[求助]搞了一天了，还没找到关键点，请高手指点一下！！-付费问答-看雪-安全社区|安全招聘|kanxue.com

[旧帖] [求助]搞了一天了，还没找到关键点，请高手指点一下！！ 0.00雪花

发表于: 2009-4-1 23:04 3923

[旧帖] [求助]搞了一天了，还没找到关键点，请高手指点一下！！ 0.00雪花

longdf

2009-4-1 23:04

3923

10001000  /$  56          push esi
10001001  |.  57          push edi
10001002  |.  FF15 08500010 call dword ptr [<&KERNEL32.GetCommand>; [GetCommandLineA
10001008  |.  8BF0       mov    esi, eax
1000100A  |.  8A06       mov    al, byte ptr [esi]
1000100C  |.  46          inc    esi
1000100D  |.  3C 22       cmp    al, 22
1000100F  |.  75 3E       jnz    short 1000104F
10001011  |.  E8 DA000000 call 100010F0
10001016  |.  85C0       test eax, eax
10001018  |.  6A 22       push 22
1000101A  |.  56          push esi
1000101B  |.  74 07       je    short 10001024
1000101D  |.  E8 7E070000 call 100017A0
10001022  |.  EB 05       jmp    short 10001029
10001024  |>  E8 B7060000 call 100016E0
10001029  |>  8BD0       mov    edx, eax
1000102B  |.  83C4 08    add    esp, 8
1000102E  |.  85D2       test edx, edx
10001030  |.  74 44       je    short 10001076
10001032  |.  8BFA       mov    edi, edx
10001034  |.  83C9 FF    or    ecx, FFFFFFFF
10001037  |.  33C0       xor    eax, eax
10001039  |.  F2:AE       repne scas byte ptr es:[edi]
1000103B  |.  F7D1       not    ecx
1000103D  |.  49          dec    ecx
1000103E  |.  83F9 02    cmp    ecx, 2
10001041  |.  77 07       ja    short 1000104A
10001043  |.  BE B0840010 mov    esi, 100084B0
10001048  |.  EB 2C       jmp    short 10001076
1000104A  |>  8D72 02    lea    esi, dword ptr [edx+2]
1000104D  |.  EB 27       jmp    short 10001076
1000104F  |>  E8 9C000000 call 100010F0
10001054  |.  85C0       test eax, eax
10001056  |.  6A 20       push 20
10001058  |.  56          push esi
10001059  |.  74 07       je    short 10001062
1000105B  |.  E8 40070000 call 100017A0
10001060  |.  EB 05       jmp    short 10001067
10001062  |>  E8 79060000 call 100016E0
10001067  |>  83C4 08    add    esp, 8
1000106A  |.  BE B4840010 mov    esi, 100084B4
1000106F  |.  85C0       test eax, eax
10001071  |.  74 03       je    short 10001076
10001073  |.  8D70 01    lea    esi, dword ptr [eax+1]
10001076  |>  8B4C24 18    mov    ecx, dword ptr [esp+18]
1000107A  |.  8B5424 10    mov    edx, dword ptr [esp+10]
1000107E  |.  8B4424 0C    mov    eax, dword ptr [esp+C]
10001082  |.  6A 00       push 0
10001084  |.  68 E8030000 push 3E8
10001089  |.  51          push ecx
1000108A  |.  56          push esi
1000108B  |.  52          push edx
1000108C  |.  50          push eax
1000108D  |.  E8 2E060000 call <jmp.&PBVM80.#137>
10001092  |.  5F          pop    edi
10001093  |.  5E          pop    esi
10001094  \.  C2 1000    retn 10
10001097    90          nop
10001098    90          nop
10001099    90          nop
1000109A    90          nop
1000109B    90          nop
1000109C    90          nop
1000109D    90          nop
1000109E    90          nop
1000109F    90          nop
100010A0 .  E9 0B000000 jmp    100010B0
100010A5    90          nop
100010A6    90          nop
100010A7    90          nop
100010A8    90          nop
100010A9    90          nop
100010AA    90          nop
100010AB    90          nop
100010AC    90          nop
100010AD    90          nop
100010AE    90          nop
100010AF    90          nop
100010B0 >  E8 0B000000 call 100010C0
100010B5 .  A3 B8840010 mov    dword ptr [100084B8], eax
100010BA .  C3          retn
100010BB    90          nop
100010BC    90          nop
100010BD    90          nop
100010BE    90          nop
100010BF    90          nop
100010C0  /$  83EC 14    sub    esp, 14
100010C3  |.  8D4424 00    lea    eax, dword ptr [esp]
100010C7  |.  50          push eax                            ; /pCPInfo
100010C8  |.  6A 00       push 0                               ; |CodePage = CP_ACP
100010CA  |.  FF15 0C500010 call dword ptr [<&KERNEL32.GetCPInfo>>; \GetCPInfo
100010D0  |.  8B5424 00    mov    edx, dword ptr [esp]
100010D4  |.  B9 01000000 mov    ecx, 1
100010D9  |.  3BCA       cmp    ecx, edx
100010DB  |.  1BC0       sbb    eax, eax
100010DD  |.  F7D8       neg    eax
100010DF  |.  83C4 14    add    esp, 14
100010E2  \.  C3          retn
100010E3    90          nop
100010E4    90          nop
100010E5    90          nop
100010E6    90          nop
100010E7    90          nop
100010E8    90          nop
100010E9    90          nop
100010EA    90          nop
100010EB    90          nop
100010EC    90          nop
100010ED    90          nop
100010EE    90          nop
100010EF    90          nop
100010F0  /$  A1 B8840010 mov    eax, dword ptr [100084B8]
100010F5  \.  C3          retn
100010F6    90          nop
100010F7    90          nop
100010F8    90          nop
100010F9    90          nop
100010FA    90          nop
100010FB    90          nop
100010FC    90          nop
100010FD    90          nop
100010FE    90          nop
100010FF    90          nop
10001100 .  51          push ecx
10001101 .  8B4424 0C    mov    eax, dword ptr [esp+C]
10001105 .  33D2       xor    edx, edx
10001107 .  53          push ebx
10001108 .  55          push ebp
10001109 .  8AD4       mov    dl, ah
1000110B .  56          push esi
1000110C .  8BC8       mov    ecx, eax
1000110E .  57          push edi
1000110F .  8BEA       mov    ebp, edx
10001111 .  33FF       xor    edi, edi
10001113 .  81E1 FF000000 and    ecx, 0FF
10001119 .  85ED       test ebp, ebp
1000111B .  894C24 10    mov    dword ptr [esp+10], ecx
1000111F .  75 20       jnz    short 10001141
10001121 .  85C9       test ecx, ecx
10001123 .  75 1C       jnz    short 10001141
10001125 .  8B5424 18    mov    edx, dword ptr [esp+18]
10001129 .  83C9 FF    or    ecx, FFFFFFFF
1000112C .  8BFA       mov    edi, edx
1000112E .  33C0       xor    eax, eax
10001130 .  F2:AE       repne scas byte ptr es:[edi]
10001132 .  F7D1       not    ecx
10001134 .  49          dec    ecx
10001135 .  8BC1       mov    eax, ecx
10001137 .  03C2       add    eax, edx
10001139 .  5F          pop    edi
1000113A .  5E          pop    esi
1000113B .  5D          pop    ebp
1000113C .  5B          pop    ebx
1000113D .  59          pop    ecx
1000113E .  C2 0800    retn 8
10001141 >  8B7424 18    mov    esi, dword ptr [esp+18]
10001145 .  33DB       xor    ebx, ebx
10001147 .  803E 00    cmp    byte ptr [esi], 0
1000114A .  74 51       je    short 1000119D
1000114C .  EB 04       jmp    short 10001152
1000114E >  8B4C24 10    mov    ecx, dword ptr [esp+10]
10001152 >  85FF       test edi, edi
10001154 .  74 1D       je    short 10001173
10001156 .  33FF       xor    edi, edi
10001158 .  85ED       test ebp, ebp
1000115A .  74 39       je    short 10001195
1000115C .  8D46 FF    lea    eax, dword ptr [esi-1]
1000115F .  33D2       xor    edx, edx
10001161 .  8A10       mov    dl, byte ptr [eax]
10001163 .  3BD5       cmp    edx, ebp
10001165 .  75 2E       jnz    short 10001195
10001167 .  33D2       xor    edx, edx
10001169 .  8A16       mov    dl, byte ptr [esi]
1000116B .  3BD1       cmp    edx, ecx
1000116D .  75 26       jnz    short 10001195
1000116F .  8BD8       mov    ebx, eax
10001171 .  EB 22       jmp    short 10001195
10001173 >  8A06       mov    al, byte ptr [esi]
10001175 .  50          push eax                            ; /TestChar
10001176 .  FF15 10500010 call dword ptr [<&KERNEL32.IsDBCSLead>; \IsDBCSLeadByte
1000117C .  85C0       test eax, eax
1000117E .  74 07       je    short 10001187
10001180 .  BF 01000000 mov    edi, 1
10001185 .  EB 0E       jmp    short 10001195
10001187 >  8B4424 1C    mov    eax, dword ptr [esp+1C]
1000118B .  33C9       xor    ecx, ecx
1000118D .  8A0E       mov    cl, byte ptr [esi]
1000118F .  3BC8       cmp    ecx, eax
10001191 .  75 02       jnz    short 10001195
10001193 .  8BDE       mov    ebx, esi
10001195 >  8A46 01    mov    al, byte ptr [esi+1]
10001198 .  46          inc    esi
10001199 .  84C0       test al, al
1000119B .^ 75 B1       jnz    short 1000114E
1000119D >  5F          pop    edi
1000119E .  5E          pop    esi
1000119F .  8BC3       mov    eax, ebx
100011A1 .  5D          pop    ebp
100011A2 .  5B          pop    ebx
100011A3 .  59          pop    ecx
100011A4 .  C2 0800    retn 8
100011A7    90          nop
100011A8    90          nop
100011A9    90          nop
100011AA    90          nop
100011AB    90          nop
100011AC    90          nop
100011AD    90          nop
100011AE    90          nop
100011AF    90          nop
100011B0  /$  51          push ecx
100011B1  |.  8B4424 0C    mov    eax, dword ptr [esp+C]
100011B5  |.  53          push ebx
100011B6  |.  33C9       xor    ecx, ecx
100011B8  |.  55          push ebp
100011B9  |.  56          push esi
100011BA  |.  8ACC       mov    cl, ah
100011BC  |.  57          push edi
100011BD  |.  8BD8       mov    ebx, eax
100011BF  |.  33FF       xor    edi, edi
100011C1  |.  8BE9       mov    ebp, ecx
100011C3  |.  81E3 FF000000 and    ebx, 0FF
100011C9  |.  3BEF       cmp    ebp, edi
100011CB  |.  75 20       jnz    short 100011ED
100011CD  |.  3BDF       cmp    ebx, edi
100011CF  |.  75 1C       jnz    short 100011ED
100011D1  |.  8B5424 18    mov    edx, dword ptr [esp+18]
100011D5  |.  83C9 FF    or    ecx, FFFFFFFF
100011D8  |.  8BFA       mov    edi, edx
100011DA  |.  33C0       xor    eax, eax
100011DC  |.  F2:AE       repne scas byte ptr es:[edi]
100011DE  |.  F7D1       not    ecx
100011E0  |.  49          dec    ecx
100011E1  |.  8BC1       mov    eax, ecx
100011E3  |.  03C2       add    eax, edx
100011E5  |.  5F          pop    edi
100011E6  |.  5E          pop    esi
100011E7  |.  5D          pop    ebp
100011E8  |.  5B          pop    ebx
100011E9  |.  59          pop    ecx
100011EA  |.  C2 0800    retn 8
100011ED  |>  8B7424 18    mov    esi, dword ptr [esp+18]
100011F1  |.  897C24 10    mov    dword ptr [esp+10], edi
100011F5  |.  803E 00    cmp    byte ptr [esi], 0
100011F8  |.  74 56       je    short 10001250
100011FA  |>  85FF       /test edi, edi
100011FC  |.  74 19       |je    short 10001217
100011FE  |.  33FF       |xor    edi, edi
10001200  |.  85ED       |test ebp, ebp
10001202  |.  74 33       |je    short 10001237
10001204  |.  33D2       |xor    edx, edx
10001206  |.  8A56 FF    |mov    dl, byte ptr [esi-1]
10001209  |.  3BD5       |cmp    edx, ebp
1000120B  |.  75 2A       |jnz    short 10001237
1000120D  |.  33C0       |xor    eax, eax
1000120F  |.  8A06       |mov    al, byte ptr [esi]
10001211  |.  3BC3       |cmp    eax, ebx
10001213  |.  74 36       |je    short 1000124B
10001215  |.  EB 20       |jmp    short 10001237
10001217  |>  8A0E       |mov    cl, byte ptr [esi]
10001219  |.  51          |push ecx                            ; /TestChar
1000121A  |.  FF15 10500010 |call dword ptr [<&KERNEL32.IsDBCSLea>; \IsDBCSLeadByte
10001220  |.  85C0       |test eax, eax
10001222  |.  74 07       |je    short 1000122B
10001224  |.  BF 01000000 |mov    edi, 1
10001229  |.  EB 0C       |jmp    short 10001237
1000122B  |>  8B4424 1C    |mov    eax, dword ptr [esp+1C]
1000122F  |.  33D2       |xor    edx, edx
10001231  |.  8A16       |mov    dl, byte ptr [esi]
10001233  |.  3BD0       |cmp    edx, eax
10001235  |.  74 15       |je    short 1000124C
10001237  |>  8A46 01    |mov    al, byte ptr [esi+1]
1000123A  |.  46          |inc    esi
1000123B  |.  84C0       |test al, al
1000123D  |.^ 75 BB       \jnz    short 100011FA
1000123F  |.  8B4424 10    mov    eax, dword ptr [esp+10]
10001243  |.  5F          pop    edi
10001244  |.  5E          pop    esi
10001245  |.  5D          pop    ebp
10001246  |.  5B          pop    ebx
10001247  |.  59          pop    ecx
10001248  |.  C2 0800    retn 8
1000124B  |>  4E          dec    esi
1000124C  |>  897424 10    mov    dword ptr [esp+10], esi
10001250  |>  8B4424 10    mov    eax, dword ptr [esp+10]
10001254  |.  5F          pop    edi
10001255  |.  5E          pop    esi
10001256  |.  5D          pop    ebp
10001257  |.  5B          pop    ebx
10001258  |.  59          pop    ecx
10001259  \.  C2 0800    retn 8
1000125C    90          nop
1000125D    90          nop
1000125E    90          nop
1000125F    90          nop
10001260 .  53          push ebx
10001261 .  55          push ebp
10001262 .  56          push esi
10001263 .  8B7424 10    mov    esi, dword ptr [esp+10]
10001267 .  33DB       xor    ebx, ebx
10001269 .  33ED       xor    ebp, ebp
1000126B .  8A06       mov    al, byte ptr [esi]
1000126D .  57          push edi
1000126E .  84C0       test al, al
10001270 .  74 5F       je    short 100012D1
10001272 .  8B7C24 14    mov    edi, dword ptr [esp+14]
10001276 >  85DB       test ebx, ebx
10001278 .  74 0A       je    short 10001284
1000127A .  33C0       xor    eax, eax
1000127C .  33DB       xor    ebx, ebx
1000127E .  8A06       mov    al, byte ptr [esi]
10001280 .  0BF8       or    edi, eax
10001282 .  EB 24       jmp    short 100012A8
10001284 >  8A0E       mov    cl, byte ptr [esi]
10001286 .  51          push ecx                            ; /TestChar
10001287 .  FF15 10500010 call dword ptr [<&KERNEL32.IsDBCSLead>; \IsDBCSLeadByte
1000128D .  85C0       test eax, eax
1000128F .  74 0F       je    short 100012A0
10001291 .  33D2       xor    edx, edx
10001293 .  BB 01000000 mov    ebx, 1
10001298 .  8A36       mov    dh, byte ptr [esi]
1000129A .  8BEE       mov    ebp, esi
1000129C .  8BFA       mov    edi, edx
1000129E .  EB 17       jmp    short 100012B7
100012A0 >  33C0       xor    eax, eax
100012A2 .  8BEE       mov    ebp, esi
100012A4 .  8A06       mov    al, byte ptr [esi]
100012A6 .  8BF8       mov    edi, eax
100012A8 >  8B4C24 18    mov    ecx, dword ptr [esp+18]
100012AC .  57          push edi
100012AD .  51          push ecx
100012AE .  E8 FDFEFFFF call 100011B0
100012B3 .  85C0       test eax, eax
100012B5 .  75 11       jnz    short 100012C8
100012B7 >  8A46 01    mov    al, byte ptr [esi+1]
100012BA .  46          inc    esi
100012BB .  84C0       test al, al
100012BD .^ 75 B7       jnz    short 10001276
100012BF .  33C0       xor    eax, eax
100012C1 .  5F          pop    edi
100012C2 .  5E          pop    esi
100012C3 .  5D          pop    ebp
100012C4 .  5B          pop    ebx
100012C5 .  C2 0800    retn 8
100012C8 >  8BC5       mov    eax, ebp
100012CA .  5F          pop    edi
100012CB .  5E          pop    esi
100012CC .  5D          pop    ebp
100012CD .  5B          pop    ebx
100012CE .  C2 0800    retn 8
100012D1 >  5F          pop    edi
100012D2 .  5E          pop    esi
100012D3 .  5D          pop    ebp
100012D4 .  33C0       xor    eax, eax
100012D6 .  5B          pop    ebx
100012D7 .  C2 0800    retn 8
100012DA    90          nop
100012DB    90          nop
100012DC    90          nop
100012DD    90          nop
100012DE    90          nop
100012DF    90          nop
100012E0 .  83EC 08    sub    esp, 8
100012E3 .  53          push ebx
100012E4 .  55          push ebp
100012E5 .  8B6C24 14    mov    ebp, dword ptr [esp+14]
100012E9 .  56          push esi
100012EA .  57          push edi
100012EB .  C74424 10 000>mov    dword ptr [esp+10], 0
100012F3 .  8A45 00    mov    al, byte ptr [ebp]
100012F6 .  896C24 1C    mov    dword ptr [esp+1C], ebp
100012FA .  84C0       test al, al
100012FC .  0F84 C3000000 je    100013C5
10001302 >  8B7424 20    mov    esi, dword ptr [esp+20]
10001306 .  83C9 FF    or    ecx, FFFFFFFF
10001309 .  8BFE       mov    edi, esi
1000130B .  33C0       xor    eax, eax
1000130D .  F2:AE       repne scas byte ptr es:[edi]
1000130F .  F7D1       not    ecx
10001311 .  49          dec    ecx
10001312 .  8BFD       mov    edi, ebp
10001314 .  8BD1       mov    edx, ecx
10001316 .  83C9 FF    or    ecx, FFFFFFFF
10001319 .  F2:AE       repne scas byte ptr es:[edi]
1000131B .  F7D1       not    ecx
1000131D .  49          dec    ecx
1000131E .  3BD1       cmp    edx, ecx
10001320 .  0F87 9F000000 ja    100013C5
10001326 .  8B4424 10    mov    eax, dword ptr [esp+10]
1000132A .  85C0       test eax, eax
1000132C .  74 0A       je    short 10001338
1000132E .  C74424 10 000>mov    dword ptr [esp+10], 0
10001336 .  EB 65       jmp    short 1000139D
10001338 >  8A45 00    mov    al, byte ptr [ebp]
1000133B .  50          push eax                            ; /TestChar
1000133C .  FF15 10500010 call dword ptr [<&KERNEL32.IsDBCSLead>; \IsDBCSLeadByte
10001342 .  85C0       test eax, eax
10001344 .  74 08       je    short 1000134E
10001346 .  C74424 10 010>mov    dword ptr [esp+10], 1
1000134E >  8A06       mov    al, byte ptr [esi]
10001350 .  8BD6       mov    edx, esi
10001352 .  84C0       test al, al
10001354 .  74 42       je    short 10001398
10001356 .  2BEE       sub    ebp, esi
10001358 >  8A1C2A       mov    bl, byte ptr [edx+ebp]
1000135B .  8D342A       lea    esi, dword ptr [edx+ebp]
1000135E .  84DB       test bl, bl
10001360 .  74 32       je    short 10001394
10001362 .  8BFA       mov    edi, edx
10001364 .  83C9 FF    or    ecx, FFFFFFFF
10001367 .  33C0       xor    eax, eax
10001369 .  F2:AE       repne scas byte ptr es:[edi]
1000136B .  F7D1       not    ecx
1000136D .  49          dec    ecx
1000136E .  8BFE       mov    edi, esi
10001370 .  8BC1       mov    eax, ecx
10001372 .  83C9 FF    or    ecx, FFFFFFFF
10001375 .  894424 14    mov    dword ptr [esp+14], eax
10001379 .  33C0       xor    eax, eax
1000137B .  F2:AE       repne scas byte ptr es:[edi]
1000137D .  8B4424 14    mov    eax, dword ptr [esp+14]
10001381 .  F7D1       not    ecx
10001383 .  49          dec    ecx
10001384 .  3BC8       cmp    ecx, eax
10001386 .  72 0C       jb    short 10001394
10001388 .  3A1A       cmp    bl, byte ptr [edx]
1000138A .  75 08       jnz    short 10001394
1000138C .  8A42 01    mov    al, byte ptr [edx+1]
1000138F .  42          inc    edx
10001390 .  84C0       test al, al
10001392 .^ 75 C4       jnz    short 10001358
10001394 >  8B6C24 1C    mov    ebp, dword ptr [esp+1C]
10001398 >  803A 00    cmp    byte ptr [edx], 0
1000139B .  74 1C       je    short 100013B9
1000139D >  8A45 01    mov    al, byte ptr [ebp+1]
100013A0 .  45          inc    ebp
100013A1 .  84C0       test al, al
100013A3 .  896C24 1C    mov    dword ptr [esp+1C], ebp
100013A7 .^ 0F85 55FFFFFF jnz    10001302
100013AD .  33C0       xor    eax, eax
100013AF .  5F          pop    edi
100013B0 .  5E          pop    esi
100013B1 .  5D          pop    ebp
100013B2 .  5B          pop    ebx
100013B3 .  83C4 08    add    esp, 8
100013B6 .  C2 0800    retn 8
100013B9 >  8BC5       mov    eax, ebp
100013BB .  5F          pop    edi
100013BC .  5E          pop    esi
100013BD .  5D          pop    ebp
100013BE .  5B          pop    ebx
100013BF .  83C4 08    add    esp, 8
100013C2 .  C2 0800    retn 8
100013C5 >  5F          pop    edi
100013C6 .  5E          pop    esi
100013C7 .  5D          pop    ebp
100013C8 .  33C0       xor    eax, eax
100013CA .  5B          pop    ebx
100013CB .  83C4 08    add    esp, 8
100013CE .  C2 0800    retn 8
100013D1    90          nop
100013D2    90          nop
100013D3    90          nop
100013D4    90          nop
100013D5    90          nop
100013D6    90          nop
100013D7    90          nop
100013D8    90          nop
100013D9    90          nop
100013DA    90          nop
100013DB    90          nop
100013DC    90          nop
100013DD    90          nop
100013DE    90          nop
100013DF    90          nop
100013E0  /$  53          push ebx
100013E1  |.  55          push ebp
100013E2  |.  56          push esi
100013E3  |.  8B7424 10    mov    esi, dword ptr [esp+10]
100013E7  |.  57          push edi
100013E8  |.  33ED       xor    ebp, ebp
100013EA  |.  8A06       mov    al, byte ptr [esi]
100013EC  |.  33FF       xor    edi, edi
100013EE  |.  84C0       test al, al
100013F0  |.  74 76       je    short 10001468
100013F2  |.  8A5C24 1C    mov    bl, byte ptr [esp+1C]
100013F6  |>  3B6C24 18    /cmp    ebp, dword ptr [esp+18]
100013FA  |.  7D 6C       |jge    short 10001468
100013FC  |.  85FF       |test edi, edi
100013FE  |.  74 04       |je    short 10001404
10001400  |.  33FF       |xor    edi, edi
10001402  |.  EB 5B       |jmp    short 1000145F
10001404  |>  8A06       |mov    al, byte ptr [esi]
10001406  |.  50          |push eax                            ; /TestChar
10001407  |.  FF15 10500010 |call dword ptr [<&KERNEL32.IsDBCSLea>; \IsDBCSLeadByte
1000140D  |.  85C0       |test eax, eax
1000140F  |.  74 07       |je    short 10001418
10001411  |.  BF 01000000 |mov    edi, 1
10001416  |.  EB 47       |jmp    short 1000145F
10001418  |>  F6C3 01    |test bl, 1
1000141B  |.  74 1D       |je    short 1000143A
1000141D  |.  33C9       |xor    ecx, ecx
1000141F  |.  8A0E       |mov    cl, byte ptr [esi]
10001421  |.  51          |push ecx
10001422  |.  E8 59050000 |call 10001980
10001427  |.  83C4 04    |add    esp, 4
1000142A  |.  85C0       |test eax, eax
1000142C  |.  74 0C       |je    short 1000143A
1000142E  |.  33D2       |xor    edx, edx
10001430  |.  8A16       |mov    dl, byte ptr [esi]
10001432  |.  52          |push edx
10001433  |.  E8 78050000 |call 100019B0
10001438  |.  EB 20       |jmp    short 1000145A
1000143A  |>  F6C3 02    |test bl, 2
1000143D  |.  74 20       |je    short 1000145F
1000143F  |.  33C0       |xor    eax, eax
10001441  |.  8A06       |mov    al, byte ptr [esi]
10001443  |.  50          |push eax
10001444  |.  E8 07050000 |call 10001950
10001449  |.  83C4 04    |add    esp, 4
1000144C  |.  85C0       |test eax, eax
1000144E  |.  74 0F       |je    short 1000145F
10001450  |.  33C9       |xor    ecx, ecx
10001452  |.  8A0E       |mov    cl, byte ptr [esi]
10001454  |.  51          |push ecx
10001455  |.  E8 F6030000 |call 10001850
1000145A  |>  83C4 04    |add    esp, 4
1000145D  |.  8806       |mov    byte ptr [esi], al
1000145F  |>  8A46 01    |mov    al, byte ptr [esi+1]
10001462  |.  46          |inc    esi
10001463  |.  45          |inc    ebp
10001464  |.  84C0       |test al, al
10001466  |.^ 75 8E       \jnz    short 100013F6
10001468  |>  5F          pop    edi
10001469  |.  8BC5       mov    eax, ebp
1000146B  |.  5E          pop    esi
1000146C  |.  5D          pop    ebp
1000146D  |.  5B          pop    ebx
1000146E  \.  C2 0C00    retn 0C
10001471    90          nop
10001472    90          nop
10001473    90          nop
10001474    90          nop
10001475    90          nop
10001476    90          nop
10001477    90          nop
10001478    90          nop
10001479    90          nop
1000147A    90          nop
1000147B    90          nop
1000147C    90          nop
1000147D    90          nop
1000147E    90          nop
1000147F    90          nop
10001480 .  8B4424 08    mov    eax, dword ptr [esp+8]
10001484 .  8B4C24 04    mov    ecx, dword ptr [esp+4]
10001488 .  6A 02       push 2
1000148A .  50          push eax
1000148B .  51          push ecx
1000148C .  E8 4FFFFFFF call 100013E0
10001491 .  C2 0800    retn 8
10001494    90          nop
10001495    90          nop
10001496    90          nop
10001497    90          nop
10001498    90          nop
10001499    90          nop
1000149A    90          nop
1000149B    90          nop
1000149C    90          nop
1000149D    90          nop
1000149E    90          nop
1000149F    90          nop
100014A0 .  8B4424 08    mov    eax, dword ptr [esp+8]
100014A4 .  8B4C24 04    mov    ecx, dword ptr [esp+4]
100014A8 .  6A 01       push 1
100014AA .  50          push eax
100014AB .  51          push ecx
100014AC .  E8 2FFFFFFF call 100013E0
100014B1 .  C2 0800    retn 8
100014B4    90          nop
100014B5    90          nop
100014B6    90          nop
100014B7    90          nop
100014B8    90          nop
100014B9    90          nop
100014BA    90          nop
100014BB    90          nop
100014BC    90          nop
100014BD    90          nop
100014BE    90          nop
100014BF    90          nop
100014C0 .  56          push esi
100014C1 .  8B7424 08    mov    esi, dword ptr [esp+8]
100014C5 .  57          push edi
100014C6 .  8BFE       mov    edi, esi
100014C8 .  83C9 FF    or    ecx, FFFFFFFF
100014CB .  33C0       xor    eax, eax
100014CD .  F2:AE       repne scas byte ptr es:[edi]
100014CF .  F7D1       not    ecx
100014D1 .  49          dec    ecx
100014D2 .  6A 02       push 2
100014D4 .  51          push ecx
100014D5 .  56          push esi
100014D6 .  E8 05FFFFFF call 100013E0
100014DB .  8BC6       mov    eax, esi
100014DD .  5F          pop    edi
100014DE .  5E          pop    esi
100014DF .  C2 0400    retn 4
100014E2    90          nop
100014E3    90          nop
100014E4    90          nop
100014E5    90          nop
100014E6    90          nop
100014E7    90          nop
100014E8    90          nop
100014E9    90          nop
100014EA    90          nop
100014EB    90          nop
100014EC    90          nop
100014ED    90          nop
100014EE    90          nop
100014EF    90          nop
100014F0 .  56          push esi
100014F1 .  8B7424 08    mov    esi, dword ptr [esp+8]
100014F5 .  57          push edi
100014F6 .  8BFE       mov    edi, esi
100014F8 .  83C9 FF    or    ecx, FFFFFFFF
100014FB .  33C0       xor    eax, eax
100014FD .  F2:AE       repne scas byte ptr es:[edi]
100014FF .  F7D1       not    ecx
10001501 .  49          dec    ecx
10001502 .  6A 01       push 1
10001504 .  51          push ecx
10001505 .  56          push esi
10001506 .  E8 D5FEFFFF call 100013E0
1000150B .  8BC6       mov    eax, esi
1000150D .  5F          pop    edi
1000150E .  5E          pop    esi
1000150F .  C2 0400    retn 4
10001512    90          nop
10001513    90          nop
10001514    90          nop
10001515    90          nop
10001516    90          nop
10001517    90          nop
10001518    90          nop
10001519    90          nop
1000151A    90          nop
1000151B    90          nop
1000151C    90          nop
1000151D    90          nop
1000151E    90          nop
1000151F    90          nop
10001520 .  53          push ebx
10001521 .  55          push ebp
10001522 .  56          push esi
10001523 .  8B7424 10    mov    esi, dword ptr [esp+10]
10001527 .  57          push edi
10001528 .  83C8 FF    or    eax, FFFFFFFF
1000152B .  8A0E       mov    cl, byte ptr [esi]
1000152D .  33FF       xor    edi, edi
1000152F .  84C9       test cl, cl
10001531 .  74 4B       je    short 1000157E
10001533 .  8B5C24 18    mov    ebx, dword ptr [esp+18]
10001537 .  8B2D 10500010 mov    ebp, dword ptr [<&KERNEL32.IsDBC>;  kernel32.IsDBCSLeadByte
1000153D >  3BFB       cmp    edi, ebx
1000153F .  7F 3D       jg    short 1000157E
10001541 .  83F8 01    cmp    eax, 1
10001544 .  75 16       jnz    short 1000155C
10001546 .  33C0       xor    eax, eax
10001548 .  8A06       mov    al, byte ptr [esi]
1000154A .  50          push eax
1000154B .  E8 80050000 call 10001AD0
10001550 .  83C4 04    add    esp, 4
10001553 .  F7D8       neg    eax
10001555 .  1BC0       sbb    eax, eax
10001557 .  83E0 03    and    eax, 3
1000155A .  EB 18       jmp    short 10001574
1000155C >  8A0E       mov    cl, byte ptr [esi]
1000155E .  51          push ecx
1000155F .  FFD5       call ebp
10001561 .  85C0       test eax, eax
10001563 .  74 07       je    short 1000156C
10001565 .  B8 01000000 mov    eax, 1
1000156A .  EB 09       jmp    short 10001575
1000156C >  8A06       mov    al, byte ptr [esi]
1000156E .  F6D8       neg    al
10001570 .  1BC0       sbb    eax, eax
10001572 .  F7D8       neg    eax
10001574 >  48          dec    eax
10001575 >  8A4E 01    mov    cl, byte ptr [esi+1]
10001578 .  46          inc    esi
10001579 .  47          inc    edi
1000157A .  84C9       test cl, cl
1000157C .^ 75 BF       jnz    short 1000153D
1000157E >  5F          pop    edi
1000157F .  5E          pop    esi
10001580 .  5D          pop    ebp
10001581 .  5B          pop    ebx
10001582 .  C2 0800    retn 8
10001585    90          nop
10001586    90          nop
10001587    90          nop
10001588    90          nop
10001589    90          nop
1000158A    90          nop
1000158B    90          nop
1000158C    90          nop
1000158D    90          nop
1000158E    90          nop
1000158F    90          nop
10001590 .  53          push ebx
10001591 .  55          push ebp
10001592 .  56          push esi
10001593 .  57          push edi
10001594 .  8B7C24 14    mov    edi, dword ptr [esp+14]
10001598 .  33F6       xor    esi, esi
1000159A .  85FF       test edi, edi
1000159C .  74 26       je    short 100015C4
1000159E .  8A07       mov    al, byte ptr [edi]
100015A0 .  84C0       test al, al
100015A2 .  74 20       je    short 100015C4
100015A4 .  8B2D 10500010 mov    ebp, dword ptr [<&KERNEL32.IsDBC>;  kernel32.IsDBCSLeadByte
100015AA .  33DB       xor    ebx, ebx
100015AC >  85F6       test esi, esi
100015AE .  74 1D       je    short 100015CD
100015B0 .  33F6       xor    esi, esi
100015B2 >  43          inc    ebx
100015B3 >  8A47 01    mov    al, byte ptr [edi+1]
100015B6 .  47          inc    edi
100015B7 .  84C0       test al, al
100015B9 .^ 75 F1       jnz    short 100015AC
100015BB .  8BC3       mov    eax, ebx
100015BD .  5F          pop    edi
100015BE .  5E          pop    esi
100015BF .  5D          pop    ebp
100015C0 .  5B          pop    ebx
100015C1 .  C2 0400    retn 4
100015C4 >  5F          pop    edi
100015C5 .  5E          pop    esi
100015C6 .  5D          pop    ebp
100015C7 .  33C0       xor    eax, eax
100015C9 .  5B          pop    ebx
100015CA .  C2 0400    retn 4
100015CD >  50          push eax
100015CE .  FFD5       call ebp
100015D0 .  85C0       test eax, eax
100015D2 .^ 74 DE       je    short 100015B2
100015D4 .  BE 01000000 mov    esi, 1
100015D9 .^ EB D8       jmp    short 100015B3
100015DB    90          nop
100015DC    90          nop
100015DD    90          nop
100015DE    90          nop
100015DF    90          nop
100015E0 .  53          push ebx
100015E1 .  55          push ebp
100015E2 .  56          push esi
100015E3 .  8B7424 10    mov    esi, dword ptr [esp+10]
100015E7 .  57          push edi
100015E8 .  33FF       xor    edi, edi
100015EA .  85F6       test esi, esi
100015EC .  74 29       je    short 10001617
100015EE .  8A06       mov    al, byte ptr [esi]
100015F0 .  84C0       test al, al
100015F2 .  74 23       je    short 10001617
100015F4 .  33ED       xor    ebp, ebp
100015F6 .  33DB       xor    ebx, ebx
100015F8 >  3B5C24 18    cmp    ebx, dword ptr [esp+18]
100015FC .  73 10       jnb    short 1000160E
100015FE .  85FF       test edi, edi
10001600 .  74 1E       je    short 10001620
10001602 .  33FF       xor    edi, edi
10001604 >  43          inc    ebx
10001605 >  8A46 01    mov    al, byte ptr [esi+1]
10001608 .  46          inc    esi
10001609 .  45          inc    ebp
1000160A .  84C0       test al, al
1000160C .^ 75 EA       jnz    short 100015F8
1000160E >  8BC5       mov    eax, ebp
10001610 .  5F          pop    edi
10001611 .  5E          pop    esi
10001612 .  5D          pop    ebp
10001613 .  5B          pop    ebx
10001614 .  C2 0800    retn 8
10001617 >  5F          pop    edi
10001618 .  5E          pop    esi
10001619 .  5D          pop    ebp
1000161A .  33C0       xor    eax, eax
1000161C .  5B          pop    ebx
1000161D .  C2 0800    retn 8
10001620 >  50          push eax                            ; /TestChar
10001621 .  FF15 10500010 call dword ptr [<&KERNEL32.IsDBCSLead>; \IsDBCSLeadByte
10001627 .  85C0       test eax, eax
10001629 .^ 74 D9       je    short 10001604
1000162B .  BF 01000000 mov    edi, 1
10001630 .^ EB D3       jmp    short 10001605
10001632    90          nop
10001633    90          nop
10001634    90          nop
10001635    90          nop
10001636    90          nop
10001637    90          nop
10001638    90          nop
10001639    90          nop
1000163A    90          nop
1000163B    90          nop
1000163C    90          nop
1000163D    90          nop
1000163E    90          nop
1000163F    90          nop
10001640 .  53          push ebx
10001641 .  55          push ebp
10001642 .  56          push esi
10001643 .  8B7424 10    mov    esi, dword ptr [esp+10]
10001647 .  57          push edi
10001648 .  33FF       xor    edi, edi
1000164A .  85F6       test esi, esi
1000164C .  74 29       je    short 10001677
1000164E .  8A06       mov    al, byte ptr [esi]
10001650 .  84C0       test al, al
10001652 .  74 23       je    short 10001677
10001654 .  33ED       xor    ebp, ebp
10001656 .  33DB       xor    ebx, ebx
10001658 >  3B5C24 18    cmp    ebx, dword ptr [esp+18]
1000165C .  73 10       jnb    short 1000166E
1000165E .  85FF       test edi, edi
10001660 .  74 1E       je    short 10001680
10001662 .  33FF       xor    edi, edi
10001664 >  45          inc    ebp
10001665 >  8A46 01    mov    al, byte ptr [esi+1]
10001668 .  46          inc    esi
10001669 .  43          inc    ebx
1000166A .  84C0       test al, al
1000166C .^ 75 EA       jnz    short 10001658
1000166E >  8BC5       mov    eax, ebp
10001670 .  5F          pop    edi
10001671 .  5E          pop    esi
10001672 .  5D          pop    ebp
10001673 .  5B          pop    ebx
10001674 .  C2 0800    retn 8
10001677 >  5F          pop    edi
10001678 .  5E          pop    esi
10001679 .  5D          pop    ebp
1000167A .  33C0       xor    eax, eax
1000167C .  5B          pop    ebx
1000167D .  C2 0800    retn 8
10001680 >  50          push eax                            ; /TestChar
10001681 .  FF15 10500010 call dword ptr [<&KERNEL32.IsDBCSLead>; \IsDBCSLeadByte
10001687 .  85C0       test eax, eax
10001689 .^ 74 D9       je    short 10001664
1000168B .  BF 01000000 mov    edi, 1
10001690 .^ EB D3       jmp    short 10001665
10001692    90          nop
10001693    90          nop
10001694    90          nop
10001695    90          nop
10001696    90          nop
10001697    90          nop
10001698    90          nop
10001699    90          nop
1000169A    90          nop
1000169B    90          nop
1000169C    90          nop
1000169D    90          nop
1000169E    90          nop
1000169F    90          nop
100016A0 .  8B4424 04    mov    eax, dword ptr [esp+4]
100016A4 .  A8 80       test al, 80
100016A6 .  75 12       jnz    short 100016BA
100016A8 .  83F8 30    cmp    eax, 30
100016AB .  7C 0D       jl    short 100016BA
100016AD .  83F8 39    cmp    eax, 39
100016B0 .  7F 08       jg    short 100016BA
100016B2 .  B8 01000000 mov    eax, 1
100016B7 .  C2 0400    retn 4
100016BA >  33C0       xor    eax, eax
100016BC .  C2 0400    retn 4
100016BF    90          nop
100016C0 $- FF25 94500010 jmp    dword ptr [<&PBVM80.#137>]    ;  PBVM80.FN_RunExecutable
100016C6    CC          int3
100016C7    CC          int3
100016C8    CC          int3
100016C9    CC          int3
100016CA    CC          int3
100016CB    CC          int3
100016CC    CC          int3
100016CD    CC          int3
100016CE    CC          int3
100016CF    CC          int3
100016D0  />  8D42 FF    lea    eax, dword ptr [edx-1]
100016D3  |.  5B          pop    ebx
100016D4  |.  C3          retn
100016D5  | 2E          db    2E                            ;  CHAR '.'
100016D6  | 8BC0       mov    eax, eax
100016D8  | 2E          db    2E                            ;  CHAR '.'
100016D9  | 8BC0       mov    eax, eax
100016DB  | 2E          db    2E                            ;  CHAR '.'
100016DC  | 8BC0       mov    eax, eax
100016DE  | 8BC0       mov    eax, eax
100016E0  |$  33C0       xor    eax, eax
100016E2  |.  8A4424 08    mov    al, byte ptr [esp+8]
100016E6  |.  53          push ebx
100016E7  |.  8BD8       mov    ebx, eax
100016E9  |.  C1E0 08    shl    eax, 8
100016EC  |.  8B5424 08    mov    edx, dword ptr [esp+8]
100016F0  |.  F7C2 03000000 test edx, 3
100016F6  |.  74 13       je    short 1000170B
100016F8  |>  8A0A       /mov    cl, byte ptr [edx]
100016FA  |.  42          |inc    edx
100016FB  |.  38D9       |cmp    cl, bl
100016FD  |.^ 74 D1       |je    short 100016D0
100016FF  |.  84C9       |test cl, cl
10001701  |.  74 51       |je    short 10001754
10001703  |.  F7C2 03000000 |test edx, 3
10001709  |.^ 75 ED       \jnz    short 100016F8
1000170B  |>  0BD8       or    ebx, eax
1000170D  |.  57          push edi
1000170E  |.  8BC3       mov    eax, ebx
10001710  |.  C1E3 10    shl    ebx, 10
10001713  |.  56          push esi
10001714  |.  0BD8       or    ebx, eax
10001716  |>  8B0A       /mov    ecx, dword ptr [edx]
10001718  |.  BF FFFEFE7E |mov    edi, 7EFEFEFF
1000171D  |.  8BC1       |mov    eax, ecx
1000171F  |.  8BF7       |mov    esi, edi
10001721  |.  33CB       |xor    ecx, ebx
10001723  |.  03F0       |add    esi, eax
10001725  |.  03F9       |add    edi, ecx
10001727  |.  83F1 FF    |xor    ecx, FFFFFFFF
1000172A  |.  83F0 FF    |xor    eax, FFFFFFFF
1000172D  |.  33CF       |xor    ecx, edi
1000172F  |.  33C6       |xor    eax, esi
10001731  |.  83C2 04    |add    edx, 4
10001734  |.  81E1 00010181 |and    ecx, 81010100
1000173A  |.  75 1C       |jnz    short 10001758
1000173C  |.  25 00010181 |and    eax, 81010100
10001741  |.^ 74 D3       |je    short 10001716
10001743  |.  25 00010101 |and    eax, 1010100
10001748  |.  75 08       |jnz    short 10001752
1000174A  |.  81E6 00000080 |and    esi, 80000000
10001750  |.^ 75 C4       \jnz    short 10001716
10001752  |>  5E          pop    esi
10001753  |.  5F          pop    edi
10001754  |>  5B          pop    ebx
10001755  |.  33C0       xor    eax, eax
10001757  |.  C3          retn
10001758  |>  8B42 FC    mov    eax, dword ptr [edx-4]
1000175B  |.  38D8       cmp    al, bl
1000175D  |.  74 36       je    short 10001795
1000175F  |.  84C0       test al, al
10001761  |.^ 74 EF       je    short 10001752
10001763  |.  38DC       cmp    ah, bl
10001765  |.  74 27       je    short 1000178E
10001767  |.  84E4       test ah, ah
10001769  |.^ 74 E7       je    short 10001752
1000176B  |.  C1E8 10    shr    eax, 10
1000176E  |.  38D8       cmp    al, bl
10001770  |.  74 15       je    short 10001787
10001772  |.  84C0       test al, al
10001774  |.^ 74 DC       je    short 10001752
10001776  |.  38DC       cmp    ah, bl
10001778  |.  74 06       je    short 10001780
1000177A  |.  84E4       test ah, ah
1000177C  |.^ 74 D4       je    short 10001752
1000177E  |.^ EB 96       jmp    short 10001716
10001780  |>  5E          pop    esi
10001781  |.  5F          pop    edi
10001782  |.  8D42 FF    lea    eax, dword ptr [edx-1]
10001785  |.  5B          pop    ebx
10001786  |.  C3          retn
10001787  |>  8D42 FE    lea    eax, dword ptr [edx-2]
1000178A  |.  5E          pop    esi
1000178B  |.  5F          pop    edi
1000178C  |.  5B          pop    ebx
1000178D  |.  C3          retn
1000178E  |>  8D42 FD    lea    eax, dword ptr [edx-3]
10001791  |.  5E          pop    esi
10001792  |.  5F          pop    edi
10001793  |.  5B          pop    ebx
10001794  |.  C3          retn
10001795  |>  8D42 FC    lea    eax, dword ptr [edx-4]
10001798  |.  5E          pop    esi
10001799  |.  5F          pop    edi
1000179A  |.  5B          pop    ebx
1000179B  \.  C3          retn
1000179C    CC          int3
1000179D    CC          int3
1000179E    CC          int3
1000179F    CC          int3
100017A0  /$  A1 D0860010 mov    eax, dword ptr [100086D0]
100017A5  |.  53          push ebx
100017A6  |.  85C0       test eax, eax
100017A8  |.  56          push esi
100017A9  |.  75 15       jnz    short 100017C0
100017AB  |.  8B4424 10    mov    eax, dword ptr [esp+10]
100017AF  |.  8B4C24 0C    mov    ecx, dword ptr [esp+C]
100017B3  |.  50          push eax
100017B4  |.  51          push ecx
100017B5  |.  E8 26FFFFFF call 100016E0
100017BA  |.  83C4 08    add    esp, 8
100017BD  |.  5E          pop    esi
100017BE  |.  5B          pop    ebx
100017BF  |.  C3          retn
100017C0  |>  8B5424 0C    mov    edx, dword ptr [esp+C]
100017C4  |.  8B7424 10    mov    esi, dword ptr [esp+10]
100017C8  |.  66:0FB602    movzx ax, byte ptr [edx]
100017CC  |.  66:85C0    test ax, ax
100017CF  |.  74 66       je    short 10001837
100017D1  |.  B3 04       mov    bl, 4
100017D3  |>  8BC8       /mov    ecx, eax
100017D5  |.  81E1 FF000000 |and    ecx, 0FF
100017DB  |.  8499 C9840010 |test byte ptr [ecx+100084C9], bl
100017E1  |.  74 1E       |je    short 10001801
100017E3  |.  8A4A 01    |mov    cl, byte ptr [edx+1]
100017E6  |.  42          |inc    edx
100017E7  |.  84C9       |test cl, cl
100017E9  |.  74 41       |je    short 1000182C
100017EB  |.  25 FFFF0000 |and    eax, 0FFFF
100017F0  |.  81E1 FF000000 |and    ecx, 0FF
100017F6  |.  C1E0 08    |shl    eax, 8
100017F9  |.  0BC1       |or    eax, ecx
100017FB  |.  3BF0       |cmp    esi, eax
100017FD  |.  74 32       |je    short 10001831
100017FF  |.  EB 0C       |jmp    short 1000180D
10001801  |>  8BC8       |mov    ecx, eax
10001803  |.  81E1 FFFF0000 |and    ecx, 0FFFF
10001809  |.  3BF1       |cmp    esi, ecx
1000180B  |.  74 2A       |je    short 10001837
1000180D  |>  66:0FB642 01  |movzx ax, byte ptr [edx+1]
10001812  |.  42          |inc    edx
10001813  |.  66:85C0    |test ax, ax
10001816  |.^ 75 BB       \jnz    short 100017D3
10001818  |.  25 FFFF0000 and    eax, 0FFFF
1000181D  |.  33C9       xor    ecx, ecx
1000181F  |.  3BF0       cmp    esi, eax
10001821  |.  0F95C1       setne cl
10001824  |.  49          dec    ecx
10001825  |.  23CA       and    ecx, edx
10001827  |.  8BC1       mov    eax, ecx
10001829  |.  5E          pop    esi
1000182A  |.  5B          pop    ebx
1000182B  |.  C3          retn
1000182C  |>  33C0       xor    eax, eax
1000182E  |.  5E          pop    esi
1000182F  |.  5B          pop    ebx
10001830  |.  C3          retn
10001831  |>  8D42 FF    lea    eax, dword ptr [edx-1]
10001834  |.  5E          pop    esi
10001835  |.  5B          pop    ebx
10001836  |.  C3          retn
10001837  |>  25 FFFF0000 and    eax, 0FFFF
1000183C  |.  33C9       xor    ecx, ecx
1000183E  |.  3BF0       cmp    esi, eax
10001840  |.  5E          pop    esi
10001841  |.  0F95C1       setne cl
10001844  |.  49          dec    ecx
10001845  |.  5B          pop    ebx
10001846  |.  23CA       and    ecx, edx
10001848  |.  8BC1       mov    eax, ecx
1000184A  \.  C3          retn
1000184B    90          nop
1000184C    90          nop
1000184D    90          nop
1000184E    90          nop
1000184F    90          nop
10001850  /$  A1 F8860010 mov    eax, dword ptr [100086F8]
10001855  |.  83EC 08    sub    esp, 8
10001858  |.  85C0       test eax, eax
1000185A  |.  53          push ebx
1000185B  |.  75 1E       jnz    short 1000187B
1000185D  |.  8B4424 10    mov    eax, dword ptr [esp+10]
10001861  |.  83F8 41    cmp    eax, 41
10001864  |.  0F8C DF000000 jl    10001949
1000186A  |.  83F8 5A    cmp    eax, 5A
1000186D  |.  0F8F D6000000 jg    10001949
10001873  |.  83C0 20    add    eax, 20
10001876  |.  5B          pop    ebx
10001877  |.  83C4 08    add    esp, 8
1000187A  |.  C3          retn
1000187B  |>  8B5C24 10    mov    ebx, dword ptr [esp+10]
1000187F  |.  81FB 00010000 cmp    ebx, 100
10001885  |.  7D 2C       jge    short 100018B3
10001887  |.  833D 3C630010>cmp    dword ptr [1000633C], 1
1000188E  |.  7E 0D       jle    short 1000189D
10001890  |.  6A 01       push 1
10001892  |.  53          push ebx
10001893  |.  E8 E80B0000 call 10002480
10001898  |.  83C4 08    add    esp, 8
1000189B  |.  EB 0B       jmp    short 100018A8
1000189D  |>  A1 30610010 mov    eax, dword ptr [10006130]
100018A2  |.  8A0458       mov    al, byte ptr [eax+ebx*2]
100018A5  |.  83E0 01    and    eax, 1
100018A8  |>  85C0       test eax, eax
100018AA  |.  75 07       jnz    short 100018B3
100018AC  |.  8BC3       mov    eax, ebx
100018AE  |.  5B          pop    ebx
100018AF  |.  83C4 08    add    esp, 8
100018B2  |.  C3          retn
100018B3  |>  8B15 30610010 mov    edx, dword ptr [10006130]       ;  pjgl.1000613A
100018B9  |.  8BC3       mov    eax, ebx
100018BB  |.  C1F8 08    sar    eax, 8
100018BE  |.  8BC8       mov    ecx, eax
100018C0  |.  81E1 FF000000 and    ecx, 0FF
100018C6  |.  F6444A 01 80  test byte ptr [edx+ecx*2+1], 80
100018CB  |.  74 14       je    short 100018E1
100018CD  |.  884424 10    mov    byte ptr [esp+10], al
100018D1  |.  885C24 11    mov    byte ptr [esp+11], bl
100018D5  |.  C64424 12 00  mov    byte ptr [esp+12], 0
100018DA  |.  B8 02000000 mov    eax, 2
100018DF  |.  EB 0E       jmp    short 100018EF
100018E1  |>  885C24 10    mov    byte ptr [esp+10], bl
100018E5  |.  C64424 11 00  mov    byte ptr [esp+11], 0
100018EA  |.  B8 01000000 mov    eax, 1
100018EF  |>  6A 01       push 1
100018F1  |.  6A 00       push 0
100018F3  |.  8D4C24 0C    lea    ecx, dword ptr [esp+C]
100018F7  |.  6A 03       push 3
100018F9  |.  51          push ecx
100018FA  |.  8D5424 20    lea    edx, dword ptr [esp+20]
100018FE  |.  50          push eax
100018FF  |.  A1 F8860010 mov    eax, dword ptr [100086F8]
10001904  |.  52          push edx
10001905  |.  68 00010000 push 100
1000190A  |.  50          push eax
1000190B  |.  E8 10090000 call 10002220
10001910  |.  83C4 20    add    esp, 20
10001913  |.  85C0       test eax, eax
10001915  |.  75 07       jnz    short 1000191E
10001917  |.  8BC3       mov    eax, ebx
10001919  |.  5B          pop    ebx
1000191A  |.  83C4 08    add    esp, 8
1000191D  |.  C3          retn
1000191E  |>  83F8 01    cmp    eax, 1
10001921  |.  75 0E       jnz    short 10001931
10001923  |.  8B4424 04    mov    eax, dword ptr [esp+4]
10001927  |.  25 FF000000 and    eax, 0FF
1000192C  |.  5B          pop    ebx
1000192D  |.  83C4 08    add    esp, 8
10001930  |.  C3          retn
10001931  |>  8B4424 05    mov    eax, dword ptr [esp+5]
10001935  |.  8B4C24 04    mov    ecx, dword ptr [esp+4]
10001939  |.  25 FF000000 and    eax, 0FF
1000193E  |.  81E1 FF000000 and    ecx, 0FF
10001944  |.  C1E0 08    shl    eax, 8
10001947  |.  0BC1       or    eax, ecx
10001949  |>  5B          pop    ebx
1000194A  |.  83C4 08    add    esp, 8
1000194D  \.  C3          retn
1000194E    90          nop
1000194F    90          nop
10001950  /$  833D 3C630010>cmp    dword ptr [1000633C], 1
10001957  |.  7E 10       jle    short 10001969
10001959  |.  8B4424 04    mov    eax, dword ptr [esp+4]
1000195D  |.  6A 01       push 1
1000195F  |.  50          push eax
10001960  |.  E8 1B0B0000 call 10002480
10001965  |.  83C4 08    add    esp, 8
10001968  |.  C3          retn
10001969  |>  8B4C24 04    mov    ecx, dword ptr [esp+4]
1000196D  |.  8B15 30610010 mov    edx, dword ptr [10006130]       ;  pjgl.1000613A
10001973  |.  8A044A       mov    al, byte ptr [edx+ecx*2]
10001976  |.  83E0 01    and    eax, 1
10001979  \.  C3          retn
1000197A    90          nop
1000197B    90          nop
1000197C    90          nop
1000197D    90          nop
1000197E    90          nop
1000197F    90          nop
10001980  /$  833D 3C630010>cmp    dword ptr [1000633C], 1
10001987  |.  7E 10       jle    short 10001999
10001989  |.  8B4424 04    mov    eax, dword ptr [esp+4]
1000198D  |.  6A 02       push 2
1000198F  |.  50          push eax
10001990  |.  E8 EB0A0000 call 10002480
10001995  |.  83C4 08    add    esp, 8
10001998  |.  C3          retn
10001999  |>  8B4C24 04    mov    ecx, dword ptr [esp+4]
1000199D  |.  8B15 30610010 mov    edx, dword ptr [10006130]       ;  pjgl.1000613A
100019A3  |.  8A044A       mov    al, byte ptr [edx+ecx*2]
100019A6  |.  83E0 02    and    eax, 2
100019A9  \.  C3          retn
100019AA    90          nop
100019AB    90          nop
100019AC    90          nop
100019AD    90          nop
100019AE    90          nop
100019AF    90          nop
100019B0  /$  A1 F8860010 mov    eax, dword ptr [100086F8]
100019B5  |.  83EC 08    sub    esp, 8
100019B8  |.  85C0       test eax, eax
100019BA  |.  53          push ebx
100019BB  |.  75 1E       jnz    short 100019DB
100019BD  |.  8B4424 10    mov    eax, dword ptr [esp+10]
100019C1  |.  83F8 61    cmp    eax, 61
100019C4  |.  0F8C DF000000 jl    10001AA9
100019CA  |.  83F8 7A    cmp    eax, 7A
100019CD  |.  0F8F D6000000 jg    10001AA9
100019D3  |.  83E8 20    sub    eax, 20
100019D6  |.  5B          pop    ebx
100019D7  |.  83C4 08    add    esp, 8
100019DA  |.  C3          retn
100019DB  |>  8B5C24 10    mov    ebx, dword ptr [esp+10]
100019DF  |.  81FB 00010000 cmp    ebx, 100
100019E5  |.  7D 2C       jge    short 10001A13
100019E7  |.  833D 3C630010>cmp    dword ptr [1000633C], 1
100019EE  |.  7E 0D       jle    short 100019FD
100019F0  |.  6A 02       push 2
100019F2  |.  53          push ebx
100019F3  |.  E8 880A0000 call 10002480
100019F8  |.  83C4 08    add    esp, 8
100019FB  |.  EB 0B       jmp    short 10001A08
100019FD  |>  A1 30610010 mov    eax, dword ptr [10006130]
10001A02  |.  8A0458       mov    al, byte ptr [eax+ebx*2]
10001A05  |.  83E0 02    and    eax, 2
10001A08  |>  85C0       test eax, eax
10001A0A  |.  75 07       jnz    short 10001A13
10001A0C  |.  8BC3       mov    eax, ebx
10001A0E  |.  5B          pop    ebx
10001A0F  |.  83C4 08    add    esp, 8
10001A12  |.  C3          retn
10001A13  |>  8B15 30610010 mov    edx, dword ptr [10006130]       ;  pjgl.1000613A
10001A19  |.  8BC3       mov    eax, ebx
10001A1B  |.  C1F8 08    sar    eax, 8
10001A1E  |.  8BC8       mov    ecx, eax
10001A20  |.  81E1 FF000000 and    ecx, 0FF
10001A26  |.  F6444A 01 80  test byte ptr [edx+ecx*2+1], 80
10001A2B  |.  74 14       je    short 10001A41
10001A2D  |.  884424 10    mov    byte ptr [esp+10], al
10001A31  |.  885C24 11    mov    byte ptr [esp+11], bl
10001A35  |.  C64424 12 00  mov    byte ptr [esp+12], 0
10001A3A  |.  B8 02000000 mov    eax, 2
10001A3F  |.  EB 0E       jmp    short 10001A4F
10001A41  |>  885C24 10    mov    byte ptr [esp+10], bl
10001A45  |.  C64424 11 00  mov    byte ptr [esp+11], 0
10001A4A  |.  B8 01000000 mov    eax, 1
10001A4F  |>  6A 01       push 1
10001A51  |.  6A 00       push 0
10001A53  |.  8D4C24 0C    lea    ecx, dword ptr [esp+C]
10001A57  |.  6A 03       push 3
10001A59  |.  51          push ecx
10001A5A  |.  8D5424 20    lea    edx, dword ptr [esp+20]
10001A5E  |.  50          push eax
10001A5F  |.  A1 F8860010 mov    eax, dword ptr [100086F8]
10001A64  |.  52          push edx
10001A65  |.  68 00020000 push 200
10001A6A  |.  50          push eax
10001A6B  |.  E8 B0070000 call 10002220
10001A70  |.  83C4 20    add    esp, 20
10001A73  |.  85C0       test eax, eax
10001A75  |.  75 07       jnz    short 10001A7E
10001A77  |.  8BC3       mov    eax, ebx
10001A79  |.  5B          pop    ebx
10001A7A  |.  83C4 08    add    esp, 8
10001A7D  |.  C3          retn
10001A7E  |>  83F8 01    cmp    eax, 1
10001A81  |.  75 0E       jnz    short 10001A91
10001A83  |.  8B4424 04    mov    eax, dword ptr [esp+4]
10001A87  |.  25 FF000000 and    eax, 0FF
10001A8C  |.  5B          pop    ebx
10001A8D  |.  83C4 08    add    esp, 8
10001A90  |.  C3          retn
10001A91  |>  8B4424 05    mov    eax, dword ptr [esp+5]
10001A95  |.  8B4C24 04    mov    ecx, dword ptr [esp+4]
10001A99  |.  25 FF000000 and    eax, 0FF
10001A9E  |.  81E1 FF000000 and    ecx, 0FF
10001AA4  |.  C1E0 08    shl    eax, 8
10001AA7  |.  0BC1       or    eax, ecx
10001AA9  |>  5B          pop    ebx
10001AAA  |.  83C4 08    add    esp, 8
10001AAD  \.  C3          retn
10001AAE    90          nop
10001AAF    90          nop
10001AB0  /$  8B4424 04    mov    eax, dword ptr [esp+4]
10001AB4  |.  6A 04       push 4
10001AB6  |.  6A 00       push 0
10001AB8  |.  50          push eax
10001AB9  |.  E8 32000000 call 10001AF0
10001ABE  |.  83C4 0C    add    esp, 0C
10001AC1  \.  C3          retn
10001AC2    90          nop
10001AC3    90          nop
10001AC4    90          nop
10001AC5    90          nop
10001AC6    90          nop
10001AC7    90          nop
10001AC8    90          nop
10001AC9    90          nop
10001ACA    90          nop
10001ACB    90          nop
10001ACC    90          nop
10001ACD    90          nop
10001ACE    90          nop
10001ACF    90          nop
10001AD0  /$  8B4424 04    mov    eax, dword ptr [esp+4]
10001AD4  |.  6A 08       push 8
10001AD6  |.  6A 00       push 0
10001AD8  |.  50          push eax
10001AD9  |.  E8 12000000 call 10001AF0
10001ADE  |.  83C4 0C    add    esp, 0C
10001AE1  \.  C3          retn
10001AE2    90          nop
10001AE3    90          nop
10001AE4    90          nop
10001AE5    90          nop
10001AE6    90          nop
10001AE7    90          nop
10001AE8    90          nop
10001AE9    90          nop
10001AEA    90          nop
10001AEB    90          nop
10001AEC    90          nop
10001AED    90          nop
10001AEE    90          nop
10001AEF    90          nop
10001AF0  /$  8B4424 04    mov    eax, dword ptr [esp+4]
10001AF4  |.  8A4C24 0C    mov    cl, byte ptr [esp+C]
10001AF8  |.  25 FF000000 and    eax, 0FF
10001AFD  |.  8488 C9840010 test byte ptr [eax+100084C9], cl
10001B03  |.  75 1F       jnz    short 10001B24
10001B05  |.  8B4C24 08    mov    ecx, dword ptr [esp+8]
10001B09  |.  85C9       test ecx, ecx
10001B0B  |.  74 10       je    short 10001B1D
10001B0D  |.  33D2       xor    edx, edx
10001B0F  |.  66:8B1445 3A6>mov    dx, word ptr [eax*2+1000613A]
10001B17  |.  8BC2       mov    eax, edx
10001B19  |.  23C1       and    eax, ecx
10001B1B  |.  EB 02       jmp    short 10001B1F
10001B1D  |>  33C0       xor    eax, eax
10001B1F  |>  85C0       test eax, eax
10001B21  |.  75 01       jnz    short 10001B24
10001B23  |.  C3          retn
10001B24  |>  B8 01000000 mov    eax, 1
10001B29  \.  C3          retn
10001B2A    90          nop
10001B2B    90          nop
10001B2C    90          nop
10001B2D    90          nop
10001B2E    90          nop
10001B2F    90          nop
10001B30 > $  55          push ebp
10001B31 .  8BEC       mov    ebp, esp
10001B33 .  6A FF       push -1
10001B35 .  68 A0500010 push 100050A0
10001B3A .  68 28300010 push 10003028                      ;  SE 处理程序安装
10001B3F .  64:A1 0000000>mov    eax, dword ptr fs:[0]
10001B45 .  50          push eax
10001B46 .  64:8925 00000>mov    dword ptr fs:[0], esp
10001B4D .  83C4 A8    add    esp, -58
10001B50 .  53          push ebx
10001B51 .  56          push esi
10001B52 .  57          push edi
10001B53 .  8965 E8    mov    dword ptr [ebp-18], esp
10001B56 .  FF15 1C500010 call dword ptr [<&KERNEL32.GetVersion>;  kernel32.GetVersion
10001B5C .  33D2       xor    edx, edx
10001B5E .  8AD4       mov    dl, ah
10001B60 .  8915 24870010 mov    dword ptr [10008724], edx
10001B66 .  8BC8       mov    ecx, eax
10001B68 .  81E1 FF000000 and    ecx, 0FF
10001B6E .  890D 20870010 mov    dword ptr [10008720], ecx
10001B74 .  C1E1 08    shl    ecx, 8
10001B77 .  03CA       add    ecx, edx
10001B79 .  890D 1C870010 mov    dword ptr [1000871C], ecx
10001B7F .  C1E8 10    shr    eax, 10
10001B82 .  A3 18870010 mov    dword ptr [10008718], eax
10001B87 .  E8 64130000 call 10002EF0
10001B8C .  85C0       test eax, eax
10001B8E .  75 0A       jnz    short 10001B9A
10001B90 .  6A 1C       push 1C
10001B92 .  E8 69010000 call 10001D00
10001B97 .  83C4 04    add    esp, 4
10001B9A >  C745 FC 00000>mov    dword ptr [ebp-4], 0
10001BA1 .  E8 4A110000 call 10002CF0
10001BA6 .  E8 65060000 call 10002210
10001BAB .  FF15 08500010 call dword ptr [<&KERNEL32.GetCommand>; [GetCommandLineA
10001BB1 .  A3 B4890010 mov    dword ptr [100089B4], eax
10001BB6 .  E8 D50F0000 call 10002B90
10001BBB .  A3 BC840010 mov    dword ptr [100084BC], eax
10001BC0 .  85C0       test eax, eax
10001BC2 .  74 09       je    short 10001BCD
10001BC4 .  A1 B4890010 mov    eax, dword ptr [100089B4]
10001BC9 .  85C0       test eax, eax
10001BCB .  75 0A       jnz    short 10001BD7
10001BCD >  6A FF       push -1
10001BCF .  E8 7C090000 call 10002550
10001BD4 .  83C4 04    add    esp, 4
10001BD7 >  E8 040D0000 call 100028E0
10001BDC .  E8 0F0C0000 call 100027F0
10001BE1 .  E8 3A090000 call 10002520
10001BE6 .  8B35 B4890010 mov    esi, dword ptr [100089B4]
10001BEC .  8975 9C    mov    dword ptr [ebp-64], esi
10001BEF .  803E 22    cmp    byte ptr [esi], 22
10001BF2 .  0F85 BE000000 jnz    10001CB6
10001BF8 >  46          inc    esi
10001BF9 .  8975 9C    mov    dword ptr [ebp-64], esi
10001BFC .  8A06       mov    al, byte ptr [esi]
10001BFE .  3C 22       cmp    al, 22
10001C00 .  74 1C       je    short 10001C1E
10001C02 .  84C0       test al, al
10001C04 .  74 18       je    short 10001C1E
10001C06 .  25 FF000000 and    eax, 0FF
10001C0B .  50          push eax
10001C0C .  E8 9FFEFFFF call 10001AB0
10001C11 .  83C4 04    add    esp, 4
10001C14 .  85C0       test eax, eax
10001C16 .^ 74 E0       je    short 10001BF8
10001C18 .  46          inc    esi
10001C19 .  8975 9C    mov    dword ptr [ebp-64], esi
10001C1C .^ EB DA       jmp    short 10001BF8
10001C1E >  803E 22    cmp    byte ptr [esi], 22
10001C21 .  75 04       jnz    short 10001C27
10001C23 .  46          inc    esi
10001C24 .  8975 9C    mov    dword ptr [ebp-64], esi
10001C27 >  8A06       mov    al, byte ptr [esi]
10001C29 .  84C0       test al, al
10001C2B .  74 0A       je    short 10001C37
10001C2D .  3C 20       cmp    al, 20
10001C2F .  77 06       ja    short 10001C37
10001C31 .  46          inc    esi
10001C32 .  8975 9C    mov    dword ptr [ebp-64], esi
10001C35 .^ EB F0       jmp    short 10001C27
10001C37 >  C745 D0 00000>mov    dword ptr [ebp-30], 0
10001C3E .  8D45 A4    lea    eax, dword ptr [ebp-5C]
10001C41 .  50          push eax                            ; /pStartupinfo
10001C42 .  FF15 18500010 call dword ptr [<&KERNEL32.GetStartup>; \GetStartupInfoA
10001C48 .  F645 D0 01 test byte ptr [ebp-30], 1
10001C4C .  74 0A       je    short 10001C58
10001C4E .  8B45 D4    mov    eax, dword ptr [ebp-2C]
10001C51 .  25 FFFF0000 and    eax, 0FFFF
10001C56 .  EB 05       jmp    short 10001C5D
10001C58 >  B8 0A000000 mov    eax, 0A
10001C5D >  50          push eax
10001C5E .  56          push esi
10001C5F .  6A 00       push 0
10001C61 .  6A 00       push 0                               ; /pModule = NULL
10001C63 .  FF15 14500010 call dword ptr [<&KERNEL32.GetModuleH>; \GetModuleHandleA
10001C69 .  50          push eax
10001C6A .  E8 91F3FFFF call 10001000
10001C6F .  8945 A0    mov    dword ptr [ebp-60], eax
10001C72 .  50          push eax
10001C73 .  E8 D8080000 call 10002550
10001C78 .  EB 21       jmp    short 10001C9B
10001C7A .  8B45 EC    mov    eax, dword ptr [ebp-14]
10001C7D .  8B08       mov    ecx, dword ptr [eax]
10001C7F .  8B09       mov    ecx, dword ptr [ecx]
10001C81 .  894D 98    mov    dword ptr [ebp-68], ecx
10001C84 .  50          push eax
10001C85 .  51          push ecx
10001C86 .  E8 D5090000 call 10002660
10001C8B .  83C4 08    add    esp, 8
10001C8E .  C3          retn
10001C8F .  8B65 E8    mov    esp, dword ptr [ebp-18]
10001C92 .  8B55 98    mov    edx, dword ptr [ebp-68]
10001C95 .  52          push edx
10001C96 .  E8 D5080000 call 10002570
10001C9B >  83C4 04    add    esp, 4
10001C9E .  C745 FC FFFFF>mov    dword ptr [ebp-4], -1
10001CA5 .  8B4D F0    mov    ecx, dword ptr [ebp-10]
10001CA8 .  64:890D 00000>mov    dword ptr fs:[0], ecx
10001CAF .  5F          pop    edi
10001CB0 .  5E          pop    esi
10001CB1 .  5B          pop    ebx
10001CB2 .  8BE5       mov    esp, ebp
10001CB4 .  5D          pop    ebp
10001CB5 .  C3          retn
10001CB6 >  803E 20    cmp    byte ptr [esi], 20
10001CB9 .^ 0F86 68FFFFFF jbe    10001C27
10001CBF .  46          inc    esi
10001CC0 .  8975 9C    mov    dword ptr [ebp-64], esi
10001CC3 .^ EB F1       jmp    short 10001CB6
10001CC5    90          nop
10001CC6    90          nop
10001CC7    90          nop
10001CC8    90          nop
10001CC9    90          nop
10001CCA    90          nop
10001CCB    90          nop
10001CCC    90          nop
10001CCD    90          nop
10001CCE    90          nop
10001CCF    90          nop
10001CD0  /$  833D C4840010>cmp    dword ptr [100084C4], 1
10001CD7  |.  75 05       jnz    short 10001CDE
10001CD9  |.  E8 22140000 call 10003100
10001CDE  |>  8B4424 04    mov    eax, dword ptr [esp+4]
10001CE2  |.  50          push eax
10001CE3  |.  E8 58140000 call 10003140
10001CE8  |.  83C4 04    add    esp, 4
10001CEB  |.  68 FF000000 push 0FF
10001CF0  |.  FF15 30600010 call dword ptr [10006030]          ;  pjgl.10002570
10001CF6  |.  83C4 04    add    esp, 4
10001CF9  \.  C3          retn
10001CFA    90          nop
10001CFB    90          nop
10001CFC    90          nop
10001CFD    90          nop
10001CFE    90          nop
10001CFF    90          nop
10001D00  /$  833D C4840010>cmp    dword ptr [100084C4], 1
10001D07  |.  75 05       jnz    short 10001D0E
10001D09  |.  E8 F2130000 call 10003100
10001D0E  |>  8B4424 04    mov    eax, dword ptr [esp+4]
10001D12  |.  50          push eax
10001D13  |.  E8 28140000 call 10003140
10001D18  |.  83C4 04    add    esp, 4
10001D1B  |.  68 FF000000 push 0FF                            ; /ExitCode = FF
10001D20  \.  FF15 20500010 call dword ptr [<&KERNEL32.ExitProces>; \ExitProcess
10001D26 .  C3          retn
10001D27    90          nop
10001D28    90          nop
10001D29    90          nop
10001D2A    90          nop

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

收藏・0

免费・0

支持

最新回复 (4)
longdf 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 8 粉丝 0 关注私信	longdf 2 楼 10001D2A 90 nop 10001D2B 90 nop 10001D2C 90 nop 10001D2D 90 nop 10001D2E 90 nop 10001D2F 90 nop 10001D30 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10001D34 \|. 83EC 14 sub esp, 14 10001D37 \|. 53 push ebx 10001D38 \|. 55 push ebp 10001D39 \|. 56 push esi 10001D3A \|. 57 push edi 10001D3B \|. 50 push eax 10001D3C \|. E8 FF010000 call 10001F40 10001D41 \|. 8BC8 mov ecx, eax 10001D43 \|. A1 D0860010 mov eax, dword ptr [100086D0] 10001D48 \|. 83C4 04 add esp, 4 10001D4B \|. 3BC8 cmp ecx, eax 10001D4D \|. 894C24 28 mov dword ptr [esp+28], ecx 10001D51 \|. 75 0A jnz short 10001D5D 10001D53 \|. 33C0 xor eax, eax 10001D55 \|. 5F pop edi 10001D56 \|. 5E pop esi 10001D57 \|. 5D pop ebp 10001D58 \|. 5B pop ebx 10001D59 \|. 83C4 14 add esp, 14 10001D5C \|. C3 retn 10001D5D \|> 85C9 test ecx, ecx 10001D5F \|. 75 14 jnz short 10001D75 10001D61 \|. E8 8A020000 call 10001FF0 10001D66 \|. E8 C5020000 call 10002030 10001D6B \|. 33C0 xor eax, eax 10001D6D \|. 5F pop edi 10001D6E \|. 5E pop esi 10001D6F \|. 5D pop ebp 10001D70 \|. 5B pop ebx 10001D71 \|. 83C4 14 add esp, 14 10001D74 \|. C3 retn 10001D75 \|> 33D2 xor edx, edx 10001D77 \|. B8 40600010 mov eax, 10006040 10001D7C \|> 3908 /cmp dword ptr [eax], ecx 10001D7E \|. 0F84 07010000 \|je 10001E8B 10001D84 \|. 83C0 30 \|add eax, 30 10001D87 \|. 42 \|inc edx 10001D88 \|. 3D 30610010 \|cmp eax, 10006130 10001D8D \|.^ 72 ED \jb short 10001D7C 10001D8F \|. 8D5424 10 lea edx, dword ptr [esp+10] 10001D93 \|. 52 push edx ; /pCPInfo 10001D94 \|. 51 push ecx ; \|CodePage 10001D95 \|. FF15 0C500010 call dword ptr [<&KERNEL32.GetCPInfo>>; \GetCPInfo 10001D9B \|. BE 01000000 mov esi, 1 10001DA0 \|. 3BC6 cmp eax, esi 10001DA2 \|. 0F85 BB000000 jnz 10001E63 10001DA8 \|. B9 40000000 mov ecx, 40 10001DAD \|. 33C0 xor eax, eax 10001DAF \|. BF C8840010 mov edi, 100084C8 10001DB4 \|. F3:AB rep stos dword ptr es:[edi] 10001DB6 \|. 8B4C24 10 mov ecx, dword ptr [esp+10] 10001DBA \|. AA stos byte ptr es:[edi] 10001DBB \|. 8B7C24 28 mov edi, dword ptr [esp+28] 10001DBF \|. 33C0 xor eax, eax 10001DC1 \|. 3BCE cmp ecx, esi 10001DC3 \|. 893D D0860010 mov dword ptr [100086D0], edi 10001DC9 \|. A3 D4860010 mov dword ptr [100086D4], eax 10001DCE \|. 76 6E jbe short 10001E3E 10001DD0 \|. 8A4424 16 mov al, byte ptr [esp+16] 10001DD4 \|. 84C0 test al, al 10001DD6 \|. 74 37 je short 10001E0F 10001DD8 \|. 8D5424 17 lea edx, dword ptr [esp+17] 10001DDC \|> 8A0A /mov cl, byte ptr [edx] 10001DDE \|. 84C9 \|test cl, cl 10001DE0 \|. 74 2D \|je short 10001E0F 10001DE2 \|. 33C0 \|xor eax, eax 10001DE4 \|. 81E1 FF000000 \|and ecx, 0FF 10001DEA \|. 8A42 FF \|mov al, byte ptr [edx-1] 10001DED \|. 3BC1 \|cmp eax, ecx 10001DEF \|. 77 14 \|ja short 10001E05 10001DF1 \|> 8A98 C9840010 \|/mov bl, byte ptr [eax+100084C9] 10001DF7 \|. 80CB 04 \|\|or bl, 4 10001DFA \|. 8898 C9840010 \|\|mov byte ptr [eax+100084C9], bl 10001E00 \|. 40 \|\|inc eax 10001E01 \|. 3BC1 \|\|cmp eax, ecx 10001E03 \|.^ 76 EC \|\jbe short 10001DF1 10001E05 \|> 8A42 01 \|mov al, byte ptr [edx+1] 10001E08 \|. 83C2 02 \|add edx, 2 10001E0B \|. 84C0 \|test al, al 10001E0D \|.^ 75 CD \jnz short 10001DDC 10001E0F \|> 8BC6 mov eax, esi 10001E11 \|> 8A98 C9840010 /mov bl, byte ptr [eax+100084C9] 10001E17 \|. 80CB 08 \|or bl, 8 10001E1A \|. 8898 C9840010 \|mov byte ptr [eax+100084C9], bl 10001E20 \|. 40 \|inc eax 10001E21 \|. 3D FF000000 \|cmp eax, 0FF 10001E26 \|.^ 72 E9 \jb short 10001E11 10001E28 \|. 57 push edi 10001E29 \|. E8 62010000 call 10001F90 10001E2E \|. 83C4 04 add esp, 4 10001E31 \|. A3 D4860010 mov dword ptr [100086D4], eax 10001E36 \|. 8935 B0890010 mov dword ptr [100089B0], esi 10001E3C \|. EB 05 jmp short 10001E43 10001E3E \|> A3 B0890010 mov dword ptr [100089B0], eax 10001E43 \|> 33C0 xor eax, eax 10001E45 \|. A3 D8860010 mov dword ptr [100086D8], eax 10001E4A \|. A3 DC860010 mov dword ptr [100086DC], eax 10001E4F \|. A3 E0860010 mov dword ptr [100086E0], eax 10001E54 \|. E8 D7010000 call 10002030 10001E59 \|. 33C0 xor eax, eax 10001E5B \|. 5F pop edi 10001E5C \|. 5E pop esi 10001E5D \|. 5D pop ebp 10001E5E \|. 5B pop ebx 10001E5F \|. 83C4 14 add esp, 14 10001E62 \|. C3 retn 10001E63 \|> A1 E4860010 mov eax, dword ptr [100086E4] 10001E68 \|. 85C0 test eax, eax 10001E6A \|. 74 14 je short 10001E80 10001E6C \|. E8 7F010000 call 10001FF0 10001E71 \|. E8 BA010000 call 10002030 10001E76 \|. 33C0 xor eax, eax 10001E78 \|. 5F pop edi 10001E79 \|. 5E pop esi 10001E7A \|. 5D pop ebp 10001E7B \|. 5B pop ebx 10001E7C \|. 83C4 14 add esp, 14 10001E7F \|. C3 retn 10001E80 \|> 83C8 FF or eax, FFFFFFFF 10001E83 \|. 5F pop edi 10001E84 \|. 5E pop esi 10001E85 \|. 5D pop ebp 10001E86 \|. 5B pop ebx 10001E87 \|. 83C4 14 add esp, 14 10001E8A \|. C3 retn 10001E8B \|> B9 40000000 mov ecx, 40 10001E90 \|. 33C0 xor eax, eax 10001E92 \|. BF C8840010 mov edi, 100084C8 10001E97 \|. 8D1C52 lea ebx, dword ptr [edx+edx2] 10001E9A \|. F3:AB rep stos dword ptr es:[edi] 10001E9C \|. AA stos byte ptr es:[edi] 10001E9D \|. 33FF xor edi, edi 10001E9F \|. C1E3 04 shl ebx, 4 10001EA2 \|. 8DAB 50600010 lea ebp, dword ptr [ebx+10006050] 10001EA8 \|> 8A45 00 /mov al, byte ptr [ebp] 10001EAB \|. 8BF5 \|mov esi, ebp 10001EAD \|. 84C0 \|test al, al 10001EAF \|. 74 30 \|je short 10001EE1 10001EB1 \|> 8A4E 01 \|/mov cl, byte ptr [esi+1] 10001EB4 \|. 84C9 \|\|test cl, cl 10001EB6 \|. 74 29 \|\|je short 10001EE1 10001EB8 \|. 33C0 \|\|xor eax, eax 10001EBA \|. 81E1 FF000000 \|\|and ecx, 0FF 10001EC0 \|. 8A06 \|\|mov al, byte ptr [esi] 10001EC2 \|. 3BC1 \|\|cmp eax, ecx 10001EC4 \|. 77 11 \|\|ja short 10001ED7 10001EC6 \|. 8A97 38600010 \|\|mov dl, byte ptr [edi+10006038] 10001ECC \|> 0890 C9840010 \|\|/or byte ptr [eax+100084C9], dl 10001ED2 \|. 40 \|\|\|inc eax 10001ED3 \|. 3BC1 \|\|\|cmp eax, ecx 10001ED5 \|.^ 76 F5 \|\|\jbe short 10001ECC 10001ED7 \|> 8A46 02 \|\|mov al, byte ptr [esi+2] 10001EDA \|. 83C6 02 \|\|add esi, 2 10001EDD \|. 84C0 \|\|test al, al 10001EDF \|.^ 75 D0 \|\jnz short 10001EB1 10001EE1 \|> 47 \|inc edi 10001EE2 \|. 83C5 08 \|add ebp, 8 10001EE5 \|. 83FF 04 \|cmp edi, 4 10001EE8 \|.^ 72 BE \jb short 10001EA8 10001EEA \|. 8B4424 28 mov eax, dword ptr [esp+28] 10001EEE \|. C705 B0890010>mov dword ptr [100089B0], 1 10001EF8 \|. 50 push eax 10001EF9 \|. A3 D0860010 mov dword ptr [100086D0], eax 10001EFE \|. E8 8D000000 call 10001F90 10001F03 \|. 8B8B 44600010 mov ecx, dword ptr [ebx+10006044] 10001F09 \|. 8B93 48600010 mov edx, dword ptr [ebx+10006048] 10001F0F \|. A3 D4860010 mov dword ptr [100086D4], eax 10001F14 \|. 8D83 44600010 lea eax, dword ptr [ebx+10006044] 10001F1A \|. 83C4 04 add esp, 4 10001F1D \|. 890D D8860010 mov dword ptr [100086D8], ecx 10001F23 \|. 8B40 08 mov eax, dword ptr [eax+8] 10001F26 \|. 8915 DC860010 mov dword ptr [100086DC], edx 10001F2C \|. A3 E0860010 mov dword ptr [100086E0], eax 10001F31 \|. E8 FA000000 call 10002030 10001F36 \|. 5F pop edi 10001F37 \|. 5E pop esi 10001F38 \|. 5D pop ebp 10001F39 \|. 33C0 xor eax, eax 10001F3B \|. 5B pop ebx 10001F3C \|. 83C4 14 add esp, 14 10001F3F \. C3 retn 10001F40 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10001F44 \|. C705 E4860010>mov dword ptr [100086E4], 0 10001F4E \|. 83F8 FE cmp eax, -2 ; Switch (cases FFFFFFFC..FFFFFFFE) 10001F51 \|. 75 10 jnz short 10001F63 10001F53 \|. C705 E4860010>mov dword ptr [100086E4], 1 ; Case FFFFFFFE of switch 10001F4E 10001F5D \|.- FF25 28500010 jmp dword ptr [<&KERNEL32.GetOEMCP>] ; kernel32.GetOEMCP 10001F63 \|> 83F8 FD cmp eax, -3 10001F66 \|. 75 10 jnz short 10001F78 10001F68 \|. C705 E4860010>mov dword ptr [100086E4], 1 ; Case FFFFFFFD of switch 10001F4E 10001F72 \|.- FF25 24500010 jmp dword ptr [<&KERNEL32.GetACP>] ; kernel32.GetACP 10001F78 \|> 83F8 FC cmp eax, -4 10001F7B \|. 75 0F jnz short 10001F8C 10001F7D \|. A1 08870010 mov eax, dword ptr [10008708] ; Case FFFFFFFC of switch 10001F4E 10001F82 \|. C705 E4860010>mov dword ptr [100086E4], 1 10001F8C \> C3 retn ; Default case of switch 10001F4E 10001F8D 90 nop 10001F8E 90 nop 10001F8F 90 nop 10001F90 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10001F94 \|. 05 5CFCFFFF add eax, -3A4 ; Switch (cases 3A4..3B6) 10001F99 \|. 83F8 12 cmp eax, 12 10001F9C \|. 77 27 ja short 10001FC5 10001F9E \|. 33C9 xor ecx, ecx 10001FA0 \|. 8A88 DC1F0010 mov cl, byte ptr [eax+10001FDC] 10001FA6 \|. FF248D C81F00>jmp dword ptr [ecx4+10001FC8] 10001FAD \|> B8 11040000 mov eax, 411 ; Case 3A4 of switch 10001F94 10001FB2 \|. C3 retn 10001FB3 \|> B8 04080000 mov eax, 804 ; Case 3A8 of switch 10001F94 10001FB8 \|. C3 retn 10001FB9 \|> B8 12040000 mov eax, 412 ; Case 3B5 of switch 10001F94 10001FBE \|. C3 retn 10001FBF \|> B8 04040000 mov eax, 404 ; Case 3B6 of switch 10001F94 10001FC4 \|. C3 retn 10001FC5 \|> 33C0 xor eax, eax ; Default case of switch 10001F94 10001FC7 \. C3 retn 10001FC8 . AD1F0010 dd pjgl.10001FAD ; 分支表被用于 10001FA6 10001FCC . B31F0010 dd pjgl.10001FB3 10001FD0 . B91F0010 dd pjgl.10001FB9 10001FD4 . BF1F0010 dd pjgl.10001FBF 10001FD8 . C51F0010 dd pjgl.10001FC5 10001FDC . 00 db 00 ; 分支 10001FC8 索引表 10001FDD . 04 db 04 10001FDE . 04 db 04 10001FDF . 04 db 04 10001FE0 . 01 db 01 10001FE1 . 04 db 04 10001FE2 . 04 db 04 10001FE3 . 04 db 04 10001FE4 . 04 db 04 10001FE5 . 04 db 04 10001FE6 . 04 db 04 10001FE7 . 04 db 04 10001FE8 . 04 db 04 10001FE9 . 04 db 04 10001FEA . 04 db 04 10001FEB . 04 db 04 10001FEC . 04 db 04 10001FED . 02 db 02 10001FEE . 03 db 03 10001FEF 90 nop 10001FF0 /$ 57 push edi 10001FF1 \|. B9 40000000 mov ecx, 40 10001FF6 \|. 33C0 xor eax, eax 10001FF8 \|. BF C8840010 mov edi, 100084C8 10001FFD \|. F3:AB rep stos dword ptr es:[edi] 10001FFF \|. AA stos byte ptr es:[edi] 10002000 \|. 33C0 xor eax, eax 10002002 \|. 5F pop edi 10002003 \|. A3 D0860010 mov dword ptr [100086D0], eax 10002008 \|. A3 B0890010 mov dword ptr [100089B0], eax 1000200D \|. A3 D4860010 mov dword ptr [100086D4], eax 10002012 \|. A3 D8860010 mov dword ptr [100086D8], eax 10002017 \|. A3 DC860010 mov dword ptr [100086DC], eax 1000201C \|. A3 E0860010 mov dword ptr [100086E0], eax 10002021 \. C3 retn 10002022 90 nop 10002023 90 nop 10002024 90 nop 10002025 90 nop 10002026 90 nop 10002027 90 nop 10002028 90 nop 10002029 90 nop 1000202A 90 nop 1000202B 90 nop 1000202C 90 nop 1000202D 90 nop 1000202E 90 nop 1000202F 90 nop 10002030 /$ 8B0D D0860010 mov ecx, dword ptr [100086D0] 10002036 \|. 81EC 14050000 sub esp, 514 1000203C \|. 8D4424 00 lea eax, dword ptr [esp] 10002040 \|. 53 push ebx 10002041 \|. 50 push eax ; /pCPInfo 10002042 \|. 51 push ecx ; \|CodePage => CP_ACP 10002043 \|. FF15 0C500010 call dword ptr [<&KERNEL32.GetCPInfo>>; \GetCPInfo 10002049 \|. 83F8 01 cmp eax, 1 1000204C \|. 0F85 52010000 jnz 100021A4 10002052 \|. 57 push edi 10002053 \|. 56 push esi 10002054 \|. 33C0 xor eax, eax 10002056 \|> 884404 20 /mov byte ptr [esp+eax+20], al 1000205A \|. 40 \|inc eax 1000205B \|. 3D 00010000 \|cmp eax, 100 10002060 \|.^ 72 F4 \jb short 10002056 10002062 \|. 8A4424 12 mov al, byte ptr [esp+12] 10002066 \|. C64424 20 20 mov byte ptr [esp+20], 20 1000206B \|. 84C0 test al, al 1000206D \|. 74 35 je short 100020A4 1000206F \|. 8D5424 13 lea edx, dword ptr [esp+13] 10002073 \|> 33C9 /xor ecx, ecx 10002075 \|. 25 FF000000 \|and eax, 0FF 1000207A \|. 8A0A \|mov cl, byte ptr [edx] 1000207C \|. 3BC1 \|cmp eax, ecx 1000207E \|. 77 1A \|ja short 1000209A 10002080 \|. 2BC8 \|sub ecx, eax 10002082 \|. 8D7C04 20 \|lea edi, dword ptr [esp+eax+20] 10002086 \|. 41 \|inc ecx 10002087 \|. B8 20202020 \|mov eax, 20202020 1000208C \|. 8BF1 \|mov esi, ecx 1000208E \|. C1E9 02 \|shr ecx, 2 10002091 \|. F3:AB \|rep stos dword ptr es:[edi] 10002093 \|. 8BCE \|mov ecx, esi 10002095 \|. 83E1 03 \|and ecx, 3 10002098 \|. F3:AA \|rep stos byte ptr es:[edi] 1000209A \|> 8A42 01 \|mov al, byte ptr [edx+1] 1000209D \|. 83C2 02 \|add edx, 2 100020A0 \|. 84C0 \|test al, al 100020A2 \|.^ 75 CF \jnz short 10002073 100020A4 \|> 8B15 D4860010 mov edx, dword ptr [100086D4] 100020AA \|. A1 D0860010 mov eax, dword ptr [100086D0] 100020AF \|. 6A 00 push 0 100020B1 \|. 52 push edx 100020B2 \|. 8D8C24 280300>lea ecx, dword ptr [esp+328] 100020B9 \|. 50 push eax 100020BA \|. 51 push ecx 100020BB \|. 8D5424 30 lea edx, dword ptr [esp+30] 100020BF \|. 68 00010000 push 100 100020C4 \|. 52 push edx 100020C5 \|. 6A 01 push 1 100020C7 \|. E8 54120000 call 10003320 100020CC \|. A1 D0860010 mov eax, dword ptr [100086D0] 100020D1 \|. 83C4 1C add esp, 1C 100020D4 \|. 8D8C24 200100>lea ecx, dword ptr [esp+120] 100020DB \|. 8D5424 20 lea edx, dword ptr [esp+20] 100020DF \|. 6A 00 push 0 100020E1 \|. 50 push eax 100020E2 \|. A1 D4860010 mov eax, dword ptr [100086D4] 100020E7 \|. 68 00010000 push 100 100020EC \|. 51 push ecx 100020ED \|. 68 00010000 push 100 100020F2 \|. 52 push edx 100020F3 \|. 68 00010000 push 100 100020F8 \|. 50 push eax 100020F9 \|. E8 22010000 call 10002220 100020FE \|. 8B0D D0860010 mov ecx, dword ptr [100086D0] 10002104 \|. 83C4 20 add esp, 20 10002107 \|. 8D9424 200200>lea edx, dword ptr [esp+220] 1000210E \|. 8D4424 20 lea eax, dword ptr [esp+20] 10002112 \|. 6A 00 push 0 10002114 \|. 51 push ecx 10002115 \|. 8B0D D4860010 mov ecx, dword ptr [100086D4] 1000211B \|. 68 00010000 push 100 10002120 \|. 52 push edx 10002121 \|. 68 00010000 push 100 10002126 \|. 50 push eax 10002127 \|. 68 00020000 push 200 1000212C \|. 51 push ecx 1000212D \|. E8 EE000000 call 10002220 10002132 \|. 83C4 20 add esp, 20 10002135 \|. 33C0 xor eax, eax 10002137 \|. 8D9424 200300>lea edx, dword ptr [esp+320] 1000213E \|. B3 10 mov bl, 10 10002140 \|> 66:8B0A /mov cx, word ptr [edx] 10002143 \|. F6C1 01 \|test cl, 1 10002146 \|. 74 1D \|je short 10002165 10002148 \|. 8A88 C9840010 \|mov cl, byte ptr [eax+100084C9] 1000214E \|. 0ACB \|or cl, bl 10002150 \|. 8888 C9840010 \|mov byte ptr [eax+100084C9], cl 10002156 \|. 8A8C04 200100>\|mov cl, byte ptr [esp+eax+120] 1000215D \|. 8888 D0850010 \|mov byte ptr [eax+100085D0], cl 10002163 \|. EB 2A \|jmp short 1000218F 10002165 \|> F6C1 02 \|test cl, 2 10002168 \|. 74 1E \|je short 10002188 1000216A \|. 8A88 C9840010 \|mov cl, byte ptr [eax+100084C9] 10002170 \|. 80C9 20 \|or cl, 20 10002173 \|. 8888 C9840010 \|mov byte ptr [eax+100084C9], cl 10002179 \|. 8A8C04 200200>\|mov cl, byte ptr [esp+eax+220] 10002180 \|. 8888 D0850010 \|mov byte ptr [eax+100085D0], cl 10002186 \|. EB 07 \|jmp short 1000218F 10002188 \|> C680 D0850010>\|mov byte ptr [eax+100085D0], 0 1000218F \|> 40 \|inc eax 10002190 \|. 83C2 02 \|add edx, 2 10002193 \|. 3D 00010000 \|cmp eax, 100 10002198 \|.^ 72 A6 \jb short 10002140 1000219A \|. 5E pop esi 1000219B \|. 5F pop edi 1000219C \|. 5B pop ebx 1000219D \|. 81C4 14050000 add esp, 514 100021A3 \|. C3 retn 100021A4 \|> 33C0 xor eax, eax 100021A6 \|. B3 10 mov bl, 10 100021A8 \|> 83F8 41 /cmp eax, 41 100021AB \|. 72 20 \|jb short 100021CD 100021AD \|. 83F8 5A \|cmp eax, 5A 100021B0 \|. 77 1B \|ja short 100021CD 100021B2 \|. 8A90 C9840010 \|mov dl, byte ptr [eax+100084C9] 100021B8 \|. 0AD3 \|or dl, bl 100021BA \|. 8890 C9840010 \|mov byte ptr [eax+100084C9], dl 100021C0 \|. 8AD0 \|mov dl, al 100021C2 \|. 80C2 20 \|add dl, 20 100021C5 \|. 8890 D0850010 \|mov byte ptr [eax+100085D0], dl 100021CB \|. EB 2D \|jmp short 100021FA 100021CD \|> 83F8 61 \|cmp eax, 61 100021D0 \|. 72 21 \|jb short 100021F3 100021D2 \|. 83F8 7A \|cmp eax, 7A 100021D5 \|. 77 1C \|ja short 100021F3 100021D7 \|. 8A88 C9840010 \|mov cl, byte ptr [eax+100084C9] 100021DD \|. 80C9 20 \|or cl, 20 100021E0 \|. 8888 C9840010 \|mov byte ptr [eax+100084C9], cl 100021E6 \|. 8AC8 \|mov cl, al 100021E8 \|. 80E9 20 \|sub cl, 20 100021EB \|. 8888 D0850010 \|mov byte ptr [eax+100085D0], cl 100021F1 \|. EB 07 \|jmp short 100021FA 100021F3 \|> C680 D0850010>\|mov byte ptr [eax+100085D0], 0 100021FA \|> 40 \|inc eax 100021FB \|. 3D 00010000 \|cmp eax, 100 10002200 \|.^ 72 A6 \jb short 100021A8 10002202 \|. 5B pop ebx 10002203 \|. 81C4 14050000 add esp, 514 10002209 \. C3 retn 1000220A 90 nop 1000220B 90 nop 1000220C 90 nop 1000220D 90 nop 1000220E 90 nop 1000220F 90 nop 10002210 /$ 6A FD push -3 10002212 \|. E8 19FBFFFF call 10001D30 10002217 \|. 83C4 04 add esp, 4 1000221A \. C3 retn 1000221B 90 nop 1000221C 90 nop 1000221D 90 nop 1000221E 90 nop 1000221F 90 nop 10002220 /$ A1 EC860010 mov eax, dword ptr [100086EC] 10002225 \|. 53 push ebx 10002226 \|. 8B1D 34500010 mov ebx, dword ptr [<&KERNEL32.LCMap>; kernel32.LCMapStringA 1000222C \|. 55 push ebp 1000222D \|. 56 push esi 1000222E \|. 57 push edi 1000222F \|. 85C0 test eax, eax 10002231 \|. 75 49 jnz short 1000227C 10002233 \|. 6A 00 push 0 ; /DestSize = 0 10002235 \|. 6A 00 push 0 ; \|DestString = NULL 10002237 \|. 6A 01 push 1 ; \|SrcSize = 1 10002239 \|. 68 B0500010 push 100050B0 ; \|SrcString = "" 1000223E \|. 68 00010000 push 100 ; \|MapFlags = LCMAP_LOWERCASE 10002243 \|. 6A 00 push 0 ; \|LocaleId = 0 10002245 \|. FF15 38500010 call dword ptr [<&KERNEL32.LCMapStrin>; \LCMapStringW 1000224B \|. 85C0 test eax, eax 1000224D \|. 74 07 je short 10002256 1000224F \|. B8 01000000 mov eax, 1 10002254 \|. EB 21 jmp short 10002277 10002256 \|> 6A 00 push 0 10002258 \|. 6A 00 push 0 1000225A \|. 6A 01 push 1 1000225C \|. 68 AC500010 push 100050AC 10002261 \|. 68 00010000 push 100 10002266 \|. 6A 00 push 0 10002268 \|. FFD3 call ebx 1000226A \|. 85C0 test eax, eax 1000226C \|. 0F84 CC010000 je 1000243E 10002272 \|. B8 02000000 mov eax, 2 10002277 \|> A3 EC860010 mov dword ptr [100086EC], eax 1000227C \|> 8B7424 20 mov esi, dword ptr [esp+20] 10002280 \|. 85F6 test esi, esi 10002282 \|. 7E 17 jle short 1000229B 10002284 \|. 8B7C24 1C mov edi, dword ptr [esp+1C] 10002288 \|. 56 push esi 10002289 \|. 57 push edi 1000228A \|. E8 C1010000 call 10002450 1000228F \|. 8BF0 mov esi, eax 10002291 \|. A1 EC860010 mov eax, dword ptr [100086EC] 10002296 \|. 83C4 08 add esp, 8 10002299 \|. EB 04 jmp short 1000229F 1000229B \|> 8B7C24 1C mov edi, dword ptr [esp+1C] 1000229F \|> 83F8 02 cmp eax, 2 100022A2 \|. 75 1D jnz short 100022C1 100022A4 \|. 8B4424 28 mov eax, dword ptr [esp+28] 100022A8 \|. 8B4C24 24 mov ecx, dword ptr [esp+24] 100022AC \|. 8B5424 18 mov edx, dword ptr [esp+18] 100022B0 \|. 50 push eax 100022B1 \|. 8B4424 18 mov eax, dword ptr [esp+18] 100022B5 \|. 51 push ecx 100022B6 \|. 56 push esi 100022B7 \|. 57 push edi 100022B8 \|. 52 push edx 100022B9 \|. 50 push eax 100022BA \|. FFD3 call ebx 100022BC \|. 5F pop edi 100022BD \|. 5E pop esi 100022BE \|. 5D pop ebp 100022BF \|. 5B pop ebx 100022C0 \|. C3 retn 100022C1 \|> 83F8 01 cmp eax, 1 100022C4 \|. 0F85 DD000000 jnz 100023A7 100022CA \|. 8B6C24 2C mov ebp, dword ptr [esp+2C] 100022CE \|. C74424 20 000>mov dword ptr [esp+20], 0 100022D6 \|. 85ED test ebp, ebp 100022D8 \|. 75 0C jnz short 100022E6 100022DA \|. 8B0D 08870010 mov ecx, dword ptr [10008708] 100022E0 \|. 894C24 2C mov dword ptr [esp+2C], ecx 100022E4 \|. 8BE9 mov ebp, ecx 100022E6 \|> 8B5424 30 mov edx, dword ptr [esp+30] 100022EA \|. 6A 00 push 0 ; /WideBufSize = 0 100022EC \|. F7DA neg edx ; \| 100022EE \|. 1BD2 sbb edx, edx ; \| 100022F0 \|. 6A 00 push 0 ; \|WideCharBuf = NULL 100022F2 \|. 83E2 08 and edx, 8 ; \| 100022F5 \|. 56 push esi ; \|StringSize 100022F6 \|. 42 inc edx ; \| 100022F7 \|. 57 push edi ; \|StringToMap 100022F8 \|. 52 push edx ; \|Options 100022F9 \|. 55 push ebp ; \|CodePage 100022FA \|. FF15 2C500010 call dword ptr [<&KERNEL32.MultiByteT>; \MultiByteToWideChar 10002300 \|. 8BF8 mov edi, eax 10002302 \|. 85FF test edi, edi 10002304 \|. 75 05 jnz short 1000230B 10002306 \|. 5F pop edi 10002307 \|. 5E pop esi 10002308 \|. 5D pop ebp 10002309 \|. 5B pop ebx 1000230A \|. C3 retn 1000230B \|> 8D043F lea eax, dword ptr [edi+edi] 1000230E \|. 50 push eax 1000230F \|. E8 9C120000 call 100035B0 10002314 \|. 8BD8 mov ebx, eax 10002316 \|. 83C4 04 add esp, 4 10002319 \|. 85DB test ebx, ebx 1000231B \|. 75 05 jnz short 10002322 1000231D \|. 5F pop edi 1000231E \|. 5E pop esi 1000231F \|. 5D pop ebp 10002320 \|. 5B pop ebx 10002321 \|. C3 retn 10002322 \|> 8B4C24 1C mov ecx, dword ptr [esp+1C] 10002326 \|. 57 push edi ; /WideBufSize 10002327 \|. 53 push ebx ; \|WideCharBuf 10002328 \|. 56 push esi ; \|StringSize 10002329 \|. 51 push ecx ; \|StringToMap 1000232A \|. 6A 01 push 1 ; \|Options = MB_PRECOMPOSED 1000232C \|. 55 push ebp ; \|CodePage 1000232D \|. FF15 2C500010 call dword ptr [<&KERNEL32.MultiByteT>; \MultiByteToWideChar 10002333 \|. 85C0 test eax, eax 10002335 \|. 0F84 ED000000 je 10002428 1000233B \|. 8B6C24 18 mov ebp, dword ptr [esp+18] 1000233F \|. 8B5424 14 mov edx, dword ptr [esp+14] 10002343 \|. 6A 00 push 0 ; /DestSize = 0 10002345 \|. 6A 00 push 0 ; \|DestString = NULL 10002347 \|. 57 push edi ; \|SrcSize 10002348 \|. 53 push ebx ; \|SrcString 10002349 \|. 55 push ebp ; \|MapFlags 1000234A \|. 52 push edx ; \|LocaleId 1000234B \|. FF15 38500010 call dword ptr [<&KERNEL32.LCMapStrin>; \LCMapStringW 10002351 \|. 8BF0 mov esi, eax 10002353 \|. 85F6 test esi, esi 10002355 \|. 0F84 CD000000 je 10002428 1000235B \|. F7C5 00040000 test ebp, 400 10002361 \|. 74 49 je short 100023AC 10002363 \|. 8B4424 28 mov eax, dword ptr [esp+28] 10002367 \|. 85C0 test eax, eax 10002369 \|. 74 24 je short 1000238F 1000236B \|. 3BF0 cmp esi, eax 1000236D \|. 0F8F B5000000 jg 10002428 10002373 \|. 8B4C24 14 mov ecx, dword ptr [esp+14] 10002377 \|. 50 push eax ; /DestSize 10002378 \|. 8B4424 28 mov eax, dword ptr [esp+28] ; \| 1000237C \|. 50 push eax ; \|DestString 1000237D \|. 57 push edi ; \|SrcSize 1000237E \|. 53 push ebx ; \|SrcString 1000237F \|. 55 push ebp ; \|MapFlags 10002380 \|. 51 push ecx ; \|LocaleId 10002381 \|. FF15 38500010 call dword ptr [<&KERNEL32.LCMapStrin>; \LCMapStringW 10002387 \|. 85C0 test eax, eax 10002389 \|. 0F84 99000000 je 10002428 1000238F \|> 53 push ebx 10002390 \|. E8 CB100000 call 10003460 10002395 \|. 8B5424 24 mov edx, dword ptr [esp+24] 10002399 \|. 83C4 04 add esp, 4 1000239C \|. 52 push edx 1000239D \|. E8 BE100000 call 10003460 100023A2 \|. 83C4 04 add esp, 4 100023A5 \|. 8BC6 mov eax, esi 100023A7 \|> 5F pop edi 100023A8 \|. 5E pop esi 100023A9 \|. 5D pop ebp 100023AA \|. 5B pop ebx 100023AB \|. C3 retn 100023AC \|> 8D1436 lea edx, dword ptr [esi+esi] 100023AF \|. 52 push edx 100023B0 \|. E8 FB110000 call 100035B0 100023B5 \|. 83C4 04 add esp, 4 100023B8 \|. 894424 20 mov dword ptr [esp+20], eax 100023BC \|. 85C0 test eax, eax 100023BE \|. 74 68 je short 10002428 100023C0 \|. 8B4C24 14 mov ecx, dword ptr [esp+14] 100023C4 \|. 56 push esi ; /DestSize 100023C5 \|. 50 push eax ; \|DestString 100023C6 \|. 57 push edi ; \|SrcSize 100023C7 \|. 53 push ebx ; \|SrcString 100023C8 \|. 55 push ebp ; \|MapFlags 100023C9 \|. 51 push ecx ; \|LocaleId 100023CA \|. FF15 38500010 call dword ptr [<&KERNEL32.LCMapStrin>; \LCMapStringW 100023D0 \|. 85C0 test eax, eax 100023D2 \|. 74 54 je short 10002428 100023D4 \|. 8B4424 28 mov eax, dword ptr [esp+28] 100023D8 \|. 6A 00 push 0 ; /pDefaultCharUsed = NULL 100023DA \|. 85C0 test eax, eax ; \| 100023DC \|. 6A 00 push 0 ; \|pDefaultChar = NULL 100023DE \|. 75 22 jnz short 10002402 ; \| 100023E0 \|. 8B5424 28 mov edx, dword ptr [esp+28] ; \| 100023E4 \|. 8B4424 34 mov eax, dword ptr [esp+34] ; \| 100023E8 \|. 6A 00 push 0 ; \|MultiByteCount = 0 100023EA \|. 6A 00 push 0 ; \|MultiByteStr = NULL 100023EC \|. 56 push esi ; \|WideCharCount 100023ED \|. 52 push edx ; \|WideCharStr 100023EE \|. 68 20020000 push 220 ; \|Options = WC_COMPOSITECHECK\|WC_SEPCHARS 100023F3 \|. 50 push eax ; \|CodePage 100023F4 \|. FF15 30500010 call dword ptr [<&KERNEL32.WideCharTo>; \WideCharToMultiByte 100023FA \|. 8BF0 mov esi, eax 100023FC \|. 85F6 test esi, esi 100023FE \|. 74 28 je short 10002428 10002400 \|.^ EB 8D jmp short 1000238F 10002402 \|> 8B4C24 2C mov ecx, dword ptr [esp+2C] ; \| 10002406 \|. 8B5424 28 mov edx, dword ptr [esp+28] ; \| 1000240A \|. 50 push eax ; \|MultiByteCount 1000240B \|. 8B4424 38 mov eax, dword ptr [esp+38] ; \| 1000240F \|. 51 push ecx ; \|MultiByteStr 10002410 \|. 56 push esi ; \|WideCharCount 10002411 \|. 52 push edx ; \|WideCharStr 10002412 \|. 68 20020000 push 220 ; \|Options = WC_COMPOSITECHECK\|WC_SEPCHARS 10002417 \|. 50 push eax ; \|CodePage 10002418 \|. FF15 30500010 call dword ptr [<&KERNEL32.WideCharTo>; \WideCharToMultiByte 1000241E \|. 8BF0 mov esi, eax 10002420 \|. 85F6 test esi, esi 10002422 \|.^ 0F85 67FFFFFF jnz 1000238F 10002428 \|> 53 push ebx 10002429 \|. E8 32100000 call 10003460 1000242E \|. 8B4C24 24 mov ecx, dword ptr [esp+24] 10002432 \|. 83C4 04 add esp, 4 10002435 \|. 51 push ecx 10002436 \|. E8 25100000 call 10003460 1000243B \|. 83C4 04 add esp, 4 1000243E \|> 5F pop edi 1000243F \|. 5E pop esi 10002440 \|. 5D pop ebp 10002441 \|. 33C0 xor eax, eax 10002443 \|. 5B pop ebx 10002444 \. C3 retn 10002445 90 nop 10002446 90 nop 10002447 90 nop 10002448 90 nop 10002449 90 nop 1000244A 90 nop 1000244B 90 nop 1000244C 90 nop 1000244D 90 nop 1000244E 90 nop 1000244F 90 nop 10002450 /$ 8B5424 08 mov edx, dword ptr [esp+8] 10002454 \|. 56 push esi 10002455 \|. 8B7424 08 mov esi, dword ptr [esp+8] 10002459 \|. 85D2 test edx, edx 1000245B \|. 57 push edi 1000245C \|. 8BC6 mov eax, esi 1000245E \|. 8D4A FF lea ecx, dword ptr [edx-1] 10002461 \|. 74 0D je short 10002470 10002463 \|> 8038 00 /cmp byte ptr [eax], 0 10002466 \|. 74 08 \|je short 10002470 10002468 \|. 40 \|inc eax 10002469 \|. 8BF9 \|mov edi, ecx 1000246B \|. 49 \|dec ecx 1000246C \|. 85FF \|test edi, edi 1000246E \|.^ 75 F3 \jnz short 10002463 10002470 \|> 8038 00 cmp byte ptr [eax], 0 10002473 \|. 75 05 jnz short 1000247A 10002475 \|. 2BC6 sub eax, esi 10002477 \|. 5F pop edi 10002478 \|. 5E pop esi 10002479 \|. C3 retn 1000247A \|> 5F pop edi 1000247B \|. 5E pop esi 1000247C \|. 8BC2 mov eax, edx 1000247E \. C3 retn 1000247F 90 nop 10002480 /$ 51 push ecx 10002481 \|. 8B4C24 08 mov ecx, dword ptr [esp+8] 10002485 \|. 56 push esi 10002486 \|. 8D41 01 lea eax, dword ptr [ecx+1] 10002489 \|. 3D 00010000 cmp eax, 100 1000248E \|. 77 15 ja short 100024A5 10002490 \|. 8B15 30610010 mov edx, dword ptr [10006130] ; pjgl.1000613A 10002496 \|. 33C0 xor eax, eax 10002498 \|. 66:8B044A mov ax, word ptr [edx+ecx2] 1000249C \|. 8B4C24 10 mov ecx, dword ptr [esp+10] 100024A0 \|. 23C1 and eax, ecx 100024A2 \|. 5E pop esi 100024A3 \|. 59 pop ecx 100024A4 \|. C3 retn 100024A5 \|> 8B35 30610010 mov esi, dword ptr [10006130] ; pjgl.1000613A 100024AB \|. 8BC1 mov eax, ecx 100024AD \|. C1F8 08 sar eax, 8 100024B0 \|. 8BD0 mov edx, eax 100024B2 \|. 81E2 FF000000 and edx, 0FF 100024B8 \|. F64456 01 80 test byte ptr [esi+edx2+1], 80 100024BD \|. 74 14 je short 100024D3 100024BF \|. 884424 0C mov byte ptr [esp+C], al 100024C3 \|. 884C24 0D mov byte ptr [esp+D], cl 100024C7 \|. C64424 0E 00 mov byte ptr [esp+E], 0 100024CC \|. B8 02000000 mov eax, 2 100024D1 \|. EB 0E jmp short 100024E1 100024D3 \|> 884C24 0C mov byte ptr [esp+C], cl 100024D7 \|. C64424 0D 00 mov byte ptr [esp+D], 0 100024DC \|. B8 01000000 mov eax, 1 100024E1 \|> 6A 01 push 1 100024E3 \|. 6A 00 push 0 100024E5 \|. 8D4C24 0C lea ecx, dword ptr [esp+C] 100024E9 \|. 6A 00 push 0 100024EB \|. 51 push ecx 100024EC \|. 8D5424 1C lea edx, dword ptr [esp+1C] 100024F0 \|. 50 push eax 100024F1 \|. 52 push edx 100024F2 \|. 6A 01 push 1 100024F4 \|. E8 270E0000 call 10003320 100024F9 \|. 83C4 1C add esp, 1C 100024FC \|. 85C0 test eax, eax 100024FE \|. 75 03 jnz short 10002503 10002500 \|. 5E pop esi 10002501 \|. 59 pop ecx 10002502 \|. C3 retn 10002503 \|> 8B4424 04 mov eax, dword ptr [esp+4] 10002507 \|. 8B4C24 10 mov ecx, dword ptr [esp+10] 1000250B \|. 25 FFFF0000 and eax, 0FFFF 10002510 \|. 5E pop esi 10002511 \|. 23C1 and eax, ecx 10002513 \|. 59 pop ecx 10002514 \. C3 retn 10002515 90 nop 10002516 90 nop 10002517 90 nop 10002518 90 nop 10002519 90 nop 1000251A 90 nop 1000251B 90 nop 1000251C 90 nop 1000251D 90 nop 1000251E 90 nop 1000251F 90 nop 10002520 /$ A1 AC890010 mov eax, dword ptr [100089AC] 10002525 \|. 85C0 test eax, eax 10002527 \|. 74 02 je short 1000252B 10002529 \|. FFD0 call eax 1000252B \|> 68 10600010 push 10006010 10002530 \|. 68 0C600010 push 1000600C 10002535 \|. E8 06010000 call 10002640 1000253A \|. 83C4 08 add esp, 8 1000253D \|. 68 08600010 push 10006008 10002542 \|. 68 00600010 push 10006000 10002547 \|. E8 F4000000 call 10002640 1000254C \|. 83C4 08 add esp, 8 1000254F \. C3 retn 10002550 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10002554 \|. 6A 00 push 0 10002556 \|. 6A 00 push 0 10002558 \|. 50 push eax 10002559 \|. E8 32000000 call 10002590 1000255E \|. 83C4 0C add esp, 0C 10002561 \. C3 retn 10002562 90 nop 10002563 90 nop 10002564 90 nop 10002565 90 nop 10002566 90 nop 10002567 90 nop 10002568 90 nop 10002569 90 nop 1000256A 90 nop 1000256B 90 nop 1000256C 90 nop 1000256D 90 nop 1000256E 90 nop 1000256F 90 nop 10002570 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10002574 \|. 6A 00 push 0 10002576 \|. 6A 01 push 1 10002578 \|. 50 push eax 10002579 \|. E8 12000000 call 10002590 1000257E \|. 83C4 0C add esp, 0C 10002581 \. C3 retn 10002582 90 nop 10002583 90 nop 10002584 90 nop 10002585 90 nop 10002586 90 nop 10002587 90 nop 10002588 90 nop 10002589 90 nop 1000258A 90 nop 1000258B 90 nop 1000258C 90 nop 1000258D 90 nop 1000258E 90 nop 1000258F 90 nop 10002590 /$ A1 54870010 mov eax, dword ptr [10008754] 10002595 \|. 53 push ebx 10002596 \|. 55 push ebp 10002597 \|. 8B6C24 0C mov ebp, dword ptr [esp+C] 1000259B \|. 83F8 01 cmp eax, 1 1000259E \|. 56 push esi 1000259F \|. 75 0E jnz short 100025AF 100025A1 \|. 55 push ebp ; /ExitCode 100025A2 \|. FF15 40500010 call dword ptr [<&KERNEL32.GetCurrent>; \|[GetCurrentProcess 100025A8 \|. 50 push eax ; \|hProcess 100025A9 \|. FF15 3C500010 call dword ptr [<&KERNEL32.TerminateP>; \TerminateProcess 100025AF \|> 8B4424 14 mov eax, dword ptr [esp+14] 100025B3 \|. 8B5C24 18 mov ebx, dword ptr [esp+18] 100025B7 \|. 85C0 test eax, eax 100025B9 \|. C705 50870010>mov dword ptr [10008750], 1 100025C3 \|. 881D 4C870010 mov byte ptr [1000874C], bl 100025C9 \|. 75 3E jnz short 10002609 100025CB \|. 8B0D A8890010 mov ecx, dword ptr [100089A8] 100025D1 \|. 85C9 test ecx, ecx 100025D3 \|. 74 22 je short 100025F7 100025D5 \|. 8B35 A4890010 mov esi, dword ptr [100089A4] 100025DB \|. 83EE 04 sub esi, 4 100025DE \|. 3BF1 cmp esi, ecx 100025E0 \|. 72 15 jb short 100025F7 100025E2 \|> 8B06 /mov eax, dword ptr [esi] 100025E4 \|. 85C0 \|test eax, eax 100025E6 \|. 74 08 \|je short 100025F0 100025E8 \|. FFD0 \|call eax 100025EA \|. 8B0D A8890010 \|mov ecx, dword ptr [100089A8] 100025F0 \|> 83EE 04 \|sub esi, 4 100025F3 \|. 3BF1 \|cmp esi, ecx 100025F5 \|.^ 73 EB \jnb short 100025E2 100025F7 \|> 68 18600010 push 10006018 100025FC \|. 68 14600010 push 10006014 10002601 \|. E8 3A000000 call 10002640 10002606 \|. 83C4 08 add esp, 8 10002609 \|> 68 20600010 push 10006020 1000260E \|. 68 1C600010 push 1000601C 10002613 \|. E8 28000000 call 10002640 10002618 \|. 83C4 08 add esp, 8 1000261B \|. 85DB test ebx, ebx 1000261D \|. 75 11 jnz short 10002630 1000261F \|. 55 push ebp ; /ExitCode 10002620 \|. C705 54870010>mov dword ptr [10008754], 1 ; \| 1000262A \|. FF15 20500010 call dword ptr [<&KERNEL32.ExitProces>; \ExitProcess 10002630 \|> 5E pop esi 10002631 \|. 5D pop ebp 10002632 \|. 5B pop ebx 10002633 \. C3 retn 10002634 90 nop 10002635 90 nop 10002636 90 nop 10002637 90 nop 10002638 90 nop 10002639 90 nop 1000263A 90 nop 1000263B 90 nop 1000263C 90 nop 1000263D 90 nop 1000263E 90 nop 1000263F 90 nop 10002640 /$ 56 push esi 10002641 \|. 8B7424 08 mov esi, dword ptr [esp+8] 10002645 \|. 57 push edi 10002646 \|. 8B7C24 10 mov edi, dword ptr [esp+10] 1000264A \|. 3BF7 cmp esi, edi 1000264C \|. 73 0F jnb short 1000265D 1000264E \|> 8B06 /mov eax, dword ptr [esi] 10002650 \|. 85C0 \|test eax, eax 10002652 \|. 74 02 \|je short 10002656 10002654 \|. FFD0 \|call eax 10002656 \|> 83C6 04 \|add esi, 4 10002659 \|. 3BF7 \|cmp esi, edi 1000265B \|.^ 72 F1 \jb short 1000264E 1000265D \|> 5F pop edi 1000265E \|. 5E pop esi 1000265F \. C3 retn 10002660 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10002664 \|. 53 push ebx 10002665 \|. 55 push ebp 10002666 \|. 56 push esi 10002667 \|. 50 push eax 10002668 \|. E8 33010000 call 100027A0 1000266D \|. 83C4 04 add esp, 4 10002670 \|. 85C0 test eax, eax 10002672 \|. 0F84 17010000 je 1000278F 10002678 \|. 8B58 08 mov ebx, dword ptr [eax+8] 1000267B \|. 85DB test ebx, ebx ; Switch (cases 0..5) 1000267D \|. 0F84 0C010000 je 1000278F 10002683 \|. 83FB 05 cmp ebx, 5 10002686 \|. 75 10 jnz short 10002698 10002688 \|. C740 08 00000>mov dword ptr [eax+8], 0 ; Case 5 of switch 1000267B 1000268F \|. B8 01000000 mov eax, 1 10002694 \|. 5E pop esi 10002695 \|. 5D pop ebp 10002696 \|. 5B pop ebx 10002697 \|. C3 retn 10002698 \|> 83FB 01 cmp ebx, 1 1000269B \|. 75 07 jnz short 100026A4 1000269D \|. 83C8 FF or eax, FFFFFFFF ; Case 1 of switch 1000267B 100026A0 \|. 5E pop esi 100026A1 \|. 5D pop ebp 100026A2 \|. 5B pop ebx 100026A3 \|. C3 retn 100026A4 \|> 8B4C24 14 mov ecx, dword ptr [esp+14] ; Default case of switch 1000267B 100026A8 \|. 8B2D 58870010 mov ebp, dword ptr [10008758] 100026AE \|. 890D 58870010 mov dword ptr [10008758], ecx 100026B4 \|. 8B48 04 mov ecx, dword ptr [eax+4] 100026B7 \|. 83F9 08 cmp ecx, 8 100026BA \|. 0F85 B5000000 jnz 10002775 100026C0 \|. 8B35 C0630010 mov esi, dword ptr [100063C0] 100026C6 \|. 8B15 C4630010 mov edx, dword ptr [100063C4] 100026CC \|. 03D6 add edx, esi 100026CE \|. 3BF2 cmp esi, edx 100026D0 \|. 7D 18 jge short 100026EA 100026D2 \|. 8D0C76 lea ecx, dword ptr [esi+esi2] 100026D5 \|. 2BD6 sub edx, esi 100026D7 \|. 8D0C8D 506300>lea ecx, dword ptr [ecx4+10006350] 100026DE \|> C701 00000000 /mov dword ptr [ecx], 0 100026E4 \|. 83C1 0C \|add ecx, 0C 100026E7 \|. 4A \|dec edx 100026E8 \|.^ 75 F4 \jnz short 100026DE 100026EA \|> 8B00 mov eax, dword ptr [eax] 100026EC \|. 8B0D CC630010 mov ecx, dword ptr [100063CC] 100026F2 \|. 3D 8E0000C0 cmp eax, C000008E ; Switch (cases C000008D..C0000093) 100026F7 \|. 8BF1 mov esi, ecx 100026F9 \|. 75 07 jnz short 10002702 100026FB \|. B9 83000000 mov ecx, 83 ; Case C000008E (FLOAT DIVIDE BY ZERO) of switch 100026F2 10002700 \|. EB 52 jmp short 10002754 10002702 \|> 3D 900000C0 cmp eax, C0000090 10002707 \|. 75 07 jnz short 10002710 10002709 \|. B9 81000000 mov ecx, 81 ; Case C0000090 (FLOAT INVALID OPERATION) of switch 100026F2 1000270E \|. EB 44 jmp short 10002754 10002710 \|> 3D 910000C0 cmp eax, C0000091 10002715 \|. 75 07 jnz short 1000271E 10002717 \|. B9 84000000 mov ecx, 84 ; Case C0000091 (FLOAT OVERFLOW) of switch 100026F2 1000271C \|. EB 36 jmp short 10002754 1000271E \|> 3D 930000C0 cmp eax, C0000093 10002723 \|. 75 07 jnz short 1000272C 10002725 \|. B9 85000000 mov ecx, 85 ; Case C0000093 (FLOAT UNDERFLOW) of switch 100026F2 1000272A \|. EB 28 jmp short 10002754 1000272C \|> 3D 8D0000C0 cmp eax, C000008D 10002731 \|. 75 07 jnz short 1000273A 10002733 \|. B9 82000000 mov ecx, 82 ; Case C000008D (FLOAT DENORMAL OPERAND) of switch 100026F2 10002738 \|. EB 1A jmp short 10002754 1000273A \|> 3D 8F0000C0 cmp eax, C000008F 1000273F \|. 75 07 jnz short 10002748 10002741 \|. B9 86000000 mov ecx, 86 ; Case C000008F (FLOAT INEXACT RESULT) of switch 100026F2 10002746 \|. EB 0C jmp short 10002754 10002748 \|> 3D 920000C0 cmp eax, C0000092 1000274D \|. 75 0B jnz short 1000275A 1000274F \|. B9 8A000000 mov ecx, 8A ; Case C0000092 (FLOAT STACK CHECK) of switch 100026F2 10002754 \|> 890D CC630010 mov dword ptr [100063CC], ecx 1000275A \|> 51 push ecx ; Default case of switch 100026F2 1000275B \|. 6A 08 push 8 1000275D \|. FFD3 call ebx 1000275F \|. 83C4 08 add esp, 8 10002762 \|. 8935 CC630010 mov dword ptr [100063CC], esi 10002768 \|. 892D 58870010 mov dword ptr [10008758], ebp 1000276E \|. 83C8 FF or eax, FFFFFFFF 10002771 \|. 5E pop esi 10002772 \|. 5D pop ebp 10002773 \|. 5B pop ebx 10002774 \|. C3 retn 10002775 \|> 51 push ecx 10002776 \|. C740 08 00000>mov dword ptr [eax+8], 0 1000277D \|. FFD3 call ebx 1000277F \|. 83C4 04 add esp, 4 10002782 \|. 892D 58870010 mov dword ptr [10008758], ebp 10002788 \|. 83C8 FF or eax, FFFFFFFF 1000278B \|. 5E pop esi 1000278C \|. 5D pop ebp 1000278D \|. 5B pop ebx 1000278E \|. C3 retn 1000278F \|> 8B5424 14 mov edx, dword ptr [esp+14] ; Case 0 of switch 1000267B 10002793 \|. 52 push edx ; /pExceptionInfo 10002794 \|. FF15 44500010 call dword ptr [<&KERNEL32.UnhandledE>; \UnhandledExceptionFilter 1000279A \|. 5E pop esi 1000279B \|. 5D pop ebp 1000279C \|. 5B pop ebx 1000279D \. C3 retn 1000279E 90 nop 1000279F 90 nop 100027A0 /$ 8B5424 04 mov edx, dword ptr [esp+4] 100027A4 \|. 8B0D 48630010 mov ecx, dword ptr [10006348] 100027AA \|. 56 push esi 100027AB \|. 8B35 C8630010 mov esi, dword ptr [100063C8] 100027B1 \|. 3BCA cmp ecx, edx 100027B3 \|. B8 48630010 mov eax, 10006348 100027B8 \|. 74 15 je short 100027CF 100027BA \|. 8D0C76 lea ecx, dword ptr [esi+esi2] 100027BD \|. 8D0C8D 486300>lea ecx, dword ptr [ecx4+10006348] 100027C4 \|> 83C0 0C /add eax, 0C 100027C7 \|. 3BC1 \|cmp eax, ecx 100027C9 \|. 73 04 \|jnb short 100027CF 100027CB \|. 3910 \|cmp dword ptr [eax], edx 100027CD \|.^ 75 F5 \jnz short 100027C4 100027CF \|> 8D0C76 lea ecx, dword ptr [esi+esi2] 100027D2 \|. 8D0C8D 486300>lea ecx, dword ptr [ecx4+10006348] 100027D9 \|. 3BC1 cmp eax, ecx 100027DB \|. 73 04 jnb short 100027E1 100027DD \|. 3910 cmp dword ptr [eax], edx 100027DF \|. 74 02 je short 100027E3 100027E1 \|> 33C0 xor eax, eax 100027E3 \|> 5E pop esi 100027E4 \. C3 retn 100027E5 90 nop 100027E6 90 nop 100027E7 90 nop 100027E8 90 nop 100027E9 90 nop 100027EA 90 nop 100027EB 90 nop 100027EC 90 nop 100027ED 90 nop 100027EE 90 nop 100027EF 90 nop 100027F0 /$ 51 push ecx 100027F1 \|. 8B15 BC840010 mov edx, dword ptr [100084BC] 100027F7 \|. 53 push ebx 100027F8 \|. 55 push ebp 100027F9 \|. 56 push esi 100027FA \|. 8A02 mov al, byte ptr [edx] 100027FC \|. 33F6 xor esi, esi 100027FE \|. 84C0 test al, al 10002800 \|. 57 push edi 10002801 \|. 74 1D je short 10002820 10002803 \|> 3C 3D /cmp al, 3D 10002805 \|. 74 01 \|je short 10002808 10002807 \|. 46 \|inc esi 10002808 \|> 8BFA \|mov edi, edx 1000280A \|. 83C9 FF \|or ecx, FFFFFFFF 1000280D \|. 33C0 \|xor eax, eax 1000280F \|. F2:AE \|repne scas byte ptr es:[edi] 10002811 \|. F7D1 \|not ecx 10002813 \|. 49 \|dec ecx 10002814 \|. 8A440A 01 \|mov al, byte ptr [edx+ecx+1] 10002818 \|. 8D540A 01 \|lea edx, dword ptr [edx+ecx+1] 1000281C \|. 84C0 \|test al, al 1000281E \|.^ 75 E3 \jnz short 10002803 10002820 \|> 8D04B5 040000>lea eax, dword ptr [esi4+4] 10002827 \|. 50 push eax 10002828 \|. E8 830D0000 call 100035B0 1000282D \|. 8BF0 mov esi, eax 1000282F \|. 83C4 04 add esp, 4 10002832 \|. 85F6 test esi, esi 10002834 \|. 897424 10 mov dword ptr [esp+10], esi 10002838 \|. 8935 34870010 mov dword ptr [10008734], esi 1000283E \|. 75 0A jnz short 1000284A 10002840 \|. 6A 09 push 9 10002842 \|. E8 89F4FFFF call 10001CD0 10002847 \|. 83C4 04 add esp, 4 1000284A \|> 8B2D BC840010 mov ebp, dword ptr [100084BC] 10002850 \|. 8A55 00 mov dl, byte ptr [ebp] 10002853 \|. 84D2 test dl, dl 10002855 \|. 74 63 je short 100028BA 10002857 \|> 8BFD /mov edi, ebp 10002859 \|. 83C9 FF \|or ecx, FFFFFFFF 1000285C \|. 33C0 \|xor eax, eax 1000285E \|. F2:AE \|repne scas byte ptr es:[edi] 10002860 \|. F7D1 \|not ecx 10002862 \|. 49 \|dec ecx 10002863 \|. 8BD9 \|mov ebx, ecx 10002865 \|. 43 \|inc ebx 10002866 \|. 80FA 3D \|cmp dl, 3D 10002869 \|. 74 45 \|je short 100028B0 1000286B \|. 53 \|push ebx 1000286C \|. E8 3F0D0000 \|call 100035B0 10002871 \|. 83C4 04 \|add esp, 4 10002874 \|. 8906 \|mov dword ptr [esi], eax 10002876 \|. 85C0 \|test eax, eax 10002878 \|. 75 0A \|jnz short 10002884 1000287A \|. 6A 09 \|push 9 1000287C \|. E8 4FF4FFFF \|call 10001CD0 10002881 \|. 83C4 04 \|add esp, 4 10002884 \|> 8BFD \|mov edi, ebp 10002886 \|. 83C9 FF \|or ecx, FFFFFFFF 10002889 \|. 33C0 \|xor eax, eax 1000288B \|. F2:AE \|repne scas byte ptr es:[edi] 1000288D \|. 8B4424 10 \|mov eax, dword ptr [esp+10] 10002891 \|. F7D1 \|not ecx 10002893 \|. 2BF9 \|sub edi, ecx 10002895 \|. 8BD1 \|mov edx, ecx 10002897 \|. 8BF7 \|mov esi, edi 10002899 \|. 8B38 \|mov edi, dword ptr [eax] 1000289B \|. C1E9 02 \|shr ecx, 2 1000289E \|. F3:A5 \|rep movs dword ptr es:[edi], dword > 100028A0 \|. 8BCA \|mov ecx, edx 100028A2 \|. 83E1 03 \|and ecx, 3 100028A5 \|. 83C0 04 \|add eax, 4 100028A8 \|. F3:A4 \|rep movs byte ptr es:[edi], byte pt> 100028AA \|. 894424 10 \|mov dword ptr [esp+10], eax 100028AE \|. 8BF0 \|mov esi, eax 100028B0 \|> 8A541D 00 \|mov dl, byte ptr [ebp+ebx] 100028B4 \|. 03EB \|add ebp, ebx 100028B6 \|. 84D2 \|test dl, dl 100028B8 \|.^ 75 9D \jnz short 10002857 100028BA \|> A1 BC840010 mov eax, dword ptr [100084BC] 100028BF \|. 50 push eax 100028C0 \|. E8 9B0B0000 call 10003460 100028C5 \|. 83C4 04 add esp, 4 100028C8 \|. C705 BC840010>mov dword ptr [100084BC], 0 100028D2 \|. C706 00000000 mov dword ptr [esi], 0 100028D8 \|. 5F pop edi 100028D9 \|. 5E pop esi 100028DA \|. 5D pop ebp 100028DB \|. 5B pop ebx 100028DC \|. 59 pop ecx 100028DD \. C3 retn 100028DE 90 nop 100028DF 90 nop 100028E0 /$ 83EC 08 sub esp, 8 100028E3 \|. 56 push esi 100028E4 \|. 57 push edi 100028E5 \|. 68 04010000 push 104 ; /BufSize = 104 (260.) 100028EA \|. 68 60870010 push 10008760 ; \|PathBuffer = pjgl.10008760 100028EF \|. 6A 00 push 0 ; \|hModule = NULL 100028F1 \|. FF15 48500010 call dword ptr [<&KERNEL32.GetModuleF>; \GetModuleFileNameA 100028F7 \|. 8B3D B4890010 mov edi, dword ptr [100089B4] 100028FD \|. C705 44870010>mov dword ptr [10008744], 10008760 10002907 \|. 803F 00 cmp byte ptr [edi], 0 1000290A \|. 75 05 jnz short 10002911 1000290C \|. BF 60870010 mov edi, 10008760 10002911 \|> 8D4424 0C lea eax, dword ptr [esp+C] 10002915 \|. 8D4C24 08 lea ecx, dword ptr [esp+8] 10002919 \|. 50 push eax 1000291A \|. 51 push ecx 1000291B \|. 6A 00 push 0 1000291D \|. 6A 00 push 0 1000291F \|. 57 push edi 10002920 \|. E8 5B000000 call 10002980 10002925 \|. 8B5424 20 mov edx, dword ptr [esp+20] 10002929 \|. 8B4424 1C mov eax, dword ptr [esp+1C] 1000292D \|. 83C4 14 add esp, 14 10002930 \|. 8D0C82 lea ecx, dword ptr [edx+eax4] 10002933 \|. 51 push ecx 10002934 \|. E8 770C0000 call 100035B0 10002939 \|. 8BF0 mov esi, eax 1000293B \|. 83C4 04 add esp, 4 1000293E \|. 85F6 test esi, esi 10002940 \|. 75 0A jnz short 1000294C 10002942 \|. 6A 08 push 8 10002944 \|. E8 87F3FFFF call 10001CD0 10002949 \|. 83C4 04 add esp, 4 1000294C \|> 8B4C24 08 mov ecx, dword ptr [esp+8] 10002950 \|. 8D5424 0C lea edx, dword ptr [esp+C] 10002954 \|. 52 push edx 10002955 \|. 8D4424 0C lea eax, dword ptr [esp+C] 10002959 \|. 8D148E lea edx, dword ptr [esi+ecx4] 1000295C \|. 50 push eax 1000295D \|. 52 push edx 1000295E \|. 56 push esi 1000295F \|. 57 push edi 10002960 \|. E8 1B000000 call 10002980 10002965 \|. 8B4424 1C mov eax, dword ptr [esp+1C] 10002969 \|. 83C4 14 add esp, 14 1000296C \|. 48 dec eax 1000296D \|. 8935 2C870010 mov dword ptr [1000872C], esi 10002973 \|. 5F pop edi 10002974 \|. A3 28870010 mov dword ptr [10008728], eax 10002979 \|. 5E pop esi 1000297A \|. 83C4 08 add esp, 8 1000297D \. C3 retn 1000297E 90 nop 1000297F 90 nop 10002980 /$ 8B4424 10 mov eax, dword ptr [esp+10] 10002984 \|. 53 push ebx 10002985 \|. 55 push ebp 10002986 \|. 8B6C24 10 mov ebp, dword ptr [esp+10] 1000298A \|. 56 push esi 1000298B \|. 8B7424 18 mov esi, dword ptr [esp+18] 1000298F \|. 57 push edi 10002990 \|. 8B7C24 24 mov edi, dword ptr [esp+24] 10002994 \|. 85ED test ebp, ebp 10002996 \|. C707 00000000 mov dword ptr [edi], 0 1000299C \|. C700 01000000 mov dword ptr [eax], 1 100029A2 \|. 8B4424 14 mov eax, dword ptr [esp+14] 100029A6 \|. BB 04000000 mov ebx, 4 100029AB \|. 74 09 je short 100029B6 100029AD \|. 8975 00 mov dword ptr [ebp], esi 100029B0 \|. 03EB add ebp, ebx 100029B2 \|. 896C24 18 mov dword ptr [esp+18], ebp 100029B6 \|> 8038 22 cmp byte ptr [eax], 22 100029B9 \|. 75 56 jnz short 10002A11 100029BB \|. 8A48 01 mov cl, byte ptr [eax+1] 100029BE \|. 40 inc eax 100029BF \|. 80F9 22 cmp cl, 22 100029C2 \|. 74 38 je short 100029FC 100029C4 \|> 84C9 /test cl, cl 100029C6 \|. 74 34 \|je short 100029FC 100029C8 \|. 81E1 FF000000 \|and ecx, 0FF 100029CE \|. 8499 C9840010 \|test byte ptr [ecx+100084C9], bl 100029D4 \|. 74 0F \|je short 100029E5 100029D6 \|. 8B17 \|mov edx, dword ptr [edi] 100029D8 \|. 42 \|inc edx 100029D9 \|. 85F6 \|test esi, esi 100029DB \|. 8917 \|mov dword ptr [edi], edx 100029DD \|. 74 06 \|je short 100029E5 100029DF \|. 8A08 \|mov cl, byte ptr [eax] 100029E1 \|. 880E \|mov byte ptr [esi], cl 100029E3 \|. 46 \|inc esi 100029E4 \|. 40 \|inc eax 100029E5 \|> 8B17 \|mov edx, dword ptr [edi] 100029E7 \|. 42 \|inc edx 100029E8 \|. 85F6 \|test esi, esi 100029EA \|. 8917 \|mov dword ptr [edi], edx 100029EC \|. 74 05 \|je short 100029F3 100029EE \|. 8A10 \|mov dl, byte ptr [eax] 100029F0 \|. 8816 \|mov byte ptr [esi], dl 100029F2 \|. 46 \|inc esi 100029F3 \|> 8A48 01 \|mov cl, byte ptr [eax+1] 100029F6 \|. 40 \|inc eax 100029F7 \|. 80F9 22 \|cmp cl, 22 100029FA \|.^ 75 C8 \jnz short 100029C4 100029FC \|> 8B17 mov edx, dword ptr [edi] 100029FE \|. 42 inc edx 100029FF \|. 85F6 test esi, esi 10002A01 \|. 8917 mov dword ptr [edi], edx 10002A03 \|. 74 04 je short 10002A09 10002A05 \|. C606 00 mov byte ptr [esi], 0 10002A08 \|. 46 inc esi 10002A09 \|> 8038 22 cmp byte ptr [eax], 22 10002A0C \|. 75 56 jnz short 10002A64 10002A0E \|. 40 inc eax 10002A0F \|. EB 53 jmp short 10002A64 10002A11 \|> 8B17 /mov edx, dword ptr [edi] ; Default case of switch 10002A47 10002A13 \|. 42 \|inc edx 10002A14 \|. 85F6 \|test esi, esi 10002A16 \|. 8917 \|mov dword ptr [edi], edx 10002A18 \|. 74 05 \|je short 10002A1F 10002A1A \|. 8A08 \|mov cl, byte ptr [eax] 10002A1C \|. 880E \|mov byte ptr [esi], cl 10002A1E \|. 46 \|inc esi 10002A1F \|> 8A08 \|mov cl, byte ptr [eax] 10002A21 \|. 40 \|inc eax 10002A22 \|. 884C24 24 \|mov byte ptr [esp+24], cl 10002A26 \|. 8B5424 24 \|mov edx, dword ptr [esp+24] 10002A2A \|. 81E2 FF000000 \|and edx, 0FF 10002A30 \|. 849A C9840010 \|test byte ptr [edx+100084C9], bl 10002A36 \|. 74 0F \|je short 10002A47 10002A38 \|. 8B17 \|mov edx, dword ptr [edi] 10002A3A \|. 42 \|inc edx 10002A3B \|. 85F6 \|test esi, esi 10002A3D \|. 8917 \|mov dword ptr [edi], edx 10002A3F \|. 74 05 \|je short 10002A46 10002A41 \|. 8A10 \|mov dl, byte ptr [eax] 10002A43 \|. 8816 \|mov byte ptr [esi], dl 10002A45 \|. 46 \|inc esi 10002A46 \|> 40 \|inc eax 10002A47 \|> 80F9 20 \|cmp cl, 20 ; Switch (cases 0..20) 10002A4A \|. 74 09 \|je short 10002A55 10002A4C \|. 84C9 \|test cl, cl 10002A4E \|. 74 09 \|je short 10002A59 10002A50 \|. 80F9 09 \|cmp cl, 9 10002A53 \|.^ 75 BC \jnz short 10002A11 10002A55 \|> 84C9 test cl, cl ; Cases 9 (TAB),20 (' ') of switch 10002A47 10002A57 \|. 75 03 jnz short 10002A5C 10002A59 \|> 48 dec eax ; Case 0 of switch 10002A47 10002A5A \|. EB 08 jmp short 10002A64 10002A5C \|> 85F6 test esi, esi 10002A5E \|. 74 04 je short 10002A64 10002A60 \|. C646 FF 00 mov byte ptr [esi-1], 0 10002A64 \|> 33D2 xor edx, edx 10002A66 \|. 895424 24 mov dword ptr [esp+24], edx 10002A6A \|> 8038 00 /cmp byte ptr [eax], 0 10002A6D \|. 0F84 03010000 \|je 10002B76 10002A73 \|> 8A08 \|/mov cl, byte ptr [eax] 10002A75 \|. 80F9 20 \|\|cmp cl, 20 10002A78 \|. 74 05 \|\|je short 10002A7F 10002A7A \|. 80F9 09 \|\|cmp cl, 9 10002A7D \|. 75 03 \|\|jnz short 10002A82 10002A7F \|> 40 \|\|inc eax 10002A80 \|.^ EB F1 \|\jmp short 10002A73 10002A82 \|> 8038 00 \|cmp byte ptr [eax], 0 10002A85 \|. 0F84 EB000000 \|je 10002B76 10002A8B \|. 85ED \|test ebp, ebp 10002A8D \|. 74 09 \|je short 10002A98 10002A8F \|. 8975 00 \|mov dword ptr [ebp], esi 10002A92 \|. 03EB \|add ebp, ebx 10002A94 \|. 896C24 18 \|mov dword ptr [esp+18], ebp 10002A98 \|> 8B4C24 20 \|mov ecx, dword ptr [esp+20] 10002A9C \|. FF01 \|inc dword ptr [ecx] 10002A9E \|> 8A18 \|/mov bl, byte ptr [eax] 10002AA0 \|. 33C9 \|\|xor ecx, ecx 10002AA2 \|. 80FB 5C \|\|cmp bl, 5C 10002AA5 \|. BD 01000000 \|\|mov ebp, 1 10002AAA \|. 75 0A \|\|jnz short 10002AB6 10002AAC \|> 8A58 01 \|\|/mov bl, byte ptr [eax+1] 10002AAF \|. 40 \|\|\|inc eax 10002AB0 \|. 41 \|\|\|inc ecx 10002AB1 \|. 80FB 5C \|\|\|cmp bl, 5C 10002AB4 \|.^ 74 F6 \|\|\je short 10002AAC 10002AB6 \|> 8038 22 \|\|cmp byte ptr [eax], 22 10002AB9 \|. 75 25 \|\|jnz short 10002AE0 10002ABB \|. F6C1 01 \|\|test cl, 1 10002ABE \|. 75 1E \|\|jnz short 10002ADE 10002AC0 \|. 85D2 \|\|test edx, edx 10002AC2 \|. 74 09 \|\|je short 10002ACD 10002AC4 \|. 8078 01 22 \|\|cmp byte ptr [eax+1], 22 10002AC8 \|. 75 03 \|\|jnz short 10002ACD 10002ACA \|. 40 \|\|inc eax 10002ACB \|. EB 02 \|\|jmp short 10002ACF 10002ACD \|> 33ED \|\|xor ebp, ebp 10002ACF \|> 8B5C24 24 \|\|mov ebx, dword ptr [esp+24] 10002AD3 \|. 33D2 \|\|xor edx, edx 10002AD5 \|. 85DB \|\|test ebx, ebx 10002AD7 \|. 0F94C2 \|\|sete dl 10002ADA \|. 895424 24 \|\|mov dword ptr [esp+24], edx 10002ADE \|> D1E9 \|\|shr ecx, 1 10002AE0 \|> 8BD9 \|\|mov ebx, ecx 10002AE2 \|. 49 \|\|dec ecx 10002AE3 \|. 85DB \|\|test ebx, ebx 10002AE5 \|. 74 11 \|\|je short 10002AF8 10002AE7 \|. 41 \|\|inc ecx 10002AE8 \|> 85F6 \|\|/test esi, esi 10002AEA \|. 74 04 \|\|\|je short 10002AF0 10002AEC \|. C606 5C \|\|\|mov byte ptr [esi], 5C 10002AEF \|. 46 \|\|\|inc esi 10002AF0 \|> 8B1F \|\|\|mov ebx, dword ptr [edi] 10002AF2 \|. 43 \|\|\|inc ebx 10002AF3 \|. 49 \|\|\|dec ecx 10002AF4 \|. 891F \|\|\|mov dword ptr [edi], ebx 10002AF6 \|.^ 75 F0 \|\|\jnz short 10002AE8 10002AF8 \|> 8A08 \|\|mov cl, byte ptr [eax] 10002AFA \|. 84C9 \|\|test cl, cl 10002AFC \|. 74 5D \|\|je short 10002B5B 10002AFE \|. 85D2 \|\|test edx, edx 10002B00 \|. 75 0A \|\|jnz short 10002B0C 10002B02 \|. 80F9 20 \|\|cmp cl, 20 10002B05 \|. 74 54 \|\|je short 10002B5B 10002B07 \|. 80F9 09 \|\|cmp cl, 9 10002B0A \|. 74 4F \|\|je short 10002B5B 10002B0C \|> 85ED \|\|test ebp, ebp 10002B0E \|. 74 45 \|\|je short 10002B55 10002B10 \|. 85F6 \|\|test esi, esi 10002B12 \|. 74 2A \|\|je short 10002B3E 10002B14 \|. 8BD9 \|\|mov ebx, ecx 10002B16 \|. 81E3 FF000000 \|\|and ebx, 0FF 10002B1C \|. F683 C9840010>\|\|test byte ptr [ebx+100084C9], 4 10002B23 \|. 74 09 \|\|je short 10002B2E 10002B25 \|. 880E \|\|mov byte ptr [esi], cl 10002B27 \|. 8B0F \|\|mov ecx, dword ptr [edi] 10002B29 \|. 46 \|\|inc esi 10002B2A \|. 40 \|\|inc eax 10002B2B \|. 41 \|\|inc ecx 10002B2C \|. 890F \|\|mov dword ptr [edi], ecx 10002B2E \|> 8A08 \|\|mov cl, byte ptr [eax] 10002B30 \|. 880E \|\|mov byte ptr [esi], cl 10002B32 \|. 8B0F \|\|mov ecx, dword ptr [edi] 10002B34 \|. 46 \|\|inc esi 10002B35 \|. 41 \|\|inc ecx 10002B36 \|. 890F \|\|mov dword ptr [edi], ecx 10002B38 \|. 40 \|\|inc eax 10002B39 \|.^ E9 60FFFFFF \|\|jmp 10002A9E 10002B3E \|> 81E1 FF000000 \|\|and ecx, 0FF 10002B44 \|. F681 C9840010>\|\|test byte ptr [ecx+100084C9], 4 10002B4B \|. 74 06 \|\|je short 10002B53 10002B4D \|. 8B0F \|\|mov ecx, dword ptr [edi] 10002B4F \|. 40 \|\|inc eax 10002B50 \|. 41 \|\|inc ecx 10002B51 \|. 890F \|\|mov dword ptr [edi], ecx 10002B53 \|> FF07 \|\|inc dword ptr [edi] 10002B55 \|> 40 \|\|inc eax 10002B56 \|.^ E9 43FFFFFF \|\jmp 10002A9E 10002B5B \|> 85F6 \|test esi, esi 10002B5D \|. 74 04 \|je short 10002B63 10002B5F \|. C606 00 \|mov byte ptr [esi], 0 10002B62 \|. 46 \|inc esi 10002B63 \|> 8B0F \|mov ecx, dword ptr [edi] 10002B65 \|. 8B6C24 18 \|mov ebp, dword ptr [esp+18] 10002B69 \|. 41 \|inc ecx 10002B6A \|. BB 04000000 \|mov ebx, 4 10002B6F \|. 890F \|mov dword ptr [edi], ecx 10002B71 \|.^ E9 F4FEFFFF \jmp 10002A6A 10002B76 \|> 85ED test ebp, ebp 10002B78 \|. 74 07 je short 10002B81 10002B7A \|. C745 00 00000>mov dword ptr [ebp], 0 10002B81 \|> 8B4424 20 mov eax, dword ptr [esp+20] 10002B85 \|. 5F pop edi 10002B86 \|. 5E pop esi 10002B87 \|. 5D pop ebp 10002B88 \|. 8B08 mov ecx, dword ptr [eax] 10002B8A \|. 5B pop ebx 10002B8B \|. 41 inc ecx 10002B8C \|. 8908 mov dword ptr [eax], ecx 10002B8E \. C3 retn 10002B8F 90 nop 10002B90 /$ A1 68880010 mov eax, dword ptr [10008868] 10002B95 \|. 53 push ebx 10002B96 \|. 55 push ebp 10002B97 \|. 8B2D 54500010 mov ebp, dword ptr [<&KERNEL32.GetEn>; kernel32.GetEnvironmentStringsA 10002B9D \|. 56 push esi 10002B9E \|. 33F6 xor esi, esi 10002BA0 \|. 33DB xor ebx, ebx 10002BA2 \|. 57 push edi 10002BA3 \|. 8B3D 58500010 mov edi, dword ptr [<&KERNEL32.GetEn>; kernel32.GetEnvironmentStringsW 10002BA9 \|. 85C0 test eax, eax 10002BAB \|. 75 25 jnz short 10002BD2 10002BAD \|. FFD7 call edi ; [GetEnvironmentStringsW 10002BAF \|. 8BF0 mov esi, eax 10002BB1 \|. 85F6 test esi, esi 10002BB3 \|. 74 07 je short 10002BBC 10002BB5 \|. B8 01000000 mov eax, 1 10002BBA \|. EB 11 jmp short 10002BCD 10002BBC \|> FFD5 call ebp 10002BBE \|. 8BD8 mov ebx, eax 10002BC0 \|. 85DB test ebx, ebx 10002BC2 \|. 0F84 17010000 je 10002CDF 10002BC8 \|. B8 02000000 mov eax, 2 10002BCD \|> A3 68880010 mov dword ptr [10008868], eax 10002BD2 \|> 83F8 01 cmp eax, 1 10002BD5 \|. 0F85 97000000 jnz 10002C72 10002BDB \|. 85F6 test esi, esi 10002BDD \|. 75 0C jnz short 10002BEB 10002BDF \|. FFD7 call edi 10002BE1 \|. 8BF0 mov esi, eax 10002BE3 \|. 85F6 test esi, esi 10002BE5 \|. 0F84 F4000000 je 10002CDF 10002BEB \|> 66:833E 00 cmp word ptr [esi], 0 10002BEF \|. 8BC6 mov eax, esi 10002BF1 \|. 74 12 je short 10002C05 10002BF3 \|> 83C0 02 /add eax, 2 10002BF6 \|. 66:8338 00 \|cmp word ptr [eax], 0 10002BFA \|.^ 75 F7 \|jnz short 10002BF3 10002BFC \|. 83C0 02 \|add eax, 2 10002BFF \|. 66:8338 00 \|cmp word ptr [eax], 0 10002C03 \|.^ 75 EE \jnz short 10002BF3 10002C05 \|> 2BC6 sub eax, esi 10002C07 \|. 6A 00 push 0 ; /pDefaultCharUsed = NULL 10002C09 \|. D1F8 sar eax, 1 ; \| 10002C0B \|. 40 inc eax ; \| 10002C0C \|. 6A 00 push 0 ; \|pDefaultChar = NULL 10002C0E \|. 8BE8 mov ebp, eax ; \| 10002C10 \|. 6A 00 push 0 ; \|MultiByteCount = 0 10002C12 \|. 6A 00 push 0 ; \|MultiByteStr = NULL 10002C14 \|. 55 push ebp ; \|WideCharCount 10002C15 \|. 56 push esi ; \|WideCharStr 10002C16 \|. 6A 00 push 0 ; \|Options = 0 10002C18 \|. 6A 00 push 0 ; \|CodePage = CP_ACP 10002C1A \|. FF15 30500010 call dword ptr [<&KERNEL32.WideCharTo>; \WideCharToMultiByte 10002C20 \|. 8BF8 mov edi, eax 10002C22 \|. 85FF test edi, edi 10002C24 \|. 74 3E je short 10002C64 10002C26 \|. 57 push edi 10002C27 \|. E8 84090000 call 100035B0 10002C2C \|. 8BD8 mov ebx, eax 10002C2E \|. 83C4 04 add esp, 4 10002C31 \|. 85DB test ebx, ebx 10002C33 \|. 74 2F je short 10002C64 10002C35 \|. 6A 00 push 0 ; /pDefaultCharUsed = NULL 10002C37 \|. 6A 00 push 0 ; \|pDefaultChar = NULL 10002C39 \|. 57 push edi ; \|MultiByteCount 10002C3A \|. 53 push ebx ; \|MultiByteStr 10002C3B \|. 55 push ebp ; \|WideCharCount 10002C3C \|. 56 push esi ; \|WideCharStr 10002C3D \|. 6A 00 push 0 ; \|Options = 0 10002C3F \|. 6A 00 push 0 ; \|CodePage = CP_ACP 10002C41 \|. FF15 30500010 call dword ptr [<&KERNEL32.WideCharTo>; \WideCharToMultiByte 10002C47 \|. 85C0 test eax, eax 10002C49 \|. 75 0B jnz short 10002C56 10002C4B \|. 53 push ebx 10002C4C \|. E8 0F080000 call 10003460 10002C51 \|. 83C4 04 add esp, 4 10002C54 \|. 33DB xor ebx, ebx 10002C56 \|> 56 push esi ; /EnvironmentBlock 10002C57 \|. FF15 04500010 call dword ptr [<&KERNEL32.FreeEnviro>; \FreeEnvironmentStringsW 10002C5D \|. 8BC3 mov eax, ebx 10002C5F \|. 5F pop edi 10002C60 \|. 5E pop esi 10002C61 \|. 5D pop ebp 10002C62 \|. 5B pop ebx 10002C63 \|. C3 retn 10002C64 \|> 56 push esi ; /EnvironmentBlock 10002C65 \|. FF15 04500010 call dword ptr [<&KERNEL32.FreeEnviro>; \FreeEnvironmentStringsW 10002C6B \|. 33C0 xor eax, eax 10002C6D \|. 5F pop edi 10002C6E \|. 5E pop esi 10002C6F \|. 5D pop ebp 10002C70 \|. 5B pop ebx 10002C71 \|. C3 retn 10002C72 \|> 83F8 02 cmp eax, 2 10002C75 \|. 75 68 jnz short 10002CDF 10002C77 \|. 85DB test ebx, ebx 10002C79 \|. 75 08 jnz short 10002C83 10002C7B \|. FFD5 call ebp 10002C7D \|. 8BD8 mov ebx, eax 10002C7F \|. 85DB test ebx, ebx 10002C81 \|. 74 5C je short 10002CDF 10002C83 \|> 8A0B mov cl, byte ptr [ebx] 10002C85 \|. 8BC3 mov eax, ebx 10002C87 \|. 84C9 test cl, cl 10002C89 \|. 74 10 je short 10002C9B 10002C8B \|> 8A48 01 /mov cl, byte ptr [eax+1] 10002C8E \|. 40 \|inc eax 10002C8F \|. 84C9 \|test cl, cl 10002C91 \|.^ 75 F8 \|jnz short 10002C8B 10002C93 \|. 8A48 01 \|mov cl, byte ptr [eax+1] 10002C96 \|. 40 \|inc eax 10002C97 \|. 84C9 \|test cl, cl 10002C99 \|.^ 75 F0 \jnz short 10002C8B 10002C9B \|> 2BC3 sub eax, ebx 10002C9D \|. 40 inc eax 10002C9E \|. 8BF0 mov esi, eax 10002CA0 \|. 56 push esi 10002CA1 \|. E8 0A090000 call 100035B0 10002CA6 \|. 8BE8 mov ebp, eax 10002CA8 \|. 83C4 04 add esp, 4 10002CAB \|. 85ED test ebp, ebp 10002CAD \|. 75 0E jnz short 10002CBD 10002CAF \|. 53 push ebx ; /EnvironmentBlock 10002CB0 \|. FF15 00500010 call dword ptr [<&KERNEL32.FreeEnviro>; \FreeEnvironmentStringsA 10002CB6 \|. 33C0 xor eax, eax 10002CB8 \|. 5F pop edi 10002CB9 \|. 5E pop esi 10002CBA \|. 5D pop ebp 10002CBB \|. 5B pop ebx 10002CBC \|. C3 retn 10002CBD \|> 8BCE mov ecx, esi 10002CBF \|. 8BF3 mov esi, ebx 10002CC1 \|. 8BC1 mov eax, ecx 10002CC3 \|. 8BFD mov edi, ebp 10002CC5 \|. C1E9 02 shr ecx, 2 10002CC8 \|. F3:A5 rep movs dword ptr es:[edi], dword p> 10002CCA \|. 8BC8 mov ecx, eax 10002CCC \|. 53 push ebx ; /EnvironmentBlock 10002CCD \|. 83E1 03 and ecx, 3 ; \| 10002CD0 \|. F3:A4 rep movs byte ptr es:[edi], byte ptr>; \| 10002CD2 \|. FF15 00500010 call dword ptr [<&KERNEL32.FreeEnviro>; \FreeEnvironmentStringsA 10002CD8 \|. 8BC5 mov eax, ebp 10002CDA \|. 5F pop edi 10002CDB \|. 5E pop esi 10002CDC \|. 5D pop ebp 10002CDD \|. 5B pop ebx 10002CDE \|. C3 retn 10002CDF \|> 5F pop edi 10002CE0 \|. 5E pop esi 10002CE1 \|. 5D pop ebp 10002CE2 \|. 33C0 xor eax, eax 10002CE4 \|. 5B pop ebx 10002CE5 \. C3 retn 10002CE6 90 nop 10002CE7 90 nop 10002CE8 90 nop 10002CE9 90 nop 10002CEA 90 nop 10002CEB 90 nop 10002CEC 90 nop 10002CED 90 nop 10002CEE 90 nop 10002CEF 90 nop 10002CF0 /$ 83EC 48 sub esp, 48 10002CF3 \|. 53 push ebx 10002CF4 \|. 55 push ebp 10002CF5 \|. 56 push esi 10002CF6 \|. 57 push edi 10002CF7 \|. 68 00010000 push 100 10002CFC \|. E8 AF080000 call 100035B0 10002D01 \|. 8BF0 mov esi, eax 10002D03 \|. 83C4 04 add esp, 4 10002D06 \|. 85F6 test esi, esi 10002D08 \|. 75 0A jnz short 10002D14 10002D0A \|. 6A 1B push 1B 10002D0C \|. E8 BFEFFFFF call 10001CD0 10002D11 \|. 83C4 04 add esp, 4 10002D14 \|> 8D86 00010000 lea eax, dword ptr [esi+100] 10002D1A \|. 8935 A0880010 mov dword ptr [100088A0], esi 10002D20 \|. 3BF0 cmp esi, eax 10002D22 \|. C705 A0890010>mov dword ptr [100089A0], 20 10002D2C \|. B3 0A mov bl, 0A 10002D2E \|. 73 20 jnb short 10002D50 10002D30 \|> C646 04 00 /mov byte ptr [esi+4], 0 10002D34 \|. C706 FFFFFFFF \|mov dword ptr [esi], -1 10002D3A \|. 885E 05 \|mov byte ptr [esi+5], bl 10002D3D \|. 8B0D A0880010 \|mov ecx, dword ptr [100088A0] 10002D43 \|. 83C6 08 \|add esi, 8 10002D46 \|. 81C1 00010000 \|add ecx, 100 10002D4C \|. 3BF1 \|cmp esi, ecx 10002D4E \|.^ 72 E0 \jb short 10002D30 10002D50 \|> 8D5424 14 lea edx, dword ptr [esp+14] 10002D54 \|. 52 push edx ; /pStartupinfo 10002D55 \|. FF15 18500010 call dword ptr [<&KERNEL32.GetStartup>; \GetStartupInfoA 10002D5B \|. 66:837C24 46 >cmp word ptr [esp+46], 0 10002D61 \|. 0F84 F2000000 je 10002E59 10002D67 \|. 8B4424 48 mov eax, dword ptr [esp+48] 10002D6B \|. 85C0 test eax, eax 10002D6D \|. 0F84 E6000000 je 10002E59 10002D73 \|. 8B08 mov ecx, dword ptr [eax] 10002D75 \|. 8D78 04 lea edi, dword ptr [eax+4] 10002D78 \|. 81F9 00080000 cmp ecx, 800 10002D7E \|. 894C24 10 mov dword ptr [esp+10], ecx 10002D82 \|. 8D2C0F lea ebp, dword ptr [edi+ecx] 10002D85 \|. 7C 08 jl short 10002D8F 10002D87 \|. C74424 10 000>mov dword ptr [esp+10], 800 10002D8F \|> 8B4424 10 mov eax, dword ptr [esp+10] 10002D93 \|. 8B0D A0890010 mov ecx, dword ptr [100089A0] 10002D99 \|. 3BC8 cmp ecx, eax 10002D9B \|. 7D 69 jge short 10002E06 10002D9D \|. BE A4880010 mov esi, 100088A4 10002DA2 \|> 68 00010000 /push 100 10002DA7 \|. E8 04080000 \|call 100035B0 10002DAC \|. 83C4 04 \|add esp, 4 10002DAF \|. 85C0 \|test eax, eax 10002DB1 \|. 74 49 \|je short 10002DFC 10002DB3 \|. 8B0D A0890010 \|mov ecx, dword ptr [100089A0] 10002DB9 \|. 8906 \|mov dword ptr [esi], eax 10002DBB \|. 83C1 20 \|add ecx, 20 10002DBE \|. 890D A0890010 \|mov dword ptr [100089A0], ecx 10002DC4 \|. 8D88 00010000 \|lea ecx, dword ptr [eax+100] 10002DCA \|. 3BC1 \|cmp eax, ecx 10002DCC \|. 73 1C \|jnb short 10002DEA 10002DCE \|> C640 04 00 \|/mov byte ptr [eax+4], 0 10002DD2 \|. C700 FFFFFFFF \|\|mov dword ptr [eax], -1 10002DD8 \|. 8858 05 \|\|mov byte ptr [eax+5], bl 10002DDB \|. 8B16 \|\|mov edx, dword ptr [esi] 10002DDD \|. 83C0 08 \|\|add eax, 8 10002DE0 \|. 81C2 00010000 \|\|add edx, 100 10002DE6 \|. 3BC2 \|\|cmp eax, edx 10002DE8 \|.^ 72 E4 \|\jb short 10002DCE 10002DEA \|> A1 A0890010 \|mov eax, dword ptr [100089A0] 10002DEF \|. 8B4C24 10 \|mov ecx, dword ptr [esp+10] 10002DF3 \|. 83C6 04 \|add esi, 4 10002DF6 \|. 3BC1 \|cmp eax, ecx 10002DF8 \|.^ 7C A8 \jl short 10002DA2 10002DFA \|. EB 0A jmp short 10002E06 10002DFC \|> 8B0D A0890010 mov ecx, dword ptr [100089A0] 10002E02 \|. 894C24 10 mov dword ptr [esp+10], ecx 10002E06 \|> 8B4424 10 mov eax, dword ptr [esp+10] 10002E0A \|. 33F6 xor esi, esi 10002E0C \|. 85C0 test eax, eax 10002E0E \|. 7E 49 jle short 10002E59 10002E10 \|> 8B4D 00 /mov ecx, dword ptr [ebp] 10002E13 \|. 83F9 FF \|cmp ecx, -1 10002E16 \|. 74 34 \|je short 10002E4C 10002E18 \|. 8A07 \|mov al, byte ptr [edi] 10002E1A \|. A8 01 \|test al, 1 10002E1C \|. 74 2E \|je short 10002E4C 10002E1E \|. A8 08 \|test al, 8 10002E20 \|. 75 0B \|jnz short 10002E2D 10002E22 \|. 51 \|push ecx ; /hFile 10002E23 \|. FF15 64500010 \|call dword ptr [<&KERNEL32.GetFileTy>; \GetFileType 10002E29 \|. 85C0 \|test eax, eax 10002E2B \|. 74 1F \|je short 10002E4C 10002E2D \|> 8BD6 \|mov edx, esi 10002E2F \|. 8BC6 \|mov eax, esi 10002E31 \|. C1FA 05 \|sar edx, 5 10002E34 \|. 83E0 1F \|and eax, 1F 10002E37 \|. 8B0C95 A08800>\|mov ecx, dword ptr [edx4+100088A0] 10002E3E \|. 8B55 00 \|mov edx, dword ptr [ebp] 10002E41 \|. 8914C1 \|mov dword ptr [ecx+eax8], edx 10002E44 \|. 8D04C1 \|lea eax, dword ptr [ecx+eax8] 10002E47 \|. 8A0F \|mov cl, byte ptr [edi] 10002E49 \|. 8848 04 \|mov byte ptr [eax+4], cl 10002E4C \|> 8B4424 10 \|mov eax, dword ptr [esp+10] 10002E50 \|. 46 \|inc esi 10002E51 \|. 47 \|inc edi 10002E52 \|. 83C5 04 \|add ebp, 4 10002E55 \|. 3BF0 \|cmp esi, eax 10002E57 \|.^ 7C B7 \jl short 10002E10 10002E59 \|> 8B2D 60500010 mov ebp, dword ptr [<&KERNEL32.GetSt>; kernel32.GetStdHandle 10002E5F \|. 33DB xor ebx, ebx 10002E61 \|> 8B15 A0880010 /mov edx, dword ptr [100088A0] 10002E67 \|. 8B04DA \|mov eax, dword ptr [edx+ebx8] 10002E6A \|. 8D34DA \|lea esi, dword ptr [edx+ebx8] 10002E6D \|. 83F8 FF \|cmp eax, -1 10002E70 \|. 75 54 \|jnz short 10002EC6 10002E72 \|. 85DB \|test ebx, ebx 10002E74 \|. C646 04 81 \|mov byte ptr [esi+4], 81 10002E78 \|. 75 07 \|jnz short 10002E81 10002E7A \|. B8 F6FFFFFF \|mov eax, -0A 10002E7F \|. EB 0A \|jmp short 10002E8B 10002E81 \|> 8BC3 \|mov eax, ebx 10002E83 \|. 48 \|dec eax 10002E84 \|. F7D8 \|neg eax 10002E86 \|. 1BC0 \|sbb eax, eax 10002E88 \|. 83C0 F5 \|add eax, -0B 10002E8B \|> 50 \|push eax 10002E8C \|. FFD5 \|call ebp 10002E8E \|. 8BF8 \|mov edi, eax 10002E90 \|. 83FF FF \|cmp edi, -1 10002E93 \|. 74 2A \|je short 10002EBF 10002E95 \|. 57 \|push edi ; /hFile 10002E96 \|. FF15 64500010 \|call dword ptr [<&KERNEL32.GetFileTy>; \GetFileType 10002E9C \|. 85C0 \|test eax, eax 10002E9E \|. 74 1F \|je short 10002EBF 10002EA0 \|. 25 FF000000 \|and eax, 0FF 10002EA5 \|. 893E \|mov dword ptr [esi], edi 10002EA7 \|. 83F8 02 \|cmp eax, 2 10002EAA \|. 75 07 \|jnz short 10002EB3 10002EAC \|. 8A46 04 \|mov al, byte ptr [esi+4] 10002EAF \|. 0C 40 \|or al, 40 10002EB1 \|. EB 18 \|jmp short 10002ECB 10002EB3 \|> 83F8 03 \|cmp eax, 3 10002EB6 \|. 75 16 \|jnz short 10002ECE 10002EB8 \|. 8A46 04 \|mov al, byte ptr [esi+4] 10002EBB \|. 0C 08 \|or al, 8 10002EBD \|. EB 0C \|jmp short 10002ECB 10002EBF \|> 8A46 04 \|mov al, byte ptr [esi+4] 10002EC2 \|. 0C 40 \|or al, 40 10002EC4 \|. EB 05 \|jmp short 10002ECB 10002EC6 \|> 8A46 04 \|mov al, byte ptr [esi+4] 10002EC9 \|. 0C 80 \|or al, 80 10002ECB \|> 8846 04 \|mov byte ptr [esi+4], al 10002ECE \|> 43 \|inc ebx 10002ECF \|. 83FB 03 \|cmp ebx, 3 10002ED2 \|.^ 7C 8D \jl short 10002E61 10002ED4 \|. A1 A0890010 mov eax, dword ptr [100089A0] 10002ED9 \|. 50 push eax ; /nHandles => 0 10002EDA \|. FF15 5C500010 call dword ptr [<&KERNEL32.SetHandleC>; \SetHandleCount 10002EE0 \|. 5F pop edi 10002EE1 \|. 5E pop esi 10002EE2 \|. 5D pop ebp 10002EE3 \|. 5B pop ebx 10002EE4 \|. 83C4 48 add esp, 48 10002EE7 \. C3 retn 10002EE8 90 nop 10002EE9 90 nop 10002EEA 90 nop 10002EEB 90 nop 10002EEC 90 nop 10002EED 90 nop 10002EEE 90 nop 10002EEF 90 nop 10002EF0 /$ 6A 00 push 0 ; /MaximumSize = 0 10002EF2 \|. 68 00100000 push 1000 ; \|InitialSize = 1000 (4096.) 10002EF7 \|. 6A 01 push 1 ; \|Flags = HEAP_NO_SERIALIZE 10002EF9 \|. FF15 6C500010 call dword ptr [<&KERNEL32.HeapCreate>; \HeapCreate 10002EFF \|. 85C0 test eax, eax 10002F01 \|. A3 90880010 mov dword ptr [10008890], eax 10002F06 \|. 75 01 jnz short 10002F09 10002F08 \|. C3 retn 10002F09 \|> E8 52070000 call 10003660 10002F0E \|. 85C0 test eax, eax 10002F10 \|. 75 0F jnz short 10002F21 10002F12 \|. A1 90880010 mov eax, dword ptr [10008890] 10002F17 \|. 50 push eax ; /hHeap => NULL 10002F18 \|. FF15 68500010 call dword ptr [<&KERNEL32.HeapDestro>; \HeapDestroy 10002F1E \|. 33C0 xor eax, eax 10002F20 \|. C3 retn 10002F21 \|> B8 01000000 mov eax, 1 10002F26 \. C3 retn 10002F27 90 nop 10002F28 90 nop 10002F29 90 nop 10002F2A 90 nop 10002F2B 90 nop 10002F2C 90 nop 10002F2D 90 nop 10002F2E 90 nop 10002F2F 90 nop 10002F30 /$ 55 push ebp 10002F31 \|. 8BEC mov ebp, esp 10002F33 \|. 53 push ebx 10002F34 \|. 56 push esi 10002F35 \|. 57 push edi 10002F36 \|. 55 push ebp 10002F37 \|. 6A 00 push 0 ; /_eax_value = 0 10002F39 \|. 6A 00 push 0 ; \|pExcptRec = NULL 10002F3B \|. 68 482F0010 push 10002F48 ; \|ReturnAddr = pjgl.10002F48 10002F40 \|. FF75 08 push dword ptr [ebp+8] ; \|pRegistrationFrame 10002F43 \|. E8 C8120000 call <jmp.&KERNEL32.RtlUnwind> ; \RtlUnwind 10002F48 \|. 5D pop ebp 10002F49 \|. 5F pop edi 10002F4A \|. 5E pop esi 10002F4B \|. 5B pop ebx 10002F4C \|. 8BE5 mov esp, ebp 10002F4E \|. 5D pop ebp 10002F4F \. C3 retn 10002F50 /$ 8B4C24 04 mov ecx, dword ptr [esp+4] ; 结构异常处理程序 10002F54 \|. F741 04 06000>test dword ptr [ecx+4], 6 10002F5B \|. B8 01000000 mov eax, 1 10002F60 \|. 74 0F je short 10002F71 10002F62 \|. 8B4424 08 mov eax, dword ptr [esp+8] 10002F66 \|. 8B5424 10 mov edx, dword ptr [esp+10] 10002F6A \|. 8902 mov dword ptr [edx], eax 10002F6C \|. B8 03000000 mov eax, 3 10002F71 \> C3 retn 10002F72 /$ 53 push ebx 10002F73 \|. 56 push esi 10002F74 \|. 57 push edi 10002F75 \|. 8B4424 10 mov eax, dword ptr [esp+10] 10002F79 \|. 50 push eax 10002F7A \|. 6A FE push -2 10002F7C \|. 68 502F0010 push 10002F50 ; SE 处理程序安装 10002F81 \|. 64:FF35 00000>push dword ptr fs:[0] 10002F88 \|. 64:8925 00000>mov dword ptr fs:[0], esp 10002F8F \|> 8B4424 20 /mov eax, dword ptr [esp+20] 10002F93 \|. 8B58 08 \|mov ebx, dword ptr [eax+8] 10002F96 \|. 8B70 0C \|mov esi, dword ptr [eax+C] 10002F99 \|. 83FE FF \|cmp esi, -1 10002F9C \|. 74 2E \|je short 10002FCC 10002F9E \|. 3B7424 24 \|cmp esi, dword ptr [esp+24] 10002FA2 \|. 74 28 \|je short 10002FCC 10002FA4 \|. 8D3476 \|lea esi, dword ptr [esi+esi2] 10002FA7 \|. 8B0CB3 \|mov ecx, dword ptr [ebx+esi4] 10002FAA \|. 894C24 08 \|mov dword ptr [esp+8], ecx 10002FAE \|. 8948 0C \|mov dword ptr [eax+C], ecx 10002FB1 \|. 837CB3 04 00 \|cmp dword ptr [ebx+esi4+4], 0 10002FB6 \|. 75 12 \|jnz short 10002FCA 10002FB8 \|. 68 01010000 \|push 101 10002FBD \|. 8B44B3 08 \|mov eax, dword ptr [ebx+esi4+8] 10002FC1 \|. E8 40000000 \|call 10003006 10002FC6 \|. FF54B3 08 \|call dword ptr [ebx+esi4+8] 10002FCA \|>^ EB C3 \jmp short 10002F8F 10002FCC \|> 64:8F05 00000>pop dword ptr fs:[0] 10002FD3 \|. 83C4 0C add esp, 0C 10002FD6 \|. 5F pop edi 10002FD7 \|. 5E pop esi 10002FD8 \|. 5B pop ebx 10002FD9 \. C3 retn 10002FDA . 33C0 xor eax, eax 10002FDC . 64:8B0D 00000>mov ecx, dword ptr fs:[0] 10002FE3 . 8179 04 502F0>cmp dword ptr [ecx+4], 10002F50 ; 入口地址 10002FEA . 75 10 jnz short 10002FFC 10002FEC . 8B51 0C mov edx, dword ptr [ecx+C] 10002FEF . 8B52 0C mov edx, dword ptr [edx+C] 10002FF2 . 3951 08 cmp dword ptr [ecx+8], edx 10002FF5 . 75 05 jnz short 10002FFC 10002FF7 . B8 01000000 mov eax, 1 10002FFC > C3 retn 10002FFD . 53 push ebx 10002FFE . 51 push ecx 10002FFF . BB DC630010 mov ebx, 100063DC 10003004 . EB 0A jmp short 10003010 10003006 /$ 53 push ebx 10003007 \|. 51 push ecx 10003008 \|. BB DC630010 mov ebx, 100063DC 1000300D \|. 8B4D 08 mov ecx, dword ptr [ebp+8] 10003010 \|> 894B 08 mov dword ptr [ebx+8], ecx 10003013 \|. 8943 04 mov dword ptr [ebx+4], eax 10003016 \|. 896B 0C mov dword ptr [ebx+C], ebp 10003019 \|. 59 pop ecx 1000301A \|. 5B pop ebx 1000301B \. C2 0400 retn 4 1000301E CC int3 1000301F CC int3 10003020 56 db 56 ; CHAR 'V' 10003021 43 db 43 ; CHAR 'C' 10003022 32 db 32 ; CHAR '2' 10003023 30 db 30 ; CHAR '0' 10003024 58 db 58 ; CHAR 'X' 10003025 43 db 43 ; CHAR 'C' 10003026 30 db 30 ; CHAR '0' 10003027 30 db 30 ; CHAR '0' 10003028 /$ 55 push ebp ; 结构异常处理程序 10003029 \|. 8BEC mov ebp, esp 1000302B \|. 83EC 08 sub esp, 8 1000302E \|. 53 push ebx 1000302F \|. 56 push esi 10003030 \|. 57 push edi 10003031 \|. 55 push ebp 10003032 \|. FC cld 10003033 \|. 8B5D 0C mov ebx, dword ptr [ebp+C] 10003036 \|. 8B45 08 mov eax, dword ptr [ebp+8] 10003039 \|. F740 04 06000>test dword ptr [eax+4], 6 10003040 \|. 0F85 82000000 jnz 100030C8 10003046 \|. 8945 F8 mov dword ptr [ebp-8], eax 10003049 \|. 8B45 10 mov eax, dword ptr [ebp+10] 1000304C \|. 8945 FC mov dword ptr [ebp-4], eax 1000304F \|. 8D45 F8 lea eax, dword ptr [ebp-8] 10003052 \|. 8943 FC mov dword ptr [ebx-4], eax 10003055 \|. 8B73 0C mov esi, dword ptr [ebx+C] 10003058 \|. 8B7B 08 mov edi, dword ptr [ebx+8] 1000305B \|> 83FE FF /cmp esi, -1 1000305E \|. 74 61 \|je short 100030C1 10003060 \|. 8D0C76 \|lea ecx, dword ptr [esi+esi2] 10003063 \|. 837C8F 04 00 \|cmp dword ptr [edi+ecx4+4], 0 10003068 \|. 74 45 \|je short 100030AF 1000306A \|. 56 \|push esi 1000306B \|. 55 \|push ebp 1000306C \|. 8D6B 10 \|lea ebp, dword ptr [ebx+10] 1000306F \|. FF548F 04 \|call dword ptr [edi+ecx4+4] 10003073 \|. 5D \|pop ebp 10003074 \|. 5E \|pop esi 10003075 \|. 8B5D 0C \|mov ebx, dword ptr [ebp+C] 10003078 \|. 0BC0 \|or eax, eax 1000307A \|. 74 33 \|je short 100030AF 1000307C \|. 78 3C \|js short 100030BA 1000307E \|. 8B7B 08 \|mov edi, dword ptr [ebx+8] 10003081 \|. 53 \|push ebx 10003082 \|. E8 A9FEFFFF \|call 10002F30 10003087 \|. 83C4 04 \|add esp, 4 1000308A \|. 8D6B 10 \|lea ebp, dword ptr [ebx+10] 1000308D \|. 56 \|push esi 1000308E \|. 53 \|push ebx 1000308F \|. E8 DEFEFFFF \|call 10002F72 10003094 \|. 83C4 08 \|add esp, 8 10003097 \|. 8D0C76 \|lea ecx, dword ptr [esi+esi2] 1000309A \|. 6A 01 \|push 1 1000309C \|. 8B448F 08 \|mov eax, dword ptr [edi+ecx4+8] 100030A0 \|. E8 61FFFFFF \|call 10003006 100030A5 \|. 8B048F \|mov eax, dword ptr [edi+ecx4] 100030A8 \|. 8943 0C \|mov dword ptr [ebx+C], eax 100030AB \|. FF548F 08 \|call dword ptr [edi+ecx4+8] 100030AF \|> 8B7B 08 \|mov edi, dword ptr [ebx+8] 100030B2 \|. 8D0C76 \|lea ecx, dword ptr [esi+esi2] 100030B5 \|. 8B348F \|mov esi, dword ptr [edi+ecx4] 100030B8 \|.^ EB A1 \jmp short 1000305B 100030BA \|> B8 00000000 mov eax, 0 100030BF \|. EB 1C jmp short 100030DD 100030C1 \|> B8 01000000 mov eax, 1 100030C6 \|. EB 15 jmp short 100030DD 100030C8 \|> 55 push ebp 100030C9 \|. 8D6B 10 lea ebp, dword ptr [ebx+10] 100030CC \|. 6A FF push -1 100030CE \|. 53 push ebx 100030CF \|. E8 9EFEFFFF call 10002F72 100030D4 \|. 83C4 08 add esp, 8 100030D7 \|. 5D pop ebp 100030D8 \|. B8 01000000 mov eax, 1 100030DD \|> 5D pop ebp 100030DE \|. 5F pop edi 100030DF \|. 5E pop esi 100030E0 \|. 5B pop ebx 100030E1 \|. 8BE5 mov esp, ebp 100030E3 \|. 5D pop ebp 100030E4 \. C3 retn 100030E5 . 55 push ebp 100030E6 . 8B4C24 08 mov ecx, dword ptr [esp+8] 100030EA . 8B29 mov ebp, dword ptr [ecx] 100030EC . 8B41 1C mov eax, dword ptr [ecx+1C] 100030EF . 50 push eax 100030F0 . 8B41 18 mov eax, dword ptr [ecx+18] 100030F3 . 50 push eax 100030F4 . E8 79FEFFFF call 10002F72 100030F9 . 83C4 08 add esp, 8 100030FC . 5D pop ebp 100030FD . C2 0400 retn 4 10003100 /$ A1 C4840010 mov eax, dword ptr [100084C4] 10003105 \|. 83F8 01 cmp eax, 1 10003108 \|. 74 0D je short 10003117 1000310A \|. 85C0 test eax, eax 1000310C \|. 75 2E jnz short 1000313C 1000310E \|. 833D 34600010>cmp dword ptr [10006034], 1 10003115 \|. 75 25 jnz short 1000313C 10003117 \|> 68 FC000000 push 0FC 1000311C \|. E8 1F000000 call 10003140 10003121 \|. A1 6C880010 mov eax, dword ptr [1000886C] 10003126 \|. 83C4 04 add esp, 4 10003129 \|. 85C0 test eax, eax 1000312B \|. 74 02 je short 1000312F 1000312D \|. FFD0 call eax 1000312F \|> 68 FF000000 push 0FF 10003134 \|. E8 07000000 call 10003140 10003139 \|. 83C4 04 add esp, 4 1000313C \> C3 retn 1000313D 90 nop 1000313E 90 nop 1000313F 90 nop 10003140 /$ 8B4C24 04 mov ecx, dword ptr [esp+4] 10003144 \|. 81EC A8010000 sub esp, 1A8 1000314A \|. B8 F0630010 mov eax, 100063F0 1000314F \|. 53 push ebx 10003150 \|. 55 push ebp 10003151 \|. 56 push esi 10003152 \|. 57 push edi 10003153 \|. 33ED xor ebp, ebp 10003155 \|> 3B08 /cmp ecx, dword ptr [eax] 10003157 \|. 74 0B \|je short 10003164 10003159 \|. 83C0 08 \|add eax, 8 1000315C \|. 45 \|inc ebp 1000315D \|. 3D 80640010 \|cmp eax, 10006480 10003162 \|.^ 72 F1 \jb short 10003155 10003164 \|> 3B0CED F06300>cmp ecx, dword ptr [ebp8+100063F0] 1000316B \|. 0F85 9A010000 jnz 1000330B 10003171 \|. A1 C4840010 mov eax, dword ptr [100084C4] 10003176 \|. 83F8 01 cmp eax, 1 10003179 \|. 0F84 4E010000 je 100032CD 1000317F \|. 85C0 test eax, eax 10003181 \|. 75 0D jnz short 10003190 10003183 \|. 833D 34600010>cmp dword ptr [10006034], 1 1000318A \|. 0F84 3D010000 je 100032CD 10003190 \|> 81F9 FC000000 cmp ecx, 0FC 10003196 \|. 0F84 6F010000 je 1000330B 1000319C \|. 8D8424 B40000>lea eax, dword ptr [esp+B4] 100031A3 \|. 68 04010000 push 104 ; /BufSize = 104 (260.) 100031A8 \|. 50 push eax ; \|PathBuffer 100031A9 \|. 6A 00 push 0 ; \|hModule = NULL 100031AB \|. FF15 48500010 call dword ptr [<&KERNEL32.GetModuleF>; \GetModuleFileNameA 100031B1 \|. 85C0 test eax, eax 100031B3 \|. 75 16 jnz short 100031CB 100031B5 \|. B9 05000000 mov ecx, 5 100031BA \|. BE 8C530010 mov esi, 1000538C ; ASCII "<program name unknown>" 100031BF \|. 8DBC24 B40000>lea edi, dword ptr [esp+B4] 100031C6 \|. F3:A5 rep movs dword ptr es:[edi], dword p> 100031C8 \|. 66:A5 movs word ptr es:[edi], word ptr [esi> 100031CA \|. A4 movs byte ptr es:[edi], byte ptr [esi> 100031CB \|> 8DBC24 B40000>lea edi, dword ptr [esp+B4] 100031D2 \|. 83C9 FF or ecx, FFFFFFFF 100031D5 \|. 33C0 xor eax, eax 100031D7 \|. 8D9C24 B40000>lea ebx, dword ptr [esp+B4] 100031DE \|. F2:AE repne scas byte ptr es:[edi] 100031E0 \|. F7D1 not ecx 100031E2 \|. 83F9 3C cmp ecx, 3C 100031E5 \|. 76 2D jbe short 10003214 100031E7 \|. 8DBC24 B40000>lea edi, dword ptr [esp+B4] 100031EE \|. 83C9 FF or ecx, FFFFFFFF 100031F1 \|. F2:AE repne scas byte ptr es:[edi] 100031F3 \|. F7D1 not ecx 100031F5 \|. 49 dec ecx 100031F6 \|. 6A 03 push 3 100031F8 \|. 8BD9 mov ebx, ecx 100031FA \|. 8D8C24 B80000>lea ecx, dword ptr [esp+B8] 10003201 \|. 83E9 3B sub ecx, 3B 10003204 \|. 68 88530010 push 10005388 ; ASCII "..." 10003209 \|. 03D9 add ebx, ecx 1000320B \|. 53 push ebx 1000320C \|. E8 9F020000 call 100034B0 10003211 \|. 83C4 0C add esp, 0C 10003214 \|> B9 06000000 mov ecx, 6 10003219 \|. BE 6C530010 mov esi, 1000536C ; ASCII "Runtime Error!",LF,LF,"Program: " 1000321E \|. 8D7C24 14 lea edi, dword ptr [esp+14] 10003222 \|. 33C0 xor eax, eax 10003224 \|. F3:A5 rep movs dword ptr es:[edi], dword p> 10003226 \|. 66:A5 movs word ptr es:[edi], word ptr [esi> 10003228 \|. 83C9 FF or ecx, FFFFFFFF 1000322B \|. 8BFB mov edi, ebx 1000322D \|. F2:AE repne scas byte ptr es:[edi] 1000322F \|. F7D1 not ecx 10003231 \|. 2BF9 sub edi, ecx 10003233 \|. 8D5424 14 lea edx, dword ptr [esp+14] 10003237 \|. 8BD9 mov ebx, ecx 10003239 \|. 8BF7 mov esi, edi 1000323B \|. 83C9 FF or ecx, FFFFFFFF 1000323E \|. 8BFA mov edi, edx 10003240 \|. F2:AE repne scas byte ptr es:[edi] 10003242 \|. 8BCB mov ecx, ebx 10003244 \|. 4F dec edi 10003245 \|. C1E9 02 shr ecx, 2 10003248 \|. F3:A5 rep movs dword ptr es:[edi], dword p> 1000324A \|. 8BCB mov ecx, ebx 1000324C \|. 8D5424 14 lea edx, dword ptr [esp+14] 10003250 \|. 83E1 03 and ecx, 3 10003253 \|. 68 10200100 push 12010 10003258 \|. F3:A4 rep movs byte ptr es:[edi], byte ptr> 1000325A \|. BF 68530010 mov edi, 10005368 ; ASCII LF,LF 1000325F \|. 83C9 FF or ecx, FFFFFFFF 10003262 \|. F2:AE repne scas byte ptr es:[edi] 10003264 \|. F7D1 not ecx 10003266 \|. 2BF9 sub edi, ecx 10003268 \|. 68 40530010 push 10005340 ; ASCII "Microsoft Visual C++ Runtime Library" 1000326D \|. 8BF7 mov esi, edi 1000326F \|. 8BD9 mov ebx, ecx 10003271 \|. 8BFA mov edi, edx 10003273 \|. 83C9 FF or ecx, FFFFFFFF 10003276 \|. F2:AE repne scas byte ptr es:[edi] 10003278 \|. 8BCB mov ecx, ebx 1000327A \|. 4F dec edi 1000327B \|. C1E9 02 shr ecx, 2 1000327E \|. F3:A5 rep movs dword ptr es:[edi], dword p> 10003280 \|. 8BCB mov ecx, ebx 10003282 \|. 8D5424 1C lea edx, dword ptr [esp+1C] 10003286 \|. 83E1 03 and ecx, 3 10003289 \|. F3:A4 rep movs byte ptr es:[edi], byte ptr> 1000328B \|. 8B3CED F46300>mov edi, dword ptr [ebp8+100063F4] 10003292 \|. 83C9 FF or ecx, FFFFFFFF 10003295 \|. F2:AE repne scas byte ptr es:[edi] 10003297 \|. F7D1 not ecx 10003299 \|. 2BF9 sub edi, ecx 1000329B \|. 8BF7 mov esi, edi 1000329D \|. 8BD9 mov ebx, ecx 1000329F \|. 8BFA mov edi, edx 100032A1 \|. 83C9 FF or ecx, FFFFFFFF 100032A4 \|. F2:AE repne scas byte ptr es:[edi] 100032A6 \|. 8BCB mov ecx, ebx 100032A8 \|. 4F dec edi 100032A9 \|. C1E9 02 shr ecx, 2 100032AC \|. F3:A5 rep movs dword ptr es:[edi], dword p> 100032AE \|. 8BCB mov ecx, ebx 100032B0 \|. 8D4424 1C lea eax, dword ptr [esp+1C] 100032B4 \|. 83E1 03 and ecx, 3 100032B7 \|. 50 push eax 100032B8 \|. F3:A4 rep movs byte ptr es:[edi], byte ptr> 100032BA \|. E8 C10A0000 call 10003D80 100032BF \|. 83C4 0C add esp, 0C 100032C2 \|. 5F pop edi 100032C3 \|. 5E pop esi 100032C4 \|. 5D pop ebp 100032C5 \|. 5B pop ebx 100032C6 \|. 81C4 A8010000 add esp, 1A8 100032CC \|. C3 retn 100032CD \|> A1 A0880010 mov eax, dword ptr [100088A0] 100032D2 \|. 85C0 test eax, eax 100032D4 \|. 74 08 je short 100032DE 100032D6 \|. 8B70 10 mov esi, dword ptr [eax+10] 100032D9 \|. 83FE FF cmp esi, -1 100032DC \|. 75 0A jnz short 100032E8 100032DE \|> 6A F4 push -0C ; /DevType = STD_ERROR_HANDLE 100032E0 \|. FF15 60500010 call dword ptr [<&KERNEL32.GetStdHand>; \GetStdHandle 100032E6 \|. 8BF0 mov esi, eax 100032E8 \|> 8B14ED F46300>mov edx, dword ptr [ebp8+100063F4] 100032EF \|. 8D4C24 10 lea ecx, dword ptr [esp+10] 100032F3 \|. 6A 00 push 0 ; /pOverlapped = NULL 100032F5 \|. 51 push ecx ; \|pBytesWritten 100032F6 \|. 8BFA mov edi, edx ; \| 100032F8 \|. 83C9 FF or ecx, FFFFFFFF ; \| 100032FB \|. 33C0 xor eax, eax ; \| 100032FD \|. F2:AE repne scas byte ptr es:[edi] ; \| 100032FF \|. F7D1 not ecx ; \| 10003301 \|. 49 dec ecx ; \| 10003302 \|. 51 push ecx ; \|nBytesToWrite 10003303 \|. 52 push edx ; \|Buffer 10003304 \|. 56 push esi ; \|hFile 10003305 \|. FF15 74500010 call dword ptr [<&KERNEL32.WriteFile>>; \WriteFile 1000330B \|> 5F pop edi 1000330C \|. 5E pop esi 1000330D \|. 5D pop ebp 1000330E \|. 5B pop ebx 1000330F \|. 81C4 A8010000 add esp, 1A8 10003315 \. C3 retn 10003316 90 nop 10003317 90 nop 10003318 90 nop 10003319 90 nop 1000331A 90 nop 1000331B 90 nop 1000331C 90 nop 1000331D 90 nop 1000331E 90 nop 1000331F 90 nop 10003320 /$ 51 push ecx 10003321 \|. A1 74880010 mov eax, dword ptr [10008874] 10003326 \|. 53 push ebx 10003327 \|. 55 push ebp 10003328 \|. 56 push esi 10003329 \|. 8B35 78500010 mov esi, dword ptr [<&KERNEL32.GetSt>; kernel32.GetStringTypeA 1000332F \|. 57 push edi 10003330 \|. 33FF xor edi, edi 10003332 \|. 3BC7 cmp eax, edi 10003334 \|. 75 26 jnz short 1000335C 10003336 \|. 8D4424 12 lea eax, dword ptr [esp+12] 1000333A \|. 50 push eax ; /CharTypes 1000333B \|. 6A 01 push 1 ; \|SrcCount = 1 1000333D \|. 68 B0500010 push 100050B0 ; \|Source = "" 10003342 \|. 6A 01 push 1 ; \|InfoType = CT_CTYPE1 10003344 \|. FF15 7C500010 call dword ptr [<&KERNEL32.GetStringT>; \GetStringTypeW 1000334A \|. 85C0 test eax, eax 1000334C \|. 0F84 DA000000 je 1000342C 10003352 \|. B8 01000000 mov eax, 1 10003357 \|. A3 74880010 mov dword ptr [10008874], eax 1000335C \|> 83F8 02 cmp eax, 2 1000335F \|. 75 2A jnz short 1000338B 10003361 \|. 8B4424 2C mov eax, dword ptr [esp+2C] 10003365 \|. 3BC7 cmp eax, edi 10003367 \|. 75 05 jnz short 1000336E 10003369 \|. A1 F8860010 mov eax, dword ptr [100086F8] 1000336E \|> 8B5424 24 mov edx, dword ptr [esp+24] 10003372 \|. 8B4C24 20 mov ecx, dword ptr [esp+20] 10003376 \|. 52 push edx 10003377 \|. 8B5424 20 mov edx, dword ptr [esp+20] 1000337B \|. 51 push ecx 1000337C \|. 8B4C24 20 mov ecx, dword ptr [esp+20] 10003380 \|. 52 push edx 10003381 \|. 51 push ecx 10003382 \|. 50 push eax 10003383 \|. FFD6 call esi 10003385 \|. 5F pop edi 10003386 \|. 5E pop esi 10003387 \|. 5D pop ebp 10003388 \|. 5B pop ebx 10003389 \|. 59 pop ecx 1000338A \|. C3 retn 1000338B \|> 83F8 01 cmp eax, 1 1000338E \|. 0F85 92000000 jnz 10003426 10003394 \|. 8B5C24 28 mov ebx, dword ptr [esp+28] 10003398 \|. 897C24 2C mov dword ptr [esp+2C], edi 1000339C \|. 3BDF cmp ebx, edi 1000339E \|. 75 06 jnz short 100033A6 100033A0 \|. 8B1D 08870010 mov ebx, dword ptr [10008708] 100033A6 \|> 8B4424 30 mov eax, dword ptr [esp+30] 100033AA \|. 8B6C24 20 mov ebp, dword ptr [esp+20] 100033AE \|. 8B5424 1C mov edx, dword ptr [esp+1C] 100033B2 \|. 57 push edi ; /WideBufSize 100033B3 \|. F7D8 neg eax ; \| 100033B5 \|. 1BC0 sbb eax, eax ; \| 100033B7 \|. 57 push edi ; \|WideCharBuf 100033B8 \|. 83E0 08 and eax, 8 ; \| 100033BB \|. 55 push ebp ; \|StringSize 100033BC \|. 40 inc eax ; \| 100033BD \|. 52 push edx ; \|StringToMap 100033BE \|. 50 push eax ; \|Options 100033BF \|. 53 push ebx ; \|CodePage 100033C0 \|. FF15 2C500010 call dword ptr [<&KERNEL32.MultiByteT>; \MultiByteToWideChar 100033C6 \|. 8BF0 mov esi, eax 100033C8 \|. 85F6 test esi, esi 100033CA \|. 74 4B je short 10003417 100033CC \|. 56 push esi 100033CD \|. 6A 02 push 2 100033CF \|. E8 7C0D0000 call 10004150 100033D4 \|. 8BF8 mov edi, eax 100033D6 \|. 83C4 08 add esp, 8 100033D9 \|. 85FF test edi, edi 100033DB \|. 74 3A je short 10003417 100033DD \|. 8B4C24 1C mov ecx, dword ptr [esp+1C] 100033E1 \|. 56 push esi ; /WideBufSize 100033E2 \|. 57 push edi ; \|WideCharBuf 100033E3 \|. 55 push ebp ; \|StringSize 100033E4 \|. 51 push ecx ; \|StringToMap 100033E5 \|. 6A 01 push 1 ; \|Options = MB_PRECOMPOSED 100033E7 \|. 53 push ebx ; \|CodePage 100033E8 \|. FF15 2C500010 call dword ptr [<&KERNEL32.MultiByteT>; \MultiByteToWideChar 100033EE \|. 85C0 test eax, eax 100033F0 \|. 74 25 je short 10003417 100033F2 \|. 8B5424 24 mov edx, dword ptr [esp+24] 100033F6 \|. 52 push edx ; /CharTypes 100033F7 \|. 50 push eax ; \|SrcCount 100033F8 \|. 8B4424 20 mov eax, dword ptr [esp+20] ; \| 100033FC \|. 57 push edi ; \|Source 100033FD \|. 50 push eax ; \|InfoType 100033FE \|. FF15 7C500010 call dword ptr [<&KERNEL32.GetStringT>; \GetStringTypeW 10003404 \|. 57 push edi 10003405 \|. 8BF0 mov esi, eax 10003407 \|. E8 54000000 call 10003460 1000340C \|. 83C4 04 add esp, 4 1000340F \|. 8BC6 mov eax, esi 10003411 \|. 5F pop edi 10003412 \|. 5E pop esi 10003413 \|. 5D pop ebp 10003414 \|. 5B pop ebx 10003415 \|. 59 pop ecx 10003416 \|. C3 retn 10003417 \|> 8B7424 2C mov esi, dword ptr [esp+2C] 1000341B \|. 57 push edi 1000341C \|. E8 3F000000 call 10003460 10003421 \|. 83C4 04 add esp, 4 10003424 \|. 8BC6 mov eax, esi 10003426 \|> 5F pop edi 10003427 \|. 5E pop esi 10003428 \|. 5D pop ebp 10003429 \|. 5B pop ebx 1000342A \|. 59 pop ecx 1000342B \|. C3 retn 1000342C \|> 8D4C24 12 lea ecx, dword ptr [esp+12] 10003430 \|. 51 push ecx 10003431 \|. 6A 01 push 1 10003433 \|. 68 AC500010 push 100050AC 10003438 \|. 6A 01 push 1 1000343A \|. 57 push edi 1000343B \|. FFD6 call esi 1000343D \|. 85C0 test eax, eax 1000343F \|. 74 0F je short 10003450 10003441 \|. B8 02000000 mov eax, 2 10003446 \|. A3 74880010 mov dword ptr [10008874], eax 1000344B \|.^ E9 0CFFFFFF jmp 1000335C 10003450 \|> 5F pop edi 10003451 \|. 5E pop esi 10003452 \|. 5D pop ebp 10003453 \|. 33C0 xor eax, eax 10003455 \|. 5B pop ebx 10003456 \|. 59 pop ecx 10003457 \. C3 retn 10003458 90 nop 10003459 90 nop 1000345A 90 nop 1000345B 90 nop 1000345C 90 nop 1000345D 90 nop 1000345E 90 nop 1000345F 90 nop 10003460 /$ 51 push ecx 10003461 \|. 56 push esi 10003462 \|. 8B7424 0C mov esi, dword ptr [esp+C] 10003466 \|. 85F6 test esi, esi 10003468 \|. 74 3D je short 100034A7 1000346A \|. 8D4424 0C lea eax, dword ptr [esp+C] 1000346E \|. 8D4C24 04 lea ecx, dword ptr [esp+4] 10003472 \|. 50 push eax 10003473 \|. 51 push ecx 10003474 \|. 56 push esi 10003475 \|. E8 86040000 call 10003900 1000347A \|. 83C4 0C add esp, 0C 1000347D \|. 85C0 test eax, eax 1000347F \|. 74 16 je short 10003497 10003481 \|. 8B5424 0C mov edx, dword ptr [esp+C] 10003485 \|. 50 push eax 10003486 \|. 8B4424 08 mov eax, dword ptr [esp+8] 1000348A \|. 52 push edx 1000348B \|. 50 push eax 1000348C \|. E8 CF040000 call 10003960 10003491 \|. 83C4 0C add esp, 0C 10003494 \|. 5E pop esi 10003495 \|. 59 pop ecx 10003496 \|. C3 retn 10003497 \|> 8B0D 90880010 mov ecx, dword ptr [10008890] 1000349D \|. 56 push esi ; /pMemory 1000349E \|. 6A 00 push 0 ; \|Flags = 0 100034A0 \|. 51 push ecx ; \|hHeap => NULL 100034A1 \|. FF15 80500010 call dword ptr [<&KERNEL32.HeapFree>] ; \HeapFree 100034A7 \|> 5E pop esi 100034A8 \|. 59 pop ecx 100034A9 \. C3 retn 100034AA 90 nop 100034AB 90 nop 100034AC 90 nop 100034AD 90 nop 100034AE 90 nop 100034AF 90 nop 100034B0 /$ 8B4C24 0C mov ecx, dword ptr [esp+C] 100034B4 \|. 57 push edi 100034B5 \|. 85C9 test ecx, ecx 100034B7 \|. 74 7A je short 10003533 100034B9 \|. 56 push esi 100034BA \|. 53 push ebx 100034BB \|. 8BD9 mov ebx, ecx 100034BD \|. 8B7424 14 mov esi, dword ptr [esp+14] 100034C1 \|. F7C6 03000000 test esi, 3 100034C7 \|. 8B7C24 10 mov edi, dword ptr [esp+10] 100034CB \|. 75 07 jnz short 100034D4 100034CD \|. C1E9 02 shr ecx, 2 100034D0 \|. 75 6F jnz short 10003541 100034D2 \|. EB 21 jmp short 100034F5 100034D4 \|> 8A06 /mov al, byte ptr [esi] 100034D6 \|. 46 \|inc esi 100034D7 \|. 8807 \|mov byte ptr [edi], al 100034D9 \|. 47 \|inc edi 100034DA \|. 49 \|dec ecx 100034DB \|. 74 25 \|je short 10003502 100034DD \|. 84C0 \|test al, al 100034DF \|. 74 29 \|je short 1000350A 100034E1 \|. F7C6 03000000 \|test esi, 3 100034E7 \|.^ 75 EB \jnz short 100034D4 100034E9 \|. 8BD9 mov ebx, ecx 100034EB \|. C1E9 02 shr ecx, 2 100034EE \|. 75 51 jnz short 10003541 100034F0 \|> 83E3 03 and ebx, 3 100034F3 \|. 74 0D je short 10003502 100034F5 \|> 8A06 /mov al, byte ptr [esi] 100034F7 \|. 46 \|inc esi 100034F8 \|. 8807 \|mov byte ptr [edi], al 100034FA \|. 47 \|inc edi 100034FB \|. 84C0 \|test al, al 100034FD \|. 74 2F \|je short 1000352E 100034FF \|. 4B \|dec ebx 10003500 \|.^ 75 F3 \jnz short 100034F5 10003502 \|> 8B4424 10 mov eax, dword ptr [esp+10] 10003506 \|. 5B pop ebx 10003507 \|. 5E pop esi 10003508 \|. 5F pop edi 10003509 \|. C3 retn 1000350A \|> F7C7 03000000 test edi, 3 10003510 \|. 74 12 je short 10003524 10003512 \|> 8807 /mov byte ptr [edi], al 10003514 \|. 47 \|inc edi 10003515 \|. 49 \|dec ecx 10003516 \|. 0F84 8A000000 \|je 100035A6 1000351C \|. F7C7 03000000 \|test edi, 3 10003522 \|.^ 75 EE \jnz short 10003512 10003524 \|> 8BD9 mov ebx, ecx 10003526 \|. C1E9 02 shr ecx, 2 10003529 \|. 75 6C jnz short 10003597 1000352B \|> 8807 mov byte ptr [edi], al 1000352D \|. 47 inc edi 1000352E \|> 4B dec ebx 1000352F \|.^ 75 FA jnz short 1000352B 10003531 \|. 5B pop ebx 10003532 \|. 5E pop esi 10003533 \|> 8B4424 08 mov eax, dword ptr [esp+8] 10003537 \|. 5F pop edi 10003538 \|. C3 retn 10003539 \|> 8917 /mov dword ptr [edi], edx 1000353B \|. 83C7 04 \|add edi, 4 1000353E \|. 49 \|dec ecx 1000353F \|.^ 74 AF \|je short 100034F0 10003541 \|> BA FFFEFE7E mov edx, 7EFEFEFF 10003546 \|. 8B06 \|mov eax, dword ptr [esi] 10003548 \|. 03D0 \|add edx, eax 1000354A \|. 83F0 FF \|xor eax, FFFFFFFF 1000354D \|. 33C2 \|xor eax, edx 1000354F \|. 8B16 \|mov edx, dword ptr [esi] 10003551 \|. 83C6 04 \|add esi, 4 10003554 \|. A9 00010181 \|test eax, 81010100 10003559 \|.^ 74 DE \|je short 10003539 1000355B \|. 84D2 \|test dl, dl 1000355D \|. 74 2C \|je short 1000358B 1000355F \|. 84F6 \|test dh, dh 10003561 \|. 74 1E \|je short 10003581 10003563 \|. F7C2 0000FF00 \|test edx, 0FF0000 10003569 \|. 74 0C \|je short 10003577 1000356B \|. F7C2 000000FF \|test edx, FF000000 10003571 \|.^ 75 C6 \jnz short 10003539 10003573 \|. 8917 mov dword ptr [edi], edx 10003575 \|. EB 18 jmp short 1000358F 10003577 \|> 81E2 FFFF0000 and edx, 0FFFF 1000357D \|. 8917 mov dword ptr [edi], edx 1000357F \|. EB 0E jmp short 1000358F 10003581 \|> 81E2 FF000000 and edx, 0FF 10003587 \|. 8917 mov dword ptr [edi], edx 10003589 \|. EB 04 jmp short 1000358F 1000358B \|> 33D2 xor edx, edx 1000358D \|. 8917 mov dword ptr [edi], edx 1000358F \|> 83C7 04 add edi, 4 10003592 \|. 33C0 xor eax, eax 10003594 \|. 49 dec ecx 10003595 \|. 74 0A je short 100035A1 10003597 \|> 33C0 xor eax, eax 10003599 \|> 8907 /mov dword ptr [edi], eax 1000359B \|. 83C7 04 \|add edi, 4 1000359E \|. 49 \|dec ecx 1000359F \|.^ 75 F8 \jnz short 10003599 100035A1 \|> 83E3 03 and ebx, 3 100035A4 \|.^ 75 85 jnz short 1000352B 100035A6 \|> 8B4424 10 mov eax, dword ptr [esp+10] 100035AA \|. 5B pop ebx 100035AB \|. 5E pop esi 100035AC \|. 5F pop edi 100035AD \. C3 retn 100035AE CC int3 100035AF CC int3 100035B0 /$ A1 88880010 mov eax, dword ptr [10008888] 100035B5 \|. 8B4C24 04 mov ecx, dword ptr [esp+4] 100035B9 \|. 50 push eax 100035BA \|. 51 push ecx 100035BB \|. E8 10000000 call 100035D0 100035C0 \|. 83C4 08 add esp, 8 100035C3 \. C3 retn 100035C4 90 nop 100035C5 90 nop 100035C6 90 nop 100035C7 90 nop 100035C8 90 nop 100035C9 90 nop 100035CA 90 nop 100035CB 90 nop 100035CC 90 nop 100035CD 90 nop 100035CE 90 nop 100035CF 90 nop 100035D0 /$ 56 push esi 100035D1 \|. 8B7424 08 mov esi, dword ptr [esp+8] 100035D5 \|. 83FE E0 cmp esi, -20 100035D8 \|. 57 push edi 100035D9 \|. 77 34 ja short 1000360F 100035DB \|. 85F6 test esi, esi 100035DD \|. 75 05 jnz short 100035E4 100035DF \|. BE 01000000 mov esi, 1 100035E4 \|> 8B7C24 10 mov edi, dword ptr [esp+10] 100035E8 \|> 83FE E0 /cmp esi, -20 100035EB \|. 77 0B \|ja short 100035F8 100035ED \|. 56 \|push esi 100035EE \|. E8 2D000000 \|call 10003620 100035F3 \|. 83C4 04 \|add esp, 4 100035F6 \|. EB 02 \|jmp short 100035FA 100035F8 \|> 33C0 \|xor eax, eax 100035FA \|> 85C0 \|test eax, eax 100035FC \|. 75 13 \|jnz short 10003611 100035FE \|. 85FF \|test edi, edi 10003600 \|. 74 0F \|je short 10003611 10003602 \|. 56 \|push esi 10003603 \|. E8 E80B0000 \|call 100041F0 10003608 \|. 83C4 04 \|add esp, 4 1000360B \|. 85C0 \|test eax, eax 1000360D \|.^ 75 D9 \jnz short 100035E8 1000360F \|> 33C0 xor eax, eax 10003611 \|> 5F pop edi 10003612 \|. 5E pop esi 10003613 \. C3 retn 10003614 90 nop 10003615 90 nop 10003616 90 nop 10003617 90 nop 10003618 90 nop 10003619 90 nop 1000361A 90 nop 1000361B 90 nop 1000361C 90 nop 1000361D 90 nop 1000361E 90 nop 1000361F 90 nop 10003620 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10003624 \|. 56 push esi 10003625 \|. 8D70 0F lea esi, dword ptr [eax+F] 10003628 \|. A1 A4840010 mov eax, dword ptr [100084A4] 1000362D \|. 83E6 F0 and esi, FFFFFFF0 10003630 \|. 3BF0 cmp esi, eax 10003632 \|. 77 12 ja short 10003646 10003634 \|. 8BCE mov ecx, esi 10003636 \|. C1E9 04 shr ecx, 4 10003639 \|. 51 push ecx 1000363A \|. E8 81030000 call 100039C0 1000363F \|. 83C4 04 add esp, 4 10003642 \|. 85C0 test eax, eax 10003644 \|. 75 10 jnz short 10003656 10003646 \|> 8B15 90880010 mov edx, dword ptr [10008890] 1000364C \|. 56 push esi ; /dwBytes 1000364D \|. 6A 00 push 0 ; \|dwFlags = 0 1000364F \|. 52 push edx ; \|hHeap => NULL 10003650 \|. FF15 84500010 call dword ptr [<&KERNEL32.HeapAlloc>>; \RtlAllocateHeap 10003656 \|> 5E pop esi 10003657 \. C3 retn 10003658 90 nop 10003659 90 nop 1000365A 90 nop 1000365B 90 nop 1000365C 90 nop 1000365D 90 nop 1000365E 90 nop 1000365F 90 nop 10003660 /$ A1 90640010 mov eax, dword ptr [10006490] 10003665 \|. 55 push ebp 10003666 \|. 56 push esi 10003667 \|. 83F8 FF cmp eax, -1 1000366A \|. 57 push edi 1000366B \|. 75 07 jnz short 10003674 1000366D \|. BD 80640010 mov ebp, 10006480 10003672 \|. EB 1D jmp short 10003691 10003674 \|> A1 90880010 mov eax, dword ptr [10008890] 10003679 \|. 68 20200000 push 2020 ; /dwBytes = 2020 (8224.) 1000367E \|. 6A 00 push 0 ; \|dwFlags = 0 10003680 \|. 50 push eax ; \|hHeap => NULL 10003681 \|. FF15 84500010 call dword ptr [<&KERNEL32.HeapAlloc>>; \RtlAllocateHeap 10003687 \|. 8BE8 mov ebp, eax 10003689 \|. 85ED test ebp, ebp 1000368B \|. 0F84 2B010000 je 100037BC 10003691 \|> 8B3D 88500010 mov edi, dword ptr [<&KERNEL32.Virtu>; kernel32.VirtualAlloc 10003697 \|. 6A 04 push 4 ; /Protect = PAGE_READWRITE 10003699 \|. 68 00200000 push 2000 ; \|AllocationType = MEM_RESERVE 1000369E \|. 68 00004000 push 400000 ; \|Size = 400000 (4194304.) 100036A3 \|. 6A 00 push 0 ; \|Address = NULL 100036A5 \|. FFD7 call edi ; \VirtualAlloc 100036A7 \|. 8BF0 mov esi, eax 100036A9 \|. 85F6 test esi, esi 100036AB \|. 0F84 F4000000 je 100037A5 100036B1 \|. 6A 04 push 4 ; /Protect = PAGE_READWRITE 100036B3 \|. 68 00100000 push 1000 ; \|AllocationType = MEM_COMMIT 100036B8 \|. 68 00000100 push 10000 ; \|Size = 10000 (65536.) 100036BD \|. 56 push esi ; \|Address 100036BE \|. FFD7 call edi ; \VirtualAlloc 100036C0 \|. 85C0 test eax, eax 100036C2 \|. 0F84 CF000000 je 10003797 100036C8 \|. 81FD 80640010 cmp ebp, 10006480 100036CE \|. 75 28 jnz short 100036F8 100036D0 \|. A1 80640010 mov eax, dword ptr [10006480] 100036D5 \|. 85C0 test eax, eax 100036D7 \|. 75 0A jnz short 100036E3 100036D9 \|. C705 80640010>mov dword ptr [10006480], 10006480 100036E3 \|> A1 84640010 mov eax, dword ptr [10006484] 100036E8 \|. 85C0 test eax, eax 100036EA \|. 75 27 jnz short 10003713 100036EC \|. C705 84640010>mov dword ptr [10006484], 10006480 100036F6 \|. EB 1B jmp short 10003713 100036F8 \|> C745 00 80640>mov dword ptr [ebp], 10006480 100036FF \|. 8B0D 84640010 mov ecx, dword ptr [10006484] ; pjgl.10006480 10003705 \|. 894D 04 mov dword ptr [ebp+4], ecx 10003708 \|. 892D 84640010 mov dword ptr [10006484], ebp 1000370E \|. 8B55 04 mov edx, dword ptr [ebp+4] 10003711 \|. 892A mov dword ptr [edx], ebp 10003713 \|> 8D86 00004000 lea eax, dword ptr [esi+400000] 10003719 \|. 8D4D 18 lea ecx, dword ptr [ebp+18] 1000371C \|. 8D95 98000000 lea edx, dword ptr [ebp+98] 10003722 \|. 8945 14 mov dword ptr [ebp+14], eax 10003725 \|. 8975 10 mov dword ptr [ebp+10], esi 10003728 \|. 894D 08 mov dword ptr [ebp+8], ecx 1000372B \|. 8955 0C mov dword ptr [ebp+C], edx 1000372E \|. 33C0 xor eax, eax 10003730 \|. BF F1000000 mov edi, 0F1 10003735 \|> 33D2 /xor edx, edx 10003737 \|. 83F8 10 \|cmp eax, 10 1000373A \|. 0F9DC2 \|setge dl 1000373D \|. 4A \|dec edx 1000373E \|. 83C1 08 \|add ecx, 8 10003741 \|. 23D7 \|and edx, edi 10003743 \|. 4A \|dec edx 10003744 \|. 40 \|inc eax 10003745 \|. 8951 F8 \|mov dword ptr [ecx-8], edx 10003748 \|. 8979 FC \|mov dword ptr [ecx-4], edi 1000374B \|. 3D 00040000 \|cmp eax, 400 10003750 \|.^ 7C E3 \jl short 10003735 10003752 \|. B9 00400000 mov ecx, 4000 10003757 \|. 33C0 xor eax, eax 10003759 \|. 8BFE mov edi, esi 1000375B \|. F3:AB rep stos dword ptr es:[edi] 1000375D \|. 8B45 10 mov eax, dword ptr [ebp+10] 10003760 \|. 05 00000100 add eax, 10000 ; UNICODE "=::=::\" 10003765 \|. 3BF0 cmp esi, eax 10003767 \|. 73 28 jnb short 10003791 10003769 \|. B9 F0000000 mov ecx, 0F0 1000376E \|. B0 FF mov al, 0FF 10003770 \|> 8D56 08 /lea edx, dword ptr [esi+8] 10003773 \|. 894E 04 \|mov dword ptr [esi+4], ecx 10003776 \|. 8916 \|mov dword ptr [esi], edx 10003778 \|. 8886 F8000000 \|mov byte ptr [esi+F8], al 1000377E \|. 8B55 10 \|mov edx, dword ptr [ebp+10] 10003781 \|. 81C6 00100000 \|add esi, 1000 10003787 \|. 81C2 00000100 \|add edx, 10000 ; UNICODE "=::=::\" 1000378D \|. 3BF2 \|cmp esi, edx 1000378F \|.^ 72 DF \jb short 10003770 10003791 \|> 8BC5 mov eax, ebp 10003793 \|. 5F pop edi 10003794 \|. 5E pop esi 10003795 \|. 5D pop ebp 10003796 \|. C3 retn 10003797 \|> 68 00800000 push 8000 ; /FreeType = MEM_RELEASE 1000379C \|. 6A 00 push 0 ; \|Size = 0 1000379E \|. 56 push esi ; \|Address 1000379F \|. FF15 50500010 call dword ptr [<&KERNEL32.VirtualFre>; \VirtualFree 100037A5 \|> 81FD 80640010 cmp ebp, 10006480 100037AB \|. 74 0F je short 100037BC 100037AD \|. A1 90880010 mov eax, dword ptr [10008890] 100037B2 \|. 55 push ebp ; /pMemory 100037B3 \|. 6A 00 push 0 ; \|Flags = 0 100037B5 \|. 50 push eax ; \|hHeap => NULL 100037B6 \|. FF15 80500010 call dword ptr [<&KERNEL32.HeapFree>] ; \HeapFree 100037BC \|> 5F pop edi 100037BD \|. 5E pop esi 100037BE \|. 33C0 xor eax, eax 100037C0 \|. 5D pop ebp 100037C1 \. C3 retn 100037C2 90 nop 100037C3 90 nop 100037C4 90 nop 100037C5 90 nop 100037C6 90 nop 100037C7 90 nop 100037C8 90 nop 100037C9 90 nop 100037CA 90 nop 100037CB 90 nop 100037CC 90 nop 100037CD 90 nop 100037CE 90 nop 100037CF 90 nop 100037D0 /$ 56 push esi 100037D1 \|. 8B7424 08 mov esi, dword ptr [esp+8] 100037D5 \|. 68 00800000 push 8000 ; /FreeType = MEM_RELEASE 100037DA \|. 6A 00 push 0 ; \|Size = 0 100037DC \|. 8B46 10 mov eax, dword ptr [esi+10] ; \| 100037DF \|. 50 push eax ; \|Address 100037E0 \|. FF15 50500010 call dword ptr [<&KERNEL32.VirtualFre>; \VirtualFree 100037E6 \|. 3935 A0840010 cmp dword ptr [100084A0], esi 100037EC \|. 75 09 jnz short 100037F7 100037EE \|. 8B4E 04 mov ecx, dword ptr [esi+4] 100037F1 \|. 890D A0840010 mov dword ptr [100084A0], ecx 100037F7 \|> 81FE 80640010 cmp esi, 10006480 100037FD \|. 74 20 je short 1000381F 100037FF \|. 8B56 04 mov edx, dword ptr [esi+4] 10003802 \|. 8B06 mov eax, dword ptr [esi] 10003804 \|. 56 push esi ; /pMemory 10003805 \|. 6A 00 push 0 ; \|Flags = 0 10003807 \|. 8902 mov dword ptr [edx], eax ; \| 10003809 \|. 8B0E mov ecx, dword ptr [esi] ; \| 1000380B \|. 8B56 04 mov edx, dword ptr [esi+4] ; \| 1000380E \|. 8951 04 mov dword ptr [ecx+4], edx ; \| 10003811 \|. A1 90880010 mov eax, dword ptr [10008890] ; \| 10003816 \|. 50 push eax ; \|hHeap => NULL 10003817 \|. FF15 80500010 call dword ptr [<&KERNEL32.HeapFree>] ; \HeapFree 1000381D \|. 5E pop esi 1000381E \|. C3 retn 1000381F \|> C705 90640010>mov dword ptr [10006490], -1 10003829 \|. 5E pop esi 1000382A \. C3 retn 1000382B 90 nop 1000382C 90 nop 1000382D 90 nop 1000382E 90 nop 1000382F 90 nop 10003830 /$ 53 push ebx 10003831 \|. 55 push ebp 10003832 \|. 56 push esi 10003833 \|. 57 push edi 10003834 \|. 8B3D 84640010 mov edi, dword ptr [10006484] ; pjgl.10006480 1000383A \|> 837F 10 FF /cmp dword ptr [edi+10], -1 1000383E \|. 0F84 A0000000 \|je 100038E4 10003844 \|. 33ED \|xor ebp, ebp 10003846 \|. 8DB7 10200000 \|lea esi, dword ptr [edi+2010] 1000384C \|. BB 00F03F00 \|mov ebx, 3FF000 10003851 \|> 813E F0000000 \|/cmp dword ptr [esi], 0F0 10003857 \|. 75 47 \|\|jnz short 100038A0 10003859 \|. 8B47 10 \|\|mov eax, dword ptr [edi+10] 1000385C \|. 68 00400000 \|\|push 4000 ; /FreeType = MEM_DECOMMIT 10003861 \|. 03C3 \|\|add eax, ebx ; \| 10003863 \|. 68 00100000 \|\|push 1000 ; \|Size = 1000 (4096.) 10003868 \|. 50 \|\|push eax ; \|Address 10003869 \|. FF15 50500010 \|\|call dword ptr [<&KERNEL32.VirtualF>; \VirtualFree 1000386F \|. 85C0 \|\|test eax, eax 10003871 \|. 74 2D \|\|je short 100038A0 10003873 \|. C706 FFFFFFFF \|\|mov dword ptr [esi], -1 10003879 \|. 8B15 78880010 \|\|mov edx, dword ptr [10008878] 1000387F \|. 4A \|\|dec edx 10003880 \|. 8915 78880010 \|\|mov dword ptr [10008878], edx 10003886 \|. 8B47 0C \|\|mov eax, dword ptr [edi+C] 10003889 \|. 85C0 \|\|test eax, eax 1000388B \|. 74 04 \|\|je short 10003891 1000388D \|. 3BC6 \|\|cmp eax, esi 1000388F \|. 76 03 \|\|jbe short 10003894 10003891 \|> 8977 0C \|\|mov dword ptr [edi+C], esi 10003894 \|> 8B4424 14 \|\|mov eax, dword ptr [esp+14] 10003898 \|. 45 \|\|inc ebp 10003899 \|. 48 \|\|dec eax 1000389A \|. 894424 14 \|\|mov dword ptr [esp+14], eax 1000389E \|. 74 0D \|\|je short 100038AD 100038A0 \|> 81EB 00100000 \|\|sub ebx, 1000 100038A6 \|. 83EE 08 \|\|sub esi, 8 100038A9 \|. 85DB \|\|test ebx, ebx 100038AB \|.^ 7D A4 \|\jge short 10003851 100038AD \|> 8BD7 \|mov edx, edi 100038AF \|. 8B7F 04 \|mov edi, dword ptr [edi+4] 100038B2 \|. 85ED \|test ebp, ebp 100038B4 \|. 74 2E \|je short 100038E4 100038B6 \|. 837A 18 FF \|cmp dword ptr [edx+18], -1 100038BA \|. 75 28 \|jnz short 100038E4 100038BC \|. B8 01000000 \|mov eax, 1 100038C1 \|. 8D4A 20 \|lea ecx, dword ptr [edx+20] 100038C4 \|> 8339 FF \|/cmp dword ptr [ecx], -1 100038C7 \|. 75 0B \|\|jnz short 100038D4 100038C9 \|. 40 \|\|inc eax 100038CA \|. 83C1 08 \|\|add ecx, 8 100038CD \|. 3D 00040000 \|\|cmp eax, 400 100038D2 \|.^ 7C F0 \|\jl short 100038C4 100038D4 \|> 3D 00040000 \|cmp eax, 400 100038D9 \|. 75 09 \|jnz short 100038E4 100038DB \|. 52 \|push edx 100038DC \|. E8 EFFEFFFF \|call 100037D0 100038E1 \|. 83C4 04 \|add esp, 4 100038E4 \|> 3B3D 84640010 \|cmp edi, dword ptr [10006484] ; pjgl.10006480 100038EA \|. 74 0C \|je short 100038F8 100038EC \|. 8B4424 14 \|mov eax, dword ptr [esp+14] 100038F0 \|. 85C0 \|test eax, eax 100038F2 \|.^ 0F8F 42FFFFFF \jg 1000383A 100038F8 \|> 5F pop edi 100038F9 \|. 5E pop esi 100038FA \|. 5D pop ebp 100038FB \|. 5B pop ebx 100038FC \. C3 retn 100038FD 90 nop 100038FE 90 nop 100038FF 90 nop 10003900 /$ 8B4C24 04 mov ecx, dword ptr [esp+4] 10003904 \|. B8 80640010 mov eax, 10006480 10003909 \|> 3B48 10 /cmp ecx, dword ptr [eax+10] 1000390C \|. 76 05 \|jbe short 10003913 1000390E \|. 3B48 14 \|cmp ecx, dword ptr [eax+14] 10003911 \|. 72 0B \|jb short 1000391E 10003913 \|> 8B00 \|mov eax, dword ptr [eax] 10003915 \|. 3D 80640010 \|cmp eax, 10006480 1000391A \|. 74 3A \|je short 10003956 1000391C \|.^ EB EB \jmp short 10003909 1000391E \|> F6C1 0F test cl, 0F 10003921 \|. 75 33 jnz short 10003956 10003923 \|. 8BD1 mov edx, ecx 10003925 \|. 81E2 FF0F0000 and edx, 0FFF 1000392B \|. 81FA 00010000 cmp edx, 100 10003931 \|. 72 23 jb short 10003956 10003933 \|. 8B5424 08 mov edx, dword ptr [esp+8] 10003937 \|. 8902 mov dword ptr [edx], eax 10003939 \|. 8B5424 0C mov edx, dword ptr [esp+C] 1000393D \|. 8BC1 mov eax, ecx 1000393F \|. 25 00F0FFFF and eax, FFFFF000 10003944 \|. 2BC8 sub ecx, eax 10003946 \|. 8902 mov dword ptr [edx], eax 10003948 \|. 81E9 00010000 sub ecx, 100 1000394E \|. C1F9 04 sar ecx, 4 10003951 \|. 8D4401 08 lea eax, dword ptr [ecx+eax+8] 10003955 \|. C3 retn 10003956 \|> 33C0 xor eax, eax 10003958 \. C3 retn 10003959 90 nop 1000395A 90 nop 1000395B 90 nop 1000395C 90 nop 1000395D 90 nop 1000395E 90 nop 1000395F 90 nop 10003960 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10003964 \|. 8B4C24 08 mov ecx, dword ptr [esp+8] 10003968 \|. 56 push esi 10003969 \|. 33D2 xor edx, edx 1000396B \|. 2B48 10 sub ecx, dword ptr [eax+10] 1000396E \|. C1F9 0C sar ecx, 0C 10003971 \|. 8B74C8 18 mov esi, dword ptr [eax+ecx8+18] 10003975 \|. 8D44C8 18 lea eax, dword ptr [eax+ecx*8+18] 10003979 \|. 8B4C24 10 mov ecx, dword ptr [esp+10] 1000397D \|. 8A11 mov dl, byte ptr [ecx] 1000397F \|. 03F2 add esi, edx 10003981 \|. 8930 mov dword ptr [eax], esi 10003983 \|. C601 00 mov byte ptr [ecx], 0 10003986 \|. 8B08 mov ecx, dword ptr [eax] 10003988 \|. C740 04 F1000>mov dword ptr [eax+4], 0F1 1000398F \|. 81F9 F0000000 cmp ecx, 0F0 10003995 \|. 75 1A jnz short 100039B1 10003997 \|. A1 78880010 mov eax, dword ptr [10008878] 1000399C \|. 40 inc eax 1000399D \|. 83F8 20 cmp eax, 20 100039A0 \|. A3 78880010 mov dword ptr [10008878], eax 100039A5 \|. 75 0A jnz short 100039B1 100039A7 \|. 6A 10 push 10 100039A9 \|. E8 82FEFFFF call 10003830 100039AE \|. 83C4 04 add esp, 4 100039B1 \|> 5E pop esi 100039B2 \. C3 retn 100039B3 90 nop 100039B4 90 nop 100039B5 90 nop 100039B6 90 nop 100039B7 90 nop 100039B8 90 nop 100039B9 90 nop 100039BA 90 nop 100039BB 90 nop 2009-4-1 23:06 0
longdf 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 8 粉丝 0 关注私信	longdf 3 楼 100039BC 90 nop 100039BD 90 nop 100039BE 90 nop 100039BF 90 nop 100039C0 /$ 51 push ecx 100039C1 \|. 8B0D A0840010 mov ecx, dword ptr [100084A0] ; pjgl.10006480 100039C7 \|. 53 push ebx 100039C8 \|. 8B5C24 0C mov ebx, dword ptr [esp+C] 100039CC \|. 55 push ebp 100039CD \|. 56 push esi 100039CE \|. 57 push edi 100039CF \|. 894C24 10 mov dword ptr [esp+10], ecx 100039D3 \|> 8B41 10 /mov eax, dword ptr [ecx+10] 100039D6 \|. 83F8 FF \|cmp eax, -1 100039D9 \|. 0F84 85000000 \|je 10003A64 100039DF \|. 8B79 08 \|mov edi, dword ptr [ecx+8] 100039E2 \|. 8DA9 18200000 \|lea ebp, dword ptr [ecx+2018] 100039E8 \|. 8BF7 \|mov esi, edi 100039EA \|. 2BF1 \|sub esi, ecx 100039EC \|. 83EE 18 \|sub esi, 18 100039EF \|. C1FE 03 \|sar esi, 3 100039F2 \|. C1E6 0C \|shl esi, 0C 100039F5 \|. 03F0 \|add esi, eax 100039F7 \|. 3BFD \|cmp edi, ebp 100039F9 \|. 73 2E \|jnb short 10003A29 100039FB \|> 8B07 \|/mov eax, dword ptr [edi] 100039FD \|. 3BC3 \|\|cmp eax, ebx 100039FF \|. 7C 1B \|\|jl short 10003A1C 10003A01 \|. 395F 04 \|\|cmp dword ptr [edi+4], ebx 10003A04 \|. 76 16 \|\|jbe short 10003A1C 10003A06 \|. 53 \|\|push ebx 10003A07 \|. 50 \|\|push eax 10003A08 \|. 56 \|\|push esi 10003A09 \|. E8 F2010000 \|\|call 10003C00 10003A0E \|. 83C4 0C \|\|add esp, 0C 10003A11 \|. 85C0 \|\|test eax, eax 10003A13 \|. 75 63 \|\|jnz short 10003A78 10003A15 \|. 8B4C24 10 \|\|mov ecx, dword ptr [esp+10] 10003A19 \|. 895F 04 \|\|mov dword ptr [edi+4], ebx 10003A1C \|> 83C7 08 \|\|add edi, 8 10003A1F \|. 81C6 00100000 \|\|add esi, 1000 10003A25 \|. 3BFD \|\|cmp edi, ebp 10003A27 \|.^ 72 D2 \|\jb short 100039FB 10003A29 \|> 8B69 08 \|mov ebp, dword ptr [ecx+8] 10003A2C \|. 8B79 10 \|mov edi, dword ptr [ecx+10] 10003A2F \|. 8D71 18 \|lea esi, dword ptr [ecx+18] 10003A32 \|. 3BF5 \|cmp esi, ebp 10003A34 \|. 73 2E \|jnb short 10003A64 10003A36 \|> 8B06 \|/mov eax, dword ptr [esi] 10003A38 \|. 3BC3 \|\|cmp eax, ebx 10003A3A \|. 7C 1B \|\|jl short 10003A57 10003A3C \|. 395E 04 \|\|cmp dword ptr [esi+4], ebx 10003A3F \|. 76 16 \|\|jbe short 10003A57 10003A41 \|. 53 \|\|push ebx 10003A42 \|. 50 \|\|push eax 10003A43 \|. 57 \|\|push edi 10003A44 \|. E8 B7010000 \|\|call 10003C00 10003A49 \|. 83C4 0C \|\|add esp, 0C 10003A4C \|. 85C0 \|\|test eax, eax 10003A4E \|. 75 41 \|\|jnz short 10003A91 10003A50 \|. 8B4C24 10 \|\|mov ecx, dword ptr [esp+10] 10003A54 \|. 895E 04 \|\|mov dword ptr [esi+4], ebx 10003A57 \|> 83C6 08 \|\|add esi, 8 10003A5A \|. 81C7 00100000 \|\|add edi, 1000 10003A60 \|. 3BF5 \|\|cmp esi, ebp 10003A62 \|.^ 72 D2 \|\jb short 10003A36 10003A64 \|> 8B09 \|mov ecx, dword ptr [ecx] 10003A66 \|. A1 A0840010 \|mov eax, dword ptr [100084A0] 10003A6B \|. 3BC8 \|cmp ecx, eax 10003A6D \|. 894C24 10 \|mov dword ptr [esp+10], ecx 10003A71 \|. 74 37 \|je short 10003AAA 10003A73 \|.^ E9 5BFFFFFF \jmp 100039D3 10003A78 \|> 8B4C24 10 mov ecx, dword ptr [esp+10] 10003A7C \|. 890D A0840010 mov dword ptr [100084A0], ecx 10003A82 \|. 8B17 mov edx, dword ptr [edi] 10003A84 \|. 2BD3 sub edx, ebx 10003A86 \|. 8917 mov dword ptr [edi], edx 10003A88 \|. 8979 08 mov dword ptr [ecx+8], edi 10003A8B \|. 5F pop edi 10003A8C \|. 5E pop esi 10003A8D \|. 5D pop ebp 10003A8E \|. 5B pop ebx 10003A8F \|. 59 pop ecx 10003A90 \|. C3 retn 10003A91 \|> 8B4C24 10 mov ecx, dword ptr [esp+10] 10003A95 \|. 890D A0840010 mov dword ptr [100084A0], ecx 10003A9B \|. 8B16 mov edx, dword ptr [esi] 10003A9D \|. 2BD3 sub edx, ebx 10003A9F \|. 8916 mov dword ptr [esi], edx 10003AA1 \|. 8971 08 mov dword ptr [ecx+8], esi 10003AA4 \|. 5F pop edi 10003AA5 \|. 5E pop esi 10003AA6 \|. 5D pop ebp 10003AA7 \|. 5B pop ebx 10003AA8 \|. 59 pop ecx 10003AA9 \|. C3 retn 10003AAA \|> BD 80640010 mov ebp, 10006480 10003AAF \|. 83C9 FF or ecx, FFFFFFFF 10003AB2 \|> 394D 10 /cmp dword ptr [ebp+10], ecx 10003AB5 \|. 74 07 \|je short 10003ABE 10003AB7 \|. 8B45 0C \|mov eax, dword ptr [ebp+C] 10003ABA \|. 85C0 \|test eax, eax 10003ABC \|. 75 11 \|jnz short 10003ACF 10003ABE \|> 8B6D 00 \|mov ebp, dword ptr [ebp] 10003AC1 \|. 81FD 80640010 \|cmp ebp, 10006480 10003AC7 \|. 0F84 E0000000 \|je 10003BAD 10003ACD \|.^ EB E3 \jmp short 10003AB2 10003ACF \|> 8B45 0C mov eax, dword ptr [ebp+C] 10003AD2 \|. 8B75 10 mov esi, dword ptr [ebp+10] 10003AD5 \|. 8BF8 mov edi, eax 10003AD7 \|. 894424 18 mov dword ptr [esp+18], eax 10003ADB \|. 2BFD sub edi, ebp 10003ADD \|. 8B10 mov edx, dword ptr [eax] 10003ADF \|. 83EF 18 sub edi, 18 10003AE2 \|. C1FF 03 sar edi, 3 10003AE5 \|. C1E7 0C shl edi, 0C 10003AE8 \|. 03FE add edi, esi 10003AEA \|. 33F6 xor esi, esi 10003AEC \|. 3BD1 cmp edx, ecx 10003AEE \|. 75 10 jnz short 10003B00 10003AF0 \|> 83FE 10 /cmp esi, 10 10003AF3 \|. 7D 0B \|jge short 10003B00 10003AF5 \|. 8B50 08 \|mov edx, dword ptr [eax+8] 10003AF8 \|. 83C0 08 \|add eax, 8 10003AFB \|. 46 \|inc esi 10003AFC \|. 3BD1 \|cmp edx, ecx 10003AFE \|.^ 74 F0 \je short 10003AF0 10003B00 \|> 8BC6 mov eax, esi 10003B02 \|. 6A 04 push 4 ; /Protect = PAGE_READWRITE 10003B04 \|. C1E0 0C shl eax, 0C ; \| 10003B07 \|. 68 00100000 push 1000 ; \|AllocationType = MEM_COMMIT 10003B0C \|. 50 push eax ; \|Size 10003B0D \|. 57 push edi ; \|Address 10003B0E \|. 894424 20 mov dword ptr [esp+20], eax ; \| 10003B12 \|. FF15 88500010 call dword ptr [<&KERNEL32.VirtualAll>; \VirtualAlloc 10003B18 \|. 3BC7 cmp eax, edi 10003B1A \|. 0F85 CB000000 jnz 10003BEB 10003B20 \|. 8B5424 18 mov edx, dword ptr [esp+18] 10003B24 \|. 8B4424 10 mov eax, dword ptr [esp+10] 10003B28 \|. 33C9 xor ecx, ecx 10003B2A \|. 85F6 test esi, esi 10003B2C \|. 8BCA mov ecx, edx 10003B2E \|. 7E 32 jle short 10003B62 10003B30 \|. 8D47 04 lea eax, dword ptr [edi+4] 10003B33 \|> 8D50 04 /lea edx, dword ptr [eax+4] 10003B36 \|. C700 F0000000 \|mov dword ptr [eax], 0F0 10003B3C \|. 8950 FC \|mov dword ptr [eax-4], edx 10003B3F \|. C680 F4000000>\|mov byte ptr [eax+F4], 0FF 10003B46 \|. C701 F0000000 \|mov dword ptr [ecx], 0F0 10003B4C \|. C741 04 F1000>\|mov dword ptr [ecx+4], 0F1 10003B53 \|. 05 00100000 \|add eax, 1000 10003B58 \|. 83C1 08 \|add ecx, 8 10003B5B \|. 4E \|dec esi 10003B5C \|.^ 75 D5 \jnz short 10003B33 10003B5E \|. 8B5424 18 mov edx, dword ptr [esp+18] 10003B62 \|> 8D85 18200000 lea eax, dword ptr [ebp+2018] 10003B68 \|. 892D A0840010 mov dword ptr [100084A0], ebp 10003B6E \|. 3BC8 cmp ecx, eax 10003B70 \|. 73 0E jnb short 10003B80 10003B72 \|> 8339 FF /cmp dword ptr [ecx], -1 10003B75 \|. 74 07 \|je short 10003B7E 10003B77 \|. 83C1 08 \|add ecx, 8 10003B7A \|. 3BC8 \|cmp ecx, eax 10003B7C \|.^ 72 F4 \jb short 10003B72 10003B7E \|> 3BC8 cmp ecx, eax 10003B80 \|> 1BC0 sbb eax, eax 10003B82 \|. 23C1 and eax, ecx 10003B84 \|. 8945 0C mov dword ptr [ebp+C], eax 10003B87 \|. 885F 08 mov byte ptr [edi+8], bl 10003B8A \|. 8955 08 mov dword ptr [ebp+8], edx 10003B8D \|. 8B0A mov ecx, dword ptr [edx] 10003B8F \|. 2BCB sub ecx, ebx 10003B91 \|. 890A mov dword ptr [edx], ecx 10003B93 \|. 8B47 04 mov eax, dword ptr [edi+4] 10003B96 \|. 2BC3 sub eax, ebx 10003B98 \|. 8D4C1F 08 lea ecx, dword ptr [edi+ebx+8] 10003B9C \|. 8947 04 mov dword ptr [edi+4], eax 10003B9F \|. 890F mov dword ptr [edi], ecx 10003BA1 \|. 8D87 00010000 lea eax, dword ptr [edi+100] 10003BA7 \|. 5F pop edi 10003BA8 \|. 5E pop esi 10003BA9 \|. 5D pop ebp 10003BAA \|. 5B pop ebx 10003BAB \|. 59 pop ecx 10003BAC \|. C3 retn 10003BAD \|> E8 AEFAFFFF call 10003660 10003BB2 \|. 85C0 test eax, eax 10003BB4 \|. 74 35 je short 10003BEB 10003BB6 \|. 8B48 10 mov ecx, dword ptr [eax+10] 10003BB9 \|. 8859 08 mov byte ptr [ecx+8], bl 10003BBC \|. 8D5419 08 lea edx, dword ptr [ecx+ebx+8] 10003BC0 \|. A3 A0840010 mov dword ptr [100084A0], eax 10003BC5 \|. 8911 mov dword ptr [ecx], edx 10003BC7 \|. BA F0000000 mov edx, 0F0 10003BCC \|. 2BD3 sub edx, ebx 10003BCE \|. 81E3 FF000000 and ebx, 0FF 10003BD4 \|. 8951 04 mov dword ptr [ecx+4], edx 10003BD7 \|. 8B50 18 mov edx, dword ptr [eax+18] 10003BDA \|. 2BD3 sub edx, ebx 10003BDC \|. 8950 18 mov dword ptr [eax+18], edx 10003BDF \|. 8D81 00010000 lea eax, dword ptr [ecx+100] 10003BE5 \|. 5F pop edi 10003BE6 \|. 5E pop esi 10003BE7 \|. 5D pop ebp 10003BE8 \|. 5B pop ebx 10003BE9 \|. 59 pop ecx 10003BEA \|. C3 retn 10003BEB \|> 5F pop edi 10003BEC \|. 5E pop esi 10003BED \|. 5D pop ebp 10003BEE \|. 33C0 xor eax, eax 10003BF0 \|. 5B pop ebx 10003BF1 \|. 59 pop ecx 10003BF2 \. C3 retn 10003BF3 90 nop 10003BF4 90 nop 10003BF5 90 nop 10003BF6 90 nop 10003BF7 90 nop 10003BF8 90 nop 10003BF9 90 nop 10003BFA 90 nop 10003BFB 90 nop 10003BFC 90 nop 10003BFD 90 nop 10003BFE 90 nop 10003BFF 90 nop 10003C00 /$ 8B5424 0C mov edx, dword ptr [esp+C] 10003C04 \|. 53 push ebx 10003C05 \|. 55 push ebp 10003C06 \|. 56 push esi 10003C07 \|. 57 push edi 10003C08 \|. 8B7C24 14 mov edi, dword ptr [esp+14] 10003C0C \|. 8B47 04 mov eax, dword ptr [edi+4] 10003C0F \|. 8B0F mov ecx, dword ptr [edi] 10003C11 \|. 3BC2 cmp eax, edx 10003C13 \|. 894C24 14 mov dword ptr [esp+14], ecx 10003C17 \|. 8BF1 mov esi, ecx 10003C19 \|. 8D9F F8000000 lea ebx, dword ptr [edi+F8] 10003C1F \|. 72 3A jb short 10003C5B 10003C21 \|. 8D0411 lea eax, dword ptr [ecx+edx] 10003C24 \|. 8811 mov byte ptr [ecx], dl 10003C26 \|. 3BC3 cmp eax, ebx 10003C28 \|. 73 10 jnb short 10003C3A 10003C2A \|. 8B37 mov esi, dword ptr [edi] 10003C2C \|. 8B47 04 mov eax, dword ptr [edi+4] 10003C2F \|. 03F2 add esi, edx 10003C31 \|. 2BC2 sub eax, edx 10003C33 \|. 8937 mov dword ptr [edi], esi 10003C35 \|. 8947 04 mov dword ptr [edi+4], eax 10003C38 \|. EB 0C jmp short 10003C46 10003C3A \|> 8D57 08 lea edx, dword ptr [edi+8] 10003C3D \|. C747 04 00000>mov dword ptr [edi+4], 0 10003C44 \|. 8917 mov dword ptr [edi], edx 10003C46 \|> 8D047F lea eax, dword ptr [edi+edi2] 10003C49 \|. 8D0480 lea eax, dword ptr [eax+eax4] 10003C4C \|. 8BD0 mov edx, eax 10003C4E \|. 8D41 08 lea eax, dword ptr [ecx+8] 10003C51 \|. C1E0 04 shl eax, 4 10003C54 \|. 2BC2 sub eax, edx 10003C56 \|. 5F pop edi 10003C57 \|. 5E pop esi 10003C58 \|. 5D pop ebp 10003C59 \|. 5B pop ebx 10003C5A \|. C3 retn 10003C5B \|> 03C1 add eax, ecx 10003C5D \|. 8038 00 cmp byte ptr [eax], 0 10003C60 \|. 74 02 je short 10003C64 10003C62 \|. 8BF0 mov esi, eax 10003C64 \|> 8D0416 lea eax, dword ptr [esi+edx] 10003C67 \|. 3BC3 cmp eax, ebx 10003C69 \|. 8B5C24 18 mov ebx, dword ptr [esp+18] 10003C6D \|. 73 75 jnb short 10003CE4 10003C6F \|> 8A06 /mov al, byte ptr [esi] 10003C71 \|. 84C0 \|test al, al 10003C73 \|. 75 3C \|jnz short 10003CB1 10003C75 \|. 807E 01 00 \|cmp byte ptr [esi+1], 0 10003C79 \|. 8D46 01 \|lea eax, dword ptr [esi+1] 10003C7C \|. B9 01000000 \|mov ecx, 1 10003C81 \|. 75 07 \|jnz short 10003C8A 10003C83 \|> 40 \|/inc eax 10003C84 \|. 41 \|\|inc ecx 10003C85 \|. 8038 00 \|\|cmp byte ptr [eax], 0 10003C88 \|.^ 74 F9 \|\je short 10003C83 10003C8A \|> 3BCA \|cmp ecx, edx 10003C8C \|. 73 39 \|jnb short 10003CC7 10003C8E \|. 8B6C24 14 \|mov ebp, dword ptr [esp+14] 10003C92 \|. 3BF5 \|cmp esi, ebp 10003C94 \|. 75 09 \|jnz short 10003C9F 10003C96 \|. 894F 04 \|mov dword ptr [edi+4], ecx 10003C99 \|. 8BF0 \|mov esi, eax 10003C9B \|. 8BCD \|mov ecx, ebp 10003C9D \|. EB 19 \|jmp short 10003CB8 10003C9F \|> 2BD9 \|sub ebx, ecx 10003CA1 \|. 3BDA \|cmp ebx, edx 10003CA3 \|. 0F82 C2000000 \|jb 10003D6B 10003CA9 \|. 8B4C24 14 \|mov ecx, dword ptr [esp+14] 10003CAD \|. 8BF0 \|mov esi, eax 10003CAF \|. EB 07 \|jmp short 10003CB8 10003CB1 \|> 25 FF000000 \|and eax, 0FF 10003CB6 \|. 03F0 \|add esi, eax 10003CB8 \|> 8D2C16 \|lea ebp, dword ptr [esi+edx] 10003CBB \|. 8D87 F8000000 \|lea eax, dword ptr [edi+F8] 10003CC1 \|. 3BE8 \|cmp ebp, eax 10003CC3 \|.^ 72 AA \jb short 10003C6F 10003CC5 \|. EB 1D jmp short 10003CE4 10003CC7 \|> 8D0416 lea eax, dword ptr [esi+edx] 10003CCA \|. 8D9F F8000000 lea ebx, dword ptr [edi+F8] 10003CD0 \|. 3BC3 cmp eax, ebx 10003CD2 \|. 73 09 jnb short 10003CDD 10003CD4 \|. 2BCA sub ecx, edx 10003CD6 \|. 8907 mov dword ptr [edi], eax 10003CD8 \|. 894F 04 mov dword ptr [edi+4], ecx 10003CDB \|. EB 79 jmp short 10003D56 10003CDD \|> 8D4F 08 lea ecx, dword ptr [edi+8] 10003CE0 \|. 890F mov dword ptr [edi], ecx 10003CE2 \|. EB 6B jmp short 10003D4F 10003CE4 \|> 8D6F 08 lea ebp, dword ptr [edi+8] 10003CE7 \|. 8BF5 mov esi, ebp 10003CE9 \|. 3BF1 cmp esi, ecx 10003CEB \|. 73 7E jnb short 10003D6B 10003CED \|> 8D0C16 /lea ecx, dword ptr [esi+edx] 10003CF0 \|. 8D87 F8000000 \|lea eax, dword ptr [edi+F8] 10003CF6 \|. 3BC8 \|cmp ecx, eax 10003CF8 \|. 73 71 \|jnb short 10003D6B 10003CFA \|. 8A06 \|mov al, byte ptr [esi] 10003CFC \|. 84C0 \|test al, al 10003CFE \|. 75 23 \|jnz short 10003D23 10003D00 \|. 807E 01 00 \|cmp byte ptr [esi+1], 0 10003D04 \|. 8D46 01 \|lea eax, dword ptr [esi+1] 10003D07 \|. B9 01000000 \|mov ecx, 1 10003D0C \|. 75 07 \|jnz short 10003D15 10003D0E \|> 40 \|/inc eax 10003D0F \|. 41 \|\|inc ecx 10003D10 \|. 8038 00 \|\|cmp byte ptr [eax], 0 10003D13 \|.^ 74 F9 \|\je short 10003D0E 10003D15 \|> 3BCA \|cmp ecx, edx 10003D17 \|. 73 1E \|jnb short 10003D37 10003D19 \|. 2BD9 \|sub ebx, ecx 10003D1B \|. 3BDA \|cmp ebx, edx 10003D1D \|. 72 4C \|jb short 10003D6B 10003D1F \|. 8BF0 \|mov esi, eax 10003D21 \|. EB 07 \|jmp short 10003D2A 10003D23 \|> 25 FF000000 \|and eax, 0FF 10003D28 \|. 03F0 \|add esi, eax 10003D2A \|> 3B7424 14 \|cmp esi, dword ptr [esp+14] 10003D2E \|.^ 72 BD \jb short 10003CED 10003D30 \|. 33C0 xor eax, eax 10003D32 \|. 5F pop edi 10003D33 \|. 5E pop esi 10003D34 \|. 5D pop ebp 10003D35 \|. 5B pop ebx 10003D36 \|. C3 retn 10003D37 \|> 8D0416 lea eax, dword ptr [esi+edx] 10003D3A \|. 8D9F F8000000 lea ebx, dword ptr [edi+F8] 10003D40 \|. 3BC3 cmp eax, ebx 10003D42 \|. 73 09 jnb short 10003D4D 10003D44 \|. 2BCA sub ecx, edx 10003D46 \|. 8907 mov dword ptr [edi], eax 10003D48 \|. 894F 04 mov dword ptr [edi+4], ecx 10003D4B \|. EB 09 jmp short 10003D56 10003D4D \|> 892F mov dword ptr [edi], ebp 10003D4F \|> C747 04 00000>mov dword ptr [edi+4], 0 10003D56 \|> 8D047F lea eax, dword ptr [edi+edi2] 10003D59 \|. 8816 mov byte ptr [esi], dl 10003D5B \|. 8D1480 lea edx, dword ptr [eax+eax4] 10003D5E \|. 8D46 08 lea eax, dword ptr [esi+8] 10003D61 \|. C1E0 04 shl eax, 4 10003D64 \|. 2BC2 sub eax, edx 10003D66 \|. 5F pop edi 10003D67 \|. 5E pop esi 10003D68 \|. 5D pop ebp 10003D69 \|. 5B pop ebx 10003D6A \|. C3 retn 10003D6B \|> 5F pop edi 10003D6C \|. 5E pop esi 10003D6D \|. 5D pop ebp 10003D6E \|. 33C0 xor eax, eax 10003D70 \|. 5B pop ebx 10003D71 \. C3 retn 10003D72 90 nop 10003D73 90 nop 10003D74 90 nop 10003D75 90 nop 10003D76 90 nop 10003D77 90 nop 10003D78 90 nop 10003D79 90 nop 10003D7A 90 nop 10003D7B 90 nop 10003D7C 90 nop 10003D7D 90 nop 10003D7E 90 nop 10003D7F 90 nop 10003D80 /$ A1 7C880010 mov eax, dword ptr [1000887C] 10003D85 \|. 53 push ebx 10003D86 \|. 33DB xor ebx, ebx 10003D88 \|. 56 push esi 10003D89 \|. 85C0 test eax, eax 10003D8B \|. 57 push edi 10003D8C \|. 75 42 jnz short 10003DD0 10003D8E \|. 68 D4530010 push 100053D4 ; /FileName = "user32.dll" 10003D93 \|. FF15 70500010 call dword ptr [<&KERNEL32.LoadLibrar>; \LoadLibraryA 10003D99 \|. 8BF0 mov esi, eax 10003D9B \|. 85F6 test esi, esi 10003D9D \|. 74 6A je short 10003E09 10003D9F \|. 8B3D 8C500010 mov edi, dword ptr [<&KERNEL32.GetPr>; kernel32.GetProcAddress 10003DA5 \|. 68 C8530010 push 100053C8 ; /ProcNameOrOrdinal = "MessageBoxA" 10003DAA \|. 56 push esi ; \|hModule 10003DAB \|. FFD7 call edi ; \GetProcAddress 10003DAD \|. 85C0 test eax, eax 10003DAF \|. A3 7C880010 mov dword ptr [1000887C], eax 10003DB4 \|. 74 53 je short 10003E09 10003DB6 \|. 68 B8530010 push 100053B8 ; /ProcNameOrOrdinal = "GetActiveWindow" 10003DBB \|. 56 push esi ; \|hModule 10003DBC \|. FFD7 call edi ; \GetProcAddress 10003DBE \|. 68 A4530010 push 100053A4 ; /ProcNameOrOrdinal = "GetLastActivePopup" 10003DC3 \|. 56 push esi ; \|hModule 10003DC4 \|. A3 80880010 mov dword ptr [10008880], eax ; \| 10003DC9 \|. FFD7 call edi ; \GetProcAddress 10003DCB \|. A3 84880010 mov dword ptr [10008884], eax 10003DD0 \|> A1 80880010 mov eax, dword ptr [10008880] 10003DD5 \|. 85C0 test eax, eax 10003DD7 \|. 74 04 je short 10003DDD 10003DD9 \|. FFD0 call eax 10003DDB \|. 8BD8 mov ebx, eax 10003DDD \|> 85DB test ebx, ebx 10003DDF \|. 74 0E je short 10003DEF 10003DE1 \|. A1 84880010 mov eax, dword ptr [10008884] 10003DE6 \|. 85C0 test eax, eax 10003DE8 \|. 74 05 je short 10003DEF 10003DEA \|. 53 push ebx 10003DEB \|. FFD0 call eax 10003DED \|. 8BD8 mov ebx, eax 10003DEF \|> 8B4424 18 mov eax, dword ptr [esp+18] 10003DF3 \|. 8B4C24 14 mov ecx, dword ptr [esp+14] 10003DF7 \|. 8B5424 10 mov edx, dword ptr [esp+10] 10003DFB \|. 50 push eax 10003DFC \|. 51 push ecx 10003DFD \|. 52 push edx 10003DFE \|. 53 push ebx 10003DFF \|. FF15 7C880010 call dword ptr [1000887C] 10003E05 \|. 5F pop edi 10003E06 \|. 5E pop esi 10003E07 \|. 5B pop ebx 10003E08 \|. C3 retn 10003E09 \|> 5F pop edi 10003E0A \|. 5E pop esi 10003E0B \|. 33C0 xor eax, eax 10003E0D \|. 5B pop ebx 10003E0E \. C3 retn 10003E0F 90 nop 10003E10 . 55 push ebp 10003E11 . 8BEC mov ebp, esp 10003E13 . 57 push edi 10003E14 . 56 push esi 10003E15 . 8B75 0C mov esi, dword ptr [ebp+C] 10003E18 . 8B4D 10 mov ecx, dword ptr [ebp+10] 10003E1B . 8B7D 08 mov edi, dword ptr [ebp+8] 10003E1E . 8BC1 mov eax, ecx 10003E20 . 8BD1 mov edx, ecx 10003E22 . 03C6 add eax, esi 10003E24 . 3BFE cmp edi, esi 10003E26 . 76 08 jbe short 10003E30 10003E28 . 3BF8 cmp edi, eax 10003E2A . 0F82 78010000 jb 10003FA8 10003E30 > F7C7 03000000 test edi, 3 10003E36 . 75 14 jnz short 10003E4C 10003E38 . C1E9 02 shr ecx, 2 10003E3B . 83E2 03 and edx, 3 10003E3E . 83F9 08 cmp ecx, 8 10003E41 . 72 29 jb short 10003E6C 10003E43 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003E45 . FF2495 583F00>jmp dword ptr [edx4+10003F58] 10003E4C > 8BC7 mov eax, edi 10003E4E . BA 03000000 mov edx, 3 10003E53 . 83E9 04 sub ecx, 4 10003E56 . 72 0C jb short 10003E64 10003E58 . 83E0 03 and eax, 3 10003E5B . 03C8 add ecx, eax 10003E5D . FF2485 703E00>jmp dword ptr [eax4+10003E70] 10003E64 > FF248D 683F00>jmp dword ptr [ecx4+10003F68] 10003E6B 90 nop 10003E6C > FF248D EC3E00>jmp dword ptr [ecx4+10003EEC] 10003E73 90 nop 10003E74 . 803E0010 dd pjgl.10003E80 ; 分支表 (1-based) 被用于 10003E5D 10003E78 . AC3E0010 dd pjgl.10003EAC 10003E7C . D03E0010 dd pjgl.10003ED0 10003E80 > 23D1 and edx, ecx 10003E82 . 8A06 mov al, byte ptr [esi] 10003E84 . 8807 mov byte ptr [edi], al 10003E86 . 8A46 01 mov al, byte ptr [esi+1] 10003E89 . 8847 01 mov byte ptr [edi+1], al 10003E8C . 8A46 02 mov al, byte ptr [esi+2] 10003E8F . C1E9 02 shr ecx, 2 10003E92 . 8847 02 mov byte ptr [edi+2], al 10003E95 . 83C6 03 add esi, 3 10003E98 . 83C7 03 add edi, 3 10003E9B . 83F9 08 cmp ecx, 8 10003E9E .^ 72 CC jb short 10003E6C 10003EA0 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003EA2 . FF2495 583F00>jmp dword ptr [edx4+10003F58] 10003EA9 . 2E:8BC0 mov eax, eax 10003EAC > 23D1 and edx, ecx 10003EAE . 8A06 mov al, byte ptr [esi] 10003EB0 . 8807 mov byte ptr [edi], al 10003EB2 . 8A46 01 mov al, byte ptr [esi+1] 10003EB5 . C1E9 02 shr ecx, 2 10003EB8 . 8847 01 mov byte ptr [edi+1], al 10003EBB . 83C6 02 add esi, 2 10003EBE . 83C7 02 add edi, 2 10003EC1 . 83F9 08 cmp ecx, 8 10003EC4 .^ 72 A6 jb short 10003E6C 10003EC6 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003EC8 . FF2495 583F00>jmp dword ptr [edx4+10003F58] 10003ECF 90 nop 10003ED0 > 23D1 and edx, ecx 10003ED2 . 8A06 mov al, byte ptr [esi] 10003ED4 . 8807 mov byte ptr [edi], al 10003ED6 . 46 inc esi 10003ED7 . C1E9 02 shr ecx, 2 10003EDA . 47 inc edi 10003EDB . 83F9 08 cmp ecx, 8 10003EDE .^ 72 8C jb short 10003E6C 10003EE0 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003EE2 . FF2495 583F00>jmp dword ptr [edx4+10003F58] 10003EE9 2E db 2E ; CHAR '.' 10003EEA 8BC0 mov eax, eax 10003EEC . 4F3F0010 dd pjgl.10003F4F ; 分支表被用于 10003E6C 10003EF0 . 3C3F0010 dd pjgl.10003F3C 10003EF4 . 343F0010 dd pjgl.10003F34 10003EF8 . 2C3F0010 dd pjgl.10003F2C 10003EFC . 243F0010 dd pjgl.10003F24 10003F00 . 1C3F0010 dd pjgl.10003F1C 10003F04 . 143F0010 dd pjgl.10003F14 10003F08 . 0C3F0010 dd pjgl.10003F0C 10003F0C > 8B448E E4 mov eax, dword ptr [esi+ecx4-1C] 10003F10 . 89448F E4 mov dword ptr [edi+ecx4-1C], eax 10003F14 > 8B448E E8 mov eax, dword ptr [esi+ecx4-18] 10003F18 . 89448F E8 mov dword ptr [edi+ecx4-18], eax 10003F1C > 8B448E EC mov eax, dword ptr [esi+ecx4-14] 10003F20 . 89448F EC mov dword ptr [edi+ecx4-14], eax 10003F24 > 8B448E F0 mov eax, dword ptr [esi+ecx4-10] 10003F28 . 89448F F0 mov dword ptr [edi+ecx4-10], eax 10003F2C > 8B448E F4 mov eax, dword ptr [esi+ecx4-C] 10003F30 . 89448F F4 mov dword ptr [edi+ecx4-C], eax 10003F34 > 8B448E F8 mov eax, dword ptr [esi+ecx4-8] 10003F38 . 89448F F8 mov dword ptr [edi+ecx4-8], eax 10003F3C > 8B448E FC mov eax, dword ptr [esi+ecx4-4] 10003F40 . 89448F FC mov dword ptr [edi+ecx4-4], eax 10003F44 . 8D048D 000000>lea eax, dword ptr [ecx4] 10003F4B . 03F0 add esi, eax 10003F4D . 03F8 add edi, eax 10003F4F > FF2495 583F00>jmp dword ptr [edx4+10003F58] 10003F56 8BC0 mov eax, eax 10003F58 . 683F0010 dd pjgl.10003F68 ; 分支表被用于 10003EA2 10003F5C . 703F0010 dd pjgl.10003F70 10003F60 . 7C3F0010 dd pjgl.10003F7C 10003F64 . 903F0010 dd pjgl.10003F90 10003F68 > 8B45 08 mov eax, dword ptr [ebp+8] 10003F6B . 5E pop esi 10003F6C . 5F pop edi 10003F6D . C9 leave 10003F6E . C3 retn 10003F6F 90 nop 10003F70 > 8A06 mov al, byte ptr [esi] 10003F72 . 8807 mov byte ptr [edi], al 10003F74 . 8B45 08 mov eax, dword ptr [ebp+8] 10003F77 . 5E pop esi 10003F78 . 5F pop edi 10003F79 . C9 leave 10003F7A . C3 retn 10003F7B 90 nop 10003F7C > 8A06 mov al, byte ptr [esi] 10003F7E . 8807 mov byte ptr [edi], al 10003F80 . 8A46 01 mov al, byte ptr [esi+1] 10003F83 . 8847 01 mov byte ptr [edi+1], al 10003F86 . 8B45 08 mov eax, dword ptr [ebp+8] 10003F89 . 5E pop esi 10003F8A . 5F pop edi 10003F8B . C9 leave 10003F8C . C3 retn 10003F8D . 2E:8BC0 mov eax, eax 10003F90 > 8A06 mov al, byte ptr [esi] 10003F92 . 8807 mov byte ptr [edi], al 10003F94 . 8A46 01 mov al, byte ptr [esi+1] 10003F97 . 8847 01 mov byte ptr [edi+1], al 10003F9A . 8A46 02 mov al, byte ptr [esi+2] 10003F9D . 8847 02 mov byte ptr [edi+2], al 10003FA0 . 8B45 08 mov eax, dword ptr [ebp+8] 10003FA3 . 5E pop esi 10003FA4 . 5F pop edi 10003FA5 . C9 leave 10003FA6 . C3 retn 10003FA7 90 nop 10003FA8 > 8D7431 FC lea esi, dword ptr [ecx+esi-4] 10003FAC . 8D7C39 FC lea edi, dword ptr [ecx+edi-4] 10003FB0 . F7C7 03000000 test edi, 3 10003FB6 . 75 24 jnz short 10003FDC 10003FB8 . C1E9 02 shr ecx, 2 10003FBB . 83E2 03 and edx, 3 10003FBE . 83F9 08 cmp ecx, 8 10003FC1 . 72 0D jb short 10003FD0 10003FC3 . FD std 10003FC4 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003FC6 . FC cld 10003FC7 . FF2495 F04000>jmp dword ptr [edx4+100040F0] 10003FCE 8BC0 mov eax, eax 10003FD0 > F7D9 neg ecx 10003FD2 . FF248D A04000>jmp dword ptr [ecx4+100040A0] 10003FD9 . 2E:8BC0 mov eax, eax 10003FDC > 8BC7 mov eax, edi 10003FDE . BA 03000000 mov edx, 3 ; Switch (cases 0..3) 10003FE3 . 83F9 04 cmp ecx, 4 10003FE6 . 72 0C jb short 10003FF4 10003FE8 . 83E0 03 and eax, 3 ; Default case of switch 10003FDE 10003FEB . 2BC8 sub ecx, eax 10003FED . FF2485 F83F00>jmp dword ptr [eax4+10003FF8] 10003FF4 > FF248D F04000>jmp dword ptr [ecx4+100040F0] 10003FFB 90 db 90 10003FFC . 08400010 dd pjgl.10004008 ; 分支表 (1-based) 被用于 10003FED 10004000 . 28400010 dd pjgl.10004028 10004004 . 50400010 dd pjgl.10004050 10004008 > 8A46 03 mov al, byte ptr [esi+3] 1000400B . 23D1 and edx, ecx 1000400D . 8847 03 mov byte ptr [edi+3], al 10004010 . 4E dec esi 10004011 . C1E9 02 shr ecx, 2 10004014 . 4F dec edi 10004015 . 83F9 08 cmp ecx, 8 10004018 .^ 72 B6 jb short 10003FD0 1000401A . FD std 1000401B . F3:A5 rep movs dword ptr es:[edi], dword p> 1000401D . FC cld 1000401E . FF2495 F04000>jmp dword ptr [edx4+100040F0] 10004025 . 2E:8BC0 mov eax, eax 10004028 > 8A46 03 mov al, byte ptr [esi+3] 1000402B . 23D1 and edx, ecx 1000402D . 8847 03 mov byte ptr [edi+3], al 10004030 . 8A46 02 mov al, byte ptr [esi+2] 10004033 . C1E9 02 shr ecx, 2 10004036 . 8847 02 mov byte ptr [edi+2], al 10004039 . 83EE 02 sub esi, 2 1000403C . 83EF 02 sub edi, 2 1000403F . 83F9 08 cmp ecx, 8 10004042 .^ 72 8C jb short 10003FD0 10004044 . FD std 10004045 . F3:A5 rep movs dword ptr es:[edi], dword p> 10004047 . FC cld 10004048 . FF2495 F04000>jmp dword ptr [edx4+100040F0] 1000404F 90 nop 10004050 > 8A46 03 mov al, byte ptr [esi+3] 10004053 . 23D1 and edx, ecx 10004055 . 8847 03 mov byte ptr [edi+3], al 10004058 . 8A46 02 mov al, byte ptr [esi+2] 1000405B . 8847 02 mov byte ptr [edi+2], al 1000405E . 8A46 01 mov al, byte ptr [esi+1] 10004061 . C1E9 02 shr ecx, 2 10004064 . 8847 01 mov byte ptr [edi+1], al 10004067 . 83EE 03 sub esi, 3 1000406A . 83EF 03 sub edi, 3 1000406D . 83F9 08 cmp ecx, 8 10004070 .^ 0F82 5AFFFFFF jb 10003FD0 10004076 . FD std 10004077 . F3:A5 rep movs dword ptr es:[edi], dword p> 10004079 . FC cld 1000407A . FF2495 F04000>jmp dword ptr [edx4+100040F0] 10004081 2E db 2E ; CHAR '.' 10004082 8BC0 mov eax, eax 10004084 . A4400010 dd pjgl.100040A4 10004088 . AC400010 dd pjgl.100040AC 1000408C . B4400010 dd pjgl.100040B4 10004090 . BC400010 dd pjgl.100040BC 10004094 . C4400010 dd pjgl.100040C4 10004098 . CC400010 dd pjgl.100040CC 1000409C . D4400010 dd pjgl.100040D4 100040A0 . E7400010 dd pjgl.100040E7 100040A4 > 8B448E 1C mov eax, dword ptr [esi+ecx4+1C] 100040A8 . 89448F 1C mov dword ptr [edi+ecx4+1C], eax 100040AC > 8B448E 18 mov eax, dword ptr [esi+ecx4+18] 100040B0 . 89448F 18 mov dword ptr [edi+ecx4+18], eax 100040B4 > 8B448E 14 mov eax, dword ptr [esi+ecx4+14] 100040B8 . 89448F 14 mov dword ptr [edi+ecx4+14], eax 100040BC > 8B448E 10 mov eax, dword ptr [esi+ecx4+10] 100040C0 . 89448F 10 mov dword ptr [edi+ecx4+10], eax 100040C4 > 8B448E 0C mov eax, dword ptr [esi+ecx4+C] 100040C8 . 89448F 0C mov dword ptr [edi+ecx4+C], eax 100040CC > 8B448E 08 mov eax, dword ptr [esi+ecx4+8] 100040D0 . 89448F 08 mov dword ptr [edi+ecx4+8], eax 100040D4 > 8B448E 04 mov eax, dword ptr [esi+ecx4+4] 100040D8 . 89448F 04 mov dword ptr [edi+ecx4+4], eax 100040DC . 8D048D 000000>lea eax, dword ptr [ecx4] 100040E3 . 03F0 add esi, eax 100040E5 . 03F8 add edi, eax 100040E7 > FF2495 F04000>jmp dword ptr [edx4+100040F0] 100040EE 8BC0 mov eax, eax 100040F0 . 00410010 dd pjgl.10004100 ; 分支表被用于 10003FF4 100040F4 . 08410010 dd pjgl.10004108 100040F8 . 18410010 dd pjgl.10004118 100040FC . 2C410010 dd pjgl.1000412C 10004100 > 8B45 08 mov eax, dword ptr [ebp+8] ; Case 0 of switch 10003FDE 10004103 . 5E pop esi 10004104 . 5F pop edi 10004105 . C9 leave 10004106 . C3 retn 10004107 90 nop 10004108 > 8A46 03 mov al, byte ptr [esi+3] ; Case 1 of switch 10003FDE 1000410B . 8847 03 mov byte ptr [edi+3], al 1000410E . 8B45 08 mov eax, dword ptr [ebp+8] 10004111 . 5E pop esi 10004112 . 5F pop edi 10004113 . C9 leave 10004114 . C3 retn 10004115 . 2E:8BC0 mov eax, eax 10004118 > 8A46 03 mov al, byte ptr [esi+3] ; Case 2 of switch 10003FDE 1000411B . 8847 03 mov byte ptr [edi+3], al 1000411E . 8A46 02 mov al, byte ptr [esi+2] 10004121 . 8847 02 mov byte ptr [edi+2], al 10004124 . 8B45 08 mov eax, dword ptr [ebp+8] 10004127 . 5E pop esi 10004128 . 5F pop edi 10004129 . C9 leave 1000412A . C3 retn 1000412B 90 nop 1000412C > 8A46 03 mov al, byte ptr [esi+3] ; Case 3 of switch 10003FDE 1000412F . 8847 03 mov byte ptr [edi+3], al 10004132 . 8A46 02 mov al, byte ptr [esi+2] 10004135 . 8847 02 mov byte ptr [edi+2], al 10004138 . 8A46 01 mov al, byte ptr [esi+1] 1000413B . 8847 01 mov byte ptr [edi+1], al 1000413E . 8B45 08 mov eax, dword ptr [ebp+8] 10004141 . 5E pop esi 10004142 . 5F pop edi 10004143 . C9 leave 10004144 . C3 retn 10004145 CC int3 10004146 CC int3 10004147 CC int3 10004148 CC int3 10004149 CC int3 1000414A CC int3 1000414B CC int3 1000414C CC int3 1000414D CC int3 1000414E CC int3 1000414F CC int3 10004150 /$ 53 push ebx 10004151 \|. 55 push ebp 10004152 \|. 56 push esi 10004153 \|. 8B7424 14 mov esi, dword ptr [esp+14] 10004157 \|. 0FAF7424 10 imul esi, dword ptr [esp+10] 1000415C \|. 83FE E0 cmp esi, -20 ; Switch (cases 0..FFFFFFFF) 1000415F \|. 57 push edi 10004160 \|. 77 11 ja short 10004173 10004162 \|. 85F6 test esi, esi 10004164 \|. 76 08 jbe short 1000416E 10004166 \|. 83C6 0F add esi, 0F ; Default case of switch 1000415C 10004169 \|. 83E6 F0 and esi, FFFFFFF0 1000416C \|. EB 05 jmp short 10004173 1000416E \|> BE 10000000 mov esi, 10 ; Case 0 of switch 1000415C 10004173 \|> 8B1D 84500010 mov ebx, dword ptr [<&KERNEL32.HeapA>; ntdll.RtlAllocateHeap; Cases FFFFFFE1,FFFFFFE2,FFFFFFE3,FFFFFFE4,FFFFFFE5,FFFFFFE6,FFFFFFE7,FFFFFFE8,FFFFFFE9,FFFFFFEA,FFFFFFEB,FFFFFFEC,FFFFFFED,FFFFFFEE,FFFFFFEF,FFFFFFF0,FFFFFFF1,FFFFFFF2,FFFFFFF3,FFFFFFF4... of switch 1000415C 10004179 \|> 33D2 /xor edx, edx 1000417B \|. 83FE E0 \|cmp esi, -20 1000417E \|. 77 42 \|ja short 100041C2 10004180 \|. 3B35 A4840010 \|cmp esi, dword ptr [100084A4] 10004186 \|. 77 28 \|ja short 100041B0 10004188 \|. 8BC6 \|mov eax, esi 1000418A \|. C1E8 04 \|shr eax, 4 1000418D \|. 50 \|push eax 1000418E \|. E8 2DF8FFFF \|call 100039C0 10004193 \|. 8BD0 \|mov edx, eax 10004195 \|. 83C4 04 \|add esp, 4 10004198 \|. 85D2 \|test edx, edx 1000419A \|. 74 18 \|je short 100041B4 1000419C \|. 8BCE \|mov ecx, esi 1000419E \|. 33C0 \|xor eax, eax 100041A0 \|. 8BE9 \|mov ebp, ecx 100041A2 \|. 8BFA \|mov edi, edx 100041A4 \|. C1E9 02 \|shr ecx, 2 100041A7 \|. F3:AB \|rep stos dword ptr es:[edi] 100041A9 \|. 8BCD \|mov ecx, ebp 100041AB \|. 83E1 03 \|and ecx, 3 100041AE \|. F3:AA \|rep stos byte ptr es:[edi] 100041B0 \|> 85D2 \|test edx, edx 100041B2 \|. 75 2D \|jnz short 100041E1 100041B4 \|> 8B0D 90880010 \|mov ecx, dword ptr [10008890] 100041BA \|. 56 \|push esi 100041BB \|. 6A 08 \|push 8 100041BD \|. 51 \|push ecx 100041BE \|. FFD3 \|call ebx 100041C0 \|. 8BD0 \|mov edx, eax 100041C2 \|> 85D2 \|test edx, edx 100041C4 \|. 75 1B \|jnz short 100041E1 100041C6 \|. A1 88880010 \|mov eax, dword ptr [10008888] 100041CB \|. 85C0 \|test eax, eax 100041CD \|. 74 12 \|je short 100041E1 100041CF \|. 56 \|push esi 100041D0 \|. E8 1B000000 \|call 100041F0 100041D5 \|. 83C4 04 \|add esp, 4 100041D8 \|. 85C0 \|test eax, eax 100041DA \|.^ 75 9D \jnz short 10004179 100041DC \|. 5F pop edi 100041DD \|. 5E pop esi 100041DE \|. 5D pop ebp 100041DF \|. 5B pop ebx 100041E0 \|. C3 retn 100041E1 \|> 5F pop edi 100041E2 \|. 5E pop esi 100041E3 \|. 5D pop ebp 100041E4 \|. 8BC2 mov eax, edx 100041E6 \|. 5B pop ebx 100041E7 \. C3 retn 100041E8 90 nop 2009-4-1 23:07 0
longdf 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 8 粉丝 0 关注私信	longdf 4 楼如要程序端请留言，或发邮件到 ldf2222#sohu.com 2009-4-1 23:08 0
icersg 雪币： 293 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 8 回帖 471 粉丝 0 关注私信	icersg 5 楼消灭零回复，看到过好多次这样的帖子了，给楼主提点建议。您上来就贴这么长的代码，又不能动态调试，只能眼巴巴的看，说实话，拖滚动条到最下面已经很累了。本来看汇编就是一件很枯燥的事情，而且还是这么没血没肉的东西，除了OD的自动注释，您一句注释都没有，让人感觉您很没有诚意，至少把你自己的分析结果贴出来，然别人知道您努力过了，现在什么地方有困难，让别人也好对症下药。每个人的精力都是有限的，一般人不会来看的，除非遇见志同道合的人，可是您连程序的描述都没有，即使别人搞过这个程序，也不可能一眼就认出来。如此说来，您又怎么找到志同道合的人呢？虽然缘分这种东西很神奇，如果不懂得珍惜，也是一场空。再看看其他求破的朋友，好歹人家把程序上传到网上空间，万一哪个路人有空，还会去试一下，多少给点提示。可是别人要帮您解决问题，还得向您求程序。我也是个初学者，也经常在网上提问。问题描述的清楚，才能让别人看得懂；说话做事要虚心，有诚意，别人才会帮您；寻求帮助的时候，也尽量替别人想一想，怎样才能方便别人回答。不要总像是挤牙膏一样，问一句，答一句；毕竟没有人欠您的，别人帮您忙算人情，不帮您是本分。 2009-4-2 12:32 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

longdf

发帖

回帖

RANK

关注

私信

他的文章

[求助]搞了一天了，还没找到关键点，请高手指点一下！！ 3924

关于我们

联系我们

企业服务

看雪公众号

最新回复 (4)
longdf 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 8 粉丝 0 关注私信	longdf 2 楼 10001D2A 90 nop 10001D2B 90 nop 10001D2C 90 nop 10001D2D 90 nop 10001D2E 90 nop 10001D2F 90 nop 10001D30 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10001D34 \|. 83EC 14 sub esp, 14 10001D37 \|. 53 push ebx 10001D38 \|. 55 push ebp 10001D39 \|. 56 push esi 10001D3A \|. 57 push edi 10001D3B \|. 50 push eax 10001D3C \|. E8 FF010000 call 10001F40 10001D41 \|. 8BC8 mov ecx, eax 10001D43 \|. A1 D0860010 mov eax, dword ptr [100086D0] 10001D48 \|. 83C4 04 add esp, 4 10001D4B \|. 3BC8 cmp ecx, eax 10001D4D \|. 894C24 28 mov dword ptr [esp+28], ecx 10001D51 \|. 75 0A jnz short 10001D5D 10001D53 \|. 33C0 xor eax, eax 10001D55 \|. 5F pop edi 10001D56 \|. 5E pop esi 10001D57 \|. 5D pop ebp 10001D58 \|. 5B pop ebx 10001D59 \|. 83C4 14 add esp, 14 10001D5C \|. C3 retn 10001D5D \|> 85C9 test ecx, ecx 10001D5F \|. 75 14 jnz short 10001D75 10001D61 \|. E8 8A020000 call 10001FF0 10001D66 \|. E8 C5020000 call 10002030 10001D6B \|. 33C0 xor eax, eax 10001D6D \|. 5F pop edi 10001D6E \|. 5E pop esi 10001D6F \|. 5D pop ebp 10001D70 \|. 5B pop ebx 10001D71 \|. 83C4 14 add esp, 14 10001D74 \|. C3 retn 10001D75 \|> 33D2 xor edx, edx 10001D77 \|. B8 40600010 mov eax, 10006040 10001D7C \|> 3908 /cmp dword ptr [eax], ecx 10001D7E \|. 0F84 07010000 \|je 10001E8B 10001D84 \|. 83C0 30 \|add eax, 30 10001D87 \|. 42 \|inc edx 10001D88 \|. 3D 30610010 \|cmp eax, 10006130 10001D8D \|.^ 72 ED \jb short 10001D7C 10001D8F \|. 8D5424 10 lea edx, dword ptr [esp+10] 10001D93 \|. 52 push edx ; /pCPInfo 10001D94 \|. 51 push ecx ; \|CodePage 10001D95 \|. FF15 0C500010 call dword ptr [<&KERNEL32.GetCPInfo>>; \GetCPInfo 10001D9B \|. BE 01000000 mov esi, 1 10001DA0 \|. 3BC6 cmp eax, esi 10001DA2 \|. 0F85 BB000000 jnz 10001E63 10001DA8 \|. B9 40000000 mov ecx, 40 10001DAD \|. 33C0 xor eax, eax 10001DAF \|. BF C8840010 mov edi, 100084C8 10001DB4 \|. F3:AB rep stos dword ptr es:[edi] 10001DB6 \|. 8B4C24 10 mov ecx, dword ptr [esp+10] 10001DBA \|. AA stos byte ptr es:[edi] 10001DBB \|. 8B7C24 28 mov edi, dword ptr [esp+28] 10001DBF \|. 33C0 xor eax, eax 10001DC1 \|. 3BCE cmp ecx, esi 10001DC3 \|. 893D D0860010 mov dword ptr [100086D0], edi 10001DC9 \|. A3 D4860010 mov dword ptr [100086D4], eax 10001DCE \|. 76 6E jbe short 10001E3E 10001DD0 \|. 8A4424 16 mov al, byte ptr [esp+16] 10001DD4 \|. 84C0 test al, al 10001DD6 \|. 74 37 je short 10001E0F 10001DD8 \|. 8D5424 17 lea edx, dword ptr [esp+17] 10001DDC \|> 8A0A /mov cl, byte ptr [edx] 10001DDE \|. 84C9 \|test cl, cl 10001DE0 \|. 74 2D \|je short 10001E0F 10001DE2 \|. 33C0 \|xor eax, eax 10001DE4 \|. 81E1 FF000000 \|and ecx, 0FF 10001DEA \|. 8A42 FF \|mov al, byte ptr [edx-1] 10001DED \|. 3BC1 \|cmp eax, ecx 10001DEF \|. 77 14 \|ja short 10001E05 10001DF1 \|> 8A98 C9840010 \|/mov bl, byte ptr [eax+100084C9] 10001DF7 \|. 80CB 04 \|\|or bl, 4 10001DFA \|. 8898 C9840010 \|\|mov byte ptr [eax+100084C9], bl 10001E00 \|. 40 \|\|inc eax 10001E01 \|. 3BC1 \|\|cmp eax, ecx 10001E03 \|.^ 76 EC \|\jbe short 10001DF1 10001E05 \|> 8A42 01 \|mov al, byte ptr [edx+1] 10001E08 \|. 83C2 02 \|add edx, 2 10001E0B \|. 84C0 \|test al, al 10001E0D \|.^ 75 CD \jnz short 10001DDC 10001E0F \|> 8BC6 mov eax, esi 10001E11 \|> 8A98 C9840010 /mov bl, byte ptr [eax+100084C9] 10001E17 \|. 80CB 08 \|or bl, 8 10001E1A \|. 8898 C9840010 \|mov byte ptr [eax+100084C9], bl 10001E20 \|. 40 \|inc eax 10001E21 \|. 3D FF000000 \|cmp eax, 0FF 10001E26 \|.^ 72 E9 \jb short 10001E11 10001E28 \|. 57 push edi 10001E29 \|. E8 62010000 call 10001F90 10001E2E \|. 83C4 04 add esp, 4 10001E31 \|. A3 D4860010 mov dword ptr [100086D4], eax 10001E36 \|. 8935 B0890010 mov dword ptr [100089B0], esi 10001E3C \|. EB 05 jmp short 10001E43 10001E3E \|> A3 B0890010 mov dword ptr [100089B0], eax 10001E43 \|> 33C0 xor eax, eax 10001E45 \|. A3 D8860010 mov dword ptr [100086D8], eax 10001E4A \|. A3 DC860010 mov dword ptr [100086DC], eax 10001E4F \|. A3 E0860010 mov dword ptr [100086E0], eax 10001E54 \|. E8 D7010000 call 10002030 10001E59 \|. 33C0 xor eax, eax 10001E5B \|. 5F pop edi 10001E5C \|. 5E pop esi 10001E5D \|. 5D pop ebp 10001E5E \|. 5B pop ebx 10001E5F \|. 83C4 14 add esp, 14 10001E62 \|. C3 retn 10001E63 \|> A1 E4860010 mov eax, dword ptr [100086E4] 10001E68 \|. 85C0 test eax, eax 10001E6A \|. 74 14 je short 10001E80 10001E6C \|. E8 7F010000 call 10001FF0 10001E71 \|. E8 BA010000 call 10002030 10001E76 \|. 33C0 xor eax, eax 10001E78 \|. 5F pop edi 10001E79 \|. 5E pop esi 10001E7A \|. 5D pop ebp 10001E7B \|. 5B pop ebx 10001E7C \|. 83C4 14 add esp, 14 10001E7F \|. C3 retn 10001E80 \|> 83C8 FF or eax, FFFFFFFF 10001E83 \|. 5F pop edi 10001E84 \|. 5E pop esi 10001E85 \|. 5D pop ebp 10001E86 \|. 5B pop ebx 10001E87 \|. 83C4 14 add esp, 14 10001E8A \|. C3 retn 10001E8B \|> B9 40000000 mov ecx, 40 10001E90 \|. 33C0 xor eax, eax 10001E92 \|. BF C8840010 mov edi, 100084C8 10001E97 \|. 8D1C52 lea ebx, dword ptr [edx+edx2] 10001E9A \|. F3:AB rep stos dword ptr es:[edi] 10001E9C \|. AA stos byte ptr es:[edi] 10001E9D \|. 33FF xor edi, edi 10001E9F \|. C1E3 04 shl ebx, 4 10001EA2 \|. 8DAB 50600010 lea ebp, dword ptr [ebx+10006050] 10001EA8 \|> 8A45 00 /mov al, byte ptr [ebp] 10001EAB \|. 8BF5 \|mov esi, ebp 10001EAD \|. 84C0 \|test al, al 10001EAF \|. 74 30 \|je short 10001EE1 10001EB1 \|> 8A4E 01 \|/mov cl, byte ptr [esi+1] 10001EB4 \|. 84C9 \|\|test cl, cl 10001EB6 \|. 74 29 \|\|je short 10001EE1 10001EB8 \|. 33C0 \|\|xor eax, eax 10001EBA \|. 81E1 FF000000 \|\|and ecx, 0FF 10001EC0 \|. 8A06 \|\|mov al, byte ptr [esi] 10001EC2 \|. 3BC1 \|\|cmp eax, ecx 10001EC4 \|. 77 11 \|\|ja short 10001ED7 10001EC6 \|. 8A97 38600010 \|\|mov dl, byte ptr [edi+10006038] 10001ECC \|> 0890 C9840010 \|\|/or byte ptr [eax+100084C9], dl 10001ED2 \|. 40 \|\|\|inc eax 10001ED3 \|. 3BC1 \|\|\|cmp eax, ecx 10001ED5 \|.^ 76 F5 \|\|\jbe short 10001ECC 10001ED7 \|> 8A46 02 \|\|mov al, byte ptr [esi+2] 10001EDA \|. 83C6 02 \|\|add esi, 2 10001EDD \|. 84C0 \|\|test al, al 10001EDF \|.^ 75 D0 \|\jnz short 10001EB1 10001EE1 \|> 47 \|inc edi 10001EE2 \|. 83C5 08 \|add ebp, 8 10001EE5 \|. 83FF 04 \|cmp edi, 4 10001EE8 \|.^ 72 BE \jb short 10001EA8 10001EEA \|. 8B4424 28 mov eax, dword ptr [esp+28] 10001EEE \|. C705 B0890010>mov dword ptr [100089B0], 1 10001EF8 \|. 50 push eax 10001EF9 \|. A3 D0860010 mov dword ptr [100086D0], eax 10001EFE \|. E8 8D000000 call 10001F90 10001F03 \|. 8B8B 44600010 mov ecx, dword ptr [ebx+10006044] 10001F09 \|. 8B93 48600010 mov edx, dword ptr [ebx+10006048] 10001F0F \|. A3 D4860010 mov dword ptr [100086D4], eax 10001F14 \|. 8D83 44600010 lea eax, dword ptr [ebx+10006044] 10001F1A \|. 83C4 04 add esp, 4 10001F1D \|. 890D D8860010 mov dword ptr [100086D8], ecx 10001F23 \|. 8B40 08 mov eax, dword ptr [eax+8] 10001F26 \|. 8915 DC860010 mov dword ptr [100086DC], edx 10001F2C \|. A3 E0860010 mov dword ptr [100086E0], eax 10001F31 \|. E8 FA000000 call 10002030 10001F36 \|. 5F pop edi 10001F37 \|. 5E pop esi 10001F38 \|. 5D pop ebp 10001F39 \|. 33C0 xor eax, eax 10001F3B \|. 5B pop ebx 10001F3C \|. 83C4 14 add esp, 14 10001F3F \. C3 retn 10001F40 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10001F44 \|. C705 E4860010>mov dword ptr [100086E4], 0 10001F4E \|. 83F8 FE cmp eax, -2 ; Switch (cases FFFFFFFC..FFFFFFFE) 10001F51 \|. 75 10 jnz short 10001F63 10001F53 \|. C705 E4860010>mov dword ptr [100086E4], 1 ; Case FFFFFFFE of switch 10001F4E 10001F5D \|.- FF25 28500010 jmp dword ptr [<&KERNEL32.GetOEMCP>] ; kernel32.GetOEMCP 10001F63 \|> 83F8 FD cmp eax, -3 10001F66 \|. 75 10 jnz short 10001F78 10001F68 \|. C705 E4860010>mov dword ptr [100086E4], 1 ; Case FFFFFFFD of switch 10001F4E 10001F72 \|.- FF25 24500010 jmp dword ptr [<&KERNEL32.GetACP>] ; kernel32.GetACP 10001F78 \|> 83F8 FC cmp eax, -4 10001F7B \|. 75 0F jnz short 10001F8C 10001F7D \|. A1 08870010 mov eax, dword ptr [10008708] ; Case FFFFFFFC of switch 10001F4E 10001F82 \|. C705 E4860010>mov dword ptr [100086E4], 1 10001F8C \> C3 retn ; Default case of switch 10001F4E 10001F8D 90 nop 10001F8E 90 nop 10001F8F 90 nop 10001F90 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10001F94 \|. 05 5CFCFFFF add eax, -3A4 ; Switch (cases 3A4..3B6) 10001F99 \|. 83F8 12 cmp eax, 12 10001F9C \|. 77 27 ja short 10001FC5 10001F9E \|. 33C9 xor ecx, ecx 10001FA0 \|. 8A88 DC1F0010 mov cl, byte ptr [eax+10001FDC] 10001FA6 \|. FF248D C81F00>jmp dword ptr [ecx4+10001FC8] 10001FAD \|> B8 11040000 mov eax, 411 ; Case 3A4 of switch 10001F94 10001FB2 \|. C3 retn 10001FB3 \|> B8 04080000 mov eax, 804 ; Case 3A8 of switch 10001F94 10001FB8 \|. C3 retn 10001FB9 \|> B8 12040000 mov eax, 412 ; Case 3B5 of switch 10001F94 10001FBE \|. C3 retn 10001FBF \|> B8 04040000 mov eax, 404 ; Case 3B6 of switch 10001F94 10001FC4 \|. C3 retn 10001FC5 \|> 33C0 xor eax, eax ; Default case of switch 10001F94 10001FC7 \. C3 retn 10001FC8 . AD1F0010 dd pjgl.10001FAD ; 分支表被用于 10001FA6 10001FCC . B31F0010 dd pjgl.10001FB3 10001FD0 . B91F0010 dd pjgl.10001FB9 10001FD4 . BF1F0010 dd pjgl.10001FBF 10001FD8 . C51F0010 dd pjgl.10001FC5 10001FDC . 00 db 00 ; 分支 10001FC8 索引表 10001FDD . 04 db 04 10001FDE . 04 db 04 10001FDF . 04 db 04 10001FE0 . 01 db 01 10001FE1 . 04 db 04 10001FE2 . 04 db 04 10001FE3 . 04 db 04 10001FE4 . 04 db 04 10001FE5 . 04 db 04 10001FE6 . 04 db 04 10001FE7 . 04 db 04 10001FE8 . 04 db 04 10001FE9 . 04 db 04 10001FEA . 04 db 04 10001FEB . 04 db 04 10001FEC . 04 db 04 10001FED . 02 db 02 10001FEE . 03 db 03 10001FEF 90 nop 10001FF0 /$ 57 push edi 10001FF1 \|. B9 40000000 mov ecx, 40 10001FF6 \|. 33C0 xor eax, eax 10001FF8 \|. BF C8840010 mov edi, 100084C8 10001FFD \|. F3:AB rep stos dword ptr es:[edi] 10001FFF \|. AA stos byte ptr es:[edi] 10002000 \|. 33C0 xor eax, eax 10002002 \|. 5F pop edi 10002003 \|. A3 D0860010 mov dword ptr [100086D0], eax 10002008 \|. A3 B0890010 mov dword ptr [100089B0], eax 1000200D \|. A3 D4860010 mov dword ptr [100086D4], eax 10002012 \|. A3 D8860010 mov dword ptr [100086D8], eax 10002017 \|. A3 DC860010 mov dword ptr [100086DC], eax 1000201C \|. A3 E0860010 mov dword ptr [100086E0], eax 10002021 \. C3 retn 10002022 90 nop 10002023 90 nop 10002024 90 nop 10002025 90 nop 10002026 90 nop 10002027 90 nop 10002028 90 nop 10002029 90 nop 1000202A 90 nop 1000202B 90 nop 1000202C 90 nop 1000202D 90 nop 1000202E 90 nop 1000202F 90 nop 10002030 /$ 8B0D D0860010 mov ecx, dword ptr [100086D0] 10002036 \|. 81EC 14050000 sub esp, 514 1000203C \|. 8D4424 00 lea eax, dword ptr [esp] 10002040 \|. 53 push ebx 10002041 \|. 50 push eax ; /pCPInfo 10002042 \|. 51 push ecx ; \|CodePage => CP_ACP 10002043 \|. FF15 0C500010 call dword ptr [<&KERNEL32.GetCPInfo>>; \GetCPInfo 10002049 \|. 83F8 01 cmp eax, 1 1000204C \|. 0F85 52010000 jnz 100021A4 10002052 \|. 57 push edi 10002053 \|. 56 push esi 10002054 \|. 33C0 xor eax, eax 10002056 \|> 884404 20 /mov byte ptr [esp+eax+20], al 1000205A \|. 40 \|inc eax 1000205B \|. 3D 00010000 \|cmp eax, 100 10002060 \|.^ 72 F4 \jb short 10002056 10002062 \|. 8A4424 12 mov al, byte ptr [esp+12] 10002066 \|. C64424 20 20 mov byte ptr [esp+20], 20 1000206B \|. 84C0 test al, al 1000206D \|. 74 35 je short 100020A4 1000206F \|. 8D5424 13 lea edx, dword ptr [esp+13] 10002073 \|> 33C9 /xor ecx, ecx 10002075 \|. 25 FF000000 \|and eax, 0FF 1000207A \|. 8A0A \|mov cl, byte ptr [edx] 1000207C \|. 3BC1 \|cmp eax, ecx 1000207E \|. 77 1A \|ja short 1000209A 10002080 \|. 2BC8 \|sub ecx, eax 10002082 \|. 8D7C04 20 \|lea edi, dword ptr [esp+eax+20] 10002086 \|. 41 \|inc ecx 10002087 \|. B8 20202020 \|mov eax, 20202020 1000208C \|. 8BF1 \|mov esi, ecx 1000208E \|. C1E9 02 \|shr ecx, 2 10002091 \|. F3:AB \|rep stos dword ptr es:[edi] 10002093 \|. 8BCE \|mov ecx, esi 10002095 \|. 83E1 03 \|and ecx, 3 10002098 \|. F3:AA \|rep stos byte ptr es:[edi] 1000209A \|> 8A42 01 \|mov al, byte ptr [edx+1] 1000209D \|. 83C2 02 \|add edx, 2 100020A0 \|. 84C0 \|test al, al 100020A2 \|.^ 75 CF \jnz short 10002073 100020A4 \|> 8B15 D4860010 mov edx, dword ptr [100086D4] 100020AA \|. A1 D0860010 mov eax, dword ptr [100086D0] 100020AF \|. 6A 00 push 0 100020B1 \|. 52 push edx 100020B2 \|. 8D8C24 280300>lea ecx, dword ptr [esp+328] 100020B9 \|. 50 push eax 100020BA \|. 51 push ecx 100020BB \|. 8D5424 30 lea edx, dword ptr [esp+30] 100020BF \|. 68 00010000 push 100 100020C4 \|. 52 push edx 100020C5 \|. 6A 01 push 1 100020C7 \|. E8 54120000 call 10003320 100020CC \|. A1 D0860010 mov eax, dword ptr [100086D0] 100020D1 \|. 83C4 1C add esp, 1C 100020D4 \|. 8D8C24 200100>lea ecx, dword ptr [esp+120] 100020DB \|. 8D5424 20 lea edx, dword ptr [esp+20] 100020DF \|. 6A 00 push 0 100020E1 \|. 50 push eax 100020E2 \|. A1 D4860010 mov eax, dword ptr [100086D4] 100020E7 \|. 68 00010000 push 100 100020EC \|. 51 push ecx 100020ED \|. 68 00010000 push 100 100020F2 \|. 52 push edx 100020F3 \|. 68 00010000 push 100 100020F8 \|. 50 push eax 100020F9 \|. E8 22010000 call 10002220 100020FE \|. 8B0D D0860010 mov ecx, dword ptr [100086D0] 10002104 \|. 83C4 20 add esp, 20 10002107 \|. 8D9424 200200>lea edx, dword ptr [esp+220] 1000210E \|. 8D4424 20 lea eax, dword ptr [esp+20] 10002112 \|. 6A 00 push 0 10002114 \|. 51 push ecx 10002115 \|. 8B0D D4860010 mov ecx, dword ptr [100086D4] 1000211B \|. 68 00010000 push 100 10002120 \|. 52 push edx 10002121 \|. 68 00010000 push 100 10002126 \|. 50 push eax 10002127 \|. 68 00020000 push 200 1000212C \|. 51 push ecx 1000212D \|. E8 EE000000 call 10002220 10002132 \|. 83C4 20 add esp, 20 10002135 \|. 33C0 xor eax, eax 10002137 \|. 8D9424 200300>lea edx, dword ptr [esp+320] 1000213E \|. B3 10 mov bl, 10 10002140 \|> 66:8B0A /mov cx, word ptr [edx] 10002143 \|. F6C1 01 \|test cl, 1 10002146 \|. 74 1D \|je short 10002165 10002148 \|. 8A88 C9840010 \|mov cl, byte ptr [eax+100084C9] 1000214E \|. 0ACB \|or cl, bl 10002150 \|. 8888 C9840010 \|mov byte ptr [eax+100084C9], cl 10002156 \|. 8A8C04 200100>\|mov cl, byte ptr [esp+eax+120] 1000215D \|. 8888 D0850010 \|mov byte ptr [eax+100085D0], cl 10002163 \|. EB 2A \|jmp short 1000218F 10002165 \|> F6C1 02 \|test cl, 2 10002168 \|. 74 1E \|je short 10002188 1000216A \|. 8A88 C9840010 \|mov cl, byte ptr [eax+100084C9] 10002170 \|. 80C9 20 \|or cl, 20 10002173 \|. 8888 C9840010 \|mov byte ptr [eax+100084C9], cl 10002179 \|. 8A8C04 200200>\|mov cl, byte ptr [esp+eax+220] 10002180 \|. 8888 D0850010 \|mov byte ptr [eax+100085D0], cl 10002186 \|. EB 07 \|jmp short 1000218F 10002188 \|> C680 D0850010>\|mov byte ptr [eax+100085D0], 0 1000218F \|> 40 \|inc eax 10002190 \|. 83C2 02 \|add edx, 2 10002193 \|. 3D 00010000 \|cmp eax, 100 10002198 \|.^ 72 A6 \jb short 10002140 1000219A \|. 5E pop esi 1000219B \|. 5F pop edi 1000219C \|. 5B pop ebx 1000219D \|. 81C4 14050000 add esp, 514 100021A3 \|. C3 retn 100021A4 \|> 33C0 xor eax, eax 100021A6 \|. B3 10 mov bl, 10 100021A8 \|> 83F8 41 /cmp eax, 41 100021AB \|. 72 20 \|jb short 100021CD 100021AD \|. 83F8 5A \|cmp eax, 5A 100021B0 \|. 77 1B \|ja short 100021CD 100021B2 \|. 8A90 C9840010 \|mov dl, byte ptr [eax+100084C9] 100021B8 \|. 0AD3 \|or dl, bl 100021BA \|. 8890 C9840010 \|mov byte ptr [eax+100084C9], dl 100021C0 \|. 8AD0 \|mov dl, al 100021C2 \|. 80C2 20 \|add dl, 20 100021C5 \|. 8890 D0850010 \|mov byte ptr [eax+100085D0], dl 100021CB \|. EB 2D \|jmp short 100021FA 100021CD \|> 83F8 61 \|cmp eax, 61 100021D0 \|. 72 21 \|jb short 100021F3 100021D2 \|. 83F8 7A \|cmp eax, 7A 100021D5 \|. 77 1C \|ja short 100021F3 100021D7 \|. 8A88 C9840010 \|mov cl, byte ptr [eax+100084C9] 100021DD \|. 80C9 20 \|or cl, 20 100021E0 \|. 8888 C9840010 \|mov byte ptr [eax+100084C9], cl 100021E6 \|. 8AC8 \|mov cl, al 100021E8 \|. 80E9 20 \|sub cl, 20 100021EB \|. 8888 D0850010 \|mov byte ptr [eax+100085D0], cl 100021F1 \|. EB 07 \|jmp short 100021FA 100021F3 \|> C680 D0850010>\|mov byte ptr [eax+100085D0], 0 100021FA \|> 40 \|inc eax 100021FB \|. 3D 00010000 \|cmp eax, 100 10002200 \|.^ 72 A6 \jb short 100021A8 10002202 \|. 5B pop ebx 10002203 \|. 81C4 14050000 add esp, 514 10002209 \. C3 retn 1000220A 90 nop 1000220B 90 nop 1000220C 90 nop 1000220D 90 nop 1000220E 90 nop 1000220F 90 nop 10002210 /$ 6A FD push -3 10002212 \|. E8 19FBFFFF call 10001D30 10002217 \|. 83C4 04 add esp, 4 1000221A \. C3 retn 1000221B 90 nop 1000221C 90 nop 1000221D 90 nop 1000221E 90 nop 1000221F 90 nop 10002220 /$ A1 EC860010 mov eax, dword ptr [100086EC] 10002225 \|. 53 push ebx 10002226 \|. 8B1D 34500010 mov ebx, dword ptr [<&KERNEL32.LCMap>; kernel32.LCMapStringA 1000222C \|. 55 push ebp 1000222D \|. 56 push esi 1000222E \|. 57 push edi 1000222F \|. 85C0 test eax, eax 10002231 \|. 75 49 jnz short 1000227C 10002233 \|. 6A 00 push 0 ; /DestSize = 0 10002235 \|. 6A 00 push 0 ; \|DestString = NULL 10002237 \|. 6A 01 push 1 ; \|SrcSize = 1 10002239 \|. 68 B0500010 push 100050B0 ; \|SrcString = "" 1000223E \|. 68 00010000 push 100 ; \|MapFlags = LCMAP_LOWERCASE 10002243 \|. 6A 00 push 0 ; \|LocaleId = 0 10002245 \|. FF15 38500010 call dword ptr [<&KERNEL32.LCMapStrin>; \LCMapStringW 1000224B \|. 85C0 test eax, eax 1000224D \|. 74 07 je short 10002256 1000224F \|. B8 01000000 mov eax, 1 10002254 \|. EB 21 jmp short 10002277 10002256 \|> 6A 00 push 0 10002258 \|. 6A 00 push 0 1000225A \|. 6A 01 push 1 1000225C \|. 68 AC500010 push 100050AC 10002261 \|. 68 00010000 push 100 10002266 \|. 6A 00 push 0 10002268 \|. FFD3 call ebx 1000226A \|. 85C0 test eax, eax 1000226C \|. 0F84 CC010000 je 1000243E 10002272 \|. B8 02000000 mov eax, 2 10002277 \|> A3 EC860010 mov dword ptr [100086EC], eax 1000227C \|> 8B7424 20 mov esi, dword ptr [esp+20] 10002280 \|. 85F6 test esi, esi 10002282 \|. 7E 17 jle short 1000229B 10002284 \|. 8B7C24 1C mov edi, dword ptr [esp+1C] 10002288 \|. 56 push esi 10002289 \|. 57 push edi 1000228A \|. E8 C1010000 call 10002450 1000228F \|. 8BF0 mov esi, eax 10002291 \|. A1 EC860010 mov eax, dword ptr [100086EC] 10002296 \|. 83C4 08 add esp, 8 10002299 \|. EB 04 jmp short 1000229F 1000229B \|> 8B7C24 1C mov edi, dword ptr [esp+1C] 1000229F \|> 83F8 02 cmp eax, 2 100022A2 \|. 75 1D jnz short 100022C1 100022A4 \|. 8B4424 28 mov eax, dword ptr [esp+28] 100022A8 \|. 8B4C24 24 mov ecx, dword ptr [esp+24] 100022AC \|. 8B5424 18 mov edx, dword ptr [esp+18] 100022B0 \|. 50 push eax 100022B1 \|. 8B4424 18 mov eax, dword ptr [esp+18] 100022B5 \|. 51 push ecx 100022B6 \|. 56 push esi 100022B7 \|. 57 push edi 100022B8 \|. 52 push edx 100022B9 \|. 50 push eax 100022BA \|. FFD3 call ebx 100022BC \|. 5F pop edi 100022BD \|. 5E pop esi 100022BE \|. 5D pop ebp 100022BF \|. 5B pop ebx 100022C0 \|. C3 retn 100022C1 \|> 83F8 01 cmp eax, 1 100022C4 \|. 0F85 DD000000 jnz 100023A7 100022CA \|. 8B6C24 2C mov ebp, dword ptr [esp+2C] 100022CE \|. C74424 20 000>mov dword ptr [esp+20], 0 100022D6 \|. 85ED test ebp, ebp 100022D8 \|. 75 0C jnz short 100022E6 100022DA \|. 8B0D 08870010 mov ecx, dword ptr [10008708] 100022E0 \|. 894C24 2C mov dword ptr [esp+2C], ecx 100022E4 \|. 8BE9 mov ebp, ecx 100022E6 \|> 8B5424 30 mov edx, dword ptr [esp+30] 100022EA \|. 6A 00 push 0 ; /WideBufSize = 0 100022EC \|. F7DA neg edx ; \| 100022EE \|. 1BD2 sbb edx, edx ; \| 100022F0 \|. 6A 00 push 0 ; \|WideCharBuf = NULL 100022F2 \|. 83E2 08 and edx, 8 ; \| 100022F5 \|. 56 push esi ; \|StringSize 100022F6 \|. 42 inc edx ; \| 100022F7 \|. 57 push edi ; \|StringToMap 100022F8 \|. 52 push edx ; \|Options 100022F9 \|. 55 push ebp ; \|CodePage 100022FA \|. FF15 2C500010 call dword ptr [<&KERNEL32.MultiByteT>; \MultiByteToWideChar 10002300 \|. 8BF8 mov edi, eax 10002302 \|. 85FF test edi, edi 10002304 \|. 75 05 jnz short 1000230B 10002306 \|. 5F pop edi 10002307 \|. 5E pop esi 10002308 \|. 5D pop ebp 10002309 \|. 5B pop ebx 1000230A \|. C3 retn 1000230B \|> 8D043F lea eax, dword ptr [edi+edi] 1000230E \|. 50 push eax 1000230F \|. E8 9C120000 call 100035B0 10002314 \|. 8BD8 mov ebx, eax 10002316 \|. 83C4 04 add esp, 4 10002319 \|. 85DB test ebx, ebx 1000231B \|. 75 05 jnz short 10002322 1000231D \|. 5F pop edi 1000231E \|. 5E pop esi 1000231F \|. 5D pop ebp 10002320 \|. 5B pop ebx 10002321 \|. C3 retn 10002322 \|> 8B4C24 1C mov ecx, dword ptr [esp+1C] 10002326 \|. 57 push edi ; /WideBufSize 10002327 \|. 53 push ebx ; \|WideCharBuf 10002328 \|. 56 push esi ; \|StringSize 10002329 \|. 51 push ecx ; \|StringToMap 1000232A \|. 6A 01 push 1 ; \|Options = MB_PRECOMPOSED 1000232C \|. 55 push ebp ; \|CodePage 1000232D \|. FF15 2C500010 call dword ptr [<&KERNEL32.MultiByteT>; \MultiByteToWideChar 10002333 \|. 85C0 test eax, eax 10002335 \|. 0F84 ED000000 je 10002428 1000233B \|. 8B6C24 18 mov ebp, dword ptr [esp+18] 1000233F \|. 8B5424 14 mov edx, dword ptr [esp+14] 10002343 \|. 6A 00 push 0 ; /DestSize = 0 10002345 \|. 6A 00 push 0 ; \|DestString = NULL 10002347 \|. 57 push edi ; \|SrcSize 10002348 \|. 53 push ebx ; \|SrcString 10002349 \|. 55 push ebp ; \|MapFlags 1000234A \|. 52 push edx ; \|LocaleId 1000234B \|. FF15 38500010 call dword ptr [<&KERNEL32.LCMapStrin>; \LCMapStringW 10002351 \|. 8BF0 mov esi, eax 10002353 \|. 85F6 test esi, esi 10002355 \|. 0F84 CD000000 je 10002428 1000235B \|. F7C5 00040000 test ebp, 400 10002361 \|. 74 49 je short 100023AC 10002363 \|. 8B4424 28 mov eax, dword ptr [esp+28] 10002367 \|. 85C0 test eax, eax 10002369 \|. 74 24 je short 1000238F 1000236B \|. 3BF0 cmp esi, eax 1000236D \|. 0F8F B5000000 jg 10002428 10002373 \|. 8B4C24 14 mov ecx, dword ptr [esp+14] 10002377 \|. 50 push eax ; /DestSize 10002378 \|. 8B4424 28 mov eax, dword ptr [esp+28] ; \| 1000237C \|. 50 push eax ; \|DestString 1000237D \|. 57 push edi ; \|SrcSize 1000237E \|. 53 push ebx ; \|SrcString 1000237F \|. 55 push ebp ; \|MapFlags 10002380 \|. 51 push ecx ; \|LocaleId 10002381 \|. FF15 38500010 call dword ptr [<&KERNEL32.LCMapStrin>; \LCMapStringW 10002387 \|. 85C0 test eax, eax 10002389 \|. 0F84 99000000 je 10002428 1000238F \|> 53 push ebx 10002390 \|. E8 CB100000 call 10003460 10002395 \|. 8B5424 24 mov edx, dword ptr [esp+24] 10002399 \|. 83C4 04 add esp, 4 1000239C \|. 52 push edx 1000239D \|. E8 BE100000 call 10003460 100023A2 \|. 83C4 04 add esp, 4 100023A5 \|. 8BC6 mov eax, esi 100023A7 \|> 5F pop edi 100023A8 \|. 5E pop esi 100023A9 \|. 5D pop ebp 100023AA \|. 5B pop ebx 100023AB \|. C3 retn 100023AC \|> 8D1436 lea edx, dword ptr [esi+esi] 100023AF \|. 52 push edx 100023B0 \|. E8 FB110000 call 100035B0 100023B5 \|. 83C4 04 add esp, 4 100023B8 \|. 894424 20 mov dword ptr [esp+20], eax 100023BC \|. 85C0 test eax, eax 100023BE \|. 74 68 je short 10002428 100023C0 \|. 8B4C24 14 mov ecx, dword ptr [esp+14] 100023C4 \|. 56 push esi ; /DestSize 100023C5 \|. 50 push eax ; \|DestString 100023C6 \|. 57 push edi ; \|SrcSize 100023C7 \|. 53 push ebx ; \|SrcString 100023C8 \|. 55 push ebp ; \|MapFlags 100023C9 \|. 51 push ecx ; \|LocaleId 100023CA \|. FF15 38500010 call dword ptr [<&KERNEL32.LCMapStrin>; \LCMapStringW 100023D0 \|. 85C0 test eax, eax 100023D2 \|. 74 54 je short 10002428 100023D4 \|. 8B4424 28 mov eax, dword ptr [esp+28] 100023D8 \|. 6A 00 push 0 ; /pDefaultCharUsed = NULL 100023DA \|. 85C0 test eax, eax ; \| 100023DC \|. 6A 00 push 0 ; \|pDefaultChar = NULL 100023DE \|. 75 22 jnz short 10002402 ; \| 100023E0 \|. 8B5424 28 mov edx, dword ptr [esp+28] ; \| 100023E4 \|. 8B4424 34 mov eax, dword ptr [esp+34] ; \| 100023E8 \|. 6A 00 push 0 ; \|MultiByteCount = 0 100023EA \|. 6A 00 push 0 ; \|MultiByteStr = NULL 100023EC \|. 56 push esi ; \|WideCharCount 100023ED \|. 52 push edx ; \|WideCharStr 100023EE \|. 68 20020000 push 220 ; \|Options = WC_COMPOSITECHECK\|WC_SEPCHARS 100023F3 \|. 50 push eax ; \|CodePage 100023F4 \|. FF15 30500010 call dword ptr [<&KERNEL32.WideCharTo>; \WideCharToMultiByte 100023FA \|. 8BF0 mov esi, eax 100023FC \|. 85F6 test esi, esi 100023FE \|. 74 28 je short 10002428 10002400 \|.^ EB 8D jmp short 1000238F 10002402 \|> 8B4C24 2C mov ecx, dword ptr [esp+2C] ; \| 10002406 \|. 8B5424 28 mov edx, dword ptr [esp+28] ; \| 1000240A \|. 50 push eax ; \|MultiByteCount 1000240B \|. 8B4424 38 mov eax, dword ptr [esp+38] ; \| 1000240F \|. 51 push ecx ; \|MultiByteStr 10002410 \|. 56 push esi ; \|WideCharCount 10002411 \|. 52 push edx ; \|WideCharStr 10002412 \|. 68 20020000 push 220 ; \|Options = WC_COMPOSITECHECK\|WC_SEPCHARS 10002417 \|. 50 push eax ; \|CodePage 10002418 \|. FF15 30500010 call dword ptr [<&KERNEL32.WideCharTo>; \WideCharToMultiByte 1000241E \|. 8BF0 mov esi, eax 10002420 \|. 85F6 test esi, esi 10002422 \|.^ 0F85 67FFFFFF jnz 1000238F 10002428 \|> 53 push ebx 10002429 \|. E8 32100000 call 10003460 1000242E \|. 8B4C24 24 mov ecx, dword ptr [esp+24] 10002432 \|. 83C4 04 add esp, 4 10002435 \|. 51 push ecx 10002436 \|. E8 25100000 call 10003460 1000243B \|. 83C4 04 add esp, 4 1000243E \|> 5F pop edi 1000243F \|. 5E pop esi 10002440 \|. 5D pop ebp 10002441 \|. 33C0 xor eax, eax 10002443 \|. 5B pop ebx 10002444 \. C3 retn 10002445 90 nop 10002446 90 nop 10002447 90 nop 10002448 90 nop 10002449 90 nop 1000244A 90 nop 1000244B 90 nop 1000244C 90 nop 1000244D 90 nop 1000244E 90 nop 1000244F 90 nop 10002450 /$ 8B5424 08 mov edx, dword ptr [esp+8] 10002454 \|. 56 push esi 10002455 \|. 8B7424 08 mov esi, dword ptr [esp+8] 10002459 \|. 85D2 test edx, edx 1000245B \|. 57 push edi 1000245C \|. 8BC6 mov eax, esi 1000245E \|. 8D4A FF lea ecx, dword ptr [edx-1] 10002461 \|. 74 0D je short 10002470 10002463 \|> 8038 00 /cmp byte ptr [eax], 0 10002466 \|. 74 08 \|je short 10002470 10002468 \|. 40 \|inc eax 10002469 \|. 8BF9 \|mov edi, ecx 1000246B \|. 49 \|dec ecx 1000246C \|. 85FF \|test edi, edi 1000246E \|.^ 75 F3 \jnz short 10002463 10002470 \|> 8038 00 cmp byte ptr [eax], 0 10002473 \|. 75 05 jnz short 1000247A 10002475 \|. 2BC6 sub eax, esi 10002477 \|. 5F pop edi 10002478 \|. 5E pop esi 10002479 \|. C3 retn 1000247A \|> 5F pop edi 1000247B \|. 5E pop esi 1000247C \|. 8BC2 mov eax, edx 1000247E \. C3 retn 1000247F 90 nop 10002480 /$ 51 push ecx 10002481 \|. 8B4C24 08 mov ecx, dword ptr [esp+8] 10002485 \|. 56 push esi 10002486 \|. 8D41 01 lea eax, dword ptr [ecx+1] 10002489 \|. 3D 00010000 cmp eax, 100 1000248E \|. 77 15 ja short 100024A5 10002490 \|. 8B15 30610010 mov edx, dword ptr [10006130] ; pjgl.1000613A 10002496 \|. 33C0 xor eax, eax 10002498 \|. 66:8B044A mov ax, word ptr [edx+ecx2] 1000249C \|. 8B4C24 10 mov ecx, dword ptr [esp+10] 100024A0 \|. 23C1 and eax, ecx 100024A2 \|. 5E pop esi 100024A3 \|. 59 pop ecx 100024A4 \|. C3 retn 100024A5 \|> 8B35 30610010 mov esi, dword ptr [10006130] ; pjgl.1000613A 100024AB \|. 8BC1 mov eax, ecx 100024AD \|. C1F8 08 sar eax, 8 100024B0 \|. 8BD0 mov edx, eax 100024B2 \|. 81E2 FF000000 and edx, 0FF 100024B8 \|. F64456 01 80 test byte ptr [esi+edx2+1], 80 100024BD \|. 74 14 je short 100024D3 100024BF \|. 884424 0C mov byte ptr [esp+C], al 100024C3 \|. 884C24 0D mov byte ptr [esp+D], cl 100024C7 \|. C64424 0E 00 mov byte ptr [esp+E], 0 100024CC \|. B8 02000000 mov eax, 2 100024D1 \|. EB 0E jmp short 100024E1 100024D3 \|> 884C24 0C mov byte ptr [esp+C], cl 100024D7 \|. C64424 0D 00 mov byte ptr [esp+D], 0 100024DC \|. B8 01000000 mov eax, 1 100024E1 \|> 6A 01 push 1 100024E3 \|. 6A 00 push 0 100024E5 \|. 8D4C24 0C lea ecx, dword ptr [esp+C] 100024E9 \|. 6A 00 push 0 100024EB \|. 51 push ecx 100024EC \|. 8D5424 1C lea edx, dword ptr [esp+1C] 100024F0 \|. 50 push eax 100024F1 \|. 52 push edx 100024F2 \|. 6A 01 push 1 100024F4 \|. E8 270E0000 call 10003320 100024F9 \|. 83C4 1C add esp, 1C 100024FC \|. 85C0 test eax, eax 100024FE \|. 75 03 jnz short 10002503 10002500 \|. 5E pop esi 10002501 \|. 59 pop ecx 10002502 \|. C3 retn 10002503 \|> 8B4424 04 mov eax, dword ptr [esp+4] 10002507 \|. 8B4C24 10 mov ecx, dword ptr [esp+10] 1000250B \|. 25 FFFF0000 and eax, 0FFFF 10002510 \|. 5E pop esi 10002511 \|. 23C1 and eax, ecx 10002513 \|. 59 pop ecx 10002514 \. C3 retn 10002515 90 nop 10002516 90 nop 10002517 90 nop 10002518 90 nop 10002519 90 nop 1000251A 90 nop 1000251B 90 nop 1000251C 90 nop 1000251D 90 nop 1000251E 90 nop 1000251F 90 nop 10002520 /$ A1 AC890010 mov eax, dword ptr [100089AC] 10002525 \|. 85C0 test eax, eax 10002527 \|. 74 02 je short 1000252B 10002529 \|. FFD0 call eax 1000252B \|> 68 10600010 push 10006010 10002530 \|. 68 0C600010 push 1000600C 10002535 \|. E8 06010000 call 10002640 1000253A \|. 83C4 08 add esp, 8 1000253D \|. 68 08600010 push 10006008 10002542 \|. 68 00600010 push 10006000 10002547 \|. E8 F4000000 call 10002640 1000254C \|. 83C4 08 add esp, 8 1000254F \. C3 retn 10002550 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10002554 \|. 6A 00 push 0 10002556 \|. 6A 00 push 0 10002558 \|. 50 push eax 10002559 \|. E8 32000000 call 10002590 1000255E \|. 83C4 0C add esp, 0C 10002561 \. C3 retn 10002562 90 nop 10002563 90 nop 10002564 90 nop 10002565 90 nop 10002566 90 nop 10002567 90 nop 10002568 90 nop 10002569 90 nop 1000256A 90 nop 1000256B 90 nop 1000256C 90 nop 1000256D 90 nop 1000256E 90 nop 1000256F 90 nop 10002570 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10002574 \|. 6A 00 push 0 10002576 \|. 6A 01 push 1 10002578 \|. 50 push eax 10002579 \|. E8 12000000 call 10002590 1000257E \|. 83C4 0C add esp, 0C 10002581 \. C3 retn 10002582 90 nop 10002583 90 nop 10002584 90 nop 10002585 90 nop 10002586 90 nop 10002587 90 nop 10002588 90 nop 10002589 90 nop 1000258A 90 nop 1000258B 90 nop 1000258C 90 nop 1000258D 90 nop 1000258E 90 nop 1000258F 90 nop 10002590 /$ A1 54870010 mov eax, dword ptr [10008754] 10002595 \|. 53 push ebx 10002596 \|. 55 push ebp 10002597 \|. 8B6C24 0C mov ebp, dword ptr [esp+C] 1000259B \|. 83F8 01 cmp eax, 1 1000259E \|. 56 push esi 1000259F \|. 75 0E jnz short 100025AF 100025A1 \|. 55 push ebp ; /ExitCode 100025A2 \|. FF15 40500010 call dword ptr [<&KERNEL32.GetCurrent>; \|[GetCurrentProcess 100025A8 \|. 50 push eax ; \|hProcess 100025A9 \|. FF15 3C500010 call dword ptr [<&KERNEL32.TerminateP>; \TerminateProcess 100025AF \|> 8B4424 14 mov eax, dword ptr [esp+14] 100025B3 \|. 8B5C24 18 mov ebx, dword ptr [esp+18] 100025B7 \|. 85C0 test eax, eax 100025B9 \|. C705 50870010>mov dword ptr [10008750], 1 100025C3 \|. 881D 4C870010 mov byte ptr [1000874C], bl 100025C9 \|. 75 3E jnz short 10002609 100025CB \|. 8B0D A8890010 mov ecx, dword ptr [100089A8] 100025D1 \|. 85C9 test ecx, ecx 100025D3 \|. 74 22 je short 100025F7 100025D5 \|. 8B35 A4890010 mov esi, dword ptr [100089A4] 100025DB \|. 83EE 04 sub esi, 4 100025DE \|. 3BF1 cmp esi, ecx 100025E0 \|. 72 15 jb short 100025F7 100025E2 \|> 8B06 /mov eax, dword ptr [esi] 100025E4 \|. 85C0 \|test eax, eax 100025E6 \|. 74 08 \|je short 100025F0 100025E8 \|. FFD0 \|call eax 100025EA \|. 8B0D A8890010 \|mov ecx, dword ptr [100089A8] 100025F0 \|> 83EE 04 \|sub esi, 4 100025F3 \|. 3BF1 \|cmp esi, ecx 100025F5 \|.^ 73 EB \jnb short 100025E2 100025F7 \|> 68 18600010 push 10006018 100025FC \|. 68 14600010 push 10006014 10002601 \|. E8 3A000000 call 10002640 10002606 \|. 83C4 08 add esp, 8 10002609 \|> 68 20600010 push 10006020 1000260E \|. 68 1C600010 push 1000601C 10002613 \|. E8 28000000 call 10002640 10002618 \|. 83C4 08 add esp, 8 1000261B \|. 85DB test ebx, ebx 1000261D \|. 75 11 jnz short 10002630 1000261F \|. 55 push ebp ; /ExitCode 10002620 \|. C705 54870010>mov dword ptr [10008754], 1 ; \| 1000262A \|. FF15 20500010 call dword ptr [<&KERNEL32.ExitProces>; \ExitProcess 10002630 \|> 5E pop esi 10002631 \|. 5D pop ebp 10002632 \|. 5B pop ebx 10002633 \. C3 retn 10002634 90 nop 10002635 90 nop 10002636 90 nop 10002637 90 nop 10002638 90 nop 10002639 90 nop 1000263A 90 nop 1000263B 90 nop 1000263C 90 nop 1000263D 90 nop 1000263E 90 nop 1000263F 90 nop 10002640 /$ 56 push esi 10002641 \|. 8B7424 08 mov esi, dword ptr [esp+8] 10002645 \|. 57 push edi 10002646 \|. 8B7C24 10 mov edi, dword ptr [esp+10] 1000264A \|. 3BF7 cmp esi, edi 1000264C \|. 73 0F jnb short 1000265D 1000264E \|> 8B06 /mov eax, dword ptr [esi] 10002650 \|. 85C0 \|test eax, eax 10002652 \|. 74 02 \|je short 10002656 10002654 \|. FFD0 \|call eax 10002656 \|> 83C6 04 \|add esi, 4 10002659 \|. 3BF7 \|cmp esi, edi 1000265B \|.^ 72 F1 \jb short 1000264E 1000265D \|> 5F pop edi 1000265E \|. 5E pop esi 1000265F \. C3 retn 10002660 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10002664 \|. 53 push ebx 10002665 \|. 55 push ebp 10002666 \|. 56 push esi 10002667 \|. 50 push eax 10002668 \|. E8 33010000 call 100027A0 1000266D \|. 83C4 04 add esp, 4 10002670 \|. 85C0 test eax, eax 10002672 \|. 0F84 17010000 je 1000278F 10002678 \|. 8B58 08 mov ebx, dword ptr [eax+8] 1000267B \|. 85DB test ebx, ebx ; Switch (cases 0..5) 1000267D \|. 0F84 0C010000 je 1000278F 10002683 \|. 83FB 05 cmp ebx, 5 10002686 \|. 75 10 jnz short 10002698 10002688 \|. C740 08 00000>mov dword ptr [eax+8], 0 ; Case 5 of switch 1000267B 1000268F \|. B8 01000000 mov eax, 1 10002694 \|. 5E pop esi 10002695 \|. 5D pop ebp 10002696 \|. 5B pop ebx 10002697 \|. C3 retn 10002698 \|> 83FB 01 cmp ebx, 1 1000269B \|. 75 07 jnz short 100026A4 1000269D \|. 83C8 FF or eax, FFFFFFFF ; Case 1 of switch 1000267B 100026A0 \|. 5E pop esi 100026A1 \|. 5D pop ebp 100026A2 \|. 5B pop ebx 100026A3 \|. C3 retn 100026A4 \|> 8B4C24 14 mov ecx, dword ptr [esp+14] ; Default case of switch 1000267B 100026A8 \|. 8B2D 58870010 mov ebp, dword ptr [10008758] 100026AE \|. 890D 58870010 mov dword ptr [10008758], ecx 100026B4 \|. 8B48 04 mov ecx, dword ptr [eax+4] 100026B7 \|. 83F9 08 cmp ecx, 8 100026BA \|. 0F85 B5000000 jnz 10002775 100026C0 \|. 8B35 C0630010 mov esi, dword ptr [100063C0] 100026C6 \|. 8B15 C4630010 mov edx, dword ptr [100063C4] 100026CC \|. 03D6 add edx, esi 100026CE \|. 3BF2 cmp esi, edx 100026D0 \|. 7D 18 jge short 100026EA 100026D2 \|. 8D0C76 lea ecx, dword ptr [esi+esi2] 100026D5 \|. 2BD6 sub edx, esi 100026D7 \|. 8D0C8D 506300>lea ecx, dword ptr [ecx4+10006350] 100026DE \|> C701 00000000 /mov dword ptr [ecx], 0 100026E4 \|. 83C1 0C \|add ecx, 0C 100026E7 \|. 4A \|dec edx 100026E8 \|.^ 75 F4 \jnz short 100026DE 100026EA \|> 8B00 mov eax, dword ptr [eax] 100026EC \|. 8B0D CC630010 mov ecx, dword ptr [100063CC] 100026F2 \|. 3D 8E0000C0 cmp eax, C000008E ; Switch (cases C000008D..C0000093) 100026F7 \|. 8BF1 mov esi, ecx 100026F9 \|. 75 07 jnz short 10002702 100026FB \|. B9 83000000 mov ecx, 83 ; Case C000008E (FLOAT DIVIDE BY ZERO) of switch 100026F2 10002700 \|. EB 52 jmp short 10002754 10002702 \|> 3D 900000C0 cmp eax, C0000090 10002707 \|. 75 07 jnz short 10002710 10002709 \|. B9 81000000 mov ecx, 81 ; Case C0000090 (FLOAT INVALID OPERATION) of switch 100026F2 1000270E \|. EB 44 jmp short 10002754 10002710 \|> 3D 910000C0 cmp eax, C0000091 10002715 \|. 75 07 jnz short 1000271E 10002717 \|. B9 84000000 mov ecx, 84 ; Case C0000091 (FLOAT OVERFLOW) of switch 100026F2 1000271C \|. EB 36 jmp short 10002754 1000271E \|> 3D 930000C0 cmp eax, C0000093 10002723 \|. 75 07 jnz short 1000272C 10002725 \|. B9 85000000 mov ecx, 85 ; Case C0000093 (FLOAT UNDERFLOW) of switch 100026F2 1000272A \|. EB 28 jmp short 10002754 1000272C \|> 3D 8D0000C0 cmp eax, C000008D 10002731 \|. 75 07 jnz short 1000273A 10002733 \|. B9 82000000 mov ecx, 82 ; Case C000008D (FLOAT DENORMAL OPERAND) of switch 100026F2 10002738 \|. EB 1A jmp short 10002754 1000273A \|> 3D 8F0000C0 cmp eax, C000008F 1000273F \|. 75 07 jnz short 10002748 10002741 \|. B9 86000000 mov ecx, 86 ; Case C000008F (FLOAT INEXACT RESULT) of switch 100026F2 10002746 \|. EB 0C jmp short 10002754 10002748 \|> 3D 920000C0 cmp eax, C0000092 1000274D \|. 75 0B jnz short 1000275A 1000274F \|. B9 8A000000 mov ecx, 8A ; Case C0000092 (FLOAT STACK CHECK) of switch 100026F2 10002754 \|> 890D CC630010 mov dword ptr [100063CC], ecx 1000275A \|> 51 push ecx ; Default case of switch 100026F2 1000275B \|. 6A 08 push 8 1000275D \|. FFD3 call ebx 1000275F \|. 83C4 08 add esp, 8 10002762 \|. 8935 CC630010 mov dword ptr [100063CC], esi 10002768 \|. 892D 58870010 mov dword ptr [10008758], ebp 1000276E \|. 83C8 FF or eax, FFFFFFFF 10002771 \|. 5E pop esi 10002772 \|. 5D pop ebp 10002773 \|. 5B pop ebx 10002774 \|. C3 retn 10002775 \|> 51 push ecx 10002776 \|. C740 08 00000>mov dword ptr [eax+8], 0 1000277D \|. FFD3 call ebx 1000277F \|. 83C4 04 add esp, 4 10002782 \|. 892D 58870010 mov dword ptr [10008758], ebp 10002788 \|. 83C8 FF or eax, FFFFFFFF 1000278B \|. 5E pop esi 1000278C \|. 5D pop ebp 1000278D \|. 5B pop ebx 1000278E \|. C3 retn 1000278F \|> 8B5424 14 mov edx, dword ptr [esp+14] ; Case 0 of switch 1000267B 10002793 \|. 52 push edx ; /pExceptionInfo 10002794 \|. FF15 44500010 call dword ptr [<&KERNEL32.UnhandledE>; \UnhandledExceptionFilter 1000279A \|. 5E pop esi 1000279B \|. 5D pop ebp 1000279C \|. 5B pop ebx 1000279D \. C3 retn 1000279E 90 nop 1000279F 90 nop 100027A0 /$ 8B5424 04 mov edx, dword ptr [esp+4] 100027A4 \|. 8B0D 48630010 mov ecx, dword ptr [10006348] 100027AA \|. 56 push esi 100027AB \|. 8B35 C8630010 mov esi, dword ptr [100063C8] 100027B1 \|. 3BCA cmp ecx, edx 100027B3 \|. B8 48630010 mov eax, 10006348 100027B8 \|. 74 15 je short 100027CF 100027BA \|. 8D0C76 lea ecx, dword ptr [esi+esi2] 100027BD \|. 8D0C8D 486300>lea ecx, dword ptr [ecx4+10006348] 100027C4 \|> 83C0 0C /add eax, 0C 100027C7 \|. 3BC1 \|cmp eax, ecx 100027C9 \|. 73 04 \|jnb short 100027CF 100027CB \|. 3910 \|cmp dword ptr [eax], edx 100027CD \|.^ 75 F5 \jnz short 100027C4 100027CF \|> 8D0C76 lea ecx, dword ptr [esi+esi2] 100027D2 \|. 8D0C8D 486300>lea ecx, dword ptr [ecx4+10006348] 100027D9 \|. 3BC1 cmp eax, ecx 100027DB \|. 73 04 jnb short 100027E1 100027DD \|. 3910 cmp dword ptr [eax], edx 100027DF \|. 74 02 je short 100027E3 100027E1 \|> 33C0 xor eax, eax 100027E3 \|> 5E pop esi 100027E4 \. C3 retn 100027E5 90 nop 100027E6 90 nop 100027E7 90 nop 100027E8 90 nop 100027E9 90 nop 100027EA 90 nop 100027EB 90 nop 100027EC 90 nop 100027ED 90 nop 100027EE 90 nop 100027EF 90 nop 100027F0 /$ 51 push ecx 100027F1 \|. 8B15 BC840010 mov edx, dword ptr [100084BC] 100027F7 \|. 53 push ebx 100027F8 \|. 55 push ebp 100027F9 \|. 56 push esi 100027FA \|. 8A02 mov al, byte ptr [edx] 100027FC \|. 33F6 xor esi, esi 100027FE \|. 84C0 test al, al 10002800 \|. 57 push edi 10002801 \|. 74 1D je short 10002820 10002803 \|> 3C 3D /cmp al, 3D 10002805 \|. 74 01 \|je short 10002808 10002807 \|. 46 \|inc esi 10002808 \|> 8BFA \|mov edi, edx 1000280A \|. 83C9 FF \|or ecx, FFFFFFFF 1000280D \|. 33C0 \|xor eax, eax 1000280F \|. F2:AE \|repne scas byte ptr es:[edi] 10002811 \|. F7D1 \|not ecx 10002813 \|. 49 \|dec ecx 10002814 \|. 8A440A 01 \|mov al, byte ptr [edx+ecx+1] 10002818 \|. 8D540A 01 \|lea edx, dword ptr [edx+ecx+1] 1000281C \|. 84C0 \|test al, al 1000281E \|.^ 75 E3 \jnz short 10002803 10002820 \|> 8D04B5 040000>lea eax, dword ptr [esi4+4] 10002827 \|. 50 push eax 10002828 \|. E8 830D0000 call 100035B0 1000282D \|. 8BF0 mov esi, eax 1000282F \|. 83C4 04 add esp, 4 10002832 \|. 85F6 test esi, esi 10002834 \|. 897424 10 mov dword ptr [esp+10], esi 10002838 \|. 8935 34870010 mov dword ptr [10008734], esi 1000283E \|. 75 0A jnz short 1000284A 10002840 \|. 6A 09 push 9 10002842 \|. E8 89F4FFFF call 10001CD0 10002847 \|. 83C4 04 add esp, 4 1000284A \|> 8B2D BC840010 mov ebp, dword ptr [100084BC] 10002850 \|. 8A55 00 mov dl, byte ptr [ebp] 10002853 \|. 84D2 test dl, dl 10002855 \|. 74 63 je short 100028BA 10002857 \|> 8BFD /mov edi, ebp 10002859 \|. 83C9 FF \|or ecx, FFFFFFFF 1000285C \|. 33C0 \|xor eax, eax 1000285E \|. F2:AE \|repne scas byte ptr es:[edi] 10002860 \|. F7D1 \|not ecx 10002862 \|. 49 \|dec ecx 10002863 \|. 8BD9 \|mov ebx, ecx 10002865 \|. 43 \|inc ebx 10002866 \|. 80FA 3D \|cmp dl, 3D 10002869 \|. 74 45 \|je short 100028B0 1000286B \|. 53 \|push ebx 1000286C \|. E8 3F0D0000 \|call 100035B0 10002871 \|. 83C4 04 \|add esp, 4 10002874 \|. 8906 \|mov dword ptr [esi], eax 10002876 \|. 85C0 \|test eax, eax 10002878 \|. 75 0A \|jnz short 10002884 1000287A \|. 6A 09 \|push 9 1000287C \|. E8 4FF4FFFF \|call 10001CD0 10002881 \|. 83C4 04 \|add esp, 4 10002884 \|> 8BFD \|mov edi, ebp 10002886 \|. 83C9 FF \|or ecx, FFFFFFFF 10002889 \|. 33C0 \|xor eax, eax 1000288B \|. F2:AE \|repne scas byte ptr es:[edi] 1000288D \|. 8B4424 10 \|mov eax, dword ptr [esp+10] 10002891 \|. F7D1 \|not ecx 10002893 \|. 2BF9 \|sub edi, ecx 10002895 \|. 8BD1 \|mov edx, ecx 10002897 \|. 8BF7 \|mov esi, edi 10002899 \|. 8B38 \|mov edi, dword ptr [eax] 1000289B \|. C1E9 02 \|shr ecx, 2 1000289E \|. F3:A5 \|rep movs dword ptr es:[edi], dword > 100028A0 \|. 8BCA \|mov ecx, edx 100028A2 \|. 83E1 03 \|and ecx, 3 100028A5 \|. 83C0 04 \|add eax, 4 100028A8 \|. F3:A4 \|rep movs byte ptr es:[edi], byte pt> 100028AA \|. 894424 10 \|mov dword ptr [esp+10], eax 100028AE \|. 8BF0 \|mov esi, eax 100028B0 \|> 8A541D 00 \|mov dl, byte ptr [ebp+ebx] 100028B4 \|. 03EB \|add ebp, ebx 100028B6 \|. 84D2 \|test dl, dl 100028B8 \|.^ 75 9D \jnz short 10002857 100028BA \|> A1 BC840010 mov eax, dword ptr [100084BC] 100028BF \|. 50 push eax 100028C0 \|. E8 9B0B0000 call 10003460 100028C5 \|. 83C4 04 add esp, 4 100028C8 \|. C705 BC840010>mov dword ptr [100084BC], 0 100028D2 \|. C706 00000000 mov dword ptr [esi], 0 100028D8 \|. 5F pop edi 100028D9 \|. 5E pop esi 100028DA \|. 5D pop ebp 100028DB \|. 5B pop ebx 100028DC \|. 59 pop ecx 100028DD \. C3 retn 100028DE 90 nop 100028DF 90 nop 100028E0 /$ 83EC 08 sub esp, 8 100028E3 \|. 56 push esi 100028E4 \|. 57 push edi 100028E5 \|. 68 04010000 push 104 ; /BufSize = 104 (260.) 100028EA \|. 68 60870010 push 10008760 ; \|PathBuffer = pjgl.10008760 100028EF \|. 6A 00 push 0 ; \|hModule = NULL 100028F1 \|. FF15 48500010 call dword ptr [<&KERNEL32.GetModuleF>; \GetModuleFileNameA 100028F7 \|. 8B3D B4890010 mov edi, dword ptr [100089B4] 100028FD \|. C705 44870010>mov dword ptr [10008744], 10008760 10002907 \|. 803F 00 cmp byte ptr [edi], 0 1000290A \|. 75 05 jnz short 10002911 1000290C \|. BF 60870010 mov edi, 10008760 10002911 \|> 8D4424 0C lea eax, dword ptr [esp+C] 10002915 \|. 8D4C24 08 lea ecx, dword ptr [esp+8] 10002919 \|. 50 push eax 1000291A \|. 51 push ecx 1000291B \|. 6A 00 push 0 1000291D \|. 6A 00 push 0 1000291F \|. 57 push edi 10002920 \|. E8 5B000000 call 10002980 10002925 \|. 8B5424 20 mov edx, dword ptr [esp+20] 10002929 \|. 8B4424 1C mov eax, dword ptr [esp+1C] 1000292D \|. 83C4 14 add esp, 14 10002930 \|. 8D0C82 lea ecx, dword ptr [edx+eax4] 10002933 \|. 51 push ecx 10002934 \|. E8 770C0000 call 100035B0 10002939 \|. 8BF0 mov esi, eax 1000293B \|. 83C4 04 add esp, 4 1000293E \|. 85F6 test esi, esi 10002940 \|. 75 0A jnz short 1000294C 10002942 \|. 6A 08 push 8 10002944 \|. E8 87F3FFFF call 10001CD0 10002949 \|. 83C4 04 add esp, 4 1000294C \|> 8B4C24 08 mov ecx, dword ptr [esp+8] 10002950 \|. 8D5424 0C lea edx, dword ptr [esp+C] 10002954 \|. 52 push edx 10002955 \|. 8D4424 0C lea eax, dword ptr [esp+C] 10002959 \|. 8D148E lea edx, dword ptr [esi+ecx4] 1000295C \|. 50 push eax 1000295D \|. 52 push edx 1000295E \|. 56 push esi 1000295F \|. 57 push edi 10002960 \|. E8 1B000000 call 10002980 10002965 \|. 8B4424 1C mov eax, dword ptr [esp+1C] 10002969 \|. 83C4 14 add esp, 14 1000296C \|. 48 dec eax 1000296D \|. 8935 2C870010 mov dword ptr [1000872C], esi 10002973 \|. 5F pop edi 10002974 \|. A3 28870010 mov dword ptr [10008728], eax 10002979 \|. 5E pop esi 1000297A \|. 83C4 08 add esp, 8 1000297D \. C3 retn 1000297E 90 nop 1000297F 90 nop 10002980 /$ 8B4424 10 mov eax, dword ptr [esp+10] 10002984 \|. 53 push ebx 10002985 \|. 55 push ebp 10002986 \|. 8B6C24 10 mov ebp, dword ptr [esp+10] 1000298A \|. 56 push esi 1000298B \|. 8B7424 18 mov esi, dword ptr [esp+18] 1000298F \|. 57 push edi 10002990 \|. 8B7C24 24 mov edi, dword ptr [esp+24] 10002994 \|. 85ED test ebp, ebp 10002996 \|. C707 00000000 mov dword ptr [edi], 0 1000299C \|. C700 01000000 mov dword ptr [eax], 1 100029A2 \|. 8B4424 14 mov eax, dword ptr [esp+14] 100029A6 \|. BB 04000000 mov ebx, 4 100029AB \|. 74 09 je short 100029B6 100029AD \|. 8975 00 mov dword ptr [ebp], esi 100029B0 \|. 03EB add ebp, ebx 100029B2 \|. 896C24 18 mov dword ptr [esp+18], ebp 100029B6 \|> 8038 22 cmp byte ptr [eax], 22 100029B9 \|. 75 56 jnz short 10002A11 100029BB \|. 8A48 01 mov cl, byte ptr [eax+1] 100029BE \|. 40 inc eax 100029BF \|. 80F9 22 cmp cl, 22 100029C2 \|. 74 38 je short 100029FC 100029C4 \|> 84C9 /test cl, cl 100029C6 \|. 74 34 \|je short 100029FC 100029C8 \|. 81E1 FF000000 \|and ecx, 0FF 100029CE \|. 8499 C9840010 \|test byte ptr [ecx+100084C9], bl 100029D4 \|. 74 0F \|je short 100029E5 100029D6 \|. 8B17 \|mov edx, dword ptr [edi] 100029D8 \|. 42 \|inc edx 100029D9 \|. 85F6 \|test esi, esi 100029DB \|. 8917 \|mov dword ptr [edi], edx 100029DD \|. 74 06 \|je short 100029E5 100029DF \|. 8A08 \|mov cl, byte ptr [eax] 100029E1 \|. 880E \|mov byte ptr [esi], cl 100029E3 \|. 46 \|inc esi 100029E4 \|. 40 \|inc eax 100029E5 \|> 8B17 \|mov edx, dword ptr [edi] 100029E7 \|. 42 \|inc edx 100029E8 \|. 85F6 \|test esi, esi 100029EA \|. 8917 \|mov dword ptr [edi], edx 100029EC \|. 74 05 \|je short 100029F3 100029EE \|. 8A10 \|mov dl, byte ptr [eax] 100029F0 \|. 8816 \|mov byte ptr [esi], dl 100029F2 \|. 46 \|inc esi 100029F3 \|> 8A48 01 \|mov cl, byte ptr [eax+1] 100029F6 \|. 40 \|inc eax 100029F7 \|. 80F9 22 \|cmp cl, 22 100029FA \|.^ 75 C8 \jnz short 100029C4 100029FC \|> 8B17 mov edx, dword ptr [edi] 100029FE \|. 42 inc edx 100029FF \|. 85F6 test esi, esi 10002A01 \|. 8917 mov dword ptr [edi], edx 10002A03 \|. 74 04 je short 10002A09 10002A05 \|. C606 00 mov byte ptr [esi], 0 10002A08 \|. 46 inc esi 10002A09 \|> 8038 22 cmp byte ptr [eax], 22 10002A0C \|. 75 56 jnz short 10002A64 10002A0E \|. 40 inc eax 10002A0F \|. EB 53 jmp short 10002A64 10002A11 \|> 8B17 /mov edx, dword ptr [edi] ; Default case of switch 10002A47 10002A13 \|. 42 \|inc edx 10002A14 \|. 85F6 \|test esi, esi 10002A16 \|. 8917 \|mov dword ptr [edi], edx 10002A18 \|. 74 05 \|je short 10002A1F 10002A1A \|. 8A08 \|mov cl, byte ptr [eax] 10002A1C \|. 880E \|mov byte ptr [esi], cl 10002A1E \|. 46 \|inc esi 10002A1F \|> 8A08 \|mov cl, byte ptr [eax] 10002A21 \|. 40 \|inc eax 10002A22 \|. 884C24 24 \|mov byte ptr [esp+24], cl 10002A26 \|. 8B5424 24 \|mov edx, dword ptr [esp+24] 10002A2A \|. 81E2 FF000000 \|and edx, 0FF 10002A30 \|. 849A C9840010 \|test byte ptr [edx+100084C9], bl 10002A36 \|. 74 0F \|je short 10002A47 10002A38 \|. 8B17 \|mov edx, dword ptr [edi] 10002A3A \|. 42 \|inc edx 10002A3B \|. 85F6 \|test esi, esi 10002A3D \|. 8917 \|mov dword ptr [edi], edx 10002A3F \|. 74 05 \|je short 10002A46 10002A41 \|. 8A10 \|mov dl, byte ptr [eax] 10002A43 \|. 8816 \|mov byte ptr [esi], dl 10002A45 \|. 46 \|inc esi 10002A46 \|> 40 \|inc eax 10002A47 \|> 80F9 20 \|cmp cl, 20 ; Switch (cases 0..20) 10002A4A \|. 74 09 \|je short 10002A55 10002A4C \|. 84C9 \|test cl, cl 10002A4E \|. 74 09 \|je short 10002A59 10002A50 \|. 80F9 09 \|cmp cl, 9 10002A53 \|.^ 75 BC \jnz short 10002A11 10002A55 \|> 84C9 test cl, cl ; Cases 9 (TAB),20 (' ') of switch 10002A47 10002A57 \|. 75 03 jnz short 10002A5C 10002A59 \|> 48 dec eax ; Case 0 of switch 10002A47 10002A5A \|. EB 08 jmp short 10002A64 10002A5C \|> 85F6 test esi, esi 10002A5E \|. 74 04 je short 10002A64 10002A60 \|. C646 FF 00 mov byte ptr [esi-1], 0 10002A64 \|> 33D2 xor edx, edx 10002A66 \|. 895424 24 mov dword ptr [esp+24], edx 10002A6A \|> 8038 00 /cmp byte ptr [eax], 0 10002A6D \|. 0F84 03010000 \|je 10002B76 10002A73 \|> 8A08 \|/mov cl, byte ptr [eax] 10002A75 \|. 80F9 20 \|\|cmp cl, 20 10002A78 \|. 74 05 \|\|je short 10002A7F 10002A7A \|. 80F9 09 \|\|cmp cl, 9 10002A7D \|. 75 03 \|\|jnz short 10002A82 10002A7F \|> 40 \|\|inc eax 10002A80 \|.^ EB F1 \|\jmp short 10002A73 10002A82 \|> 8038 00 \|cmp byte ptr [eax], 0 10002A85 \|. 0F84 EB000000 \|je 10002B76 10002A8B \|. 85ED \|test ebp, ebp 10002A8D \|. 74 09 \|je short 10002A98 10002A8F \|. 8975 00 \|mov dword ptr [ebp], esi 10002A92 \|. 03EB \|add ebp, ebx 10002A94 \|. 896C24 18 \|mov dword ptr [esp+18], ebp 10002A98 \|> 8B4C24 20 \|mov ecx, dword ptr [esp+20] 10002A9C \|. FF01 \|inc dword ptr [ecx] 10002A9E \|> 8A18 \|/mov bl, byte ptr [eax] 10002AA0 \|. 33C9 \|\|xor ecx, ecx 10002AA2 \|. 80FB 5C \|\|cmp bl, 5C 10002AA5 \|. BD 01000000 \|\|mov ebp, 1 10002AAA \|. 75 0A \|\|jnz short 10002AB6 10002AAC \|> 8A58 01 \|\|/mov bl, byte ptr [eax+1] 10002AAF \|. 40 \|\|\|inc eax 10002AB0 \|. 41 \|\|\|inc ecx 10002AB1 \|. 80FB 5C \|\|\|cmp bl, 5C 10002AB4 \|.^ 74 F6 \|\|\je short 10002AAC 10002AB6 \|> 8038 22 \|\|cmp byte ptr [eax], 22 10002AB9 \|. 75 25 \|\|jnz short 10002AE0 10002ABB \|. F6C1 01 \|\|test cl, 1 10002ABE \|. 75 1E \|\|jnz short 10002ADE 10002AC0 \|. 85D2 \|\|test edx, edx 10002AC2 \|. 74 09 \|\|je short 10002ACD 10002AC4 \|. 8078 01 22 \|\|cmp byte ptr [eax+1], 22 10002AC8 \|. 75 03 \|\|jnz short 10002ACD 10002ACA \|. 40 \|\|inc eax 10002ACB \|. EB 02 \|\|jmp short 10002ACF 10002ACD \|> 33ED \|\|xor ebp, ebp 10002ACF \|> 8B5C24 24 \|\|mov ebx, dword ptr [esp+24] 10002AD3 \|. 33D2 \|\|xor edx, edx 10002AD5 \|. 85DB \|\|test ebx, ebx 10002AD7 \|. 0F94C2 \|\|sete dl 10002ADA \|. 895424 24 \|\|mov dword ptr [esp+24], edx 10002ADE \|> D1E9 \|\|shr ecx, 1 10002AE0 \|> 8BD9 \|\|mov ebx, ecx 10002AE2 \|. 49 \|\|dec ecx 10002AE3 \|. 85DB \|\|test ebx, ebx 10002AE5 \|. 74 11 \|\|je short 10002AF8 10002AE7 \|. 41 \|\|inc ecx 10002AE8 \|> 85F6 \|\|/test esi, esi 10002AEA \|. 74 04 \|\|\|je short 10002AF0 10002AEC \|. C606 5C \|\|\|mov byte ptr [esi], 5C 10002AEF \|. 46 \|\|\|inc esi 10002AF0 \|> 8B1F \|\|\|mov ebx, dword ptr [edi] 10002AF2 \|. 43 \|\|\|inc ebx 10002AF3 \|. 49 \|\|\|dec ecx 10002AF4 \|. 891F \|\|\|mov dword ptr [edi], ebx 10002AF6 \|.^ 75 F0 \|\|\jnz short 10002AE8 10002AF8 \|> 8A08 \|\|mov cl, byte ptr [eax] 10002AFA \|. 84C9 \|\|test cl, cl 10002AFC \|. 74 5D \|\|je short 10002B5B 10002AFE \|. 85D2 \|\|test edx, edx 10002B00 \|. 75 0A \|\|jnz short 10002B0C 10002B02 \|. 80F9 20 \|\|cmp cl, 20 10002B05 \|. 74 54 \|\|je short 10002B5B 10002B07 \|. 80F9 09 \|\|cmp cl, 9 10002B0A \|. 74 4F \|\|je short 10002B5B 10002B0C \|> 85ED \|\|test ebp, ebp 10002B0E \|. 74 45 \|\|je short 10002B55 10002B10 \|. 85F6 \|\|test esi, esi 10002B12 \|. 74 2A \|\|je short 10002B3E 10002B14 \|. 8BD9 \|\|mov ebx, ecx 10002B16 \|. 81E3 FF000000 \|\|and ebx, 0FF 10002B1C \|. F683 C9840010>\|\|test byte ptr [ebx+100084C9], 4 10002B23 \|. 74 09 \|\|je short 10002B2E 10002B25 \|. 880E \|\|mov byte ptr [esi], cl 10002B27 \|. 8B0F \|\|mov ecx, dword ptr [edi] 10002B29 \|. 46 \|\|inc esi 10002B2A \|. 40 \|\|inc eax 10002B2B \|. 41 \|\|inc ecx 10002B2C \|. 890F \|\|mov dword ptr [edi], ecx 10002B2E \|> 8A08 \|\|mov cl, byte ptr [eax] 10002B30 \|. 880E \|\|mov byte ptr [esi], cl 10002B32 \|. 8B0F \|\|mov ecx, dword ptr [edi] 10002B34 \|. 46 \|\|inc esi 10002B35 \|. 41 \|\|inc ecx 10002B36 \|. 890F \|\|mov dword ptr [edi], ecx 10002B38 \|. 40 \|\|inc eax 10002B39 \|.^ E9 60FFFFFF \|\|jmp 10002A9E 10002B3E \|> 81E1 FF000000 \|\|and ecx, 0FF 10002B44 \|. F681 C9840010>\|\|test byte ptr [ecx+100084C9], 4 10002B4B \|. 74 06 \|\|je short 10002B53 10002B4D \|. 8B0F \|\|mov ecx, dword ptr [edi] 10002B4F \|. 40 \|\|inc eax 10002B50 \|. 41 \|\|inc ecx 10002B51 \|. 890F \|\|mov dword ptr [edi], ecx 10002B53 \|> FF07 \|\|inc dword ptr [edi] 10002B55 \|> 40 \|\|inc eax 10002B56 \|.^ E9 43FFFFFF \|\jmp 10002A9E 10002B5B \|> 85F6 \|test esi, esi 10002B5D \|. 74 04 \|je short 10002B63 10002B5F \|. C606 00 \|mov byte ptr [esi], 0 10002B62 \|. 46 \|inc esi 10002B63 \|> 8B0F \|mov ecx, dword ptr [edi] 10002B65 \|. 8B6C24 18 \|mov ebp, dword ptr [esp+18] 10002B69 \|. 41 \|inc ecx 10002B6A \|. BB 04000000 \|mov ebx, 4 10002B6F \|. 890F \|mov dword ptr [edi], ecx 10002B71 \|.^ E9 F4FEFFFF \jmp 10002A6A 10002B76 \|> 85ED test ebp, ebp 10002B78 \|. 74 07 je short 10002B81 10002B7A \|. C745 00 00000>mov dword ptr [ebp], 0 10002B81 \|> 8B4424 20 mov eax, dword ptr [esp+20] 10002B85 \|. 5F pop edi 10002B86 \|. 5E pop esi 10002B87 \|. 5D pop ebp 10002B88 \|. 8B08 mov ecx, dword ptr [eax] 10002B8A \|. 5B pop ebx 10002B8B \|. 41 inc ecx 10002B8C \|. 8908 mov dword ptr [eax], ecx 10002B8E \. C3 retn 10002B8F 90 nop 10002B90 /$ A1 68880010 mov eax, dword ptr [10008868] 10002B95 \|. 53 push ebx 10002B96 \|. 55 push ebp 10002B97 \|. 8B2D 54500010 mov ebp, dword ptr [<&KERNEL32.GetEn>; kernel32.GetEnvironmentStringsA 10002B9D \|. 56 push esi 10002B9E \|. 33F6 xor esi, esi 10002BA0 \|. 33DB xor ebx, ebx 10002BA2 \|. 57 push edi 10002BA3 \|. 8B3D 58500010 mov edi, dword ptr [<&KERNEL32.GetEn>; kernel32.GetEnvironmentStringsW 10002BA9 \|. 85C0 test eax, eax 10002BAB \|. 75 25 jnz short 10002BD2 10002BAD \|. FFD7 call edi ; [GetEnvironmentStringsW 10002BAF \|. 8BF0 mov esi, eax 10002BB1 \|. 85F6 test esi, esi 10002BB3 \|. 74 07 je short 10002BBC 10002BB5 \|. B8 01000000 mov eax, 1 10002BBA \|. EB 11 jmp short 10002BCD 10002BBC \|> FFD5 call ebp 10002BBE \|. 8BD8 mov ebx, eax 10002BC0 \|. 85DB test ebx, ebx 10002BC2 \|. 0F84 17010000 je 10002CDF 10002BC8 \|. B8 02000000 mov eax, 2 10002BCD \|> A3 68880010 mov dword ptr [10008868], eax 10002BD2 \|> 83F8 01 cmp eax, 1 10002BD5 \|. 0F85 97000000 jnz 10002C72 10002BDB \|. 85F6 test esi, esi 10002BDD \|. 75 0C jnz short 10002BEB 10002BDF \|. FFD7 call edi 10002BE1 \|. 8BF0 mov esi, eax 10002BE3 \|. 85F6 test esi, esi 10002BE5 \|. 0F84 F4000000 je 10002CDF 10002BEB \|> 66:833E 00 cmp word ptr [esi], 0 10002BEF \|. 8BC6 mov eax, esi 10002BF1 \|. 74 12 je short 10002C05 10002BF3 \|> 83C0 02 /add eax, 2 10002BF6 \|. 66:8338 00 \|cmp word ptr [eax], 0 10002BFA \|.^ 75 F7 \|jnz short 10002BF3 10002BFC \|. 83C0 02 \|add eax, 2 10002BFF \|. 66:8338 00 \|cmp word ptr [eax], 0 10002C03 \|.^ 75 EE \jnz short 10002BF3 10002C05 \|> 2BC6 sub eax, esi 10002C07 \|. 6A 00 push 0 ; /pDefaultCharUsed = NULL 10002C09 \|. D1F8 sar eax, 1 ; \| 10002C0B \|. 40 inc eax ; \| 10002C0C \|. 6A 00 push 0 ; \|pDefaultChar = NULL 10002C0E \|. 8BE8 mov ebp, eax ; \| 10002C10 \|. 6A 00 push 0 ; \|MultiByteCount = 0 10002C12 \|. 6A 00 push 0 ; \|MultiByteStr = NULL 10002C14 \|. 55 push ebp ; \|WideCharCount 10002C15 \|. 56 push esi ; \|WideCharStr 10002C16 \|. 6A 00 push 0 ; \|Options = 0 10002C18 \|. 6A 00 push 0 ; \|CodePage = CP_ACP 10002C1A \|. FF15 30500010 call dword ptr [<&KERNEL32.WideCharTo>; \WideCharToMultiByte 10002C20 \|. 8BF8 mov edi, eax 10002C22 \|. 85FF test edi, edi 10002C24 \|. 74 3E je short 10002C64 10002C26 \|. 57 push edi 10002C27 \|. E8 84090000 call 100035B0 10002C2C \|. 8BD8 mov ebx, eax 10002C2E \|. 83C4 04 add esp, 4 10002C31 \|. 85DB test ebx, ebx 10002C33 \|. 74 2F je short 10002C64 10002C35 \|. 6A 00 push 0 ; /pDefaultCharUsed = NULL 10002C37 \|. 6A 00 push 0 ; \|pDefaultChar = NULL 10002C39 \|. 57 push edi ; \|MultiByteCount 10002C3A \|. 53 push ebx ; \|MultiByteStr 10002C3B \|. 55 push ebp ; \|WideCharCount 10002C3C \|. 56 push esi ; \|WideCharStr 10002C3D \|. 6A 00 push 0 ; \|Options = 0 10002C3F \|. 6A 00 push 0 ; \|CodePage = CP_ACP 10002C41 \|. FF15 30500010 call dword ptr [<&KERNEL32.WideCharTo>; \WideCharToMultiByte 10002C47 \|. 85C0 test eax, eax 10002C49 \|. 75 0B jnz short 10002C56 10002C4B \|. 53 push ebx 10002C4C \|. E8 0F080000 call 10003460 10002C51 \|. 83C4 04 add esp, 4 10002C54 \|. 33DB xor ebx, ebx 10002C56 \|> 56 push esi ; /EnvironmentBlock 10002C57 \|. FF15 04500010 call dword ptr [<&KERNEL32.FreeEnviro>; \FreeEnvironmentStringsW 10002C5D \|. 8BC3 mov eax, ebx 10002C5F \|. 5F pop edi 10002C60 \|. 5E pop esi 10002C61 \|. 5D pop ebp 10002C62 \|. 5B pop ebx 10002C63 \|. C3 retn 10002C64 \|> 56 push esi ; /EnvironmentBlock 10002C65 \|. FF15 04500010 call dword ptr [<&KERNEL32.FreeEnviro>; \FreeEnvironmentStringsW 10002C6B \|. 33C0 xor eax, eax 10002C6D \|. 5F pop edi 10002C6E \|. 5E pop esi 10002C6F \|. 5D pop ebp 10002C70 \|. 5B pop ebx 10002C71 \|. C3 retn 10002C72 \|> 83F8 02 cmp eax, 2 10002C75 \|. 75 68 jnz short 10002CDF 10002C77 \|. 85DB test ebx, ebx 10002C79 \|. 75 08 jnz short 10002C83 10002C7B \|. FFD5 call ebp 10002C7D \|. 8BD8 mov ebx, eax 10002C7F \|. 85DB test ebx, ebx 10002C81 \|. 74 5C je short 10002CDF 10002C83 \|> 8A0B mov cl, byte ptr [ebx] 10002C85 \|. 8BC3 mov eax, ebx 10002C87 \|. 84C9 test cl, cl 10002C89 \|. 74 10 je short 10002C9B 10002C8B \|> 8A48 01 /mov cl, byte ptr [eax+1] 10002C8E \|. 40 \|inc eax 10002C8F \|. 84C9 \|test cl, cl 10002C91 \|.^ 75 F8 \|jnz short 10002C8B 10002C93 \|. 8A48 01 \|mov cl, byte ptr [eax+1] 10002C96 \|. 40 \|inc eax 10002C97 \|. 84C9 \|test cl, cl 10002C99 \|.^ 75 F0 \jnz short 10002C8B 10002C9B \|> 2BC3 sub eax, ebx 10002C9D \|. 40 inc eax 10002C9E \|. 8BF0 mov esi, eax 10002CA0 \|. 56 push esi 10002CA1 \|. E8 0A090000 call 100035B0 10002CA6 \|. 8BE8 mov ebp, eax 10002CA8 \|. 83C4 04 add esp, 4 10002CAB \|. 85ED test ebp, ebp 10002CAD \|. 75 0E jnz short 10002CBD 10002CAF \|. 53 push ebx ; /EnvironmentBlock 10002CB0 \|. FF15 00500010 call dword ptr [<&KERNEL32.FreeEnviro>; \FreeEnvironmentStringsA 10002CB6 \|. 33C0 xor eax, eax 10002CB8 \|. 5F pop edi 10002CB9 \|. 5E pop esi 10002CBA \|. 5D pop ebp 10002CBB \|. 5B pop ebx 10002CBC \|. C3 retn 10002CBD \|> 8BCE mov ecx, esi 10002CBF \|. 8BF3 mov esi, ebx 10002CC1 \|. 8BC1 mov eax, ecx 10002CC3 \|. 8BFD mov edi, ebp 10002CC5 \|. C1E9 02 shr ecx, 2 10002CC8 \|. F3:A5 rep movs dword ptr es:[edi], dword p> 10002CCA \|. 8BC8 mov ecx, eax 10002CCC \|. 53 push ebx ; /EnvironmentBlock 10002CCD \|. 83E1 03 and ecx, 3 ; \| 10002CD0 \|. F3:A4 rep movs byte ptr es:[edi], byte ptr>; \| 10002CD2 \|. FF15 00500010 call dword ptr [<&KERNEL32.FreeEnviro>; \FreeEnvironmentStringsA 10002CD8 \|. 8BC5 mov eax, ebp 10002CDA \|. 5F pop edi 10002CDB \|. 5E pop esi 10002CDC \|. 5D pop ebp 10002CDD \|. 5B pop ebx 10002CDE \|. C3 retn 10002CDF \|> 5F pop edi 10002CE0 \|. 5E pop esi 10002CE1 \|. 5D pop ebp 10002CE2 \|. 33C0 xor eax, eax 10002CE4 \|. 5B pop ebx 10002CE5 \. C3 retn 10002CE6 90 nop 10002CE7 90 nop 10002CE8 90 nop 10002CE9 90 nop 10002CEA 90 nop 10002CEB 90 nop 10002CEC 90 nop 10002CED 90 nop 10002CEE 90 nop 10002CEF 90 nop 10002CF0 /$ 83EC 48 sub esp, 48 10002CF3 \|. 53 push ebx 10002CF4 \|. 55 push ebp 10002CF5 \|. 56 push esi 10002CF6 \|. 57 push edi 10002CF7 \|. 68 00010000 push 100 10002CFC \|. E8 AF080000 call 100035B0 10002D01 \|. 8BF0 mov esi, eax 10002D03 \|. 83C4 04 add esp, 4 10002D06 \|. 85F6 test esi, esi 10002D08 \|. 75 0A jnz short 10002D14 10002D0A \|. 6A 1B push 1B 10002D0C \|. E8 BFEFFFFF call 10001CD0 10002D11 \|. 83C4 04 add esp, 4 10002D14 \|> 8D86 00010000 lea eax, dword ptr [esi+100] 10002D1A \|. 8935 A0880010 mov dword ptr [100088A0], esi 10002D20 \|. 3BF0 cmp esi, eax 10002D22 \|. C705 A0890010>mov dword ptr [100089A0], 20 10002D2C \|. B3 0A mov bl, 0A 10002D2E \|. 73 20 jnb short 10002D50 10002D30 \|> C646 04 00 /mov byte ptr [esi+4], 0 10002D34 \|. C706 FFFFFFFF \|mov dword ptr [esi], -1 10002D3A \|. 885E 05 \|mov byte ptr [esi+5], bl 10002D3D \|. 8B0D A0880010 \|mov ecx, dword ptr [100088A0] 10002D43 \|. 83C6 08 \|add esi, 8 10002D46 \|. 81C1 00010000 \|add ecx, 100 10002D4C \|. 3BF1 \|cmp esi, ecx 10002D4E \|.^ 72 E0 \jb short 10002D30 10002D50 \|> 8D5424 14 lea edx, dword ptr [esp+14] 10002D54 \|. 52 push edx ; /pStartupinfo 10002D55 \|. FF15 18500010 call dword ptr [<&KERNEL32.GetStartup>; \GetStartupInfoA 10002D5B \|. 66:837C24 46 >cmp word ptr [esp+46], 0 10002D61 \|. 0F84 F2000000 je 10002E59 10002D67 \|. 8B4424 48 mov eax, dword ptr [esp+48] 10002D6B \|. 85C0 test eax, eax 10002D6D \|. 0F84 E6000000 je 10002E59 10002D73 \|. 8B08 mov ecx, dword ptr [eax] 10002D75 \|. 8D78 04 lea edi, dword ptr [eax+4] 10002D78 \|. 81F9 00080000 cmp ecx, 800 10002D7E \|. 894C24 10 mov dword ptr [esp+10], ecx 10002D82 \|. 8D2C0F lea ebp, dword ptr [edi+ecx] 10002D85 \|. 7C 08 jl short 10002D8F 10002D87 \|. C74424 10 000>mov dword ptr [esp+10], 800 10002D8F \|> 8B4424 10 mov eax, dword ptr [esp+10] 10002D93 \|. 8B0D A0890010 mov ecx, dword ptr [100089A0] 10002D99 \|. 3BC8 cmp ecx, eax 10002D9B \|. 7D 69 jge short 10002E06 10002D9D \|. BE A4880010 mov esi, 100088A4 10002DA2 \|> 68 00010000 /push 100 10002DA7 \|. E8 04080000 \|call 100035B0 10002DAC \|. 83C4 04 \|add esp, 4 10002DAF \|. 85C0 \|test eax, eax 10002DB1 \|. 74 49 \|je short 10002DFC 10002DB3 \|. 8B0D A0890010 \|mov ecx, dword ptr [100089A0] 10002DB9 \|. 8906 \|mov dword ptr [esi], eax 10002DBB \|. 83C1 20 \|add ecx, 20 10002DBE \|. 890D A0890010 \|mov dword ptr [100089A0], ecx 10002DC4 \|. 8D88 00010000 \|lea ecx, dword ptr [eax+100] 10002DCA \|. 3BC1 \|cmp eax, ecx 10002DCC \|. 73 1C \|jnb short 10002DEA 10002DCE \|> C640 04 00 \|/mov byte ptr [eax+4], 0 10002DD2 \|. C700 FFFFFFFF \|\|mov dword ptr [eax], -1 10002DD8 \|. 8858 05 \|\|mov byte ptr [eax+5], bl 10002DDB \|. 8B16 \|\|mov edx, dword ptr [esi] 10002DDD \|. 83C0 08 \|\|add eax, 8 10002DE0 \|. 81C2 00010000 \|\|add edx, 100 10002DE6 \|. 3BC2 \|\|cmp eax, edx 10002DE8 \|.^ 72 E4 \|\jb short 10002DCE 10002DEA \|> A1 A0890010 \|mov eax, dword ptr [100089A0] 10002DEF \|. 8B4C24 10 \|mov ecx, dword ptr [esp+10] 10002DF3 \|. 83C6 04 \|add esi, 4 10002DF6 \|. 3BC1 \|cmp eax, ecx 10002DF8 \|.^ 7C A8 \jl short 10002DA2 10002DFA \|. EB 0A jmp short 10002E06 10002DFC \|> 8B0D A0890010 mov ecx, dword ptr [100089A0] 10002E02 \|. 894C24 10 mov dword ptr [esp+10], ecx 10002E06 \|> 8B4424 10 mov eax, dword ptr [esp+10] 10002E0A \|. 33F6 xor esi, esi 10002E0C \|. 85C0 test eax, eax 10002E0E \|. 7E 49 jle short 10002E59 10002E10 \|> 8B4D 00 /mov ecx, dword ptr [ebp] 10002E13 \|. 83F9 FF \|cmp ecx, -1 10002E16 \|. 74 34 \|je short 10002E4C 10002E18 \|. 8A07 \|mov al, byte ptr [edi] 10002E1A \|. A8 01 \|test al, 1 10002E1C \|. 74 2E \|je short 10002E4C 10002E1E \|. A8 08 \|test al, 8 10002E20 \|. 75 0B \|jnz short 10002E2D 10002E22 \|. 51 \|push ecx ; /hFile 10002E23 \|. FF15 64500010 \|call dword ptr [<&KERNEL32.GetFileTy>; \GetFileType 10002E29 \|. 85C0 \|test eax, eax 10002E2B \|. 74 1F \|je short 10002E4C 10002E2D \|> 8BD6 \|mov edx, esi 10002E2F \|. 8BC6 \|mov eax, esi 10002E31 \|. C1FA 05 \|sar edx, 5 10002E34 \|. 83E0 1F \|and eax, 1F 10002E37 \|. 8B0C95 A08800>\|mov ecx, dword ptr [edx4+100088A0] 10002E3E \|. 8B55 00 \|mov edx, dword ptr [ebp] 10002E41 \|. 8914C1 \|mov dword ptr [ecx+eax8], edx 10002E44 \|. 8D04C1 \|lea eax, dword ptr [ecx+eax8] 10002E47 \|. 8A0F \|mov cl, byte ptr [edi] 10002E49 \|. 8848 04 \|mov byte ptr [eax+4], cl 10002E4C \|> 8B4424 10 \|mov eax, dword ptr [esp+10] 10002E50 \|. 46 \|inc esi 10002E51 \|. 47 \|inc edi 10002E52 \|. 83C5 04 \|add ebp, 4 10002E55 \|. 3BF0 \|cmp esi, eax 10002E57 \|.^ 7C B7 \jl short 10002E10 10002E59 \|> 8B2D 60500010 mov ebp, dword ptr [<&KERNEL32.GetSt>; kernel32.GetStdHandle 10002E5F \|. 33DB xor ebx, ebx 10002E61 \|> 8B15 A0880010 /mov edx, dword ptr [100088A0] 10002E67 \|. 8B04DA \|mov eax, dword ptr [edx+ebx8] 10002E6A \|. 8D34DA \|lea esi, dword ptr [edx+ebx8] 10002E6D \|. 83F8 FF \|cmp eax, -1 10002E70 \|. 75 54 \|jnz short 10002EC6 10002E72 \|. 85DB \|test ebx, ebx 10002E74 \|. C646 04 81 \|mov byte ptr [esi+4], 81 10002E78 \|. 75 07 \|jnz short 10002E81 10002E7A \|. B8 F6FFFFFF \|mov eax, -0A 10002E7F \|. EB 0A \|jmp short 10002E8B 10002E81 \|> 8BC3 \|mov eax, ebx 10002E83 \|. 48 \|dec eax 10002E84 \|. F7D8 \|neg eax 10002E86 \|. 1BC0 \|sbb eax, eax 10002E88 \|. 83C0 F5 \|add eax, -0B 10002E8B \|> 50 \|push eax 10002E8C \|. FFD5 \|call ebp 10002E8E \|. 8BF8 \|mov edi, eax 10002E90 \|. 83FF FF \|cmp edi, -1 10002E93 \|. 74 2A \|je short 10002EBF 10002E95 \|. 57 \|push edi ; /hFile 10002E96 \|. FF15 64500010 \|call dword ptr [<&KERNEL32.GetFileTy>; \GetFileType 10002E9C \|. 85C0 \|test eax, eax 10002E9E \|. 74 1F \|je short 10002EBF 10002EA0 \|. 25 FF000000 \|and eax, 0FF 10002EA5 \|. 893E \|mov dword ptr [esi], edi 10002EA7 \|. 83F8 02 \|cmp eax, 2 10002EAA \|. 75 07 \|jnz short 10002EB3 10002EAC \|. 8A46 04 \|mov al, byte ptr [esi+4] 10002EAF \|. 0C 40 \|or al, 40 10002EB1 \|. EB 18 \|jmp short 10002ECB 10002EB3 \|> 83F8 03 \|cmp eax, 3 10002EB6 \|. 75 16 \|jnz short 10002ECE 10002EB8 \|. 8A46 04 \|mov al, byte ptr [esi+4] 10002EBB \|. 0C 08 \|or al, 8 10002EBD \|. EB 0C \|jmp short 10002ECB 10002EBF \|> 8A46 04 \|mov al, byte ptr [esi+4] 10002EC2 \|. 0C 40 \|or al, 40 10002EC4 \|. EB 05 \|jmp short 10002ECB 10002EC6 \|> 8A46 04 \|mov al, byte ptr [esi+4] 10002EC9 \|. 0C 80 \|or al, 80 10002ECB \|> 8846 04 \|mov byte ptr [esi+4], al 10002ECE \|> 43 \|inc ebx 10002ECF \|. 83FB 03 \|cmp ebx, 3 10002ED2 \|.^ 7C 8D \jl short 10002E61 10002ED4 \|. A1 A0890010 mov eax, dword ptr [100089A0] 10002ED9 \|. 50 push eax ; /nHandles => 0 10002EDA \|. FF15 5C500010 call dword ptr [<&KERNEL32.SetHandleC>; \SetHandleCount 10002EE0 \|. 5F pop edi 10002EE1 \|. 5E pop esi 10002EE2 \|. 5D pop ebp 10002EE3 \|. 5B pop ebx 10002EE4 \|. 83C4 48 add esp, 48 10002EE7 \. C3 retn 10002EE8 90 nop 10002EE9 90 nop 10002EEA 90 nop 10002EEB 90 nop 10002EEC 90 nop 10002EED 90 nop 10002EEE 90 nop 10002EEF 90 nop 10002EF0 /$ 6A 00 push 0 ; /MaximumSize = 0 10002EF2 \|. 68 00100000 push 1000 ; \|InitialSize = 1000 (4096.) 10002EF7 \|. 6A 01 push 1 ; \|Flags = HEAP_NO_SERIALIZE 10002EF9 \|. FF15 6C500010 call dword ptr [<&KERNEL32.HeapCreate>; \HeapCreate 10002EFF \|. 85C0 test eax, eax 10002F01 \|. A3 90880010 mov dword ptr [10008890], eax 10002F06 \|. 75 01 jnz short 10002F09 10002F08 \|. C3 retn 10002F09 \|> E8 52070000 call 10003660 10002F0E \|. 85C0 test eax, eax 10002F10 \|. 75 0F jnz short 10002F21 10002F12 \|. A1 90880010 mov eax, dword ptr [10008890] 10002F17 \|. 50 push eax ; /hHeap => NULL 10002F18 \|. FF15 68500010 call dword ptr [<&KERNEL32.HeapDestro>; \HeapDestroy 10002F1E \|. 33C0 xor eax, eax 10002F20 \|. C3 retn 10002F21 \|> B8 01000000 mov eax, 1 10002F26 \. C3 retn 10002F27 90 nop 10002F28 90 nop 10002F29 90 nop 10002F2A 90 nop 10002F2B 90 nop 10002F2C 90 nop 10002F2D 90 nop 10002F2E 90 nop 10002F2F 90 nop 10002F30 /$ 55 push ebp 10002F31 \|. 8BEC mov ebp, esp 10002F33 \|. 53 push ebx 10002F34 \|. 56 push esi 10002F35 \|. 57 push edi 10002F36 \|. 55 push ebp 10002F37 \|. 6A 00 push 0 ; /_eax_value = 0 10002F39 \|. 6A 00 push 0 ; \|pExcptRec = NULL 10002F3B \|. 68 482F0010 push 10002F48 ; \|ReturnAddr = pjgl.10002F48 10002F40 \|. FF75 08 push dword ptr [ebp+8] ; \|pRegistrationFrame 10002F43 \|. E8 C8120000 call <jmp.&KERNEL32.RtlUnwind> ; \RtlUnwind 10002F48 \|. 5D pop ebp 10002F49 \|. 5F pop edi 10002F4A \|. 5E pop esi 10002F4B \|. 5B pop ebx 10002F4C \|. 8BE5 mov esp, ebp 10002F4E \|. 5D pop ebp 10002F4F \. C3 retn 10002F50 /$ 8B4C24 04 mov ecx, dword ptr [esp+4] ; 结构异常处理程序 10002F54 \|. F741 04 06000>test dword ptr [ecx+4], 6 10002F5B \|. B8 01000000 mov eax, 1 10002F60 \|. 74 0F je short 10002F71 10002F62 \|. 8B4424 08 mov eax, dword ptr [esp+8] 10002F66 \|. 8B5424 10 mov edx, dword ptr [esp+10] 10002F6A \|. 8902 mov dword ptr [edx], eax 10002F6C \|. B8 03000000 mov eax, 3 10002F71 \> C3 retn 10002F72 /$ 53 push ebx 10002F73 \|. 56 push esi 10002F74 \|. 57 push edi 10002F75 \|. 8B4424 10 mov eax, dword ptr [esp+10] 10002F79 \|. 50 push eax 10002F7A \|. 6A FE push -2 10002F7C \|. 68 502F0010 push 10002F50 ; SE 处理程序安装 10002F81 \|. 64:FF35 00000>push dword ptr fs:[0] 10002F88 \|. 64:8925 00000>mov dword ptr fs:[0], esp 10002F8F \|> 8B4424 20 /mov eax, dword ptr [esp+20] 10002F93 \|. 8B58 08 \|mov ebx, dword ptr [eax+8] 10002F96 \|. 8B70 0C \|mov esi, dword ptr [eax+C] 10002F99 \|. 83FE FF \|cmp esi, -1 10002F9C \|. 74 2E \|je short 10002FCC 10002F9E \|. 3B7424 24 \|cmp esi, dword ptr [esp+24] 10002FA2 \|. 74 28 \|je short 10002FCC 10002FA4 \|. 8D3476 \|lea esi, dword ptr [esi+esi2] 10002FA7 \|. 8B0CB3 \|mov ecx, dword ptr [ebx+esi4] 10002FAA \|. 894C24 08 \|mov dword ptr [esp+8], ecx 10002FAE \|. 8948 0C \|mov dword ptr [eax+C], ecx 10002FB1 \|. 837CB3 04 00 \|cmp dword ptr [ebx+esi4+4], 0 10002FB6 \|. 75 12 \|jnz short 10002FCA 10002FB8 \|. 68 01010000 \|push 101 10002FBD \|. 8B44B3 08 \|mov eax, dword ptr [ebx+esi4+8] 10002FC1 \|. E8 40000000 \|call 10003006 10002FC6 \|. FF54B3 08 \|call dword ptr [ebx+esi4+8] 10002FCA \|>^ EB C3 \jmp short 10002F8F 10002FCC \|> 64:8F05 00000>pop dword ptr fs:[0] 10002FD3 \|. 83C4 0C add esp, 0C 10002FD6 \|. 5F pop edi 10002FD7 \|. 5E pop esi 10002FD8 \|. 5B pop ebx 10002FD9 \. C3 retn 10002FDA . 33C0 xor eax, eax 10002FDC . 64:8B0D 00000>mov ecx, dword ptr fs:[0] 10002FE3 . 8179 04 502F0>cmp dword ptr [ecx+4], 10002F50 ; 入口地址 10002FEA . 75 10 jnz short 10002FFC 10002FEC . 8B51 0C mov edx, dword ptr [ecx+C] 10002FEF . 8B52 0C mov edx, dword ptr [edx+C] 10002FF2 . 3951 08 cmp dword ptr [ecx+8], edx 10002FF5 . 75 05 jnz short 10002FFC 10002FF7 . B8 01000000 mov eax, 1 10002FFC > C3 retn 10002FFD . 53 push ebx 10002FFE . 51 push ecx 10002FFF . BB DC630010 mov ebx, 100063DC 10003004 . EB 0A jmp short 10003010 10003006 /$ 53 push ebx 10003007 \|. 51 push ecx 10003008 \|. BB DC630010 mov ebx, 100063DC 1000300D \|. 8B4D 08 mov ecx, dword ptr [ebp+8] 10003010 \|> 894B 08 mov dword ptr [ebx+8], ecx 10003013 \|. 8943 04 mov dword ptr [ebx+4], eax 10003016 \|. 896B 0C mov dword ptr [ebx+C], ebp 10003019 \|. 59 pop ecx 1000301A \|. 5B pop ebx 1000301B \. C2 0400 retn 4 1000301E CC int3 1000301F CC int3 10003020 56 db 56 ; CHAR 'V' 10003021 43 db 43 ; CHAR 'C' 10003022 32 db 32 ; CHAR '2' 10003023 30 db 30 ; CHAR '0' 10003024 58 db 58 ; CHAR 'X' 10003025 43 db 43 ; CHAR 'C' 10003026 30 db 30 ; CHAR '0' 10003027 30 db 30 ; CHAR '0' 10003028 /$ 55 push ebp ; 结构异常处理程序 10003029 \|. 8BEC mov ebp, esp 1000302B \|. 83EC 08 sub esp, 8 1000302E \|. 53 push ebx 1000302F \|. 56 push esi 10003030 \|. 57 push edi 10003031 \|. 55 push ebp 10003032 \|. FC cld 10003033 \|. 8B5D 0C mov ebx, dword ptr [ebp+C] 10003036 \|. 8B45 08 mov eax, dword ptr [ebp+8] 10003039 \|. F740 04 06000>test dword ptr [eax+4], 6 10003040 \|. 0F85 82000000 jnz 100030C8 10003046 \|. 8945 F8 mov dword ptr [ebp-8], eax 10003049 \|. 8B45 10 mov eax, dword ptr [ebp+10] 1000304C \|. 8945 FC mov dword ptr [ebp-4], eax 1000304F \|. 8D45 F8 lea eax, dword ptr [ebp-8] 10003052 \|. 8943 FC mov dword ptr [ebx-4], eax 10003055 \|. 8B73 0C mov esi, dword ptr [ebx+C] 10003058 \|. 8B7B 08 mov edi, dword ptr [ebx+8] 1000305B \|> 83FE FF /cmp esi, -1 1000305E \|. 74 61 \|je short 100030C1 10003060 \|. 8D0C76 \|lea ecx, dword ptr [esi+esi2] 10003063 \|. 837C8F 04 00 \|cmp dword ptr [edi+ecx4+4], 0 10003068 \|. 74 45 \|je short 100030AF 1000306A \|. 56 \|push esi 1000306B \|. 55 \|push ebp 1000306C \|. 8D6B 10 \|lea ebp, dword ptr [ebx+10] 1000306F \|. FF548F 04 \|call dword ptr [edi+ecx4+4] 10003073 \|. 5D \|pop ebp 10003074 \|. 5E \|pop esi 10003075 \|. 8B5D 0C \|mov ebx, dword ptr [ebp+C] 10003078 \|. 0BC0 \|or eax, eax 1000307A \|. 74 33 \|je short 100030AF 1000307C \|. 78 3C \|js short 100030BA 1000307E \|. 8B7B 08 \|mov edi, dword ptr [ebx+8] 10003081 \|. 53 \|push ebx 10003082 \|. E8 A9FEFFFF \|call 10002F30 10003087 \|. 83C4 04 \|add esp, 4 1000308A \|. 8D6B 10 \|lea ebp, dword ptr [ebx+10] 1000308D \|. 56 \|push esi 1000308E \|. 53 \|push ebx 1000308F \|. E8 DEFEFFFF \|call 10002F72 10003094 \|. 83C4 08 \|add esp, 8 10003097 \|. 8D0C76 \|lea ecx, dword ptr [esi+esi2] 1000309A \|. 6A 01 \|push 1 1000309C \|. 8B448F 08 \|mov eax, dword ptr [edi+ecx4+8] 100030A0 \|. E8 61FFFFFF \|call 10003006 100030A5 \|. 8B048F \|mov eax, dword ptr [edi+ecx4] 100030A8 \|. 8943 0C \|mov dword ptr [ebx+C], eax 100030AB \|. FF548F 08 \|call dword ptr [edi+ecx4+8] 100030AF \|> 8B7B 08 \|mov edi, dword ptr [ebx+8] 100030B2 \|. 8D0C76 \|lea ecx, dword ptr [esi+esi2] 100030B5 \|. 8B348F \|mov esi, dword ptr [edi+ecx4] 100030B8 \|.^ EB A1 \jmp short 1000305B 100030BA \|> B8 00000000 mov eax, 0 100030BF \|. EB 1C jmp short 100030DD 100030C1 \|> B8 01000000 mov eax, 1 100030C6 \|. EB 15 jmp short 100030DD 100030C8 \|> 55 push ebp 100030C9 \|. 8D6B 10 lea ebp, dword ptr [ebx+10] 100030CC \|. 6A FF push -1 100030CE \|. 53 push ebx 100030CF \|. E8 9EFEFFFF call 10002F72 100030D4 \|. 83C4 08 add esp, 8 100030D7 \|. 5D pop ebp 100030D8 \|. B8 01000000 mov eax, 1 100030DD \|> 5D pop ebp 100030DE \|. 5F pop edi 100030DF \|. 5E pop esi 100030E0 \|. 5B pop ebx 100030E1 \|. 8BE5 mov esp, ebp 100030E3 \|. 5D pop ebp 100030E4 \. C3 retn 100030E5 . 55 push ebp 100030E6 . 8B4C24 08 mov ecx, dword ptr [esp+8] 100030EA . 8B29 mov ebp, dword ptr [ecx] 100030EC . 8B41 1C mov eax, dword ptr [ecx+1C] 100030EF . 50 push eax 100030F0 . 8B41 18 mov eax, dword ptr [ecx+18] 100030F3 . 50 push eax 100030F4 . E8 79FEFFFF call 10002F72 100030F9 . 83C4 08 add esp, 8 100030FC . 5D pop ebp 100030FD . C2 0400 retn 4 10003100 /$ A1 C4840010 mov eax, dword ptr [100084C4] 10003105 \|. 83F8 01 cmp eax, 1 10003108 \|. 74 0D je short 10003117 1000310A \|. 85C0 test eax, eax 1000310C \|. 75 2E jnz short 1000313C 1000310E \|. 833D 34600010>cmp dword ptr [10006034], 1 10003115 \|. 75 25 jnz short 1000313C 10003117 \|> 68 FC000000 push 0FC 1000311C \|. E8 1F000000 call 10003140 10003121 \|. A1 6C880010 mov eax, dword ptr [1000886C] 10003126 \|. 83C4 04 add esp, 4 10003129 \|. 85C0 test eax, eax 1000312B \|. 74 02 je short 1000312F 1000312D \|. FFD0 call eax 1000312F \|> 68 FF000000 push 0FF 10003134 \|. E8 07000000 call 10003140 10003139 \|. 83C4 04 add esp, 4 1000313C \> C3 retn 1000313D 90 nop 1000313E 90 nop 1000313F 90 nop 10003140 /$ 8B4C24 04 mov ecx, dword ptr [esp+4] 10003144 \|. 81EC A8010000 sub esp, 1A8 1000314A \|. B8 F0630010 mov eax, 100063F0 1000314F \|. 53 push ebx 10003150 \|. 55 push ebp 10003151 \|. 56 push esi 10003152 \|. 57 push edi 10003153 \|. 33ED xor ebp, ebp 10003155 \|> 3B08 /cmp ecx, dword ptr [eax] 10003157 \|. 74 0B \|je short 10003164 10003159 \|. 83C0 08 \|add eax, 8 1000315C \|. 45 \|inc ebp 1000315D \|. 3D 80640010 \|cmp eax, 10006480 10003162 \|.^ 72 F1 \jb short 10003155 10003164 \|> 3B0CED F06300>cmp ecx, dword ptr [ebp8+100063F0] 1000316B \|. 0F85 9A010000 jnz 1000330B 10003171 \|. A1 C4840010 mov eax, dword ptr [100084C4] 10003176 \|. 83F8 01 cmp eax, 1 10003179 \|. 0F84 4E010000 je 100032CD 1000317F \|. 85C0 test eax, eax 10003181 \|. 75 0D jnz short 10003190 10003183 \|. 833D 34600010>cmp dword ptr [10006034], 1 1000318A \|. 0F84 3D010000 je 100032CD 10003190 \|> 81F9 FC000000 cmp ecx, 0FC 10003196 \|. 0F84 6F010000 je 1000330B 1000319C \|. 8D8424 B40000>lea eax, dword ptr [esp+B4] 100031A3 \|. 68 04010000 push 104 ; /BufSize = 104 (260.) 100031A8 \|. 50 push eax ; \|PathBuffer 100031A9 \|. 6A 00 push 0 ; \|hModule = NULL 100031AB \|. FF15 48500010 call dword ptr [<&KERNEL32.GetModuleF>; \GetModuleFileNameA 100031B1 \|. 85C0 test eax, eax 100031B3 \|. 75 16 jnz short 100031CB 100031B5 \|. B9 05000000 mov ecx, 5 100031BA \|. BE 8C530010 mov esi, 1000538C ; ASCII "<program name unknown>" 100031BF \|. 8DBC24 B40000>lea edi, dword ptr [esp+B4] 100031C6 \|. F3:A5 rep movs dword ptr es:[edi], dword p> 100031C8 \|. 66:A5 movs word ptr es:[edi], word ptr [esi> 100031CA \|. A4 movs byte ptr es:[edi], byte ptr [esi> 100031CB \|> 8DBC24 B40000>lea edi, dword ptr [esp+B4] 100031D2 \|. 83C9 FF or ecx, FFFFFFFF 100031D5 \|. 33C0 xor eax, eax 100031D7 \|. 8D9C24 B40000>lea ebx, dword ptr [esp+B4] 100031DE \|. F2:AE repne scas byte ptr es:[edi] 100031E0 \|. F7D1 not ecx 100031E2 \|. 83F9 3C cmp ecx, 3C 100031E5 \|. 76 2D jbe short 10003214 100031E7 \|. 8DBC24 B40000>lea edi, dword ptr [esp+B4] 100031EE \|. 83C9 FF or ecx, FFFFFFFF 100031F1 \|. F2:AE repne scas byte ptr es:[edi] 100031F3 \|. F7D1 not ecx 100031F5 \|. 49 dec ecx 100031F6 \|. 6A 03 push 3 100031F8 \|. 8BD9 mov ebx, ecx 100031FA \|. 8D8C24 B80000>lea ecx, dword ptr [esp+B8] 10003201 \|. 83E9 3B sub ecx, 3B 10003204 \|. 68 88530010 push 10005388 ; ASCII "..." 10003209 \|. 03D9 add ebx, ecx 1000320B \|. 53 push ebx 1000320C \|. E8 9F020000 call 100034B0 10003211 \|. 83C4 0C add esp, 0C 10003214 \|> B9 06000000 mov ecx, 6 10003219 \|. BE 6C530010 mov esi, 1000536C ; ASCII "Runtime Error!",LF,LF,"Program: " 1000321E \|. 8D7C24 14 lea edi, dword ptr [esp+14] 10003222 \|. 33C0 xor eax, eax 10003224 \|. F3:A5 rep movs dword ptr es:[edi], dword p> 10003226 \|. 66:A5 movs word ptr es:[edi], word ptr [esi> 10003228 \|. 83C9 FF or ecx, FFFFFFFF 1000322B \|. 8BFB mov edi, ebx 1000322D \|. F2:AE repne scas byte ptr es:[edi] 1000322F \|. F7D1 not ecx 10003231 \|. 2BF9 sub edi, ecx 10003233 \|. 8D5424 14 lea edx, dword ptr [esp+14] 10003237 \|. 8BD9 mov ebx, ecx 10003239 \|. 8BF7 mov esi, edi 1000323B \|. 83C9 FF or ecx, FFFFFFFF 1000323E \|. 8BFA mov edi, edx 10003240 \|. F2:AE repne scas byte ptr es:[edi] 10003242 \|. 8BCB mov ecx, ebx 10003244 \|. 4F dec edi 10003245 \|. C1E9 02 shr ecx, 2 10003248 \|. F3:A5 rep movs dword ptr es:[edi], dword p> 1000324A \|. 8BCB mov ecx, ebx 1000324C \|. 8D5424 14 lea edx, dword ptr [esp+14] 10003250 \|. 83E1 03 and ecx, 3 10003253 \|. 68 10200100 push 12010 10003258 \|. F3:A4 rep movs byte ptr es:[edi], byte ptr> 1000325A \|. BF 68530010 mov edi, 10005368 ; ASCII LF,LF 1000325F \|. 83C9 FF or ecx, FFFFFFFF 10003262 \|. F2:AE repne scas byte ptr es:[edi] 10003264 \|. F7D1 not ecx 10003266 \|. 2BF9 sub edi, ecx 10003268 \|. 68 40530010 push 10005340 ; ASCII "Microsoft Visual C++ Runtime Library" 1000326D \|. 8BF7 mov esi, edi 1000326F \|. 8BD9 mov ebx, ecx 10003271 \|. 8BFA mov edi, edx 10003273 \|. 83C9 FF or ecx, FFFFFFFF 10003276 \|. F2:AE repne scas byte ptr es:[edi] 10003278 \|. 8BCB mov ecx, ebx 1000327A \|. 4F dec edi 1000327B \|. C1E9 02 shr ecx, 2 1000327E \|. F3:A5 rep movs dword ptr es:[edi], dword p> 10003280 \|. 8BCB mov ecx, ebx 10003282 \|. 8D5424 1C lea edx, dword ptr [esp+1C] 10003286 \|. 83E1 03 and ecx, 3 10003289 \|. F3:A4 rep movs byte ptr es:[edi], byte ptr> 1000328B \|. 8B3CED F46300>mov edi, dword ptr [ebp8+100063F4] 10003292 \|. 83C9 FF or ecx, FFFFFFFF 10003295 \|. F2:AE repne scas byte ptr es:[edi] 10003297 \|. F7D1 not ecx 10003299 \|. 2BF9 sub edi, ecx 1000329B \|. 8BF7 mov esi, edi 1000329D \|. 8BD9 mov ebx, ecx 1000329F \|. 8BFA mov edi, edx 100032A1 \|. 83C9 FF or ecx, FFFFFFFF 100032A4 \|. F2:AE repne scas byte ptr es:[edi] 100032A6 \|. 8BCB mov ecx, ebx 100032A8 \|. 4F dec edi 100032A9 \|. C1E9 02 shr ecx, 2 100032AC \|. F3:A5 rep movs dword ptr es:[edi], dword p> 100032AE \|. 8BCB mov ecx, ebx 100032B0 \|. 8D4424 1C lea eax, dword ptr [esp+1C] 100032B4 \|. 83E1 03 and ecx, 3 100032B7 \|. 50 push eax 100032B8 \|. F3:A4 rep movs byte ptr es:[edi], byte ptr> 100032BA \|. E8 C10A0000 call 10003D80 100032BF \|. 83C4 0C add esp, 0C 100032C2 \|. 5F pop edi 100032C3 \|. 5E pop esi 100032C4 \|. 5D pop ebp 100032C5 \|. 5B pop ebx 100032C6 \|. 81C4 A8010000 add esp, 1A8 100032CC \|. C3 retn 100032CD \|> A1 A0880010 mov eax, dword ptr [100088A0] 100032D2 \|. 85C0 test eax, eax 100032D4 \|. 74 08 je short 100032DE 100032D6 \|. 8B70 10 mov esi, dword ptr [eax+10] 100032D9 \|. 83FE FF cmp esi, -1 100032DC \|. 75 0A jnz short 100032E8 100032DE \|> 6A F4 push -0C ; /DevType = STD_ERROR_HANDLE 100032E0 \|. FF15 60500010 call dword ptr [<&KERNEL32.GetStdHand>; \GetStdHandle 100032E6 \|. 8BF0 mov esi, eax 100032E8 \|> 8B14ED F46300>mov edx, dword ptr [ebp8+100063F4] 100032EF \|. 8D4C24 10 lea ecx, dword ptr [esp+10] 100032F3 \|. 6A 00 push 0 ; /pOverlapped = NULL 100032F5 \|. 51 push ecx ; \|pBytesWritten 100032F6 \|. 8BFA mov edi, edx ; \| 100032F8 \|. 83C9 FF or ecx, FFFFFFFF ; \| 100032FB \|. 33C0 xor eax, eax ; \| 100032FD \|. F2:AE repne scas byte ptr es:[edi] ; \| 100032FF \|. F7D1 not ecx ; \| 10003301 \|. 49 dec ecx ; \| 10003302 \|. 51 push ecx ; \|nBytesToWrite 10003303 \|. 52 push edx ; \|Buffer 10003304 \|. 56 push esi ; \|hFile 10003305 \|. FF15 74500010 call dword ptr [<&KERNEL32.WriteFile>>; \WriteFile 1000330B \|> 5F pop edi 1000330C \|. 5E pop esi 1000330D \|. 5D pop ebp 1000330E \|. 5B pop ebx 1000330F \|. 81C4 A8010000 add esp, 1A8 10003315 \. C3 retn 10003316 90 nop 10003317 90 nop 10003318 90 nop 10003319 90 nop 1000331A 90 nop 1000331B 90 nop 1000331C 90 nop 1000331D 90 nop 1000331E 90 nop 1000331F 90 nop 10003320 /$ 51 push ecx 10003321 \|. A1 74880010 mov eax, dword ptr [10008874] 10003326 \|. 53 push ebx 10003327 \|. 55 push ebp 10003328 \|. 56 push esi 10003329 \|. 8B35 78500010 mov esi, dword ptr [<&KERNEL32.GetSt>; kernel32.GetStringTypeA 1000332F \|. 57 push edi 10003330 \|. 33FF xor edi, edi 10003332 \|. 3BC7 cmp eax, edi 10003334 \|. 75 26 jnz short 1000335C 10003336 \|. 8D4424 12 lea eax, dword ptr [esp+12] 1000333A \|. 50 push eax ; /CharTypes 1000333B \|. 6A 01 push 1 ; \|SrcCount = 1 1000333D \|. 68 B0500010 push 100050B0 ; \|Source = "" 10003342 \|. 6A 01 push 1 ; \|InfoType = CT_CTYPE1 10003344 \|. FF15 7C500010 call dword ptr [<&KERNEL32.GetStringT>; \GetStringTypeW 1000334A \|. 85C0 test eax, eax 1000334C \|. 0F84 DA000000 je 1000342C 10003352 \|. B8 01000000 mov eax, 1 10003357 \|. A3 74880010 mov dword ptr [10008874], eax 1000335C \|> 83F8 02 cmp eax, 2 1000335F \|. 75 2A jnz short 1000338B 10003361 \|. 8B4424 2C mov eax, dword ptr [esp+2C] 10003365 \|. 3BC7 cmp eax, edi 10003367 \|. 75 05 jnz short 1000336E 10003369 \|. A1 F8860010 mov eax, dword ptr [100086F8] 1000336E \|> 8B5424 24 mov edx, dword ptr [esp+24] 10003372 \|. 8B4C24 20 mov ecx, dword ptr [esp+20] 10003376 \|. 52 push edx 10003377 \|. 8B5424 20 mov edx, dword ptr [esp+20] 1000337B \|. 51 push ecx 1000337C \|. 8B4C24 20 mov ecx, dword ptr [esp+20] 10003380 \|. 52 push edx 10003381 \|. 51 push ecx 10003382 \|. 50 push eax 10003383 \|. FFD6 call esi 10003385 \|. 5F pop edi 10003386 \|. 5E pop esi 10003387 \|. 5D pop ebp 10003388 \|. 5B pop ebx 10003389 \|. 59 pop ecx 1000338A \|. C3 retn 1000338B \|> 83F8 01 cmp eax, 1 1000338E \|. 0F85 92000000 jnz 10003426 10003394 \|. 8B5C24 28 mov ebx, dword ptr [esp+28] 10003398 \|. 897C24 2C mov dword ptr [esp+2C], edi 1000339C \|. 3BDF cmp ebx, edi 1000339E \|. 75 06 jnz short 100033A6 100033A0 \|. 8B1D 08870010 mov ebx, dword ptr [10008708] 100033A6 \|> 8B4424 30 mov eax, dword ptr [esp+30] 100033AA \|. 8B6C24 20 mov ebp, dword ptr [esp+20] 100033AE \|. 8B5424 1C mov edx, dword ptr [esp+1C] 100033B2 \|. 57 push edi ; /WideBufSize 100033B3 \|. F7D8 neg eax ; \| 100033B5 \|. 1BC0 sbb eax, eax ; \| 100033B7 \|. 57 push edi ; \|WideCharBuf 100033B8 \|. 83E0 08 and eax, 8 ; \| 100033BB \|. 55 push ebp ; \|StringSize 100033BC \|. 40 inc eax ; \| 100033BD \|. 52 push edx ; \|StringToMap 100033BE \|. 50 push eax ; \|Options 100033BF \|. 53 push ebx ; \|CodePage 100033C0 \|. FF15 2C500010 call dword ptr [<&KERNEL32.MultiByteT>; \MultiByteToWideChar 100033C6 \|. 8BF0 mov esi, eax 100033C8 \|. 85F6 test esi, esi 100033CA \|. 74 4B je short 10003417 100033CC \|. 56 push esi 100033CD \|. 6A 02 push 2 100033CF \|. E8 7C0D0000 call 10004150 100033D4 \|. 8BF8 mov edi, eax 100033D6 \|. 83C4 08 add esp, 8 100033D9 \|. 85FF test edi, edi 100033DB \|. 74 3A je short 10003417 100033DD \|. 8B4C24 1C mov ecx, dword ptr [esp+1C] 100033E1 \|. 56 push esi ; /WideBufSize 100033E2 \|. 57 push edi ; \|WideCharBuf 100033E3 \|. 55 push ebp ; \|StringSize 100033E4 \|. 51 push ecx ; \|StringToMap 100033E5 \|. 6A 01 push 1 ; \|Options = MB_PRECOMPOSED 100033E7 \|. 53 push ebx ; \|CodePage 100033E8 \|. FF15 2C500010 call dword ptr [<&KERNEL32.MultiByteT>; \MultiByteToWideChar 100033EE \|. 85C0 test eax, eax 100033F0 \|. 74 25 je short 10003417 100033F2 \|. 8B5424 24 mov edx, dword ptr [esp+24] 100033F6 \|. 52 push edx ; /CharTypes 100033F7 \|. 50 push eax ; \|SrcCount 100033F8 \|. 8B4424 20 mov eax, dword ptr [esp+20] ; \| 100033FC \|. 57 push edi ; \|Source 100033FD \|. 50 push eax ; \|InfoType 100033FE \|. FF15 7C500010 call dword ptr [<&KERNEL32.GetStringT>; \GetStringTypeW 10003404 \|. 57 push edi 10003405 \|. 8BF0 mov esi, eax 10003407 \|. E8 54000000 call 10003460 1000340C \|. 83C4 04 add esp, 4 1000340F \|. 8BC6 mov eax, esi 10003411 \|. 5F pop edi 10003412 \|. 5E pop esi 10003413 \|. 5D pop ebp 10003414 \|. 5B pop ebx 10003415 \|. 59 pop ecx 10003416 \|. C3 retn 10003417 \|> 8B7424 2C mov esi, dword ptr [esp+2C] 1000341B \|. 57 push edi 1000341C \|. E8 3F000000 call 10003460 10003421 \|. 83C4 04 add esp, 4 10003424 \|. 8BC6 mov eax, esi 10003426 \|> 5F pop edi 10003427 \|. 5E pop esi 10003428 \|. 5D pop ebp 10003429 \|. 5B pop ebx 1000342A \|. 59 pop ecx 1000342B \|. C3 retn 1000342C \|> 8D4C24 12 lea ecx, dword ptr [esp+12] 10003430 \|. 51 push ecx 10003431 \|. 6A 01 push 1 10003433 \|. 68 AC500010 push 100050AC 10003438 \|. 6A 01 push 1 1000343A \|. 57 push edi 1000343B \|. FFD6 call esi 1000343D \|. 85C0 test eax, eax 1000343F \|. 74 0F je short 10003450 10003441 \|. B8 02000000 mov eax, 2 10003446 \|. A3 74880010 mov dword ptr [10008874], eax 1000344B \|.^ E9 0CFFFFFF jmp 1000335C 10003450 \|> 5F pop edi 10003451 \|. 5E pop esi 10003452 \|. 5D pop ebp 10003453 \|. 33C0 xor eax, eax 10003455 \|. 5B pop ebx 10003456 \|. 59 pop ecx 10003457 \. C3 retn 10003458 90 nop 10003459 90 nop 1000345A 90 nop 1000345B 90 nop 1000345C 90 nop 1000345D 90 nop 1000345E 90 nop 1000345F 90 nop 10003460 /$ 51 push ecx 10003461 \|. 56 push esi 10003462 \|. 8B7424 0C mov esi, dword ptr [esp+C] 10003466 \|. 85F6 test esi, esi 10003468 \|. 74 3D je short 100034A7 1000346A \|. 8D4424 0C lea eax, dword ptr [esp+C] 1000346E \|. 8D4C24 04 lea ecx, dword ptr [esp+4] 10003472 \|. 50 push eax 10003473 \|. 51 push ecx 10003474 \|. 56 push esi 10003475 \|. E8 86040000 call 10003900 1000347A \|. 83C4 0C add esp, 0C 1000347D \|. 85C0 test eax, eax 1000347F \|. 74 16 je short 10003497 10003481 \|. 8B5424 0C mov edx, dword ptr [esp+C] 10003485 \|. 50 push eax 10003486 \|. 8B4424 08 mov eax, dword ptr [esp+8] 1000348A \|. 52 push edx 1000348B \|. 50 push eax 1000348C \|. E8 CF040000 call 10003960 10003491 \|. 83C4 0C add esp, 0C 10003494 \|. 5E pop esi 10003495 \|. 59 pop ecx 10003496 \|. C3 retn 10003497 \|> 8B0D 90880010 mov ecx, dword ptr [10008890] 1000349D \|. 56 push esi ; /pMemory 1000349E \|. 6A 00 push 0 ; \|Flags = 0 100034A0 \|. 51 push ecx ; \|hHeap => NULL 100034A1 \|. FF15 80500010 call dword ptr [<&KERNEL32.HeapFree>] ; \HeapFree 100034A7 \|> 5E pop esi 100034A8 \|. 59 pop ecx 100034A9 \. C3 retn 100034AA 90 nop 100034AB 90 nop 100034AC 90 nop 100034AD 90 nop 100034AE 90 nop 100034AF 90 nop 100034B0 /$ 8B4C24 0C mov ecx, dword ptr [esp+C] 100034B4 \|. 57 push edi 100034B5 \|. 85C9 test ecx, ecx 100034B7 \|. 74 7A je short 10003533 100034B9 \|. 56 push esi 100034BA \|. 53 push ebx 100034BB \|. 8BD9 mov ebx, ecx 100034BD \|. 8B7424 14 mov esi, dword ptr [esp+14] 100034C1 \|. F7C6 03000000 test esi, 3 100034C7 \|. 8B7C24 10 mov edi, dword ptr [esp+10] 100034CB \|. 75 07 jnz short 100034D4 100034CD \|. C1E9 02 shr ecx, 2 100034D0 \|. 75 6F jnz short 10003541 100034D2 \|. EB 21 jmp short 100034F5 100034D4 \|> 8A06 /mov al, byte ptr [esi] 100034D6 \|. 46 \|inc esi 100034D7 \|. 8807 \|mov byte ptr [edi], al 100034D9 \|. 47 \|inc edi 100034DA \|. 49 \|dec ecx 100034DB \|. 74 25 \|je short 10003502 100034DD \|. 84C0 \|test al, al 100034DF \|. 74 29 \|je short 1000350A 100034E1 \|. F7C6 03000000 \|test esi, 3 100034E7 \|.^ 75 EB \jnz short 100034D4 100034E9 \|. 8BD9 mov ebx, ecx 100034EB \|. C1E9 02 shr ecx, 2 100034EE \|. 75 51 jnz short 10003541 100034F0 \|> 83E3 03 and ebx, 3 100034F3 \|. 74 0D je short 10003502 100034F5 \|> 8A06 /mov al, byte ptr [esi] 100034F7 \|. 46 \|inc esi 100034F8 \|. 8807 \|mov byte ptr [edi], al 100034FA \|. 47 \|inc edi 100034FB \|. 84C0 \|test al, al 100034FD \|. 74 2F \|je short 1000352E 100034FF \|. 4B \|dec ebx 10003500 \|.^ 75 F3 \jnz short 100034F5 10003502 \|> 8B4424 10 mov eax, dword ptr [esp+10] 10003506 \|. 5B pop ebx 10003507 \|. 5E pop esi 10003508 \|. 5F pop edi 10003509 \|. C3 retn 1000350A \|> F7C7 03000000 test edi, 3 10003510 \|. 74 12 je short 10003524 10003512 \|> 8807 /mov byte ptr [edi], al 10003514 \|. 47 \|inc edi 10003515 \|. 49 \|dec ecx 10003516 \|. 0F84 8A000000 \|je 100035A6 1000351C \|. F7C7 03000000 \|test edi, 3 10003522 \|.^ 75 EE \jnz short 10003512 10003524 \|> 8BD9 mov ebx, ecx 10003526 \|. C1E9 02 shr ecx, 2 10003529 \|. 75 6C jnz short 10003597 1000352B \|> 8807 mov byte ptr [edi], al 1000352D \|. 47 inc edi 1000352E \|> 4B dec ebx 1000352F \|.^ 75 FA jnz short 1000352B 10003531 \|. 5B pop ebx 10003532 \|. 5E pop esi 10003533 \|> 8B4424 08 mov eax, dword ptr [esp+8] 10003537 \|. 5F pop edi 10003538 \|. C3 retn 10003539 \|> 8917 /mov dword ptr [edi], edx 1000353B \|. 83C7 04 \|add edi, 4 1000353E \|. 49 \|dec ecx 1000353F \|.^ 74 AF \|je short 100034F0 10003541 \|> BA FFFEFE7E mov edx, 7EFEFEFF 10003546 \|. 8B06 \|mov eax, dword ptr [esi] 10003548 \|. 03D0 \|add edx, eax 1000354A \|. 83F0 FF \|xor eax, FFFFFFFF 1000354D \|. 33C2 \|xor eax, edx 1000354F \|. 8B16 \|mov edx, dword ptr [esi] 10003551 \|. 83C6 04 \|add esi, 4 10003554 \|. A9 00010181 \|test eax, 81010100 10003559 \|.^ 74 DE \|je short 10003539 1000355B \|. 84D2 \|test dl, dl 1000355D \|. 74 2C \|je short 1000358B 1000355F \|. 84F6 \|test dh, dh 10003561 \|. 74 1E \|je short 10003581 10003563 \|. F7C2 0000FF00 \|test edx, 0FF0000 10003569 \|. 74 0C \|je short 10003577 1000356B \|. F7C2 000000FF \|test edx, FF000000 10003571 \|.^ 75 C6 \jnz short 10003539 10003573 \|. 8917 mov dword ptr [edi], edx 10003575 \|. EB 18 jmp short 1000358F 10003577 \|> 81E2 FFFF0000 and edx, 0FFFF 1000357D \|. 8917 mov dword ptr [edi], edx 1000357F \|. EB 0E jmp short 1000358F 10003581 \|> 81E2 FF000000 and edx, 0FF 10003587 \|. 8917 mov dword ptr [edi], edx 10003589 \|. EB 04 jmp short 1000358F 1000358B \|> 33D2 xor edx, edx 1000358D \|. 8917 mov dword ptr [edi], edx 1000358F \|> 83C7 04 add edi, 4 10003592 \|. 33C0 xor eax, eax 10003594 \|. 49 dec ecx 10003595 \|. 74 0A je short 100035A1 10003597 \|> 33C0 xor eax, eax 10003599 \|> 8907 /mov dword ptr [edi], eax 1000359B \|. 83C7 04 \|add edi, 4 1000359E \|. 49 \|dec ecx 1000359F \|.^ 75 F8 \jnz short 10003599 100035A1 \|> 83E3 03 and ebx, 3 100035A4 \|.^ 75 85 jnz short 1000352B 100035A6 \|> 8B4424 10 mov eax, dword ptr [esp+10] 100035AA \|. 5B pop ebx 100035AB \|. 5E pop esi 100035AC \|. 5F pop edi 100035AD \. C3 retn 100035AE CC int3 100035AF CC int3 100035B0 /$ A1 88880010 mov eax, dword ptr [10008888] 100035B5 \|. 8B4C24 04 mov ecx, dword ptr [esp+4] 100035B9 \|. 50 push eax 100035BA \|. 51 push ecx 100035BB \|. E8 10000000 call 100035D0 100035C0 \|. 83C4 08 add esp, 8 100035C3 \. C3 retn 100035C4 90 nop 100035C5 90 nop 100035C6 90 nop 100035C7 90 nop 100035C8 90 nop 100035C9 90 nop 100035CA 90 nop 100035CB 90 nop 100035CC 90 nop 100035CD 90 nop 100035CE 90 nop 100035CF 90 nop 100035D0 /$ 56 push esi 100035D1 \|. 8B7424 08 mov esi, dword ptr [esp+8] 100035D5 \|. 83FE E0 cmp esi, -20 100035D8 \|. 57 push edi 100035D9 \|. 77 34 ja short 1000360F 100035DB \|. 85F6 test esi, esi 100035DD \|. 75 05 jnz short 100035E4 100035DF \|. BE 01000000 mov esi, 1 100035E4 \|> 8B7C24 10 mov edi, dword ptr [esp+10] 100035E8 \|> 83FE E0 /cmp esi, -20 100035EB \|. 77 0B \|ja short 100035F8 100035ED \|. 56 \|push esi 100035EE \|. E8 2D000000 \|call 10003620 100035F3 \|. 83C4 04 \|add esp, 4 100035F6 \|. EB 02 \|jmp short 100035FA 100035F8 \|> 33C0 \|xor eax, eax 100035FA \|> 85C0 \|test eax, eax 100035FC \|. 75 13 \|jnz short 10003611 100035FE \|. 85FF \|test edi, edi 10003600 \|. 74 0F \|je short 10003611 10003602 \|. 56 \|push esi 10003603 \|. E8 E80B0000 \|call 100041F0 10003608 \|. 83C4 04 \|add esp, 4 1000360B \|. 85C0 \|test eax, eax 1000360D \|.^ 75 D9 \jnz short 100035E8 1000360F \|> 33C0 xor eax, eax 10003611 \|> 5F pop edi 10003612 \|. 5E pop esi 10003613 \. C3 retn 10003614 90 nop 10003615 90 nop 10003616 90 nop 10003617 90 nop 10003618 90 nop 10003619 90 nop 1000361A 90 nop 1000361B 90 nop 1000361C 90 nop 1000361D 90 nop 1000361E 90 nop 1000361F 90 nop 10003620 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10003624 \|. 56 push esi 10003625 \|. 8D70 0F lea esi, dword ptr [eax+F] 10003628 \|. A1 A4840010 mov eax, dword ptr [100084A4] 1000362D \|. 83E6 F0 and esi, FFFFFFF0 10003630 \|. 3BF0 cmp esi, eax 10003632 \|. 77 12 ja short 10003646 10003634 \|. 8BCE mov ecx, esi 10003636 \|. C1E9 04 shr ecx, 4 10003639 \|. 51 push ecx 1000363A \|. E8 81030000 call 100039C0 1000363F \|. 83C4 04 add esp, 4 10003642 \|. 85C0 test eax, eax 10003644 \|. 75 10 jnz short 10003656 10003646 \|> 8B15 90880010 mov edx, dword ptr [10008890] 1000364C \|. 56 push esi ; /dwBytes 1000364D \|. 6A 00 push 0 ; \|dwFlags = 0 1000364F \|. 52 push edx ; \|hHeap => NULL 10003650 \|. FF15 84500010 call dword ptr [<&KERNEL32.HeapAlloc>>; \RtlAllocateHeap 10003656 \|> 5E pop esi 10003657 \. C3 retn 10003658 90 nop 10003659 90 nop 1000365A 90 nop 1000365B 90 nop 1000365C 90 nop 1000365D 90 nop 1000365E 90 nop 1000365F 90 nop 10003660 /$ A1 90640010 mov eax, dword ptr [10006490] 10003665 \|. 55 push ebp 10003666 \|. 56 push esi 10003667 \|. 83F8 FF cmp eax, -1 1000366A \|. 57 push edi 1000366B \|. 75 07 jnz short 10003674 1000366D \|. BD 80640010 mov ebp, 10006480 10003672 \|. EB 1D jmp short 10003691 10003674 \|> A1 90880010 mov eax, dword ptr [10008890] 10003679 \|. 68 20200000 push 2020 ; /dwBytes = 2020 (8224.) 1000367E \|. 6A 00 push 0 ; \|dwFlags = 0 10003680 \|. 50 push eax ; \|hHeap => NULL 10003681 \|. FF15 84500010 call dword ptr [<&KERNEL32.HeapAlloc>>; \RtlAllocateHeap 10003687 \|. 8BE8 mov ebp, eax 10003689 \|. 85ED test ebp, ebp 1000368B \|. 0F84 2B010000 je 100037BC 10003691 \|> 8B3D 88500010 mov edi, dword ptr [<&KERNEL32.Virtu>; kernel32.VirtualAlloc 10003697 \|. 6A 04 push 4 ; /Protect = PAGE_READWRITE 10003699 \|. 68 00200000 push 2000 ; \|AllocationType = MEM_RESERVE 1000369E \|. 68 00004000 push 400000 ; \|Size = 400000 (4194304.) 100036A3 \|. 6A 00 push 0 ; \|Address = NULL 100036A5 \|. FFD7 call edi ; \VirtualAlloc 100036A7 \|. 8BF0 mov esi, eax 100036A9 \|. 85F6 test esi, esi 100036AB \|. 0F84 F4000000 je 100037A5 100036B1 \|. 6A 04 push 4 ; /Protect = PAGE_READWRITE 100036B3 \|. 68 00100000 push 1000 ; \|AllocationType = MEM_COMMIT 100036B8 \|. 68 00000100 push 10000 ; \|Size = 10000 (65536.) 100036BD \|. 56 push esi ; \|Address 100036BE \|. FFD7 call edi ; \VirtualAlloc 100036C0 \|. 85C0 test eax, eax 100036C2 \|. 0F84 CF000000 je 10003797 100036C8 \|. 81FD 80640010 cmp ebp, 10006480 100036CE \|. 75 28 jnz short 100036F8 100036D0 \|. A1 80640010 mov eax, dword ptr [10006480] 100036D5 \|. 85C0 test eax, eax 100036D7 \|. 75 0A jnz short 100036E3 100036D9 \|. C705 80640010>mov dword ptr [10006480], 10006480 100036E3 \|> A1 84640010 mov eax, dword ptr [10006484] 100036E8 \|. 85C0 test eax, eax 100036EA \|. 75 27 jnz short 10003713 100036EC \|. C705 84640010>mov dword ptr [10006484], 10006480 100036F6 \|. EB 1B jmp short 10003713 100036F8 \|> C745 00 80640>mov dword ptr [ebp], 10006480 100036FF \|. 8B0D 84640010 mov ecx, dword ptr [10006484] ; pjgl.10006480 10003705 \|. 894D 04 mov dword ptr [ebp+4], ecx 10003708 \|. 892D 84640010 mov dword ptr [10006484], ebp 1000370E \|. 8B55 04 mov edx, dword ptr [ebp+4] 10003711 \|. 892A mov dword ptr [edx], ebp 10003713 \|> 8D86 00004000 lea eax, dword ptr [esi+400000] 10003719 \|. 8D4D 18 lea ecx, dword ptr [ebp+18] 1000371C \|. 8D95 98000000 lea edx, dword ptr [ebp+98] 10003722 \|. 8945 14 mov dword ptr [ebp+14], eax 10003725 \|. 8975 10 mov dword ptr [ebp+10], esi 10003728 \|. 894D 08 mov dword ptr [ebp+8], ecx 1000372B \|. 8955 0C mov dword ptr [ebp+C], edx 1000372E \|. 33C0 xor eax, eax 10003730 \|. BF F1000000 mov edi, 0F1 10003735 \|> 33D2 /xor edx, edx 10003737 \|. 83F8 10 \|cmp eax, 10 1000373A \|. 0F9DC2 \|setge dl 1000373D \|. 4A \|dec edx 1000373E \|. 83C1 08 \|add ecx, 8 10003741 \|. 23D7 \|and edx, edi 10003743 \|. 4A \|dec edx 10003744 \|. 40 \|inc eax 10003745 \|. 8951 F8 \|mov dword ptr [ecx-8], edx 10003748 \|. 8979 FC \|mov dword ptr [ecx-4], edi 1000374B \|. 3D 00040000 \|cmp eax, 400 10003750 \|.^ 7C E3 \jl short 10003735 10003752 \|. B9 00400000 mov ecx, 4000 10003757 \|. 33C0 xor eax, eax 10003759 \|. 8BFE mov edi, esi 1000375B \|. F3:AB rep stos dword ptr es:[edi] 1000375D \|. 8B45 10 mov eax, dword ptr [ebp+10] 10003760 \|. 05 00000100 add eax, 10000 ; UNICODE "=::=::\" 10003765 \|. 3BF0 cmp esi, eax 10003767 \|. 73 28 jnb short 10003791 10003769 \|. B9 F0000000 mov ecx, 0F0 1000376E \|. B0 FF mov al, 0FF 10003770 \|> 8D56 08 /lea edx, dword ptr [esi+8] 10003773 \|. 894E 04 \|mov dword ptr [esi+4], ecx 10003776 \|. 8916 \|mov dword ptr [esi], edx 10003778 \|. 8886 F8000000 \|mov byte ptr [esi+F8], al 1000377E \|. 8B55 10 \|mov edx, dword ptr [ebp+10] 10003781 \|. 81C6 00100000 \|add esi, 1000 10003787 \|. 81C2 00000100 \|add edx, 10000 ; UNICODE "=::=::\" 1000378D \|. 3BF2 \|cmp esi, edx 1000378F \|.^ 72 DF \jb short 10003770 10003791 \|> 8BC5 mov eax, ebp 10003793 \|. 5F pop edi 10003794 \|. 5E pop esi 10003795 \|. 5D pop ebp 10003796 \|. C3 retn 10003797 \|> 68 00800000 push 8000 ; /FreeType = MEM_RELEASE 1000379C \|. 6A 00 push 0 ; \|Size = 0 1000379E \|. 56 push esi ; \|Address 1000379F \|. FF15 50500010 call dword ptr [<&KERNEL32.VirtualFre>; \VirtualFree 100037A5 \|> 81FD 80640010 cmp ebp, 10006480 100037AB \|. 74 0F je short 100037BC 100037AD \|. A1 90880010 mov eax, dword ptr [10008890] 100037B2 \|. 55 push ebp ; /pMemory 100037B3 \|. 6A 00 push 0 ; \|Flags = 0 100037B5 \|. 50 push eax ; \|hHeap => NULL 100037B6 \|. FF15 80500010 call dword ptr [<&KERNEL32.HeapFree>] ; \HeapFree 100037BC \|> 5F pop edi 100037BD \|. 5E pop esi 100037BE \|. 33C0 xor eax, eax 100037C0 \|. 5D pop ebp 100037C1 \. C3 retn 100037C2 90 nop 100037C3 90 nop 100037C4 90 nop 100037C5 90 nop 100037C6 90 nop 100037C7 90 nop 100037C8 90 nop 100037C9 90 nop 100037CA 90 nop 100037CB 90 nop 100037CC 90 nop 100037CD 90 nop 100037CE 90 nop 100037CF 90 nop 100037D0 /$ 56 push esi 100037D1 \|. 8B7424 08 mov esi, dword ptr [esp+8] 100037D5 \|. 68 00800000 push 8000 ; /FreeType = MEM_RELEASE 100037DA \|. 6A 00 push 0 ; \|Size = 0 100037DC \|. 8B46 10 mov eax, dword ptr [esi+10] ; \| 100037DF \|. 50 push eax ; \|Address 100037E0 \|. FF15 50500010 call dword ptr [<&KERNEL32.VirtualFre>; \VirtualFree 100037E6 \|. 3935 A0840010 cmp dword ptr [100084A0], esi 100037EC \|. 75 09 jnz short 100037F7 100037EE \|. 8B4E 04 mov ecx, dword ptr [esi+4] 100037F1 \|. 890D A0840010 mov dword ptr [100084A0], ecx 100037F7 \|> 81FE 80640010 cmp esi, 10006480 100037FD \|. 74 20 je short 1000381F 100037FF \|. 8B56 04 mov edx, dword ptr [esi+4] 10003802 \|. 8B06 mov eax, dword ptr [esi] 10003804 \|. 56 push esi ; /pMemory 10003805 \|. 6A 00 push 0 ; \|Flags = 0 10003807 \|. 8902 mov dword ptr [edx], eax ; \| 10003809 \|. 8B0E mov ecx, dword ptr [esi] ; \| 1000380B \|. 8B56 04 mov edx, dword ptr [esi+4] ; \| 1000380E \|. 8951 04 mov dword ptr [ecx+4], edx ; \| 10003811 \|. A1 90880010 mov eax, dword ptr [10008890] ; \| 10003816 \|. 50 push eax ; \|hHeap => NULL 10003817 \|. FF15 80500010 call dword ptr [<&KERNEL32.HeapFree>] ; \HeapFree 1000381D \|. 5E pop esi 1000381E \|. C3 retn 1000381F \|> C705 90640010>mov dword ptr [10006490], -1 10003829 \|. 5E pop esi 1000382A \. C3 retn 1000382B 90 nop 1000382C 90 nop 1000382D 90 nop 1000382E 90 nop 1000382F 90 nop 10003830 /$ 53 push ebx 10003831 \|. 55 push ebp 10003832 \|. 56 push esi 10003833 \|. 57 push edi 10003834 \|. 8B3D 84640010 mov edi, dword ptr [10006484] ; pjgl.10006480 1000383A \|> 837F 10 FF /cmp dword ptr [edi+10], -1 1000383E \|. 0F84 A0000000 \|je 100038E4 10003844 \|. 33ED \|xor ebp, ebp 10003846 \|. 8DB7 10200000 \|lea esi, dword ptr [edi+2010] 1000384C \|. BB 00F03F00 \|mov ebx, 3FF000 10003851 \|> 813E F0000000 \|/cmp dword ptr [esi], 0F0 10003857 \|. 75 47 \|\|jnz short 100038A0 10003859 \|. 8B47 10 \|\|mov eax, dword ptr [edi+10] 1000385C \|. 68 00400000 \|\|push 4000 ; /FreeType = MEM_DECOMMIT 10003861 \|. 03C3 \|\|add eax, ebx ; \| 10003863 \|. 68 00100000 \|\|push 1000 ; \|Size = 1000 (4096.) 10003868 \|. 50 \|\|push eax ; \|Address 10003869 \|. FF15 50500010 \|\|call dword ptr [<&KERNEL32.VirtualF>; \VirtualFree 1000386F \|. 85C0 \|\|test eax, eax 10003871 \|. 74 2D \|\|je short 100038A0 10003873 \|. C706 FFFFFFFF \|\|mov dword ptr [esi], -1 10003879 \|. 8B15 78880010 \|\|mov edx, dword ptr [10008878] 1000387F \|. 4A \|\|dec edx 10003880 \|. 8915 78880010 \|\|mov dword ptr [10008878], edx 10003886 \|. 8B47 0C \|\|mov eax, dword ptr [edi+C] 10003889 \|. 85C0 \|\|test eax, eax 1000388B \|. 74 04 \|\|je short 10003891 1000388D \|. 3BC6 \|\|cmp eax, esi 1000388F \|. 76 03 \|\|jbe short 10003894 10003891 \|> 8977 0C \|\|mov dword ptr [edi+C], esi 10003894 \|> 8B4424 14 \|\|mov eax, dword ptr [esp+14] 10003898 \|. 45 \|\|inc ebp 10003899 \|. 48 \|\|dec eax 1000389A \|. 894424 14 \|\|mov dword ptr [esp+14], eax 1000389E \|. 74 0D \|\|je short 100038AD 100038A0 \|> 81EB 00100000 \|\|sub ebx, 1000 100038A6 \|. 83EE 08 \|\|sub esi, 8 100038A9 \|. 85DB \|\|test ebx, ebx 100038AB \|.^ 7D A4 \|\jge short 10003851 100038AD \|> 8BD7 \|mov edx, edi 100038AF \|. 8B7F 04 \|mov edi, dword ptr [edi+4] 100038B2 \|. 85ED \|test ebp, ebp 100038B4 \|. 74 2E \|je short 100038E4 100038B6 \|. 837A 18 FF \|cmp dword ptr [edx+18], -1 100038BA \|. 75 28 \|jnz short 100038E4 100038BC \|. B8 01000000 \|mov eax, 1 100038C1 \|. 8D4A 20 \|lea ecx, dword ptr [edx+20] 100038C4 \|> 8339 FF \|/cmp dword ptr [ecx], -1 100038C7 \|. 75 0B \|\|jnz short 100038D4 100038C9 \|. 40 \|\|inc eax 100038CA \|. 83C1 08 \|\|add ecx, 8 100038CD \|. 3D 00040000 \|\|cmp eax, 400 100038D2 \|.^ 7C F0 \|\jl short 100038C4 100038D4 \|> 3D 00040000 \|cmp eax, 400 100038D9 \|. 75 09 \|jnz short 100038E4 100038DB \|. 52 \|push edx 100038DC \|. E8 EFFEFFFF \|call 100037D0 100038E1 \|. 83C4 04 \|add esp, 4 100038E4 \|> 3B3D 84640010 \|cmp edi, dword ptr [10006484] ; pjgl.10006480 100038EA \|. 74 0C \|je short 100038F8 100038EC \|. 8B4424 14 \|mov eax, dword ptr [esp+14] 100038F0 \|. 85C0 \|test eax, eax 100038F2 \|.^ 0F8F 42FFFFFF \jg 1000383A 100038F8 \|> 5F pop edi 100038F9 \|. 5E pop esi 100038FA \|. 5D pop ebp 100038FB \|. 5B pop ebx 100038FC \. C3 retn 100038FD 90 nop 100038FE 90 nop 100038FF 90 nop 10003900 /$ 8B4C24 04 mov ecx, dword ptr [esp+4] 10003904 \|. B8 80640010 mov eax, 10006480 10003909 \|> 3B48 10 /cmp ecx, dword ptr [eax+10] 1000390C \|. 76 05 \|jbe short 10003913 1000390E \|. 3B48 14 \|cmp ecx, dword ptr [eax+14] 10003911 \|. 72 0B \|jb short 1000391E 10003913 \|> 8B00 \|mov eax, dword ptr [eax] 10003915 \|. 3D 80640010 \|cmp eax, 10006480 1000391A \|. 74 3A \|je short 10003956 1000391C \|.^ EB EB \jmp short 10003909 1000391E \|> F6C1 0F test cl, 0F 10003921 \|. 75 33 jnz short 10003956 10003923 \|. 8BD1 mov edx, ecx 10003925 \|. 81E2 FF0F0000 and edx, 0FFF 1000392B \|. 81FA 00010000 cmp edx, 100 10003931 \|. 72 23 jb short 10003956 10003933 \|. 8B5424 08 mov edx, dword ptr [esp+8] 10003937 \|. 8902 mov dword ptr [edx], eax 10003939 \|. 8B5424 0C mov edx, dword ptr [esp+C] 1000393D \|. 8BC1 mov eax, ecx 1000393F \|. 25 00F0FFFF and eax, FFFFF000 10003944 \|. 2BC8 sub ecx, eax 10003946 \|. 8902 mov dword ptr [edx], eax 10003948 \|. 81E9 00010000 sub ecx, 100 1000394E \|. C1F9 04 sar ecx, 4 10003951 \|. 8D4401 08 lea eax, dword ptr [ecx+eax+8] 10003955 \|. C3 retn 10003956 \|> 33C0 xor eax, eax 10003958 \. C3 retn 10003959 90 nop 1000395A 90 nop 1000395B 90 nop 1000395C 90 nop 1000395D 90 nop 1000395E 90 nop 1000395F 90 nop 10003960 /$ 8B4424 04 mov eax, dword ptr [esp+4] 10003964 \|. 8B4C24 08 mov ecx, dword ptr [esp+8] 10003968 \|. 56 push esi 10003969 \|. 33D2 xor edx, edx 1000396B \|. 2B48 10 sub ecx, dword ptr [eax+10] 1000396E \|. C1F9 0C sar ecx, 0C 10003971 \|. 8B74C8 18 mov esi, dword ptr [eax+ecx8+18] 10003975 \|. 8D44C8 18 lea eax, dword ptr [eax+ecx*8+18] 10003979 \|. 8B4C24 10 mov ecx, dword ptr [esp+10] 1000397D \|. 8A11 mov dl, byte ptr [ecx] 1000397F \|. 03F2 add esi, edx 10003981 \|. 8930 mov dword ptr [eax], esi 10003983 \|. C601 00 mov byte ptr [ecx], 0 10003986 \|. 8B08 mov ecx, dword ptr [eax] 10003988 \|. C740 04 F1000>mov dword ptr [eax+4], 0F1 1000398F \|. 81F9 F0000000 cmp ecx, 0F0 10003995 \|. 75 1A jnz short 100039B1 10003997 \|. A1 78880010 mov eax, dword ptr [10008878] 1000399C \|. 40 inc eax 1000399D \|. 83F8 20 cmp eax, 20 100039A0 \|. A3 78880010 mov dword ptr [10008878], eax 100039A5 \|. 75 0A jnz short 100039B1 100039A7 \|. 6A 10 push 10 100039A9 \|. E8 82FEFFFF call 10003830 100039AE \|. 83C4 04 add esp, 4 100039B1 \|> 5E pop esi 100039B2 \. C3 retn 100039B3 90 nop 100039B4 90 nop 100039B5 90 nop 100039B6 90 nop 100039B7 90 nop 100039B8 90 nop 100039B9 90 nop 100039BA 90 nop 100039BB 90 nop 2009-4-1 23:06 0
longdf 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 8 粉丝 0 关注私信	longdf 3 楼 100039BC 90 nop 100039BD 90 nop 100039BE 90 nop 100039BF 90 nop 100039C0 /$ 51 push ecx 100039C1 \|. 8B0D A0840010 mov ecx, dword ptr [100084A0] ; pjgl.10006480 100039C7 \|. 53 push ebx 100039C8 \|. 8B5C24 0C mov ebx, dword ptr [esp+C] 100039CC \|. 55 push ebp 100039CD \|. 56 push esi 100039CE \|. 57 push edi 100039CF \|. 894C24 10 mov dword ptr [esp+10], ecx 100039D3 \|> 8B41 10 /mov eax, dword ptr [ecx+10] 100039D6 \|. 83F8 FF \|cmp eax, -1 100039D9 \|. 0F84 85000000 \|je 10003A64 100039DF \|. 8B79 08 \|mov edi, dword ptr [ecx+8] 100039E2 \|. 8DA9 18200000 \|lea ebp, dword ptr [ecx+2018] 100039E8 \|. 8BF7 \|mov esi, edi 100039EA \|. 2BF1 \|sub esi, ecx 100039EC \|. 83EE 18 \|sub esi, 18 100039EF \|. C1FE 03 \|sar esi, 3 100039F2 \|. C1E6 0C \|shl esi, 0C 100039F5 \|. 03F0 \|add esi, eax 100039F7 \|. 3BFD \|cmp edi, ebp 100039F9 \|. 73 2E \|jnb short 10003A29 100039FB \|> 8B07 \|/mov eax, dword ptr [edi] 100039FD \|. 3BC3 \|\|cmp eax, ebx 100039FF \|. 7C 1B \|\|jl short 10003A1C 10003A01 \|. 395F 04 \|\|cmp dword ptr [edi+4], ebx 10003A04 \|. 76 16 \|\|jbe short 10003A1C 10003A06 \|. 53 \|\|push ebx 10003A07 \|. 50 \|\|push eax 10003A08 \|. 56 \|\|push esi 10003A09 \|. E8 F2010000 \|\|call 10003C00 10003A0E \|. 83C4 0C \|\|add esp, 0C 10003A11 \|. 85C0 \|\|test eax, eax 10003A13 \|. 75 63 \|\|jnz short 10003A78 10003A15 \|. 8B4C24 10 \|\|mov ecx, dword ptr [esp+10] 10003A19 \|. 895F 04 \|\|mov dword ptr [edi+4], ebx 10003A1C \|> 83C7 08 \|\|add edi, 8 10003A1F \|. 81C6 00100000 \|\|add esi, 1000 10003A25 \|. 3BFD \|\|cmp edi, ebp 10003A27 \|.^ 72 D2 \|\jb short 100039FB 10003A29 \|> 8B69 08 \|mov ebp, dword ptr [ecx+8] 10003A2C \|. 8B79 10 \|mov edi, dword ptr [ecx+10] 10003A2F \|. 8D71 18 \|lea esi, dword ptr [ecx+18] 10003A32 \|. 3BF5 \|cmp esi, ebp 10003A34 \|. 73 2E \|jnb short 10003A64 10003A36 \|> 8B06 \|/mov eax, dword ptr [esi] 10003A38 \|. 3BC3 \|\|cmp eax, ebx 10003A3A \|. 7C 1B \|\|jl short 10003A57 10003A3C \|. 395E 04 \|\|cmp dword ptr [esi+4], ebx 10003A3F \|. 76 16 \|\|jbe short 10003A57 10003A41 \|. 53 \|\|push ebx 10003A42 \|. 50 \|\|push eax 10003A43 \|. 57 \|\|push edi 10003A44 \|. E8 B7010000 \|\|call 10003C00 10003A49 \|. 83C4 0C \|\|add esp, 0C 10003A4C \|. 85C0 \|\|test eax, eax 10003A4E \|. 75 41 \|\|jnz short 10003A91 10003A50 \|. 8B4C24 10 \|\|mov ecx, dword ptr [esp+10] 10003A54 \|. 895E 04 \|\|mov dword ptr [esi+4], ebx 10003A57 \|> 83C6 08 \|\|add esi, 8 10003A5A \|. 81C7 00100000 \|\|add edi, 1000 10003A60 \|. 3BF5 \|\|cmp esi, ebp 10003A62 \|.^ 72 D2 \|\jb short 10003A36 10003A64 \|> 8B09 \|mov ecx, dword ptr [ecx] 10003A66 \|. A1 A0840010 \|mov eax, dword ptr [100084A0] 10003A6B \|. 3BC8 \|cmp ecx, eax 10003A6D \|. 894C24 10 \|mov dword ptr [esp+10], ecx 10003A71 \|. 74 37 \|je short 10003AAA 10003A73 \|.^ E9 5BFFFFFF \jmp 100039D3 10003A78 \|> 8B4C24 10 mov ecx, dword ptr [esp+10] 10003A7C \|. 890D A0840010 mov dword ptr [100084A0], ecx 10003A82 \|. 8B17 mov edx, dword ptr [edi] 10003A84 \|. 2BD3 sub edx, ebx 10003A86 \|. 8917 mov dword ptr [edi], edx 10003A88 \|. 8979 08 mov dword ptr [ecx+8], edi 10003A8B \|. 5F pop edi 10003A8C \|. 5E pop esi 10003A8D \|. 5D pop ebp 10003A8E \|. 5B pop ebx 10003A8F \|. 59 pop ecx 10003A90 \|. C3 retn 10003A91 \|> 8B4C24 10 mov ecx, dword ptr [esp+10] 10003A95 \|. 890D A0840010 mov dword ptr [100084A0], ecx 10003A9B \|. 8B16 mov edx, dword ptr [esi] 10003A9D \|. 2BD3 sub edx, ebx 10003A9F \|. 8916 mov dword ptr [esi], edx 10003AA1 \|. 8971 08 mov dword ptr [ecx+8], esi 10003AA4 \|. 5F pop edi 10003AA5 \|. 5E pop esi 10003AA6 \|. 5D pop ebp 10003AA7 \|. 5B pop ebx 10003AA8 \|. 59 pop ecx 10003AA9 \|. C3 retn 10003AAA \|> BD 80640010 mov ebp, 10006480 10003AAF \|. 83C9 FF or ecx, FFFFFFFF 10003AB2 \|> 394D 10 /cmp dword ptr [ebp+10], ecx 10003AB5 \|. 74 07 \|je short 10003ABE 10003AB7 \|. 8B45 0C \|mov eax, dword ptr [ebp+C] 10003ABA \|. 85C0 \|test eax, eax 10003ABC \|. 75 11 \|jnz short 10003ACF 10003ABE \|> 8B6D 00 \|mov ebp, dword ptr [ebp] 10003AC1 \|. 81FD 80640010 \|cmp ebp, 10006480 10003AC7 \|. 0F84 E0000000 \|je 10003BAD 10003ACD \|.^ EB E3 \jmp short 10003AB2 10003ACF \|> 8B45 0C mov eax, dword ptr [ebp+C] 10003AD2 \|. 8B75 10 mov esi, dword ptr [ebp+10] 10003AD5 \|. 8BF8 mov edi, eax 10003AD7 \|. 894424 18 mov dword ptr [esp+18], eax 10003ADB \|. 2BFD sub edi, ebp 10003ADD \|. 8B10 mov edx, dword ptr [eax] 10003ADF \|. 83EF 18 sub edi, 18 10003AE2 \|. C1FF 03 sar edi, 3 10003AE5 \|. C1E7 0C shl edi, 0C 10003AE8 \|. 03FE add edi, esi 10003AEA \|. 33F6 xor esi, esi 10003AEC \|. 3BD1 cmp edx, ecx 10003AEE \|. 75 10 jnz short 10003B00 10003AF0 \|> 83FE 10 /cmp esi, 10 10003AF3 \|. 7D 0B \|jge short 10003B00 10003AF5 \|. 8B50 08 \|mov edx, dword ptr [eax+8] 10003AF8 \|. 83C0 08 \|add eax, 8 10003AFB \|. 46 \|inc esi 10003AFC \|. 3BD1 \|cmp edx, ecx 10003AFE \|.^ 74 F0 \je short 10003AF0 10003B00 \|> 8BC6 mov eax, esi 10003B02 \|. 6A 04 push 4 ; /Protect = PAGE_READWRITE 10003B04 \|. C1E0 0C shl eax, 0C ; \| 10003B07 \|. 68 00100000 push 1000 ; \|AllocationType = MEM_COMMIT 10003B0C \|. 50 push eax ; \|Size 10003B0D \|. 57 push edi ; \|Address 10003B0E \|. 894424 20 mov dword ptr [esp+20], eax ; \| 10003B12 \|. FF15 88500010 call dword ptr [<&KERNEL32.VirtualAll>; \VirtualAlloc 10003B18 \|. 3BC7 cmp eax, edi 10003B1A \|. 0F85 CB000000 jnz 10003BEB 10003B20 \|. 8B5424 18 mov edx, dword ptr [esp+18] 10003B24 \|. 8B4424 10 mov eax, dword ptr [esp+10] 10003B28 \|. 33C9 xor ecx, ecx 10003B2A \|. 85F6 test esi, esi 10003B2C \|. 8BCA mov ecx, edx 10003B2E \|. 7E 32 jle short 10003B62 10003B30 \|. 8D47 04 lea eax, dword ptr [edi+4] 10003B33 \|> 8D50 04 /lea edx, dword ptr [eax+4] 10003B36 \|. C700 F0000000 \|mov dword ptr [eax], 0F0 10003B3C \|. 8950 FC \|mov dword ptr [eax-4], edx 10003B3F \|. C680 F4000000>\|mov byte ptr [eax+F4], 0FF 10003B46 \|. C701 F0000000 \|mov dword ptr [ecx], 0F0 10003B4C \|. C741 04 F1000>\|mov dword ptr [ecx+4], 0F1 10003B53 \|. 05 00100000 \|add eax, 1000 10003B58 \|. 83C1 08 \|add ecx, 8 10003B5B \|. 4E \|dec esi 10003B5C \|.^ 75 D5 \jnz short 10003B33 10003B5E \|. 8B5424 18 mov edx, dword ptr [esp+18] 10003B62 \|> 8D85 18200000 lea eax, dword ptr [ebp+2018] 10003B68 \|. 892D A0840010 mov dword ptr [100084A0], ebp 10003B6E \|. 3BC8 cmp ecx, eax 10003B70 \|. 73 0E jnb short 10003B80 10003B72 \|> 8339 FF /cmp dword ptr [ecx], -1 10003B75 \|. 74 07 \|je short 10003B7E 10003B77 \|. 83C1 08 \|add ecx, 8 10003B7A \|. 3BC8 \|cmp ecx, eax 10003B7C \|.^ 72 F4 \jb short 10003B72 10003B7E \|> 3BC8 cmp ecx, eax 10003B80 \|> 1BC0 sbb eax, eax 10003B82 \|. 23C1 and eax, ecx 10003B84 \|. 8945 0C mov dword ptr [ebp+C], eax 10003B87 \|. 885F 08 mov byte ptr [edi+8], bl 10003B8A \|. 8955 08 mov dword ptr [ebp+8], edx 10003B8D \|. 8B0A mov ecx, dword ptr [edx] 10003B8F \|. 2BCB sub ecx, ebx 10003B91 \|. 890A mov dword ptr [edx], ecx 10003B93 \|. 8B47 04 mov eax, dword ptr [edi+4] 10003B96 \|. 2BC3 sub eax, ebx 10003B98 \|. 8D4C1F 08 lea ecx, dword ptr [edi+ebx+8] 10003B9C \|. 8947 04 mov dword ptr [edi+4], eax 10003B9F \|. 890F mov dword ptr [edi], ecx 10003BA1 \|. 8D87 00010000 lea eax, dword ptr [edi+100] 10003BA7 \|. 5F pop edi 10003BA8 \|. 5E pop esi 10003BA9 \|. 5D pop ebp 10003BAA \|. 5B pop ebx 10003BAB \|. 59 pop ecx 10003BAC \|. C3 retn 10003BAD \|> E8 AEFAFFFF call 10003660 10003BB2 \|. 85C0 test eax, eax 10003BB4 \|. 74 35 je short 10003BEB 10003BB6 \|. 8B48 10 mov ecx, dword ptr [eax+10] 10003BB9 \|. 8859 08 mov byte ptr [ecx+8], bl 10003BBC \|. 8D5419 08 lea edx, dword ptr [ecx+ebx+8] 10003BC0 \|. A3 A0840010 mov dword ptr [100084A0], eax 10003BC5 \|. 8911 mov dword ptr [ecx], edx 10003BC7 \|. BA F0000000 mov edx, 0F0 10003BCC \|. 2BD3 sub edx, ebx 10003BCE \|. 81E3 FF000000 and ebx, 0FF 10003BD4 \|. 8951 04 mov dword ptr [ecx+4], edx 10003BD7 \|. 8B50 18 mov edx, dword ptr [eax+18] 10003BDA \|. 2BD3 sub edx, ebx 10003BDC \|. 8950 18 mov dword ptr [eax+18], edx 10003BDF \|. 8D81 00010000 lea eax, dword ptr [ecx+100] 10003BE5 \|. 5F pop edi 10003BE6 \|. 5E pop esi 10003BE7 \|. 5D pop ebp 10003BE8 \|. 5B pop ebx 10003BE9 \|. 59 pop ecx 10003BEA \|. C3 retn 10003BEB \|> 5F pop edi 10003BEC \|. 5E pop esi 10003BED \|. 5D pop ebp 10003BEE \|. 33C0 xor eax, eax 10003BF0 \|. 5B pop ebx 10003BF1 \|. 59 pop ecx 10003BF2 \. C3 retn 10003BF3 90 nop 10003BF4 90 nop 10003BF5 90 nop 10003BF6 90 nop 10003BF7 90 nop 10003BF8 90 nop 10003BF9 90 nop 10003BFA 90 nop 10003BFB 90 nop 10003BFC 90 nop 10003BFD 90 nop 10003BFE 90 nop 10003BFF 90 nop 10003C00 /$ 8B5424 0C mov edx, dword ptr [esp+C] 10003C04 \|. 53 push ebx 10003C05 \|. 55 push ebp 10003C06 \|. 56 push esi 10003C07 \|. 57 push edi 10003C08 \|. 8B7C24 14 mov edi, dword ptr [esp+14] 10003C0C \|. 8B47 04 mov eax, dword ptr [edi+4] 10003C0F \|. 8B0F mov ecx, dword ptr [edi] 10003C11 \|. 3BC2 cmp eax, edx 10003C13 \|. 894C24 14 mov dword ptr [esp+14], ecx 10003C17 \|. 8BF1 mov esi, ecx 10003C19 \|. 8D9F F8000000 lea ebx, dword ptr [edi+F8] 10003C1F \|. 72 3A jb short 10003C5B 10003C21 \|. 8D0411 lea eax, dword ptr [ecx+edx] 10003C24 \|. 8811 mov byte ptr [ecx], dl 10003C26 \|. 3BC3 cmp eax, ebx 10003C28 \|. 73 10 jnb short 10003C3A 10003C2A \|. 8B37 mov esi, dword ptr [edi] 10003C2C \|. 8B47 04 mov eax, dword ptr [edi+4] 10003C2F \|. 03F2 add esi, edx 10003C31 \|. 2BC2 sub eax, edx 10003C33 \|. 8937 mov dword ptr [edi], esi 10003C35 \|. 8947 04 mov dword ptr [edi+4], eax 10003C38 \|. EB 0C jmp short 10003C46 10003C3A \|> 8D57 08 lea edx, dword ptr [edi+8] 10003C3D \|. C747 04 00000>mov dword ptr [edi+4], 0 10003C44 \|. 8917 mov dword ptr [edi], edx 10003C46 \|> 8D047F lea eax, dword ptr [edi+edi2] 10003C49 \|. 8D0480 lea eax, dword ptr [eax+eax4] 10003C4C \|. 8BD0 mov edx, eax 10003C4E \|. 8D41 08 lea eax, dword ptr [ecx+8] 10003C51 \|. C1E0 04 shl eax, 4 10003C54 \|. 2BC2 sub eax, edx 10003C56 \|. 5F pop edi 10003C57 \|. 5E pop esi 10003C58 \|. 5D pop ebp 10003C59 \|. 5B pop ebx 10003C5A \|. C3 retn 10003C5B \|> 03C1 add eax, ecx 10003C5D \|. 8038 00 cmp byte ptr [eax], 0 10003C60 \|. 74 02 je short 10003C64 10003C62 \|. 8BF0 mov esi, eax 10003C64 \|> 8D0416 lea eax, dword ptr [esi+edx] 10003C67 \|. 3BC3 cmp eax, ebx 10003C69 \|. 8B5C24 18 mov ebx, dword ptr [esp+18] 10003C6D \|. 73 75 jnb short 10003CE4 10003C6F \|> 8A06 /mov al, byte ptr [esi] 10003C71 \|. 84C0 \|test al, al 10003C73 \|. 75 3C \|jnz short 10003CB1 10003C75 \|. 807E 01 00 \|cmp byte ptr [esi+1], 0 10003C79 \|. 8D46 01 \|lea eax, dword ptr [esi+1] 10003C7C \|. B9 01000000 \|mov ecx, 1 10003C81 \|. 75 07 \|jnz short 10003C8A 10003C83 \|> 40 \|/inc eax 10003C84 \|. 41 \|\|inc ecx 10003C85 \|. 8038 00 \|\|cmp byte ptr [eax], 0 10003C88 \|.^ 74 F9 \|\je short 10003C83 10003C8A \|> 3BCA \|cmp ecx, edx 10003C8C \|. 73 39 \|jnb short 10003CC7 10003C8E \|. 8B6C24 14 \|mov ebp, dword ptr [esp+14] 10003C92 \|. 3BF5 \|cmp esi, ebp 10003C94 \|. 75 09 \|jnz short 10003C9F 10003C96 \|. 894F 04 \|mov dword ptr [edi+4], ecx 10003C99 \|. 8BF0 \|mov esi, eax 10003C9B \|. 8BCD \|mov ecx, ebp 10003C9D \|. EB 19 \|jmp short 10003CB8 10003C9F \|> 2BD9 \|sub ebx, ecx 10003CA1 \|. 3BDA \|cmp ebx, edx 10003CA3 \|. 0F82 C2000000 \|jb 10003D6B 10003CA9 \|. 8B4C24 14 \|mov ecx, dword ptr [esp+14] 10003CAD \|. 8BF0 \|mov esi, eax 10003CAF \|. EB 07 \|jmp short 10003CB8 10003CB1 \|> 25 FF000000 \|and eax, 0FF 10003CB6 \|. 03F0 \|add esi, eax 10003CB8 \|> 8D2C16 \|lea ebp, dword ptr [esi+edx] 10003CBB \|. 8D87 F8000000 \|lea eax, dword ptr [edi+F8] 10003CC1 \|. 3BE8 \|cmp ebp, eax 10003CC3 \|.^ 72 AA \jb short 10003C6F 10003CC5 \|. EB 1D jmp short 10003CE4 10003CC7 \|> 8D0416 lea eax, dword ptr [esi+edx] 10003CCA \|. 8D9F F8000000 lea ebx, dword ptr [edi+F8] 10003CD0 \|. 3BC3 cmp eax, ebx 10003CD2 \|. 73 09 jnb short 10003CDD 10003CD4 \|. 2BCA sub ecx, edx 10003CD6 \|. 8907 mov dword ptr [edi], eax 10003CD8 \|. 894F 04 mov dword ptr [edi+4], ecx 10003CDB \|. EB 79 jmp short 10003D56 10003CDD \|> 8D4F 08 lea ecx, dword ptr [edi+8] 10003CE0 \|. 890F mov dword ptr [edi], ecx 10003CE2 \|. EB 6B jmp short 10003D4F 10003CE4 \|> 8D6F 08 lea ebp, dword ptr [edi+8] 10003CE7 \|. 8BF5 mov esi, ebp 10003CE9 \|. 3BF1 cmp esi, ecx 10003CEB \|. 73 7E jnb short 10003D6B 10003CED \|> 8D0C16 /lea ecx, dword ptr [esi+edx] 10003CF0 \|. 8D87 F8000000 \|lea eax, dword ptr [edi+F8] 10003CF6 \|. 3BC8 \|cmp ecx, eax 10003CF8 \|. 73 71 \|jnb short 10003D6B 10003CFA \|. 8A06 \|mov al, byte ptr [esi] 10003CFC \|. 84C0 \|test al, al 10003CFE \|. 75 23 \|jnz short 10003D23 10003D00 \|. 807E 01 00 \|cmp byte ptr [esi+1], 0 10003D04 \|. 8D46 01 \|lea eax, dword ptr [esi+1] 10003D07 \|. B9 01000000 \|mov ecx, 1 10003D0C \|. 75 07 \|jnz short 10003D15 10003D0E \|> 40 \|/inc eax 10003D0F \|. 41 \|\|inc ecx 10003D10 \|. 8038 00 \|\|cmp byte ptr [eax], 0 10003D13 \|.^ 74 F9 \|\je short 10003D0E 10003D15 \|> 3BCA \|cmp ecx, edx 10003D17 \|. 73 1E \|jnb short 10003D37 10003D19 \|. 2BD9 \|sub ebx, ecx 10003D1B \|. 3BDA \|cmp ebx, edx 10003D1D \|. 72 4C \|jb short 10003D6B 10003D1F \|. 8BF0 \|mov esi, eax 10003D21 \|. EB 07 \|jmp short 10003D2A 10003D23 \|> 25 FF000000 \|and eax, 0FF 10003D28 \|. 03F0 \|add esi, eax 10003D2A \|> 3B7424 14 \|cmp esi, dword ptr [esp+14] 10003D2E \|.^ 72 BD \jb short 10003CED 10003D30 \|. 33C0 xor eax, eax 10003D32 \|. 5F pop edi 10003D33 \|. 5E pop esi 10003D34 \|. 5D pop ebp 10003D35 \|. 5B pop ebx 10003D36 \|. C3 retn 10003D37 \|> 8D0416 lea eax, dword ptr [esi+edx] 10003D3A \|. 8D9F F8000000 lea ebx, dword ptr [edi+F8] 10003D40 \|. 3BC3 cmp eax, ebx 10003D42 \|. 73 09 jnb short 10003D4D 10003D44 \|. 2BCA sub ecx, edx 10003D46 \|. 8907 mov dword ptr [edi], eax 10003D48 \|. 894F 04 mov dword ptr [edi+4], ecx 10003D4B \|. EB 09 jmp short 10003D56 10003D4D \|> 892F mov dword ptr [edi], ebp 10003D4F \|> C747 04 00000>mov dword ptr [edi+4], 0 10003D56 \|> 8D047F lea eax, dword ptr [edi+edi2] 10003D59 \|. 8816 mov byte ptr [esi], dl 10003D5B \|. 8D1480 lea edx, dword ptr [eax+eax4] 10003D5E \|. 8D46 08 lea eax, dword ptr [esi+8] 10003D61 \|. C1E0 04 shl eax, 4 10003D64 \|. 2BC2 sub eax, edx 10003D66 \|. 5F pop edi 10003D67 \|. 5E pop esi 10003D68 \|. 5D pop ebp 10003D69 \|. 5B pop ebx 10003D6A \|. C3 retn 10003D6B \|> 5F pop edi 10003D6C \|. 5E pop esi 10003D6D \|. 5D pop ebp 10003D6E \|. 33C0 xor eax, eax 10003D70 \|. 5B pop ebx 10003D71 \. C3 retn 10003D72 90 nop 10003D73 90 nop 10003D74 90 nop 10003D75 90 nop 10003D76 90 nop 10003D77 90 nop 10003D78 90 nop 10003D79 90 nop 10003D7A 90 nop 10003D7B 90 nop 10003D7C 90 nop 10003D7D 90 nop 10003D7E 90 nop 10003D7F 90 nop 10003D80 /$ A1 7C880010 mov eax, dword ptr [1000887C] 10003D85 \|. 53 push ebx 10003D86 \|. 33DB xor ebx, ebx 10003D88 \|. 56 push esi 10003D89 \|. 85C0 test eax, eax 10003D8B \|. 57 push edi 10003D8C \|. 75 42 jnz short 10003DD0 10003D8E \|. 68 D4530010 push 100053D4 ; /FileName = "user32.dll" 10003D93 \|. FF15 70500010 call dword ptr [<&KERNEL32.LoadLibrar>; \LoadLibraryA 10003D99 \|. 8BF0 mov esi, eax 10003D9B \|. 85F6 test esi, esi 10003D9D \|. 74 6A je short 10003E09 10003D9F \|. 8B3D 8C500010 mov edi, dword ptr [<&KERNEL32.GetPr>; kernel32.GetProcAddress 10003DA5 \|. 68 C8530010 push 100053C8 ; /ProcNameOrOrdinal = "MessageBoxA" 10003DAA \|. 56 push esi ; \|hModule 10003DAB \|. FFD7 call edi ; \GetProcAddress 10003DAD \|. 85C0 test eax, eax 10003DAF \|. A3 7C880010 mov dword ptr [1000887C], eax 10003DB4 \|. 74 53 je short 10003E09 10003DB6 \|. 68 B8530010 push 100053B8 ; /ProcNameOrOrdinal = "GetActiveWindow" 10003DBB \|. 56 push esi ; \|hModule 10003DBC \|. FFD7 call edi ; \GetProcAddress 10003DBE \|. 68 A4530010 push 100053A4 ; /ProcNameOrOrdinal = "GetLastActivePopup" 10003DC3 \|. 56 push esi ; \|hModule 10003DC4 \|. A3 80880010 mov dword ptr [10008880], eax ; \| 10003DC9 \|. FFD7 call edi ; \GetProcAddress 10003DCB \|. A3 84880010 mov dword ptr [10008884], eax 10003DD0 \|> A1 80880010 mov eax, dword ptr [10008880] 10003DD5 \|. 85C0 test eax, eax 10003DD7 \|. 74 04 je short 10003DDD 10003DD9 \|. FFD0 call eax 10003DDB \|. 8BD8 mov ebx, eax 10003DDD \|> 85DB test ebx, ebx 10003DDF \|. 74 0E je short 10003DEF 10003DE1 \|. A1 84880010 mov eax, dword ptr [10008884] 10003DE6 \|. 85C0 test eax, eax 10003DE8 \|. 74 05 je short 10003DEF 10003DEA \|. 53 push ebx 10003DEB \|. FFD0 call eax 10003DED \|. 8BD8 mov ebx, eax 10003DEF \|> 8B4424 18 mov eax, dword ptr [esp+18] 10003DF3 \|. 8B4C24 14 mov ecx, dword ptr [esp+14] 10003DF7 \|. 8B5424 10 mov edx, dword ptr [esp+10] 10003DFB \|. 50 push eax 10003DFC \|. 51 push ecx 10003DFD \|. 52 push edx 10003DFE \|. 53 push ebx 10003DFF \|. FF15 7C880010 call dword ptr [1000887C] 10003E05 \|. 5F pop edi 10003E06 \|. 5E pop esi 10003E07 \|. 5B pop ebx 10003E08 \|. C3 retn 10003E09 \|> 5F pop edi 10003E0A \|. 5E pop esi 10003E0B \|. 33C0 xor eax, eax 10003E0D \|. 5B pop ebx 10003E0E \. C3 retn 10003E0F 90 nop 10003E10 . 55 push ebp 10003E11 . 8BEC mov ebp, esp 10003E13 . 57 push edi 10003E14 . 56 push esi 10003E15 . 8B75 0C mov esi, dword ptr [ebp+C] 10003E18 . 8B4D 10 mov ecx, dword ptr [ebp+10] 10003E1B . 8B7D 08 mov edi, dword ptr [ebp+8] 10003E1E . 8BC1 mov eax, ecx 10003E20 . 8BD1 mov edx, ecx 10003E22 . 03C6 add eax, esi 10003E24 . 3BFE cmp edi, esi 10003E26 . 76 08 jbe short 10003E30 10003E28 . 3BF8 cmp edi, eax 10003E2A . 0F82 78010000 jb 10003FA8 10003E30 > F7C7 03000000 test edi, 3 10003E36 . 75 14 jnz short 10003E4C 10003E38 . C1E9 02 shr ecx, 2 10003E3B . 83E2 03 and edx, 3 10003E3E . 83F9 08 cmp ecx, 8 10003E41 . 72 29 jb short 10003E6C 10003E43 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003E45 . FF2495 583F00>jmp dword ptr [edx4+10003F58] 10003E4C > 8BC7 mov eax, edi 10003E4E . BA 03000000 mov edx, 3 10003E53 . 83E9 04 sub ecx, 4 10003E56 . 72 0C jb short 10003E64 10003E58 . 83E0 03 and eax, 3 10003E5B . 03C8 add ecx, eax 10003E5D . FF2485 703E00>jmp dword ptr [eax4+10003E70] 10003E64 > FF248D 683F00>jmp dword ptr [ecx4+10003F68] 10003E6B 90 nop 10003E6C > FF248D EC3E00>jmp dword ptr [ecx4+10003EEC] 10003E73 90 nop 10003E74 . 803E0010 dd pjgl.10003E80 ; 分支表 (1-based) 被用于 10003E5D 10003E78 . AC3E0010 dd pjgl.10003EAC 10003E7C . D03E0010 dd pjgl.10003ED0 10003E80 > 23D1 and edx, ecx 10003E82 . 8A06 mov al, byte ptr [esi] 10003E84 . 8807 mov byte ptr [edi], al 10003E86 . 8A46 01 mov al, byte ptr [esi+1] 10003E89 . 8847 01 mov byte ptr [edi+1], al 10003E8C . 8A46 02 mov al, byte ptr [esi+2] 10003E8F . C1E9 02 shr ecx, 2 10003E92 . 8847 02 mov byte ptr [edi+2], al 10003E95 . 83C6 03 add esi, 3 10003E98 . 83C7 03 add edi, 3 10003E9B . 83F9 08 cmp ecx, 8 10003E9E .^ 72 CC jb short 10003E6C 10003EA0 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003EA2 . FF2495 583F00>jmp dword ptr [edx4+10003F58] 10003EA9 . 2E:8BC0 mov eax, eax 10003EAC > 23D1 and edx, ecx 10003EAE . 8A06 mov al, byte ptr [esi] 10003EB0 . 8807 mov byte ptr [edi], al 10003EB2 . 8A46 01 mov al, byte ptr [esi+1] 10003EB5 . C1E9 02 shr ecx, 2 10003EB8 . 8847 01 mov byte ptr [edi+1], al 10003EBB . 83C6 02 add esi, 2 10003EBE . 83C7 02 add edi, 2 10003EC1 . 83F9 08 cmp ecx, 8 10003EC4 .^ 72 A6 jb short 10003E6C 10003EC6 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003EC8 . FF2495 583F00>jmp dword ptr [edx4+10003F58] 10003ECF 90 nop 10003ED0 > 23D1 and edx, ecx 10003ED2 . 8A06 mov al, byte ptr [esi] 10003ED4 . 8807 mov byte ptr [edi], al 10003ED6 . 46 inc esi 10003ED7 . C1E9 02 shr ecx, 2 10003EDA . 47 inc edi 10003EDB . 83F9 08 cmp ecx, 8 10003EDE .^ 72 8C jb short 10003E6C 10003EE0 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003EE2 . FF2495 583F00>jmp dword ptr [edx4+10003F58] 10003EE9 2E db 2E ; CHAR '.' 10003EEA 8BC0 mov eax, eax 10003EEC . 4F3F0010 dd pjgl.10003F4F ; 分支表被用于 10003E6C 10003EF0 . 3C3F0010 dd pjgl.10003F3C 10003EF4 . 343F0010 dd pjgl.10003F34 10003EF8 . 2C3F0010 dd pjgl.10003F2C 10003EFC . 243F0010 dd pjgl.10003F24 10003F00 . 1C3F0010 dd pjgl.10003F1C 10003F04 . 143F0010 dd pjgl.10003F14 10003F08 . 0C3F0010 dd pjgl.10003F0C 10003F0C > 8B448E E4 mov eax, dword ptr [esi+ecx4-1C] 10003F10 . 89448F E4 mov dword ptr [edi+ecx4-1C], eax 10003F14 > 8B448E E8 mov eax, dword ptr [esi+ecx4-18] 10003F18 . 89448F E8 mov dword ptr [edi+ecx4-18], eax 10003F1C > 8B448E EC mov eax, dword ptr [esi+ecx4-14] 10003F20 . 89448F EC mov dword ptr [edi+ecx4-14], eax 10003F24 > 8B448E F0 mov eax, dword ptr [esi+ecx4-10] 10003F28 . 89448F F0 mov dword ptr [edi+ecx4-10], eax 10003F2C > 8B448E F4 mov eax, dword ptr [esi+ecx4-C] 10003F30 . 89448F F4 mov dword ptr [edi+ecx4-C], eax 10003F34 > 8B448E F8 mov eax, dword ptr [esi+ecx4-8] 10003F38 . 89448F F8 mov dword ptr [edi+ecx4-8], eax 10003F3C > 8B448E FC mov eax, dword ptr [esi+ecx4-4] 10003F40 . 89448F FC mov dword ptr [edi+ecx4-4], eax 10003F44 . 8D048D 000000>lea eax, dword ptr [ecx4] 10003F4B . 03F0 add esi, eax 10003F4D . 03F8 add edi, eax 10003F4F > FF2495 583F00>jmp dword ptr [edx4+10003F58] 10003F56 8BC0 mov eax, eax 10003F58 . 683F0010 dd pjgl.10003F68 ; 分支表被用于 10003EA2 10003F5C . 703F0010 dd pjgl.10003F70 10003F60 . 7C3F0010 dd pjgl.10003F7C 10003F64 . 903F0010 dd pjgl.10003F90 10003F68 > 8B45 08 mov eax, dword ptr [ebp+8] 10003F6B . 5E pop esi 10003F6C . 5F pop edi 10003F6D . C9 leave 10003F6E . C3 retn 10003F6F 90 nop 10003F70 > 8A06 mov al, byte ptr [esi] 10003F72 . 8807 mov byte ptr [edi], al 10003F74 . 8B45 08 mov eax, dword ptr [ebp+8] 10003F77 . 5E pop esi 10003F78 . 5F pop edi 10003F79 . C9 leave 10003F7A . C3 retn 10003F7B 90 nop 10003F7C > 8A06 mov al, byte ptr [esi] 10003F7E . 8807 mov byte ptr [edi], al 10003F80 . 8A46 01 mov al, byte ptr [esi+1] 10003F83 . 8847 01 mov byte ptr [edi+1], al 10003F86 . 8B45 08 mov eax, dword ptr [ebp+8] 10003F89 . 5E pop esi 10003F8A . 5F pop edi 10003F8B . C9 leave 10003F8C . C3 retn 10003F8D . 2E:8BC0 mov eax, eax 10003F90 > 8A06 mov al, byte ptr [esi] 10003F92 . 8807 mov byte ptr [edi], al 10003F94 . 8A46 01 mov al, byte ptr [esi+1] 10003F97 . 8847 01 mov byte ptr [edi+1], al 10003F9A . 8A46 02 mov al, byte ptr [esi+2] 10003F9D . 8847 02 mov byte ptr [edi+2], al 10003FA0 . 8B45 08 mov eax, dword ptr [ebp+8] 10003FA3 . 5E pop esi 10003FA4 . 5F pop edi 10003FA5 . C9 leave 10003FA6 . C3 retn 10003FA7 90 nop 10003FA8 > 8D7431 FC lea esi, dword ptr [ecx+esi-4] 10003FAC . 8D7C39 FC lea edi, dword ptr [ecx+edi-4] 10003FB0 . F7C7 03000000 test edi, 3 10003FB6 . 75 24 jnz short 10003FDC 10003FB8 . C1E9 02 shr ecx, 2 10003FBB . 83E2 03 and edx, 3 10003FBE . 83F9 08 cmp ecx, 8 10003FC1 . 72 0D jb short 10003FD0 10003FC3 . FD std 10003FC4 . F3:A5 rep movs dword ptr es:[edi], dword p> 10003FC6 . FC cld 10003FC7 . FF2495 F04000>jmp dword ptr [edx4+100040F0] 10003FCE 8BC0 mov eax, eax 10003FD0 > F7D9 neg ecx 10003FD2 . FF248D A04000>jmp dword ptr [ecx4+100040A0] 10003FD9 . 2E:8BC0 mov eax, eax 10003FDC > 8BC7 mov eax, edi 10003FDE . BA 03000000 mov edx, 3 ; Switch (cases 0..3) 10003FE3 . 83F9 04 cmp ecx, 4 10003FE6 . 72 0C jb short 10003FF4 10003FE8 . 83E0 03 and eax, 3 ; Default case of switch 10003FDE 10003FEB . 2BC8 sub ecx, eax 10003FED . FF2485 F83F00>jmp dword ptr [eax4+10003FF8] 10003FF4 > FF248D F04000>jmp dword ptr [ecx4+100040F0] 10003FFB 90 db 90 10003FFC . 08400010 dd pjgl.10004008 ; 分支表 (1-based) 被用于 10003FED 10004000 . 28400010 dd pjgl.10004028 10004004 . 50400010 dd pjgl.10004050 10004008 > 8A46 03 mov al, byte ptr [esi+3] 1000400B . 23D1 and edx, ecx 1000400D . 8847 03 mov byte ptr [edi+3], al 10004010 . 4E dec esi 10004011 . C1E9 02 shr ecx, 2 10004014 . 4F dec edi 10004015 . 83F9 08 cmp ecx, 8 10004018 .^ 72 B6 jb short 10003FD0 1000401A . FD std 1000401B . F3:A5 rep movs dword ptr es:[edi], dword p> 1000401D . FC cld 1000401E . FF2495 F04000>jmp dword ptr [edx4+100040F0] 10004025 . 2E:8BC0 mov eax, eax 10004028 > 8A46 03 mov al, byte ptr [esi+3] 1000402B . 23D1 and edx, ecx 1000402D . 8847 03 mov byte ptr [edi+3], al 10004030 . 8A46 02 mov al, byte ptr [esi+2] 10004033 . C1E9 02 shr ecx, 2 10004036 . 8847 02 mov byte ptr [edi+2], al 10004039 . 83EE 02 sub esi, 2 1000403C . 83EF 02 sub edi, 2 1000403F . 83F9 08 cmp ecx, 8 10004042 .^ 72 8C jb short 10003FD0 10004044 . FD std 10004045 . F3:A5 rep movs dword ptr es:[edi], dword p> 10004047 . FC cld 10004048 . FF2495 F04000>jmp dword ptr [edx4+100040F0] 1000404F 90 nop 10004050 > 8A46 03 mov al, byte ptr [esi+3] 10004053 . 23D1 and edx, ecx 10004055 . 8847 03 mov byte ptr [edi+3], al 10004058 . 8A46 02 mov al, byte ptr [esi+2] 1000405B . 8847 02 mov byte ptr [edi+2], al 1000405E . 8A46 01 mov al, byte ptr [esi+1] 10004061 . C1E9 02 shr ecx, 2 10004064 . 8847 01 mov byte ptr [edi+1], al 10004067 . 83EE 03 sub esi, 3 1000406A . 83EF 03 sub edi, 3 1000406D . 83F9 08 cmp ecx, 8 10004070 .^ 0F82 5AFFFFFF jb 10003FD0 10004076 . FD std 10004077 . F3:A5 rep movs dword ptr es:[edi], dword p> 10004079 . FC cld 1000407A . FF2495 F04000>jmp dword ptr [edx4+100040F0] 10004081 2E db 2E ; CHAR '.' 10004082 8BC0 mov eax, eax 10004084 . A4400010 dd pjgl.100040A4 10004088 . AC400010 dd pjgl.100040AC 1000408C . B4400010 dd pjgl.100040B4 10004090 . BC400010 dd pjgl.100040BC 10004094 . C4400010 dd pjgl.100040C4 10004098 . CC400010 dd pjgl.100040CC 1000409C . D4400010 dd pjgl.100040D4 100040A0 . E7400010 dd pjgl.100040E7 100040A4 > 8B448E 1C mov eax, dword ptr [esi+ecx4+1C] 100040A8 . 89448F 1C mov dword ptr [edi+ecx4+1C], eax 100040AC > 8B448E 18 mov eax, dword ptr [esi+ecx4+18] 100040B0 . 89448F 18 mov dword ptr [edi+ecx4+18], eax 100040B4 > 8B448E 14 mov eax, dword ptr [esi+ecx4+14] 100040B8 . 89448F 14 mov dword ptr [edi+ecx4+14], eax 100040BC > 8B448E 10 mov eax, dword ptr [esi+ecx4+10] 100040C0 . 89448F 10 mov dword ptr [edi+ecx4+10], eax 100040C4 > 8B448E 0C mov eax, dword ptr [esi+ecx4+C] 100040C8 . 89448F 0C mov dword ptr [edi+ecx4+C], eax 100040CC > 8B448E 08 mov eax, dword ptr [esi+ecx4+8] 100040D0 . 89448F 08 mov dword ptr [edi+ecx4+8], eax 100040D4 > 8B448E 04 mov eax, dword ptr [esi+ecx4+4] 100040D8 . 89448F 04 mov dword ptr [edi+ecx4+4], eax 100040DC . 8D048D 000000>lea eax, dword ptr [ecx4] 100040E3 . 03F0 add esi, eax 100040E5 . 03F8 add edi, eax 100040E7 > FF2495 F04000>jmp dword ptr [edx4+100040F0] 100040EE 8BC0 mov eax, eax 100040F0 . 00410010 dd pjgl.10004100 ; 分支表被用于 10003FF4 100040F4 . 08410010 dd pjgl.10004108 100040F8 . 18410010 dd pjgl.10004118 100040FC . 2C410010 dd pjgl.1000412C 10004100 > 8B45 08 mov eax, dword ptr [ebp+8] ; Case 0 of switch 10003FDE 10004103 . 5E pop esi 10004104 . 5F pop edi 10004105 . C9 leave 10004106 . C3 retn 10004107 90 nop 10004108 > 8A46 03 mov al, byte ptr [esi+3] ; Case 1 of switch 10003FDE 1000410B . 8847 03 mov byte ptr [edi+3], al 1000410E . 8B45 08 mov eax, dword ptr [ebp+8] 10004111 . 5E pop esi 10004112 . 5F pop edi 10004113 . C9 leave 10004114 . C3 retn 10004115 . 2E:8BC0 mov eax, eax 10004118 > 8A46 03 mov al, byte ptr [esi+3] ; Case 2 of switch 10003FDE 1000411B . 8847 03 mov byte ptr [edi+3], al 1000411E . 8A46 02 mov al, byte ptr [esi+2] 10004121 . 8847 02 mov byte ptr [edi+2], al 10004124 . 8B45 08 mov eax, dword ptr [ebp+8] 10004127 . 5E pop esi 10004128 . 5F pop edi 10004129 . C9 leave 1000412A . C3 retn 1000412B 90 nop 1000412C > 8A46 03 mov al, byte ptr [esi+3] ; Case 3 of switch 10003FDE 1000412F . 8847 03 mov byte ptr [edi+3], al 10004132 . 8A46 02 mov al, byte ptr [esi+2] 10004135 . 8847 02 mov byte ptr [edi+2], al 10004138 . 8A46 01 mov al, byte ptr [esi+1] 1000413B . 8847 01 mov byte ptr [edi+1], al 1000413E . 8B45 08 mov eax, dword ptr [ebp+8] 10004141 . 5E pop esi 10004142 . 5F pop edi 10004143 . C9 leave 10004144 . C3 retn 10004145 CC int3 10004146 CC int3 10004147 CC int3 10004148 CC int3 10004149 CC int3 1000414A CC int3 1000414B CC int3 1000414C CC int3 1000414D CC int3 1000414E CC int3 1000414F CC int3 10004150 /$ 53 push ebx 10004151 \|. 55 push ebp 10004152 \|. 56 push esi 10004153 \|. 8B7424 14 mov esi, dword ptr [esp+14] 10004157 \|. 0FAF7424 10 imul esi, dword ptr [esp+10] 1000415C \|. 83FE E0 cmp esi, -20 ; Switch (cases 0..FFFFFFFF) 1000415F \|. 57 push edi 10004160 \|. 77 11 ja short 10004173 10004162 \|. 85F6 test esi, esi 10004164 \|. 76 08 jbe short 1000416E 10004166 \|. 83C6 0F add esi, 0F ; Default case of switch 1000415C 10004169 \|. 83E6 F0 and esi, FFFFFFF0 1000416C \|. EB 05 jmp short 10004173 1000416E \|> BE 10000000 mov esi, 10 ; Case 0 of switch 1000415C 10004173 \|> 8B1D 84500010 mov ebx, dword ptr [<&KERNEL32.HeapA>; ntdll.RtlAllocateHeap; Cases FFFFFFE1,FFFFFFE2,FFFFFFE3,FFFFFFE4,FFFFFFE5,FFFFFFE6,FFFFFFE7,FFFFFFE8,FFFFFFE9,FFFFFFEA,FFFFFFEB,FFFFFFEC,FFFFFFED,FFFFFFEE,FFFFFFEF,FFFFFFF0,FFFFFFF1,FFFFFFF2,FFFFFFF3,FFFFFFF4... of switch 1000415C 10004179 \|> 33D2 /xor edx, edx 1000417B \|. 83FE E0 \|cmp esi, -20 1000417E \|. 77 42 \|ja short 100041C2 10004180 \|. 3B35 A4840010 \|cmp esi, dword ptr [100084A4] 10004186 \|. 77 28 \|ja short 100041B0 10004188 \|. 8BC6 \|mov eax, esi 1000418A \|. C1E8 04 \|shr eax, 4 1000418D \|. 50 \|push eax 1000418E \|. E8 2DF8FFFF \|call 100039C0 10004193 \|. 8BD0 \|mov edx, eax 10004195 \|. 83C4 04 \|add esp, 4 10004198 \|. 85D2 \|test edx, edx 1000419A \|. 74 18 \|je short 100041B4 1000419C \|. 8BCE \|mov ecx, esi 1000419E \|. 33C0 \|xor eax, eax 100041A0 \|. 8BE9 \|mov ebp, ecx 100041A2 \|. 8BFA \|mov edi, edx 100041A4 \|. C1E9 02 \|shr ecx, 2 100041A7 \|. F3:AB \|rep stos dword ptr es:[edi] 100041A9 \|. 8BCD \|mov ecx, ebp 100041AB \|. 83E1 03 \|and ecx, 3 100041AE \|. F3:AA \|rep stos byte ptr es:[edi] 100041B0 \|> 85D2 \|test edx, edx 100041B2 \|. 75 2D \|jnz short 100041E1 100041B4 \|> 8B0D 90880010 \|mov ecx, dword ptr [10008890] 100041BA \|. 56 \|push esi 100041BB \|. 6A 08 \|push 8 100041BD \|. 51 \|push ecx 100041BE \|. FFD3 \|call ebx 100041C0 \|. 8BD0 \|mov edx, eax 100041C2 \|> 85D2 \|test edx, edx 100041C4 \|. 75 1B \|jnz short 100041E1 100041C6 \|. A1 88880010 \|mov eax, dword ptr [10008888] 100041CB \|. 85C0 \|test eax, eax 100041CD \|. 74 12 \|je short 100041E1 100041CF \|. 56 \|push esi 100041D0 \|. E8 1B000000 \|call 100041F0 100041D5 \|. 83C4 04 \|add esp, 4 100041D8 \|. 85C0 \|test eax, eax 100041DA \|.^ 75 9D \jnz short 10004179 100041DC \|. 5F pop edi 100041DD \|. 5E pop esi 100041DE \|. 5D pop ebp 100041DF \|. 5B pop ebx 100041E0 \|. C3 retn 100041E1 \|> 5F pop edi 100041E2 \|. 5E pop esi 100041E3 \|. 5D pop ebp 100041E4 \|. 8BC2 mov eax, edx 100041E6 \|. 5B pop ebx 100041E7 \. C3 retn 100041E8 90 nop 2009-4-1 23:07 0
longdf 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 8 粉丝 0 关注私信	longdf 4 楼如要程序端请留言，或发邮件到 ldf2222#sohu.com 2009-4-1 23:08 0
icersg 雪币： 293 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 8 回帖 471 粉丝 0 关注私信	icersg 5 楼消灭零回复，看到过好多次这样的帖子了，给楼主提点建议。您上来就贴这么长的代码，又不能动态调试，只能眼巴巴的看，说实话，拖滚动条到最下面已经很累了。本来看汇编就是一件很枯燥的事情，而且还是这么没血没肉的东西，除了OD的自动注释，您一句注释都没有，让人感觉您很没有诚意，至少把你自己的分析结果贴出来，然别人知道您努力过了，现在什么地方有困难，让别人也好对症下药。每个人的精力都是有限的，一般人不会来看的，除非遇见志同道合的人，可是您连程序的描述都没有，即使别人搞过这个程序，也不可能一眼就认出来。如此说来，您又怎么找到志同道合的人呢？虽然缘分这种东西很神奇，如果不懂得珍惜，也是一场空。再看看其他求破的朋友，好歹人家把程序上传到网上空间，万一哪个路人有空，还会去试一下，多少给点提示。可是别人要帮您解决问题，还得向您求程序。我也是个初学者，也经常在网上提问。问题描述的清楚，才能让别人看得懂；说话做事要虚心，有诚意，别人才会帮您；寻求帮助的时候，也尽量替别人想一想，怎样才能方便别人回答。不要总像是挤牙膏一样，问一句，答一句；毕竟没有人欠您的，别人帮您忙算人情，不帮您是本分。 2009-4-2 12:32 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复