请高手帮忙看看!先谢谢了![求助]-付费问答-看雪-安全社区|安全招聘|kanxue.com

[旧帖] 请高手帮忙看看!先谢谢了![求助] 0.00雪花

发表于: 2007-2-10 10:16 3971

[旧帖] 请高手帮忙看看!先谢谢了![求助] 0.00雪花

lovetj

2007-2-10 10:16

3971

00401000 >/$  8BC1       MOV EAX,ECX
00401002  |.  C700 C08D4C00 MOV DWORD PTR DS:[EAX],OFFSET ProgMan.??>
00401008  \.  C3          RETN
00401009    90          NOP
0040100A    90          NOP
0040100B    90          NOP
0040100C    90          NOP
0040100D    90          NOP
0040100E    90          NOP
0040100F    90          NOP
00401010 >/$  C701 C08D4C00 MOV DWORD PTR DS:[ECX],OFFSET ProgMan.??>
00401016  \.  C3          RETN
00401017    90          NOP
00401018    90          NOP
00401019    90          NOP
0040101A    90          NOP
0040101B    90          NOP
0040101C    90          NOP
0040101D    90          NOP
0040101E    90          NOP
0040101F    90          NOP
00401020 >/$  8B01       MOV EAX,DWORD PTR DS:[ECX]
00401022  |.  6A 01       PUSH 1
00401024  |.  8D5424 08    LEA EDX,DWORD PTR SS:[ESP+8]
00401028  |.  6A 01       PUSH 1
0040102A  |.  52          PUSH EDX
0040102B  |.  FF50 0C    CALL DWORD PTR DS:[EAX+C]
0040102E  |.  48          DEC EAX
0040102F  |.  F7D8       NEG EAX
00401031  |.  1BC0       SBB EAX,EAX
00401033  |.  40          INC EAX
00401034  \.  C2 0400    RETN 4
00401037    90          NOP
00401038    90          NOP
00401039    90          NOP
0040103A    90          NOP
0040103B    90          NOP
0040103C    90          NOP
0040103D    90          NOP
0040103E    90          NOP
0040103F    90          NOP
00401040 >/$  8BC1       MOV EAX,ECX
00401042  |.  C700 C08D4C00 MOV DWORD PTR DS:[EAX],OFFSET ProgMan.??>
00401048  \.  C2 0400    RETN 4
0040104B    90          NOP
0040104C    90          NOP
0040104D    90          NOP
0040104E    90          NOP
0040104F    90          NOP
00401050 >/$  8BC1       MOV EAX,ECX
00401052  \.  C2 0400    RETN 4
00401055    90          NOP
00401056    90          NOP
00401057    90          NOP
00401058    90          NOP
00401059    90          NOP
0040105A    90          NOP
0040105B    90          NOP
0040105C    90          NOP
0040105D    90          NOP
0040105E    90          NOP
0040105F    90          NOP
00401060 .  53          PUSH EBX
00401061 .  8A5C24 08    MOV BL,BYTE PTR SS:[ESP+8]
00401065 .  56          PUSH ESI
00401066 .  8BF1       MOV ESI,ECX
00401068 .  F6C3 02    TEST BL,2
0040106B .  74 2B       JE SHORT ProgMan.00401098
0040106D .  8B46 FC    MOV EAX,DWORD PTR DS:[ESI-4]
00401070 .  57          PUSH EDI
00401071 .  8D7E FC    LEA EDI,DWORD PTR DS:[ESI-4]
00401074 .  68 10104000 PUSH ProgMan.??1CxFile@@UAE@XZ
00401079 .  50          PUSH EAX
0040107A .  6A 04       PUSH 4
0040107C .  56          PUSH ESI
0040107D .  E8 42DB0B00 CALL ProgMan.004BEBC4
00401082 .  F6C3 01    TEST BL,1
00401085 .  74 09       JE SHORT ProgMan.00401090
00401087 .  57          PUSH EDI
00401088 .  E8 A3CF0B00 CALL <JMP.&MFC42.#825_??3@YAXPAX@Z>
0040108D .  83C4 04    ADD ESP,4
00401090 >  8BC7       MOV EAX,EDI
00401092 .  5F          POP EDI
00401093 .  5E          POP ESI
00401094 .  5B          POP EBX
00401095 .  C2 0400    RETN 4
00401098 >  F6C3 01    TEST BL,1
0040109B .  C706 C08D4C00 MOV DWORD PTR DS:[ESI],OFFSET ProgMan.??>
004010A1 .  74 09       JE SHORT ProgMan.004010AC
004010A3 .  56          PUSH ESI
004010A4 .  E8 87CF0B00 CALL <JMP.&MFC42.#825_??3@YAXPAX@Z>
004010A9 .  83C4 04    ADD ESP,4
004010AC >  8BC6       MOV EAX,ESI
004010AE .  5E          POP ESI
004010AF .  5B          POP EBX
004010B0 .  C2 0400    RETN 4
004010B3    90          NOP
004010B4    90          NOP
004010B5    90          NOP
004010B6    90          NOP
004010B7    90          NOP
004010B8    90          NOP
004010B9    90          NOP
004010BA    90          NOP
004010BB    90          NOP
004010BC    90          NOP
004010BD    90          NOP
004010BE    90          NOP
004010BF    90          NOP
004010C0 >/$  8BC1       MOV EAX,ECX
004010C2  |.  8B4C24 04    MOV ECX,DWORD PTR SS:[ESP+4]
004010C6  |.  85C9       TEST ECX,ECX
004010C8  |.  8948 04    MOV DWORD PTR DS:[EAX+4],ECX
004010CB  |.  C700 F08D4C00 MOV DWORD PTR DS:[EAX],OFFSET ProgMan.??>
004010D1  |.  0F94C1       SETE CL
004010D4  |.  8848 08    MOV BYTE PTR DS:[EAX+8],CL
004010D7  \.  C2 0400    RETN 4
004010DA    90          NOP
004010DB    90          NOP
004010DC    90          NOP
004010DD    90          NOP
004010DE    90          NOP
004010DF    90          NOP
004010E0 >/$  56          PUSH ESI
004010E1  |.  8BF1       MOV ESI,ECX
004010E3  |.  8B46 04    MOV EAX,DWORD PTR DS:[ESI+4]
004010E6  |.  C706 F08D4C00 MOV DWORD PTR DS:[ESI],OFFSET ProgMan.??>
004010EC  |.  85C0       TEST EAX,EAX
004010EE  |.  74 18       JE SHORT ProgMan.00401108
004010F0  |.  8A4E 08    MOV CL,BYTE PTR DS:[ESI+8]
004010F3  |.  84C9       TEST CL,CL
004010F5  |.  74 11       JE SHORT ProgMan.00401108
004010F7  |.  50          PUSH EAX                               ; /stream
004010F8  |.  FF15 A48A4C00 CALL DWORD PTR DS:[<&MSVCRT.fclose>]    ; \fclose
004010FE  |.  83C4 04    ADD ESP,4
00401101  |.  C746 04 00000>MOV DWORD PTR DS:[ESI+4],0
00401108  |>  C706 C08D4C00 MOV DWORD PTR DS:[ESI],OFFSET ProgMan.??>
0040110E  |.  5E          POP ESI
0040110F  \.  C3          RETN
00401110 >/$  56          PUSH ESI
00401111  |.  8BF1       MOV ESI,ECX
00401113  |.  8B46 04    MOV EAX,DWORD PTR DS:[ESI+4]
00401116  |.  85C0       TEST EAX,EAX
00401118  |.  74 06       JE SHORT ProgMan.00401120
0040111A  |.  32C0       XOR AL,AL
0040111C  |.  5E          POP ESI
0040111D  |.  C2 0800    RETN 8
00401120  |>  8B4424 0C    MOV EAX,DWORD PTR SS:[ESP+C]
00401124  |.  8B4C24 08    MOV ECX,DWORD PTR SS:[ESP+8]
00401128  |.  50          PUSH EAX                               ; /mode
00401129  |.  51          PUSH ECX                               ; |path
0040112A  |.  FF15 A88A4C00 CALL DWORD PTR DS:[<&MSVCRT.fopen>]    ; \fopen
00401130  |.  83C4 08    ADD ESP,8
00401133  |.  8946 04    MOV DWORD PTR DS:[ESI+4],EAX
00401136  |.  85C0       TEST EAX,EAX
00401138  |.  75 06       JNZ SHORT ProgMan.00401140
0040113A  |.  32C0       XOR AL,AL
0040113C  |.  5E          POP ESI
0040113D  |.  C2 0800    RETN 8
00401140  |>  B0 01       MOV AL,1
00401142  |.  8846 08    MOV BYTE PTR DS:[ESI+8],AL
00401145  |.  5E          POP ESI
00401146  \.  C2 0800    RETN 8
00401149    90          NOP
0040114A    90          NOP
0040114B    90          NOP
0040114C    90          NOP
0040114D    90          NOP
0040114E    90          NOP
0040114F    90          NOP
00401150 >/$  56          PUSH ESI
00401151  |.  8BF1       MOV ESI,ECX
00401153  |.  33C0       XOR EAX,EAX
00401155  |.  8B4E 04    MOV ECX,DWORD PTR DS:[ESI+4]
00401158  |.  85C9       TEST ECX,ECX
0040115A  |.  74 18       JE SHORT ProgMan.00401174
0040115C  |.  8A56 08    MOV DL,BYTE PTR DS:[ESI+8]
0040115F  |.  84D2       TEST DL,DL
00401161  |.  74 11       JE SHORT ProgMan.00401174
00401163  |.  51          PUSH ECX                               ; /stream
00401164  |.  FF15 A48A4C00 CALL DWORD PTR DS:[<&MSVCRT.fclose>]    ; \fclose
0040116A  |.  83C4 04    ADD ESP,4
0040116D  |.  C746 04 00000>MOV DWORD PTR DS:[ESI+4],0
00401174  |>  33C9       XOR ECX,ECX
00401176  |.  5E          POP ESI
00401177  |.  85C0       TEST EAX,EAX
00401179  |.  0F94C1       SETE CL
0040117C  |.  8AC1       MOV AL,CL
0040117E  \.  C3          RETN
0040117F    90          NOP
00401180 >/$  8B41 04    MOV EAX,DWORD PTR DS:[ECX+4]
00401183  |.  85C0       TEST EAX,EAX
00401185  |.  75 03       JNZ SHORT ProgMan.0040118A
00401187  |.  C2 0C00    RETN 0C
0040118A  |>  8B4C24 08    MOV ECX,DWORD PTR SS:[ESP+8]
0040118E  |.  8B5424 04    MOV EDX,DWORD PTR SS:[ESP+4]
00401192  |.  50          PUSH EAX                               ; /stream
00401193  |.  8B4424 10    MOV EAX,DWORD PTR SS:[ESP+10]          ; |
00401197  |.  50          PUSH EAX                               ; |n
00401198  |.  51          PUSH ECX                               ; |size
00401199  |.  52          PUSH EDX                               ; |ptr
0040119A  |.  FF15 AC8A4C00 CALL DWORD PTR DS:[<&MSVCRT.fread>]    ; \fread
004011A0  |.  83C4 10    ADD ESP,10
004011A3  \.  C2 0C00    RETN 0C
004011A6    90          NOP
004011A7    90          NOP
004011A8    90          NOP
004011A9    90          NOP
004011AA    90          NOP
004011AB    90          NOP
004011AC    90          NOP
004011AD    90          NOP
004011AE    90          NOP
004011AF    90          NOP
004011B0 >/$  8B41 04    MOV EAX,DWORD PTR DS:[ECX+4]
004011B3  |.  85C0       TEST EAX,EAX
004011B5  |.  75 03       JNZ SHORT ProgMan.004011BA
004011B7  |.  C2 0C00    RETN 0C
004011BA  |>  8B4C24 08    MOV ECX,DWORD PTR SS:[ESP+8]
004011BE  |.  8B5424 04    MOV EDX,DWORD PTR SS:[ESP+4]
004011C2  |.  50          PUSH EAX                               ; /stream
004011C3  |.  8B4424 10    MOV EAX,DWORD PTR SS:[ESP+10]          ; |
004011C7  |.  50          PUSH EAX                               ; |n
004011C8  |.  51          PUSH ECX                               ; |size
004011C9  |.  52          PUSH EDX                               ; |ptr
004011CA  |.  FF15 B08A4C00 CALL DWORD PTR DS:[<&MSVCRT.fwrite>]    ; \fwrite
004011D0  |.  83C4 10    ADD ESP,10
004011D3  \.  C2 0C00    RETN 0C
004011D6    90          NOP
004011D7    90          NOP
004011D8    90          NOP
004011D9    90          NOP
004011DA    90          NOP
004011DB    90          NOP
004011DC    90          NOP
004011DD    90          NOP
004011DE    90          NOP
004011DF    90          NOP
004011E0 >/$  8B41 04    MOV EAX,DWORD PTR DS:[ECX+4]
004011E3  |.  85C0       TEST EAX,EAX
004011E5  |.  75 05       JNZ SHORT ProgMan.004011EC
004011E7  |.  32C0       XOR AL,AL
004011E9  |.  C2 0800    RETN 8
004011EC  |>  8B4C24 08    MOV ECX,DWORD PTR SS:[ESP+8]
004011F0  |.  8B5424 04    MOV EDX,DWORD PTR SS:[ESP+4]
004011F4  |.  51          PUSH ECX                               ; /whence
004011F5  |.  52          PUSH EDX                               ; |offset
004011F6  |.  50          PUSH EAX                               ; |stream
004011F7  |.  FF15 B48A4C00 CALL DWORD PTR DS:[<&MSVCRT.fseek>]    ; \fseek
004011FD  |.  83C4 0C    ADD ESP,0C
00401200  |.  F7D8       NEG EAX
00401202  |.  1BC0       SBB EAX,EAX
00401204  |.  40          INC EAX
00401205  \.  C2 0800    RETN 8
00401208    90          NOP
00401209    90          NOP
0040120A    90          NOP
0040120B    90          NOP
0040120C    90          NOP
0040120D    90          NOP
0040120E    90          NOP
0040120F    90          NOP
00401210 >/$  8B41 04    MOV EAX,DWORD PTR DS:[ECX+4]
00401213  |.  85C0       TEST EAX,EAX
00401215  |.  75 01       JNZ SHORT ProgMan.00401218
00401217  |.  C3          RETN
00401218  |>  50          PUSH EAX                               ; /stream
00401219  |.  FF15 B88A4C00 CALL DWORD PTR DS:[<&MSVCRT.ftell>]    ; \ftell
0040121F  |.  83C4 04    ADD ESP,4
00401222  \.  C3          RETN
00401223    90          NOP
00401224    90          NOP
00401225    90          NOP
00401226    90          NOP
00401227    90          NOP
00401228    90          NOP
00401229    90          NOP
0040122A    90          NOP
0040122B    90          NOP
0040122C    90          NOP
0040122D    90          NOP
0040122E    90          NOP
0040122F    90          NOP
00401230 >/$  56          PUSH ESI
00401231  |.  8BF1       MOV ESI,ECX
00401233  |.  8B46 04    MOV EAX,DWORD PTR DS:[ESI+4]
00401236  |.  85C0       TEST EAX,EAX
00401238  |.  75 05       JNZ SHORT ProgMan.0040123F
0040123A  |.  83C8 FF    OR EAX,FFFFFFFF
0040123D  |.  5E          POP ESI
0040123E  |.  C3          RETN
0040123F  |>  53          PUSH EBX
00401240  |.  55          PUSH EBP
00401241  |.  57          PUSH EDI
00401242  |.  8B3D B88A4C00 MOV EDI,DWORD PTR DS:[<&MSVCRT.ftell>] ;  msvcrt.ftell
00401248  |.  50          PUSH EAX                               ; /stream
00401249  |.  FFD7       CALL EDI                               ; \ftell
0040124B  |.  8B2D B48A4C00 MOV EBP,DWORD PTR DS:[<&MSVCRT.fseek>] ;  msvcrt.fseek
00401251  |.  8BD8       MOV EBX,EAX
00401253  |.  8B46 04    MOV EAX,DWORD PTR DS:[ESI+4]
00401256  |.  6A 02       PUSH 2                                  ; /whence = SEEK_END
00401258  |.  6A 00       PUSH 0                                  ; |offset = 0
0040125A  |.  50          PUSH EAX                               ; |stream
0040125B  |.  FFD5       CALL EBP                               ; \fseek
0040125D  |.  8B4E 04    MOV ECX,DWORD PTR DS:[ESI+4]
00401260  |.  51          PUSH ECX
00401261  |.  FFD7       CALL EDI
00401263  |.  8B56 04    MOV EDX,DWORD PTR DS:[ESI+4]
00401266  |.  6A 00       PUSH 0
00401268  |.  53          PUSH EBX
00401269  |.  52          PUSH EDX
0040126A  |.  8BF8       MOV EDI,EAX
0040126C  |.  FFD5       CALL EBP
0040126E  |.  83C4 20    ADD ESP,20
00401271  |.  8BC7       MOV EAX,EDI
00401273  |.  5F          POP EDI
00401274  |.  5D          POP EBP
00401275  |.  5B          POP EBX
00401276  |.  5E          POP ESI
00401277  \.  C3          RETN
00401278    90          NOP
00401279    90          NOP
0040127A    90          NOP
0040127B    90          NOP
0040127C    90          NOP
0040127D    90          NOP
0040127E    90          NOP
0040127F    90          NOP
00401280 >/$  8B41 04    MOV EAX,DWORD PTR DS:[ECX+4]
00401283  |.  85C0       TEST EAX,EAX
00401285  |.  75 03       JNZ SHORT ProgMan.0040128A
00401287  |.  32C0       XOR AL,AL
00401289  |.  C3          RETN
0040128A  |>  50          PUSH EAX                               ; /stream
0040128B  |.  FF15 BC8A4C00 CALL DWORD PTR DS:[<&MSVCRT.fflush>]    ; \fflush
00401291  |.  83C4 04    ADD ESP,4
00401294  |.  F7D8       NEG EAX
00401296  |.  1BC0       SBB EAX,EAX
00401298  |.  40          INC EAX
00401299  \.  C3          RETN
0040129A    90          NOP
0040129B    90          NOP
0040129C    90          NOP
0040129D    90          NOP
0040129E    90          NOP
0040129F    90          NOP
004012A0 >/$  8B41 04    MOV EAX,DWORD PTR DS:[ECX+4]
004012A3  |.  85C0       TEST EAX,EAX
004012A5  |.  75 03       JNZ SHORT ProgMan.004012AA
004012A7  |.  B0 01       MOV AL,1
004012A9  |.  C3          RETN
004012AA  |>  8B40 0C    MOV EAX,DWORD PTR DS:[EAX+C]
004012AD  |.  C1E8 04    SHR EAX,4
004012B0  |.  83E0 01    AND EAX,1
004012B3  \.  C3          RETN
004012B4    90          NOP
004012B5    90          NOP
004012B6    90          NOP
004012B7    90          NOP
004012B8    90          NOP
004012B9    90          NOP
004012BA    90          NOP
004012BB    90          NOP
004012BC    90          NOP
004012BD    90          NOP
004012BE    90          NOP
004012BF    90          NOP
004012C0 >/$  8B41 04    MOV EAX,DWORD PTR DS:[ECX+4]
004012C3  |.  85C0       TEST EAX,EAX
004012C5  |.  75 04       JNZ SHORT ProgMan.004012CB
004012C7  |.  83C8 FF    OR EAX,FFFFFFFF
004012CA  |.  C3          RETN
004012CB  |>  8B40 0C    MOV EAX,DWORD PTR DS:[EAX+C]
004012CE  |.  83E0 20    AND EAX,20
004012D1  \.  C3          RETN
004012D2    90          NOP
004012D3    90          NOP
004012D4    90          NOP
004012D5    90          NOP
004012D6    90          NOP
004012D7    90          NOP
004012D8    90          NOP
004012D9    90          NOP
004012DA    90          NOP
004012DB    90          NOP
004012DC    90          NOP
004012DD    90          NOP
004012DE    90          NOP
004012DF    90          NOP
004012E0 >/$  8B41 04    MOV EAX,DWORD PTR DS:[ECX+4]
004012E3  |.  85C0       TEST EAX,EAX
004012E5  |.  75 05       JNZ SHORT ProgMan.004012EC
004012E7  |.  32C0       XOR AL,AL
004012E9  |.  C2 0400    RETN 4
004012EC  |>  56          PUSH ESI
004012ED  |.  8B7424 08    MOV ESI,DWORD PTR SS:[ESP+8]
004012F1  |.  81E6 FF000000 AND ESI,0FF
004012F7  |.  50          PUSH EAX                               ; /stream
004012F8  |.  56          PUSH ESI                               ; |c
004012F9  |.  FF15 C08A4C00 CALL DWORD PTR DS:[<&MSVCRT.fputc>]    ; \putc
004012FF  |.  83C4 08    ADD ESP,8
00401302  |.  33C9       XOR ECX,ECX
00401304  |.  3BC6       CMP EAX,ESI
00401306  |.  0F94C1       SETE CL
00401309  |.  8AC1       MOV AL,CL
0040130B  |.  5E          POP ESI
0040130C  \.  C2 0400    RETN 4
0040130F    90          NOP
00401310 >/$  8B41 04    MOV EAX,DWORD PTR DS:[ECX+4]
00401313  |.  85C0       TEST EAX,EAX
00401315  |.  75 04       JNZ SHORT ProgMan.0040131B
00401317  |.  83C8 FF    OR EAX,FFFFFFFF
0040131A  |.  C3          RETN
0040131B  |>  50          PUSH EAX                               ; /stream
0040131C  |.  FF15 C48A4C00 CALL DWORD PTR DS:[<&MSVCRT.getc>]    ; \getc
00401322  |.  83C4 04    ADD ESP,4
00401325  \.  C3          RETN
00401326    90          NOP
00401327    90          NOP
00401328    90          NOP
00401329    90          NOP
0040132A    90          NOP
0040132B    90          NOP
0040132C    90          NOP
0040132D    90          NOP
0040132E    90          NOP
0040132F    90          NOP
00401330 >/$  8BC1       MOV EAX,ECX
00401332  |.  8B4C24 04    MOV ECX,DWORD PTR SS:[ESP+4]
00401336  |.  C700 C08D4C00 MOV DWORD PTR DS:[EAX],OFFSET ProgMan.??>
0040133C  |.  8B51 04    MOV EDX,DWORD PTR DS:[ECX+4]
0040133F  |.  8950 04    MOV DWORD PTR DS:[EAX+4],EDX
00401342  |.  8A49 08    MOV CL,BYTE PTR DS:[ECX+8]
00401345  |.  8848 08    MOV BYTE PTR DS:[EAX+8],CL
00401348  |.  C700 F08D4C00 MOV DWORD PTR DS:[EAX],OFFSET ProgMan.??>
0040134E  \.  C2 0400    RETN 4
00401351    90          NOP
00401352    90          NOP
00401353    90          NOP
00401354    90          NOP
00401355    90          NOP
00401356    90          NOP
00401357    90          NOP
00401358    90          NOP
00401359    90          NOP
0040135A    90          NOP
0040135B    90          NOP
0040135C    90          NOP
0040135D    90          NOP
0040135E    90          NOP
0040135F    90          NOP
00401360 >/$  8BC1       MOV EAX,ECX
00401362  |.  8B4C24 04    MOV ECX,DWORD PTR SS:[ESP+4]
00401366  |.  8B51 04    MOV EDX,DWORD PTR DS:[ECX+4]
00401369  |.  8950 04    MOV DWORD PTR DS:[EAX+4],EDX
0040136C  |.  8A49 08    MOV CL,BYTE PTR DS:[ECX+8]
0040136F  |.  8848 08    MOV BYTE PTR DS:[EAX+8],CL
00401372  \.  C2 0400    RETN 4
00401375    90          NOP
00401376    90          NOP
00401377    90          NOP
00401378    90          NOP
00401379    90          NOP
0040137A    90          NOP
0040137B    90          NOP
0040137C    90          NOP
0040137D    90          NOP
0040137E    90          NOP
0040137F    90          NOP
00401380 >/$  6A 00       PUSH 0
00401382  |.  E8 39FDFFFF CALL ProgMan.??0CxIOFile@@QAE@PAU_iobuf@>
00401387  \.  C3          RETN
00401388    90          NOP
00401389    90          NOP
0040138A    90          NOP
0040138B    90          NOP
0040138C    90          NOP
0040138D    90          NOP
0040138E    90          NOP
0040138F    90          NOP
00401390 .  53          PUSH EBX
00401391 .  8A5C24 08    MOV BL,BYTE PTR SS:[ESP+8]
00401395 .  56          PUSH ESI
00401396 .  8BF1       MOV ESI,ECX
00401398 .  F6C3 02    TEST BL,2
0040139B .  74 2B       JE SHORT ProgMan.004013C8
0040139D .  8B46 FC    MOV EAX,DWORD PTR DS:[ESI-4]
004013A0 .  57          PUSH EDI
004013A1 .  8D7E FC    LEA EDI,DWORD PTR DS:[ESI-4]
004013A4 .  68 E0104000 PUSH ProgMan.??1CxIOFile@@UAE@XZ
004013A9 .  50          PUSH EAX
004013AA .  6A 0C       PUSH 0C
004013AC .  56          PUSH ESI
004013AD .  E8 12D80B00 CALL ProgMan.004BEBC4
004013B2 .  F6C3 01    TEST BL,1
004013B5 .  74 09       JE SHORT ProgMan.004013C0
004013B7 .  57          PUSH EDI
004013B8 .  E8 73CC0B00 CALL <JMP.&MFC42.#825_??3@YAXPAX@Z>
004013BD .  83C4 04    ADD ESP,4
004013C0 >  8BC7       MOV EAX,EDI
004013C2 .  5F          POP EDI
004013C3 .  5E          POP ESI
004013C4 .  5B          POP EBX
004013C5 .  C2 0400    RETN 4
004013C8 >  8BCE       MOV ECX,ESI
004013CA .  E8 11FDFFFF CALL ProgMan.??1CxIOFile@@UAE@XZ
004013CF .  F6C3 01    TEST BL,1
004013D2 .  74 09       JE SHORT ProgMan.004013DD
004013D4 .  56          PUSH ESI
004013D5 .  E8 56CC0B00 CALL <JMP.&MFC42.#825_??3@YAXPAX@Z>
004013DA .  83C4 04    ADD ESP,4
004013DD >  8BC6       MOV EAX,ESI
004013DF .  5E          POP ESI
004013E0 .  5B          POP EBX
004013E1 .  C2 0400    RETN 4
004013E4    90          NOP
004013E5    90          NOP
004013E6    90          NOP
004013E7    90          NOP
004013E8    90          NOP
004013E9    90          NOP
004013EA    90          NOP
004013EB    90          NOP
004013EC    90          NOP
004013ED    90          NOP
004013EE    90          NOP
004013EF    90          NOP
004013F0 >/$  8B5424 08    MOV EDX,DWORD PTR SS:[ESP+8]
004013F4  |.  8BC1       MOV EAX,ECX
004013F6  |.  8B4C24 04    MOV ECX,DWORD PTR SS:[ESP+4]
004013FA  |.  85C9       TEST ECX,ECX
004013FC  |.  8948 04    MOV DWORD PTR DS:[EAX+4],ECX
004013FF  |.  C700 208E4C00 MOV DWORD PTR DS:[EAX],OFFSET ProgMan.??>
00401405  |.  0F94C1       SETE CL
00401408  |.  C740 10 00000>MOV DWORD PTR DS:[EAX+10],0
0040140F  |.  8950 14    MOV DWORD PTR DS:[EAX+14],EDX
00401412  |.  8950 08    MOV DWORD PTR DS:[EAX+8],EDX
00401415  |.  8848 0C    MOV BYTE PTR DS:[EAX+C],CL
00401418  \.  C2 0800    RETN 8
0040141B    90          NOP
0040141C    90          NOP
0040141D    90          NOP
0040141E    90          NOP
0040141F    90          NOP
00401420 >/$  56          PUSH ESI
00401421  |.  8BF1       MOV ESI,ECX
00401423  |.  8B46 04    MOV EAX,DWORD PTR DS:[ESI+4]
00401426  |.  C706 208E4C00 MOV DWORD PTR DS:[ESI],OFFSET ProgMan.??>
0040142C  |.  85C0       TEST EAX,EAX
0040142E  |.  74 1F       JE SHORT ProgMan.0040144F
00401430  |.  8A4E 0C    MOV CL,BYTE PTR DS:[ESI+C]
00401433  |.  84C9       TEST CL,CL
00401435  |.  74 18       JE SHORT ProgMan.0040144F
00401437  |.  50          PUSH EAX                               ; /block
00401438  |.  FF15 C88A4C00 CALL DWORD PTR DS:[<&MSVCRT.free>]    ; \free
0040143E  |.  83C4 04    ADD ESP,4
00401441  |.  C746 04 00000>MOV DWORD PTR DS:[ESI+4],0
00401448  |.  C746 08 00000>MOV DWORD PTR DS:[ESI+8],0
0040144F  |>  C706 C08D4C00 MOV DWORD PTR DS:[ESI],OFFSET ProgMan.??>
00401455  |.  5E          POP ESI
00401456  \.  C3          RETN
00401457    90          NOP
00401458    90          NOP
00401459    90          NOP
0040145A    90          NOP
0040145B    90          NOP
0040145C    90          NOP
0040145D    90          NOP
0040145E    90          NOP
0040145F    90          NOP
00401460 >/$  56          PUSH ESI
00401461  |.  8BF1       MOV ESI,ECX
00401463  |.  8B46 04    MOV EAX,DWORD PTR DS:[ESI+4]
00401466  |.  85C0       TEST EAX,EAX
00401468  |.  74 1F       JE SHORT ProgMan.00401489
0040146A  |.  8A4E 0C    MOV CL,BYTE PTR DS:[ESI+C]
0040146D  |.  84C9       TEST CL,CL
0040146F  |.  74 18       JE SHORT ProgMan.00401489
00401471  |.  50          PUSH EAX                               ; /block
00401472  |.  FF15 C88A4C00 CALL DWORD PTR DS:[<&MSVCRT.free>]    ; \free
00401478  |.  83C4 04    ADD ESP,4
0040147B  |.  C746 04 00000>MOV DWORD PTR DS:[ESI+4],0
00401482  |.  C746 08 00000>MOV DWORD PTR DS:[ESI+8],0
00401489  |>  B0 01       MOV AL,1
0040148B  |.  5E          POP ESI
0040148C  \.  C3          RETN
0040148D    90          NOP
0040148E    90          NOP
0040148F    90          NOP
00401490 >/$  56          PUSH ESI
00401491  |.  8BF1       MOV ESI,ECX
00401493  |.  8B46 04    MOV EAX,DWORD PTR DS:[ESI+4]
00401496  |.  85C0       TEST EAX,EAX
00401498  |.  74 04       JE SHORT ProgMan.0040149E
0040149A  |.  32C0       XOR AL,AL
0040149C  |.  5E          POP ESI
0040149D  |.  C3          RETN
0040149E  |>  6A 00       PUSH 0                                  ; /size = 0
004014A0  |.  C746 14 00000>MOV DWORD PTR DS:[ESI+14],0             ; |
004014A7  |.  C746 08 00000>MOV DWORD PTR DS:[ESI+8],0             ; |
004014AE  |.  C746 10 00000>MOV DWORD PTR DS:[ESI+10],0             ; |
004014B5  |.  FF15 CC8A4C00 CALL DWORD PTR DS:[<&MSVCRT.malloc>]    ; \malloc
004014BB  |.  83C4 04    ADD ESP,4
004014BE  |.  33C9       XOR ECX,ECX
004014C0  |.  85C0       TEST EAX,EAX
004014C2  |.  0F95C1       SETNE CL
004014C5  |.  8946 04    MOV DWORD PTR DS:[ESI+4],EAX
004014C8  |.  C646 0C 01 MOV BYTE PTR DS:[ESI+C],1
004014CC  |.  8AC1       MOV AL,CL
004014CE  |.  5E          POP ESI
004014CF  \.  C3          RETN
004014D0 >/$  8B41 04    MOV EAX,DWORD PTR DS:[ECX+4]
004014D3  |.  C641 0C 00 MOV BYTE PTR DS:[ECX+C],0
004014D7  \.  C3          RETN
004014D8    90          NOP
004014D9    90          NOP
004014DA    90          NOP
004014DB    90          NOP
004014DC    90          NOP
004014DD    90          NOP
004014DE    90          NOP
004014DF    90          NOP
004014E0 >/$  8BC1       MOV EAX,ECX
004014E2  |.  8B4C24 04    MOV ECX,DWORD PTR SS:[ESP+4]
004014E6  |.  C700 C08D4C00 MOV DWORD PTR DS:[EAX],OFFSET ProgMan.??>
004014EC  |.  8B51 04    MOV EDX,DWORD PTR DS:[ECX+4]
004014EF  |.  8950 04    MOV DWORD PTR DS:[EAX+4],EDX
004014F2  |.  8B51 08    MOV EDX,DWORD PTR DS:[ECX+8]
004014F5  |.  8950 08    MOV DWORD PTR DS:[EAX+8],EDX
004014F8  |.  8A51 0C    MOV DL,BYTE PTR DS:[ECX+C]
004014FB  |.  8850 0C    MOV BYTE PTR DS:[EAX+C],DL
004014FE  |.  8B51 10    MOV EDX,DWORD PTR DS:[ECX+10]
00401501  |.  8950 10    MOV DWORD PTR DS:[EAX+10],EDX
00401504  |.  8B49 14    MOV ECX,DWORD PTR DS:[ECX+14]
00401507  |.  8948 14    MOV DWORD PTR DS:[EAX+14],ECX
0040150A  |.  C700 208E4C00 MOV DWORD PTR DS:[EAX],OFFSET ProgMan.??>
00401510  \.  C2 0400    RETN 4
00401513    90          NOP
00401514    90          NOP
00401515    90          NOP
00401516    90          NOP
00401517    90          NOP
00401518    90          NOP
00401519    90          NOP
0040151A    90          NOP
0040151B    90          NOP
0040151C    90          NOP
0040151D    90          NOP
0040151E    90          NOP
0040151F    90          NOP
00401520 >/$  8BC1       MOV EAX,ECX
00401522  |.  8B4C24 04    MOV ECX,DWORD PTR SS:[ESP+4]
00401526  |.  8B51 04    MOV EDX,DWORD PTR DS:[ECX+4]
00401529  |.  8950 04    MOV DWORD PTR DS:[EAX+4],EDX
0040152C  |.  8B51 08    MOV EDX,DWORD PTR DS:[ECX+8]
0040152F  |.  8950 08    MOV DWORD PTR DS:[EAX+8],EDX
00401532  |.  8A51 0C    MOV DL,BYTE PTR DS:[ECX+C]
00401535  |.  8850 0C    MOV BYTE PTR DS:[EAX+C],DL
00401538  |.  8B51 10    MOV EDX,DWORD PTR DS:[ECX+10]
0040153B  |.  8950 10    MOV DWORD PTR DS:[EAX+10],EDX
0040153E  |.  8B49 14    MOV ECX,DWORD PTR DS:[ECX+14]
00401541  |.  8948 14    MOV DWORD PTR DS:[EAX+14],ECX
00401544  \.  C2 0400    RETN 4
00401547    90          NOP
00401548    90          NOP
00401549    90          NOP
0040154A    90          NOP
0040154B    90          NOP
0040154C    90          NOP
0040154D    90          NOP
0040154E    90          NOP
0040154F    90          NOP
00401550 >/$  6A 00       PUSH 0
00401552  |.  6A 00       PUSH 0
00401554  |.  E8 97FEFFFF CALL ProgMan.??0CxMemFile@@QAE@PAEK@Z
00401559  \.  C3          RETN
0040155A    90          NOP
0040155B    90          NOP
0040155C    90          NOP
0040155D    90          NOP
0040155E    90          NOP
0040155F    90          NOP
00401560 .  53          PUSH EBX
00401561 .  8A5C24 08    MOV BL,BYTE PTR SS:[ESP+8]
00401565 .  56          PUSH ESI
00401566 .  8BF1       MOV ESI,ECX
00401568 .  F6C3 02    TEST BL,2
0040156B .  74 2B       JE SHORT ProgMan.00401598
0040156D .  8B46 FC    MOV EAX,DWORD PTR DS:[ESI-4]
00401570 .  57          PUSH EDI
00401571 .  8D7E FC    LEA EDI,DWORD PTR DS:[ESI-4]
00401574 .  68 20144000 PUSH ProgMan.??1CxMemFile@@UAE@XZ
00401579 .  50          PUSH EAX
0040157A .  6A 18       PUSH 18
0040157C .  56          PUSH ESI
0040157D .  E8 42D60B00 CALL ProgMan.004BEBC4
00401582 .  F6C3 01    TEST BL,1
00401585 .  74 09       JE SHORT ProgMan.00401590
00401587 .  57          PUSH EDI
00401588 .  E8 A3CA0B00 CALL <JMP.&MFC42.#825_??3@YAXPAX@Z>
0040158D .  83C4 04    ADD ESP,4
00401590 >  8BC7       MOV EAX,EDI
00401592 .  5F          POP EDI
00401593 .  5E          POP ESI
00401594 .  5B          POP EBX
00401595 .  C2 0400    RETN 4
00401598 >  8BCE       MOV ECX,ESI
0040159A .  E8 81FEFFFF CALL ProgMan.??1CxMemFile@@UAE@XZ
0040159F .  F6C3 01    TEST BL,1
004015A2 .  74 09       JE SHORT ProgMan.004015AD
004015A4 .  56          PUSH ESI
004015A5 .  E8 86CA0B00 CALL <JMP.&MFC42.#825_??3@YAXPAX@Z>
004015AA .  83C4 04    ADD ESP,4
004015AD >  8BC6       MOV EAX,ESI
004015AF .  5E          POP ESI
004015B0 .  5B          POP EBX
004015B1 .  C2 0400    RETN 4
004015B4    90          NOP
004015B5    90          NOP
004015B6    90          NOP
004015B7    90          NOP
004015B8    90          NOP
004015B9    90          NOP
004015BA    90          NOP
004015BB    90          NOP
004015BC    90          NOP
004015BD    90          NOP
004015BE    90          NOP
004015BF    90          NOP
004015C0 >/$  8B41 04    MOV EAX,DWORD PTR DS:[ECX+4]
004015C3  \.  C3          RETN
004015C4    90          NOP
004015C5    90          NOP
004015C6    90          NOP
004015C7    90          NOP
004015C8    90          NOP
004015C9    90          NOP
004015CA    90          NOP
004015CB    90          NOP
004015CC    90          NOP
004015CD    90          NOP
004015CE    90          NOP
004015CF    90          NOP
004015D0 >/$  8B41 10    MOV EAX,DWORD PTR DS:[ECX+10]
004015D3  \.  C3          RETN
004015D4    90          NOP
004015D5    90          NOP
004015D6    90          NOP
004015D7    90          NOP
004015D8    90          NOP
004015D9    90          NOP
004015DA    90          NOP
004015DB    90          NOP
004015DC    90          NOP
004015DD    90          NOP
004015DE    90          NOP
004015DF    90          NOP
004015E0 >/$  8B41 0C    MOV EAX,DWORD PTR DS:[ECX+C]
004015E3  \.  C3          RETN
004015E4    90          NOP
004015E5    90          NOP
004015E6    90          NOP
004015E7    90          NOP
004015E8    90          NOP
004015E9    90          NOP
004015EA    90          NOP
004015EB    90          NOP
004015EC    90          NOP
004015ED    90          NOP
004015EE    90          NOP
004015EF    90          NOP
004015F0 >/$  8B41 30    MOV EAX,DWORD PTR DS:[ECX+30]
004015F3  \.  C3          RETN
004015F4    90          NOP
004015F5    90          NOP
004015F6    90          NOP
004015F7    90          NOP
004015F8    90          NOP
004015F9    90          NOP
004015FA    90          NOP
004015FB    90          NOP
004015FC    90          NOP
004015FD    90          NOP
004015FE    90          NOP
004015FF    90          NOP
00401600 >/$  8B41 28    MOV EAX,DWORD PTR DS:[ECX+28]
00401603  \.  C3          RETN
00401604    90          NOP
00401605    90          NOP
00401606    90          NOP
00401607    90          NOP
00401608    90          NOP
00401609    90          NOP
0040160A    90          NOP
0040160B    90          NOP
0040160C    90          NOP
0040160D    90          NOP
0040160E    90          NOP
0040160F    90          NOP
00401610 >/$  66:8B41 16 MOV AX,WORD PTR DS:[ECX+16]
00401614  \.  C3          RETN
00401615    90          NOP
00401616    90          NOP
00401617    90          NOP
00401618    90          NOP
00401619    90          NOP
0040161A    90          NOP
0040161B    90          NOP
0040161C    90          NOP
0040161D    90          NOP
0040161E    90          NOP
0040161F    90          NOP
00401620 >/$  8B41 3C    MOV EAX,DWORD PTR DS:[ECX+3C]
00401623  \.  C3          RETN
00401624    90          NOP
00401625    90          NOP
00401626    90          NOP
00401627    90          NOP
00401628    90          NOP
00401629    90          NOP
0040162A    90          NOP
0040162B    90          NOP
0040162C    90          NOP
0040162D    90          NOP
0040162E    90          NOP
0040162F    90          NOP
00401630 >/$  8D41 40    LEA EAX,DWORD PTR DS:[ECX+40]
00401633  \.  C3          RETN
00401634    90          NOP
00401635    90          NOP
00401636    90          NOP
00401637    90          NOP
00401638    90          NOP
00401639    90          NOP
0040163A    90          NOP
0040163B    90          NOP
0040163C    90          NOP
0040163D    90          NOP
0040163E    90          NOP
0040163F    90          NOP
00401640 >/$  8B81 5C010000 MOV EAX,DWORD PTR DS:[ECX+15C]
00401646  \.  C3          RETN
00401647    90          NOP
00401648    90          NOP
00401649    90          NOP
0040164A    90          NOP
0040164B    90          NOP
0040164C    90          NOP
0040164D    90          NOP
0040164E    90          NOP
0040164F    90          NOP
00401650 >/$  8B4424 04    MOV EAX,DWORD PTR SS:[ESP+4]
00401654  |.  8981 5C010000 MOV DWORD PTR DS:[ECX+15C],EAX
0040165A  \.  C2 0400    RETN 4
0040165D    90          NOP
0040165E    90          NOP
0040165F    90          NOP
00401660 >/$  8B5424 04    MOV EDX,DWORD PTR SS:[ESP+4]
00401664  |.  8B81 7C010000 MOV EAX,DWORD PTR DS:[ECX+17C]
0040166A  |.  8902       MOV DWORD PTR DS:[EDX],EAX
0040166C  |.  8B81 80010000 MOV EAX,DWORD PTR DS:[ECX+180]
00401672  |.  8B4C24 08    MOV ECX,DWORD PTR SS:[ESP+8]
00401676  |.  8901       MOV DWORD PTR DS:[ECX],EAX
00401678  \.  C2 0800    RETN 8
0040167B    90          NOP
0040167C    90          NOP
0040167D    90          NOP
0040167E    90          NOP
0040167F    90          NOP
00401680 >/$  8B4424 04    MOV EAX,DWORD PTR SS:[ESP+4]
00401684  |.  8B5424 08    MOV EDX,DWORD PTR SS:[ESP+8]
00401688  |.  8981 7C010000 MOV DWORD PTR DS:[ECX+17C],EAX
0040168E  |.  8991 80010000 MOV DWORD PTR DS:[ECX+180],EDX
00401694  \.  C2 0800    RETN 8
00401697    90          NOP
00401698    90          NOP
00401699    90          NOP
0040169A    90          NOP
0040169B    90          NOP
0040169C    90          NOP
0040169D    90          NOP
0040169E    90          NOP
0040169F    90          NOP
004016A0 >/$  8A81 50010000 MOV AL,BYTE PTR DS:[ECX+150]
004016A6  \.  C3          RETN
004016A7    90          NOP
004016A8    90          NOP
004016A9    90          NOP
004016AA    90          NOP
004016AB    90          NOP
004016AC    90          NOP
004016AD    90          NOP
004016AE    90          NOP
004016AF    90          NOP
004016B0 >/$  8A4424 04    MOV AL,BYTE PTR SS:[ESP+4]
004016B4  |.  8881 50010000 MOV BYTE PTR DS:[ECX+150],AL
004016BA  \.  C2 0400    RETN 4
004016BD    90          NOP
004016BE    90          NOP
004016BF    90          NOP
004016C0 >/$  8B81 60010000 MOV EAX,DWORD PTR DS:[ECX+160]
004016C6  \.  C3          RETN
004016C7    90          NOP
004016C8    90          NOP
004016C9    90          NOP
004016CA    90          NOP
004016CB    90          NOP
004016CC    90          NOP
004016CD    90          NOP
004016CE    90          NOP
004016CF    90          NOP
004016D0 >/$  8B81 64010000 MOV EAX,DWORD PTR DS:[ECX+164]
004016D6  \.  C3          RETN
004016D7    90          NOP
004016D8    90          NOP
004016D9    90          NOP
004016DA    90          NOP
004016DB    90          NOP
004016DC    90          NOP
004016DD    90          NOP
004016DE    90          NOP
004016DF    90          NOP
004016E0 >/$  8B81 40010000 MOV EAX,DWORD PTR DS:[ECX+140]
004016E6  \.  C3          RETN
004016E7    90          NOP
004016E8    90          NOP
004016E9    90          NOP
004016EA    90          NOP
004016EB    90          NOP
004016EC    90          NOP
004016ED    90          NOP
004016EE    90          NOP
004016EF    90          NOP
004016F0 >/$  8B81 44010000 MOV EAX,DWORD PTR DS:[ECX+144]
004016F6  \.  C3          RETN
004016F7    90          NOP
004016F8    90          NOP
004016F9    90          NOP
004016FA    90          NOP
004016FB    90          NOP
004016FC    90          NOP
004016FD    90          NOP
004016FE    90          NOP
004016FF    90          NOP
00401700 >/$  8B4424 04    MOV EAX,DWORD PTR SS:[ESP+4]
00401704  |.  8981 40010000 MOV DWORD PTR DS:[ECX+140],EAX
0040170A  \.  C2 0400    RETN 4
0040170D    90          NOP
0040170E    90          NOP
0040170F    90          NOP
00401710 >/$  8B4424 04    MOV EAX,DWORD PTR SS:[ESP+4]
00401714  |.  8981 44010000 MOV DWORD PTR DS:[ECX+144],EAX
0040171A  \.  C2 0400    RETN 4
0040171D    90          NOP
0040171E    90          NOP
0040171F    90          NOP
00401720 >/$  8B81 48010000 MOV EAX,DWORD PTR DS:[ECX+148]
00401726  \.  C3          RETN
00401727    90          NOP
00401728    90          NOP
00401729    90          NOP
0040172A    90          NOP
0040172B    90          NOP
0040172C    90          NOP
0040172D    90          NOP
0040172E    90          NOP
0040172F    90          NOP
00401730 >/$  8B4424 04    MOV EAX,DWORD PTR SS:[ESP+4]
00401734  |.  8981 48010000 MOV DWORD PTR DS:[ECX+148],EAX
0040173A  \.  C2 0400    RETN 4
0040173D    90          NOP
0040173E    90          NOP
0040173F    90          NOP
00401740 >/$  8B4424 04    MOV EAX,DWORD PTR SS:[ESP+4]
00401744  |.  8981 4C010000 MOV DWORD PTR DS:[ECX+14C],EAX
0040174A  \.  C2 0400    RETN 4
0040174D    90          NOP
0040174E    90          NOP
0040174F    90          NOP
00401750 >/$  8B91 48010000 MOV EDX,DWORD PTR DS:[ECX+148]
00401756  |.  33C0       XOR EAX,EAX
00401758  |.  85D2       TEST EDX,EDX
0040175A  |.  0F9DC0       SETGE AL
0040175D  \.  C3          RETN
0040175E    90          NOP
0040175F    90          NOP
00401760 >/$  8B51 28    MOV EDX,DWORD PTR DS:[ECX+28]
00401763  |.  33C0       XOR EAX,EAX
00401765  |.  85D2       TEST EDX,EDX
00401767  |.  0F95C0       SETNE AL
0040176A  \.  C3          RETN
0040176B    90          NOP
0040176C    90          NOP
0040176D    90          NOP
0040176E    90          NOP
0040176F    90          NOP
00401770 >/$  8B4424 08    MOV EAX,DWORD PTR SS:[ESP+8]
00401774  |.  56          PUSH ESI
00401775  |.  57          PUSH EDI
00401776  |.  8B7C24 14    MOV EDI,DWORD PTR SS:[ESP+14]
0040177A  |.  8B50 04    MOV EDX,DWORD PTR DS:[EAX+4]
0040177D  |.  8B30       MOV ESI,DWORD PTR DS:[EAX]
0040177F  |.  57          PUSH EDI                               ; /Arg6
00401780  |.  8B78 0C    MOV EDI,DWORD PTR DS:[EAX+C]          ; |
00401783  |.  8B40 08    MOV EAX,DWORD PTR DS:[EAX+8]          ; |
00401786  |.  2BFA       SUB EDI,EDX                            ; |
00401788  |.  2BC6       SUB EAX,ESI                            ; |
0040178A  |.  57          PUSH EDI                               ; |Arg5
0040178B  |.  50          PUSH EAX                               ; |Arg4
0040178C  |.  52          PUSH EDX                               ; |Arg3
0040178D  |.  8B5424 1C    MOV EDX,DWORD PTR SS:[ESP+1C]          ; |
00401791  |.  56          PUSH ESI                               ; |Arg2
00401792  |.  52          PUSH EDX                               ; |Arg1
00401793  |.  E8 48580300 CALL ProgMan.?Draw@CxImage@@QAEJPAUHDC__>; \?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@@Z
00401798  |.  5F          POP EDI
00401799  |.  5E          POP ESI
0040179A  \.  C2 0C00    RETN 0C
0040179D    90          NOP
0040179E    90          NOP
0040179F    90          NOP
004017A0 >/$  8B4424 08    MOV EAX,DWORD PTR SS:[ESP+8]
004017A4  |.  56          PUSH ESI
004017A5  |.  57          PUSH EDI
004017A6  |.  8B50 04    MOV EDX,DWORD PTR DS:[EAX+4]
004017A9  |.  8B30       MOV ESI,DWORD PTR DS:[EAX]
004017AB  |.  8B78 0C    MOV EDI,DWORD PTR DS:[EAX+C]
004017AE  |.  8B40 08    MOV EAX,DWORD PTR DS:[EAX+8]
004017B1  |.  2BFA       SUB EDI,EDX
004017B3  |.  2BC6       SUB EAX,ESI
004017B5  |.  57          PUSH EDI                               ; /Arg5
004017B6  |.  50          PUSH EAX                               ; |Arg4
004017B7  |.  52          PUSH EDX                               ; |Arg3
004017B8  |.  8B5424 18    MOV EDX,DWORD PTR SS:[ESP+18]          ; |
004017BC  |.  56          PUSH ESI                               ; |Arg2
004017BD  |.  52          PUSH EDX                               ; |Arg1
004017BE  |.  E8 6D710300 CALL ProgMan.?Stretch@CxImage@@QAEJPAUHD>; \?Stretch@CxImage@@QAEJPAUHDC__@@JJJJ@Z
004017C3  |.  5F          POP EDI
004017C4  |.  5E          POP ESI
004017C5  \.  C2 0800    RETN 8
004017C8    90          NOP
004017C9    90          NOP
004017CA    90          NOP
004017CB    90          NOP
004017CC    90          NOP
004017CD    90          NOP
004017CE    90          NOP
004017CF    90          NOP
004017D0 >/$  8B4424 08    MOV EAX,DWORD PTR SS:[ESP+8]
004017D4  |.  56          PUSH ESI
004017D5  |.  57          PUSH EDI
004017D6  |.  8B50 04    MOV EDX,DWORD PTR DS:[EAX+4]
004017D9  |.  8B30       MOV ESI,DWORD PTR DS:[EAX]
004017DB  |.  8B78 0C    MOV EDI,DWORD PTR DS:[EAX+C]
004017DE  |.  8B40 08    MOV EAX,DWORD PTR DS:[EAX+8]
004017E1  |.  2BFA       SUB EDI,EDX
004017E3  |.  2BC6       SUB EAX,ESI
004017E5  |.  57          PUSH EDI                               ; /Arg5
004017E6  |.  50          PUSH EAX                               ; |Arg4
004017E7  |.  52          PUSH EDX                               ; |Arg3
004017E8  |.  8B5424 18    MOV EDX,DWORD PTR SS:[ESP+18]          ; |
004017EC  |.  56          PUSH ESI                               ; |Arg2
004017ED  |.  52          PUSH EDX                               ; |Arg1
004017EE  |.  E8 FD6C0300 CALL ProgMan.?Draw2@CxImage@@QAEJPAUHDC_>; \?Draw2@CxImage@@QAEJPAUHDC__@@JJJJ@Z
004017F3  |.  5F          POP EDI
004017F4  |.  5E          POP ESI
004017F5  \.  C2 0800    RETN 8
004017F8    90          NOP
004017F9    90          NOP
004017FA    90          NOP
004017FB    90          NOP
004017FC    90          NOP
004017FD    90          NOP
004017FE    90          NOP
004017FF    90          NOP
00401800 >/$  8B51 04    MOV EDX,DWORD PTR DS:[ECX+4]
00401803  |.  33C0       XOR EAX,EAX
00401805  |.  85D2       TEST EDX,EDX
00401807  |.  0F95C0       SETNE AL
0040180A  \.  C3          RETN
0040180B    90          NOP
0040180C    90          NOP
0040180D    90          NOP
0040180E    90          NOP
0040180F    90          NOP
00401810 >/$  8A91 7A010000 MOV DL,BYTE PTR DS:[ECX+17A]
00401816  |.  33C0       XOR EAX,EAX
00401818  |.  84D2       TEST DL,DL
0040181A  |.  0F95C0       SETNE AL
0040181D  \.  C3          RETN
0040181E    90          NOP
0040181F    90          NOP
00401820 >/$  8A4424 04    MOV AL,BYTE PTR SS:[ESP+4]
00401824  |.  8881 7A010000 MOV BYTE PTR DS:[ECX+17A],AL
0040182A  \.  C2 0400    RETN 4
0040182D    90          NOP
0040182E    90          NOP
0040182F    90          NOP
00401830 >/$  8B81 58010000 MOV EAX,DWORD PTR DS:[ECX+158]
00401836  \.  C3          RETN
00401837    90          NOP
00401838    90          NOP
00401839    90          NOP
0040183A    90          NOP
0040183B    90          NOP
0040183C    90          NOP
0040183D    90          NOP
0040183E    90          NOP
0040183F    90          NOP
00401840 >/$  8B81 54010000 MOV EAX,DWORD PTR DS:[ECX+154]
00401846  \.  C3          RETN
00401847    90          NOP
00401848    90          NOP
00401849    90          NOP
0040184A    90          NOP
0040184B    90          NOP
0040184C    90          NOP
0040184D    90          NOP
0040184E    90          NOP
0040184F    90          NOP
00401850 >/$  8B4424 04    MOV EAX,DWORD PTR SS:[ESP+4]
00401854  |.  8981 54010000 MOV DWORD PTR DS:[ECX+154],EAX
0040185A  \.  C2 0400    RETN 4
0040185D    90          NOP
0040185E    90          NOP
0040185F    90          NOP
00401860 >/$  8B4424 08    MOV EAX,DWORD PTR SS:[ESP+8]
00401864  |.  50          PUSH EAX                               ; /Arg5
00401865  |.  8B4424 08    MOV EAX,DWORD PTR SS:[ESP+8]          ; |
00401869  |.  8B50 0C    MOV EDX,DWORD PTR DS:[EAX+C]          ; |
0040186C  |.  52          PUSH EDX                               ; |Arg4
0040186D  |.  8B50 08    MOV EDX,DWORD PTR DS:[EAX+8]          ; |

用OD打开后,有这样的代码??这样的有壳吗???

[课程]Linux pwn 探索篇！

收藏・0

免费・0

支持

最新回复 (8)
lovetj 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 13 粉丝 0 关注私信	lovetj 2 楼 75524269 E8 A245FEFF CALL MFC42.#5718_?RunModalLoop@CWnd@@QAEHK@Z 7552426E 8B46 20 MOV EAX,DWORD PTR DS:[ESI+20] 75524271 85C0 TEST EAX,EAX 75524273 74 36 JE SHORT MFC42.755242AB 75524275 68 97000000 PUSH 97 7552427A 6A 00 PUSH 0 7552427C 6A 00 PUSH 0 7552427E 6A 00 PUSH 0 75524280 6A 00 PUSH 0 75524282 6A 00 PUSH 0 75524284 8BCE MOV ECX,ESI 75524286 E8 95A40000 CALL MFC42.#6197_?SetWindowPos@CWnd@@QAEHPBV1@HHHHI@Z 7552428B EB 1E JMP SHORT MFC42.755242AB 7552428D 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28] 75524290 E8 2B66FDFF CALL MFC42.#2393_?Delete@CException@@QAEXXZ 75524295 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C] 75524298 C740 30 FFFFFFF>MOV DWORD PTR DS:[EAX+30],-1 7552429F B8 A5425275 MOV EAX,MFC42.755242A5 755242A4 C3 RETN 755242A5 8B75 E4 MOV ESI,DWORD PTR SS:[EBP-1C] 755242A8 8B5D DC MOV EBX,DWORD PTR SS:[EBP-24] 755242AB 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20] 755242AE 85C0 TEST EAX,EAX 755242B0 C745 FC FFFFFFF>MOV DWORD PTR SS:[EBP-4],-1 755242B7 74 09 JE SHORT MFC42.755242C2 755242B9 6A 01 PUSH 1 755242BB 53 PUSH EBX 755242BC FF15 34184E75 CALL DWORD PTR DS:[<&USER32.EnableWindow>] ; USER32.EnableWindow 755242C2 85DB TEST EBX,EBX 755242C4 74 12 JE SHORT MFC42.755242D8 755242C6 FF15 80174E75 CALL DWORD PTR DS:[<&USER32.GetActiveWindow>] ; USER32.GetActiveWindow 755242CC 3B46 20 CMP EAX,DWORD PTR DS:[ESI+20] 755242CF 75 07 JNZ SHORT MFC42.755242D8 755242D1 53 PUSH EBX 755242D2 FF15 64164E75 CALL DWORD PTR DS:[<&USER32.SetActiveWindow>] ; USER32.SetActiveWindow 755242D8 8B16 MOV EDX,DWORD PTR DS:[ESI] 755242DA 8BCE MOV ECX,ESI 755242DC FF52 60 CALL DWORD PTR DS:[EDX+60] 755242DF 8BCE MOV ECX,ESI 755242E1 E8 0AF8FFFF CALL MFC42.#5232_?PostModal@CDialog@@IAEXXZ 755242E6 8B46 44 MOV EAX,DWORD PTR DS:[ESI+44] 755242E9 85C0 TEST EAX,EAX 755242EB 74 0A JE SHORT MFC42.755242F7 755242ED 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18] 755242F0 50 PUSH EAX 755242F1 FF15 84124E75 CALL DWORD PTR DS:[<&KERNEL32.FreeResource>] ; kernel32.FreeResource 755242F7 8B46 30 MOV EAX,DWORD PTR DS:[ESI+30] 755242FA 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] 755242FD 5F POP EDI 755242FE 5E POP ESI 755242FF 64:890D 0000000>MOV DWORD PTR FS:[0],ECX 75524306 5B POP EBX 75524307 8BE5 MOV ESP,EBP 75524309 5D POP EBP 7552430A C3 RETN 7552430B CC INT3 7552430C CC INT3 7552430D CC INT3 7552430E CC INT3 7552430F CC INT3 2007-2-10 10:18 0
sbright 雪币： 146 活跃值： (33) 能力值： ( LV6，RANK：90 ) 在线值：发帖 120 回帖 995 粉丝 0 关注私信	sbright 2 3 楼怎么感觉到坛子里有13,4岁的小孩子... 最近专门有贴长代码的 2007-2-10 10:19 0
lovetj 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 13 粉丝 0 关注私信	lovetj 4 楼 ls的,不好意思,我刚刚接触这个,所以,找个软件下手的时候就不知道该怎么做了!! 2007-2-10 10:22 0
sbright 雪币： 146 活跃值： (33) 能力值： ( LV6，RANK：90 ) 在线值：发帖 120 回帖 995 粉丝 0 关注私信	sbright 2 5 楼如果不从基础开始的话,至少也先照别人的文章画一下瓢吧 2007-2-10 10:34 0
lovetj 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 13 粉丝 0 关注私信	lovetj 6 楼我画过了,什么脱UPK壳,都画过,上面程序我用PEID查过,查出的结果是Microsoft Visual C++ 6.0 要不,我把程序发给你,你帮我看看!! 2007-2-10 10:37 0
sbright 雪币： 146 活跃值： (33) 能力值： ( LV6，RANK：90 ) 在线值：发帖 120 回帖 995 粉丝 0 关注私信	sbright 2 7 楼不用了,我还是继续画自己的瓢.. 2007-2-10 10:42 0
assistx 雪币： 400 活跃值： (11) 能力值： ( LV2，RANK：10 ) 在线值：发帖 4 回帖 36 粉丝 0 关注私信	assistx 8 楼太长了不能发附件的话，可以在其它网站发，这里发链接。 2007-2-10 11:17 0
lovetj 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 13 粉丝 0 关注私信	lovetj 9 楼 2007-2-10 21:46 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

lovetj

发帖

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (8)
lovetj 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 13 粉丝 0 关注私信	lovetj 2 楼 75524269 E8 A245FEFF CALL MFC42.#5718_?RunModalLoop@CWnd@@QAEHK@Z 7552426E 8B46 20 MOV EAX,DWORD PTR DS:[ESI+20] 75524271 85C0 TEST EAX,EAX 75524273 74 36 JE SHORT MFC42.755242AB 75524275 68 97000000 PUSH 97 7552427A 6A 00 PUSH 0 7552427C 6A 00 PUSH 0 7552427E 6A 00 PUSH 0 75524280 6A 00 PUSH 0 75524282 6A 00 PUSH 0 75524284 8BCE MOV ECX,ESI 75524286 E8 95A40000 CALL MFC42.#6197_?SetWindowPos@CWnd@@QAEHPBV1@HHHHI@Z 7552428B EB 1E JMP SHORT MFC42.755242AB 7552428D 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28] 75524290 E8 2B66FDFF CALL MFC42.#2393_?Delete@CException@@QAEXXZ 75524295 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C] 75524298 C740 30 FFFFFFF>MOV DWORD PTR DS:[EAX+30],-1 7552429F B8 A5425275 MOV EAX,MFC42.755242A5 755242A4 C3 RETN 755242A5 8B75 E4 MOV ESI,DWORD PTR SS:[EBP-1C] 755242A8 8B5D DC MOV EBX,DWORD PTR SS:[EBP-24] 755242AB 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20] 755242AE 85C0 TEST EAX,EAX 755242B0 C745 FC FFFFFFF>MOV DWORD PTR SS:[EBP-4],-1 755242B7 74 09 JE SHORT MFC42.755242C2 755242B9 6A 01 PUSH 1 755242BB 53 PUSH EBX 755242BC FF15 34184E75 CALL DWORD PTR DS:[<&USER32.EnableWindow>] ; USER32.EnableWindow 755242C2 85DB TEST EBX,EBX 755242C4 74 12 JE SHORT MFC42.755242D8 755242C6 FF15 80174E75 CALL DWORD PTR DS:[<&USER32.GetActiveWindow>] ; USER32.GetActiveWindow 755242CC 3B46 20 CMP EAX,DWORD PTR DS:[ESI+20] 755242CF 75 07 JNZ SHORT MFC42.755242D8 755242D1 53 PUSH EBX 755242D2 FF15 64164E75 CALL DWORD PTR DS:[<&USER32.SetActiveWindow>] ; USER32.SetActiveWindow 755242D8 8B16 MOV EDX,DWORD PTR DS:[ESI] 755242DA 8BCE MOV ECX,ESI 755242DC FF52 60 CALL DWORD PTR DS:[EDX+60] 755242DF 8BCE MOV ECX,ESI 755242E1 E8 0AF8FFFF CALL MFC42.#5232_?PostModal@CDialog@@IAEXXZ 755242E6 8B46 44 MOV EAX,DWORD PTR DS:[ESI+44] 755242E9 85C0 TEST EAX,EAX 755242EB 74 0A JE SHORT MFC42.755242F7 755242ED 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18] 755242F0 50 PUSH EAX 755242F1 FF15 84124E75 CALL DWORD PTR DS:[<&KERNEL32.FreeResource>] ; kernel32.FreeResource 755242F7 8B46 30 MOV EAX,DWORD PTR DS:[ESI+30] 755242FA 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] 755242FD 5F POP EDI 755242FE 5E POP ESI 755242FF 64:890D 0000000>MOV DWORD PTR FS:[0],ECX 75524306 5B POP EBX 75524307 8BE5 MOV ESP,EBP 75524309 5D POP EBP 7552430A C3 RETN 7552430B CC INT3 7552430C CC INT3 7552430D CC INT3 7552430E CC INT3 7552430F CC INT3 2007-2-10 10:18 0
sbright 雪币： 146 活跃值： (33) 能力值： ( LV6，RANK：90 ) 在线值：发帖 120 回帖 995 粉丝 0 关注私信	sbright 2 3 楼怎么感觉到坛子里有13,4岁的小孩子... 最近专门有贴长代码的 2007-2-10 10:19 0
lovetj 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 13 粉丝 0 关注私信	lovetj 4 楼 ls的,不好意思,我刚刚接触这个,所以,找个软件下手的时候就不知道该怎么做了!! 2007-2-10 10:22 0
sbright 雪币： 146 活跃值： (33) 能力值： ( LV6，RANK：90 ) 在线值：发帖 120 回帖 995 粉丝 0 关注私信	sbright 2 5 楼如果不从基础开始的话,至少也先照别人的文章画一下瓢吧 2007-2-10 10:34 0
lovetj 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 13 粉丝 0 关注私信	lovetj 6 楼我画过了,什么脱UPK壳,都画过,上面程序我用PEID查过,查出的结果是Microsoft Visual C++ 6.0 要不,我把程序发给你,你帮我看看!! 2007-2-10 10:37 0
sbright 雪币： 146 活跃值： (33) 能力值： ( LV6，RANK：90 ) 在线值：发帖 120 回帖 995 粉丝 0 关注私信	sbright 2 7 楼不用了,我还是继续画自己的瓢.. 2007-2-10 10:42 0
assistx 雪币： 400 活跃值： (11) 能力值： ( LV2，RANK：10 ) 在线值：发帖 4 回帖 36 粉丝 0 关注私信	assistx 8 楼太长了不能发附件的话，可以在其它网站发，这里发链接。 2007-2-10 11:17 0
lovetj 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 13 粉丝 0 关注私信	lovetj 9 楼 2007-2-10 21:46 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复