00401156 je 004011B0 00401158 mov dword ptr ds:[0043F0C0h],eax 0040115D mov edx,dword ptr ds:[4482A8h] 00401163 test edx,edx 00401165 jne 004011F6 0040116B cmp edx,0FFFFFFE0h 0040116E je 00401190 00401170 mov eax,dword ptr ds:[00447B30h] 00401175 mov dword ptr [esp+4],eax 00401179 mov ebx,dword ptr ds:[4482A8h] 0040117F mov ecx,dword ptr [ebx+30h] 00401182 mov dword ptr [esp],ecx 00401185 call 00410850 0040118A mov edx,dword ptr ds:[4482A8h] 00401190 cmp edx,0FFFFFFC0h 00401193 je 004011B0 00401195 mov ebx,dword ptr ds:[447B30h] 0040119B mov dword ptr [esp+4],ebx 0040119F mov ecx,dword ptr ds:[4482A8h] 004011A5 mov edx,dword ptr [ecx+50h] 004011A8 mov dword ptr [esp],edx 004011AB call 00410850 004011B0 call 00410840 004011B5 mov ebx,dword ptr ds:[43F0C0h] 004011BB mov dword ptr [eax],ebx 004011BD call 0040CDE0 004011C2 and esp,0FFFFFFF0h 004011C5 call 00410820 004011CA mov ecx,dword ptr [eax] 004011CC mov dword ptr [esp+8],ecx 004011D0 mov edx,dword ptr ds:[443000h] 004011D6 mov dword ptr [esp+4],edx 004011DA mov eax,dword ptr ds:[00443004h] 004011DF mov dword ptr [esp],eax 004011E2 call 00401390 004011E7 mov ebx,eax 004011E9 call 00410810 004011EE mov dword ptr [esp],ebx 004011F1 call 00410B10 004011F6 mov dword ptr [esp+4],eax 004011FA mov edx,dword ptr ds:[4482A8h] 00401200 mov eax,dword ptr [edx+10h] 00401203 mov dword ptr [esp],eax 00401206 call 00410850 0040120B mov edx,dword ptr ds:[4482A8h] 00401211 jmp 0040116B 00401216 lea esi,[esi] 00401219 lea edi,[edi] 00401220 push ebp 00401221 mov ebp,esp 00401223 sub esp,8 00401226 mov dword ptr [esp],1 0040122D call dword ptr ds:[44828Ch] 00401233 call 00401100 00401238 nop 00401239 lea esi,[esi] 00401240 push ebp 00401241 mov ebp,esp 00401243 sub esp,8 00401246 mov dword ptr [esp],2 0040124D call dword ptr ds:[44828Ch] 00401253 call 00401100 00401258 nop 00401259 lea esi,[esi] 00401260 push ebp 00401261 mov ecx,dword ptr ds:[4482CCh] 00401267 mov ebp,esp 00401269 pop ebp 0040126A jmp ecx 0040126C lea esi,[esi] 00401270 push ebp 00401271 mov ecx,dword ptr ds:[4482B4h] 00401277 mov ebp,esp 00401279 pop ebp 0040127A jmp ecx 0040127C nop 0040127D nop 0040127E nop 0040127F nop 00401280 push ebp 00401281 mov ebp,esp 00401283 pop ebp 00401284 jmp 0040D040 00401289 nop 0040128A nop 0040128B nop 0040128C nop 0040128D nop 0040128E nop 0040128F nop 00401290 push ebp 00401291 mov ebp,esp 00401293 sub esp,28h 00401296 mov eax,dword ptr [ebp+10h] 00401299 mov dword ptr [esp],eax 0040129C call 004121D0 004012A1 dec eax 004012A2 mov dword ptr [ebp-4],eax 004012A5 mov eax,dword ptr [ebp+0Ch] 004012A8 dec eax 004012A9 mov dword ptr [ebp-0Ch],eax 004012AC lea eax,[ebp-0Ch] 004012AF mov dword ptr [esp+4],eax 004012B3 lea eax,[ebp-4] 004012B6 mov dword ptr [esp],eax 004012B9 call 0043B0C0 004012BE mov eax,dword ptr [eax] 004012C0 mov dword ptr [ebp-8],eax 004012C3 mov eax,dword ptr [ebp-4] 004012C6 mov dword ptr [ebp-10h],eax 004012C9 mov byte ptr [ebp-11h],1 004012CD mov dword ptr [ebp-18h],0 004012D4 mov eax,dword ptr [ebp-18h] 004012D7 cmp eax,dword ptr [ebp-8] 004012DA jae 00401315 004012DC cmp byte ptr [ebp-11h],0 004012E0 je 00401315 004012E2 mov eax,dword ptr [ebp-10h] 004012E5 mov dword ptr [esp+4],eax 004012E9 mov eax,dword ptr [ebp+10h] 004012EC mov dword ptr [esp],eax 004012EF call 00412800 004012F4 mov ecx,eax 004012F6 mov eax,dword ptr [ebp+8] 004012F9 mov edx,dword ptr [ebp-18h] 004012FC add edx,eax 004012FE movzx eax,byte ptr [ecx] 00401301 cmp al,byte ptr [edx] 00401303 sete al 00401306 mov byte ptr [ebp-11h],al 00401309 lea eax,[ebp-10h] 0040130C dec dword ptr [eax] 0040130E lea eax,[ebp-18h] 00401311 inc dword ptr [eax] 00401313 jmp 004012D4 00401315 cmp dword ptr [ebp-10h],0 00401319 je 0040134F 0040131B cmp byte ptr [ebp-11h],0 0040131F je 0040134F 00401321 mov eax,dword ptr [ebp-10h] 00401324 mov dword ptr [esp+4],eax 00401328 mov eax,dword ptr [ebp+10h] 0040132B mov dword ptr [esp],eax 0040132E call 00412800 00401333 mov ecx,eax 00401335 mov eax,dword ptr [ebp+8] 00401338 mov edx,dword ptr [ebp-8] 0040133B add edx,eax 0040133D movzx eax,byte ptr [ecx] 00401340 cmp al,byte ptr [edx] 00401342 sete al 00401345 mov byte ptr [ebp-11h],al 00401348 lea eax,[ebp-10h] 0040134B dec dword ptr [eax] 0040134D jmp 00401315 0040134F mov dword ptr [esp+4],0 00401357 mov eax,dword ptr [ebp+10h] 0040135A mov dword ptr [esp],eax 0040135D call 00412800 00401362 mov ecx,eax 00401364 mov eax,dword ptr [ebp+8] 00401367 mov edx,dword ptr [ebp-8] 0040136A add edx,eax 0040136C movzx eax,byte ptr [ecx] 0040136F cmp al,byte ptr [edx] 00401371 jg 0040137F 00401373 movzx eax,byte ptr [ebp-11h] 00401377 and eax,1 0040137A mov byte ptr [ebp-19h],al 0040137D jmp 00401383 0040137F mov byte ptr [ebp-19h],0 00401383 movzx eax,byte ptr [ebp-19h] 00401387 mov byte ptr [ebp-11h],al 0040138A movzx eax,byte ptr [ebp-11h] 0040138E leave 0040138F ret 00401390 push ebp 00401391 mov ebp,esp 00401393 sub esp,278h 00401399 and esp,0FFFFFFF0h 0040139C mov eax,0 004013A1 add eax,0Fh 004013A4 add eax,0Fh 004013A7 shr eax,4 004013AA shl eax,4 004013AD mov dword ptr [ebp-24Ch],eax 004013B3 mov eax,dword ptr [ebp-24Ch] 004013B9 call 0040D280 004013BE call 0040CEC0 004013C3 mov dword ptr [esp],440000h 004013CA call 00410B20 004013CF sub esp,4 004013D2 mov dword ptr [esp+4],440000h 004013DA mov dword ptr [esp],0 004013E1 call 00410AC0 004013E6 sub esp,8 004013E9 mov dword ptr [ebp-0Ch],eax 004013EC mov dword ptr [esp+4],0 004013F4 mov eax,dword ptr [ebp-0Ch] 004013F7 mov dword ptr [esp],eax 004013FA call 00410AD0 004013FF sub esp,8 00401402 mov dword ptr [esp],0 00401409 call 00410B30 0040140E sub esp,4 00401411 mov dword ptr [ebp-23Ch],eax 00401417 mov dword ptr [esp+8],104h 0040141F lea eax,[ebp-238h] 00401425 mov dword ptr [esp+4],eax 00401429 mov eax,dword ptr [ebp-23Ch] 0040142F mov dword ptr [esp],eax 00401432 call 00410B40 00401437 sub esp,0Ch 0040143A mov dword ptr [esp+4],104h 00401442 lea eax,[ebp-128h] 00401448 mov dword ptr [esp],eax 0040144B call 00410B50 00401450 sub esp,8 00401453 mov dword ptr [esp+4],440005h 0040145B lea eax,[ebp-128h] 00401461 mov dword ptr [esp],eax 00401464 call 00410870 00401469 mov dword ptr [esp+8],0 00401471 lea eax,[ebp-128h] 00401477 mov dword ptr [esp+4],eax 0040147B lea eax,[ebp-238h] 00401481 mov dword ptr [esp],eax 00401484 call 00410B60 00401489 sub esp,0Ch 0040148C lea eax,[ebp-240h] 00401492 mov dword ptr [esp+10h],eax 00401496 mov dword ptr [esp+0Ch],2 0040149E mov dword ptr [esp+8],0 004014A6 mov dword ptr [esp+4],440010h 004014AE mov dword ptr [esp],80000002h 004014B5 call 00410C60 004014BA sub esp,14h 004014BD mov dword ptr [esp+14h],104h 004014C5 lea eax,[ebp-128h] 004014CB mov dword ptr [esp+10h],eax 004014CF mov dword ptr [esp+0Ch],1 004014D7 mov dword ptr [esp+8],0 004014DF mov dword ptr [esp+4],440000h 004014E7 mov eax,dword ptr [ebp-240h] 004014ED mov dword ptr [esp],eax 004014F0 call 00410C70 004014F5 sub esp,18h 004014F8 mov eax,dword ptr [ebp-240h] 004014FE mov dword ptr [esp],eax 00401501 call 00410C80 00401506 sub esp,4 00401509 mov dword ptr [ebp-244h],1 00401513 cmp dword ptr [ebp-244h],0 0040151A jle 004015D6 00401520 mov dword ptr [esp],0Ah 00401527 call 00410B70 0040152C sub esp,4 0040152F mov dword ptr [esp],61h 00401536 call 00410AE0 0040153B sub esp,4 0040153E test ax,ax 00401541 je 00401513 00401543 mov dword ptr [ebp-248h],1 0040154D cmp dword ptr [ebp-248h],0 00401554 jle 00401513 00401556 mov dword ptr [esp],62h 0040155D call 00410AE0 00401562 sub esp,4 00401565 test ax,ax 00401568 je 0040159B 0040156A mov dword ptr [ebp-248h],0 00401574 mov dword ptr [esp+0Ch],0FFFFFFFFh 0040157C mov dword ptr [esp+8],0F170h 00401584 mov dword ptr [esp+4],112h 0040158C mov dword ptr [esp],0FFFFh 00401593 call 00410AF0 00401598 sub esp,10h 0040159B mov dword ptr [esp+0Ch],2 004015A3 mov dword ptr [esp+8],0F170h 004015AB mov dword ptr [esp+4],112h 004015B3 mov dword ptr [esp],0FFFFh 004015BA call 00410AF0 004015BF sub esp,10h 004015C2 mov dword ptr [esp],0Ah 004015C9 call 00410B70 004015CE sub esp,4 004015D1 jmp 0040154D 004015D6 mov eax,0 004015DB leave 004015DC ret 004015DD nop 004015DE push ebp 004015DF mov ebp,esp 004015E1 sub esp,8 004015E4 cmp dword ptr [ebp+0Ch],0FFFFh 004015EB jne 004015FF 004015ED cmp dword ptr [ebp+8],1 004015F1 jne 004015FF 004015F3 mov dword ptr [esp],443010h 004015FA call 00401820 004015FF cmp dword ptr [ebp+0Ch],0FFFFh 00401606 jne 0040161A 00401608 cmp dword ptr [ebp+8],0 0040160C jne 0040161A 0040160E mov dword ptr [esp],443010h 00401615 call 00401740 0040161A leave 0040161B ret 0040161C push ebp 0040161D mov ebp,esp 0040161F sub esp,8 00401622 mov dword ptr [esp+4],0FFFFh 0040162A mov dword ptr [esp],1 00401631 call 004015DE 00401636 leave 00401637 ret 00401638 push ebp 00401639 mov ebp,esp 0040163B sub esp,8 0040163E mov dword ptr [esp+4],0FFFFh 00401646 mov dword ptr [esp],0 0040164D call 004015DE 00401652 leave 00401653 ret 00401654 nop 00401655 nop 00401656 nop 00401657 nop 00401658 nop 00401659 nop ************ Thats my disassembly of it. ************* 'lockout.exe': Loaded 'C:\Documents and Settings\Administrator\Desktop\lockout.exe', Binary was not built with debug information. 'lockout.exe': Loaded 'C:\WINDOWS\system32\ntdll.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\kernel32.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\advapi32.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\rpcrt4.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\msvcrt.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\user32.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\gdi32.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\imm32.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\lpk.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\usp10.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\Program Files\NewDotNet\newdotnet7_48.dll', Binary was not built with debug information. 'lockout.exe': Loaded 'C:\WINDOWS\system32\ole32.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\oleaut32.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\urlmon.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\shlwapi.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\version.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\ws2_32.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\ws2help.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\wininet.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\crypt32.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\msasn1.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\setupapi.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\mpr.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\wintrust.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\imagehlp.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\shell32.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll', No symbols loaded. 'lockout.exe': Loaded 'C:\WINDOWS\system32\comctl32.dll', No symbols loaded.