report on malware analysis

A Malware Investigation Report

Ethiopian Cyber Emergency Readiness and Response Team

(ECERRT)

By Alemayehu Tilahun

[email protected]

November 13, 2014

Addis Ababa, Ethiopia

1. Background

The consequence and risk of malicious software can easily be considered as the greatest threat to

cyberspace security these days. Earlier, Viruses were, more or less, the only form of Malware.

However, nowadays, the threat has grown to include a vast range of highly sophisticated

applications phenomenal. Network-aware worms, Trojans, DDoS agents, IRC Controlled bots,

Spywares, Rootkits and many more. The infection vectors have also changed and grown

drastically as malicious agents now use mechanisms like email harvesting, browser exploits,

operating system vulnerabilities, and P2P networks and many more unknown, unheard and

technologically advanced techniques of replication.

A relatively large percentage of the software that a normal internet user encounters in his/her

online activities are or can be malicious in some form or other. Most of these Malwares are

detected by Antivirus software, Spyware removal applications and other similar tools. However,

this protection is not always enough and there are times when a small, benign looking binary

sneak through all these levels of protection and compromises the system and the user’s data. The

reasons for this breach can be:

Users not updating their Antivirus signatures regularly

Users not keeping their systems well patched

Failure of Antivirus Software’s heuristics engine

New or low-profile Malware that has not yet been discovered by Antivirus vendors

Custom coded Malware which cannot be detected by Antivirus

Firewall not installed or not properly configured

Malwares are continuously evolving, and Antivirus vendors are finding it difficult to keep up

with this ever increasing threat list. In some cases, the vendors may choose not to include a

signature for a particular piece of Malware. However, this should not prevent knowledge seekers

from using freeware tools and techniques to analyze the files and develop their own prevention

and detection mechanisms. Though the Antivirus Software’s are continually getting better and

more sophisticated, a small but very significant percentage of Malwares escape this predefined

screening process and manages to enter and compromise both the system and the network itself.

Unfortunately, this percentage of the Malwares escaping this predefined screening process is also

growing every day.

2 | P a g e a l e x g o o f @ g m a i l . c o m

It is essential for users and absolutely essential for administrators to be able to determine if a

binary is harmful by examining it manually and without relying on the automated scanning

engines. The level of information required after an analysis is done differs according to the user's

needs. For instance, a normal user might only want to know if a binary is malicious or not, while

an administrator might want to know more like the registry values the binary injects, the copies

of infected files it creates, the types of files the binary infects and also the actual payload

information and what it does. That means, he may want to completely reverse engineer the

binary for his purposes.

Techniques for Malware Analysis

There are basically two techniques that are used for analyzing a Malware:

1. Code analysis

2. Behavior analysis

In most cases, a combination of both these techniques is used. However, we will consider code

analysis first.

Code Analysis

Code analysis is one of the primary techniques used for examining Malwares. The best way of

understanding the way a program works is, of course, to study the source code of the program.

However, the source code for most Malware is not available. Malicious software is more often

distributed in the form of binaries, and binary code can still be examined using debuggers and

disassembles. However, the use of these tools is often beyond the ability of all but a small

minority because of the specialized knowledge that is required. Given sufficient time, any binary,

however large or complicated, can be reversed completely by using code analysis techniques. I

will deal with some aspect of code analysis and reverse engineering process later.

Behavior Analysis

Behavior analysis is more concerned with the behavioral aspects of the malicious software. Like

a beast kept under observation in a zoo, a binary can be kept in a tightly controlled environment

and have its behavior scrutinized. It is mainly done in Virtual OS environment so that the effects

of the Malware can be kept under control. Analysis of activities or changes it makes to the


environment (file system, registry, network, etc), its communication with the rest of the network,

its communication with remote devices, and so on are closely monitored and information is

collected. The collected data is properly documented, analyzed and the complete picture is

reconstructed from these different bits of information.

The best thing about behavior analysis is that it is within the scope of an average administrator or

even a normal user. Though reverse engineering using behavior analysis does not lead to the

generation of the binaries code, it is sufficient for most users' needs. For instance, it is not

sufficient for an antivirus researcher but for most other users or Administrators, behavior

analysis can fulfill all their needs. In this article, I will deal mainly with the behavioral analysis

of the Malwares and the ways and tools with which we can do that.

2. Investigation goal

The goal of this malware investigation is to provide a set of behavior analysis techniques for

reverse engineering Malwares activities in a controlled environment. I also have to keep in mind

that the learning curve should be simple enough so that it is within the scope of the average users

understanding. Using these methods, people should be able to analyze an unknown binary and

determine whether it is a Malware or not.

3. Tools Used

Since the goal of this Investigation is to propose a generic set of techniques, the tools mentioned

in this Investigation are just "proposed" tools and are readily available as freeware. Any other

tool that has the same or similar functionality can be used in place of the proposed ones, however

it would be recommended to use the ones suggested here, though the versions may vary. The

tools or applications we would be using for our analysis part are:

Vmware V. 10.1

Ollydbg 2.01

PEid

Process Monitor

Process Explorer

Autorun


4. Basic Analysis 3.1 Virus Total

To collect a detail description of the malware sample “cczice.cmd” I have submitted the file to online malware analyzing websites like www.virustotal.com and www.threatexpert.com to collect the analysis report of the file itself for further understanding the characteristics of the target malware delivered and details is illustrated in the bellow tables.

SHA256: 025f76687658fa53dbf60d846a8cacfb1fe27f9ffbe87f74e61f7ca47da6ad8a

File name: cczice.cmd

Detection ratio:

20 / 27

Analysis date: 2014-11-13 17:28:28 UTC ( 2 minutes ago )

3.2 Threat Expert Submission details

MD5: 0xE480220E4837910DBD33E491D942C5CD

SHA-1: 0x3F61A5DBC33303B3278ECAF87C10AF0B9EE1DF23

File size 130,754 bytes

Submission Received 12 November 2013, 07, 07:39:17

Processing Time 5 min 51 Sec

3.3 Autoruns SysInternals


http://www.threatexpert.com/

http://www.virustotal.com/

The above snapshot is taken from autoruns tools to check in which registry file type is the target malware (cczice.cmd) is running, its description and the time stamp available for the file format.

3.4 Portable Executable identifier

The Portable executable identifier snapshot presented above illustrates that the address for the file Entry point (00003BC1) and the Entry point section type (.txt). it also delivers the directory information available as shown below:-

Size of Headers _ : 00000400 | 00000400 or 1000Size of Optional Header: 000000E0 | 000000E0Numbers of Directories : 00000010 | 00000010h (16 | 16 decimal)Directory. RESERVED size: 00000000 | 0Base of Code : 00001000 | 00001000Image Base : 00400000 | 00400000Magic Optional header : 0000010B | 0000010B = PE32, 020B = PE64Debugger information : No


-EP to EOF bytes: 0001683F (decimal: 92223)

3.5 Process Explorer

The Process Explore tool justified and presented the target malware “cczice.cmd” CPU Consumption is almost 98% and the Process Id given for the malware during the Process is 1992. Apart from that the strings available in both Memory and Disk is displayed in the figure below.


3.6 Process Monitor

The Process Monitor used in this table has illustrated the process Id available and the Operation on the registry key alongside with the result of the operation with its details available in the Process itself. As shown in the graph provided bellow. The Process Monitor tool also explicitly infers the life time of each available with respect to the starting and ending time of the process. In this case the Malware “CCZICE.cmd” takes the shortest life time available in all Processes.


5. Dynamic Analysis 5.1 Ollydbg


The bellow snapshot was taken as the target malware is loaded into the ollydbg environment. As it is seen explicitly seen the debugger translated the cczice.cmd in to its equivalent assembly language code with its respective memory addresses in the right side of the Editor. The Registers available in the left side of the editor will contain their values.


Once the target malware is presented on the ollydbg we can right click on the code editor to search for all referenced strings in the code as shown in the figure bellow. Doing so the inline text string with its perspective address and the handled command will be displayed.

On the search string Editor we can click on any address with its equivalent command we can see the possible register manipulations as well as the value in that current register.


A breakpoint can be taken form a given address and we can see the characteristics of the code manipulation after running the code .

The address indicated in the starting point of the target malware instruction is designated at the collection of 01711AA, from here we can make a Hardware breakpoint to catch during the execution.


Appendix

Antivirus Result Update

AVG Luhe.Fiha.A 20141117

AVware Trojan-Downloader.Win32.Wauchos.la (v) 20141117

Ad-Aware Gen:Variant.Symmi.26024 20141117

Agnitum Trojan.DL.Wauchos!K3Ruifcs1Es 20141116

AhnLab-V3 Trojan/Win32.Androm 20141116

Antiy-AVL Trojan[:HEUR]/Win32.Unknown 20141117

Avast Win32:Injector-BGE [Trj] 20141117

Avira Worm/Gamarue.F.1290 20141117

Baidu-International Trojan.Win32.Agent.AMRt 20141107

BitDefender Gen:Variant.Symmi.26024 20141117

CMC Trojan.Win32.Agentb!O 20141114

Comodo TrojWare.Win32.Injector.AJPG 20141117

File identification


MD5 e480220e4837910dbd33e491d942c5cd

SHA1 3f61a5dbc33303b3278ecaf87c10af0b9ee1df23

SHA256 025f76687658fa53dbf60d846a8cacfb1fe27f9ffbe87f74e61f7ca47da6ad8a

ssdeep

1536:95W65+2dxbZtoIwGS8JBh+mSEx1jeYSchAb+puLC5PQmskBTU8TxxbB7:jW5MbnownJBRxteYSc

B0C5omskBTU875

authentihash 4fd9b33583b53c2bed3704d2db26cbdf76e26fcae556ce8c509cdd01038ad20b

imphash e4bed1c0ed5f0904c6d73d069fefaffc

File size 127.7 KB ( 130754 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 Executable MS Visual C++ (generic) (42.1%)Win64 Executable (generic) (37.3%)Win32 Dynamic Link Library (generic) (8.8%)Win32 Executable (generic) (6.0%)Generic Win/DOS Executable (2.7%)

VirusTotal metadata

First submission 2014-07-03 12:48:06 UTC ( 4 months, 2 weeks ago )

Last submission 2014-11-17 08:29:06 UTC ( 3 minutes ago )

File names cczice.cmd

Advanced heuristic and reputation engines

ClamAV PUA

Possibly Unwanted Application. While not necessarily malicious, the scanned file presents certain

characteristics which depending on the user policies and environment may or may not represent a threat.

For full details see: http://www.clamav.net/doc/pua.html .

Deleted files


http://www.clamav.net/doc/pua.html

check (failed)

Created processes

C:\025f76687658fa53dbf60d846a8cacfb1fe27f9ffbe87f74e61f7ca47da6ad8a (successful)

Code injections in the following processes

025f76687658fa53dbf60d846a8cacfb1fe27f9ffbe87f74e61f7ca47da6ad8a (failed)

Opened mutexes

ShimCacheMutex (successful)

Runtime DLLs

kernel32 (successful)

ntdll.dll (successful)

advapi32.dll (successful)

The Assembly Code for the Target Malware

CPU Disasm

Address Hex dump Command Comments

00171000 33C0 XOR EAX,EAX

00171002 C2 1000 RETN 10

00171005 3B0D 04801700 CMP ECX,DWORD PTR DS:[178004]

0017100B 75 02 JNE SHORT 0017100F

0017100D F3:C3 REP RETN

0017100F E9 A0010000 JMP 001711B4

00171014 8BFF MOV EDI,EDI

00171016 55 PUSH EBP

00171017 8BEC MOV EBP,ESP

00171019 833D 488B1700 0 CMP DWORD PTR DS:[178B48],1

00171020 75 05 JNE SHORT 00171027

00171022 E8 A3070000 CALL 001717CA

00171027 FF75 08 PUSH DWORD PTR SS:[EBP+8]

0017102A E8 EC050000 CALL 0017161B

0017102F 68 FF000000 PUSH 0FF

00171034 E8 FC020000 CALL 00171335

00171039 59 POP ECX

0017103A 59 POP ECX

0017103B 5D POP EBP

0017103C C3 RETN

0017103D 6A 58 PUSH 58


0017103F 68 F0781700 PUSH OFFSET 001778F0

00171044 E8 57140000 CALL 001724A0

00171049 8D45 98 LEA EAX,[EBP-68]

0017104C 50 PUSH EAX

0017104D FF15 08601700 CALL DWORD PTR DS:[176008]

00171053 33F6 XOR ESI,ESI

00171055 3935 DC981700 CMP DWORD PTR DS:[1798DC],ESI

0017105B 75 0B JNE SHORT 00171068

0017105D 56 PUSH ESI

0017105E 56 PUSH ESI

0017105F 6A 01 PUSH 1

00171061 56 PUSH ESI

00171062 FF15 04601700 CALL DWORD PTR DS:[176004]

00171068 B8 4D5A0000 MOV EAX,5A4D

0017106D 66:3905 0000170 CMP WORD PTR DS:[170000],AX

00171074 74 05 JE SHORT 0017107B

00171076 8975 E4 MOV DWORD PTR SS:[EBP-1C],ESI

00171079 EB 36 JMP SHORT 001710B1

0017107B A1 3C001700 MOV EAX,DWORD PTR DS:[17003C]

00171080 81B8 00001700 5 CMP DWORD PTR DS:[EAX+170000],4550

0017108A ^ 75 EA JNE SHORT 00171076

0017108C B9 0B010000 MOV ECX,10B

00171091 66:3988 1800170 CMP WORD PTR DS:[EAX+170018],CX

00171098 ^ 75 DC JNE SHORT 00171076

0017109A 83B8 74001700 0 CMP DWORD PTR DS:[EAX+170074],0E ; ASCII ".

$"

001710A1 ^ 76 D3 JBE SHORT 00171076

001710A3 33C9 XOR ECX,ECX

001710A5 39B0 E8001700 CMP DWORD PTR DS:[EAX+1700E8],ESI

001710AB 0F95C1 SETNE CL

001710AE 894D E4 MOV DWORD PTR SS:[EBP-1C],ECX

001710B1 E8 C3130000 CALL 00172479

001710B6 85C0 TEST EAX,EAX

001710B8 75 08 JNE SHORT 001710C2

001710BA 6A 1C PUSH 1C

001710BC E8 53FFFFFF CALL 00171014

001710C1 59 POP ECX

001710C2 E8 37120000 CALL 001722FE

001710C7 85C0 TEST EAX,EAX

001710C9 75 08 JNE SHORT 001710D3

001710CB 6A 10 PUSH 10


001710CD E8 42FFFFFF CALL 00171014

001710D2 59 POP ECX

001710D3 E8 E10E0000 CALL 00171FB9

001710D8 8975 FC MOV DWORD PTR SS:[EBP-4],ESI

001710DB E8 940C0000 CALL 00171D74

001710E0 85C0 TEST EAX,EAX

001710E2 79 08 JNS SHORT 001710EC

001710E4 6A 1B PUSH 1B

001710E6 E8 EC040000 CALL 001715D7

001710EB 59 POP ECX

001710EC FF15 00601700 CALL DWORD PTR DS:[176000]

001710F2 A3 D8981700 MOV DWORD PTR DS:[1798D8],EAX

001710F7 E8 E10B0000 CALL 00171CDD

001710FC A3 408B1700 MOV DWORD PTR DS:[178B40],EAX

00171101 E8 1C0B0000 CALL 00171C22

00171106 85C0 TEST EAX,EAX

00171108 79 08 JNS SHORT 00171112

0017110A 6A 08 PUSH 8

0017110C E8 C6040000 CALL 001715D7

00171111 59 POP ECX

00171112 E8 95080000 CALL 001719AC


00171119 79 08 JNS SHORT 00171123

0017111B 6A 09 PUSH 9

0017111D E8 B5040000 CALL 001715D7

00171122 59 POP ECX

00171123 6A 01 PUSH 1

00171125 E8 8C020000 CALL 001713B6

0017112A 59 POP ECX

0017112B 3BC6 CMP EAX,ESI

0017112D 74 07 JE SHORT 00171136

0017112F 50 PUSH EAX

00171130 E8 A2040000 CALL 001715D7

00171135 59 POP ECX

00171136 E8 12080000 CALL 0017194D

0017113B F645 C4 01 TEST BYTE PTR SS:[EBP-3C],01

0017113F 74 06 JE SHORT 00171147

00171141 0FB74D C8 MOVZX ECX,WORD PTR SS:[EBP-38]

00171145 EB 03 JMP SHORT 0017114A

00171147 6A 0A PUSH 0A

00171149 59 POP ECX

0017114A 51 PUSH ECX


0017114B 50 PUSH EAX

0017114C 56 PUSH ESI

0017114D 68 00001700 PUSH OFFSET 00170000

00171152 E8 A9FEFFFF CALL 00171000

00171157 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX

0017115A 3975 E4 CMP DWORD PTR SS:[EBP-1C],ESI

0017115D 75 06 JNE SHORT 00171165


00171160 E8 28040000 CALL 0017158D

00171165 E8 4F040000 CALL 001715B9

0017116A EB 2E JMP SHORT 0017119A

0017116C 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]

0017116F 8B08 MOV ECX,DWORD PTR DS:[EAX]

00171171 8B09 MOV ECX,DWORD PTR DS:[ECX]

00171173 894D DC MOV DWORD PTR SS:[EBP-24],ECX

00171176 50 PUSH EAX

00171177 51 PUSH ECX

00171178 E8 86060000 CALL 00171803

0017117D 59 POP ECX

0017117E 59 POP ECX

0017117F C3 RETN

00171180 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18]

00171183 8B45 DC MOV EAX,DWORD PTR SS:[EBP-24]


00171189 837D E4 00 CMP DWORD PTR SS:[EBP-1C],0

0017118D 75 06 JNE SHORT 00171195


00171190 E8 0E040000 CALL 001715A3

00171195 E8 2E040000 CALL 001715C8

0017119A C745 FC FEFFFFF MOV DWORD PTR SS:[EBP-4],-2

001711A1 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]

001711A4 E8 3C130000 CALL 001724E5

001711A9 C3 RETN

001711AA E8 E0140000 CALL 0017268F

001711AF ^ E9 89FEFFFF JMP 0017103D

001711B4 8BFF MOV EDI,EDI

001711B6 55 PUSH EBP

001711B7 8BEC MOV EBP,ESP

001711B9 81EC 28030000 SUB ESP,328

001711BF A3 588C1700 MOV DWORD PTR DS:[178C58],EAX

001711C4 890D 548C1700 MOV DWORD PTR DS:[178C54],ECX

001711CA 8915 508C1700 MOV DWORD PTR DS:[178C50],EDX


001711D0 891D 4C8C1700 MOV DWORD PTR DS:[178C4C],EBX

001711D6 8935 488C1700 MOV DWORD PTR DS:[178C48],ESI

001711DC 893D 448C1700 MOV DWORD PTR DS:[178C44],EDI

001711E2 66:8C15 708C170 MOV WORD PTR DS:[178C70],SS ; Superfluous operand size

prefix

001711E9 66:8C0D 648C170 MOV WORD PTR DS:[178C64],CS ; Superfluous operand size

prefix

001711F0 66:8C1D 408C170 MOV WORD PTR DS:[178C40],DS ; Superfluous operand size

prefix

001711F7 66:8C05 3C8C170 MOV WORD PTR DS:[178C3C],ES ; Superfluous operand size

prefix

001711FE 66:8C25 388C170 MOV WORD PTR DS:[178C38],FS ; Superfluous operand size

prefix

00171205 66:8C2D 348C170 MOV WORD PTR DS:[178C34],GS ; Superfluous operand size

prefix

0017120C 9C PUSHFD

0017120D 8F05 688C1700 POP DWORD PTR DS:[178C68]

00171213 8B45 00 MOV EAX,DWORD PTR SS:[EBP]

00171216 A3 5C8C1700 MOV DWORD PTR DS:[178C5C],EAX

0017121B 8B45 04 MOV EAX,DWORD PTR SS:[EBP+4]

0017121E A3 608C1700 MOV DWORD PTR DS:[178C60],EAX

00171223 8D45 08 LEA EAX,[EBP+8]

00171226 A3 6C8C1700 MOV DWORD PTR DS:[178C6C],EAX

0017122B 8B85 E0FCFFFF MOV EAX,DWORD PTR SS:[EBP-320]

00171231 C705 A88B1700 0 MOV DWORD PTR DS:[178BA8],10001

0017123B A1 608C1700 MOV EAX,DWORD PTR DS:[178C60]

00171240 A3 5C8B1700 MOV DWORD PTR DS:[178B5C],EAX

00171245 C705 508B1700 0 MOV DWORD PTR DS:[178B50],C0000409

0017124F C705 548B1700 0 MOV DWORD PTR DS:[178B54],1

00171259 A1 04801700 MOV EAX,DWORD PTR DS:[178004]

0017125E 8985 D8FCFFFF MOV DWORD PTR SS:[EBP-328],EAX


00171269 8985 DCFCFFFF MOV DWORD PTR SS:[EBP-324],EAX

0017126F FF15 1C601700 CALL DWORD PTR DS:[17601C]

00171275 A3 A08B1700 MOV DWORD PTR DS:[178BA0],EAX

0017127A 6A 01 PUSH 1

0017127C E8 A9140000 CALL 0017272A

00171281 59 POP ECX

00171282 6A 00 PUSH 0


0017128A 68 2C611700 PUSH OFFSET 0017612C

0017128F FF15 14601700 CALL DWORD PTR DS:[176014]


00171295 833D A08B1700 0 CMP DWORD PTR DS:[178BA0],0

0017129C 75 08 JNE SHORT 001712A6

0017129E 6A 01 PUSH 1

001712A0 E8 85140000 CALL 0017272A

001712A5 59 POP ECX

001712A6 68 090400C0 PUSH C0000409

001712AB FF15 10601700 CALL DWORD PTR DS:[176010]

001712B1 50 PUSH EAX

001712B2 FF15 0C601700 CALL DWORD PTR DS:[17600C]

001712B8 C9 LEAVE

001712B9 C3 RETN

001712BA 8BFF MOV EDI,EDI

001712BC 55 PUSH EBP

001712BD 8BEC MOV EBP,ESP

001712BF 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

001712C2 8B00 MOV EAX,DWORD PTR DS:[EAX]

001712C4 8138 63736DE0 CMP DWORD PTR DS:[EAX],E06D7363

001712CA 75 2A JNE SHORT 001712F6

001712CC 8378 10 03 CMP DWORD PTR DS:[EAX+10],3

001712D0 75 24 JNE SHORT 001712F6

001712D2 8B40 14 MOV EAX,DWORD PTR DS:[EAX+14]

001712D5 3D 20059319 CMP EAX,19930520

001712DA 74 15 JE SHORT 001712F1

001712DC 3D 21059319 CMP EAX,19930521

001712E1 74 0E JE SHORT 001712F1

001712E3 3D 22059319 CMP EAX,19930522

001712E8 74 07 JE SHORT 001712F1

001712EA 3D 00409901 CMP EAX,1994000

001712EF 75 05 JNE SHORT 001712F6

001712F1 E8 3C140000 CALL 00172732

001712F6 33C0 XOR EAX,EAX

001712F8 5D POP EBP

001712F9 C2 0400 RETN 4

001712FC 68 BA121700 PUSH OFFSET 001712BA



00171309 C3 RETN

0017130A 8BFF MOV EDI,EDI

0017130C 55 PUSH EBP

0017130D 8BEC MOV EBP,ESP

0017130F 68 44611700 PUSH OFFSET 00176144 ; UNICODE "mscoree.dll"



0017131A 85C0 TEST EAX,EAX

0017131C 74 15 JE SHORT 00171333

0017131E 68 34611700 PUSH OFFSET 00176134 ; ASCII "CorExitProcess"

00171323 50 PUSH EAX



0017132C 74 05 JE SHORT 00171333

0017132E FF75 08 PUSH DWORD PTR SS:[EBP+8]

00171331 FFD0 CALL EAX

00171333 5D POP EBP

00171334 C3 RETN


00171337 55 PUSH EBP


0017133A FF75 08 PUSH DWORD PTR SS:[EBP+8]

0017133D E8 C8FFFFFF CALL 0017130A

00171342 59 POP ECX



0017134C CC INT3

0017134D 6A 08 PUSH 8

0017134F E8 A2150000 CALL 001728F6

00171354 59 POP ECX

00171355 C3 RETN

00171356 6A 08 PUSH 8

00171358 E8 C0140000 CALL 0017281D

0017135D 59 POP ECX

0017135E C3 RETN

0017135F 8BFF MOV EDI,EDI

00171361 56 PUSH ESI

00171362 E8 9E0C0000 CALL 00172005

00171367 8BF0 MOV ESI,EAX

00171369 56 PUSH ESI

0017136A E8 77190000 CALL 00172CE6

0017136F 56 PUSH ESI

00171370 E8 D7170000 CALL 00172B4C

00171375 56 PUSH ESI

00171376 E8 C2170000 CALL 00172B3D

0017137B 56 PUSH ESI

0017137C E8 AD170000 CALL 00172B2E

00171381 56 PUSH ESI

00171382 E8 A2150000 CALL 00172929


00171387 56 PUSH ESI

00171388 E8 DE130000 CALL 0017276B

0017138D 83C4 18 ADD ESP,18

00171390 5E POP ESI

00171391 C3 RETN


00171394 55 PUSH EBP


00171397 56 PUSH ESI

00171398 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]

0017139B 33C0 XOR EAX,EAX

0017139D EB 0F JMP SHORT 001713AE

0017139F 85C0 TEST EAX,EAX

001713A1 75 10 JNE SHORT 001713B3

001713A3 8B0E MOV ECX,DWORD PTR DS:[ESI]

001713A5 85C9 TEST ECX,ECX

001713A7 74 02 JE SHORT 001713AB

001713A9 FFD1 CALL ECX

001713AB 83C6 04 ADD ESI,4

001713AE 3B75 0C CMP ESI,DWORD PTR SS:[EBP+0C]

001713B1 ^ 72 EC JB SHORT 0017139F

001713B3 5E POP ESI

001713B4 5D POP EBP

001713B5 C3 RETN




001713BB 833D D0981700 0 CMP DWORD PTR DS:[1798D0],0

001713C2 74 19 JE SHORT 001713DD

001713C4 68 D0981700 PUSH OFFSET 001798D0

001713C9 E8 921B0000 CALL 00172F60

001713CE 59 POP ECX

001713CF 85C0 TEST EAX,EAX

001713D1 74 0A JE SHORT 001713DD

001713D3 FF75 08 PUSH DWORD PTR SS:[EBP+8]

001713D6 FF15 D0981700 CALL DWORD PTR DS:[1798D0]

001713DC 59 POP ECX

001713DD E8 CA1A0000 CALL 00172EAC

001713E2 68 F4601700 PUSH OFFSET 001760F4

001713E7 68 E0601700 PUSH OFFSET 001760E0

001713EC E8 A1FFFFFF CALL 00171392

001713F1 59 POP ECX


001713F2 59 POP ECX

001713F3 85C0 TEST EAX,EAX

001713F5 75 54 JNE SHORT 0017144B

001713F7 56 PUSH ESI

001713F8 57 PUSH EDI

001713F9 68 DF1F1700 PUSH OFFSET 00171FDF

001713FE E8 921A0000 CALL 00172E95

00171403 B8 D8601700 MOV EAX,OFFSET 001760D8

00171408 BE DC601700 MOV ESI,OFFSET 001760DC

0017140D 59 POP ECX

0017140E 8BF8 MOV EDI,EAX

00171410 3BC6 CMP EAX,ESI

00171412 73 0F JNB SHORT 00171423

00171414 8B07 MOV EAX,DWORD PTR DS:[EDI]


00171418 74 02 JE SHORT 0017141C

0017141A FFD0 CALL EAX

0017141C 83C7 04 ADD EDI,4

0017141F 3BFE CMP EDI,ESI

00171421 ^ 72 F1 JB SHORT 00171414

00171423 833D D4981700 0 CMP DWORD PTR DS:[1798D4],0

0017142A 5F POP EDI

0017142B 5E POP ESI

0017142C 74 1B JE SHORT 00171449

0017142E 68 D4981700 PUSH OFFSET 001798D4

00171433 E8 281B0000 CALL 00172F60

00171438 59 POP ECX


0017143B 74 0C JE SHORT 00171449

0017143D 6A 00 PUSH 0

0017143F 6A 02 PUSH 2

00171441 6A 00 PUSH 0

00171443 FF15 D4981700 CALL DWORD PTR DS:[1798D4]


0017144B 5D POP EBP

0017144C C3 RETN

0017144D 6A 20 PUSH 20

0017144F 68 10791700 PUSH OFFSET 00177910

00171454 E8 47100000 CALL 001724A0

00171459 6A 08 PUSH 8

0017145B E8 96140000 CALL 001728F6

00171460 59 POP ECX


00171461 8365 FC 00 AND DWORD PTR SS:[EBP-4],00000000


00171467 40 INC EAX

00171468 3905 A48E1700 CMP DWORD PTR DS:[178EA4],EAX

0017146E 0F84 D8000000 JE 0017154C

00171474 A3 A08E1700 MOV DWORD PTR DS:[178EA0],EAX

00171479 8A45 10 MOV AL,BYTE PTR SS:[EBP+10]

0017147C A2 9C8E1700 MOV BYTE PTR DS:[178E9C],AL

00171481 837D 0C 00 CMP DWORD PTR SS:[EBP+0C],0

00171485 0F85 A0000000 JNE 0017152B

0017148B FF35 C8981700 PUSH DWORD PTR DS:[1798C8]

00171491 8B35 208B1700 MOV ESI,DWORD PTR DS:[178B20]

00171497 FFD6 CALL ESI

00171499 8BD8 MOV EBX,EAX

0017149B 895D D0 MOV DWORD PTR SS:[EBP-30],EBX

0017149E 85DB TEST EBX,EBX

001714A0 74 68 JE SHORT 0017150A

001714A2 FF35 C4981700 PUSH DWORD PTR DS:[1798C4]

001714A8 FFD6 CALL ESI

001714AA 8BF8 MOV EDI,EAX

001714AC 897D D4 MOV DWORD PTR SS:[EBP-2C],EDI

001714AF 895D DC MOV DWORD PTR SS:[EBP-24],EBX

001714B2 897D D8 MOV DWORD PTR SS:[EBP-28],EDI

001714B5 83EF 04 SUB EDI,4

001714B8 897D D4 MOV DWORD PTR SS:[EBP-2C],EDI

001714BB 3BFB CMP EDI,EBX

001714BD 72 4B JB SHORT 0017150A

001714BF E8 410B0000 CALL 00172005

001714C4 3907 CMP DWORD PTR DS:[EDI],EAX

001714C6 ^ 74 ED JE SHORT 001714B5

001714C8 3BFB CMP EDI,EBX

001714CA 72 3E JB SHORT 0017150A

001714CC FF37 PUSH DWORD PTR DS:[EDI]

001714CE FFD6 CALL ESI

001714D0 8BD8 MOV EBX,EAX

001714D2 E8 2E0B0000 CALL 00172005

001714D7 8907 MOV DWORD PTR DS:[EDI],EAX

001714D9 FFD3 CALL EBX

001714DB FF35 C8981700 PUSH DWORD PTR DS:[1798C8]

001714E1 FFD6 CALL ESI

001714E3 8BD8 MOV EBX,EAX

001714E5 FF35 C4981700 PUSH DWORD PTR DS:[1798C4]


001714EB FFD6 CALL ESI

001714ED 395D DC CMP DWORD PTR SS:[EBP-24],EBX

001714F0 75 05 JNE SHORT 001714F7

001714F2 3945 D8 CMP DWORD PTR SS:[EBP-28],EAX

001714F5 74 0E JE SHORT 00171505

001714F7 895D DC MOV DWORD PTR SS:[EBP-24],EBX

001714FA 895D D0 MOV DWORD PTR SS:[EBP-30],EBX

001714FD 8945 D8 MOV DWORD PTR SS:[EBP-28],EAX

00171500 8BF8 MOV EDI,EAX

00171502 897D D4 MOV DWORD PTR SS:[EBP-2C],EDI

00171505 8B5D D0 MOV EBX,DWORD PTR SS:[EBP-30]

00171508 ^ EB AB JMP SHORT 001714B5

0017150A C745 E4 F860170 MOV DWORD PTR SS:[EBP-1C],OFFSET 001760F

00171511 817D E4 FC60170 CMP DWORD PTR SS:[EBP-1C],OFFSET 001760F

00171518 73 11 JNB SHORT 0017152B

0017151A 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]

0017151D 8B00 MOV EAX,DWORD PTR DS:[EAX]


00171521 74 02 JE SHORT 00171525


00171525 8345 E4 04 ADD DWORD PTR SS:[EBP-1C],4

00171529 ^ EB E6 JMP SHORT 00171511

0017152B C745 E0 0061170 MOV DWORD PTR SS:[EBP-20],OFFSET 0017610

00171532 817D E0 0461170 CMP DWORD PTR SS:[EBP-20],OFFSET 0017610

00171539 73 11 JNB SHORT 0017154C

0017153B 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]

0017153E 8B00 MOV EAX,DWORD PTR DS:[EAX]


00171542 74 02 JE SHORT 00171546


00171546 8345 E0 04 ADD DWORD PTR SS:[EBP-20],4

0017154A ^ EB E6 JMP SHORT 00171532

0017154C C745 FC FEFFFFF MOV DWORD PTR SS:[EBP-4],-2

00171553 E8 20000000 CALL 00171578

00171558 837D 10 00 CMP DWORD PTR SS:[EBP+10],0

0017155C 75 29 JNE SHORT 00171587

0017155E C705 A48E1700 0 MOV DWORD PTR DS:[178EA4],1

00171568 6A 08 PUSH 8

0017156A E8 AE120000 CALL 0017281D

0017156F 59 POP ECX


00171573 E8 BDFDFFFF CALL 00171335


00171578 837D 10 00 CMP DWORD PTR SS:[EBP+10],0

0017157C 74 08 JE SHORT 00171586

0017157E 6A 08 PUSH 8

00171580 E8 98120000 CALL 0017281D

00171585 59 POP ECX

00171586 C3 RETN

00171587 E8 590F0000 CALL 001724E5

0017158C C3 RETN

0017158D 8BFF MOV EDI,EDI

0017158F 55 PUSH EBP


00171592 6A 00 PUSH 0

00171594 6A 00 PUSH 0


00171599 E8 AFFEFFFF CALL 0017144D

0017159E 83C4 0C ADD ESP,0C

001715A1 5D POP EBP

001715A2 C3 RETN

001715A3 8BFF MOV EDI,EDI

001715A5 55 PUSH EBP

001715A6 8BEC MOV EBP,ESP

001715A8 6A 00 PUSH 0

001715AA 6A 01 PUSH 1

001715AC FF75 08 PUSH DWORD PTR SS:[EBP+8]

001715AF E8 99FEFFFF CALL 0017144D

001715B4 83C4 0C ADD ESP,0C

001715B7 5D POP EBP

001715B8 C3 RETN

001715B9 6A 01 PUSH 1

001715BB 6A 00 PUSH 0

001715BD 6A 00 PUSH 0

001715BF E8 89FEFFFF CALL 0017144D

001715C4 83C4 0C ADD ESP,0C

001715C7 C3 RETN

001715C8 6A 01 PUSH 1

001715CA 6A 01 PUSH 1

001715CC 6A 00 PUSH 0

001715CE E8 7AFEFFFF CALL 0017144D

001715D3 83C4 0C ADD ESP,0C

001715D6 C3 RETN

001715D7 8BFF MOV EDI,EDI

001715D9 55 PUSH EBP


001715DA 8BEC MOV EBP,ESP

001715DC E8 E9010000 CALL 001717CA

001715E1 FF75 08 PUSH DWORD PTR SS:[EBP+8]

001715E4 E8 32000000 CALL 0017161B

001715E9 59 POP ECX

001715EA 68 FF000000 PUSH 0FF

001715EF E8 AFFFFFFF CALL 001715A3

001715F4 CC INT3

001715F5 8BFF MOV EDI,EDI

001715F7 55 PUSH EBP

001715F8 8BEC MOV EBP,ESP

001715FA 33C0 XOR EAX,EAX

001715FC 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]

001715FF 3B0CC5 E0691700 CMP ECX,DWORD PTR DS:[EAX*8+1769E0]

00171606 74 0A JE SHORT 00171612

00171608 40 INC EAX

00171609 83F8 16 CMP EAX,16

0017160C ^ 72 EE JB SHORT 001715FC

0017160E 33C0 XOR EAX,EAX

00171610 5D POP EBP

00171611 C3 RETN

00171612 8B04C5 E4691700 MOV EAX,DWORD PTR DS:[EAX*8+1769E4] ; PTR to UNICODE

"R6002

- floating point support not loaded

"

00171619 5D POP EBP

0017161A C3 RETN

0017161B 8BFF MOV EDI,EDI

0017161D 55 PUSH EBP

0017161E 8BEC MOV EBP,ESP

00171620 81EC FC010000 SUB ESP,1FC


0017162B 33C5 XOR EAX,EBP

0017162D 8945 FC MOV DWORD PTR SS:[EBP-4],EAX

00171630 53 PUSH EBX

00171631 56 PUSH ESI


00171635 57 PUSH EDI

00171636 56 PUSH ESI

00171637 E8 B9FFFFFF CALL 001715F5

0017163C 8BF8 MOV EDI,EAX

0017163E 33DB XOR EBX,EBX


00171640 59 POP ECX

00171641 89BD 04FEFFFF MOV DWORD PTR SS:[EBP-1FC],EDI

00171647 3BFB CMP EDI,EBX

00171649 0F84 6C010000 JE 001717BB

0017164F 6A 03 PUSH 3

00171651 E8 811D0000 CALL 001733D7

00171656 59 POP ECX

00171657 83F8 01 CMP EAX,1

0017165A 0F84 07010000 JE 00171767

00171660 6A 03 PUSH 3

00171662 E8 701D0000 CALL 001733D7

00171667 59 POP ECX


0017166A 75 0D JNE SHORT 00171679

0017166C 833D 00801700 0 CMP DWORD PTR DS:[178000],1

00171673 0F84 EE000000 JE 00171767

00171679 81FE FC000000 CMP ESI,0FC

0017167F 0F84 36010000 JE 001717BB

00171685 68 1C6B1700 PUSH OFFSET 00176B1C ; UNICODE "Runtime Error!

Program: "

0017168A 68 14030000 PUSH 314

0017168F BF A88E1700 MOV EDI,OFFSET 00178EA8

00171694 57 PUSH EDI

00171695 E8 DA1C0000 CALL 00173374

0017169A 83C4 0C ADD ESP,0C

0017169D 85C0 TEST EAX,EAX

0017169F 0F85 B8000000 JNE 0017175D

001716A5 68 04010000 PUSH 104

001716AA BE DA8E1700 MOV ESI,OFFSET 00178EDA

001716AF 56 PUSH ESI

001716B0 53 PUSH EBX

001716B1 66:A3 E2901700 MOV WORD PTR DS:[1790E2],AX

001716B7 FF15 34601700 CALL DWORD PTR DS:[176034]

001716BD BB FB020000 MOV EBX,2FB


001716C4 75 1F JNE SHORT 001716E5

001716C6 68 EC6A1700 PUSH OFFSET 00176AEC ; UNICODE "<program name

unknown>"

001716CB 53 PUSH EBX

001716CC 56 PUSH ESI

001716CD E8 A21C0000 CALL 00173374


001716D2 83C4 0C ADD ESP,0C

001716D5 85C0 TEST EAX,EAX

001716D7 74 0C JE SHORT 001716E5

001716D9 33C0 XOR EAX,EAX

001716DB 50 PUSH EAX

001716DC 50 PUSH EAX

001716DD 50 PUSH EAX

001716DE 50 PUSH EAX

001716DF 50 PUSH EAX

001716E0 E8 9F150000 CALL 00172C84

001716E5 56 PUSH ESI

001716E6 E8 6E1C0000 CALL 00173359

001716EB 40 INC EAX

001716EC 59 POP ECX

001716ED 83F8 3C CMP EAX,3C

001716F0 76 2A JBE SHORT 0017171C


001716F3 E8 611C0000 CALL 00173359

001716F8 8D0445 648E1700 LEA EAX,[EAX*2+178E64]

001716FF 8BC8 MOV ECX,EAX

00171701 2BCE SUB ECX,ESI

00171703 6A 03 PUSH 3

00171705 D1F9 SAR ECX,1

00171707 68 E46A1700 PUSH OFFSET 00176AE4 ; UNICODE "..."

0017170C 2BD9 SUB EBX,ECX

0017170E 53 PUSH EBX


00171710 E8 771B0000 CALL 0017328C

00171715 83C4 14 ADD ESP,14


0017171A ^ 75 BD JNE SHORT 001716D9

0017171C 68 DC6A1700 PUSH OFFSET 00176ADC ; UNICODE "

"

00171721 BE 14030000 MOV ESI,314

00171726 56 PUSH ESI

00171727 57 PUSH EDI

00171728 E8 EA1A0000 CALL 00173217

0017172D 83C4 0C ADD ESP,0C


00171732 ^ 75 A5 JNE SHORT 001716D9

00171734 FFB5 04FEFFFF PUSH DWORD PTR SS:[EBP-1FC]


0017173A 56 PUSH ESI

0017173B 57 PUSH EDI

0017173C E8 D61A0000 CALL 00173217

00171741 83C4 0C ADD ESP,0C


00171746 ^ 75 91 JNE SHORT 001716D9

00171748 68 10200100 PUSH 12010

0017174D 68 906A1700 PUSH OFFSET 00176A90 ; UNICODE "Microsoft Visual C++

Runtime Library"

00171752 57 PUSH EDI

00171753 E8 53190000 CALL 001730AB

00171758 83C4 0C ADD ESP,0C

0017175B EB 5E JMP SHORT 001717BB

0017175D 53 PUSH EBX


0017175F 53 PUSH EBX

00171760 53 PUSH EBX

00171761 53 PUSH EBX

00171762 ^ E9 79FFFFFF JMP 001716E0

00171767 6A F4 PUSH -0C


0017176F 8BF0 MOV ESI,EAX

00171771 3BF3 CMP ESI,EBX

00171773 74 46 JE SHORT 001717BB

00171775 83FE FF CMP ESI,-1

00171778 74 41 JE SHORT 001717BB

0017177A 33C0 XOR EAX,EAX

0017177C 8A0C47 MOV CL,BYTE PTR DS:[EAX*2+EDI]

0017177F 888C05 08FEFFFF MOV BYTE PTR SS:[EAX+EBP-1F8],CL

00171786 66:391C47 CMP WORD PTR DS:[EAX*2+EDI],BX

0017178A 74 08 JE SHORT 00171794

0017178C 40 INC EAX

0017178D 3D F4010000 CMP EAX,1F4

00171792 ^ 72 E8 JB SHORT 0017177C

00171794 53 PUSH EBX

00171795 8D85 04FEFFFF LEA EAX,[EBP-1FC]


0017179C 8D85 08FEFFFF LEA EAX,[EBP-1F8]

001717A2 50 PUSH EAX

001717A3 885D FB MOV BYTE PTR SS:[EBP-5],BL

001717A6 E8 75180000 CALL 00173020

001717AB 59 POP ECX


001717AC 50 PUSH EAX

001717AD 8D85 08FEFFFF LEA EAX,[EBP-1F8]


001717B4 56 PUSH ESI

001717B5 FF15 2C601700 CALL DWORD PTR DS:[17602C]

001717BB 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]

001717BE 5F POP EDI

001717BF 5E POP ESI

001717C0 33CD XOR ECX,EBP

001717C2 5B POP EBX

001717C3 E8 3DF8FFFF CALL 00171005

001717C8 C9 LEAVE

001717C9 C3 RETN

001717CA 6A 03 PUSH 3

001717CC E8 061C0000 CALL 001733D7

001717D1 59 POP ECX

001717D2 83F8 01 CMP EAX,1

001717D5 74 15 JE SHORT 001717EC

001717D7 6A 03 PUSH 3

001717D9 E8 F91B0000 CALL 001733D7

001717DE 59 POP ECX

001717DF 85C0 TEST EAX,EAX

001717E1 75 1F JNE SHORT 00171802

001717E3 833D 00801700 0 CMP DWORD PTR DS:[178000],1

001717EA 75 16 JNE SHORT 00171802

001717EC 68 FC000000 PUSH 0FC

001717F1 E8 25FEFFFF CALL 0017161B

001717F6 68 FF000000 PUSH 0FF

001717FB E8 1BFEFFFF CALL 0017161B

00171800 59 POP ECX

00171801 59 POP ECX

00171802 C3 RETN


00171805 55 PUSH EBP


00171808 56 PUSH ESI

00171809 E8 2E090000 CALL 0017213C

0017180E 8BF0 MOV ESI,EAX

00171810 85F6 TEST ESI,ESI

00171812 0F84 32010000 JE 0017194A

00171818 8B4E 5C MOV ECX,DWORD PTR DS:[ESI+5C]

0017181B 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]


0017181E 8BC1 MOV EAX,ECX

00171820 57 PUSH EDI

00171821 3910 CMP DWORD PTR DS:[EAX],EDX

00171823 74 0D JE SHORT 00171832

00171825 83C0 0C ADD EAX,0C

00171828 8DB9 90000000 LEA EDI,[ECX+90]

0017182E 3BC7 CMP EAX,EDI

00171830 ^ 72 EF JB SHORT 00171821

00171832 81C1 90000000 ADD ECX,90

00171838 3BC1 CMP EAX,ECX

0017183A 73 04 JNB SHORT 00171840

0017183C 3910 CMP DWORD PTR DS:[EAX],EDX

0017183E 74 02 JE SHORT 00171842



00171844 74 07 JE SHORT 0017184D

00171846 8B50 08 MOV EDX,DWORD PTR DS:[EAX+8]

00171849 85D2 TEST EDX,EDX

0017184B 75 07 JNE SHORT 00171854

0017184D 33C0 XOR EAX,EAX

0017184F E9 F5000000 JMP 00171949

00171854 83FA 05 CMP EDX,5

00171857 75 0C JNE SHORT 00171865

00171859 8360 08 00 AND DWORD PTR DS:[EAX+8],00000000


0017185F 40 INC EAX

00171860 E9 E4000000 JMP 00171949

00171865 83FA 01 CMP EDX,1

00171868 0F84 D8000000 JE 00171946

0017186E 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]

00171871 53 PUSH EBX

00171872 8B5E 60 MOV EBX,DWORD PTR DS:[ESI+60]

00171875 894E 60 MOV DWORD PTR DS:[ESI+60],ECX

00171878 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4]

0017187B 83F9 08 CMP ECX,8

0017187E 0F85 B6000000 JNE 0017193A

00171884 6A 24 PUSH 24

00171886 59 POP ECX

00171887 8B7E 5C MOV EDI,DWORD PTR DS:[ESI+5C]

0017188A 836439 08 00 AND DWORD PTR DS:[EDI+ECX+8],00000000

0017188F 83C1 0C ADD ECX,0C

00171892 81F9 90000000 CMP ECX,90


00171898 ^ 7C ED JL SHORT 00171887

0017189A 8B00 MOV EAX,DWORD PTR DS:[EAX]

0017189C 8B7E 64 MOV EDI,DWORD PTR DS:[ESI+64]

0017189F 3D 8E0000C0 CMP EAX,C000008E

001718A4 75 09 JNE SHORT 001718AF

001718A6 C746 64 8300000 MOV DWORD PTR DS:[ESI+64],83

001718AD EB 7E JMP SHORT 0017192D

001718AF 3D 900000C0 CMP EAX,C0000090

001718B4 75 09 JNE SHORT 001718BF

001718B6 C746 64 8100000 MOV DWORD PTR DS:[ESI+64],81

001718BD EB 6E JMP SHORT 0017192D

001718BF 3D 910000C0 CMP EAX,C0000091

001718C4 75 09 JNE SHORT 001718CF

001718C6 C746 64 8400000 MOV DWORD PTR DS:[ESI+64],84

001718CD EB 5E JMP SHORT 0017192D

001718CF 3D 930000C0 CMP EAX,C0000093

001718D4 75 09 JNE SHORT 001718DF

001718D6 C746 64 8500000 MOV DWORD PTR DS:[ESI+64],85

001718DD EB 4E JMP SHORT 0017192D

001718DF 3D 8D0000C0 CMP EAX,C000008D

001718E4 75 09 JNE SHORT 001718EF

001718E6 C746 64 8200000 MOV DWORD PTR DS:[ESI+64],82

001718ED EB 3E JMP SHORT 0017192D

001718EF 3D 8F0000C0 CMP EAX,C000008F

001718F4 75 09 JNE SHORT 001718FF

001718F6 C746 64 8600000 MOV DWORD PTR DS:[ESI+64],86

001718FD EB 2E JMP SHORT 0017192D

001718FF 3D 920000C0 CMP EAX,C0000092

00171904 75 09 JNE SHORT 0017190F

00171906 C746 64 8A00000 MOV DWORD PTR DS:[ESI+64],8A

0017190D EB 1E JMP SHORT 0017192D

0017190F 3D B50200C0 CMP EAX,C00002B5

00171914 75 09 JNE SHORT 0017191F

00171916 C746 64 8D00000 MOV DWORD PTR DS:[ESI+64],8D

0017191D EB 0E JMP SHORT 0017192D

0017191F 3D B40200C0 CMP EAX,C00002B4

00171924 75 07 JNE SHORT 0017192D

00171926 C746 64 8E00000 MOV DWORD PTR DS:[ESI+64],8E

0017192D FF76 64 PUSH DWORD PTR DS:[ESI+64]

00171930 6A 08 PUSH 8

00171932 FFD2 CALL EDX

00171934 59 POP ECX


00171935 897E 64 MOV DWORD PTR DS:[ESI+64],EDI

00171938 EB 07 JMP SHORT 00171941

0017193A 8360 08 00 AND DWORD PTR DS:[EAX+8],00000000

0017193E 51 PUSH ECX

0017193F FFD2 CALL EDX

00171941 59 POP ECX

00171942 895E 60 MOV DWORD PTR DS:[ESI+60],EBX

00171945 5B POP EBX

00171946 83C8 FF OR EAX,FFFFFFFF

00171949 5F POP EDI

0017194A 5E POP ESI

0017194B 5D POP EBP

0017194C C3 RETN



00171950 57 PUSH EDI

00171951 33FF XOR EDI,EDI

00171953 393D CC981700 CMP DWORD PTR DS:[1798CC],EDI

00171959 75 05 JNE SHORT 00171960

0017195B E8 6E220000 CALL 00173BCE

00171960 8B35 D8981700 MOV ESI,DWORD PTR DS:[1798D8]


00171968 75 05 JNE SHORT 0017196F

0017196A BE F06B1700 MOV ESI,OFFSET 00176BF0

0017196F 8A06 MOV AL,BYTE PTR DS:[ESI]

00171971 3C 20 CMP AL,20

00171973 77 08 JA SHORT 0017197D

00171975 84C0 TEST AL,AL

00171977 74 2E JE SHORT 001719A7

00171979 85FF TEST EDI,EDI

0017197B 74 24 JE SHORT 001719A1

0017197D 3C 22 CMP AL,22

0017197F 75 09 JNE SHORT 0017198A

00171981 33C9 XOR ECX,ECX


00171985 0F94C1 SETE CL

00171988 8BF9 MOV EDI,ECX

0017198A 0FB6C0 MOVZX EAX,AL

0017198D 50 PUSH EAX

0017198E E8 5D1B0000 CALL 001734F0

00171993 59 POP ECX



00171996 74 01 JE SHORT 00171999

00171998 46 INC ESI

00171999 46 INC ESI

0017199A ^ EB D3 JMP SHORT 0017196F

0017199C 3C 20 CMP AL,20

0017199E 77 07 JA SHORT 001719A7

001719A0 46 INC ESI

001719A1 8A06 MOV AL,BYTE PTR DS:[ESI]

001719A3 84C0 TEST AL,AL

001719A5 ^ 75 F5 JNE SHORT 0017199C

001719A7 5F POP EDI

001719A8 8BC6 MOV EAX,ESI

001719AA 5E POP ESI

001719AB C3 RETN

001719AC 833D CC981700 0 CMP DWORD PTR DS:[1798CC],0

001719B3 75 05 JNE SHORT 001719BA

001719B5 E8 14220000 CALL 00173BCE

001719BA 56 PUSH ESI

001719BB 8B35 408B1700 MOV ESI,DWORD PTR DS:[178B40]

001719C1 57 PUSH EDI

001719C2 33FF XOR EDI,EDI

001719C4 85F6 TEST ESI,ESI

001719C6 75 18 JNE SHORT 001719E0

001719C8 83C8 FF OR EAX,FFFFFFFF

001719CB E9 91000000 JMP 00171A61

001719D0 3C 3D CMP AL,3D

001719D2 74 01 JE SHORT 001719D5

001719D4 47 INC EDI

001719D5 56 PUSH ESI

001719D6 E8 45160000 CALL 00173020

001719DB 59 POP ECX

001719DC 8D7406 01 LEA ESI,[EAX+ESI+1]

001719E0 8A06 MOV AL,BYTE PTR DS:[ESI]

001719E2 84C0 TEST AL,AL

001719E4 ^ 75 EA JNE SHORT 001719D0

001719E6 6A 04 PUSH 4

001719E8 47 INC EDI

001719E9 57 PUSH EDI

001719EA E8 DB220000 CALL 00173CCA

001719EF 8BF8 MOV EDI,EAX

001719F1 59 POP ECX

001719F2 59 POP ECX


001719F3 893D 848E1700 MOV DWORD PTR DS:[178E84],EDI

001719F9 85FF TEST EDI,EDI

001719FB ^ 74 CB JE SHORT 001719C8

001719FD 8B35 408B1700 MOV ESI,DWORD PTR DS:[178B40]

00171A03 53 PUSH EBX

00171A04 EB 33 JMP SHORT 00171A39

00171A06 56 PUSH ESI

00171A07 E8 14160000 CALL 00173020

00171A0C 803E 3D CMP BYTE PTR DS:[ESI],3D

00171A0F 59 POP ECX

00171A10 8D58 01 LEA EBX,[EAX+1]

00171A13 74 22 JE SHORT 00171A37

00171A15 6A 01 PUSH 1


00171A18 E8 AD220000 CALL 00173CCA

00171A1D 59 POP ECX

00171A1E 59 POP ECX

00171A1F 8907 MOV DWORD PTR DS:[EDI],EAX

00171A21 85C0 TEST EAX,EAX

00171A23 74 3F JE SHORT 00171A64




00171A28 E8 F9210000 CALL 00173C26

00171A2D 83C4 0C ADD ESP,0C


00171A32 75 47 JNE SHORT 00171A7B

00171A34 83C7 04 ADD EDI,4

00171A37 03F3 ADD ESI,EBX

00171A39 803E 00 CMP BYTE PTR DS:[ESI],0

00171A3C ^ 75 C8 JNE SHORT 00171A06

00171A3E FF35 408B1700 PUSH DWORD PTR DS:[178B40]

00171A44 E8 A3210000 CALL 00173BEC

00171A49 8325 408B1700 0 AND DWORD PTR DS:[178B40],00000000

00171A50 8327 00 AND DWORD PTR DS:[EDI],00000000

00171A53 C705 C0981700 0 MOV DWORD PTR DS:[1798C0],1

00171A5D 33C0 XOR EAX,EAX

00171A5F 59 POP ECX

00171A60 5B POP EBX

00171A61 5F POP EDI

00171A62 5E POP ESI

00171A63 C3 RETN


00171A64 FF35 848E1700 PUSH DWORD PTR DS:[178E84]

00171A6A E8 7D210000 CALL 00173BEC

00171A6F 8325 848E1700 0 AND DWORD PTR DS:[178E84],00000000

00171A76 83C8 FF OR EAX,FFFFFFFF

00171A79 ^ EB E4 JMP SHORT 00171A5F

00171A7B 33C0 XOR EAX,EAX

00171A7D 50 PUSH EAX

00171A7E 50 PUSH EAX

00171A7F 50 PUSH EAX



00171A82 E8 FD110000 CALL 00172C84

00171A87 CC INT3


00171A8A 55 PUSH EBP

00171A8B 8BEC MOV EBP,ESP

00171A8D 51 PUSH ECX

00171A8E 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]


00171A92 33C0 XOR EAX,EAX


00171A95 8907 MOV DWORD PTR DS:[EDI],EAX

00171A97 8BF2 MOV ESI,EDX

00171A99 8B55 0C MOV EDX,DWORD PTR SS:[EBP+0C]

00171A9C C701 01000000 MOV DWORD PTR DS:[ECX],1

00171AA2 3945 08 CMP DWORD PTR SS:[EBP+8],EAX

00171AA5 74 09 JE SHORT 00171AB0

00171AA7 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+8]

00171AAA 8345 08 04 ADD DWORD PTR SS:[EBP+8],4

00171AAE 8913 MOV DWORD PTR DS:[EBX],EDX

00171AB0 8945 FC MOV DWORD PTR SS:[EBP-4],EAX

00171AB3 803E 22 CMP BYTE PTR DS:[ESI],22

00171AB6 75 10 JNE SHORT 00171AC8

00171AB8 33C0 XOR EAX,EAX

00171ABA 3945 FC CMP DWORD PTR SS:[EBP-4],EAX

00171ABD B3 22 MOV BL,22

00171ABF 0F94C0 SETE AL

00171AC2 46 INC ESI

00171AC3 8945 FC MOV DWORD PTR SS:[EBP-4],EAX

00171AC6 EB 3C JMP SHORT 00171B04

00171AC8 FF07 INC DWORD PTR DS:[EDI]

00171ACA 85D2 TEST EDX,EDX


00171ACC 74 08 JE SHORT 00171AD6

00171ACE 8A06 MOV AL,BYTE PTR DS:[ESI]

00171AD0 8802 MOV BYTE PTR DS:[EDX],AL

00171AD2 42 INC EDX

00171AD3 8955 0C MOV DWORD PTR SS:[EBP+0C],EDX

00171AD6 8A1E MOV BL,BYTE PTR DS:[ESI]

00171AD8 0FB6C3 MOVZX EAX,BL

00171ADB 50 PUSH EAX

00171ADC 46 INC ESI

00171ADD E8 0E1A0000 CALL 001734F0

00171AE2 59 POP ECX

00171AE3 85C0 TEST EAX,EAX

00171AE5 74 13 JE SHORT 00171AFA

00171AE7 FF07 INC DWORD PTR DS:[EDI]

00171AE9 837D 0C 00 CMP DWORD PTR SS:[EBP+0C],0

00171AED 74 0A JE SHORT 00171AF9

00171AEF 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]

00171AF2 8A06 MOV AL,BYTE PTR DS:[ESI]

00171AF4 FF45 0C INC DWORD PTR SS:[EBP+0C]

00171AF7 8801 MOV BYTE PTR DS:[ECX],AL

00171AF9 46 INC ESI

00171AFA 8B55 0C MOV EDX,DWORD PTR SS:[EBP+0C]

00171AFD 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]

00171B00 84DB TEST BL,BL

00171B02 74 32 JE SHORT 00171B36

00171B04 837D FC 00 CMP DWORD PTR SS:[EBP-4],0

00171B08 ^ 75 A9 JNE SHORT 00171AB3

00171B0A 80FB 20 CMP BL,20

00171B0D 74 05 JE SHORT 00171B14

00171B0F 80FB 09 CMP BL,9

00171B12 ^ 75 9F JNE SHORT 00171AB3

00171B14 85D2 TEST EDX,EDX

00171B16 74 04 JE SHORT 00171B1C

00171B18 C642 FF 00 MOV BYTE PTR DS:[EDX-1],0

00171B1C 8365 FC 00 AND DWORD PTR SS:[EBP-4],00000000

00171B20 803E 00 CMP BYTE PTR DS:[ESI],0

00171B23 0F84 E9000000 JE 00171C12

00171B29 8A06 MOV AL,BYTE PTR DS:[ESI]

00171B2B 3C 20 CMP AL,20

00171B2D 74 04 JE SHORT 00171B33

00171B2F 3C 09 CMP AL,9

00171B31 75 06 JNE SHORT 00171B39


00171B33 46 INC ESI

00171B34 ^ EB F3 JMP SHORT 00171B29

00171B36 4E DEC ESI

00171B37 ^ EB E3 JMP SHORT 00171B1C


00171B3C 0F84 D0000000 JE 00171C12

00171B42 837D 08 00 CMP DWORD PTR SS:[EBP+8],0

00171B46 74 09 JE SHORT 00171B51

00171B48 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

00171B4B 8345 08 04 ADD DWORD PTR SS:[EBP+8],4

00171B4F 8910 MOV DWORD PTR DS:[EAX],EDX

00171B51 FF01 INC DWORD PTR DS:[ECX]

00171B53 33DB XOR EBX,EBX

00171B55 43 INC EBX

00171B56 33C9 XOR ECX,ECX

00171B58 EB 02 JMP SHORT 00171B5C

00171B5A 46 INC ESI

00171B5B 41 INC ECX

00171B5C 803E 5C CMP BYTE PTR DS:[ESI],5C

00171B5F ^ 74 F9 JE SHORT 00171B5A


00171B64 75 26 JNE SHORT 00171B8C

00171B66 F6C1 01 TEST CL,01

00171B69 75 1F JNE SHORT 00171B8A

00171B6B 837D FC 00 CMP DWORD PTR SS:[EBP-4],0

00171B6F 74 0C JE SHORT 00171B7D

00171B71 8D46 01 LEA EAX,[ESI+1]

00171B74 8038 22 CMP BYTE PTR DS:[EAX],22

00171B77 75 04 JNE SHORT 00171B7D

00171B79 8BF0 MOV ESI,EAX

00171B7B EB 0D JMP SHORT 00171B8A

00171B7D 33C0 XOR EAX,EAX

00171B7F 33DB XOR EBX,EBX

00171B81 3945 FC CMP DWORD PTR SS:[EBP-4],EAX

00171B84 0F94C0 SETE AL

00171B87 8945 FC MOV DWORD PTR SS:[EBP-4],EAX

00171B8A D1E9 SHR ECX,1

00171B8C 85C9 TEST ECX,ECX

00171B8E 74 12 JE SHORT 00171BA2

00171B90 49 DEC ECX

00171B91 85D2 TEST EDX,EDX

00171B93 74 04 JE SHORT 00171B99


00171B95 C602 5C MOV BYTE PTR DS:[EDX],5C

00171B98 42 INC EDX

00171B99 FF07 INC DWORD PTR DS:[EDI]

00171B9B 85C9 TEST ECX,ECX

00171B9D ^ 75 F1 JNE SHORT 00171B90

00171B9F 8955 0C MOV DWORD PTR SS:[EBP+0C],EDX

00171BA2 8A06 MOV AL,BYTE PTR DS:[ESI]

00171BA4 84C0 TEST AL,AL

00171BA6 74 55 JE SHORT 00171BFD

00171BA8 837D FC 00 CMP DWORD PTR SS:[EBP-4],0

00171BAC 75 08 JNE SHORT 00171BB6

00171BAE 3C 20 CMP AL,20

00171BB0 74 4B JE SHORT 00171BFD

00171BB2 3C 09 CMP AL,9

00171BB4 74 47 JE SHORT 00171BFD

00171BB6 85DB TEST EBX,EBX

00171BB8 74 3D JE SHORT 00171BF7

00171BBA 0FBEC0 MOVSX EAX,AL

00171BBD 50 PUSH EAX

00171BBE 85D2 TEST EDX,EDX

00171BC0 74 23 JE SHORT 00171BE5

00171BC2 E8 29190000 CALL 001734F0

00171BC7 59 POP ECX

00171BC8 85C0 TEST EAX,EAX

00171BCA 74 0D JE SHORT 00171BD9

00171BCC 8A06 MOV AL,BYTE PTR DS:[ESI]

00171BCE 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]

00171BD1 FF45 0C INC DWORD PTR SS:[EBP+0C]

00171BD4 8801 MOV BYTE PTR DS:[ECX],AL

00171BD6 46 INC ESI

00171BD7 FF07 INC DWORD PTR DS:[EDI]

00171BD9 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]

00171BDC 8A06 MOV AL,BYTE PTR DS:[ESI]

00171BDE FF45 0C INC DWORD PTR SS:[EBP+0C]

00171BE1 8801 MOV BYTE PTR DS:[ECX],AL

00171BE3 EB 0D JMP SHORT 00171BF2

00171BE5 E8 06190000 CALL 001734F0

00171BEA 59 POP ECX

00171BEB 85C0 TEST EAX,EAX

00171BED 74 03 JE SHORT 00171BF2

00171BEF 46 INC ESI

00171BF0 FF07 INC DWORD PTR DS:[EDI]


00171BF2 FF07 INC DWORD PTR DS:[EDI]

00171BF4 8B55 0C MOV EDX,DWORD PTR SS:[EBP+0C]

00171BF7 46 INC ESI

00171BF8 ^ E9 56FFFFFF JMP 00171B53

00171BFD 85D2 TEST EDX,EDX

00171BFF 74 07 JE SHORT 00171C08

00171C01 C602 00 MOV BYTE PTR DS:[EDX],0

00171C04 42 INC EDX

00171C05 8955 0C MOV DWORD PTR SS:[EBP+0C],EDX

00171C08 FF07 INC DWORD PTR DS:[EDI]

00171C0A 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]

00171C0D ^ E9 0EFFFFFF JMP 00171B20

00171C12 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

00171C15 5E POP ESI

00171C16 5B POP EBX


00171C19 74 03 JE SHORT 00171C1E

00171C1B 8320 00 AND DWORD PTR DS:[EAX],00000000

00171C1E FF01 INC DWORD PTR DS:[ECX]

00171C20 C9 LEAVE

00171C21 C3 RETN

00171C22 8BFF MOV EDI,EDI

00171C24 55 PUSH EBP

00171C25 8BEC MOV EBP,ESP

00171C27 83EC 0C SUB ESP,0C

00171C2A 53 PUSH EBX

00171C2B 33DB XOR EBX,EBX

00171C2D 56 PUSH ESI

00171C2E 57 PUSH EDI

00171C2F 391D CC981700 CMP DWORD PTR DS:[1798CC],EBX

00171C35 75 05 JNE SHORT 00171C3C

00171C37 E8 921F0000 CALL 00173BCE

00171C3C 68 04010000 PUSH 104

00171C41 BE D0941700 MOV ESI,OFFSET 001794D0

00171C46 56 PUSH ESI

00171C47 53 PUSH EBX

00171C48 881D D4951700 MOV BYTE PTR DS:[1795D4],BL

00171C4E FF15 38601700 CALL DWORD PTR DS:[176038]

00171C54 A1 D8981700 MOV EAX,DWORD PTR DS:[1798D8]

00171C59 8935 948E1700 MOV DWORD PTR DS:[178E94],ESI

00171C5F 3BC3 CMP EAX,EBX

00171C61 74 07 JE SHORT 00171C6A


00171C63 8945 FC MOV DWORD PTR SS:[EBP-4],EAX

00171C66 3818 CMP BYTE PTR DS:[EAX],BL

00171C68 75 03 JNE SHORT 00171C6D

00171C6A 8975 FC MOV DWORD PTR SS:[EBP-4],ESI

00171C6D 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]

00171C70 8D45 F8 LEA EAX,[EBP-8]

00171C73 50 PUSH EAX



00171C76 8D7D F4 LEA EDI,[EBP-0C]

00171C79 E8 0AFEFFFF CALL 00171A88

00171C7E 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]

00171C81 83C4 0C ADD ESP,0C

00171C84 3D FFFFFF3F CMP EAX,3FFFFFFF

00171C89 73 4A JNB SHORT 00171CD5

00171C8B 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-0C]

00171C8E 83F9 FF CMP ECX,-1

00171C91 73 42 JNB SHORT 00171CD5

00171C93 8BF8 MOV EDI,EAX

00171C95 C1E7 02 SHL EDI,2

00171C98 8D040F LEA EAX,[ECX+EDI]

00171C9B 3BC1 CMP EAX,ECX

00171C9D 72 36 JB SHORT 00171CD5

00171C9F 50 PUSH EAX

00171CA0 E8 E01F0000 CALL 00173C85

00171CA5 8BF0 MOV ESI,EAX

00171CA7 59 POP ECX

00171CA8 3BF3 CMP ESI,EBX

00171CAA 74 29 JE SHORT 00171CD5

00171CAC 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]

00171CAF 8D45 F8 LEA EAX,[EBP-8]

00171CB2 50 PUSH EAX

00171CB3 03FE ADD EDI,ESI

00171CB5 57 PUSH EDI

00171CB6 56 PUSH ESI

00171CB7 8D7D F4 LEA EDI,[EBP-0C]

00171CBA E8 C9FDFFFF CALL 00171A88

00171CBF 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]

00171CC2 83C4 0C ADD ESP,0C

00171CC5 48 DEC EAX

00171CC6 A3 788E1700 MOV DWORD PTR DS:[178E78],EAX

00171CCB 8935 7C8E1700 MOV DWORD PTR DS:[178E7C],ESI


00171CD1 33C0 XOR EAX,EAX

00171CD3 EB 03 JMP SHORT 00171CD8

00171CD5 83C8 FF OR EAX,FFFFFFFF

00171CD8 5F POP EDI

00171CD9 5E POP ESI

00171CDA 5B POP EBX

00171CDB C9 LEAVE

00171CDC C3 RETN

00171CDD 8BFF MOV EDI,EDI

00171CDF 55 PUSH EBP

00171CE0 8BEC MOV EBP,ESP

00171CE2 83EC 0C SUB ESP,0C

00171CE5 53 PUSH EBX

00171CE6 56 PUSH ESI

00171CE7 FF15 44601700 CALL DWORD PTR DS:[176044]

00171CED 8BD8 MOV EBX,EAX

00171CEF 33F6 XOR ESI,ESI

00171CF1 3BDE CMP EBX,ESI

00171CF3 75 04 JNE SHORT 00171CF9

00171CF5 33C0 XOR EAX,EAX

00171CF7 EB 77 JMP SHORT 00171D70

00171CF9 66:3933 CMP WORD PTR DS:[EBX],SI

00171CFC 74 10 JE SHORT 00171D0E

00171CFE 83C0 02 ADD EAX,2

00171D01 66:3930 CMP WORD PTR DS:[EAX],SI

00171D04 ^ 75 F8 JNE SHORT 00171CFE

00171D06 83C0 02 ADD EAX,2

00171D09 66:3930 CMP WORD PTR DS:[EAX],SI

00171D0C ^ 75 F0 JNE SHORT 00171CFE

00171D0E 57 PUSH EDI

00171D0F 8B3D 40601700 MOV EDI,DWORD PTR DS:[176040]




00171D18 2BC3 SUB EAX,EBX

00171D1A 56 PUSH ESI

00171D1B D1F8 SAR EAX,1

00171D1D 40 INC EAX

00171D1E 50 PUSH EAX

00171D1F 53 PUSH EBX




00171D22 8945 F4 MOV DWORD PTR SS:[EBP-0C],EAX

00171D25 FFD7 CALL EDI

00171D27 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX

00171D2A 3BC6 CMP EAX,ESI

00171D2C 74 38 JE SHORT 00171D66

00171D2E 50 PUSH EAX

00171D2F E8 511F0000 CALL 00173C85

00171D34 59 POP ECX

00171D35 8945 FC MOV DWORD PTR SS:[EBP-4],EAX

00171D38 3BC6 CMP EAX,ESI

00171D3A 74 2A JE SHORT 00171D66

00171D3C 56 PUSH ESI

00171D3D 56 PUSH ESI

00171D3E FF75 F8 PUSH DWORD PTR SS:[EBP-8]

00171D41 50 PUSH EAX

00171D42 FF75 F4 PUSH DWORD PTR SS:[EBP-0C]

00171D45 53 PUSH EBX



00171D48 FFD7 CALL EDI

00171D4A 85C0 TEST EAX,EAX

00171D4C 75 0C JNE SHORT 00171D5A

00171D4E FF75 FC PUSH DWORD PTR SS:[EBP-4]

00171D51 E8 961E0000 CALL 00173BEC

00171D56 59 POP ECX

00171D57 8975 FC MOV DWORD PTR SS:[EBP-4],ESI

00171D5A 53 PUSH EBX

00171D5B FF15 3C601700 CALL DWORD PTR DS:[17603C]

00171D61 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]

00171D64 EB 09 JMP SHORT 00171D6F


00171D67 FF15 3C601700 CALL DWORD PTR DS:[17603C]

00171D6D 33C0 XOR EAX,EAX

00171D6F 5F POP EDI

00171D70 5E POP ESI

00171D71 5B POP EBX

00171D72 C9 LEAVE

00171D73 C3 RETN



00171D77 8BEC MOV EBP,ESP

00171D79 83EC 4C SUB ESP,4C



00171D7D 8D45 B4 LEA EAX,[EBP-4C]


00171D81 FF15 08601700 CALL DWORD PTR DS:[176008]

00171D87 6A 40 PUSH 40

00171D89 6A 20 PUSH 20

00171D8B 5E POP ESI


00171D8D E8 381F0000 CALL 00173CCA

00171D92 59 POP ECX

00171D93 59 POP ECX

00171D94 33C9 XOR ECX,ECX

00171D96 3BC1 CMP EAX,ECX

00171D98 75 08 JNE SHORT 00171DA2

00171D9A 83C8 FF OR EAX,FFFFFFFF

00171D9D E9 0F020000 JMP 00171FB1

00171DA2 8D90 00080000 LEA EDX,[EAX+800]

00171DA8 A3 C0971700 MOV DWORD PTR DS:[1797C0],EAX

00171DAD 8935 B0971700 MOV DWORD PTR DS:[1797B0],ESI

00171DB3 3BC2 CMP EAX,EDX

00171DB5 73 36 JNB SHORT 00171DED

00171DB7 83C0 05 ADD EAX,5

00171DBA 8348 FB FF OR DWORD PTR DS:[EAX-5],FFFFFFFF

00171DBE 66:C740 FF 000A MOV WORD PTR DS:[EAX-1],0A00

00171DC4 8948 03 MOV DWORD PTR DS:[EAX+3],ECX

00171DC7 66:C740 1F 000A MOV WORD PTR DS:[EAX+1F],0A00

00171DCD C640 21 0A MOV BYTE PTR DS:[EAX+21],0A

00171DD1 8948 33 MOV DWORD PTR DS:[EAX+33],ECX

00171DD4 8848 2F MOV BYTE PTR DS:[EAX+2F],CL

00171DD7 8B35 C0971700 MOV ESI,DWORD PTR DS:[1797C0]

00171DDD 83C0 40 ADD EAX,40

00171DE0 8D50 FB LEA EDX,[EAX-5]

00171DE3 81C6 00080000 ADD ESI,800

00171DE9 3BD6 CMP EDX,ESI

00171DEB ^ 72 CD JB SHORT 00171DBA

00171DED 53 PUSH EBX

00171DEE 57 PUSH EDI

00171DEF 66:394D E6 CMP WORD PTR SS:[EBP-1A],CX

00171DF3 0F84 0E010000 JE 00171F07

00171DF9 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18]

00171DFC 3BC1 CMP EAX,ECX

00171DFE 0F84 03010000 JE 00171F07


00171E04 8B18 MOV EBX,DWORD PTR DS:[EAX]

00171E06 83C0 04 ADD EAX,4

00171E09 8945 FC MOV DWORD PTR SS:[EBP-4],EAX

00171E0C 03C3 ADD EAX,EBX

00171E0E BE 00080000 MOV ESI,800

00171E13 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX

00171E16 3BDE CMP EBX,ESI

00171E18 7C 02 JL SHORT 00171E1C

00171E1A 8BDE MOV EBX,ESI

00171E1C 391D B0971700 CMP DWORD PTR DS:[1797B0],EBX

00171E22 7D 6B JGE SHORT 00171E8F

00171E24 BF C4971700 MOV EDI,OFFSET 001797C4

00171E29 6A 40 PUSH 40

00171E2B 6A 20 PUSH 20

00171E2D E8 981E0000 CALL 00173CCA

00171E32 59 POP ECX

00171E33 59 POP ECX


00171E36 74 51 JE SHORT 00171E89

00171E38 8305 B0971700 2 ADD DWORD PTR DS:[1797B0],20

00171E3F 8D88 00080000 LEA ECX,[EAX+800]

00171E45 8907 MOV DWORD PTR DS:[EDI],EAX

00171E47 3BC1 CMP EAX,ECX

00171E49 73 31 JNB SHORT 00171E7C

00171E4B 83C0 05 ADD EAX,5

00171E4E 8348 FB FF OR DWORD PTR DS:[EAX-5],FFFFFFFF

00171E52 8360 03 00 AND DWORD PTR DS:[EAX+3],00000000

00171E56 8060 1F 80 AND BYTE PTR DS:[EAX+1F],80

00171E5A 8360 33 00 AND DWORD PTR DS:[EAX+33],00000000

00171E5E 66:C740 FF 000A MOV WORD PTR DS:[EAX-1],0A00

00171E64 66:C740 20 0A0A MOV WORD PTR DS:[EAX+20],0A0A

00171E6A C640 2F 00 MOV BYTE PTR DS:[EAX+2F],0

00171E6E 8B0F MOV ECX,DWORD PTR DS:[EDI]

00171E70 83C0 40 ADD EAX,40

00171E73 03CE ADD ECX,ESI

00171E75 8D50 FB LEA EDX,[EAX-5]

00171E78 3BD1 CMP EDX,ECX

00171E7A ^ 72 D2 JB SHORT 00171E4E

00171E7C 83C7 04 ADD EDI,4

00171E7F 391D B0971700 CMP DWORD PTR DS:[1797B0],EBX

00171E85 ^ 7C A2 JL SHORT 00171E29

00171E87 EB 06 JMP SHORT 00171E8F


00171E89 8B1D B0971700 MOV EBX,DWORD PTR DS:[1797B0]

00171E8F 33FF XOR EDI,EDI

00171E91 85DB TEST EBX,EBX

00171E93 7E 72 JLE SHORT 00171F07

00171E95 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]

00171E98 8B00 MOV EAX,DWORD PTR DS:[EAX]

00171E9A 83F8 FF CMP EAX,-1

00171E9D 74 5C JE SHORT 00171EFB

00171E9F 83F8 FE CMP EAX,-2

00171EA2 74 57 JE SHORT 00171EFB

00171EA4 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]

00171EA7 8A09 MOV CL,BYTE PTR DS:[ECX]

00171EA9 F6C1 01 TEST CL,01

00171EAC 74 4D JE SHORT 00171EFB

00171EAE F6C1 08 TEST CL,08

00171EB1 75 0B JNE SHORT 00171EBE

00171EB3 50 PUSH EAX

00171EB4 FF15 50601700 CALL DWORD PTR DS:[176050]

00171EBA 85C0 TEST EAX,EAX

00171EBC 74 3D JE SHORT 00171EFB

00171EBE 8BF7 MOV ESI,EDI

00171EC0 83E6 1F AND ESI,0000001F

00171EC3 8BC7 MOV EAX,EDI

00171EC5 C1F8 05 SAR EAX,5

00171EC8 C1E6 06 SHL ESI,6

00171ECB 033485 C0971700 ADD ESI,DWORD PTR DS:[EAX*4+1797C0]

00171ED2 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]

00171ED5 8B00 MOV EAX,DWORD PTR DS:[EAX]

00171ED7 8906 MOV DWORD PTR DS:[ESI],EAX

00171ED9 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]

00171EDC 8A00 MOV AL,BYTE PTR DS:[EAX]

00171EDE 8846 04 MOV BYTE PTR DS:[ESI+4],AL

00171EE1 68 A00F0000 PUSH 0FA0

00171EE6 8D46 0C LEA EAX,[ESI+0C]

00171EE9 50 PUSH EAX

00171EEA FF15 4C601700 CALL DWORD PTR DS:[17604C]

00171EF0 85C0 TEST EAX,EAX

00171EF2 0F84 BC000000 JE 00171FB4

00171EF8 FF46 08 INC DWORD PTR DS:[ESI+8]

00171EFB 8345 F8 04 ADD DWORD PTR SS:[EBP-8],4

00171EFF 47 INC EDI

00171F00 FF45 FC INC DWORD PTR SS:[EBP-4]


00171F03 3BFB CMP EDI,EBX

00171F05 ^ 7C 8E JL SHORT 00171E95

00171F07 33DB XOR EBX,EBX

00171F09 8BF3 MOV ESI,EBX

00171F0B C1E6 06 SHL ESI,6

00171F0E 0335 C0971700 ADD ESI,DWORD PTR DS:[1797C0]

00171F14 8B06 MOV EAX,DWORD PTR DS:[ESI]

00171F16 83F8 FF CMP EAX,-1

00171F19 74 0B JE SHORT 00171F26

00171F1B 83F8 FE CMP EAX,-2

00171F1E 74 06 JE SHORT 00171F26

00171F20 804E 04 80 OR BYTE PTR DS:[ESI+4],80

00171F24 EB 71 JMP SHORT 00171F97

00171F26 C646 04 81 MOV BYTE PTR DS:[ESI+4],81

00171F2A 85DB TEST EBX,EBX

00171F2C 75 05 JNE SHORT 00171F33

00171F2E 6A F6 PUSH -0A

00171F30 58 POP EAX

00171F31 EB 0A JMP SHORT 00171F3D

00171F33 8D43 FF LEA EAX,[EBX-1]

00171F36 F7D8 NEG EAX

00171F38 1BC0 SBB EAX,EAX

00171F3A 83C0 F5 ADD EAX,-0B

00171F3D 50 PUSH EAX

00171F3E FF15 30601700 CALL DWORD PTR DS:[176030]

00171F44 8BF8 MOV EDI,EAX

00171F46 83FF FF CMP EDI,-1

00171F49 74 42 JE SHORT 00171F8D

00171F4B 85FF TEST EDI,EDI

00171F4D 74 3E JE SHORT 00171F8D

00171F4F 57 PUSH EDI

00171F50 FF15 50601700 CALL DWORD PTR DS:[176050]


00171F58 74 33 JE SHORT 00171F8D

00171F5A 25 FF000000 AND EAX,000000FF

00171F5F 893E MOV DWORD PTR DS:[ESI],EDI

00171F61 83F8 02 CMP EAX,2

00171F64 75 06 JNE SHORT 00171F6C


00171F6A EB 09 JMP SHORT 00171F75

00171F6C 83F8 03 CMP EAX,3

00171F6F 75 04 JNE SHORT 00171F75



00171F75 68 A00F0000 PUSH 0FA0

00171F7A 8D46 0C LEA EAX,[ESI+0C]


00171F7E FF15 4C601700 CALL DWORD PTR DS:[17604C]


00171F86 74 2C JE SHORT 00171FB4

00171F88 FF46 08 INC DWORD PTR DS:[ESI+8]

00171F8B EB 0A JMP SHORT 00171F97

00171F8D 804E 04 40 OR BYTE PTR DS:[ESI+4],40

00171F91 C706 FEFFFFFF MOV DWORD PTR DS:[ESI],-2

00171F97 43 INC EBX

00171F98 83FB 03 CMP EBX,3

00171F9B ^ 0F8C 68FFFFFF JL 00171F09

00171FA1 FF35 B0971700 PUSH DWORD PTR DS:[1797B0]

00171FA7 FF15 48601700 CALL DWORD PTR DS:[176048]

00171FAD 33C0 XOR EAX,EAX

00171FAF 5F POP EDI

00171FB0 5B POP EBX

00171FB1 5E POP ESI

00171FB2 C9 LEAVE

00171FB3 C3 RETN

00171FB4 83C8 FF OR EAX,FFFFFFFF

00171FB7 ^ EB F6 JMP SHORT 00171FAF

00171FB9 8BFF MOV EDI,EDI

00171FBB 56 PUSH ESI

00171FBC B8 E0781700 MOV EAX,OFFSET 001778E0

00171FC1 BE E0781700 MOV ESI,OFFSET 001778E0

00171FC6 57 PUSH EDI

00171FC7 8BF8 MOV EDI,EAX

00171FC9 3BC6 CMP EAX,ESI

00171FCB 73 0F JNB SHORT 00171FDC

00171FCD 8B07 MOV EAX,DWORD PTR DS:[EDI]

00171FCF 85C0 TEST EAX,EAX

00171FD1 74 02 JE SHORT 00171FD5

00171FD3 FFD0 CALL EAX

00171FD5 83C7 04 ADD EDI,4

00171FD8 3BFE CMP EDI,ESI

00171FDA ^ 72 F1 JB SHORT 00171FCD

00171FDC 5F POP EDI

00171FDD 5E POP ESI

00171FDE C3 RETN


00171FDF 8BFF MOV EDI,EDI

00171FE1 56 PUSH ESI

00171FE2 B8 E8781700 MOV EAX,OFFSET 001778E8

00171FE7 BE E8781700 MOV ESI,OFFSET 001778E8

00171FEC 57 PUSH EDI

00171FED 8BF8 MOV EDI,EAX

00171FEF 3BC6 CMP EAX,ESI

00171FF1 73 0F JNB SHORT 00172002

00171FF3 8B07 MOV EAX,DWORD PTR DS:[EDI]

00171FF5 85C0 TEST EAX,EAX

00171FF7 74 02 JE SHORT 00171FFB

00171FF9 FFD0 CALL EAX

00171FFB 83C7 04 ADD EDI,4

00171FFE 3BFE CMP EDI,ESI

00172000 ^ 72 F1 JB SHORT 00171FF3

00172002 5F POP EDI

00172003 5E POP ESI

00172004 C3 RETN

00172005 6A 00 PUSH 0

00172007 FF15 248B1700 CALL DWORD PTR DS:[178B24]

0017200D C3 RETN

0017200E FF15 58601700 CALL DWORD PTR DS:[176058]

00172014 C2 0400 RETN 4


00172019 56 PUSH ESI

0017201A FF35 54801700 PUSH DWORD PTR DS:[178054]

00172020 FF15 5C601700 CALL DWORD PTR DS:[17605C]



0017202A 75 1B JNE SHORT 00172047

0017202C FF35 DC951700 PUSH DWORD PTR DS:[1795DC]




0017203B FF35 54801700 PUSH DWORD PTR DS:[178054]


00172047 8BC6 MOV EAX,ESI

00172049 5E POP ESI

0017204A C3 RETN

0017204B A1 50801700 MOV EAX,DWORD PTR DS:[178050]

00172050 83F8 FF CMP EAX,-1

00172053 74 16 JE SHORT 0017206B


00172055 50 PUSH EAX

00172056 FF35 E4951700 PUSH DWORD PTR DS:[1795E4]

0017205C FF15 208B1700 CALL DWORD PTR DS:[178B20]


00172064 830D 50801700 F OR DWORD PTR DS:[178050],FFFFFFFF

0017206B A1 54801700 MOV EAX,DWORD PTR DS:[178054]

00172070 83F8 FF CMP EAX,-1

00172073 74 0E JE SHORT 00172083

00172075 50 PUSH EAX


0017207C 830D 54801700 F OR DWORD PTR DS:[178054],FFFFFFFF

00172083 E9 3E070000 JMP 001727C6

00172088 6A 08 PUSH 8

0017208A 68 30791700 PUSH OFFSET 00177930

0017208F E8 0C040000 CALL 001724A0

00172094 68 F46B1700 PUSH OFFSET 00176BF4 ; UNICODE "KERNEL32.DLL"


0017209F 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]

001720A2 C746 5C 506B170 MOV DWORD PTR DS:[ESI+5C],OFFSET 00176B5

001720A9 8366 08 00 AND DWORD PTR DS:[ESI+8],00000000

001720AD 33FF XOR EDI,EDI

001720AF 47 INC EDI

001720B0 897E 14 MOV DWORD PTR DS:[ESI+14],EDI

001720B3 897E 70 MOV DWORD PTR DS:[ESI+70],EDI

001720B6 C686 C8000000 4 MOV BYTE PTR DS:[ESI+0C8],43

001720BD C686 4B010000 4 MOV BYTE PTR DS:[ESI+14B],43

001720C4 C746 68 2083170 MOV DWORD PTR DS:[ESI+68],OFFSET 0017832

001720CB 6A 0D PUSH 0D

001720CD E8 24080000 CALL 001728F6

001720D2 59 POP ECX

001720D3 8365 FC 00 AND DWORD PTR SS:[EBP-4],00000000

001720D7 FF76 68 PUSH DWORD PTR DS:[ESI+68]

001720DA FF15 68601700 CALL DWORD PTR DS:[176068]

001720E0 C745 FC FEFFFFF MOV DWORD PTR SS:[EBP-4],-2

001720E7 E8 3E000000 CALL 0017212A

001720EC 6A 0C PUSH 0C

001720EE E8 03080000 CALL 001728F6

001720F3 59 POP ECX

001720F4 897D FC MOV DWORD PTR SS:[EBP-4],EDI

001720F7 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0C]

001720FA 8946 6C MOV DWORD PTR DS:[ESI+6C],EAX

001720FD 85C0 TEST EAX,EAX


001720FF 75 08 JNE SHORT 00172109

00172101 A1 888A1700 MOV EAX,DWORD PTR DS:[178A88]

00172106 8946 6C MOV DWORD PTR DS:[ESI+6C],EAX

00172109 FF76 6C PUSH DWORD PTR DS:[ESI+6C]

0017210C E8 531C0000 CALL 00173D64

00172111 59 POP ECX

00172112 C745 FC FEFFFFF MOV DWORD PTR SS:[EBP-4],-2

00172119 E8 15000000 CALL 00172133

0017211E E8 C2030000 CALL 001724E5

00172123 C3 RETN


00172126 47 INC EDI


0017212A 6A 0D PUSH 0D

0017212C E8 EC060000 CALL 0017281D

00172131 59 POP ECX

00172132 C3 RETN

00172133 6A 0C PUSH 0C

00172135 E8 E3060000 CALL 0017281D

0017213A 59 POP ECX

0017213B C3 RETN

0017213C 8BFF MOV EDI,EDI


0017213F 57 PUSH EDI


00172146 FF35 50801700 PUSH DWORD PTR DS:[178050]


0017214E E8 C4FEFFFF CALL 00172017




00172159 75 4E JNE SHORT 001721A9

0017215B 68 14020000 PUSH 214

00172160 6A 01 PUSH 1

00172162 E8 631B0000 CALL 00173CCA


00172169 59 POP ECX

0017216A 59 POP ECX

0017216B 85F6 TEST ESI,ESI

0017216D 74 3A JE SHORT 001721A9





0017217C FF15 208B1700 CALL DWORD PTR DS:[178B20]



00172186 74 18 JE SHORT 001721A0

00172188 6A 00 PUSH 0


0017218B E8 F8FEFFFF CALL 00172088

00172190 59 POP ECX

00172191 59 POP ECX


00172198 834E 04 FF OR DWORD PTR DS:[ESI+4],FFFFFFFF

0017219C 8906 MOV DWORD PTR DS:[ESI],EAX

0017219E EB 09 JMP SHORT 001721A9


001721A1 E8 461A0000 CALL 00173BEC

001721A6 59 POP ECX

001721A7 33F6 XOR ESI,ESI

001721A9 57 PUSH EDI

001721AA FF15 6C601700 CALL DWORD PTR DS:[17606C]

001721B0 5F POP EDI

001721B1 8BC6 MOV EAX,ESI

001721B3 5E POP ESI

001721B4 C3 RETN



001721B8 E8 7FFFFFFF CALL 0017213C

001721BD 8BF0 MOV ESI,EAX

001721BF 85F6 TEST ESI,ESI

001721C1 75 08 JNE SHORT 001721CB

001721C3 6A 10 PUSH 10

001721C5 E8 0DF4FFFF CALL 001715D7

001721CA 59 POP ECX

001721CB 8BC6 MOV EAX,ESI

001721CD 5E POP ESI

001721CE C3 RETN

001721CF 6A 08 PUSH 8

001721D1 68 58791700 PUSH OFFSET 00177958

001721D6 E8 C5020000 CALL 001724A0

001721DB 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]

001721DE 85F6 TEST ESI,ESI

001721E0 0F84 F8000000 JE 001722DE


001721E6 8B46 24 MOV EAX,DWORD PTR DS:[ESI+24]


001721EB 74 07 JE SHORT 001721F4

001721ED 50 PUSH EAX

001721EE E8 F9190000 CALL 00173BEC

001721F3 59 POP ECX

001721F4 8B46 2C MOV EAX,DWORD PTR DS:[ESI+2C]


001721F9 74 07 JE SHORT 00172202

001721FB 50 PUSH EAX

001721FC E8 EB190000 CALL 00173BEC

00172201 59 POP ECX

00172202 8B46 34 MOV EAX,DWORD PTR DS:[ESI+34]


00172207 74 07 JE SHORT 00172210

00172209 50 PUSH EAX

0017220A E8 DD190000 CALL 00173BEC

0017220F 59 POP ECX

00172210 8B46 3C MOV EAX,DWORD PTR DS:[ESI+3C]


00172215 74 07 JE SHORT 0017221E

00172217 50 PUSH EAX

00172218 E8 CF190000 CALL 00173BEC

0017221D 59 POP ECX

0017221E 8B46 40 MOV EAX,DWORD PTR DS:[ESI+40]


00172223 74 07 JE SHORT 0017222C

00172225 50 PUSH EAX

00172226 E8 C1190000 CALL 00173BEC

0017222B 59 POP ECX

0017222C 8B46 44 MOV EAX,DWORD PTR DS:[ESI+44]


00172231 74 07 JE SHORT 0017223A

00172233 50 PUSH EAX

00172234 E8 B3190000 CALL 00173BEC

00172239 59 POP ECX

0017223A 8B46 48 MOV EAX,DWORD PTR DS:[ESI+48]

0017223D 85C0 TEST EAX,EAX

0017223F 74 07 JE SHORT 00172248

00172241 50 PUSH EAX

00172242 E8 A5190000 CALL 00173BEC

00172247 59 POP ECX


00172248 8B46 5C MOV EAX,DWORD PTR DS:[ESI+5C]

0017224B 3D 506B1700 CMP EAX,OFFSET 00176B50

00172250 74 07 JE SHORT 00172259

00172252 50 PUSH EAX

00172253 E8 94190000 CALL 00173BEC

00172258 59 POP ECX

00172259 6A 0D PUSH 0D

0017225B E8 96060000 CALL 001728F6

00172260 59 POP ECX

00172261 8365 FC 00 AND DWORD PTR SS:[EBP-4],00000000

00172265 8B7E 68 MOV EDI,DWORD PTR DS:[ESI+68]


0017226A 74 1A JE SHORT 00172286

0017226C 57 PUSH EDI

0017226D FF15 78601700 CALL DWORD PTR DS:[176078]


00172275 75 0F JNE SHORT 00172286

00172277 81FF 20831700 CMP EDI,OFFSET 00178320

0017227D 74 07 JE SHORT 00172286


00172280 E8 67190000 CALL 00173BEC

00172285 59 POP ECX


0017228D E8 57000000 CALL 001722E9

00172292 6A 0C PUSH 0C

00172294 E8 5D060000 CALL 001728F6

00172299 59 POP ECX

0017229A C745 FC 0100000 MOV DWORD PTR SS:[EBP-4],1

001722A1 8B7E 6C MOV EDI,DWORD PTR DS:[ESI+6C]

001722A4 85FF TEST EDI,EDI

001722A6 74 23 JE SHORT 001722CB


001722A9 E8 451B0000 CALL 00173DF3

001722AE 59 POP ECX

001722AF 3B3D 888A1700 CMP EDI,DWORD PTR DS:[178A88]

001722B5 74 14 JE SHORT 001722CB

001722B7 81FF B0891700 CMP EDI,OFFSET 001789B0

001722BD 74 0C JE SHORT 001722CB

001722BF 833F 00 CMP DWORD PTR DS:[EDI],0

001722C2 75 07 JNE SHORT 001722CB


001722C5 E8 C21B0000 CALL 00173E8C


001722CA 59 POP ECX

001722CB C745 FC FEFFFFF MOV DWORD PTR SS:[EBP-4],-2

001722D2 E8 1E000000 CALL 001722F5


001722D8 E8 0F190000 CALL 00173BEC

001722DD 59 POP ECX

001722DE E8 02020000 CALL 001724E5

001722E3 C2 0400 RETN 4

001722E6 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]

001722E9 6A 0D PUSH 0D

001722EB E8 2D050000 CALL 0017281D

001722F0 59 POP ECX

001722F1 C3 RETN

001722F2 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]

001722F5 6A 0C PUSH 0C

001722F7 E8 21050000 CALL 0017281D

001722FC 59 POP ECX

001722FD C3 RETN

001722FE 8BFF MOV EDI,EDI

00172300 57 PUSH EDI

00172301 68 F46B1700 PUSH OFFSET 00176BF4 ; UNICODE "KERNEL32.DLL"



0017230E 85FF TEST EDI,EDI

00172310 75 09 JNE SHORT 0017231B

00172312 E8 34FDFFFF CALL 0017204B


00172319 5F POP EDI

0017231A C3 RETN

0017231B 56 PUSH ESI

0017231C 8B35 20601700 MOV ESI,DWORD PTR DS:[176020]

00172322 68 306C1700 PUSH OFFSET 00176C30 ; ASCII "FlsAlloc"

00172327 57 PUSH EDI


0017232A 68 246C1700 PUSH OFFSET 00176C24 ; ASCII "FlsGetValue"


00172330 A3 D8951700 MOV DWORD PTR DS:[1795D8],EAX


00172337 68 186C1700 PUSH OFFSET 00176C18 ; ASCII "FlsSetValue"


0017233D A3 DC951700 MOV DWORD PTR DS:[1795DC],EAX



00172344 68 106C1700 PUSH OFFSET 00176C10 ; ASCII "FlsFree"

00172349 57 PUSH EDI

0017234A A3 E0951700 MOV DWORD PTR DS:[1795E0],EAX

0017234F FFD6 CALL ESI

00172351 833D D8951700 0 CMP DWORD PTR DS:[1795D8],0

00172358 8B35 60601700 MOV ESI,DWORD PTR DS:[176060]

0017235E A3 E4951700 MOV DWORD PTR DS:[1795E4],EAX

00172363 74 16 JE SHORT 0017237B

00172365 833D DC951700 0 CMP DWORD PTR DS:[1795DC],0

0017236C 74 0D JE SHORT 0017237B

0017236E 833D E0951700 0 CMP DWORD PTR DS:[1795E0],0

00172375 74 04 JE SHORT 0017237B


00172379 75 24 JNE SHORT 0017239F

0017237B A1 5C601700 MOV EAX,DWORD PTR DS:[17605C]

00172380 A3 DC951700 MOV DWORD PTR DS:[1795DC],EAX


0017238A C705 D8951700 0 MOV DWORD PTR DS:[1795D8],OFFSET 0017200

00172394 8935 E0951700 MOV DWORD PTR DS:[1795E0],ESI

0017239A A3 E4951700 MOV DWORD PTR DS:[1795E4],EAX


001723A5 A3 54801700 MOV DWORD PTR DS:[178054],EAX

001723AA 83F8 FF CMP EAX,-1

001723AD 0F84 C1000000 JE 00172474

001723B3 FF35 DC951700 PUSH DWORD PTR DS:[1795DC]


001723BA FFD6 CALL ESI

001723BC 85C0 TEST EAX,EAX

001723BE 0F84 B0000000 JE 00172474

001723C4 E8 96EFFFFF CALL 0017135F

001723C9 FF35 D8951700 PUSH DWORD PTR DS:[1795D8]

001723CF 8B35 248B1700 MOV ESI,DWORD PTR DS:[178B24]

001723D5 FFD6 CALL ESI

001723D7 FF35 DC951700 PUSH DWORD PTR DS:[1795DC]

001723DD A3 D8951700 MOV DWORD PTR DS:[1795D8],EAX


001723E4 FF35 E0951700 PUSH DWORD PTR DS:[1795E0]

001723EA A3 DC951700 MOV DWORD PTR DS:[1795DC],EAX

001723EF FFD6 CALL ESI

001723F1 FF35 E4951700 PUSH DWORD PTR DS:[1795E4]

001723F7 A3 E0951700 MOV DWORD PTR DS:[1795E0],EAX

001723FC FFD6 CALL ESI


001723FE A3 E4951700 MOV DWORD PTR DS:[1795E4],EAX

00172403 E8 74030000 CALL 0017277C


0017240A 74 63 JE SHORT 0017246F

0017240C 8B3D 208B1700 MOV EDI,DWORD PTR DS:[178B20]

00172412 68 CF211700 PUSH OFFSET 001721CF

00172417 FF35 D8951700 PUSH DWORD PTR DS:[1795D8]

0017241D FFD7 CALL EDI

0017241F FFD0 CALL EAX

00172421 A3 50801700 MOV DWORD PTR DS:[178050],EAX

00172426 83F8 FF CMP EAX,-1

00172429 74 44 JE SHORT 0017246F

0017242B 68 14020000 PUSH 214

00172430 6A 01 PUSH 1

00172432 E8 93180000 CALL 00173CCA


00172439 59 POP ECX

0017243A 59 POP ECX

0017243B 85F6 TEST ESI,ESI

0017243D 74 30 JE SHORT 0017246F




0017244C FFD7 CALL EDI

0017244E FFD0 CALL EAX


00172452 74 1B JE SHORT 0017246F

00172454 6A 00 PUSH 0

00172456 56 PUSH ESI

00172457 E8 2CFCFFFF CALL 00172088

0017245C 59 POP ECX

0017245D 59 POP ECX

0017245E FF15 70601700 CALL DWORD PTR DS:[176070]

00172464 834E 04 FF OR DWORD PTR DS:[ESI+4],FFFFFFFF

00172468 8906 MOV DWORD PTR DS:[ESI],EAX


0017246C 40 INC EAX

0017246D EB 07 JMP SHORT 00172476

0017246F E8 D7FBFFFF CALL 0017204B


00172476 5E POP ESI

00172477 5F POP EDI


00172478 C3 RETN

00172479 6A 00 PUSH 0

0017247B 68 00100000 PUSH 1000

00172480 6A 00 PUSH 0

00172482 FF15 7C601700 CALL DWORD PTR DS:[17607C]



0017248C 0F95C1 SETNE CL

0017248F A3 E8951700 MOV DWORD PTR DS:[1795E8],EAX

00172494 8BC1 MOV EAX,ECX

00172496 C3 RETN

00172497 CC INT3

00172498 CC INT3

00172499 CC INT3

0017249A CC INT3

0017249B CC INT3

0017249C CC INT3

0017249D CC INT3

0017249E CC INT3

0017249F CC INT3

001724A0 68 00251700 PUSH OFFSET 00172500

001724A5 64:FF35 0000000 PUSH DWORD PTR FS:[0]

001724AC 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10]

001724B0 896C24 10 MOV DWORD PTR SS:[ESP+10],EBP

001724B4 8D6C24 10 LEA EBP,[ESP+10]

001724B8 2BE0 SUB ESP,EAX

001724BA 53 PUSH EBX

001724BB 56 PUSH ESI

001724BC 57 PUSH EDI

001724BD A1 04801700 MOV EAX,DWORD PTR DS:[178004]

001724C2 3145 FC XOR DWORD PTR SS:[EBP-4],EAX

001724C5 33C5 XOR EAX,EBP


001724C8 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP

001724CB FF75 F8 PUSH DWORD PTR SS:[EBP-8]

001724CE 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]

001724D1 C745 FC FEFFFFF MOV DWORD PTR SS:[EBP-4],-2

001724D8 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX

001724DB 8D45 F0 LEA EAX,[EBP-10]

001724DE 64:A3 00000000 MOV DWORD PTR FS:[0],EAX

001724E4 C3 RETN

001724E5 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10]


001724E8 64:890D 0000000 MOV DWORD PTR FS:[0],ECX

001724EF 59 POP ECX

001724F0 5F POP EDI

001724F1 5F POP EDI

001724F2 5E POP ESI

001724F3 5B POP EBX

001724F4 8BE5 MOV ESP,EBP

001724F6 5D POP EBP

001724F7 51 PUSH ECX

001724F8 C3 RETN

001724F9 CC INT3

001724FA CC INT3

001724FB CC INT3

001724FC CC INT3

001724FD CC INT3

001724FE CC INT3

001724FF CC INT3


00172502 55 PUSH EBP


00172505 83EC 18 SUB ESP,18

00172508 53 PUSH EBX

00172509 8B5D 0C MOV EBX,DWORD PTR SS:[EBP+0C]


0017250D 8B73 08 MOV ESI,DWORD PTR DS:[EBX+8]

00172510 3335 04801700 XOR ESI,DWORD PTR DS:[178004]

00172516 57 PUSH EDI

00172517 8B06 MOV EAX,DWORD PTR DS:[ESI]

00172519 C645 FF 00 MOV BYTE PTR SS:[EBP-1],0

0017251D C745 F4 0100000 MOV DWORD PTR SS:[EBP-0C],1

00172524 8D7B 10 LEA EDI,[EBX+10]

00172527 83F8 FE CMP EAX,-2

0017252A 74 0D JE SHORT 00172539

0017252C 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4]

0017252F 03CF ADD ECX,EDI

00172531 330C38 XOR ECX,DWORD PTR DS:[EDI+EAX]

00172534 E8 CCEAFFFF CALL 00171005


0017253C 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8]

0017253F 03CF ADD ECX,EDI

00172541 330C38 XOR ECX,DWORD PTR DS:[EDI+EAX]

00172544 E8 BCEAFFFF CALL 00171005


00172549 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

0017254C F640 04 66 TEST BYTE PTR DS:[EAX+4],66

00172550 0F85 19010000 JNE 0017266F

00172556 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]

00172559 8D55 E8 LEA EDX,[EBP-18]

0017255C 8953 FC MOV DWORD PTR DS:[EBX-4],EDX

0017255F 8B5B 0C MOV EBX,DWORD PTR DS:[EBX+0C]


00172565 894D EC MOV DWORD PTR SS:[EBP-14],ECX

00172568 83FB FE CMP EBX,-2

0017256B 74 5F JE SHORT 001725CC

0017256D 8D49 00 LEA ECX,[ECX]

00172570 8D045B LEA EAX,[EBX*2+EBX]

00172573 8B4C86 14 MOV ECX,DWORD PTR DS:[EAX*4+ESI+14]

00172577 8D4486 10 LEA EAX,[EAX*4+ESI+10]

0017257B 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX

0017257E 8B00 MOV EAX,DWORD PTR DS:[EAX]

00172580 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX

00172583 85C9 TEST ECX,ECX

00172585 74 14 JE SHORT 0017259B

00172587 8BD7 MOV EDX,EDI

00172589 E8 041C0000 CALL 00174192

0017258E C645 FF 01 MOV BYTE PTR SS:[EBP-1],1


00172594 78 40 JS SHORT 001725D6

00172596 7F 47 JG SHORT 001725DF

00172598 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]

0017259B 8BD8 MOV EBX,EAX

0017259D 83F8 FE CMP EAX,-2

001725A0 ^ 75 CE JNE SHORT 00172570

001725A2 807D FF 00 CMP BYTE PTR SS:[EBP-1],0

001725A6 74 24 JE SHORT 001725CC

001725A8 8B06 MOV EAX,DWORD PTR DS:[ESI]

001725AA 83F8 FE CMP EAX,-2

001725AD 74 0D JE SHORT 001725BC

001725AF 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4]

001725B2 03CF ADD ECX,EDI

001725B4 330C38 XOR ECX,DWORD PTR DS:[EDI+EAX]

001725B7 E8 49EAFFFF CALL 00171005

001725BC 8B4E 0C MOV ECX,DWORD PTR DS:[ESI+0C]

001725BF 8B56 08 MOV EDX,DWORD PTR DS:[ESI+8]

001725C2 03CF ADD ECX,EDI


001725C4 330C3A XOR ECX,DWORD PTR DS:[EDI+EDX]

001725C7 E8 39EAFFFF CALL 00171005

001725CC 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-0C]

001725CF 5F POP EDI

001725D0 5E POP ESI

001725D1 5B POP EBX

001725D2 8BE5 MOV ESP,EBP

001725D4 5D POP EBP

001725D5 C3 RETN

001725D6 C745 F4 0000000 MOV DWORD PTR SS:[EBP-0C],0

001725DD ^ EB C9 JMP SHORT 001725A8

001725DF 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]

001725E2 8139 63736DE0 CMP DWORD PTR DS:[ECX],E06D7363

001725E8 75 29 JNE SHORT 00172613

001725EA 833D AC971700 0 CMP DWORD PTR DS:[1797AC],0

001725F1 74 20 JE SHORT 00172613

001725F3 68 AC971700 PUSH OFFSET 001797AC

001725F8 E8 63090000 CALL 00172F60

001725FD 83C4 04 ADD ESP,4


00172602 74 0F JE SHORT 00172613

00172604 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]

00172607 6A 01 PUSH 1

00172609 52 PUSH EDX

0017260A FF15 AC971700 CALL DWORD PTR DS:[1797AC]

00172610 83C4 08 ADD ESP,8

00172613 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]


00172619 E8 A41B0000 CALL 001741C2

0017261E 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0C]

00172621 3958 0C CMP DWORD PTR DS:[EAX+0C],EBX

00172624 74 12 JE SHORT 00172638

00172626 68 04801700 PUSH OFFSET 00178004


0017262C 8BD3 MOV EDX,EBX

0017262E 8BC8 MOV ECX,EAX

00172630 E8 A61B0000 CALL 001741DB

00172635 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0C]

00172638 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]

0017263B 8948 0C MOV DWORD PTR DS:[EAX+0C],ECX

0017263E 8B06 MOV EAX,DWORD PTR DS:[ESI]

00172640 83F8 FE CMP EAX,-2


00172643 74 0D JE SHORT 00172652

00172645 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4]

00172648 03CF ADD ECX,EDI

0017264A 330C38 XOR ECX,DWORD PTR DS:[EDI+EAX]

0017264D E8 B3E9FFFF CALL 00171005


00172655 8B56 08 MOV EDX,DWORD PTR DS:[ESI+8]

00172658 03CF ADD ECX,EDI

0017265A 330C3A XOR ECX,DWORD PTR DS:[EDI+EDX]

0017265D E8 A3E9FFFF CALL 00171005



00172668 8BD7 MOV EDX,EDI

0017266A E8 3A1B0000 CALL 001741A9

0017266F BA FEFFFFFF MOV EDX,-2

00172674 3953 0C CMP DWORD PTR DS:[EBX+0C],EDX

00172677 ^ 0F84 4FFFFFFF JE 001725CC

0017267D 68 04801700 PUSH OFFSET 00178004

00172682 57 PUSH EDI

00172683 8BCB MOV ECX,EBX

00172685 E8 511B0000 CALL 001741DB

0017268A ^ E9 19FFFFFF JMP 001725A8

0017268F 8BFF MOV EDI,EDI

00172691 55 PUSH EBP


00172694 83EC 10 SUB ESP,10


0017269C 8365 F8 00 AND DWORD PTR SS:[EBP-8],00000000

001726A0 8365 FC 00 AND DWORD PTR SS:[EBP-4],00000000



001726A6 BF 4EE640BB MOV EDI,BB40E64E

001726AB BB 0000FFFF MOV EBX,FFFF0000

001726B0 3BC7 CMP EAX,EDI

001726B2 74 0D JE SHORT 001726C1

001726B4 85C3 TEST EBX,EAX

001726B6 74 09 JE SHORT 001726C1

001726B8 F7D0 NOT EAX

001726BA A3 08801700 MOV DWORD PTR DS:[178008],EAX

001726BF EB 65 JMP SHORT 00172726


001726C2 8D45 F8 LEA EAX,[EBP-8]



001726C6 FF15 8C601700 CALL DWORD PTR DS:[17608C]

001726CC 8B75 FC MOV ESI,DWORD PTR SS:[EBP-4]

001726CF 3375 F8 XOR ESI,DWORD PTR SS:[EBP-8]

001726D2 FF15 88601700 CALL DWORD PTR DS:[176088]

001726D8 33F0 XOR ESI,EAX

001726DA FF15 70601700 CALL DWORD PTR DS:[176070]

001726E0 33F0 XOR ESI,EAX

001726E2 FF15 84601700 CALL DWORD PTR DS:[176084]

001726E8 33F0 XOR ESI,EAX

001726EA 8D45 F0 LEA EAX,[EBP-10]

001726ED 50 PUSH EAX

001726EE FF15 80601700 CALL DWORD PTR DS:[176080]

001726F4 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-0C]

001726F7 3345 F0 XOR EAX,DWORD PTR SS:[EBP-10]

001726FA 33F0 XOR ESI,EAX

001726FC 3BF7 CMP ESI,EDI

001726FE 75 07 JNE SHORT 00172707

00172700 BE 4FE640BB MOV ESI,BB40E64F

00172705 EB 10 JMP SHORT 00172717

00172707 85F3 TEST EBX,ESI

00172709 75 0C JNE SHORT 00172717

0017270B 8BC6 MOV EAX,ESI

0017270D 0D 11470000 OR EAX,00004711

00172712 C1E0 10 SHL EAX,10

00172715 0BF0 OR ESI,EAX

00172717 8935 04801700 MOV DWORD PTR DS:[178004],ESI

0017271D F7D6 NOT ESI

0017271F 8935 08801700 MOV DWORD PTR DS:[178008],ESI

00172725 5E POP ESI

00172726 5F POP EDI

00172727 5B POP EBX

00172728 C9 LEAVE

00172729 C3 RETN

0017272A 8325 A8971700 0 AND DWORD PTR DS:[1797A8],00000000

00172731 C3 RETN

00172732 6A 08 PUSH 8

00172734 68 80791700 PUSH OFFSET 00177980

00172739 E8 62FDFFFF CALL 001724A0

0017273E E8 72FAFFFF CALL 001721B5

00172743 8B40 78 MOV EAX,DWORD PTR DS:[EAX+78]



00172748 74 16 JE SHORT 00172760

0017274A 8365 FC 00 AND DWORD PTR SS:[EBP-4],00000000

0017274E FFD0 CALL EAX

00172750 EB 07 JMP SHORT 00172759


00172754 40 INC EAX

00172755 C3 RETN

00172756 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18]


00172760 E8 8D1A0000 CALL 001741F2

00172765 E8 7BFDFFFF CALL 001724E5

0017276A C3 RETN

0017276B 68 32271700 PUSH OFFSET 00172732


00172776 A3 EC951700 MOV DWORD PTR DS:[1795EC],EAX

0017277B C3 RETN




00172780 33F6 XOR ESI,ESI

00172782 BF F0951700 MOV EDI,OFFSET 001795F0

00172787 833CF5 64801700 CMP DWORD PTR DS:[ESI*8+178064],1

0017278F 75 1D JNE SHORT 001727AE

00172791 8D04F5 60801700 LEA EAX,[ESI*8+178060]

00172798 8938 MOV DWORD PTR DS:[EAX],EDI

0017279A 68 A00F0000 PUSH 0FA0

0017279F FF30 PUSH DWORD PTR DS:[EAX]

001727A1 83C7 18 ADD EDI,18

001727A4 FF15 4C601700 CALL DWORD PTR DS:[17604C]

001727AA 85C0 TEST EAX,EAX

001727AC 74 0C JE SHORT 001727BA

001727AE 46 INC ESI

001727AF 83FE 24 CMP ESI,24

001727B2 ^ 7C D3 JL SHORT 00172787

001727B4 33C0 XOR EAX,EAX

001727B6 40 INC EAX

001727B7 5F POP EDI

001727B8 5E POP ESI

001727B9 C3 RETN

001727BA 8324F5 60801700 AND DWORD PTR DS:[ESI*8+178060],00000000

001727C2 33C0 XOR EAX,EAX

001727C4 ^ EB F1 JMP SHORT 001727B7




001727C9 8B1D 54601700 MOV EBX,DWORD PTR DS:[176054]

001727CF 56 PUSH ESI

001727D0 BE 60801700 MOV ESI,OFFSET 00178060

001727D5 57 PUSH EDI

001727D6 8B3E MOV EDI,DWORD PTR DS:[ESI]

001727D8 85FF TEST EDI,EDI

001727DA 74 13 JE SHORT 001727EF

001727DC 837E 04 01 CMP DWORD PTR DS:[ESI+4],1

001727E0 74 0D JE SHORT 001727EF


001727E3 FFD3 CALL EBX


001727E6 E8 01140000 CALL 00173BEC

001727EB 8326 00 AND DWORD PTR DS:[ESI],00000000

001727EE 59 POP ECX

001727EF 83C6 08 ADD ESI,8

001727F2 81FE 80811700 CMP ESI,OFFSET 00178180

001727F8 ^ 7C DC JL SHORT 001727D6

001727FA BE 60801700 MOV ESI,OFFSET 00178060

001727FF 5F POP EDI

00172800 8B06 MOV EAX,DWORD PTR DS:[ESI]


00172804 74 09 JE SHORT 0017280F

00172806 837E 04 01 CMP DWORD PTR DS:[ESI+4],1

0017280A 75 03 JNE SHORT 0017280F


0017280D FFD3 CALL EBX

0017280F 83C6 08 ADD ESI,8

00172812 81FE 80811700 CMP ESI,OFFSET 00178180

00172818 ^ 7C E6 JL SHORT 00172800

0017281A 5E POP ESI

0017281B 5B POP EBX

0017281C C3 RETN





00172825 FF34C5 60801700 PUSH DWORD PTR DS:[EAX*8+178060]

0017282C FF15 90601700 CALL DWORD PTR DS:[176090]

00172832 5D POP EBP


00172833 C3 RETN

00172834 6A 0C PUSH 0C

00172836 68 A0791700 PUSH OFFSET 001779A0

0017283B E8 60FCFFFF CALL 001724A0


00172842 47 INC EDI

00172843 897D E4 MOV DWORD PTR SS:[EBP-1C],EDI

00172846 33DB XOR EBX,EBX

00172848 391D E8951700 CMP DWORD PTR DS:[1795E8],EBX

0017284E 75 18 JNE SHORT 00172868

00172850 E8 75EFFFFF CALL 001717CA

00172855 6A 1E PUSH 1E

00172857 E8 BFEDFFFF CALL 0017161B

0017285C 68 FF000000 PUSH 0FF

00172861 E8 CFEAFFFF CALL 00171335

00172866 59 POP ECX

00172867 59 POP ECX


0017286B 8D34F5 60801700 LEA ESI,[ESI*8+178060]

00172872 391E CMP DWORD PTR DS:[ESI],EBX

00172874 74 04 JE SHORT 0017287A

00172876 8BC7 MOV EAX,EDI

00172878 EB 6D JMP SHORT 001728E7

0017287A 6A 18 PUSH 18

0017287C E8 04140000 CALL 00173C85

00172881 59 POP ECX


00172884 3BFB CMP EDI,EBX

00172886 75 0F JNE SHORT 00172897

00172888 E8 D2040000 CALL 00172D5F

0017288D C700 0C000000 MOV DWORD PTR DS:[EAX],0C


00172895 EB 50 JMP SHORT 001728E7

00172897 6A 0A PUSH 0A

00172899 E8 58000000 CALL 001728F6

0017289E 59 POP ECX

0017289F 895D FC MOV DWORD PTR SS:[EBP-4],EBX

001728A2 391E CMP DWORD PTR DS:[ESI],EBX

001728A4 75 2B JNE SHORT 001728D1

001728A6 68 A00F0000 PUSH 0FA0

001728AB 57 PUSH EDI

001728AC FF15 4C601700 CALL DWORD PTR DS:[17604C]



001728B4 75 17 JNE SHORT 001728CD

001728B6 57 PUSH EDI

001728B7 E8 30130000 CALL 00173BEC

001728BC 59 POP ECX

001728BD E8 9D040000 CALL 00172D5F

001728C2 C700 0C000000 MOV DWORD PTR DS:[EAX],0C

001728C8 895D E4 MOV DWORD PTR SS:[EBP-1C],EBX

001728CB EB 0B JMP SHORT 001728D8

001728CD 893E MOV DWORD PTR DS:[ESI],EDI

001728CF EB 07 JMP SHORT 001728D8


001728D2 E8 15130000 CALL 00173BEC

001728D7 59 POP ECX

001728D8 C745 FC FEFFFFF MOV DWORD PTR SS:[EBP-4],-2

001728DF E8 09000000 CALL 001728ED

001728E4 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]

001728E7 E8 F9FBFFFF CALL 001724E5

001728EC C3 RETN

001728ED 6A 0A PUSH 0A

001728EF E8 29FFFFFF CALL 0017281D

001728F4 59 POP ECX

001728F5 C3 RETN




001728FB 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

001728FE 56 PUSH ESI

001728FF 8D34C5 60801700 LEA ESI,[EAX*8+178060]

00172906 833E 00 CMP DWORD PTR DS:[ESI],0

00172909 75 13 JNE SHORT 0017291E


0017290C E8 23FFFFFF CALL 00172834

00172911 59 POP ECX


00172914 75 08 JNE SHORT 0017291E

00172916 6A 11 PUSH 11

00172918 E8 BAECFFFF CALL 001715D7

0017291D 59 POP ECX

0017291E FF36 PUSH DWORD PTR DS:[ESI]


00172926 5E POP ESI


00172927 5D POP EBP

00172928 C3 RETN


0017292B 55 PUSH EBP

0017292C 8BEC MOV EBP,ESP

0017292E 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]



0017293B A3 48971700 MOV DWORD PTR DS:[179748],EAX

00172940 A3 4C971700 MOV DWORD PTR DS:[17974C],EAX

00172945 5D POP EBP

00172946 C3 RETN


00172949 55 PUSH EBP

0017294A 8BEC MOV EBP,ESP

0017294C 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

0017294F 8B0D EC6B1700 MOV ECX,DWORD PTR DS:[176BEC]

00172955 56 PUSH ESI

00172956 3950 04 CMP DWORD PTR DS:[EAX+4],EDX

00172959 74 0F JE SHORT 0017296A

0017295B 8BF1 MOV ESI,ECX

0017295D 6BF6 0C IMUL ESI,ESI,0C

00172960 0375 08 ADD ESI,DWORD PTR SS:[EBP+8]

00172963 83C0 0C ADD EAX,0C

00172966 3BC6 CMP EAX,ESI

00172968 ^ 72 EC JB SHORT 00172956

0017296A 6BC9 0C IMUL ECX,ECX,0C

0017296D 034D 08 ADD ECX,DWORD PTR SS:[EBP+8]

00172970 5E POP ESI

00172971 3BC1 CMP EAX,ECX

00172973 73 05 JNB SHORT 0017297A

00172975 3950 04 CMP DWORD PTR DS:[EAX+4],EDX

00172978 74 02 JE SHORT 0017297C


0017297C 5D POP EBP

0017297D C3 RETN

0017297E FF35 48971700 PUSH DWORD PTR DS:[179748]


0017298A C3 RETN

0017298B 6A 20 PUSH 20

0017298D 68 C0791700 PUSH OFFSET 001779C0

00172992 E8 09FBFFFF CALL 001724A0



00172999 897D E4 MOV DWORD PTR SS:[EBP-1C],EDI

0017299C 897D D8 MOV DWORD PTR SS:[EBP-28],EDI

0017299F 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+8]

001729A2 83FB 0B CMP EBX,0B

001729A5 7F 4B JG SHORT 001729F2

001729A7 74 15 JE SHORT 001729BE

001729A9 8BC3 MOV EAX,EBX

001729AB 6A 02 PUSH 2

001729AD 59 POP ECX

001729AE 2BC1 SUB EAX,ECX

001729B0 74 22 JE SHORT 001729D4

001729B2 2BC1 SUB EAX,ECX

001729B4 74 08 JE SHORT 001729BE

001729B6 2BC1 SUB EAX,ECX

001729B8 74 59 JE SHORT 00172A13

001729BA 2BC1 SUB EAX,ECX

001729BC 75 43 JNE SHORT 00172A01

001729BE E8 79F7FFFF CALL 0017213C


001729C5 897D D8 MOV DWORD PTR SS:[EBP-28],EDI

001729C8 85FF TEST EDI,EDI

001729CA 75 14 JNE SHORT 001729E0

001729CC 83C8 FF OR EAX,FFFFFFFF

001729CF E9 54010000 JMP 00172B28

001729D4 BE 40971700 MOV ESI,OFFSET 00179740

001729D9 A1 40971700 MOV EAX,DWORD PTR DS:[179740]

001729DE EB 55 JMP SHORT 00172A35

001729E0 FF77 5C PUSH DWORD PTR DS:[EDI+5C]

001729E3 8BD3 MOV EDX,EBX

001729E5 E8 5DFFFFFF CALL 00172947

001729EA 59 POP ECX

001729EB 8D70 08 LEA ESI,[EAX+8]

001729EE 8B06 MOV EAX,DWORD PTR DS:[ESI]

001729F0 EB 51 JMP SHORT 00172A43

001729F2 8BC3 MOV EAX,EBX

001729F4 83E8 0F SUB EAX,0F

001729F7 74 32 JE SHORT 00172A2B

001729F9 83E8 06 SUB EAX,6

001729FC 74 21 JE SHORT 00172A1F

001729FE 48 DEC EAX

001729FF 74 12 JE SHORT 00172A13


00172A01 E8 59030000 CALL 00172D5F

00172A06 C700 16000000 MOV DWORD PTR DS:[EAX],16

00172A0C E8 C5020000 CALL 00172CD6

00172A11 ^ EB B9 JMP SHORT 001729CC

00172A13 BE 48971700 MOV ESI,OFFSET 00179748

00172A18 A1 48971700 MOV EAX,DWORD PTR DS:[179748]

00172A1D EB 16 JMP SHORT 00172A35

00172A1F BE 44971700 MOV ESI,OFFSET 00179744


00172A29 EB 0A JMP SHORT 00172A35

00172A2B BE 4C971700 MOV ESI,OFFSET 0017974C

00172A30 A1 4C971700 MOV EAX,DWORD PTR DS:[17974C]

00172A35 C745 E4 0100000 MOV DWORD PTR SS:[EBP-1C],1

00172A3C 50 PUSH EAX

00172A3D FF15 208B1700 CALL DWORD PTR DS:[178B20]

00172A43 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX


00172A48 837D E0 01 CMP DWORD PTR SS:[EBP-20],1

00172A4C 0F84 D6000000 JE 00172B28

00172A52 3945 E0 CMP DWORD PTR SS:[EBP-20],EAX

00172A55 75 07 JNE SHORT 00172A5E

00172A57 6A 03 PUSH 3

00172A59 E8 45EBFFFF CALL 001715A3

00172A5E 3945 E4 CMP DWORD PTR SS:[EBP-1C],EAX

00172A61 74 07 JE SHORT 00172A6A


00172A64 E8 8DFEFFFF CALL 001728F6

00172A69 59 POP ECX

00172A6A 33C0 XOR EAX,EAX

00172A6C 8945 FC MOV DWORD PTR SS:[EBP-4],EAX

00172A6F 83FB 08 CMP EBX,8

00172A72 74 0A JE SHORT 00172A7E

00172A74 83FB 0B CMP EBX,0B

00172A77 74 05 JE SHORT 00172A7E

00172A79 83FB 04 CMP EBX,4

00172A7C 75 1B JNE SHORT 00172A99

00172A7E 8B4F 60 MOV ECX,DWORD PTR DS:[EDI+60]

00172A81 894D D4 MOV DWORD PTR SS:[EBP-2C],ECX

00172A84 8947 60 MOV DWORD PTR DS:[EDI+60],EAX

00172A87 83FB 08 CMP EBX,8

00172A8A 75 3E JNE SHORT 00172ACA

00172A8C 8B4F 64 MOV ECX,DWORD PTR DS:[EDI+64]


00172A8F 894D D0 MOV DWORD PTR SS:[EBP-30],ECX

00172A92 C747 64 8C00000 MOV DWORD PTR DS:[EDI+64],8C

00172A99 83FB 08 CMP EBX,8

00172A9C 75 2C JNE SHORT 00172ACA

00172A9E 8B0D E06B1700 MOV ECX,DWORD PTR DS:[176BE0]

00172AA4 894D DC MOV DWORD PTR SS:[EBP-24],ECX

00172AA7 8B0D E46B1700 MOV ECX,DWORD PTR DS:[176BE4]

00172AAD 030D E06B1700 ADD ECX,DWORD PTR DS:[176BE0]

00172AB3 394D DC CMP DWORD PTR SS:[EBP-24],ECX

00172AB6 7D 19 JGE SHORT 00172AD1

00172AB8 8B4D DC MOV ECX,DWORD PTR SS:[EBP-24]

00172ABB 6BC9 0C IMUL ECX,ECX,0C

00172ABE 8B57 5C MOV EDX,DWORD PTR DS:[EDI+5C]

00172AC1 894411 08 MOV DWORD PTR DS:[EDX+ECX+8],EAX

00172AC5 FF45 DC INC DWORD PTR SS:[EBP-24]

00172AC8 ^ EB DD JMP SHORT 00172AA7

00172ACA E8 36F5FFFF CALL 00172005

00172ACF 8906 MOV DWORD PTR DS:[ESI],EAX

00172AD1 C745 FC FEFFFFF MOV DWORD PTR SS:[EBP-4],-2

00172AD8 E8 15000000 CALL 00172AF2

00172ADD 83FB 08 CMP EBX,8

00172AE0 75 1F JNE SHORT 00172B01

00172AE2 FF77 64 PUSH DWORD PTR DS:[EDI+64]

00172AE5 53 PUSH EBX

00172AE6 FF55 E0 CALL DWORD PTR SS:[EBP-20]

00172AE9 59 POP ECX

00172AEA EB 19 JMP SHORT 00172B05

00172AEC 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+8]

00172AEF 8B7D D8 MOV EDI,DWORD PTR SS:[EBP-28]

00172AF2 837D E4 00 CMP DWORD PTR SS:[EBP-1C],0

00172AF6 74 08 JE SHORT 00172B00

00172AF8 6A 00 PUSH 0

00172AFA E8 1EFDFFFF CALL 0017281D

00172AFF 59 POP ECX

00172B00 C3 RETN


00172B02 FF55 E0 CALL DWORD PTR SS:[EBP-20]

00172B05 59 POP ECX

00172B06 83FB 08 CMP EBX,8

00172B09 74 0A JE SHORT 00172B15

00172B0B 83FB 0B CMP EBX,0B

00172B0E 74 05 JE SHORT 00172B15


00172B10 83FB 04 CMP EBX,4

00172B13 75 11 JNE SHORT 00172B26

00172B15 8B45 D4 MOV EAX,DWORD PTR SS:[EBP-2C]

00172B18 8947 60 MOV DWORD PTR DS:[EDI+60],EAX

00172B1B 83FB 08 CMP EBX,8

00172B1E 75 06 JNE SHORT 00172B26

00172B20 8B45 D0 MOV EAX,DWORD PTR SS:[EBP-30]

00172B23 8947 64 MOV DWORD PTR DS:[EDI+64],EAX


00172B28 E8 B8F9FFFF CALL 001724E5

00172B2D C3 RETN

00172B2E 8BFF MOV EDI,EDI




00172B36 A3 54971700 MOV DWORD PTR DS:[179754],EAX

00172B3B 5D POP EBP

00172B3C C3 RETN

00172B3D 8BFF MOV EDI,EDI

00172B3F 55 PUSH EBP




00172B4A 5D POP EBP

00172B4B C3 RETN

00172B4C 8BFF MOV EDI,EDI

00172B4E 55 PUSH EBP

00172B4F 8BEC MOV EBP,ESP


00172B54 A3 5C971700 MOV DWORD PTR DS:[17975C],EAX

00172B59 5D POP EBP

00172B5A C3 RETN

00172B5B 8BFF MOV EDI,EDI

00172B5D 55 PUSH EBP

00172B5E 8BEC MOV EBP,ESP

00172B60 81EC 28030000 SUB ESP,328

00172B66 A1 04801700 MOV EAX,DWORD PTR DS:[178004]

00172B6B 33C5 XOR EAX,EBP

00172B6D 8945 FC MOV DWORD PTR SS:[EBP-4],EAX


00172B71 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+8]



00172B75 83FB FF CMP EBX,-1

00172B78 74 07 JE SHORT 00172B81

00172B7A 53 PUSH EBX

00172B7B E8 AAFBFFFF CALL 0017272A

00172B80 59 POP ECX

00172B81 83A5 E0FCFFFF 0 AND DWORD PTR SS:[EBP-320],00000000

00172B88 6A 4C PUSH 4C

00172B8A 8D85 E4FCFFFF LEA EAX,[EBP-31C]

00172B90 6A 00 PUSH 0


00172B93 E8 281A0000 CALL 001745C0

00172B98 8D85 E0FCFFFF LEA EAX,[EBP-320]

00172B9E 8985 D8FCFFFF MOV DWORD PTR SS:[EBP-328],EAX

00172BA4 8D85 30FDFFFF LEA EAX,[EBP-2D0]

00172BAA 83C4 0C ADD ESP,0C

00172BAD 8985 DCFCFFFF MOV DWORD PTR SS:[EBP-324],EAX

00172BB3 8985 E0FDFFFF MOV DWORD PTR SS:[EBP-220],EAX

00172BB9 898D DCFDFFFF MOV DWORD PTR SS:[EBP-224],ECX

00172BBF 8995 D8FDFFFF MOV DWORD PTR SS:[EBP-228],EDX

00172BC5 899D D4FDFFFF MOV DWORD PTR SS:[EBP-22C],EBX

00172BCB 89B5 D0FDFFFF MOV DWORD PTR SS:[EBP-230],ESI

00172BD1 89BD CCFDFFFF MOV DWORD PTR SS:[EBP-234],EDI

00172BD7 66:8C95 F8FDFFF MOV WORD PTR SS:[EBP-208],SS ; Superfluous operand size

prefix

00172BDE 66:8C8D ECFDFFF MOV WORD PTR SS:[EBP-214],CS ; Superfluous operand size

prefix

00172BE5 66:8C9D C8FDFFF MOV WORD PTR SS:[EBP-238],DS ; Superfluous operand size

prefix

00172BEC 66:8C85 C4FDFFF MOV WORD PTR SS:[EBP-23C],ES ; Superfluous operand size

prefix

00172BF3 66:8CA5 C0FDFFF MOV WORD PTR SS:[EBP-240],FS ; Superfluous operand size

prefix

00172BFA 66:8CAD BCFDFFF MOV WORD PTR SS:[EBP-244],GS ; Superfluous operand size

prefix

00172C01 9C PUSHFD

00172C02 8F85 F0FDFFFF POP DWORD PTR SS:[EBP-210]


00172C0B 8D4D 04 LEA ECX,[EBP+4]

00172C0E 898D F4FDFFFF MOV DWORD PTR SS:[EBP-20C],ECX

00172C14 C785 30FDFFFF 0 MOV DWORD PTR SS:[EBP-2D0],10001

00172C1E 8985 E8FDFFFF MOV DWORD PTR SS:[EBP-218],EAX

00172C24 8B49 FC MOV ECX,DWORD PTR DS:[ECX-4]


00172C27 898D E4FDFFFF MOV DWORD PTR SS:[EBP-21C],ECX

00172C2D 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]

00172C30 898D E0FCFFFF MOV DWORD PTR SS:[EBP-320],ECX

00172C36 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]

00172C39 898D E4FCFFFF MOV DWORD PTR SS:[EBP-31C],ECX

00172C3F 8985 ECFCFFFF MOV DWORD PTR SS:[EBP-314],EAX

00172C45 FF15 1C601700 CALL DWORD PTR DS:[17601C]

00172C4B 6A 00 PUSH 0

00172C4D 8BF8 MOV EDI,EAX

00172C4F FF15 18601700 CALL DWORD PTR DS:[176018]

00172C55 8D85 D8FCFFFF LEA EAX,[EBP-328]

00172C5B 50 PUSH EAX

00172C5C FF15 14601700 CALL DWORD PTR DS:[176014]


00172C64 75 10 JNE SHORT 00172C76


00172C68 75 0C JNE SHORT 00172C76

00172C6A 83FB FF CMP EBX,-1

00172C6D 74 07 JE SHORT 00172C76

00172C6F 53 PUSH EBX

00172C70 E8 B5FAFFFF CALL 0017272A

00172C75 59 POP ECX

00172C76 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]

00172C79 5F POP EDI

00172C7A 33CD XOR ECX,EBP

00172C7C 5B POP EBX

00172C7D E8 83E3FFFF CALL 00171005

00172C82 C9 LEAVE

00172C83 C3 RETN



00172C87 6A 01 PUSH 1

00172C89 BE 170400C0 MOV ESI,C0000417

00172C8E 56 PUSH ESI

00172C8F 6A 02 PUSH 2

00172C91 E8 C5FEFFFF CALL 00172B5B

00172C96 83C4 0C ADD ESP,0C


00172C9A FF15 10601700 CALL DWORD PTR DS:[176010]

00172CA0 50 PUSH EAX

00172CA1 FF15 0C601700 CALL DWORD PTR DS:[17600C]

00172CA7 5E POP ESI


00172CA8 C3 RETN

00172CA9 8BFF MOV EDI,EDI

00172CAB 55 PUSH EBP

00172CAC 8BEC MOV EBP,ESP

00172CAE FF35 5C971700 PUSH DWORD PTR DS:[17975C]

00172CB4 FF15 208B1700 CALL DWORD PTR DS:[178B20]

00172CBA 85C0 TEST EAX,EAX

00172CBC 74 03 JE SHORT 00172CC1

00172CBE 5D POP EBP

00172CBF FFE0 JMP EAX

00172CC1 FF75 18 PUSH DWORD PTR SS:[EBP+18]



00172CCA FF75 0C PUSH DWORD PTR SS:[EBP+0C]

00172CCD FF75 08 PUSH DWORD PTR SS:[EBP+8]

00172CD0 E8 AFFFFFFF CALL 00172C84

00172CD5 CC INT3

00172CD6 33C0 XOR EAX,EAX

00172CD8 50 PUSH EAX

00172CD9 50 PUSH EAX

00172CDA 50 PUSH EAX

00172CDB 50 PUSH EAX

00172CDC 50 PUSH EAX

00172CDD E8 C7FFFFFF CALL 00172CA9

00172CE2 83C4 14 ADD ESP,14

00172CE5 C3 RETN

00172CE6 8BFF MOV EDI,EDI

00172CE8 55 PUSH EBP

00172CE9 8BEC MOV EBP,ESP

00172CEB 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

00172CEE A3 60971700 MOV DWORD PTR DS:[179760],EAX

00172CF3 5D POP EBP

00172CF4 C3 RETN

00172CF5 8BFF MOV EDI,EDI

00172CF7 55 PUSH EBP

00172CF8 8BEC MOV EBP,ESP

00172CFA FF35 60971700 PUSH DWORD PTR DS:[179760]

00172D00 FF15 208B1700 CALL DWORD PTR DS:[178B20]


00172D08 74 0F JE SHORT 00172D19

00172D0A FF75 08 PUSH DWORD PTR SS:[EBP+8]

00172D0D FFD0 CALL EAX


00172D0F 59 POP ECX


00172D12 74 05 JE SHORT 00172D19


00172D16 40 INC EAX

00172D17 5D POP EBP

00172D18 C3 RETN


00172D1B 5D POP EBP

00172D1C C3 RETN

00172D1D 8BFF MOV EDI,EDI

00172D1F 55 PUSH EBP


00172D22 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

00172D25 33C9 XOR ECX,ECX

00172D27 3B04CD 80811700 CMP EAX,DWORD PTR DS:[ECX*8+178180]

00172D2E 74 13 JE SHORT 00172D43

00172D30 41 INC ECX

00172D31 83F9 2D CMP ECX,2D

00172D34 ^ 72 F1 JB SHORT 00172D27

00172D36 8D48 ED LEA ECX,[EAX-13]

00172D39 83F9 11 CMP ECX,11

00172D3C 77 0E JA SHORT 00172D4C

00172D3E 6A 0D PUSH 0D

00172D40 58 POP EAX

00172D41 5D POP EBP

00172D42 C3 RETN

00172D43 8B04CD 84811700 MOV EAX,DWORD PTR DS:[ECX*8+178184]

00172D4A 5D POP EBP

00172D4B C3 RETN

00172D4C 05 44FFFFFF ADD EAX,-0BC

00172D51 6A 0E PUSH 0E

00172D53 59 POP ECX

00172D54 3BC8 CMP ECX,EAX

00172D56 1BC0 SBB EAX,EAX

00172D58 23C1 AND EAX,ECX

00172D5A 83C0 08 ADD EAX,8

00172D5D 5D POP EBP

00172D5E C3 RETN

00172D5F E8 D8F3FFFF CALL 0017213C


00172D66 75 06 JNE SHORT 00172D6E


00172D68 B8 E8821700 MOV EAX,OFFSET 001782E8

00172D6D C3 RETN

00172D6E 83C0 08 ADD EAX,8

00172D71 C3 RETN




00172D77 51 PUSH ECX



00172D7A 8B35 208B1700 MOV ESI,DWORD PTR DS:[178B20]


00172D81 FF35 C8981700 PUSH DWORD PTR DS:[1798C8]


00172D89 FF35 C4981700 PUSH DWORD PTR DS:[1798C4]

00172D8F 8BD8 MOV EBX,EAX

00172D91 895D FC MOV DWORD PTR SS:[EBP-4],EBX


00172D96 8BF0 MOV ESI,EAX

00172D98 3BF3 CMP ESI,EBX

00172D9A 0F82 81000000 JB 00172E21

00172DA0 8BFE MOV EDI,ESI

00172DA2 2BFB SUB EDI,EBX

00172DA4 8D47 04 LEA EAX,[EDI+4]

00172DA7 83F8 04 CMP EAX,4

00172DAA 72 75 JB SHORT 00172E21

00172DAC 53 PUSH EBX

00172DAD E8 88180000 CALL 0017463A

00172DB2 8BD8 MOV EBX,EAX

00172DB4 8D47 04 LEA EAX,[EDI+4]

00172DB7 59 POP ECX

00172DB8 3BD8 CMP EBX,EAX

00172DBA 73 48 JNB SHORT 00172E04

00172DBC B8 00080000 MOV EAX,800

00172DC1 3BD8 CMP EBX,EAX

00172DC3 73 02 JNB SHORT 00172DC7

00172DC5 8BC3 MOV EAX,EBX

00172DC7 03C3 ADD EAX,EBX

00172DC9 3BC3 CMP EAX,EBX

00172DCB 72 0F JB SHORT 00172DDC

00172DCD 50 PUSH EAX

00172DCE FF75 FC PUSH DWORD PTR SS:[EBP-4]


00172DD1 E8 400F0000 CALL 00173D16

00172DD6 59 POP ECX

00172DD7 59 POP ECX

00172DD8 85C0 TEST EAX,EAX

00172DDA 75 16 JNE SHORT 00172DF2

00172DDC 8D43 10 LEA EAX,[EBX+10]

00172DDF 3BC3 CMP EAX,EBX

00172DE1 72 3E JB SHORT 00172E21

00172DE3 50 PUSH EAX

00172DE4 FF75 FC PUSH DWORD PTR SS:[EBP-4]

00172DE7 E8 2A0F0000 CALL 00173D16

00172DEC 59 POP ECX

00172DED 59 POP ECX

00172DEE 85C0 TEST EAX,EAX

00172DF0 74 2F JE SHORT 00172E21

00172DF2 C1FF 02 SAR EDI,2

00172DF5 50 PUSH EAX

00172DF6 8D34B8 LEA ESI,[EDI*4+EAX]

00172DF9 FF15 248B1700 CALL DWORD PTR DS:[178B24]

00172DFF A3 C8981700 MOV DWORD PTR DS:[1798C8],EAX


00172E07 8B3D 248B1700 MOV EDI,DWORD PTR DS:[178B24]

00172E0D FFD7 CALL EDI

00172E0F 8906 MOV DWORD PTR DS:[ESI],EAX

00172E11 83C6 04 ADD ESI,4


00172E15 FFD7 CALL EDI

00172E17 A3 C4981700 MOV DWORD PTR DS:[1798C4],EAX

00172E1C 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

00172E1F EB 02 JMP SHORT 00172E23

00172E21 33C0 XOR EAX,EAX

00172E23 5F POP EDI

00172E24 5E POP ESI

00172E25 5B POP EBX

00172E26 C9 LEAVE

00172E27 C3 RETN

00172E28 8BFF MOV EDI,EDI

00172E2A 56 PUSH ESI

00172E2B 6A 04 PUSH 4

00172E2D 6A 20 PUSH 20

00172E2F E8 960E0000 CALL 00173CCA

00172E34 59 POP ECX


00172E35 59 POP ECX

00172E36 8BF0 MOV ESI,EAX


00172E39 FF15 248B1700 CALL DWORD PTR DS:[178B24]

00172E3F A3 C8981700 MOV DWORD PTR DS:[1798C8],EAX

00172E44 A3 C4981700 MOV DWORD PTR DS:[1798C4],EAX

00172E49 85F6 TEST ESI,ESI

00172E4B 75 05 JNE SHORT 00172E52

00172E4D 6A 18 PUSH 18

00172E4F 58 POP EAX

00172E50 5E POP ESI

00172E51 C3 RETN

00172E52 8326 00 AND DWORD PTR DS:[ESI],00000000

00172E55 33C0 XOR EAX,EAX

00172E57 5E POP ESI

00172E58 C3 RETN

00172E59 6A 0C PUSH 0C

00172E5B 68 E0791700 PUSH OFFSET 001779E0

00172E60 E8 3BF6FFFF CALL 001724A0

00172E65 E8 E3E4FFFF CALL 0017134D

00172E6A 8365 FC 00 AND DWORD PTR SS:[EBP-4],00000000

00172E6E FF75 08 PUSH DWORD PTR SS:[EBP+8]

00172E71 E8 FCFEFFFF CALL 00172D72

00172E76 59 POP ECX

00172E77 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX

00172E7A C745 FC FEFFFFF MOV DWORD PTR SS:[EBP-4],-2

00172E81 E8 09000000 CALL 00172E8F

00172E86 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]

00172E89 E8 57F6FFFF CALL 001724E5

00172E8E C3 RETN

00172E8F E8 C2E4FFFF CALL 00171356

00172E94 C3 RETN

00172E95 8BFF MOV EDI,EDI

00172E97 55 PUSH EBP

00172E98 8BEC MOV EBP,ESP

00172E9A FF75 08 PUSH DWORD PTR SS:[EBP+8]

00172E9D E8 B7FFFFFF CALL 00172E59

00172EA2 F7D8 NEG EAX

00172EA4 1BC0 SBB EAX,EAX

00172EA6 F7D8 NEG EAX

00172EA8 59 POP ECX

00172EA9 48 DEC EAX


00172EAA 5D POP EBP

00172EAB C3 RETN

00172EAC 8BFF MOV EDI,EDI

00172EAE 56 PUSH ESI

00172EAF 57 PUSH EDI

00172EB0 33FF XOR EDI,EDI

00172EB2 FFB7 F0821700 PUSH DWORD PTR DS:[EDI+1782F0]

00172EB8 FF15 248B1700 CALL DWORD PTR DS:[178B24]

00172EBE 8987 F0821700 MOV DWORD PTR DS:[EDI+1782F0],EAX

00172EC4 83C7 04 ADD EDI,4

00172EC7 83FF 28 CMP EDI,28

00172ECA ^ 72 E6 JB SHORT 00172EB2

00172ECC 5F POP EDI

00172ECD 5E POP ESI

00172ECE C3 RETN

00172ECF CC INT3

00172ED0 8BFF MOV EDI,EDI

00172ED2 55 PUSH EBP

00172ED3 8BEC MOV EBP,ESP

00172ED5 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]

00172ED8 B8 4D5A0000 MOV EAX,5A4D

00172EDD 66:3901 CMP WORD PTR DS:[ECX],AX

00172EE0 74 04 JE SHORT 00172EE6

00172EE2 33C0 XOR EAX,EAX

00172EE4 5D POP EBP

00172EE5 C3 RETN

00172EE6 8B41 3C MOV EAX,DWORD PTR DS:[ECX+3C]

00172EE9 03C1 ADD EAX,ECX

00172EEB 8138 50450000 CMP DWORD PTR DS:[EAX],4550

00172EF1 ^ 75 EF JNE SHORT 00172EE2

00172EF3 33D2 XOR EDX,EDX

00172EF5 B9 0B010000 MOV ECX,10B

00172EFA 66:3948 18 CMP WORD PTR DS:[EAX+18],CX

00172EFE 0F94C2 SETE DL

00172F01 8BC2 MOV EAX,EDX

00172F03 5D POP EBP

00172F04 C3 RETN

00172F05 CC INT3

00172F06 CC INT3

00172F07 CC INT3

00172F08 CC INT3

00172F09 CC INT3


00172F0A CC INT3

00172F0B CC INT3

00172F0C CC INT3

00172F0D CC INT3

00172F0E CC INT3

00172F0F CC INT3




00172F15 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

00172F18 8B48 3C MOV ECX,DWORD PTR DS:[EAX+3C]

00172F1B 03C8 ADD ECX,EAX

00172F1D 0FB741 14 MOVZX EAX,WORD PTR DS:[ECX+14]

00172F21 53 PUSH EBX


00172F23 0FB771 06 MOVZX ESI,WORD PTR DS:[ECX+6]

00172F27 33D2 XOR EDX,EDX

00172F29 57 PUSH EDI

00172F2A 8D4408 18 LEA EAX,[ECX+EAX+18]

00172F2E 85F6 TEST ESI,ESI

00172F30 74 1B JE SHORT 00172F4D

00172F32 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+0C]

00172F35 8B48 0C MOV ECX,DWORD PTR DS:[EAX+0C]

00172F38 3BF9 CMP EDI,ECX

00172F3A 72 09 JB SHORT 00172F45

00172F3C 8B58 08 MOV EBX,DWORD PTR DS:[EAX+8]

00172F3F 03D9 ADD EBX,ECX


00172F43 72 0A JB SHORT 00172F4F

00172F45 42 INC EDX

00172F46 83C0 28 ADD EAX,28

00172F49 3BD6 CMP EDX,ESI

00172F4B ^ 72 E8 JB SHORT 00172F35

00172F4D 33C0 XOR EAX,EAX

00172F4F 5F POP EDI

00172F50 5E POP ESI

00172F51 5B POP EBX

00172F52 5D POP EBP

00172F53 C3 RETN

00172F54 CC INT3

00172F55 CC INT3

00172F56 CC INT3


00172F57 CC INT3

00172F58 CC INT3

00172F59 CC INT3

00172F5A CC INT3

00172F5B CC INT3

00172F5C CC INT3

00172F5D CC INT3

00172F5E CC INT3

00172F5F CC INT3




00172F65 6A FE PUSH -2

00172F67 68 007A1700 PUSH OFFSET 00177A00

00172F6C 68 00251700 PUSH OFFSET 00172500

00172F71 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]

00172F77 50 PUSH EAX

00172F78 83EC 08 SUB ESP,8

00172F7B 53 PUSH EBX

00172F7C 56 PUSH ESI

00172F7D 57 PUSH EDI

00172F7E A1 04801700 MOV EAX,DWORD PTR DS:[178004]

00172F83 3145 F8 XOR DWORD PTR SS:[EBP-8],EAX

00172F86 33C5 XOR EAX,EBP


00172F89 8D45 F0 LEA EAX,[EBP-10]

00172F8C 64:A3 00000000 MOV DWORD PTR FS:[0],EAX

00172F92 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP

00172F95 C745 FC 0000000 MOV DWORD PTR SS:[EBP-4],0

00172F9C 68 00001700 PUSH OFFSET 00170000

00172FA1 E8 2AFFFFFF CALL 00172ED0

00172FA6 83C4 04 ADD ESP,4

00172FA9 85C0 TEST EAX,EAX

00172FAB 74 54 JE SHORT 00173001

00172FAD 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

00172FB0 2D 00001700 SUB EAX,OFFSET 00170000

00172FB5 50 PUSH EAX

00172FB6 68 00001700 PUSH OFFSET 00170000

00172FBB E8 50FFFFFF CALL 00172F10

00172FC0 83C4 08 ADD ESP,8

00172FC3 85C0 TEST EAX,EAX

00172FC5 74 3A JE SHORT 00173001


00172FC7 8B40 24 MOV EAX,DWORD PTR DS:[EAX+24]

00172FCA C1E8 1F SHR EAX,1F

00172FCD F7D0 NOT EAX

00172FCF 83E0 01 AND EAX,00000001

00172FD2 C745 FC FEFFFFF MOV DWORD PTR SS:[EBP-4],-2

00172FD9 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10]

00172FDC 64:890D 0000000 MOV DWORD PTR FS:[0],ECX

00172FE3 59 POP ECX

00172FE4 5F POP EDI

00172FE5 5E POP ESI

00172FE6 5B POP EBX

00172FE7 8BE5 MOV ESP,EBP

00172FE9 5D POP EBP

00172FEA C3 RETN

00172FEB 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]

00172FEE 8B08 MOV ECX,DWORD PTR DS:[EAX]

00172FF0 33D2 XOR EDX,EDX

00172FF2 8139 050000C0 CMP DWORD PTR DS:[ECX],C0000005

00172FF8 0F94C2 SETE DL

00172FFB 8BC2 MOV EAX,EDX

00172FFD C3 RETN

00172FFE 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18]



0017300A 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10]

0017300D 64:890D 0000000 MOV DWORD PTR FS:[0],ECX

00173014 59 POP ECX

00173015 5F POP EDI

00173016 5E POP ESI

00173017 5B POP EBX

00173018 8BE5 MOV ESP,EBP

0017301A 5D POP EBP

0017301B C3 RETN

0017301C CC INT3

0017301D CC INT3

0017301E CC INT3

0017301F CC INT3

00173020 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]

00173024 F7C1 03000000 TEST ECX,00000003

0017302A 74 24 JE SHORT 00173050

0017302C 8A01 MOV AL,BYTE PTR DS:[ECX]

0017302E 83C1 01 ADD ECX,1


00173031 84C0 TEST AL,AL

00173033 74 4E JE SHORT 00173083

00173035 F7C1 03000000 TEST ECX,00000003

0017303B ^ 75 EF JNE SHORT 0017302C

0017303D 05 00000000 ADD EAX,0

00173042 8DA424 00000000 LEA ESP,[ESP]

00173049 8DA424 00000000 LEA ESP,[ESP]

00173050 8B01 MOV EAX,DWORD PTR DS:[ECX]

00173052 BA FFFEFE7E MOV EDX,7EFEFEFF

00173057 03D0 ADD EDX,EAX

00173059 83F0 FF XOR EAX,FFFFFFFF

0017305C 33C2 XOR EAX,EDX

0017305E 83C1 04 ADD ECX,4

00173061 A9 00010181 TEST EAX,81010100

00173066 ^ 74 E8 JE SHORT 00173050

00173068 8B41 FC MOV EAX,DWORD PTR DS:[ECX-4]

0017306B 84C0 TEST AL,AL

0017306D 74 32 JE SHORT 001730A1

0017306F 84E4 TEST AH,AH

00173071 74 24 JE SHORT 00173097

00173073 A9 0000FF00 TEST EAX,00FF0000

00173078 74 13 JE SHORT 0017308D

0017307A A9 000000FF TEST EAX,FF000000

0017307F 74 02 JE SHORT 00173083

00173081 ^ EB CD JMP SHORT 00173050

00173083 8D41 FF LEA EAX,[ECX-1]


0017308A 2BC1 SUB EAX,ECX

0017308C C3 RETN

0017308D 8D41 FE LEA EAX,[ECX-2]


00173094 2BC1 SUB EAX,ECX

00173096 C3 RETN

00173097 8D41 FD LEA EAX,[ECX-3]

0017309A 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]

0017309E 2BC1 SUB EAX,ECX

001730A0 C3 RETN

001730A1 8D41 FC LEA EAX,[ECX-4]

001730A4 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]

001730A8 2BC1 SUB EAX,ECX

001730AA C3 RETN

001730AB 8BFF MOV EDI,EDI


001730AD 55 PUSH EBP

001730AE 8BEC MOV EBP,ESP

001730B0 83EC 24 SUB ESP,24


001730B8 33C5 XOR EAX,EBP

001730BA 8945 FC MOV DWORD PTR SS:[EBP-4],EAX

001730BD 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]


001730C1 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX

001730C4 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0C]



001730C9 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX

001730CC E8 34EFFFFF CALL 00172005

001730D1 8365 EC 00 AND DWORD PTR SS:[EBP-14],00000000

001730D5 833D 64971700 0 CMP DWORD PTR DS:[179764],0

001730DC 8945 E8 MOV DWORD PTR SS:[EBP-18],EAX

001730DF 75 7D JNE SHORT 0017315E

001730E1 68 A06C1700 PUSH OFFSET 00176CA0 ; UNICODE "USER32.DLL"

001730E6 FF15 98601700 CALL DWORD PTR DS:[176098]

001730EC 8BD8 MOV EBX,EAX

001730EE 85DB TEST EBX,EBX

001730F0 0F84 10010000 JE 00173206

001730F6 8B3D 20601700 MOV EDI,DWORD PTR DS:[176020]

001730FC 68 946C1700 PUSH OFFSET 00176C94 ; ASCII "MessageBoxW"

00173101 53 PUSH EBX

00173102 FFD7 CALL EDI


00173106 0F84 FA000000 JE 00173206

0017310C 8B35 248B1700 MOV ESI,DWORD PTR DS:[178B24]

00173112 50 PUSH EAX


00173115 68 846C1700 PUSH OFFSET 00176C84 ; ASCII "GetActiveWindow"

0017311A 53 PUSH EBX



00173122 50 PUSH EAX


00173125 68 706C1700 PUSH OFFSET 00176C70 ; ASCII "GetLastActivePopup"





00173132 50 PUSH EAX


00173135 68 546C1700 PUSH OFFSET 00176C54 ; ASCII

"GetUserObjectInformationW"


0017313B A3 6C971700 MOV DWORD PTR DS:[17976C],EAX


00173142 50 PUSH EAX




0017314C 74 10 JE SHORT 0017315E

0017314E 68 3C6C1700 PUSH OFFSET 00176C3C ; ASCII

"GetProcessWindowStation"

00173153 53 PUSH EBX


00173156 50 PUSH EAX



0017315E A1 70971700 MOV EAX,DWORD PTR DS:[179770]

00173163 8B4D E8 MOV ECX,DWORD PTR SS:[EBP-18]

00173166 8B35 208B1700 MOV ESI,DWORD PTR DS:[178B20]

0017316C 3BC1 CMP EAX,ECX

0017316E 74 47 JE SHORT 001731B7

00173170 390D 74971700 CMP DWORD PTR DS:[179774],ECX

00173176 74 3F JE SHORT 001731B7

00173178 50 PUSH EAX


0017317B FF35 74971700 PUSH DWORD PTR DS:[179774]





00173189 74 2C JE SHORT 001731B7

0017318B 85DB TEST EBX,EBX

0017318D 74 28 JE SHORT 001731B7

0017318F FFD7 CALL EDI


00173193 74 19 JE SHORT 001731AE

00173195 8D4D DC LEA ECX,[EBP-24]

00173198 51 PUSH ECX

00173199 6A 0C PUSH 0C


0017319B 8D4D F0 LEA ECX,[EBP-10]

0017319E 51 PUSH ECX

0017319F 6A 01 PUSH 1


001731A2 FFD3 CALL EBX


001731A6 74 06 JE SHORT 001731AE

001731A8 F645 F8 01 TEST BYTE PTR SS:[EBP-8],01

001731AC 75 09 JNE SHORT 001731B7

001731AE 814D 10 0000200 OR DWORD PTR SS:[EBP+10],00200000

001731B5 EB 33 JMP SHORT 001731EA


001731BC 3B45 E8 CMP EAX,DWORD PTR SS:[EBP-18]

001731BF 74 29 JE SHORT 001731EA


001731C2 FFD6 CALL ESI


001731C6 74 22 JE SHORT 001731EA

001731C8 FFD0 CALL EAX

001731CA 8945 EC MOV DWORD PTR SS:[EBP-14],EAX

001731CD 85C0 TEST EAX,EAX

001731CF 74 19 JE SHORT 001731EA

001731D1 A1 6C971700 MOV EAX,DWORD PTR DS:[17976C]

001731D6 3B45 E8 CMP EAX,DWORD PTR SS:[EBP-18]

001731D9 74 0F JE SHORT 001731EA

001731DB 50 PUSH EAX

001731DC FFD6 CALL ESI

001731DE 85C0 TEST EAX,EAX

001731E0 74 08 JE SHORT 001731EA

001731E2 FF75 EC PUSH DWORD PTR SS:[EBP-14]

001731E5 FFD0 CALL EAX

001731E7 8945 EC MOV DWORD PTR SS:[EBP-14],EAX

001731EA FF35 64971700 PUSH DWORD PTR DS:[179764]

001731F0 FFD6 CALL ESI


001731F4 74 10 JE SHORT 00173206

001731F6 FF75 10 PUSH DWORD PTR SS:[EBP+10]

001731F9 FF75 E4 PUSH DWORD PTR SS:[EBP-1C]

001731FC FF75 E0 PUSH DWORD PTR SS:[EBP-20]

001731FF FF75 EC PUSH DWORD PTR SS:[EBP-14]


00173204 EB 02 JMP SHORT 00173208



00173208 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]

0017320B 5F POP EDI

0017320C 5E POP ESI

0017320D 33CD XOR ECX,EBP

0017320F 5B POP EBX

00173210 E8 F0DDFFFF CALL 00171005

00173215 C9 LEAVE

00173216 C3 RETN


00173219 55 PUSH EBP

0017321A 8BEC MOV EBP,ESP


0017321D 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]

00173220 57 PUSH EDI


00173223 74 07 JE SHORT 0017322C

00173225 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+0C]


0017322A 75 15 JNE SHORT 00173241

0017322C E8 2EFBFFFF CALL 00172D5F

00173231 6A 16 PUSH 16

00173233 5E POP ESI

00173234 8930 MOV DWORD PTR DS:[EAX],ESI

00173236 E8 9BFAFFFF CALL 00172CD6


0017323D 5F POP EDI

0017323E 5E POP ESI

0017323F 5D POP EBP

00173240 C3 RETN



00173246 75 07 JNE SHORT 0017324F


0017324A 66:8906 MOV WORD PTR DS:[ESI],AX

0017324D ^ EB DD JMP SHORT 0017322C

0017324F 8BD6 MOV EDX,ESI

00173251 66:833A 00 CMP WORD PTR DS:[EDX],0

00173255 74 06 JE SHORT 0017325D

00173257 83C2 02 ADD EDX,2

0017325A 4F DEC EDI

0017325B ^ 75 F4 JNE SHORT 00173251


0017325D 85FF TEST EDI,EDI

0017325F ^ 74 E7 JE SHORT 00173248

00173261 2BD1 SUB EDX,ECX

00173263 0FB701 MOVZX EAX,WORD PTR DS:[ECX]

00173266 66:89040A MOV WORD PTR DS:[ECX+EDX],AX

0017326A 83C1 02 ADD ECX,2

0017326D 66:85C0 TEST AX,AX

00173270 74 03 JE SHORT 00173275

00173272 4F DEC EDI

00173273 ^ 75 EE JNE SHORT 00173263



00173279 ^ 75 C2 JNE SHORT 0017323D

0017327B 66:8906 MOV WORD PTR DS:[ESI],AX

0017327E E8 DCFAFFFF CALL 00172D5F

00173283 6A 22 PUSH 22

00173285 59 POP ECX

00173286 8908 MOV DWORD PTR DS:[EAX],ECX

00173288 8BF1 MOV ESI,ECX

0017328A ^ EB AA JMP SHORT 00173236


0017328E 55 PUSH EBP

0017328F 8BEC MOV EBP,ESP


00173294 53 PUSH EBX

00173295 8B5D 14 MOV EBX,DWORD PTR SS:[EBP+14]

00173298 56 PUSH ESI

00173299 57 PUSH EDI

0017329A 85DB TEST EBX,EBX

0017329C 75 10 JNE SHORT 001732AE

0017329E 85D2 TEST EDX,EDX

001732A0 75 10 JNE SHORT 001732B2

001732A2 3955 0C CMP DWORD PTR SS:[EBP+0C],EDX

001732A5 75 12 JNE SHORT 001732B9


001732A9 5F POP EDI

001732AA 5E POP ESI

001732AB 5B POP EBX

001732AC 5D POP EBP

001732AD C3 RETN

001732AE 85D2 TEST EDX,EDX

001732B0 74 07 JE SHORT 001732B9


001732B2 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+0C]

001732B5 85FF TEST EDI,EDI

001732B7 75 13 JNE SHORT 001732CC

001732B9 E8 A1FAFFFF CALL 00172D5F

001732BE 6A 16 PUSH 16

001732C0 5E POP ESI

001732C1 8930 MOV DWORD PTR DS:[EAX],ESI

001732C3 E8 0EFAFFFF CALL 00172CD6

001732C8 8BC6 MOV EAX,ESI

001732CA ^ EB DD JMP SHORT 001732A9

001732CC 85DB TEST EBX,EBX

001732CE 75 07 JNE SHORT 001732D7


001732D2 66:8902 MOV WORD PTR DS:[EDX],AX

001732D5 ^ EB D0 JMP SHORT 001732A7

001732D7 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]

001732DA 85C9 TEST ECX,ECX

001732DC 75 07 JNE SHORT 001732E5

001732DE 33C0 XOR EAX,EAX

001732E0 66:8902 MOV WORD PTR DS:[EDX],AX

001732E3 ^ EB D4 JMP SHORT 001732B9

001732E5 8BC2 MOV EAX,EDX

001732E7 83FB FF CMP EBX,-1

001732EA 75 18 JNE SHORT 00173304

001732EC 8BF2 MOV ESI,EDX

001732EE 2BF1 SUB ESI,ECX

001732F0 0FB701 MOVZX EAX,WORD PTR DS:[ECX]

001732F3 66:89040E MOV WORD PTR DS:[ECX+ESI],AX

001732F7 83C1 02 ADD ECX,2

001732FA 66:85C0 TEST AX,AX

001732FD 74 27 JE SHORT 00173326

001732FF 4F DEC EDI

00173300 ^ 75 EE JNE SHORT 001732F0

00173302 EB 22 JMP SHORT 00173326


00173306 2BF2 SUB ESI,EDX

00173308 0FB70C06 MOVZX ECX,WORD PTR DS:[EAX+ESI]

0017330C 66:8908 MOV WORD PTR DS:[EAX],CX

0017330F 83C0 02 ADD EAX,2

00173312 66:85C9 TEST CX,CX

00173315 74 06 JE SHORT 0017331D

00173317 4F DEC EDI


00173318 74 03 JE SHORT 0017331D

0017331A 4B DEC EBX

0017331B ^ 75 EB JNE SHORT 00173308

0017331D 85DB TEST EBX,EBX

0017331F 75 05 JNE SHORT 00173326


00173323 66:8908 MOV WORD PTR DS:[EAX],CX


00173328 ^ 0F85 79FFFFFF JNE 001732A7


00173330 83FB FF CMP EBX,-1

00173333 75 10 JNE SHORT 00173345

00173335 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0C]

00173338 6A 50 PUSH 50

0017333A 66:89444A FE MOV WORD PTR DS:[ECX*2+EDX-2],AX

0017333F 58 POP EAX

00173340 ^ E9 64FFFFFF JMP 001732A9

00173345 66:8902 MOV WORD PTR DS:[EDX],AX

00173348 E8 12FAFFFF CALL 00172D5F

0017334D 6A 22 PUSH 22

0017334F 59 POP ECX

00173350 8908 MOV DWORD PTR DS:[EAX],ECX


00173354 ^ E9 6AFFFFFF JMP 001732C3


0017335B 55 PUSH EBP

0017335C 8BEC MOV EBP,ESP


00173361 66:8B08 MOV CX,WORD PTR DS:[EAX]

00173364 83C0 02 ADD EAX,2

00173367 66:85C9 TEST CX,CX

0017336A ^ 75 F5 JNE SHORT 00173361

0017336C 2B45 08 SUB EAX,DWORD PTR SS:[EBP+8]

0017336F D1F8 SAR EAX,1

00173371 48 DEC EAX

00173372 5D POP EBP

00173373 C3 RETN


00173376 55 PUSH EBP


00173379 56 PUSH ESI

0017337A 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]


0017337D 57 PUSH EDI

0017337E 85F6 TEST ESI,ESI

00173380 74 07 JE SHORT 00173389

00173382 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+0C]


00173387 75 15 JNE SHORT 0017339E

00173389 E8 D1F9FFFF CALL 00172D5F

0017338E 6A 16 PUSH 16

00173390 5E POP ESI

00173391 8930 MOV DWORD PTR DS:[EAX],ESI

00173393 E8 3EF9FFFF CALL 00172CD6


0017339A 5F POP EDI

0017339B 5E POP ESI

0017339C 5D POP EBP

0017339D C3 RETN



001733A3 75 05 JNE SHORT 001733AA

001733A5 66:8906 MOV WORD PTR DS:[ESI],AX

001733A8 ^ EB DF JMP SHORT 00173389

001733AA 8BD6 MOV EDX,ESI

001733AC 2BD0 SUB EDX,EAX

001733AE 0FB708 MOVZX ECX,WORD PTR DS:[EAX]

001733B1 66:890C02 MOV WORD PTR DS:[EAX+EDX],CX

001733B5 83C0 02 ADD EAX,2

001733B8 66:85C9 TEST CX,CX

001733BB 74 03 JE SHORT 001733C0

001733BD 4F DEC EDI

001733BE ^ 75 EE JNE SHORT 001733AE

001733C0 33C0 XOR EAX,EAX


001733C4 ^ 75 D4 JNE SHORT 0017339A

001733C6 66:8906 MOV WORD PTR DS:[ESI],AX

001733C9 E8 91F9FFFF CALL 00172D5F

001733CE 6A 22 PUSH 22

001733D0 59 POP ECX

001733D1 8908 MOV DWORD PTR DS:[EAX],ECX

001733D3 8BF1 MOV ESI,ECX

001733D5 ^ EB BC JMP SHORT 00173393




001733DA 8BEC MOV EBP,ESP

001733DC 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]

001733DF 85C9 TEST ECX,ECX

001733E1 78 1E JS SHORT 00173401

001733E3 83F9 02 CMP ECX,2

001733E6 7E 0C JLE SHORT 001733F4

001733E8 83F9 03 CMP ECX,3

001733EB 75 14 JNE SHORT 00173401

001733ED A1 488B1700 MOV EAX,DWORD PTR DS:[178B48]

001733F2 5D POP EBP

001733F3 C3 RETN

001733F4 A1 488B1700 MOV EAX,DWORD PTR DS:[178B48]

001733F9 890D 488B1700 MOV DWORD PTR DS:[178B48],ECX

001733FF 5D POP EBP

00173400 C3 RETN

00173401 E8 59F9FFFF CALL 00172D5F

00173406 C700 16000000 MOV DWORD PTR DS:[EAX],16

0017340C E8 C5F8FFFF CALL 00172CD6


00173414 5D POP EBP

00173415 C3 RETN


00173418 55 PUSH EBP


0017341B 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]


0017341F 8BF1 MOV ESI,ECX

00173421 C646 0C 00 MOV BYTE PTR DS:[ESI+0C],0


00173427 75 63 JNE SHORT 0017348C

00173429 E8 87EDFFFF CALL 001721B5

0017342E 8946 08 MOV DWORD PTR DS:[ESI+8],EAX

00173431 8B48 6C MOV ECX,DWORD PTR DS:[EAX+6C]

00173434 890E MOV DWORD PTR DS:[ESI],ECX


00173439 894E 04 MOV DWORD PTR DS:[ESI+4],ECX

0017343C 8B0E MOV ECX,DWORD PTR DS:[ESI]

0017343E 3B0D 888A1700 CMP ECX,DWORD PTR DS:[178A88]

00173444 74 12 JE SHORT 00173458

00173446 8B0D A08A1700 MOV ECX,DWORD PTR DS:[178AA0]

0017344C 8548 70 TEST DWORD PTR DS:[EAX+70],ECX

0017344F 75 07 JNE SHORT 00173458


00173451 E8 CE0B0000 CALL 00174024

00173456 8906 MOV DWORD PTR DS:[ESI],EAX


0017345B 3B05 48871700 CMP EAX,DWORD PTR DS:[178748]

00173461 74 16 JE SHORT 00173479


00173466 8B0D A08A1700 MOV ECX,DWORD PTR DS:[178AA0]

0017346C 8548 70 TEST DWORD PTR DS:[EAX+70],ECX

0017346F 75 08 JNE SHORT 00173479

00173471 E8 B5020000 CALL 0017372B

00173476 8946 04 MOV DWORD PTR DS:[ESI+4],EAX


0017347C F640 70 02 TEST BYTE PTR DS:[EAX+70],02

00173480 75 14 JNE SHORT 00173496

00173482 8348 70 02 OR DWORD PTR DS:[EAX+70],00000002

00173486 C646 0C 01 MOV BYTE PTR DS:[ESI+0C],1

0017348A EB 0A JMP SHORT 00173496

0017348C 8B08 MOV ECX,DWORD PTR DS:[EAX]

0017348E 890E MOV DWORD PTR DS:[ESI],ECX

00173490 8B40 04 MOV EAX,DWORD PTR DS:[EAX+4]

00173493 8946 04 MOV DWORD PTR DS:[ESI+4],EAX


00173498 5E POP ESI

00173499 5D POP EBP

0017349A C2 0400 RETN 4




001734A2 83EC 10 SUB ESP,10

001734A5 FF75 08 PUSH DWORD PTR SS:[EBP+8]

001734A8 8D4D F0 LEA ECX,[EBP-10]

001734AB E8 66FFFFFF CALL 00173416

001734B0 0FB645 0C MOVZX EAX,BYTE PTR SS:[EBP+0C]

001734B4 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-0C]

001734B7 8A55 14 MOV DL,BYTE PTR SS:[EBP+14]

001734BA 845401 1D TEST BYTE PTR DS:[EAX+ECX+1D],DL

001734BE 75 1E JNE SHORT 001734DE

001734C0 837D 10 00 CMP DWORD PTR SS:[EBP+10],0

001734C4 74 12 JE SHORT 001734D8

001734C6 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10]

001734C9 8B89 C8000000 MOV ECX,DWORD PTR DS:[ECX+0C8]

001734CF 0FB70441 MOVZX EAX,WORD PTR DS:[EAX*2+ECX]


001734D3 2345 10 AND EAX,DWORD PTR SS:[EBP+10]

001734D6 EB 02 JMP SHORT 001734DA


001734DA 85C0 TEST EAX,EAX

001734DC 74 03 JE SHORT 001734E1

001734DE 33C0 XOR EAX,EAX

001734E0 40 INC EAX

001734E1 807D FC 00 CMP BYTE PTR SS:[EBP-4],0

001734E5 74 07 JE SHORT 001734EE

001734E7 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]

001734EA 8361 70 FD AND DWORD PTR DS:[ECX+70],FFFFFFFD

001734EE C9 LEAVE

001734EF C3 RETN




001734F5 6A 04 PUSH 4

001734F7 6A 00 PUSH 0

001734F9 FF75 08 PUSH DWORD PTR SS:[EBP+8]

001734FC 6A 00 PUSH 0

001734FE E8 9AFFFFFF CALL 0017349D

00173503 83C4 10 ADD ESP,10

00173506 5D POP EBP

00173507 C3 RETN

00173508 2D A4030000 SUB EAX,3A4

0017350D 74 22 JE SHORT 00173531

0017350F 83E8 04 SUB EAX,4

00173512 74 17 JE SHORT 0017352B

00173514 83E8 0D SUB EAX,0D

00173517 74 0C JE SHORT 00173525

00173519 48 DEC EAX

0017351A 74 03 JE SHORT 0017351F

0017351C 33C0 XOR EAX,EAX

0017351E C3 RETN

0017351F B8 04040000 MOV EAX,404

00173524 C3 RETN

00173525 B8 12040000 MOV EAX,412

0017352A C3 RETN

0017352B B8 04080000 MOV EAX,804

00173530 C3 RETN

00173531 B8 11040000 MOV EAX,411

00173536 C3 RETN



00173539 56 PUSH ESI

0017353A 57 PUSH EDI

0017353B 8BF0 MOV ESI,EAX

0017353D 68 01010000 PUSH 101


00173544 8D46 1C LEA EAX,[ESI+1C]

00173547 57 PUSH EDI

00173548 50 PUSH EAX

00173549 E8 72100000 CALL 001745C0


00173550 0FB7C8 MOVZX ECX,AX

00173553 8BC1 MOV EAX,ECX



0017355B 897E 0C MOV DWORD PTR DS:[ESI+0C],EDI

0017355E C1E1 10 SHL ECX,10

00173561 0BC1 OR EAX,ECX

00173563 8D7E 10 LEA EDI,[ESI+10]

00173566 AB STOS DWORD PTR ES:[EDI]



00173569 B9 20831700 MOV ECX,OFFSET 00178320

0017356E 83C4 0C ADD ESP,0C

00173571 8D46 1C LEA EAX,[ESI+1C]

00173574 2BCE SUB ECX,ESI

00173576 BF 01010000 MOV EDI,101

0017357B 8A1401 MOV DL,BYTE PTR DS:[EAX+ECX]

0017357E 8810 MOV BYTE PTR DS:[EAX],DL

00173580 40 INC EAX

00173581 4F DEC EDI

00173582 ^ 75 F7 JNE SHORT 0017357B

00173584 8D86 1D010000 LEA EAX,[ESI+11D]

0017358A BE 00010000 MOV ESI,100

0017358F 8A1408 MOV DL,BYTE PTR DS:[ECX+EAX]

00173592 8810 MOV BYTE PTR DS:[EAX],DL

00173594 40 INC EAX

00173595 4E DEC ESI

00173596 ^ 75 F7 JNE SHORT 0017358F

00173598 5F POP EDI

00173599 5E POP ESI

0017359A C3 RETN





001735A0 81EC 1C050000 SUB ESP,51C


001735AB 33C5 XOR EAX,EBP

001735AD 8945 FC MOV DWORD PTR SS:[EBP-4],EAX



001735B2 8D85 E8FAFFFF LEA EAX,[EBP-518]


001735B9 FF76 04 PUSH DWORD PTR DS:[ESI+4]

001735BC FF15 9C601700 CALL DWORD PTR DS:[17609C]

001735C2 BF 00010000 MOV EDI,100


001735C9 0F84 FC000000 JE 001736CB

001735CF 33C0 XOR EAX,EAX

001735D1 888405 FCFEFFFF MOV BYTE PTR SS:[EAX+EBP-104],AL

001735D8 40 INC EAX

001735D9 3BC7 CMP EAX,EDI

001735DB ^ 72 F4 JB SHORT 001735D1

001735DD 8A85 EEFAFFFF MOV AL,BYTE PTR SS:[EBP-512]

001735E3 C685 FCFEFFFF 2 MOV BYTE PTR SS:[EBP-104],20

001735EA 84C0 TEST AL,AL

001735EC 74 30 JE SHORT 0017361E

001735EE 8D9D EFFAFFFF LEA EBX,[EBP-511]

001735F4 0FB6C8 MOVZX ECX,AL

001735F7 0FB603 MOVZX EAX,BYTE PTR DS:[EBX]

001735FA 3BC8 CMP ECX,EAX

001735FC 77 16 JA SHORT 00173614

001735FE 2BC1 SUB EAX,ECX

00173600 40 INC EAX

00173601 50 PUSH EAX

00173602 8D940D FCFEFFFF LEA EDX,[ECX+EBP-104]

00173609 6A 20 PUSH 20

0017360B 52 PUSH EDX

0017360C E8 AF0F0000 CALL 001745C0

00173611 83C4 0C ADD ESP,0C

00173614 8A43 01 MOV AL,BYTE PTR DS:[EBX+1]

00173617 83C3 02 ADD EBX,2

0017361A 84C0 TEST AL,AL

0017361C ^ 75 D6 JNE SHORT 001735F4


0017361E 6A 00 PUSH 0


00173623 8D85 FCFAFFFF LEA EAX,[EBP-504]

00173629 FF76 04 PUSH DWORD PTR DS:[ESI+4]



0017362E 8D85 FCFEFFFF LEA EAX,[EBP-104]

00173634 50 PUSH EAX

00173635 6A 01 PUSH 1

00173637 6A 00 PUSH 0

00173639 E8 4C130000 CALL 0017498A

0017363E 33DB XOR EBX,EBX

00173640 53 PUSH EBX


00173644 8D85 FCFDFFFF LEA EAX,[EBP-204]




0017364D 8D85 FCFEFFFF LEA EAX,[EBP-104]

00173653 50 PUSH EAX

00173654 57 PUSH EDI


00173658 53 PUSH EBX

00173659 E8 FF110000 CALL 0017485D

0017365E 83C4 44 ADD ESP,44

00173661 53 PUSH EBX


00173665 8D85 FCFCFFFF LEA EAX,[EBP-304]




0017366E 8D85 FCFEFFFF LEA EAX,[EBP-104]

00173674 50 PUSH EAX

00173675 68 00020000 PUSH 200

0017367A FF76 0C PUSH DWORD PTR DS:[ESI+0C]


0017367E E8 DA110000 CALL 0017485D

00173683 83C4 24 ADD ESP,24


00173688 0FB78C45 FCFAFF MOVZX ECX,WORD PTR SS:[EAX*2+EBP-504]

00173690 F6C1 01 TEST CL,01

00173693 74 0E JE SHORT 001736A3


00173695 804C06 1D 10 OR BYTE PTR DS:[EAX+ESI+1D],10

0017369A 8A8C05 FCFDFFFF MOV CL,BYTE PTR SS:[EAX+EBP-204]

001736A1 EB 11 JMP SHORT 001736B4

001736A3 F6C1 02 TEST CL,02

001736A6 74 15 JE SHORT 001736BD

001736A8 804C06 1D 20 OR BYTE PTR DS:[EAX+ESI+1D],20

001736AD 8A8C05 FCFCFFFF MOV CL,BYTE PTR SS:[EAX+EBP-304]

001736B4 888C06 1D010000 MOV BYTE PTR DS:[EAX+ESI+11D],CL

001736BB EB 07 JMP SHORT 001736C4

001736BD 889C06 1D010000 MOV BYTE PTR DS:[EAX+ESI+11D],BL

001736C4 40 INC EAX

001736C5 3BC7 CMP EAX,EDI

001736C7 ^ 72 BF JB SHORT 00173688

001736C9 EB 52 JMP SHORT 0017371D

001736CB 8D86 1D010000 LEA EAX,[ESI+11D]

001736D1 C785 E4FAFFFF 9 MOV DWORD PTR SS:[EBP-51C],-61

001736DB 33C9 XOR ECX,ECX

001736DD 2985 E4FAFFFF SUB DWORD PTR SS:[EBP-51C],EAX

001736E3 8B95 E4FAFFFF MOV EDX,DWORD PTR SS:[EBP-51C]

001736E9 8D840E 1D010000 LEA EAX,[ECX+ESI+11D]

001736F0 03D0 ADD EDX,EAX

001736F2 8D5A 20 LEA EBX,[EDX+20]

001736F5 83FB 19 CMP EBX,19

001736F8 77 0A JA SHORT 00173704

001736FA 804C0E 1D 10 OR BYTE PTR DS:[ECX+ESI+1D],10

001736FF 8D51 20 LEA EDX,[ECX+20]

00173702 EB 0D JMP SHORT 00173711

00173704 83FA 19 CMP EDX,19

00173707 77 0C JA SHORT 00173715

00173709 804C0E 1D 20 OR BYTE PTR DS:[ECX+ESI+1D],20

0017370E 8D51 E0 LEA EDX,[ECX-20]

00173711 8810 MOV BYTE PTR DS:[EAX],DL

00173713 EB 03 JMP SHORT 00173718

00173715 C600 00 MOV BYTE PTR DS:[EAX],0

00173718 41 INC ECX

00173719 3BCF CMP ECX,EDI

0017371B ^ 72 C6 JB SHORT 001736E3

0017371D 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]

00173720 5F POP EDI

00173721 33CD XOR ECX,EBP

00173723 5B POP EBX

00173724 E8 DCD8FFFF CALL 00171005


00173729 C9 LEAVE

0017372A C3 RETN

0017372B 6A 0C PUSH 0C

0017372D 68 207A1700 PUSH OFFSET 00177A20

00173732 E8 69EDFFFF CALL 001724A0

00173737 E8 79EAFFFF CALL 001721B5


0017373E A1 A08A1700 MOV EAX,DWORD PTR DS:[178AA0]

00173743 8547 70 TEST DWORD PTR DS:[EDI+70],EAX

00173746 74 1D JE SHORT 00173765

00173748 837F 6C 00 CMP DWORD PTR DS:[EDI+6C],0

0017374C 74 17 JE SHORT 00173765

0017374E 8B77 68 MOV ESI,DWORD PTR DS:[EDI+68]


00173753 75 08 JNE SHORT 0017375D

00173755 6A 20 PUSH 20

00173757 E8 7BDEFFFF CALL 001715D7

0017375C 59 POP ECX

0017375D 8BC6 MOV EAX,ESI

0017375F E8 81EDFFFF CALL 001724E5

00173764 C3 RETN

00173765 6A 0D PUSH 0D

00173767 E8 8AF1FFFF CALL 001728F6

0017376C 59 POP ECX

0017376D 8365 FC 00 AND DWORD PTR SS:[EBP-4],00000000

00173771 8B77 68 MOV ESI,DWORD PTR DS:[EDI+68]


00173777 3B35 48871700 CMP ESI,DWORD PTR DS:[178748]

0017377D 74 36 JE SHORT 001737B5

0017377F 85F6 TEST ESI,ESI

00173781 74 1A JE SHORT 0017379D

00173783 56 PUSH ESI



0017378C 75 0F JNE SHORT 0017379D

0017378E 81FE 20831700 CMP ESI,OFFSET 00178320

00173794 74 07 JE SHORT 0017379D

00173796 56 PUSH ESI

00173797 E8 50040000 CALL 00173BEC

0017379C 59 POP ECX

0017379D A1 48871700 MOV EAX,DWORD PTR DS:[178748]

001737A2 8947 68 MOV DWORD PTR DS:[EDI+68],EAX


001737A5 8B35 48871700 MOV ESI,DWORD PTR DS:[178748]

001737AB 8975 E4 MOV DWORD PTR SS:[EBP-1C],ESI

001737AE 56 PUSH ESI

001737AF FF15 68601700 CALL DWORD PTR DS:[176068]

001737B5 C745 FC FEFFFFF MOV DWORD PTR SS:[EBP-4],-2

001737BC E8 05000000 CALL 001737C6

001737C1 ^ EB 8E JMP SHORT 00173751

001737C3 8B75 E4 MOV ESI,DWORD PTR SS:[EBP-1C]

001737C6 6A 0D PUSH 0D

001737C8 E8 50F0FFFF CALL 0017281D

001737CD 59 POP ECX

001737CE C3 RETN

001737CF 8BFF MOV EDI,EDI



001737D4 83EC 10 SUB ESP,10


001737D8 33DB XOR EBX,EBX

001737DA 53 PUSH EBX

001737DB 8D4D F0 LEA ECX,[EBP-10]

001737DE E8 33FCFFFF CALL 00173416

001737E3 891D 78971700 MOV DWORD PTR DS:[179778],EBX

001737E9 83FE FE CMP ESI,-2

001737EC 75 1E JNE SHORT 0017380C

001737EE C705 78971700 0 MOV DWORD PTR DS:[179778],1

001737F8 FF15 A4601700 CALL DWORD PTR DS:[1760A4]

001737FE 385D FC CMP BYTE PTR SS:[EBP-4],BL

00173801 74 45 JE SHORT 00173848

00173803 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]

00173806 8361 70 FD AND DWORD PTR DS:[ECX+70],FFFFFFFD

0017380A EB 3C JMP SHORT 00173848

0017380C 83FE FD CMP ESI,-3

0017380F 75 12 JNE SHORT 00173823

00173811 C705 78971700 0 MOV DWORD PTR DS:[179778],1

0017381B FF15 A0601700 CALL DWORD PTR DS:[1760A0]

00173821 ^ EB DB JMP SHORT 001737FE

00173823 83FE FC CMP ESI,-4

00173826 75 12 JNE SHORT 0017383A


0017382B 8B40 04 MOV EAX,DWORD PTR DS:[EAX+4]

0017382E C705 78971700 0 MOV DWORD PTR DS:[179778],1

00173838 ^ EB C4 JMP SHORT 001737FE


0017383A 385D FC CMP BYTE PTR SS:[EBP-4],BL

0017383D 74 07 JE SHORT 00173846

0017383F 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]

00173842 8360 70 FD AND DWORD PTR DS:[EAX+70],FFFFFFFD


00173848 5B POP EBX

00173849 C9 LEAVE

0017384A C3 RETN




00173850 83EC 20 SUB ESP,20


00173858 33C5 XOR EAX,EBP

0017385A 8945 FC MOV DWORD PTR SS:[EBP-4],EAX


0017385E 8B5D 0C MOV EBX,DWORD PTR SS:[EBP+0C]

00173861 56 PUSH ESI


00173865 57 PUSH EDI

00173866 E8 64FFFFFF CALL 001737CF

0017386B 8BF8 MOV EDI,EAX

0017386D 33F6 XOR ESI,ESI

0017386F 897D 08 MOV DWORD PTR SS:[EBP+8],EDI

00173872 3BFE CMP EDI,ESI

00173874 75 0E JNE SHORT 00173884

00173876 8BC3 MOV EAX,EBX

00173878 E8 BAFCFFFF CALL 00173537


0017387F E9 A1010000 JMP 00173A25



00173889 39B8 50871700 CMP DWORD PTR DS:[EAX+178750],EDI

0017388F 0F84 91000000 JE 00173926

00173895 FF45 E4 INC DWORD PTR SS:[EBP-1C]

00173898 83C0 30 ADD EAX,30

0017389B 3D F0000000 CMP EAX,0F0

001738A0 ^ 72 E7 JB SHORT 00173889

001738A2 81FF E8FD0000 CMP EDI,0FDE8

001738A8 0F84 74010000 JE 00173A22

001738AE 81FF E9FD0000 CMP EDI,0FDE9

001738B4 0F84 68010000 JE 00173A22


001738BA 0FB7C7 MOVZX EAX,DI

001738BD 50 PUSH EAX

001738BE FF15 A8601700 CALL DWORD PTR DS:[1760A8]


001738C6 0F84 56010000 JE 00173A22

001738CC 8D45 E8 LEA EAX,[EBP-18]

001738CF 50 PUSH EAX


001738D1 FF15 9C601700 CALL DWORD PTR DS:[17609C]


001738D9 0F84 37010000 JE 00173A16

001738DF 68 01010000 PUSH 101

001738E4 8D43 1C LEA EAX,[EBX+1C]


001738E8 50 PUSH EAX

001738E9 E8 D20C0000 CALL 001745C0

001738EE 33D2 XOR EDX,EDX

001738F0 42 INC EDX

001738F1 83C4 0C ADD ESP,0C

001738F4 897B 04 MOV DWORD PTR DS:[EBX+4],EDI

001738F7 8973 0C MOV DWORD PTR DS:[EBX+0C],ESI

001738FA 3955 E8 CMP DWORD PTR SS:[EBP-18],EDX

001738FD 0F86 FC000000 JBE 001739FF

00173903 807D EE 00 CMP BYTE PTR SS:[EBP-12],0

00173907 0F84 D3000000 JE 001739E0

0017390D 8D75 EF LEA ESI,[EBP-11]

00173910 8A0E MOV CL,BYTE PTR DS:[ESI]

00173912 84C9 TEST CL,CL

00173914 0F84 C6000000 JE 001739E0

0017391A 0FB646 FF MOVZX EAX,BYTE PTR DS:[ESI-1]

0017391E 0FB6C9 MOVZX ECX,CL

00173921 E9 A9000000 JMP 001739CF

00173926 68 01010000 PUSH 101

0017392B 8D43 1C LEA EAX,[EBX+1C]



00173930 E8 8B0C0000 CALL 001745C0

00173935 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C]

00173938 83C4 0C ADD ESP,0C

0017393B 6BC9 30 IMUL ECX,ECX,30

0017393E 8975 E0 MOV DWORD PTR SS:[EBP-20],ESI

00173941 8DB1 60871700 LEA ESI,[ECX+178760]



0017394A EB 2B JMP SHORT 00173977

0017394C 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]

0017394F 84C0 TEST AL,AL

00173951 74 29 JE SHORT 0017397C

00173953 0FB63E MOVZX EDI,BYTE PTR DS:[ESI]

00173956 0FB6C0 MOVZX EAX,AL

00173959 EB 12 JMP SHORT 0017396D

0017395B 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]

0017395E 8A80 4C871700 MOV AL,BYTE PTR DS:[EAX+17874C]

00173964 08443B 1D OR BYTE PTR DS:[EDI+EBX+1D],AL

00173968 0FB646 01 MOVZX EAX,BYTE PTR DS:[ESI+1]

0017396C 47 INC EDI

0017396D 3BF8 CMP EDI,EAX

0017396F ^ 76 EA JBE SHORT 0017395B

00173971 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]

00173974 83C6 02 ADD ESI,2

00173977 803E 00 CMP BYTE PTR DS:[ESI],0

0017397A ^ 75 D0 JNE SHORT 0017394C

0017397C 8B75 E4 MOV ESI,DWORD PTR SS:[EBP-1C]

0017397F FF45 E0 INC DWORD PTR SS:[EBP-20]

00173982 83C6 08 ADD ESI,8

00173985 837D E0 04 CMP DWORD PTR SS:[EBP-20],4


0017398C ^ 72 E9 JB SHORT 00173977

0017398E 8BC7 MOV EAX,EDI

00173990 897B 04 MOV DWORD PTR DS:[EBX+4],EDI

00173993 C743 08 0100000 MOV DWORD PTR DS:[EBX+8],1

0017399A E8 69FBFFFF CALL 00173508

0017399F 6A 06 PUSH 6

001739A1 8943 0C MOV DWORD PTR DS:[EBX+0C],EAX

001739A4 8D43 10 LEA EAX,[EBX+10]

001739A7 8D89 54871700 LEA ECX,[ECX+178754]

001739AD 5A POP EDX

001739AE 66:8B31 MOV SI,WORD PTR DS:[ECX]

001739B1 66:8930 MOV WORD PTR DS:[EAX],SI

001739B4 83C1 02 ADD ECX,2

001739B7 83C0 02 ADD EAX,2

001739BA 4A DEC EDX

001739BB ^ 75 F1 JNE SHORT 001739AE

001739BD 8BF3 MOV ESI,EBX

001739BF E8 D7FBFFFF CALL 0017359B


001739C4 ^ E9 B4FEFFFF JMP 0017387D

001739C9 804C03 1D 04 OR BYTE PTR DS:[EAX+EBX+1D],04

001739CE 40 INC EAX

001739CF 3BC1 CMP EAX,ECX

001739D1 ^ 76 F6 JBE SHORT 001739C9

001739D3 83C6 02 ADD ESI,2

001739D6 807E FF 00 CMP BYTE PTR DS:[ESI-1],0

001739DA ^ 0F85 30FFFFFF JNE 00173910

001739E0 8D43 1E LEA EAX,[EBX+1E]

001739E3 B9 FE000000 MOV ECX,0FE

001739E8 8008 08 OR BYTE PTR DS:[EAX],08

001739EB 40 INC EAX

001739EC 49 DEC ECX

001739ED ^ 75 F9 JNE SHORT 001739E8

001739EF 8B43 04 MOV EAX,DWORD PTR DS:[EBX+4]

001739F2 E8 11FBFFFF CALL 00173508

001739F7 8943 0C MOV DWORD PTR DS:[EBX+0C],EAX

001739FA 8953 08 MOV DWORD PTR DS:[EBX+8],EDX

001739FD EB 03 JMP SHORT 00173A02

001739FF 8973 08 MOV DWORD PTR DS:[EBX+8],ESI


00173A04 0FB7C8 MOVZX ECX,AX

00173A07 8BC1 MOV EAX,ECX

00173A09 C1E1 10 SHL ECX,10

00173A0C 0BC1 OR EAX,ECX

00173A0E 8D7B 10 LEA EDI,[EBX+10]

00173A11 AB STOS DWORD PTR ES:[EDI]



00173A14 ^ EB A7 JMP SHORT 001739BD

00173A16 3935 78971700 CMP DWORD PTR DS:[179778],ESI

00173A1C ^ 0F85 54FEFFFF JNE 00173876

00173A22 83C8 FF OR EAX,FFFFFFFF

00173A25 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]

00173A28 5F POP EDI

00173A29 5E POP ESI

00173A2A 33CD XOR ECX,EBP

00173A2C 5B POP EBX

00173A2D E8 D3D5FFFF CALL 00171005

00173A32 C9 LEAVE

00173A33 C3 RETN

00173A34 6A 14 PUSH 14


00173A36 68 407A1700 PUSH OFFSET 00177A40

00173A3B E8 60EAFFFF CALL 001724A0

00173A40 834D E0 FF OR DWORD PTR SS:[EBP-20],FFFFFFFF

00173A44 E8 6CE7FFFF CALL 001721B5

00173A49 8BF8 MOV EDI,EAX

00173A4B 897D DC MOV DWORD PTR SS:[EBP-24],EDI

00173A4E E8 D8FCFFFF CALL 0017372B

00173A53 8B5F 68 MOV EBX,DWORD PTR DS:[EDI+68]

00173A56 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]

00173A59 E8 71FDFFFF CALL 001737CF

00173A5E 8945 08 MOV DWORD PTR SS:[EBP+8],EAX

00173A61 3B43 04 CMP EAX,DWORD PTR DS:[EBX+4]

00173A64 0F84 57010000 JE 00173BC1

00173A6A 68 20020000 PUSH 220

00173A6F E8 11020000 CALL 00173C85

00173A74 59 POP ECX

00173A75 8BD8 MOV EBX,EAX

00173A77 85DB TEST EBX,EBX

00173A79 0F84 46010000 JE 00173BC5

00173A7F B9 88000000 MOV ECX,88

00173A84 8B77 68 MOV ESI,DWORD PTR DS:[EDI+68]

00173A87 8BFB MOV EDI,EBX

00173A89 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS

00173A8B 8323 00 AND DWORD PTR DS:[EBX],00000000

00173A8E 53 PUSH EBX

00173A8F FF75 08 PUSH DWORD PTR SS:[EBP+8]

00173A92 E8 B4FDFFFF CALL 0017384B

00173A97 59 POP ECX

00173A98 59 POP ECX

00173A99 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX

00173A9C 85C0 TEST EAX,EAX

00173A9E 0F85 FC000000 JNE 00173BA0

00173AA4 8B75 DC MOV ESI,DWORD PTR SS:[EBP-24]

00173AA7 FF76 68 PUSH DWORD PTR DS:[ESI+68]

00173AAA FF15 78601700 CALL DWORD PTR DS:[176078]

00173AB0 85C0 TEST EAX,EAX

00173AB2 75 11 JNE SHORT 00173AC5

00173AB4 8B46 68 MOV EAX,DWORD PTR DS:[ESI+68]

00173AB7 3D 20831700 CMP EAX,OFFSET 00178320

00173ABC 74 07 JE SHORT 00173AC5

00173ABE 50 PUSH EAX

00173ABF E8 28010000 CALL 00173BEC


00173AC4 59 POP ECX

00173AC5 895E 68 MOV DWORD PTR DS:[ESI+68],EBX

00173AC8 53 PUSH EBX

00173AC9 8B3D 68601700 MOV EDI,DWORD PTR DS:[176068]

00173ACF FFD7 CALL EDI

00173AD1 F646 70 02 TEST BYTE PTR DS:[ESI+70],02

00173AD5 0F85 EA000000 JNE 00173BC5

00173ADB F605 A08A1700 0 TEST BYTE PTR DS:[178AA0],01

00173AE2 0F85 DD000000 JNE 00173BC5

00173AE8 6A 0D PUSH 0D

00173AEA E8 07EEFFFF CALL 001728F6

00173AEF 59 POP ECX

00173AF0 8365 FC 00 AND DWORD PTR SS:[EBP-4],00000000

00173AF4 8B43 04 MOV EAX,DWORD PTR DS:[EBX+4]

00173AF7 A3 88971700 MOV DWORD PTR DS:[179788],EAX

00173AFC 8B43 08 MOV EAX,DWORD PTR DS:[EBX+8]

00173AFF A3 8C971700 MOV DWORD PTR DS:[17978C],EAX

00173B04 8B43 0C MOV EAX,DWORD PTR DS:[EBX+0C]


00173B0C 33C0 XOR EAX,EAX

00173B0E 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX

00173B11 83F8 05 CMP EAX,5

00173B14 7D 10 JGE SHORT 00173B26

00173B16 66:8B4C43 10 MOV CX,WORD PTR DS:[EAX*2+EBX+10]

00173B1B 66:890C45 7C971 MOV WORD PTR DS:[EAX*2+17977C],CX

00173B23 40 INC EAX

00173B24 ^ EB E8 JMP SHORT 00173B0E


00173B28 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX

00173B2B 3D 01010000 CMP EAX,101

00173B30 7D 0D JGE SHORT 00173B3F

00173B32 8A4C18 1C MOV CL,BYTE PTR DS:[EBX+EAX+1C]

00173B36 8888 40851700 MOV BYTE PTR DS:[EAX+178540],CL

00173B3C 40 INC EAX

00173B3D ^ EB E9 JMP SHORT 00173B28

00173B3F 33C0 XOR EAX,EAX

00173B41 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX

00173B44 3D 00010000 CMP EAX,100

00173B49 7D 10 JGE SHORT 00173B5B

00173B4B 8A8C18 1D010000 MOV CL,BYTE PTR DS:[EBX+EAX+11D]

00173B52 8888 48861700 MOV BYTE PTR DS:[EAX+178648],CL

00173B58 40 INC EAX


00173B59 ^ EB E6 JMP SHORT 00173B41

00173B5B FF35 48871700 PUSH DWORD PTR DS:[178748]



00173B69 75 13 JNE SHORT 00173B7E

00173B6B A1 48871700 MOV EAX,DWORD PTR DS:[178748]

00173B70 3D 20831700 CMP EAX,OFFSET 00178320

00173B75 74 07 JE SHORT 00173B7E


00173B78 E8 6F000000 CALL 00173BEC

00173B7D 59 POP ECX

00173B7E 891D 48871700 MOV DWORD PTR DS:[178748],EBX


00173B85 FFD7 CALL EDI

00173B87 C745 FC FEFFFFF MOV DWORD PTR SS:[EBP-4],-2

00173B8E E8 02000000 CALL 00173B95

00173B93 EB 30 JMP SHORT 00173BC5

00173B95 6A 0D PUSH 0D

00173B97 E8 81ECFFFF CALL 0017281D

00173B9C 59 POP ECX

00173B9D C3 RETN

00173B9E EB 25 JMP SHORT 00173BC5

00173BA0 83F8 FF CMP EAX,-1

00173BA3 75 20 JNE SHORT 00173BC5

00173BA5 81FB 20831700 CMP EBX,OFFSET 00178320

00173BAB 74 07 JE SHORT 00173BB4

00173BAD 53 PUSH EBX

00173BAE E8 39000000 CALL 00173BEC

00173BB3 59 POP ECX

00173BB4 E8 A6F1FFFF CALL 00172D5F

00173BB9 C700 16000000 MOV DWORD PTR DS:[EAX],16

00173BBF EB 04 JMP SHORT 00173BC5

00173BC1 8365 E0 00 AND DWORD PTR SS:[EBP-20],00000000

00173BC5 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]

00173BC8 E8 18E9FFFF CALL 001724E5

00173BCD C3 RETN

00173BCE 833D CC981700 0 CMP DWORD PTR DS:[1798CC],0

00173BD5 75 12 JNE SHORT 00173BE9

00173BD7 6A FD PUSH -3

00173BD9 E8 56FEFFFF CALL 00173A34

00173BDE 59 POP ECX

00173BDF C705 CC981700 0 MOV DWORD PTR DS:[1798CC],1


00173BE9 33C0 XOR EAX,EAX

00173BEB C3 RETN

00173BEC 8BFF MOV EDI,EDI

00173BEE 55 PUSH EBP

00173BEF 8BEC MOV EBP,ESP

00173BF1 837D 08 00 CMP DWORD PTR SS:[EBP+8],0

00173BF5 74 2D JE SHORT 00173C24

00173BF7 FF75 08 PUSH DWORD PTR SS:[EBP+8]

00173BFA 6A 00 PUSH 0

00173BFC FF35 E8951700 PUSH DWORD PTR DS:[1795E8]

00173C02 FF15 AC601700 CALL DWORD PTR DS:[1760AC]


00173C0A 75 18 JNE SHORT 00173C24

00173C0C 56 PUSH ESI

00173C0D E8 4DF1FFFF CALL 00172D5F

00173C12 8BF0 MOV ESI,EAX

00173C14 FF15 74601700 CALL DWORD PTR DS:[176074]

00173C1A 50 PUSH EAX

00173C1B E8 FDF0FFFF CALL 00172D1D

00173C20 59 POP ECX

00173C21 8906 MOV DWORD PTR DS:[ESI],EAX

00173C23 5E POP ESI

00173C24 5D POP EBP

00173C25 C3 RETN




00173C2B 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]

00173C2E 56 PUSH ESI

00173C2F 57 PUSH EDI

00173C30 85D2 TEST EDX,EDX

00173C32 74 07 JE SHORT 00173C3B

00173C34 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+0C]


00173C39 75 13 JNE SHORT 00173C4E

00173C3B E8 1FF1FFFF CALL 00172D5F

00173C40 6A 16 PUSH 16

00173C42 5E POP ESI

00173C43 8930 MOV DWORD PTR DS:[EAX],ESI

00173C45 E8 8CF0FFFF CALL 00172CD6

00173C4A 8BC6 MOV EAX,ESI

00173C4C EB 33 JMP SHORT 00173C81


00173C4E 8B45 10 MOV EAX,DWORD PTR SS:[EBP+10]


00173C53 75 04 JNE SHORT 00173C59

00173C55 8802 MOV BYTE PTR DS:[EDX],AL

00173C57 ^ EB E2 JMP SHORT 00173C3B

00173C59 8BF2 MOV ESI,EDX

00173C5B 2BF0 SUB ESI,EAX

00173C5D 8A08 MOV CL,BYTE PTR DS:[EAX]

00173C5F 880C06 MOV BYTE PTR DS:[EAX+ESI],CL

00173C62 40 INC EAX

00173C63 84C9 TEST CL,CL

00173C65 74 03 JE SHORT 00173C6A

00173C67 4F DEC EDI

00173C68 ^ 75 F3 JNE SHORT 00173C5D

00173C6A 85FF TEST EDI,EDI

00173C6C 75 11 JNE SHORT 00173C7F

00173C6E C602 00 MOV BYTE PTR DS:[EDX],0

00173C71 E8 E9F0FFFF CALL 00172D5F

00173C76 6A 22 PUSH 22

00173C78 59 POP ECX

00173C79 8908 MOV DWORD PTR DS:[EAX],ECX

00173C7B 8BF1 MOV ESI,ECX

00173C7D ^ EB C6 JMP SHORT 00173C45

00173C7F 33C0 XOR EAX,EAX

00173C81 5F POP EDI

00173C82 5E POP ESI

00173C83 5D POP EBP

00173C84 C3 RETN




00173C8A 56 PUSH ESI

00173C8B 57 PUSH EDI

00173C8C 33F6 XOR ESI,ESI

00173C8E FF75 08 PUSH DWORD PTR SS:[EBP+8]

00173C91 E8 340D0000 CALL 001749CA


00173C98 59 POP ECX


00173C9B 75 27 JNE SHORT 00173CC4

00173C9D 3905 94971700 CMP DWORD PTR DS:[179794],EAX

00173CA3 76 1F JBE SHORT 00173CC4


00173CA5 56 PUSH ESI

00173CA6 FF15 B0601700 CALL DWORD PTR DS:[1760B0]

00173CAC 8D86 E8030000 LEA EAX,[ESI+3E8]

00173CB2 3B05 94971700 CMP EAX,DWORD PTR DS:[179794]

00173CB8 76 03 JBE SHORT 00173CBD

00173CBA 83C8 FF OR EAX,FFFFFFFF

00173CBD 8BF0 MOV ESI,EAX

00173CBF 83F8 FF CMP EAX,-1

00173CC2 ^ 75 CA JNE SHORT 00173C8E

00173CC4 8BC7 MOV EAX,EDI

00173CC6 5F POP EDI

00173CC7 5E POP ESI

00173CC8 5D POP EBP

00173CC9 C3 RETN

00173CCA 8BFF MOV EDI,EDI

00173CCC 55 PUSH EBP

00173CCD 8BEC MOV EBP,ESP

00173CCF 56 PUSH ESI

00173CD0 57 PUSH EDI

00173CD1 33F6 XOR ESI,ESI

00173CD3 6A 00 PUSH 0

00173CD5 FF75 0C PUSH DWORD PTR SS:[EBP+0C]

00173CD8 FF75 08 PUSH DWORD PTR SS:[EBP+8]

00173CDB E8 7E0D0000 CALL 00174A5E

00173CE0 8BF8 MOV EDI,EAX

00173CE2 83C4 0C ADD ESP,0C

00173CE5 85FF TEST EDI,EDI

00173CE7 75 27 JNE SHORT 00173D10

00173CE9 3905 94971700 CMP DWORD PTR DS:[179794],EAX

00173CEF 76 1F JBE SHORT 00173D10

00173CF1 56 PUSH ESI

00173CF2 FF15 B0601700 CALL DWORD PTR DS:[1760B0]

00173CF8 8D86 E8030000 LEA EAX,[ESI+3E8]

00173CFE 3B05 94971700 CMP EAX,DWORD PTR DS:[179794]

00173D04 76 03 JBE SHORT 00173D09

00173D06 83C8 FF OR EAX,FFFFFFFF


00173D0B 83F8 FF CMP EAX,-1

00173D0E ^ 75 C3 JNE SHORT 00173CD3

00173D10 8BC7 MOV EAX,EDI

00173D12 5F POP EDI

00173D13 5E POP ESI


00173D14 5D POP EBP

00173D15 C3 RETN




00173D1B 56 PUSH ESI

00173D1C 57 PUSH EDI

00173D1D 33F6 XOR ESI,ESI

00173D1F FF75 0C PUSH DWORD PTR SS:[EBP+0C]


00173D25 E8 B60D0000 CALL 00174AE0

00173D2A 8BF8 MOV EDI,EAX

00173D2C 59 POP ECX

00173D2D 59 POP ECX

00173D2E 85FF TEST EDI,EDI

00173D30 75 2C JNE SHORT 00173D5E

00173D32 3945 0C CMP DWORD PTR SS:[EBP+0C],EAX

00173D35 74 27 JE SHORT 00173D5E

00173D37 3905 94971700 CMP DWORD PTR DS:[179794],EAX

00173D3D 76 1F JBE SHORT 00173D5E

00173D3F 56 PUSH ESI

00173D40 FF15 B0601700 CALL DWORD PTR DS:[1760B0]

00173D46 8D86 E8030000 LEA EAX,[ESI+3E8]

00173D4C 3B05 94971700 CMP EAX,DWORD PTR DS:[179794]

00173D52 76 03 JBE SHORT 00173D57

00173D54 83C8 FF OR EAX,FFFFFFFF


00173D59 83F8 FF CMP EAX,-1

00173D5C ^ 75 C1 JNE SHORT 00173D1F

00173D5E 8BC7 MOV EAX,EDI

00173D60 5F POP EDI

00173D61 5E POP ESI

00173D62 5D POP EBP

00173D63 C3 RETN





00173D6A 56 PUSH ESI

00173D6B 8B35 68601700 MOV ESI,DWORD PTR DS:[176068]


00173D72 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]




00173D78 8B87 B0000000 MOV EAX,DWORD PTR DS:[EDI+0B0]

00173D7E 85C0 TEST EAX,EAX

00173D80 74 03 JE SHORT 00173D85




00173D8B 85C0 TEST EAX,EAX

00173D8D 74 03 JE SHORT 00173D92

00173D8F 50 PUSH EAX




00173D9A 74 03 JE SHORT 00173D9F

00173D9C 50 PUSH EAX

00173D9D FFD6 CALL ESI

00173D9F 8B87 C0000000 MOV EAX,DWORD PTR DS:[EDI+0C0]

00173DA5 85C0 TEST EAX,EAX

00173DA7 74 03 JE SHORT 00173DAC

00173DA9 50 PUSH EAX

00173DAA FFD6 CALL ESI

00173DAC 8D5F 50 LEA EBX,[EDI+50]

00173DAF C745 08 0600000 MOV DWORD PTR SS:[EBP+8],6

00173DB6 817B F8 4088170 CMP DWORD PTR DS:[EBX-8],OFFSET 00178840

00173DBD 74 09 JE SHORT 00173DC8

00173DBF 8B03 MOV EAX,DWORD PTR DS:[EBX]

00173DC1 85C0 TEST EAX,EAX

00173DC3 74 03 JE SHORT 00173DC8

00173DC5 50 PUSH EAX

00173DC6 FFD6 CALL ESI

00173DC8 837B FC 00 CMP DWORD PTR DS:[EBX-4],0

00173DCC 74 0A JE SHORT 00173DD8

00173DCE 8B43 04 MOV EAX,DWORD PTR DS:[EBX+4]

00173DD1 85C0 TEST EAX,EAX

00173DD3 74 03 JE SHORT 00173DD8

00173DD5 50 PUSH EAX

00173DD6 FFD6 CALL ESI

00173DD8 83C3 10 ADD EBX,10

00173DDB FF4D 08 DEC DWORD PTR SS:[EBP+8]

00173DDE ^ 75 D6 JNE SHORT 00173DB6

00173DE0 8B87 D4000000 MOV EAX,DWORD PTR DS:[EDI+0D4]


00173DE6 05 B4000000 ADD EAX,0B4

00173DEB 50 PUSH EAX

00173DEC FFD6 CALL ESI

00173DEE 5F POP EDI

00173DEF 5E POP ESI

00173DF0 5B POP EBX

00173DF1 5D POP EBP

00173DF2 C3 RETN

00173DF3 8BFF MOV EDI,EDI

00173DF5 55 PUSH EBP

00173DF6 8BEC MOV EBP,ESP

00173DF8 57 PUSH EDI

00173DF9 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]

00173DFC 85FF TEST EDI,EDI

00173DFE 0F84 83000000 JE 00173E87

00173E04 53 PUSH EBX


00173E06 8B35 78601700 MOV ESI,DWORD PTR DS:[176078]

00173E0C 57 PUSH EDI

00173E0D FFD6 CALL ESI

00173E0F 8B87 B0000000 MOV EAX,DWORD PTR DS:[EDI+0B0]


00173E17 74 03 JE SHORT 00173E1C


00173E1A FFD6 CALL ESI

00173E1C 8B87 B8000000 MOV EAX,DWORD PTR DS:[EDI+0B8]


00173E24 74 03 JE SHORT 00173E29



00173E29 8B87 B4000000 MOV EAX,DWORD PTR DS:[EDI+0B4]

00173E2F 85C0 TEST EAX,EAX

00173E31 74 03 JE SHORT 00173E36



00173E36 8B87 C0000000 MOV EAX,DWORD PTR DS:[EDI+0C0]

00173E3C 85C0 TEST EAX,EAX

00173E3E 74 03 JE SHORT 00173E43



00173E43 8D5F 50 LEA EBX,[EDI+50]

00173E46 C745 08 0600000 MOV DWORD PTR SS:[EBP+8],6


00173E4D 817B F8 4088170 CMP DWORD PTR DS:[EBX-8],OFFSET 00178840

00173E54 74 09 JE SHORT 00173E5F

00173E56 8B03 MOV EAX,DWORD PTR DS:[EBX]


00173E5A 74 03 JE SHORT 00173E5F

00173E5C 50 PUSH EAX


00173E5F 837B FC 00 CMP DWORD PTR DS:[EBX-4],0

00173E63 74 0A JE SHORT 00173E6F

00173E65 8B43 04 MOV EAX,DWORD PTR DS:[EBX+4]


00173E6A 74 03 JE SHORT 00173E6F

00173E6C 50 PUSH EAX


00173E6F 83C3 10 ADD EBX,10

00173E72 FF4D 08 DEC DWORD PTR SS:[EBP+8]

00173E75 ^ 75 D6 JNE SHORT 00173E4D

00173E77 8B87 D4000000 MOV EAX,DWORD PTR DS:[EDI+0D4]

00173E7D 05 B4000000 ADD EAX,0B4



00173E85 5E POP ESI

00173E86 5B POP EBX

00173E87 8BC7 MOV EAX,EDI

00173E89 5F POP EDI

00173E8A 5D POP EBP

00173E8B C3 RETN

00173E8C 8BFF MOV EDI,EDI

00173E8E 55 PUSH EBP

00173E8F 8BEC MOV EBP,ESP

00173E91 53 PUSH EBX


00173E93 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]

00173E96 8B86 BC000000 MOV EAX,DWORD PTR DS:[ESI+0BC]

00173E9C 33DB XOR EBX,EBX

00173E9E 57 PUSH EDI

00173E9F 3BC3 CMP EAX,EBX

00173EA1 74 6F JE SHORT 00173F12

00173EA3 3D B08A1700 CMP EAX,OFFSET 00178AB0

00173EA8 74 68 JE SHORT 00173F12

00173EAA 8B86 B0000000 MOV EAX,DWORD PTR DS:[ESI+0B0]

00173EB0 3BC3 CMP EAX,EBX


00173EB2 74 5E JE SHORT 00173F12

00173EB4 3918 CMP DWORD PTR DS:[EAX],EBX

00173EB6 75 5A JNE SHORT 00173F12

00173EB8 8B86 B8000000 MOV EAX,DWORD PTR DS:[ESI+0B8]

00173EBE 3BC3 CMP EAX,EBX

00173EC0 74 17 JE SHORT 00173ED9

00173EC2 3918 CMP DWORD PTR DS:[EAX],EBX

00173EC4 75 13 JNE SHORT 00173ED9

00173EC6 50 PUSH EAX

00173EC7 E8 20FDFFFF CALL 00173BEC

00173ECC FFB6 BC000000 PUSH DWORD PTR DS:[ESI+0BC]

00173ED2 E8 96100000 CALL 00174F6D

00173ED7 59 POP ECX

00173ED8 59 POP ECX

00173ED9 8B86 B4000000 MOV EAX,DWORD PTR DS:[ESI+0B4]

00173EDF 3BC3 CMP EAX,EBX

00173EE1 74 17 JE SHORT 00173EFA

00173EE3 3918 CMP DWORD PTR DS:[EAX],EBX

00173EE5 75 13 JNE SHORT 00173EFA

00173EE7 50 PUSH EAX

00173EE8 E8 FFFCFFFF CALL 00173BEC

00173EED FFB6 BC000000 PUSH DWORD PTR DS:[ESI+0BC]

00173EF3 E8 0C100000 CALL 00174F04

00173EF8 59 POP ECX

00173EF9 59 POP ECX

00173EFA FFB6 B0000000 PUSH DWORD PTR DS:[ESI+0B0]

00173F00 E8 E7FCFFFF CALL 00173BEC

00173F05 FFB6 BC000000 PUSH DWORD PTR DS:[ESI+0BC]

00173F0B E8 DCFCFFFF CALL 00173BEC

00173F10 59 POP ECX

00173F11 59 POP ECX

00173F12 8B86 C0000000 MOV EAX,DWORD PTR DS:[ESI+0C0]

00173F18 3BC3 CMP EAX,EBX

00173F1A 74 44 JE SHORT 00173F60

00173F1C 3918 CMP DWORD PTR DS:[EAX],EBX

00173F1E 75 40 JNE SHORT 00173F60

00173F20 8B86 C4000000 MOV EAX,DWORD PTR DS:[ESI+0C4]

00173F26 2D FE000000 SUB EAX,0FE

00173F2B 50 PUSH EAX

00173F2C E8 BBFCFFFF CALL 00173BEC

00173F31 8B86 CC000000 MOV EAX,DWORD PTR DS:[ESI+0CC]

00173F37 BF 80000000 MOV EDI,80


00173F3C 2BC7 SUB EAX,EDI

00173F3E 50 PUSH EAX

00173F3F E8 A8FCFFFF CALL 00173BEC

00173F44 8B86 D0000000 MOV EAX,DWORD PTR DS:[ESI+0D0]

00173F4A 2BC7 SUB EAX,EDI

00173F4C 50 PUSH EAX

00173F4D E8 9AFCFFFF CALL 00173BEC

00173F52 FFB6 C0000000 PUSH DWORD PTR DS:[ESI+0C0]

00173F58 E8 8FFCFFFF CALL 00173BEC

00173F5D 83C4 10 ADD ESP,10

00173F60 8B86 D4000000 MOV EAX,DWORD PTR DS:[ESI+0D4]

00173F66 3D 48881700 CMP EAX,OFFSET 00178848 ; PTR to ASCII "Sun"

00173F6B 74 1B JE SHORT 00173F88

00173F6D 3998 B4000000 CMP DWORD PTR DS:[EAX+0B4],EBX

00173F73 75 13 JNE SHORT 00173F88


00173F76 E8 120C0000 CALL 00174B8D

00173F7B FFB6 D4000000 PUSH DWORD PTR DS:[ESI+0D4]

00173F81 E8 66FCFFFF CALL 00173BEC

00173F86 59 POP ECX

00173F87 59 POP ECX

00173F88 8D7E 50 LEA EDI,[ESI+50]

00173F8B C745 08 0600000 MOV DWORD PTR SS:[EBP+8],6

00173F92 817F F8 4088170 CMP DWORD PTR DS:[EDI-8],OFFSET 00178840

00173F99 74 11 JE SHORT 00173FAC

00173F9B 8B07 MOV EAX,DWORD PTR DS:[EDI]

00173F9D 3BC3 CMP EAX,EBX

00173F9F 74 0B JE SHORT 00173FAC

00173FA1 3918 CMP DWORD PTR DS:[EAX],EBX

00173FA3 75 07 JNE SHORT 00173FAC

00173FA5 50 PUSH EAX

00173FA6 E8 41FCFFFF CALL 00173BEC

00173FAB 59 POP ECX

00173FAC 395F FC CMP DWORD PTR DS:[EDI-4],EBX

00173FAF 74 12 JE SHORT 00173FC3

00173FB1 8B47 04 MOV EAX,DWORD PTR DS:[EDI+4]

00173FB4 3BC3 CMP EAX,EBX

00173FB6 74 0B JE SHORT 00173FC3

00173FB8 3918 CMP DWORD PTR DS:[EAX],EBX

00173FBA 75 07 JNE SHORT 00173FC3

00173FBC 50 PUSH EAX

00173FBD E8 2AFCFFFF CALL 00173BEC


00173FC2 59 POP ECX

00173FC3 83C7 10 ADD EDI,10

00173FC6 FF4D 08 DEC DWORD PTR SS:[EBP+8]

00173FC9 ^ 75 C7 JNE SHORT 00173F92

00173FCB 56 PUSH ESI

00173FCC E8 1BFCFFFF CALL 00173BEC

00173FD1 59 POP ECX

00173FD2 5F POP EDI

00173FD3 5E POP ESI

00173FD4 5B POP EBX

00173FD5 5D POP EBP

00173FD6 C3 RETN

00173FD7 8BFF MOV EDI,EDI

00173FD9 55 PUSH EBP

00173FDA 8BEC MOV EBP,ESP

00173FDC 57 PUSH EDI

00173FDD 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+0C]

00173FE0 85FF TEST EDI,EDI

00173FE2 74 3B JE SHORT 0017401F

00173FE4 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

00173FE7 85C0 TEST EAX,EAX

00173FE9 74 34 JE SHORT 0017401F

00173FEB 56 PUSH ESI

00173FEC 8B30 MOV ESI,DWORD PTR DS:[EAX]

00173FEE 3BF7 CMP ESI,EDI

00173FF0 74 28 JE SHORT 0017401A

00173FF2 57 PUSH EDI

00173FF3 8938 MOV DWORD PTR DS:[EAX],EDI

00173FF5 E8 6AFDFFFF CALL 00173D64

00173FFA 59 POP ECX

00173FFB 85F6 TEST ESI,ESI

00173FFD 74 1B JE SHORT 0017401A

00173FFF 56 PUSH ESI

00174000 E8 EEFDFFFF CALL 00173DF3

00174005 833E 00 CMP DWORD PTR DS:[ESI],0

00174008 59 POP ECX

00174009 75 0F JNE SHORT 0017401A

0017400B 81FE B0891700 CMP ESI,OFFSET 001789B0

00174011 74 07 JE SHORT 0017401A

00174013 56 PUSH ESI

00174014 E8 73FEFFFF CALL 00173E8C

00174019 59 POP ECX


0017401A 8BC7 MOV EAX,EDI

0017401C 5E POP ESI

0017401D EB 02 JMP SHORT 00174021

0017401F 33C0 XOR EAX,EAX

00174021 5F POP EDI

00174022 5D POP EBP

00174023 C3 RETN

00174024 6A 0C PUSH 0C

00174026 68 607A1700 PUSH OFFSET 00177A60

0017402B E8 70E4FFFF CALL 001724A0

00174030 E8 80E1FFFF CALL 001721B5


00174037 A1 A08A1700 MOV EAX,DWORD PTR DS:[178AA0]

0017403C 8546 70 TEST DWORD PTR DS:[ESI+70],EAX

0017403F 74 22 JE SHORT 00174063

00174041 837E 6C 00 CMP DWORD PTR DS:[ESI+6C],0

00174045 74 1C JE SHORT 00174063

00174047 E8 69E1FFFF CALL 001721B5

0017404C 8B70 6C MOV ESI,DWORD PTR DS:[EAX+6C]

0017404F 85F6 TEST ESI,ESI

00174051 75 08 JNE SHORT 0017405B

00174053 6A 20 PUSH 20

00174055 E8 7DD5FFFF CALL 001715D7

0017405A 59 POP ECX


0017405D E8 83E4FFFF CALL 001724E5

00174062 C3 RETN

00174063 6A 0C PUSH 0C

00174065 E8 8CE8FFFF CALL 001728F6

0017406A 59 POP ECX

0017406B 8365 FC 00 AND DWORD PTR SS:[EBP-4],00000000

0017406F FF35 888A1700 PUSH DWORD PTR DS:[178A88]

00174075 83C6 6C ADD ESI,6C

00174078 56 PUSH ESI

00174079 E8 59FFFFFF CALL 00173FD7

0017407E 59 POP ECX

0017407F 59 POP ECX

00174080 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX


0017408A E8 02000000 CALL 00174091

0017408F ^ EB BE JMP SHORT 0017404F

00174091 6A 0C PUSH 0C


00174093 E8 85E7FFFF CALL 0017281D

00174098 59 POP ECX

00174099 8B75 E4 MOV ESI,DWORD PTR SS:[EBP-1C]

0017409C C3 RETN

0017409D CC INT3

0017409E CC INT3

0017409F CC INT3




001740A3 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10]

001740A7 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14]

001740AB 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18]

001740AF 55 PUSH EBP

001740B0 52 PUSH EDX


001740B2 51 PUSH ECX


001740B4 68 30411700 PUSH OFFSET 00174130

001740B9 64:FF35 0000000 PUSH DWORD PTR FS:[0]

001740C0 A1 04801700 MOV EAX,DWORD PTR DS:[178004]

001740C5 33C4 XOR EAX,ESP

001740C7 894424 08 MOV DWORD PTR SS:[ESP+8],EAX

001740CB 64:8925 0000000 MOV DWORD PTR FS:[0],ESP

001740D2 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+30]

001740D6 8B58 08 MOV EBX,DWORD PTR DS:[EAX+8]

001740D9 8B4C24 2C MOV ECX,DWORD PTR SS:[ESP+2C]

001740DD 3319 XOR EBX,DWORD PTR DS:[ECX]

001740DF 8B70 0C MOV ESI,DWORD PTR DS:[EAX+0C]

001740E2 83FE FE CMP ESI,-2

001740E5 74 3B JE SHORT 00174122

001740E7 8B5424 34 MOV EDX,DWORD PTR SS:[ESP+34]

001740EB 83FA FE CMP EDX,-2

001740EE 74 04 JE SHORT 001740F4

001740F0 3BF2 CMP ESI,EDX

001740F2 76 2E JBE SHORT 00174122

001740F4 8D3476 LEA ESI,[ESI*2+ESI]

001740F7 8D5CB3 10 LEA EBX,[ESI*4+EBX+10]

001740FB 8B0B MOV ECX,DWORD PTR DS:[EBX]

001740FD 8948 0C MOV DWORD PTR DS:[EAX+0C],ECX

00174100 837B 04 00 CMP DWORD PTR DS:[EBX+4],0

00174104 ^ 75 CC JNE SHORT 001740D2


00174106 68 01010000 PUSH 101

0017410B 8B43 08 MOV EAX,DWORD PTR DS:[EBX+8]

0017410E E8 72100000 CALL 00175185

00174113 B9 01000000 MOV ECX,1

00174118 8B43 08 MOV EAX,DWORD PTR DS:[EBX+8]

0017411B E8 84100000 CALL 001751A4

00174120 ^ EB B0 JMP SHORT 001740D2

00174122 64:8F05 0000000 POP DWORD PTR FS:[0]

00174129 83C4 18 ADD ESP,18

0017412C 5F POP EDI

0017412D 5E POP ESI

0017412E 5B POP EBX

0017412F C3 RETN


00174134 F741 04 0600000 TEST DWORD PTR DS:[ECX+4],00000006

0017413B B8 01000000 MOV EAX,1

00174140 74 33 JE SHORT 00174175

00174142 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]


00174149 33C8 XOR ECX,EAX

0017414B E8 B5CEFFFF CALL 00171005

00174150 55 PUSH EBP

00174151 8B68 18 MOV EBP,DWORD PTR DS:[EAX+18]

00174154 FF70 0C PUSH DWORD PTR DS:[EAX+0C]

00174157 FF70 10 PUSH DWORD PTR DS:[EAX+10]

0017415A FF70 14 PUSH DWORD PTR DS:[EAX+14]

0017415D E8 3EFFFFFF CALL 001740A0

00174162 83C4 0C ADD ESP,0C

00174165 5D POP EBP


0017416A 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10]

0017416E 8902 MOV DWORD PTR DS:[EDX],EAX

00174170 B8 03000000 MOV EAX,3

00174175 C3 RETN

00174176 55 PUSH EBP


0017417B 8B29 MOV EBP,DWORD PTR DS:[ECX]

0017417D FF71 1C PUSH DWORD PTR DS:[ECX+1C]

00174180 FF71 18 PUSH DWORD PTR DS:[ECX+18]

00174183 FF71 28 PUSH DWORD PTR DS:[ECX+28]

00174186 E8 15FFFFFF CALL 001740A0

0017418B 83C4 0C ADD ESP,0C


0017418E 5D POP EBP

0017418F C2 0400 RETN 4

00174192 55 PUSH EBP

00174193 56 PUSH ESI

00174194 57 PUSH EDI

00174195 53 PUSH EBX

00174196 8BEA MOV EBP,EDX


0017419A 33DB XOR EBX,EBX

0017419C 33D2 XOR EDX,EDX

0017419E 33F6 XOR ESI,ESI

001741A0 33FF XOR EDI,EDI

001741A2 FFD1 CALL ECX

001741A4 5B POP EBX

001741A5 5F POP EDI

001741A6 5E POP ESI

001741A7 5D POP EBP

001741A8 C3 RETN

001741A9 8BEA MOV EBP,EDX

001741AB 8BF1 MOV ESI,ECX

001741AD 8BC1 MOV EAX,ECX

001741AF 6A 01 PUSH 1

001741B1 E8 CF0F0000 CALL 00175185



001741BA 33C9 XOR ECX,ECX

001741BC 33D2 XOR EDX,EDX

001741BE 33FF XOR EDI,EDI

001741C0 FFE6 JMP ESI






001741C8 6A 00 PUSH 0

001741CA 52 PUSH EDX

001741CB 68 D6411700 PUSH OFFSET 001741D6


001741D1 E8 0E120000 CALL <JMP.RtlUnwind> ; Jump to kernel32.RtlUnwind

001741D6 5F POP EDI

001741D7 5E POP ESI

001741D8 5B POP EBX


001741D9 5D POP EBP

001741DA C3 RETN

001741DB 55 PUSH EBP

001741DC 8B6C24 08 MOV EBP,DWORD PTR SS:[ESP+8]

001741E0 52 PUSH EDX

001741E1 51 PUSH ECX

001741E2 FF7424 14 PUSH DWORD PTR SS:[ESP+14]

001741E6 E8 B5FEFFFF CALL 001740A0

001741EB 83C4 0C ADD ESP,0C

001741EE 5D POP EBP

001741EF C2 0800 RETN 8

001741F2 E8 87E7FFFF CALL 0017297E


001741F9 74 08 JE SHORT 00174203

001741FB 6A 16 PUSH 16

001741FD E8 89E7FFFF CALL 0017298B

00174202 59 POP ECX

00174203 F605 908A1700 0 TEST BYTE PTR DS:[178A90],02

0017420A 74 11 JE SHORT 0017421D

0017420C 6A 01 PUSH 1

0017420E 68 15000040 PUSH 40000015

00174213 6A 03 PUSH 3

00174215 E8 41E9FFFF CALL 00172B5B

0017421A 83C4 0C ADD ESP,0C

0017421D 6A 03 PUSH 3

0017421F E8 7FD3FFFF CALL 001715A3

00174224 CC INT3

00174225 CC INT3

00174226 CC INT3

00174227 CC INT3

00174228 CC INT3

00174229 CC INT3

0017422A CC INT3

0017422B CC INT3

0017422C CC INT3

0017422D CC INT3

0017422E CC INT3

0017422F CC INT3

00174230 55 PUSH EBP


00174233 57 PUSH EDI

00174234 56 PUSH ESI


00174235 8B75 0C MOV ESI,DWORD PTR SS:[EBP+0C]


0017423B 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]

0017423E 8BC1 MOV EAX,ECX

00174240 8BD1 MOV EDX,ECX

00174242 03C6 ADD EAX,ESI


00174246 76 08 JBE SHORT 00174250

00174248 3BF8 CMP EDI,EAX

0017424A 0F82 A0010000 JB 001743F0

00174250 81F9 80000000 CMP ECX,80

00174256 72 1C JB SHORT 00174274

00174258 833D A4971700 0 CMP DWORD PTR DS:[1797A4],0

0017425F 74 13 JE SHORT 00174274

00174261 57 PUSH EDI

00174262 56 PUSH ESI

00174263 83E7 0F AND EDI,0000000F

00174266 83E6 0F AND ESI,0000000F


0017426B 5E POP ESI

0017426C 5F POP EDI

0017426D 75 05 JNE SHORT 00174274

0017426F E9 330F0000 JMP 001751A7

00174274 F7C7 03000000 TEST EDI,00000003

0017427A 75 14 JNE SHORT 00174290

0017427C C1E9 02 SHR ECX,2

0017427F 83E2 03 AND EDX,00000003

00174282 83F9 08 CMP ECX,8

00174285 72 29 JB SHORT 001742B0

00174287 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS

00174289 FF2495 A0431700 JMP DWORD PTR DS:[EDX*4+1743A0]


00174292 BA 03000000 MOV EDX,3

00174297 83E9 04 SUB ECX,4

0017429A 72 0C JB SHORT 001742A8

0017429C 83E0 03 AND EAX,00000003

0017429F 03C8 ADD ECX,EAX

001742A1 FF2485 B4421700 JMP DWORD PTR DS:[EAX*4+1742B4]

001742A8 FF248D B0431700 JMP DWORD PTR DS:[ECX*4+1743B0]

001742AF 90 NOP

001742B0 FF248D 34431700 JMP DWORD PTR DS:[ECX*4+174334]

001742B7 90 NOP


001742B8 C442 17 LES EAX,FWORD PTR DS:[EDX+17] ; Modification of segment register

001742BB 00F0 ADD AL,DH

001742BD 42 INC EDX

001742BE 17 POP SS ; Modification of segment register

001742BF 001443 ADD BYTE PTR DS:[EAX*2+EBX],DL

001742C2 17 POP SS ; Modification of segment register

001742C3 0023 ADD BYTE PTR DS:[EBX],AH

001742C5 D18A 0688078A ROR DWORD PTR DS:[EDX+8A078806],1

001742CB 46 INC ESI

001742CC 0188 47018A46 ADD DWORD PTR DS:[EAX+468A0147],ECX

001742D2 02C1 ADD AL,CL

001742D4 - E9 02884702 JMP 025ECADB

001742D9 83C6 03 ADD ESI,3

001742DC 83C7 03 ADD EDI,3

001742DF 83F9 08 CMP ECX,8

001742E2 ^ 72 CC JB SHORT 001742B0

001742E4 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS

001742E6 FF2495 A0431700 JMP DWORD PTR DS:[EDX*4+1743A0]

001742ED 8D49 00 LEA ECX,[ECX]

001742F0 23D1 AND EDX,ECX

001742F2 8A06 MOV AL,BYTE PTR DS:[ESI]

001742F4 8807 MOV BYTE PTR DS:[EDI],AL

001742F6 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]

001742F9 C1E9 02 SHR ECX,2

001742FC 8847 01 MOV BYTE PTR DS:[EDI+1],AL

001742FF 83C6 02 ADD ESI,2

00174302 83C7 02 ADD EDI,2

00174305 83F9 08 CMP ECX,8

00174308 ^ 72 A6 JB SHORT 001742B0

0017430A F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS

0017430C FF2495 A0431700 JMP DWORD PTR DS:[EDX*4+1743A0]

00174313 90 NOP

00174314 23D1 AND EDX,ECX

00174316 8A06 MOV AL,BYTE PTR DS:[ESI]

00174318 8807 MOV BYTE PTR DS:[EDI],AL

0017431A 83C6 01 ADD ESI,1

0017431D C1E9 02 SHR ECX,2

00174320 83C7 01 ADD EDI,1

00174323 83F9 08 CMP ECX,8

00174326 ^ 72 88 JB SHORT 001742B0


0017432A FF2495 A0431700 JMP DWORD PTR DS:[EDX*4+1743A0]


00174331 8D49 00 LEA ECX,[ECX]

00174334 97 XCHG EAX,EDI

00174335 43 INC EBX

00174336 17 POP SS ; Modification of segment register

00174337 008443 17007C43 ADD BYTE PTR DS:[EAX*2+EBX+437C0017],AL

0017433E 17 POP SS ; Modification of segment register

0017433F 007443 17 ADD BYTE PTR DS:[EAX*2+EBX+17],DH

00174343 006C43 17 ADD BYTE PTR DS:[EAX*2+EBX+17],CH

00174347 006443 17 ADD BYTE PTR DS:[EAX*2+EBX+17],AH

0017434B 005C43 17 ADD BYTE PTR DS:[EAX*2+EBX+17],BL

0017434F 005443 17 ADD BYTE PTR DS:[EAX*2+EBX+17],DL

00174353 008B 448EE489 ADD BYTE PTR DS:[EBX+89E48E44],CL

00174359 44 INC ESP

0017435A 8F DB 8F ; Unknown command

0017435B E4 8B IN AL,8B ; I/O command

0017435D 44 INC ESP

0017435E 8EE8 MOV GS,AX ; Modification of segment register

00174360 89448F E8 MOV DWORD PTR DS:[ECX*4+EDI-18],EAX

00174364 8B448E EC MOV EAX,DWORD PTR DS:[ECX*4+ESI-14]

00174368 89448F EC MOV DWORD PTR DS:[ECX*4+EDI-14],EAX

0017436C 8B448E F0 MOV EAX,DWORD PTR DS:[ECX*4+ESI-10]

00174370 89448F F0 MOV DWORD PTR DS:[ECX*4+EDI-10],EAX

00174374 8B448E F4 MOV EAX,DWORD PTR DS:[ECX*4+ESI-0C]

00174378 89448F F4 MOV DWORD PTR DS:[ECX*4+EDI-0C],EAX

0017437C 8B448E F8 MOV EAX,DWORD PTR DS:[ECX*4+ESI-8]

00174380 89448F F8 MOV DWORD PTR DS:[ECX*4+EDI-8],EAX

00174384 8B448E FC MOV EAX,DWORD PTR DS:[ECX*4+ESI-4]

00174388 89448F FC MOV DWORD PTR DS:[ECX*4+EDI-4],EAX

0017438C 8D048D 00000000 LEA EAX,[ECX*4]

00174393 03F0 ADD ESI,EAX

00174395 03F8 ADD EDI,EAX

00174397 FF2495 A0431700 JMP DWORD PTR DS:[EDX*4+1743A0]

0017439E 8BFF MOV EDI,EDI

001743A0 B0 43 MOV AL,43

001743A2 17 POP SS ; Modification of segment register

001743A3 00B8 431700C4 ADD BYTE PTR DS:[EAX+C4001743],BH

001743A9 43 INC EBX

001743AA 17 POP SS ; Modification of segment register

001743AB 00D8 ADD AL,BL

001743AD 43 INC EBX

001743AE 17 POP SS ; Modification of segment register

001743AF 008B 45085E5F ADD BYTE PTR DS:[EBX+5F5E0845],CL


001743B5 C9 LEAVE

001743B6 C3 RETN

001743B7 90 NOP

001743B8 8A06 MOV AL,BYTE PTR DS:[ESI]

001743BA 8807 MOV BYTE PTR DS:[EDI],AL

001743BC 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

001743BF 5E POP ESI

001743C0 5F POP EDI

001743C1 C9 LEAVE

001743C2 C3 RETN

001743C3 90 NOP

001743C4 8A06 MOV AL,BYTE PTR DS:[ESI]

001743C6 8807 MOV BYTE PTR DS:[EDI],AL

001743C8 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]

001743CB 8847 01 MOV BYTE PTR DS:[EDI+1],AL

001743CE 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

001743D1 5E POP ESI

001743D2 5F POP EDI

001743D3 C9 LEAVE

001743D4 C3 RETN

001743D5 8D49 00 LEA ECX,[ECX]

001743D8 8A06 MOV AL,BYTE PTR DS:[ESI]

001743DA 8807 MOV BYTE PTR DS:[EDI],AL

001743DC 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]

001743DF 8847 01 MOV BYTE PTR DS:[EDI+1],AL

001743E2 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]

001743E5 8847 02 MOV BYTE PTR DS:[EDI+2],AL

001743E8 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

001743EB 5E POP ESI

001743EC 5F POP EDI

001743ED C9 LEAVE

001743EE C3 RETN

001743EF 90 NOP

001743F0 8D7431 FC LEA ESI,[ESI+ECX-4]

001743F4 8D7C39 FC LEA EDI,[EDI+ECX-4]

001743F8 F7C7 03000000 TEST EDI,00000003

001743FE 75 24 JNE SHORT 00174424

00174400 C1E9 02 SHR ECX,2

00174403 83E2 03 AND EDX,00000003

00174406 83F9 08 CMP ECX,8

00174409 72 0D JB SHORT 00174418

0017440B FD STD


0017440C F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS

0017440E FC CLD

0017440F FF2495 3C451700 JMP DWORD PTR DS:[EDX*4+17453C]


00174418 F7D9 NEG ECX

0017441A FF248D EC441700 JMP DWORD PTR DS:[ECX*4+1744EC]

00174421 8D49 00 LEA ECX,[ECX]


00174426 BA 03000000 MOV EDX,3

0017442B 83F9 04 CMP ECX,4

0017442E 72 0C JB SHORT 0017443C

00174430 83E0 03 AND EAX,00000003

00174433 2BC8 SUB ECX,EAX

00174435 FF2485 40441700 JMP DWORD PTR DS:[EAX*4+174440]

0017443C FF248D 3C451700 JMP DWORD PTR DS:[ECX*4+17453C]

00174443 90 NOP

00174444 50 PUSH EAX

00174445 44 INC ESP

00174446 17 POP SS ; Modification of segment register

00174447 007444 17 ADD BYTE PTR SS:[EAX*2+ESP+17],DH

0017444B 009C44 17008A46 ADD BYTE PTR SS:[EAX*2+ESP+468A0017],BL

00174452 0323 ADD ESP,DWORD PTR DS:[EBX]

00174454 D188 470383EE ROR DWORD PTR DS:[EAX+EE830347],1

0017445A 01C1 ADD ECX,EAX

0017445C - E9 0283EF01 JMP 0206C763

00174461 83F9 08 CMP ECX,8

00174464 ^ 72 B2 JB SHORT 00174418

00174466 FD STD


00174469 FC CLD

0017446A FF2495 3C451700 JMP DWORD PTR DS:[EDX*4+17453C]

00174471 8D49 00 LEA ECX,[ECX]

00174474 8A46 03 MOV AL,BYTE PTR DS:[ESI+3]

00174477 23D1 AND EDX,ECX

00174479 8847 03 MOV BYTE PTR DS:[EDI+3],AL


0017447F C1E9 02 SHR ECX,2


00174485 83EE 02 SUB ESI,2

00174488 83EF 02 SUB EDI,2

0017448B 83F9 08 CMP ECX,8

0017448E ^ 72 88 JB SHORT 00174418


00174490 FD STD


00174493 FC CLD

00174494 FF2495 3C451700 JMP DWORD PTR DS:[EDX*4+17453C]

0017449B 90 NOP


0017449F 23D1 AND EDX,ECX

001744A1 8847 03 MOV BYTE PTR DS:[EDI+3],AL

001744A4 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]

001744A7 8847 02 MOV BYTE PTR DS:[EDI+2],AL

001744AA 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]

001744AD C1E9 02 SHR ECX,2

001744B0 8847 01 MOV BYTE PTR DS:[EDI+1],AL

001744B3 83EE 03 SUB ESI,3

001744B6 83EF 03 SUB EDI,3

001744B9 83F9 08 CMP ECX,8

001744BC ^ 0F82 56FFFFFF JB 00174418

001744C2 FD STD

001744C3 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS

001744C5 FC CLD

001744C6 FF2495 3C451700 JMP DWORD PTR DS:[EDX*4+17453C]

001744CD 8D49 00 LEA ECX,[ECX]

001744D0 F0:44 LOCK INC ESP ; LOCK prefix is not allowed

001744D2 17 POP SS ; Modification of segment register

001744D3 00F8 ADD AL,BH

001744D5 44 INC ESP

001744D6 17 POP SS ; Modification of segment register

001744D7 0000 ADD BYTE PTR DS:[EAX],AL

001744D9 45 INC EBP

001744DA 17 POP SS ; Modification of segment register

001744DB 0008 ADD BYTE PTR DS:[EAX],CL

001744DD 45 INC EBP

001744DE 17 POP SS ; Modification of segment register

001744DF 0010 ADD BYTE PTR DS:[EAX],DL

001744E1 45 INC EBP

001744E2 17 POP SS ; Modification of segment register

001744E3 0018 ADD BYTE PTR DS:[EAX],BL

001744E5 45 INC EBP

001744E6 17 POP SS ; Modification of segment register

001744E7 0020 ADD BYTE PTR DS:[EAX],AH

001744E9 45 INC EBP

001744EA 17 POP SS ; Modification of segment register


001744EB 0033 ADD BYTE PTR DS:[EBX],DH

001744ED 45 INC EBP

001744EE 17 POP SS ; Modification of segment register

001744EF 008B 448E1C89 ADD BYTE PTR DS:[EBX+891C8E44],CL

001744F5 44 INC ESP

001744F6 8F DB 8F ; Unknown command

001744F7 1C 8B SBB AL,8B

001744F9 44 INC ESP

001744FA 8E18 MOV DS,WORD PTR DS:[EAX] ; Modification of segment register

001744FC 89448F 18 MOV DWORD PTR DS:[ECX*4+EDI+18],EAX

00174500 8B448E 14 MOV EAX,DWORD PTR DS:[ECX*4+ESI+14]

00174504 89448F 14 MOV DWORD PTR DS:[ECX*4+EDI+14],EAX


0017450C 89448F 10 MOV DWORD PTR DS:[ECX*4+EDI+10],EAX

00174510 8B448E 0C MOV EAX,DWORD PTR DS:[ECX*4+ESI+0C]

00174514 89448F 0C MOV DWORD PTR DS:[ECX*4+EDI+0C],EAX


0017451C 89448F 08 MOV DWORD PTR DS:[ECX*4+EDI+8],EAX


00174524 89448F 04 MOV DWORD PTR DS:[ECX*4+EDI+4],EAX

00174528 8D048D 00000000 LEA EAX,[ECX*4]

0017452F 03F0 ADD ESI,EAX

00174531 03F8 ADD EDI,EAX

00174533 FF2495 3C451700 JMP DWORD PTR DS:[EDX*4+17453C]


0017453C 4C DEC ESP

0017453D 45 INC EBP

0017453E 17 POP SS ; Modification of segment register

0017453F 005445 17 ADD BYTE PTR SS:[EAX*2+EBP+17],DL

00174543 006445 17 ADD BYTE PTR SS:[EAX*2+EBP+17],AH

00174547 0078 45 ADD BYTE PTR DS:[EAX+45],BH

0017454A 17 POP SS ; Modification of segment register

0017454B 008B 45085E5F ADD BYTE PTR DS:[EBX+5F5E0845],CL

00174551 C9 LEAVE

00174552 C3 RETN

00174553 90 NOP



0017455A 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

0017455D 5E POP ESI

0017455E 5F POP EDI

0017455F C9 LEAVE


00174560 C3 RETN

00174561 8D49 00 LEA ECX,[ECX]



0017456A 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]

0017456D 8847 02 MOV BYTE PTR DS:[EDI+2],AL


00174573 5E POP ESI

00174574 5F POP EDI

00174575 C9 LEAVE

00174576 C3 RETN

00174577 90 NOP


0017457B 8847 03 MOV BYTE PTR DS:[EDI+3],AL

0017457E 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]




0017458A 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

0017458D 5E POP ESI

0017458E 5F POP EDI

0017458F C9 LEAVE

00174590 C3 RETN


00174593 55 PUSH EBP




0017459B 74 12 JE SHORT 001745AF

0017459D 83E8 08 SUB EAX,8

001745A0 8138 DDDD0000 CMP DWORD PTR DS:[EAX],0DDDD

001745A6 75 07 JNE SHORT 001745AF


001745A9 E8 3EF6FFFF CALL 00173BEC

001745AE 59 POP ECX

001745AF 5D POP EBP

001745B0 C3 RETN

001745B1 CC INT3

001745B2 CC INT3

001745B3 CC INT3

001745B4 CC INT3

001745B5 CC INT3


001745B6 CC INT3

001745B7 CC INT3

001745B8 CC INT3

001745B9 CC INT3

001745BA CC INT3

001745BB CC INT3

001745BC CC INT3

001745BD CC INT3

001745BE CC INT3

001745BF CC INT3

001745C0 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+0C]

001745C4 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]

001745C8 85D2 TEST EDX,EDX

001745CA 74 69 JE SHORT 00174635

001745CC 33C0 XOR EAX,EAX

001745CE 8A4424 08 MOV AL,BYTE PTR SS:[ESP+8]

001745D2 84C0 TEST AL,AL

001745D4 75 16 JNE SHORT 001745EC

001745D6 81FA 80000000 CMP EDX,80

001745DC 72 0E JB SHORT 001745EC

001745DE 833D A4971700 0 CMP DWORD PTR DS:[1797A4],0

001745E5 74 05 JE SHORT 001745EC

001745E7 E9 000D0000 JMP 001752EC

001745EC 57 PUSH EDI

001745ED 8BF9 MOV EDI,ECX

001745EF 83FA 04 CMP EDX,4

001745F2 72 31 JB SHORT 00174625

001745F4 F7D9 NEG ECX

001745F6 83E1 03 AND ECX,00000003

001745F9 74 0C JE SHORT 00174607

001745FB 2BD1 SUB EDX,ECX

001745FD 8807 MOV BYTE PTR DS:[EDI],AL

001745FF 83C7 01 ADD EDI,1

00174602 83E9 01 SUB ECX,1

00174605 ^ 75 F6 JNE SHORT 001745FD

00174607 8BC8 MOV ECX,EAX

00174609 C1E0 08 SHL EAX,8

0017460C 03C1 ADD EAX,ECX

0017460E 8BC8 MOV ECX,EAX

00174610 C1E0 10 SHL EAX,10

00174613 03C1 ADD EAX,ECX

00174615 8BCA MOV ECX,EDX


00174617 83E2 03 AND EDX,00000003

0017461A C1E9 02 SHR ECX,2

0017461D 74 06 JE SHORT 00174625

0017461F F3:AB REP STOS DWORD PTR ES:[EDI]

00174621 85D2 TEST EDX,EDX

00174623 74 0A JE SHORT 0017462F

00174625 8807 MOV BYTE PTR DS:[EDI],AL

00174627 83C7 01 ADD EDI,1

0017462A 83EA 01 SUB EDX,1

0017462D ^ 75 F6 JNE SHORT 00174625

0017462F 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]

00174633 5F POP EDI

00174634 C3 RETN


00174639 C3 RETN




0017463F 837D 08 00 CMP DWORD PTR SS:[EBP+8],0

00174643 75 15 JNE SHORT 0017465A

00174645 E8 15E7FFFF CALL 00172D5F

0017464A C700 16000000 MOV DWORD PTR DS:[EAX],16

00174650 E8 81E6FFFF CALL 00172CD6


00174658 5D POP EBP

00174659 C3 RETN


0017465D 6A 00 PUSH 0

0017465F FF35 E8951700 PUSH DWORD PTR DS:[1795E8]

00174665 FF15 B8601700 CALL DWORD PTR DS:[1760B8]

0017466B 5D POP EBP

0017466C C3 RETN

0017466D 6A 02 PUSH 2

0017466F E8 63CFFFFF CALL 001715D7

00174674 59 POP ECX

00174675 C3 RETN


00174678 55 PUSH EBP


0017467B 83EC 10 SUB ESP,10

0017467E A1 04801700 MOV EAX,DWORD PTR DS:[178004]

00174683 33C5 XOR EAX,EBP


00174685 8945 FC MOV DWORD PTR SS:[EBP-4],EAX


0017468B 53 PUSH EBX

0017468C 33DB XOR EBX,EBX



00174690 3BD3 CMP EDX,EBX

00174692 7E 1F JLE SHORT 001746B3


00174697 8BCA MOV ECX,EDX

00174699 49 DEC ECX

0017469A 3818 CMP BYTE PTR DS:[EAX],BL

0017469C 74 08 JE SHORT 001746A6

0017469E 40 INC EAX

0017469F 3BCB CMP ECX,EBX

001746A1 ^ 75 F6 JNE SHORT 00174699

001746A3 83C9 FF OR ECX,FFFFFFFF

001746A6 8BC2 MOV EAX,EDX

001746A8 2BC1 SUB EAX,ECX

001746AA 48 DEC EAX

001746AB 3BC2 CMP EAX,EDX

001746AD 7D 01 JGE SHORT 001746B0

001746AF 40 INC EAX

001746B0 8945 18 MOV DWORD PTR SS:[EBP+18],EAX

001746B3 895D F8 MOV DWORD PTR SS:[EBP-8],EBX

001746B6 395D 24 CMP DWORD PTR SS:[EBP+24],EBX

001746B9 75 0B JNE SHORT 001746C6

001746BB 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]

001746BE 8B00 MOV EAX,DWORD PTR DS:[EAX]

001746C0 8B40 04 MOV EAX,DWORD PTR DS:[EAX+4]

001746C3 8945 24 MOV DWORD PTR SS:[EBP+24],EAX

001746C6 8B35 C0601700 MOV ESI,DWORD PTR DS:[1760C0]

001746CC 33C0 XOR EAX,EAX

001746CE 395D 28 CMP DWORD PTR SS:[EBP+28],EBX




001746D6 0F95C0 SETNE AL


001746DC 8D04C5 01000000 LEA EAX,[EAX*8+1]





001746E9 8BF8 MOV EDI,EAX

001746EB 897D F0 MOV DWORD PTR SS:[EBP-10],EDI

001746EE 3BFB CMP EDI,EBX

001746F0 75 07 JNE SHORT 001746F9


001746F4 E9 52010000 JMP 0017484B

001746F9 7E 43 JLE SHORT 0017473E

001746FB 6A E0 PUSH -20

001746FD 33D2 XOR EDX,EDX

001746FF 58 POP EAX

00174700 F7F7 DIV EDI

00174702 83F8 02 CMP EAX,2

00174705 72 37 JB SHORT 0017473E

00174707 8D443F 08 LEA EAX,[EDI+EDI+8]

0017470B 3D 00040000 CMP EAX,400

00174710 77 13 JA SHORT 00174725

00174712 E8 A90B0000 CALL 001752C0

00174717 8BC4 MOV EAX,ESP

00174719 3BC3 CMP EAX,EBX

0017471B 74 1C JE SHORT 00174739

0017471D C700 CCCC0000 MOV DWORD PTR DS:[EAX],0CCCC

00174723 EB 11 JMP SHORT 00174736

00174725 50 PUSH EAX

00174726 E8 9F020000 CALL 001749CA

0017472B 59 POP ECX

0017472C 3BC3 CMP EAX,EBX

0017472E 74 09 JE SHORT 00174739

00174730 C700 DDDD0000 MOV DWORD PTR DS:[EAX],0DDDD

00174736 83C0 08 ADD EAX,8

00174739 8945 F4 MOV DWORD PTR SS:[EBP-0C],EAX

0017473C EB 03 JMP SHORT 00174741

0017473E 895D F4 MOV DWORD PTR SS:[EBP-0C],EBX

00174741 395D F4 CMP DWORD PTR SS:[EBP-0C],EBX

00174744 ^ 74 AC JE SHORT 001746F2

00174746 57 PUSH EDI

00174747 FF75 F4 PUSH DWORD PTR SS:[EBP-0C]


0017474D FF75 14 PUSH DWORD PTR SS:[EBP+14]

00174750 6A 01 PUSH 1





00174759 0F84 E0000000 JE 0017483F

0017475F 8B35 BC601700 MOV ESI,DWORD PTR DS:[1760BC]

00174765 53 PUSH EBX

00174766 53 PUSH EBX

00174767 57 PUSH EDI


0017476B FF75 10 PUSH DWORD PTR SS:[EBP+10]

0017476E FF75 0C PUSH DWORD PTR SS:[EBP+0C]




00174778 0F84 C1000000 JE 0017483F

0017477E B9 00040000 MOV ECX,400

00174783 854D 10 TEST DWORD PTR SS:[EBP+10],ECX

00174786 74 29 JE SHORT 001747B1


0017478B 3BC3 CMP EAX,EBX

0017478D 0F84 AC000000 JE 0017483F

00174793 3945 F8 CMP DWORD PTR SS:[EBP-8],EAX

00174796 0F8F A3000000 JG 0017483F


0017479D FF75 1C PUSH DWORD PTR SS:[EBP+1C]


001747A1 FF75 F4 PUSH DWORD PTR SS:[EBP-0C]


001747A7 FF75 0C PUSH DWORD PTR SS:[EBP+0C]

001747AA FFD6 CALL ESI

001747AC E9 8E000000 JMP 0017483F

001747B1 8B7D F8 MOV EDI,DWORD PTR SS:[EBP-8]

001747B4 3BFB CMP EDI,EBX

001747B6 7E 42 JLE SHORT 001747FA

001747B8 6A E0 PUSH -20

001747BA 33D2 XOR EDX,EDX

001747BC 58 POP EAX

001747BD F7F7 DIV EDI

001747BF 83F8 02 CMP EAX,2

001747C2 72 36 JB SHORT 001747FA

001747C4 8D443F 08 LEA EAX,[EDI+EDI+8]

001747C8 3BC1 CMP EAX,ECX

001747CA 77 16 JA SHORT 001747E2

001747CC E8 EF0A0000 CALL 001752C0


001747D1 8BFC MOV EDI,ESP

001747D3 3BFB CMP EDI,EBX

001747D5 74 68 JE SHORT 0017483F

001747D7 C707 CCCC0000 MOV DWORD PTR DS:[EDI],0CCCC

001747DD 83C7 08 ADD EDI,8

001747E0 EB 1A JMP SHORT 001747FC


001747E3 E8 E2010000 CALL 001749CA

001747E8 59 POP ECX

001747E9 3BC3 CMP EAX,EBX

001747EB 74 09 JE SHORT 001747F6

001747ED C700 DDDD0000 MOV DWORD PTR DS:[EAX],0DDDD

001747F3 83C0 08 ADD EAX,8

001747F6 8BF8 MOV EDI,EAX

001747F8 EB 02 JMP SHORT 001747FC

001747FA 33FF XOR EDI,EDI

001747FC 3BFB CMP EDI,EBX

001747FE 74 3F JE SHORT 0017483F

00174800 FF75 F8 PUSH DWORD PTR SS:[EBP-8]

00174803 57 PUSH EDI




0017480D FF75 0C PUSH DWORD PTR SS:[EBP+0C]



00174814 74 22 JE SHORT 00174838

00174816 53 PUSH EBX

00174817 53 PUSH EBX

00174818 395D 20 CMP DWORD PTR SS:[EBP+20],EBX

0017481B 75 04 JNE SHORT 00174821



0017481F EB 06 JMP SHORT 00174827


00174824 FF75 1C PUSH DWORD PTR SS:[EBP+1C]




0017482C FF75 24 PUSH DWORD PTR SS:[EBP+24]




00174838 57 PUSH EDI

00174839 E8 53FDFFFF CALL 00174591

0017483E 59 POP ECX

0017483F FF75 F4 PUSH DWORD PTR SS:[EBP-0C]

00174842 E8 4AFDFFFF CALL 00174591


0017484A 59 POP ECX

0017484B 8D65 E4 LEA ESP,[EBP-1C]

0017484E 5F POP EDI

0017484F 5E POP ESI

00174850 5B POP EBX

00174851 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]


00174856 E8 AAC7FFFF CALL 00171005

0017485B C9 LEAVE

0017485C C3 RETN




00174862 83EC 10 SUB ESP,10


00174868 8D4D F0 LEA ECX,[EBP-10]

0017486B E8 A6EBFFFF CALL 00173416


00174873 8D45 F0 LEA EAX,[EBP-10]



0017487C FF75 1C PUSH DWORD PTR SS:[EBP+1C]

0017487F FF75 18 PUSH DWORD PTR SS:[EBP+18]





0017488C E8 E5FDFFFF CALL 00174676

00174891 83C4 24 ADD ESP,24

00174894 807D FC 00 CMP BYTE PTR SS:[EBP-4],0

00174898 74 07 JE SHORT 001748A1

0017489A 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]

0017489D 8361 70 FD AND DWORD PTR DS:[ECX+70],FFFFFFFD

001748A1 C9 LEAVE

001748A2 C3 RETN





001748A8 51 PUSH ECX

001748A9 51 PUSH ECX

001748AA A1 04801700 MOV EAX,DWORD PTR DS:[178004]

001748AF 33C5 XOR EAX,EBP

001748B1 8945 FC MOV DWORD PTR SS:[EBP-4],EAX





001748B9 895D F8 MOV DWORD PTR SS:[EBP-8],EBX

001748BC 395D 1C CMP DWORD PTR SS:[EBP+1C],EBX

001748BF 75 0B JNE SHORT 001748CC


001748C4 8B00 MOV EAX,DWORD PTR DS:[EAX]

001748C6 8B40 04 MOV EAX,DWORD PTR DS:[EAX+4]

001748C9 8945 1C MOV DWORD PTR SS:[EBP+1C],EAX

001748CC 8B35 C0601700 MOV ESI,DWORD PTR DS:[1760C0]


001748D4 395D 20 CMP DWORD PTR SS:[EBP+20],EBX




001748DC 0F95C0 SETNE AL

001748DF FF75 10 PUSH DWORD PTR SS:[EBP+10]

001748E2 8D04C5 01000000 LEA EAX,[EAX*8+1]


001748EA FF75 1C PUSH DWORD PTR SS:[EBP+1C]

001748ED FFD6 CALL ESI

001748EF 8BF8 MOV EDI,EAX


001748F3 75 04 JNE SHORT 001748F9


001748F7 EB 7F JMP SHORT 00174978

001748F9 7E 3C JLE SHORT 00174937

001748FB 81FF F0FFFF7F CMP EDI,7FFFFFF0

00174901 77 34 JA SHORT 00174937

00174903 8D443F 08 LEA EAX,[EDI+EDI+8]

00174907 3D 00040000 CMP EAX,400

0017490C 77 13 JA SHORT 00174921

0017490E E8 AD090000 CALL 001752C0


00174913 8BC4 MOV EAX,ESP


00174917 74 1C JE SHORT 00174935

00174919 C700 CCCC0000 MOV DWORD PTR DS:[EAX],0CCCC

0017491F EB 11 JMP SHORT 00174932

00174921 50 PUSH EAX

00174922 E8 A3000000 CALL 001749CA

00174927 59 POP ECX


0017492A 74 09 JE SHORT 00174935

0017492C C700 DDDD0000 MOV DWORD PTR DS:[EAX],0DDDD

00174932 83C0 08 ADD EAX,8


00174937 85DB TEST EBX,EBX

00174939 ^ 74 BA JE SHORT 001748F5

0017493B 8D043F LEA EAX,[EDI+EDI]

0017493E 50 PUSH EAX

0017493F 6A 00 PUSH 0

00174941 53 PUSH EBX

00174942 E8 79FCFFFF CALL 001745C0

00174947 83C4 0C ADD ESP,0C



0017494C FF75 14 PUSH DWORD PTR SS:[EBP+14]

0017494F FF75 10 PUSH DWORD PTR SS:[EBP+10]

00174952 6A 01 PUSH 1




0017495B 74 11 JE SHORT 0017496E


00174960 50 PUSH EAX

00174961 53 PUSH EBX


00174965 FF15 C4601700 CALL DWORD PTR DS:[1760C4]

0017496B 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX


0017496F E8 1DFCFFFF CALL 00174591


00174977 59 POP ECX

00174978 8D65 EC LEA ESP,[EBP-14]

0017497B 5F POP EDI


0017497C 5E POP ESI

0017497D 5B POP EBX

0017497E 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]


00174983 E8 7DC6FFFF CALL 00171005

00174988 C9 LEAVE

00174989 C3 RETN




0017498F 83EC 10 SUB ESP,10


00174995 8D4D F0 LEA ECX,[EBP-10]

00174998 E8 79EAFFFF CALL 00173416


001749A0 8D45 F0 LEA EAX,[EBP-10]

001749A3 FF75 1C PUSH DWORD PTR SS:[EBP+1C]



001749AC FF75 10 PUSH DWORD PTR SS:[EBP+10]

001749AF FF75 0C PUSH DWORD PTR SS:[EBP+0C]


001749B3 E8 EBFEFFFF CALL 001748A3

001749B8 83C4 1C ADD ESP,1C

001749BB 807D FC 00 CMP BYTE PTR SS:[EBP-4],0

001749BF 74 07 JE SHORT 001749C8

001749C1 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]

001749C4 8361 70 FD AND DWORD PTR DS:[ECX+70],FFFFFFFD

001749C8 C9 LEAVE

001749C9 C3 RETN

001749CA 8BFF MOV EDI,EDI

001749CC 55 PUSH EBP

001749CD 8BEC MOV EBP,ESP

001749CF 53 PUSH EBX

001749D0 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+8]

001749D3 83FB E0 CMP EBX,-20

001749D6 77 6F JA SHORT 00174A47



001749DA 833D E8951700 0 CMP DWORD PTR DS:[1795E8],0

001749E1 75 18 JNE SHORT 001749FB

001749E3 E8 E2CDFFFF CALL 001717CA


001749E8 6A 1E PUSH 1E

001749EA E8 2CCCFFFF CALL 0017161B

001749EF 68 FF000000 PUSH 0FF

001749F4 E8 3CC9FFFF CALL 00171335

001749F9 59 POP ECX

001749FA 59 POP ECX

001749FB 85DB TEST EBX,EBX

001749FD 74 04 JE SHORT 00174A03

001749FF 8BC3 MOV EAX,EBX

00174A01 EB 03 JMP SHORT 00174A06


00174A05 40 INC EAX


00174A07 6A 00 PUSH 0

00174A09 FF35 E8951700 PUSH DWORD PTR DS:[1795E8]

00174A0F FF15 C8601700 CALL DWORD PTR DS:[1760C8]

00174A15 8BF8 MOV EDI,EAX

00174A17 85FF TEST EDI,EDI

00174A19 75 26 JNE SHORT 00174A41

00174A1B 6A 0C PUSH 0C

00174A1D 5E POP ESI

00174A1E 3905 A0971700 CMP DWORD PTR DS:[1797A0],EAX

00174A24 74 0D JE SHORT 00174A33


00174A27 E8 C9E2FFFF CALL 00172CF5

00174A2C 59 POP ECX

00174A2D 85C0 TEST EAX,EAX

00174A2F ^ 75 A9 JNE SHORT 001749DA

00174A31 EB 07 JMP SHORT 00174A3A

00174A33 E8 27E3FFFF CALL 00172D5F

00174A38 8930 MOV DWORD PTR DS:[EAX],ESI

00174A3A E8 20E3FFFF CALL 00172D5F

00174A3F 8930 MOV DWORD PTR DS:[EAX],ESI

00174A41 8BC7 MOV EAX,EDI

00174A43 5F POP EDI

00174A44 5E POP ESI

00174A45 EB 14 JMP SHORT 00174A5B


00174A48 E8 A8E2FFFF CALL 00172CF5

00174A4D 59 POP ECX

00174A4E E8 0CE3FFFF CALL 00172D5F

00174A53 C700 0C000000 MOV DWORD PTR DS:[EAX],0C



00174A5B 5B POP EBX

00174A5C 5D POP EBP

00174A5D C3 RETN

00174A5E 8BFF MOV EDI,EDI



00174A63 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]

00174A66 85C9 TEST ECX,ECX

00174A68 74 1B JE SHORT 00174A85

00174A6A 6A E0 PUSH -20

00174A6C 33D2 XOR EDX,EDX

00174A6E 58 POP EAX

00174A6F F7F1 DIV ECX

00174A71 3B45 0C CMP EAX,DWORD PTR SS:[EBP+0C]

00174A74 73 0F JNB SHORT 00174A85

00174A76 E8 E4E2FFFF CALL 00172D5F

00174A7B C700 0C000000 MOV DWORD PTR DS:[EAX],0C


00174A83 5D POP EBP

00174A84 C3 RETN

00174A85 0FAF4D 0C IMUL ECX,DWORD PTR SS:[EBP+0C]


00174A8A 8BF1 MOV ESI,ECX

00174A8C 85F6 TEST ESI,ESI

00174A8E 75 01 JNE SHORT 00174A91

00174A90 46 INC ESI


00174A93 83FE E0 CMP ESI,-20

00174A96 77 13 JA SHORT 00174AAB


00174A99 6A 08 PUSH 8

00174A9B FF35 E8951700 PUSH DWORD PTR DS:[1795E8]

00174AA1 FF15 C8601700 CALL DWORD PTR DS:[1760C8]

00174AA7 85C0 TEST EAX,EAX

00174AA9 75 32 JNE SHORT 00174ADD

00174AAB 833D A0971700 0 CMP DWORD PTR DS:[1797A0],0

00174AB2 74 1C JE SHORT 00174AD0

00174AB4 56 PUSH ESI

00174AB5 E8 3BE2FFFF CALL 00172CF5

00174ABA 59 POP ECX

00174ABB 85C0 TEST EAX,EAX


00174ABD ^ 75 D2 JNE SHORT 00174A91

00174ABF 8B45 10 MOV EAX,DWORD PTR SS:[EBP+10]

00174AC2 85C0 TEST EAX,EAX

00174AC4 74 06 JE SHORT 00174ACC

00174AC6 C700 0C000000 MOV DWORD PTR DS:[EAX],0C

00174ACC 33C0 XOR EAX,EAX

00174ACE EB 0D JMP SHORT 00174ADD

00174AD0 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]

00174AD3 85C9 TEST ECX,ECX

00174AD5 74 06 JE SHORT 00174ADD

00174AD7 C701 0C000000 MOV DWORD PTR DS:[ECX],0C

00174ADD 5E POP ESI

00174ADE 5D POP EBP

00174ADF C3 RETN

00174AE0 8BFF MOV EDI,EDI

00174AE2 55 PUSH EBP

00174AE3 8BEC MOV EBP,ESP

00174AE5 837D 08 00 CMP DWORD PTR SS:[EBP+8],0

00174AE9 75 0B JNE SHORT 00174AF6

00174AEB FF75 0C PUSH DWORD PTR SS:[EBP+0C]

00174AEE E8 D7FEFFFF CALL 001749CA

00174AF3 59 POP ECX

00174AF4 5D POP EBP

00174AF5 C3 RETN

00174AF6 56 PUSH ESI

00174AF7 8B75 0C MOV ESI,DWORD PTR SS:[EBP+0C]

00174AFA 85F6 TEST ESI,ESI

00174AFC 75 0D JNE SHORT 00174B0B

00174AFE FF75 08 PUSH DWORD PTR SS:[EBP+8]

00174B01 E8 E6F0FFFF CALL 00173BEC

00174B06 59 POP ECX


00174B09 EB 4D JMP SHORT 00174B58

00174B0B 57 PUSH EDI

00174B0C EB 30 JMP SHORT 00174B3E

00174B0E 85F6 TEST ESI,ESI

00174B10 75 01 JNE SHORT 00174B13

00174B12 46 INC ESI


00174B14 FF75 08 PUSH DWORD PTR SS:[EBP+8]

00174B17 6A 00 PUSH 0

00174B19 FF35 E8951700 PUSH DWORD PTR DS:[1795E8]


00174B1F FF15 CC601700 CALL DWORD PTR DS:[1760CC]

00174B25 8BF8 MOV EDI,EAX

00174B27 85FF TEST EDI,EDI

00174B29 75 5E JNE SHORT 00174B89

00174B2B 3905 A0971700 CMP DWORD PTR DS:[1797A0],EAX

00174B31 74 40 JE SHORT 00174B73


00174B34 E8 BCE1FFFF CALL 00172CF5

00174B39 59 POP ECX

00174B3A 85C0 TEST EAX,EAX

00174B3C 74 1D JE SHORT 00174B5B

00174B3E 83FE E0 CMP ESI,-20

00174B41 ^ 76 CB JBE SHORT 00174B0E


00174B44 E8 ACE1FFFF CALL 00172CF5

00174B49 59 POP ECX

00174B4A E8 10E2FFFF CALL 00172D5F

00174B4F C700 0C000000 MOV DWORD PTR DS:[EAX],0C


00174B57 5F POP EDI

00174B58 5E POP ESI

00174B59 5D POP EBP

00174B5A C3 RETN

00174B5B E8 FFE1FFFF CALL 00172D5F




00174B69 E8 AFE1FFFF CALL 00172D1D

00174B6E 59 POP ECX

00174B6F 8906 MOV DWORD PTR DS:[ESI],EAX

00174B71 ^ EB E2 JMP SHORT 00174B55

00174B73 E8 E7E1FFFF CALL 00172D5F


00174B7A FF15 74601700 CALL DWORD PTR DS:[176074]


00174B81 E8 97E1FFFF CALL 00172D1D

00174B86 59 POP ECX

00174B87 8906 MOV DWORD PTR DS:[ESI],EAX

00174B89 8BC7 MOV EAX,EDI

00174B8B ^ EB CA JMP SHORT 00174B57

00174B8D 8BFF MOV EDI,EDI

00174B8F 55 PUSH EBP




00174B93 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]

00174B96 85F6 TEST ESI,ESI

00174B98 0F84 63030000 JE 00174F01

00174B9E FF76 04 PUSH DWORD PTR DS:[ESI+4]

00174BA1 E8 46F0FFFF CALL 00173BEC

00174BA6 FF76 08 PUSH DWORD PTR DS:[ESI+8]

00174BA9 E8 3EF0FFFF CALL 00173BEC

00174BAE FF76 0C PUSH DWORD PTR DS:[ESI+0C]

00174BB1 E8 36F0FFFF CALL 00173BEC

00174BB6 FF76 10 PUSH DWORD PTR DS:[ESI+10]

00174BB9 E8 2EF0FFFF CALL 00173BEC

00174BBE FF76 14 PUSH DWORD PTR DS:[ESI+14]

00174BC1 E8 26F0FFFF CALL 00173BEC

00174BC6 FF76 18 PUSH DWORD PTR DS:[ESI+18]

00174BC9 E8 1EF0FFFF CALL 00173BEC

00174BCE FF36 PUSH DWORD PTR DS:[ESI]

00174BD0 E8 17F0FFFF CALL 00173BEC

00174BD5 FF76 20 PUSH DWORD PTR DS:[ESI+20]

00174BD8 E8 0FF0FFFF CALL 00173BEC

00174BDD FF76 24 PUSH DWORD PTR DS:[ESI+24]

00174BE0 E8 07F0FFFF CALL 00173BEC

00174BE5 FF76 28 PUSH DWORD PTR DS:[ESI+28]

00174BE8 E8 FFEFFFFF CALL 00173BEC

00174BED FF76 2C PUSH DWORD PTR DS:[ESI+2C]

00174BF0 E8 F7EFFFFF CALL 00173BEC

00174BF5 FF76 30 PUSH DWORD PTR DS:[ESI+30]

00174BF8 E8 EFEFFFFF CALL 00173BEC

00174BFD FF76 34 PUSH DWORD PTR DS:[ESI+34]

00174C00 E8 E7EFFFFF CALL 00173BEC

00174C05 FF76 1C PUSH DWORD PTR DS:[ESI+1C]

00174C08 E8 DFEFFFFF CALL 00173BEC

00174C0D FF76 38 PUSH DWORD PTR DS:[ESI+38]

00174C10 E8 D7EFFFFF CALL 00173BEC


00174C18 E8 CFEFFFFF CALL 00173BEC

00174C1D 83C4 40 ADD ESP,40

00174C20 FF76 40 PUSH DWORD PTR DS:[ESI+40]

00174C23 E8 C4EFFFFF CALL 00173BEC


00174C2B E8 BCEFFFFF CALL 00173BEC



00174C33 E8 B4EFFFFF CALL 00173BEC


00174C3B E8 ACEFFFFF CALL 00173BEC


00174C43 E8 A4EFFFFF CALL 00173BEC


00174C4B E8 9CEFFFFF CALL 00173BEC


00174C53 E8 94EFFFFF CALL 00173BEC



















00174CA0 83C4 40 ADD ESP,40

00174CA3 FFB6 80000000 PUSH DWORD PTR DS:[ESI+80]

00174CA9 E8 3EEFFFFF CALL 00173BEC

00174CAE FFB6 84000000 PUSH DWORD PTR DS:[ESI+84]

00174CB4 E8 33EFFFFF CALL 00173BEC

00174CB9 FFB6 88000000 PUSH DWORD PTR DS:[ESI+88]

00174CBF E8 28EFFFFF CALL 00173BEC

00174CC4 FFB6 8C000000 PUSH DWORD PTR DS:[ESI+8C]

00174CCA E8 1DEFFFFF CALL 00173BEC

00174CCF FFB6 90000000 PUSH DWORD PTR DS:[ESI+90]

00174CD5 E8 12EFFFFF CALL 00173BEC

00174CDA FFB6 94000000 PUSH DWORD PTR DS:[ESI+94]

00174CE0 E8 07EFFFFF CALL 00173BEC

00174CE5 FFB6 98000000 PUSH DWORD PTR DS:[ESI+98]


00174CEB E8 FCEEFFFF CALL 00173BEC

00174CF0 FFB6 9C000000 PUSH DWORD PTR DS:[ESI+9C]

00174CF6 E8 F1EEFFFF CALL 00173BEC

00174CFB FFB6 A0000000 PUSH DWORD PTR DS:[ESI+0A0]

00174D01 E8 E6EEFFFF CALL 00173BEC

00174D06 FFB6 A4000000 PUSH DWORD PTR DS:[ESI+0A4]

00174D0C E8 DBEEFFFF CALL 00173BEC

00174D11 FFB6 A8000000 PUSH DWORD PTR DS:[ESI+0A8]

00174D17 E8 D0EEFFFF CALL 00173BEC

00174D1C FFB6 BC000000 PUSH DWORD PTR DS:[ESI+0BC]

00174D22 E8 C5EEFFFF CALL 00173BEC

00174D27 FFB6 C0000000 PUSH DWORD PTR DS:[ESI+0C0]

00174D2D E8 BAEEFFFF CALL 00173BEC

00174D32 FFB6 C4000000 PUSH DWORD PTR DS:[ESI+0C4]

00174D38 E8 AFEEFFFF CALL 00173BEC

00174D3D FFB6 C8000000 PUSH DWORD PTR DS:[ESI+0C8]

00174D43 E8 A4EEFFFF CALL 00173BEC

00174D48 FFB6 CC000000 PUSH DWORD PTR DS:[ESI+0CC]

00174D4E E8 99EEFFFF CALL 00173BEC

00174D53 83C4 40 ADD ESP,40

00174D56 FFB6 D0000000 PUSH DWORD PTR DS:[ESI+0D0]

00174D5C E8 8BEEFFFF CALL 00173BEC

00174D61 FFB6 B8000000 PUSH DWORD PTR DS:[ESI+0B8]

00174D67 E8 80EEFFFF CALL 00173BEC

00174D6C FFB6 D8000000 PUSH DWORD PTR DS:[ESI+0D8]


00174D77 FFB6 DC000000 PUSH DWORD PTR DS:[ESI+0DC]

00174D7D E8 6AEEFFFF CALL 00173BEC

00174D82 FFB6 E0000000 PUSH DWORD PTR DS:[ESI+0E0]

00174D88 E8 5FEEFFFF CALL 00173BEC

00174D8D FFB6 E4000000 PUSH DWORD PTR DS:[ESI+0E4]


00174D98 FFB6 E8000000 PUSH DWORD PTR DS:[ESI+0E8]

00174D9E E8 49EEFFFF CALL 00173BEC

00174DA3 FFB6 EC000000 PUSH DWORD PTR DS:[ESI+0EC]

00174DA9 E8 3EEEFFFF CALL 00173BEC

00174DAE FFB6 D4000000 PUSH DWORD PTR DS:[ESI+0D4]

00174DB4 E8 33EEFFFF CALL 00173BEC

00174DB9 FFB6 F0000000 PUSH DWORD PTR DS:[ESI+0F0]

00174DBF E8 28EEFFFF CALL 00173BEC

00174DC4 FFB6 F4000000 PUSH DWORD PTR DS:[ESI+0F4]

00174DCA E8 1DEEFFFF CALL 00173BEC


00174DCF FFB6 F8000000 PUSH DWORD PTR DS:[ESI+0F8]

00174DD5 E8 12EEFFFF CALL 00173BEC

00174DDA FFB6 FC000000 PUSH DWORD PTR DS:[ESI+0FC]

00174DE0 E8 07EEFFFF CALL 00173BEC

00174DE5 FFB6 00010000 PUSH DWORD PTR DS:[ESI+100]

00174DEB E8 FCEDFFFF CALL 00173BEC

00174DF0 FFB6 04010000 PUSH DWORD PTR DS:[ESI+104]

00174DF6 E8 F1EDFFFF CALL 00173BEC

00174DFB FFB6 08010000 PUSH DWORD PTR DS:[ESI+108]

00174E01 E8 E6EDFFFF CALL 00173BEC

00174E06 83C4 40 ADD ESP,40

00174E09 FFB6 0C010000 PUSH DWORD PTR DS:[ESI+10C]

00174E0F E8 D8EDFFFF CALL 00173BEC

00174E14 FFB6 10010000 PUSH DWORD PTR DS:[ESI+110]

00174E1A E8 CDEDFFFF CALL 00173BEC

00174E1F FFB6 14010000 PUSH DWORD PTR DS:[ESI+114]

00174E25 E8 C2EDFFFF CALL 00173BEC

00174E2A FFB6 18010000 PUSH DWORD PTR DS:[ESI+118]

00174E30 E8 B7EDFFFF CALL 00173BEC


00174E3B E8 ACEDFFFF CALL 00173BEC


00174E46 E8 A1EDFFFF CALL 00173BEC

00174E4B FFB6 24010000 PUSH DWORD PTR DS:[ESI+124]

00174E51 E8 96EDFFFF CALL 00173BEC


00174E5C E8 8BEDFFFF CALL 00173BEC



00174E6C FFB6 30010000 PUSH DWORD PTR DS:[ESI+130]



00174E7D E8 6AEDFFFF CALL 00173BEC


00174E88 E8 5FEDFFFF CALL 00173BEC

00174E8D FFB6 3C010000 PUSH DWORD PTR DS:[ESI+13C]



00174E9E E8 49EDFFFF CALL 00173BEC

00174EA3 FFB6 44010000 PUSH DWORD PTR DS:[ESI+144]

00174EA9 E8 3EEDFFFF CALL 00173BEC

00174EAE FFB6 48010000 PUSH DWORD PTR DS:[ESI+148]


00174EB4 E8 33EDFFFF CALL 00173BEC

00174EB9 83C4 40 ADD ESP,40

00174EBC FFB6 4C010000 PUSH DWORD PTR DS:[ESI+14C]

00174EC2 E8 25EDFFFF CALL 00173BEC

00174EC7 FFB6 50010000 PUSH DWORD PTR DS:[ESI+150]

00174ECD E8 1AEDFFFF CALL 00173BEC

00174ED2 FFB6 54010000 PUSH DWORD PTR DS:[ESI+154]

00174ED8 E8 0FEDFFFF CALL 00173BEC

00174EDD FFB6 58010000 PUSH DWORD PTR DS:[ESI+158]

00174EE3 E8 04EDFFFF CALL 00173BEC

00174EE8 FFB6 5C010000 PUSH DWORD PTR DS:[ESI+15C]

00174EEE E8 F9ECFFFF CALL 00173BEC

00174EF3 FFB6 60010000 PUSH DWORD PTR DS:[ESI+160]

00174EF9 E8 EEECFFFF CALL 00173BEC

00174EFE 83C4 18 ADD ESP,18

00174F01 5E POP ESI

00174F02 5D POP EBP

00174F03 C3 RETN





00174F0A 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]

00174F0D 85F6 TEST ESI,ESI

00174F0F 74 59 JE SHORT 00174F6A

00174F11 8B06 MOV EAX,DWORD PTR DS:[ESI]

00174F13 3B05 B08A1700 CMP EAX,DWORD PTR DS:[178AB0]

00174F19 74 07 JE SHORT 00174F22


00174F1C E8 CBECFFFF CALL 00173BEC

00174F21 59 POP ECX

00174F22 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]


00174F2B 74 07 JE SHORT 00174F34


00174F2E E8 B9ECFFFF CALL 00173BEC

00174F33 59 POP ECX



00174F3D 74 07 JE SHORT 00174F46

00174F3F 50 PUSH EAX

00174F40 E8 A7ECFFFF CALL 00173BEC


00174F45 59 POP ECX


00174F49 3B05 E08A1700 CMP EAX,DWORD PTR DS:[178AE0]

00174F4F 74 07 JE SHORT 00174F58


00174F52 E8 95ECFFFF CALL 00173BEC

00174F57 59 POP ECX

00174F58 8B76 34 MOV ESI,DWORD PTR DS:[ESI+34]

00174F5B 3B35 E48A1700 CMP ESI,DWORD PTR DS:[178AE4]

00174F61 74 07 JE SHORT 00174F6A


00174F64 E8 83ECFFFF CALL 00173BEC

00174F69 59 POP ECX

00174F6A 5E POP ESI

00174F6B 5D POP EBP

00174F6C C3 RETN

00174F6D 8BFF MOV EDI,EDI

00174F6F 55 PUSH EBP



00174F73 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]

00174F76 85F6 TEST ESI,ESI

00174F78 0F84 EA000000 JE 00175068

00174F7E 8B46 0C MOV EAX,DWORD PTR DS:[ESI+0C]

00174F81 3B05 BC8A1700 CMP EAX,DWORD PTR DS:[178ABC]

00174F87 74 07 JE SHORT 00174F90


00174F8A E8 5DECFFFF CALL 00173BEC

00174F8F 59 POP ECX


00174F93 3B05 C08A1700 CMP EAX,DWORD PTR DS:[178AC0]

00174F99 74 07 JE SHORT 00174FA2


00174F9C E8 4BECFFFF CALL 00173BEC

00174FA1 59 POP ECX

00174FA2 8B46 14 MOV EAX,DWORD PTR DS:[ESI+14]

00174FA5 3B05 C48A1700 CMP EAX,DWORD PTR DS:[178AC4]

00174FAB 74 07 JE SHORT 00174FB4

00174FAD 50 PUSH EAX

00174FAE E8 39ECFFFF CALL 00173BEC

00174FB3 59 POP ECX

00174FB4 8B46 18 MOV EAX,DWORD PTR DS:[ESI+18]


00174FB7 3B05 C88A1700 CMP EAX,DWORD PTR DS:[178AC8]

00174FBD 74 07 JE SHORT 00174FC6

00174FBF 50 PUSH EAX

00174FC0 E8 27ECFFFF CALL 00173BEC

00174FC5 59 POP ECX

00174FC6 8B46 1C MOV EAX,DWORD PTR DS:[ESI+1C]

00174FC9 3B05 CC8A1700 CMP EAX,DWORD PTR DS:[178ACC]

00174FCF 74 07 JE SHORT 00174FD8

00174FD1 50 PUSH EAX

00174FD2 E8 15ECFFFF CALL 00173BEC

00174FD7 59 POP ECX

00174FD8 8B46 20 MOV EAX,DWORD PTR DS:[ESI+20]

00174FDB 3B05 D08A1700 CMP EAX,DWORD PTR DS:[178AD0]

00174FE1 74 07 JE SHORT 00174FEA

00174FE3 50 PUSH EAX

00174FE4 E8 03ECFFFF CALL 00173BEC

00174FE9 59 POP ECX

00174FEA 8B46 24 MOV EAX,DWORD PTR DS:[ESI+24]

00174FED 3B05 D48A1700 CMP EAX,DWORD PTR DS:[178AD4]

00174FF3 74 07 JE SHORT 00174FFC

00174FF5 50 PUSH EAX

00174FF6 E8 F1EBFFFF CALL 00173BEC

00174FFB 59 POP ECX

00174FFC 8B46 38 MOV EAX,DWORD PTR DS:[ESI+38]

00174FFF 3B05 E88A1700 CMP EAX,DWORD PTR DS:[178AE8]

00175005 74 07 JE SHORT 0017500E

00175007 50 PUSH EAX

00175008 E8 DFEBFFFF CALL 00173BEC

0017500D 59 POP ECX

0017500E 8B46 3C MOV EAX,DWORD PTR DS:[ESI+3C]

00175011 3B05 EC8A1700 CMP EAX,DWORD PTR DS:[178AEC]

00175017 74 07 JE SHORT 00175020

00175019 50 PUSH EAX

0017501A E8 CDEBFFFF CALL 00173BEC

0017501F 59 POP ECX


00175023 3B05 F08A1700 CMP EAX,DWORD PTR DS:[178AF0]

00175029 74 07 JE SHORT 00175032


0017502C E8 BBEBFFFF CALL 00173BEC

00175031 59 POP ECX




0017503B 74 07 JE SHORT 00175044

0017503D 50 PUSH EAX

0017503E E8 A9EBFFFF CALL 00173BEC

00175043 59 POP ECX



0017504D 74 07 JE SHORT 00175056


00175050 E8 97EBFFFF CALL 00173BEC

00175055 59 POP ECX

00175056 8B76 4C MOV ESI,DWORD PTR DS:[ESI+4C]

00175059 3B35 FC8A1700 CMP ESI,DWORD PTR DS:[178AFC]

0017505F 74 07 JE SHORT 00175068

00175061 56 PUSH ESI

00175062 E8 85EBFFFF CALL 00173BEC

00175067 59 POP ECX

00175068 5E POP ESI

00175069 5D POP EBP

0017506A C3 RETN

0017506B CC INT3

0017506C CC INT3

0017506D CC INT3

0017506E CC INT3

0017506F CC INT3

00175070 55 PUSH EBP


00175073 53 PUSH EBX

00175074 56 PUSH ESI

00175075 57 PUSH EDI

00175076 55 PUSH EBP

00175077 6A 00 PUSH 0

00175079 6A 00 PUSH 0

0017507B 68 88501700 PUSH OFFSET 00175088


00175083 E8 5C030000 CALL <JMP.RtlUnwind> ; Jump to kernel32.RtlUnwind

00175088 5D POP EBP

00175089 5F POP EDI

0017508A 5E POP ESI

0017508B 5B POP EBX

0017508C 8BE5 MOV ESP,EBP

0017508E 5D POP EBP


0017508F C3 RETN


00175094 F741 04 0600000 TEST DWORD PTR DS:[ECX+4],00000006

0017509B B8 01000000 MOV EAX,1

001750A0 74 32 JE SHORT 001750D4

001750A2 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14]

001750A6 8B48 FC MOV ECX,DWORD PTR DS:[EAX-4]

001750A9 33C8 XOR ECX,EAX

001750AB E8 55BFFFFF CALL 00171005


001750B1 8B68 10 MOV EBP,DWORD PTR DS:[EAX+10]

001750B4 8B50 28 MOV EDX,DWORD PTR DS:[EAX+28]

001750B7 52 PUSH EDX

001750B8 8B50 24 MOV EDX,DWORD PTR DS:[EAX+24]

001750BB 52 PUSH EDX

001750BC E8 14000000 CALL 001750D5

001750C1 83C4 08 ADD ESP,8

001750C4 5D POP EBP

001750C5 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]

001750C9 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10]

001750CD 8902 MOV DWORD PTR DS:[EDX],EAX

001750CF B8 03000000 MOV EAX,3

001750D4 C3 RETN




001750D8 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10]

001750DC 55 PUSH EBP

001750DD 50 PUSH EAX

001750DE 6A FE PUSH -2

001750E0 68 90501700 PUSH OFFSET 00175090

001750E5 64:FF35 0000000 PUSH DWORD PTR FS:[0]

001750EC A1 04801700 MOV EAX,DWORD PTR DS:[178004]

001750F1 33C4 XOR EAX,ESP


001750F4 8D4424 04 LEA EAX,[ESP+4]

001750F8 64:A3 00000000 MOV DWORD PTR FS:[0],EAX

001750FE 8B4424 28 MOV EAX,DWORD PTR SS:[ESP+28]

00175102 8B58 08 MOV EBX,DWORD PTR DS:[EAX+8]

00175105 8B70 0C MOV ESI,DWORD PTR DS:[EAX+0C]

00175108 83FE FF CMP ESI,-1

0017510B 74 3A JE SHORT 00175147


0017510D 837C24 2C FF CMP DWORD PTR SS:[ESP+2C],-1

00175112 74 06 JE SHORT 0017511A

00175114 3B7424 2C CMP ESI,DWORD PTR SS:[ESP+2C]

00175118 76 2D JBE SHORT 00175147

0017511A 8D3476 LEA ESI,[ESI*2+ESI]

0017511D 8B0CB3 MOV ECX,DWORD PTR DS:[ESI*4+EBX]

00175120 894C24 0C MOV DWORD PTR SS:[ESP+0C],ECX

00175124 8948 0C MOV DWORD PTR DS:[EAX+0C],ECX

00175127 837CB3 04 00 CMP DWORD PTR DS:[ESI*4+EBX+4],0

0017512C 75 17 JNE SHORT 00175145

0017512E 68 01010000 PUSH 101

00175133 8B44B3 08 MOV EAX,DWORD PTR DS:[ESI*4+EBX+8]

00175137 E8 49000000 CALL 00175185

0017513C 8B44B3 08 MOV EAX,DWORD PTR DS:[ESI*4+EBX+8]

00175140 E8 5F000000 CALL 001751A4

00175145 ^ EB B7 JMP SHORT 001750FE


0017514B 64:890D 0000000 MOV DWORD PTR FS:[0],ECX

00175152 83C4 18 ADD ESP,18

00175155 5F POP EDI

00175156 5E POP ESI

00175157 5B POP EBX

00175158 C3 RETN


0017515B 64:8B0D 0000000 MOV ECX,DWORD PTR FS:[0]

00175162 8179 04 9050170 CMP DWORD PTR DS:[ECX+4],OFFSET 00175090

00175169 75 10 JNE SHORT 0017517B

0017516B 8B51 0C MOV EDX,DWORD PTR DS:[ECX+0C]

0017516E 8B52 0C MOV EDX,DWORD PTR DS:[EDX+0C]

00175171 3951 08 CMP DWORD PTR DS:[ECX+8],EDX

00175174 75 05 JNE SHORT 0017517B

00175176 B8 01000000 MOV EAX,1

0017517B C3 RETN

0017517C 53 PUSH EBX

0017517D 51 PUSH ECX

0017517E BB 108B1700 MOV EBX,OFFSET 00178B10

00175183 EB 0B JMP SHORT 00175190

00175185 53 PUSH EBX

00175186 51 PUSH ECX

00175187 BB 108B1700 MOV EBX,OFFSET 00178B10

0017518C 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+0C]

00175190 894B 08 MOV DWORD PTR DS:[EBX+8],ECX


00175193 8943 04 MOV DWORD PTR DS:[EBX+4],EAX

00175196 896B 0C MOV DWORD PTR DS:[EBX+0C],EBP

00175199 55 PUSH EBP

0017519A 51 PUSH ECX


0017519C 58 POP EAX

0017519D 59 POP ECX

0017519E 5D POP EBP

0017519F 59 POP ECX

001751A0 5B POP EBX

001751A1 C2 0400 RETN 4

001751A4 FFD0 CALL EAX

001751A6 C3 RETN


001751A8 8BC6 MOV EAX,ESI

001751AA 83E0 0F AND EAX,0000000F

001751AD 85C0 TEST EAX,EAX

001751AF 0F85 C1000000 JNE 00175276

001751B5 8BD1 MOV EDX,ECX

001751B7 83E1 7F AND ECX,0000007F

001751BA C1EA 07 SHR EDX,7

001751BD 74 65 JE SHORT 00175224

001751BF EB 06 JMP SHORT 001751C7

001751C1 8D9B 00000000 LEA EBX,[EBX]

001751C7 660F6F06 MOVDQA XMM0,DQWORD PTR DS:[ESI]

001751CB 660F6F4E 10 MOVDQA XMM1,DQWORD PTR DS:[ESI+10]

001751D0 660F6F56 20 MOVDQA XMM2,DQWORD PTR DS:[ESI+20]

001751D5 660F6F5E 30 MOVDQA XMM3,DQWORD PTR DS:[ESI+30]

001751DA 660F7F07 MOVDQA DQWORD PTR DS:[EDI],XMM0

001751DE 660F7F4F 10 MOVDQA DQWORD PTR DS:[EDI+10],XMM1

001751E3 660F7F57 20 MOVDQA DQWORD PTR DS:[EDI+20],XMM2

001751E8 660F7F5F 30 MOVDQA DQWORD PTR DS:[EDI+30],XMM3

001751ED 660F6F66 40 MOVDQA XMM4,DQWORD PTR DS:[ESI+40]

001751F2 660F6F6E 50 MOVDQA XMM5,DQWORD PTR DS:[ESI+50]

001751F7 660F6F76 60 MOVDQA XMM6,DQWORD PTR DS:[ESI+60]

001751FC 660F6F7E 70 MOVDQA XMM7,DQWORD PTR DS:[ESI+70]

00175201 660F7F67 40 MOVDQA DQWORD PTR DS:[EDI+40],XMM4

00175206 660F7F6F 50 MOVDQA DQWORD PTR DS:[EDI+50],XMM5

0017520B 660F7F77 60 MOVDQA DQWORD PTR DS:[EDI+60],XMM6

00175210 660F7F7F 70 MOVDQA DQWORD PTR DS:[EDI+70],XMM7

00175215 8DB6 80000000 LEA ESI,[ESI+80]

0017521B 8DBF 80000000 LEA EDI,[EDI+80]


00175221 4A DEC EDX

00175222 ^ 75 A3 JNE SHORT 001751C7


00175226 74 49 JE SHORT 00175271

00175228 8BD1 MOV EDX,ECX

0017522A C1EA 04 SHR EDX,4

0017522D 85D2 TEST EDX,EDX

0017522F 74 17 JE SHORT 00175248

00175231 8D9B 00000000 LEA EBX,[EBX]

00175237 660F6F06 MOVDQA XMM0,DQWORD PTR DS:[ESI]

0017523B 660F7F07 MOVDQA DQWORD PTR DS:[EDI],XMM0

0017523F 8D76 10 LEA ESI,[ESI+10]

00175242 8D7F 10 LEA EDI,[EDI+10]

00175245 4A DEC EDX

00175246 ^ 75 EF JNE SHORT 00175237

00175248 83E1 0F AND ECX,0000000F

0017524B 74 24 JE SHORT 00175271

0017524D 8BC1 MOV EAX,ECX

0017524F C1E9 02 SHR ECX,2

00175252 74 0D JE SHORT 00175261

00175254 8B16 MOV EDX,DWORD PTR DS:[ESI]

00175256 8917 MOV DWORD PTR DS:[EDI],EDX

00175258 8D76 04 LEA ESI,[ESI+4]

0017525B 8D7F 04 LEA EDI,[EDI+4]

0017525E 49 DEC ECX

0017525F ^ 75 F3 JNE SHORT 00175254


00175263 83E1 03 AND ECX,00000003

00175266 74 09 JE SHORT 00175271

00175268 8A06 MOV AL,BYTE PTR DS:[ESI]

0017526A 8807 MOV BYTE PTR DS:[EDI],AL

0017526C 46 INC ESI

0017526D 47 INC EDI

0017526E 49 DEC ECX

0017526F ^ 75 F7 JNE SHORT 00175268

00175271 58 POP EAX

00175272 5E POP ESI

00175273 5F POP EDI

00175274 5D POP EBP

00175275 C3 RETN

00175276 BA 10000000 MOV EDX,10

0017527B 2BD0 SUB EDX,EAX


0017527D 2BCA SUB ECX,EDX

0017527F 51 PUSH ECX

00175280 8BC2 MOV EAX,EDX


00175284 83E1 03 AND ECX,00000003

00175287 74 09 JE SHORT 00175292

00175289 8A16 MOV DL,BYTE PTR DS:[ESI]

0017528B 8817 MOV BYTE PTR DS:[EDI],DL

0017528D 46 INC ESI

0017528E 47 INC EDI

0017528F 49 DEC ECX

00175290 ^ 75 F7 JNE SHORT 00175289

00175292 C1E8 02 SHR EAX,2

00175295 74 0D JE SHORT 001752A4

00175297 8B16 MOV EDX,DWORD PTR DS:[ESI]

00175299 8917 MOV DWORD PTR DS:[EDI],EDX

0017529B 8D76 04 LEA ESI,[ESI+4]

0017529E 8D7F 04 LEA EDI,[EDI+4]

001752A1 48 DEC EAX

001752A2 ^ 75 F3 JNE SHORT 00175297

001752A4 59 POP ECX

001752A5 ^ E9 0BFFFFFF JMP 001751B5

001752AA 6A 0A PUSH 0A

001752AC FF15 D0601700 CALL DWORD PTR DS:[1760D0]

001752B2 A3 A4971700 MOV DWORD PTR DS:[1797A4],EAX


001752B9 C3 RETN

001752BA CC INT3

001752BB CC INT3

001752BC CC INT3

001752BD CC INT3

001752BE CC INT3

001752BF CC INT3

001752C0 51 PUSH ECX

001752C1 8D4C24 08 LEA ECX,[ESP+8]

001752C5 2BC8 SUB ECX,EAX

001752C7 83E1 0F AND ECX,0000000F

001752CA 03C1 ADD EAX,ECX

001752CC 1BC9 SBB ECX,ECX

001752CE 0BC1 OR EAX,ECX

001752D0 59 POP ECX

001752D1 E9 DA000000 JMP 001753B0



001752D7 8D4C24 08 LEA ECX,[ESP+8]

001752DB 2BC8 SUB ECX,EAX

001752DD 83E1 07 AND ECX,00000007

001752E0 03C1 ADD EAX,ECX

001752E2 1BC9 SBB ECX,ECX

001752E4 0BC1 OR EAX,ECX

001752E6 59 POP ECX

001752E7 E9 C4000000 JMP 001753B0

001752EC 660FEFC0 PXOR XMM0,XMM0

001752F0 51 PUSH ECX

001752F1 53 PUSH EBX

001752F2 8BC1 MOV EAX,ECX

001752F4 83E0 0F AND EAX,0000000F


001752F9 75 7F JNE SHORT 0017537A

001752FB 8BC2 MOV EAX,EDX

001752FD 83E2 7F AND EDX,0000007F

00175300 C1E8 07 SHR EAX,7

00175303 74 37 JE SHORT 0017533C

00175305 8DA424 00000000 LEA ESP,[ESP]

0017530C 660F7F01 MOVDQA DQWORD PTR DS:[ECX],XMM0

00175310 660F7F41 10 MOVDQA DQWORD PTR DS:[ECX+10],XMM0


0017531A 660F7F41 30 MOVDQA DQWORD PTR DS:[ECX+30],XMM0

0017531F 660F7F41 40 MOVDQA DQWORD PTR DS:[ECX+40],XMM0



0017532E 660F7F41 70 MOVDQA DQWORD PTR DS:[ECX+70],XMM0

00175333 8D89 80000000 LEA ECX,[ECX+80]

00175339 48 DEC EAX

0017533A ^ 75 D0 JNE SHORT 0017530C

0017533C 85D2 TEST EDX,EDX

0017533E 74 37 JE SHORT 00175377

00175340 8BC2 MOV EAX,EDX

00175342 C1E8 04 SHR EAX,4

00175345 74 0F JE SHORT 00175356

00175347 EB 03 JMP SHORT 0017534C

00175349 8D49 00 LEA ECX,[ECX]

0017534C 660F7F01 MOVDQA DQWORD PTR DS:[ECX],XMM0

00175350 8D49 10 LEA ECX,[ECX+10]

00175353 48 DEC EAX


00175354 ^ 75 F6 JNE SHORT 0017534C

00175356 83E2 0F AND EDX,0000000F

00175359 74 1C JE SHORT 00175377

0017535B 8BC2 MOV EAX,EDX

0017535D 33DB XOR EBX,EBX

0017535F C1EA 02 SHR EDX,2

00175362 74 08 JE SHORT 0017536C

00175364 8919 MOV DWORD PTR DS:[ECX],EBX

00175366 8D49 04 LEA ECX,[ECX+4]

00175369 4A DEC EDX

0017536A ^ 75 F8 JNE SHORT 00175364

0017536C 83E0 03 AND EAX,00000003

0017536F 74 06 JE SHORT 00175377

00175371 8819 MOV BYTE PTR DS:[ECX],BL

00175373 41 INC ECX

00175374 48 DEC EAX

00175375 ^ 75 FA JNE SHORT 00175371

00175377 5B POP EBX

00175378 58 POP EAX

00175379 C3 RETN

0017537A 8BD8 MOV EBX,EAX

0017537C F7DB NEG EBX

0017537E 83C3 10 ADD EBX,10

00175381 2BD3 SUB EDX,EBX


00175385 52 PUSH EDX

00175386 8BD3 MOV EDX,EBX

00175388 83E2 03 AND EDX,00000003

0017538B 74 06 JE SHORT 00175393

0017538D 8801 MOV BYTE PTR DS:[ECX],AL

0017538F 41 INC ECX

00175390 4A DEC EDX

00175391 ^ 75 FA JNE SHORT 0017538D

00175393 C1EB 02 SHR EBX,2

00175396 74 08 JE SHORT 001753A0

00175398 8901 MOV DWORD PTR DS:[ECX],EAX

0017539A 8D49 04 LEA ECX,[ECX+4]

0017539D 4B DEC EBX

0017539E ^ 75 F8 JNE SHORT 00175398

001753A0 5A POP EDX

001753A1 ^ E9 55FFFFFF JMP 001752FB

001753A6 CC INT3


001753A7 CC INT3

001753A8 CC INT3

001753A9 CC INT3

001753AA CC INT3

001753AB CC INT3

001753AC CC INT3

001753AD CC INT3

001753AE CC INT3

001753AF CC INT3


001753B1 8D4C24 04 LEA ECX,[ESP+4]

001753B5 2BC8 SUB ECX,EAX

001753B7 1BC0 SBB EAX,EAX

001753B9 F7D0 NOT EAX

001753BB 23C8 AND ECX,EAX

001753BD 8BC4 MOV EAX,ESP

001753BF 25 00F0FFFF AND EAX,FFFFF000

001753C4 3BC8 CMP ECX,EAX

001753C6 72 0A JB SHORT 001753D2

001753C8 8BC1 MOV EAX,ECX

001753CA 59 POP ECX

001753CB 94 XCHG EAX,ESP

001753CC 8B00 MOV EAX,DWORD PTR DS:[EAX]

001753CE 890424 MOV DWORD PTR SS:[ESP],EAX

001753D1 C3 RETN

001753D2 2D 00100000 SUB EAX,1000

001753D7 8500 TEST DWORD PTR DS:[EAX],EAX

001753D9 ^ EB E9 JMP SHORT 001753C4

001753DB CC INT3

001753DC 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]

001753E0 C2 0400 RETN 4

001753E3 CC INT3

001753E4 - FF25 B4601700 JMP DWORD PTR DS:[1760B4]

001753EA 0000 ADD BYTE PTR DS:[EAX],AL

001753EC 0000 ADD BYTE PTR DS:[EAX],AL

001753EE 0000 ADD BYTE PTR DS:[EAX],AL

001753F0 0000 ADD BYTE PTR DS:[EAX],AL





001753FA 0000 ADD BYTE PTR DS:[EAX],AL


001753FC 0000 ADD BYTE PTR DS:[EAX],AL

001753FE 0000 ADD BYTE PTR DS:[EAX],AL

00175400 0000 ADD BYTE PTR DS:[EAX],AL





0017540A 0000 ADD BYTE PTR DS:[EAX],AL

0017540C 0000 ADD BYTE PTR DS:[EAX],AL

0017540E 0000 ADD BYTE PTR DS:[EAX],AL










































































001754A0 0000 ADD BYTE PTR DS:[EAX],AL






001754AA 0000 ADD BYTE PTR DS:[EAX],AL

001754AC 0000 ADD BYTE PTR DS:[EAX],AL

001754AE 0000 ADD BYTE PTR DS:[EAX],AL

001754B0 0000 ADD BYTE PTR DS:[EAX],AL





001754BA 0000 ADD BYTE PTR DS:[EAX],AL

001754BC 0000 ADD BYTE PTR DS:[EAX],AL

001754BE 0000 ADD BYTE PTR DS:[EAX],AL

001754C0 0000 ADD BYTE PTR DS:[EAX],AL





001754CA 0000 ADD BYTE PTR DS:[EAX],AL

001754CC 0000 ADD BYTE PTR DS:[EAX],AL

001754CE 0000 ADD BYTE PTR DS:[EAX],AL






001754DA 0000 ADD BYTE PTR DS:[EAX],AL

001754DC 0000 ADD BYTE PTR DS:[EAX],AL

001754DE 0000 ADD BYTE PTR DS:[EAX],AL

001754E0 0000 ADD BYTE PTR DS:[EAX],AL
































00175A0A 0000 ADD BYTE PTR DS:[EAX],AL

00175A0C 0000 ADD BYTE PTR DS:[EAX],AL

00175A0E 0000 ADD BYTE PTR DS:[EAX],AL
































00175AA0 0000 ADD BYTE PTR DS:[EAX],AL





00175AAA 0000 ADD BYTE PTR DS:[EAX],AL

00175AAC 0000 ADD BYTE PTR DS:[EAX],AL

00175AAE 0000 ADD BYTE PTR DS:[EAX],AL

00175AB0 0000 ADD BYTE PTR DS:[EAX],AL





00175ABA 0000 ADD BYTE PTR DS:[EAX],AL

00175ABC 0000 ADD BYTE PTR DS:[EAX],AL

00175ABE 0000 ADD BYTE PTR DS:[EAX],AL

00175AC0 0000 ADD BYTE PTR DS:[EAX],AL





00175ACA 0000 ADD BYTE PTR DS:[EAX],AL

00175ACC 0000 ADD BYTE PTR DS:[EAX],AL

00175ACE 0000 ADD BYTE PTR DS:[EAX],AL

00175AD0 0000 ADD BYTE PTR DS:[EAX],AL





00175ADA 0000 ADD BYTE PTR DS:[EAX],AL

00175ADC 0000 ADD BYTE PTR DS:[EAX],AL

00175ADE 0000 ADD BYTE PTR DS:[EAX],AL


00175AE0 0000 ADD BYTE PTR DS:[EAX],AL





00175AEA 0000 ADD BYTE PTR DS:[EAX],AL

00175AEC 0000 ADD BYTE PTR DS:[EAX],AL

00175AEE 0000 ADD BYTE PTR DS:[EAX],AL

00175AF0 0000 ADD BYTE PTR DS:[EAX],AL





00175AFA 0000 ADD BYTE PTR DS:[EAX],AL

00175AFC 0000 ADD BYTE PTR DS:[EAX],AL

00175AFE 0000 ADD BYTE PTR DS:[EAX],AL






00175B0A 0000 ADD BYTE PTR DS:[EAX],AL

00175B0C 0000 ADD BYTE PTR DS:[EAX],AL

00175B0E 0000 ADD BYTE PTR DS:[EAX],AL
































00175BA0 0000 ADD BYTE PTR DS:[EAX],AL





00175BAA 0000 ADD BYTE PTR DS:[EAX],AL

00175BAC 0000 ADD BYTE PTR DS:[EAX],AL

00175BAE 0000 ADD BYTE PTR DS:[EAX],AL

00175BB0 0000 ADD BYTE PTR DS:[EAX],AL





00175BBA 0000 ADD BYTE PTR DS:[EAX],AL

00175BBC 0000 ADD BYTE PTR DS:[EAX],AL

00175BBE 0000 ADD BYTE PTR DS:[EAX],AL

00175BC0 0000 ADD BYTE PTR DS:[EAX],AL





00175BCA 0000 ADD BYTE PTR DS:[EAX],AL

00175BCC 0000 ADD BYTE PTR DS:[EAX],AL

00175BCE 0000 ADD BYTE PTR DS:[EAX],AL

00175BD0 0000 ADD BYTE PTR DS:[EAX],AL





00175BDA 0000 ADD BYTE PTR DS:[EAX],AL


00175BDC 0000 ADD BYTE PTR DS:[EAX],AL

00175BDE 0000 ADD BYTE PTR DS:[EAX],AL

00175BE0 0000 ADD BYTE PTR DS:[EAX],AL





00175BEA 0000 ADD BYTE PTR DS:[EAX],AL

00175BEC 0000 ADD BYTE PTR DS:[EAX],AL

00175BEE 0000 ADD BYTE PTR DS:[EAX],AL

00175BF0 0000 ADD BYTE PTR DS:[EAX],AL





00175BFA 0000 ADD BYTE PTR DS:[EAX],AL

00175BFC 0000 ADD BYTE PTR DS:[EAX],AL

00175BFE 0000 ADD BYTE PTR DS:[EAX],AL






00175C0A 0000 ADD BYTE PTR DS:[EAX],AL

00175C0C 0000 ADD BYTE PTR DS:[EAX],AL

00175C0E 0000 ADD BYTE PTR DS:[EAX],AL
































00175CA0 0000 ADD BYTE PTR DS:[EAX],AL





00175CAA 0000 ADD BYTE PTR DS:[EAX],AL

00175CAC 0000 ADD BYTE PTR DS:[EAX],AL

00175CAE 0000 ADD BYTE PTR DS:[EAX],AL

00175CB0 0000 ADD BYTE PTR DS:[EAX],AL





00175CBA 0000 ADD BYTE PTR DS:[EAX],AL

00175CBC 0000 ADD BYTE PTR DS:[EAX],AL

00175CBE 0000 ADD BYTE PTR DS:[EAX],AL

00175CC0 0000 ADD BYTE PTR DS:[EAX],AL





00175CCA 0000 ADD BYTE PTR DS:[EAX],AL

00175CCC 0000 ADD BYTE PTR DS:[EAX],AL

00175CCE 0000 ADD BYTE PTR DS:[EAX],AL

00175CD0 0000 ADD BYTE PTR DS:[EAX],AL






00175CDA 0000 ADD BYTE PTR DS:[EAX],AL

00175CDC 0000 ADD BYTE PTR DS:[EAX],AL

00175CDE 0000 ADD BYTE PTR DS:[EAX],AL

00175CE0 0000 ADD BYTE PTR DS:[EAX],AL





00175CEA 0000 ADD BYTE PTR DS:[EAX],AL

00175CEC 0000 ADD BYTE PTR DS:[EAX],AL

00175CEE 0000 ADD BYTE PTR DS:[EAX],AL

00175CF0 0000 ADD BYTE PTR DS:[EAX],AL





00175CFA 0000 ADD BYTE PTR DS:[EAX],AL

00175CFC 0000 ADD BYTE PTR DS:[EAX],AL

00175CFE 0000 ADD BYTE PTR DS:[EAX],AL






00175D0A 0000 ADD BYTE PTR DS:[EAX],AL

00175D0C 0000 ADD BYTE PTR DS:[EAX],AL

00175D0E 0000 ADD BYTE PTR DS:[EAX],AL
































00175DA0 0000 ADD BYTE PTR DS:[EAX],AL





00175DAA 0000 ADD BYTE PTR DS:[EAX],AL

00175DAC 0000 ADD BYTE PTR DS:[EAX],AL

00175DAE 0000 ADD BYTE PTR DS:[EAX],AL

00175DB0 0000 ADD BYTE PTR DS:[EAX],AL





00175DBA 0000 ADD BYTE PTR DS:[EAX],AL

00175DBC 0000 ADD BYTE PTR DS:[EAX],AL

00175DBE 0000 ADD BYTE PTR DS:[EAX],AL

00175DC0 0000 ADD BYTE PTR DS:[EAX],AL





00175DCA 0000 ADD BYTE PTR DS:[EAX],AL

00175DCC 0000 ADD BYTE PTR DS:[EAX],AL

00175DCE 0000 ADD BYTE PTR DS:[EAX],AL

00175DD0 0000 ADD BYTE PTR DS:[EAX],AL






00175DDA 0000 ADD BYTE PTR DS:[EAX],AL

00175DDC 0000 ADD BYTE PTR DS:[EAX],AL

00175DDE 0000 ADD BYTE PTR DS:[EAX],AL

00175DE0 0000 ADD BYTE PTR DS:[EAX],AL





00175DEA 0000 ADD BYTE PTR DS:[EAX],AL

00175DEC 0000 ADD BYTE PTR DS:[EAX],AL

00175DEE 0000 ADD BYTE PTR DS:[EAX],AL

00175DF0 0000 ADD BYTE PTR DS:[EAX],AL





00175DFA 0000 ADD BYTE PTR DS:[EAX],AL

00175DFC 0000 ADD BYTE PTR DS:[EAX],AL

00175DFE 0000 ADD BYTE PTR DS:[EAX],AL






00175E0A 0000 ADD BYTE PTR DS:[EAX],AL

00175E0C 0000 ADD BYTE PTR DS:[EAX],AL

00175E0E 0000 ADD BYTE PTR DS:[EAX],AL
































00175EA0 0000 ADD BYTE PTR DS:[EAX],AL





00175EAA 0000 ADD BYTE PTR DS:[EAX],AL

00175EAC 0000 ADD BYTE PTR DS:[EAX],AL

00175EAE 0000 ADD BYTE PTR DS:[EAX],AL

00175EB0 0000 ADD BYTE PTR DS:[EAX],AL





00175EBA 0000 ADD BYTE PTR DS:[EAX],AL

00175EBC 0000 ADD BYTE PTR DS:[EAX],AL

00175EBE 0000 ADD BYTE PTR DS:[EAX],AL

00175EC0 0000 ADD BYTE PTR DS:[EAX],AL





00175ECA 0000 ADD BYTE PTR DS:[EAX],AL

00175ECC 0000 ADD BYTE PTR DS:[EAX],AL

00175ECE 0000 ADD BYTE PTR DS:[EAX],AL


00175ED0 0000 ADD BYTE PTR DS:[EAX],AL





00175EDA 0000 ADD BYTE PTR DS:[EAX],AL

00175EDC 0000 ADD BYTE PTR DS:[EAX],AL

00175EDE 0000 ADD BYTE PTR DS:[EAX],AL

00175EE0 0000 ADD BYTE PTR DS:[EAX],AL





00175EEA 0000 ADD BYTE PTR DS:[EAX],AL

00175EEC 0000 ADD BYTE PTR DS:[EAX],AL

00175EEE 0000 ADD BYTE PTR DS:[EAX],AL

00175EF0 0000 ADD BYTE PTR DS:[EAX],AL





00175EFA 0000 ADD BYTE PTR DS:[EAX],AL

00175EFC 0000 ADD BYTE PTR DS:[EAX],AL

00175EFE 0000 ADD BYTE PTR DS:[EAX],AL






00175F0A 0000 ADD BYTE PTR DS:[EAX],AL

00175F0C 0000 ADD BYTE PTR DS:[EAX],AL

00175F0E 0000 ADD BYTE PTR DS:[EAX],AL
































00175FA0 0000 ADD BYTE PTR DS:[EAX],AL





00175FAA 0000 ADD BYTE PTR DS:[EAX],AL

00175FAC 0000 ADD BYTE PTR DS:[EAX],AL

00175FAE 0000 ADD BYTE PTR DS:[EAX],AL

00175FB0 0000 ADD BYTE PTR DS:[EAX],AL





00175FBA 0000 ADD BYTE PTR DS:[EAX],AL

00175FBC 0000 ADD BYTE PTR DS:[EAX],AL

00175FBE 0000 ADD BYTE PTR DS:[EAX],AL

00175FC0 0000 ADD BYTE PTR DS:[EAX],AL





00175FCA 0000 ADD BYTE PTR DS:[EAX],AL


00175FCC 0000 ADD BYTE PTR DS:[EAX],AL

00175FCE 0000 ADD BYTE PTR DS:[EAX],AL

00175FD0 0000 ADD BYTE PTR DS:[EAX],AL





00175FDA 0000 ADD BYTE PTR DS:[EAX],AL

00175FDC 0000 ADD BYTE PTR DS:[EAX],AL

00175FDE 0000 ADD BYTE PTR DS:[EAX],AL

00175FE0 0000 ADD BYTE PTR DS:[EAX],AL





00175FEA 0000 ADD BYTE PTR DS:[EAX],AL

00175FEC 0000 ADD BYTE PTR DS:[EAX],AL

00175FEE 0000 ADD BYTE PTR DS:[EAX],AL

00175FF0 0000 ADD BYTE PTR DS:[EAX],AL





00175FFA 0000 ADD BYTE PTR DS:[EAX],AL

00175FFC 0000 ADD BYTE PTR DS:[EAX],AL

00175FFE 0000 ADD BYTE PTR DS:[EAX],AL

Log data

Address Message

OllyDbg v2.01

Command line: "C:\Documents and Settings\Administrator\Desktop\cczice.cmd"

File 'C:\Documents and Settings\Administrator\Desktop\cczice.cmd'

New process (ID 00000654) created

00403BC1 Main thread (ID 000001F0) created


00400000 Module 'C:\Documents and Settings\Administrator\Desktop\cczice.cmd'

77F10000 Module 'C:\WINDOWS\system32\GDI32.dll'

7C800000 Module 'C:\WINDOWS\system32\kernel32.dll'

7C900000 Module 'C:\WINDOWS\system32\ntdll.dll'

7E410000 Module 'C:\WINDOWS\system32\USER32.dll'

Analysing ntdll

3652 fuzzy procedures

3087 calls to known, 2752 calls to guessed functions

111 switches, 776 loops

Analysing kernel32




Analysing GDI32




Analysing USER32




Analysing cczice




00403BC1 Entry point of main module

629C0000 Module 'C:\WINDOWS\system32\LPK.DLL'

74D90000 Module 'C:\WINDOWS\system32\USP10.dll'


76390000 Module 'C:\WINDOWS\system32\IMM32.DLL'

77DD0000 Module 'C:\WINDOWS\system32\ADVAPI32.dll'

77E70000 Module 'C:\WINDOWS\system32\RPCRT4.dll'

Code sections '.text' and '.orpc' will be merged to a single memory block

77FE0000 Module 'C:\WINDOWS\system32\Secur32.dll'

Analysing ADVAPI32




Analysing Secur32




Analysing RPCRT 5301 fuzzy procedures



Analysing IMM32




Analysing USP10




Analysing LPK

51 fuzzy procedures




Analysing cczice




Analysing cczice




References

1. Practical Malware Analysis by by Michael Sikorski and Andrew Honig2. Reverse Deception- Organized Cyber Threat Counter-Exploitation - by Sean Bodmer3. http://www.threatexpert.com/ 4. https://www.virustotal.com/en/ 5. http://thelegendofrandom.com/blog/archives/1156. Reversing - Secrets Of Reverse Engineering (2005) by Eldad Eilam 7. https://quequero.org/2013/04/mcrat-malware-analysis-part1/ last Viewed November 13,

20148. http://writequit.org/blog/?p=165 last viewed November 13, 2014 9. Resources form www.google.com


http://www.google.com/

http://writequit.org/blog/?p=165

https://quequero.org/2013/04/mcrat-malware-analysis-part1/

https://www.virustotal.com/en/

http://www.threatexpert.com/

report on malware analysis

Documents

antivirus signatures

antivirus firewall

form of malware

lowprofile malware

malicious agents

users data

risk of malicious software

particular piece of