rendered paste body10001000 /$ 55 PUSH EBP
10001001 |. 8BEC MOV EBP,ESP
10001003 |. 51 PUSH ECX
10001004 |. 8B45 0C MOV EAX,[ARG.2]
10001007 |. 8945 FC MOV [LOCAL.1],EAX
1000100A |. B8 01000000 MOV EAX,1
1000100F |. 8BE5 MOV ESP,EBP
10001011 |. 5D POP EBP ; kernel32.7C816FD7
10001012 \. C2 0C00 RETN 0C
10001015 CC INT3
10001016 CC INT3
10001017 CC INT3
10001018 CC INT3
10001019 CC INT3
1000101A CC INT3
1000101B CC INT3
1000101C CC INT3
1000101D CC INT3
1000101E CC INT3
1000101F CC INT3
10001020 /$ 55 PUSH EBP
10001021 |. 8BEC MOV EBP,ESP
10001023 |. 83EC 10 SUB ESP,10
10001026 |. C705 50AC0010 000>MOV DWORD PTR DS:[1000AC50],0
10001030 |. C705 54AC0010 000>MOV DWORD PTR DS:[1000AC54],0
1000103A |. 8D45 F8 LEA EAX,[LOCAL.2]
1000103D |. 50 PUSH EAX ; /pPerformanceFreq = 00000008
1000103E |. FF15 04800010 CALL DWORD PTR DS:[<&KERNEL32.QueryPerformanceFrequency>] ; \QueryPerformanceFrequency
10001044 |. 85C0 TEST EAX,EAX
10001046 |. 74 34 JE SHORT jagmisc.1000107C
10001048 |. 8D4D F0 LEA ECX,[LOCAL.4]
1000104B |. 51 PUSH ECX ; /pPerformanceCount = FFFFFFFF
1000104C |. FF15 00800010 CALL DWORD PTR DS:[<&KERNEL32.QueryPerformanceCounter>] ; \QueryPerformanceCounter
10001052 |. 85C0 TEST EAX,EAX
10001054 |. 74 26 JE SHORT jagmisc.1000107C
10001056 |. 8B55 F8 MOV EDX,[LOCAL.2] ; LOADDLL.00410249
10001059 |. 0B55 FC OR EDX,[LOCAL.1]
1000105C |. 74 1E JE SHORT jagmisc.1000107C
1000105E |. DF6D F0 FILD QWORD PTR SS:[EBP-10]
10001061 |. DC0D 40810010 FMUL QWORD PTR DS:[10008140]
10001067 |. DF6D F8 FILD QWORD PTR SS:[EBP-8]
1000106A |. DEF9 FDIVP ST(1),ST
1000106C |. E8 6F030000 CALL jagmisc.100013E0
10001071 |. A3 50AC0010 MOV DWORD PTR DS:[1000AC50],EAX
10001076 |. 8915 54AC0010 MOV DWORD PTR DS:[1000AC54],EDX
1000107C |> 8BE5 MOV ESP,EBP
1000107E |. 5D POP EBP ; kernel32.7C816FD7
1000107F \. C3 RETN
10001080 /. 55 PUSH EBP
10001081 |. 8BEC MOV EBP,ESP
10001083 |. 83EC 0C SUB ESP,0C
10001086 |. 6A 01 PUSH 1 ; /AffinityMask = 1
10001088 |. FF15 14800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentThread>] ; |[GetCurrentThread
1000108E |. 50 PUSH EAX ; |hThread = 00000008
1000108F |. FF15 10800010 CALL DWORD PTR DS:[<&KERNEL32.SetThreadAffinityMask>] ; \SetThreadAffinityMask
10001095 |. E8 86FFFFFF CALL jagmisc.10001020
1000109A |> B8 01000000 /MOV EAX,1
1000109F |. 85C0 |TEST EAX,EAX
100010A1 |. 74 5F |JE SHORT jagmisc.10001102
100010A3 |. 8B0D 48AC0010 |MOV ECX,DWORD PTR DS:[1000AC48]
100010A9 |. 51 |PUSH ECX ; /hEvent = FFFFFFFF
100010AA |. FF15 0C800010 |CALL DWORD PTR DS:[<&KERNEL32.SetEvent>] ; \SetEvent
100010B0 |. 8B15 38AC0010 |MOV EDX,DWORD PTR DS:[1000AC38]
100010B6 |. 8955 F8 |MOV [LOCAL.2],EDX
100010B9 |. A1 40AC0010 |MOV EAX,DWORD PTR DS:[1000AC40]
100010BE |. 8945 FC |MOV [LOCAL.1],EAX
100010C1 |. 6A FF |PUSH -1 ; /Timeout = INFINITE
100010C3 |. 6A 00 |PUSH 0 ; |WaitForAll = FALSE
100010C5 |. 8D4D F8 |LEA ECX,[LOCAL.2] ; |
100010C8 |. 51 |PUSH ECX ; |pObjects = FFFFFFFF
100010C9 |. 6A 02 |PUSH 2 ; |nObjects = 2
100010CB |. FF15 08800010 |CALL DWORD PTR DS:[<&KERNEL32.WaitForMultipleObjects>] ; \WaitForMultipleObjects
100010D1 |. 8945 F4 |MOV [LOCAL.3],EAX
100010D4 |. 837D F4 01 |CMP [LOCAL.3],1
100010D8 |. 75 0F |JNZ SHORT jagmisc.100010E9
100010DA |. 8B15 44AC0010 |MOV EDX,DWORD PTR DS:[1000AC44]
100010E0 |. 52 |PUSH EDX ; /hEvent = NULL
100010E1 |. FF15 0C800010 |CALL DWORD PTR DS:[<&KERNEL32.SetEvent>] ; \SetEvent
100010E7 |. EB 19 |JMP SHORT jagmisc.10001102
100010E9 |> 837D F4 00 |CMP [LOCAL.3],0
100010ED |. 75 11 |JNZ SHORT jagmisc.10001100
100010EF |. E8 2CFFFFFF |CALL jagmisc.10001020
100010F4 |. A1 3CAC0010 |MOV EAX,DWORD PTR DS:[1000AC3C]
100010F9 |. 50 |PUSH EAX ; /hEvent = 00000008
100010FA |. FF15 0C800010 |CALL DWORD PTR DS:[<&KERNEL32.SetEvent>] ; \SetEvent
10001100 |>^ EB 98 \JMP SHORT jagmisc.1000109A
10001102 |> 8BE5 MOV ESP,EBP
10001104 |. 5D POP EBP ; kernel32.7C816FD7
10001105 \. C3 RETN
10001106 CC INT3
10001107 CC INT3
10001108 CC INT3
10001109 CC INT3
1000110A CC INT3
1000110B CC INT3
1000110C CC INT3
1000110D CC INT3
1000110E CC INT3
1000110F CC INT3
10001110 /$ 55 PUSH EBP
10001111 |. 8BEC MOV EBP,ESP
10001113 |. A1 30A00010 MOV EAX,DWORD PTR DS:[1000A030]
10001118 |. 50 PUSH EAX ; /hObject = 00000008
10001119 |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle
1000111F |. 8B0D 48AC0010 MOV ECX,DWORD PTR DS:[1000AC48]
10001125 |. 51 PUSH ECX ; /hObject = FFFFFFFF
10001126 |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle
1000112C |. 8B15 38AC0010 MOV EDX,DWORD PTR DS:[1000AC38]
10001132 |. 52 PUSH EDX ; /hObject = NULL
10001133 |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle
10001139 |. A1 3CAC0010 MOV EAX,DWORD PTR DS:[1000AC3C]
1000113E |. 50 PUSH EAX ; /hObject = 00000008
1000113F |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle
10001145 |. 8B0D 40AC0010 MOV ECX,DWORD PTR DS:[1000AC40]
1000114B |. 51 PUSH ECX ; /hObject = FFFFFFFF
1000114C |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle
10001152 |. 8B15 44AC0010 MOV EDX,DWORD PTR DS:[1000AC44]
10001158 |. 52 PUSH EDX ; /hObject = NULL
10001159 |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle
1000115F |. 68 20AC0010 PUSH jagmisc.1000AC20 ; /pCriticalSection = jagmisc.1000AC20
10001164 |. FF15 18800010 CALL DWORD PTR DS:[<&KERNEL32.DeleteCriticalSection>] ; \DeleteCriticalSection
1000116A |. C705 58AC0010 000>MOV DWORD PTR DS:[1000AC58],0
10001174 |. 5D POP EBP ; kernel32.7C816FD7
10001175 \. C3 RETN
10001176 CC INT3
10001177 CC INT3
10001178 CC INT3
10001179 CC INT3
1000117A CC INT3
1000117B CC INT3
1000117C CC INT3
1000117D CC INT3
1000117E CC INT3
1000117F CC INT3
10001180 /$ 55 PUSH EBP
10001181 |. 8BEC MOV EBP,ESP
10001183 |. 833D 58AC0010 00 CMP DWORD PTR DS:[1000AC58],0
1000118A |. 75 02 JNZ SHORT jagmisc.1000118E
1000118C |. EB 39 JMP SHORT jagmisc.100011C7
1000118E |> A1 58AC0010 MOV EAX,DWORD PTR DS:[1000AC58]
10001193 |. 83E8 01 SUB EAX,1
10001196 |. A3 58AC0010 MOV DWORD PTR DS:[1000AC58],EAX
1000119B |. 74 02 JE SHORT jagmisc.1000119F
1000119D |. EB 28 JMP SHORT jagmisc.100011C7
1000119F |> 8B0D 40AC0010 MOV ECX,DWORD PTR DS:[1000AC40]
100011A5 |. 51 PUSH ECX ; /hEvent = FFFFFFFF
100011A6 |. FF15 0C800010 CALL DWORD PTR DS:[<&KERNEL32.SetEvent>] ; \SetEvent
100011AC |. 68 E8030000 PUSH 3E8 ; /Timeout = 1000. ms
100011B1 |. 8B15 44AC0010 MOV EDX,DWORD PTR DS:[1000AC44] ; |
100011B7 |. 52 PUSH EDX ; |hObject = NULL
100011B8 |. FF15 20800010 CALL DWORD PTR DS:[<&KERNEL32.WaitForSingleObject>] ; \WaitForSingleObject
100011BE |. 85C0 TEST EAX,EAX
100011C0 |. 75 05 JNZ SHORT jagmisc.100011C7
100011C2 |. E8 49FFFFFF CALL jagmisc.10001110
100011C7 |> 5D POP EBP ; kernel32.7C816FD7
100011C8 \. C3 RETN
100011C9 CC INT3
100011CA CC INT3
100011CB CC INT3
100011CC CC INT3
100011CD CC INT3
100011CE CC INT3
100011CF CC INT3
100011D0 /$ 55 PUSH EBP
100011D1 |. 8BEC MOV EBP,ESP
100011D3 |. A1 58AC0010 MOV EAX,DWORD PTR DS:[1000AC58]
100011D8 |. 8B0D 58AC0010 MOV ECX,DWORD PTR DS:[1000AC58]
100011DE |. 83C1 01 ADD ECX,1
100011E1 |. 890D 58AC0010 MOV DWORD PTR DS:[1000AC58],ECX
100011E7 |. 85C0 TEST EAX,EAX
100011E9 |. 74 0A JE SHORT jagmisc.100011F5
100011EB |. B8 01000000 MOV EAX,1
100011F0 |. E9 DA000000 JMP jagmisc.100012CF
100011F5 |> 6A 00 PUSH 0 ; /EventName = NULL
100011F7 |. 6A 00 PUSH 0 ; |InitiallySignaled = FALSE
100011F9 |. 6A 00 PUSH 0 ; |ManualReset = FALSE
100011FB |. 6A 00 PUSH 0 ; |pSecurity = NULL
100011FD |. FF15 28800010 CALL DWORD PTR DS:[<&KERNEL32.CreateEventA>] ; \CreateEventA
10001203 |. A3 48AC0010 MOV DWORD PTR DS:[1000AC48],EAX
10001208 |. 6A 00 PUSH 0 ; /EventName = NULL
1000120A |. 6A 00 PUSH 0 ; |InitiallySignaled = FALSE
1000120C |. 6A 00 PUSH 0 ; |ManualReset = FALSE
1000120E |. 6A 00 PUSH 0 ; |pSecurity = NULL
10001210 |. FF15 28800010 CALL DWORD PTR DS:[<&KERNEL32.CreateEventA>] ; \CreateEventA
10001216 |. A3 38AC0010 MOV DWORD PTR DS:[1000AC38],EAX
1000121B |. 6A 00 PUSH 0 ; /EventName = NULL
1000121D |. 6A 00 PUSH 0 ; |InitiallySignaled = FALSE
1000121F |. 6A 00 PUSH 0 ; |ManualReset = FALSE
10001221 |. 6A 00 PUSH 0 ; |pSecurity = NULL
10001223 |. FF15 28800010 CALL DWORD PTR DS:[<&KERNEL32.CreateEventA>] ; \CreateEventA
10001229 |. A3 3CAC0010 MOV DWORD PTR DS:[1000AC3C],EAX
1000122E |. 6A 00 PUSH 0 ; /EventName = NULL
10001230 |. 6A 00 PUSH 0 ; |InitiallySignaled = FALSE
10001232 |. 6A 00 PUSH 0 ; |ManualReset = FALSE
10001234 |. 6A 00 PUSH 0 ; |pSecurity = NULL
10001236 |. FF15 28800010 CALL DWORD PTR DS:[<&KERNEL32.CreateEventA>] ; \CreateEventA
1000123C |. A3 40AC0010 MOV DWORD PTR DS:[1000AC40],EAX
10001241 |. 6A 00 PUSH 0 ; /EventName = NULL
10001243 |. 6A 00 PUSH 0 ; |InitiallySignaled = FALSE
10001245 |. 6A 00 PUSH 0 ; |ManualReset = FALSE
10001247 |. 6A 00 PUSH 0 ; |pSecurity = NULL
10001249 |. FF15 28800010 CALL DWORD PTR DS:[<&KERNEL32.CreateEventA>] ; \CreateEventA
1000124F |. A3 44AC0010 MOV DWORD PTR DS:[1000AC44],EAX
10001254 |. 68 20AC0010 PUSH jagmisc.1000AC20 ; /pCriticalSection = jagmisc.1000AC20
10001259 |. FF15 24800010 CALL DWORD PTR DS:[<&KERNEL32.InitializeCriticalSection>] ; \InitializeCriticalSection
1000125F |. 6A 00 PUSH 0
10001261 |. 6A 00 PUSH 0
10001263 |. 68 80100010 PUSH jagmisc.10001080
10001268 |. E8 B8020000 CALL jagmisc.10001525
1000126D |. 83C4 0C ADD ESP,0C
10001270 |. A3 30A00010 MOV DWORD PTR DS:[1000A030],EAX
10001275 |. 68 E8030000 PUSH 3E8 ; /Timeout = 1000. ms
1000127A |. 8B15 48AC0010 MOV EDX,DWORD PTR DS:[1000AC48] ; |
10001280 |. 52 PUSH EDX ; |hObject = NULL
10001281 |. FF15 20800010 CALL DWORD PTR DS:[<&KERNEL32.WaitForSingleObject>] ; \WaitForSingleObject
10001287 |. 85C0 TEST EAX,EAX
10001289 |. 75 3D JNZ SHORT jagmisc.100012C8
1000128B |. 833D 48AC0010 00 CMP DWORD PTR DS:[1000AC48],0
10001292 |. 74 34 JE SHORT jagmisc.100012C8
10001294 |. 833D 38AC0010 00 CMP DWORD PTR DS:[1000AC38],0
1000129B |. 74 2B JE SHORT jagmisc.100012C8
1000129D |. 833D 3CAC0010 00 CMP DWORD PTR DS:[1000AC3C],0
100012A4 |. 74 22 JE SHORT jagmisc.100012C8
100012A6 |. 833D 40AC0010 00 CMP DWORD PTR DS:[1000AC40],0
100012AD |. 74 19 JE SHORT jagmisc.100012C8
100012AF |. 833D 44AC0010 00 CMP DWORD PTR DS:[1000AC44],0
100012B6 |. 74 10 JE SHORT jagmisc.100012C8
100012B8 |. 833D 30A00010 FF CMP DWORD PTR DS:[1000A030],-1
100012BF |. 74 07 JE SHORT jagmisc.100012C8
100012C1 |. B8 01000000 MOV EAX,1
100012C6 |. EB 07 JMP SHORT jagmisc.100012CF
100012C8 |> E8 43FEFFFF CALL jagmisc.10001110
100012CD |. 33C0 XOR EAX,EAX
100012CF |> 5D POP EBP ; kernel32.7C816FD7
100012D0 \. C3 RETN
100012D1 CC INT3
100012D2 CC INT3
100012D3 CC INT3
100012D4 CC INT3
100012D5 CC INT3
100012D6 CC INT3
100012D7 CC INT3
100012D8 CC INT3
100012D9 CC INT3
100012DA CC INT3
100012DB CC INT3
100012DC CC INT3
100012DD CC INT3
100012DE CC INT3
100012DF CC INT3
100012E0 j>/$ 55 PUSH EBP
100012E1 |. 8BEC MOV EBP,ESP
100012E3 |. E8 E8FEFFFF CALL jagmisc.100011D0
100012E8 |. 5D POP EBP ; kernel32.7C816FD7
100012E9 \. C2 0800 RETN 8
100012EC CC INT3
100012ED CC INT3
100012EE CC INT3
100012EF CC INT3
100012F0 j>/$ 55 PUSH EBP
100012F1 |. 8BEC MOV EBP,ESP
100012F3 |. 83EC 08 SUB ESP,8
100012F6 |. 833D 58AC0010 00 CMP DWORD PTR DS:[1000AC58],0
100012FD |. 75 06 JNZ SHORT jagmisc.10001305
100012FF |. 33C0 XOR EAX,EAX
10001301 |. 33D2 XOR EDX,EDX
10001303 |. EB 5D JMP SHORT jagmisc.10001362
10001305 |> 68 20AC0010 PUSH jagmisc.1000AC20 ; /pCriticalSection = jagmisc.1000AC20
1000130A |. FF15 30800010 CALL DWORD PTR DS:[<&KERNEL32.EnterCriticalSection>] ; \EnterCriticalSection
10001310 |. C745 F8 00000000 MOV [LOCAL.2],0
10001317 |. C745 FC 00000000 MOV [LOCAL.1],0
1000131E |. A1 38AC0010 MOV EAX,DWORD PTR DS:[1000AC38]
10001323 |. 50 PUSH EAX ; /hEvent = 00000008
10001324 |. FF15 0C800010 CALL DWORD PTR DS:[<&KERNEL32.SetEvent>] ; \SetEvent
1000132A |. 68 E8030000 PUSH 3E8 ; /Timeout = 1000. ms
1000132F |. 8B0D 3CAC0010 MOV ECX,DWORD PTR DS:[1000AC3C] ; |
10001335 |. 51 PUSH ECX ; |hObject = FFFFFFFF
10001336 |. FF15 20800010 CALL DWORD PTR DS:[<&KERNEL32.WaitForSingleObject>] ; \WaitForSingleObject
1000133C |. 85C0 TEST EAX,EAX
1000133E |. 75 11 JNZ SHORT jagmisc.10001351
10001340 |. 8B15 50AC0010 MOV EDX,DWORD PTR DS:[1000AC50]
10001346 |. 8955 F8 MOV [LOCAL.2],EDX
10001349 |. A1 54AC0010 MOV EAX,DWORD PTR DS:[1000AC54]
1000134E |. 8945 FC MOV [LOCAL.1],EAX
10001351 |> 68 20AC0010 PUSH jagmisc.1000AC20 ; /pCriticalSection = jagmisc.1000AC20
10001356 |. FF15 2C800010 CALL DWORD PTR DS:[<&KERNEL32.LeaveCriticalSection>] ; \LeaveCriticalSection
1000135C |. 8B45 F8 MOV EAX,[LOCAL.2] ; LOADDLL.00410249
1000135F |. 8B55 FC MOV EDX,[LOCAL.1]
10001362 |> 8BE5 MOV ESP,EBP
10001364 |. 5D POP EBP ; kernel32.7C816FD7
10001365 \. C2 0800 RETN 8
10001368 CC INT3
10001369 CC INT3
1000136A CC INT3
1000136B CC INT3
1000136C CC INT3
1000136D CC INT3
1000136E CC INT3
1000136F CC INT3
10001370 j>/$ 55 PUSH EBP
10001371 |. 8BEC MOV EBP,ESP
10001373 |. 8B45 0C MOV EAX,[ARG.2]
10001376 |. 50 PUSH EAX ; /Arg2 = 00000008
10001377 |. 8B4D 08 MOV ECX,[ARG.1] ; |
1000137A |. 51 PUSH ECX ; |Arg1 = FFFFFFFF
1000137B |. E8 70FFFFFF CALL jagmisc.Java_jagex3_jagmisc_jagmisc_nanoTime ; \Java_jagex3_jagmisc_jagmisc_nanoTime
10001380 |. E8 FBFDFFFF CALL jagmisc.10001180
10001385 |. 5D POP EBP ; kernel32.7C816FD7
10001386 \. C2 0800 RETN 8
10001389 . C3 RETN
1000138A /$ B8 FC1B0010 MOV EAX,jagmisc.10001BFC
1000138F |. A3 4CA00010 MOV DWORD PTR DS:[1000A04C],EAX
10001394 |. C705 50A00010 8A1>MOV DWORD PTR DS:[1000A050],jagmisc.1000188A
1000139E |. C705 54A00010 EF1>MOV DWORD PTR DS:[1000A054],jagmisc.100018EF
100013A8 |. C705 58A00010 4E1>MOV DWORD PTR DS:[1000A058],jagmisc.1000184E
100013B2 |. C705 5CA00010 D51>MOV DWORD PTR DS:[1000A05C],jagmisc.100018D5
100013BC |. A3 60A00010 MOV DWORD PTR DS:[1000A060],EAX
100013C1 \. C3 RETN
100013C2 . E8 C3FFFFFF CALL jagmisc.1000138A
100013C7 . E8 D3080000 CALL jagmisc.10001C9F
100013CC . 837C24 04 00 CMP DWORD PTR SS:[ESP+4],0
100013D1 . A3 60AC0010 MOV DWORD PTR DS:[1000AC60],EAX
100013D6 . 74 05 JE SHORT jagmisc.100013DD
100013D8 . E8 70080000 CALL jagmisc.10001C4D
100013DD > DBE2 FCLEX
100013DF . C3 RETN
100013E0 /$ 55 PUSH EBP
100013E1 |. 8BEC MOV EBP,ESP
100013E3 |. 83EC 20 SUB ESP,20
100013E6 |. 83E4 F0 AND ESP,FFFFFFF0
100013E9 |. D9C0 FLD ST
100013EB |. D95424 18 FST DWORD PTR SS:[ESP+18]
100013EF |. DF7C24 10 FISTP QWORD PTR SS:[ESP+10]
100013F3 |. DF6C24 10 FILD QWORD PTR SS:[ESP+10]
100013F7 |. 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+18]
100013FB |. 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10]
100013FF |. 85C0 TEST EAX,EAX
10001401 |. 74 3C JE SHORT jagmisc.1000143F
10001403 |> DEE9 FSUBP ST(1),ST
10001405 |. 85D2 TEST EDX,EDX
10001407 |. 79 1E JNS SHORT jagmisc.10001427
10001409 |. D91C24 FSTP DWORD PTR SS:[ESP]
1000140C |. 8B0C24 MOV ECX,DWORD PTR SS:[ESP] ; kernel32.7C816FD7
1000140F |. 81F1 00000080 XOR ECX,80000000
10001415 |. 81C1 FFFFFF7F ADD ECX,7FFFFFFF
1000141B |. 83D0 00 ADC EAX,0
1000141E |. 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14]
10001422 |. 83D2 00 ADC EDX,0
10001425 |. EB 2C JMP SHORT jagmisc.10001453
10001427 |> D91C24 FSTP DWORD PTR SS:[ESP]
1000142A |. 8B0C24 MOV ECX,DWORD PTR SS:[ESP] ; kernel32.7C816FD7
1000142D |. 81C1 FFFFFF7F ADD ECX,7FFFFFFF
10001433 |. 83D8 00 SBB EAX,0
10001436 |. 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14]
1000143A |. 83DA 00 SBB EDX,0
1000143D |. EB 14 JMP SHORT jagmisc.10001453
1000143F |> 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14]
10001443 |. F7C2 FFFFFF7F TEST EDX,7FFFFFFF
10001449 |.^ 75 B8 JNZ SHORT jagmisc.10001403
1000144B |. D95C24 18 FSTP DWORD PTR SS:[ESP+18]
1000144F |. D95C24 18 FSTP DWORD PTR SS:[ESP+18]
10001453 |> C9 LEAVE
10001454 \. C3 RETN
10001455 /$ A1 44A00010 MOV EAX,DWORD PTR DS:[1000A044]
1000145A |. 85C0 TEST EAX,EAX
1000145C |. 74 02 JE SHORT jagmisc.10001460
1000145E |. FFD0 CALL EAX
10001460 |> 56 PUSH ESI
10001461 |. E8 9B080000 CALL jagmisc.10001D01
10001466 |. 8BF0 MOV ESI,EAX
10001468 |. 85F6 TEST ESI,ESI
1000146A |. 75 08 JNZ SHORT jagmisc.10001474
1000146C |. 6A 10 PUSH 10
1000146E |. E8 A8030000 CALL jagmisc.1000181B
10001473 |. 59 POP ECX ; kernel32.7C816FD7
10001474 |> 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]
10001477 |. 83F8 FF CMP EAX,-1
1000147A |. 74 07 JE SHORT jagmisc.10001483
1000147C |. 50 PUSH EAX ; /hObject = 00000008
1000147D |. FF15 1C800010 CALL DWORD PTR DS:[<&KERNEL32.CloseHandle>] ; \CloseHandle
10001483 |> 56 PUSH ESI
10001484 |. E8 300A0000 CALL jagmisc.10001EB9
10001489 |. 59 POP ECX ; kernel32.7C816FD7
1000148A |. 6A 00 PUSH 0 ; /ExitCode = 0
1000148C \. FF15 34800010 CALL DWORD PTR DS:[<&KERNEL32.ExitThread>] ; \ExitThread
10001492 . 5E POP ESI ; kernel32.7C816FD7
10001493 . 6A 0C PUSH 0C
10001495 . 68 48810010 PUSH jagmisc.10008148
1000149A . E8 D10E0000 CALL jagmisc.10002370
1000149F . FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; /TlsIndex = 1
100014A5 . FF15 7CAC0010 CALL DWORD PTR DS:[1000AC7C] ; \TlsGetValue
100014AB . 8BF0 MOV ESI,EAX
100014AD . 85F6 TEST ESI,ESI
100014AF . 75 1D JNZ SHORT jagmisc.100014CE
100014B1 . 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]
100014B4 . 56 PUSH ESI ; /pValue = NULL
100014B5 . FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; |TlsIndex = 1
100014BB . FF15 80AC0010 CALL DWORD PTR DS:[1000AC80] ; \TlsSetValue
100014C1 . 85C0 TEST EAX,EAX
100014C3 . 75 25 JNZ SHORT jagmisc.100014EA
100014C5 . 6A 10 PUSH 10
100014C7 . E8 4F030000 CALL jagmisc.1000181B
100014CC . EB 1B JMP SHORT jagmisc.100014E9
100014CE > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
100014D1 . 8B48 4C MOV ECX,DWORD PTR DS:[EAX+4C]
100014D4 . 894E 4C MOV DWORD PTR DS:[ESI+4C],ECX
100014D7 . 8B48 50 MOV ECX,DWORD PTR DS:[EAX+50]
100014DA . 894E 50 MOV DWORD PTR DS:[ESI+50],ECX
100014DD . 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4]
100014E0 . 894E 04 MOV DWORD PTR DS:[ESI+4],ECX
100014E3 . 50 PUSH EAX
100014E4 . E8 140E0000 CALL jagmisc.100022FD
100014E9 > 59 POP ECX ; kernel32.7C816FD7
100014EA > A1 40A00010 MOV EAX,DWORD PTR DS:[1000A040]
100014EF . 85C0 TEST EAX,EAX
100014F1 . 74 02 JE SHORT jagmisc.100014F5
100014F3 . FFD0 CALL EAX
100014F5 > 8365 FC 00 AND DWORD PTR SS:[EBP-4],0
100014F9 . FF76 50 PUSH DWORD PTR DS:[ESI+50]
100014FC . FF56 4C CALL DWORD PTR DS:[ESI+4C]
100014FF . 59 POP ECX ; kernel32.7C816FD7
10001500 . E8 50FFFFFF CALL jagmisc.10001455
10001505 . 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
10001508 . 8B08 MOV ECX,DWORD PTR DS:[EAX]
1000150A . 8B09 MOV ECX,DWORD PTR DS:[ECX]
1000150C . 894D E4 MOV DWORD PTR SS:[EBP-1C],ECX
1000150F . 50 PUSH EAX
10001510 . 51 PUSH ECX
10001511 . E8 680C0000 CALL jagmisc.1000217E
10001516 . 59 POP ECX ; kernel32.7C816FD7
10001517 . 59 POP ECX ; kernel32.7C816FD7
10001518 . C3 RETN
10001519 8B DB 8B
1000151A 65 DB 65 ; CHAR 'e'
1000151B E8 DB E8
1000151C FF DB FF
1000151D 75 DB 75 ; CHAR 'u'
1000151E E4 DB E4
1000151F E8 DB E8
10001520 3A DB 3A ; CHAR ':'
10001521 0C DB 0C
10001522 00 DB 00
10001523 00 DB 00
10001524 CC INT3
10001525 /$ 53 PUSH EBX
10001526 |. 57 PUSH EDI
10001527 |. 8B7C24 0C MOV EDI,DWORD PTR SS:[ESP+C]
1000152B |. 33DB XOR EBX,EBX
1000152D |. 85FF TEST EDI,EDI
1000152F |. 75 10 JNZ SHORT jagmisc.10001541
10001531 |. E8 8F0F0000 CALL jagmisc.100024C5
10001536 |. C700 16000000 MOV DWORD PTR DS:[EAX],16
1000153C |. 83C8 FF OR EAX,FFFFFFFF
1000153F |. EB 72 JMP SHORT jagmisc.100015B3
10001541 |> 56 PUSH ESI
10001542 |. 68 8C000000 PUSH 8C
10001547 |. 6A 01 PUSH 1
10001549 |. E8 F30F0000 CALL jagmisc.10002541
1000154E |. 8BF0 MOV ESI,EAX
10001550 |. 85F6 TEST ESI,ESI
10001552 |. 59 POP ECX ; kernel32.7C816FD7
10001553 |. 59 POP ECX ; kernel32.7C816FD7
10001554 |. 74 43 JE SHORT jagmisc.10001599
10001556 |. 56 PUSH ESI
10001557 |. E8 92070000 CALL jagmisc.10001CEE
1000155C |. 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C]
10001560 |. 59 POP ECX ; kernel32.7C816FD7
10001561 |. 56 PUSH ESI ; /pThreadId = NULL
10001562 |. 6A 04 PUSH 4 ; |CreationFlags = CREATE_SUSPENDED
10001564 |. 56 PUSH ESI ; |pThreadParm = NULL
10001565 |. 68 93140010 PUSH jagmisc.10001493 ; |ThreadFunction = jagmisc.10001493
1000156A |. FF7424 24 PUSH DWORD PTR SS:[ESP+24] ; |StackSize = 7C816FE0 (2088857568.)
1000156E |. 897E 4C MOV DWORD PTR DS:[ESI+4C],EDI ; |
10001571 |. 6A 00 PUSH 0 ; |pSecurity = NULL
10001573 |. 8946 50 MOV DWORD PTR DS:[ESI+50],EAX ; |
10001576 |. FF15 40800010 CALL DWORD PTR DS:[<&KERNEL32.CreateThread>] ; \CreateThread
1000157C |. 8BF8 MOV EDI,EAX
1000157E |. 85FF TEST EDI,EDI
10001580 |. 897E 04 MOV DWORD PTR DS:[ESI+4],EDI
10001583 |. 74 0C JE SHORT jagmisc.10001591
10001585 |. 57 PUSH EDI ; /hThread = NULL
10001586 |. FF15 3C800010 CALL DWORD PTR DS:[<&KERNEL32.ResumeThread>] ; \ResumeThread
1000158C |. 83F8 FF CMP EAX,-1
1000158F |. 75 1F JNZ SHORT jagmisc.100015B0
10001591 |> FF15 38800010 CALL DWORD PTR DS:[<&KERNEL32.GetLastError>] ; [GetLastError
10001597 |. 8BD8 MOV EBX,EAX
10001599 |> 56 PUSH ESI
1000159A |. E8 5E0D0000 CALL jagmisc.100022FD
1000159F |. 85DB TEST EBX,EBX
100015A1 |. 59 POP ECX ; kernel32.7C816FD7
100015A2 |. 74 07 JE SHORT jagmisc.100015AB
100015A4 |. 53 PUSH EBX
100015A5 |. E8 240F0000 CALL jagmisc.100024CE
100015AA |. 59 POP ECX ; kernel32.7C816FD7
100015AB |> 83C8 FF OR EAX,FFFFFFFF
100015AE |. EB 02 JMP SHORT jagmisc.100015B2
100015B0 |> 8BC7 MOV EAX,EDI
100015B2 |> 5E POP ESI ; kernel32.7C816FD7
100015B3 |> 5F POP EDI ; kernel32.7C816FD7
100015B4 |. 5B POP EBX ; kernel32.7C816FD7
100015B5 \. C3 RETN
100015B6 /$ 55 PUSH EBP
100015B7 |. 8BEC MOV EBP,ESP
100015B9 |. 8B45 0C MOV EAX,[ARG.2]
100015BC |. 83F8 01 CMP EAX,1
100015BF |. 56 PUSH ESI
100015C0 |. 0F85 E0000000 JNZ jagmisc.100016A6
100015C6 |. B8 94000000 MOV EAX,94
100015CB |. E8 E0170000 CALL jagmisc.10002DB0
100015D0 |. 8BF4 MOV ESI,ESP
100015D2 |. 56 PUSH ESI ; /pVersionInformation = NULL
100015D3 |. C706 94000000 MOV DWORD PTR DS:[ESI],94 ; |
100015D9 |. FF15 4C800010 CALL DWORD PTR DS:[<&KERNEL32.GetVersionExA>] ; \GetVersionExA
100015DF |. 85C0 TEST EAX,EAX
100015E1 |. 0F84 34010000 JE jagmisc.1000171B
100015E7 |. 8B4E 10 MOV ECX,DWORD PTR DS:[ESI+10]
100015EA |. 890D 8CAC0010 MOV DWORD PTR DS:[1000AC8C],ECX
100015F0 |. 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]
100015F3 |. A3 98AC0010 MOV DWORD PTR DS:[1000AC98],EAX
100015F8 |. 8B56 08 MOV EDX,DWORD PTR DS:[ESI+8]
100015FB |. 8915 9CAC0010 MOV DWORD PTR DS:[1000AC9C],EDX
10001601 |. 8B76 0C MOV ESI,DWORD PTR DS:[ESI+C]
10001604 |. 81E6 FF7F0000 AND ESI,7FFF
1000160A |. 83F9 02 CMP ECX,2
1000160D |. 8935 90AC0010 MOV DWORD PTR DS:[1000AC90],ESI
10001613 |. 74 0C JE SHORT jagmisc.10001621
10001615 |. 81CE 00800000 OR ESI,8000
1000161B |. 8935 90AC0010 MOV DWORD PTR DS:[1000AC90],ESI
10001621 |> C1E0 08 SHL EAX,8
10001624 |. 03C2 ADD EAX,EDX
10001626 |. 6A 01 PUSH 1
10001628 |. A3 94AC0010 MOV DWORD PTR DS:[1000AC94],EAX
1000162D |. E8 AD160000 CALL jagmisc.10002CDF
10001632 |. 85C0 TEST EAX,EAX
10001634 |. 59 POP ECX ; kernel32.7C816FD7
10001635 |. 0F84 E0000000 JE jagmisc.1000171B
1000163B |. E8 A8080000 CALL jagmisc.10001EE8
10001640 |. 85C0 TEST EAX,EAX
10001642 |. 75 0A JNZ SHORT jagmisc.1000164E
10001644 |> E8 E7160000 CALL jagmisc.10002D30
10001649 |. E9 CD000000 JMP jagmisc.1000171B
1000164E |> E8 EA150000 CALL jagmisc.10002C3D
10001653 |. FF15 48800010 CALL DWORD PTR DS:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA
10001659 |. A3 90B40010 MOV DWORD PTR DS:[1000B490],EAX
1000165E |. E8 B8140000 CALL jagmisc.10002B1B
10001663 |. A3 68AC0010 MOV DWORD PTR DS:[1000AC68],EAX
10001668 |. E8 8F0F0000 CALL jagmisc.100025FC
1000166D |. 85C0 TEST EAX,EAX
1000166F |. 7C 2E JL SHORT jagmisc.1000169F
10001671 |. E8 03140000 CALL jagmisc.10002A79
10001676 |. 85C0 TEST EAX,EAX
10001678 |. 7C 20 JL SHORT jagmisc.1000169A
1000167A |. E8 C7110000 CALL jagmisc.10002846
1000167F |. 85C0 TEST EAX,EAX
10001681 |. 7C 17 JL SHORT jagmisc.1000169A
10001683 |. 6A 00 PUSH 0
10001685 |. E8 A7090000 CALL jagmisc.10002031
1000168A |. 85C0 TEST EAX,EAX
1000168C |. 59 POP ECX ; kernel32.7C816FD7
1000168D |. 75 0B JNZ SHORT jagmisc.1000169A
1000168F |. FF05 64AC0010 INC DWORD PTR DS:[1000AC64]
10001695 |. E9 92000000 JMP jagmisc.1000172C
1000169A |> E8 5B110000 CALL jagmisc.100027FA
1000169F |> E8 2D060000 CALL jagmisc.10001CD1
100016A4 |.^ EB 9E JMP SHORT jagmisc.10001644
100016A6 |> 85C0 TEST EAX,EAX
100016A8 |. 75 2C JNZ SHORT jagmisc.100016D6
100016AA |. 3905 64AC0010 CMP DWORD PTR DS:[1000AC64],EAX
100016B0 |. 7E 69 JLE SHORT jagmisc.1000171B
100016B2 |. FF0D 64AC0010 DEC DWORD PTR DS:[1000AC64]
100016B8 |. 3905 C8AC0010 CMP DWORD PTR DS:[1000ACC8],EAX
100016BE |. 75 05 JNZ SHORT jagmisc.100016C5
100016C0 |. E8 AA0A0000 CALL jagmisc.1000216F
100016C5 |> E8 30110000 CALL jagmisc.100027FA
100016CA |. E8 02060000 CALL jagmisc.10001CD1
100016CF |. E8 5C160000 CALL jagmisc.10002D30
100016D4 |. EB 56 JMP SHORT jagmisc.1000172C
100016D6 |> 83F8 02 CMP EAX,2
100016D9 |. 75 44 JNZ SHORT jagmisc.1000171F
100016DB |. 68 8C000000 PUSH 8C
100016E0 |. 6A 01 PUSH 1
100016E2 |. E8 5A0E0000 CALL jagmisc.10002541
100016E7 |. 8BF0 MOV ESI,EAX
100016E9 |. 85F6 TEST ESI,ESI
100016EB |. 59 POP ECX ; kernel32.7C816FD7
100016EC |. 59 POP ECX ; kernel32.7C816FD7
100016ED |. 74 2C JE SHORT jagmisc.1000171B
100016EF |. 56 PUSH ESI ; /pValue = NULL
100016F0 |. FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; |TlsIndex = 1
100016F6 |. FF15 80AC0010 CALL DWORD PTR DS:[1000AC80] ; \TlsSetValue
100016FC |. 85C0 TEST EAX,EAX
100016FE |. 56 PUSH ESI
100016FF |. 74 14 JE SHORT jagmisc.10001715
10001701 |. E8 E8050000 CALL jagmisc.10001CEE
10001706 |. 59 POP ECX ; kernel32.7C816FD7
10001707 |. FF15 44800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentThreadId>] ; [GetCurrentThreadId
1000170D |. 834E 04 FF OR DWORD PTR DS:[ESI+4],FFFFFFFF
10001711 |. 8906 MOV DWORD PTR DS:[ESI],EAX
10001713 |. EB 17 JMP SHORT jagmisc.1000172C
10001715 |> E8 E30B0000 CALL jagmisc.100022FD
1000171A |. 59 POP ECX ; kernel32.7C816FD7
1000171B |> 33C0 XOR EAX,EAX
1000171D |. EB 10 JMP SHORT jagmisc.1000172F
1000171F |> 83F8 03 CMP EAX,3
10001722 |. 75 08 JNZ SHORT jagmisc.1000172C
10001724 |. 6A 00 PUSH 0
10001726 |. E8 8E070000 CALL jagmisc.10001EB9
1000172B |. 59 POP ECX ; kernel32.7C816FD7
1000172C |> 33C0 XOR EAX,EAX
1000172E |. 40 INC EAX
1000172F |> 8D65 FC LEA ESP,[LOCAL.1]
10001732 |. 5E POP ESI ; kernel32.7C816FD7
10001733 |. 5D POP EBP ; kernel32.7C816FD7
10001734 \. C2 0C00 RETN 0C
10001737 j> $ 6A 0C PUSH 0C
10001739 . 68 58810010 PUSH jagmisc.10008158
1000173E . E8 2D0C0000 CALL jagmisc.10002370
10001743 . 33C0 XOR EAX,EAX
10001745 . 40 INC EAX
10001746 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
10001749 . 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C]
1000174C . 33FF XOR EDI,EDI
1000174E . 3BF7 CMP ESI,EDI
10001750 . 75 0C JNZ SHORT jagmisc.1000175E
10001752 . 393D 64AC0010 CMP DWORD PTR DS:[1000AC64],EDI
10001758 . 0F84 B3000000 JE jagmisc.10001811
1000175E > 897D FC MOV DWORD PTR SS:[EBP-4],EDI
10001761 . 3BF0 CMP ESI,EAX
10001763 . 74 05 JE SHORT jagmisc.1000176A
10001765 . 83FE 02 CMP ESI,2
10001768 . 75 31 JNZ SHORT jagmisc.1000179B
1000176A > A1 94B40010 MOV EAX,DWORD PTR DS:[1000B494]
1000176F . 3BC7 CMP EAX,EDI
10001771 . 74 0C JE SHORT jagmisc.1000177F
10001773 . FF75 10 PUSH DWORD PTR SS:[EBP+10]
10001776 . 56 PUSH ESI
10001777 . FF75 08 PUSH DWORD PTR SS:[EBP+8]
1000177A . FFD0 CALL EAX
1000177C . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
1000177F > 397D E4 CMP DWORD PTR SS:[EBP-1C],EDI
10001782 . 0F84 85000000 JE jagmisc.1000180D
10001788 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; /Arg3 = 8054A6ED
1000178B . 56 PUSH ESI ; |Arg2 = 00000000
1000178C . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |Arg1 = FFFFFFFF
1000178F . E8 22FEFFFF CALL jagmisc.100015B6 ; \jagmisc.100015B6
10001794 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
10001797 . 3BC7 CMP EAX,EDI
10001799 . 74 72 JE SHORT jagmisc.1000180D
1000179B > 8B5D 10 MOV EBX,DWORD PTR SS:[EBP+10]
1000179E . 53 PUSH EBX ; /Arg3 = 00000000
1000179F . 56 PUSH ESI ; |Arg2 = 00000000
100017A0 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |Arg1 = FFFFFFFF
100017A3 . E8 58F8FFFF CALL jagmisc.10001000 ; \jagmisc.10001000
100017A8 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
100017AB . 83FE 01 CMP ESI,1
100017AE . 75 0E JNZ SHORT jagmisc.100017BE
100017B0 . 3BC7 CMP EAX,EDI
100017B2 . 75 0A JNZ SHORT jagmisc.100017BE
100017B4 . 53 PUSH EBX ; /Arg3 = 00000000
100017B5 . 57 PUSH EDI ; |Arg2 = 00000000
100017B6 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |Arg1 = FFFFFFFF
100017B9 . E8 F8FDFFFF CALL jagmisc.100015B6 ; \jagmisc.100015B6
100017BE > 3BF7 CMP ESI,EDI
100017C0 . 74 05 JE SHORT jagmisc.100017C7
100017C2 . 83FE 03 CMP ESI,3
100017C5 . 75 29 JNZ SHORT jagmisc.100017F0
100017C7 > 53 PUSH EBX ; /Arg3 = 00000000
100017C8 . 56 PUSH ESI ; |Arg2 = 00000000
100017C9 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |Arg1 = FFFFFFFF
100017CC . E8 E5FDFFFF CALL jagmisc.100015B6 ; \jagmisc.100015B6
100017D1 . 85C0 TEST EAX,EAX
100017D3 . 75 03 JNZ SHORT jagmisc.100017D8
100017D5 . 897D E4 MOV DWORD PTR SS:[EBP-1C],EDI
100017D8 > 397D E4 CMP DWORD PTR SS:[EBP-1C],EDI
100017DB . 74 13 JE SHORT jagmisc.100017F0
100017DD . A1 94B40010 MOV EAX,DWORD PTR DS:[1000B494]
100017E2 . 3BC7 CMP EAX,EDI
100017E4 . 74 0A JE SHORT jagmisc.100017F0
100017E6 . 53 PUSH EBX
100017E7 . 56 PUSH ESI
100017E8 . FF75 08 PUSH DWORD PTR SS:[EBP+8]
100017EB . FFD0 CALL EAX
100017ED . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
100017F0 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
100017F4 . 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
100017F7 . EB 1A JMP SHORT jagmisc.10001813
100017F9 . 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
100017FC . 8B08 MOV ECX,DWORD PTR DS:[EAX]
100017FE . 8B09 MOV ECX,DWORD PTR DS:[ECX]
10001800 . 50 PUSH EAX
10001801 . 51 PUSH ECX
10001802 . E8 DB0A0000 CALL jagmisc.100022E2
10001807 . 59 POP ECX ; kernel32.7C816FD7
10001808 . 59 POP ECX ; kernel32.7C816FD7
10001809 . C3 RETN
1000180A . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451
1000180D > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10001811 > 33C0 XOR EAX,EAX
10001813 > E8 930B0000 CALL jagmisc.100023AB
10001818 . C2 0C00 RETN 0C
1000181B /$ A1 70AC0010 MOV EAX,DWORD PTR DS:[1000AC70]
10001820 |. 83F8 01 CMP EAX,1
10001823 |. 74 0D JE SHORT jagmisc.10001832
10001825 |. 85C0 TEST EAX,EAX
10001827 |. 75 0E JNZ SHORT jagmisc.10001837
10001829 |. 833D 74AC0010 01 CMP DWORD PTR DS:[1000AC74],1
10001830 |. 75 05 JNZ SHORT jagmisc.10001837
10001832 |> E8 2D170000 CALL jagmisc.10002F64
10001837 |> FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738
1000183B |. E8 AD150000 CALL jagmisc.10002DED
10001840 |. 68 FF000000 PUSH 0FF
10001845 |. FF15 48A00010 CALL DWORD PTR DS:[1000A048] ; jagmisc.1000215E
1000184B |. 59 POP ECX ; kernel32.7C816FD7
1000184C |. 59 POP ECX ; kernel32.7C816FD7
1000184D \. C3 RETN
1000184E . 56 PUSH ESI
1000184F . 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8]
10001853 . 0FBE06 MOVSX EAX,BYTE PTR DS:[ESI]
10001856 . 50 PUSH EAX
10001857 . E8 43180000 CALL jagmisc.1000309F
1000185C . 83F8 65 CMP EAX,65
1000185F . EB 0C JMP SHORT jagmisc.1000186D
10001861 > 46 INC ESI
10001862 . 0FBE06 MOVSX EAX,BYTE PTR DS:[ESI]
10001865 . 50 PUSH EAX
10001866 . E8 32170000 CALL jagmisc.10002F9D
1000186B . 85C0 TEST EAX,EAX
1000186D > 59 POP ECX ; kernel32.7C816FD7
1000186E .^ 75 F1 JNZ SHORT jagmisc.10001861
10001870 . 8A06 MOV AL,BYTE PTR DS:[ESI]
10001872 . 8A0D 1CA30010 MOV CL,BYTE PTR DS:[1000A31C]
10001878 . 880E MOV BYTE PTR DS:[ESI],CL
1000187A . 46 INC ESI
1000187B > 8A0E MOV CL,BYTE PTR DS:[ESI]
1000187D . 8806 MOV BYTE PTR DS:[ESI],AL
1000187F . 8AC1 MOV AL,CL
10001881 . 8A0E MOV CL,BYTE PTR DS:[ESI]
10001883 . 46 INC ESI
10001884 . 84C9 TEST CL,CL
10001886 .^ 75 F3 JNZ SHORT jagmisc.1000187B
10001888 . 5E POP ESI ; kernel32.7C816FD7
10001889 . C3 RETN
1000188A . 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
1000188E . 53 PUSH EBX
1000188F . 8A1D 1CA30010 MOV BL,BYTE PTR DS:[1000A31C]
10001895 . EB 05 JMP SHORT jagmisc.1000189C
10001897 > 3ACB CMP CL,BL
10001899 . 74 07 JE SHORT jagmisc.100018A2
1000189B . 40 INC EAX
1000189C > 8A08 MOV CL,BYTE PTR DS:[EAX]
1000189E . 84C9 TEST CL,CL
100018A0 .^ 75 F5 JNZ SHORT jagmisc.10001897
100018A2 > 8A08 MOV CL,BYTE PTR DS:[EAX]
100018A4 . 40 INC EAX
100018A5 . 84C9 TEST CL,CL
100018A7 . 74 2A JE SHORT jagmisc.100018D3
100018A9 . EB 0B JMP SHORT jagmisc.100018B6
100018AB > 80F9 65 CMP CL,65
100018AE . 74 0C JE SHORT jagmisc.100018BC
100018B0 . 80F9 45 CMP CL,45
100018B3 . 74 07 JE SHORT jagmisc.100018BC
100018B5 . 40 INC EAX
100018B6 > 8A08 MOV CL,BYTE PTR DS:[EAX]
100018B8 . 84C9 TEST CL,CL
100018BA .^ 75 EF JNZ SHORT jagmisc.100018AB
100018BC > 8BD0 MOV EDX,EAX
100018BE > 48 DEC EAX
100018BF . 8038 30 CMP BYTE PTR DS:[EAX],30
100018C2 .^ 74 FA JE SHORT jagmisc.100018BE
100018C4 . 3818 CMP BYTE PTR DS:[EAX],BL
100018C6 . 75 01 JNZ SHORT jagmisc.100018C9
100018C8 . 48 DEC EAX
100018C9 > 8A0A MOV CL,BYTE PTR DS:[EDX]
100018CB . 40 INC EAX
100018CC . 42 INC EDX
100018CD . 84C9 TEST CL,CL
100018CF . 8808 MOV BYTE PTR DS:[EAX],CL
100018D1 .^ 75 F6 JNZ SHORT jagmisc.100018C9
100018D3 > 5B POP EBX ; kernel32.7C816FD7
100018D4 . C3 RETN
100018D5 . 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
100018D9 . DD00 FLD QWORD PTR DS:[EAX]
100018DB . DC1D 68810010 FCOMP QWORD PTR DS:[10008168]
100018E1 . DFE0 FSTSW AX
100018E3 . F6C4 01 TEST AH,1
100018E6 . 75 04 JNZ SHORT jagmisc.100018EC
100018E8 . 33C0 XOR EAX,EAX
100018EA . 40 INC EAX
100018EB . C3 RETN
100018EC > 33C0 XOR EAX,EAX
100018EE . C3 RETN
100018EF /. 55 PUSH EBP
100018F0 |. 8BEC MOV EBP,ESP
100018F2 |. 51 PUSH ECX
100018F3 |. 51 PUSH ECX
100018F4 |. 837D 08 00 CMP [ARG.1],0
100018F8 |. FF75 10 PUSH [ARG.3]
100018FB |. 74 1B JE SHORT jagmisc.10001918
100018FD |. 8D45 F8 LEA EAX,[LOCAL.2]
10001900 |. 50 PUSH EAX
10001901 |. E8 DF1A0000 CALL jagmisc.100033E5
10001906 |. 8B45 0C MOV EAX,[ARG.2]
10001909 |. 59 POP ECX ; kernel32.7C816FD7
1000190A |. 59 POP ECX ; kernel32.7C816FD7
1000190B |. 8B4D F8 MOV ECX,[LOCAL.2] ; LOADDLL.00410249
1000190E |. 8908 MOV DWORD PTR DS:[EAX],ECX
10001910 |. 8B4D FC MOV ECX,[LOCAL.1]
10001913 |. 8948 04 MOV DWORD PTR DS:[EAX+4],ECX
10001916 |. C9 LEAVE
10001917 |. C3 RETN
10001918 |> 8D45 08 LEA EAX,[ARG.1]
1000191B |. 50 PUSH EAX
1000191C |. E8 011B0000 CALL jagmisc.10003422
10001921 |. 8B45 0C MOV EAX,[ARG.2]
10001924 |. 59 POP ECX ; kernel32.7C816FD7
10001925 |. 59 POP ECX ; kernel32.7C816FD7
10001926 |. 8B4D 08 MOV ECX,[ARG.1]
10001929 |. 8908 MOV DWORD PTR DS:[EAX],ECX
1000192B |. C9 LEAVE
1000192C \. C3 RETN
1000192D /$ 85FF TEST EDI,EDI
1000192F |. 56 PUSH ESI
10001930 |. 8BF0 MOV ESI,EAX
10001932 |. 74 14 JE SHORT jagmisc.10001948
10001934 |. 56 PUSH ESI
10001935 |. E8 661E0000 CALL jagmisc.100037A0
1000193A |. 40 INC EAX
1000193B |. 50 PUSH EAX
1000193C |. 56 PUSH ESI
1000193D |. 03F7 ADD ESI,EDI
1000193F |. 56 PUSH ESI
10001940 |. E8 1B1B0000 CALL jagmisc.10003460
10001945 |. 83C4 10 ADD ESP,10
10001948 |> 5E POP ESI ; kernel32.7C816FD7
10001949 \. C3 RETN
1000194A /$ 55 PUSH EBP
1000194B |. 8BEC MOV EBP,ESP
1000194D |. 807D 10 00 CMP BYTE PTR SS:[EBP+10],0
10001951 |. 56 PUSH ESI
10001952 |. 8BF0 MOV ESI,EAX
10001954 |. 74 1D JE SHORT jagmisc.10001973
10001956 |. 33C0 XOR EAX,EAX
10001958 |. 3945 08 CMP [ARG.1],EAX
1000195B |. 57 PUSH EDI
1000195C |. 0F9FC0 SETG AL
1000195F |. 33C9 XOR ECX,ECX
10001961 |. 833E 2D CMP DWORD PTR DS:[ESI],2D
10001964 |. 0F94C1 SETE CL
10001967 |. 8BF8 MOV EDI,EAX
10001969 |. 03CB ADD ECX,EBX
1000196B |. 8BC1 MOV EAX,ECX
1000196D |. E8 BBFFFFFF CALL jagmisc.1000192D
10001972 |. 5F POP EDI ; kernel32.7C816FD7
10001973 |> 833E 2D CMP DWORD PTR DS:[ESI],2D
10001976 |. 8BC3 MOV EAX,EBX
10001978 |. 75 06 JNZ SHORT jagmisc.10001980
1000197A |. C603 2D MOV BYTE PTR DS:[EBX],2D
1000197D |. 8D43 01 LEA EAX,DWORD PTR DS:[EBX+1]
10001980 |> 837D 08 00 CMP [ARG.1],0
10001984 |. 7E 11 JLE SHORT jagmisc.10001997
10001986 |. 8D48 01 LEA ECX,DWORD PTR DS:[EAX+1]
10001989 |. 8A11 MOV DL,BYTE PTR DS:[ECX]
1000198B |. 8810 MOV BYTE PTR DS:[EAX],DL
1000198D |. 8BC1 MOV EAX,ECX
1000198F |. 8A0D 1CA30010 MOV CL,BYTE PTR DS:[1000A31C]
10001995 |. 8808 MOV BYTE PTR DS:[EAX],CL
10001997 |> 33C9 XOR ECX,ECX
10001999 |. 384D 10 CMP BYTE PTR SS:[EBP+10],CL
1000199C |. 68 70810010 PUSH jagmisc.10008170 ; ASCII "e+000"
100019A1 |. 0F94C1 SETE CL
100019A4 |. 03C8 ADD ECX,EAX
100019A6 |. 034D 08 ADD ECX,[ARG.1]
100019A9 |. 51 PUSH ECX
100019AA |. E8 811E0000 CALL jagmisc.10003830
100019AF |. 837D 0C 00 CMP [ARG.2],0
100019B3 |. 59 POP ECX ; kernel32.7C816FD7
100019B4 |. 59 POP ECX ; kernel32.7C816FD7
100019B5 |. 8BC8 MOV ECX,EAX
100019B7 |. 74 03 JE SHORT jagmisc.100019BC
100019B9 |. C601 45 MOV BYTE PTR DS:[ECX],45
100019BC |> 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C]
100019BF |. 41 INC ECX
100019C0 |. 8038 30 CMP BYTE PTR DS:[EAX],30
100019C3 |. 74 2E JE SHORT jagmisc.100019F3
100019C5 |. 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]
100019C8 |. 48 DEC EAX
100019C9 |. 79 05 JNS SHORT jagmisc.100019D0
100019CB |. F7D8 NEG EAX
100019CD |. C601 2D MOV BYTE PTR DS:[ECX],2D
100019D0 |> 41 INC ECX
100019D1 |. 83F8 64 CMP EAX,64
100019D4 |. 7C 0A JL SHORT jagmisc.100019E0
100019D6 |. 99 CDQ
100019D7 |. 6A 64 PUSH 64
100019D9 |. 5E POP ESI ; kernel32.7C816FD7
100019DA |. F7FE IDIV ESI
100019DC |. 0001 ADD BYTE PTR DS:[ECX],AL
100019DE |. 8BC2 MOV EAX,EDX
100019E0 |> 41 INC ECX
100019E1 |. 83F8 0A CMP EAX,0A
100019E4 |. 7C 0A JL SHORT jagmisc.100019F0
100019E6 |. 99 CDQ
100019E7 |. 6A 0A PUSH 0A
100019E9 |. 5E POP ESI ; kernel32.7C816FD7
100019EA |. F7FE IDIV ESI
100019EC |. 0001 ADD BYTE PTR DS:[ECX],AL
100019EE |. 8BC2 MOV EAX,EDX
100019F0 |> 0041 01 ADD BYTE PTR DS:[ECX+1],AL
100019F3 |> 8BC3 MOV EAX,EBX
100019F5 |. 5E POP ESI ; kernel32.7C816FD7
100019F6 |. 5D POP EBP ; kernel32.7C816FD7
100019F7 \. C3 RETN
100019F8 /$ 55 PUSH EBP
100019F9 |. 8BEC MOV EBP,ESP
100019FB |. 83EC 2C SUB ESP,2C
100019FE |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
10001A03 |. 53 PUSH EBX
10001A04 |. 8945 FC MOV [LOCAL.1],EAX
10001A07 |. 56 PUSH ESI
10001A08 |. 8D45 E4 LEA EAX,[LOCAL.7]
10001A0B |. 50 PUSH EAX
10001A0C |. 8D45 D4 LEA EAX,[LOCAL.11]
10001A0F |. 50 PUSH EAX
10001A10 |. 8B45 08 MOV EAX,[ARG.1]
10001A13 |. FF70 04 PUSH DWORD PTR DS:[EAX+4]
10001A16 |. FF30 PUSH DWORD PTR DS:[EAX]
10001A18 |. E8 3C200000 CALL jagmisc.10003A59
10001A1D |. 8B75 10 MOV ESI,[ARG.3]
10001A20 |. 8B5D 0C MOV EBX,[ARG.2]
10001A23 |. 8D45 D4 LEA EAX,[LOCAL.11]
10001A26 |. 50 PUSH EAX
10001A27 |. 8D46 01 LEA EAX,DWORD PTR DS:[ESI+1]
10001A2A |. 50 PUSH EAX
10001A2B |. 33C0 XOR EAX,EAX
10001A2D |. 837D D4 2D CMP [LOCAL.11],2D
10001A31 |. 0F94C0 SETE AL
10001A34 |. 33C9 XOR ECX,ECX
10001A36 |. 85F6 TEST ESI,ESI
10001A38 |. 0F9FC1 SETG CL
10001A3B |. 03C3 ADD EAX,EBX
10001A3D |. 03C8 ADD ECX,EAX
10001A3F |. 51 PUSH ECX
10001A40 |. E8 E31E0000 CALL jagmisc.10003928
10001A45 |. 6A 00 PUSH 0 ; |Arg3 = 00000000
10001A47 |. FF75 14 PUSH [ARG.4] ; |Arg2 = 0006FFC8
10001A4A |. 8D45 D4 LEA EAX,[LOCAL.11] ; |
10001A4D |. 56 PUSH ESI ; |Arg1 = 00000000
10001A4E |. E8 F7FEFFFF CALL jagmisc.1000194A ; \jagmisc.1000194A
10001A53 |. 8B4D FC MOV ECX,[LOCAL.1]
10001A56 |. 83C4 28 ADD ESP,28
10001A59 |. 5E POP ESI ; kernel32.7C816FD7
10001A5A |. 8BC3 MOV EAX,EBX
10001A5C |. 5B POP EBX ; kernel32.7C816FD7
10001A5D |. E8 94200000 CALL jagmisc.10003AF6
10001A62 |. C9 LEAVE
10001A63 \. C3 RETN
10001A64 /$ 55 PUSH EBP
10001A65 |. 8BEC MOV EBP,ESP
10001A67 |. 53 PUSH EBX
10001A68 |. 56 PUSH ESI
10001A69 |. 8BF0 MOV ESI,EAX
10001A6B |. 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]
10001A6E |. 48 DEC EAX
10001A6F |. 807D 10 00 CMP BYTE PTR SS:[EBP+10],0
10001A73 |. 57 PUSH EDI
10001A74 |. 74 1B JE SHORT jagmisc.10001A91
10001A76 |. 3B45 0C CMP EAX,[ARG.2]
10001A79 |. 75 16 JNZ SHORT jagmisc.10001A91
10001A7B |. 33C9 XOR ECX,ECX
10001A7D |. 833E 2D CMP DWORD PTR DS:[ESI],2D
10001A80 |. 0F94C1 SETE CL
10001A83 |. 03C8 ADD ECX,EAX
10001A85 |. 034D 08 ADD ECX,[ARG.1]
10001A88 |. 8BC1 MOV EAX,ECX
10001A8A |. C600 30 MOV BYTE PTR DS:[EAX],30
10001A8D |. C640 01 00 MOV BYTE PTR DS:[EAX+1],0
10001A91 |> 833E 2D CMP DWORD PTR DS:[ESI],2D
10001A94 |. 8B5D 08 MOV EBX,[ARG.1]
10001A97 |. 75 04 JNZ SHORT jagmisc.10001A9D
10001A99 |. C603 2D MOV BYTE PTR DS:[EBX],2D
10001A9C |. 43 INC EBX
10001A9D |> 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]
10001AA0 |. 33FF XOR EDI,EDI
10001AA2 |. 47 INC EDI
10001AA3 |. 85C0 TEST EAX,EAX
10001AA5 |. 7F 0D JG SHORT jagmisc.10001AB4
10001AA7 |. 8BC3 MOV EAX,EBX
10001AA9 |. E8 7FFEFFFF CALL jagmisc.1000192D
10001AAE |. C603 30 MOV BYTE PTR DS:[EBX],30
10001AB1 |. 43 INC EBX
10001AB2 |. EB 02 JMP SHORT jagmisc.10001AB6
10001AB4 |> 03D8 ADD EBX,EAX
10001AB6 |> 837D 0C 00 CMP [ARG.2],0
10001ABA |. 7E 3C JLE SHORT jagmisc.10001AF8
10001ABC |. 8BC3 MOV EAX,EBX
10001ABE |. E8 6AFEFFFF CALL jagmisc.1000192D
10001AC3 |. A0 1CA30010 MOV AL,BYTE PTR DS:[1000A31C]
10001AC8 |. 8803 MOV BYTE PTR DS:[EBX],AL
10001ACA |. 8B76 04 MOV ESI,DWORD PTR DS:[ESI+4]
10001ACD |. 43 INC EBX
10001ACE |. 85F6 TEST ESI,ESI
10001AD0 |. 7D 26 JGE SHORT jagmisc.10001AF8
10001AD2 |. F7DE NEG ESI
10001AD4 |. 807D 10 00 CMP BYTE PTR SS:[EBP+10],0
10001AD8 |. 75 05 JNZ SHORT jagmisc.10001ADF
10001ADA |. 3975 0C CMP [ARG.2],ESI
10001ADD |. 7C 03 JL SHORT jagmisc.10001AE2
10001ADF |> 8975 0C MOV [ARG.2],ESI
10001AE2 |> 8B7D 0C MOV EDI,[ARG.2]
10001AE5 |. 8BC3 MOV EAX,EBX
10001AE7 |. E8 41FEFFFF CALL jagmisc.1000192D
10001AEC |. 57 PUSH EDI
10001AED |. 6A 30 PUSH 30
10001AEF |. 53 PUSH EBX
10001AF0 |. E8 1B200000 CALL jagmisc.10003B10
10001AF5 |. 83C4 0C ADD ESP,0C
10001AF8 |> 8B45 08 MOV EAX,[ARG.1]
10001AFB |. 5F POP EDI ; kernel32.7C816FD7
10001AFC |. 5E POP ESI ; kernel32.7C816FD7
10001AFD |. 5B POP EBX ; kernel32.7C816FD7
10001AFE |. 5D POP EBP ; kernel32.7C816FD7
10001AFF \. C3 RETN
10001B00 /$ 55 PUSH EBP
10001B01 |. 8BEC MOV EBP,ESP
10001B03 |. 83EC 2C SUB ESP,2C
10001B06 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
10001B0B |. 8945 FC MOV [LOCAL.1],EAX
10001B0E |. 56 PUSH ESI
10001B0F |. 8D45 E4 LEA EAX,[LOCAL.7]
10001B12 |. 50 PUSH EAX
10001B13 |. 8D45 D4 LEA EAX,[LOCAL.11]
10001B16 |. 50 PUSH EAX
10001B17 |. 8B45 08 MOV EAX,[ARG.1]
10001B1A |. FF70 04 PUSH DWORD PTR DS:[EAX+4]
10001B1D |. FF30 PUSH DWORD PTR DS:[EAX]
10001B1F |. E8 351F0000 CALL jagmisc.10003A59
10001B24 |. 8B75 10 MOV ESI,[ARG.3]
10001B27 |. 8D45 D4 LEA EAX,[LOCAL.11]
10001B2A |. 50 PUSH EAX
10001B2B |. 8B45 D8 MOV EAX,[LOCAL.10] ; kernel32.7C839AA8
10001B2E |. 03C6 ADD EAX,ESI
10001B30 |. 50 PUSH EAX
10001B31 |. 33C0 XOR EAX,EAX
10001B33 |. 837D D4 2D CMP [LOCAL.11],2D
10001B37 |. 0F94C0 SETE AL
10001B3A |. 0345 0C ADD EAX,[ARG.2]
10001B3D |. 50 PUSH EAX
10001B3E |. E8 E51D0000 CALL jagmisc.10003928
10001B43 |. 6A 00 PUSH 0 ; |Arg3 = 00000000
10001B45 |. 56 PUSH ESI ; |Arg2 = 00000000
10001B46 |. FF75 0C PUSH [ARG.2] ; |Arg1 = 7FFD9000
10001B49 |. 8D45 D4 LEA EAX,[LOCAL.11] ; |
10001B4C |. E8 13FFFFFF CALL jagmisc.10001A64 ; \jagmisc.10001A64
10001B51 |. 8B4D FC MOV ECX,[LOCAL.1]
10001B54 |. 8B45 0C MOV EAX,[ARG.2]
10001B57 |. 83C4 28 ADD ESP,28
10001B5A |. 5E POP ESI ; kernel32.7C816FD7
10001B5B |. E8 961F0000 CALL jagmisc.10003AF6
10001B60 |. C9 LEAVE
10001B61 \. C3 RETN
10001B62 /$ 55 PUSH EBP
10001B63 |. 8BEC MOV EBP,ESP
10001B65 |. 83EC 2C SUB ESP,2C
10001B68 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
10001B6D |. 53 PUSH EBX
10001B6E |. 56 PUSH ESI
10001B6F |. 8945 FC MOV [LOCAL.1],EAX
10001B72 |. 57 PUSH EDI
10001B73 |. 8D45 E4 LEA EAX,[LOCAL.7]
10001B76 |. 50 PUSH EAX
10001B77 |. 8D45 D4 LEA EAX,[LOCAL.11]
10001B7A |. 50 PUSH EAX
10001B7B |. 8B45 08 MOV EAX,[ARG.1]
10001B7E |. FF70 04 PUSH DWORD PTR DS:[EAX+4]
10001B81 |. FF30 PUSH DWORD PTR DS:[EAX]
10001B83 |. E8 D11E0000 CALL jagmisc.10003A59
10001B88 |. 8B75 D8 MOV ESI,[LOCAL.10] ; |kernel32.7C839AA8
10001B8B |. 8B5D 10 MOV EBX,[ARG.3] ; |
10001B8E |. 33C0 XOR EAX,EAX ; |
10001B90 |. 4E DEC ESI ; |
10001B91 |. 837D D4 2D CMP [LOCAL.11],2D ; |
10001B95 |. 0F94C0 SETE AL ; |
10001B98 |. 0345 0C ADD EAX,[ARG.2] ; |
10001B9B |. 8BF8 MOV EDI,EAX ; |
10001B9D |. 8D45 D4 LEA EAX,[LOCAL.11] ; |
10001BA0 |. 50 PUSH EAX ; |Arg3 = 00000008
10001BA1 |. 53 PUSH EBX ; |Arg2 = 00000000
10001BA2 |. 57 PUSH EDI ; |Arg1 = 00000000
10001BA3 |. E8 801D0000 CALL jagmisc.10003928 ; \jagmisc.10003928
10001BA8 |. 8B45 D8 MOV EAX,[LOCAL.10] ; kernel32.7C839AA8
10001BAB |. 83C4 1C ADD ESP,1C
10001BAE |. 48 DEC EAX
10001BAF |. 3BF0 CMP ESI,EAX
10001BB1 |. 0F9CC1 SETL CL
10001BB4 |. 83F8 FC CMP EAX,-4
10001BB7 |. 7C 22 JL SHORT jagmisc.10001BDB
10001BB9 |. 3BC3 CMP EAX,EBX
10001BBB |. 7D 1E JGE SHORT jagmisc.10001BDB
10001BBD |. 84C9 TEST CL,CL
10001BBF |. 74 0A JE SHORT jagmisc.10001BCB
10001BC1 |> 8A07 /MOV AL,BYTE PTR DS:[EDI]
10001BC3 |. 47 |INC EDI
10001BC4 |. 84C0 |TEST AL,AL
10001BC6 |.^ 75 F9 \JNZ SHORT jagmisc.10001BC1
10001BC8 |. 8847 FE MOV BYTE PTR DS:[EDI-2],AL
10001BCB |> 6A 01 PUSH 1
10001BCD |. 53 PUSH EBX
10001BCE |. FF75 0C PUSH [ARG.2]
10001BD1 |. 8D45 D4 LEA EAX,[LOCAL.11]
10001BD4 |. E8 8BFEFFFF CALL jagmisc.10001A64
10001BD9 |. EB 11 JMP SHORT jagmisc.10001BEC
10001BDB |> 6A 01 PUSH 1
10001BDD |. FF75 14 PUSH [ARG.4]
10001BE0 |. 8D45 D4 LEA EAX,[LOCAL.11]
10001BE3 |. 53 PUSH EBX
10001BE4 |. 8B5D 0C MOV EBX,[ARG.2]
10001BE7 |. E8 5EFDFFFF CALL jagmisc.1000194A
10001BEC |> 8B4D FC MOV ECX,[LOCAL.1]
10001BEF |. 83C4 0C ADD ESP,0C
10001BF2 |. 5F POP EDI ; kernel32.7C816FD7
10001BF3 |. 5E POP ESI ; kernel32.7C816FD7
10001BF4 |. 5B POP EBX ; kernel32.7C816FD7
10001BF5 |. E8 FC1E0000 CALL jagmisc.10003AF6
10001BFA |. C9 LEAVE
10001BFB \. C3 RETN
10001BFC /. 55 PUSH EBP
10001BFD |. 8BEC MOV EBP,ESP
10001BFF |. 837D 10 65 CMP [ARG.3],65
10001C03 |. 74 32 JE SHORT jagmisc.10001C37
10001C05 |. 837D 10 45 CMP [ARG.3],45
10001C09 |. 74 2C JE SHORT jagmisc.10001C37
10001C0B |. 837D 10 66 CMP [ARG.3],66
10001C0F |. 75 13 JNZ SHORT jagmisc.10001C24
10001C11 |. FF75 14 PUSH [ARG.4]
10001C14 |. FF75 0C PUSH [ARG.2]
10001C17 |. FF75 08 PUSH [ARG.1]
10001C1A |. E8 E1FEFFFF CALL jagmisc.10001B00
10001C1F |. 83C4 0C ADD ESP,0C
10001C22 |. 5D POP EBP ; kernel32.7C816FD7
10001C23 |. C3 RETN
10001C24 |> FF75 18 PUSH [ARG.5]
10001C27 |. FF75 14 PUSH [ARG.4]
10001C2A |. FF75 0C PUSH [ARG.2]
10001C2D |. FF75 08 PUSH [ARG.1]
10001C30 |. E8 2DFFFFFF CALL jagmisc.10001B62
10001C35 |. EB 11 JMP SHORT jagmisc.10001C48
10001C37 |> FF75 18 PUSH [ARG.5]
10001C3A |. FF75 14 PUSH [ARG.4]
10001C3D |. FF75 0C PUSH [ARG.2]
10001C40 |. FF75 08 PUSH [ARG.1]
10001C43 |. E8 B0FDFFFF CALL jagmisc.100019F8
10001C48 |> 83C4 10 ADD ESP,10
10001C4B |. 5D POP EBP ; kernel32.7C816FD7
10001C4C \. C3 RETN
10001C4D /$ 68 00000300 PUSH 30000
10001C52 |. 68 00000100 PUSH 10000 ; UNICODE "=::=::\\"
10001C57 |. E8 6F200000 CALL jagmisc.10003CCB
10001C5C |. 59 POP ECX ; kernel32.7C816FD7
10001C5D |. 59 POP ECX ; kernel32.7C816FD7
10001C5E \. C3 RETN
10001C5F /> 55 PUSH EBP
10001C60 |. 8BEC MOV EBP,ESP
10001C62 |. 83EC 18 SUB ESP,18
10001C65 |. DD05 88810010 FLD QWORD PTR DS:[10008188]
10001C6B |. DD5D F8 FSTP QWORD PTR SS:[EBP-8]
10001C6E |. DD05 80810010 FLD QWORD PTR DS:[10008180]
10001C74 |. DD5D F0 FSTP QWORD PTR SS:[EBP-10]
10001C77 |. DD45 F0 FLD QWORD PTR SS:[EBP-10]
10001C7A |. DC75 F8 FDIV QWORD PTR SS:[EBP-8]
10001C7D |. DC4D F8 FMUL QWORD PTR SS:[EBP-8]
10001C80 |. DC6D F0 FSUBR QWORD PTR SS:[EBP-10]
10001C83 |. DD5D E8 FSTP QWORD PTR SS:[EBP-18]
10001C86 |. DD45 E8 FLD QWORD PTR SS:[EBP-18]
10001C89 |. DC1D 78810010 FCOMP QWORD PTR DS:[10008178]
10001C8F |. DFE0 FSTSW AX
10001C91 |. F6C4 41 TEST AH,41
10001C94 |. 75 05 JNZ SHORT jagmisc.10001C9B
10001C96 |. 33C0 XOR EAX,EAX
10001C98 |. 40 INC EAX
10001C99 |. C9 LEAVE
10001C9A |. C3 RETN
10001C9B |> 33C0 XOR EAX,EAX
10001C9D |. C9 LEAVE
10001C9E |. C3 RETN
10001C9F |$ 68 AC810010 PUSH jagmisc.100081AC ; /pModule = "KERNEL32"
10001CA4 |. FF15 54800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA
10001CAA |. 85C0 TEST EAX,EAX
10001CAC |. 74 15 JE SHORT jagmisc.10001CC3
10001CAE |. 68 90810010 PUSH jagmisc.10008190 ; /ProcNameOrOrdinal = "IsProcessorFeaturePresent"
10001CB3 |. 50 PUSH EAX ; |hModule = 00000008
10001CB4 |. FF15 50800010 CALL DWORD PTR DS:[<&KERNEL32.GetProcAddress>] ; \GetProcAddress
10001CBA |. 85C0 TEST EAX,EAX
10001CBC |. 74 05 JE SHORT jagmisc.10001CC3
10001CBE |. 6A 00 PUSH 0
10001CC0 |. FFD0 CALL EAX
10001CC2 |. C3 RETN
10001CC3 \>^ E9 97FFFFFF JMP jagmisc.10001C5F
10001CC8 /$ FF15 58800010 CALL DWORD PTR DS:[<&KERNEL32.TlsAlloc>] ; [TlsAlloc
10001CCE \. C2 0400 RETN 4
10001CD1 $ A1 64A00010 MOV EAX,DWORD PTR DS:[1000A064]
10001CD6 . 83F8 FF CMP EAX,-1
10001CD9 . 74 0E JE SHORT jagmisc.10001CE9
10001CDB . 50 PUSH EAX ; /TLSIndex = 8
10001CDC . FF15 84AC0010 CALL DWORD PTR DS:[1000AC84] ; \TlsFree
10001CE2 . 830D 64A00010 FF OR DWORD PTR DS:[1000A064],FFFFFFFF
10001CE9 > E9 3C200000 JMP jagmisc.10003D2A
10001CEE /$ 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10001CF2 |. C740 54 68A00010 MOV DWORD PTR DS:[EAX+54],jagmisc.1000A068
10001CF9 |. C740 14 01000000 MOV DWORD PTR DS:[EAX+14],1
10001D00 \. C3 RETN
10001D01 /$ 53 PUSH EBX
10001D02 |. 56 PUSH ESI
10001D03 |. FF15 38800010 CALL DWORD PTR DS:[<&KERNEL32.GetLastError>] ; [GetLastError
10001D09 |. FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; /TlsIndex = 1
10001D0F |. 8BD8 MOV EBX,EAX ; |
10001D11 |. FF15 7CAC0010 CALL DWORD PTR DS:[1000AC7C] ; \TlsGetValue
10001D17 |. 8BF0 MOV ESI,EAX
10001D19 |. 85F6 TEST ESI,ESI
10001D1B |. 75 49 JNZ SHORT jagmisc.10001D66
10001D1D |. 68 8C000000 PUSH 8C
10001D22 |. 6A 01 PUSH 1
10001D24 |. E8 18080000 CALL jagmisc.10002541
10001D29 |. 8BF0 MOV ESI,EAX
10001D2B |. 85F6 TEST ESI,ESI
10001D2D |. 59 POP ECX ; kernel32.7C816FD7
10001D2E |. 59 POP ECX ; kernel32.7C816FD7
10001D2F |. 74 2D JE SHORT jagmisc.10001D5E
10001D31 |. 56 PUSH ESI ; /pValue = NULL
10001D32 |. FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; |TlsIndex = 1
10001D38 |. FF15 80AC0010 CALL DWORD PTR DS:[1000AC80] ; \TlsSetValue
10001D3E |. 85C0 TEST EAX,EAX
10001D40 |. 74 1C JE SHORT jagmisc.10001D5E
10001D42 |. C746 54 68A00010 MOV DWORD PTR DS:[ESI+54],jagmisc.1000A068
10001D49 |. C746 14 01000000 MOV DWORD PTR DS:[ESI+14],1
10001D50 |. FF15 44800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentThreadId>] ; [GetCurrentThreadId
10001D56 |. 834E 04 FF OR DWORD PTR DS:[ESI+4],FFFFFFFF
10001D5A |. 8906 MOV DWORD PTR DS:[ESI],EAX
10001D5C |. EB 08 JMP SHORT jagmisc.10001D66
10001D5E |> 6A 10 PUSH 10
10001D60 |. E8 B6FAFFFF CALL jagmisc.1000181B
10001D65 |. 59 POP ECX ; kernel32.7C816FD7
10001D66 |> 53 PUSH EBX ; /Error = ERROR_SUCCESS
10001D67 |. FF15 5C800010 CALL DWORD PTR DS:[<&KERNEL32.SetLastError>] ; \SetLastError
10001D6D |. 8BC6 MOV EAX,ESI
10001D6F |. 5E POP ESI ; kernel32.7C816FD7
10001D70 |. 5B POP EBX ; kernel32.7C816FD7
10001D71 \. C3 RETN
10001D72 /$ 6A 10 PUSH 10
10001D74 |. 68 B8810010 PUSH jagmisc.100081B8
10001D79 |. E8 F2050000 CALL jagmisc.10002370
10001D7E |. 8B75 08 MOV ESI,[ARG.1]
10001D81 |. 33FF XOR EDI,EDI
10001D83 |. 3BF7 CMP ESI,EDI
10001D85 |. 0F84 0C010000 JE jagmisc.10001E97
10001D8B |. 8B46 24 MOV EAX,DWORD PTR DS:[ESI+24]
10001D8E |. 3BC7 CMP EAX,EDI
10001D90 |. 74 07 JE SHORT jagmisc.10001D99
10001D92 |. 50 PUSH EAX
10001D93 |. E8 65050000 CALL jagmisc.100022FD
10001D98 |. 59 POP ECX ; kernel32.7C816FD7
10001D99 |> 8B46 2C MOV EAX,DWORD PTR DS:[ESI+2C]
10001D9C |. 3BC7 CMP EAX,EDI
10001D9E |. 74 07 JE SHORT jagmisc.10001DA7
10001DA0 |. 50 PUSH EAX
10001DA1 |. E8 57050000 CALL jagmisc.100022FD
10001DA6 |. 59 POP ECX ; kernel32.7C816FD7
10001DA7 |> 8B46 34 MOV EAX,DWORD PTR DS:[ESI+34]
10001DAA |. 3BC7 CMP EAX,EDI
10001DAC |. 74 07 JE SHORT jagmisc.10001DB5
10001DAE |. 50 PUSH EAX
10001DAF |. E8 49050000 CALL jagmisc.100022FD
10001DB4 |. 59 POP ECX ; kernel32.7C816FD7
10001DB5 |> 8B46 3C MOV EAX,DWORD PTR DS:[ESI+3C]
10001DB8 |. 3BC7 CMP EAX,EDI
10001DBA |. 74 07 JE SHORT jagmisc.10001DC3
10001DBC |. 50 PUSH EAX
10001DBD |. E8 3B050000 CALL jagmisc.100022FD
10001DC2 |. 59 POP ECX ; kernel32.7C816FD7
10001DC3 |> 8B46 44 MOV EAX,DWORD PTR DS:[ESI+44]
10001DC6 |. 3BC7 CMP EAX,EDI
10001DC8 |. 74 07 JE SHORT jagmisc.10001DD1
10001DCA |. 50 PUSH EAX
10001DCB |. E8 2D050000 CALL jagmisc.100022FD
10001DD0 |. 59 POP ECX ; kernel32.7C816FD7
10001DD1 |> 8B46 48 MOV EAX,DWORD PTR DS:[ESI+48]
10001DD4 |. 3BC7 CMP EAX,EDI
10001DD6 |. 74 07 JE SHORT jagmisc.10001DDF
10001DD8 |. 50 PUSH EAX
10001DD9 |. E8 1F050000 CALL jagmisc.100022FD
10001DDE |. 59 POP ECX ; kernel32.7C816FD7
10001DDF |> 8B46 54 MOV EAX,DWORD PTR DS:[ESI+54]
10001DE2 |. 3D 68A00010 CMP EAX,jagmisc.1000A068
10001DE7 |. 74 07 JE SHORT jagmisc.10001DF0
10001DE9 |. 50 PUSH EAX
10001DEA |. E8 0E050000 CALL jagmisc.100022FD
10001DEF |. 59 POP ECX ; kernel32.7C816FD7
10001DF0 |> 6A 0D PUSH 0D ; /Arg1 = 0000000D
10001DF2 |. E8 3D200000 CALL jagmisc.10003E34 ; \jagmisc.10003E34
10001DF7 |. 59 POP ECX ; kernel32.7C816FD7
10001DF8 |. 897D FC MOV [LOCAL.1],EDI
10001DFB |. 8B46 60 MOV EAX,DWORD PTR DS:[ESI+60]
10001DFE |. 8945 E4 MOV [LOCAL.7],EAX
10001E01 |. 3BC7 CMP EAX,EDI
10001E03 |. 74 13 JE SHORT jagmisc.10001E18
10001E05 |. FF08 DEC DWORD PTR DS:[EAX]
10001E07 |. 75 0F JNZ SHORT jagmisc.10001E18
10001E09 |. 3B05 38B10010 CMP EAX,DWORD PTR DS:[1000B138]
10001E0F |. 74 07 JE SHORT jagmisc.10001E18
10001E11 |. 50 PUSH EAX
10001E12 |. E8 E6040000 CALL jagmisc.100022FD
10001E17 |. 59 POP ECX ; kernel32.7C816FD7
10001E18 |> 834D FC FF OR [LOCAL.1],FFFFFFFF
10001E1C |. E8 83000000 CALL jagmisc.10001EA4
10001E21 |. 6A 0C PUSH 0C ; /Arg1 = 0000000C
10001E23 |. E8 0C200000 CALL jagmisc.10003E34 ; \jagmisc.10003E34
10001E28 |. 59 POP ECX ; kernel32.7C816FD7
10001E29 |. C745 FC 01000000 MOV [LOCAL.1],1
10001E30 |. 8B46 64 MOV EAX,DWORD PTR DS:[ESI+64]
10001E33 |. 8945 E0 MOV [LOCAL.8],EAX
10001E36 |. 3BC7 CMP EAX,EDI
10001E38 |. 74 4D JE SHORT jagmisc.10001E87
10001E3A |. FF08 DEC DWORD PTR DS:[EAX]
10001E3C |. 3978 2C CMP DWORD PTR DS:[EAX+2C],EDI
10001E3F |. 74 05 JE SHORT jagmisc.10001E46
10001E41 |. 8B48 2C MOV ECX,DWORD PTR DS:[EAX+2C]
10001E44 |. FF09 DEC DWORD PTR DS:[ECX]
10001E46 |> 3978 34 CMP DWORD PTR DS:[EAX+34],EDI
10001E49 |. 74 05 JE SHORT jagmisc.10001E50
10001E4B |. 8B48 34 MOV ECX,DWORD PTR DS:[EAX+34]
10001E4E |. FF09 DEC DWORD PTR DS:[ECX]
10001E50 |> 3978 30 CMP DWORD PTR DS:[EAX+30],EDI
10001E53 |. 74 05 JE SHORT jagmisc.10001E5A
10001E55 |. 8B48 30 MOV ECX,DWORD PTR DS:[EAX+30]
10001E58 |. FF09 DEC DWORD PTR DS:[ECX]
10001E5A |> 3978 40 CMP DWORD PTR DS:[EAX+40],EDI
10001E5D |. 74 05 JE SHORT jagmisc.10001E64
10001E5F |. 8B48 40 MOV ECX,DWORD PTR DS:[EAX+40]
10001E62 |. FF09 DEC DWORD PTR DS:[ECX]
10001E64 |> 8B48 4C MOV ECX,DWORD PTR DS:[EAX+4C]
10001E67 |. FF89 B4000000 DEC DWORD PTR DS:[ECX+B4]
10001E6D |. 3B05 ECA40010 CMP EAX,DWORD PTR DS:[1000A4EC] ; jagmisc.1000A498
10001E73 |. 74 12 JE SHORT jagmisc.10001E87
10001E75 |. 3D 98A40010 CMP EAX,jagmisc.1000A498
10001E7A |. 74 0B JE SHORT jagmisc.10001E87
10001E7C |. 3938 CMP DWORD PTR DS:[EAX],EDI
10001E7E |. 75 07 JNZ SHORT jagmisc.10001E87
10001E80 |. 50 PUSH EAX
10001E81 |. E8 DF1F0000 CALL jagmisc.10003E65
10001E86 |. 59 POP ECX ; kernel32.7C816FD7
10001E87 |> 834D FC FF OR [LOCAL.1],FFFFFFFF
10001E8B |. E8 20000000 CALL jagmisc.10001EB0
10001E90 |. 56 PUSH ESI
10001E91 |. E8 67040000 CALL jagmisc.100022FD
10001E96 |. 59 POP ECX ; kernel32.7C816FD7
10001E97 |> E8 0F050000 CALL jagmisc.100023AB
10001E9C \. C2 0400 RETN 4
10001E9F 33 DB 33 ; CHAR '3'
10001EA0 FF DB FF
10001EA1 8B DB 8B
10001EA2 75 DB 75 ; CHAR 'u'
10001EA3 08 DB 08
10001EA4 /$ 6A 0D PUSH 0D
10001EA6 |. E8 D41E0000 CALL jagmisc.10003D7F
10001EAB |. 59 POP ECX ; kernel32.7C816FD7
10001EAC \. C3 RETN
10001EAD 8B DB 8B
10001EAE 75 DB 75 ; CHAR 'u'
10001EAF 08 DB 08
10001EB0 /$ 6A 0C PUSH 0C
10001EB2 |. E8 C81E0000 CALL jagmisc.10003D7F
10001EB7 |. 59 POP ECX ; kernel32.7C816FD7
10001EB8 \. C3 RETN
10001EB9 /$ 8B0D 64A00010 MOV ECX,DWORD PTR DS:[1000A064]
10001EBF |. 83F9 FF CMP ECX,-1
10001EC2 |. 74 23 JE SHORT jagmisc.10001EE7
10001EC4 |. 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10001EC8 |. 85C0 TEST EAX,EAX
10001ECA |. 75 07 JNZ SHORT jagmisc.10001ED3
10001ECC |. 51 PUSH ECX ; /TlsIndex = FFFFFFFF
10001ECD |. FF15 7CAC0010 CALL DWORD PTR DS:[1000AC7C] ; \TlsGetValue
10001ED3 |> 50 PUSH EAX
10001ED4 |. E8 99FEFFFF CALL jagmisc.10001D72
10001ED9 |. 6A 00 PUSH 0 ; /pValue = NULL
10001EDB |. FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; |TlsIndex = 1
10001EE1 |. FF15 80AC0010 CALL DWORD PTR DS:[1000AC80] ; \TlsSetValue
10001EE7 \> C3 RETN
10001EE8 /$ E8 F41D0000 CALL jagmisc.10003CE1
10001EED |. 85C0 TEST EAX,EAX
10001EEF |. 75 08 JNZ SHORT jagmisc.10001EF9
10001EF1 |. E8 DBFDFFFF CALL jagmisc.10001CD1
10001EF6 |. 33C0 XOR EAX,EAX
10001EF8 |. C3 RETN
10001EF9 |> 56 PUSH ESI
10001EFA |. 57 PUSH EDI
10001EFB |. 68 FC810010 PUSH jagmisc.100081FC ; /pModule = "kernel32.dll"
10001F00 |. FF15 54800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA
10001F06 |. 8BF8 MOV EDI,EAX
10001F08 |. 85FF TEST EDI,EDI
10001F0A |. 74 6B JE SHORT jagmisc.10001F77
10001F0C |. 8B35 50800010 MOV ESI,DWORD PTR DS:[<&KERNEL32.GetProcAddress>] ; kernel32.GetProcAddress
10001F12 |. 68 F0810010 PUSH jagmisc.100081F0 ; /ProcNameOrOrdinal = "FlsAlloc"
10001F17 |. 57 PUSH EDI ; |hModule = NULL
10001F18 |. FFD6 CALL ESI ; \GetProcAddress
10001F1A |. 68 E4810010 PUSH jagmisc.100081E4 ; /ProcNameOrOrdinal = "FlsGetValue"
10001F1F |. 57 PUSH EDI ; |hModule = NULL
10001F20 |. A3 78AC0010 MOV DWORD PTR DS:[1000AC78],EAX ; |
10001F25 |. FFD6 CALL ESI ; \GetProcAddress
10001F27 |. 68 D8810010 PUSH jagmisc.100081D8 ; /ProcNameOrOrdinal = "FlsSetValue"
10001F2C |. 57 PUSH EDI ; |hModule = NULL
10001F2D |. A3 7CAC0010 MOV DWORD PTR DS:[1000AC7C],EAX ; |
10001F32 |. FFD6 CALL ESI ; \GetProcAddress
10001F34 |. 68 D0810010 PUSH jagmisc.100081D0 ; /ProcNameOrOrdinal = "FlsFree"
10001F39 |. 57 PUSH EDI ; |hModule = NULL
10001F3A |. A3 80AC0010 MOV DWORD PTR DS:[1000AC80],EAX ; |
10001F3F |. FFD6 CALL ESI ; \GetProcAddress
10001F41 |. 833D 7CAC0010 00 CMP DWORD PTR DS:[1000AC7C],0
10001F48 |. A3 84AC0010 MOV DWORD PTR DS:[1000AC84],EAX
10001F4D |. 75 28 JNZ SHORT jagmisc.10001F77
10001F4F |. A1 68800010 MOV EAX,DWORD PTR DS:[<&KERNEL32.TlsGetValue>]
10001F54 |. A3 7CAC0010 MOV DWORD PTR DS:[1000AC7C],EAX
10001F59 |. A1 64800010 MOV EAX,DWORD PTR DS:[<&KERNEL32.TlsSetValue>]
10001F5E |. A3 80AC0010 MOV DWORD PTR DS:[1000AC80],EAX
10001F63 |. A1 60800010 MOV EAX,DWORD PTR DS:[<&KERNEL32.TlsFree>]
10001F68 |. C705 78AC0010 C81>MOV DWORD PTR DS:[1000AC78],jagmisc.10001CC8 ; Entry address
10001F72 |. A3 84AC0010 MOV DWORD PTR DS:[1000AC84],EAX
10001F77 |> 68 721D0010 PUSH jagmisc.10001D72 ; Entry address
10001F7C |. FF15 78AC0010 CALL DWORD PTR DS:[1000AC78] ; jagmisc.10001CC8
10001F82 |. 83F8 FF CMP EAX,-1
10001F85 |. A3 64A00010 MOV DWORD PTR DS:[1000A064],EAX
10001F8A |. 74 41 JE SHORT jagmisc.10001FCD
10001F8C |. 33FF XOR EDI,EDI
10001F8E |. 68 8C000000 PUSH 8C
10001F93 |. 47 INC EDI
10001F94 |. 57 PUSH EDI
10001F95 |. E8 A7050000 CALL jagmisc.10002541
10001F9A |. 8BF0 MOV ESI,EAX
10001F9C |. 85F6 TEST ESI,ESI
10001F9E |. 59 POP ECX ; kernel32.7C816FD7
10001F9F |. 59 POP ECX ; kernel32.7C816FD7
10001FA0 |. 74 2B JE SHORT jagmisc.10001FCD
10001FA2 |. 56 PUSH ESI ; /pValue = NULL
10001FA3 |. FF35 64A00010 PUSH DWORD PTR DS:[1000A064] ; |TlsIndex = 1
10001FA9 |. FF15 80AC0010 CALL DWORD PTR DS:[1000AC80] ; \TlsSetValue
10001FAF |. 85C0 TEST EAX,EAX
10001FB1 |. 74 1A JE SHORT jagmisc.10001FCD
10001FB3 |. C746 54 68A00010 MOV DWORD PTR DS:[ESI+54],jagmisc.1000A068
10001FBA |. 897E 14 MOV DWORD PTR DS:[ESI+14],EDI
10001FBD |. FF15 44800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentThreadId>] ; [GetCurrentThreadId
10001FC3 |. 834E 04 FF OR DWORD PTR DS:[ESI+4],FFFFFFFF
10001FC7 |. 8906 MOV DWORD PTR DS:[ESI],EAX
10001FC9 |. 8BC7 MOV EAX,EDI
10001FCB |. EB 07 JMP SHORT jagmisc.10001FD4
10001FCD |> E8 FFFCFFFF CALL jagmisc.10001CD1
10001FD2 |. 33C0 XOR EAX,EAX
10001FD4 |> 5F POP EDI ; kernel32.7C816FD7
10001FD5 |. 5E POP ESI ; kernel32.7C816FD7
10001FD6 \. C3 RETN
10001FD7 /$ 68 1C820010 PUSH jagmisc.1000821C ; /pModule = "mscoree.dll"
10001FDC |. FF15 54800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA
10001FE2 |. 85C0 TEST EAX,EAX
10001FE4 |. 74 16 JE SHORT jagmisc.10001FFC
10001FE6 |. 68 0C820010 PUSH jagmisc.1000820C ; /ProcNameOrOrdinal = "CorExitProcess"
10001FEB |. 50 PUSH EAX ; |hModule = 00000008
10001FEC |. FF15 50800010 CALL DWORD PTR DS:[<&KERNEL32.GetProcAddress>] ; \GetProcAddress
10001FF2 |. 85C0 TEST EAX,EAX
10001FF4 |. 74 06 JE SHORT jagmisc.10001FFC
10001FF6 |. FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10001FFA |. FFD0 CALL EAX
10001FFC |> FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; /ExitCode = 7C910738
10002000 \. FF15 6C800010 CALL DWORD PTR DS:[<&KERNEL32.ExitProcess>] ; \ExitProcess
10002006 CC INT3
10002007 /$ 6A 08 PUSH 8
10002009 |. E8 261E0000 CALL jagmisc.10003E34
1000200E |. 59 POP ECX ; kernel32.7C816FD7
1000200F \. C3 RETN
10002010 /$ 6A 08 PUSH 8
10002012 |. E8 681D0000 CALL jagmisc.10003D7F
10002017 |. 59 POP ECX ; kernel32.7C816FD7
10002018 \. C3 RETN
10002019 /$ 56 PUSH ESI
1000201A |. 8BF0 MOV ESI,EAX
1000201C |. EB 0B JMP SHORT jagmisc.10002029
1000201E |> 8B06 /MOV EAX,DWORD PTR DS:[ESI]
10002020 |. 85C0 |TEST EAX,EAX
10002022 |. 74 02 |JE SHORT jagmisc.10002026
10002024 |. FFD0 |CALL EAX
10002026 |> 83C6 04 |ADD ESI,4
10002029 |> 3B7424 08 CMP ESI,DWORD PTR SS:[ESP+8]
1000202D |.^ 72 EF \JB SHORT jagmisc.1000201E
1000202F |. 5E POP ESI ; kernel32.7C816FD7
10002030 \. C3 RETN
10002031 /$ A1 3CA00010 MOV EAX,DWORD PTR DS:[1000A03C]
10002036 |. 85C0 TEST EAX,EAX
10002038 |. 74 07 JE SHORT jagmisc.10002041
1000203A |. FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738
1000203E |. FFD0 CALL EAX
10002040 |. 59 POP ECX ; kernel32.7C816FD7
10002041 |> 56 PUSH ESI
10002042 |. 57 PUSH EDI
10002043 |. B9 0CA00010 MOV ECX,jagmisc.1000A00C
10002048 |. BF 18A00010 MOV EDI,jagmisc.1000A018
1000204D |. 33C0 XOR EAX,EAX
1000204F |. 3BCF CMP ECX,EDI
10002051 |. 8BF1 MOV ESI,ECX
10002053 |. 73 17 JNB SHORT jagmisc.1000206C
10002055 |> 85C0 /TEST EAX,EAX
10002057 |. 75 3F |JNZ SHORT jagmisc.10002098
10002059 |. 8B0E |MOV ECX,DWORD PTR DS:[ESI]
1000205B |. 85C9 |TEST ECX,ECX
1000205D |. 74 02 |JE SHORT jagmisc.10002061
1000205F |. FFD1 |CALL ECX
10002061 |> 83C6 04 |ADD ESI,4
10002064 |. 3BF7 |CMP ESI,EDI
10002066 |.^ 72 ED \JB SHORT jagmisc.10002055
10002068 |. 85C0 TEST EAX,EAX
1000206A |. 75 2C JNZ SHORT jagmisc.10002098
1000206C |> 68 812C0010 PUSH jagmisc.10002C81
10002071 |. E8 7D250000 CALL jagmisc.100045F3
10002076 |. BE 00A00010 MOV ESI,jagmisc.1000A000
1000207B |. 8BC6 MOV EAX,ESI
1000207D |. BF 08A00010 MOV EDI,jagmisc.1000A008
10002082 |. 3BC7 CMP EAX,EDI
10002084 |. 59 POP ECX ; kernel32.7C816FD7
10002085 |. 73 0F JNB SHORT jagmisc.10002096
10002087 |> 8B06 /MOV EAX,DWORD PTR DS:[ESI]
10002089 |. 85C0 |TEST EAX,EAX
1000208B |. 74 02 |JE SHORT jagmisc.1000208F
1000208D |. FFD0 |CALL EAX
1000208F |> 83C6 04 |ADD ESI,4
10002092 |. 3BF7 |CMP ESI,EDI
10002094 |.^ 72 F1 \JB SHORT jagmisc.10002087
10002096 |> 33C0 XOR EAX,EAX
10002098 |> 5F POP EDI ; kernel32.7C816FD7
10002099 |. 5E POP ESI ; kernel32.7C816FD7
1000209A \. C3 RETN
1000209B /$ 6A 08 PUSH 8
1000209D |. 68 28820010 PUSH jagmisc.10008228
100020A2 |. E8 C9020000 CALL jagmisc.10002370
100020A7 |. 6A 08 PUSH 8 ; /Arg1 = 00000008
100020A9 |. E8 861D0000 CALL jagmisc.10003E34 ; \jagmisc.10003E34
100020AE |. 59 POP ECX ; kernel32.7C816FD7
100020AF |. 33FF XOR EDI,EDI
100020B1 |. 897D FC MOV [LOCAL.1],EDI
100020B4 |. 33F6 XOR ESI,ESI
100020B6 |. 46 INC ESI
100020B7 |. 3935 CCAC0010 CMP DWORD PTR DS:[1000ACCC],ESI
100020BD |. 75 10 JNZ SHORT jagmisc.100020CF
100020BF |. FF75 08 PUSH [ARG.1] ; /ExitCode = FFFFFFFF (-1.)
100020C2 |. FF15 74800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentProcess>] ; |[GetCurrentProcess
100020C8 |. 50 PUSH EAX ; |hProcess = 00000008
100020C9 |. FF15 70800010 CALL DWORD PTR DS:[<&KERNEL32.TerminateProcess>] ; \TerminateProcess
100020CF |> 8935 C8AC0010 MOV DWORD PTR DS:[1000ACC8],ESI
100020D5 |. 8A45 10 MOV AL,BYTE PTR SS:[EBP+10]
100020D8 |. A2 C4AC0010 MOV BYTE PTR DS:[1000ACC4],AL
100020DD |. 397D 0C CMP [ARG.2],EDI
100020E0 |. 75 37 JNZ SHORT jagmisc.10002119
100020E2 |. 393D 88B40010 CMP DWORD PTR DS:[1000B488],EDI
100020E8 |. 74 1F JE SHORT jagmisc.10002109
100020EA |> A1 84B40010 /MOV EAX,DWORD PTR DS:[1000B484]
100020EF |. 83E8 04 |SUB EAX,4
100020F2 |. A3 84B40010 |MOV DWORD PTR DS:[1000B484],EAX
100020F7 |. 3B05 88B40010 |CMP EAX,DWORD PTR DS:[1000B488]
100020FD |. 72 0A |JB SHORT jagmisc.10002109
100020FF |. 8B00 |MOV EAX,DWORD PTR DS:[EAX]
10002101 |. 3BC7 |CMP EAX,EDI
10002103 |.^ 74 E5 |JE SHORT jagmisc.100020EA
10002105 |. FFD0 |CALL EAX
10002107 |.^ EB E1 \JMP SHORT jagmisc.100020EA
10002109 |> 68 20A00010 PUSH jagmisc.1000A020
1000210E |. B8 1CA00010 MOV EAX,jagmisc.1000A01C
10002113 |. E8 01FFFFFF CALL jagmisc.10002019
10002118 |. 59 POP ECX ; kernel32.7C816FD7
10002119 |> 68 28A00010 PUSH jagmisc.1000A028
1000211E |. B8 24A00010 MOV EAX,jagmisc.1000A024
10002123 |. E8 F1FEFFFF CALL jagmisc.10002019
10002128 |. 59 POP ECX ; kernel32.7C816FD7
10002129 |. 834D FC FF OR [LOCAL.1],FFFFFFFF
1000212D |. E8 18000000 CALL jagmisc.1000214A
10002132 |. 397D 10 CMP [ARG.3],EDI
10002135 |. 75 21 JNZ SHORT jagmisc.10002158
10002137 |. 8935 CCAC0010 MOV DWORD PTR DS:[1000ACCC],ESI
1000213D |. FF75 08 PUSH [ARG.1]
10002140 |. E8 92FEFFFF CALL jagmisc.10001FD7
10002145 |. 33FF XOR EDI,EDI
10002147 |. 33F6 XOR ESI,ESI
10002149 |. 46 INC ESI
1000214A |$ 397D 10 CMP [ARG.3],EDI
1000214D |. 74 08 JE SHORT jagmisc.10002157
1000214F |. 6A 08 PUSH 8
10002151 |. E8 291C0000 CALL jagmisc.10003D7F
10002156 |. 59 POP ECX ; kernel32.7C816FD7
10002157 |> C3 RETN
10002158 |> E8 4E020000 CALL jagmisc.100023AB
1000215D \. C3 RETN
1000215E /$ 6A 00 PUSH 0
10002160 |. 6A 01 PUSH 1
10002162 |. FF7424 0C PUSH DWORD PTR SS:[ESP+C]
10002166 |. E8 30FFFFFF CALL jagmisc.1000209B
1000216B |. 83C4 0C ADD ESP,0C
1000216E \. C3 RETN
1000216F /$ 6A 01 PUSH 1
10002171 |. 6A 00 PUSH 0
10002173 |. 6A 00 PUSH 0
10002175 |. E8 21FFFFFF CALL jagmisc.1000209B
1000217A |. 83C4 0C ADD ESP,0C
1000217D \. C3 RETN
1000217E /$ 55 PUSH EBP
1000217F |. 8BEC MOV EBP,ESP
10002181 |. 51 PUSH ECX
10002182 |. 53 PUSH EBX
10002183 |. 56 PUSH ESI
10002184 |. 57 PUSH EDI
10002185 |. E8 77FBFFFF CALL jagmisc.10001D01
1000218A |. 8B7D 08 MOV EDI,[ARG.1]
1000218D |. 8BF0 MOV ESI,EAX
1000218F |. 8B56 54 MOV EDX,DWORD PTR DS:[ESI+54]
10002192 |. A1 ECA00010 MOV EAX,DWORD PTR DS:[1000A0EC]
10002197 |. 8BCA MOV ECX,EDX
10002199 |> 3939 /CMP DWORD PTR DS:[ECX],EDI
1000219B |. 74 0D |JE SHORT jagmisc.100021AA
1000219D |. 8D1C40 |LEA EBX,DWORD PTR DS:[EAX+EAX*2]
100021A0 |. 83C1 0C |ADD ECX,0C
100021A3 |. 8D1C9A |LEA EBX,DWORD PTR DS:[EDX+EBX*4]
100021A6 |. 3BCB |CMP ECX,EBX
100021A8 |.^ 72 EF \JB SHORT jagmisc.10002199
100021AA |> 8D0440 LEA EAX,DWORD PTR DS:[EAX+EAX*2]
100021AD |. 8D0482 LEA EAX,DWORD PTR DS:[EDX+EAX*4]
100021B0 |. 3BC8 CMP ECX,EAX
100021B2 |. 73 04 JNB SHORT jagmisc.100021B8
100021B4 |. 3939 CMP DWORD PTR DS:[ECX],EDI
100021B6 |. 74 02 JE SHORT jagmisc.100021BA
100021B8 |> 33C9 XOR ECX,ECX
100021BA |> 85C9 TEST ECX,ECX
100021BC |. 0F84 12010000 JE jagmisc.100022D4
100021C2 |. 8B59 08 MOV EBX,DWORD PTR DS:[ECX+8]
100021C5 |. 85DB TEST EBX,EBX
100021C7 |. 895D 08 MOV [ARG.1],EBX
100021CA |. 0F84 04010000 JE jagmisc.100022D4
100021D0 |. 83FB 05 CMP EBX,5
100021D3 |. 75 0C JNZ SHORT jagmisc.100021E1
100021D5 |. 8361 08 00 AND DWORD PTR DS:[ECX+8],0
100021D9 |. 33C0 XOR EAX,EAX
100021DB |. 40 INC EAX
100021DC |. E9 FC000000 JMP jagmisc.100022DD
100021E1 |> 83FB 01 CMP EBX,1
100021E4 |. 0F84 E5000000 JE jagmisc.100022CF
100021EA |. 8B46 58 MOV EAX,DWORD PTR DS:[ESI+58]
100021ED |. 8945 FC MOV [LOCAL.1],EAX
100021F0 |. 8B45 0C MOV EAX,[ARG.2]
100021F3 |. 8946 58 MOV DWORD PTR DS:[ESI+58],EAX
100021F6 |. 8B41 04 MOV EAX,DWORD PTR DS:[ECX+4]
100021F9 |. 83F8 08 CMP EAX,8
100021FC |. 0F85 BF000000 JNZ jagmisc.100022C1
10002202 |. 8B15 E0A00010 MOV EDX,DWORD PTR DS:[1000A0E0]
10002208 |. A1 E4A00010 MOV EAX,DWORD PTR DS:[1000A0E4]
1000220D |. 03C2 ADD EAX,EDX
1000220F |. 3BD0 CMP EDX,EAX
10002211 |. 7D 27 JGE SHORT jagmisc.1000223A
10002213 |. 8D0452 LEA EAX,DWORD PTR DS:[EDX+EDX*2]
10002216 |. C1E0 02 SHL EAX,2
10002219 |> 8B7E 54 /MOV EDI,DWORD PTR DS:[ESI+54]
1000221C |. 836438 08 00 |AND DWORD PTR DS:[EAX+EDI+8],0
10002221 |. 8B3D E0A00010 |MOV EDI,DWORD PTR DS:[1000A0E0]
10002227 |. 8B1D E4A00010 |MOV EBX,DWORD PTR DS:[1000A0E4]
1000222D |. 42 |INC EDX
1000222E |. 03DF |ADD EBX,EDI
10002230 |. 83C0 0C |ADD EAX,0C
10002233 |. 3BD3 |CMP EDX,EBX
10002235 |.^ 7C E2 \JL SHORT jagmisc.10002219
10002237 |. 8B5D 08 MOV EBX,[ARG.1]
1000223A |> 8B09 MOV ECX,DWORD PTR DS:[ECX]
1000223C |. 81F9 8E0000C0 CMP ECX,C000008E
10002242 |. 8B7E 5C MOV EDI,DWORD PTR DS:[ESI+5C]
10002245 |. 75 09 JNZ SHORT jagmisc.10002250
10002247 |. C746 5C 83000000 MOV DWORD PTR DS:[ESI+5C],83
1000224E |. EB 64 JMP SHORT jagmisc.100022B4
10002250 |> 81F9 900000C0 CMP ECX,C0000090
10002256 |. 75 09 JNZ SHORT jagmisc.10002261
10002258 |. C746 5C 81000000 MOV DWORD PTR DS:[ESI+5C],81
1000225F |. EB 53 JMP SHORT jagmisc.100022B4
10002261 |> 81F9 910000C0 CMP ECX,C0000091
10002267 |. 75 09 JNZ SHORT jagmisc.10002272
10002269 |. C746 5C 84000000 MOV DWORD PTR DS:[ESI+5C],84
10002270 |. EB 42 JMP SHORT jagmisc.100022B4
10002272 |> 81F9 930000C0 CMP ECX,C0000093
10002278 |. 75 09 JNZ SHORT jagmisc.10002283
1000227A |. C746 5C 85000000 MOV DWORD PTR DS:[ESI+5C],85
10002281 |. EB 31 JMP SHORT jagmisc.100022B4
10002283 |> 81F9 8D0000C0 CMP ECX,C000008D
10002289 |. 75 09 JNZ SHORT jagmisc.10002294
1000228B |. C746 5C 82000000 MOV DWORD PTR DS:[ESI+5C],82
10002292 |. EB 20 JMP SHORT jagmisc.100022B4
10002294 |> 81F9 8F0000C0 CMP ECX,C000008F
1000229A |. 75 09 JNZ SHORT jagmisc.100022A5
1000229C |. C746 5C 86000000 MOV DWORD PTR DS:[ESI+5C],86
100022A3 |. EB 0F JMP SHORT jagmisc.100022B4
100022A5 |> 81F9 920000C0 CMP ECX,C0000092
100022AB |. 75 07 JNZ SHORT jagmisc.100022B4
100022AD |. C746 5C 8A000000 MOV DWORD PTR DS:[ESI+5C],8A
100022B4 |> FF76 5C PUSH DWORD PTR DS:[ESI+5C]
100022B7 |. 6A 08 PUSH 8
100022B9 |. FFD3 CALL EBX
100022BB |. 59 POP ECX ; kernel32.7C816FD7
100022BC |. 897E 5C MOV DWORD PTR DS:[ESI+5C],EDI
100022BF |. EB 07 JMP SHORT jagmisc.100022C8
100022C1 |> 8361 08 00 AND DWORD PTR DS:[ECX+8],0
100022C5 |. 50 PUSH EAX
100022C6 |. FFD3 CALL EBX
100022C8 |> 8B45 FC MOV EAX,[LOCAL.1]
100022CB |. 59 POP ECX ; kernel32.7C816FD7
100022CC |. 8946 58 MOV DWORD PTR DS:[ESI+58],EAX
100022CF |> 83C8 FF OR EAX,FFFFFFFF
100022D2 |. EB 09 JMP SHORT jagmisc.100022DD
100022D4 |> FF75 0C PUSH [ARG.2] ; /pExceptionInfo = 7FFD9000
100022D7 |. FF15 78800010 CALL DWORD PTR DS:[<&KERNEL32.UnhandledExceptionFilter>] ; \UnhandledExceptionFilter
100022DD |> 5F POP EDI ; kernel32.7C816FD7
100022DE |. 5E POP ESI ; kernel32.7C816FD7
100022DF |. 5B POP EBX ; kernel32.7C816FD7
100022E0 |. C9 LEAVE
100022E1 \. C3 RETN
100022E2 /$ B8 63736DE0 MOV EAX,E06D7363
100022E7 |. 394424 04 CMP DWORD PTR SS:[ESP+4],EAX
100022EB |. 75 0D JNZ SHORT jagmisc.100022FA
100022ED |. FF7424 08 PUSH DWORD PTR SS:[ESP+8]
100022F1 |. 50 PUSH EAX
100022F2 |. E8 87FEFFFF CALL jagmisc.1000217E
100022F7 |. 59 POP ECX ; kernel32.7C816FD7
100022F8 |. 59 POP ECX ; kernel32.7C816FD7
100022F9 |. C3 RETN
100022FA |> 33C0 XOR EAX,EAX
100022FC \. C3 RETN
100022FD $ 6A 0C PUSH 0C
100022FF . 68 38820010 PUSH jagmisc.10008238
10002304 . E8 67000000 CALL jagmisc.10002370
10002309 . 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]
1000230C . 85F6 TEST ESI,ESI
1000230E . 74 58 JE SHORT jagmisc.10002368
10002310 . 833D 64B30010 03 CMP DWORD PTR DS:[1000B364],3
10002317 . 75 40 JNZ SHORT jagmisc.10002359
10002319 . 6A 04 PUSH 4 ; /Arg1 = 00000004
1000231B . E8 141B0000 CALL jagmisc.10003E34 ; \jagmisc.10003E34
10002320 . 59 POP ECX ; kernel32.7C816FD7
10002321 . 8365 FC 00 AND DWORD PTR SS:[EBP-4],0
10002325 . 56 PUSH ESI
10002326 . E8 22230000 CALL jagmisc.1000464D
1000232B . 59 POP ECX ; kernel32.7C816FD7
1000232C . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
1000232F . 85C0 TEST EAX,EAX
10002331 . 74 09 JE SHORT jagmisc.1000233C
10002333 . 56 PUSH ESI
10002334 . 50 PUSH EAX
10002335 . E8 3E230000 CALL jagmisc.10004678
1000233A . 59 POP ECX ; kernel32.7C816FD7
1000233B . 59 POP ECX ; kernel32.7C816FD7
1000233C > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10002340 . E8 0B000000 CALL jagmisc.10002350
10002345 . 837D E4 00 CMP DWORD PTR SS:[EBP-1C],0
10002349 . 75 1D JNZ SHORT jagmisc.10002368
1000234B . FF75 08 PUSH DWORD PTR SS:[EBP+8]
1000234E . EB 0A JMP SHORT jagmisc.1000235A
10002350 /$ 6A 04 PUSH 4
10002352 |. E8 281A0000 CALL jagmisc.10003D7F
10002357 |. 59 POP ECX ; kernel32.7C816FD7
10002358 \. C3 RETN
10002359 > 56 PUSH ESI
1000235A > 6A 00 PUSH 0 ; |Flags = 0
1000235C . FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000
10002362 . FF15 7C800010 CALL DWORD PTR DS:[<&KERNEL32.HeapFree>] ; \HeapFree
10002368 > E8 3E000000 CALL jagmisc.100023AB
1000236D . C3 RETN
1000236E CC INT3
1000236F CC INT3
10002370 /$ 68 C4230010 PUSH jagmisc.100023C4
10002375 |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
1000237B |. 50 PUSH EAX
1000237C |. 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10]
10002380 |. 896C24 10 MOV DWORD PTR SS:[ESP+10],EBP
10002384 |. 8D6C24 10 LEA EBP,DWORD PTR SS:[ESP+10]
10002388 |. 2BE0 SUB ESP,EAX
1000238A |. 53 PUSH EBX
1000238B |. 56 PUSH ESI
1000238C |. 57 PUSH EDI
1000238D |. 8B45 F8 MOV EAX,[LOCAL.2] ; LOADDLL.00410249
10002390 |. 8965 E8 MOV [LOCAL.6],ESP
10002393 |. 50 PUSH EAX
10002394 |. 8B45 FC MOV EAX,[LOCAL.1]
10002397 |. C745 FC FFFFFFFF MOV [LOCAL.1],-1
1000239E |. 8945 F8 MOV [LOCAL.2],EAX
100023A1 |. 8D45 F0 LEA EAX,[LOCAL.4]
100023A4 |. 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
100023AA \. C3 RETN
100023AB /$ 8B4D F0 MOV ECX,[LOCAL.4]
100023AE |. 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
100023B5 |. 59 POP ECX ; kernel32.7C816FD7
100023B6 |. 5F POP EDI ; kernel32.7C816FD7
100023B7 |. 5E POP ESI ; kernel32.7C816FD7
100023B8 |. 5B POP EBX ; kernel32.7C816FD7
100023B9 |. C9 LEAVE
100023BA |. 51 PUSH ECX
100023BB \. C3 RETN
100023BC . 56 PUSH ESI
100023BD . 43 INC EBX
100023BE . 3230 XOR DH,BYTE PTR DS:[EAX]
100023C0 . 58 POP EAX ; kernel32.7C816FD7
100023C1 . 43 INC EBX
100023C2 . 3030 XOR BYTE PTR DS:[EAX],DH
100023C4 /. 55 PUSH EBP
100023C5 |. 8BEC MOV EBP,ESP
100023C7 |. 83EC 08 SUB ESP,8
100023CA |. 53 PUSH EBX
100023CB |. 56 PUSH ESI
100023CC |. 57 PUSH EDI
100023CD |. 55 PUSH EBP
100023CE |. FC CLD
100023CF |. 8B5D 0C MOV EBX,[ARG.2]
100023D2 |. 8B45 08 MOV EAX,[ARG.1]
100023D5 |. F740 04 06000000 TEST DWORD PTR DS:[EAX+4],6
100023DC |. 0F85 AB000000 JNZ jagmisc.1000248D
100023E2 |. 8945 F8 MOV [LOCAL.2],EAX
100023E5 |. 8B45 10 MOV EAX,[ARG.3]
100023E8 |. 8945 FC MOV [LOCAL.1],EAX
100023EB |. 8D45 F8 LEA EAX,[LOCAL.2]
100023EE |. 8943 FC MOV DWORD PTR DS:[EBX-4],EAX
100023F1 |. 8B73 0C MOV ESI,DWORD PTR DS:[EBX+C]
100023F4 |. 8B7B 08 MOV EDI,DWORD PTR DS:[EBX+8]
100023F7 |. 53 PUSH EBX
100023F8 |. E8 192E0000 CALL jagmisc.10005216
100023FD |. 83C4 04 ADD ESP,4
10002400 |. 0BC0 OR EAX,EAX
10002402 |. 74 7B JE SHORT jagmisc.1000247F
10002404 |> 83FE FF /CMP ESI,-1
10002407 |. 74 7D |JE SHORT jagmisc.10002486
10002409 |. 8D0C76 |LEA ECX,DWORD PTR DS:[ESI+ESI*2]
1000240C |. 8B448F 04 |MOV EAX,DWORD PTR DS:[EDI+ECX*4+4]
10002410 |. 0BC0 |OR EAX,EAX
10002412 |. 74 59 |JE SHORT jagmisc.1000246D
10002414 |. 56 |PUSH ESI
10002415 |. 55 |PUSH EBP
10002416 |. 8D6B 10 |LEA EBP,DWORD PTR DS:[EBX+10]
10002419 |. 33DB |XOR EBX,EBX
1000241B |. 33C9 |XOR ECX,ECX
1000241D |. 33D2 |XOR EDX,EDX
1000241F |. 33F6 |XOR ESI,ESI
10002421 |. 33FF |XOR EDI,EDI
10002423 |. FFD0 |CALL EAX
10002425 |. 5D |POP EBP ; kernel32.7C816FD7
10002426 |. 5E |POP ESI ; kernel32.7C816FD7
10002427 |. 8B5D 0C |MOV EBX,[ARG.2]
1000242A |. 0BC0 |OR EAX,EAX
1000242C |. 74 3F |JE SHORT jagmisc.1000246D
1000242E |. 78 48 |JS SHORT jagmisc.10002478
10002430 |. 8B7B 08 |MOV EDI,DWORD PTR DS:[EBX+8]
10002433 |. 53 |PUSH EBX ; /Arg1 = 00000000
10002434 |. E8 EF2C0000 |CALL jagmisc.10005128 ; \jagmisc.10005128
10002439 |. 83C4 04 |ADD ESP,4
1000243C |. 8D6B 10 |LEA EBP,DWORD PTR DS:[EBX+10]
1000243F |. 56 |PUSH ESI
10002440 |. 53 |PUSH EBX
10002441 |. E8 242D0000 |CALL jagmisc.1000516A
10002446 |. 83C4 08 |ADD ESP,8
10002449 |. 8D0C76 |LEA ECX,DWORD PTR DS:[ESI+ESI*2]
1000244C |. 6A 01 |PUSH 1
1000244E |. 8B448F 08 |MOV EAX,DWORD PTR DS:[EDI+ECX*4+8]
10002452 |. E8 A72D0000 |CALL jagmisc.100051FE
10002457 |. 8B048F |MOV EAX,DWORD PTR DS:[EDI+ECX*4]
1000245A |. 8943 0C |MOV DWORD PTR DS:[EBX+C],EAX
1000245D |. 8B448F 08 |MOV EAX,DWORD PTR DS:[EDI+ECX*4+8]
10002461 |. 33DB |XOR EBX,EBX
10002463 |. 33C9 |XOR ECX,ECX
10002465 |. 33D2 |XOR EDX,EDX
10002467 |. 33F6 |XOR ESI,ESI
10002469 |. 33FF |XOR EDI,EDI
1000246B |. FFD0 |CALL EAX
1000246D |> 8B7B 08 |MOV EDI,DWORD PTR DS:[EBX+8]
10002470 |. 8D0C76 |LEA ECX,DWORD PTR DS:[ESI+ESI*2]
10002473 |. 8B348F |MOV ESI,DWORD PTR DS:[EDI+ECX*4]
10002476 |.^ EB 8C \JMP SHORT jagmisc.10002404
10002478 |> B8 00000000 MOV EAX,0
1000247D |. EB 23 JMP SHORT jagmisc.100024A2
1000247F |> 8B45 08 MOV EAX,[ARG.1]
10002482 |. 8348 04 08 OR DWORD PTR DS:[EAX+4],8
10002486 |> B8 01000000 MOV EAX,1
1000248B |. EB 15 JMP SHORT jagmisc.100024A2
1000248D |> 55 PUSH EBP
1000248E |. 8D6B 10 LEA EBP,DWORD PTR DS:[EBX+10]
10002491 |. 6A FF PUSH -1
10002493 |. 53 PUSH EBX
10002494 |. E8 D12C0000 CALL jagmisc.1000516A
10002499 |. 83C4 08 ADD ESP,8
1000249C |. 5D POP EBP ; kernel32.7C816FD7
1000249D |. B8 01000000 MOV EAX,1
100024A2 |> 5D POP EBP ; kernel32.7C816FD7
100024A3 |. 5F POP EDI ; kernel32.7C816FD7
100024A4 |. 5E POP ESI ; kernel32.7C816FD7
100024A5 |. 5B POP EBX ; kernel32.7C816FD7
100024A6 |. 8BE5 MOV ESP,EBP
100024A8 |. 5D POP EBP ; kernel32.7C816FD7
100024A9 \. C3 RETN
100024AA . 55 PUSH EBP
100024AB . 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8]
100024AF . 8B29 MOV EBP,DWORD PTR DS:[ECX]
100024B1 . 8B41 1C MOV EAX,DWORD PTR DS:[ECX+1C]
100024B4 . 50 PUSH EAX
100024B5 . 8B41 18 MOV EAX,DWORD PTR DS:[ECX+18]
100024B8 . 50 PUSH EAX
100024B9 . E8 AC2C0000 CALL jagmisc.1000516A
100024BE . 83C4 08 ADD ESP,8
100024C1 . 5D POP EBP ; kernel32.7C816FD7
100024C2 . C2 0400 RETN 4
100024C5 /$ E8 37F8FFFF CALL jagmisc.10001D01
100024CA |. 83C0 08 ADD EAX,8
100024CD \. C3 RETN
100024CE /$ 56 PUSH ESI
100024CF |. E8 2DF8FFFF CALL jagmisc.10001D01
100024D4 |. 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8]
100024D8 |. 8948 0C MOV DWORD PTR DS:[EAX+C],ECX
100024DB |. 33F6 XOR ESI,ESI
100024DD |> 3B0CF5 F0A00010 /CMP ECX,DWORD PTR DS:[ESI*8+1000A0F0]
100024E4 |. 74 1E |JE SHORT jagmisc.10002504
100024E6 |. 46 |INC ESI
100024E7 |. 83FE 2D |CMP ESI,2D
100024EA |.^ 72 F1 \JB SHORT jagmisc.100024DD
100024EC |. 83F9 13 CMP ECX,13
100024EF |. 72 24 JB SHORT jagmisc.10002515
100024F1 |. 83F9 24 CMP ECX,24
100024F4 |. 77 1F JA SHORT jagmisc.10002515
100024F6 |. E8 06F8FFFF CALL jagmisc.10001D01
100024FB |. C740 08 0D000000 MOV DWORD PTR DS:[EAX+8],0D
10002502 |. 5E POP ESI ; kernel32.7C816FD7
10002503 |. C3 RETN
10002504 |> E8 F8F7FFFF CALL jagmisc.10001D01
10002509 |. 8B0CF5 F4A00010 MOV ECX,DWORD PTR DS:[ESI*8+1000A0F4]
10002510 |. 8948 08 MOV DWORD PTR DS:[EAX+8],ECX
10002513 |. 5E POP ESI ; kernel32.7C816FD7
10002514 |. C3 RETN
10002515 |> 81F9 BC000000 CMP ECX,0BC
1000251B |. 72 16 JB SHORT jagmisc.10002533
1000251D |. 81F9 CA000000 CMP ECX,0CA
10002523 |. 77 0E JA SHORT jagmisc.10002533
10002525 |. E8 D7F7FFFF CALL jagmisc.10001D01
1000252A |. C740 08 08000000 MOV DWORD PTR DS:[EAX+8],8
10002531 |. 5E POP ESI ; kernel32.7C816FD7
10002532 |. C3 RETN
10002533 |> E8 C9F7FFFF CALL jagmisc.10001D01
10002538 |. C740 08 16000000 MOV DWORD PTR DS:[EAX+8],16
1000253F |. 5E POP ESI ; kernel32.7C816FD7
10002540 \. C3 RETN
10002541 $ 6A 10 PUSH 10
10002543 . 68 48820010 PUSH jagmisc.10008248
10002548 . E8 23FEFFFF CALL jagmisc.10002370
1000254D . 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]
10002550 . 0FAF75 0C IMUL ESI,DWORD PTR SS:[EBP+C]
10002554 . 8975 E0 MOV DWORD PTR SS:[EBP-20],ESI
10002557 . 85F6 TEST ESI,ESI
10002559 . 75 01 JNZ SHORT jagmisc.1000255C
1000255B . 46 INC ESI
1000255C > 33FF XOR EDI,EDI
1000255E . 897D E4 MOV DWORD PTR SS:[EBP-1C],EDI
10002561 . 83FE E0 CMP ESI,-20
10002564 . 77 65 JA SHORT jagmisc.100025CB
10002566 . 833D 64B30010 03 CMP DWORD PTR DS:[1000B364],3
1000256D . 75 47 JNZ SHORT jagmisc.100025B6
1000256F . 83C6 0F ADD ESI,0F
10002572 . 83E6 F0 AND ESI,FFFFFFF0
10002575 . 8975 0C MOV DWORD PTR SS:[EBP+C],ESI
10002578 . 8B5D E0 MOV EBX,DWORD PTR SS:[EBP-20]
1000257B . 3B1D 24B10010 CMP EBX,DWORD PTR DS:[1000B124]
10002581 . 77 33 JA SHORT jagmisc.100025B6
10002583 . 6A 04 PUSH 4 ; /Arg1 = 00000004
10002585 . E8 AA180000 CALL jagmisc.10003E34 ; \jagmisc.10003E34
1000258A . 59 POP ECX ; kernel32.7C816FD7
1000258B . 217D FC AND DWORD PTR SS:[EBP-4],EDI
1000258E . 53 PUSH EBX
1000258F . E8 98280000 CALL jagmisc.10004E2C
10002594 . 59 POP ECX ; kernel32.7C816FD7
10002595 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
10002598 . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
1000259C . E8 4A000000 CALL jagmisc.100025EB
100025A1 . 8B7D E4 MOV EDI,DWORD PTR SS:[EBP-1C]
100025A4 . 85FF TEST EDI,EDI
100025A6 . 74 12 JE SHORT jagmisc.100025BA
100025A8 . FF75 E0 PUSH DWORD PTR SS:[EBP-20]
100025AB . 6A 00 PUSH 0
100025AD . 57 PUSH EDI
100025AE . E8 5D150000 CALL jagmisc.10003B10
100025B3 . 83C4 0C ADD ESP,0C
100025B6 > 85FF TEST EDI,EDI
100025B8 . 75 3A JNZ SHORT jagmisc.100025F4
100025BA > 56 PUSH ESI ; /HeapSize = 0
100025BB . 6A 08 PUSH 8 ; |Flags = HEAP_ZERO_MEMORY
100025BD . FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000
100025C3 . FF15 80800010 CALL DWORD PTR DS:[<&KERNEL32.HeapAlloc>] ; \HeapAlloc
100025C9 . 8BF8 MOV EDI,EAX
100025CB > 85FF TEST EDI,EDI
100025CD . 75 25 JNZ SHORT jagmisc.100025F4
100025CF . 393D 90AF0010 CMP DWORD PTR DS:[1000AF90],EDI
100025D5 . 74 1D JE SHORT jagmisc.100025F4
100025D7 . 56 PUSH ESI
100025D8 . E8 622E0000 CALL jagmisc.1000543F
100025DD . 59 POP ECX ; kernel32.7C816FD7
100025DE . 85C0 TEST EAX,EAX
100025E0 .^ 0F85 76FFFFFF JNZ jagmisc.1000255C
100025E6 . EB 0E JMP SHORT jagmisc.100025F6
100025E8 8B DB 8B
100025E9 75 DB 75 ; CHAR 'u'
100025EA 0C DB 0C
100025EB /$ 6A 04 PUSH 4
100025ED |. E8 8D170000 CALL jagmisc.10003D7F
100025F2 |. 59 POP ECX ; kernel32.7C816FD7
100025F3 \. C3 RETN
100025F4 > 8BC7 MOV EAX,EDI
100025F6 > E8 B0FDFFFF CALL jagmisc.100023AB
100025FB . C3 RETN
100025FC /$ 83EC 48 SUB ESP,48
100025FF |. 53 PUSH EBX
10002600 |. BB 80040000 MOV EBX,480
10002605 |. 53 PUSH EBX
10002606 |. E8 912F0000 CALL jagmisc.1000559C
1000260B |. 85C0 TEST EAX,EAX
1000260D |. 59 POP ECX ; kernel32.7C816FD7
1000260E |. 75 08 JNZ SHORT jagmisc.10002618
10002610 |. 83C8 FF OR EAX,FFFFFFFF
10002613 |. E9 DD010000 JMP jagmisc.100027F5
10002618 |> A3 80B30010 MOV DWORD PTR DS:[1000B380],EAX
1000261D |. C705 68B30010 200>MOV DWORD PTR DS:[1000B368],20
10002627 |. 8D88 80040000 LEA ECX,DWORD PTR DS:[EAX+480]
1000262D |. EB 1E JMP SHORT jagmisc.1000264D
1000262F |> 8308 FF /OR DWORD PTR DS:[EAX],FFFFFFFF
10002632 |. 8360 08 00 |AND DWORD PTR DS:[EAX+8],0
10002636 |. C640 04 00 |MOV BYTE PTR DS:[EAX+4],0
1000263A |. C640 05 0A |MOV BYTE PTR DS:[EAX+5],0A
1000263E |. 8B0D 80B30010 |MOV ECX,DWORD PTR DS:[1000B380]
10002644 |. 83C0 24 |ADD EAX,24
10002647 |. 81C1 80040000 |ADD ECX,480
1000264D |> 3BC1 CMP EAX,ECX
1000264F |.^ 72 DE \JB SHORT jagmisc.1000262F
10002651 |. 55 PUSH EBP
10002652 |. 56 PUSH ESI
10002653 |. 57 PUSH EDI
10002654 |. 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14]
10002658 |. 50 PUSH EAX ; /pStartupinfo = 00000008
10002659 |. FF15 90800010 CALL DWORD PTR DS:[<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA
1000265F |. 66:837C24 46 00 CMP WORD PTR SS:[ESP+46],0
10002665 |. 0F84 E9000000 JE jagmisc.10002754
1000266B |. 8B4424 48 MOV EAX,DWORD PTR SS:[ESP+48]
1000266F |. 85C0 TEST EAX,EAX
10002671 |. 0F84 DD000000 JE jagmisc.10002754
10002677 |. 8B38 MOV EDI,DWORD PTR DS:[EAX]
10002679 |. 8D68 04 LEA EBP,DWORD PTR DS:[EAX+4]
1000267C |. 8D042F LEA EAX,DWORD PTR DS:[EDI+EBP]
1000267F |. 894424 10 MOV DWORD PTR SS:[ESP+10],EAX
10002683 |. B8 00080000 MOV EAX,800
10002688 |. 3BF8 CMP EDI,EAX
1000268A |. 7C 02 JL SHORT jagmisc.1000268E
1000268C |. 8BF8 MOV EDI,EAX
1000268E |> 393D 68B30010 CMP DWORD PTR DS:[1000B368],EDI
10002694 |. 7D 4E JGE SHORT jagmisc.100026E4
10002696 |. BE 84B30010 MOV ESI,jagmisc.1000B384
1000269B |> 53 /PUSH EBX
1000269C |. E8 FB2E0000 |CALL jagmisc.1000559C
100026A1 |. 85C0 |TEST EAX,EAX
100026A3 |. 59 |POP ECX ; kernel32.7C816FD7
100026A4 |. 74 38 |JE SHORT jagmisc.100026DE
100026A6 |. 8305 68B30010 20 |ADD DWORD PTR DS:[1000B368],20
100026AD |. 8906 |MOV DWORD PTR DS:[ESI],EAX
100026AF |. 8D88 80040000 |LEA ECX,DWORD PTR DS:[EAX+480]
100026B5 |. EB 16 |JMP SHORT jagmisc.100026CD
100026B7 |> 8308 FF |/OR DWORD PTR DS:[EAX],FFFFFFFF
100026BA |. 8360 08 00 ||AND DWORD PTR DS:[EAX+8],0
100026BE |. C640 04 00 ||MOV BYTE PTR DS:[EAX+4],0
100026C2 |. C640 05 0A ||MOV BYTE PTR DS:[EAX+5],0A
100026C6 |. 8B0E ||MOV ECX,DWORD PTR DS:[ESI]
100026C8 |. 83C0 24 ||ADD EAX,24
100026CB |. 03CB ||ADD ECX,EBX
100026CD |> 3BC1 | CMP EAX,ECX
100026CF |.^ 72 E6 |\JB SHORT jagmisc.100026B7
100026D1 |. 83C6 04 |ADD ESI,4
100026D4 |. 393D 68B30010 |CMP DWORD PTR DS:[1000B368],EDI
100026DA |.^ 7C BF \JL SHORT jagmisc.1000269B
100026DC |. EB 06 JMP SHORT jagmisc.100026E4
100026DE |> 8B3D 68B30010 MOV EDI,DWORD PTR DS:[1000B368]
100026E4 |> 33DB XOR EBX,EBX
100026E6 |. 85FF TEST EDI,EDI
100026E8 |. 7E 6A JLE SHORT jagmisc.10002754
100026EA |> 8B4424 10 /MOV EAX,DWORD PTR SS:[ESP+10]
100026EE |. 8B00 |MOV EAX,DWORD PTR DS:[EAX]
100026F0 |. 83F8 FF |CMP EAX,-1
100026F3 |. 74 54 |JE SHORT jagmisc.10002749
100026F5 |. 8A4D 00 |MOV CL,BYTE PTR SS:[EBP]
100026F8 |. F6C1 01 |TEST CL,1
100026FB |. 74 4C |JE SHORT jagmisc.10002749
100026FD |. F6C1 08 |TEST CL,8
10002700 |. 75 0B |JNZ SHORT jagmisc.1000270D
10002702 |. 50 |PUSH EAX ; /hFile = 00000008
10002703 |. FF15 8C800010 |CALL DWORD PTR DS:[<&KERNEL32.GetFileType>] ; \GetFileType
10002709 |. 85C0 |TEST EAX,EAX
1000270B |. 74 3C |JE SHORT jagmisc.10002749
1000270D |> 8BCB |MOV ECX,EBX
1000270F |. 8BC3 |MOV EAX,EBX
10002711 |. 83E0 1F |AND EAX,1F
10002714 |. 8D04C0 |LEA EAX,DWORD PTR DS:[EAX+EAX*8]
10002717 |. C1F9 05 |SAR ECX,5
1000271A |. 8B0C8D 80B30010 |MOV ECX,DWORD PTR DS:[ECX*4+1000B380]
10002721 |. 8D3481 |LEA ESI,DWORD PTR DS:[ECX+EAX*4]
10002724 |. 8B4424 10 |MOV EAX,DWORD PTR SS:[ESP+10]
10002728 |. 8B00 |MOV EAX,DWORD PTR DS:[EAX]
1000272A |. 8906 |MOV DWORD PTR DS:[ESI],EAX
1000272C |. 8A45 00 |MOV AL,BYTE PTR SS:[EBP]
1000272F |. 8846 04 |MOV BYTE PTR DS:[ESI+4],AL
10002732 |. 8D46 0C |LEA EAX,DWORD PTR DS:[ESI+C]
10002735 |. 68 A00F0000 |PUSH 0FA0
1000273A |. 50 |PUSH EAX
1000273B |. E8 2A2D0000 |CALL jagmisc.1000546A
10002740 |. 85C0 |TEST EAX,EAX
10002742 |. 59 |POP ECX ; kernel32.7C816FD7
10002743 |. 59 |POP ECX ; kernel32.7C816FD7
10002744 |. 74 2E |JE SHORT jagmisc.10002774
10002746 |. FF46 08 |INC DWORD PTR DS:[ESI+8]
10002749 |> 834424 10 04 |ADD DWORD PTR SS:[ESP+10],4
1000274E |. 43 |INC EBX
1000274F |. 45 |INC EBP
10002750 |. 3BDF |CMP EBX,EDI
10002752 |.^ 7C 96 \JL SHORT jagmisc.100026EA
10002754 |> 33DB XOR EBX,EBX
10002756 |> 8B0D 80B30010 MOV ECX,DWORD PTR DS:[1000B380]
1000275C |. 8D04DB LEA EAX,DWORD PTR DS:[EBX+EBX*8]
1000275F |. 8D3481 LEA ESI,DWORD PTR DS:[ECX+EAX*4]
10002762 |. 833E FF CMP DWORD PTR DS:[ESI],-1
10002765 |. 75 6F JNZ SHORT jagmisc.100027D6
10002767 |. 85DB TEST EBX,EBX
10002769 |. C646 04 81 MOV BYTE PTR DS:[ESI+4],81
1000276D |. 75 0A JNZ SHORT jagmisc.10002779
1000276F |. 6A F6 PUSH -0A
10002771 |. 58 POP EAX ; kernel32.7C816FD7
10002772 |. EB 0F JMP SHORT jagmisc.10002783
10002774 |> 83C8 FF OR EAX,FFFFFFFF
10002777 |. EB 79 JMP SHORT jagmisc.100027F2
10002779 |> 8BC3 MOV EAX,EBX
1000277B |. 48 DEC EAX
1000277C |. F7D8 NEG EAX
1000277E |. 1BC0 SBB EAX,EAX
10002780 |. 83C0 F5 ADD EAX,-0B
10002783 |> 50 PUSH EAX ; /DevType = 8
10002784 |. FF15 88800010 CALL DWORD PTR DS:[<&KERNEL32.GetStdHandle>] ; \GetStdHandle
1000278A |. 8BF8 MOV EDI,EAX
1000278C |. 83FF FF CMP EDI,-1
1000278F |. 74 3F JE SHORT jagmisc.100027D0
10002791 |. 57 PUSH EDI ; /hFile = NULL
10002792 |. FF15 8C800010 CALL DWORD PTR DS:[<&KERNEL32.GetFileType>] ; \GetFileType
10002798 |. 85C0 TEST EAX,EAX
1000279A |. 74 34 JE SHORT jagmisc.100027D0
1000279C |. 25 FF000000 AND EAX,0FF
100027A1 |. 83F8 02 CMP EAX,2
100027A4 |. 893E MOV DWORD PTR DS:[ESI],EDI
100027A6 |. 75 06 JNZ SHORT jagmisc.100027AE
100027A8 |. 804E 04 40 OR BYTE PTR DS:[ESI+4],40
100027AC |. EB 09 JMP SHORT jagmisc.100027B7
100027AE |> 83F8 03 CMP EAX,3
100027B1 |. 75 04 JNZ SHORT jagmisc.100027B7
100027B3 |. 804E 04 08 OR BYTE PTR DS:[ESI+4],8
100027B7 |> 8D46 0C LEA EAX,DWORD PTR DS:[ESI+C]
100027BA |. 68 A00F0000 PUSH 0FA0
100027BF |. 50 PUSH EAX
100027C0 |. E8 A52C0000 CALL jagmisc.1000546A
100027C5 |. 85C0 TEST EAX,EAX
100027C7 |. 59 POP ECX ; kernel32.7C816FD7
100027C8 |. 59 POP ECX ; kernel32.7C816FD7
100027C9 |.^ 74 A9 JE SHORT jagmisc.10002774
100027CB |. FF46 08 INC DWORD PTR DS:[ESI+8]
100027CE |. EB 0A JMP SHORT jagmisc.100027DA
100027D0 |> 804E 04 40 OR BYTE PTR DS:[ESI+4],40
100027D4 |. EB 04 JMP SHORT jagmisc.100027DA
100027D6 |> 804E 04 80 OR BYTE PTR DS:[ESI+4],80
100027DA |> 43 INC EBX
100027DB |. 83FB 03 CMP EBX,3
100027DE |.^ 0F8C 72FFFFFF JL jagmisc.10002756
100027E4 |. FF35 68B30010 PUSH DWORD PTR DS:[1000B368] ; /nHandles = 20 (32.)
100027EA |. FF15 84800010 CALL DWORD PTR DS:[<&KERNEL32.SetHandleCount>] ; \SetHandleCount
100027F0 |. 33C0 XOR EAX,EAX
100027F2 |> 5F POP EDI ; kernel32.7C816FD7
100027F3 |. 5E POP ESI ; kernel32.7C816FD7
100027F4 |. 5D POP EBP ; kernel32.7C816FD7
100027F5 |> 5B POP EBX ; kernel32.7C816FD7
100027F6 |. 83C4 48 ADD ESP,48
100027F9 \. C3 RETN
100027FA /$ 56 PUSH ESI
100027FB |. 57 PUSH EDI
100027FC |. BE 80B30010 MOV ESI,jagmisc.1000B380
10002801 |> 8B3E /MOV EDI,DWORD PTR DS:[ESI]
10002803 |. 85FF |TEST EDI,EDI
10002805 |. 74 31 |JE SHORT jagmisc.10002838
10002807 |. 8D87 80040000 |LEA EAX,DWORD PTR DS:[EDI+480]
1000280D |. EB 1A |JMP SHORT jagmisc.10002829
1000280F |> 837F 08 00 |/CMP DWORD PTR DS:[EDI+8],0
10002813 |. 74 0A ||JE SHORT jagmisc.1000281F
10002815 |. 8D47 0C ||LEA EAX,DWORD PTR DS:[EDI+C]
10002818 |. 50 ||PUSH EAX ; /pCriticalSection = 00000008
10002819 |. FF15 18800010 ||CALL DWORD PTR DS:[<&KERNEL32.DeleteCriticalSection>] ; \DeleteCriticalSection
1000281F |> 8B06 ||MOV EAX,DWORD PTR DS:[ESI]
10002821 |. 83C7 24 ||ADD EDI,24
10002824 |. 05 80040000 ||ADD EAX,480
10002829 |> 3BF8 | CMP EDI,EAX
1000282B |.^ 72 E2 |\JB SHORT jagmisc.1000280F
1000282D |. FF36 |PUSH DWORD PTR DS:[ESI]
1000282F |. E8 C9FAFFFF |CALL jagmisc.100022FD
10002834 |. 8326 00 |AND DWORD PTR DS:[ESI],0
10002837 |. 59 |POP ECX ; kernel32.7C816FD7
10002838 |> 83C6 04 |ADD ESI,4
1000283B |. 81FE 80B40010 |CMP ESI,jagmisc.1000B480
10002841 |.^ 7C BE \JL SHORT jagmisc.10002801
10002843 |. 5F POP EDI ; kernel32.7C816FD7
10002844 |. 5E POP ESI ; kernel32.7C816FD7
10002845 \. C3 RETN
10002846 /$ 53 PUSH EBX
10002847 |. 33DB XOR EBX,EBX
10002849 |. 391D 8CB40010 CMP DWORD PTR DS:[1000B48C],EBX
1000284F |. 56 PUSH ESI
10002850 |. 57 PUSH EDI
10002851 |. 75 05 JNZ SHORT jagmisc.10002858
10002853 |. E8 9D1C0000 CALL jagmisc.100044F5
10002858 |> 8B35 68AC0010 MOV ESI,DWORD PTR DS:[1000AC68]
1000285E |. 33FF XOR EDI,EDI
10002860 |. 3BF3 CMP ESI,EBX
10002862 |. 75 12 JNZ SHORT jagmisc.10002876
10002864 |. EB 30 JMP SHORT jagmisc.10002896
10002866 |> 3C 3D /CMP AL,3D
10002868 |. 74 01 |JE SHORT jagmisc.1000286B
1000286A |. 47 |INC EDI
1000286B |> 56 |PUSH ESI
1000286C |. E8 2F0F0000 |CALL jagmisc.100037A0
10002871 |. 59 |POP ECX ; kernel32.7C816FD7
10002872 |. 8D7406 01 |LEA ESI,DWORD PTR DS:[ESI+EAX+1]
10002876 |> 8A06 MOV AL,BYTE PTR DS:[ESI]
10002878 |. 3AC3 |CMP AL,BL
1000287A |.^ 75 EA \JNZ SHORT jagmisc.10002866
1000287C |. 8D04BD 04000000 LEA EAX,DWORD PTR DS:[EDI*4+4]
10002883 |. 50 PUSH EAX
10002884 |. E8 132D0000 CALL jagmisc.1000559C
10002889 |. 8BF8 MOV EDI,EAX
1000288B |. 3BFB CMP EDI,EBX
1000288D |. 59 POP ECX ; kernel32.7C816FD7
1000288E |. 893D ACAC0010 MOV DWORD PTR DS:[1000ACAC],EDI
10002894 |. 75 05 JNZ SHORT jagmisc.1000289B
10002896 |> 83C8 FF OR EAX,FFFFFFFF
10002899 |. EB 58 JMP SHORT jagmisc.100028F3
1000289B |> 8B35 68AC0010 MOV ESI,DWORD PTR DS:[1000AC68]
100028A1 |. 55 PUSH EBP
100028A2 |. EB 2A JMP SHORT jagmisc.100028CE
100028A4 |> 56 /PUSH ESI
100028A5 |. E8 F60E0000 |CALL jagmisc.100037A0
100028AA |. 8BE8 |MOV EBP,EAX
100028AC |. 45 |INC EBP
100028AD |. 803E 3D |CMP BYTE PTR DS:[ESI],3D
100028B0 |. 59 |POP ECX ; kernel32.7C816FD7
100028B1 |. 74 19 |JE SHORT jagmisc.100028CC
100028B3 |. 55 |PUSH EBP
100028B4 |. E8 E32C0000 |CALL jagmisc.1000559C
100028B9 |. 3BC3 |CMP EAX,EBX
100028BB |. 59 |POP ECX ; kernel32.7C816FD7
100028BC |. 8907 |MOV DWORD PTR DS:[EDI],EAX
100028BE |. 74 37 |JE SHORT jagmisc.100028F7
100028C0 |. 56 |PUSH ESI
100028C1 |. 50 |PUSH EAX
100028C2 |. E8 690F0000 |CALL jagmisc.10003830
100028C7 |. 59 |POP ECX ; kernel32.7C816FD7
100028C8 |. 59 |POP ECX ; kernel32.7C816FD7
100028C9 |. 83C7 04 |ADD EDI,4
100028CC |> 03F5 |ADD ESI,EBP
100028CE |> 381E CMP BYTE PTR DS:[ESI],BL
100028D0 |.^ 75 D2 \JNZ SHORT jagmisc.100028A4
100028D2 |. FF35 68AC0010 PUSH DWORD PTR DS:[1000AC68]
100028D8 |. E8 20FAFFFF CALL jagmisc.100022FD
100028DD |. 891D 68AC0010 MOV DWORD PTR DS:[1000AC68],EBX
100028E3 |. 891F MOV DWORD PTR DS:[EDI],EBX
100028E5 |. C705 80B40010 010>MOV DWORD PTR DS:[1000B480],1
100028EF |. 33C0 XOR EAX,EAX
100028F1 |> 59 POP ECX ; kernel32.7C816FD7
100028F2 |. 5D POP EBP ; kernel32.7C816FD7
100028F3 |> 5F POP EDI ; kernel32.7C816FD7
100028F4 |. 5E POP ESI ; kernel32.7C816FD7
100028F5 |. 5B POP EBX ; kernel32.7C816FD7
100028F6 |. C3 RETN
100028F7 |> FF35 ACAC0010 PUSH DWORD PTR DS:[1000ACAC]
100028FD |. E8 FBF9FFFF CALL jagmisc.100022FD
10002902 |. 891D ACAC0010 MOV DWORD PTR DS:[1000ACAC],EBX
10002908 |. 83C8 FF OR EAX,FFFFFFFF
1000290B \.^ EB E4 JMP SHORT jagmisc.100028F1
1000290D /$ 55 PUSH EBP
1000290E |. 8BEC MOV EBP,ESP
10002910 |. 51 PUSH ECX
10002911 |. 53 PUSH EBX
10002912 |. 8B5D 0C MOV EBX,[ARG.2]
10002915 |. 33D2 XOR EDX,EDX
10002917 |. 3955 08 CMP [ARG.1],EDX
1000291A |. 57 PUSH EDI
1000291B |. 8916 MOV DWORD PTR DS:[ESI],EDX
1000291D |. 8BF9 MOV EDI,ECX
1000291F |. C703 01000000 MOV DWORD PTR DS:[EBX],1
10002925 |. 74 09 JE SHORT jagmisc.10002930
10002927 |. 8B4D 08 MOV ECX,[ARG.1]
1000292A |. 8345 08 04 ADD [ARG.1],4
1000292E |. 8939 MOV DWORD PTR DS:[ECX],EDI
10002930 |> 8038 22 /CMP BYTE PTR DS:[EAX],22
10002933 |. 75 0E |JNZ SHORT jagmisc.10002943
10002935 |. 33C9 |XOR ECX,ECX
10002937 |. 85D2 |TEST EDX,EDX
10002939 |. 0F94C1 |SETE CL
1000293C |. 40 |INC EAX
1000293D |. 8BD1 |MOV EDX,ECX
1000293F |. B1 22 |MOV CL,22
10002941 |. EB 2D |JMP SHORT jagmisc.10002970
10002943 |> FF06 |INC DWORD PTR DS:[ESI]
10002945 |. 85FF |TEST EDI,EDI
10002947 |. 74 05 |JE SHORT jagmisc.1000294E
10002949 |. 8A08 |MOV CL,BYTE PTR DS:[EAX]
1000294B |. 880F |MOV BYTE PTR DS:[EDI],CL
1000294D |. 47 |INC EDI
1000294E |> 8A08 |MOV CL,BYTE PTR DS:[EAX]
10002950 |. 0FB6D9 |MOVZX EBX,CL
10002953 |. 40 |INC EAX
10002954 |. F683 41B10010 04 |TEST BYTE PTR DS:[EBX+1000B141],4
1000295B |. 74 0C |JE SHORT jagmisc.10002969
1000295D |. FF06 |INC DWORD PTR DS:[ESI]
1000295F |. 85FF |TEST EDI,EDI
10002961 |. 74 05 |JE SHORT jagmisc.10002968
10002963 |. 8A18 |MOV BL,BYTE PTR DS:[EAX]
10002965 |. 881F |MOV BYTE PTR DS:[EDI],BL
10002967 |. 47 |INC EDI
10002968 |> 40 |INC EAX
10002969 |> 84C9 |TEST CL,CL
1000296B |. 8B5D 0C |MOV EBX,[ARG.2]
1000296E |. 74 32 |JE SHORT jagmisc.100029A2
10002970 |> 85D2 |TEST EDX,EDX
10002972 |.^ 75 BC |JNZ SHORT jagmisc.10002930
10002974 |. 80F9 20 |CMP CL,20
10002977 |. 74 05 |JE SHORT jagmisc.1000297E
10002979 |. 80F9 09 |CMP CL,9
1000297C |.^ 75 B2 \JNZ SHORT jagmisc.10002930
1000297E |> 85FF TEST EDI,EDI
10002980 |. 74 04 JE SHORT jagmisc.10002986
10002982 |. C647 FF 00 MOV BYTE PTR DS:[EDI-1],0
10002986 |> 8365 FC 00 AND [LOCAL.1],0
1000298A |> 8038 00 CMP BYTE PTR DS:[EAX],0
1000298D |. 0F84 D6000000 JE jagmisc.10002A69
10002993 |> 8A08 /MOV CL,BYTE PTR DS:[EAX]
10002995 |. 80F9 20 |CMP CL,20
10002998 |. 74 05 |JE SHORT jagmisc.1000299F
1000299A |. 80F9 09 |CMP CL,9
1000299D |. 75 06 |JNZ SHORT jagmisc.100029A5
1000299F |> 40 |INC EAX
100029A0 |.^ EB F1 \JMP SHORT jagmisc.10002993
100029A2 |> 48 DEC EAX
100029A3 |.^ EB E1 JMP SHORT jagmisc.10002986
100029A5 |> 8038 00 CMP BYTE PTR DS:[EAX],0
100029A8 |. 0F84 BB000000 JE jagmisc.10002A69
100029AE |. 837D 08 00 CMP [ARG.1],0
100029B2 |. 74 09 JE SHORT jagmisc.100029BD
100029B4 |. 8B4D 08 MOV ECX,[ARG.1]
100029B7 |. 8345 08 04 ADD [ARG.1],4
100029BB |. 8939 MOV DWORD PTR DS:[ECX],EDI
100029BD |> FF03 INC DWORD PTR DS:[EBX]
100029BF |> 33DB /XOR EBX,EBX
100029C1 |. 43 |INC EBX
100029C2 |. 33D2 |XOR EDX,EDX
100029C4 |. EB 02 |JMP SHORT jagmisc.100029C8
100029C6 |> 40 |/INC EAX
100029C7 |. 42 ||INC EDX
100029C8 |> 8038 5C | CMP BYTE PTR DS:[EAX],5C
100029CB |.^ 74 F9 |\JE SHORT jagmisc.100029C6
100029CD |. 8038 22 |CMP BYTE PTR DS:[EAX],22
100029D0 |. 75 26 |JNZ SHORT jagmisc.100029F8
100029D2 |. F6C2 01 |TEST DL,1
100029D5 |. 75 1F |JNZ SHORT jagmisc.100029F6
100029D7 |. 837D FC 00 |CMP [LOCAL.1],0
100029DB |. 74 0C |JE SHORT jagmisc.100029E9
100029DD |. 8D48 01 |LEA ECX,DWORD PTR DS:[EAX+1]
100029E0 |. 8039 22 |CMP BYTE PTR DS:[ECX],22
100029E3 |. 75 04 |JNZ SHORT jagmisc.100029E9
100029E5 |. 8BC1 |MOV EAX,ECX
100029E7 |. EB 02 |JMP SHORT jagmisc.100029EB
100029E9 |> 33DB |XOR EBX,EBX
100029EB |> 33C9 |XOR ECX,ECX
100029ED |. 394D FC |CMP [LOCAL.1],ECX
100029F0 |. 0F94C1 |SETE CL
100029F3 |. 894D FC |MOV [LOCAL.1],ECX
100029F6 |> D1EA |SHR EDX,1
100029F8 |> 85D2 |TEST EDX,EDX
100029FA |. 74 0D |JE SHORT jagmisc.10002A09
100029FC |> 85FF |/TEST EDI,EDI
100029FE |. 74 04 ||JE SHORT jagmisc.10002A04
10002A00 |. C607 5C ||MOV BYTE PTR DS:[EDI],5C
10002A03 |. 47 ||INC EDI
10002A04 |> FF06 ||INC DWORD PTR DS:[ESI]
10002A06 |. 4A ||DEC EDX
10002A07 |.^ 75 F3 |\JNZ SHORT jagmisc.100029FC
10002A09 |> 8A08 |MOV CL,BYTE PTR DS:[EAX]
10002A0B |. 84C9 |TEST CL,CL
10002A0D |. 74 48 |JE SHORT jagmisc.10002A57
10002A0F |. 837D FC 00 |CMP [LOCAL.1],0
10002A13 |. 75 0A |JNZ SHORT jagmisc.10002A1F
10002A15 |. 80F9 20 |CMP CL,20
10002A18 |. 74 3D |JE SHORT jagmisc.10002A57
10002A1A |. 80F9 09 |CMP CL,9
10002A1D |. 74 38 |JE SHORT jagmisc.10002A57
10002A1F |> 85DB |TEST EBX,EBX
10002A21 |. 74 2E |JE SHORT jagmisc.10002A51
10002A23 |. 85FF |TEST EDI,EDI
10002A25 |. 74 19 |JE SHORT jagmisc.10002A40
10002A27 |. 0FB6D1 |MOVZX EDX,CL
10002A2A |. F682 41B10010 04 |TEST BYTE PTR DS:[EDX+1000B141],4
10002A31 |. 74 06 |JE SHORT jagmisc.10002A39
10002A33 |. 880F |MOV BYTE PTR DS:[EDI],CL
10002A35 |. 47 |INC EDI
10002A36 |. 40 |INC EAX
10002A37 |. FF06 |INC DWORD PTR DS:[ESI]
10002A39 |> 8A08 |MOV CL,BYTE PTR DS:[EAX]
10002A3B |. 880F |MOV BYTE PTR DS:[EDI],CL
10002A3D |. 47 |INC EDI
10002A3E |. EB 0F |JMP SHORT jagmisc.10002A4F
10002A40 |> 0FB6C9 |MOVZX ECX,CL
10002A43 |. F681 41B10010 04 |TEST BYTE PTR DS:[ECX+1000B141],4
10002A4A |. 74 03 |JE SHORT jagmisc.10002A4F
10002A4C |. 40 |INC EAX
10002A4D |. FF06 |INC DWORD PTR DS:[ESI]
10002A4F |> FF06 |INC DWORD PTR DS:[ESI]
10002A51 |> 40 |INC EAX
10002A52 |.^ E9 68FFFFFF \JMP jagmisc.100029BF
10002A57 |> 85FF TEST EDI,EDI
10002A59 |. 74 04 JE SHORT jagmisc.10002A5F
10002A5B |. C607 00 MOV BYTE PTR DS:[EDI],0
10002A5E |. 47 INC EDI
10002A5F |> FF06 INC DWORD PTR DS:[ESI]
10002A61 |. 8B5D 0C MOV EBX,[ARG.2]
10002A64 |.^ E9 21FFFFFF JMP jagmisc.1000298A
10002A69 |> 8B45 08 MOV EAX,[ARG.1]
10002A6C |. 85C0 TEST EAX,EAX
10002A6E |. 74 03 JE SHORT jagmisc.10002A73
10002A70 |. 8320 00 AND DWORD PTR DS:[EAX],0
10002A73 |> FF03 INC DWORD PTR DS:[EBX]
10002A75 |. 5F POP EDI ; kernel32.7C816FD7
10002A76 |. 5B POP EBX ; kernel32.7C816FD7
10002A77 |. C9 LEAVE
10002A78 \. C3 RETN
10002A79 /$ 55 PUSH EBP
10002A7A |. 8BEC MOV EBP,ESP
10002A7C |. 51 PUSH ECX
10002A7D |. 51 PUSH ECX
10002A7E |. 53 PUSH EBX
10002A7F |. 56 PUSH ESI
10002A80 |. 57 PUSH EDI
10002A81 |. 33FF XOR EDI,EDI
10002A83 |. 393D 8CB40010 CMP DWORD PTR DS:[1000B48C],EDI
10002A89 |. 75 05 JNZ SHORT jagmisc.10002A90
10002A8B |. E8 651A0000 CALL jagmisc.100044F5
10002A90 |> 68 04010000 PUSH 104 ; /BufSize = 104 (260.)
10002A95 |. BE D0AC0010 MOV ESI,jagmisc.1000ACD0 ; |ASCII "C:\\Documents and Settings\\Mike\\Desktop\\odbg110\\LOADDLL.EXE"
10002A9A |. 56 PUSH ESI ; |PathBuffer = NULL
10002A9B |. 57 PUSH EDI ; |hModule = NULL
10002A9C |. C605 D4AD0010 00 MOV BYTE PTR DS:[1000ADD4],0 ; |
10002AA3 |. FF15 94800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleFileNameA>] ; \GetModuleFileNameA
10002AA9 |. A1 90B40010 MOV EAX,DWORD PTR DS:[1000B490]
10002AAE |. 3BC7 CMP EAX,EDI
10002AB0 |. 8935 BCAC0010 MOV DWORD PTR DS:[1000ACBC],ESI
10002AB6 |. 74 07 JE SHORT jagmisc.10002ABF
10002AB8 |. 8038 00 CMP BYTE PTR DS:[EAX],0
10002ABB |. 8BD8 MOV EBX,EAX
10002ABD |. 75 02 JNZ SHORT jagmisc.10002AC1
10002ABF |> 8BDE MOV EBX,ESI
10002AC1 |> 8D45 FC LEA EAX,[LOCAL.1]
10002AC4 |. 50 PUSH EAX
10002AC5 |. 57 PUSH EDI
10002AC6 |. 8D75 F8 LEA ESI,[LOCAL.2]
10002AC9 |. 33C9 XOR ECX,ECX
10002ACB |. 8BC3 MOV EAX,EBX
10002ACD |. E8 3BFEFFFF CALL jagmisc.1000290D
10002AD2 |. 8B75 FC MOV ESI,[LOCAL.1]
10002AD5 |. 8B45 F8 MOV EAX,[LOCAL.2] ; LOADDLL.00410249
10002AD8 |. C1E6 02 SHL ESI,2
10002ADB |. 03C6 ADD EAX,ESI
10002ADD |. 50 PUSH EAX
10002ADE |. E8 B92A0000 CALL jagmisc.1000559C
10002AE3 |. 8BF8 MOV EDI,EAX
10002AE5 |. 83C4 0C ADD ESP,0C
10002AE8 |. 85FF TEST EDI,EDI
10002AEA |. 75 05 JNZ SHORT jagmisc.10002AF1
10002AEC |. 83C8 FF OR EAX,FFFFFFFF
10002AEF |. EB 25 JMP SHORT jagmisc.10002B16
10002AF1 |> 8D45 FC LEA EAX,[LOCAL.1]
10002AF4 |. 50 PUSH EAX
10002AF5 |. 8D0C3E LEA ECX,DWORD PTR DS:[ESI+EDI]
10002AF8 |. 57 PUSH EDI
10002AF9 |. 8D75 F8 LEA ESI,[LOCAL.2]
10002AFC |. 8BC3 MOV EAX,EBX
10002AFE |. E8 0AFEFFFF CALL jagmisc.1000290D
10002B03 |. 8B45 FC MOV EAX,[LOCAL.1]
10002B06 |. 48 DEC EAX
10002B07 |. 59 POP ECX ; kernel32.7C816FD7
10002B08 |. A3 A0AC0010 MOV DWORD PTR DS:[1000ACA0],EAX
10002B0D |. 59 POP ECX ; kernel32.7C816FD7
10002B0E |. 893D A4AC0010 MOV DWORD PTR DS:[1000ACA4],EDI
10002B14 |. 33C0 XOR EAX,EAX
10002B16 |> 5F POP EDI ; kernel32.7C816FD7
10002B17 |. 5E POP ESI ; kernel32.7C816FD7
10002B18 |. 5B POP EBX ; kernel32.7C816FD7
10002B19 |. C9 LEAVE
10002B1A \. C3 RETN
10002B1B /$ 51 PUSH ECX
10002B1C |. 51 PUSH ECX
10002B1D |. A1 D8AD0010 MOV EAX,DWORD PTR DS:[1000ADD8]
10002B22 |. 53 PUSH EBX
10002B23 |. 55 PUSH EBP
10002B24 |. 56 PUSH ESI
10002B25 |. 57 PUSH EDI
10002B26 |. 8B3D A8800010 MOV EDI,DWORD PTR DS:[<&KERNEL32.GetEnvironmentStringsW>] ; kernel32.GetEnvironmentStringsW
10002B2C |. 33DB XOR EBX,EBX
10002B2E |. 33F6 XOR ESI,ESI
10002B30 |. 3BC3 CMP EAX,EBX
10002B32 |. 6A 02 PUSH 2
10002B34 |. 5D POP EBP ; kernel32.7C816FD7
10002B35 |. 75 2D JNZ SHORT jagmisc.10002B64
10002B37 |. FFD7 CALL EDI ; [GetEnvironmentStringsW
10002B39 |. 8BF0 MOV ESI,EAX
10002B3B |. 3BF3 CMP ESI,EBX
10002B3D |. 74 0C JE SHORT jagmisc.10002B4B
10002B3F |. C705 D8AD0010 010>MOV DWORD PTR DS:[1000ADD8],1
10002B49 |. EB 1E JMP SHORT jagmisc.10002B69
10002B4B |> FF15 38800010 CALL DWORD PTR DS:[<&KERNEL32.GetLastError>] ; [GetLastError
10002B51 |. 83F8 78 CMP EAX,78
10002B54 |. 75 09 JNZ SHORT jagmisc.10002B5F
10002B56 |. 8BC5 MOV EAX,EBP
10002B58 |. A3 D8AD0010 MOV DWORD PTR DS:[1000ADD8],EAX
10002B5D |. EB 05 JMP SHORT jagmisc.10002B64
10002B5F |> A1 D8AD0010 MOV EAX,DWORD PTR DS:[1000ADD8]
10002B64 |> 83F8 01 CMP EAX,1
10002B67 |. 75 7D JNZ SHORT jagmisc.10002BE6
10002B69 |> 3BF3 CMP ESI,EBX
10002B6B |. 75 08 JNZ SHORT jagmisc.10002B75
10002B6D |. FFD7 CALL EDI
10002B6F |. 8BF0 MOV ESI,EAX
10002B71 |. 3BF3 CMP ESI,EBX
10002B73 |. 74 79 JE SHORT jagmisc.10002BEE
10002B75 |> 66:391E CMP WORD PTR DS:[ESI],BX
10002B78 |. 8BC6 MOV EAX,ESI
10002B7A |. 74 0E JE SHORT jagmisc.10002B8A
10002B7C |> 03C5 /ADD EAX,EBP
10002B7E |. 66:3918 |CMP WORD PTR DS:[EAX],BX
10002B81 |.^ 75 F9 |JNZ SHORT jagmisc.10002B7C
10002B83 |. 03C5 |ADD EAX,EBP
10002B85 |. 66:3918 |CMP WORD PTR DS:[EAX],BX
10002B88 |.^ 75 F2 \JNZ SHORT jagmisc.10002B7C
10002B8A |> 8B3D A4800010 MOV EDI,DWORD PTR DS:[<&KERNEL32.WideCharToMultiByte>] ; kernel32.WideCharToMultiByte
10002B90 |. 53 PUSH EBX ; /pDefaultCharUsed = NULL
10002B91 |. 53 PUSH EBX ; |pDefaultChar = NULL
10002B92 |. 53 PUSH EBX ; |MultiByteCount = 0
10002B93 |. 2BC6 SUB EAX,ESI ; |
10002B95 |. 53 PUSH EBX ; |MultiByteStr = NULL
10002B96 |. D1F8 SAR EAX,1 ; |
10002B98 |. 40 INC EAX ; |
10002B99 |. 50 PUSH EAX ; |WideCharCount = 8
10002B9A |. 56 PUSH ESI ; |WideCharStr = NULL
10002B9B |. 53 PUSH EBX ; |Options = 0
10002B9C |. 53 PUSH EBX ; |CodePage = CP_ACP
10002B9D |. 894424 34 MOV DWORD PTR SS:[ESP+34],EAX ; |
10002BA1 |. FFD7 CALL EDI ; \WideCharToMultiByte
10002BA3 |. 8BE8 MOV EBP,EAX
10002BA5 |. 3BEB CMP EBP,EBX
10002BA7 |. 74 32 JE SHORT jagmisc.10002BDB
10002BA9 |. 55 PUSH EBP
10002BAA |. E8 ED290000 CALL jagmisc.1000559C
10002BAF |. 3BC3 CMP EAX,EBX
10002BB1 |. 59 POP ECX ; kernel32.7C816FD7
10002BB2 |. 894424 10 MOV DWORD PTR SS:[ESP+10],EAX
10002BB6 |. 74 23 JE SHORT jagmisc.10002BDB
10002BB8 |. 53 PUSH EBX
10002BB9 |. 53 PUSH EBX
10002BBA |. 55 PUSH EBP
10002BBB |. 50 PUSH EAX
10002BBC |. FF7424 24 PUSH DWORD PTR SS:[ESP+24] ; kernel32.7C816FE0
10002BC0 |. 56 PUSH ESI
10002BC1 |. 53 PUSH EBX
10002BC2 |. 53 PUSH EBX
10002BC3 |. FFD7 CALL EDI
10002BC5 |. 85C0 TEST EAX,EAX
10002BC7 |. 75 0E JNZ SHORT jagmisc.10002BD7
10002BC9 |. FF7424 10 PUSH DWORD PTR SS:[ESP+10]
10002BCD |. E8 2BF7FFFF CALL jagmisc.100022FD
10002BD2 |. 59 POP ECX ; kernel32.7C816FD7
10002BD3 |. 895C24 10 MOV DWORD PTR SS:[ESP+10],EBX
10002BD7 |> 8B5C24 10 MOV EBX,DWORD PTR SS:[ESP+10]
10002BDB |> 56 PUSH ESI ; /EnvironmentBlock = NULL
10002BDC |. FF15 A0800010 CALL DWORD PTR DS:[<&KERNEL32.FreeEnvironmentStringsW>] ; \FreeEnvironmentStringsW
10002BE2 |. 8BC3 MOV EAX,EBX
10002BE4 |. EB 50 JMP SHORT jagmisc.10002C36
10002BE6 |> 3BC5 CMP EAX,EBP
10002BE8 |. 74 08 JE SHORT jagmisc.10002BF2
10002BEA |. 3BC3 CMP EAX,EBX
10002BEC |. 74 04 JE SHORT jagmisc.10002BF2
10002BEE |> 33C0 XOR EAX,EAX
10002BF0 |. EB 44 JMP SHORT jagmisc.10002C36
10002BF2 |> FF15 9C800010 CALL DWORD PTR DS:[<&KERNEL32.GetEnvironmentStrings>] ; [GetEnvironmentStrings
10002BF8 |. 8BF0 MOV ESI,EAX
10002BFA |. 3BF3 CMP ESI,EBX
10002BFC |.^ 74 F0 JE SHORT jagmisc.10002BEE
10002BFE |. 381E CMP BYTE PTR DS:[ESI],BL
10002C00 |. 74 0A JE SHORT jagmisc.10002C0C
10002C02 |> 40 /INC EAX
10002C03 |. 3818 |CMP BYTE PTR DS:[EAX],BL
10002C05 |.^ 75 FB |JNZ SHORT jagmisc.10002C02
10002C07 |. 40 |INC EAX
10002C08 |. 3818 |CMP BYTE PTR DS:[EAX],BL
10002C0A |.^ 75 F6 \JNZ SHORT jagmisc.10002C02
10002C0C |> 2BC6 SUB EAX,ESI
10002C0E |. 40 INC EAX
10002C0F |. 8BE8 MOV EBP,EAX
10002C11 |. 55 PUSH EBP
10002C12 |. E8 85290000 CALL jagmisc.1000559C
10002C17 |. 8BF8 MOV EDI,EAX
10002C19 |. 3BFB CMP EDI,EBX
10002C1B |. 59 POP ECX ; kernel32.7C816FD7
10002C1C |. 75 04 JNZ SHORT jagmisc.10002C22
10002C1E |. 33FF XOR EDI,EDI
10002C20 |. EB 0B JMP SHORT jagmisc.10002C2D
10002C22 |> 55 PUSH EBP
10002C23 |. 56 PUSH ESI
10002C24 |. 57 PUSH EDI
10002C25 |. E8 86290000 CALL jagmisc.100055B0
10002C2A |. 83C4 0C ADD ESP,0C
10002C2D |> 56 PUSH ESI ; /EnvironmentBlock = NULL
10002C2E |. FF15 98800010 CALL DWORD PTR DS:[<&KERNEL32.FreeEnvironmentStringsA>] ; \FreeEnvironmentStringsA
10002C34 |. 8BC7 MOV EAX,EDI
10002C36 |> 5F POP EDI ; kernel32.7C816FD7
10002C37 |. 5E POP ESI ; kernel32.7C816FD7
10002C38 |. 5D POP EBP ; kernel32.7C816FD7
10002C39 |. 5B POP EBX ; kernel32.7C816FD7
10002C3A |. 59 POP ECX ; kernel32.7C816FD7
10002C3B |. 59 POP ECX ; kernel32.7C816FD7
10002C3C \. C3 RETN
10002C3D $ 6A 0C PUSH 0C
10002C3F . 68 58820010 PUSH jagmisc.10008258
10002C44 . E8 27F7FFFF CALL jagmisc.10002370
10002C49 . C745 E4 6C920010 MOV DWORD PTR SS:[EBP-1C],jagmisc.1000926C
10002C50 > 817D E4 6C920010 CMP DWORD PTR SS:[EBP-1C],jagmisc.1000926C
10002C57 . 73 22 JNB SHORT jagmisc.10002C7B
10002C59 . 8365 FC 00 AND DWORD PTR SS:[EBP-4],0
10002C5D . 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
10002C60 . 8B00 MOV EAX,DWORD PTR DS:[EAX]
10002C62 . 85C0 TEST EAX,EAX
10002C64 . 74 0B JE SHORT jagmisc.10002C71
10002C66 . FFD0 CALL EAX
10002C68 . EB 07 JMP SHORT jagmisc.10002C71
10002C6A . 33C0 XOR EAX,EAX
10002C6C . 40 INC EAX
10002C6D . C3 RETN
10002C6E . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451
10002C71 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10002C75 . 8345 E4 04 ADD DWORD PTR SS:[EBP-1C],4
10002C79 .^ EB D5 JMP SHORT jagmisc.10002C50
10002C7B > E8 2BF7FFFF CALL jagmisc.100023AB
10002C80 . C3 RETN
10002C81 . 6A 0C PUSH 0C
10002C83 . 68 68820010 PUSH jagmisc.10008268
10002C88 . E8 E3F6FFFF CALL jagmisc.10002370
10002C8D . C745 E4 74920010 MOV DWORD PTR SS:[EBP-1C],jagmisc.10009274
10002C94 > 817D E4 74920010 CMP DWORD PTR SS:[EBP-1C],jagmisc.10009274
10002C9B . 73 22 JNB SHORT jagmisc.10002CBF
10002C9D . 8365 FC 00 AND DWORD PTR SS:[EBP-4],0
10002CA1 . 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
10002CA4 . 8B00 MOV EAX,DWORD PTR DS:[EAX]
10002CA6 . 85C0 TEST EAX,EAX
10002CA8 . 74 0B JE SHORT jagmisc.10002CB5
10002CAA . FFD0 CALL EAX
10002CAC . EB 07 JMP SHORT jagmisc.10002CB5
10002CAE . 33C0 XOR EAX,EAX
10002CB0 . 40 INC EAX
10002CB1 . C3 RETN
10002CB2 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451
10002CB5 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10002CB9 . 8345 E4 04 ADD DWORD PTR SS:[EBP-1C],4
10002CBD .^ EB D5 JMP SHORT jagmisc.10002C94
10002CBF > E8 E7F6FFFF CALL jagmisc.100023AB
10002CC4 . C3 RETN
10002CC5 /$ 833D 8CAC0010 02 CMP DWORD PTR DS:[1000AC8C],2
10002CCC |. 75 0D JNZ SHORT jagmisc.10002CDB
10002CCE |. 833D 98AC0010 05 CMP DWORD PTR DS:[1000AC98],5
10002CD5 |. 72 04 JB SHORT jagmisc.10002CDB
10002CD7 |. 33C0 XOR EAX,EAX
10002CD9 |. 40 INC EAX
10002CDA |. C3 RETN
10002CDB |> 6A 03 PUSH 3
10002CDD |. 58 POP EAX ; kernel32.7C816FD7
10002CDE \. C3 RETN
10002CDF /$ 33C0 XOR EAX,EAX
10002CE1 |. 394424 04 CMP DWORD PTR SS:[ESP+4],EAX
10002CE5 |. 6A 00 PUSH 0 ; /MaximumSize = 0
10002CE7 |. 0F94C0 SETE AL ; |
10002CEA |. 68 00100000 PUSH 1000 ; |InitialSize = 1000 (4096.)
10002CEF |. 50 PUSH EAX ; |Flags = HEAP_ZERO_MEMORY
10002CF0 |. FF15 B0800010 CALL DWORD PTR DS:[<&KERNEL32.HeapCreate>] ; \HeapCreate
10002CF6 |. 85C0 TEST EAX,EAX
10002CF8 |. A3 60B30010 MOV DWORD PTR DS:[1000B360],EAX
10002CFD |. 74 2A JE SHORT jagmisc.10002D29
10002CFF |. E8 C1FFFFFF CALL jagmisc.10002CC5
10002D04 |. 83F8 03 CMP EAX,3
10002D07 |. A3 64B30010 MOV DWORD PTR DS:[1000B364],EAX
10002D0C |. 75 1E JNZ SHORT jagmisc.10002D2C
10002D0E |. 68 F8030000 PUSH 3F8
10002D13 |. E8 ED180000 CALL jagmisc.10004605
10002D18 |. 85C0 TEST EAX,EAX
10002D1A |. 59 POP ECX ; kernel32.7C816FD7
10002D1B |. 75 0F JNZ SHORT jagmisc.10002D2C
10002D1D |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; /hHeap = 00390000
10002D23 |. FF15 AC800010 CALL DWORD PTR DS:[<&KERNEL32.HeapDestroy>] ; \HeapDestroy
10002D29 |> 33C0 XOR EAX,EAX
10002D2B |. C3 RETN
10002D2C |> 33C0 XOR EAX,EAX
10002D2E |. 40 INC EAX
10002D2F \. C3 RETN
10002D30 /$ 833D 64B30010 03 CMP DWORD PTR DS:[1000B364],3
10002D37 |. 75 69 JNZ SHORT jagmisc.10002DA2
10002D39 |. 53 PUSH EBX
10002D3A |. 33DB XOR EBX,EBX
10002D3C |. 391D 1CB10010 CMP DWORD PTR DS:[1000B11C],EBX
10002D42 |. 55 PUSH EBP
10002D43 |. 8B2D 7C800010 MOV EBP,DWORD PTR DS:[<&KERNEL32.HeapFree>] ; ntdll.RtlFreeHeap
10002D49 |. 7E 45 JLE SHORT jagmisc.10002D90
10002D4B |. 56 PUSH ESI
10002D4C |. 8B35 20B10010 MOV ESI,DWORD PTR DS:[1000B120]
10002D52 |. 57 PUSH EDI
10002D53 |. 8B3D B4800010 MOV EDI,DWORD PTR DS:[<&KERNEL32.VirtualFree>] ; kernel32.VirtualFree
10002D59 |. 83C6 0C ADD ESI,0C
10002D5C |> 68 00400000 /PUSH 4000
10002D61 |. 68 00001000 |PUSH 100000
10002D66 |. FF36 |PUSH DWORD PTR DS:[ESI]
10002D68 |. FFD7 |CALL EDI
10002D6A |. 68 00800000 |PUSH 8000
10002D6F |. 6A 00 |PUSH 0
10002D71 |. FF36 |PUSH DWORD PTR DS:[ESI]
10002D73 |. FFD7 |CALL EDI
10002D75 |. FF76 04 |PUSH DWORD PTR DS:[ESI+4]
10002D78 |. 6A 00 |PUSH 0
10002D7A |. FF35 60B30010 |PUSH DWORD PTR DS:[1000B360]
10002D80 |. FFD5 |CALL EBP
10002D82 |. 83C6 14 |ADD ESI,14
10002D85 |. 43 |INC EBX
10002D86 |. 3B1D 1CB10010 |CMP EBX,DWORD PTR DS:[1000B11C]
10002D8C |.^ 7C CE \JL SHORT jagmisc.10002D5C
10002D8E |. 5F POP EDI ; kernel32.7C816FD7
10002D8F |. 5E POP ESI ; kernel32.7C816FD7
10002D90 |> FF35 20B10010 PUSH DWORD PTR DS:[1000B120]
10002D96 |. 6A 00 PUSH 0
10002D98 |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360]
10002D9E |. FFD5 CALL EBP
10002DA0 |. 5D POP EBP ; kernel32.7C816FD7
10002DA1 |. 5B POP EBX ; kernel32.7C816FD7
10002DA2 |> FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; /hHeap = 00390000
10002DA8 |. FF15 AC800010 CALL DWORD PTR DS:[<&KERNEL32.HeapDestroy>] ; \HeapDestroy
10002DAE \. C3 RETN
10002DAF CC INT3
10002DB0 /$ 3D 00100000 CMP EAX,1000
10002DB5 |. 73 0E JNB SHORT jagmisc.10002DC5
10002DB7 |. F7D8 NEG EAX
10002DB9 |. 03C4 ADD EAX,ESP
10002DBB |. 83C0 04 ADD EAX,4
10002DBE |. 8500 TEST DWORD PTR DS:[EAX],EAX
10002DC0 |. 94 XCHG EAX,ESP
10002DC1 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
10002DC3 |. 50 PUSH EAX
10002DC4 |. C3 RETN
10002DC5 |> 51 PUSH ECX
10002DC6 |. 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]
10002DCA |> 81E9 00100000 SUB ECX,1000
10002DD0 |. 2D 00100000 SUB EAX,1000
10002DD5 |. 8501 TEST DWORD PTR DS:[ECX],EAX
10002DD7 |. 3D 00100000 CMP EAX,1000
10002DDC |.^ 73 EC JNB SHORT jagmisc.10002DCA
10002DDE |. 2BC8 SUB ECX,EAX
10002DE0 |. 8BC4 MOV EAX,ESP
10002DE2 |. 8501 TEST DWORD PTR DS:[ECX],EAX
10002DE4 |. 8BE1 MOV ESP,ECX
10002DE6 |. 8B08 MOV ECX,DWORD PTR DS:[EAX]
10002DE8 |. 8B40 04 MOV EAX,DWORD PTR DS:[EAX+4]
10002DEB |. 50 PUSH EAX
10002DEC \. C3 RETN
10002DED /$ 55 PUSH EBP
10002DEE |. 8DAC24 74FFFFFF LEA EBP,DWORD PTR SS:[ESP-8C]
10002DF5 |. 81EC 0C010000 SUB ESP,10C
10002DFB |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
10002E00 |. 8B8D 94000000 MOV ECX,DWORD PTR SS:[EBP+94]
10002E06 |. 53 PUSH EBX
10002E07 |. 56 PUSH ESI
10002E08 |. 8985 88000000 MOV DWORD PTR SS:[EBP+88],EAX
10002E0E |. 33D2 XOR EDX,EDX
10002E10 |. 57 PUSH EDI
10002E11 |. 33C0 XOR EAX,EAX
10002E13 |> 3B0CC5 80A20010 /CMP ECX,DWORD PTR DS:[EAX*8+1000A280]
10002E1A |. 74 06 |JE SHORT jagmisc.10002E22
10002E1C |. 40 |INC EAX
10002E1D |. 83F8 13 |CMP EAX,13
10002E20 |.^ 72 F1 \JB SHORT jagmisc.10002E13
10002E22 |> 8BF0 MOV ESI,EAX
10002E24 |. C1E6 03 SHL ESI,3
10002E27 |. 3B8E 80A20010 CMP ECX,DWORD PTR DS:[ESI+1000A280]
10002E2D |. 0F85 15010000 JNZ jagmisc.10002F48
10002E33 |. A1 70AC0010 MOV EAX,DWORD PTR DS:[1000AC70]
10002E38 |. 83F8 01 CMP EAX,1
10002E3B |. 0F84 DF000000 JE jagmisc.10002F20
10002E41 |. 3BC2 CMP EAX,EDX
10002E43 |. 75 0D JNZ SHORT jagmisc.10002E52
10002E45 |. 833D 74AC0010 01 CMP DWORD PTR DS:[1000AC74],1
10002E4C |. 0F84 CE000000 JE jagmisc.10002F20
10002E52 |> 81F9 FC000000 CMP ECX,0FC
10002E58 |. 0F84 EA000000 JE jagmisc.10002F48
10002E5E |. 68 04010000 PUSH 104 ; /BufSize = 104 (260.)
10002E63 |. 8D45 80 LEA EAX,[LOCAL.32] ; |
10002E66 |. 50 PUSH EAX ; |PathBuffer = 00000008
10002E67 |. 52 PUSH EDX ; |hModule = NULL
10002E68 |. 8895 84000000 MOV BYTE PTR SS:[EBP+84],DL ; |
10002E6E |. FF15 94800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleFileNameA>] ; \GetModuleFileNameA
10002E74 |. 85C0 TEST EAX,EAX
10002E76 |. 75 10 JNZ SHORT jagmisc.10002E88
10002E78 |. 8D45 80 LEA EAX,[LOCAL.32]
10002E7B |. 68 64860010 PUSH jagmisc.10008664 ; ASCII "<program name unknown>"
10002E80 |. 50 PUSH EAX
10002E81 |. E8 AA090000 CALL jagmisc.10003830
10002E86 |. 59 POP ECX ; kernel32.7C816FD7
10002E87 |. 59 POP ECX ; kernel32.7C816FD7
10002E88 |> 8D7D 80 LEA EDI,[LOCAL.32]
10002E8B |. 8BC7 MOV EAX,EDI
10002E8D |. 50 PUSH EAX
10002E8E |. E8 0D090000 CALL jagmisc.100037A0
10002E93 |. 40 INC EAX
10002E94 |. 83F8 3C CMP EAX,3C
10002E97 |. 59 POP ECX ; kernel32.7C816FD7
10002E98 |. 76 22 JBE SHORT jagmisc.10002EBC
10002E9A |. 8BC7 MOV EAX,EDI
10002E9C |. 50 PUSH EAX
10002E9D |. E8 FE080000 CALL jagmisc.100037A0
10002EA2 |. 8BF8 MOV EDI,EAX
10002EA4 |. 8D45 80 LEA EAX,[LOCAL.32]
10002EA7 |. 83E8 3B SUB EAX,3B
10002EAA |. 6A 03 PUSH 3
10002EAC |. 03F8 ADD EDI,EAX
10002EAE |. 68 60860010 PUSH jagmisc.10008660 ; ASCII "..."
10002EB3 |. 57 PUSH EDI
10002EB4 |. E8 372B0000 CALL jagmisc.100059F0
10002EB9 |. 83C4 10 ADD ESP,10
10002EBC |> 57 PUSH EDI
10002EBD |. E8 DE080000 CALL jagmisc.100037A0
10002EC2 |. FFB6 84A20010 PUSH DWORD PTR DS:[ESI+1000A284] ; jagmisc.100085F0
10002EC8 |. 8BD8 MOV EBX,EAX
10002ECA |. E8 D1080000 CALL jagmisc.100037A0
10002ECF |. 8D4403 1C LEA EAX,DWORD PTR DS:[EBX+EAX+1C]
10002ED3 |. 59 POP ECX ; kernel32.7C816FD7
10002ED4 |. 83C0 03 ADD EAX,3
10002ED7 |. 59 POP ECX ; kernel32.7C816FD7
10002ED8 |. 83E0 FC AND EAX,FFFFFFFC
10002EDB |. E8 D0FEFFFF CALL jagmisc.10002DB0
10002EE0 |. 8BDC MOV EBX,ESP
10002EE2 |. 68 44860010 PUSH jagmisc.10008644 ; ASCII "Runtime Error!\n\nProgram: "
10002EE7 |. 53 PUSH EBX
10002EE8 |. E8 43090000 CALL jagmisc.10003830
10002EED |. 57 PUSH EDI
10002EEE |. 53 PUSH EBX
10002EEF |. E8 4C090000 CALL jagmisc.10003840
10002EF4 |. 68 40860010 PUSH jagmisc.10008640 ; ASCII "\n\n"
10002EF9 |. 53 PUSH EBX
10002EFA |. E8 41090000 CALL jagmisc.10003840
10002EFF |. FFB6 84A20010 PUSH DWORD PTR DS:[ESI+1000A284] ; jagmisc.100085F0
10002F05 |. 53 PUSH EBX
10002F06 |. E8 35090000 CALL jagmisc.10003840
10002F0B |. 68 10200100 PUSH 12010
10002F10 |. 68 18860010 PUSH jagmisc.10008618 ; ASCII "Microsoft Visual C++ Runtime Library"
10002F15 |. 53 PUSH EBX
10002F16 |. E8 D2290000 CALL jagmisc.100058ED
10002F1B |. 83C4 2C ADD ESP,2C
10002F1E |. EB 28 JMP SHORT jagmisc.10002F48
10002F20 |> 52 PUSH EDX
10002F21 |. 8D85 94000000 LEA EAX,DWORD PTR SS:[EBP+94]
10002F27 |. 50 PUSH EAX
10002F28 |. 8DB6 84A20010 LEA ESI,DWORD PTR DS:[ESI+1000A284]
10002F2E |. FF36 PUSH DWORD PTR DS:[ESI]
10002F30 |. E8 6B080000 CALL jagmisc.100037A0
10002F35 |. 59 POP ECX ; |kernel32.7C816FD7
10002F36 |. 50 PUSH EAX ; |nBytesToWrite = 8
10002F37 |. FF36 PUSH DWORD PTR DS:[ESI] ; |Buffer
10002F39 |. 6A F4 PUSH -0C ; |/DevType = STD_ERROR_HANDLE
10002F3B |. FF15 88800010 CALL DWORD PTR DS:[<&KERNEL32.GetStdHandle>] ; |\GetStdHandle
10002F41 |. 50 PUSH EAX ; |hFile = 00000008
10002F42 |. FF15 B8800010 CALL DWORD PTR DS:[<&KERNEL32.WriteFile>] ; \WriteFile
10002F48 |> 8DA5 74FFFFFF LEA ESP,[LOCAL.35]
10002F4E |. 8B8D 88000000 MOV ECX,DWORD PTR SS:[EBP+88]
10002F54 |. E8 9D0B0000 CALL jagmisc.10003AF6
10002F59 |. 5F POP EDI ; kernel32.7C816FD7
10002F5A |. 5E POP ESI ; kernel32.7C816FD7
10002F5B |. 5B POP EBX ; kernel32.7C816FD7
10002F5C |. 81C5 8C000000 ADD EBP,8C
10002F62 |. C9 LEAVE
10002F63 \. C3 RETN
10002F64 /$ A1 70AC0010 MOV EAX,DWORD PTR DS:[1000AC70]
10002F69 |. 83F8 01 CMP EAX,1
10002F6C |. 74 0D JE SHORT jagmisc.10002F7B
10002F6E |. 85C0 TEST EAX,EAX
10002F70 |. 75 2A JNZ SHORT jagmisc.10002F9C
10002F72 |. 833D 74AC0010 01 CMP DWORD PTR DS:[1000AC74],1
10002F79 |. 75 21 JNZ SHORT jagmisc.10002F9C
10002F7B |> 68 FC000000 PUSH 0FC
10002F80 |. E8 68FEFFFF CALL jagmisc.10002DED
10002F85 |. A1 DCAD0010 MOV EAX,DWORD PTR DS:[1000ADDC]
10002F8A |. 85C0 TEST EAX,EAX
10002F8C |. 59 POP ECX ; kernel32.7C816FD7
10002F8D |. 74 02 JE SHORT jagmisc.10002F91
10002F8F |. FFD0 CALL EAX
10002F91 |> 68 FF000000 PUSH 0FF
10002F96 |. E8 52FEFFFF CALL jagmisc.10002DED
10002F9B |. 59 POP ECX ; kernel32.7C816FD7
10002F9C \> C3 RETN
10002F9D /$ E8 5FEDFFFF CALL jagmisc.10001D01
10002FA2 |. 8B40 64 MOV EAX,DWORD PTR DS:[EAX+64]
10002FA5 |. 3B05 ECA40010 CMP EAX,DWORD PTR DS:[1000A4EC] ; jagmisc.1000A498
10002FAB |. 74 05 JE SHORT jagmisc.10002FB2
10002FAD |. E8 44100000 CALL jagmisc.10003FF6
10002FB2 |> 8378 28 01 CMP DWORD PTR DS:[EAX+28],1
10002FB6 |. 7E 10 JLE SHORT jagmisc.10002FC8
10002FB8 |. 6A 04 PUSH 4
10002FBA |. FF7424 08 PUSH DWORD PTR SS:[ESP+8]
10002FBE |. 50 PUSH EAX
10002FBF |. E8 502B0000 CALL jagmisc.10005B14
10002FC4 |. 83C4 0C ADD ESP,0C
10002FC7 |. C3 RETN
10002FC8 |> 8B40 48 MOV EAX,DWORD PTR DS:[EAX+48]
10002FCB |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10002FCF |. 0FB60448 MOVZX EAX,BYTE PTR DS:[EAX+ECX*2]
10002FD3 |. 83E0 04 AND EAX,4
10002FD6 \. C3 RETN
10002FD7 /$ 55 PUSH EBP
10002FD8 |. 8BEC MOV EBP,ESP
10002FDA |. 51 PUSH ECX
10002FDB |. 53 PUSH EBX
10002FDC |. 8B5D 0C MOV EBX,[ARG.2]
10002FDF |. 56 PUSH ESI
10002FE0 |. 8B75 08 MOV ESI,[ARG.1]
10002FE3 |. 837E 14 00 CMP DWORD PTR DS:[ESI+14],0
10002FE7 |. 57 PUSH EDI
10002FE8 |. 0F84 9D000000 JE jagmisc.1000308B
10002FEE |. 837E 24 00 CMP DWORD PTR DS:[ESI+24],0
10002FF2 |. 74 09 JE SHORT jagmisc.10002FFD
10002FF4 |. 83FB 7F CMP EBX,7F
10002FF7 |. 0F86 8E000000 JBE jagmisc.1000308B
10002FFD |> 33FF XOR EDI,EDI
10002FFF |. 47 INC EDI
10003000 |. 81FB 00010000 CMP EBX,100
10003006 |. 73 1F JNB SHORT jagmisc.10003027
10003008 |. 397E 28 CMP DWORD PTR DS:[ESI+28],EDI
1000300B |. 7E 0D JLE SHORT jagmisc.1000301A
1000300D |. 57 PUSH EDI
1000300E |. 53 PUSH EBX
1000300F |. 56 PUSH ESI
10003010 |. E8 FF2A0000 CALL jagmisc.10005B14
10003015 |. 83C4 0C ADD ESP,0C
10003018 |. EB 09 JMP SHORT jagmisc.10003023
1000301A |> 8B46 48 MOV EAX,DWORD PTR DS:[ESI+48]
1000301D |. 0FB60458 MOVZX EAX,BYTE PTR DS:[EAX+EBX*2]
10003021 |. 23C7 AND EAX,EDI
10003023 |> 85C0 TEST EAX,EAX
10003025 |. 74 71 JE SHORT jagmisc.10003098
10003027 |> 8B56 48 MOV EDX,DWORD PTR DS:[ESI+48]
1000302A |. 8BC3 MOV EAX,EBX
1000302C |. C1F8 08 SAR EAX,8
1000302F |. 0FB6C8 MOVZX ECX,AL
10003032 |. F6444A 01 80 TEST BYTE PTR DS:[EDX+ECX*2+1],80
10003037 |. 74 0F JE SHORT jagmisc.10003048
10003039 |. 6A 02 PUSH 2
1000303B |. 8845 08 MOV BYTE PTR SS:[EBP+8],AL
1000303E |. 885D 09 MOV BYTE PTR SS:[EBP+9],BL
10003041 |. C645 0A 00 MOV BYTE PTR SS:[EBP+A],0
10003045 |. 58 POP EAX ; kernel32.7C816FD7
10003046 |. EB 09 JMP SHORT jagmisc.10003051
10003048 |> 885D 08 MOV BYTE PTR SS:[EBP+8],BL
1000304B |. C645 09 00 MOV BYTE PTR SS:[EBP+9],0
1000304F |. 8BC7 MOV EAX,EDI
10003051 |> 57 PUSH EDI
10003052 |. FF76 04 PUSH DWORD PTR DS:[ESI+4]
10003055 |. 8D4D FC LEA ECX,[LOCAL.1]
10003058 |. 6A 03 PUSH 3
1000305A |. 51 PUSH ECX
1000305B |. 50 PUSH EAX
1000305C |. 8D45 08 LEA EAX,[ARG.1]
1000305F |. 50 PUSH EAX
10003060 |. 68 00010000 PUSH 100
10003065 |. FF76 14 PUSH DWORD PTR DS:[ESI+14]
10003068 |. E8 1E2B0000 CALL jagmisc.10005B8B
1000306D |. 83C4 20 ADD ESP,20
10003070 |. 85C0 TEST EAX,EAX
10003072 |. 74 24 JE SHORT jagmisc.10003098
10003074 |. 3BC7 CMP EAX,EDI
10003076 |. 75 06 JNZ SHORT jagmisc.1000307E
10003078 |. 0FB645 FC MOVZX EAX,BYTE PTR SS:[EBP-4]
1000307C |. EB 1C JMP SHORT jagmisc.1000309A
1000307E |> 0FB64D FD MOVZX ECX,BYTE PTR SS:[EBP-3]
10003082 |. 33C0 XOR EAX,EAX
10003084 |. 8A65 FC MOV AH,BYTE PTR SS:[EBP-4]
10003087 |. 0BC1 OR EAX,ECX
10003089 |. EB 0F JMP SHORT jagmisc.1000309A
1000308B |> 83FB 41 CMP EBX,41
1000308E |. 7C 08 JL SHORT jagmisc.10003098
10003090 |. 83FB 5A CMP EBX,5A
10003093 |. 8D43 20 LEA EAX,DWORD PTR DS:[EBX+20]
10003096 |. 7E 02 JLE SHORT jagmisc.1000309A
10003098 |> 8BC3 MOV EAX,EBX
1000309A |> 5F POP EDI ; kernel32.7C816FD7
1000309B |. 5E POP ESI ; kernel32.7C816FD7
1000309C |. 5B POP EBX ; kernel32.7C816FD7
1000309D |. C9 LEAVE
1000309E \. C3 RETN
1000309F /$ E8 5DECFFFF CALL jagmisc.10001D01
100030A4 |. 8B40 64 MOV EAX,DWORD PTR DS:[EAX+64]
100030A7 |. 3B05 ECA40010 CMP EAX,DWORD PTR DS:[1000A4EC] ; jagmisc.1000A498
100030AD |. 74 05 JE SHORT jagmisc.100030B4
100030AF |. E8 420F0000 CALL jagmisc.10003FF6
100030B4 |> FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738
100030B8 |. 50 PUSH EAX
100030B9 |. E8 19FFFFFF CALL jagmisc.10002FD7
100030BE |. 59 POP ECX ; kernel32.7C816FD7
100030BF |. 59 POP ECX ; kernel32.7C816FD7
100030C0 \. C3 RETN
100030C1 /$ 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
100030C5 |. 6A 20 PUSH 20
100030C7 |. 59 POP ECX ; kernel32.7C816FD7
100030C8 |. 99 CDQ
100030C9 |. F7F9 IDIV ECX
100030CB |. 6A 1F PUSH 1F
100030CD |. 59 POP ECX ; kernel32.7C816FD7
100030CE |. 2BCA SUB ECX,EDX
100030D0 |. 83CA FF OR EDX,FFFFFFFF
100030D3 |. D3E2 SHL EDX,CL
100030D5 |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
100030D9 |. F7D2 NOT EDX
100030DB |. 851481 TEST DWORD PTR DS:[ECX+EAX*4],EDX
100030DE |. 74 09 JE SHORT jagmisc.100030E9
100030E0 |> 33C0 XOR EAX,EAX
100030E2 |. C3 RETN
100030E3 |> 833C81 00 /CMP DWORD PTR DS:[ECX+EAX*4],0
100030E7 |.^ 75 F7 |JNZ SHORT jagmisc.100030E0
100030E9 |> 40 INC EAX
100030EA |. 83F8 03 |CMP EAX,3
100030ED |.^ 7C F4 \JL SHORT jagmisc.100030E3
100030EF |. 33C0 XOR EAX,EAX
100030F1 |. 40 INC EAX
100030F2 \. C3 RETN
100030F3 /$ 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
100030F7 |. 56 PUSH ESI
100030F8 |. 57 PUSH EDI
100030F9 |. 6A 20 PUSH 20
100030FB |. 59 POP ECX ; kernel32.7C816FD7
100030FC |. 99 CDQ
100030FD |. F7F9 IDIV ECX
100030FF |. 8B7C24 0C MOV EDI,DWORD PTR SS:[ESP+C]
10003103 |. 8BF0 MOV ESI,EAX
10003105 |. 8D04B7 LEA EAX,DWORD PTR DS:[EDI+ESI*4]
10003108 |. 50 PUSH EAX
10003109 |. 6A 1F PUSH 1F
1000310B |. 59 POP ECX ; kernel32.7C816FD7
1000310C |. 2BCA SUB ECX,EDX
1000310E |. 33D2 XOR EDX,EDX
10003110 |. 42 INC EDX
10003111 |. D3E2 SHL EDX,CL
10003113 |. 52 PUSH EDX
10003114 |. FF30 PUSH DWORD PTR DS:[EAX]
10003116 |. E8 2C2E0000 CALL jagmisc.10005F47
1000311B |. 83C4 0C ADD ESP,0C
1000311E |. 4E DEC ESI
1000311F |. 78 1C JS SHORT jagmisc.1000313D
10003121 |. 8D3CB7 LEA EDI,DWORD PTR DS:[EDI+ESI*4]
10003124 |> 85C0 /TEST EAX,EAX
10003126 |. 74 15 |JE SHORT jagmisc.1000313D
10003128 |. 57 |PUSH EDI
10003129 |. 6A 01 |PUSH 1
1000312B |. FF37 |PUSH DWORD PTR DS:[EDI]
1000312D |. E8 152E0000 |CALL jagmisc.10005F47
10003132 |. 83C4 0C |ADD ESP,0C
10003135 |. 4E |DEC ESI
10003136 |. 83EF 04 |SUB EDI,4
10003139 |. 85F6 |TEST ESI,ESI
1000313B |.^ 7D E7 \JGE SHORT jagmisc.10003124
1000313D |> 5F POP EDI ; kernel32.7C816FD7
1000313E |. 5E POP ESI ; kernel32.7C816FD7
1000313F \. C3 RETN
10003140 /$ 55 PUSH EBP
10003141 |. 8BEC MOV EBP,ESP
10003143 |. 51 PUSH ECX
10003144 |. 8365 FC 00 AND [LOCAL.1],0
10003148 |. 53 PUSH EBX
10003149 |. 56 PUSH ESI
1000314A |. 57 PUSH EDI
1000314B |. 8B7D 0C MOV EDI,[ARG.2]
1000314E |. 4F DEC EDI
1000314F |. 6A 20 PUSH 20
10003151 |. 8D47 01 LEA EAX,DWORD PTR DS:[EDI+1]
10003154 |. 59 POP ECX ; kernel32.7C816FD7
10003155 |. 99 CDQ
10003156 |. F7F9 IDIV ECX
10003158 |. 6A 1F PUSH 1F
1000315A |. 5E POP ESI ; kernel32.7C816FD7
1000315B |. 2BF2 SUB ESI,EDX
1000315D |. 33D2 XOR EDX,EDX
1000315F |. 42 INC EDX
10003160 |. 8BCE MOV ECX,ESI
10003162 |. D3E2 SHL EDX,CL
10003164 |. 8BD8 MOV EBX,EAX
10003166 |. 8B45 08 MOV EAX,[ARG.1]
10003169 |. 851498 TEST DWORD PTR DS:[EAX+EBX*4],EDX
1000316C |. 74 21 JE SHORT jagmisc.1000318F
1000316E |. 8D4F 01 LEA ECX,DWORD PTR DS:[EDI+1]
10003171 |. 51 PUSH ECX
10003172 |. 50 PUSH EAX
10003173 |. E8 49FFFFFF CALL jagmisc.100030C1
10003178 |. 85C0 TEST EAX,EAX
1000317A |. 59 POP ECX ; kernel32.7C816FD7
1000317B |. 59 POP ECX ; kernel32.7C816FD7
1000317C |. 75 0E JNZ SHORT jagmisc.1000318C
1000317E |. 57 PUSH EDI
1000317F |. FF75 08 PUSH [ARG.1]
10003182 |. E8 6CFFFFFF CALL jagmisc.100030F3
10003187 |. 59 POP ECX ; kernel32.7C816FD7
10003188 |. 59 POP ECX ; kernel32.7C816FD7
10003189 |. 8945 FC MOV [LOCAL.1],EAX
1000318C |> 8B45 08 MOV EAX,[ARG.1]
1000318F |> 83CA FF OR EDX,FFFFFFFF
10003192 |. 8BCE MOV ECX,ESI
10003194 |. D3E2 SHL EDX,CL
10003196 |. 6A 03 PUSH 3
10003198 |. 59 POP ECX ; kernel32.7C816FD7
10003199 |. 211498 AND DWORD PTR DS:[EAX+EBX*4],EDX
1000319C |. 43 INC EBX
1000319D |. 3BD9 CMP EBX,ECX
1000319F |. 7D 09 JGE SHORT jagmisc.100031AA
100031A1 |. 8D3C98 LEA EDI,DWORD PTR DS:[EAX+EBX*4]
100031A4 |. 2BCB SUB ECX,EBX
100031A6 |. 33C0 XOR EAX,EAX
100031A8 |. F3:AB REP STOS DWORD PTR ES:[EDI]
100031AA |> 8B45 FC MOV EAX,[LOCAL.1]
100031AD |. 5F POP EDI ; kernel32.7C816FD7
100031AE |. 5E POP ESI ; kernel32.7C816FD7
100031AF |. 5B POP EBX ; kernel32.7C816FD7
100031B0 |. C9 LEAVE
100031B1 \. C3 RETN
100031B2 /$ 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
100031B6 |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
100031BA |. 6A 03 PUSH 3
100031BC |. 5A POP EDX ; kernel32.7C816FD7
100031BD |. 2BC8 SUB ECX,EAX
100031BF |. 56 PUSH ESI
100031C0 |> 8B30 /MOV ESI,DWORD PTR DS:[EAX]
100031C2 |. 893401 |MOV DWORD PTR DS:[ECX+EAX],ESI
100031C5 |. 83C0 04 |ADD EAX,4
100031C8 |. 4A |DEC EDX
100031C9 |.^ 75 F5 \JNZ SHORT jagmisc.100031C0
100031CB |. 5E POP ESI ; kernel32.7C816FD7
100031CC \. C3 RETN
100031CD /$ 33C0 XOR EAX,EAX
100031CF |> 8B4C24 04 /MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
100031D3 |. 833C81 00 |CMP DWORD PTR DS:[ECX+EAX*4],0
100031D7 |. 75 0A |JNZ SHORT jagmisc.100031E3
100031D9 |. 40 |INC EAX
100031DA |. 83F8 03 |CMP EAX,3
100031DD |.^ 7C F0 \JL SHORT jagmisc.100031CF
100031DF |. 33C0 XOR EAX,EAX
100031E1 |. 40 INC EAX
100031E2 |. C3 RETN
100031E3 |> 33C0 XOR EAX,EAX
100031E5 \. C3 RETN
100031E6 /$ 55 PUSH EBP
100031E7 |. 8BEC MOV EBP,ESP
100031E9 |. 83EC 0C SUB ESP,0C
100031EC |. 8B45 0C MOV EAX,[ARG.2]
100031EF |. 53 PUSH EBX
100031F0 |. 56 PUSH ESI
100031F1 |. 57 PUSH EDI
100031F2 |. 6A 20 PUSH 20
100031F4 |. 5E POP ESI ; kernel32.7C816FD7
100031F5 |. 99 CDQ
100031F6 |. 8BCE MOV ECX,ESI
100031F8 |. F7F9 IDIV ECX
100031FA |. 8B5D 08 MOV EBX,[ARG.1]
100031FD |. 83CF FF OR EDI,FFFFFFFF
10003200 |. 8975 0C MOV [ARG.2],ESI
10003203 |. 8BCA MOV ECX,EDX
10003205 |. D3E7 SHL EDI,CL
10003207 |. 8945 F8 MOV [LOCAL.2],EAX
1000320A |. 33C0 XOR EAX,EAX
1000320C |. 2955 0C SUB [ARG.2],EDX
1000320F |. F7D7 NOT EDI
10003211 |. 8945 FC MOV [LOCAL.1],EAX
10003214 |> 8B3483 /MOV ESI,DWORD PTR DS:[EBX+EAX*4]
10003217 |. 8BCE |MOV ECX,ESI
10003219 |. 23CF |AND ECX,EDI
1000321B |. 894D F4 |MOV [LOCAL.3],ECX
1000321E |. 8BCA |MOV ECX,EDX
10003220 |. D3EE |SHR ESI,CL
10003222 |. 8B4D 0C |MOV ECX,[ARG.2]
10003225 |. 0B75 FC |OR ESI,[LOCAL.1]
10003228 |. 893483 |MOV DWORD PTR DS:[EBX+EAX*4],ESI
1000322B |. 8B75 F4 |MOV ESI,[LOCAL.3]
1000322E |. D3E6 |SHL ESI,CL
10003230 |. 40 |INC EAX
10003231 |. 83F8 03 |CMP EAX,3
10003234 |. 8975 FC |MOV [LOCAL.1],ESI
10003237 |.^ 7C DB \JL SHORT jagmisc.10003214
10003239 |. 6A 02 PUSH 2
1000323B |. 58 POP EAX ; kernel32.7C816FD7
1000323C |. 8BC8 MOV ECX,EAX
1000323E |. 2B4D F8 SUB ECX,[LOCAL.2] ; LOADDLL.00410249
10003241 |. 8D0C8B LEA ECX,DWORD PTR DS:[EBX+ECX*4]
10003244 |> 3B45 F8 /CMP EAX,[LOCAL.2] ; LOADDLL.00410249
10003247 |. 7C 07 |JL SHORT jagmisc.10003250
10003249 |. 8B11 |MOV EDX,DWORD PTR DS:[ECX]
1000324B |. 891483 |MOV DWORD PTR DS:[EBX+EAX*4],EDX
1000324E |. EB 04 |JMP SHORT jagmisc.10003254
10003250 |> 832483 00 |AND DWORD PTR DS:[EBX+EAX*4],0
10003254 |> 48 |DEC EAX
10003255 |. 83E9 04 |SUB ECX,4
10003258 |. 85C0 |TEST EAX,EAX
1000325A |.^ 7D E8 \JGE SHORT jagmisc.10003244
1000325C |. 5F POP EDI ; kernel32.7C816FD7
1000325D |. 5E POP ESI ; kernel32.7C816FD7
1000325E |. 5B POP EBX ; kernel32.7C816FD7
1000325F |. C9 LEAVE
10003260 \. C3 RETN
10003261 /$ 55 PUSH EBP
10003262 |. 8BEC MOV EBP,ESP
10003264 |. 83EC 18 SUB ESP,18
10003267 |. 8B45 08 MOV EAX,[ARG.1]
1000326A |. 0FB748 0A MOVZX ECX,WORD PTR DS:[EAX+A]
1000326E |. 53 PUSH EBX
1000326F |. 56 PUSH ESI
10003270 |. 8B75 10 MOV ESI,[ARG.3]
10003273 |. 57 PUSH EDI
10003274 |. 8BF9 MOV EDI,ECX
10003276 |. 81E1 00800000 AND ECX,8000
1000327C |. 894D 08 MOV [ARG.1],ECX
1000327F |. 8B48 06 MOV ECX,DWORD PTR DS:[EAX+6]
10003282 |. 894D F4 MOV [LOCAL.3],ECX
10003285 |. 8B48 02 MOV ECX,DWORD PTR DS:[EAX+2]
10003288 |. 0FB700 MOVZX EAX,WORD PTR DS:[EAX]
1000328B |. C1E0 10 SHL EAX,10
1000328E |. 81E7 FF7F0000 AND EDI,7FFF
10003294 |. 81EF FF3F0000 SUB EDI,3FFF
1000329A |. 81FF 01C0FFFF CMP EDI,-3FFF
100032A0 |. 8945 FC MOV [LOCAL.1],EAX
100032A3 |. 8D45 F4 LEA EAX,[LOCAL.3]
100032A6 |. 894D F8 MOV [LOCAL.2],ECX
100032A9 |. 50 PUSH EAX
100032AA |. 75 1E JNZ SHORT jagmisc.100032CA
100032AC |. 33DB XOR EBX,EBX
100032AE |. E8 1AFFFFFF CALL jagmisc.100031CD
100032B3 |. 85C0 TEST EAX,EAX
100032B5 |. 59 POP ECX ; kernel32.7C816FD7
100032B6 |. 0F85 BD000000 JNZ jagmisc.10003379
100032BC |. 8D7D F4 LEA EDI,[LOCAL.3]
100032BF |. AB STOS DWORD PTR ES:[EDI]
100032C0 |. AB STOS DWORD PTR ES:[EDI]
100032C1 |. AB STOS DWORD PTR ES:[EDI]
100032C2 |> 6A 02 PUSH 2
100032C4 |. 58 POP EAX ; kernel32.7C816FD7
100032C5 |. E9 B1000000 JMP jagmisc.1000337B
100032CA |> 8D45 E8 LEA EAX,[LOCAL.6]
100032CD |. 50 PUSH EAX
100032CE |. E8 DFFEFFFF CALL jagmisc.100031B2
100032D3 |. FF76 08 PUSH DWORD PTR DS:[ESI+8]
100032D6 |. 8D45 F4 LEA EAX,[LOCAL.3]
100032D9 |. 50 PUSH EAX
100032DA |. E8 61FEFFFF CALL jagmisc.10003140
100032DF |. 83C4 10 ADD ESP,10
100032E2 |. 85C0 TEST EAX,EAX
100032E4 |. 74 01 JE SHORT jagmisc.100032E7
100032E6 |. 47 INC EDI
100032E7 |> 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]
100032EA |. 8BC8 MOV ECX,EAX
100032EC |. 2B4E 08 SUB ECX,DWORD PTR DS:[ESI+8]
100032EF |. 3BF9 CMP EDI,ECX
100032F1 |. 7D 0A JGE SHORT jagmisc.100032FD
100032F3 |. 33C0 XOR EAX,EAX
100032F5 |. 8D7D F4 LEA EDI,[LOCAL.3]
100032F8 |. AB STOS DWORD PTR ES:[EDI]
100032F9 |. AB STOS DWORD PTR ES:[EDI]
100032FA |. AB STOS DWORD PTR ES:[EDI]
100032FB |. EB 3C JMP SHORT jagmisc.10003339
100032FD |> 3BF8 CMP EDI,EAX
100032FF |. 7F 3C JG SHORT jagmisc.1000333D
10003301 |. 2BC7 SUB EAX,EDI
10003303 |. 8BF8 MOV EDI,EAX
10003305 |. 8D45 E8 LEA EAX,[LOCAL.6]
10003308 |. 50 PUSH EAX
10003309 |. 8D45 F4 LEA EAX,[LOCAL.3]
1000330C |. 50 PUSH EAX
1000330D |. E8 A0FEFFFF CALL jagmisc.100031B2
10003312 |. 8D45 F4 LEA EAX,[LOCAL.3]
10003315 |. 57 PUSH EDI
10003316 |. 50 PUSH EAX
10003317 |. E8 CAFEFFFF CALL jagmisc.100031E6
1000331C |. FF76 08 PUSH DWORD PTR DS:[ESI+8]
1000331F |. 8D45 F4 LEA EAX,[LOCAL.3]
10003322 |. 50 PUSH EAX
10003323 |. E8 18FEFFFF CALL jagmisc.10003140
10003328 |. 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C]
1000332B |. 40 INC EAX
1000332C |. 50 PUSH EAX
1000332D |. 8D45 F4 LEA EAX,[LOCAL.3]
10003330 |. 50 PUSH EAX
10003331 |. E8 B0FEFFFF CALL jagmisc.100031E6
10003336 |. 83C4 20 ADD ESP,20
10003339 |> 33DB XOR EBX,EBX
1000333B |.^ EB 85 JMP SHORT jagmisc.100032C2
1000333D |> 3B3E CMP EDI,DWORD PTR DS:[ESI]
1000333F |. FF76 0C PUSH DWORD PTR DS:[ESI+C]
10003342 |. 7C 21 JL SHORT jagmisc.10003365
10003344 |. 33C0 XOR EAX,EAX
10003346 |. 8D7D F4 LEA EDI,[LOCAL.3]
10003349 |. AB STOS DWORD PTR ES:[EDI]
1000334A |. AB STOS DWORD PTR ES:[EDI]
1000334B |. AB STOS DWORD PTR ES:[EDI]
1000334C |. 804D F7 80 OR BYTE PTR SS:[EBP-9],80
10003350 |. 8D45 F4 LEA EAX,[LOCAL.3]
10003353 |. 50 PUSH EAX
10003354 |. E8 8DFEFFFF CALL jagmisc.100031E6
10003359 |. 8B5E 14 MOV EBX,DWORD PTR DS:[ESI+14]
1000335C |. 031E ADD EBX,DWORD PTR DS:[ESI]
1000335E |. 59 POP ECX ; kernel32.7C816FD7
1000335F |. 33C0 XOR EAX,EAX
10003361 |. 59 POP ECX ; kernel32.7C816FD7
10003362 |. 40 INC EAX
10003363 |. EB 16 JMP SHORT jagmisc.1000337B
10003365 |> 8B5E 14 MOV EBX,DWORD PTR DS:[ESI+14]
10003368 |. 8065 F7 7F AND BYTE PTR SS:[EBP-9],7F
1000336C |. 8D45 F4 LEA EAX,[LOCAL.3]
1000336F |. 50 PUSH EAX
10003370 |. 03DF ADD EBX,EDI
10003372 |. E8 6FFEFFFF CALL jagmisc.100031E6
10003377 |. 59 POP ECX ; kernel32.7C816FD7
10003378 |. 59 POP ECX ; kernel32.7C816FD7
10003379 |> 33C0 XOR EAX,EAX
1000337B |> 6A 1F PUSH 1F
1000337D |. 59 POP ECX ; kernel32.7C816FD7
1000337E |. 2B4E 0C SUB ECX,DWORD PTR DS:[ESI+C]
10003381 |. 8B76 10 MOV ESI,DWORD PTR DS:[ESI+10]
10003384 |. D3E3 SHL EBX,CL
10003386 |. 8B4D 08 MOV ECX,[ARG.1]
10003389 |. F7D9 NEG ECX
1000338B |. 1BC9 SBB ECX,ECX
1000338D |. 81E1 00000080 AND ECX,80000000
10003393 |. 0BD9 OR EBX,ECX
10003395 |. 0B5D F4 OR EBX,[LOCAL.3]
10003398 |. 83FE 40 CMP ESI,40
1000339B |. 75 0D JNZ SHORT jagmisc.100033AA
1000339D |. 8B4D 0C MOV ECX,[ARG.2]
100033A0 |. 8B55 F8 MOV EDX,[LOCAL.2] ; LOADDLL.00410249
100033A3 |. 8959 04 MOV DWORD PTR DS:[ECX+4],EBX
100033A6 |. 8911 MOV DWORD PTR DS:[ECX],EDX
100033A8 |. EB 0A JMP SHORT jagmisc.100033B4
100033AA |> 83FE 20 CMP ESI,20
100033AD |. 75 05 JNZ SHORT jagmisc.100033B4
100033AF |. 8B4D 0C MOV ECX,[ARG.2]
100033B2 |. 8919 MOV DWORD PTR DS:[ECX],EBX
100033B4 |> 5F POP EDI ; kernel32.7C816FD7
100033B5 |. 5E POP ESI ; kernel32.7C816FD7
100033B6 |. 5B POP EBX ; kernel32.7C816FD7
100033B7 |. C9 LEAVE
100033B8 \. C3 RETN
100033B9 /$ 68 24A30010 PUSH jagmisc.1000A324
100033BE |. FF7424 0C PUSH DWORD PTR SS:[ESP+C]
100033C2 |. FF7424 0C PUSH DWORD PTR SS:[ESP+C]
100033C6 |. E8 96FEFFFF CALL jagmisc.10003261
100033CB |. 83C4 0C ADD ESP,0C
100033CE \. C3 RETN
100033CF /$ 68 3CA30010 PUSH jagmisc.1000A33C
100033D4 |. FF7424 0C PUSH DWORD PTR SS:[ESP+C]
100033D8 |. FF7424 0C PUSH DWORD PTR SS:[ESP+C]
100033DC |. E8 80FEFFFF CALL jagmisc.10003261
100033E1 |. 83C4 0C ADD ESP,0C
100033E4 \. C3 RETN
100033E5 /$ 55 PUSH EBP
100033E6 |. 8BEC MOV EBP,ESP
100033E8 |. 83EC 14 SUB ESP,14
100033EB |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
100033F0 |. 8945 FC MOV [LOCAL.1],EAX
100033F3 |. 33C0 XOR EAX,EAX
100033F5 |. 50 PUSH EAX
100033F6 |. 50 PUSH EAX
100033F7 |. 50 PUSH EAX
100033F8 |. 50 PUSH EAX
100033F9 |. FF75 0C PUSH [ARG.2]
100033FC |. 8D45 EC LEA EAX,[LOCAL.5]
100033FF |. 50 PUSH EAX
10003400 |. 8D45 F0 LEA EAX,[LOCAL.4]
10003403 |. 50 PUSH EAX
10003404 |. E8 F62C0000 CALL jagmisc.100060FF
10003409 |. FF75 08 PUSH [ARG.1]
1000340C |. 8D45 F0 LEA EAX,[LOCAL.4]
1000340F |. 50 PUSH EAX
10003410 |. E8 A4FFFFFF CALL jagmisc.100033B9
10003415 |. 8B4D FC MOV ECX,[LOCAL.1]
10003418 |. 83C4 24 ADD ESP,24
1000341B |. E8 D6060000 CALL jagmisc.10003AF6
10003420 |. C9 LEAVE
10003421 \. C3 RETN
10003422 /$ 55 PUSH EBP
10003423 |. 8BEC MOV EBP,ESP
10003425 |. 83EC 14 SUB ESP,14
10003428 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
1000342D |. 8945 FC MOV [LOCAL.1],EAX
10003430 |. 33C0 XOR EAX,EAX
10003432 |. 50 PUSH EAX
10003433 |. 50 PUSH EAX
10003434 |. 50 PUSH EAX
10003435 |. 50 PUSH EAX
10003436 |. FF75 0C PUSH [ARG.2]
10003439 |. 8D45 EC LEA EAX,[LOCAL.5]
1000343C |. 50 PUSH EAX
1000343D |. 8D45 F0 LEA EAX,[LOCAL.4]
10003440 |. 50 PUSH EAX
10003441 |. E8 B92C0000 CALL jagmisc.100060FF
10003446 |. FF75 08 PUSH [ARG.1]
10003449 |. 8D45 F0 LEA EAX,[LOCAL.4]
1000344C |. 50 PUSH EAX
1000344D |. E8 7DFFFFFF CALL jagmisc.100033CF
10003452 |. 8B4D FC MOV ECX,[LOCAL.1]
10003455 |. 83C4 24 ADD ESP,24
10003458 |. E8 99060000 CALL jagmisc.10003AF6
1000345D |. C9 LEAVE
1000345E \. C3 RETN
1000345F CC INT3
10003460 $ 55 PUSH EBP
10003461 . 8BEC MOV EBP,ESP
10003463 . 57 PUSH EDI
10003464 . 56 PUSH ESI
10003465 . 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C]
10003468 . 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]
1000346B . 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
1000346E . 8BC1 MOV EAX,ECX
10003470 . 8BD1 MOV EDX,ECX
10003472 . 03C6 ADD EAX,ESI
10003474 . 3BFE CMP EDI,ESI
10003476 . 76 08 JBE SHORT jagmisc.10003480
10003478 . 3BF8 CMP EDI,EAX
1000347A . 0F82 7C010000 JB jagmisc.100035FC
10003480 > F7C7 03000000 TEST EDI,3
10003486 . 75 14 JNZ SHORT jagmisc.1000349C
10003488 . C1E9 02 SHR ECX,2
1000348B . 83E2 03 AND EDX,3
1000348E . 83F9 08 CMP ECX,8
10003491 . 72 29 JB SHORT jagmisc.100034BC
10003493 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10003495 . FF2495 AC350010 JMP DWORD PTR DS:[EDX*4+100035AC] ; jagmisc.100035BC
1000349C > 8BC7 MOV EAX,EDI
1000349E . BA 03000000 MOV EDX,3
100034A3 . 83E9 04 SUB ECX,4
100034A6 . 72 0C JB SHORT jagmisc.100034B4
100034A8 . 83E0 03 AND EAX,3
100034AB . 03C8 ADD ECX,EAX
100034AD .- FF2485 C0340010 JMP DWORD PTR DS:[EAX*4+100034C0]
100034B4 > FF248D BC350010 JMP DWORD PTR DS:[ECX*4+100035BC] ; jagmisc.100035E4
100034BB 90 NOP
100034BC >- FF248D 40350010 JMP DWORD PTR DS:[ECX*4+10003540]
100034C3 90 DB 90
100034C4 . D0340010 DD jagmisc.100034D0 ; Switch table (1-based) used at 100034AD
100034C8 . FC340010 DD jagmisc.100034FC
100034CC . 20350010 DD jagmisc.10003520
100034D0 > 23D1 AND EDX,ECX
100034D2 . 8A06 MOV AL,BYTE PTR DS:[ESI]
100034D4 . 8807 MOV BYTE PTR DS:[EDI],AL
100034D6 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
100034D9 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
100034DC . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
100034DF . C1E9 02 SHR ECX,2
100034E2 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL
100034E5 . 83C6 03 ADD ESI,3
100034E8 . 83C7 03 ADD EDI,3
100034EB . 83F9 08 CMP ECX,8
100034EE .^ 72 CC JB SHORT jagmisc.100034BC
100034F0 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
100034F2 . FF2495 AC350010 JMP DWORD PTR DS:[EDX*4+100035AC] ; jagmisc.100035BC
100034F9 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
100034FC > 23D1 AND EDX,ECX
100034FE . 8A06 MOV AL,BYTE PTR DS:[ESI]
10003500 . 8807 MOV BYTE PTR DS:[EDI],AL
10003502 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
10003505 . C1E9 02 SHR ECX,2
10003508 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
1000350B . 83C6 02 ADD ESI,2
1000350E . 83C7 02 ADD EDI,2
10003511 . 83F9 08 CMP ECX,8
10003514 .^ 72 A6 JB SHORT jagmisc.100034BC
10003516 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10003518 . FF2495 AC350010 JMP DWORD PTR DS:[EDX*4+100035AC] ; jagmisc.100035BC
1000351F 90 NOP
10003520 > 23D1 AND EDX,ECX
10003522 . 8A06 MOV AL,BYTE PTR DS:[ESI]
10003524 . 8807 MOV BYTE PTR DS:[EDI],AL
10003526 . 83C6 01 ADD ESI,1
10003529 . C1E9 02 SHR ECX,2
1000352C . 83C7 01 ADD EDI,1
1000352F . 83F9 08 CMP ECX,8
10003532 .^ 72 88 JB SHORT jagmisc.100034BC
10003534 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10003536 . FF2495 AC350010 JMP DWORD PTR DS:[EDX*4+100035AC] ; jagmisc.100035BC
1000353D 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
10003540 . A3350010 DD jagmisc.100035A3 ; Switch table used at 100034BC
10003544 . 90350010 DD jagmisc.10003590
10003548 . 88350010 DD jagmisc.10003588
1000354C . 80350010 DD jagmisc.10003580
10003550 . 78350010 DD jagmisc.10003578
10003554 . 70350010 DD jagmisc.10003570
10003558 . 68350010 DD jagmisc.10003568
1000355C . 60350010 DD jagmisc.10003560
10003560 > 8B448E E4 MOV EAX,DWORD PTR DS:[ESI+ECX*4-1C]
10003564 . 89448F E4 MOV DWORD PTR DS:[EDI+ECX*4-1C],EAX
10003568 > 8B448E E8 MOV EAX,DWORD PTR DS:[ESI+ECX*4-18]
1000356C . 89448F E8 MOV DWORD PTR DS:[EDI+ECX*4-18],EAX
10003570 > 8B448E EC MOV EAX,DWORD PTR DS:[ESI+ECX*4-14]
10003574 . 89448F EC MOV DWORD PTR DS:[EDI+ECX*4-14],EAX
10003578 > 8B448E F0 MOV EAX,DWORD PTR DS:[ESI+ECX*4-10]
1000357C . 89448F F0 MOV DWORD PTR DS:[EDI+ECX*4-10],EAX
10003580 > 8B448E F4 MOV EAX,DWORD PTR DS:[ESI+ECX*4-C]
10003584 . 89448F F4 MOV DWORD PTR DS:[EDI+ECX*4-C],EAX
10003588 > 8B448E F8 MOV EAX,DWORD PTR DS:[ESI+ECX*4-8]
1000358C . 89448F F8 MOV DWORD PTR DS:[EDI+ECX*4-8],EAX
10003590 > 8B448E FC MOV EAX,DWORD PTR DS:[ESI+ECX*4-4]
10003594 . 89448F FC MOV DWORD PTR DS:[EDI+ECX*4-4],EAX
10003598 . 8D048D 00000000 LEA EAX,DWORD PTR DS:[ECX*4]
1000359F . 03F0 ADD ESI,EAX
100035A1 . 03F8 ADD EDI,EAX
100035A3 > FF2495 AC350010 JMP DWORD PTR DS:[EDX*4+100035AC] ; jagmisc.100035BC
100035AA 8BFF MOV EDI,EDI
100035AC . BC350010 DD jagmisc.100035BC ; Switch table used at 100034F2 and other places
100035B0 . C4350010 DD jagmisc.100035C4
100035B4 . D0350010 DD jagmisc.100035D0
100035B8 . E4350010 DD jagmisc.100035E4
100035BC > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
100035BF . 5E POP ESI ; kernel32.7C816FD7
100035C0 . 5F POP EDI ; kernel32.7C816FD7
100035C1 . C9 LEAVE
100035C2 . C3 RETN
100035C3 90 NOP
100035C4 > 8A06 MOV AL,BYTE PTR DS:[ESI]
100035C6 . 8807 MOV BYTE PTR DS:[EDI],AL
100035C8 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
100035CB . 5E POP ESI ; kernel32.7C816FD7
100035CC . 5F POP EDI ; kernel32.7C816FD7
100035CD . C9 LEAVE
100035CE . C3 RETN
100035CF 90 NOP
100035D0 > 8A06 MOV AL,BYTE PTR DS:[ESI]
100035D2 . 8807 MOV BYTE PTR DS:[EDI],AL
100035D4 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
100035D7 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
100035DA . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
100035DD . 5E POP ESI ; kernel32.7C816FD7
100035DE . 5F POP EDI ; kernel32.7C816FD7
100035DF . C9 LEAVE
100035E0 . C3 RETN
100035E1 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
100035E4 > 8A06 MOV AL,BYTE PTR DS:[ESI]
100035E6 . 8807 MOV BYTE PTR DS:[EDI],AL
100035E8 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
100035EB . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
100035EE . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
100035F1 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL
100035F4 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
100035F7 . 5E POP ESI ; kernel32.7C816FD7
100035F8 . 5F POP EDI ; kernel32.7C816FD7
100035F9 . C9 LEAVE
100035FA . C3 RETN
100035FB 90 NOP
100035FC > 8D7431 FC LEA ESI,DWORD PTR DS:[ECX+ESI-4]
10003600 . 8D7C39 FC LEA EDI,DWORD PTR DS:[ECX+EDI-4]
10003604 . F7C7 03000000 TEST EDI,3
1000360A . 75 24 JNZ SHORT jagmisc.10003630
1000360C . C1E9 02 SHR ECX,2
1000360F . 83E2 03 AND EDX,3
10003612 . 83F9 08 CMP ECX,8
10003615 . 72 0D JB SHORT jagmisc.10003624
10003617 . FD STD
10003618 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
1000361A . FC CLD
1000361B . FF2495 48370010 JMP DWORD PTR DS:[EDX*4+10003748] ; jagmisc.10003758
10003622 8BFF MOV EDI,EDI
10003624 > F7D9 NEG ECX
10003626 . FF248D F8360010 JMP DWORD PTR DS:[ECX*4+100036F8] ; jagmisc.1000372C
1000362D 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
10003630 > 8BC7 MOV EAX,EDI
10003632 . BA 03000000 MOV EDX,3 ; Switch (cases 0..3)
10003637 . 83F9 04 CMP ECX,4
1000363A . 72 0C JB SHORT jagmisc.10003648
1000363C . 83E0 03 AND EAX,3 ; Default case of switch 10003632
1000363F . 2BC8 SUB ECX,EAX
10003641 .- FF2485 4C360010 JMP DWORD PTR DS:[EAX*4+1000364C]
10003648 >- FF248D 48370010 JMP DWORD PTR DS:[ECX*4+10003748]
1000364F 90 DB 90
10003650 . 5C360010 DD jagmisc.1000365C ; Switch table (1-based) used at 10003641
10003654 . 80360010 DD jagmisc.10003680
10003658 . A8360010 DD jagmisc.100036A8
1000365C > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3]
1000365F . 23D1 AND EDX,ECX
10003661 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL
10003664 . 83EE 01 SUB ESI,1
10003667 . C1E9 02 SHR ECX,2
1000366A . 83EF 01 SUB EDI,1
1000366D . 83F9 08 CMP ECX,8
10003670 .^ 72 B2 JB SHORT jagmisc.10003624
10003672 . FD STD
10003673 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10003675 . FC CLD
10003676 . FF2495 48370010 JMP DWORD PTR DS:[EDX*4+10003748] ; jagmisc.10003758
1000367D 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
10003680 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3]
10003683 . 23D1 AND EDX,ECX
10003685 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL
10003688 . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
1000368B . C1E9 02 SHR ECX,2
1000368E . 8847 02 MOV BYTE PTR DS:[EDI+2],AL
10003691 . 83EE 02 SUB ESI,2
10003694 . 83EF 02 SUB EDI,2
10003697 . 83F9 08 CMP ECX,8
1000369A .^ 72 88 JB SHORT jagmisc.10003624
1000369C . FD STD
1000369D . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
1000369F . FC CLD
100036A0 . FF2495 48370010 JMP DWORD PTR DS:[EDX*4+10003748] ; jagmisc.10003758
100036A7 90 NOP
100036A8 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3]
100036AB . 23D1 AND EDX,ECX
100036AD . 8847 03 MOV BYTE PTR DS:[EDI+3],AL
100036B0 . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
100036B3 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL
100036B6 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
100036B9 . C1E9 02 SHR ECX,2
100036BC . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
100036BF . 83EE 03 SUB ESI,3
100036C2 . 83EF 03 SUB EDI,3
100036C5 . 83F9 08 CMP ECX,8
100036C8 .^ 0F82 56FFFFFF JB jagmisc.10003624
100036CE . FD STD
100036CF . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
100036D1 . FC CLD
100036D2 . FF2495 48370010 JMP DWORD PTR DS:[EDX*4+10003748] ; jagmisc.10003758
100036D9 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
100036DC . FC360010 DD jagmisc.100036FC
100036E0 . 04370010 DD jagmisc.10003704
100036E4 . 0C370010 DD jagmisc.1000370C
100036E8 . 14370010 DD jagmisc.10003714
100036EC . 1C370010 DD jagmisc.1000371C
100036F0 . 24370010 DD jagmisc.10003724
100036F4 . 2C370010 DD jagmisc.1000372C
100036F8 . 3F370010 DD jagmisc.1000373F
100036FC > 8B448E 1C MOV EAX,DWORD PTR DS:[ESI+ECX*4+1C]
10003700 . 89448F 1C MOV DWORD PTR DS:[EDI+ECX*4+1C],EAX
10003704 > 8B448E 18 MOV EAX,DWORD PTR DS:[ESI+ECX*4+18]
10003708 . 89448F 18 MOV DWORD PTR DS:[EDI+ECX*4+18],EAX
1000370C > 8B448E 14 MOV EAX,DWORD PTR DS:[ESI+ECX*4+14]
10003710 . 89448F 14 MOV DWORD PTR DS:[EDI+ECX*4+14],EAX
10003714 > 8B448E 10 MOV EAX,DWORD PTR DS:[ESI+ECX*4+10]
10003718 . 89448F 10 MOV DWORD PTR DS:[EDI+ECX*4+10],EAX
1000371C > 8B448E 0C MOV EAX,DWORD PTR DS:[ESI+ECX*4+C]
10003720 . 89448F 0C MOV DWORD PTR DS:[EDI+ECX*4+C],EAX
10003724 > 8B448E 08 MOV EAX,DWORD PTR DS:[ESI+ECX*4+8]
10003728 . 89448F 08 MOV DWORD PTR DS:[EDI+ECX*4+8],EAX
1000372C > 8B448E 04 MOV EAX,DWORD PTR DS:[ESI+ECX*4+4]
10003730 . 89448F 04 MOV DWORD PTR DS:[EDI+ECX*4+4],EAX
10003734 . 8D048D 00000000 LEA EAX,DWORD PTR DS:[ECX*4]
1000373B . 03F0 ADD ESI,EAX
1000373D . 03F8 ADD EDI,EAX
1000373F > FF2495 48370010 JMP DWORD PTR DS:[EDX*4+10003748] ; jagmisc.10003758
10003746 8BFF MOV EDI,EDI
10003748 . 58370010 DD jagmisc.10003758 ; Switch table used at 10003648 and other places
1000374C . 60370010 DD jagmisc.10003760
10003750 . 70370010 DD jagmisc.10003770
10003754 . 84370010 DD jagmisc.10003784
10003758 > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] ; Case 0 of switch 10003632
1000375B . 5E POP ESI ; kernel32.7C816FD7
1000375C . 5F POP EDI ; kernel32.7C816FD7
1000375D . C9 LEAVE
1000375E . C3 RETN
1000375F 90 NOP
10003760 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] ; Case 1 of switch 10003632
10003763 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL
10003766 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
10003769 . 5E POP ESI ; kernel32.7C816FD7
1000376A . 5F POP EDI ; kernel32.7C816FD7
1000376B . C9 LEAVE
1000376C . C3 RETN
1000376D 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
10003770 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] ; Case 2 of switch 10003632
10003773 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL
10003776 . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
10003779 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL
1000377C . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
1000377F . 5E POP ESI ; kernel32.7C816FD7
10003780 . 5F POP EDI ; kernel32.7C816FD7
10003781 . C9 LEAVE
10003782 . C3 RETN
10003783 90 NOP
10003784 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] ; Case 3 of switch 10003632
10003787 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL
1000378A . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
1000378D . 8847 02 MOV BYTE PTR DS:[EDI+2],AL
10003790 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
10003793 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
10003796 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
10003799 . 5E POP ESI ; kernel32.7C816FD7
1000379A . 5F POP EDI ; kernel32.7C816FD7
1000379B . C9 LEAVE
1000379C . C3 RETN
1000379D CC INT3
1000379E CC INT3
1000379F CC INT3
100037A0 /$ 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
100037A4 |. F7C1 03000000 TEST ECX,3
100037AA |. 74 24 JE SHORT jagmisc.100037D0
100037AC |> 8A01 /MOV AL,BYTE PTR DS:[ECX]
100037AE |. 83C1 01 |ADD ECX,1
100037B1 |. 84C0 |TEST AL,AL
100037B3 |. 74 4E |JE SHORT jagmisc.10003803
100037B5 |. F7C1 03000000 |TEST ECX,3
100037BB |.^ 75 EF \JNZ SHORT jagmisc.100037AC
100037BD |. 05 00000000 ADD EAX,0
100037C2 |. 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
100037C9 |. 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
100037D0 |> 8B01 /MOV EAX,DWORD PTR DS:[ECX]
100037D2 |. BA FFFEFE7E |MOV EDX,7EFEFEFF
100037D7 |. 03D0 |ADD EDX,EAX
100037D9 |. 83F0 FF |XOR EAX,FFFFFFFF
100037DC |. 33C2 |XOR EAX,EDX
100037DE |. 83C1 04 |ADD ECX,4
100037E1 |. A9 00010181 |TEST EAX,81010100
100037E6 |.^ 74 E8 |JE SHORT jagmisc.100037D0
100037E8 |. 8B41 FC |MOV EAX,DWORD PTR DS:[ECX-4]
100037EB |. 84C0 |TEST AL,AL
100037ED |. 74 32 |JE SHORT jagmisc.10003821
100037EF |. 84E4 |TEST AH,AH
100037F1 |. 74 24 |JE SHORT jagmisc.10003817
100037F3 |. A9 0000FF00 |TEST EAX,0FF0000
100037F8 |. 74 13 |JE SHORT jagmisc.1000380D
100037FA |. A9 000000FF |TEST EAX,FF000000
100037FF |. 74 02 |JE SHORT jagmisc.10003803
10003801 |.^ EB CD \JMP SHORT jagmisc.100037D0
10003803 |> 8D41 FF LEA EAX,DWORD PTR DS:[ECX-1]
10003806 |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
1000380A |. 2BC1 SUB EAX,ECX
1000380C |. C3 RETN
1000380D |> 8D41 FE LEA EAX,DWORD PTR DS:[ECX-2]
10003810 |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10003814 |. 2BC1 SUB EAX,ECX
10003816 |. C3 RETN
10003817 |> 8D41 FD LEA EAX,DWORD PTR DS:[ECX-3]
1000381A |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
1000381E |. 2BC1 SUB EAX,ECX
10003820 |. C3 RETN
10003821 |> 8D41 FC LEA EAX,DWORD PTR DS:[ECX-4]
10003824 |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10003828 |. 2BC1 SUB EAX,ECX
1000382A \. C3 RETN
1000382B CC INT3
1000382C CC INT3
1000382D CC INT3
1000382E CC INT3
1000382F CC INT3
10003830 $ 57 PUSH EDI
10003831 . 8B7C24 08 MOV EDI,DWORD PTR SS:[ESP+8]
10003835 . EB 6E JMP SHORT jagmisc.100038A5
10003837 8D DB 8D
10003838 A4 DB A4
10003839 24 DB 24 ; CHAR '$'
1000383A 00 DB 00
1000383B 00 DB 00
1000383C 00 DB 00
1000383D 00 DB 00
1000383E 8BFF MOV EDI,EDI
10003840 /$ 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10003844 |. 57 PUSH EDI
10003845 |. F7C1 03000000 TEST ECX,3
1000384B |. 74 13 JE SHORT jagmisc.10003860
1000384D |> 8A01 /MOV AL,BYTE PTR DS:[ECX]
1000384F |. 83C1 01 |ADD ECX,1
10003852 |. 84C0 |TEST AL,AL
10003854 |. 74 3D |JE SHORT jagmisc.10003893
10003856 |. F7C1 03000000 |TEST ECX,3
1000385C |.^ 75 EF \JNZ SHORT jagmisc.1000384D
1000385E |. 8BFF MOV EDI,EDI
10003860 |> 8B01 /MOV EAX,DWORD PTR DS:[ECX]
10003862 |. BA FFFEFE7E |MOV EDX,7EFEFEFF
10003867 |. 03D0 |ADD EDX,EAX
10003869 |. 83F0 FF |XOR EAX,FFFFFFFF
1000386C |. 33C2 |XOR EAX,EDX
1000386E |. 83C1 04 |ADD ECX,4
10003871 |. A9 00010181 |TEST EAX,81010100
10003876 |.^ 74 E8 |JE SHORT jagmisc.10003860
10003878 |. 8B41 FC |MOV EAX,DWORD PTR DS:[ECX-4]
1000387B |. 84C0 |TEST AL,AL
1000387D |. 74 23 |JE SHORT jagmisc.100038A2
1000387F |. 84E4 |TEST AH,AH
10003881 |. 74 1A |JE SHORT jagmisc.1000389D
10003883 |. A9 0000FF00 |TEST EAX,0FF0000
10003888 |. 74 0E |JE SHORT jagmisc.10003898
1000388A |. A9 000000FF |TEST EAX,FF000000
1000388F |. 74 02 |JE SHORT jagmisc.10003893
10003891 |.^ EB CD \JMP SHORT jagmisc.10003860
10003893 |> 8D79 FF LEA EDI,DWORD PTR DS:[ECX-1]
10003896 |. EB 0D JMP SHORT jagmisc.100038A5
10003898 |> 8D79 FE LEA EDI,DWORD PTR DS:[ECX-2]
1000389B |. EB 08 JMP SHORT jagmisc.100038A5
1000389D |> 8D79 FD LEA EDI,DWORD PTR DS:[ECX-3]
100038A0 |. EB 03 JMP SHORT jagmisc.100038A5
100038A2 |> 8D79 FC LEA EDI,DWORD PTR DS:[ECX-4]
100038A5 |> 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]
100038A9 |. F7C1 03000000 TEST ECX,3
100038AF |. 74 1D JE SHORT jagmisc.100038CE
100038B1 |> 8A11 /MOV DL,BYTE PTR DS:[ECX]
100038B3 |. 83C1 01 |ADD ECX,1
100038B6 |. 84D2 |TEST DL,DL
100038B8 |. 74 66 |JE SHORT jagmisc.10003920
100038BA |. 8817 |MOV BYTE PTR DS:[EDI],DL
100038BC |. 83C7 01 |ADD EDI,1
100038BF |. F7C1 03000000 |TEST ECX,3
100038C5 |.^ 75 EA \JNZ SHORT jagmisc.100038B1
100038C7 |. EB 05 JMP SHORT jagmisc.100038CE
100038C9 |> 8917 /MOV DWORD PTR DS:[EDI],EDX
100038CB |. 83C7 04 |ADD EDI,4
100038CE |> BA FFFEFE7E MOV EDX,7EFEFEFF
100038D3 |. 8B01 |MOV EAX,DWORD PTR DS:[ECX]
100038D5 |. 03D0 |ADD EDX,EAX
100038D7 |. 83F0 FF |XOR EAX,FFFFFFFF
100038DA |. 33C2 |XOR EAX,EDX
100038DC |. 8B11 |MOV EDX,DWORD PTR DS:[ECX]
100038DE |. 83C1 04 |ADD ECX,4
100038E1 |. A9 00010181 |TEST EAX,81010100
100038E6 |.^ 74 E1 |JE SHORT jagmisc.100038C9
100038E8 |. 84D2 |TEST DL,DL
100038EA |. 74 34 |JE SHORT jagmisc.10003920
100038EC |. 84F6 |TEST DH,DH
100038EE |. 74 27 |JE SHORT jagmisc.10003917
100038F0 |. F7C2 0000FF00 |TEST EDX,0FF0000
100038F6 |. 74 12 |JE SHORT jagmisc.1000390A
100038F8 |. F7C2 000000FF |TEST EDX,FF000000
100038FE |. 74 02 |JE SHORT jagmisc.10003902
10003900 |.^ EB C7 \JMP SHORT jagmisc.100038C9
10003902 |> 8917 MOV DWORD PTR DS:[EDI],EDX
10003904 |. 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
10003908 |. 5F POP EDI ; kernel32.7C816FD7
10003909 |. C3 RETN
1000390A |> 66:8917 MOV WORD PTR DS:[EDI],DX
1000390D |. 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
10003911 |. C647 02 00 MOV BYTE PTR DS:[EDI+2],0
10003915 |. 5F POP EDI ; kernel32.7C816FD7
10003916 |. C3 RETN
10003917 |> 66:8917 MOV WORD PTR DS:[EDI],DX
1000391A |. 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
1000391E |. 5F POP EDI ; kernel32.7C816FD7
1000391F |. C3 RETN
10003920 |> 8817 MOV BYTE PTR DS:[EDI],DL
10003922 |. 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
10003926 |. 5F POP EDI ; kernel32.7C816FD7
10003927 \. C3 RETN
10003928 /$ 55 PUSH EBP
10003929 |. 8BEC MOV EBP,ESP
1000392B |. 8B55 10 MOV EDX,[ARG.3]
1000392E |. 8B4A 0C MOV ECX,DWORD PTR DS:[EDX+C]
10003931 |. 53 PUSH EBX
10003932 |. 8B5D 0C MOV EBX,[ARG.2]
10003935 |. 85DB TEST EBX,EBX
10003937 |. 56 PUSH ESI
10003938 |. 8B75 08 MOV ESI,[ARG.1]
1000393B |. 57 PUSH EDI
1000393C |. 8D7E 01 LEA EDI,DWORD PTR DS:[ESI+1]
1000393F |. C606 30 MOV BYTE PTR DS:[ESI],30
10003942 |. 8BC7 MOV EAX,EDI
10003944 |. 7E 1F JLE SHORT jagmisc.10003965
10003946 |. 895D 08 MOV [ARG.1],EBX
10003949 |. 33DB XOR EBX,EBX
1000394B |> 8A11 /MOV DL,BYTE PTR DS:[ECX]
1000394D |. 84D2 |TEST DL,DL
1000394F |. 74 06 |JE SHORT jagmisc.10003957
10003951 |. 0FBED2 |MOVSX EDX,DL
10003954 |. 41 |INC ECX
10003955 |. EB 03 |JMP SHORT jagmisc.1000395A
10003957 |> 6A 30 |PUSH 30
10003959 |. 5A |POP EDX ; kernel32.7C816FD7
1000395A |> 8810 |MOV BYTE PTR DS:[EAX],DL
1000395C |. 40 |INC EAX
1000395D |. FF4D 08 |DEC [ARG.1]
10003960 |.^ 75 E9 \JNZ SHORT jagmisc.1000394B
10003962 |. 8B55 10 MOV EDX,[ARG.3]
10003965 |> 85DB TEST EBX,EBX
10003967 |. C600 00 MOV BYTE PTR DS:[EAX],0
1000396A |. 7C 12 JL SHORT jagmisc.1000397E
1000396C |. 8039 35 CMP BYTE PTR DS:[ECX],35
1000396F |. 7C 0D JL SHORT jagmisc.1000397E
10003971 |. EB 03 JMP SHORT jagmisc.10003976
10003973 |> C600 30 /MOV BYTE PTR DS:[EAX],30
10003976 |> 48 DEC EAX
10003977 |. 8038 39 |CMP BYTE PTR DS:[EAX],39
1000397A |.^ 74 F7 \JE SHORT jagmisc.10003973
1000397C |. FE00 INC BYTE PTR DS:[EAX]
1000397E |> 803E 31 CMP BYTE PTR DS:[ESI],31
10003981 |. 75 05 JNZ SHORT jagmisc.10003988
10003983 |. FF42 04 INC DWORD PTR DS:[EDX+4]
10003986 |. EB 12 JMP SHORT jagmisc.1000399A
10003988 |> 57 PUSH EDI
10003989 |. E8 12FEFFFF CALL jagmisc.100037A0
1000398E |. 40 INC EAX
1000398F |. 50 PUSH EAX
10003990 |. 57 PUSH EDI
10003991 |. 56 PUSH ESI
10003992 |. E8 C9FAFFFF CALL jagmisc.10003460
10003997 |. 83C4 10 ADD ESP,10
1000399A |> 5F POP EDI ; kernel32.7C816FD7
1000399B |. 5E POP ESI ; kernel32.7C816FD7
1000399C |. 5B POP EBX ; kernel32.7C816FD7
1000399D |. 5D POP EBP ; kernel32.7C816FD7
1000399E \. C3 RETN
1000399F /$ 55 PUSH EBP
100039A0 |. 8BEC MOV EBP,ESP
100039A2 |. 51 PUSH ECX
100039A3 |. 8B55 0C MOV EDX,[ARG.2]
100039A6 |. 33C0 XOR EAX,EAX
100039A8 |. 66:8B42 06 MOV AX,WORD PTR DS:[EDX+6]
100039AC |. 53 PUSH EBX
100039AD |. 56 PUSH ESI
100039AE |. 57 PUSH EDI
100039AF |. BF FF070000 MOV EDI,7FF
100039B4 |. BE 00000080 MOV ESI,80000000
100039B9 |. 8975 FC MOV [LOCAL.1],ESI
100039BC |. 8BC8 MOV ECX,EAX
100039BE |. C1E9 04 SHR ECX,4
100039C1 |. 25 00800000 AND EAX,8000
100039C6 |. 23CF AND ECX,EDI
100039C8 |. 8945 0C MOV [ARG.2],EAX
100039CB |. 8B42 04 MOV EAX,DWORD PTR DS:[EDX+4]
100039CE |. 8B12 MOV EDX,DWORD PTR DS:[EDX]
100039D0 |. 0FB7D9 MOVZX EBX,CX
100039D3 |. 25 FFFF0F00 AND EAX,0FFFFF
100039D8 |. 85DB TEST EBX,EBX
100039DA |. 74 13 JE SHORT jagmisc.100039EF
100039DC |. 3BDF CMP EBX,EDI
100039DE |. 74 08 JE SHORT jagmisc.100039E8
100039E0 |. 8DB9 003C0000 LEA EDI,DWORD PTR DS:[ECX+3C00]
100039E6 |. EB 28 JMP SHORT jagmisc.10003A10
100039E8 |> BF FF7F0000 MOV EDI,7FFF
100039ED |. EB 21 JMP SHORT jagmisc.10003A10
100039EF |> 33DB XOR EBX,EBX
100039F1 |. 3BC3 CMP EAX,EBX
100039F3 |. 75 12 JNZ SHORT jagmisc.10003A07
100039F5 |. 3BD3 CMP EDX,EBX
100039F7 |. 75 0E JNZ SHORT jagmisc.10003A07
100039F9 |. 8B45 08 MOV EAX,[ARG.1]
100039FC |. 8958 04 MOV DWORD PTR DS:[EAX+4],EBX
100039FF |. 8918 MOV DWORD PTR DS:[EAX],EBX
10003A01 |. 66:8958 08 MOV WORD PTR DS:[EAX+8],BX
10003A05 |. EB 4D JMP SHORT jagmisc.10003A54
10003A07 |> 8DB9 013C0000 LEA EDI,DWORD PTR DS:[ECX+3C01]
10003A0D |. 895D FC MOV [LOCAL.1],EBX
10003A10 |> 8BCA MOV ECX,EDX
10003A12 |. C1E9 15 SHR ECX,15
10003A15 |. C1E0 0B SHL EAX,0B
10003A18 |. 0BC8 OR ECX,EAX
10003A1A |. 0B4D FC OR ECX,[LOCAL.1]
10003A1D |. 8B45 08 MOV EAX,[ARG.1]
10003A20 |. C1E2 0B SHL EDX,0B
10003A23 |. 85CE TEST ESI,ECX
10003A25 |. 8948 04 MOV DWORD PTR DS:[EAX+4],ECX
10003A28 |. 8910 MOV DWORD PTR DS:[EAX],EDX
10003A2A |. 75 1F JNZ SHORT jagmisc.10003A4B
10003A2C |> 8B08 /MOV ECX,DWORD PTR DS:[EAX]
10003A2E |. 8B50 04 |MOV EDX,DWORD PTR DS:[EAX+4]
10003A31 |. 8BD9 |MOV EBX,ECX
10003A33 |. D1E2 |SHL EDX,1
10003A35 |. C1EB 1F |SHR EBX,1F
10003A38 |. 0BD3 |OR EDX,EBX
10003A3A |. 03C9 |ADD ECX,ECX
10003A3C |. 81C7 FFFF0000 |ADD EDI,0FFFF
10003A42 |. 85D6 |TEST ESI,EDX
10003A44 |. 8950 04 |MOV DWORD PTR DS:[EAX+4],EDX
10003A47 |. 8908 |MOV DWORD PTR DS:[EAX],ECX
10003A49 |.^ 74 E1 \JE SHORT jagmisc.10003A2C
10003A4B |> 8B4D 0C MOV ECX,[ARG.2]
10003A4E |. 0BCF OR ECX,EDI
10003A50 |. 66:8948 08 MOV WORD PTR DS:[EAX+8],CX
10003A54 |> 5F POP EDI ; kernel32.7C816FD7
10003A55 |. 5E POP ESI ; kernel32.7C816FD7
10003A56 |. 5B POP EBX ; kernel32.7C816FD7
10003A57 |. C9 LEAVE
10003A58 \. C3 RETN
10003A59 /$ 55 PUSH EBP
10003A5A |. 8BEC MOV EBP,ESP
10003A5C |. 83EC 2C SUB ESP,2C
10003A5F |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
10003A64 |. 8945 FC MOV [LOCAL.1],EAX
10003A67 |. 56 PUSH ESI
10003A68 |. 57 PUSH EDI
10003A69 |. 8D45 08 LEA EAX,[ARG.1]
10003A6C |. 50 PUSH EAX
10003A6D |. 8D45 F0 LEA EAX,[LOCAL.4]
10003A70 |. 50 PUSH EAX
10003A71 |. E8 29FFFFFF CALL jagmisc.1000399F
10003A76 |. 59 POP ECX ; kernel32.7C816FD7
10003A77 |. 59 POP ECX ; kernel32.7C816FD7
10003A78 |. 8D45 D4 LEA EAX,[LOCAL.11]
10003A7B |. 50 PUSH EAX
10003A7C |. 6A 00 PUSH 0
10003A7E |. 6A 11 PUSH 11
10003A80 |. 83EC 0C SUB ESP,0C
10003A83 |. 8D75 F0 LEA ESI,[LOCAL.4]
10003A86 |. 8BFC MOV EDI,ESP
10003A88 |. A5 MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10003A89 |. A5 MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10003A8A |. 66:A5 MOVS WORD PTR ES:[EDI],WORD PTR DS:[ESI]
10003A8C |. E8 A22A0000 CALL jagmisc.10006533
10003A91 |. 8B75 10 MOV ESI,[ARG.3]
10003A94 |. 8B7D 14 MOV EDI,[ARG.4]
10003A97 |. 8946 08 MOV DWORD PTR DS:[ESI+8],EAX
10003A9A |. 0FBE45 D6 MOVSX EAX,BYTE PTR SS:[EBP-2A]
10003A9E |. 8906 MOV DWORD PTR DS:[ESI],EAX
10003AA0 |. 0FBF45 D4 MOVSX EAX,WORD PTR SS:[EBP-2C]
10003AA4 |. 8946 04 MOV DWORD PTR DS:[ESI+4],EAX
10003AA7 |. 8D45 D8 LEA EAX,[LOCAL.10]
10003AAA |. 50 PUSH EAX
10003AAB |. 57 PUSH EDI
10003AAC |. E8 7FFDFFFF CALL jagmisc.10003830
10003AB1 |. 8B4D FC MOV ECX,[LOCAL.1]
10003AB4 |. 83C4 20 ADD ESP,20
10003AB7 |. 897E 0C MOV DWORD PTR DS:[ESI+C],EDI
10003ABA |. 8BC6 MOV EAX,ESI
10003ABC |. E8 35000000 CALL jagmisc.10003AF6
10003AC1 |. 5F POP EDI ; kernel32.7C816FD7
10003AC2 |. 5E POP ESI ; kernel32.7C816FD7
10003AC3 |. C9 LEAVE
10003AC4 \. C3 RETN
10003AC5 > 6A 08 PUSH 8
10003AC7 . 68 80860010 PUSH jagmisc.10008680
10003ACC . E8 9FE8FFFF CALL jagmisc.10002370
10003AD1 . 8365 FC 00 AND DWORD PTR SS:[EBP-4],0
10003AD5 . 6A 00 PUSH 0
10003AD7 . 6A 01 PUSH 1
10003AD9 . E8 492D0000 CALL jagmisc.10006827
10003ADE . 59 POP ECX ; kernel32.7C816FD7
10003ADF . 59 POP ECX ; kernel32.7C816FD7
10003AE0 . EB 07 JMP SHORT jagmisc.10003AE9
10003AE2 . 33C0 XOR EAX,EAX
10003AE4 . 40 INC EAX
10003AE5 . C3 RETN
10003AE6 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451
10003AE9 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10003AED . 6A 03 PUSH 3 ; /ExitCode = 3
10003AEF . FF15 6C800010 CALL DWORD PTR DS:[<&KERNEL32.ExitProcess>] ; \ExitProcess
10003AF5 CC INT3
10003AF6 $ 3B0D 60A30010 CMP ECX,DWORD PTR DS:[1000A360]
10003AFC . 75 01 JNZ SHORT jagmisc.10003AFF
10003AFE . C3 RETN
10003AFF >^ E9 C1FFFFFF JMP jagmisc.10003AC5
10003B04 CC INT3
10003B05 CC INT3
10003B06 CC INT3
10003B07 CC INT3
10003B08 CC INT3
10003B09 CC INT3
10003B0A CC INT3
10003B0B CC INT3
10003B0C CC INT3
10003B0D CC INT3
10003B0E CC INT3
10003B0F CC INT3
10003B10 /$ 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C]
10003B14 |. 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10003B18 |. 85D2 TEST EDX,EDX
10003B1A |. 74 4F JE SHORT jagmisc.10003B6B
10003B1C |. 33C0 XOR EAX,EAX
10003B1E |. 8A4424 08 MOV AL,BYTE PTR SS:[ESP+8]
10003B22 |. 57 PUSH EDI
10003B23 |. 8BF9 MOV EDI,ECX
10003B25 |. 83FA 04 CMP EDX,4
10003B28 |. 72 31 JB SHORT jagmisc.10003B5B
10003B2A |. F7D9 NEG ECX
10003B2C |. 83E1 03 AND ECX,3
10003B2F |. 74 0C JE SHORT jagmisc.10003B3D
10003B31 |. 2BD1 SUB EDX,ECX
10003B33 |> 8807 /MOV BYTE PTR DS:[EDI],AL
10003B35 |. 83C7 01 |ADD EDI,1
10003B38 |. 83E9 01 |SUB ECX,1
10003B3B |.^ 75 F6 \JNZ SHORT jagmisc.10003B33
10003B3D |> 8BC8 MOV ECX,EAX
10003B3F |. C1E0 08 SHL EAX,8
10003B42 |. 03C1 ADD EAX,ECX
10003B44 |. 8BC8 MOV ECX,EAX
10003B46 |. C1E0 10 SHL EAX,10
10003B49 |. 03C1 ADD EAX,ECX
10003B4B |. 8BCA MOV ECX,EDX
10003B4D |. 83E2 03 AND EDX,3
10003B50 |. C1E9 02 SHR ECX,2
10003B53 |. 74 06 JE SHORT jagmisc.10003B5B
10003B55 |. F3:AB REP STOS DWORD PTR ES:[EDI]
10003B57 |. 85D2 TEST EDX,EDX
10003B59 |. 74 0A JE SHORT jagmisc.10003B65
10003B5B |> 8807 /MOV BYTE PTR DS:[EDI],AL
10003B5D |. 83C7 01 |ADD EDI,1
10003B60 |. 83EA 01 |SUB EDX,1
10003B63 |.^ 75 F6 \JNZ SHORT jagmisc.10003B5B
10003B65 |> 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
10003B69 |. 5F POP EDI ; kernel32.7C816FD7
10003B6A |. C3 RETN
10003B6B |> 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10003B6F \. C3 RETN
10003B70 . 6A 02 PUSH 2
10003B72 . E8 A4DCFFFF CALL jagmisc.1000181B
10003B77 . 59 POP ECX ; kernel32.7C816FD7
10003B78 . C3 RETN
10003B79 /$ 33C0 XOR EAX,EAX
10003B7B |. F6C3 01 TEST BL,1
10003B7E |. 74 03 JE SHORT jagmisc.10003B83
10003B80 |. 6A 10 PUSH 10
10003B82 |. 58 POP EAX ; kernel32.7C816FD7
10003B83 |> F6C3 04 TEST BL,4
10003B86 |. 74 03 JE SHORT jagmisc.10003B8B
10003B88 |. 83C8 08 OR EAX,8
10003B8B |> F6C3 08 TEST BL,8
10003B8E |. 74 03 JE SHORT jagmisc.10003B93
10003B90 |. 83C8 04 OR EAX,4
10003B93 |> F6C3 10 TEST BL,10
10003B96 |. 74 03 JE SHORT jagmisc.10003B9B
10003B98 |. 83C8 02 OR EAX,2
10003B9B |> F6C3 20 TEST BL,20
10003B9E |. 74 03 JE SHORT jagmisc.10003BA3
10003BA0 |. 83C8 01 OR EAX,1
10003BA3 |> F6C3 02 TEST BL,2
10003BA6 |. 74 05 JE SHORT jagmisc.10003BAD
10003BA8 |. 0D 00000800 OR EAX,80000
10003BAD |> 55 PUSH EBP
10003BAE |. 0FB7D3 MOVZX EDX,BX
10003BB1 |. 56 PUSH ESI
10003BB2 |. 8BCA MOV ECX,EDX
10003BB4 |. BE 000C0000 MOV ESI,0C00
10003BB9 |. 23CE AND ECX,ESI
10003BBB |. 57 PUSH EDI
10003BBC |. BF 00030000 MOV EDI,300
10003BC1 |. BD 00020000 MOV EBP,200
10003BC6 |. 74 21 JE SHORT jagmisc.10003BE9
10003BC8 |. 81F9 00040000 CMP ECX,400
10003BCE |. 74 14 JE SHORT jagmisc.10003BE4
10003BD0 |. 81F9 00080000 CMP ECX,800
10003BD6 |. 74 08 JE SHORT jagmisc.10003BE0
10003BD8 |. 3BCE CMP ECX,ESI
10003BDA |. 75 0D JNZ SHORT jagmisc.10003BE9
10003BDC |. 0BC7 OR EAX,EDI
10003BDE |. EB 09 JMP SHORT jagmisc.10003BE9
10003BE0 |> 0BC5 OR EAX,EBP
10003BE2 |. EB 05 JMP SHORT jagmisc.10003BE9
10003BE4 |> 0D 00010000 OR EAX,100
10003BE9 |> 23D7 AND EDX,EDI
10003BEB |. 74 0B JE SHORT jagmisc.10003BF8
10003BED |. 3BD5 CMP EDX,EBP
10003BEF |. 75 0C JNZ SHORT jagmisc.10003BFD
10003BF1 |. 0D 00000100 OR EAX,10000
10003BF6 |. EB 05 JMP SHORT jagmisc.10003BFD
10003BF8 |> 0D 00000200 OR EAX,20000
10003BFD |> F6C7 10 TEST BH,10
10003C00 |. 5F POP EDI ; kernel32.7C816FD7
10003C01 |. 5E POP ESI ; kernel32.7C816FD7
10003C02 |. 5D POP EBP ; kernel32.7C816FD7
10003C03 |. 74 05 JE SHORT jagmisc.10003C0A
10003C05 |. 0D 00000400 OR EAX,40000
10003C0A \> C3 RETN
10003C0B /$ 33C0 XOR EAX,EAX
10003C0D |. F6C3 10 TEST BL,10
10003C10 |. 74 01 JE SHORT jagmisc.10003C13
10003C12 |. 40 INC EAX
10003C13 |> F6C3 08 TEST BL,8
10003C16 |. 74 03 JE SHORT jagmisc.10003C1B
10003C18 |. 83C8 04 OR EAX,4
10003C1B |> F6C3 04 TEST BL,4
10003C1E |. 74 03 JE SHORT jagmisc.10003C23
10003C20 |. 83C8 08 OR EAX,8
10003C23 |> F6C3 02 TEST BL,2
10003C26 |. 74 03 JE SHORT jagmisc.10003C2B
10003C28 |. 83C8 10 OR EAX,10
10003C2B |> F6C3 01 TEST BL,1
10003C2E |. 74 03 JE SHORT jagmisc.10003C33
10003C30 |. 83C8 20 OR EAX,20
10003C33 |> F7C3 00000800 TEST EBX,80000
10003C39 |. 74 03 JE SHORT jagmisc.10003C3E
10003C3B |. 83C8 02 OR EAX,2
10003C3E |> 8BCB MOV ECX,EBX
10003C40 |. BA 00030000 MOV EDX,300
10003C45 |. 23CA AND ECX,EDX
10003C47 |. 56 PUSH ESI
10003C48 |. BE 00020000 MOV ESI,200
10003C4D |. 74 23 JE SHORT jagmisc.10003C72
10003C4F |. 81F9 00010000 CMP ECX,100
10003C55 |. 74 16 JE SHORT jagmisc.10003C6D
10003C57 |. 3BCE CMP ECX,ESI
10003C59 |. 74 0B JE SHORT jagmisc.10003C66
10003C5B |. 3BCA CMP ECX,EDX
10003C5D |. 75 13 JNZ SHORT jagmisc.10003C72
10003C5F |. 0D 000C0000 OR EAX,0C00
10003C64 |. EB 0C JMP SHORT jagmisc.10003C72
10003C66 |> 0D 00080000 OR EAX,800
10003C6B |. EB 05 JMP SHORT jagmisc.10003C72
10003C6D |> 0D 00040000 OR EAX,400
10003C72 |> 8BCB MOV ECX,EBX
10003C74 |. 81E1 00000300 AND ECX,30000
10003C7A |. 74 0C JE SHORT jagmisc.10003C88
10003C7C |. 81F9 00000100 CMP ECX,10000 ; UNICODE "=::=::\\"
10003C82 |. 75 06 JNZ SHORT jagmisc.10003C8A
10003C84 |. 0BC6 OR EAX,ESI
10003C86 |. EB 02 JMP SHORT jagmisc.10003C8A
10003C88 |> 0BC2 OR EAX,EDX
10003C8A |> F7C3 00000400 TEST EBX,40000
10003C90 |. 5E POP ESI ; kernel32.7C816FD7
10003C91 |. 74 05 JE SHORT jagmisc.10003C98
10003C93 |. 0D 00100000 OR EAX,1000
10003C98 \> C3 RETN
10003C99 /$ 55 PUSH EBP
10003C9A |. 8BEC MOV EBP,ESP
10003C9C |. 51 PUSH ECX
10003C9D |. 53 PUSH EBX
10003C9E |. 9B WAIT
10003C9F |. D97D FC FSTCW WORD PTR SS:[EBP-4]
10003CA2 |. 8B5D FC MOV EBX,[LOCAL.1]
10003CA5 |. E8 CFFEFFFF CALL jagmisc.10003B79
10003CAA |. 8BD8 MOV EBX,EAX
10003CAC |. 8B45 0C MOV EAX,[ARG.2]
10003CAF |. F7D0 NOT EAX
10003CB1 |. 23D8 AND EBX,EAX
10003CB3 |. 8B45 08 MOV EAX,[ARG.1]
10003CB6 |. 2345 0C AND EAX,[ARG.2]
10003CB9 |. 0BD8 OR EBX,EAX
10003CBB |. E8 4BFFFFFF CALL jagmisc.10003C0B
10003CC0 |. 8945 0C MOV [ARG.2],EAX
10003CC3 |. D96D 0C FLDCW WORD PTR SS:[EBP+C]
10003CC6 |. 8BC3 MOV EAX,EBX
10003CC8 |. 5B POP EBX ; kernel32.7C816FD7
10003CC9 |. C9 LEAVE
10003CCA \. C3 RETN
10003CCB /$ 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
10003CCF |. 25 FFFFF7FF AND EAX,FFF7FFFF
10003CD4 |. 50 PUSH EAX
10003CD5 |. FF7424 08 PUSH DWORD PTR SS:[ESP+8]
10003CD9 |. E8 BBFFFFFF CALL jagmisc.10003C99
10003CDE |. 59 POP ECX ; kernel32.7C816FD7
10003CDF |. 59 POP ECX ; kernel32.7C816FD7
10003CE0 \. C3 RETN
10003CE1 /$ 56 PUSH ESI
10003CE2 |. 57 PUSH EDI
10003CE3 |. 33F6 XOR ESI,ESI
10003CE5 |. BF E0AD0010 MOV EDI,jagmisc.1000ADE0
10003CEA |> 833CF5 74A30010 0>/CMP DWORD PTR DS:[ESI*8+1000A374],1
10003CF2 |. 75 1E |JNZ SHORT jagmisc.10003D12
10003CF4 |. 8D04F5 70A30010 |LEA EAX,DWORD PTR DS:[ESI*8+1000A370]
10003CFB |. 8938 |MOV DWORD PTR DS:[EAX],EDI
10003CFD |. 68 A00F0000 |PUSH 0FA0
10003D02 |. FF30 |PUSH DWORD PTR DS:[EAX]
10003D04 |. 83C7 18 |ADD EDI,18
10003D07 |. E8 5E170000 |CALL jagmisc.1000546A
10003D0C |. 85C0 |TEST EAX,EAX
10003D0E |. 59 |POP ECX ; kernel32.7C816FD7
10003D0F |. 59 |POP ECX ; kernel32.7C816FD7
10003D10 |. 74 0C |JE SHORT jagmisc.10003D1E
10003D12 |> 46 |INC ESI
10003D13 |. 83FE 24 |CMP ESI,24
10003D16 |.^ 7C D2 \JL SHORT jagmisc.10003CEA
10003D18 |. 33C0 XOR EAX,EAX
10003D1A |. 40 INC EAX
10003D1B |> 5F POP EDI ; kernel32.7C816FD7
10003D1C |. 5E POP ESI ; kernel32.7C816FD7
10003D1D |. C3 RETN
10003D1E |> 8324F5 70A30010 0>AND DWORD PTR DS:[ESI*8+1000A370],0
10003D26 |. 33C0 XOR EAX,EAX
10003D28 \.^ EB F1 JMP SHORT jagmisc.10003D1B
10003D2A > 53 PUSH EBX
10003D2B . 8B1D 18800010 MOV EBX,DWORD PTR DS:[<&KERNEL32.DeleteCriticalSection>] ; ntdll.RtlDeleteCriticalSection
10003D31 . 56 PUSH ESI
10003D32 . BE 70A30010 MOV ESI,jagmisc.1000A370
10003D37 . 57 PUSH EDI
10003D38 > 8B3E MOV EDI,DWORD PTR DS:[ESI]
10003D3A . 85FF TEST EDI,EDI
10003D3C . 74 13 JE SHORT jagmisc.10003D51
10003D3E . 837E 04 01 CMP DWORD PTR DS:[ESI+4],1
10003D42 . 74 0D JE SHORT jagmisc.10003D51
10003D44 . 57 PUSH EDI
10003D45 . FFD3 CALL EBX
10003D47 . 57 PUSH EDI
10003D48 . E8 B0E5FFFF CALL jagmisc.100022FD
10003D4D . 8326 00 AND DWORD PTR DS:[ESI],0
10003D50 . 59 POP ECX ; kernel32.7C816FD7
10003D51 > 83C6 08 ADD ESI,8
10003D54 . 81FE 90A40010 CMP ESI,jagmisc.1000A490
10003D5A .^ 7C DC JL SHORT jagmisc.10003D38
10003D5C . BE 70A30010 MOV ESI,jagmisc.1000A370
10003D61 . 5F POP EDI ; kernel32.7C816FD7
10003D62 > 8B06 MOV EAX,DWORD PTR DS:[ESI]
10003D64 . 85C0 TEST EAX,EAX
10003D66 . 74 09 JE SHORT jagmisc.10003D71
10003D68 . 837E 04 01 CMP DWORD PTR DS:[ESI+4],1
10003D6C . 75 03 JNZ SHORT jagmisc.10003D71
10003D6E . 50 PUSH EAX
10003D6F . FFD3 CALL EBX
10003D71 > 83C6 08 ADD ESI,8
10003D74 . 81FE 90A40010 CMP ESI,jagmisc.1000A490
10003D7A .^ 7C E6 JL SHORT jagmisc.10003D62
10003D7C . 5E POP ESI ; kernel32.7C816FD7
10003D7D . 5B POP EBX ; kernel32.7C816FD7
10003D7E . C3 RETN
10003D7F /$ 55 PUSH EBP
10003D80 |. 8BEC MOV EBP,ESP
10003D82 |. 8B45 08 MOV EAX,[ARG.1]
10003D85 |. FF34C5 70A30010 PUSH DWORD PTR DS:[EAX*8+1000A370] ; /pCriticalSection = jagmisc.1000AE70
10003D8C |. FF15 2C800010 CALL DWORD PTR DS:[<&KERNEL32.LeaveCriticalSection>] ; \LeaveCriticalSection
10003D92 |. 5D POP EBP ; kernel32.7C816FD7
10003D93 \. C3 RETN
10003D94 /$ 6A 08 PUSH 8
10003D96 |. 68 90860010 PUSH jagmisc.10008690
10003D9B |. E8 D0E5FFFF CALL jagmisc.10002370
10003DA0 |. 8B75 08 MOV ESI,[ARG.1]
10003DA3 |. 8D34F5 70A30010 LEA ESI,DWORD PTR DS:[ESI*8+1000A370]
10003DAA |. 33DB XOR EBX,EBX
10003DAC |. 391E CMP DWORD PTR DS:[ESI],EBX
10003DAE |. 75 72 JNZ SHORT jagmisc.10003E22
10003DB0 |. 6A 18 PUSH 18
10003DB2 |. E8 E5170000 CALL jagmisc.1000559C
10003DB7 |. 59 POP ECX ; kernel32.7C816FD7
10003DB8 |. 8BF8 MOV EDI,EAX
10003DBA |. 3BFB CMP EDI,EBX
10003DBC |. 75 0D JNZ SHORT jagmisc.10003DCB
10003DBE |. E8 02E7FFFF CALL jagmisc.100024C5
10003DC3 |. C700 0C000000 MOV DWORD PTR DS:[EAX],0C
10003DC9 |. EB 3F JMP SHORT jagmisc.10003E0A
10003DCB |> 6A 0A PUSH 0A ; /Arg1 = 0000000A
10003DCD |. E8 62000000 CALL jagmisc.10003E34 ; \jagmisc.10003E34
10003DD2 |. 59 POP ECX ; kernel32.7C816FD7
10003DD3 |. 895D FC MOV [LOCAL.1],EBX
10003DD6 |. 391E CMP DWORD PTR DS:[ESI],EBX
10003DD8 |. 75 38 JNZ SHORT jagmisc.10003E12
10003DDA |. 68 A00F0000 PUSH 0FA0
10003DDF |. 57 PUSH EDI
10003DE0 |. E8 85160000 CALL jagmisc.1000546A
10003DE5 |. 59 POP ECX ; kernel32.7C816FD7
10003DE6 |. 59 POP ECX ; kernel32.7C816FD7
10003DE7 |. 85C0 TEST EAX,EAX
10003DE9 |. 75 23 JNZ SHORT jagmisc.10003E0E
10003DEB |. 57 PUSH EDI
10003DEC |. E8 0CE5FFFF CALL jagmisc.100022FD
10003DF1 |. E8 CFE6FFFF CALL jagmisc.100024C5
10003DF6 |. C700 0C000000 MOV DWORD PTR DS:[EAX],0C
10003DFC |. 6A FF PUSH -1
10003DFE |. 8D45 F0 LEA EAX,[LOCAL.4]
10003E01 |. 50 PUSH EAX
10003E02 |. E8 63130000 CALL jagmisc.1000516A
10003E07 |. 83C4 0C ADD ESP,0C
10003E0A |> 33C0 XOR EAX,EAX
10003E0C |. EB 17 JMP SHORT jagmisc.10003E25
10003E0E |> 893E MOV DWORD PTR DS:[ESI],EDI
10003E10 |. EB 07 JMP SHORT jagmisc.10003E19
10003E12 |> 57 PUSH EDI
10003E13 |. E8 E5E4FFFF CALL jagmisc.100022FD
10003E18 |. 59 POP ECX ; kernel32.7C816FD7
10003E19 |> 834D FC FF OR [LOCAL.1],FFFFFFFF
10003E1D |. E8 09000000 CALL jagmisc.10003E2B
10003E22 |> 33C0 XOR EAX,EAX
10003E24 |. 40 INC EAX
10003E25 |> E8 81E5FFFF CALL jagmisc.100023AB
10003E2A \. C3 RETN
10003E2B /$ 6A 0A PUSH 0A
10003E2D |. E8 4DFFFFFF CALL jagmisc.10003D7F
10003E32 |. 59 POP ECX ; kernel32.7C816FD7
10003E33 \. C3 RETN
10003E34 /$ 55 PUSH EBP
10003E35 |. 8BEC MOV EBP,ESP
10003E37 |. 8B45 08 MOV EAX,[ARG.1]
10003E3A |. 56 PUSH ESI
10003E3B |. 8D34C5 70A30010 LEA ESI,DWORD PTR DS:[EAX*8+1000A370]
10003E42 |. 833E 00 CMP DWORD PTR DS:[ESI],0
10003E45 |. 75 13 JNZ SHORT jagmisc.10003E5A
10003E47 |. 50 PUSH EAX
10003E48 |. E8 47FFFFFF CALL jagmisc.10003D94
10003E4D |. 85C0 TEST EAX,EAX
10003E4F |. 59 POP ECX ; kernel32.7C816FD7
10003E50 |. 75 08 JNZ SHORT jagmisc.10003E5A
10003E52 |. 6A 11 PUSH 11
10003E54 |. E8 C2D9FFFF CALL jagmisc.1000181B
10003E59 |. 59 POP ECX ; kernel32.7C816FD7
10003E5A |> FF36 PUSH DWORD PTR DS:[ESI] ; /pCriticalSection
10003E5C |. FF15 30800010 CALL DWORD PTR DS:[<&KERNEL32.EnterCriticalSection>] ; \EnterCriticalSection
10003E62 |. 5E POP ESI ; kernel32.7C816FD7
10003E63 |. 5D POP EBP ; kernel32.7C816FD7
10003E64 \. C3 RETN
10003E65 /$ 56 PUSH ESI
10003E66 |. 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8]
10003E6A |. 8B46 3C MOV EAX,DWORD PTR DS:[ESI+3C]
10003E6D |. 57 PUSH EDI
10003E6E |. 33FF XOR EDI,EDI
10003E70 |. 3B05 D0AF0010 CMP EAX,DWORD PTR DS:[1000AFD0]
10003E76 |. 74 63 JE SHORT jagmisc.10003EDB
10003E78 |. 3BC7 CMP EAX,EDI
10003E7A |. 74 5F JE SHORT jagmisc.10003EDB
10003E7C |. 8B46 2C MOV EAX,DWORD PTR DS:[ESI+2C]
10003E7F |. 3938 CMP DWORD PTR DS:[EAX],EDI
10003E81 |. 75 58 JNZ SHORT jagmisc.10003EDB
10003E83 |. 8B46 34 MOV EAX,DWORD PTR DS:[ESI+34]
10003E86 |. 3BC7 CMP EAX,EDI
10003E88 |. 74 1C JE SHORT jagmisc.10003EA6
10003E8A |. 3938 CMP DWORD PTR DS:[EAX],EDI
10003E8C |. 75 18 JNZ SHORT jagmisc.10003EA6
10003E8E |. 3B05 10B10010 CMP EAX,DWORD PTR DS:[1000B110]
10003E94 |. 74 10 JE SHORT jagmisc.10003EA6
10003E96 |. 50 PUSH EAX
10003E97 |. E8 61E4FFFF CALL jagmisc.100022FD
10003E9C |. FF76 3C PUSH DWORD PTR DS:[ESI+3C]
10003E9F |. E8 BA2C0000 CALL jagmisc.10006B5E
10003EA4 |. 59 POP ECX ; kernel32.7C816FD7
10003EA5 |. 59 POP ECX ; kernel32.7C816FD7
10003EA6 |> 8B46 30 MOV EAX,DWORD PTR DS:[ESI+30]
10003EA9 |. 3BC7 CMP EAX,EDI
10003EAB |. 74 1C JE SHORT jagmisc.10003EC9
10003EAD |. 3938 CMP DWORD PTR DS:[EAX],EDI
10003EAF |. 75 18 JNZ SHORT jagmisc.10003EC9
10003EB1 |. 3B05 14B10010 CMP EAX,DWORD PTR DS:[1000B114]
10003EB7 |. 74 10 JE SHORT jagmisc.10003EC9
10003EB9 |. 50 PUSH EAX
10003EBA |. E8 3EE4FFFF CALL jagmisc.100022FD
10003EBF |. FF76 3C PUSH DWORD PTR DS:[ESI+3C]
10003EC2 |. E8 382C0000 CALL jagmisc.10006AFF
10003EC7 |. 59 POP ECX ; kernel32.7C816FD7
10003EC8 |. 59 POP ECX ; kernel32.7C816FD7
10003EC9 |> FF76 2C PUSH DWORD PTR DS:[ESI+2C]
10003ECC |. E8 2CE4FFFF CALL jagmisc.100022FD
10003ED1 |. FF76 3C PUSH DWORD PTR DS:[ESI+3C]
10003ED4 |. E8 24E4FFFF CALL jagmisc.100022FD
10003ED9 |. 59 POP ECX ; kernel32.7C816FD7
10003EDA |. 59 POP ECX ; kernel32.7C816FD7
10003EDB |> 8B46 40 MOV EAX,DWORD PTR DS:[ESI+40]
10003EDE |. 3B05 0CB10010 CMP EAX,DWORD PTR DS:[1000B10C]
10003EE4 |. 74 1E JE SHORT jagmisc.10003F04
10003EE6 |. 3BC7 CMP EAX,EDI
10003EE8 |. 74 1A JE SHORT jagmisc.10003F04
10003EEA |. 3938 CMP DWORD PTR DS:[EAX],EDI
10003EEC |. 75 16 JNZ SHORT jagmisc.10003F04
10003EEE |. 50 PUSH EAX
10003EEF |. E8 09E4FFFF CALL jagmisc.100022FD
10003EF4 |. 8B46 44 MOV EAX,DWORD PTR DS:[ESI+44]
10003EF7 |. 2D FE000000 SUB EAX,0FE
10003EFC |. 50 PUSH EAX
10003EFD |. E8 FBE3FFFF CALL jagmisc.100022FD
10003F02 |. 59 POP ECX ; kernel32.7C816FD7
10003F03 |. 59 POP ECX ; kernel32.7C816FD7
10003F04 |> 8B46 50 MOV EAX,DWORD PTR DS:[ESI+50]
10003F07 |. 3B05 CCAF0010 CMP EAX,DWORD PTR DS:[1000AFCC]
10003F0D |. 74 1C JE SHORT jagmisc.10003F2B
10003F0F |. 3BC7 CMP EAX,EDI
10003F11 |. 74 18 JE SHORT jagmisc.10003F2B
10003F13 |. 39B8 B4000000 CMP DWORD PTR DS:[EAX+B4],EDI
10003F19 |. 75 10 JNZ SHORT jagmisc.10003F2B
10003F1B |. 50 PUSH EAX
10003F1C |. E8 4E2A0000 CALL jagmisc.1000696F
10003F21 |. FF76 50 PUSH DWORD PTR DS:[ESI+50]
10003F24 |. E8 D4E3FFFF CALL jagmisc.100022FD
10003F29 |. 59 POP ECX ; kernel32.7C816FD7
10003F2A |. 59 POP ECX ; kernel32.7C816FD7
10003F2B |> 56 PUSH ESI
10003F2C |. E8 CCE3FFFF CALL jagmisc.100022FD
10003F31 |. 59 POP ECX ; kernel32.7C816FD7
10003F32 |. 5F POP EDI ; kernel32.7C816FD7
10003F33 |. 5E POP ESI ; kernel32.7C816FD7
10003F34 \. C3 RETN
10003F35 /$ 56 PUSH ESI
10003F36 |. E8 C6DDFFFF CALL jagmisc.10001D01
10003F3B |. 8BF0 MOV ESI,EAX
10003F3D |. 8B4E 64 MOV ECX,DWORD PTR DS:[ESI+64]
10003F40 |. 3B0D ECA40010 CMP ECX,DWORD PTR DS:[1000A4EC] ; jagmisc.1000A498
10003F46 |. 0F84 A5000000 JE jagmisc.10003FF1
10003F4C |. 33D2 XOR EDX,EDX
10003F4E |. 3BCA CMP ECX,EDX
10003F50 |. 74 2F JE SHORT jagmisc.10003F81
10003F52 |. 8B41 2C MOV EAX,DWORD PTR DS:[ECX+2C]
10003F55 |. FF09 DEC DWORD PTR DS:[ECX]
10003F57 |. 3BC2 CMP EAX,EDX
10003F59 |. 74 02 JE SHORT jagmisc.10003F5D
10003F5B |. FF08 DEC DWORD PTR DS:[EAX]
10003F5D |> 8B41 34 MOV EAX,DWORD PTR DS:[ECX+34]
10003F60 |. 3BC2 CMP EAX,EDX
10003F62 |. 74 02 JE SHORT jagmisc.10003F66
10003F64 |. FF08 DEC DWORD PTR DS:[EAX]
10003F66 |> 8B41 30 MOV EAX,DWORD PTR DS:[ECX+30]
10003F69 |. 3BC2 CMP EAX,EDX
10003F6B |. 74 02 JE SHORT jagmisc.10003F6F
10003F6D |. FF08 DEC DWORD PTR DS:[EAX]
10003F6F |> 8B41 40 MOV EAX,DWORD PTR DS:[ECX+40]
10003F72 |. 3BC2 CMP EAX,EDX
10003F74 |. 74 02 JE SHORT jagmisc.10003F78
10003F76 |. FF08 DEC DWORD PTR DS:[EAX]
10003F78 |> 8B41 4C MOV EAX,DWORD PTR DS:[ECX+4C]
10003F7B |. FF88 B4000000 DEC DWORD PTR DS:[EAX+B4]
10003F81 |> A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC]
10003F86 |. 8946 64 MOV DWORD PTR DS:[ESI+64],EAX
10003F89 |. A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC]
10003F8E |. FF00 INC DWORD PTR DS:[EAX]
10003F90 |. A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC]
10003F95 |. 3950 2C CMP DWORD PTR DS:[EAX+2C],EDX
10003F98 |. 74 0A JE SHORT jagmisc.10003FA4
10003F9A |. 8B40 2C MOV EAX,DWORD PTR DS:[EAX+2C]
10003F9D |. FF00 INC DWORD PTR DS:[EAX]
10003F9F |. A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC]
10003FA4 |> 3950 34 CMP DWORD PTR DS:[EAX+34],EDX
10003FA7 |. 74 0A JE SHORT jagmisc.10003FB3
10003FA9 |. 8B40 34 MOV EAX,DWORD PTR DS:[EAX+34]
10003FAC |. FF00 INC DWORD PTR DS:[EAX]
10003FAE |. A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC]
10003FB3 |> 3950 30 CMP DWORD PTR DS:[EAX+30],EDX
10003FB6 |. 74 0A JE SHORT jagmisc.10003FC2
10003FB8 |. 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30]
10003FBB |. FF00 INC DWORD PTR DS:[EAX]
10003FBD |. A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC]
10003FC2 |> 3950 40 CMP DWORD PTR DS:[EAX+40],EDX
10003FC5 |. 74 0A JE SHORT jagmisc.10003FD1
10003FC7 |. 8B40 40 MOV EAX,DWORD PTR DS:[EAX+40]
10003FCA |. FF00 INC DWORD PTR DS:[EAX]
10003FCC |. A1 ECA40010 MOV EAX,DWORD PTR DS:[1000A4EC]
10003FD1 |> 8B40 4C MOV EAX,DWORD PTR DS:[EAX+4C]
10003FD4 |. FF80 B4000000 INC DWORD PTR DS:[EAX+B4]
10003FDA |. 3BCA CMP ECX,EDX
10003FDC |. 74 13 JE SHORT jagmisc.10003FF1
10003FDE |. 3911 CMP DWORD PTR DS:[ECX],EDX
10003FE0 |. 75 0F JNZ SHORT jagmisc.10003FF1
10003FE2 |. 81F9 98A40010 CMP ECX,jagmisc.1000A498
10003FE8 |. 74 07 JE SHORT jagmisc.10003FF1
10003FEA |. 51 PUSH ECX
10003FEB |. E8 75FEFFFF CALL jagmisc.10003E65
10003FF0 |. 59 POP ECX ; kernel32.7C816FD7
10003FF1 |> 8B46 64 MOV EAX,DWORD PTR DS:[ESI+64]
10003FF4 |. 5E POP ESI ; kernel32.7C816FD7
10003FF5 \. C3 RETN
10003FF6 /$ 6A 0C PUSH 0C
10003FF8 |. 68 20880010 PUSH jagmisc.10008820
10003FFD |. E8 6EE3FFFF CALL jagmisc.10002370
10004002 |. 6A 0C PUSH 0C ; /Arg1 = 0000000C
10004004 |. E8 2BFEFFFF CALL jagmisc.10003E34 ; \jagmisc.10003E34
10004009 |. 59 POP ECX ; kernel32.7C816FD7
1000400A |. 8365 FC 00 AND [LOCAL.1],0
1000400E |. E8 22FFFFFF CALL jagmisc.10003F35
10004013 |. 8945 E4 MOV [LOCAL.7],EAX
10004016 |. 834D FC FF OR [LOCAL.1],FFFFFFFF
1000401A |. E8 09000000 CALL jagmisc.10004028
1000401F |. 8B45 E4 MOV EAX,[LOCAL.7]
10004022 |. E8 84E3FFFF CALL jagmisc.100023AB
10004027 \. C3 RETN
10004028 /$ 6A 0C PUSH 0C
1000402A |. E8 50FDFFFF CALL jagmisc.10003D7F
1000402F |. 59 POP ECX ; kernel32.7C816FD7
10004030 \. C3 RETN
10004031 /$ 2D A4030000 SUB EAX,3A4
10004036 |. 74 22 JE SHORT jagmisc.1000405A
10004038 |. 83E8 04 SUB EAX,4 ; Switch (cases 4..12)
1000403B |. 74 17 JE SHORT jagmisc.10004054
1000403D |. 83E8 0D SUB EAX,0D
10004040 |. 74 0C JE SHORT jagmisc.1000404E
10004042 |. 48 DEC EAX
10004043 |. 74 03 JE SHORT jagmisc.10004048
10004045 |. 33C0 XOR EAX,EAX ; Default case of switch 10004038
10004047 |. C3 RETN
10004048 |> B8 04040000 MOV EAX,404 ; Case 12 of switch 10004038
1000404D |. C3 RETN
1000404E |> B8 12040000 MOV EAX,412 ; Case 11 of switch 10004038
10004053 |. C3 RETN
10004054 |> B8 04080000 MOV EAX,804 ; Case 4 of switch 10004038
10004059 |. C3 RETN
1000405A |> B8 11040000 MOV EAX,411
1000405F \. C3 RETN
10004060 /$ 57 PUSH EDI
10004061 |. 6A 40 PUSH 40
10004063 |. 33C0 XOR EAX,EAX
10004065 |. 59 POP ECX ; kernel32.7C816FD7
10004066 |. BF 40B10010 MOV EDI,jagmisc.1000B140
1000406B |. F3:AB REP STOS DWORD PTR ES:[EDI]
1000406D |. AA STOS BYTE PTR ES:[EDI]
1000406E |. 33C0 XOR EAX,EAX
10004070 |. A3 44B20010 MOV DWORD PTR DS:[1000B244],EAX
10004075 |. A3 3CB10010 MOV DWORD PTR DS:[1000B13C],EAX
1000407A |. A3 34B10010 MOV DWORD PTR DS:[1000B134],EAX
1000407F |. BF 50B20010 MOV EDI,jagmisc.1000B250
10004084 |. AB STOS DWORD PTR ES:[EDI]
10004085 |. AB STOS DWORD PTR ES:[EDI]
10004086 |. AB STOS DWORD PTR ES:[EDI]
10004087 |. 5F POP EDI ; kernel32.7C816FD7
10004088 \. C3 RETN
10004089 /$ 55 PUSH EBP
1000408A |. 8BEC MOV EBP,ESP
1000408C |. 81EC 18050000 SUB ESP,518
10004092 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
10004097 |. 8945 FC MOV [LOCAL.1],EAX
1000409A |. 56 PUSH ESI
1000409B |. 8D45 E8 LEA EAX,[LOCAL.6]
1000409E |. 50 PUSH EAX ; /pCPInfo = 00000008
1000409F |. FF35 44B20010 PUSH DWORD PTR DS:[1000B244] ; |CodePage = 4E4
100040A5 |. FF15 C4800010 CALL DWORD PTR DS:[<&KERNEL32.GetCPInfo>] ; \GetCPInfo
100040AB |. 83F8 01 CMP EAX,1
100040AE |. BE 00010000 MOV ESI,100
100040B3 |. 0F85 0D010000 JNZ jagmisc.100041C6
100040B9 |. 33C0 XOR EAX,EAX
100040BB |> 888405 E8FEFFFF /MOV BYTE PTR SS:[EBP+EAX-118],AL
100040C2 |. 40 |INC EAX
100040C3 |. 3BC6 |CMP EAX,ESI
100040C5 |.^ 72 F4 \JB SHORT jagmisc.100040BB
100040C7 |. 8A45 EE MOV AL,BYTE PTR SS:[EBP-12]
100040CA |. 84C0 TEST AL,AL
100040CC |. C685 E8FEFFFF 20 MOV BYTE PTR SS:[EBP-118],20
100040D3 |. 74 36 JE SHORT jagmisc.1000410B
100040D5 |. 53 PUSH EBX
100040D6 |. 8D55 EF LEA EDX,DWORD PTR SS:[EBP-11]
100040D9 |. 57 PUSH EDI
100040DA |> 0FB60A /MOVZX ECX,BYTE PTR DS:[EDX]
100040DD |. 0FB6C0 |MOVZX EAX,AL
100040E0 |. 3BC1 |CMP EAX,ECX
100040E2 |. 77 1D |JA SHORT jagmisc.10004101
100040E4 |. 2BC8 |SUB ECX,EAX
100040E6 |. 41 |INC ECX
100040E7 |. 8BD9 |MOV EBX,ECX
100040E9 |. C1E9 02 |SHR ECX,2
100040EC |. 8DBC05 E8FEFFFF |LEA EDI,DWORD PTR SS:[EBP+EAX-118]
100040F3 |. B8 20202020 |MOV EAX,20202020
100040F8 |. F3:AB |REP STOS DWORD PTR ES:[EDI]
100040FA |. 8BCB |MOV ECX,EBX
100040FC |. 83E1 03 |AND ECX,3
100040FF |. F3:AA |REP STOS BYTE PTR ES:[EDI]
10004101 |> 42 |INC EDX
10004102 |. 8A02 |MOV AL,BYTE PTR DS:[EDX]
10004104 |. 42 |INC EDX
10004105 |. 84C0 |TEST AL,AL
10004107 |.^ 75 D1 \JNZ SHORT jagmisc.100040DA
10004109 |. 5F POP EDI ; kernel32.7C816FD7
1000410A |. 5B POP EBX ; kernel32.7C816FD7
1000410B |> 6A 00 PUSH 0
1000410D |. FF35 34B10010 PUSH DWORD PTR DS:[1000B134]
10004113 |. 8D85 E8FAFFFF LEA EAX,[LOCAL.326]
10004119 |. FF35 44B20010 PUSH DWORD PTR DS:[1000B244]
1000411F |. 50 PUSH EAX
10004120 |. 56 PUSH ESI
10004121 |. 8D85 E8FEFFFF LEA EAX,[LOCAL.70]
10004127 |. 50 PUSH EAX
10004128 |. 6A 01 PUSH 1
1000412A |. E8 A92C0000 CALL jagmisc.10006DD8
1000412F |. 6A 00 PUSH 0
10004131 |. FF35 44B20010 PUSH DWORD PTR DS:[1000B244]
10004137 |. 8D85 E8FDFFFF LEA EAX,[LOCAL.134]
1000413D |. 56 PUSH ESI
1000413E |. 50 PUSH EAX
1000413F |. 56 PUSH ESI
10004140 |. 8D85 E8FEFFFF LEA EAX,[LOCAL.70]
10004146 |. 50 PUSH EAX
10004147 |. 56 PUSH ESI
10004148 |. FF35 34B10010 PUSH DWORD PTR DS:[1000B134]
1000414E |. E8 381A0000 CALL jagmisc.10005B8B
10004153 |. 6A 00 PUSH 0
10004155 |. FF35 44B20010 PUSH DWORD PTR DS:[1000B244]
1000415B |. 8D85 E8FCFFFF LEA EAX,[LOCAL.198]
10004161 |. 56 PUSH ESI
10004162 |. 50 PUSH EAX
10004163 |. 56 PUSH ESI
10004164 |. 8D85 E8FEFFFF LEA EAX,[LOCAL.70]
1000416A |. 50 PUSH EAX
1000416B |. 68 00020000 PUSH 200
10004170 |. FF35 34B10010 PUSH DWORD PTR DS:[1000B134]
10004176 |. E8 101A0000 CALL jagmisc.10005B8B
1000417B |. 83C4 5C ADD ESP,5C
1000417E |. 33C0 XOR EAX,EAX
10004180 |> 66:8B8C45 E8FAFFF>/MOV CX,WORD PTR SS:[EBP+EAX*2-518]
10004188 |. F6C1 01 |TEST CL,1
1000418B |. 74 16 |JE SHORT jagmisc.100041A3
1000418D |. 8088 41B10010 10 |OR BYTE PTR DS:[EAX+1000B141],10
10004194 |. 8A8C05 E8FDFFFF |MOV CL,BYTE PTR SS:[EBP+EAX-218]
1000419B |> 8888 60B20010 |MOV BYTE PTR DS:[EAX+1000B260],CL
100041A1 |. EB 1C |JMP SHORT jagmisc.100041BF
100041A3 |> F6C1 02 |TEST CL,2
100041A6 |. 74 10 |JE SHORT jagmisc.100041B8
100041A8 |. 8088 41B10010 20 |OR BYTE PTR DS:[EAX+1000B141],20
100041AF |. 8A8C05 E8FCFFFF |MOV CL,BYTE PTR SS:[EBP+EAX-318]
100041B6 |.^ EB E3 |JMP SHORT jagmisc.1000419B
100041B8 |> C680 60B20010 00 |MOV BYTE PTR DS:[EAX+1000B260],0
100041BF |> 40 |INC EAX
100041C0 |. 3BC6 |CMP EAX,ESI
100041C2 |.^ 72 BC \JB SHORT jagmisc.10004180
100041C4 |. EB 44 JMP SHORT jagmisc.1000420A
100041C6 |> 33C0 XOR EAX,EAX
100041C8 |> 83F8 41 /CMP EAX,41
100041CB |. 72 19 |JB SHORT jagmisc.100041E6
100041CD |. 83F8 5A |CMP EAX,5A
100041D0 |. 77 14 |JA SHORT jagmisc.100041E6
100041D2 |. 8088 41B10010 10 |OR BYTE PTR DS:[EAX+1000B141],10
100041D9 |. 8AC8 |MOV CL,AL
100041DB |. 80C1 20 |ADD CL,20
100041DE |> 8888 60B20010 |MOV BYTE PTR DS:[EAX+1000B260],CL
100041E4 |. EB 1F |JMP SHORT jagmisc.10004205
100041E6 |> 83F8 61 |CMP EAX,61
100041E9 |. 72 13 |JB SHORT jagmisc.100041FE
100041EB |. 83F8 7A |CMP EAX,7A
100041EE |. 77 0E |JA SHORT jagmisc.100041FE
100041F0 |. 8088 41B10010 20 |OR BYTE PTR DS:[EAX+1000B141],20
100041F7 |. 8AC8 |MOV CL,AL
100041F9 |. 80E9 20 |SUB CL,20
100041FC |.^ EB E0 |JMP SHORT jagmisc.100041DE
100041FE |> C680 60B20010 00 |MOV BYTE PTR DS:[EAX+1000B260],0
10004205 |> 40 |INC EAX
10004206 |. 3BC6 |CMP EAX,ESI
10004208 |.^ 72 BE \JB SHORT jagmisc.100041C8
1000420A |> 8B4D FC MOV ECX,[LOCAL.1]
1000420D |. 5E POP ESI ; kernel32.7C816FD7
1000420E |. E8 E3F8FFFF CALL jagmisc.10003AF6
10004213 |. C9 LEAVE
10004214 \. C3 RETN
10004215 /$ 55 PUSH EBP
10004216 |. 8BEC MOV EBP,ESP
10004218 |. 83EC 1C SUB ESP,1C
1000421B |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
10004220 |. 53 PUSH EBX
10004221 |. 56 PUSH ESI
10004222 |. 8B75 08 MOV ESI,[ARG.1]
10004225 |. 33DB XOR EBX,EBX
10004227 |. 3BF3 CMP ESI,EBX
10004229 |. 8945 FC MOV [LOCAL.1],EAX
1000422C |. 57 PUSH EDI
1000422D |. 0F84 54010000 JE jagmisc.10004387
10004233 |. 33D2 XOR EDX,EDX
10004235 |. 33C0 XOR EAX,EAX
10004237 |> 39B0 30A60010 /CMP DWORD PTR DS:[EAX+1000A630],ESI
1000423D |. 74 65 |JE SHORT jagmisc.100042A4
1000423F |. 83C0 30 |ADD EAX,30
10004242 |. 42 |INC EDX
10004243 |. 3D F0000000 |CMP EAX,0F0
10004248 |.^ 72 ED \JB SHORT jagmisc.10004237
1000424A |. 8D45 E8 LEA EAX,[LOCAL.6]
1000424D |. 50 PUSH EAX ; /pCPInfo = 00000008
1000424E |. 56 PUSH ESI ; |CodePage = CP_ACP
1000424F |. FF15 C4800010 CALL DWORD PTR DS:[<&KERNEL32.GetCPInfo>] ; \GetCPInfo
10004255 |. 83F8 01 CMP EAX,1
10004258 |. 0F85 21010000 JNZ jagmisc.1000437F
1000425E |. 6A 40 PUSH 40
10004260 |. 33C0 XOR EAX,EAX
10004262 |. 837D E8 01 CMP [LOCAL.6],1
10004266 |. 59 POP ECX ; kernel32.7C816FD7
10004267 |. BF 40B10010 MOV EDI,jagmisc.1000B140
1000426C |. F3:AB REP STOS DWORD PTR ES:[EDI]
1000426E |. AA STOS BYTE PTR ES:[EDI]
1000426F |. 8935 44B20010 MOV DWORD PTR DS:[1000B244],ESI
10004275 |. 891D 34B10010 MOV DWORD PTR DS:[1000B134],EBX
1000427B |. 0F86 EC000000 JBE jagmisc.1000436D
10004281 |. 807D EE 00 CMP BYTE PTR SS:[EBP-12],0
10004285 |. 0F84 BA000000 JE jagmisc.10004345
1000428B |. 8D4D EF LEA ECX,DWORD PTR SS:[EBP-11]
1000428E |> 8A11 MOV DL,BYTE PTR DS:[ECX]
10004290 |. 84D2 TEST DL,DL
10004292 |. 0F84 AD000000 JE jagmisc.10004345
10004298 |. 0FB641 FF MOVZX EAX,BYTE PTR DS:[ECX-1]
1000429C |. 0FB6D2 MOVZX EDX,DL
1000429F |. E9 91000000 JMP jagmisc.10004335
100042A4 |> 6A 40 PUSH 40
100042A6 |. 33C0 XOR EAX,EAX
100042A8 |. 59 POP ECX ; kernel32.7C816FD7
100042A9 |. BF 40B10010 MOV EDI,jagmisc.1000B140
100042AE |. F3:AB REP STOS DWORD PTR ES:[EDI]
100042B0 |. 8D0C52 LEA ECX,DWORD PTR DS:[EDX+EDX*2]
100042B3 |. C1E1 04 SHL ECX,4
100042B6 |. 895D E4 MOV [LOCAL.7],EBX
100042B9 |. AA STOS BYTE PTR ES:[EDI]
100042BA |. 8D99 40A60010 LEA EBX,DWORD PTR DS:[ECX+1000A640]
100042C0 |> 8A03 /MOV AL,BYTE PTR DS:[EBX]
100042C2 |. 8BF3 |MOV ESI,EBX
100042C4 |. EB 29 |JMP SHORT jagmisc.100042EF
100042C6 |> 8A56 01 |/MOV DL,BYTE PTR DS:[ESI+1]
100042C9 |. 84D2 ||TEST DL,DL
100042CB |. 74 26 ||JE SHORT jagmisc.100042F3
100042CD |. 0FB6C0 ||MOVZX EAX,AL
100042D0 |. 0FB6FA ||MOVZX EDI,DL
100042D3 |. 3BC7 ||CMP EAX,EDI
100042D5 |. 77 14 ||JA SHORT jagmisc.100042EB
100042D7 |. 8B55 E4 ||MOV EDX,[LOCAL.7]
100042DA |. 8A92 28A60010 ||MOV DL,BYTE PTR DS:[EDX+1000A628]
100042E0 |> 0890 41B10010 ||/OR BYTE PTR DS:[EAX+1000B141],DL
100042E6 |. 40 |||INC EAX
100042E7 |. 3BC7 |||CMP EAX,EDI
100042E9 |.^ 76 F5 ||\JBE SHORT jagmisc.100042E0
100042EB |> 46 ||INC ESI
100042EC |. 46 ||INC ESI
100042ED |. 8A06 ||MOV AL,BYTE PTR DS:[ESI]
100042EF |> 84C0 | TEST AL,AL
100042F1 |.^ 75 D3 |\JNZ SHORT jagmisc.100042C6
100042F3 |> FF45 E4 |INC [LOCAL.7]
100042F6 |. 83C3 08 |ADD EBX,8
100042F9 |. 837D E4 04 |CMP [LOCAL.7],4
100042FD |.^ 72 C1 \JB SHORT jagmisc.100042C0
100042FF |. 8B45 08 MOV EAX,[ARG.1]
10004302 |. A3 44B20010 MOV DWORD PTR DS:[1000B244],EAX
10004307 |. C705 3CB10010 010>MOV DWORD PTR DS:[1000B13C],1
10004311 |. E8 1BFDFFFF CALL jagmisc.10004031
10004316 |. 8D89 34A60010 LEA ECX,DWORD PTR DS:[ECX+1000A634]
1000431C |. 8BF1 MOV ESI,ECX
1000431E |. BF 50B20010 MOV EDI,jagmisc.1000B250
10004323 |. A5 MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10004324 |. A5 MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10004325 |. A3 34B10010 MOV DWORD PTR DS:[1000B134],EAX
1000432A |. A5 MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
1000432B |. EB 5F JMP SHORT jagmisc.1000438C
1000432D |> 8088 41B10010 04 /OR BYTE PTR DS:[EAX+1000B141],4
10004334 |. 40 |INC EAX
10004335 |> 3BC2 CMP EAX,EDX
10004337 |.^ 76 F4 \JBE SHORT jagmisc.1000432D
10004339 |. 41 INC ECX
1000433A |. 41 INC ECX
1000433B |. 8079 FF 00 CMP BYTE PTR DS:[ECX-1],0
1000433F |.^ 0F85 49FFFFFF JNZ jagmisc.1000428E
10004345 |> 33C9 XOR ECX,ECX
10004347 |. 41 INC ECX
10004348 |. 8BC1 MOV EAX,ECX
1000434A |> 8088 41B10010 08 /OR BYTE PTR DS:[EAX+1000B141],8
10004351 |. 40 |INC EAX
10004352 |. 3D FF000000 |CMP EAX,0FF
10004357 |.^ 72 F1 \JB SHORT jagmisc.1000434A
10004359 |. 8BC6 MOV EAX,ESI
1000435B |. E8 D1FCFFFF CALL jagmisc.10004031
10004360 |. A3 34B10010 MOV DWORD PTR DS:[1000B134],EAX
10004365 |. 890D 3CB10010 MOV DWORD PTR DS:[1000B13C],ECX
1000436B |. EB 06 JMP SHORT jagmisc.10004373
1000436D |> 891D 3CB10010 MOV DWORD PTR DS:[1000B13C],EBX
10004373 |> 33C0 XOR EAX,EAX
10004375 |. BF 50B20010 MOV EDI,jagmisc.1000B250
1000437A |. AB STOS DWORD PTR ES:[EDI]
1000437B |. AB STOS DWORD PTR ES:[EDI]
1000437C |. AB STOS DWORD PTR ES:[EDI]
1000437D |. EB 0D JMP SHORT jagmisc.1000438C
1000437F |> 391D 3CAF0010 CMP DWORD PTR DS:[1000AF3C],EBX
10004385 |. 74 0E JE SHORT jagmisc.10004395
10004387 |> E8 D4FCFFFF CALL jagmisc.10004060
1000438C |> E8 F8FCFFFF CALL jagmisc.10004089
10004391 |. 33C0 XOR EAX,EAX
10004393 |. EB 03 JMP SHORT jagmisc.10004398
10004395 |> 83C8 FF OR EAX,FFFFFFFF
10004398 |> 8B4D FC MOV ECX,[LOCAL.1]
1000439B |. 5F POP EDI ; kernel32.7C816FD7
1000439C |. 5E POP ESI ; kernel32.7C816FD7
1000439D |. 5B POP EBX ; kernel32.7C816FD7
1000439E |. E8 53F7FFFF CALL jagmisc.10003AF6
100043A3 |. C9 LEAVE
100043A4 \. C3 RETN
100043A5 /$ 6A 14 PUSH 14
100043A7 |. 68 30880010 PUSH jagmisc.10008830
100043AC |. E8 BFDFFFFF CALL jagmisc.10002370
100043B1 |. 834D E0 FF OR [LOCAL.8],FFFFFFFF
100043B5 |. 6A 0D PUSH 0D ; /Arg1 = 0000000D
100043B7 |. E8 78FAFFFF CALL jagmisc.10003E34 ; \jagmisc.10003E34
100043BC |. 59 POP ECX ; kernel32.7C816FD7
100043BD |. 33FF XOR EDI,EDI
100043BF |. 897D FC MOV [LOCAL.1],EDI
100043C2 |. 893D 3CAF0010 MOV DWORD PTR DS:[1000AF3C],EDI
100043C8 |. 8B45 08 MOV EAX,[ARG.1]
100043CB |. 83F8 FE CMP EAX,-2
100043CE |. 75 12 JNZ SHORT jagmisc.100043E2
100043D0 |. C705 3CAF0010 010>MOV DWORD PTR DS:[1000AF3C],1
100043DA |. FF15 C0800010 CALL DWORD PTR DS:[<&KERNEL32.GetOEMCP>] ; [GetOEMCP
100043E0 |. EB 2B JMP SHORT jagmisc.1000440D
100043E2 |> 83F8 FD CMP EAX,-3
100043E5 |. 75 12 JNZ SHORT jagmisc.100043F9
100043E7 |. C705 3CAF0010 010>MOV DWORD PTR DS:[1000AF3C],1
100043F1 |. FF15 BC800010 CALL DWORD PTR DS:[<&KERNEL32.GetACP>] ; [GetACP
100043F7 |. EB 14 JMP SHORT jagmisc.1000440D
100043F9 |> 83F8 FC CMP EAX,-4
100043FC |. 75 0F JNZ SHORT jagmisc.1000440D
100043FE |. C705 3CAF0010 010>MOV DWORD PTR DS:[1000AF3C],1
10004408 |. A1 10B00010 MOV EAX,DWORD PTR DS:[1000B010]
1000440D |> 8945 08 MOV [ARG.1],EAX
10004410 |. 3B05 44B20010 CMP EAX,DWORD PTR DS:[1000B244]
10004416 |. 0F84 BB000000 JE jagmisc.100044D7
1000441C |. 8B35 38B10010 MOV ESI,DWORD PTR DS:[1000B138]
10004422 |. 8975 DC MOV [LOCAL.9],ESI
10004425 |. 3BF7 CMP ESI,EDI
10004427 |. 74 04 JE SHORT jagmisc.1000442D
10004429 |. 393E CMP DWORD PTR DS:[ESI],EDI
1000442B |. 74 10 JE SHORT jagmisc.1000443D
1000442D |> 68 20020000 PUSH 220
10004432 |. E8 65110000 CALL jagmisc.1000559C
10004437 |. 59 POP ECX ; kernel32.7C816FD7
10004438 |. 8BF0 MOV ESI,EAX
1000443A |. 8975 DC MOV [LOCAL.9],ESI
1000443D |> 3BF7 CMP ESI,EDI
1000443F |. 74 7F JE SHORT jagmisc.100044C0
10004441 |. FF75 08 PUSH [ARG.1]
10004444 |. E8 CCFDFFFF CALL jagmisc.10004215
10004449 |. 59 POP ECX ; kernel32.7C816FD7
1000444A |. 8945 E0 MOV [LOCAL.8],EAX
1000444D |. 3BC7 CMP EAX,EDI
1000444F |. 75 6F JNZ SHORT jagmisc.100044C0
10004451 |. 893E MOV DWORD PTR DS:[ESI],EDI
10004453 |. A1 44B20010 MOV EAX,DWORD PTR DS:[1000B244]
10004458 |. 8946 04 MOV DWORD PTR DS:[ESI+4],EAX
1000445B |. A1 3CB10010 MOV EAX,DWORD PTR DS:[1000B13C]
10004460 |. 8946 08 MOV DWORD PTR DS:[ESI+8],EAX
10004463 |. A1 34B10010 MOV EAX,DWORD PTR DS:[1000B134]
10004468 |. 8946 0C MOV DWORD PTR DS:[ESI+C],EAX
1000446B |. 33C0 XOR EAX,EAX
1000446D |> 8945 E4 /MOV [LOCAL.7],EAX
10004470 |. 83F8 05 |CMP EAX,5
10004473 |. 7D 10 |JGE SHORT jagmisc.10004485
10004475 |. 66:8B0C45 50B2001>|MOV CX,WORD PTR DS:[EAX*2+1000B250]
1000447D |. 66:894C46 10 |MOV WORD PTR DS:[ESI+EAX*2+10],CX
10004482 |. 40 |INC EAX
10004483 |.^ EB E8 \JMP SHORT jagmisc.1000446D
10004485 |> 33C0 XOR EAX,EAX
10004487 |> 8945 E4 /MOV [LOCAL.7],EAX
1000448A |. 3D 01010000 |CMP EAX,101
1000448F |. 7D 0D |JGE SHORT jagmisc.1000449E
10004491 |. 8A88 40B10010 |MOV CL,BYTE PTR DS:[EAX+1000B140]
10004497 |. 884C30 1C |MOV BYTE PTR DS:[EAX+ESI+1C],CL
1000449B |. 40 |INC EAX
1000449C |.^ EB E9 \JMP SHORT jagmisc.10004487
1000449E |> 33C0 XOR EAX,EAX
100044A0 |> 8945 E4 /MOV [LOCAL.7],EAX
100044A3 |. 3D 00010000 |CMP EAX,100
100044A8 |. 7D 10 |JGE SHORT jagmisc.100044BA
100044AA |. 8A88 60B20010 |MOV CL,BYTE PTR DS:[EAX+1000B260]
100044B0 |. 888C30 1D010000 |MOV BYTE PTR DS:[EAX+ESI+11D],CL
100044B7 |. 40 |INC EAX
100044B8 |.^ EB E6 \JMP SHORT jagmisc.100044A0
100044BA |> 8935 38B10010 MOV DWORD PTR DS:[1000B138],ESI
100044C0 |> 837D E0 FF CMP [LOCAL.8],-1
100044C4 |. 75 14 JNZ SHORT jagmisc.100044DA
100044C6 |. 3B35 38B10010 CMP ESI,DWORD PTR DS:[1000B138]
100044CC |. 74 0C JE SHORT jagmisc.100044DA
100044CE |. 56 PUSH ESI
100044CF |. E8 29DEFFFF CALL jagmisc.100022FD
100044D4 |. 59 POP ECX ; kernel32.7C816FD7
100044D5 |. EB 03 JMP SHORT jagmisc.100044DA
100044D7 |> 897D E0 MOV [LOCAL.8],EDI
100044DA |> 834D FC FF OR [LOCAL.1],FFFFFFFF
100044DE |. E8 09000000 CALL jagmisc.100044EC
100044E3 |. 8B45 E0 MOV EAX,[LOCAL.8]
100044E6 |. E8 C0DEFFFF CALL jagmisc.100023AB
100044EB \. C3 RETN
100044EC /$ 6A 0D PUSH 0D
100044EE |. E8 8CF8FFFF CALL jagmisc.10003D7F
100044F3 |. 59 POP ECX ; kernel32.7C816FD7
100044F4 \. C3 RETN
100044F5 /$ 833D 8CB40010 00 CMP DWORD PTR DS:[1000B48C],0
100044FC |. 75 12 JNZ SHORT jagmisc.10004510
100044FE |. 6A FD PUSH -3
10004500 |. E8 A0FEFFFF CALL jagmisc.100043A5
10004505 |. 59 POP ECX ; kernel32.7C816FD7
10004506 |. C705 8CB40010 010>MOV DWORD PTR DS:[1000B48C],1
10004510 |> 33C0 XOR EAX,EAX
10004512 \. C3 RETN
10004513 /$ 56 PUSH ESI
10004514 |. FF35 88B40010 PUSH DWORD PTR DS:[1000B488]
1000451A |. E8 AE2C0000 CALL jagmisc.100071CD
1000451F |. 59 POP ECX ; kernel32.7C816FD7
10004520 |. 8B0D 84B40010 MOV ECX,DWORD PTR DS:[1000B484]
10004526 |. 8BF0 MOV ESI,EAX
10004528 |. A1 88B40010 MOV EAX,DWORD PTR DS:[1000B488]
1000452D |. 8BD1 MOV EDX,ECX
1000452F |. 2BD0 SUB EDX,EAX
10004531 |. 83C2 04 ADD EDX,4
10004534 |. 3BF2 CMP ESI,EDX
10004536 |. 73 4E JNB SHORT jagmisc.10004586
10004538 |. B9 00080000 MOV ECX,800
1000453D |. 3BF1 CMP ESI,ECX
1000453F |. 73 02 JNB SHORT jagmisc.10004543
10004541 |. 8BCE MOV ECX,ESI
10004543 |> 03CE ADD ECX,ESI
10004545 |. 51 PUSH ECX
10004546 |. 50 PUSH EAX
10004547 |. E8 D42A0000 CALL jagmisc.10007020
1000454C |. 85C0 TEST EAX,EAX
1000454E |. 59 POP ECX ; kernel32.7C816FD7
1000454F |. 59 POP ECX ; kernel32.7C816FD7
10004550 |. 75 17 JNZ SHORT jagmisc.10004569
10004552 |. 83C6 10 ADD ESI,10
10004555 |. 56 PUSH ESI
10004556 |. FF35 88B40010 PUSH DWORD PTR DS:[1000B488]
1000455C |. E8 BF2A0000 CALL jagmisc.10007020
10004561 |. 85C0 TEST EAX,EAX
10004563 |. 59 POP ECX ; kernel32.7C816FD7
10004564 |. 59 POP ECX ; kernel32.7C816FD7
10004565 |. 75 02 JNZ SHORT jagmisc.10004569
10004567 |. 5E POP ESI ; kernel32.7C816FD7
10004568 |. C3 RETN
10004569 |> 8B0D 84B40010 MOV ECX,DWORD PTR DS:[1000B484]
1000456F |. 2B0D 88B40010 SUB ECX,DWORD PTR DS:[1000B488]
10004575 |. A3 88B40010 MOV DWORD PTR DS:[1000B488],EAX
1000457A |. C1F9 02 SAR ECX,2
1000457D |. 8D0C88 LEA ECX,DWORD PTR DS:[EAX+ECX*4]
10004580 |. 890D 84B40010 MOV DWORD PTR DS:[1000B484],ECX
10004586 |> 8939 MOV DWORD PTR DS:[ECX],EDI
10004588 |. 8305 84B40010 04 ADD DWORD PTR DS:[1000B484],4
1000458F |. 8BC7 MOV EAX,EDI
10004591 |. 5E POP ESI ; kernel32.7C816FD7
10004592 \. C3 RETN
10004593 . 68 80000000 PUSH 80
10004598 . E8 FF0F0000 CALL jagmisc.1000559C
1000459D . 85C0 TEST EAX,EAX
1000459F . 59 POP ECX ; kernel32.7C816FD7
100045A0 . A3 88B40010 MOV DWORD PTR DS:[1000B488],EAX
100045A5 . 75 04 JNZ SHORT jagmisc.100045AB
100045A7 . 6A 18 PUSH 18
100045A9 . 58 POP EAX ; kernel32.7C816FD7
100045AA . C3 RETN
100045AB > 8320 00 AND DWORD PTR DS:[EAX],0
100045AE . A1 88B40010 MOV EAX,DWORD PTR DS:[1000B488]
100045B3 . A3 84B40010 MOV DWORD PTR DS:[1000B484],EAX
100045B8 . 33C0 XOR EAX,EAX
100045BA . C3 RETN
100045BB /$ 6A 0C PUSH 0C
100045BD |. 68 40880010 PUSH jagmisc.10008840
100045C2 |. E8 A9DDFFFF CALL jagmisc.10002370
100045C7 |. E8 3BDAFFFF CALL jagmisc.10002007
100045CC |. 8365 FC 00 AND [LOCAL.1],0
100045D0 |. 8B7D 08 MOV EDI,[ARG.1]
100045D3 |. E8 3BFFFFFF CALL jagmisc.10004513
100045D8 |. 8945 E4 MOV [LOCAL.7],EAX
100045DB |. 834D FC FF OR [LOCAL.1],FFFFFFFF
100045DF |. E8 09000000 CALL jagmisc.100045ED
100045E4 |. 8B45 E4 MOV EAX,[LOCAL.7]
100045E7 |. E8 BFDDFFFF CALL jagmisc.100023AB
100045EC \. C3 RETN
100045ED /$ E8 1EDAFFFF CALL jagmisc.10002010
100045F2 \. C3 RETN
100045F3 /$ FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738
100045F7 |. E8 BFFFFFFF CALL jagmisc.100045BB
100045FC |. F7D8 NEG EAX
100045FE |. 1BC0 SBB EAX,EAX
10004600 |. F7D8 NEG EAX
10004602 |. 59 POP ECX ; kernel32.7C816FD7
10004603 |. 48 DEC EAX
10004604 \. C3 RETN
10004605 /$ 68 40010000 PUSH 140 ; /HeapSize = 140 (320.)
1000460A |. 6A 00 PUSH 0 ; |Flags = 0
1000460C |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000
10004612 |. FF15 80800010 CALL DWORD PTR DS:[<&KERNEL32.HeapAlloc>] ; \HeapAlloc
10004618 |. 85C0 TEST EAX,EAX
1000461A |. A3 20B10010 MOV DWORD PTR DS:[1000B120],EAX
1000461F |. 75 01 JNZ SHORT jagmisc.10004622
10004621 |. C3 RETN
10004622 |> 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10004626 |. 8325 18B10010 00 AND DWORD PTR DS:[1000B118],0
1000462D |. 8325 1CB10010 00 AND DWORD PTR DS:[1000B11C],0
10004634 |. A3 28B10010 MOV DWORD PTR DS:[1000B128],EAX
10004639 |. 33C0 XOR EAX,EAX
1000463B |. 890D 24B10010 MOV DWORD PTR DS:[1000B124],ECX
10004641 |. C705 2CB10010 100>MOV DWORD PTR DS:[1000B12C],10
1000464B |. 40 INC EAX
1000464C \. C3 RETN
1000464D /$ A1 1CB10010 MOV EAX,DWORD PTR DS:[1000B11C]
10004652 |. 8D0C80 LEA ECX,DWORD PTR DS:[EAX+EAX*4]
10004655 |. A1 20B10010 MOV EAX,DWORD PTR DS:[1000B120]
1000465A |. 8D0C88 LEA ECX,DWORD PTR DS:[EAX+ECX*4]
1000465D |. EB 12 JMP SHORT jagmisc.10004671
1000465F |> 8B5424 04 /MOV EDX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10004663 |. 2B50 0C |SUB EDX,DWORD PTR DS:[EAX+C]
10004666 |. 81FA 00001000 |CMP EDX,100000
1000466C |. 72 09 |JB SHORT jagmisc.10004677
1000466E |. 83C0 14 |ADD EAX,14
10004671 |> 3BC1 CMP EAX,ECX
10004673 |.^ 72 EA \JB SHORT jagmisc.1000465F
10004675 |. 33C0 XOR EAX,EAX
10004677 \> C3 RETN
10004678 /$ 55 PUSH EBP
10004679 |. 8BEC MOV EBP,ESP
1000467B |. 83EC 10 SUB ESP,10
1000467E |. 8B4D 08 MOV ECX,[ARG.1]
10004681 |. 8B41 10 MOV EAX,DWORD PTR DS:[ECX+10]
10004684 |. 56 PUSH ESI
10004685 |. 8B75 0C MOV ESI,[ARG.2]
10004688 |. 57 PUSH EDI
10004689 |. 8BFE MOV EDI,ESI
1000468B |. 2B79 0C SUB EDI,DWORD PTR DS:[ECX+C]
1000468E |. 83C6 FC ADD ESI,-4
10004691 |. C1EF 0F SHR EDI,0F
10004694 |. 8BCF MOV ECX,EDI
10004696 |. 69C9 04020000 IMUL ECX,ECX,204
1000469C |. 8D8C01 44010000 LEA ECX,DWORD PTR DS:[ECX+EAX+144]
100046A3 |. 894D F0 MOV [LOCAL.4],ECX
100046A6 |. 8B0E MOV ECX,DWORD PTR DS:[ESI]
100046A8 |. 49 DEC ECX
100046A9 |. F6C1 01 TEST CL,1
100046AC |. 894D FC MOV [LOCAL.1],ECX
100046AF |. 0F85 D7020000 JNZ jagmisc.1000498C
100046B5 |. 53 PUSH EBX
100046B6 |. 8D1C31 LEA EBX,DWORD PTR DS:[ECX+ESI]
100046B9 |. 8B13 MOV EDX,DWORD PTR DS:[EBX]
100046BB |. 8955 F4 MOV [LOCAL.3],EDX
100046BE |. 8B56 FC MOV EDX,DWORD PTR DS:[ESI-4]
100046C1 |. 8955 F8 MOV [LOCAL.2],EDX
100046C4 |. 8B55 F4 MOV EDX,[LOCAL.3]
100046C7 |. F6C2 01 TEST DL,1
100046CA |. 895D 0C MOV [ARG.2],EBX
100046CD |. 75 74 JNZ SHORT jagmisc.10004743
100046CF |. C1FA 04 SAR EDX,4
100046D2 |. 4A DEC EDX
100046D3 |. 83FA 3F CMP EDX,3F
100046D6 |. 76 03 JBE SHORT jagmisc.100046DB
100046D8 |. 6A 3F PUSH 3F
100046DA |. 5A POP EDX ; kernel32.7C816FD7
100046DB |> 8B4B 04 MOV ECX,DWORD PTR DS:[EBX+4]
100046DE |. 3B4B 08 CMP ECX,DWORD PTR DS:[EBX+8]
100046E1 |. 75 42 JNZ SHORT jagmisc.10004725
100046E3 |. 83FA 20 CMP EDX,20
100046E6 |. BB 00000080 MOV EBX,80000000
100046EB |. 73 19 JNB SHORT jagmisc.10004706
100046ED |. 8BCA MOV ECX,EDX
100046EF |. D3EB SHR EBX,CL
100046F1 |. 8D4C02 04 LEA ECX,DWORD PTR DS:[EDX+EAX+4]
100046F5 |. F7D3 NOT EBX
100046F7 |. 215CB8 44 AND DWORD PTR DS:[EAX+EDI*4+44],EBX
100046FB |. FE09 DEC BYTE PTR DS:[ECX]
100046FD |. 75 23 JNZ SHORT jagmisc.10004722
100046FF |. 8B4D 08 MOV ECX,[ARG.1]
10004702 |. 2119 AND DWORD PTR DS:[ECX],EBX
10004704 |. EB 1C JMP SHORT jagmisc.10004722
10004706 |> 8D4A E0 LEA ECX,DWORD PTR DS:[EDX-20]
10004709 |. D3EB SHR EBX,CL
1000470B |. 8D4C02 04 LEA ECX,DWORD PTR DS:[EDX+EAX+4]
1000470F |. F7D3 NOT EBX
10004711 |. 219CB8 C4000000 AND DWORD PTR DS:[EAX+EDI*4+C4],EBX
10004718 |. FE09 DEC BYTE PTR DS:[ECX]
1000471A |. 75 06 JNZ SHORT jagmisc.10004722
1000471C |. 8B4D 08 MOV ECX,[ARG.1]
1000471F |. 2159 04 AND DWORD PTR DS:[ECX+4],EBX
10004722 |> 8B5D 0C MOV EBX,[ARG.2]
10004725 |> 8B53 08 MOV EDX,DWORD PTR DS:[EBX+8]
10004728 |. 8B5B 04 MOV EBX,DWORD PTR DS:[EBX+4]
1000472B |. 8B4D FC MOV ECX,[LOCAL.1]
1000472E |. 034D F4 ADD ECX,[LOCAL.3]
10004731 |. 895A 04 MOV DWORD PTR DS:[EDX+4],EBX
10004734 |. 8B55 0C MOV EDX,[ARG.2]
10004737 |. 8B5A 04 MOV EBX,DWORD PTR DS:[EDX+4]
1000473A |. 8B52 08 MOV EDX,DWORD PTR DS:[EDX+8]
1000473D |. 8953 08 MOV DWORD PTR DS:[EBX+8],EDX
10004740 |. 894D FC MOV [LOCAL.1],ECX
10004743 |> 8BD1 MOV EDX,ECX
10004745 |. C1FA 04 SAR EDX,4
10004748 |. 4A DEC EDX
10004749 |. 83FA 3F CMP EDX,3F
1000474C |. 76 03 JBE SHORT jagmisc.10004751
1000474E |. 6A 3F PUSH 3F
10004750 |. 5A POP EDX ; kernel32.7C816FD7
10004751 |> 8B5D F8 MOV EBX,[LOCAL.2] ; LOADDLL.00410249
10004754 |. 83E3 01 AND EBX,1
10004757 |. 895D F4 MOV [LOCAL.3],EBX
1000475A |. 0F85 8F000000 JNZ jagmisc.100047EF
10004760 |. 2B75 F8 SUB ESI,[LOCAL.2] ; LOADDLL.00410249
10004763 |. 8B5D F8 MOV EBX,[LOCAL.2] ; LOADDLL.00410249
10004766 |. C1FB 04 SAR EBX,4
10004769 |. 6A 3F PUSH 3F
1000476B |. 8975 0C MOV [ARG.2],ESI
1000476E |. 4B DEC EBX
1000476F |. 5E POP ESI ; kernel32.7C816FD7
10004770 |. 3BDE CMP EBX,ESI
10004772 |. 76 02 JBE SHORT jagmisc.10004776
10004774 |. 8BDE MOV EBX,ESI
10004776 |> 034D F8 ADD ECX,[LOCAL.2] ; LOADDLL.00410249
10004779 |. 8BD1 MOV EDX,ECX
1000477B |. C1FA 04 SAR EDX,4
1000477E |. 4A DEC EDX
1000477F |. 3BD6 CMP EDX,ESI
10004781 |. 894D FC MOV [LOCAL.1],ECX
10004784 |. 76 02 JBE SHORT jagmisc.10004788
10004786 |. 8BD6 MOV EDX,ESI
10004788 |> 3BDA CMP EBX,EDX
1000478A |. 74 5E JE SHORT jagmisc.100047EA
1000478C |. 8B4D 0C MOV ECX,[ARG.2]
1000478F |. 8B71 04 MOV ESI,DWORD PTR DS:[ECX+4]
10004792 |. 3B71 08 CMP ESI,DWORD PTR DS:[ECX+8]
10004795 |. 75 3B JNZ SHORT jagmisc.100047D2
10004797 |. 83FB 20 CMP EBX,20
1000479A |. BE 00000080 MOV ESI,80000000
1000479F |. 73 17 JNB SHORT jagmisc.100047B8
100047A1 |. 8BCB MOV ECX,EBX
100047A3 |. D3EE SHR ESI,CL
100047A5 |. F7D6 NOT ESI
100047A7 |. 2174B8 44 AND DWORD PTR DS:[EAX+EDI*4+44],ESI
100047AB |. FE4C03 04 DEC BYTE PTR DS:[EBX+EAX+4]
100047AF |. 75 21 JNZ SHORT jagmisc.100047D2
100047B1 |. 8B4D 08 MOV ECX,[ARG.1]
100047B4 |. 2131 AND DWORD PTR DS:[ECX],ESI
100047B6 |. EB 1A JMP SHORT jagmisc.100047D2
100047B8 |> 8D4B E0 LEA ECX,DWORD PTR DS:[EBX-20]
100047BB |. D3EE SHR ESI,CL
100047BD |. F7D6 NOT ESI
100047BF |. 21B4B8 C4000000 AND DWORD PTR DS:[EAX+EDI*4+C4],ESI
100047C6 |. FE4C03 04 DEC BYTE PTR DS:[EBX+EAX+4]
100047CA |. 75 06 JNZ SHORT jagmisc.100047D2
100047CC |. 8B4D 08 MOV ECX,[ARG.1]
100047CF |. 2171 04 AND DWORD PTR DS:[ECX+4],ESI
100047D2 |> 8B4D 0C MOV ECX,[ARG.2]
100047D5 |. 8B71 08 MOV ESI,DWORD PTR DS:[ECX+8]
100047D8 |. 8B49 04 MOV ECX,DWORD PTR DS:[ECX+4]
100047DB |. 894E 04 MOV DWORD PTR DS:[ESI+4],ECX
100047DE |. 8B4D 0C MOV ECX,[ARG.2]
100047E1 |. 8B71 04 MOV ESI,DWORD PTR DS:[ECX+4]
100047E4 |. 8B49 08 MOV ECX,DWORD PTR DS:[ECX+8]
100047E7 |. 894E 08 MOV DWORD PTR DS:[ESI+8],ECX
100047EA |> 8B75 0C MOV ESI,[ARG.2]
100047ED |. EB 03 JMP SHORT jagmisc.100047F2
100047EF |> 8B5D 08 MOV EBX,[ARG.1]
100047F2 |> 837D F4 00 CMP [LOCAL.3],0
100047F6 |. 75 08 JNZ SHORT jagmisc.10004800
100047F8 |. 3BDA CMP EBX,EDX
100047FA |. 0F84 80000000 JE jagmisc.10004880
10004800 |> 8B4D F0 MOV ECX,[LOCAL.4]
10004803 |. 8D0CD1 LEA ECX,DWORD PTR DS:[ECX+EDX*8]
10004806 |. 8B59 04 MOV EBX,DWORD PTR DS:[ECX+4]
10004809 |. 894E 08 MOV DWORD PTR DS:[ESI+8],ECX
1000480C |. 895E 04 MOV DWORD PTR DS:[ESI+4],EBX
1000480F |. 8971 04 MOV DWORD PTR DS:[ECX+4],ESI
10004812 |. 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4]
10004815 |. 8971 08 MOV DWORD PTR DS:[ECX+8],ESI
10004818 |. 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4]
1000481B |. 3B4E 08 CMP ECX,DWORD PTR DS:[ESI+8]
1000481E |. 75 60 JNZ SHORT jagmisc.10004880
10004820 |. 8A4C02 04 MOV CL,BYTE PTR DS:[EDX+EAX+4]
10004824 |. 884D 0F MOV BYTE PTR SS:[EBP+F],CL
10004827 |. FEC1 INC CL
10004829 |. 83FA 20 CMP EDX,20
1000482C |. 884C02 04 MOV BYTE PTR DS:[EDX+EAX+4],CL
10004830 |. 73 25 JNB SHORT jagmisc.10004857
10004832 |. 807D 0F 00 CMP BYTE PTR SS:[EBP+F],0
10004836 |. 75 0E JNZ SHORT jagmisc.10004846
10004838 |. 8BCA MOV ECX,EDX
1000483A |. BB 00000080 MOV EBX,80000000
1000483F |. D3EB SHR EBX,CL
10004841 |. 8B4D 08 MOV ECX,[ARG.1]
10004844 |. 0919 OR DWORD PTR DS:[ECX],EBX
10004846 |> BB 00000080 MOV EBX,80000000
1000484B |. 8BCA MOV ECX,EDX
1000484D |. D3EB SHR EBX,CL
1000484F |. 8D44B8 44 LEA EAX,DWORD PTR DS:[EAX+EDI*4+44]
10004853 |. 0918 OR DWORD PTR DS:[EAX],EBX
10004855 |. EB 29 JMP SHORT jagmisc.10004880
10004857 |> 807D 0F 00 CMP BYTE PTR SS:[EBP+F],0
1000485B |. 75 10 JNZ SHORT jagmisc.1000486D
1000485D |. 8D4A E0 LEA ECX,DWORD PTR DS:[EDX-20]
10004860 |. BB 00000080 MOV EBX,80000000
10004865 |. D3EB SHR EBX,CL
10004867 |. 8B4D 08 MOV ECX,[ARG.1]
1000486A |. 0959 04 OR DWORD PTR DS:[ECX+4],EBX
1000486D |> 8D4A E0 LEA ECX,DWORD PTR DS:[EDX-20]
10004870 |. BA 00000080 MOV EDX,80000000
10004875 |. D3EA SHR EDX,CL
10004877 |. 8D84B8 C4000000 LEA EAX,DWORD PTR DS:[EAX+EDI*4+C4]
1000487E |. 0910 OR DWORD PTR DS:[EAX],EDX
10004880 |> 8B45 FC MOV EAX,[LOCAL.1]
10004883 |. 8906 MOV DWORD PTR DS:[ESI],EAX
10004885 |. 894430 FC MOV DWORD PTR DS:[EAX+ESI-4],EAX
10004889 |. 8B45 F0 MOV EAX,[LOCAL.4]
1000488C |. FF08 DEC DWORD PTR DS:[EAX]
1000488E |. 0F85 F7000000 JNZ jagmisc.1000498B
10004894 |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118]
10004899 |. 85C0 TEST EAX,EAX
1000489B |. 0F84 DC000000 JE jagmisc.1000497D
100048A1 |. 8B0D 30B10010 MOV ECX,DWORD PTR DS:[1000B130]
100048A7 |. 8B35 B4800010 MOV ESI,DWORD PTR DS:[<&KERNEL32.VirtualFree>] ; kernel32.VirtualFree
100048AD |. 68 00400000 PUSH 4000 ; /FreeType = MEM_DECOMMIT
100048B2 |. C1E1 0F SHL ECX,0F ; |
100048B5 |. 0348 0C ADD ECX,DWORD PTR DS:[EAX+C] ; |
100048B8 |. BB 00800000 MOV EBX,8000 ; |
100048BD |. 53 PUSH EBX ; |Size = 0
100048BE |. 51 PUSH ECX ; |Address = FFFFFFFF
100048BF |. FFD6 CALL ESI ; \VirtualFree
100048C1 |. 8B0D 30B10010 MOV ECX,DWORD PTR DS:[1000B130]
100048C7 |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118]
100048CC |. BA 00000080 MOV EDX,80000000
100048D1 |. D3EA SHR EDX,CL
100048D3 |. 0950 08 OR DWORD PTR DS:[EAX+8],EDX
100048D6 |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118]
100048DB |. 8B40 10 MOV EAX,DWORD PTR DS:[EAX+10]
100048DE |. 8B0D 30B10010 MOV ECX,DWORD PTR DS:[1000B130]
100048E4 |. 83A488 C4000000 0>AND DWORD PTR DS:[EAX+ECX*4+C4],0
100048EC |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118]
100048F1 |. 8B40 10 MOV EAX,DWORD PTR DS:[EAX+10]
100048F4 |. FE48 43 DEC BYTE PTR DS:[EAX+43]
100048F7 |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118]
100048FC |. 8B48 10 MOV ECX,DWORD PTR DS:[EAX+10]
100048FF |. 8079 43 00 CMP BYTE PTR DS:[ECX+43],0
10004903 |. 75 09 JNZ SHORT jagmisc.1000490E
10004905 |. 8360 04 FE AND DWORD PTR DS:[EAX+4],FFFFFFFE
10004909 |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118]
1000490E |> 8378 08 FF CMP DWORD PTR DS:[EAX+8],-1
10004912 |. 75 69 JNZ SHORT jagmisc.1000497D
10004914 |. 53 PUSH EBX
10004915 |. 6A 00 PUSH 0
10004917 |. FF70 0C PUSH DWORD PTR DS:[EAX+C]
1000491A |. FFD6 CALL ESI
1000491C |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118]
10004921 |. FF70 10 PUSH DWORD PTR DS:[EAX+10] ; /pMemory
10004924 |. 6A 00 PUSH 0 ; |Flags = 0
10004926 |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000
1000492C |. FF15 7C800010 CALL DWORD PTR DS:[<&KERNEL32.HeapFree>] ; \HeapFree
10004932 |. A1 1CB10010 MOV EAX,DWORD PTR DS:[1000B11C]
10004937 |. 8B15 20B10010 MOV EDX,DWORD PTR DS:[1000B120]
1000493D |. 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4]
10004940 |. C1E0 02 SHL EAX,2
10004943 |. 8BC8 MOV ECX,EAX
10004945 |. A1 18B10010 MOV EAX,DWORD PTR DS:[1000B118]
1000494A |. 2BC8 SUB ECX,EAX
1000494C |. 8D4C11 EC LEA ECX,DWORD PTR DS:[ECX+EDX-14]
10004950 |. 51 PUSH ECX
10004951 |. 8D48 14 LEA ECX,DWORD PTR DS:[EAX+14]
10004954 |. 51 PUSH ECX
10004955 |. 50 PUSH EAX
10004956 |. E8 05EBFFFF CALL jagmisc.10003460
1000495B |. 8B45 08 MOV EAX,[ARG.1]
1000495E |. 83C4 0C ADD ESP,0C
10004961 |. FF0D 1CB10010 DEC DWORD PTR DS:[1000B11C]
10004967 |. 3B05 18B10010 CMP EAX,DWORD PTR DS:[1000B118]
1000496D |. 76 04 JBE SHORT jagmisc.10004973
1000496F |. 836D 08 14 SUB [ARG.1],14
10004973 |> A1 20B10010 MOV EAX,DWORD PTR DS:[1000B120]
10004978 |. A3 28B10010 MOV DWORD PTR DS:[1000B128],EAX
1000497D |> 8B45 08 MOV EAX,[ARG.1]
10004980 |. A3 18B10010 MOV DWORD PTR DS:[1000B118],EAX
10004985 |. 893D 30B10010 MOV DWORD PTR DS:[1000B130],EDI
1000498B |> 5B POP EBX ; kernel32.7C816FD7
1000498C |> 5F POP EDI ; kernel32.7C816FD7
1000498D |. 5E POP ESI ; kernel32.7C816FD7
1000498E |. C9 LEAVE
1000498F \. C3 RETN
10004990 /$ A1 1CB10010 MOV EAX,DWORD PTR DS:[1000B11C]
10004995 |. 8B0D 2CB10010 MOV ECX,DWORD PTR DS:[1000B12C]
1000499B |. 57 PUSH EDI
1000499C |. 33FF XOR EDI,EDI
1000499E |. 3BC1 CMP EAX,ECX
100049A0 |. 75 34 JNZ SHORT jagmisc.100049D6
100049A2 |. 8D4489 50 LEA EAX,DWORD PTR DS:[ECX+ECX*4+50]
100049A6 |. C1E0 02 SHL EAX,2
100049A9 |. 50 PUSH EAX ; /NewSize = 8
100049AA |. FF35 20B10010 PUSH DWORD PTR DS:[1000B120] ; |pMemory = NULL
100049B0 |. 57 PUSH EDI ; |Flags = 0
100049B1 |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000
100049B7 |. FF15 CC800010 CALL DWORD PTR DS:[<&KERNEL32.HeapReAlloc>] ; \HeapReAlloc
100049BD |. 3BC7 CMP EAX,EDI
100049BF |. 75 04 JNZ SHORT jagmisc.100049C5
100049C1 |. 33C0 XOR EAX,EAX
100049C3 |. 5F POP EDI ; kernel32.7C816FD7
100049C4 |. C3 RETN
100049C5 |> 8305 2CB10010 10 ADD DWORD PTR DS:[1000B12C],10
100049CC |. A3 20B10010 MOV DWORD PTR DS:[1000B120],EAX
100049D1 |. A1 1CB10010 MOV EAX,DWORD PTR DS:[1000B11C]
100049D6 |> 8B0D 20B10010 MOV ECX,DWORD PTR DS:[1000B120]
100049DC |. 56 PUSH ESI
100049DD |. 68 C4410000 PUSH 41C4 ; /HeapSize = 41C4 (16836.)
100049E2 |. 6A 08 PUSH 8 ; |Flags = HEAP_ZERO_MEMORY
100049E4 |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000
100049EA |. 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] ; |
100049ED |. 8D3481 LEA ESI,DWORD PTR DS:[ECX+EAX*4] ; |
100049F0 |. FF15 80800010 CALL DWORD PTR DS:[<&KERNEL32.HeapAlloc>] ; \HeapAlloc
100049F6 |. 3BC7 CMP EAX,EDI
100049F8 |. 8946 10 MOV DWORD PTR DS:[ESI+10],EAX
100049FB |. 75 04 JNZ SHORT jagmisc.10004A01
100049FD |> 33C0 XOR EAX,EAX
100049FF |. EB 43 JMP SHORT jagmisc.10004A44
10004A01 |> 6A 04 PUSH 4 ; /Protect = PAGE_READWRITE
10004A03 |. 68 00200000 PUSH 2000 ; |AllocationType = MEM_RESERVE
10004A08 |. 68 00001000 PUSH 100000 ; |Size = 100000 (1048576.)
10004A0D |. 57 PUSH EDI ; |Address = NULL
10004A0E |. FF15 C8800010 CALL DWORD PTR DS:[<&KERNEL32.VirtualAlloc>] ; \VirtualAlloc
10004A14 |. 3BC7 CMP EAX,EDI
10004A16 |. 8946 0C MOV DWORD PTR DS:[ESI+C],EAX
10004A19 |. 75 12 JNZ SHORT jagmisc.10004A2D
10004A1B |. FF76 10 PUSH DWORD PTR DS:[ESI+10] ; /pMemory
10004A1E |. 57 PUSH EDI ; |Flags = 0
10004A1F |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000
10004A25 |. FF15 7C800010 CALL DWORD PTR DS:[<&KERNEL32.HeapFree>] ; \HeapFree
10004A2B |.^ EB D0 JMP SHORT jagmisc.100049FD
10004A2D |> 834E 08 FF OR DWORD PTR DS:[ESI+8],FFFFFFFF
10004A31 |. 893E MOV DWORD PTR DS:[ESI],EDI
10004A33 |. 897E 04 MOV DWORD PTR DS:[ESI+4],EDI
10004A36 |. FF05 1CB10010 INC DWORD PTR DS:[1000B11C]
10004A3C |. 8B46 10 MOV EAX,DWORD PTR DS:[ESI+10]
10004A3F |. 8308 FF OR DWORD PTR DS:[EAX],FFFFFFFF
10004A42 |. 8BC6 MOV EAX,ESI
10004A44 |> 5E POP ESI ; kernel32.7C816FD7
10004A45 |. 5F POP EDI ; kernel32.7C816FD7
10004A46 \. C3 RETN
10004A47 /$ 55 PUSH EBP
10004A48 |. 8BEC MOV EBP,ESP
10004A4A |. 51 PUSH ECX
10004A4B |. 51 PUSH ECX
10004A4C |. 8B4D 08 MOV ECX,[ARG.1]
10004A4F |. 8B41 08 MOV EAX,DWORD PTR DS:[ECX+8]
10004A52 |. 53 PUSH EBX
10004A53 |. 56 PUSH ESI
10004A54 |. 8B71 10 MOV ESI,DWORD PTR DS:[ECX+10]
10004A57 |. 57 PUSH EDI
10004A58 |. 33DB XOR EBX,EBX
10004A5A |. EB 03 JMP SHORT jagmisc.10004A5F
10004A5C |> D1E0 /SHL EAX,1
10004A5E |. 43 |INC EBX
10004A5F |> 85C0 TEST EAX,EAX
10004A61 |.^ 7D F9 \JGE SHORT jagmisc.10004A5C
10004A63 |. 8BC3 MOV EAX,EBX
10004A65 |. 69C0 04020000 IMUL EAX,EAX,204
10004A6B |. 8D8430 44010000 LEA EAX,DWORD PTR DS:[EAX+ESI+144]
10004A72 |. 6A 3F PUSH 3F
10004A74 |. 8945 F8 MOV [LOCAL.2],EAX
10004A77 |. 5A POP EDX ; kernel32.7C816FD7
10004A78 |> 8940 08 /MOV DWORD PTR DS:[EAX+8],EAX
10004A7B |. 8940 04 |MOV DWORD PTR DS:[EAX+4],EAX
10004A7E |. 83C0 08 |ADD EAX,8
10004A81 |. 4A |DEC EDX
10004A82 |.^ 75 F4 \JNZ SHORT jagmisc.10004A78
10004A84 |. 6A 04 PUSH 4 ; /Protect = PAGE_READWRITE
10004A86 |. 8BFB MOV EDI,EBX ; |
10004A88 |. 68 00100000 PUSH 1000 ; |AllocationType = MEM_COMMIT
10004A8D |. C1E7 0F SHL EDI,0F ; |
10004A90 |. 0379 0C ADD EDI,DWORD PTR DS:[ECX+C] ; |
10004A93 |. 68 00800000 PUSH 8000 ; |Size = 8000 (32768.)
10004A98 |. 57 PUSH EDI ; |Address = NULL
10004A99 |. FF15 C8800010 CALL DWORD PTR DS:[<&KERNEL32.VirtualAlloc>] ; \VirtualAlloc
10004A9F |. 85C0 TEST EAX,EAX
10004AA1 |. 75 08 JNZ SHORT jagmisc.10004AAB
10004AA3 |. 83C8 FF OR EAX,FFFFFFFF
10004AA6 |. E9 9D000000 JMP jagmisc.10004B48
10004AAB |> 8D97 00700000 LEA EDX,DWORD PTR DS:[EDI+7000]
10004AB1 |. 3BFA CMP EDI,EDX
10004AB3 |. 8955 FC MOV [LOCAL.1],EDX
10004AB6 |. 77 43 JA SHORT jagmisc.10004AFB
10004AB8 |. 8BCA MOV ECX,EDX
10004ABA |. 2BCF SUB ECX,EDI
10004ABC |. C1E9 0C SHR ECX,0C
10004ABF |. 8D47 10 LEA EAX,DWORD PTR DS:[EDI+10]
10004AC2 |. 41 INC ECX
10004AC3 |> 8348 F8 FF /OR DWORD PTR DS:[EAX-8],FFFFFFFF
10004AC7 |. 8388 EC0F0000 FF |OR DWORD PTR DS:[EAX+FEC],FFFFFFFF
10004ACE |. 8D90 FC0F0000 |LEA EDX,DWORD PTR DS:[EAX+FFC]
10004AD4 |. 8910 |MOV DWORD PTR DS:[EAX],EDX
10004AD6 |. 8D90 FCEFFFFF |LEA EDX,DWORD PTR DS:[EAX-1004]
10004ADC |. C740 FC F00F0000 |MOV DWORD PTR DS:[EAX-4],0FF0
10004AE3 |. 8950 04 |MOV DWORD PTR DS:[EAX+4],EDX
10004AE6 |. C780 E80F0000 F00>|MOV DWORD PTR DS:[EAX+FE8],0FF0
10004AF0 |. 05 00100000 |ADD EAX,1000
10004AF5 |. 49 |DEC ECX
10004AF6 |.^ 75 CB \JNZ SHORT jagmisc.10004AC3
10004AF8 |. 8B55 FC MOV EDX,[LOCAL.1]
10004AFB |> 8B45 F8 MOV EAX,[LOCAL.2] ; LOADDLL.00410249
10004AFE |. 05 F8010000 ADD EAX,1F8
10004B03 |. 8D4F 0C LEA ECX,DWORD PTR DS:[EDI+C]
10004B06 |. 8948 04 MOV DWORD PTR DS:[EAX+4],ECX
10004B09 |. 8941 08 MOV DWORD PTR DS:[ECX+8],EAX
10004B0C |. 8D4A 0C LEA ECX,DWORD PTR DS:[EDX+C]
10004B0F |. 8948 08 MOV DWORD PTR DS:[EAX+8],ECX
10004B12 |. 8941 04 MOV DWORD PTR DS:[ECX+4],EAX
10004B15 |. 83649E 44 00 AND DWORD PTR DS:[ESI+EBX*4+44],0
10004B1A |. 33FF XOR EDI,EDI
10004B1C |. 47 INC EDI
10004B1D |. 89BC9E C4000000 MOV DWORD PTR DS:[ESI+EBX*4+C4],EDI
10004B24 |. 8A46 43 MOV AL,BYTE PTR DS:[ESI+43]
10004B27 |. 8AC8 MOV CL,AL
10004B29 |. FEC1 INC CL
10004B2B |. 84C0 TEST AL,AL
10004B2D |. 8B45 08 MOV EAX,[ARG.1]
10004B30 |. 884E 43 MOV BYTE PTR DS:[ESI+43],CL
10004B33 |. 75 03 JNZ SHORT jagmisc.10004B38
10004B35 |. 0978 04 OR DWORD PTR DS:[EAX+4],EDI
10004B38 |> BA 00000080 MOV EDX,80000000
10004B3D |. 8BCB MOV ECX,EBX
10004B3F |. D3EA SHR EDX,CL
10004B41 |. F7D2 NOT EDX
10004B43 |. 2150 08 AND DWORD PTR DS:[EAX+8],EDX
10004B46 |. 8BC3 MOV EAX,EBX
10004B48 |> 5F POP EDI ; kernel32.7C816FD7
10004B49 |. 5E POP ESI ; kernel32.7C816FD7
10004B4A |. 5B POP EBX ; kernel32.7C816FD7
10004B4B |. C9 LEAVE
10004B4C \. C3 RETN
10004B4D /$ 55 PUSH EBP
10004B4E |. 8BEC MOV EBP,ESP
10004B50 |. 83EC 0C SUB ESP,0C
10004B53 |. 8B4D 08 MOV ECX,[ARG.1]
10004B56 |. 8B41 10 MOV EAX,DWORD PTR DS:[ECX+10]
10004B59 |. 53 PUSH EBX
10004B5A |. 56 PUSH ESI
10004B5B |. 8B75 10 MOV ESI,[ARG.3]
10004B5E |. 57 PUSH EDI
10004B5F |. 8B7D 0C MOV EDI,[ARG.2]
10004B62 |. 8BD7 MOV EDX,EDI
10004B64 |. 2B51 0C SUB EDX,DWORD PTR DS:[ECX+C]
10004B67 |. 83C6 17 ADD ESI,17
10004B6A |. C1EA 0F SHR EDX,0F
10004B6D |. 8BCA MOV ECX,EDX
10004B6F |. 69C9 04020000 IMUL ECX,ECX,204
10004B75 |. 8D8C01 44010000 LEA ECX,DWORD PTR DS:[ECX+EAX+144]
10004B7C |. 894D F4 MOV [LOCAL.3],ECX
10004B7F |. 8B4F FC MOV ECX,DWORD PTR DS:[EDI-4]
10004B82 |. 83E6 F0 AND ESI,FFFFFFF0
10004B85 |. 49 DEC ECX
10004B86 |. 3BF1 CMP ESI,ECX
10004B88 |. 8D7C39 FC LEA EDI,DWORD PTR DS:[ECX+EDI-4]
10004B8C |. 8B1F MOV EBX,DWORD PTR DS:[EDI]
10004B8E |. 894D 10 MOV [ARG.3],ECX
10004B91 |. 895D FC MOV [LOCAL.1],EBX
10004B94 |. 0F8E 55010000 JLE jagmisc.10004CEF
10004B9A |. F6C3 01 TEST BL,1
10004B9D |. 0F85 45010000 JNZ jagmisc.10004CE8
10004BA3 |. 03D9 ADD EBX,ECX
10004BA5 |. 3BF3 CMP ESI,EBX
10004BA7 |. 0F8F 3B010000 JG jagmisc.10004CE8
10004BAD |. 8B4D FC MOV ECX,[LOCAL.1]
10004BB0 |. C1F9 04 SAR ECX,4
10004BB3 |. 49 DEC ECX
10004BB4 |. 83F9 3F CMP ECX,3F
10004BB7 |. 894D F8 MOV [LOCAL.2],ECX
10004BBA |. 76 06 JBE SHORT jagmisc.10004BC2
10004BBC |. 6A 3F PUSH 3F
10004BBE |. 59 POP ECX ; kernel32.7C816FD7
10004BBF |. 894D F8 MOV [LOCAL.2],ECX
10004BC2 |> 8B5F 04 MOV EBX,DWORD PTR DS:[EDI+4]
10004BC5 |. 3B5F 08 CMP EBX,DWORD PTR DS:[EDI+8]
10004BC8 |. 75 43 JNZ SHORT jagmisc.10004C0D
10004BCA |. 83F9 20 CMP ECX,20
10004BCD |. BB 00000080 MOV EBX,80000000
10004BD2 |. 73 1A JNB SHORT jagmisc.10004BEE
10004BD4 |. D3EB SHR EBX,CL
10004BD6 |. 8B4D F8 MOV ECX,[LOCAL.2] ; LOADDLL.00410249
10004BD9 |. 8D4C01 04 LEA ECX,DWORD PTR DS:[ECX+EAX+4]
10004BDD |. F7D3 NOT EBX
10004BDF |. 215C90 44 AND DWORD PTR DS:[EAX+EDX*4+44],EBX
10004BE3 |. FE09 DEC BYTE PTR DS:[ECX]
10004BE5 |. 75 26 JNZ SHORT jagmisc.10004C0D
10004BE7 |. 8B4D 08 MOV ECX,[ARG.1]
10004BEA |. 2119 AND DWORD PTR DS:[ECX],EBX
10004BEC |. EB 1F JMP SHORT jagmisc.10004C0D
10004BEE |> 83C1 E0 ADD ECX,-20
10004BF1 |. D3EB SHR EBX,CL
10004BF3 |. 8B4D F8 MOV ECX,[LOCAL.2] ; LOADDLL.00410249
10004BF6 |. 8D4C01 04 LEA ECX,DWORD PTR DS:[ECX+EAX+4]
10004BFA |. F7D3 NOT EBX
10004BFC |. 219C90 C4000000 AND DWORD PTR DS:[EAX+EDX*4+C4],EBX
10004C03 |. FE09 DEC BYTE PTR DS:[ECX]
10004C05 |. 75 06 JNZ SHORT jagmisc.10004C0D
10004C07 |. 8B4D 08 MOV ECX,[ARG.1]
10004C0A |. 2159 04 AND DWORD PTR DS:[ECX+4],EBX
10004C0D |> 8B4F 08 MOV ECX,DWORD PTR DS:[EDI+8]
10004C10 |. 8B5F 04 MOV EBX,DWORD PTR DS:[EDI+4]
10004C13 |. 8959 04 MOV DWORD PTR DS:[ECX+4],EBX
10004C16 |. 8B4F 04 MOV ECX,DWORD PTR DS:[EDI+4]
10004C19 |. 8B7F 08 MOV EDI,DWORD PTR DS:[EDI+8]
10004C1C |. 8979 08 MOV DWORD PTR DS:[ECX+8],EDI
10004C1F |. 8B4D 10 MOV ECX,[ARG.3]
10004C22 |. 2BCE SUB ECX,ESI
10004C24 |. 014D FC ADD [LOCAL.1],ECX
10004C27 |. 837D FC 00 CMP [LOCAL.1],0
10004C2B |. 0F8E A5000000 JLE jagmisc.10004CD6
10004C31 |. 8B7D FC MOV EDI,[LOCAL.1]
10004C34 |. 8B4D 0C MOV ECX,[ARG.2]
10004C37 |. C1FF 04 SAR EDI,4
10004C3A |. 4F DEC EDI
10004C3B |. 83FF 3F CMP EDI,3F
10004C3E |. 8D4C31 FC LEA ECX,DWORD PTR DS:[ECX+ESI-4]
10004C42 |. 76 03 JBE SHORT jagmisc.10004C47
10004C44 |. 6A 3F PUSH 3F
10004C46 |. 5F POP EDI ; kernel32.7C816FD7
10004C47 |> 8B5D F4 MOV EBX,[LOCAL.3]
10004C4A |. 8D1CFB LEA EBX,DWORD PTR DS:[EBX+EDI*8]
10004C4D |. 895D 10 MOV [ARG.3],EBX
10004C50 |. 8B5B 04 MOV EBX,DWORD PTR DS:[EBX+4]
10004C53 |. 8959 04 MOV DWORD PTR DS:[ECX+4],EBX
10004C56 |. 8B5D 10 MOV EBX,[ARG.3]
10004C59 |. 8959 08 MOV DWORD PTR DS:[ECX+8],EBX
10004C5C |. 894B 04 MOV DWORD PTR DS:[EBX+4],ECX
10004C5F |. 8B59 04 MOV EBX,DWORD PTR DS:[ECX+4]
10004C62 |. 894B 08 MOV DWORD PTR DS:[EBX+8],ECX
10004C65 |. 8B59 04 MOV EBX,DWORD PTR DS:[ECX+4]
10004C68 |. 3B59 08 CMP EBX,DWORD PTR DS:[ECX+8]
10004C6B |. 75 57 JNZ SHORT jagmisc.10004CC4
10004C6D |. 8A4C07 04 MOV CL,BYTE PTR DS:[EDI+EAX+4]
10004C71 |. 884D 13 MOV BYTE PTR SS:[EBP+13],CL
10004C74 |. FEC1 INC CL
10004C76 |. 83FF 20 CMP EDI,20
10004C79 |. 884C07 04 MOV BYTE PTR DS:[EDI+EAX+4],CL
10004C7D |. 73 1C JNB SHORT jagmisc.10004C9B
10004C7F |. 807D 13 00 CMP BYTE PTR SS:[EBP+13],0
10004C83 |. 75 0E JNZ SHORT jagmisc.10004C93
10004C85 |. 8BCF MOV ECX,EDI
10004C87 |. BB 00000080 MOV EBX,80000000
10004C8C |. D3EB SHR EBX,CL
10004C8E |. 8B4D 08 MOV ECX,[ARG.1]
10004C91 |. 0919 OR DWORD PTR DS:[ECX],EBX
10004C93 |> 8D4490 44 LEA EAX,DWORD PTR DS:[EAX+EDX*4+44]
10004C97 |. 8BCF MOV ECX,EDI
10004C99 |. EB 20 JMP SHORT jagmisc.10004CBB
10004C9B |> 807D 13 00 CMP BYTE PTR SS:[EBP+13],0
10004C9F |. 75 10 JNZ SHORT jagmisc.10004CB1
10004CA1 |. 8D4F E0 LEA ECX,DWORD PTR DS:[EDI-20]
10004CA4 |. BB 00000080 MOV EBX,80000000
10004CA9 |. D3EB SHR EBX,CL
10004CAB |. 8B4D 08 MOV ECX,[ARG.1]
10004CAE |. 0959 04 OR DWORD PTR DS:[ECX+4],EBX
10004CB1 |> 8D8490 C4000000 LEA EAX,DWORD PTR DS:[EAX+EDX*4+C4]
10004CB8 |. 8D4F E0 LEA ECX,DWORD PTR DS:[EDI-20]
10004CBB |> BA 00000080 MOV EDX,80000000
10004CC0 |. D3EA SHR EDX,CL
10004CC2 |. 0910 OR DWORD PTR DS:[EAX],EDX
10004CC4 |> 8B55 0C MOV EDX,[ARG.2]
10004CC7 |. 8B4D FC MOV ECX,[LOCAL.1]
10004CCA |. 8D4432 FC LEA EAX,DWORD PTR DS:[EDX+ESI-4]
10004CCE |. 8908 MOV DWORD PTR DS:[EAX],ECX
10004CD0 |. 894C01 FC MOV DWORD PTR DS:[ECX+EAX-4],ECX
10004CD4 |. EB 03 JMP SHORT jagmisc.10004CD9
10004CD6 |> 8B55 0C MOV EDX,[ARG.2]
10004CD9 |> 8D46 01 LEA EAX,DWORD PTR DS:[ESI+1]
10004CDC |. 8942 FC MOV DWORD PTR DS:[EDX-4],EAX
10004CDF |. 894432 F8 MOV DWORD PTR DS:[EDX+ESI-8],EAX
10004CE3 |. E9 3C010000 JMP jagmisc.10004E24
10004CE8 |> 33C0 XOR EAX,EAX
10004CEA |. E9 38010000 JMP jagmisc.10004E27
10004CEF |> 0F8D 2F010000 JGE jagmisc.10004E24
10004CF5 |. 8B5D 0C MOV EBX,[ARG.2]
10004CF8 |. 2975 10 SUB [ARG.3],ESI
10004CFB |. 8D4E 01 LEA ECX,DWORD PTR DS:[ESI+1]
10004CFE |. 894B FC MOV DWORD PTR DS:[EBX-4],ECX
10004D01 |. 8D5C33 FC LEA EBX,DWORD PTR DS:[EBX+ESI-4]
10004D05 |. 8B75 10 MOV ESI,[ARG.3]
10004D08 |. C1FE 04 SAR ESI,4
10004D0B |. 4E DEC ESI
10004D0C |. 83FE 3F CMP ESI,3F
10004D0F |. 895D 0C MOV [ARG.2],EBX
10004D12 |. 894B FC MOV DWORD PTR DS:[EBX-4],ECX
10004D15 |. 76 03 JBE SHORT jagmisc.10004D1A
10004D17 |. 6A 3F PUSH 3F
10004D19 |. 5E POP ESI ; kernel32.7C816FD7
10004D1A |> F645 FC 01 TEST BYTE PTR SS:[EBP-4],1
10004D1E |. 0F85 80000000 JNZ jagmisc.10004DA4
10004D24 |. 8B75 FC MOV ESI,[LOCAL.1]
10004D27 |. C1FE 04 SAR ESI,4
10004D2A |. 4E DEC ESI
10004D2B |. 83FE 3F CMP ESI,3F
10004D2E |. 76 03 JBE SHORT jagmisc.10004D33
10004D30 |. 6A 3F PUSH 3F
10004D32 |. 5E POP ESI ; kernel32.7C816FD7
10004D33 |> 8B4F 04 MOV ECX,DWORD PTR DS:[EDI+4]
10004D36 |. 3B4F 08 CMP ECX,DWORD PTR DS:[EDI+8]
10004D39 |. 75 42 JNZ SHORT jagmisc.10004D7D
10004D3B |. 83FE 20 CMP ESI,20
10004D3E |. BB 00000080 MOV EBX,80000000
10004D43 |. 73 19 JNB SHORT jagmisc.10004D5E
10004D45 |. 8BCE MOV ECX,ESI
10004D47 |. D3EB SHR EBX,CL
10004D49 |. 8D7406 04 LEA ESI,DWORD PTR DS:[ESI+EAX+4]
10004D4D |. F7D3 NOT EBX
10004D4F |. 215C90 44 AND DWORD PTR DS:[EAX+EDX*4+44],EBX
10004D53 |. FE0E DEC BYTE PTR DS:[ESI]
10004D55 |. 75 23 JNZ SHORT jagmisc.10004D7A
10004D57 |. 8B4D 08 MOV ECX,[ARG.1]
10004D5A |. 2119 AND DWORD PTR DS:[ECX],EBX
10004D5C |. EB 1C JMP SHORT jagmisc.10004D7A
10004D5E |> 8D4E E0 LEA ECX,DWORD PTR DS:[ESI-20]
10004D61 |. D3EB SHR EBX,CL
10004D63 |. 8D4C06 04 LEA ECX,DWORD PTR DS:[ESI+EAX+4]
10004D67 |. F7D3 NOT EBX
10004D69 |. 219C90 C4000000 AND DWORD PTR DS:[EAX+EDX*4+C4],EBX
10004D70 |. FE09 DEC BYTE PTR DS:[ECX]
10004D72 |. 75 06 JNZ SHORT jagmisc.10004D7A
10004D74 |. 8B4D 08 MOV ECX,[ARG.1]
10004D77 |. 2159 04 AND DWORD PTR DS:[ECX+4],EBX
10004D7A |> 8B5D 0C MOV EBX,[ARG.2]
10004D7D |> 8B4F 08 MOV ECX,DWORD PTR DS:[EDI+8]
10004D80 |. 8B77 04 MOV ESI,DWORD PTR DS:[EDI+4]
10004D83 |. 8971 04 MOV DWORD PTR DS:[ECX+4],ESI
10004D86 |. 8B77 08 MOV ESI,DWORD PTR DS:[EDI+8]
10004D89 |. 8B4F 04 MOV ECX,DWORD PTR DS:[EDI+4]
10004D8C |. 8971 08 MOV DWORD PTR DS:[ECX+8],ESI
10004D8F |. 8B75 10 MOV ESI,[ARG.3]
10004D92 |. 0375 FC ADD ESI,[LOCAL.1]
10004D95 |. 8975 10 MOV [ARG.3],ESI
10004D98 |. C1FE 04 SAR ESI,4
10004D9B |. 4E DEC ESI
10004D9C |. 83FE 3F CMP ESI,3F
10004D9F |. 76 03 JBE SHORT jagmisc.10004DA4
10004DA1 |. 6A 3F PUSH 3F
10004DA3 |. 5E POP ESI ; kernel32.7C816FD7
10004DA4 |> 8B4D F4 MOV ECX,[LOCAL.3]
10004DA7 |. 8D0CF1 LEA ECX,DWORD PTR DS:[ECX+ESI*8]
10004DAA |. 8B79 04 MOV EDI,DWORD PTR DS:[ECX+4]
10004DAD |. 894B 08 MOV DWORD PTR DS:[EBX+8],ECX
10004DB0 |. 897B 04 MOV DWORD PTR DS:[EBX+4],EDI
10004DB3 |. 8959 04 MOV DWORD PTR DS:[ECX+4],EBX
10004DB6 |. 8B4B 04 MOV ECX,DWORD PTR DS:[EBX+4]
10004DB9 |. 8959 08 MOV DWORD PTR DS:[ECX+8],EBX
10004DBC |. 8B4B 04 MOV ECX,DWORD PTR DS:[EBX+4]
10004DBF |. 3B4B 08 CMP ECX,DWORD PTR DS:[EBX+8]
10004DC2 |. 75 57 JNZ SHORT jagmisc.10004E1B
10004DC4 |. 8A4C06 04 MOV CL,BYTE PTR DS:[ESI+EAX+4]
10004DC8 |. 884D 0F MOV BYTE PTR SS:[EBP+F],CL
10004DCB |. FEC1 INC CL
10004DCD |. 83FE 20 CMP ESI,20
10004DD0 |. 884C06 04 MOV BYTE PTR DS:[ESI+EAX+4],CL
10004DD4 |. 73 1C JNB SHORT jagmisc.10004DF2
10004DD6 |. 807D 0F 00 CMP BYTE PTR SS:[EBP+F],0
10004DDA |. 75 0E JNZ SHORT jagmisc.10004DEA
10004DDC |. 8BCE MOV ECX,ESI
10004DDE |. BF 00000080 MOV EDI,80000000
10004DE3 |. D3EF SHR EDI,CL
10004DE5 |. 8B4D 08 MOV ECX,[ARG.1]
10004DE8 |. 0939 OR DWORD PTR DS:[ECX],EDI
10004DEA |> 8D4490 44 LEA EAX,DWORD PTR DS:[EAX+EDX*4+44]
10004DEE |. 8BCE MOV ECX,ESI
10004DF0 |. EB 20 JMP SHORT jagmisc.10004E12
10004DF2 |> 807D 0F 00 CMP BYTE PTR SS:[EBP+F],0
10004DF6 |. 75 10 JNZ SHORT jagmisc.10004E08
10004DF8 |. 8D4E E0 LEA ECX,DWORD PTR DS:[ESI-20]
10004DFB |. BF 00000080 MOV EDI,80000000
10004E00 |. D3EF SHR EDI,CL
10004E02 |. 8B4D 08 MOV ECX,[ARG.1]
10004E05 |. 0979 04 OR DWORD PTR DS:[ECX+4],EDI
10004E08 |> 8D8490 C4000000 LEA EAX,DWORD PTR DS:[EAX+EDX*4+C4]
10004E0F |. 8D4E E0 LEA ECX,DWORD PTR DS:[ESI-20]
10004E12 |> BA 00000080 MOV EDX,80000000
10004E17 |. D3EA SHR EDX,CL
10004E19 |. 0910 OR DWORD PTR DS:[EAX],EDX
10004E1B |> 8B45 10 MOV EAX,[ARG.3]
10004E1E |. 8903 MOV DWORD PTR DS:[EBX],EAX
10004E20 |. 894418 FC MOV DWORD PTR DS:[EAX+EBX-4],EAX
10004E24 |> 33C0 XOR EAX,EAX
10004E26 |. 40 INC EAX
10004E27 |> 5F POP EDI ; kernel32.7C816FD7
10004E28 |. 5E POP ESI ; kernel32.7C816FD7
10004E29 |. 5B POP EBX ; kernel32.7C816FD7
10004E2A |. C9 LEAVE
10004E2B \. C3 RETN
10004E2C /$ 55 PUSH EBP
10004E2D |. 8BEC MOV EBP,ESP
10004E2F |. 83EC 14 SUB ESP,14
10004E32 |. 8B4D 08 MOV ECX,[ARG.1]
10004E35 |. A1 1CB10010 MOV EAX,DWORD PTR DS:[1000B11C]
10004E3A |. 8B15 20B10010 MOV EDX,DWORD PTR DS:[1000B120]
10004E40 |. 83C1 17 ADD ECX,17
10004E43 |. 83E1 F0 AND ECX,FFFFFFF0
10004E46 |. 53 PUSH EBX
10004E47 |. 894D F0 MOV [LOCAL.4],ECX
10004E4A |. C1F9 04 SAR ECX,4
10004E4D |. 56 PUSH ESI
10004E4E |. 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4]
10004E51 |. 57 PUSH EDI
10004E52 |. 49 DEC ECX
10004E53 |. 83F9 20 CMP ECX,20
10004E56 |. 8D3C82 LEA EDI,DWORD PTR DS:[EDX+EAX*4]
10004E59 |. 897D FC MOV [LOCAL.1],EDI
10004E5C |. 7D 0B JGE SHORT jagmisc.10004E69
10004E5E |. 83CE FF OR ESI,FFFFFFFF
10004E61 |. D3EE SHR ESI,CL
10004E63 |. 834D F8 FF OR [LOCAL.2],FFFFFFFF
10004E67 |. EB 0D JMP SHORT jagmisc.10004E76
10004E69 |> 83C1 E0 ADD ECX,-20
10004E6C |. 83C8 FF OR EAX,FFFFFFFF
10004E6F |. 33F6 XOR ESI,ESI
10004E71 |. D3E8 SHR EAX,CL
10004E73 |. 8945 F8 MOV [LOCAL.2],EAX
10004E76 |> A1 28B10010 MOV EAX,DWORD PTR DS:[1000B128]
10004E7B |. 8BD8 MOV EBX,EAX
10004E7D |. 8975 F4 MOV [LOCAL.3],ESI
10004E80 |. 3BDF CMP EBX,EDI
10004E82 |. EB 14 JMP SHORT jagmisc.10004E98
10004E84 |> 8B4B 04 /MOV ECX,DWORD PTR DS:[EBX+4]
10004E87 |. 8B3B |MOV EDI,DWORD PTR DS:[EBX]
10004E89 |. 234D F8 |AND ECX,[LOCAL.2] ; LOADDLL.00410249
10004E8C |. 23FE |AND EDI,ESI
10004E8E |. 0BCF |OR ECX,EDI
10004E90 |. 75 0B |JNZ SHORT jagmisc.10004E9D
10004E92 |. 83C3 14 |ADD EBX,14
10004E95 |. 3B5D FC |CMP EBX,[LOCAL.1]
10004E98 |> 895D 08 MOV [ARG.1],EBX
10004E9B |.^ 72 E7 \JB SHORT jagmisc.10004E84
10004E9D |> 3B5D FC CMP EBX,[LOCAL.1]
10004EA0 |. 75 24 JNZ SHORT jagmisc.10004EC6
10004EA2 |. 8BDA MOV EBX,EDX
10004EA4 |. EB 11 JMP SHORT jagmisc.10004EB7
10004EA6 |> 8B4B 04 /MOV ECX,DWORD PTR DS:[EBX+4]
10004EA9 |. 8B3B |MOV EDI,DWORD PTR DS:[EBX]
10004EAB |. 234D F8 |AND ECX,[LOCAL.2] ; LOADDLL.00410249
10004EAE |. 23FE |AND EDI,ESI
10004EB0 |. 0BCF |OR ECX,EDI
10004EB2 |. 75 0A |JNZ SHORT jagmisc.10004EBE
10004EB4 |. 83C3 14 |ADD EBX,14
10004EB7 |> 3BD8 CMP EBX,EAX
10004EB9 |. 895D 08 |MOV [ARG.1],EBX
10004EBC |.^ 72 E8 \JB SHORT jagmisc.10004EA6
10004EBE |> 3BD8 CMP EBX,EAX
10004EC0 |. 0F84 94000000 JE jagmisc.10004F5A
10004EC6 |> 891D 28B10010 MOV DWORD PTR DS:[1000B128],EBX
10004ECC |. 8B43 10 MOV EAX,DWORD PTR DS:[EBX+10]
10004ECF |. 8B10 MOV EDX,DWORD PTR DS:[EAX]
10004ED1 |. 83FA FF CMP EDX,-1
10004ED4 |. 8955 FC MOV [LOCAL.1],EDX
10004ED7 |. 74 14 JE SHORT jagmisc.10004EED
10004ED9 |. 8B8C90 C4000000 MOV ECX,DWORD PTR DS:[EAX+EDX*4+C4]
10004EE0 |. 8B7C90 44 MOV EDI,DWORD PTR DS:[EAX+EDX*4+44]
10004EE4 |. 234D F8 AND ECX,[LOCAL.2] ; LOADDLL.00410249
10004EE7 |. 23FE AND EDI,ESI
10004EE9 |. 0BCF OR ECX,EDI
10004EEB |. 75 36 JNZ SHORT jagmisc.10004F23
10004EED |> 8B90 C4000000 MOV EDX,DWORD PTR DS:[EAX+C4]
10004EF3 |. 2355 F8 AND EDX,[LOCAL.2] ; LOADDLL.00410249
10004EF6 |. 8365 FC 00 AND [LOCAL.1],0
10004EFA |. 8D48 44 LEA ECX,DWORD PTR DS:[EAX+44]
10004EFD |. 8B31 MOV ESI,DWORD PTR DS:[ECX]
10004EFF |. 2375 F4 AND ESI,[LOCAL.3]
10004F02 |. 0BD6 OR EDX,ESI
10004F04 |. 8B75 F4 MOV ESI,[LOCAL.3]
10004F07 |. 75 17 JNZ SHORT jagmisc.10004F20
10004F09 |> 8B91 84000000 /MOV EDX,DWORD PTR DS:[ECX+84]
10004F0F |. 2355 F8 |AND EDX,[LOCAL.2] ; LOADDLL.00410249
10004F12 |. FF45 FC |INC [LOCAL.1]
10004F15 |. 83C1 04 |ADD ECX,4
10004F18 |. 8B39 |MOV EDI,DWORD PTR DS:[ECX]
10004F1A |. 23FE |AND EDI,ESI
10004F1C |. 0BD7 |OR EDX,EDI
10004F1E |.^ 74 E9 \JE SHORT jagmisc.10004F09
10004F20 |> 8B55 FC MOV EDX,[LOCAL.1]
10004F23 |> 8BCA MOV ECX,EDX
10004F25 |. 69C9 04020000 IMUL ECX,ECX,204
10004F2B |. 8D8C01 44010000 LEA ECX,DWORD PTR DS:[ECX+EAX+144]
10004F32 |. 894D F4 MOV [LOCAL.3],ECX
10004F35 |. 8B4C90 44 MOV ECX,DWORD PTR DS:[EAX+EDX*4+44]
10004F39 |. 33FF XOR EDI,EDI
10004F3B |. 23CE AND ECX,ESI
10004F3D |. 75 6D JNZ SHORT jagmisc.10004FAC
10004F3F |. 8B8C90 C4000000 MOV ECX,DWORD PTR DS:[EAX+EDX*4+C4]
10004F46 |. 234D F8 AND ECX,[LOCAL.2] ; LOADDLL.00410249
10004F49 |. 6A 20 PUSH 20
10004F4B |. 5F POP EDI ; kernel32.7C816FD7
10004F4C |. EB 5E JMP SHORT jagmisc.10004FAC
10004F4E |> 837B 08 00 /CMP DWORD PTR DS:[EBX+8],0
10004F52 |. 75 0B |JNZ SHORT jagmisc.10004F5F
10004F54 |. 83C3 14 |ADD EBX,14
10004F57 |. 895D 08 |MOV [ARG.1],EBX
10004F5A |> 3B5D FC CMP EBX,[LOCAL.1]
10004F5D |.^ 72 EF \JB SHORT jagmisc.10004F4E
10004F5F |> 3B5D FC CMP EBX,[LOCAL.1]
10004F62 |. 75 26 JNZ SHORT jagmisc.10004F8A
10004F64 |. 8BDA MOV EBX,EDX
10004F66 |. EB 09 JMP SHORT jagmisc.10004F71
10004F68 |> 837B 08 00 /CMP DWORD PTR DS:[EBX+8],0
10004F6C |. 75 0A |JNZ SHORT jagmisc.10004F78
10004F6E |. 83C3 14 |ADD EBX,14
10004F71 |> 3BD8 CMP EBX,EAX
10004F73 |. 895D 08 |MOV [ARG.1],EBX
10004F76 |.^ 72 F0 \JB SHORT jagmisc.10004F68
10004F78 |> 3BD8 CMP EBX,EAX
10004F7A |. 75 0E JNZ SHORT jagmisc.10004F8A
10004F7C |. E8 0FFAFFFF CALL jagmisc.10004990
10004F81 |. 8BD8 MOV EBX,EAX
10004F83 |. 85DB TEST EBX,EBX
10004F85 |. 895D 08 MOV [ARG.1],EBX
10004F88 |. 74 18 JE SHORT jagmisc.10004FA2
10004F8A |> 53 PUSH EBX
10004F8B |. E8 B7FAFFFF CALL jagmisc.10004A47
10004F90 |. 59 POP ECX ; kernel32.7C816FD7
10004F91 |. 8B4B 10 MOV ECX,DWORD PTR DS:[EBX+10]
10004F94 |. 8901 MOV DWORD PTR DS:[ECX],EAX
10004F96 |. 8B43 10 MOV EAX,DWORD PTR DS:[EBX+10]
10004F99 |. 8338 FF CMP DWORD PTR DS:[EAX],-1
10004F9C |.^ 0F85 24FFFFFF JNZ jagmisc.10004EC6
10004FA2 |> 33C0 XOR EAX,EAX
10004FA4 |. E9 7A010000 JMP jagmisc.10005123
10004FA9 |> D1E1 /SHL ECX,1
10004FAB |. 47 |INC EDI
10004FAC |> 85C9 TEST ECX,ECX
10004FAE |.^ 7D F9 \JGE SHORT jagmisc.10004FA9
10004FB0 |. 8B4D F4 MOV ECX,[LOCAL.3]
10004FB3 |. 8B54F9 04 MOV EDX,DWORD PTR DS:[ECX+EDI*8+4]
10004FB7 |. 8B0A MOV ECX,DWORD PTR DS:[EDX]
10004FB9 |. 2B4D F0 SUB ECX,[LOCAL.4]
10004FBC |. 8BF1 MOV ESI,ECX
10004FBE |. C1FE 04 SAR ESI,4
10004FC1 |. 4E DEC ESI
10004FC2 |. 83FE 3F CMP ESI,3F
10004FC5 |. 894D F8 MOV [LOCAL.2],ECX
10004FC8 |. 7E 03 JLE SHORT jagmisc.10004FCD
10004FCA |. 6A 3F PUSH 3F
10004FCC |. 5E POP ESI ; kernel32.7C816FD7
10004FCD |> 3BF7 CMP ESI,EDI
10004FCF |. 0F84 01010000 JE jagmisc.100050D6
10004FD5 |. 8B4A 04 MOV ECX,DWORD PTR DS:[EDX+4]
10004FD8 |. 3B4A 08 CMP ECX,DWORD PTR DS:[EDX+8]
10004FDB |. 75 5C JNZ SHORT jagmisc.10005039
10004FDD |. 83FF 20 CMP EDI,20
10004FE0 |. BB 00000080 MOV EBX,80000000
10004FE5 |. 7D 26 JGE SHORT jagmisc.1000500D
10004FE7 |. 8BCF MOV ECX,EDI
10004FE9 |. D3EB SHR EBX,CL
10004FEB |. 8B4D FC MOV ECX,[LOCAL.1]
10004FEE |. 8D7C38 04 LEA EDI,DWORD PTR DS:[EAX+EDI+4]
10004FF2 |. F7D3 NOT EBX
10004FF4 |. 895D EC MOV [LOCAL.5],EBX
10004FF7 |. 235C88 44 AND EBX,DWORD PTR DS:[EAX+ECX*4+44]
10004FFB |. 895C88 44 MOV DWORD PTR DS:[EAX+ECX*4+44],EBX
10004FFF |. FE0F DEC BYTE PTR DS:[EDI]
10005001 |. 75 33 JNZ SHORT jagmisc.10005036
10005003 |. 8B4D EC MOV ECX,[LOCAL.5]
10005006 |. 8B5D 08 MOV EBX,[ARG.1]
10005009 |. 210B AND DWORD PTR DS:[EBX],ECX
1000500B |. EB 2C JMP SHORT jagmisc.10005039
1000500D |> 8D4F E0 LEA ECX,DWORD PTR DS:[EDI-20]
10005010 |. D3EB SHR EBX,CL
10005012 |. 8B4D FC MOV ECX,[LOCAL.1]
10005015 |. 8D8C88 C4000000 LEA ECX,DWORD PTR DS:[EAX+ECX*4+C4]
1000501C |. 8D7C38 04 LEA EDI,DWORD PTR DS:[EAX+EDI+4]
10005020 |. F7D3 NOT EBX
10005022 |. 2119 AND DWORD PTR DS:[ECX],EBX
10005024 |. FE0F DEC BYTE PTR DS:[EDI]
10005026 |. 895D EC MOV [LOCAL.5],EBX
10005029 |. 75 0B JNZ SHORT jagmisc.10005036
1000502B |. 8B5D 08 MOV EBX,[ARG.1]
1000502E |. 8B4D EC MOV ECX,[LOCAL.5]
10005031 |. 214B 04 AND DWORD PTR DS:[EBX+4],ECX
10005034 |. EB 03 JMP SHORT jagmisc.10005039
10005036 |> 8B5D 08 MOV EBX,[ARG.1]
10005039 |> 837D F8 00 CMP [LOCAL.2],0
1000503D |. 8B4A 08 MOV ECX,DWORD PTR DS:[EDX+8]
10005040 |. 8B7A 04 MOV EDI,DWORD PTR DS:[EDX+4]
10005043 |. 8979 04 MOV DWORD PTR DS:[ECX+4],EDI
10005046 |. 8B4A 04 MOV ECX,DWORD PTR DS:[EDX+4]
10005049 |. 8B7A 08 MOV EDI,DWORD PTR DS:[EDX+8]
1000504C |. 8979 08 MOV DWORD PTR DS:[ECX+8],EDI
1000504F |. 0F84 8D000000 JE jagmisc.100050E2
10005055 |. 8B4D F4 MOV ECX,[LOCAL.3]
10005058 |. 8D0CF1 LEA ECX,DWORD PTR DS:[ECX+ESI*8]
1000505B |. 8B79 04 MOV EDI,DWORD PTR DS:[ECX+4]
1000505E |. 894A 08 MOV DWORD PTR DS:[EDX+8],ECX
10005061 |. 897A 04 MOV DWORD PTR DS:[EDX+4],EDI
10005064 |. 8951 04 MOV DWORD PTR DS:[ECX+4],EDX
10005067 |. 8B4A 04 MOV ECX,DWORD PTR DS:[EDX+4]
1000506A |. 8951 08 MOV DWORD PTR DS:[ECX+8],EDX
1000506D |. 8B4A 04 MOV ECX,DWORD PTR DS:[EDX+4]
10005070 |. 3B4A 08 CMP ECX,DWORD PTR DS:[EDX+8]
10005073 |. 75 5E JNZ SHORT jagmisc.100050D3
10005075 |. 8A4C06 04 MOV CL,BYTE PTR DS:[ESI+EAX+4]
10005079 |. 884D 0B MOV BYTE PTR SS:[EBP+B],CL
1000507C |. FEC1 INC CL
1000507E |. 83FE 20 CMP ESI,20
10005081 |. 884C06 04 MOV BYTE PTR DS:[ESI+EAX+4],CL
10005085 |. 7D 23 JGE SHORT jagmisc.100050AA
10005087 |. 807D 0B 00 CMP BYTE PTR SS:[EBP+B],0
1000508B |. 75 0B JNZ SHORT jagmisc.10005098
1000508D |. BF 00000080 MOV EDI,80000000
10005092 |. 8BCE MOV ECX,ESI
10005094 |. D3EF SHR EDI,CL
10005096 |. 093B OR DWORD PTR DS:[EBX],EDI
10005098 |> 8BCE MOV ECX,ESI
1000509A |. BF 00000080 MOV EDI,80000000
1000509F |. D3EF SHR EDI,CL
100050A1 |. 8B4D FC MOV ECX,[LOCAL.1]
100050A4 |. 097C88 44 OR DWORD PTR DS:[EAX+ECX*4+44],EDI
100050A8 |. EB 29 JMP SHORT jagmisc.100050D3
100050AA |> 807D 0B 00 CMP BYTE PTR SS:[EBP+B],0
100050AE |. 75 0D JNZ SHORT jagmisc.100050BD
100050B0 |. 8D4E E0 LEA ECX,DWORD PTR DS:[ESI-20]
100050B3 |. BF 00000080 MOV EDI,80000000
100050B8 |. D3EF SHR EDI,CL
100050BA |. 097B 04 OR DWORD PTR DS:[EBX+4],EDI
100050BD |> 8B4D FC MOV ECX,[LOCAL.1]
100050C0 |. 8DBC88 C4000000 LEA EDI,DWORD PTR DS:[EAX+ECX*4+C4]
100050C7 |. 8D4E E0 LEA ECX,DWORD PTR DS:[ESI-20]
100050CA |. BE 00000080 MOV ESI,80000000
100050CF |. D3EE SHR ESI,CL
100050D1 |. 0937 OR DWORD PTR DS:[EDI],ESI
100050D3 |> 8B4D F8 MOV ECX,[LOCAL.2] ; LOADDLL.00410249
100050D6 |> 85C9 TEST ECX,ECX
100050D8 |. 74 0B JE SHORT jagmisc.100050E5
100050DA |. 890A MOV DWORD PTR DS:[EDX],ECX
100050DC |. 894C11 FC MOV DWORD PTR DS:[ECX+EDX-4],ECX
100050E0 |. EB 03 JMP SHORT jagmisc.100050E5
100050E2 |> 8B4D F8 MOV ECX,[LOCAL.2] ; LOADDLL.00410249
100050E5 |> 8B75 F0 MOV ESI,[LOCAL.4]
100050E8 |. 03D1 ADD EDX,ECX
100050EA |. 8D4E 01 LEA ECX,DWORD PTR DS:[ESI+1]
100050ED |. 890A MOV DWORD PTR DS:[EDX],ECX
100050EF |. 894C32 FC MOV DWORD PTR DS:[EDX+ESI-4],ECX
100050F3 |. 8B75 F4 MOV ESI,[LOCAL.3]
100050F6 |. 8B0E MOV ECX,DWORD PTR DS:[ESI]
100050F8 |. 85C9 TEST ECX,ECX
100050FA |. 8D79 01 LEA EDI,DWORD PTR DS:[ECX+1]
100050FD |. 893E MOV DWORD PTR DS:[ESI],EDI
100050FF |. 75 1A JNZ SHORT jagmisc.1000511B
10005101 |. 3B1D 18B10010 CMP EBX,DWORD PTR DS:[1000B118]
10005107 |. 75 12 JNZ SHORT jagmisc.1000511B
10005109 |. 8B4D FC MOV ECX,[LOCAL.1]
1000510C |. 3B0D 30B10010 CMP ECX,DWORD PTR DS:[1000B130]
10005112 |. 75 07 JNZ SHORT jagmisc.1000511B
10005114 |. 8325 18B10010 00 AND DWORD PTR DS:[1000B118],0
1000511B |> 8B4D FC MOV ECX,[LOCAL.1]
1000511E |. 8908 MOV DWORD PTR DS:[EAX],ECX
10005120 |. 8D42 04 LEA EAX,DWORD PTR DS:[EDX+4]
10005123 |> 5F POP EDI ; kernel32.7C816FD7
10005124 |. 5E POP ESI ; kernel32.7C816FD7
10005125 |. 5B POP EBX ; kernel32.7C816FD7
10005126 |. C9 LEAVE
10005127 \. C3 RETN
10005128 /$ 55 PUSH EBP
10005129 |. 8BEC MOV EBP,ESP
1000512B |. 53 PUSH EBX
1000512C |. 56 PUSH ESI
1000512D |. 57 PUSH EDI
1000512E |. 55 PUSH EBP
1000512F |. 6A 00 PUSH 0 ; /_eax_value = 0
10005131 |. 6A 00 PUSH 0 ; |pExcptRec = NULL
10005133 |. 68 40510010 PUSH jagmisc.10005140 ; |ReturnAddr = jagmisc.10005140
10005138 |. FF75 08 PUSH [ARG.1] ; |pRegistrationFrame = FFFFFFFF
1000513B |. E8 AE290000 CALL <JMP.&KERNEL32.RtlUnwind> ; \RtlUnwind
10005140 |. 5D POP EBP ; kernel32.7C816FD7
10005141 |. 5F POP EDI ; kernel32.7C816FD7
10005142 |. 5E POP ESI ; kernel32.7C816FD7
10005143 |. 5B POP EBX ; kernel32.7C816FD7
10005144 |. 8BE5 MOV ESP,EBP
10005146 |. 5D POP EBP ; kernel32.7C816FD7
10005147 \. C3 RETN
10005148 /$ 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738; Structured exception handler
1000514C |. F741 04 06000000 TEST DWORD PTR DS:[ECX+4],6
10005153 |. B8 01000000 MOV EAX,1
10005158 |. 74 0F JE SHORT jagmisc.10005169
1000515A |. 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
1000515E |. 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10]
10005162 |. 8902 MOV DWORD PTR DS:[EDX],EAX
10005164 |. B8 03000000 MOV EAX,3
10005169 \> C3 RETN
1000516A /$ 53 PUSH EBX
1000516B |. 56 PUSH ESI
1000516C |. 57 PUSH EDI
1000516D |. 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10]
10005171 |. 50 PUSH EAX
10005172 |. 6A FE PUSH -2
10005174 |. 68 48510010 PUSH jagmisc.10005148 ; SE handler installation
10005179 |. 64:FF35 00000000 PUSH DWORD PTR FS:[0]
10005180 |. 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
10005187 |> 8B4424 20 /MOV EAX,DWORD PTR SS:[ESP+20] ; kernel32.7C839AA8
1000518B |. 8B58 08 |MOV EBX,DWORD PTR DS:[EAX+8]
1000518E |. 8B70 0C |MOV ESI,DWORD PTR DS:[EAX+C]
10005191 |. 83FE FF |CMP ESI,-1
10005194 |. 74 2E |JE SHORT jagmisc.100051C4
10005196 |. 3B7424 24 |CMP ESI,DWORD PTR SS:[ESP+24] ; kernel32.7C816FE0
1000519A |. 74 28 |JE SHORT jagmisc.100051C4
1000519C |. 8D3476 |LEA ESI,DWORD PTR DS:[ESI+ESI*2]
1000519F |. 8B0CB3 |MOV ECX,DWORD PTR DS:[EBX+ESI*4]
100051A2 |. 894C24 08 |MOV DWORD PTR SS:[ESP+8],ECX
100051A6 |. 8948 0C |MOV DWORD PTR DS:[EAX+C],ECX
100051A9 |. 837CB3 04 00 |CMP DWORD PTR DS:[EBX+ESI*4+4],0
100051AE |. 75 12 |JNZ SHORT jagmisc.100051C2
100051B0 |. 68 01010000 |PUSH 101
100051B5 |. 8B44B3 08 |MOV EAX,DWORD PTR DS:[EBX+ESI*4+8]
100051B9 |. E8 40000000 |CALL jagmisc.100051FE
100051BE |. FF54B3 08 |CALL DWORD PTR DS:[EBX+ESI*4+8]
100051C2 |>^ EB C3 \JMP SHORT jagmisc.10005187
100051C4 |> 64:8F05 00000000 POP DWORD PTR FS:[0] ; kernel32.7C816FD7
100051CB |. 83C4 0C ADD ESP,0C
100051CE |. 5F POP EDI ; kernel32.7C816FD7
100051CF |. 5E POP ESI ; kernel32.7C816FD7
100051D0 |. 5B POP EBX ; kernel32.7C816FD7
100051D1 \. C3 RETN
100051D2 . 33C0 XOR EAX,EAX
100051D4 . 64:8B0D 00000000 MOV ECX,DWORD PTR FS:[0]
100051DB . 8179 04 48510010 CMP DWORD PTR DS:[ECX+4],jagmisc.10005148 ; Entry address
100051E2 . 75 10 JNZ SHORT jagmisc.100051F4
100051E4 . 8B51 0C MOV EDX,DWORD PTR DS:[ECX+C]
100051E7 . 8B52 0C MOV EDX,DWORD PTR DS:[EDX+C]
100051EA . 3951 08 CMP DWORD PTR DS:[ECX+8],EDX
100051ED . 75 05 JNZ SHORT jagmisc.100051F4
100051EF . B8 01000000 MOV EAX,1
100051F4 > C3 RETN
100051F5 . 53 PUSH EBX
100051F6 . 51 PUSH ECX
100051F7 . BB 20A70010 MOV EBX,jagmisc.1000A720
100051FC . EB 0A JMP SHORT jagmisc.10005208
100051FE /$ 53 PUSH EBX
100051FF |. 51 PUSH ECX
10005200 |. BB 20A70010 MOV EBX,jagmisc.1000A720
10005205 |. 8B4D 08 MOV ECX,[ARG.1]
10005208 |> 894B 08 MOV DWORD PTR DS:[EBX+8],ECX
1000520B |. 8943 04 MOV DWORD PTR DS:[EBX+4],EAX
1000520E |. 896B 0C MOV DWORD PTR DS:[EBX+C],EBP
10005211 |. 59 POP ECX ; kernel32.7C816FD7
10005212 |. 5B POP EBX ; kernel32.7C816FD7
10005213 \. C2 0400 RETN 4
10005216 /$ 55 PUSH EBP
10005217 |. 8BEC MOV EBP,ESP
10005219 |. 83EC 20 SUB ESP,20
1000521C |. 53 PUSH EBX
1000521D |. 56 PUSH ESI
1000521E |. 8B75 08 MOV ESI,[ARG.1]
10005221 |. 8B5E 08 MOV EBX,DWORD PTR DS:[ESI+8]
10005224 |. F6C3 03 TEST BL,3
10005227 |. 75 1B JNZ SHORT jagmisc.10005244
10005229 |. 64:A1 18000000 MOV EAX,DWORD PTR FS:[18]
1000522F |. 8945 08 MOV [ARG.1],EAX
10005232 |. 8B45 08 MOV EAX,[ARG.1]
10005235 |. 8B48 08 MOV ECX,DWORD PTR DS:[EAX+8]
10005238 |. 3BD9 CMP EBX,ECX
1000523A |. 894D FC MOV [LOCAL.1],ECX
1000523D |. 72 0C JB SHORT jagmisc.1000524B
1000523F |. 3B58 04 CMP EBX,DWORD PTR DS:[EAX+4]
10005242 |. 73 07 JNB SHORT jagmisc.1000524B
10005244 |> 33C0 XOR EAX,EAX
10005246 |. E9 F0010000 JMP jagmisc.1000543B
1000524B |> 57 PUSH EDI
1000524C |. 8B7E 0C MOV EDI,DWORD PTR DS:[ESI+C]
1000524F |. 83FF FF CMP EDI,-1
10005252 |. 75 08 JNZ SHORT jagmisc.1000525C
10005254 |> 33C0 XOR EAX,EAX
10005256 |. 40 INC EAX
10005257 |. E9 DE010000 JMP jagmisc.1000543A
1000525C |> 33D2 XOR EDX,EDX
1000525E |. 8955 08 MOV [ARG.1],EDX
10005261 |. 8BC3 MOV EAX,EBX
10005263 |> 8B08 /MOV ECX,DWORD PTR DS:[EAX]
10005265 |. 83F9 FF |CMP ECX,-1
10005268 |. 74 08 |JE SHORT jagmisc.10005272
1000526A |. 3BCA |CMP ECX,EDX
1000526C |. 0F83 45010000 |JNB jagmisc.100053B7
10005272 |> 8378 04 00 |CMP DWORD PTR DS:[EAX+4],0
10005276 |. 74 03 |JE SHORT jagmisc.1000527B
10005278 |. FF45 08 |INC [ARG.1]
1000527B |> 42 |INC EDX
1000527C |. 83C0 0C |ADD EAX,0C
1000527F |. 3BD7 |CMP EDX,EDI
10005281 |.^ 76 E0 \JBE SHORT jagmisc.10005263
10005283 |. 837D 08 00 CMP [ARG.1],0
10005287 |. 74 14 JE SHORT jagmisc.1000529D
10005289 |. 8B46 F8 MOV EAX,DWORD PTR DS:[ESI-8]
1000528C |. 3B45 FC CMP EAX,[LOCAL.1]
1000528F |. 0F82 22010000 JB jagmisc.100053B7
10005295 |. 3BC6 CMP EAX,ESI
10005297 |. 0F83 1A010000 JNB jagmisc.100053B7
1000529D |> A1 40AF0010 MOV EAX,DWORD PTR DS:[1000AF40]
100052A2 |. 8BFB MOV EDI,EBX
100052A4 |. 81E7 00F0FFFF AND EDI,FFFFF000
100052AA |. 33F6 XOR ESI,ESI
100052AC |. 85C0 TEST EAX,EAX
100052AE |. 7E 12 JLE SHORT jagmisc.100052C2
100052B0 |> 393CB5 48AF0010 /CMP DWORD PTR DS:[ESI*4+1000AF48],EDI
100052B7 |. 0F84 FE000000 |JE jagmisc.100053BB
100052BD |. 46 |INC ESI
100052BE |. 3BF0 |CMP ESI,EAX
100052C0 |.^ 7C EE \JL SHORT jagmisc.100052B0
100052C2 |> 6A 1C PUSH 1C ; /BufSize = 1C (28.)
100052C4 |. 8D45 E0 LEA EAX,[LOCAL.8] ; |
100052C7 |. 50 PUSH EAX ; |Buffer = 00000008
100052C8 |. 53 PUSH EBX ; |Address = NULL
100052C9 |. FF15 D8800010 CALL DWORD PTR DS:[<&KERNEL32.VirtualQuery>] ; \VirtualQuery
100052CF |. 85C0 TEST EAX,EAX
100052D1 |. 0F84 60010000 JE jagmisc.10005437
100052D7 |. 817D F8 00000001 CMP [LOCAL.2],1000000
100052DE |. 0F85 53010000 JNZ jagmisc.10005437
100052E4 |. F645 F4 CC TEST BYTE PTR SS:[EBP-C],0CC
100052E8 |. 74 56 JE SHORT jagmisc.10005340
100052EA |. 8B4D E4 MOV ECX,[LOCAL.7]
100052ED |. 66:8139 4D5A CMP WORD PTR DS:[ECX],5A4D
100052F2 |. 0F85 3F010000 JNZ jagmisc.10005437
100052F8 |. 8B41 3C MOV EAX,DWORD PTR DS:[ECX+3C]
100052FB |. 03C1 ADD EAX,ECX
100052FD |. 8138 50450000 CMP DWORD PTR DS:[EAX],4550
10005303 |. 0F85 2E010000 JNZ jagmisc.10005437
10005309 |. 66:8178 18 0B01 CMP WORD PTR DS:[EAX+18],10B
1000530F |. 0F85 22010000 JNZ jagmisc.10005437
10005315 |. 2BD9 SUB EBX,ECX
10005317 |. 66:8378 06 00 CMP WORD PTR DS:[EAX+6],0
1000531C |. 0FB748 14 MOVZX ECX,WORD PTR DS:[EAX+14]
10005320 |. 8D4C01 18 LEA ECX,DWORD PTR DS:[ECX+EAX+18]
10005324 |. 0F86 0D010000 JBE jagmisc.10005437
1000532A |. 8B41 0C MOV EAX,DWORD PTR DS:[ECX+C]
1000532D |. 3BD8 CMP EBX,EAX
1000532F |. 72 0F JB SHORT jagmisc.10005340
10005331 |. 8B51 08 MOV EDX,DWORD PTR DS:[ECX+8]
10005334 |. 03D0 ADD EDX,EAX
10005336 |. 3BDA CMP EBX,EDX
10005338 |. 73 06 JNB SHORT jagmisc.10005340
1000533A |. F641 27 80 TEST BYTE PTR DS:[ECX+27],80
1000533E |. 75 77 JNZ SHORT jagmisc.100053B7
10005340 |> 6A 01 PUSH 1 ; /NewValue = 1
10005342 |. 68 88AF0010 PUSH jagmisc.1000AF88 ; |pTarget = jagmisc.1000AF88
10005347 |. FF15 D4800010 CALL DWORD PTR DS:[<&KERNEL32.InterlockedExchange>] ; \InterlockedExchange
1000534D |. 85C0 TEST EAX,EAX
1000534F |.^ 0F85 FFFEFFFF JNZ jagmisc.10005254
10005355 |. 8B0D 40AF0010 MOV ECX,DWORD PTR DS:[1000AF40]
1000535B |. 85C9 TEST ECX,ECX
1000535D |. 8BD1 MOV EDX,ECX
1000535F |. 7E 13 JLE SHORT jagmisc.10005374
10005361 |. 8D048D 44AF0010 LEA EAX,DWORD PTR DS:[ECX*4+1000AF44]
10005368 |> 3938 /CMP DWORD PTR DS:[EAX],EDI
1000536A |. 74 08 |JE SHORT jagmisc.10005374
1000536C |. 4A |DEC EDX
1000536D |. 83E8 04 |SUB EAX,4
10005370 |. 85D2 |TEST EDX,EDX
10005372 |.^ 7F F4 \JG SHORT jagmisc.10005368
10005374 |> 85D2 TEST EDX,EDX
10005376 |. 75 2D JNZ SHORT jagmisc.100053A5
10005378 |. 6A 0F PUSH 0F
1000537A |. 5B POP EBX ; kernel32.7C816FD7
1000537B |. 3BCB CMP ECX,EBX
1000537D |. 7F 02 JG SHORT jagmisc.10005381
1000537F |. 8BD9 MOV EBX,ECX
10005381 |> 33D2 XOR EDX,EDX
10005383 |. 85DB TEST EBX,EBX
10005385 |. 7C 12 JL SHORT jagmisc.10005399
10005387 |> 8D0495 48AF0010 /LEA EAX,DWORD PTR DS:[EDX*4+1000AF48]
1000538E |. 8B30 |MOV ESI,DWORD PTR DS:[EAX]
10005390 |. 42 |INC EDX
10005391 |. 3BD3 |CMP EDX,EBX
10005393 |. 8938 |MOV DWORD PTR DS:[EAX],EDI
10005395 |. 8BFE |MOV EDI,ESI
10005397 |.^ 7E EE \JLE SHORT jagmisc.10005387
10005399 |> 83F9 10 CMP ECX,10
1000539C |. 7D 07 JGE SHORT jagmisc.100053A5
1000539E |. 41 INC ECX
1000539F |. 890D 40AF0010 MOV DWORD PTR DS:[1000AF40],ECX
100053A5 |> 6A 00 PUSH 0 ; /NewValue = 0
100053A7 |. 68 88AF0010 PUSH jagmisc.1000AF88 ; |pTarget = jagmisc.1000AF88
100053AC |. FF15 D4800010 CALL DWORD PTR DS:[<&KERNEL32.InterlockedExchange>] ; \InterlockedExchange
100053B2 |.^ E9 9DFEFFFF JMP jagmisc.10005254
100053B7 |> 33C0 XOR EAX,EAX
100053B9 |. EB 7F JMP SHORT jagmisc.1000543A
100053BB |> 85F6 TEST ESI,ESI
100053BD |.^ 0F8E 91FEFFFF JLE jagmisc.10005254
100053C3 |. 8B1D D4800010 MOV EBX,DWORD PTR DS:[<&KERNEL32.InterlockedExchange>] ; kernel32.InterlockedExchange
100053C9 |. 6A 01 PUSH 1 ; /NewValue = 1
100053CB |. 68 88AF0010 PUSH jagmisc.1000AF88 ; |pTarget = jagmisc.1000AF88
100053D0 |. FFD3 CALL EBX ; \InterlockedExchange
100053D2 |. 85C0 TEST EAX,EAX
100053D4 |.^ 0F85 7AFEFFFF JNZ jagmisc.10005254
100053DA |. 393CB5 48AF0010 CMP DWORD PTR DS:[ESI*4+1000AF48],EDI
100053E1 |. 74 2E JE SHORT jagmisc.10005411
100053E3 |. A1 40AF0010 MOV EAX,DWORD PTR DS:[1000AF40]
100053E8 |. 8D70 FF LEA ESI,DWORD PTR DS:[EAX-1]
100053EB |. 85F6 TEST ESI,ESI
100053ED |. 7C 10 JL SHORT jagmisc.100053FF
100053EF |> 393CB5 48AF0010 /CMP DWORD PTR DS:[ESI*4+1000AF48],EDI
100053F6 |. 74 03 |JE SHORT jagmisc.100053FB
100053F8 |. 4E |DEC ESI
100053F9 |.^ 79 F4 \JNS SHORT jagmisc.100053EF
100053FB |> 85F6 TEST ESI,ESI
100053FD |. 7D 10 JGE SHORT jagmisc.1000540F
100053FF |> 83F8 10 CMP EAX,10
10005402 |. 7D 06 JGE SHORT jagmisc.1000540A
10005404 |. 40 INC EAX
10005405 |. A3 40AF0010 MOV DWORD PTR DS:[1000AF40],EAX
1000540A |> 8D70 FF LEA ESI,DWORD PTR DS:[EAX-1]
1000540D |. EB 02 JMP SHORT jagmisc.10005411
1000540F |> 74 18 JE SHORT jagmisc.10005429
10005411 |> 33C9 XOR ECX,ECX
10005413 |. 85F6 TEST ESI,ESI
10005415 |. 7C 12 JL SHORT jagmisc.10005429
10005417 |> 8D048D 48AF0010 /LEA EAX,DWORD PTR DS:[ECX*4+1000AF48]
1000541E |. 8B10 |MOV EDX,DWORD PTR DS:[EAX]
10005420 |. 41 |INC ECX
10005421 |. 3BCE |CMP ECX,ESI
10005423 |. 8938 |MOV DWORD PTR DS:[EAX],EDI
10005425 |. 8BFA |MOV EDI,EDX
10005427 |.^ 7E EE \JLE SHORT jagmisc.10005417
10005429 |> 6A 00 PUSH 0
1000542B |. 68 88AF0010 PUSH jagmisc.1000AF88
10005430 |. FFD3 CALL EBX
10005432 |.^ E9 1DFEFFFF JMP jagmisc.10005254
10005437 |> 83C8 FF OR EAX,FFFFFFFF
1000543A |> 5F POP EDI ; kernel32.7C816FD7
1000543B |> 5E POP ESI ; kernel32.7C816FD7
1000543C |. 5B POP EBX ; kernel32.7C816FD7
1000543D |. C9 LEAVE
1000543E \. C3 RETN
1000543F /$ A1 8CAF0010 MOV EAX,DWORD PTR DS:[1000AF8C]
10005444 |. 85C0 TEST EAX,EAX
10005446 |. 74 0F JE SHORT jagmisc.10005457
10005448 |. FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738
1000544C |. FFD0 CALL EAX
1000544E |. 85C0 TEST EAX,EAX
10005450 |. 59 POP ECX ; kernel32.7C816FD7
10005451 |. 74 04 JE SHORT jagmisc.10005457
10005453 |. 33C0 XOR EAX,EAX
10005455 |. 40 INC EAX
10005456 |. C3 RETN
10005457 |> 33C0 XOR EAX,EAX
10005459 \. C3 RETN
1000545A . FF7424 04 PUSH DWORD PTR SS:[ESP+4] ; /pCriticalSection = ntdll.7C910738
1000545E . FF15 24800010 CALL DWORD PTR DS:[<&KERNEL32.InitializeCriticalSection>] ; \InitializeCriticalSection
10005464 . 33C0 XOR EAX,EAX
10005466 . 40 INC EAX
10005467 . C2 0800 RETN 8
1000546A $ 6A 10 PUSH 10
1000546C . 68 78880010 PUSH jagmisc.10008878
10005471 . E8 FACEFFFF CALL jagmisc.10002370
10005476 . A1 94AF0010 MOV EAX,DWORD PTR DS:[1000AF94]
1000547B . 85C0 TEST EAX,EAX
1000547D . 75 37 JNZ SHORT jagmisc.100054B6
1000547F . 833D 8CAC0010 01 CMP DWORD PTR DS:[1000AC8C],1
10005486 . 74 24 JE SHORT jagmisc.100054AC
10005488 . 68 FC810010 PUSH jagmisc.100081FC ; /pModule = "kernel32.dll"
1000548D . FF15 54800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA
10005493 . 85C0 TEST EAX,EAX
10005495 . 74 15 JE SHORT jagmisc.100054AC
10005497 . 68 4C880010 PUSH jagmisc.1000884C ; /ProcNameOrOrdinal = "InitializeCriticalSectionAndSpinCount"
1000549C . 50 PUSH EAX ; |hModule = 00000008
1000549D . FF15 50800010 CALL DWORD PTR DS:[<&KERNEL32.GetProcAddress>] ; \GetProcAddress
100054A3 . A3 94AF0010 MOV DWORD PTR DS:[1000AF94],EAX
100054A8 . 85C0 TEST EAX,EAX
100054AA . 75 0A JNZ SHORT jagmisc.100054B6
100054AC > B8 5A540010 MOV EAX,jagmisc.1000545A
100054B1 . A3 94AF0010 MOV DWORD PTR DS:[1000AF94],EAX
100054B6 > 8365 FC 00 AND DWORD PTR SS:[EBP-4],0
100054BA . FF75 0C PUSH DWORD PTR SS:[EBP+C]
100054BD . FF75 08 PUSH DWORD PTR SS:[EBP+8]
100054C0 . FFD0 CALL EAX
100054C2 . 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX
100054C5 . EB 24 JMP SHORT jagmisc.100054EB
100054C7 . 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
100054CA . 8B00 MOV EAX,DWORD PTR DS:[EAX]
100054CC . 8B00 MOV EAX,DWORD PTR DS:[EAX]
100054CE . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
100054D1 . 33C0 XOR EAX,EAX
100054D3 . 40 INC EAX
100054D4 . C3 RETN
100054D5 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451
100054D8 . 817D E4 170000C0 CMP DWORD PTR SS:[EBP-1C],C0000017
100054DF . 75 08 JNZ SHORT jagmisc.100054E9
100054E1 . 6A 08 PUSH 8 ; /Error = ERROR_NOT_ENOUGH_MEMORY
100054E3 . FF15 5C800010 CALL DWORD PTR DS:[<&KERNEL32.SetLastError>] ; \SetLastError
100054E9 > 33C0 XOR EAX,EAX
100054EB > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
100054EF . E8 B7CEFFFF CALL jagmisc.100023AB
100054F4 . C3 RETN
100054F5 /$ 6A 0C PUSH 0C
100054F7 |. 68 88880010 PUSH jagmisc.10008888
100054FC |. E8 6FCEFFFF CALL jagmisc.10002370
10005501 |. 8B75 08 MOV ESI,[ARG.1]
10005504 |. 833D 64B30010 03 CMP DWORD PTR DS:[1000B364],3
1000550B |. 75 2E JNZ SHORT jagmisc.1000553B
1000550D |. 3B35 24B10010 CMP ESI,DWORD PTR DS:[1000B124]
10005513 |. 77 26 JA SHORT jagmisc.1000553B
10005515 |. 6A 04 PUSH 4 ; /Arg1 = 00000004
10005517 |. E8 18E9FFFF CALL jagmisc.10003E34 ; \jagmisc.10003E34
1000551C |. 59 POP ECX ; kernel32.7C816FD7
1000551D |. 8365 FC 00 AND [LOCAL.1],0
10005521 |. 56 PUSH ESI
10005522 |. E8 05F9FFFF CALL jagmisc.10004E2C
10005527 |. 59 POP ECX ; kernel32.7C816FD7
10005528 |. 8945 E4 MOV [LOCAL.7],EAX
1000552B |. 834D FC FF OR [LOCAL.1],FFFFFFFF
1000552F |. E8 33000000 CALL jagmisc.10005567
10005534 |. 8B45 E4 MOV EAX,[LOCAL.7]
10005537 |. 85C0 TEST EAX,EAX
10005539 |. 75 23 JNZ SHORT jagmisc.1000555E
1000553B |> 85F6 TEST ESI,ESI
1000553D |. 75 01 JNZ SHORT jagmisc.10005540
1000553F |. 46 INC ESI
10005540 |> 833D 64B30010 01 CMP DWORD PTR DS:[1000B364],1
10005547 |. 74 06 JE SHORT jagmisc.1000554F
10005549 |. 83C6 0F ADD ESI,0F
1000554C |. 83E6 F0 AND ESI,FFFFFFF0
1000554F |> 56 PUSH ESI ; /HeapSize = 0
10005550 |. 6A 00 PUSH 0 ; |Flags = 0
10005552 |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000
10005558 |. FF15 80800010 CALL DWORD PTR DS:[<&KERNEL32.HeapAlloc>] ; \HeapAlloc
1000555E |> E8 48CEFFFF CALL jagmisc.100023AB
10005563 \. C3 RETN
10005564 8B DB 8B
10005565 75 DB 75 ; CHAR 'u'
10005566 08 DB 08
10005567 /$ 6A 04 PUSH 4
10005569 |. E8 11E8FFFF CALL jagmisc.10003D7F
1000556E |. 59 POP ECX ; kernel32.7C816FD7
1000556F \. C3 RETN
10005570 /$ 837C24 04 E0 CMP DWORD PTR SS:[ESP+4],-20
10005575 |. 77 22 JA SHORT jagmisc.10005599
10005577 |> FF7424 04 /PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738
1000557B |. E8 75FFFFFF |CALL jagmisc.100054F5
10005580 |. 85C0 |TEST EAX,EAX
10005582 |. 59 |POP ECX ; kernel32.7C816FD7
10005583 |. 75 16 |JNZ SHORT jagmisc.1000559B
10005585 |. 394424 08 |CMP DWORD PTR SS:[ESP+8],EAX
10005589 |. 74 10 |JE SHORT jagmisc.1000559B
1000558B |. FF7424 04 |PUSH DWORD PTR SS:[ESP+4] ; ntdll.7C910738
1000558F |. E8 ABFEFFFF |CALL jagmisc.1000543F
10005594 |. 85C0 |TEST EAX,EAX
10005596 |. 59 |POP ECX ; kernel32.7C816FD7
10005597 |.^ 75 DE \JNZ SHORT jagmisc.10005577
10005599 |> 33C0 XOR EAX,EAX
1000559B \> C3 RETN
1000559C /$ FF35 90AF0010 PUSH DWORD PTR DS:[1000AF90]
100055A2 |. FF7424 08 PUSH DWORD PTR SS:[ESP+8]
100055A6 |. E8 C5FFFFFF CALL jagmisc.10005570
100055AB |. 59 POP ECX ; kernel32.7C816FD7
100055AC |. 59 POP ECX ; kernel32.7C816FD7
100055AD \. C3 RETN
100055AE CC INT3
100055AF CC INT3
100055B0 $ 55 PUSH EBP
100055B1 . 8BEC MOV EBP,ESP
100055B3 . 57 PUSH EDI
100055B4 . 56 PUSH ESI
100055B5 . 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C]
100055B8 . 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]
100055BB . 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
100055BE . 8BC1 MOV EAX,ECX
100055C0 . 8BD1 MOV EDX,ECX
100055C2 . 03C6 ADD EAX,ESI
100055C4 . 3BFE CMP EDI,ESI
100055C6 . 76 08 JBE SHORT jagmisc.100055D0
100055C8 . 3BF8 CMP EDI,EAX
100055CA . 0F82 7C010000 JB jagmisc.1000574C
100055D0 > F7C7 03000000 TEST EDI,3
100055D6 . 75 14 JNZ SHORT jagmisc.100055EC
100055D8 . C1E9 02 SHR ECX,2
100055DB . 83E2 03 AND EDX,3
100055DE . 83F9 08 CMP ECX,8
100055E1 . 72 29 JB SHORT jagmisc.1000560C
100055E3 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
100055E5 . FF2495 FC560010 JMP DWORD PTR DS:[EDX*4+100056FC] ; jagmisc.1000570C
100055EC > 8BC7 MOV EAX,EDI
100055EE . BA 03000000 MOV EDX,3
100055F3 . 83E9 04 SUB ECX,4
100055F6 . 72 0C JB SHORT jagmisc.10005604
100055F8 . 83E0 03 AND EAX,3
100055FB . 03C8 ADD ECX,EAX
100055FD .- FF2485 10560010 JMP DWORD PTR DS:[EAX*4+10005610]
10005604 > FF248D 0C570010 JMP DWORD PTR DS:[ECX*4+1000570C] ; jagmisc.10005734
1000560B 90 NOP
1000560C >- FF248D 90560010 JMP DWORD PTR DS:[ECX*4+10005690]
10005613 90 DB 90
10005614 . 20560010 DD jagmisc.10005620 ; Switch table (1-based) used at 100055FD
10005618 . 4C560010 DD jagmisc.1000564C
1000561C . 70560010 DD jagmisc.10005670
10005620 > 23D1 AND EDX,ECX
10005622 . 8A06 MOV AL,BYTE PTR DS:[ESI]
10005624 . 8807 MOV BYTE PTR DS:[EDI],AL
10005626 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
10005629 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
1000562C . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
1000562F . C1E9 02 SHR ECX,2
10005632 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL
10005635 . 83C6 03 ADD ESI,3
10005638 . 83C7 03 ADD EDI,3
1000563B . 83F9 08 CMP ECX,8
1000563E .^ 72 CC JB SHORT jagmisc.1000560C
10005640 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10005642 . FF2495 FC560010 JMP DWORD PTR DS:[EDX*4+100056FC] ; jagmisc.1000570C
10005649 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
1000564C > 23D1 AND EDX,ECX
1000564E . 8A06 MOV AL,BYTE PTR DS:[ESI]
10005650 . 8807 MOV BYTE PTR DS:[EDI],AL
10005652 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
10005655 . C1E9 02 SHR ECX,2
10005658 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
1000565B . 83C6 02 ADD ESI,2
1000565E . 83C7 02 ADD EDI,2
10005661 . 83F9 08 CMP ECX,8
10005664 .^ 72 A6 JB SHORT jagmisc.1000560C
10005666 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10005668 . FF2495 FC560010 JMP DWORD PTR DS:[EDX*4+100056FC] ; jagmisc.1000570C
1000566F 90 NOP
10005670 > 23D1 AND EDX,ECX
10005672 . 8A06 MOV AL,BYTE PTR DS:[ESI]
10005674 . 8807 MOV BYTE PTR DS:[EDI],AL
10005676 . 83C6 01 ADD ESI,1
10005679 . C1E9 02 SHR ECX,2
1000567C . 83C7 01 ADD EDI,1
1000567F . 83F9 08 CMP ECX,8
10005682 .^ 72 88 JB SHORT jagmisc.1000560C
10005684 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10005686 . FF2495 FC560010 JMP DWORD PTR DS:[EDX*4+100056FC] ; jagmisc.1000570C
1000568D 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
10005690 . F3560010 DD jagmisc.100056F3 ; Switch table used at 1000560C
10005694 . E0560010 DD jagmisc.100056E0
10005698 . D8560010 DD jagmisc.100056D8
1000569C . D0560010 DD jagmisc.100056D0
100056A0 . C8560010 DD jagmisc.100056C8
100056A4 . C0560010 DD jagmisc.100056C0
100056A8 . B8560010 DD jagmisc.100056B8
100056AC . B0560010 DD jagmisc.100056B0
100056B0 > 8B448E E4 MOV EAX,DWORD PTR DS:[ESI+ECX*4-1C]
100056B4 . 89448F E4 MOV DWORD PTR DS:[EDI+ECX*4-1C],EAX
100056B8 > 8B448E E8 MOV EAX,DWORD PTR DS:[ESI+ECX*4-18]
100056BC . 89448F E8 MOV DWORD PTR DS:[EDI+ECX*4-18],EAX
100056C0 > 8B448E EC MOV EAX,DWORD PTR DS:[ESI+ECX*4-14]
100056C4 . 89448F EC MOV DWORD PTR DS:[EDI+ECX*4-14],EAX
100056C8 > 8B448E F0 MOV EAX,DWORD PTR DS:[ESI+ECX*4-10]
100056CC . 89448F F0 MOV DWORD PTR DS:[EDI+ECX*4-10],EAX
100056D0 > 8B448E F4 MOV EAX,DWORD PTR DS:[ESI+ECX*4-C]
100056D4 . 89448F F4 MOV DWORD PTR DS:[EDI+ECX*4-C],EAX
100056D8 > 8B448E F8 MOV EAX,DWORD PTR DS:[ESI+ECX*4-8]
100056DC . 89448F F8 MOV DWORD PTR DS:[EDI+ECX*4-8],EAX
100056E0 > 8B448E FC MOV EAX,DWORD PTR DS:[ESI+ECX*4-4]
100056E4 . 89448F FC MOV DWORD PTR DS:[EDI+ECX*4-4],EAX
100056E8 . 8D048D 00000000 LEA EAX,DWORD PTR DS:[ECX*4]
100056EF . 03F0 ADD ESI,EAX
100056F1 . 03F8 ADD EDI,EAX
100056F3 > FF2495 FC560010 JMP DWORD PTR DS:[EDX*4+100056FC] ; jagmisc.1000570C
100056FA 8BFF MOV EDI,EDI
100056FC . 0C570010 DD jagmisc.1000570C ; Switch table used at 10005642 and other places
10005700 . 14570010 DD jagmisc.10005714
10005704 . 20570010 DD jagmisc.10005720
10005708 . 34570010 DD jagmisc.10005734
1000570C > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
1000570F . 5E POP ESI ; kernel32.7C816FD7
10005710 . 5F POP EDI ; kernel32.7C816FD7
10005711 . C9 LEAVE
10005712 . C3 RETN
10005713 90 NOP
10005714 > 8A06 MOV AL,BYTE PTR DS:[ESI]
10005716 . 8807 MOV BYTE PTR DS:[EDI],AL
10005718 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
1000571B . 5E POP ESI ; kernel32.7C816FD7
1000571C . 5F POP EDI ; kernel32.7C816FD7
1000571D . C9 LEAVE
1000571E . C3 RETN
1000571F 90 NOP
10005720 > 8A06 MOV AL,BYTE PTR DS:[ESI]
10005722 . 8807 MOV BYTE PTR DS:[EDI],AL
10005724 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
10005727 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
1000572A . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
1000572D . 5E POP ESI ; kernel32.7C816FD7
1000572E . 5F POP EDI ; kernel32.7C816FD7
1000572F . C9 LEAVE
10005730 . C3 RETN
10005731 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
10005734 > 8A06 MOV AL,BYTE PTR DS:[ESI]
10005736 . 8807 MOV BYTE PTR DS:[EDI],AL
10005738 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
1000573B . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
1000573E . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
10005741 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL
10005744 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
10005747 . 5E POP ESI ; kernel32.7C816FD7
10005748 . 5F POP EDI ; kernel32.7C816FD7
10005749 . C9 LEAVE
1000574A . C3 RETN
1000574B 90 NOP
1000574C > 8D7431 FC LEA ESI,DWORD PTR DS:[ECX+ESI-4]
10005750 . 8D7C39 FC LEA EDI,DWORD PTR DS:[ECX+EDI-4]
10005754 . F7C7 03000000 TEST EDI,3
1000575A . 75 24 JNZ SHORT jagmisc.10005780
1000575C . C1E9 02 SHR ECX,2
1000575F . 83E2 03 AND EDX,3
10005762 . 83F9 08 CMP ECX,8
10005765 . 72 0D JB SHORT jagmisc.10005774
10005767 . FD STD
10005768 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
1000576A . FC CLD
1000576B . FF2495 98580010 JMP DWORD PTR DS:[EDX*4+10005898] ; jagmisc.100058A8
10005772 8BFF MOV EDI,EDI
10005774 > F7D9 NEG ECX
10005776 . FF248D 48580010 JMP DWORD PTR DS:[ECX*4+10005848] ; jagmisc.1000587C
1000577D 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
10005780 > 8BC7 MOV EAX,EDI
10005782 . BA 03000000 MOV EDX,3 ; Switch (cases 0..3)
10005787 . 83F9 04 CMP ECX,4
1000578A . 72 0C JB SHORT jagmisc.10005798
1000578C . 83E0 03 AND EAX,3 ; Default case of switch 10005782
1000578F . 2BC8 SUB ECX,EAX
10005791 .- FF2485 9C570010 JMP DWORD PTR DS:[EAX*4+1000579C]
10005798 >- FF248D 98580010 JMP DWORD PTR DS:[ECX*4+10005898]
1000579F 90 DB 90
100057A0 . AC570010 DD jagmisc.100057AC ; Switch table (1-based) used at 10005791
100057A4 . D0570010 DD jagmisc.100057D0
100057A8 . F8570010 DD jagmisc.100057F8
100057AC > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3]
100057AF . 23D1 AND EDX,ECX
100057B1 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL
100057B4 . 83EE 01 SUB ESI,1
100057B7 . C1E9 02 SHR ECX,2
100057BA . 83EF 01 SUB EDI,1
100057BD . 83F9 08 CMP ECX,8
100057C0 .^ 72 B2 JB SHORT jagmisc.10005774
100057C2 . FD STD
100057C3 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
100057C5 . FC CLD
100057C6 . FF2495 98580010 JMP DWORD PTR DS:[EDX*4+10005898] ; jagmisc.100058A8
100057CD 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
100057D0 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3]
100057D3 . 23D1 AND EDX,ECX
100057D5 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL
100057D8 . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
100057DB . C1E9 02 SHR ECX,2
100057DE . 8847 02 MOV BYTE PTR DS:[EDI+2],AL
100057E1 . 83EE 02 SUB ESI,2
100057E4 . 83EF 02 SUB EDI,2
100057E7 . 83F9 08 CMP ECX,8
100057EA .^ 72 88 JB SHORT jagmisc.10005774
100057EC . FD STD
100057ED . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
100057EF . FC CLD
100057F0 . FF2495 98580010 JMP DWORD PTR DS:[EDX*4+10005898] ; jagmisc.100058A8
100057F7 90 NOP
100057F8 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3]
100057FB . 23D1 AND EDX,ECX
100057FD . 8847 03 MOV BYTE PTR DS:[EDI+3],AL
10005800 . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
10005803 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL
10005806 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
10005809 . C1E9 02 SHR ECX,2
1000580C . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
1000580F . 83EE 03 SUB ESI,3
10005812 . 83EF 03 SUB EDI,3
10005815 . 83F9 08 CMP ECX,8
10005818 .^ 0F82 56FFFFFF JB jagmisc.10005774
1000581E . FD STD
1000581F . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10005821 . FC CLD
10005822 . FF2495 98580010 JMP DWORD PTR DS:[EDX*4+10005898] ; jagmisc.100058A8
10005829 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
1000582C . 4C580010 DD jagmisc.1000584C
10005830 . 54580010 DD jagmisc.10005854
10005834 . 5C580010 DD jagmisc.1000585C
10005838 . 64580010 DD jagmisc.10005864
1000583C . 6C580010 DD jagmisc.1000586C
10005840 . 74580010 DD jagmisc.10005874
10005844 . 7C580010 DD jagmisc.1000587C
10005848 . 8F580010 DD jagmisc.1000588F
1000584C > 8B448E 1C MOV EAX,DWORD PTR DS:[ESI+ECX*4+1C]
10005850 . 89448F 1C MOV DWORD PTR DS:[EDI+ECX*4+1C],EAX
10005854 > 8B448E 18 MOV EAX,DWORD PTR DS:[ESI+ECX*4+18]
10005858 . 89448F 18 MOV DWORD PTR DS:[EDI+ECX*4+18],EAX
1000585C > 8B448E 14 MOV EAX,DWORD PTR DS:[ESI+ECX*4+14]
10005860 . 89448F 14 MOV DWORD PTR DS:[EDI+ECX*4+14],EAX
10005864 > 8B448E 10 MOV EAX,DWORD PTR DS:[ESI+ECX*4+10]
10005868 . 89448F 10 MOV DWORD PTR DS:[EDI+ECX*4+10],EAX
1000586C > 8B448E 0C MOV EAX,DWORD PTR DS:[ESI+ECX*4+C]
10005870 . 89448F 0C MOV DWORD PTR DS:[EDI+ECX*4+C],EAX
10005874 > 8B448E 08 MOV EAX,DWORD PTR DS:[ESI+ECX*4+8]
10005878 . 89448F 08 MOV DWORD PTR DS:[EDI+ECX*4+8],EAX
1000587C > 8B448E 04 MOV EAX,DWORD PTR DS:[ESI+ECX*4+4]
10005880 . 89448F 04 MOV DWORD PTR DS:[EDI+ECX*4+4],EAX
10005884 . 8D048D 00000000 LEA EAX,DWORD PTR DS:[ECX*4]
1000588B . 03F0 ADD ESI,EAX
1000588D . 03F8 ADD EDI,EAX
1000588F > FF2495 98580010 JMP DWORD PTR DS:[EDX*4+10005898] ; jagmisc.100058A8
10005896 8BFF MOV EDI,EDI
10005898 . A8580010 DD jagmisc.100058A8 ; Switch table used at 10005798 and other places
1000589C . B0580010 DD jagmisc.100058B0
100058A0 . C0580010 DD jagmisc.100058C0
100058A4 . D4580010 DD jagmisc.100058D4
100058A8 > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] ; Case 0 of switch 10005782
100058AB . 5E POP ESI ; kernel32.7C816FD7
100058AC . 5F POP EDI ; kernel32.7C816FD7
100058AD . C9 LEAVE
100058AE . C3 RETN
100058AF 90 NOP
100058B0 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] ; Case 1 of switch 10005782
100058B3 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL
100058B6 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
100058B9 . 5E POP ESI ; kernel32.7C816FD7
100058BA . 5F POP EDI ; kernel32.7C816FD7
100058BB . C9 LEAVE
100058BC . C3 RETN
100058BD 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
100058C0 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] ; Case 2 of switch 10005782
100058C3 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL
100058C6 . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
100058C9 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL
100058CC . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
100058CF . 5E POP ESI ; kernel32.7C816FD7
100058D0 . 5F POP EDI ; kernel32.7C816FD7
100058D1 . C9 LEAVE
100058D2 . C3 RETN
100058D3 90 NOP
100058D4 > 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] ; Case 3 of switch 10005782
100058D7 . 8847 03 MOV BYTE PTR DS:[EDI+3],AL
100058DA . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
100058DD . 8847 02 MOV BYTE PTR DS:[EDI+2],AL
100058E0 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
100058E3 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
100058E6 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
100058E9 . 5E POP ESI ; kernel32.7C816FD7
100058EA . 5F POP EDI ; kernel32.7C816FD7
100058EB . C9 LEAVE
100058EC . C3 RETN
100058ED /$ 55 PUSH EBP
100058EE |. 8BEC MOV EBP,ESP
100058F0 |. 83EC 10 SUB ESP,10
100058F3 |. 53 PUSH EBX
100058F4 |. 33DB XOR EBX,EBX
100058F6 |. 391D 98AF0010 CMP DWORD PTR DS:[1000AF98],EBX
100058FC |. 56 PUSH ESI
100058FD |. 57 PUSH EDI
100058FE |. 75 6D JNZ SHORT jagmisc.1000596D
10005900 |. 68 F8880010 PUSH jagmisc.100088F8 ; /FileName = "user32.dll"
10005905 |. FF15 DC800010 CALL DWORD PTR DS:[<&KERNEL32.LoadLibraryA>] ; \LoadLibraryA
1000590B |. 8BF8 MOV EDI,EAX
1000590D |. 3BFB CMP EDI,EBX
1000590F |. 0F84 93000000 JE jagmisc.100059A8
10005915 |. 8B35 50800010 MOV ESI,DWORD PTR DS:[<&KERNEL32.GetProcAddress>] ; kernel32.GetProcAddress
1000591B |. 68 EC880010 PUSH jagmisc.100088EC ; /ProcNameOrOrdinal = "MessageBoxA"
10005920 |. 57 PUSH EDI ; |hModule = NULL
10005921 |. FFD6 CALL ESI ; \GetProcAddress
10005923 |. 85C0 TEST EAX,EAX
10005925 |. A3 98AF0010 MOV DWORD PTR DS:[1000AF98],EAX
1000592A |. 74 7C JE SHORT jagmisc.100059A8
1000592C |. 68 DC880010 PUSH jagmisc.100088DC ; /ProcNameOrOrdinal = "GetActiveWindow"
10005931 |. 57 PUSH EDI ; |hModule = NULL
10005932 |. FFD6 CALL ESI ; \GetProcAddress
10005934 |. 68 C8880010 PUSH jagmisc.100088C8 ; /ProcNameOrOrdinal = "GetLastActivePopup"
10005939 |. 57 PUSH EDI ; |hModule = NULL
1000593A |. A3 9CAF0010 MOV DWORD PTR DS:[1000AF9C],EAX ; |
1000593F |. FFD6 CALL ESI ; \GetProcAddress
10005941 |. 833D 8CAC0010 02 CMP DWORD PTR DS:[1000AC8C],2
10005948 |. A3 A0AF0010 MOV DWORD PTR DS:[1000AFA0],EAX
1000594D |. 75 1E JNZ SHORT jagmisc.1000596D
1000594F |. 68 AC880010 PUSH jagmisc.100088AC ; /ProcNameOrOrdinal = "GetUserObjectInformationA"
10005954 |. 57 PUSH EDI ; |hModule = NULL
10005955 |. FFD6 CALL ESI ; \GetProcAddress
10005957 |. 85C0 TEST EAX,EAX
10005959 |. A3 A8AF0010 MOV DWORD PTR DS:[1000AFA8],EAX
1000595E |. 74 0D JE SHORT jagmisc.1000596D
10005960 |. 68 94880010 PUSH jagmisc.10008894 ; /ProcNameOrOrdinal = "GetProcessWindowStation"
10005965 |. 57 PUSH EDI ; |hModule = NULL
10005966 |. FFD6 CALL ESI ; \GetProcAddress
10005968 |. A3 A4AF0010 MOV DWORD PTR DS:[1000AFA4],EAX
1000596D |> A1 A4AF0010 MOV EAX,DWORD PTR DS:[1000AFA4]
10005972 |. 85C0 TEST EAX,EAX
10005974 |. 74 3C JE SHORT jagmisc.100059B2
10005976 |. FFD0 CALL EAX
10005978 |. 85C0 TEST EAX,EAX
1000597A |. 74 1D JE SHORT jagmisc.10005999
1000597C |. 8D4D FC LEA ECX,[LOCAL.1]
1000597F |. 51 PUSH ECX
10005980 |. 6A 0C PUSH 0C
10005982 |. 8D4D F0 LEA ECX,[LOCAL.4]
10005985 |. 51 PUSH ECX
10005986 |. 6A 01 PUSH 1
10005988 |. 50 PUSH EAX
10005989 |. FF15 A8AF0010 CALL DWORD PTR DS:[1000AFA8]
1000598F |. 85C0 TEST EAX,EAX
10005991 |. 74 06 JE SHORT jagmisc.10005999
10005993 |. F645 F8 01 TEST BYTE PTR SS:[EBP-8],1
10005997 |. 75 19 JNZ SHORT jagmisc.100059B2
10005999 |> 833D 98AC0010 04 CMP DWORD PTR DS:[1000AC98],4
100059A0 |. 72 0A JB SHORT jagmisc.100059AC
100059A2 |. 804D 12 20 OR BYTE PTR SS:[EBP+12],20
100059A6 |. EB 29 JMP SHORT jagmisc.100059D1
100059A8 |> 33C0 XOR EAX,EAX
100059AA |. EB 35 JMP SHORT jagmisc.100059E1
100059AC |> 804D 12 04 OR BYTE PTR SS:[EBP+12],4
100059B0 |. EB 1F JMP SHORT jagmisc.100059D1
100059B2 |> A1 9CAF0010 MOV EAX,DWORD PTR DS:[1000AF9C]
100059B7 |. 85C0 TEST EAX,EAX
100059B9 |. 74 16 JE SHORT jagmisc.100059D1
100059BB |. FFD0 CALL EAX
100059BD |. 8BD8 MOV EBX,EAX
100059BF |. 85DB TEST EBX,EBX
100059C1 |. 74 0E JE SHORT jagmisc.100059D1
100059C3 |. A1 A0AF0010 MOV EAX,DWORD PTR DS:[1000AFA0]
100059C8 |. 85C0 TEST EAX,EAX
100059CA |. 74 05 JE SHORT jagmisc.100059D1
100059CC |. 53 PUSH EBX
100059CD |. FFD0 CALL EAX
100059CF |. 8BD8 MOV EBX,EAX
100059D1 |> FF75 10 PUSH [ARG.3]
100059D4 |. FF75 0C PUSH [ARG.2]
100059D7 |. FF75 08 PUSH [ARG.1]
100059DA |. 53 PUSH EBX
100059DB |. FF15 98AF0010 CALL DWORD PTR DS:[1000AF98]
100059E1 |> 5F POP EDI ; kernel32.7C816FD7
100059E2 |. 5E POP ESI ; kernel32.7C816FD7
100059E3 |. 5B POP EBX ; kernel32.7C816FD7
100059E4 |. C9 LEAVE
100059E5 \. C3 RETN
100059E6 CC INT3
100059E7 CC INT3
100059E8 CC INT3
100059E9 CC INT3
100059EA CC INT3
100059EB CC INT3
100059EC CC INT3
100059ED CC INT3
100059EE CC INT3
100059EF CC INT3
100059F0 /$ 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]
100059F4 |. 57 PUSH EDI
100059F5 |. 85C9 TEST ECX,ECX
100059F7 |. 0F84 92000000 JE jagmisc.10005A8F
100059FD |. 56 PUSH ESI
100059FE |. 53 PUSH EBX
100059FF |. 8BD9 MOV EBX,ECX
10005A01 |. 8B7424 14 MOV ESI,DWORD PTR SS:[ESP+14]
10005A05 |. F7C6 03000000 TEST ESI,3
10005A0B |. 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10]
10005A0F |. 75 0B JNZ SHORT jagmisc.10005A1C
10005A11 |. C1E9 02 SHR ECX,2
10005A14 |. 0F85 85000000 JNZ jagmisc.10005A9F
10005A1A |. EB 27 JMP SHORT jagmisc.10005A43
10005A1C |> 8A06 /MOV AL,BYTE PTR DS:[ESI]
10005A1E |. 83C6 01 |ADD ESI,1
10005A21 |. 8807 |MOV BYTE PTR DS:[EDI],AL
10005A23 |. 83C7 01 |ADD EDI,1
10005A26 |. 83E9 01 |SUB ECX,1
10005A29 |. 74 2B |JE SHORT jagmisc.10005A56
10005A2B |. 84C0 |TEST AL,AL
10005A2D |. 74 2F |JE SHORT jagmisc.10005A5E
10005A2F |. F7C6 03000000 |TEST ESI,3
10005A35 |.^ 75 E5 \JNZ SHORT jagmisc.10005A1C
10005A37 |. 8BD9 MOV EBX,ECX
10005A39 |. C1E9 02 SHR ECX,2
10005A3C |. 75 61 JNZ SHORT jagmisc.10005A9F
10005A3E |> 83E3 03 AND EBX,3
10005A41 |. 74 13 JE SHORT jagmisc.10005A56
10005A43 |> 8A06 /MOV AL,BYTE PTR DS:[ESI]
10005A45 |. 83C6 01 |ADD ESI,1
10005A48 |. 8807 |MOV BYTE PTR DS:[EDI],AL
10005A4A |. 83C7 01 |ADD EDI,1
10005A4D |. 84C0 |TEST AL,AL
10005A4F |. 74 37 |JE SHORT jagmisc.10005A88
10005A51 |. 83EB 01 |SUB EBX,1
10005A54 |.^ 75 ED \JNZ SHORT jagmisc.10005A43
10005A56 |> 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10]
10005A5A |. 5B POP EBX ; kernel32.7C816FD7
10005A5B |. 5E POP ESI ; kernel32.7C816FD7
10005A5C |. 5F POP EDI ; kernel32.7C816FD7
10005A5D |. C3 RETN
10005A5E |> F7C7 03000000 TEST EDI,3
10005A64 |. 74 16 JE SHORT jagmisc.10005A7C
10005A66 |> 8807 /MOV BYTE PTR DS:[EDI],AL
10005A68 |. 83C7 01 |ADD EDI,1
10005A6B |. 83E9 01 |SUB ECX,1
10005A6E |. 0F84 98000000 |JE jagmisc.10005B0C
10005A74 |. F7C7 03000000 |TEST EDI,3
10005A7A |.^ 75 EA \JNZ SHORT jagmisc.10005A66
10005A7C |> 8BD9 MOV EBX,ECX
10005A7E |. C1E9 02 SHR ECX,2
10005A81 |. 75 74 JNZ SHORT jagmisc.10005AF7
10005A83 |> 8807 MOV BYTE PTR DS:[EDI],AL
10005A85 |. 83C7 01 ADD EDI,1
10005A88 |> 83EB 01 SUB EBX,1
10005A8B |.^ 75 F6 JNZ SHORT jagmisc.10005A83
10005A8D |. 5B POP EBX ; kernel32.7C816FD7
10005A8E |. 5E POP ESI ; kernel32.7C816FD7
10005A8F |> 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
10005A93 |. 5F POP EDI ; kernel32.7C816FD7
10005A94 |. C3 RETN
10005A95 |> 8917 /MOV DWORD PTR DS:[EDI],EDX
10005A97 |. 83C7 04 |ADD EDI,4
10005A9A |. 83E9 01 |SUB ECX,1
10005A9D |.^ 74 9F |JE SHORT jagmisc.10005A3E
10005A9F |> BA FFFEFE7E MOV EDX,7EFEFEFF
10005AA4 |. 8B06 |MOV EAX,DWORD PTR DS:[ESI]
10005AA6 |. 03D0 |ADD EDX,EAX
10005AA8 |. 83F0 FF |XOR EAX,FFFFFFFF
10005AAB |. 33C2 |XOR EAX,EDX
10005AAD |. 8B16 |MOV EDX,DWORD PTR DS:[ESI]
10005AAF |. 83C6 04 |ADD ESI,4
10005AB2 |. A9 00010181 |TEST EAX,81010100
10005AB7 |.^ 74 DC |JE SHORT jagmisc.10005A95
10005AB9 |. 84D2 |TEST DL,DL
10005ABB |. 74 2C |JE SHORT jagmisc.10005AE9
10005ABD |. 84F6 |TEST DH,DH
10005ABF |. 74 1E |JE SHORT jagmisc.10005ADF
10005AC1 |. F7C2 0000FF00 |TEST EDX,0FF0000
10005AC7 |. 74 0C |JE SHORT jagmisc.10005AD5
10005AC9 |. F7C2 000000FF |TEST EDX,FF000000
10005ACF |.^ 75 C4 \JNZ SHORT jagmisc.10005A95
10005AD1 |. 8917 MOV DWORD PTR DS:[EDI],EDX
10005AD3 |. EB 18 JMP SHORT jagmisc.10005AED
10005AD5 |> 81E2 FFFF0000 AND EDX,0FFFF
10005ADB |. 8917 MOV DWORD PTR DS:[EDI],EDX
10005ADD |. EB 0E JMP SHORT jagmisc.10005AED
10005ADF |> 81E2 FF000000 AND EDX,0FF
10005AE5 |. 8917 MOV DWORD PTR DS:[EDI],EDX
10005AE7 |. EB 04 JMP SHORT jagmisc.10005AED
10005AE9 |> 33D2 XOR EDX,EDX
10005AEB |. 8917 MOV DWORD PTR DS:[EDI],EDX
10005AED |> 83C7 04 ADD EDI,4
10005AF0 |. 33C0 XOR EAX,EAX
10005AF2 |. 83E9 01 SUB ECX,1
10005AF5 |. 74 0C JE SHORT jagmisc.10005B03
10005AF7 |> 33C0 XOR EAX,EAX
10005AF9 |> 8907 /MOV DWORD PTR DS:[EDI],EAX
10005AFB |. 83C7 04 |ADD EDI,4
10005AFE |. 83E9 01 |SUB ECX,1
10005B01 |.^ 75 F6 \JNZ SHORT jagmisc.10005AF9
10005B03 |> 83E3 03 AND EBX,3
10005B06 |.^ 0F85 77FFFFFF JNZ jagmisc.10005A83
10005B0C |> 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10]
10005B10 |. 5B POP EBX ; kernel32.7C816FD7
10005B11 |. 5E POP ESI ; kernel32.7C816FD7
10005B12 |. 5F POP EDI ; kernel32.7C816FD7
10005B13 \. C3 RETN
10005B14 /$ 55 PUSH EBP
10005B15 |. 8BEC MOV EBP,ESP
10005B17 |. 51 PUSH ECX
10005B18 |. 8B45 0C MOV EAX,[ARG.2]
10005B1B |. 8D48 01 LEA ECX,DWORD PTR DS:[EAX+1]
10005B1E |. 81F9 00010000 CMP ECX,100
10005B24 |. 8B4D 08 MOV ECX,[ARG.1]
10005B27 |. 77 09 JA SHORT jagmisc.10005B32
10005B29 |. 8B49 48 MOV ECX,DWORD PTR DS:[ECX+48]
10005B2C |. 0FB70441 MOVZX EAX,WORD PTR DS:[ECX+EAX*2]
10005B30 |. EB 54 JMP SHORT jagmisc.10005B86
10005B32 |> 56 PUSH ESI
10005B33 |. 8BD0 MOV EDX,EAX
10005B35 |. C1FA 08 SAR EDX,8
10005B38 |. 57 PUSH EDI
10005B39 |. 8B79 48 MOV EDI,DWORD PTR DS:[ECX+48]
10005B3C |. 0FB6F2 MOVZX ESI,DL
10005B3F |. F64477 01 80 TEST BYTE PTR DS:[EDI+ESI*2+1],80
10005B44 |. 5F POP EDI ; kernel32.7C816FD7
10005B45 |. 5E POP ESI ; kernel32.7C816FD7
10005B46 |. 74 0F JE SHORT jagmisc.10005B57
10005B48 |. 6A 02 PUSH 2
10005B4A |. 8845 FD MOV BYTE PTR SS:[EBP-3],AL
10005B4D |. 8855 FC MOV BYTE PTR SS:[EBP-4],DL
10005B50 |. C645 FE 00 MOV BYTE PTR SS:[EBP-2],0
10005B54 |. 58 POP EAX ; kernel32.7C816FD7
10005B55 |. EB 0A JMP SHORT jagmisc.10005B61
10005B57 |> 8845 FC MOV BYTE PTR SS:[EBP-4],AL
10005B5A |. 33C0 XOR EAX,EAX
10005B5C |. C645 FD 00 MOV BYTE PTR SS:[EBP-3],0
10005B60 |. 40 INC EAX
10005B61 |> 6A 01 PUSH 1
10005B63 |. FF71 14 PUSH DWORD PTR DS:[ECX+14]
10005B66 |. FF71 04 PUSH DWORD PTR DS:[ECX+4]
10005B69 |. 8D4D 0E LEA ECX,DWORD PTR SS:[EBP+E]
10005B6C |. 51 PUSH ECX
10005B6D |. 50 PUSH EAX
10005B6E |. 8D45 FC LEA EAX,[LOCAL.1]
10005B71 |. 50 PUSH EAX
10005B72 |. 6A 01 PUSH 1
10005B74 |. E8 5F120000 CALL jagmisc.10006DD8
10005B79 |. 83C4 1C ADD ESP,1C
10005B7C |. 85C0 TEST EAX,EAX
10005B7E |. 75 02 JNZ SHORT jagmisc.10005B82
10005B80 |. C9 LEAVE
10005B81 |. C3 RETN
10005B82 |> 0FB745 0E MOVZX EAX,WORD PTR SS:[EBP+E]
10005B86 |> 2345 10 AND EAX,[ARG.3]
10005B89 |. C9 LEAVE
10005B8A \. C3 RETN
10005B8B $ 6A 38 PUSH 38
10005B8D . 68 08890010 PUSH jagmisc.10008908
10005B92 . E8 D9C7FFFF CALL jagmisc.10002370
10005B97 . 33DB XOR EBX,EBX
10005B99 . 391D ACAF0010 CMP DWORD PTR DS:[1000AFAC],EBX
10005B9F . 75 38 JNZ SHORT jagmisc.10005BD9
10005BA1 . 53 PUSH EBX ; /DestSize = 0
10005BA2 . 53 PUSH EBX ; |DestString = NULL
10005BA3 . 33F6 XOR ESI,ESI ; |
10005BA5 . 46 INC ESI ; |
10005BA6 . 56 PUSH ESI ; |SrcSize = 0
10005BA7 . 68 04890010 PUSH jagmisc.10008904 ; |SrcString = ""
10005BAC . 68 00010000 PUSH 100 ; |MapFlags = LCMAP_LOWERCASE
10005BB1 . 53 PUSH EBX ; |LocaleId = 0
10005BB2 . FF15 E8800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringW>] ; \LCMapStringW
10005BB8 . 85C0 TEST EAX,EAX
10005BBA . 74 08 JE SHORT jagmisc.10005BC4
10005BBC . 8935 ACAF0010 MOV DWORD PTR DS:[1000AFAC],ESI
10005BC2 . EB 15 JMP SHORT jagmisc.10005BD9
10005BC4 > FF15 38800010 CALL DWORD PTR DS:[<&KERNEL32.GetLastError>] ; [GetLastError
10005BCA . 83F8 78 CMP EAX,78
10005BCD . 75 0A JNZ SHORT jagmisc.10005BD9
10005BCF . C705 ACAF0010 020>MOV DWORD PTR DS:[1000AFAC],2
10005BD9 > 395D 14 CMP DWORD PTR SS:[EBP+14],EBX
10005BDC . 7E 1B JLE SHORT jagmisc.10005BF9
10005BDE . 8B4D 14 MOV ECX,DWORD PTR SS:[EBP+14]
10005BE1 . 8B45 10 MOV EAX,DWORD PTR SS:[EBP+10]
10005BE4 > 49 DEC ECX
10005BE5 . 3818 CMP BYTE PTR DS:[EAX],BL
10005BE7 . 74 08 JE SHORT jagmisc.10005BF1
10005BE9 . 40 INC EAX
10005BEA . 3BCB CMP ECX,EBX
10005BEC .^ 75 F6 JNZ SHORT jagmisc.10005BE4
10005BEE . 83C9 FF OR ECX,FFFFFFFF
10005BF1 > 83C8 FF OR EAX,FFFFFFFF
10005BF4 . 2BC1 SUB EAX,ECX
10005BF6 . 0145 14 ADD DWORD PTR SS:[EBP+14],EAX
10005BF9 > A1 ACAF0010 MOV EAX,DWORD PTR DS:[1000AFAC]
10005BFE . 83F8 02 CMP EAX,2
10005C01 . 0F84 DC010000 JE jagmisc.10005DE3
10005C07 . 3BC3 CMP EAX,EBX
10005C09 . 0F84 D4010000 JE jagmisc.10005DE3
10005C0F . 83F8 01 CMP EAX,1
10005C12 . 0F85 FE010000 JNZ jagmisc.10005E16
10005C18 . 33FF XOR EDI,EDI
10005C1A . 897D D4 MOV DWORD PTR SS:[EBP-2C],EDI
10005C1D . 895D C8 MOV DWORD PTR SS:[EBP-38],EBX
10005C20 . 895D CC MOV DWORD PTR SS:[EBP-34],EBX
10005C23 . 395D 20 CMP DWORD PTR SS:[EBP+20],EBX
10005C26 . 75 08 JNZ SHORT jagmisc.10005C30
10005C28 . A1 10B00010 MOV EAX,DWORD PTR DS:[1000B010]
10005C2D . 8945 20 MOV DWORD PTR SS:[EBP+20],EAX
10005C30 > 53 PUSH EBX ; /WideBufSize = 0
10005C31 . 53 PUSH EBX ; |WideCharBuf = NULL
10005C32 . FF75 14 PUSH DWORD PTR SS:[EBP+14] ; |StringSize = 6FFC8 (458696.)
10005C35 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |StringToMap = 8054A6ED ???
10005C38 . 33C0 XOR EAX,EAX ; |
10005C3A . 395D 24 CMP DWORD PTR SS:[EBP+24],EBX ; |
10005C3D . 0F95C0 SETNE AL ; |
10005C40 . 8D04C5 01000000 LEA EAX,DWORD PTR DS:[EAX*8+1] ; |
10005C47 . 50 PUSH EAX ; |Options = MB_ERR_INVALID_CHARS
10005C48 . FF75 20 PUSH DWORD PTR SS:[EBP+20] ; |CodePage = 7C839AA8
10005C4B . FF15 E4800010 CALL DWORD PTR DS:[<&KERNEL32.MultiByteToWideChar>] ; \MultiByteToWideChar
10005C51 . 8BF0 MOV ESI,EAX
10005C53 . 8975 D0 MOV DWORD PTR SS:[EBP-30],ESI
10005C56 . 3BF3 CMP ESI,EBX
10005C58 . 0F84 B8010000 JE jagmisc.10005E16
10005C5E . C745 FC 01000000 MOV DWORD PTR SS:[EBP-4],1
10005C65 . 8D0436 LEA EAX,DWORD PTR DS:[ESI+ESI]
10005C68 . 83C0 03 ADD EAX,3
10005C6B . 83E0 FC AND EAX,FFFFFFFC
10005C6E . E8 3DD1FFFF CALL jagmisc.10002DB0
10005C73 . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
10005C76 . 8BC4 MOV EAX,ESP
10005C78 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
10005C7B . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10005C7F . EB 1B JMP SHORT jagmisc.10005C9C
10005C81 . 33C0 XOR EAX,EAX
10005C83 . 40 INC EAX
10005C84 . C3 RETN
10005C85 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451
10005C88 . E8 C2170000 CALL jagmisc.1000744F
10005C8D . 33DB XOR EBX,EBX
10005C8F . 895D E4 MOV DWORD PTR SS:[EBP-1C],EBX
10005C92 . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10005C96 . 8B7D D4 MOV EDI,DWORD PTR SS:[EBP-2C]
10005C99 . 8B75 D0 MOV ESI,DWORD PTR SS:[EBP-30] ; ntdll.7C90EA53
10005C9C > 395D E4 CMP DWORD PTR SS:[EBP-1C],EBX
10005C9F . 75 1C JNZ SHORT jagmisc.10005CBD
10005CA1 . 8D0436 LEA EAX,DWORD PTR DS:[ESI+ESI]
10005CA4 . 50 PUSH EAX
10005CA5 . E8 F2F8FFFF CALL jagmisc.1000559C
10005CAA . 59 POP ECX ; kernel32.7C816FD7
10005CAB . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
10005CAE . 3BC3 CMP EAX,EBX
10005CB0 . 0F84 60010000 JE jagmisc.10005E16
10005CB6 . C745 C8 01000000 MOV DWORD PTR SS:[EBP-38],1
10005CBD > 56 PUSH ESI ; /WideBufSize = 0
10005CBE . FF75 E4 PUSH DWORD PTR SS:[EBP-1C] ; |WideCharBuf = 0006FFB8
10005CC1 . FF75 14 PUSH DWORD PTR SS:[EBP+14] ; |StringSize = 6FFC8 (458696.)
10005CC4 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |StringToMap = 8054A6ED ???
10005CC7 . 6A 01 PUSH 1 ; |Options = MB_PRECOMPOSED
10005CC9 . FF75 20 PUSH DWORD PTR SS:[EBP+20] ; |CodePage = 7C839AA8
10005CCC . FF15 E4800010 CALL DWORD PTR DS:[<&KERNEL32.MultiByteToWideChar>] ; \MultiByteToWideChar
10005CD2 . 85C0 TEST EAX,EAX
10005CD4 . 0F84 E6000000 JE jagmisc.10005DC0
10005CDA . 53 PUSH EBX ; /DestSize = 0
10005CDB . 53 PUSH EBX ; |DestString = NULL
10005CDC . 56 PUSH ESI ; |SrcSize = 0
10005CDD . FF75 E4 PUSH DWORD PTR SS:[EBP-1C] ; |SrcString = "?\x06?A"
10005CE0 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |MapFlags = NORM_IGNOREKANATYPE|LCMAP_HIRAGANA|LCMAP_KATAKANA|LCMAP_HALFWIDTH|LCMAP_FULLWIDTH|SORT_STRINGSORT|7F0C8000
10005CE3 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |LocaleId = FFFFFFFF
10005CE6 . FF15 E8800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringW>] ; \LCMapStringW
10005CEC . 8BF8 MOV EDI,EAX
10005CEE . 897D D4 MOV DWORD PTR SS:[EBP-2C],EDI
10005CF1 . 3BFB CMP EDI,EBX
10005CF3 . 0F84 C7000000 JE jagmisc.10005DC0
10005CF9 . F645 0D 04 TEST BYTE PTR SS:[EBP+D],4
10005CFD . 74 2D JE SHORT jagmisc.10005D2C
10005CFF . 395D 1C CMP DWORD PTR SS:[EBP+1C],EBX
10005D02 . 0F84 B8000000 JE jagmisc.10005DC0
10005D08 . 3B7D 1C CMP EDI,DWORD PTR SS:[EBP+1C]
10005D0B . 0F8F AF000000 JG jagmisc.10005DC0
10005D11 . FF75 1C PUSH DWORD PTR SS:[EBP+1C] ; /DestSize = FFFFFFFF (-1.)
10005D14 . FF75 18 PUSH DWORD PTR SS:[EBP+18] ; |DestString = 8227C238
10005D17 . 56 PUSH ESI ; |SrcSize = 0
10005D18 . FF75 E4 PUSH DWORD PTR SS:[EBP-1C] ; |SrcString = "?\x06?A"
10005D1B . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |MapFlags = NORM_IGNOREKANATYPE|LCMAP_HIRAGANA|LCMAP_KATAKANA|LCMAP_HALFWIDTH|LCMAP_FULLWIDTH|SORT_STRINGSORT|7F0C8000
10005D1E . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |LocaleId = FFFFFFFF
10005D21 . FF15 E8800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringW>] ; \LCMapStringW
10005D27 . E9 94000000 JMP jagmisc.10005DC0
10005D2C > C745 FC 02000000 MOV DWORD PTR SS:[EBP-4],2
10005D33 . 8D043F LEA EAX,DWORD PTR DS:[EDI+EDI]
10005D36 . 83C0 03 ADD EAX,3
10005D39 . 83E0 FC AND EAX,FFFFFFFC
10005D3C . E8 6FD0FFFF CALL jagmisc.10002DB0
10005D41 . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
10005D44 . 8BC4 MOV EAX,ESP
10005D46 . 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX
10005D49 . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10005D4D . EB 1B JMP SHORT jagmisc.10005D6A
10005D4F . 33C0 XOR EAX,EAX
10005D51 . 40 INC EAX
10005D52 . C3 RETN
10005D53 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451
10005D56 . E8 F4160000 CALL jagmisc.1000744F
10005D5B . 33DB XOR EBX,EBX
10005D5D . 895D E0 MOV DWORD PTR SS:[EBP-20],EBX
10005D60 . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10005D64 . 8B7D D4 MOV EDI,DWORD PTR SS:[EBP-2C]
10005D67 . 8B75 D0 MOV ESI,DWORD PTR SS:[EBP-30] ; ntdll.7C90EA53
10005D6A > 395D E0 CMP DWORD PTR SS:[EBP-20],EBX
10005D6D . 75 18 JNZ SHORT jagmisc.10005D87
10005D6F . 8D043F LEA EAX,DWORD PTR DS:[EDI+EDI]
10005D72 . 50 PUSH EAX
10005D73 . E8 24F8FFFF CALL jagmisc.1000559C
10005D78 . 59 POP ECX ; kernel32.7C816FD7
10005D79 . 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX
10005D7C . 3BC3 CMP EAX,EBX
10005D7E . 74 40 JE SHORT jagmisc.10005DC0
10005D80 . C745 CC 01000000 MOV DWORD PTR SS:[EBP-34],1
10005D87 > 57 PUSH EDI ; /DestSize = 0
10005D88 . FF75 E0 PUSH DWORD PTR SS:[EBP-20] ; |DestString = NULL
10005D8B . 56 PUSH ESI ; |SrcSize = 0
10005D8C . FF75 E4 PUSH DWORD PTR SS:[EBP-1C] ; |SrcString = "?\x06?A"
10005D8F . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |MapFlags = NORM_IGNOREKANATYPE|LCMAP_HIRAGANA|LCMAP_KATAKANA|LCMAP_HALFWIDTH|LCMAP_FULLWIDTH|SORT_STRINGSORT|7F0C8000
10005D92 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |LocaleId = FFFFFFFF
10005D95 . FF15 E8800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringW>] ; \LCMapStringW
10005D9B . 85C0 TEST EAX,EAX
10005D9D . 74 21 JE SHORT jagmisc.10005DC0
10005D9F . 53 PUSH EBX
10005DA0 . 53 PUSH EBX
10005DA1 . 395D 1C CMP DWORD PTR SS:[EBP+1C],EBX
10005DA4 . 75 04 JNZ SHORT jagmisc.10005DAA
10005DA6 . 53 PUSH EBX
10005DA7 . 53 PUSH EBX
10005DA8 . EB 06 JMP SHORT jagmisc.10005DB0
10005DAA > FF75 1C PUSH DWORD PTR SS:[EBP+1C]
10005DAD . FF75 18 PUSH DWORD PTR SS:[EBP+18]
10005DB0 > 57 PUSH EDI ; |WideCharCount = 0
10005DB1 . FF75 E0 PUSH DWORD PTR SS:[EBP-20] ; |WideCharStr = NULL
10005DB4 . 53 PUSH EBX ; |Options = 0
10005DB5 . FF75 20 PUSH DWORD PTR SS:[EBP+20] ; |CodePage = 7C839AA8
10005DB8 . FF15 A4800010 CALL DWORD PTR DS:[<&KERNEL32.WideCharToMultiByte>] ; \WideCharToMultiByte
10005DBE . 8BF8 MOV EDI,EAX
10005DC0 > 395D CC CMP DWORD PTR SS:[EBP-34],EBX
10005DC3 . 74 09 JE SHORT jagmisc.10005DCE
10005DC5 . FF75 E0 PUSH DWORD PTR SS:[EBP-20]
10005DC8 . E8 30C5FFFF CALL jagmisc.100022FD
10005DCD . 59 POP ECX ; kernel32.7C816FD7
10005DCE > 395D C8 CMP DWORD PTR SS:[EBP-38],EBX
10005DD1 . 74 09 JE SHORT jagmisc.10005DDC
10005DD3 . FF75 E4 PUSH DWORD PTR SS:[EBP-1C]
10005DD6 . E8 22C5FFFF CALL jagmisc.100022FD
10005DDB . 59 POP ECX ; kernel32.7C816FD7
10005DDC > 8BC7 MOV EAX,EDI
10005DDE . E9 5B010000 JMP jagmisc.10005F3E
10005DE3 > 895D D8 MOV DWORD PTR SS:[EBP-28],EBX
10005DE6 . 33FF XOR EDI,EDI
10005DE8 . 895D C4 MOV DWORD PTR SS:[EBP-3C],EBX
10005DEB . 395D 08 CMP DWORD PTR SS:[EBP+8],EBX
10005DEE . 75 08 JNZ SHORT jagmisc.10005DF8
10005DF0 . A1 00B00010 MOV EAX,DWORD PTR DS:[1000B000]
10005DF5 . 8945 08 MOV DWORD PTR SS:[EBP+8],EAX
10005DF8 > 395D 20 CMP DWORD PTR SS:[EBP+20],EBX
10005DFB . 75 08 JNZ SHORT jagmisc.10005E05
10005DFD . A1 10B00010 MOV EAX,DWORD PTR DS:[1000B010]
10005E02 . 8945 20 MOV DWORD PTR SS:[EBP+20],EAX
10005E05 > FF75 08 PUSH DWORD PTR SS:[EBP+8]
10005E08 . E8 36140000 CALL jagmisc.10007243
10005E0D . 59 POP ECX ; kernel32.7C816FD7
10005E0E . 8945 C0 MOV DWORD PTR SS:[EBP-40],EAX
10005E11 . 83F8 FF CMP EAX,-1
10005E14 . 75 07 JNZ SHORT jagmisc.10005E1D
10005E16 > 33C0 XOR EAX,EAX
10005E18 . E9 21010000 JMP jagmisc.10005F3E
10005E1D > 3B45 20 CMP EAX,DWORD PTR SS:[EBP+20] ; kernel32.7C839AA8
10005E20 . 0F84 EE000000 JE jagmisc.10005F14
10005E26 . 53 PUSH EBX
10005E27 . 53 PUSH EBX
10005E28 . 8D4D 14 LEA ECX,DWORD PTR SS:[EBP+14]
10005E2B . 51 PUSH ECX
10005E2C . FF75 10 PUSH DWORD PTR SS:[EBP+10]
10005E2F . 50 PUSH EAX
10005E30 . FF75 20 PUSH DWORD PTR SS:[EBP+20] ; kernel32.7C839AA8
10005E33 . E8 4E140000 CALL jagmisc.10007286
10005E38 . 83C4 18 ADD ESP,18
10005E3B . 8945 D8 MOV DWORD PTR SS:[EBP-28],EAX
10005E3E . 3BC3 CMP EAX,EBX
10005E40 .^ 74 D4 JE SHORT jagmisc.10005E16
10005E42 . 53 PUSH EBX ; /DestSize = 0
10005E43 . 53 PUSH EBX ; |DestString = NULL
10005E44 . FF75 14 PUSH DWORD PTR SS:[EBP+14] ; |SrcSize = 6FFC8 (458696.)
10005E47 . 50 PUSH EAX ; |SrcString = 00000008 ???
10005E48 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |MapFlags = NORM_IGNOREKANATYPE|LCMAP_HIRAGANA|LCMAP_KATAKANA|LCMAP_HALFWIDTH|LCMAP_FULLWIDTH|SORT_STRINGSORT|7F0C8000
10005E4B . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |LocaleId = FFFFFFFF
10005E4E . FF15 E0800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringA>] ; \LCMapStringA
10005E54 . 8BF0 MOV ESI,EAX
10005E56 . 8975 DC MOV DWORD PTR SS:[EBP-24],ESI
10005E59 . 3BF3 CMP ESI,EBX
10005E5B . 0F84 A2000000 JE jagmisc.10005F03
10005E61 . 895D FC MOV DWORD PTR SS:[EBP-4],EBX
10005E64 . 83C0 03 ADD EAX,3
10005E67 . 83E0 FC AND EAX,FFFFFFFC
10005E6A . E8 41CFFFFF CALL jagmisc.10002DB0
10005E6F . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
10005E72 . 8BFC MOV EDI,ESP
10005E74 . 897D BC MOV DWORD PTR SS:[EBP-44],EDI
10005E77 . 56 PUSH ESI
10005E78 . 53 PUSH EBX
10005E79 . 57 PUSH EDI
10005E7A . E8 91DCFFFF CALL jagmisc.10003B10
10005E7F . 83C4 0C ADD ESP,0C
10005E82 . EB 10 JMP SHORT jagmisc.10005E94
10005E84 . 33C0 XOR EAX,EAX
10005E86 . 40 INC EAX
10005E87 . C3 RETN
10005E88 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451
10005E8B . E8 BF150000 CALL jagmisc.1000744F
10005E90 . 33DB XOR EBX,EBX
10005E92 . 33FF XOR EDI,EDI
10005E94 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10005E98 . 3BFB CMP EDI,EBX
10005E9A . 75 23 JNZ SHORT jagmisc.10005EBF
10005E9C . FF75 DC PUSH DWORD PTR SS:[EBP-24] ; kernel32.7C802458
10005E9F . E8 F8F6FFFF CALL jagmisc.1000559C
10005EA4 . 59 POP ECX ; kernel32.7C816FD7
10005EA5 . 8BF8 MOV EDI,EAX
10005EA7 . 3BFB CMP EDI,EBX
10005EA9 . 74 31 JE SHORT jagmisc.10005EDC
10005EAB . FF75 DC PUSH DWORD PTR SS:[EBP-24] ; kernel32.7C802458
10005EAE . 53 PUSH EBX
10005EAF . 57 PUSH EDI
10005EB0 . E8 5BDCFFFF CALL jagmisc.10003B10
10005EB5 . 83C4 0C ADD ESP,0C
10005EB8 . C745 C4 01000000 MOV DWORD PTR SS:[EBP-3C],1
10005EBF > FF75 DC PUSH DWORD PTR SS:[EBP-24] ; /DestSize = 7C802458 (2088772696.)
10005EC2 . 57 PUSH EDI ; |DestString = NULL
10005EC3 . FF75 14 PUSH DWORD PTR SS:[EBP+14] ; |SrcSize = 6FFC8 (458696.)
10005EC6 . FF75 D8 PUSH DWORD PTR SS:[EBP-28] ; |SrcString = "U\x8Bì\x83ì\x08SVWUü\x8B]\x0C\x8BE\x08\xF7@\x04\x06"
10005EC9 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |MapFlags = NORM_IGNOREKANATYPE|LCMAP_HIRAGANA|LCMAP_KATAKANA|LCMAP_HALFWIDTH|LCMAP_FULLWIDTH|SORT_STRINGSORT|7F0C8000
10005ECC . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |LocaleId = FFFFFFFF
10005ECF . FF15 E0800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringA>] ; \LCMapStringA
10005ED5 . 8945 DC MOV DWORD PTR SS:[EBP-24],EAX
10005ED8 . 3BC3 CMP EAX,EBX
10005EDA . 75 04 JNZ SHORT jagmisc.10005EE0
10005EDC > 33F6 XOR ESI,ESI
10005EDE . EB 26 JMP SHORT jagmisc.10005F06
10005EE0 > FF75 1C PUSH DWORD PTR SS:[EBP+1C]
10005EE3 . FF75 18 PUSH DWORD PTR SS:[EBP+18]
10005EE6 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
10005EE9 . 50 PUSH EAX
10005EEA . 57 PUSH EDI
10005EEB . FF75 20 PUSH DWORD PTR SS:[EBP+20] ; kernel32.7C839AA8
10005EEE . FF75 C0 PUSH DWORD PTR SS:[EBP-40]
10005EF1 . E8 90130000 CALL jagmisc.10007286
10005EF6 . 83C4 18 ADD ESP,18
10005EF9 . 8BF0 MOV ESI,EAX
10005EFB . F7DE NEG ESI
10005EFD . 1BF6 SBB ESI,ESI
10005EFF . F7DE NEG ESI
10005F01 . EB 03 JMP SHORT jagmisc.10005F06
10005F03 > 8B75 B8 MOV ESI,DWORD PTR SS:[EBP-48]
10005F06 > 395D C4 CMP DWORD PTR SS:[EBP-3C],EBX
10005F09 . 74 23 JE SHORT jagmisc.10005F2E
10005F0B . 57 PUSH EDI
10005F0C . E8 ECC3FFFF CALL jagmisc.100022FD
10005F11 . 59 POP ECX ; kernel32.7C816FD7
10005F12 . EB 1A JMP SHORT jagmisc.10005F2E
10005F14 > FF75 1C PUSH DWORD PTR SS:[EBP+1C] ; /DestSize = FFFFFFFF (-1.)
10005F17 . FF75 18 PUSH DWORD PTR SS:[EBP+18] ; |DestString = 8227C238
10005F1A . FF75 14 PUSH DWORD PTR SS:[EBP+14] ; |SrcSize = 6FFC8 (458696.)
10005F1D . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |SrcString = 8054A6ED ???
10005F20 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |MapFlags = NORM_IGNOREKANATYPE|LCMAP_HIRAGANA|LCMAP_KATAKANA|LCMAP_HALFWIDTH|LCMAP_FULLWIDTH|SORT_STRINGSORT|7F0C8000
10005F23 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |LocaleId = FFFFFFFF
10005F26 . FF15 E0800010 CALL DWORD PTR DS:[<&KERNEL32.LCMapStringA>] ; \LCMapStringA
10005F2C . 8BF0 MOV ESI,EAX
10005F2E > 395D D8 CMP DWORD PTR SS:[EBP-28],EBX
10005F31 . 74 09 JE SHORT jagmisc.10005F3C
10005F33 . FF75 D8 PUSH DWORD PTR SS:[EBP-28] ; kernel32.7C839AA8
10005F36 . E8 C2C3FFFF CALL jagmisc.100022FD
10005F3B . 59 POP ECX ; kernel32.7C816FD7
10005F3C > 8BC6 MOV EAX,ESI
10005F3E > 8D65 AC LEA ESP,DWORD PTR SS:[EBP-54]
10005F41 . E8 65C4FFFF CALL jagmisc.100023AB
10005F46 . C3 RETN
10005F47 /$ 8B5424 04 MOV EDX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10005F4B |. 56 PUSH ESI
10005F4C |. 8B7424 0C MOV ESI,DWORD PTR SS:[ESP+C]
10005F50 |. 8D0C32 LEA ECX,DWORD PTR DS:[EDX+ESI]
10005F53 |. 33C0 XOR EAX,EAX
10005F55 |. 3BCA CMP ECX,EDX
10005F57 |. 72 04 JB SHORT jagmisc.10005F5D
10005F59 |. 3BCE CMP ECX,ESI
10005F5B |. 73 03 JNB SHORT jagmisc.10005F60
10005F5D |> 33C0 XOR EAX,EAX
10005F5F |. 40 INC EAX
10005F60 |> 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10]
10005F64 |. 890A MOV DWORD PTR DS:[EDX],ECX
10005F66 |. 5E POP ESI ; kernel32.7C816FD7
10005F67 \. C3 RETN
10005F68 /$ 56 PUSH ESI
10005F69 |. 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8]
10005F6D |. 57 PUSH EDI
10005F6E |. 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10]
10005F72 |. 56 PUSH ESI
10005F73 |. FF37 PUSH DWORD PTR DS:[EDI]
10005F75 |. FF36 PUSH DWORD PTR DS:[ESI]
10005F77 |. E8 CBFFFFFF CALL jagmisc.10005F47
10005F7C |. 83C4 0C ADD ESP,0C
10005F7F |. 85C0 TEST EAX,EAX
10005F81 |. 74 17 JE SHORT jagmisc.10005F9A
10005F83 |. 8D46 04 LEA EAX,DWORD PTR DS:[ESI+4]
10005F86 |. 50 PUSH EAX
10005F87 |. 6A 01 PUSH 1
10005F89 |. FF30 PUSH DWORD PTR DS:[EAX]
10005F8B |. E8 B7FFFFFF CALL jagmisc.10005F47
10005F90 |. 83C4 0C ADD ESP,0C
10005F93 |. 85C0 TEST EAX,EAX
10005F95 |. 74 03 JE SHORT jagmisc.10005F9A
10005F97 |. FF46 08 INC DWORD PTR DS:[ESI+8]
10005F9A |> 8D46 04 LEA EAX,DWORD PTR DS:[ESI+4]
10005F9D |. 50 PUSH EAX
10005F9E |. FF77 04 PUSH DWORD PTR DS:[EDI+4]
10005FA1 |. FF30 PUSH DWORD PTR DS:[EAX]
10005FA3 |. E8 9FFFFFFF CALL jagmisc.10005F47
10005FA8 |. 83C4 0C ADD ESP,0C
10005FAB |. 85C0 TEST EAX,EAX
10005FAD |. 74 03 JE SHORT jagmisc.10005FB2
10005FAF |. FF46 08 INC DWORD PTR DS:[ESI+8]
10005FB2 |> 8D46 08 LEA EAX,DWORD PTR DS:[ESI+8]
10005FB5 |. 50 PUSH EAX
10005FB6 |. FF77 08 PUSH DWORD PTR DS:[EDI+8]
10005FB9 |. FF30 PUSH DWORD PTR DS:[EAX]
10005FBB |. E8 87FFFFFF CALL jagmisc.10005F47
10005FC0 |. 83C4 0C ADD ESP,0C
10005FC3 |. 5F POP EDI ; kernel32.7C816FD7
10005FC4 |. 5E POP ESI ; kernel32.7C816FD7
10005FC5 \. C3 RETN
10005FC6 /$ 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10005FCA |. 56 PUSH ESI
10005FCB |. 8B30 MOV ESI,DWORD PTR DS:[EAX]
10005FCD |. 8BCE MOV ECX,ESI
10005FCF |. 03F6 ADD ESI,ESI
10005FD1 |. 57 PUSH EDI
10005FD2 |. 8B78 04 MOV EDI,DWORD PTR DS:[EAX+4]
10005FD5 |. C1E9 1F SHR ECX,1F
10005FD8 |. 8930 MOV DWORD PTR DS:[EAX],ESI
10005FDA |. 8D343F LEA ESI,DWORD PTR DS:[EDI+EDI]
10005FDD |. 0BF1 OR ESI,ECX
10005FDF |. 8B48 08 MOV ECX,DWORD PTR DS:[EAX+8]
10005FE2 |. 8BD7 MOV EDX,EDI
10005FE4 |. C1EA 1F SHR EDX,1F
10005FE7 |. D1E1 SHL ECX,1
10005FE9 |. 0BCA OR ECX,EDX
10005FEB |. 5F POP EDI ; kernel32.7C816FD7
10005FEC |. 8970 04 MOV DWORD PTR DS:[EAX+4],ESI
10005FEF |. 8948 08 MOV DWORD PTR DS:[EAX+8],ECX
10005FF2 |. 5E POP ESI ; kernel32.7C816FD7
10005FF3 \. C3 RETN
10005FF4 /$ 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10005FF8 |. 8B50 08 MOV EDX,DWORD PTR DS:[EAX+8]
10005FFB |. 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4]
10005FFE |. 56 PUSH ESI
10005FFF |. 57 PUSH EDI
10006000 |. 8BF9 MOV EDI,ECX
10006002 |. 8BF2 MOV ESI,EDX
10006004 |. D1E9 SHR ECX,1
10006006 |. C1E6 1F SHL ESI,1F
10006009 |. 0BCE OR ECX,ESI
1000600B |. 8948 04 MOV DWORD PTR DS:[EAX+4],ECX
1000600E |. 8B08 MOV ECX,DWORD PTR DS:[EAX]
10006010 |. C1E7 1F SHL EDI,1F
10006013 |. D1E9 SHR ECX,1
10006015 |. 0BCF OR ECX,EDI
10006017 |. D1EA SHR EDX,1
10006019 |. 5F POP EDI ; kernel32.7C816FD7
1000601A |. 8950 08 MOV DWORD PTR DS:[EAX+8],EDX
1000601D |. 8908 MOV DWORD PTR DS:[EAX],ECX
1000601F |. 5E POP ESI ; kernel32.7C816FD7
10006020 \. C3 RETN
10006021 /$ 55 PUSH EBP
10006022 |. 8BEC MOV EBP,ESP
10006024 |. 83EC 14 SUB ESP,14
10006027 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
1000602C |. 53 PUSH EBX
1000602D |. 8B5D 10 MOV EBX,[ARG.3]
10006030 |. 33D2 XOR EDX,EDX
10006032 |. 8945 FC MOV [LOCAL.1],EAX
10006035 |. 8B45 0C MOV EAX,[ARG.2]
10006038 |. 3BC2 CMP EAX,EDX
1000603A |. 56 PUSH ESI
1000603B |. 57 PUSH EDI
1000603C |. C745 EC 4E400000 MOV [LOCAL.5],404E
10006043 |. 8913 MOV DWORD PTR DS:[EBX],EDX
10006045 |. 8953 04 MOV DWORD PTR DS:[EBX+4],EDX
10006048 |. 8953 08 MOV DWORD PTR DS:[EBX+8],EDX
1000604B |. 76 4F JBE SHORT jagmisc.1000609C
1000604D |. 8945 10 MOV [ARG.3],EAX
10006050 |> 8BF3 /MOV ESI,EBX
10006052 |. 8D7D F0 |LEA EDI,[LOCAL.4]
10006055 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10006056 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10006057 |. 53 |PUSH EBX
10006058 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10006059 |. E8 68FFFFFF |CALL jagmisc.10005FC6
1000605E |. 53 |PUSH EBX
1000605F |. E8 62FFFFFF |CALL jagmisc.10005FC6
10006064 |. 8D45 F0 |LEA EAX,[LOCAL.4]
10006067 |. 50 |PUSH EAX
10006068 |. 53 |PUSH EBX
10006069 |. E8 FAFEFFFF |CALL jagmisc.10005F68
1000606E |. 53 |PUSH EBX
1000606F |. E8 52FFFFFF |CALL jagmisc.10005FC6
10006074 |. 8B45 08 |MOV EAX,[ARG.1]
10006077 |. 0FBE00 |MOVSX EAX,BYTE PTR DS:[EAX]
1000607A |. 8365 F4 00 |AND [LOCAL.3],0
1000607E |. 8365 F8 00 |AND [LOCAL.2],0
10006082 |. 8945 F0 |MOV [LOCAL.4],EAX
10006085 |. 8D45 F0 |LEA EAX,[LOCAL.4]
10006088 |. 50 |PUSH EAX
10006089 |. 53 |PUSH EBX
1000608A |. E8 D9FEFFFF |CALL jagmisc.10005F68
1000608F |. 83C4 1C |ADD ESP,1C
10006092 |. FF45 08 |INC [ARG.1]
10006095 |. FF4D 10 |DEC [ARG.3]
10006098 |.^ 75 B6 \JNZ SHORT jagmisc.10006050
1000609A |. 33D2 XOR EDX,EDX
1000609C |> 3953 08 CMP DWORD PTR DS:[EBX+8],EDX
1000609F |. 75 2F JNZ SHORT jagmisc.100060D0
100060A1 |. 8B7B 08 MOV EDI,DWORD PTR DS:[EBX+8]
100060A4 |> 8B4B 04 /MOV ECX,DWORD PTR DS:[EBX+4]
100060A7 |. 8145 EC F0FF0000 |ADD [LOCAL.5],0FFF0
100060AE |. 8BC1 |MOV EAX,ECX
100060B0 |. C1E8 10 |SHR EAX,10
100060B3 |. 8BF8 |MOV EDI,EAX
100060B5 |. 8B03 |MOV EAX,DWORD PTR DS:[EBX]
100060B7 |. 8BF0 |MOV ESI,EAX
100060B9 |. C1EE 10 |SHR ESI,10
100060BC |. C1E1 10 |SHL ECX,10
100060BF |. 0BF1 |OR ESI,ECX
100060C1 |. C1E0 10 |SHL EAX,10
100060C4 |. 3BFA |CMP EDI,EDX
100060C6 |. 8973 04 |MOV DWORD PTR DS:[EBX+4],ESI
100060C9 |. 8903 |MOV DWORD PTR DS:[EBX],EAX
100060CB |.^ 74 D7 \JE SHORT jagmisc.100060A4
100060CD |. 897B 08 MOV DWORD PTR DS:[EBX+8],EDI
100060D0 |> BE 00800000 MOV ESI,8000
100060D5 |. EB 0E JMP SHORT jagmisc.100060E5
100060D7 |> 53 /PUSH EBX
100060D8 |. E8 E9FEFFFF |CALL jagmisc.10005FC6
100060DD |. 8145 EC FFFF0000 |ADD [LOCAL.5],0FFFF
100060E4 |. 59 |POP ECX ; kernel32.7C816FD7
100060E5 |> 8573 08 TEST DWORD PTR DS:[EBX+8],ESI
100060E8 |.^ 74 ED \JE SHORT jagmisc.100060D7
100060EA |. 66:8B45 EC MOV AX,WORD PTR SS:[EBP-14]
100060EE |. 8B4D FC MOV ECX,[LOCAL.1]
100060F1 |. 5F POP EDI ; kernel32.7C816FD7
100060F2 |. 5E POP ESI ; kernel32.7C816FD7
100060F3 |. 66:8943 0A MOV WORD PTR DS:[EBX+A],AX
100060F7 |. 5B POP EBX ; kernel32.7C816FD7
100060F8 |. E8 F9D9FFFF CALL jagmisc.10003AF6
100060FD |. C9 LEAVE
100060FE \. C3 RETN
100060FF /$ 55 PUSH EBP
10006100 |. 8BEC MOV EBP,ESP
10006102 |. 83EC 5C SUB ESP,5C
10006105 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
1000610A |. 53 PUSH EBX
1000610B |. 56 PUSH ESI
1000610C |. 8945 FC MOV [LOCAL.1],EAX
1000610F |. 33C0 XOR EAX,EAX
10006111 |. 57 PUSH EDI
10006112 |. 8B7D 10 MOV EDI,[ARG.3]
10006115 |. 8D75 D0 LEA ESI,[LOCAL.12]
10006118 |. 8975 CC MOV [LOCAL.13],ESI
1000611B |. 8945 B0 MOV [LOCAL.20],EAX
1000611E |. C745 B4 01000000 MOV [LOCAL.19],1
10006125 |. 8945 C8 MOV [LOCAL.14],EAX
10006128 |. 8945 BC MOV [LOCAL.17],EAX
1000612B |. 8945 A8 MOV [LOCAL.22],EAX
1000612E |. 8945 A4 MOV [LOCAL.23],EAX
10006131 |. 8945 AC MOV [LOCAL.21],EAX
10006134 |. 8945 C4 MOV [LOCAL.15],EAX
10006137 |. 8945 B8 MOV [LOCAL.18],EAX
1000613A |. 897D C0 MOV [LOCAL.16],EDI
1000613D |> 8A0F /MOV CL,BYTE PTR DS:[EDI]
1000613F |. 80F9 20 |CMP CL,20
10006142 |. 74 0F |JE SHORT jagmisc.10006153
10006144 |. 80F9 09 |CMP CL,9
10006147 |. 74 0A |JE SHORT jagmisc.10006153
10006149 |. 80F9 0A |CMP CL,0A
1000614C |. 74 05 |JE SHORT jagmisc.10006153
1000614E |. 80F9 0D |CMP CL,0D
10006151 |. 75 03 |JNZ SHORT jagmisc.10006156
10006153 |> 47 |INC EDI
10006154 |.^ EB E7 \JMP SHORT jagmisc.1000613D
10006156 |> 8A1F MOV BL,BYTE PTR DS:[EDI]
10006158 |. 47 INC EDI
10006159 |. 83F8 0B CMP EAX,0B ; Switch (cases 0..B)
1000615C |. 0F87 73020000 JA jagmisc.100063D5
10006162 |. FF2485 03650010 JMP DWORD PTR DS:[EAX*4+10006503] ; jagmisc.10006333
10006169 |> 80FB 31 CMP BL,31 ; Case 0 of switch 10006159
1000616C |. 7C 0C JL SHORT jagmisc.1000617A
1000616E |. 80FB 39 CMP BL,39
10006171 |. 7F 07 JG SHORT jagmisc.1000617A
10006173 |> 6A 03 PUSH 3
10006175 |. E9 1A020000 JMP jagmisc.10006394
1000617A |> 3A1D 1CA30010 CMP BL,BYTE PTR DS:[1000A31C]
10006180 |. 75 07 JNZ SHORT jagmisc.10006189
10006182 |> 6A 05 PUSH 5
10006184 |. E9 42020000 JMP jagmisc.100063CB
10006189 |> 0FBEC3 MOVSX EAX,BL
1000618C |. 83E8 2B SUB EAX,2B ; Switch (cases 2B..30)
1000618F |. 74 22 JE SHORT jagmisc.100061B3
10006191 |. 48 DEC EAX
10006192 |. 48 DEC EAX
10006193 |. 74 12 JE SHORT jagmisc.100061A7
10006195 |. 83E8 03 SUB EAX,3
10006198 |. 0F84 A2000000 JE jagmisc.10006240
1000619E |. 8975 CC MOV [LOCAL.13],ESI ; Default case of switch 1000618C
100061A1 |. 4F DEC EDI
100061A2 |. E9 AB010000 JMP jagmisc.10006352
100061A7 |> 6A 02 PUSH 2 ; Case 2D ('-') of switch 1000618C
100061A9 |. 58 POP EAX ; kernel32.7C816FD7
100061AA |. C745 B0 00800000 MOV [LOCAL.20],8000
100061B1 |.^ EB A3 JMP SHORT jagmisc.10006156
100061B3 |> 8365 B0 00 AND [LOCAL.20],0 ; Case 2B ('+') of switch 1000618C
100061B7 |. 6A 02 PUSH 2
100061B9 |. 58 POP EAX ; kernel32.7C816FD7
100061BA |.^ EB 9A JMP SHORT jagmisc.10006156
100061BC |> 33C0 XOR EAX,EAX ; Case 1 of switch 10006159
100061BE |. 40 INC EAX
100061BF |. 80FB 31 CMP BL,31
100061C2 |. 8945 BC MOV [LOCAL.17],EAX
100061C5 |. 7C 05 JL SHORT jagmisc.100061CC
100061C7 |. 80FB 39 CMP BL,39
100061CA |.^ 7E A7 JLE SHORT jagmisc.10006173
100061CC |> 3A1D 1CA30010 CMP BL,BYTE PTR DS:[1000A31C]
100061D2 |. 75 07 JNZ SHORT jagmisc.100061DB
100061D4 |> 6A 04 PUSH 4
100061D6 |. E9 F0010000 JMP jagmisc.100063CB
100061DB |> 80FB 2B CMP BL,2B
100061DE |. 74 35 JE SHORT jagmisc.10006215
100061E0 |. 80FB 2D CMP BL,2D
100061E3 |. 74 30 JE SHORT jagmisc.10006215
100061E5 |. 80FB 30 CMP BL,30
100061E8 |.^ 0F84 68FFFFFF JE jagmisc.10006156
100061EE |> 80FB 43 CMP BL,43
100061F1 |. 0F8E 57010000 JLE jagmisc.1000634E
100061F7 |. 80FB 45 CMP BL,45
100061FA |. 7E 12 JLE SHORT jagmisc.1000620E
100061FC |. 80FB 63 CMP BL,63
100061FF |. 0F8E 49010000 JLE jagmisc.1000634E
10006205 |. 80FB 65 CMP BL,65
10006208 |. 0F8F 40010000 JG jagmisc.1000634E
1000620E |> 6A 06 PUSH 6
10006210 |. E9 B6010000 JMP jagmisc.100063CB
10006215 |> 4F DEC EDI
10006216 |. 6A 0B PUSH 0B
10006218 |. E9 AE010000 JMP jagmisc.100063CB
1000621D |> 80FB 31 CMP BL,31 ; Case 2 of switch 10006159
10006220 |. 7C 09 JL SHORT jagmisc.1000622B
10006222 |. 80FB 39 CMP BL,39
10006225 |.^ 0F8E 48FFFFFF JLE jagmisc.10006173
1000622B |> 3A1D 1CA30010 CMP BL,BYTE PTR DS:[1000A31C]
10006231 |.^ 0F84 4BFFFFFF JE jagmisc.10006182
10006237 |. 80FB 30 CMP BL,30
1000623A |. 0F85 60010000 JNZ jagmisc.100063A0
10006240 |> 33C0 XOR EAX,EAX ; Case 30 ('0') of switch 1000618C
10006242 |. 40 INC EAX
10006243 |.^ E9 0EFFFFFF JMP jagmisc.10006156
10006248 |> C745 BC 01000000 MOV [LOCAL.17],1 ; Case 3 of switch 10006159
1000624F |. EB 17 JMP SHORT jagmisc.10006268
10006251 |> 837D C8 19 /CMP [LOCAL.14],19
10006255 |. 73 0B |JNB SHORT jagmisc.10006262
10006257 |. FF45 C8 |INC [LOCAL.14]
1000625A |. 80EB 30 |SUB BL,30
1000625D |. 881E |MOV BYTE PTR DS:[ESI],BL
1000625F |. 46 |INC ESI
10006260 |. EB 03 |JMP SHORT jagmisc.10006265
10006262 |> FF45 C4 |INC [LOCAL.15]
10006265 |> 8A1F |MOV BL,BYTE PTR DS:[EDI]
10006267 |. 47 |INC EDI
10006268 |> 0FB6C3 MOVZX EAX,BL
1000626B |. 50 |PUSH EAX
1000626C |. E8 2CCDFFFF |CALL jagmisc.10002F9D
10006271 |. 85C0 |TEST EAX,EAX
10006273 |. 59 |POP ECX ; kernel32.7C816FD7
10006274 |.^ 75 DB \JNZ SHORT jagmisc.10006251
10006276 |. 3A1D 1CA30010 CMP BL,BYTE PTR DS:[1000A31C]
1000627C |. 75 46 JNZ SHORT jagmisc.100062C4
1000627E |.^ E9 51FFFFFF JMP jagmisc.100061D4
10006283 |> 33C0 XOR EAX,EAX ; Case 4 of switch 10006159
10006285 |. 40 INC EAX
10006286 |. 837D C8 00 CMP [LOCAL.14],0
1000628A |. 8945 BC MOV [LOCAL.17],EAX
1000628D |. 8945 A8 MOV [LOCAL.22],EAX
10006290 |. 75 24 JNZ SHORT jagmisc.100062B6
10006292 |. EB 06 JMP SHORT jagmisc.1000629A
10006294 |> FF4D C4 /DEC [LOCAL.15]
10006297 |. 8A1F |MOV BL,BYTE PTR DS:[EDI]
10006299 |. 47 |INC EDI
1000629A |> 80FB 30 CMP BL,30
1000629D |.^ 74 F5 \JE SHORT jagmisc.10006294
1000629F |. EB 15 JMP SHORT jagmisc.100062B6
100062A1 |> 837D C8 19 /CMP [LOCAL.14],19
100062A5 |. 73 0C |JNB SHORT jagmisc.100062B3
100062A7 |. FF45 C8 |INC [LOCAL.14]
100062AA |. 80EB 30 |SUB BL,30
100062AD |. 881E |MOV BYTE PTR DS:[ESI],BL
100062AF |. 46 |INC ESI
100062B0 |. FF4D C4 |DEC [LOCAL.15]
100062B3 |> 8A1F |MOV BL,BYTE PTR DS:[EDI]
100062B5 |. 47 |INC EDI
100062B6 |> 0FB6C3 MOVZX EAX,BL
100062B9 |. 50 |PUSH EAX
100062BA |. E8 DECCFFFF |CALL jagmisc.10002F9D
100062BF |. 85C0 |TEST EAX,EAX
100062C1 |. 59 |POP ECX ; kernel32.7C816FD7
100062C2 |.^ 75 DD \JNZ SHORT jagmisc.100062A1
100062C4 |> 80FB 2B CMP BL,2B
100062C7 |.^ 0F84 48FFFFFF JE jagmisc.10006215
100062CD |. 80FB 2D CMP BL,2D
100062D0 |.^ 0F84 3FFFFFFF JE jagmisc.10006215
100062D6 |.^ E9 13FFFFFF JMP jagmisc.100061EE
100062DB |> 0FB6C3 MOVZX EAX,BL ; Case 5 of switch 10006159
100062DE |. 50 PUSH EAX
100062DF |. C745 A8 01000000 MOV [LOCAL.22],1
100062E6 |. E8 B2CCFFFF CALL jagmisc.10002F9D
100062EB |. 85C0 TEST EAX,EAX
100062ED |. 59 POP ECX ; kernel32.7C816FD7
100062EE |. 0F84 AC000000 JE jagmisc.100063A0
100062F4 |. 6A 04 PUSH 4
100062F6 |. E9 99000000 JMP jagmisc.10006394
100062FB |> 80FB 31 CMP BL,31 ; Case 6 of switch 10006159
100062FE |. 8D4F FE LEA ECX,DWORD PTR DS:[EDI-2]
10006301 |. 894D C0 MOV [LOCAL.16],ECX
10006304 |. 7C 09 JL SHORT jagmisc.1000630F
10006306 |. 80FB 39 CMP BL,39
10006309 |. 0F8E 83000000 JLE jagmisc.10006392
1000630F |> 0FBEC3 MOVSX EAX,BL
10006312 |. 83E8 2B SUB EAX,2B ; Switch (cases 2B..30)
10006315 |. 0F84 AE000000 JE jagmisc.100063C9
1000631B |. 48 DEC EAX
1000631C |. 48 DEC EAX
1000631D |. 0F84 9A000000 JE jagmisc.100063BD
10006323 |. 83E8 03 SUB EAX,3
10006326 |. 0F85 B7000000 JNZ jagmisc.100063E3
1000632C |> 6A 08 PUSH 8 ; Case 30 ('0') of switch 10006312
1000632E |. E9 98000000 JMP jagmisc.100063CB
10006333 |> C745 A4 01000000 MOV [LOCAL.23],1 ; Case 8 of switch 10006159
1000633A |. EB 03 JMP SHORT jagmisc.1000633F
1000633C |> 8A1F /MOV BL,BYTE PTR DS:[EDI]
1000633E |. 47 |INC EDI
1000633F |> 80FB 30 CMP BL,30
10006342 |.^ 74 F8 \JE SHORT jagmisc.1000633C
10006344 |. 80FB 31 CMP BL,31
10006347 |. 7C 05 JL SHORT jagmisc.1000634E
10006349 |. 80FB 39 CMP BL,39
1000634C |. 7E 44 JLE SHORT jagmisc.10006392
1000634E |> 4F DEC EDI
1000634F |> 8975 CC MOV [LOCAL.13],ESI
10006352 |> 837D BC 00 CMP [LOCAL.17],0
10006356 |. 8B45 0C MOV EAX,[ARG.2]
10006359 |. 8938 MOV DWORD PTR DS:[EAX],EDI
1000635B |. 0F84 50010000 JE jagmisc.100064B1
10006361 |. 6A 18 PUSH 18
10006363 |. 58 POP EAX ; kernel32.7C816FD7
10006364 |. 3945 C8 CMP [LOCAL.14],EAX
10006367 |. 76 10 JBE SHORT jagmisc.10006379
10006369 |. 807D E7 05 CMP BYTE PTR SS:[EBP-19],5
1000636D |. 7C 03 JL SHORT jagmisc.10006372
1000636F |. FE45 E7 INC BYTE PTR SS:[EBP-19]
10006372 |> 4E DEC ESI
10006373 |. FF45 C4 INC [LOCAL.15]
10006376 |. 8945 C8 MOV [LOCAL.14],EAX
10006379 |> 837D C8 00 CMP [LOCAL.14],0
1000637D |. 0F86 55010000 JBE jagmisc.100064D8
10006383 |. E9 C5000000 JMP jagmisc.1000644D
10006388 |> 80FB 31 CMP BL,31 ; Case 7 of switch 10006159
1000638B |. 7C 0E JL SHORT jagmisc.1000639B
1000638D |. 80FB 39 CMP BL,39
10006390 |. 7F 09 JG SHORT jagmisc.1000639B
10006392 |> 6A 09 PUSH 9
10006394 |> 58 POP EAX ; kernel32.7C816FD7
10006395 |. 4F DEC EDI
10006396 |.^ E9 BBFDFFFF JMP jagmisc.10006156
1000639B |> 80FB 30 CMP BL,30
1000639E |.^ 74 8C JE SHORT jagmisc.1000632C
100063A0 |> 8B7D C0 MOV EDI,[LOCAL.16]
100063A3 |.^ EB AA JMP SHORT jagmisc.1000634F
100063A5 |> 837D 20 00 CMP [ARG.7],0 ; Case B of switch 10006159
100063A9 |. 74 26 JE SHORT jagmisc.100063D1
100063AB |. 0FBEC3 MOVSX EAX,BL
100063AE |. 83E8 2B SUB EAX,2B ; Switch (cases 2B..2D)
100063B1 |. 8D4F FF LEA ECX,DWORD PTR DS:[EDI-1]
100063B4 |. 894D C0 MOV [LOCAL.16],ECX
100063B7 |. 74 10 JE SHORT jagmisc.100063C9
100063B9 |. 48 DEC EAX
100063BA |. 48 DEC EAX
100063BB |. 75 26 JNZ SHORT jagmisc.100063E3
100063BD |> 834D B4 FF OR [LOCAL.19],FFFFFFFF ; Case 2D ('-') of switch 100063AE
100063C1 |. 6A 07 PUSH 7
100063C3 |. 58 POP EAX ; kernel32.7C816FD7
100063C4 |.^ E9 8DFDFFFF JMP jagmisc.10006156
100063C9 |> 6A 07 PUSH 7 ; Case 2B ('+') of switch 100063AE
100063CB |> 58 POP EAX ; kernel32.7C816FD7
100063CC |.^ E9 85FDFFFF JMP jagmisc.10006156
100063D1 |> 6A 0A PUSH 0A
100063D3 |. 58 POP EAX ; kernel32.7C816FD7
100063D4 |. 4F DEC EDI
100063D5 |> 83F8 0A CMP EAX,0A ; Default case of switch 10006159
100063D8 |.^ 0F85 78FDFFFF JNZ jagmisc.10006156
100063DE |.^ E9 6CFFFFFF JMP jagmisc.1000634F
100063E3 |> 8975 CC MOV [LOCAL.13],ESI ; Default case of switch 100063AE
100063E6 |. 8BF9 MOV EDI,ECX
100063E8 |.^ E9 65FFFFFF JMP jagmisc.10006352
100063ED |> 8975 CC MOV [LOCAL.13],ESI ; Case 9 of switch 10006159
100063F0 |. C745 A4 01000000 MOV [LOCAL.23],1
100063F7 |. 33F6 XOR ESI,ESI
100063F9 |. EB 15 JMP SHORT jagmisc.10006410
100063FB |> 0FBECB /MOVSX ECX,BL
100063FE |. 8D04B6 |LEA EAX,DWORD PTR DS:[ESI+ESI*4]
10006401 |. 8D7441 D0 |LEA ESI,DWORD PTR DS:[ECX+EAX*2-30]
10006405 |. 81FE 50140000 |CMP ESI,1450
1000640B |. 7F 13 |JG SHORT jagmisc.10006420
1000640D |. 8A1F |MOV BL,BYTE PTR DS:[EDI]
1000640F |. 47 |INC EDI
10006410 |> 0FB6C3 MOVZX EAX,BL
10006413 |. 50 |PUSH EAX
10006414 |. E8 84CBFFFF |CALL jagmisc.10002F9D
10006419 |. 85C0 |TEST EAX,EAX
1000641B |. 59 |POP ECX ; kernel32.7C816FD7
1000641C |.^ 75 DD \JNZ SHORT jagmisc.100063FB
1000641E |. EB 05 JMP SHORT jagmisc.10006425
10006420 |> BE 51140000 MOV ESI,1451
10006425 |> 8975 AC MOV [LOCAL.21],ESI
10006428 |. 0FB6C3 MOVZX EAX,BL
1000642B |. EB 06 JMP SHORT jagmisc.10006433
1000642D |> 8A07 /MOV AL,BYTE PTR DS:[EDI]
1000642F |. 47 |INC EDI
10006430 |. 0FB6C0 |MOVZX EAX,AL
10006433 |> 50 PUSH EAX
10006434 |. E8 64CBFFFF |CALL jagmisc.10002F9D
10006439 |. 85C0 |TEST EAX,EAX
1000643B |. 59 |POP ECX ; kernel32.7C816FD7
1000643C |.^ 75 EF \JNZ SHORT jagmisc.1000642D
1000643E |. 8B75 CC MOV ESI,[LOCAL.13]
10006441 |. 4F DEC EDI
10006442 |.^ E9 0BFFFFFF JMP jagmisc.10006352
10006447 |> FF4D C8 /DEC [LOCAL.14]
1000644A |. FF45 C4 |INC [LOCAL.15]
1000644D |> 4E DEC ESI
1000644E |. 803E 00 |CMP BYTE PTR DS:[ESI],0
10006451 |.^ 74 F4 \JE SHORT jagmisc.10006447
10006453 |. 8D45 EC LEA EAX,[LOCAL.5]
10006456 |. 50 PUSH EAX
10006457 |. FF75 C8 PUSH [LOCAL.14]
1000645A |. 8D45 D0 LEA EAX,[LOCAL.12]
1000645D |. 50 PUSH EAX
1000645E |. E8 BEFBFFFF CALL jagmisc.10006021
10006463 |. 8B45 AC MOV EAX,[LOCAL.21]
10006466 |. 33C9 XOR ECX,ECX
10006468 |. 83C4 0C ADD ESP,0C
1000646B |. 394D B4 CMP [LOCAL.19],ECX
1000646E |. 7D 02 JGE SHORT jagmisc.10006472
10006470 |. F7D8 NEG EAX
10006472 |> 0345 C4 ADD EAX,[LOCAL.15]
10006475 |. 394D A4 CMP [LOCAL.23],ECX
10006478 |. 75 03 JNZ SHORT jagmisc.1000647D
1000647A |. 0345 18 ADD EAX,[ARG.5]
1000647D |> 394D A8 CMP [LOCAL.22],ECX
10006480 |. 75 03 JNZ SHORT jagmisc.10006485
10006482 |. 2B45 1C SUB EAX,[ARG.6]
10006485 |> 3D 50140000 CMP EAX,1450
1000648A |. 7F 2E JG SHORT jagmisc.100064BA
1000648C |. 3D B0EBFFFF CMP EAX,-1450
10006491 |. 7C 3E JL SHORT jagmisc.100064D1
10006493 |. FF75 14 PUSH [ARG.4]
10006496 |. 50 PUSH EAX
10006497 |. 8D45 EC LEA EAX,[LOCAL.5]
1000649A |. 50 PUSH EAX
1000649B |. E8 C4120000 CALL jagmisc.10007764
100064A0 |. 8B55 EC MOV EDX,[LOCAL.5]
100064A3 |. 8B5D EE MOV EBX,DWORD PTR SS:[EBP-12]
100064A6 |. 8B75 F2 MOV ESI,DWORD PTR SS:[EBP-E]
100064A9 |. 8B45 F6 MOV EAX,DWORD PTR SS:[EBP-A]
100064AC |. 83C4 0C ADD ESP,0C
100064AF |. EB 2F JMP SHORT jagmisc.100064E0
100064B1 |> C745 B8 04000000 MOV [LOCAL.18],4
100064B8 |. EB 1E JMP SHORT jagmisc.100064D8
100064BA |> 33DB XOR EBX,EBX
100064BC |. B8 FF7F0000 MOV EAX,7FFF
100064C1 |. BE 00000080 MOV ESI,80000000
100064C6 |. 33D2 XOR EDX,EDX
100064C8 |. C745 B8 02000000 MOV [LOCAL.18],2
100064CF |. EB 0F JMP SHORT jagmisc.100064E0
100064D1 |> C745 B8 01000000 MOV [LOCAL.18],1
100064D8 |> 33D2 XOR EDX,EDX
100064DA |. 33C0 XOR EAX,EAX
100064DC |. 33F6 XOR ESI,ESI
100064DE |. 33DB XOR EBX,EBX
100064E0 |> 8B4D 08 MOV ECX,[ARG.1]
100064E3 |. 0B45 B0 OR EAX,[LOCAL.20]
100064E6 |. 5F POP EDI ; kernel32.7C816FD7
100064E7 |. 8971 06 MOV DWORD PTR DS:[ECX+6],ESI
100064EA |. 8959 02 MOV DWORD PTR DS:[ECX+2],EBX
100064ED |. 66:8941 0A MOV WORD PTR DS:[ECX+A],AX
100064F1 |. 8B45 B8 MOV EAX,[LOCAL.18]
100064F4 |. 66:8911 MOV WORD PTR DS:[ECX],DX
100064F7 |. 8B4D FC MOV ECX,[LOCAL.1]
100064FA |. 5E POP ESI ; kernel32.7C816FD7
100064FB |. 5B POP EBX ; kernel32.7C816FD7
100064FC |. E8 F5D5FFFF CALL jagmisc.10003AF6
10006501 |. C9 LEAVE
10006502 \. C3 RETN
10006503 . 69610010 DD jagmisc.10006169 ; Switch table used at 10006162
10006507 . BC610010 DD jagmisc.100061BC
1000650B . 1D620010 DD jagmisc.1000621D
1000650F . 48620010 DD jagmisc.10006248
10006513 . 83620010 DD jagmisc.10006283
10006517 . DB620010 DD jagmisc.100062DB
1000651B . FB620010 DD jagmisc.100062FB
1000651F . 88630010 DD jagmisc.10006388
10006523 . 33630010 DD jagmisc.10006333
10006527 . ED630010 DD jagmisc.100063ED
1000652B . D5630010 DD jagmisc.100063D5
1000652F . A5630010 DD jagmisc.100063A5
10006533 /$ 55 PUSH EBP
10006534 |. 8BEC MOV EBP,ESP
10006536 |. 83EC 30 SUB ESP,30
10006539 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
1000653E |. 8945 FC MOV [LOCAL.1],EAX
10006541 |. 8B45 10 MOV EAX,[ARG.3]
10006544 |. 53 PUSH EBX
10006545 |. 8B5D 1C MOV EBX,[ARG.6]
10006548 |. 56 PUSH ESI
10006549 |. 8BC8 MOV ECX,EAX
1000654B |. BE FF7F0000 MOV ESI,7FFF
10006550 |. 81E1 00800000 AND ECX,8000
10006556 |. 23C6 AND EAX,ESI
10006558 |. 66:85C9 TEST CX,CX
1000655B |. 57 PUSH EDI
1000655C |. C645 E4 CC MOV BYTE PTR SS:[EBP-1C],0CC
10006560 |. C645 E5 CC MOV BYTE PTR SS:[EBP-1B],0CC
10006564 |. C645 E6 CC MOV BYTE PTR SS:[EBP-1A],0CC
10006568 |. C645 E7 CC MOV BYTE PTR SS:[EBP-19],0CC
1000656C |. C645 E8 CC MOV BYTE PTR SS:[EBP-18],0CC
10006570 |. C645 E9 CC MOV BYTE PTR SS:[EBP-17],0CC
10006574 |. C645 EA CC MOV BYTE PTR SS:[EBP-16],0CC
10006578 |. C645 EB CC MOV BYTE PTR SS:[EBP-15],0CC
1000657C |. C645 EC CC MOV BYTE PTR SS:[EBP-14],0CC
10006580 |. C645 ED CC MOV BYTE PTR SS:[EBP-13],0CC
10006584 |. C645 EE FB MOV BYTE PTR SS:[EBP-12],0FB
10006588 |. C645 EF 3F MOV BYTE PTR SS:[EBP-11],3F
1000658C |. C745 D4 01000000 MOV [LOCAL.11],1
10006593 |. 8BD0 MOV EDX,EAX
10006595 |. 74 06 JE SHORT jagmisc.1000659D
10006597 |. C643 02 2D MOV BYTE PTR DS:[EBX+2],2D
1000659B |. EB 04 JMP SHORT jagmisc.100065A1
1000659D |> C643 02 20 MOV BYTE PTR DS:[EBX+2],20
100065A1 |> 66:85D2 TEST DX,DX
100065A4 |. 8B7D 0C MOV EDI,[ARG.2]
100065A7 |. 75 0D JNZ SHORT jagmisc.100065B6
100065A9 |. 85FF TEST EDI,EDI
100065AB |. 75 09 JNZ SHORT jagmisc.100065B6
100065AD |. 397D 08 CMP [ARG.1],EDI
100065B0 |. 0F84 F3000000 JE jagmisc.100066A9
100065B6 |> 66:3BD6 CMP DX,SI
100065B9 |. 75 78 JNZ SHORT jagmisc.10006633
100065BB |. B8 00000080 MOV EAX,80000000
100065C0 |. 3BF8 CMP EDI,EAX
100065C2 |. 66:C703 0100 MOV WORD PTR DS:[EBX],1
100065C7 |. 75 06 JNZ SHORT jagmisc.100065CF
100065C9 |. 837D 08 00 CMP [ARG.1],0
100065CD |. 74 0F JE SHORT jagmisc.100065DE
100065CF |> F7C7 00000040 TEST EDI,40000000
100065D5 |. 75 07 JNZ SHORT jagmisc.100065DE
100065D7 |. 68 44890010 PUSH jagmisc.10008944 ; ASCII "1#SNAN"
100065DC |. EB 46 JMP SHORT jagmisc.10006624
100065DE |> 66:85C9 TEST CX,CX
100065E1 |. 74 15 JE SHORT jagmisc.100065F8
100065E3 |. 81FF 000000C0 CMP EDI,C0000000
100065E9 |. 75 0D JNZ SHORT jagmisc.100065F8
100065EB |. 837D 08 00 CMP [ARG.1],0
100065EF |. 75 2E JNZ SHORT jagmisc.1000661F
100065F1 |. 68 3C890010 PUSH jagmisc.1000893C ; ASCII "1#IND"
100065F6 |. EB 0F JMP SHORT jagmisc.10006607
100065F8 |> 3BF8 CMP EDI,EAX
100065FA |. 75 23 JNZ SHORT jagmisc.1000661F
100065FC |. 837D 08 00 CMP [ARG.1],0
10006600 |. 75 1D JNZ SHORT jagmisc.1000661F
10006602 |. 68 34890010 PUSH jagmisc.10008934 ; ASCII "1#INF"
10006607 |> 8D43 04 LEA EAX,DWORD PTR DS:[EBX+4]
1000660A |. 50 PUSH EAX
1000660B |. E8 20D2FFFF CALL jagmisc.10003830
10006610 |. C643 03 05 MOV BYTE PTR DS:[EBX+3],5
10006614 |> 8365 D4 00 AND [LOCAL.11],0
10006618 |. 59 POP ECX ; kernel32.7C816FD7
10006619 |. 59 POP ECX ; kernel32.7C816FD7
1000661A |. E9 6C010000 JMP jagmisc.1000678B
1000661F |> 68 2C890010 PUSH jagmisc.1000892C ; ASCII "1#QNAN"
10006624 |> 8D43 04 LEA EAX,DWORD PTR DS:[EBX+4]
10006627 |. 50 PUSH EAX
10006628 |. E8 03D2FFFF CALL jagmisc.10003830
1000662D |. C643 03 06 MOV BYTE PTR DS:[EBX+3],6
10006631 |.^ EB E1 JMP SHORT jagmisc.10006614
10006633 |> 0FB7C2 MOVZX EAX,DX
10006636 |. 8BF0 MOV ESI,EAX
10006638 |. 69C0 104D0000 IMUL EAX,EAX,4D10
1000663E |. 66:8365 F0 00 AND WORD PTR SS:[EBP-10],0
10006643 |. 8BCF MOV ECX,EDI
10006645 |. C1E9 18 SHR ECX,18
10006648 |. C1EE 08 SHR ESI,8
1000664B |. 8D0C4E LEA ECX,DWORD PTR DS:[ESI+ECX*2]
1000664E |. 6BC9 4D IMUL ECX,ECX,4D
10006651 |. 8DB401 0CEDBCEC LEA ESI,DWORD PTR DS:[ECX+EAX+ECBCED0C]
10006658 |. 8B45 08 MOV EAX,[ARG.1]
1000665B |. 8945 F2 MOV DWORD PTR SS:[EBP-E],EAX
1000665E |. C1FE 10 SAR ESI,10
10006661 |. 0FBFC6 MOVSX EAX,SI
10006664 |. F7D8 NEG EAX
10006666 |. 6A 01 PUSH 1
10006668 |. 50 PUSH EAX
10006669 |. 8D45 F0 LEA EAX,[LOCAL.4]
1000666C |. 50 PUSH EAX
1000666D |. 66:8955 FA MOV WORD PTR SS:[EBP-6],DX
10006671 |. 897D F6 MOV DWORD PTR SS:[EBP-A],EDI
10006674 |. E8 EB100000 CALL jagmisc.10007764
10006679 |. 83C4 0C ADD ESP,0C
1000667C |. 66:817D FA FF3F CMP WORD PTR SS:[EBP-6],3FFF
10006682 |. 72 10 JB SHORT jagmisc.10006694
10006684 |. 8D45 E4 LEA EAX,[LOCAL.7]
10006687 |. 50 PUSH EAX
10006688 |. 8D45 F0 LEA EAX,[LOCAL.4]
1000668B |. 50 PUSH EAX
1000668C |. 46 INC ESI
1000668D |. E8 A00E0000 CALL jagmisc.10007532
10006692 |. 59 POP ECX ; kernel32.7C816FD7
10006693 |. 59 POP ECX ; kernel32.7C816FD7
10006694 |> F645 18 01 TEST BYTE PTR SS:[EBP+18],1
10006698 |. 8B7D 14 MOV EDI,[ARG.4]
1000669B |. 66:8933 MOV WORD PTR DS:[EBX],SI
1000669E |. 74 12 JE SHORT jagmisc.100066B2
100066A0 |. 0FBFC6 MOVSX EAX,SI
100066A3 |. 03F8 ADD EDI,EAX
100066A5 |. 85FF TEST EDI,EDI
100066A7 |. 7F 09 JG SHORT jagmisc.100066B2
100066A9 |> C643 04 30 MOV BYTE PTR DS:[EBX+4],30
100066AD |. E9 FA000000 JMP jagmisc.100067AC
100066B2 |> 83FF 15 CMP EDI,15
100066B5 |. 7E 03 JLE SHORT jagmisc.100066BA
100066B7 |. 6A 15 PUSH 15
100066B9 |. 5F POP EDI ; kernel32.7C816FD7
100066BA |> 0FB775 FA MOVZX ESI,WORD PTR SS:[EBP-6]
100066BE |. 81EE FE3F0000 SUB ESI,3FFE
100066C4 |. 66:8365 FA 00 AND WORD PTR SS:[EBP-6],0
100066C9 |. C745 10 08000000 MOV [ARG.3],8
100066D0 |> 8D45 F0 /LEA EAX,[LOCAL.4]
100066D3 |. 50 |PUSH EAX
100066D4 |. E8 EDF8FFFF |CALL jagmisc.10005FC6
100066D9 |. FF4D 10 |DEC [ARG.3]
100066DC |. 59 |POP ECX ; kernel32.7C816FD7
100066DD |.^ 75 F1 \JNZ SHORT jagmisc.100066D0
100066DF |. 85F6 TEST ESI,ESI
100066E1 |. 7D 17 JGE SHORT jagmisc.100066FA
100066E3 |. F7DE NEG ESI
100066E5 |. 81E6 FF000000 AND ESI,0FF
100066EB |. 7E 0D JLE SHORT jagmisc.100066FA
100066ED |> 8D45 F0 /LEA EAX,[LOCAL.4]
100066F0 |. 50 |PUSH EAX
100066F1 |. E8 FEF8FFFF |CALL jagmisc.10005FF4
100066F6 |. 4E |DEC ESI
100066F7 |. 59 |POP ECX ; kernel32.7C816FD7
100066F8 |.^ 75 F3 \JNZ SHORT jagmisc.100066ED
100066FA |> 8D4F 01 LEA ECX,DWORD PTR DS:[EDI+1]
100066FD |. 85C9 TEST ECX,ECX
100066FF |. 8D43 04 LEA EAX,DWORD PTR DS:[EBX+4]
10006702 |. 8945 D0 MOV [LOCAL.12],EAX
10006705 |. 7E 50 JLE SHORT jagmisc.10006757
10006707 |. 894D 10 MOV [ARG.3],ECX
1000670A |> 8D75 F0 /LEA ESI,[LOCAL.4]
1000670D |. 8D7D D8 |LEA EDI,[LOCAL.10]
10006710 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10006711 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10006712 |. 8D45 F0 |LEA EAX,[LOCAL.4]
10006715 |. 50 |PUSH EAX
10006716 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10006717 |. E8 AAF8FFFF |CALL jagmisc.10005FC6
1000671C |. 8D45 F0 |LEA EAX,[LOCAL.4]
1000671F |. 50 |PUSH EAX
10006720 |. E8 A1F8FFFF |CALL jagmisc.10005FC6
10006725 |. 8D45 D8 |LEA EAX,[LOCAL.10]
10006728 |. 50 |PUSH EAX
10006729 |. 8D45 F0 |LEA EAX,[LOCAL.4]
1000672C |. 50 |PUSH EAX
1000672D |. E8 36F8FFFF |CALL jagmisc.10005F68
10006732 |. 8D45 F0 |LEA EAX,[LOCAL.4]
10006735 |. 50 |PUSH EAX
10006736 |. E8 8BF8FFFF |CALL jagmisc.10005FC6
1000673B |. 8A45 FB |MOV AL,BYTE PTR SS:[EBP-5]
1000673E |. 8B4D D0 |MOV ECX,[LOCAL.12] ; ntdll.7C90EA53
10006741 |. 04 30 |ADD AL,30
10006743 |. 83C4 14 |ADD ESP,14
10006746 |. FF45 D0 |INC [LOCAL.12] ; ntdll.7C90EA53
10006749 |. FF4D 10 |DEC [ARG.3]
1000674C |. 8801 |MOV BYTE PTR DS:[ECX],AL
1000674E |. C645 FB 00 |MOV BYTE PTR SS:[EBP-5],0
10006752 |.^ 75 B6 \JNZ SHORT jagmisc.1000670A
10006754 |. 8B45 D0 MOV EAX,[LOCAL.12] ; ntdll.7C90EA53
10006757 |> 48 DEC EAX
10006758 |. 8A08 MOV CL,BYTE PTR DS:[EAX]
1000675A |. 48 DEC EAX
1000675B |. 80F9 35 CMP CL,35
1000675E |. 8D4B 04 LEA ECX,DWORD PTR DS:[EBX+4]
10006761 |. 7C 3E JL SHORT jagmisc.100067A1
10006763 |. EB 09 JMP SHORT jagmisc.1000676E
10006765 |> 8038 39 /CMP BYTE PTR DS:[EAX],39
10006768 |. 75 08 |JNZ SHORT jagmisc.10006772
1000676A |. C600 30 |MOV BYTE PTR DS:[EAX],30
1000676D |. 48 |DEC EAX
1000676E |> 3BC1 CMP EAX,ECX
10006770 |.^ 73 F3 \JNB SHORT jagmisc.10006765
10006772 |> 3BC1 CMP EAX,ECX
10006774 |. 73 04 JNB SHORT jagmisc.1000677A
10006776 |. 40 INC EAX
10006777 |. 66:FF03 INC WORD PTR DS:[EBX]
1000677A |> FE00 INC BYTE PTR DS:[EAX]
1000677C |> 2AC3 SUB AL,BL
1000677E |. 2C 03 SUB AL,3
10006780 |. 8843 03 MOV BYTE PTR DS:[EBX+3],AL
10006783 |. 0FBEC0 MOVSX EAX,AL
10006786 |. C64418 04 00 MOV BYTE PTR DS:[EAX+EBX+4],0
1000678B |> 8B45 D4 MOV EAX,[LOCAL.11]
1000678E |> 8B4D FC MOV ECX,[LOCAL.1]
10006791 |. 5F POP EDI ; kernel32.7C816FD7
10006792 |. 5E POP ESI ; kernel32.7C816FD7
10006793 |. 5B POP EBX ; kernel32.7C816FD7
10006794 |. E8 5DD3FFFF CALL jagmisc.10003AF6
10006799 |. C9 LEAVE
1000679A |. C3 RETN
1000679B |> 8038 30 /CMP BYTE PTR DS:[EAX],30
1000679E |. 75 05 |JNZ SHORT jagmisc.100067A5
100067A0 |. 48 |DEC EAX
100067A1 |> 3BC1 CMP EAX,ECX
100067A3 |.^ 73 F6 \JNB SHORT jagmisc.1000679B
100067A5 |> 3BC1 CMP EAX,ECX
100067A7 |.^ 73 D3 JNB SHORT jagmisc.1000677C
100067A9 |. C601 30 MOV BYTE PTR DS:[ECX],30
100067AC |> 66:8323 00 AND WORD PTR DS:[EBX],0
100067B0 |. 33C0 XOR EAX,EAX
100067B2 |. C643 02 20 MOV BYTE PTR DS:[EBX+2],20
100067B6 |. C643 03 01 MOV BYTE PTR DS:[EBX+3],1
100067BA |. C643 05 00 MOV BYTE PTR DS:[EBX+5],0
100067BE |. 40 INC EAX
100067BF \.^ EB CD JMP SHORT jagmisc.1000678E
100067C1 /. 55 PUSH EBP
100067C2 |. 8BEC MOV EBP,ESP
100067C4 |. 83EC 10 SUB ESP,10
100067C7 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
100067CC |. 85C0 TEST EAX,EAX
100067CE |. 74 07 JE SHORT jagmisc.100067D7
100067D0 |. 3D 4EE640BB CMP EAX,BB40E64E
100067D5 |. 75 4E JNZ SHORT jagmisc.10006825
100067D7 |> 56 PUSH ESI
100067D8 |. 8D45 F8 LEA EAX,[LOCAL.2]
100067DB |. 50 PUSH EAX ; /pFileTime = 00000008
100067DC |. FF15 F4800010 CALL DWORD PTR DS:[<&KERNEL32.GetSystemTimeAsFileTime>] ; \GetSystemTimeAsFileTime
100067E2 |. 8B75 FC MOV ESI,[LOCAL.1]
100067E5 |. 3375 F8 XOR ESI,[LOCAL.2] ; LOADDLL.00410249
100067E8 |. FF15 F0800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentProcessId>] ; [GetCurrentProcessId
100067EE |. 33F0 XOR ESI,EAX
100067F0 |. FF15 44800010 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentThreadId>] ; [GetCurrentThreadId
100067F6 |. 33F0 XOR ESI,EAX
100067F8 |. FF15 EC800010 CALL DWORD PTR DS:[<&KERNEL32.GetTickCount>] ; [GetTickCount
100067FE |. 33F0 XOR ESI,EAX
10006800 |. 8D45 F0 LEA EAX,[LOCAL.4]
10006803 |. 50 PUSH EAX ; /pPerformanceCount = 00000008
10006804 |. FF15 00800010 CALL DWORD PTR DS:[<&KERNEL32.QueryPerformanceCounter>] ; \QueryPerformanceCounter
1000680A |. 8B45 F4 MOV EAX,[LOCAL.3]
1000680D |. 3345 F0 XOR EAX,[LOCAL.4]
10006810 |. 33F0 XOR ESI,EAX
10006812 |. 8935 60A30010 MOV DWORD PTR DS:[1000A360],ESI
10006818 |. 75 0A JNZ SHORT jagmisc.10006824
1000681A |. C705 60A30010 4EE>MOV DWORD PTR DS:[1000A360],BB40E64E
10006824 |> 5E POP ESI ; kernel32.7C816FD7
10006825 |> C9 LEAVE
10006826 \. C3 RETN
10006827 $ 68 18010000 PUSH 118
1000682C . 68 F08A0010 PUSH jagmisc.10008AF0
10006831 . E8 3ABBFFFF CALL jagmisc.10002370
10006836 . A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
1000683B . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
1000683E . A1 B0AF0010 MOV EAX,DWORD PTR DS:[1000AFB0]
10006843 . 33C9 XOR ECX,ECX
10006845 . 3BC1 CMP EAX,ECX
10006847 . 74 1F JE SHORT jagmisc.10006868
10006849 . 894D FC MOV DWORD PTR SS:[EBP-4],ECX
1000684C . FF75 0C PUSH DWORD PTR SS:[EBP+C]
1000684F . FF75 08 PUSH DWORD PTR SS:[EBP+8]
10006852 . FFD0 CALL EAX
10006854 . 59 POP ECX ; kernel32.7C816FD7
10006855 . 59 POP ECX ; kernel32.7C816FD7
10006856 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
1000685A . E9 08010000 JMP jagmisc.10006967
1000685F . 33C0 XOR EAX,EAX
10006861 . 40 INC EAX
10006862 . C3 RETN
10006863 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451
10006866 .^ EB EE JMP SHORT jagmisc.10006856
10006868 > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
1000686B . 48 DEC EAX
1000686C . 74 16 JE SHORT jagmisc.10006884
1000686E . BF CC8A0010 MOV EDI,jagmisc.10008ACC ; ASCII "Unknown security failure detected!"
10006873 . C785 D8FEFFFF 188>MOV DWORD PTR SS:[EBP-128],jagmisc.10008A18 ; ASCII "A security error of unknown cause has been detected which has\ncorrupted the program's internal state. The program cannot safely\ncontinue execution and must now be terminated.\n"
1000687D . BE D4000000 MOV ESI,0D4
10006882 . EB 14 JMP SHORT jagmisc.10006898
10006884 > BF F8890010 MOV EDI,jagmisc.100089F8 ; ASCII "Buffer overrun detected!"
10006889 . C785 D8FEFFFF 588>MOV DWORD PTR SS:[EBP-128],jagmisc.10008958 ; ASCII "A buffer overrun has been detected which has corrupted the program's\ninternal state. The program cannot safely continue execution and must\nnow be terminated.\n"
10006893 . BE B9000000 MOV ESI,0B9
10006898 > 884D E0 MOV BYTE PTR SS:[EBP-20],CL
1000689B . 68 04010000 PUSH 104 ; /BufSize = 104 (260.)
100068A0 . 8D85 DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-124] ; |
100068A6 . 50 PUSH EAX ; |PathBuffer = 00000008
100068A7 . 51 PUSH ECX ; |hModule = FFFFFFFF
100068A8 . FF15 94800010 CALL DWORD PTR DS:[<&KERNEL32.GetModuleFileNameA>] ; \GetModuleFileNameA
100068AE . 85C0 TEST EAX,EAX
100068B0 . 75 13 JNZ SHORT jagmisc.100068C5
100068B2 . 68 64860010 PUSH jagmisc.10008664 ; ASCII "<program name unknown>"
100068B7 . 8D85 DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-124]
100068BD . 50 PUSH EAX
100068BE . E8 6DCFFFFF CALL jagmisc.10003830
100068C3 . 59 POP ECX ; kernel32.7C816FD7
100068C4 . 59 POP ECX ; kernel32.7C816FD7
100068C5 > 8D9D DCFEFFFF LEA EBX,DWORD PTR SS:[EBP-124]
100068CB . 8BC3 MOV EAX,EBX
100068CD . 50 PUSH EAX
100068CE . E8 CDCEFFFF CALL jagmisc.100037A0
100068D3 . 59 POP ECX ; kernel32.7C816FD7
100068D4 . 83C0 0B ADD EAX,0B
100068D7 . 83F8 3C CMP EAX,3C
100068DA . 76 25 JBE SHORT jagmisc.10006901
100068DC . 8BC3 MOV EAX,EBX
100068DE . 50 PUSH EAX
100068DF . E8 BCCEFFFF CALL jagmisc.100037A0
100068E4 . 8BD8 MOV EBX,EAX
100068E6 . 8D85 DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-124]
100068EC . 83E8 31 SUB EAX,31
100068EF . 03D8 ADD EBX,EAX
100068F1 . 6A 03 PUSH 3
100068F3 . 68 60860010 PUSH jagmisc.10008660 ; ASCII "..."
100068F8 . 53 PUSH EBX
100068F9 . E8 F2F0FFFF CALL jagmisc.100059F0
100068FE . 83C4 10 ADD ESP,10
10006901 > 53 PUSH EBX
10006902 . E8 99CEFFFF CALL jagmisc.100037A0
10006907 . 59 POP ECX ; kernel32.7C816FD7
10006908 . 8D4430 0C LEA EAX,DWORD PTR DS:[EAX+ESI+C]
1000690C . 83C0 03 ADD EAX,3
1000690F . 83E0 FC AND EAX,FFFFFFFC
10006912 . E8 99C4FFFF CALL jagmisc.10002DB0
10006917 . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
1000691A . 8BF4 MOV ESI,ESP
1000691C . 57 PUSH EDI
1000691D . 56 PUSH ESI
1000691E . E8 0DCFFFFF CALL jagmisc.10003830
10006923 . BF 40860010 MOV EDI,jagmisc.10008640 ; ASCII "\n\n"
10006928 . 57 PUSH EDI
10006929 . 56 PUSH ESI
1000692A . E8 11CFFFFF CALL jagmisc.10003840
1000692F . 68 4C890010 PUSH jagmisc.1000894C ; ASCII "Program: "
10006934 . 56 PUSH ESI
10006935 . E8 06CFFFFF CALL jagmisc.10003840
1000693A . 53 PUSH EBX
1000693B . 56 PUSH ESI
1000693C . E8 FFCEFFFF CALL jagmisc.10003840
10006941 . 57 PUSH EDI
10006942 . 56 PUSH ESI
10006943 . E8 F8CEFFFF CALL jagmisc.10003840
10006948 . FFB5 D8FEFFFF PUSH DWORD PTR SS:[EBP-128] ; msctfime.UIWndProc
1000694E . 56 PUSH ESI
1000694F . E8 ECCEFFFF CALL jagmisc.10003840
10006954 . 68 10200100 PUSH 12010
10006959 . 68 18860010 PUSH jagmisc.10008618 ; ASCII "Microsoft Visual C++ Runtime Library"
1000695E . 56 PUSH ESI
1000695F . E8 89EFFFFF CALL jagmisc.100058ED
10006964 . 83C4 3C ADD ESP,3C
10006967 > 6A 03 PUSH 3
10006969 . E8 F0B7FFFF CALL jagmisc.1000215E
1000696E . CC INT3
1000696F /$ 56 PUSH ESI
10006970 |. 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8]
10006974 |. 85F6 TEST ESI,ESI
10006976 |. 0F84 81010000 JE jagmisc.10006AFD
1000697C |. FF76 04 PUSH DWORD PTR DS:[ESI+4]
1000697F |. E8 79B9FFFF CALL jagmisc.100022FD
10006984 |. FF76 08 PUSH DWORD PTR DS:[ESI+8]
10006987 |. E8 71B9FFFF CALL jagmisc.100022FD
1000698C |. FF76 0C PUSH DWORD PTR DS:[ESI+C]
1000698F |. E8 69B9FFFF CALL jagmisc.100022FD
10006994 |. FF76 10 PUSH DWORD PTR DS:[ESI+10]
10006997 |. E8 61B9FFFF CALL jagmisc.100022FD
1000699C |. FF76 14 PUSH DWORD PTR DS:[ESI+14]
1000699F |. E8 59B9FFFF CALL jagmisc.100022FD
100069A4 |. FF76 18 PUSH DWORD PTR DS:[ESI+18]
100069A7 |. E8 51B9FFFF CALL jagmisc.100022FD
100069AC |. FF36 PUSH DWORD PTR DS:[ESI]
100069AE |. E8 4AB9FFFF CALL jagmisc.100022FD
100069B3 |. FF76 20 PUSH DWORD PTR DS:[ESI+20]
100069B6 |. E8 42B9FFFF CALL jagmisc.100022FD
100069BB |. FF76 24 PUSH DWORD PTR DS:[ESI+24]
100069BE |. E8 3AB9FFFF CALL jagmisc.100022FD
100069C3 |. FF76 28 PUSH DWORD PTR DS:[ESI+28]
100069C6 |. E8 32B9FFFF CALL jagmisc.100022FD
100069CB |. FF76 2C PUSH DWORD PTR DS:[ESI+2C]
100069CE |. E8 2AB9FFFF CALL jagmisc.100022FD
100069D3 |. FF76 30 PUSH DWORD PTR DS:[ESI+30]
100069D6 |. E8 22B9FFFF CALL jagmisc.100022FD
100069DB |. FF76 34 PUSH DWORD PTR DS:[ESI+34]
100069DE |. E8 1AB9FFFF CALL jagmisc.100022FD
100069E3 |. FF76 1C PUSH DWORD PTR DS:[ESI+1C]
100069E6 |. E8 12B9FFFF CALL jagmisc.100022FD
100069EB |. FF76 38 PUSH DWORD PTR DS:[ESI+38]
100069EE |. E8 0AB9FFFF CALL jagmisc.100022FD
100069F3 |. FF76 3C PUSH DWORD PTR DS:[ESI+3C]
100069F6 |. E8 02B9FFFF CALL jagmisc.100022FD
100069FB |. 83C4 40 ADD ESP,40
100069FE |. FF76 40 PUSH DWORD PTR DS:[ESI+40]
10006A01 |. E8 F7B8FFFF CALL jagmisc.100022FD
10006A06 |. FF76 44 PUSH DWORD PTR DS:[ESI+44]
10006A09 |. E8 EFB8FFFF CALL jagmisc.100022FD
10006A0E |. FF76 48 PUSH DWORD PTR DS:[ESI+48]
10006A11 |. E8 E7B8FFFF CALL jagmisc.100022FD
10006A16 |. FF76 4C PUSH DWORD PTR DS:[ESI+4C]
10006A19 |. E8 DFB8FFFF CALL jagmisc.100022FD
10006A1E |. FF76 50 PUSH DWORD PTR DS:[ESI+50]
10006A21 |. E8 D7B8FFFF CALL jagmisc.100022FD
10006A26 |. FF76 54 PUSH DWORD PTR DS:[ESI+54]
10006A29 |. E8 CFB8FFFF CALL jagmisc.100022FD
10006A2E |. FF76 58 PUSH DWORD PTR DS:[ESI+58]
10006A31 |. E8 C7B8FFFF CALL jagmisc.100022FD
10006A36 |. FF76 5C PUSH DWORD PTR DS:[ESI+5C]
10006A39 |. E8 BFB8FFFF CALL jagmisc.100022FD
10006A3E |. FF76 60 PUSH DWORD PTR DS:[ESI+60]
10006A41 |. E8 B7B8FFFF CALL jagmisc.100022FD
10006A46 |. FF76 64 PUSH DWORD PTR DS:[ESI+64]
10006A49 |. E8 AFB8FFFF CALL jagmisc.100022FD
10006A4E |. FF76 68 PUSH DWORD PTR DS:[ESI+68]
10006A51 |. E8 A7B8FFFF CALL jagmisc.100022FD
10006A56 |. FF76 6C PUSH DWORD PTR DS:[ESI+6C]
10006A59 |. E8 9FB8FFFF CALL jagmisc.100022FD
10006A5E |. FF76 70 PUSH DWORD PTR DS:[ESI+70]
10006A61 |. E8 97B8FFFF CALL jagmisc.100022FD
10006A66 |. FF76 74 PUSH DWORD PTR DS:[ESI+74]
10006A69 |. E8 8FB8FFFF CALL jagmisc.100022FD
10006A6E |. FF76 78 PUSH DWORD PTR DS:[ESI+78]
10006A71 |. E8 87B8FFFF CALL jagmisc.100022FD
10006A76 |. FF76 7C PUSH DWORD PTR DS:[ESI+7C]
10006A79 |. E8 7FB8FFFF CALL jagmisc.100022FD
10006A7E |. 83C4 40 ADD ESP,40
10006A81 |. FFB6 80000000 PUSH DWORD PTR DS:[ESI+80]
10006A87 |. E8 71B8FFFF CALL jagmisc.100022FD
10006A8C |. FFB6 84000000 PUSH DWORD PTR DS:[ESI+84]
10006A92 |. E8 66B8FFFF CALL jagmisc.100022FD
10006A97 |. FFB6 88000000 PUSH DWORD PTR DS:[ESI+88]
10006A9D |. E8 5BB8FFFF CALL jagmisc.100022FD
10006AA2 |. FFB6 8C000000 PUSH DWORD PTR DS:[ESI+8C]
10006AA8 |. E8 50B8FFFF CALL jagmisc.100022FD
10006AAD |. FFB6 90000000 PUSH DWORD PTR DS:[ESI+90]
10006AB3 |. E8 45B8FFFF CALL jagmisc.100022FD
10006AB8 |. FFB6 94000000 PUSH DWORD PTR DS:[ESI+94]
10006ABE |. E8 3AB8FFFF CALL jagmisc.100022FD
10006AC3 |. FFB6 98000000 PUSH DWORD PTR DS:[ESI+98]
10006AC9 |. E8 2FB8FFFF CALL jagmisc.100022FD
10006ACE |. FFB6 9C000000 PUSH DWORD PTR DS:[ESI+9C]
10006AD4 |. E8 24B8FFFF CALL jagmisc.100022FD
10006AD9 |. FFB6 A0000000 PUSH DWORD PTR DS:[ESI+A0]
10006ADF |. E8 19B8FFFF CALL jagmisc.100022FD
10006AE4 |. FFB6 A4000000 PUSH DWORD PTR DS:[ESI+A4]
10006AEA |. E8 0EB8FFFF CALL jagmisc.100022FD
10006AEF |. FFB6 A8000000 PUSH DWORD PTR DS:[ESI+A8]
10006AF5 |. E8 03B8FFFF CALL jagmisc.100022FD
10006AFA |. 83C4 2C ADD ESP,2C
10006AFD |> 5E POP ESI ; kernel32.7C816FD7
10006AFE \. C3 RETN
10006AFF /$ 56 PUSH ESI
10006B00 |. 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8]
10006B04 |. 85F6 TEST ESI,ESI
10006B06 |. 74 54 JE SHORT jagmisc.10006B5C
10006B08 |. 8B06 MOV EAX,DWORD PTR DS:[ESI]
10006B0A |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC
10006B10 |. 3B01 CMP EAX,DWORD PTR DS:[ECX]
10006B12 |. 74 0F JE SHORT jagmisc.10006B23
10006B14 |. 3B05 FCA70010 CMP EAX,DWORD PTR DS:[1000A7FC] ; jagmisc.1000A7F8
10006B1A |. 74 07 JE SHORT jagmisc.10006B23
10006B1C |. 50 PUSH EAX
10006B1D |. E8 DBB7FFFF CALL jagmisc.100022FD
10006B22 |. 59 POP ECX ; kernel32.7C816FD7
10006B23 |> 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]
10006B26 |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC
10006B2C |. 3B41 04 CMP EAX,DWORD PTR DS:[ECX+4]
10006B2F |. 74 0F JE SHORT jagmisc.10006B40
10006B31 |. 3B05 00A80010 CMP EAX,DWORD PTR DS:[1000A800] ; jagmisc.1000AFC8
10006B37 |. 74 07 JE SHORT jagmisc.10006B40
10006B39 |. 50 PUSH EAX
10006B3A |. E8 BEB7FFFF CALL jagmisc.100022FD
10006B3F |. 59 POP ECX ; kernel32.7C816FD7
10006B40 |> 8B76 08 MOV ESI,DWORD PTR DS:[ESI+8]
10006B43 |. A1 2CA80010 MOV EAX,DWORD PTR DS:[1000A82C]
10006B48 |. 3B70 08 CMP ESI,DWORD PTR DS:[EAX+8]
10006B4B |. 74 0F JE SHORT jagmisc.10006B5C
10006B4D |. 3B35 04A80010 CMP ESI,DWORD PTR DS:[1000A804] ; jagmisc.1000AFC8
10006B53 |. 74 07 JE SHORT jagmisc.10006B5C
10006B55 |. 56 PUSH ESI
10006B56 |. E8 A2B7FFFF CALL jagmisc.100022FD
10006B5B |. 59 POP ECX ; kernel32.7C816FD7
10006B5C |> 5E POP ESI ; kernel32.7C816FD7
10006B5D \. C3 RETN
10006B5E /$ 56 PUSH ESI
10006B5F |. 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8]
10006B63 |. 85F6 TEST ESI,ESI
10006B65 |. 0F84 CA000000 JE jagmisc.10006C35
10006B6B |. 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C]
10006B6E |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC
10006B74 |. 3B41 0C CMP EAX,DWORD PTR DS:[ECX+C]
10006B77 |. 74 0F JE SHORT jagmisc.10006B88
10006B79 |. 3B05 08A80010 CMP EAX,DWORD PTR DS:[1000A808] ; jagmisc.1000AFC8
10006B7F |. 74 07 JE SHORT jagmisc.10006B88
10006B81 |. 50 PUSH EAX
10006B82 |. E8 76B7FFFF CALL jagmisc.100022FD
10006B87 |. 59 POP ECX ; kernel32.7C816FD7
10006B88 |> 8B46 10 MOV EAX,DWORD PTR DS:[ESI+10]
10006B8B |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC
10006B91 |. 3B41 10 CMP EAX,DWORD PTR DS:[ECX+10]
10006B94 |. 74 0F JE SHORT jagmisc.10006BA5
10006B96 |. 3B05 0CA80010 CMP EAX,DWORD PTR DS:[1000A80C] ; jagmisc.1000AFC8
10006B9C |. 74 07 JE SHORT jagmisc.10006BA5
10006B9E |. 50 PUSH EAX
10006B9F |. E8 59B7FFFF CALL jagmisc.100022FD
10006BA4 |. 59 POP ECX ; kernel32.7C816FD7
10006BA5 |> 8B46 14 MOV EAX,DWORD PTR DS:[ESI+14]
10006BA8 |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC
10006BAE |. 3B41 14 CMP EAX,DWORD PTR DS:[ECX+14]
10006BB1 |. 74 0F JE SHORT jagmisc.10006BC2
10006BB3 |. 3B05 10A80010 CMP EAX,DWORD PTR DS:[1000A810] ; jagmisc.1000AFC8
10006BB9 |. 74 07 JE SHORT jagmisc.10006BC2
10006BBB |. 50 PUSH EAX
10006BBC |. E8 3CB7FFFF CALL jagmisc.100022FD
10006BC1 |. 59 POP ECX ; kernel32.7C816FD7
10006BC2 |> 8B46 18 MOV EAX,DWORD PTR DS:[ESI+18]
10006BC5 |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC
10006BCB |. 3B41 18 CMP EAX,DWORD PTR DS:[ECX+18]
10006BCE |. 74 0F JE SHORT jagmisc.10006BDF
10006BD0 |. 3B05 14A80010 CMP EAX,DWORD PTR DS:[1000A814] ; jagmisc.1000AFC8
10006BD6 |. 74 07 JE SHORT jagmisc.10006BDF
10006BD8 |. 50 PUSH EAX
10006BD9 |. E8 1FB7FFFF CALL jagmisc.100022FD
10006BDE |. 59 POP ECX ; kernel32.7C816FD7
10006BDF |> 8B46 1C MOV EAX,DWORD PTR DS:[ESI+1C]
10006BE2 |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC
10006BE8 |. 3B41 1C CMP EAX,DWORD PTR DS:[ECX+1C]
10006BEB |. 74 0F JE SHORT jagmisc.10006BFC
10006BED |. 3B05 18A80010 CMP EAX,DWORD PTR DS:[1000A818] ; jagmisc.1000AFC8
10006BF3 |. 74 07 JE SHORT jagmisc.10006BFC
10006BF5 |. 50 PUSH EAX
10006BF6 |. E8 02B7FFFF CALL jagmisc.100022FD
10006BFB |. 59 POP ECX ; kernel32.7C816FD7
10006BFC |> 8B46 20 MOV EAX,DWORD PTR DS:[ESI+20]
10006BFF |. 8B0D 2CA80010 MOV ECX,DWORD PTR DS:[1000A82C] ; jagmisc.1000A7FC
10006C05 |. 3B41 20 CMP EAX,DWORD PTR DS:[ECX+20]
10006C08 |. 74 0F JE SHORT jagmisc.10006C19
10006C0A |. 3B05 1CA80010 CMP EAX,DWORD PTR DS:[1000A81C] ; jagmisc.1000AFC8
10006C10 |. 74 07 JE SHORT jagmisc.10006C19
10006C12 |. 50 PUSH EAX
10006C13 |. E8 E5B6FFFF CALL jagmisc.100022FD
10006C18 |. 59 POP ECX ; kernel32.7C816FD7
10006C19 |> 8B76 24 MOV ESI,DWORD PTR DS:[ESI+24]
10006C1C |. A1 2CA80010 MOV EAX,DWORD PTR DS:[1000A82C]
10006C21 |. 3B70 24 CMP ESI,DWORD PTR DS:[EAX+24]
10006C24 |. 74 0F JE SHORT jagmisc.10006C35
10006C26 |. 3B35 20A80010 CMP ESI,DWORD PTR DS:[1000A820] ; jagmisc.1000AFC8
10006C2C |. 74 07 JE SHORT jagmisc.10006C35
10006C2E |. 56 PUSH ESI
10006C2F |. E8 C9B6FFFF CALL jagmisc.100022FD
10006C34 |. 59 POP ECX ; kernel32.7C816FD7
10006C35 |> 5E POP ESI ; kernel32.7C816FD7
10006C36 \. C3 RETN
10006C37 CC INT3
10006C38 CC INT3
10006C39 CC INT3
10006C3A CC INT3
10006C3B CC INT3
10006C3C CC INT3
10006C3D CC INT3
10006C3E CC INT3
10006C3F CC INT3
10006C40 /. 55 PUSH EBP
10006C41 |. 8BEC MOV EBP,ESP
10006C43 |. 56 PUSH ESI
10006C44 |. 33C0 XOR EAX,EAX
10006C46 |. 50 PUSH EAX
10006C47 |. 50 PUSH EAX
10006C48 |. 50 PUSH EAX
10006C49 |. 50 PUSH EAX
10006C4A |. 50 PUSH EAX
10006C4B |. 50 PUSH EAX
10006C4C |. 50 PUSH EAX
10006C4D |. 50 PUSH EAX
10006C4E |. 8B55 0C MOV EDX,[ARG.2]
10006C51 |. 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
10006C54 |> 8A02 /MOV AL,BYTE PTR DS:[EDX]
10006C56 |. 0AC0 |OR AL,AL
10006C58 |. 74 09 |JE SHORT jagmisc.10006C63
10006C5A |. 83C2 01 |ADD EDX,1
10006C5D |. 0FAB0424 |BTS DWORD PTR SS:[ESP],EAX
10006C61 |.^ EB F1 \JMP SHORT jagmisc.10006C54
10006C63 |> 8B75 08 MOV ESI,[ARG.1]
10006C66 |. 83C9 FF OR ECX,FFFFFFFF
10006C69 |. 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
10006C6C |> 83C1 01 /ADD ECX,1
10006C6F |. 8A06 |MOV AL,BYTE PTR DS:[ESI]
10006C71 |. 0AC0 |OR AL,AL
10006C73 |. 74 09 |JE SHORT jagmisc.10006C7E
10006C75 |. 83C6 01 |ADD ESI,1
10006C78 |. 0FA30424 |BT DWORD PTR SS:[ESP],EAX
10006C7C |.^ 73 EE \JNB SHORT jagmisc.10006C6C
10006C7E |> 8BC1 MOV EAX,ECX
10006C80 |. 83C4 20 ADD ESP,20
10006C83 |. 5E POP ESI ; kernel32.7C816FD7
10006C84 |. C9 LEAVE
10006C85 \. C3 RETN
10006C86 CC INT3
10006C87 CC INT3
10006C88 CC INT3
10006C89 CC INT3
10006C8A CC INT3
10006C8B CC INT3
10006C8C CC INT3
10006C8D CC INT3
10006C8E CC INT3
10006C8F CC INT3
10006C90 . 8B5424 04 MOV EDX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10006C94 . 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8]
10006C98 . F7C2 03000000 TEST EDX,3
10006C9E . 75 3C JNZ SHORT jagmisc.10006CDC
10006CA0 > 8B02 MOV EAX,DWORD PTR DS:[EDX]
10006CA2 . 3A01 CMP AL,BYTE PTR DS:[ECX]
10006CA4 . 75 2E JNZ SHORT jagmisc.10006CD4
10006CA6 . 0AC0 OR AL,AL
10006CA8 . 74 26 JE SHORT jagmisc.10006CD0
10006CAA . 3A61 01 CMP AH,BYTE PTR DS:[ECX+1]
10006CAD . 75 25 JNZ SHORT jagmisc.10006CD4
10006CAF . 0AE4 OR AH,AH
10006CB1 . 74 1D JE SHORT jagmisc.10006CD0
10006CB3 . C1E8 10 SHR EAX,10
10006CB6 . 3A41 02 CMP AL,BYTE PTR DS:[ECX+2]
10006CB9 . 75 19 JNZ SHORT jagmisc.10006CD4
10006CBB . 0AC0 OR AL,AL
10006CBD . 74 11 JE SHORT jagmisc.10006CD0
10006CBF . 3A61 03 CMP AH,BYTE PTR DS:[ECX+3]
10006CC2 . 75 10 JNZ SHORT jagmisc.10006CD4
10006CC4 . 83C1 04 ADD ECX,4
10006CC7 . 83C2 04 ADD EDX,4
10006CCA . 0AE4 OR AH,AH
10006CCC .^ 75 D2 JNZ SHORT jagmisc.10006CA0
10006CCE . 8BFF MOV EDI,EDI
10006CD0 > 33C0 XOR EAX,EAX
10006CD2 . C3 RETN
10006CD3 90 NOP
10006CD4 > 1BC0 SBB EAX,EAX
10006CD6 . D1E0 SHL EAX,1
10006CD8 . 83C0 01 ADD EAX,1
10006CDB . C3 RETN
10006CDC > F7C2 01000000 TEST EDX,1
10006CE2 . 74 18 JE SHORT jagmisc.10006CFC
10006CE4 . 8A02 MOV AL,BYTE PTR DS:[EDX]
10006CE6 . 83C2 01 ADD EDX,1
10006CE9 . 3A01 CMP AL,BYTE PTR DS:[ECX]
10006CEB .^ 75 E7 JNZ SHORT jagmisc.10006CD4
10006CED . 83C1 01 ADD ECX,1
10006CF0 . 0AC0 OR AL,AL
10006CF2 .^ 74 DC JE SHORT jagmisc.10006CD0
10006CF4 . F7C2 02000000 TEST EDX,2
10006CFA .^ 74 A4 JE SHORT jagmisc.10006CA0
10006CFC > 66:8B02 MOV AX,WORD PTR DS:[EDX]
10006CFF . 83C2 02 ADD EDX,2
10006D02 . 3A01 CMP AL,BYTE PTR DS:[ECX]
10006D04 .^ 75 CE JNZ SHORT jagmisc.10006CD4
10006D06 . 0AC0 OR AL,AL
10006D08 .^ 74 C6 JE SHORT jagmisc.10006CD0
10006D0A . 3A61 01 CMP AH,BYTE PTR DS:[ECX+1]
10006D0D .^ 75 C5 JNZ SHORT jagmisc.10006CD4
10006D0F . 0AE4 OR AH,AH
10006D11 .^ 74 BD JE SHORT jagmisc.10006CD0
10006D13 . 83C1 02 ADD ECX,2
10006D16 .^ EB 88 JMP SHORT jagmisc.10006CA0
10006D18 CC INT3
10006D19 CC INT3
10006D1A CC INT3
10006D1B CC INT3
10006D1C CC INT3
10006D1D CC INT3
10006D1E CC INT3
10006D1F CC INT3
10006D20 . 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+C]
10006D24 . 85C0 TEST EAX,EAX
10006D26 . 74 4A JE SHORT jagmisc.10006D72
10006D28 . 8B5424 04 MOV EDX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
10006D2C . 56 PUSH ESI
10006D2D . 57 PUSH EDI
10006D2E . 8BF2 MOV ESI,EDX
10006D30 . 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10]
10006D34 . 0BD7 OR EDX,EDI
10006D36 . 83E2 03 AND EDX,3
10006D39 . 74 38 JE SHORT jagmisc.10006D73
10006D3B . A9 01000000 TEST EAX,1
10006D40 . 74 11 JE SHORT jagmisc.10006D53
10006D42 . 8A0E MOV CL,BYTE PTR DS:[ESI]
10006D44 . 3A0F CMP CL,BYTE PTR DS:[EDI]
10006D46 . 75 58 JNZ SHORT jagmisc.10006DA0
10006D48 . 83C6 01 ADD ESI,1
10006D4B . 83C7 01 ADD EDI,1
10006D4E . 83E8 01 SUB EAX,1
10006D51 . 74 1D JE SHORT jagmisc.10006D70
10006D53 > 8A0E MOV CL,BYTE PTR DS:[ESI]
10006D55 . 8A17 MOV DL,BYTE PTR DS:[EDI]
10006D57 . 38D1 CMP CL,DL
10006D59 . 75 45 JNZ SHORT jagmisc.10006DA0
10006D5B . 8A4E 01 MOV CL,BYTE PTR DS:[ESI+1]
10006D5E . 8A57 01 MOV DL,BYTE PTR DS:[EDI+1]
10006D61 . 38D1 CMP CL,DL
10006D63 . 75 3B JNZ SHORT jagmisc.10006DA0
10006D65 . 83C7 02 ADD EDI,2
10006D68 . 83C6 02 ADD ESI,2
10006D6B . 83E8 02 SUB EAX,2
10006D6E .^ 75 E3 JNZ SHORT jagmisc.10006D53
10006D70 > 5F POP EDI ; kernel32.7C816FD7
10006D71 . 5E POP ESI ; kernel32.7C816FD7
10006D72 > C3 RETN
10006D73 > 8BC8 MOV ECX,EAX
10006D75 . 83E0 03 AND EAX,3
10006D78 . C1E9 02 SHR ECX,2
10006D7B . 74 2B JE SHORT jagmisc.10006DA8
10006D7D . F3:A7 REPE CMPS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
10006D7F . 74 27 JE SHORT jagmisc.10006DA8
10006D81 . 8B4E FC MOV ECX,DWORD PTR DS:[ESI-4]
10006D84 . 8B57 FC MOV EDX,DWORD PTR DS:[EDI-4]
10006D87 . 38D1 CMP CL,DL
10006D89 . 75 10 JNZ SHORT jagmisc.10006D9B
10006D8B . 38F5 CMP CH,DH
10006D8D . 75 0C JNZ SHORT jagmisc.10006D9B
10006D8F . C1E9 10 SHR ECX,10
10006D92 . C1EA 10 SHR EDX,10
10006D95 . 38D1 CMP CL,DL
10006D97 . 75 02 JNZ SHORT jagmisc.10006D9B
10006D99 . 38F5 CMP CH,DH
10006D9B > B8 00000000 MOV EAX,0
10006DA0 > 1BC0 SBB EAX,EAX
10006DA2 . 5F POP EDI ; kernel32.7C816FD7
10006DA3 . 83D8 FF SBB EAX,-1
10006DA6 . 5E POP ESI ; kernel32.7C816FD7
10006DA7 . C3 RETN
10006DA8 > 85C0 TEST EAX,EAX
10006DAA .^ 74 C4 JE SHORT jagmisc.10006D70
10006DAC . 8B16 MOV EDX,DWORD PTR DS:[ESI]
10006DAE . 8B0F MOV ECX,DWORD PTR DS:[EDI]
10006DB0 . 38CA CMP DL,CL
10006DB2 .^ 75 E7 JNZ SHORT jagmisc.10006D9B
10006DB4 . 83E8 01 SUB EAX,1
10006DB7 . 74 1C JE SHORT jagmisc.10006DD5
10006DB9 . 38EE CMP DH,CH
10006DBB .^ 75 DE JNZ SHORT jagmisc.10006D9B
10006DBD . 83E8 01 SUB EAX,1
10006DC0 . 74 13 JE SHORT jagmisc.10006DD5
10006DC2 . 81E1 0000FF00 AND ECX,0FF0000
10006DC8 . 81E2 0000FF00 AND EDX,0FF0000
10006DCE . 3BD1 CMP EDX,ECX
10006DD0 .^ 75 C9 JNZ SHORT jagmisc.10006D9B
10006DD2 . 83E8 01 SUB EAX,1
10006DD5 > 5F POP EDI ; kernel32.7C816FD7
10006DD6 . 5E POP ESI ; kernel32.7C816FD7
10006DD7 . C3 RETN
10006DD8 $ 6A 1C PUSH 1C
10006DDA . 68 30910010 PUSH jagmisc.10009130
10006DDF . E8 8CB5FFFF CALL jagmisc.10002370
10006DE4 . 33F6 XOR ESI,ESI
10006DE6 . 3935 18B00010 CMP DWORD PTR DS:[1000B018],ESI
10006DEC . 75 35 JNZ SHORT jagmisc.10006E23
10006DEE . 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C]
10006DF1 . 50 PUSH EAX ; /CharTypes = 00000008
10006DF2 . 33FF XOR EDI,EDI ; |
10006DF4 . 47 INC EDI ; |
10006DF5 . 57 PUSH EDI ; |SrcCount = 0
10006DF6 . 68 04890010 PUSH jagmisc.10008904 ; |Source = ""
10006DFB . 57 PUSH EDI ; |InfoType = 0
10006DFC . FF15 00810010 CALL DWORD PTR DS:[<&KERNEL32.GetStringTypeW>] ; \GetStringTypeW
10006E02 . 85C0 TEST EAX,EAX
10006E04 . 74 08 JE SHORT jagmisc.10006E0E
10006E06 . 893D 18B00010 MOV DWORD PTR DS:[1000B018],EDI
10006E0C . EB 15 JMP SHORT jagmisc.10006E23
10006E0E > FF15 38800010 CALL DWORD PTR DS:[<&KERNEL32.GetLastError>] ; [GetLastError
10006E14 . 83F8 78 CMP EAX,78
10006E17 . 75 0A JNZ SHORT jagmisc.10006E23
10006E19 . C705 18B00010 020>MOV DWORD PTR DS:[1000B018],2
10006E23 > A1 18B00010 MOV EAX,DWORD PTR DS:[1000B018]
10006E28 . 83F8 02 CMP EAX,2
10006E2B . 0F84 EA000000 JE jagmisc.10006F1B
10006E31 . 3BC6 CMP EAX,ESI
10006E33 . 0F84 E2000000 JE jagmisc.10006F1B
10006E39 . 83F8 01 CMP EAX,1
10006E3C . 0F85 FF000000 JNZ jagmisc.10006F41
10006E42 . 8975 DC MOV DWORD PTR SS:[EBP-24],ESI
10006E45 . 8975 E0 MOV DWORD PTR SS:[EBP-20],ESI
10006E48 . 3975 18 CMP DWORD PTR SS:[EBP+18],ESI
10006E4B . 75 08 JNZ SHORT jagmisc.10006E55
10006E4D . A1 10B00010 MOV EAX,DWORD PTR DS:[1000B010]
10006E52 . 8945 18 MOV DWORD PTR SS:[EBP+18],EAX
10006E55 > 56 PUSH ESI ; /WideBufSize = 0
10006E56 . 56 PUSH ESI ; |WideCharBuf = NULL
10006E57 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |StringSize = 8054A6ED (-2141935891.)
10006E5A . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |StringToMap = ""
10006E5D . 33C0 XOR EAX,EAX ; |
10006E5F . 3975 20 CMP DWORD PTR SS:[EBP+20],ESI ; |
10006E62 . 0F95C0 SETNE AL ; |
10006E65 . 8D04C5 01000000 LEA EAX,DWORD PTR DS:[EAX*8+1] ; |
10006E6C . 50 PUSH EAX ; |Options = MB_ERR_INVALID_CHARS
10006E6D . FF75 18 PUSH DWORD PTR SS:[EBP+18] ; |CodePage = 8227C238
10006E70 . FF15 E4800010 CALL DWORD PTR DS:[<&KERNEL32.MultiByteToWideChar>] ; \MultiByteToWideChar
10006E76 . 8BF8 MOV EDI,EAX
10006E78 . 897D D8 MOV DWORD PTR SS:[EBP-28],EDI
10006E7B . 85FF TEST EDI,EDI
10006E7D . 0F84 BE000000 JE jagmisc.10006F41
10006E83 . 8365 FC 00 AND DWORD PTR SS:[EBP-4],0
10006E87 . 8D1C3F LEA EBX,DWORD PTR DS:[EDI+EDI]
10006E8A . 8BC3 MOV EAX,EBX
10006E8C . 83C0 03 ADD EAX,3
10006E8F . 83E0 FC AND EAX,FFFFFFFC
10006E92 . E8 19BFFFFF CALL jagmisc.10002DB0
10006E97 . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
10006E9A . 8BF4 MOV ESI,ESP
10006E9C . 8975 D4 MOV DWORD PTR SS:[EBP-2C],ESI
10006E9F . 53 PUSH EBX
10006EA0 . 6A 00 PUSH 0
10006EA2 . 56 PUSH ESI
10006EA3 . E8 68CCFFFF CALL jagmisc.10003B10
10006EA8 . 83C4 0C ADD ESP,0C
10006EAB . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10006EAF . EB 15 JMP SHORT jagmisc.10006EC6
10006EB1 . 33C0 XOR EAX,EAX
10006EB3 . 40 INC EAX
10006EB4 . C3 RETN
10006EB5 . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451
10006EB8 . E8 92050000 CALL jagmisc.1000744F
10006EBD . 33F6 XOR ESI,ESI
10006EBF . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10006EC3 . 8B7D D8 MOV EDI,DWORD PTR SS:[EBP-28] ; kernel32.7C839AA8
10006EC6 > 85F6 TEST ESI,ESI
10006EC8 . 75 17 JNZ SHORT jagmisc.10006EE1
10006ECA . 57 PUSH EDI
10006ECB . 6A 02 PUSH 2
10006ECD . E8 6FB6FFFF CALL jagmisc.10002541
10006ED2 . 59 POP ECX ; kernel32.7C816FD7
10006ED3 . 59 POP ECX ; kernel32.7C816FD7
10006ED4 . 8BF0 MOV ESI,EAX
10006ED6 . 85F6 TEST ESI,ESI
10006ED8 . 74 67 JE SHORT jagmisc.10006F41
10006EDA . C745 E0 01000000 MOV DWORD PTR SS:[EBP-20],1
10006EE1 > 57 PUSH EDI ; /WideBufSize = 0
10006EE2 . 56 PUSH ESI ; |WideCharBuf = NULL
10006EE3 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |StringSize = 8054A6ED (-2141935891.)
10006EE6 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |StringToMap = ""
10006EE9 . 6A 01 PUSH 1 ; |Options = MB_PRECOMPOSED
10006EEB . FF75 18 PUSH DWORD PTR SS:[EBP+18] ; |CodePage = 8227C238
10006EEE . FF15 E4800010 CALL DWORD PTR DS:[<&KERNEL32.MultiByteToWideChar>] ; \MultiByteToWideChar
10006EF4 . 85C0 TEST EAX,EAX
10006EF6 . 74 11 JE SHORT jagmisc.10006F09
10006EF8 . FF75 14 PUSH DWORD PTR SS:[EBP+14] ; /CharTypes = 0006FFC8
10006EFB . 50 PUSH EAX ; |SrcCount = 8
10006EFC . 56 PUSH ESI ; |Source = NULL
10006EFD . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |InfoType = FFFFFFFF
10006F00 . FF15 00810010 CALL DWORD PTR DS:[<&KERNEL32.GetStringTypeW>] ; \GetStringTypeW
10006F06 . 8945 DC MOV DWORD PTR SS:[EBP-24],EAX
10006F09 > 837D E0 00 CMP DWORD PTR SS:[EBP-20],0
10006F0D . 74 07 JE SHORT jagmisc.10006F16
10006F0F . 56 PUSH ESI
10006F10 . E8 E8B3FFFF CALL jagmisc.100022FD
10006F15 . 59 POP ECX ; kernel32.7C816FD7
10006F16 > 8B45 DC MOV EAX,DWORD PTR SS:[EBP-24] ; kernel32.7C802458
10006F19 . EB 6E JMP SHORT jagmisc.10006F89
10006F1B > 8B5D 1C MOV EBX,DWORD PTR SS:[EBP+1C]
10006F1E . 3BDE CMP EBX,ESI
10006F20 . 75 06 JNZ SHORT jagmisc.10006F28
10006F22 . 8B1D 00B00010 MOV EBX,DWORD PTR DS:[1000B000]
10006F28 > 8B7D 18 MOV EDI,DWORD PTR SS:[EBP+18]
10006F2B . 85FF TEST EDI,EDI
10006F2D . 75 06 JNZ SHORT jagmisc.10006F35
10006F2F . 8B3D 10B00010 MOV EDI,DWORD PTR DS:[1000B010]
10006F35 > 53 PUSH EBX
10006F36 . E8 08030000 CALL jagmisc.10007243
10006F3B . 59 POP ECX ; kernel32.7C816FD7
10006F3C . 83F8 FF CMP EAX,-1
10006F3F . 75 04 JNZ SHORT jagmisc.10006F45
10006F41 > 33C0 XOR EAX,EAX
10006F43 . EB 44 JMP SHORT jagmisc.10006F89
10006F45 > 3BC7 CMP EAX,EDI
10006F47 . 74 1E JE SHORT jagmisc.10006F67
10006F49 . 6A 00 PUSH 0
10006F4B . 6A 00 PUSH 0
10006F4D . 8D4D 10 LEA ECX,DWORD PTR SS:[EBP+10]
10006F50 . 51 PUSH ECX
10006F51 . FF75 0C PUSH DWORD PTR SS:[EBP+C]
10006F54 . 50 PUSH EAX
10006F55 . 57 PUSH EDI
10006F56 . E8 2B030000 CALL jagmisc.10007286
10006F5B . 83C4 18 ADD ESP,18
10006F5E . 8BF0 MOV ESI,EAX
10006F60 . 85F6 TEST ESI,ESI
10006F62 .^ 74 DD JE SHORT jagmisc.10006F41
10006F64 . 8975 0C MOV DWORD PTR SS:[EBP+C],ESI
10006F67 > FF75 14 PUSH DWORD PTR SS:[EBP+14] ; /CharTypes = 0006FFC8
10006F6A . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |SrcSize = 8054A6ED (-2141935891.)
10006F6D . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |Source = ""
10006F70 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |InfoType = FFFFFFFF
10006F73 . 53 PUSH EBX ; |LocaleId = 0
10006F74 . FF15 FC800010 CALL DWORD PTR DS:[<&KERNEL32.GetStringTypeA>] ; \GetStringTypeA
10006F7A . 8BF8 MOV EDI,EAX
10006F7C . 85F6 TEST ESI,ESI
10006F7E . 74 07 JE SHORT jagmisc.10006F87
10006F80 . 56 PUSH ESI
10006F81 . E8 77B3FFFF CALL jagmisc.100022FD
10006F86 . 59 POP ECX ; kernel32.7C816FD7
10006F87 > 8BC7 MOV EAX,EDI
10006F89 > 8D65 C8 LEA ESP,DWORD PTR SS:[EBP-38]
10006F8C . E8 1AB4FFFF CALL jagmisc.100023AB
10006F91 . C3 RETN
10006F92 CC INT3
10006F93 CC INT3
10006F94 CC INT3
10006F95 CC INT3
10006F96 CC INT3
10006F97 CC INT3
10006F98 CC INT3
10006F99 CC INT3
10006F9A CC INT3
10006F9B CC INT3
10006F9C CC INT3
10006F9D CC INT3
10006F9E CC INT3
10006F9F CC INT3
10006FA0 /. 55 PUSH EBP
10006FA1 |. 8BEC MOV EBP,ESP
10006FA3 |. 57 PUSH EDI
10006FA4 |. 56 PUSH ESI
10006FA5 |. 53 PUSH EBX
10006FA6 |. 8B4D 10 MOV ECX,[ARG.3]
10006FA9 |. E3 27 JECXZ SHORT jagmisc.10006FD2
10006FAB |. 8BD9 MOV EBX,ECX
10006FAD |. 8B7D 08 MOV EDI,[ARG.1]
10006FB0 |. 8BF7 MOV ESI,EDI
10006FB2 |. 33C0 XOR EAX,EAX
10006FB4 |. F2:AE REPNE SCAS BYTE PTR ES:[EDI]
10006FB6 |. F7D9 NEG ECX
10006FB8 |. 03CB ADD ECX,EBX
10006FBA |. 8BFE MOV EDI,ESI
10006FBC |. 8B75 0C MOV ESI,[ARG.2]
10006FBF |. F3:A6 REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]
10006FC1 |. 8A46 FF MOV AL,BYTE PTR DS:[ESI-1]
10006FC4 |. 33C9 XOR ECX,ECX
10006FC6 |. 3A47 FF CMP AL,BYTE PTR DS:[EDI-1]
10006FC9 |. 77 05 JA SHORT jagmisc.10006FD0
10006FCB |. 74 05 JE SHORT jagmisc.10006FD2
10006FCD |. 83E9 02 SUB ECX,2
10006FD0 |> F7D1 NOT ECX
10006FD2 |> 8BC1 MOV EAX,ECX
10006FD4 |. 5B POP EBX ; kernel32.7C816FD7
10006FD5 |. 5E POP ESI ; kernel32.7C816FD7
10006FD6 |. 5F POP EDI ; kernel32.7C816FD7
10006FD7 |. C9 LEAVE
10006FD8 \. C3 RETN
10006FD9 CC INT3
10006FDA CC INT3
10006FDB CC INT3
10006FDC CC INT3
10006FDD CC INT3
10006FDE CC INT3
10006FDF CC INT3
10006FE0 /. 55 PUSH EBP
10006FE1 |. 8BEC MOV EBP,ESP
10006FE3 |. 56 PUSH ESI
10006FE4 |. 33C0 XOR EAX,EAX
10006FE6 |. 50 PUSH EAX
10006FE7 |. 50 PUSH EAX
10006FE8 |. 50 PUSH EAX
10006FE9 |. 50 PUSH EAX
10006FEA |. 50 PUSH EAX
10006FEB |. 50 PUSH EAX
10006FEC |. 50 PUSH EAX
10006FED |. 50 PUSH EAX
10006FEE |. 8B55 0C MOV EDX,[ARG.2]
10006FF1 |. 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
10006FF4 |> 8A02 /MOV AL,BYTE PTR DS:[EDX]
10006FF6 |. 0AC0 |OR AL,AL
10006FF8 |. 74 09 |JE SHORT jagmisc.10007003
10006FFA |. 83C2 01 |ADD EDX,1
10006FFD |. 0FAB0424 |BTS DWORD PTR SS:[ESP],EAX
10007001 |.^ EB F1 \JMP SHORT jagmisc.10006FF4
10007003 |> 8B75 08 MOV ESI,[ARG.1]
10007006 |. 8BFF MOV EDI,EDI
10007008 |> 8A06 /MOV AL,BYTE PTR DS:[ESI]
1000700A |. 0AC0 |OR AL,AL
1000700C |. 74 0C |JE SHORT jagmisc.1000701A
1000700E |. 83C6 01 |ADD ESI,1
10007011 |. 0FA30424 |BT DWORD PTR SS:[ESP],EAX
10007015 |.^ 73 F1 \JNB SHORT jagmisc.10007008
10007017 |. 8D46 FF LEA EAX,DWORD PTR DS:[ESI-1]
1000701A |> 83C4 20 ADD ESP,20
1000701D |. 5E POP ESI ; kernel32.7C816FD7
1000701E |. C9 LEAVE
1000701F \. C3 RETN
10007020 $ 6A 14 PUSH 14
10007022 . 68 40910010 PUSH jagmisc.10009140
10007027 . E8 44B3FFFF CALL jagmisc.10002370
1000702C . 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
1000702F . 33DB XOR EBX,EBX
10007031 . 3BFB CMP EDI,EBX
10007033 . 75 0E JNZ SHORT jagmisc.10007043
10007035 . FF75 0C PUSH DWORD PTR SS:[EBP+C]
10007038 . E8 5FE5FFFF CALL jagmisc.1000559C
1000703D . 59 POP ECX ; kernel32.7C816FD7
1000703E . E9 84010000 JMP jagmisc.100071C7
10007043 > 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C]
10007046 . 3BF3 CMP ESI,EBX
10007048 . 75 0C JNZ SHORT jagmisc.10007056
1000704A . 57 PUSH EDI
1000704B . E8 ADB2FFFF CALL jagmisc.100022FD
10007050 . 59 POP ECX ; kernel32.7C816FD7
10007051 . E9 6F010000 JMP jagmisc.100071C5
10007056 > 833D 64B30010 03 CMP DWORD PTR DS:[1000B364],3
1000705D . 0F85 2E010000 JNZ jagmisc.10007191
10007063 > 895D E4 MOV DWORD PTR SS:[EBP-1C],EBX
10007066 . 83FE E0 CMP ESI,-20
10007069 . 0F87 F1000000 JA jagmisc.10007160
1000706F . 6A 04 PUSH 4 ; /Arg1 = 00000004
10007071 . E8 BECDFFFF CALL jagmisc.10003E34 ; \jagmisc.10003E34
10007076 . 59 POP ECX ; kernel32.7C816FD7
10007077 . 895D FC MOV DWORD PTR SS:[EBP-4],EBX
1000707A . 57 PUSH EDI
1000707B . E8 CDD5FFFF CALL jagmisc.1000464D
10007080 . 59 POP ECX ; kernel32.7C816FD7
10007081 . 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX
10007084 . 3BC3 CMP EAX,EBX
10007086 . 0F84 A4000000 JE jagmisc.10007130
1000708C . 3B35 24B10010 CMP ESI,DWORD PTR DS:[1000B124]
10007092 . 77 4C JA SHORT jagmisc.100070E0
10007094 . 56 PUSH ESI
10007095 . 57 PUSH EDI
10007096 . 50 PUSH EAX
10007097 . E8 B1DAFFFF CALL jagmisc.10004B4D
1000709C . 83C4 0C ADD ESP,0C
1000709F . 85C0 TEST EAX,EAX
100070A1 . 74 05 JE SHORT jagmisc.100070A8
100070A3 . 897D E4 MOV DWORD PTR SS:[EBP-1C],EDI
100070A6 . EB 38 JMP SHORT jagmisc.100070E0
100070A8 > 56 PUSH ESI
100070A9 . E8 7EDDFFFF CALL jagmisc.10004E2C
100070AE . 59 POP ECX ; kernel32.7C816FD7
100070AF . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
100070B2 . 3BC3 CMP EAX,EBX
100070B4 . 74 2A JE SHORT jagmisc.100070E0
100070B6 . 8B47 FC MOV EAX,DWORD PTR DS:[EDI-4]
100070B9 . 48 DEC EAX
100070BA . 8945 DC MOV DWORD PTR SS:[EBP-24],EAX
100070BD . 3BC6 CMP EAX,ESI
100070BF . 72 02 JB SHORT jagmisc.100070C3
100070C1 . 8BC6 MOV EAX,ESI
100070C3 > 50 PUSH EAX
100070C4 . 57 PUSH EDI
100070C5 . FF75 E4 PUSH DWORD PTR SS:[EBP-1C]
100070C8 . E8 E3E4FFFF CALL jagmisc.100055B0
100070CD . 57 PUSH EDI
100070CE . E8 7AD5FFFF CALL jagmisc.1000464D
100070D3 . 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX
100070D6 . 57 PUSH EDI
100070D7 . 50 PUSH EAX
100070D8 . E8 9BD5FFFF CALL jagmisc.10004678
100070DD . 83C4 18 ADD ESP,18
100070E0 > 395D E4 CMP DWORD PTR SS:[EBP-1C],EBX
100070E3 . 75 4B JNZ SHORT jagmisc.10007130
100070E5 . 3BF3 CMP ESI,EBX
100070E7 . 75 06 JNZ SHORT jagmisc.100070EF
100070E9 . 33F6 XOR ESI,ESI
100070EB . 46 INC ESI
100070EC . 8975 0C MOV DWORD PTR SS:[EBP+C],ESI
100070EF > 83C6 0F ADD ESI,0F
100070F2 . 83E6 F0 AND ESI,FFFFFFF0
100070F5 . 8975 0C MOV DWORD PTR SS:[EBP+C],ESI
100070F8 . 56 PUSH ESI ; /HeapSize = 0
100070F9 . 53 PUSH EBX ; |Flags = 0
100070FA . FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000
10007100 . FF15 80800010 CALL DWORD PTR DS:[<&KERNEL32.HeapAlloc>] ; \HeapAlloc
10007106 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
10007109 . 3BC3 CMP EAX,EBX
1000710B . 74 23 JE SHORT jagmisc.10007130
1000710D . 8B47 FC MOV EAX,DWORD PTR DS:[EDI-4]
10007110 . 48 DEC EAX
10007111 . 8945 DC MOV DWORD PTR SS:[EBP-24],EAX
10007114 . 3BC6 CMP EAX,ESI
10007116 . 72 02 JB SHORT jagmisc.1000711A
10007118 . 8BC6 MOV EAX,ESI
1000711A > 50 PUSH EAX
1000711B . 57 PUSH EDI
1000711C . FF75 E4 PUSH DWORD PTR SS:[EBP-1C]
1000711F . E8 8CE4FFFF CALL jagmisc.100055B0
10007124 . 57 PUSH EDI
10007125 . FF75 E0 PUSH DWORD PTR SS:[EBP-20]
10007128 . E8 4BD5FFFF CALL jagmisc.10004678
1000712D . 83C4 14 ADD ESP,14
10007130 > 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10007134 . E8 4F000000 CALL jagmisc.10007188
10007139 . 395D E0 CMP DWORD PTR SS:[EBP-20],EBX
1000713C . 75 22 JNZ SHORT jagmisc.10007160
1000713E . 3BF3 CMP ESI,EBX
10007140 . 75 03 JNZ SHORT jagmisc.10007145
10007142 . 33F6 XOR ESI,ESI
10007144 . 46 INC ESI
10007145 > 83C6 0F ADD ESI,0F
10007148 . 83E6 F0 AND ESI,FFFFFFF0
1000714B . 8975 0C MOV DWORD PTR SS:[EBP+C],ESI
1000714E . 56 PUSH ESI ; /NewSize = 0
1000714F . 57 PUSH EDI ; |pMemory = NULL
10007150 . 53 PUSH EBX ; |Flags = 0
10007151 . FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000
10007157 . FF15 CC800010 CALL DWORD PTR DS:[<&KERNEL32.HeapReAlloc>] ; \HeapReAlloc
1000715D . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
10007160 > 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
10007163 . 3BC3 CMP EAX,EBX
10007165 . 75 60 JNZ SHORT jagmisc.100071C7
10007167 . 391D 90AF0010 CMP DWORD PTR DS:[1000AF90],EBX
1000716D . 74 58 JE SHORT jagmisc.100071C7
1000716F . 56 PUSH ESI
10007170 . E8 CAE2FFFF CALL jagmisc.1000543F
10007175 . 59 POP ECX ; kernel32.7C816FD7
10007176 . 85C0 TEST EAX,EAX
10007178 .^ 0F85 E5FEFFFF JNZ jagmisc.10007063
1000717E . EB 45 JMP SHORT jagmisc.100071C5
10007180 33 DB 33 ; CHAR '3'
10007181 DB DB DB
10007182 8B DB 8B
10007183 75 DB 75 ; CHAR 'u'
10007184 0C DB 0C
10007185 8B DB 8B
10007186 7D DB 7D ; CHAR '}'
10007187 08 DB 08
10007188 /$ 6A 04 PUSH 4
1000718A |. E8 F0CBFFFF CALL jagmisc.10003D7F
1000718F |. 59 POP ECX ; kernel32.7C816FD7
10007190 \. C3 RETN
10007191 > 33C0 XOR EAX,EAX
10007193 . 83FE E0 CMP ESI,-20
10007196 . 77 16 JA SHORT jagmisc.100071AE
10007198 . 3BF3 CMP ESI,EBX
1000719A . 75 03 JNZ SHORT jagmisc.1000719F
1000719C . 33F6 XOR ESI,ESI
1000719E . 46 INC ESI
1000719F > 56 PUSH ESI ; /NewSize = 0
100071A0 . 57 PUSH EDI ; |pMemory = NULL
100071A1 . 53 PUSH EBX ; |Flags = 0
100071A2 . FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000
100071A8 . FF15 CC800010 CALL DWORD PTR DS:[<&KERNEL32.HeapReAlloc>] ; \HeapReAlloc
100071AE > 3BC3 CMP EAX,EBX
100071B0 . 75 15 JNZ SHORT jagmisc.100071C7
100071B2 . 391D 90AF0010 CMP DWORD PTR DS:[1000AF90],EBX
100071B8 . 74 0D JE SHORT jagmisc.100071C7
100071BA . 56 PUSH ESI
100071BB . E8 7FE2FFFF CALL jagmisc.1000543F
100071C0 . 59 POP ECX ; kernel32.7C816FD7
100071C1 . 85C0 TEST EAX,EAX
100071C3 .^ 75 CC JNZ SHORT jagmisc.10007191
100071C5 > 33C0 XOR EAX,EAX
100071C7 > E8 DFB1FFFF CALL jagmisc.100023AB
100071CC . C3 RETN
100071CD /$ 6A 10 PUSH 10
100071CF |. 68 50910010 PUSH jagmisc.10009150
100071D4 |. E8 97B1FFFF CALL jagmisc.10002370
100071D9 |. 833D 64B30010 03 CMP DWORD PTR DS:[1000B364],3
100071E0 |. 75 3A JNZ SHORT jagmisc.1000721C
100071E2 |. 6A 04 PUSH 4 ; /Arg1 = 00000004
100071E4 |. E8 4BCCFFFF CALL jagmisc.10003E34 ; \jagmisc.10003E34
100071E9 |. 59 POP ECX ; kernel32.7C816FD7
100071EA |. 8365 FC 00 AND [LOCAL.1],0
100071EE |. 8B75 08 MOV ESI,[ARG.1]
100071F1 |. 56 PUSH ESI
100071F2 |. E8 56D4FFFF CALL jagmisc.1000464D
100071F7 |. 59 POP ECX ; kernel32.7C816FD7
100071F8 |. 8945 E0 MOV [LOCAL.8],EAX
100071FB |. 85C0 TEST EAX,EAX
100071FD |. 74 0B JE SHORT jagmisc.1000720A
100071FF |. 8B76 FC MOV ESI,DWORD PTR DS:[ESI-4]
10007202 |. 83EE 09 SUB ESI,9
10007205 |. 8975 E4 MOV [LOCAL.7],ESI
10007208 |. EB 03 JMP SHORT jagmisc.1000720D
1000720A |> 8B75 E4 MOV ESI,[LOCAL.7]
1000720D |> 834D FC FF OR [LOCAL.1],FFFFFFFF
10007211 |. E8 24000000 CALL jagmisc.1000723A
10007216 |. 837D E0 00 CMP [LOCAL.8],0
1000721A |. 75 13 JNZ SHORT jagmisc.1000722F
1000721C |> FF75 08 PUSH [ARG.1] ; /pMemory = FFFFFFFF
1000721F |. 6A 00 PUSH 0 ; |Flags = 0
10007221 |. FF35 60B30010 PUSH DWORD PTR DS:[1000B360] ; |hHeap = 00390000
10007227 |. FF15 04810010 CALL DWORD PTR DS:[<&KERNEL32.HeapSize>] ; \HeapSize
1000722D |. 8BF0 MOV ESI,EAX
1000722F |> 8BC6 MOV EAX,ESI
10007231 |. E8 75B1FFFF CALL jagmisc.100023AB
10007236 \. C3 RETN
10007237 8B DB 8B
10007238 75 DB 75 ; CHAR 'u'
10007239 E4 DB E4
1000723A /$ 6A 04 PUSH 4
1000723C |. E8 3ECBFFFF CALL jagmisc.10003D7F
10007241 |. 59 POP ECX ; kernel32.7C816FD7
10007242 \. C3 RETN
10007243 /$ 55 PUSH EBP
10007244 |. 8BEC MOV EBP,ESP
10007246 |. 83EC 0C SUB ESP,0C
10007249 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
1000724E |. 6A 06 PUSH 6 ; /BufSize = 6
10007250 |. 8945 FC MOV [LOCAL.1],EAX ; |
10007253 |. 8D45 F4 LEA EAX,[LOCAL.3] ; |
10007256 |. 50 PUSH EAX ; |Buffer = 00000008
10007257 |. 68 04100000 PUSH 1004 ; |InfoType = 1004
1000725C |. FF75 08 PUSH [ARG.1] ; |LocaleId = FFFFFFFF
1000725F |. C645 FA 00 MOV BYTE PTR SS:[EBP-6],0 ; |
10007263 |. FF15 F8800010 CALL DWORD PTR DS:[<&KERNEL32.GetLocaleInfoA>] ; \GetLocaleInfoA
10007269 |. 85C0 TEST EAX,EAX
1000726B |. 75 05 JNZ SHORT jagmisc.10007272
1000726D |. 83C8 FF OR EAX,FFFFFFFF
10007270 |. EB 0A JMP SHORT jagmisc.1000727C
10007272 |> 8D45 F4 LEA EAX,[LOCAL.3]
10007275 |. 50 PUSH EAX
10007276 |. E8 C3050000 CALL jagmisc.1000783E
1000727B |. 59 POP ECX ; kernel32.7C816FD7
1000727C |> 8B4D FC MOV ECX,[LOCAL.1]
1000727F |. E8 72C8FFFF CALL jagmisc.10003AF6
10007284 |. C9 LEAVE
10007285 \. C3 RETN
10007286 $ 6A 38 PUSH 38
10007288 . 68 60910010 PUSH jagmisc.10009160
1000728D . E8 DEB0FFFF CALL jagmisc.10002370
10007292 . A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
10007297 . 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
1000729A . 33FF XOR EDI,EDI
1000729C . 897D CC MOV DWORD PTR SS:[EBP-34],EDI
1000729F . 897D BC MOV DWORD PTR SS:[EBP-44],EDI
100072A2 . 8B45 14 MOV EAX,DWORD PTR SS:[EBP+14]
100072A5 . 8B18 MOV EBX,DWORD PTR DS:[EAX]
100072A7 . 895D C0 MOV DWORD PTR SS:[EBP-40],EBX
100072AA . 897D C4 MOV DWORD PTR SS:[EBP-3C],EDI
100072AD . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
100072B0 . 3B45 0C CMP EAX,DWORD PTR SS:[EBP+C]
100072B3 . 0F84 73010000 JE jagmisc.1000742C
100072B9 . 8D4D D0 LEA ECX,DWORD PTR SS:[EBP-30]
100072BC . 51 PUSH ECX ; /pCPInfo = FFFFFFFF
100072BD . 50 PUSH EAX ; |CodePage = 8
100072BE . 8B35 C4800010 MOV ESI,DWORD PTR DS:[<&KERNEL32.GetCPInfo>] ; |kernel32.GetCPInfo
100072C4 . FFD6 CALL ESI ; \GetCPInfo
100072C6 . 85C0 TEST EAX,EAX
100072C8 . 74 20 JE SHORT jagmisc.100072EA
100072CA . 837D D0 01 CMP DWORD PTR SS:[EBP-30],1
100072CE . 75 1A JNZ SHORT jagmisc.100072EA
100072D0 . 8D45 D0 LEA EAX,DWORD PTR SS:[EBP-30]
100072D3 . 50 PUSH EAX ; /pCPInfo = 00000008
100072D4 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |CodePage = 7FFD9000
100072D7 . FFD6 CALL ESI ; \GetCPInfo
100072D9 . 85C0 TEST EAX,EAX
100072DB . 74 0D JE SHORT jagmisc.100072EA
100072DD . 837D D0 01 CMP DWORD PTR SS:[EBP-30],1
100072E1 . 75 07 JNZ SHORT jagmisc.100072EA
100072E3 . C745 C4 01000000 MOV DWORD PTR SS:[EBP-3C],1
100072EA > 397D C4 CMP DWORD PTR SS:[EBP-3C],EDI
100072ED . 74 1A JE SHORT jagmisc.10007309
100072EF . 83FB FF CMP EBX,-1
100072F2 . 74 04 JE SHORT jagmisc.100072F8
100072F4 . 8BF3 MOV ESI,EBX
100072F6 . EB 0C JMP SHORT jagmisc.10007304
100072F8 > FF75 10 PUSH DWORD PTR SS:[EBP+10]
100072FB . E8 A0C4FFFF CALL jagmisc.100037A0
10007300 . 59 POP ECX ; kernel32.7C816FD7
10007301 . 8BF0 MOV ESI,EAX
10007303 . 46 INC ESI
10007304 > 8975 C8 MOV DWORD PTR SS:[EBP-38],ESI
10007307 . EB 03 JMP SHORT jagmisc.1000730C
10007309 > 8B75 C8 MOV ESI,DWORD PTR SS:[EBP-38]
1000730C > 397D C4 CMP DWORD PTR SS:[EBP-3C],EDI
1000730F . 75 1A JNZ SHORT jagmisc.1000732B
10007311 . 57 PUSH EDI ; /WideBufSize = 0
10007312 . 57 PUSH EDI ; |WideCharBuf = NULL
10007313 . 53 PUSH EBX ; |StringSize = 0
10007314 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |StringToMap = 8054A6ED ???
10007317 . 6A 01 PUSH 1 ; |Options = MB_PRECOMPOSED
10007319 . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |CodePage = FFFFFFFF
1000731C . FF15 E4800010 CALL DWORD PTR DS:[<&KERNEL32.MultiByteToWideChar>] ; \MultiByteToWideChar
10007322 . 8BF0 MOV ESI,EAX
10007324 . 8975 C8 MOV DWORD PTR SS:[EBP-38],ESI
10007327 . 3BF7 CMP ESI,EDI
10007329 . 74 58 JE SHORT jagmisc.10007383
1000732B > 897D FC MOV DWORD PTR SS:[EBP-4],EDI
1000732E . 8D0436 LEA EAX,DWORD PTR DS:[ESI+ESI]
10007331 . 83C0 03 ADD EAX,3
10007334 . 83E0 FC AND EAX,FFFFFFFC
10007337 . E8 74BAFFFF CALL jagmisc.10002DB0
1000733C . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
1000733F . 8BDC MOV EBX,ESP
10007341 . 895D B8 MOV DWORD PTR SS:[EBP-48],EBX
10007344 . 8D0436 LEA EAX,DWORD PTR DS:[ESI+ESI]
10007347 . 50 PUSH EAX
10007348 . 57 PUSH EDI
10007349 . 53 PUSH EBX
1000734A . E8 C1C7FFFF CALL jagmisc.10003B10
1000734F . 83C4 0C ADD ESP,0C
10007352 . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
10007356 . EB 17 JMP SHORT jagmisc.1000736F
10007358 . 33C0 XOR EAX,EAX
1000735A . 40 INC EAX
1000735B . C3 RETN
1000735C . 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] ; kernel32.7C802451
1000735F . E8 EB000000 CALL jagmisc.1000744F
10007364 . 33FF XOR EDI,EDI
10007366 . 33DB XOR EBX,EBX
10007368 . 834D FC FF OR DWORD PTR SS:[EBP-4],FFFFFFFF
1000736C . 8B75 C8 MOV ESI,DWORD PTR SS:[EBP-38]
1000736F > 3BDF CMP EBX,EDI
10007371 . 75 1E JNZ SHORT jagmisc.10007391
10007373 . 56 PUSH ESI
10007374 . 6A 02 PUSH 2
10007376 . E8 C6B1FFFF CALL jagmisc.10002541
1000737B . 59 POP ECX ; kernel32.7C816FD7
1000737C . 59 POP ECX ; kernel32.7C816FD7
1000737D . 8BD8 MOV EBX,EAX
1000737F . 3BDF CMP EBX,EDI
10007381 . 75 07 JNZ SHORT jagmisc.1000738A
10007383 > 33C0 XOR EAX,EAX
10007385 . E9 B4000000 JMP jagmisc.1000743E
1000738A > C745 BC 01000000 MOV DWORD PTR SS:[EBP-44],1
10007391 > 56 PUSH ESI ; /WideBufSize = 0
10007392 . 53 PUSH EBX ; |WideCharBuf = NULL
10007393 . FF75 C0 PUSH DWORD PTR SS:[EBP-40] ; |StringSize = 0
10007396 . FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |StringToMap = 8054A6ED ???
10007399 . 6A 01 PUSH 1 ; |Options = MB_PRECOMPOSED
1000739B . FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |CodePage = FFFFFFFF
1000739E . FF15 E4800010 CALL DWORD PTR DS:[<&KERNEL32.MultiByteToWideChar>] ; \MultiByteToWideChar
100073A4 . 85C0 TEST EAX,EAX
100073A6 . 0F84 83000000 JE jagmisc.1000742F
100073AC . 397D 18 CMP DWORD PTR SS:[EBP+18],EDI
100073AF . 74 20 JE SHORT jagmisc.100073D1
100073B1 . 57 PUSH EDI ; /pDefaultCharUsed = NULL
100073B2 . 57 PUSH EDI ; |pDefaultChar = NULL
100073B3 . FF75 1C PUSH DWORD PTR SS:[EBP+1C] ; |MultiByteCount = FFFFFFFF (-1.)
100073B6 . FF75 18 PUSH DWORD PTR SS:[EBP+18] ; |MultiByteStr = 8227C238
100073B9 . 56 PUSH ESI ; |WideCharCount = 0
100073BA . 53 PUSH EBX ; |WideCharStr = NULL
100073BB . 57 PUSH EDI ; |Options = 0
100073BC . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |CodePage = 7FFD9000
100073BF . FF15 A4800010 CALL DWORD PTR DS:[<&KERNEL32.WideCharToMultiByte>] ; \WideCharToMultiByte
100073C5 . 85C0 TEST EAX,EAX
100073C7 . 74 66 JE SHORT jagmisc.1000742F
100073C9 . 8B45 18 MOV EAX,DWORD PTR SS:[EBP+18]
100073CC . 8945 CC MOV DWORD PTR SS:[EBP-34],EAX
100073CF . EB 5E JMP SHORT jagmisc.1000742F
100073D1 > 397D C4 CMP DWORD PTR SS:[EBP-3C],EDI
100073D4 . 75 16 JNZ SHORT jagmisc.100073EC
100073D6 . 57 PUSH EDI ; /pDefaultCharUsed = NULL
100073D7 . 57 PUSH EDI ; |pDefaultChar = NULL
100073D8 . 57 PUSH EDI ; |MultiByteCount = 0
100073D9 . 57 PUSH EDI ; |MultiByteStr = NULL
100073DA . 56 PUSH ESI ; |WideCharCount = 0
100073DB . 53 PUSH EBX ; |WideCharStr = NULL
100073DC . 57 PUSH EDI ; |Options = 0
100073DD . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |CodePage = 7FFD9000
100073E0 . FF15 A4800010 CALL DWORD PTR DS:[<&KERNEL32.WideCharToMultiByte>] ; \WideCharToMultiByte
100073E6 . 8BF0 MOV ESI,EAX
100073E8 . 3BF7 CMP ESI,EDI
100073EA . 74 43 JE SHORT jagmisc.1000742F
100073EC > 56 PUSH ESI
100073ED . 6A 01 PUSH 1
100073EF . E8 4DB1FFFF CALL jagmisc.10002541
100073F4 . 59 POP ECX ; kernel32.7C816FD7
100073F5 . 59 POP ECX ; kernel32.7C816FD7
100073F6 . 8945 CC MOV DWORD PTR SS:[EBP-34],EAX
100073F9 . 3BC7 CMP EAX,EDI
100073FB . 74 32 JE SHORT jagmisc.1000742F
100073FD . 57 PUSH EDI ; /pDefaultCharUsed = NULL
100073FE . 57 PUSH EDI ; |pDefaultChar = NULL
100073FF . 56 PUSH ESI ; |MultiByteCount = 0
10007400 . 50 PUSH EAX ; |MultiByteStr = 00000008
10007401 . 56 PUSH ESI ; |WideCharCount = 0
10007402 . 53 PUSH EBX ; |WideCharStr = NULL
10007403 . 57 PUSH EDI ; |Options = 0
10007404 . FF75 0C PUSH DWORD PTR SS:[EBP+C] ; |CodePage = 7FFD9000
10007407 . FF15 A4800010 CALL DWORD PTR DS:[<&KERNEL32.WideCharToMultiByte>] ; \WideCharToMultiByte
1000740D . 3BC7 CMP EAX,EDI
1000740F . 75 0E JNZ SHORT jagmisc.1000741F
10007411 . FF75 CC PUSH DWORD PTR SS:[EBP-34]
10007414 . E8 E4AEFFFF CALL jagmisc.100022FD
10007419 . 59 POP ECX ; kernel32.7C816FD7
1000741A . 897D CC MOV DWORD PTR SS:[EBP-34],EDI
1000741D . EB 10 JMP SHORT jagmisc.1000742F
1000741F > 837D C0 FF CMP DWORD PTR SS:[EBP-40],-1
10007423 . 74 0A JE SHORT jagmisc.1000742F
10007425 . 8B4D 14 MOV ECX,DWORD PTR SS:[EBP+14]
10007428 . 8901 MOV DWORD PTR DS:[ECX],EAX
1000742A . EB 03 JMP SHORT jagmisc.1000742F
1000742C > 8B5D B8 MOV EBX,DWORD PTR SS:[EBP-48]
1000742F > 397D BC CMP DWORD PTR SS:[EBP-44],EDI
10007432 . 74 07 JE SHORT jagmisc.1000743B
10007434 . 53 PUSH EBX
10007435 . E8 C3AEFFFF CALL jagmisc.100022FD
1000743A . 59 POP ECX ; kernel32.7C816FD7
1000743B > 8B45 CC MOV EAX,DWORD PTR SS:[EBP-34]
1000743E > 8D65 AC LEA ESP,DWORD PTR SS:[EBP-54]
10007441 . 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C]
10007444 . E8 ADC6FFFF CALL jagmisc.10003AF6
10007449 . E8 5DAFFFFF CALL jagmisc.100023AB
1000744E . C3 RETN
1000744F /$ 55 PUSH EBP
10007450 |. 8BEC MOV EBP,ESP
10007452 |. 83EC 4C SUB ESP,4C
10007455 |. 53 PUSH EBX
10007456 |. 56 PUSH ESI
10007457 |. 57 PUSH EDI
10007458 |. 6A 04 PUSH 4
1000745A |. 58 POP EAX ; kernel32.7C816FD7
1000745B |. E8 50B9FFFF CALL jagmisc.10002DB0
10007460 |. 8BF4 MOV ESI,ESP
10007462 |. 6A 1C PUSH 1C ; /BufSize = 1C (28.)
10007464 |. 8D45 D8 LEA EAX,[LOCAL.10] ; |
10007467 |. 50 PUSH EAX ; |Buffer = 00000008
10007468 |. 56 PUSH ESI ; |Address = NULL
10007469 |. FF15 D8800010 CALL DWORD PTR DS:[<&KERNEL32.VirtualQuery>] ; \VirtualQuery
1000746F |. 85C0 TEST EAX,EAX
10007471 |. 74 77 JE SHORT jagmisc.100074EA
10007473 |. 8B5D DC MOV EBX,[LOCAL.9] ; kernel32.7C802458
10007476 |. 8D45 B4 LEA EAX,[LOCAL.19]
10007479 |. 50 PUSH EAX ; /pSystemInfo = 00000008
1000747A |. FF15 0C810010 CALL DWORD PTR DS:[<&KERNEL32.GetSystemInfo>] ; \GetSystemInfo
10007480 |. 8B4D B8 MOV ECX,[LOCAL.18]
10007483 |. A1 8CAC0010 MOV EAX,DWORD PTR DS:[1000AC8C]
10007488 |. 8D79 FF LEA EDI,DWORD PTR DS:[ECX-1]
1000748B |. F7D7 NOT EDI
1000748D |. 23FE AND EDI,ESI
1000748F |. 2BF9 SUB EDI,ECX
10007491 |. 8BF0 MOV ESI,EAX
10007493 |. 4E DEC ESI
10007494 |. F7DE NEG ESI
10007496 |. 1BF6 SBB ESI,ESI
10007498 |. 83E6 F1 AND ESI,FFFFFFF1
1000749B |. 83C6 11 ADD ESI,11
1000749E |. 0FAFF1 IMUL ESI,ECX
100074A1 |. 03F3 ADD ESI,EBX
100074A3 |. 3BFE CMP EDI,ESI
100074A5 |. 894D F8 MOV [LOCAL.2],ECX
100074A8 |. 72 40 JB SHORT jagmisc.100074EA
100074AA |. 83F8 01 CMP EAX,1
100074AD |. 74 5C JE SHORT jagmisc.1000750B
100074AF |. 895D FC MOV [LOCAL.1],EBX
100074B2 |. BB 00100000 MOV EBX,1000
100074B7 |> 6A 1C /PUSH 1C ; /BufSize = 1C (28.)
100074B9 |. 8D45 D8 |LEA EAX,[LOCAL.10] ; |
100074BC |. 50 |PUSH EAX ; |Buffer = 00000008
100074BD |. FF75 FC |PUSH [LOCAL.1] ; |Address = NULL
100074C0 |. FF15 D8800010 |CALL DWORD PTR DS:[<&KERNEL32.VirtualQuery>] ; \VirtualQuery
100074C6 |. 85C0 |TEST EAX,EAX
100074C8 |. 74 20 |JE SHORT jagmisc.100074EA
100074CA |. 8B45 E4 |MOV EAX,[LOCAL.7]
100074CD |. 0145 FC |ADD [LOCAL.1],EAX
100074D0 |. 855D E8 |TEST [LOCAL.6],EBX
100074D3 |.^ 74 E2 \JE SHORT jagmisc.100074B7
100074D5 |. F645 ED 01 TEST BYTE PTR SS:[EBP-13],1
100074D9 |. 8B45 D8 MOV EAX,[LOCAL.10] ; kernel32.7C839AA8
100074DC |. 8945 FC MOV [LOCAL.1],EAX
100074DF |. 74 05 JE SHORT jagmisc.100074E6
100074E1 |. 33C0 XOR EAX,EAX
100074E3 |. 40 INC EAX
100074E4 |. EB 44 JMP SHORT jagmisc.1000752A
100074E6 |> 3BF8 CMP EDI,EAX
100074E8 |. 73 04 JNB SHORT jagmisc.100074EE
100074EA |> 33C0 XOR EAX,EAX
100074EC |. EB 3C JMP SHORT jagmisc.1000752A
100074EE |> 3BC6 CMP EAX,ESI
100074F0 |. 73 03 JNB SHORT jagmisc.100074F5
100074F2 |. 8975 FC MOV [LOCAL.1],ESI
100074F5 |> 6A 04 PUSH 4 ; /Protect = PAGE_READWRITE
100074F7 |. 53 PUSH EBX ; |AllocationType = 0
100074F8 |. FF75 F8 PUSH [LOCAL.2] ; |Size = 410249 (4260425.)
100074FB |. FF75 FC PUSH [LOCAL.1] ; |Address = NULL
100074FE |. FF15 C8800010 CALL DWORD PTR DS:[<&KERNEL32.VirtualAlloc>] ; \VirtualAlloc
10007504 |. A1 8CAC0010 MOV EAX,DWORD PTR DS:[1000AC8C]
10007509 |. EB 03 JMP SHORT jagmisc.1000750E
1000750B |> 897D FC MOV [LOCAL.1],EDI
1000750E |> 48 DEC EAX
1000750F |. F7D8 NEG EAX
10007511 |. 1BC0 SBB EAX,EAX
10007513 |. 25 03010000 AND EAX,103
10007518 |. 8D4D F4 LEA ECX,[LOCAL.3]
1000751B |. 51 PUSH ECX ; /pOldProtect = FFFFFFFF
1000751C |. 40 INC EAX ; |
1000751D |. 50 PUSH EAX ; |NewProtect = PAGE_WRITECOPY
1000751E |. FF75 F8 PUSH [LOCAL.2] ; |Size = 410249 (4260425.)
10007521 |. FF75 FC PUSH [LOCAL.1] ; |Address = NULL
10007524 |. FF15 08810010 CALL DWORD PTR DS:[<&KERNEL32.VirtualProtect>] ; \VirtualProtect
1000752A |> 8D65 A8 LEA ESP,[LOCAL.22]
1000752D |. 5F POP EDI ; kernel32.7C816FD7
1000752E |. 5E POP ESI ; kernel32.7C816FD7
1000752F |. 5B POP EBX ; kernel32.7C816FD7
10007530 |. C9 LEAVE
10007531 \. C3 RETN
10007532 /$ 55 PUSH EBP
10007533 |. 8BEC MOV EBP,ESP
10007535 |. 83EC 28 SUB ESP,28
10007538 |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
1000753D |. 53 PUSH EBX
1000753E |. 8B5D 0C MOV EBX,[ARG.2]
10007541 |. 8945 FC MOV [LOCAL.1],EAX
10007544 |. 33C0 XOR EAX,EAX
10007546 |. 33C9 XOR ECX,ECX
10007548 |. 66:8B4B 0A MOV CX,WORD PTR DS:[EBX+A]
1000754C |. 56 PUSH ESI
1000754D |. 8B75 08 MOV ESI,[ARG.1]
10007550 |. 8945 E4 MOV [LOCAL.7],EAX
10007553 |. 8945 F0 MOV [LOCAL.4],EAX
10007556 |. 8945 F4 MOV [LOCAL.3],EAX
10007559 |. 8945 F8 MOV [LOCAL.2],EAX
1000755C |. 66:8B46 0A MOV AX,WORD PTR DS:[ESI+A]
10007560 |. 57 PUSH EDI
10007561 |. 8BF9 MOV EDI,ECX
10007563 |. BA FF7F0000 MOV EDX,7FFF
10007568 |. 23CA AND ECX,EDX
1000756A |. 33F8 XOR EDI,EAX
1000756C |. 23C2 AND EAX,EDX
1000756E |. 81E7 00800000 AND EDI,8000
10007574 |. 66:3D FF7F CMP AX,7FFF
10007578 |. 8D1401 LEA EDX,DWORD PTR DS:[ECX+EAX]
1000757B |. 8955 08 MOV [ARG.1],EDX
1000757E |. 0F83 B8010000 JNB jagmisc.1000773C
10007584 |. 66:81F9 FF7F CMP CX,7FFF
10007589 |. 0F83 AD010000 JNB jagmisc.1000773C
1000758F |. 66:81FA FDBF CMP DX,0BFFD
10007594 |. 0F87 A2010000 JA jagmisc.1000773C
1000759A |. 66:81FA BF3F CMP DX,3FBF
1000759F |. 77 04 JA SHORT jagmisc.100075A5
100075A1 |. 33C0 XOR EAX,EAX
100075A3 |. EB 3A JMP SHORT jagmisc.100075DF
100075A5 |> 66:85C0 TEST AX,AX
100075A8 |. BA FFFFFF7F MOV EDX,7FFFFFFF
100075AD |. 75 18 JNZ SHORT jagmisc.100075C7
100075AF |. FF45 08 INC [ARG.1]
100075B2 |. 33C0 XOR EAX,EAX
100075B4 |. 8556 08 TEST DWORD PTR DS:[ESI+8],EDX
100075B7 |. 75 10 JNZ SHORT jagmisc.100075C9
100075B9 |. 3946 04 CMP DWORD PTR DS:[ESI+4],EAX
100075BC |. 75 0B JNZ SHORT jagmisc.100075C9
100075BE |. 3906 CMP DWORD PTR DS:[ESI],EAX
100075C0 |. 75 07 JNZ SHORT jagmisc.100075C9
100075C2 |. E9 6F010000 JMP jagmisc.10007736
100075C7 |> 33C0 XOR EAX,EAX
100075C9 |> 66:3BC8 CMP CX,AX
100075CC |. 75 1E JNZ SHORT jagmisc.100075EC
100075CE |. FF45 08 INC [ARG.1]
100075D1 |. 8553 08 TEST DWORD PTR DS:[EBX+8],EDX
100075D4 |. 75 16 JNZ SHORT jagmisc.100075EC
100075D6 |. 3943 04 CMP DWORD PTR DS:[EBX+4],EAX
100075D9 |. 75 11 JNZ SHORT jagmisc.100075EC
100075DB |. 3903 CMP DWORD PTR DS:[EBX],EAX
100075DD |. 75 0D JNZ SHORT jagmisc.100075EC
100075DF |> 8946 08 MOV DWORD PTR DS:[ESI+8],EAX
100075E2 |. 8946 04 MOV DWORD PTR DS:[ESI+4],EAX
100075E5 |. 8906 MOV DWORD PTR DS:[ESI],EAX
100075E7 |. E9 6B010000 JMP jagmisc.10007757
100075EC |> 8945 E8 MOV [LOCAL.6],EAX
100075EF |. 8D45 F4 LEA EAX,[LOCAL.3]
100075F2 |. 8945 EC MOV [LOCAL.5],EAX
100075F5 |. C745 0C 05000000 MOV [ARG.2],5
100075FC |> 8B45 E8 /MOV EAX,[LOCAL.6] ; kernel32.7C802451
100075FF |. 03C0 |ADD EAX,EAX
10007601 |. 837D 0C 00 |CMP [ARG.2],0
10007605 |. 7E 49 |JLE SHORT jagmisc.10007650
10007607 |. 03C6 |ADD EAX,ESI
10007609 |. 8945 DC |MOV [LOCAL.9],EAX
1000760C |. 8B45 0C |MOV EAX,[ARG.2]
1000760F |. 8D4B 08 |LEA ECX,DWORD PTR DS:[EBX+8]
10007612 |. 894D E0 |MOV [LOCAL.8],ECX
10007615 |. 8945 D8 |MOV [LOCAL.10],EAX
10007618 |> 8B45 E0 |/MOV EAX,[LOCAL.8]
1000761B |. 8B4D DC ||MOV ECX,[LOCAL.9] ; kernel32.7C802458
1000761E |. 0FB709 ||MOVZX ECX,WORD PTR DS:[ECX]
10007621 |. 0FB700 ||MOVZX EAX,WORD PTR DS:[EAX]
10007624 |. 0FAFC1 ||IMUL EAX,ECX
10007627 |. 8B4D EC ||MOV ECX,[LOCAL.5]
1000762A |. 83C1 FC ||ADD ECX,-4
1000762D |. 51 ||PUSH ECX
1000762E |. 50 ||PUSH EAX
1000762F |. FF31 ||PUSH DWORD PTR DS:[ECX]
10007631 |. E8 11E9FFFF ||CALL jagmisc.10005F47
10007636 |. 83C4 0C ||ADD ESP,0C
10007639 |. 85C0 ||TEST EAX,EAX
1000763B |. 74 06 ||JE SHORT jagmisc.10007643
1000763D |. 8B45 EC ||MOV EAX,[LOCAL.5]
10007640 |. 66:FF00 ||INC WORD PTR DS:[EAX]
10007643 |> 8345 DC 02 ||ADD [LOCAL.9],2
10007647 |. 836D E0 02 ||SUB [LOCAL.8],2
1000764B |. FF4D D8 ||DEC [LOCAL.10] ; kernel32.7C839AA8
1000764E |.^ 75 C8 |\JNZ SHORT jagmisc.10007618
10007650 |> 8345 EC 02 |ADD [LOCAL.5],2
10007654 |. FF45 E8 |INC [LOCAL.6] ; kernel32.7C802451
10007657 |. FF4D 0C |DEC [ARG.2]
1000765A |. 837D 0C 00 |CMP [ARG.2],0
1000765E |.^ 7F 9C \JG SHORT jagmisc.100075FC
10007660 |. 8145 08 02C00000 ADD [ARG.1],0C002
10007667 |. 66:837D 08 00 CMP WORD PTR SS:[EBP+8],0
1000766C |. 7E 25 JLE SHORT jagmisc.10007693
1000766E |> F645 FB 80 /TEST BYTE PTR SS:[EBP-5],80
10007672 |. 75 18 |JNZ SHORT jagmisc.1000768C
10007674 |. 8D45 F0 |LEA EAX,[LOCAL.4]
10007677 |. 50 |PUSH EAX
10007678 |. E8 49E9FFFF |CALL jagmisc.10005FC6
1000767D |. 8145 08 FFFF0000 |ADD [ARG.1],0FFFF
10007684 |. 66:837D 08 00 |CMP WORD PTR SS:[EBP+8],0
10007689 |. 59 |POP ECX ; kernel32.7C816FD7
1000768A |.^ 7F E2 \JG SHORT jagmisc.1000766E
1000768C |> 66:837D 08 00 CMP WORD PTR SS:[EBP+8],0
10007691 |. 7F 39 JG SHORT jagmisc.100076CC
10007693 |> 8145 08 FFFF0000 ADD [ARG.1],0FFFF
1000769A |. 66:837D 08 00 CMP WORD PTR SS:[EBP+8],0
1000769F |. 7D 2B JGE SHORT jagmisc.100076CC
100076A1 |. 8B45 08 MOV EAX,[ARG.1]
100076A4 |. F7D8 NEG EAX
100076A6 |. 0FB7D8 MOVZX EBX,AX
100076A9 |. 015D 08 ADD [ARG.1],EBX
100076AC |> F645 F0 01 /TEST BYTE PTR SS:[EBP-10],1
100076B0 |. 74 03 |JE SHORT jagmisc.100076B5
100076B2 |. FF45 E4 |INC [LOCAL.7]
100076B5 |> 8D45 F0 |LEA EAX,[LOCAL.4]
100076B8 |. 50 |PUSH EAX
100076B9 |. E8 36E9FFFF |CALL jagmisc.10005FF4
100076BE |. 4B |DEC EBX
100076BF |. 59 |POP ECX ; kernel32.7C816FD7
100076C0 |.^ 75 EA \JNZ SHORT jagmisc.100076AC
100076C2 |. 837D E4 00 CMP [LOCAL.7],0
100076C6 |. 74 04 JE SHORT jagmisc.100076CC
100076C8 |. 804D F0 01 OR BYTE PTR SS:[EBP-10],1
100076CC |> 66:817D F0 0080 CMP WORD PTR SS:[EBP-10],8000
100076D2 |. 77 0F JA SHORT jagmisc.100076E3
100076D4 |. 8B45 F0 MOV EAX,[LOCAL.4]
100076D7 |. 25 FFFF0100 AND EAX,1FFFF
100076DC |. 3D 00800100 CMP EAX,18000
100076E1 |. 75 35 JNZ SHORT jagmisc.10007718
100076E3 |> 837D F2 FF CMP DWORD PTR SS:[EBP-E],-1
100076E7 |. 75 2C JNZ SHORT jagmisc.10007715
100076E9 |. 8365 F2 00 AND DWORD PTR SS:[EBP-E],0
100076ED |. 837D F6 FF CMP DWORD PTR SS:[EBP-A],-1
100076F1 |. 75 1D JNZ SHORT jagmisc.10007710
100076F3 |. 8365 F6 00 AND DWORD PTR SS:[EBP-A],0
100076F7 |. 66:817D FA FFFF CMP WORD PTR SS:[EBP-6],0FFFF
100076FD |. 75 0B JNZ SHORT jagmisc.1000770A
100076FF |. FF45 08 INC [ARG.1]
10007702 |. 66:C745 FA 0080 MOV WORD PTR SS:[EBP-6],8000
10007708 |. EB 0E JMP SHORT jagmisc.10007718
1000770A |> 66:FF45 FA INC WORD PTR SS:[EBP-6]
1000770E |. EB 08 JMP SHORT jagmisc.10007718
10007710 |> FF45 F6 INC DWORD PTR SS:[EBP-A]
10007713 |. EB 03 JMP SHORT jagmisc.10007718
10007715 |> FF45 F2 INC DWORD PTR SS:[EBP-E]
10007718 |> 8B45 08 MOV EAX,[ARG.1]
1000771B |. 66:3D FF7F CMP AX,7FFF
1000771F |. 73 1B JNB SHORT jagmisc.1000773C
10007721 |. 66:8B4D F2 MOV CX,WORD PTR SS:[EBP-E]
10007725 |. 66:890E MOV WORD PTR DS:[ESI],CX
10007728 |. 8B4D F4 MOV ECX,[LOCAL.3]
1000772B |. 894E 02 MOV DWORD PTR DS:[ESI+2],ECX
1000772E |. 8B4D F8 MOV ECX,[LOCAL.2] ; LOADDLL.00410249
10007731 |. 894E 06 MOV DWORD PTR DS:[ESI+6],ECX
10007734 |. 0BC7 OR EAX,EDI
10007736 |> 66:8946 0A MOV WORD PTR DS:[ESI+A],AX
1000773A |. EB 1B JMP SHORT jagmisc.10007757
1000773C |> 66:F7DF NEG DI
1000773F |. 1BFF SBB EDI,EDI
10007741 |. 8366 04 00 AND DWORD PTR DS:[ESI+4],0
10007745 |. 81E7 00000080 AND EDI,80000000
1000774B |. 81C7 0080FF7F ADD EDI,7FFF8000
10007751 |. 8326 00 AND DWORD PTR DS:[ESI],0
10007754 |. 897E 08 MOV DWORD PTR DS:[ESI+8],EDI
10007757 |> 8B4D FC MOV ECX,[LOCAL.1]
1000775A |. 5F POP EDI ; kernel32.7C816FD7
1000775B |. 5E POP ESI ; kernel32.7C816FD7
1000775C |. 5B POP EBX ; kernel32.7C816FD7
1000775D |. E8 94C3FFFF CALL jagmisc.10003AF6
10007762 |. C9 LEAVE
10007763 \. C3 RETN
10007764 /$ 55 PUSH EBP
10007765 |. 8BEC MOV EBP,ESP
10007767 |. 83EC 10 SUB ESP,10
1000776A |. A1 60A30010 MOV EAX,DWORD PTR DS:[1000A360]
1000776F |. 53 PUSH EBX
10007770 |. BB F0A80010 MOV EBX,jagmisc.1000A8F0
10007775 |. 33C9 XOR ECX,ECX
10007777 |. 83EB 60 SUB EBX,60
1000777A |. 394D 0C CMP [ARG.2],ECX
1000777D |. 8945 FC MOV [LOCAL.1],EAX
10007780 |. 74 5D JE SHORT jagmisc.100077DF
10007782 |. 7D 0B JGE SHORT jagmisc.1000778F
10007784 |. F75D 0C NEG [ARG.2]
10007787 |. BB 50AA0010 MOV EBX,jagmisc.1000AA50
1000778C |. 83EB 60 SUB EBX,60
1000778F |> 394D 10 CMP [ARG.3],ECX
10007792 |. 75 06 JNZ SHORT jagmisc.1000779A
10007794 |. 8B45 08 MOV EAX,[ARG.1]
10007797 |. 66:8908 MOV WORD PTR DS:[EAX],CX
1000779A |> 394D 0C CMP [ARG.2],ECX
1000779D |. 74 40 JE SHORT jagmisc.100077DF
1000779F |. 56 PUSH ESI
100077A0 |. 57 PUSH EDI
100077A1 |> 8B45 0C /MOV EAX,[ARG.2]
100077A4 |. C17D 0C 03 |SAR [ARG.2],3
100077A8 |. 83E0 07 |AND EAX,7
100077AB |. 83C3 54 |ADD EBX,54
100077AE |. 3BC1 |CMP EAX,ECX
100077B0 |. 74 26 |JE SHORT jagmisc.100077D8
100077B2 |. 8D0440 |LEA EAX,DWORD PTR DS:[EAX+EAX*2]
100077B5 |. 8D3483 |LEA ESI,DWORD PTR DS:[EBX+EAX*4]
100077B8 |. 66:813E 0080 |CMP WORD PTR DS:[ESI],8000
100077BD |. 72 0C |JB SHORT jagmisc.100077CB
100077BF |. 8D7D F0 |LEA EDI,[LOCAL.4]
100077C2 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
100077C3 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
100077C4 |. A5 |MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
100077C5 |. FF4D F2 |DEC DWORD PTR SS:[EBP-E]
100077C8 |. 8D75 F0 |LEA ESI,[LOCAL.4]
100077CB |> 56 |PUSH ESI
100077CC |. FF75 08 |PUSH [ARG.1]
100077CF |. E8 5EFDFFFF |CALL jagmisc.10007532
100077D4 |. 59 |POP ECX ; kernel32.7C816FD7
100077D5 |. 59 |POP ECX ; kernel32.7C816FD7
100077D6 |. 33C9 |XOR ECX,ECX
100077D8 |> 394D 0C |CMP [ARG.2],ECX
100077DB |.^ 75 C4 \JNZ SHORT jagmisc.100077A1
100077DD |. 5F POP EDI ; kernel32.7C816FD7
100077DE |. 5E POP ESI ; kernel32.7C816FD7
100077DF |> 8B4D FC MOV ECX,[LOCAL.1]
100077E2 |. 5B POP EBX ; kernel32.7C816FD7
100077E3 |. E8 0EC3FFFF CALL jagmisc.10003AF6
100077E8 |. C9 LEAVE
100077E9 \. C3 RETN
100077EA CC INT3
100077EB CC INT3
100077EC CC INT3
100077ED CC INT3
100077EE CC INT3
100077EF CC INT3
100077F0 /. 55 PUSH EBP
100077F1 |. 8BEC MOV EBP,ESP
100077F3 |. 57 PUSH EDI
100077F4 |. 56 PUSH ESI
100077F5 |. 53 PUSH EBX
100077F6 |. 8B75 0C MOV ESI,[ARG.2]
100077F9 |. 8B7D 08 MOV EDI,[ARG.1]
100077FC |. B0 FF MOV AL,0FF
100077FE |. 8BFF MOV EDI,EDI
10007800 |> 0AC0 /OR AL,AL
10007802 |. 74 32 |JE SHORT jagmisc.10007836
10007804 |. 8A06 |MOV AL,BYTE PTR DS:[ESI]
10007806 |. 83C6 01 |ADD ESI,1
10007809 |. 8A27 |MOV AH,BYTE PTR DS:[EDI]
1000780B |. 83C7 01 |ADD EDI,1
1000780E |. 38C4 |CMP AH,AL
10007810 |.^ 74 EE |JE SHORT jagmisc.10007800
10007812 |. 2C 41 |SUB AL,41
10007814 |. 3C 1A |CMP AL,1A
10007816 |. 1AC9 |SBB CL,CL
10007818 |. 80E1 20 |AND CL,20
1000781B |. 02C1 |ADD AL,CL
1000781D |. 04 41 |ADD AL,41
1000781F |. 86E0 |XCHG AL,AH
10007821 |. 2C 41 |SUB AL,41
10007823 |. 3C 1A |CMP AL,1A
10007825 |. 1AC9 |SBB CL,CL
10007827 |. 80E1 20 |AND CL,20
1000782A |. 02C1 |ADD AL,CL
1000782C |. 04 41 |ADD AL,41
1000782E |. 38E0 |CMP AL,AH
10007830 |.^ 74 CE \JE SHORT jagmisc.10007800
10007832 |. 1AC0 SBB AL,AL
10007834 |. 1C FF SBB AL,0FF
10007836 |> 0FBEC0 MOVSX EAX,AL
10007839 |. 5B POP EBX ; kernel32.7C816FD7
1000783A |. 5E POP ESI ; kernel32.7C816FD7
1000783B |. 5F POP EDI ; kernel32.7C816FD7
1000783C |. C9 LEAVE
1000783D \. C3 RETN
1000783E /$ 56 PUSH ESI
1000783F |. 57 PUSH EDI
10007840 |. E8 BCA4FFFF CALL jagmisc.10001D01
10007845 |. 8B78 64 MOV EDI,DWORD PTR DS:[EAX+64]
10007848 |. 3B3D ECA40010 CMP EDI,DWORD PTR DS:[1000A4EC] ; jagmisc.1000A498
1000784E |. 74 07 JE SHORT jagmisc.10007857
10007850 |. E8 A1C7FFFF CALL jagmisc.10003FF6
10007855 |. 8BF8 MOV EDI,EAX
10007857 |> 8B7424 0C MOV ESI,DWORD PTR SS:[ESP+C]
1000785B |> 837F 28 01 /CMP DWORD PTR DS:[EDI+28],1
1000785F |. 0FB606 |MOVZX EAX,BYTE PTR DS:[ESI]
10007862 |. 7E 0E |JLE SHORT jagmisc.10007872
10007864 |. 6A 08 |PUSH 8
10007866 |. 50 |PUSH EAX
10007867 |. 57 |PUSH EDI
10007868 |. E8 A7E2FFFF |CALL jagmisc.10005B14
1000786D |. 83C4 0C |ADD ESP,0C
10007870 |. EB 0A |JMP SHORT jagmisc.1000787C
10007872 |> 8B4F 48 |MOV ECX,DWORD PTR DS:[EDI+48]
10007875 |. 0FB60441 |MOVZX EAX,BYTE PTR DS:[ECX+EAX*2]
10007879 |. 83E0 08 |AND EAX,8
1000787C |> 85C0 |TEST EAX,EAX
1000787E |. 74 03 |JE SHORT jagmisc.10007883
10007880 |. 46 |INC ESI
10007881 |.^ EB D8 \JMP SHORT jagmisc.1000785B
10007883 |> 0FB60E MOVZX ECX,BYTE PTR DS:[ESI]
10007886 |. 46 INC ESI
10007887 |. 83F9 2D CMP ECX,2D
1000788A |. 8BD1 MOV EDX,ECX
1000788C |. 74 05 JE SHORT jagmisc.10007893
1000788E |. 83F9 2B CMP ECX,2B
10007891 |. 75 04 JNZ SHORT jagmisc.10007897
10007893 |> 0FB60E MOVZX ECX,BYTE PTR DS:[ESI]
10007896 |. 46 INC ESI
10007897 |> 33C0 XOR EAX,EAX
10007899 |> 83F9 30 /CMP ECX,30
1000789C |. 7C 0A |JL SHORT jagmisc.100078A8
1000789E |. 83F9 39 |CMP ECX,39
100078A1 |. 7F 05 |JG SHORT jagmisc.100078A8
100078A3 |. 83E9 30 |SUB ECX,30
100078A6 |. EB 03 |JMP SHORT jagmisc.100078AB
100078A8 |> 83C9 FF |OR ECX,FFFFFFFF
100078AB |> 83F9 FF |CMP ECX,-1
100078AE |. 74 0C |JE SHORT jagmisc.100078BC
100078B0 |. 8D0480 |LEA EAX,DWORD PTR DS:[EAX+EAX*4]
100078B3 |. 8D0441 |LEA EAX,DWORD PTR DS:[ECX+EAX*2]
100078B6 |. 0FB60E |MOVZX ECX,BYTE PTR DS:[ESI]
100078B9 |. 46 |INC ESI
100078BA |.^ EB DD \JMP SHORT jagmisc.10007899
100078BC |> 83FA 2D CMP EDX,2D
100078BF |. 5F POP EDI ; kernel32.7C816FD7
100078C0 |. 5E POP ESI ; kernel32.7C816FD7
100078C1 |. 75 02 JNZ SHORT jagmisc.100078C5
100078C3 |. F7D8 NEG EAX
100078C5 \> C3 RETN
100078C6 CC INT3
100078C7 CC INT3
100078C8 CC INT3
100078C9 CC INT3
100078CA CC INT3
100078CB CC INT3
100078CC CC INT3
100078CD CC INT3
100078CE CC INT3
100078CF CC INT3
100078D0 . 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
100078D4 . 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10]
100078D8 . 0BC8 OR ECX,EAX
100078DA . 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]
100078DE . 75 09 JNZ SHORT jagmisc.100078E9
100078E0 . 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ntdll.7C910738
100078E4 . F7E1 MUL ECX
100078E6 . C2 1000 RETN 10
100078E9 > 53 PUSH EBX
100078EA . F7E1 MUL ECX
100078EC . 8BD8 MOV EBX,EAX
100078EE . 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
100078F2 . F76424 14 MUL DWORD PTR SS:[ESP+14]
100078F6 . 03D8 ADD EBX,EAX
100078F8 . 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
100078FC . F7E1 MUL ECX
100078FE . 03D3 ADD EDX,EBX
10007900 . 5B POP EBX ; kernel32.7C816FD7
10007901 . C2 1000 RETN 10
10007904 CC INT3
10007905 CC INT3
10007906 CC INT3
10007907 CC INT3
10007908 CC INT3
10007909 CC INT3
1000790A CC INT3
1000790B CC INT3
1000790C CC INT3
1000790D CC INT3
1000790E CC INT3
1000790F CC INT3
10007910 /. 55 PUSH EBP
10007911 |. 8BEC MOV EBP,ESP
10007913 |. 57 PUSH EDI
10007914 |. 56 PUSH ESI
10007915 |. 53 PUSH EBX
10007916 |. 8B4D 10 MOV ECX,[ARG.3]
10007919 |. 0BC9 OR ECX,ECX
1000791B |. 74 4D JE SHORT jagmisc.1000796A
1000791D |. 8B75 08 MOV ESI,[ARG.1]
10007920 |. 8B7D 0C MOV EDI,[ARG.2]
10007923 |. B7 41 MOV BH,41
10007925 |. B3 5A MOV BL,5A
10007927 |. B6 20 MOV DH,20
10007929 |. 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
1000792C |> 8A26 /MOV AH,BYTE PTR DS:[ESI]
1000792E |. 0AE4 |OR AH,AH
10007930 |. 8A07 |MOV AL,BYTE PTR DS:[EDI]
10007932 |. 74 27 |JE SHORT jagmisc.1000795B
10007934 |. 0AC0 |OR AL,AL
10007936 |. 74 23 |JE SHORT jagmisc.1000795B
10007938 |. 83C6 01 |ADD ESI,1
1000793B |. 83C7 01 |ADD EDI,1
1000793E |. 38FC |CMP AH,BH
10007940 |. 72 06 |JB SHORT jagmisc.10007948
10007942 |. 38DC |CMP AH,BL
10007944 |. 77 02 |JA SHORT jagmisc.10007948
10007946 |. 02E6 |ADD AH,DH
10007948 |> 38F8 |CMP AL,BH
1000794A |. 72 06 |JB SHORT jagmisc.10007952
1000794C |. 38D8 |CMP AL,BL
1000794E |. 77 02 |JA SHORT jagmisc.10007952
10007950 |. 02C6 |ADD AL,DH
10007952 |> 38C4 |CMP AH,AL
10007954 |. 75 0B |JNZ SHORT jagmisc.10007961
10007956 |. 83E9 01 |SUB ECX,1
10007959 |.^ 75 D1 \JNZ SHORT jagmisc.1000792C
1000795B |> 33C9 XOR ECX,ECX
1000795D |. 38C4 CMP AH,AL
1000795F |. 74 09 JE SHORT jagmisc.1000796A
10007961 |> B9 FFFFFFFF MOV ECX,-1
10007966 |. 72 02 JB SHORT jagmisc.1000796A
10007968 |. F7D9 NEG ECX
1000796A |> 8BC1 MOV EAX,ECX
1000796C |. 5B POP EBX ; kernel32.7C816FD7
1000796D |. 5E POP ESI ; kernel32.7C816FD7
1000796E |. 5F POP EDI ; kernel32.7C816FD7
1000796F |. C9 LEAVE
10007970 \. C3 RETN
10007971 CC INT3
10007972 CC INT3
10007973 CC INT3
10007974 CC INT3
10007975 CC INT3
10007976 CC INT3
10007977 CC INT3
10007978 CC INT3
10007979 CC INT3
1000797A CC INT3
1000797B CC INT3
1000797C CC INT3
1000797D CC INT3
1000797E CC INT3
1000797F CC INT3
10007980 . 56 PUSH ESI
10007981 . 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14]
10007985 . 0BC0 OR EAX,EAX
10007987 . 75 28 JNZ SHORT jagmisc.100079B1
10007989 . 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10]
1000798D . 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+C]
10007991 . 33D2 XOR EDX,EDX
10007993 . F7F1 DIV ECX
10007995 . 8BD8 MOV EBX,EAX
10007997 . 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
1000799B . F7F1 DIV ECX
1000799D . 8BF0 MOV ESI,EAX
1000799F . 8BC3 MOV EAX,EBX
100079A1 . F76424 10 MUL DWORD PTR SS:[ESP+10]
100079A5 . 8BC8 MOV ECX,EAX
100079A7 . 8BC6 MOV EAX,ESI
100079A9 . F76424 10 MUL DWORD PTR SS:[ESP+10]
100079AD . 03D1 ADD EDX,ECX
100079AF . EB 47 JMP SHORT jagmisc.100079F8
100079B1 > 8BC8 MOV ECX,EAX
100079B3 . 8B5C24 10 MOV EBX,DWORD PTR SS:[ESP+10]
100079B7 . 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C]
100079BB . 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
100079BF > D1E9 SHR ECX,1
100079C1 . D1DB RCR EBX,1
100079C3 . D1EA SHR EDX,1
100079C5 . D1D8 RCR EAX,1
100079C7 . 0BC9 OR ECX,ECX
100079C9 .^ 75 F4 JNZ SHORT jagmisc.100079BF
100079CB . F7F3 DIV EBX
100079CD . 8BF0 MOV ESI,EAX
100079CF . F76424 14 MUL DWORD PTR SS:[ESP+14]
100079D3 . 8BC8 MOV ECX,EAX
100079D5 . 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10]
100079D9 . F7E6 MUL ESI
100079DB . 03D1 ADD EDX,ECX
100079DD . 72 0E JB SHORT jagmisc.100079ED
100079DF . 3B5424 0C CMP EDX,DWORD PTR SS:[ESP+C]
100079E3 . 77 08 JA SHORT jagmisc.100079ED
100079E5 . 72 0F JB SHORT jagmisc.100079F6
100079E7 . 3B4424 08 CMP EAX,DWORD PTR SS:[ESP+8]
100079EB . 76 09 JBE SHORT jagmisc.100079F6
100079ED > 4E DEC ESI
100079EE . 2B4424 10 SUB EAX,DWORD PTR SS:[ESP+10]
100079F2 . 1B5424 14 SBB EDX,DWORD PTR SS:[ESP+14]
100079F6 > 33DB XOR EBX,EBX
100079F8 > 2B4424 08 SUB EAX,DWORD PTR SS:[ESP+8]
100079FC . 1B5424 0C SBB EDX,DWORD PTR SS:[ESP+C]
10007A00 . F7DA NEG EDX
10007A02 . F7D8 NEG EAX
10007A04 . 83DA 00 SBB EDX,0
10007A07 . 8BCA MOV ECX,EDX
10007A09 . 8BD3 MOV EDX,EBX
10007A0B . 8BD9 MOV EBX,ECX
10007A0D . 8BC8 MOV ECX,EAX
10007A0F . 8BC6 MOV EAX,ESI
10007A11 . 5E POP ESI ; kernel32.7C816FD7
10007A12 . C2 1000 RETN 10
10007A15 CC INT3
10007A16 CC INT3
10007A17 CC INT3
10007A18 CC INT3
10007A19 CC INT3
10007A1A CC INT3
10007A1B CC INT3
10007A1C CC INT3
10007A1D CC INT3
10007A1E CC INT3
10007A1F CC INT3
10007A20 > 8D42 FF LEA EAX,DWORD PTR DS:[EDX-1]
10007A23 . 5B POP EBX ; kernel32.7C816FD7
10007A24 . C3 RETN
10007A25 . 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
10007A2C . 8D6424 00 LEA ESP,DWORD PTR SS:[ESP]
10007A30 . 33C0 XOR EAX,EAX
10007A32 . 8A4424 08 MOV AL,BYTE PTR SS:[ESP+8]
10007A36 . 53 PUSH EBX
10007A37 . 8BD8 MOV EBX,EAX
10007A39 . C1E0 08 SHL EAX,8
10007A3C . 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8]
10007A40 . F7C2 03000000 TEST EDX,3
10007A46 . 74 15 JE SHORT jagmisc.10007A5D
10007A48 > 8A0A MOV CL,BYTE PTR DS:[EDX]
10007A4A . 83C2 01 ADD EDX,1
10007A4D . 38D9 CMP CL,BL
10007A4F .^ 74 CF JE SHORT jagmisc.10007A20
10007A51 . 84C9 TEST CL,CL
10007A53 . 74 51 JE SHORT jagmisc.10007AA6
10007A55 . F7C2 03000000 TEST EDX,3
10007A5B .^ 75 EB JNZ SHORT jagmisc.10007A48
10007A5D > 0BD8 OR EBX,EAX
10007A5F . 57 PUSH EDI
10007A60 . 8BC3 MOV EAX,EBX
10007A62 . C1E3 10 SHL EBX,10
10007A65 . 56 PUSH ESI
10007A66 . 0BD8 OR EBX,EAX
10007A68 > 8B0A MOV ECX,DWORD PTR DS:[EDX]
10007A6A . BF FFFEFE7E MOV EDI,7EFEFEFF
10007A6F . 8BC1 MOV EAX,ECX
10007A71 . 8BF7 MOV ESI,EDI
10007A73 . 33CB XOR ECX,EBX
10007A75 . 03F0 ADD ESI,EAX
10007A77 . 03F9 ADD EDI,ECX
10007A79 . 83F1 FF XOR ECX,FFFFFFFF
10007A7C . 83F0 FF XOR EAX,FFFFFFFF
10007A7F . 33CF XOR ECX,EDI
10007A81 . 33C6 XOR EAX,ESI
10007A83 . 83C2 04 ADD EDX,4
10007A86 . 81E1 00010181 AND ECX,81010100
10007A8C . 75 1C JNZ SHORT jagmisc.10007AAA
10007A8E . 25 00010181 AND EAX,81010100
10007A93 .^ 74 D3 JE SHORT jagmisc.10007A68
10007A95 . 25 00010101 AND EAX,1010100
10007A9A . 75 08 JNZ SHORT jagmisc.10007AA4
10007A9C . 81E6 00000080 AND ESI,80000000
10007AA2 .^ 75 C4 JNZ SHORT jagmisc.10007A68
10007AA4 > 5E POP ESI ; kernel32.7C816FD7
10007AA5 . 5F POP EDI ; kernel32.7C816FD7
10007AA6 > 5B POP EBX ; kernel32.7C816FD7
10007AA7 . 33C0 XOR EAX,EAX
10007AA9 . C3 RETN
10007AAA > 8B42 FC MOV EAX,DWORD PTR DS:[EDX-4]
10007AAD . 38D8 CMP AL,BL
10007AAF . 74 36 JE SHORT jagmisc.10007AE7
10007AB1 . 84C0 TEST AL,AL
10007AB3 .^ 74 EF JE SHORT jagmisc.10007AA4
10007AB5 . 38DC CMP AH,BL
10007AB7 . 74 27 JE SHORT jagmisc.10007AE0
10007AB9 . 84E4 TEST AH,AH
10007ABB .^ 74 E7 JE SHORT jagmisc.10007AA4
10007ABD . C1E8 10 SHR EAX,10
10007AC0 . 38D8 CMP AL,BL
10007AC2 . 74 15 JE SHORT jagmisc.10007AD9
10007AC4 . 84C0 TEST AL,AL
10007AC6 .^ 74 DC JE SHORT jagmisc.10007AA4
10007AC8 . 38DC CMP AH,BL
10007ACA . 74 06 JE SHORT jagmisc.10007AD2
10007ACC . 84E4 TEST AH,AH
10007ACE .^ 74 D4 JE SHORT jagmisc.10007AA4
10007AD0 .^ EB 96 JMP SHORT jagmisc.10007A68
10007AD2 > 5E POP ESI ; kernel32.7C816FD7
10007AD3 . 5F POP EDI ; kernel32.7C816FD7
10007AD4 . 8D42 FF LEA EAX,DWORD PTR DS:[EDX-1]
10007AD7 . 5B POP EBX ; kernel32.7C816FD7
10007AD8 . C3 RETN
10007AD9 > 8D42 FE LEA EAX,DWORD PTR DS:[EDX-2]
10007ADC . 5E POP ESI ; kernel32.7C816FD7
10007ADD . 5F POP EDI ; kernel32.7C816FD7
10007ADE . 5B POP EBX ; kernel32.7C816FD7
10007ADF . C3 RETN
10007AE0 > 8D42 FD LEA EAX,DWORD PTR DS:[EDX-3]
10007AE3 . 5E POP ESI ; kernel32.7C816FD7
10007AE4 . 5F POP EDI ; kernel32.7C816FD7
10007AE5 . 5B POP EBX ; kernel32.7C816FD7
10007AE6 . C3 RETN
10007AE7 > 8D42 FC LEA EAX,DWORD PTR DS:[EDX-4]
10007AEA . 5E POP ESI ; kernel32.7C816FD7
10007AEB . 5F POP EDI ; kernel32.7C816FD7
10007AEC . 5B POP EBX ; kernel32.7C816FD7
10007AED . C3 RETN
10007AEE $- FF25 D0800010 JMP DWORD PTR DS:[<&KERNEL32.RtlUnwind>] ; ntdll.RtlUnwind
10007AF4 00 DB 00
10007AF5 00 DB 00
10007AF6 00 DB 00
10007AF7 00 DB 00
10007AF8 00 DB 00
10007AF9 00 DB 00
10007AFA 00 DB 00
10007AFB 00 DB 00
10007AFC 00 DB 00
10007AFD 00 DB 00
10007AFE 00 DB 00
10007AFF 00 DB 00
10007B00 00 DB 00
10007B01 00 DB 00
10007B02 00 DB 00
10007B03 00 DB 00
10007B04 00 DB 00
10007B05 00 DB 00
10007B06 00 DB 00
10007B07 00 DB 00
10007B08 00 DB 00
10007B09 00 DB 00
10007B0A 00 DB 00
10007B0B 00 DB 00
10007B0C 00 DB 00
10007B0D 00 DB 00
10007B0E 00 DB 00
10007B0F 00 DB 00
10007B10 00 DB 00
10007B11 00 DB 00
10007B12 00 DB 00
10007B13 00 DB 00
10007B14 00 DB 00
10007B15 00 DB 00
10007B16 00 DB 00
10007B17 00 DB 00
10007B18 00 DB 00
10007B19 00 DB 00
10007B1A 00 DB 00
10007B1B 00 DB 00
10007B1C 00 DB 00
10007B1D 00 DB 00
10007B1E 00 DB 00
10007B1F 00 DB 00
10007B20 00 DB 00
10007B21 00 DB 00
10007B22 00 DB 00
10007B23 00 DB 00
10007B24 00 DB 00
10007B25 00 DB 00
10007B26 00 DB 00
10007B27 00 DB 00
10007B28 00 DB 00
10007B29 00 DB 00
10007B2A 00 DB 00
10007B2B 00 DB 00
10007B2C 00 DB 00
10007B2D 00 DB 00
10007B2E 00 DB 00
10007B2F 00 DB 00
10007B30 00 DB 00
10007B31 00 DB 00
10007B32 00 DB 00
10007B33 00 DB 00
10007B34 00 DB 00
10007B35 00 DB 00
10007B36 00 DB 00
10007B37 00 DB 00
10007B38 00 DB 00
10007B39 00 DB 00
10007B3A 00 DB 00
10007B3B 00 DB 00
10007B3C 00 DB 00
10007B3D 00 DB 00
10007B3E 00 DB 00
10007B3F 00 DB 00
10007B40 00 DB 00
10007B41 00 DB 00
10007B42 00 DB 00
10007B43 00 DB 00
10007B44 00 DB 00
10007B45 00 DB 00
10007B46 00 DB 00
10007B47 00 DB 00
10007B48 00 DB 00
10007B49 00 DB 00
10007B4A 00 DB 00
10007B4B 00 DB 00
10007B4C 00 DB 00
10007B4D 00 DB 00
10007B4E 00 DB 00
10007B4F 00 DB 00
10007B50 00 DB 00
10007B51 00 DB 00
10007B52 00 DB 00
10007B53 00 DB 00
10007B54 00 DB 00
10007B55 00 DB 00
10007B56 00 DB 00
10007B57 00 DB 00
10007B58 00 DB 00
10007B59 00 DB 00
10007B5A 00 DB 00
10007B5B 00 DB 00
10007B5C 00 DB 00
10007B5D 00 DB 00
10007B5E 00 DB 00
10007B5F 00 DB 00
10007B60 00 DB 00
10007B61 00 DB 00
10007B62 00 DB 00
10007B63 00 DB 00
10007B64 00 DB 00
10007B65 00 DB 00
10007B66 00 DB 00
10007B67 00 DB 00
10007B68 00 DB 00
10007B69 00 DB 00
10007B6A 00 DB 00
10007B6B 00 DB 00
10007B6C 00 DB 00
10007B6D 00 DB 00
10007B6E 00 DB 00
10007B6F 00 DB 00
10007B70 00 DB 00
10007B71 00 DB 00
10007B72 00 DB 00
10007B73 00 DB 00
10007B74 00 DB 00
10007B75 00 DB 00
10007B76 00 DB 00
10007B77 00 DB 00
10007B78 00 DB 00
10007B79 00 DB 00
10007B7A 00 DB 00
10007B7B 00 DB 00
10007B7C 00 DB 00
10007B7D 00 DB 00
10007B7E 00 DB 00
10007B7F 00 DB 00
10007B80 00 DB 00
10007B81 00 DB 00
10007B82 00 DB 00
10007B83 00 DB 00
10007B84 00 DB 00
10007B85 00 DB 00
10007B86 00 DB 00
10007B87 00 DB 00
10007B88 00 DB 00
10007B89 00 DB 00
10007B8A 00 DB 00
10007B8B 00 DB 00
10007B8C 00 DB 00
10007B8D 00 DB 00
10007B8E 00 DB 00
10007B8F 00 DB 00
10007B90 00 DB 00
10007B91 00 DB 00
10007B92 00 DB 00
10007B93 00 DB 00
10007B94 00 DB 00
10007B95 00 DB 00
10007B96 00 DB 00
10007B97 00 DB 00
10007B98 00 DB 00
10007B99 00 DB 00
10007B9A 00 DB 00
10007B9B 00 DB 00
10007B9C 00 DB 00
10007B9D 00 DB 00
10007B9E 00 DB 00
10007B9F 00 DB 00
10007BA0 00 DB 00
10007BA1 00 DB 00
10007BA2 00 DB 00
10007BA3 00 DB 00
10007BA4 00 DB 00
10007BA5 00 DB 00
10007BA6 00 DB 00
10007BA7 00 DB 00
10007BA8 00 DB 00
10007BA9 00 DB 00
10007BAA 00 DB 00
10007BAB 00 DB 00
10007BAC 00 DB 00
10007BAD 00 DB 00
10007BAE 00 DB 00
10007BAF 00 DB 00
10007BB0 00 DB 00
10007BB1 00 DB 00
10007BB2 00 DB 00
10007BB3 00 DB 00
10007BB4 00 DB 00
10007BB5 00 DB 00
10007BB6 00 DB 00
10007BB7 00 DB 00
10007BB8 00 DB 00
10007BB9 00 DB 00
10007BBA 00 DB 00
10007BBB 00 DB 00
10007BBC 00 DB 00
10007BBD 00 DB 00
10007BBE 00 DB 00
10007BBF 00 DB 00
10007BC0 00 DB 00
10007BC1 00 DB 00
10007BC2 00 DB 00
10007BC3 00 DB 00
10007BC4 00 DB 00
10007BC5 00 DB 00
10007BC6 00 DB 00
10007BC7 00 DB 00
10007BC8 00 DB 00
10007BC9 00 DB 00
10007BCA 00 DB 00
10007BCB 00 DB 00
10007BCC 00 DB 00
10007BCD 00 DB 00
10007BCE 00 DB 00
10007BCF 00 DB 00
10007BD0 00 DB 00
10007BD1 00 DB 00
10007BD2 00 DB 00
10007BD3 00 DB 00
10007BD4 00 DB 00
10007BD5 00 DB 00
10007BD6 00 DB 00
10007BD7 00 DB 00
10007BD8 00 DB 00
10007BD9 00 DB 00
10007BDA 00 DB 00
10007BDB 00 DB 00
10007BDC 00 DB 00
10007BDD 00 DB 00
10007BDE 00 DB 00
10007BDF 00 DB 00
10007BE0 00 DB 00
10007BE1 00 DB 00
10007BE2 00 DB 00
10007BE3 00 DB 00
10007BE4 00 DB 00
10007BE5 00 DB 00
10007BE6 00 DB 00
10007BE7 00 DB 00
10007BE8 00 DB 00
10007BE9 00 DB 00
10007BEA 00 DB 00
10007BEB 00 DB 00
10007BEC 00 DB 00
10007BED 00 DB 00
10007BEE 00 DB 00
10007BEF 00 DB 00
10007BF0 00 DB 00
10007BF1 00 DB 00
10007BF2 00 DB 00
10007BF3 00 DB 00
10007BF4 00 DB 00
10007BF5 00 DB 00
10007BF6 00 DB 00
10007BF7 00 DB 00
10007BF8 00 DB 00
10007BF9 00 DB 00
10007BFA 00 DB 00
10007BFB 00 DB 00
10007BFC 00 DB 00
10007BFD 00 DB 00
10007BFE 00 DB 00
10007BFF 00 DB 00
10007C00 00 DB 00
10007C01 00 DB 00
10007C02 00 DB 00
10007C03 00 DB 00
10007C04 00 DB 00
10007C05 00 DB 00
10007C06 00 DB 00
10007C07 00 DB 00
10007C08 00 DB 00
10007C09 00 DB 00
10007C0A 00 DB 00
10007C0B 00 DB 00
10007C0C 00 DB 00
10007C0D 00 DB 00
10007C0E 00 DB 00
10007C0F 00 DB 00
10007C10 00 DB 00
10007C11 00 DB 00
10007C12 00 DB 00
10007C13 00 DB 00
10007C14 00 DB 00
10007C15 00 DB 00
10007C16 00 DB 00
10007C17 00 DB 00
10007C18 00 DB 00
10007C19 00 DB 00
10007C1A 00 DB 00
10007C1B 00 DB 00
10007C1C 00 DB 00
10007C1D 00 DB 00
10007C1E 00 DB 00
10007C1F 00 DB 00
10007C20 00 DB 00
10007C21 00 DB 00
10007C22 00 DB 00
10007C23 00 DB 00
10007C24 00 DB 00
10007C25 00 DB 00
10007C26 00 DB 00
10007C27 00 DB 00
10007C28 00 DB 00
10007C29 00 DB 00
10007C2A 00 DB 00
10007C2B 00 DB 00
10007C2C 00 DB 00
10007C2D 00 DB 00
10007C2E 00 DB 00
10007C2F 00 DB 00
10007C30 00 DB 00
10007C31 00 DB 00
10007C32 00 DB 00
10007C33 00 DB 00
10007C34 00 DB 00
10007C35 00 DB 00
10007C36 00 DB 00
10007C37 00 DB 00
10007C38 00 DB 00
10007C39 00 DB 00
10007C3A 00 DB 00
10007C3B 00 DB 00
10007C3C 00 DB 00
10007C3D 00 DB 00
10007C3E 00 DB 00
10007C3F 00 DB 00
10007C40 00 DB 00
10007C41 00 DB 00
10007C42 00 DB 00
10007C43 00 DB 00
10007C44 00 DB 00
10007C45 00 DB 00
10007C46 00 DB 00
10007C47 00 DB 00
10007C48 00 DB 00
10007C49 00 DB 00
10007C4A 00 DB 00
10007C4B 00 DB 00
10007C4C 00 DB 00
10007C4D 00 DB 00
10007C4E 00 DB 00
10007C4F 00 DB 00
10007C50 00 DB 00
10007C51 00 DB 00
10007C52 00 DB 00
10007C53 00 DB 00
10007C54 00 DB 00
10007C55 00 DB 00
10007C56 00 DB 00
10007C57 00 DB 00
10007C58 00 DB 00
10007C59 00 DB 00
10007C5A 00 DB 00
10007C5B 00 DB 00
10007C5C 00 DB 00
10007C5D 00 DB 00
10007C5E 00 DB 00
10007C5F 00 DB 00
10007C60 00 DB 00
10007C61 00 DB 00
10007C62 00 DB 00
10007C63 00 DB 00
10007C64 00 DB 00
10007C65 00 DB 00
10007C66 00 DB 00
10007C67 00 DB 00
10007C68 00 DB 00
10007C69 00 DB 00
10007C6A 00 DB 00
10007C6B 00 DB 00
10007C6C 00 DB 00
10007C6D 00 DB 00
10007C6E 00 DB 00
10007C6F 00 DB 00
10007C70 00 DB 00
10007C71 00 DB 00
10007C72 00 DB 00
10007C73 00 DB 00
10007C74 00 DB 00
10007C75 00 DB 00
10007C76 00 DB 00
10007C77 00 DB 00
10007C78 00 DB 00
10007C79 00 DB 00
10007C7A 00 DB 00
10007C7B 00 DB 00
10007C7C 00 DB 00
10007C7D 00 DB 00
10007C7E 00 DB 00
10007C7F 00 DB 00
10007C80 00 DB 00
10007C81 00 DB 00
10007C82 00 DB 00
10007C83 00 DB 00
10007C84 00 DB 00
10007C85 00 DB 00
10007C86 00 DB 00
10007C87 00 DB 00
10007C88 00 DB 00
10007C89 00 DB 00
10007C8A 00 DB 00
10007C8B 00 DB 00
10007C8C 00 DB 00
10007C8D 00 DB 00
10007C8E 00 DB 00
10007C8F 00 DB 00
10007C90 00 DB 00
10007C91 00 DB 00
10007C92 00 DB 00
10007C93 00 DB 00
10007C94 00 DB 00
10007C95 00 DB 00
10007C96 00 DB 00
10007C97 00 DB 00
10007C98 00 DB 00
10007C99 00 DB 00
10007C9A 00 DB 00
10007C9B 00 DB 00
10007C9C 00 DB 00
10007C9D 00 DB 00
10007C9E 00 DB 00
10007C9F 00 DB 00
10007CA0 00 DB 00
10007CA1 00 DB 00
10007CA2 00 DB 00
10007CA3 00 DB 00
10007CA4 00 DB 00
10007CA5 00 DB 00
10007CA6 00 DB 00
10007CA7 00 DB 00
10007CA8 00 DB 00
10007CA9 00 DB 00
10007CAA 00 DB 00
10007CAB 00 DB 00
10007CAC 00 DB 00
10007CAD 00 DB 00
10007CAE 00 DB 00
10007CAF 00 DB 00
10007CB0 00 DB 00
10007CB1 00 DB 00
10007CB2 00 DB 00
10007CB3 00 DB 00
10007CB4 00 DB 00
10007CB5 00 DB 00
10007CB6 00 DB 00
10007CB7 00 DB 00
10007CB8 00 DB 00
10007CB9 00 DB 00
10007CBA 00 DB 00
10007CBB 00 DB 00
10007CBC 00 DB 00
10007CBD 00 DB 00
10007CBE 00 DB 00
10007CBF 00 DB 00
10007CC0 00 DB 00
10007CC1 00 DB 00
10007CC2 00 DB 00
10007CC3 00 DB 00
10007CC4 00 DB 00
10007CC5 00 DB 00
10007CC6 00 DB 00
10007CC7 00 DB 00
10007CC8 00 DB 00
10007CC9 00 DB 00
10007CCA 00 DB 00
10007CCB 00 DB 00
10007CCC 00 DB 00
10007CCD 00 DB 00
10007CCE 00 DB 00
10007CCF 00 DB 00
10007CD0 00 DB 00
10007CD1 00 DB 00
10007CD2 00 DB 00
10007CD3 00 DB 00
10007CD4 00 DB 00
10007CD5 00 DB 00
10007CD6 00 DB 00
10007CD7 00 DB 00
10007CD8 00 DB 00
10007CD9 00 DB 00
10007CDA 00 DB 00
10007CDB 00 DB 00
10007CDC 00 DB 00
10007CDD 00 DB 00
10007CDE 00 DB 00
10007CDF 00 DB 00
10007CE0 00 DB 00
10007CE1 00 DB 00
10007CE2 00 DB 00
10007CE3 00 DB 00
10007CE4 00 DB 00
10007CE5 00 DB 00
10007CE6 00 DB 00
10007CE7 00 DB 00
10007CE8 00 DB 00
10007CE9 00 DB 00
10007CEA 00 DB 00
10007CEB 00 DB 00
10007CEC 00 DB 00
10007CED 00 DB 00
10007CEE 00 DB 00
10007CEF 00 DB 00
10007CF0 00 DB 00
10007CF1 00 DB 00
10007CF2 00 DB 00
10007CF3 00 DB 00
10007CF4 00 DB 00
10007CF5 00 DB 00
10007CF6 00 DB 00
10007CF7 00 DB 00
10007CF8 00 DB 00
10007CF9 00 DB 00
10007CFA 00 DB 00
10007CFB 00 DB 00
10007CFC 00 DB 00
10007CFD 00 DB 00
10007CFE 00 DB 00
10007CFF 00 DB 00
10007D00 00 DB 00
10007D01 00 DB 00
10007D02 00 DB 00
10007D03 00 DB 00
10007D04 00 DB 00
10007D05 00 DB 00
10007D06 00 DB 00
10007D07 00 DB 00
10007D08 00 DB 00
10007D09 00 DB 00
10007D0A 00 DB 00
10007D0B 00 DB 00
10007D0C 00 DB 00
10007D0D 00 DB 00
10007D0E 00 DB 00
10007D0F 00 DB 00
10007D10 00 DB 00
10007D11 00 DB 00
10007D12 00 DB 00
10007D13 00 DB 00
10007D14 00 DB 00
10007D15 00 DB 00
10007D16 00 DB 00
10007D17 00 DB 00
10007D18 00 DB 00
10007D19 00 DB 00
10007D1A 00 DB 00
10007D1B 00 DB 00
10007D1C 00 DB 00
10007D1D 00 DB 00
10007D1E 00 DB 00
10007D1F 00 DB 00
10007D20 00 DB 00
10007D21 00 DB 00
10007D22 00 DB 00
10007D23 00 DB 00
10007D24 00 DB 00
10007D25 00 DB 00
10007D26 00 DB 00
10007D27 00 DB 00
10007D28 00 DB 00
10007D29 00 DB 00
10007D2A 00 DB 00
10007D2B 00 DB 00
10007D2C 00 DB 00
10007D2D 00 DB 00
10007D2E 00 DB 00
10007D2F 00 DB 00
10007D30 00 DB 00
10007D31 00 DB 00
10007D32 00 DB 00
10007D33 00 DB 00
10007D34 00 DB 00
10007D35 00 DB 00
10007D36 00 DB 00
10007D37 00 DB 00
10007D38 00 DB 00
10007D39 00 DB 00
10007D3A 00 DB 00
10007D3B 00 DB 00
10007D3C 00 DB 00
10007D3D 00 DB 00
10007D3E 00 DB 00
10007D3F 00 DB 00
10007D40 00 DB 00
10007D41 00 DB 00
10007D42 00 DB 00
10007D43 00 DB 00
10007D44 00 DB 00
10007D45 00 DB 00
10007D46 00 DB 00
10007D47 00 DB 00
10007D48 00 DB 00
10007D49 00 DB 00
10007D4A 00 DB 00
10007D4B 00 DB 00
10007D4C 00 DB 00
10007D4D 00 DB 00
10007D4E 00 DB 00
10007D4F 00 DB 00
10007D50 00 DB 00
10007D51 00 DB 00
10007D52 00 DB 00
10007D53 00 DB 00
10007D54 00 DB 00
10007D55 00 DB 00
10007D56 00 DB 00
10007D57 00 DB 00
10007D58 00 DB 00
10007D59 00 DB 00
10007D5A 00 DB 00
10007D5B 00 DB 00
10007D5C 00 DB 00
10007D5D 00 DB 00
10007D5E 00 DB 00
10007D5F 00 DB 00
10007D60 00 DB 00
10007D61 00 DB 00
10007D62 00 DB 00
10007D63 00 DB 00
10007D64 00 DB 00
10007D65 00 DB 00
10007D66 00 DB 00
10007D67 00 DB 00
10007D68 00 DB 00
10007D69 00 DB 00
10007D6A 00 DB 00
10007D6B 00 DB 00
10007D6C 00 DB 00
10007D6D 00 DB 00
10007D6E 00 DB 00
10007D6F 00 DB 00
10007D70 00 DB 00
10007D71 00 DB 00
10007D72 00 DB 00
10007D73 00 DB 00
10007D74 00 DB 00
10007D75 00 DB 00
10007D76 00 DB 00
10007D77 00 DB 00
10007D78 00 DB 00
10007D79 00 DB 00
10007D7A 00 DB 00
10007D7B 00 DB 00
10007D7C 00 DB 00
10007D7D 00 DB 00
10007D7E 00 DB 00
10007D7F 00 DB 00
10007D80 00 DB 00
10007D81 00 DB 00
10007D82 00 DB 00
10007D83 00 DB 00
10007D84 00 DB 00
10007D85 00 DB 00
10007D86 00 DB 00
10007D87 00 DB 00
10007D88 00 DB 00
10007D89 00 DB 00
10007D8A 00 DB 00
10007D8B 00 DB 00
10007D8C 00 DB 00
10007D8D 00 DB 00
10007D8E 00 DB 00
10007D8F 00 DB 00
10007D90 00 DB 00
10007D91 00 DB 00
10007D92 00 DB 00
10007D93 00 DB 00
10007D94 00 DB 00
10007D95 00 DB 00
10007D96 00 DB 00
10007D97 00 DB 00
10007D98 00 DB 00
10007D99 00 DB 00
10007D9A 00 DB 00
10007D9B 00 DB 00
10007D9C 00 DB 00
10007D9D 00 DB 00
10007D9E 00 DB 00
10007D9F 00 DB 00
10007DA0 00 DB 00
10007DA1 00 DB 00
10007DA2 00 DB 00
10007DA3 00 DB 00
10007DA4 00 DB 00
10007DA5 00 DB 00
10007DA6 00 DB 00
10007DA7 00 DB 00
10007DA8 00 DB 00
10007DA9 00 DB 00
10007DAA 00 DB 00
10007DAB 00 DB 00
10007DAC 00 DB 00
10007DAD 00 DB 00
10007DAE 00 DB 00
10007DAF 00 DB 00
10007DB0 00 DB 00
10007DB1 00 DB 00
10007DB2 00 DB 00
10007DB3 00 DB 00
10007DB4 00 DB 00
10007DB5 00 DB 00
10007DB6 00 DB 00
10007DB7 00 DB 00
10007DB8 00 DB 00
10007DB9 00 DB 00
10007DBA 00 DB 00
10007DBB 00 DB 00
10007DBC 00 DB 00
10007DBD 00 DB 00
10007DBE 00 DB 00
10007DBF 00 DB 00
10007DC0 00 DB 00
10007DC1 00 DB 00
10007DC2 00 DB 00
10007DC3 00 DB 00
10007DC4 00 DB 00
10007DC5 00 DB 00
10007DC6 00 DB 00
10007DC7 00 DB 00
10007DC8 00 DB 00
10007DC9 00 DB 00
10007DCA 00 DB 00
10007DCB 00 DB 00
10007DCC 00 DB 00
10007DCD 00 DB 00
10007DCE 00 DB 00
10007DCF 00 DB 00
10007DD0 00 DB 00
10007DD1 00 DB 00
10007DD2 00 DB 00
10007DD3 00 DB 00
10007DD4 00 DB 00
10007DD5 00 DB 00
10007DD6 00 DB 00
10007DD7 00 DB 00
10007DD8 00 DB 00
10007DD9 00 DB 00
10007DDA 00 DB 00
10007DDB 00 DB 00
10007DDC 00 DB 00
10007DDD 00 DB 00
10007DDE 00 DB 00
10007DDF 00 DB 00
10007DE0 00 DB 00
10007DE1 00 DB 00
10007DE2 00 DB 00
10007DE3 00 DB 00
10007DE4 00 DB 00
10007DE5 00 DB 00
10007DE6 00 DB 00
10007DE7 00 DB 00
10007DE8 00 DB 00
10007DE9 00 DB 00
10007DEA 00 DB 00
10007DEB 00 DB 00
10007DEC 00 DB 00
10007DED 00 DB 00
10007DEE 00 DB 00
10007DEF 00 DB 00
10007DF0 00 DB 00
10007DF1 00 DB 00
10007DF2 00 DB 00
10007DF3 00 DB 00
10007DF4 00 DB 00
10007DF5 00 DB 00
10007DF6 00 DB 00
10007DF7 00 DB 00
10007DF8 00 DB 00
10007DF9 00 DB 00
10007DFA 00 DB 00
10007DFB 00 DB 00
10007DFC 00 DB 00
10007DFD 00 DB 00
10007DFE 00 DB 00
10007DFF 00 DB 00
10007E00 00 DB 00
10007E01 00 DB 00
10007E02 00 DB 00
10007E03 00 DB 00
10007E04 00 DB 00
10007E05 00 DB 00
10007E06 00 DB 00
10007E07 00 DB 00
10007E08 00 DB 00
10007E09 00 DB 00
10007E0A 00 DB 00
10007E0B 00 DB 00
10007E0C 00 DB 00
10007E0D 00 DB 00
10007E0E 00 DB 00
10007E0F 00 DB 00
10007E10 00 DB 00
10007E11 00 DB 00
10007E12 00 DB 00
10007E13 00 DB 00
10007E14 00 DB 00
10007E15 00 DB 00
10007E16 00 DB 00
10007E17 00 DB 00
10007E18 00 DB 00
10007E19 00 DB 00
10007E1A 00 DB 00
10007E1B 00 DB 00
10007E1C 00 DB 00
10007E1D 00 DB 00
10007E1E 00 DB 00
10007E1F 00 DB 00
10007E20 00 DB 00
10007E21 00 DB 00
10007E22 00 DB 00
10007E23 00 DB 00
10007E24 00 DB 00
10007E25 00 DB 00
10007E26 00 DB 00
10007E27 00 DB 00
10007E28 00 DB 00
10007E29 00 DB 00
10007E2A 00 DB 00
10007E2B 00 DB 00
10007E2C 00 DB 00
10007E2D 00 DB 00
10007E2E 00 DB 00
10007E2F 00 DB 00
10007E30 00 DB 00
10007E31 00 DB 00
10007E32 00 DB 00
10007E33 00 DB 00
10007E34 00 DB 00
10007E35 00 DB 00
10007E36 00 DB 00
10007E37 00 DB 00
10007E38 00 DB 00
10007E39 00 DB 00
10007E3A 00 DB 00
10007E3B 00 DB 00
10007E3C 00 DB 00
10007E3D 00 DB 00
10007E3E 00 DB 00
10007E3F 00 DB 00
10007E40 00 DB 00
10007E41 00 DB 00
10007E42 00 DB 00
10007E43 00 DB 00
10007E44 00 DB 00
10007E45 00 DB 00
10007E46 00 DB 00
10007E47 00 DB 00
10007E48 00 DB 00
10007E49 00 DB 00
10007E4A 00 DB 00
10007E4B 00 DB 00
10007E4C 00 DB 00
10007E4D 00 DB 00
10007E4E 00 DB 00
10007E4F 00 DB 00
10007E50 00 DB 00
10007E51 00 DB 00
10007E52 00 DB 00
10007E53 00 DB 00
10007E54 00 DB 00
10007E55 00 DB 00
10007E56 00 DB 00
10007E57 00 DB 00
10007E58 00 DB 00
10007E59 00 DB 00
10007E5A 00 DB 00
10007E5B 00 DB 00
10007E5C 00 DB 00
10007E5D 00 DB 00
10007E5E 00 DB 00
10007E5F 00 DB 00
10007E60 00 DB 00
10007E61 00 DB 00
10007E62 00 DB 00
10007E63 00 DB 00
10007E64 00 DB 00
10007E65 00 DB 00
10007E66 00 DB 00
10007E67 00 DB 00
10007E68 00 DB 00
10007E69 00 DB 00
10007E6A 00 DB 00
10007E6B 00 DB 00
10007E6C 00 DB 00
10007E6D 00 DB 00
10007E6E 00 DB 00
10007E6F 00 DB 00
10007E70 00 DB 00
10007E71 00 DB 00
10007E72 00 DB 00
10007E73 00 DB 00
10007E74 00 DB 00
10007E75 00 DB 00
10007E76 00 DB 00
10007E77 00 DB 00
10007E78 00 DB 00
10007E79 00 DB 00
10007E7A 00 DB 00
10007E7B 00 DB 00
10007E7C 00 DB 00
10007E7D 00 DB 00
10007E7E 00 DB 00
10007E7F 00 DB 00
10007E80 00 DB 00
10007E81 00 DB 00
10007E82 00 DB 00
10007E83 00 DB 00
10007E84 00 DB 00
10007E85 00 DB 00
10007E86 00 DB 00
10007E87 00 DB 00
10007E88 00 DB 00
10007E89 00 DB 00
10007E8A 00 DB 00
10007E8B 00 DB 00
10007E8C 00 DB 00
10007E8D 00 DB 00
10007E8E 00 DB 00
10007E8F 00 DB 00
10007E90 00 DB 00
10007E91 00 DB 00
10007E92 00 DB 00
10007E93 00 DB 00
10007E94 00 DB 00
10007E95 00 DB 00
10007E96 00 DB 00
10007E97 00 DB 00
10007E98 00 DB 00
10007E99 00 DB 00
10007E9A 00 DB 00
10007E9B 00 DB 00
10007E9C 00 DB 00
10007E9D 00 DB 00
10007E9E 00 DB 00
10007E9F 00 DB 00
10007EA0 00 DB 00
10007EA1 00 DB 00
10007EA2 00 DB 00
10007EA3 00 DB 00
10007EA4 00 DB 00
10007EA5 00 DB 00
10007EA6 00 DB 00
10007EA7 00 DB 00
10007EA8 00 DB 00
10007EA9 00 DB 00
10007EAA 00 DB 00
10007EAB 00 DB 00
10007EAC 00 DB 00
10007EAD 00 DB 00
10007EAE 00 DB 00
10007EAF 00 DB 00
10007EB0 00 DB 00
10007EB1 00 DB 00
10007EB2 00 DB 00
10007EB3 00 DB 00
10007EB4 00 DB 00
10007EB5 00 DB 00
10007EB6 00 DB 00
10007EB7 00 DB 00
10007EB8 00 DB 00
10007EB9 00 DB 00
10007EBA 00 DB 00
10007EBB 00 DB 00
10007EBC 00 DB 00
10007EBD 00 DB 00
10007EBE 00 DB 00
10007EBF 00 DB 00
10007EC0 00 DB 00
10007EC1 00 DB 00
10007EC2 00 DB 00
10007EC3 00 DB 00
10007EC4 00 DB 00
10007EC5 00 DB 00
10007EC6 00 DB 00
10007EC7 00 DB 00
10007EC8 00 DB 00
10007EC9 00 DB 00
10007ECA 00 DB 00
10007ECB 00 DB 00
10007ECC 00 DB 00
10007ECD 00 DB 00
10007ECE 00 DB 00
10007ECF 00 DB 00
10007ED0 00 DB 00
10007ED1 00 DB 00
10007ED2 00 DB 00
10007ED3 00 DB 00
10007ED4 00 DB 00
10007ED5 00 DB 00
10007ED6 00 DB 00
10007ED7 00 DB 00
10007ED8 00 DB 00
10007ED9 00 DB 00
10007EDA 00 DB 00
10007EDB 00 DB 00
10007EDC 00 DB 00
10007EDD 00 DB 00
10007EDE 00 DB 00
10007EDF 00 DB 00
10007EE0 00 DB 00
10007EE1 00 DB 00
10007EE2 00 DB 00
10007EE3 00 DB 00
10007EE4 00 DB 00
10007EE5 00 DB 00
10007EE6 00 DB 00
10007EE7 00 DB 00
10007EE8 00 DB 00
10007EE9 00 DB 00
10007EEA 00 DB 00
10007EEB 00 DB 00
10007EEC 00 DB 00
10007EED 00 DB 00
10007EEE 00 DB 00
10007EEF 00 DB 00
10007EF0 00 DB 00
10007EF1 00 DB 00
10007EF2 00 DB 00
10007EF3 00 DB 00
10007EF4 00 DB 00
10007EF5 00 DB 00
10007EF6 00 DB 00
10007EF7 00 DB 00
10007EF8 00 DB 00
10007EF9 00 DB 00
10007EFA 00 DB 00
10007EFB 00 DB 00
10007EFC 00 DB 00
10007EFD 00 DB 00
10007EFE 00 DB 00
10007EFF 00 DB 00
10007F00 00 DB 00
10007F01 00 DB 00
10007F02 00 DB 00
10007F03 00 DB 00
10007F04 00 DB 00
10007F05 00 DB 00
10007F06 00 DB 00
10007F07 00 DB 00
10007F08 00 DB 00
10007F09 00 DB 00
10007F0A 00 DB 00
10007F0B 00 DB 00
10007F0C 00 DB 00
10007F0D 00 DB 00
10007F0E 00 DB 00
10007F0F 00 DB 00
10007F10 00 DB 00
10007F11 00 DB 00
10007F12 00 DB 00
10007F13 00 DB 00
10007F14 00 DB 00
10007F15 00 DB 00
10007F16 00 DB 00
10007F17 00 DB 00
10007F18 00 DB 00
10007F19 00 DB 00
10007F1A 00 DB 00
10007F1B 00 DB 00
10007F1C 00 DB 00
10007F1D 00 DB 00
10007F1E 00 DB 00
10007F1F 00 DB 00
10007F20 00 DB 00
10007F21 00 DB 00
10007F22 00 DB 00
10007F23 00 DB 00
10007F24 00 DB 00
10007F25 00 DB 00
10007F26 00 DB 00
10007F27 00 DB 00
10007F28 00 DB 00
10007F29 00 DB 00
10007F2A 00 DB 00
10007F2B 00 DB 00
10007F2C 00 DB 00
10007F2D 00 DB 00
10007F2E 00 DB 00
10007F2F 00 DB 00
10007F30 00 DB 00
10007F31 00 DB 00
10007F32 00 DB 00
10007F33 00 DB 00
10007F34 00 DB 00
10007F35 00 DB 00
10007F36 00 DB 00
10007F37 00 DB 00
10007F38 00 DB 00
10007F39 00 DB 00
10007F3A 00 DB 00
10007F3B 00 DB 00
10007F3C 00 DB 00
10007F3D 00 DB 00
10007F3E 00 DB 00
10007F3F 00 DB 00
10007F40 00 DB 00
10007F41 00 DB 00
10007F42 00 DB 00
10007F43 00 DB 00
10007F44 00 DB 00
10007F45 00 DB 00
10007F46 00 DB 00
10007F47 00 DB 00
10007F48 00 DB 00
10007F49 00 DB 00
10007F4A 00 DB 00
10007F4B 00 DB 00
10007F4C 00 DB 00
10007F4D 00 DB 00
10007F4E 00 DB 00
10007F4F 00 DB 00
10007F50 00 DB 00
10007F51 00 DB 00
10007F52 00 DB 00
10007F53 00 DB 00
10007F54 00 DB 00
10007F55 00 DB 00
10007F56 00 DB 00
10007F57 00 DB 00
10007F58 00 DB 00
10007F59 00 DB 00
10007F5A 00 DB 00
10007F5B 00 DB 00
10007F5C 00 DB 00
10007F5D 00 DB 00
10007F5E 00 DB 00
10007F5F 00 DB 00
10007F60 00 DB 00
10007F61 00 DB 00
10007F62 00 DB 00
10007F63 00 DB 00
10007F64 00 DB 00
10007F65 00 DB 00
10007F66 00 DB 00
10007F67 00 DB 00
10007F68 00 DB 00
10007F69 00 DB 00
10007F6A 00 DB 00
10007F6B 00 DB 00
10007F6C 00 DB 00
10007F6D 00 DB 00
10007F6E 00 DB 00
10007F6F 00 DB 00
10007F70 00 DB 00
10007F71 00 DB 00
10007F72 00 DB 00
10007F73 00 DB 00
10007F74 00 DB 00
10007F75 00 DB 00
10007F76 00 DB 00
10007F77 00 DB 00
10007F78 00 DB 00
10007F79 00 DB 00
10007F7A 00 DB 00
10007F7B 00 DB 00
10007F7C 00 DB 00
10007F7D 00 DB 00
10007F7E 00 DB 00
10007F7F 00 DB 00
10007F80 00 DB 00
10007F81 00 DB 00
10007F82 00 DB 00
10007F83 00 DB 00
10007F84 00 DB 00
10007F85 00 DB 00
10007F86 00 DB 00
10007F87 00 DB 00
10007F88 00 DB 00
10007F89 00 DB 00
10007F8A 00 DB 00
10007F8B 00 DB 00
10007F8C 00 DB 00
10007F8D 00 DB 00
10007F8E 00 DB 00
10007F8F 00 DB 00
10007F90 00 DB 00
10007F91 00 DB 00
10007F92 00 DB 00
10007F93 00 DB 00
10007F94 00 DB 00
10007F95 00 DB 00
10007F96 00 DB 00
10007F97 00 DB 00
10007F98 00 DB 00
10007F99 00 DB 00
10007F9A 00 DB 00
10007F9B 00 DB 00
10007F9C 00 DB 00
10007F9D 00 DB 00
10007F9E 00 DB 00
10007F9F 00 DB 00
10007FA0 00 DB 00
10007FA1 00 DB 00
10007FA2 00 DB 00
10007FA3 00 DB 00
10007FA4 00 DB 00
10007FA5 00 DB 00
10007FA6 00 DB 00
10007FA7 00 DB 00
10007FA8 00 DB 00
10007FA9 00 DB 00
10007FAA 00 DB 00
10007FAB 00 DB 00
10007FAC 00 DB 00
10007FAD 00 DB 00
10007FAE 00 DB 00
10007FAF 00 DB 00
10007FB0 00 DB 00
10007FB1 00 DB 00
10007FB2 00 DB 00
10007FB3 00 DB 00
10007FB4 00 DB 00
10007FB5 00 DB 00
10007FB6 00 DB 00
10007FB7 00 DB 00
10007FB8 00 DB 00
10007FB9 00 DB 00
10007FBA 00 DB 00
10007FBB 00 DB 00
10007FBC 00 DB 00
10007FBD 00 DB 00
10007FBE 00 DB 00
10007FBF 00 DB 00
10007FC0 00 DB 00
10007FC1 00 DB 00
10007FC2 00 DB 00
10007FC3 00 DB 00
10007FC4 00 DB 00
10007FC5 00 DB 00
10007FC6 00 DB 00
10007FC7 00 DB 00
10007FC8 00 DB 00
10007FC9 00 DB 00
10007FCA 00 DB 00
10007FCB 00 DB 00
10007FCC 00 DB 00
10007FCD 00 DB 00
10007FCE 00 DB 00
10007FCF 00 DB 00
10007FD0 00 DB 00
10007FD1 00 DB 00
10007FD2 00 DB 00
10007FD3 00 DB 00
10007FD4 00 DB 00
10007FD5 00 DB 00
10007FD6 00 DB 00
10007FD7 00 DB 00
10007FD8 00 DB 00
10007FD9 00 DB 00
10007FDA 00 DB 00
10007FDB 00 DB 00
10007FDC 00 DB 00
10007FDD 00 DB 00
10007FDE 00 DB 00
10007FDF 00 DB 00
10007FE0 00 DB 00
10007FE1 00 DB 00
10007FE2 00 DB 00
10007FE3 00 DB 00
10007FE4 00 DB 00
10007FE5 00 DB 00
10007FE6 00 DB 00
10007FE7 00 DB 00
10007FE8 00 DB 00
10007FE9 00 DB 00
10007FEA 00 DB 00
10007FEB 00 DB 00
10007FEC 00 DB 00
10007FED 00 DB 00
10007FEE 00 DB 00
10007FEF 00 DB 00
10007FF0 00 DB 00
10007FF1 00 DB 00
10007FF2 00 DB 00
10007FF3 00 DB 00
10007FF4 00 DB 00
10007FF5 00 DB 00
10007FF6 00 DB 00
10007FF7 00 DB 00
10007FF8 00 DB 00
10007FF9 00 DB 00
10007FFA 00 DB 00
10007FFB 00 DB 00
10007FFC 00 DB 00
10007FFD 00 DB 00
10007FFE 00 DB 00
10007FFF 00 DB 00