[求助]不知道自己是否到达OPE！-付费问答-看雪-安全社区|安全招聘|kanxue.com

最新回复 (6)
yydis 雪币： 23 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 15 粉丝 0 关注私信	yydis 2 楼这里有一些拿去看看吧上传的附件： Borland C++.txt （7.87kb，12次下载） Borland C++ 1999.txt （3.61kb，8次下载） Borland Delphi 2.0.txt （2.38kb，10次下载） Borland Delphi 3.0.txt （6.36kb，8次下载） Borland Delphi 4.0 - 5.0.txt （2.03kb，8次下载） Borland Delphi 6.0 - 7.0.txt （4.49kb，9次下载） MASM32 - TASM32.txt （3.16kb，13次下载） Microsoft Visual Basic 5.0 - 6.0.txt （1.05kb，8次下载） Microsoft Visual C++ 4.x.txt （8.59kb，8次下载） Microsoft Visual C++ 5.0.txt （8.50kb，9次下载） Microsoft Visual C++ 6.0.txt （6.47kb，8次下载） Microsoft Visual C++ 6.0 [Debug].txt （6.79kb，9次下载） Microsoft Visual C++ 7.0.txt （11.18kb，8次下载） Microsoft Visual C++ 7.0 [Debug].txt （11.06kb，8次下载） Microsoft Visual C++ 7.0 Method2 [Debug].txt （10.34kb，18次下载） 2010-4-23 17:15 0
留香雪币： 1 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 7 回帖 14 粉丝 0 关注私信	留香 3 楼下载要钱哦！！ 2010-4-23 17:18 0
留香雪币： 1 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 7 回帖 14 粉丝 0 关注私信	留香 4 楼能发到我邮箱吗397338853@qq.com？我没有KX币，帮帮忙！！ 2010-4-23 17:21 0
yydis 雪币： 23 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 15 粉丝 0 关注私信	yydis 5 楼 Borland C++ CODE DATA .INIT .idata .edata .reloc .rsrc 00401000 BCW.> $ A1 59B05000 mov eax,dword ptr ds:[50B059] 00401005 . C1E0 02 shl eax,2 00401008 . A3 5DB05000 mov dword ptr ds:[50B05D],eax 0040100D . 57 push edi ; ntdll.7C930738 0040100E . 51 push ecx 0040100F . 33C0 xor eax,eax 00401011 . BF 84665400 mov edi,BCW.00546684 00401016 . B9 8C345500 mov ecx,BCW.0055348C 0040101B . 3BCF cmp ecx,edi ; ntdll.7C930738 0040101D . 76 05 jbe short BCW.00401024 0040101F . 2BCF sub ecx,edi ; ntdll.7C930738 00401021 . FC cld 00401022 . F3:AA rep stos byte ptr es:[edi] 00401024 > 59 pop ecx ; kernel32.7C816FD7 00401025 . 5F pop edi ; kernel32.7C816FD7 00401026 . 64:67:8B16 0400 mov edx,dword ptr fs:[4] 0040102C . 8B42 F8 mov eax,dword ptr ds:[edx-8] 0040102F . A3 61B05000 mov dword ptr ds:[50B061],eax 00401034 . 8B42 FC mov eax,dword ptr ds:[edx-4] 00401037 . A3 65B05000 mov dword ptr ds:[50B065],eax 0040103C . 83EA 04 sub edx,4 0040103F . 8915 80345500 mov dword ptr ds:[553480],edx ; ntdll.KiFastSystemCallRet 00401045 . 83EA 04 sub edx,4 00401048 . 3BD4 cmp edx,esp 0040104A . 73 02 jnb short BCW.0040104E 0040104C . 8BE2 mov esp,edx ; ntdll.KiFastSystemCallRet 0040104E > 6A 00 push 0 ; /Arg1 = 00000000 00401050 . E8 45100000 call BCW.0040209A ; \BCW.0040209A 00401055 . 59 pop ecx ; kernel32.7C816FD7 00401056 . 68 2CB05000 push BCW.0050B02C 0040105B . 6A 00 push 0 ; /pModule = NULL 0040105D . E8 73821000 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA 00401062 . A3 6AB05000 mov dword ptr ds:[50B06A],eax 00401067 . 6A 00 push 0 00401069 . E9 93801000 jmp <jmp.&cw3220mt.__startup> 0040106E BCW.> $ E9 09110000 jmp BCW.0040217C 00401073 00 db 00 00401074 00 db 00 00401075 00 db 00 00401076 00 db 00 00401077 00 db 00 00401078 /$ 55 push ebp 00401079 \|. 8BEC mov ebp,esp 0040107B \|. 53 push ebx 0040107C \|. 56 push esi 0040107D \|. 57 push edi ; ntdll.7C930738 0040107E \|. 8B75 0C mov esi,dword ptr ss:[ebp+C] 00401081 \|. 6A 00 push 0 ; /pDefaultCharUsed = NULL 00401083 \|. 6A 00 push 0 ; \|pDefaultChar = NULL 00401085 \|. 6A 00 push 0 ; \|MultiByteCount = 0 00401087 \|. 6A 00 push 0 ; \|MultiByteStr = NULL 00401089 \|. 56 push esi ; \|WideCharCount = FFFFFFFF (-1.) 0040108A \|. FF75 08 push dword ptr ss:[ebp+8] ; \|WideCharStr = "妡",82,"??嶣",82,"?,87,"??暄T貹",86,"",85,"?盏????,A1,"",96,"v?",04,"???P???P?褄",B8,"?,86,"",85,"?,85,"???j?",10,"",89,"?",82,"?,98,"旦Ｑ?,10,"",99,"{",82,"?,98,"?肓",10,"?",11,"" 0040108D \|. 6A 00 push 0 ; \|Options = 0 0040108F \|. 6A 00 push 0 ; \|CodePage = CP_ACP 00401091 \|. E8 99821000 call <jmp.&KERNEL32.WideCharToMultiByte> ; \WideCharToMultiByte 00401096 \|. 8BD8 mov ebx,eax 00401098 \|. 83FE FF cmp esi,-1 0040109B \|. 0F95C0 setne al 0040109E \|. 83E0 01 and eax,1 004010A1 \|. 03C3 add eax,ebx 004010A3 \|. 50 push eax 004010A4 \|. E8 A47F1000 call <jmp.&cw3220mt.@$bnwa$qui> 004010A9 \|. 59 pop ecx ; kernel32.7C816FD7 004010AA \|. 8BF8 mov edi,eax 004010AC \|. 6A 00 push 0 ; /pDefaultCharUsed = NULL 004010AE \|. 6A 00 push 0 ; \|pDefaultChar = NULL 004010B0 \|. 53 push ebx ; \|MultiByteCount = 7FFDF000 (2147348480.) 004010B1 \|. 57 push edi ; \|MultiByteStr = ntdll.7C930738 004010B2 \|. 56 push esi ; \|WideCharCount = FFFFFFFF (-1.) 004010B3 \|. FF75 08 push dword ptr ss:[ebp+8] ; \|WideCharStr = "妡",82,"??嶣",82,"?,87,"??暄T貹",86,"",85,"?盏????,A1,"",96,"v?",04,"???P???P?褄",B8,"?,86,"",85,"?,85,"???j?",10,"",89,"?",82,"?,98,"旦Ｑ?,10,"",99,"{",82,"?,98,"?肓",10,"?",11,"" 004010B6 \|. 6A 00 push 0 ; \|Options = 0 004010B8 \|. 6A 00 push 0 ; \|CodePage = CP_ACP 004010BA \|. E8 70821000 call <jmp.&KERNEL32.WideCharToMultiByte> ; \WideCharToMultiByte 004010BF \|. 8BD8 mov ebx,eax 004010C1 \|. 83FE FF cmp esi,-1 004010C4 \|. 74 04 je short BCW.004010CA 004010C6 \|. C6041F 00 mov byte ptr ds:[edi+ebx],0 004010CA \|> 8BC7 mov eax,edi ; ntdll.7C930738 004010CC \|. 5F pop edi ; kernel32.7C816FD7 004010CD \|. 5E pop esi ; kernel32.7C816FD7 004010CE \|. 5B pop ebx ; kernel32.7C816FD7 004010CF \|. 5D pop ebp ; kernel32.7C816FD7 004010D0 \. C3 retn A1 59 B0 50 00 C1 E0 02 A3 5D B0 50 00 57 51 33 C0 BF 84 66 54 00 B9 8C 34 55 00 3B CF 76 05 2B CF FC F3 AA 59 5F 64 67 8B 16 04 00 8B 42 F8 A3 61 B0 50 00 8B 42 FC A3 65 B0 50 00 83 EA 04 89 15 80 34 55 00 83 EA 04 3B D4 73 02 8B E2 6A 00 E8 45 10 00 00 59 68 2C B0 50 00 6A 00 E8 73 82 10 00 A3 6A B0 50 00 6A 00 E9 93 80 10 00 E9 09 11 00 00 00 00 00 00 00 55 8B EC 53 56 57 8B 75 0C 6A 00 6A 00 6A 00 6A 00 56 FF 75 08 6A 00 6A 00 E8 99 82 10 00 8B D8 83 FE FF 0F 95 C0 83 E0 01 03 C3 50 E8 A4 7F 10 00 59 8B F8 6A 00 6A 00 53 57 56 FF 75 08 6A 00 6A 00 E8 70 82 10 00 8B D8 83 FE FF 74 04 C6 04 1F 00 8B C7 5F 5E 5B 5D C3 Borland C++ 1999 .text .data .tls .rdata .idata .edata .rsrc .reloc 00401000 Find> $ /EB 10 jmp short Finder33.00401012 00401002 \|66 db 66 ; CHAR 'f' 00401003 \|62 db 62 ; CHAR 'b' 00401004 \|3A db 3A ; CHAR ':' 00401005 \|43 db 43 ; CHAR 'C' 00401006 \|2B db 2B ; CHAR '+' 00401007 \|2B db 2B ; CHAR '+' 00401008 \|48 db 48 ; CHAR 'H' 00401009 \|4F db 4F ; CHAR 'O' 0040100A \|4F db 4F ; CHAR 'O' 0040100B \|4B db 4B ; CHAR 'K' 0040100C \|90 nop 0040100D \|E9 db E9 0040100E . \|AC lods byte ptr ds:[esi] 0040100F . \|2348 00 and ecx,dword ptr ds:[eax] 00401012 > \A1 9F234800 mov eax,dword ptr ds:[48239F] 00401017 . C1E0 02 shl eax,2 0040101A . A3 A3234800 mov dword ptr ds:[4823A3],eax 0040101F . 52 push edx ; ntdll.KiFastSystemCallRet 00401020 . 6A 00 push 0 ; /pModule = NULL 00401022 . E8 79010800 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA 00401027 . 8BD0 mov edx,eax 00401029 . E8 F64F0700 call Finder33.00476024 0040102E . 5A pop edx ; kernel32.7C816FD7 0040102F . E8 544F0700 call Finder33.00475F88 00401034 . E8 2B500700 call Finder33.00476064 00401039 . 6A 00 push 0 ; /Arg1 = 00000000 0040103B . E8 48620700 call Finder33.00477288 ; \Finder33.00477288 00401040 . 59 pop ecx ; kernel32.7C816FD7 00401041 . 68 48234800 push Finder33.00482348 00401046 . 6A 00 push 0 ; /pModule = NULL 00401048 . E8 53010800 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA 0040104D . A3 A7234800 mov dword ptr ds:[4823A7],eax 00401052 . 6A 00 push 0 00401054 . E9 0BB40700 jmp Finder33.0047C464 00401059 Find> $ E9 76620700 jmp Finder33.004772D4 0040105E . 33C0 xor eax,eax 00401060 . A0 91234800 mov al,byte ptr ds:[482391] 00401065 . C3 retn EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 AC 23 48 00 A1 9F 23 48 00 C1 E0 02 A3 A3 23 48 00 52 6A 00 E8 79 01 08 00 8B D0 E8 F6 4F 07 00 5A E8 54 4F 07 00 E8 2B 50 07 00 6A 00 E8 48 62 07 00 59 68 48 23 48 00 6A 00 E8 53 01 08 00 A3 A7 23 48 00 6A 00 E9 0B B4 07 00 E9 76 62 07 00 33 C0 A0 91 23 48 00 C3 Borland Delphi 2.0 CODE DATA BSS .idata .tls .rdata .reloc .rsrc 00433D9C htes> 55 push ebp 00433D9D 8BEC mov ebp,esp 00433D9F 83C4 F4 add esp,-0C 00433DA2 E8 F1F4FCFF call htest.00403298 00433DA7 E8 940AFDFF call htest.00404840 00433DAC E8 CF3AFDFF call htest.00407880 00433DB1 E8 92A4FDFF call htest.0040E248 00433DB6 E8 D1A5FDFF call htest.0040E38C 00433DBB E8 28C5FDFF call htest.004102E8 00433DC0 E8 633CFEFF call htest.00417A28 00433DC5 E8 CE0BFFFF call htest.00424998 00433DCA E8 2956FFFF call htest.004293F8 00433DCF E8 1474FFFF call htest.0042B1E8 00433DD4 E8 C3A2FFFF call htest.0042E09C 00433DD9 E8 4ED3FFFF call htest.0043112C 00433DDE E8 A5E2FFFF call htest.00432088 00433DE3 A1 28664300 mov eax,dword ptr ds:[436628] 00433DE8 E8 1302FFFF call htest.00424000 00433DED BA 2C3E4300 mov edx,htest.00433E2C ; ASCII "MP3-2-EXE Player" 00433DF2 A1 28664300 mov eax,dword ptr ds:[436628] 00433DF7 E8 20FFFEFF call htest.00423D1C 00433DFC B9 A4664300 mov ecx,htest.004366A4 00433E01 BA 04254300 mov edx,htest.00432504 00433E06 A1 28664300 mov eax,dword ptr ds:[436628] 00433E0B E8 0002FFFF call htest.00424010 00433E10 A1 28664300 mov eax,dword ptr ds:[436628] 00433E15 E8 8602FFFF call htest.004240A0 00433E1A E8 2904FDFF call htest.00404248 00433E1F 8BE5 mov esp,ebp 00433E21 5D pop ebp ; kernel32.7C816FD7 00433E22 C3 retn 55 8B EC 83 C4 F4 E8 F1 F4 FC FF E8 94 0A FD FF E8 CF 3A FD FF E8 92 A4 FD FF E8 D1 A5 FD FF E8 28 C5 FD FF E8 63 3C FE FF E8 CE 0B FF FF E8 29 56 FF FF E8 14 74 FF FF E8 C3 A2 FF FF E8 4E D3 FF FF E8 A5 E2 FF FF A1 28 66 43 00 E8 13 02 FF FF BA 2C 3E 43 00 A1 28 66 43 00 E8 20 FF FE FF B9 A4 66 43 00 BA 04 25 43 00 A1 28 66 43 00 E8 00 02 FF FF A1 28 66 43 00 E8 86 02 FF FF E8 29 04 FD FF 8B E5 5D C3 Borland Delphi 3.0 CODE DATA BSS .idata .tls .rdata .reloc .rsrc 004ABA30 ResH> 55 push ebp 004ABA31 8BEC mov ebp,esp 004ABA33 83C4 F0 add esp,-10 004ABA36 33C0 xor eax,eax 004ABA38 8945 F0 mov dword ptr ss:[ebp-10],eax 004ABA3B B8 60B84A00 mov eax,ResHacke.004AB860 004ABA40 E8 B79CF5FF call ResHacke.004056FC 004ABA45 33C0 xor eax,eax 004ABA47 55 push ebp 004ABA48 68 40BB4A00 push ResHacke.004ABB40 004ABA4D 64:FF30 push dword ptr fs:[eax] 004ABA50 64:8920 mov dword ptr fs:[eax],esp 004ABA53 A1 60DC4A00 mov eax,dword ptr ds:[4ADC60] 004ABA58 8B00 mov eax,dword ptr ds:[eax] 004ABA5A E8 856EF8FF call ResHacke.004328E4 004ABA5F A1 60DC4A00 mov eax,dword ptr ds:[4ADC60] 004ABA64 8B00 mov eax,dword ptr ds:[eax] 004ABA66 BA 54BB4A00 mov edx,ResHacke.004ABB54 ; ASCII "Resource Hacker" 004ABA6B E8 8C6BF8FF call ResHacke.004325FC 004ABA70 A1 60DC4A00 mov eax,dword ptr ds:[4ADC60] 004ABA75 8B00 mov eax,dword ptr ds:[eax] 004ABA77 C640 3F 00 mov byte ptr ds:[eax+3F],0 004ABA7B 8B0D D8DA4A00 mov ecx,dword ptr ds:[4ADAD8] ; ResHacke.004AE81C 004ABA81 A1 60DC4A00 mov eax,dword ptr ds:[4ADC60] 004ABA86 8B00 mov eax,dword ptr ds:[eax] 004ABA88 8B15 DCE44900 mov edx,dword ptr ds:[49E4DC] ; ResHacke.0049E51C 004ABA8E E8 696EF8FF call ResHacke.004328FC 004ABA93 E8 786DF5FF call ResHacke.00402810 004ABA98 48 dec eax 004ABA99 7E 78 jle short ResHacke.004ABB13 004ABA9B 8D55 F0 lea edx,dword ptr ss:[ebp-10] 004ABA9E B8 01000000 mov eax,1 004ABAA3 E8 C86DF5FF call ResHacke.00402870 004ABAA8 8B45 F0 mov eax,dword ptr ss:[ebp-10] 004ABAAB 8038 2D cmp byte ptr ds:[eax],2D 004ABAAE 75 63 jnz short ResHacke.004ABB13 004ABAB0 B2 01 mov dl,1 004ABAB2 A1 88AE4800 mov eax,dword ptr ds:[48AE88] 004ABAB7 E8 B872F5FF call ResHacke.00402D74 004ABABC A3 84E84A00 mov dword ptr ds:[4AE884],eax 004ABAC1 33C0 xor eax,eax 004ABAC3 55 push ebp 004ABAC4 68 F9BA4A00 push ResHacke.004ABAF9 004ABAC9 64:FF30 push dword ptr fs:[eax] 004ABACC 64:8920 mov dword ptr fs:[eax],esp 004ABACF 8B15 D8DA4A00 mov edx,dword ptr ds:[4ADAD8] ; ResHacke.004AE81C 004ABAD5 8B12 mov edx,dword ptr ds:[edx] 004ABAD7 A1 84E84A00 mov eax,dword ptr ds:[4AE884] 004ABADC E8 8BF5FDFF call ResHacke.0048B06C 004ABAE1 33C0 xor eax,eax 004ABAE3 5A pop edx ; kernel32.7C816FD7 004ABAE4 59 pop ecx ; kernel32.7C816FD7 004ABAE5 59 pop ecx ; kernel32.7C816FD7 004ABAE6 64:8910 mov dword ptr fs:[eax],edx ; ntdll.KiFastSystemCallRet 004ABAE9 68 00BB4A00 push ResHacke.004ABB00 004ABAEE A1 84E84A00 mov eax,dword ptr ds:[4AE884] 004ABAF3 E8 A472F5FF call ResHacke.00402D9C 004ABAF8 C3 retn 004ABAF9 ^ E9 6A78F5FF jmp ResHacke.00403368 004ABAFE ^ EB EE jmp short ResHacke.004ABAEE 004ABB00 A1 D8DA4A00 mov eax,dword ptr ds:[4ADAD8] 004ABB05 8B00 mov eax,dword ptr ds:[eax] 004ABB07 E8 304DF8FF call ResHacke.0043083C 004ABB0C E8 837CF5FF call ResHacke.00403794 004ABB11 EB 0B jmp short ResHacke.004ABB1E 004ABB13 A1 60DC4A00 mov eax,dword ptr ds:[4ADC60] 004ABB18 8B00 mov eax,dword ptr ds:[eax] 004ABB1A C640 3F 01 mov byte ptr ds:[eax+3F],1 004ABB1E A1 60DC4A00 mov eax,dword ptr ds:[4ADC60] 004ABB23 8B00 mov eax,dword ptr ds:[eax] 004ABB25 E8 5E6EF8FF call ResHacke.00432988 004ABB2A 33C0 xor eax,eax 004ABB2C 5A pop edx ; kernel32.7C816FD7 004ABB2D 59 pop ecx ; kernel32.7C816FD7 004ABB2E 59 pop ecx ; kernel32.7C816FD7 004ABB2F 64:8910 mov dword ptr fs:[eax],edx ; ntdll.KiFastSystemCallRet 004ABB32 68 47BB4A00 push ResHacke.004ABB47 004ABB37 8D45 F0 lea eax,dword ptr ss:[ebp-10] 004ABB3A E8 097EF5FF call ResHacke.00403948 004ABB3F C3 retn 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 60 B8 4A 00 E8 B7 9C F5 FF 33 C0 55 68 40 BB 4A 00 64 FF 30 64 89 20 A1 60 DC 4A 00 8B 00 E8 85 6E F8 FF A1 60 DC 4A 00 8B 00 BA 54 BB 4A 00 E8 8C 6B F8 FF A1 60 DC 4A 00 8B 00 C6 40 3F 00 8B 0D D8 DA 4A 00 A1 60 DC 4A 00 8B 00 8B 15 DC E4 49 00 E8 69 6E F8 FF E8 78 6D F5 FF 48 7E 78 8D 55 F0 B8 01 00 00 00 E8 C8 6D F5 FF 8B 45 F0 80 38 2D 75 63 B2 01 A1 88 AE 48 00 E8 B8 72 F5 FF A3 84 E8 4A 00 33 C0 55 68 F9 BA 4A 00 64 FF 30 64 89 20 8B 15 D8 DA 4A 00 8B 12 A1 84 E8 4A 00 E8 8B F5 FD FF 33 C0 5A 59 59 64 89 10 68 00 BB 4A 00 A1 84 E8 4A 00 E8 A4 72 F5 FF C3 E9 6A 78 F5 FF EB EE A1 D8 DA 4A 00 8B 00 E8 30 4D F8 FF E8 83 7C F5 FF EB 0B A1 60 DC 4A 00 8B 00 C6 40 3F 01 A1 60 DC 4A 00 8B 00 E8 5E 6E F8 FF 33 C0 5A 59 59 64 89 10 68 47 BB 4A 00 8D 45 F0 E8 09 7E F5 FF C3 Borland Delphi 4.0 - 5.0 CODE DATA BSS .idata .tls .rdata .reloc .rsrc 00457E00 YUCE> 55 push ebp 00457E01 8BEC mov ebp,esp 00457E03 83C4 F4 add esp,-0C 00457E06 B8 C87C4500 mov eax,YUCE.00457CC8 00457E0B E8 44E4FAFF call YUCE.00406254 00457E10 A1 048F4500 mov eax,dword ptr ds:[458F04] 00457E15 8B00 mov eax,dword ptr ds:[eax] 00457E17 BA 547E4500 mov edx,YUCE.00457E54 00457E1C E8 83DEFEFF call YUCE.00445CA4 00457E21 8B0D 688D4500 mov ecx,dword ptr ds:[458D68] ; YUCE.0045A878 00457E27 A1 048F4500 mov eax,dword ptr ds:[458F04] 00457E2C 8B00 mov eax,dword ptr ds:[eax] 00457E2E 8B15 C85B4500 mov edx,dword ptr ds:[455BC8] ; YUCE.00455C14 00457E34 E8 2FE2FEFF call YUCE.00446068 00457E39 A1 048F4500 mov eax,dword ptr ds:[458F04] 00457E3E 8B00 mov eax,dword ptr ds:[eax] 00457E40 E8 A3E2FEFF call YUCE.004460E8 00457E45 E8 F6B8FAFF call YUCE.00403740 00457E4A 0000 add byte ptr ds:[eax],al 00457E4C FFFF ??? ; Unknown command 00457E4E FFFF ??? ; Unknown command 00457E50 0C 00 or al,0 00457E52 0000 add byte ptr ds:[eax],al 00457E54 C9 leave 00457E55 FA cli 00457E56 C3 retn 55 8B EC 83 C4 F4 B8 C8 7C 45 00 E8 44 E4 FA FF A1 04 8F 45 00 8B 00 BA 54 7E 45 00 E8 83 DE FE FF 8B 0D 68 8D 45 00 A1 04 8F 45 00 8B 00 8B 15 C8 5B 45 00 E8 2F E2 FE FF A1 04 8F 45 00 8B 00 E8 A3 E2 FE FF E8 F6 B8 FA FF 00 00 FF FF FF FF 0C 00 00 00 C9 FA C3 Borland Delphi 6.0 - 7.0 CODE DATA BSS .idata .tls .rdata .reloc .rsrc 0047845C pymf> 55 push ebp 0047845D 8BEC mov ebp,esp 0047845F 83C4 E8 add esp,-18 00478462 33C0 xor eax,eax 00478464 8945 EC mov dword ptr ss:[ebp-14],eax 00478467 8945 E8 mov dword ptr ss:[ebp-18],eax 0047846A B8 6C824700 mov eax,pymf.0047826C 0047846F E8 94E3F8FF call pymf.00406808 00478474 33C0 xor eax,eax 00478476 55 push ebp 00478477 68 21854700 push pymf.00478521 0047847C 64:FF30 push dword ptr fs:[eax] 0047847F 64:8920 mov dword ptr fs:[eax],esp 00478482 E8 0DD5FFFF call pymf.00475994 00478487 84C0 test al,al 00478489 75 18 jnz short pymf.004784A3 0047848B 6A 24 push 24 0047848D 68 30854700 push pymf.00478530 ; ASCII "Error" 00478492 68 38854700 push pymf.00478538 ; ASCII "YMF7x4 driver is not found. Start the program anyway?" 00478497 6A 00 push 0 00478499 E8 C2ECF8FF call <jmp.&user32.MessageBoxA> 0047849E 83F8 06 cmp eax,6 004784A1 75 63 jnz short pymf.00478506 004784A3 8D55 E8 lea edx,dword ptr ss:[ebp-18] 004784A6 B8 01000000 mov eax,1 004784AB E8 BCA5F8FF call pymf.00402A6C 004784B0 8B45 E8 mov eax,dword ptr ss:[ebp-18] 004784B3 8D55 EC lea edx,dword ptr ss:[ebp-14] 004784B6 E8 3900F9FF call pymf.004084F4 004784BB 8B45 EC mov eax,dword ptr ss:[ebp-14] 004784BE BA 78854700 mov edx,pymf.00478578 ; ASCII "-clean" 004784C3 E8 5CC3F8FF call pymf.00404824 004784C8 75 07 jnz short pymf.004784D1 004784CA E8 B1C7FFFF call pymf.00474C80 004784CF EB 35 jmp short pymf.00478506 004784D1 A1 E8B24700 mov eax,dword ptr ds:[47B2E8] 004784D6 8B00 mov eax,dword ptr ds:[eax] 004784D8 E8 A75BFEFF call pymf.0045E084 004784DD 8B0D 00B14700 mov ecx,dword ptr ds:[47B100] ; pymf.0047CDC0 004784E3 A1 E8B24700 mov eax,dword ptr ds:[47B2E8] 004784E8 8B00 mov eax,dword ptr ds:[eax] 004784EA 8B15 F85B4700 mov edx,dword ptr ds:[475BF8] ; pymf.00475C44 004784F0 E8 A75BFEFF call pymf.0045E09C 004784F5 A1 E8B24700 mov eax,dword ptr ds:[47B2E8] 004784FA 8B00 mov eax,dword ptr ds:[eax] 004784FC E8 1B5CFEFF call pymf.0045E11C 00478501 E8 5ED6FFFF call pymf.00475B64 00478506 33C0 xor eax,eax 00478508 5A pop edx ; kernel32.7C816FD7 00478509 59 pop ecx ; kernel32.7C816FD7 0047850A 59 pop ecx ; kernel32.7C816FD7 0047850B 64:8910 mov dword ptr fs:[eax],edx ; ntdll.KiFastSystemCallRet 0047850E 68 28854700 push pymf.00478528 00478513 8D45 E8 lea eax,dword ptr ss:[ebp-18] 00478516 BA 02000000 mov edx,2 0047851B E8 2CBFF8FF call pymf.0040444C 00478520 C3 retn 55 8B EC 83 C4 E8 33 C0 89 45 EC 89 45 E8 B8 6C 82 47 00 E8 94 E3 F8 FF 33 C0 55 68 21 85 47 00 64 FF 30 64 89 20 E8 0D D5 FF FF 84 C0 75 18 6A 24 68 30 85 47 00 68 38 85 47 00 6A 00 E8 C2 EC F8 FF 83 F8 06 75 63 8D 55 E8 B8 01 00 00 00 E8 BC A5 F8 FF 8B 45 E8 8D 55 EC E8 39 00 F9 FF 8B 45 EC BA 78 85 47 00 E8 5C C3 F8 FF 75 07 E8 B1 C7 FF FF EB 35 A1 E8 B2 47 00 8B 00 E8 A7 5B FE FF 8B 0D 00 B1 47 00 A1 E8 B2 47 00 8B 00 8B 15 F8 5B 47 00 E8 A7 5B FE FF A1 E8 B2 47 00 8B 00 E8 1B 5C FE FF E8 5E D6 FF FF 33 C0 5A 59 59 64 89 10 68 28 85 47 00 8D 45 E8 BA 02 00 00 00 E8 2C BF F8 FF C3 MASM32 / TASM32 .text .rdata .data .rsrc 00401000 RVA.>/$ 6A 00 push 0 ; /pModule = NULL 00401002 \|. E8 830A0000 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA 00401007 \|. A3 07304000 mov dword ptr ds:[403007],eax 0040100C \|. 6A 00 push 0 ; /lParam = NULL 0040100E \|. 68 6C104000 push RVA.0040106C ; \|DlgProc = RVA.0040106C 00401013 \|. 6A 00 push 0 ; \|hOwner = NULL 00401015 \|. 68 00304000 push RVA.00403000 ; \|pTemplate = "DIALOG" 0040101A \|. FF35 07304000 push dword ptr ds:[403007] ; \|hInst = NULL 00401020 \|. E8 F9090000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA 00401025 \|. 50 push eax ; /ExitCode = 0 00401026 \. E8 4D0A0000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess 0040102B /. 55 push ebp 0040102C \|. 8BEC mov ebp,esp 0040102E \|. 837D 0C 10 cmp dword ptr ss:[ebp+C],10 00401032 \|. 75 0C jnz short RVA.00401040 00401034 \|. 6A 00 push 0 ; /Result = 0 00401036 \|. FF75 08 push dword ptr ss:[ebp+8] ; \|hWnd = 00401000 00401039 \|. E8 EC090000 call <jmp.&USER32.EndDialog> ; \EndDialog 0040103E \|. EB 26 jmp short RVA.00401066 00401040 \|> 817D 0C 11010000 cmp dword ptr ss:[ebp+C],111 00401047 \|. 75 1D jnz short RVA.00401066 00401049 \|. 8B45 10 mov eax,dword ptr ss:[ebp+10] 0040104C \|. 66:3D B80B cmp ax,0BB8 00401050 \|. 75 14 jnz short RVA.00401066 00401052 \|. C1E8 10 shr eax,10 00401055 \|. 66:0BC0 or ax,ax 00401058 \|. 75 0A jnz short RVA.00401064 0040105A \|. 6A 00 push 0 ; /Result = 0 0040105C \|. FF75 08 push dword ptr ss:[ebp+8] ; \|hWnd = 00401000 0040105F \|. E8 C6090000 call <jmp.&USER32.EndDialog> ; \EndDialog 00401064 \|> EB 00 jmp short RVA.00401066 00401066 \|> 33C0 xor eax,eax 00401068 \|. C9 leave 00401069 \. C2 1000 retn 10 6A 00 E8 83 0A 00 00 A3 07 30 40 00 6A 00 68 6C 10 40 00 6A 00 68 00 30 40 00 FF 35 07 30 40 00 E8 F9 09 00 00 50 E8 4D 0A 00 00 55 8B EC 83 7D 0C 10 75 0C 6A 00 FF 75 08 E8 EC 09 00 00 EB 26 81 7D 0C 11 01 00 00 75 1D 8B 45 10 66 3D B8 0B 75 14 C1 E8 10 66 0B C0 75 0A 6A 00 FF 75 08 E8 C6 09 00 00 EB 00 33 C0 C9 C2 10 00 Microsoft Visual Basic 5.0 / 6.0 .text .data .rsrc 00402360 Kill>/$ 68 2C4D4000 push KillBox.00404D2C ; ASCII "VB5!6&" 00402365 \|. E8 EEFFFFFF call <jmp.&MSVBVM60.#100> 0040236A \|. 0000 add byte ptr ds:[eax],al 0040236C \|. 0000 add byte ptr ds:[eax],al 0040236E \|. 0000 add byte ptr ds:[eax],al 00402370 \|. 3000 xor byte ptr ds:[eax],al 00402372 \|. 0000 add byte ptr ds:[eax],al 00402374 \|. 3800 cmp byte ptr ds:[eax],al 00402376 \|. 0000 add byte ptr ds:[eax],al 00402378 \|. 0000 add byte ptr ds:[eax],al 0040237A \|. 0000 add byte ptr ds:[eax],al 0040237C \|. 4F dec edi ; ntdll.7C930738 0040237D \. C2 F150 retn 50F1 68 2C 4D 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 4F C2 F1 50 Microsoft Visual C++ 4.x .text .rdata .data .idata .reloc 00401CC0 memt> $ 64:A1 00000000 mov eax,dword ptr fs:[0] 00401CC6 . 55 push ebp 00401CC7 . 8BEC mov ebp,esp 00401CC9 . 6A FF push -1 00401CCB . 68 28804000 push memtest.00408028 00401CD0 . 68 001B4000 push memtest.00401B00 00401CD5 . 50 push eax 00401CD6 . 64:8925 00000000 mov dword ptr fs:[0],esp 00401CDD . 83EC 60 sub esp,60 00401CE0 . 53 push ebx 00401CE1 . 56 push esi 00401CE2 . 57 push edi ; ntdll.7C930738 00401CE3 . 8965 E8 mov dword ptr ss:[ebp-18],esp 00401CE6 . FF15 30D14000 call near dword ptr ds:[<&KERNEL32.GetVersion>] ; kernel32.GetVersion 00401CEC . A3 B89A4000 mov dword ptr ds:[409AB8],eax 00401CF1 . 33C0 xor eax,eax 00401CF3 . A0 B99A4000 mov al,byte ptr ds:[409AB9] 00401CF8 . A3 C49A4000 mov dword ptr ds:[409AC4],eax 00401CFD . A1 B89A4000 mov eax,dword ptr ds:[409AB8] 00401D02 . C12D B89A4000 10 shr dword ptr ds:[409AB8],10 00401D09 . 25 FF000000 and eax,0FF 00401D0E . A3 C09A4000 mov dword ptr ds:[409AC0],eax 00401D13 . C1E0 08 shl eax,8 00401D16 . 0305 C49A4000 add eax,dword ptr ds:[409AC4] 00401D1C . A3 BC9A4000 mov dword ptr ds:[409ABC],eax 00401D21 . E8 6A010000 call memtest.00401E90 00401D26 . 85C0 test eax,eax 00401D28 . 75 0A jnz short memtest.00401D34 00401D2A . 6A 1C push 1C 00401D2C . E8 2F010000 call memtest.00401E60 00401D31 . 83C4 04 add esp,4 00401D34 > C745 FC 00000000 mov dword ptr ss:[ebp-4],0 00401D3B . E8 00260000 call memtest.00404340 00401D40 . E8 EB250000 call memtest.00404330 00401D45 . FF15 2CD14000 call near dword ptr ds:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA 00401D4B . A3 80CD4000 mov dword ptr ds:[40CD80],eax 00401D50 . E8 8B210000 call memtest.00403EE0 00401D55 . A3 3C924000 mov dword ptr ds:[40923C],eax 00401D5A . 85C0 test eax,eax 00401D5C . 74 09 je short memtest.00401D67 00401D5E . 833D 80CD4000 00 cmp dword ptr ds:[40CD80],0 00401D65 . 75 0A jnz short memtest.00401D71 00401D67 > 6A FF push -1 00401D69 . E8 021B0000 call memtest.00403870 00401D6E . 83C4 04 add esp,4 00401D71 > E8 EA1E0000 call memtest.00403C60 00401D76 . E8 F51D0000 call memtest.00403B70 00401D7B . E8 C01A0000 call memtest.00403840 00401D80 . 8B35 80CD4000 mov esi,dword ptr ds:[40CD80] 00401D86 . 8A06 mov al,byte ptr ds:[esi] 00401D88 . 3C 22 cmp al,22 00401D8A . 74 0C je short memtest.00401D98 00401D8C . 3C 20 cmp al,20 00401D8E . 76 35 jbe short memtest.00401DC5 00401D90 > 46 inc esi 00401D91 . 803E 20 cmp byte ptr ds:[esi],20 00401D94 .^ 77 FA ja short memtest.00401D90 00401D96 . EB 2D jmp short memtest.00401DC5 00401D98 > 46 inc esi 00401D99 . 803E 22 cmp byte ptr ds:[esi],22 00401D9C . 74 26 je short memtest.00401DC4 00401D9E . 8A5D D8 mov bl,byte ptr ss:[ebp-28] 00401DA1 > 8A1E mov bl,byte ptr ds:[esi] 00401DA3 . 84DB test bl,bl 00401DA5 . 74 18 je short memtest.00401DBF 00401DA7 . 33C0 xor eax,eax 00401DA9 . 8AC3 mov al,bl 00401DAB . 50 push eax 00401DAC . E8 5F1D0000 call memtest.00403B10 00401DB1 . 83C4 04 add esp,4 00401DB4 . 85C0 test eax,eax 00401DB6 . 74 01 je short memtest.00401DB9 00401DB8 . 46 inc esi 00401DB9 > 46 inc esi 00401DBA . 803E 22 cmp byte ptr ds:[esi],22 00401DBD .^ 75 E2 jnz short memtest.00401DA1 00401DBF > 803E 22 cmp byte ptr ds:[esi],22 00401DC2 . 75 01 jnz short memtest.00401DC5 00401DC4 > 46 inc esi 00401DC5 > 803E 00 cmp byte ptr ds:[esi],0 00401DC8 . 74 0B je short memtest.00401DD5 00401DCA > 803E 20 cmp byte ptr ds:[esi],20 00401DCD . 77 06 ja short memtest.00401DD5 00401DCF . 46 inc esi 00401DD0 . 803E 00 cmp byte ptr ds:[esi],0 00401DD3 .^ 75 F5 jnz short memtest.00401DCA 00401DD5 > C745 BC 00000000 mov dword ptr ss:[ebp-44],0 00401DDC . 8D45 90 lea eax,dword ptr ss:[ebp-70] 00401DDF . 50 push eax ; /pStartupinfo = NULL 00401DE0 . FF15 28D14000 call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA 00401DE6 . F645 BC 01 test byte ptr ss:[ebp-44],1 00401DEA . B8 0A000000 mov eax,0A 00401DEF . 74 08 je short memtest.00401DF9 00401DF1 . 8B45 C0 mov eax,dword ptr ss:[ebp-40] ; ntdll.7C92E64E 00401DF4 . 25 FFFF0000 and eax,0FFFF 00401DF9 > 50 push eax ; /Arg4 = 00000000 00401DFA . 56 push esi ; \|Arg3 = FFFFFFFF 00401DFB . 6A 00 push 0 ; \|Arg2 = 00000000 00401DFD . 6A 00 push 0 ; \|/pModule = NULL 00401DFF . FF15 24D14000 call near dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; \|\GetModuleHandleA 00401E05 . 50 push eax ; \|Arg1 = 00000000 00401E06 . E8 F5F1FFFF call memtest.00401000 ; \memtest.00401000 00401E0B . 50 push eax 00401E0C . E8 5F1A0000 call memtest.00403870 00401E11 . EB 27 jmp short memtest.00401E3A 00401E13 . 8B45 EC mov eax,dword ptr ss:[ebp-14] 00401E16 . 8B00 mov eax,dword ptr ds:[eax] 00401E18 . 8B00 mov eax,dword ptr ds:[eax] 00401E1A . 8945 E0 mov dword ptr ss:[ebp-20],eax 00401E1D . 8B45 EC mov eax,dword ptr ss:[ebp-14] 00401E20 . 50 push eax 00401E21 . 8B45 E0 mov eax,dword ptr ss:[ebp-20] 00401E24 . 50 push eax 00401E25 . E8 561B0000 call memtest.00403980 00401E2A . 83C4 08 add esp,8 00401E2D . C3 retn 64 A1 00 00 00 00 55 8B EC 6A FF 68 28 80 40 00 68 00 1B 40 00 50 64 89 25 00 00 00 00 83 EC 60 53 56 57 89 65 E8 FF 15 30 D1 40 00 A3 B8 9A 40 00 33 C0 A0 B9 9A 40 00 A3 C4 9A 40 00 A1 B8 9A 40 00 C1 2D B8 9A 40 00 10 25 FF 00 00 00 A3 C0 9A 40 00 C1 E0 08 03 05 C4 9A 40 00 A3 BC 9A 40 00 E8 6A 01 00 00 85 C0 75 0A 6A 1C E8 2F 01 00 00 83 C4 04 C7 45 FC 00 00 00 00 E8 00 26 00 00 E8 EB 25 00 00 FF 15 2C D1 40 00 A3 80 CD 40 00 E8 8B 21 00 00 A3 3C 92 40 00 85 C0 74 09 83 3D 80 CD 40 00 00 75 0A 6A FF E8 02 1B 00 00 83 C4 04 E8 EA 1E 00 00 E8 F5 1D 00 00 E8 C0 1A 00 00 8B 35 80 CD 40 00 8A 06 3C 22 74 0C 3C 20 76 35 46 80 3E 20 77 FA EB 2D 46 80 3E 22 74 26 8A 5D D8 8A 1E 84 DB 74 18 33 C0 8A C3 50 E8 5F 1D 00 00 83 C4 04 85 C0 74 01 46 46 80 3E 22 75 E2 80 3E 22 75 01 46 80 3E 00 74 0B 80 3E 20 77 06 46 80 3E 00 75 F5 C7 45 BC 00 00 00 00 8D 45 90 50 FF 15 28 D1 40 00 F6 45 BC 01 B8 0A 00 00 00 74 08 8B 45 C0 25 FF FF 00 00 50 56 6A 00 6A 00 FF 15 24 D1 40 00 50 E8 F5 F1 FF FF 50 E8 5F 1A 00 00 EB 27 8B 45 EC 8B 00 8B 00 89 45 E0 8B 45 EC 50 8B 45 E0 50 E8 56 1B 00 00 83 C4 08 C3 Microsoft Visual C++ 5.0 .text .rdata .data .rsrc 0040B060 HEdi> $ 55 push ebp 0040B061 . 8BEC mov ebp,esp 0040B063 . 6A FF push -1 0040B065 . 68 C8264400 push HEdit.004426C8 0040B06A . 68 38E24000 push HEdit.0040E238 ; SE handler installation 0040B06F . 64:A1 00000000 mov eax,dword ptr fs:[0] 0040B075 . 50 push eax 0040B076 . 64:8925 00000000 mov dword ptr fs:[0],esp 0040B07D . 83C4 A8 add esp,-58 0040B080 . 53 push ebx 0040B081 . 56 push esi 0040B082 . 57 push edi ; ntdll.7C930738 0040B083 . 8965 E8 mov dword ptr ss:[ebp-18],esp 0040B086 . FF15 F0C14300 call near dword ptr ds: [<&KERNEL32.GetVersion>] ; kernel32.GetVersion 0040B08C . 33D2 xor edx,edx ; ntdll.KiFastSystemCallRet 0040B08E . 8AD4 mov dl,ah 0040B090 . 8915 A0174500 mov dword ptr ds:[4517A0],edx ; ntdll.KiFastSystemCallRet 0040B096 . 8BC8 mov ecx,eax 0040B098 . 81E1 FF000000 and ecx,0FF 0040B09E . 890D 9C174500 mov dword ptr ds:[45179C],ecx 0040B0A4 . C1E1 08 shl ecx,8 0040B0A7 . 03CA add ecx,edx ; ntdll.KiFastSystemCallRet 0040B0A9 . 890D 98174500 mov dword ptr ds:[451798],ecx 0040B0AF . C1E8 10 shr eax,10 0040B0B2 . A3 94174500 mov dword ptr ds:[451794],eax 0040B0B7 . E8 F45C0000 call HEdit.00410DB0 0040B0BC . 85C0 test eax,eax 0040B0BE . 75 0A jnz short HEdit.0040B0CA 0040B0C0 . 6A 1C push 1C 0040B0C2 . E8 79010000 call HEdit.0040B240 0040B0C7 . 83C4 04 add esp,4 0040B0CA > E8 11290000 call HEdit.0040D9E0 0040B0CF . 85C0 test eax,eax 0040B0D1 . 75 0A jnz short HEdit.0040B0DD 0040B0D3 . 6A 10 push 10 0040B0D5 . E8 66010000 call HEdit.0040B240 0040B0DA . 83C4 04 add esp,4 0040B0DD > C745 FC 00000000 mov dword ptr ss:[ebp-4],0 0040B0E4 . E8 B75A0000 call HEdit.00410BA0 0040B0E9 . E8 821B0000 call HEdit.0040CC70 0040B0EE . FF15 70C24300 call near dword ptr ds: [<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA 0040B0F4 . A3 D02E4500 mov dword ptr ds:[452ED0],eax 0040B0F9 . E8 42590000 call HEdit.00410A40 0040B0FE . A3 DC174500 mov dword ptr ds:[4517DC],eax 0040B103 . 85C0 test eax,eax 0040B105 . 74 09 je short HEdit.0040B110 0040B107 . A1 D02E4500 mov eax,dword ptr ds:[452ED0] 0040B10C . 85C0 test eax,eax 0040B10E . 75 0A jnz short HEdit.0040B11A 0040B110 > 6A FF push -1 0040B112 . E8 C9F7FFFF call HEdit.0040A8E0 0040B117 . 83C4 04 add esp,4 0040B11A > E8 71560000 call HEdit.00410790 0040B11F . E8 7C550000 call HEdit.004106A0 0040B124 . E8 87F7FFFF call HEdit.0040A8B0 0040B129 . 8B35 D02E4500 mov esi,dword ptr ds:[452ED0] 0040B12F . 8975 9C mov dword ptr ss:[ebp-64],esi 0040B132 . 803E 22 cmp byte ptr ds:[esi],22 0040B135 . 0F85 BE000000 jnz HEdit.0040B1F9 0040B13B > 46 inc esi 0040B13C . 8975 9C mov dword ptr ss:[ebp-64],esi 0040B13F . 8A06 mov al,byte ptr ds:[esi] 0040B141 . 3C 22 cmp al,22 0040B143 . 74 1C je short HEdit.0040B161 0040B145 . 84C0 test al,al 0040B147 . 74 18 je short HEdit.0040B161 0040B149 . 25 FF000000 and eax,0FF 0040B14E . 50 push eax 0040B14F . E8 EC540000 call HEdit.00410640 0040B154 . 83C4 04 add esp,4 0040B157 . 85C0 test eax,eax 0040B159 .^ 74 E0 je short HEdit.0040B13B 0040B15B . 46 inc esi 0040B15C . 8975 9C mov dword ptr ss:[ebp-64],esi 0040B15F .^ EB DA jmp short HEdit.0040B13B 0040B161 > 803E 22 cmp byte ptr ds:[esi],22 0040B164 . 75 04 jnz short HEdit.0040B16A 0040B166 . 46 inc esi 0040B167 . 8975 9C mov dword ptr ss:[ebp-64],esi 0040B16A > 8A06 mov al,byte ptr ds:[esi] 0040B16C . 84C0 test al,al 0040B16E . 74 0A je short HEdit.0040B17A 0040B170 . 3C 20 cmp al,20 0040B172 . 77 06 ja short HEdit.0040B17A 0040B174 . 46 inc esi 0040B175 . 8975 9C mov dword ptr ss:[ebp-64],esi 0040B178 .^ EB F0 jmp short HEdit.0040B16A 0040B17A > C745 D0 00000000 mov dword ptr ss:[ebp-30],0 0040B181 . 8D45 A4 lea eax,dword ptr ss:[ebp-5C] 0040B184 . 50 push eax ; /pStartupinfo = NULL 0040B185 . FF15 68C24300 call near dword ptr ds: [<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA 0040B18B . F645 D0 01 test byte ptr ss:[ebp-30],1 0040B18F . 74 0A je short HEdit.0040B19B 0040B191 . 8B45 D4 mov eax,dword ptr ss:[ebp-2C] ; kernel32.7C816FD7 0040B194 . 25 FFFF0000 and eax,0FFFF 0040B199 . EB 05 jmp short HEdit.0040B1A0 0040B19B > B8 0A000000 mov eax,0A 0040B1A0 > 50 push eax 0040B1A1 . 56 push esi 0040B1A2 . 6A 00 push 0 0040B1A4 . 6A 00 push 0 ; /pModule = NULL 0040B1A6 . FF15 78C24300 call near dword ptr ds: [<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA 0040B1AC . 50 push eax 0040B1AD . E8 B5FC0000 call HEdit.0041AE67 0040B1B2 . 8945 A0 mov dword ptr ss:[ebp-60],eax 0040B1B5 . 50 push eax 0040B1B6 . E8 25F7FFFF call HEdit.0040A8E0 0040B1BB . EB 21 jmp short HEdit.0040B1DE 0040B1BD . 8B45 EC mov eax,dword ptr ss:[ebp-14] 0040B1C0 . 8B08 mov ecx,dword ptr ds:[eax] 0040B1C2 . 8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E64E 0040B1C4 . 894D 98 mov dword ptr ss:[ebp-68],ecx 0040B1C7 . 50 push eax 0040B1C8 . 51 push ecx 0040B1C9 . E8 22520000 call HEdit.004103F0 0040B1CE . 83C4 08 add esp,8 0040B1D1 . C3 retn 55 8B EC 6A FF 68 C8 26 44 00 68 38 E2 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57 89 65 E8 FF 15 F0 C1 43 00 33 D2 8A D4 89 15 A0 17 45 00 8B C8 81 E1 FF 00 00 00 89 0D 9C 17 45 00 C1 E1 08 03 CA 89 0D 98 17 45 00 C1 E8 10 A3 94 17 45 00 E8 F4 5C 00 00 85 C0 75 0A 6A 1C E8 79 01 00 00 83 C4 04 E8 11 29 00 00 85 C0 75 0A 6A 10 E8 66 01 00 00 83 C4 04 C7 45 FC 00 00 00 00 E8 B7 5A 00 00 E8 82 1B 00 00 FF 15 70 C2 43 00 A3 D0 2E 45 00 E8 42 59 00 00 A3 DC 17 45 00 85 C0 74 09 A1 D0 2E 45 00 85 C0 75 0A 6A FF E8 C9 F7 FF FF 83 C4 04 E8 71 56 00 00 E8 7C 55 00 00 E8 87 F7 FF FF 8B 35 D0 2E 45 00 89 75 9C 80 3E 22 0F 85 BE 00 00 00 46 89 75 9C 8A 06 3C 22 74 1C 84 C0 74 18 25 FF 00 00 00 50 E8 EC 54 00 00 83 C4 04 85 C0 74 E0 46 89 75 9C EB DA 80 3E 22 75 04 46 89 75 9C 8A 06 84 C0 74 0A 3C 20 77 06 46 89 75 9C EB F0 C7 45 D0 00 00 00 00 8D 45 A4 50 FF 15 68 C2 43 00 F6 45 D0 01 74 0A 8B 45 D4 25 FF FF 00 00 EB 05 B8 0A 00 00 00 50 56 6A 00 6A 00 FF 15 78 C2 43 00 50 E8 B5 FC 00 00 89 45 A0 50 E8 25 F7 FF FF EB 21 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 22 52 00 00 83 C4 08 C3 Microsoft Visual C++ 6.0 .text .rdata .data .tls .rsrc 004AD06E ACDS>/$ 55 push ebp 004AD06F \|. 8BEC mov ebp,esp 004AD071 \|. 6A FF push -1 004AD073 \|. 68 28014E00 push ACDSee.004E0128 004AD078 \|. 68 9C0C4B00 push ACDSee.004B0C9C ; SE handler installation 004AD07D \|. 64:A1 00000000 mov eax,dword ptr fs:[0] 004AD083 \|. 50 push eax 004AD084 \|. 64:8925 00000000 mov dword ptr fs:[0],esp 004AD08B \|. 83EC 58 sub esp,58 004AD08E \|. 53 push ebx 004AD08F \|. 56 push esi 004AD090 \|. 57 push edi ; ntdll.7C930738 004AD091 \|. 8965 E8 mov dword ptr ss:[ebp-18],esp 004AD094 \|. FF15 A8744D00 call near dword ptr ds:[<&KERNEL32.GetVersion>] ; kernel32.GetVersion 004AD09A \|. 33D2 xor edx,edx ; ntdll.KiFastSystemCallRet 004AD09C \|. 8AD4 mov dl,ah 004AD09E \|. 8915 F4584F00 mov dword ptr ds:[4F58F4],edx ; ntdll.KiFastSystemCallRet 004AD0A4 \|. 8BC8 mov ecx,eax 004AD0A6 \|. 81E1 FF000000 and ecx,0FF 004AD0AC \|. 890D F0584F00 mov dword ptr ds:[4F58F0],ecx 004AD0B2 \|. C1E1 08 shl ecx,8 004AD0B5 \|. 03CA add ecx,edx ; ntdll.KiFastSystemCallRet 004AD0B7 \|. 890D EC584F00 mov dword ptr ds:[4F58EC],ecx 004AD0BD \|. C1E8 10 shr eax,10 004AD0C0 \|. A3 E8584F00 mov dword ptr ds:[4F58E8],eax 004AD0C5 \|. 6A 01 push 1 004AD0C7 \|. E8 C12D0000 call ACDSee.004AFE8D 004AD0CC \|. 59 pop ecx ; kernel32.7C816FD7 004AD0CD \|. 85C0 test eax,eax 004AD0CF \|. 75 08 jnz short ACDSee.004AD0D9 004AD0D1 \|. 6A 1C push 1C 004AD0D3 \|. E8 C3000000 call ACDSee.004AD19B 004AD0D8 \|. 59 pop ecx ; kernel32.7C816FD7 004AD0D9 \|> E8 4E230000 call ACDSee.004AF42C 004AD0DE \|. 85C0 test eax,eax 004AD0E0 \|. 75 08 jnz short ACDSee.004AD0EA 004AD0E2 \|. 6A 10 push 10 004AD0E4 \|. E8 B2000000 call ACDSee.004AD19B 004AD0E9 \|. 59 pop ecx ; kernel32.7C816FD7 004AD0EA \|> 33F6 xor esi,esi 004AD0EC \|. 8975 FC mov dword ptr ss:[ebp-4],esi 004AD0EF \|. E8 42510000 call ACDSee.004B2236 004AD0F4 \|. FF15 7C724D00 call near dword ptr ds:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA 004AD0FA \|. A3 58704F00 mov dword ptr ds:[4F7058],eax 004AD0FF \|. E8 00500000 call ACDSee.004B2104 004AD104 \|. A3 D8584F00 mov dword ptr ds:[4F58D8],eax 004AD109 \|. E8 A94D0000 call ACDSee.004B1EB7 004AD10E \|. E8 EB4C0000 call ACDSee.004B1DFE 004AD113 \|. E8 EF080000 call ACDSee.004ADA07 004AD118 \|. 8975 D0 mov dword ptr ss:[ebp-30],esi 004AD11B \|. 8D45 A4 lea eax,dword ptr ss:[ebp-5C] 004AD11E \|. 50 push eax ; /pStartupinfo = NULL 004AD11F \|. FF15 74724D00 call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA 004AD125 \|. E8 7C4C0000 call ACDSee.004B1DA6 004AD12A \|. 8945 9C mov dword ptr ss:[ebp-64],eax 004AD12D \|. F645 D0 01 test byte ptr ss:[ebp-30],1 004AD131 \|. 74 06 je short ACDSee.004AD139 004AD133 \|. 0FB745 D4 movzx eax,word ptr ss:[ebp-2C] 004AD137 \|. EB 03 jmp short ACDSee.004AD13C 004AD139 \|> 6A 0A push 0A 004AD13B \|. 58 pop eax ; kernel32.7C816FD7 004AD13C \|> 50 push eax 004AD13D \|. FF75 9C push dword ptr ss:[ebp-64] 004AD140 \|. 56 push esi 004AD141 \|. 56 push esi ; /pModule = FFFFFFFF ??? 004AD142 \|. FF15 90744D00 call near dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA 004AD148 \|. 50 push eax 004AD149 \|. E8 F9E50000 call ACDSee.004BB747 004AD14E \|. 8945 A0 mov dword ptr ss:[ebp-60],eax 004AD151 \|. 50 push eax 004AD152 \|. E8 DD080000 call ACDSee.004ADA34 004AD157 \|. 8B45 EC mov eax,dword ptr ss:[ebp-14] 004AD15A \|. 8B08 mov ecx,dword ptr ds:[eax] 004AD15C \|. 8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E64E 004AD15E \|. 894D 98 mov dword ptr ss:[ebp-68],ecx 004AD161 \|. 50 push eax 004AD162 \|. 51 push ecx 004AD163 \|. E8 B3390000 call ACDSee.004B0B1B 004AD168 \|. 59 pop ecx ; kernel32.7C816FD7 004AD169 \|. 59 pop ecx ; kernel32.7C816FD7 004AD16A \. C3 retn 55 8B EC 6A FF 68 28 01 4E 00 68 9C 0C 4B 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 A8 74 4D 00 33 D2 8A D4 89 15 F4 58 4F 00 8B C8 81 E1 FF 00 00 00 89 0D F0 58 4F 00 C1 E1 08 03 CA 89 0D EC 58 4F 00 C1 E8 10 A3 E8 58 4F 00 6A 01 E8 C1 2D 00 00 59 85 C0 75 08 6A 1C E8 C3 00 00 00 59 E8 4E 23 00 00 85 C0 75 08 6A 10 E8 B2 00 00 00 59 33 F6 89 75 FC E8 42 51 00 00 FF 15 7C 72 4D 00 A3 58 70 4F 00 E8 00 50 00 00 A3 D8 58 4F 00 E8 A9 4D 00 00 E8 EB 4C 00 00 E8 EF 08 00 00 89 75 D0 8D 45 A4 50 FF 15 74 72 4D 00 E8 7C 4C 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 90 74 4D 00 50 E8 F9 E5 00 00 89 45 A0 50 E8 DD 08 00 00 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 B3 39 00 00 59 59 C3 Microsoft Visual C++ 6.0 [Debug] .text .rdata .data .rsrc 005522F3 Baby>/$ 55 push ebp 005522F4 \|. 8BEC mov ebp,esp 005522F6 \|. 6A FF push -1 005522F8 \|. 68 58235800 push Babylon.00582358 005522FD \|. 68 6C5B5500 push Babylon.00555B6C ; SE handler installation 00552302 \|. 64:A1 00000000 mov eax,dword ptr fs:[0] 00552308 \|. 50 push eax 00552309 \|. 64:8925 00000000 mov dword ptr fs:[0],esp 00552310 \|. 83EC 58 sub esp,58 00552313 \|. 53 push ebx 00552314 \|. 56 push esi 00552315 \|. 57 push edi ; ntdll.7C930738 00552316 \|. 8965 E8 mov dword ptr ss:[ebp-18],esp 00552319 \|. FF15 00635700 call near dword ptr ds:[<&KERNEL32.GetVersion>] ; kernel32.GetVersion 0055231F \|. 33D2 xor edx,edx ; ntdll.KiFastSystemCallRet 00552321 \|. 8AD4 mov dl,ah 00552323 \|. 8915 00BF5D00 mov dword ptr ds:[5DBF00],edx ; ntdll.KiFastSystemCallRet 00552329 \|. 8BC8 mov ecx,eax 0055232B \|. 81E1 FF000000 and ecx,0FF 00552331 \|. 890D FCBE5D00 mov dword ptr ds:[5DBEFC],ecx 00552337 \|. C1E1 08 shl ecx,8 0055233A \|. 03CA add ecx,edx ; ntdll.KiFastSystemCallRet 0055233C \|. 890D F8BE5D00 mov dword ptr ds:[5DBEF8],ecx 00552342 \|. C1E8 10 shr eax,10 00552345 \|. A3 F4BE5D00 mov dword ptr ds:[5DBEF4],eax 0055234A \|. 6A 01 push 1 0055234C \|. E8 391D0000 call Babylon.0055408A 00552351 \|. 59 pop ecx ; kernel32.7C816FD7 00552352 \|. 85C0 test eax,eax 00552354 \|. 75 08 jnz short Babylon.0055235E 00552356 \|. 6A 1C push 1C 00552358 \|. E8 C3000000 call Babylon.00552420 0055235D \|. 59 pop ecx ; kernel32.7C816FD7 0055235E \|> E8 99350000 call Babylon.005558FC 00552363 \|. 85C0 test eax,eax 00552365 \|. 75 08 jnz short Babylon.0055236F 00552367 \|. 6A 10 push 10 00552369 \|. E8 B2000000 call Babylon.00552420 0055236E \|. 59 pop ecx ; kernel32.7C816FD7 0055236F \|> 33F6 xor esi,esi 00552371 \|. 8975 FC mov dword ptr ss:[ebp-4],esi 00552374 \|. E8 1B840000 call Babylon.0055A794 00552379 \|. FF15 0C625700 call near dword ptr ds:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA 0055237F \|. A3 08D85D00 mov dword ptr ds:[5DD808],eax 00552384 \|. E8 1B8C0000 call Babylon.0055AFA4 00552389 \|. A3 7CBE5D00 mov dword ptr ds:[5DBE7C],eax 0055238E \|. E8 C4890000 call Babylon.0055AD57 00552393 \|. E8 06890000 call Babylon.0055AC9E 00552398 \|. E8 A7380000 call Babylon.00555C44 0055239D \|. 8975 D0 mov dword ptr ss:[ebp-30],esi 005523A0 \|. 8D45 A4 lea eax,dword ptr ss:[ebp-5C] 005523A3 \|. 50 push eax ; /pStartupinfo = NULL 005523A4 \|. FF15 18625700 call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA 005523AA \|. E8 97880000 call Babylon.0055AC46 005523AF \|. 8945 9C mov dword ptr ss:[ebp-64],eax 005523B2 \|. F645 D0 01 test byte ptr ss:[ebp-30],1 005523B6 \|. 74 06 je short Babylon.005523BE 005523B8 \|. 0FB745 D4 movzx eax,word ptr ss:[ebp-2C] 005523BC \|. EB 03 jmp short Babylon.005523C1 005523BE \|> 6A 0A push 0A 005523C0 \|. 58 pop eax ; kernel32.7C816FD7 005523C1 \|> 50 push eax ; /Arg4 = 00000000 005523C2 \|. FF75 9C push dword ptr ss:[ebp-64] ; \|Arg3 = 00000001 005523C5 \|. 56 push esi ; \|Arg2 = FFFFFFFF 005523C6 \|. 56 push esi ; \|/pModule = FFFFFFFF ??? 005523C7 \|. FF15 68645700 call near dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; \|\GetModuleHandleA 005523CD \|. 50 push eax ; \|Arg1 = 00000000 005523CE \|. E8 2DC0EBFF call Babylon.0040E400 ; \Babylon.0040E400 005523D3 \|. 8945 A0 mov dword ptr ss:[ebp-60],eax 005523D6 \|. 50 push eax 005523D7 \|. E8 95380000 call Babylon.00555C71 005523DC \|. 8B45 EC mov eax,dword ptr ss:[ebp-14] 005523DF \|. 8B08 mov ecx,dword ptr ds:[eax] 005523E1 \|. 8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E64E 005523E3 \|. 894D 98 mov dword ptr ss:[ebp-68],ecx 005523E6 \|. 50 push eax 005523E7 \|. 51 push ecx 005523E8 \|. E8 68550000 call Babylon.00557955 005523ED \|. 59 pop ecx ; kernel32.7C816FD7 005523EE \|. 59 pop ecx ; kernel32.7C816FD7 005523EF \. C3 retn 55 8B EC 6A FF 68 58 23 58 00 68 6C 5B 55 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 00 63 57 00 33 D2 8A D4 89 15 00 BF 5D 00 8B C8 81 E1 FF 00 00 00 89 0D FC BE 5D 00 C1 E1 08 03 CA 89 0D F8 BE 5D 00 C1 E8 10 A3 F4 BE 5D 00 6A 01 E8 39 1D 00 00 59 85 C0 75 08 6A 1C E8 C3 00 00 00 59 E8 99 35 00 00 85 C0 75 08 6A 10 E8 B2 00 00 00 59 33 F6 89 75 FC E8 1B 84 00 00 FF 15 0C 62 57 00 A3 08 D8 5D 00 E8 1B 8C 00 00 A3 7C BE 5D 00 E8 C4 89 00 00 E8 06 89 00 00 E8 A7 38 00 00 89 75 D0 8D 45 A4 50 FF 15 18 62 57 00 E8 97 88 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 68 64 57 00 50 E8 2D C0 EB FF 89 45 A0 50 E8 95 38 00 00 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 68 55 00 00 59 59 C3 Microsoft Visual C++ 7.0 .text .rdata .data .rsrc 004A5D0A BitB> $ 6A 60 push 60 004A5D0C . 68 D07A4C00 push BitBuddy.004C7AD0 004A5D11 . E8 7A060000 call BitBuddy.004A6390 004A5D16 . BF 94000000 mov edi,94 004A5D1B . 8BC7 mov eax,edi ; ntdll.7C930738 004A5D1D . E8 CEE6FFFF call BitBuddy.004A43F0 004A5D22 . 8965 E8 mov dword ptr ss:[ebp-18],esp 004A5D25 . 8BF4 mov esi,esp 004A5D27 . 893E mov dword ptr ds:[esi],edi ; ntdll.7C930738 004A5D29 . 56 push esi ; /pVersionInformation = FFFFFFFF 004A5D2A . FF15 8CF24B00 call near dword ptr ds:[<&KERNEL32.GetVersionExA>] ; \GetVersionExA 004A5D30 . 8B4E 10 mov ecx,dword ptr ds:[esi+10] 004A5D33 . 890D 78614E00 mov dword ptr ds:[4E6178],ecx 004A5D39 . 8B46 04 mov eax,dword ptr ds:[esi+4] 004A5D3C . A3 84614E00 mov dword ptr ds:[4E6184],eax 004A5D41 . 8B56 08 mov edx,dword ptr ds:[esi+8] 004A5D44 . 8915 88614E00 mov dword ptr ds:[4E6188],edx ; ntdll.KiFastSystemCallRet 004A5D4A . 8B76 0C mov esi,dword ptr ds:[esi+C] 004A5D4D . 81E6 FF7F0000 and esi,7FFF 004A5D53 . 8935 7C614E00 mov dword ptr ds:[4E617C],esi 004A5D59 . 83F9 02 cmp ecx,2 004A5D5C . 74 0C je short BitBuddy.004A5D6A 004A5D5E . 81CE 00800000 or esi,8000 004A5D64 . 8935 7C614E00 mov dword ptr ds:[4E617C],esi 004A5D6A > C1E0 08 shl eax,8 004A5D6D . 03C2 add eax,edx ; ntdll.KiFastSystemCallRet 004A5D6F . A3 80614E00 mov dword ptr ds:[4E6180],eax 004A5D74 . 33F6 xor esi,esi 004A5D76 . 56 push esi ; /pModule = FFFFFFFF ??? 004A5D77 . 8B3D 08F24B00 mov edi,dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; \|kernel32.GetModuleHandleA 004A5D7D . FFD7 call near edi ; \GetModuleHandleA 004A5D7F . 66:8138 4D5A cmp word ptr ds:[eax],5A4D 004A5D84 . 75 1F jnz short BitBuddy.004A5DA5 004A5D86 . 8B48 3C mov ecx,dword ptr ds:[eax+3C] 004A5D89 . 03C8 add ecx,eax 004A5D8B . 8139 50450000 cmp dword ptr ds:[ecx],4550 004A5D91 . 75 12 jnz short BitBuddy.004A5DA5 004A5D93 . 0FB741 18 movzx eax,word ptr ds:[ecx+18] 004A5D97 . 3D 0B010000 cmp eax,10B 004A5D9C . 74 1F je short BitBuddy.004A5DBD 004A5D9E . 3D 0B020000 cmp eax,20B 004A5DA3 . 74 05 je short BitBuddy.004A5DAA 004A5DA5 > 8975 E4 mov dword ptr ss:[ebp-1C],esi 004A5DA8 . EB 27 jmp short BitBuddy.004A5DD1 004A5DAA > 83B9 84000000 0E cmp dword ptr ds:[ecx+84],0E 004A5DB1 .^ 76 F2 jbe short BitBuddy.004A5DA5 004A5DB3 . 33C0 xor eax,eax 004A5DB5 . 39B1 F8000000 cmp dword ptr ds:[ecx+F8],esi 004A5DBB . EB 0E jmp short BitBuddy.004A5DCB 004A5DBD > 8379 74 0E cmp dword ptr ds:[ecx+74],0E 004A5DC1 .^ 76 E2 jbe short BitBuddy.004A5DA5 004A5DC3 . 33C0 xor eax,eax 004A5DC5 . 39B1 E8000000 cmp dword ptr ds:[ecx+E8],esi 004A5DCB > 0F95C0 setne al 004A5DCE . 8945 E4 mov dword ptr ss:[ebp-1C],eax 004A5DD1 > 6A 01 push 1 004A5DD3 . E8 6C340000 call BitBuddy.004A9244 004A5DD8 . 59 pop ecx ; kernel32.7C816FD7 004A5DD9 . 85C0 test eax,eax 004A5DDB . 75 08 jnz short BitBuddy.004A5DE5 004A5DDD . 6A 1C push 1C 004A5DDF . E8 02FFFFFF call BitBuddy.004A5CE6 004A5DE4 . 59 pop ecx ; kernel32.7C816FD7 004A5DE5 > E8 EE300000 call BitBuddy.004A8ED8 004A5DEA . 85C0 test eax,eax 004A5DEC . 75 08 jnz short BitBuddy.004A5DF6 004A5DEE . 6A 10 push 10 004A5DF0 . E8 F1FEFFFF call BitBuddy.004A5CE6 004A5DF5 . 59 pop ecx ; kernel32.7C816FD7 004A5DF6 > E8 EA6F0000 call BitBuddy.004ACDE5 004A5DFB . 8975 FC mov dword ptr ss:[ebp-4],esi 004A5DFE . E8 BC630000 call BitBuddy.004AC1BF 004A5E03 . 85C0 test eax,eax 004A5E05 . 7D 08 jge short BitBuddy.004A5E0F 004A5E07 . 6A 1B push 1B 004A5E09 . E8 B3FEFFFF call BitBuddy.004A5CC1 004A5E0E . 59 pop ecx ; kernel32.7C816FD7 004A5E0F > FF15 54F14B00 call near dword ptr ds:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA 004A5E15 . A3 F4784E00 mov dword ptr ds:[4E78F4],eax 004A5E1A . E8 A46E0000 call BitBuddy.004ACCC3 004A5E1F . A3 D85F4E00 mov dword ptr ds:[4E5FD8],eax 004A5E24 . E8 F86D0000 call BitBuddy.004ACC21 004A5E29 . 85C0 test eax,eax 004A5E2B . 7D 08 jge short BitBuddy.004A5E35 004A5E2D . 6A 08 push 8 004A5E2F . E8 8DFEFFFF call BitBuddy.004A5CC1 004A5E34 . 59 pop ecx ; kernel32.7C816FD7 004A5E35 > E8 B46B0000 call BitBuddy.004AC9EE 004A5E3A . 85C0 test eax,eax 004A5E3C . 7D 08 jge short BitBuddy.004A5E46 004A5E3E . 6A 09 push 9 004A5E40 . E8 7CFEFFFF call BitBuddy.004A5CC1 004A5E45 . 59 pop ecx ; kernel32.7C816FD7 004A5E46 > 6A 01 push 1 004A5E48 . E8 42290000 call BitBuddy.004A878F 004A5E4D . 59 pop ecx ; kernel32.7C816FD7 004A5E4E . 8945 D8 mov dword ptr ss:[ebp-28],eax 004A5E51 . 3BC6 cmp eax,esi 004A5E53 . 74 07 je short BitBuddy.004A5E5C 004A5E55 . 50 push eax 004A5E56 . E8 66FEFFFF call BitBuddy.004A5CC1 004A5E5B . 59 pop ecx ; kernel32.7C816FD7 004A5E5C > 8975 BC mov dword ptr ss:[ebp-44],esi 004A5E5F . 8D45 90 lea eax,dword ptr ss:[ebp-70] 004A5E62 . 50 push eax ; /pStartupinfo = NULL 004A5E63 . FF15 58F14B00 call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA 004A5E69 . E8 236B0000 call BitBuddy.004AC991 004A5E6E . 8945 E0 mov dword ptr ss:[ebp-20],eax 004A5E71 . F645 BC 01 test byte ptr ss:[ebp-44],1 004A5E75 . 74 06 je short BitBuddy.004A5E7D 004A5E77 . 0FB745 C0 movzx eax,word ptr ss:[ebp-40] 004A5E7B . EB 03 jmp short BitBuddy.004A5E80 004A5E7D > 6A 0A push 0A 004A5E7F . 58 pop eax ; kernel32.7C816FD7 004A5E80 > 50 push eax 004A5E81 . FF75 E0 push dword ptr ss:[ebp-20] 004A5E84 . 56 push esi 004A5E85 . 56 push esi 004A5E86 . FFD7 call near edi ; ntdll.7C930738 004A5E88 . 50 push eax ; \|Arg1 = 00000000 004A5E89 . E8 620BF8FF call BitBuddy.004269F0 ; \BitBuddy.004269F0 004A5E8E . 8BF8 mov edi,eax 004A5E90 . 897D D4 mov dword ptr ss:[ebp-2C],edi ; ntdll.7C930738 004A5E93 . 3975 E4 cmp dword ptr ss:[ebp-1C],esi 004A5E96 . 75 06 jnz short BitBuddy.004A5E9E 004A5E98 . 57 push edi ; ntdll.7C930738 004A5E99 . E8 1E2A0000 call BitBuddy.004A88BC 004A5E9E > E8 3B2A0000 call BitBuddy.004A88DE 004A5EA3 . EB 2B jmp short BitBuddy.004A5ED0 004A5EA5 . 8B45 EC mov eax,dword ptr ss:[ebp-14] 004A5EA8 . 8B08 mov ecx,dword ptr ds:[eax] 004A5EAA . 8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E64E 004A5EAC . 894D DC mov dword ptr ss:[ebp-24],ecx 004A5EAF . 50 push eax 004A5EB0 . 51 push ecx 004A5EB1 . E8 77690000 call BitBuddy.004AC82D 004A5EB6 . 59 pop ecx ; kernel32.7C816FD7 004A5EB7 . 59 pop ecx ; kernel32.7C816FD7 004A5EB8 . C3 retn 6A 60 68 D0 7A 4C 00 E8 7A 06 00 00 BF 94 00 00 00 8B C7 E8 CE E6 FF FF 89 65 E8 8B F4 89 3E 56 FF 15 8C F2 4B 00 8B 4E 10 89 0D 78 61 4E 00 8B 46 04 A3 84 61 4E 00 8B 56 08 89 15 88 61 4E 00 8B 76 0C 81 E6 FF 7F 00 00 89 35 7C 61 4E 00 83 F9 02 74 0C 81 CE 00 80 00 00 89 35 7C 61 4E 00 C1 E0 08 03 C2 A3 80 61 4E 00 33 F6 56 8B 3D 08 F2 4B 00 FF D7 66 81 38 4D 5A 75 1F 8B 48 3C 03 C8 81 39 50 45 00 00 75 12 0F B7 41 18 3D 0B 01 00 00 74 1F 3D 0B 02 00 00 74 05 89 75 E4 EB 27 83 B9 84 00 00 00 0E 76 F2 33 C0 39 B1 F8 00 00 00 EB 0E 83 79 74 0E 76 E2 33 C0 39 B1 E8 00 00 00 0F 95 C0 89 45 E4 6A 01 E8 6C 34 00 00 59 85 C0 75 08 6A 1C E8 02 FF FF FF 59 E8 EE 30 00 00 85 C0 75 08 6A 10 E8 F1 FE FF FF 59 E8 EA 6F 00 00 89 75 FC E8 BC 63 00 00 85 C0 7D 08 6A 1B E8 B3 FE FF FF 59 FF 15 54 F1 4B 00 A3 F4 78 4E 00 E8 A4 6E 00 00 A3 D8 5F 4E 00 E8 F8 6D 00 00 85 C0 7D 08 6A 08 E8 8D FE FF FF 59 E8 B4 6B 00 00 85 C0 7D 08 6A 09 E8 7C FE FF FF 59 6A 01 E8 42 29 00 00 59 89 45 D8 3B C6 74 07 50 E8 66 FE FF FF 59 89 75 BC 8D 45 90 50 FF 15 58 F1 4B 00 E8 23 6B 00 00 89 45 E0 F6 45 BC 01 74 06 0F B7 45 C0 EB 03 6A 0A 58 50 FF 75 E0 56 56 FF D7 50 E8 62 0B F8 FF 8B F8 89 7D D4 39 75 E4 75 06 57 E8 1E 2A 00 00 E8 3B 2A 00 00 EB 2B 8B 45 EC 8B 08 8B 09 89 4D DC 50 51 E8 77 69 00 00 59 59 C3 Microsoft Visual C++ 7.0 [Debug] .text .rdata .data .rsrc 004079A3 eMul> $ 6A 60 push 60 004079A5 . 68 B0244200 push eMuleUpd.004224B0 004079AA . E8 F5E1FFFF call eMuleUpd.00405BA4 004079AF . BF 94000000 mov edi,94 004079B4 . 8BC7 mov eax,edi ; ntdll.7C930738 004079B6 . E8 65FCFFFF call eMuleUpd.00407620 004079BB . 8965 E8 mov dword ptr ss:[ebp-18],esp 004079BE . 8BF4 mov esi,esp 004079C0 . 893E mov dword ptr ds:[esi],edi ; ntdll.7C930738 004079C2 . 56 push esi ; /pVersionInformation = FFFFFFFF 004079C3 . FF15 70024200 call near dword ptr ds:[<&KERNEL32.GetVersionExA>] ; \GetVersionExA 004079C9 . 8B4E 10 mov ecx,dword ptr ds:[esi+10] 004079CC . 890D 28BB4200 mov dword ptr ds:[42BB28],ecx 004079D2 . 8B46 04 mov eax,dword ptr ds:[esi+4] 004079D5 . A3 34BB4200 mov dword ptr ds:[42BB34],eax 004079DA . 8B56 08 mov edx,dword ptr ds:[esi+8] 004079DD . 8915 38BB4200 mov dword ptr ds:[42BB38],edx ; ntdll.KiFastSystemCallRet 004079E3 . 8B76 0C mov esi,dword ptr ds:[esi+C] 004079E6 . 81E6 FF7F0000 and esi,7FFF 004079EC . 8935 2CBB4200 mov dword ptr ds:[42BB2C],esi 004079F2 . 83F9 02 cmp ecx,2 004079F5 . 74 0C je short eMuleUpd.00407A03 004079F7 . 81CE 00800000 or esi,8000 004079FD . 8935 2CBB4200 mov dword ptr ds:[42BB2C],esi 00407A03 > C1E0 08 shl eax,8 00407A06 . 03C2 add eax,edx ; ntdll.KiFastSystemCallRet 00407A08 . A3 30BB4200 mov dword ptr ds:[42BB30],eax 00407A0D . 33F6 xor esi,esi 00407A0F . 56 push esi ; /pModule = FFFFFFFF ??? 00407A10 . 8B3D 88014200 mov edi,dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; \|kernel32.GetModuleHandleA 00407A16 . FFD7 call near edi ; \GetModuleHandleA 00407A18 . 66:8138 4D5A cmp word ptr ds:[eax],5A4D 00407A1D . 75 1F jnz short eMuleUpd.00407A3E 00407A1F . 8B48 3C mov ecx,dword ptr ds:[eax+3C] 00407A22 . 03C8 add ecx,eax 00407A24 . 8139 50450000 cmp dword ptr ds:[ecx],4550 00407A2A . 75 12 jnz short eMuleUpd.00407A3E 00407A2C . 0FB741 18 movzx eax,word ptr ds:[ecx+18] 00407A30 . 3D 0B010000 cmp eax,10B 00407A35 . 74 1F je short eMuleUpd.00407A56 00407A37 . 3D 0B020000 cmp eax,20B 00407A3C . 74 05 je short eMuleUpd.00407A43 00407A3E > 8975 E4 mov dword ptr ss:[ebp-1C],esi 00407A41 . EB 27 jmp short eMuleUpd.00407A6A 00407A43 > 83B9 84000000 0E cmp dword ptr ds:[ecx+84],0E 00407A4A .^ 76 F2 jbe short eMuleUpd.00407A3E 00407A4C . 33C0 xor eax,eax 00407A4E . 39B1 F8000000 cmp dword ptr ds:[ecx+F8],esi 00407A54 . EB 0E jmp short eMuleUpd.00407A64 00407A56 > 8379 74 0E cmp dword ptr ds:[ecx+74],0E 00407A5A .^ 76 E2 jbe short eMuleUpd.00407A3E 00407A5C . 33C0 xor eax,eax 00407A5E . 39B1 E8000000 cmp dword ptr ds:[ecx+E8],esi 00407A64 > 0F95C0 setne al 00407A67 . 8945 E4 mov dword ptr ss:[ebp-1C],eax 00407A6A > 6A 01 push 1 00407A6C . E8 A3550000 call eMuleUpd.0040D014 00407A71 . 59 pop ecx ; kernel32.7C816FD7 00407A72 . 85C0 test eax,eax 00407A74 . 75 08 jnz short eMuleUpd.00407A7E 00407A76 . 6A 1C push 1C 00407A78 . E8 02FFFFFF call eMuleUpd.0040797F 00407A7D . 59 pop ecx ; kernel32.7C816FD7 00407A7E > E8 572A0000 call eMuleUpd.0040A4DA 00407A83 . 85C0 test eax,eax 00407A85 . 75 08 jnz short eMuleUpd.00407A8F 00407A87 . 6A 10 push 10 00407A89 . E8 F1FEFFFF call eMuleUpd.0040797F 00407A8E . 59 pop ecx ; kernel32.7C816FD7 00407A8F > E8 756A0000 call eMuleUpd.0040E509 00407A94 . 8975 FC mov dword ptr ss:[ebp-4],esi 00407A97 . E8 6F680000 call eMuleUpd.0040E30B 00407A9C . 85C0 test eax,eax 00407A9E . 7D 08 jge short eMuleUpd.00407AA8 00407AA0 . 6A 1B push 1B 00407AA2 . E8 B3FEFFFF call eMuleUpd.0040795A 00407AA7 . 59 pop ecx ; kernel32.7C816FD7 00407AA8 > FF15 0C024200 call near dword ptr ds:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA 00407AAE . A3 10D44200 mov dword ptr ds:[42D410],eax 00407AB3 . E8 31670000 call eMuleUpd.0040E1E9 00407AB8 . A3 14BB4200 mov dword ptr ds:[42BB14],eax 00407ABD . E8 85660000 call eMuleUpd.0040E147 00407AC2 . 85C0 test eax,eax 00407AC4 . 7D 08 jge short eMuleUpd.00407ACE 00407AC6 . 6A 08 push 8 00407AC8 . E8 8DFEFFFF call eMuleUpd.0040795A 00407ACD . 59 pop ecx ; kernel32.7C816FD7 00407ACE > E8 41640000 call eMuleUpd.0040DF14 00407AD3 . 85C0 test eax,eax 00407AD5 . 7D 08 jge short eMuleUpd.00407ADF 00407AD7 . 6A 09 push 9 00407AD9 . E8 7CFEFFFF call eMuleUpd.0040795A 00407ADE . 59 pop ecx ; kernel32.7C816FD7 00407ADF > 6A 01 push 1 00407AE1 . E8 72030000 call eMuleUpd.00407E58 00407AE6 . 59 pop ecx ; kernel32.7C816FD7 00407AE7 . 8945 D8 mov dword ptr ss:[ebp-28],eax 00407AEA . 3BC6 cmp eax,esi 00407AEC . 74 07 je short eMuleUpd.00407AF5 00407AEE . 50 push eax 00407AEF . E8 66FEFFFF call eMuleUpd.0040795A 00407AF4 . 59 pop ecx ; kernel32.7C816FD7 00407AF5 > 8975 BC mov dword ptr ss:[ebp-44],esi 00407AF8 . 8D45 90 lea eax,dword ptr ss:[ebp-70] 00407AFB . 50 push eax ; /pStartupinfo = NULL 00407AFC . FF15 B4004200 call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA 00407B02 . E8 B0630000 call eMuleUpd.0040DEB7 00407B07 . 8945 E0 mov dword ptr ss:[ebp-20],eax 00407B0A . F645 BC 01 test byte ptr ss:[ebp-44],1 00407B0E . 74 06 je short eMuleUpd.00407B16 00407B10 . 0FB745 C0 movzx eax,word ptr ss:[ebp-40] 00407B14 . EB 03 jmp short eMuleUpd.00407B19 00407B16 > 6A 0A push 0A 00407B18 . 58 pop eax ; kernel32.7C816FD7 00407B19 > 50 push eax 00407B1A . FF75 E0 push dword ptr ss:[ebp-20] 00407B1D . 56 push esi 00407B1E . 56 push esi 00407B1F . FFD7 call near edi ; ntdll.7C930738 00407B21 . 50 push eax 00407B22 . E8 33B50000 call eMuleUpd.0041305A 00407B27 . 8BF8 mov edi,eax 00407B29 . 897D D4 mov dword ptr ss:[ebp-2C],edi ; ntdll.7C930738 00407B2C . 3975 E4 cmp dword ptr ss:[ebp-1C],esi 00407B2F . 75 06 jnz short eMuleUpd.00407B37 00407B31 . 57 push edi ; ntdll.7C930738 00407B32 . E8 4E040000 call eMuleUpd.00407F85 00407B37 > E8 6B040000 call eMuleUpd.00407FA7 00407B3C . EB 2B jmp short eMuleUpd.00407B69 00407B3E . 8B45 EC mov eax,dword ptr ss:[ebp-14] 00407B41 . 8B08 mov ecx,dword ptr ds:[eax] 00407B43 . 8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E64E 00407B45 . 894D DC mov dword ptr ss:[ebp-24],ecx 00407B48 . 50 push eax 00407B49 . 51 push ecx 00407B4A . E8 04620000 call eMuleUpd.0040DD53 00407B4F . 59 pop ecx ; kernel32.7C816FD7 00407B50 . 59 pop ecx ; kernel32.7C816FD7 00407B51 . C3 retn 6A 60 68 B0 24 42 00 E8 F5 E1 FF FF BF 94 00 00 00 8B C7 E8 65 FC FF FF 89 65 E8 8B F4 89 3E 56 FF 15 70 02 42 00 8B 4E 10 89 0D 28 BB 42 00 8B 46 04 A3 34 BB 42 00 8B 56 08 89 15 38 BB 42 00 8B 76 0C 81 E6 FF 7F 00 00 89 35 2C BB 42 00 83 F9 02 74 0C 81 CE 00 80 00 00 89 35 2C BB 42 00 C1 E0 08 03 C2 A3 30 BB 42 00 33 F6 56 8B 3D 88 01 42 00 FF D7 66 81 38 4D 5A 75 1F 8B 48 3C 03 C8 81 39 50 45 00 00 75 12 0F B7 41 18 3D 0B 01 00 00 74 1F 3D 0B 02 00 00 74 05 89 75 E4 EB 27 83 B9 84 00 00 00 0E 76 F2 33 C0 39 B1 F8 00 00 00 EB 0E 83 79 74 0E 76 E2 33 C0 39 B1 E8 00 00 00 0F 95 C0 89 45 E4 6A 01 E8 A3 55 00 00 59 85 C0 75 08 6A 1C E8 02 FF FF FF 59 E8 57 2A 00 00 85 C0 75 08 6A 10 E8 F1 FE FF FF 59 E8 75 6A 00 00 89 75 FC E8 6F 68 00 00 85 C0 7D 08 6A 1B E8 B3 FE FF FF 59 FF 15 0C 02 42 00 A3 10 D4 42 00 E8 31 67 00 00 A3 14 BB 42 00 E8 85 66 00 00 85 C0 7D 08 6A 08 E8 8D FE FF FF 59 E8 41 64 00 00 85 C0 7D 08 6A 09 E8 7C FE FF FF 59 6A 01 E8 72 03 00 00 59 89 45 D8 3B C6 74 07 50 E8 66 FE FF FF 59 89 75 BC 8D 45 90 50 FF 15 B4 00 42 00 E8 B0 63 00 00 89 45 E0 F6 45 BC 01 74 06 0F B7 45 C0 EB 03 6A 0A 58 50 FF 75 E0 56 56 FF D7 50 E8 33 B5 00 00 8B F8 89 7D D4 39 75 E4 75 06 57 E8 4E 04 00 00 E8 6B 04 00 00 EB 2B 8B 45 EC 8B 08 8B 09 89 4D DC 50 51 E8 04 62 00 00 59 59 C3 Microsoft Visual C++ 7.0 Method2 [Debug] .text .data .rsrc 0100739D note> 6A 70 push 70 0100739F 68 98180001 push notepad.01001898 010073A4 E8 BF010000 call notepad.01007568 010073A9 33DB xor ebx,ebx 010073AB 53 push ebx 010073AC 8B3D CC100001 mov edi,dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; kernel32.GetModuleHandleA 010073B2 FFD7 call near edi ; ntdll.7C930738 010073B4 66:8138 4D5A cmp word ptr ds:[eax],5A4D 010073B9 75 1F jnz short notepad.010073DA 010073BB 8B48 3C mov ecx,dword ptr ds:[eax+3C] 010073BE 03C8 add ecx,eax 010073C0 8139 50450000 cmp dword ptr ds:[ecx],4550 010073C6 75 12 jnz short notepad.010073DA 010073C8 0FB741 18 movzx eax,word ptr ds:[ecx+18] 010073CC 3D 0B010000 cmp eax,10B 010073D1 74 1F je short notepad.010073F2 010073D3 3D 0B020000 cmp eax,20B 010073D8 74 05 je short notepad.010073DF 010073DA 895D E4 mov dword ptr ss:[ebp-1C],ebx 010073DD EB 27 jmp short notepad.01007406 010073DF 83B9 84000000 0E cmp dword ptr ds:[ecx+84],0E 010073E6 ^ 76 F2 jbe short notepad.010073DA 010073E8 33C0 xor eax,eax 010073EA 3999 F8000000 cmp dword ptr ds:[ecx+F8],ebx 010073F0 EB 0E jmp short notepad.01007400 010073F2 8379 74 0E cmp dword ptr ds:[ecx+74],0E 010073F6 ^ 76 E2 jbe short notepad.010073DA 010073F8 33C0 xor eax,eax 010073FA 3999 E8000000 cmp dword ptr ds:[ecx+E8],ebx 01007400 0F95C0 setne al 01007403 8945 E4 mov dword ptr ss:[ebp-1C],eax 01007406 895D FC mov dword ptr ss:[ebp-4],ebx 01007409 6A 02 push 2 0100740B FF15 38130001 call near dword ptr ds:[<&msvcrt.__set_app_type>] ; msvcrt.__set_app_type 01007411 59 pop ecx ; kernel32.7C816FD7 01007412 830D 9CAB0001 FF or dword ptr ds:[100AB9C],FFFFFFFF 01007419 830D A0AB0001 FF or dword ptr ds:[100ABA0],FFFFFFFF 01007420 FF15 34130001 call near dword ptr ds:[<&msvcrt.__p__fmode>] ; msvcrt.__p__fmode 01007426 8B0D B89A0001 mov ecx,dword ptr ds:[1009AB8] 0100742C 8908 mov dword ptr ds:[eax],ecx 0100742E FF15 30130001 call near dword ptr ds:[<&msvcrt.__p__commode>] ; msvcrt.__p__commode 01007434 8B0D B49A0001 mov ecx,dword ptr ds:[1009AB4] 0100743A 8908 mov dword ptr ds:[eax],ecx 0100743C A1 2C130001 mov eax,dword ptr ds:[<&msvcrt._adjust_fdiv>] 01007441 8B00 mov eax,dword ptr ds:[eax] 01007443 A3 A4AB0001 mov dword ptr ds:[100ABA4],eax 01007448 E8 A7010000 call notepad.010075F4 0100744D 391D 08960001 cmp dword ptr ds:[1009608],ebx 01007453 75 0C jnz short notepad.01007461 01007455 68 F4750001 push notepad.010075F4 ; Entry address 0100745A FF15 28130001 call near dword ptr ds:[<&msvcrt.__setusermatherr>] ; msvcrt.__setusermatherr 01007460 59 pop ecx ; kernel32.7C816FD7 01007461 E8 77010000 call notepad.010075DD 01007466 68 10900001 push notepad.01009010 0100746B 68 0C900001 push notepad.0100900C 01007470 E8 5D010000 call <jmp.&msvcrt._initterm> 01007475 A1 B09A0001 mov eax,dword ptr ds:[1009AB0] 0100747A 8945 DC mov dword ptr ss:[ebp-24],eax 0100747D 8D45 DC lea eax,dword ptr ss:[ebp-24] 01007480 50 push eax 01007481 FF35 AC9A0001 push dword ptr ds:[1009AAC] 01007487 8D45 D4 lea eax,dword ptr ss:[ebp-2C] 0100748A 50 push eax 0100748B 8D45 D0 lea eax,dword ptr ss:[ebp-30] 0100748E 50 push eax 0100748F 8D45 CC lea eax,dword ptr ss:[ebp-34] 01007492 50 push eax 01007493 FF15 20130001 call near dword ptr ds:[<&msvcrt.__getmainargs>] ; msvcrt.__getmainargs 01007499 8945 C8 mov dword ptr ss:[ebp-38],eax 0100749C 68 08900001 push notepad.01009008 010074A1 68 00900001 push notepad.01009000 010074A6 E8 27010000 call <jmp.&msvcrt._initterm> 010074AB 83C4 24 add esp,24 010074AE A1 1C130001 mov eax,dword ptr ds:[<&msvcrt._acmdln>] 010074B3 8B30 mov esi,dword ptr ds:[eax] 010074B5 8975 E0 mov dword ptr ss:[ebp-20],esi 010074B8 803E 22 cmp byte ptr ds:[esi],22 010074BB 75 3A jnz short notepad.010074F7 010074BD 46 inc esi 010074BE 8975 E0 mov dword ptr ss:[ebp-20],esi 010074C1 8A06 mov al,byte ptr ds:[esi] 010074C3 3AC3 cmp al,bl 010074C5 74 04 je short notepad.010074CB 010074C7 3C 22 cmp al,22 010074C9 ^ 75 F2 jnz short notepad.010074BD 010074CB 803E 22 cmp byte ptr ds:[esi],22 010074CE 75 04 jnz short notepad.010074D4 010074D0 46 inc esi 010074D1 8975 E0 mov dword ptr ss:[ebp-20],esi 010074D4 8A06 mov al,byte ptr ds:[esi] 010074D6 3AC3 cmp al,bl 010074D8 74 04 je short notepad.010074DE 010074DA 3C 20 cmp al,20 010074DC ^ 76 F2 jbe short notepad.010074D0 010074DE 895D AC mov dword ptr ss:[ebp-54],ebx 010074E1 8D45 80 lea eax,dword ptr ss:[ebp-80] 010074E4 50 push eax 010074E5 FF15 D0100001 call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>] ; kernel32.GetStartupInfoA 010074EB F645 AC 01 test byte ptr ss:[ebp-54],1 010074EF 74 11 je short notepad.01007502 010074F1 0FB745 B0 movzx eax,word ptr ss:[ebp-50] 010074F5 EB 0E jmp short notepad.01007505 010074F7 803E 20 cmp byte ptr ds:[esi],20 010074FA ^ 76 D8 jbe short notepad.010074D4 010074FC 46 inc esi 010074FD 8975 E0 mov dword ptr ss:[ebp-20],esi 01007500 ^ EB F5 jmp short notepad.010074F7 01007502 6A 0A push 0A 01007504 58 pop eax ; kernel32.7C816FD7 01007505 50 push eax 01007506 56 push esi 01007507 53 push ebx 01007508 53 push ebx 01007509 FFD7 call near edi ; ntdll.7C930738 0100750B 50 push eax 0100750C E8 25B4FFFF call notepad.01002936 01007511 8BF0 mov esi,eax 01007513 8975 C4 mov dword ptr ss:[ebp-3C],esi 01007516 395D E4 cmp dword ptr ss:[ebp-1C],ebx 01007519 75 07 jnz short notepad.01007522 0100751B 56 push esi 0100751C FF15 18130001 call near dword ptr ds:[<&msvcrt.exit>] ; msvcrt.exit 01007522 FF15 00130001 call near dword ptr ds:[<&msvcrt._cexit>] ; msvcrt._cexit 01007528 EB 2D jmp short notepad.01007557 0100752A 8B45 EC mov eax,dword ptr ss:[ebp-14] 0100752D 8B08 mov ecx,dword ptr ds:[eax] 0100752F 8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E64E 01007531 894D D8 mov dword ptr ss:[ebp-28],ecx 01007534 50 push eax 01007535 51 push ecx 01007536 E8 8B000000 call <jmp.&msvcrt._XcptFilter> 0100753B 59 pop ecx ; kernel32.7C816FD7 0100753C 59 pop ecx ; kernel32.7C816FD7 0100753D C3 retn 6A 70 68 98 18 00 01 E8 BF 01 00 00 33 DB 53 8B 3D CC 10 00 01 FF D7 66 81 38 4D 5A 75 1F 8B 48 3C 03 C8 81 39 50 45 00 00 75 12 0F B7 41 18 3D 0B 01 00 00 74 1F 3D 0B 02 00 00 74 05 89 5D E4 EB 27 83 B9 84 00 00 00 0E 76 F2 33 C0 39 99 F8 00 00 00 EB 0E 83 79 74 0E 76 E2 33 C0 39 99 E8 00 00 00 0F 95 C0 89 45 E4 89 5D FC 6A 02 FF 15 38 13 00 01 59 83 0D 9C AB 00 01 FF 83 0D A0 AB 00 01 FF FF 15 34 13 00 01 8B 0D B8 9A 00 01 89 08 FF 15 30 13 00 01 8B 0D B4 9A 00 01 89 08 A1 2C 13 00 01 8B 00 A3 A4 AB 00 01 E8 A7 01 00 00 39 1D 08 96 00 01 75 0C 68 F4 75 00 01 FF 15 28 13 00 01 59 E8 77 01 00 00 68 10 90 00 01 68 0C 90 00 01 E8 5D 01 00 00 A1 B0 9A 00 01 89 45 DC 8D 45 DC 50 FF 35 AC 9A 00 01 8D 45 D4 50 8D 45 D0 50 8D 45 CC 50 FF 15 20 13 00 01 89 45 C8 68 08 90 00 01 68 00 90 00 01 E8 27 01 00 00 83 C4 24 A1 1C 13 00 01 8B 30 89 75 E0 80 3E 22 75 3A 46 89 75 E0 8A 06 3A C3 74 04 3C 22 75 F2 80 3E 22 75 04 46 89 75 E0 8A 06 3A C3 74 04 3C 20 76 F2 89 5D AC 8D 45 80 50 FF 15 D0 10 00 01 F6 45 AC 01 74 11 0F B7 45 B0 EB 0E 80 3E 20 76 D8 46 89 75 E0 EB F5 6A 0A 58 50 56 53 53 FF D7 50 E8 25 B4 FF FF 8B F0 89 75 C4 39 5D E4 75 07 56 FF 15 18 13 00 01 FF 15 00 13 00 01 EB 2D 8B 45 EC 8B 08 8B 09 89 4D D8 50 51 E8 8B 00 00 00 59 59 C3 VC8 -> Microsoft Corporation .text .rdata .data .rsrc 00495FCE > /6A 60 push 60 00495FD0 . \|68 387B4C00 push foobar20.004C7B38 00495FD5 . \|E8 A60C0000 call foobar20.00496C80 00495FDA . \|8365 FC 00 and dword ptr ss:[ebp-4],0 00495FDE . \|8D45 90 lea eax,dword ptr ss:[ebp-70] 00495FE1 . \|50 push eax ; /pStartupinfo = 535C08DE 00495FE2 . \|FF15 14414B00 call near dword ptr ds:[<&KERNEL32.GetStartupInfoW>] ; \GetStartupInfoW 00495FE8 . \|C745 FC FEFFFFFF mov dword ptr ss:[ebp-4],-2 00495FEF . \|BF 94000000 mov edi,94 00495FF4 . \|57 push edi ; /HeapSize = 7C930738 (2090010424.) 00495FF5 . \|6A 00 push 0 ; \|Flags = 0 00495FF7 . \|8B1D 10414B00 mov ebx,dword ptr ds:[<&KERNEL32.GetProcessHeap>] ; \|kernel32.GetProcessHeap 00495FFD . \|FFD3 call near ebx ; \|[GetProcessHeap 00495FFF . \|50 push eax ; \|hHeap = 535C08DE 00496000 . \|FF15 08414B00 call near dword ptr ds:[<&KERNEL32.HeapAlloc>] ; \HeapAlloc 00496006 . \|8BF0 mov esi,eax 00496008 . \|85F6 test esi,esi 0049600A . \|75 0D jnz short foobar20.00496019 0049600C . \|6A 12 push 12 0049600E . \|E8 56FFFFFF call foobar20.00495F69 00496013 . \|59 pop ecx ; kernel32.7C816FD7 00496014 . \|E9 89010000 jmp foobar20.004961A2 00496019 > \|893E mov dword ptr ds:[esi],edi ; ntdll.7C930738 0049601B . \|56 push esi ; /pVersionInformation = FFFFFFFF 0049601C . \|FF15 0C414B00 call near dword ptr ds:[<&KERNEL32.GetVersionExA>] ; \GetVersionExA 00496022 . \|56 push esi 00496023 . \|6A 00 push 0 00496025 . \|85C0 test eax,eax 00496027 . \|75 0E jnz short foobar20.00496037 00496029 . \|FFD3 call near ebx 0049602B . \|50 push eax ; \|hHeap = 535C08DE 0049602C . \|FF15 C8414B00 call near dword ptr ds:[<&KERNEL32.HeapFree>] ; \HeapFree 00496032 . \|E9 6B010000 jmp foobar20.004961A2 00496037 > \|8B46 10 mov eax,dword ptr ds:[esi+10] 0049603A . \|8945 E0 mov dword ptr ss:[ebp-20],eax 0049603D . \|8B46 04 mov eax,dword ptr ds:[esi+4] 00496040 . \|8945 DC mov dword ptr ss:[ebp-24],eax 00496043 . \|8B46 08 mov eax,dword ptr ds:[esi+8] 00496046 . \|8945 D8 mov dword ptr ss:[ebp-28],eax 00496049 . \|8B7E 0C mov edi,dword ptr ds:[esi+C] 0049604C . \|81E7 FF7F0000 and edi,7FFF 00496052 . \|FFD3 call near ebx 00496054 . \|50 push eax ; \|hHeap = 535C08DE 00496055 . \|FF15 C8414B00 call near dword ptr ds:[<&KERNEL32.HeapFree>] ; \HeapFree 0049605B . \|8B75 E0 mov esi,dword ptr ss:[ebp-20] 0049605E . \|83FE 02 cmp esi,2 00496061 . \|74 06 je short foobar20.00496069 00496063 . \|81CF 00800000 or edi,8000 00496069 > \|8B4D DC mov ecx,dword ptr ss:[ebp-24] 0049606C . \|8BC1 mov eax,ecx 0049606E . \|C1E0 08 shl eax,8 00496071 . \|8B55 D8 mov edx,dword ptr ss:[ebp-28] ; ntdll.7C930738 00496074 . \|03C2 add eax,edx ; ntdll.KiFastSystemCallRet 00496076 . \|8935 CC084E00 mov dword ptr ds:[4E08CC],esi 0049607C . \|A3 D4084E00 mov dword ptr ds:[4E08D4],eax 00496081 . \|890D D8084E00 mov dword ptr ds:[4E08D8],ecx 00496087 . \|8915 DC084E00 mov dword ptr ds:[4E08DC],edx ; ntdll.KiFastSystemCallRet 0049608D . \|893D D0084E00 mov dword ptr ds:[4E08D0],edi ; ntdll.7C930738 00496093 . \|E8 F5FEFFFF call foobar20.00495F8D 00496098 . \|8945 E0 mov dword ptr ss:[ebp-20],eax 0049609B . \|33DB xor ebx,ebx 0049609D . \|43 inc ebx 0049609E . \|53 push ebx 0049609F . \|E8 8C100000 call foobar20.00497130 004960A4 . \|59 pop ecx ; kernel32.7C816FD7 004960A5 . \|85C0 test eax,eax 004960A7 . \|75 08 jnz short foobar20.004960B1 004960A9 . \|6A 1C push 1C 004960AB . \|E8 B9FEFFFF call foobar20.00495F69 004960B0 . \|59 pop ecx ; kernel32.7C816FD7 004960B1 > \|E8 C5050000 call foobar20.0049667B 004960B6 . \|85C0 test eax,eax 004960B8 . \|75 08 jnz short foobar20.004960C2 004960BA . \|6A 10 push 10 004960BC . \|E8 A8FEFFFF call foobar20.00495F69 004960C1 . \|59 pop ecx ; kernel32.7C816FD7 004960C2 > \|E8 80790000 call foobar20.0049DA47 004960C7 . \|895D FC mov dword ptr ss:[ebp-4],ebx 004960CA . \|E8 38770000 call foobar20.0049D807 004960CF . \|85C0 test eax,eax 004960D1 . \|7D 08 jge short foobar20.004960DB 004960D3 . \|6A 1B push 1B 004960D5 . \|E8 9B080000 call foobar20.00496975 004960DA . \|59 pop ecx ; kernel32.7C816FD7 004960DB > \|E8 88760000 call foobar20.0049D768 004960E0 . \|A3 9C544E00 mov dword ptr ds:[4E549C],eax 004960E5 . \|E8 1D750000 call foobar20.0049D607 004960EA . \|A3 AC084E00 mov dword ptr ds:[4E08AC],eax 004960EF . \|E8 68740000 call foobar20.0049D55C 004960F4 . \|85C0 test eax,eax 004960F6 . \|7D 08 jge short foobar20.00496100 004960F8 . \|6A 08 push 8 004960FA . \|E8 76080000 call foobar20.00496975 004960FF . \|59 pop ecx ; kernel32.7C816FD7 00496100 > \|E8 31720000 call foobar20.0049D336 00496105 . \|85C0 test eax,eax 00496107 . \|7D 08 jge short foobar20.00496111 00496109 . \|6A 09 push 9 0049610B . \|E8 65080000 call foobar20.00496975 00496110 . \|59 pop ecx ; kernel32.7C816FD7 00496111 > \|53 push ebx 00496112 . \|E8 7A090000 call foobar20.00496A91 00496117 . \|59 pop ecx ; kernel32.7C816FD7 00496118 . \|85C0 test eax,eax 0049611A . \|74 07 je short foobar20.00496123 0049611C . \|50 push eax 0049611D . \|E8 53080000 call foobar20.00496975 00496122 . \|59 pop ecx ; kernel32.7C816FD7 00496123 > \|E8 C8710000 call foobar20.0049D2F0 00496128 . \|845D BC test byte ptr ss:[ebp-44],bl 0049612B . \|74 06 je short foobar20.00496133 0049612D . \|0FB74D C0 movzx ecx,word ptr ss:[ebp-40] 00496131 . \|EB 03 jmp short foobar20.00496136 00496133 > \|6A 0A push 0A 00496135 . \|59 pop ecx ; kernel32.7C816FD7 00496136 > \|51 push ecx 00496137 . \|50 push eax 00496138 . \|6A 00 push 0 0049613A . \|68 00004000 push foobar20.00400000 0049613F . \|E8 8EAAF9FF call foobar20.00430BD2 00496144 . \|8945 E4 mov dword ptr ss:[ebp-1C],eax 00496147 . \|837D E0 00 cmp dword ptr ss:[ebp-20],0 0049614B . \|75 06 jnz short foobar20.00496153 0049614D . \|50 push eax 0049614E . \|E8 9E0A0000 call foobar20.00496BF1 00496153 > \|E8 BB0A0000 call foobar20.00496C13 00496158 . \|EB 2E jmp short foobar20.00496188 0049615A . \|8B45 EC mov eax,dword ptr ss:[ebp-14] 0049615D . \|8B08 mov ecx,dword ptr ds:[eax] 0049615F . \|8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E10E 00496161 . \|894D D4 mov dword ptr ss:[ebp-2C],ecx 00496164 . \|50 push eax 00496165 . \|51 push ecx 00496166 . \|E8 16700000 call foobar20.0049D181 0049616B . \|59 pop ecx ; kernel32.7C816FD7 0049616C . \|59 pop ecx ; kernel32.7C816FD7 0049616D . \|C3 retn 0049616E . \|8B65 E8 mov esp,dword ptr ss:[ebp-18] 00496171 . \|8B45 D4 mov eax,dword ptr ss:[ebp-2C] ; kernel32.7C816FD7 00496174 . \|8945 E4 mov dword ptr ss:[ebp-1C],eax 00496177 . \|837D E0 00 cmp dword ptr ss:[ebp-20],0 0049617B . \|75 06 jnz short foobar20.00496183 0049617D . \|50 push eax 0049617E . \|E8 7F0A0000 call foobar20.00496C02 00496183 > \|E8 9A0A0000 call foobar20.00496C22 00496188 > \|C745 FC FEFFFFFF mov dword ptr ss:[ebp-4],-2 0049618F . \|8B45 E4 mov eax,dword ptr ss:[ebp-1C] 00496192 . \|EB 13 jmp short foobar20.004961A7 00496194 . \|33C0 xor eax,eax 00496196 . \|40 inc eax 00496197 . \|C3 retn 00496198 . \|8B65 E8 mov esp,dword ptr ss:[ebp-18] 0049619B . \|C745 FC FEFFFFFF mov dword ptr ss:[ebp-4],-2 004961A2 > \|B8 FF000000 mov eax,0FF 004961A7 > \|E8 190B0000 call foobar20.00496CC5 004961AC . \|C3 retn 004961AD foob> $ \|E8 DD780000 call foobar20.0049DA8F 004961B2 .^\E9 17FEFFFF jmp foobar20.00495FCE 004961B7 $ 3B0D B0CC4D00 cmp ecx,dword ptr ds:[4DCCB0] 004961BD . 75 02 jnz short foobar20.004961C1 004961BF . F3: prefix rep: 004961C0 . C3 retn 6A 60 68 38 7B 4C 00 E8 A6 0C 00 00 83 65 FC 00 8D 45 90 50 FF 15 14 41 4B 00 C7 45 FC FE FF FF FF BF 94 00 00 00 57 6A 00 8B 1D 10 41 4B 00 FF D3 50 FF 15 08 41 4B 00 8B F0 85 F6 75 0D 6A 12 E8 56 FF FF FF 59 E9 89 01 00 00 89 3E 56 FF 15 0C 41 4B 00 56 6A 00 85 C0 75 0E FF D3 50 FF 15 C8 41 4B 00 E9 6B 01 00 00 8B 46 10 89 45 E0 8B 46 04 89 45 DC 8B 46 08 89 45 D8 8B 7E 0C 81 E7 FF 7F 00 00 FF D3 50 FF 15 C8 41 4B 00 8B 75 E0 83 FE 02 74 06 81 CF 00 80 00 00 8B 4D DC 8B C1 C1 E0 08 8B 55 D8 03 C2 89 35 CC 08 4E 00 A3 D4 08 4E 00 89 0D D8 08 4E 00 89 15 DC 08 4E 00 89 3D D0 08 4E 00 E8 F5 FE FF FF 89 45 E0 33 DB 43 53 E8 8C 10 00 00 59 85 C0 75 08 6A 1C E8 B9 FE FF FF 59 E8 C5 05 00 00 85 C0 75 08 6A 10 E8 A8 FE FF FF 59 E8 80 79 00 00 89 5D FC E8 38 77 00 00 85 C0 7D 08 6A 1B E8 9B 08 00 00 59 E8 88 76 00 00 A3 9C 54 4E 00 E8 1D 75 00 00 A3 AC 08 4E 00 E8 68 74 00 00 85 C0 7D 08 6A 08 E8 76 08 00 00 59 E8 31 72 00 00 85 C0 7D 08 6A 09 E8 65 08 00 00 59 53 E8 7A 09 00 00 59 85 C0 74 07 50 E8 53 08 00 00 59 E8 C8 71 00 00 84 5D BC 74 06 0F B7 4D C0 EB 03 6A 0A 59 51 50 6A 00 68 00 00 40 00 E8 8E AA F9 FF 89 45 E4 83 7D E0 00 75 06 50 E8 9E 0A 00 00 E8 BB 0A 00 00 EB 2E 8B 45 EC 8B 08 8B 09 89 4D D4 50 51 E8 16 70 00 00 59 59 C3 8B 65 E8 8B 45 D4 89 45 E4 83 7D E0 00 75 06 50 E8 7F 0A 00 00 E8 9A 0A 00 00 C7 45 FC FE FF FF FF 8B 45 E4 EB 13 33 C0 40 C3 8B 65 E8 C7 45 FC FE FF FF FF B8 FF 00 00 00 E8 19 0B 00 00 C3 E8 DD 78 00 00 E9 17 FE FF FF 3B 0D B0 CC 4D 00 75 02 F3 C3 复制好累的说。。 2010-4-23 17:23 0
霹雳游侠雪币： 333 活跃值： (25) 能力值： ( LV2，RANK：10 ) 在线值：发帖 4 回帖 51 粉丝 0 关注私信	霹雳游侠 6 楼题目？ope？ 2010-4-23 19:55 0
炎SKY 雪币： 300 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 25 粉丝 0 关注私信	炎SKY 7 楼很有用,多谢了,收藏了. 2010-4-23 20:06 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

yydis

雪币： 23

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

3

回帖

15

粉丝

0

关注

私信

yydis: 2 楼

这里有一些拿去看看吧

上传的附件：

Borland C++.txt （7.87kb，12次下载）
Borland C++ 1999.txt （3.61kb，8次下载）
Borland Delphi 2.0.txt （2.38kb，10次下载）
Borland Delphi 3.0.txt （6.36kb，8次下载）
Borland Delphi 4.0 - 5.0.txt （2.03kb，8次下载）
Borland Delphi 6.0 - 7.0.txt （4.49kb，9次下载）
MASM32 - TASM32.txt （3.16kb，13次下载）
Microsoft Visual Basic 5.0 - 6.0.txt （1.05kb，8次下载）
Microsoft Visual C++ 4.x.txt （8.59kb，8次下载）
Microsoft Visual C++ 5.0.txt （8.50kb，9次下载）
Microsoft Visual C++ 6.0.txt （6.47kb，8次下载）
Microsoft Visual C++ 6.0 [Debug].txt （6.79kb，9次下载）
Microsoft Visual C++ 7.0.txt （11.18kb，8次下载）
Microsoft Visual C++ 7.0 [Debug].txt （11.06kb，8次下载）
Microsoft Visual C++ 7.0 Method2 [Debug].txt （10.34kb，18次下载）

2010-4-23 17:15

0

留香

雪币： 1

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

7

回帖

14

粉丝

0

关注

私信

留香: 3 楼

下载要钱哦！！

2010-4-23 17:18

0

留香

雪币： 1

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

7

回帖

14

粉丝

0

关注

私信

留香: 4 楼

能发到我邮箱吗397338853@qq.com？我没有KX币，帮帮忙！！

2010-4-23 17:21

0

yydis

雪币： 23

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

3

回帖

15

粉丝

0

关注

私信

yydis: 5 楼

Borland C++

CODE
DATA
.INIT
.idata
.edata
.reloc
.rsrc

00401000 BCW.> $  A1 59B05000       mov eax,dword ptr ds:[50B059]
00401005    .  C1E0 02          shl eax,2
00401008    .  A3 5DB05000       mov dword ptr ds:[50B05D],eax
0040100D    .  57                push edi                                              ;  ntdll.7C930738
0040100E    .  51                push ecx
0040100F    .  33C0             xor eax,eax
00401011    .  BF 84665400       mov edi,BCW.00546684
00401016    .  B9 8C345500       mov ecx,BCW.0055348C
0040101B    .  3BCF             cmp ecx,edi                                           ;  ntdll.7C930738
0040101D    .  76 05             jbe short BCW.00401024
0040101F    .  2BCF             sub ecx,edi                                           ;  ntdll.7C930738
00401021    .  FC                cld
00401022    .  F3:AA             rep stos byte ptr es:[edi]
00401024    >  59                pop ecx                                                 ;  kernel32.7C816FD7
00401025    .  5F                pop edi                                                 ;  kernel32.7C816FD7
00401026    .  64:67:8B16 0400    mov edx,dword ptr fs:[4]
0040102C    .  8B42 F8          mov eax,dword ptr ds:[edx-8]
0040102F    .  A3 61B05000       mov dword ptr ds:[50B061],eax
00401034    .  8B42 FC          mov eax,dword ptr ds:[edx-4]
00401037    .  A3 65B05000       mov dword ptr ds:[50B065],eax
0040103C    .  83EA 04          sub edx,4
0040103F    .  8915 80345500    mov dword ptr ds:[553480],edx                         ;  ntdll.KiFastSystemCallRet
00401045    .  83EA 04          sub edx,4
00401048    .  3BD4             cmp edx,esp
0040104A    .  73 02             jnb short BCW.0040104E
0040104C    .  8BE2             mov esp,edx                                           ;  ntdll.KiFastSystemCallRet
0040104E    >  6A 00             push 0                                                 ; /Arg1 = 00000000
00401050    .  E8 45100000       call BCW.0040209A                                     ; \BCW.0040209A
00401055    .  59                pop ecx                                                 ;  kernel32.7C816FD7
00401056    .  68 2CB05000       push BCW.0050B02C
0040105B    .  6A 00             push 0                                                 ; /pModule = NULL
0040105D    .  E8 73821000       call <jmp.&KERNEL32.GetModuleHandleA>                   ; \GetModuleHandleA
00401062    .  A3 6AB05000       mov dword ptr ds:[50B06A],eax
00401067    .  6A 00             push 0
00401069    .  E9 93801000       jmp <jmp.&cw3220mt.__startup>
0040106E BCW.> $  E9 09110000       jmp BCW.0040217C
00401073       00                db 00
00401074       00                db 00
00401075       00                db 00
00401076       00                db 00
00401077       00                db 00
00401078    /$  55                push ebp
00401079    |.  8BEC             mov ebp,esp
0040107B    |.  53                push ebx
0040107C    |.  56                push esi
0040107D    |.  57                push edi                                              ;  ntdll.7C930738
0040107E    |.  8B75 0C          mov esi,dword ptr ss:[ebp+C]
00401081    |.  6A 00             push 0                                                 ; /pDefaultCharUsed = NULL
00401083    |.  6A 00             push 0                                                 ; |pDefaultChar = NULL
00401085    |.  6A 00             push 0                                                 ; |MultiByteCount = 0
00401087    |.  6A 00             push 0                                                 ; |MultiByteStr = NULL
00401089    |.  56                push esi                                              ; |WideCharCount = FFFFFFFF (-1.)
0040108A    |.  FF75 08          push dword ptr ss:[ebp+8]                               ; |WideCharStr = "妡",82,"??嶣",82,"?,87,"??暄T貹",86,"",85,"?盏????,A1,"",96,"v?",04,"???P???P?褄",B8,"?,86,"",85,"?,85,"???j?",10,"",89,"?",82,"?,98,"旦Ｑ?,10,"",99,"{",82,"?,98,"?肓",10,"?",11,""
0040108D    |.  6A 00             push 0                                                 ; |Options = 0
0040108F    |.  6A 00             push 0                                                 ; |CodePage = CP_ACP
00401091    |.  E8 99821000       call <jmp.&KERNEL32.WideCharToMultiByte>                ; \WideCharToMultiByte
00401096    |.  8BD8             mov ebx,eax
00401098    |.  83FE FF          cmp esi,-1
0040109B    |.  0F95C0             setne al
0040109E    |.  83E0 01          and eax,1
004010A1    |.  03C3             add eax,ebx
004010A3    |.  50                push eax
004010A4    |.  E8 A47F1000       call <jmp.&cw3220mt.@$bnwa$qui>
004010A9    |.  59                pop ecx                                                 ;  kernel32.7C816FD7
004010AA    |.  8BF8             mov edi,eax
004010AC    |.  6A 00             push 0                                                 ; /pDefaultCharUsed = NULL
004010AE    |.  6A 00             push 0                                                 ; |pDefaultChar = NULL
004010B0    |.  53                push ebx                                              ; |MultiByteCount = 7FFDF000 (2147348480.)
004010B1    |.  57                push edi                                              ; |MultiByteStr = ntdll.7C930738
004010B2    |.  56                push esi                                              ; |WideCharCount = FFFFFFFF (-1.)
004010B3    |.  FF75 08          push dword ptr ss:[ebp+8]                               ; |WideCharStr = "妡",82,"??嶣",82,"?,87,"??暄T貹",86,"",85,"?盏????,A1,"",96,"v?",04,"???P???P?褄",B8,"?,86,"",85,"?,85,"???j?",10,"",89,"?",82,"?,98,"旦Ｑ?,10,"",99,"{",82,"?,98,"?肓",10,"?",11,""
004010B6    |.  6A 00             push 0                                                 ; |Options = 0
004010B8    |.  6A 00             push 0                                                 ; |CodePage = CP_ACP
004010BA    |.  E8 70821000       call <jmp.&KERNEL32.WideCharToMultiByte>                ; \WideCharToMultiByte
004010BF    |.  8BD8             mov ebx,eax
004010C1    |.  83FE FF          cmp esi,-1
004010C4    |.  74 04             je short BCW.004010CA
004010C6    |.  C6041F 00          mov byte ptr ds:[edi+ebx],0
004010CA    |>  8BC7             mov eax,edi                                           ;  ntdll.7C930738
004010CC    |.  5F                pop edi                                                 ;  kernel32.7C816FD7
004010CD    |.  5E                pop esi                                                 ;  kernel32.7C816FD7
004010CE    |.  5B                pop ebx                                                 ;  kernel32.7C816FD7
004010CF    |.  5D                pop ebp                                                 ;  kernel32.7C816FD7
004010D0    \.  C3                retn

A1 59 B0 50 00 C1 E0 02 A3 5D B0 50 00 57 51 33 C0 BF 84 66 54 00 B9 8C 34 55 00 3B CF 76 05 2B
CF FC F3 AA 59 5F 64 67 8B 16 04 00 8B 42 F8 A3 61 B0 50 00 8B 42 FC A3 65 B0 50 00 83 EA 04 89
15 80 34 55 00 83 EA 04 3B D4 73 02 8B E2 6A 00 E8 45 10 00 00 59 68 2C B0 50 00 6A 00 E8 73 82
10 00 A3 6A B0 50 00 6A 00 E9 93 80 10 00 E9 09 11 00 00 00 00 00 00 00 55 8B EC 53 56 57 8B 75
0C 6A 00 6A 00 6A 00 6A 00 56 FF 75 08 6A 00 6A 00 E8 99 82 10 00 8B D8 83 FE FF 0F 95 C0 83 E0
01 03 C3 50 E8 A4 7F 10 00 59 8B F8 6A 00 6A 00 53 57 56 FF 75 08 6A 00 6A 00 E8 70 82 10 00 8B
D8 83 FE FF 74 04 C6 04 1F 00 8B C7 5F 5E 5B 5D C3

Borland C++ 1999

.text
.data
.tls
.rdata
.idata
.edata
.rsrc
.reloc

00401000 Find> $ /EB 10             jmp short Finder33.00401012
00401002       |66                db 66                                                 ;  CHAR 'f'
00401003       |62                db 62                                                 ;  CHAR 'b'
00401004       |3A                db 3A                                                 ;  CHAR ':'
00401005       |43                db 43                                                 ;  CHAR 'C'
00401006       |2B                db 2B                                                 ;  CHAR '+'
00401007       |2B                db 2B                                                 ;  CHAR '+'
00401008       |48                db 48                                                 ;  CHAR 'H'
00401009       |4F                db 4F                                                 ;  CHAR 'O'
0040100A       |4F                db 4F                                                 ;  CHAR 'O'
0040100B       |4B                db 4B                                                 ;  CHAR 'K'
0040100C       |90                nop
0040100D       |E9                db E9
0040100E    . |AC                lods byte ptr ds:[esi]
0040100F    . |2348 00          and ecx,dword ptr ds:[eax]
00401012    > \A1 9F234800       mov eax,dword ptr ds:[48239F]
00401017    .  C1E0 02          shl eax,2
0040101A    .  A3 A3234800       mov dword ptr ds:[4823A3],eax
0040101F    .  52                push edx                                              ;  ntdll.KiFastSystemCallRet
00401020    .  6A 00             push 0                                                 ; /pModule = NULL
00401022    .  E8 79010800       call <jmp.&KERNEL32.GetModuleHandleA>                   ; \GetModuleHandleA
00401027    .  8BD0             mov edx,eax
00401029    .  E8 F64F0700       call Finder33.00476024
0040102E    .  5A                pop edx                                                 ;  kernel32.7C816FD7
0040102F    .  E8 544F0700       call Finder33.00475F88
00401034    .  E8 2B500700       call Finder33.00476064
00401039    .  6A 00             push 0                                                 ; /Arg1 = 00000000
0040103B    .  E8 48620700       call Finder33.00477288                                  ; \Finder33.00477288
00401040    .  59                pop ecx                                                 ;  kernel32.7C816FD7
00401041    .  68 48234800       push Finder33.00482348
00401046    .  6A 00             push 0                                                 ; /pModule = NULL
00401048    .  E8 53010800       call <jmp.&KERNEL32.GetModuleHandleA>                   ; \GetModuleHandleA
0040104D    .  A3 A7234800       mov dword ptr ds:[4823A7],eax
00401052    .  6A 00             push 0
00401054    .  E9 0BB40700       jmp Finder33.0047C464
00401059 Find> $  E9 76620700       jmp Finder33.004772D4
0040105E    .  33C0             xor eax,eax
00401060    .  A0 91234800       mov al,byte ptr ds:[482391]
00401065    .  C3                retn

EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 AC 23 48 00 A1 9F 23 48 00 C1 E0 02 A3 A3 23 48 00 52
6A 00 E8 79 01 08 00 8B D0 E8 F6 4F 07 00 5A E8 54 4F 07 00 E8 2B 50 07 00 6A 00 E8 48 62 07 00
59 68 48 23 48 00 6A 00 E8 53 01 08 00 A3 A7 23 48 00 6A 00 E9 0B B4 07 00 E9 76 62 07 00 33 C0
A0 91 23 48 00 C3

Borland Delphi 2.0

CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc

00433D9C htes>  55                   push ebp
00433D9D       8BEC                mov ebp,esp
00433D9F       83C4 F4             add esp,-0C
00433DA2       E8 F1F4FCFF          call htest.00403298
00433DA7       E8 940AFDFF          call htest.00404840
00433DAC       E8 CF3AFDFF          call htest.00407880
00433DB1       E8 92A4FDFF          call htest.0040E248
00433DB6       E8 D1A5FDFF          call htest.0040E38C
00433DBB       E8 28C5FDFF          call htest.004102E8
00433DC0       E8 633CFEFF          call htest.00417A28
00433DC5       E8 CE0BFFFF          call htest.00424998
00433DCA       E8 2956FFFF          call htest.004293F8
00433DCF       E8 1474FFFF          call htest.0042B1E8
00433DD4       E8 C3A2FFFF          call htest.0042E09C
00433DD9       E8 4ED3FFFF          call htest.0043112C
00433DDE       E8 A5E2FFFF          call htest.00432088
00433DE3       A1 28664300          mov eax,dword ptr ds:[436628]
00433DE8       E8 1302FFFF          call htest.00424000
00433DED       BA 2C3E4300          mov edx,htest.00433E2C

                     ; ASCII "MP3-2-EXE Player"
00433DF2       A1 28664300          mov eax,dword ptr ds:[436628]
00433DF7       E8 20FFFEFF          call htest.00423D1C
00433DFC       B9 A4664300          mov ecx,htest.004366A4
00433E01       BA 04254300          mov edx,htest.00432504
00433E06       A1 28664300          mov eax,dword ptr ds:[436628]
00433E0B       E8 0002FFFF          call htest.00424010
00433E10       A1 28664300          mov eax,dword ptr ds:[436628]
00433E15       E8 8602FFFF          call htest.004240A0
00433E1A       E8 2904FDFF          call htest.00404248
00433E1F       8BE5                mov esp,ebp
00433E21       5D                   pop ebp

                     ; kernel32.7C816FD7
00433E22       C3                   retn

55 8B EC 83 C4 F4 E8 F1 F4 FC FF E8 94 0A FD FF E8 CF 3A FD FF E8 92

A4 FD FF E8 D1 A5 FD FF E8
28 C5 FD FF E8 63 3C FE FF E8 CE 0B FF FF E8 29 56 FF FF E8 14 74 FF

FF E8 C3 A2 FF FF E8 4E D3
FF FF E8 A5 E2 FF FF A1 28 66 43 00 E8 13 02 FF FF BA 2C 3E 43 00 A1

28 66 43 00 E8 20 FF FE FF
B9 A4 66 43 00 BA 04 25 43 00 A1 28 66 43 00 E8 00 02 FF FF A1 28 66

43 00 E8 86 02 FF FF E8 29
04 FD FF 8B E5 5D C3

Borland Delphi 3.0

CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc

004ABA30 ResH>  55                   push ebp
004ABA31       8BEC                mov ebp,esp
004ABA33       83C4 F0             add esp,-10
004ABA36       33C0                xor eax,eax
004ABA38       8945 F0             mov dword ptr ss:[ebp-10],eax
004ABA3B       B8 60B84A00          mov eax,ResHacke.004AB860
004ABA40       E8 B79CF5FF          call ResHacke.004056FC
004ABA45       33C0                xor eax,eax
004ABA47       55                   push ebp
004ABA48       68 40BB4A00          push ResHacke.004ABB40
004ABA4D       64:FF30             push dword ptr fs:[eax]
004ABA50       64:8920             mov dword ptr fs:[eax],esp
004ABA53       A1 60DC4A00          mov eax,dword ptr ds:[4ADC60]
004ABA58       8B00                mov eax,dword ptr ds:[eax]
004ABA5A       E8 856EF8FF          call ResHacke.004328E4
004ABA5F       A1 60DC4A00          mov eax,dword ptr ds:[4ADC60]
004ABA64       8B00                mov eax,dword ptr ds:[eax]
004ABA66       BA 54BB4A00          mov edx,ResHacke.004ABB54                               ; ASCII "Resource Hacker"
004ABA6B       E8 8C6BF8FF          call ResHacke.004325FC
004ABA70       A1 60DC4A00          mov eax,dword ptr ds:[4ADC60]
004ABA75       8B00                mov eax,dword ptr ds:[eax]
004ABA77       C640 3F 00          mov byte ptr ds:[eax+3F],0
004ABA7B       8B0D D8DA4A00       mov ecx,dword ptr ds:[4ADAD8]                         ; ResHacke.004AE81C
004ABA81       A1 60DC4A00          mov eax,dword ptr ds:[4ADC60]
004ABA86       8B00                mov eax,dword ptr ds:[eax]
004ABA88       8B15 DCE44900       mov edx,dword ptr ds:[49E4DC]                         ; ResHacke.0049E51C
004ABA8E       E8 696EF8FF          call ResHacke.004328FC
004ABA93       E8 786DF5FF          call ResHacke.00402810
004ABA98       48                   dec eax
004ABA99       7E 78                jle short ResHacke.004ABB13
004ABA9B       8D55 F0             lea edx,dword ptr ss:[ebp-10]
004ABA9E       B8 01000000          mov eax,1
004ABAA3       E8 C86DF5FF          call ResHacke.00402870
004ABAA8       8B45 F0             mov eax,dword ptr ss:[ebp-10]
004ABAAB       8038 2D             cmp byte ptr ds:[eax],2D
004ABAAE       75 63                jnz short ResHacke.004ABB13
004ABAB0       B2 01                mov dl,1
004ABAB2       A1 88AE4800          mov eax,dword ptr ds:[48AE88]
004ABAB7       E8 B872F5FF          call ResHacke.00402D74
004ABABC       A3 84E84A00          mov dword ptr ds:[4AE884],eax
004ABAC1       33C0                xor eax,eax
004ABAC3       55                   push ebp
004ABAC4       68 F9BA4A00          push ResHacke.004ABAF9
004ABAC9       64:FF30             push dword ptr fs:[eax]
004ABACC       64:8920             mov dword ptr fs:[eax],esp
004ABACF       8B15 D8DA4A00       mov edx,dword ptr ds:[4ADAD8]                         ; ResHacke.004AE81C
004ABAD5       8B12                mov edx,dword ptr ds:[edx]
004ABAD7       A1 84E84A00          mov eax,dword ptr ds:[4AE884]
004ABADC       E8 8BF5FDFF          call ResHacke.0048B06C
004ABAE1       33C0                xor eax,eax
004ABAE3       5A                   pop edx                                                 ; kernel32.7C816FD7
004ABAE4       59                   pop ecx                                                 ; kernel32.7C816FD7
004ABAE5       59                   pop ecx                                                 ; kernel32.7C816FD7
004ABAE6       64:8910             mov dword ptr fs:[eax],edx                            ; ntdll.KiFastSystemCallRet
004ABAE9       68 00BB4A00          push ResHacke.004ABB00
004ABAEE       A1 84E84A00          mov eax,dword ptr ds:[4AE884]
004ABAF3       E8 A472F5FF          call ResHacke.00402D9C
004ABAF8       C3                   retn
004ABAF9    ^ E9 6A78F5FF          jmp ResHacke.00403368
004ABAFE    ^ EB EE                jmp short ResHacke.004ABAEE
004ABB00       A1 D8DA4A00          mov eax,dword ptr ds:[4ADAD8]
004ABB05       8B00                mov eax,dword ptr ds:[eax]
004ABB07       E8 304DF8FF          call ResHacke.0043083C
004ABB0C       E8 837CF5FF          call ResHacke.00403794
004ABB11       EB 0B                jmp short ResHacke.004ABB1E
004ABB13       A1 60DC4A00          mov eax,dword ptr ds:[4ADC60]
004ABB18       8B00                mov eax,dword ptr ds:[eax]
004ABB1A       C640 3F 01          mov byte ptr ds:[eax+3F],1
004ABB1E       A1 60DC4A00          mov eax,dword ptr ds:[4ADC60]
004ABB23       8B00                mov eax,dword ptr ds:[eax]
004ABB25       E8 5E6EF8FF          call ResHacke.00432988
004ABB2A       33C0                xor eax,eax
004ABB2C       5A                   pop edx                                                 ; kernel32.7C816FD7
004ABB2D       59                   pop ecx                                                 ; kernel32.7C816FD7
004ABB2E       59                   pop ecx                                                 ; kernel32.7C816FD7
004ABB2F       64:8910             mov dword ptr fs:[eax],edx                            ; ntdll.KiFastSystemCallRet
004ABB32       68 47BB4A00          push ResHacke.004ABB47
004ABB37       8D45 F0             lea eax,dword ptr ss:[ebp-10]
004ABB3A       E8 097EF5FF          call ResHacke.00403948
004ABB3F       C3                   retn

55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 60 B8 4A 00 E8 B7 9C F5 FF 33 C0 55 68 40 BB 4A 00 64 FF 30
64 89 20 A1 60 DC 4A 00 8B 00 E8 85 6E F8 FF A1 60 DC 4A 00 8B 00 BA 54 BB 4A 00 E8 8C 6B F8 FF
A1 60 DC 4A 00 8B 00 C6 40 3F 00 8B 0D D8 DA 4A 00 A1 60 DC 4A 00 8B 00 8B 15 DC E4 49 00 E8 69
6E F8 FF E8 78 6D F5 FF 48 7E 78 8D 55 F0 B8 01 00 00 00 E8 C8 6D F5 FF 8B 45 F0 80 38 2D 75 63
B2 01 A1 88 AE 48 00 E8 B8 72 F5 FF A3 84 E8 4A 00 33 C0 55 68 F9 BA 4A 00 64 FF 30 64 89 20 8B
15 D8 DA 4A 00 8B 12 A1 84 E8 4A 00 E8 8B F5 FD FF 33 C0 5A 59 59 64 89 10 68 00 BB 4A 00 A1 84
E8 4A 00 E8 A4 72 F5 FF C3 E9 6A 78 F5 FF EB EE A1 D8 DA 4A 00 8B 00 E8 30 4D F8 FF E8 83 7C F5
FF EB 0B A1 60 DC 4A 00 8B 00 C6 40 3F 01 A1 60 DC 4A 00 8B 00 E8 5E 6E F8 FF 33 C0 5A 59 59 64
89 10 68 47 BB 4A 00 8D 45 F0 E8 09 7E F5 FF C3

Borland Delphi 4.0 - 5.0

CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc

00457E00 YUCE>  55                   push ebp
00457E01       8BEC                mov ebp,esp
00457E03       83C4 F4             add esp,-0C
00457E06       B8 C87C4500          mov eax,YUCE.00457CC8
00457E0B       E8 44E4FAFF          call YUCE.00406254
00457E10       A1 048F4500          mov eax,dword ptr ds:[458F04]
00457E15       8B00                mov eax,dword ptr ds:[eax]
00457E17       BA 547E4500          mov edx,YUCE.00457E54
00457E1C       E8 83DEFEFF          call YUCE.00445CA4
00457E21       8B0D 688D4500       mov ecx,dword ptr ds:[458D68]

                     ; YUCE.0045A878
00457E27       A1 048F4500          mov eax,dword ptr ds:[458F04]
00457E2C       8B00                mov eax,dword ptr ds:[eax]
00457E2E       8B15 C85B4500       mov edx,dword ptr ds:[455BC8]

                     ; YUCE.00455C14
00457E34       E8 2FE2FEFF          call YUCE.00446068
00457E39       A1 048F4500          mov eax,dword ptr ds:[458F04]
00457E3E       8B00                mov eax,dword ptr ds:[eax]
00457E40       E8 A3E2FEFF          call YUCE.004460E8
00457E45       E8 F6B8FAFF          call YUCE.00403740
00457E4A       0000                add byte ptr ds:[eax],al
00457E4C       FFFF                ???

                     ; Unknown command
00457E4E       FFFF                ???

                     ; Unknown command
00457E50       0C 00                or al,0
00457E52       0000                add byte ptr ds:[eax],al
00457E54       C9                   leave
00457E55       FA                   cli
00457E56       C3                   retn

55 8B EC 83 C4 F4 B8 C8 7C 45 00 E8 44 E4 FA FF A1 04 8F 45 00 8B 00

BA 54 7E 45 00 E8 83 DE FE
FF 8B 0D 68 8D 45 00 A1 04 8F 45 00 8B 00 8B 15 C8 5B 45 00 E8 2F E2

FE FF A1 04 8F 45 00 8B 00
E8 A3 E2 FE FF E8 F6 B8 FA FF 00 00 FF FF FF FF 0C 00 00 00 C9 FA C3

Borland Delphi 6.0 - 7.0

CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc

0047845C pymf>  55                   push ebp
0047845D       8BEC                mov ebp,esp
0047845F       83C4 E8             add esp,-18
00478462       33C0                xor eax,eax
00478464       8945 EC             mov dword ptr ss:[ebp-14],eax
00478467       8945 E8             mov dword ptr ss:[ebp-18],eax
0047846A       B8 6C824700          mov eax,pymf.0047826C
0047846F       E8 94E3F8FF          call pymf.00406808
00478474       33C0                xor eax,eax
00478476       55                   push ebp
00478477       68 21854700          push pymf.00478521
0047847C       64:FF30             push dword ptr fs:[eax]
0047847F       64:8920             mov dword ptr fs:[eax],esp
00478482       E8 0DD5FFFF          call pymf.00475994
00478487       84C0                test al,al
00478489       75 18                jnz short pymf.004784A3
0047848B       6A 24                push 24
0047848D       68 30854700          push pymf.00478530                                     ; ASCII "Error"
00478492       68 38854700          push pymf.00478538                                     ; ASCII "YMF7x4 driver is not found. Start the program anyway?"
00478497       6A 00                push 0
00478499       E8 C2ECF8FF          call <jmp.&user32.MessageBoxA>
0047849E       83F8 06             cmp eax,6
004784A1       75 63                jnz short pymf.00478506
004784A3       8D55 E8             lea edx,dword ptr ss:[ebp-18]
004784A6       B8 01000000          mov eax,1
004784AB       E8 BCA5F8FF          call pymf.00402A6C
004784B0       8B45 E8             mov eax,dword ptr ss:[ebp-18]
004784B3       8D55 EC             lea edx,dword ptr ss:[ebp-14]
004784B6       E8 3900F9FF          call pymf.004084F4
004784BB       8B45 EC             mov eax,dword ptr ss:[ebp-14]
004784BE       BA 78854700          mov edx,pymf.00478578                                  ; ASCII "-clean"
004784C3       E8 5CC3F8FF          call pymf.00404824
004784C8       75 07                jnz short pymf.004784D1
004784CA       E8 B1C7FFFF          call pymf.00474C80
004784CF       EB 35                jmp short pymf.00478506
004784D1       A1 E8B24700          mov eax,dword ptr ds:[47B2E8]
004784D6       8B00                mov eax,dword ptr ds:[eax]
004784D8       E8 A75BFEFF          call pymf.0045E084
004784DD       8B0D 00B14700       mov ecx,dword ptr ds:[47B100]                         ; pymf.0047CDC0
004784E3       A1 E8B24700          mov eax,dword ptr ds:[47B2E8]
004784E8       8B00                mov eax,dword ptr ds:[eax]
004784EA       8B15 F85B4700       mov edx,dword ptr ds:[475BF8]                         ; pymf.00475C44
004784F0       E8 A75BFEFF          call pymf.0045E09C
004784F5       A1 E8B24700          mov eax,dword ptr ds:[47B2E8]
004784FA       8B00                mov eax,dword ptr ds:[eax]
004784FC       E8 1B5CFEFF          call pymf.0045E11C
00478501       E8 5ED6FFFF          call pymf.00475B64
00478506       33C0                xor eax,eax
00478508       5A                   pop edx                                                 ; kernel32.7C816FD7
00478509       59                   pop ecx                                                 ; kernel32.7C816FD7
0047850A       59                   pop ecx                                                 ; kernel32.7C816FD7
0047850B       64:8910             mov dword ptr fs:[eax],edx                            ; ntdll.KiFastSystemCallRet
0047850E       68 28854700          push pymf.00478528
00478513       8D45 E8             lea eax,dword ptr ss:[ebp-18]
00478516       BA 02000000          mov edx,2
0047851B       E8 2CBFF8FF          call pymf.0040444C
00478520       C3                   retn

55 8B EC 83 C4 E8 33 C0 89 45 EC 89 45 E8 B8 6C 82 47 00 E8 94 E3 F8 FF 33 C0 55 68 21 85 47 00
64 FF 30 64 89 20 E8 0D D5 FF FF 84 C0 75 18 6A 24 68 30 85 47 00 68 38 85 47 00 6A 00 E8 C2 EC
F8 FF 83 F8 06 75 63 8D 55 E8 B8 01 00 00 00 E8 BC A5 F8 FF 8B 45 E8 8D 55 EC E8 39 00 F9 FF 8B
45 EC BA 78 85 47 00 E8 5C C3 F8 FF 75 07 E8 B1 C7 FF FF EB 35 A1 E8 B2 47 00 8B 00 E8 A7 5B FE
FF 8B 0D 00 B1 47 00 A1 E8 B2 47 00 8B 00 8B 15 F8 5B 47 00 E8 A7 5B FE FF A1 E8 B2 47 00 8B 00
E8 1B 5C FE FF E8 5E D6 FF FF 33 C0 5A 59 59 64 89 10 68 28 85 47 00 8D 45 E8 BA 02 00 00 00 E8
2C BF F8 FF C3

MASM32 / TASM32

.text
.rdata
.data
.rsrc

00401000 RVA.>/$  6A 00             push 0                                                 ; /pModule = NULL
00401002    |.  E8 830A0000       call <jmp.&KERNEL32.GetModuleHandleA>                   ; \GetModuleHandleA
00401007    |.  A3 07304000       mov dword ptr ds:[403007],eax
0040100C    |.  6A 00             push 0                                                 ; /lParam = NULL
0040100E    |.  68 6C104000       push RVA.0040106C                                     ; |DlgProc = RVA.0040106C
00401013    |.  6A 00             push 0                                                 ; |hOwner = NULL
00401015    |.  68 00304000       push RVA.00403000                                     ; |pTemplate = "DIALOG"
0040101A    |.  FF35 07304000    push dword ptr ds:[403007]                            ; |hInst = NULL
00401020    |.  E8 F9090000       call <jmp.&USER32.DialogBoxParamA>                      ; \DialogBoxParamA
00401025    |.  50                push eax                                              ; /ExitCode = 0
00401026    \.  E8 4D0A0000       call <jmp.&KERNEL32.ExitProcess>                      ; \ExitProcess
0040102B    /.  55                push ebp
0040102C    |.  8BEC             mov ebp,esp
0040102E    |.  837D 0C 10       cmp dword ptr ss:[ebp+C],10
00401032    |.  75 0C             jnz short RVA.00401040
00401034    |.  6A 00             push 0                                                 ; /Result = 0
00401036    |.  FF75 08          push dword ptr ss:[ebp+8]                               ; |hWnd = 00401000
00401039    |.  E8 EC090000       call <jmp.&USER32.EndDialog>                            ; \EndDialog
0040103E    |.  EB 26             jmp short RVA.00401066
00401040    |>  817D 0C 11010000 cmp dword ptr ss:[ebp+C],111
00401047    |.  75 1D             jnz short RVA.00401066
00401049    |.  8B45 10          mov eax,dword ptr ss:[ebp+10]
0040104C    |.  66:3D B80B       cmp ax,0BB8
00401050    |.  75 14             jnz short RVA.00401066
00401052    |.  C1E8 10          shr eax,10
00401055    |.  66:0BC0          or ax,ax
00401058    |.  75 0A             jnz short RVA.00401064
0040105A    |.  6A 00             push 0                                                 ; /Result = 0
0040105C    |.  FF75 08          push dword ptr ss:[ebp+8]                               ; |hWnd = 00401000
0040105F    |.  E8 C6090000       call <jmp.&USER32.EndDialog>                            ; \EndDialog
00401064    |>  EB 00             jmp short RVA.00401066
00401066    |>  33C0             xor eax,eax
00401068    |.  C9                leave
00401069    \.  C2 1000          retn 10

6A 00 E8 83 0A 00 00 A3 07 30 40 00 6A 00 68 6C 10 40 00 6A 00 68 00 30 40 00 FF 35 07 30 40 00
E8 F9 09 00 00 50 E8 4D 0A 00 00 55 8B EC 83 7D 0C 10 75 0C 6A 00 FF 75 08 E8 EC 09 00 00 EB 26
81 7D 0C 11 01 00 00 75 1D 8B 45 10 66 3D B8 0B 75 14 C1 E8 10 66 0B C0 75 0A 6A 00 FF 75 08 E8
C6 09 00 00 EB 00 33 C0 C9 C2 10 00

Microsoft Visual Basic 5.0 / 6.0

.text
.data
.rsrc

00402360 Kill>/$  68 2C4D4000       push KillBox.00404D2C                                  ;  ASCII "VB5!6&*"
00402365    |.  E8 EEFFFFFF       call <jmp.&MSVBVM60.#100>
0040236A    |.  0000             add byte ptr ds:[eax],al
0040236C    |.  0000             add byte ptr ds:[eax],al
0040236E    |.  0000             add byte ptr ds:[eax],al
00402370    |.  3000             xor byte ptr ds:[eax],al
00402372    |.  0000             add byte ptr ds:[eax],al
00402374    |.  3800             cmp byte ptr ds:[eax],al
00402376    |.  0000             add byte ptr ds:[eax],al
00402378    |.  0000             add byte ptr ds:[eax],al
0040237A    |.  0000             add byte ptr ds:[eax],al
0040237C    |.  4F                dec edi                                                 ;  ntdll.7C930738
0040237D    \.  C2 F150          retn 50F1

68 2C 4D 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 4F C2 F1 50

Microsoft Visual C++ 4.x

.text
.rdata
.data
.idata
.reloc

00401CC0 memt> $  64:A1 00000000    mov eax,dword ptr fs:[0]
00401CC6    .  55                push ebp
00401CC7    .  8BEC             mov ebp,esp
00401CC9    .  6A FF             push -1
00401CCB    .  68 28804000       push memtest.00408028
00401CD0    .  68 001B4000       push memtest.00401B00
00401CD5    .  50                push eax
00401CD6    .  64:8925 00000000 mov dword ptr fs:[0],esp
00401CDD    .  83EC 60          sub esp,60
00401CE0    .  53                push ebx
00401CE1    .  56                push esi
00401CE2    .  57                push edi                                              ;  ntdll.7C930738
00401CE3    .  8965 E8          mov dword ptr ss:[ebp-18],esp
00401CE6    .  FF15 30D14000    call near dword ptr ds:[<&KERNEL32.GetVersion>]       ;  kernel32.GetVersion
00401CEC    .  A3 B89A4000       mov dword ptr ds:[409AB8],eax
00401CF1    .  33C0             xor eax,eax
00401CF3    .  A0 B99A4000       mov al,byte ptr ds:[409AB9]
00401CF8    .  A3 C49A4000       mov dword ptr ds:[409AC4],eax
00401CFD    .  A1 B89A4000       mov eax,dword ptr ds:[409AB8]
00401D02    .  C12D B89A4000 10 shr dword ptr ds:[409AB8],10
00401D09    .  25 FF000000       and eax,0FF
00401D0E    .  A3 C09A4000       mov dword ptr ds:[409AC0],eax
00401D13    .  C1E0 08          shl eax,8
00401D16    .  0305 C49A4000    add eax,dword ptr ds:[409AC4]
00401D1C    .  A3 BC9A4000       mov dword ptr ds:[409ABC],eax
00401D21    .  E8 6A010000       call memtest.00401E90
00401D26    .  85C0             test eax,eax
00401D28    .  75 0A             jnz short memtest.00401D34
00401D2A    .  6A 1C             push 1C
00401D2C    .  E8 2F010000       call memtest.00401E60
00401D31    .  83C4 04          add esp,4
00401D34    >  C745 FC 00000000 mov dword ptr ss:[ebp-4],0
00401D3B    .  E8 00260000       call memtest.00404340
00401D40    .  E8 EB250000       call memtest.00404330
00401D45    .  FF15 2CD14000    call near dword ptr ds:[<&KERNEL32.GetCommandLineA>]    ; [GetCommandLineA
00401D4B    .  A3 80CD4000       mov dword ptr ds:[40CD80],eax
00401D50    .  E8 8B210000       call memtest.00403EE0
00401D55    .  A3 3C924000       mov dword ptr ds:[40923C],eax
00401D5A    .  85C0             test eax,eax
00401D5C    .  74 09             je short memtest.00401D67
00401D5E    .  833D 80CD4000 00 cmp dword ptr ds:[40CD80],0
00401D65    .  75 0A             jnz short memtest.00401D71
00401D67    >  6A FF             push -1
00401D69    .  E8 021B0000       call memtest.00403870
00401D6E    .  83C4 04          add esp,4
00401D71    >  E8 EA1E0000       call memtest.00403C60
00401D76    .  E8 F51D0000       call memtest.00403B70
00401D7B    .  E8 C01A0000       call memtest.00403840
00401D80    .  8B35 80CD4000    mov esi,dword ptr ds:[40CD80]
00401D86    .  8A06             mov al,byte ptr ds:[esi]
00401D88    .  3C 22             cmp al,22
00401D8A    .  74 0C             je short memtest.00401D98
00401D8C    .  3C 20             cmp al,20
00401D8E    .  76 35             jbe short memtest.00401DC5
00401D90    >  46                inc esi
00401D91    .  803E 20          cmp byte ptr ds:[esi],20
00401D94    .^ 77 FA             ja short memtest.00401D90
00401D96    .  EB 2D             jmp short memtest.00401DC5
00401D98    >  46                inc esi
00401D99    .  803E 22          cmp byte ptr ds:[esi],22
00401D9C    .  74 26             je short memtest.00401DC4
00401D9E    .  8A5D D8          mov bl,byte ptr ss:[ebp-28]
00401DA1    >  8A1E             mov bl,byte ptr ds:[esi]
00401DA3    .  84DB             test bl,bl
00401DA5    .  74 18             je short memtest.00401DBF
00401DA7    .  33C0             xor eax,eax
00401DA9    .  8AC3             mov al,bl
00401DAB    .  50                push eax
00401DAC    .  E8 5F1D0000       call memtest.00403B10
00401DB1    .  83C4 04          add esp,4
00401DB4    .  85C0             test eax,eax
00401DB6    .  74 01             je short memtest.00401DB9
00401DB8    .  46                inc esi
00401DB9    >  46                inc esi
00401DBA    .  803E 22          cmp byte ptr ds:[esi],22
00401DBD    .^ 75 E2             jnz short memtest.00401DA1
00401DBF    >  803E 22          cmp byte ptr ds:[esi],22
00401DC2    .  75 01             jnz short memtest.00401DC5
00401DC4    >  46                inc esi
00401DC5    >  803E 00          cmp byte ptr ds:[esi],0
00401DC8    .  74 0B             je short memtest.00401DD5
00401DCA    >  803E 20          cmp byte ptr ds:[esi],20
00401DCD    .  77 06             ja short memtest.00401DD5
00401DCF    .  46                inc esi
00401DD0    .  803E 00          cmp byte ptr ds:[esi],0
00401DD3    .^ 75 F5             jnz short memtest.00401DCA
00401DD5    >  C745 BC 00000000 mov dword ptr ss:[ebp-44],0
00401DDC    .  8D45 90          lea eax,dword ptr ss:[ebp-70]
00401DDF    .  50                push eax                                              ; /pStartupinfo = NULL
00401DE0    .  FF15 28D14000    call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>]    ; \GetStartupInfoA
00401DE6    .  F645 BC 01       test byte ptr ss:[ebp-44],1
00401DEA    .  B8 0A000000       mov eax,0A
00401DEF    .  74 08             je short memtest.00401DF9
00401DF1    .  8B45 C0          mov eax,dword ptr ss:[ebp-40]                         ;  ntdll.7C92E64E
00401DF4    .  25 FFFF0000       and eax,0FFFF
00401DF9    >  50                push eax                                              ; /Arg4 = 00000000
00401DFA    .  56                push esi                                              ; |Arg3 = FFFFFFFF
00401DFB    .  6A 00             push 0                                                 ; |Arg2 = 00000000
00401DFD    .  6A 00             push 0                                                 ; |/pModule = NULL
00401DFF    .  FF15 24D14000    call near dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; |\GetModuleHandleA
00401E05    .  50                push eax                                              ; |Arg1 = 00000000
00401E06    .  E8 F5F1FFFF       call memtest.00401000                                  ; \memtest.00401000
00401E0B    .  50                push eax
00401E0C    .  E8 5F1A0000       call memtest.00403870
00401E11    .  EB 27             jmp short memtest.00401E3A
00401E13    .  8B45 EC          mov eax,dword ptr ss:[ebp-14]
00401E16    .  8B00             mov eax,dword ptr ds:[eax]
00401E18    .  8B00             mov eax,dword ptr ds:[eax]
00401E1A    .  8945 E0          mov dword ptr ss:[ebp-20],eax
00401E1D    .  8B45 EC          mov eax,dword ptr ss:[ebp-14]
00401E20    .  50                push eax
00401E21    .  8B45 E0          mov eax,dword ptr ss:[ebp-20]
00401E24    .  50                push eax
00401E25    .  E8 561B0000       call memtest.00403980
00401E2A    .  83C4 08          add esp,8
00401E2D    .  C3                retn

64 A1 00 00 00 00 55 8B EC 6A FF 68 28 80 40 00 68 00 1B 40 00 50 64 89 25 00 00 00 00 83 EC 60
53 56 57 89 65 E8 FF 15 30 D1 40 00 A3 B8 9A 40 00 33 C0 A0 B9 9A 40 00 A3 C4 9A 40 00 A1 B8 9A
40 00 C1 2D B8 9A 40 00 10 25 FF 00 00 00 A3 C0 9A 40 00 C1 E0 08 03 05 C4 9A 40 00 A3 BC 9A 40
00 E8 6A 01 00 00 85 C0 75 0A 6A 1C E8 2F 01 00 00 83 C4 04 C7 45 FC 00 00 00 00 E8 00 26 00 00
E8 EB 25 00 00 FF 15 2C D1 40 00 A3 80 CD 40 00 E8 8B 21 00 00 A3 3C 92 40 00 85 C0 74 09 83 3D
80 CD 40 00 00 75 0A 6A FF E8 02 1B 00 00 83 C4 04 E8 EA 1E 00 00 E8 F5 1D 00 00 E8 C0 1A 00 00
8B 35 80 CD 40 00 8A 06 3C 22 74 0C 3C 20 76 35 46 80 3E 20 77 FA EB 2D 46 80 3E 22 74 26 8A 5D
D8 8A 1E 84 DB 74 18 33 C0 8A C3 50 E8 5F 1D 00 00 83 C4 04 85 C0 74 01 46 46 80 3E 22 75 E2 80
3E 22 75 01 46 80 3E 00 74 0B 80 3E 20 77 06 46 80 3E 00 75 F5 C7 45 BC 00 00 00 00 8D 45 90 50
FF 15 28 D1 40 00 F6 45 BC 01 B8 0A 00 00 00 74 08 8B 45 C0 25 FF FF 00 00 50 56 6A 00 6A 00 FF
15 24 D1 40 00 50 E8 F5 F1 FF FF 50 E8 5F 1A 00 00 EB 27 8B 45 EC 8B 00 8B 00 89 45 E0 8B 45 EC
50 8B 45 E0 50 E8 56 1B 00 00 83 C4 08 C3

Microsoft Visual C++ 5.0

.text
.rdata
.data
.rsrc

0040B060 HEdi> $  55                push ebp
0040B061    .  8BEC             mov ebp,esp
0040B063    .  6A FF             push -1
0040B065    .  68 C8264400       push HEdit.004426C8
0040B06A    .  68 38E24000       push HEdit.0040E238

                     ;  SE handler installation
0040B06F    .  64:A1 00000000    mov eax,dword ptr fs:[0]
0040B075    .  50                push eax
0040B076    .  64:8925 00000000 mov dword ptr fs:[0],esp
0040B07D    .  83C4 A8          add esp,-58
0040B080    .  53                push ebx
0040B081    .  56                push esi
0040B082    .  57                push edi

                     ;  ntdll.7C930738
0040B083    .  8965 E8          mov dword ptr ss:[ebp-18],esp
0040B086    .  FF15 F0C14300    call near dword ptr ds:

[<&KERNEL32.GetVersion>]       ;  kernel32.GetVersion
0040B08C    .  33D2             xor edx,edx

                     ;  ntdll.KiFastSystemCallRet
0040B08E    .  8AD4             mov dl,ah
0040B090    .  8915 A0174500    mov dword ptr ds:[4517A0],edx

                     ;  ntdll.KiFastSystemCallRet
0040B096    .  8BC8             mov ecx,eax
0040B098    .  81E1 FF000000    and ecx,0FF
0040B09E    .  890D 9C174500    mov dword ptr ds:[45179C],ecx
0040B0A4    .  C1E1 08          shl ecx,8
0040B0A7    .  03CA             add ecx,edx

                     ;  ntdll.KiFastSystemCallRet
0040B0A9    .  890D 98174500    mov dword ptr ds:[451798],ecx
0040B0AF    .  C1E8 10          shr eax,10
0040B0B2    .  A3 94174500       mov dword ptr ds:[451794],eax
0040B0B7    .  E8 F45C0000       call HEdit.00410DB0
0040B0BC    .  85C0             test eax,eax
0040B0BE    .  75 0A             jnz short HEdit.0040B0CA
0040B0C0    .  6A 1C             push 1C
0040B0C2    .  E8 79010000       call HEdit.0040B240
0040B0C7    .  83C4 04          add esp,4
0040B0CA    >  E8 11290000       call HEdit.0040D9E0
0040B0CF    .  85C0             test eax,eax
0040B0D1    .  75 0A             jnz short HEdit.0040B0DD
0040B0D3    .  6A 10             push 10
0040B0D5    .  E8 66010000       call HEdit.0040B240
0040B0DA    .  83C4 04          add esp,4
0040B0DD    >  C745 FC 00000000 mov dword ptr ss:[ebp-4],0
0040B0E4    .  E8 B75A0000       call HEdit.00410BA0
0040B0E9    .  E8 821B0000       call HEdit.0040CC70
0040B0EE    .  FF15 70C24300    call near dword ptr ds:

[<&KERNEL32.GetCommandLineA>]    ; [GetCommandLineA
0040B0F4    .  A3 D02E4500       mov dword ptr ds:[452ED0],eax
0040B0F9    .  E8 42590000       call HEdit.00410A40
0040B0FE    .  A3 DC174500       mov dword ptr ds:[4517DC],eax
0040B103    .  85C0             test eax,eax
0040B105    .  74 09             je short HEdit.0040B110
0040B107    .  A1 D02E4500       mov eax,dword ptr ds:[452ED0]
0040B10C    .  85C0             test eax,eax
0040B10E    .  75 0A             jnz short HEdit.0040B11A
0040B110    >  6A FF             push -1
0040B112    .  E8 C9F7FFFF       call HEdit.0040A8E0
0040B117    .  83C4 04          add esp,4
0040B11A    >  E8 71560000       call HEdit.00410790
0040B11F    .  E8 7C550000       call HEdit.004106A0
0040B124    .  E8 87F7FFFF       call HEdit.0040A8B0
0040B129    .  8B35 D02E4500    mov esi,dword ptr ds:[452ED0]
0040B12F    .  8975 9C          mov dword ptr ss:[ebp-64],esi
0040B132    .  803E 22          cmp byte ptr ds:[esi],22
0040B135    .  0F85 BE000000    jnz HEdit.0040B1F9
0040B13B    >  46                inc esi
0040B13C    .  8975 9C          mov dword ptr ss:[ebp-64],esi
0040B13F    .  8A06             mov al,byte ptr ds:[esi]
0040B141    .  3C 22             cmp al,22
0040B143    .  74 1C             je short HEdit.0040B161
0040B145    .  84C0             test al,al
0040B147    .  74 18             je short HEdit.0040B161
0040B149    .  25 FF000000       and eax,0FF
0040B14E    .  50                push eax
0040B14F    .  E8 EC540000       call HEdit.00410640
0040B154    .  83C4 04          add esp,4
0040B157    .  85C0             test eax,eax
0040B159    .^ 74 E0             je short HEdit.0040B13B
0040B15B    .  46                inc esi
0040B15C    .  8975 9C          mov dword ptr ss:[ebp-64],esi
0040B15F    .^ EB DA             jmp short HEdit.0040B13B
0040B161    >  803E 22          cmp byte ptr ds:[esi],22
0040B164    .  75 04             jnz short HEdit.0040B16A
0040B166    .  46                inc esi
0040B167    .  8975 9C          mov dword ptr ss:[ebp-64],esi
0040B16A    >  8A06             mov al,byte ptr ds:[esi]
0040B16C    .  84C0             test al,al
0040B16E    .  74 0A             je short HEdit.0040B17A
0040B170    .  3C 20             cmp al,20
0040B172    .  77 06             ja short HEdit.0040B17A
0040B174    .  46                inc esi
0040B175    .  8975 9C          mov dword ptr ss:[ebp-64],esi
0040B178    .^ EB F0             jmp short HEdit.0040B16A
0040B17A    >  C745 D0 00000000 mov dword ptr ss:[ebp-30],0
0040B181    .  8D45 A4          lea eax,dword ptr ss:[ebp-5C]
0040B184    .  50                push eax

                     ; /pStartupinfo = NULL
0040B185    .  FF15 68C24300    call near dword ptr ds:

[<&KERNEL32.GetStartupInfoA>]    ; \GetStartupInfoA
0040B18B    .  F645 D0 01       test byte ptr ss:[ebp-30],1
0040B18F    .  74 0A             je short HEdit.0040B19B
0040B191    .  8B45 D4          mov eax,dword ptr ss:[ebp-2C]

                     ;  kernel32.7C816FD7
0040B194    .  25 FFFF0000       and eax,0FFFF
0040B199    .  EB 05             jmp short HEdit.0040B1A0
0040B19B    >  B8 0A000000       mov eax,0A
0040B1A0    >  50                push eax
0040B1A1    .  56                push esi
0040B1A2    .  6A 00             push 0
0040B1A4    .  6A 00             push 0

                     ; /pModule = NULL
0040B1A6    .  FF15 78C24300    call near dword ptr ds:

[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA
0040B1AC    .  50                push eax
0040B1AD    .  E8 B5FC0000       call HEdit.0041AE67
0040B1B2    .  8945 A0          mov dword ptr ss:[ebp-60],eax
0040B1B5    .  50                push eax
0040B1B6    .  E8 25F7FFFF       call HEdit.0040A8E0
0040B1BB    .  EB 21             jmp short HEdit.0040B1DE
0040B1BD    .  8B45 EC          mov eax,dword ptr ss:[ebp-14]
0040B1C0    .  8B08             mov ecx,dword ptr ds:[eax]
0040B1C2    .  8B09             mov ecx,dword ptr ds:[ecx]

                     ;  ntdll.7C92E64E
0040B1C4    .  894D 98          mov dword ptr ss:[ebp-68],ecx
0040B1C7    .  50                push eax
0040B1C8    .  51                push ecx
0040B1C9    .  E8 22520000       call HEdit.004103F0
0040B1CE    .  83C4 08          add esp,8
0040B1D1    .  C3                retn

55 8B EC 6A FF 68 C8 26 44 00 68 38 E2 40 00 64 A1 00 00 00 00 50 64

89 25 00 00 00 00 83 C4 A8
53 56 57 89 65 E8 FF 15 F0 C1 43 00 33 D2 8A D4 89 15 A0 17 45 00 8B

C8 81 E1 FF 00 00 00 89 0D
9C 17 45 00 C1 E1 08 03 CA 89 0D 98 17 45 00 C1 E8 10 A3 94 17 45 00

E8 F4 5C 00 00 85 C0 75 0A
6A 1C E8 79 01 00 00 83 C4 04 E8 11 29 00 00 85 C0 75 0A 6A 10 E8 66

01 00 00 83 C4 04 C7 45 FC
00 00 00 00 E8 B7 5A 00 00 E8 82 1B 00 00 FF 15 70 C2 43 00 A3 D0 2E

45 00 E8 42 59 00 00 A3 DC
17 45 00 85 C0 74 09 A1 D0 2E 45 00 85 C0 75 0A 6A FF E8 C9 F7 FF FF

83 C4 04 E8 71 56 00 00 E8
7C 55 00 00 E8 87 F7 FF FF 8B 35 D0 2E 45 00 89 75 9C 80 3E 22 0F 85

BE 00 00 00 46 89 75 9C 8A
06 3C 22 74 1C 84 C0 74 18 25 FF 00 00 00 50 E8 EC 54 00 00 83 C4 04

85 C0 74 E0 46 89 75 9C EB
DA 80 3E 22 75 04 46 89 75 9C 8A 06 84 C0 74 0A 3C 20 77 06 46 89 75

9C EB F0 C7 45 D0 00 00 00
00 8D 45 A4 50 FF 15 68 C2 43 00 F6 45 D0 01 74 0A 8B 45 D4 25 FF FF

00 00 EB 05 B8 0A 00 00 00
50 56 6A 00 6A 00 FF 15 78 C2 43 00 50 E8 B5 FC 00 00 89 45 A0 50 E8

25 F7 FF FF EB 21 8B 45 EC
8B 08 8B 09 89 4D 98 50 51 E8 22 52 00 00 83 C4 08 C3

Microsoft Visual C++ 6.0

.text
.rdata
.data
.tls
.rsrc

004AD06E ACDS>/$  55                push ebp
004AD06F    |.  8BEC             mov ebp,esp
004AD071    |.  6A FF             push -1
004AD073    |.  68 28014E00       push ACDSee.004E0128
004AD078    |.  68 9C0C4B00       push ACDSee.004B0C9C                                  ;  SE handler installation
004AD07D    |.  64:A1 00000000    mov eax,dword ptr fs:[0]
004AD083    |.  50                push eax
004AD084    |.  64:8925 00000000 mov dword ptr fs:[0],esp
004AD08B    |.  83EC 58          sub esp,58
004AD08E    |.  53                push ebx
004AD08F    |.  56                push esi
004AD090    |.  57                push edi                                              ;  ntdll.7C930738
004AD091    |.  8965 E8          mov dword ptr ss:[ebp-18],esp
004AD094    |.  FF15 A8744D00    call near dword ptr ds:[<&KERNEL32.GetVersion>]       ;  kernel32.GetVersion
004AD09A    |.  33D2             xor edx,edx                                           ;  ntdll.KiFastSystemCallRet
004AD09C    |.  8AD4             mov dl,ah
004AD09E    |.  8915 F4584F00    mov dword ptr ds:[4F58F4],edx                         ;  ntdll.KiFastSystemCallRet
004AD0A4    |.  8BC8             mov ecx,eax
004AD0A6    |.  81E1 FF000000    and ecx,0FF
004AD0AC    |.  890D F0584F00    mov dword ptr ds:[4F58F0],ecx
004AD0B2    |.  C1E1 08          shl ecx,8
004AD0B5    |.  03CA             add ecx,edx                                           ;  ntdll.KiFastSystemCallRet
004AD0B7    |.  890D EC584F00    mov dword ptr ds:[4F58EC],ecx
004AD0BD    |.  C1E8 10          shr eax,10
004AD0C0    |.  A3 E8584F00       mov dword ptr ds:[4F58E8],eax
004AD0C5    |.  6A 01             push 1
004AD0C7    |.  E8 C12D0000       call ACDSee.004AFE8D
004AD0CC    |.  59                pop ecx                                                 ;  kernel32.7C816FD7
004AD0CD    |.  85C0             test eax,eax
004AD0CF    |.  75 08             jnz short ACDSee.004AD0D9
004AD0D1    |.  6A 1C             push 1C
004AD0D3    |.  E8 C3000000       call ACDSee.004AD19B
004AD0D8    |.  59                pop ecx                                                 ;  kernel32.7C816FD7
004AD0D9    |>  E8 4E230000       call ACDSee.004AF42C
004AD0DE    |.  85C0             test eax,eax
004AD0E0    |.  75 08             jnz short ACDSee.004AD0EA
004AD0E2    |.  6A 10             push 10
004AD0E4    |.  E8 B2000000       call ACDSee.004AD19B
004AD0E9    |.  59                pop ecx                                                 ;  kernel32.7C816FD7
004AD0EA    |>  33F6             xor esi,esi
004AD0EC    |.  8975 FC          mov dword ptr ss:[ebp-4],esi
004AD0EF    |.  E8 42510000       call ACDSee.004B2236
004AD0F4    |.  FF15 7C724D00    call near dword ptr ds:[<&KERNEL32.GetCommandLineA>]    ; [GetCommandLineA
004AD0FA    |.  A3 58704F00       mov dword ptr ds:[4F7058],eax
004AD0FF    |.  E8 00500000       call ACDSee.004B2104
004AD104    |.  A3 D8584F00       mov dword ptr ds:[4F58D8],eax
004AD109    |.  E8 A94D0000       call ACDSee.004B1EB7
004AD10E    |.  E8 EB4C0000       call ACDSee.004B1DFE
004AD113    |.  E8 EF080000       call ACDSee.004ADA07
004AD118    |.  8975 D0          mov dword ptr ss:[ebp-30],esi
004AD11B    |.  8D45 A4          lea eax,dword ptr ss:[ebp-5C]
004AD11E    |.  50                push eax                                              ; /pStartupinfo = NULL
004AD11F    |.  FF15 74724D00    call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>]    ; \GetStartupInfoA
004AD125    |.  E8 7C4C0000       call ACDSee.004B1DA6
004AD12A    |.  8945 9C          mov dword ptr ss:[ebp-64],eax
004AD12D    |.  F645 D0 01       test byte ptr ss:[ebp-30],1
004AD131    |.  74 06             je short ACDSee.004AD139
004AD133    |.  0FB745 D4          movzx eax,word ptr ss:[ebp-2C]
004AD137    |.  EB 03             jmp short ACDSee.004AD13C
004AD139    |>  6A 0A             push 0A
004AD13B    |.  58                pop eax                                                 ;  kernel32.7C816FD7
004AD13C    |>  50                push eax
004AD13D    |.  FF75 9C          push dword ptr ss:[ebp-64]
004AD140    |.  56                push esi
004AD141    |.  56                push esi                                              ; /pModule = FFFFFFFF ???
004AD142    |.  FF15 90744D00    call near dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA
004AD148    |.  50                push eax
004AD149    |.  E8 F9E50000       call ACDSee.004BB747
004AD14E    |.  8945 A0          mov dword ptr ss:[ebp-60],eax
004AD151    |.  50                push eax
004AD152    |.  E8 DD080000       call ACDSee.004ADA34
004AD157    |.  8B45 EC          mov eax,dword ptr ss:[ebp-14]
004AD15A    |.  8B08             mov ecx,dword ptr ds:[eax]
004AD15C    |.  8B09             mov ecx,dword ptr ds:[ecx]                            ;  ntdll.7C92E64E
004AD15E    |.  894D 98          mov dword ptr ss:[ebp-68],ecx
004AD161    |.  50                push eax
004AD162    |.  51                push ecx
004AD163    |.  E8 B3390000       call ACDSee.004B0B1B
004AD168    |.  59                pop ecx                                                 ;  kernel32.7C816FD7
004AD169    |.  59                pop ecx                                                 ;  kernel32.7C816FD7
004AD16A    \.  C3                retn

55 8B EC 6A FF 68 28 01 4E 00 68 9C 0C 4B 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
53 56 57 89 65 E8 FF 15 A8 74 4D 00 33 D2 8A D4 89 15 F4 58 4F 00 8B C8 81 E1 FF 00 00 00 89 0D
F0 58 4F 00 C1 E1 08 03 CA 89 0D EC 58 4F 00 C1 E8 10 A3 E8 58 4F 00 6A 01 E8 C1 2D 00 00 59 85
C0 75 08 6A 1C E8 C3 00 00 00 59 E8 4E 23 00 00 85 C0 75 08 6A 10 E8 B2 00 00 00 59 33 F6 89 75
FC E8 42 51 00 00 FF 15 7C 72 4D 00 A3 58 70 4F 00 E8 00 50 00 00 A3 D8 58 4F 00 E8 A9 4D 00 00
E8 EB 4C 00 00 E8 EF 08 00 00 89 75 D0 8D 45 A4 50 FF 15 74 72 4D 00 E8 7C 4C 00 00 89 45 9C F6
45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 90 74 4D 00 50 E8 F9 E5 00 00
89 45 A0 50 E8 DD 08 00 00 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 B3 39 00 00 59 59 C3

Microsoft Visual C++ 6.0 [Debug]

.text
.rdata
.data
.rsrc

005522F3 Baby>/$  55                push ebp
005522F4    |.  8BEC             mov ebp,esp
005522F6    |.  6A FF             push -1
005522F8    |.  68 58235800       push Babylon.00582358
005522FD    |.  68 6C5B5500       push Babylon.00555B6C                                  ;  SE handler installation
00552302    |.  64:A1 00000000    mov eax,dword ptr fs:[0]
00552308    |.  50                push eax
00552309    |.  64:8925 00000000 mov dword ptr fs:[0],esp
00552310    |.  83EC 58          sub esp,58
00552313    |.  53                push ebx
00552314    |.  56                push esi
00552315    |.  57                push edi                                              ;  ntdll.7C930738
00552316    |.  8965 E8          mov dword ptr ss:[ebp-18],esp
00552319    |.  FF15 00635700    call near dword ptr ds:[<&KERNEL32.GetVersion>]       ;  kernel32.GetVersion
0055231F    |.  33D2             xor edx,edx                                           ;  ntdll.KiFastSystemCallRet
00552321    |.  8AD4             mov dl,ah
00552323    |.  8915 00BF5D00    mov dword ptr ds:[5DBF00],edx                         ;  ntdll.KiFastSystemCallRet
00552329    |.  8BC8             mov ecx,eax
0055232B    |.  81E1 FF000000    and ecx,0FF
00552331    |.  890D FCBE5D00    mov dword ptr ds:[5DBEFC],ecx
00552337    |.  C1E1 08          shl ecx,8
0055233A    |.  03CA             add ecx,edx                                           ;  ntdll.KiFastSystemCallRet
0055233C    |.  890D F8BE5D00    mov dword ptr ds:[5DBEF8],ecx
00552342    |.  C1E8 10          shr eax,10
00552345    |.  A3 F4BE5D00       mov dword ptr ds:[5DBEF4],eax
0055234A    |.  6A 01             push 1
0055234C    |.  E8 391D0000       call Babylon.0055408A
00552351    |.  59                pop ecx                                                 ;  kernel32.7C816FD7
00552352    |.  85C0             test eax,eax
00552354    |.  75 08             jnz short Babylon.0055235E
00552356    |.  6A 1C             push 1C
00552358    |.  E8 C3000000       call Babylon.00552420
0055235D    |.  59                pop ecx                                                 ;  kernel32.7C816FD7
0055235E    |>  E8 99350000       call Babylon.005558FC
00552363    |.  85C0             test eax,eax
00552365    |.  75 08             jnz short Babylon.0055236F
00552367    |.  6A 10             push 10
00552369    |.  E8 B2000000       call Babylon.00552420
0055236E    |.  59                pop ecx                                                 ;  kernel32.7C816FD7
0055236F    |>  33F6             xor esi,esi
00552371    |.  8975 FC          mov dword ptr ss:[ebp-4],esi
00552374    |.  E8 1B840000       call Babylon.0055A794
00552379    |.  FF15 0C625700    call near dword ptr ds:[<&KERNEL32.GetCommandLineA>]    ; [GetCommandLineA
0055237F    |.  A3 08D85D00       mov dword ptr ds:[5DD808],eax
00552384    |.  E8 1B8C0000       call Babylon.0055AFA4
00552389    |.  A3 7CBE5D00       mov dword ptr ds:[5DBE7C],eax
0055238E    |.  E8 C4890000       call Babylon.0055AD57
00552393    |.  E8 06890000       call Babylon.0055AC9E
00552398    |.  E8 A7380000       call Babylon.00555C44
0055239D    |.  8975 D0          mov dword ptr ss:[ebp-30],esi
005523A0    |.  8D45 A4          lea eax,dword ptr ss:[ebp-5C]
005523A3    |.  50                push eax                                              ; /pStartupinfo = NULL
005523A4    |.  FF15 18625700    call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>]    ; \GetStartupInfoA
005523AA    |.  E8 97880000       call Babylon.0055AC46
005523AF    |.  8945 9C          mov dword ptr ss:[ebp-64],eax
005523B2    |.  F645 D0 01       test byte ptr ss:[ebp-30],1
005523B6    |.  74 06             je short Babylon.005523BE
005523B8    |.  0FB745 D4          movzx eax,word ptr ss:[ebp-2C]
005523BC    |.  EB 03             jmp short Babylon.005523C1
005523BE    |>  6A 0A             push 0A
005523C0    |.  58                pop eax                                                 ;  kernel32.7C816FD7
005523C1    |>  50                push eax                                              ; /Arg4 = 00000000
005523C2    |.  FF75 9C          push dword ptr ss:[ebp-64]                            ; |Arg3 = 00000001
005523C5    |.  56                push esi                                              ; |Arg2 = FFFFFFFF
005523C6    |.  56                push esi                                              ; |/pModule = FFFFFFFF ???
005523C7    |.  FF15 68645700    call near dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; |\GetModuleHandleA
005523CD    |.  50                push eax                                              ; |Arg1 = 00000000
005523CE    |.  E8 2DC0EBFF       call Babylon.0040E400                                  ; \Babylon.0040E400
005523D3    |.  8945 A0          mov dword ptr ss:[ebp-60],eax
005523D6    |.  50                push eax
005523D7    |.  E8 95380000       call Babylon.00555C71
005523DC    |.  8B45 EC          mov eax,dword ptr ss:[ebp-14]
005523DF    |.  8B08             mov ecx,dword ptr ds:[eax]
005523E1    |.  8B09             mov ecx,dword ptr ds:[ecx]                            ;  ntdll.7C92E64E
005523E3    |.  894D 98          mov dword ptr ss:[ebp-68],ecx
005523E6    |.  50                push eax
005523E7    |.  51                push ecx
005523E8    |.  E8 68550000       call Babylon.00557955
005523ED    |.  59                pop ecx                                                 ;  kernel32.7C816FD7
005523EE    |.  59                pop ecx                                                 ;  kernel32.7C816FD7
005523EF    \.  C3                retn

55 8B EC 6A FF 68 58 23 58 00 68 6C 5B 55 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
53 56 57 89 65 E8 FF 15 00 63 57 00 33 D2 8A D4 89 15 00 BF 5D 00 8B C8 81 E1 FF 00 00 00 89 0D
FC BE 5D 00 C1 E1 08 03 CA 89 0D F8 BE 5D 00 C1 E8 10 A3 F4 BE 5D 00 6A 01 E8 39 1D 00 00 59 85
C0 75 08 6A 1C E8 C3 00 00 00 59 E8 99 35 00 00 85 C0 75 08 6A 10 E8 B2 00 00 00 59 33 F6 89 75
FC E8 1B 84 00 00 FF 15 0C 62 57 00 A3 08 D8 5D 00 E8 1B 8C 00 00 A3 7C BE 5D 00 E8 C4 89 00 00
E8 06 89 00 00 E8 A7 38 00 00 89 75 D0 8D 45 A4 50 FF 15 18 62 57 00 E8 97 88 00 00 89 45 9C F6
45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 68 64 57 00 50 E8 2D C0 EB FF
89 45 A0 50 E8 95 38 00 00 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 68 55 00 00 59 59 C3

Microsoft Visual C++ 7.0

.text
.rdata
.data
.rsrc

004A5D0A BitB> $  6A 60             push 60
004A5D0C    .  68 D07A4C00       push BitBuddy.004C7AD0
004A5D11    .  E8 7A060000       call BitBuddy.004A6390
004A5D16    .  BF 94000000       mov edi,94
004A5D1B    .  8BC7             mov eax,edi                                           ;  ntdll.7C930738
004A5D1D    .  E8 CEE6FFFF       call BitBuddy.004A43F0
004A5D22    .  8965 E8          mov dword ptr ss:[ebp-18],esp
004A5D25    .  8BF4             mov esi,esp
004A5D27    .  893E             mov dword ptr ds:[esi],edi                            ;  ntdll.7C930738
004A5D29    .  56                push esi                                              ; /pVersionInformation = FFFFFFFF
004A5D2A    .  FF15 8CF24B00    call near dword ptr ds:[<&KERNEL32.GetVersionExA>]    ; \GetVersionExA
004A5D30    .  8B4E 10          mov ecx,dword ptr ds:[esi+10]
004A5D33    .  890D 78614E00    mov dword ptr ds:[4E6178],ecx
004A5D39    .  8B46 04          mov eax,dword ptr ds:[esi+4]
004A5D3C    .  A3 84614E00       mov dword ptr ds:[4E6184],eax
004A5D41    .  8B56 08          mov edx,dword ptr ds:[esi+8]
004A5D44    .  8915 88614E00    mov dword ptr ds:[4E6188],edx                         ;  ntdll.KiFastSystemCallRet
004A5D4A    .  8B76 0C          mov esi,dword ptr ds:[esi+C]
004A5D4D    .  81E6 FF7F0000    and esi,7FFF
004A5D53    .  8935 7C614E00    mov dword ptr ds:[4E617C],esi
004A5D59    .  83F9 02          cmp ecx,2
004A5D5C    .  74 0C             je short BitBuddy.004A5D6A
004A5D5E    .  81CE 00800000    or esi,8000
004A5D64    .  8935 7C614E00    mov dword ptr ds:[4E617C],esi
004A5D6A    >  C1E0 08          shl eax,8
004A5D6D    .  03C2             add eax,edx                                           ;  ntdll.KiFastSystemCallRet
004A5D6F    .  A3 80614E00       mov dword ptr ds:[4E6180],eax
004A5D74    .  33F6             xor esi,esi
004A5D76    .  56                push esi                                              ; /pModule = FFFFFFFF ???
004A5D77    .  8B3D 08F24B00    mov edi,dword ptr ds:[<&KERNEL32.GetModuleHandleA>]    ; |kernel32.GetModuleHandleA
004A5D7D    .  FFD7             call near edi                                           ; \GetModuleHandleA
004A5D7F    .  66:8138 4D5A       cmp word ptr ds:[eax],5A4D
004A5D84    .  75 1F             jnz short BitBuddy.004A5DA5
004A5D86    .  8B48 3C          mov ecx,dword ptr ds:[eax+3C]
004A5D89    .  03C8             add ecx,eax
004A5D8B    .  8139 50450000    cmp dword ptr ds:[ecx],4550
004A5D91    .  75 12             jnz short BitBuddy.004A5DA5
004A5D93    .  0FB741 18          movzx eax,word ptr ds:[ecx+18]
004A5D97    .  3D 0B010000       cmp eax,10B
004A5D9C    .  74 1F             je short BitBuddy.004A5DBD
004A5D9E    .  3D 0B020000       cmp eax,20B
004A5DA3    .  74 05             je short BitBuddy.004A5DAA
004A5DA5    >  8975 E4          mov dword ptr ss:[ebp-1C],esi
004A5DA8    .  EB 27             jmp short BitBuddy.004A5DD1
004A5DAA    >  83B9 84000000 0E cmp dword ptr ds:[ecx+84],0E
004A5DB1    .^ 76 F2             jbe short BitBuddy.004A5DA5
004A5DB3    .  33C0             xor eax,eax
004A5DB5    .  39B1 F8000000    cmp dword ptr ds:[ecx+F8],esi
004A5DBB    .  EB 0E             jmp short BitBuddy.004A5DCB
004A5DBD    >  8379 74 0E       cmp dword ptr ds:[ecx+74],0E
004A5DC1    .^ 76 E2             jbe short BitBuddy.004A5DA5
004A5DC3    .  33C0             xor eax,eax
004A5DC5    .  39B1 E8000000    cmp dword ptr ds:[ecx+E8],esi
004A5DCB    >  0F95C0             setne al
004A5DCE    .  8945 E4          mov dword ptr ss:[ebp-1C],eax
004A5DD1    >  6A 01             push 1
004A5DD3    .  E8 6C340000       call BitBuddy.004A9244
004A5DD8    .  59                pop ecx                                                 ;  kernel32.7C816FD7
004A5DD9    .  85C0             test eax,eax
004A5DDB    .  75 08             jnz short BitBuddy.004A5DE5
004A5DDD    .  6A 1C             push 1C
004A5DDF    .  E8 02FFFFFF       call BitBuddy.004A5CE6
004A5DE4    .  59                pop ecx                                                 ;  kernel32.7C816FD7
004A5DE5    >  E8 EE300000       call BitBuddy.004A8ED8
004A5DEA    .  85C0             test eax,eax
004A5DEC    .  75 08             jnz short BitBuddy.004A5DF6
004A5DEE    .  6A 10             push 10
004A5DF0    .  E8 F1FEFFFF       call BitBuddy.004A5CE6
004A5DF5    .  59                pop ecx                                                 ;  kernel32.7C816FD7
004A5DF6    >  E8 EA6F0000       call BitBuddy.004ACDE5
004A5DFB    .  8975 FC          mov dword ptr ss:[ebp-4],esi
004A5DFE    .  E8 BC630000       call BitBuddy.004AC1BF
004A5E03    .  85C0             test eax,eax
004A5E05    .  7D 08             jge short BitBuddy.004A5E0F
004A5E07    .  6A 1B             push 1B
004A5E09    .  E8 B3FEFFFF       call BitBuddy.004A5CC1
004A5E0E    .  59                pop ecx                                                 ;  kernel32.7C816FD7
004A5E0F    >  FF15 54F14B00    call near dword ptr ds:[<&KERNEL32.GetCommandLineA>]    ; [GetCommandLineA
004A5E15    .  A3 F4784E00       mov dword ptr ds:[4E78F4],eax
004A5E1A    .  E8 A46E0000       call BitBuddy.004ACCC3
004A5E1F    .  A3 D85F4E00       mov dword ptr ds:[4E5FD8],eax
004A5E24    .  E8 F86D0000       call BitBuddy.004ACC21
004A5E29    .  85C0             test eax,eax
004A5E2B    .  7D 08             jge short BitBuddy.004A5E35
004A5E2D    .  6A 08             push 8
004A5E2F    .  E8 8DFEFFFF       call BitBuddy.004A5CC1
004A5E34    .  59                pop ecx                                                 ;  kernel32.7C816FD7
004A5E35    >  E8 B46B0000       call BitBuddy.004AC9EE
004A5E3A    .  85C0             test eax,eax
004A5E3C    .  7D 08             jge short BitBuddy.004A5E46
004A5E3E    .  6A 09             push 9
004A5E40    .  E8 7CFEFFFF       call BitBuddy.004A5CC1
004A5E45    .  59                pop ecx                                                 ;  kernel32.7C816FD7
004A5E46    >  6A 01             push 1
004A5E48    .  E8 42290000       call BitBuddy.004A878F
004A5E4D    .  59                pop ecx                                                 ;  kernel32.7C816FD7
004A5E4E    .  8945 D8          mov dword ptr ss:[ebp-28],eax
004A5E51    .  3BC6             cmp eax,esi
004A5E53    .  74 07             je short BitBuddy.004A5E5C
004A5E55    .  50                push eax
004A5E56    .  E8 66FEFFFF       call BitBuddy.004A5CC1
004A5E5B    .  59                pop ecx                                                 ;  kernel32.7C816FD7
004A5E5C    >  8975 BC          mov dword ptr ss:[ebp-44],esi
004A5E5F    .  8D45 90          lea eax,dword ptr ss:[ebp-70]
004A5E62    .  50                push eax                                              ; /pStartupinfo = NULL
004A5E63    .  FF15 58F14B00    call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>]    ; \GetStartupInfoA
004A5E69    .  E8 236B0000       call BitBuddy.004AC991
004A5E6E    .  8945 E0          mov dword ptr ss:[ebp-20],eax
004A5E71    .  F645 BC 01       test byte ptr ss:[ebp-44],1
004A5E75    .  74 06             je short BitBuddy.004A5E7D
004A5E77    .  0FB745 C0          movzx eax,word ptr ss:[ebp-40]
004A5E7B    .  EB 03             jmp short BitBuddy.004A5E80
004A5E7D    >  6A 0A             push 0A
004A5E7F    .  58                pop eax                                                 ;  kernel32.7C816FD7
004A5E80    >  50                push eax
004A5E81    .  FF75 E0          push dword ptr ss:[ebp-20]
004A5E84    .  56                push esi
004A5E85    .  56                push esi
004A5E86    .  FFD7             call near edi                                           ;  ntdll.7C930738
004A5E88    .  50                push eax                                              ; |Arg1 = 00000000
004A5E89    .  E8 620BF8FF       call BitBuddy.004269F0                                  ; \BitBuddy.004269F0
004A5E8E    .  8BF8             mov edi,eax
004A5E90    .  897D D4          mov dword ptr ss:[ebp-2C],edi                         ;  ntdll.7C930738
004A5E93    .  3975 E4          cmp dword ptr ss:[ebp-1C],esi
004A5E96    .  75 06             jnz short BitBuddy.004A5E9E
004A5E98    .  57                push edi                                              ;  ntdll.7C930738
004A5E99    .  E8 1E2A0000       call BitBuddy.004A88BC
004A5E9E    >  E8 3B2A0000       call BitBuddy.004A88DE
004A5EA3    .  EB 2B             jmp short BitBuddy.004A5ED0
004A5EA5    .  8B45 EC          mov eax,dword ptr ss:[ebp-14]
004A5EA8    .  8B08             mov ecx,dword ptr ds:[eax]
004A5EAA    .  8B09             mov ecx,dword ptr ds:[ecx]                            ;  ntdll.7C92E64E
004A5EAC    .  894D DC          mov dword ptr ss:[ebp-24],ecx
004A5EAF    .  50                push eax
004A5EB0    .  51                push ecx
004A5EB1    .  E8 77690000       call BitBuddy.004AC82D
004A5EB6    .  59                pop ecx                                                 ;  kernel32.7C816FD7
004A5EB7    .  59                pop ecx                                                 ;  kernel32.7C816FD7
004A5EB8    .  C3                retn

6A 60 68 D0 7A 4C 00 E8 7A 06 00 00 BF 94 00 00 00 8B C7 E8 CE E6 FF FF 89 65 E8 8B F4 89 3E 56
FF 15 8C F2 4B 00 8B 4E 10 89 0D 78 61 4E 00 8B 46 04 A3 84 61 4E 00 8B 56 08 89 15 88 61 4E 00
8B 76 0C 81 E6 FF 7F 00 00 89 35 7C 61 4E 00 83 F9 02 74 0C 81 CE 00 80 00 00 89 35 7C 61 4E 00
C1 E0 08 03 C2 A3 80 61 4E 00 33 F6 56 8B 3D 08 F2 4B 00 FF D7 66 81 38 4D 5A 75 1F 8B 48 3C 03
C8 81 39 50 45 00 00 75 12 0F B7 41 18 3D 0B 01 00 00 74 1F 3D 0B 02 00 00 74 05 89 75 E4 EB 27
83 B9 84 00 00 00 0E 76 F2 33 C0 39 B1 F8 00 00 00 EB 0E 83 79 74 0E 76 E2 33 C0 39 B1 E8 00 00
00 0F 95 C0 89 45 E4 6A 01 E8 6C 34 00 00 59 85 C0 75 08 6A 1C E8 02 FF FF FF 59 E8 EE 30 00 00
85 C0 75 08 6A 10 E8 F1 FE FF FF 59 E8 EA 6F 00 00 89 75 FC E8 BC 63 00 00 85 C0 7D 08 6A 1B E8
B3 FE FF FF 59 FF 15 54 F1 4B 00 A3 F4 78 4E 00 E8 A4 6E 00 00 A3 D8 5F 4E 00 E8 F8 6D 00 00 85
C0 7D 08 6A 08 E8 8D FE FF FF 59 E8 B4 6B 00 00 85 C0 7D 08 6A 09 E8 7C FE FF FF 59 6A 01 E8 42
29 00 00 59 89 45 D8 3B C6 74 07 50 E8 66 FE FF FF 59 89 75 BC 8D 45 90 50 FF 15 58 F1 4B 00 E8
23 6B 00 00 89 45 E0 F6 45 BC 01 74 06 0F B7 45 C0 EB 03 6A 0A 58 50 FF 75 E0 56 56 FF D7 50 E8
62 0B F8 FF 8B F8 89 7D D4 39 75 E4 75 06 57 E8 1E 2A 00 00 E8 3B 2A 00 00 EB 2B 8B 45 EC 8B 08
8B 09 89 4D DC 50 51 E8 77 69 00 00 59 59 C3

Microsoft Visual C++ 7.0 [Debug]

.text
.rdata
.data
.rsrc

004079A3 eMul> $  6A 60             push 60
004079A5    .  68 B0244200       push eMuleUpd.004224B0
004079AA    .  E8 F5E1FFFF       call eMuleUpd.00405BA4
004079AF    .  BF 94000000       mov edi,94
004079B4    .  8BC7             mov eax,edi                                           ;  ntdll.7C930738
004079B6    .  E8 65FCFFFF       call eMuleUpd.00407620
004079BB    .  8965 E8          mov dword ptr ss:[ebp-18],esp
004079BE    .  8BF4             mov esi,esp
004079C0    .  893E             mov dword ptr ds:[esi],edi                            ;  ntdll.7C930738
004079C2    .  56                push esi                                              ; /pVersionInformation = FFFFFFFF
004079C3    .  FF15 70024200    call near dword ptr ds:[<&KERNEL32.GetVersionExA>]    ; \GetVersionExA
004079C9    .  8B4E 10          mov ecx,dword ptr ds:[esi+10]
004079CC    .  890D 28BB4200    mov dword ptr ds:[42BB28],ecx
004079D2    .  8B46 04          mov eax,dword ptr ds:[esi+4]
004079D5    .  A3 34BB4200       mov dword ptr ds:[42BB34],eax
004079DA    .  8B56 08          mov edx,dword ptr ds:[esi+8]
004079DD    .  8915 38BB4200    mov dword ptr ds:[42BB38],edx                         ;  ntdll.KiFastSystemCallRet
004079E3    .  8B76 0C          mov esi,dword ptr ds:[esi+C]
004079E6    .  81E6 FF7F0000    and esi,7FFF
004079EC    .  8935 2CBB4200    mov dword ptr ds:[42BB2C],esi
004079F2    .  83F9 02          cmp ecx,2
004079F5    .  74 0C             je short eMuleUpd.00407A03
004079F7    .  81CE 00800000    or esi,8000
004079FD    .  8935 2CBB4200    mov dword ptr ds:[42BB2C],esi
00407A03    >  C1E0 08          shl eax,8
00407A06    .  03C2             add eax,edx                                           ;  ntdll.KiFastSystemCallRet
00407A08    .  A3 30BB4200       mov dword ptr ds:[42BB30],eax
00407A0D    .  33F6             xor esi,esi
00407A0F    .  56                push esi                                              ; /pModule = FFFFFFFF ???
00407A10    .  8B3D 88014200    mov edi,dword ptr ds:[<&KERNEL32.GetModuleHandleA>]    ; |kernel32.GetModuleHandleA
00407A16    .  FFD7             call near edi                                           ; \GetModuleHandleA
00407A18    .  66:8138 4D5A       cmp word ptr ds:[eax],5A4D
00407A1D    .  75 1F             jnz short eMuleUpd.00407A3E
00407A1F    .  8B48 3C          mov ecx,dword ptr ds:[eax+3C]
00407A22    .  03C8             add ecx,eax
00407A24    .  8139 50450000    cmp dword ptr ds:[ecx],4550
00407A2A    .  75 12             jnz short eMuleUpd.00407A3E
00407A2C    .  0FB741 18          movzx eax,word ptr ds:[ecx+18]
00407A30    .  3D 0B010000       cmp eax,10B
00407A35    .  74 1F             je short eMuleUpd.00407A56
00407A37    .  3D 0B020000       cmp eax,20B
00407A3C    .  74 05             je short eMuleUpd.00407A43
00407A3E    >  8975 E4          mov dword ptr ss:[ebp-1C],esi
00407A41    .  EB 27             jmp short eMuleUpd.00407A6A
00407A43    >  83B9 84000000 0E cmp dword ptr ds:[ecx+84],0E
00407A4A    .^ 76 F2             jbe short eMuleUpd.00407A3E
00407A4C    .  33C0             xor eax,eax
00407A4E    .  39B1 F8000000    cmp dword ptr ds:[ecx+F8],esi
00407A54    .  EB 0E             jmp short eMuleUpd.00407A64
00407A56    >  8379 74 0E       cmp dword ptr ds:[ecx+74],0E
00407A5A    .^ 76 E2             jbe short eMuleUpd.00407A3E
00407A5C    .  33C0             xor eax,eax
00407A5E    .  39B1 E8000000    cmp dword ptr ds:[ecx+E8],esi
00407A64    >  0F95C0             setne al
00407A67    .  8945 E4          mov dword ptr ss:[ebp-1C],eax
00407A6A    >  6A 01             push 1
00407A6C    .  E8 A3550000       call eMuleUpd.0040D014
00407A71    .  59                pop ecx                                                 ;  kernel32.7C816FD7
00407A72    .  85C0             test eax,eax
00407A74    .  75 08             jnz short eMuleUpd.00407A7E
00407A76    .  6A 1C             push 1C
00407A78    .  E8 02FFFFFF       call eMuleUpd.0040797F
00407A7D    .  59                pop ecx                                                 ;  kernel32.7C816FD7
00407A7E    >  E8 572A0000       call eMuleUpd.0040A4DA
00407A83    .  85C0             test eax,eax
00407A85    .  75 08             jnz short eMuleUpd.00407A8F
00407A87    .  6A 10             push 10
00407A89    .  E8 F1FEFFFF       call eMuleUpd.0040797F
00407A8E    .  59                pop ecx                                                 ;  kernel32.7C816FD7
00407A8F    >  E8 756A0000       call eMuleUpd.0040E509
00407A94    .  8975 FC          mov dword ptr ss:[ebp-4],esi
00407A97    .  E8 6F680000       call eMuleUpd.0040E30B
00407A9C    .  85C0             test eax,eax
00407A9E    .  7D 08             jge short eMuleUpd.00407AA8
00407AA0    .  6A 1B             push 1B
00407AA2    .  E8 B3FEFFFF       call eMuleUpd.0040795A
00407AA7    .  59                pop ecx                                                 ;  kernel32.7C816FD7
00407AA8    >  FF15 0C024200    call near dword ptr ds:[<&KERNEL32.GetCommandLineA>]    ; [GetCommandLineA
00407AAE    .  A3 10D44200       mov dword ptr ds:[42D410],eax
00407AB3    .  E8 31670000       call eMuleUpd.0040E1E9
00407AB8    .  A3 14BB4200       mov dword ptr ds:[42BB14],eax
00407ABD    .  E8 85660000       call eMuleUpd.0040E147
00407AC2    .  85C0             test eax,eax
00407AC4    .  7D 08             jge short eMuleUpd.00407ACE
00407AC6    .  6A 08             push 8
00407AC8    .  E8 8DFEFFFF       call eMuleUpd.0040795A
00407ACD    .  59                pop ecx                                                 ;  kernel32.7C816FD7
00407ACE    >  E8 41640000       call eMuleUpd.0040DF14
00407AD3    .  85C0             test eax,eax
00407AD5    .  7D 08             jge short eMuleUpd.00407ADF
00407AD7    .  6A 09             push 9
00407AD9    .  E8 7CFEFFFF       call eMuleUpd.0040795A
00407ADE    .  59                pop ecx                                                 ;  kernel32.7C816FD7
00407ADF    >  6A 01             push 1
00407AE1    .  E8 72030000       call eMuleUpd.00407E58
00407AE6    .  59                pop ecx                                                 ;  kernel32.7C816FD7
00407AE7    .  8945 D8          mov dword ptr ss:[ebp-28],eax
00407AEA    .  3BC6             cmp eax,esi
00407AEC    .  74 07             je short eMuleUpd.00407AF5
00407AEE    .  50                push eax
00407AEF    .  E8 66FEFFFF       call eMuleUpd.0040795A
00407AF4    .  59                pop ecx                                                 ;  kernel32.7C816FD7
00407AF5    >  8975 BC          mov dword ptr ss:[ebp-44],esi
00407AF8    .  8D45 90          lea eax,dword ptr ss:[ebp-70]
00407AFB    .  50                push eax                                              ; /pStartupinfo = NULL
00407AFC    .  FF15 B4004200    call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>]    ; \GetStartupInfoA
00407B02    .  E8 B0630000       call eMuleUpd.0040DEB7
00407B07    .  8945 E0          mov dword ptr ss:[ebp-20],eax
00407B0A    .  F645 BC 01       test byte ptr ss:[ebp-44],1
00407B0E    .  74 06             je short eMuleUpd.00407B16
00407B10    .  0FB745 C0          movzx eax,word ptr ss:[ebp-40]
00407B14    .  EB 03             jmp short eMuleUpd.00407B19
00407B16    >  6A 0A             push 0A
00407B18    .  58                pop eax                                                 ;  kernel32.7C816FD7
00407B19    >  50                push eax
00407B1A    .  FF75 E0          push dword ptr ss:[ebp-20]
00407B1D    .  56                push esi
00407B1E    .  56                push esi
00407B1F    .  FFD7             call near edi                                           ;  ntdll.7C930738
00407B21    .  50                push eax
00407B22    .  E8 33B50000       call eMuleUpd.0041305A
00407B27    .  8BF8             mov edi,eax
00407B29    .  897D D4          mov dword ptr ss:[ebp-2C],edi                         ;  ntdll.7C930738
00407B2C    .  3975 E4          cmp dword ptr ss:[ebp-1C],esi
00407B2F    .  75 06             jnz short eMuleUpd.00407B37
00407B31    .  57                push edi                                              ;  ntdll.7C930738
00407B32    .  E8 4E040000       call eMuleUpd.00407F85
00407B37    >  E8 6B040000       call eMuleUpd.00407FA7
00407B3C    .  EB 2B             jmp short eMuleUpd.00407B69
00407B3E    .  8B45 EC          mov eax,dword ptr ss:[ebp-14]
00407B41    .  8B08             mov ecx,dword ptr ds:[eax]
00407B43    .  8B09             mov ecx,dword ptr ds:[ecx]                            ;  ntdll.7C92E64E
00407B45    .  894D DC          mov dword ptr ss:[ebp-24],ecx
00407B48    .  50                push eax
00407B49    .  51                push ecx
00407B4A    .  E8 04620000       call eMuleUpd.0040DD53
00407B4F    .  59                pop ecx                                                 ;  kernel32.7C816FD7
00407B50    .  59                pop ecx                                                 ;  kernel32.7C816FD7
00407B51    .  C3                retn

6A 60 68 B0 24 42 00 E8 F5 E1 FF FF BF 94 00 00 00 8B C7 E8 65 FC FF FF 89 65 E8 8B F4 89 3E 56
FF 15 70 02 42 00 8B 4E 10 89 0D 28 BB 42 00 8B 46 04 A3 34 BB 42 00 8B 56 08 89 15 38 BB 42 00
8B 76 0C 81 E6 FF 7F 00 00 89 35 2C BB 42 00 83 F9 02 74 0C 81 CE 00 80 00 00 89 35 2C BB 42 00
C1 E0 08 03 C2 A3 30 BB 42 00 33 F6 56 8B 3D 88 01 42 00 FF D7 66 81 38 4D 5A 75 1F 8B 48 3C 03
C8 81 39 50 45 00 00 75 12 0F B7 41 18 3D 0B 01 00 00 74 1F 3D 0B 02 00 00 74 05 89 75 E4 EB 27
83 B9 84 00 00 00 0E 76 F2 33 C0 39 B1 F8 00 00 00 EB 0E 83 79 74 0E 76 E2 33 C0 39 B1 E8 00 00
00 0F 95 C0 89 45 E4 6A 01 E8 A3 55 00 00 59 85 C0 75 08 6A 1C E8 02 FF FF FF 59 E8 57 2A 00 00
85 C0 75 08 6A 10 E8 F1 FE FF FF 59 E8 75 6A 00 00 89 75 FC E8 6F 68 00 00 85 C0 7D 08 6A 1B E8
B3 FE FF FF 59 FF 15 0C 02 42 00 A3 10 D4 42 00 E8 31 67 00 00 A3 14 BB 42 00 E8 85 66 00 00 85
C0 7D 08 6A 08 E8 8D FE FF FF 59 E8 41 64 00 00 85 C0 7D 08 6A 09 E8 7C FE FF FF 59 6A 01 E8 72
03 00 00 59 89 45 D8 3B C6 74 07 50 E8 66 FE FF FF 59 89 75 BC 8D 45 90 50 FF 15 B4 00 42 00 E8
B0 63 00 00 89 45 E0 F6 45 BC 01 74 06 0F B7 45 C0 EB 03 6A 0A 58 50 FF 75 E0 56 56 FF D7 50 E8
33 B5 00 00 8B F8 89 7D D4 39 75 E4 75 06 57 E8 4E 04 00 00 E8 6B 04 00 00 EB 2B 8B 45 EC 8B 08
8B 09 89 4D DC 50 51 E8 04 62 00 00 59 59 C3

Microsoft Visual C++ 7.0 Method2 [Debug]

.text
.data
.rsrc

0100739D note>  6A 70                push 70
0100739F       68 98180001          push notepad.01001898
010073A4       E8 BF010000          call notepad.01007568
010073A9       33DB                xor ebx,ebx
010073AB       53                   push ebx
010073AC       8B3D CC100001       mov edi,dword ptr ds:[<&KERNEL32.GetModuleHandleA>]    ; kernel32.GetModuleHandleA
010073B2       FFD7                call near edi                                           ; ntdll.7C930738
010073B4       66:8138 4D5A       cmp word ptr ds:[eax],5A4D
010073B9       75 1F                jnz short notepad.010073DA
010073BB       8B48 3C             mov ecx,dword ptr ds:[eax+3C]
010073BE       03C8                add ecx,eax
010073C0       8139 50450000       cmp dword ptr ds:[ecx],4550
010073C6       75 12                jnz short notepad.010073DA
010073C8       0FB741 18          movzx eax,word ptr ds:[ecx+18]
010073CC       3D 0B010000          cmp eax,10B
010073D1       74 1F                je short notepad.010073F2
010073D3       3D 0B020000          cmp eax,20B
010073D8       74 05                je short notepad.010073DF
010073DA       895D E4             mov dword ptr ss:[ebp-1C],ebx
010073DD       EB 27                jmp short notepad.01007406
010073DF       83B9 84000000 0E    cmp dword ptr ds:[ecx+84],0E
010073E6    ^ 76 F2                jbe short notepad.010073DA
010073E8       33C0                xor eax,eax
010073EA       3999 F8000000       cmp dword ptr ds:[ecx+F8],ebx
010073F0       EB 0E                jmp short notepad.01007400
010073F2       8379 74 0E          cmp dword ptr ds:[ecx+74],0E
010073F6    ^ 76 E2                jbe short notepad.010073DA
010073F8       33C0                xor eax,eax
010073FA       3999 E8000000       cmp dword ptr ds:[ecx+E8],ebx
01007400       0F95C0             setne al
01007403       8945 E4             mov dword ptr ss:[ebp-1C],eax
01007406       895D FC             mov dword ptr ss:[ebp-4],ebx
01007409       6A 02                push 2
0100740B       FF15 38130001       call near dword ptr ds:[<&msvcrt.__set_app_type>]       ; msvcrt.__set_app_type
01007411       59                   pop ecx                                                 ; kernel32.7C816FD7
01007412       830D 9CAB0001 FF    or dword ptr ds:[100AB9C],FFFFFFFF
01007419       830D A0AB0001 FF    or dword ptr ds:[100ABA0],FFFFFFFF
01007420       FF15 34130001       call near dword ptr ds:[<&msvcrt.__p__fmode>]          ; msvcrt.__p__fmode
01007426       8B0D B89A0001       mov ecx,dword ptr ds:[1009AB8]
0100742C       8908                mov dword ptr ds:[eax],ecx
0100742E       FF15 30130001       call near dword ptr ds:[<&msvcrt.__p__commode>]       ; msvcrt.__p__commode
01007434       8B0D B49A0001       mov ecx,dword ptr ds:[1009AB4]
0100743A       8908                mov dword ptr ds:[eax],ecx
0100743C       A1 2C130001          mov eax,dword ptr ds:[<&msvcrt._adjust_fdiv>]
01007441       8B00                mov eax,dword ptr ds:[eax]
01007443       A3 A4AB0001          mov dword ptr ds:[100ABA4],eax
01007448       E8 A7010000          call notepad.010075F4
0100744D       391D 08960001       cmp dword ptr ds:[1009608],ebx
01007453       75 0C                jnz short notepad.01007461
01007455       68 F4750001          push notepad.010075F4                                  ; Entry address
0100745A       FF15 28130001       call near dword ptr ds:[<&msvcrt.__setusermatherr>]    ; msvcrt.__setusermatherr
01007460       59                   pop ecx                                                 ; kernel32.7C816FD7
01007461       E8 77010000          call notepad.010075DD
01007466       68 10900001          push notepad.01009010
0100746B       68 0C900001          push notepad.0100900C
01007470       E8 5D010000          call <jmp.&msvcrt._initterm>
01007475       A1 B09A0001          mov eax,dword ptr ds:[1009AB0]
0100747A       8945 DC             mov dword ptr ss:[ebp-24],eax
0100747D       8D45 DC             lea eax,dword ptr ss:[ebp-24]
01007480       50                   push eax
01007481       FF35 AC9A0001       push dword ptr ds:[1009AAC]
01007487       8D45 D4             lea eax,dword ptr ss:[ebp-2C]
0100748A       50                   push eax
0100748B       8D45 D0             lea eax,dword ptr ss:[ebp-30]
0100748E       50                   push eax
0100748F       8D45 CC             lea eax,dword ptr ss:[ebp-34]
01007492       50                   push eax
01007493       FF15 20130001       call near dword ptr ds:[<&msvcrt.__getmainargs>]       ; msvcrt.__getmainargs
01007499       8945 C8             mov dword ptr ss:[ebp-38],eax
0100749C       68 08900001          push notepad.01009008
010074A1       68 00900001          push notepad.01009000
010074A6       E8 27010000          call <jmp.&msvcrt._initterm>
010074AB       83C4 24             add esp,24
010074AE       A1 1C130001          mov eax,dword ptr ds:[<&msvcrt._acmdln>]
010074B3       8B30                mov esi,dword ptr ds:[eax]
010074B5       8975 E0             mov dword ptr ss:[ebp-20],esi
010074B8       803E 22             cmp byte ptr ds:[esi],22
010074BB       75 3A                jnz short notepad.010074F7
010074BD       46                   inc esi
010074BE       8975 E0             mov dword ptr ss:[ebp-20],esi
010074C1       8A06                mov al,byte ptr ds:[esi]
010074C3       3AC3                cmp al,bl
010074C5       74 04                je short notepad.010074CB
010074C7       3C 22                cmp al,22
010074C9    ^ 75 F2                jnz short notepad.010074BD
010074CB       803E 22             cmp byte ptr ds:[esi],22
010074CE       75 04                jnz short notepad.010074D4
010074D0       46                   inc esi
010074D1       8975 E0             mov dword ptr ss:[ebp-20],esi
010074D4       8A06                mov al,byte ptr ds:[esi]
010074D6       3AC3                cmp al,bl
010074D8       74 04                je short notepad.010074DE
010074DA       3C 20                cmp al,20
010074DC    ^ 76 F2                jbe short notepad.010074D0
010074DE       895D AC             mov dword ptr ss:[ebp-54],ebx
010074E1       8D45 80             lea eax,dword ptr ss:[ebp-80]
010074E4       50                   push eax
010074E5       FF15 D0100001       call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>]    ; kernel32.GetStartupInfoA
010074EB       F645 AC 01          test byte ptr ss:[ebp-54],1
010074EF       74 11                je short notepad.01007502
010074F1       0FB745 B0          movzx eax,word ptr ss:[ebp-50]
010074F5       EB 0E                jmp short notepad.01007505
010074F7       803E 20             cmp byte ptr ds:[esi],20
010074FA    ^ 76 D8                jbe short notepad.010074D4
010074FC       46                   inc esi
010074FD       8975 E0             mov dword ptr ss:[ebp-20],esi
01007500    ^ EB F5                jmp short notepad.010074F7
01007502       6A 0A                push 0A
01007504       58                   pop eax                                                 ; kernel32.7C816FD7
01007505       50                   push eax
01007506       56                   push esi
01007507       53                   push ebx
01007508       53                   push ebx
01007509       FFD7                call near edi                                           ; ntdll.7C930738
0100750B       50                   push eax
0100750C       E8 25B4FFFF          call notepad.01002936
01007511       8BF0                mov esi,eax
01007513       8975 C4             mov dword ptr ss:[ebp-3C],esi
01007516       395D E4             cmp dword ptr ss:[ebp-1C],ebx
01007519       75 07                jnz short notepad.01007522
0100751B       56                   push esi
0100751C       FF15 18130001       call near dword ptr ds:[<&msvcrt.exit>]                ; msvcrt.exit
01007522       FF15 00130001       call near dword ptr ds:[<&msvcrt._cexit>]             ; msvcrt._cexit
01007528       EB 2D                jmp short notepad.01007557
0100752A       8B45 EC             mov eax,dword ptr ss:[ebp-14]
0100752D       8B08                mov ecx,dword ptr ds:[eax]
0100752F       8B09                mov ecx,dword ptr ds:[ecx]                            ; ntdll.7C92E64E
01007531       894D D8             mov dword ptr ss:[ebp-28],ecx
01007534       50                   push eax
01007535       51                   push ecx
01007536       E8 8B000000          call <jmp.&msvcrt._XcptFilter>
0100753B       59                   pop ecx                                                 ; kernel32.7C816FD7
0100753C       59                   pop ecx                                                 ; kernel32.7C816FD7
0100753D       C3                   retn

6A 70 68 98 18 00 01 E8 BF 01 00 00 33 DB 53 8B 3D CC 10 00 01 FF D7 66 81 38 4D 5A 75 1F 8B 48
3C 03 C8 81 39 50 45 00 00 75 12 0F B7 41 18 3D 0B 01 00 00 74 1F 3D 0B 02 00 00 74 05 89 5D E4
EB 27 83 B9 84 00 00 00 0E 76 F2 33 C0 39 99 F8 00 00 00 EB 0E 83 79 74 0E 76 E2 33 C0 39 99 E8
00 00 00 0F 95 C0 89 45 E4 89 5D FC 6A 02 FF 15 38 13 00 01 59 83 0D 9C AB 00 01 FF 83 0D A0 AB
00 01 FF FF 15 34 13 00 01 8B 0D B8 9A 00 01 89 08 FF 15 30 13 00 01 8B 0D B4 9A 00 01 89 08 A1
2C 13 00 01 8B 00 A3 A4 AB 00 01 E8 A7 01 00 00 39 1D 08 96 00 01 75 0C 68 F4 75 00 01 FF 15 28
13 00 01 59 E8 77 01 00 00 68 10 90 00 01 68 0C 90 00 01 E8 5D 01 00 00 A1 B0 9A 00 01 89 45 DC
8D 45 DC 50 FF 35 AC 9A 00 01 8D 45 D4 50 8D 45 D0 50 8D 45 CC 50 FF 15 20 13 00 01 89 45 C8 68
08 90 00 01 68 00 90 00 01 E8 27 01 00 00 83 C4 24 A1 1C 13 00 01 8B 30 89 75 E0 80 3E 22 75 3A
46 89 75 E0 8A 06 3A C3 74 04 3C 22 75 F2 80 3E 22 75 04 46 89 75 E0 8A 06 3A C3 74 04 3C 20 76
F2 89 5D AC 8D 45 80 50 FF 15 D0 10 00 01 F6 45 AC 01 74 11 0F B7 45 B0 EB 0E 80 3E 20 76 D8 46
89 75 E0 EB F5 6A 0A 58 50 56 53 53 FF D7 50 E8 25 B4 FF FF 8B F0 89 75 C4 39 5D E4 75 07 56 FF
15 18 13 00 01 FF 15 00 13 00 01 EB 2D 8B 45 EC 8B 08 8B 09 89 4D D8 50 51 E8 8B 00 00 00 59 59
C3

VC8 -> Microsoft Corporation *

.text
.rdata
.data
.rsrc

00495FCE    > /6A 60             push 60
00495FD0    . |68 387B4C00       push foobar20.004C7B38
00495FD5    . |E8 A60C0000       call foobar20.00496C80
00495FDA    . |8365 FC 00       and dword ptr ss:[ebp-4],0
00495FDE    . |8D45 90          lea eax,dword ptr ss:[ebp-70]
00495FE1    . |50                push eax                                              ; /pStartupinfo = 535C08DE
00495FE2    . |FF15 14414B00    call near dword ptr ds:[<&KERNEL32.GetStartupInfoW>]    ; \GetStartupInfoW
00495FE8    . |C745 FC FEFFFFFF mov dword ptr ss:[ebp-4],-2
00495FEF    . |BF 94000000       mov edi,94
00495FF4    . |57                push edi                                              ; /HeapSize = 7C930738 (2090010424.)
00495FF5    . |6A 00             push 0                                                 ; |Flags = 0
00495FF7    . |8B1D 10414B00    mov ebx,dword ptr ds:[<&KERNEL32.GetProcessHeap>]       ; |kernel32.GetProcessHeap
00495FFD    . |FFD3             call near ebx                                           ; |[GetProcessHeap
00495FFF    . |50                push eax                                              ; |hHeap = 535C08DE
00496000    . |FF15 08414B00    call near dword ptr ds:[<&KERNEL32.HeapAlloc>]          ; \HeapAlloc
00496006    . |8BF0             mov esi,eax
00496008    . |85F6             test esi,esi
0049600A    . |75 0D             jnz short foobar20.00496019
0049600C    . |6A 12             push 12
0049600E    . |E8 56FFFFFF       call foobar20.00495F69
00496013    . |59                pop ecx                                                 ;  kernel32.7C816FD7
00496014    . |E9 89010000       jmp foobar20.004961A2
00496019    > |893E             mov dword ptr ds:[esi],edi                            ;  ntdll.7C930738
0049601B    . |56                push esi                                              ; /pVersionInformation = FFFFFFFF
0049601C    . |FF15 0C414B00    call near dword ptr ds:[<&KERNEL32.GetVersionExA>]    ; \GetVersionExA
00496022    . |56                push esi
00496023    . |6A 00             push 0
00496025    . |85C0             test eax,eax
00496027    . |75 0E             jnz short foobar20.00496037
00496029    . |FFD3             call near ebx
0049602B    . |50                push eax                                              ; |hHeap = 535C08DE
0049602C    . |FF15 C8414B00    call near dword ptr ds:[<&KERNEL32.HeapFree>]          ; \HeapFree
00496032    . |E9 6B010000       jmp foobar20.004961A2
00496037    > |8B46 10          mov eax,dword ptr ds:[esi+10]
0049603A    . |8945 E0          mov dword ptr ss:[ebp-20],eax
0049603D    . |8B46 04          mov eax,dword ptr ds:[esi+4]
00496040    . |8945 DC          mov dword ptr ss:[ebp-24],eax
00496043    . |8B46 08          mov eax,dword ptr ds:[esi+8]
00496046    . |8945 D8          mov dword ptr ss:[ebp-28],eax
00496049    . |8B7E 0C          mov edi,dword ptr ds:[esi+C]
0049604C    . |81E7 FF7F0000    and edi,7FFF
00496052    . |FFD3             call near ebx
00496054    . |50                push eax                                              ; |hHeap = 535C08DE
00496055    . |FF15 C8414B00    call near dword ptr ds:[<&KERNEL32.HeapFree>]          ; \HeapFree
0049605B    . |8B75 E0          mov esi,dword ptr ss:[ebp-20]
0049605E    . |83FE 02          cmp esi,2
00496061    . |74 06             je short foobar20.00496069
00496063    . |81CF 00800000    or edi,8000
00496069    > |8B4D DC          mov ecx,dword ptr ss:[ebp-24]
0049606C    . |8BC1             mov eax,ecx
0049606E    . |C1E0 08          shl eax,8
00496071    . |8B55 D8          mov edx,dword ptr ss:[ebp-28]                         ;  ntdll.7C930738
00496074    . |03C2             add eax,edx                                           ;  ntdll.KiFastSystemCallRet
00496076    . |8935 CC084E00    mov dword ptr ds:[4E08CC],esi
0049607C    . |A3 D4084E00       mov dword ptr ds:[4E08D4],eax
00496081    . |890D D8084E00    mov dword ptr ds:[4E08D8],ecx
00496087    . |8915 DC084E00    mov dword ptr ds:[4E08DC],edx                         ;  ntdll.KiFastSystemCallRet
0049608D    . |893D D0084E00    mov dword ptr ds:[4E08D0],edi                         ;  ntdll.7C930738
00496093    . |E8 F5FEFFFF       call foobar20.00495F8D
00496098    . |8945 E0          mov dword ptr ss:[ebp-20],eax
0049609B    . |33DB             xor ebx,ebx
0049609D    . |43                inc ebx
0049609E    . |53                push ebx
0049609F    . |E8 8C100000       call foobar20.00497130
004960A4    . |59                pop ecx                                                 ;  kernel32.7C816FD7
004960A5    . |85C0             test eax,eax
004960A7    . |75 08             jnz short foobar20.004960B1
004960A9    . |6A 1C             push 1C
004960AB    . |E8 B9FEFFFF       call foobar20.00495F69
004960B0    . |59                pop ecx                                                 ;  kernel32.7C816FD7
004960B1    > |E8 C5050000       call foobar20.0049667B
004960B6    . |85C0             test eax,eax
004960B8    . |75 08             jnz short foobar20.004960C2
004960BA    . |6A 10             push 10
004960BC    . |E8 A8FEFFFF       call foobar20.00495F69
004960C1    . |59                pop ecx                                                 ;  kernel32.7C816FD7
004960C2    > |E8 80790000       call foobar20.0049DA47
004960C7    . |895D FC          mov dword ptr ss:[ebp-4],ebx
004960CA    . |E8 38770000       call foobar20.0049D807
004960CF    . |85C0             test eax,eax
004960D1    . |7D 08             jge short foobar20.004960DB
004960D3    . |6A 1B             push 1B
004960D5    . |E8 9B080000       call foobar20.00496975
004960DA    . |59                pop ecx                                                 ;  kernel32.7C816FD7
004960DB    > |E8 88760000       call foobar20.0049D768
004960E0    . |A3 9C544E00       mov dword ptr ds:[4E549C],eax
004960E5    . |E8 1D750000       call foobar20.0049D607
004960EA    . |A3 AC084E00       mov dword ptr ds:[4E08AC],eax
004960EF    . |E8 68740000       call foobar20.0049D55C
004960F4    . |85C0             test eax,eax
004960F6    . |7D 08             jge short foobar20.00496100
004960F8    . |6A 08             push 8
004960FA    . |E8 76080000       call foobar20.00496975
004960FF    . |59                pop ecx                                                 ;  kernel32.7C816FD7
00496100    > |E8 31720000       call foobar20.0049D336
00496105    . |85C0             test eax,eax
00496107    . |7D 08             jge short foobar20.00496111
00496109    . |6A 09             push 9
0049610B    . |E8 65080000       call foobar20.00496975
00496110    . |59                pop ecx                                                 ;  kernel32.7C816FD7
00496111    > |53                push ebx
00496112    . |E8 7A090000       call foobar20.00496A91
00496117    . |59                pop ecx                                                 ;  kernel32.7C816FD7
00496118    . |85C0             test eax,eax
0049611A    . |74 07             je short foobar20.00496123
0049611C    . |50                push eax
0049611D    . |E8 53080000       call foobar20.00496975
00496122    . |59                pop ecx                                                 ;  kernel32.7C816FD7
00496123    > |E8 C8710000       call foobar20.0049D2F0
00496128    . |845D BC          test byte ptr ss:[ebp-44],bl
0049612B    . |74 06             je short foobar20.00496133
0049612D    . |0FB74D C0          movzx ecx,word ptr ss:[ebp-40]
00496131    . |EB 03             jmp short foobar20.00496136
00496133    > |6A 0A             push 0A
00496135    . |59                pop ecx                                                 ;  kernel32.7C816FD7
00496136    > |51                push ecx
00496137    . |50                push eax
00496138    . |6A 00             push 0
0049613A    . |68 00004000       push foobar20.00400000
0049613F    . |E8 8EAAF9FF       call foobar20.00430BD2
00496144    . |8945 E4          mov dword ptr ss:[ebp-1C],eax
00496147    . |837D E0 00       cmp dword ptr ss:[ebp-20],0
0049614B    . |75 06             jnz short foobar20.00496153
0049614D    . |50                push eax
0049614E    . |E8 9E0A0000       call foobar20.00496BF1
00496153    > |E8 BB0A0000       call foobar20.00496C13
00496158    . |EB 2E             jmp short foobar20.00496188
0049615A    . |8B45 EC          mov eax,dword ptr ss:[ebp-14]
0049615D    . |8B08             mov ecx,dword ptr ds:[eax]
0049615F    . |8B09             mov ecx,dword ptr ds:[ecx]                            ;  ntdll.7C92E10E
00496161    . |894D D4          mov dword ptr ss:[ebp-2C],ecx
00496164    . |50                push eax
00496165    . |51                push ecx
00496166    . |E8 16700000       call foobar20.0049D181
0049616B    . |59                pop ecx                                                 ;  kernel32.7C816FD7
0049616C    . |59                pop ecx                                                 ;  kernel32.7C816FD7
0049616D    . |C3                retn
0049616E    . |8B65 E8          mov esp,dword ptr ss:[ebp-18]
00496171    . |8B45 D4          mov eax,dword ptr ss:[ebp-2C]                         ;  kernel32.7C816FD7
00496174    . |8945 E4          mov dword ptr ss:[ebp-1C],eax
00496177    . |837D E0 00       cmp dword ptr ss:[ebp-20],0
0049617B    . |75 06             jnz short foobar20.00496183
0049617D    . |50                push eax
0049617E    . |E8 7F0A0000       call foobar20.00496C02
00496183    > |E8 9A0A0000       call foobar20.00496C22
00496188    > |C745 FC FEFFFFFF mov dword ptr ss:[ebp-4],-2
0049618F    . |8B45 E4          mov eax,dword ptr ss:[ebp-1C]
00496192    . |EB 13             jmp short foobar20.004961A7
00496194    . |33C0             xor eax,eax
00496196    . |40                inc eax
00496197    . |C3                retn
00496198    . |8B65 E8          mov esp,dword ptr ss:[ebp-18]
0049619B    . |C745 FC FEFFFFFF mov dword ptr ss:[ebp-4],-2
004961A2    > |B8 FF000000       mov eax,0FF
004961A7    > |E8 190B0000       call foobar20.00496CC5
004961AC    . |C3                retn
004961AD foob> $ |E8 DD780000       call foobar20.0049DA8F
004961B2    .^\E9 17FEFFFF       jmp foobar20.00495FCE
004961B7    $  3B0D B0CC4D00    cmp ecx,dword ptr ds:[4DCCB0]
004961BD    .  75 02             jnz short foobar20.004961C1
004961BF    .  F3:                prefix rep:
004961C0    .  C3                retn

6A 60 68 38 7B 4C 00 E8 A6 0C 00 00 83 65 FC 00 8D 45 90 50 FF 15 14 41 4B 00 C7 45 FC FE FF FF
FF BF 94 00 00 00 57 6A 00 8B 1D 10 41 4B 00 FF D3 50 FF 15 08 41 4B 00 8B F0 85 F6 75 0D 6A 12
E8 56 FF FF FF 59 E9 89 01 00 00 89 3E 56 FF 15 0C 41 4B 00 56 6A 00 85 C0 75 0E FF D3 50 FF 15
C8 41 4B 00 E9 6B 01 00 00 8B 46 10 89 45 E0 8B 46 04 89 45 DC 8B 46 08 89 45 D8 8B 7E 0C 81 E7
FF 7F 00 00 FF D3 50 FF 15 C8 41 4B 00 8B 75 E0 83 FE 02 74 06 81 CF 00 80 00 00 8B 4D DC 8B C1
C1 E0 08 8B 55 D8 03 C2 89 35 CC 08 4E 00 A3 D4 08 4E 00 89 0D D8 08 4E 00 89 15 DC 08 4E 00 89
3D D0 08 4E 00 E8 F5 FE FF FF 89 45 E0 33 DB 43 53 E8 8C 10 00 00 59 85 C0 75 08 6A 1C E8 B9 FE
FF FF 59 E8 C5 05 00 00 85 C0 75 08 6A 10 E8 A8 FE FF FF 59 E8 80 79 00 00 89 5D FC E8 38 77 00
00 85 C0 7D 08 6A 1B E8 9B 08 00 00 59 E8 88 76 00 00 A3 9C 54 4E 00 E8 1D 75 00 00 A3 AC 08 4E
00 E8 68 74 00 00 85 C0 7D 08 6A 08 E8 76 08 00 00 59 E8 31 72 00 00 85 C0 7D 08 6A 09 E8 65 08
00 00 59 53 E8 7A 09 00 00 59 85 C0 74 07 50 E8 53 08 00 00 59 E8 C8 71 00 00 84 5D BC 74 06 0F
B7 4D C0 EB 03 6A 0A 59 51 50 6A 00 68 00 00 40 00 E8 8E AA F9 FF 89 45 E4 83 7D E0 00 75 06 50
E8 9E 0A 00 00 E8 BB 0A 00 00 EB 2E 8B 45 EC 8B 08 8B 09 89 4D D4 50 51 E8 16 70 00 00 59 59 C3
8B 65 E8 8B 45 D4 89 45 E4 83 7D E0 00 75 06 50 E8 7F 0A 00 00 E8 9A 0A 00 00 C7 45 FC FE FF FF
FF 8B 45 E4 EB 13 33 C0 40 C3 8B 65 E8 C7 45 FC FE FF FF FF B8 FF 00 00 00 E8 19 0B 00 00 C3 E8
DD 78 00 00 E9 17 FE FF FF 3B 0D B0 CC 4D 00 75 02 F3 C3

复制好累的说。。

2010-4-23 17:23

0