.text:004FFCD7 var_10 = dword ptr -10h .text:004FFCD7 var_C = dword ptr -0Ch .text:004FFCD7 var_4 = dword ptr -4 .text:004FFCD7 lpFileName = dword ptr 8 .text:004FFCD7 .text:004FFCD7 push ebp .text:004FFCD8 mov ebp, esp .text:004FFCDA push 0FFFFFFFFh .text:004FFCDC push offset loc_6D6C8F .text:004FFCE1 mov eax, large fs:0 .text:004FFCE7 push eax .text:004FFCE8 mov large fs:0, esp .text:004FFCEF push ecx .text:004FFCF0 mov [ebp+var_10], ecx .text:004FFCF3 mov ecx, [ebp+var_10] .text:004FFCF6 add ecx, 120h .text:004FFCFC call sub_4FFAD0 .text:004FFD01 mov [ebp+var_4], 0 .text:004FFD08 push 130h ; size_t .text:004FFD0D push 0 ; int .text:004FFD0F mov eax, [ebp+var_10] .text:004FFD12 push eax ; void * .text:004FFD13 call _memset .text:004FFD18 add esp, 0Ch .text:004FFD1B mov ecx, [ebp+var_10] .text:004FFD1E mov dword ptr [ecx+12Ch], 0FFFFFFFFh .text:004FFD28 mov edx, [ebp+lpFileName] .text:004FFD2B push edx ; lpFileName .text:004FFD2C mov ecx, [ebp+var_10] .text:004FFD2F call sub_4FFD4E .text:004FFD34 mov [ebp+var_4], 0FFFFFFFFh .text:004FFD3B mov eax, [ebp+var_10] .text:004FFD3E mov ecx, [ebp+var_C] .text:004FFD41 mov large fs:0, ecx .text:004FFD48 mov esp, ebp .text:0045B910 var_4 = dword ptr -4 .text:0045B910 .text:0045B910 push ebp .text:0045B911 mov ebp, esp .text:0045B913 push ecx .text:0045B914 mov [ebp+var_4], ecx .text:0045B917 mov eax, [ebp+var_4] .text:0045B91A add eax, 120h .text:0045B91F mov esp, ebp .text:0045B921 pop ebp .text:0045B922 retn text:004FFD4E ; int __stdcall sub_4FFD4E(LPCSTR lpFileName) .text:004FFD4E sub_4FFD4E proc near ; CODE XREF: sub_4FFCD7+58p .text:004FFD4E .text:004FFD4E var_4 = dword ptr -4 .text:004FFD4E lpFileName = dword ptr 8 .text:004FFD4E .text:004FFD4E push ebp .text:004FFD4F mov ebp, esp .text:004FFD51 push ecx .text:004FFD52 mov [ebp+var_4], ecx .text:004FFD55 cmp [ebp+lpFileName], 0 .text:004FFD59 jz short loc_4FFD67 .text:004FFD5B mov eax, [ebp+var_4] .text:004FFD5E cmp dword ptr [eax+12Ch], 0FFFFFFFFh .text:004FFD65 jz short loc_4FFD6E .text:004FFD67 .text:004FFD67 loc_4FFD67: ; CODE XREF: sub_4FFD4E+Bj .text:004FFD67 xor eax, eax .text:004FFD69 jmp loc_4FFDF3 .text:004FFD6E ; --------------------------------------------------------------------------- .text:004FFD6E .text:004FFD6E loc_4FFD6E: ; CODE XREF: sub_4FFD4E+17j .text:004FFD6E push 0 ; hTemplateFile .text:004FFD70 push 80h ; dwFlagsAndAttributes .text:004FFD75 push 3 ; dwCreationDisposition .text:004FFD77 push 0 ; lpSecurityAttributes .text:004FFD79 push 1 ; dwShareMode .text:004FFD7B push 80000000h ; dwDesiredAccess .text:004FFD80 mov ecx, [ebp+lpFileName] .text:004FFD83 push ecx ; lpFileName .text:004FFD84 call ds:CreateFileA .text:004FFD8A mov edx, [ebp+var_4] .text:004FFD8D mov [edx+12Ch], eax .text:004FFD93 mov eax, [ebp+var_4] .text:004FFD96 cmp dword ptr [eax+12Ch], 0FFFFFFFFh .text:004FFD9D jnz short loc_4FFDA3 .text:004FFD9F xor eax, eax .text:004FFDA1 jmp short loc_4FFDF3 .text:004FFDA3 ; --------------------------------------------------------------------------- .text:004FFDA3 .text:004FFDA3 loc_4FFDA3: ; CODE XREF: sub_4FFD4E+4Fj .text:004FFDA3 mov ecx, [ebp+var_4] .text:004FFDA6 call sub_4FFDF9 .text:004FFDAB mov ecx, [ebp+var_4] .text:004FFDAE mov edx, [ecx+12Ch] .text:004FFDB4 push edx ; hObject .text:004FFDB5 call ds:CloseHandle .text:004FFDBB mov eax, [ebp+var_4] .text:004FFDBE mov dword ptr [eax+12Ch], 0FFFFFFFFh .text:004FFDC8 mov ecx, [ebp+var_4] .text:004FFDCB call sub_4FFFD9 .text:004FFDD0 mov ecx, [ebp+var_4] .text:004FFDD3 call sub_4FFF08 .text:004FFDD8 push 100h ; size_t .text:004FFDDD push 0 ; int .text:004FFDDF mov ecx, [ebp+var_4] .text:004FFDE2 add ecx, 1Dh .text:004FFDE5 push ecx ; void * .text:004FFDE6 call _memset .text:004FFDEB add esp, 0Ch .text:004FFDEE mov eax, 1 .text:004FFDF3 .text:004FFDF3 loc_4FFDF3: ; CODE XREF: sub_4FFD4E+1Bj .text:004FFDF3 ; sub_4FFD4E+53j .text:004FFDF3 mov esp, ebp .text:004FFDF5 pop ebp .text:004FFDF6 retn 4 .text:004FFDF6 sub_4FFD4E endp // -------------------------------------------------------- sub_4FFF08 .text:004FFF08 sub_4FFF08 proc near ; CODE XREF: sub_4FFD4E+85p .text:004FFF08 .text:004FFF08 var_10 = dword ptr -10h .text:004FFF08 var_C = dword ptr -0Ch .text:004FFF08 var_8 = dword ptr -8 .text:004FFF08 var_4 = dword ptr -4 .text:004FFF08 .text:004FFF08 push ebp .text:004FFF09 mov ebp, esp .text:004FFF0B sub esp, 10h .text:004FFF0E mov [ebp+var_10], ecx .text:004FFF11 mov ecx, [ebp+var_10] .text:004FFF14 add ecx, 120h .text:004FFF1A call unknown_libname_156 ; Microsoft VisualC 2-8/net runtime .text:004FFF1F mov [ebp+var_4], eax .text:004FFF22 cmp [ebp+var_4], 0 .text:004FFF26 jnz short loc_4FFF2F .text:004FFF28 xor eax, eax .text:004FFF2A jmp loc_4FFFD5 .text:004FFF2F ; --------------------------------------------------------------------------- .text:004FFF2F .text:004FFF2F loc_4FFF2F: ; CODE XREF: sub_4FFF08+1Ej .text:004FFF2F mov [ebp+var_C], 1 .text:004FFF36 mov [ebp+var_8], 0 .text:004FFF3D jmp short loc_4FFF48 .text:004FFF3F ; --------------------------------------------------------------------------- .text:004FFF3F .text:004FFF3F loc_4FFF3F: ; CODE XREF: sub_4FFF08:loc_4FFFCBj .text:004FFF3F mov eax, [ebp+var_8] .text:004FFF42 add eax, 1 .text:004FFF45 mov [ebp+var_8], eax .text:004FFF48 .text:004FFF48 loc_4FFF48: ; CODE XREF: sub_4FFF08+35j .text:004FFF48 mov ecx, [ebp+var_10] .text:004FFF4B add ecx, 120h .text:004FFF51 call unknown_libname_413 ; Microsoft VisualC 2-8/net runtime .text:004FFF56 cmp [ebp+var_8], eax .text:004FFF59 jnb short loc_4FFFD0 .text:004FFF5B cmp [ebp+var_C], 0 .text:004FFF5F jz short loc_4FFF97 .text:004FFF61 mov ecx, [ebp+var_8] .text:004FFF64 add ecx, 1 .text:004FFF67 and ecx, 800000FFh .text:004FFF6D jns short loc_4FFF77 .text:004FFF6F dec ecx .text:004FFF70 or ecx, 0FFFFFF00h .text:004FFF76 inc ecx .text:004FFF77 .text:004FFF77 loc_4FFF77: ; CODE XREF: sub_4FFF08+65j .text:004FFF77 mov edx, [ebp+var_4] .text:004FFF7A add edx, [ebp+var_8] .text:004FFF7D mov eax, [ebp+var_10] .text:004FFF80 mov dl, [edx] .text:004FFF82 sub dl, [eax+ecx+1Dh] .text:004FFF86 mov eax, [ebp+var_4] .text:004FFF89 add eax, [ebp+var_8] .text:004FFF8C mov [eax], dl .text:004FFF8E mov [ebp+var_C], 0 .text:004FFF95 jmp short loc_4FFFCB .text:004FFF97 ; --------------------------------------------------------------------------- .text:004FFF97 .text:004FFF97 loc_4FFF97: ; CODE XREF: sub_4FFF08+57j .text:004FFF97 mov ecx, [ebp+var_8] .text:004FFF9A add ecx, 1 .text:004FFF9D and ecx, 800000FFh .text:004FFFA3 jns short loc_4FFFAD .text:004FFFA5 dec ecx .text:004FFFA6 or ecx, 0FFFFFF00h .text:004FFFAC inc ecx .text:004FFFAD .text:004FFFAD loc_4FFFAD: ; CODE XREF: sub_4FFF08+9Bj .text:004FFFAD mov edx, [ebp+var_4] .text:004FFFB0 add edx, [ebp+var_8] .text:004FFFB3 mov eax, [ebp+var_10] .text:004FFFB6 mov dl, [edx] .text:004FFFB8 add dl, [eax+ecx+1Dh] .text:004FFFBC mov eax, [ebp+var_4] .text:004FFFBF add eax, [ebp+var_8] .text:004FFFC2 mov [eax], dl .text:004FFFC4 mov [ebp+var_C], 1 .text:004FFFCB .text:004FFFCB loc_4FFFCB: ; CODE XREF: sub_4FFF08+8Dj .text:004FFFCB jmp loc_4FFF3F .text:004FFFD0 ; --------------------------------------------------------------------------- .text:004FFFD0 .text:004FFFD0 loc_4FFFD0: ; CODE XREF: sub_4FFF08+51j .text:004FFFD0 mov eax, 1 .text:004FFFD5 .text:004FFFD5 loc_4FFFD5: ; CODE XREF: sub_4FFF08+22j .text:004FFFD5 mov esp, ebp .text:004FFFD7 pop ebp .text:004FFFD8 retn .text:004FFFD8 sub_4FFF08 endp sub_4FFFD9 .text:004FFFD9 sub_4FFFD9 proc near ; CODE XREF: sub_4FFD4E+7Dp .text:004FFFD9 .text:004FFFD9 var_18 = dword ptr -18h .text:004FFFD9 var_14 = byte ptr -14h .text:004FFFD9 var_13 = byte ptr -13h .text:004FFFD9 var_12 = byte ptr -12h .text:004FFFD9 var_11 = byte ptr -11h .text:004FFFD9 var_10 = byte ptr -10h .text:004FFFD9 var_F = byte ptr -0Fh .text:004FFFD9 var_E = byte ptr -0Eh .text:004FFFD9 var_D = byte ptr -0Dh .text:004FFFD9 var_C = dword ptr -0Ch .text:004FFFD9 var_8 = dword ptr -8 .text:004FFFD9 var_4 = byte ptr -4 .text:004FFFD9 .text:004FFFD9 push ebp .text:004FFFDA mov ebp, esp .text:004FFFDC sub esp, 18h .text:004FFFDF mov [ebp+var_18], ecx .text:004FFFE2 mov [ebp+var_14], 1 .text:004FFFE6 mov [ebp+var_13], 2 .text:004FFFEA mov [ebp+var_12], 4 .text:004FFFEE mov [ebp+var_11], 8 .text:004FFFF2 mov [ebp+var_10], 10h .text:004FFFF6 mov [ebp+var_F], 20h .text:004FFFFA mov [ebp+var_E], 40h .text:004FFFFE mov [ebp+var_D], 80h ; DATA XREF: sub_4F82EE+5Fo .text:00500002 mov [ebp+var_C], 1 .text:00500009 mov [ebp+var_8], 0 .text:00500010 jmp short loc_50001B .text:00500012 ; --------------------------------------------------------------------------- .text:00500012 .text:00500012 loc_500012: ; CODE XREF: sub_4FFFD9:loc_50008Cj .text:00500012 mov eax, [ebp+var_8] .text:00500015 add eax, 1 .text:00500018 mov [ebp+var_8], eax .text:0050001B .text:0050001B loc_50001B: ; CODE XREF: sub_4FFFD9+37j .text:0050001B cmp [ebp+var_8], 100h .text:00500022 jge short loc_50008E .text:00500024 cmp [ebp+var_C], 0 .text:00500028 jz short loc_50005C .text:0050002A mov ecx, [ebp+var_8] .text:0050002D add ecx, 1 .text:00500030 and ecx, 80000007h .text:00500036 jns short loc_50003D .text:00500038 dec ecx .text:00500039 or ecx, 0FFFFFFF8h .text:0050003C inc ecx .text:0050003D .text:0050003D loc_50003D: ; CODE XREF: sub_4FFFD9+5Dj .text:0050003D mov edx, [ebp+var_18] .text:00500040 add edx, [ebp+var_8] .text:00500043 mov al, [edx+1Dh] .text:00500046 sub al, [ebp+ecx+var_14] .text:0050004A mov ecx, [ebp+var_18] .text:0050004D add ecx, [ebp+var_8] .text:00500050 mov [ecx+1Dh], al .text:00500053 mov [ebp+var_C], 0 .text:0050005A jmp short loc_50008C .text:0050005C ; --------------------------------------------------------------------------- .text:0050005C .text:0050005C loc_50005C: ; CODE XREF: sub_4FFFD9+4Fj .text:0050005C mov edx, [ebp+var_8] .text:0050005F add edx, 1 .text:00500062 and edx, 80000007h .text:00500068 jns short loc_50006F .text:0050006A dec edx .text:0050006B or edx, 0FFFFFFF8h .text:0050006E inc edx .text:0050006F .text:0050006F loc_50006F: ; CODE XREF: sub_4FFFD9+8Fj .text:0050006F mov eax, [ebp+var_18] .text:00500072 add eax, [ebp+var_8] .text:00500075 mov cl, [eax+1Dh] .text:00500078 add cl, [ebp+edx+var_14] .text:0050007C mov edx, [ebp+var_18] .text:0050007F add edx, [ebp+var_8] .text:00500082 mov [edx+1Dh], cl .text:00500085 mov [ebp+var_C], 1 .text:0050008C .text:0050008C loc_50008C: ; CODE XREF: sub_4FFFD9+81j .text:0050008C jmp short loc_500012 .text:0050008E ; --------------------------------------------------------------------------- .text:0050008E .text:0050008E loc_50008E: ; CODE XREF: sub_4FFFD9+49j .text:0050008E mov [ebp+var_8], 0 .text:00500095 jmp short loc_5000A0 .text:00500097 ; --------------------------------------------------------------------------- .text:00500097 .text:00500097 loc_500097: ; CODE XREF: sub_4FFFD9+106j .text:00500097 mov eax, [ebp+var_8] .text:0050009A add eax, 1 .text:0050009D mov [ebp+var_8], eax .text:005000A0 .text:005000A0 loc_5000A0: ; CODE XREF: sub_4FFFD9+BCj .text:005000A0 cmp [ebp+var_8], 80h .text:005000A7 jge short loc_5000E1 .text:005000A9 mov ecx, 0FFh .text:005000AE sub ecx, [ebp+var_8] .text:005000B1 mov edx, [ebp+var_18] .text:005000B4 mov al, [edx+ecx+1Dh] .text:005000B8 mov [ebp+var_4], al .text:005000BB mov ecx, 0FFh .text:005000C0 sub ecx, [ebp+var_8] .text:005000C3 mov edx, [ebp+var_18] .text:005000C6 add edx, [ebp+var_8] .text:005000C9 mov eax, [ebp+var_18] .text:005000CC mov dl, [edx+1Dh] .text:005000CF mov [eax+ecx+1Dh], dl .text:005000D3 mov eax, [ebp+var_18] .text:005000D6 add eax, [ebp+var_8] .text:005000D9 mov cl, [ebp+var_4] .text:005000DC mov [eax+1Dh], cl .text:005000DF jmp short loc_500097 .text:005000E1 ; --------------------------------------------------------------------------- .text:005000E1 .text:005000E1 loc_5000E1: ; CODE XREF: sub_4FFFD9+CEj .text:005000E1 mov [ebp+var_8], 0 .text:005000E8 jmp short loc_5000F3 .text:005000EA ; --------------------------------------------------------------------------- .text:005000EA .text:005000EA loc_5000EA: ; CODE XREF: sub_4FFFD9+14Dj .text:005000EA mov edx, [ebp+var_8] .text:005000ED add edx, 2 .text:005000F0 mov [ebp+var_8], edx .text:005000F3 .text:005000F3 loc_5000F3: ; CODE XREF: sub_4FFFD9+10Fj .text:005000F3 cmp [ebp+var_8], 100h .text:005000FA jge short loc_500128 .text:005000FC mov eax, [ebp+var_18] .text:005000FF add eax, [ebp+var_8] .text:00500102 mov cl, [eax+1Eh] .text:00500105 mov [ebp+var_4], cl .text:00500108 mov edx, [ebp+var_18] .text:0050010B add edx, [ebp+var_8] .text:0050010E mov eax, [ebp+var_18] .text:00500111 add eax, [ebp+var_8] .text:00500114 mov cl, [eax+1Dh] .text:00500117 mov [edx+1Eh], cl .text:0050011A mov edx, [ebp+var_18] .text:0050011D add edx, [ebp+var_8] .text:00500120 mov al, [ebp+var_4] .text:00500123 mov [edx+1Dh], al .text:00500126 jmp short loc_5000EA .text:00500128 ; --------------------------------------------------------------------------- .text:00500128 .text:00500128 loc_500128: ; CODE XREF: sub_4FFFD9+121j .text:00500128 mov eax, 1 .text:0050012D mov esp, ebp .text:0050012F pop ebp .text:00500130 retn .text:00500130 sub_4FFFD9 endp