Code:
0051591F /$ 833D B8CA9D00>CMP DWORD PTR DS:[9DCAB8],0
00515926 74 64 JE SHORT 0051598C
00515928 |. 8B15 1C34A500 MOV EDX,DWORD PTR DS:[A5341C]
0051592E |. 85D2 TEST EDX,EDX
00515930 |. 74 57 JE SHORT 00515989
00515932 |. 56 PUSH ESI
00515933 |. C682 25010000>MOV BYTE PTR DS:[EDX+125],1
0051593A |. C682 60030000>MOV BYTE PTR DS:[EDX+360],1
00515941 |. E8 DBFAFFFF CALL 00515421
00515946 |. 8BF0 MOV ESI,EAX
00515948 |. 81C2 60010000 ADD EDX,160
0051594E |. 56 PUSH ESI ; |format
0051594F |. 52 PUSH EDX ; |s
00515950 |. FF15 E4558600 CALL DWORD PTR DS:[<&msvcr90.sprintf>] ; \sprintf
00515956 |. A1 1C34A500 MOV EAX,DWORD PTR DS:[A5341C]
0051595B |. 59 POP ECX
0051595C |. 59 POP ECX
0051595D |. 56 PUSH ESI
0051595E |. 68 9A020000 PUSH 29A
00515963 |. 05 D8E80B00 ADD EAX,0BE8D8
00515968 |. E8 2F48FCFF CALL 004DA19C
0051596D |. 6A 00 PUSH 0
0051596F |. E8 2EFFFFFF CALL 005158A2
00515974 |. 56 PUSH ESI
00515975 |. E8 12B12B00 CALL <JMP.&msvcr90.??_V@YAXPAX@Z>
0051597A |. C70424 E80300>MOV DWORD PTR SS:[ESP],3E8
00515981 |. FF15 40578600 CALL DWORD PTR DS:[<&msvcr90._sleep>] ; MSVCR90._sleep
00515987 |. 59 POP ECX
00515988 |. 5E POP ESI
00515989 |> B0 01 MOV AL,1
0051598B |. C3 RETN
0051598C |> 32C0 XOR AL,AL
0051598E \. C3 RETN
Code:
005E5E53 . 55 PUSH EBP
005E5E54 . 8DAC24 D8EEFF>LEA EBP,DWORD PTR SS:[ESP-1128]
005E5E5B . B8 A8110000 MOV EAX,11A8
005E5E60 . E8 1BB31E00 CALL 007D1180
005E5E65 . A1 D41C9100 MOV EAX,DWORD PTR DS:[911CD4]
005E5E6A . 33C5 XOR EAX,EBP
005E5E6C . 8985 24110000 MOV DWORD PTR SS:[EBP+1124],EAX
005E5E72 . 8B85 30110000 MOV EAX,DWORD PTR SS:[EBP+1130]
005E5E78 . 8365 88 00 AND DWORD PTR SS:[EBP-78],0
005E5E7C . 53 PUSH EBX
005E5E7D . 56 PUSH ESI
005E5E7E . 8BB0 D0570000 MOV ESI,DWORD PTR DS:[EAX+57D0]
005E5E84 . 57 PUSH EDI
005E5E85 . 8DBE 0C400000 LEA EDI,DWORD PTR DS:[ESI+400C]
005E5E8B . 56 PUSH ESI
005E5E8C . 8BCF MOV ECX,EDI
005E5E8E . 8945 80 MOV DWORD PTR SS:[EBP-80],EAX
005E5E91 . E8 9AC00800 CALL 00671F30
005E5E96 . 8D4D 88 LEA ECX,DWORD PTR SS:[EBP-78]
005E5E99 . 51 PUSH ECX
005E5E9A . 50 PUSH EAX
005E5E9B . 8BCF MOV ECX,EDI
005E5E9D . E8 5EC00800 CALL 00671F00
005E5EA2 . BB 00040000 MOV EBX,400
005E5EA7 . 53 PUSH EBX
005E5EA8 . 8D8D 24090000 LEA ECX,DWORD PTR SS:[EBP+924]
005E5EAE . 51 PUSH ECX
005E5EAF . 50 PUSH EAX
005E5EB0 . 8BCF MOV ECX,EDI
005E5EB2 . E8 E9C00800 CALL 00671FA0
005E5EB7 . 50 PUSH EAX
005E5EB8 . 8BCF MOV ECX,EDI
005E5EBA . E8 A1C00800 CALL 00671F60
005E5EBF . 8B45 88 MOV EAX,DWORD PTR SS:[EBP-78]
005E5EC2 . 03C0 ADD EAX,EAX
005E5EC4 . 33FF XOR EDI,EDI
005E5EC6 . 85C0 TEST EAX,EAX
005E5EC8 . 7E 43 JLE SHORT 005E5F0D
005E5ECA > 3BFB CMP EDI,EBX
005E5ECC . 7D 50 JGE SHORT 005E5F1E
005E5ECE . 8A8C7D 240900>MOV CL,BYTE PTR SS:[EBP+EDI*2+924]
005E5ED5 . 80F9 41 CMP CL,41
005E5ED8 . 0FBEC9 MOVSX ECX,CL
005E5EDB . 7C 05 JL SHORT 005E5EE2
005E5EDD . 83E9 37 SUB ECX,37
005E5EE0 . EB 03 JMP SHORT 005E5EE5
005E5EE2 > 83E9 30 SUB ECX,30
005E5EE5 > 8A947D 250900>MOV DL,BYTE PTR SS:[EBP+EDI*2+925]
005E5EEC . 80FA 41 CMP DL,41
005E5EEF . 0FBED2 MOVSX EDX,DL
005E5EF2 . 7C 05 JL SHORT 005E5EF9
005E5EF4 . 83EA 37 SUB EDX,37
005E5EF7 . EB 03 JMP SHORT 005E5EFC
005E5EF9 > 83EA 30 SUB EDX,30
005E5EFC > C0E1 04 SHL CL,4
005E5EFF . 02CA ADD CL,DL
005E5F01 . 888C3D 240500>MOV BYTE PTR SS:[EBP+EDI+524],CL
005E5F08 . 47 INC EDI
005E5F09 . 3BF8 CMP EDI,EAX
005E5F0B .^ 7C BD JL SHORT 005E5ECA
005E5F0D > 99 CDQ
005E5F0E . 2BC2 SUB EAX,EDX
005E5F10 . C6843D 240500>MOV BYTE PTR SS:[EBP+EDI+524],0
005E5F18 . 8BF8 MOV EDI,EAX
005E5F1A . D1FF SAR EDI,1
005E5F1C . EB 18 JMP SHORT 005E5F36
005E5F1E > 6A 00 PUSH 0 ; /Style = MB_OK|MB_APPLMODAL
005E5F20 . B8 A8058A00 MOV EAX,008A05A8 ; |ASCII "ERROR: [KeepAlive] Buffer Error"
005E5F25 . 50 PUSH EAX ; |Title => "ERROR: [KeepAlive] Buffer Error"
005E5F26 . 50 PUSH EAX ; |Text => "ERROR: [KeepAlive] Buffer Error"
005E5F27 . FF35 E82FA500 PUSH DWORD PTR DS:[A52FE8] ; |hOwner = NULL
005E5F2D . FF15 90588600 CALL DWORD PTR DS:[<&user32.MessageBoxA>>; \MessageBoxA
005E5F33 . 8B7D 80 MOV EDI,DWORD PTR SS:[EBP-80]
005E5F36 > B8 90010000 MOV EAX,190
005E5F3B . 397D 88 CMP DWORD PTR SS:[EBP-78],EDI
005E5F3E . 75 04 JNZ SHORT 005E5F44
005E5F40 . 3BF8 CMP EDI,EAX
005E5F42 . 7C 1E JL SHORT 005E5F62
005E5F44 > 3BF8 CMP EDI,EAX
005E5F46 . 6A 00 PUSH 0
005E5F48 . B8 C8058A00 MOV EAX,008A05C8 ; ASCII "ERROR: [KeepAlive] bylen >=ANTICPX_TRANS_BUFFER_MAX"
005E5F4D . 7D 05 JGE SHORT 005E5F54
005E5F4F . B8 FC058A00 MOV EAX,008A05FC ; ASCII "ERROR: [KeepAlive] rsize != bylen"
005E5F54 > 50 PUSH EAX ; |Title
005E5F55 . 50 PUSH EAX ; |Text
005E5F56 . FF35 E82FA500 PUSH DWORD PTR DS:[A52FE8] ; |hOwner = NULL
005E5F5C . FF15 90588600 CALL DWORD PTR DS:[<&user32.MessageBoxA>>; \MessageBoxA
005E5F62 > 8D45 90 LEA EAX,DWORD PTR SS:[EBP-70]
005E5F65 . 50 PUSH EAX ; /Arg3
005E5F66 . 57 PUSH EDI ; |Arg2
005E5F67 . 8D85 24050000 LEA EAX,DWORD PTR SS:[EBP+524] ; |
005E5F6D . 50 PUSH EAX ; |Arg1
005E5F6E . E8 45981D00 CALL 007BF7B8 ; \WarRock.007BF7B8
005E5F73 . 8B1D E4558600 MOV EBX,DWORD PTR DS:[<&msvcr90.sprintf>>; MSVCR90.sprintf
005E5F79 . 8945 8C MOV DWORD PTR SS:[EBP-74],EAX
005E5F7C . 85C0 TEST EAX,EAX
005E5F7E . 74 56 JE SHORT 005E5FD6
005E5F80 . 68 FF030000 PUSH 3FF ; /n = 3FF (1023.)
005E5F85 . 8D85 250D0000 LEA EAX,DWORD PTR SS:[EBP+D25] ; |
005E5F8B . 6A 00 PUSH 0 ; |c = 00
005E5F8D . 50 PUSH EAX ; |s
005E5F8E . C685 240D0000>MOV BYTE PTR SS:[EBP+D24],0 ; |
005E5F95 . E8 E6AA1E00 CALL <JMP.&msvcr90.memset> ; \memset
005E5F9A . FF75 8C PUSH DWORD PTR SS:[EBP-74] ; /<%X>
005E5F9D . 8D85 240D0000 LEA EAX,DWORD PTR SS:[EBP+D24] ; |
005E5FA3 . 68 20068A00 PUSH 008A0620 ; |format = "%X"
005E5FA8 . 50 PUSH EAX ; |s
005E5FA9 . FFD3 CALL EBX ; \sprintf
005E5FAB . 68 04020000 PUSH 204
005E5FB0 . E8 1F101D00 CALL 007B6FD4
005E5FB5 . 8BF8 MOV EDI,EAX
005E5FB7 . 8D85 240D0000 LEA EAX,DWORD PTR SS:[EBP+D24]
005E5FBD . 50 PUSH EAX ; /src
005E5FBE . 57 PUSH EDI ; |dest
005E5FBF . E8 E8AB1E00 CALL <JMP.&msvcr90.strcpy> ; \strcpy
005E5FC4 . 8B45 8C MOV EAX,DWORD PTR SS:[EBP-74]
005E5FC7 . 83C4 24 ADD ESP,24
005E5FCA . 57 PUSH EDI
005E5FCB . 8987 00020000 MOV DWORD PTR DS:[EDI+200],EAX
005E5FD1 . E8 FFF3F2FF CALL 005153D5
005E5FD6 > 0FB785 200100>MOVZX EAX,WORD PTR SS:[EBP+120]
005E5FDD . 8D8D 24010000 LEA ECX,DWORD PTR SS:[EBP+124]
005E5FE3 . 8945 8C MOV DWORD PTR SS:[EBP-74],EAX
005E5FE6 . 894D 84 MOV DWORD PTR SS:[EBP-7C],ECX
005E5FE9 . 8D7D 90 LEA EDI,DWORD PTR SS:[EBP-70]
005E5FEC . 85C0 TEST EAX,EAX
005E5FEE . 74 1F JE SHORT 005E600F
005E5FF0 > 0FB607 MOVZX EAX,BYTE PTR DS:[EDI]
005E5FF3 . FF4D 8C DEC DWORD PTR SS:[EBP-74]
005E5FF6 . 50 PUSH EAX
005E5FF7 . 68 34F48700 PUSH 0087F434 ; ASCII "%02X"
005E5FFC . FF75 84 PUSH DWORD PTR SS:[EBP-7C]
005E5FFF . FFD3 CALL EBX
005E6001 . 8345 84 02 ADD DWORD PTR SS:[EBP-7C],2
005E6005 . 83C4 0C ADD ESP,0C
005E6008 . 47 INC EDI
005E6009 . 837D 8C 00 CMP DWORD PTR SS:[EBP-74],0
005E600D .^ 75 E1 JNZ SHORT 005E5FF0
005E600F > 0FB79D 200100>MOVZX EBX,WORD PTR SS:[EBP+120]
005E6016 . 68 207A0000 PUSH 7A20
005E601B . 8DBE 0C400000 LEA EDI,DWORD PTR DS:[ESI+400C]
005E6021 . 56 PUSH ESI
005E6022 . 8BCF MOV ECX,EDI
005E6024 . E8 27BC0800 CALL 00671C50
005E6029 . 53 PUSH EBX
005E602A . 56 PUSH ESI
005E602B . 8BCF MOV ECX,EDI
005E602D . E8 8EBD0800 CALL 00671DC0
005E6032 . 6A 01 PUSH 1
005E6034 . 8D85 24010000 LEA EAX,DWORD PTR SS:[EBP+124]
005E603A . 50 PUSH EAX
005E603B . 56 PUSH ESI
005E603C . 8BCF MOV ECX,EDI
005E603E . E8 ADBD0800 CALL 00671DF0
005E6043 . 56 PUSH ESI
005E6044 . 8BCF MOV ECX,EDI
005E6046 . E8 35BD0800 CALL 00671D80
005E604B . 56 PUSH ESI ; /s
005E604C . E8 61AB1E00 CALL <JMP.&msvcr90.strlen> ; \strlen
005E6051 . 59 POP ECX
005E6052 . 50 PUSH EAX
005E6053 . 8B45 80 MOV EAX,DWORD PTR SS:[EBP-80]
005E6056 . 56 PUSH ESI
005E6057 . E8 F25EF0FF CALL 004EBF4E
005E605C . 8B8D 24110000 MOV ECX,DWORD PTR SS:[EBP+1124]
005E6062 . 5F POP EDI
005E6063 . 5E POP ESI
005E6064 . 33CD XOR ECX,EBP
005E6066 . 5B POP EBX
005E6067 . E8 F9A91E00 CALL 007D0A65
005E606C . 81C5 28110000 ADD EBP,1128
005E6072 . C9 LEAVE
005E6073 . C3 RETN