Disassembly 00401000 fn_00401000: 00401000 55 push ebp 00401001 8BEC mov ebp,esp 00401003 83EC08 sub esp,8 00401006 DD05F8204000 fld qword ptr [4020F8h] 0040100C 8D45F8 lea eax,[ebp-8] 0040100F 50 push eax 00401010 DD5DF8 fstp qword ptr [ebp-8] 00401013 68F4204000 push offset 4020F4h 00401018 FF15A0204000 call dword ptr [scanf] 0040101E 83C408 add esp,8 00401021 FF15A4204000 call dword ptr [_getch] 00401027 33C0 xor eax,eax 00401029 8BE5 mov esp,ebp 0040102B 5D pop ebp 0040102C C3 ret 0040102D 3B0D00304000 cmp ecx,[403000h] 00401033 7502 jnz loc_00401037 00401035 F3C3 rep ret 00401037 loc_00401037: 00401037 E998020000 jmp loc_004012D4 0040103C 680E154000 push offset 40150Eh 00401041 E88B040000 call fn_004014D1 00401046 A168334000 mov eax,[403368h] 0040104B C7042434304000 mov dword ptr [esp],offset 403034h 00401052 FF3564334000 push dword ptr [403364h] 00401058 A334304000 mov [403034h],eax 0040105D 6824304000 push offset 403024h 00401062 6828304000 push offset 403028h 00401067 6820304000 push offset 403020h 0040106C FF1594204000 call dword ptr [__getmainargs] 00401072 83C414 add esp,14h 00401075 A330304000 mov [403030h],eax 0040107A 85C0 test eax,eax 0040107C 7908 jns loc_00401086 0040107E 6A08 push 8 00401080 E8A5030000 call fn_0040142A 00401085 59 pop ecx 00401086 loc_00401086: 00401086 C3 ret 00401087 loc_00401087: 00401087 6A10 push 10h 00401089 68C8214000 push offset 4021C8h 0040108E E80D060000 call fn_004016A0 00401093 33DB xor ebx,ebx 00401095 391D84334000 cmp [403384h],ebx 0040109B 750B jnz loc_004010A8 0040109D 53 push ebx 0040109E 53 push ebx 0040109F 6A01 push 1 004010A1 53 push ebx 004010A2 FF152C204000 call dword ptr [HeapSetInformation] 004010A8 loc_004010A8: 004010A8 895DFC mov [ebp-4],ebx 004010AB 64A118000000 mov eax,fs:[18h] 004010B1 8B7004 mov esi,[eax+4] 004010B4 895DE4 mov [ebp-1Ch],ebx 004010B7 BF78334000 mov edi,offset 403378h 004010BC loc_004010BC: 004010BC 53 push ebx 004010BD 56 push esi 004010BE 57 push edi 004010BF FF1530204000 call dword ptr [InterlockedCompareExchange] 004010C5 3BC3 cmp eax,ebx 004010C7 7419 jz loc_004010E2 004010C9 3BC6 cmp eax,esi 004010CB 7508 jnz loc_004010D5 004010CD 33F6 xor esi,esi 004010CF 46 inc esi 004010D0 8975E4 mov [ebp-1Ch],esi 004010D3 EB10 jmp loc_004010E5 004010D5 loc_004010D5: 004010D5 68E8030000 push 3E8h 004010DA FF1534204000 call dword ptr [Sleep] 004010E0 EBDA jmp loc_004010BC 004010E2 loc_004010E2: 004010E2 33F6 xor esi,esi 004010E4 46 inc esi 004010E5 loc_004010E5: 004010E5 A174334000 mov eax,[403374h] 004010EA 3BC6 cmp eax,esi 004010EC 750A jnz loc_004010F8 004010EE 6A1F push 1Fh 004010F0 E835030000 call fn_0040142A 004010F5 59 pop ecx 004010F6 EB3B jmp loc_00401133 004010F8 loc_004010F8: 004010F8 A174334000 mov eax,[403374h] 004010FD 85C0 test eax,eax 004010FF 752C jnz loc_0040112D 00401101 893574334000 mov [403374h],esi 00401107 68C4204000 push offset 4020C4h 0040110C 68B8204000 push offset 4020B8h 00401111 E87C050000 call fn_00401692 00401116 59 pop ecx 00401117 59 pop ecx 00401118 85C0 test eax,eax 0040111A 7417 jz loc_00401133 0040111C C745FCFEFFFFFF mov dword ptr [ebp-4],0FFFFFFFEh 00401123 B8FF000000 mov eax,0FFh 00401128 E9DD000000 jmp loc_0040120A 0040112D loc_0040112D: 0040112D 89353C304000 mov [40303Ch],esi 00401133 loc_00401133: 00401133 A174334000 mov eax,[403374h] 00401138 3BC6 cmp eax,esi 0040113A 751B jnz loc_00401157 0040113C 68B4204000 push offset 4020B4h 00401141 68AC204000 push offset 4020ACh 00401146 E841050000 call fn_0040168C 0040114B 59 pop ecx 0040114C 59 pop ecx 0040114D C7057433400002000000 mov dword ptr [403374h],2 00401157 loc_00401157: 00401157 395DE4 cmp [ebp-1Ch],ebx 0040115A 7508 jnz loc_00401164 0040115C 53 push ebx 0040115D 57 push edi 0040115E FF1538204000 call dword ptr [InterlockedExchange] 00401164 loc_00401164: 00401164 391D88334000 cmp [403388h],ebx 0040116A 7419 jz loc_00401185 0040116C 6888334000 push offset 403388h 00401171 E85A040000 call fn_004015D0 00401176 59 pop ecx 00401177 85C0 test eax,eax 00401179 740A jz loc_00401185 0040117B 53 push ebx 0040117C 6A02 push 2 0040117E 53 push ebx 0040117F FF1588334000 call dword ptr [403388h] 00401185 loc_00401185: 00401185 A124304000 mov eax,[403024h] 0040118A 8B0D80204000 mov ecx,[__initenv] 00401190 8901 mov [ecx],eax 00401192 FF3524304000 push dword ptr [403024h] 00401198 FF3528304000 push dword ptr [403028h] 0040119E FF3520304000 push dword ptr [403020h] 004011A4 E857FEFFFF call fn_00401000 004011A9 83C40C add esp,0Ch 004011AC A338304000 mov [403038h],eax 004011B1 391D2C304000 cmp [40302Ch],ebx 004011B7 7537 jnz loc_004011F0 004011B9 50 push eax 004011BA FF1584204000 call dword ptr [exit] 004011C0 8B45EC mov eax,[ebp-14h] 004011C3 8B08 mov ecx,[eax] 004011C5 8B09 mov ecx,[ecx] 004011C7 894DE0 mov [ebp-20h],ecx 004011CA 50 push eax 004011CB 51 push ecx 004011CC E863030000 call fn_00401534 004011D1 59 pop ecx 004011D2 59 pop ecx 004011D3 C3 ret 004011D4 8B65E8 mov esp,[ebp-18h] 004011D7 8B45E0 mov eax,[ebp-20h] 004011DA A338304000 mov [403038h],eax 004011DF 33DB xor ebx,ebx 004011E1 391D2C304000 cmp [40302Ch],ebx 004011E7 7507 jnz loc_004011F0 004011E9 50 push eax 004011EA FF158C204000 call dword ptr [_exit] 004011F0 loc_004011F0: 004011F0 391D3C304000 cmp [40303Ch],ebx 004011F6 7506 jnz loc_004011FE 004011F8 FF1590204000 call dword ptr [_cexit] 004011FE loc_004011FE: 004011FE C745FCFEFFFFFF mov dword ptr [ebp-4],0FFFFFFFEh 00401205 A138304000 mov eax,[403038h] 0040120A loc_0040120A: 0040120A E8D6040000 call fn_004016E5 0040120F C3 ret 00401210 B84D5A0000 mov eax,5A4Dh 00401215 66390500004000 cmp [400000h],ax 0040121C 7404 jz loc_00401222 0040121E loc_0040121E: 0040121E 33C0 xor eax,eax 00401220 EB35 jmp loc_00401257 00401222 loc_00401222: 00401222 A13C004000 mov eax,[40003Ch] 00401227 81B80000400050450000 cmp dword ptr [eax+400000h],4550h 00401231 75EB jnz loc_0040121E 00401233 B90B010000 mov ecx,10Bh 00401238 66398818004000 cmp [eax+400018h],cx 0040123F 75DD jnz loc_0040121E 00401241 83B8740040000E cmp dword ptr [eax+400074h],0Eh 00401248 76D4 jbe loc_0040121E 0040124A 33C9 xor ecx,ecx 0040124C 3988E8004000 cmp [eax+4000E8h],ecx 00401252 0F95C1 setne cl 00401255 8BC1 mov eax,ecx 00401257 loc_00401257: 00401257 6A01 push 1 00401259 A32C304000 mov [40302Ch],eax 0040125E FF1564204000 call dword ptr [__set_app_type] 00401264 59 pop ecx 00401265 6AFF push 0FFFFFFFFh 00401267 FF1528204000 call dword ptr [EncodePointer] 0040126D 8B0D70334000 mov ecx,[403370h] 00401273 A37C334000 mov [40337Ch],eax 00401278 A380334000 mov [403380h],eax 0040127D A168204000 mov eax,[_fmode] 00401282 8908 mov [eax],ecx 00401284 A16C204000 mov eax,[_commode] 00401289 8B0D6C334000 mov ecx,[40336Ch] 0040128F 8908 mov [eax],ecx 00401291 E852020000 call fn_004014E8 00401296 E8AB040000 call fn_00401746 0040129B 833D1430400000 cmp dword ptr [403014h],0 004012A2 750C jnz loc_004012B0 004012A4 6846174000 push offset fn_00401746 004012A9 FF1570204000 call dword ptr [__setusermatherr] 004012AF 59 pop ecx 004012B0 loc_004012B0: 004012B0 E869040000 call fn_0040171E 004012B5 833D10304000FF cmp dword ptr [403010h],0FFFFFFFFh 004012BC 7509 jnz loc_004012C7 004012BE 6AFF push 0FFFFFFFFh 004012C0 FF1574204000 call dword ptr [_configthreadlocale] 004012C6 59 pop ecx 004012C7 loc_004012C7: 004012C7 33C0 xor eax,eax 004012C9 C3 ret 004012CA start: 004012CA E87A040000 call fn_00401749 004012CF E9B3FDFFFF jmp loc_00401087 004012D4 loc_004012D4: 004012D4 8BFF mov edi,edi 004012D6 55 push ebp 004012D7 8BEC mov ebp,esp 004012D9 81EC28030000 sub esp,328h 004012DF A348314000 mov [403148h],eax 004012E4 890D44314000 mov [403144h],ecx 004012EA 891540314000 mov [403140h],edx 004012F0 891D3C314000 mov [40313Ch],ebx 004012F6 893538314000 mov [403138h],esi 004012FC 893D34314000 mov [403134h],edi 00401302 668C1560314000 mov [403160h],ss 00401309 668C0D54314000 mov [403154h],cs 00401310 668C1D30314000 mov [403130h],ds 00401317 668C052C314000 mov [40312Ch],es 0040131E 668C2528314000 mov [403128h],fs 00401325 668C2D24314000 mov [403124h],gs 0040132C 9C pushfd 0040132D 8F0558314000 pop [403158h] 00401333 8B4500 mov eax,[ebp] 00401336 A34C314000 mov [40314Ch],eax 0040133B 8B4504 mov eax,[ebp+4] 0040133E A350314000 mov [403150h],eax 00401343 8D4508 lea eax,[ebp+8] 00401346 A35C314000 mov [40315Ch],eax 0040134B 8B85E0FCFFFF mov eax,[ebp-320h] 00401351 C7059830400001000100 mov dword ptr [403098h],10001h 0040135B A150314000 mov eax,[403150h] 00401360 A34C304000 mov [40304Ch],eax 00401365 C70540304000090400C0 mov dword ptr [403040h],0C0000409h 0040136F C7054430400001000000 mov dword ptr [403044h],1 00401379 A100304000 mov eax,[403000h] 0040137E 8985D8FCFFFF mov [ebp-328h],eax 00401384 A104304000 mov eax,[403004h] 00401389 8985DCFCFFFF mov [ebp-324h],eax 0040138F FF1514204000 call dword ptr [IsDebuggerPresent] 00401395 A390304000 mov [403090h],eax 0040139A 6A01 push 1 0040139C E843040000 call fn_004017E4 004013A1 59 pop ecx 004013A2 6A00 push 0 004013A4 FF1518204000 call dword ptr [SetUnhandledExceptionFilter] 004013AA 68EC204000 push offset 4020ECh 004013AF FF151C204000 call dword ptr [UnhandledExceptionFilter] 004013B5 833D9030400000 cmp dword ptr [403090h],0 004013BC 7508 jnz loc_004013C6 004013BE 6A01 push 1 004013C0 E81F040000 call fn_004017E4 004013C5 59 pop ecx 004013C6 loc_004013C6: 004013C6 68090400C0 push 0C0000409h 004013CB FF1520204000 call dword ptr [GetCurrentProcess] 004013D1 50 push eax 004013D2 FF1524204000 call dword ptr [TerminateProcess] 004013D8 C9 leave 004013D9 C3 ret 004013DA 8BFF mov edi,edi 004013DC 55 push ebp 004013DD 8BEC mov ebp,esp 004013DF 8B4508 mov eax,[ebp+8] 004013E2 8B00 mov eax,[eax] 004013E4 813863736DE0 cmp dword ptr [eax],0E06D7363h 004013EA 752A jnz loc_00401416 004013EC 83781003 cmp dword ptr [eax+10h],3 004013F0 7524 jnz loc_00401416 004013F2 8B4014 mov eax,[eax+14h] 004013F5 3D20059319 cmp eax,19930520h 004013FA 7415 jz loc_00401411 004013FC 3D21059319 cmp eax,19930521h 00401401 740E jz loc_00401411 00401403 3D22059319 cmp eax,19930522h 00401408 7407 jz loc_00401411 0040140A 3D00409901 cmp eax,1994000h 0040140F 7505 jnz loc_00401416 00401411 loc_00401411: 00401411 E8D4030000 call fn_004017EA 00401416 loc_00401416: 00401416 33C0 xor eax,eax 00401418 5D pop ebp 00401419 C20400 ret 4 0040141C 68DA134000 push offset 4013DAh 00401421 FF1518204000 call dword ptr [SetUnhandledExceptionFilter] 00401427 33C0 xor eax,eax 00401429 C3 ret 0040142A fn_0040142A: 0040142A FF2598204000 jmp dword ptr [_amsg_exit] 00401430 fn_00401430: 00401430 6A14 push 14h 00401432 68E8214000 push offset 4021E8h 00401437 E864020000 call fn_004016A0 0040143C FF3580334000 push dword ptr [403380h] 00401442 8B3510204000 mov esi,[DecodePointer] 00401448 FFD6 call esi 0040144A 8945E4 mov [ebp-1Ch],eax 0040144D 83F8FF cmp eax,0FFFFFFFFh 00401450 750C jnz loc_0040145E 00401452 FF7508 push dword ptr [ebp+8] 00401455 FF1550204000 call dword ptr [_onexit] 0040145B 59 pop ecx 0040145C EB64 jmp loc_004014C2 0040145E loc_0040145E: 0040145E 6A08 push 8 00401460 E897030000 call fn_004017FC 00401465 59 pop ecx 00401466 8365FC00 and dword ptr [ebp-4],0 0040146A FF3580334000 push dword ptr [403380h] 00401470 FFD6 call esi 00401472 8945E4 mov [ebp-1Ch],eax 00401475 FF357C334000 push dword ptr [40337Ch] 0040147B FFD6 call esi 0040147D 8945E0 mov [ebp-20h],eax 00401480 8D45E0 lea eax,[ebp-20h] 00401483 50 push eax 00401484 8D45E4 lea eax,[ebp-1Ch] 00401487 50 push eax 00401488 FF7508 push dword ptr [ebp+8] 0040148B 8B3528204000 mov esi,[EncodePointer] 00401491 FFD6 call esi 00401493 50 push eax 00401494 E85D030000 call fn_004017F6 00401499 83C40C add esp,0Ch 0040149C 8945DC mov [ebp-24h],eax 0040149F FF75E4 push dword ptr [ebp-1Ch] 004014A2 FFD6 call esi 004014A4 A380334000 mov [403380h],eax 004014A9 FF75E0 push dword ptr [ebp-20h] 004014AC FFD6 call esi 004014AE A37C334000 mov [40337Ch],eax 004014B3 C745FCFEFFFFFF mov dword ptr [ebp-4],0FFFFFFFEh 004014BA E809000000 call fn_004014C8 004014BF 8B45DC mov eax,[ebp-24h] 004014C2 loc_004014C2: 004014C2 E81E020000 call fn_004016E5 004014C7 C3 ret 004014C8 fn_004014C8: 004014C8 6A08 push 8 004014CA E821030000 call fn_004017F0 004014CF 59 pop ecx 004014D0 C3 ret 004014D1 fn_004014D1: 004014D1 8BFF mov edi,edi 004014D3 55 push ebp 004014D4 8BEC mov ebp,esp 004014D6 FF7508 push dword ptr [ebp+8] 004014D9 E852FFFFFF call fn_00401430 004014DE F7D8 neg eax 004014E0 1BC0 sbb eax,eax 004014E2 F7D8 neg eax 004014E4 59 pop ecx 004014E5 48 dec eax 004014E6 5D pop ebp 004014E7 C3 ret 004014E8 fn_004014E8: 004014E8 8BFF mov edi,edi 004014EA 56 push esi 004014EB B8B8214000 mov eax,offset 4021B8h 004014F0 BEB8214000 mov esi,offset 4021B8h 004014F5 57 push edi 004014F6 8BF8 mov edi,eax 004014F8 3BC6 cmp eax,esi 004014FA 730F jnb loc_0040150B 004014FC loc_004014FC: 004014FC 8B07 mov eax,[edi] 004014FE 85C0 test eax,eax 00401500 7402 jz loc_00401504 00401502 FFD0 call eax 00401504 loc_00401504: 00401504 83C704 add edi,4 00401507 3BFE cmp edi,esi 00401509 72F1 jb loc_004014FC 0040150B loc_0040150B: 0040150B 5F pop edi 0040150C 5E pop esi 0040150D C3 ret 0040150E 8BFF mov edi,edi 00401510 56 push esi 00401511 B8C0214000 mov eax,offset 4021C0h 00401516 BEC0214000 mov esi,offset 4021C0h 0040151B 57 push edi 0040151C 8BF8 mov edi,eax 0040151E 3BC6 cmp eax,esi 00401520 730F jnb loc_00401531 00401522 loc_00401522: 00401522 8B07 mov eax,[edi] 00401524 85C0 test eax,eax 00401526 7402 jz loc_0040152A 00401528 FFD0 call eax 0040152A loc_0040152A: 0040152A 83C704 add edi,4 0040152D 3BFE cmp edi,esi 0040152F 72F1 jb loc_00401522 00401531 loc_00401531: 00401531 5F pop edi 00401532 5E pop esi 00401533 C3 ret 00401534 fn_00401534: 00401534 FF2588204000 jmp dword ptr [_XcptFilter] 0040153A CC int 3 0040153B CC int 3 0040153C CC int 3 0040153D CC int 3 0040153E CC int 3 0040153F CC int 3 00401540 fn_00401540: 00401540 8BFF mov edi,edi 00401542 55 push ebp 00401543 8BEC mov ebp,esp 00401545 8B4D08 mov ecx,[ebp+8] 00401548 B84D5A0000 mov eax,5A4Dh 0040154D 663901 cmp [ecx],ax 00401550 7404 jz loc_00401556 00401552 loc_00401552: 00401552 33C0 xor eax,eax 00401554 5D pop ebp 00401555 C3 ret 00401556 loc_00401556: 00401556 8B413C mov eax,[ecx+3Ch] 00401559 03C1 add eax,ecx 0040155B 813850450000 cmp dword ptr [eax],4550h 00401561 75EF jnz loc_00401552 00401563 33D2 xor edx,edx 00401565 B90B010000 mov ecx,10Bh 0040156A 66394818 cmp [eax+18h],cx 0040156E 0F94C2 sete dl 00401571 8BC2 mov eax,edx 00401573 5D pop ebp 00401574 C3 ret 00401575 CC int 3 00401576 CC int 3 00401577 CC int 3 00401578 CC int 3 00401579 CC int 3 0040157A CC int 3 0040157B CC int 3 0040157C CC int 3 0040157D CC int 3 0040157E CC int 3 0040157F CC int 3 00401580 fn_00401580: 00401580 8BFF mov edi,edi 00401582 55 push ebp 00401583 8BEC mov ebp,esp 00401585 8B4508 mov eax,[ebp+8] 00401588 8B483C mov ecx,[eax+3Ch] 0040158B 03C8 add ecx,eax 0040158D 0FB74114 movzx eax,word ptr [ecx+14h] 00401591 53 push ebx 00401592 56 push esi 00401593 0FB77106 movzx esi,word ptr [ecx+6] 00401597 33D2 xor edx,edx 00401599 57 push edi 0040159A 8D440818 lea eax,[eax+ecx+18h] 0040159E 85F6 test esi,esi 004015A0 741B jz loc_004015BD 004015A2 8B7D0C mov edi,[ebp+0Ch] 004015A5 loc_004015A5: 004015A5 8B480C mov ecx,[eax+0Ch] 004015A8 3BF9 cmp edi,ecx 004015AA 7209 jb loc_004015B5 004015AC 8B5808 mov ebx,[eax+8] 004015AF 03D9 add ebx,ecx 004015B1 3BFB cmp edi,ebx 004015B3 720A jb loc_004015BF 004015B5 loc_004015B5: 004015B5 42 inc edx 004015B6 83C028 add eax,28h 004015B9 3BD6 cmp edx,esi 004015BB 72E8 jb loc_004015A5 004015BD loc_004015BD: 004015BD 33C0 xor eax,eax 004015BF loc_004015BF: 004015BF 5F pop edi 004015C0 5E pop esi 004015C1 5B pop ebx 004015C2 5D pop ebp 004015C3 C3 ret 004015C4 CC int 3 004015C5 CC int 3 004015C6 CC int 3 004015C7 CC int 3 004015C8 CC int 3 004015C9 CC int 3 004015CA CC int 3 004015CB CC int 3 004015CC CC int 3 004015CD CC int 3 004015CE CC int 3 004015CF CC int 3 004015D0 fn_004015D0: 004015D0 8BFF mov edi,edi 004015D2 55 push ebp 004015D3 8BEC mov ebp,esp 004015D5 6AFE push 0FFFFFFFEh 004015D7 6808224000 push offset 402208h 004015DC 68F9164000 push offset 4016F9h 004015E1 64A100000000 mov eax,fs:[0] 004015E7 50 push eax 004015E8 83EC08 sub esp,8 004015EB 53 push ebx 004015EC 56 push esi 004015ED 57 push edi 004015EE A100304000 mov eax,[403000h] 004015F3 3145F8 xor [ebp-8],eax 004015F6 33C5 xor eax,ebp 004015F8 50 push eax 004015F9 8D45F0 lea eax,[ebp-10h] 004015FC 64A300000000 mov fs:[0],eax 00401602 8965E8 mov [ebp-18h],esp 00401605 C745FC00000000 mov dword ptr [ebp-4],0 0040160C 6800004000 push offset 400000h 00401611 E82AFFFFFF call fn_00401540 00401616 83C404 add esp,4 00401619 85C0 test eax,eax 0040161B 7454 jz loc_00401671 0040161D 8B4508 mov eax,[ebp+8] 00401620 2D00004000 sub eax,offset 400000h 00401625 50 push eax 00401626 6800004000 push offset 400000h 0040162B E850FFFFFF call fn_00401580 00401630 83C408 add esp,8 00401633 85C0 test eax,eax 00401635 743A jz loc_00401671 00401637 8B4024 mov eax,[eax+24h] 0040163A C1E81F shr eax,1Fh 0040163D F7D0 not eax 0040163F 83E001 and eax,1 00401642 C745FCFEFFFFFF mov dword ptr [ebp-4],0FFFFFFFEh 00401649 8B4DF0 mov ecx,[ebp-10h] 0040164C 64890D00000000 mov fs:[0],ecx 00401653 59 pop ecx 00401654 5F pop edi 00401655 5E pop esi 00401656 5B pop ebx 00401657 8BE5 mov esp,ebp 00401659 5D pop ebp 0040165A C3 ret 0040165B 8B45EC mov eax,[ebp-14h] 0040165E 8B08 mov ecx,[eax] 00401660 33D2 xor edx,edx 00401662 8139050000C0 cmp dword ptr [ecx],0C0000005h 00401668 0F94C2 sete dl 0040166B 8BC2 mov eax,edx 0040166D C3 ret 0040166E 8B65E8 mov esp,[ebp-18h] 00401671 loc_00401671: 00401671 C745FCFEFFFFFF mov dword ptr [ebp-4],0FFFFFFFEh 00401678 33C0 xor eax,eax 0040167A 8B4DF0 mov ecx,[ebp-10h] 0040167D 64890D00000000 mov fs:[0],ecx 00401684 59 pop ecx 00401685 5F pop edi 00401686 5E pop esi 00401687 5B pop ebx 00401688 8BE5 mov esp,ebp 0040168A 5D pop ebp 0040168B C3 ret 0040168C fn_0040168C: 0040168C FF257C204000 jmp dword ptr [_initterm] 00401692 fn_00401692: 00401692 FF2578204000 jmp dword ptr [_initterm_e] 00401698 CC int 3 00401699 CC int 3 0040169A CC int 3 0040169B CC int 3 0040169C CC int 3 0040169D CC int 3 0040169E CC int 3 0040169F CC int 3 004016A0 fn_004016A0: 004016A0 68F9164000 push offset 4016F9h 004016A5 64FF3500000000 push dword ptr fs:[0] 004016AC 8B442410 mov eax,[esp+10h] 004016B0 896C2410 mov [esp+10h],ebp 004016B4 8D6C2410 lea ebp,[esp+10h] 004016B8 2BE0 sub esp,eax 004016BA 53 push ebx 004016BB 56 push esi 004016BC 57 push edi 004016BD A100304000 mov eax,[403000h] 004016C2 3145FC xor [ebp-4],eax 004016C5 33C5 xor eax,ebp 004016C7 50 push eax 004016C8 8965E8 mov [ebp-18h],esp 004016CB FF75F8 push dword ptr [ebp-8] 004016CE 8B45FC mov eax,[ebp-4] 004016D1 C745FCFEFFFFFF mov dword ptr [ebp-4],0FFFFFFFEh 004016D8 8945F8 mov [ebp-8],eax 004016DB 8D45F0 lea eax,[ebp-10h] 004016DE 64A300000000 mov fs:[0],eax 004016E4 C3 ret 004016E5 fn_004016E5: 004016E5 8B4DF0 mov ecx,[ebp-10h] 004016E8 64890D00000000 mov fs:[0],ecx 004016EF 59 pop ecx 004016F0 5F pop edi 004016F1 5F pop edi 004016F2 5E pop esi 004016F3 5B pop ebx 004016F4 8BE5 mov esp,ebp 004016F6 5D pop ebp 004016F7 51 push ecx 004016F8 C3 ret 004016F9 8BFF mov edi,edi 004016FB 55 push ebp 004016FC 8BEC mov ebp,esp 004016FE FF7514 push dword ptr [ebp+14h] 00401701 FF7510 push dword ptr [ebp+10h] 00401704 FF750C push dword ptr [ebp+0Ch] 00401707 FF7508 push dword ptr [ebp+8] 0040170A 682D104000 push offset 40102Dh 0040170F 6800304000 push offset 403000h 00401714 E8E9000000 call fn_00401802 00401719 83C418 add esp,18h 0040171C 5D pop ebp 0040171D C3 ret 0040171E fn_0040171E: 0040171E 8BFF mov edi,edi 00401720 56 push esi 00401721 6800000300 push 30000h 00401726 6800000100 push 10000h 0040172B 33F6 xor esi,esi 0040172D 56 push esi 0040172E E8DB000000 call fn_0040180E 00401733 83C40C add esp,0Ch 00401736 85C0 test eax,eax 00401738 740A jz loc_00401744 0040173A 56 push esi 0040173B 56 push esi 0040173C 56 push esi 0040173D 56 push esi 0040173E 56 push esi 0040173F E8C4000000 call fn_00401808 00401744 loc_00401744: 00401744 5E pop esi 00401745 C3 ret 00401746 fn_00401746: 00401746 33C0 xor eax,eax 00401748 C3 ret 00401749 fn_00401749: 00401749 8BFF mov edi,edi 0040174B 55 push ebp 0040174C 8BEC mov ebp,esp 0040174E 83EC10 sub esp,10h 00401751 A100304000 mov eax,[403000h] 00401756 8365F800 and dword ptr [ebp-8],0 0040175A 8365FC00 and dword ptr [ebp-4],0 0040175E 53 push ebx 0040175F 57 push edi 00401760 BF4EE640BB mov edi,0BB40E64Eh 00401765 BB0000FFFF mov ebx,0FFFF0000h 0040176A 3BC7 cmp eax,edi 0040176C 740D jz loc_0040177B 0040176E 85C3 test ebx,eax 00401770 7409 jz loc_0040177B 00401772 F7D0 not eax 00401774 A304304000 mov [403004h],eax 00401779 EB65 jmp loc_004017E0 0040177B loc_0040177B: 0040177B 56 push esi 0040177C 8D45F8 lea eax,[ebp-8] 0040177F 50 push eax 00401780 FF153C204000 call dword ptr [GetSystemTimeAsFileTime] 00401786 8B75FC mov esi,[ebp-4] 00401789 3375F8 xor esi,[ebp-8] 0040178C FF1500204000 call dword ptr [GetCurrentProcessId] 00401792 33F0 xor esi,eax 00401794 FF1504204000 call dword ptr [GetCurrentThreadId] 0040179A 33F0 xor esi,eax 0040179C FF1508204000 call dword ptr [GetTickCount] 004017A2 33F0 xor esi,eax 004017A4 8D45F0 lea eax,[ebp-10h] 004017A7 50 push eax 004017A8 FF150C204000 call dword ptr [QueryPerformanceCounter] 004017AE 8B45F4 mov eax,[ebp-0Ch] 004017B1 3345F0 xor eax,[ebp-10h] 004017B4 33F0 xor esi,eax 004017B6 3BF7 cmp esi,edi 004017B8 7507 jnz loc_004017C1 004017BA BE4FE640BB mov esi,0BB40E64Fh 004017BF EB10 jmp loc_004017D1 004017C1 loc_004017C1: 004017C1 85F3 test ebx,esi 004017C3 750C jnz loc_004017D1 004017C5 8BC6 mov eax,esi 004017C7 0D11470000 or eax,4711h 004017CC C1E010 shl eax,10h 004017CF 0BF0 or esi,eax 004017D1 loc_004017D1: 004017D1 893500304000 mov [403000h],esi 004017D7 F7D6 not esi 004017D9 893504304000 mov [403004h],esi 004017DF 5E pop esi 004017E0 loc_004017E0: 004017E0 5F pop edi 004017E1 5B pop ebx 004017E2 C9 leave 004017E3 C3 ret 004017E4 fn_004017E4: 004017E4 FF2560204000 jmp dword ptr [_crt_debugger_hook] 004017EA fn_004017EA: 004017EA FF2544204000 jmp dword ptr [?terminate@@YAXXZ] 004017F0 fn_004017F0: 004017F0 FF2548204000 jmp dword ptr [_unlock] 004017F6 fn_004017F6: 004017F6 FF254C204000 jmp dword ptr [__dllonexit] 004017FC fn_004017FC: 004017FC FF259C204000 jmp dword ptr [_lock] 00401802 fn_00401802: 00401802 FF2554204000 jmp dword ptr [_except_handler4_common] 00401808 fn_00401808: 00401808 FF2558204000 jmp dword ptr [_invoke_watson] 0040180E fn_0040180E: 0040180E FF255C204000 jmp dword ptr [_controlfp_s] 00401814 0000 add [eax],al 00401816 0000 add [eax],al 00401818 0000 add [eax],al 0040181A 0000 add [eax],al 0040181C 0000 add [eax],al 0040181E 0000 add [eax],al
Comments