|
[求助]搞了一天了,还没找到关键点,请高手指点一下!!
如要程序端请留言,或发邮件到 ldf2222#sohu.com |
|
[求助]搞了一天了,还没找到关键点,请高手指点一下!!
100039BC 90 nop 100039BD 90 nop 100039BE 90 nop 100039BF 90 nop 100039C0 /$ 51 push ecx 100039C1 |. 8B0D A0840010 mov ecx, dword ptr [100084A0] ; pjgl.10006480 100039C7 |. 53 push ebx 100039C8 |. 8B5C24 0C mov ebx, dword ptr [esp+C] 100039CC |. 55 push ebp 100039CD |. 56 push esi 100039CE |. 57 push edi 100039CF |. 894C24 10 mov dword ptr [esp+10], ecx 100039D3 |> 8B41 10 /mov eax, dword ptr [ecx+10] 100039D6 |. 83F8 FF |cmp eax, -1 100039D9 |. 0F84 85000000 |je 10003A64 100039DF |. 8B79 08 |mov edi, dword ptr [ecx+8] 100039E2 |. 8DA9 18200000 |lea ebp, dword ptr [ecx+2018] 100039E8 |. 8BF7 |mov esi, edi 100039EA |. 2BF1 |sub esi, ecx 100039EC |. 83EE 18 |sub esi, 18 100039EF |. C1FE 03 |sar esi, 3 100039F2 |. C1E6 0C |shl esi, 0C 100039F5 |. 03F0 |add esi, eax 100039F7 |. 3BFD |cmp edi, ebp 100039F9 |. 73 2E |jnb short 10003A29 100039FB |> 8B07 |/mov eax, dword ptr [edi] 100039FD |. 3BC3 ||cmp eax, ebx 100039FF |. 7C 1B ||jl short 10003A1C 10003A01 |. 395F 04 ||cmp dword ptr [edi+4], ebx 10003A04 |. 76 16 ||jbe short 10003A1C 10003A06 |. 53 ||push ebx 10003A07 |. 50 ||push eax 10003A08 |. 56 ||push esi 10003A09 |. E8 F2010000 ||call 10003C00 10003A0E |. 83C4 0C ||add esp, 0C 10003A11 |. 85C0 ||test eax, eax 10003A13 |. 75 63 ||jnz short 10003A78 10003A15 |. 8B4C24 10 ||mov ecx, dword ptr [esp+10] 10003A19 |. 895F 04 ||mov dword ptr [edi+4], ebx 10003A1C |> 83C7 08 ||add edi, 8 10003A1F |. 81C6 00100000 ||add esi, 1000 10003A25 |. 3BFD ||cmp edi, ebp 10003A27 |.^ 72 D2 |\jb short 100039FB 10003A29 |> 8B69 08 |mov ebp, dword ptr [ecx+8] 10003A2C |. 8B79 10 |mov edi, dword ptr [ecx+10] 10003A2F |. 8D71 18 |lea esi, dword ptr [ecx+18] 10003A32 |. 3BF5 |cmp esi, ebp 10003A34 |. 73 2E |jnb short 10003A64 10003A36 |> 8B06 |/mov eax, dword ptr [esi] 10003A38 |. 3BC3 ||cmp eax, ebx 10003A3A |. 7C 1B ||jl short 10003A57 10003A3C |. 395E 04 ||cmp dword ptr [esi+4], ebx 10003A3F |. 76 16 ||jbe short 10003A57 10003A41 |. 53 ||push ebx 10003A42 |. 50 ||push eax 10003A43 |. 57 ||push edi 10003A44 |. E8 B7010000 ||call 10003C00 10003A49 |. 83C4 0C ||add esp, 0C 10003A4C |. 85C0 ||test eax, eax 10003A4E |. 75 41 ||jnz short 10003A91 10003A50 |. 8B4C24 10 ||mov ecx, dword ptr [esp+10] 10003A54 |. 895E 04 ||mov dword ptr [esi+4], ebx 10003A57 |> 83C6 08 ||add esi, 8 10003A5A |. 81C7 00100000 ||add edi, 1000 10003A60 |. 3BF5 ||cmp esi, ebp 10003A62 |.^ 72 D2 |\jb short 10003A36 10003A64 |> 8B09 |mov ecx, dword ptr [ecx] 10003A66 |. A1 A0840010 |mov eax, dword ptr [100084A0] 10003A6B |. 3BC8 |cmp ecx, eax 10003A6D |. 894C24 10 |mov dword ptr [esp+10], ecx 10003A71 |. 74 37 |je short 10003AAA 10003A73 |.^ E9 5BFFFFFF \jmp 100039D3 10003A78 |> 8B4C24 10 mov ecx, dword ptr [esp+10] 10003A7C |. 890D A0840010 mov dword ptr [100084A0], ecx 10003A82 |. 8B17 mov edx, dword ptr [edi] 10003A84 |. 2BD3 sub edx, ebx 10003A86 |. 8917 mov dword ptr [edi], edx 10003A88 |. 8979 08 mov dword ptr [ecx+8], edi 10003A8B |. 5F pop edi 10003A8C |. 5E pop esi 10003A8D |. 5D pop ebp 10003A8E |. 5B pop ebx 10003A8F |. 59 pop ecx 10003A90 |. C3 retn 10003A91 |> 8B4C24 10 mov ecx, dword ptr [esp+10] 10003A95 |. 890D A0840010 mov dword ptr [100084A0], ecx 10003A9B |. 8B16 mov edx, dword ptr [esi] 10003A9D |. 2BD3 sub edx, ebx 10003A9F |. 8916 mov dword ptr [esi], edx 10003AA1 |. 8971 08 mov dword ptr [ecx+8], esi 10003AA4 |. 5F pop edi 10003AA5 |. 5E pop esi 10003AA6 |. 5D pop ebp 10003AA7 |. 5B pop ebx 10003AA8 |. 59 pop ecx 10003AA9 |. C3 retn 10003AAA |> BD 80640010 mov ebp, 10006480 10003AAF |. 83C9 FF or ecx, FFFFFFFF 10003AB2 |> 394D 10 /cmp dword ptr [ebp+10], ecx 10003AB5 |. 74 07 |je short 10003ABE 10003AB7 |. 8B45 0C |mov eax, dword ptr [ebp+C] 10003ABA |. 85C0 |test eax, eax 10003ABC |. 75 11 |jnz short 10003ACF 10003ABE |> 8B6D 00 |mov ebp, dword ptr [ebp] 10003AC1 |. 81FD 80640010 |cmp ebp, 10006480 10003AC7 |. 0F84 E0000000 |je 10003BAD 10003ACD |.^ EB E3 \jmp short 10003AB2 10003ACF |> 8B45 0C mov eax, dword ptr [ebp+C] 10003AD2 |. 8B75 10 mov esi, dword ptr [ebp+10] 10003AD5 |. 8BF8 mov edi, eax 10003AD7 |. 894424 18 mov dword ptr [esp+18], eax 10003ADB |. 2BFD sub edi, ebp 10003ADD |. 8B10 mov edx, dword ptr [eax] 10003ADF |. 83EF 18 sub edi, 18 10003AE2 |. C1FF 03 sar edi, 3 10003AE5 |. C1E7 0C shl edi, 0C 10003AE8 |. 03FE add edi, esi 10003AEA |. 33F6 xor esi, esi 10003AEC |. 3BD1 cmp edx, ecx 10003AEE |. 75 10 jnz short 10003B00 10003AF0 |> 83FE 10 /cmp esi, 10 10003AF3 |. 7D 0B |jge short 10003B00 10003AF5 |. 8B50 08 |mov edx, dword ptr [eax+8] 10003AF8 |. 83C0 08 |add eax, 8 10003AFB |. 46 |inc esi 10003AFC |. 3BD1 |cmp edx, ecx 10003AFE |.^ 74 F0 \je short 10003AF0 10003B00 |> 8BC6 mov eax, esi 10003B02 |. 6A 04 push 4 ; /Protect = PAGE_READWRITE 10003B04 |. C1E0 0C shl eax, 0C ; | 10003B07 |. 68 00100000 push 1000 ; |AllocationType = MEM_COMMIT 10003B0C |. 50 push eax ; |Size 10003B0D |. 57 push edi ; |Address 10003B0E |. 894424 20 mov dword ptr [esp+20], eax ; | 10003B12 |. FF15 88500010 call dword ptr [<&KERNEL32.VirtualAll>; \VirtualAlloc 10003B18 |. 3BC7 cmp eax, edi 10003B1A |. 0F85 CB000000 jnz 10003BEB 10003B20 |. 8B5424 18 mov edx, dword ptr [esp+18] 10003B24 |. 8B4424 10 mov eax, dword ptr [esp+10] 10003B28 |. 33C9 xor ecx, ecx 10003B2A |. 85F6 test esi, esi 10003B2C |. 8BCA mov ecx, edx 10003B2E |. 7E 32 jle short 10003B62 10003B30 |. 8D47 04 lea eax, dword ptr [edi+4] 10003B33 |> 8D50 04 /lea edx, dword ptr [eax+4] 10003B36 |. C700 F0000000 |mov dword ptr [eax], 0F0 10003B3C |. 8950 FC |mov dword ptr [eax-4], edx 10003B3F |. C680 F4000000>|mov byte ptr [eax+F4], 0FF 10003B46 |. C701 F0000000 |mov dword ptr [ecx], 0F0 10003B4C |. C741 04 F1000>|mov dword ptr [ecx+4], 0F1 10003B53 |. 05 00100000 |add eax, 1000 10003B58 |. 83C1 08 |add ecx, 8 10003B5B |. 4E |dec esi 10003B5C |.^ 75 D5 \jnz short 10003B33 10003B5E |. 8B5424 18 mov edx, dword ptr [esp+18] 10003B62 |> 8D85 18200000 lea eax, dword ptr [ebp+2018] 10003B68 |. 892D A0840010 mov dword ptr [100084A0], ebp 10003B6E |. 3BC8 cmp ecx, eax 10003B70 |. 73 0E jnb short 10003B80 10003B72 |> 8339 FF /cmp dword ptr [ecx], -1 10003B75 |. 74 07 |je short 10003B7E 10003B77 |. 83C1 08 |add ecx, 8 10003B7A |. 3BC8 |cmp ecx, eax 10003B7C |.^ 72 F4 \jb short 10003B72 10003B7E |> 3BC8 cmp ecx, eax 10003B80 |> 1BC0 sbb eax, eax 10003B82 |. 23C1 and eax, ecx 10003B84 |. 8945 0C mov dword ptr [ebp+C], eax 10003B87 |. 885F 08 mov byte ptr [edi+8], bl 10003B8A |. 8955 08 mov dword ptr [ebp+8], edx 10003B8D |. 8B0A mov ecx, dword ptr [edx] 10003B8F |. 2BCB sub ecx, ebx 10003B91 |. 890A mov dword ptr [edx], ecx 10003B93 |. 8B47 04 mov eax, dword ptr [edi+4] 10003B96 |. 2BC3 sub eax, ebx 10003B98 |. 8D4C1F 08 lea ecx, dword ptr [edi+ebx+8] 10003B9C |. 8947 04 mov dword ptr [edi+4], eax 10003B9F |. 890F mov dword ptr [edi], ecx 10003BA1 |. 8D87 00010000 lea eax, dword ptr [edi+100] 10003BA7 |. 5F pop edi 10003BA8 |. 5E pop esi 10003BA9 |. 5D pop ebp 10003BAA |. 5B pop ebx 10003BAB |. 59 pop ecx 10003BAC |. C3 retn 10003BAD |> E8 AEFAFFFF call 10003660 10003BB2 |. 85C0 test eax, eax 10003BB4 |. 74 35 je short 10003BEB 10003BB6 |. 8B48 10 mov ecx, dword ptr [eax+10] 10003BB9 |. 8859 08 mov byte ptr [ecx+8], bl 10003BBC |. 8D5419 08 lea edx, dword ptr [ecx+ebx+8] 10003BC0 |. A3 A0840010 mov dword ptr [100084A0], eax 10003BC5 |. 8911 mov dword ptr [ecx], edx 10003BC7 |. BA F0000000 mov edx, 0F0 10003BCC |. 2BD3 sub edx, ebx 10003BCE |. 81E3 FF000000 and ebx, 0FF 10003BD4 |. 8951 04 mov dword ptr [ecx+4], edx 10003BD7 |. 8B50 18 mov edx, dword ptr [eax+18] 10003BDA |. 2BD3 sub edx, ebx 10003BDC |. 8950 18 mov dword ptr [eax+18], edx 10003BDF |. 8D81 00010000 lea eax, dword ptr [ecx+100] 10003BE5 |. 5F pop edi 10003BE6 |. 5E pop esi 10003BE7 |. 5D pop ebp 10003BE8 |. 5B pop ebx 10003BE9 |. 59 pop ecx 10003BEA |. C3 retn 10003BEB |> 5F pop edi 10003BEC |. 5E pop esi 10003BED |. 5D pop ebp 10003BEE |. 33C0 xor eax, eax 10003BF0 |. 5B pop ebx 10003BF1 |. 59 pop ecx 10003BF2 \. C3 retn 10003BF3 90 nop 10003BF4 90 nop 10003BF5 90 nop 10003BF6 90 nop 10003BF7 90 nop 10003BF8 90 nop 10003BF9 90 nop 10003BFA 90 nop 10003BFB 90 nop 10003BFC 90 nop 10003BFD 90 nop 10003BFE 90 nop 10003BFF 90 nop 10003C00 /$ 8B5424 0C mov edx, dword ptr [esp+C] 10003C04 |. 53 push ebx 10003C05 |. 55 push ebp 10003C06 |. 56 push esi 10003C07 |. 57 push edi 10003C08 |. 8B7C24 14 mov edi, dword ptr [esp+14] 10003C0C |. 8B47 04 mov eax, dword ptr [edi+4] 10003C0F |. 8B0F mov ecx, dword ptr [edi] 10003C11 |. 3BC2 cmp eax, edx 10003C13 |. 894C24 14 mov dword ptr [esp+14], ecx 10003C17 |. 8BF1 mov esi, ecx 10003C19 |. 8D9F F8000000 lea ebx, dword ptr [edi+F8] 10003C1F |. 72 3A jb short 10003C5B 10003C21 |. 8D0411 lea eax, dword ptr [ecx+edx] 10003C24 |. 8811 mov byte ptr [ecx], dl 10003C26 |. 3BC3 cmp eax, ebx 10003C28 |. 73 10 jnb short 10003C3A 10003C2A |. 8B37 mov esi, dword ptr [edi] 10003C2C |. 8B47 04 mov eax, dword ptr [edi+4] 10003C2F |. 03F2 add esi, edx 10003C31 |. 2BC2 sub eax, edx 10003C33 |. 8937 mov dword ptr [edi], esi 10003C35 |. 8947 04 mov dword ptr [edi+4], eax 10003C38 |. EB 0C jmp short 10003C46 10003C3A |> 8D57 08 lea edx, dword ptr [edi+8] 10003C3D |. C747 04 00000>mov dword ptr [edi+4], 0 10003C44 |. 8917 mov dword ptr [edi], edx 10003C46 |> 8D047F lea eax, dword ptr [edi+edi*2] 10003C49 |. 8D0480 lea eax, dword ptr [eax+eax*4] 10003C4C |. 8BD0 mov edx, eax 10003C4E |. 8D41 08 lea eax, dword ptr [ecx+8] 10003C51 |. C1E0 04 shl eax, 4 10003C54 |. 2BC2 sub eax, edx 10003C56 |. 5F pop edi 10003C57 |. 5E pop esi 10003C58 |. 5D pop ebp 10003C59 |. 5B pop ebx 10003C5A |. C3 retn 10003C5B |> 03C1 add eax, ecx 10003C5D |. 8038 00 cmp byte ptr [eax], 0 10003C60 |. 74 02 je short 10003C64 10003C62 |. 8BF0 mov esi, eax 10003C64 |> 8D0416 lea eax, dword ptr [esi+edx] 10003C67 |. 3BC3 cmp eax, ebx 10003C69 |. 8B5C24 18 mov ebx, dword ptr [esp+18] 10003C6D |. 73 75 jnb short 10003CE4 10003C6F |> 8A06 /mov al, byte ptr [esi] 10003C71 |. 84C0 |test al, al 10003C73 |. 75 3C |jnz short 10003CB1 10003C75 |. 807E 01 00 |cmp byte ptr [esi+1], 0 10003C79 |. 8D46 01 |lea eax, dword ptr [esi+1] 10003C7C |. B9 01000000 |mov ecx, 1 10003C81 |. 75 07 |jnz short 10003C8A 10003C83 |> 40 |/inc eax 10003C84 |. 41 ||inc ecx 10003C85 |. 8038 00 ||cmp byte ptr [eax], 0 10003C88 |.^ 74 F9 |\je short 10003C83 10003C8A |> 3BCA |cmp ecx, edx 10003C8C |. 73 39 |jnb short 10003CC7 10003C8E |. 8B6C24 14 |mov ebp, dword ptr [esp+14] 10003C92 |. 3BF5 |cmp esi, ebp 10003C94 |. 75 09 |jnz short 10003C9F 10003C96 |. 894F 04 |mov dword ptr [edi+4], ecx 10003C99 |. 8BF0 |mov esi, eax 10003C9B |. 8BCD |mov ecx, ebp 10003C9D |. EB 19 |jmp short 10003CB8 10003C9F |> 2BD9 |sub ebx, ecx 10003CA1 |. 3BDA |cmp ebx, edx 10003CA3 |. 0F82 C2000000 |jb 10003D6B 10003CA9 |. 8B4C24 14 |mov ecx, dword ptr [esp+14] 10003CAD |. 8BF0 |mov esi, eax 10003CAF |. EB 07 |jmp short 10003CB8 10003CB1 |> 25 FF000000 |and eax, 0FF 10003CB6 |. 03F0 |add esi, eax 10003CB8 |> 8D2C16 |lea ebp, dword ptr [esi+edx] 10003CBB |. 8D87 F8000000 |lea eax, dword ptr [edi+F8] 10003CC1 |. 3BE8 |cmp ebp, eax 10003CC3 |.^ 72 AA \jb short 10003C6F 10003CC5 |. EB 1D jmp short 10003CE4 10003CC7 |> 8D0416 lea eax, dword ptr [esi+edx] 10003CCA |. 8D9F F8000000 lea ebx, dword ptr [edi+F8] 10003CD0 |. 3BC3 cmp eax, ebx 10003CD2 |. 73 09 jnb short 10003CDD 10003CD4 |. 2BCA sub ecx, edx 10003CD6 |. 8907 mov dword ptr [edi], eax 10003CD8 |. 894F 04 mov dword ptr [edi+4], ecx 10003CDB |. EB 79 jmp short 10003D56 10003CDD |> 8D4F 08 lea ecx, dword ptr [edi+8] 10003CE0 |. 890F mov dword ptr [edi], ecx 10003CE2 |. EB 6B jmp short 10003D4F 10003CE4 |> 8D6F 08 lea ebp, dword ptr [edi+8] 10003CE7 |. 8BF5 mov esi, ebp 10003CE9 |. 3BF1 cmp esi, ecx 10003CEB |. 73 7E jnb short 10003D6B 10003CED |> 8D0C16 /lea ecx, dword ptr [esi+edx] 10003CF0 |. 8D87 F8000000 |lea eax, dword ptr [edi+F8] 10003CF6 |. 3BC8 |cmp ecx, eax 10003CF8 |. 73 71 |jnb short 10003D6B 10003CFA |. 8A06 |mov al, byte ptr [esi] 10003CFC |. 84C0 |test al, al 10003CFE |. 75 23 |jnz short 10003D23 10003D00 |. 807E 01 00 |cmp byte ptr [esi+1], 0 10003D04 |. 8D46 01 |lea eax, dword ptr [esi+1] 10003D07 |. B9 01000000 |mov ecx, 1 10003D0C |. 75 07 |jnz short 10003D15 10003D0E |> 40 |/inc eax 10003D0F |. 41 ||inc ecx 10003D10 |. 8038 00 ||cmp byte ptr [eax], 0 10003D13 |.^ 74 F9 |\je short 10003D0E 10003D15 |> 3BCA |cmp ecx, edx 10003D17 |. 73 1E |jnb short 10003D37 10003D19 |. 2BD9 |sub ebx, ecx 10003D1B |. 3BDA |cmp ebx, edx 10003D1D |. 72 4C |jb short 10003D6B 10003D1F |. 8BF0 |mov esi, eax 10003D21 |. EB 07 |jmp short 10003D2A 10003D23 |> 25 FF000000 |and eax, 0FF 10003D28 |. 03F0 |add esi, eax 10003D2A |> 3B7424 14 |cmp esi, dword ptr [esp+14] 10003D2E |.^ 72 BD \jb short 10003CED 10003D30 |. 33C0 xor eax, eax 10003D32 |. 5F pop edi 10003D33 |. 5E pop esi 10003D34 |. 5D pop ebp 10003D35 |. 5B pop ebx 10003D36 |. C3 retn 10003D37 |> 8D0416 lea eax, dword ptr [esi+edx] 10003D3A |. 8D9F F8000000 lea ebx, dword ptr [edi+F8] 10003D40 |. 3BC3 cmp eax, ebx 10003D42 |. 73 09 jnb short 10003D4D 10003D44 |. 2BCA sub ecx, edx 10003D46 |. 8907 mov dword ptr [edi], eax 10003D48 |. 894F 04 mov dword ptr [edi+4], ecx 10003D4B |. EB 09 jmp short 10003D56 10003D4D |> 892F mov dword ptr [edi], ebp 10003D4F |> C747 04 00000>mov dword ptr [edi+4], 0 10003D56 |> 8D047F lea eax, dword ptr [edi+edi*2] 10003D59 |. 8816 mov byte ptr [esi], dl 10003D5B |. 8D1480 lea edx, dword ptr [eax+eax*4] 10003D5E |. 8D46 08 lea eax, dword ptr [esi+8] 10003D61 |. C1E0 04 shl eax, 4 10003D64 |. 2BC2 sub eax, edx 10003D66 |. 5F pop edi 10003D67 |. 5E pop esi 10003D68 |. 5D pop ebp 10003D69 |. 5B pop ebx 10003D6A |. C3 retn 10003D6B |> 5F pop edi 10003D6C |. 5E pop esi 10003D6D |. 5D pop ebp 10003D6E |. 33C0 xor eax, eax 10003D70 |. 5B pop ebx 10003D71 \. C3 retn 10003D72 90 nop 10003D73 90 nop 10003D74 90 nop 10003D75 90 nop 10003D76 90 nop 10003D77 90 nop 10003D78 90 nop 10003D79 90 nop 10003D7A 90 nop 10003D7B 90 nop 10003D7C 90 nop 10003D7D 90 nop 10003D7E 90 nop 10003D7F 90 nop 10003D80 /$ A1 7C880010 mov eax, dword ptr [1000887C] 10003D85 |. 53 push ebx 10003D86 |. 33DB xor ebx, ebx 10003D88 |. 56 push esi 10003D89 |. 85C0 test eax, eax 10003D8B |. 57 push edi 10003D8C |. 75 42 jnz short 10003DD0 10003D8E |. 68 D4530010 push 100053D4 ; /FileName = "user32.dll" 10003D93 |. FF15 70500010 call dword ptr [<&KERNEL32.LoadLibrar>; \LoadLibraryA 10003D99 |. 8BF0 mov esi, eax 10003D9B |. 85F6 test esi, esi 10003D9D |. 74 6A je short 10003E09 10003D9F |. 8B3D 8C500010 mov edi, dword ptr [<&KERNEL32.GetPr>; kernel32.GetProcAddress 10003DA5 |. 68 C8530010 push 100053C8 ; /ProcNameOrOrdinal = "MessageBoxA" 10003DAA |. 56 push esi ; |hModule 10003DAB |. FFD7 call edi ; \GetProcAddress 10003DAD |. 85C0 test eax, eax 10003DAF |. A3 7C880010 mov dword ptr [1000887C], eax 10003DB4 |. 74 53 je short 10003E09 10003DB6 |. 68 B8530010 push 100053B8 ; /ProcNameOrOrdinal = "GetActiveWindow" 10003DBB |. 56 push esi ; |hModule 10003DBC |. FFD7 call edi ; \GetProcAddress 10003DBE |. 68 A4530010 push 100053A4 ; /ProcNameOrOrdinal = "GetLastActivePopup" 10003DC3 |. 56 push esi ; |hModule 10003DC4 |. A3 80880010 mov dword ptr [10008880], eax ; | 10003DC9 |. FFD7 call edi ; \GetProcAddress 10003DCB |. A3 84880010 mov dword ptr [10008884], eax 10003DD0 |> A1 80880010 mov eax, dword ptr [10008880] 10003DD5 |. 85C0 test eax, eax 10003DD7 |. 74 04 je short 10003DDD 10003DD9 |. FFD0 call eax 10003DDB |. 8BD8 mov ebx, eax 10003DDD |> 85DB test ebx, ebx 10003DDF |. 74 0E je short 10003DEF 10003DE1 |. A1 84880010 mov eax, dword ptr [10008884] 10003DE6 |. 85C0 test eax, eax 10003DE8 |. 74 05 je short 10003DEF 10003DEA |. 53 push ebx 10003DEB |. FFD0 call eax 10003DED |. 8BD8 mov ebx, eax 10003DEF |> 8B4424 18 mov eax, dword ptr [esp+18] 10003DF3 |. 8B4C24 14 mov ecx, dword ptr [esp+14] 10003DF7 |. 8B5424 10 mov edx, dword ptr [esp+10] 10003DFB |. 50 push eax 10003DFC |. 51 push ecx 10003DFD |. 52 push edx 10003DFE |. 53 push ebx 10003DFF |. FF15 7C880010 call dword ptr [1000887C] 10003E05 |. 5F pop edi 10003E06 |. 5E pop esi 10003E07 |. 5B pop ebx 10003E08 |. C3 retn 10003E09 |> 5F pop edi 10003E0A |. 5E pop esi 10003E0B |. 33C0 xor eax, eax 10003E0D |. 5B pop ebx 10003E0E \. C3 retn 10003E0F 90 nop 10003E10 . 55 push ebp 10003E11 . 8BEC mov ebp, esp 10003E13 . 57 push edi 10003E14 . 56 push esi 10003E15 . 8B75 0C mov esi, dword ptr [ebp+C] 10003E18 . 8B4D 10 mov ecx, dword ptr [ebp+10] 10003E1B . 8B7D 08 mov edi, dword ptr [ebp+8] 10003E1E . 8BC1 mov eax, ecx 10003E20 . 8BD1 mov edx, ecx 10003E22 . 03C6 add eax, esi 10003E24 . 3BFE cmp edi, esi 10003E26 . 76 08 jbe short 10003E30 10003E28 . 3BF8 cmp edi, eax 10003E2A . 0F82 78010000 jb 10003FA8 10003E30 > F7C7 03000000 test edi, 3 10003E36 . 75 14 jnz short 10003E4C 10003E38 . C1E9 02 shr ecx, 2 10003E3B . 83E2 03 and edx, 3 10003E3E . 83F9 08 cmp ecx, 8 10003E41 . 72 29 jb short 10003E6C 10003E43 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003E45 . FF2495 583F00>jmp dword ptr [edx*4+10003F58] 10003E4C > 8BC7 mov eax, edi 10003E4E . BA 03000000 mov edx, 3 10003E53 . 83E9 04 sub ecx, 4 10003E56 . 72 0C jb short 10003E64 10003E58 . 83E0 03 and eax, 3 10003E5B . 03C8 add ecx, eax 10003E5D . FF2485 703E00>jmp dword ptr [eax*4+10003E70] 10003E64 > FF248D 683F00>jmp dword ptr [ecx*4+10003F68] 10003E6B 90 nop 10003E6C > FF248D EC3E00>jmp dword ptr [ecx*4+10003EEC] 10003E73 90 nop 10003E74 . 803E0010 dd pjgl.10003E80 ; 分支表 (1-based) 被用于 10003E5D 10003E78 . AC3E0010 dd pjgl.10003EAC 10003E7C . D03E0010 dd pjgl.10003ED0 10003E80 > 23D1 and edx, ecx 10003E82 . 8A06 mov al, byte ptr [esi] 10003E84 . 8807 mov byte ptr [edi], al 10003E86 . 8A46 01 mov al, byte ptr [esi+1] 10003E89 . 8847 01 mov byte ptr [edi+1], al 10003E8C . 8A46 02 mov al, byte ptr [esi+2] 10003E8F . C1E9 02 shr ecx, 2 10003E92 . 8847 02 mov byte ptr [edi+2], al 10003E95 . 83C6 03 add esi, 3 10003E98 . 83C7 03 add edi, 3 10003E9B . 83F9 08 cmp ecx, 8 10003E9E .^ 72 CC jb short 10003E6C 10003EA0 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003EA2 . FF2495 583F00>jmp dword ptr [edx*4+10003F58] 10003EA9 . 2E:8BC0 mov eax, eax 10003EAC > 23D1 and edx, ecx 10003EAE . 8A06 mov al, byte ptr [esi] 10003EB0 . 8807 mov byte ptr [edi], al 10003EB2 . 8A46 01 mov al, byte ptr [esi+1] 10003EB5 . C1E9 02 shr ecx, 2 10003EB8 . 8847 01 mov byte ptr [edi+1], al 10003EBB . 83C6 02 add esi, 2 10003EBE . 83C7 02 add edi, 2 10003EC1 . 83F9 08 cmp ecx, 8 10003EC4 .^ 72 A6 jb short 10003E6C 10003EC6 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003EC8 . FF2495 583F00>jmp dword ptr [edx*4+10003F58] 10003ECF 90 nop 10003ED0 > 23D1 and edx, ecx 10003ED2 . 8A06 mov al, byte ptr [esi] 10003ED4 . 8807 mov byte ptr [edi], al 10003ED6 . 46 inc esi 10003ED7 . C1E9 02 shr ecx, 2 10003EDA . 47 inc edi 10003EDB . 83F9 08 cmp ecx, 8 10003EDE .^ 72 8C jb short 10003E6C 10003EE0 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003EE2 . FF2495 583F00>jmp dword ptr [edx*4+10003F58] 10003EE9 2E db 2E ; CHAR '.' 10003EEA 8BC0 mov eax, eax 10003EEC . 4F3F0010 dd pjgl.10003F4F ; 分支表 被用于 10003E6C 10003EF0 . 3C3F0010 dd pjgl.10003F3C 10003EF4 . 343F0010 dd pjgl.10003F34 10003EF8 . 2C3F0010 dd pjgl.10003F2C 10003EFC . 243F0010 dd pjgl.10003F24 10003F00 . 1C3F0010 dd pjgl.10003F1C 10003F04 . 143F0010 dd pjgl.10003F14 10003F08 . 0C3F0010 dd pjgl.10003F0C 10003F0C > 8B448E E4 mov eax, dword ptr [esi+ecx*4-1C] 10003F10 . 89448F E4 mov dword ptr [edi+ecx*4-1C], eax 10003F14 > 8B448E E8 mov eax, dword ptr [esi+ecx*4-18] 10003F18 . 89448F E8 mov dword ptr [edi+ecx*4-18], eax 10003F1C > 8B448E EC mov eax, dword ptr [esi+ecx*4-14] 10003F20 . 89448F EC mov dword ptr [edi+ecx*4-14], eax 10003F24 > 8B448E F0 mov eax, dword ptr [esi+ecx*4-10] 10003F28 . 89448F F0 mov dword ptr [edi+ecx*4-10], eax 10003F2C > 8B448E F4 mov eax, dword ptr [esi+ecx*4-C] 10003F30 . 89448F F4 mov dword ptr [edi+ecx*4-C], eax 10003F34 > 8B448E F8 mov eax, dword ptr [esi+ecx*4-8] 10003F38 . 89448F F8 mov dword ptr [edi+ecx*4-8], eax 10003F3C > 8B448E FC mov eax, dword ptr [esi+ecx*4-4] 10003F40 . 89448F FC mov dword ptr [edi+ecx*4-4], eax 10003F44 . 8D048D 000000>lea eax, dword ptr [ecx*4] 10003F4B . 03F0 add esi, eax 10003F4D . 03F8 add edi, eax 10003F4F > FF2495 583F00>jmp dword ptr [edx*4+10003F58] 10003F56 8BC0 mov eax, eax 10003F58 . 683F0010 dd pjgl.10003F68 ; 分支表 被用于 10003EA2 10003F5C . 703F0010 dd pjgl.10003F70 10003F60 . 7C3F0010 dd pjgl.10003F7C 10003F64 . 903F0010 dd pjgl.10003F90 10003F68 > 8B45 08 mov eax, dword ptr [ebp+8] 10003F6B . 5E pop esi 10003F6C . 5F pop edi 10003F6D . C9 leave 10003F6E . C3 retn 10003F6F 90 nop 10003F70 > 8A06 mov al, byte ptr [esi] 10003F72 . 8807 mov byte ptr [edi], al 10003F74 . 8B45 08 mov eax, dword ptr [ebp+8] 10003F77 . 5E pop esi 10003F78 . 5F pop edi 10003F79 . C9 leave 10003F7A . C3 retn 10003F7B 90 nop 10003F7C > 8A06 mov al, byte ptr [esi] 10003F7E . 8807 mov byte ptr [edi], al 10003F80 . 8A46 01 mov al, byte ptr [esi+1] 10003F83 . 8847 01 mov byte ptr [edi+1], al 10003F86 . 8B45 08 mov eax, dword ptr [ebp+8] 10003F89 . 5E pop esi 10003F8A . 5F pop edi 10003F8B . C9 leave 10003F8C . C3 retn 10003F8D . 2E:8BC0 mov eax, eax 10003F90 > 8A06 mov al, byte ptr [esi] 10003F92 . 8807 mov byte ptr [edi], al 10003F94 . 8A46 01 mov al, byte ptr [esi+1] 10003F97 . 8847 01 mov byte ptr [edi+1], al 10003F9A . 8A46 02 mov al, byte ptr [esi+2] 10003F9D . 8847 02 mov byte ptr [edi+2], al 10003FA0 . 8B45 08 mov eax, dword ptr [ebp+8] 10003FA3 . 5E pop esi 10003FA4 . 5F pop edi 10003FA5 . C9 leave 10003FA6 . C3 retn 10003FA7 90 nop 10003FA8 > 8D7431 FC lea esi, dword ptr [ecx+esi-4] 10003FAC . 8D7C39 FC lea edi, dword ptr [ecx+edi-4] 10003FB0 . F7C7 03000000 test edi, 3 10003FB6 . 75 24 jnz short 10003FDC 10003FB8 . C1E9 02 shr ecx, 2 10003FBB . 83E2 03 and edx, 3 10003FBE . 83F9 08 cmp ecx, 8 10003FC1 . 72 0D jb short 10003FD0 10003FC3 . FD std 10003FC4 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003FC6 . FC cld 10003FC7 . FF2495 F04000>jmp dword ptr [edx*4+100040F0] 10003FCE 8BC0 mov eax, eax 10003FD0 > F7D9 neg ecx 10003FD2 . FF248D A04000>jmp dword ptr [ecx*4+100040A0] 10003FD9 . 2E:8BC0 mov eax, eax 10003FDC > 8BC7 mov eax, edi 10003FDE . BA 03000000 mov edx, 3 ; Switch (cases 0..3) 10003FE3 . 83F9 04 cmp ecx, 4 10003FE6 . 72 0C jb short 10003FF4 10003FE8 . 83E0 03 and eax, 3 ; Default case of switch 10003FDE 10003FEB . 2BC8 sub ecx, eax 10003FED . FF2485 F83F00>jmp dword ptr [eax*4+10003FF8] 10003FF4 > FF248D F04000>jmp dword ptr [ecx*4+100040F0] 10003FFB 90 db 90 10003FFC . 08400010 dd pjgl.10004008 ; 分支表 (1-based) 被用于 10003FED 10004000 . 28400010 dd pjgl.10004028 10004004 . 50400010 dd pjgl.10004050 10004008 > 8A46 03 mov al, byte ptr [esi+3] 1000400B . 23D1 and edx, ecx 1000400D . 8847 03 mov byte ptr [edi+3], al 10004010 . 4E dec esi 10004011 . C1E9 02 shr ecx, 2 10004014 . 4F dec edi 10004015 . 83F9 08 cmp ecx, 8 10004018 .^ 72 B6 jb short 10003FD0 1000401A . FD std 1000401B . F3:A5 rep movs dword ptr es:[edi], dword p> 1000401D . FC cld 1000401E . FF2495 F04000>jmp dword ptr [edx*4+100040F0] 10004025 . 2E:8BC0 mov eax, eax 10004028 > 8A46 03 mov al, byte ptr [esi+3] 1000402B . 23D1 and edx, ecx 1000402D . 8847 03 mov byte ptr [edi+3], al 10004030 . 8A46 02 mov al, byte ptr [esi+2] 10004033 . C1E9 02 shr ecx, 2 10004036 . 8847 02 mov byte ptr [edi+2], al 10004039 . 83EE 02 sub esi, 2 1000403C . 83EF 02 sub edi, 2 1000403F . 83F9 08 cmp ecx, 8 10004042 .^ 72 8C jb short 10003FD0 10004044 . FD std 10004045 . F3:A5 rep movs dword ptr es:[edi], dword p> 10004047 . FC cld 10004048 . FF2495 F04000>jmp dword ptr [edx*4+100040F0] 1000404F 90 nop 10004050 > 8A46 03 mov al, byte ptr [esi+3] 10004053 . 23D1 and edx, ecx 10004055 . 8847 03 mov byte ptr [edi+3], al 10004058 . 8A46 02 mov al, byte ptr [esi+2] 1000405B . 8847 02 mov byte ptr [edi+2], al 1000405E . 8A46 01 mov al, byte ptr [esi+1] 10004061 . C1E9 02 shr ecx, 2 10004064 . 8847 01 mov byte ptr [edi+1], al 10004067 . 83EE 03 sub esi, 3 1000406A . 83EF 03 sub edi, 3 1000406D . 83F9 08 cmp ecx, 8 10004070 .^ 0F82 5AFFFFFF jb 10003FD0 10004076 . FD std 10004077 . F3:A5 rep movs dword ptr es:[edi], dword p> 10004079 . FC cld 1000407A . FF2495 F04000>jmp dword ptr [edx*4+100040F0] 10004081 2E db 2E ; CHAR '.' 10004082 8BC0 mov eax, eax 10004084 . A4400010 dd pjgl.100040A4 10004088 . AC400010 dd pjgl.100040AC 1000408C . B4400010 dd pjgl.100040B4 10004090 . BC400010 dd pjgl.100040BC 10004094 . C4400010 dd pjgl.100040C4 10004098 . CC400010 dd pjgl.100040CC 1000409C . D4400010 dd pjgl.100040D4 100040A0 . E7400010 dd pjgl.100040E7 100040A4 > 8B448E 1C mov eax, dword ptr [esi+ecx*4+1C] 100040A8 . 89448F 1C mov dword ptr [edi+ecx*4+1C], eax 100040AC > 8B448E 18 mov eax, dword ptr [esi+ecx*4+18] 100040B0 . 89448F 18 mov dword ptr [edi+ecx*4+18], eax 100040B4 > 8B448E 14 mov eax, dword ptr [esi+ecx*4+14] 100040B8 . 89448F 14 mov dword ptr [edi+ecx*4+14], eax 100040BC > 8B448E 10 mov eax, dword ptr [esi+ecx*4+10] 100040C0 . 89448F 10 mov dword ptr [edi+ecx*4+10], eax 100040C4 > 8B448E 0C mov eax, dword ptr [esi+ecx*4+C] 100040C8 . 89448F 0C mov dword ptr [edi+ecx*4+C], eax 100040CC > 8B448E 08 mov eax, dword ptr [esi+ecx*4+8] 100040D0 . 89448F 08 mov dword ptr [edi+ecx*4+8], eax 100040D4 > 8B448E 04 mov eax, dword ptr [esi+ecx*4+4] 100040D8 . 89448F 04 mov dword ptr [edi+ecx*4+4], eax 100040DC . 8D048D 000000>lea eax, dword ptr [ecx*4] 100040E3 . 03F0 add esi, eax 100040E5 . 03F8 add edi, eax 100040E7 > FF2495 F04000>jmp dword ptr [edx*4+100040F0] 100040EE 8BC0 mov eax, eax 100040F0 . 00410010 dd pjgl.10004100 ; 分支表 被用于 10003FF4 100040F4 . 08410010 dd pjgl.10004108 100040F8 . 18410010 dd pjgl.10004118 100040FC . 2C410010 dd pjgl.1000412C 10004100 > 8B45 08 mov eax, dword ptr [ebp+8] ; Case 0 of switch 10003FDE 10004103 . 5E pop esi 10004104 . 5F pop edi 10004105 . C9 leave 10004106 . C3 retn 10004107 90 nop 10004108 > 8A46 03 mov al, byte ptr [esi+3] ; Case 1 of switch 10003FDE 1000410B . 8847 03 mov byte ptr [edi+3], al 1000410E . 8B45 08 mov eax, dword ptr [ebp+8] 10004111 . 5E pop esi 10004112 . 5F pop edi 10004113 . C9 leave 10004114 . C3 retn 10004115 . 2E:8BC0 mov eax, eax 10004118 > 8A46 03 mov al, byte ptr [esi+3] ; Case 2 of switch 10003FDE 1000411B . 8847 03 mov byte ptr [edi+3], al 1000411E . 8A46 02 mov al, byte ptr [esi+2] 10004121 . 8847 02 mov byte ptr [edi+2], al 10004124 . 8B45 08 mov eax, dword ptr [ebp+8] 10004127 . 5E pop esi 10004128 . 5F pop edi 10004129 . C9 leave 1000412A . C3 retn 1000412B 90 nop 1000412C > 8A46 03 mov al, byte ptr [esi+3] ; Case 3 of switch 10003FDE 1000412F . 8847 03 mov byte ptr [edi+3], al 10004132 . 8A46 02 mov al, byte ptr [esi+2] 10004135 . 8847 02 mov byte ptr [edi+2], al 10004138 . 8A46 01 mov al, byte ptr [esi+1] 1000413B . 8847 01 mov byte ptr [edi+1], al 1000413E . 8B45 08 mov eax, dword ptr [ebp+8] 10004141 . 5E pop esi 10004142 . 5F pop edi 10004143 . C9 leave 10004144 . C3 retn 10004145 CC int3 10004146 CC int3 10004147 CC int3 10004148 CC int3 10004149 CC int3 1000414A CC int3 1000414B CC int3 1000414C CC int3 1000414D CC int3 1000414E CC int3 1000414F CC int3 10004150 /$ 53 push ebx 10004151 |. 55 push ebp 10004152 |. 56 push esi 10004153 |. 8B7424 14 mov esi, dword ptr [esp+14] 10004157 |. 0FAF7424 10 imul esi, dword ptr [esp+10] 1000415C |. 83FE E0 cmp esi, -20 ; Switch (cases 0..FFFFFFFF) 1000415F |. 57 push edi 10004160 |. 77 11 ja short 10004173 10004162 |. 85F6 test esi, esi 10004164 |. 76 08 jbe short 1000416E 10004166 |. 83C6 0F add esi, 0F ; Default case of switch 1000415C 10004169 |. 83E6 F0 and esi, FFFFFFF0 1000416C |. EB 05 jmp short 10004173 1000416E |> BE 10000000 mov esi, 10 ; Case 0 of switch 1000415C 10004173 |> 8B1D 84500010 mov ebx, dword ptr [<&KERNEL32.HeapA>; ntdll.RtlAllocateHeap; Cases FFFFFFE1,FFFFFFE2,FFFFFFE3,FFFFFFE4,FFFFFFE5,FFFFFFE6,FFFFFFE7,FFFFFFE8,FFFFFFE9,FFFFFFEA,FFFFFFEB,FFFFFFEC,FFFFFFED,FFFFFFEE,FFFFFFEF,FFFFFFF0,FFFFFFF1,FFFFFFF2,FFFFFFF3,FFFFFFF4... of switch 1000415C 10004179 |> 33D2 /xor edx, edx 1000417B |. 83FE E0 |cmp esi, -20 1000417E |. 77 42 |ja short 100041C2 10004180 |. 3B35 A4840010 |cmp esi, dword ptr [100084A4] 10004186 |. 77 28 |ja short 100041B0 10004188 |. 8BC6 |mov eax, esi 1000418A |. C1E8 04 |shr eax, 4 1000418D |. 50 |push eax 1000418E |. E8 2DF8FFFF |call 100039C0 10004193 |. 8BD0 |mov edx, eax 10004195 |. 83C4 04 |add esp, 4 10004198 |. 85D2 |test edx, edx 1000419A |. 74 18 |je short 100041B4 1000419C |. 8BCE |mov ecx, esi 1000419E |. 33C0 |xor eax, eax 100041A0 |. 8BE9 |mov ebp, ecx 100041A2 |. 8BFA |mov edi, edx 100041A4 |. C1E9 02 |shr ecx, 2 100041A7 |. F3:AB |rep stos dword ptr es:[edi] 100041A9 |. 8BCD |mov ecx, ebp 100041AB |. 83E1 03 |and ecx, 3 100041AE |. F3:AA |rep stos byte ptr es:[edi] 100041B0 |> 85D2 |test edx, edx 100041B2 |. 75 2D |jnz short 100041E1 100041B4 |> 8B0D 90880010 |mov ecx, dword ptr [10008890] 100041BA |. 56 |push esi 100041BB |. 6A 08 |push 8 100041BD |. 51 |push ecx 100041BE |. FFD3 |call ebx 100041C0 |. 8BD0 |mov edx, eax 100041C2 |> 85D2 |test edx, edx 100041C4 |. 75 1B |jnz short 100041E1 100041C6 |. A1 88880010 |mov eax, dword ptr [10008888] 100041CB |. 85C0 |test eax, eax 100041CD |. 74 12 |je short 100041E1 100041CF |. 56 |push esi 100041D0 |. E8 1B000000 |call 100041F0 100041D5 |. 83C4 04 |add esp, 4 100041D8 |. 85C0 |test eax, eax 100041DA |.^ 75 9D \jnz short 10004179 100041DC |. 5F pop edi 100041DD |. 5E pop esi 100041DE |. 5D pop ebp 100041DF |. 5B pop ebx 100041E0 |. C3 retn 100041E1 |> 5F pop edi 100041E2 |. 5E pop esi 100041E3 |. 5D pop ebp 100041E4 |. 8BC2 mov eax, edx 100041E6 |. 5B pop ebx 100041E7 \. C3 retn 100041E8 90 nop |
|
[求助]搞了一天了,还没找到关键点,请高手指点一下!!
10001D2A 90 nop 10001D2B 90 nop 10001D2C 90 nop 10001D2D 90 nop 10001D2E 90 nop 10001D2F 90 nop 10001D30 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10001D34 |. 83EC 14 sub esp, 14 10001D37 |. 53 push ebx 10001D38 |. 55 push ebp 10001D39 |. 56 push esi 10001D3A |. 57 push edi 10001D3B |. 50 push eax 10001D3C |. E8 FF010000 call 10001F40 10001D41 |. 8BC8 mov ecx, eax 10001D43 |. A1 D0860010 mov eax, dword ptr [100086D0] 10001D48 |. 83C4 04 add esp, 4 10001D4B |. 3BC8 cmp ecx, eax 10001D4D |. 894C24 28 mov dword ptr [esp+28], ecx 10001D51 |. 75 0A jnz short 10001D5D 10001D53 |. 33C0 xor eax, eax 10001D55 |. 5F pop edi 10001D56 |. 5E pop esi 10001D57 |. 5D pop ebp 10001D58 |. 5B pop ebx 10001D59 |. 83C4 14 add esp, 14 10001D5C |. C3 retn 10001D5D |> 85C9 test ecx, ecx 10001D5F |. 75 14 jnz short 10001D75 10001D61 |. E8 8A020000 call 10001FF0 10001D66 |. E8 C5020000 call 10002030 10001D6B |. 33C0 xor eax, eax 10001D6D |. 5F pop edi 10001D6E |. 5E pop esi 10001D6F |. 5D pop ebp 10001D70 |. 5B pop ebx 10001D71 |. 83C4 14 add esp, 14 10001D74 |. C3 retn 10001D75 |> 33D2 xor edx, edx 10001D77 |. B8 40600010 mov eax, 10006040 10001D7C |> 3908 /cmp dword ptr [eax], ecx 10001D7E |. 0F84 07010000 |je 10001E8B 10001D84 |. 83C0 30 |add eax, 30 10001D87 |. 42 |inc edx 10001D88 |. 3D 30610010 |cmp eax, 10006130 10001D8D |.^ 72 ED \jb short 10001D7C 10001D8F |. 8D5424 10 lea edx, dword ptr [esp+10] 10001D93 |. 52 push edx ; /pCPInfo 10001D94 |. 51 push ecx ; |CodePage 10001D95 |. FF15 0C500010 call dword ptr [<&KERNEL32.GetCPInfo>>; \GetCPInfo 10001D9B |. BE 01000000 mov esi, 1 10001DA0 |. 3BC6 cmp eax, esi 10001DA2 |. 0F85 BB000000 jnz 10001E63 10001DA8 |. B9 40000000 mov ecx, 40 10001DAD |. 33C0 xor eax, eax 10001DAF |. BF C8840010 mov edi, 100084C8 10001DB4 |. F3:AB rep stos dword ptr es:[edi] 10001DB6 |. 8B4C24 10 mov ecx, dword ptr [esp+10] 10001DBA |. AA stos byte ptr es:[edi] 10001DBB |. 8B7C24 28 mov edi, dword ptr [esp+28] 10001DBF |. 33C0 xor eax, eax 10001DC1 |. 3BCE cmp ecx, esi 10001DC3 |. 893D D0860010 mov dword ptr [100086D0], edi 10001DC9 |. A3 D4860010 mov dword ptr [100086D4], eax 10001DCE |. 76 6E jbe short 10001E3E 10001DD0 |. 8A4424 16 mov al, byte ptr [esp+16] 10001DD4 |. 84C0 test al, al 10001DD6 |. 74 37 je short 10001E0F 10001DD8 |. 8D5424 17 lea edx, dword ptr [esp+17] 10001DDC |> 8A0A /mov cl, byte ptr [edx] 10001DDE |. 84C9 |test cl, cl 10001DE0 |. 74 2D |je short 10001E0F 10001DE2 |. 33C0 |xor eax, eax 10001DE4 |. 81E1 FF000000 |and ecx, 0FF 10001DEA |. 8A42 FF |mov al, byte ptr [edx-1] 10001DED |. 3BC1 |cmp eax, ecx 10001DEF |. 77 14 |ja short 10001E05 10001DF1 |> 8A98 C9840010 |/mov bl, byte ptr [eax+100084C9] 10001DF7 |. 80CB 04 ||or bl, 4 10001DFA |. 8898 C9840010 ||mov byte ptr [eax+100084C9], bl 10001E00 |. 40 ||inc eax 10001E01 |. 3BC1 ||cmp eax, ecx 10001E03 |.^ 76 EC |\jbe short 10001DF1 10001E05 |> 8A42 01 |mov al, byte ptr [edx+1] 10001E08 |. 83C2 02 |add edx, 2 10001E0B |. 84C0 |test al, al 10001E0D |.^ 75 CD \jnz short 10001DDC 10001E0F |> 8BC6 mov eax, esi 10001E11 |> 8A98 C9840010 /mov bl, byte ptr [eax+100084C9] 10001E17 |. 80CB 08 |or bl, 8 10001E1A |. 8898 C9840010 |mov byte ptr [eax+100084C9], bl 10001E20 |. 40 |inc eax 10001E21 |. 3D FF000000 |cmp eax, 0FF 10001E26 |.^ 72 E9 \jb short 10001E11 10001E28 |. 57 push edi 10001E29 |. E8 62010000 call 10001F90 10001E2E |. 83C4 04 add esp, 4 10001E31 |. A3 D4860010 mov dword ptr [100086D4], eax 10001E36 |. 8935 B0890010 mov dword ptr [100089B0], esi 10001E3C |. EB 05 jmp short 10001E43 10001E3E |> A3 B0890010 mov dword ptr [100089B0], eax 10001E43 |> 33C0 xor eax, eax 10001E45 |. A3 D8860010 mov dword ptr [100086D8], eax 10001E4A |. A3 DC860010 mov dword ptr [100086DC], eax 10001E4F |. A3 E0860010 mov dword ptr [100086E0], eax 10001E54 |. E8 D7010000 call 10002030 10001E59 |. 33C0 xor eax, eax 10001E5B |. 5F pop edi 10001E5C |. 5E pop esi 10001E5D |. 5D pop ebp 10001E5E |. 5B pop ebx 10001E5F |. 83C4 14 add esp, 14 10001E62 |. C3 retn 10001E63 |> A1 E4860010 mov eax, dword ptr [100086E4] 10001E68 |. 85C0 test eax, eax 10001E6A |. 74 14 je short 10001E80 10001E6C |. E8 7F010000 call 10001FF0 10001E71 |. E8 BA010000 call 10002030 10001E76 |. 33C0 xor eax, eax 10001E78 |. 5F pop edi 10001E79 |. 5E pop esi 10001E7A |. 5D pop ebp 10001E7B |. 5B pop ebx 10001E7C |. 83C4 14 add esp, 14 10001E7F |. C3 retn 10001E80 |> 83C8 FF or eax, FFFFFFFF 10001E83 |. 5F pop edi 10001E84 |. 5E pop esi 10001E85 |. 5D pop ebp 10001E86 |. 5B pop ebx 10001E87 |. 83C4 14 add esp, 14 10001E8A |. C3 retn 10001E8B |> B9 40000000 mov ecx, 40 10001E90 |. 33C0 xor eax, eax 10001E92 |. BF C8840010 mov edi, 100084C8 10001E97 |. 8D1C52 lea ebx, dword ptr [edx+edx*2] 10001E9A |. F3:AB rep stos dword ptr es:[edi] 10001E9C |. AA stos byte ptr es:[edi] 10001E9D |. 33FF xor edi, edi 10001E9F |. C1E3 04 shl ebx, 4 10001EA2 |. 8DAB 50600010 lea ebp, dword ptr [ebx+10006050] 10001EA8 |> 8A45 00 /mov al, byte ptr [ebp] 10001EAB |. 8BF5 |mov esi, ebp 10001EAD |. 84C0 |test al, al 10001EAF |. 74 30 |je short 10001EE1 10001EB1 |> 8A4E 01 |/mov cl, byte ptr [esi+1] 10001EB4 |. 84C9 ||test cl, cl 10001EB6 |. 74 29 ||je short 10001EE1 10001EB8 |. 33C0 ||xor eax, eax 10001EBA |. 81E1 FF000000 ||and ecx, 0FF 10001EC0 |. 8A06 ||mov al, byte ptr [esi] 10001EC2 |. 3BC1 ||cmp eax, ecx 10001EC4 |. 77 11 ||ja short 10001ED7 10001EC6 |. 8A97 38600010 ||mov dl, byte ptr [edi+10006038] 10001ECC |> 0890 C9840010 ||/or byte ptr [eax+100084C9], dl 10001ED2 |. 40 |||inc eax 10001ED3 |. 3BC1 |||cmp eax, ecx 10001ED5 |.^ 76 F5 ||\jbe short 10001ECC 10001ED7 |> 8A46 02 ||mov al, byte ptr [esi+2] 10001EDA |. 83C6 02 ||add esi, 2 10001EDD |. 84C0 ||test al, al 10001EDF |.^ 75 D0 |\jnz short 10001EB1 10001EE1 |> 47 |inc edi 10001EE2 |. 83C5 08 |add ebp, 8 10001EE5 |. 83FF 04 |cmp edi, 4 10001EE8 |.^ 72 BE \jb short 10001EA8 10001EEA |. 8B4424 28 mov eax, dword ptr [esp+28] 10001EEE |. C705 B0890010>mov dword ptr [100089B0], 1 10001EF8 |. 50 push eax 10001EF9 |. A3 D0860010 mov dword ptr [100086D0], eax 10001EFE |. E8 8D000000 call 10001F90 10001F03 |. 8B8B 44600010 mov ecx, dword ptr [ebx+10006044] 10001F09 |. 8B93 48600010 mov edx, dword ptr [ebx+10006048] 10001F0F |. A3 D4860010 mov dword ptr [100086D4], eax 10001F14 |. 8D83 44600010 lea eax, dword ptr [ebx+10006044] 10001F1A |. 83C4 04 add esp, 4 10001F1D |. 890D D8860010 mov dword ptr [100086D8], ecx 10001F23 |. 8B40 08 mov eax, dword ptr [eax+8] 10001F26 |. 8915 DC860010 mov dword ptr [100086DC], edx 10001F2C |. A3 E0860010 mov dword ptr [100086E0], eax 10001F31 |. E8 FA000000 call 10002030 10001F36 |. 5F pop edi 10001F37 |. 5E pop esi 10001F38 |. 5D pop ebp 10001F39 |. 33C0 xor eax, eax 10001F3B |. 5B pop ebx 10001F3C |. 83C4 14 add esp, 14 10001F3F \. C3 retn 10001F40 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10001F44 |. C705 E4860010>mov dword ptr [100086E4], 0 10001F4E |. 83F8 FE cmp eax, -2 ; Switch (cases FFFFFFFC..FFFFFFFE) 10001F51 |. 75 10 jnz short 10001F63 10001F53 |. C705 E4860010>mov dword ptr [100086E4], 1 ; Case FFFFFFFE of switch 10001F4E 10001F5D |.- FF25 28500010 jmp dword ptr [<&KERNEL32.GetOEMCP>] ; kernel32.GetOEMCP 10001F63 |> 83F8 FD cmp eax, -3 10001F66 |. 75 10 jnz short 10001F78 10001F68 |. C705 E4860010>mov dword ptr [100086E4], 1 ; Case FFFFFFFD of switch 10001F4E 10001F72 |.- FF25 24500010 jmp dword ptr [<&KERNEL32.GetACP>] ; kernel32.GetACP 10001F78 |> 83F8 FC cmp eax, -4 10001F7B |. 75 0F jnz short 10001F8C 10001F7D |. A1 08870010 mov eax, dword ptr [10008708] ; Case FFFFFFFC of switch 10001F4E 10001F82 |. C705 E4860010>mov dword ptr [100086E4], 1 10001F8C \> C3 retn ; Default case of switch 10001F4E 10001F8D 90 nop 10001F8E 90 nop 10001F8F 90 nop 10001F90 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10001F94 |. 05 5CFCFFFF add eax, -3A4 ; Switch (cases 3A4..3B6) 10001F99 |. 83F8 12 cmp eax, 12 10001F9C |. 77 27 ja short 10001FC5 10001F9E |. 33C9 xor ecx, ecx 10001FA0 |. 8A88 DC1F0010 mov cl, byte ptr [eax+10001FDC] 10001FA6 |. FF248D C81F00>jmp dword ptr [ecx*4+10001FC8] 10001FAD |> B8 11040000 mov eax, 411 ; Case 3A4 of switch 10001F94 10001FB2 |. C3 retn 10001FB3 |> B8 04080000 mov eax, 804 ; Case 3A8 of switch 10001F94 10001FB8 |. C3 retn 10001FB9 |> B8 12040000 mov eax, 412 ; Case 3B5 of switch 10001F94 10001FBE |. C3 retn 10001FBF |> B8 04040000 mov eax, 404 ; Case 3B6 of switch 10001F94 10001FC4 |. C3 retn 10001FC5 |> 33C0 xor eax, eax ; Default case of switch 10001F94 10001FC7 \. C3 retn 10001FC8 . AD1F0010 dd pjgl.10001FAD ; 分支表 被用于 10001FA6 10001FCC . B31F0010 dd pjgl.10001FB3 10001FD0 . B91F0010 dd pjgl.10001FB9 10001FD4 . BF1F0010 dd pjgl.10001FBF 10001FD8 . C51F0010 dd pjgl.10001FC5 10001FDC . 00 db 00 ; 分支 10001FC8 索引表 10001FDD . 04 db 04 10001FDE . 04 db 04 10001FDF . 04 db 04 10001FE0 . 01 db 01 10001FE1 . 04 db 04 10001FE2 . 04 db 04 10001FE3 . 04 db 04 10001FE4 . 04 db 04 10001FE5 . 04 db 04 10001FE6 . 04 db 04 10001FE7 . 04 db 04 10001FE8 . 04 db 04 10001FE9 . 04 db 04 10001FEA . 04 db 04 10001FEB . 04 db 04 10001FEC . 04 db 04 10001FED . 02 db 02 10001FEE . 03 db 03 10001FEF 90 nop 10001FF0 /$ 57 push edi 10001FF1 |. B9 40000000 mov ecx, 40 10001FF6 |. 33C0 xor eax, eax 10001FF8 |. BF C8840010 mov edi, 100084C8 10001FFD |. F3:AB rep stos dword ptr es:[edi] 10001FFF |. AA stos byte ptr es:[edi] 10002000 |. 33C0 xor eax, eax 10002002 |. 5F pop edi 10002003 |. A3 D0860010 mov dword ptr [100086D0], eax 10002008 |. A3 B0890010 mov dword ptr [100089B0], eax 1000200D |. A3 D4860010 mov dword ptr [100086D4], eax 10002012 |. A3 D8860010 mov dword ptr [100086D8], eax 10002017 |. A3 DC860010 mov dword ptr [100086DC], eax 1000201C |. A3 E0860010 mov dword ptr [100086E0], eax 10002021 \. C3 retn 10002022 90 nop 10002023 90 nop 10002024 90 nop 10002025 90 nop 10002026 90 nop 10002027 90 nop 10002028 90 nop 10002029 90 nop 1000202A 90 nop 1000202B 90 nop 1000202C 90 nop 1000202D 90 nop 1000202E 90 nop 1000202F 90 nop 10002030 /$ 8B0D D0860010 mov ecx, dword ptr [100086D0] 10002036 |. 81EC 14050000 sub esp, 514 1000203C |. 8D4424 00 lea eax, dword ptr [esp] 10002040 |. 53 push ebx 10002041 |. 50 push eax ; /pCPInfo 10002042 |. 51 push ecx ; |CodePage => CP_ACP 10002043 |. FF15 0C500010 call dword ptr [<&KERNEL32.GetCPInfo>>; \GetCPInfo 10002049 |. 83F8 01 cmp eax, 1 1000204C |. 0F85 52010000 jnz 100021A4 10002052 |. 57 push edi 10002053 |. 56 push esi 10002054 |. 33C0 xor eax, eax 10002056 |> 884404 20 /mov byte ptr [esp+eax+20], al 1000205A |. 40 |inc eax 1000205B |. 3D 00010000 |cmp eax, 100 10002060 |.^ 72 F4 \jb short 10002056 10002062 |. 8A4424 12 mov al, byte ptr [esp+12] 10002066 |. C64424 20 20 mov byte ptr [esp+20], 20 1000206B |. 84C0 test al, al 1000206D |. 74 35 je short 100020A4 1000206F |. 8D5424 13 lea edx, dword ptr [esp+13] 10002073 |> 33C9 /xor ecx, ecx 10002075 |. 25 FF000000 |and eax, 0FF 1000207A |. 8A0A |mov cl, byte ptr [edx] 1000207C |. 3BC1 |cmp eax, ecx 1000207E |. 77 1A |ja short 1000209A 10002080 |. 2BC8 |sub ecx, eax 10002082 |. 8D7C04 20 |lea edi, dword ptr [esp+eax+20] 10002086 |. 41 |inc ecx 10002087 |. B8 20202020 |mov eax, 20202020 1000208C |. 8BF1 |mov esi, ecx 1000208E |. C1E9 02 |shr ecx, 2 10002091 |. F3:AB |rep stos dword ptr es:[edi] 10002093 |. 8BCE |mov ecx, esi 10002095 |. 83E1 03 |and ecx, 3 10002098 |. F3:AA |rep stos byte ptr es:[edi] 1000209A |> 8A42 01 |mov al, byte ptr [edx+1] 1000209D |. 83C2 02 |add edx, 2 100020A0 |. 84C0 |test al, al 100020A2 |.^ 75 CF \jnz short 10002073 100020A4 |> 8B15 D4860010 mov edx, dword ptr [100086D4] 100020AA |. A1 D0860010 mov eax, dword ptr [100086D0] 100020AF |. 6A 00 push 0 100020B1 |. 52 push edx 100020B2 |. 8D8C24 280300>lea ecx, dword ptr [esp+328] 100020B9 |. 50 push eax 100020BA |. 51 push ecx 100020BB |. 8D5424 30 lea edx, dword ptr [esp+30] 100020BF |. 68 00010000 push 100 100020C4 |. 52 push edx 100020C5 |. 6A 01 push 1 100020C7 |. E8 54120000 call 10003320 100020CC |. A1 D0860010 mov eax, dword ptr [100086D0] 100020D1 |. 83C4 1C add esp, 1C 100020D4 |. 8D8C24 200100>lea ecx, dword ptr [esp+120] 100020DB |. 8D5424 20 lea edx, dword ptr [esp+20] 100020DF |. 6A 00 push 0 100020E1 |. 50 push eax 100020E2 |. A1 D4860010 mov eax, dword ptr [100086D4] 100020E7 |. 68 00010000 push 100 100020EC |. 51 push ecx 100020ED |. 68 00010000 push 100 100020F2 |. 52 push edx 100020F3 |. 68 00010000 push 100 100020F8 |. 50 push eax 100020F9 |. E8 22010000 call 10002220 100020FE |. 8B0D D0860010 mov ecx, dword ptr [100086D0] 10002104 |. 83C4 20 add esp, 20 10002107 |. 8D9424 200200>lea edx, dword ptr [esp+220] 1000210E |. 8D4424 20 lea eax, dword ptr [esp+20] 10002112 |. 6A 00 push 0 10002114 |. 51 push ecx 10002115 |. 8B0D D4860010 mov ecx, dword ptr [100086D4] 1000211B |. 68 00010000 push 100 10002120 |. 52 push edx 10002121 |. 68 00010000 push 100 10002126 |. 50 push eax 10002127 |. 68 00020000 push 200 1000212C |. 51 push ecx 1000212D |. E8 EE000000 call 10002220 10002132 |. 83C4 20 add esp, 20 10002135 |. 33C0 xor eax, eax 10002137 |. 8D9424 200300>lea edx, dword ptr [esp+320] 1000213E |. B3 10 mov bl, 10 10002140 |> 66:8B0A /mov cx, word ptr [edx] 10002143 |. F6C1 01 |test cl, 1 10002146 |. 74 1D |je short 10002165 10002148 |. 8A88 C9840010 |mov cl, byte ptr [eax+100084C9] 1000214E |. 0ACB |or cl, bl 10002150 |. 8888 C9840010 |mov byte ptr [eax+100084C9], cl 10002156 |. 8A8C04 200100>|mov cl, byte ptr [esp+eax+120] 1000215D |. 8888 D0850010 |mov byte ptr [eax+100085D0], cl 10002163 |. EB 2A |jmp short 1000218F 10002165 |> F6C1 02 |test cl, 2 10002168 |. 74 1E |je short 10002188 1000216A |. 8A88 C9840010 |mov cl, byte ptr [eax+100084C9] 10002170 |. 80C9 20 |or cl, 20 10002173 |. 8888 C9840010 |mov byte ptr [eax+100084C9], cl 10002179 |. 8A8C04 200200>|mov cl, byte ptr [esp+eax+220] 10002180 |. 8888 D0850010 |mov byte ptr [eax+100085D0], cl 10002186 |. EB 07 |jmp short 1000218F 10002188 |> C680 D0850010>|mov byte ptr [eax+100085D0], 0 1000218F |> 40 |inc eax 10002190 |. 83C2 02 |add edx, 2 10002193 |. 3D 00010000 |cmp eax, 100 10002198 |.^ 72 A6 \jb short 10002140 1000219A |. 5E pop esi 1000219B |. 5F pop edi 1000219C |. 5B pop ebx 1000219D |. 81C4 14050000 add esp, 514 100021A3 |. C3 retn 100021A4 |> 33C0 xor eax, eax 100021A6 |. B3 10 mov bl, 10 100021A8 |> 83F8 41 /cmp eax, 41 100021AB |. 72 20 |jb short 100021CD 100021AD |. 83F8 5A |cmp eax, 5A 100021B0 |. 77 1B |ja short 100021CD 100021B2 |. 8A90 C9840010 |mov dl, byte ptr [eax+100084C9] 100021B8 |. 0AD3 |or dl, bl 100021BA |. 8890 C9840010 |mov byte ptr [eax+100084C9], dl 100021C0 |. 8AD0 |mov dl, al 100021C2 |. 80C2 20 |add dl, 20 100021C5 |. 8890 D0850010 |mov byte ptr [eax+100085D0], dl 100021CB |. EB 2D |jmp short 100021FA 100021CD |> 83F8 61 |cmp eax, 61 100021D0 |. 72 21 |jb short 100021F3 100021D2 |. 83F8 7A |cmp eax, 7A 100021D5 |. 77 1C |ja short 100021F3 100021D7 |. 8A88 C9840010 |mov cl, byte ptr [eax+100084C9] 100021DD |. 80C9 20 |or cl, 20 100021E0 |. 8888 C9840010 |mov byte ptr [eax+100084C9], cl 100021E6 |. 8AC8 |mov cl, al 100021E8 |. 80E9 20 |sub cl, 20 100021EB |. 8888 D0850010 |mov byte ptr [eax+100085D0], cl 100021F1 |. EB 07 |jmp short 100021FA 100021F3 |> C680 D0850010>|mov byte ptr [eax+100085D0], 0 100021FA |> 40 |inc eax 100021FB |. 3D 00010000 |cmp eax, 100 10002200 |.^ 72 A6 \jb short 100021A8 10002202 |. 5B pop ebx 10002203 |. 81C4 14050000 add esp, 514 10002209 \. C3 retn 1000220A 90 nop 1000220B 90 nop 1000220C 90 nop 1000220D 90 nop 1000220E 90 nop 1000220F 90 nop 10002210 /$ 6A FD push -3 10002212 |. E8 19FBFFFF call 10001D30 10002217 |. 83C4 04 add esp, 4 1000221A \. C3 retn 1000221B 90 nop 1000221C 90 nop 1000221D 90 nop 1000221E 90 nop 1000221F 90 nop 10002220 /$ A1 EC860010 mov eax, dword ptr [100086EC] 10002225 |. 53 push ebx 10002226 |. 8B1D 34500010 mov ebx, dword ptr [<&KERNEL32.LCMap>; kernel32.LCMapStringA 1000222C |. 55 push ebp 1000222D |. 56 push esi 1000222E |. 57 push edi 1000222F |. 85C0 test eax, eax 10002231 |. 75 49 jnz short 1000227C 10002233 |. 6A 00 push 0 ; /DestSize = 0 10002235 |. 6A 00 push 0 ; |DestString = NULL 10002237 |. 6A 01 push 1 ; |SrcSize = 1 10002239 |. 68 B0500010 push 100050B0 ; |SrcString = "" 1000223E |. 68 00010000 push 100 ; |MapFlags = LCMAP_LOWERCASE 10002243 |. 6A 00 push 0 ; |LocaleId = 0 10002245 |. FF15 38500010 call dword ptr [<&KERNEL32.LCMapStrin>; \LCMapStringW 1000224B |. 85C0 test eax, eax 1000224D |. 74 07 je short 10002256 1000224F |. B8 01000000 mov eax, 1 10002254 |. EB 21 jmp short 10002277 10002256 |> 6A 00 push 0 10002258 |. 6A 00 push 0 1000225A |. 6A 01 push 1 1000225C |. 68 AC500010 push 100050AC 10002261 |. 68 00010000 push 100 10002266 |. 6A 00 push 0 10002268 |. FFD3 call ebx 1000226A |. 85C0 test eax, eax 1000226C |. 0F84 CC010000 je 1000243E 10002272 |. B8 02000000 mov eax, 2 10002277 |> A3 EC860010 mov dword ptr [100086EC], eax 1000227C |> 8B7424 20 mov esi, dword ptr [esp+20] 10002280 |. 85F6 test esi, esi 10002282 |. 7E 17 jle short 1000229B 10002284 |. 8B7C24 1C mov edi, dword ptr [esp+1C] 10002288 |. 56 push esi 10002289 |. 57 push edi 1000228A |. E8 C1010000 call 10002450 1000228F |. 8BF0 mov esi, eax 10002291 |. A1 EC860010 mov eax, dword ptr [100086EC] 10002296 |. 83C4 08 add esp, 8 10002299 |. EB 04 jmp short 1000229F 1000229B |> 8B7C24 1C mov edi, dword ptr [esp+1C] 1000229F |> 83F8 02 cmp eax, 2 100022A2 |. 75 1D jnz short 100022C1 100022A4 |. 8B4424 28 mov eax, dword ptr [esp+28] 100022A8 |. 8B4C24 24 mov ecx, dword ptr [esp+24] 100022AC |. 8B5424 18 mov edx, dword ptr [esp+18] 100022B0 |. 50 push eax 100022B1 |. 8B4424 18 mov eax, dword ptr [esp+18] 100022B5 |. 51 push ecx 100022B6 |. 56 push esi 100022B7 |. 57 push edi 100022B8 |. 52 push edx 100022B9 |. 50 push eax 100022BA |. FFD3 call ebx 100022BC |. 5F pop edi 100022BD |. 5E pop esi 100022BE |. 5D pop ebp 100022BF |. 5B pop ebx 100022C0 |. C3 retn 100022C1 |> 83F8 01 cmp eax, 1 100022C4 |. 0F85 DD000000 jnz 100023A7 100022CA |. 8B6C24 2C mov ebp, dword ptr [esp+2C] 100022CE |. C74424 20 000>mov dword ptr [esp+20], 0 100022D6 |. 85ED test ebp, ebp 100022D8 |. 75 0C jnz short 100022E6 100022DA |. 8B0D 08870010 mov ecx, dword ptr [10008708] 100022E0 |. 894C24 2C mov dword ptr [esp+2C], ecx 100022E4 |. 8BE9 mov ebp, ecx 100022E6 |> 8B5424 30 mov edx, dword ptr [esp+30] 100022EA |. 6A 00 push 0 ; /WideBufSize = 0 100022EC |. F7DA neg edx ; | 100022EE |. 1BD2 sbb edx, edx ; | 100022F0 |. 6A 00 push 0 ; |WideCharBuf = NULL 100022F2 |. 83E2 08 and edx, 8 ; | 100022F5 |. 56 push esi ; |StringSize 100022F6 |. 42 inc edx ; | 100022F7 |. 57 push edi ; |StringToMap 100022F8 |. 52 push edx ; |Options 100022F9 |. 55 push ebp ; |CodePage 100022FA |. FF15 2C500010 call dword ptr [<&KERNEL32.MultiByteT>; \MultiByteToWideChar 10002300 |. 8BF8 mov edi, eax 10002302 |. 85FF test edi, edi 10002304 |. 75 05 jnz short 1000230B 10002306 |. 5F pop edi 10002307 |. 5E pop esi 10002308 |. 5D pop ebp 10002309 |. 5B pop ebx 1000230A |. C3 retn 1000230B |> 8D043F lea eax, dword ptr [edi+edi] 1000230E |. 50 push eax 1000230F |. E8 9C120000 call 100035B0 10002314 |. 8BD8 mov ebx, eax 10002316 |. 83C4 04 add esp, 4 10002319 |. 85DB test ebx, ebx 1000231B |. 75 05 jnz short 10002322 1000231D |. 5F pop edi 1000231E |. 5E pop esi 1000231F |. 5D pop ebp 10002320 |. 5B pop ebx 10002321 |. C3 retn 10002322 |> 8B4C24 1C mov ecx, dword ptr [esp+1C] 10002326 |. 57 push edi ; /WideBufSize 10002327 |. 53 push ebx ; |WideCharBuf 10002328 |. 56 push esi ; |StringSize 10002329 |. 51 push ecx ; |StringToMap 1000232A |. 6A 01 push 1 ; |Options = MB_PRECOMPOSED 1000232C |. 55 push ebp ; |CodePage 1000232D |. FF15 2C500010 call dword ptr [<&KERNEL32.MultiByteT>; \MultiByteToWideChar 10002333 |. 85C0 test eax, eax 10002335 |. 0F84 ED000000 je 10002428 1000233B |. 8B6C24 18 mov ebp, dword ptr [esp+18] 1000233F |. 8B5424 14 mov edx, dword ptr [esp+14] 10002343 |. 6A 00 push 0 ; /DestSize = 0 10002345 |. 6A 00 push 0 ; |DestString = NULL 10002347 |. 57 push edi ; |SrcSize 10002348 |. 53 push ebx ; |SrcString 10002349 |. 55 push ebp ; |MapFlags 1000234A |. 52 push edx ; |LocaleId 1000234B |. FF15 38500010 call dword ptr [<&KERNEL32.LCMapStrin>; \LCMapStringW 10002351 |. 8BF0 mov esi, eax 10002353 |. 85F6 test esi, esi 10002355 |. 0F84 CD000000 je 10002428 1000235B |. F7C5 00040000 test ebp, 400 10002361 |. 74 49 je short 100023AC 10002363 |. 8B4424 28 mov eax, dword ptr [esp+28] 10002367 |. 85C0 test eax, eax 10002369 |. 74 24 je short 1000238F 1000236B |. 3BF0 cmp esi, eax 1000236D |. 0F8F B5000000 jg 10002428 10002373 |. 8B4C24 14 mov ecx, dword ptr [esp+14] 10002377 |. 50 push eax ; /DestSize 10002378 |. 8B4424 28 mov eax, dword ptr [esp+28] ; | 1000237C |. 50 push eax ; |DestString 1000237D |. 57 push edi ; |SrcSize 1000237E |. 53 push ebx ; |SrcString 1000237F |. 55 push ebp ; |MapFlags 10002380 |. 51 push ecx ; |LocaleId 10002381 |. FF15 38500010 call dword ptr [<&KERNEL32.LCMapStrin>; \LCMapStringW 10002387 |. 85C0 test eax, eax 10002389 |. 0F84 99000000 je 10002428 1000238F |> 53 push ebx 10002390 |. E8 CB100000 call 10003460 10002395 |. 8B5424 24 mov edx, dword ptr [esp+24] 10002399 |. 83C4 04 add esp, 4 1000239C |. 52 push edx 1000239D |. E8 BE100000 call 10003460 100023A2 |. 83C4 04 add esp, 4 100023A5 |. 8BC6 mov eax, esi 100023A7 |> 5F pop edi 100023A8 |. 5E pop esi 100023A9 |. 5D pop ebp 100023AA |. 5B pop ebx 100023AB |. C3 retn 100023AC |> 8D1436 lea edx, dword ptr [esi+esi] 100023AF |. 52 push edx 100023B0 |. E8 FB110000 call 100035B0 100023B5 |. 83C4 04 add esp, 4 100023B8 |. 894424 20 mov dword ptr [esp+20], eax 100023BC |. 85C0 test eax, eax 100023BE |. 74 68 je short 10002428 100023C0 |. 8B4C24 14 mov ecx, dword ptr [esp+14] 100023C4 |. 56 push esi ; /DestSize 100023C5 |. 50 push eax ; |DestString 100023C6 |. 57 push edi ; |SrcSize 100023C7 |. 53 push ebx ; |SrcString 100023C8 |. 55 push ebp ; |MapFlags 100023C9 |. 51 push ecx ; |LocaleId 100023CA |. FF15 38500010 call dword ptr [<&KERNEL32.LCMapStrin>; \LCMapStringW 100023D0 |. 85C0 test eax, eax 100023D2 |. 74 54 je short 10002428 100023D4 |. 8B4424 28 mov eax, dword ptr [esp+28] 100023D8 |. 6A 00 push 0 ; /pDefaultCharUsed = NULL 100023DA |. 85C0 test eax, eax ; | 100023DC |. 6A 00 push 0 ; |pDefaultChar = NULL 100023DE |. 75 22 jnz short 10002402 ; | 100023E0 |. 8B5424 28 mov edx, dword ptr [esp+28] ; | 100023E4 |. 8B4424 34 mov eax, dword ptr [esp+34] ; | 100023E8 |. 6A 00 push 0 ; |MultiByteCount = 0 100023EA |. 6A 00 push 0 ; |MultiByteStr = NULL 100023EC |. 56 push esi ; |WideCharCount 100023ED |. 52 push edx ; |WideCharStr 100023EE |. 68 20020000 push 220 ; |Options = WC_COMPOSITECHECK|WC_SEPCHARS 100023F3 |. 50 push eax ; |CodePage 100023F4 |. FF15 30500010 call dword ptr [<&KERNEL32.WideCharTo>; \WideCharToMultiByte 100023FA |. 8BF0 mov esi, eax 100023FC |. 85F6 test esi, esi 100023FE |. 74 28 je short 10002428 10002400 |.^ EB 8D jmp short 1000238F 10002402 |> 8B4C24 2C mov ecx, dword ptr [esp+2C] ; | 10002406 |. 8B5424 28 mov edx, dword ptr [esp+28] ; | 1000240A |. 50 push eax ; |MultiByteCount 1000240B |. 8B4424 38 mov eax, dword ptr [esp+38] ; | 1000240F |. 51 push ecx ; |MultiByteStr 10002410 |. 56 push esi ; |WideCharCount 10002411 |. 52 push edx ; |WideCharStr 10002412 |. 68 20020000 push 220 ; |Options = WC_COMPOSITECHECK|WC_SEPCHARS 10002417 |. 50 push eax ; |CodePage 10002418 |. FF15 30500010 call dword ptr [<&KERNEL32.WideCharTo>; \WideCharToMultiByte 1000241E |. 8BF0 mov esi, eax 10002420 |. 85F6 test esi, esi 10002422 |.^ 0F85 67FFFFFF jnz 1000238F 10002428 |> 53 push ebx 10002429 |. E8 32100000 call 10003460 1000242E |. 8B4C24 24 mov ecx, dword ptr [esp+24] 10002432 |. 83C4 04 add esp, 4 10002435 |. 51 push ecx 10002436 |. E8 25100000 call 10003460 1000243B |. 83C4 04 add esp, 4 1000243E |> 5F pop edi 1000243F |. 5E pop esi 10002440 |. 5D pop ebp 10002441 |. 33C0 xor eax, eax 10002443 |. 5B pop ebx 10002444 \. C3 retn 10002445 90 nop 10002446 90 nop 10002447 90 nop 10002448 90 nop 10002449 90 nop 1000244A 90 nop 1000244B 90 nop 1000244C 90 nop 1000244D 90 nop 1000244E 90 nop 1000244F 90 nop 10002450 /$ 8B5424 08 mov edx, dword ptr [esp+8] 10002454 |. 56 push esi 10002455 |. 8B7424 08 mov esi, dword ptr [esp+8] 10002459 |. 85D2 test edx, edx 1000245B |. 57 push edi 1000245C |. 8BC6 mov eax, esi 1000245E |. 8D4A FF lea ecx, dword ptr [edx-1] 10002461 |. 74 0D je short 10002470 10002463 |> 8038 00 /cmp byte ptr [eax], 0 10002466 |. 74 08 |je short 10002470 10002468 |. 40 |inc eax 10002469 |. 8BF9 |mov edi, ecx 1000246B |. 49 |dec ecx 1000246C |. 85FF |test edi, edi 1000246E |.^ 75 F3 \jnz short 10002463 10002470 |> 8038 00 cmp byte ptr [eax], 0 10002473 |. 75 05 jnz short 1000247A 10002475 |. 2BC6 sub eax, esi 10002477 |. 5F pop edi 10002478 |. 5E pop esi 10002479 |. C3 retn 1000247A |> 5F pop edi 1000247B |. 5E pop esi 1000247C |. 8BC2 mov eax, edx 1000247E \. C3 retn 1000247F 90 nop 10002480 /$ 51 push ecx 10002481 |. 8B4C24 08 mov ecx, dword ptr [esp+8] 10002485 |. 56 push esi 10002486 |. 8D41 01 lea eax, dword ptr [ecx+1] 10002489 |. 3D 00010000 cmp eax, 100 1000248E |. 77 15 ja short 100024A5 10002490 |. 8B15 30610010 mov edx, dword ptr [10006130] ; pjgl.1000613A 10002496 |. 33C0 xor eax, eax 10002498 |. 66:8B044A mov ax, word ptr [edx+ecx*2] 1000249C |. 8B4C24 10 mov ecx, dword ptr [esp+10] 100024A0 |. 23C1 and eax, ecx 100024A2 |. 5E pop esi 100024A3 |. 59 pop ecx 100024A4 |. C3 retn 100024A5 |> 8B35 30610010 mov esi, dword ptr [10006130] ; pjgl.1000613A 100024AB |. 8BC1 mov eax, ecx 100024AD |. C1F8 08 sar eax, 8 100024B0 |. 8BD0 mov edx, eax 100024B2 |. 81E2 FF000000 and edx, 0FF 100024B8 |. F64456 01 80 test byte ptr [esi+edx*2+1], 80 100024BD |. 74 14 je short 100024D3 100024BF |. 884424 0C mov byte ptr [esp+C], al 100024C3 |. 884C24 0D mov byte ptr [esp+D], cl 100024C7 |. C64424 0E 00 mov byte ptr [esp+E], 0 100024CC |. B8 02000000 mov eax, 2 100024D1 |. EB 0E jmp short 100024E1 100024D3 |> 884C24 0C mov byte ptr [esp+C], cl 100024D7 |. C64424 0D 00 mov byte ptr [esp+D], 0 100024DC |. B8 01000000 mov eax, 1 100024E1 |> 6A 01 push 1 100024E3 |. 6A 00 push 0 100024E5 |. 8D4C24 0C lea ecx, dword ptr [esp+C] 100024E9 |. 6A 00 push 0 100024EB |. 51 push ecx 100024EC |. 8D5424 1C lea edx, dword ptr [esp+1C] 100024F0 |. 50 push eax 100024F1 |. 52 push edx 100024F2 |. 6A 01 push 1 100024F4 |. E8 270E0000 call 10003320 100024F9 |. 83C4 1C add esp, 1C 100024FC |. 85C0 test eax, eax 100024FE |. 75 03 jnz short 10002503 10002500 |. 5E pop esi 10002501 |. 59 pop ecx 10002502 |. C3 retn 10002503 |> 8B4424 04 mov eax, dword ptr [esp+4] 10002507 |. 8B4C24 10 mov ecx, dword ptr [esp+10] 1000250B |. 25 FFFF0000 and eax, 0FFFF 10002510 |. 5E pop esi 10002511 |. 23C1 and eax, ecx 10002513 |. 59 pop ecx 10002514 \. C3 retn 10002515 90 nop 10002516 90 nop 10002517 90 nop 10002518 90 nop 10002519 90 nop 1000251A 90 nop 1000251B 90 nop 1000251C 90 nop 1000251D 90 nop 1000251E 90 nop 1000251F 90 nop 10002520 /$ A1 AC890010 mov eax, dword ptr [100089AC] 10002525 |. 85C0 test eax, eax 10002527 |. 74 02 je short 1000252B 10002529 |. FFD0 call eax 1000252B |> 68 10600010 push 10006010 10002530 |. 68 0C600010 push 1000600C 10002535 |. E8 06010000 call 10002640 1000253A |. 83C4 08 add esp, 8 1000253D |. 68 08600010 push 10006008 10002542 |. 68 00600010 push 10006000 10002547 |. E8 F4000000 call 10002640 1000254C |. 83C4 08 add esp, 8 1000254F \. C3 retn 10002550 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10002554 |. 6A 00 push 0 10002556 |. 6A 00 push 0 10002558 |. 50 push eax 10002559 |. E8 32000000 call 10002590 1000255E |. 83C4 0C add esp, 0C 10002561 \. C3 retn 10002562 90 nop 10002563 90 nop 10002564 90 nop 10002565 90 nop 10002566 90 nop 10002567 90 nop 10002568 90 nop 10002569 90 nop 1000256A 90 nop 1000256B 90 nop 1000256C 90 nop 1000256D 90 nop 1000256E 90 nop 1000256F 90 nop 10002570 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10002574 |. 6A 00 push 0 10002576 |. 6A 01 push 1 10002578 |. 50 push eax 10002579 |. E8 12000000 call 10002590 1000257E |. 83C4 0C add esp, 0C 10002581 \. C3 retn 10002582 90 nop 10002583 90 nop 10002584 90 nop 10002585 90 nop 10002586 90 nop 10002587 90 nop 10002588 90 nop 10002589 90 nop 1000258A 90 nop 1000258B 90 nop 1000258C 90 nop 1000258D 90 nop 1000258E 90 nop 1000258F 90 nop 10002590 /$ A1 54870010 mov eax, dword ptr [10008754] 10002595 |. 53 push ebx 10002596 |. 55 push ebp 10002597 |. 8B6C24 0C mov ebp, dword ptr [esp+C] 1000259B |. 83F8 01 cmp eax, 1 1000259E |. 56 push esi 1000259F |. 75 0E jnz short 100025AF 100025A1 |. 55 push ebp ; /ExitCode 100025A2 |. FF15 40500010 call dword ptr [<&KERNEL32.GetCurrent>; |[GetCurrentProcess 100025A8 |. 50 push eax ; |hProcess 100025A9 |. FF15 3C500010 call dword ptr [<&KERNEL32.TerminateP>; \TerminateProcess 100025AF |> 8B4424 14 mov eax, dword ptr [esp+14] 100025B3 |. 8B5C24 18 mov ebx, dword ptr [esp+18] 100025B7 |. 85C0 test eax, eax 100025B9 |. C705 50870010>mov dword ptr [10008750], 1 100025C3 |. 881D 4C870010 mov byte ptr [1000874C], bl 100025C9 |. 75 3E jnz short 10002609 100025CB |. 8B0D A8890010 mov ecx, dword ptr [100089A8] 100025D1 |. 85C9 test ecx, ecx 100025D3 |. 74 22 je short 100025F7 100025D5 |. 8B35 A4890010 mov esi, dword ptr [100089A4] 100025DB |. 83EE 04 sub esi, 4 100025DE |. 3BF1 cmp esi, ecx 100025E0 |. 72 15 jb short 100025F7 100025E2 |> 8B06 /mov eax, dword ptr [esi] 100025E4 |. 85C0 |test eax, eax 100025E6 |. 74 08 |je short 100025F0 100025E8 |. FFD0 |call eax 100025EA |. 8B0D A8890010 |mov ecx, dword ptr [100089A8] 100025F0 |> 83EE 04 |sub esi, 4 100025F3 |. 3BF1 |cmp esi, ecx 100025F5 |.^ 73 EB \jnb short 100025E2 100025F7 |> 68 18600010 push 10006018 100025FC |. 68 14600010 push 10006014 10002601 |. E8 3A000000 call 10002640 10002606 |. 83C4 08 add esp, 8 10002609 |> 68 20600010 push 10006020 1000260E |. 68 1C600010 push 1000601C 10002613 |. E8 28000000 call 10002640 10002618 |. 83C4 08 add esp, 8 1000261B |. 85DB test ebx, ebx 1000261D |. 75 11 jnz short 10002630 1000261F |. 55 push ebp ; /ExitCode 10002620 |. C705 54870010>mov dword ptr [10008754], 1 ; | 1000262A |. FF15 20500010 call dword ptr [<&KERNEL32.ExitProces>; \ExitProcess 10002630 |> 5E pop esi 10002631 |. 5D pop ebp 10002632 |. 5B pop ebx 10002633 \. C3 retn 10002634 90 nop 10002635 90 nop 10002636 90 nop 10002637 90 nop 10002638 90 nop 10002639 90 nop 1000263A 90 nop 1000263B 90 nop 1000263C 90 nop 1000263D 90 nop 1000263E 90 nop 1000263F 90 nop 10002640 /$ 56 push esi 10002641 |. 8B7424 08 mov esi, dword ptr [esp+8] 10002645 |. 57 push edi 10002646 |. 8B7C24 10 mov edi, dword ptr [esp+10] 1000264A |. 3BF7 cmp esi, edi 1000264C |. 73 0F jnb short 1000265D 1000264E |> 8B06 /mov eax, dword ptr [esi] 10002650 |. 85C0 |test eax, eax 10002652 |. 74 02 |je short 10002656 10002654 |. FFD0 |call eax 10002656 |> 83C6 04 |add esi, 4 10002659 |. 3BF7 |cmp esi, edi 1000265B |.^ 72 F1 \jb short 1000264E 1000265D |> 5F pop edi 1000265E |. 5E pop esi 1000265F \. C3 retn 10002660 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10002664 |. 53 push ebx 10002665 |. 55 push ebp 10002666 |. 56 push esi 10002667 |. 50 push eax 10002668 |. E8 33010000 call 100027A0 1000266D |. 83C4 04 add esp, 4 10002670 |. 85C0 test eax, eax 10002672 |. 0F84 17010000 je 1000278F 10002678 |. 8B58 08 mov ebx, dword ptr [eax+8] 1000267B |. 85DB test ebx, ebx ; Switch (cases 0..5) 1000267D |. 0F84 0C010000 je 1000278F 10002683 |. 83FB 05 cmp ebx, 5 10002686 |. 75 10 jnz short 10002698 10002688 |. C740 08 00000>mov dword ptr [eax+8], 0 ; Case 5 of switch 1000267B 1000268F |. B8 01000000 mov eax, 1 10002694 |. 5E pop esi 10002695 |. 5D pop ebp 10002696 |. 5B pop ebx 10002697 |. C3 retn 10002698 |> 83FB 01 cmp ebx, 1 1000269B |. 75 07 jnz short 100026A4 1000269D |. 83C8 FF or eax, FFFFFFFF ; Case 1 of switch 1000267B 100026A0 |. 5E pop esi 100026A1 |. 5D pop ebp 100026A2 |. 5B pop ebx 100026A3 |. C3 retn 100026A4 |> 8B4C24 14 mov ecx, dword ptr [esp+14] ; Default case of switch 1000267B 100026A8 |. 8B2D 58870010 mov ebp, dword ptr [10008758] 100026AE |. 890D 58870010 mov dword ptr [10008758], ecx 100026B4 |. 8B48 04 mov ecx, dword ptr [eax+4] 100026B7 |. 83F9 08 cmp ecx, 8 100026BA |. 0F85 B5000000 jnz 10002775 100026C0 |. 8B35 C0630010 mov esi, dword ptr [100063C0] 100026C6 |. 8B15 C4630010 mov edx, dword ptr [100063C4] 100026CC |. 03D6 add edx, esi 100026CE |. 3BF2 cmp esi, edx 100026D0 |. 7D 18 jge short 100026EA 100026D2 |. 8D0C76 lea ecx, dword ptr [esi+esi*2] 100026D5 |. 2BD6 sub edx, esi 100026D7 |. 8D0C8D 506300>lea ecx, dword ptr [ecx*4+10006350] 100026DE |> C701 00000000 /mov dword ptr [ecx], 0 100026E4 |. 83C1 0C |add ecx, 0C 100026E7 |. 4A |dec edx 100026E8 |.^ 75 F4 \jnz short 100026DE 100026EA |> 8B00 mov eax, dword ptr [eax] 100026EC |. 8B0D CC630010 mov ecx, dword ptr [100063CC] 100026F2 |. 3D 8E0000C0 cmp eax, C000008E ; Switch (cases C000008D..C0000093) 100026F7 |. 8BF1 mov esi, ecx 100026F9 |. 75 07 jnz short 10002702 100026FB |. B9 83000000 mov ecx, 83 ; Case C000008E (FLOAT DIVIDE BY ZERO) of switch 100026F2 10002700 |. EB 52 jmp short 10002754 10002702 |> 3D 900000C0 cmp eax, C0000090 10002707 |. 75 07 jnz short 10002710 10002709 |. B9 81000000 mov ecx, 81 ; Case C0000090 (FLOAT INVALID OPERATION) of switch 100026F2 1000270E |. EB 44 jmp short 10002754 10002710 |> 3D 910000C0 cmp eax, C0000091 10002715 |. 75 07 jnz short 1000271E 10002717 |. B9 84000000 mov ecx, 84 ; Case C0000091 (FLOAT OVERFLOW) of switch 100026F2 1000271C |. EB 36 jmp short 10002754 1000271E |> 3D 930000C0 cmp eax, C0000093 10002723 |. 75 07 jnz short 1000272C 10002725 |. B9 85000000 mov ecx, 85 ; Case C0000093 (FLOAT UNDERFLOW) of switch 100026F2 1000272A |. EB 28 jmp short 10002754 1000272C |> 3D 8D0000C0 cmp eax, C000008D 10002731 |. 75 07 jnz short 1000273A 10002733 |. B9 82000000 mov ecx, 82 ; Case C000008D (FLOAT DENORMAL OPERAND) of switch 100026F2 10002738 |. EB 1A jmp short 10002754 1000273A |> 3D 8F0000C0 cmp eax, C000008F 1000273F |. 75 07 jnz short 10002748 10002741 |. B9 86000000 mov ecx, 86 ; Case C000008F (FLOAT INEXACT RESULT) of switch 100026F2 10002746 |. EB 0C jmp short 10002754 10002748 |> 3D 920000C0 cmp eax, C0000092 1000274D |. 75 0B jnz short 1000275A 1000274F |. B9 8A000000 mov ecx, 8A ; Case C0000092 (FLOAT STACK CHECK) of switch 100026F2 10002754 |> 890D CC630010 mov dword ptr [100063CC], ecx 1000275A |> 51 push ecx ; Default case of switch 100026F2 1000275B |. 6A 08 push 8 1000275D |. FFD3 call ebx 1000275F |. 83C4 08 add esp, 8 10002762 |. 8935 CC630010 mov dword ptr [100063CC], esi 10002768 |. 892D 58870010 mov dword ptr [10008758], ebp 1000276E |. 83C8 FF or eax, FFFFFFFF 10002771 |. 5E pop esi 10002772 |. 5D pop ebp 10002773 |. 5B pop ebx 10002774 |. C3 retn 10002775 |> 51 push ecx 10002776 |. C740 08 00000>mov dword ptr [eax+8], 0 1000277D |. FFD3 call ebx 1000277F |. 83C4 04 add esp, 4 10002782 |. 892D 58870010 mov dword ptr [10008758], ebp 10002788 |. 83C8 FF or eax, FFFFFFFF 1000278B |. 5E pop esi 1000278C |. 5D pop ebp 1000278D |. 5B pop ebx 1000278E |. C3 retn 1000278F |> 8B5424 14 mov edx, dword ptr [esp+14] ; Case 0 of switch 1000267B 10002793 |. 52 push edx ; /pExceptionInfo 10002794 |. FF15 44500010 call dword ptr [<&KERNEL32.UnhandledE>; \UnhandledExceptionFilter 1000279A |. 5E pop esi 1000279B |. 5D pop ebp 1000279C |. 5B pop ebx 1000279D \. C3 retn 1000279E 90 nop 1000279F 90 nop 100027A0 /$ 8B5424 04 mov edx, dword ptr [esp+4] 100027A4 |. 8B0D 48630010 mov ecx, dword ptr [10006348] 100027AA |. 56 push esi 100027AB |. 8B35 C8630010 mov esi, dword ptr [100063C8] 100027B1 |. 3BCA cmp ecx, edx 100027B3 |. B8 48630010 mov eax, 10006348 100027B8 |. 74 15 je short 100027CF 100027BA |. 8D0C76 lea ecx, dword ptr [esi+esi*2] 100027BD |. 8D0C8D 486300>lea ecx, dword ptr [ecx*4+10006348] 100027C4 |> 83C0 0C /add eax, 0C 100027C7 |. 3BC1 |cmp eax, ecx 100027C9 |. 73 04 |jnb short 100027CF 100027CB |. 3910 |cmp dword ptr [eax], edx 100027CD |.^ 75 F5 \jnz short 100027C4 100027CF |> 8D0C76 lea ecx, dword ptr [esi+esi*2] 100027D2 |. 8D0C8D 486300>lea ecx, dword ptr [ecx*4+10006348] 100027D9 |. 3BC1 cmp eax, ecx 100027DB |. 73 04 jnb short 100027E1 100027DD |. 3910 cmp dword ptr [eax], edx 100027DF |. 74 02 je short 100027E3 100027E1 |> 33C0 xor eax, eax 100027E3 |> 5E pop esi 100027E4 \. C3 retn 100027E5 90 nop 100027E6 90 nop 100027E7 90 nop 100027E8 90 nop 100027E9 90 nop 100027EA 90 nop 100027EB 90 nop 100027EC 90 nop 100027ED 90 nop 100027EE 90 nop 100027EF 90 nop 100027F0 /$ 51 push ecx 100027F1 |. 8B15 BC840010 mov edx, dword ptr [100084BC] 100027F7 |. 53 push ebx 100027F8 |. 55 push ebp 100027F9 |. 56 push esi 100027FA |. 8A02 mov al, byte ptr [edx] 100027FC |. 33F6 xor esi, esi 100027FE |. 84C0 test al, al 10002800 |. 57 push edi 10002801 |. 74 1D je short 10002820 10002803 |> 3C 3D /cmp al, 3D 10002805 |. 74 01 |je short 10002808 10002807 |. 46 |inc esi 10002808 |> 8BFA |mov edi, edx 1000280A |. 83C9 FF |or ecx, FFFFFFFF 1000280D |. 33C0 |xor eax, eax 1000280F |. F2:AE |repne scas byte ptr es:[edi] 10002811 |. F7D1 |not ecx 10002813 |. 49 |dec ecx 10002814 |. 8A440A 01 |mov al, byte ptr [edx+ecx+1] 10002818 |. 8D540A 01 |lea edx, dword ptr [edx+ecx+1] 1000281C |. 84C0 |test al, al 1000281E |.^ 75 E3 \jnz short 10002803 10002820 |> 8D04B5 040000>lea eax, dword ptr [esi*4+4] 10002827 |. 50 push eax 10002828 |. E8 830D0000 call 100035B0 1000282D |. 8BF0 mov esi, eax 1000282F |. 83C4 04 add esp, 4 10002832 |. 85F6 test esi, esi 10002834 |. 897424 10 mov dword ptr [esp+10], esi 10002838 |. 8935 34870010 mov dword ptr [10008734], esi 1000283E |. 75 0A jnz short 1000284A 10002840 |. 6A 09 push 9 10002842 |. E8 89F4FFFF call 10001CD0 10002847 |. 83C4 04 add esp, 4 1000284A |> 8B2D BC840010 mov ebp, dword ptr [100084BC] 10002850 |. 8A55 00 mov dl, byte ptr [ebp] 10002853 |. 84D2 test dl, dl 10002855 |. 74 63 je short 100028BA 10002857 |> 8BFD /mov edi, ebp 10002859 |. 83C9 FF |or ecx, FFFFFFFF 1000285C |. 33C0 |xor eax, eax 1000285E |. F2:AE |repne scas byte ptr es:[edi] 10002860 |. F7D1 |not ecx 10002862 |. 49 |dec ecx 10002863 |. 8BD9 |mov ebx, ecx 10002865 |. 43 |inc ebx 10002866 |. 80FA 3D |cmp dl, 3D 10002869 |. 74 45 |je short 100028B0 1000286B |. 53 |push ebx 1000286C |. E8 3F0D0000 |call 100035B0 10002871 |. 83C4 04 |add esp, 4 10002874 |. 8906 |mov dword ptr [esi], eax 10002876 |. 85C0 |test eax, eax 10002878 |. 75 0A |jnz short 10002884 1000287A |. 6A 09 |push 9 1000287C |. E8 4FF4FFFF |call 10001CD0 10002881 |. 83C4 04 |add esp, 4 10002884 |> 8BFD |mov edi, ebp 10002886 |. 83C9 FF |or ecx, FFFFFFFF 10002889 |. 33C0 |xor eax, eax 1000288B |. F2:AE |repne scas byte ptr es:[edi] 1000288D |. 8B4424 10 |mov eax, dword ptr [esp+10] 10002891 |. F7D1 |not ecx 10002893 |. 2BF9 |sub edi, ecx 10002895 |. 8BD1 |mov edx, ecx 10002897 |. 8BF7 |mov esi, edi 10002899 |. 8B38 |mov edi, dword ptr [eax] 1000289B |. C1E9 02 |shr ecx, 2 1000289E |. F3:A5 |rep movs dword ptr es:[edi], dword > 100028A0 |. 8BCA |mov ecx, edx 100028A2 |. 83E1 03 |and ecx, 3 100028A5 |. 83C0 04 |add eax, 4 100028A8 |. F3:A4 |rep movs byte ptr es:[edi], byte pt> 100028AA |. 894424 10 |mov dword ptr [esp+10], eax 100028AE |. 8BF0 |mov esi, eax 100028B0 |> 8A541D 00 |mov dl, byte ptr [ebp+ebx] 100028B4 |. 03EB |add ebp, ebx 100028B6 |. 84D2 |test dl, dl 100028B8 |.^ 75 9D \jnz short 10002857 100028BA |> A1 BC840010 mov eax, dword ptr [100084BC] 100028BF |. 50 push eax 100028C0 |. E8 9B0B0000 call 10003460 100028C5 |. 83C4 04 add esp, 4 100028C8 |. C705 BC840010>mov dword ptr [100084BC], 0 100028D2 |. C706 00000000 mov dword ptr [esi], 0 100028D8 |. 5F pop edi 100028D9 |. 5E pop esi 100028DA |. 5D pop ebp 100028DB |. 5B pop ebx 100028DC |. 59 pop ecx 100028DD \. C3 retn 100028DE 90 nop 100028DF 90 nop 100028E0 /$ 83EC 08 sub esp, 8 100028E3 |. 56 push esi 100028E4 |. 57 push edi 100028E5 |. 68 04010000 push 104 ; /BufSize = 104 (260.) 100028EA |. 68 60870010 push 10008760 ; |PathBuffer = pjgl.10008760 100028EF |. 6A 00 push 0 ; |hModule = NULL 100028F1 |. FF15 48500010 call dword ptr [<&KERNEL32.GetModuleF>; \GetModuleFileNameA 100028F7 |. 8B3D B4890010 mov edi, dword ptr [100089B4] 100028FD |. C705 44870010>mov dword ptr [10008744], 10008760 10002907 |. 803F 00 cmp byte ptr [edi], 0 1000290A |. 75 05 jnz short 10002911 1000290C |. BF 60870010 mov edi, 10008760 10002911 |> 8D4424 0C lea eax, dword ptr [esp+C] 10002915 |. 8D4C24 08 lea ecx, dword ptr [esp+8] 10002919 |. 50 push eax 1000291A |. 51 push ecx 1000291B |. 6A 00 push 0 1000291D |. 6A 00 push 0 1000291F |. 57 push edi 10002920 |. E8 5B000000 call 10002980 10002925 |. 8B5424 20 mov edx, dword ptr [esp+20] 10002929 |. 8B4424 1C mov eax, dword ptr [esp+1C] 1000292D |. 83C4 14 add esp, 14 10002930 |. 8D0C82 lea ecx, dword ptr [edx+eax*4] 10002933 |. 51 push ecx 10002934 |. E8 770C0000 call 100035B0 10002939 |. 8BF0 mov esi, eax 1000293B |. 83C4 04 add esp, 4 1000293E |. 85F6 test esi, esi 10002940 |. 75 0A jnz short 1000294C 10002942 |. 6A 08 push 8 10002944 |. E8 87F3FFFF call 10001CD0 10002949 |. 83C4 04 add esp, 4 1000294C |> 8B4C24 08 mov ecx, dword ptr [esp+8] 10002950 |. 8D5424 0C lea edx, dword ptr [esp+C] 10002954 |. 52 push edx 10002955 |. 8D4424 0C lea eax, dword ptr [esp+C] 10002959 |. 8D148E lea edx, dword ptr [esi+ecx*4] 1000295C |. 50 push eax 1000295D |. 52 push edx 1000295E |. 56 push esi 1000295F |. 57 push edi 10002960 |. E8 1B000000 call 10002980 10002965 |. 8B4424 1C mov eax, dword ptr [esp+1C] 10002969 |. 83C4 14 add esp, 14 1000296C |. 48 dec eax 1000296D |. 8935 2C870010 mov dword ptr [1000872C], esi 10002973 |. 5F pop edi 10002974 |. A3 28870010 mov dword ptr [10008728], eax 10002979 |. 5E pop esi 1000297A |. 83C4 08 add esp, 8 1000297D \. C3 retn 1000297E 90 nop 1000297F 90 nop 10002980 /$ 8B4424 10 mov eax, dword ptr [esp+10] 10002984 |. 53 push ebx 10002985 |. 55 push ebp 10002986 |. 8B6C24 10 mov ebp, dword ptr [esp+10] 1000298A |. 56 push esi 1000298B |. 8B7424 18 mov esi, dword ptr [esp+18] 1000298F |. 57 push edi 10002990 |. 8B7C24 24 mov edi, dword ptr [esp+24] 10002994 |. 85ED test ebp, ebp 10002996 |. C707 00000000 mov dword ptr [edi], 0 1000299C |. C700 01000000 mov dword ptr [eax], 1 100029A2 |. 8B4424 14 mov eax, dword ptr [esp+14] 100029A6 |. BB 04000000 mov ebx, 4 100029AB |. 74 09 je short 100029B6 100029AD |. 8975 00 mov dword ptr [ebp], esi 100029B0 |. 03EB add ebp, ebx 100029B2 |. 896C24 18 mov dword ptr [esp+18], ebp 100029B6 |> 8038 22 cmp byte ptr [eax], 22 100029B9 |. 75 56 jnz short 10002A11 100029BB |. 8A48 01 mov cl, byte ptr [eax+1] 100029BE |. 40 inc eax 100029BF |. 80F9 22 cmp cl, 22 100029C2 |. 74 38 je short 100029FC 100029C4 |> 84C9 /test cl, cl 100029C6 |. 74 34 |je short 100029FC 100029C8 |. 81E1 FF000000 |and ecx, 0FF 100029CE |. 8499 C9840010 |test byte ptr [ecx+100084C9], bl 100029D4 |. 74 0F |je short 100029E5 100029D6 |. 8B17 |mov edx, dword ptr [edi] 100029D8 |. 42 |inc edx 100029D9 |. 85F6 |test esi, esi 100029DB |. 8917 |mov dword ptr [edi], edx 100029DD |. 74 06 |je short 100029E5 100029DF |. 8A08 |mov cl, byte ptr [eax] 100029E1 |. 880E |mov byte ptr [esi], cl 100029E3 |. 46 |inc esi 100029E4 |. 40 |inc eax 100029E5 |> 8B17 |mov edx, dword ptr [edi] 100029E7 |. 42 |inc edx 100029E8 |. 85F6 |test esi, esi 100029EA |. 8917 |mov dword ptr [edi], edx 100029EC |. 74 05 |je short 100029F3 100029EE |. 8A10 |mov dl, byte ptr [eax] 100029F0 |. 8816 |mov byte ptr [esi], dl 100029F2 |. 46 |inc esi 100029F3 |> 8A48 01 |mov cl, byte ptr [eax+1] 100029F6 |. 40 |inc eax 100029F7 |. 80F9 22 |cmp cl, 22 100029FA |.^ 75 C8 \jnz short 100029C4 100029FC |> 8B17 mov edx, dword ptr [edi] 100029FE |. 42 inc edx 100029FF |. 85F6 test esi, esi 10002A01 |. 8917 mov dword ptr [edi], edx 10002A03 |. 74 04 je short 10002A09 10002A05 |. C606 00 mov byte ptr [esi], 0 10002A08 |. 46 inc esi 10002A09 |> 8038 22 cmp byte ptr [eax], 22 10002A0C |. 75 56 jnz short 10002A64 10002A0E |. 40 inc eax 10002A0F |. EB 53 jmp short 10002A64 10002A11 |> 8B17 /mov edx, dword ptr [edi] ; Default case of switch 10002A47 10002A13 |. 42 |inc edx 10002A14 |. 85F6 |test esi, esi 10002A16 |. 8917 |mov dword ptr [edi], edx 10002A18 |. 74 05 |je short 10002A1F 10002A1A |. 8A08 |mov cl, byte ptr [eax] 10002A1C |. 880E |mov byte ptr [esi], cl 10002A1E |. 46 |inc esi 10002A1F |> 8A08 |mov cl, byte ptr [eax] 10002A21 |. 40 |inc eax 10002A22 |. 884C24 24 |mov byte ptr [esp+24], cl 10002A26 |. 8B5424 24 |mov edx, dword ptr [esp+24] 10002A2A |. 81E2 FF000000 |and edx, 0FF 10002A30 |. 849A C9840010 |test byte ptr [edx+100084C9], bl 10002A36 |. 74 0F |je short 10002A47 10002A38 |. 8B17 |mov edx, dword ptr [edi] 10002A3A |. 42 |inc edx 10002A3B |. 85F6 |test esi, esi 10002A3D |. 8917 |mov dword ptr [edi], edx 10002A3F |. 74 05 |je short 10002A46 10002A41 |. 8A10 |mov dl, byte ptr [eax] 10002A43 |. 8816 |mov byte ptr [esi], dl 10002A45 |. 46 |inc esi 10002A46 |> 40 |inc eax 10002A47 |> 80F9 20 |cmp cl, 20 ; Switch (cases 0..20) 10002A4A |. 74 09 |je short 10002A55 10002A4C |. 84C9 |test cl, cl 10002A4E |. 74 09 |je short 10002A59 10002A50 |. 80F9 09 |cmp cl, 9 10002A53 |.^ 75 BC \jnz short 10002A11 10002A55 |> 84C9 test cl, cl ; Cases 9 (TAB),20 (' ') of switch 10002A47 10002A57 |. 75 03 jnz short 10002A5C 10002A59 |> 48 dec eax ; Case 0 of switch 10002A47 10002A5A |. EB 08 jmp short 10002A64 10002A5C |> 85F6 test esi, esi 10002A5E |. 74 04 je short 10002A64 10002A60 |. C646 FF 00 mov byte ptr [esi-1], 0 10002A64 |> 33D2 xor edx, edx 10002A66 |. 895424 24 mov dword ptr [esp+24], edx 10002A6A |> 8038 00 /cmp byte ptr [eax], 0 10002A6D |. 0F84 03010000 |je 10002B76 10002A73 |> 8A08 |/mov cl, byte ptr [eax] 10002A75 |. 80F9 20 ||cmp cl, 20 10002A78 |. 74 05 ||je short 10002A7F 10002A7A |. 80F9 09 ||cmp cl, 9 10002A7D |. 75 03 ||jnz short 10002A82 10002A7F |> 40 ||inc eax 10002A80 |.^ EB F1 |\jmp short 10002A73 10002A82 |> 8038 00 |cmp byte ptr [eax], 0 10002A85 |. 0F84 EB000000 |je 10002B76 10002A8B |. 85ED |test ebp, ebp 10002A8D |. 74 09 |je short 10002A98 10002A8F |. 8975 00 |mov dword ptr [ebp], esi 10002A92 |. 03EB |add ebp, ebx 10002A94 |. 896C24 18 |mov dword ptr [esp+18], ebp 10002A98 |> 8B4C24 20 |mov ecx, dword ptr [esp+20] 10002A9C |. FF01 |inc dword ptr [ecx] 10002A9E |> 8A18 |/mov bl, byte ptr [eax] 10002AA0 |. 33C9 ||xor ecx, ecx 10002AA2 |. 80FB 5C ||cmp bl, 5C 10002AA5 |. BD 01000000 ||mov ebp, 1 10002AAA |. 75 0A ||jnz short 10002AB6 10002AAC |> 8A58 01 ||/mov bl, byte ptr [eax+1] 10002AAF |. 40 |||inc eax 10002AB0 |. 41 |||inc ecx 10002AB1 |. 80FB 5C |||cmp bl, 5C 10002AB4 |.^ 74 F6 ||\je short 10002AAC 10002AB6 |> 8038 22 ||cmp byte ptr [eax], 22 10002AB9 |. 75 25 ||jnz short 10002AE0 10002ABB |. F6C1 01 ||test cl, 1 10002ABE |. 75 1E ||jnz short 10002ADE 10002AC0 |. 85D2 ||test edx, edx 10002AC2 |. 74 09 ||je short 10002ACD 10002AC4 |. 8078 01 22 ||cmp byte ptr [eax+1], 22 10002AC8 |. 75 03 ||jnz short 10002ACD 10002ACA |. 40 ||inc eax 10002ACB |. EB 02 ||jmp short 10002ACF 10002ACD |> 33ED ||xor ebp, ebp 10002ACF |> 8B5C24 24 ||mov ebx, dword ptr [esp+24] 10002AD3 |. 33D2 ||xor edx, edx 10002AD5 |. 85DB ||test ebx, ebx 10002AD7 |. 0F94C2 ||sete dl 10002ADA |. 895424 24 ||mov dword ptr [esp+24], edx 10002ADE |> D1E9 ||shr ecx, 1 10002AE0 |> 8BD9 ||mov ebx, ecx 10002AE2 |. 49 ||dec ecx 10002AE3 |. 85DB ||test ebx, ebx 10002AE5 |. 74 11 ||je short 10002AF8 10002AE7 |. 41 ||inc ecx 10002AE8 |> 85F6 ||/test esi, esi 10002AEA |. 74 04 |||je short 10002AF0 10002AEC |. C606 5C |||mov byte ptr [esi], 5C 10002AEF |. 46 |||inc esi 10002AF0 |> 8B1F |||mov ebx, dword ptr [edi] 10002AF2 |. 43 |||inc ebx 10002AF3 |. 49 |||dec ecx 10002AF4 |. 891F |||mov dword ptr [edi], ebx 10002AF6 |.^ 75 F0 ||\jnz short 10002AE8 10002AF8 |> 8A08 ||mov cl, byte ptr [eax] 10002AFA |. 84C9 ||test cl, cl 10002AFC |. 74 5D ||je short 10002B5B 10002AFE |. 85D2 ||test edx, edx 10002B00 |. 75 0A ||jnz short 10002B0C 10002B02 |. 80F9 20 ||cmp cl, 20 10002B05 |. 74 54 ||je short 10002B5B 10002B07 |. 80F9 09 ||cmp cl, 9 10002B0A |. 74 4F ||je short 10002B5B 10002B0C |> 85ED ||test ebp, ebp 10002B0E |. 74 45 ||je short 10002B55 10002B10 |. 85F6 ||test esi, esi 10002B12 |. 74 2A ||je short 10002B3E 10002B14 |. 8BD9 ||mov ebx, ecx 10002B16 |. 81E3 FF000000 ||and ebx, 0FF 10002B1C |. F683 C9840010>||test byte ptr [ebx+100084C9], 4 10002B23 |. 74 09 ||je short 10002B2E 10002B25 |. 880E ||mov byte ptr [esi], cl 10002B27 |. 8B0F ||mov ecx, dword ptr [edi] 10002B29 |. 46 ||inc esi 10002B2A |. 40 ||inc eax 10002B2B |. 41 ||inc ecx 10002B2C |. 890F ||mov dword ptr [edi], ecx 10002B2E |> 8A08 ||mov cl, byte ptr [eax] 10002B30 |. 880E ||mov byte ptr [esi], cl 10002B32 |. 8B0F ||mov ecx, dword ptr [edi] 10002B34 |. 46 ||inc esi 10002B35 |. 41 ||inc ecx 10002B36 |. 890F ||mov dword ptr [edi], ecx 10002B38 |. 40 ||inc eax 10002B39 |.^ E9 60FFFFFF ||jmp 10002A9E 10002B3E |> 81E1 FF000000 ||and ecx, 0FF 10002B44 |. F681 C9840010>||test byte ptr [ecx+100084C9], 4 10002B4B |. 74 06 ||je short 10002B53 10002B4D |. 8B0F ||mov ecx, dword ptr [edi] 10002B4F |. 40 ||inc eax 10002B50 |. 41 ||inc ecx 10002B51 |. 890F ||mov dword ptr [edi], ecx 10002B53 |> FF07 ||inc dword ptr [edi] 10002B55 |> 40 ||inc eax 10002B56 |.^ E9 43FFFFFF |\jmp 10002A9E 10002B5B |> 85F6 |test esi, esi 10002B5D |. 74 04 |je short 10002B63 10002B5F |. C606 00 |mov byte ptr [esi], 0 10002B62 |. 46 |inc esi 10002B63 |> 8B0F |mov ecx, dword ptr [edi] 10002B65 |. 8B6C24 18 |mov ebp, dword ptr [esp+18] 10002B69 |. 41 |inc ecx 10002B6A |. BB 04000000 |mov ebx, 4 10002B6F |. 890F |mov dword ptr [edi], ecx 10002B71 |.^ E9 F4FEFFFF \jmp 10002A6A 10002B76 |> 85ED test ebp, ebp 10002B78 |. 74 07 je short 10002B81 10002B7A |. C745 00 00000>mov dword ptr [ebp], 0 10002B81 |> 8B4424 20 mov eax, dword ptr [esp+20] 10002B85 |. 5F pop edi 10002B86 |. 5E pop esi 10002B87 |. 5D pop ebp 10002B88 |. 8B08 mov ecx, dword ptr [eax] 10002B8A |. 5B pop ebx 10002B8B |. 41 inc ecx 10002B8C |. 8908 mov dword ptr [eax], ecx 10002B8E \. C3 retn 10002B8F 90 nop 10002B90 /$ A1 68880010 mov eax, dword ptr [10008868] 10002B95 |. 53 push ebx 10002B96 |. 55 push ebp 10002B97 |. 8B2D 54500010 mov ebp, dword ptr [<&KERNEL32.GetEn>; kernel32.GetEnvironmentStringsA 10002B9D |. 56 push esi 10002B9E |. 33F6 xor esi, esi 10002BA0 |. 33DB xor ebx, ebx 10002BA2 |. 57 push edi 10002BA3 |. 8B3D 58500010 mov edi, dword ptr [<&KERNEL32.GetEn>; kernel32.GetEnvironmentStringsW 10002BA9 |. 85C0 test eax, eax 10002BAB |. 75 25 jnz short 10002BD2 10002BAD |. FFD7 call edi ; [GetEnvironmentStringsW 10002BAF |. 8BF0 mov esi, eax 10002BB1 |. 85F6 test esi, esi 10002BB3 |. 74 07 je short 10002BBC 10002BB5 |. B8 01000000 mov eax, 1 10002BBA |. EB 11 jmp short 10002BCD 10002BBC |> FFD5 call ebp 10002BBE |. 8BD8 mov ebx, eax 10002BC0 |. 85DB test ebx, ebx 10002BC2 |. 0F84 17010000 je 10002CDF 10002BC8 |. B8 02000000 mov eax, 2 10002BCD |> A3 68880010 mov dword ptr [10008868], eax 10002BD2 |> 83F8 01 cmp eax, 1 10002BD5 |. 0F85 97000000 jnz 10002C72 10002BDB |. 85F6 test esi, esi 10002BDD |. 75 0C jnz short 10002BEB 10002BDF |. FFD7 call edi 10002BE1 |. 8BF0 mov esi, eax 10002BE3 |. 85F6 test esi, esi 10002BE5 |. 0F84 F4000000 je 10002CDF 10002BEB |> 66:833E 00 cmp word ptr [esi], 0 10002BEF |. 8BC6 mov eax, esi 10002BF1 |. 74 12 je short 10002C05 10002BF3 |> 83C0 02 /add eax, 2 10002BF6 |. 66:8338 00 |cmp word ptr [eax], 0 10002BFA |.^ 75 F7 |jnz short 10002BF3 10002BFC |. 83C0 02 |add eax, 2 10002BFF |. 66:8338 00 |cmp word ptr [eax], 0 10002C03 |.^ 75 EE \jnz short 10002BF3 10002C05 |> 2BC6 sub eax, esi 10002C07 |. 6A 00 push 0 ; /pDefaultCharUsed = NULL 10002C09 |. D1F8 sar eax, 1 ; | 10002C0B |. 40 inc eax ; | 10002C0C |. 6A 00 push 0 ; |pDefaultChar = NULL 10002C0E |. 8BE8 mov ebp, eax ; | 10002C10 |. 6A 00 push 0 ; |MultiByteCount = 0 10002C12 |. 6A 00 push 0 ; |MultiByteStr = NULL 10002C14 |. 55 push ebp ; |WideCharCount 10002C15 |. 56 push esi ; |WideCharStr 10002C16 |. 6A 00 push 0 ; |Options = 0 10002C18 |. 6A 00 push 0 ; |CodePage = CP_ACP 10002C1A |. FF15 30500010 call dword ptr [<&KERNEL32.WideCharTo>; \WideCharToMultiByte 10002C20 |. 8BF8 mov edi, eax 10002C22 |. 85FF test edi, edi 10002C24 |. 74 3E je short 10002C64 10002C26 |. 57 push edi 10002C27 |. E8 84090000 call 100035B0 10002C2C |. 8BD8 mov ebx, eax 10002C2E |. 83C4 04 add esp, 4 10002C31 |. 85DB test ebx, ebx 10002C33 |. 74 2F je short 10002C64 10002C35 |. 6A 00 push 0 ; /pDefaultCharUsed = NULL 10002C37 |. 6A 00 push 0 ; |pDefaultChar = NULL 10002C39 |. 57 push edi ; |MultiByteCount 10002C3A |. 53 push ebx ; |MultiByteStr 10002C3B |. 55 push ebp ; |WideCharCount 10002C3C |. 56 push esi ; |WideCharStr 10002C3D |. 6A 00 push 0 ; |Options = 0 10002C3F |. 6A 00 push 0 ; |CodePage = CP_ACP 10002C41 |. FF15 30500010 call dword ptr [<&KERNEL32.WideCharTo>; \WideCharToMultiByte 10002C47 |. 85C0 test eax, eax 10002C49 |. 75 0B jnz short 10002C56 10002C4B |. 53 push ebx 10002C4C |. E8 0F080000 call 10003460 10002C51 |. 83C4 04 add esp, 4 10002C54 |. 33DB xor ebx, ebx 10002C56 |> 56 push esi ; /EnvironmentBlock 10002C57 |. FF15 04500010 call dword ptr [<&KERNEL32.FreeEnviro>; \FreeEnvironmentStringsW 10002C5D |. 8BC3 mov eax, ebx 10002C5F |. 5F pop edi 10002C60 |. 5E pop esi 10002C61 |. 5D pop ebp 10002C62 |. 5B pop ebx 10002C63 |. C3 retn 10002C64 |> 56 push esi ; /EnvironmentBlock 10002C65 |. FF15 04500010 call dword ptr [<&KERNEL32.FreeEnviro>; \FreeEnvironmentStringsW 10002C6B |. 33C0 xor eax, eax 10002C6D |. 5F pop edi 10002C6E |. 5E pop esi 10002C6F |. 5D pop ebp 10002C70 |. 5B pop ebx 10002C71 |. C3 retn 10002C72 |> 83F8 02 cmp eax, 2 10002C75 |. 75 68 jnz short 10002CDF 10002C77 |. 85DB test ebx, ebx 10002C79 |. 75 08 jnz short 10002C83 10002C7B |. FFD5 call ebp 10002C7D |. 8BD8 mov ebx, eax 10002C7F |. 85DB test ebx, ebx 10002C81 |. 74 5C je short 10002CDF 10002C83 |> 8A0B mov cl, byte ptr [ebx] 10002C85 |. 8BC3 mov eax, ebx 10002C87 |. 84C9 test cl, cl 10002C89 |. 74 10 je short 10002C9B 10002C8B |> 8A48 01 /mov cl, byte ptr [eax+1] 10002C8E |. 40 |inc eax 10002C8F |. 84C9 |test cl, cl 10002C91 |.^ 75 F8 |jnz short 10002C8B 10002C93 |. 8A48 01 |mov cl, byte ptr [eax+1] 10002C96 |. 40 |inc eax 10002C97 |. 84C9 |test cl, cl 10002C99 |.^ 75 F0 \jnz short 10002C8B 10002C9B |> 2BC3 sub eax, ebx 10002C9D |. 40 inc eax 10002C9E |. 8BF0 mov esi, eax 10002CA0 |. 56 push esi 10002CA1 |. E8 0A090000 call 100035B0 10002CA6 |. 8BE8 mov ebp, eax 10002CA8 |. 83C4 04 add esp, 4 10002CAB |. 85ED test ebp, ebp 10002CAD |. 75 0E jnz short 10002CBD 10002CAF |. 53 push ebx ; /EnvironmentBlock 10002CB0 |. FF15 00500010 call dword ptr [<&KERNEL32.FreeEnviro>; \FreeEnvironmentStringsA 10002CB6 |. 33C0 xor eax, eax 10002CB8 |. 5F pop edi 10002CB9 |. 5E pop esi 10002CBA |. 5D pop ebp 10002CBB |. 5B pop ebx 10002CBC |. C3 retn 10002CBD |> 8BCE mov ecx, esi 10002CBF |. 8BF3 mov esi, ebx 10002CC1 |. 8BC1 mov eax, ecx 10002CC3 |. 8BFD mov edi, ebp 10002CC5 |. C1E9 02 shr ecx, 2 10002CC8 |. F3:A5 rep movs dword ptr es:[edi], dword p> 10002CCA |. 8BC8 mov ecx, eax 10002CCC |. 53 push ebx ; /EnvironmentBlock 10002CCD |. 83E1 03 and ecx, 3 ; | 10002CD0 |. F3:A4 rep movs byte ptr es:[edi], byte ptr>; | 10002CD2 |. FF15 00500010 call dword ptr [<&KERNEL32.FreeEnviro>; \FreeEnvironmentStringsA 10002CD8 |. 8BC5 mov eax, ebp 10002CDA |. 5F pop edi 10002CDB |. 5E pop esi 10002CDC |. 5D pop ebp 10002CDD |. 5B pop ebx 10002CDE |. C3 retn 10002CDF |> 5F pop edi 10002CE0 |. 5E pop esi 10002CE1 |. 5D pop ebp 10002CE2 |. 33C0 xor eax, eax 10002CE4 |. 5B pop ebx 10002CE5 \. C3 retn 10002CE6 90 nop 10002CE7 90 nop 10002CE8 90 nop 10002CE9 90 nop 10002CEA 90 nop 10002CEB 90 nop 10002CEC 90 nop 10002CED 90 nop 10002CEE 90 nop 10002CEF 90 nop 10002CF0 /$ 83EC 48 sub esp, 48 10002CF3 |. 53 push ebx 10002CF4 |. 55 push ebp 10002CF5 |. 56 push esi 10002CF6 |. 57 push edi 10002CF7 |. 68 00010000 push 100 10002CFC |. E8 AF080000 call 100035B0 10002D01 |. 8BF0 mov esi, eax 10002D03 |. 83C4 04 add esp, 4 10002D06 |. 85F6 test esi, esi 10002D08 |. 75 0A jnz short 10002D14 10002D0A |. 6A 1B push 1B 10002D0C |. E8 BFEFFFFF call 10001CD0 10002D11 |. 83C4 04 add esp, 4 10002D14 |> 8D86 00010000 lea eax, dword ptr [esi+100] 10002D1A |. 8935 A0880010 mov dword ptr [100088A0], esi 10002D20 |. 3BF0 cmp esi, eax 10002D22 |. C705 A0890010>mov dword ptr [100089A0], 20 10002D2C |. B3 0A mov bl, 0A 10002D2E |. 73 20 jnb short 10002D50 10002D30 |> C646 04 00 /mov byte ptr [esi+4], 0 10002D34 |. C706 FFFFFFFF |mov dword ptr [esi], -1 10002D3A |. 885E 05 |mov byte ptr [esi+5], bl 10002D3D |. 8B0D A0880010 |mov ecx, dword ptr [100088A0] 10002D43 |. 83C6 08 |add esi, 8 10002D46 |. 81C1 00010000 |add ecx, 100 10002D4C |. 3BF1 |cmp esi, ecx 10002D4E |.^ 72 E0 \jb short 10002D30 10002D50 |> 8D5424 14 lea edx, dword ptr [esp+14] 10002D54 |. 52 push edx ; /pStartupinfo 10002D55 |. FF15 18500010 call dword ptr [<&KERNEL32.GetStartup>; \GetStartupInfoA 10002D5B |. 66:837C24 46 >cmp word ptr [esp+46], 0 10002D61 |. 0F84 F2000000 je 10002E59 10002D67 |. 8B4424 48 mov eax, dword ptr [esp+48] 10002D6B |. 85C0 test eax, eax 10002D6D |. 0F84 E6000000 je 10002E59 10002D73 |. 8B08 mov ecx, dword ptr [eax] 10002D75 |. 8D78 04 lea edi, dword ptr [eax+4] 10002D78 |. 81F9 00080000 cmp ecx, 800 10002D7E |. 894C24 10 mov dword ptr [esp+10], ecx 10002D82 |. 8D2C0F lea ebp, dword ptr [edi+ecx] 10002D85 |. 7C 08 jl short 10002D8F 10002D87 |. C74424 10 000>mov dword ptr [esp+10], 800 10002D8F |> 8B4424 10 mov eax, dword ptr [esp+10] 10002D93 |. 8B0D A0890010 mov ecx, dword ptr [100089A0] 10002D99 |. 3BC8 cmp ecx, eax 10002D9B |. 7D 69 jge short 10002E06 10002D9D |. BE A4880010 mov esi, 100088A4 10002DA2 |> 68 00010000 /push 100 10002DA7 |. E8 04080000 |call 100035B0 10002DAC |. 83C4 04 |add esp, 4 10002DAF |. 85C0 |test eax, eax 10002DB1 |. 74 49 |je short 10002DFC 10002DB3 |. 8B0D A0890010 |mov ecx, dword ptr [100089A0] 10002DB9 |. 8906 |mov dword ptr [esi], eax 10002DBB |. 83C1 20 |add ecx, 20 10002DBE |. 890D A0890010 |mov dword ptr [100089A0], ecx 10002DC4 |. 8D88 00010000 |lea ecx, dword ptr [eax+100] 10002DCA |. 3BC1 |cmp eax, ecx 10002DCC |. 73 1C |jnb short 10002DEA 10002DCE |> C640 04 00 |/mov byte ptr [eax+4], 0 10002DD2 |. C700 FFFFFFFF ||mov dword ptr [eax], -1 10002DD8 |. 8858 05 ||mov byte ptr [eax+5], bl 10002DDB |. 8B16 ||mov edx, dword ptr [esi] 10002DDD |. 83C0 08 ||add eax, 8 10002DE0 |. 81C2 00010000 ||add edx, 100 10002DE6 |. 3BC2 ||cmp eax, edx 10002DE8 |.^ 72 E4 |\jb short 10002DCE 10002DEA |> A1 A0890010 |mov eax, dword ptr [100089A0] 10002DEF |. 8B4C24 10 |mov ecx, dword ptr [esp+10] 10002DF3 |. 83C6 04 |add esi, 4 10002DF6 |. 3BC1 |cmp eax, ecx 10002DF8 |.^ 7C A8 \jl short 10002DA2 10002DFA |. EB 0A jmp short 10002E06 10002DFC |> 8B0D A0890010 mov ecx, dword ptr [100089A0] 10002E02 |. 894C24 10 mov dword ptr [esp+10], ecx 10002E06 |> 8B4424 10 mov eax, dword ptr [esp+10] 10002E0A |. 33F6 xor esi, esi 10002E0C |. 85C0 test eax, eax 10002E0E |. 7E 49 jle short 10002E59 10002E10 |> 8B4D 00 /mov ecx, dword ptr [ebp] 10002E13 |. 83F9 FF |cmp ecx, -1 10002E16 |. 74 34 |je short 10002E4C 10002E18 |. 8A07 |mov al, byte ptr [edi] 10002E1A |. A8 01 |test al, 1 10002E1C |. 74 2E |je short 10002E4C 10002E1E |. A8 08 |test al, 8 10002E20 |. 75 0B |jnz short 10002E2D 10002E22 |. 51 |push ecx ; /hFile 10002E23 |. FF15 64500010 |call dword ptr [<&KERNEL32.GetFileTy>; \GetFileType 10002E29 |. 85C0 |test eax, eax 10002E2B |. 74 1F |je short 10002E4C 10002E2D |> 8BD6 |mov edx, esi 10002E2F |. 8BC6 |mov eax, esi 10002E31 |. C1FA 05 |sar edx, 5 10002E34 |. 83E0 1F |and eax, 1F 10002E37 |. 8B0C95 A08800>|mov ecx, dword ptr [edx*4+100088A0] 10002E3E |. 8B55 00 |mov edx, dword ptr [ebp] 10002E41 |. 8914C1 |mov dword ptr [ecx+eax*8], edx 10002E44 |. 8D04C1 |lea eax, dword ptr [ecx+eax*8] 10002E47 |. 8A0F |mov cl, byte ptr [edi] 10002E49 |. 8848 04 |mov byte ptr [eax+4], cl 10002E4C |> 8B4424 10 |mov eax, dword ptr [esp+10] 10002E50 |. 46 |inc esi 10002E51 |. 47 |inc edi 10002E52 |. 83C5 04 |add ebp, 4 10002E55 |. 3BF0 |cmp esi, eax 10002E57 |.^ 7C B7 \jl short 10002E10 10002E59 |> 8B2D 60500010 mov ebp, dword ptr [<&KERNEL32.GetSt>; kernel32.GetStdHandle 10002E5F |. 33DB xor ebx, ebx 10002E61 |> 8B15 A0880010 /mov edx, dword ptr [100088A0] 10002E67 |. 8B04DA |mov eax, dword ptr [edx+ebx*8] 10002E6A |. 8D34DA |lea esi, dword ptr [edx+ebx*8] 10002E6D |. 83F8 FF |cmp eax, -1 10002E70 |. 75 54 |jnz short 10002EC6 10002E72 |. 85DB |test ebx, ebx 10002E74 |. C646 04 81 |mov byte ptr [esi+4], 81 10002E78 |. 75 07 |jnz short 10002E81 10002E7A |. B8 F6FFFFFF |mov eax, -0A 10002E7F |. EB 0A |jmp short 10002E8B 10002E81 |> 8BC3 |mov eax, ebx 10002E83 |. 48 |dec eax 10002E84 |. F7D8 |neg eax 10002E86 |. 1BC0 |sbb eax, eax 10002E88 |. 83C0 F5 |add eax, -0B 10002E8B |> 50 |push eax 10002E8C |. FFD5 |call ebp 10002E8E |. 8BF8 |mov edi, eax 10002E90 |. 83FF FF |cmp edi, -1 10002E93 |. 74 2A |je short 10002EBF 10002E95 |. 57 |push edi ; /hFile 10002E96 |. FF15 64500010 |call dword ptr [<&KERNEL32.GetFileTy>; \GetFileType 10002E9C |. 85C0 |test eax, eax 10002E9E |. 74 1F |je short 10002EBF 10002EA0 |. 25 FF000000 |and eax, 0FF 10002EA5 |. 893E |mov dword ptr [esi], edi 10002EA7 |. 83F8 02 |cmp eax, 2 10002EAA |. 75 07 |jnz short 10002EB3 10002EAC |. 8A46 04 |mov al, byte ptr [esi+4] 10002EAF |. 0C 40 |or al, 40 10002EB1 |. EB 18 |jmp short 10002ECB 10002EB3 |> 83F8 03 |cmp eax, 3 10002EB6 |. 75 16 |jnz short 10002ECE 10002EB8 |. 8A46 04 |mov al, byte ptr [esi+4] 10002EBB |. 0C 08 |or al, 8 10002EBD |. EB 0C |jmp short 10002ECB 10002EBF |> 8A46 04 |mov al, byte ptr [esi+4] 10002EC2 |. 0C 40 |or al, 40 10002EC4 |. EB 05 |jmp short 10002ECB 10002EC6 |> 8A46 04 |mov al, byte ptr [esi+4] 10002EC9 |. 0C 80 |or al, 80 10002ECB |> 8846 04 |mov byte ptr [esi+4], al 10002ECE |> 43 |inc ebx 10002ECF |. 83FB 03 |cmp ebx, 3 10002ED2 |.^ 7C 8D \jl short 10002E61 10002ED4 |. A1 A0890010 mov eax, dword ptr [100089A0] 10002ED9 |. 50 push eax ; /nHandles => 0 10002EDA |. FF15 5C500010 call dword ptr [<&KERNEL32.SetHandleC>; \SetHandleCount 10002EE0 |. 5F pop edi 10002EE1 |. 5E pop esi 10002EE2 |. 5D pop ebp 10002EE3 |. 5B pop ebx 10002EE4 |. 83C4 48 add esp, 48 10002EE7 \. C3 retn 10002EE8 90 nop 10002EE9 90 nop 10002EEA 90 nop 10002EEB 90 nop 10002EEC 90 nop 10002EED 90 nop 10002EEE 90 nop 10002EEF 90 nop 10002EF0 /$ 6A 00 push 0 ; /MaximumSize = 0 10002EF2 |. 68 00100000 push 1000 ; |InitialSize = 1000 (4096.) 10002EF7 |. 6A 01 push 1 ; |Flags = HEAP_NO_SERIALIZE 10002EF9 |. FF15 6C500010 call dword ptr [<&KERNEL32.HeapCreate>; \HeapCreate 10002EFF |. 85C0 test eax, eax 10002F01 |. A3 90880010 mov dword ptr [10008890], eax 10002F06 |. 75 01 jnz short 10002F09 10002F08 |. C3 retn 10002F09 |> E8 52070000 call 10003660 10002F0E |. 85C0 test eax, eax 10002F10 |. 75 0F jnz short 10002F21 10002F12 |. A1 90880010 mov eax, dword ptr [10008890] 10002F17 |. 50 push eax ; /hHeap => NULL 10002F18 |. FF15 68500010 call dword ptr [<&KERNEL32.HeapDestro>; \HeapDestroy 10002F1E |. 33C0 xor eax, eax 10002F20 |. C3 retn 10002F21 |> B8 01000000 mov eax, 1 10002F26 \. C3 retn 10002F27 90 nop 10002F28 90 nop 10002F29 90 nop 10002F2A 90 nop 10002F2B 90 nop 10002F2C 90 nop 10002F2D 90 nop 10002F2E 90 nop 10002F2F 90 nop 10002F30 /$ 55 push ebp 10002F31 |. 8BEC mov ebp, esp 10002F33 |. 53 push ebx 10002F34 |. 56 push esi 10002F35 |. 57 push edi 10002F36 |. 55 push ebp 10002F37 |. 6A 00 push 0 ; /_eax_value = 0 10002F39 |. 6A 00 push 0 ; |pExcptRec = NULL 10002F3B |. 68 482F0010 push 10002F48 ; |ReturnAddr = pjgl.10002F48 10002F40 |. FF75 08 push dword ptr [ebp+8] ; |pRegistrationFrame 10002F43 |. E8 C8120000 call <jmp.&KERNEL32.RtlUnwind> ; \RtlUnwind 10002F48 |. 5D pop ebp 10002F49 |. 5F pop edi 10002F4A |. 5E pop esi 10002F4B |. 5B pop ebx 10002F4C |. 8BE5 mov esp, ebp 10002F4E |. 5D pop ebp 10002F4F \. C3 retn 10002F50 /$ 8B4C24 04 mov ecx, dword ptr [esp+4] ; 结构异常处理程序 10002F54 |. F741 04 06000>test dword ptr [ecx+4], 6 10002F5B |. B8 01000000 mov eax, 1 10002F60 |. 74 0F je short 10002F71 10002F62 |. 8B4424 08 mov eax, dword ptr [esp+8] 10002F66 |. 8B5424 10 mov edx, dword ptr [esp+10] 10002F6A |. 8902 mov dword ptr [edx], eax 10002F6C |. B8 03000000 mov eax, 3 10002F71 \> C3 retn 10002F72 /$ 53 push ebx 10002F73 |. 56 push esi 10002F74 |. 57 push edi 10002F75 |. 8B4424 10 mov eax, dword ptr [esp+10] 10002F79 |. 50 push eax 10002F7A |. 6A FE push -2 10002F7C |. 68 502F0010 push 10002F50 ; SE 处理程序安装 10002F81 |. 64:FF35 00000>push dword ptr fs:[0] 10002F88 |. 64:8925 00000>mov dword ptr fs:[0], esp 10002F8F |> 8B4424 20 /mov eax, dword ptr [esp+20] 10002F93 |. 8B58 08 |mov ebx, dword ptr [eax+8] 10002F96 |. 8B70 0C |mov esi, dword ptr [eax+C] 10002F99 |. 83FE FF |cmp esi, -1 10002F9C |. 74 2E |je short 10002FCC 10002F9E |. 3B7424 24 |cmp esi, dword ptr [esp+24] 10002FA2 |. 74 28 |je short 10002FCC 10002FA4 |. 8D3476 |lea esi, dword ptr [esi+esi*2] 10002FA7 |. 8B0CB3 |mov ecx, dword ptr [ebx+esi*4] 10002FAA |. 894C24 08 |mov dword ptr [esp+8], ecx 10002FAE |. 8948 0C |mov dword ptr [eax+C], ecx 10002FB1 |. 837CB3 04 00 |cmp dword ptr [ebx+esi*4+4], 0 10002FB6 |. 75 12 |jnz short 10002FCA 10002FB8 |. 68 01010000 |push 101 10002FBD |. 8B44B3 08 |mov eax, dword ptr [ebx+esi*4+8] 10002FC1 |. E8 40000000 |call 10003006 10002FC6 |. FF54B3 08 |call dword ptr [ebx+esi*4+8] 10002FCA |>^ EB C3 \jmp short 10002F8F 10002FCC |> 64:8F05 00000>pop dword ptr fs:[0] 10002FD3 |. 83C4 0C add esp, 0C 10002FD6 |. 5F pop edi 10002FD7 |. 5E pop esi 10002FD8 |. 5B pop ebx 10002FD9 \. C3 retn 10002FDA . 33C0 xor eax, eax 10002FDC . 64:8B0D 00000>mov ecx, dword ptr fs:[0] 10002FE3 . 8179 04 502F0>cmp dword ptr [ecx+4], 10002F50 ; 入口地址 10002FEA . 75 10 jnz short 10002FFC 10002FEC . 8B51 0C mov edx, dword ptr [ecx+C] 10002FEF . 8B52 0C mov edx, dword ptr [edx+C] 10002FF2 . 3951 08 cmp dword ptr [ecx+8], edx 10002FF5 . 75 05 jnz short 10002FFC 10002FF7 . B8 01000000 mov eax, 1 10002FFC > C3 retn 10002FFD . 53 push ebx 10002FFE . 51 push ecx 10002FFF . BB DC630010 mov ebx, 100063DC 10003004 . EB 0A jmp short 10003010 10003006 /$ 53 push ebx 10003007 |. 51 push ecx 10003008 |. BB DC630010 mov ebx, 100063DC 1000300D |. 8B4D 08 mov ecx, dword ptr [ebp+8] 10003010 |> 894B 08 mov dword ptr [ebx+8], ecx 10003013 |. 8943 04 mov dword ptr [ebx+4], eax 10003016 |. 896B 0C mov dword ptr [ebx+C], ebp 10003019 |. 59 pop ecx 1000301A |. 5B pop ebx 1000301B \. C2 0400 retn 4 1000301E CC int3 1000301F CC int3 10003020 56 db 56 ; CHAR 'V' 10003021 43 db 43 ; CHAR 'C' 10003022 32 db 32 ; CHAR '2' 10003023 30 db 30 ; CHAR '0' 10003024 58 db 58 ; CHAR 'X' 10003025 43 db 43 ; CHAR 'C' 10003026 30 db 30 ; CHAR '0' 10003027 30 db 30 ; CHAR '0' 10003028 /$ 55 push ebp ; 结构异常处理程序 10003029 |. 8BEC mov ebp, esp 1000302B |. 83EC 08 sub esp, 8 1000302E |. 53 push ebx 1000302F |. 56 push esi 10003030 |. 57 push edi 10003031 |. 55 push ebp 10003032 |. FC cld 10003033 |. 8B5D 0C mov ebx, dword ptr [ebp+C] 10003036 |. 8B45 08 mov eax, dword ptr [ebp+8] 10003039 |. F740 04 06000>test dword ptr [eax+4], 6 10003040 |. 0F85 82000000 jnz 100030C8 10003046 |. 8945 F8 mov dword ptr [ebp-8], eax 10003049 |. 8B45 10 mov eax, dword ptr [ebp+10] 1000304C |. 8945 FC mov dword ptr [ebp-4], eax 1000304F |. 8D45 F8 lea eax, dword ptr [ebp-8] 10003052 |. 8943 FC mov dword ptr [ebx-4], eax 10003055 |. 8B73 0C mov esi, dword ptr [ebx+C] 10003058 |. 8B7B 08 mov edi, dword ptr [ebx+8] 1000305B |> 83FE FF /cmp esi, -1 1000305E |. 74 61 |je short 100030C1 10003060 |. 8D0C76 |lea ecx, dword ptr [esi+esi*2] 10003063 |. 837C8F 04 00 |cmp dword ptr [edi+ecx*4+4], 0 10003068 |. 74 45 |je short 100030AF 1000306A |. 56 |push esi 1000306B |. 55 |push ebp 1000306C |. 8D6B 10 |lea ebp, dword ptr [ebx+10] 1000306F |. FF548F 04 |call dword ptr [edi+ecx*4+4] 10003073 |. 5D |pop ebp 10003074 |. 5E |pop esi 10003075 |. 8B5D 0C |mov ebx, dword ptr [ebp+C] 10003078 |. 0BC0 |or eax, eax 1000307A |. 74 33 |je short 100030AF 1000307C |. 78 3C |js short 100030BA 1000307E |. 8B7B 08 |mov edi, dword ptr [ebx+8] 10003081 |. 53 |push ebx 10003082 |. E8 A9FEFFFF |call 10002F30 10003087 |. 83C4 04 |add esp, 4 1000308A |. 8D6B 10 |lea ebp, dword ptr [ebx+10] 1000308D |. 56 |push esi 1000308E |. 53 |push ebx 1000308F |. E8 DEFEFFFF |call 10002F72 10003094 |. 83C4 08 |add esp, 8 10003097 |. 8D0C76 |lea ecx, dword ptr [esi+esi*2] 1000309A |. 6A 01 |push 1 1000309C |. 8B448F 08 |mov eax, dword ptr [edi+ecx*4+8] 100030A0 |. E8 61FFFFFF |call 10003006 100030A5 |. 8B048F |mov eax, dword ptr [edi+ecx*4] 100030A8 |. 8943 0C |mov dword ptr [ebx+C], eax 100030AB |. FF548F 08 |call dword ptr [edi+ecx*4+8] 100030AF |> 8B7B 08 |mov edi, dword ptr [ebx+8] 100030B2 |. 8D0C76 |lea ecx, dword ptr [esi+esi*2] 100030B5 |. 8B348F |mov esi, dword ptr [edi+ecx*4] 100030B8 |.^ EB A1 \jmp short 1000305B 100030BA |> B8 00000000 mov eax, 0 100030BF |. EB 1C jmp short 100030DD 100030C1 |> B8 01000000 mov eax, 1 100030C6 |. EB 15 jmp short 100030DD 100030C8 |> 55 push ebp 100030C9 |. 8D6B 10 lea ebp, dword ptr [ebx+10] 100030CC |. 6A FF push -1 100030CE |. 53 push ebx 100030CF |. E8 9EFEFFFF call 10002F72 100030D4 |. 83C4 08 add esp, 8 100030D7 |. 5D pop ebp 100030D8 |. B8 01000000 mov eax, 1 100030DD |> 5D pop ebp 100030DE |. 5F pop edi 100030DF |. 5E pop esi 100030E0 |. 5B pop ebx 100030E1 |. 8BE5 mov esp, ebp 100030E3 |. 5D pop ebp 100030E4 \. C3 retn 100030E5 . 55 push ebp 100030E6 . 8B4C24 08 mov ecx, dword ptr [esp+8] 100030EA . 8B29 mov ebp, dword ptr [ecx] 100030EC . 8B41 1C mov eax, dword ptr [ecx+1C] 100030EF . 50 push eax 100030F0 . 8B41 18 mov eax, dword ptr [ecx+18] 100030F3 . 50 push eax 100030F4 . E8 79FEFFFF call 10002F72 100030F9 . 83C4 08 add esp, 8 100030FC . 5D pop ebp 100030FD . C2 0400 retn 4 10003100 /$ A1 C4840010 mov eax, dword ptr [100084C4] 10003105 |. 83F8 01 cmp eax, 1 10003108 |. 74 0D je short 10003117 1000310A |. 85C0 test eax, eax 1000310C |. 75 2E jnz short 1000313C 1000310E |. 833D 34600010>cmp dword ptr [10006034], 1 10003115 |. 75 25 jnz short 1000313C 10003117 |> 68 FC000000 push 0FC 1000311C |. E8 1F000000 call 10003140 10003121 |. A1 6C880010 mov eax, dword ptr [1000886C] 10003126 |. 83C4 04 add esp, 4 10003129 |. 85C0 test eax, eax 1000312B |. 74 02 je short 1000312F 1000312D |. FFD0 call eax 1000312F |> 68 FF000000 push 0FF 10003134 |. E8 07000000 call 10003140 10003139 |. 83C4 04 add esp, 4 1000313C \> C3 retn 1000313D 90 nop 1000313E 90 nop 1000313F 90 nop 10003140 /$ 8B4C24 04 mov ecx, dword ptr [esp+4] 10003144 |. 81EC A8010000 sub esp, 1A8 1000314A |. B8 F0630010 mov eax, 100063F0 1000314F |. 53 push ebx 10003150 |. 55 push ebp 10003151 |. 56 push esi 10003152 |. 57 push edi 10003153 |. 33ED xor ebp, ebp 10003155 |> 3B08 /cmp ecx, dword ptr [eax] 10003157 |. 74 0B |je short 10003164 10003159 |. 83C0 08 |add eax, 8 1000315C |. 45 |inc ebp 1000315D |. 3D 80640010 |cmp eax, 10006480 10003162 |.^ 72 F1 \jb short 10003155 10003164 |> 3B0CED F06300>cmp ecx, dword ptr [ebp*8+100063F0] 1000316B |. 0F85 9A010000 jnz 1000330B 10003171 |. A1 C4840010 mov eax, dword ptr [100084C4] 10003176 |. 83F8 01 cmp eax, 1 10003179 |. 0F84 4E010000 je 100032CD 1000317F |. 85C0 test eax, eax 10003181 |. 75 0D jnz short 10003190 10003183 |. 833D 34600010>cmp dword ptr [10006034], 1 1000318A |. 0F84 3D010000 je 100032CD 10003190 |> 81F9 FC000000 cmp ecx, 0FC 10003196 |. 0F84 6F010000 je 1000330B 1000319C |. 8D8424 B40000>lea eax, dword ptr [esp+B4] 100031A3 |. 68 04010000 push 104 ; /BufSize = 104 (260.) 100031A8 |. 50 push eax ; |PathBuffer 100031A9 |. 6A 00 push 0 ; |hModule = NULL 100031AB |. FF15 48500010 call dword ptr [<&KERNEL32.GetModuleF>; \GetModuleFileNameA 100031B1 |. 85C0 test eax, eax 100031B3 |. 75 16 jnz short 100031CB 100031B5 |. B9 05000000 mov ecx, 5 100031BA |. BE 8C530010 mov esi, 1000538C ; ASCII "<program name unknown>" 100031BF |. 8DBC24 B40000>lea edi, dword ptr [esp+B4] 100031C6 |. F3:A5 rep movs dword ptr es:[edi], dword p> 100031C8 |. 66:A5 movs word ptr es:[edi], word ptr [esi> 100031CA |. A4 movs byte ptr es:[edi], byte ptr [esi> 100031CB |> 8DBC24 B40000>lea edi, dword ptr [esp+B4] 100031D2 |. 83C9 FF or ecx, FFFFFFFF 100031D5 |. 33C0 xor eax, eax 100031D7 |. 8D9C24 B40000>lea ebx, dword ptr [esp+B4] 100031DE |. F2:AE repne scas byte ptr es:[edi] 100031E0 |. F7D1 not ecx 100031E2 |. 83F9 3C cmp ecx, 3C 100031E5 |. 76 2D jbe short 10003214 100031E7 |. 8DBC24 B40000>lea edi, dword ptr [esp+B4] 100031EE |. 83C9 FF or ecx, FFFFFFFF 100031F1 |. F2:AE repne scas byte ptr es:[edi] 100031F3 |. F7D1 not ecx 100031F5 |. 49 dec ecx 100031F6 |. 6A 03 push 3 100031F8 |. 8BD9 mov ebx, ecx 100031FA |. 8D8C24 B80000>lea ecx, dword ptr [esp+B8] 10003201 |. 83E9 3B sub ecx, 3B 10003204 |. 68 88530010 push 10005388 ; ASCII "..." 10003209 |. 03D9 add ebx, ecx 1000320B |. 53 push ebx 1000320C |. E8 9F020000 call 100034B0 10003211 |. 83C4 0C add esp, 0C 10003214 |> B9 06000000 mov ecx, 6 10003219 |. BE 6C530010 mov esi, 1000536C ; ASCII "Runtime Error!",LF,LF,"Program: " 1000321E |. 8D7C24 14 lea edi, dword ptr [esp+14] 10003222 |. 33C0 xor eax, eax 10003224 |. F3:A5 rep movs dword ptr es:[edi], dword p> 10003226 |. 66:A5 movs word ptr es:[edi], word ptr [esi> 10003228 |. 83C9 FF or ecx, FFFFFFFF 1000322B |. 8BFB mov edi, ebx 1000322D |. F2:AE repne scas byte ptr es:[edi] 1000322F |. F7D1 not ecx 10003231 |. 2BF9 sub edi, ecx 10003233 |. 8D5424 14 lea edx, dword ptr [esp+14] 10003237 |. 8BD9 mov ebx, ecx 10003239 |. 8BF7 mov esi, edi 1000323B |. 83C9 FF or ecx, FFFFFFFF 1000323E |. 8BFA mov edi, edx 10003240 |. F2:AE repne scas byte ptr es:[edi] 10003242 |. 8BCB mov ecx, ebx 10003244 |. 4F dec edi 10003245 |. C1E9 02 shr ecx, 2 10003248 |. F3:A5 rep movs dword ptr es:[edi], dword p> 1000324A |. 8BCB mov ecx, ebx 1000324C |. 8D5424 14 lea edx, dword ptr [esp+14] 10003250 |. 83E1 03 and ecx, 3 10003253 |. 68 10200100 push 12010 10003258 |. F3:A4 rep movs byte ptr es:[edi], byte ptr> 1000325A |. BF 68530010 mov edi, 10005368 ; ASCII LF,LF 1000325F |. 83C9 FF or ecx, FFFFFFFF 10003262 |. F2:AE repne scas byte ptr es:[edi] 10003264 |. F7D1 not ecx 10003266 |. 2BF9 sub edi, ecx 10003268 |. 68 40530010 push 10005340 ; ASCII "Microsoft Visual C++ Runtime Library" 1000326D |. 8BF7 mov esi, edi 1000326F |. 8BD9 mov ebx, ecx 10003271 |. 8BFA mov edi, edx 10003273 |. 83C9 FF or ecx, FFFFFFFF 10003276 |. F2:AE repne scas byte ptr es:[edi] 10003278 |. 8BCB mov ecx, ebx 1000327A |. 4F dec edi 1000327B |. C1E9 02 shr ecx, 2 1000327E |. F3:A5 rep movs dword ptr es:[edi], dword p> 10003280 |. 8BCB mov ecx, ebx 10003282 |. 8D5424 1C lea edx, dword ptr [esp+1C] 10003286 |. 83E1 03 and ecx, 3 10003289 |. F3:A4 rep movs byte ptr es:[edi], byte ptr> 1000328B |. 8B3CED F46300>mov edi, dword ptr [ebp*8+100063F4] 10003292 |. 83C9 FF or ecx, FFFFFFFF 10003295 |. F2:AE repne scas byte ptr es:[edi] 10003297 |. F7D1 not ecx 10003299 |. 2BF9 sub edi, ecx 1000329B |. 8BF7 mov esi, edi 1000329D |. 8BD9 mov ebx, ecx 1000329F |. 8BFA mov edi, edx 100032A1 |. 83C9 FF or ecx, FFFFFFFF 100032A4 |. F2:AE repne scas byte ptr es:[edi] 100032A6 |. 8BCB mov ecx, ebx 100032A8 |. 4F dec edi 100032A9 |. C1E9 02 shr ecx, 2 100032AC |. F3:A5 rep movs dword ptr es:[edi], dword p> 100032AE |. 8BCB mov ecx, ebx 100032B0 |. 8D4424 1C lea eax, dword ptr [esp+1C] 100032B4 |. 83E1 03 and ecx, 3 100032B7 |. 50 push eax 100032B8 |. F3:A4 rep movs byte ptr es:[edi], byte ptr> 100032BA |. E8 C10A0000 call 10003D80 100032BF |. 83C4 0C add esp, 0C 100032C2 |. 5F pop edi 100032C3 |. 5E pop esi 100032C4 |. 5D pop ebp 100032C5 |. 5B pop ebx 100032C6 |. 81C4 A8010000 add esp, 1A8 100032CC |. C3 retn 100032CD |> A1 A0880010 mov eax, dword ptr [100088A0] 100032D2 |. 85C0 test eax, eax 100032D4 |. 74 08 je short 100032DE 100032D6 |. 8B70 10 mov esi, dword ptr [eax+10] 100032D9 |. 83FE FF cmp esi, -1 100032DC |. 75 0A jnz short 100032E8 100032DE |> 6A F4 push -0C ; /DevType = STD_ERROR_HANDLE 100032E0 |. FF15 60500010 call dword ptr [<&KERNEL32.GetStdHand>; \GetStdHandle 100032E6 |. 8BF0 mov esi, eax 100032E8 |> 8B14ED F46300>mov edx, dword ptr [ebp*8+100063F4] 100032EF |. 8D4C24 10 lea ecx, dword ptr [esp+10] 100032F3 |. 6A 00 push 0 ; /pOverlapped = NULL 100032F5 |. 51 push ecx ; |pBytesWritten 100032F6 |. 8BFA mov edi, edx ; | 100032F8 |. 83C9 FF or ecx, FFFFFFFF ; | 100032FB |. 33C0 xor eax, eax ; | 100032FD |. F2:AE repne scas byte ptr es:[edi] ; | 100032FF |. F7D1 not ecx ; | 10003301 |. 49 dec ecx ; | 10003302 |. 51 push ecx ; |nBytesToWrite 10003303 |. 52 push edx ; |Buffer 10003304 |. 56 push esi ; |hFile 10003305 |. FF15 74500010 call dword ptr [<&KERNEL32.WriteFile>>; \WriteFile 1000330B |> 5F pop edi 1000330C |. 5E pop esi 1000330D |. 5D pop ebp 1000330E |. 5B pop ebx 1000330F |. 81C4 A8010000 add esp, 1A8 10003315 \. C3 retn 10003316 90 nop 10003317 90 nop 10003318 90 nop 10003319 90 nop 1000331A 90 nop 1000331B 90 nop 1000331C 90 nop 1000331D 90 nop 1000331E 90 nop 1000331F 90 nop 10003320 /$ 51 push ecx 10003321 |. A1 74880010 mov eax, dword ptr [10008874] 10003326 |. 53 push ebx 10003327 |. 55 push ebp 10003328 |. 56 push esi 10003329 |. 8B35 78500010 mov esi, dword ptr [<&KERNEL32.GetSt>; kernel32.GetStringTypeA 1000332F |. 57 push edi 10003330 |. 33FF xor edi, edi 10003332 |. 3BC7 cmp eax, edi 10003334 |. 75 26 jnz short 1000335C 10003336 |. 8D4424 12 lea eax, dword ptr [esp+12] 1000333A |. 50 push eax ; /CharTypes 1000333B |. 6A 01 push 1 ; |SrcCount = 1 1000333D |. 68 B0500010 push 100050B0 ; |Source = "" 10003342 |. 6A 01 push 1 ; |InfoType = CT_CTYPE1 10003344 |. FF15 7C500010 call dword ptr [<&KERNEL32.GetStringT>; \GetStringTypeW 1000334A |. 85C0 test eax, eax 1000334C |. 0F84 DA000000 je 1000342C 10003352 |. B8 01000000 mov eax, 1 10003357 |. A3 74880010 mov dword ptr [10008874], eax 1000335C |> 83F8 02 cmp eax, 2 1000335F |. 75 2A jnz short 1000338B 10003361 |. 8B4424 2C mov eax, dword ptr [esp+2C] 10003365 |. 3BC7 cmp eax, edi 10003367 |. 75 05 jnz short 1000336E 10003369 |. A1 F8860010 mov eax, dword ptr [100086F8] 1000336E |> 8B5424 24 mov edx, dword ptr [esp+24] 10003372 |. 8B4C24 20 mov ecx, dword ptr [esp+20] 10003376 |. 52 push edx 10003377 |. 8B5424 20 mov edx, dword ptr [esp+20] 1000337B |. 51 push ecx 1000337C |. 8B4C24 20 mov ecx, dword ptr [esp+20] 10003380 |. 52 push edx 10003381 |. 51 push ecx 10003382 |. 50 push eax 10003383 |. FFD6 call esi 10003385 |. 5F pop edi 10003386 |. 5E pop esi 10003387 |. 5D pop ebp 10003388 |. 5B pop ebx 10003389 |. 59 pop ecx 1000338A |. C3 retn 1000338B |> 83F8 01 cmp eax, 1 1000338E |. 0F85 92000000 jnz 10003426 10003394 |. 8B5C24 28 mov ebx, dword ptr [esp+28] 10003398 |. 897C24 2C mov dword ptr [esp+2C], edi 1000339C |. 3BDF cmp ebx, edi 1000339E |. 75 06 jnz short 100033A6 100033A0 |. 8B1D 08870010 mov ebx, dword ptr [10008708] 100033A6 |> 8B4424 30 mov eax, dword ptr [esp+30] 100033AA |. 8B6C24 20 mov ebp, dword ptr [esp+20] 100033AE |. 8B5424 1C mov edx, dword ptr [esp+1C] 100033B2 |. 57 push edi ; /WideBufSize 100033B3 |. F7D8 neg eax ; | 100033B5 |. 1BC0 sbb eax, eax ; | 100033B7 |. 57 push edi ; |WideCharBuf 100033B8 |. 83E0 08 and eax, 8 ; | 100033BB |. 55 push ebp ; |StringSize 100033BC |. 40 inc eax ; | 100033BD |. 52 push edx ; |StringToMap 100033BE |. 50 push eax ; |Options 100033BF |. 53 push ebx ; |CodePage 100033C0 |. FF15 2C500010 call dword ptr [<&KERNEL32.MultiByteT>; \MultiByteToWideChar 100033C6 |. 8BF0 mov esi, eax 100033C8 |. 85F6 test esi, esi 100033CA |. 74 4B je short 10003417 100033CC |. 56 push esi 100033CD |. 6A 02 push 2 100033CF |. E8 7C0D0000 call 10004150 100033D4 |. 8BF8 mov edi, eax 100033D6 |. 83C4 08 add esp, 8 100033D9 |. 85FF test edi, edi 100033DB |. 74 3A je short 10003417 100033DD |. 8B4C24 1C mov ecx, dword ptr [esp+1C] 100033E1 |. 56 push esi ; /WideBufSize 100033E2 |. 57 push edi ; |WideCharBuf 100033E3 |. 55 push ebp ; |StringSize 100033E4 |. 51 push ecx ; |StringToMap 100033E5 |. 6A 01 push 1 ; |Options = MB_PRECOMPOSED 100033E7 |. 53 push ebx ; |CodePage 100033E8 |. FF15 2C500010 call dword ptr [<&KERNEL32.MultiByteT>; \MultiByteToWideChar 100033EE |. 85C0 test eax, eax 100033F0 |. 74 25 je short 10003417 100033F2 |. 8B5424 24 mov edx, dword ptr [esp+24] 100033F6 |. 52 push edx ; /CharTypes 100033F7 |. 50 push eax ; |SrcCount 100033F8 |. 8B4424 20 mov eax, dword ptr [esp+20] ; | 100033FC |. 57 push edi ; |Source 100033FD |. 50 push eax ; |InfoType 100033FE |. FF15 7C500010 call dword ptr [<&KERNEL32.GetStringT>; \GetStringTypeW 10003404 |. 57 push edi 10003405 |. 8BF0 mov esi, eax 10003407 |. E8 54000000 call 10003460 1000340C |. 83C4 04 add esp, 4 1000340F |. 8BC6 mov eax, esi 10003411 |. 5F pop edi 10003412 |. 5E pop esi 10003413 |. 5D pop ebp 10003414 |. 5B pop ebx 10003415 |. 59 pop ecx 10003416 |. C3 retn 10003417 |> 8B7424 2C mov esi, dword ptr [esp+2C] 1000341B |. 57 push edi 1000341C |. E8 3F000000 call 10003460 10003421 |. 83C4 04 add esp, 4 10003424 |. 8BC6 mov eax, esi 10003426 |> 5F pop edi 10003427 |. 5E pop esi 10003428 |. 5D pop ebp 10003429 |. 5B pop ebx 1000342A |. 59 pop ecx 1000342B |. C3 retn 1000342C |> 8D4C24 12 lea ecx, dword ptr [esp+12] 10003430 |. 51 push ecx 10003431 |. 6A 01 push 1 10003433 |. 68 AC500010 push 100050AC 10003438 |. 6A 01 push 1 1000343A |. 57 push edi 1000343B |. FFD6 call esi 1000343D |. 85C0 test eax, eax 1000343F |. 74 0F je short 10003450 10003441 |. B8 02000000 mov eax, 2 10003446 |. A3 74880010 mov dword ptr [10008874], eax 1000344B |.^ E9 0CFFFFFF jmp 1000335C 10003450 |> 5F pop edi 10003451 |. 5E pop esi 10003452 |. 5D pop ebp 10003453 |. 33C0 xor eax, eax 10003455 |. 5B pop ebx 10003456 |. 59 pop ecx 10003457 \. C3 retn 10003458 90 nop 10003459 90 nop 1000345A 90 nop 1000345B 90 nop 1000345C 90 nop 1000345D 90 nop 1000345E 90 nop 1000345F 90 nop 10003460 /$ 51 push ecx 10003461 |. 56 push esi 10003462 |. 8B7424 0C mov esi, dword ptr [esp+C] 10003466 |. 85F6 test esi, esi 10003468 |. 74 3D je short 100034A7 1000346A |. 8D4424 0C lea eax, dword ptr [esp+C] 1000346E |. 8D4C24 04 lea ecx, dword ptr [esp+4] 10003472 |. 50 push eax 10003473 |. 51 push ecx 10003474 |. 56 push esi 10003475 |. E8 86040000 call 10003900 1000347A |. 83C4 0C add esp, 0C 1000347D |. 85C0 test eax, eax 1000347F |. 74 16 je short 10003497 10003481 |. 8B5424 0C mov edx, dword ptr [esp+C] 10003485 |. 50 push eax 10003486 |. 8B4424 08 mov eax, dword ptr [esp+8] 1000348A |. 52 push edx 1000348B |. 50 push eax 1000348C |. E8 CF040000 call 10003960 10003491 |. 83C4 0C add esp, 0C 10003494 |. 5E pop esi 10003495 |. 59 pop ecx 10003496 |. C3 retn 10003497 |> 8B0D 90880010 mov ecx, dword ptr [10008890] 1000349D |. 56 push esi ; /pMemory 1000349E |. 6A 00 push 0 ; |Flags = 0 100034A0 |. 51 push ecx ; |hHeap => NULL 100034A1 |. FF15 80500010 call dword ptr [<&KERNEL32.HeapFree>] ; \HeapFree 100034A7 |> 5E pop esi 100034A8 |. 59 pop ecx 100034A9 \. C3 retn 100034AA 90 nop 100034AB 90 nop 100034AC 90 nop 100034AD 90 nop 100034AE 90 nop 100034AF 90 nop 100034B0 /$ 8B4C24 0C mov ecx, dword ptr [esp+C] 100034B4 |. 57 push edi 100034B5 |. 85C9 test ecx, ecx 100034B7 |. 74 7A je short 10003533 100034B9 |. 56 push esi 100034BA |. 53 push ebx 100034BB |. 8BD9 mov ebx, ecx 100034BD |. 8B7424 14 mov esi, dword ptr [esp+14] 100034C1 |. F7C6 03000000 test esi, 3 100034C7 |. 8B7C24 10 mov edi, dword ptr [esp+10] 100034CB |. 75 07 jnz short 100034D4 100034CD |. C1E9 02 shr ecx, 2 100034D0 |. 75 6F jnz short 10003541 100034D2 |. EB 21 jmp short 100034F5 100034D4 |> 8A06 /mov al, byte ptr [esi] 100034D6 |. 46 |inc esi 100034D7 |. 8807 |mov byte ptr [edi], al 100034D9 |. 47 |inc edi 100034DA |. 49 |dec ecx 100034DB |. 74 25 |je short 10003502 100034DD |. 84C0 |test al, al 100034DF |. 74 29 |je short 1000350A 100034E1 |. F7C6 03000000 |test esi, 3 100034E7 |.^ 75 EB \jnz short 100034D4 100034E9 |. 8BD9 mov ebx, ecx 100034EB |. C1E9 02 shr ecx, 2 100034EE |. 75 51 jnz short 10003541 100034F0 |> 83E3 03 and ebx, 3 100034F3 |. 74 0D je short 10003502 100034F5 |> 8A06 /mov al, byte ptr [esi] 100034F7 |. 46 |inc esi 100034F8 |. 8807 |mov byte ptr [edi], al 100034FA |. 47 |inc edi 100034FB |. 84C0 |test al, al 100034FD |. 74 2F |je short 1000352E 100034FF |. 4B |dec ebx 10003500 |.^ 75 F3 \jnz short 100034F5 10003502 |> 8B4424 10 mov eax, dword ptr [esp+10] 10003506 |. 5B pop ebx 10003507 |. 5E pop esi 10003508 |. 5F pop edi 10003509 |. C3 retn 1000350A |> F7C7 03000000 test edi, 3 10003510 |. 74 12 je short 10003524 10003512 |> 8807 /mov byte ptr [edi], al 10003514 |. 47 |inc edi 10003515 |. 49 |dec ecx 10003516 |. 0F84 8A000000 |je 100035A6 1000351C |. F7C7 03000000 |test edi, 3 10003522 |.^ 75 EE \jnz short 10003512 10003524 |> 8BD9 mov ebx, ecx 10003526 |. C1E9 02 shr ecx, 2 10003529 |. 75 6C jnz short 10003597 1000352B |> 8807 mov byte ptr [edi], al 1000352D |. 47 inc edi 1000352E |> 4B dec ebx 1000352F |.^ 75 FA jnz short 1000352B 10003531 |. 5B pop ebx 10003532 |. 5E pop esi 10003533 |> 8B4424 08 mov eax, dword ptr [esp+8] 10003537 |. 5F pop edi 10003538 |. C3 retn 10003539 |> 8917 /mov dword ptr [edi], edx 1000353B |. 83C7 04 |add edi, 4 1000353E |. 49 |dec ecx 1000353F |.^ 74 AF |je short 100034F0 10003541 |> BA FFFEFE7E mov edx, 7EFEFEFF 10003546 |. 8B06 |mov eax, dword ptr [esi] 10003548 |. 03D0 |add edx, eax 1000354A |. 83F0 FF |xor eax, FFFFFFFF 1000354D |. 33C2 |xor eax, edx 1000354F |. 8B16 |mov edx, dword ptr [esi] 10003551 |. 83C6 04 |add esi, 4 10003554 |. A9 00010181 |test eax, 81010100 10003559 |.^ 74 DE |je short 10003539 1000355B |. 84D2 |test dl, dl 1000355D |. 74 2C |je short 1000358B 1000355F |. 84F6 |test dh, dh 10003561 |. 74 1E |je short 10003581 10003563 |. F7C2 0000FF00 |test edx, 0FF0000 10003569 |. 74 0C |je short 10003577 1000356B |. F7C2 000000FF |test edx, FF000000 10003571 |.^ 75 C6 \jnz short 10003539 10003573 |. 8917 mov dword ptr [edi], edx 10003575 |. EB 18 jmp short 1000358F 10003577 |> 81E2 FFFF0000 and edx, 0FFFF 1000357D |. 8917 mov dword ptr [edi], edx 1000357F |. EB 0E jmp short 1000358F 10003581 |> 81E2 FF000000 and edx, 0FF 10003587 |. 8917 mov dword ptr [edi], edx 10003589 |. EB 04 jmp short 1000358F 1000358B |> 33D2 xor edx, edx 1000358D |. 8917 mov dword ptr [edi], edx 1000358F |> 83C7 04 add edi, 4 10003592 |. 33C0 xor eax, eax 10003594 |. 49 dec ecx 10003595 |. 74 0A je short 100035A1 10003597 |> 33C0 xor eax, eax 10003599 |> 8907 /mov dword ptr [edi], eax 1000359B |. 83C7 04 |add edi, 4 1000359E |. 49 |dec ecx 1000359F |.^ 75 F8 \jnz short 10003599 100035A1 |> 83E3 03 and ebx, 3 100035A4 |.^ 75 85 jnz short 1000352B 100035A6 |> 8B4424 10 mov eax, dword ptr [esp+10] 100035AA |. 5B pop ebx 100035AB |. 5E pop esi 100035AC |. 5F pop edi 100035AD \. C3 retn 100035AE CC int3 100035AF CC int3 100035B0 /$ A1 88880010 mov eax, dword ptr [10008888] 100035B5 |. 8B4C24 04 mov ecx, dword ptr [esp+4] 100035B9 |. 50 push eax 100035BA |. 51 push ecx 100035BB |. E8 10000000 call 100035D0 100035C0 |. 83C4 08 add esp, 8 100035C3 \. C3 retn 100035C4 90 nop 100035C5 90 nop 100035C6 90 nop 100035C7 90 nop 100035C8 90 nop 100035C9 90 nop 100035CA 90 nop 100035CB 90 nop 100035CC 90 nop 100035CD 90 nop 100035CE 90 nop 100035CF 90 nop 100035D0 /$ 56 push esi 100035D1 |. 8B7424 08 mov esi, dword ptr [esp+8] 100035D5 |. 83FE E0 cmp esi, -20 100035D8 |. 57 push edi 100035D9 |. 77 34 ja short 1000360F 100035DB |. 85F6 test esi, esi 100035DD |. 75 05 jnz short 100035E4 100035DF |. BE 01000000 mov esi, 1 100035E4 |> 8B7C24 10 mov edi, dword ptr [esp+10] 100035E8 |> 83FE E0 /cmp esi, -20 100035EB |. 77 0B |ja short 100035F8 100035ED |. 56 |push esi 100035EE |. E8 2D000000 |call 10003620 100035F3 |. 83C4 04 |add esp, 4 100035F6 |. EB 02 |jmp short 100035FA 100035F8 |> 33C0 |xor eax, eax 100035FA |> 85C0 |test eax, eax 100035FC |. 75 13 |jnz short 10003611 100035FE |. 85FF |test edi, edi 10003600 |. 74 0F |je short 10003611 10003602 |. 56 |push esi 10003603 |. E8 E80B0000 |call 100041F0 10003608 |. 83C4 04 |add esp, 4 1000360B |. 85C0 |test eax, eax 1000360D |.^ 75 D9 \jnz short 100035E8 1000360F |> 33C0 xor eax, eax 10003611 |> 5F pop edi 10003612 |. 5E pop esi 10003613 \. C3 retn 10003614 90 nop 10003615 90 nop 10003616 90 nop 10003617 90 nop 10003618 90 nop 10003619 90 nop 1000361A 90 nop 1000361B 90 nop 1000361C 90 nop 1000361D 90 nop 1000361E 90 nop 1000361F 90 nop 10003620 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10003624 |. 56 push esi 10003625 |. 8D70 0F lea esi, dword ptr [eax+F] 10003628 |. A1 A4840010 mov eax, dword ptr [100084A4] 1000362D |. 83E6 F0 and esi, FFFFFFF0 10003630 |. 3BF0 cmp esi, eax 10003632 |. 77 12 ja short 10003646 10003634 |. 8BCE mov ecx, esi 10003636 |. C1E9 04 shr ecx, 4 10003639 |. 51 push ecx 1000363A |. E8 81030000 call 100039C0 1000363F |. 83C4 04 add esp, 4 10003642 |. 85C0 test eax, eax 10003644 |. 75 10 jnz short 10003656 10003646 |> 8B15 90880010 mov edx, dword ptr [10008890] 1000364C |. 56 push esi ; /dwBytes 1000364D |. 6A 00 push 0 ; |dwFlags = 0 1000364F |. 52 push edx ; |hHeap => NULL 10003650 |. FF15 84500010 call dword ptr [<&KERNEL32.HeapAlloc>>; \RtlAllocateHeap 10003656 |> 5E pop esi 10003657 \. C3 retn 10003658 90 nop 10003659 90 nop 1000365A 90 nop 1000365B 90 nop 1000365C 90 nop 1000365D 90 nop 1000365E 90 nop 1000365F 90 nop 10003660 /$ A1 90640010 mov eax, dword ptr [10006490] 10003665 |. 55 push ebp 10003666 |. 56 push esi 10003667 |. 83F8 FF cmp eax, -1 1000366A |. 57 push edi 1000366B |. 75 07 jnz short 10003674 1000366D |. BD 80640010 mov ebp, 10006480 10003672 |. EB 1D jmp short 10003691 10003674 |> A1 90880010 mov eax, dword ptr [10008890] 10003679 |. 68 20200000 push 2020 ; /dwBytes = 2020 (8224.) 1000367E |. 6A 00 push 0 ; |dwFlags = 0 10003680 |. 50 push eax ; |hHeap => NULL 10003681 |. FF15 84500010 call dword ptr [<&KERNEL32.HeapAlloc>>; \RtlAllocateHeap 10003687 |. 8BE8 mov ebp, eax 10003689 |. 85ED test ebp, ebp 1000368B |. 0F84 2B010000 je 100037BC 10003691 |> 8B3D 88500010 mov edi, dword ptr [<&KERNEL32.Virtu>; kernel32.VirtualAlloc 10003697 |. 6A 04 push 4 ; /Protect = PAGE_READWRITE 10003699 |. 68 00200000 push 2000 ; |AllocationType = MEM_RESERVE 1000369E |. 68 00004000 push 400000 ; |Size = 400000 (4194304.) 100036A3 |. 6A 00 push 0 ; |Address = NULL 100036A5 |. FFD7 call edi ; \VirtualAlloc 100036A7 |. 8BF0 mov esi, eax 100036A9 |. 85F6 test esi, esi 100036AB |. 0F84 F4000000 je 100037A5 100036B1 |. 6A 04 push 4 ; /Protect = PAGE_READWRITE 100036B3 |. 68 00100000 push 1000 ; |AllocationType = MEM_COMMIT 100036B8 |. 68 00000100 push 10000 ; |Size = 10000 (65536.) 100036BD |. 56 push esi ; |Address 100036BE |. FFD7 call edi ; \VirtualAlloc 100036C0 |. 85C0 test eax, eax 100036C2 |. 0F84 CF000000 je 10003797 100036C8 |. 81FD 80640010 cmp ebp, 10006480 100036CE |. 75 28 jnz short 100036F8 100036D0 |. A1 80640010 mov eax, dword ptr [10006480] 100036D5 |. 85C0 test eax, eax 100036D7 |. 75 0A jnz short 100036E3 100036D9 |. C705 80640010>mov dword ptr [10006480], 10006480 100036E3 |> A1 84640010 mov eax, dword ptr [10006484] 100036E8 |. 85C0 test eax, eax 100036EA |. 75 27 jnz short 10003713 100036EC |. C705 84640010>mov dword ptr [10006484], 10006480 100036F6 |. EB 1B jmp short 10003713 100036F8 |> C745 00 80640>mov dword ptr [ebp], 10006480 100036FF |. 8B0D 84640010 mov ecx, dword ptr [10006484] ; pjgl.10006480 10003705 |. 894D 04 mov dword ptr [ebp+4], ecx 10003708 |. 892D 84640010 mov dword ptr [10006484], ebp 1000370E |. 8B55 04 mov edx, dword ptr [ebp+4] 10003711 |. 892A mov dword ptr [edx], ebp 10003713 |> 8D86 00004000 lea eax, dword ptr [esi+400000] 10003719 |. 8D4D 18 lea ecx, dword ptr [ebp+18] 1000371C |. 8D95 98000000 lea edx, dword ptr [ebp+98] 10003722 |. 8945 14 mov dword ptr [ebp+14], eax 10003725 |. 8975 10 mov dword ptr [ebp+10], esi 10003728 |. 894D 08 mov dword ptr [ebp+8], ecx 1000372B |. 8955 0C mov dword ptr [ebp+C], edx 1000372E |. 33C0 xor eax, eax 10003730 |. BF F1000000 mov edi, 0F1 10003735 |> 33D2 /xor edx, edx 10003737 |. 83F8 10 |cmp eax, 10 1000373A |. 0F9DC2 |setge dl 1000373D |. 4A |dec edx 1000373E |. 83C1 08 |add ecx, 8 10003741 |. 23D7 |and edx, edi 10003743 |. 4A |dec edx 10003744 |. 40 |inc eax 10003745 |. 8951 F8 |mov dword ptr [ecx-8], edx 10003748 |. 8979 FC |mov dword ptr [ecx-4], edi 1000374B |. 3D 00040000 |cmp eax, 400 10003750 |.^ 7C E3 \jl short 10003735 10003752 |. B9 00400000 mov ecx, 4000 10003757 |. 33C0 xor eax, eax 10003759 |. 8BFE mov edi, esi 1000375B |. F3:AB rep stos dword ptr es:[edi] 1000375D |. 8B45 10 mov eax, dword ptr [ebp+10] 10003760 |. 05 00000100 add eax, 10000 ; UNICODE "=::=::\" 10003765 |. 3BF0 cmp esi, eax 10003767 |. 73 28 jnb short 10003791 10003769 |. B9 F0000000 mov ecx, 0F0 1000376E |. B0 FF mov al, 0FF 10003770 |> 8D56 08 /lea edx, dword ptr [esi+8] 10003773 |. 894E 04 |mov dword ptr [esi+4], ecx 10003776 |. 8916 |mov dword ptr [esi], edx 10003778 |. 8886 F8000000 |mov byte ptr [esi+F8], al 1000377E |. 8B55 10 |mov edx, dword ptr [ebp+10] 10003781 |. 81C6 00100000 |add esi, 1000 10003787 |. 81C2 00000100 |add edx, 10000 ; UNICODE "=::=::\" 1000378D |. 3BF2 |cmp esi, edx 1000378F |.^ 72 DF \jb short 10003770 10003791 |> 8BC5 mov eax, ebp 10003793 |. 5F pop edi 10003794 |. 5E pop esi 10003795 |. 5D pop ebp 10003796 |. C3 retn 10003797 |> 68 00800000 push 8000 ; /FreeType = MEM_RELEASE 1000379C |. 6A 00 push 0 ; |Size = 0 1000379E |. 56 push esi ; |Address 1000379F |. FF15 50500010 call dword ptr [<&KERNEL32.VirtualFre>; \VirtualFree 100037A5 |> 81FD 80640010 cmp ebp, 10006480 100037AB |. 74 0F je short 100037BC 100037AD |. A1 90880010 mov eax, dword ptr [10008890] 100037B2 |. 55 push ebp ; /pMemory 100037B3 |. 6A 00 push 0 ; |Flags = 0 100037B5 |. 50 push eax ; |hHeap => NULL 100037B6 |. FF15 80500010 call dword ptr [<&KERNEL32.HeapFree>] ; \HeapFree 100037BC |> 5F pop edi 100037BD |. 5E pop esi 100037BE |. 33C0 xor eax, eax 100037C0 |. 5D pop ebp 100037C1 \. C3 retn 100037C2 90 nop 100037C3 90 nop 100037C4 90 nop 100037C5 90 nop 100037C6 90 nop 100037C7 90 nop 100037C8 90 nop 100037C9 90 nop 100037CA 90 nop 100037CB 90 nop 100037CC 90 nop 100037CD 90 nop 100037CE 90 nop 100037CF 90 nop 100037D0 /$ 56 push esi 100037D1 |. 8B7424 08 mov esi, dword ptr [esp+8] 100037D5 |. 68 00800000 push 8000 ; /FreeType = MEM_RELEASE 100037DA |. 6A 00 push 0 ; |Size = 0 100037DC |. 8B46 10 mov eax, dword ptr [esi+10] ; | 100037DF |. 50 push eax ; |Address 100037E0 |. FF15 50500010 call dword ptr [<&KERNEL32.VirtualFre>; \VirtualFree 100037E6 |. 3935 A0840010 cmp dword ptr [100084A0], esi 100037EC |. 75 09 jnz short 100037F7 100037EE |. 8B4E 04 mov ecx, dword ptr [esi+4] 100037F1 |. 890D A0840010 mov dword ptr [100084A0], ecx 100037F7 |> 81FE 80640010 cmp esi, 10006480 100037FD |. 74 20 je short 1000381F 100037FF |. 8B56 04 mov edx, dword ptr [esi+4] 10003802 |. 8B06 mov eax, dword ptr [esi] 10003804 |. 56 push esi ; /pMemory 10003805 |. 6A 00 push 0 ; |Flags = 0 10003807 |. 8902 mov dword ptr [edx], eax ; | 10003809 |. 8B0E mov ecx, dword ptr [esi] ; | 1000380B |. 8B56 04 mov edx, dword ptr [esi+4] ; | 1000380E |. 8951 04 mov dword ptr [ecx+4], edx ; | 10003811 |. A1 90880010 mov eax, dword ptr [10008890] ; | 10003816 |. 50 push eax ; |hHeap => NULL 10003817 |. FF15 80500010 call dword ptr [<&KERNEL32.HeapFree>] ; \HeapFree 1000381D |. 5E pop esi 1000381E |. C3 retn 1000381F |> C705 90640010>mov dword ptr [10006490], -1 10003829 |. 5E pop esi 1000382A \. C3 retn 1000382B 90 nop 1000382C 90 nop 1000382D 90 nop 1000382E 90 nop 1000382F 90 nop 10003830 /$ 53 push ebx 10003831 |. 55 push ebp 10003832 |. 56 push esi 10003833 |. 57 push edi 10003834 |. 8B3D 84640010 mov edi, dword ptr [10006484] ; pjgl.10006480 1000383A |> 837F 10 FF /cmp dword ptr [edi+10], -1 1000383E |. 0F84 A0000000 |je 100038E4 10003844 |. 33ED |xor ebp, ebp 10003846 |. 8DB7 10200000 |lea esi, dword ptr [edi+2010] 1000384C |. BB 00F03F00 |mov ebx, 3FF000 10003851 |> 813E F0000000 |/cmp dword ptr [esi], 0F0 10003857 |. 75 47 ||jnz short 100038A0 10003859 |. 8B47 10 ||mov eax, dword ptr [edi+10] 1000385C |. 68 00400000 ||push 4000 ; /FreeType = MEM_DECOMMIT 10003861 |. 03C3 ||add eax, ebx ; | 10003863 |. 68 00100000 ||push 1000 ; |Size = 1000 (4096.) 10003868 |. 50 ||push eax ; |Address 10003869 |. FF15 50500010 ||call dword ptr [<&KERNEL32.VirtualF>; \VirtualFree 1000386F |. 85C0 ||test eax, eax 10003871 |. 74 2D ||je short 100038A0 10003873 |. C706 FFFFFFFF ||mov dword ptr [esi], -1 10003879 |. 8B15 78880010 ||mov edx, dword ptr [10008878] 1000387F |. 4A ||dec edx 10003880 |. 8915 78880010 ||mov dword ptr [10008878], edx 10003886 |. 8B47 0C ||mov eax, dword ptr [edi+C] 10003889 |. 85C0 ||test eax, eax 1000388B |. 74 04 ||je short 10003891 1000388D |. 3BC6 ||cmp eax, esi 1000388F |. 76 03 ||jbe short 10003894 10003891 |> 8977 0C ||mov dword ptr [edi+C], esi 10003894 |> 8B4424 14 ||mov eax, dword ptr [esp+14] 10003898 |. 45 ||inc ebp 10003899 |. 48 ||dec eax 1000389A |. 894424 14 ||mov dword ptr [esp+14], eax 1000389E |. 74 0D ||je short 100038AD 100038A0 |> 81EB 00100000 ||sub ebx, 1000 100038A6 |. 83EE 08 ||sub esi, 8 100038A9 |. 85DB ||test ebx, ebx 100038AB |.^ 7D A4 |\jge short 10003851 100038AD |> 8BD7 |mov edx, edi 100038AF |. 8B7F 04 |mov edi, dword ptr [edi+4] 100038B2 |. 85ED |test ebp, ebp 100038B4 |. 74 2E |je short 100038E4 100038B6 |. 837A 18 FF |cmp dword ptr [edx+18], -1 100038BA |. 75 28 |jnz short 100038E4 100038BC |. B8 01000000 |mov eax, 1 100038C1 |. 8D4A 20 |lea ecx, dword ptr [edx+20] 100038C4 |> 8339 FF |/cmp dword ptr [ecx], -1 100038C7 |. 75 0B ||jnz short 100038D4 100038C9 |. 40 ||inc eax 100038CA |. 83C1 08 ||add ecx, 8 100038CD |. 3D 00040000 ||cmp eax, 400 100038D2 |.^ 7C F0 |\jl short 100038C4 100038D4 |> 3D 00040000 |cmp eax, 400 100038D9 |. 75 09 |jnz short 100038E4 100038DB |. 52 |push edx 100038DC |. E8 EFFEFFFF |call 100037D0 100038E1 |. 83C4 04 |add esp, 4 100038E4 |> 3B3D 84640010 |cmp edi, dword ptr [10006484] ; pjgl.10006480 100038EA |. 74 0C |je short 100038F8 100038EC |. 8B4424 14 |mov eax, dword ptr [esp+14] 100038F0 |. 85C0 |test eax, eax 100038F2 |.^ 0F8F 42FFFFFF \jg 1000383A 100038F8 |> 5F pop edi 100038F9 |. 5E pop esi 100038FA |. 5D pop ebp 100038FB |. 5B pop ebx 100038FC \. C3 retn 100038FD 90 nop 100038FE 90 nop 100038FF 90 nop 10003900 /$ 8B4C24 04 mov ecx, dword ptr [esp+4] 10003904 |. B8 80640010 mov eax, 10006480 10003909 |> 3B48 10 /cmp ecx, dword ptr [eax+10] 1000390C |. 76 05 |jbe short 10003913 1000390E |. 3B48 14 |cmp ecx, dword ptr [eax+14] 10003911 |. 72 0B |jb short 1000391E 10003913 |> 8B00 |mov eax, dword ptr [eax] 10003915 |. 3D 80640010 |cmp eax, 10006480 1000391A |. 74 3A |je short 10003956 1000391C |.^ EB EB \jmp short 10003909 1000391E |> F6C1 0F test cl, 0F 10003921 |. 75 33 jnz short 10003956 10003923 |. 8BD1 mov edx, ecx 10003925 |. 81E2 FF0F0000 and edx, 0FFF 1000392B |. 81FA 00010000 cmp edx, 100 10003931 |. 72 23 jb short 10003956 10003933 |. 8B5424 08 mov edx, dword ptr [esp+8] 10003937 |. 8902 mov dword ptr [edx], eax 10003939 |. 8B5424 0C mov edx, dword ptr [esp+C] 1000393D |. 8BC1 mov eax, ecx 1000393F |. 25 00F0FFFF and eax, FFFFF000 10003944 |. 2BC8 sub ecx, eax 10003946 |. 8902 mov dword ptr [edx], eax 10003948 |. 81E9 00010000 sub ecx, 100 1000394E |. C1F9 04 sar ecx, 4 10003951 |. 8D4401 08 lea eax, dword ptr [ecx+eax+8] 10003955 |. C3 retn 10003956 |> 33C0 xor eax, eax 10003958 \. C3 retn 10003959 90 nop 1000395A 90 nop 1000395B 90 nop 1000395C 90 nop 1000395D 90 nop 1000395E 90 nop 1000395F 90 nop 10003960 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10003964 |. 8B4C24 08 mov ecx, dword ptr [esp+8] 10003968 |. 56 push esi 10003969 |. 33D2 xor edx, edx 1000396B |. 2B48 10 sub ecx, dword ptr [eax+10] 1000396E |. C1F9 0C sar ecx, 0C 10003971 |. 8B74C8 18 mov esi, dword ptr [eax+ecx*8+18] 10003975 |. 8D44C8 18 lea eax, dword ptr [eax+ecx*8+18] 10003979 |. 8B4C24 10 mov ecx, dword ptr [esp+10] 1000397D |. 8A11 mov dl, byte ptr [ecx] 1000397F |. 03F2 add esi, edx 10003981 |. 8930 mov dword ptr [eax], esi 10003983 |. C601 00 mov byte ptr [ecx], 0 10003986 |. 8B08 mov ecx, dword ptr [eax] 10003988 |. C740 04 F1000>mov dword ptr [eax+4], 0F1 1000398F |. 81F9 F0000000 cmp ecx, 0F0 10003995 |. 75 1A jnz short 100039B1 10003997 |. A1 78880010 mov eax, dword ptr [10008878] 1000399C |. 40 inc eax 1000399D |. 83F8 20 cmp eax, 20 100039A0 |. A3 78880010 mov dword ptr [10008878], eax 100039A5 |. 75 0A jnz short 100039B1 100039A7 |. 6A 10 push 10 100039A9 |. E8 82FEFFFF call 10003830 100039AE |. 83C4 04 add esp, 4 100039B1 |> 5E pop esi 100039B2 \. C3 retn 100039B3 90 nop 100039B4 90 nop 100039B5 90 nop 100039B6 90 nop 100039B7 90 nop 100039B8 90 nop 100039B9 90 nop 100039BA 90 nop 100039BB 90 nop |
操作理由
RANk
{{ user_info.golds == '' ? 0 : user_info.golds }}
雪币
{{ experience }}
课程经验
{{ score }}
学习收益
{{study_duration_fmt}}
学习时长
基本信息
荣誉称号:
{{ honorary_title }}
能力排名:
No.{{ rank_num }}
等 级:
LV{{ rank_lv-100 }}
活跃值:
在线值:
浏览人数:{{ visits }}
最近活跃:{{ last_active_time }}
注册时间:{{ user_info.create_date_jsonfmt }}
勋章
兑换勋章
证书
证书查询 >
能力值