10001000 /$ 55 PUSH EBP 10001001 |. 8BEC MOV EBP,ESP 10001003 |. 51 PUSH ECX 10001004 |. 8B45 0C MOV EAX,[ARG.2] 10001007 |. 8945 FC MOV [LOCAL.1],EAX 1000100A |. B8 01000000 MOV EAX,1 1000100F |. 8BE5 MOV ESP,EBP 10001011 |. 5D POP EBP ; kernel32.7C816FD7 10001012 \. C2 0C00 RETN 0C 10001015 CC INT3 10001016 CC INT3 10001017 CC INT3 10001018 CC INT3 10001019 CC INT3 1000101A CC INT3 1000101B CC INT3 1000101C CC INT3 1000101D CC INT3 1000101E CC INT3 1000101F CC INT3 10001020 /$ 55 PUSH EBP 10001021 |. 8BEC MOV EBP,ESP 10001023 |. 83EC 10 SUB ESP,10 10001026 |. C705 50AC0010 000>MOV DWORD PTR DS:[1000AC50],0 10001030 |. C705 54AC0010 000>MOV DWORD PTR DS:[1000AC54],0 1000103A |. 8D45 F8 LEA EAX,[LOCAL.2] 1000103D |. 50 PUSH EAX ; /pPerformanceFreq = 00000008 1000103E |. FF15 04800010 CALL DWORD PTR DS:[<&KERNEL32.QueryPerformanceFrequency>] ; \QueryPerformanceFrequency 10001044 |. 85C0 TEST EAX,EAX 10001046 |. 74 34 JE SHORT jagmisc.1000107C 10001048 |. 8D4D F0 LEA ECX,[LOCAL.4] 1000104B |. 51 PUSH ECX ; /pPerformanceCount = FFFFFFFF 1000104C |. FF15 00800010 CALL DWORD PTR DS:[<&KERNEL32.QueryPerformanceCounter>] ; \QueryPerformanceCounter 10001052 |. 85C0 TEST EAX,EAX 10001054 |. 74 26 JE SHORT jagmisc.1000107C 10001056 |. 8B55 F8 MOV EDX,[LOCAL.2] ; LOADDLL.00410249 10001059 |. 0B55 FC OR EDX,[LOCAL.1] 1000105C |. 74 1E JE SHORT jagmisc.1000107C 1000105E |. DF6D F0 FILD QWORD PTR SS:[EBP-10] 10001061 |. DC0D 40810010 FMUL QWORD PTR DS:[10008140] 10001067 |. DF6D F8 FILD QWORD PTR SS:[EBP-8] 1000106A |. DEF9 FDIVP ST(1),ST 1000106C |. E8 6F030000 CALL jagmisc.100013E0 10001071 |. A3 50AC0010 MOV DWORD PTR DS:[1000AC50],EAX 10001076 |. 8915 54AC0010 MOV DWORD PTR DS:[1000AC54],EDX 1000107C |> 8BE5 MOV ESP,EBP 1000107E |. 5D POP EBP ; kernel32.7C816FD7 1000107F \. C3 RETN 10001080 /. 55 PUSH EBP 10001081 |. 8BEC MOV EBP,ESP 10001083 |. 83EC 0C SUB ESP,0C 10001086 |. 6A 01 PUSH 1 ; /AffinityMask = 1 10001088 |. FF15 14800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentThread>] ; |[GetCurrentThread 1000108E |. 50 PUSH EAX ; |hThread = 00000008 1000108F |. FF15 10800010 CALL DWORD PTR DS:[<&KERNEL32.SetThreadAffinityMask>] ; \SetThreadAffinityMask 10001095 |. E8 86FFFFFF CALL jagmisc.10001020 1000109A |> B8 01000000 /MOV EAX,1 1000109F |. 85C0 |TEST EAX,EAX 100010A1 |. 74 5F |JE SHORT jagmisc.10001102 100010A3 |. 8B0D 48AC0010 |MOV ECX,DWORD PTR DS:[1000AC48] 100010A9 |. 51 |PUSH ECX ; /hEvent = FFFFFFFF 100010AA |. FF15 0C800010 |CALL DWORD PTR DS:[<&KERNEL32.SetEvent>] ; \SetEvent 100010B0 |. 8B15 38AC0010 |MOV EDX,DWORD PTR DS:[1000AC38] 100010B6 |. 8955 F8 |MOV [LOCAL.2],EDX 100010B9 |. A1 40AC0010 |MOV EAX,DWORD PTR DS:[1000AC40] 100010BE |. 8945 FC |MOV [LOCAL.1],EAX 100010C1 |. 6A FF |PUSH -1 ; /Timeout = INFINITE 100010C3 |. 6A 00 |PUSH 0 ; |WaitForAll = FALSE 100010C5 |. 8D4D F8 |LEA ECX,[LOCAL.2] ; | 100010C8 |. 51 |PUSH ECX ; |pObjects = FFFFFFFF 100010C9 |. 6A 02 |PUSH 2 ; |nObjects = 2 100010CB |. FF15 08800010 |CALL DWORD PTR DS:[<&KERNEL32.WaitForMultipleObjects>] ; \WaitForMultipleObjects 100010D1 |. 8945 F4 |MOV [LOCAL.3],EAX 100010D4 |. 837D F4 01 |CMP [LOCAL.3],1 100010D8 |. 75 0F |JNZ SHORT jagmisc.100010E9 100010DA |. 8B15 44AC0010 |MOV EDX,DWORD PTR DS:[1000AC44] 100010E0 |. 52 |PUSH EDX ; /hEvent = NULL 100010E1 |. FF15 0C800010 |CALL DWORD PTR DS:[<&KERNEL32.SetEvent>] ; \SetEvent 100010E7 |. EB 19 |JMP SHORT jagmisc.10001102 100010E9 |> 837D F4 00 |CMP [LOCAL.3],0 100010ED |. 75 11 |JNZ SHORT jagmisc.10001100 100010EF |. E8 2CFFFFFF |CALL jagmisc.10001020 100010F4 |. A1 3CAC0010 |MOV EAX,DWORD PTR DS:[1000AC3C] 100010F9 |. 50 |PUSH EAX ; /hEvent = 00000008 100010FA |. FF15 0C800010 |CALL DWORD PTR DS:[<&KERNEL32.SetEvent>] ; \SetEvent 10001100 |>^ EB 98 \JMP SHORT jagmisc.1000109A 10001102 |> 8BE5 MOV ESP,EBP 10001104 |. 5D POP EBP ; kernel32.7C816FD7 10001105 \. C3 RETN 10001106 CC INT3 10001107 CC INT3 10001108 CC INT3 10001109 CC INT3 1000110A CC INT3 1000110B CC INT3 1000110C CC INT3 1000110D CC INT3 1000110E CC INT3 1000110F CC INT3 10001110 /$ 55 PUSH EBP 10001111 |. 8BEC MOV EBP,ESP 10001113 |. A1 30A00010 MOV EAX,DWORD PTR DS:[1000A030] 10001118 |. 50 PUSH EAX ; /hObject = 00000008 10001119 |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle 1000111F |. 8B0D 48AC0010 MOV ECX,DWORD PTR DS:[1000AC48] 10001125 |. 51 PUSH ECX ; /hObject = FFFFFFFF 10001126 |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle 1000112C |. 8B15 38AC0010 MOV EDX,DWORD PTR DS:[1000AC38] 10001132 |. 52 PUSH EDX ; /hObject = NULL 10001133 |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle 10001139 |. A1 3CAC0010 MOV EAX,DWORD PTR DS:[1000AC3C] 1000113E |. 50 PUSH EAX ; /hObject = 00000008 1000113F |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle 10001145 |. 8B0D 40AC0010 MOV ECX,DWORD PTR DS:[1000AC40] 1000114B |. 51 PUSH ECX ; /hObject = FFFFFFFF 1000114C |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle 10001152 |. 8B15 44AC0010 MOV EDX,DWORD PTR DS:[1000AC44] 10001158 |. 52 PUSH EDX ; /hObject = NULL 10001159 |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle 1000115F |. 68 20AC0010 PUSH jagmisc.1000AC20 ; /pCriticalSection = jagmisc.1000AC20 10001164 |. FF15 18800010 CALL DWORD PTR DS:[<&KERNEL32.DeleteCriticalSection>] ; \DeleteCriticalSection 1000116A |. C705 58AC0010 000>MOV DWORD PTR DS:[1000AC58],0 10001174 |. 5D POP EBP ; kernel32.7C816FD7 10001175 \. C3 RETN 10001176 CC INT3 10001177 CC INT3 10001178 CC INT3 10001179 CC INT3 1000117A CC INT3 1000117B CC INT3 1000117C CC INT3 1000117D CC INT3 1000117E CC INT3 1000117F CC INT3 10001180 /$ 55 PUSH EBP 10001181 |. 8BEC MOV EBP,ESP 10001183 |. 833D 58AC0010 00 CMP DWORD PTR DS:[1000AC58],0 1000118A |. 75 02 JNZ SHORT jagmisc.1000118E 1000118C |. EB 39 JMP SHORT jagmisc.100011C7 1000118E |> A1 58AC0010 MOV EAX,DWORD PTR DS:[1000AC58] 10001193 |. 83E8 01 SUB EAX,1 10001196 |. A3 58AC0010 MOV DWORD PTR DS:[1000AC58],EAX 1000119B |. 74 02 JE SHORT jagmisc.1000119F 1000119D |. EB 28 JMP SHORT jagmisc.100011C7 1000119F |> 8B0D 40AC0010 MOV ECX,DWORD PTR DS:[1000AC40] 100011A5 |. 51 PUSH ECX ; /hEvent = FFFFFFFF 100011A6 |. FF15 0C800010 CALL DWORD PTR DS:[<&KERNEL32.SetEvent>] ; \SetEvent 100011AC |. 68 E8030000 PUSH 3E8 ; /Timeout = 1000. ms 100011B1 |. 8B15 44AC0010 MOV EDX,DWORD PTR DS:[1000AC44] ; | 100011B7 |. 52 PUSH EDX ; |hObject = NULL 100011B8 |. FF15 20800010 CALL DWORD PTR DS:[<&KERNEL32.WaitForSingleObject>] ; \WaitForSingleObject 100011BE |. 85C0 TEST EAX,EAX 100011C0 |. 75 05 JNZ SHORT jagmisc.100011C7 100011C2 |. E8 49FFFFFF CALL jagmisc.10001110 100011C7 |> 5D POP EBP ; kernel32.7C816FD7 100011C8 \. C3 RETN 100011C9 CC INT3 100011CA CC INT3 100011CB CC INT3 100011CC CC INT3 100011CD CC INT3 100011CE CC INT3 100011CF CC INT3 100011D0 /$ 55 PUSH EBP 100011D1 |. 8BEC MOV EBP,ESP 100011D3 |. A1 58AC0010 MOV EAX,DWORD PTR DS:[1000AC58] 100011D8 |. 8B0D 58AC0010 MOV ECX,DWORD PTR DS:[1000AC58] 100011DE |. 83C1 01 ADD ECX,1 100011E1 |. 890D 58AC0010 MOV DWORD PTR DS:[1000AC58],ECX 100011E7 |. 85C0 TEST EAX,EAX 100011E9 |. 74 0A JE SHORT jagmisc.100011F5 100011EB |. B8 01000000 MOV EAX,1 100011F0 |. E9 DA000000 JMP jagmisc.100012CF 100011F5 |> 6A 00 PUSH 0 ; /EventName = NULL 100011F7 |. 6A 00 PUSH 0 ; |InitiallySignaled = FALSE 100011F9 |. 6A 00 PUSH 0 ; |ManualReset = FALSE 100011FB |. 6A 00 PUSH 0 ; |pSecurity = NULL 100011FD |. FF15 28800010 CALL DWORD PTR DS:[<&KERNEL32.CreateEventA>] ; \CreateEventA 10001203 |. A3 48AC0010 MOV DWORD PTR DS:[1000AC48],EAX 10001208 |. 6A 00 PUSH 0 ; /EventName = NULL 1000120A |. 6A 00 PUSH 0 ; |InitiallySignaled = FALSE 1000120C |. 6A 00 PUSH 0 ; |ManualReset = FALSE 1000120E |. 6A 00 PUSH 0 ; |pSecurity = NULL 10001210 |. FF15 28800010 CALL DWORD PTR DS:[<&KERNEL32.CreateEventA>] ; \CreateEventA 10001216 |. A3 38AC0010 MOV DWORD PTR DS:[1000AC38],EAX 1000121B |. 6A 00 PUSH 0 ; /EventName = NULL 1000121D |. 6A 00 PUSH 0 ; |InitiallySignaled = FALSE 1000121F |. 6A 00 PUSH 0 ; |ManualReset = FALSE 10001221 |. 6A 00 PUSH 0 ; |pSecurity = NULL 10001223 |. FF15 28800010 CALL DWORD PTR DS:[<&KERNEL32.CreateEventA>] ; \CreateEventA 10001229 |. A3 3CAC0010 MOV DWORD PTR DS:[1000AC3C],EAX 1000122E |. 6A 00 PUSH 0 ; /EventName = NULL 10001230 |. 6A 00 PUSH 0 ; |InitiallySignaled = FALSE 10001232 |. 6A 00 PUSH 0 ; |ManualReset = FALSE 10001234 |. 6A 00 PUSH 0 ; |pSecurity = NULL 10001236 |. FF15 28800010 CALL DWORD PTR DS:[<&KERNEL32.CreateEventA>] ; \CreateEventA 1000123C |. A3 40AC0010 MOV DWORD PTR DS:[1000AC40],EAX 10001241 |. 6A 00 PUSH 0 ; /EventName = NULL 10001243 |. 6A 00 PUSH 0 ; |InitiallySignaled = FALSE 10001245 |. 6A 00 PUSH 0 ; |ManualReset = FALSE 10001247 |. 6A 00 PUSH 0 ; |pSecurity = NULL 10001249 |. FF15 28800010 CALL DWORD PTR DS:[<&KERNEL32.CreateEventA>] ; \CreateEventA 1000124F |. A3 44AC0010 MOV DWORD PTR DS:[1000AC44],EAX 10001254 |. 68 20AC0010 PUSH jagmisc.1000AC20 ; /pCriticalSection = jagmisc.1000AC20 10001259 |. FF15 24800010 CALL DWORD PTR DS:[<&KERNEL32.InitializeCriticalSection>] ; \InitializeCriticalSection 1000125F |. 6A 00 PUSH 0 10001261 |. 6A 00 PUSH 0 10001263 |. 68 80100010 PUSH jagmisc.10001080 10001268 |. E8 B8020000 CALL jagmisc.10001525 1000126D |. 83C4 0C ADD ESP,0C 10001270 |. A3 30A00010 MOV DWORD PTR DS:[1000A030],EAX 10001275 |. 68 E8030000 PUSH 3E8 ; /Timeout = 1000. ms 1000127A |. 8B15 48AC0010 MOV EDX,DWORD PTR DS:[1000AC48] ; | 10001280 |. 52 PUSH EDX ; |hObject = NULL 10001281 |. FF15 20800010 CALL DWORD PTR DS:[<&KERNEL32.WaitForSingleObject>] ; \WaitForSingleObject 10001287 |. 85C0 TEST EAX,EAX 10001289 |. 75 3D JNZ SHORT jagmisc.100012C8 1000128B |. 833D 48AC0010 00 CMP DWORD PTR DS:[1000AC48],0 10001292 |. 74 34 JE SHORT jagmisc.100012C8 10001294 |. 833D 38AC0010 00 CMP DWORD PTR DS:[1000AC38],0 1000129B |. 74 2B JE SHORT jagmisc.100012C8 1000129D |. 833D 3CAC0010 00 CMP DWORD PTR DS:[1000AC3C],0 100012A4 |. 74 22 JE SHORT jagmisc.100012C8 100012A6 |. 833D 40AC0010 00 CMP DWORD PTR DS:[1000AC40],0 100012AD |. 74 19 JE SHORT jagmisc.100012C8 100012AF |. 833D 44AC0010 00 CMP DWORD PTR DS:[1000AC44],0 100012B6 |. 74 10 JE SHORT jagmisc.100012C8 100012B8 |. 833D 30A00010 FF CMP DWORD PTR DS:[1000A030],-1 100012BF |. 74 07 JE SHORT jagmisc.100012C8 100012C1 |. B8 01000000 MOV EAX,1 100012C6 |. EB 07 JMP SHORT jagmisc.100012CF 100012C8 |> E8 43FEFFFF CALL jagmisc.10001110 100012CD |. 33C0 XOR EAX,EAX 100012CF |> 5D POP EBP ; kernel32.7C816FD7 100012D0 \. C3 RETN 100012D1 CC INT3 100012D2 CC INT3 100012D3 CC INT3 100012D4 CC INT3 100012D5 CC INT3 100012D6 CC INT3 100012D7 CC INT3 100012D8 CC INT3 100012D9 CC INT3 100012DA CC INT3 100012DB CC INT3 100012DC CC INT3 100012DD CC INT3 100012DE CC INT3 100012DF CC INT3 100012E0 j>/$ 55 PUSH EBP 100012E1 |. 8BEC MOV EBP,ESP 100012E3 |. E8 E8FEFFFF CALL jagmisc.100011D0 100012E8 |. 5D POP EBP ; kernel32.7C816FD7 100012E9 \. C2 0800 RETN 8 100012EC CC INT3 100012ED CC INT3 100012EE CC INT3 100012EF CC INT3 100012F0 j>/$ 55 PUSH EBP 100012F1 |. 8BEC MOV EBP,ESP 100012F3 |. 83EC 08 SUB ESP,8 100012F6 |. 833D 58AC0010 00 CMP DWORD PTR DS:[1000AC58],0 100012FD |. 75 06 JNZ SHORT jagmisc.10001305 100012FF |. 33C0 XOR EAX,EAX 10001301 |. 33D2 XOR EDX,EDX 10001303 |. EB 5D JMP SHORT jagmisc.10001362 10001305 |> 68 20AC0010 PUSH jagmisc.1000AC20 ; /pCriticalSection = jagmisc.1000AC20 1000130A |. FF15 30800010 CALL DWORD PTR DS:[<&KERNEL32.EnterCriticalSection>] ; \EnterCriticalSection 10001310 |. C745 F8 00000000 MOV [LOCAL.2],0 10001317 |. C745 FC 00000000 MOV [LOCAL.1],0 1000131E |. A1 38AC0010 MOV EAX,DWORD PTR DS:[1000AC38] 10001323 |. 50 PUSH EAX ; /hEvent = 00000008 10001324 |. FF15 0C800010 CALL DWORD PTR DS:[<&KERNEL32.SetEvent>] ; \SetEvent 1000132A |. 68 E8030000 PUSH 3E8 ; /Timeout = 1000. ms 1000132F |. 8B0D 3CAC0010 MOV ECX,DWORD PTR DS:[1000AC3C] ; | 10001335 |. 51 PUSH ECX ; |hObject = FFFFFFFF 10001336 |. FF15 20800010 CALL DWORD PTR DS:[<&KERNEL32.WaitForSingleObject>] ; \WaitForSingleObject 1000133C |. 85C0 TEST EAX,EAX 1000133E |. 75 11 JNZ SHORT jagmisc.10001351 10001340 |. 8B15 50AC0010 MOV EDX,DWORD PTR DS:[1000AC50] 10001346 |. 8955 F8 MOV [LOCAL.2],EDX 10001349 |. A1 54AC0010 MOV EAX,DWORD PTR DS:[1000AC54] 1000134E |. 8945 FC MOV [LOCAL.1],EAX 10001351 |> 68 20AC0010 PUSH jagmisc.1000AC20 ; /pCriticalSection = jagmisc.1000AC20 10001356 |. FF15 2C800010 CALL DWORD PTR DS:[<&KERNEL32.LeaveCriticalSection>] ; \LeaveCriticalSection 1000135C |. 8B45 F8 MOV EAX,[LOCAL.2] ; LOADDLL.00410249 1000135F |. 8B55 FC MOV EDX,[LOCAL.1] 10001362 |> 8BE5 MOV ESP,EBP 10001364 |. 5D POP EBP ; kernel32.7C816FD7 10001365 \. C2 0800 RETN 8 10001368 CC INT3 10001369 CC INT3 1000136A CC INT3 1000136B CC INT3 1000136C CC INT3 1000136D CC INT3 1000136E CC INT3 1000136F CC INT3 10001370 j>/$ 55 PUSH EBP 10001371 |. 8BEC MOV EBP,ESP 10001373 |. 8B45 0C MOV EAX,[ARG.2] 10001376 |. 50 PUSH EAX ; /Arg2 = 00000008 10001377 |. 8B4D 08 MOV ECX,[ARG.1] ; | 1000137A |. 51 PUSH ECX ; |Arg1 = FFFFFFFF 1000137B |. E8 70FFFFFF CALL jagmisc.Java_jagex3_jagmisc_jagmisc_nanoTime ; \Java_jagex3_jagmisc_jagmisc_nanoTime 10001380 |. E8 FBFDFFFF CALL jagmisc.10001180 10001385 |. 5D POP EBP ; kernel32.7C816FD7 10001386 \. C2 0800 RETN 8 10001389 . C3 RETN 1000138A /$ B8 FC1B0010 MOV EAX,jagmisc.10001BFC 1000138F |. A3 4CA00010 MOV DWORD PTR DS:[1000A04C],EAX 10001394 |. C705 50A00010 8A1>MOV DWORD PTR DS:[1000A050],jagmisc.1000188A 1000139E |. C705 54A00010 EF1>MOV DWORD PTR DS:[1000A054],jagmisc.100018EF 100013A8 |. C705 58A00010 4E1>MOV DWORD PTR DS:[1000A058],jagmisc.1000184E 100013B2 |. C705 5CA00010 D51>MOV DWORD PTR DS:[1000A05C],jagmisc.100018D5 100013BC |. A3 60A00010 MOV DWORD PTR DS:[1000A060],EAX 100013C1 \. C3 RETN 100013C2 . E8 C3FFFFFF CALL jagmisc.1000138A 100013C7 . E8 D3080000 CALL jagmisc.10001C9F 100013CC . 837C24 04 00 CMP DWORD PTR SS:[ESP+4],0 100013D1 . A3 60AC0010 MOV DWORD PTR DS:[1000AC60],EAX 100013D6 . 74 05 JE SHORT jagmisc.100013DD 100013D8 . E8 70080000 CALL jagmisc.10001C4D 100013DD > DBE2 FCLEX 100013DF . C3 RETN 100013E0 /$ 55 PUSH EBP 100013E1 |. 8BEC MOV EBP,ESP 100013E3 |. 83EC 20 SUB ESP,20 100013E6 |. 83E4 F0 AND ESP,FFFFFFF0 100013E9 |. D9C0 FLD ST 100013EB |. D95424 18 FST DWORD PTR SS:[ESP+18] 100013EF |. DF7C24 10 FISTP QWORD PTR SS:[ESP+10] 100013F3 |. DF6C24 10 FILD QWORD PTR SS:[ESP+10] 100013F7 |. 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+18] 100013FB |. 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 100013FF |. 85C0 TEST EAX,EAX 10001401 |. 74 3C JE SHORT jagmisc.1000143F 10001403 |> DEE9 FSUBP ST(1),ST 10001405 |. 85D2 TEST EDX,EDX 10001407 |. 79 1E JNS SHORT jagmisc.10001427 10001409 |. D91C24 FSTP DWORD PTR SS:[ESP] 1000140C |. 8B0C24 MOV ECX,DWORD PTR SS:[ESP] ; kernel32.7C816FD7 1000140F |. 81F1 00000080 XOR ECX,80000000 10001415 |. 81C1 FFFFFF7F ADD ECX,7FFFFFFF 1000141B |. 83D0 00 ADC EAX,0 1000141E |. 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14] 10001422 |. 83D2 00 ADC EDX,0 10001425 |. EB 2C JMP SHORT jagmisc.10001453 10001427 |> D91C24 FSTP DWORD PTR SS:[ESP] 1000142A |. 8B0C24 MOV ECX,DWORD PTR SS:[ESP] ; kernel32.7C816FD7 1000142D |. 81C1 FFFFFF7F ADD ECX,7FFFFFFF 10001433 |. 83D8 00 SBB EAX,0 10001436 |. 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14] 1000143A |. 83DA 00 SBB EDX,0 1000143D |. EB 14 JMP SHORT jagmisc.10001453 1000143F |> 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14] 10001443 |. F7C2 FFFFFF7F TEST EDX,7FFFFFFF 10001449 |.^ 75 B8 JNZ SHORT jagmisc.10001403 1000144B |. D95C24 18 FSTP DWORD PTR SS:[ESP+18] 1000144F |. D95C24 18 FSTP DWORD PTR SS:[ESP+18] 10001453 |> C9 LEAVE 10001454 \. C3 RETN 10001455 /$ A1 44A00010 MOV EAX,DWORD PTR DS:[1000A044] 1000145A |. 85C0 TEST EAX,EAX 1000145C |. 74 02 JE SHORT jagmisc.10001460 1000145E |. FFD0 CALL EAX 10001460 |> 56 PUSH ESI 10001461 |. E8 9B080000 CALL jagmisc.10001D01 10001466 |. 8BF0 MOV ESI,EAX 10001468 |. 85F6 TEST ESI,ESI 1000146A |. 75 08 JNZ SHORT jagmisc.10001474 1000146C |. 6A 10 PUSH 10 1000146E |. E8 A8030000 CALL jagmisc.1000181B 10001473 |. 59 POP ECX ; kernel32.7C816FD7 10001474 |> 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4] 10001477 |. 83F8 FF CMP EAX,-1 1000147A |. 74 07 JE SHORT jagmisc.10001483 1000147C |. 50 PUSH EAX ; /hObject = 00000008 1000147D |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle 10001483 |> 56 PUSH ESI 10001484 |. E8 300A0000 CALL jagmisc.10001EB9 10001489 |. 59 POP ECX ; kernel32.7C816FD7 1000148A |. 6A 00 PUSH 0 ; /ExitCode = 0 1000148C \. FF15 34800010 CALL DWORD PTR DS:[<&KERNEL32.ExitThread>] ; \ExitThread 10001492 . 5E POP ESI ; kernel32.7C816FD7 10001493 . 6A 0C PUSH 0C 10001495 . 68 48810010 PUSH jagmisc.10008148 1000149A . E8 D10E0000 CALL jagmisc.10002370 1000149F . FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; /TlsIndex = 1 100014A5 . FF15 7CAC0010 CALL DWORD PTR DS:[1000AC7C] ; \TlsGetValue 100014AB . 8BF0 MOV ESI,EAX 100014AD . 85F6 TEST ESI,ESI 100014AF . 75 1D JNZ SHORT jagmisc.100014CE 100014B1 . 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8] 100014B4 . 56 PUSH ESI ; /pValue = NULL 100014B5 . FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; |TlsIndex = 1 100014BB . FF15 80AC0010 CALL DWORD PTR DS:[1000AC80] ; \TlsSetValue 100014C1 . 85C0 TEST EAX,EAX 100014C3 . 75 25 JNZ SHORT jagmisc.100014EA 100014C5 . 6A 10 PUSH 10 100014C7 . E8 4F030000 CALL jagmisc.1000181B 100014CC . EB 1B JMP SHORT jagmisc.100014E9 100014CE > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 100014D1 . 8B48 4C MOV ECX,DWORD PTR DS:[EAX+4C] 100014D4 . 894E 4C MOV DWORD PTR DS:[ESI+4C],ECX 100014D7 . 8B48 50 MOV ECX,DWORD PTR DS:[EAX+50] 100014DA . 894E 50 MOV DWORD PTR DS:[ESI+50],ECX 100014DD . 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4] 100014E0 . 894E 04 MOV DWORD PTR DS:[ESI+4],ECX 100014E3 . 50 PUSH EAX 100014E4 . E8 140E0000 CALL jagmisc.100022FD 100014E9 > 59 POP ECX ; kernel32.7C816FD7 100014EA > A1 40A00010 MOV EAX,DWORD PTR DS:[1000A040] 100014EF . 85C0 TEST EAX,EAX 100014F1 . 74 02 JE SHORT jagmisc.100014F5 100014F3 . FFD0 CALL EAX 100014F5 > 8365 FC 00 AND DWORD PTR SS:[EBP-4],0 100014F9 . FF76 50 PUSH DWORD PTR DS:[ESI+50] 100014FC . FF56 4C CALL DWORD PTR DS:[ESI+4C] 100014FF . 59 POP ECX ; kernel32.7C816FD7 10001500 . E8 50FFFFFF CALL jagmisc.10001455 10001505 . 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] 10001508 . 8B08 MOV ECX,DWORD PTR DS:[EAX] 1000150A . 8B09 MOV ECX,DWORD PTR DS:[ECX] 1000150C . 894D E4 MOV DWORD PTR SS:[EBP-1C],ECX 1000150F . 50 PUSH EAX 10001510 . 51 PUSH ECX 10001511 . E8 680C0000 CALL jagmisc.1000217E 10001516 . 59 POP ECX ; kernel32.7C816FD7 10001517 . 59 POP ECX ; kernel32.7C816FD7 10001518 . C3 RETN 10001519 8B DB 8B 1000151A 65 DB 65 ; CHAR 'e' 1000151B E8 DB E8 1000151C FF DB FF 1000151D 75 DB 75 ; CHAR 'u' 1000151E E4 DB E4 1000151F E8 DB E8 10001520 3A DB 3A ; CHAR ':' 10001521 0C DB 0C 10001522 00 DB 00 10001523 00 DB 00 10001524 CC INT3 10001525 /$ 53 PUSH EBX 10001526 |. 57 PUSH EDI 10001527 |. 8B7C24 0C MOV EDI,DWORD PTR SS:[ESP+C] 1000152B |. 33DB XOR EBX,EBX 1000152D |. 85FF TEST EDI,EDI 1000152F |. 75 10 JNZ SHORT jagmisc.10001541 10001531 |. E8 8F0F0000 CALL jagmisc.100024C5 10001536 |. C700 16000000 MOV DWORD PTR DS:[EAX],16 1000153C |. 83C8 FF OR EAX,FFFFFFFF 1000153F |. EB 72 JMP SHORT jagmisc.100015B3 10001541 |> 56 PUSH ESI 10001542 |. 68 8C000000 PUSH 8C 10001547 |. 6A 01 PUSH 1 10001549 |. E8 F30F0000 CALL jagmisc.10002541 1000154E |. 8BF0 MOV ESI,EAX 10001550 |. 85F6 TEST ESI,ESI 10001552 |. 59 POP ECX ; kernel32.7C816FD7 10001553 |. 59 POP ECX ; kernel32.7C816FD7 10001554 |. 74 43 JE SHORT jagmisc.10001599 10001556 |. 56 PUSH ESI 10001557 |. E8 92070000 CALL jagmisc.10001CEE 1000155C |. 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C] 10001560 |. 59 POP ECX ; kernel32.7C816FD7 10001561 |. 56 PUSH ESI ; /pThreadId = NULL 10001562 |. 6A 04 PUSH 4 ; |CreationFlags = CREATE_SUSPENDED 10001564 |. 56 PUSH ESI ; |pThreadParm = NULL 10001565 |. 68 93140010 PUSH jagmisc.10001493 ; |ThreadFunction = jagmisc.10001493 1000156A |. FF7424 24 PUSH DWORD PTR SS:[ESP+24] ; |StackSize = 7C816FE0 (2088857568.) 1000156E |. 897E 4C MOV DWORD PTR DS:[ESI+4C],EDI ; | 10001571 |. 6A 00 PUSH 0 ; |pSecurity = NULL 10001573 |. 8946 50 MOV DWORD PTR DS:[ESI+50],EAX ; | 10001576 |. FF15 40800010 CALL DWORD PTR DS:[<&KERNEL32.CreateThread>] ; \CreateThread 1000157C |. 8BF8 MOV EDI,EAX 1000157E |. 85FF TEST EDI,EDI 10001580 |. 897E 04 MOV DWORD PTR DS:[ESI+4],EDI 10001583 |. 74 0C JE SHORT jagmisc.10001591 10001585 |. 57 PUSH EDI ; /hThread = NULL 10001586 |. FF15 3C800010 CALL DWORD PTR DS:[<&KERNEL32.ResumeThread>] ; \ResumeThread 1000158C |. 83F8 FF CMP EAX,-1 1000158F |. 75 1F JNZ SHORT jagmisc.100015B0 10001591 |> FF15 38800010 CALL DWORD PTR DS:[<&KERNEL32.GetLastError>] ; [GetLastError 10001597 |. 8BD8 MOV EBX,EAX 10001599 |> 56 PUSH ESI 1000159A |. E8 5E0D0000 CALL jagmisc.100022FD 1000159F |. 85DB TEST EBX,EBX 100015A1 |. 59 POP ECX ; kernel32.7C816FD7 100015A2 |. 74 07 JE SHORT jagmisc.100015AB 100015A4 |. 53 PUSH EBX 100015A5 |. E8 240F0000 CALL jagmisc.100024CE 100015AA |. 59 POP ECX ; kernel32.7C816FD7 100015AB |> 83C8 FF OR EAX,FFFFFFFF 100015AE |. EB 02 JMP SHORT jagmisc.100015B2 100015B0 |> 8BC7 MOV EAX,EDI 100015B2 |> 5E POP ESI ; kernel32.7C816FD7 100015B3 |> 5F POP EDI ; kernel32.7C816FD7 100015B4 |. 5B POP EBX ; kernel32.7C816FD7 100015B5 \. C3 RETN 100015B6 /$ 55 PUSH EBP 100015B7 |. 8BEC MOV EBP,ESP 100015B9 |. 8B45 0C MOV EAX,[ARG.2] 100015BC |. 83F8 01 CMP EAX,1 100015BF |. 56 PUSH ESI 100015C0 |. 0F85 E0000000 JNZ jagmisc.100016A6 100015C6 |. B8 94000000 MOV EAX,94 100015CB |. E8 E0170000 CALL jagmisc.10002DB0 100015D0 |. 8BF4 MOV ESI,ESP 100015D2 |. 56 PUSH ESI ; /pVersionInformation = NULL 100015D3 |. C706 94000000 MOV DWORD PTR DS:[ESI],94 ; | 100015D9 |. FF15 4C800010 CALL DWORD PTR DS:[<&KERNEL32.GetVersionExA>] ; \GetVersionExA 100015DF |. 85C0 TEST EAX,EAX 100015E1 |. 0F84 34010000 JE jagmisc.1000171B 100015E7 |. 8B4E 10 MOV ECX,DWORD PTR DS:[ESI+10] 100015EA |. 890D 8CAC0010 MOV DWORD PTR DS:[1000AC8C],ECX 100015F0 |. 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4] 100015F3 |. A3 98AC0010 MOV DWORD PTR DS:[1000AC98],EAX 100015F8 |. 8B56 08 MOV EDX,DWORD PTR DS:[ESI+8] 100015FB |. 8915 9CAC0010 MOV DWORD PTR DS:[1000AC9C],EDX 10001601 |. 8B76 0C MOV ESI,DWORD PTR DS:[ESI+C] 10001604 |. 81E6 FF7F0000 AND ESI,7FFF 1000160A |. 83F9 02 CMP ECX,2 1000160D |. 8935 90AC0010 MOV DWORD PTR DS:[1000AC90],ESI 10001613 |. 74 0C JE SHORT jagmisc.10001621 10001615 |. 81CE 00800000 OR ESI,8000 1000161B |. 8935 90AC0010 MOV DWORD PTR DS:[1000AC90],ESI 10001621 |> C1E0 08 SHL EAX,8 10001624 |. 03C2 ADD EAX,EDX 10001626 |. 6A 01 PUSH 1 10001628 |. A3 94AC0010 MOV DWORD PTR DS:[1000AC94],EAX 1000162D |. E8 AD160000 CALL jagmisc.10002CDF 10001632 |. 85C0 TEST EAX,EAX 10001634 |. 59 POP ECX ; kernel32.7C816FD7 10001635 |. 0F84 E0000000 JE jagmisc.1000171B 1000163B |. E8 A8080000 CALL jagmisc.10001EE8 10001640 |. 85C0 TEST EAX,EAX 10001642 |. 75 0A JNZ SHORT jagmisc.1000164E 10001644 |> E8 E7160000 CALL jagmisc.10002D30 10001649 |. E9 CD000000 JMP jagmisc.1000171B 1000164E |> E8 EA150000 CALL jagmisc.10002C3D 10001653 |. FF15 48800010 CALL DWORD PTR DS:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA 10001659 |. A3 90B40010 MOV DWORD PTR DS:[1000B490],EAX 1000165E |. E8 B8140000 CALL jagmisc.10002B1B 10001663 |. A3 68AC0010 MOV DWORD PTR DS:[1000AC68],EAX 10001668 |. E8 8F0F0000 CALL jagmisc.100025FC 1000166D |. 85C0 TEST EAX,EAX 1000166F |. 7C 2E JL SHORT jagmisc.1000169F 10001671 |. E8 03140000 CALL jagmisc.10002A79 10001676 |. 85C0 TEST EAX,EAX 10001678 |. 7C 20 JL SHORT jagmisc.1000169A 1000167A |. E8 C7110000 CALL jagmisc.10002846 1000167F |. 85C0 TEST EAX,EAX 10001681 |. 7C 17 JL SHORT jagmisc.1000169A 10001683 |. 6A 00 PUSH 0 10001685 |. E8 A7090000 CALL jagmisc.10002031 1000168A |. 85C0 TEST EAX,EAX 1000168C |. 59 POP ECX ; kernel32.7C816FD7 1000168D |. 75 0B JNZ SHORT jagmisc.1000169A 1000168F |. FF05 64AC0010 INC DWORD PTR DS:[1000AC64] 10001695 |. E9 92000000 JMP jagmisc.1000172C 1000169A |> E8 5B110000 CALL jagmisc.100027FA 1000169F |> E8 2D060000 CALL jagmisc.10001CD1 100016A4 |.^ EB 9E JMP SHORT jagmisc.10001644 100016A6 |> 85C0 TEST EAX,EAX 100016A8 |. 75 2C JNZ SHORT jagmisc.100016D6 100016AA |. 3905 64AC0010 CMP DWORD PTR DS:[1000AC64],EAX 100016B0 |. 7E 69 JLE SHORT jagmisc.1000171B 100016B2 |. FF0D 64AC0010 DEC DWORD PTR DS:[1000AC64] 100016B8 |. 3905 C8AC0010 CMP DWORD PTR DS:[1000ACC8],EAX 100016BE |. 75 05 JNZ SHORT jagmisc.100016C5 100016C0 |. E8 AA0A0000 CALL jagmisc.1000216F 100016C5 |> E8 30110000 CALL jagmisc.100027FA 100016CA |. E8 02060000 CALL jagmisc.10001CD1 100016CF |. E8 5C160000 CALL jagmisc.10002D30 100016D4 |. EB 56 JMP SHORT jagmisc.1000172C 100016D6 |> 83F8 02 CMP EAX,2 100016D9 |. 75 44 JNZ SHORT jagmisc.1000171F 100016DB |. 68 8C000000 PUSH 8C 100016E0 |. 6A 01 PUSH 1 100016E2 |. E8 5A0E0000 CALL jagmisc.10002541 100016E7 |. 8BF0 MOV ESI,EAX 100016E9 |. 85F6 TEST ESI,ESI 100016EB |. 59 POP ECX ; kernel32.7C816FD7 100016EC |. 59 POP ECX ; kernel32.7C816FD7 100016ED |. 74 2C JE SHORT jagmisc.1000171B 100016EF |. 56 PUSH ESI ; /pValue = NULL 100016F0 |. FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; |TlsIndex = 1 100016F6 |. FF15 80AC0010 CALL DWORD PTR DS:[1000AC80] ; \TlsSetValue 100016FC |. 85C0 TEST EAX,EAX 100016FE |. 56 PUSH ESI 100016FF |. 74 14 JE SHORT jagmisc.10001715 10001701 |. E8 E8050000 CALL jagmisc.10001CEE 10001706 |. 59 POP ECX ; kernel32.7C816FD7 10001707 |. FF15 44800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentThreadId>] ; [GetCurrentThreadId 1000170D |. 834E 04 FF OR DWORD PTR DS:[ESI+4],FFFFFFFF 10001711 |. 8906 MOV DWORD PTR DS:[ESI],EAX 10001713 |. EB 17 JMP SHORT jagmisc.1000172C 10001715 |> E8 E30B0000 CALL jagmisc.100022FD 1000171A |. 59 POP ECX ; kernel32.7C816FD7 1000171B |> 33C0 XOR EAX,EAX 1000171D |. EB 10 JMP SHORT jagmisc.1000172F 1000171F |> 83F8 03 CMP EAX,3 10001722 |. 75 08 JNZ SHORT jagmisc.1000172C 10001724 |. 6A 00 PUSH 0 10001726 |. E8 8E070000 CALL jagmisc.10001EB9 1000172B |. 59 POP ECX ; kernel32.7C816FD7 1000172C |> 33C0 XOR EAX,EAX 1000172E |. 40 INC EAX 1000172F |> 8D65 FC LEA ESP,[LOCAL.1] 10001732 |. 5E POP ESI ; kernel32.7C816FD7 10001733 |. 5D POP EBP ; kernel32.7C816FD7 10001734 \. C2 0C00 RETN 0C 10001737 j> $ 6A 0C PUSH 0C 10001739 . 68 58810010 PUSH jagmisc.10008158 1000173E . E8 2D0C0000 CALL jagmisc.10002370 10001743 . 33C0 XOR EAX,EAX 10001745 . 40 INC EAX 10001746 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 10001749 . 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C] 1000174C . 33FF XOR EDI,EDI 1000174E . 3BF7 CMP ESI,EDI 10001750 . 75 0C JNZ SHORT jagmisc.1000175E 10001752 . 393D 64AC0010 CMP DWORD PTR DS:[1000AC64],EDI 10001758 . 0F84 B3000000 JE jagmisc.10001811 1000175E > 897D FC MOV DWORD PTR SS:[EBP-4],EDI 10001761 . 3BF0 CMP ESI,EAX 10001763 . 74 05 JE SHORT jagmisc.1000176A 10001765 . 83FE 02 CMP ESI,2 10001768 . 75 31 JNZ SHORT jagmisc.1000179B 1000176A > A1 94B40010 MOV EAX,DWORD PTR DS:[1000B494] 1000176F . 3BC7 CMP EAX,EDI 10001771 . 74 0C JE SHORT jagmisc.1000177F 10001773 . FF75 10 PUSH DWORD PTR SS:[EBP+10] 10001776 . 56 PUSH ESI 10001777 . FF75 08 PUSH DWORD PTR SS:[EBP+8] 1000177A . FFD0 CALL EAX 1000177C . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 1000177F > 397D E4 CMP DWORD PTR SS:[EBP-1C],EDI 10001782 . 0F84 85000000 JE jagmisc.1000180D 10001788 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; /Arg3 = 8054A6ED 1000178B . 56 PUSH ESI ; |Arg2 = 00000000 1000178C . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |Arg1 = FFFFFFFF 1000178F . E8 22FEFFFF CALL jagmisc.100015B6 ; \jagmisc.100015B6 10001794 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 10001797 . 3BC7 CMP EAX,EDI 10001799 . 74 72 JE SHORT jagmisc.1000180D 1000179B > 8B5D 10 MOV EBX,DWORD PTR SS:[EBP+10] 1000179E . 53 PUSH EBX ; /Arg3 = 00000000 1000179F . 56 PUSH ESI ; |Arg2 = 00000000 100017A0 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |Arg1 = FFFFFFFF 100017A3 . E8 58F8FFFF CALL jagmisc.10001000 ; \jagmisc.10001000 100017A8 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 100017AB . 83FE 01 CMP ESI,1 100017AE . 75 0E JNZ SHORT jagmisc.100017BE 100017B0 . 3BC7 CMP EAX,EDI 100017B2 . 75 0A JNZ SHORT jagmisc.100017BE 100017B4 . 53 PUSH EBX ; /Arg3 = 00000000 100017B5 . 57 PUSH EDI ; |Arg2 = 00000000 100017B6 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |Arg1 = FFFFFFFF 100017B9 . E8 F8FDFFFF CALL jagmisc.100015B6 ; \jagmisc.100015B6 100017BE > 3BF7 CMP ESI,EDI 100017C0 . 74 05 JE SHORT jagmisc.100017C7 100017C2 . 83FE 03 CMP ESI,3 100017C5 . 75 29 JNZ SHORT jagmisc.100017F0 100017C7 > 53 PUSH EBX ; /Arg3 = 00000000 100017C8 . 56 PUSH ESI ; |Arg2 = 00000000 100017C9 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |Arg1 = FFFFFFFF 100017CC . E8 E5FDFFFF CALL jagmisc.100015B6 ; \jagmisc.100015B6 100017D1 . 85C0 TEST EAX,EAX 100017D3 . 75 03 JNZ SHORT jagmisc.100017D8 100017D5 . 897D E4 MOV DWORD PTR SS:[EBP-1C],EDI 100017D8 > 397D E4 CMP DWORD PTR SS:[EBP-1C],EDI 100017DB . 74 13 JE SHORT jagmisc.100017F0 100017DD . A1 94B40010 MOV EAX,DWORD PTR DS:[1000B494] 100017E2 . 3BC7 CMP EAX,EDI 100017E4 . 74 0A JE SHORT jagmisc.100017F0 100017E6 . 53 PUSH EBX 100017E7 . 56 PUSH ESI 100017E8 . FF75 08 PUSH DWORD PTR SS:[EBP+8] 100017EB . FFD0 CALL EAX 100017ED . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 100017F0 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 100017F4 . 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C] 100017F7 . EB 1A JMP SHORT jagmisc.10001813 100017F9 . 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] 100017FC . 8B08 MOV ECX,DWORD PTR DS:[EAX] 100017FE . 8B09 MOV ECX,DWORD PTR DS:[ECX] 10001800 . 50 PUSH EAX 10001801 . 51 PUSH ECX 10001802 . E8 DB0A0000 CALL jagmisc.100022E2 10001807 . 59 POP ECX ; kernel32.7C816FD7 10001808 . 59 POP ECX ; kernel32.7C816FD7 10001809 . C3 RETN 1000180A . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451 1000180D > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10001811 > 33C0 XOR EAX,EAX 10001813 > E8 930B0000 CALL jagmisc.100023AB 10001818 . C2 0C00 RETN 0C 1000181B /$ A1 70AC0010 MOV EAX,DWORD PTR DS:[1000AC70] 10001820 |. 83F8 01 CMP EAX,1 10001823 |. 74 0D JE SHORT jagmisc.10001832 10001825 |. 85C0 TEST EAX,EAX 10001827 |. 75 0E JNZ SHORT jagmisc.10001837 10001829 |. 833D 74AC0010 01 CMP DWORD PTR DS:[1000AC74],1 10001830 |. 75 05 JNZ SHORT jagmisc.10001837 10001832 |> E8 2D170000 CALL jagmisc.10002F64 10001837 |> FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738 1000183B |. E8 AD150000 CALL jagmisc.10002DED 10001840 |. 68 FF000000 PUSH 0FF 10001845 |. FF15 48A00010 CALL DWORD PTR DS:[1000A048] ; jagmisc.1000215E 1000184B |. 59 POP ECX ; kernel32.7C816FD7 1000184C |. 59 POP ECX ; kernel32.7C816FD7 1000184D \. C3 RETN 1000184E . 56 PUSH ESI 1000184F . 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 10001853 . 0FBE06 MOVSX EAX,BYTE PTR DS:[ESI] 10001856 . 50 PUSH EAX 10001857 . E8 43180000 CALL jagmisc.1000309F 1000185C . 83F8 65 CMP EAX,65 1000185F . EB 0C JMP SHORT jagmisc.1000186D 10001861 > 46 INC ESI 10001862 . 0FBE06 MOVSX EAX,BYTE PTR DS:[ESI] 10001865 . 50 PUSH EAX 10001866 . E8 32170000 CALL jagmisc.10002F9D 1000186B . 85C0 TEST EAX,EAX 1000186D > 59 POP ECX ; kernel32.7C816FD7 1000186E .^ 75 F1 JNZ SHORT jagmisc.10001861 10001870 . 8A06 MOV AL,BYTE PTR DS:[ESI] 10001872 . 8A0D 1CA30010 MOV CL,BYTE PTR DS:[1000A31C] 10001878 . 880E MOV BYTE PTR DS:[ESI],CL 1000187A . 46 INC ESI 1000187B > 8A0E MOV CL,BYTE PTR DS:[ESI] 1000187D . 8806 MOV BYTE PTR DS:[ESI],AL 1000187F . 8AC1 MOV AL,CL 10001881 . 8A0E MOV CL,BYTE PTR DS:[ESI] 10001883 . 46 INC ESI 10001884 . 84C9 TEST CL,CL 10001886 .^ 75 F3 JNZ SHORT jagmisc.1000187B 10001888 . 5E POP ESI ; kernel32.7C816FD7 10001889 . C3 RETN 1000188A . 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 1000188E . 53 PUSH EBX 1000188F . 8A1D 1CA30010 MOV BL,BYTE PTR DS:[1000A31C] 10001895 . EB 05 JMP SHORT jagmisc.1000189C 10001897 > 3ACB CMP CL,BL 10001899 . 74 07 JE SHORT jagmisc.100018A2 1000189B . 40 INC EAX 1000189C > 8A08 MOV CL,BYTE PTR DS:[EAX] 1000189E . 84C9 TEST CL,CL 100018A0 .^ 75 F5 JNZ SHORT jagmisc.10001897 100018A2 > 8A08 MOV CL,BYTE PTR DS:[EAX] 100018A4 . 40 INC EAX 100018A5 . 84C9 TEST CL,CL 100018A7 . 74 2A JE SHORT jagmisc.100018D3 100018A9 . EB 0B JMP SHORT jagmisc.100018B6 100018AB > 80F9 65 CMP CL,65 100018AE . 74 0C JE SHORT jagmisc.100018BC 100018B0 . 80F9 45 CMP CL,45 100018B3 . 74 07 JE SHORT jagmisc.100018BC 100018B5 . 40 INC EAX 100018B6 > 8A08 MOV CL,BYTE PTR DS:[EAX] 100018B8 . 84C9 TEST CL,CL 100018BA .^ 75 EF JNZ SHORT jagmisc.100018AB 100018BC > 8BD0 MOV EDX,EAX 100018BE > 48 DEC EAX 100018BF . 8038 30 CMP BYTE PTR DS:[EAX],30 100018C2 .^ 74 FA JE SHORT jagmisc.100018BE 100018C4 . 3818 CMP BYTE PTR DS:[EAX],BL 100018C6 . 75 01 JNZ SHORT jagmisc.100018C9 100018C8 . 48 DEC EAX 100018C9 > 8A0A MOV CL,BYTE PTR DS:[EDX] 100018CB . 40 INC EAX 100018CC . 42 INC EDX 100018CD . 84C9 TEST CL,CL 100018CF . 8808 MOV BYTE PTR DS:[EAX],CL 100018D1 .^ 75 F6 JNZ SHORT jagmisc.100018C9 100018D3 > 5B POP EBX ; kernel32.7C816FD7 100018D4 . C3 RETN 100018D5 . 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 100018D9 . DD00 FLD QWORD PTR DS:[EAX] 100018DB . DC1D 68810010 FCOMP QWORD PTR DS:[10008168] 100018E1 . DFE0 FSTSW AX 100018E3 . F6C4 01 TEST AH,1 100018E6 . 75 04 JNZ SHORT jagmisc.100018EC 100018E8 . 33C0 XOR EAX,EAX 100018EA . 40 INC EAX 100018EB . C3 RETN 100018EC > 33C0 XOR EAX,EAX 100018EE . C3 RETN 100018EF /. 55 PUSH EBP 100018F0 |. 8BEC MOV EBP,ESP 100018F2 |. 51 PUSH ECX 100018F3 |. 51 PUSH ECX 100018F4 |. 837D 08 00 CMP [ARG.1],0 100018F8 |. FF75 10 PUSH [ARG.3] 100018FB |. 74 1B JE SHORT jagmisc.10001918 100018FD |. 8D45 F8 LEA EAX,[LOCAL.2] 10001900 |. 50 PUSH EAX 10001901 |. E8 DF1A0000 CALL jagmisc.100033E5 10001906 |. 8B45 0C MOV EAX,[ARG.2] 10001909 |. 59 POP ECX ; kernel32.7C816FD7 1000190A |. 59 POP ECX ; kernel32.7C816FD7 1000190B |. 8B4D F8 MOV ECX,[LOCAL.2] ; LOADDLL.00410249 1000190E |. 8908 MOV DWORD PTR DS:[EAX],ECX 10001910 |. 8B4D FC MOV ECX,[LOCAL.1] 10001913 |. 8948 04 MOV DWORD PTR DS:[EAX+4],ECX 10001916 |. C9 LEAVE 10001917 |. C3 RETN 10001918 |> 8D45 08 LEA EAX,[ARG.1] 1000191B |. 50 PUSH EAX 1000191C |. E8 011B0000 CALL jagmisc.10003422 10001921 |. 8B45 0C MOV EAX,[ARG.2] 10001924 |. 59 POP ECX ; kernel32.7C816FD7 10001925 |. 59 POP ECX ; kernel32.7C816FD7 10001926 |. 8B4D 08 MOV ECX,[ARG.1] 10001929 |. 8908 MOV DWORD PTR DS:[EAX],ECX 1000192B |. C9 LEAVE 1000192C \. C3 RETN 1000192D /$ 85FF TEST EDI,EDI 1000192F |. 56 PUSH ESI 10001930 |. 8BF0 MOV ESI,EAX 10001932 |. 74 14 JE SHORT jagmisc.10001948 10001934 |. 56 PUSH ESI 10001935 |. E8 661E0000 CALL jagmisc.100037A0 1000193A |. 40 INC EAX 1000193B |. 50 PUSH EAX 1000193C |. 56 PUSH ESI 1000193D |. 03F7 ADD ESI,EDI 1000193F |. 56 PUSH ESI 10001940 |. E8 1B1B0000 CALL jagmisc.10003460 10001945 |. 83C4 10 ADD ESP,10 10001948 |> 5E POP ESI ; kernel32.7C816FD7 10001949 \. C3 RETN 1000194A /$ 55 PUSH EBP 1000194B |. 8BEC MOV EBP,ESP 1000194D |. 807D 10 00 CMP BYTE PTR SS:[EBP+10],0 10001951 |. 56 PUSH ESI 10001952 |. 8BF0 MOV ESI,EAX 10001954 |. 74 1D JE SHORT jagmisc.10001973 10001956 |. 33C0 XOR EAX,EAX 10001958 |. 3945 08 CMP [ARG.1],EAX 1000195B |. 57 PUSH EDI 1000195C |. 0F9FC0 SETG AL 1000195F |. 33C9 XOR ECX,ECX 10001961 |. 833E 2D CMP DWORD PTR DS:[ESI],2D 10001964 |. 0F94C1 SETE CL 10001967 |. 8BF8 MOV EDI,EAX 10001969 |. 03CB ADD ECX,EBX 1000196B |. 8BC1 MOV EAX,ECX 1000196D |. E8 BBFFFFFF CALL jagmisc.1000192D 10001972 |. 5F POP EDI ; kernel32.7C816FD7 10001973 |> 833E 2D CMP DWORD PTR DS:[ESI],2D 10001976 |. 8BC3 MOV EAX,EBX 10001978 |. 75 06 JNZ SHORT jagmisc.10001980 1000197A |. C603 2D MOV BYTE PTR DS:[EBX],2D 1000197D |. 8D43 01 LEA EAX,DWORD PTR DS:[EBX+1] 10001980 |> 837D 08 00 CMP [ARG.1],0 10001984 |. 7E 11 JLE SHORT jagmisc.10001997 10001986 |. 8D48 01 LEA ECX,DWORD PTR DS:[EAX+1] 10001989 |. 8A11 MOV DL,BYTE PTR DS:[ECX] 1000198B |. 8810 MOV BYTE PTR DS:[EAX],DL 1000198D |. 8BC1 MOV EAX,ECX 1000198F |. 8A0D 1CA30010 MOV CL,BYTE PTR DS:[1000A31C] 10001995 |. 8808 MOV BYTE PTR DS:[EAX],CL 10001997 |> 33C9 XOR ECX,ECX 10001999 |. 384D 10 CMP BYTE PTR SS:[EBP+10],CL 1000199C |. 68 70810010 PUSH jagmisc.10008170 ; ASCII "e+000" 100019A1 |. 0F94C1 SETE CL 100019A4 |. 03C8 ADD ECX,EAX 100019A6 |. 034D 08 ADD ECX,[ARG.1] 100019A9 |. 51 PUSH ECX 100019AA |. E8 811E0000 CALL jagmisc.10003830 100019AF |. 837D 0C 00 CMP [ARG.2],0 100019B3 |. 59 POP ECX ; kernel32.7C816FD7 100019B4 |. 59 POP ECX ; kernel32.7C816FD7 100019B5 |. 8BC8 MOV ECX,EAX 100019B7 |. 74 03 JE SHORT jagmisc.100019BC 100019B9 |. C601 45 MOV BYTE PTR DS:[ECX],45 100019BC |> 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 100019BF |. 41 INC ECX 100019C0 |. 8038 30 CMP BYTE PTR DS:[EAX],30 100019C3 |. 74 2E JE SHORT jagmisc.100019F3 100019C5 |. 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4] 100019C8 |. 48 DEC EAX 100019C9 |. 79 05 JNS SHORT jagmisc.100019D0 100019CB |. F7D8 NEG EAX 100019CD |. C601 2D MOV BYTE PTR DS:[ECX],2D 100019D0 |> 41 INC ECX 100019D1 |. 83F8 64 CMP EAX,64 100019D4 |. 7C 0A JL SHORT jagmisc.100019E0 100019D6 |. 99 CDQ 100019D7 |. 6A 64 PUSH 64 100019D9 |. 5E POP ESI ; kernel32.7C816FD7 100019DA |. F7FE IDIV ESI 100019DC |. 0001 ADD BYTE PTR DS:[ECX],AL 100019DE |. 8BC2 MOV EAX,EDX 100019E0 |> 41 INC ECX 100019E1 |. 83F8 0A CMP EAX,0A 100019E4 |. 7C 0A JL SHORT jagmisc.100019F0 100019E6 |. 99 CDQ 100019E7 |. 6A 0A PUSH 0A 100019E9 |. 5E POP ESI ; kernel32.7C816FD7 100019EA |. F7FE IDIV ESI 100019EC |. 0001 ADD BYTE PTR DS:[ECX],AL 100019EE |. 8BC2 MOV EAX,EDX 100019F0 |> 0041 01 ADD BYTE PTR DS:[ECX+1],AL 100019F3 |> 8BC3 MOV EAX,EBX 100019F5 |. 5E POP ESI ; kernel32.7C816FD7 100019F6 |. 5D POP EBP ; kernel32.7C816FD7 100019F7 \. C3 RETN 100019F8 /$ 55 PUSH EBP 100019F9 |. 8BEC MOV EBP,ESP 100019FB |. 83EC 2C SUB ESP,2C 100019FE |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 10001A03 |. 53 PUSH EBX 10001A04 |. 8945 FC MOV [LOCAL.1],EAX 10001A07 |. 56 PUSH ESI 10001A08 |. 8D45 E4 LEA EAX,[LOCAL.7] 10001A0B |. 50 PUSH EAX 10001A0C |. 8D45 D4 LEA EAX,[LOCAL.11] 10001A0F |. 50 PUSH EAX 10001A10 |. 8B45 08 MOV EAX,[ARG.1] 10001A13 |. FF70 04 PUSH DWORD PTR DS:[EAX+4] 10001A16 |. FF30 PUSH DWORD PTR DS:[EAX] 10001A18 |. E8 3C200000 CALL jagmisc.10003A59 10001A1D |. 8B75 10 MOV ESI,[ARG.3] 10001A20 |. 8B5D 0C MOV EBX,[ARG.2] 10001A23 |. 8D45 D4 LEA EAX,[LOCAL.11] 10001A26 |. 50 PUSH EAX 10001A27 |. 8D46 01 LEA EAX,DWORD PTR DS:[ESI+1] 10001A2A |. 50 PUSH EAX 10001A2B |. 33C0 XOR EAX,EAX 10001A2D |. 837D D4 2D CMP [LOCAL.11],2D 10001A31 |. 0F94C0 SETE AL 10001A34 |. 33C9 XOR ECX,ECX 10001A36 |. 85F6 TEST ESI,ESI 10001A38 |. 0F9FC1 SETG CL 10001A3B |. 03C3 ADD EAX,EBX 10001A3D |. 03C8 ADD ECX,EAX 10001A3F |. 51 PUSH ECX 10001A40 |. E8 E31E0000 CALL jagmisc.10003928 10001A45 |. 6A 00 PUSH 0 ; |Arg3 = 00000000 10001A47 |. FF75 14 PUSH [ARG.4] ; |Arg2 = 0006FFC8 10001A4A |. 8D45 D4 LEA EAX,[LOCAL.11] ; | 10001A4D |. 56 PUSH ESI ; |Arg1 = 00000000 10001A4E |. E8 F7FEFFFF CALL jagmisc.1000194A ; \jagmisc.1000194A 10001A53 |. 8B4D FC MOV ECX,[LOCAL.1] 10001A56 |. 83C4 28 ADD ESP,28 10001A59 |. 5E POP ESI ; kernel32.7C816FD7 10001A5A |. 8BC3 MOV EAX,EBX 10001A5C |. 5B POP EBX ; kernel32.7C816FD7 10001A5D |. E8 94200000 CALL jagmisc.10003AF6 10001A62 |. C9 LEAVE 10001A63 \. C3 RETN 10001A64 /$ 55 PUSH EBP 10001A65 |. 8BEC MOV EBP,ESP 10001A67 |. 53 PUSH EBX 10001A68 |. 56 PUSH ESI 10001A69 |. 8BF0 MOV ESI,EAX 10001A6B |. 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4] 10001A6E |. 48 DEC EAX 10001A6F |. 807D 10 00 CMP BYTE PTR SS:[EBP+10],0 10001A73 |. 57 PUSH EDI 10001A74 |. 74 1B JE SHORT jagmisc.10001A91 10001A76 |. 3B45 0C CMP EAX,[ARG.2] 10001A79 |. 75 16 JNZ SHORT jagmisc.10001A91 10001A7B |. 33C9 XOR ECX,ECX 10001A7D |. 833E 2D CMP DWORD PTR DS:[ESI],2D 10001A80 |. 0F94C1 SETE CL 10001A83 |. 03C8 ADD ECX,EAX 10001A85 |. 034D 08 ADD ECX,[ARG.1] 10001A88 |. 8BC1 MOV EAX,ECX 10001A8A |. C600 30 MOV BYTE PTR DS:[EAX],30 10001A8D |. C640 01 00 MOV BYTE PTR DS:[EAX+1],0 10001A91 |> 833E 2D CMP DWORD PTR DS:[ESI],2D 10001A94 |. 8B5D 08 MOV EBX,[ARG.1] 10001A97 |. 75 04 JNZ SHORT jagmisc.10001A9D 10001A99 |. C603 2D MOV BYTE PTR DS:[EBX],2D 10001A9C |. 43 INC EBX 10001A9D |> 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4] 10001AA0 |. 33FF XOR EDI,EDI 10001AA2 |. 47 INC EDI 10001AA3 |. 85C0 TEST EAX,EAX 10001AA5 |. 7F 0D JG SHORT jagmisc.10001AB4 10001AA7 |. 8BC3 MOV EAX,EBX 10001AA9 |. E8 7FFEFFFF CALL jagmisc.1000192D 10001AAE |. C603 30 MOV BYTE PTR DS:[EBX],30 10001AB1 |. 43 INC EBX 10001AB2 |. EB 02 JMP SHORT jagmisc.10001AB6 10001AB4 |> 03D8 ADD EBX,EAX 10001AB6 |> 837D 0C 00 CMP [ARG.2],0 10001ABA |. 7E 3C JLE SHORT jagmisc.10001AF8 10001ABC |. 8BC3 MOV EAX,EBX 10001ABE |. E8 6AFEFFFF CALL jagmisc.1000192D 10001AC3 |. A0 1CA30010 MOV AL,BYTE PTR DS:[1000A31C] 10001AC8 |. 8803 MOV BYTE PTR DS:[EBX],AL 10001ACA |. 8B76 04 MOV ESI,DWORD PTR DS:[ESI+4] 10001ACD |. 43 INC EBX 10001ACE |. 85F6 TEST ESI,ESI 10001AD0 |. 7D 26 JGE SHORT jagmisc.10001AF8 10001AD2 |. F7DE NEG ESI 10001AD4 |. 807D 10 00 CMP BYTE PTR SS:[EBP+10],0 10001AD8 |. 75 05 JNZ SHORT jagmisc.10001ADF 10001ADA |. 3975 0C CMP [ARG.2],ESI 10001ADD |. 7C 03 JL SHORT jagmisc.10001AE2 10001ADF |> 8975 0C MOV [ARG.2],ESI 10001AE2 |> 8B7D 0C MOV EDI,[ARG.2] 10001AE5 |. 8BC3 MOV EAX,EBX 10001AE7 |. E8 41FEFFFF CALL jagmisc.1000192D 10001AEC |. 57 PUSH EDI 10001AED |. 6A 30 PUSH 30 10001AEF |. 53 PUSH EBX 10001AF0 |. E8 1B200000 CALL jagmisc.10003B10 10001AF5 |. 83C4 0C ADD ESP,0C 10001AF8 |> 8B45 08 MOV EAX,[ARG.1] 10001AFB |. 5F POP EDI ; kernel32.7C816FD7 10001AFC |. 5E POP ESI ; kernel32.7C816FD7 10001AFD |. 5B POP EBX ; kernel32.7C816FD7 10001AFE |. 5D POP EBP ; kernel32.7C816FD7 10001AFF \. C3 RETN 10001B00 /$ 55 PUSH EBP 10001B01 |. 8BEC MOV EBP,ESP 10001B03 |. 83EC 2C SUB ESP,2C 10001B06 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 10001B0B |. 8945 FC MOV [LOCAL.1],EAX 10001B0E |. 56 PUSH ESI 10001B0F |. 8D45 E4 LEA EAX,[LOCAL.7] 10001B12 |. 50 PUSH EAX 10001B13 |. 8D45 D4 LEA EAX,[LOCAL.11] 10001B16 |. 50 PUSH EAX 10001B17 |. 8B45 08 MOV EAX,[ARG.1] 10001B1A |. FF70 04 PUSH DWORD PTR DS:[EAX+4] 10001B1D |. FF30 PUSH DWORD PTR DS:[EAX] 10001B1F |. E8 351F0000 CALL jagmisc.10003A59 10001B24 |. 8B75 10 MOV ESI,[ARG.3] 10001B27 |. 8D45 D4 LEA EAX,[LOCAL.11] 10001B2A |. 50 PUSH EAX 10001B2B |. 8B45 D8 MOV EAX,[LOCAL.10] ; kernel32.7C839AA8 10001B2E |. 03C6 ADD EAX,ESI 10001B30 |. 50 PUSH EAX 10001B31 |. 33C0 XOR EAX,EAX 10001B33 |. 837D D4 2D CMP [LOCAL.11],2D 10001B37 |. 0F94C0 SETE AL 10001B3A |. 0345 0C ADD EAX,[ARG.2] 10001B3D |. 50 PUSH EAX 10001B3E |. E8 E51D0000 CALL jagmisc.10003928 10001B43 |. 6A 00 PUSH 0 ; |Arg3 = 00000000 10001B45 |. 56 PUSH ESI ; |Arg2 = 00000000 10001B46 |. FF75 0C PUSH [ARG.2] ; |Arg1 = 7FFD9000 10001B49 |. 8D45 D4 LEA EAX,[LOCAL.11] ; | 10001B4C |. E8 13FFFFFF CALL jagmisc.10001A64 ; \jagmisc.10001A64 10001B51 |. 8B4D FC MOV ECX,[LOCAL.1] 10001B54 |. 8B45 0C MOV EAX,[ARG.2] 10001B57 |. 83C4 28 ADD ESP,28 10001B5A |. 5E POP ESI ; kernel32.7C816FD7 10001B5B |. E8 961F0000 CALL jagmisc.10003AF6 10001B60 |. C9 LEAVE 10001B61 \. C3 RETN 10001B62 /$ 55 PUSH EBP 10001B63 |. 8BEC MOV EBP,ESP 10001B65 |. 83EC 2C SUB ESP,2C 10001B68 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 10001B6D |. 53 PUSH EBX 10001B6E |. 56 PUSH ESI 10001B6F |. 8945 FC MOV [LOCAL.1],EAX 10001B72 |. 57 PUSH EDI 10001B73 |. 8D45 E4 LEA EAX,[LOCAL.7] 10001B76 |. 50 PUSH EAX 10001B77 |. 8D45 D4 LEA EAX,[LOCAL.11] 10001B7A |. 50 PUSH EAX 10001B7B |. 8B45 08 MOV EAX,[ARG.1] 10001B7E |. FF70 04 PUSH DWORD PTR DS:[EAX+4] 10001B81 |. FF30 PUSH DWORD PTR DS:[EAX] 10001B83 |. E8 D11E0000 CALL jagmisc.10003A59 10001B88 |. 8B75 D8 MOV ESI,[LOCAL.10] ; |kernel32.7C839AA8 10001B8B |. 8B5D 10 MOV EBX,[ARG.3] ; | 10001B8E |. 33C0 XOR EAX,EAX ; | 10001B90 |. 4E DEC ESI ; | 10001B91 |. 837D D4 2D CMP [LOCAL.11],2D ; | 10001B95 |. 0F94C0 SETE AL ; | 10001B98 |. 0345 0C ADD EAX,[ARG.2] ; | 10001B9B |. 8BF8 MOV EDI,EAX ; | 10001B9D |. 8D45 D4 LEA EAX,[LOCAL.11] ; | 10001BA0 |. 50 PUSH EAX ; |Arg3 = 00000008 10001BA1 |. 53 PUSH EBX ; |Arg2 = 00000000 10001BA2 |. 57 PUSH EDI ; |Arg1 = 00000000 10001BA3 |. E8 801D0000 CALL jagmisc.10003928 ; \jagmisc.10003928 10001BA8 |. 8B45 D8 MOV EAX,[LOCAL.10] ; kernel32.7C839AA8 10001BAB |. 83C4 1C ADD ESP,1C 10001BAE |. 48 DEC EAX 10001BAF |. 3BF0 CMP ESI,EAX 10001BB1 |. 0F9CC1 SETL CL 10001BB4 |. 83F8 FC CMP EAX,-4 10001BB7 |. 7C 22 JL SHORT jagmisc.10001BDB 10001BB9 |. 3BC3 CMP EAX,EBX 10001BBB |. 7D 1E JGE SHORT jagmisc.10001BDB 10001BBD |. 84C9 TEST CL,CL 10001BBF |. 74 0A JE SHORT jagmisc.10001BCB 10001BC1 |> 8A07 /MOV AL,BYTE PTR DS:[EDI] 10001BC3 |. 47 |INC EDI 10001BC4 |. 84C0 |TEST AL,AL 10001BC6 |.^ 75 F9 \JNZ SHORT jagmisc.10001BC1 10001BC8 |. 8847 FE MOV BYTE PTR DS:[EDI-2],AL 10001BCB |> 6A 01 PUSH 1 10001BCD |. 53 PUSH EBX 10001BCE |. FF75 0C PUSH [ARG.2] 10001BD1 |. 8D45 D4 LEA EAX,[LOCAL.11] 10001BD4 |. E8 8BFEFFFF CALL jagmisc.10001A64 10001BD9 |. EB 11 JMP SHORT jagmisc.10001BEC 10001BDB |> 6A 01 PUSH 1 10001BDD |. FF75 14 PUSH [ARG.4] 10001BE0 |. 8D45 D4 LEA EAX,[LOCAL.11] 10001BE3 |. 53 PUSH EBX 10001BE4 |. 8B5D 0C MOV EBX,[ARG.2] 10001BE7 |. E8 5EFDFFFF CALL jagmisc.1000194A 10001BEC |> 8B4D FC MOV ECX,[LOCAL.1] 10001BEF |. 83C4 0C ADD ESP,0C 10001BF2 |. 5F POP EDI ; kernel32.7C816FD7 10001BF3 |. 5E POP ESI ; kernel32.7C816FD7 10001BF4 |. 5B POP EBX ; kernel32.7C816FD7 10001BF5 |. E8 FC1E0000 CALL jagmisc.10003AF6 10001BFA |. C9 LEAVE 10001BFB \. C3 RETN 10001BFC /. 55 PUSH EBP 10001BFD |. 8BEC MOV EBP,ESP 10001BFF |. 837D 10 65 CMP [ARG.3],65 10001C03 |. 74 32 JE SHORT jagmisc.10001C37 10001C05 |. 837D 10 45 CMP [ARG.3],45 10001C09 |. 74 2C JE SHORT jagmisc.10001C37 10001C0B |. 837D 10 66 CMP [ARG.3],66 10001C0F |. 75 13 JNZ SHORT jagmisc.10001C24 10001C11 |. FF75 14 PUSH [ARG.4] 10001C14 |. FF75 0C PUSH [ARG.2] 10001C17 |. FF75 08 PUSH [ARG.1] 10001C1A |. E8 E1FEFFFF CALL jagmisc.10001B00 10001C1F |. 83C4 0C ADD ESP,0C 10001C22 |. 5D POP EBP ; kernel32.7C816FD7 10001C23 |. C3 RETN 10001C24 |> FF75 18 PUSH [ARG.5] 10001C27 |. FF75 14 PUSH [ARG.4] 10001C2A |. FF75 0C PUSH [ARG.2] 10001C2D |. FF75 08 PUSH [ARG.1] 10001C30 |. E8 2DFFFFFF CALL jagmisc.10001B62 10001C35 |. EB 11 JMP SHORT jagmisc.10001C48 10001C37 |> FF75 18 PUSH [ARG.5] 10001C3A |. FF75 14 PUSH [ARG.4] 10001C3D |. FF75 0C PUSH [ARG.2] 10001C40 |. FF75 08 PUSH [ARG.1] 10001C43 |. E8 B0FDFFFF CALL jagmisc.100019F8 10001C48 |> 83C4 10 ADD ESP,10 10001C4B |. 5D POP EBP ; kernel32.7C816FD7 10001C4C \. C3 RETN 10001C4D /$ 68 00000300 PUSH 30000 10001C52 |. 68 00000100 PUSH 10000 ; UNICODE "=::=::\\" 10001C57 |. E8 6F200000 CALL jagmisc.10003CCB 10001C5C |. 59 POP ECX ; kernel32.7C816FD7 10001C5D |. 59 POP ECX ; kernel32.7C816FD7 10001C5E \. C3 RETN 10001C5F /> 55 PUSH EBP 10001C60 |. 8BEC MOV EBP,ESP 10001C62 |. 83EC 18 SUB ESP,18 10001C65 |. DD05 88810010 FLD QWORD PTR DS:[10008188] 10001C6B |. DD5D F8 FSTP QWORD PTR SS:[EBP-8] 10001C6E |. DD05 80810010 FLD QWORD PTR DS:[10008180] 10001C74 |. DD5D F0 FSTP QWORD PTR SS:[EBP-10] 10001C77 |. DD45 F0 FLD QWORD PTR SS:[EBP-10] 10001C7A |. DC75 F8 FDIV QWORD PTR SS:[EBP-8] 10001C7D |. DC4D F8 FMUL QWORD PTR SS:[EBP-8] 10001C80 |. DC6D F0 FSUBR QWORD PTR SS:[EBP-10] 10001C83 |. DD5D E8 FSTP QWORD PTR SS:[EBP-18] 10001C86 |. DD45 E8 FLD QWORD PTR SS:[EBP-18] 10001C89 |. DC1D 78810010 FCOMP QWORD PTR DS:[10008178] 10001C8F |. DFE0 FSTSW AX 10001C91 |. F6C4 41 TEST AH,41 10001C94 |. 75 05 JNZ SHORT jagmisc.10001C9B 10001C96 |. 33C0 XOR EAX,EAX 10001C98 |. 40 INC EAX 10001C99 |. C9 LEAVE 10001C9A |. C3 RETN 10001C9B |> 33C0 XOR EAX,EAX 10001C9D |. C9 LEAVE 10001C9E |. C3 RETN 10001C9F |$ 68 AC810010 PUSH jagmisc.100081AC ; /pModule = "KERNEL32" 10001CA4 |. FF15 54800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA 10001CAA |. 85C0 TEST EAX,EAX 10001CAC |. 74 15 JE SHORT jagmisc.10001CC3 10001CAE |. 68 90810010 PUSH jagmisc.10008190 ; /ProcNameOrOrdinal = "IsProcessorFeaturePresent" 10001CB3 |. 50 PUSH EAX ; |hModule = 00000008 10001CB4 |. FF15 50800010 CALL DWORD PTR DS:[<&KERNEL32.GetProcAddress>] ; \GetProcAddress 10001CBA |. 85C0 TEST EAX,EAX 10001CBC |. 74 05 JE SHORT jagmisc.10001CC3 10001CBE |. 6A 00 PUSH 0 10001CC0 |. FFD0 CALL EAX 10001CC2 |. C3 RETN 10001CC3 \>^ E9 97FFFFFF JMP jagmisc.10001C5F 10001CC8 /$ FF15 58800010 CALL DWORD PTR DS:[<&KERNEL32.TlsAlloc>] ; [TlsAlloc 10001CCE \. C2 0400 RETN 4 10001CD1 $ A1 64A00010 MOV EAX,DWORD PTR DS:[1000A064] 10001CD6 . 83F8 FF CMP EAX,-1 10001CD9 . 74 0E JE SHORT jagmisc.10001CE9 10001CDB . 50 PUSH EAX ; /TLSIndex = 8 10001CDC . FF15 84AC0010 CALL DWORD PTR DS:[1000AC84] ; \TlsFree 10001CE2 . 830D 64A00010 FF OR DWORD PTR DS:[1000A064],FFFFFFFF 10001CE9 > E9 3C200000 JMP jagmisc.10003D2A 10001CEE /$ 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10001CF2 |. C740 54 68A00010 MOV DWORD PTR DS:[EAX+54],jagmisc.1000A068 10001CF9 |. C740 14 01000000 MOV DWORD PTR DS:[EAX+14],1 10001D00 \. C3 RETN 10001D01 /$ 53 PUSH EBX 10001D02 |. 56 PUSH ESI 10001D03 |. FF15 38800010 CALL DWORD PTR DS:[<&KERNEL32.GetLastError>] ; [GetLastError 10001D09 |. FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; /TlsIndex = 1 10001D0F |. 8BD8 MOV EBX,EAX ; | 10001D11 |. FF15 7CAC0010 CALL DWORD PTR DS:[1000AC7C] ; \TlsGetValue 10001D17 |. 8BF0 MOV ESI,EAX 10001D19 |. 85F6 TEST ESI,ESI 10001D1B |. 75 49 JNZ SHORT jagmisc.10001D66 10001D1D |. 68 8C000000 PUSH 8C 10001D22 |. 6A 01 PUSH 1 10001D24 |. E8 18080000 CALL jagmisc.10002541 10001D29 |. 8BF0 MOV ESI,EAX 10001D2B |. 85F6 TEST ESI,ESI 10001D2D |. 59 POP ECX ; kernel32.7C816FD7 10001D2E |. 59 POP ECX ; kernel32.7C816FD7 10001D2F |. 74 2D JE SHORT jagmisc.10001D5E 10001D31 |. 56 PUSH ESI ; /pValue = NULL 10001D32 |. FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; |TlsIndex = 1 10001D38 |. FF15 80AC0010 CALL DWORD PTR DS:[1000AC80] ; \TlsSetValue 10001D3E |. 85C0 TEST EAX,EAX 10001D40 |. 74 1C JE SHORT jagmisc.10001D5E 10001D42 |. C746 54 68A00010 MOV DWORD PTR DS:[ESI+54],jagmisc.1000A068 10001D49 |. C746 14 01000000 MOV DWORD PTR DS:[ESI+14],1 10001D50 |. FF15 44800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentThreadId>] ; [GetCurrentThreadId 10001D56 |. 834E 04 FF OR DWORD PTR DS:[ESI+4],FFFFFFFF 10001D5A |. 8906 MOV DWORD PTR DS:[ESI],EAX 10001D5C |. EB 08 JMP SHORT jagmisc.10001D66 10001D5E |> 6A 10 PUSH 10 10001D60 |. E8 B6FAFFFF CALL jagmisc.1000181B 10001D65 |. 59 POP ECX ; kernel32.7C816FD7 10001D66 |> 53 PUSH EBX ; /Error = ERROR_SUCCESS 10001D67 |. FF15 5C800010 CALL DWORD PTR DS:[<&KERNEL32.SetLastError>] ; \SetLastError 10001D6D |. 8BC6 MOV EAX,ESI 10001D6F |. 5E POP ESI ; kernel32.7C816FD7 10001D70 |. 5B POP EBX ; kernel32.7C816FD7 10001D71 \. C3 RETN 10001D72 /$ 6A 10 PUSH 10 10001D74 |. 68 B8810010 PUSH jagmisc.100081B8 10001D79 |. E8 F2050000 CALL jagmisc.10002370 10001D7E |. 8B75 08 MOV ESI,[ARG.1] 10001D81 |. 33FF XOR EDI,EDI 10001D83 |. 3BF7 CMP ESI,EDI 10001D85 |. 0F84 0C010000 JE jagmisc.10001E97 10001D8B |. 8B46 24 MOV EAX,DWORD PTR DS:[ESI+24] 10001D8E |. 3BC7 CMP EAX,EDI 10001D90 |. 74 07 JE SHORT jagmisc.10001D99 10001D92 |. 50 PUSH EAX 10001D93 |. E8 65050000 CALL jagmisc.100022FD 10001D98 |. 59 POP ECX ; kernel32.7C816FD7 10001D99 |> 8B46 2C MOV EAX,DWORD PTR DS:[ESI+2C] 10001D9C |. 3BC7 CMP EAX,EDI 10001D9E |. 74 07 JE SHORT jagmisc.10001DA7 10001DA0 |. 50 PUSH EAX 10001DA1 |. E8 57050000 CALL jagmisc.100022FD 10001DA6 |. 59 POP ECX ; kernel32.7C816FD7 10001DA7 |> 8B46 34 MOV EAX,DWORD PTR DS:[ESI+34] 10001DAA |. 3BC7 CMP EAX,EDI 10001DAC |. 74 07 JE SHORT jagmisc.10001DB5 10001DAE |. 50 PUSH EAX 10001DAF |. E8 49050000 CALL jagmisc.100022FD 10001DB4 |. 59 POP ECX ; kernel32.7C816FD7 10001DB5 |> 8B46 3C MOV EAX,DWORD PTR DS:[ESI+3C] 10001DB8 |. 3BC7 CMP EAX,EDI 10001DBA |. 74 07 JE SHORT jagmisc.10001DC3 10001DBC |. 50 PUSH EAX 10001DBD |. E8 3B050000 CALL jagmisc.100022FD 10001DC2 |. 59 POP ECX ; kernel32.7C816FD7 10001DC3 |> 8B46 44 MOV EAX,DWORD PTR DS:[ESI+44] 10001DC6 |. 3BC7 CMP EAX,EDI 10001DC8 |. 74 07 JE SHORT jagmisc.10001DD1 10001DCA |. 50 PUSH EAX 10001DCB |. E8 2D050000 CALL jagmisc.100022FD 10001DD0 |. 59 POP ECX ; kernel32.7C816FD7 10001DD1 |> 8B46 48 MOV EAX,DWORD PTR DS:[ESI+48] 10001DD4 |. 3BC7 CMP EAX,EDI 10001DD6 |. 74 07 JE SHORT jagmisc.10001DDF 10001DD8 |. 50 PUSH EAX 10001DD9 |. E8 1F050000 CALL jagmisc.100022FD 10001DDE |. 59 POP ECX ; kernel32.7C816FD7 10001DDF |> 8B46 54 MOV EAX,DWORD PTR DS:[ESI+54] 10001DE2 |. 3D 68A00010 CMP EAX,jagmisc.1000A068 10001DE7 |. 74 07 JE SHORT jagmisc.10001DF0 10001DE9 |. 50 PUSH EAX 10001DEA |. E8 0E050000 CALL jagmisc.100022FD 10001DEF |. 59 POP ECX ; kernel32.7C816FD7 10001DF0 |> 6A 0D PUSH 0D ; /Arg1 = 0000000D 10001DF2 |. E8 3D200000 CALL jagmisc.10003E34 ; \jagmisc.10003E34 10001DF7 |. 59 POP ECX ; kernel32.7C816FD7 10001DF8 |. 897D FC MOV [LOCAL.1],EDI 10001DFB |. 8B46 60 MOV EAX,DWORD PTR DS:[ESI+60] 10001DFE |. 8945 E4 MOV [LOCAL.7],EAX 10001E01 |. 3BC7 CMP EAX,EDI 10001E03 |. 74 13 JE SHORT jagmisc.10001E18 10001E05 |. FF08 DEC DWORD PTR DS:[EAX] 10001E07 |. 75 0F JNZ SHORT jagmisc.10001E18 10001E09 |. 3B05 38B10010 CMP EAX,DWORD PTR DS:[1000B138] 10001E0F |. 74 07 JE SHORT jagmisc.10001E18 10001E11 |. 50 PUSH EAX 10001E12 |. E8 E6040000 CALL jagmisc.100022FD 10001E17 |. 59 POP ECX ; kernel32.7C816FD7 10001E18 |> 834D FC FF OR [LOCAL.1],FFFFFFFF 10001E1C |. E8 83000000 CALL jagmisc.10001EA4 10001E21 |. 6A 0C PUSH 0C ; /Arg1 = 0000000C 10001E23 |. E8 0C200000 CALL jagmisc.10003E34 ; \jagmisc.10003E34 10001E28 |. 59 POP ECX ; kernel32.7C816FD7 10001E29 |. C745 FC 01000000 MOV [LOCAL.1],1 10001E30 |. 8B46 64 MOV EAX,DWORD PTR DS:[ESI+64] 10001E33 |. 8945 E0 MOV [LOCAL.8],EAX 10001E36 |. 3BC7 CMP EAX,EDI 10001E38 |. 74 4D JE SHORT jagmisc.10001E87 10001E3A |. FF08 DEC DWORD PTR DS:[EAX] 10001E3C |. 3978 2C CMP DWORD PTR DS:[EAX+2C],EDI 10001E3F |. 74 05 JE SHORT jagmisc.10001E46 10001E41 |. 8B48 2C MOV ECX,DWORD PTR DS:[EAX+2C] 10001E44 |. FF09 DEC DWORD PTR DS:[ECX] 10001E46 |> 3978 34 CMP DWORD PTR DS:[EAX+34],EDI 10001E49 |. 74 05 JE SHORT jagmisc.10001E50 10001E4B |. 8B48 34 MOV ECX,DWORD PTR DS:[EAX+34] 10001E4E |. FF09 DEC DWORD PTR DS:[ECX] 10001E50 |> 3978 30 CMP DWORD PTR DS:[EAX+30],EDI 10001E53 |. 74 05 JE SHORT jagmisc.10001E5A 10001E55 |. 8B48 30 MOV ECX,DWORD PTR DS:[EAX+30] 10001E58 |. FF09 DEC DWORD PTR DS:[ECX] 10001E5A |> 3978 40 CMP DWORD PTR DS:[EAX+40],EDI 10001E5D |. 74 05 JE SHORT jagmisc.10001E64 10001E5F |. 8B48 40 MOV ECX,DWORD PTR DS:[EAX+40] 10001E62 |. FF09 DEC DWORD PTR DS:[ECX] 10001E64 |> 8B48 4C MOV ECX,DWORD PTR DS:[EAX+4C] 10001E67 |. FF89 B4000000 DEC DWORD PTR DS:[ECX+B4] 10001E6D |. 3B05 ECA40010 CMP EAX,DWORD PTR DS:[1000A4EC] ; jagmisc.1000A498 10001E73 |. 74 12 JE SHORT jagmisc.10001E87 10001E75 |. 3D 98A40010 CMP EAX,jagmisc.1000A498 10001E7A |. 74 0B JE SHORT jagmisc.10001E87 10001E7C |. 3938 CMP DWORD PTR DS:[EAX],EDI 10001E7E |. 75 07 JNZ SHORT jagmisc.10001E87 10001E80 |. 50 PUSH EAX 10001E81 |. E8 DF1F0000 CALL jagmisc.10003E65 10001E86 |. 59 POP ECX ; kernel32.7C816FD7 10001E87 |> 834D FC FF OR [LOCAL.1],FFFFFFFF 10001E8B |. E8 20000000 CALL jagmisc.10001EB0 10001E90 |. 56 PUSH ESI 10001E91 |. E8 67040000 CALL jagmisc.100022FD 10001E96 |. 59 POP ECX ; kernel32.7C816FD7 10001E97 |> E8 0F050000 CALL jagmisc.100023AB 10001E9C \. C2 0400 RETN 4 10001E9F 33 DB 33 ; CHAR '3' 10001EA0 FF DB FF 10001EA1 8B DB 8B 10001EA2 75 DB 75 ; CHAR 'u' 10001EA3 08 DB 08 10001EA4 /$ 6A 0D PUSH 0D 10001EA6 |. E8 D41E0000 CALL jagmisc.10003D7F 10001EAB |. 59 POP ECX ; kernel32.7C816FD7 10001EAC \. C3 RETN 10001EAD 8B DB 8B 10001EAE 75 DB 75 ; CHAR 'u' 10001EAF 08 DB 08 10001EB0 /$ 6A 0C PUSH 0C 10001EB2 |. E8 C81E0000 CALL jagmisc.10003D7F 10001EB7 |. 59 POP ECX ; kernel32.7C816FD7 10001EB8 \. C3 RETN 10001EB9 /$ 8B0D 64A00010 MOV ECX,DWORD PTR DS:[1000A064] 10001EBF |. 83F9 FF CMP ECX,-1 10001EC2 |. 74 23 JE SHORT jagmisc.10001EE7 10001EC4 |. 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10001EC8 |. 85C0 TEST EAX,EAX 10001ECA |. 75 07 JNZ SHORT jagmisc.10001ED3 10001ECC |. 51 PUSH ECX ; /TlsIndex = FFFFFFFF 10001ECD |. FF15 7CAC0010 CALL DWORD PTR DS:[1000AC7C] ; \TlsGetValue 10001ED3 |> 50 PUSH EAX 10001ED4 |. E8 99FEFFFF CALL jagmisc.10001D72 10001ED9 |. 6A 00 PUSH 0 ; /pValue = NULL 10001EDB |. FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; |TlsIndex = 1 10001EE1 |. FF15 80AC0010 CALL DWORD PTR DS:[1000AC80] ; \TlsSetValue 10001EE7 \> C3 RETN 10001EE8 /$ E8 F41D0000 CALL jagmisc.10003CE1 10001EED |. 85C0 TEST EAX,EAX 10001EEF |. 75 08 JNZ SHORT jagmisc.10001EF9 10001EF1 |. E8 DBFDFFFF CALL jagmisc.10001CD1 10001EF6 |. 33C0 XOR EAX,EAX 10001EF8 |. C3 RETN 10001EF9 |> 56 PUSH ESI 10001EFA |. 57 PUSH EDI 10001EFB |. 68 FC810010 PUSH jagmisc.100081FC ; /pModule = "kernel32.dll" 10001F00 |. FF15 54800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA 10001F06 |. 8BF8 MOV EDI,EAX 10001F08 |. 85FF TEST EDI,EDI 10001F0A |. 74 6B JE SHORT jagmisc.10001F77 10001F0C |. 8B35 50800010 MOV ESI,DWORD PTR DS:[<&KERNEL32.GetProcAddress>] ; kernel32.GetProcAddress 10001F12 |. 68 F0810010 PUSH jagmisc.100081F0 ; /ProcNameOrOrdinal = "FlsAlloc" 10001F17 |. 57 PUSH EDI ; |hModule = NULL 10001F18 |. FFD6 CALL ESI ; \GetProcAddress 10001F1A |. 68 E4810010 PUSH jagmisc.100081E4 ; /ProcNameOrOrdinal = "FlsGetValue" 10001F1F |. 57 PUSH EDI ; |hModule = NULL 10001F20 |. A3 78AC0010 MOV DWORD PTR DS:[1000AC78],EAX ; | 10001F25 |. FFD6 CALL ESI ; \GetProcAddress 10001F27 |. 68 D8810010 PUSH jagmisc.100081D8 ; /ProcNameOrOrdinal = "FlsSetValue" 10001F2C |. 57 PUSH EDI ; |hModule = NULL 10001F2D |. A3 7CAC0010 MOV DWORD PTR DS:[1000AC7C],EAX ; | 10001F32 |. FFD6 CALL ESI ; \GetProcAddress 10001F34 |. 68 D0810010 PUSH jagmisc.100081D0 ; /ProcNameOrOrdinal = "FlsFree" 10001F39 |. 57 PUSH EDI ; |hModule = NULL 10001F3A |. A3 80AC0010 MOV DWORD PTR DS:[1000AC80],EAX ; | 10001F3F |. FFD6 CALL ESI ; \GetProcAddress 10001F41 |. 833D 7CAC0010 00 CMP DWORD PTR DS:[1000AC7C],0 10001F48 |. A3 84AC0010 MOV DWORD PTR DS:[1000AC84],EAX 10001F4D |. 75 28 JNZ SHORT jagmisc.10001F77 10001F4F |. A1 68800010 MOV EAX,DWORD PTR DS:[<&KERNEL32.TlsGetValue>] 10001F54 |. A3 7CAC0010 MOV DWORD PTR DS:[1000AC7C],EAX 10001F59 |. A1 64800010 MOV EAX,DWORD PTR DS:[<&KERNEL32.TlsSetValue>] 10001F5E |. A3 80AC0010 MOV DWORD PTR DS:[1000AC80],EAX 10001F63 |. A1 60800010 MOV EAX,DWORD PTR DS:[<&KERNEL32.TlsFree>] 10001F68 |. C705 78AC0010 C81>MOV DWORD PTR DS:[1000AC78],jagmisc.10001CC8 ; Entry address 10001F72 |. A3 84AC0010 MOV DWORD PTR DS:[1000AC84],EAX 10001F77 |> 68 721D0010 PUSH jagmisc.10001D72 ; Entry address 10001F7C |. FF15 78AC0010 CALL DWORD PTR DS:[1000AC78] ; jagmisc.10001CC8 10001F82 |. 83F8 FF CMP EAX,-1 10001F85 |. A3 64A00010 MOV DWORD PTR DS:[1000A064],EAX 10001F8A |. 74 41 JE SHORT jagmisc.10001FCD 10001F8C |. 33FF XOR EDI,EDI 10001F8E |. 68 8C000000 PUSH 8C 10001F93 |. 47 INC EDI 10001F94 |. 57 PUSH EDI 10001F95 |. E8 A7050000 CALL jagmisc.10002541 10001F9A |. 8BF0 MOV ESI,EAX 10001F9C |. 85F6 TEST ESI,ESI 10001F9E |. 59 POP ECX ; kernel32.7C816FD7 10001F9F |. 59 POP ECX ; kernel32.7C816FD7 10001FA0 |. 74 2B JE SHORT jagmisc.10001FCD 10001FA2 |. 56 PUSH ESI ; /pValue = NULL 10001FA3 |. FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; |TlsIndex = 1 10001FA9 |. FF15 80AC0010 CALL DWORD PTR DS:[1000AC80] ; \TlsSetValue 10001FAF |. 85C0 TEST EAX,EAX 10001FB1 |. 74 1A JE SHORT jagmisc.10001FCD 10001FB3 |. C746 54 68A00010 MOV DWORD PTR DS:[ESI+54],jagmisc.1000A068 10001FBA |. 897E 14 MOV DWORD PTR DS:[ESI+14],EDI 10001FBD |. FF15 44800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentThreadId>] ; [GetCurrentThreadId 10001FC3 |. 834E 04 FF OR DWORD PTR DS:[ESI+4],FFFFFFFF 10001FC7 |. 8906 MOV DWORD PTR DS:[ESI],EAX 10001FC9 |. 8BC7 MOV EAX,EDI 10001FCB |. EB 07 JMP SHORT jagmisc.10001FD4 10001FCD |> E8 FFFCFFFF CALL jagmisc.10001CD1 10001FD2 |. 33C0 XOR EAX,EAX 10001FD4 |> 5F POP EDI ; kernel32.7C816FD7 10001FD5 |. 5E POP ESI ; kernel32.7C816FD7 10001FD6 \. C3 RETN 10001FD7 /$ 68 1C820010 PUSH jagmisc.1000821C ; /pModule = "mscoree.dll" 10001FDC |. FF15 54800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA 10001FE2 |. 85C0 TEST EAX,EAX 10001FE4 |. 74 16 JE SHORT jagmisc.10001FFC 10001FE6 |. 68 0C820010 PUSH jagmisc.1000820C ; /ProcNameOrOrdinal = "CorExitProcess" 10001FEB |. 50 PUSH EAX ; |hModule = 00000008 10001FEC |. FF15 50800010 CALL DWORD PTR DS:[<&KERNEL32.GetProcAddress>] ; \GetProcAddress 10001FF2 |. 85C0 TEST EAX,EAX 10001FF4 |. 74 06 JE SHORT jagmisc.10001FFC 10001FF6 |. FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10001FFA |. FFD0 CALL EAX 10001FFC |> FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; /ExitCode = 7C910738 10002000 \. FF15 6C800010 CALL DWORD PTR DS:[<&KERNEL32.ExitProcess>] ; \ExitProcess 10002006 CC INT3 10002007 /$ 6A 08 PUSH 8 10002009 |. E8 261E0000 CALL jagmisc.10003E34 1000200E |. 59 POP ECX ; kernel32.7C816FD7 1000200F \. C3 RETN 10002010 /$ 6A 08 PUSH 8 10002012 |. E8 681D0000 CALL jagmisc.10003D7F 10002017 |. 59 POP ECX ; kernel32.7C816FD7 10002018 \. C3 RETN 10002019 /$ 56 PUSH ESI 1000201A |. 8BF0 MOV ESI,EAX 1000201C |. EB 0B JMP SHORT jagmisc.10002029 1000201E |> 8B06 /MOV EAX,DWORD PTR DS:[ESI] 10002020 |. 85C0 |TEST EAX,EAX 10002022 |. 74 02 |JE SHORT jagmisc.10002026 10002024 |. FFD0 |CALL EAX 10002026 |> 83C6 04 |ADD ESI,4 10002029 |> 3B7424 08 CMP ESI,DWORD PTR SS:[ESP+8] 1000202D |.^ 72 EF \JB SHORT jagmisc.1000201E 1000202F |. 5E POP ESI ; kernel32.7C816FD7 10002030 \. C3 RETN 10002031 /$ A1 3CA00010 MOV EAX,DWORD PTR DS:[1000A03C] 10002036 |. 85C0 TEST EAX,EAX 10002038 |. 74 07 JE SHORT jagmisc.10002041 1000203A |. FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738 1000203E |. FFD0 CALL EAX 10002040 |. 59 POP ECX ; kernel32.7C816FD7 10002041 |> 56 PUSH ESI 10002042 |. 57 PUSH EDI 10002043 |. B9 0CA00010 MOV ECX,jagmisc.1000A00C 10002048 |. BF 18A00010 MOV EDI,jagmisc.1000A018 1000204D |. 33C0 XOR EAX,EAX 1000204F |. 3BCF CMP ECX,EDI 10002051 |. 8BF1 MOV ESI,ECX 10002053 |. 73 17 JNB SHORT jagmisc.1000206C 10002055 |> 85C0 /TEST EAX,EAX 10002057 |. 75 3F |JNZ SHORT jagmisc.10002098 10002059 |. 8B0E |MOV ECX,DWORD PTR DS:[ESI] 1000205B |. 85C9 |TEST ECX,ECX 1000205D |. 74 02 |JE SHORT jagmisc.10002061 1000205F |. FFD1 |CALL ECX 10002061 |> 83C6 04 |ADD ESI,4 10002064 |. 3BF7 |CMP ESI,EDI 10002066 |.^ 72 ED \JB SHORT jagmisc.10002055 10002068 |. 85C0 TEST EAX,EAX 1000206A |. 75 2C JNZ SHORT jagmisc.10002098 1000206C |> 68 812C0010 PUSH jagmisc.10002C81 10002071 |. E8 7D250000 CALL jagmisc.100045F3 10002076 |. BE 00A00010 MOV ESI,jagmisc.1000A000 1000207B |. 8BC6 MOV EAX,ESI 1000207D |. BF 08A00010 MOV EDI,jagmisc.1000A008 10002082 |. 3BC7 CMP EAX,EDI 10002084 |. 59 POP ECX ; kernel32.7C816FD7 10002085 |. 73 0F JNB SHORT jagmisc.10002096 10002087 |> 8B06 /MOV EAX,DWORD PTR DS:[ESI] 10002089 |. 85C0 |TEST EAX,EAX 1000208B |. 74 02 |JE SHORT jagmisc.1000208F 1000208D |. FFD0 |CALL EAX 1000208F |> 83C6 04 |ADD ESI,4 10002092 |. 3BF7 |CMP ESI,EDI 10002094 |.^ 72 F1 \JB SHORT jagmisc.10002087 10002096 |> 33C0 XOR EAX,EAX 10002098 |> 5F POP EDI ; kernel32.7C816FD7 10002099 |. 5E POP ESI ; kernel32.7C816FD7 1000209A \. C3 RETN 1000209B /$ 6A 08 PUSH 8 1000209D |. 68 28820010 PUSH jagmisc.10008228 100020A2 |. E8 C9020000 CALL jagmisc.10002370 100020A7 |. 6A 08 PUSH 8 ; /Arg1 = 00000008 100020A9 |. E8 861D0000 CALL jagmisc.10003E34 ; \jagmisc.10003E34 100020AE |. 59 POP ECX ; kernel32.7C816FD7 100020AF |. 33FF XOR EDI,EDI 100020B1 |. 897D FC MOV [LOCAL.1],EDI 100020B4 |. 33F6 XOR ESI,ESI 100020B6 |. 46 INC ESI 100020B7 |. 3935 CCAC0010 CMP DWORD PTR DS:[1000ACCC],ESI 100020BD |. 75 10 JNZ SHORT jagmisc.100020CF 100020BF |. FF75 08 PUSH [ARG.1] ; /ExitCode = FFFFFFFF (-1.) 100020C2 |. FF15 74800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentProcess>] ; |[GetCurrentProcess 100020C8 |. 50 PUSH EAX ; |hProcess = 00000008 100020C9 |. FF15 70800010 CALL DWORD PTR DS:[<&KERNEL32.TerminateProcess>] ; \TerminateProcess 100020CF |> 8935 C8AC0010 MOV DWORD PTR DS:[1000ACC8],ESI 100020D5 |. 8A45 10 MOV AL,BYTE PTR SS:[EBP+10] 100020D8 |. A2 C4AC0010 MOV BYTE PTR DS:[1000ACC4],AL 100020DD |. 397D 0C CMP [ARG.2],EDI 100020E0 |. 75 37 JNZ SHORT jagmisc.10002119 100020E2 |. 393D 88B40010 CMP DWORD PTR DS:[1000B488],EDI 100020E8 |. 74 1F JE SHORT jagmisc.10002109 100020EA |> A1 84B40010 /MOV EAX,DWORD PTR DS:[1000B484] 100020EF |. 83E8 04 |SUB EAX,4 100020F2 |. A3 84B40010 |MOV DWORD PTR DS:[1000B484],EAX 100020F7 |. 3B05 88B40010 |CMP EAX,DWORD PTR DS:[1000B488] 100020FD |. 72 0A |JB SHORT jagmisc.10002109 100020FF |. 8B00 |MOV EAX,DWORD PTR DS:[EAX] 10002101 |. 3BC7 |CMP EAX,EDI 10002103 |.^ 74 E5 |JE SHORT jagmisc.100020EA 10002105 |. FFD0 |CALL EAX 10002107 |.^ EB E1 \JMP SHORT jagmisc.100020EA 10002109 |> 68 20A00010 PUSH jagmisc.1000A020 1000210E |. B8 1CA00010 MOV EAX,jagmisc.1000A01C 10002113 |. E8 01FFFFFF CALL jagmisc.10002019 10002118 |. 59 POP ECX ; kernel32.7C816FD7 10002119 |> 68 28A00010 PUSH jagmisc.1000A028 1000211E |. B8 24A00010 MOV EAX,jagmisc.1000A024 10002123 |. E8 F1FEFFFF CALL jagmisc.10002019 10002128 |. 59 POP ECX ; kernel32.7C816FD7 10002129 |. 834D FC FF OR [LOCAL.1],FFFFFFFF 1000212D |. E8 18000000 CALL jagmisc.1000214A 10002132 |. 397D 10 CMP [ARG.3],EDI 10002135 |. 75 21 JNZ SHORT jagmisc.10002158 10002137 |. 8935 CCAC0010 MOV DWORD PTR DS:[1000ACCC],ESI 1000213D |. FF75 08 PUSH [ARG.1] 10002140 |. E8 92FEFFFF CALL jagmisc.10001FD7 10002145 |. 33FF XOR EDI,EDI 10002147 |. 33F6 XOR ESI,ESI 10002149 |. 46 INC ESI 1000214A |$ 397D 10 CMP [ARG.3],EDI 1000214D |. 74 08 JE SHORT jagmisc.10002157 1000214F |. 6A 08 PUSH 8 10002151 |. E8 291C0000 CALL jagmisc.10003D7F 10002156 |. 59 POP ECX ; kernel32.7C816FD7 10002157 |> C3 RETN 10002158 |> E8 4E020000 CALL jagmisc.100023AB 1000215D \. C3 RETN 1000215E /$ 6A 00 PUSH 0 10002160 |. 6A 01 PUSH 1 10002162 |. FF7424 0C PUSH DWORD PTR SS:[ESP+C] 10002166 |. E8 30FFFFFF CALL jagmisc.1000209B 1000216B |. 83C4 0C ADD ESP,0C 1000216E \. C3 RETN 1000216F /$ 6A 01 PUSH 1 10002171 |. 6A 00 PUSH 0 10002173 |. 6A 00 PUSH 0 10002175 |. E8 21FFFFFF CALL jagmisc.1000209B 1000217A |. 83C4 0C ADD ESP,0C 1000217D \. C3 RETN 1000217E /$ 55 PUSH EBP 1000217F |. 8BEC MOV EBP,ESP 10002181 |. 51 PUSH ECX 10002182 |. 53 PUSH EBX 10002183 |. 56 PUSH ESI 10002184 |. 57 PUSH EDI 10002185 |. E8 77FBFFFF CALL jagmisc.10001D01 1000218A |. 8B7D 08 MOV EDI,[ARG.1] 1000218D |. 8BF0 MOV ESI,EAX 1000218F |. 8B56 54 MOV EDX,DWORD PTR DS:[ESI+54] 10002192 |. A1 ECA00010 MOV EAX,DWORD PTR DS:[1000A0EC] 10002197 |. 8BCA MOV ECX,EDX 10002199 |> 3939 /CMP DWORD PTR DS:[ECX],EDI 1000219B |. 74 0D |JE SHORT jagmisc.100021AA 1000219D |. 8D1C40 |LEA EBX,DWORD PTR DS:[EAX+EAX*2] 100021A0 |. 83C1 0C |ADD ECX,0C 100021A3 |. 8D1C9A |LEA EBX,DWORD PTR DS:[EDX+EBX*4] 100021A6 |. 3BCB |CMP ECX,EBX 100021A8 |.^ 72 EF \JB SHORT jagmisc.10002199 100021AA |> 8D0440 LEA EAX,DWORD PTR DS:[EAX+EAX*2] 100021AD |. 8D0482 LEA EAX,DWORD PTR DS:[EDX+EAX*4] 100021B0 |. 3BC8 CMP ECX,EAX 100021B2 |. 73 04 JNB SHORT jagmisc.100021B8 100021B4 |. 3939 CMP DWORD PTR DS:[ECX],EDI 100021B6 |. 74 02 JE SHORT jagmisc.100021BA 100021B8 |> 33C9 XOR ECX,ECX 100021BA |> 85C9 TEST ECX,ECX 100021BC |. 0F84 12010000 JE jagmisc.100022D4 100021C2 |. 8B59 08 MOV EBX,DWORD PTR DS:[ECX+8] 100021C5 |. 85DB TEST EBX,EBX 100021C7 |. 895D 08 MOV [ARG.1],EBX 100021CA |. 0F84 04010000 JE jagmisc.100022D4 100021D0 |. 83FB 05 CMP EBX,5 100021D3 |. 75 0C JNZ SHORT jagmisc.100021E1 100021D5 |. 8361 08 00 AND DWORD PTR DS:[ECX+8],0 100021D9 |. 33C0 XOR EAX,EAX 100021DB |. 40 INC EAX 100021DC |. E9 FC000000 JMP jagmisc.100022DD 100021E1 |> 83FB 01 CMP EBX,1 100021E4 |. 0F84 E5000000 JE jagmisc.100022CF 100021EA |. 8B46 58 MOV EAX,DWORD PTR DS:[ESI+58] 100021ED |. 8945 FC MOV [LOCAL.1],EAX 100021F0 |. 8B45 0C MOV EAX,[ARG.2] 100021F3 |. 8946 58 MOV DWORD PTR DS:[ESI+58],EAX 100021F6 |. 8B41 04 MOV EAX,DWORD PTR DS:[ECX+4] 100021F9 |. 83F8 08 CMP EAX,8 100021FC |. 0F85 BF000000 JNZ jagmisc.100022C1 10002202 |. 8B15 E0A00010 MOV EDX,DWORD PTR DS:[1000A0E0] 10002208 |. A1 E4A00010 MOV EAX,DWORD PTR DS:[1000A0E4] 1000220D |. 03C2 ADD EAX,EDX 1000220F |. 3BD0 CMP EDX,EAX 10002211 |. 7D 27 JGE SHORT jagmisc.1000223A 10002213 |. 8D0452 LEA EAX,DWORD PTR DS:[EDX+EDX*2] 10002216 |. C1E0 02 SHL EAX,2 10002219 |> 8B7E 54 /MOV EDI,DWORD PTR DS:[ESI+54] 1000221C |. 836438 08 00 |AND DWORD PTR DS:[EAX+EDI+8],0 10002221 |. 8B3D E0A00010 |MOV EDI,DWORD PTR DS:[1000A0E0] 10002227 |. 8B1D E4A00010 |MOV EBX,DWORD PTR DS:[1000A0E4] 1000222D |. 42 |INC EDX 1000222E |. 03DF |ADD EBX,EDI 10002230 |. 83C0 0C |ADD EAX,0C 10002233 |. 3BD3 |CMP EDX,EBX 10002235 |.^ 7C E2 \JL SHORT jagmisc.10002219 10002237 |. 8B5D 08 MOV EBX,[ARG.1] 1000223A |> 8B09 MOV ECX,DWORD PTR DS:[ECX] 1000223C |. 81F9 8E0000C0 CMP ECX,C000008E 10002242 |. 8B7E 5C MOV EDI,DWORD PTR DS:[ESI+5C] 10002245 |. 75 09 JNZ SHORT jagmisc.10002250 10002247 |. C746 5C 83000000 MOV DWORD PTR DS:[ESI+5C],83 1000224E |. EB 64 JMP SHORT jagmisc.100022B4 10002250 |> 81F9 900000C0 CMP ECX,C0000090 10002256 |. 75 09 JNZ SHORT jagmisc.10002261 10002258 |. C746 5C 81000000 MOV DWORD PTR DS:[ESI+5C],81 1000225F |. EB 53 JMP SHORT jagmisc.100022B4 10002261 |> 81F9 910000C0 CMP ECX,C0000091 10002267 |. 75 09 JNZ SHORT jagmisc.10002272 10002269 |. C746 5C 84000000 MOV DWORD PTR DS:[ESI+5C],84 10002270 |. EB 42 JMP SHORT jagmisc.100022B4 10002272 |> 81F9 930000C0 CMP ECX,C0000093 10002278 |. 75 09 JNZ SHORT jagmisc.10002283 1000227A |. C746 5C 85000000 MOV DWORD PTR DS:[ESI+5C],85 10002281 |. EB 31 JMP SHORT jagmisc.100022B4 10002283 |> 81F9 8D0000C0 CMP ECX,C000008D 10002289 |. 75 09 JNZ SHORT jagmisc.10002294 1000228B |. C746 5C 82000000 MOV DWORD PTR DS:[ESI+5C],82 10002292 |. EB 20 JMP SHORT jagmisc.100022B4 10002294 |> 81F9 8F0000C0 CMP ECX,C000008F 1000229A |. 75 09 JNZ SHORT jagmisc.100022A5 1000229C |. C746 5C 86000000 MOV DWORD PTR DS:[ESI+5C],86 100022A3 |. EB 0F JMP SHORT jagmisc.100022B4 100022A5 |> 81F9 920000C0 CMP ECX,C0000092 100022AB |. 75 07 JNZ SHORT jagmisc.100022B4 100022AD |. C746 5C 8A000000 MOV DWORD PTR DS:[ESI+5C],8A 100022B4 |> FF76 5C PUSH DWORD PTR DS:[ESI+5C] 100022B7 |. 6A 08 PUSH 8 100022B9 |. FFD3 CALL EBX 100022BB |. 59 POP ECX ; kernel32.7C816FD7 100022BC |. 897E 5C MOV DWORD PTR DS:[ESI+5C],EDI 100022BF |. EB 07 JMP SHORT jagmisc.100022C8 100022C1 |> 8361 08 00 AND DWORD PTR DS:[ECX+8],0 100022C5 |. 50 PUSH EAX 100022C6 |. FFD3 CALL EBX 100022C8 |> 8B45 FC MOV EAX,[LOCAL.1] 100022CB |. 59 POP ECX ; kernel32.7C816FD7 100022CC |. 8946 58 MOV DWORD PTR DS:[ESI+58],EAX 100022CF |> 83C8 FF OR EAX,FFFFFFFF 100022D2 |. EB 09 JMP SHORT jagmisc.100022DD 100022D4 |> FF75 0C PUSH [ARG.2] ; /pExceptionInfo = 7FFD9000 100022D7 |. FF15 78800010 CALL DWORD PTR DS:[<&KERNEL32.UnhandledExceptionFilter>] ; \UnhandledExceptionFilter 100022DD |> 5F POP EDI ; kernel32.7C816FD7 100022DE |. 5E POP ESI ; kernel32.7C816FD7 100022DF |. 5B POP EBX ; kernel32.7C816FD7 100022E0 |. C9 LEAVE 100022E1 \. C3 RETN 100022E2 /$ B8 63736DE0 MOV EAX,E06D7363 100022E7 |. 394424 04 CMP DWORD PTR SS:[ESP+4],EAX 100022EB |. 75 0D JNZ SHORT jagmisc.100022FA 100022ED |. FF7424 08 PUSH DWORD PTR SS:[ESP+8] 100022F1 |. 50 PUSH EAX 100022F2 |. E8 87FEFFFF CALL jagmisc.1000217E 100022F7 |. 59 POP ECX ; kernel32.7C816FD7 100022F8 |. 59 POP ECX ; kernel32.7C816FD7 100022F9 |. C3 RETN 100022FA |> 33C0 XOR EAX,EAX 100022FC \. C3 RETN 100022FD $ 6A 0C PUSH 0C 100022FF . 68 38820010 PUSH jagmisc.10008238 10002304 . E8 67000000 CALL jagmisc.10002370 10002309 . 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8] 1000230C . 85F6 TEST ESI,ESI 1000230E . 74 58 JE SHORT jagmisc.10002368 10002310 . 833D 64B30010 03 CMP DWORD PTR DS:[1000B364],3 10002317 . 75 40 JNZ SHORT jagmisc.10002359 10002319 . 6A 04 PUSH 4 ; /Arg1 = 00000004 1000231B . E8 141B0000 CALL jagmisc.10003E34 ; \jagmisc.10003E34 10002320 . 59 POP ECX ; kernel32.7C816FD7 10002321 . 8365 FC 00 AND DWORD PTR SS:[EBP-4],0 10002325 . 56 PUSH ESI 10002326 . E8 22230000 CALL jagmisc.1000464D 1000232B . 59 POP ECX ; kernel32.7C816FD7 1000232C . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 1000232F . 85C0 TEST EAX,EAX 10002331 . 74 09 JE SHORT jagmisc.1000233C 10002333 . 56 PUSH ESI 10002334 . 50 PUSH EAX 10002335 . E8 3E230000 CALL jagmisc.10004678 1000233A . 59 POP ECX ; kernel32.7C816FD7 1000233B . 59 POP ECX ; kernel32.7C816FD7 1000233C > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10002340 . E8 0B000000 CALL jagmisc.10002350 10002345 . 837D E4 00 CMP DWORD PTR SS:[EBP-1C],0 10002349 . 75 1D JNZ SHORT jagmisc.10002368 1000234B . FF75 08 PUSH DWORD PTR SS:[EBP+8] 1000234E . EB 0A JMP SHORT jagmisc.1000235A 10002350 /$ 6A 04 PUSH 4 10002352 |. E8 281A0000 CALL jagmisc.10003D7F 10002357 |. 59 POP ECX ; kernel32.7C816FD7 10002358 \. C3 RETN 10002359 > 56 PUSH ESI 1000235A > 6A 00 PUSH 0 ; |Flags = 0 1000235C . FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000 10002362 . FF15 7C800010 CALL DWORD PTR DS:[<&KERNEL32.HeapFree>] ; \HeapFree 10002368 > E8 3E000000 CALL jagmisc.100023AB 1000236D . C3 RETN 1000236E CC INT3 1000236F CC INT3 10002370 /$ 68 C4230010 PUSH jagmisc.100023C4 10002375 |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 1000237B |. 50 PUSH EAX 1000237C |. 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 10002380 |. 896C24 10 MOV DWORD PTR SS:[ESP+10],EBP 10002384 |. 8D6C24 10 LEA EBP,DWORD PTR SS:[ESP+10] 10002388 |. 2BE0 SUB ESP,EAX 1000238A |. 53 PUSH EBX 1000238B |. 56 PUSH ESI 1000238C |. 57 PUSH EDI 1000238D |. 8B45 F8 MOV EAX,[LOCAL.2] ; LOADDLL.00410249 10002390 |. 8965 E8 MOV [LOCAL.6],ESP 10002393 |. 50 PUSH EAX 10002394 |. 8B45 FC MOV EAX,[LOCAL.1] 10002397 |. C745 FC FFFFFFFF MOV [LOCAL.1],-1 1000239E |. 8945 F8 MOV [LOCAL.2],EAX 100023A1 |. 8D45 F0 LEA EAX,[LOCAL.4] 100023A4 |. 64:A3 00000000 MOV DWORD PTR FS:[0],EAX 100023AA \. C3 RETN 100023AB /$ 8B4D F0 MOV ECX,[LOCAL.4] 100023AE |. 64:890D 00000000 MOV DWORD PTR FS:[0],ECX 100023B5 |. 59 POP ECX ; kernel32.7C816FD7 100023B6 |. 5F POP EDI ; kernel32.7C816FD7 100023B7 |. 5E POP ESI ; kernel32.7C816FD7 100023B8 |. 5B POP EBX ; kernel32.7C816FD7 100023B9 |. C9 LEAVE 100023BA |. 51 PUSH ECX 100023BB \. C3 RETN 100023BC . 56 PUSH ESI 100023BD . 43 INC EBX 100023BE . 3230 XOR DH,BYTE PTR DS:[EAX] 100023C0 . 58 POP EAX ; kernel32.7C816FD7 100023C1 . 43 INC EBX 100023C2 . 3030 XOR BYTE PTR DS:[EAX],DH 100023C4 /. 55 PUSH EBP 100023C5 |. 8BEC MOV EBP,ESP 100023C7 |. 83EC 08 SUB ESP,8 100023CA |. 53 PUSH EBX 100023CB |. 56 PUSH ESI 100023CC |. 57 PUSH EDI 100023CD |. 55 PUSH EBP 100023CE |. FC CLD 100023CF |. 8B5D 0C MOV EBX,[ARG.2] 100023D2 |. 8B45 08 MOV EAX,[ARG.1] 100023D5 |. F740 04 06000000 TEST DWORD PTR DS:[EAX+4],6 100023DC |. 0F85 AB000000 JNZ jagmisc.1000248D 100023E2 |. 8945 F8 MOV [LOCAL.2],EAX 100023E5 |. 8B45 10 MOV EAX,[ARG.3] 100023E8 |. 8945 FC MOV [LOCAL.1],EAX 100023EB |. 8D45 F8 LEA EAX,[LOCAL.2] 100023EE |. 8943 FC MOV DWORD PTR DS:[EBX-4],EAX 100023F1 |. 8B73 0C MOV ESI,DWORD PTR DS:[EBX+C] 100023F4 |. 8B7B 08 MOV EDI,DWORD PTR DS:[EBX+8] 100023F7 |. 53 PUSH EBX 100023F8 |. E8 192E0000 CALL jagmisc.10005216 100023FD |. 83C4 04 ADD ESP,4 10002400 |. 0BC0 OR EAX,EAX 10002402 |. 74 7B JE SHORT jagmisc.1000247F 10002404 |> 83FE FF /CMP ESI,-1 10002407 |. 74 7D |JE SHORT jagmisc.10002486 10002409 |. 8D0C76 |LEA ECX,DWORD PTR DS:[ESI+ESI*2] 1000240C |. 8B448F 04 |MOV EAX,DWORD PTR DS:[EDI+ECX*4+4] 10002410 |. 0BC0 |OR EAX,EAX 10002412 |. 74 59 |JE SHORT jagmisc.1000246D 10002414 |. 56 |PUSH ESI 10002415 |. 55 |PUSH EBP 10002416 |. 8D6B 10 |LEA EBP,DWORD PTR DS:[EBX+10] 10002419 |. 33DB |XOR EBX,EBX 1000241B |. 33C9 |XOR ECX,ECX 1000241D |. 33D2 |XOR EDX,EDX 1000241F |. 33F6 |XOR ESI,ESI 10002421 |. 33FF |XOR EDI,EDI 10002423 |. FFD0 |CALL EAX 10002425 |. 5D |POP EBP ; kernel32.7C816FD7 10002426 |. 5E |POP ESI ; kernel32.7C816FD7 10002427 |. 8B5D 0C |MOV EBX,[ARG.2] 1000242A |. 0BC0 |OR EAX,EAX 1000242C |. 74 3F |JE SHORT jagmisc.1000246D 1000242E |. 78 48 |JS SHORT jagmisc.10002478 10002430 |. 8B7B 08 |MOV EDI,DWORD PTR DS:[EBX+8] 10002433 |. 53 |PUSH EBX ; /Arg1 = 00000000 10002434 |. E8 EF2C0000 |CALL jagmisc.10005128 ; \jagmisc.10005128 10002439 |. 83C4 04 |ADD ESP,4 1000243C |. 8D6B 10 |LEA EBP,DWORD PTR DS:[EBX+10] 1000243F |. 56 |PUSH ESI 10002440 |. 53 |PUSH EBX 10002441 |. E8 242D0000 |CALL jagmisc.1000516A 10002446 |. 83C4 08 |ADD ESP,8 10002449 |. 8D0C76 |LEA ECX,DWORD PTR DS:[ESI+ESI*2] 1000244C |. 6A 01 |PUSH 1 1000244E |. 8B448F 08 |MOV EAX,DWORD PTR DS:[EDI+ECX*4+8] 10002452 |. E8 A72D0000 |CALL jagmisc.100051FE 10002457 |. 8B048F |MOV EAX,DWORD PTR DS:[EDI+ECX*4] 1000245A |. 8943 0C |MOV DWORD PTR DS:[EBX+C],EAX 1000245D |. 8B448F 08 |MOV EAX,DWORD PTR DS:[EDI+ECX*4+8] 10002461 |. 33DB |XOR EBX,EBX 10002463 |. 33C9 |XOR ECX,ECX 10002465 |. 33D2 |XOR EDX,EDX 10002467 |. 33F6 |XOR ESI,ESI 10002469 |. 33FF |XOR EDI,EDI 1000246B |. FFD0 |CALL EAX 1000246D |> 8B7B 08 |MOV EDI,DWORD PTR DS:[EBX+8] 10002470 |. 8D0C76 |LEA ECX,DWORD PTR DS:[ESI+ESI*2] 10002473 |. 8B348F |MOV ESI,DWORD PTR DS:[EDI+ECX*4] 10002476 |.^ EB 8C \JMP SHORT jagmisc.10002404 10002478 |> B8 00000000 MOV EAX,0 1000247D |. EB 23 JMP SHORT jagmisc.100024A2 1000247F |> 8B45 08 MOV EAX,[ARG.1] 10002482 |. 8348 04 08 OR DWORD PTR DS:[EAX+4],8 10002486 |> B8 01000000 MOV EAX,1 1000248B |. EB 15 JMP SHORT jagmisc.100024A2 1000248D |> 55 PUSH EBP 1000248E |. 8D6B 10 LEA EBP,DWORD PTR DS:[EBX+10] 10002491 |. 6A FF PUSH -1 10002493 |. 53 PUSH EBX 10002494 |. E8 D12C0000 CALL jagmisc.1000516A 10002499 |. 83C4 08 ADD ESP,8 1000249C |. 5D POP EBP ; kernel32.7C816FD7 1000249D |. B8 01000000 MOV EAX,1 100024A2 |> 5D POP EBP ; kernel32.7C816FD7 100024A3 |. 5F POP EDI ; kernel32.7C816FD7 100024A4 |. 5E POP ESI ; kernel32.7C816FD7 100024A5 |. 5B POP EBX ; kernel32.7C816FD7 100024A6 |. 8BE5 MOV ESP,EBP 100024A8 |. 5D POP EBP ; kernel32.7C816FD7 100024A9 \. C3 RETN 100024AA . 55 PUSH EBP 100024AB . 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 100024AF . 8B29 MOV EBP,DWORD PTR DS:[ECX] 100024B1 . 8B41 1C MOV EAX,DWORD PTR DS:[ECX+1C] 100024B4 . 50 PUSH EAX 100024B5 . 8B41 18 MOV EAX,DWORD PTR DS:[ECX+18] 100024B8 . 50 PUSH EAX 100024B9 . E8 AC2C0000 CALL jagmisc.1000516A 100024BE . 83C4 08 ADD ESP,8 100024C1 . 5D POP EBP ; kernel32.7C816FD7 100024C2 . C2 0400 RETN 4 100024C5 /$ E8 37F8FFFF CALL jagmisc.10001D01 100024CA |. 83C0 08 ADD EAX,8 100024CD \. C3 RETN 100024CE /$ 56 PUSH ESI 100024CF |. E8 2DF8FFFF CALL jagmisc.10001D01 100024D4 |. 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 100024D8 |. 8948 0C MOV DWORD PTR DS:[EAX+C],ECX 100024DB |. 33F6 XOR ESI,ESI 100024DD |> 3B0CF5 F0A00010 /CMP ECX,DWORD PTR DS:[ESI*8+1000A0F0] 100024E4 |. 74 1E |JE SHORT jagmisc.10002504 100024E6 |. 46 |INC ESI 100024E7 |. 83FE 2D |CMP ESI,2D 100024EA |.^ 72 F1 \JB SHORT jagmisc.100024DD 100024EC |. 83F9 13 CMP ECX,13 100024EF |. 72 24 JB SHORT jagmisc.10002515 100024F1 |. 83F9 24 CMP ECX,24 100024F4 |. 77 1F JA SHORT jagmisc.10002515 100024F6 |. E8 06F8FFFF CALL jagmisc.10001D01 100024FB |. C740 08 0D000000 MOV DWORD PTR DS:[EAX+8],0D 10002502 |. 5E POP ESI ; kernel32.7C816FD7 10002503 |. C3 RETN 10002504 |> E8 F8F7FFFF CALL jagmisc.10001D01 10002509 |. 8B0CF5 F4A00010 MOV ECX,DWORD PTR DS:[ESI*8+1000A0F4] 10002510 |. 8948 08 MOV DWORD PTR DS:[EAX+8],ECX 10002513 |. 5E POP ESI ; kernel32.7C816FD7 10002514 |. C3 RETN 10002515 |> 81F9 BC000000 CMP ECX,0BC 1000251B |. 72 16 JB SHORT jagmisc.10002533 1000251D |. 81F9 CA000000 CMP ECX,0CA 10002523 |. 77 0E JA SHORT jagmisc.10002533 10002525 |. E8 D7F7FFFF CALL jagmisc.10001D01 1000252A |. C740 08 08000000 MOV DWORD PTR DS:[EAX+8],8 10002531 |. 5E POP ESI ; kernel32.7C816FD7 10002532 |. C3 RETN 10002533 |> E8 C9F7FFFF CALL jagmisc.10001D01 10002538 |. C740 08 16000000 MOV DWORD PTR DS:[EAX+8],16 1000253F |. 5E POP ESI ; kernel32.7C816FD7 10002540 \. C3 RETN 10002541 $ 6A 10 PUSH 10 10002543 . 68 48820010 PUSH jagmisc.10008248 10002548 . E8 23FEFFFF CALL jagmisc.10002370 1000254D . 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8] 10002550 . 0FAF75 0C IMUL ESI,DWORD PTR SS:[EBP+C] 10002554 . 8975 E0 MOV DWORD PTR SS:[EBP-20],ESI 10002557 . 85F6 TEST ESI,ESI 10002559 . 75 01 JNZ SHORT jagmisc.1000255C 1000255B . 46 INC ESI 1000255C > 33FF XOR EDI,EDI 1000255E . 897D E4 MOV DWORD PTR SS:[EBP-1C],EDI 10002561 . 83FE E0 CMP ESI,-20 10002564 . 77 65 JA SHORT jagmisc.100025CB 10002566 . 833D 64B30010 03 CMP DWORD PTR DS:[1000B364],3 1000256D . 75 47 JNZ SHORT jagmisc.100025B6 1000256F . 83C6 0F ADD ESI,0F 10002572 . 83E6 F0 AND ESI,FFFFFFF0 10002575 . 8975 0C MOV DWORD PTR SS:[EBP+C],ESI 10002578 . 8B5D E0 MOV EBX,DWORD PTR SS:[EBP-20] 1000257B . 3B1D 24B10010 CMP EBX,DWORD PTR DS:[1000B124] 10002581 . 77 33 JA SHORT jagmisc.100025B6 10002583 . 6A 04 PUSH 4 ; /Arg1 = 00000004 10002585 . E8 AA180000 CALL jagmisc.10003E34 ; \jagmisc.10003E34 1000258A . 59 POP ECX ; kernel32.7C816FD7 1000258B . 217D FC AND DWORD PTR SS:[EBP-4],EDI 1000258E . 53 PUSH EBX 1000258F . E8 98280000 CALL jagmisc.10004E2C 10002594 . 59 POP ECX ; kernel32.7C816FD7 10002595 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 10002598 . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 1000259C . E8 4A000000 CALL jagmisc.100025EB 100025A1 . 8B7D E4 MOV EDI,DWORD PTR SS:[EBP-1C] 100025A4 . 85FF TEST EDI,EDI 100025A6 . 74 12 JE SHORT jagmisc.100025BA 100025A8 . FF75 E0 PUSH DWORD PTR SS:[EBP-20] 100025AB . 6A 00 PUSH 0 100025AD . 57 PUSH EDI 100025AE . E8 5D150000 CALL jagmisc.10003B10 100025B3 . 83C4 0C ADD ESP,0C 100025B6 > 85FF TEST EDI,EDI 100025B8 . 75 3A JNZ SHORT jagmisc.100025F4 100025BA > 56 PUSH ESI ; /HeapSize = 0 100025BB . 6A 08 PUSH 8 ; |Flags = HEAP_ZERO_MEMORY 100025BD . FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000 100025C3 . FF15 80800010 CALL DWORD PTR DS:[<&KERNEL32.HeapAlloc>] ; \HeapAlloc 100025C9 . 8BF8 MOV EDI,EAX 100025CB > 85FF TEST EDI,EDI 100025CD . 75 25 JNZ SHORT jagmisc.100025F4 100025CF . 393D 90AF0010 CMP DWORD PTR DS:[1000AF90],EDI 100025D5 . 74 1D JE SHORT jagmisc.100025F4 100025D7 . 56 PUSH ESI 100025D8 . E8 622E0000 CALL jagmisc.1000543F 100025DD . 59 POP ECX ; kernel32.7C816FD7 100025DE . 85C0 TEST EAX,EAX 100025E0 .^ 0F85 76FFFFFF JNZ jagmisc.1000255C 100025E6 . EB 0E JMP SHORT jagmisc.100025F6 100025E8 8B DB 8B 100025E9 75 DB 75 ; CHAR 'u' 100025EA 0C DB 0C 100025EB /$ 6A 04 PUSH 4 100025ED |. E8 8D170000 CALL jagmisc.10003D7F 100025F2 |. 59 POP ECX ; kernel32.7C816FD7 100025F3 \. C3 RETN 100025F4 > 8BC7 MOV EAX,EDI 100025F6 > E8 B0FDFFFF CALL jagmisc.100023AB 100025FB . C3 RETN 100025FC /$ 83EC 48 SUB ESP,48 100025FF |. 53 PUSH EBX 10002600 |. BB 80040000 MOV EBX,480 10002605 |. 53 PUSH EBX 10002606 |. E8 912F0000 CALL jagmisc.1000559C 1000260B |. 85C0 TEST EAX,EAX 1000260D |. 59 POP ECX ; kernel32.7C816FD7 1000260E |. 75 08 JNZ SHORT jagmisc.10002618 10002610 |. 83C8 FF OR EAX,FFFFFFFF 10002613 |. E9 DD010000 JMP jagmisc.100027F5 10002618 |> A3 80B30010 MOV DWORD PTR DS:[1000B380],EAX 1000261D |. C705 68B30010 200>MOV DWORD PTR DS:[1000B368],20 10002627 |. 8D88 80040000 LEA ECX,DWORD PTR DS:[EAX+480] 1000262D |. EB 1E JMP SHORT jagmisc.1000264D 1000262F |> 8308 FF /OR DWORD PTR DS:[EAX],FFFFFFFF 10002632 |. 8360 08 00 |AND DWORD PTR DS:[EAX+8],0 10002636 |. C640 04 00 |MOV BYTE PTR DS:[EAX+4],0 1000263A |. C640 05 0A |MOV BYTE PTR DS:[EAX+5],0A 1000263E |. 8B0D 80B30010 |MOV ECX,DWORD PTR DS:[1000B380] 10002644 |. 83C0 24 |ADD EAX,24 10002647 |. 81C1 80040000 |ADD ECX,480 1000264D |> 3BC1 CMP EAX,ECX 1000264F |.^ 72 DE \JB SHORT jagmisc.1000262F 10002651 |. 55 PUSH EBP 10002652 |. 56 PUSH ESI 10002653 |. 57 PUSH EDI 10002654 |. 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14] 10002658 |. 50 PUSH EAX ; /pStartupinfo = 00000008 10002659 |. FF15 90800010 CALL DWORD PTR DS:[<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA 1000265F |. 66:837C24 46 00 CMP WORD PTR SS:[ESP+46],0 10002665 |. 0F84 E9000000 JE jagmisc.10002754 1000266B |. 8B4424 48 MOV EAX,DWORD PTR SS:[ESP+48] 1000266F |. 85C0 TEST EAX,EAX 10002671 |. 0F84 DD000000 JE jagmisc.10002754 10002677 |. 8B38 MOV EDI,DWORD PTR DS:[EAX] 10002679 |. 8D68 04 LEA EBP,DWORD PTR DS:[EAX+4] 1000267C |. 8D042F LEA EAX,DWORD PTR DS:[EDI+EBP] 1000267F |. 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 10002683 |. B8 00080000 MOV EAX,800 10002688 |. 3BF8 CMP EDI,EAX 1000268A |. 7C 02 JL SHORT jagmisc.1000268E 1000268C |. 8BF8 MOV EDI,EAX 1000268E |> 393D 68B30010 CMP DWORD PTR DS:[1000B368],EDI 10002694 |. 7D 4E JGE SHORT jagmisc.100026E4 10002696 |. BE 84B30010 MOV ESI,jagmisc.1000B384 1000269B |> 53 /PUSH EBX 1000269C |. E8 FB2E0000 |CALL jagmisc.1000559C 100026A1 |. 85C0 |TEST EAX,EAX 100026A3 |. 59 |POP ECX ; kernel32.7C816FD7 100026A4 |. 74 38 |JE SHORT jagmisc.100026DE 100026A6 |. 8305 68B30010 20 |ADD DWORD PTR DS:[1000B368],20 100026AD |. 8906 |MOV DWORD PTR DS:[ESI],EAX 100026AF |. 8D88 80040000 |LEA ECX,DWORD PTR DS:[EAX+480] 100026B5 |. EB 16 |JMP SHORT jagmisc.100026CD 100026B7 |> 8308 FF |/OR DWORD PTR DS:[EAX],FFFFFFFF 100026BA |. 8360 08 00 ||AND DWORD PTR DS:[EAX+8],0 100026BE |. C640 04 00 ||MOV BYTE PTR DS:[EAX+4],0 100026C2 |. C640 05 0A ||MOV BYTE PTR DS:[EAX+5],0A 100026C6 |. 8B0E ||MOV ECX,DWORD PTR DS:[ESI] 100026C8 |. 83C0 24 ||ADD EAX,24 100026CB |. 03CB ||ADD ECX,EBX 100026CD |> 3BC1 | CMP EAX,ECX 100026CF |.^ 72 E6 |\JB SHORT jagmisc.100026B7 100026D1 |. 83C6 04 |ADD ESI,4 100026D4 |. 393D 68B30010 |CMP DWORD PTR DS:[1000B368],EDI 100026DA |.^ 7C BF \JL SHORT jagmisc.1000269B 100026DC |. EB 06 JMP SHORT jagmisc.100026E4 100026DE |> 8B3D 68B30010 MOV EDI,DWORD PTR DS:[1000B368] 100026E4 |> 33DB XOR EBX,EBX 100026E6 |. 85FF TEST EDI,EDI 100026E8 |. 7E 6A JLE SHORT jagmisc.10002754 100026EA |> 8B4424 10 /MOV EAX,DWORD PTR SS:[ESP+10] 100026EE |. 8B00 |MOV EAX,DWORD PTR DS:[EAX] 100026F0 |. 83F8 FF |CMP EAX,-1 100026F3 |. 74 54 |JE SHORT jagmisc.10002749 100026F5 |. 8A4D 00 |MOV CL,BYTE PTR SS:[EBP] 100026F8 |. F6C1 01 |TEST CL,1 100026FB |. 74 4C |JE SHORT jagmisc.10002749 100026FD |. F6C1 08 |TEST CL,8 10002700 |. 75 0B |JNZ SHORT jagmisc.1000270D 10002702 |. 50 |PUSH EAX ; /hFile = 00000008 10002703 |. FF15 8C800010 |CALL DWORD PTR DS:[<&KERNEL32.GetFileType>] ; \GetFileType 10002709 |. 85C0 |TEST EAX,EAX 1000270B |. 74 3C |JE SHORT jagmisc.10002749 1000270D |> 8BCB |MOV ECX,EBX 1000270F |. 8BC3 |MOV EAX,EBX 10002711 |. 83E0 1F |AND EAX,1F 10002714 |. 8D04C0 |LEA EAX,DWORD PTR DS:[EAX+EAX*8] 10002717 |. C1F9 05 |SAR ECX,5 1000271A |. 8B0C8D 80B30010 |MOV ECX,DWORD PTR DS:[ECX*4+1000B380] 10002721 |. 8D3481 |LEA ESI,DWORD PTR DS:[ECX+EAX*4] 10002724 |. 8B4424 10 |MOV EAX,DWORD PTR SS:[ESP+10] 10002728 |. 8B00 |MOV EAX,DWORD PTR DS:[EAX] 1000272A |. 8906 |MOV DWORD PTR DS:[ESI],EAX 1000272C |. 8A45 00 |MOV AL,BYTE PTR SS:[EBP] 1000272F |. 8846 04 |MOV BYTE PTR DS:[ESI+4],AL 10002732 |. 8D46 0C |LEA EAX,DWORD PTR DS:[ESI+C] 10002735 |. 68 A00F0000 |PUSH 0FA0 1000273A |. 50 |PUSH EAX 1000273B |. E8 2A2D0000 |CALL jagmisc.1000546A 10002740 |. 85C0 |TEST EAX,EAX 10002742 |. 59 |POP ECX ; kernel32.7C816FD7 10002743 |. 59 |POP ECX ; kernel32.7C816FD7 10002744 |. 74 2E |JE SHORT jagmisc.10002774 10002746 |. FF46 08 |INC DWORD PTR DS:[ESI+8] 10002749 |> 834424 10 04 |ADD DWORD PTR SS:[ESP+10],4 1000274E |. 43 |INC EBX 1000274F |. 45 |INC EBP 10002750 |. 3BDF |CMP EBX,EDI 10002752 |.^ 7C 96 \JL SHORT jagmisc.100026EA 10002754 |> 33DB XOR EBX,EBX 10002756 |> 8B0D 80B30010 MOV ECX,DWORD PTR DS:[1000B380] 1000275C |. 8D04DB LEA EAX,DWORD PTR DS:[EBX+EBX*8] 1000275F |. 8D3481 LEA ESI,DWORD PTR DS:[ECX+EAX*4] 10002762 |. 833E FF CMP DWORD PTR DS:[ESI],-1 10002765 |. 75 6F JNZ SHORT jagmisc.100027D6 10002767 |. 85DB TEST EBX,EBX 10002769 |. C646 04 81 MOV BYTE PTR DS:[ESI+4],81 1000276D |. 75 0A JNZ SHORT jagmisc.10002779 1000276F |. 6A F6 PUSH -0A 10002771 |. 58 POP EAX ; kernel32.7C816FD7 10002772 |. EB 0F JMP SHORT jagmisc.10002783 10002774 |> 83C8 FF OR EAX,FFFFFFFF 10002777 |. EB 79 JMP SHORT jagmisc.100027F2 10002779 |> 8BC3 MOV EAX,EBX 1000277B |. 48 DEC EAX 1000277C |. F7D8 NEG EAX 1000277E |. 1BC0 SBB EAX,EAX 10002780 |. 83C0 F5 ADD EAX,-0B 10002783 |> 50 PUSH EAX ; /DevType = 8 10002784 |. FF15 88800010 CALL DWORD PTR DS:[<&KERNEL32.GetStdHandle>] ; \GetStdHandle 1000278A |. 8BF8 MOV EDI,EAX 1000278C |. 83FF FF CMP EDI,-1 1000278F |. 74 3F JE SHORT jagmisc.100027D0 10002791 |. 57 PUSH EDI ; /hFile = NULL 10002792 |. FF15 8C800010 CALL DWORD PTR DS:[<&KERNEL32.GetFileType>] ; \GetFileType 10002798 |. 85C0 TEST EAX,EAX 1000279A |. 74 34 JE SHORT jagmisc.100027D0 1000279C |. 25 FF000000 AND EAX,0FF 100027A1 |. 83F8 02 CMP EAX,2 100027A4 |. 893E MOV DWORD PTR DS:[ESI],EDI 100027A6 |. 75 06 JNZ SHORT jagmisc.100027AE 100027A8 |. 804E 04 40 OR BYTE PTR DS:[ESI+4],40 100027AC |. EB 09 JMP SHORT jagmisc.100027B7 100027AE |> 83F8 03 CMP EAX,3 100027B1 |. 75 04 JNZ SHORT jagmisc.100027B7 100027B3 |. 804E 04 08 OR BYTE PTR DS:[ESI+4],8 100027B7 |> 8D46 0C LEA EAX,DWORD PTR DS:[ESI+C] 100027BA |. 68 A00F0000 PUSH 0FA0 100027BF |. 50 PUSH EAX 100027C0 |. E8 A52C0000 CALL jagmisc.1000546A 100027C5 |. 85C0 TEST EAX,EAX 100027C7 |. 59 POP ECX ; kernel32.7C816FD7 100027C8 |. 59 POP ECX ; kernel32.7C816FD7 100027C9 |.^ 74 A9 JE SHORT jagmisc.10002774 100027CB |. FF46 08 INC DWORD PTR DS:[ESI+8] 100027CE |. EB 0A JMP SHORT jagmisc.100027DA 100027D0 |> 804E 04 40 OR BYTE PTR DS:[ESI+4],40 100027D4 |. EB 04 JMP SHORT jagmisc.100027DA 100027D6 |> 804E 04 80 OR BYTE PTR DS:[ESI+4],80 100027DA |> 43 INC EBX 100027DB |. 83FB 03 CMP EBX,3 100027DE |.^ 0F8C 72FFFFFF JL jagmisc.10002756 100027E4 |. FF35 68B30010 PUSH DWORD PTR DS:[1000B368] ; /nHandles = 20 (32.) 100027EA |. FF15 84800010 CALL DWORD PTR DS:[<&KERNEL32.SetHandleCount>] ; \SetHandleCount 100027F0 |. 33C0 XOR EAX,EAX 100027F2 |> 5F POP EDI ; kernel32.7C816FD7 100027F3 |. 5E POP ESI ; kernel32.7C816FD7 100027F4 |. 5D POP EBP ; kernel32.7C816FD7 100027F5 |> 5B POP EBX ; kernel32.7C816FD7 100027F6 |. 83C4 48 ADD ESP,48 100027F9 \. C3 RETN 100027FA /$ 56 PUSH ESI 100027FB |. 57 PUSH EDI 100027FC |. BE 80B30010 MOV ESI,jagmisc.1000B380 10002801 |> 8B3E /MOV EDI,DWORD PTR DS:[ESI] 10002803 |. 85FF |TEST EDI,EDI 10002805 |. 74 31 |JE SHORT jagmisc.10002838 10002807 |. 8D87 80040000 |LEA EAX,DWORD PTR DS:[EDI+480] 1000280D |. EB 1A |JMP SHORT jagmisc.10002829 1000280F |> 837F 08 00 |/CMP DWORD PTR DS:[EDI+8],0 10002813 |. 74 0A ||JE SHORT jagmisc.1000281F 10002815 |. 8D47 0C ||LEA EAX,DWORD PTR DS:[EDI+C] 10002818 |. 50 ||PUSH EAX ; /pCriticalSection = 00000008 10002819 |. FF15 18800010 ||CALL DWORD PTR DS:[<&KERNEL32.DeleteCriticalSection>] ; \DeleteCriticalSection 1000281F |> 8B06 ||MOV EAX,DWORD PTR DS:[ESI] 10002821 |. 83C7 24 ||ADD EDI,24 10002824 |. 05 80040000 ||ADD EAX,480 10002829 |> 3BF8 | CMP EDI,EAX 1000282B |.^ 72 E2 |\JB SHORT jagmisc.1000280F 1000282D |. FF36 |PUSH DWORD PTR DS:[ESI] 1000282F |. E8 C9FAFFFF |CALL jagmisc.100022FD 10002834 |. 8326 00 |AND DWORD PTR DS:[ESI],0 10002837 |. 59 |POP ECX ; kernel32.7C816FD7 10002838 |> 83C6 04 |ADD ESI,4 1000283B |. 81FE 80B40010 |CMP ESI,jagmisc.1000B480 10002841 |.^ 7C BE \JL SHORT jagmisc.10002801 10002843 |. 5F POP EDI ; kernel32.7C816FD7 10002844 |. 5E POP ESI ; kernel32.7C816FD7 10002845 \. C3 RETN 10002846 /$ 53 PUSH EBX 10002847 |. 33DB XOR EBX,EBX 10002849 |. 391D 8CB40010 CMP DWORD PTR DS:[1000B48C],EBX 1000284F |. 56 PUSH ESI 10002850 |. 57 PUSH EDI 10002851 |. 75 05 JNZ SHORT jagmisc.10002858 10002853 |. E8 9D1C0000 CALL jagmisc.100044F5 10002858 |> 8B35 68AC0010 MOV ESI,DWORD PTR DS:[1000AC68] 1000285E |. 33FF XOR EDI,EDI 10002860 |. 3BF3 CMP ESI,EBX 10002862 |. 75 12 JNZ SHORT jagmisc.10002876 10002864 |. EB 30 JMP SHORT jagmisc.10002896 10002866 |> 3C 3D /CMP AL,3D 10002868 |. 74 01 |JE SHORT jagmisc.1000286B 1000286A |. 47 |INC EDI 1000286B |> 56 |PUSH ESI 1000286C |. E8 2F0F0000 |CALL jagmisc.100037A0 10002871 |. 59 |POP ECX ; kernel32.7C816FD7 10002872 |. 8D7406 01 |LEA ESI,DWORD PTR DS:[ESI+EAX+1] 10002876 |> 8A06 MOV AL,BYTE PTR DS:[ESI] 10002878 |. 3AC3 |CMP AL,BL 1000287A |.^ 75 EA \JNZ SHORT jagmisc.10002866 1000287C |. 8D04BD 04000000 LEA EAX,DWORD PTR DS:[EDI*4+4] 10002883 |. 50 PUSH EAX 10002884 |. E8 132D0000 CALL jagmisc.1000559C 10002889 |. 8BF8 MOV EDI,EAX 1000288B |. 3BFB CMP EDI,EBX 1000288D |. 59 POP ECX ; kernel32.7C816FD7 1000288E |. 893D ACAC0010 MOV DWORD PTR DS:[1000ACAC],EDI 10002894 |. 75 05 JNZ SHORT jagmisc.1000289B 10002896 |> 83C8 FF OR EAX,FFFFFFFF 10002899 |. EB 58 JMP SHORT jagmisc.100028F3 1000289B |> 8B35 68AC0010 MOV ESI,DWORD PTR DS:[1000AC68] 100028A1 |. 55 PUSH EBP 100028A2 |. EB 2A JMP SHORT jagmisc.100028CE 100028A4 |> 56 /PUSH ESI 100028A5 |. E8 F60E0000 |CALL jagmisc.100037A0 100028AA |. 8BE8 |MOV EBP,EAX 100028AC |. 45 |INC EBP 100028AD |. 803E 3D |CMP BYTE PTR DS:[ESI],3D 100028B0 |. 59 |POP ECX ; kernel32.7C816FD7 100028B1 |. 74 19 |JE SHORT jagmisc.100028CC 100028B3 |. 55 |PUSH EBP 100028B4 |. E8 E32C0000 |CALL jagmisc.1000559C 100028B9 |. 3BC3 |CMP EAX,EBX 100028BB |. 59 |POP ECX ; kernel32.7C816FD7 100028BC |. 8907 |MOV DWORD PTR DS:[EDI],EAX 100028BE |. 74 37 |JE SHORT jagmisc.100028F7 100028C0 |. 56 |PUSH ESI 100028C1 |. 50 |PUSH EAX 100028C2 |. E8 690F0000 |CALL jagmisc.10003830 100028C7 |. 59 |POP ECX ; kernel32.7C816FD7 100028C8 |. 59 |POP ECX ; kernel32.7C816FD7 100028C9 |. 83C7 04 |ADD EDI,4 100028CC |> 03F5 |ADD ESI,EBP 100028CE |> 381E CMP BYTE PTR DS:[ESI],BL 100028D0 |.^ 75 D2 \JNZ SHORT jagmisc.100028A4 100028D2 |. FF35 68AC0010 PUSH DWORD PTR DS:[1000AC68] 100028D8 |. E8 20FAFFFF CALL jagmisc.100022FD 100028DD |. 891D 68AC0010 MOV DWORD PTR DS:[1000AC68],EBX 100028E3 |. 891F MOV DWORD PTR DS:[EDI],EBX 100028E5 |. C705 80B40010 010>MOV DWORD PTR DS:[1000B480],1 100028EF |. 33C0 XOR EAX,EAX 100028F1 |> 59 POP ECX ; kernel32.7C816FD7 100028F2 |. 5D POP EBP ; kernel32.7C816FD7 100028F3 |> 5F POP EDI ; kernel32.7C816FD7 100028F4 |. 5E POP ESI ; kernel32.7C816FD7 100028F5 |. 5B POP EBX ; kernel32.7C816FD7 100028F6 |. C3 RETN 100028F7 |> FF35 ACAC0010 PUSH DWORD PTR DS:[1000ACAC] 100028FD |. E8 FBF9FFFF CALL jagmisc.100022FD 10002902 |. 891D ACAC0010 MOV DWORD PTR DS:[1000ACAC],EBX 10002908 |. 83C8 FF OR EAX,FFFFFFFF 1000290B \.^ EB E4 JMP SHORT jagmisc.100028F1 1000290D /$ 55 PUSH EBP 1000290E |. 8BEC MOV EBP,ESP 10002910 |. 51 PUSH ECX 10002911 |. 53 PUSH EBX 10002912 |. 8B5D 0C MOV EBX,[ARG.2] 10002915 |. 33D2 XOR EDX,EDX 10002917 |. 3955 08 CMP [ARG.1],EDX 1000291A |. 57 PUSH EDI 1000291B |. 8916 MOV DWORD PTR DS:[ESI],EDX 1000291D |. 8BF9 MOV EDI,ECX 1000291F |. C703 01000000 MOV DWORD PTR DS:[EBX],1 10002925 |. 74 09 JE SHORT jagmisc.10002930 10002927 |. 8B4D 08 MOV ECX,[ARG.1] 1000292A |. 8345 08 04 ADD [ARG.1],4 1000292E |. 8939 MOV DWORD PTR DS:[ECX],EDI 10002930 |> 8038 22 /CMP BYTE PTR DS:[EAX],22 10002933 |. 75 0E |JNZ SHORT jagmisc.10002943 10002935 |. 33C9 |XOR ECX,ECX 10002937 |. 85D2 |TEST EDX,EDX 10002939 |. 0F94C1 |SETE CL 1000293C |. 40 |INC EAX 1000293D |. 8BD1 |MOV EDX,ECX 1000293F |. B1 22 |MOV CL,22 10002941 |. EB 2D |JMP SHORT jagmisc.10002970 10002943 |> FF06 |INC DWORD PTR DS:[ESI] 10002945 |. 85FF |TEST EDI,EDI 10002947 |. 74 05 |JE SHORT jagmisc.1000294E 10002949 |. 8A08 |MOV CL,BYTE PTR DS:[EAX] 1000294B |. 880F |MOV BYTE PTR DS:[EDI],CL 1000294D |. 47 |INC EDI 1000294E |> 8A08 |MOV CL,BYTE PTR DS:[EAX] 10002950 |. 0FB6D9 |MOVZX EBX,CL 10002953 |. 40 |INC EAX 10002954 |. F683 41B10010 04 |TEST BYTE PTR DS:[EBX+1000B141],4 1000295B |. 74 0C |JE SHORT jagmisc.10002969 1000295D |. FF06 |INC DWORD PTR DS:[ESI] 1000295F |. 85FF |TEST EDI,EDI 10002961 |. 74 05 |JE SHORT jagmisc.10002968 10002963 |. 8A18 |MOV BL,BYTE PTR DS:[EAX] 10002965 |. 881F |MOV BYTE PTR DS:[EDI],BL 10002967 |. 47 |INC EDI 10002968 |> 40 |INC EAX 10002969 |> 84C9 |TEST CL,CL 1000296B |. 8B5D 0C |MOV EBX,[ARG.2] 1000296E |. 74 32 |JE SHORT jagmisc.100029A2 10002970 |> 85D2 |TEST EDX,EDX 10002972 |.^ 75 BC |JNZ SHORT jagmisc.10002930 10002974 |. 80F9 20 |CMP CL,20 10002977 |. 74 05 |JE SHORT jagmisc.1000297E 10002979 |. 80F9 09 |CMP CL,9 1000297C |.^ 75 B2 \JNZ SHORT jagmisc.10002930 1000297E |> 85FF TEST EDI,EDI 10002980 |. 74 04 JE SHORT jagmisc.10002986 10002982 |. C647 FF 00 MOV BYTE PTR DS:[EDI-1],0 10002986 |> 8365 FC 00 AND [LOCAL.1],0 1000298A |> 8038 00 CMP BYTE PTR DS:[EAX],0 1000298D |. 0F84 D6000000 JE jagmisc.10002A69 10002993 |> 8A08 /MOV CL,BYTE PTR DS:[EAX] 10002995 |. 80F9 20 |CMP CL,20 10002998 |. 74 05 |JE SHORT jagmisc.1000299F 1000299A |. 80F9 09 |CMP CL,9 1000299D |. 75 06 |JNZ SHORT jagmisc.100029A5 1000299F |> 40 |INC EAX 100029A0 |.^ EB F1 \JMP SHORT jagmisc.10002993 100029A2 |> 48 DEC EAX 100029A3 |.^ EB E1 JMP SHORT jagmisc.10002986 100029A5 |> 8038 00 CMP BYTE PTR DS:[EAX],0 100029A8 |. 0F84 BB000000 JE jagmisc.10002A69 100029AE |. 837D 08 00 CMP [ARG.1],0 100029B2 |. 74 09 JE SHORT jagmisc.100029BD 100029B4 |. 8B4D 08 MOV ECX,[ARG.1] 100029B7 |. 8345 08 04 ADD [ARG.1],4 100029BB |. 8939 MOV DWORD PTR DS:[ECX],EDI 100029BD |> FF03 INC DWORD PTR DS:[EBX] 100029BF |> 33DB /XOR EBX,EBX 100029C1 |. 43 |INC EBX 100029C2 |. 33D2 |XOR EDX,EDX 100029C4 |. EB 02 |JMP SHORT jagmisc.100029C8 100029C6 |> 40 |/INC EAX 100029C7 |. 42 ||INC EDX 100029C8 |> 8038 5C | CMP BYTE PTR DS:[EAX],5C 100029CB |.^ 74 F9 |\JE SHORT jagmisc.100029C6 100029CD |. 8038 22 |CMP BYTE PTR DS:[EAX],22 100029D0 |. 75 26 |JNZ SHORT jagmisc.100029F8 100029D2 |. F6C2 01 |TEST DL,1 100029D5 |. 75 1F |JNZ SHORT jagmisc.100029F6 100029D7 |. 837D FC 00 |CMP [LOCAL.1],0 100029DB |. 74 0C |JE SHORT jagmisc.100029E9 100029DD |. 8D48 01 |LEA ECX,DWORD PTR DS:[EAX+1] 100029E0 |. 8039 22 |CMP BYTE PTR DS:[ECX],22 100029E3 |. 75 04 |JNZ SHORT jagmisc.100029E9 100029E5 |. 8BC1 |MOV EAX,ECX 100029E7 |. EB 02 |JMP SHORT jagmisc.100029EB 100029E9 |> 33DB |XOR EBX,EBX 100029EB |> 33C9 |XOR ECX,ECX 100029ED |. 394D FC |CMP [LOCAL.1],ECX 100029F0 |. 0F94C1 |SETE CL 100029F3 |. 894D FC |MOV [LOCAL.1],ECX 100029F6 |> D1EA |SHR EDX,1 100029F8 |> 85D2 |TEST EDX,EDX 100029FA |. 74 0D |JE SHORT jagmisc.10002A09 100029FC |> 85FF |/TEST EDI,EDI 100029FE |. 74 04 ||JE SHORT jagmisc.10002A04 10002A00 |. C607 5C ||MOV BYTE PTR DS:[EDI],5C 10002A03 |. 47 ||INC EDI 10002A04 |> FF06 ||INC DWORD PTR DS:[ESI] 10002A06 |. 4A ||DEC EDX 10002A07 |.^ 75 F3 |\JNZ SHORT jagmisc.100029FC 10002A09 |> 8A08 |MOV CL,BYTE PTR DS:[EAX] 10002A0B |. 84C9 |TEST CL,CL 10002A0D |. 74 48 |JE SHORT jagmisc.10002A57 10002A0F |. 837D FC 00 |CMP [LOCAL.1],0 10002A13 |. 75 0A |JNZ SHORT jagmisc.10002A1F 10002A15 |. 80F9 20 |CMP CL,20 10002A18 |. 74 3D |JE SHORT jagmisc.10002A57 10002A1A |. 80F9 09 |CMP CL,9 10002A1D |. 74 38 |JE SHORT jagmisc.10002A57 10002A1F |> 85DB |TEST EBX,EBX 10002A21 |. 74 2E |JE SHORT jagmisc.10002A51 10002A23 |. 85FF |TEST EDI,EDI 10002A25 |. 74 19 |JE SHORT jagmisc.10002A40 10002A27 |. 0FB6D1 |MOVZX EDX,CL 10002A2A |. F682 41B10010 04 |TEST BYTE PTR DS:[EDX+1000B141],4 10002A31 |. 74 06 |JE SHORT jagmisc.10002A39 10002A33 |. 880F |MOV BYTE PTR DS:[EDI],CL 10002A35 |. 47 |INC EDI 10002A36 |. 40 |INC EAX 10002A37 |. FF06 |INC DWORD PTR DS:[ESI] 10002A39 |> 8A08 |MOV CL,BYTE PTR DS:[EAX] 10002A3B |. 880F |MOV BYTE PTR DS:[EDI],CL 10002A3D |. 47 |INC EDI 10002A3E |. EB 0F |JMP SHORT jagmisc.10002A4F 10002A40 |> 0FB6C9 |MOVZX ECX,CL 10002A43 |. F681 41B10010 04 |TEST BYTE PTR DS:[ECX+1000B141],4 10002A4A |. 74 03 |JE SHORT jagmisc.10002A4F 10002A4C |. 40 |INC EAX 10002A4D |. FF06 |INC DWORD PTR DS:[ESI] 10002A4F |> FF06 |INC DWORD PTR DS:[ESI] 10002A51 |> 40 |INC EAX 10002A52 |.^ E9 68FFFFFF \JMP jagmisc.100029BF 10002A57 |> 85FF TEST EDI,EDI 10002A59 |. 74 04 JE SHORT jagmisc.10002A5F 10002A5B |. C607 00 MOV BYTE PTR DS:[EDI],0 10002A5E |. 47 INC EDI 10002A5F |> FF06 INC DWORD PTR DS:[ESI] 10002A61 |. 8B5D 0C MOV EBX,[ARG.2] 10002A64 |.^ E9 21FFFFFF JMP jagmisc.1000298A 10002A69 |> 8B45 08 MOV EAX,[ARG.1] 10002A6C |. 85C0 TEST EAX,EAX 10002A6E |. 74 03 JE SHORT jagmisc.10002A73 10002A70 |. 8320 00 AND DWORD PTR DS:[EAX],0 10002A73 |> FF03 INC DWORD PTR DS:[EBX] 10002A75 |. 5F POP EDI ; kernel32.7C816FD7 10002A76 |. 5B POP EBX ; kernel32.7C816FD7 10002A77 |. C9 LEAVE 10002A78 \. C3 RETN 10002A79 /$ 55 PUSH EBP 10002A7A |. 8BEC MOV EBP,ESP 10002A7C |. 51 PUSH ECX 10002A7D |. 51 PUSH ECX 10002A7E |. 53 PUSH EBX 10002A7F |. 56 PUSH ESI 10002A80 |. 57 PUSH EDI 10002A81 |. 33FF XOR EDI,EDI 10002A83 |. 393D 8CB40010 CMP DWORD PTR DS:[1000B48C],EDI 10002A89 |. 75 05 JNZ SHORT jagmisc.10002A90 10002A8B |. E8 651A0000 CALL jagmisc.100044F5 10002A90 |> 68 04010000 PUSH 104 ; /BufSize = 104 (260.) 10002A95 |. BE D0AC0010 MOV ESI,jagmisc.1000ACD0 ; |ASCII "C:\\Documents and Settings\\Mike\\Desktop\\odbg110\\LOADDLL.EXE" 10002A9A |. 56 PUSH ESI ; |PathBuffer = NULL 10002A9B |. 57 PUSH EDI ; |hModule = NULL 10002A9C |. C605 D4AD0010 00 MOV BYTE PTR DS:[1000ADD4],0 ; | 10002AA3 |. FF15 94800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleFileNameA>] ; \GetModuleFileNameA 10002AA9 |. A1 90B40010 MOV EAX,DWORD PTR DS:[1000B490] 10002AAE |. 3BC7 CMP EAX,EDI 10002AB0 |. 8935 BCAC0010 MOV DWORD PTR DS:[1000ACBC],ESI 10002AB6 |. 74 07 JE SHORT jagmisc.10002ABF 10002AB8 |. 8038 00 CMP BYTE PTR DS:[EAX],0 10002ABB |. 8BD8 MOV EBX,EAX 10002ABD |. 75 02 JNZ SHORT jagmisc.10002AC1 10002ABF |> 8BDE MOV EBX,ESI 10002AC1 |> 8D45 FC LEA EAX,[LOCAL.1] 10002AC4 |. 50 PUSH EAX 10002AC5 |. 57 PUSH EDI 10002AC6 |. 8D75 F8 LEA ESI,[LOCAL.2] 10002AC9 |. 33C9 XOR ECX,ECX 10002ACB |. 8BC3 MOV EAX,EBX 10002ACD |. E8 3BFEFFFF CALL jagmisc.1000290D 10002AD2 |. 8B75 FC MOV ESI,[LOCAL.1] 10002AD5 |. 8B45 F8 MOV EAX,[LOCAL.2] ; LOADDLL.00410249 10002AD8 |. C1E6 02 SHL ESI,2 10002ADB |. 03C6 ADD EAX,ESI 10002ADD |. 50 PUSH EAX 10002ADE |. E8 B92A0000 CALL jagmisc.1000559C 10002AE3 |. 8BF8 MOV EDI,EAX 10002AE5 |. 83C4 0C ADD ESP,0C 10002AE8 |. 85FF TEST EDI,EDI 10002AEA |. 75 05 JNZ SHORT jagmisc.10002AF1 10002AEC |. 83C8 FF OR EAX,FFFFFFFF 10002AEF |. EB 25 JMP SHORT jagmisc.10002B16 10002AF1 |> 8D45 FC LEA EAX,[LOCAL.1] 10002AF4 |. 50 PUSH EAX 10002AF5 |. 8D0C3E LEA ECX,DWORD PTR DS:[ESI+EDI] 10002AF8 |. 57 PUSH EDI 10002AF9 |. 8D75 F8 LEA ESI,[LOCAL.2] 10002AFC |. 8BC3 MOV EAX,EBX 10002AFE |. E8 0AFEFFFF CALL jagmisc.1000290D 10002B03 |. 8B45 FC MOV EAX,[LOCAL.1] 10002B06 |. 48 DEC EAX 10002B07 |. 59 POP ECX ; kernel32.7C816FD7 10002B08 |. A3 A0AC0010 MOV DWORD PTR DS:[1000ACA0],EAX 10002B0D |. 59 POP ECX ; kernel32.7C816FD7 10002B0E |. 893D A4AC0010 MOV DWORD PTR DS:[1000ACA4],EDI 10002B14 |. 33C0 XOR EAX,EAX 10002B16 |> 5F POP EDI ; kernel32.7C816FD7 10002B17 |. 5E POP ESI ; kernel32.7C816FD7 10002B18 |. 5B POP EBX ; kernel32.7C816FD7 10002B19 |. C9 LEAVE 10002B1A \. C3 RETN 10002B1B /$ 51 PUSH ECX 10002B1C |. 51 PUSH ECX 10002B1D |. A1 D8AD0010 MOV EAX,DWORD PTR DS:[1000ADD8] 10002B22 |. 53 PUSH EBX 10002B23 |. 55 PUSH EBP 10002B24 |. 56 PUSH ESI 10002B25 |. 57 PUSH EDI 10002B26 |. 8B3D A8800010 MOV EDI,DWORD PTR DS:[<&KERNEL32.GetEnvironmentStringsW>] ; kernel32.GetEnvironmentStringsW 10002B2C |. 33DB XOR EBX,EBX 10002B2E |. 33F6 XOR ESI,ESI 10002B30 |. 3BC3 CMP EAX,EBX 10002B32 |. 6A 02 PUSH 2 10002B34 |. 5D POP EBP ; kernel32.7C816FD7 10002B35 |. 75 2D JNZ SHORT jagmisc.10002B64 10002B37 |. FFD7 CALL EDI ; [GetEnvironmentStringsW 10002B39 |. 8BF0 MOV ESI,EAX 10002B3B |. 3BF3 CMP ESI,EBX 10002B3D |. 74 0C JE SHORT jagmisc.10002B4B 10002B3F |. C705 D8AD0010 010>MOV DWORD PTR DS:[1000ADD8],1 10002B49 |. EB 1E JMP SHORT jagmisc.10002B69 10002B4B |> FF15 38800010 CALL DWORD PTR DS:[<&KERNEL32.GetLastError>] ; [GetLastError 10002B51 |. 83F8 78 CMP EAX,78 10002B54 |. 75 09 JNZ SHORT jagmisc.10002B5F 10002B56 |. 8BC5 MOV EAX,EBP 10002B58 |. A3 D8AD0010 MOV DWORD PTR DS:[1000ADD8],EAX 10002B5D |. EB 05 JMP SHORT jagmisc.10002B64 10002B5F |> A1 D8AD0010 MOV EAX,DWORD PTR DS:[1000ADD8] 10002B64 |> 83F8 01 CMP EAX,1 10002B67 |. 75 7D JNZ SHORT jagmisc.10002BE6 10002B69 |> 3BF3 CMP ESI,EBX 10002B6B |. 75 08 JNZ SHORT jagmisc.10002B75 10002B6D |. FFD7 CALL EDI 10002B6F |. 8BF0 MOV ESI,EAX 10002B71 |. 3BF3 CMP ESI,EBX 10002B73 |. 74 79 JE SHORT jagmisc.10002BEE 10002B75 |> 66:391E CMP WORD PTR DS:[ESI],BX 10002B78 |. 8BC6 MOV EAX,ESI 10002B7A |. 74 0E JE SHORT jagmisc.10002B8A 10002B7C |> 03C5 /ADD EAX,EBP 10002B7E |. 66:3918 |CMP WORD PTR DS:[EAX],BX 10002B81 |.^ 75 F9 |JNZ SHORT jagmisc.10002B7C 10002B83 |. 03C5 |ADD EAX,EBP 10002B85 |. 66:3918 |CMP WORD PTR DS:[EAX],BX 10002B88 |.^ 75 F2 \JNZ SHORT jagmisc.10002B7C 10002B8A |> 8B3D A4800010 MOV EDI,DWORD PTR DS:[<&KERNEL32.WideCharToMultiByte>] ; kernel32.WideCharToMultiByte 10002B90 |. 53 PUSH EBX ; /pDefaultCharUsed = NULL 10002B91 |. 53 PUSH EBX ; |pDefaultChar = NULL 10002B92 |. 53 PUSH EBX ; |MultiByteCount = 0 10002B93 |. 2BC6 SUB EAX,ESI ; | 10002B95 |. 53 PUSH EBX ; |MultiByteStr = NULL 10002B96 |. D1F8 SAR EAX,1 ; | 10002B98 |. 40 INC EAX ; | 10002B99 |. 50 PUSH EAX ; |WideCharCount = 8 10002B9A |. 56 PUSH ESI ; |WideCharStr = NULL 10002B9B |. 53 PUSH EBX ; |Options = 0 10002B9C |. 53 PUSH EBX ; |CodePage = CP_ACP 10002B9D |. 894424 34 MOV DWORD PTR SS:[ESP+34],EAX ; | 10002BA1 |. FFD7 CALL EDI ; \WideCharToMultiByte 10002BA3 |. 8BE8 MOV EBP,EAX 10002BA5 |. 3BEB CMP EBP,EBX 10002BA7 |. 74 32 JE SHORT jagmisc.10002BDB 10002BA9 |. 55 PUSH EBP 10002BAA |. E8 ED290000 CALL jagmisc.1000559C 10002BAF |. 3BC3 CMP EAX,EBX 10002BB1 |. 59 POP ECX ; kernel32.7C816FD7 10002BB2 |. 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 10002BB6 |. 74 23 JE SHORT jagmisc.10002BDB 10002BB8 |. 53 PUSH EBX 10002BB9 |. 53 PUSH EBX 10002BBA |. 55 PUSH EBP 10002BBB |. 50 PUSH EAX 10002BBC |. FF7424 24 PUSH DWORD PTR SS:[ESP+24] ; kernel32.7C816FE0 10002BC0 |. 56 PUSH ESI 10002BC1 |. 53 PUSH EBX 10002BC2 |. 53 PUSH EBX 10002BC3 |. FFD7 CALL EDI 10002BC5 |. 85C0 TEST EAX,EAX 10002BC7 |. 75 0E JNZ SHORT jagmisc.10002BD7 10002BC9 |. FF7424 10 PUSH DWORD PTR SS:[ESP+10] 10002BCD |. E8 2BF7FFFF CALL jagmisc.100022FD 10002BD2 |. 59 POP ECX ; kernel32.7C816FD7 10002BD3 |. 895C24 10 MOV DWORD PTR SS:[ESP+10],EBX 10002BD7 |> 8B5C24 10 MOV EBX,DWORD PTR SS:[ESP+10] 10002BDB |> 56 PUSH ESI ; /EnvironmentBlock = NULL 10002BDC |. FF15 A0800010 CALL DWORD PTR DS:[<&KERNEL32.FreeEnvironmentStringsW>] ; \FreeEnvironmentStringsW 10002BE2 |. 8BC3 MOV EAX,EBX 10002BE4 |. EB 50 JMP SHORT jagmisc.10002C36 10002BE6 |> 3BC5 CMP EAX,EBP 10002BE8 |. 74 08 JE SHORT jagmisc.10002BF2 10002BEA |. 3BC3 CMP EAX,EBX 10002BEC |. 74 04 JE SHORT jagmisc.10002BF2 10002BEE |> 33C0 XOR EAX,EAX 10002BF0 |. EB 44 JMP SHORT jagmisc.10002C36 10002BF2 |> FF15 9C800010 CALL DWORD PTR DS:[<&KERNEL32.GetEnvironmentStrings>] ; [GetEnvironmentStrings 10002BF8 |. 8BF0 MOV ESI,EAX 10002BFA |. 3BF3 CMP ESI,EBX 10002BFC |.^ 74 F0 JE SHORT jagmisc.10002BEE 10002BFE |. 381E CMP BYTE PTR DS:[ESI],BL 10002C00 |. 74 0A JE SHORT jagmisc.10002C0C 10002C02 |> 40 /INC EAX 10002C03 |. 3818 |CMP BYTE PTR DS:[EAX],BL 10002C05 |.^ 75 FB |JNZ SHORT jagmisc.10002C02 10002C07 |. 40 |INC EAX 10002C08 |. 3818 |CMP BYTE PTR DS:[EAX],BL 10002C0A |.^ 75 F6 \JNZ SHORT jagmisc.10002C02 10002C0C |> 2BC6 SUB EAX,ESI 10002C0E |. 40 INC EAX 10002C0F |. 8BE8 MOV EBP,EAX 10002C11 |. 55 PUSH EBP 10002C12 |. E8 85290000 CALL jagmisc.1000559C 10002C17 |. 8BF8 MOV EDI,EAX 10002C19 |. 3BFB CMP EDI,EBX 10002C1B |. 59 POP ECX ; kernel32.7C816FD7 10002C1C |. 75 04 JNZ SHORT jagmisc.10002C22 10002C1E |. 33FF XOR EDI,EDI 10002C20 |. EB 0B JMP SHORT jagmisc.10002C2D 10002C22 |> 55 PUSH EBP 10002C23 |. 56 PUSH ESI 10002C24 |. 57 PUSH EDI 10002C25 |. E8 86290000 CALL jagmisc.100055B0 10002C2A |. 83C4 0C ADD ESP,0C 10002C2D |> 56 PUSH ESI ; /EnvironmentBlock = NULL 10002C2E |. FF15 98800010 CALL DWORD PTR DS:[<&KERNEL32.FreeEnvironmentStringsA>] ; \FreeEnvironmentStringsA 10002C34 |. 8BC7 MOV EAX,EDI 10002C36 |> 5F POP EDI ; kernel32.7C816FD7 10002C37 |. 5E POP ESI ; kernel32.7C816FD7 10002C38 |. 5D POP EBP ; kernel32.7C816FD7 10002C39 |. 5B POP EBX ; kernel32.7C816FD7 10002C3A |. 59 POP ECX ; kernel32.7C816FD7 10002C3B |. 59 POP ECX ; kernel32.7C816FD7 10002C3C \. C3 RETN 10002C3D $ 6A 0C PUSH 0C 10002C3F . 68 58820010 PUSH jagmisc.10008258 10002C44 . E8 27F7FFFF CALL jagmisc.10002370 10002C49 . C745 E4 6C920010 MOV DWORD PTR SS:[EBP-1C],jagmisc.1000926C 10002C50 > 817D E4 6C920010 CMP DWORD PTR SS:[EBP-1C],jagmisc.1000926C 10002C57 . 73 22 JNB SHORT jagmisc.10002C7B 10002C59 . 8365 FC 00 AND DWORD PTR SS:[EBP-4],0 10002C5D . 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C] 10002C60 . 8B00 MOV EAX,DWORD PTR DS:[EAX] 10002C62 . 85C0 TEST EAX,EAX 10002C64 . 74 0B JE SHORT jagmisc.10002C71 10002C66 . FFD0 CALL EAX 10002C68 . EB 07 JMP SHORT jagmisc.10002C71 10002C6A . 33C0 XOR EAX,EAX 10002C6C . 40 INC EAX 10002C6D . C3 RETN 10002C6E . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451 10002C71 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10002C75 . 8345 E4 04 ADD DWORD PTR SS:[EBP-1C],4 10002C79 .^ EB D5 JMP SHORT jagmisc.10002C50 10002C7B > E8 2BF7FFFF CALL jagmisc.100023AB 10002C80 . C3 RETN 10002C81 . 6A 0C PUSH 0C 10002C83 . 68 68820010 PUSH jagmisc.10008268 10002C88 . E8 E3F6FFFF CALL jagmisc.10002370 10002C8D . C745 E4 74920010 MOV DWORD PTR SS:[EBP-1C],jagmisc.10009274 10002C94 > 817D E4 74920010 CMP DWORD PTR SS:[EBP-1C],jagmisc.10009274 10002C9B . 73 22 JNB SHORT jagmisc.10002CBF 10002C9D . 8365 FC 00 AND DWORD PTR SS:[EBP-4],0 10002CA1 . 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C] 10002CA4 . 8B00 MOV EAX,DWORD PTR DS:[EAX] 10002CA6 . 85C0 TEST EAX,EAX 10002CA8 . 74 0B JE SHORT jagmisc.10002CB5 10002CAA . FFD0 CALL EAX 10002CAC . EB 07 JMP SHORT jagmisc.10002CB5 10002CAE . 33C0 XOR EAX,EAX 10002CB0 . 40 INC EAX 10002CB1 . C3 RETN 10002CB2 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451 10002CB5 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10002CB9 . 8345 E4 04 ADD DWORD PTR SS:[EBP-1C],4 10002CBD .^ EB D5 JMP SHORT jagmisc.10002C94 10002CBF > E8 E7F6FFFF CALL jagmisc.100023AB 10002CC4 . C3 RETN 10002CC5 /$ 833D 8CAC0010 02 CMP DWORD PTR DS:[1000AC8C],2 10002CCC |. 75 0D JNZ SHORT jagmisc.10002CDB 10002CCE |. 833D 98AC0010 05 CMP DWORD PTR DS:[1000AC98],5 10002CD5 |. 72 04 JB SHORT jagmisc.10002CDB 10002CD7 |. 33C0 XOR EAX,EAX 10002CD9 |. 40 INC EAX 10002CDA |. C3 RETN 10002CDB |> 6A 03 PUSH 3 10002CDD |. 58 POP EAX ; kernel32.7C816FD7 10002CDE \. C3 RETN 10002CDF /$ 33C0 XOR EAX,EAX 10002CE1 |. 394424 04 CMP DWORD PTR SS:[ESP+4],EAX 10002CE5 |. 6A 00 PUSH 0 ; /MaximumSize = 0 10002CE7 |. 0F94C0 SETE AL ; | 10002CEA |. 68 00100000 PUSH 1000 ; |InitialSize = 1000 (4096.) 10002CEF |. 50 PUSH EAX ; |Flags = HEAP_ZERO_MEMORY 10002CF0 |. FF15 B0800010 CALL DWORD PTR DS:[<&KERNEL32.HeapCreate>] ; \HeapCreate 10002CF6 |. 85C0 TEST EAX,EAX 10002CF8 |. A3 60B30010 MOV DWORD PTR DS:[1000B360],EAX 10002CFD |. 74 2A JE SHORT jagmisc.10002D29 10002CFF |. E8 C1FFFFFF CALL jagmisc.10002CC5 10002D04 |. 83F8 03 CMP EAX,3 10002D07 |. A3 64B30010 MOV DWORD PTR DS:[1000B364],EAX 10002D0C |. 75 1E JNZ SHORT jagmisc.10002D2C 10002D0E |. 68 F8030000 PUSH 3F8 10002D13 |. E8 ED180000 CALL jagmisc.10004605 10002D18 |. 85C0 TEST EAX,EAX 10002D1A |. 59 POP ECX ; kernel32.7C816FD7 10002D1B |. 75 0F JNZ SHORT jagmisc.10002D2C 10002D1D |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; /hHeap = 00390000 10002D23 |. FF15 AC800010 CALL DWORD PTR DS:[<&KERNEL32.HeapDestroy>] ; \HeapDestroy 10002D29 |> 33C0 XOR EAX,EAX 10002D2B |. C3 RETN 10002D2C |> 33C0 XOR EAX,EAX 10002D2E |. 40 INC EAX 10002D2F \. C3 RETN 10002D30 /$ 833D 64B30010 03 CMP DWORD PTR DS:[1000B364],3 10002D37 |. 75 69 JNZ SHORT jagmisc.10002DA2 10002D39 |. 53 PUSH EBX 10002D3A |. 33DB XOR EBX,EBX 10002D3C |. 391D 1CB10010 CMP DWORD PTR DS:[1000B11C],EBX 10002D42 |. 55 PUSH EBP 10002D43 |. 8B2D 7C800010 MOV EBP,DWORD PTR DS:[<&KERNEL32.HeapFree>] ; ntdll.RtlFreeHeap 10002D49 |. 7E 45 JLE SHORT jagmisc.10002D90 10002D4B |. 56 PUSH ESI 10002D4C |. 8B35 20B10010 MOV ESI,DWORD PTR DS:[1000B120] 10002D52 |. 57 PUSH EDI 10002D53 |. 8B3D B4800010 MOV EDI,DWORD PTR DS:[<&KERNEL32.VirtualFree>] ; kernel32.VirtualFree 10002D59 |. 83C6 0C ADD ESI,0C 10002D5C |> 68 00400000 /PUSH 4000 10002D61 |. 68 00001000 |PUSH 100000 10002D66 |. FF36 |PUSH DWORD PTR DS:[ESI] 10002D68 |. FFD7 |CALL EDI 10002D6A |. 68 00800000 |PUSH 8000 10002D6F |. 6A 00 |PUSH 0 10002D71 |. FF36 |PUSH DWORD PTR DS:[ESI] 10002D73 |. FFD7 |CALL EDI 10002D75 |. FF76 04 |PUSH DWORD PTR DS:[ESI+4] 10002D78 |. 6A 00 |PUSH 0 10002D7A |. FF35 60B30010 |PUSH DWORD PTR DS:[1000B360] 10002D80 |. FFD5 |CALL EBP 10002D82 |. 83C6 14 |ADD ESI,14 10002D85 |. 43 |INC EBX 10002D86 |. 3B1D 1CB10010 |CMP EBX,DWORD PTR DS:[1000B11C] 10002D8C |.^ 7C CE \JL SHORT jagmisc.10002D5C 10002D8E |. 5F POP EDI ; kernel32.7C816FD7 10002D8F |. 5E POP ESI ; kernel32.7C816FD7 10002D90 |> FF35 20B10010 PUSH DWORD PTR DS:[1000B120] 10002D96 |. 6A 00 PUSH 0 10002D98 |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] 10002D9E |. FFD5 CALL EBP 10002DA0 |. 5D POP EBP ; kernel32.7C816FD7 10002DA1 |. 5B POP EBX ; kernel32.7C816FD7 10002DA2 |> FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; /hHeap = 00390000 10002DA8 |. FF15 AC800010 CALL DWORD PTR DS:[<&KERNEL32.HeapDestroy>] ; \HeapDestroy 10002DAE \. C3 RETN 10002DAF CC INT3 10002DB0 /$ 3D 00100000 CMP EAX,1000 10002DB5 |. 73 0E JNB SHORT jagmisc.10002DC5 10002DB7 |. F7D8 NEG EAX 10002DB9 |. 03C4 ADD EAX,ESP 10002DBB |. 83C0 04 ADD EAX,4 10002DBE |. 8500 TEST DWORD PTR DS:[EAX],EAX 10002DC0 |. 94 XCHG EAX,ESP 10002DC1 |. 8B00 MOV EAX,DWORD PTR DS:[EAX] 10002DC3 |. 50 PUSH EAX 10002DC4 |. C3 RETN 10002DC5 |> 51 PUSH ECX 10002DC6 |. 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8] 10002DCA |> 81E9 00100000 SUB ECX,1000 10002DD0 |. 2D 00100000 SUB EAX,1000 10002DD5 |. 8501 TEST DWORD PTR DS:[ECX],EAX 10002DD7 |. 3D 00100000 CMP EAX,1000 10002DDC |.^ 73 EC JNB SHORT jagmisc.10002DCA 10002DDE |. 2BC8 SUB ECX,EAX 10002DE0 |. 8BC4 MOV EAX,ESP 10002DE2 |. 8501 TEST DWORD PTR DS:[ECX],EAX 10002DE4 |. 8BE1 MOV ESP,ECX 10002DE6 |. 8B08 MOV ECX,DWORD PTR DS:[EAX] 10002DE8 |. 8B40 04 MOV EAX,DWORD PTR DS:[EAX+4] 10002DEB |. 50 PUSH EAX 10002DEC \. C3 RETN 10002DED /$ 55 PUSH EBP 10002DEE |. 8DAC24 74FFFFFF LEA EBP,DWORD PTR SS:[ESP-8C] 10002DF5 |. 81EC 0C010000 SUB ESP,10C 10002DFB |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 10002E00 |. 8B8D 94000000 MOV ECX,DWORD PTR SS:[EBP+94] 10002E06 |. 53 PUSH EBX 10002E07 |. 56 PUSH ESI 10002E08 |. 8985 88000000 MOV DWORD PTR SS:[EBP+88],EAX 10002E0E |. 33D2 XOR EDX,EDX 10002E10 |. 57 PUSH EDI 10002E11 |. 33C0 XOR EAX,EAX 10002E13 |> 3B0CC5 80A20010 /CMP ECX,DWORD PTR DS:[EAX*8+1000A280] 10002E1A |. 74 06 |JE SHORT jagmisc.10002E22 10002E1C |. 40 |INC EAX 10002E1D |. 83F8 13 |CMP EAX,13 10002E20 |.^ 72 F1 \JB SHORT jagmisc.10002E13 10002E22 |> 8BF0 MOV ESI,EAX 10002E24 |. C1E6 03 SHL ESI,3 10002E27 |. 3B8E 80A20010 CMP ECX,DWORD PTR DS:[ESI+1000A280] 10002E2D |. 0F85 15010000 JNZ jagmisc.10002F48 10002E33 |. A1 70AC0010 MOV EAX,DWORD PTR DS:[1000AC70] 10002E38 |. 83F8 01 CMP EAX,1 10002E3B |. 0F84 DF000000 JE jagmisc.10002F20 10002E41 |. 3BC2 CMP EAX,EDX 10002E43 |. 75 0D JNZ SHORT jagmisc.10002E52 10002E45 |. 833D 74AC0010 01 CMP DWORD PTR DS:[1000AC74],1 10002E4C |. 0F84 CE000000 JE jagmisc.10002F20 10002E52 |> 81F9 FC000000 CMP ECX,0FC 10002E58 |. 0F84 EA000000 JE jagmisc.10002F48 10002E5E |. 68 04010000 PUSH 104 ; /BufSize = 104 (260.) 10002E63 |. 8D45 80 LEA EAX,[LOCAL.32] ; | 10002E66 |. 50 PUSH EAX ; |PathBuffer = 00000008 10002E67 |. 52 PUSH EDX ; |hModule = NULL 10002E68 |. 8895 84000000 MOV BYTE PTR SS:[EBP+84],DL ; | 10002E6E |. FF15 94800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleFileNameA>] ; \GetModuleFileNameA 10002E74 |. 85C0 TEST EAX,EAX 10002E76 |. 75 10 JNZ SHORT jagmisc.10002E88 10002E78 |. 8D45 80 LEA EAX,[LOCAL.32] 10002E7B |. 68 64860010 PUSH jagmisc.10008664 ; ASCII "" 10002E80 |. 50 PUSH EAX 10002E81 |. E8 AA090000 CALL jagmisc.10003830 10002E86 |. 59 POP ECX ; kernel32.7C816FD7 10002E87 |. 59 POP ECX ; kernel32.7C816FD7 10002E88 |> 8D7D 80 LEA EDI,[LOCAL.32] 10002E8B |. 8BC7 MOV EAX,EDI 10002E8D |. 50 PUSH EAX 10002E8E |. E8 0D090000 CALL jagmisc.100037A0 10002E93 |. 40 INC EAX 10002E94 |. 83F8 3C CMP EAX,3C 10002E97 |. 59 POP ECX ; kernel32.7C816FD7 10002E98 |. 76 22 JBE SHORT jagmisc.10002EBC 10002E9A |. 8BC7 MOV EAX,EDI 10002E9C |. 50 PUSH EAX 10002E9D |. E8 FE080000 CALL jagmisc.100037A0 10002EA2 |. 8BF8 MOV EDI,EAX 10002EA4 |. 8D45 80 LEA EAX,[LOCAL.32] 10002EA7 |. 83E8 3B SUB EAX,3B 10002EAA |. 6A 03 PUSH 3 10002EAC |. 03F8 ADD EDI,EAX 10002EAE |. 68 60860010 PUSH jagmisc.10008660 ; ASCII "..." 10002EB3 |. 57 PUSH EDI 10002EB4 |. E8 372B0000 CALL jagmisc.100059F0 10002EB9 |. 83C4 10 ADD ESP,10 10002EBC |> 57 PUSH EDI 10002EBD |. E8 DE080000 CALL jagmisc.100037A0 10002EC2 |. FFB6 84A20010 PUSH DWORD PTR DS:[ESI+1000A284] ; jagmisc.100085F0 10002EC8 |. 8BD8 MOV EBX,EAX 10002ECA |. E8 D1080000 CALL jagmisc.100037A0 10002ECF |. 8D4403 1C LEA EAX,DWORD PTR DS:[EBX+EAX+1C] 10002ED3 |. 59 POP ECX ; kernel32.7C816FD7 10002ED4 |. 83C0 03 ADD EAX,3 10002ED7 |. 59 POP ECX ; kernel32.7C816FD7 10002ED8 |. 83E0 FC AND EAX,FFFFFFFC 10002EDB |. E8 D0FEFFFF CALL jagmisc.10002DB0 10002EE0 |. 8BDC MOV EBX,ESP 10002EE2 |. 68 44860010 PUSH jagmisc.10008644 ; ASCII "Runtime Error!\n\nProgram: " 10002EE7 |. 53 PUSH EBX 10002EE8 |. E8 43090000 CALL jagmisc.10003830 10002EED |. 57 PUSH EDI 10002EEE |. 53 PUSH EBX 10002EEF |. E8 4C090000 CALL jagmisc.10003840 10002EF4 |. 68 40860010 PUSH jagmisc.10008640 ; ASCII "\n\n" 10002EF9 |. 53 PUSH EBX 10002EFA |. E8 41090000 CALL jagmisc.10003840 10002EFF |. FFB6 84A20010 PUSH DWORD PTR DS:[ESI+1000A284] ; jagmisc.100085F0 10002F05 |. 53 PUSH EBX 10002F06 |. E8 35090000 CALL jagmisc.10003840 10002F0B |. 68 10200100 PUSH 12010 10002F10 |. 68 18860010 PUSH jagmisc.10008618 ; ASCII "Microsoft Visual C++ Runtime Library" 10002F15 |. 53 PUSH EBX 10002F16 |. E8 D2290000 CALL jagmisc.100058ED 10002F1B |. 83C4 2C ADD ESP,2C 10002F1E |. EB 28 JMP SHORT jagmisc.10002F48 10002F20 |> 52 PUSH EDX 10002F21 |. 8D85 94000000 LEA EAX,DWORD PTR SS:[EBP+94] 10002F27 |. 50 PUSH EAX 10002F28 |. 8DB6 84A20010 LEA ESI,DWORD PTR DS:[ESI+1000A284] 10002F2E |. FF36 PUSH DWORD PTR DS:[ESI] 10002F30 |. E8 6B080000 CALL jagmisc.100037A0 10002F35 |. 59 POP ECX ; |kernel32.7C816FD7 10002F36 |. 50 PUSH EAX ; |nBytesToWrite = 8 10002F37 |. FF36 PUSH DWORD PTR DS:[ESI] ; |Buffer 10002F39 |. 6A F4 PUSH -0C ; |/DevType = STD_ERROR_HANDLE 10002F3B |. FF15 88800010 CALL DWORD PTR DS:[<&KERNEL32.GetStdHandle>] ; |\GetStdHandle 10002F41 |. 50 PUSH EAX ; |hFile = 00000008 10002F42 |. FF15 B8800010 CALL DWORD PTR DS:[<&KERNEL32.WriteFile>] ; \WriteFile 10002F48 |> 8DA5 74FFFFFF LEA ESP,[LOCAL.35] 10002F4E |. 8B8D 88000000 MOV ECX,DWORD PTR SS:[EBP+88] 10002F54 |. E8 9D0B0000 CALL jagmisc.10003AF6 10002F59 |. 5F POP EDI ; kernel32.7C816FD7 10002F5A |. 5E POP ESI ; kernel32.7C816FD7 10002F5B |. 5B POP EBX ; kernel32.7C816FD7 10002F5C |. 81C5 8C000000 ADD EBP,8C 10002F62 |. C9 LEAVE 10002F63 \. C3 RETN 10002F64 /$ A1 70AC0010 MOV EAX,DWORD PTR DS:[1000AC70] 10002F69 |. 83F8 01 CMP EAX,1 10002F6C |. 74 0D JE SHORT jagmisc.10002F7B 10002F6E |. 85C0 TEST EAX,EAX 10002F70 |. 75 2A JNZ SHORT jagmisc.10002F9C 10002F72 |. 833D 74AC0010 01 CMP DWORD PTR DS:[1000AC74],1 10002F79 |. 75 21 JNZ SHORT jagmisc.10002F9C 10002F7B |> 68 FC000000 PUSH 0FC 10002F80 |. E8 68FEFFFF CALL jagmisc.10002DED 10002F85 |. A1 DCAD0010 MOV EAX,DWORD PTR DS:[1000ADDC] 10002F8A |. 85C0 TEST EAX,EAX 10002F8C |. 59 POP ECX ; kernel32.7C816FD7 10002F8D |. 74 02 JE SHORT jagmisc.10002F91 10002F8F |. FFD0 CALL EAX 10002F91 |> 68 FF000000 PUSH 0FF 10002F96 |. E8 52FEFFFF CALL jagmisc.10002DED 10002F9B |. 59 POP ECX ; kernel32.7C816FD7 10002F9C \> C3 RETN 10002F9D /$ E8 5FEDFFFF CALL jagmisc.10001D01 10002FA2 |. 8B40 64 MOV EAX,DWORD PTR DS:[EAX+64] 10002FA5 |. 3B05 ECA40010 CMP EAX,DWORD PTR DS:[1000A4EC] ; jagmisc.1000A498 10002FAB |. 74 05 JE SHORT jagmisc.10002FB2 10002FAD |. E8 44100000 CALL jagmisc.10003FF6 10002FB2 |> 8378 28 01 CMP DWORD PTR DS:[EAX+28],1 10002FB6 |. 7E 10 JLE SHORT jagmisc.10002FC8 10002FB8 |. 6A 04 PUSH 4 10002FBA |. FF7424 08 PUSH DWORD PTR SS:[ESP+8] 10002FBE |. 50 PUSH EAX 10002FBF |. E8 502B0000 CALL jagmisc.10005B14 10002FC4 |. 83C4 0C ADD ESP,0C 10002FC7 |. C3 RETN 10002FC8 |> 8B40 48 MOV EAX,DWORD PTR DS:[EAX+48] 10002FCB |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10002FCF |. 0FB60448 MOVZX EAX,BYTE PTR DS:[EAX+ECX*2] 10002FD3 |. 83E0 04 AND EAX,4 10002FD6 \. C3 RETN 10002FD7 /$ 55 PUSH EBP 10002FD8 |. 8BEC MOV EBP,ESP 10002FDA |. 51 PUSH ECX 10002FDB |. 53 PUSH EBX 10002FDC |. 8B5D 0C MOV EBX,[ARG.2] 10002FDF |. 56 PUSH ESI 10002FE0 |. 8B75 08 MOV ESI,[ARG.1] 10002FE3 |. 837E 14 00 CMP DWORD PTR DS:[ESI+14],0 10002FE7 |. 57 PUSH EDI 10002FE8 |. 0F84 9D000000 JE jagmisc.1000308B 10002FEE |. 837E 24 00 CMP DWORD PTR DS:[ESI+24],0 10002FF2 |. 74 09 JE SHORT jagmisc.10002FFD 10002FF4 |. 83FB 7F CMP EBX,7F 10002FF7 |. 0F86 8E000000 JBE jagmisc.1000308B 10002FFD |> 33FF XOR EDI,EDI 10002FFF |. 47 INC EDI 10003000 |. 81FB 00010000 CMP EBX,100 10003006 |. 73 1F JNB SHORT jagmisc.10003027 10003008 |. 397E 28 CMP DWORD PTR DS:[ESI+28],EDI 1000300B |. 7E 0D JLE SHORT jagmisc.1000301A 1000300D |. 57 PUSH EDI 1000300E |. 53 PUSH EBX 1000300F |. 56 PUSH ESI 10003010 |. E8 FF2A0000 CALL jagmisc.10005B14 10003015 |. 83C4 0C ADD ESP,0C 10003018 |. EB 09 JMP SHORT jagmisc.10003023 1000301A |> 8B46 48 MOV EAX,DWORD PTR DS:[ESI+48] 1000301D |. 0FB60458 MOVZX EAX,BYTE PTR DS:[EAX+EBX*2] 10003021 |. 23C7 AND EAX,EDI 10003023 |> 85C0 TEST EAX,EAX 10003025 |. 74 71 JE SHORT jagmisc.10003098 10003027 |> 8B56 48 MOV EDX,DWORD PTR DS:[ESI+48] 1000302A |. 8BC3 MOV EAX,EBX 1000302C |. C1F8 08 SAR EAX,8 1000302F |. 0FB6C8 MOVZX ECX,AL 10003032 |. F6444A 01 80 TEST BYTE PTR DS:[EDX+ECX*2+1],80 10003037 |. 74 0F JE SHORT jagmisc.10003048 10003039 |. 6A 02 PUSH 2 1000303B |. 8845 08 MOV BYTE PTR SS:[EBP+8],AL 1000303E |. 885D 09 MOV BYTE PTR SS:[EBP+9],BL 10003041 |. C645 0A 00 MOV BYTE PTR SS:[EBP+A],0 10003045 |. 58 POP EAX ; kernel32.7C816FD7 10003046 |. EB 09 JMP SHORT jagmisc.10003051 10003048 |> 885D 08 MOV BYTE PTR SS:[EBP+8],BL 1000304B |. C645 09 00 MOV BYTE PTR SS:[EBP+9],0 1000304F |. 8BC7 MOV EAX,EDI 10003051 |> 57 PUSH EDI 10003052 |. FF76 04 PUSH DWORD PTR DS:[ESI+4] 10003055 |. 8D4D FC LEA ECX,[LOCAL.1] 10003058 |. 6A 03 PUSH 3 1000305A |. 51 PUSH ECX 1000305B |. 50 PUSH EAX 1000305C |. 8D45 08 LEA EAX,[ARG.1] 1000305F |. 50 PUSH EAX 10003060 |. 68 00010000 PUSH 100 10003065 |. FF76 14 PUSH DWORD PTR DS:[ESI+14] 10003068 |. E8 1E2B0000 CALL jagmisc.10005B8B 1000306D |. 83C4 20 ADD ESP,20 10003070 |. 85C0 TEST EAX,EAX 10003072 |. 74 24 JE SHORT jagmisc.10003098 10003074 |. 3BC7 CMP EAX,EDI 10003076 |. 75 06 JNZ SHORT jagmisc.1000307E 10003078 |. 0FB645 FC MOVZX EAX,BYTE PTR SS:[EBP-4] 1000307C |. EB 1C JMP SHORT jagmisc.1000309A 1000307E |> 0FB64D FD MOVZX ECX,BYTE PTR SS:[EBP-3] 10003082 |. 33C0 XOR EAX,EAX 10003084 |. 8A65 FC MOV AH,BYTE PTR SS:[EBP-4] 10003087 |. 0BC1 OR EAX,ECX 10003089 |. EB 0F JMP SHORT jagmisc.1000309A 1000308B |> 83FB 41 CMP EBX,41 1000308E |. 7C 08 JL SHORT jagmisc.10003098 10003090 |. 83FB 5A CMP EBX,5A 10003093 |. 8D43 20 LEA EAX,DWORD PTR DS:[EBX+20] 10003096 |. 7E 02 JLE SHORT jagmisc.1000309A 10003098 |> 8BC3 MOV EAX,EBX 1000309A |> 5F POP EDI ; kernel32.7C816FD7 1000309B |. 5E POP ESI ; kernel32.7C816FD7 1000309C |. 5B POP EBX ; kernel32.7C816FD7 1000309D |. C9 LEAVE 1000309E \. C3 RETN 1000309F /$ E8 5DECFFFF CALL jagmisc.10001D01 100030A4 |. 8B40 64 MOV EAX,DWORD PTR DS:[EAX+64] 100030A7 |. 3B05 ECA40010 CMP EAX,DWORD PTR DS:[1000A4EC] ; jagmisc.1000A498 100030AD |. 74 05 JE SHORT jagmisc.100030B4 100030AF |. E8 420F0000 CALL jagmisc.10003FF6 100030B4 |> FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738 100030B8 |. 50 PUSH EAX 100030B9 |. E8 19FFFFFF CALL jagmisc.10002FD7 100030BE |. 59 POP ECX ; kernel32.7C816FD7 100030BF |. 59 POP ECX ; kernel32.7C816FD7 100030C0 \. C3 RETN 100030C1 /$ 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 100030C5 |. 6A 20 PUSH 20 100030C7 |. 59 POP ECX ; kernel32.7C816FD7 100030C8 |. 99 CDQ 100030C9 |. F7F9 IDIV ECX 100030CB |. 6A 1F PUSH 1F 100030CD |. 59 POP ECX ; kernel32.7C816FD7 100030CE |. 2BCA SUB ECX,EDX 100030D0 |. 83CA FF OR EDX,FFFFFFFF 100030D3 |. D3E2 SHL EDX,CL 100030D5 |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 100030D9 |. F7D2 NOT EDX 100030DB |. 851481 TEST DWORD PTR DS:[ECX+EAX*4],EDX 100030DE |. 74 09 JE SHORT jagmisc.100030E9 100030E0 |> 33C0 XOR EAX,EAX 100030E2 |. C3 RETN 100030E3 |> 833C81 00 /CMP DWORD PTR DS:[ECX+EAX*4],0 100030E7 |.^ 75 F7 |JNZ SHORT jagmisc.100030E0 100030E9 |> 40 INC EAX 100030EA |. 83F8 03 |CMP EAX,3 100030ED |.^ 7C F4 \JL SHORT jagmisc.100030E3 100030EF |. 33C0 XOR EAX,EAX 100030F1 |. 40 INC EAX 100030F2 \. C3 RETN 100030F3 /$ 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 100030F7 |. 56 PUSH ESI 100030F8 |. 57 PUSH EDI 100030F9 |. 6A 20 PUSH 20 100030FB |. 59 POP ECX ; kernel32.7C816FD7 100030FC |. 99 CDQ 100030FD |. F7F9 IDIV ECX 100030FF |. 8B7C24 0C MOV EDI,DWORD PTR SS:[ESP+C] 10003103 |. 8BF0 MOV ESI,EAX 10003105 |. 8D04B7 LEA EAX,DWORD PTR DS:[EDI+ESI*4] 10003108 |. 50 PUSH EAX 10003109 |. 6A 1F PUSH 1F 1000310B |. 59 POP ECX ; kernel32.7C816FD7 1000310C |. 2BCA SUB ECX,EDX 1000310E |. 33D2 XOR EDX,EDX 10003110 |. 42 INC EDX 10003111 |. D3E2 SHL EDX,CL 10003113 |. 52 PUSH EDX 10003114 |. FF30 PUSH DWORD PTR DS:[EAX] 10003116 |. E8 2C2E0000 CALL jagmisc.10005F47 1000311B |. 83C4 0C ADD ESP,0C 1000311E |. 4E DEC ESI 1000311F |. 78 1C JS SHORT jagmisc.1000313D 10003121 |. 8D3CB7 LEA EDI,DWORD PTR DS:[EDI+ESI*4] 10003124 |> 85C0 /TEST EAX,EAX 10003126 |. 74 15 |JE SHORT jagmisc.1000313D 10003128 |. 57 |PUSH EDI 10003129 |. 6A 01 |PUSH 1 1000312B |. FF37 |PUSH DWORD PTR DS:[EDI] 1000312D |. E8 152E0000 |CALL jagmisc.10005F47 10003132 |. 83C4 0C |ADD ESP,0C 10003135 |. 4E |DEC ESI 10003136 |. 83EF 04 |SUB EDI,4 10003139 |. 85F6 |TEST ESI,ESI 1000313B |.^ 7D E7 \JGE SHORT jagmisc.10003124 1000313D |> 5F POP EDI ; kernel32.7C816FD7 1000313E |. 5E POP ESI ; kernel32.7C816FD7 1000313F \. C3 RETN 10003140 /$ 55 PUSH EBP 10003141 |. 8BEC MOV EBP,ESP 10003143 |. 51 PUSH ECX 10003144 |. 8365 FC 00 AND [LOCAL.1],0 10003148 |. 53 PUSH EBX 10003149 |. 56 PUSH ESI 1000314A |. 57 PUSH EDI 1000314B |. 8B7D 0C MOV EDI,[ARG.2] 1000314E |. 4F DEC EDI 1000314F |. 6A 20 PUSH 20 10003151 |. 8D47 01 LEA EAX,DWORD PTR DS:[EDI+1] 10003154 |. 59 POP ECX ; kernel32.7C816FD7 10003155 |. 99 CDQ 10003156 |. F7F9 IDIV ECX 10003158 |. 6A 1F PUSH 1F 1000315A |. 5E POP ESI ; kernel32.7C816FD7 1000315B |. 2BF2 SUB ESI,EDX 1000315D |. 33D2 XOR EDX,EDX 1000315F |. 42 INC EDX 10003160 |. 8BCE MOV ECX,ESI 10003162 |. D3E2 SHL EDX,CL 10003164 |. 8BD8 MOV EBX,EAX 10003166 |. 8B45 08 MOV EAX,[ARG.1] 10003169 |. 851498 TEST DWORD PTR DS:[EAX+EBX*4],EDX 1000316C |. 74 21 JE SHORT jagmisc.1000318F 1000316E |. 8D4F 01 LEA ECX,DWORD PTR DS:[EDI+1] 10003171 |. 51 PUSH ECX 10003172 |. 50 PUSH EAX 10003173 |. E8 49FFFFFF CALL jagmisc.100030C1 10003178 |. 85C0 TEST EAX,EAX 1000317A |. 59 POP ECX ; kernel32.7C816FD7 1000317B |. 59 POP ECX ; kernel32.7C816FD7 1000317C |. 75 0E JNZ SHORT jagmisc.1000318C 1000317E |. 57 PUSH EDI 1000317F |. FF75 08 PUSH [ARG.1] 10003182 |. E8 6CFFFFFF CALL jagmisc.100030F3 10003187 |. 59 POP ECX ; kernel32.7C816FD7 10003188 |. 59 POP ECX ; kernel32.7C816FD7 10003189 |. 8945 FC MOV [LOCAL.1],EAX 1000318C |> 8B45 08 MOV EAX,[ARG.1] 1000318F |> 83CA FF OR EDX,FFFFFFFF 10003192 |. 8BCE MOV ECX,ESI 10003194 |. D3E2 SHL EDX,CL 10003196 |. 6A 03 PUSH 3 10003198 |. 59 POP ECX ; kernel32.7C816FD7 10003199 |. 211498 AND DWORD PTR DS:[EAX+EBX*4],EDX 1000319C |. 43 INC EBX 1000319D |. 3BD9 CMP EBX,ECX 1000319F |. 7D 09 JGE SHORT jagmisc.100031AA 100031A1 |. 8D3C98 LEA EDI,DWORD PTR DS:[EAX+EBX*4] 100031A4 |. 2BCB SUB ECX,EBX 100031A6 |. 33C0 XOR EAX,EAX 100031A8 |. F3:AB REP STOS DWORD PTR ES:[EDI] 100031AA |> 8B45 FC MOV EAX,[LOCAL.1] 100031AD |. 5F POP EDI ; kernel32.7C816FD7 100031AE |. 5E POP ESI ; kernel32.7C816FD7 100031AF |. 5B POP EBX ; kernel32.7C816FD7 100031B0 |. C9 LEAVE 100031B1 \. C3 RETN 100031B2 /$ 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 100031B6 |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 100031BA |. 6A 03 PUSH 3 100031BC |. 5A POP EDX ; kernel32.7C816FD7 100031BD |. 2BC8 SUB ECX,EAX 100031BF |. 56 PUSH ESI 100031C0 |> 8B30 /MOV ESI,DWORD PTR DS:[EAX] 100031C2 |. 893401 |MOV DWORD PTR DS:[ECX+EAX],ESI 100031C5 |. 83C0 04 |ADD EAX,4 100031C8 |. 4A |DEC EDX 100031C9 |.^ 75 F5 \JNZ SHORT jagmisc.100031C0 100031CB |. 5E POP ESI ; kernel32.7C816FD7 100031CC \. C3 RETN 100031CD /$ 33C0 XOR EAX,EAX 100031CF |> 8B4C24 04 /MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 100031D3 |. 833C81 00 |CMP DWORD PTR DS:[ECX+EAX*4],0 100031D7 |. 75 0A |JNZ SHORT jagmisc.100031E3 100031D9 |. 40 |INC EAX 100031DA |. 83F8 03 |CMP EAX,3 100031DD |.^ 7C F0 \JL SHORT jagmisc.100031CF 100031DF |. 33C0 XOR EAX,EAX 100031E1 |. 40 INC EAX 100031E2 |. C3 RETN 100031E3 |> 33C0 XOR EAX,EAX 100031E5 \. C3 RETN 100031E6 /$ 55 PUSH EBP 100031E7 |. 8BEC MOV EBP,ESP 100031E9 |. 83EC 0C SUB ESP,0C 100031EC |. 8B45 0C MOV EAX,[ARG.2] 100031EF |. 53 PUSH EBX 100031F0 |. 56 PUSH ESI 100031F1 |. 57 PUSH EDI 100031F2 |. 6A 20 PUSH 20 100031F4 |. 5E POP ESI ; kernel32.7C816FD7 100031F5 |. 99 CDQ 100031F6 |. 8BCE MOV ECX,ESI 100031F8 |. F7F9 IDIV ECX 100031FA |. 8B5D 08 MOV EBX,[ARG.1] 100031FD |. 83CF FF OR EDI,FFFFFFFF 10003200 |. 8975 0C MOV [ARG.2],ESI 10003203 |. 8BCA MOV ECX,EDX 10003205 |. D3E7 SHL EDI,CL 10003207 |. 8945 F8 MOV [LOCAL.2],EAX 1000320A |. 33C0 XOR EAX,EAX 1000320C |. 2955 0C SUB [ARG.2],EDX 1000320F |. F7D7 NOT EDI 10003211 |. 8945 FC MOV [LOCAL.1],EAX 10003214 |> 8B3483 /MOV ESI,DWORD PTR DS:[EBX+EAX*4] 10003217 |. 8BCE |MOV ECX,ESI 10003219 |. 23CF |AND ECX,EDI 1000321B |. 894D F4 |MOV [LOCAL.3],ECX 1000321E |. 8BCA |MOV ECX,EDX 10003220 |. D3EE |SHR ESI,CL 10003222 |. 8B4D 0C |MOV ECX,[ARG.2] 10003225 |. 0B75 FC |OR ESI,[LOCAL.1] 10003228 |. 893483 |MOV DWORD PTR DS:[EBX+EAX*4],ESI 1000322B |. 8B75 F4 |MOV ESI,[LOCAL.3] 1000322E |. D3E6 |SHL ESI,CL 10003230 |. 40 |INC EAX 10003231 |. 83F8 03 |CMP EAX,3 10003234 |. 8975 FC |MOV [LOCAL.1],ESI 10003237 |.^ 7C DB \JL SHORT jagmisc.10003214 10003239 |. 6A 02 PUSH 2 1000323B |. 58 POP EAX ; kernel32.7C816FD7 1000323C |. 8BC8 MOV ECX,EAX 1000323E |. 2B4D F8 SUB ECX,[LOCAL.2] ; LOADDLL.00410249 10003241 |. 8D0C8B LEA ECX,DWORD PTR DS:[EBX+ECX*4] 10003244 |> 3B45 F8 /CMP EAX,[LOCAL.2] ; LOADDLL.00410249 10003247 |. 7C 07 |JL SHORT jagmisc.10003250 10003249 |. 8B11 |MOV EDX,DWORD PTR DS:[ECX] 1000324B |. 891483 |MOV DWORD PTR DS:[EBX+EAX*4],EDX 1000324E |. EB 04 |JMP SHORT jagmisc.10003254 10003250 |> 832483 00 |AND DWORD PTR DS:[EBX+EAX*4],0 10003254 |> 48 |DEC EAX 10003255 |. 83E9 04 |SUB ECX,4 10003258 |. 85C0 |TEST EAX,EAX 1000325A |.^ 7D E8 \JGE SHORT jagmisc.10003244 1000325C |. 5F POP EDI ; kernel32.7C816FD7 1000325D |. 5E POP ESI ; kernel32.7C816FD7 1000325E |. 5B POP EBX ; kernel32.7C816FD7 1000325F |. C9 LEAVE 10003260 \. C3 RETN 10003261 /$ 55 PUSH EBP 10003262 |. 8BEC MOV EBP,ESP 10003264 |. 83EC 18 SUB ESP,18 10003267 |. 8B45 08 MOV EAX,[ARG.1] 1000326A |. 0FB748 0A MOVZX ECX,WORD PTR DS:[EAX+A] 1000326E |. 53 PUSH EBX 1000326F |. 56 PUSH ESI 10003270 |. 8B75 10 MOV ESI,[ARG.3] 10003273 |. 57 PUSH EDI 10003274 |. 8BF9 MOV EDI,ECX 10003276 |. 81E1 00800000 AND ECX,8000 1000327C |. 894D 08 MOV [ARG.1],ECX 1000327F |. 8B48 06 MOV ECX,DWORD PTR DS:[EAX+6] 10003282 |. 894D F4 MOV [LOCAL.3],ECX 10003285 |. 8B48 02 MOV ECX,DWORD PTR DS:[EAX+2] 10003288 |. 0FB700 MOVZX EAX,WORD PTR DS:[EAX] 1000328B |. C1E0 10 SHL EAX,10 1000328E |. 81E7 FF7F0000 AND EDI,7FFF 10003294 |. 81EF FF3F0000 SUB EDI,3FFF 1000329A |. 81FF 01C0FFFF CMP EDI,-3FFF 100032A0 |. 8945 FC MOV [LOCAL.1],EAX 100032A3 |. 8D45 F4 LEA EAX,[LOCAL.3] 100032A6 |. 894D F8 MOV [LOCAL.2],ECX 100032A9 |. 50 PUSH EAX 100032AA |. 75 1E JNZ SHORT jagmisc.100032CA 100032AC |. 33DB XOR EBX,EBX 100032AE |. E8 1AFFFFFF CALL jagmisc.100031CD 100032B3 |. 85C0 TEST EAX,EAX 100032B5 |. 59 POP ECX ; kernel32.7C816FD7 100032B6 |. 0F85 BD000000 JNZ jagmisc.10003379 100032BC |. 8D7D F4 LEA EDI,[LOCAL.3] 100032BF |. AB STOS DWORD PTR ES:[EDI] 100032C0 |. AB STOS DWORD PTR ES:[EDI] 100032C1 |. AB STOS DWORD PTR ES:[EDI] 100032C2 |> 6A 02 PUSH 2 100032C4 |. 58 POP EAX ; kernel32.7C816FD7 100032C5 |. E9 B1000000 JMP jagmisc.1000337B 100032CA |> 8D45 E8 LEA EAX,[LOCAL.6] 100032CD |. 50 PUSH EAX 100032CE |. E8 DFFEFFFF CALL jagmisc.100031B2 100032D3 |. FF76 08 PUSH DWORD PTR DS:[ESI+8] 100032D6 |. 8D45 F4 LEA EAX,[LOCAL.3] 100032D9 |. 50 PUSH EAX 100032DA |. E8 61FEFFFF CALL jagmisc.10003140 100032DF |. 83C4 10 ADD ESP,10 100032E2 |. 85C0 TEST EAX,EAX 100032E4 |. 74 01 JE SHORT jagmisc.100032E7 100032E6 |. 47 INC EDI 100032E7 |> 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4] 100032EA |. 8BC8 MOV ECX,EAX 100032EC |. 2B4E 08 SUB ECX,DWORD PTR DS:[ESI+8] 100032EF |. 3BF9 CMP EDI,ECX 100032F1 |. 7D 0A JGE SHORT jagmisc.100032FD 100032F3 |. 33C0 XOR EAX,EAX 100032F5 |. 8D7D F4 LEA EDI,[LOCAL.3] 100032F8 |. AB STOS DWORD PTR ES:[EDI] 100032F9 |. AB STOS DWORD PTR ES:[EDI] 100032FA |. AB STOS DWORD PTR ES:[EDI] 100032FB |. EB 3C JMP SHORT jagmisc.10003339 100032FD |> 3BF8 CMP EDI,EAX 100032FF |. 7F 3C JG SHORT jagmisc.1000333D 10003301 |. 2BC7 SUB EAX,EDI 10003303 |. 8BF8 MOV EDI,EAX 10003305 |. 8D45 E8 LEA EAX,[LOCAL.6] 10003308 |. 50 PUSH EAX 10003309 |. 8D45 F4 LEA EAX,[LOCAL.3] 1000330C |. 50 PUSH EAX 1000330D |. E8 A0FEFFFF CALL jagmisc.100031B2 10003312 |. 8D45 F4 LEA EAX,[LOCAL.3] 10003315 |. 57 PUSH EDI 10003316 |. 50 PUSH EAX 10003317 |. E8 CAFEFFFF CALL jagmisc.100031E6 1000331C |. FF76 08 PUSH DWORD PTR DS:[ESI+8] 1000331F |. 8D45 F4 LEA EAX,[LOCAL.3] 10003322 |. 50 PUSH EAX 10003323 |. E8 18FEFFFF CALL jagmisc.10003140 10003328 |. 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 1000332B |. 40 INC EAX 1000332C |. 50 PUSH EAX 1000332D |. 8D45 F4 LEA EAX,[LOCAL.3] 10003330 |. 50 PUSH EAX 10003331 |. E8 B0FEFFFF CALL jagmisc.100031E6 10003336 |. 83C4 20 ADD ESP,20 10003339 |> 33DB XOR EBX,EBX 1000333B |.^ EB 85 JMP SHORT jagmisc.100032C2 1000333D |> 3B3E CMP EDI,DWORD PTR DS:[ESI] 1000333F |. FF76 0C PUSH DWORD PTR DS:[ESI+C] 10003342 |. 7C 21 JL SHORT jagmisc.10003365 10003344 |. 33C0 XOR EAX,EAX 10003346 |. 8D7D F4 LEA EDI,[LOCAL.3] 10003349 |. AB STOS DWORD PTR ES:[EDI] 1000334A |. AB STOS DWORD PTR ES:[EDI] 1000334B |. AB STOS DWORD PTR ES:[EDI] 1000334C |. 804D F7 80 OR BYTE PTR SS:[EBP-9],80 10003350 |. 8D45 F4 LEA EAX,[LOCAL.3] 10003353 |. 50 PUSH EAX 10003354 |. E8 8DFEFFFF CALL jagmisc.100031E6 10003359 |. 8B5E 14 MOV EBX,DWORD PTR DS:[ESI+14] 1000335C |. 031E ADD EBX,DWORD PTR DS:[ESI] 1000335E |. 59 POP ECX ; kernel32.7C816FD7 1000335F |. 33C0 XOR EAX,EAX 10003361 |. 59 POP ECX ; kernel32.7C816FD7 10003362 |. 40 INC EAX 10003363 |. EB 16 JMP SHORT jagmisc.1000337B 10003365 |> 8B5E 14 MOV EBX,DWORD PTR DS:[ESI+14] 10003368 |. 8065 F7 7F AND BYTE PTR SS:[EBP-9],7F 1000336C |. 8D45 F4 LEA EAX,[LOCAL.3] 1000336F |. 50 PUSH EAX 10003370 |. 03DF ADD EBX,EDI 10003372 |. E8 6FFEFFFF CALL jagmisc.100031E6 10003377 |. 59 POP ECX ; kernel32.7C816FD7 10003378 |. 59 POP ECX ; kernel32.7C816FD7 10003379 |> 33C0 XOR EAX,EAX 1000337B |> 6A 1F PUSH 1F 1000337D |. 59 POP ECX ; kernel32.7C816FD7 1000337E |. 2B4E 0C SUB ECX,DWORD PTR DS:[ESI+C] 10003381 |. 8B76 10 MOV ESI,DWORD PTR DS:[ESI+10] 10003384 |. D3E3 SHL EBX,CL 10003386 |. 8B4D 08 MOV ECX,[ARG.1] 10003389 |. F7D9 NEG ECX 1000338B |. 1BC9 SBB ECX,ECX 1000338D |. 81E1 00000080 AND ECX,80000000 10003393 |. 0BD9 OR EBX,ECX 10003395 |. 0B5D F4 OR EBX,[LOCAL.3] 10003398 |. 83FE 40 CMP ESI,40 1000339B |. 75 0D JNZ SHORT jagmisc.100033AA 1000339D |. 8B4D 0C MOV ECX,[ARG.2] 100033A0 |. 8B55 F8 MOV EDX,[LOCAL.2] ; LOADDLL.00410249 100033A3 |. 8959 04 MOV DWORD PTR DS:[ECX+4],EBX 100033A6 |. 8911 MOV DWORD PTR DS:[ECX],EDX 100033A8 |. EB 0A JMP SHORT jagmisc.100033B4 100033AA |> 83FE 20 CMP ESI,20 100033AD |. 75 05 JNZ SHORT jagmisc.100033B4 100033AF |. 8B4D 0C MOV ECX,[ARG.2] 100033B2 |. 8919 MOV DWORD PTR DS:[ECX],EBX 100033B4 |> 5F POP EDI ; kernel32.7C816FD7 100033B5 |. 5E POP ESI ; kernel32.7C816FD7 100033B6 |. 5B POP EBX ; kernel32.7C816FD7 100033B7 |. C9 LEAVE 100033B8 \. C3 RETN 100033B9 /$ 68 24A30010 PUSH jagmisc.1000A324 100033BE |. FF7424 0C PUSH DWORD PTR SS:[ESP+C] 100033C2 |. FF7424 0C PUSH DWORD PTR SS:[ESP+C] 100033C6 |. E8 96FEFFFF CALL jagmisc.10003261 100033CB |. 83C4 0C ADD ESP,0C 100033CE \. C3 RETN 100033CF /$ 68 3CA30010 PUSH jagmisc.1000A33C 100033D4 |. FF7424 0C PUSH DWORD PTR SS:[ESP+C] 100033D8 |. FF7424 0C PUSH DWORD PTR SS:[ESP+C] 100033DC |. E8 80FEFFFF CALL jagmisc.10003261 100033E1 |. 83C4 0C ADD ESP,0C 100033E4 \. C3 RETN 100033E5 /$ 55 PUSH EBP 100033E6 |. 8BEC MOV EBP,ESP 100033E8 |. 83EC 14 SUB ESP,14 100033EB |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 100033F0 |. 8945 FC MOV [LOCAL.1],EAX 100033F3 |. 33C0 XOR EAX,EAX 100033F5 |. 50 PUSH EAX 100033F6 |. 50 PUSH EAX 100033F7 |. 50 PUSH EAX 100033F8 |. 50 PUSH EAX 100033F9 |. FF75 0C PUSH [ARG.2] 100033FC |. 8D45 EC LEA EAX,[LOCAL.5] 100033FF |. 50 PUSH EAX 10003400 |. 8D45 F0 LEA EAX,[LOCAL.4] 10003403 |. 50 PUSH EAX 10003404 |. E8 F62C0000 CALL jagmisc.100060FF 10003409 |. FF75 08 PUSH [ARG.1] 1000340C |. 8D45 F0 LEA EAX,[LOCAL.4] 1000340F |. 50 PUSH EAX 10003410 |. E8 A4FFFFFF CALL jagmisc.100033B9 10003415 |. 8B4D FC MOV ECX,[LOCAL.1] 10003418 |. 83C4 24 ADD ESP,24 1000341B |. E8 D6060000 CALL jagmisc.10003AF6 10003420 |. C9 LEAVE 10003421 \. C3 RETN 10003422 /$ 55 PUSH EBP 10003423 |. 8BEC MOV EBP,ESP 10003425 |. 83EC 14 SUB ESP,14 10003428 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 1000342D |. 8945 FC MOV [LOCAL.1],EAX 10003430 |. 33C0 XOR EAX,EAX 10003432 |. 50 PUSH EAX 10003433 |. 50 PUSH EAX 10003434 |. 50 PUSH EAX 10003435 |. 50 PUSH EAX 10003436 |. FF75 0C PUSH [ARG.2] 10003439 |. 8D45 EC LEA EAX,[LOCAL.5] 1000343C |. 50 PUSH EAX 1000343D |. 8D45 F0 LEA EAX,[LOCAL.4] 10003440 |. 50 PUSH EAX 10003441 |. E8 B92C0000 CALL jagmisc.100060FF 10003446 |. FF75 08 PUSH [ARG.1] 10003449 |. 8D45 F0 LEA EAX,[LOCAL.4] 1000344C |. 50 PUSH EAX 1000344D |. E8 7DFFFFFF CALL jagmisc.100033CF 10003452 |. 8B4D FC MOV ECX,[LOCAL.1] 10003455 |. 83C4 24 ADD ESP,24 10003458 |. E8 99060000 CALL jagmisc.10003AF6 1000345D |. C9 LEAVE 1000345E \. C3 RETN 1000345F CC INT3 10003460 $ 55 PUSH EBP 10003461 . 8BEC MOV EBP,ESP 10003463 . 57 PUSH EDI 10003464 . 56 PUSH ESI 10003465 . 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C] 10003468 . 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10] 1000346B . 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8] 1000346E . 8BC1 MOV EAX,ECX 10003470 . 8BD1 MOV EDX,ECX 10003472 . 03C6 ADD EAX,ESI 10003474 . 3BFE CMP EDI,ESI 10003476 . 76 08 JBE SHORT jagmisc.10003480 10003478 . 3BF8 CMP EDI,EAX 1000347A . 0F82 7C010000 JB jagmisc.100035FC 10003480 > F7C7 03000000 TEST EDI,3 10003486 . 75 14 JNZ SHORT jagmisc.1000349C 10003488 . C1E9 02 SHR ECX,2 1000348B . 83E2 03 AND EDX,3 1000348E . 83F9 08 CMP ECX,8 10003491 . 72 29 JB SHORT jagmisc.100034BC 10003493 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10003495 . FF2495 AC350010 JMP DWORD PTR DS:[EDX*4+100035AC] ; jagmisc.100035BC 1000349C > 8BC7 MOV EAX,EDI 1000349E . BA 03000000 MOV EDX,3 100034A3 . 83E9 04 SUB ECX,4 100034A6 . 72 0C JB SHORT jagmisc.100034B4 100034A8 . 83E0 03 AND EAX,3 100034AB . 03C8 ADD ECX,EAX 100034AD .- FF2485 C0340010 JMP DWORD PTR DS:[EAX*4+100034C0] 100034B4 > FF248D BC350010 JMP DWORD PTR DS:[ECX*4+100035BC] ; jagmisc.100035E4 100034BB 90 NOP 100034BC >- FF248D 40350010 JMP DWORD PTR DS:[ECX*4+10003540] 100034C3 90 DB 90 100034C4 . D0340010 DD jagmisc.100034D0 ; Switch table (1-based) used at 100034AD 100034C8 . FC340010 DD jagmisc.100034FC 100034CC . 20350010 DD jagmisc.10003520 100034D0 > 23D1 AND EDX,ECX 100034D2 . 8A06 MOV AL,BYTE PTR DS:[ESI] 100034D4 . 8807 MOV BYTE PTR DS:[EDI],AL 100034D6 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 100034D9 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL 100034DC . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 100034DF . C1E9 02 SHR ECX,2 100034E2 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL 100034E5 . 83C6 03 ADD ESI,3 100034E8 . 83C7 03 ADD EDI,3 100034EB . 83F9 08 CMP ECX,8 100034EE .^ 72 CC JB SHORT jagmisc.100034BC 100034F0 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 100034F2 . FF2495 AC350010 JMP DWORD PTR DS:[EDX*4+100035AC] ; jagmisc.100035BC 100034F9 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 100034FC > 23D1 AND EDX,ECX 100034FE . 8A06 MOV AL,BYTE PTR DS:[ESI] 10003500 . 8807 MOV BYTE PTR DS:[EDI],AL 10003502 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 10003505 . C1E9 02 SHR ECX,2 10003508 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL 1000350B . 83C6 02 ADD ESI,2 1000350E . 83C7 02 ADD EDI,2 10003511 . 83F9 08 CMP ECX,8 10003514 .^ 72 A6 JB SHORT jagmisc.100034BC 10003516 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10003518 . FF2495 AC350010 JMP DWORD PTR DS:[EDX*4+100035AC] ; jagmisc.100035BC 1000351F 90 NOP 10003520 > 23D1 AND EDX,ECX 10003522 . 8A06 MOV AL,BYTE PTR DS:[ESI] 10003524 . 8807 MOV BYTE PTR DS:[EDI],AL 10003526 . 83C6 01 ADD ESI,1 10003529 . C1E9 02 SHR ECX,2 1000352C . 83C7 01 ADD EDI,1 1000352F . 83F9 08 CMP ECX,8 10003532 .^ 72 88 JB SHORT jagmisc.100034BC 10003534 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10003536 . FF2495 AC350010 JMP DWORD PTR DS:[EDX*4+100035AC] ; jagmisc.100035BC 1000353D 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 10003540 . A3350010 DD jagmisc.100035A3 ; Switch table used at 100034BC 10003544 . 90350010 DD jagmisc.10003590 10003548 . 88350010 DD jagmisc.10003588 1000354C . 80350010 DD jagmisc.10003580 10003550 . 78350010 DD jagmisc.10003578 10003554 . 70350010 DD jagmisc.10003570 10003558 . 68350010 DD jagmisc.10003568 1000355C . 60350010 DD jagmisc.10003560 10003560 > 8B448E E4 MOV EAX,DWORD PTR DS:[ESI+ECX*4-1C] 10003564 . 89448F E4 MOV DWORD PTR DS:[EDI+ECX*4-1C],EAX 10003568 > 8B448E E8 MOV EAX,DWORD PTR DS:[ESI+ECX*4-18] 1000356C . 89448F E8 MOV DWORD PTR DS:[EDI+ECX*4-18],EAX 10003570 > 8B448E EC MOV EAX,DWORD PTR DS:[ESI+ECX*4-14] 10003574 . 89448F EC MOV DWORD PTR DS:[EDI+ECX*4-14],EAX 10003578 > 8B448E F0 MOV EAX,DWORD PTR DS:[ESI+ECX*4-10] 1000357C . 89448F F0 MOV DWORD PTR DS:[EDI+ECX*4-10],EAX 10003580 > 8B448E F4 MOV EAX,DWORD PTR DS:[ESI+ECX*4-C] 10003584 . 89448F F4 MOV DWORD PTR DS:[EDI+ECX*4-C],EAX 10003588 > 8B448E F8 MOV EAX,DWORD PTR DS:[ESI+ECX*4-8] 1000358C . 89448F F8 MOV DWORD PTR DS:[EDI+ECX*4-8],EAX 10003590 > 8B448E FC MOV EAX,DWORD PTR DS:[ESI+ECX*4-4] 10003594 . 89448F FC MOV DWORD PTR DS:[EDI+ECX*4-4],EAX 10003598 . 8D048D 00000000 LEA EAX,DWORD PTR DS:[ECX*4] 1000359F . 03F0 ADD ESI,EAX 100035A1 . 03F8 ADD EDI,EAX 100035A3 > FF2495 AC350010 JMP DWORD PTR DS:[EDX*4+100035AC] ; jagmisc.100035BC 100035AA 8BFF MOV EDI,EDI 100035AC . BC350010 DD jagmisc.100035BC ; Switch table used at 100034F2 and other places 100035B0 . C4350010 DD jagmisc.100035C4 100035B4 . D0350010 DD jagmisc.100035D0 100035B8 . E4350010 DD jagmisc.100035E4 100035BC > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 100035BF . 5E POP ESI ; kernel32.7C816FD7 100035C0 . 5F POP EDI ; kernel32.7C816FD7 100035C1 . C9 LEAVE 100035C2 . C3 RETN 100035C3 90 NOP 100035C4 > 8A06 MOV AL,BYTE PTR DS:[ESI] 100035C6 . 8807 MOV BYTE PTR DS:[EDI],AL 100035C8 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 100035CB . 5E POP ESI ; kernel32.7C816FD7 100035CC . 5F POP EDI ; kernel32.7C816FD7 100035CD . C9 LEAVE 100035CE . C3 RETN 100035CF 90 NOP 100035D0 > 8A06 MOV AL,BYTE PTR DS:[ESI] 100035D2 . 8807 MOV BYTE PTR DS:[EDI],AL 100035D4 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 100035D7 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL 100035DA . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 100035DD . 5E POP ESI ; kernel32.7C816FD7 100035DE . 5F POP EDI ; kernel32.7C816FD7 100035DF . C9 LEAVE 100035E0 . C3 RETN 100035E1 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 100035E4 > 8A06 MOV AL,BYTE PTR DS:[ESI] 100035E6 . 8807 MOV BYTE PTR DS:[EDI],AL 100035E8 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 100035EB . 8847 01 MOV BYTE PTR DS:[EDI+1],AL 100035EE . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 100035F1 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL 100035F4 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 100035F7 . 5E POP ESI ; kernel32.7C816FD7 100035F8 . 5F POP EDI ; kernel32.7C816FD7 100035F9 . C9 LEAVE 100035FA . C3 RETN 100035FB 90 NOP 100035FC > 8D7431 FC LEA ESI,DWORD PTR DS:[ECX+ESI-4] 10003600 . 8D7C39 FC LEA EDI,DWORD PTR DS:[ECX+EDI-4] 10003604 . F7C7 03000000 TEST EDI,3 1000360A . 75 24 JNZ SHORT jagmisc.10003630 1000360C . C1E9 02 SHR ECX,2 1000360F . 83E2 03 AND EDX,3 10003612 . 83F9 08 CMP ECX,8 10003615 . 72 0D JB SHORT jagmisc.10003624 10003617 . FD STD 10003618 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 1000361A . FC CLD 1000361B . FF2495 48370010 JMP DWORD PTR DS:[EDX*4+10003748] ; jagmisc.10003758 10003622 8BFF MOV EDI,EDI 10003624 > F7D9 NEG ECX 10003626 . FF248D F8360010 JMP DWORD PTR DS:[ECX*4+100036F8] ; jagmisc.1000372C 1000362D 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 10003630 > 8BC7 MOV EAX,EDI 10003632 . BA 03000000 MOV EDX,3 ; Switch (cases 0..3) 10003637 . 83F9 04 CMP ECX,4 1000363A . 72 0C JB SHORT jagmisc.10003648 1000363C . 83E0 03 AND EAX,3 ; Default case of switch 10003632 1000363F . 2BC8 SUB ECX,EAX 10003641 .- FF2485 4C360010 JMP DWORD PTR DS:[EAX*4+1000364C] 10003648 >- FF248D 48370010 JMP DWORD PTR DS:[ECX*4+10003748] 1000364F 90 DB 90 10003650 . 5C360010 DD jagmisc.1000365C ; Switch table (1-based) used at 10003641 10003654 . 80360010 DD jagmisc.10003680 10003658 . A8360010 DD jagmisc.100036A8 1000365C > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] 1000365F . 23D1 AND EDX,ECX 10003661 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL 10003664 . 83EE 01 SUB ESI,1 10003667 . C1E9 02 SHR ECX,2 1000366A . 83EF 01 SUB EDI,1 1000366D . 83F9 08 CMP ECX,8 10003670 .^ 72 B2 JB SHORT jagmisc.10003624 10003672 . FD STD 10003673 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10003675 . FC CLD 10003676 . FF2495 48370010 JMP DWORD PTR DS:[EDX*4+10003748] ; jagmisc.10003758 1000367D 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 10003680 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] 10003683 . 23D1 AND EDX,ECX 10003685 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL 10003688 . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 1000368B . C1E9 02 SHR ECX,2 1000368E . 8847 02 MOV BYTE PTR DS:[EDI+2],AL 10003691 . 83EE 02 SUB ESI,2 10003694 . 83EF 02 SUB EDI,2 10003697 . 83F9 08 CMP ECX,8 1000369A .^ 72 88 JB SHORT jagmisc.10003624 1000369C . FD STD 1000369D . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 1000369F . FC CLD 100036A0 . FF2495 48370010 JMP DWORD PTR DS:[EDX*4+10003748] ; jagmisc.10003758 100036A7 90 NOP 100036A8 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] 100036AB . 23D1 AND EDX,ECX 100036AD . 8847 03 MOV BYTE PTR DS:[EDI+3],AL 100036B0 . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 100036B3 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL 100036B6 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 100036B9 . C1E9 02 SHR ECX,2 100036BC . 8847 01 MOV BYTE PTR DS:[EDI+1],AL 100036BF . 83EE 03 SUB ESI,3 100036C2 . 83EF 03 SUB EDI,3 100036C5 . 83F9 08 CMP ECX,8 100036C8 .^ 0F82 56FFFFFF JB jagmisc.10003624 100036CE . FD STD 100036CF . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 100036D1 . FC CLD 100036D2 . FF2495 48370010 JMP DWORD PTR DS:[EDX*4+10003748] ; jagmisc.10003758 100036D9 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 100036DC . FC360010 DD jagmisc.100036FC 100036E0 . 04370010 DD jagmisc.10003704 100036E4 . 0C370010 DD jagmisc.1000370C 100036E8 . 14370010 DD jagmisc.10003714 100036EC . 1C370010 DD jagmisc.1000371C 100036F0 . 24370010 DD jagmisc.10003724 100036F4 . 2C370010 DD jagmisc.1000372C 100036F8 . 3F370010 DD jagmisc.1000373F 100036FC > 8B448E 1C MOV EAX,DWORD PTR DS:[ESI+ECX*4+1C] 10003700 . 89448F 1C MOV DWORD PTR DS:[EDI+ECX*4+1C],EAX 10003704 > 8B448E 18 MOV EAX,DWORD PTR DS:[ESI+ECX*4+18] 10003708 . 89448F 18 MOV DWORD PTR DS:[EDI+ECX*4+18],EAX 1000370C > 8B448E 14 MOV EAX,DWORD PTR DS:[ESI+ECX*4+14] 10003710 . 89448F 14 MOV DWORD PTR DS:[EDI+ECX*4+14],EAX 10003714 > 8B448E 10 MOV EAX,DWORD PTR DS:[ESI+ECX*4+10] 10003718 . 89448F 10 MOV DWORD PTR DS:[EDI+ECX*4+10],EAX 1000371C > 8B448E 0C MOV EAX,DWORD PTR DS:[ESI+ECX*4+C] 10003720 . 89448F 0C MOV DWORD PTR DS:[EDI+ECX*4+C],EAX 10003724 > 8B448E 08 MOV EAX,DWORD PTR DS:[ESI+ECX*4+8] 10003728 . 89448F 08 MOV DWORD PTR DS:[EDI+ECX*4+8],EAX 1000372C > 8B448E 04 MOV EAX,DWORD PTR DS:[ESI+ECX*4+4] 10003730 . 89448F 04 MOV DWORD PTR DS:[EDI+ECX*4+4],EAX 10003734 . 8D048D 00000000 LEA EAX,DWORD PTR DS:[ECX*4] 1000373B . 03F0 ADD ESI,EAX 1000373D . 03F8 ADD EDI,EAX 1000373F > FF2495 48370010 JMP DWORD PTR DS:[EDX*4+10003748] ; jagmisc.10003758 10003746 8BFF MOV EDI,EDI 10003748 . 58370010 DD jagmisc.10003758 ; Switch table used at 10003648 and other places 1000374C . 60370010 DD jagmisc.10003760 10003750 . 70370010 DD jagmisc.10003770 10003754 . 84370010 DD jagmisc.10003784 10003758 > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] ; Case 0 of switch 10003632 1000375B . 5E POP ESI ; kernel32.7C816FD7 1000375C . 5F POP EDI ; kernel32.7C816FD7 1000375D . C9 LEAVE 1000375E . C3 RETN 1000375F 90 NOP 10003760 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] ; Case 1 of switch 10003632 10003763 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL 10003766 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 10003769 . 5E POP ESI ; kernel32.7C816FD7 1000376A . 5F POP EDI ; kernel32.7C816FD7 1000376B . C9 LEAVE 1000376C . C3 RETN 1000376D 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 10003770 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] ; Case 2 of switch 10003632 10003773 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL 10003776 . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 10003779 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL 1000377C . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 1000377F . 5E POP ESI ; kernel32.7C816FD7 10003780 . 5F POP EDI ; kernel32.7C816FD7 10003781 . C9 LEAVE 10003782 . C3 RETN 10003783 90 NOP 10003784 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] ; Case 3 of switch 10003632 10003787 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL 1000378A . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 1000378D . 8847 02 MOV BYTE PTR DS:[EDI+2],AL 10003790 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 10003793 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL 10003796 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 10003799 . 5E POP ESI ; kernel32.7C816FD7 1000379A . 5F POP EDI ; kernel32.7C816FD7 1000379B . C9 LEAVE 1000379C . C3 RETN 1000379D CC INT3 1000379E CC INT3 1000379F CC INT3 100037A0 /$ 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 100037A4 |. F7C1 03000000 TEST ECX,3 100037AA |. 74 24 JE SHORT jagmisc.100037D0 100037AC |> 8A01 /MOV AL,BYTE PTR DS:[ECX] 100037AE |. 83C1 01 |ADD ECX,1 100037B1 |. 84C0 |TEST AL,AL 100037B3 |. 74 4E |JE SHORT jagmisc.10003803 100037B5 |. F7C1 03000000 |TEST ECX,3 100037BB |.^ 75 EF \JNZ SHORT jagmisc.100037AC 100037BD |. 05 00000000 ADD EAX,0 100037C2 |. 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP] 100037C9 |. 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP] 100037D0 |> 8B01 /MOV EAX,DWORD PTR DS:[ECX] 100037D2 |. BA FFFEFE7E |MOV EDX,7EFEFEFF 100037D7 |. 03D0 |ADD EDX,EAX 100037D9 |. 83F0 FF |XOR EAX,FFFFFFFF 100037DC |. 33C2 |XOR EAX,EDX 100037DE |. 83C1 04 |ADD ECX,4 100037E1 |. A9 00010181 |TEST EAX,81010100 100037E6 |.^ 74 E8 |JE SHORT jagmisc.100037D0 100037E8 |. 8B41 FC |MOV EAX,DWORD PTR DS:[ECX-4] 100037EB |. 84C0 |TEST AL,AL 100037ED |. 74 32 |JE SHORT jagmisc.10003821 100037EF |. 84E4 |TEST AH,AH 100037F1 |. 74 24 |JE SHORT jagmisc.10003817 100037F3 |. A9 0000FF00 |TEST EAX,0FF0000 100037F8 |. 74 13 |JE SHORT jagmisc.1000380D 100037FA |. A9 000000FF |TEST EAX,FF000000 100037FF |. 74 02 |JE SHORT jagmisc.10003803 10003801 |.^ EB CD \JMP SHORT jagmisc.100037D0 10003803 |> 8D41 FF LEA EAX,DWORD PTR DS:[ECX-1] 10003806 |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 1000380A |. 2BC1 SUB EAX,ECX 1000380C |. C3 RETN 1000380D |> 8D41 FE LEA EAX,DWORD PTR DS:[ECX-2] 10003810 |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10003814 |. 2BC1 SUB EAX,ECX 10003816 |. C3 RETN 10003817 |> 8D41 FD LEA EAX,DWORD PTR DS:[ECX-3] 1000381A |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 1000381E |. 2BC1 SUB EAX,ECX 10003820 |. C3 RETN 10003821 |> 8D41 FC LEA EAX,DWORD PTR DS:[ECX-4] 10003824 |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10003828 |. 2BC1 SUB EAX,ECX 1000382A \. C3 RETN 1000382B CC INT3 1000382C CC INT3 1000382D CC INT3 1000382E CC INT3 1000382F CC INT3 10003830 $ 57 PUSH EDI 10003831 . 8B7C24 08 MOV EDI,DWORD PTR SS:[ESP+8] 10003835 . EB 6E JMP SHORT jagmisc.100038A5 10003837 8D DB 8D 10003838 A4 DB A4 10003839 24 DB 24 ; CHAR '$' 1000383A 00 DB 00 1000383B 00 DB 00 1000383C 00 DB 00 1000383D 00 DB 00 1000383E 8BFF MOV EDI,EDI 10003840 /$ 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10003844 |. 57 PUSH EDI 10003845 |. F7C1 03000000 TEST ECX,3 1000384B |. 74 13 JE SHORT jagmisc.10003860 1000384D |> 8A01 /MOV AL,BYTE PTR DS:[ECX] 1000384F |. 83C1 01 |ADD ECX,1 10003852 |. 84C0 |TEST AL,AL 10003854 |. 74 3D |JE SHORT jagmisc.10003893 10003856 |. F7C1 03000000 |TEST ECX,3 1000385C |.^ 75 EF \JNZ SHORT jagmisc.1000384D 1000385E |. 8BFF MOV EDI,EDI 10003860 |> 8B01 /MOV EAX,DWORD PTR DS:[ECX] 10003862 |. BA FFFEFE7E |MOV EDX,7EFEFEFF 10003867 |. 03D0 |ADD EDX,EAX 10003869 |. 83F0 FF |XOR EAX,FFFFFFFF 1000386C |. 33C2 |XOR EAX,EDX 1000386E |. 83C1 04 |ADD ECX,4 10003871 |. A9 00010181 |TEST EAX,81010100 10003876 |.^ 74 E8 |JE SHORT jagmisc.10003860 10003878 |. 8B41 FC |MOV EAX,DWORD PTR DS:[ECX-4] 1000387B |. 84C0 |TEST AL,AL 1000387D |. 74 23 |JE SHORT jagmisc.100038A2 1000387F |. 84E4 |TEST AH,AH 10003881 |. 74 1A |JE SHORT jagmisc.1000389D 10003883 |. A9 0000FF00 |TEST EAX,0FF0000 10003888 |. 74 0E |JE SHORT jagmisc.10003898 1000388A |. A9 000000FF |TEST EAX,FF000000 1000388F |. 74 02 |JE SHORT jagmisc.10003893 10003891 |.^ EB CD \JMP SHORT jagmisc.10003860 10003893 |> 8D79 FF LEA EDI,DWORD PTR DS:[ECX-1] 10003896 |. EB 0D JMP SHORT jagmisc.100038A5 10003898 |> 8D79 FE LEA EDI,DWORD PTR DS:[ECX-2] 1000389B |. EB 08 JMP SHORT jagmisc.100038A5 1000389D |> 8D79 FD LEA EDI,DWORD PTR DS:[ECX-3] 100038A0 |. EB 03 JMP SHORT jagmisc.100038A5 100038A2 |> 8D79 FC LEA EDI,DWORD PTR DS:[ECX-4] 100038A5 |> 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C] 100038A9 |. F7C1 03000000 TEST ECX,3 100038AF |. 74 1D JE SHORT jagmisc.100038CE 100038B1 |> 8A11 /MOV DL,BYTE PTR DS:[ECX] 100038B3 |. 83C1 01 |ADD ECX,1 100038B6 |. 84D2 |TEST DL,DL 100038B8 |. 74 66 |JE SHORT jagmisc.10003920 100038BA |. 8817 |MOV BYTE PTR DS:[EDI],DL 100038BC |. 83C7 01 |ADD EDI,1 100038BF |. F7C1 03000000 |TEST ECX,3 100038C5 |.^ 75 EA \JNZ SHORT jagmisc.100038B1 100038C7 |. EB 05 JMP SHORT jagmisc.100038CE 100038C9 |> 8917 /MOV DWORD PTR DS:[EDI],EDX 100038CB |. 83C7 04 |ADD EDI,4 100038CE |> BA FFFEFE7E MOV EDX,7EFEFEFF 100038D3 |. 8B01 |MOV EAX,DWORD PTR DS:[ECX] 100038D5 |. 03D0 |ADD EDX,EAX 100038D7 |. 83F0 FF |XOR EAX,FFFFFFFF 100038DA |. 33C2 |XOR EAX,EDX 100038DC |. 8B11 |MOV EDX,DWORD PTR DS:[ECX] 100038DE |. 83C1 04 |ADD ECX,4 100038E1 |. A9 00010181 |TEST EAX,81010100 100038E6 |.^ 74 E1 |JE SHORT jagmisc.100038C9 100038E8 |. 84D2 |TEST DL,DL 100038EA |. 74 34 |JE SHORT jagmisc.10003920 100038EC |. 84F6 |TEST DH,DH 100038EE |. 74 27 |JE SHORT jagmisc.10003917 100038F0 |. F7C2 0000FF00 |TEST EDX,0FF0000 100038F6 |. 74 12 |JE SHORT jagmisc.1000390A 100038F8 |. F7C2 000000FF |TEST EDX,FF000000 100038FE |. 74 02 |JE SHORT jagmisc.10003902 10003900 |.^ EB C7 \JMP SHORT jagmisc.100038C9 10003902 |> 8917 MOV DWORD PTR DS:[EDI],EDX 10003904 |. 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 10003908 |. 5F POP EDI ; kernel32.7C816FD7 10003909 |. C3 RETN 1000390A |> 66:8917 MOV WORD PTR DS:[EDI],DX 1000390D |. 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 10003911 |. C647 02 00 MOV BYTE PTR DS:[EDI+2],0 10003915 |. 5F POP EDI ; kernel32.7C816FD7 10003916 |. C3 RETN 10003917 |> 66:8917 MOV WORD PTR DS:[EDI],DX 1000391A |. 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 1000391E |. 5F POP EDI ; kernel32.7C816FD7 1000391F |. C3 RETN 10003920 |> 8817 MOV BYTE PTR DS:[EDI],DL 10003922 |. 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 10003926 |. 5F POP EDI ; kernel32.7C816FD7 10003927 \. C3 RETN 10003928 /$ 55 PUSH EBP 10003929 |. 8BEC MOV EBP,ESP 1000392B |. 8B55 10 MOV EDX,[ARG.3] 1000392E |. 8B4A 0C MOV ECX,DWORD PTR DS:[EDX+C] 10003931 |. 53 PUSH EBX 10003932 |. 8B5D 0C MOV EBX,[ARG.2] 10003935 |. 85DB TEST EBX,EBX 10003937 |. 56 PUSH ESI 10003938 |. 8B75 08 MOV ESI,[ARG.1] 1000393B |. 57 PUSH EDI 1000393C |. 8D7E 01 LEA EDI,DWORD PTR DS:[ESI+1] 1000393F |. C606 30 MOV BYTE PTR DS:[ESI],30 10003942 |. 8BC7 MOV EAX,EDI 10003944 |. 7E 1F JLE SHORT jagmisc.10003965 10003946 |. 895D 08 MOV [ARG.1],EBX 10003949 |. 33DB XOR EBX,EBX 1000394B |> 8A11 /MOV DL,BYTE PTR DS:[ECX] 1000394D |. 84D2 |TEST DL,DL 1000394F |. 74 06 |JE SHORT jagmisc.10003957 10003951 |. 0FBED2 |MOVSX EDX,DL 10003954 |. 41 |INC ECX 10003955 |. EB 03 |JMP SHORT jagmisc.1000395A 10003957 |> 6A 30 |PUSH 30 10003959 |. 5A |POP EDX ; kernel32.7C816FD7 1000395A |> 8810 |MOV BYTE PTR DS:[EAX],DL 1000395C |. 40 |INC EAX 1000395D |. FF4D 08 |DEC [ARG.1] 10003960 |.^ 75 E9 \JNZ SHORT jagmisc.1000394B 10003962 |. 8B55 10 MOV EDX,[ARG.3] 10003965 |> 85DB TEST EBX,EBX 10003967 |. C600 00 MOV BYTE PTR DS:[EAX],0 1000396A |. 7C 12 JL SHORT jagmisc.1000397E 1000396C |. 8039 35 CMP BYTE PTR DS:[ECX],35 1000396F |. 7C 0D JL SHORT jagmisc.1000397E 10003971 |. EB 03 JMP SHORT jagmisc.10003976 10003973 |> C600 30 /MOV BYTE PTR DS:[EAX],30 10003976 |> 48 DEC EAX 10003977 |. 8038 39 |CMP BYTE PTR DS:[EAX],39 1000397A |.^ 74 F7 \JE SHORT jagmisc.10003973 1000397C |. FE00 INC BYTE PTR DS:[EAX] 1000397E |> 803E 31 CMP BYTE PTR DS:[ESI],31 10003981 |. 75 05 JNZ SHORT jagmisc.10003988 10003983 |. FF42 04 INC DWORD PTR DS:[EDX+4] 10003986 |. EB 12 JMP SHORT jagmisc.1000399A 10003988 |> 57 PUSH EDI 10003989 |. E8 12FEFFFF CALL jagmisc.100037A0 1000398E |. 40 INC EAX 1000398F |. 50 PUSH EAX 10003990 |. 57 PUSH EDI 10003991 |. 56 PUSH ESI 10003992 |. E8 C9FAFFFF CALL jagmisc.10003460 10003997 |. 83C4 10 ADD ESP,10 1000399A |> 5F POP EDI ; kernel32.7C816FD7 1000399B |. 5E POP ESI ; kernel32.7C816FD7 1000399C |. 5B POP EBX ; kernel32.7C816FD7 1000399D |. 5D POP EBP ; kernel32.7C816FD7 1000399E \. C3 RETN 1000399F /$ 55 PUSH EBP 100039A0 |. 8BEC MOV EBP,ESP 100039A2 |. 51 PUSH ECX 100039A3 |. 8B55 0C MOV EDX,[ARG.2] 100039A6 |. 33C0 XOR EAX,EAX 100039A8 |. 66:8B42 06 MOV AX,WORD PTR DS:[EDX+6] 100039AC |. 53 PUSH EBX 100039AD |. 56 PUSH ESI 100039AE |. 57 PUSH EDI 100039AF |. BF FF070000 MOV EDI,7FF 100039B4 |. BE 00000080 MOV ESI,80000000 100039B9 |. 8975 FC MOV [LOCAL.1],ESI 100039BC |. 8BC8 MOV ECX,EAX 100039BE |. C1E9 04 SHR ECX,4 100039C1 |. 25 00800000 AND EAX,8000 100039C6 |. 23CF AND ECX,EDI 100039C8 |. 8945 0C MOV [ARG.2],EAX 100039CB |. 8B42 04 MOV EAX,DWORD PTR DS:[EDX+4] 100039CE |. 8B12 MOV EDX,DWORD PTR DS:[EDX] 100039D0 |. 0FB7D9 MOVZX EBX,CX 100039D3 |. 25 FFFF0F00 AND EAX,0FFFFF 100039D8 |. 85DB TEST EBX,EBX 100039DA |. 74 13 JE SHORT jagmisc.100039EF 100039DC |. 3BDF CMP EBX,EDI 100039DE |. 74 08 JE SHORT jagmisc.100039E8 100039E0 |. 8DB9 003C0000 LEA EDI,DWORD PTR DS:[ECX+3C00] 100039E6 |. EB 28 JMP SHORT jagmisc.10003A10 100039E8 |> BF FF7F0000 MOV EDI,7FFF 100039ED |. EB 21 JMP SHORT jagmisc.10003A10 100039EF |> 33DB XOR EBX,EBX 100039F1 |. 3BC3 CMP EAX,EBX 100039F3 |. 75 12 JNZ SHORT jagmisc.10003A07 100039F5 |. 3BD3 CMP EDX,EBX 100039F7 |. 75 0E JNZ SHORT jagmisc.10003A07 100039F9 |. 8B45 08 MOV EAX,[ARG.1] 100039FC |. 8958 04 MOV DWORD PTR DS:[EAX+4],EBX 100039FF |. 8918 MOV DWORD PTR DS:[EAX],EBX 10003A01 |. 66:8958 08 MOV WORD PTR DS:[EAX+8],BX 10003A05 |. EB 4D JMP SHORT jagmisc.10003A54 10003A07 |> 8DB9 013C0000 LEA EDI,DWORD PTR DS:[ECX+3C01] 10003A0D |. 895D FC MOV [LOCAL.1],EBX 10003A10 |> 8BCA MOV ECX,EDX 10003A12 |. C1E9 15 SHR ECX,15 10003A15 |. C1E0 0B SHL EAX,0B 10003A18 |. 0BC8 OR ECX,EAX 10003A1A |. 0B4D FC OR ECX,[LOCAL.1] 10003A1D |. 8B45 08 MOV EAX,[ARG.1] 10003A20 |. C1E2 0B SHL EDX,0B 10003A23 |. 85CE TEST ESI,ECX 10003A25 |. 8948 04 MOV DWORD PTR DS:[EAX+4],ECX 10003A28 |. 8910 MOV DWORD PTR DS:[EAX],EDX 10003A2A |. 75 1F JNZ SHORT jagmisc.10003A4B 10003A2C |> 8B08 /MOV ECX,DWORD PTR DS:[EAX] 10003A2E |. 8B50 04 |MOV EDX,DWORD PTR DS:[EAX+4] 10003A31 |. 8BD9 |MOV EBX,ECX 10003A33 |. D1E2 |SHL EDX,1 10003A35 |. C1EB 1F |SHR EBX,1F 10003A38 |. 0BD3 |OR EDX,EBX 10003A3A |. 03C9 |ADD ECX,ECX 10003A3C |. 81C7 FFFF0000 |ADD EDI,0FFFF 10003A42 |. 85D6 |TEST ESI,EDX 10003A44 |. 8950 04 |MOV DWORD PTR DS:[EAX+4],EDX 10003A47 |. 8908 |MOV DWORD PTR DS:[EAX],ECX 10003A49 |.^ 74 E1 \JE SHORT jagmisc.10003A2C 10003A4B |> 8B4D 0C MOV ECX,[ARG.2] 10003A4E |. 0BCF OR ECX,EDI 10003A50 |. 66:8948 08 MOV WORD PTR DS:[EAX+8],CX 10003A54 |> 5F POP EDI ; kernel32.7C816FD7 10003A55 |. 5E POP ESI ; kernel32.7C816FD7 10003A56 |. 5B POP EBX ; kernel32.7C816FD7 10003A57 |. C9 LEAVE 10003A58 \. C3 RETN 10003A59 /$ 55 PUSH EBP 10003A5A |. 8BEC MOV EBP,ESP 10003A5C |. 83EC 2C SUB ESP,2C 10003A5F |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 10003A64 |. 8945 FC MOV [LOCAL.1],EAX 10003A67 |. 56 PUSH ESI 10003A68 |. 57 PUSH EDI 10003A69 |. 8D45 08 LEA EAX,[ARG.1] 10003A6C |. 50 PUSH EAX 10003A6D |. 8D45 F0 LEA EAX,[LOCAL.4] 10003A70 |. 50 PUSH EAX 10003A71 |. E8 29FFFFFF CALL jagmisc.1000399F 10003A76 |. 59 POP ECX ; kernel32.7C816FD7 10003A77 |. 59 POP ECX ; kernel32.7C816FD7 10003A78 |. 8D45 D4 LEA EAX,[LOCAL.11] 10003A7B |. 50 PUSH EAX 10003A7C |. 6A 00 PUSH 0 10003A7E |. 6A 11 PUSH 11 10003A80 |. 83EC 0C SUB ESP,0C 10003A83 |. 8D75 F0 LEA ESI,[LOCAL.4] 10003A86 |. 8BFC MOV EDI,ESP 10003A88 |. A5 MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10003A89 |. A5 MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10003A8A |. 66:A5 MOVS WORD PTR ES:[EDI],WORD PTR DS:[ESI] 10003A8C |. E8 A22A0000 CALL jagmisc.10006533 10003A91 |. 8B75 10 MOV ESI,[ARG.3] 10003A94 |. 8B7D 14 MOV EDI,[ARG.4] 10003A97 |. 8946 08 MOV DWORD PTR DS:[ESI+8],EAX 10003A9A |. 0FBE45 D6 MOVSX EAX,BYTE PTR SS:[EBP-2A] 10003A9E |. 8906 MOV DWORD PTR DS:[ESI],EAX 10003AA0 |. 0FBF45 D4 MOVSX EAX,WORD PTR SS:[EBP-2C] 10003AA4 |. 8946 04 MOV DWORD PTR DS:[ESI+4],EAX 10003AA7 |. 8D45 D8 LEA EAX,[LOCAL.10] 10003AAA |. 50 PUSH EAX 10003AAB |. 57 PUSH EDI 10003AAC |. E8 7FFDFFFF CALL jagmisc.10003830 10003AB1 |. 8B4D FC MOV ECX,[LOCAL.1] 10003AB4 |. 83C4 20 ADD ESP,20 10003AB7 |. 897E 0C MOV DWORD PTR DS:[ESI+C],EDI 10003ABA |. 8BC6 MOV EAX,ESI 10003ABC |. E8 35000000 CALL jagmisc.10003AF6 10003AC1 |. 5F POP EDI ; kernel32.7C816FD7 10003AC2 |. 5E POP ESI ; kernel32.7C816FD7 10003AC3 |. C9 LEAVE 10003AC4 \. C3 RETN 10003AC5 > 6A 08 PUSH 8 10003AC7 . 68 80860010 PUSH jagmisc.10008680 10003ACC . E8 9FE8FFFF CALL jagmisc.10002370 10003AD1 . 8365 FC 00 AND DWORD PTR SS:[EBP-4],0 10003AD5 . 6A 00 PUSH 0 10003AD7 . 6A 01 PUSH 1 10003AD9 . E8 492D0000 CALL jagmisc.10006827 10003ADE . 59 POP ECX ; kernel32.7C816FD7 10003ADF . 59 POP ECX ; kernel32.7C816FD7 10003AE0 . EB 07 JMP SHORT jagmisc.10003AE9 10003AE2 . 33C0 XOR EAX,EAX 10003AE4 . 40 INC EAX 10003AE5 . C3 RETN 10003AE6 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451 10003AE9 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10003AED . 6A 03 PUSH 3 ; /ExitCode = 3 10003AEF . FF15 6C800010 CALL DWORD PTR DS:[<&KERNEL32.ExitProcess>] ; \ExitProcess 10003AF5 CC INT3 10003AF6 $ 3B0D 60A30010 CMP ECX,DWORD PTR DS:[1000A360] 10003AFC . 75 01 JNZ SHORT jagmisc.10003AFF 10003AFE . C3 RETN 10003AFF >^ E9 C1FFFFFF JMP jagmisc.10003AC5 10003B04 CC INT3 10003B05 CC INT3 10003B06 CC INT3 10003B07 CC INT3 10003B08 CC INT3 10003B09 CC INT3 10003B0A CC INT3 10003B0B CC INT3 10003B0C CC INT3 10003B0D CC INT3 10003B0E CC INT3 10003B0F CC INT3 10003B10 /$ 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C] 10003B14 |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10003B18 |. 85D2 TEST EDX,EDX 10003B1A |. 74 4F JE SHORT jagmisc.10003B6B 10003B1C |. 33C0 XOR EAX,EAX 10003B1E |. 8A4424 08 MOV AL,BYTE PTR SS:[ESP+8] 10003B22 |. 57 PUSH EDI 10003B23 |. 8BF9 MOV EDI,ECX 10003B25 |. 83FA 04 CMP EDX,4 10003B28 |. 72 31 JB SHORT jagmisc.10003B5B 10003B2A |. F7D9 NEG ECX 10003B2C |. 83E1 03 AND ECX,3 10003B2F |. 74 0C JE SHORT jagmisc.10003B3D 10003B31 |. 2BD1 SUB EDX,ECX 10003B33 |> 8807 /MOV BYTE PTR DS:[EDI],AL 10003B35 |. 83C7 01 |ADD EDI,1 10003B38 |. 83E9 01 |SUB ECX,1 10003B3B |.^ 75 F6 \JNZ SHORT jagmisc.10003B33 10003B3D |> 8BC8 MOV ECX,EAX 10003B3F |. C1E0 08 SHL EAX,8 10003B42 |. 03C1 ADD EAX,ECX 10003B44 |. 8BC8 MOV ECX,EAX 10003B46 |. C1E0 10 SHL EAX,10 10003B49 |. 03C1 ADD EAX,ECX 10003B4B |. 8BCA MOV ECX,EDX 10003B4D |. 83E2 03 AND EDX,3 10003B50 |. C1E9 02 SHR ECX,2 10003B53 |. 74 06 JE SHORT jagmisc.10003B5B 10003B55 |. F3:AB REP STOS DWORD PTR ES:[EDI] 10003B57 |. 85D2 TEST EDX,EDX 10003B59 |. 74 0A JE SHORT jagmisc.10003B65 10003B5B |> 8807 /MOV BYTE PTR DS:[EDI],AL 10003B5D |. 83C7 01 |ADD EDI,1 10003B60 |. 83EA 01 |SUB EDX,1 10003B63 |.^ 75 F6 \JNZ SHORT jagmisc.10003B5B 10003B65 |> 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 10003B69 |. 5F POP EDI ; kernel32.7C816FD7 10003B6A |. C3 RETN 10003B6B |> 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10003B6F \. C3 RETN 10003B70 . 6A 02 PUSH 2 10003B72 . E8 A4DCFFFF CALL jagmisc.1000181B 10003B77 . 59 POP ECX ; kernel32.7C816FD7 10003B78 . C3 RETN 10003B79 /$ 33C0 XOR EAX,EAX 10003B7B |. F6C3 01 TEST BL,1 10003B7E |. 74 03 JE SHORT jagmisc.10003B83 10003B80 |. 6A 10 PUSH 10 10003B82 |. 58 POP EAX ; kernel32.7C816FD7 10003B83 |> F6C3 04 TEST BL,4 10003B86 |. 74 03 JE SHORT jagmisc.10003B8B 10003B88 |. 83C8 08 OR EAX,8 10003B8B |> F6C3 08 TEST BL,8 10003B8E |. 74 03 JE SHORT jagmisc.10003B93 10003B90 |. 83C8 04 OR EAX,4 10003B93 |> F6C3 10 TEST BL,10 10003B96 |. 74 03 JE SHORT jagmisc.10003B9B 10003B98 |. 83C8 02 OR EAX,2 10003B9B |> F6C3 20 TEST BL,20 10003B9E |. 74 03 JE SHORT jagmisc.10003BA3 10003BA0 |. 83C8 01 OR EAX,1 10003BA3 |> F6C3 02 TEST BL,2 10003BA6 |. 74 05 JE SHORT jagmisc.10003BAD 10003BA8 |. 0D 00000800 OR EAX,80000 10003BAD |> 55 PUSH EBP 10003BAE |. 0FB7D3 MOVZX EDX,BX 10003BB1 |. 56 PUSH ESI 10003BB2 |. 8BCA MOV ECX,EDX 10003BB4 |. BE 000C0000 MOV ESI,0C00 10003BB9 |. 23CE AND ECX,ESI 10003BBB |. 57 PUSH EDI 10003BBC |. BF 00030000 MOV EDI,300 10003BC1 |. BD 00020000 MOV EBP,200 10003BC6 |. 74 21 JE SHORT jagmisc.10003BE9 10003BC8 |. 81F9 00040000 CMP ECX,400 10003BCE |. 74 14 JE SHORT jagmisc.10003BE4 10003BD0 |. 81F9 00080000 CMP ECX,800 10003BD6 |. 74 08 JE SHORT jagmisc.10003BE0 10003BD8 |. 3BCE CMP ECX,ESI 10003BDA |. 75 0D JNZ SHORT jagmisc.10003BE9 10003BDC |. 0BC7 OR EAX,EDI 10003BDE |. EB 09 JMP SHORT jagmisc.10003BE9 10003BE0 |> 0BC5 OR EAX,EBP 10003BE2 |. EB 05 JMP SHORT jagmisc.10003BE9 10003BE4 |> 0D 00010000 OR EAX,100 10003BE9 |> 23D7 AND EDX,EDI 10003BEB |. 74 0B JE SHORT jagmisc.10003BF8 10003BED |. 3BD5 CMP EDX,EBP 10003BEF |. 75 0C JNZ SHORT jagmisc.10003BFD 10003BF1 |. 0D 00000100 OR EAX,10000 10003BF6 |. EB 05 JMP SHORT jagmisc.10003BFD 10003BF8 |> 0D 00000200 OR EAX,20000 10003BFD |> F6C7 10 TEST BH,10 10003C00 |. 5F POP EDI ; kernel32.7C816FD7 10003C01 |. 5E POP ESI ; kernel32.7C816FD7 10003C02 |. 5D POP EBP ; kernel32.7C816FD7 10003C03 |. 74 05 JE SHORT jagmisc.10003C0A 10003C05 |. 0D 00000400 OR EAX,40000 10003C0A \> C3 RETN 10003C0B /$ 33C0 XOR EAX,EAX 10003C0D |. F6C3 10 TEST BL,10 10003C10 |. 74 01 JE SHORT jagmisc.10003C13 10003C12 |. 40 INC EAX 10003C13 |> F6C3 08 TEST BL,8 10003C16 |. 74 03 JE SHORT jagmisc.10003C1B 10003C18 |. 83C8 04 OR EAX,4 10003C1B |> F6C3 04 TEST BL,4 10003C1E |. 74 03 JE SHORT jagmisc.10003C23 10003C20 |. 83C8 08 OR EAX,8 10003C23 |> F6C3 02 TEST BL,2 10003C26 |. 74 03 JE SHORT jagmisc.10003C2B 10003C28 |. 83C8 10 OR EAX,10 10003C2B |> F6C3 01 TEST BL,1 10003C2E |. 74 03 JE SHORT jagmisc.10003C33 10003C30 |. 83C8 20 OR EAX,20 10003C33 |> F7C3 00000800 TEST EBX,80000 10003C39 |. 74 03 JE SHORT jagmisc.10003C3E 10003C3B |. 83C8 02 OR EAX,2 10003C3E |> 8BCB MOV ECX,EBX 10003C40 |. BA 00030000 MOV EDX,300 10003C45 |. 23CA AND ECX,EDX 10003C47 |. 56 PUSH ESI 10003C48 |. BE 00020000 MOV ESI,200 10003C4D |. 74 23 JE SHORT jagmisc.10003C72 10003C4F |. 81F9 00010000 CMP ECX,100 10003C55 |. 74 16 JE SHORT jagmisc.10003C6D 10003C57 |. 3BCE CMP ECX,ESI 10003C59 |. 74 0B JE SHORT jagmisc.10003C66 10003C5B |. 3BCA CMP ECX,EDX 10003C5D |. 75 13 JNZ SHORT jagmisc.10003C72 10003C5F |. 0D 000C0000 OR EAX,0C00 10003C64 |. EB 0C JMP SHORT jagmisc.10003C72 10003C66 |> 0D 00080000 OR EAX,800 10003C6B |. EB 05 JMP SHORT jagmisc.10003C72 10003C6D |> 0D 00040000 OR EAX,400 10003C72 |> 8BCB MOV ECX,EBX 10003C74 |. 81E1 00000300 AND ECX,30000 10003C7A |. 74 0C JE SHORT jagmisc.10003C88 10003C7C |. 81F9 00000100 CMP ECX,10000 ; UNICODE "=::=::\\" 10003C82 |. 75 06 JNZ SHORT jagmisc.10003C8A 10003C84 |. 0BC6 OR EAX,ESI 10003C86 |. EB 02 JMP SHORT jagmisc.10003C8A 10003C88 |> 0BC2 OR EAX,EDX 10003C8A |> F7C3 00000400 TEST EBX,40000 10003C90 |. 5E POP ESI ; kernel32.7C816FD7 10003C91 |. 74 05 JE SHORT jagmisc.10003C98 10003C93 |. 0D 00100000 OR EAX,1000 10003C98 \> C3 RETN 10003C99 /$ 55 PUSH EBP 10003C9A |. 8BEC MOV EBP,ESP 10003C9C |. 51 PUSH ECX 10003C9D |. 53 PUSH EBX 10003C9E |. 9B WAIT 10003C9F |. D97D FC FSTCW WORD PTR SS:[EBP-4] 10003CA2 |. 8B5D FC MOV EBX,[LOCAL.1] 10003CA5 |. E8 CFFEFFFF CALL jagmisc.10003B79 10003CAA |. 8BD8 MOV EBX,EAX 10003CAC |. 8B45 0C MOV EAX,[ARG.2] 10003CAF |. F7D0 NOT EAX 10003CB1 |. 23D8 AND EBX,EAX 10003CB3 |. 8B45 08 MOV EAX,[ARG.1] 10003CB6 |. 2345 0C AND EAX,[ARG.2] 10003CB9 |. 0BD8 OR EBX,EAX 10003CBB |. E8 4BFFFFFF CALL jagmisc.10003C0B 10003CC0 |. 8945 0C MOV [ARG.2],EAX 10003CC3 |. D96D 0C FLDCW WORD PTR SS:[EBP+C] 10003CC6 |. 8BC3 MOV EAX,EBX 10003CC8 |. 5B POP EBX ; kernel32.7C816FD7 10003CC9 |. C9 LEAVE 10003CCA \. C3 RETN 10003CCB /$ 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 10003CCF |. 25 FFFFF7FF AND EAX,FFF7FFFF 10003CD4 |. 50 PUSH EAX 10003CD5 |. FF7424 08 PUSH DWORD PTR SS:[ESP+8] 10003CD9 |. E8 BBFFFFFF CALL jagmisc.10003C99 10003CDE |. 59 POP ECX ; kernel32.7C816FD7 10003CDF |. 59 POP ECX ; kernel32.7C816FD7 10003CE0 \. C3 RETN 10003CE1 /$ 56 PUSH ESI 10003CE2 |. 57 PUSH EDI 10003CE3 |. 33F6 XOR ESI,ESI 10003CE5 |. BF E0AD0010 MOV EDI,jagmisc.1000ADE0 10003CEA |> 833CF5 74A30010 0>/CMP DWORD PTR DS:[ESI*8+1000A374],1 10003CF2 |. 75 1E |JNZ SHORT jagmisc.10003D12 10003CF4 |. 8D04F5 70A30010 |LEA EAX,DWORD PTR DS:[ESI*8+1000A370] 10003CFB |. 8938 |MOV DWORD PTR DS:[EAX],EDI 10003CFD |. 68 A00F0000 |PUSH 0FA0 10003D02 |. FF30 |PUSH DWORD PTR DS:[EAX] 10003D04 |. 83C7 18 |ADD EDI,18 10003D07 |. E8 5E170000 |CALL jagmisc.1000546A 10003D0C |. 85C0 |TEST EAX,EAX 10003D0E |. 59 |POP ECX ; kernel32.7C816FD7 10003D0F |. 59 |POP ECX ; kernel32.7C816FD7 10003D10 |. 74 0C |JE SHORT jagmisc.10003D1E 10003D12 |> 46 |INC ESI 10003D13 |. 83FE 24 |CMP ESI,24 10003D16 |.^ 7C D2 \JL SHORT jagmisc.10003CEA 10003D18 |. 33C0 XOR EAX,EAX 10003D1A |. 40 INC EAX 10003D1B |> 5F POP EDI ; kernel32.7C816FD7 10003D1C |. 5E POP ESI ; kernel32.7C816FD7 10003D1D |. C3 RETN 10003D1E |> 8324F5 70A30010 0>AND DWORD PTR DS:[ESI*8+1000A370],0 10003D26 |. 33C0 XOR EAX,EAX 10003D28 \.^ EB F1 JMP SHORT jagmisc.10003D1B 10003D2A > 53 PUSH EBX 10003D2B . 8B1D 18800010 MOV EBX,DWORD PTR DS:[<&KERNEL32.DeleteCriticalSection>] ; ntdll.RtlDeleteCriticalSection 10003D31 . 56 PUSH ESI 10003D32 . BE 70A30010 MOV ESI,jagmisc.1000A370 10003D37 . 57 PUSH EDI 10003D38 > 8B3E MOV EDI,DWORD PTR DS:[ESI] 10003D3A . 85FF TEST EDI,EDI 10003D3C . 74 13 JE SHORT jagmisc.10003D51 10003D3E . 837E 04 01 CMP DWORD PTR DS:[ESI+4],1 10003D42 . 74 0D JE SHORT jagmisc.10003D51 10003D44 . 57 PUSH EDI 10003D45 . FFD3 CALL EBX 10003D47 . 57 PUSH EDI 10003D48 . E8 B0E5FFFF CALL jagmisc.100022FD 10003D4D . 8326 00 AND DWORD PTR DS:[ESI],0 10003D50 . 59 POP ECX ; kernel32.7C816FD7 10003D51 > 83C6 08 ADD ESI,8 10003D54 . 81FE 90A40010 CMP ESI,jagmisc.1000A490 10003D5A .^ 7C DC JL SHORT jagmisc.10003D38 10003D5C . BE 70A30010 MOV ESI,jagmisc.1000A370 10003D61 . 5F POP EDI ; kernel32.7C816FD7 10003D62 > 8B06 MOV EAX,DWORD PTR DS:[ESI] 10003D64 . 85C0 TEST EAX,EAX 10003D66 . 74 09 JE SHORT jagmisc.10003D71 10003D68 . 837E 04 01 CMP DWORD PTR DS:[ESI+4],1 10003D6C . 75 03 JNZ SHORT jagmisc.10003D71 10003D6E . 50 PUSH EAX 10003D6F . FFD3 CALL EBX 10003D71 > 83C6 08 ADD ESI,8 10003D74 . 81FE 90A40010 CMP ESI,jagmisc.1000A490 10003D7A .^ 7C E6 JL SHORT jagmisc.10003D62 10003D7C . 5E POP ESI ; kernel32.7C816FD7 10003D7D . 5B POP EBX ; kernel32.7C816FD7 10003D7E . C3 RETN 10003D7F /$ 55 PUSH EBP 10003D80 |. 8BEC MOV EBP,ESP 10003D82 |. 8B45 08 MOV EAX,[ARG.1] 10003D85 |. FF34C5 70A30010 PUSH DWORD PTR DS:[EAX*8+1000A370] ; /pCriticalSection = jagmisc.1000AE70 10003D8C |. FF15 2C800010 CALL DWORD PTR DS:[<&KERNEL32.LeaveCriticalSection>] ; \LeaveCriticalSection 10003D92 |. 5D POP EBP ; kernel32.7C816FD7 10003D93 \. C3 RETN 10003D94 /$ 6A 08 PUSH 8 10003D96 |. 68 90860010 PUSH jagmisc.10008690 10003D9B |. E8 D0E5FFFF CALL jagmisc.10002370 10003DA0 |. 8B75 08 MOV ESI,[ARG.1] 10003DA3 |. 8D34F5 70A30010 LEA ESI,DWORD PTR DS:[ESI*8+1000A370] 10003DAA |. 33DB XOR EBX,EBX 10003DAC |. 391E CMP DWORD PTR DS:[ESI],EBX 10003DAE |. 75 72 JNZ SHORT jagmisc.10003E22 10003DB0 |. 6A 18 PUSH 18 10003DB2 |. E8 E5170000 CALL jagmisc.1000559C 10003DB7 |. 59 POP ECX ; kernel32.7C816FD7 10003DB8 |. 8BF8 MOV EDI,EAX 10003DBA |. 3BFB CMP EDI,EBX 10003DBC |. 75 0D JNZ SHORT jagmisc.10003DCB 10003DBE |. E8 02E7FFFF CALL jagmisc.100024C5 10003DC3 |. C700 0C000000 MOV DWORD PTR DS:[EAX],0C 10003DC9 |. EB 3F JMP SHORT jagmisc.10003E0A 10003DCB |> 6A 0A PUSH 0A ; /Arg1 = 0000000A 10003DCD |. E8 62000000 CALL jagmisc.10003E34 ; \jagmisc.10003E34 10003DD2 |. 59 POP ECX ; kernel32.7C816FD7 10003DD3 |. 895D FC MOV [LOCAL.1],EBX 10003DD6 |. 391E CMP DWORD PTR DS:[ESI],EBX 10003DD8 |. 75 38 JNZ SHORT jagmisc.10003E12 10003DDA |. 68 A00F0000 PUSH 0FA0 10003DDF |. 57 PUSH EDI 10003DE0 |. E8 85160000 CALL jagmisc.1000546A 10003DE5 |. 59 POP ECX ; kernel32.7C816FD7 10003DE6 |. 59 POP ECX ; kernel32.7C816FD7 10003DE7 |. 85C0 TEST EAX,EAX 10003DE9 |. 75 23 JNZ SHORT jagmisc.10003E0E 10003DEB |. 57 PUSH EDI 10003DEC |. E8 0CE5FFFF CALL jagmisc.100022FD 10003DF1 |. E8 CFE6FFFF CALL jagmisc.100024C5 10003DF6 |. C700 0C000000 MOV DWORD PTR DS:[EAX],0C 10003DFC |. 6A FF PUSH -1 10003DFE |. 8D45 F0 LEA EAX,[LOCAL.4] 10003E01 |. 50 PUSH EAX 10003E02 |. E8 63130000 CALL jagmisc.1000516A 10003E07 |. 83C4 0C ADD ESP,0C 10003E0A |> 33C0 XOR EAX,EAX 10003E0C |. EB 17 JMP SHORT jagmisc.10003E25 10003E0E |> 893E MOV DWORD PTR DS:[ESI],EDI 10003E10 |. EB 07 JMP SHORT jagmisc.10003E19 10003E12 |> 57 PUSH EDI 10003E13 |. E8 E5E4FFFF CALL jagmisc.100022FD 10003E18 |. 59 POP ECX ; kernel32.7C816FD7 10003E19 |> 834D FC FF OR [LOCAL.1],FFFFFFFF 10003E1D |. E8 09000000 CALL jagmisc.10003E2B 10003E22 |> 33C0 XOR EAX,EAX 10003E24 |. 40 INC EAX 10003E25 |> E8 81E5FFFF CALL jagmisc.100023AB 10003E2A \. C3 RETN 10003E2B /$ 6A 0A PUSH 0A 10003E2D |. E8 4DFFFFFF CALL jagmisc.10003D7F 10003E32 |. 59 POP ECX ; kernel32.7C816FD7 10003E33 \. C3 RETN 10003E34 /$ 55 PUSH EBP 10003E35 |. 8BEC MOV EBP,ESP 10003E37 |. 8B45 08 MOV EAX,[ARG.1] 10003E3A |. 56 PUSH ESI 10003E3B |. 8D34C5 70A30010 LEA ESI,DWORD PTR DS:[EAX*8+1000A370] 10003E42 |. 833E 00 CMP DWORD PTR DS:[ESI],0 10003E45 |. 75 13 JNZ SHORT jagmisc.10003E5A 10003E47 |. 50 PUSH EAX 10003E48 |. E8 47FFFFFF CALL jagmisc.10003D94 10003E4D |. 85C0 TEST EAX,EAX 10003E4F |. 59 POP ECX ; kernel32.7C816FD7 10003E50 |. 75 08 JNZ SHORT jagmisc.10003E5A 10003E52 |. 6A 11 PUSH 11 10003E54 |. E8 C2D9FFFF CALL jagmisc.1000181B 10003E59 |. 59 POP ECX ; kernel32.7C816FD7 10003E5A |> FF36 PUSH DWORD PTR DS:[ESI] ; /pCriticalSection 10003E5C |. FF15 30800010 CALL DWORD PTR DS:[<&KERNEL32.EnterCriticalSection>] ; \EnterCriticalSection 10003E62 |. 5E POP ESI ; kernel32.7C816FD7 10003E63 |. 5D POP EBP ; kernel32.7C816FD7 10003E64 \. C3 RETN 10003E65 /$ 56 PUSH ESI 10003E66 |. 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 10003E6A |. 8B46 3C MOV EAX,DWORD PTR DS:[ESI+3C] 10003E6D |. 57 PUSH EDI 10003E6E |. 33FF XOR EDI,EDI 10003E70 |. 3B05 D0AF0010 CMP EAX,DWORD PTR DS:[1000AFD0] 10003E76 |. 74 63 JE SHORT jagmisc.10003EDB 10003E78 |. 3BC7 CMP EAX,EDI 10003E7A |. 74 5F JE SHORT jagmisc.10003EDB 10003E7C |. 8B46 2C MOV EAX,DWORD PTR DS:[ESI+2C] 10003E7F |. 3938 CMP DWORD PTR DS:[EAX],EDI 10003E81 |. 75 58 JNZ SHORT jagmisc.10003EDB 10003E83 |. 8B46 34 MOV EAX,DWORD PTR DS:[ESI+34] 10003E86 |. 3BC7 CMP EAX,EDI 10003E88 |. 74 1C JE SHORT jagmisc.10003EA6 10003E8A |. 3938 CMP DWORD PTR DS:[EAX],EDI 10003E8C |. 75 18 JNZ SHORT jagmisc.10003EA6 10003E8E |. 3B05 10B10010 CMP EAX,DWORD PTR DS:[1000B110] 10003E94 |. 74 10 JE SHORT jagmisc.10003EA6 10003E96 |. 50 PUSH EAX 10003E97 |. E8 61E4FFFF CALL jagmisc.100022FD 10003E9C |. FF76 3C PUSH DWORD PTR DS:[ESI+3C] 10003E9F |. E8 BA2C0000 CALL jagmisc.10006B5E 10003EA4 |. 59 POP ECX ; kernel32.7C816FD7 10003EA5 |. 59 POP ECX ; kernel32.7C816FD7 10003EA6 |> 8B46 30 MOV EAX,DWORD PTR DS:[ESI+30] 10003EA9 |. 3BC7 CMP EAX,EDI 10003EAB |. 74 1C JE SHORT jagmisc.10003EC9 10003EAD |. 3938 CMP DWORD PTR DS:[EAX],EDI 10003EAF |. 75 18 JNZ SHORT jagmisc.10003EC9 10003EB1 |. 3B05 14B10010 CMP EAX,DWORD PTR DS:[1000B114] 10003EB7 |. 74 10 JE SHORT jagmisc.10003EC9 10003EB9 |. 50 PUSH EAX 10003EBA |. E8 3EE4FFFF CALL jagmisc.100022FD 10003EBF |. FF76 3C PUSH DWORD PTR DS:[ESI+3C] 10003EC2 |. E8 382C0000 CALL jagmisc.10006AFF 10003EC7 |. 59 POP ECX ; kernel32.7C816FD7 10003EC8 |. 59 POP ECX ; kernel32.7C816FD7 10003EC9 |> FF76 2C PUSH DWORD PTR DS:[ESI+2C] 10003ECC |. E8 2CE4FFFF CALL jagmisc.100022FD 10003ED1 |. FF76 3C PUSH DWORD PTR DS:[ESI+3C] 10003ED4 |. E8 24E4FFFF CALL jagmisc.100022FD 10003ED9 |. 59 POP ECX ; kernel32.7C816FD7 10003EDA |. 59 POP ECX ; kernel32.7C816FD7 10003EDB |> 8B46 40 MOV EAX,DWORD PTR DS:[ESI+40] 10003EDE |. 3B05 0CB10010 CMP EAX,DWORD PTR DS:[1000B10C] 10003EE4 |. 74 1E JE SHORT jagmisc.10003F04 10003EE6 |. 3BC7 CMP EAX,EDI 10003EE8 |. 74 1A JE SHORT jagmisc.10003F04 10003EEA |. 3938 CMP DWORD PTR DS:[EAX],EDI 10003EEC |. 75 16 JNZ SHORT jagmisc.10003F04 10003EEE |. 50 PUSH EAX 10003EEF |. E8 09E4FFFF CALL jagmisc.100022FD 10003EF4 |. 8B46 44 MOV EAX,DWORD PTR DS:[ESI+44] 10003EF7 |. 2D FE000000 SUB EAX,0FE 10003EFC |. 50 PUSH EAX 10003EFD |. E8 FBE3FFFF CALL jagmisc.100022FD 10003F02 |. 59 POP ECX ; kernel32.7C816FD7 10003F03 |. 59 POP ECX ; kernel32.7C816FD7 10003F04 |> 8B46 50 MOV EAX,DWORD PTR DS:[ESI+50] 10003F07 |. 3B05 CCAF0010 CMP EAX,DWORD PTR DS:[1000AFCC] 10003F0D |. 74 1C JE SHORT jagmisc.10003F2B 10003F0F |. 3BC7 CMP EAX,EDI 10003F11 |. 74 18 JE SHORT jagmisc.10003F2B 10003F13 |. 39B8 B4000000 CMP DWORD PTR DS:[EAX+B4],EDI 10003F19 |. 75 10 JNZ SHORT jagmisc.10003F2B 10003F1B |. 50 PUSH EAX 10003F1C |. E8 4E2A0000 CALL jagmisc.1000696F 10003F21 |. FF76 50 PUSH DWORD PTR DS:[ESI+50] 10003F24 |. E8 D4E3FFFF CALL jagmisc.100022FD 10003F29 |. 59 POP ECX ; kernel32.7C816FD7 10003F2A |. 59 POP ECX ; kernel32.7C816FD7 10003F2B |> 56 PUSH ESI 10003F2C |. E8 CCE3FFFF CALL jagmisc.100022FD 10003F31 |. 59 POP ECX ; kernel32.7C816FD7 10003F32 |. 5F POP EDI ; kernel32.7C816FD7 10003F33 |. 5E POP ESI ; kernel32.7C816FD7 10003F34 \. C3 RETN 10003F35 /$ 56 PUSH ESI 10003F36 |. E8 C6DDFFFF CALL jagmisc.10001D01 10003F3B |. 8BF0 MOV ESI,EAX 10003F3D |. 8B4E 64 MOV ECX,DWORD PTR DS:[ESI+64] 10003F40 |. 3B0D ECA40010 CMP ECX,DWORD PTR DS:[1000A4EC] ; jagmisc.1000A498 10003F46 |. 0F84 A5000000 JE jagmisc.10003FF1 10003F4C |. 33D2 XOR EDX,EDX 10003F4E |. 3BCA CMP ECX,EDX 10003F50 |. 74 2F JE SHORT jagmisc.10003F81 10003F52 |. 8B41 2C MOV EAX,DWORD PTR DS:[ECX+2C] 10003F55 |. FF09 DEC DWORD PTR DS:[ECX] 10003F57 |. 3BC2 CMP EAX,EDX 10003F59 |. 74 02 JE SHORT jagmisc.10003F5D 10003F5B |. FF08 DEC DWORD PTR DS:[EAX] 10003F5D |> 8B41 34 MOV EAX,DWORD PTR DS:[ECX+34] 10003F60 |. 3BC2 CMP EAX,EDX 10003F62 |. 74 02 JE SHORT jagmisc.10003F66 10003F64 |. FF08 DEC DWORD PTR DS:[EAX] 10003F66 |> 8B41 30 MOV EAX,DWORD PTR DS:[ECX+30] 10003F69 |. 3BC2 CMP EAX,EDX 10003F6B |. 74 02 JE SHORT jagmisc.10003F6F 10003F6D |. FF08 DEC DWORD PTR DS:[EAX] 10003F6F |> 8B41 40 MOV EAX,DWORD PTR DS:[ECX+40] 10003F72 |. 3BC2 CMP EAX,EDX 10003F74 |. 74 02 JE SHORT jagmisc.10003F78 10003F76 |. FF08 DEC DWORD PTR DS:[EAX] 10003F78 |> 8B41 4C MOV EAX,DWORD PTR DS:[ECX+4C] 10003F7B |. FF88 B4000000 DEC DWORD PTR DS:[EAX+B4] 10003F81 |> A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC] 10003F86 |. 8946 64 MOV DWORD PTR DS:[ESI+64],EAX 10003F89 |. A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC] 10003F8E |. FF00 INC DWORD PTR DS:[EAX] 10003F90 |. A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC] 10003F95 |. 3950 2C CMP DWORD PTR DS:[EAX+2C],EDX 10003F98 |. 74 0A JE SHORT jagmisc.10003FA4 10003F9A |. 8B40 2C MOV EAX,DWORD PTR DS:[EAX+2C] 10003F9D |. FF00 INC DWORD PTR DS:[EAX] 10003F9F |. A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC] 10003FA4 |> 3950 34 CMP DWORD PTR DS:[EAX+34],EDX 10003FA7 |. 74 0A JE SHORT jagmisc.10003FB3 10003FA9 |. 8B40 34 MOV EAX,DWORD PTR DS:[EAX+34] 10003FAC |. FF00 INC DWORD PTR DS:[EAX] 10003FAE |. A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC] 10003FB3 |> 3950 30 CMP DWORD PTR DS:[EAX+30],EDX 10003FB6 |. 74 0A JE SHORT jagmisc.10003FC2 10003FB8 |. 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30] 10003FBB |. FF00 INC DWORD PTR DS:[EAX] 10003FBD |. A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC] 10003FC2 |> 3950 40 CMP DWORD PTR DS:[EAX+40],EDX 10003FC5 |. 74 0A JE SHORT jagmisc.10003FD1 10003FC7 |. 8B40 40 MOV EAX,DWORD PTR DS:[EAX+40] 10003FCA |. FF00 INC DWORD PTR DS:[EAX] 10003FCC |. A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC] 10003FD1 |> 8B40 4C MOV EAX,DWORD PTR DS:[EAX+4C] 10003FD4 |. FF80 B4000000 INC DWORD PTR DS:[EAX+B4] 10003FDA |. 3BCA CMP ECX,EDX 10003FDC |. 74 13 JE SHORT jagmisc.10003FF1 10003FDE |. 3911 CMP DWORD PTR DS:[ECX],EDX 10003FE0 |. 75 0F JNZ SHORT jagmisc.10003FF1 10003FE2 |. 81F9 98A40010 CMP ECX,jagmisc.1000A498 10003FE8 |. 74 07 JE SHORT jagmisc.10003FF1 10003FEA |. 51 PUSH ECX 10003FEB |. E8 75FEFFFF CALL jagmisc.10003E65 10003FF0 |. 59 POP ECX ; kernel32.7C816FD7 10003FF1 |> 8B46 64 MOV EAX,DWORD PTR DS:[ESI+64] 10003FF4 |. 5E POP ESI ; kernel32.7C816FD7 10003FF5 \. C3 RETN 10003FF6 /$ 6A 0C PUSH 0C 10003FF8 |. 68 20880010 PUSH jagmisc.10008820 10003FFD |. E8 6EE3FFFF CALL jagmisc.10002370 10004002 |. 6A 0C PUSH 0C ; /Arg1 = 0000000C 10004004 |. E8 2BFEFFFF CALL jagmisc.10003E34 ; \jagmisc.10003E34 10004009 |. 59 POP ECX ; kernel32.7C816FD7 1000400A |. 8365 FC 00 AND [LOCAL.1],0 1000400E |. E8 22FFFFFF CALL jagmisc.10003F35 10004013 |. 8945 E4 MOV [LOCAL.7],EAX 10004016 |. 834D FC FF OR [LOCAL.1],FFFFFFFF 1000401A |. E8 09000000 CALL jagmisc.10004028 1000401F |. 8B45 E4 MOV EAX,[LOCAL.7] 10004022 |. E8 84E3FFFF CALL jagmisc.100023AB 10004027 \. C3 RETN 10004028 /$ 6A 0C PUSH 0C 1000402A |. E8 50FDFFFF CALL jagmisc.10003D7F 1000402F |. 59 POP ECX ; kernel32.7C816FD7 10004030 \. C3 RETN 10004031 /$ 2D A4030000 SUB EAX,3A4 10004036 |. 74 22 JE SHORT jagmisc.1000405A 10004038 |. 83E8 04 SUB EAX,4 ; Switch (cases 4..12) 1000403B |. 74 17 JE SHORT jagmisc.10004054 1000403D |. 83E8 0D SUB EAX,0D 10004040 |. 74 0C JE SHORT jagmisc.1000404E 10004042 |. 48 DEC EAX 10004043 |. 74 03 JE SHORT jagmisc.10004048 10004045 |. 33C0 XOR EAX,EAX ; Default case of switch 10004038 10004047 |. C3 RETN 10004048 |> B8 04040000 MOV EAX,404 ; Case 12 of switch 10004038 1000404D |. C3 RETN 1000404E |> B8 12040000 MOV EAX,412 ; Case 11 of switch 10004038 10004053 |. C3 RETN 10004054 |> B8 04080000 MOV EAX,804 ; Case 4 of switch 10004038 10004059 |. C3 RETN 1000405A |> B8 11040000 MOV EAX,411 1000405F \. C3 RETN 10004060 /$ 57 PUSH EDI 10004061 |. 6A 40 PUSH 40 10004063 |. 33C0 XOR EAX,EAX 10004065 |. 59 POP ECX ; kernel32.7C816FD7 10004066 |. BF 40B10010 MOV EDI,jagmisc.1000B140 1000406B |. F3:AB REP STOS DWORD PTR ES:[EDI] 1000406D |. AA STOS BYTE PTR ES:[EDI] 1000406E |. 33C0 XOR EAX,EAX 10004070 |. A3 44B20010 MOV DWORD PTR DS:[1000B244],EAX 10004075 |. A3 3CB10010 MOV DWORD PTR DS:[1000B13C],EAX 1000407A |. A3 34B10010 MOV DWORD PTR DS:[1000B134],EAX 1000407F |. BF 50B20010 MOV EDI,jagmisc.1000B250 10004084 |. AB STOS DWORD PTR ES:[EDI] 10004085 |. AB STOS DWORD PTR ES:[EDI] 10004086 |. AB STOS DWORD PTR ES:[EDI] 10004087 |. 5F POP EDI ; kernel32.7C816FD7 10004088 \. C3 RETN 10004089 /$ 55 PUSH EBP 1000408A |. 8BEC MOV EBP,ESP 1000408C |. 81EC 18050000 SUB ESP,518 10004092 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 10004097 |. 8945 FC MOV [LOCAL.1],EAX 1000409A |. 56 PUSH ESI 1000409B |. 8D45 E8 LEA EAX,[LOCAL.6] 1000409E |. 50 PUSH EAX ; /pCPInfo = 00000008 1000409F |. FF35 44B20010 PUSH DWORD PTR DS:[1000B244] ; |CodePage = 4E4 100040A5 |. FF15 C4800010 CALL DWORD PTR DS:[<&KERNEL32.GetCPInfo>] ; \GetCPInfo 100040AB |. 83F8 01 CMP EAX,1 100040AE |. BE 00010000 MOV ESI,100 100040B3 |. 0F85 0D010000 JNZ jagmisc.100041C6 100040B9 |. 33C0 XOR EAX,EAX 100040BB |> 888405 E8FEFFFF /MOV BYTE PTR SS:[EBP+EAX-118],AL 100040C2 |. 40 |INC EAX 100040C3 |. 3BC6 |CMP EAX,ESI 100040C5 |.^ 72 F4 \JB SHORT jagmisc.100040BB 100040C7 |. 8A45 EE MOV AL,BYTE PTR SS:[EBP-12] 100040CA |. 84C0 TEST AL,AL 100040CC |. C685 E8FEFFFF 20 MOV BYTE PTR SS:[EBP-118],20 100040D3 |. 74 36 JE SHORT jagmisc.1000410B 100040D5 |. 53 PUSH EBX 100040D6 |. 8D55 EF LEA EDX,DWORD PTR SS:[EBP-11] 100040D9 |. 57 PUSH EDI 100040DA |> 0FB60A /MOVZX ECX,BYTE PTR DS:[EDX] 100040DD |. 0FB6C0 |MOVZX EAX,AL 100040E0 |. 3BC1 |CMP EAX,ECX 100040E2 |. 77 1D |JA SHORT jagmisc.10004101 100040E4 |. 2BC8 |SUB ECX,EAX 100040E6 |. 41 |INC ECX 100040E7 |. 8BD9 |MOV EBX,ECX 100040E9 |. C1E9 02 |SHR ECX,2 100040EC |. 8DBC05 E8FEFFFF |LEA EDI,DWORD PTR SS:[EBP+EAX-118] 100040F3 |. B8 20202020 |MOV EAX,20202020 100040F8 |. F3:AB |REP STOS DWORD PTR ES:[EDI] 100040FA |. 8BCB |MOV ECX,EBX 100040FC |. 83E1 03 |AND ECX,3 100040FF |. F3:AA |REP STOS BYTE PTR ES:[EDI] 10004101 |> 42 |INC EDX 10004102 |. 8A02 |MOV AL,BYTE PTR DS:[EDX] 10004104 |. 42 |INC EDX 10004105 |. 84C0 |TEST AL,AL 10004107 |.^ 75 D1 \JNZ SHORT jagmisc.100040DA 10004109 |. 5F POP EDI ; kernel32.7C816FD7 1000410A |. 5B POP EBX ; kernel32.7C816FD7 1000410B |> 6A 00 PUSH 0 1000410D |. FF35 34B10010 PUSH DWORD PTR DS:[1000B134] 10004113 |. 8D85 E8FAFFFF LEA EAX,[LOCAL.326] 10004119 |. FF35 44B20010 PUSH DWORD PTR DS:[1000B244] 1000411F |. 50 PUSH EAX 10004120 |. 56 PUSH ESI 10004121 |. 8D85 E8FEFFFF LEA EAX,[LOCAL.70] 10004127 |. 50 PUSH EAX 10004128 |. 6A 01 PUSH 1 1000412A |. E8 A92C0000 CALL jagmisc.10006DD8 1000412F |. 6A 00 PUSH 0 10004131 |. FF35 44B20010 PUSH DWORD PTR DS:[1000B244] 10004137 |. 8D85 E8FDFFFF LEA EAX,[LOCAL.134] 1000413D |. 56 PUSH ESI 1000413E |. 50 PUSH EAX 1000413F |. 56 PUSH ESI 10004140 |. 8D85 E8FEFFFF LEA EAX,[LOCAL.70] 10004146 |. 50 PUSH EAX 10004147 |. 56 PUSH ESI 10004148 |. FF35 34B10010 PUSH DWORD PTR DS:[1000B134] 1000414E |. E8 381A0000 CALL jagmisc.10005B8B 10004153 |. 6A 00 PUSH 0 10004155 |. FF35 44B20010 PUSH DWORD PTR DS:[1000B244] 1000415B |. 8D85 E8FCFFFF LEA EAX,[LOCAL.198] 10004161 |. 56 PUSH ESI 10004162 |. 50 PUSH EAX 10004163 |. 56 PUSH ESI 10004164 |. 8D85 E8FEFFFF LEA EAX,[LOCAL.70] 1000416A |. 50 PUSH EAX 1000416B |. 68 00020000 PUSH 200 10004170 |. FF35 34B10010 PUSH DWORD PTR DS:[1000B134] 10004176 |. E8 101A0000 CALL jagmisc.10005B8B 1000417B |. 83C4 5C ADD ESP,5C 1000417E |. 33C0 XOR EAX,EAX 10004180 |> 66:8B8C45 E8FAFFF>/MOV CX,WORD PTR SS:[EBP+EAX*2-518] 10004188 |. F6C1 01 |TEST CL,1 1000418B |. 74 16 |JE SHORT jagmisc.100041A3 1000418D |. 8088 41B10010 10 |OR BYTE PTR DS:[EAX+1000B141],10 10004194 |. 8A8C05 E8FDFFFF |MOV CL,BYTE PTR SS:[EBP+EAX-218] 1000419B |> 8888 60B20010 |MOV BYTE PTR DS:[EAX+1000B260],CL 100041A1 |. EB 1C |JMP SHORT jagmisc.100041BF 100041A3 |> F6C1 02 |TEST CL,2 100041A6 |. 74 10 |JE SHORT jagmisc.100041B8 100041A8 |. 8088 41B10010 20 |OR BYTE PTR DS:[EAX+1000B141],20 100041AF |. 8A8C05 E8FCFFFF |MOV CL,BYTE PTR SS:[EBP+EAX-318] 100041B6 |.^ EB E3 |JMP SHORT jagmisc.1000419B 100041B8 |> C680 60B20010 00 |MOV BYTE PTR DS:[EAX+1000B260],0 100041BF |> 40 |INC EAX 100041C0 |. 3BC6 |CMP EAX,ESI 100041C2 |.^ 72 BC \JB SHORT jagmisc.10004180 100041C4 |. EB 44 JMP SHORT jagmisc.1000420A 100041C6 |> 33C0 XOR EAX,EAX 100041C8 |> 83F8 41 /CMP EAX,41 100041CB |. 72 19 |JB SHORT jagmisc.100041E6 100041CD |. 83F8 5A |CMP EAX,5A 100041D0 |. 77 14 |JA SHORT jagmisc.100041E6 100041D2 |. 8088 41B10010 10 |OR BYTE PTR DS:[EAX+1000B141],10 100041D9 |. 8AC8 |MOV CL,AL 100041DB |. 80C1 20 |ADD CL,20 100041DE |> 8888 60B20010 |MOV BYTE PTR DS:[EAX+1000B260],CL 100041E4 |. EB 1F |JMP SHORT jagmisc.10004205 100041E6 |> 83F8 61 |CMP EAX,61 100041E9 |. 72 13 |JB SHORT jagmisc.100041FE 100041EB |. 83F8 7A |CMP EAX,7A 100041EE |. 77 0E |JA SHORT jagmisc.100041FE 100041F0 |. 8088 41B10010 20 |OR BYTE PTR DS:[EAX+1000B141],20 100041F7 |. 8AC8 |MOV CL,AL 100041F9 |. 80E9 20 |SUB CL,20 100041FC |.^ EB E0 |JMP SHORT jagmisc.100041DE 100041FE |> C680 60B20010 00 |MOV BYTE PTR DS:[EAX+1000B260],0 10004205 |> 40 |INC EAX 10004206 |. 3BC6 |CMP EAX,ESI 10004208 |.^ 72 BE \JB SHORT jagmisc.100041C8 1000420A |> 8B4D FC MOV ECX,[LOCAL.1] 1000420D |. 5E POP ESI ; kernel32.7C816FD7 1000420E |. E8 E3F8FFFF CALL jagmisc.10003AF6 10004213 |. C9 LEAVE 10004214 \. C3 RETN 10004215 /$ 55 PUSH EBP 10004216 |. 8BEC MOV EBP,ESP 10004218 |. 83EC 1C SUB ESP,1C 1000421B |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 10004220 |. 53 PUSH EBX 10004221 |. 56 PUSH ESI 10004222 |. 8B75 08 MOV ESI,[ARG.1] 10004225 |. 33DB XOR EBX,EBX 10004227 |. 3BF3 CMP ESI,EBX 10004229 |. 8945 FC MOV [LOCAL.1],EAX 1000422C |. 57 PUSH EDI 1000422D |. 0F84 54010000 JE jagmisc.10004387 10004233 |. 33D2 XOR EDX,EDX 10004235 |. 33C0 XOR EAX,EAX 10004237 |> 39B0 30A60010 /CMP DWORD PTR DS:[EAX+1000A630],ESI 1000423D |. 74 65 |JE SHORT jagmisc.100042A4 1000423F |. 83C0 30 |ADD EAX,30 10004242 |. 42 |INC EDX 10004243 |. 3D F0000000 |CMP EAX,0F0 10004248 |.^ 72 ED \JB SHORT jagmisc.10004237 1000424A |. 8D45 E8 LEA EAX,[LOCAL.6] 1000424D |. 50 PUSH EAX ; /pCPInfo = 00000008 1000424E |. 56 PUSH ESI ; |CodePage = CP_ACP 1000424F |. FF15 C4800010 CALL DWORD PTR DS:[<&KERNEL32.GetCPInfo>] ; \GetCPInfo 10004255 |. 83F8 01 CMP EAX,1 10004258 |. 0F85 21010000 JNZ jagmisc.1000437F 1000425E |. 6A 40 PUSH 40 10004260 |. 33C0 XOR EAX,EAX 10004262 |. 837D E8 01 CMP [LOCAL.6],1 10004266 |. 59 POP ECX ; kernel32.7C816FD7 10004267 |. BF 40B10010 MOV EDI,jagmisc.1000B140 1000426C |. F3:AB REP STOS DWORD PTR ES:[EDI] 1000426E |. AA STOS BYTE PTR ES:[EDI] 1000426F |. 8935 44B20010 MOV DWORD PTR DS:[1000B244],ESI 10004275 |. 891D 34B10010 MOV DWORD PTR DS:[1000B134],EBX 1000427B |. 0F86 EC000000 JBE jagmisc.1000436D 10004281 |. 807D EE 00 CMP BYTE PTR SS:[EBP-12],0 10004285 |. 0F84 BA000000 JE jagmisc.10004345 1000428B |. 8D4D EF LEA ECX,DWORD PTR SS:[EBP-11] 1000428E |> 8A11 MOV DL,BYTE PTR DS:[ECX] 10004290 |. 84D2 TEST DL,DL 10004292 |. 0F84 AD000000 JE jagmisc.10004345 10004298 |. 0FB641 FF MOVZX EAX,BYTE PTR DS:[ECX-1] 1000429C |. 0FB6D2 MOVZX EDX,DL 1000429F |. E9 91000000 JMP jagmisc.10004335 100042A4 |> 6A 40 PUSH 40 100042A6 |. 33C0 XOR EAX,EAX 100042A8 |. 59 POP ECX ; kernel32.7C816FD7 100042A9 |. BF 40B10010 MOV EDI,jagmisc.1000B140 100042AE |. F3:AB REP STOS DWORD PTR ES:[EDI] 100042B0 |. 8D0C52 LEA ECX,DWORD PTR DS:[EDX+EDX*2] 100042B3 |. C1E1 04 SHL ECX,4 100042B6 |. 895D E4 MOV [LOCAL.7],EBX 100042B9 |. AA STOS BYTE PTR ES:[EDI] 100042BA |. 8D99 40A60010 LEA EBX,DWORD PTR DS:[ECX+1000A640] 100042C0 |> 8A03 /MOV AL,BYTE PTR DS:[EBX] 100042C2 |. 8BF3 |MOV ESI,EBX 100042C4 |. EB 29 |JMP SHORT jagmisc.100042EF 100042C6 |> 8A56 01 |/MOV DL,BYTE PTR DS:[ESI+1] 100042C9 |. 84D2 ||TEST DL,DL 100042CB |. 74 26 ||JE SHORT jagmisc.100042F3 100042CD |. 0FB6C0 ||MOVZX EAX,AL 100042D0 |. 0FB6FA ||MOVZX EDI,DL 100042D3 |. 3BC7 ||CMP EAX,EDI 100042D5 |. 77 14 ||JA SHORT jagmisc.100042EB 100042D7 |. 8B55 E4 ||MOV EDX,[LOCAL.7] 100042DA |. 8A92 28A60010 ||MOV DL,BYTE PTR DS:[EDX+1000A628] 100042E0 |> 0890 41B10010 ||/OR BYTE PTR DS:[EAX+1000B141],DL 100042E6 |. 40 |||INC EAX 100042E7 |. 3BC7 |||CMP EAX,EDI 100042E9 |.^ 76 F5 ||\JBE SHORT jagmisc.100042E0 100042EB |> 46 ||INC ESI 100042EC |. 46 ||INC ESI 100042ED |. 8A06 ||MOV AL,BYTE PTR DS:[ESI] 100042EF |> 84C0 | TEST AL,AL 100042F1 |.^ 75 D3 |\JNZ SHORT jagmisc.100042C6 100042F3 |> FF45 E4 |INC [LOCAL.7] 100042F6 |. 83C3 08 |ADD EBX,8 100042F9 |. 837D E4 04 |CMP [LOCAL.7],4 100042FD |.^ 72 C1 \JB SHORT jagmisc.100042C0 100042FF |. 8B45 08 MOV EAX,[ARG.1] 10004302 |. A3 44B20010 MOV DWORD PTR DS:[1000B244],EAX 10004307 |. C705 3CB10010 010>MOV DWORD PTR DS:[1000B13C],1 10004311 |. E8 1BFDFFFF CALL jagmisc.10004031 10004316 |. 8D89 34A60010 LEA ECX,DWORD PTR DS:[ECX+1000A634] 1000431C |. 8BF1 MOV ESI,ECX 1000431E |. BF 50B20010 MOV EDI,jagmisc.1000B250 10004323 |. A5 MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10004324 |. A5 MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10004325 |. A3 34B10010 MOV DWORD PTR DS:[1000B134],EAX 1000432A |. A5 MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 1000432B |. EB 5F JMP SHORT jagmisc.1000438C 1000432D |> 8088 41B10010 04 /OR BYTE PTR DS:[EAX+1000B141],4 10004334 |. 40 |INC EAX 10004335 |> 3BC2 CMP EAX,EDX 10004337 |.^ 76 F4 \JBE SHORT jagmisc.1000432D 10004339 |. 41 INC ECX 1000433A |. 41 INC ECX 1000433B |. 8079 FF 00 CMP BYTE PTR DS:[ECX-1],0 1000433F |.^ 0F85 49FFFFFF JNZ jagmisc.1000428E 10004345 |> 33C9 XOR ECX,ECX 10004347 |. 41 INC ECX 10004348 |. 8BC1 MOV EAX,ECX 1000434A |> 8088 41B10010 08 /OR BYTE PTR DS:[EAX+1000B141],8 10004351 |. 40 |INC EAX 10004352 |. 3D FF000000 |CMP EAX,0FF 10004357 |.^ 72 F1 \JB SHORT jagmisc.1000434A 10004359 |. 8BC6 MOV EAX,ESI 1000435B |. E8 D1FCFFFF CALL jagmisc.10004031 10004360 |. A3 34B10010 MOV DWORD PTR DS:[1000B134],EAX 10004365 |. 890D 3CB10010 MOV DWORD PTR DS:[1000B13C],ECX 1000436B |. EB 06 JMP SHORT jagmisc.10004373 1000436D |> 891D 3CB10010 MOV DWORD PTR DS:[1000B13C],EBX 10004373 |> 33C0 XOR EAX,EAX 10004375 |. BF 50B20010 MOV EDI,jagmisc.1000B250 1000437A |. AB STOS DWORD PTR ES:[EDI] 1000437B |. AB STOS DWORD PTR ES:[EDI] 1000437C |. AB STOS DWORD PTR ES:[EDI] 1000437D |. EB 0D JMP SHORT jagmisc.1000438C 1000437F |> 391D 3CAF0010 CMP DWORD PTR DS:[1000AF3C],EBX 10004385 |. 74 0E JE SHORT jagmisc.10004395 10004387 |> E8 D4FCFFFF CALL jagmisc.10004060 1000438C |> E8 F8FCFFFF CALL jagmisc.10004089 10004391 |. 33C0 XOR EAX,EAX 10004393 |. EB 03 JMP SHORT jagmisc.10004398 10004395 |> 83C8 FF OR EAX,FFFFFFFF 10004398 |> 8B4D FC MOV ECX,[LOCAL.1] 1000439B |. 5F POP EDI ; kernel32.7C816FD7 1000439C |. 5E POP ESI ; kernel32.7C816FD7 1000439D |. 5B POP EBX ; kernel32.7C816FD7 1000439E |. E8 53F7FFFF CALL jagmisc.10003AF6 100043A3 |. C9 LEAVE 100043A4 \. C3 RETN 100043A5 /$ 6A 14 PUSH 14 100043A7 |. 68 30880010 PUSH jagmisc.10008830 100043AC |. E8 BFDFFFFF CALL jagmisc.10002370 100043B1 |. 834D E0 FF OR [LOCAL.8],FFFFFFFF 100043B5 |. 6A 0D PUSH 0D ; /Arg1 = 0000000D 100043B7 |. E8 78FAFFFF CALL jagmisc.10003E34 ; \jagmisc.10003E34 100043BC |. 59 POP ECX ; kernel32.7C816FD7 100043BD |. 33FF XOR EDI,EDI 100043BF |. 897D FC MOV [LOCAL.1],EDI 100043C2 |. 893D 3CAF0010 MOV DWORD PTR DS:[1000AF3C],EDI 100043C8 |. 8B45 08 MOV EAX,[ARG.1] 100043CB |. 83F8 FE CMP EAX,-2 100043CE |. 75 12 JNZ SHORT jagmisc.100043E2 100043D0 |. C705 3CAF0010 010>MOV DWORD PTR DS:[1000AF3C],1 100043DA |. FF15 C0800010 CALL DWORD PTR DS:[<&KERNEL32.GetOEMCP>] ; [GetOEMCP 100043E0 |. EB 2B JMP SHORT jagmisc.1000440D 100043E2 |> 83F8 FD CMP EAX,-3 100043E5 |. 75 12 JNZ SHORT jagmisc.100043F9 100043E7 |. C705 3CAF0010 010>MOV DWORD PTR DS:[1000AF3C],1 100043F1 |. FF15 BC800010 CALL DWORD PTR DS:[<&KERNEL32.GetACP>] ; [GetACP 100043F7 |. EB 14 JMP SHORT jagmisc.1000440D 100043F9 |> 83F8 FC CMP EAX,-4 100043FC |. 75 0F JNZ SHORT jagmisc.1000440D 100043FE |. C705 3CAF0010 010>MOV DWORD PTR DS:[1000AF3C],1 10004408 |. A1 10B00010 MOV EAX,DWORD PTR DS:[1000B010] 1000440D |> 8945 08 MOV [ARG.1],EAX 10004410 |. 3B05 44B20010 CMP EAX,DWORD PTR DS:[1000B244] 10004416 |. 0F84 BB000000 JE jagmisc.100044D7 1000441C |. 8B35 38B10010 MOV ESI,DWORD PTR DS:[1000B138] 10004422 |. 8975 DC MOV [LOCAL.9],ESI 10004425 |. 3BF7 CMP ESI,EDI 10004427 |. 74 04 JE SHORT jagmisc.1000442D 10004429 |. 393E CMP DWORD PTR DS:[ESI],EDI 1000442B |. 74 10 JE SHORT jagmisc.1000443D 1000442D |> 68 20020000 PUSH 220 10004432 |. E8 65110000 CALL jagmisc.1000559C 10004437 |. 59 POP ECX ; kernel32.7C816FD7 10004438 |. 8BF0 MOV ESI,EAX 1000443A |. 8975 DC MOV [LOCAL.9],ESI 1000443D |> 3BF7 CMP ESI,EDI 1000443F |. 74 7F JE SHORT jagmisc.100044C0 10004441 |. FF75 08 PUSH [ARG.1] 10004444 |. E8 CCFDFFFF CALL jagmisc.10004215 10004449 |. 59 POP ECX ; kernel32.7C816FD7 1000444A |. 8945 E0 MOV [LOCAL.8],EAX 1000444D |. 3BC7 CMP EAX,EDI 1000444F |. 75 6F JNZ SHORT jagmisc.100044C0 10004451 |. 893E MOV DWORD PTR DS:[ESI],EDI 10004453 |. A1 44B20010 MOV EAX,DWORD PTR DS:[1000B244] 10004458 |. 8946 04 MOV DWORD PTR DS:[ESI+4],EAX 1000445B |. A1 3CB10010 MOV EAX,DWORD PTR DS:[1000B13C] 10004460 |. 8946 08 MOV DWORD PTR DS:[ESI+8],EAX 10004463 |. A1 34B10010 MOV EAX,DWORD PTR DS:[1000B134] 10004468 |. 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 1000446B |. 33C0 XOR EAX,EAX 1000446D |> 8945 E4 /MOV [LOCAL.7],EAX 10004470 |. 83F8 05 |CMP EAX,5 10004473 |. 7D 10 |JGE SHORT jagmisc.10004485 10004475 |. 66:8B0C45 50B2001>|MOV CX,WORD PTR DS:[EAX*2+1000B250] 1000447D |. 66:894C46 10 |MOV WORD PTR DS:[ESI+EAX*2+10],CX 10004482 |. 40 |INC EAX 10004483 |.^ EB E8 \JMP SHORT jagmisc.1000446D 10004485 |> 33C0 XOR EAX,EAX 10004487 |> 8945 E4 /MOV [LOCAL.7],EAX 1000448A |. 3D 01010000 |CMP EAX,101 1000448F |. 7D 0D |JGE SHORT jagmisc.1000449E 10004491 |. 8A88 40B10010 |MOV CL,BYTE PTR DS:[EAX+1000B140] 10004497 |. 884C30 1C |MOV BYTE PTR DS:[EAX+ESI+1C],CL 1000449B |. 40 |INC EAX 1000449C |.^ EB E9 \JMP SHORT jagmisc.10004487 1000449E |> 33C0 XOR EAX,EAX 100044A0 |> 8945 E4 /MOV [LOCAL.7],EAX 100044A3 |. 3D 00010000 |CMP EAX,100 100044A8 |. 7D 10 |JGE SHORT jagmisc.100044BA 100044AA |. 8A88 60B20010 |MOV CL,BYTE PTR DS:[EAX+1000B260] 100044B0 |. 888C30 1D010000 |MOV BYTE PTR DS:[EAX+ESI+11D],CL 100044B7 |. 40 |INC EAX 100044B8 |.^ EB E6 \JMP SHORT jagmisc.100044A0 100044BA |> 8935 38B10010 MOV DWORD PTR DS:[1000B138],ESI 100044C0 |> 837D E0 FF CMP [LOCAL.8],-1 100044C4 |. 75 14 JNZ SHORT jagmisc.100044DA 100044C6 |. 3B35 38B10010 CMP ESI,DWORD PTR DS:[1000B138] 100044CC |. 74 0C JE SHORT jagmisc.100044DA 100044CE |. 56 PUSH ESI 100044CF |. E8 29DEFFFF CALL jagmisc.100022FD 100044D4 |. 59 POP ECX ; kernel32.7C816FD7 100044D5 |. EB 03 JMP SHORT jagmisc.100044DA 100044D7 |> 897D E0 MOV [LOCAL.8],EDI 100044DA |> 834D FC FF OR [LOCAL.1],FFFFFFFF 100044DE |. E8 09000000 CALL jagmisc.100044EC 100044E3 |. 8B45 E0 MOV EAX,[LOCAL.8] 100044E6 |. E8 C0DEFFFF CALL jagmisc.100023AB 100044EB \. C3 RETN 100044EC /$ 6A 0D PUSH 0D 100044EE |. E8 8CF8FFFF CALL jagmisc.10003D7F 100044F3 |. 59 POP ECX ; kernel32.7C816FD7 100044F4 \. C3 RETN 100044F5 /$ 833D 8CB40010 00 CMP DWORD PTR DS:[1000B48C],0 100044FC |. 75 12 JNZ SHORT jagmisc.10004510 100044FE |. 6A FD PUSH -3 10004500 |. E8 A0FEFFFF CALL jagmisc.100043A5 10004505 |. 59 POP ECX ; kernel32.7C816FD7 10004506 |. C705 8CB40010 010>MOV DWORD PTR DS:[1000B48C],1 10004510 |> 33C0 XOR EAX,EAX 10004512 \. C3 RETN 10004513 /$ 56 PUSH ESI 10004514 |. FF35 88B40010 PUSH DWORD PTR DS:[1000B488] 1000451A |. E8 AE2C0000 CALL jagmisc.100071CD 1000451F |. 59 POP ECX ; kernel32.7C816FD7 10004520 |. 8B0D 84B40010 MOV ECX,DWORD PTR DS:[1000B484] 10004526 |. 8BF0 MOV ESI,EAX 10004528 |. A1 88B40010 MOV EAX,DWORD PTR DS:[1000B488] 1000452D |. 8BD1 MOV EDX,ECX 1000452F |. 2BD0 SUB EDX,EAX 10004531 |. 83C2 04 ADD EDX,4 10004534 |. 3BF2 CMP ESI,EDX 10004536 |. 73 4E JNB SHORT jagmisc.10004586 10004538 |. B9 00080000 MOV ECX,800 1000453D |. 3BF1 CMP ESI,ECX 1000453F |. 73 02 JNB SHORT jagmisc.10004543 10004541 |. 8BCE MOV ECX,ESI 10004543 |> 03CE ADD ECX,ESI 10004545 |. 51 PUSH ECX 10004546 |. 50 PUSH EAX 10004547 |. E8 D42A0000 CALL jagmisc.10007020 1000454C |. 85C0 TEST EAX,EAX 1000454E |. 59 POP ECX ; kernel32.7C816FD7 1000454F |. 59 POP ECX ; kernel32.7C816FD7 10004550 |. 75 17 JNZ SHORT jagmisc.10004569 10004552 |. 83C6 10 ADD ESI,10 10004555 |. 56 PUSH ESI 10004556 |. FF35 88B40010 PUSH DWORD PTR DS:[1000B488] 1000455C |. E8 BF2A0000 CALL jagmisc.10007020 10004561 |. 85C0 TEST EAX,EAX 10004563 |. 59 POP ECX ; kernel32.7C816FD7 10004564 |. 59 POP ECX ; kernel32.7C816FD7 10004565 |. 75 02 JNZ SHORT jagmisc.10004569 10004567 |. 5E POP ESI ; kernel32.7C816FD7 10004568 |. C3 RETN 10004569 |> 8B0D 84B40010 MOV ECX,DWORD PTR DS:[1000B484] 1000456F |. 2B0D 88B40010 SUB ECX,DWORD PTR DS:[1000B488] 10004575 |. A3 88B40010 MOV DWORD PTR DS:[1000B488],EAX 1000457A |. C1F9 02 SAR ECX,2 1000457D |. 8D0C88 LEA ECX,DWORD PTR DS:[EAX+ECX*4] 10004580 |. 890D 84B40010 MOV DWORD PTR DS:[1000B484],ECX 10004586 |> 8939 MOV DWORD PTR DS:[ECX],EDI 10004588 |. 8305 84B40010 04 ADD DWORD PTR DS:[1000B484],4 1000458F |. 8BC7 MOV EAX,EDI 10004591 |. 5E POP ESI ; kernel32.7C816FD7 10004592 \. C3 RETN 10004593 . 68 80000000 PUSH 80 10004598 . E8 FF0F0000 CALL jagmisc.1000559C 1000459D . 85C0 TEST EAX,EAX 1000459F . 59 POP ECX ; kernel32.7C816FD7 100045A0 . A3 88B40010 MOV DWORD PTR DS:[1000B488],EAX 100045A5 . 75 04 JNZ SHORT jagmisc.100045AB 100045A7 . 6A 18 PUSH 18 100045A9 . 58 POP EAX ; kernel32.7C816FD7 100045AA . C3 RETN 100045AB > 8320 00 AND DWORD PTR DS:[EAX],0 100045AE . A1 88B40010 MOV EAX,DWORD PTR DS:[1000B488] 100045B3 . A3 84B40010 MOV DWORD PTR DS:[1000B484],EAX 100045B8 . 33C0 XOR EAX,EAX 100045BA . C3 RETN 100045BB /$ 6A 0C PUSH 0C 100045BD |. 68 40880010 PUSH jagmisc.10008840 100045C2 |. E8 A9DDFFFF CALL jagmisc.10002370 100045C7 |. E8 3BDAFFFF CALL jagmisc.10002007 100045CC |. 8365 FC 00 AND [LOCAL.1],0 100045D0 |. 8B7D 08 MOV EDI,[ARG.1] 100045D3 |. E8 3BFFFFFF CALL jagmisc.10004513 100045D8 |. 8945 E4 MOV [LOCAL.7],EAX 100045DB |. 834D FC FF OR [LOCAL.1],FFFFFFFF 100045DF |. E8 09000000 CALL jagmisc.100045ED 100045E4 |. 8B45 E4 MOV EAX,[LOCAL.7] 100045E7 |. E8 BFDDFFFF CALL jagmisc.100023AB 100045EC \. C3 RETN 100045ED /$ E8 1EDAFFFF CALL jagmisc.10002010 100045F2 \. C3 RETN 100045F3 /$ FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738 100045F7 |. E8 BFFFFFFF CALL jagmisc.100045BB 100045FC |. F7D8 NEG EAX 100045FE |. 1BC0 SBB EAX,EAX 10004600 |. F7D8 NEG EAX 10004602 |. 59 POP ECX ; kernel32.7C816FD7 10004603 |. 48 DEC EAX 10004604 \. C3 RETN 10004605 /$ 68 40010000 PUSH 140 ; /HeapSize = 140 (320.) 1000460A |. 6A 00 PUSH 0 ; |Flags = 0 1000460C |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000 10004612 |. FF15 80800010 CALL DWORD PTR DS:[<&KERNEL32.HeapAlloc>] ; \HeapAlloc 10004618 |. 85C0 TEST EAX,EAX 1000461A |. A3 20B10010 MOV DWORD PTR DS:[1000B120],EAX 1000461F |. 75 01 JNZ SHORT jagmisc.10004622 10004621 |. C3 RETN 10004622 |> 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10004626 |. 8325 18B10010 00 AND DWORD PTR DS:[1000B118],0 1000462D |. 8325 1CB10010 00 AND DWORD PTR DS:[1000B11C],0 10004634 |. A3 28B10010 MOV DWORD PTR DS:[1000B128],EAX 10004639 |. 33C0 XOR EAX,EAX 1000463B |. 890D 24B10010 MOV DWORD PTR DS:[1000B124],ECX 10004641 |. C705 2CB10010 100>MOV DWORD PTR DS:[1000B12C],10 1000464B |. 40 INC EAX 1000464C \. C3 RETN 1000464D /$ A1 1CB10010 MOV EAX,DWORD PTR DS:[1000B11C] 10004652 |. 8D0C80 LEA ECX,DWORD PTR DS:[EAX+EAX*4] 10004655 |. A1 20B10010 MOV EAX,DWORD PTR DS:[1000B120] 1000465A |. 8D0C88 LEA ECX,DWORD PTR DS:[EAX+ECX*4] 1000465D |. EB 12 JMP SHORT jagmisc.10004671 1000465F |> 8B5424 04 /MOV EDX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10004663 |. 2B50 0C |SUB EDX,DWORD PTR DS:[EAX+C] 10004666 |. 81FA 00001000 |CMP EDX,100000 1000466C |. 72 09 |JB SHORT jagmisc.10004677 1000466E |. 83C0 14 |ADD EAX,14 10004671 |> 3BC1 CMP EAX,ECX 10004673 |.^ 72 EA \JB SHORT jagmisc.1000465F 10004675 |. 33C0 XOR EAX,EAX 10004677 \> C3 RETN 10004678 /$ 55 PUSH EBP 10004679 |. 8BEC MOV EBP,ESP 1000467B |. 83EC 10 SUB ESP,10 1000467E |. 8B4D 08 MOV ECX,[ARG.1] 10004681 |. 8B41 10 MOV EAX,DWORD PTR DS:[ECX+10] 10004684 |. 56 PUSH ESI 10004685 |. 8B75 0C MOV ESI,[ARG.2] 10004688 |. 57 PUSH EDI 10004689 |. 8BFE MOV EDI,ESI 1000468B |. 2B79 0C SUB EDI,DWORD PTR DS:[ECX+C] 1000468E |. 83C6 FC ADD ESI,-4 10004691 |. C1EF 0F SHR EDI,0F 10004694 |. 8BCF MOV ECX,EDI 10004696 |. 69C9 04020000 IMUL ECX,ECX,204 1000469C |. 8D8C01 44010000 LEA ECX,DWORD PTR DS:[ECX+EAX+144] 100046A3 |. 894D F0 MOV [LOCAL.4],ECX 100046A6 |. 8B0E MOV ECX,DWORD PTR DS:[ESI] 100046A8 |. 49 DEC ECX 100046A9 |. F6C1 01 TEST CL,1 100046AC |. 894D FC MOV [LOCAL.1],ECX 100046AF |. 0F85 D7020000 JNZ jagmisc.1000498C 100046B5 |. 53 PUSH EBX 100046B6 |. 8D1C31 LEA EBX,DWORD PTR DS:[ECX+ESI] 100046B9 |. 8B13 MOV EDX,DWORD PTR DS:[EBX] 100046BB |. 8955 F4 MOV [LOCAL.3],EDX 100046BE |. 8B56 FC MOV EDX,DWORD PTR DS:[ESI-4] 100046C1 |. 8955 F8 MOV [LOCAL.2],EDX 100046C4 |. 8B55 F4 MOV EDX,[LOCAL.3] 100046C7 |. F6C2 01 TEST DL,1 100046CA |. 895D 0C MOV [ARG.2],EBX 100046CD |. 75 74 JNZ SHORT jagmisc.10004743 100046CF |. C1FA 04 SAR EDX,4 100046D2 |. 4A DEC EDX 100046D3 |. 83FA 3F CMP EDX,3F 100046D6 |. 76 03 JBE SHORT jagmisc.100046DB 100046D8 |. 6A 3F PUSH 3F 100046DA |. 5A POP EDX ; kernel32.7C816FD7 100046DB |> 8B4B 04 MOV ECX,DWORD PTR DS:[EBX+4] 100046DE |. 3B4B 08 CMP ECX,DWORD PTR DS:[EBX+8] 100046E1 |. 75 42 JNZ SHORT jagmisc.10004725 100046E3 |. 83FA 20 CMP EDX,20 100046E6 |. BB 00000080 MOV EBX,80000000 100046EB |. 73 19 JNB SHORT jagmisc.10004706 100046ED |. 8BCA MOV ECX,EDX 100046EF |. D3EB SHR EBX,CL 100046F1 |. 8D4C02 04 LEA ECX,DWORD PTR DS:[EDX+EAX+4] 100046F5 |. F7D3 NOT EBX 100046F7 |. 215CB8 44 AND DWORD PTR DS:[EAX+EDI*4+44],EBX 100046FB |. FE09 DEC BYTE PTR DS:[ECX] 100046FD |. 75 23 JNZ SHORT jagmisc.10004722 100046FF |. 8B4D 08 MOV ECX,[ARG.1] 10004702 |. 2119 AND DWORD PTR DS:[ECX],EBX 10004704 |. EB 1C JMP SHORT jagmisc.10004722 10004706 |> 8D4A E0 LEA ECX,DWORD PTR DS:[EDX-20] 10004709 |. D3EB SHR EBX,CL 1000470B |. 8D4C02 04 LEA ECX,DWORD PTR DS:[EDX+EAX+4] 1000470F |. F7D3 NOT EBX 10004711 |. 219CB8 C4000000 AND DWORD PTR DS:[EAX+EDI*4+C4],EBX 10004718 |. FE09 DEC BYTE PTR DS:[ECX] 1000471A |. 75 06 JNZ SHORT jagmisc.10004722 1000471C |. 8B4D 08 MOV ECX,[ARG.1] 1000471F |. 2159 04 AND DWORD PTR DS:[ECX+4],EBX 10004722 |> 8B5D 0C MOV EBX,[ARG.2] 10004725 |> 8B53 08 MOV EDX,DWORD PTR DS:[EBX+8] 10004728 |. 8B5B 04 MOV EBX,DWORD PTR DS:[EBX+4] 1000472B |. 8B4D FC MOV ECX,[LOCAL.1] 1000472E |. 034D F4 ADD ECX,[LOCAL.3] 10004731 |. 895A 04 MOV DWORD PTR DS:[EDX+4],EBX 10004734 |. 8B55 0C MOV EDX,[ARG.2] 10004737 |. 8B5A 04 MOV EBX,DWORD PTR DS:[EDX+4] 1000473A |. 8B52 08 MOV EDX,DWORD PTR DS:[EDX+8] 1000473D |. 8953 08 MOV DWORD PTR DS:[EBX+8],EDX 10004740 |. 894D FC MOV [LOCAL.1],ECX 10004743 |> 8BD1 MOV EDX,ECX 10004745 |. C1FA 04 SAR EDX,4 10004748 |. 4A DEC EDX 10004749 |. 83FA 3F CMP EDX,3F 1000474C |. 76 03 JBE SHORT jagmisc.10004751 1000474E |. 6A 3F PUSH 3F 10004750 |. 5A POP EDX ; kernel32.7C816FD7 10004751 |> 8B5D F8 MOV EBX,[LOCAL.2] ; LOADDLL.00410249 10004754 |. 83E3 01 AND EBX,1 10004757 |. 895D F4 MOV [LOCAL.3],EBX 1000475A |. 0F85 8F000000 JNZ jagmisc.100047EF 10004760 |. 2B75 F8 SUB ESI,[LOCAL.2] ; LOADDLL.00410249 10004763 |. 8B5D F8 MOV EBX,[LOCAL.2] ; LOADDLL.00410249 10004766 |. C1FB 04 SAR EBX,4 10004769 |. 6A 3F PUSH 3F 1000476B |. 8975 0C MOV [ARG.2],ESI 1000476E |. 4B DEC EBX 1000476F |. 5E POP ESI ; kernel32.7C816FD7 10004770 |. 3BDE CMP EBX,ESI 10004772 |. 76 02 JBE SHORT jagmisc.10004776 10004774 |. 8BDE MOV EBX,ESI 10004776 |> 034D F8 ADD ECX,[LOCAL.2] ; LOADDLL.00410249 10004779 |. 8BD1 MOV EDX,ECX 1000477B |. C1FA 04 SAR EDX,4 1000477E |. 4A DEC EDX 1000477F |. 3BD6 CMP EDX,ESI 10004781 |. 894D FC MOV [LOCAL.1],ECX 10004784 |. 76 02 JBE SHORT jagmisc.10004788 10004786 |. 8BD6 MOV EDX,ESI 10004788 |> 3BDA CMP EBX,EDX 1000478A |. 74 5E JE SHORT jagmisc.100047EA 1000478C |. 8B4D 0C MOV ECX,[ARG.2] 1000478F |. 8B71 04 MOV ESI,DWORD PTR DS:[ECX+4] 10004792 |. 3B71 08 CMP ESI,DWORD PTR DS:[ECX+8] 10004795 |. 75 3B JNZ SHORT jagmisc.100047D2 10004797 |. 83FB 20 CMP EBX,20 1000479A |. BE 00000080 MOV ESI,80000000 1000479F |. 73 17 JNB SHORT jagmisc.100047B8 100047A1 |. 8BCB MOV ECX,EBX 100047A3 |. D3EE SHR ESI,CL 100047A5 |. F7D6 NOT ESI 100047A7 |. 2174B8 44 AND DWORD PTR DS:[EAX+EDI*4+44],ESI 100047AB |. FE4C03 04 DEC BYTE PTR DS:[EBX+EAX+4] 100047AF |. 75 21 JNZ SHORT jagmisc.100047D2 100047B1 |. 8B4D 08 MOV ECX,[ARG.1] 100047B4 |. 2131 AND DWORD PTR DS:[ECX],ESI 100047B6 |. EB 1A JMP SHORT jagmisc.100047D2 100047B8 |> 8D4B E0 LEA ECX,DWORD PTR DS:[EBX-20] 100047BB |. D3EE SHR ESI,CL 100047BD |. F7D6 NOT ESI 100047BF |. 21B4B8 C4000000 AND DWORD PTR DS:[EAX+EDI*4+C4],ESI 100047C6 |. FE4C03 04 DEC BYTE PTR DS:[EBX+EAX+4] 100047CA |. 75 06 JNZ SHORT jagmisc.100047D2 100047CC |. 8B4D 08 MOV ECX,[ARG.1] 100047CF |. 2171 04 AND DWORD PTR DS:[ECX+4],ESI 100047D2 |> 8B4D 0C MOV ECX,[ARG.2] 100047D5 |. 8B71 08 MOV ESI,DWORD PTR DS:[ECX+8] 100047D8 |. 8B49 04 MOV ECX,DWORD PTR DS:[ECX+4] 100047DB |. 894E 04 MOV DWORD PTR DS:[ESI+4],ECX 100047DE |. 8B4D 0C MOV ECX,[ARG.2] 100047E1 |. 8B71 04 MOV ESI,DWORD PTR DS:[ECX+4] 100047E4 |. 8B49 08 MOV ECX,DWORD PTR DS:[ECX+8] 100047E7 |. 894E 08 MOV DWORD PTR DS:[ESI+8],ECX 100047EA |> 8B75 0C MOV ESI,[ARG.2] 100047ED |. EB 03 JMP SHORT jagmisc.100047F2 100047EF |> 8B5D 08 MOV EBX,[ARG.1] 100047F2 |> 837D F4 00 CMP [LOCAL.3],0 100047F6 |. 75 08 JNZ SHORT jagmisc.10004800 100047F8 |. 3BDA CMP EBX,EDX 100047FA |. 0F84 80000000 JE jagmisc.10004880 10004800 |> 8B4D F0 MOV ECX,[LOCAL.4] 10004803 |. 8D0CD1 LEA ECX,DWORD PTR DS:[ECX+EDX*8] 10004806 |. 8B59 04 MOV EBX,DWORD PTR DS:[ECX+4] 10004809 |. 894E 08 MOV DWORD PTR DS:[ESI+8],ECX 1000480C |. 895E 04 MOV DWORD PTR DS:[ESI+4],EBX 1000480F |. 8971 04 MOV DWORD PTR DS:[ECX+4],ESI 10004812 |. 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4] 10004815 |. 8971 08 MOV DWORD PTR DS:[ECX+8],ESI 10004818 |. 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4] 1000481B |. 3B4E 08 CMP ECX,DWORD PTR DS:[ESI+8] 1000481E |. 75 60 JNZ SHORT jagmisc.10004880 10004820 |. 8A4C02 04 MOV CL,BYTE PTR DS:[EDX+EAX+4] 10004824 |. 884D 0F MOV BYTE PTR SS:[EBP+F],CL 10004827 |. FEC1 INC CL 10004829 |. 83FA 20 CMP EDX,20 1000482C |. 884C02 04 MOV BYTE PTR DS:[EDX+EAX+4],CL 10004830 |. 73 25 JNB SHORT jagmisc.10004857 10004832 |. 807D 0F 00 CMP BYTE PTR SS:[EBP+F],0 10004836 |. 75 0E JNZ SHORT jagmisc.10004846 10004838 |. 8BCA MOV ECX,EDX 1000483A |. BB 00000080 MOV EBX,80000000 1000483F |. D3EB SHR EBX,CL 10004841 |. 8B4D 08 MOV ECX,[ARG.1] 10004844 |. 0919 OR DWORD PTR DS:[ECX],EBX 10004846 |> BB 00000080 MOV EBX,80000000 1000484B |. 8BCA MOV ECX,EDX 1000484D |. D3EB SHR EBX,CL 1000484F |. 8D44B8 44 LEA EAX,DWORD PTR DS:[EAX+EDI*4+44] 10004853 |. 0918 OR DWORD PTR DS:[EAX],EBX 10004855 |. EB 29 JMP SHORT jagmisc.10004880 10004857 |> 807D 0F 00 CMP BYTE PTR SS:[EBP+F],0 1000485B |. 75 10 JNZ SHORT jagmisc.1000486D 1000485D |. 8D4A E0 LEA ECX,DWORD PTR DS:[EDX-20] 10004860 |. BB 00000080 MOV EBX,80000000 10004865 |. D3EB SHR EBX,CL 10004867 |. 8B4D 08 MOV ECX,[ARG.1] 1000486A |. 0959 04 OR DWORD PTR DS:[ECX+4],EBX 1000486D |> 8D4A E0 LEA ECX,DWORD PTR DS:[EDX-20] 10004870 |. BA 00000080 MOV EDX,80000000 10004875 |. D3EA SHR EDX,CL 10004877 |. 8D84B8 C4000000 LEA EAX,DWORD PTR DS:[EAX+EDI*4+C4] 1000487E |. 0910 OR DWORD PTR DS:[EAX],EDX 10004880 |> 8B45 FC MOV EAX,[LOCAL.1] 10004883 |. 8906 MOV DWORD PTR DS:[ESI],EAX 10004885 |. 894430 FC MOV DWORD PTR DS:[EAX+ESI-4],EAX 10004889 |. 8B45 F0 MOV EAX,[LOCAL.4] 1000488C |. FF08 DEC DWORD PTR DS:[EAX] 1000488E |. 0F85 F7000000 JNZ jagmisc.1000498B 10004894 |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118] 10004899 |. 85C0 TEST EAX,EAX 1000489B |. 0F84 DC000000 JE jagmisc.1000497D 100048A1 |. 8B0D 30B10010 MOV ECX,DWORD PTR DS:[1000B130] 100048A7 |. 8B35 B4800010 MOV ESI,DWORD PTR DS:[<&KERNEL32.VirtualFree>] ; kernel32.VirtualFree 100048AD |. 68 00400000 PUSH 4000 ; /FreeType = MEM_DECOMMIT 100048B2 |. C1E1 0F SHL ECX,0F ; | 100048B5 |. 0348 0C ADD ECX,DWORD PTR DS:[EAX+C] ; | 100048B8 |. BB 00800000 MOV EBX,8000 ; | 100048BD |. 53 PUSH EBX ; |Size = 0 100048BE |. 51 PUSH ECX ; |Address = FFFFFFFF 100048BF |. FFD6 CALL ESI ; \VirtualFree 100048C1 |. 8B0D 30B10010 MOV ECX,DWORD PTR DS:[1000B130] 100048C7 |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118] 100048CC |. BA 00000080 MOV EDX,80000000 100048D1 |. D3EA SHR EDX,CL 100048D3 |. 0950 08 OR DWORD PTR DS:[EAX+8],EDX 100048D6 |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118] 100048DB |. 8B40 10 MOV EAX,DWORD PTR DS:[EAX+10] 100048DE |. 8B0D 30B10010 MOV ECX,DWORD PTR DS:[1000B130] 100048E4 |. 83A488 C4000000 0>AND DWORD PTR DS:[EAX+ECX*4+C4],0 100048EC |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118] 100048F1 |. 8B40 10 MOV EAX,DWORD PTR DS:[EAX+10] 100048F4 |. FE48 43 DEC BYTE PTR DS:[EAX+43] 100048F7 |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118] 100048FC |. 8B48 10 MOV ECX,DWORD PTR DS:[EAX+10] 100048FF |. 8079 43 00 CMP BYTE PTR DS:[ECX+43],0 10004903 |. 75 09 JNZ SHORT jagmisc.1000490E 10004905 |. 8360 04 FE AND DWORD PTR DS:[EAX+4],FFFFFFFE 10004909 |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118] 1000490E |> 8378 08 FF CMP DWORD PTR DS:[EAX+8],-1 10004912 |. 75 69 JNZ SHORT jagmisc.1000497D 10004914 |. 53 PUSH EBX 10004915 |. 6A 00 PUSH 0 10004917 |. FF70 0C PUSH DWORD PTR DS:[EAX+C] 1000491A |. FFD6 CALL ESI 1000491C |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118] 10004921 |. FF70 10 PUSH DWORD PTR DS:[EAX+10] ; /pMemory 10004924 |. 6A 00 PUSH 0 ; |Flags = 0 10004926 |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000 1000492C |. FF15 7C800010 CALL DWORD PTR DS:[<&KERNEL32.HeapFree>] ; \HeapFree 10004932 |. A1 1CB10010 MOV EAX,DWORD PTR DS:[1000B11C] 10004937 |. 8B15 20B10010 MOV EDX,DWORD PTR DS:[1000B120] 1000493D |. 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 10004940 |. C1E0 02 SHL EAX,2 10004943 |. 8BC8 MOV ECX,EAX 10004945 |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118] 1000494A |. 2BC8 SUB ECX,EAX 1000494C |. 8D4C11 EC LEA ECX,DWORD PTR DS:[ECX+EDX-14] 10004950 |. 51 PUSH ECX 10004951 |. 8D48 14 LEA ECX,DWORD PTR DS:[EAX+14] 10004954 |. 51 PUSH ECX 10004955 |. 50 PUSH EAX 10004956 |. E8 05EBFFFF CALL jagmisc.10003460 1000495B |. 8B45 08 MOV EAX,[ARG.1] 1000495E |. 83C4 0C ADD ESP,0C 10004961 |. FF0D 1CB10010 DEC DWORD PTR DS:[1000B11C] 10004967 |. 3B05 18B10010 CMP EAX,DWORD PTR DS:[1000B118] 1000496D |. 76 04 JBE SHORT jagmisc.10004973 1000496F |. 836D 08 14 SUB [ARG.1],14 10004973 |> A1 20B10010 MOV EAX,DWORD PTR DS:[1000B120] 10004978 |. A3 28B10010 MOV DWORD PTR DS:[1000B128],EAX 1000497D |> 8B45 08 MOV EAX,[ARG.1] 10004980 |. A3 18B10010 MOV DWORD PTR DS:[1000B118],EAX 10004985 |. 893D 30B10010 MOV DWORD PTR DS:[1000B130],EDI 1000498B |> 5B POP EBX ; kernel32.7C816FD7 1000498C |> 5F POP EDI ; kernel32.7C816FD7 1000498D |. 5E POP ESI ; kernel32.7C816FD7 1000498E |. C9 LEAVE 1000498F \. C3 RETN 10004990 /$ A1 1CB10010 MOV EAX,DWORD PTR DS:[1000B11C] 10004995 |. 8B0D 2CB10010 MOV ECX,DWORD PTR DS:[1000B12C] 1000499B |. 57 PUSH EDI 1000499C |. 33FF XOR EDI,EDI 1000499E |. 3BC1 CMP EAX,ECX 100049A0 |. 75 34 JNZ SHORT jagmisc.100049D6 100049A2 |. 8D4489 50 LEA EAX,DWORD PTR DS:[ECX+ECX*4+50] 100049A6 |. C1E0 02 SHL EAX,2 100049A9 |. 50 PUSH EAX ; /NewSize = 8 100049AA |. FF35 20B10010 PUSH DWORD PTR DS:[1000B120] ; |pMemory = NULL 100049B0 |. 57 PUSH EDI ; |Flags = 0 100049B1 |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000 100049B7 |. FF15 CC800010 CALL DWORD PTR DS:[<&KERNEL32.HeapReAlloc>] ; \HeapReAlloc 100049BD |. 3BC7 CMP EAX,EDI 100049BF |. 75 04 JNZ SHORT jagmisc.100049C5 100049C1 |. 33C0 XOR EAX,EAX 100049C3 |. 5F POP EDI ; kernel32.7C816FD7 100049C4 |. C3 RETN 100049C5 |> 8305 2CB10010 10 ADD DWORD PTR DS:[1000B12C],10 100049CC |. A3 20B10010 MOV DWORD PTR DS:[1000B120],EAX 100049D1 |. A1 1CB10010 MOV EAX,DWORD PTR DS:[1000B11C] 100049D6 |> 8B0D 20B10010 MOV ECX,DWORD PTR DS:[1000B120] 100049DC |. 56 PUSH ESI 100049DD |. 68 C4410000 PUSH 41C4 ; /HeapSize = 41C4 (16836.) 100049E2 |. 6A 08 PUSH 8 ; |Flags = HEAP_ZERO_MEMORY 100049E4 |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000 100049EA |. 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] ; | 100049ED |. 8D3481 LEA ESI,DWORD PTR DS:[ECX+EAX*4] ; | 100049F0 |. FF15 80800010 CALL DWORD PTR DS:[<&KERNEL32.HeapAlloc>] ; \HeapAlloc 100049F6 |. 3BC7 CMP EAX,EDI 100049F8 |. 8946 10 MOV DWORD PTR DS:[ESI+10],EAX 100049FB |. 75 04 JNZ SHORT jagmisc.10004A01 100049FD |> 33C0 XOR EAX,EAX 100049FF |. EB 43 JMP SHORT jagmisc.10004A44 10004A01 |> 6A 04 PUSH 4 ; /Protect = PAGE_READWRITE 10004A03 |. 68 00200000 PUSH 2000 ; |AllocationType = MEM_RESERVE 10004A08 |. 68 00001000 PUSH 100000 ; |Size = 100000 (1048576.) 10004A0D |. 57 PUSH EDI ; |Address = NULL 10004A0E |. FF15 C8800010 CALL DWORD PTR DS:[<&KERNEL32.VirtualAlloc>] ; \VirtualAlloc 10004A14 |. 3BC7 CMP EAX,EDI 10004A16 |. 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 10004A19 |. 75 12 JNZ SHORT jagmisc.10004A2D 10004A1B |. FF76 10 PUSH DWORD PTR DS:[ESI+10] ; /pMemory 10004A1E |. 57 PUSH EDI ; |Flags = 0 10004A1F |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000 10004A25 |. FF15 7C800010 CALL DWORD PTR DS:[<&KERNEL32.HeapFree>] ; \HeapFree 10004A2B |.^ EB D0 JMP SHORT jagmisc.100049FD 10004A2D |> 834E 08 FF OR DWORD PTR DS:[ESI+8],FFFFFFFF 10004A31 |. 893E MOV DWORD PTR DS:[ESI],EDI 10004A33 |. 897E 04 MOV DWORD PTR DS:[ESI+4],EDI 10004A36 |. FF05 1CB10010 INC DWORD PTR DS:[1000B11C] 10004A3C |. 8B46 10 MOV EAX,DWORD PTR DS:[ESI+10] 10004A3F |. 8308 FF OR DWORD PTR DS:[EAX],FFFFFFFF 10004A42 |. 8BC6 MOV EAX,ESI 10004A44 |> 5E POP ESI ; kernel32.7C816FD7 10004A45 |. 5F POP EDI ; kernel32.7C816FD7 10004A46 \. C3 RETN 10004A47 /$ 55 PUSH EBP 10004A48 |. 8BEC MOV EBP,ESP 10004A4A |. 51 PUSH ECX 10004A4B |. 51 PUSH ECX 10004A4C |. 8B4D 08 MOV ECX,[ARG.1] 10004A4F |. 8B41 08 MOV EAX,DWORD PTR DS:[ECX+8] 10004A52 |. 53 PUSH EBX 10004A53 |. 56 PUSH ESI 10004A54 |. 8B71 10 MOV ESI,DWORD PTR DS:[ECX+10] 10004A57 |. 57 PUSH EDI 10004A58 |. 33DB XOR EBX,EBX 10004A5A |. EB 03 JMP SHORT jagmisc.10004A5F 10004A5C |> D1E0 /SHL EAX,1 10004A5E |. 43 |INC EBX 10004A5F |> 85C0 TEST EAX,EAX 10004A61 |.^ 7D F9 \JGE SHORT jagmisc.10004A5C 10004A63 |. 8BC3 MOV EAX,EBX 10004A65 |. 69C0 04020000 IMUL EAX,EAX,204 10004A6B |. 8D8430 44010000 LEA EAX,DWORD PTR DS:[EAX+ESI+144] 10004A72 |. 6A 3F PUSH 3F 10004A74 |. 8945 F8 MOV [LOCAL.2],EAX 10004A77 |. 5A POP EDX ; kernel32.7C816FD7 10004A78 |> 8940 08 /MOV DWORD PTR DS:[EAX+8],EAX 10004A7B |. 8940 04 |MOV DWORD PTR DS:[EAX+4],EAX 10004A7E |. 83C0 08 |ADD EAX,8 10004A81 |. 4A |DEC EDX 10004A82 |.^ 75 F4 \JNZ SHORT jagmisc.10004A78 10004A84 |. 6A 04 PUSH 4 ; /Protect = PAGE_READWRITE 10004A86 |. 8BFB MOV EDI,EBX ; | 10004A88 |. 68 00100000 PUSH 1000 ; |AllocationType = MEM_COMMIT 10004A8D |. C1E7 0F SHL EDI,0F ; | 10004A90 |. 0379 0C ADD EDI,DWORD PTR DS:[ECX+C] ; | 10004A93 |. 68 00800000 PUSH 8000 ; |Size = 8000 (32768.) 10004A98 |. 57 PUSH EDI ; |Address = NULL 10004A99 |. FF15 C8800010 CALL DWORD PTR DS:[<&KERNEL32.VirtualAlloc>] ; \VirtualAlloc 10004A9F |. 85C0 TEST EAX,EAX 10004AA1 |. 75 08 JNZ SHORT jagmisc.10004AAB 10004AA3 |. 83C8 FF OR EAX,FFFFFFFF 10004AA6 |. E9 9D000000 JMP jagmisc.10004B48 10004AAB |> 8D97 00700000 LEA EDX,DWORD PTR DS:[EDI+7000] 10004AB1 |. 3BFA CMP EDI,EDX 10004AB3 |. 8955 FC MOV [LOCAL.1],EDX 10004AB6 |. 77 43 JA SHORT jagmisc.10004AFB 10004AB8 |. 8BCA MOV ECX,EDX 10004ABA |. 2BCF SUB ECX,EDI 10004ABC |. C1E9 0C SHR ECX,0C 10004ABF |. 8D47 10 LEA EAX,DWORD PTR DS:[EDI+10] 10004AC2 |. 41 INC ECX 10004AC3 |> 8348 F8 FF /OR DWORD PTR DS:[EAX-8],FFFFFFFF 10004AC7 |. 8388 EC0F0000 FF |OR DWORD PTR DS:[EAX+FEC],FFFFFFFF 10004ACE |. 8D90 FC0F0000 |LEA EDX,DWORD PTR DS:[EAX+FFC] 10004AD4 |. 8910 |MOV DWORD PTR DS:[EAX],EDX 10004AD6 |. 8D90 FCEFFFFF |LEA EDX,DWORD PTR DS:[EAX-1004] 10004ADC |. C740 FC F00F0000 |MOV DWORD PTR DS:[EAX-4],0FF0 10004AE3 |. 8950 04 |MOV DWORD PTR DS:[EAX+4],EDX 10004AE6 |. C780 E80F0000 F00>|MOV DWORD PTR DS:[EAX+FE8],0FF0 10004AF0 |. 05 00100000 |ADD EAX,1000 10004AF5 |. 49 |DEC ECX 10004AF6 |.^ 75 CB \JNZ SHORT jagmisc.10004AC3 10004AF8 |. 8B55 FC MOV EDX,[LOCAL.1] 10004AFB |> 8B45 F8 MOV EAX,[LOCAL.2] ; LOADDLL.00410249 10004AFE |. 05 F8010000 ADD EAX,1F8 10004B03 |. 8D4F 0C LEA ECX,DWORD PTR DS:[EDI+C] 10004B06 |. 8948 04 MOV DWORD PTR DS:[EAX+4],ECX 10004B09 |. 8941 08 MOV DWORD PTR DS:[ECX+8],EAX 10004B0C |. 8D4A 0C LEA ECX,DWORD PTR DS:[EDX+C] 10004B0F |. 8948 08 MOV DWORD PTR DS:[EAX+8],ECX 10004B12 |. 8941 04 MOV DWORD PTR DS:[ECX+4],EAX 10004B15 |. 83649E 44 00 AND DWORD PTR DS:[ESI+EBX*4+44],0 10004B1A |. 33FF XOR EDI,EDI 10004B1C |. 47 INC EDI 10004B1D |. 89BC9E C4000000 MOV DWORD PTR DS:[ESI+EBX*4+C4],EDI 10004B24 |. 8A46 43 MOV AL,BYTE PTR DS:[ESI+43] 10004B27 |. 8AC8 MOV CL,AL 10004B29 |. FEC1 INC CL 10004B2B |. 84C0 TEST AL,AL 10004B2D |. 8B45 08 MOV EAX,[ARG.1] 10004B30 |. 884E 43 MOV BYTE PTR DS:[ESI+43],CL 10004B33 |. 75 03 JNZ SHORT jagmisc.10004B38 10004B35 |. 0978 04 OR DWORD PTR DS:[EAX+4],EDI 10004B38 |> BA 00000080 MOV EDX,80000000 10004B3D |. 8BCB MOV ECX,EBX 10004B3F |. D3EA SHR EDX,CL 10004B41 |. F7D2 NOT EDX 10004B43 |. 2150 08 AND DWORD PTR DS:[EAX+8],EDX 10004B46 |. 8BC3 MOV EAX,EBX 10004B48 |> 5F POP EDI ; kernel32.7C816FD7 10004B49 |. 5E POP ESI ; kernel32.7C816FD7 10004B4A |. 5B POP EBX ; kernel32.7C816FD7 10004B4B |. C9 LEAVE 10004B4C \. C3 RETN 10004B4D /$ 55 PUSH EBP 10004B4E |. 8BEC MOV EBP,ESP 10004B50 |. 83EC 0C SUB ESP,0C 10004B53 |. 8B4D 08 MOV ECX,[ARG.1] 10004B56 |. 8B41 10 MOV EAX,DWORD PTR DS:[ECX+10] 10004B59 |. 53 PUSH EBX 10004B5A |. 56 PUSH ESI 10004B5B |. 8B75 10 MOV ESI,[ARG.3] 10004B5E |. 57 PUSH EDI 10004B5F |. 8B7D 0C MOV EDI,[ARG.2] 10004B62 |. 8BD7 MOV EDX,EDI 10004B64 |. 2B51 0C SUB EDX,DWORD PTR DS:[ECX+C] 10004B67 |. 83C6 17 ADD ESI,17 10004B6A |. C1EA 0F SHR EDX,0F 10004B6D |. 8BCA MOV ECX,EDX 10004B6F |. 69C9 04020000 IMUL ECX,ECX,204 10004B75 |. 8D8C01 44010000 LEA ECX,DWORD PTR DS:[ECX+EAX+144] 10004B7C |. 894D F4 MOV [LOCAL.3],ECX 10004B7F |. 8B4F FC MOV ECX,DWORD PTR DS:[EDI-4] 10004B82 |. 83E6 F0 AND ESI,FFFFFFF0 10004B85 |. 49 DEC ECX 10004B86 |. 3BF1 CMP ESI,ECX 10004B88 |. 8D7C39 FC LEA EDI,DWORD PTR DS:[ECX+EDI-4] 10004B8C |. 8B1F MOV EBX,DWORD PTR DS:[EDI] 10004B8E |. 894D 10 MOV [ARG.3],ECX 10004B91 |. 895D FC MOV [LOCAL.1],EBX 10004B94 |. 0F8E 55010000 JLE jagmisc.10004CEF 10004B9A |. F6C3 01 TEST BL,1 10004B9D |. 0F85 45010000 JNZ jagmisc.10004CE8 10004BA3 |. 03D9 ADD EBX,ECX 10004BA5 |. 3BF3 CMP ESI,EBX 10004BA7 |. 0F8F 3B010000 JG jagmisc.10004CE8 10004BAD |. 8B4D FC MOV ECX,[LOCAL.1] 10004BB0 |. C1F9 04 SAR ECX,4 10004BB3 |. 49 DEC ECX 10004BB4 |. 83F9 3F CMP ECX,3F 10004BB7 |. 894D F8 MOV [LOCAL.2],ECX 10004BBA |. 76 06 JBE SHORT jagmisc.10004BC2 10004BBC |. 6A 3F PUSH 3F 10004BBE |. 59 POP ECX ; kernel32.7C816FD7 10004BBF |. 894D F8 MOV [LOCAL.2],ECX 10004BC2 |> 8B5F 04 MOV EBX,DWORD PTR DS:[EDI+4] 10004BC5 |. 3B5F 08 CMP EBX,DWORD PTR DS:[EDI+8] 10004BC8 |. 75 43 JNZ SHORT jagmisc.10004C0D 10004BCA |. 83F9 20 CMP ECX,20 10004BCD |. BB 00000080 MOV EBX,80000000 10004BD2 |. 73 1A JNB SHORT jagmisc.10004BEE 10004BD4 |. D3EB SHR EBX,CL 10004BD6 |. 8B4D F8 MOV ECX,[LOCAL.2] ; LOADDLL.00410249 10004BD9 |. 8D4C01 04 LEA ECX,DWORD PTR DS:[ECX+EAX+4] 10004BDD |. F7D3 NOT EBX 10004BDF |. 215C90 44 AND DWORD PTR DS:[EAX+EDX*4+44],EBX 10004BE3 |. FE09 DEC BYTE PTR DS:[ECX] 10004BE5 |. 75 26 JNZ SHORT jagmisc.10004C0D 10004BE7 |. 8B4D 08 MOV ECX,[ARG.1] 10004BEA |. 2119 AND DWORD PTR DS:[ECX],EBX 10004BEC |. EB 1F JMP SHORT jagmisc.10004C0D 10004BEE |> 83C1 E0 ADD ECX,-20 10004BF1 |. D3EB SHR EBX,CL 10004BF3 |. 8B4D F8 MOV ECX,[LOCAL.2] ; LOADDLL.00410249 10004BF6 |. 8D4C01 04 LEA ECX,DWORD PTR DS:[ECX+EAX+4] 10004BFA |. F7D3 NOT EBX 10004BFC |. 219C90 C4000000 AND DWORD PTR DS:[EAX+EDX*4+C4],EBX 10004C03 |. FE09 DEC BYTE PTR DS:[ECX] 10004C05 |. 75 06 JNZ SHORT jagmisc.10004C0D 10004C07 |. 8B4D 08 MOV ECX,[ARG.1] 10004C0A |. 2159 04 AND DWORD PTR DS:[ECX+4],EBX 10004C0D |> 8B4F 08 MOV ECX,DWORD PTR DS:[EDI+8] 10004C10 |. 8B5F 04 MOV EBX,DWORD PTR DS:[EDI+4] 10004C13 |. 8959 04 MOV DWORD PTR DS:[ECX+4],EBX 10004C16 |. 8B4F 04 MOV ECX,DWORD PTR DS:[EDI+4] 10004C19 |. 8B7F 08 MOV EDI,DWORD PTR DS:[EDI+8] 10004C1C |. 8979 08 MOV DWORD PTR DS:[ECX+8],EDI 10004C1F |. 8B4D 10 MOV ECX,[ARG.3] 10004C22 |. 2BCE SUB ECX,ESI 10004C24 |. 014D FC ADD [LOCAL.1],ECX 10004C27 |. 837D FC 00 CMP [LOCAL.1],0 10004C2B |. 0F8E A5000000 JLE jagmisc.10004CD6 10004C31 |. 8B7D FC MOV EDI,[LOCAL.1] 10004C34 |. 8B4D 0C MOV ECX,[ARG.2] 10004C37 |. C1FF 04 SAR EDI,4 10004C3A |. 4F DEC EDI 10004C3B |. 83FF 3F CMP EDI,3F 10004C3E |. 8D4C31 FC LEA ECX,DWORD PTR DS:[ECX+ESI-4] 10004C42 |. 76 03 JBE SHORT jagmisc.10004C47 10004C44 |. 6A 3F PUSH 3F 10004C46 |. 5F POP EDI ; kernel32.7C816FD7 10004C47 |> 8B5D F4 MOV EBX,[LOCAL.3] 10004C4A |. 8D1CFB LEA EBX,DWORD PTR DS:[EBX+EDI*8] 10004C4D |. 895D 10 MOV [ARG.3],EBX 10004C50 |. 8B5B 04 MOV EBX,DWORD PTR DS:[EBX+4] 10004C53 |. 8959 04 MOV DWORD PTR DS:[ECX+4],EBX 10004C56 |. 8B5D 10 MOV EBX,[ARG.3] 10004C59 |. 8959 08 MOV DWORD PTR DS:[ECX+8],EBX 10004C5C |. 894B 04 MOV DWORD PTR DS:[EBX+4],ECX 10004C5F |. 8B59 04 MOV EBX,DWORD PTR DS:[ECX+4] 10004C62 |. 894B 08 MOV DWORD PTR DS:[EBX+8],ECX 10004C65 |. 8B59 04 MOV EBX,DWORD PTR DS:[ECX+4] 10004C68 |. 3B59 08 CMP EBX,DWORD PTR DS:[ECX+8] 10004C6B |. 75 57 JNZ SHORT jagmisc.10004CC4 10004C6D |. 8A4C07 04 MOV CL,BYTE PTR DS:[EDI+EAX+4] 10004C71 |. 884D 13 MOV BYTE PTR SS:[EBP+13],CL 10004C74 |. FEC1 INC CL 10004C76 |. 83FF 20 CMP EDI,20 10004C79 |. 884C07 04 MOV BYTE PTR DS:[EDI+EAX+4],CL 10004C7D |. 73 1C JNB SHORT jagmisc.10004C9B 10004C7F |. 807D 13 00 CMP BYTE PTR SS:[EBP+13],0 10004C83 |. 75 0E JNZ SHORT jagmisc.10004C93 10004C85 |. 8BCF MOV ECX,EDI 10004C87 |. BB 00000080 MOV EBX,80000000 10004C8C |. D3EB SHR EBX,CL 10004C8E |. 8B4D 08 MOV ECX,[ARG.1] 10004C91 |. 0919 OR DWORD PTR DS:[ECX],EBX 10004C93 |> 8D4490 44 LEA EAX,DWORD PTR DS:[EAX+EDX*4+44] 10004C97 |. 8BCF MOV ECX,EDI 10004C99 |. EB 20 JMP SHORT jagmisc.10004CBB 10004C9B |> 807D 13 00 CMP BYTE PTR SS:[EBP+13],0 10004C9F |. 75 10 JNZ SHORT jagmisc.10004CB1 10004CA1 |. 8D4F E0 LEA ECX,DWORD PTR DS:[EDI-20] 10004CA4 |. BB 00000080 MOV EBX,80000000 10004CA9 |. D3EB SHR EBX,CL 10004CAB |. 8B4D 08 MOV ECX,[ARG.1] 10004CAE |. 0959 04 OR DWORD PTR DS:[ECX+4],EBX 10004CB1 |> 8D8490 C4000000 LEA EAX,DWORD PTR DS:[EAX+EDX*4+C4] 10004CB8 |. 8D4F E0 LEA ECX,DWORD PTR DS:[EDI-20] 10004CBB |> BA 00000080 MOV EDX,80000000 10004CC0 |. D3EA SHR EDX,CL 10004CC2 |. 0910 OR DWORD PTR DS:[EAX],EDX 10004CC4 |> 8B55 0C MOV EDX,[ARG.2] 10004CC7 |. 8B4D FC MOV ECX,[LOCAL.1] 10004CCA |. 8D4432 FC LEA EAX,DWORD PTR DS:[EDX+ESI-4] 10004CCE |. 8908 MOV DWORD PTR DS:[EAX],ECX 10004CD0 |. 894C01 FC MOV DWORD PTR DS:[ECX+EAX-4],ECX 10004CD4 |. EB 03 JMP SHORT jagmisc.10004CD9 10004CD6 |> 8B55 0C MOV EDX,[ARG.2] 10004CD9 |> 8D46 01 LEA EAX,DWORD PTR DS:[ESI+1] 10004CDC |. 8942 FC MOV DWORD PTR DS:[EDX-4],EAX 10004CDF |. 894432 F8 MOV DWORD PTR DS:[EDX+ESI-8],EAX 10004CE3 |. E9 3C010000 JMP jagmisc.10004E24 10004CE8 |> 33C0 XOR EAX,EAX 10004CEA |. E9 38010000 JMP jagmisc.10004E27 10004CEF |> 0F8D 2F010000 JGE jagmisc.10004E24 10004CF5 |. 8B5D 0C MOV EBX,[ARG.2] 10004CF8 |. 2975 10 SUB [ARG.3],ESI 10004CFB |. 8D4E 01 LEA ECX,DWORD PTR DS:[ESI+1] 10004CFE |. 894B FC MOV DWORD PTR DS:[EBX-4],ECX 10004D01 |. 8D5C33 FC LEA EBX,DWORD PTR DS:[EBX+ESI-4] 10004D05 |. 8B75 10 MOV ESI,[ARG.3] 10004D08 |. C1FE 04 SAR ESI,4 10004D0B |. 4E DEC ESI 10004D0C |. 83FE 3F CMP ESI,3F 10004D0F |. 895D 0C MOV [ARG.2],EBX 10004D12 |. 894B FC MOV DWORD PTR DS:[EBX-4],ECX 10004D15 |. 76 03 JBE SHORT jagmisc.10004D1A 10004D17 |. 6A 3F PUSH 3F 10004D19 |. 5E POP ESI ; kernel32.7C816FD7 10004D1A |> F645 FC 01 TEST BYTE PTR SS:[EBP-4],1 10004D1E |. 0F85 80000000 JNZ jagmisc.10004DA4 10004D24 |. 8B75 FC MOV ESI,[LOCAL.1] 10004D27 |. C1FE 04 SAR ESI,4 10004D2A |. 4E DEC ESI 10004D2B |. 83FE 3F CMP ESI,3F 10004D2E |. 76 03 JBE SHORT jagmisc.10004D33 10004D30 |. 6A 3F PUSH 3F 10004D32 |. 5E POP ESI ; kernel32.7C816FD7 10004D33 |> 8B4F 04 MOV ECX,DWORD PTR DS:[EDI+4] 10004D36 |. 3B4F 08 CMP ECX,DWORD PTR DS:[EDI+8] 10004D39 |. 75 42 JNZ SHORT jagmisc.10004D7D 10004D3B |. 83FE 20 CMP ESI,20 10004D3E |. BB 00000080 MOV EBX,80000000 10004D43 |. 73 19 JNB SHORT jagmisc.10004D5E 10004D45 |. 8BCE MOV ECX,ESI 10004D47 |. D3EB SHR EBX,CL 10004D49 |. 8D7406 04 LEA ESI,DWORD PTR DS:[ESI+EAX+4] 10004D4D |. F7D3 NOT EBX 10004D4F |. 215C90 44 AND DWORD PTR DS:[EAX+EDX*4+44],EBX 10004D53 |. FE0E DEC BYTE PTR DS:[ESI] 10004D55 |. 75 23 JNZ SHORT jagmisc.10004D7A 10004D57 |. 8B4D 08 MOV ECX,[ARG.1] 10004D5A |. 2119 AND DWORD PTR DS:[ECX],EBX 10004D5C |. EB 1C JMP SHORT jagmisc.10004D7A 10004D5E |> 8D4E E0 LEA ECX,DWORD PTR DS:[ESI-20] 10004D61 |. D3EB SHR EBX,CL 10004D63 |. 8D4C06 04 LEA ECX,DWORD PTR DS:[ESI+EAX+4] 10004D67 |. F7D3 NOT EBX 10004D69 |. 219C90 C4000000 AND DWORD PTR DS:[EAX+EDX*4+C4],EBX 10004D70 |. FE09 DEC BYTE PTR DS:[ECX] 10004D72 |. 75 06 JNZ SHORT jagmisc.10004D7A 10004D74 |. 8B4D 08 MOV ECX,[ARG.1] 10004D77 |. 2159 04 AND DWORD PTR DS:[ECX+4],EBX 10004D7A |> 8B5D 0C MOV EBX,[ARG.2] 10004D7D |> 8B4F 08 MOV ECX,DWORD PTR DS:[EDI+8] 10004D80 |. 8B77 04 MOV ESI,DWORD PTR DS:[EDI+4] 10004D83 |. 8971 04 MOV DWORD PTR DS:[ECX+4],ESI 10004D86 |. 8B77 08 MOV ESI,DWORD PTR DS:[EDI+8] 10004D89 |. 8B4F 04 MOV ECX,DWORD PTR DS:[EDI+4] 10004D8C |. 8971 08 MOV DWORD PTR DS:[ECX+8],ESI 10004D8F |. 8B75 10 MOV ESI,[ARG.3] 10004D92 |. 0375 FC ADD ESI,[LOCAL.1] 10004D95 |. 8975 10 MOV [ARG.3],ESI 10004D98 |. C1FE 04 SAR ESI,4 10004D9B |. 4E DEC ESI 10004D9C |. 83FE 3F CMP ESI,3F 10004D9F |. 76 03 JBE SHORT jagmisc.10004DA4 10004DA1 |. 6A 3F PUSH 3F 10004DA3 |. 5E POP ESI ; kernel32.7C816FD7 10004DA4 |> 8B4D F4 MOV ECX,[LOCAL.3] 10004DA7 |. 8D0CF1 LEA ECX,DWORD PTR DS:[ECX+ESI*8] 10004DAA |. 8B79 04 MOV EDI,DWORD PTR DS:[ECX+4] 10004DAD |. 894B 08 MOV DWORD PTR DS:[EBX+8],ECX 10004DB0 |. 897B 04 MOV DWORD PTR DS:[EBX+4],EDI 10004DB3 |. 8959 04 MOV DWORD PTR DS:[ECX+4],EBX 10004DB6 |. 8B4B 04 MOV ECX,DWORD PTR DS:[EBX+4] 10004DB9 |. 8959 08 MOV DWORD PTR DS:[ECX+8],EBX 10004DBC |. 8B4B 04 MOV ECX,DWORD PTR DS:[EBX+4] 10004DBF |. 3B4B 08 CMP ECX,DWORD PTR DS:[EBX+8] 10004DC2 |. 75 57 JNZ SHORT jagmisc.10004E1B 10004DC4 |. 8A4C06 04 MOV CL,BYTE PTR DS:[ESI+EAX+4] 10004DC8 |. 884D 0F MOV BYTE PTR SS:[EBP+F],CL 10004DCB |. FEC1 INC CL 10004DCD |. 83FE 20 CMP ESI,20 10004DD0 |. 884C06 04 MOV BYTE PTR DS:[ESI+EAX+4],CL 10004DD4 |. 73 1C JNB SHORT jagmisc.10004DF2 10004DD6 |. 807D 0F 00 CMP BYTE PTR SS:[EBP+F],0 10004DDA |. 75 0E JNZ SHORT jagmisc.10004DEA 10004DDC |. 8BCE MOV ECX,ESI 10004DDE |. BF 00000080 MOV EDI,80000000 10004DE3 |. D3EF SHR EDI,CL 10004DE5 |. 8B4D 08 MOV ECX,[ARG.1] 10004DE8 |. 0939 OR DWORD PTR DS:[ECX],EDI 10004DEA |> 8D4490 44 LEA EAX,DWORD PTR DS:[EAX+EDX*4+44] 10004DEE |. 8BCE MOV ECX,ESI 10004DF0 |. EB 20 JMP SHORT jagmisc.10004E12 10004DF2 |> 807D 0F 00 CMP BYTE PTR SS:[EBP+F],0 10004DF6 |. 75 10 JNZ SHORT jagmisc.10004E08 10004DF8 |. 8D4E E0 LEA ECX,DWORD PTR DS:[ESI-20] 10004DFB |. BF 00000080 MOV EDI,80000000 10004E00 |. D3EF SHR EDI,CL 10004E02 |. 8B4D 08 MOV ECX,[ARG.1] 10004E05 |. 0979 04 OR DWORD PTR DS:[ECX+4],EDI 10004E08 |> 8D8490 C4000000 LEA EAX,DWORD PTR DS:[EAX+EDX*4+C4] 10004E0F |. 8D4E E0 LEA ECX,DWORD PTR DS:[ESI-20] 10004E12 |> BA 00000080 MOV EDX,80000000 10004E17 |. D3EA SHR EDX,CL 10004E19 |. 0910 OR DWORD PTR DS:[EAX],EDX 10004E1B |> 8B45 10 MOV EAX,[ARG.3] 10004E1E |. 8903 MOV DWORD PTR DS:[EBX],EAX 10004E20 |. 894418 FC MOV DWORD PTR DS:[EAX+EBX-4],EAX 10004E24 |> 33C0 XOR EAX,EAX 10004E26 |. 40 INC EAX 10004E27 |> 5F POP EDI ; kernel32.7C816FD7 10004E28 |. 5E POP ESI ; kernel32.7C816FD7 10004E29 |. 5B POP EBX ; kernel32.7C816FD7 10004E2A |. C9 LEAVE 10004E2B \. C3 RETN 10004E2C /$ 55 PUSH EBP 10004E2D |. 8BEC MOV EBP,ESP 10004E2F |. 83EC 14 SUB ESP,14 10004E32 |. 8B4D 08 MOV ECX,[ARG.1] 10004E35 |. A1 1CB10010 MOV EAX,DWORD PTR DS:[1000B11C] 10004E3A |. 8B15 20B10010 MOV EDX,DWORD PTR DS:[1000B120] 10004E40 |. 83C1 17 ADD ECX,17 10004E43 |. 83E1 F0 AND ECX,FFFFFFF0 10004E46 |. 53 PUSH EBX 10004E47 |. 894D F0 MOV [LOCAL.4],ECX 10004E4A |. C1F9 04 SAR ECX,4 10004E4D |. 56 PUSH ESI 10004E4E |. 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 10004E51 |. 57 PUSH EDI 10004E52 |. 49 DEC ECX 10004E53 |. 83F9 20 CMP ECX,20 10004E56 |. 8D3C82 LEA EDI,DWORD PTR DS:[EDX+EAX*4] 10004E59 |. 897D FC MOV [LOCAL.1],EDI 10004E5C |. 7D 0B JGE SHORT jagmisc.10004E69 10004E5E |. 83CE FF OR ESI,FFFFFFFF 10004E61 |. D3EE SHR ESI,CL 10004E63 |. 834D F8 FF OR [LOCAL.2],FFFFFFFF 10004E67 |. EB 0D JMP SHORT jagmisc.10004E76 10004E69 |> 83C1 E0 ADD ECX,-20 10004E6C |. 83C8 FF OR EAX,FFFFFFFF 10004E6F |. 33F6 XOR ESI,ESI 10004E71 |. D3E8 SHR EAX,CL 10004E73 |. 8945 F8 MOV [LOCAL.2],EAX 10004E76 |> A1 28B10010 MOV EAX,DWORD PTR DS:[1000B128] 10004E7B |. 8BD8 MOV EBX,EAX 10004E7D |. 8975 F4 MOV [LOCAL.3],ESI 10004E80 |. 3BDF CMP EBX,EDI 10004E82 |. EB 14 JMP SHORT jagmisc.10004E98 10004E84 |> 8B4B 04 /MOV ECX,DWORD PTR DS:[EBX+4] 10004E87 |. 8B3B |MOV EDI,DWORD PTR DS:[EBX] 10004E89 |. 234D F8 |AND ECX,[LOCAL.2] ; LOADDLL.00410249 10004E8C |. 23FE |AND EDI,ESI 10004E8E |. 0BCF |OR ECX,EDI 10004E90 |. 75 0B |JNZ SHORT jagmisc.10004E9D 10004E92 |. 83C3 14 |ADD EBX,14 10004E95 |. 3B5D FC |CMP EBX,[LOCAL.1] 10004E98 |> 895D 08 MOV [ARG.1],EBX 10004E9B |.^ 72 E7 \JB SHORT jagmisc.10004E84 10004E9D |> 3B5D FC CMP EBX,[LOCAL.1] 10004EA0 |. 75 24 JNZ SHORT jagmisc.10004EC6 10004EA2 |. 8BDA MOV EBX,EDX 10004EA4 |. EB 11 JMP SHORT jagmisc.10004EB7 10004EA6 |> 8B4B 04 /MOV ECX,DWORD PTR DS:[EBX+4] 10004EA9 |. 8B3B |MOV EDI,DWORD PTR DS:[EBX] 10004EAB |. 234D F8 |AND ECX,[LOCAL.2] ; LOADDLL.00410249 10004EAE |. 23FE |AND EDI,ESI 10004EB0 |. 0BCF |OR ECX,EDI 10004EB2 |. 75 0A |JNZ SHORT jagmisc.10004EBE 10004EB4 |. 83C3 14 |ADD EBX,14 10004EB7 |> 3BD8 CMP EBX,EAX 10004EB9 |. 895D 08 |MOV [ARG.1],EBX 10004EBC |.^ 72 E8 \JB SHORT jagmisc.10004EA6 10004EBE |> 3BD8 CMP EBX,EAX 10004EC0 |. 0F84 94000000 JE jagmisc.10004F5A 10004EC6 |> 891D 28B10010 MOV DWORD PTR DS:[1000B128],EBX 10004ECC |. 8B43 10 MOV EAX,DWORD PTR DS:[EBX+10] 10004ECF |. 8B10 MOV EDX,DWORD PTR DS:[EAX] 10004ED1 |. 83FA FF CMP EDX,-1 10004ED4 |. 8955 FC MOV [LOCAL.1],EDX 10004ED7 |. 74 14 JE SHORT jagmisc.10004EED 10004ED9 |. 8B8C90 C4000000 MOV ECX,DWORD PTR DS:[EAX+EDX*4+C4] 10004EE0 |. 8B7C90 44 MOV EDI,DWORD PTR DS:[EAX+EDX*4+44] 10004EE4 |. 234D F8 AND ECX,[LOCAL.2] ; LOADDLL.00410249 10004EE7 |. 23FE AND EDI,ESI 10004EE9 |. 0BCF OR ECX,EDI 10004EEB |. 75 36 JNZ SHORT jagmisc.10004F23 10004EED |> 8B90 C4000000 MOV EDX,DWORD PTR DS:[EAX+C4] 10004EF3 |. 2355 F8 AND EDX,[LOCAL.2] ; LOADDLL.00410249 10004EF6 |. 8365 FC 00 AND [LOCAL.1],0 10004EFA |. 8D48 44 LEA ECX,DWORD PTR DS:[EAX+44] 10004EFD |. 8B31 MOV ESI,DWORD PTR DS:[ECX] 10004EFF |. 2375 F4 AND ESI,[LOCAL.3] 10004F02 |. 0BD6 OR EDX,ESI 10004F04 |. 8B75 F4 MOV ESI,[LOCAL.3] 10004F07 |. 75 17 JNZ SHORT jagmisc.10004F20 10004F09 |> 8B91 84000000 /MOV EDX,DWORD PTR DS:[ECX+84] 10004F0F |. 2355 F8 |AND EDX,[LOCAL.2] ; LOADDLL.00410249 10004F12 |. FF45 FC |INC [LOCAL.1] 10004F15 |. 83C1 04 |ADD ECX,4 10004F18 |. 8B39 |MOV EDI,DWORD PTR DS:[ECX] 10004F1A |. 23FE |AND EDI,ESI 10004F1C |. 0BD7 |OR EDX,EDI 10004F1E |.^ 74 E9 \JE SHORT jagmisc.10004F09 10004F20 |> 8B55 FC MOV EDX,[LOCAL.1] 10004F23 |> 8BCA MOV ECX,EDX 10004F25 |. 69C9 04020000 IMUL ECX,ECX,204 10004F2B |. 8D8C01 44010000 LEA ECX,DWORD PTR DS:[ECX+EAX+144] 10004F32 |. 894D F4 MOV [LOCAL.3],ECX 10004F35 |. 8B4C90 44 MOV ECX,DWORD PTR DS:[EAX+EDX*4+44] 10004F39 |. 33FF XOR EDI,EDI 10004F3B |. 23CE AND ECX,ESI 10004F3D |. 75 6D JNZ SHORT jagmisc.10004FAC 10004F3F |. 8B8C90 C4000000 MOV ECX,DWORD PTR DS:[EAX+EDX*4+C4] 10004F46 |. 234D F8 AND ECX,[LOCAL.2] ; LOADDLL.00410249 10004F49 |. 6A 20 PUSH 20 10004F4B |. 5F POP EDI ; kernel32.7C816FD7 10004F4C |. EB 5E JMP SHORT jagmisc.10004FAC 10004F4E |> 837B 08 00 /CMP DWORD PTR DS:[EBX+8],0 10004F52 |. 75 0B |JNZ SHORT jagmisc.10004F5F 10004F54 |. 83C3 14 |ADD EBX,14 10004F57 |. 895D 08 |MOV [ARG.1],EBX 10004F5A |> 3B5D FC CMP EBX,[LOCAL.1] 10004F5D |.^ 72 EF \JB SHORT jagmisc.10004F4E 10004F5F |> 3B5D FC CMP EBX,[LOCAL.1] 10004F62 |. 75 26 JNZ SHORT jagmisc.10004F8A 10004F64 |. 8BDA MOV EBX,EDX 10004F66 |. EB 09 JMP SHORT jagmisc.10004F71 10004F68 |> 837B 08 00 /CMP DWORD PTR DS:[EBX+8],0 10004F6C |. 75 0A |JNZ SHORT jagmisc.10004F78 10004F6E |. 83C3 14 |ADD EBX,14 10004F71 |> 3BD8 CMP EBX,EAX 10004F73 |. 895D 08 |MOV [ARG.1],EBX 10004F76 |.^ 72 F0 \JB SHORT jagmisc.10004F68 10004F78 |> 3BD8 CMP EBX,EAX 10004F7A |. 75 0E JNZ SHORT jagmisc.10004F8A 10004F7C |. E8 0FFAFFFF CALL jagmisc.10004990 10004F81 |. 8BD8 MOV EBX,EAX 10004F83 |. 85DB TEST EBX,EBX 10004F85 |. 895D 08 MOV [ARG.1],EBX 10004F88 |. 74 18 JE SHORT jagmisc.10004FA2 10004F8A |> 53 PUSH EBX 10004F8B |. E8 B7FAFFFF CALL jagmisc.10004A47 10004F90 |. 59 POP ECX ; kernel32.7C816FD7 10004F91 |. 8B4B 10 MOV ECX,DWORD PTR DS:[EBX+10] 10004F94 |. 8901 MOV DWORD PTR DS:[ECX],EAX 10004F96 |. 8B43 10 MOV EAX,DWORD PTR DS:[EBX+10] 10004F99 |. 8338 FF CMP DWORD PTR DS:[EAX],-1 10004F9C |.^ 0F85 24FFFFFF JNZ jagmisc.10004EC6 10004FA2 |> 33C0 XOR EAX,EAX 10004FA4 |. E9 7A010000 JMP jagmisc.10005123 10004FA9 |> D1E1 /SHL ECX,1 10004FAB |. 47 |INC EDI 10004FAC |> 85C9 TEST ECX,ECX 10004FAE |.^ 7D F9 \JGE SHORT jagmisc.10004FA9 10004FB0 |. 8B4D F4 MOV ECX,[LOCAL.3] 10004FB3 |. 8B54F9 04 MOV EDX,DWORD PTR DS:[ECX+EDI*8+4] 10004FB7 |. 8B0A MOV ECX,DWORD PTR DS:[EDX] 10004FB9 |. 2B4D F0 SUB ECX,[LOCAL.4] 10004FBC |. 8BF1 MOV ESI,ECX 10004FBE |. C1FE 04 SAR ESI,4 10004FC1 |. 4E DEC ESI 10004FC2 |. 83FE 3F CMP ESI,3F 10004FC5 |. 894D F8 MOV [LOCAL.2],ECX 10004FC8 |. 7E 03 JLE SHORT jagmisc.10004FCD 10004FCA |. 6A 3F PUSH 3F 10004FCC |. 5E POP ESI ; kernel32.7C816FD7 10004FCD |> 3BF7 CMP ESI,EDI 10004FCF |. 0F84 01010000 JE jagmisc.100050D6 10004FD5 |. 8B4A 04 MOV ECX,DWORD PTR DS:[EDX+4] 10004FD8 |. 3B4A 08 CMP ECX,DWORD PTR DS:[EDX+8] 10004FDB |. 75 5C JNZ SHORT jagmisc.10005039 10004FDD |. 83FF 20 CMP EDI,20 10004FE0 |. BB 00000080 MOV EBX,80000000 10004FE5 |. 7D 26 JGE SHORT jagmisc.1000500D 10004FE7 |. 8BCF MOV ECX,EDI 10004FE9 |. D3EB SHR EBX,CL 10004FEB |. 8B4D FC MOV ECX,[LOCAL.1] 10004FEE |. 8D7C38 04 LEA EDI,DWORD PTR DS:[EAX+EDI+4] 10004FF2 |. F7D3 NOT EBX 10004FF4 |. 895D EC MOV [LOCAL.5],EBX 10004FF7 |. 235C88 44 AND EBX,DWORD PTR DS:[EAX+ECX*4+44] 10004FFB |. 895C88 44 MOV DWORD PTR DS:[EAX+ECX*4+44],EBX 10004FFF |. FE0F DEC BYTE PTR DS:[EDI] 10005001 |. 75 33 JNZ SHORT jagmisc.10005036 10005003 |. 8B4D EC MOV ECX,[LOCAL.5] 10005006 |. 8B5D 08 MOV EBX,[ARG.1] 10005009 |. 210B AND DWORD PTR DS:[EBX],ECX 1000500B |. EB 2C JMP SHORT jagmisc.10005039 1000500D |> 8D4F E0 LEA ECX,DWORD PTR DS:[EDI-20] 10005010 |. D3EB SHR EBX,CL 10005012 |. 8B4D FC MOV ECX,[LOCAL.1] 10005015 |. 8D8C88 C4000000 LEA ECX,DWORD PTR DS:[EAX+ECX*4+C4] 1000501C |. 8D7C38 04 LEA EDI,DWORD PTR DS:[EAX+EDI+4] 10005020 |. F7D3 NOT EBX 10005022 |. 2119 AND DWORD PTR DS:[ECX],EBX 10005024 |. FE0F DEC BYTE PTR DS:[EDI] 10005026 |. 895D EC MOV [LOCAL.5],EBX 10005029 |. 75 0B JNZ SHORT jagmisc.10005036 1000502B |. 8B5D 08 MOV EBX,[ARG.1] 1000502E |. 8B4D EC MOV ECX,[LOCAL.5] 10005031 |. 214B 04 AND DWORD PTR DS:[EBX+4],ECX 10005034 |. EB 03 JMP SHORT jagmisc.10005039 10005036 |> 8B5D 08 MOV EBX,[ARG.1] 10005039 |> 837D F8 00 CMP [LOCAL.2],0 1000503D |. 8B4A 08 MOV ECX,DWORD PTR DS:[EDX+8] 10005040 |. 8B7A 04 MOV EDI,DWORD PTR DS:[EDX+4] 10005043 |. 8979 04 MOV DWORD PTR DS:[ECX+4],EDI 10005046 |. 8B4A 04 MOV ECX,DWORD PTR DS:[EDX+4] 10005049 |. 8B7A 08 MOV EDI,DWORD PTR DS:[EDX+8] 1000504C |. 8979 08 MOV DWORD PTR DS:[ECX+8],EDI 1000504F |. 0F84 8D000000 JE jagmisc.100050E2 10005055 |. 8B4D F4 MOV ECX,[LOCAL.3] 10005058 |. 8D0CF1 LEA ECX,DWORD PTR DS:[ECX+ESI*8] 1000505B |. 8B79 04 MOV EDI,DWORD PTR DS:[ECX+4] 1000505E |. 894A 08 MOV DWORD PTR DS:[EDX+8],ECX 10005061 |. 897A 04 MOV DWORD PTR DS:[EDX+4],EDI 10005064 |. 8951 04 MOV DWORD PTR DS:[ECX+4],EDX 10005067 |. 8B4A 04 MOV ECX,DWORD PTR DS:[EDX+4] 1000506A |. 8951 08 MOV DWORD PTR DS:[ECX+8],EDX 1000506D |. 8B4A 04 MOV ECX,DWORD PTR DS:[EDX+4] 10005070 |. 3B4A 08 CMP ECX,DWORD PTR DS:[EDX+8] 10005073 |. 75 5E JNZ SHORT jagmisc.100050D3 10005075 |. 8A4C06 04 MOV CL,BYTE PTR DS:[ESI+EAX+4] 10005079 |. 884D 0B MOV BYTE PTR SS:[EBP+B],CL 1000507C |. FEC1 INC CL 1000507E |. 83FE 20 CMP ESI,20 10005081 |. 884C06 04 MOV BYTE PTR DS:[ESI+EAX+4],CL 10005085 |. 7D 23 JGE SHORT jagmisc.100050AA 10005087 |. 807D 0B 00 CMP BYTE PTR SS:[EBP+B],0 1000508B |. 75 0B JNZ SHORT jagmisc.10005098 1000508D |. BF 00000080 MOV EDI,80000000 10005092 |. 8BCE MOV ECX,ESI 10005094 |. D3EF SHR EDI,CL 10005096 |. 093B OR DWORD PTR DS:[EBX],EDI 10005098 |> 8BCE MOV ECX,ESI 1000509A |. BF 00000080 MOV EDI,80000000 1000509F |. D3EF SHR EDI,CL 100050A1 |. 8B4D FC MOV ECX,[LOCAL.1] 100050A4 |. 097C88 44 OR DWORD PTR DS:[EAX+ECX*4+44],EDI 100050A8 |. EB 29 JMP SHORT jagmisc.100050D3 100050AA |> 807D 0B 00 CMP BYTE PTR SS:[EBP+B],0 100050AE |. 75 0D JNZ SHORT jagmisc.100050BD 100050B0 |. 8D4E E0 LEA ECX,DWORD PTR DS:[ESI-20] 100050B3 |. BF 00000080 MOV EDI,80000000 100050B8 |. D3EF SHR EDI,CL 100050BA |. 097B 04 OR DWORD PTR DS:[EBX+4],EDI 100050BD |> 8B4D FC MOV ECX,[LOCAL.1] 100050C0 |. 8DBC88 C4000000 LEA EDI,DWORD PTR DS:[EAX+ECX*4+C4] 100050C7 |. 8D4E E0 LEA ECX,DWORD PTR DS:[ESI-20] 100050CA |. BE 00000080 MOV ESI,80000000 100050CF |. D3EE SHR ESI,CL 100050D1 |. 0937 OR DWORD PTR DS:[EDI],ESI 100050D3 |> 8B4D F8 MOV ECX,[LOCAL.2] ; LOADDLL.00410249 100050D6 |> 85C9 TEST ECX,ECX 100050D8 |. 74 0B JE SHORT jagmisc.100050E5 100050DA |. 890A MOV DWORD PTR DS:[EDX],ECX 100050DC |. 894C11 FC MOV DWORD PTR DS:[ECX+EDX-4],ECX 100050E0 |. EB 03 JMP SHORT jagmisc.100050E5 100050E2 |> 8B4D F8 MOV ECX,[LOCAL.2] ; LOADDLL.00410249 100050E5 |> 8B75 F0 MOV ESI,[LOCAL.4] 100050E8 |. 03D1 ADD EDX,ECX 100050EA |. 8D4E 01 LEA ECX,DWORD PTR DS:[ESI+1] 100050ED |. 890A MOV DWORD PTR DS:[EDX],ECX 100050EF |. 894C32 FC MOV DWORD PTR DS:[EDX+ESI-4],ECX 100050F3 |. 8B75 F4 MOV ESI,[LOCAL.3] 100050F6 |. 8B0E MOV ECX,DWORD PTR DS:[ESI] 100050F8 |. 85C9 TEST ECX,ECX 100050FA |. 8D79 01 LEA EDI,DWORD PTR DS:[ECX+1] 100050FD |. 893E MOV DWORD PTR DS:[ESI],EDI 100050FF |. 75 1A JNZ SHORT jagmisc.1000511B 10005101 |. 3B1D 18B10010 CMP EBX,DWORD PTR DS:[1000B118] 10005107 |. 75 12 JNZ SHORT jagmisc.1000511B 10005109 |. 8B4D FC MOV ECX,[LOCAL.1] 1000510C |. 3B0D 30B10010 CMP ECX,DWORD PTR DS:[1000B130] 10005112 |. 75 07 JNZ SHORT jagmisc.1000511B 10005114 |. 8325 18B10010 00 AND DWORD PTR DS:[1000B118],0 1000511B |> 8B4D FC MOV ECX,[LOCAL.1] 1000511E |. 8908 MOV DWORD PTR DS:[EAX],ECX 10005120 |. 8D42 04 LEA EAX,DWORD PTR DS:[EDX+4] 10005123 |> 5F POP EDI ; kernel32.7C816FD7 10005124 |. 5E POP ESI ; kernel32.7C816FD7 10005125 |. 5B POP EBX ; kernel32.7C816FD7 10005126 |. C9 LEAVE 10005127 \. C3 RETN 10005128 /$ 55 PUSH EBP 10005129 |. 8BEC MOV EBP,ESP 1000512B |. 53 PUSH EBX 1000512C |. 56 PUSH ESI 1000512D |. 57 PUSH EDI 1000512E |. 55 PUSH EBP 1000512F |. 6A 00 PUSH 0 ; /_eax_value = 0 10005131 |. 6A 00 PUSH 0 ; |pExcptRec = NULL 10005133 |. 68 40510010 PUSH jagmisc.10005140 ; |ReturnAddr = jagmisc.10005140 10005138 |. FF75 08 PUSH [ARG.1] ; |pRegistrationFrame = FFFFFFFF 1000513B |. E8 AE290000 CALL ; \RtlUnwind 10005140 |. 5D POP EBP ; kernel32.7C816FD7 10005141 |. 5F POP EDI ; kernel32.7C816FD7 10005142 |. 5E POP ESI ; kernel32.7C816FD7 10005143 |. 5B POP EBX ; kernel32.7C816FD7 10005144 |. 8BE5 MOV ESP,EBP 10005146 |. 5D POP EBP ; kernel32.7C816FD7 10005147 \. C3 RETN 10005148 /$ 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738; Structured exception handler 1000514C |. F741 04 06000000 TEST DWORD PTR DS:[ECX+4],6 10005153 |. B8 01000000 MOV EAX,1 10005158 |. 74 0F JE SHORT jagmisc.10005169 1000515A |. 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 1000515E |. 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 10005162 |. 8902 MOV DWORD PTR DS:[EDX],EAX 10005164 |. B8 03000000 MOV EAX,3 10005169 \> C3 RETN 1000516A /$ 53 PUSH EBX 1000516B |. 56 PUSH ESI 1000516C |. 57 PUSH EDI 1000516D |. 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 10005171 |. 50 PUSH EAX 10005172 |. 6A FE PUSH -2 10005174 |. 68 48510010 PUSH jagmisc.10005148 ; SE handler installation 10005179 |. 64:FF35 00000000 PUSH DWORD PTR FS:[0] 10005180 |. 64:8925 00000000 MOV DWORD PTR FS:[0],ESP 10005187 |> 8B4424 20 /MOV EAX,DWORD PTR SS:[ESP+20] ; kernel32.7C839AA8 1000518B |. 8B58 08 |MOV EBX,DWORD PTR DS:[EAX+8] 1000518E |. 8B70 0C |MOV ESI,DWORD PTR DS:[EAX+C] 10005191 |. 83FE FF |CMP ESI,-1 10005194 |. 74 2E |JE SHORT jagmisc.100051C4 10005196 |. 3B7424 24 |CMP ESI,DWORD PTR SS:[ESP+24] ; kernel32.7C816FE0 1000519A |. 74 28 |JE SHORT jagmisc.100051C4 1000519C |. 8D3476 |LEA ESI,DWORD PTR DS:[ESI+ESI*2] 1000519F |. 8B0CB3 |MOV ECX,DWORD PTR DS:[EBX+ESI*4] 100051A2 |. 894C24 08 |MOV DWORD PTR SS:[ESP+8],ECX 100051A6 |. 8948 0C |MOV DWORD PTR DS:[EAX+C],ECX 100051A9 |. 837CB3 04 00 |CMP DWORD PTR DS:[EBX+ESI*4+4],0 100051AE |. 75 12 |JNZ SHORT jagmisc.100051C2 100051B0 |. 68 01010000 |PUSH 101 100051B5 |. 8B44B3 08 |MOV EAX,DWORD PTR DS:[EBX+ESI*4+8] 100051B9 |. E8 40000000 |CALL jagmisc.100051FE 100051BE |. FF54B3 08 |CALL DWORD PTR DS:[EBX+ESI*4+8] 100051C2 |>^ EB C3 \JMP SHORT jagmisc.10005187 100051C4 |> 64:8F05 00000000 POP DWORD PTR FS:[0] ; kernel32.7C816FD7 100051CB |. 83C4 0C ADD ESP,0C 100051CE |. 5F POP EDI ; kernel32.7C816FD7 100051CF |. 5E POP ESI ; kernel32.7C816FD7 100051D0 |. 5B POP EBX ; kernel32.7C816FD7 100051D1 \. C3 RETN 100051D2 . 33C0 XOR EAX,EAX 100051D4 . 64:8B0D 00000000 MOV ECX,DWORD PTR FS:[0] 100051DB . 8179 04 48510010 CMP DWORD PTR DS:[ECX+4],jagmisc.10005148 ; Entry address 100051E2 . 75 10 JNZ SHORT jagmisc.100051F4 100051E4 . 8B51 0C MOV EDX,DWORD PTR DS:[ECX+C] 100051E7 . 8B52 0C MOV EDX,DWORD PTR DS:[EDX+C] 100051EA . 3951 08 CMP DWORD PTR DS:[ECX+8],EDX 100051ED . 75 05 JNZ SHORT jagmisc.100051F4 100051EF . B8 01000000 MOV EAX,1 100051F4 > C3 RETN 100051F5 . 53 PUSH EBX 100051F6 . 51 PUSH ECX 100051F7 . BB 20A70010 MOV EBX,jagmisc.1000A720 100051FC . EB 0A JMP SHORT jagmisc.10005208 100051FE /$ 53 PUSH EBX 100051FF |. 51 PUSH ECX 10005200 |. BB 20A70010 MOV EBX,jagmisc.1000A720 10005205 |. 8B4D 08 MOV ECX,[ARG.1] 10005208 |> 894B 08 MOV DWORD PTR DS:[EBX+8],ECX 1000520B |. 8943 04 MOV DWORD PTR DS:[EBX+4],EAX 1000520E |. 896B 0C MOV DWORD PTR DS:[EBX+C],EBP 10005211 |. 59 POP ECX ; kernel32.7C816FD7 10005212 |. 5B POP EBX ; kernel32.7C816FD7 10005213 \. C2 0400 RETN 4 10005216 /$ 55 PUSH EBP 10005217 |. 8BEC MOV EBP,ESP 10005219 |. 83EC 20 SUB ESP,20 1000521C |. 53 PUSH EBX 1000521D |. 56 PUSH ESI 1000521E |. 8B75 08 MOV ESI,[ARG.1] 10005221 |. 8B5E 08 MOV EBX,DWORD PTR DS:[ESI+8] 10005224 |. F6C3 03 TEST BL,3 10005227 |. 75 1B JNZ SHORT jagmisc.10005244 10005229 |. 64:A1 18000000 MOV EAX,DWORD PTR FS:[18] 1000522F |. 8945 08 MOV [ARG.1],EAX 10005232 |. 8B45 08 MOV EAX,[ARG.1] 10005235 |. 8B48 08 MOV ECX,DWORD PTR DS:[EAX+8] 10005238 |. 3BD9 CMP EBX,ECX 1000523A |. 894D FC MOV [LOCAL.1],ECX 1000523D |. 72 0C JB SHORT jagmisc.1000524B 1000523F |. 3B58 04 CMP EBX,DWORD PTR DS:[EAX+4] 10005242 |. 73 07 JNB SHORT jagmisc.1000524B 10005244 |> 33C0 XOR EAX,EAX 10005246 |. E9 F0010000 JMP jagmisc.1000543B 1000524B |> 57 PUSH EDI 1000524C |. 8B7E 0C MOV EDI,DWORD PTR DS:[ESI+C] 1000524F |. 83FF FF CMP EDI,-1 10005252 |. 75 08 JNZ SHORT jagmisc.1000525C 10005254 |> 33C0 XOR EAX,EAX 10005256 |. 40 INC EAX 10005257 |. E9 DE010000 JMP jagmisc.1000543A 1000525C |> 33D2 XOR EDX,EDX 1000525E |. 8955 08 MOV [ARG.1],EDX 10005261 |. 8BC3 MOV EAX,EBX 10005263 |> 8B08 /MOV ECX,DWORD PTR DS:[EAX] 10005265 |. 83F9 FF |CMP ECX,-1 10005268 |. 74 08 |JE SHORT jagmisc.10005272 1000526A |. 3BCA |CMP ECX,EDX 1000526C |. 0F83 45010000 |JNB jagmisc.100053B7 10005272 |> 8378 04 00 |CMP DWORD PTR DS:[EAX+4],0 10005276 |. 74 03 |JE SHORT jagmisc.1000527B 10005278 |. FF45 08 |INC [ARG.1] 1000527B |> 42 |INC EDX 1000527C |. 83C0 0C |ADD EAX,0C 1000527F |. 3BD7 |CMP EDX,EDI 10005281 |.^ 76 E0 \JBE SHORT jagmisc.10005263 10005283 |. 837D 08 00 CMP [ARG.1],0 10005287 |. 74 14 JE SHORT jagmisc.1000529D 10005289 |. 8B46 F8 MOV EAX,DWORD PTR DS:[ESI-8] 1000528C |. 3B45 FC CMP EAX,[LOCAL.1] 1000528F |. 0F82 22010000 JB jagmisc.100053B7 10005295 |. 3BC6 CMP EAX,ESI 10005297 |. 0F83 1A010000 JNB jagmisc.100053B7 1000529D |> A1 40AF0010 MOV EAX,DWORD PTR DS:[1000AF40] 100052A2 |. 8BFB MOV EDI,EBX 100052A4 |. 81E7 00F0FFFF AND EDI,FFFFF000 100052AA |. 33F6 XOR ESI,ESI 100052AC |. 85C0 TEST EAX,EAX 100052AE |. 7E 12 JLE SHORT jagmisc.100052C2 100052B0 |> 393CB5 48AF0010 /CMP DWORD PTR DS:[ESI*4+1000AF48],EDI 100052B7 |. 0F84 FE000000 |JE jagmisc.100053BB 100052BD |. 46 |INC ESI 100052BE |. 3BF0 |CMP ESI,EAX 100052C0 |.^ 7C EE \JL SHORT jagmisc.100052B0 100052C2 |> 6A 1C PUSH 1C ; /BufSize = 1C (28.) 100052C4 |. 8D45 E0 LEA EAX,[LOCAL.8] ; | 100052C7 |. 50 PUSH EAX ; |Buffer = 00000008 100052C8 |. 53 PUSH EBX ; |Address = NULL 100052C9 |. FF15 D8800010 CALL DWORD PTR DS:[<&KERNEL32.VirtualQuery>] ; \VirtualQuery 100052CF |. 85C0 TEST EAX,EAX 100052D1 |. 0F84 60010000 JE jagmisc.10005437 100052D7 |. 817D F8 00000001 CMP [LOCAL.2],1000000 100052DE |. 0F85 53010000 JNZ jagmisc.10005437 100052E4 |. F645 F4 CC TEST BYTE PTR SS:[EBP-C],0CC 100052E8 |. 74 56 JE SHORT jagmisc.10005340 100052EA |. 8B4D E4 MOV ECX,[LOCAL.7] 100052ED |. 66:8139 4D5A CMP WORD PTR DS:[ECX],5A4D 100052F2 |. 0F85 3F010000 JNZ jagmisc.10005437 100052F8 |. 8B41 3C MOV EAX,DWORD PTR DS:[ECX+3C] 100052FB |. 03C1 ADD EAX,ECX 100052FD |. 8138 50450000 CMP DWORD PTR DS:[EAX],4550 10005303 |. 0F85 2E010000 JNZ jagmisc.10005437 10005309 |. 66:8178 18 0B01 CMP WORD PTR DS:[EAX+18],10B 1000530F |. 0F85 22010000 JNZ jagmisc.10005437 10005315 |. 2BD9 SUB EBX,ECX 10005317 |. 66:8378 06 00 CMP WORD PTR DS:[EAX+6],0 1000531C |. 0FB748 14 MOVZX ECX,WORD PTR DS:[EAX+14] 10005320 |. 8D4C01 18 LEA ECX,DWORD PTR DS:[ECX+EAX+18] 10005324 |. 0F86 0D010000 JBE jagmisc.10005437 1000532A |. 8B41 0C MOV EAX,DWORD PTR DS:[ECX+C] 1000532D |. 3BD8 CMP EBX,EAX 1000532F |. 72 0F JB SHORT jagmisc.10005340 10005331 |. 8B51 08 MOV EDX,DWORD PTR DS:[ECX+8] 10005334 |. 03D0 ADD EDX,EAX 10005336 |. 3BDA CMP EBX,EDX 10005338 |. 73 06 JNB SHORT jagmisc.10005340 1000533A |. F641 27 80 TEST BYTE PTR DS:[ECX+27],80 1000533E |. 75 77 JNZ SHORT jagmisc.100053B7 10005340 |> 6A 01 PUSH 1 ; /NewValue = 1 10005342 |. 68 88AF0010 PUSH jagmisc.1000AF88 ; |pTarget = jagmisc.1000AF88 10005347 |. FF15 D4800010 CALL DWORD PTR DS:[<&KERNEL32.InterlockedExchange>] ; \InterlockedExchange 1000534D |. 85C0 TEST EAX,EAX 1000534F |.^ 0F85 FFFEFFFF JNZ jagmisc.10005254 10005355 |. 8B0D 40AF0010 MOV ECX,DWORD PTR DS:[1000AF40] 1000535B |. 85C9 TEST ECX,ECX 1000535D |. 8BD1 MOV EDX,ECX 1000535F |. 7E 13 JLE SHORT jagmisc.10005374 10005361 |. 8D048D 44AF0010 LEA EAX,DWORD PTR DS:[ECX*4+1000AF44] 10005368 |> 3938 /CMP DWORD PTR DS:[EAX],EDI 1000536A |. 74 08 |JE SHORT jagmisc.10005374 1000536C |. 4A |DEC EDX 1000536D |. 83E8 04 |SUB EAX,4 10005370 |. 85D2 |TEST EDX,EDX 10005372 |.^ 7F F4 \JG SHORT jagmisc.10005368 10005374 |> 85D2 TEST EDX,EDX 10005376 |. 75 2D JNZ SHORT jagmisc.100053A5 10005378 |. 6A 0F PUSH 0F 1000537A |. 5B POP EBX ; kernel32.7C816FD7 1000537B |. 3BCB CMP ECX,EBX 1000537D |. 7F 02 JG SHORT jagmisc.10005381 1000537F |. 8BD9 MOV EBX,ECX 10005381 |> 33D2 XOR EDX,EDX 10005383 |. 85DB TEST EBX,EBX 10005385 |. 7C 12 JL SHORT jagmisc.10005399 10005387 |> 8D0495 48AF0010 /LEA EAX,DWORD PTR DS:[EDX*4+1000AF48] 1000538E |. 8B30 |MOV ESI,DWORD PTR DS:[EAX] 10005390 |. 42 |INC EDX 10005391 |. 3BD3 |CMP EDX,EBX 10005393 |. 8938 |MOV DWORD PTR DS:[EAX],EDI 10005395 |. 8BFE |MOV EDI,ESI 10005397 |.^ 7E EE \JLE SHORT jagmisc.10005387 10005399 |> 83F9 10 CMP ECX,10 1000539C |. 7D 07 JGE SHORT jagmisc.100053A5 1000539E |. 41 INC ECX 1000539F |. 890D 40AF0010 MOV DWORD PTR DS:[1000AF40],ECX 100053A5 |> 6A 00 PUSH 0 ; /NewValue = 0 100053A7 |. 68 88AF0010 PUSH jagmisc.1000AF88 ; |pTarget = jagmisc.1000AF88 100053AC |. FF15 D4800010 CALL DWORD PTR DS:[<&KERNEL32.InterlockedExchange>] ; \InterlockedExchange 100053B2 |.^ E9 9DFEFFFF JMP jagmisc.10005254 100053B7 |> 33C0 XOR EAX,EAX 100053B9 |. EB 7F JMP SHORT jagmisc.1000543A 100053BB |> 85F6 TEST ESI,ESI 100053BD |.^ 0F8E 91FEFFFF JLE jagmisc.10005254 100053C3 |. 8B1D D4800010 MOV EBX,DWORD PTR DS:[<&KERNEL32.InterlockedExchange>] ; kernel32.InterlockedExchange 100053C9 |. 6A 01 PUSH 1 ; /NewValue = 1 100053CB |. 68 88AF0010 PUSH jagmisc.1000AF88 ; |pTarget = jagmisc.1000AF88 100053D0 |. FFD3 CALL EBX ; \InterlockedExchange 100053D2 |. 85C0 TEST EAX,EAX 100053D4 |.^ 0F85 7AFEFFFF JNZ jagmisc.10005254 100053DA |. 393CB5 48AF0010 CMP DWORD PTR DS:[ESI*4+1000AF48],EDI 100053E1 |. 74 2E JE SHORT jagmisc.10005411 100053E3 |. A1 40AF0010 MOV EAX,DWORD PTR DS:[1000AF40] 100053E8 |. 8D70 FF LEA ESI,DWORD PTR DS:[EAX-1] 100053EB |. 85F6 TEST ESI,ESI 100053ED |. 7C 10 JL SHORT jagmisc.100053FF 100053EF |> 393CB5 48AF0010 /CMP DWORD PTR DS:[ESI*4+1000AF48],EDI 100053F6 |. 74 03 |JE SHORT jagmisc.100053FB 100053F8 |. 4E |DEC ESI 100053F9 |.^ 79 F4 \JNS SHORT jagmisc.100053EF 100053FB |> 85F6 TEST ESI,ESI 100053FD |. 7D 10 JGE SHORT jagmisc.1000540F 100053FF |> 83F8 10 CMP EAX,10 10005402 |. 7D 06 JGE SHORT jagmisc.1000540A 10005404 |. 40 INC EAX 10005405 |. A3 40AF0010 MOV DWORD PTR DS:[1000AF40],EAX 1000540A |> 8D70 FF LEA ESI,DWORD PTR DS:[EAX-1] 1000540D |. EB 02 JMP SHORT jagmisc.10005411 1000540F |> 74 18 JE SHORT jagmisc.10005429 10005411 |> 33C9 XOR ECX,ECX 10005413 |. 85F6 TEST ESI,ESI 10005415 |. 7C 12 JL SHORT jagmisc.10005429 10005417 |> 8D048D 48AF0010 /LEA EAX,DWORD PTR DS:[ECX*4+1000AF48] 1000541E |. 8B10 |MOV EDX,DWORD PTR DS:[EAX] 10005420 |. 41 |INC ECX 10005421 |. 3BCE |CMP ECX,ESI 10005423 |. 8938 |MOV DWORD PTR DS:[EAX],EDI 10005425 |. 8BFA |MOV EDI,EDX 10005427 |.^ 7E EE \JLE SHORT jagmisc.10005417 10005429 |> 6A 00 PUSH 0 1000542B |. 68 88AF0010 PUSH jagmisc.1000AF88 10005430 |. FFD3 CALL EBX 10005432 |.^ E9 1DFEFFFF JMP jagmisc.10005254 10005437 |> 83C8 FF OR EAX,FFFFFFFF 1000543A |> 5F POP EDI ; kernel32.7C816FD7 1000543B |> 5E POP ESI ; kernel32.7C816FD7 1000543C |. 5B POP EBX ; kernel32.7C816FD7 1000543D |. C9 LEAVE 1000543E \. C3 RETN 1000543F /$ A1 8CAF0010 MOV EAX,DWORD PTR DS:[1000AF8C] 10005444 |. 85C0 TEST EAX,EAX 10005446 |. 74 0F JE SHORT jagmisc.10005457 10005448 |. FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738 1000544C |. FFD0 CALL EAX 1000544E |. 85C0 TEST EAX,EAX 10005450 |. 59 POP ECX ; kernel32.7C816FD7 10005451 |. 74 04 JE SHORT jagmisc.10005457 10005453 |. 33C0 XOR EAX,EAX 10005455 |. 40 INC EAX 10005456 |. C3 RETN 10005457 |> 33C0 XOR EAX,EAX 10005459 \. C3 RETN 1000545A . FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; /pCriticalSection = ntdll.7C910738 1000545E . FF15 24800010 CALL DWORD PTR DS:[<&KERNEL32.InitializeCriticalSection>] ; \InitializeCriticalSection 10005464 . 33C0 XOR EAX,EAX 10005466 . 40 INC EAX 10005467 . C2 0800 RETN 8 1000546A $ 6A 10 PUSH 10 1000546C . 68 78880010 PUSH jagmisc.10008878 10005471 . E8 FACEFFFF CALL jagmisc.10002370 10005476 . A1 94AF0010 MOV EAX,DWORD PTR DS:[1000AF94] 1000547B . 85C0 TEST EAX,EAX 1000547D . 75 37 JNZ SHORT jagmisc.100054B6 1000547F . 833D 8CAC0010 01 CMP DWORD PTR DS:[1000AC8C],1 10005486 . 74 24 JE SHORT jagmisc.100054AC 10005488 . 68 FC810010 PUSH jagmisc.100081FC ; /pModule = "kernel32.dll" 1000548D . FF15 54800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA 10005493 . 85C0 TEST EAX,EAX 10005495 . 74 15 JE SHORT jagmisc.100054AC 10005497 . 68 4C880010 PUSH jagmisc.1000884C ; /ProcNameOrOrdinal = "InitializeCriticalSectionAndSpinCount" 1000549C . 50 PUSH EAX ; |hModule = 00000008 1000549D . FF15 50800010 CALL DWORD PTR DS:[<&KERNEL32.GetProcAddress>] ; \GetProcAddress 100054A3 . A3 94AF0010 MOV DWORD PTR DS:[1000AF94],EAX 100054A8 . 85C0 TEST EAX,EAX 100054AA . 75 0A JNZ SHORT jagmisc.100054B6 100054AC > B8 5A540010 MOV EAX,jagmisc.1000545A 100054B1 . A3 94AF0010 MOV DWORD PTR DS:[1000AF94],EAX 100054B6 > 8365 FC 00 AND DWORD PTR SS:[EBP-4],0 100054BA . FF75 0C PUSH DWORD PTR SS:[EBP+C] 100054BD . FF75 08 PUSH DWORD PTR SS:[EBP+8] 100054C0 . FFD0 CALL EAX 100054C2 . 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX 100054C5 . EB 24 JMP SHORT jagmisc.100054EB 100054C7 . 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] 100054CA . 8B00 MOV EAX,DWORD PTR DS:[EAX] 100054CC . 8B00 MOV EAX,DWORD PTR DS:[EAX] 100054CE . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 100054D1 . 33C0 XOR EAX,EAX 100054D3 . 40 INC EAX 100054D4 . C3 RETN 100054D5 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451 100054D8 . 817D E4 170000C0 CMP DWORD PTR SS:[EBP-1C],C0000017 100054DF . 75 08 JNZ SHORT jagmisc.100054E9 100054E1 . 6A 08 PUSH 8 ; /Error = ERROR_NOT_ENOUGH_MEMORY 100054E3 . FF15 5C800010 CALL DWORD PTR DS:[<&KERNEL32.SetLastError>] ; \SetLastError 100054E9 > 33C0 XOR EAX,EAX 100054EB > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 100054EF . E8 B7CEFFFF CALL jagmisc.100023AB 100054F4 . C3 RETN 100054F5 /$ 6A 0C PUSH 0C 100054F7 |. 68 88880010 PUSH jagmisc.10008888 100054FC |. E8 6FCEFFFF CALL jagmisc.10002370 10005501 |. 8B75 08 MOV ESI,[ARG.1] 10005504 |. 833D 64B30010 03 CMP DWORD PTR DS:[1000B364],3 1000550B |. 75 2E JNZ SHORT jagmisc.1000553B 1000550D |. 3B35 24B10010 CMP ESI,DWORD PTR DS:[1000B124] 10005513 |. 77 26 JA SHORT jagmisc.1000553B 10005515 |. 6A 04 PUSH 4 ; /Arg1 = 00000004 10005517 |. E8 18E9FFFF CALL jagmisc.10003E34 ; \jagmisc.10003E34 1000551C |. 59 POP ECX ; kernel32.7C816FD7 1000551D |. 8365 FC 00 AND [LOCAL.1],0 10005521 |. 56 PUSH ESI 10005522 |. E8 05F9FFFF CALL jagmisc.10004E2C 10005527 |. 59 POP ECX ; kernel32.7C816FD7 10005528 |. 8945 E4 MOV [LOCAL.7],EAX 1000552B |. 834D FC FF OR [LOCAL.1],FFFFFFFF 1000552F |. E8 33000000 CALL jagmisc.10005567 10005534 |. 8B45 E4 MOV EAX,[LOCAL.7] 10005537 |. 85C0 TEST EAX,EAX 10005539 |. 75 23 JNZ SHORT jagmisc.1000555E 1000553B |> 85F6 TEST ESI,ESI 1000553D |. 75 01 JNZ SHORT jagmisc.10005540 1000553F |. 46 INC ESI 10005540 |> 833D 64B30010 01 CMP DWORD PTR DS:[1000B364],1 10005547 |. 74 06 JE SHORT jagmisc.1000554F 10005549 |. 83C6 0F ADD ESI,0F 1000554C |. 83E6 F0 AND ESI,FFFFFFF0 1000554F |> 56 PUSH ESI ; /HeapSize = 0 10005550 |. 6A 00 PUSH 0 ; |Flags = 0 10005552 |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000 10005558 |. FF15 80800010 CALL DWORD PTR DS:[<&KERNEL32.HeapAlloc>] ; \HeapAlloc 1000555E |> E8 48CEFFFF CALL jagmisc.100023AB 10005563 \. C3 RETN 10005564 8B DB 8B 10005565 75 DB 75 ; CHAR 'u' 10005566 08 DB 08 10005567 /$ 6A 04 PUSH 4 10005569 |. E8 11E8FFFF CALL jagmisc.10003D7F 1000556E |. 59 POP ECX ; kernel32.7C816FD7 1000556F \. C3 RETN 10005570 /$ 837C24 04 E0 CMP DWORD PTR SS:[ESP+4],-20 10005575 |. 77 22 JA SHORT jagmisc.10005599 10005577 |> FF7424 04 /PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738 1000557B |. E8 75FFFFFF |CALL jagmisc.100054F5 10005580 |. 85C0 |TEST EAX,EAX 10005582 |. 59 |POP ECX ; kernel32.7C816FD7 10005583 |. 75 16 |JNZ SHORT jagmisc.1000559B 10005585 |. 394424 08 |CMP DWORD PTR SS:[ESP+8],EAX 10005589 |. 74 10 |JE SHORT jagmisc.1000559B 1000558B |. FF7424 04 |PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738 1000558F |. E8 ABFEFFFF |CALL jagmisc.1000543F 10005594 |. 85C0 |TEST EAX,EAX 10005596 |. 59 |POP ECX ; kernel32.7C816FD7 10005597 |.^ 75 DE \JNZ SHORT jagmisc.10005577 10005599 |> 33C0 XOR EAX,EAX 1000559B \> C3 RETN 1000559C /$ FF35 90AF0010 PUSH DWORD PTR DS:[1000AF90] 100055A2 |. FF7424 08 PUSH DWORD PTR SS:[ESP+8] 100055A6 |. E8 C5FFFFFF CALL jagmisc.10005570 100055AB |. 59 POP ECX ; kernel32.7C816FD7 100055AC |. 59 POP ECX ; kernel32.7C816FD7 100055AD \. C3 RETN 100055AE CC INT3 100055AF CC INT3 100055B0 $ 55 PUSH EBP 100055B1 . 8BEC MOV EBP,ESP 100055B3 . 57 PUSH EDI 100055B4 . 56 PUSH ESI 100055B5 . 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C] 100055B8 . 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10] 100055BB . 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8] 100055BE . 8BC1 MOV EAX,ECX 100055C0 . 8BD1 MOV EDX,ECX 100055C2 . 03C6 ADD EAX,ESI 100055C4 . 3BFE CMP EDI,ESI 100055C6 . 76 08 JBE SHORT jagmisc.100055D0 100055C8 . 3BF8 CMP EDI,EAX 100055CA . 0F82 7C010000 JB jagmisc.1000574C 100055D0 > F7C7 03000000 TEST EDI,3 100055D6 . 75 14 JNZ SHORT jagmisc.100055EC 100055D8 . C1E9 02 SHR ECX,2 100055DB . 83E2 03 AND EDX,3 100055DE . 83F9 08 CMP ECX,8 100055E1 . 72 29 JB SHORT jagmisc.1000560C 100055E3 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 100055E5 . FF2495 FC560010 JMP DWORD PTR DS:[EDX*4+100056FC] ; jagmisc.1000570C 100055EC > 8BC7 MOV EAX,EDI 100055EE . BA 03000000 MOV EDX,3 100055F3 . 83E9 04 SUB ECX,4 100055F6 . 72 0C JB SHORT jagmisc.10005604 100055F8 . 83E0 03 AND EAX,3 100055FB . 03C8 ADD ECX,EAX 100055FD .- FF2485 10560010 JMP DWORD PTR DS:[EAX*4+10005610] 10005604 > FF248D 0C570010 JMP DWORD PTR DS:[ECX*4+1000570C] ; jagmisc.10005734 1000560B 90 NOP 1000560C >- FF248D 90560010 JMP DWORD PTR DS:[ECX*4+10005690] 10005613 90 DB 90 10005614 . 20560010 DD jagmisc.10005620 ; Switch table (1-based) used at 100055FD 10005618 . 4C560010 DD jagmisc.1000564C 1000561C . 70560010 DD jagmisc.10005670 10005620 > 23D1 AND EDX,ECX 10005622 . 8A06 MOV AL,BYTE PTR DS:[ESI] 10005624 . 8807 MOV BYTE PTR DS:[EDI],AL 10005626 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 10005629 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL 1000562C . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 1000562F . C1E9 02 SHR ECX,2 10005632 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL 10005635 . 83C6 03 ADD ESI,3 10005638 . 83C7 03 ADD EDI,3 1000563B . 83F9 08 CMP ECX,8 1000563E .^ 72 CC JB SHORT jagmisc.1000560C 10005640 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10005642 . FF2495 FC560010 JMP DWORD PTR DS:[EDX*4+100056FC] ; jagmisc.1000570C 10005649 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 1000564C > 23D1 AND EDX,ECX 1000564E . 8A06 MOV AL,BYTE PTR DS:[ESI] 10005650 . 8807 MOV BYTE PTR DS:[EDI],AL 10005652 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 10005655 . C1E9 02 SHR ECX,2 10005658 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL 1000565B . 83C6 02 ADD ESI,2 1000565E . 83C7 02 ADD EDI,2 10005661 . 83F9 08 CMP ECX,8 10005664 .^ 72 A6 JB SHORT jagmisc.1000560C 10005666 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10005668 . FF2495 FC560010 JMP DWORD PTR DS:[EDX*4+100056FC] ; jagmisc.1000570C 1000566F 90 NOP 10005670 > 23D1 AND EDX,ECX 10005672 . 8A06 MOV AL,BYTE PTR DS:[ESI] 10005674 . 8807 MOV BYTE PTR DS:[EDI],AL 10005676 . 83C6 01 ADD ESI,1 10005679 . C1E9 02 SHR ECX,2 1000567C . 83C7 01 ADD EDI,1 1000567F . 83F9 08 CMP ECX,8 10005682 .^ 72 88 JB SHORT jagmisc.1000560C 10005684 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10005686 . FF2495 FC560010 JMP DWORD PTR DS:[EDX*4+100056FC] ; jagmisc.1000570C 1000568D 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 10005690 . F3560010 DD jagmisc.100056F3 ; Switch table used at 1000560C 10005694 . E0560010 DD jagmisc.100056E0 10005698 . D8560010 DD jagmisc.100056D8 1000569C . D0560010 DD jagmisc.100056D0 100056A0 . C8560010 DD jagmisc.100056C8 100056A4 . C0560010 DD jagmisc.100056C0 100056A8 . B8560010 DD jagmisc.100056B8 100056AC . B0560010 DD jagmisc.100056B0 100056B0 > 8B448E E4 MOV EAX,DWORD PTR DS:[ESI+ECX*4-1C] 100056B4 . 89448F E4 MOV DWORD PTR DS:[EDI+ECX*4-1C],EAX 100056B8 > 8B448E E8 MOV EAX,DWORD PTR DS:[ESI+ECX*4-18] 100056BC . 89448F E8 MOV DWORD PTR DS:[EDI+ECX*4-18],EAX 100056C0 > 8B448E EC MOV EAX,DWORD PTR DS:[ESI+ECX*4-14] 100056C4 . 89448F EC MOV DWORD PTR DS:[EDI+ECX*4-14],EAX 100056C8 > 8B448E F0 MOV EAX,DWORD PTR DS:[ESI+ECX*4-10] 100056CC . 89448F F0 MOV DWORD PTR DS:[EDI+ECX*4-10],EAX 100056D0 > 8B448E F4 MOV EAX,DWORD PTR DS:[ESI+ECX*4-C] 100056D4 . 89448F F4 MOV DWORD PTR DS:[EDI+ECX*4-C],EAX 100056D8 > 8B448E F8 MOV EAX,DWORD PTR DS:[ESI+ECX*4-8] 100056DC . 89448F F8 MOV DWORD PTR DS:[EDI+ECX*4-8],EAX 100056E0 > 8B448E FC MOV EAX,DWORD PTR DS:[ESI+ECX*4-4] 100056E4 . 89448F FC MOV DWORD PTR DS:[EDI+ECX*4-4],EAX 100056E8 . 8D048D 00000000 LEA EAX,DWORD PTR DS:[ECX*4] 100056EF . 03F0 ADD ESI,EAX 100056F1 . 03F8 ADD EDI,EAX 100056F3 > FF2495 FC560010 JMP DWORD PTR DS:[EDX*4+100056FC] ; jagmisc.1000570C 100056FA 8BFF MOV EDI,EDI 100056FC . 0C570010 DD jagmisc.1000570C ; Switch table used at 10005642 and other places 10005700 . 14570010 DD jagmisc.10005714 10005704 . 20570010 DD jagmisc.10005720 10005708 . 34570010 DD jagmisc.10005734 1000570C > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 1000570F . 5E POP ESI ; kernel32.7C816FD7 10005710 . 5F POP EDI ; kernel32.7C816FD7 10005711 . C9 LEAVE 10005712 . C3 RETN 10005713 90 NOP 10005714 > 8A06 MOV AL,BYTE PTR DS:[ESI] 10005716 . 8807 MOV BYTE PTR DS:[EDI],AL 10005718 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 1000571B . 5E POP ESI ; kernel32.7C816FD7 1000571C . 5F POP EDI ; kernel32.7C816FD7 1000571D . C9 LEAVE 1000571E . C3 RETN 1000571F 90 NOP 10005720 > 8A06 MOV AL,BYTE PTR DS:[ESI] 10005722 . 8807 MOV BYTE PTR DS:[EDI],AL 10005724 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 10005727 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL 1000572A . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 1000572D . 5E POP ESI ; kernel32.7C816FD7 1000572E . 5F POP EDI ; kernel32.7C816FD7 1000572F . C9 LEAVE 10005730 . C3 RETN 10005731 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 10005734 > 8A06 MOV AL,BYTE PTR DS:[ESI] 10005736 . 8807 MOV BYTE PTR DS:[EDI],AL 10005738 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 1000573B . 8847 01 MOV BYTE PTR DS:[EDI+1],AL 1000573E . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 10005741 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL 10005744 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 10005747 . 5E POP ESI ; kernel32.7C816FD7 10005748 . 5F POP EDI ; kernel32.7C816FD7 10005749 . C9 LEAVE 1000574A . C3 RETN 1000574B 90 NOP 1000574C > 8D7431 FC LEA ESI,DWORD PTR DS:[ECX+ESI-4] 10005750 . 8D7C39 FC LEA EDI,DWORD PTR DS:[ECX+EDI-4] 10005754 . F7C7 03000000 TEST EDI,3 1000575A . 75 24 JNZ SHORT jagmisc.10005780 1000575C . C1E9 02 SHR ECX,2 1000575F . 83E2 03 AND EDX,3 10005762 . 83F9 08 CMP ECX,8 10005765 . 72 0D JB SHORT jagmisc.10005774 10005767 . FD STD 10005768 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 1000576A . FC CLD 1000576B . FF2495 98580010 JMP DWORD PTR DS:[EDX*4+10005898] ; jagmisc.100058A8 10005772 8BFF MOV EDI,EDI 10005774 > F7D9 NEG ECX 10005776 . FF248D 48580010 JMP DWORD PTR DS:[ECX*4+10005848] ; jagmisc.1000587C 1000577D 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 10005780 > 8BC7 MOV EAX,EDI 10005782 . BA 03000000 MOV EDX,3 ; Switch (cases 0..3) 10005787 . 83F9 04 CMP ECX,4 1000578A . 72 0C JB SHORT jagmisc.10005798 1000578C . 83E0 03 AND EAX,3 ; Default case of switch 10005782 1000578F . 2BC8 SUB ECX,EAX 10005791 .- FF2485 9C570010 JMP DWORD PTR DS:[EAX*4+1000579C] 10005798 >- FF248D 98580010 JMP DWORD PTR DS:[ECX*4+10005898] 1000579F 90 DB 90 100057A0 . AC570010 DD jagmisc.100057AC ; Switch table (1-based) used at 10005791 100057A4 . D0570010 DD jagmisc.100057D0 100057A8 . F8570010 DD jagmisc.100057F8 100057AC > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] 100057AF . 23D1 AND EDX,ECX 100057B1 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL 100057B4 . 83EE 01 SUB ESI,1 100057B7 . C1E9 02 SHR ECX,2 100057BA . 83EF 01 SUB EDI,1 100057BD . 83F9 08 CMP ECX,8 100057C0 .^ 72 B2 JB SHORT jagmisc.10005774 100057C2 . FD STD 100057C3 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 100057C5 . FC CLD 100057C6 . FF2495 98580010 JMP DWORD PTR DS:[EDX*4+10005898] ; jagmisc.100058A8 100057CD 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 100057D0 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] 100057D3 . 23D1 AND EDX,ECX 100057D5 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL 100057D8 . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 100057DB . C1E9 02 SHR ECX,2 100057DE . 8847 02 MOV BYTE PTR DS:[EDI+2],AL 100057E1 . 83EE 02 SUB ESI,2 100057E4 . 83EF 02 SUB EDI,2 100057E7 . 83F9 08 CMP ECX,8 100057EA .^ 72 88 JB SHORT jagmisc.10005774 100057EC . FD STD 100057ED . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 100057EF . FC CLD 100057F0 . FF2495 98580010 JMP DWORD PTR DS:[EDX*4+10005898] ; jagmisc.100058A8 100057F7 90 NOP 100057F8 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] 100057FB . 23D1 AND EDX,ECX 100057FD . 8847 03 MOV BYTE PTR DS:[EDI+3],AL 10005800 . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 10005803 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL 10005806 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 10005809 . C1E9 02 SHR ECX,2 1000580C . 8847 01 MOV BYTE PTR DS:[EDI+1],AL 1000580F . 83EE 03 SUB ESI,3 10005812 . 83EF 03 SUB EDI,3 10005815 . 83F9 08 CMP ECX,8 10005818 .^ 0F82 56FFFFFF JB jagmisc.10005774 1000581E . FD STD 1000581F . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10005821 . FC CLD 10005822 . FF2495 98580010 JMP DWORD PTR DS:[EDX*4+10005898] ; jagmisc.100058A8 10005829 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 1000582C . 4C580010 DD jagmisc.1000584C 10005830 . 54580010 DD jagmisc.10005854 10005834 . 5C580010 DD jagmisc.1000585C 10005838 . 64580010 DD jagmisc.10005864 1000583C . 6C580010 DD jagmisc.1000586C 10005840 . 74580010 DD jagmisc.10005874 10005844 . 7C580010 DD jagmisc.1000587C 10005848 . 8F580010 DD jagmisc.1000588F 1000584C > 8B448E 1C MOV EAX,DWORD PTR DS:[ESI+ECX*4+1C] 10005850 . 89448F 1C MOV DWORD PTR DS:[EDI+ECX*4+1C],EAX 10005854 > 8B448E 18 MOV EAX,DWORD PTR DS:[ESI+ECX*4+18] 10005858 . 89448F 18 MOV DWORD PTR DS:[EDI+ECX*4+18],EAX 1000585C > 8B448E 14 MOV EAX,DWORD PTR DS:[ESI+ECX*4+14] 10005860 . 89448F 14 MOV DWORD PTR DS:[EDI+ECX*4+14],EAX 10005864 > 8B448E 10 MOV EAX,DWORD PTR DS:[ESI+ECX*4+10] 10005868 . 89448F 10 MOV DWORD PTR DS:[EDI+ECX*4+10],EAX 1000586C > 8B448E 0C MOV EAX,DWORD PTR DS:[ESI+ECX*4+C] 10005870 . 89448F 0C MOV DWORD PTR DS:[EDI+ECX*4+C],EAX 10005874 > 8B448E 08 MOV EAX,DWORD PTR DS:[ESI+ECX*4+8] 10005878 . 89448F 08 MOV DWORD PTR DS:[EDI+ECX*4+8],EAX 1000587C > 8B448E 04 MOV EAX,DWORD PTR DS:[ESI+ECX*4+4] 10005880 . 89448F 04 MOV DWORD PTR DS:[EDI+ECX*4+4],EAX 10005884 . 8D048D 00000000 LEA EAX,DWORD PTR DS:[ECX*4] 1000588B . 03F0 ADD ESI,EAX 1000588D . 03F8 ADD EDI,EAX 1000588F > FF2495 98580010 JMP DWORD PTR DS:[EDX*4+10005898] ; jagmisc.100058A8 10005896 8BFF MOV EDI,EDI 10005898 . A8580010 DD jagmisc.100058A8 ; Switch table used at 10005798 and other places 1000589C . B0580010 DD jagmisc.100058B0 100058A0 . C0580010 DD jagmisc.100058C0 100058A4 . D4580010 DD jagmisc.100058D4 100058A8 > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] ; Case 0 of switch 10005782 100058AB . 5E POP ESI ; kernel32.7C816FD7 100058AC . 5F POP EDI ; kernel32.7C816FD7 100058AD . C9 LEAVE 100058AE . C3 RETN 100058AF 90 NOP 100058B0 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] ; Case 1 of switch 10005782 100058B3 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL 100058B6 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 100058B9 . 5E POP ESI ; kernel32.7C816FD7 100058BA . 5F POP EDI ; kernel32.7C816FD7 100058BB . C9 LEAVE 100058BC . C3 RETN 100058BD 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 100058C0 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] ; Case 2 of switch 10005782 100058C3 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL 100058C6 . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 100058C9 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL 100058CC . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 100058CF . 5E POP ESI ; kernel32.7C816FD7 100058D0 . 5F POP EDI ; kernel32.7C816FD7 100058D1 . C9 LEAVE 100058D2 . C3 RETN 100058D3 90 NOP 100058D4 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] ; Case 3 of switch 10005782 100058D7 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL 100058DA . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 100058DD . 8847 02 MOV BYTE PTR DS:[EDI+2],AL 100058E0 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 100058E3 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL 100058E6 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 100058E9 . 5E POP ESI ; kernel32.7C816FD7 100058EA . 5F POP EDI ; kernel32.7C816FD7 100058EB . C9 LEAVE 100058EC . C3 RETN 100058ED /$ 55 PUSH EBP 100058EE |. 8BEC MOV EBP,ESP 100058F0 |. 83EC 10 SUB ESP,10 100058F3 |. 53 PUSH EBX 100058F4 |. 33DB XOR EBX,EBX 100058F6 |. 391D 98AF0010 CMP DWORD PTR DS:[1000AF98],EBX 100058FC |. 56 PUSH ESI 100058FD |. 57 PUSH EDI 100058FE |. 75 6D JNZ SHORT jagmisc.1000596D 10005900 |. 68 F8880010 PUSH jagmisc.100088F8 ; /FileName = "user32.dll" 10005905 |. FF15 DC800010 CALL DWORD PTR DS:[<&KERNEL32.LoadLibraryA>] ; \LoadLibraryA 1000590B |. 8BF8 MOV EDI,EAX 1000590D |. 3BFB CMP EDI,EBX 1000590F |. 0F84 93000000 JE jagmisc.100059A8 10005915 |. 8B35 50800010 MOV ESI,DWORD PTR DS:[<&KERNEL32.GetProcAddress>] ; kernel32.GetProcAddress 1000591B |. 68 EC880010 PUSH jagmisc.100088EC ; /ProcNameOrOrdinal = "MessageBoxA" 10005920 |. 57 PUSH EDI ; |hModule = NULL 10005921 |. FFD6 CALL ESI ; \GetProcAddress 10005923 |. 85C0 TEST EAX,EAX 10005925 |. A3 98AF0010 MOV DWORD PTR DS:[1000AF98],EAX 1000592A |. 74 7C JE SHORT jagmisc.100059A8 1000592C |. 68 DC880010 PUSH jagmisc.100088DC ; /ProcNameOrOrdinal = "GetActiveWindow" 10005931 |. 57 PUSH EDI ; |hModule = NULL 10005932 |. FFD6 CALL ESI ; \GetProcAddress 10005934 |. 68 C8880010 PUSH jagmisc.100088C8 ; /ProcNameOrOrdinal = "GetLastActivePopup" 10005939 |. 57 PUSH EDI ; |hModule = NULL 1000593A |. A3 9CAF0010 MOV DWORD PTR DS:[1000AF9C],EAX ; | 1000593F |. FFD6 CALL ESI ; \GetProcAddress 10005941 |. 833D 8CAC0010 02 CMP DWORD PTR DS:[1000AC8C],2 10005948 |. A3 A0AF0010 MOV DWORD PTR DS:[1000AFA0],EAX 1000594D |. 75 1E JNZ SHORT jagmisc.1000596D 1000594F |. 68 AC880010 PUSH jagmisc.100088AC ; /ProcNameOrOrdinal = "GetUserObjectInformationA" 10005954 |. 57 PUSH EDI ; |hModule = NULL 10005955 |. FFD6 CALL ESI ; \GetProcAddress 10005957 |. 85C0 TEST EAX,EAX 10005959 |. A3 A8AF0010 MOV DWORD PTR DS:[1000AFA8],EAX 1000595E |. 74 0D JE SHORT jagmisc.1000596D 10005960 |. 68 94880010 PUSH jagmisc.10008894 ; /ProcNameOrOrdinal = "GetProcessWindowStation" 10005965 |. 57 PUSH EDI ; |hModule = NULL 10005966 |. FFD6 CALL ESI ; \GetProcAddress 10005968 |. A3 A4AF0010 MOV DWORD PTR DS:[1000AFA4],EAX 1000596D |> A1 A4AF0010 MOV EAX,DWORD PTR DS:[1000AFA4] 10005972 |. 85C0 TEST EAX,EAX 10005974 |. 74 3C JE SHORT jagmisc.100059B2 10005976 |. FFD0 CALL EAX 10005978 |. 85C0 TEST EAX,EAX 1000597A |. 74 1D JE SHORT jagmisc.10005999 1000597C |. 8D4D FC LEA ECX,[LOCAL.1] 1000597F |. 51 PUSH ECX 10005980 |. 6A 0C PUSH 0C 10005982 |. 8D4D F0 LEA ECX,[LOCAL.4] 10005985 |. 51 PUSH ECX 10005986 |. 6A 01 PUSH 1 10005988 |. 50 PUSH EAX 10005989 |. FF15 A8AF0010 CALL DWORD PTR DS:[1000AFA8] 1000598F |. 85C0 TEST EAX,EAX 10005991 |. 74 06 JE SHORT jagmisc.10005999 10005993 |. F645 F8 01 TEST BYTE PTR SS:[EBP-8],1 10005997 |. 75 19 JNZ SHORT jagmisc.100059B2 10005999 |> 833D 98AC0010 04 CMP DWORD PTR DS:[1000AC98],4 100059A0 |. 72 0A JB SHORT jagmisc.100059AC 100059A2 |. 804D 12 20 OR BYTE PTR SS:[EBP+12],20 100059A6 |. EB 29 JMP SHORT jagmisc.100059D1 100059A8 |> 33C0 XOR EAX,EAX 100059AA |. EB 35 JMP SHORT jagmisc.100059E1 100059AC |> 804D 12 04 OR BYTE PTR SS:[EBP+12],4 100059B0 |. EB 1F JMP SHORT jagmisc.100059D1 100059B2 |> A1 9CAF0010 MOV EAX,DWORD PTR DS:[1000AF9C] 100059B7 |. 85C0 TEST EAX,EAX 100059B9 |. 74 16 JE SHORT jagmisc.100059D1 100059BB |. FFD0 CALL EAX 100059BD |. 8BD8 MOV EBX,EAX 100059BF |. 85DB TEST EBX,EBX 100059C1 |. 74 0E JE SHORT jagmisc.100059D1 100059C3 |. A1 A0AF0010 MOV EAX,DWORD PTR DS:[1000AFA0] 100059C8 |. 85C0 TEST EAX,EAX 100059CA |. 74 05 JE SHORT jagmisc.100059D1 100059CC |. 53 PUSH EBX 100059CD |. FFD0 CALL EAX 100059CF |. 8BD8 MOV EBX,EAX 100059D1 |> FF75 10 PUSH [ARG.3] 100059D4 |. FF75 0C PUSH [ARG.2] 100059D7 |. FF75 08 PUSH [ARG.1] 100059DA |. 53 PUSH EBX 100059DB |. FF15 98AF0010 CALL DWORD PTR DS:[1000AF98] 100059E1 |> 5F POP EDI ; kernel32.7C816FD7 100059E2 |. 5E POP ESI ; kernel32.7C816FD7 100059E3 |. 5B POP EBX ; kernel32.7C816FD7 100059E4 |. C9 LEAVE 100059E5 \. C3 RETN 100059E6 CC INT3 100059E7 CC INT3 100059E8 CC INT3 100059E9 CC INT3 100059EA CC INT3 100059EB CC INT3 100059EC CC INT3 100059ED CC INT3 100059EE CC INT3 100059EF CC INT3 100059F0 /$ 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C] 100059F4 |. 57 PUSH EDI 100059F5 |. 85C9 TEST ECX,ECX 100059F7 |. 0F84 92000000 JE jagmisc.10005A8F 100059FD |. 56 PUSH ESI 100059FE |. 53 PUSH EBX 100059FF |. 8BD9 MOV EBX,ECX 10005A01 |. 8B7424 14 MOV ESI,DWORD PTR SS:[ESP+14] 10005A05 |. F7C6 03000000 TEST ESI,3 10005A0B |. 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10] 10005A0F |. 75 0B JNZ SHORT jagmisc.10005A1C 10005A11 |. C1E9 02 SHR ECX,2 10005A14 |. 0F85 85000000 JNZ jagmisc.10005A9F 10005A1A |. EB 27 JMP SHORT jagmisc.10005A43 10005A1C |> 8A06 /MOV AL,BYTE PTR DS:[ESI] 10005A1E |. 83C6 01 |ADD ESI,1 10005A21 |. 8807 |MOV BYTE PTR DS:[EDI],AL 10005A23 |. 83C7 01 |ADD EDI,1 10005A26 |. 83E9 01 |SUB ECX,1 10005A29 |. 74 2B |JE SHORT jagmisc.10005A56 10005A2B |. 84C0 |TEST AL,AL 10005A2D |. 74 2F |JE SHORT jagmisc.10005A5E 10005A2F |. F7C6 03000000 |TEST ESI,3 10005A35 |.^ 75 E5 \JNZ SHORT jagmisc.10005A1C 10005A37 |. 8BD9 MOV EBX,ECX 10005A39 |. C1E9 02 SHR ECX,2 10005A3C |. 75 61 JNZ SHORT jagmisc.10005A9F 10005A3E |> 83E3 03 AND EBX,3 10005A41 |. 74 13 JE SHORT jagmisc.10005A56 10005A43 |> 8A06 /MOV AL,BYTE PTR DS:[ESI] 10005A45 |. 83C6 01 |ADD ESI,1 10005A48 |. 8807 |MOV BYTE PTR DS:[EDI],AL 10005A4A |. 83C7 01 |ADD EDI,1 10005A4D |. 84C0 |TEST AL,AL 10005A4F |. 74 37 |JE SHORT jagmisc.10005A88 10005A51 |. 83EB 01 |SUB EBX,1 10005A54 |.^ 75 ED \JNZ SHORT jagmisc.10005A43 10005A56 |> 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 10005A5A |. 5B POP EBX ; kernel32.7C816FD7 10005A5B |. 5E POP ESI ; kernel32.7C816FD7 10005A5C |. 5F POP EDI ; kernel32.7C816FD7 10005A5D |. C3 RETN 10005A5E |> F7C7 03000000 TEST EDI,3 10005A64 |. 74 16 JE SHORT jagmisc.10005A7C 10005A66 |> 8807 /MOV BYTE PTR DS:[EDI],AL 10005A68 |. 83C7 01 |ADD EDI,1 10005A6B |. 83E9 01 |SUB ECX,1 10005A6E |. 0F84 98000000 |JE jagmisc.10005B0C 10005A74 |. F7C7 03000000 |TEST EDI,3 10005A7A |.^ 75 EA \JNZ SHORT jagmisc.10005A66 10005A7C |> 8BD9 MOV EBX,ECX 10005A7E |. C1E9 02 SHR ECX,2 10005A81 |. 75 74 JNZ SHORT jagmisc.10005AF7 10005A83 |> 8807 MOV BYTE PTR DS:[EDI],AL 10005A85 |. 83C7 01 ADD EDI,1 10005A88 |> 83EB 01 SUB EBX,1 10005A8B |.^ 75 F6 JNZ SHORT jagmisc.10005A83 10005A8D |. 5B POP EBX ; kernel32.7C816FD7 10005A8E |. 5E POP ESI ; kernel32.7C816FD7 10005A8F |> 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 10005A93 |. 5F POP EDI ; kernel32.7C816FD7 10005A94 |. C3 RETN 10005A95 |> 8917 /MOV DWORD PTR DS:[EDI],EDX 10005A97 |. 83C7 04 |ADD EDI,4 10005A9A |. 83E9 01 |SUB ECX,1 10005A9D |.^ 74 9F |JE SHORT jagmisc.10005A3E 10005A9F |> BA FFFEFE7E MOV EDX,7EFEFEFF 10005AA4 |. 8B06 |MOV EAX,DWORD PTR DS:[ESI] 10005AA6 |. 03D0 |ADD EDX,EAX 10005AA8 |. 83F0 FF |XOR EAX,FFFFFFFF 10005AAB |. 33C2 |XOR EAX,EDX 10005AAD |. 8B16 |MOV EDX,DWORD PTR DS:[ESI] 10005AAF |. 83C6 04 |ADD ESI,4 10005AB2 |. A9 00010181 |TEST EAX,81010100 10005AB7 |.^ 74 DC |JE SHORT jagmisc.10005A95 10005AB9 |. 84D2 |TEST DL,DL 10005ABB |. 74 2C |JE SHORT jagmisc.10005AE9 10005ABD |. 84F6 |TEST DH,DH 10005ABF |. 74 1E |JE SHORT jagmisc.10005ADF 10005AC1 |. F7C2 0000FF00 |TEST EDX,0FF0000 10005AC7 |. 74 0C |JE SHORT jagmisc.10005AD5 10005AC9 |. F7C2 000000FF |TEST EDX,FF000000 10005ACF |.^ 75 C4 \JNZ SHORT jagmisc.10005A95 10005AD1 |. 8917 MOV DWORD PTR DS:[EDI],EDX 10005AD3 |. EB 18 JMP SHORT jagmisc.10005AED 10005AD5 |> 81E2 FFFF0000 AND EDX,0FFFF 10005ADB |. 8917 MOV DWORD PTR DS:[EDI],EDX 10005ADD |. EB 0E JMP SHORT jagmisc.10005AED 10005ADF |> 81E2 FF000000 AND EDX,0FF 10005AE5 |. 8917 MOV DWORD PTR DS:[EDI],EDX 10005AE7 |. EB 04 JMP SHORT jagmisc.10005AED 10005AE9 |> 33D2 XOR EDX,EDX 10005AEB |. 8917 MOV DWORD PTR DS:[EDI],EDX 10005AED |> 83C7 04 ADD EDI,4 10005AF0 |. 33C0 XOR EAX,EAX 10005AF2 |. 83E9 01 SUB ECX,1 10005AF5 |. 74 0C JE SHORT jagmisc.10005B03 10005AF7 |> 33C0 XOR EAX,EAX 10005AF9 |> 8907 /MOV DWORD PTR DS:[EDI],EAX 10005AFB |. 83C7 04 |ADD EDI,4 10005AFE |. 83E9 01 |SUB ECX,1 10005B01 |.^ 75 F6 \JNZ SHORT jagmisc.10005AF9 10005B03 |> 83E3 03 AND EBX,3 10005B06 |.^ 0F85 77FFFFFF JNZ jagmisc.10005A83 10005B0C |> 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 10005B10 |. 5B POP EBX ; kernel32.7C816FD7 10005B11 |. 5E POP ESI ; kernel32.7C816FD7 10005B12 |. 5F POP EDI ; kernel32.7C816FD7 10005B13 \. C3 RETN 10005B14 /$ 55 PUSH EBP 10005B15 |. 8BEC MOV EBP,ESP 10005B17 |. 51 PUSH ECX 10005B18 |. 8B45 0C MOV EAX,[ARG.2] 10005B1B |. 8D48 01 LEA ECX,DWORD PTR DS:[EAX+1] 10005B1E |. 81F9 00010000 CMP ECX,100 10005B24 |. 8B4D 08 MOV ECX,[ARG.1] 10005B27 |. 77 09 JA SHORT jagmisc.10005B32 10005B29 |. 8B49 48 MOV ECX,DWORD PTR DS:[ECX+48] 10005B2C |. 0FB70441 MOVZX EAX,WORD PTR DS:[ECX+EAX*2] 10005B30 |. EB 54 JMP SHORT jagmisc.10005B86 10005B32 |> 56 PUSH ESI 10005B33 |. 8BD0 MOV EDX,EAX 10005B35 |. C1FA 08 SAR EDX,8 10005B38 |. 57 PUSH EDI 10005B39 |. 8B79 48 MOV EDI,DWORD PTR DS:[ECX+48] 10005B3C |. 0FB6F2 MOVZX ESI,DL 10005B3F |. F64477 01 80 TEST BYTE PTR DS:[EDI+ESI*2+1],80 10005B44 |. 5F POP EDI ; kernel32.7C816FD7 10005B45 |. 5E POP ESI ; kernel32.7C816FD7 10005B46 |. 74 0F JE SHORT jagmisc.10005B57 10005B48 |. 6A 02 PUSH 2 10005B4A |. 8845 FD MOV BYTE PTR SS:[EBP-3],AL 10005B4D |. 8855 FC MOV BYTE PTR SS:[EBP-4],DL 10005B50 |. C645 FE 00 MOV BYTE PTR SS:[EBP-2],0 10005B54 |. 58 POP EAX ; kernel32.7C816FD7 10005B55 |. EB 0A JMP SHORT jagmisc.10005B61 10005B57 |> 8845 FC MOV BYTE PTR SS:[EBP-4],AL 10005B5A |. 33C0 XOR EAX,EAX 10005B5C |. C645 FD 00 MOV BYTE PTR SS:[EBP-3],0 10005B60 |. 40 INC EAX 10005B61 |> 6A 01 PUSH 1 10005B63 |. FF71 14 PUSH DWORD PTR DS:[ECX+14] 10005B66 |. FF71 04 PUSH DWORD PTR DS:[ECX+4] 10005B69 |. 8D4D 0E LEA ECX,DWORD PTR SS:[EBP+E] 10005B6C |. 51 PUSH ECX 10005B6D |. 50 PUSH EAX 10005B6E |. 8D45 FC LEA EAX,[LOCAL.1] 10005B71 |. 50 PUSH EAX 10005B72 |. 6A 01 PUSH 1 10005B74 |. E8 5F120000 CALL jagmisc.10006DD8 10005B79 |. 83C4 1C ADD ESP,1C 10005B7C |. 85C0 TEST EAX,EAX 10005B7E |. 75 02 JNZ SHORT jagmisc.10005B82 10005B80 |. C9 LEAVE 10005B81 |. C3 RETN 10005B82 |> 0FB745 0E MOVZX EAX,WORD PTR SS:[EBP+E] 10005B86 |> 2345 10 AND EAX,[ARG.3] 10005B89 |. C9 LEAVE 10005B8A \. C3 RETN 10005B8B $ 6A 38 PUSH 38 10005B8D . 68 08890010 PUSH jagmisc.10008908 10005B92 . E8 D9C7FFFF CALL jagmisc.10002370 10005B97 . 33DB XOR EBX,EBX 10005B99 . 391D ACAF0010 CMP DWORD PTR DS:[1000AFAC],EBX 10005B9F . 75 38 JNZ SHORT jagmisc.10005BD9 10005BA1 . 53 PUSH EBX ; /DestSize = 0 10005BA2 . 53 PUSH EBX ; |DestString = NULL 10005BA3 . 33F6 XOR ESI,ESI ; | 10005BA5 . 46 INC ESI ; | 10005BA6 . 56 PUSH ESI ; |SrcSize = 0 10005BA7 . 68 04890010 PUSH jagmisc.10008904 ; |SrcString = "" 10005BAC . 68 00010000 PUSH 100 ; |MapFlags = LCMAP_LOWERCASE 10005BB1 . 53 PUSH EBX ; |LocaleId = 0 10005BB2 . FF15 E8800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringW>] ; \LCMapStringW 10005BB8 . 85C0 TEST EAX,EAX 10005BBA . 74 08 JE SHORT jagmisc.10005BC4 10005BBC . 8935 ACAF0010 MOV DWORD PTR DS:[1000AFAC],ESI 10005BC2 . EB 15 JMP SHORT jagmisc.10005BD9 10005BC4 > FF15 38800010 CALL DWORD PTR DS:[<&KERNEL32.GetLastError>] ; [GetLastError 10005BCA . 83F8 78 CMP EAX,78 10005BCD . 75 0A JNZ SHORT jagmisc.10005BD9 10005BCF . C705 ACAF0010 020>MOV DWORD PTR DS:[1000AFAC],2 10005BD9 > 395D 14 CMP DWORD PTR SS:[EBP+14],EBX 10005BDC . 7E 1B JLE SHORT jagmisc.10005BF9 10005BDE . 8B4D 14 MOV ECX,DWORD PTR SS:[EBP+14] 10005BE1 . 8B45 10 MOV EAX,DWORD PTR SS:[EBP+10] 10005BE4 > 49 DEC ECX 10005BE5 . 3818 CMP BYTE PTR DS:[EAX],BL 10005BE7 . 74 08 JE SHORT jagmisc.10005BF1 10005BE9 . 40 INC EAX 10005BEA . 3BCB CMP ECX,EBX 10005BEC .^ 75 F6 JNZ SHORT jagmisc.10005BE4 10005BEE . 83C9 FF OR ECX,FFFFFFFF 10005BF1 > 83C8 FF OR EAX,FFFFFFFF 10005BF4 . 2BC1 SUB EAX,ECX 10005BF6 . 0145 14 ADD DWORD PTR SS:[EBP+14],EAX 10005BF9 > A1 ACAF0010 MOV EAX,DWORD PTR DS:[1000AFAC] 10005BFE . 83F8 02 CMP EAX,2 10005C01 . 0F84 DC010000 JE jagmisc.10005DE3 10005C07 . 3BC3 CMP EAX,EBX 10005C09 . 0F84 D4010000 JE jagmisc.10005DE3 10005C0F . 83F8 01 CMP EAX,1 10005C12 . 0F85 FE010000 JNZ jagmisc.10005E16 10005C18 . 33FF XOR EDI,EDI 10005C1A . 897D D4 MOV DWORD PTR SS:[EBP-2C],EDI 10005C1D . 895D C8 MOV DWORD PTR SS:[EBP-38],EBX 10005C20 . 895D CC MOV DWORD PTR SS:[EBP-34],EBX 10005C23 . 395D 20 CMP DWORD PTR SS:[EBP+20],EBX 10005C26 . 75 08 JNZ SHORT jagmisc.10005C30 10005C28 . A1 10B00010 MOV EAX,DWORD PTR DS:[1000B010] 10005C2D . 8945 20 MOV DWORD PTR SS:[EBP+20],EAX 10005C30 > 53 PUSH EBX ; /WideBufSize = 0 10005C31 . 53 PUSH EBX ; |WideCharBuf = NULL 10005C32 . FF75 14 PUSH DWORD PTR SS:[EBP+14] ; |StringSize = 6FFC8 (458696.) 10005C35 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |StringToMap = 8054A6ED ??? 10005C38 . 33C0 XOR EAX,EAX ; | 10005C3A . 395D 24 CMP DWORD PTR SS:[EBP+24],EBX ; | 10005C3D . 0F95C0 SETNE AL ; | 10005C40 . 8D04C5 01000000 LEA EAX,DWORD PTR DS:[EAX*8+1] ; | 10005C47 . 50 PUSH EAX ; |Options = MB_ERR_INVALID_CHARS 10005C48 . FF75 20 PUSH DWORD PTR SS:[EBP+20] ; |CodePage = 7C839AA8 10005C4B . FF15 E4800010 CALL DWORD PTR DS:[<&KERNEL32.MultiByteToWideChar>] ; \MultiByteToWideChar 10005C51 . 8BF0 MOV ESI,EAX 10005C53 . 8975 D0 MOV DWORD PTR SS:[EBP-30],ESI 10005C56 . 3BF3 CMP ESI,EBX 10005C58 . 0F84 B8010000 JE jagmisc.10005E16 10005C5E . C745 FC 01000000 MOV DWORD PTR SS:[EBP-4],1 10005C65 . 8D0436 LEA EAX,DWORD PTR DS:[ESI+ESI] 10005C68 . 83C0 03 ADD EAX,3 10005C6B . 83E0 FC AND EAX,FFFFFFFC 10005C6E . E8 3DD1FFFF CALL jagmisc.10002DB0 10005C73 . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP 10005C76 . 8BC4 MOV EAX,ESP 10005C78 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 10005C7B . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10005C7F . EB 1B JMP SHORT jagmisc.10005C9C 10005C81 . 33C0 XOR EAX,EAX 10005C83 . 40 INC EAX 10005C84 . C3 RETN 10005C85 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451 10005C88 . E8 C2170000 CALL jagmisc.1000744F 10005C8D . 33DB XOR EBX,EBX 10005C8F . 895D E4 MOV DWORD PTR SS:[EBP-1C],EBX 10005C92 . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10005C96 . 8B7D D4 MOV EDI,DWORD PTR SS:[EBP-2C] 10005C99 . 8B75 D0 MOV ESI,DWORD PTR SS:[EBP-30] ; ntdll.7C90EA53 10005C9C > 395D E4 CMP DWORD PTR SS:[EBP-1C],EBX 10005C9F . 75 1C JNZ SHORT jagmisc.10005CBD 10005CA1 . 8D0436 LEA EAX,DWORD PTR DS:[ESI+ESI] 10005CA4 . 50 PUSH EAX 10005CA5 . E8 F2F8FFFF CALL jagmisc.1000559C 10005CAA . 59 POP ECX ; kernel32.7C816FD7 10005CAB . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 10005CAE . 3BC3 CMP EAX,EBX 10005CB0 . 0F84 60010000 JE jagmisc.10005E16 10005CB6 . C745 C8 01000000 MOV DWORD PTR SS:[EBP-38],1 10005CBD > 56 PUSH ESI ; /WideBufSize = 0 10005CBE . FF75 E4 PUSH DWORD PTR SS:[EBP-1C] ; |WideCharBuf = 0006FFB8 10005CC1 . FF75 14 PUSH DWORD PTR SS:[EBP+14] ; |StringSize = 6FFC8 (458696.) 10005CC4 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |StringToMap = 8054A6ED ??? 10005CC7 . 6A 01 PUSH 1 ; |Options = MB_PRECOMPOSED 10005CC9 . FF75 20 PUSH DWORD PTR SS:[EBP+20] ; |CodePage = 7C839AA8 10005CCC . FF15 E4800010 CALL DWORD PTR DS:[<&KERNEL32.MultiByteToWideChar>] ; \MultiByteToWideChar 10005CD2 . 85C0 TEST EAX,EAX 10005CD4 . 0F84 E6000000 JE jagmisc.10005DC0 10005CDA . 53 PUSH EBX ; /DestSize = 0 10005CDB . 53 PUSH EBX ; |DestString = NULL 10005CDC . 56 PUSH ESI ; |SrcSize = 0 10005CDD . FF75 E4 PUSH DWORD PTR SS:[EBP-1C] ; |SrcString = "?\x06?A" 10005CE0 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |MapFlags = NORM_IGNOREKANATYPE|LCMAP_HIRAGANA|LCMAP_KATAKANA|LCMAP_HALFWIDTH|LCMAP_FULLWIDTH|SORT_STRINGSORT|7F0C8000 10005CE3 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |LocaleId = FFFFFFFF 10005CE6 . FF15 E8800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringW>] ; \LCMapStringW 10005CEC . 8BF8 MOV EDI,EAX 10005CEE . 897D D4 MOV DWORD PTR SS:[EBP-2C],EDI 10005CF1 . 3BFB CMP EDI,EBX 10005CF3 . 0F84 C7000000 JE jagmisc.10005DC0 10005CF9 . F645 0D 04 TEST BYTE PTR SS:[EBP+D],4 10005CFD . 74 2D JE SHORT jagmisc.10005D2C 10005CFF . 395D 1C CMP DWORD PTR SS:[EBP+1C],EBX 10005D02 . 0F84 B8000000 JE jagmisc.10005DC0 10005D08 . 3B7D 1C CMP EDI,DWORD PTR SS:[EBP+1C] 10005D0B . 0F8F AF000000 JG jagmisc.10005DC0 10005D11 . FF75 1C PUSH DWORD PTR SS:[EBP+1C] ; /DestSize = FFFFFFFF (-1.) 10005D14 . FF75 18 PUSH DWORD PTR SS:[EBP+18] ; |DestString = 8227C238 10005D17 . 56 PUSH ESI ; |SrcSize = 0 10005D18 . FF75 E4 PUSH DWORD PTR SS:[EBP-1C] ; |SrcString = "?\x06?A" 10005D1B . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |MapFlags = NORM_IGNOREKANATYPE|LCMAP_HIRAGANA|LCMAP_KATAKANA|LCMAP_HALFWIDTH|LCMAP_FULLWIDTH|SORT_STRINGSORT|7F0C8000 10005D1E . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |LocaleId = FFFFFFFF 10005D21 . FF15 E8800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringW>] ; \LCMapStringW 10005D27 . E9 94000000 JMP jagmisc.10005DC0 10005D2C > C745 FC 02000000 MOV DWORD PTR SS:[EBP-4],2 10005D33 . 8D043F LEA EAX,DWORD PTR DS:[EDI+EDI] 10005D36 . 83C0 03 ADD EAX,3 10005D39 . 83E0 FC AND EAX,FFFFFFFC 10005D3C . E8 6FD0FFFF CALL jagmisc.10002DB0 10005D41 . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP 10005D44 . 8BC4 MOV EAX,ESP 10005D46 . 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX 10005D49 . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10005D4D . EB 1B JMP SHORT jagmisc.10005D6A 10005D4F . 33C0 XOR EAX,EAX 10005D51 . 40 INC EAX 10005D52 . C3 RETN 10005D53 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451 10005D56 . E8 F4160000 CALL jagmisc.1000744F 10005D5B . 33DB XOR EBX,EBX 10005D5D . 895D E0 MOV DWORD PTR SS:[EBP-20],EBX 10005D60 . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10005D64 . 8B7D D4 MOV EDI,DWORD PTR SS:[EBP-2C] 10005D67 . 8B75 D0 MOV ESI,DWORD PTR SS:[EBP-30] ; ntdll.7C90EA53 10005D6A > 395D E0 CMP DWORD PTR SS:[EBP-20],EBX 10005D6D . 75 18 JNZ SHORT jagmisc.10005D87 10005D6F . 8D043F LEA EAX,DWORD PTR DS:[EDI+EDI] 10005D72 . 50 PUSH EAX 10005D73 . E8 24F8FFFF CALL jagmisc.1000559C 10005D78 . 59 POP ECX ; kernel32.7C816FD7 10005D79 . 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX 10005D7C . 3BC3 CMP EAX,EBX 10005D7E . 74 40 JE SHORT jagmisc.10005DC0 10005D80 . C745 CC 01000000 MOV DWORD PTR SS:[EBP-34],1 10005D87 > 57 PUSH EDI ; /DestSize = 0 10005D88 . FF75 E0 PUSH DWORD PTR SS:[EBP-20] ; |DestString = NULL 10005D8B . 56 PUSH ESI ; |SrcSize = 0 10005D8C . FF75 E4 PUSH DWORD PTR SS:[EBP-1C] ; |SrcString = "?\x06?A" 10005D8F . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |MapFlags = NORM_IGNOREKANATYPE|LCMAP_HIRAGANA|LCMAP_KATAKANA|LCMAP_HALFWIDTH|LCMAP_FULLWIDTH|SORT_STRINGSORT|7F0C8000 10005D92 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |LocaleId = FFFFFFFF 10005D95 . FF15 E8800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringW>] ; \LCMapStringW 10005D9B . 85C0 TEST EAX,EAX 10005D9D . 74 21 JE SHORT jagmisc.10005DC0 10005D9F . 53 PUSH EBX 10005DA0 . 53 PUSH EBX 10005DA1 . 395D 1C CMP DWORD PTR SS:[EBP+1C],EBX 10005DA4 . 75 04 JNZ SHORT jagmisc.10005DAA 10005DA6 . 53 PUSH EBX 10005DA7 . 53 PUSH EBX 10005DA8 . EB 06 JMP SHORT jagmisc.10005DB0 10005DAA > FF75 1C PUSH DWORD PTR SS:[EBP+1C] 10005DAD . FF75 18 PUSH DWORD PTR SS:[EBP+18] 10005DB0 > 57 PUSH EDI ; |WideCharCount = 0 10005DB1 . FF75 E0 PUSH DWORD PTR SS:[EBP-20] ; |WideCharStr = NULL 10005DB4 . 53 PUSH EBX ; |Options = 0 10005DB5 . FF75 20 PUSH DWORD PTR SS:[EBP+20] ; |CodePage = 7C839AA8 10005DB8 . FF15 A4800010 CALL DWORD PTR DS:[<&KERNEL32.WideCharToMultiByte>] ; \WideCharToMultiByte 10005DBE . 8BF8 MOV EDI,EAX 10005DC0 > 395D CC CMP DWORD PTR SS:[EBP-34],EBX 10005DC3 . 74 09 JE SHORT jagmisc.10005DCE 10005DC5 . FF75 E0 PUSH DWORD PTR SS:[EBP-20] 10005DC8 . E8 30C5FFFF CALL jagmisc.100022FD 10005DCD . 59 POP ECX ; kernel32.7C816FD7 10005DCE > 395D C8 CMP DWORD PTR SS:[EBP-38],EBX 10005DD1 . 74 09 JE SHORT jagmisc.10005DDC 10005DD3 . FF75 E4 PUSH DWORD PTR SS:[EBP-1C] 10005DD6 . E8 22C5FFFF CALL jagmisc.100022FD 10005DDB . 59 POP ECX ; kernel32.7C816FD7 10005DDC > 8BC7 MOV EAX,EDI 10005DDE . E9 5B010000 JMP jagmisc.10005F3E 10005DE3 > 895D D8 MOV DWORD PTR SS:[EBP-28],EBX 10005DE6 . 33FF XOR EDI,EDI 10005DE8 . 895D C4 MOV DWORD PTR SS:[EBP-3C],EBX 10005DEB . 395D 08 CMP DWORD PTR SS:[EBP+8],EBX 10005DEE . 75 08 JNZ SHORT jagmisc.10005DF8 10005DF0 . A1 00B00010 MOV EAX,DWORD PTR DS:[1000B000] 10005DF5 . 8945 08 MOV DWORD PTR SS:[EBP+8],EAX 10005DF8 > 395D 20 CMP DWORD PTR SS:[EBP+20],EBX 10005DFB . 75 08 JNZ SHORT jagmisc.10005E05 10005DFD . A1 10B00010 MOV EAX,DWORD PTR DS:[1000B010] 10005E02 . 8945 20 MOV DWORD PTR SS:[EBP+20],EAX 10005E05 > FF75 08 PUSH DWORD PTR SS:[EBP+8] 10005E08 . E8 36140000 CALL jagmisc.10007243 10005E0D . 59 POP ECX ; kernel32.7C816FD7 10005E0E . 8945 C0 MOV DWORD PTR SS:[EBP-40],EAX 10005E11 . 83F8 FF CMP EAX,-1 10005E14 . 75 07 JNZ SHORT jagmisc.10005E1D 10005E16 > 33C0 XOR EAX,EAX 10005E18 . E9 21010000 JMP jagmisc.10005F3E 10005E1D > 3B45 20 CMP EAX,DWORD PTR SS:[EBP+20] ; kernel32.7C839AA8 10005E20 . 0F84 EE000000 JE jagmisc.10005F14 10005E26 . 53 PUSH EBX 10005E27 . 53 PUSH EBX 10005E28 . 8D4D 14 LEA ECX,DWORD PTR SS:[EBP+14] 10005E2B . 51 PUSH ECX 10005E2C . FF75 10 PUSH DWORD PTR SS:[EBP+10] 10005E2F . 50 PUSH EAX 10005E30 . FF75 20 PUSH DWORD PTR SS:[EBP+20] ; kernel32.7C839AA8 10005E33 . E8 4E140000 CALL jagmisc.10007286 10005E38 . 83C4 18 ADD ESP,18 10005E3B . 8945 D8 MOV DWORD PTR SS:[EBP-28],EAX 10005E3E . 3BC3 CMP EAX,EBX 10005E40 .^ 74 D4 JE SHORT jagmisc.10005E16 10005E42 . 53 PUSH EBX ; /DestSize = 0 10005E43 . 53 PUSH EBX ; |DestString = NULL 10005E44 . FF75 14 PUSH DWORD PTR SS:[EBP+14] ; |SrcSize = 6FFC8 (458696.) 10005E47 . 50 PUSH EAX ; |SrcString = 00000008 ??? 10005E48 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |MapFlags = NORM_IGNOREKANATYPE|LCMAP_HIRAGANA|LCMAP_KATAKANA|LCMAP_HALFWIDTH|LCMAP_FULLWIDTH|SORT_STRINGSORT|7F0C8000 10005E4B . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |LocaleId = FFFFFFFF 10005E4E . FF15 E0800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringA>] ; \LCMapStringA 10005E54 . 8BF0 MOV ESI,EAX 10005E56 . 8975 DC MOV DWORD PTR SS:[EBP-24],ESI 10005E59 . 3BF3 CMP ESI,EBX 10005E5B . 0F84 A2000000 JE jagmisc.10005F03 10005E61 . 895D FC MOV DWORD PTR SS:[EBP-4],EBX 10005E64 . 83C0 03 ADD EAX,3 10005E67 . 83E0 FC AND EAX,FFFFFFFC 10005E6A . E8 41CFFFFF CALL jagmisc.10002DB0 10005E6F . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP 10005E72 . 8BFC MOV EDI,ESP 10005E74 . 897D BC MOV DWORD PTR SS:[EBP-44],EDI 10005E77 . 56 PUSH ESI 10005E78 . 53 PUSH EBX 10005E79 . 57 PUSH EDI 10005E7A . E8 91DCFFFF CALL jagmisc.10003B10 10005E7F . 83C4 0C ADD ESP,0C 10005E82 . EB 10 JMP SHORT jagmisc.10005E94 10005E84 . 33C0 XOR EAX,EAX 10005E86 . 40 INC EAX 10005E87 . C3 RETN 10005E88 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451 10005E8B . E8 BF150000 CALL jagmisc.1000744F 10005E90 . 33DB XOR EBX,EBX 10005E92 . 33FF XOR EDI,EDI 10005E94 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10005E98 . 3BFB CMP EDI,EBX 10005E9A . 75 23 JNZ SHORT jagmisc.10005EBF 10005E9C . FF75 DC PUSH DWORD PTR SS:[EBP-24] ; kernel32.7C802458 10005E9F . E8 F8F6FFFF CALL jagmisc.1000559C 10005EA4 . 59 POP ECX ; kernel32.7C816FD7 10005EA5 . 8BF8 MOV EDI,EAX 10005EA7 . 3BFB CMP EDI,EBX 10005EA9 . 74 31 JE SHORT jagmisc.10005EDC 10005EAB . FF75 DC PUSH DWORD PTR SS:[EBP-24] ; kernel32.7C802458 10005EAE . 53 PUSH EBX 10005EAF . 57 PUSH EDI 10005EB0 . E8 5BDCFFFF CALL jagmisc.10003B10 10005EB5 . 83C4 0C ADD ESP,0C 10005EB8 . C745 C4 01000000 MOV DWORD PTR SS:[EBP-3C],1 10005EBF > FF75 DC PUSH DWORD PTR SS:[EBP-24] ; /DestSize = 7C802458 (2088772696.) 10005EC2 . 57 PUSH EDI ; |DestString = NULL 10005EC3 . FF75 14 PUSH DWORD PTR SS:[EBP+14] ; |SrcSize = 6FFC8 (458696.) 10005EC6 . FF75 D8 PUSH DWORD PTR SS:[EBP-28] ; |SrcString = "U\x8Bì\x83ì\x08SVWUü\x8B]\x0C\x8BE\x08\xF7@\x04\x06" 10005EC9 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |MapFlags = NORM_IGNOREKANATYPE|LCMAP_HIRAGANA|LCMAP_KATAKANA|LCMAP_HALFWIDTH|LCMAP_FULLWIDTH|SORT_STRINGSORT|7F0C8000 10005ECC . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |LocaleId = FFFFFFFF 10005ECF . FF15 E0800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringA>] ; \LCMapStringA 10005ED5 . 8945 DC MOV DWORD PTR SS:[EBP-24],EAX 10005ED8 . 3BC3 CMP EAX,EBX 10005EDA . 75 04 JNZ SHORT jagmisc.10005EE0 10005EDC > 33F6 XOR ESI,ESI 10005EDE . EB 26 JMP SHORT jagmisc.10005F06 10005EE0 > FF75 1C PUSH DWORD PTR SS:[EBP+1C] 10005EE3 . FF75 18 PUSH DWORD PTR SS:[EBP+18] 10005EE6 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24] 10005EE9 . 50 PUSH EAX 10005EEA . 57 PUSH EDI 10005EEB . FF75 20 PUSH DWORD PTR SS:[EBP+20] ; kernel32.7C839AA8 10005EEE . FF75 C0 PUSH DWORD PTR SS:[EBP-40] 10005EF1 . E8 90130000 CALL jagmisc.10007286 10005EF6 . 83C4 18 ADD ESP,18 10005EF9 . 8BF0 MOV ESI,EAX 10005EFB . F7DE NEG ESI 10005EFD . 1BF6 SBB ESI,ESI 10005EFF . F7DE NEG ESI 10005F01 . EB 03 JMP SHORT jagmisc.10005F06 10005F03 > 8B75 B8 MOV ESI,DWORD PTR SS:[EBP-48] 10005F06 > 395D C4 CMP DWORD PTR SS:[EBP-3C],EBX 10005F09 . 74 23 JE SHORT jagmisc.10005F2E 10005F0B . 57 PUSH EDI 10005F0C . E8 ECC3FFFF CALL jagmisc.100022FD 10005F11 . 59 POP ECX ; kernel32.7C816FD7 10005F12 . EB 1A JMP SHORT jagmisc.10005F2E 10005F14 > FF75 1C PUSH DWORD PTR SS:[EBP+1C] ; /DestSize = FFFFFFFF (-1.) 10005F17 . FF75 18 PUSH DWORD PTR SS:[EBP+18] ; |DestString = 8227C238 10005F1A . FF75 14 PUSH DWORD PTR SS:[EBP+14] ; |SrcSize = 6FFC8 (458696.) 10005F1D . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |SrcString = 8054A6ED ??? 10005F20 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |MapFlags = NORM_IGNOREKANATYPE|LCMAP_HIRAGANA|LCMAP_KATAKANA|LCMAP_HALFWIDTH|LCMAP_FULLWIDTH|SORT_STRINGSORT|7F0C8000 10005F23 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |LocaleId = FFFFFFFF 10005F26 . FF15 E0800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringA>] ; \LCMapStringA 10005F2C . 8BF0 MOV ESI,EAX 10005F2E > 395D D8 CMP DWORD PTR SS:[EBP-28],EBX 10005F31 . 74 09 JE SHORT jagmisc.10005F3C 10005F33 . FF75 D8 PUSH DWORD PTR SS:[EBP-28] ; kernel32.7C839AA8 10005F36 . E8 C2C3FFFF CALL jagmisc.100022FD 10005F3B . 59 POP ECX ; kernel32.7C816FD7 10005F3C > 8BC6 MOV EAX,ESI 10005F3E > 8D65 AC LEA ESP,DWORD PTR SS:[EBP-54] 10005F41 . E8 65C4FFFF CALL jagmisc.100023AB 10005F46 . C3 RETN 10005F47 /$ 8B5424 04 MOV EDX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10005F4B |. 56 PUSH ESI 10005F4C |. 8B7424 0C MOV ESI,DWORD PTR SS:[ESP+C] 10005F50 |. 8D0C32 LEA ECX,DWORD PTR DS:[EDX+ESI] 10005F53 |. 33C0 XOR EAX,EAX 10005F55 |. 3BCA CMP ECX,EDX 10005F57 |. 72 04 JB SHORT jagmisc.10005F5D 10005F59 |. 3BCE CMP ECX,ESI 10005F5B |. 73 03 JNB SHORT jagmisc.10005F60 10005F5D |> 33C0 XOR EAX,EAX 10005F5F |. 40 INC EAX 10005F60 |> 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 10005F64 |. 890A MOV DWORD PTR DS:[EDX],ECX 10005F66 |. 5E POP ESI ; kernel32.7C816FD7 10005F67 \. C3 RETN 10005F68 /$ 56 PUSH ESI 10005F69 |. 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 10005F6D |. 57 PUSH EDI 10005F6E |. 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10] 10005F72 |. 56 PUSH ESI 10005F73 |. FF37 PUSH DWORD PTR DS:[EDI] 10005F75 |. FF36 PUSH DWORD PTR DS:[ESI] 10005F77 |. E8 CBFFFFFF CALL jagmisc.10005F47 10005F7C |. 83C4 0C ADD ESP,0C 10005F7F |. 85C0 TEST EAX,EAX 10005F81 |. 74 17 JE SHORT jagmisc.10005F9A 10005F83 |. 8D46 04 LEA EAX,DWORD PTR DS:[ESI+4] 10005F86 |. 50 PUSH EAX 10005F87 |. 6A 01 PUSH 1 10005F89 |. FF30 PUSH DWORD PTR DS:[EAX] 10005F8B |. E8 B7FFFFFF CALL jagmisc.10005F47 10005F90 |. 83C4 0C ADD ESP,0C 10005F93 |. 85C0 TEST EAX,EAX 10005F95 |. 74 03 JE SHORT jagmisc.10005F9A 10005F97 |. FF46 08 INC DWORD PTR DS:[ESI+8] 10005F9A |> 8D46 04 LEA EAX,DWORD PTR DS:[ESI+4] 10005F9D |. 50 PUSH EAX 10005F9E |. FF77 04 PUSH DWORD PTR DS:[EDI+4] 10005FA1 |. FF30 PUSH DWORD PTR DS:[EAX] 10005FA3 |. E8 9FFFFFFF CALL jagmisc.10005F47 10005FA8 |. 83C4 0C ADD ESP,0C 10005FAB |. 85C0 TEST EAX,EAX 10005FAD |. 74 03 JE SHORT jagmisc.10005FB2 10005FAF |. FF46 08 INC DWORD PTR DS:[ESI+8] 10005FB2 |> 8D46 08 LEA EAX,DWORD PTR DS:[ESI+8] 10005FB5 |. 50 PUSH EAX 10005FB6 |. FF77 08 PUSH DWORD PTR DS:[EDI+8] 10005FB9 |. FF30 PUSH DWORD PTR DS:[EAX] 10005FBB |. E8 87FFFFFF CALL jagmisc.10005F47 10005FC0 |. 83C4 0C ADD ESP,0C 10005FC3 |. 5F POP EDI ; kernel32.7C816FD7 10005FC4 |. 5E POP ESI ; kernel32.7C816FD7 10005FC5 \. C3 RETN 10005FC6 /$ 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10005FCA |. 56 PUSH ESI 10005FCB |. 8B30 MOV ESI,DWORD PTR DS:[EAX] 10005FCD |. 8BCE MOV ECX,ESI 10005FCF |. 03F6 ADD ESI,ESI 10005FD1 |. 57 PUSH EDI 10005FD2 |. 8B78 04 MOV EDI,DWORD PTR DS:[EAX+4] 10005FD5 |. C1E9 1F SHR ECX,1F 10005FD8 |. 8930 MOV DWORD PTR DS:[EAX],ESI 10005FDA |. 8D343F LEA ESI,DWORD PTR DS:[EDI+EDI] 10005FDD |. 0BF1 OR ESI,ECX 10005FDF |. 8B48 08 MOV ECX,DWORD PTR DS:[EAX+8] 10005FE2 |. 8BD7 MOV EDX,EDI 10005FE4 |. C1EA 1F SHR EDX,1F 10005FE7 |. D1E1 SHL ECX,1 10005FE9 |. 0BCA OR ECX,EDX 10005FEB |. 5F POP EDI ; kernel32.7C816FD7 10005FEC |. 8970 04 MOV DWORD PTR DS:[EAX+4],ESI 10005FEF |. 8948 08 MOV DWORD PTR DS:[EAX+8],ECX 10005FF2 |. 5E POP ESI ; kernel32.7C816FD7 10005FF3 \. C3 RETN 10005FF4 /$ 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10005FF8 |. 8B50 08 MOV EDX,DWORD PTR DS:[EAX+8] 10005FFB |. 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4] 10005FFE |. 56 PUSH ESI 10005FFF |. 57 PUSH EDI 10006000 |. 8BF9 MOV EDI,ECX 10006002 |. 8BF2 MOV ESI,EDX 10006004 |. D1E9 SHR ECX,1 10006006 |. C1E6 1F SHL ESI,1F 10006009 |. 0BCE OR ECX,ESI 1000600B |. 8948 04 MOV DWORD PTR DS:[EAX+4],ECX 1000600E |. 8B08 MOV ECX,DWORD PTR DS:[EAX] 10006010 |. C1E7 1F SHL EDI,1F 10006013 |. D1E9 SHR ECX,1 10006015 |. 0BCF OR ECX,EDI 10006017 |. D1EA SHR EDX,1 10006019 |. 5F POP EDI ; kernel32.7C816FD7 1000601A |. 8950 08 MOV DWORD PTR DS:[EAX+8],EDX 1000601D |. 8908 MOV DWORD PTR DS:[EAX],ECX 1000601F |. 5E POP ESI ; kernel32.7C816FD7 10006020 \. C3 RETN 10006021 /$ 55 PUSH EBP 10006022 |. 8BEC MOV EBP,ESP 10006024 |. 83EC 14 SUB ESP,14 10006027 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 1000602C |. 53 PUSH EBX 1000602D |. 8B5D 10 MOV EBX,[ARG.3] 10006030 |. 33D2 XOR EDX,EDX 10006032 |. 8945 FC MOV [LOCAL.1],EAX 10006035 |. 8B45 0C MOV EAX,[ARG.2] 10006038 |. 3BC2 CMP EAX,EDX 1000603A |. 56 PUSH ESI 1000603B |. 57 PUSH EDI 1000603C |. C745 EC 4E400000 MOV [LOCAL.5],404E 10006043 |. 8913 MOV DWORD PTR DS:[EBX],EDX 10006045 |. 8953 04 MOV DWORD PTR DS:[EBX+4],EDX 10006048 |. 8953 08 MOV DWORD PTR DS:[EBX+8],EDX 1000604B |. 76 4F JBE SHORT jagmisc.1000609C 1000604D |. 8945 10 MOV [ARG.3],EAX 10006050 |> 8BF3 /MOV ESI,EBX 10006052 |. 8D7D F0 |LEA EDI,[LOCAL.4] 10006055 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10006056 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10006057 |. 53 |PUSH EBX 10006058 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10006059 |. E8 68FFFFFF |CALL jagmisc.10005FC6 1000605E |. 53 |PUSH EBX 1000605F |. E8 62FFFFFF |CALL jagmisc.10005FC6 10006064 |. 8D45 F0 |LEA EAX,[LOCAL.4] 10006067 |. 50 |PUSH EAX 10006068 |. 53 |PUSH EBX 10006069 |. E8 FAFEFFFF |CALL jagmisc.10005F68 1000606E |. 53 |PUSH EBX 1000606F |. E8 52FFFFFF |CALL jagmisc.10005FC6 10006074 |. 8B45 08 |MOV EAX,[ARG.1] 10006077 |. 0FBE00 |MOVSX EAX,BYTE PTR DS:[EAX] 1000607A |. 8365 F4 00 |AND [LOCAL.3],0 1000607E |. 8365 F8 00 |AND [LOCAL.2],0 10006082 |. 8945 F0 |MOV [LOCAL.4],EAX 10006085 |. 8D45 F0 |LEA EAX,[LOCAL.4] 10006088 |. 50 |PUSH EAX 10006089 |. 53 |PUSH EBX 1000608A |. E8 D9FEFFFF |CALL jagmisc.10005F68 1000608F |. 83C4 1C |ADD ESP,1C 10006092 |. FF45 08 |INC [ARG.1] 10006095 |. FF4D 10 |DEC [ARG.3] 10006098 |.^ 75 B6 \JNZ SHORT jagmisc.10006050 1000609A |. 33D2 XOR EDX,EDX 1000609C |> 3953 08 CMP DWORD PTR DS:[EBX+8],EDX 1000609F |. 75 2F JNZ SHORT jagmisc.100060D0 100060A1 |. 8B7B 08 MOV EDI,DWORD PTR DS:[EBX+8] 100060A4 |> 8B4B 04 /MOV ECX,DWORD PTR DS:[EBX+4] 100060A7 |. 8145 EC F0FF0000 |ADD [LOCAL.5],0FFF0 100060AE |. 8BC1 |MOV EAX,ECX 100060B0 |. C1E8 10 |SHR EAX,10 100060B3 |. 8BF8 |MOV EDI,EAX 100060B5 |. 8B03 |MOV EAX,DWORD PTR DS:[EBX] 100060B7 |. 8BF0 |MOV ESI,EAX 100060B9 |. C1EE 10 |SHR ESI,10 100060BC |. C1E1 10 |SHL ECX,10 100060BF |. 0BF1 |OR ESI,ECX 100060C1 |. C1E0 10 |SHL EAX,10 100060C4 |. 3BFA |CMP EDI,EDX 100060C6 |. 8973 04 |MOV DWORD PTR DS:[EBX+4],ESI 100060C9 |. 8903 |MOV DWORD PTR DS:[EBX],EAX 100060CB |.^ 74 D7 \JE SHORT jagmisc.100060A4 100060CD |. 897B 08 MOV DWORD PTR DS:[EBX+8],EDI 100060D0 |> BE 00800000 MOV ESI,8000 100060D5 |. EB 0E JMP SHORT jagmisc.100060E5 100060D7 |> 53 /PUSH EBX 100060D8 |. E8 E9FEFFFF |CALL jagmisc.10005FC6 100060DD |. 8145 EC FFFF0000 |ADD [LOCAL.5],0FFFF 100060E4 |. 59 |POP ECX ; kernel32.7C816FD7 100060E5 |> 8573 08 TEST DWORD PTR DS:[EBX+8],ESI 100060E8 |.^ 74 ED \JE SHORT jagmisc.100060D7 100060EA |. 66:8B45 EC MOV AX,WORD PTR SS:[EBP-14] 100060EE |. 8B4D FC MOV ECX,[LOCAL.1] 100060F1 |. 5F POP EDI ; kernel32.7C816FD7 100060F2 |. 5E POP ESI ; kernel32.7C816FD7 100060F3 |. 66:8943 0A MOV WORD PTR DS:[EBX+A],AX 100060F7 |. 5B POP EBX ; kernel32.7C816FD7 100060F8 |. E8 F9D9FFFF CALL jagmisc.10003AF6 100060FD |. C9 LEAVE 100060FE \. C3 RETN 100060FF /$ 55 PUSH EBP 10006100 |. 8BEC MOV EBP,ESP 10006102 |. 83EC 5C SUB ESP,5C 10006105 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 1000610A |. 53 PUSH EBX 1000610B |. 56 PUSH ESI 1000610C |. 8945 FC MOV [LOCAL.1],EAX 1000610F |. 33C0 XOR EAX,EAX 10006111 |. 57 PUSH EDI 10006112 |. 8B7D 10 MOV EDI,[ARG.3] 10006115 |. 8D75 D0 LEA ESI,[LOCAL.12] 10006118 |. 8975 CC MOV [LOCAL.13],ESI 1000611B |. 8945 B0 MOV [LOCAL.20],EAX 1000611E |. C745 B4 01000000 MOV [LOCAL.19],1 10006125 |. 8945 C8 MOV [LOCAL.14],EAX 10006128 |. 8945 BC MOV [LOCAL.17],EAX 1000612B |. 8945 A8 MOV [LOCAL.22],EAX 1000612E |. 8945 A4 MOV [LOCAL.23],EAX 10006131 |. 8945 AC MOV [LOCAL.21],EAX 10006134 |. 8945 C4 MOV [LOCAL.15],EAX 10006137 |. 8945 B8 MOV [LOCAL.18],EAX 1000613A |. 897D C0 MOV [LOCAL.16],EDI 1000613D |> 8A0F /MOV CL,BYTE PTR DS:[EDI] 1000613F |. 80F9 20 |CMP CL,20 10006142 |. 74 0F |JE SHORT jagmisc.10006153 10006144 |. 80F9 09 |CMP CL,9 10006147 |. 74 0A |JE SHORT jagmisc.10006153 10006149 |. 80F9 0A |CMP CL,0A 1000614C |. 74 05 |JE SHORT jagmisc.10006153 1000614E |. 80F9 0D |CMP CL,0D 10006151 |. 75 03 |JNZ SHORT jagmisc.10006156 10006153 |> 47 |INC EDI 10006154 |.^ EB E7 \JMP SHORT jagmisc.1000613D 10006156 |> 8A1F MOV BL,BYTE PTR DS:[EDI] 10006158 |. 47 INC EDI 10006159 |. 83F8 0B CMP EAX,0B ; Switch (cases 0..B) 1000615C |. 0F87 73020000 JA jagmisc.100063D5 10006162 |. FF2485 03650010 JMP DWORD PTR DS:[EAX*4+10006503] ; jagmisc.10006333 10006169 |> 80FB 31 CMP BL,31 ; Case 0 of switch 10006159 1000616C |. 7C 0C JL SHORT jagmisc.1000617A 1000616E |. 80FB 39 CMP BL,39 10006171 |. 7F 07 JG SHORT jagmisc.1000617A 10006173 |> 6A 03 PUSH 3 10006175 |. E9 1A020000 JMP jagmisc.10006394 1000617A |> 3A1D 1CA30010 CMP BL,BYTE PTR DS:[1000A31C] 10006180 |. 75 07 JNZ SHORT jagmisc.10006189 10006182 |> 6A 05 PUSH 5 10006184 |. E9 42020000 JMP jagmisc.100063CB 10006189 |> 0FBEC3 MOVSX EAX,BL 1000618C |. 83E8 2B SUB EAX,2B ; Switch (cases 2B..30) 1000618F |. 74 22 JE SHORT jagmisc.100061B3 10006191 |. 48 DEC EAX 10006192 |. 48 DEC EAX 10006193 |. 74 12 JE SHORT jagmisc.100061A7 10006195 |. 83E8 03 SUB EAX,3 10006198 |. 0F84 A2000000 JE jagmisc.10006240 1000619E |. 8975 CC MOV [LOCAL.13],ESI ; Default case of switch 1000618C 100061A1 |. 4F DEC EDI 100061A2 |. E9 AB010000 JMP jagmisc.10006352 100061A7 |> 6A 02 PUSH 2 ; Case 2D ('-') of switch 1000618C 100061A9 |. 58 POP EAX ; kernel32.7C816FD7 100061AA |. C745 B0 00800000 MOV [LOCAL.20],8000 100061B1 |.^ EB A3 JMP SHORT jagmisc.10006156 100061B3 |> 8365 B0 00 AND [LOCAL.20],0 ; Case 2B ('+') of switch 1000618C 100061B7 |. 6A 02 PUSH 2 100061B9 |. 58 POP EAX ; kernel32.7C816FD7 100061BA |.^ EB 9A JMP SHORT jagmisc.10006156 100061BC |> 33C0 XOR EAX,EAX ; Case 1 of switch 10006159 100061BE |. 40 INC EAX 100061BF |. 80FB 31 CMP BL,31 100061C2 |. 8945 BC MOV [LOCAL.17],EAX 100061C5 |. 7C 05 JL SHORT jagmisc.100061CC 100061C7 |. 80FB 39 CMP BL,39 100061CA |.^ 7E A7 JLE SHORT jagmisc.10006173 100061CC |> 3A1D 1CA30010 CMP BL,BYTE PTR DS:[1000A31C] 100061D2 |. 75 07 JNZ SHORT jagmisc.100061DB 100061D4 |> 6A 04 PUSH 4 100061D6 |. E9 F0010000 JMP jagmisc.100063CB 100061DB |> 80FB 2B CMP BL,2B 100061DE |. 74 35 JE SHORT jagmisc.10006215 100061E0 |. 80FB 2D CMP BL,2D 100061E3 |. 74 30 JE SHORT jagmisc.10006215 100061E5 |. 80FB 30 CMP BL,30 100061E8 |.^ 0F84 68FFFFFF JE jagmisc.10006156 100061EE |> 80FB 43 CMP BL,43 100061F1 |. 0F8E 57010000 JLE jagmisc.1000634E 100061F7 |. 80FB 45 CMP BL,45 100061FA |. 7E 12 JLE SHORT jagmisc.1000620E 100061FC |. 80FB 63 CMP BL,63 100061FF |. 0F8E 49010000 JLE jagmisc.1000634E 10006205 |. 80FB 65 CMP BL,65 10006208 |. 0F8F 40010000 JG jagmisc.1000634E 1000620E |> 6A 06 PUSH 6 10006210 |. E9 B6010000 JMP jagmisc.100063CB 10006215 |> 4F DEC EDI 10006216 |. 6A 0B PUSH 0B 10006218 |. E9 AE010000 JMP jagmisc.100063CB 1000621D |> 80FB 31 CMP BL,31 ; Case 2 of switch 10006159 10006220 |. 7C 09 JL SHORT jagmisc.1000622B 10006222 |. 80FB 39 CMP BL,39 10006225 |.^ 0F8E 48FFFFFF JLE jagmisc.10006173 1000622B |> 3A1D 1CA30010 CMP BL,BYTE PTR DS:[1000A31C] 10006231 |.^ 0F84 4BFFFFFF JE jagmisc.10006182 10006237 |. 80FB 30 CMP BL,30 1000623A |. 0F85 60010000 JNZ jagmisc.100063A0 10006240 |> 33C0 XOR EAX,EAX ; Case 30 ('0') of switch 1000618C 10006242 |. 40 INC EAX 10006243 |.^ E9 0EFFFFFF JMP jagmisc.10006156 10006248 |> C745 BC 01000000 MOV [LOCAL.17],1 ; Case 3 of switch 10006159 1000624F |. EB 17 JMP SHORT jagmisc.10006268 10006251 |> 837D C8 19 /CMP [LOCAL.14],19 10006255 |. 73 0B |JNB SHORT jagmisc.10006262 10006257 |. FF45 C8 |INC [LOCAL.14] 1000625A |. 80EB 30 |SUB BL,30 1000625D |. 881E |MOV BYTE PTR DS:[ESI],BL 1000625F |. 46 |INC ESI 10006260 |. EB 03 |JMP SHORT jagmisc.10006265 10006262 |> FF45 C4 |INC [LOCAL.15] 10006265 |> 8A1F |MOV BL,BYTE PTR DS:[EDI] 10006267 |. 47 |INC EDI 10006268 |> 0FB6C3 MOVZX EAX,BL 1000626B |. 50 |PUSH EAX 1000626C |. E8 2CCDFFFF |CALL jagmisc.10002F9D 10006271 |. 85C0 |TEST EAX,EAX 10006273 |. 59 |POP ECX ; kernel32.7C816FD7 10006274 |.^ 75 DB \JNZ SHORT jagmisc.10006251 10006276 |. 3A1D 1CA30010 CMP BL,BYTE PTR DS:[1000A31C] 1000627C |. 75 46 JNZ SHORT jagmisc.100062C4 1000627E |.^ E9 51FFFFFF JMP jagmisc.100061D4 10006283 |> 33C0 XOR EAX,EAX ; Case 4 of switch 10006159 10006285 |. 40 INC EAX 10006286 |. 837D C8 00 CMP [LOCAL.14],0 1000628A |. 8945 BC MOV [LOCAL.17],EAX 1000628D |. 8945 A8 MOV [LOCAL.22],EAX 10006290 |. 75 24 JNZ SHORT jagmisc.100062B6 10006292 |. EB 06 JMP SHORT jagmisc.1000629A 10006294 |> FF4D C4 /DEC [LOCAL.15] 10006297 |. 8A1F |MOV BL,BYTE PTR DS:[EDI] 10006299 |. 47 |INC EDI 1000629A |> 80FB 30 CMP BL,30 1000629D |.^ 74 F5 \JE SHORT jagmisc.10006294 1000629F |. EB 15 JMP SHORT jagmisc.100062B6 100062A1 |> 837D C8 19 /CMP [LOCAL.14],19 100062A5 |. 73 0C |JNB SHORT jagmisc.100062B3 100062A7 |. FF45 C8 |INC [LOCAL.14] 100062AA |. 80EB 30 |SUB BL,30 100062AD |. 881E |MOV BYTE PTR DS:[ESI],BL 100062AF |. 46 |INC ESI 100062B0 |. FF4D C4 |DEC [LOCAL.15] 100062B3 |> 8A1F |MOV BL,BYTE PTR DS:[EDI] 100062B5 |. 47 |INC EDI 100062B6 |> 0FB6C3 MOVZX EAX,BL 100062B9 |. 50 |PUSH EAX 100062BA |. E8 DECCFFFF |CALL jagmisc.10002F9D 100062BF |. 85C0 |TEST EAX,EAX 100062C1 |. 59 |POP ECX ; kernel32.7C816FD7 100062C2 |.^ 75 DD \JNZ SHORT jagmisc.100062A1 100062C4 |> 80FB 2B CMP BL,2B 100062C7 |.^ 0F84 48FFFFFF JE jagmisc.10006215 100062CD |. 80FB 2D CMP BL,2D 100062D0 |.^ 0F84 3FFFFFFF JE jagmisc.10006215 100062D6 |.^ E9 13FFFFFF JMP jagmisc.100061EE 100062DB |> 0FB6C3 MOVZX EAX,BL ; Case 5 of switch 10006159 100062DE |. 50 PUSH EAX 100062DF |. C745 A8 01000000 MOV [LOCAL.22],1 100062E6 |. E8 B2CCFFFF CALL jagmisc.10002F9D 100062EB |. 85C0 TEST EAX,EAX 100062ED |. 59 POP ECX ; kernel32.7C816FD7 100062EE |. 0F84 AC000000 JE jagmisc.100063A0 100062F4 |. 6A 04 PUSH 4 100062F6 |. E9 99000000 JMP jagmisc.10006394 100062FB |> 80FB 31 CMP BL,31 ; Case 6 of switch 10006159 100062FE |. 8D4F FE LEA ECX,DWORD PTR DS:[EDI-2] 10006301 |. 894D C0 MOV [LOCAL.16],ECX 10006304 |. 7C 09 JL SHORT jagmisc.1000630F 10006306 |. 80FB 39 CMP BL,39 10006309 |. 0F8E 83000000 JLE jagmisc.10006392 1000630F |> 0FBEC3 MOVSX EAX,BL 10006312 |. 83E8 2B SUB EAX,2B ; Switch (cases 2B..30) 10006315 |. 0F84 AE000000 JE jagmisc.100063C9 1000631B |. 48 DEC EAX 1000631C |. 48 DEC EAX 1000631D |. 0F84 9A000000 JE jagmisc.100063BD 10006323 |. 83E8 03 SUB EAX,3 10006326 |. 0F85 B7000000 JNZ jagmisc.100063E3 1000632C |> 6A 08 PUSH 8 ; Case 30 ('0') of switch 10006312 1000632E |. E9 98000000 JMP jagmisc.100063CB 10006333 |> C745 A4 01000000 MOV [LOCAL.23],1 ; Case 8 of switch 10006159 1000633A |. EB 03 JMP SHORT jagmisc.1000633F 1000633C |> 8A1F /MOV BL,BYTE PTR DS:[EDI] 1000633E |. 47 |INC EDI 1000633F |> 80FB 30 CMP BL,30 10006342 |.^ 74 F8 \JE SHORT jagmisc.1000633C 10006344 |. 80FB 31 CMP BL,31 10006347 |. 7C 05 JL SHORT jagmisc.1000634E 10006349 |. 80FB 39 CMP BL,39 1000634C |. 7E 44 JLE SHORT jagmisc.10006392 1000634E |> 4F DEC EDI 1000634F |> 8975 CC MOV [LOCAL.13],ESI 10006352 |> 837D BC 00 CMP [LOCAL.17],0 10006356 |. 8B45 0C MOV EAX,[ARG.2] 10006359 |. 8938 MOV DWORD PTR DS:[EAX],EDI 1000635B |. 0F84 50010000 JE jagmisc.100064B1 10006361 |. 6A 18 PUSH 18 10006363 |. 58 POP EAX ; kernel32.7C816FD7 10006364 |. 3945 C8 CMP [LOCAL.14],EAX 10006367 |. 76 10 JBE SHORT jagmisc.10006379 10006369 |. 807D E7 05 CMP BYTE PTR SS:[EBP-19],5 1000636D |. 7C 03 JL SHORT jagmisc.10006372 1000636F |. FE45 E7 INC BYTE PTR SS:[EBP-19] 10006372 |> 4E DEC ESI 10006373 |. FF45 C4 INC [LOCAL.15] 10006376 |. 8945 C8 MOV [LOCAL.14],EAX 10006379 |> 837D C8 00 CMP [LOCAL.14],0 1000637D |. 0F86 55010000 JBE jagmisc.100064D8 10006383 |. E9 C5000000 JMP jagmisc.1000644D 10006388 |> 80FB 31 CMP BL,31 ; Case 7 of switch 10006159 1000638B |. 7C 0E JL SHORT jagmisc.1000639B 1000638D |. 80FB 39 CMP BL,39 10006390 |. 7F 09 JG SHORT jagmisc.1000639B 10006392 |> 6A 09 PUSH 9 10006394 |> 58 POP EAX ; kernel32.7C816FD7 10006395 |. 4F DEC EDI 10006396 |.^ E9 BBFDFFFF JMP jagmisc.10006156 1000639B |> 80FB 30 CMP BL,30 1000639E |.^ 74 8C JE SHORT jagmisc.1000632C 100063A0 |> 8B7D C0 MOV EDI,[LOCAL.16] 100063A3 |.^ EB AA JMP SHORT jagmisc.1000634F 100063A5 |> 837D 20 00 CMP [ARG.7],0 ; Case B of switch 10006159 100063A9 |. 74 26 JE SHORT jagmisc.100063D1 100063AB |. 0FBEC3 MOVSX EAX,BL 100063AE |. 83E8 2B SUB EAX,2B ; Switch (cases 2B..2D) 100063B1 |. 8D4F FF LEA ECX,DWORD PTR DS:[EDI-1] 100063B4 |. 894D C0 MOV [LOCAL.16],ECX 100063B7 |. 74 10 JE SHORT jagmisc.100063C9 100063B9 |. 48 DEC EAX 100063BA |. 48 DEC EAX 100063BB |. 75 26 JNZ SHORT jagmisc.100063E3 100063BD |> 834D B4 FF OR [LOCAL.19],FFFFFFFF ; Case 2D ('-') of switch 100063AE 100063C1 |. 6A 07 PUSH 7 100063C3 |. 58 POP EAX ; kernel32.7C816FD7 100063C4 |.^ E9 8DFDFFFF JMP jagmisc.10006156 100063C9 |> 6A 07 PUSH 7 ; Case 2B ('+') of switch 100063AE 100063CB |> 58 POP EAX ; kernel32.7C816FD7 100063CC |.^ E9 85FDFFFF JMP jagmisc.10006156 100063D1 |> 6A 0A PUSH 0A 100063D3 |. 58 POP EAX ; kernel32.7C816FD7 100063D4 |. 4F DEC EDI 100063D5 |> 83F8 0A CMP EAX,0A ; Default case of switch 10006159 100063D8 |.^ 0F85 78FDFFFF JNZ jagmisc.10006156 100063DE |.^ E9 6CFFFFFF JMP jagmisc.1000634F 100063E3 |> 8975 CC MOV [LOCAL.13],ESI ; Default case of switch 100063AE 100063E6 |. 8BF9 MOV EDI,ECX 100063E8 |.^ E9 65FFFFFF JMP jagmisc.10006352 100063ED |> 8975 CC MOV [LOCAL.13],ESI ; Case 9 of switch 10006159 100063F0 |. C745 A4 01000000 MOV [LOCAL.23],1 100063F7 |. 33F6 XOR ESI,ESI 100063F9 |. EB 15 JMP SHORT jagmisc.10006410 100063FB |> 0FBECB /MOVSX ECX,BL 100063FE |. 8D04B6 |LEA EAX,DWORD PTR DS:[ESI+ESI*4] 10006401 |. 8D7441 D0 |LEA ESI,DWORD PTR DS:[ECX+EAX*2-30] 10006405 |. 81FE 50140000 |CMP ESI,1450 1000640B |. 7F 13 |JG SHORT jagmisc.10006420 1000640D |. 8A1F |MOV BL,BYTE PTR DS:[EDI] 1000640F |. 47 |INC EDI 10006410 |> 0FB6C3 MOVZX EAX,BL 10006413 |. 50 |PUSH EAX 10006414 |. E8 84CBFFFF |CALL jagmisc.10002F9D 10006419 |. 85C0 |TEST EAX,EAX 1000641B |. 59 |POP ECX ; kernel32.7C816FD7 1000641C |.^ 75 DD \JNZ SHORT jagmisc.100063FB 1000641E |. EB 05 JMP SHORT jagmisc.10006425 10006420 |> BE 51140000 MOV ESI,1451 10006425 |> 8975 AC MOV [LOCAL.21],ESI 10006428 |. 0FB6C3 MOVZX EAX,BL 1000642B |. EB 06 JMP SHORT jagmisc.10006433 1000642D |> 8A07 /MOV AL,BYTE PTR DS:[EDI] 1000642F |. 47 |INC EDI 10006430 |. 0FB6C0 |MOVZX EAX,AL 10006433 |> 50 PUSH EAX 10006434 |. E8 64CBFFFF |CALL jagmisc.10002F9D 10006439 |. 85C0 |TEST EAX,EAX 1000643B |. 59 |POP ECX ; kernel32.7C816FD7 1000643C |.^ 75 EF \JNZ SHORT jagmisc.1000642D 1000643E |. 8B75 CC MOV ESI,[LOCAL.13] 10006441 |. 4F DEC EDI 10006442 |.^ E9 0BFFFFFF JMP jagmisc.10006352 10006447 |> FF4D C8 /DEC [LOCAL.14] 1000644A |. FF45 C4 |INC [LOCAL.15] 1000644D |> 4E DEC ESI 1000644E |. 803E 00 |CMP BYTE PTR DS:[ESI],0 10006451 |.^ 74 F4 \JE SHORT jagmisc.10006447 10006453 |. 8D45 EC LEA EAX,[LOCAL.5] 10006456 |. 50 PUSH EAX 10006457 |. FF75 C8 PUSH [LOCAL.14] 1000645A |. 8D45 D0 LEA EAX,[LOCAL.12] 1000645D |. 50 PUSH EAX 1000645E |. E8 BEFBFFFF CALL jagmisc.10006021 10006463 |. 8B45 AC MOV EAX,[LOCAL.21] 10006466 |. 33C9 XOR ECX,ECX 10006468 |. 83C4 0C ADD ESP,0C 1000646B |. 394D B4 CMP [LOCAL.19],ECX 1000646E |. 7D 02 JGE SHORT jagmisc.10006472 10006470 |. F7D8 NEG EAX 10006472 |> 0345 C4 ADD EAX,[LOCAL.15] 10006475 |. 394D A4 CMP [LOCAL.23],ECX 10006478 |. 75 03 JNZ SHORT jagmisc.1000647D 1000647A |. 0345 18 ADD EAX,[ARG.5] 1000647D |> 394D A8 CMP [LOCAL.22],ECX 10006480 |. 75 03 JNZ SHORT jagmisc.10006485 10006482 |. 2B45 1C SUB EAX,[ARG.6] 10006485 |> 3D 50140000 CMP EAX,1450 1000648A |. 7F 2E JG SHORT jagmisc.100064BA 1000648C |. 3D B0EBFFFF CMP EAX,-1450 10006491 |. 7C 3E JL SHORT jagmisc.100064D1 10006493 |. FF75 14 PUSH [ARG.4] 10006496 |. 50 PUSH EAX 10006497 |. 8D45 EC LEA EAX,[LOCAL.5] 1000649A |. 50 PUSH EAX 1000649B |. E8 C4120000 CALL jagmisc.10007764 100064A0 |. 8B55 EC MOV EDX,[LOCAL.5] 100064A3 |. 8B5D EE MOV EBX,DWORD PTR SS:[EBP-12] 100064A6 |. 8B75 F2 MOV ESI,DWORD PTR SS:[EBP-E] 100064A9 |. 8B45 F6 MOV EAX,DWORD PTR SS:[EBP-A] 100064AC |. 83C4 0C ADD ESP,0C 100064AF |. EB 2F JMP SHORT jagmisc.100064E0 100064B1 |> C745 B8 04000000 MOV [LOCAL.18],4 100064B8 |. EB 1E JMP SHORT jagmisc.100064D8 100064BA |> 33DB XOR EBX,EBX 100064BC |. B8 FF7F0000 MOV EAX,7FFF 100064C1 |. BE 00000080 MOV ESI,80000000 100064C6 |. 33D2 XOR EDX,EDX 100064C8 |. C745 B8 02000000 MOV [LOCAL.18],2 100064CF |. EB 0F JMP SHORT jagmisc.100064E0 100064D1 |> C745 B8 01000000 MOV [LOCAL.18],1 100064D8 |> 33D2 XOR EDX,EDX 100064DA |. 33C0 XOR EAX,EAX 100064DC |. 33F6 XOR ESI,ESI 100064DE |. 33DB XOR EBX,EBX 100064E0 |> 8B4D 08 MOV ECX,[ARG.1] 100064E3 |. 0B45 B0 OR EAX,[LOCAL.20] 100064E6 |. 5F POP EDI ; kernel32.7C816FD7 100064E7 |. 8971 06 MOV DWORD PTR DS:[ECX+6],ESI 100064EA |. 8959 02 MOV DWORD PTR DS:[ECX+2],EBX 100064ED |. 66:8941 0A MOV WORD PTR DS:[ECX+A],AX 100064F1 |. 8B45 B8 MOV EAX,[LOCAL.18] 100064F4 |. 66:8911 MOV WORD PTR DS:[ECX],DX 100064F7 |. 8B4D FC MOV ECX,[LOCAL.1] 100064FA |. 5E POP ESI ; kernel32.7C816FD7 100064FB |. 5B POP EBX ; kernel32.7C816FD7 100064FC |. E8 F5D5FFFF CALL jagmisc.10003AF6 10006501 |. C9 LEAVE 10006502 \. C3 RETN 10006503 . 69610010 DD jagmisc.10006169 ; Switch table used at 10006162 10006507 . BC610010 DD jagmisc.100061BC 1000650B . 1D620010 DD jagmisc.1000621D 1000650F . 48620010 DD jagmisc.10006248 10006513 . 83620010 DD jagmisc.10006283 10006517 . DB620010 DD jagmisc.100062DB 1000651B . FB620010 DD jagmisc.100062FB 1000651F . 88630010 DD jagmisc.10006388 10006523 . 33630010 DD jagmisc.10006333 10006527 . ED630010 DD jagmisc.100063ED 1000652B . D5630010 DD jagmisc.100063D5 1000652F . A5630010 DD jagmisc.100063A5 10006533 /$ 55 PUSH EBP 10006534 |. 8BEC MOV EBP,ESP 10006536 |. 83EC 30 SUB ESP,30 10006539 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 1000653E |. 8945 FC MOV [LOCAL.1],EAX 10006541 |. 8B45 10 MOV EAX,[ARG.3] 10006544 |. 53 PUSH EBX 10006545 |. 8B5D 1C MOV EBX,[ARG.6] 10006548 |. 56 PUSH ESI 10006549 |. 8BC8 MOV ECX,EAX 1000654B |. BE FF7F0000 MOV ESI,7FFF 10006550 |. 81E1 00800000 AND ECX,8000 10006556 |. 23C6 AND EAX,ESI 10006558 |. 66:85C9 TEST CX,CX 1000655B |. 57 PUSH EDI 1000655C |. C645 E4 CC MOV BYTE PTR SS:[EBP-1C],0CC 10006560 |. C645 E5 CC MOV BYTE PTR SS:[EBP-1B],0CC 10006564 |. C645 E6 CC MOV BYTE PTR SS:[EBP-1A],0CC 10006568 |. C645 E7 CC MOV BYTE PTR SS:[EBP-19],0CC 1000656C |. C645 E8 CC MOV BYTE PTR SS:[EBP-18],0CC 10006570 |. C645 E9 CC MOV BYTE PTR SS:[EBP-17],0CC 10006574 |. C645 EA CC MOV BYTE PTR SS:[EBP-16],0CC 10006578 |. C645 EB CC MOV BYTE PTR SS:[EBP-15],0CC 1000657C |. C645 EC CC MOV BYTE PTR SS:[EBP-14],0CC 10006580 |. C645 ED CC MOV BYTE PTR SS:[EBP-13],0CC 10006584 |. C645 EE FB MOV BYTE PTR SS:[EBP-12],0FB 10006588 |. C645 EF 3F MOV BYTE PTR SS:[EBP-11],3F 1000658C |. C745 D4 01000000 MOV [LOCAL.11],1 10006593 |. 8BD0 MOV EDX,EAX 10006595 |. 74 06 JE SHORT jagmisc.1000659D 10006597 |. C643 02 2D MOV BYTE PTR DS:[EBX+2],2D 1000659B |. EB 04 JMP SHORT jagmisc.100065A1 1000659D |> C643 02 20 MOV BYTE PTR DS:[EBX+2],20 100065A1 |> 66:85D2 TEST DX,DX 100065A4 |. 8B7D 0C MOV EDI,[ARG.2] 100065A7 |. 75 0D JNZ SHORT jagmisc.100065B6 100065A9 |. 85FF TEST EDI,EDI 100065AB |. 75 09 JNZ SHORT jagmisc.100065B6 100065AD |. 397D 08 CMP [ARG.1],EDI 100065B0 |. 0F84 F3000000 JE jagmisc.100066A9 100065B6 |> 66:3BD6 CMP DX,SI 100065B9 |. 75 78 JNZ SHORT jagmisc.10006633 100065BB |. B8 00000080 MOV EAX,80000000 100065C0 |. 3BF8 CMP EDI,EAX 100065C2 |. 66:C703 0100 MOV WORD PTR DS:[EBX],1 100065C7 |. 75 06 JNZ SHORT jagmisc.100065CF 100065C9 |. 837D 08 00 CMP [ARG.1],0 100065CD |. 74 0F JE SHORT jagmisc.100065DE 100065CF |> F7C7 00000040 TEST EDI,40000000 100065D5 |. 75 07 JNZ SHORT jagmisc.100065DE 100065D7 |. 68 44890010 PUSH jagmisc.10008944 ; ASCII "1#SNAN" 100065DC |. EB 46 JMP SHORT jagmisc.10006624 100065DE |> 66:85C9 TEST CX,CX 100065E1 |. 74 15 JE SHORT jagmisc.100065F8 100065E3 |. 81FF 000000C0 CMP EDI,C0000000 100065E9 |. 75 0D JNZ SHORT jagmisc.100065F8 100065EB |. 837D 08 00 CMP [ARG.1],0 100065EF |. 75 2E JNZ SHORT jagmisc.1000661F 100065F1 |. 68 3C890010 PUSH jagmisc.1000893C ; ASCII "1#IND" 100065F6 |. EB 0F JMP SHORT jagmisc.10006607 100065F8 |> 3BF8 CMP EDI,EAX 100065FA |. 75 23 JNZ SHORT jagmisc.1000661F 100065FC |. 837D 08 00 CMP [ARG.1],0 10006600 |. 75 1D JNZ SHORT jagmisc.1000661F 10006602 |. 68 34890010 PUSH jagmisc.10008934 ; ASCII "1#INF" 10006607 |> 8D43 04 LEA EAX,DWORD PTR DS:[EBX+4] 1000660A |. 50 PUSH EAX 1000660B |. E8 20D2FFFF CALL jagmisc.10003830 10006610 |. C643 03 05 MOV BYTE PTR DS:[EBX+3],5 10006614 |> 8365 D4 00 AND [LOCAL.11],0 10006618 |. 59 POP ECX ; kernel32.7C816FD7 10006619 |. 59 POP ECX ; kernel32.7C816FD7 1000661A |. E9 6C010000 JMP jagmisc.1000678B 1000661F |> 68 2C890010 PUSH jagmisc.1000892C ; ASCII "1#QNAN" 10006624 |> 8D43 04 LEA EAX,DWORD PTR DS:[EBX+4] 10006627 |. 50 PUSH EAX 10006628 |. E8 03D2FFFF CALL jagmisc.10003830 1000662D |. C643 03 06 MOV BYTE PTR DS:[EBX+3],6 10006631 |.^ EB E1 JMP SHORT jagmisc.10006614 10006633 |> 0FB7C2 MOVZX EAX,DX 10006636 |. 8BF0 MOV ESI,EAX 10006638 |. 69C0 104D0000 IMUL EAX,EAX,4D10 1000663E |. 66:8365 F0 00 AND WORD PTR SS:[EBP-10],0 10006643 |. 8BCF MOV ECX,EDI 10006645 |. C1E9 18 SHR ECX,18 10006648 |. C1EE 08 SHR ESI,8 1000664B |. 8D0C4E LEA ECX,DWORD PTR DS:[ESI+ECX*2] 1000664E |. 6BC9 4D IMUL ECX,ECX,4D 10006651 |. 8DB401 0CEDBCEC LEA ESI,DWORD PTR DS:[ECX+EAX+ECBCED0C] 10006658 |. 8B45 08 MOV EAX,[ARG.1] 1000665B |. 8945 F2 MOV DWORD PTR SS:[EBP-E],EAX 1000665E |. C1FE 10 SAR ESI,10 10006661 |. 0FBFC6 MOVSX EAX,SI 10006664 |. F7D8 NEG EAX 10006666 |. 6A 01 PUSH 1 10006668 |. 50 PUSH EAX 10006669 |. 8D45 F0 LEA EAX,[LOCAL.4] 1000666C |. 50 PUSH EAX 1000666D |. 66:8955 FA MOV WORD PTR SS:[EBP-6],DX 10006671 |. 897D F6 MOV DWORD PTR SS:[EBP-A],EDI 10006674 |. E8 EB100000 CALL jagmisc.10007764 10006679 |. 83C4 0C ADD ESP,0C 1000667C |. 66:817D FA FF3F CMP WORD PTR SS:[EBP-6],3FFF 10006682 |. 72 10 JB SHORT jagmisc.10006694 10006684 |. 8D45 E4 LEA EAX,[LOCAL.7] 10006687 |. 50 PUSH EAX 10006688 |. 8D45 F0 LEA EAX,[LOCAL.4] 1000668B |. 50 PUSH EAX 1000668C |. 46 INC ESI 1000668D |. E8 A00E0000 CALL jagmisc.10007532 10006692 |. 59 POP ECX ; kernel32.7C816FD7 10006693 |. 59 POP ECX ; kernel32.7C816FD7 10006694 |> F645 18 01 TEST BYTE PTR SS:[EBP+18],1 10006698 |. 8B7D 14 MOV EDI,[ARG.4] 1000669B |. 66:8933 MOV WORD PTR DS:[EBX],SI 1000669E |. 74 12 JE SHORT jagmisc.100066B2 100066A0 |. 0FBFC6 MOVSX EAX,SI 100066A3 |. 03F8 ADD EDI,EAX 100066A5 |. 85FF TEST EDI,EDI 100066A7 |. 7F 09 JG SHORT jagmisc.100066B2 100066A9 |> C643 04 30 MOV BYTE PTR DS:[EBX+4],30 100066AD |. E9 FA000000 JMP jagmisc.100067AC 100066B2 |> 83FF 15 CMP EDI,15 100066B5 |. 7E 03 JLE SHORT jagmisc.100066BA 100066B7 |. 6A 15 PUSH 15 100066B9 |. 5F POP EDI ; kernel32.7C816FD7 100066BA |> 0FB775 FA MOVZX ESI,WORD PTR SS:[EBP-6] 100066BE |. 81EE FE3F0000 SUB ESI,3FFE 100066C4 |. 66:8365 FA 00 AND WORD PTR SS:[EBP-6],0 100066C9 |. C745 10 08000000 MOV [ARG.3],8 100066D0 |> 8D45 F0 /LEA EAX,[LOCAL.4] 100066D3 |. 50 |PUSH EAX 100066D4 |. E8 EDF8FFFF |CALL jagmisc.10005FC6 100066D9 |. FF4D 10 |DEC [ARG.3] 100066DC |. 59 |POP ECX ; kernel32.7C816FD7 100066DD |.^ 75 F1 \JNZ SHORT jagmisc.100066D0 100066DF |. 85F6 TEST ESI,ESI 100066E1 |. 7D 17 JGE SHORT jagmisc.100066FA 100066E3 |. F7DE NEG ESI 100066E5 |. 81E6 FF000000 AND ESI,0FF 100066EB |. 7E 0D JLE SHORT jagmisc.100066FA 100066ED |> 8D45 F0 /LEA EAX,[LOCAL.4] 100066F0 |. 50 |PUSH EAX 100066F1 |. E8 FEF8FFFF |CALL jagmisc.10005FF4 100066F6 |. 4E |DEC ESI 100066F7 |. 59 |POP ECX ; kernel32.7C816FD7 100066F8 |.^ 75 F3 \JNZ SHORT jagmisc.100066ED 100066FA |> 8D4F 01 LEA ECX,DWORD PTR DS:[EDI+1] 100066FD |. 85C9 TEST ECX,ECX 100066FF |. 8D43 04 LEA EAX,DWORD PTR DS:[EBX+4] 10006702 |. 8945 D0 MOV [LOCAL.12],EAX 10006705 |. 7E 50 JLE SHORT jagmisc.10006757 10006707 |. 894D 10 MOV [ARG.3],ECX 1000670A |> 8D75 F0 /LEA ESI,[LOCAL.4] 1000670D |. 8D7D D8 |LEA EDI,[LOCAL.10] 10006710 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10006711 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10006712 |. 8D45 F0 |LEA EAX,[LOCAL.4] 10006715 |. 50 |PUSH EAX 10006716 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10006717 |. E8 AAF8FFFF |CALL jagmisc.10005FC6 1000671C |. 8D45 F0 |LEA EAX,[LOCAL.4] 1000671F |. 50 |PUSH EAX 10006720 |. E8 A1F8FFFF |CALL jagmisc.10005FC6 10006725 |. 8D45 D8 |LEA EAX,[LOCAL.10] 10006728 |. 50 |PUSH EAX 10006729 |. 8D45 F0 |LEA EAX,[LOCAL.4] 1000672C |. 50 |PUSH EAX 1000672D |. E8 36F8FFFF |CALL jagmisc.10005F68 10006732 |. 8D45 F0 |LEA EAX,[LOCAL.4] 10006735 |. 50 |PUSH EAX 10006736 |. E8 8BF8FFFF |CALL jagmisc.10005FC6 1000673B |. 8A45 FB |MOV AL,BYTE PTR SS:[EBP-5] 1000673E |. 8B4D D0 |MOV ECX,[LOCAL.12] ; ntdll.7C90EA53 10006741 |. 04 30 |ADD AL,30 10006743 |. 83C4 14 |ADD ESP,14 10006746 |. FF45 D0 |INC [LOCAL.12] ; ntdll.7C90EA53 10006749 |. FF4D 10 |DEC [ARG.3] 1000674C |. 8801 |MOV BYTE PTR DS:[ECX],AL 1000674E |. C645 FB 00 |MOV BYTE PTR SS:[EBP-5],0 10006752 |.^ 75 B6 \JNZ SHORT jagmisc.1000670A 10006754 |. 8B45 D0 MOV EAX,[LOCAL.12] ; ntdll.7C90EA53 10006757 |> 48 DEC EAX 10006758 |. 8A08 MOV CL,BYTE PTR DS:[EAX] 1000675A |. 48 DEC EAX 1000675B |. 80F9 35 CMP CL,35 1000675E |. 8D4B 04 LEA ECX,DWORD PTR DS:[EBX+4] 10006761 |. 7C 3E JL SHORT jagmisc.100067A1 10006763 |. EB 09 JMP SHORT jagmisc.1000676E 10006765 |> 8038 39 /CMP BYTE PTR DS:[EAX],39 10006768 |. 75 08 |JNZ SHORT jagmisc.10006772 1000676A |. C600 30 |MOV BYTE PTR DS:[EAX],30 1000676D |. 48 |DEC EAX 1000676E |> 3BC1 CMP EAX,ECX 10006770 |.^ 73 F3 \JNB SHORT jagmisc.10006765 10006772 |> 3BC1 CMP EAX,ECX 10006774 |. 73 04 JNB SHORT jagmisc.1000677A 10006776 |. 40 INC EAX 10006777 |. 66:FF03 INC WORD PTR DS:[EBX] 1000677A |> FE00 INC BYTE PTR DS:[EAX] 1000677C |> 2AC3 SUB AL,BL 1000677E |. 2C 03 SUB AL,3 10006780 |. 8843 03 MOV BYTE PTR DS:[EBX+3],AL 10006783 |. 0FBEC0 MOVSX EAX,AL 10006786 |. C64418 04 00 MOV BYTE PTR DS:[EAX+EBX+4],0 1000678B |> 8B45 D4 MOV EAX,[LOCAL.11] 1000678E |> 8B4D FC MOV ECX,[LOCAL.1] 10006791 |. 5F POP EDI ; kernel32.7C816FD7 10006792 |. 5E POP ESI ; kernel32.7C816FD7 10006793 |. 5B POP EBX ; kernel32.7C816FD7 10006794 |. E8 5DD3FFFF CALL jagmisc.10003AF6 10006799 |. C9 LEAVE 1000679A |. C3 RETN 1000679B |> 8038 30 /CMP BYTE PTR DS:[EAX],30 1000679E |. 75 05 |JNZ SHORT jagmisc.100067A5 100067A0 |. 48 |DEC EAX 100067A1 |> 3BC1 CMP EAX,ECX 100067A3 |.^ 73 F6 \JNB SHORT jagmisc.1000679B 100067A5 |> 3BC1 CMP EAX,ECX 100067A7 |.^ 73 D3 JNB SHORT jagmisc.1000677C 100067A9 |. C601 30 MOV BYTE PTR DS:[ECX],30 100067AC |> 66:8323 00 AND WORD PTR DS:[EBX],0 100067B0 |. 33C0 XOR EAX,EAX 100067B2 |. C643 02 20 MOV BYTE PTR DS:[EBX+2],20 100067B6 |. C643 03 01 MOV BYTE PTR DS:[EBX+3],1 100067BA |. C643 05 00 MOV BYTE PTR DS:[EBX+5],0 100067BE |. 40 INC EAX 100067BF \.^ EB CD JMP SHORT jagmisc.1000678E 100067C1 /. 55 PUSH EBP 100067C2 |. 8BEC MOV EBP,ESP 100067C4 |. 83EC 10 SUB ESP,10 100067C7 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 100067CC |. 85C0 TEST EAX,EAX 100067CE |. 74 07 JE SHORT jagmisc.100067D7 100067D0 |. 3D 4EE640BB CMP EAX,BB40E64E 100067D5 |. 75 4E JNZ SHORT jagmisc.10006825 100067D7 |> 56 PUSH ESI 100067D8 |. 8D45 F8 LEA EAX,[LOCAL.2] 100067DB |. 50 PUSH EAX ; /pFileTime = 00000008 100067DC |. FF15 F4800010 CALL DWORD PTR DS:[<&KERNEL32.GetSystemTimeAsFileTime>] ; \GetSystemTimeAsFileTime 100067E2 |. 8B75 FC MOV ESI,[LOCAL.1] 100067E5 |. 3375 F8 XOR ESI,[LOCAL.2] ; LOADDLL.00410249 100067E8 |. FF15 F0800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentProcessId>] ; [GetCurrentProcessId 100067EE |. 33F0 XOR ESI,EAX 100067F0 |. FF15 44800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentThreadId>] ; [GetCurrentThreadId 100067F6 |. 33F0 XOR ESI,EAX 100067F8 |. FF15 EC800010 CALL DWORD PTR DS:[<&KERNEL32.GetTickCount>] ; [GetTickCount 100067FE |. 33F0 XOR ESI,EAX 10006800 |. 8D45 F0 LEA EAX,[LOCAL.4] 10006803 |. 50 PUSH EAX ; /pPerformanceCount = 00000008 10006804 |. FF15 00800010 CALL DWORD PTR DS:[<&KERNEL32.QueryPerformanceCounter>] ; \QueryPerformanceCounter 1000680A |. 8B45 F4 MOV EAX,[LOCAL.3] 1000680D |. 3345 F0 XOR EAX,[LOCAL.4] 10006810 |. 33F0 XOR ESI,EAX 10006812 |. 8935 60A30010 MOV DWORD PTR DS:[1000A360],ESI 10006818 |. 75 0A JNZ SHORT jagmisc.10006824 1000681A |. C705 60A30010 4EE>MOV DWORD PTR DS:[1000A360],BB40E64E 10006824 |> 5E POP ESI ; kernel32.7C816FD7 10006825 |> C9 LEAVE 10006826 \. C3 RETN 10006827 $ 68 18010000 PUSH 118 1000682C . 68 F08A0010 PUSH jagmisc.10008AF0 10006831 . E8 3ABBFFFF CALL jagmisc.10002370 10006836 . A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 1000683B . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 1000683E . A1 B0AF0010 MOV EAX,DWORD PTR DS:[1000AFB0] 10006843 . 33C9 XOR ECX,ECX 10006845 . 3BC1 CMP EAX,ECX 10006847 . 74 1F JE SHORT jagmisc.10006868 10006849 . 894D FC MOV DWORD PTR SS:[EBP-4],ECX 1000684C . FF75 0C PUSH DWORD PTR SS:[EBP+C] 1000684F . FF75 08 PUSH DWORD PTR SS:[EBP+8] 10006852 . FFD0 CALL EAX 10006854 . 59 POP ECX ; kernel32.7C816FD7 10006855 . 59 POP ECX ; kernel32.7C816FD7 10006856 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 1000685A . E9 08010000 JMP jagmisc.10006967 1000685F . 33C0 XOR EAX,EAX 10006861 . 40 INC EAX 10006862 . C3 RETN 10006863 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451 10006866 .^ EB EE JMP SHORT jagmisc.10006856 10006868 > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 1000686B . 48 DEC EAX 1000686C . 74 16 JE SHORT jagmisc.10006884 1000686E . BF CC8A0010 MOV EDI,jagmisc.10008ACC ; ASCII "Unknown security failure detected!" 10006873 . C785 D8FEFFFF 188>MOV DWORD PTR SS:[EBP-128],jagmisc.10008A18 ; ASCII "A security error of unknown cause has been detected which has\ncorrupted the program's internal state. The program cannot safely\ncontinue execution and must now be terminated.\n" 1000687D . BE D4000000 MOV ESI,0D4 10006882 . EB 14 JMP SHORT jagmisc.10006898 10006884 > BF F8890010 MOV EDI,jagmisc.100089F8 ; ASCII "Buffer overrun detected!" 10006889 . C785 D8FEFFFF 588>MOV DWORD PTR SS:[EBP-128],jagmisc.10008958 ; ASCII "A buffer overrun has been detected which has corrupted the program's\ninternal state. The program cannot safely continue execution and must\nnow be terminated.\n" 10006893 . BE B9000000 MOV ESI,0B9 10006898 > 884D E0 MOV BYTE PTR SS:[EBP-20],CL 1000689B . 68 04010000 PUSH 104 ; /BufSize = 104 (260.) 100068A0 . 8D85 DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-124] ; | 100068A6 . 50 PUSH EAX ; |PathBuffer = 00000008 100068A7 . 51 PUSH ECX ; |hModule = FFFFFFFF 100068A8 . FF15 94800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleFileNameA>] ; \GetModuleFileNameA 100068AE . 85C0 TEST EAX,EAX 100068B0 . 75 13 JNZ SHORT jagmisc.100068C5 100068B2 . 68 64860010 PUSH jagmisc.10008664 ; ASCII "" 100068B7 . 8D85 DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-124] 100068BD . 50 PUSH EAX 100068BE . E8 6DCFFFFF CALL jagmisc.10003830 100068C3 . 59 POP ECX ; kernel32.7C816FD7 100068C4 . 59 POP ECX ; kernel32.7C816FD7 100068C5 > 8D9D DCFEFFFF LEA EBX,DWORD PTR SS:[EBP-124] 100068CB . 8BC3 MOV EAX,EBX 100068CD . 50 PUSH EAX 100068CE . E8 CDCEFFFF CALL jagmisc.100037A0 100068D3 . 59 POP ECX ; kernel32.7C816FD7 100068D4 . 83C0 0B ADD EAX,0B 100068D7 . 83F8 3C CMP EAX,3C 100068DA . 76 25 JBE SHORT jagmisc.10006901 100068DC . 8BC3 MOV EAX,EBX 100068DE . 50 PUSH EAX 100068DF . E8 BCCEFFFF CALL jagmisc.100037A0 100068E4 . 8BD8 MOV EBX,EAX 100068E6 . 8D85 DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-124] 100068EC . 83E8 31 SUB EAX,31 100068EF . 03D8 ADD EBX,EAX 100068F1 . 6A 03 PUSH 3 100068F3 . 68 60860010 PUSH jagmisc.10008660 ; ASCII "..." 100068F8 . 53 PUSH EBX 100068F9 . E8 F2F0FFFF CALL jagmisc.100059F0 100068FE . 83C4 10 ADD ESP,10 10006901 > 53 PUSH EBX 10006902 . E8 99CEFFFF CALL jagmisc.100037A0 10006907 . 59 POP ECX ; kernel32.7C816FD7 10006908 . 8D4430 0C LEA EAX,DWORD PTR DS:[EAX+ESI+C] 1000690C . 83C0 03 ADD EAX,3 1000690F . 83E0 FC AND EAX,FFFFFFFC 10006912 . E8 99C4FFFF CALL jagmisc.10002DB0 10006917 . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP 1000691A . 8BF4 MOV ESI,ESP 1000691C . 57 PUSH EDI 1000691D . 56 PUSH ESI 1000691E . E8 0DCFFFFF CALL jagmisc.10003830 10006923 . BF 40860010 MOV EDI,jagmisc.10008640 ; ASCII "\n\n" 10006928 . 57 PUSH EDI 10006929 . 56 PUSH ESI 1000692A . E8 11CFFFFF CALL jagmisc.10003840 1000692F . 68 4C890010 PUSH jagmisc.1000894C ; ASCII "Program: " 10006934 . 56 PUSH ESI 10006935 . E8 06CFFFFF CALL jagmisc.10003840 1000693A . 53 PUSH EBX 1000693B . 56 PUSH ESI 1000693C . E8 FFCEFFFF CALL jagmisc.10003840 10006941 . 57 PUSH EDI 10006942 . 56 PUSH ESI 10006943 . E8 F8CEFFFF CALL jagmisc.10003840 10006948 . FFB5 D8FEFFFF PUSH DWORD PTR SS:[EBP-128] ; msctfime.UIWndProc 1000694E . 56 PUSH ESI 1000694F . E8 ECCEFFFF CALL jagmisc.10003840 10006954 . 68 10200100 PUSH 12010 10006959 . 68 18860010 PUSH jagmisc.10008618 ; ASCII "Microsoft Visual C++ Runtime Library" 1000695E . 56 PUSH ESI 1000695F . E8 89EFFFFF CALL jagmisc.100058ED 10006964 . 83C4 3C ADD ESP,3C 10006967 > 6A 03 PUSH 3 10006969 . E8 F0B7FFFF CALL jagmisc.1000215E 1000696E . CC INT3 1000696F /$ 56 PUSH ESI 10006970 |. 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 10006974 |. 85F6 TEST ESI,ESI 10006976 |. 0F84 81010000 JE jagmisc.10006AFD 1000697C |. FF76 04 PUSH DWORD PTR DS:[ESI+4] 1000697F |. E8 79B9FFFF CALL jagmisc.100022FD 10006984 |. FF76 08 PUSH DWORD PTR DS:[ESI+8] 10006987 |. E8 71B9FFFF CALL jagmisc.100022FD 1000698C |. FF76 0C PUSH DWORD PTR DS:[ESI+C] 1000698F |. E8 69B9FFFF CALL jagmisc.100022FD 10006994 |. FF76 10 PUSH DWORD PTR DS:[ESI+10] 10006997 |. E8 61B9FFFF CALL jagmisc.100022FD 1000699C |. FF76 14 PUSH DWORD PTR DS:[ESI+14] 1000699F |. E8 59B9FFFF CALL jagmisc.100022FD 100069A4 |. FF76 18 PUSH DWORD PTR DS:[ESI+18] 100069A7 |. E8 51B9FFFF CALL jagmisc.100022FD 100069AC |. FF36 PUSH DWORD PTR DS:[ESI] 100069AE |. E8 4AB9FFFF CALL jagmisc.100022FD 100069B3 |. FF76 20 PUSH DWORD PTR DS:[ESI+20] 100069B6 |. E8 42B9FFFF CALL jagmisc.100022FD 100069BB |. FF76 24 PUSH DWORD PTR DS:[ESI+24] 100069BE |. E8 3AB9FFFF CALL jagmisc.100022FD 100069C3 |. FF76 28 PUSH DWORD PTR DS:[ESI+28] 100069C6 |. E8 32B9FFFF CALL jagmisc.100022FD 100069CB |. FF76 2C PUSH DWORD PTR DS:[ESI+2C] 100069CE |. E8 2AB9FFFF CALL jagmisc.100022FD 100069D3 |. FF76 30 PUSH DWORD PTR DS:[ESI+30] 100069D6 |. E8 22B9FFFF CALL jagmisc.100022FD 100069DB |. FF76 34 PUSH DWORD PTR DS:[ESI+34] 100069DE |. E8 1AB9FFFF CALL jagmisc.100022FD 100069E3 |. FF76 1C PUSH DWORD PTR DS:[ESI+1C] 100069E6 |. E8 12B9FFFF CALL jagmisc.100022FD 100069EB |. FF76 38 PUSH DWORD PTR DS:[ESI+38] 100069EE |. E8 0AB9FFFF CALL jagmisc.100022FD 100069F3 |. FF76 3C PUSH DWORD PTR DS:[ESI+3C] 100069F6 |. E8 02B9FFFF CALL jagmisc.100022FD 100069FB |. 83C4 40 ADD ESP,40 100069FE |. FF76 40 PUSH DWORD PTR DS:[ESI+40] 10006A01 |. E8 F7B8FFFF CALL jagmisc.100022FD 10006A06 |. FF76 44 PUSH DWORD PTR DS:[ESI+44] 10006A09 |. E8 EFB8FFFF CALL jagmisc.100022FD 10006A0E |. FF76 48 PUSH DWORD PTR DS:[ESI+48] 10006A11 |. E8 E7B8FFFF CALL jagmisc.100022FD 10006A16 |. FF76 4C PUSH DWORD PTR DS:[ESI+4C] 10006A19 |. E8 DFB8FFFF CALL jagmisc.100022FD 10006A1E |. FF76 50 PUSH DWORD PTR DS:[ESI+50] 10006A21 |. E8 D7B8FFFF CALL jagmisc.100022FD 10006A26 |. FF76 54 PUSH DWORD PTR DS:[ESI+54] 10006A29 |. E8 CFB8FFFF CALL jagmisc.100022FD 10006A2E |. FF76 58 PUSH DWORD PTR DS:[ESI+58] 10006A31 |. E8 C7B8FFFF CALL jagmisc.100022FD 10006A36 |. FF76 5C PUSH DWORD PTR DS:[ESI+5C] 10006A39 |. E8 BFB8FFFF CALL jagmisc.100022FD 10006A3E |. FF76 60 PUSH DWORD PTR DS:[ESI+60] 10006A41 |. E8 B7B8FFFF CALL jagmisc.100022FD 10006A46 |. FF76 64 PUSH DWORD PTR DS:[ESI+64] 10006A49 |. E8 AFB8FFFF CALL jagmisc.100022FD 10006A4E |. FF76 68 PUSH DWORD PTR DS:[ESI+68] 10006A51 |. E8 A7B8FFFF CALL jagmisc.100022FD 10006A56 |. FF76 6C PUSH DWORD PTR DS:[ESI+6C] 10006A59 |. E8 9FB8FFFF CALL jagmisc.100022FD 10006A5E |. FF76 70 PUSH DWORD PTR DS:[ESI+70] 10006A61 |. E8 97B8FFFF CALL jagmisc.100022FD 10006A66 |. FF76 74 PUSH DWORD PTR DS:[ESI+74] 10006A69 |. E8 8FB8FFFF CALL jagmisc.100022FD 10006A6E |. FF76 78 PUSH DWORD PTR DS:[ESI+78] 10006A71 |. E8 87B8FFFF CALL jagmisc.100022FD 10006A76 |. FF76 7C PUSH DWORD PTR DS:[ESI+7C] 10006A79 |. E8 7FB8FFFF CALL jagmisc.100022FD 10006A7E |. 83C4 40 ADD ESP,40 10006A81 |. FFB6 80000000 PUSH DWORD PTR DS:[ESI+80] 10006A87 |. E8 71B8FFFF CALL jagmisc.100022FD 10006A8C |. FFB6 84000000 PUSH DWORD PTR DS:[ESI+84] 10006A92 |. E8 66B8FFFF CALL jagmisc.100022FD 10006A97 |. FFB6 88000000 PUSH DWORD PTR DS:[ESI+88] 10006A9D |. E8 5BB8FFFF CALL jagmisc.100022FD 10006AA2 |. FFB6 8C000000 PUSH DWORD PTR DS:[ESI+8C] 10006AA8 |. E8 50B8FFFF CALL jagmisc.100022FD 10006AAD |. FFB6 90000000 PUSH DWORD PTR DS:[ESI+90] 10006AB3 |. E8 45B8FFFF CALL jagmisc.100022FD 10006AB8 |. FFB6 94000000 PUSH DWORD PTR DS:[ESI+94] 10006ABE |. E8 3AB8FFFF CALL jagmisc.100022FD 10006AC3 |. FFB6 98000000 PUSH DWORD PTR DS:[ESI+98] 10006AC9 |. E8 2FB8FFFF CALL jagmisc.100022FD 10006ACE |. FFB6 9C000000 PUSH DWORD PTR DS:[ESI+9C] 10006AD4 |. E8 24B8FFFF CALL jagmisc.100022FD 10006AD9 |. FFB6 A0000000 PUSH DWORD PTR DS:[ESI+A0] 10006ADF |. E8 19B8FFFF CALL jagmisc.100022FD 10006AE4 |. FFB6 A4000000 PUSH DWORD PTR DS:[ESI+A4] 10006AEA |. E8 0EB8FFFF CALL jagmisc.100022FD 10006AEF |. FFB6 A8000000 PUSH DWORD PTR DS:[ESI+A8] 10006AF5 |. E8 03B8FFFF CALL jagmisc.100022FD 10006AFA |. 83C4 2C ADD ESP,2C 10006AFD |> 5E POP ESI ; kernel32.7C816FD7 10006AFE \. C3 RETN 10006AFF /$ 56 PUSH ESI 10006B00 |. 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 10006B04 |. 85F6 TEST ESI,ESI 10006B06 |. 74 54 JE SHORT jagmisc.10006B5C 10006B08 |. 8B06 MOV EAX,DWORD PTR DS:[ESI] 10006B0A |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC 10006B10 |. 3B01 CMP EAX,DWORD PTR DS:[ECX] 10006B12 |. 74 0F JE SHORT jagmisc.10006B23 10006B14 |. 3B05 FCA70010 CMP EAX,DWORD PTR DS:[1000A7FC] ; jagmisc.1000A7F8 10006B1A |. 74 07 JE SHORT jagmisc.10006B23 10006B1C |. 50 PUSH EAX 10006B1D |. E8 DBB7FFFF CALL jagmisc.100022FD 10006B22 |. 59 POP ECX ; kernel32.7C816FD7 10006B23 |> 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4] 10006B26 |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC 10006B2C |. 3B41 04 CMP EAX,DWORD PTR DS:[ECX+4] 10006B2F |. 74 0F JE SHORT jagmisc.10006B40 10006B31 |. 3B05 00A80010 CMP EAX,DWORD PTR DS:[1000A800] ; jagmisc.1000AFC8 10006B37 |. 74 07 JE SHORT jagmisc.10006B40 10006B39 |. 50 PUSH EAX 10006B3A |. E8 BEB7FFFF CALL jagmisc.100022FD 10006B3F |. 59 POP ECX ; kernel32.7C816FD7 10006B40 |> 8B76 08 MOV ESI,DWORD PTR DS:[ESI+8] 10006B43 |. A1 2CA80010 MOV EAX,DWORD PTR DS:[1000A82C] 10006B48 |. 3B70 08 CMP ESI,DWORD PTR DS:[EAX+8] 10006B4B |. 74 0F JE SHORT jagmisc.10006B5C 10006B4D |. 3B35 04A80010 CMP ESI,DWORD PTR DS:[1000A804] ; jagmisc.1000AFC8 10006B53 |. 74 07 JE SHORT jagmisc.10006B5C 10006B55 |. 56 PUSH ESI 10006B56 |. E8 A2B7FFFF CALL jagmisc.100022FD 10006B5B |. 59 POP ECX ; kernel32.7C816FD7 10006B5C |> 5E POP ESI ; kernel32.7C816FD7 10006B5D \. C3 RETN 10006B5E /$ 56 PUSH ESI 10006B5F |. 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 10006B63 |. 85F6 TEST ESI,ESI 10006B65 |. 0F84 CA000000 JE jagmisc.10006C35 10006B6B |. 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 10006B6E |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC 10006B74 |. 3B41 0C CMP EAX,DWORD PTR DS:[ECX+C] 10006B77 |. 74 0F JE SHORT jagmisc.10006B88 10006B79 |. 3B05 08A80010 CMP EAX,DWORD PTR DS:[1000A808] ; jagmisc.1000AFC8 10006B7F |. 74 07 JE SHORT jagmisc.10006B88 10006B81 |. 50 PUSH EAX 10006B82 |. E8 76B7FFFF CALL jagmisc.100022FD 10006B87 |. 59 POP ECX ; kernel32.7C816FD7 10006B88 |> 8B46 10 MOV EAX,DWORD PTR DS:[ESI+10] 10006B8B |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC 10006B91 |. 3B41 10 CMP EAX,DWORD PTR DS:[ECX+10] 10006B94 |. 74 0F JE SHORT jagmisc.10006BA5 10006B96 |. 3B05 0CA80010 CMP EAX,DWORD PTR DS:[1000A80C] ; jagmisc.1000AFC8 10006B9C |. 74 07 JE SHORT jagmisc.10006BA5 10006B9E |. 50 PUSH EAX 10006B9F |. E8 59B7FFFF CALL jagmisc.100022FD 10006BA4 |. 59 POP ECX ; kernel32.7C816FD7 10006BA5 |> 8B46 14 MOV EAX,DWORD PTR DS:[ESI+14] 10006BA8 |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC 10006BAE |. 3B41 14 CMP EAX,DWORD PTR DS:[ECX+14] 10006BB1 |. 74 0F JE SHORT jagmisc.10006BC2 10006BB3 |. 3B05 10A80010 CMP EAX,DWORD PTR DS:[1000A810] ; jagmisc.1000AFC8 10006BB9 |. 74 07 JE SHORT jagmisc.10006BC2 10006BBB |. 50 PUSH EAX 10006BBC |. E8 3CB7FFFF CALL jagmisc.100022FD 10006BC1 |. 59 POP ECX ; kernel32.7C816FD7 10006BC2 |> 8B46 18 MOV EAX,DWORD PTR DS:[ESI+18] 10006BC5 |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC 10006BCB |. 3B41 18 CMP EAX,DWORD PTR DS:[ECX+18] 10006BCE |. 74 0F JE SHORT jagmisc.10006BDF 10006BD0 |. 3B05 14A80010 CMP EAX,DWORD PTR DS:[1000A814] ; jagmisc.1000AFC8 10006BD6 |. 74 07 JE SHORT jagmisc.10006BDF 10006BD8 |. 50 PUSH EAX 10006BD9 |. E8 1FB7FFFF CALL jagmisc.100022FD 10006BDE |. 59 POP ECX ; kernel32.7C816FD7 10006BDF |> 8B46 1C MOV EAX,DWORD PTR DS:[ESI+1C] 10006BE2 |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC 10006BE8 |. 3B41 1C CMP EAX,DWORD PTR DS:[ECX+1C] 10006BEB |. 74 0F JE SHORT jagmisc.10006BFC 10006BED |. 3B05 18A80010 CMP EAX,DWORD PTR DS:[1000A818] ; jagmisc.1000AFC8 10006BF3 |. 74 07 JE SHORT jagmisc.10006BFC 10006BF5 |. 50 PUSH EAX 10006BF6 |. E8 02B7FFFF CALL jagmisc.100022FD 10006BFB |. 59 POP ECX ; kernel32.7C816FD7 10006BFC |> 8B46 20 MOV EAX,DWORD PTR DS:[ESI+20] 10006BFF |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC 10006C05 |. 3B41 20 CMP EAX,DWORD PTR DS:[ECX+20] 10006C08 |. 74 0F JE SHORT jagmisc.10006C19 10006C0A |. 3B05 1CA80010 CMP EAX,DWORD PTR DS:[1000A81C] ; jagmisc.1000AFC8 10006C10 |. 74 07 JE SHORT jagmisc.10006C19 10006C12 |. 50 PUSH EAX 10006C13 |. E8 E5B6FFFF CALL jagmisc.100022FD 10006C18 |. 59 POP ECX ; kernel32.7C816FD7 10006C19 |> 8B76 24 MOV ESI,DWORD PTR DS:[ESI+24] 10006C1C |. A1 2CA80010 MOV EAX,DWORD PTR DS:[1000A82C] 10006C21 |. 3B70 24 CMP ESI,DWORD PTR DS:[EAX+24] 10006C24 |. 74 0F JE SHORT jagmisc.10006C35 10006C26 |. 3B35 20A80010 CMP ESI,DWORD PTR DS:[1000A820] ; jagmisc.1000AFC8 10006C2C |. 74 07 JE SHORT jagmisc.10006C35 10006C2E |. 56 PUSH ESI 10006C2F |. E8 C9B6FFFF CALL jagmisc.100022FD 10006C34 |. 59 POP ECX ; kernel32.7C816FD7 10006C35 |> 5E POP ESI ; kernel32.7C816FD7 10006C36 \. C3 RETN 10006C37 CC INT3 10006C38 CC INT3 10006C39 CC INT3 10006C3A CC INT3 10006C3B CC INT3 10006C3C CC INT3 10006C3D CC INT3 10006C3E CC INT3 10006C3F CC INT3 10006C40 /. 55 PUSH EBP 10006C41 |. 8BEC MOV EBP,ESP 10006C43 |. 56 PUSH ESI 10006C44 |. 33C0 XOR EAX,EAX 10006C46 |. 50 PUSH EAX 10006C47 |. 50 PUSH EAX 10006C48 |. 50 PUSH EAX 10006C49 |. 50 PUSH EAX 10006C4A |. 50 PUSH EAX 10006C4B |. 50 PUSH EAX 10006C4C |. 50 PUSH EAX 10006C4D |. 50 PUSH EAX 10006C4E |. 8B55 0C MOV EDX,[ARG.2] 10006C51 |. 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 10006C54 |> 8A02 /MOV AL,BYTE PTR DS:[EDX] 10006C56 |. 0AC0 |OR AL,AL 10006C58 |. 74 09 |JE SHORT jagmisc.10006C63 10006C5A |. 83C2 01 |ADD EDX,1 10006C5D |. 0FAB0424 |BTS DWORD PTR SS:[ESP],EAX 10006C61 |.^ EB F1 \JMP SHORT jagmisc.10006C54 10006C63 |> 8B75 08 MOV ESI,[ARG.1] 10006C66 |. 83C9 FF OR ECX,FFFFFFFF 10006C69 |. 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 10006C6C |> 83C1 01 /ADD ECX,1 10006C6F |. 8A06 |MOV AL,BYTE PTR DS:[ESI] 10006C71 |. 0AC0 |OR AL,AL 10006C73 |. 74 09 |JE SHORT jagmisc.10006C7E 10006C75 |. 83C6 01 |ADD ESI,1 10006C78 |. 0FA30424 |BT DWORD PTR SS:[ESP],EAX 10006C7C |.^ 73 EE \JNB SHORT jagmisc.10006C6C 10006C7E |> 8BC1 MOV EAX,ECX 10006C80 |. 83C4 20 ADD ESP,20 10006C83 |. 5E POP ESI ; kernel32.7C816FD7 10006C84 |. C9 LEAVE 10006C85 \. C3 RETN 10006C86 CC INT3 10006C87 CC INT3 10006C88 CC INT3 10006C89 CC INT3 10006C8A CC INT3 10006C8B CC INT3 10006C8C CC INT3 10006C8D CC INT3 10006C8E CC INT3 10006C8F CC INT3 10006C90 . 8B5424 04 MOV EDX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10006C94 . 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 10006C98 . F7C2 03000000 TEST EDX,3 10006C9E . 75 3C JNZ SHORT jagmisc.10006CDC 10006CA0 > 8B02 MOV EAX,DWORD PTR DS:[EDX] 10006CA2 . 3A01 CMP AL,BYTE PTR DS:[ECX] 10006CA4 . 75 2E JNZ SHORT jagmisc.10006CD4 10006CA6 . 0AC0 OR AL,AL 10006CA8 . 74 26 JE SHORT jagmisc.10006CD0 10006CAA . 3A61 01 CMP AH,BYTE PTR DS:[ECX+1] 10006CAD . 75 25 JNZ SHORT jagmisc.10006CD4 10006CAF . 0AE4 OR AH,AH 10006CB1 . 74 1D JE SHORT jagmisc.10006CD0 10006CB3 . C1E8 10 SHR EAX,10 10006CB6 . 3A41 02 CMP AL,BYTE PTR DS:[ECX+2] 10006CB9 . 75 19 JNZ SHORT jagmisc.10006CD4 10006CBB . 0AC0 OR AL,AL 10006CBD . 74 11 JE SHORT jagmisc.10006CD0 10006CBF . 3A61 03 CMP AH,BYTE PTR DS:[ECX+3] 10006CC2 . 75 10 JNZ SHORT jagmisc.10006CD4 10006CC4 . 83C1 04 ADD ECX,4 10006CC7 . 83C2 04 ADD EDX,4 10006CCA . 0AE4 OR AH,AH 10006CCC .^ 75 D2 JNZ SHORT jagmisc.10006CA0 10006CCE . 8BFF MOV EDI,EDI 10006CD0 > 33C0 XOR EAX,EAX 10006CD2 . C3 RETN 10006CD3 90 NOP 10006CD4 > 1BC0 SBB EAX,EAX 10006CD6 . D1E0 SHL EAX,1 10006CD8 . 83C0 01 ADD EAX,1 10006CDB . C3 RETN 10006CDC > F7C2 01000000 TEST EDX,1 10006CE2 . 74 18 JE SHORT jagmisc.10006CFC 10006CE4 . 8A02 MOV AL,BYTE PTR DS:[EDX] 10006CE6 . 83C2 01 ADD EDX,1 10006CE9 . 3A01 CMP AL,BYTE PTR DS:[ECX] 10006CEB .^ 75 E7 JNZ SHORT jagmisc.10006CD4 10006CED . 83C1 01 ADD ECX,1 10006CF0 . 0AC0 OR AL,AL 10006CF2 .^ 74 DC JE SHORT jagmisc.10006CD0 10006CF4 . F7C2 02000000 TEST EDX,2 10006CFA .^ 74 A4 JE SHORT jagmisc.10006CA0 10006CFC > 66:8B02 MOV AX,WORD PTR DS:[EDX] 10006CFF . 83C2 02 ADD EDX,2 10006D02 . 3A01 CMP AL,BYTE PTR DS:[ECX] 10006D04 .^ 75 CE JNZ SHORT jagmisc.10006CD4 10006D06 . 0AC0 OR AL,AL 10006D08 .^ 74 C6 JE SHORT jagmisc.10006CD0 10006D0A . 3A61 01 CMP AH,BYTE PTR DS:[ECX+1] 10006D0D .^ 75 C5 JNZ SHORT jagmisc.10006CD4 10006D0F . 0AE4 OR AH,AH 10006D11 .^ 74 BD JE SHORT jagmisc.10006CD0 10006D13 . 83C1 02 ADD ECX,2 10006D16 .^ EB 88 JMP SHORT jagmisc.10006CA0 10006D18 CC INT3 10006D19 CC INT3 10006D1A CC INT3 10006D1B CC INT3 10006D1C CC INT3 10006D1D CC INT3 10006D1E CC INT3 10006D1F CC INT3 10006D20 . 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+C] 10006D24 . 85C0 TEST EAX,EAX 10006D26 . 74 4A JE SHORT jagmisc.10006D72 10006D28 . 8B5424 04 MOV EDX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 10006D2C . 56 PUSH ESI 10006D2D . 57 PUSH EDI 10006D2E . 8BF2 MOV ESI,EDX 10006D30 . 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10] 10006D34 . 0BD7 OR EDX,EDI 10006D36 . 83E2 03 AND EDX,3 10006D39 . 74 38 JE SHORT jagmisc.10006D73 10006D3B . A9 01000000 TEST EAX,1 10006D40 . 74 11 JE SHORT jagmisc.10006D53 10006D42 . 8A0E MOV CL,BYTE PTR DS:[ESI] 10006D44 . 3A0F CMP CL,BYTE PTR DS:[EDI] 10006D46 . 75 58 JNZ SHORT jagmisc.10006DA0 10006D48 . 83C6 01 ADD ESI,1 10006D4B . 83C7 01 ADD EDI,1 10006D4E . 83E8 01 SUB EAX,1 10006D51 . 74 1D JE SHORT jagmisc.10006D70 10006D53 > 8A0E MOV CL,BYTE PTR DS:[ESI] 10006D55 . 8A17 MOV DL,BYTE PTR DS:[EDI] 10006D57 . 38D1 CMP CL,DL 10006D59 . 75 45 JNZ SHORT jagmisc.10006DA0 10006D5B . 8A4E 01 MOV CL,BYTE PTR DS:[ESI+1] 10006D5E . 8A57 01 MOV DL,BYTE PTR DS:[EDI+1] 10006D61 . 38D1 CMP CL,DL 10006D63 . 75 3B JNZ SHORT jagmisc.10006DA0 10006D65 . 83C7 02 ADD EDI,2 10006D68 . 83C6 02 ADD ESI,2 10006D6B . 83E8 02 SUB EAX,2 10006D6E .^ 75 E3 JNZ SHORT jagmisc.10006D53 10006D70 > 5F POP EDI ; kernel32.7C816FD7 10006D71 . 5E POP ESI ; kernel32.7C816FD7 10006D72 > C3 RETN 10006D73 > 8BC8 MOV ECX,EAX 10006D75 . 83E0 03 AND EAX,3 10006D78 . C1E9 02 SHR ECX,2 10006D7B . 74 2B JE SHORT jagmisc.10006DA8 10006D7D . F3:A7 REPE CMPS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 10006D7F . 74 27 JE SHORT jagmisc.10006DA8 10006D81 . 8B4E FC MOV ECX,DWORD PTR DS:[ESI-4] 10006D84 . 8B57 FC MOV EDX,DWORD PTR DS:[EDI-4] 10006D87 . 38D1 CMP CL,DL 10006D89 . 75 10 JNZ SHORT jagmisc.10006D9B 10006D8B . 38F5 CMP CH,DH 10006D8D . 75 0C JNZ SHORT jagmisc.10006D9B 10006D8F . C1E9 10 SHR ECX,10 10006D92 . C1EA 10 SHR EDX,10 10006D95 . 38D1 CMP CL,DL 10006D97 . 75 02 JNZ SHORT jagmisc.10006D9B 10006D99 . 38F5 CMP CH,DH 10006D9B > B8 00000000 MOV EAX,0 10006DA0 > 1BC0 SBB EAX,EAX 10006DA2 . 5F POP EDI ; kernel32.7C816FD7 10006DA3 . 83D8 FF SBB EAX,-1 10006DA6 . 5E POP ESI ; kernel32.7C816FD7 10006DA7 . C3 RETN 10006DA8 > 85C0 TEST EAX,EAX 10006DAA .^ 74 C4 JE SHORT jagmisc.10006D70 10006DAC . 8B16 MOV EDX,DWORD PTR DS:[ESI] 10006DAE . 8B0F MOV ECX,DWORD PTR DS:[EDI] 10006DB0 . 38CA CMP DL,CL 10006DB2 .^ 75 E7 JNZ SHORT jagmisc.10006D9B 10006DB4 . 83E8 01 SUB EAX,1 10006DB7 . 74 1C JE SHORT jagmisc.10006DD5 10006DB9 . 38EE CMP DH,CH 10006DBB .^ 75 DE JNZ SHORT jagmisc.10006D9B 10006DBD . 83E8 01 SUB EAX,1 10006DC0 . 74 13 JE SHORT jagmisc.10006DD5 10006DC2 . 81E1 0000FF00 AND ECX,0FF0000 10006DC8 . 81E2 0000FF00 AND EDX,0FF0000 10006DCE . 3BD1 CMP EDX,ECX 10006DD0 .^ 75 C9 JNZ SHORT jagmisc.10006D9B 10006DD2 . 83E8 01 SUB EAX,1 10006DD5 > 5F POP EDI ; kernel32.7C816FD7 10006DD6 . 5E POP ESI ; kernel32.7C816FD7 10006DD7 . C3 RETN 10006DD8 $ 6A 1C PUSH 1C 10006DDA . 68 30910010 PUSH jagmisc.10009130 10006DDF . E8 8CB5FFFF CALL jagmisc.10002370 10006DE4 . 33F6 XOR ESI,ESI 10006DE6 . 3935 18B00010 CMP DWORD PTR DS:[1000B018],ESI 10006DEC . 75 35 JNZ SHORT jagmisc.10006E23 10006DEE . 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C] 10006DF1 . 50 PUSH EAX ; /CharTypes = 00000008 10006DF2 . 33FF XOR EDI,EDI ; | 10006DF4 . 47 INC EDI ; | 10006DF5 . 57 PUSH EDI ; |SrcCount = 0 10006DF6 . 68 04890010 PUSH jagmisc.10008904 ; |Source = "" 10006DFB . 57 PUSH EDI ; |InfoType = 0 10006DFC . FF15 00810010 CALL DWORD PTR DS:[<&KERNEL32.GetStringTypeW>] ; \GetStringTypeW 10006E02 . 85C0 TEST EAX,EAX 10006E04 . 74 08 JE SHORT jagmisc.10006E0E 10006E06 . 893D 18B00010 MOV DWORD PTR DS:[1000B018],EDI 10006E0C . EB 15 JMP SHORT jagmisc.10006E23 10006E0E > FF15 38800010 CALL DWORD PTR DS:[<&KERNEL32.GetLastError>] ; [GetLastError 10006E14 . 83F8 78 CMP EAX,78 10006E17 . 75 0A JNZ SHORT jagmisc.10006E23 10006E19 . C705 18B00010 020>MOV DWORD PTR DS:[1000B018],2 10006E23 > A1 18B00010 MOV EAX,DWORD PTR DS:[1000B018] 10006E28 . 83F8 02 CMP EAX,2 10006E2B . 0F84 EA000000 JE jagmisc.10006F1B 10006E31 . 3BC6 CMP EAX,ESI 10006E33 . 0F84 E2000000 JE jagmisc.10006F1B 10006E39 . 83F8 01 CMP EAX,1 10006E3C . 0F85 FF000000 JNZ jagmisc.10006F41 10006E42 . 8975 DC MOV DWORD PTR SS:[EBP-24],ESI 10006E45 . 8975 E0 MOV DWORD PTR SS:[EBP-20],ESI 10006E48 . 3975 18 CMP DWORD PTR SS:[EBP+18],ESI 10006E4B . 75 08 JNZ SHORT jagmisc.10006E55 10006E4D . A1 10B00010 MOV EAX,DWORD PTR DS:[1000B010] 10006E52 . 8945 18 MOV DWORD PTR SS:[EBP+18],EAX 10006E55 > 56 PUSH ESI ; /WideBufSize = 0 10006E56 . 56 PUSH ESI ; |WideCharBuf = NULL 10006E57 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |StringSize = 8054A6ED (-2141935891.) 10006E5A . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |StringToMap = "" 10006E5D . 33C0 XOR EAX,EAX ; | 10006E5F . 3975 20 CMP DWORD PTR SS:[EBP+20],ESI ; | 10006E62 . 0F95C0 SETNE AL ; | 10006E65 . 8D04C5 01000000 LEA EAX,DWORD PTR DS:[EAX*8+1] ; | 10006E6C . 50 PUSH EAX ; |Options = MB_ERR_INVALID_CHARS 10006E6D . FF75 18 PUSH DWORD PTR SS:[EBP+18] ; |CodePage = 8227C238 10006E70 . FF15 E4800010 CALL DWORD PTR DS:[<&KERNEL32.MultiByteToWideChar>] ; \MultiByteToWideChar 10006E76 . 8BF8 MOV EDI,EAX 10006E78 . 897D D8 MOV DWORD PTR SS:[EBP-28],EDI 10006E7B . 85FF TEST EDI,EDI 10006E7D . 0F84 BE000000 JE jagmisc.10006F41 10006E83 . 8365 FC 00 AND DWORD PTR SS:[EBP-4],0 10006E87 . 8D1C3F LEA EBX,DWORD PTR DS:[EDI+EDI] 10006E8A . 8BC3 MOV EAX,EBX 10006E8C . 83C0 03 ADD EAX,3 10006E8F . 83E0 FC AND EAX,FFFFFFFC 10006E92 . E8 19BFFFFF CALL jagmisc.10002DB0 10006E97 . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP 10006E9A . 8BF4 MOV ESI,ESP 10006E9C . 8975 D4 MOV DWORD PTR SS:[EBP-2C],ESI 10006E9F . 53 PUSH EBX 10006EA0 . 6A 00 PUSH 0 10006EA2 . 56 PUSH ESI 10006EA3 . E8 68CCFFFF CALL jagmisc.10003B10 10006EA8 . 83C4 0C ADD ESP,0C 10006EAB . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10006EAF . EB 15 JMP SHORT jagmisc.10006EC6 10006EB1 . 33C0 XOR EAX,EAX 10006EB3 . 40 INC EAX 10006EB4 . C3 RETN 10006EB5 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451 10006EB8 . E8 92050000 CALL jagmisc.1000744F 10006EBD . 33F6 XOR ESI,ESI 10006EBF . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10006EC3 . 8B7D D8 MOV EDI,DWORD PTR SS:[EBP-28] ; kernel32.7C839AA8 10006EC6 > 85F6 TEST ESI,ESI 10006EC8 . 75 17 JNZ SHORT jagmisc.10006EE1 10006ECA . 57 PUSH EDI 10006ECB . 6A 02 PUSH 2 10006ECD . E8 6FB6FFFF CALL jagmisc.10002541 10006ED2 . 59 POP ECX ; kernel32.7C816FD7 10006ED3 . 59 POP ECX ; kernel32.7C816FD7 10006ED4 . 8BF0 MOV ESI,EAX 10006ED6 . 85F6 TEST ESI,ESI 10006ED8 . 74 67 JE SHORT jagmisc.10006F41 10006EDA . C745 E0 01000000 MOV DWORD PTR SS:[EBP-20],1 10006EE1 > 57 PUSH EDI ; /WideBufSize = 0 10006EE2 . 56 PUSH ESI ; |WideCharBuf = NULL 10006EE3 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |StringSize = 8054A6ED (-2141935891.) 10006EE6 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |StringToMap = "" 10006EE9 . 6A 01 PUSH 1 ; |Options = MB_PRECOMPOSED 10006EEB . FF75 18 PUSH DWORD PTR SS:[EBP+18] ; |CodePage = 8227C238 10006EEE . FF15 E4800010 CALL DWORD PTR DS:[<&KERNEL32.MultiByteToWideChar>] ; \MultiByteToWideChar 10006EF4 . 85C0 TEST EAX,EAX 10006EF6 . 74 11 JE SHORT jagmisc.10006F09 10006EF8 . FF75 14 PUSH DWORD PTR SS:[EBP+14] ; /CharTypes = 0006FFC8 10006EFB . 50 PUSH EAX ; |SrcCount = 8 10006EFC . 56 PUSH ESI ; |Source = NULL 10006EFD . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |InfoType = FFFFFFFF 10006F00 . FF15 00810010 CALL DWORD PTR DS:[<&KERNEL32.GetStringTypeW>] ; \GetStringTypeW 10006F06 . 8945 DC MOV DWORD PTR SS:[EBP-24],EAX 10006F09 > 837D E0 00 CMP DWORD PTR SS:[EBP-20],0 10006F0D . 74 07 JE SHORT jagmisc.10006F16 10006F0F . 56 PUSH ESI 10006F10 . E8 E8B3FFFF CALL jagmisc.100022FD 10006F15 . 59 POP ECX ; kernel32.7C816FD7 10006F16 > 8B45 DC MOV EAX,DWORD PTR SS:[EBP-24] ; kernel32.7C802458 10006F19 . EB 6E JMP SHORT jagmisc.10006F89 10006F1B > 8B5D 1C MOV EBX,DWORD PTR SS:[EBP+1C] 10006F1E . 3BDE CMP EBX,ESI 10006F20 . 75 06 JNZ SHORT jagmisc.10006F28 10006F22 . 8B1D 00B00010 MOV EBX,DWORD PTR DS:[1000B000] 10006F28 > 8B7D 18 MOV EDI,DWORD PTR SS:[EBP+18] 10006F2B . 85FF TEST EDI,EDI 10006F2D . 75 06 JNZ SHORT jagmisc.10006F35 10006F2F . 8B3D 10B00010 MOV EDI,DWORD PTR DS:[1000B010] 10006F35 > 53 PUSH EBX 10006F36 . E8 08030000 CALL jagmisc.10007243 10006F3B . 59 POP ECX ; kernel32.7C816FD7 10006F3C . 83F8 FF CMP EAX,-1 10006F3F . 75 04 JNZ SHORT jagmisc.10006F45 10006F41 > 33C0 XOR EAX,EAX 10006F43 . EB 44 JMP SHORT jagmisc.10006F89 10006F45 > 3BC7 CMP EAX,EDI 10006F47 . 74 1E JE SHORT jagmisc.10006F67 10006F49 . 6A 00 PUSH 0 10006F4B . 6A 00 PUSH 0 10006F4D . 8D4D 10 LEA ECX,DWORD PTR SS:[EBP+10] 10006F50 . 51 PUSH ECX 10006F51 . FF75 0C PUSH DWORD PTR SS:[EBP+C] 10006F54 . 50 PUSH EAX 10006F55 . 57 PUSH EDI 10006F56 . E8 2B030000 CALL jagmisc.10007286 10006F5B . 83C4 18 ADD ESP,18 10006F5E . 8BF0 MOV ESI,EAX 10006F60 . 85F6 TEST ESI,ESI 10006F62 .^ 74 DD JE SHORT jagmisc.10006F41 10006F64 . 8975 0C MOV DWORD PTR SS:[EBP+C],ESI 10006F67 > FF75 14 PUSH DWORD PTR SS:[EBP+14] ; /CharTypes = 0006FFC8 10006F6A . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |SrcSize = 8054A6ED (-2141935891.) 10006F6D . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |Source = "" 10006F70 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |InfoType = FFFFFFFF 10006F73 . 53 PUSH EBX ; |LocaleId = 0 10006F74 . FF15 FC800010 CALL DWORD PTR DS:[<&KERNEL32.GetStringTypeA>] ; \GetStringTypeA 10006F7A . 8BF8 MOV EDI,EAX 10006F7C . 85F6 TEST ESI,ESI 10006F7E . 74 07 JE SHORT jagmisc.10006F87 10006F80 . 56 PUSH ESI 10006F81 . E8 77B3FFFF CALL jagmisc.100022FD 10006F86 . 59 POP ECX ; kernel32.7C816FD7 10006F87 > 8BC7 MOV EAX,EDI 10006F89 > 8D65 C8 LEA ESP,DWORD PTR SS:[EBP-38] 10006F8C . E8 1AB4FFFF CALL jagmisc.100023AB 10006F91 . C3 RETN 10006F92 CC INT3 10006F93 CC INT3 10006F94 CC INT3 10006F95 CC INT3 10006F96 CC INT3 10006F97 CC INT3 10006F98 CC INT3 10006F99 CC INT3 10006F9A CC INT3 10006F9B CC INT3 10006F9C CC INT3 10006F9D CC INT3 10006F9E CC INT3 10006F9F CC INT3 10006FA0 /. 55 PUSH EBP 10006FA1 |. 8BEC MOV EBP,ESP 10006FA3 |. 57 PUSH EDI 10006FA4 |. 56 PUSH ESI 10006FA5 |. 53 PUSH EBX 10006FA6 |. 8B4D 10 MOV ECX,[ARG.3] 10006FA9 |. E3 27 JECXZ SHORT jagmisc.10006FD2 10006FAB |. 8BD9 MOV EBX,ECX 10006FAD |. 8B7D 08 MOV EDI,[ARG.1] 10006FB0 |. 8BF7 MOV ESI,EDI 10006FB2 |. 33C0 XOR EAX,EAX 10006FB4 |. F2:AE REPNE SCAS BYTE PTR ES:[EDI] 10006FB6 |. F7D9 NEG ECX 10006FB8 |. 03CB ADD ECX,EBX 10006FBA |. 8BFE MOV EDI,ESI 10006FBC |. 8B75 0C MOV ESI,[ARG.2] 10006FBF |. F3:A6 REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI] 10006FC1 |. 8A46 FF MOV AL,BYTE PTR DS:[ESI-1] 10006FC4 |. 33C9 XOR ECX,ECX 10006FC6 |. 3A47 FF CMP AL,BYTE PTR DS:[EDI-1] 10006FC9 |. 77 05 JA SHORT jagmisc.10006FD0 10006FCB |. 74 05 JE SHORT jagmisc.10006FD2 10006FCD |. 83E9 02 SUB ECX,2 10006FD0 |> F7D1 NOT ECX 10006FD2 |> 8BC1 MOV EAX,ECX 10006FD4 |. 5B POP EBX ; kernel32.7C816FD7 10006FD5 |. 5E POP ESI ; kernel32.7C816FD7 10006FD6 |. 5F POP EDI ; kernel32.7C816FD7 10006FD7 |. C9 LEAVE 10006FD8 \. C3 RETN 10006FD9 CC INT3 10006FDA CC INT3 10006FDB CC INT3 10006FDC CC INT3 10006FDD CC INT3 10006FDE CC INT3 10006FDF CC INT3 10006FE0 /. 55 PUSH EBP 10006FE1 |. 8BEC MOV EBP,ESP 10006FE3 |. 56 PUSH ESI 10006FE4 |. 33C0 XOR EAX,EAX 10006FE6 |. 50 PUSH EAX 10006FE7 |. 50 PUSH EAX 10006FE8 |. 50 PUSH EAX 10006FE9 |. 50 PUSH EAX 10006FEA |. 50 PUSH EAX 10006FEB |. 50 PUSH EAX 10006FEC |. 50 PUSH EAX 10006FED |. 50 PUSH EAX 10006FEE |. 8B55 0C MOV EDX,[ARG.2] 10006FF1 |. 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 10006FF4 |> 8A02 /MOV AL,BYTE PTR DS:[EDX] 10006FF6 |. 0AC0 |OR AL,AL 10006FF8 |. 74 09 |JE SHORT jagmisc.10007003 10006FFA |. 83C2 01 |ADD EDX,1 10006FFD |. 0FAB0424 |BTS DWORD PTR SS:[ESP],EAX 10007001 |.^ EB F1 \JMP SHORT jagmisc.10006FF4 10007003 |> 8B75 08 MOV ESI,[ARG.1] 10007006 |. 8BFF MOV EDI,EDI 10007008 |> 8A06 /MOV AL,BYTE PTR DS:[ESI] 1000700A |. 0AC0 |OR AL,AL 1000700C |. 74 0C |JE SHORT jagmisc.1000701A 1000700E |. 83C6 01 |ADD ESI,1 10007011 |. 0FA30424 |BT DWORD PTR SS:[ESP],EAX 10007015 |.^ 73 F1 \JNB SHORT jagmisc.10007008 10007017 |. 8D46 FF LEA EAX,DWORD PTR DS:[ESI-1] 1000701A |> 83C4 20 ADD ESP,20 1000701D |. 5E POP ESI ; kernel32.7C816FD7 1000701E |. C9 LEAVE 1000701F \. C3 RETN 10007020 $ 6A 14 PUSH 14 10007022 . 68 40910010 PUSH jagmisc.10009140 10007027 . E8 44B3FFFF CALL jagmisc.10002370 1000702C . 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8] 1000702F . 33DB XOR EBX,EBX 10007031 . 3BFB CMP EDI,EBX 10007033 . 75 0E JNZ SHORT jagmisc.10007043 10007035 . FF75 0C PUSH DWORD PTR SS:[EBP+C] 10007038 . E8 5FE5FFFF CALL jagmisc.1000559C 1000703D . 59 POP ECX ; kernel32.7C816FD7 1000703E . E9 84010000 JMP jagmisc.100071C7 10007043 > 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C] 10007046 . 3BF3 CMP ESI,EBX 10007048 . 75 0C JNZ SHORT jagmisc.10007056 1000704A . 57 PUSH EDI 1000704B . E8 ADB2FFFF CALL jagmisc.100022FD 10007050 . 59 POP ECX ; kernel32.7C816FD7 10007051 . E9 6F010000 JMP jagmisc.100071C5 10007056 > 833D 64B30010 03 CMP DWORD PTR DS:[1000B364],3 1000705D . 0F85 2E010000 JNZ jagmisc.10007191 10007063 > 895D E4 MOV DWORD PTR SS:[EBP-1C],EBX 10007066 . 83FE E0 CMP ESI,-20 10007069 . 0F87 F1000000 JA jagmisc.10007160 1000706F . 6A 04 PUSH 4 ; /Arg1 = 00000004 10007071 . E8 BECDFFFF CALL jagmisc.10003E34 ; \jagmisc.10003E34 10007076 . 59 POP ECX ; kernel32.7C816FD7 10007077 . 895D FC MOV DWORD PTR SS:[EBP-4],EBX 1000707A . 57 PUSH EDI 1000707B . E8 CDD5FFFF CALL jagmisc.1000464D 10007080 . 59 POP ECX ; kernel32.7C816FD7 10007081 . 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX 10007084 . 3BC3 CMP EAX,EBX 10007086 . 0F84 A4000000 JE jagmisc.10007130 1000708C . 3B35 24B10010 CMP ESI,DWORD PTR DS:[1000B124] 10007092 . 77 4C JA SHORT jagmisc.100070E0 10007094 . 56 PUSH ESI 10007095 . 57 PUSH EDI 10007096 . 50 PUSH EAX 10007097 . E8 B1DAFFFF CALL jagmisc.10004B4D 1000709C . 83C4 0C ADD ESP,0C 1000709F . 85C0 TEST EAX,EAX 100070A1 . 74 05 JE SHORT jagmisc.100070A8 100070A3 . 897D E4 MOV DWORD PTR SS:[EBP-1C],EDI 100070A6 . EB 38 JMP SHORT jagmisc.100070E0 100070A8 > 56 PUSH ESI 100070A9 . E8 7EDDFFFF CALL jagmisc.10004E2C 100070AE . 59 POP ECX ; kernel32.7C816FD7 100070AF . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 100070B2 . 3BC3 CMP EAX,EBX 100070B4 . 74 2A JE SHORT jagmisc.100070E0 100070B6 . 8B47 FC MOV EAX,DWORD PTR DS:[EDI-4] 100070B9 . 48 DEC EAX 100070BA . 8945 DC MOV DWORD PTR SS:[EBP-24],EAX 100070BD . 3BC6 CMP EAX,ESI 100070BF . 72 02 JB SHORT jagmisc.100070C3 100070C1 . 8BC6 MOV EAX,ESI 100070C3 > 50 PUSH EAX 100070C4 . 57 PUSH EDI 100070C5 . FF75 E4 PUSH DWORD PTR SS:[EBP-1C] 100070C8 . E8 E3E4FFFF CALL jagmisc.100055B0 100070CD . 57 PUSH EDI 100070CE . E8 7AD5FFFF CALL jagmisc.1000464D 100070D3 . 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX 100070D6 . 57 PUSH EDI 100070D7 . 50 PUSH EAX 100070D8 . E8 9BD5FFFF CALL jagmisc.10004678 100070DD . 83C4 18 ADD ESP,18 100070E0 > 395D E4 CMP DWORD PTR SS:[EBP-1C],EBX 100070E3 . 75 4B JNZ SHORT jagmisc.10007130 100070E5 . 3BF3 CMP ESI,EBX 100070E7 . 75 06 JNZ SHORT jagmisc.100070EF 100070E9 . 33F6 XOR ESI,ESI 100070EB . 46 INC ESI 100070EC . 8975 0C MOV DWORD PTR SS:[EBP+C],ESI 100070EF > 83C6 0F ADD ESI,0F 100070F2 . 83E6 F0 AND ESI,FFFFFFF0 100070F5 . 8975 0C MOV DWORD PTR SS:[EBP+C],ESI 100070F8 . 56 PUSH ESI ; /HeapSize = 0 100070F9 . 53 PUSH EBX ; |Flags = 0 100070FA . FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000 10007100 . FF15 80800010 CALL DWORD PTR DS:[<&KERNEL32.HeapAlloc>] ; \HeapAlloc 10007106 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 10007109 . 3BC3 CMP EAX,EBX 1000710B . 74 23 JE SHORT jagmisc.10007130 1000710D . 8B47 FC MOV EAX,DWORD PTR DS:[EDI-4] 10007110 . 48 DEC EAX 10007111 . 8945 DC MOV DWORD PTR SS:[EBP-24],EAX 10007114 . 3BC6 CMP EAX,ESI 10007116 . 72 02 JB SHORT jagmisc.1000711A 10007118 . 8BC6 MOV EAX,ESI 1000711A > 50 PUSH EAX 1000711B . 57 PUSH EDI 1000711C . FF75 E4 PUSH DWORD PTR SS:[EBP-1C] 1000711F . E8 8CE4FFFF CALL jagmisc.100055B0 10007124 . 57 PUSH EDI 10007125 . FF75 E0 PUSH DWORD PTR SS:[EBP-20] 10007128 . E8 4BD5FFFF CALL jagmisc.10004678 1000712D . 83C4 14 ADD ESP,14 10007130 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10007134 . E8 4F000000 CALL jagmisc.10007188 10007139 . 395D E0 CMP DWORD PTR SS:[EBP-20],EBX 1000713C . 75 22 JNZ SHORT jagmisc.10007160 1000713E . 3BF3 CMP ESI,EBX 10007140 . 75 03 JNZ SHORT jagmisc.10007145 10007142 . 33F6 XOR ESI,ESI 10007144 . 46 INC ESI 10007145 > 83C6 0F ADD ESI,0F 10007148 . 83E6 F0 AND ESI,FFFFFFF0 1000714B . 8975 0C MOV DWORD PTR SS:[EBP+C],ESI 1000714E . 56 PUSH ESI ; /NewSize = 0 1000714F . 57 PUSH EDI ; |pMemory = NULL 10007150 . 53 PUSH EBX ; |Flags = 0 10007151 . FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000 10007157 . FF15 CC800010 CALL DWORD PTR DS:[<&KERNEL32.HeapReAlloc>] ; \HeapReAlloc 1000715D . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 10007160 > 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C] 10007163 . 3BC3 CMP EAX,EBX 10007165 . 75 60 JNZ SHORT jagmisc.100071C7 10007167 . 391D 90AF0010 CMP DWORD PTR DS:[1000AF90],EBX 1000716D . 74 58 JE SHORT jagmisc.100071C7 1000716F . 56 PUSH ESI 10007170 . E8 CAE2FFFF CALL jagmisc.1000543F 10007175 . 59 POP ECX ; kernel32.7C816FD7 10007176 . 85C0 TEST EAX,EAX 10007178 .^ 0F85 E5FEFFFF JNZ jagmisc.10007063 1000717E . EB 45 JMP SHORT jagmisc.100071C5 10007180 33 DB 33 ; CHAR '3' 10007181 DB DB DB 10007182 8B DB 8B 10007183 75 DB 75 ; CHAR 'u' 10007184 0C DB 0C 10007185 8B DB 8B 10007186 7D DB 7D ; CHAR '}' 10007187 08 DB 08 10007188 /$ 6A 04 PUSH 4 1000718A |. E8 F0CBFFFF CALL jagmisc.10003D7F 1000718F |. 59 POP ECX ; kernel32.7C816FD7 10007190 \. C3 RETN 10007191 > 33C0 XOR EAX,EAX 10007193 . 83FE E0 CMP ESI,-20 10007196 . 77 16 JA SHORT jagmisc.100071AE 10007198 . 3BF3 CMP ESI,EBX 1000719A . 75 03 JNZ SHORT jagmisc.1000719F 1000719C . 33F6 XOR ESI,ESI 1000719E . 46 INC ESI 1000719F > 56 PUSH ESI ; /NewSize = 0 100071A0 . 57 PUSH EDI ; |pMemory = NULL 100071A1 . 53 PUSH EBX ; |Flags = 0 100071A2 . FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000 100071A8 . FF15 CC800010 CALL DWORD PTR DS:[<&KERNEL32.HeapReAlloc>] ; \HeapReAlloc 100071AE > 3BC3 CMP EAX,EBX 100071B0 . 75 15 JNZ SHORT jagmisc.100071C7 100071B2 . 391D 90AF0010 CMP DWORD PTR DS:[1000AF90],EBX 100071B8 . 74 0D JE SHORT jagmisc.100071C7 100071BA . 56 PUSH ESI 100071BB . E8 7FE2FFFF CALL jagmisc.1000543F 100071C0 . 59 POP ECX ; kernel32.7C816FD7 100071C1 . 85C0 TEST EAX,EAX 100071C3 .^ 75 CC JNZ SHORT jagmisc.10007191 100071C5 > 33C0 XOR EAX,EAX 100071C7 > E8 DFB1FFFF CALL jagmisc.100023AB 100071CC . C3 RETN 100071CD /$ 6A 10 PUSH 10 100071CF |. 68 50910010 PUSH jagmisc.10009150 100071D4 |. E8 97B1FFFF CALL jagmisc.10002370 100071D9 |. 833D 64B30010 03 CMP DWORD PTR DS:[1000B364],3 100071E0 |. 75 3A JNZ SHORT jagmisc.1000721C 100071E2 |. 6A 04 PUSH 4 ; /Arg1 = 00000004 100071E4 |. E8 4BCCFFFF CALL jagmisc.10003E34 ; \jagmisc.10003E34 100071E9 |. 59 POP ECX ; kernel32.7C816FD7 100071EA |. 8365 FC 00 AND [LOCAL.1],0 100071EE |. 8B75 08 MOV ESI,[ARG.1] 100071F1 |. 56 PUSH ESI 100071F2 |. E8 56D4FFFF CALL jagmisc.1000464D 100071F7 |. 59 POP ECX ; kernel32.7C816FD7 100071F8 |. 8945 E0 MOV [LOCAL.8],EAX 100071FB |. 85C0 TEST EAX,EAX 100071FD |. 74 0B JE SHORT jagmisc.1000720A 100071FF |. 8B76 FC MOV ESI,DWORD PTR DS:[ESI-4] 10007202 |. 83EE 09 SUB ESI,9 10007205 |. 8975 E4 MOV [LOCAL.7],ESI 10007208 |. EB 03 JMP SHORT jagmisc.1000720D 1000720A |> 8B75 E4 MOV ESI,[LOCAL.7] 1000720D |> 834D FC FF OR [LOCAL.1],FFFFFFFF 10007211 |. E8 24000000 CALL jagmisc.1000723A 10007216 |. 837D E0 00 CMP [LOCAL.8],0 1000721A |. 75 13 JNZ SHORT jagmisc.1000722F 1000721C |> FF75 08 PUSH [ARG.1] ; /pMemory = FFFFFFFF 1000721F |. 6A 00 PUSH 0 ; |Flags = 0 10007221 |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000 10007227 |. FF15 04810010 CALL DWORD PTR DS:[<&KERNEL32.HeapSize>] ; \HeapSize 1000722D |. 8BF0 MOV ESI,EAX 1000722F |> 8BC6 MOV EAX,ESI 10007231 |. E8 75B1FFFF CALL jagmisc.100023AB 10007236 \. C3 RETN 10007237 8B DB 8B 10007238 75 DB 75 ; CHAR 'u' 10007239 E4 DB E4 1000723A /$ 6A 04 PUSH 4 1000723C |. E8 3ECBFFFF CALL jagmisc.10003D7F 10007241 |. 59 POP ECX ; kernel32.7C816FD7 10007242 \. C3 RETN 10007243 /$ 55 PUSH EBP 10007244 |. 8BEC MOV EBP,ESP 10007246 |. 83EC 0C SUB ESP,0C 10007249 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 1000724E |. 6A 06 PUSH 6 ; /BufSize = 6 10007250 |. 8945 FC MOV [LOCAL.1],EAX ; | 10007253 |. 8D45 F4 LEA EAX,[LOCAL.3] ; | 10007256 |. 50 PUSH EAX ; |Buffer = 00000008 10007257 |. 68 04100000 PUSH 1004 ; |InfoType = 1004 1000725C |. FF75 08 PUSH [ARG.1] ; |LocaleId = FFFFFFFF 1000725F |. C645 FA 00 MOV BYTE PTR SS:[EBP-6],0 ; | 10007263 |. FF15 F8800010 CALL DWORD PTR DS:[<&KERNEL32.GetLocaleInfoA>] ; \GetLocaleInfoA 10007269 |. 85C0 TEST EAX,EAX 1000726B |. 75 05 JNZ SHORT jagmisc.10007272 1000726D |. 83C8 FF OR EAX,FFFFFFFF 10007270 |. EB 0A JMP SHORT jagmisc.1000727C 10007272 |> 8D45 F4 LEA EAX,[LOCAL.3] 10007275 |. 50 PUSH EAX 10007276 |. E8 C3050000 CALL jagmisc.1000783E 1000727B |. 59 POP ECX ; kernel32.7C816FD7 1000727C |> 8B4D FC MOV ECX,[LOCAL.1] 1000727F |. E8 72C8FFFF CALL jagmisc.10003AF6 10007284 |. C9 LEAVE 10007285 \. C3 RETN 10007286 $ 6A 38 PUSH 38 10007288 . 68 60910010 PUSH jagmisc.10009160 1000728D . E8 DEB0FFFF CALL jagmisc.10002370 10007292 . A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 10007297 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 1000729A . 33FF XOR EDI,EDI 1000729C . 897D CC MOV DWORD PTR SS:[EBP-34],EDI 1000729F . 897D BC MOV DWORD PTR SS:[EBP-44],EDI 100072A2 . 8B45 14 MOV EAX,DWORD PTR SS:[EBP+14] 100072A5 . 8B18 MOV EBX,DWORD PTR DS:[EAX] 100072A7 . 895D C0 MOV DWORD PTR SS:[EBP-40],EBX 100072AA . 897D C4 MOV DWORD PTR SS:[EBP-3C],EDI 100072AD . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 100072B0 . 3B45 0C CMP EAX,DWORD PTR SS:[EBP+C] 100072B3 . 0F84 73010000 JE jagmisc.1000742C 100072B9 . 8D4D D0 LEA ECX,DWORD PTR SS:[EBP-30] 100072BC . 51 PUSH ECX ; /pCPInfo = FFFFFFFF 100072BD . 50 PUSH EAX ; |CodePage = 8 100072BE . 8B35 C4800010 MOV ESI,DWORD PTR DS:[<&KERNEL32.GetCPInfo>] ; |kernel32.GetCPInfo 100072C4 . FFD6 CALL ESI ; \GetCPInfo 100072C6 . 85C0 TEST EAX,EAX 100072C8 . 74 20 JE SHORT jagmisc.100072EA 100072CA . 837D D0 01 CMP DWORD PTR SS:[EBP-30],1 100072CE . 75 1A JNZ SHORT jagmisc.100072EA 100072D0 . 8D45 D0 LEA EAX,DWORD PTR SS:[EBP-30] 100072D3 . 50 PUSH EAX ; /pCPInfo = 00000008 100072D4 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |CodePage = 7FFD9000 100072D7 . FFD6 CALL ESI ; \GetCPInfo 100072D9 . 85C0 TEST EAX,EAX 100072DB . 74 0D JE SHORT jagmisc.100072EA 100072DD . 837D D0 01 CMP DWORD PTR SS:[EBP-30],1 100072E1 . 75 07 JNZ SHORT jagmisc.100072EA 100072E3 . C745 C4 01000000 MOV DWORD PTR SS:[EBP-3C],1 100072EA > 397D C4 CMP DWORD PTR SS:[EBP-3C],EDI 100072ED . 74 1A JE SHORT jagmisc.10007309 100072EF . 83FB FF CMP EBX,-1 100072F2 . 74 04 JE SHORT jagmisc.100072F8 100072F4 . 8BF3 MOV ESI,EBX 100072F6 . EB 0C JMP SHORT jagmisc.10007304 100072F8 > FF75 10 PUSH DWORD PTR SS:[EBP+10] 100072FB . E8 A0C4FFFF CALL jagmisc.100037A0 10007300 . 59 POP ECX ; kernel32.7C816FD7 10007301 . 8BF0 MOV ESI,EAX 10007303 . 46 INC ESI 10007304 > 8975 C8 MOV DWORD PTR SS:[EBP-38],ESI 10007307 . EB 03 JMP SHORT jagmisc.1000730C 10007309 > 8B75 C8 MOV ESI,DWORD PTR SS:[EBP-38] 1000730C > 397D C4 CMP DWORD PTR SS:[EBP-3C],EDI 1000730F . 75 1A JNZ SHORT jagmisc.1000732B 10007311 . 57 PUSH EDI ; /WideBufSize = 0 10007312 . 57 PUSH EDI ; |WideCharBuf = NULL 10007313 . 53 PUSH EBX ; |StringSize = 0 10007314 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |StringToMap = 8054A6ED ??? 10007317 . 6A 01 PUSH 1 ; |Options = MB_PRECOMPOSED 10007319 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |CodePage = FFFFFFFF 1000731C . FF15 E4800010 CALL DWORD PTR DS:[<&KERNEL32.MultiByteToWideChar>] ; \MultiByteToWideChar 10007322 . 8BF0 MOV ESI,EAX 10007324 . 8975 C8 MOV DWORD PTR SS:[EBP-38],ESI 10007327 . 3BF7 CMP ESI,EDI 10007329 . 74 58 JE SHORT jagmisc.10007383 1000732B > 897D FC MOV DWORD PTR SS:[EBP-4],EDI 1000732E . 8D0436 LEA EAX,DWORD PTR DS:[ESI+ESI] 10007331 . 83C0 03 ADD EAX,3 10007334 . 83E0 FC AND EAX,FFFFFFFC 10007337 . E8 74BAFFFF CALL jagmisc.10002DB0 1000733C . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP 1000733F . 8BDC MOV EBX,ESP 10007341 . 895D B8 MOV DWORD PTR SS:[EBP-48],EBX 10007344 . 8D0436 LEA EAX,DWORD PTR DS:[ESI+ESI] 10007347 . 50 PUSH EAX 10007348 . 57 PUSH EDI 10007349 . 53 PUSH EBX 1000734A . E8 C1C7FFFF CALL jagmisc.10003B10 1000734F . 83C4 0C ADD ESP,0C 10007352 . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 10007356 . EB 17 JMP SHORT jagmisc.1000736F 10007358 . 33C0 XOR EAX,EAX 1000735A . 40 INC EAX 1000735B . C3 RETN 1000735C . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451 1000735F . E8 EB000000 CALL jagmisc.1000744F 10007364 . 33FF XOR EDI,EDI 10007366 . 33DB XOR EBX,EBX 10007368 . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF 1000736C . 8B75 C8 MOV ESI,DWORD PTR SS:[EBP-38] 1000736F > 3BDF CMP EBX,EDI 10007371 . 75 1E JNZ SHORT jagmisc.10007391 10007373 . 56 PUSH ESI 10007374 . 6A 02 PUSH 2 10007376 . E8 C6B1FFFF CALL jagmisc.10002541 1000737B . 59 POP ECX ; kernel32.7C816FD7 1000737C . 59 POP ECX ; kernel32.7C816FD7 1000737D . 8BD8 MOV EBX,EAX 1000737F . 3BDF CMP EBX,EDI 10007381 . 75 07 JNZ SHORT jagmisc.1000738A 10007383 > 33C0 XOR EAX,EAX 10007385 . E9 B4000000 JMP jagmisc.1000743E 1000738A > C745 BC 01000000 MOV DWORD PTR SS:[EBP-44],1 10007391 > 56 PUSH ESI ; /WideBufSize = 0 10007392 . 53 PUSH EBX ; |WideCharBuf = NULL 10007393 . FF75 C0 PUSH DWORD PTR SS:[EBP-40] ; |StringSize = 0 10007396 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |StringToMap = 8054A6ED ??? 10007399 . 6A 01 PUSH 1 ; |Options = MB_PRECOMPOSED 1000739B . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |CodePage = FFFFFFFF 1000739E . FF15 E4800010 CALL DWORD PTR DS:[<&KERNEL32.MultiByteToWideChar>] ; \MultiByteToWideChar 100073A4 . 85C0 TEST EAX,EAX 100073A6 . 0F84 83000000 JE jagmisc.1000742F 100073AC . 397D 18 CMP DWORD PTR SS:[EBP+18],EDI 100073AF . 74 20 JE SHORT jagmisc.100073D1 100073B1 . 57 PUSH EDI ; /pDefaultCharUsed = NULL 100073B2 . 57 PUSH EDI ; |pDefaultChar = NULL 100073B3 . FF75 1C PUSH DWORD PTR SS:[EBP+1C] ; |MultiByteCount = FFFFFFFF (-1.) 100073B6 . FF75 18 PUSH DWORD PTR SS:[EBP+18] ; |MultiByteStr = 8227C238 100073B9 . 56 PUSH ESI ; |WideCharCount = 0 100073BA . 53 PUSH EBX ; |WideCharStr = NULL 100073BB . 57 PUSH EDI ; |Options = 0 100073BC . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |CodePage = 7FFD9000 100073BF . FF15 A4800010 CALL DWORD PTR DS:[<&KERNEL32.WideCharToMultiByte>] ; \WideCharToMultiByte 100073C5 . 85C0 TEST EAX,EAX 100073C7 . 74 66 JE SHORT jagmisc.1000742F 100073C9 . 8B45 18 MOV EAX,DWORD PTR SS:[EBP+18] 100073CC . 8945 CC MOV DWORD PTR SS:[EBP-34],EAX 100073CF . EB 5E JMP SHORT jagmisc.1000742F 100073D1 > 397D C4 CMP DWORD PTR SS:[EBP-3C],EDI 100073D4 . 75 16 JNZ SHORT jagmisc.100073EC 100073D6 . 57 PUSH EDI ; /pDefaultCharUsed = NULL 100073D7 . 57 PUSH EDI ; |pDefaultChar = NULL 100073D8 . 57 PUSH EDI ; |MultiByteCount = 0 100073D9 . 57 PUSH EDI ; |MultiByteStr = NULL 100073DA . 56 PUSH ESI ; |WideCharCount = 0 100073DB . 53 PUSH EBX ; |WideCharStr = NULL 100073DC . 57 PUSH EDI ; |Options = 0 100073DD . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |CodePage = 7FFD9000 100073E0 . FF15 A4800010 CALL DWORD PTR DS:[<&KERNEL32.WideCharToMultiByte>] ; \WideCharToMultiByte 100073E6 . 8BF0 MOV ESI,EAX 100073E8 . 3BF7 CMP ESI,EDI 100073EA . 74 43 JE SHORT jagmisc.1000742F 100073EC > 56 PUSH ESI 100073ED . 6A 01 PUSH 1 100073EF . E8 4DB1FFFF CALL jagmisc.10002541 100073F4 . 59 POP ECX ; kernel32.7C816FD7 100073F5 . 59 POP ECX ; kernel32.7C816FD7 100073F6 . 8945 CC MOV DWORD PTR SS:[EBP-34],EAX 100073F9 . 3BC7 CMP EAX,EDI 100073FB . 74 32 JE SHORT jagmisc.1000742F 100073FD . 57 PUSH EDI ; /pDefaultCharUsed = NULL 100073FE . 57 PUSH EDI ; |pDefaultChar = NULL 100073FF . 56 PUSH ESI ; |MultiByteCount = 0 10007400 . 50 PUSH EAX ; |MultiByteStr = 00000008 10007401 . 56 PUSH ESI ; |WideCharCount = 0 10007402 . 53 PUSH EBX ; |WideCharStr = NULL 10007403 . 57 PUSH EDI ; |Options = 0 10007404 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |CodePage = 7FFD9000 10007407 . FF15 A4800010 CALL DWORD PTR DS:[<&KERNEL32.WideCharToMultiByte>] ; \WideCharToMultiByte 1000740D . 3BC7 CMP EAX,EDI 1000740F . 75 0E JNZ SHORT jagmisc.1000741F 10007411 . FF75 CC PUSH DWORD PTR SS:[EBP-34] 10007414 . E8 E4AEFFFF CALL jagmisc.100022FD 10007419 . 59 POP ECX ; kernel32.7C816FD7 1000741A . 897D CC MOV DWORD PTR SS:[EBP-34],EDI 1000741D . EB 10 JMP SHORT jagmisc.1000742F 1000741F > 837D C0 FF CMP DWORD PTR SS:[EBP-40],-1 10007423 . 74 0A JE SHORT jagmisc.1000742F 10007425 . 8B4D 14 MOV ECX,DWORD PTR SS:[EBP+14] 10007428 . 8901 MOV DWORD PTR DS:[ECX],EAX 1000742A . EB 03 JMP SHORT jagmisc.1000742F 1000742C > 8B5D B8 MOV EBX,DWORD PTR SS:[EBP-48] 1000742F > 397D BC CMP DWORD PTR SS:[EBP-44],EDI 10007432 . 74 07 JE SHORT jagmisc.1000743B 10007434 . 53 PUSH EBX 10007435 . E8 C3AEFFFF CALL jagmisc.100022FD 1000743A . 59 POP ECX ; kernel32.7C816FD7 1000743B > 8B45 CC MOV EAX,DWORD PTR SS:[EBP-34] 1000743E > 8D65 AC LEA ESP,DWORD PTR SS:[EBP-54] 10007441 . 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C] 10007444 . E8 ADC6FFFF CALL jagmisc.10003AF6 10007449 . E8 5DAFFFFF CALL jagmisc.100023AB 1000744E . C3 RETN 1000744F /$ 55 PUSH EBP 10007450 |. 8BEC MOV EBP,ESP 10007452 |. 83EC 4C SUB ESP,4C 10007455 |. 53 PUSH EBX 10007456 |. 56 PUSH ESI 10007457 |. 57 PUSH EDI 10007458 |. 6A 04 PUSH 4 1000745A |. 58 POP EAX ; kernel32.7C816FD7 1000745B |. E8 50B9FFFF CALL jagmisc.10002DB0 10007460 |. 8BF4 MOV ESI,ESP 10007462 |. 6A 1C PUSH 1C ; /BufSize = 1C (28.) 10007464 |. 8D45 D8 LEA EAX,[LOCAL.10] ; | 10007467 |. 50 PUSH EAX ; |Buffer = 00000008 10007468 |. 56 PUSH ESI ; |Address = NULL 10007469 |. FF15 D8800010 CALL DWORD PTR DS:[<&KERNEL32.VirtualQuery>] ; \VirtualQuery 1000746F |. 85C0 TEST EAX,EAX 10007471 |. 74 77 JE SHORT jagmisc.100074EA 10007473 |. 8B5D DC MOV EBX,[LOCAL.9] ; kernel32.7C802458 10007476 |. 8D45 B4 LEA EAX,[LOCAL.19] 10007479 |. 50 PUSH EAX ; /pSystemInfo = 00000008 1000747A |. FF15 0C810010 CALL DWORD PTR DS:[<&KERNEL32.GetSystemInfo>] ; \GetSystemInfo 10007480 |. 8B4D B8 MOV ECX,[LOCAL.18] 10007483 |. A1 8CAC0010 MOV EAX,DWORD PTR DS:[1000AC8C] 10007488 |. 8D79 FF LEA EDI,DWORD PTR DS:[ECX-1] 1000748B |. F7D7 NOT EDI 1000748D |. 23FE AND EDI,ESI 1000748F |. 2BF9 SUB EDI,ECX 10007491 |. 8BF0 MOV ESI,EAX 10007493 |. 4E DEC ESI 10007494 |. F7DE NEG ESI 10007496 |. 1BF6 SBB ESI,ESI 10007498 |. 83E6 F1 AND ESI,FFFFFFF1 1000749B |. 83C6 11 ADD ESI,11 1000749E |. 0FAFF1 IMUL ESI,ECX 100074A1 |. 03F3 ADD ESI,EBX 100074A3 |. 3BFE CMP EDI,ESI 100074A5 |. 894D F8 MOV [LOCAL.2],ECX 100074A8 |. 72 40 JB SHORT jagmisc.100074EA 100074AA |. 83F8 01 CMP EAX,1 100074AD |. 74 5C JE SHORT jagmisc.1000750B 100074AF |. 895D FC MOV [LOCAL.1],EBX 100074B2 |. BB 00100000 MOV EBX,1000 100074B7 |> 6A 1C /PUSH 1C ; /BufSize = 1C (28.) 100074B9 |. 8D45 D8 |LEA EAX,[LOCAL.10] ; | 100074BC |. 50 |PUSH EAX ; |Buffer = 00000008 100074BD |. FF75 FC |PUSH [LOCAL.1] ; |Address = NULL 100074C0 |. FF15 D8800010 |CALL DWORD PTR DS:[<&KERNEL32.VirtualQuery>] ; \VirtualQuery 100074C6 |. 85C0 |TEST EAX,EAX 100074C8 |. 74 20 |JE SHORT jagmisc.100074EA 100074CA |. 8B45 E4 |MOV EAX,[LOCAL.7] 100074CD |. 0145 FC |ADD [LOCAL.1],EAX 100074D0 |. 855D E8 |TEST [LOCAL.6],EBX 100074D3 |.^ 74 E2 \JE SHORT jagmisc.100074B7 100074D5 |. F645 ED 01 TEST BYTE PTR SS:[EBP-13],1 100074D9 |. 8B45 D8 MOV EAX,[LOCAL.10] ; kernel32.7C839AA8 100074DC |. 8945 FC MOV [LOCAL.1],EAX 100074DF |. 74 05 JE SHORT jagmisc.100074E6 100074E1 |. 33C0 XOR EAX,EAX 100074E3 |. 40 INC EAX 100074E4 |. EB 44 JMP SHORT jagmisc.1000752A 100074E6 |> 3BF8 CMP EDI,EAX 100074E8 |. 73 04 JNB SHORT jagmisc.100074EE 100074EA |> 33C0 XOR EAX,EAX 100074EC |. EB 3C JMP SHORT jagmisc.1000752A 100074EE |> 3BC6 CMP EAX,ESI 100074F0 |. 73 03 JNB SHORT jagmisc.100074F5 100074F2 |. 8975 FC MOV [LOCAL.1],ESI 100074F5 |> 6A 04 PUSH 4 ; /Protect = PAGE_READWRITE 100074F7 |. 53 PUSH EBX ; |AllocationType = 0 100074F8 |. FF75 F8 PUSH [LOCAL.2] ; |Size = 410249 (4260425.) 100074FB |. FF75 FC PUSH [LOCAL.1] ; |Address = NULL 100074FE |. FF15 C8800010 CALL DWORD PTR DS:[<&KERNEL32.VirtualAlloc>] ; \VirtualAlloc 10007504 |. A1 8CAC0010 MOV EAX,DWORD PTR DS:[1000AC8C] 10007509 |. EB 03 JMP SHORT jagmisc.1000750E 1000750B |> 897D FC MOV [LOCAL.1],EDI 1000750E |> 48 DEC EAX 1000750F |. F7D8 NEG EAX 10007511 |. 1BC0 SBB EAX,EAX 10007513 |. 25 03010000 AND EAX,103 10007518 |. 8D4D F4 LEA ECX,[LOCAL.3] 1000751B |. 51 PUSH ECX ; /pOldProtect = FFFFFFFF 1000751C |. 40 INC EAX ; | 1000751D |. 50 PUSH EAX ; |NewProtect = PAGE_WRITECOPY 1000751E |. FF75 F8 PUSH [LOCAL.2] ; |Size = 410249 (4260425.) 10007521 |. FF75 FC PUSH [LOCAL.1] ; |Address = NULL 10007524 |. FF15 08810010 CALL DWORD PTR DS:[<&KERNEL32.VirtualProtect>] ; \VirtualProtect 1000752A |> 8D65 A8 LEA ESP,[LOCAL.22] 1000752D |. 5F POP EDI ; kernel32.7C816FD7 1000752E |. 5E POP ESI ; kernel32.7C816FD7 1000752F |. 5B POP EBX ; kernel32.7C816FD7 10007530 |. C9 LEAVE 10007531 \. C3 RETN 10007532 /$ 55 PUSH EBP 10007533 |. 8BEC MOV EBP,ESP 10007535 |. 83EC 28 SUB ESP,28 10007538 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 1000753D |. 53 PUSH EBX 1000753E |. 8B5D 0C MOV EBX,[ARG.2] 10007541 |. 8945 FC MOV [LOCAL.1],EAX 10007544 |. 33C0 XOR EAX,EAX 10007546 |. 33C9 XOR ECX,ECX 10007548 |. 66:8B4B 0A MOV CX,WORD PTR DS:[EBX+A] 1000754C |. 56 PUSH ESI 1000754D |. 8B75 08 MOV ESI,[ARG.1] 10007550 |. 8945 E4 MOV [LOCAL.7],EAX 10007553 |. 8945 F0 MOV [LOCAL.4],EAX 10007556 |. 8945 F4 MOV [LOCAL.3],EAX 10007559 |. 8945 F8 MOV [LOCAL.2],EAX 1000755C |. 66:8B46 0A MOV AX,WORD PTR DS:[ESI+A] 10007560 |. 57 PUSH EDI 10007561 |. 8BF9 MOV EDI,ECX 10007563 |. BA FF7F0000 MOV EDX,7FFF 10007568 |. 23CA AND ECX,EDX 1000756A |. 33F8 XOR EDI,EAX 1000756C |. 23C2 AND EAX,EDX 1000756E |. 81E7 00800000 AND EDI,8000 10007574 |. 66:3D FF7F CMP AX,7FFF 10007578 |. 8D1401 LEA EDX,DWORD PTR DS:[ECX+EAX] 1000757B |. 8955 08 MOV [ARG.1],EDX 1000757E |. 0F83 B8010000 JNB jagmisc.1000773C 10007584 |. 66:81F9 FF7F CMP CX,7FFF 10007589 |. 0F83 AD010000 JNB jagmisc.1000773C 1000758F |. 66:81FA FDBF CMP DX,0BFFD 10007594 |. 0F87 A2010000 JA jagmisc.1000773C 1000759A |. 66:81FA BF3F CMP DX,3FBF 1000759F |. 77 04 JA SHORT jagmisc.100075A5 100075A1 |. 33C0 XOR EAX,EAX 100075A3 |. EB 3A JMP SHORT jagmisc.100075DF 100075A5 |> 66:85C0 TEST AX,AX 100075A8 |. BA FFFFFF7F MOV EDX,7FFFFFFF 100075AD |. 75 18 JNZ SHORT jagmisc.100075C7 100075AF |. FF45 08 INC [ARG.1] 100075B2 |. 33C0 XOR EAX,EAX 100075B4 |. 8556 08 TEST DWORD PTR DS:[ESI+8],EDX 100075B7 |. 75 10 JNZ SHORT jagmisc.100075C9 100075B9 |. 3946 04 CMP DWORD PTR DS:[ESI+4],EAX 100075BC |. 75 0B JNZ SHORT jagmisc.100075C9 100075BE |. 3906 CMP DWORD PTR DS:[ESI],EAX 100075C0 |. 75 07 JNZ SHORT jagmisc.100075C9 100075C2 |. E9 6F010000 JMP jagmisc.10007736 100075C7 |> 33C0 XOR EAX,EAX 100075C9 |> 66:3BC8 CMP CX,AX 100075CC |. 75 1E JNZ SHORT jagmisc.100075EC 100075CE |. FF45 08 INC [ARG.1] 100075D1 |. 8553 08 TEST DWORD PTR DS:[EBX+8],EDX 100075D4 |. 75 16 JNZ SHORT jagmisc.100075EC 100075D6 |. 3943 04 CMP DWORD PTR DS:[EBX+4],EAX 100075D9 |. 75 11 JNZ SHORT jagmisc.100075EC 100075DB |. 3903 CMP DWORD PTR DS:[EBX],EAX 100075DD |. 75 0D JNZ SHORT jagmisc.100075EC 100075DF |> 8946 08 MOV DWORD PTR DS:[ESI+8],EAX 100075E2 |. 8946 04 MOV DWORD PTR DS:[ESI+4],EAX 100075E5 |. 8906 MOV DWORD PTR DS:[ESI],EAX 100075E7 |. E9 6B010000 JMP jagmisc.10007757 100075EC |> 8945 E8 MOV [LOCAL.6],EAX 100075EF |. 8D45 F4 LEA EAX,[LOCAL.3] 100075F2 |. 8945 EC MOV [LOCAL.5],EAX 100075F5 |. C745 0C 05000000 MOV [ARG.2],5 100075FC |> 8B45 E8 /MOV EAX,[LOCAL.6] ; kernel32.7C802451 100075FF |. 03C0 |ADD EAX,EAX 10007601 |. 837D 0C 00 |CMP [ARG.2],0 10007605 |. 7E 49 |JLE SHORT jagmisc.10007650 10007607 |. 03C6 |ADD EAX,ESI 10007609 |. 8945 DC |MOV [LOCAL.9],EAX 1000760C |. 8B45 0C |MOV EAX,[ARG.2] 1000760F |. 8D4B 08 |LEA ECX,DWORD PTR DS:[EBX+8] 10007612 |. 894D E0 |MOV [LOCAL.8],ECX 10007615 |. 8945 D8 |MOV [LOCAL.10],EAX 10007618 |> 8B45 E0 |/MOV EAX,[LOCAL.8] 1000761B |. 8B4D DC ||MOV ECX,[LOCAL.9] ; kernel32.7C802458 1000761E |. 0FB709 ||MOVZX ECX,WORD PTR DS:[ECX] 10007621 |. 0FB700 ||MOVZX EAX,WORD PTR DS:[EAX] 10007624 |. 0FAFC1 ||IMUL EAX,ECX 10007627 |. 8B4D EC ||MOV ECX,[LOCAL.5] 1000762A |. 83C1 FC ||ADD ECX,-4 1000762D |. 51 ||PUSH ECX 1000762E |. 50 ||PUSH EAX 1000762F |. FF31 ||PUSH DWORD PTR DS:[ECX] 10007631 |. E8 11E9FFFF ||CALL jagmisc.10005F47 10007636 |. 83C4 0C ||ADD ESP,0C 10007639 |. 85C0 ||TEST EAX,EAX 1000763B |. 74 06 ||JE SHORT jagmisc.10007643 1000763D |. 8B45 EC ||MOV EAX,[LOCAL.5] 10007640 |. 66:FF00 ||INC WORD PTR DS:[EAX] 10007643 |> 8345 DC 02 ||ADD [LOCAL.9],2 10007647 |. 836D E0 02 ||SUB [LOCAL.8],2 1000764B |. FF4D D8 ||DEC [LOCAL.10] ; kernel32.7C839AA8 1000764E |.^ 75 C8 |\JNZ SHORT jagmisc.10007618 10007650 |> 8345 EC 02 |ADD [LOCAL.5],2 10007654 |. FF45 E8 |INC [LOCAL.6] ; kernel32.7C802451 10007657 |. FF4D 0C |DEC [ARG.2] 1000765A |. 837D 0C 00 |CMP [ARG.2],0 1000765E |.^ 7F 9C \JG SHORT jagmisc.100075FC 10007660 |. 8145 08 02C00000 ADD [ARG.1],0C002 10007667 |. 66:837D 08 00 CMP WORD PTR SS:[EBP+8],0 1000766C |. 7E 25 JLE SHORT jagmisc.10007693 1000766E |> F645 FB 80 /TEST BYTE PTR SS:[EBP-5],80 10007672 |. 75 18 |JNZ SHORT jagmisc.1000768C 10007674 |. 8D45 F0 |LEA EAX,[LOCAL.4] 10007677 |. 50 |PUSH EAX 10007678 |. E8 49E9FFFF |CALL jagmisc.10005FC6 1000767D |. 8145 08 FFFF0000 |ADD [ARG.1],0FFFF 10007684 |. 66:837D 08 00 |CMP WORD PTR SS:[EBP+8],0 10007689 |. 59 |POP ECX ; kernel32.7C816FD7 1000768A |.^ 7F E2 \JG SHORT jagmisc.1000766E 1000768C |> 66:837D 08 00 CMP WORD PTR SS:[EBP+8],0 10007691 |. 7F 39 JG SHORT jagmisc.100076CC 10007693 |> 8145 08 FFFF0000 ADD [ARG.1],0FFFF 1000769A |. 66:837D 08 00 CMP WORD PTR SS:[EBP+8],0 1000769F |. 7D 2B JGE SHORT jagmisc.100076CC 100076A1 |. 8B45 08 MOV EAX,[ARG.1] 100076A4 |. F7D8 NEG EAX 100076A6 |. 0FB7D8 MOVZX EBX,AX 100076A9 |. 015D 08 ADD [ARG.1],EBX 100076AC |> F645 F0 01 /TEST BYTE PTR SS:[EBP-10],1 100076B0 |. 74 03 |JE SHORT jagmisc.100076B5 100076B2 |. FF45 E4 |INC [LOCAL.7] 100076B5 |> 8D45 F0 |LEA EAX,[LOCAL.4] 100076B8 |. 50 |PUSH EAX 100076B9 |. E8 36E9FFFF |CALL jagmisc.10005FF4 100076BE |. 4B |DEC EBX 100076BF |. 59 |POP ECX ; kernel32.7C816FD7 100076C0 |.^ 75 EA \JNZ SHORT jagmisc.100076AC 100076C2 |. 837D E4 00 CMP [LOCAL.7],0 100076C6 |. 74 04 JE SHORT jagmisc.100076CC 100076C8 |. 804D F0 01 OR BYTE PTR SS:[EBP-10],1 100076CC |> 66:817D F0 0080 CMP WORD PTR SS:[EBP-10],8000 100076D2 |. 77 0F JA SHORT jagmisc.100076E3 100076D4 |. 8B45 F0 MOV EAX,[LOCAL.4] 100076D7 |. 25 FFFF0100 AND EAX,1FFFF 100076DC |. 3D 00800100 CMP EAX,18000 100076E1 |. 75 35 JNZ SHORT jagmisc.10007718 100076E3 |> 837D F2 FF CMP DWORD PTR SS:[EBP-E],-1 100076E7 |. 75 2C JNZ SHORT jagmisc.10007715 100076E9 |. 8365 F2 00 AND DWORD PTR SS:[EBP-E],0 100076ED |. 837D F6 FF CMP DWORD PTR SS:[EBP-A],-1 100076F1 |. 75 1D JNZ SHORT jagmisc.10007710 100076F3 |. 8365 F6 00 AND DWORD PTR SS:[EBP-A],0 100076F7 |. 66:817D FA FFFF CMP WORD PTR SS:[EBP-6],0FFFF 100076FD |. 75 0B JNZ SHORT jagmisc.1000770A 100076FF |. FF45 08 INC [ARG.1] 10007702 |. 66:C745 FA 0080 MOV WORD PTR SS:[EBP-6],8000 10007708 |. EB 0E JMP SHORT jagmisc.10007718 1000770A |> 66:FF45 FA INC WORD PTR SS:[EBP-6] 1000770E |. EB 08 JMP SHORT jagmisc.10007718 10007710 |> FF45 F6 INC DWORD PTR SS:[EBP-A] 10007713 |. EB 03 JMP SHORT jagmisc.10007718 10007715 |> FF45 F2 INC DWORD PTR SS:[EBP-E] 10007718 |> 8B45 08 MOV EAX,[ARG.1] 1000771B |. 66:3D FF7F CMP AX,7FFF 1000771F |. 73 1B JNB SHORT jagmisc.1000773C 10007721 |. 66:8B4D F2 MOV CX,WORD PTR SS:[EBP-E] 10007725 |. 66:890E MOV WORD PTR DS:[ESI],CX 10007728 |. 8B4D F4 MOV ECX,[LOCAL.3] 1000772B |. 894E 02 MOV DWORD PTR DS:[ESI+2],ECX 1000772E |. 8B4D F8 MOV ECX,[LOCAL.2] ; LOADDLL.00410249 10007731 |. 894E 06 MOV DWORD PTR DS:[ESI+6],ECX 10007734 |. 0BC7 OR EAX,EDI 10007736 |> 66:8946 0A MOV WORD PTR DS:[ESI+A],AX 1000773A |. EB 1B JMP SHORT jagmisc.10007757 1000773C |> 66:F7DF NEG DI 1000773F |. 1BFF SBB EDI,EDI 10007741 |. 8366 04 00 AND DWORD PTR DS:[ESI+4],0 10007745 |. 81E7 00000080 AND EDI,80000000 1000774B |. 81C7 0080FF7F ADD EDI,7FFF8000 10007751 |. 8326 00 AND DWORD PTR DS:[ESI],0 10007754 |. 897E 08 MOV DWORD PTR DS:[ESI+8],EDI 10007757 |> 8B4D FC MOV ECX,[LOCAL.1] 1000775A |. 5F POP EDI ; kernel32.7C816FD7 1000775B |. 5E POP ESI ; kernel32.7C816FD7 1000775C |. 5B POP EBX ; kernel32.7C816FD7 1000775D |. E8 94C3FFFF CALL jagmisc.10003AF6 10007762 |. C9 LEAVE 10007763 \. C3 RETN 10007764 /$ 55 PUSH EBP 10007765 |. 8BEC MOV EBP,ESP 10007767 |. 83EC 10 SUB ESP,10 1000776A |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360] 1000776F |. 53 PUSH EBX 10007770 |. BB F0A80010 MOV EBX,jagmisc.1000A8F0 10007775 |. 33C9 XOR ECX,ECX 10007777 |. 83EB 60 SUB EBX,60 1000777A |. 394D 0C CMP [ARG.2],ECX 1000777D |. 8945 FC MOV [LOCAL.1],EAX 10007780 |. 74 5D JE SHORT jagmisc.100077DF 10007782 |. 7D 0B JGE SHORT jagmisc.1000778F 10007784 |. F75D 0C NEG [ARG.2] 10007787 |. BB 50AA0010 MOV EBX,jagmisc.1000AA50 1000778C |. 83EB 60 SUB EBX,60 1000778F |> 394D 10 CMP [ARG.3],ECX 10007792 |. 75 06 JNZ SHORT jagmisc.1000779A 10007794 |. 8B45 08 MOV EAX,[ARG.1] 10007797 |. 66:8908 MOV WORD PTR DS:[EAX],CX 1000779A |> 394D 0C CMP [ARG.2],ECX 1000779D |. 74 40 JE SHORT jagmisc.100077DF 1000779F |. 56 PUSH ESI 100077A0 |. 57 PUSH EDI 100077A1 |> 8B45 0C /MOV EAX,[ARG.2] 100077A4 |. C17D 0C 03 |SAR [ARG.2],3 100077A8 |. 83E0 07 |AND EAX,7 100077AB |. 83C3 54 |ADD EBX,54 100077AE |. 3BC1 |CMP EAX,ECX 100077B0 |. 74 26 |JE SHORT jagmisc.100077D8 100077B2 |. 8D0440 |LEA EAX,DWORD PTR DS:[EAX+EAX*2] 100077B5 |. 8D3483 |LEA ESI,DWORD PTR DS:[EBX+EAX*4] 100077B8 |. 66:813E 0080 |CMP WORD PTR DS:[ESI],8000 100077BD |. 72 0C |JB SHORT jagmisc.100077CB 100077BF |. 8D7D F0 |LEA EDI,[LOCAL.4] 100077C2 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 100077C3 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 100077C4 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] 100077C5 |. FF4D F2 |DEC DWORD PTR SS:[EBP-E] 100077C8 |. 8D75 F0 |LEA ESI,[LOCAL.4] 100077CB |> 56 |PUSH ESI 100077CC |. FF75 08 |PUSH [ARG.1] 100077CF |. E8 5EFDFFFF |CALL jagmisc.10007532 100077D4 |. 59 |POP ECX ; kernel32.7C816FD7 100077D5 |. 59 |POP ECX ; kernel32.7C816FD7 100077D6 |. 33C9 |XOR ECX,ECX 100077D8 |> 394D 0C |CMP [ARG.2],ECX 100077DB |.^ 75 C4 \JNZ SHORT jagmisc.100077A1 100077DD |. 5F POP EDI ; kernel32.7C816FD7 100077DE |. 5E POP ESI ; kernel32.7C816FD7 100077DF |> 8B4D FC MOV ECX,[LOCAL.1] 100077E2 |. 5B POP EBX ; kernel32.7C816FD7 100077E3 |. E8 0EC3FFFF CALL jagmisc.10003AF6 100077E8 |. C9 LEAVE 100077E9 \. C3 RETN 100077EA CC INT3 100077EB CC INT3 100077EC CC INT3 100077ED CC INT3 100077EE CC INT3 100077EF CC INT3 100077F0 /. 55 PUSH EBP 100077F1 |. 8BEC MOV EBP,ESP 100077F3 |. 57 PUSH EDI 100077F4 |. 56 PUSH ESI 100077F5 |. 53 PUSH EBX 100077F6 |. 8B75 0C MOV ESI,[ARG.2] 100077F9 |. 8B7D 08 MOV EDI,[ARG.1] 100077FC |. B0 FF MOV AL,0FF 100077FE |. 8BFF MOV EDI,EDI 10007800 |> 0AC0 /OR AL,AL 10007802 |. 74 32 |JE SHORT jagmisc.10007836 10007804 |. 8A06 |MOV AL,BYTE PTR DS:[ESI] 10007806 |. 83C6 01 |ADD ESI,1 10007809 |. 8A27 |MOV AH,BYTE PTR DS:[EDI] 1000780B |. 83C7 01 |ADD EDI,1 1000780E |. 38C4 |CMP AH,AL 10007810 |.^ 74 EE |JE SHORT jagmisc.10007800 10007812 |. 2C 41 |SUB AL,41 10007814 |. 3C 1A |CMP AL,1A 10007816 |. 1AC9 |SBB CL,CL 10007818 |. 80E1 20 |AND CL,20 1000781B |. 02C1 |ADD AL,CL 1000781D |. 04 41 |ADD AL,41 1000781F |. 86E0 |XCHG AL,AH 10007821 |. 2C 41 |SUB AL,41 10007823 |. 3C 1A |CMP AL,1A 10007825 |. 1AC9 |SBB CL,CL 10007827 |. 80E1 20 |AND CL,20 1000782A |. 02C1 |ADD AL,CL 1000782C |. 04 41 |ADD AL,41 1000782E |. 38E0 |CMP AL,AH 10007830 |.^ 74 CE \JE SHORT jagmisc.10007800 10007832 |. 1AC0 SBB AL,AL 10007834 |. 1C FF SBB AL,0FF 10007836 |> 0FBEC0 MOVSX EAX,AL 10007839 |. 5B POP EBX ; kernel32.7C816FD7 1000783A |. 5E POP ESI ; kernel32.7C816FD7 1000783B |. 5F POP EDI ; kernel32.7C816FD7 1000783C |. C9 LEAVE 1000783D \. C3 RETN 1000783E /$ 56 PUSH ESI 1000783F |. 57 PUSH EDI 10007840 |. E8 BCA4FFFF CALL jagmisc.10001D01 10007845 |. 8B78 64 MOV EDI,DWORD PTR DS:[EAX+64] 10007848 |. 3B3D ECA40010 CMP EDI,DWORD PTR DS:[1000A4EC] ; jagmisc.1000A498 1000784E |. 74 07 JE SHORT jagmisc.10007857 10007850 |. E8 A1C7FFFF CALL jagmisc.10003FF6 10007855 |. 8BF8 MOV EDI,EAX 10007857 |> 8B7424 0C MOV ESI,DWORD PTR SS:[ESP+C] 1000785B |> 837F 28 01 /CMP DWORD PTR DS:[EDI+28],1 1000785F |. 0FB606 |MOVZX EAX,BYTE PTR DS:[ESI] 10007862 |. 7E 0E |JLE SHORT jagmisc.10007872 10007864 |. 6A 08 |PUSH 8 10007866 |. 50 |PUSH EAX 10007867 |. 57 |PUSH EDI 10007868 |. E8 A7E2FFFF |CALL jagmisc.10005B14 1000786D |. 83C4 0C |ADD ESP,0C 10007870 |. EB 0A |JMP SHORT jagmisc.1000787C 10007872 |> 8B4F 48 |MOV ECX,DWORD PTR DS:[EDI+48] 10007875 |. 0FB60441 |MOVZX EAX,BYTE PTR DS:[ECX+EAX*2] 10007879 |. 83E0 08 |AND EAX,8 1000787C |> 85C0 |TEST EAX,EAX 1000787E |. 74 03 |JE SHORT jagmisc.10007883 10007880 |. 46 |INC ESI 10007881 |.^ EB D8 \JMP SHORT jagmisc.1000785B 10007883 |> 0FB60E MOVZX ECX,BYTE PTR DS:[ESI] 10007886 |. 46 INC ESI 10007887 |. 83F9 2D CMP ECX,2D 1000788A |. 8BD1 MOV EDX,ECX 1000788C |. 74 05 JE SHORT jagmisc.10007893 1000788E |. 83F9 2B CMP ECX,2B 10007891 |. 75 04 JNZ SHORT jagmisc.10007897 10007893 |> 0FB60E MOVZX ECX,BYTE PTR DS:[ESI] 10007896 |. 46 INC ESI 10007897 |> 33C0 XOR EAX,EAX 10007899 |> 83F9 30 /CMP ECX,30 1000789C |. 7C 0A |JL SHORT jagmisc.100078A8 1000789E |. 83F9 39 |CMP ECX,39 100078A1 |. 7F 05 |JG SHORT jagmisc.100078A8 100078A3 |. 83E9 30 |SUB ECX,30 100078A6 |. EB 03 |JMP SHORT jagmisc.100078AB 100078A8 |> 83C9 FF |OR ECX,FFFFFFFF 100078AB |> 83F9 FF |CMP ECX,-1 100078AE |. 74 0C |JE SHORT jagmisc.100078BC 100078B0 |. 8D0480 |LEA EAX,DWORD PTR DS:[EAX+EAX*4] 100078B3 |. 8D0441 |LEA EAX,DWORD PTR DS:[ECX+EAX*2] 100078B6 |. 0FB60E |MOVZX ECX,BYTE PTR DS:[ESI] 100078B9 |. 46 |INC ESI 100078BA |.^ EB DD \JMP SHORT jagmisc.10007899 100078BC |> 83FA 2D CMP EDX,2D 100078BF |. 5F POP EDI ; kernel32.7C816FD7 100078C0 |. 5E POP ESI ; kernel32.7C816FD7 100078C1 |. 75 02 JNZ SHORT jagmisc.100078C5 100078C3 |. F7D8 NEG EAX 100078C5 \> C3 RETN 100078C6 CC INT3 100078C7 CC INT3 100078C8 CC INT3 100078C9 CC INT3 100078CA CC INT3 100078CB CC INT3 100078CC CC INT3 100078CD CC INT3 100078CE CC INT3 100078CF CC INT3 100078D0 . 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 100078D4 . 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 100078D8 . 0BC8 OR ECX,EAX 100078DA . 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C] 100078DE . 75 09 JNZ SHORT jagmisc.100078E9 100078E0 . 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738 100078E4 . F7E1 MUL ECX 100078E6 . C2 1000 RETN 10 100078E9 > 53 PUSH EBX 100078EA . F7E1 MUL ECX 100078EC . 8BD8 MOV EBX,EAX 100078EE . 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 100078F2 . F76424 14 MUL DWORD PTR SS:[ESP+14] 100078F6 . 03D8 ADD EBX,EAX 100078F8 . 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 100078FC . F7E1 MUL ECX 100078FE . 03D3 ADD EDX,EBX 10007900 . 5B POP EBX ; kernel32.7C816FD7 10007901 . C2 1000 RETN 10 10007904 CC INT3 10007905 CC INT3 10007906 CC INT3 10007907 CC INT3 10007908 CC INT3 10007909 CC INT3 1000790A CC INT3 1000790B CC INT3 1000790C CC INT3 1000790D CC INT3 1000790E CC INT3 1000790F CC INT3 10007910 /. 55 PUSH EBP 10007911 |. 8BEC MOV EBP,ESP 10007913 |. 57 PUSH EDI 10007914 |. 56 PUSH ESI 10007915 |. 53 PUSH EBX 10007916 |. 8B4D 10 MOV ECX,[ARG.3] 10007919 |. 0BC9 OR ECX,ECX 1000791B |. 74 4D JE SHORT jagmisc.1000796A 1000791D |. 8B75 08 MOV ESI,[ARG.1] 10007920 |. 8B7D 0C MOV EDI,[ARG.2] 10007923 |. B7 41 MOV BH,41 10007925 |. B3 5A MOV BL,5A 10007927 |. B6 20 MOV DH,20 10007929 |. 8D49 00 LEA ECX,DWORD PTR DS:[ECX] 1000792C |> 8A26 /MOV AH,BYTE PTR DS:[ESI] 1000792E |. 0AE4 |OR AH,AH 10007930 |. 8A07 |MOV AL,BYTE PTR DS:[EDI] 10007932 |. 74 27 |JE SHORT jagmisc.1000795B 10007934 |. 0AC0 |OR AL,AL 10007936 |. 74 23 |JE SHORT jagmisc.1000795B 10007938 |. 83C6 01 |ADD ESI,1 1000793B |. 83C7 01 |ADD EDI,1 1000793E |. 38FC |CMP AH,BH 10007940 |. 72 06 |JB SHORT jagmisc.10007948 10007942 |. 38DC |CMP AH,BL 10007944 |. 77 02 |JA SHORT jagmisc.10007948 10007946 |. 02E6 |ADD AH,DH 10007948 |> 38F8 |CMP AL,BH 1000794A |. 72 06 |JB SHORT jagmisc.10007952 1000794C |. 38D8 |CMP AL,BL 1000794E |. 77 02 |JA SHORT jagmisc.10007952 10007950 |. 02C6 |ADD AL,DH 10007952 |> 38C4 |CMP AH,AL 10007954 |. 75 0B |JNZ SHORT jagmisc.10007961 10007956 |. 83E9 01 |SUB ECX,1 10007959 |.^ 75 D1 \JNZ SHORT jagmisc.1000792C 1000795B |> 33C9 XOR ECX,ECX 1000795D |. 38C4 CMP AH,AL 1000795F |. 74 09 JE SHORT jagmisc.1000796A 10007961 |> B9 FFFFFFFF MOV ECX,-1 10007966 |. 72 02 JB SHORT jagmisc.1000796A 10007968 |. F7D9 NEG ECX 1000796A |> 8BC1 MOV EAX,ECX 1000796C |. 5B POP EBX ; kernel32.7C816FD7 1000796D |. 5E POP ESI ; kernel32.7C816FD7 1000796E |. 5F POP EDI ; kernel32.7C816FD7 1000796F |. C9 LEAVE 10007970 \. C3 RETN 10007971 CC INT3 10007972 CC INT3 10007973 CC INT3 10007974 CC INT3 10007975 CC INT3 10007976 CC INT3 10007977 CC INT3 10007978 CC INT3 10007979 CC INT3 1000797A CC INT3 1000797B CC INT3 1000797C CC INT3 1000797D CC INT3 1000797E CC INT3 1000797F CC INT3 10007980 . 56 PUSH ESI 10007981 . 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 10007985 . 0BC0 OR EAX,EAX 10007987 . 75 28 JNZ SHORT jagmisc.100079B1 10007989 . 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 1000798D . 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+C] 10007991 . 33D2 XOR EDX,EDX 10007993 . F7F1 DIV ECX 10007995 . 8BD8 MOV EBX,EAX 10007997 . 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 1000799B . F7F1 DIV ECX 1000799D . 8BF0 MOV ESI,EAX 1000799F . 8BC3 MOV EAX,EBX 100079A1 . F76424 10 MUL DWORD PTR SS:[ESP+10] 100079A5 . 8BC8 MOV ECX,EAX 100079A7 . 8BC6 MOV EAX,ESI 100079A9 . F76424 10 MUL DWORD PTR SS:[ESP+10] 100079AD . 03D1 ADD EDX,ECX 100079AF . EB 47 JMP SHORT jagmisc.100079F8 100079B1 > 8BC8 MOV ECX,EAX 100079B3 . 8B5C24 10 MOV EBX,DWORD PTR SS:[ESP+10] 100079B7 . 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C] 100079BB . 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 100079BF > D1E9 SHR ECX,1 100079C1 . D1DB RCR EBX,1 100079C3 . D1EA SHR EDX,1 100079C5 . D1D8 RCR EAX,1 100079C7 . 0BC9 OR ECX,ECX 100079C9 .^ 75 F4 JNZ SHORT jagmisc.100079BF 100079CB . F7F3 DIV EBX 100079CD . 8BF0 MOV ESI,EAX 100079CF . F76424 14 MUL DWORD PTR SS:[ESP+14] 100079D3 . 8BC8 MOV ECX,EAX 100079D5 . 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 100079D9 . F7E6 MUL ESI 100079DB . 03D1 ADD EDX,ECX 100079DD . 72 0E JB SHORT jagmisc.100079ED 100079DF . 3B5424 0C CMP EDX,DWORD PTR SS:[ESP+C] 100079E3 . 77 08 JA SHORT jagmisc.100079ED 100079E5 . 72 0F JB SHORT jagmisc.100079F6 100079E7 . 3B4424 08 CMP EAX,DWORD PTR SS:[ESP+8] 100079EB . 76 09 JBE SHORT jagmisc.100079F6 100079ED > 4E DEC ESI 100079EE . 2B4424 10 SUB EAX,DWORD PTR SS:[ESP+10] 100079F2 . 1B5424 14 SBB EDX,DWORD PTR SS:[ESP+14] 100079F6 > 33DB XOR EBX,EBX 100079F8 > 2B4424 08 SUB EAX,DWORD PTR SS:[ESP+8] 100079FC . 1B5424 0C SBB EDX,DWORD PTR SS:[ESP+C] 10007A00 . F7DA NEG EDX 10007A02 . F7D8 NEG EAX 10007A04 . 83DA 00 SBB EDX,0 10007A07 . 8BCA MOV ECX,EDX 10007A09 . 8BD3 MOV EDX,EBX 10007A0B . 8BD9 MOV EBX,ECX 10007A0D . 8BC8 MOV ECX,EAX 10007A0F . 8BC6 MOV EAX,ESI 10007A11 . 5E POP ESI ; kernel32.7C816FD7 10007A12 . C2 1000 RETN 10 10007A15 CC INT3 10007A16 CC INT3 10007A17 CC INT3 10007A18 CC INT3 10007A19 CC INT3 10007A1A CC INT3 10007A1B CC INT3 10007A1C CC INT3 10007A1D CC INT3 10007A1E CC INT3 10007A1F CC INT3 10007A20 > 8D42 FF LEA EAX,DWORD PTR DS:[EDX-1] 10007A23 . 5B POP EBX ; kernel32.7C816FD7 10007A24 . C3 RETN 10007A25 . 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP] 10007A2C . 8D6424 00 LEA ESP,DWORD PTR SS:[ESP] 10007A30 . 33C0 XOR EAX,EAX 10007A32 . 8A4424 08 MOV AL,BYTE PTR SS:[ESP+8] 10007A36 . 53 PUSH EBX 10007A37 . 8BD8 MOV EBX,EAX 10007A39 . C1E0 08 SHL EAX,8 10007A3C . 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8] 10007A40 . F7C2 03000000 TEST EDX,3 10007A46 . 74 15 JE SHORT jagmisc.10007A5D 10007A48 > 8A0A MOV CL,BYTE PTR DS:[EDX] 10007A4A . 83C2 01 ADD EDX,1 10007A4D . 38D9 CMP CL,BL 10007A4F .^ 74 CF JE SHORT jagmisc.10007A20 10007A51 . 84C9 TEST CL,CL 10007A53 . 74 51 JE SHORT jagmisc.10007AA6 10007A55 . F7C2 03000000 TEST EDX,3 10007A5B .^ 75 EB JNZ SHORT jagmisc.10007A48 10007A5D > 0BD8 OR EBX,EAX 10007A5F . 57 PUSH EDI 10007A60 . 8BC3 MOV EAX,EBX 10007A62 . C1E3 10 SHL EBX,10 10007A65 . 56 PUSH ESI 10007A66 . 0BD8 OR EBX,EAX 10007A68 > 8B0A MOV ECX,DWORD PTR DS:[EDX] 10007A6A . BF FFFEFE7E MOV EDI,7EFEFEFF 10007A6F . 8BC1 MOV EAX,ECX 10007A71 . 8BF7 MOV ESI,EDI 10007A73 . 33CB XOR ECX,EBX 10007A75 . 03F0 ADD ESI,EAX 10007A77 . 03F9 ADD EDI,ECX 10007A79 . 83F1 FF XOR ECX,FFFFFFFF 10007A7C . 83F0 FF XOR EAX,FFFFFFFF 10007A7F . 33CF XOR ECX,EDI 10007A81 . 33C6 XOR EAX,ESI 10007A83 . 83C2 04 ADD EDX,4 10007A86 . 81E1 00010181 AND ECX,81010100 10007A8C . 75 1C JNZ SHORT jagmisc.10007AAA 10007A8E . 25 00010181 AND EAX,81010100 10007A93 .^ 74 D3 JE SHORT jagmisc.10007A68 10007A95 . 25 00010101 AND EAX,1010100 10007A9A . 75 08 JNZ SHORT jagmisc.10007AA4 10007A9C . 81E6 00000080 AND ESI,80000000 10007AA2 .^ 75 C4 JNZ SHORT jagmisc.10007A68 10007AA4 > 5E POP ESI ; kernel32.7C816FD7 10007AA5 . 5F POP EDI ; kernel32.7C816FD7 10007AA6 > 5B POP EBX ; kernel32.7C816FD7 10007AA7 . 33C0 XOR EAX,EAX 10007AA9 . C3 RETN 10007AAA > 8B42 FC MOV EAX,DWORD PTR DS:[EDX-4] 10007AAD . 38D8 CMP AL,BL 10007AAF . 74 36 JE SHORT jagmisc.10007AE7 10007AB1 . 84C0 TEST AL,AL 10007AB3 .^ 74 EF JE SHORT jagmisc.10007AA4 10007AB5 . 38DC CMP AH,BL 10007AB7 . 74 27 JE SHORT jagmisc.10007AE0 10007AB9 . 84E4 TEST AH,AH 10007ABB .^ 74 E7 JE SHORT jagmisc.10007AA4 10007ABD . C1E8 10 SHR EAX,10 10007AC0 . 38D8 CMP AL,BL 10007AC2 . 74 15 JE SHORT jagmisc.10007AD9 10007AC4 . 84C0 TEST AL,AL 10007AC6 .^ 74 DC JE SHORT jagmisc.10007AA4 10007AC8 . 38DC CMP AH,BL 10007ACA . 74 06 JE SHORT jagmisc.10007AD2 10007ACC . 84E4 TEST AH,AH 10007ACE .^ 74 D4 JE SHORT jagmisc.10007AA4 10007AD0 .^ EB 96 JMP SHORT jagmisc.10007A68 10007AD2 > 5E POP ESI ; kernel32.7C816FD7 10007AD3 . 5F POP EDI ; kernel32.7C816FD7 10007AD4 . 8D42 FF LEA EAX,DWORD PTR DS:[EDX-1] 10007AD7 . 5B POP EBX ; kernel32.7C816FD7 10007AD8 . C3 RETN 10007AD9 > 8D42 FE LEA EAX,DWORD PTR DS:[EDX-2] 10007ADC . 5E POP ESI ; kernel32.7C816FD7 10007ADD . 5F POP EDI ; kernel32.7C816FD7 10007ADE . 5B POP EBX ; kernel32.7C816FD7 10007ADF . C3 RETN 10007AE0 > 8D42 FD LEA EAX,DWORD PTR DS:[EDX-3] 10007AE3 . 5E POP ESI ; kernel32.7C816FD7 10007AE4 . 5F POP EDI ; kernel32.7C816FD7 10007AE5 . 5B POP EBX ; kernel32.7C816FD7 10007AE6 . C3 RETN 10007AE7 > 8D42 FC LEA EAX,DWORD PTR DS:[EDX-4] 10007AEA . 5E POP ESI ; kernel32.7C816FD7 10007AEB . 5F POP EDI ; kernel32.7C816FD7 10007AEC . 5B POP EBX ; kernel32.7C816FD7 10007AED . C3 RETN 10007AEE $- FF25 D0800010 JMP DWORD PTR DS:[<&KERNEL32.RtlUnwind>] ; ntdll.RtlUnwind 10007AF4 00 DB 00 10007AF5 00 DB 00 10007AF6 00 DB 00 10007AF7 00 DB 00 10007AF8 00 DB 00 10007AF9 00 DB 00 10007AFA 00 DB 00 10007AFB 00 DB 00 10007AFC 00 DB 00 10007AFD 00 DB 00 10007AFE 00 DB 00 10007AFF 00 DB 00 10007B00 00 DB 00 10007B01 00 DB 00 10007B02 00 DB 00 10007B03 00 DB 00 10007B04 00 DB 00 10007B05 00 DB 00 10007B06 00 DB 00 10007B07 00 DB 00 10007B08 00 DB 00 10007B09 00 DB 00 10007B0A 00 DB 00 10007B0B 00 DB 00 10007B0C 00 DB 00 10007B0D 00 DB 00 10007B0E 00 DB 00 10007B0F 00 DB 00 10007B10 00 DB 00 10007B11 00 DB 00 10007B12 00 DB 00 10007B13 00 DB 00 10007B14 00 DB 00 10007B15 00 DB 00 10007B16 00 DB 00 10007B17 00 DB 00 10007B18 00 DB 00 10007B19 00 DB 00 10007B1A 00 DB 00 10007B1B 00 DB 00 10007B1C 00 DB 00 10007B1D 00 DB 00 10007B1E 00 DB 00 10007B1F 00 DB 00 10007B20 00 DB 00 10007B21 00 DB 00 10007B22 00 DB 00 10007B23 00 DB 00 10007B24 00 DB 00 10007B25 00 DB 00 10007B26 00 DB 00 10007B27 00 DB 00 10007B28 00 DB 00 10007B29 00 DB 00 10007B2A 00 DB 00 10007B2B 00 DB 00 10007B2C 00 DB 00 10007B2D 00 DB 00 10007B2E 00 DB 00 10007B2F 00 DB 00 10007B30 00 DB 00 10007B31 00 DB 00 10007B32 00 DB 00 10007B33 00 DB 00 10007B34 00 DB 00 10007B35 00 DB 00 10007B36 00 DB 00 10007B37 00 DB 00 10007B38 00 DB 00 10007B39 00 DB 00 10007B3A 00 DB 00 10007B3B 00 DB 00 10007B3C 00 DB 00 10007B3D 00 DB 00 10007B3E 00 DB 00 10007B3F 00 DB 00 10007B40 00 DB 00 10007B41 00 DB 00 10007B42 00 DB 00 10007B43 00 DB 00 10007B44 00 DB 00 10007B45 00 DB 00 10007B46 00 DB 00 10007B47 00 DB 00 10007B48 00 DB 00 10007B49 00 DB 00 10007B4A 00 DB 00 10007B4B 00 DB 00 10007B4C 00 DB 00 10007B4D 00 DB 00 10007B4E 00 DB 00 10007B4F 00 DB 00 10007B50 00 DB 00 10007B51 00 DB 00 10007B52 00 DB 00 10007B53 00 DB 00 10007B54 00 DB 00 10007B55 00 DB 00 10007B56 00 DB 00 10007B57 00 DB 00 10007B58 00 DB 00 10007B59 00 DB 00 10007B5A 00 DB 00 10007B5B 00 DB 00 10007B5C 00 DB 00 10007B5D 00 DB 00 10007B5E 00 DB 00 10007B5F 00 DB 00 10007B60 00 DB 00 10007B61 00 DB 00 10007B62 00 DB 00 10007B63 00 DB 00 10007B64 00 DB 00 10007B65 00 DB 00 10007B66 00 DB 00 10007B67 00 DB 00 10007B68 00 DB 00 10007B69 00 DB 00 10007B6A 00 DB 00 10007B6B 00 DB 00 10007B6C 00 DB 00 10007B6D 00 DB 00 10007B6E 00 DB 00 10007B6F 00 DB 00 10007B70 00 DB 00 10007B71 00 DB 00 10007B72 00 DB 00 10007B73 00 DB 00 10007B74 00 DB 00 10007B75 00 DB 00 10007B76 00 DB 00 10007B77 00 DB 00 10007B78 00 DB 00 10007B79 00 DB 00 10007B7A 00 DB 00 10007B7B 00 DB 00 10007B7C 00 DB 00 10007B7D 00 DB 00 10007B7E 00 DB 00 10007B7F 00 DB 00 10007B80 00 DB 00 10007B81 00 DB 00 10007B82 00 DB 00 10007B83 00 DB 00 10007B84 00 DB 00 10007B85 00 DB 00 10007B86 00 DB 00 10007B87 00 DB 00 10007B88 00 DB 00 10007B89 00 DB 00 10007B8A 00 DB 00 10007B8B 00 DB 00 10007B8C 00 DB 00 10007B8D 00 DB 00 10007B8E 00 DB 00 10007B8F 00 DB 00 10007B90 00 DB 00 10007B91 00 DB 00 10007B92 00 DB 00 10007B93 00 DB 00 10007B94 00 DB 00 10007B95 00 DB 00 10007B96 00 DB 00 10007B97 00 DB 00 10007B98 00 DB 00 10007B99 00 DB 00 10007B9A 00 DB 00 10007B9B 00 DB 00 10007B9C 00 DB 00 10007B9D 00 DB 00 10007B9E 00 DB 00 10007B9F 00 DB 00 10007BA0 00 DB 00 10007BA1 00 DB 00 10007BA2 00 DB 00 10007BA3 00 DB 00 10007BA4 00 DB 00 10007BA5 00 DB 00 10007BA6 00 DB 00 10007BA7 00 DB 00 10007BA8 00 DB 00 10007BA9 00 DB 00 10007BAA 00 DB 00 10007BAB 00 DB 00 10007BAC 00 DB 00 10007BAD 00 DB 00 10007BAE 00 DB 00 10007BAF 00 DB 00 10007BB0 00 DB 00 10007BB1 00 DB 00 10007BB2 00 DB 00 10007BB3 00 DB 00 10007BB4 00 DB 00 10007BB5 00 DB 00 10007BB6 00 DB 00 10007BB7 00 DB 00 10007BB8 00 DB 00 10007BB9 00 DB 00 10007BBA 00 DB 00 10007BBB 00 DB 00 10007BBC 00 DB 00 10007BBD 00 DB 00 10007BBE 00 DB 00 10007BBF 00 DB 00 10007BC0 00 DB 00 10007BC1 00 DB 00 10007BC2 00 DB 00 10007BC3 00 DB 00 10007BC4 00 DB 00 10007BC5 00 DB 00 10007BC6 00 DB 00 10007BC7 00 DB 00 10007BC8 00 DB 00 10007BC9 00 DB 00 10007BCA 00 DB 00 10007BCB 00 DB 00 10007BCC 00 DB 00 10007BCD 00 DB 00 10007BCE 00 DB 00 10007BCF 00 DB 00 10007BD0 00 DB 00 10007BD1 00 DB 00 10007BD2 00 DB 00 10007BD3 00 DB 00 10007BD4 00 DB 00 10007BD5 00 DB 00 10007BD6 00 DB 00 10007BD7 00 DB 00 10007BD8 00 DB 00 10007BD9 00 DB 00 10007BDA 00 DB 00 10007BDB 00 DB 00 10007BDC 00 DB 00 10007BDD 00 DB 00 10007BDE 00 DB 00 10007BDF 00 DB 00 10007BE0 00 DB 00 10007BE1 00 DB 00 10007BE2 00 DB 00 10007BE3 00 DB 00 10007BE4 00 DB 00 10007BE5 00 DB 00 10007BE6 00 DB 00 10007BE7 00 DB 00 10007BE8 00 DB 00 10007BE9 00 DB 00 10007BEA 00 DB 00 10007BEB 00 DB 00 10007BEC 00 DB 00 10007BED 00 DB 00 10007BEE 00 DB 00 10007BEF 00 DB 00 10007BF0 00 DB 00 10007BF1 00 DB 00 10007BF2 00 DB 00 10007BF3 00 DB 00 10007BF4 00 DB 00 10007BF5 00 DB 00 10007BF6 00 DB 00 10007BF7 00 DB 00 10007BF8 00 DB 00 10007BF9 00 DB 00 10007BFA 00 DB 00 10007BFB 00 DB 00 10007BFC 00 DB 00 10007BFD 00 DB 00 10007BFE 00 DB 00 10007BFF 00 DB 00 10007C00 00 DB 00 10007C01 00 DB 00 10007C02 00 DB 00 10007C03 00 DB 00 10007C04 00 DB 00 10007C05 00 DB 00 10007C06 00 DB 00 10007C07 00 DB 00 10007C08 00 DB 00 10007C09 00 DB 00 10007C0A 00 DB 00 10007C0B 00 DB 00 10007C0C 00 DB 00 10007C0D 00 DB 00 10007C0E 00 DB 00 10007C0F 00 DB 00 10007C10 00 DB 00 10007C11 00 DB 00 10007C12 00 DB 00 10007C13 00 DB 00 10007C14 00 DB 00 10007C15 00 DB 00 10007C16 00 DB 00 10007C17 00 DB 00 10007C18 00 DB 00 10007C19 00 DB 00 10007C1A 00 DB 00 10007C1B 00 DB 00 10007C1C 00 DB 00 10007C1D 00 DB 00 10007C1E 00 DB 00 10007C1F 00 DB 00 10007C20 00 DB 00 10007C21 00 DB 00 10007C22 00 DB 00 10007C23 00 DB 00 10007C24 00 DB 00 10007C25 00 DB 00 10007C26 00 DB 00 10007C27 00 DB 00 10007C28 00 DB 00 10007C29 00 DB 00 10007C2A 00 DB 00 10007C2B 00 DB 00 10007C2C 00 DB 00 10007C2D 00 DB 00 10007C2E 00 DB 00 10007C2F 00 DB 00 10007C30 00 DB 00 10007C31 00 DB 00 10007C32 00 DB 00 10007C33 00 DB 00 10007C34 00 DB 00 10007C35 00 DB 00 10007C36 00 DB 00 10007C37 00 DB 00 10007C38 00 DB 00 10007C39 00 DB 00 10007C3A 00 DB 00 10007C3B 00 DB 00 10007C3C 00 DB 00 10007C3D 00 DB 00 10007C3E 00 DB 00 10007C3F 00 DB 00 10007C40 00 DB 00 10007C41 00 DB 00 10007C42 00 DB 00 10007C43 00 DB 00 10007C44 00 DB 00 10007C45 00 DB 00 10007C46 00 DB 00 10007C47 00 DB 00 10007C48 00 DB 00 10007C49 00 DB 00 10007C4A 00 DB 00 10007C4B 00 DB 00 10007C4C 00 DB 00 10007C4D 00 DB 00 10007C4E 00 DB 00 10007C4F 00 DB 00 10007C50 00 DB 00 10007C51 00 DB 00 10007C52 00 DB 00 10007C53 00 DB 00 10007C54 00 DB 00 10007C55 00 DB 00 10007C56 00 DB 00 10007C57 00 DB 00 10007C58 00 DB 00 10007C59 00 DB 00 10007C5A 00 DB 00 10007C5B 00 DB 00 10007C5C 00 DB 00 10007C5D 00 DB 00 10007C5E 00 DB 00 10007C5F 00 DB 00 10007C60 00 DB 00 10007C61 00 DB 00 10007C62 00 DB 00 10007C63 00 DB 00 10007C64 00 DB 00 10007C65 00 DB 00 10007C66 00 DB 00 10007C67 00 DB 00 10007C68 00 DB 00 10007C69 00 DB 00 10007C6A 00 DB 00 10007C6B 00 DB 00 10007C6C 00 DB 00 10007C6D 00 DB 00 10007C6E 00 DB 00 10007C6F 00 DB 00 10007C70 00 DB 00 10007C71 00 DB 00 10007C72 00 DB 00 10007C73 00 DB 00 10007C74 00 DB 00 10007C75 00 DB 00 10007C76 00 DB 00 10007C77 00 DB 00 10007C78 00 DB 00 10007C79 00 DB 00 10007C7A 00 DB 00 10007C7B 00 DB 00 10007C7C 00 DB 00 10007C7D 00 DB 00 10007C7E 00 DB 00 10007C7F 00 DB 00 10007C80 00 DB 00 10007C81 00 DB 00 10007C82 00 DB 00 10007C83 00 DB 00 10007C84 00 DB 00 10007C85 00 DB 00 10007C86 00 DB 00 10007C87 00 DB 00 10007C88 00 DB 00 10007C89 00 DB 00 10007C8A 00 DB 00 10007C8B 00 DB 00 10007C8C 00 DB 00 10007C8D 00 DB 00 10007C8E 00 DB 00 10007C8F 00 DB 00 10007C90 00 DB 00 10007C91 00 DB 00 10007C92 00 DB 00 10007C93 00 DB 00 10007C94 00 DB 00 10007C95 00 DB 00 10007C96 00 DB 00 10007C97 00 DB 00 10007C98 00 DB 00 10007C99 00 DB 00 10007C9A 00 DB 00 10007C9B 00 DB 00 10007C9C 00 DB 00 10007C9D 00 DB 00 10007C9E 00 DB 00 10007C9F 00 DB 00 10007CA0 00 DB 00 10007CA1 00 DB 00 10007CA2 00 DB 00 10007CA3 00 DB 00 10007CA4 00 DB 00 10007CA5 00 DB 00 10007CA6 00 DB 00 10007CA7 00 DB 00 10007CA8 00 DB 00 10007CA9 00 DB 00 10007CAA 00 DB 00 10007CAB 00 DB 00 10007CAC 00 DB 00 10007CAD 00 DB 00 10007CAE 00 DB 00 10007CAF 00 DB 00 10007CB0 00 DB 00 10007CB1 00 DB 00 10007CB2 00 DB 00 10007CB3 00 DB 00 10007CB4 00 DB 00 10007CB5 00 DB 00 10007CB6 00 DB 00 10007CB7 00 DB 00 10007CB8 00 DB 00 10007CB9 00 DB 00 10007CBA 00 DB 00 10007CBB 00 DB 00 10007CBC 00 DB 00 10007CBD 00 DB 00 10007CBE 00 DB 00 10007CBF 00 DB 00 10007CC0 00 DB 00 10007CC1 00 DB 00 10007CC2 00 DB 00 10007CC3 00 DB 00 10007CC4 00 DB 00 10007CC5 00 DB 00 10007CC6 00 DB 00 10007CC7 00 DB 00 10007CC8 00 DB 00 10007CC9 00 DB 00 10007CCA 00 DB 00 10007CCB 00 DB 00 10007CCC 00 DB 00 10007CCD 00 DB 00 10007CCE 00 DB 00 10007CCF 00 DB 00 10007CD0 00 DB 00 10007CD1 00 DB 00 10007CD2 00 DB 00 10007CD3 00 DB 00 10007CD4 00 DB 00 10007CD5 00 DB 00 10007CD6 00 DB 00 10007CD7 00 DB 00 10007CD8 00 DB 00 10007CD9 00 DB 00 10007CDA 00 DB 00 10007CDB 00 DB 00 10007CDC 00 DB 00 10007CDD 00 DB 00 10007CDE 00 DB 00 10007CDF 00 DB 00 10007CE0 00 DB 00 10007CE1 00 DB 00 10007CE2 00 DB 00 10007CE3 00 DB 00 10007CE4 00 DB 00 10007CE5 00 DB 00 10007CE6 00 DB 00 10007CE7 00 DB 00 10007CE8 00 DB 00 10007CE9 00 DB 00 10007CEA 00 DB 00 10007CEB 00 DB 00 10007CEC 00 DB 00 10007CED 00 DB 00 10007CEE 00 DB 00 10007CEF 00 DB 00 10007CF0 00 DB 00 10007CF1 00 DB 00 10007CF2 00 DB 00 10007CF3 00 DB 00 10007CF4 00 DB 00 10007CF5 00 DB 00 10007CF6 00 DB 00 10007CF7 00 DB 00 10007CF8 00 DB 00 10007CF9 00 DB 00 10007CFA 00 DB 00 10007CFB 00 DB 00 10007CFC 00 DB 00 10007CFD 00 DB 00 10007CFE 00 DB 00 10007CFF 00 DB 00 10007D00 00 DB 00 10007D01 00 DB 00 10007D02 00 DB 00 10007D03 00 DB 00 10007D04 00 DB 00 10007D05 00 DB 00 10007D06 00 DB 00 10007D07 00 DB 00 10007D08 00 DB 00 10007D09 00 DB 00 10007D0A 00 DB 00 10007D0B 00 DB 00 10007D0C 00 DB 00 10007D0D 00 DB 00 10007D0E 00 DB 00 10007D0F 00 DB 00 10007D10 00 DB 00 10007D11 00 DB 00 10007D12 00 DB 00 10007D13 00 DB 00 10007D14 00 DB 00 10007D15 00 DB 00 10007D16 00 DB 00 10007D17 00 DB 00 10007D18 00 DB 00 10007D19 00 DB 00 10007D1A 00 DB 00 10007D1B 00 DB 00 10007D1C 00 DB 00 10007D1D 00 DB 00 10007D1E 00 DB 00 10007D1F 00 DB 00 10007D20 00 DB 00 10007D21 00 DB 00 10007D22 00 DB 00 10007D23 00 DB 00 10007D24 00 DB 00 10007D25 00 DB 00 10007D26 00 DB 00 10007D27 00 DB 00 10007D28 00 DB 00 10007D29 00 DB 00 10007D2A 00 DB 00 10007D2B 00 DB 00 10007D2C 00 DB 00 10007D2D 00 DB 00 10007D2E 00 DB 00 10007D2F 00 DB 00 10007D30 00 DB 00 10007D31 00 DB 00 10007D32 00 DB 00 10007D33 00 DB 00 10007D34 00 DB 00 10007D35 00 DB 00 10007D36 00 DB 00 10007D37 00 DB 00 10007D38 00 DB 00 10007D39 00 DB 00 10007D3A 00 DB 00 10007D3B 00 DB 00 10007D3C 00 DB 00 10007D3D 00 DB 00 10007D3E 00 DB 00 10007D3F 00 DB 00 10007D40 00 DB 00 10007D41 00 DB 00 10007D42 00 DB 00 10007D43 00 DB 00 10007D44 00 DB 00 10007D45 00 DB 00 10007D46 00 DB 00 10007D47 00 DB 00 10007D48 00 DB 00 10007D49 00 DB 00 10007D4A 00 DB 00 10007D4B 00 DB 00 10007D4C 00 DB 00 10007D4D 00 DB 00 10007D4E 00 DB 00 10007D4F 00 DB 00 10007D50 00 DB 00 10007D51 00 DB 00 10007D52 00 DB 00 10007D53 00 DB 00 10007D54 00 DB 00 10007D55 00 DB 00 10007D56 00 DB 00 10007D57 00 DB 00 10007D58 00 DB 00 10007D59 00 DB 00 10007D5A 00 DB 00 10007D5B 00 DB 00 10007D5C 00 DB 00 10007D5D 00 DB 00 10007D5E 00 DB 00 10007D5F 00 DB 00 10007D60 00 DB 00 10007D61 00 DB 00 10007D62 00 DB 00 10007D63 00 DB 00 10007D64 00 DB 00 10007D65 00 DB 00 10007D66 00 DB 00 10007D67 00 DB 00 10007D68 00 DB 00 10007D69 00 DB 00 10007D6A 00 DB 00 10007D6B 00 DB 00 10007D6C 00 DB 00 10007D6D 00 DB 00 10007D6E 00 DB 00 10007D6F 00 DB 00 10007D70 00 DB 00 10007D71 00 DB 00 10007D72 00 DB 00 10007D73 00 DB 00 10007D74 00 DB 00 10007D75 00 DB 00 10007D76 00 DB 00 10007D77 00 DB 00 10007D78 00 DB 00 10007D79 00 DB 00 10007D7A 00 DB 00 10007D7B 00 DB 00 10007D7C 00 DB 00 10007D7D 00 DB 00 10007D7E 00 DB 00 10007D7F 00 DB 00 10007D80 00 DB 00 10007D81 00 DB 00 10007D82 00 DB 00 10007D83 00 DB 00 10007D84 00 DB 00 10007D85 00 DB 00 10007D86 00 DB 00 10007D87 00 DB 00 10007D88 00 DB 00 10007D89 00 DB 00 10007D8A 00 DB 00 10007D8B 00 DB 00 10007D8C 00 DB 00 10007D8D 00 DB 00 10007D8E 00 DB 00 10007D8F 00 DB 00 10007D90 00 DB 00 10007D91 00 DB 00 10007D92 00 DB 00 10007D93 00 DB 00 10007D94 00 DB 00 10007D95 00 DB 00 10007D96 00 DB 00 10007D97 00 DB 00 10007D98 00 DB 00 10007D99 00 DB 00 10007D9A 00 DB 00 10007D9B 00 DB 00 10007D9C 00 DB 00 10007D9D 00 DB 00 10007D9E 00 DB 00 10007D9F 00 DB 00 10007DA0 00 DB 00 10007DA1 00 DB 00 10007DA2 00 DB 00 10007DA3 00 DB 00 10007DA4 00 DB 00 10007DA5 00 DB 00 10007DA6 00 DB 00 10007DA7 00 DB 00 10007DA8 00 DB 00 10007DA9 00 DB 00 10007DAA 00 DB 00 10007DAB 00 DB 00 10007DAC 00 DB 00 10007DAD 00 DB 00 10007DAE 00 DB 00 10007DAF 00 DB 00 10007DB0 00 DB 00 10007DB1 00 DB 00 10007DB2 00 DB 00 10007DB3 00 DB 00 10007DB4 00 DB 00 10007DB5 00 DB 00 10007DB6 00 DB 00 10007DB7 00 DB 00 10007DB8 00 DB 00 10007DB9 00 DB 00 10007DBA 00 DB 00 10007DBB 00 DB 00 10007DBC 00 DB 00 10007DBD 00 DB 00 10007DBE 00 DB 00 10007DBF 00 DB 00 10007DC0 00 DB 00 10007DC1 00 DB 00 10007DC2 00 DB 00 10007DC3 00 DB 00 10007DC4 00 DB 00 10007DC5 00 DB 00 10007DC6 00 DB 00 10007DC7 00 DB 00 10007DC8 00 DB 00 10007DC9 00 DB 00 10007DCA 00 DB 00 10007DCB 00 DB 00 10007DCC 00 DB 00 10007DCD 00 DB 00 10007DCE 00 DB 00 10007DCF 00 DB 00 10007DD0 00 DB 00 10007DD1 00 DB 00 10007DD2 00 DB 00 10007DD3 00 DB 00 10007DD4 00 DB 00 10007DD5 00 DB 00 10007DD6 00 DB 00 10007DD7 00 DB 00 10007DD8 00 DB 00 10007DD9 00 DB 00 10007DDA 00 DB 00 10007DDB 00 DB 00 10007DDC 00 DB 00 10007DDD 00 DB 00 10007DDE 00 DB 00 10007DDF 00 DB 00 10007DE0 00 DB 00 10007DE1 00 DB 00 10007DE2 00 DB 00 10007DE3 00 DB 00 10007DE4 00 DB 00 10007DE5 00 DB 00 10007DE6 00 DB 00 10007DE7 00 DB 00 10007DE8 00 DB 00 10007DE9 00 DB 00 10007DEA 00 DB 00 10007DEB 00 DB 00 10007DEC 00 DB 00 10007DED 00 DB 00 10007DEE 00 DB 00 10007DEF 00 DB 00 10007DF0 00 DB 00 10007DF1 00 DB 00 10007DF2 00 DB 00 10007DF3 00 DB 00 10007DF4 00 DB 00 10007DF5 00 DB 00 10007DF6 00 DB 00 10007DF7 00 DB 00 10007DF8 00 DB 00 10007DF9 00 DB 00 10007DFA 00 DB 00 10007DFB 00 DB 00 10007DFC 00 DB 00 10007DFD 00 DB 00 10007DFE 00 DB 00 10007DFF 00 DB 00 10007E00 00 DB 00 10007E01 00 DB 00 10007E02 00 DB 00 10007E03 00 DB 00 10007E04 00 DB 00 10007E05 00 DB 00 10007E06 00 DB 00 10007E07 00 DB 00 10007E08 00 DB 00 10007E09 00 DB 00 10007E0A 00 DB 00 10007E0B 00 DB 00 10007E0C 00 DB 00 10007E0D 00 DB 00 10007E0E 00 DB 00 10007E0F 00 DB 00 10007E10 00 DB 00 10007E11 00 DB 00 10007E12 00 DB 00 10007E13 00 DB 00 10007E14 00 DB 00 10007E15 00 DB 00 10007E16 00 DB 00 10007E17 00 DB 00 10007E18 00 DB 00 10007E19 00 DB 00 10007E1A 00 DB 00 10007E1B 00 DB 00 10007E1C 00 DB 00 10007E1D 00 DB 00 10007E1E 00 DB 00 10007E1F 00 DB 00 10007E20 00 DB 00 10007E21 00 DB 00 10007E22 00 DB 00 10007E23 00 DB 00 10007E24 00 DB 00 10007E25 00 DB 00 10007E26 00 DB 00 10007E27 00 DB 00 10007E28 00 DB 00 10007E29 00 DB 00 10007E2A 00 DB 00 10007E2B 00 DB 00 10007E2C 00 DB 00 10007E2D 00 DB 00 10007E2E 00 DB 00 10007E2F 00 DB 00 10007E30 00 DB 00 10007E31 00 DB 00 10007E32 00 DB 00 10007E33 00 DB 00 10007E34 00 DB 00 10007E35 00 DB 00 10007E36 00 DB 00 10007E37 00 DB 00 10007E38 00 DB 00 10007E39 00 DB 00 10007E3A 00 DB 00 10007E3B 00 DB 00 10007E3C 00 DB 00 10007E3D 00 DB 00 10007E3E 00 DB 00 10007E3F 00 DB 00 10007E40 00 DB 00 10007E41 00 DB 00 10007E42 00 DB 00 10007E43 00 DB 00 10007E44 00 DB 00 10007E45 00 DB 00 10007E46 00 DB 00 10007E47 00 DB 00 10007E48 00 DB 00 10007E49 00 DB 00 10007E4A 00 DB 00 10007E4B 00 DB 00 10007E4C 00 DB 00 10007E4D 00 DB 00 10007E4E 00 DB 00 10007E4F 00 DB 00 10007E50 00 DB 00 10007E51 00 DB 00 10007E52 00 DB 00 10007E53 00 DB 00 10007E54 00 DB 00 10007E55 00 DB 00 10007E56 00 DB 00 10007E57 00 DB 00 10007E58 00 DB 00 10007E59 00 DB 00 10007E5A 00 DB 00 10007E5B 00 DB 00 10007E5C 00 DB 00 10007E5D 00 DB 00 10007E5E 00 DB 00 10007E5F 00 DB 00 10007E60 00 DB 00 10007E61 00 DB 00 10007E62 00 DB 00 10007E63 00 DB 00 10007E64 00 DB 00 10007E65 00 DB 00 10007E66 00 DB 00 10007E67 00 DB 00 10007E68 00 DB 00 10007E69 00 DB 00 10007E6A 00 DB 00 10007E6B 00 DB 00 10007E6C 00 DB 00 10007E6D 00 DB 00 10007E6E 00 DB 00 10007E6F 00 DB 00 10007E70 00 DB 00 10007E71 00 DB 00 10007E72 00 DB 00 10007E73 00 DB 00 10007E74 00 DB 00 10007E75 00 DB 00 10007E76 00 DB 00 10007E77 00 DB 00 10007E78 00 DB 00 10007E79 00 DB 00 10007E7A 00 DB 00 10007E7B 00 DB 00 10007E7C 00 DB 00 10007E7D 00 DB 00 10007E7E 00 DB 00 10007E7F 00 DB 00 10007E80 00 DB 00 10007E81 00 DB 00 10007E82 00 DB 00 10007E83 00 DB 00 10007E84 00 DB 00 10007E85 00 DB 00 10007E86 00 DB 00 10007E87 00 DB 00 10007E88 00 DB 00 10007E89 00 DB 00 10007E8A 00 DB 00 10007E8B 00 DB 00 10007E8C 00 DB 00 10007E8D 00 DB 00 10007E8E 00 DB 00 10007E8F 00 DB 00 10007E90 00 DB 00 10007E91 00 DB 00 10007E92 00 DB 00 10007E93 00 DB 00 10007E94 00 DB 00 10007E95 00 DB 00 10007E96 00 DB 00 10007E97 00 DB 00 10007E98 00 DB 00 10007E99 00 DB 00 10007E9A 00 DB 00 10007E9B 00 DB 00 10007E9C 00 DB 00 10007E9D 00 DB 00 10007E9E 00 DB 00 10007E9F 00 DB 00 10007EA0 00 DB 00 10007EA1 00 DB 00 10007EA2 00 DB 00 10007EA3 00 DB 00 10007EA4 00 DB 00 10007EA5 00 DB 00 10007EA6 00 DB 00 10007EA7 00 DB 00 10007EA8 00 DB 00 10007EA9 00 DB 00 10007EAA 00 DB 00 10007EAB 00 DB 00 10007EAC 00 DB 00 10007EAD 00 DB 00 10007EAE 00 DB 00 10007EAF 00 DB 00 10007EB0 00 DB 00 10007EB1 00 DB 00 10007EB2 00 DB 00 10007EB3 00 DB 00 10007EB4 00 DB 00 10007EB5 00 DB 00 10007EB6 00 DB 00 10007EB7 00 DB 00 10007EB8 00 DB 00 10007EB9 00 DB 00 10007EBA 00 DB 00 10007EBB 00 DB 00 10007EBC 00 DB 00 10007EBD 00 DB 00 10007EBE 00 DB 00 10007EBF 00 DB 00 10007EC0 00 DB 00 10007EC1 00 DB 00 10007EC2 00 DB 00 10007EC3 00 DB 00 10007EC4 00 DB 00 10007EC5 00 DB 00 10007EC6 00 DB 00 10007EC7 00 DB 00 10007EC8 00 DB 00 10007EC9 00 DB 00 10007ECA 00 DB 00 10007ECB 00 DB 00 10007ECC 00 DB 00 10007ECD 00 DB 00 10007ECE 00 DB 00 10007ECF 00 DB 00 10007ED0 00 DB 00 10007ED1 00 DB 00 10007ED2 00 DB 00 10007ED3 00 DB 00 10007ED4 00 DB 00 10007ED5 00 DB 00 10007ED6 00 DB 00 10007ED7 00 DB 00 10007ED8 00 DB 00 10007ED9 00 DB 00 10007EDA 00 DB 00 10007EDB 00 DB 00 10007EDC 00 DB 00 10007EDD 00 DB 00 10007EDE 00 DB 00 10007EDF 00 DB 00 10007EE0 00 DB 00 10007EE1 00 DB 00 10007EE2 00 DB 00 10007EE3 00 DB 00 10007EE4 00 DB 00 10007EE5 00 DB 00 10007EE6 00 DB 00 10007EE7 00 DB 00 10007EE8 00 DB 00 10007EE9 00 DB 00 10007EEA 00 DB 00 10007EEB 00 DB 00 10007EEC 00 DB 00 10007EED 00 DB 00 10007EEE 00 DB 00 10007EEF 00 DB 00 10007EF0 00 DB 00 10007EF1 00 DB 00 10007EF2 00 DB 00 10007EF3 00 DB 00 10007EF4 00 DB 00 10007EF5 00 DB 00 10007EF6 00 DB 00 10007EF7 00 DB 00 10007EF8 00 DB 00 10007EF9 00 DB 00 10007EFA 00 DB 00 10007EFB 00 DB 00 10007EFC 00 DB 00 10007EFD 00 DB 00 10007EFE 00 DB 00 10007EFF 00 DB 00 10007F00 00 DB 00 10007F01 00 DB 00 10007F02 00 DB 00 10007F03 00 DB 00 10007F04 00 DB 00 10007F05 00 DB 00 10007F06 00 DB 00 10007F07 00 DB 00 10007F08 00 DB 00 10007F09 00 DB 00 10007F0A 00 DB 00 10007F0B 00 DB 00 10007F0C 00 DB 00 10007F0D 00 DB 00 10007F0E 00 DB 00 10007F0F 00 DB 00 10007F10 00 DB 00 10007F11 00 DB 00 10007F12 00 DB 00 10007F13 00 DB 00 10007F14 00 DB 00 10007F15 00 DB 00 10007F16 00 DB 00 10007F17 00 DB 00 10007F18 00 DB 00 10007F19 00 DB 00 10007F1A 00 DB 00 10007F1B 00 DB 00 10007F1C 00 DB 00 10007F1D 00 DB 00 10007F1E 00 DB 00 10007F1F 00 DB 00 10007F20 00 DB 00 10007F21 00 DB 00 10007F22 00 DB 00 10007F23 00 DB 00 10007F24 00 DB 00 10007F25 00 DB 00 10007F26 00 DB 00 10007F27 00 DB 00 10007F28 00 DB 00 10007F29 00 DB 00 10007F2A 00 DB 00 10007F2B 00 DB 00 10007F2C 00 DB 00 10007F2D 00 DB 00 10007F2E 00 DB 00 10007F2F 00 DB 00 10007F30 00 DB 00 10007F31 00 DB 00 10007F32 00 DB 00 10007F33 00 DB 00 10007F34 00 DB 00 10007F35 00 DB 00 10007F36 00 DB 00 10007F37 00 DB 00 10007F38 00 DB 00 10007F39 00 DB 00 10007F3A 00 DB 00 10007F3B 00 DB 00 10007F3C 00 DB 00 10007F3D 00 DB 00 10007F3E 00 DB 00 10007F3F 00 DB 00 10007F40 00 DB 00 10007F41 00 DB 00 10007F42 00 DB 00 10007F43 00 DB 00 10007F44 00 DB 00 10007F45 00 DB 00 10007F46 00 DB 00 10007F47 00 DB 00 10007F48 00 DB 00 10007F49 00 DB 00 10007F4A 00 DB 00 10007F4B 00 DB 00 10007F4C 00 DB 00 10007F4D 00 DB 00 10007F4E 00 DB 00 10007F4F 00 DB 00 10007F50 00 DB 00 10007F51 00 DB 00 10007F52 00 DB 00 10007F53 00 DB 00 10007F54 00 DB 00 10007F55 00 DB 00 10007F56 00 DB 00 10007F57 00 DB 00 10007F58 00 DB 00 10007F59 00 DB 00 10007F5A 00 DB 00 10007F5B 00 DB 00 10007F5C 00 DB 00 10007F5D 00 DB 00 10007F5E 00 DB 00 10007F5F 00 DB 00 10007F60 00 DB 00 10007F61 00 DB 00 10007F62 00 DB 00 10007F63 00 DB 00 10007F64 00 DB 00 10007F65 00 DB 00 10007F66 00 DB 00 10007F67 00 DB 00 10007F68 00 DB 00 10007F69 00 DB 00 10007F6A 00 DB 00 10007F6B 00 DB 00 10007F6C 00 DB 00 10007F6D 00 DB 00 10007F6E 00 DB 00 10007F6F 00 DB 00 10007F70 00 DB 00 10007F71 00 DB 00 10007F72 00 DB 00 10007F73 00 DB 00 10007F74 00 DB 00 10007F75 00 DB 00 10007F76 00 DB 00 10007F77 00 DB 00 10007F78 00 DB 00 10007F79 00 DB 00 10007F7A 00 DB 00 10007F7B 00 DB 00 10007F7C 00 DB 00 10007F7D 00 DB 00 10007F7E 00 DB 00 10007F7F 00 DB 00 10007F80 00 DB 00 10007F81 00 DB 00 10007F82 00 DB 00 10007F83 00 DB 00 10007F84 00 DB 00 10007F85 00 DB 00 10007F86 00 DB 00 10007F87 00 DB 00 10007F88 00 DB 00 10007F89 00 DB 00 10007F8A 00 DB 00 10007F8B 00 DB 00 10007F8C 00 DB 00 10007F8D 00 DB 00 10007F8E 00 DB 00 10007F8F 00 DB 00 10007F90 00 DB 00 10007F91 00 DB 00 10007F92 00 DB 00 10007F93 00 DB 00 10007F94 00 DB 00 10007F95 00 DB 00 10007F96 00 DB 00 10007F97 00 DB 00 10007F98 00 DB 00 10007F99 00 DB 00 10007F9A 00 DB 00 10007F9B 00 DB 00 10007F9C 00 DB 00 10007F9D 00 DB 00 10007F9E 00 DB 00 10007F9F 00 DB 00 10007FA0 00 DB 00 10007FA1 00 DB 00 10007FA2 00 DB 00 10007FA3 00 DB 00 10007FA4 00 DB 00 10007FA5 00 DB 00 10007FA6 00 DB 00 10007FA7 00 DB 00 10007FA8 00 DB 00 10007FA9 00 DB 00 10007FAA 00 DB 00 10007FAB 00 DB 00 10007FAC 00 DB 00 10007FAD 00 DB 00 10007FAE 00 DB 00 10007FAF 00 DB 00 10007FB0 00 DB 00 10007FB1 00 DB 00 10007FB2 00 DB 00 10007FB3 00 DB 00 10007FB4 00 DB 00 10007FB5 00 DB 00 10007FB6 00 DB 00 10007FB7 00 DB 00 10007FB8 00 DB 00 10007FB9 00 DB 00 10007FBA 00 DB 00 10007FBB 00 DB 00 10007FBC 00 DB 00 10007FBD 00 DB 00 10007FBE 00 DB 00 10007FBF 00 DB 00 10007FC0 00 DB 00 10007FC1 00 DB 00 10007FC2 00 DB 00 10007FC3 00 DB 00 10007FC4 00 DB 00 10007FC5 00 DB 00 10007FC6 00 DB 00 10007FC7 00 DB 00 10007FC8 00 DB 00 10007FC9 00 DB 00 10007FCA 00 DB 00 10007FCB 00 DB 00 10007FCC 00 DB 00 10007FCD 00 DB 00 10007FCE 00 DB 00 10007FCF 00 DB 00 10007FD0 00 DB 00 10007FD1 00 DB 00 10007FD2 00 DB 00 10007FD3 00 DB 00 10007FD4 00 DB 00 10007FD5 00 DB 00 10007FD6 00 DB 00 10007FD7 00 DB 00 10007FD8 00 DB 00 10007FD9 00 DB 00 10007FDA 00 DB 00 10007FDB 00 DB 00 10007FDC 00 DB 00 10007FDD 00 DB 00 10007FDE 00 DB 00 10007FDF 00 DB 00 10007FE0 00 DB 00 10007FE1 00 DB 00 10007FE2 00 DB 00 10007FE3 00 DB 00 10007FE4 00 DB 00 10007FE5 00 DB 00 10007FE6 00 DB 00 10007FE7 00 DB 00 10007FE8 00 DB 00 10007FE9 00 DB 00 10007FEA 00 DB 00 10007FEB 00 DB 00 10007FEC 00 DB 00 10007FED 00 DB 00 10007FEE 00 DB 00 10007FEF 00 DB 00 10007FF0 00 DB 00 10007FF1 00 DB 00 10007FF2 00 DB 00 10007FF3 00 DB 00 10007FF4 00 DB 00 10007FF5 00 DB 00 10007FF6 00 DB 00 10007FF7 00 DB 00 10007FF8 00 DB 00 10007FF9 00 DB 00 10007FFA 00 DB 00 10007FFB 00 DB 00 10007FFC 00 DB 00 10007FFD 00 DB 00 10007FFE 00 DB 00 10007FFF 00 DB 00