rendered paste body00401156 je 004011B0
00401158 mov dword ptr ds:[0043F0C0h],eax
0040115D mov edx,dword ptr ds:[4482A8h]
00401163 test edx,edx
00401165 jne 004011F6
0040116B cmp edx,0FFFFFFE0h
0040116E je 00401190
00401170 mov eax,dword ptr ds:[00447B30h]
00401175 mov dword ptr [esp+4],eax
00401179 mov ebx,dword ptr ds:[4482A8h]
0040117F mov ecx,dword ptr [ebx+30h]
00401182 mov dword ptr [esp],ecx
00401185 call 00410850
0040118A mov edx,dword ptr ds:[4482A8h]
00401190 cmp edx,0FFFFFFC0h
00401193 je 004011B0
00401195 mov ebx,dword ptr ds:[447B30h]
0040119B mov dword ptr [esp+4],ebx
0040119F mov ecx,dword ptr ds:[4482A8h]
004011A5 mov edx,dword ptr [ecx+50h]
004011A8 mov dword ptr [esp],edx
004011AB call 00410850
004011B0 call 00410840
004011B5 mov ebx,dword ptr ds:[43F0C0h]
004011BB mov dword ptr [eax],ebx
004011BD call 0040CDE0
004011C2 and esp,0FFFFFFF0h
004011C5 call 00410820
004011CA mov ecx,dword ptr [eax]
004011CC mov dword ptr [esp+8],ecx
004011D0 mov edx,dword ptr ds:[443000h]
004011D6 mov dword ptr [esp+4],edx
004011DA mov eax,dword ptr ds:[00443004h]
004011DF mov dword ptr [esp],eax
004011E2 call 00401390
004011E7 mov ebx,eax
004011E9 call 00410810
004011EE mov dword ptr [esp],ebx
004011F1 call 00410B10
004011F6 mov dword ptr [esp+4],eax
004011FA mov edx,dword ptr ds:[4482A8h]
00401200 mov eax,dword ptr [edx+10h]
00401203 mov dword ptr [esp],eax
00401206 call 00410850
0040120B mov edx,dword ptr ds:[4482A8h]
00401211 jmp 0040116B
00401216 lea esi,[esi]
00401219 lea edi,[edi]
00401220 push ebp
00401221 mov ebp,esp
00401223 sub esp,8
00401226 mov dword ptr [esp],1
0040122D call dword ptr ds:[44828Ch]
00401233 call 00401100
00401238 nop
00401239 lea esi,[esi]
00401240 push ebp
00401241 mov ebp,esp
00401243 sub esp,8
00401246 mov dword ptr [esp],2
0040124D call dword ptr ds:[44828Ch]
00401253 call 00401100
00401258 nop
00401259 lea esi,[esi]
00401260 push ebp
00401261 mov ecx,dword ptr ds:[4482CCh]
00401267 mov ebp,esp
00401269 pop ebp
0040126A jmp ecx
0040126C lea esi,[esi]
00401270 push ebp
00401271 mov ecx,dword ptr ds:[4482B4h]
00401277 mov ebp,esp
00401279 pop ebp
0040127A jmp ecx
0040127C nop
0040127D nop
0040127E nop
0040127F nop
00401280 push ebp
00401281 mov ebp,esp
00401283 pop ebp
00401284 jmp 0040D040
00401289 nop
0040128A nop
0040128B nop
0040128C nop
0040128D nop
0040128E nop
0040128F nop
00401290 push ebp
00401291 mov ebp,esp
00401293 sub esp,28h
00401296 mov eax,dword ptr [ebp+10h]
00401299 mov dword ptr [esp],eax
0040129C call 004121D0
004012A1 dec eax
004012A2 mov dword ptr [ebp-4],eax
004012A5 mov eax,dword ptr [ebp+0Ch]
004012A8 dec eax
004012A9 mov dword ptr [ebp-0Ch],eax
004012AC lea eax,[ebp-0Ch]
004012AF mov dword ptr [esp+4],eax
004012B3 lea eax,[ebp-4]
004012B6 mov dword ptr [esp],eax
004012B9 call 0043B0C0
004012BE mov eax,dword ptr [eax]
004012C0 mov dword ptr [ebp-8],eax
004012C3 mov eax,dword ptr [ebp-4]
004012C6 mov dword ptr [ebp-10h],eax
004012C9 mov byte ptr [ebp-11h],1
004012CD mov dword ptr [ebp-18h],0
004012D4 mov eax,dword ptr [ebp-18h]
004012D7 cmp eax,dword ptr [ebp-8]
004012DA jae 00401315
004012DC cmp byte ptr [ebp-11h],0
004012E0 je 00401315
004012E2 mov eax,dword ptr [ebp-10h]
004012E5 mov dword ptr [esp+4],eax
004012E9 mov eax,dword ptr [ebp+10h]
004012EC mov dword ptr [esp],eax
004012EF call 00412800
004012F4 mov ecx,eax
004012F6 mov eax,dword ptr [ebp+8]
004012F9 mov edx,dword ptr [ebp-18h]
004012FC add edx,eax
004012FE movzx eax,byte ptr [ecx]
00401301 cmp al,byte ptr [edx]
00401303 sete al
00401306 mov byte ptr [ebp-11h],al
00401309 lea eax,[ebp-10h]
0040130C dec dword ptr [eax]
0040130E lea eax,[ebp-18h]
00401311 inc dword ptr [eax]
00401313 jmp 004012D4
00401315 cmp dword ptr [ebp-10h],0
00401319 je 0040134F
0040131B cmp byte ptr [ebp-11h],0
0040131F je 0040134F
00401321 mov eax,dword ptr [ebp-10h]
00401324 mov dword ptr [esp+4],eax
00401328 mov eax,dword ptr [ebp+10h]
0040132B mov dword ptr [esp],eax
0040132E call 00412800
00401333 mov ecx,eax
00401335 mov eax,dword ptr [ebp+8]
00401338 mov edx,dword ptr [ebp-8]
0040133B add edx,eax
0040133D movzx eax,byte ptr [ecx]
00401340 cmp al,byte ptr [edx]
00401342 sete al
00401345 mov byte ptr [ebp-11h],al
00401348 lea eax,[ebp-10h]
0040134B dec dword ptr [eax]
0040134D jmp 00401315
0040134F mov dword ptr [esp+4],0
00401357 mov eax,dword ptr [ebp+10h]
0040135A mov dword ptr [esp],eax
0040135D call 00412800
00401362 mov ecx,eax
00401364 mov eax,dword ptr [ebp+8]
00401367 mov edx,dword ptr [ebp-8]
0040136A add edx,eax
0040136C movzx eax,byte ptr [ecx]
0040136F cmp al,byte ptr [edx]
00401371 jg 0040137F
00401373 movzx eax,byte ptr [ebp-11h]
00401377 and eax,1
0040137A mov byte ptr [ebp-19h],al
0040137D jmp 00401383
0040137F mov byte ptr [ebp-19h],0
00401383 movzx eax,byte ptr [ebp-19h]
00401387 mov byte ptr [ebp-11h],al
0040138A movzx eax,byte ptr [ebp-11h]
0040138E leave
0040138F ret
00401390 push ebp
00401391 mov ebp,esp
00401393 sub esp,278h
00401399 and esp,0FFFFFFF0h
0040139C mov eax,0
004013A1 add eax,0Fh
004013A4 add eax,0Fh
004013A7 shr eax,4
004013AA shl eax,4
004013AD mov dword ptr [ebp-24Ch],eax
004013B3 mov eax,dword ptr [ebp-24Ch]
004013B9 call 0040D280
004013BE call 0040CEC0
004013C3 mov dword ptr [esp],440000h
004013CA call 00410B20
004013CF sub esp,4
004013D2 mov dword ptr [esp+4],440000h
004013DA mov dword ptr [esp],0
004013E1 call 00410AC0
004013E6 sub esp,8
004013E9 mov dword ptr [ebp-0Ch],eax
004013EC mov dword ptr [esp+4],0
004013F4 mov eax,dword ptr [ebp-0Ch]
004013F7 mov dword ptr [esp],eax
004013FA call 00410AD0
004013FF sub esp,8
00401402 mov dword ptr [esp],0
00401409 call 00410B30
0040140E sub esp,4
00401411 mov dword ptr [ebp-23Ch],eax
00401417 mov dword ptr [esp+8],104h
0040141F lea eax,[ebp-238h]
00401425 mov dword ptr [esp+4],eax
00401429 mov eax,dword ptr [ebp-23Ch]
0040142F mov dword ptr [esp],eax
00401432 call 00410B40
00401437 sub esp,0Ch
0040143A mov dword ptr [esp+4],104h
00401442 lea eax,[ebp-128h]
00401448 mov dword ptr [esp],eax
0040144B call 00410B50
00401450 sub esp,8
00401453 mov dword ptr [esp+4],440005h
0040145B lea eax,[ebp-128h]
00401461 mov dword ptr [esp],eax
00401464 call 00410870
00401469 mov dword ptr [esp+8],0
00401471 lea eax,[ebp-128h]
00401477 mov dword ptr [esp+4],eax
0040147B lea eax,[ebp-238h]
00401481 mov dword ptr [esp],eax
00401484 call 00410B60
00401489 sub esp,0Ch
0040148C lea eax,[ebp-240h]
00401492 mov dword ptr [esp+10h],eax
00401496 mov dword ptr [esp+0Ch],2
0040149E mov dword ptr [esp+8],0
004014A6 mov dword ptr [esp+4],440010h
004014AE mov dword ptr [esp],80000002h
004014B5 call 00410C60
004014BA sub esp,14h
004014BD mov dword ptr [esp+14h],104h
004014C5 lea eax,[ebp-128h]
004014CB mov dword ptr [esp+10h],eax
004014CF mov dword ptr [esp+0Ch],1
004014D7 mov dword ptr [esp+8],0
004014DF mov dword ptr [esp+4],440000h
004014E7 mov eax,dword ptr [ebp-240h]
004014ED mov dword ptr [esp],eax
004014F0 call 00410C70
004014F5 sub esp,18h
004014F8 mov eax,dword ptr [ebp-240h]
004014FE mov dword ptr [esp],eax
00401501 call 00410C80
00401506 sub esp,4
00401509 mov dword ptr [ebp-244h],1
00401513 cmp dword ptr [ebp-244h],0
0040151A jle 004015D6
00401520 mov dword ptr [esp],0Ah
00401527 call 00410B70
0040152C sub esp,4
0040152F mov dword ptr [esp],61h
00401536 call 00410AE0
0040153B sub esp,4
0040153E test ax,ax
00401541 je 00401513
00401543 mov dword ptr [ebp-248h],1
0040154D cmp dword ptr [ebp-248h],0
00401554 jle 00401513
00401556 mov dword ptr [esp],62h
0040155D call 00410AE0
00401562 sub esp,4
00401565 test ax,ax
00401568 je 0040159B
0040156A mov dword ptr [ebp-248h],0
00401574 mov dword ptr [esp+0Ch],0FFFFFFFFh
0040157C mov dword ptr [esp+8],0F170h
00401584 mov dword ptr [esp+4],112h
0040158C mov dword ptr [esp],0FFFFh
00401593 call 00410AF0
00401598 sub esp,10h
0040159B mov dword ptr [esp+0Ch],2
004015A3 mov dword ptr [esp+8],0F170h
004015AB mov dword ptr [esp+4],112h
004015B3 mov dword ptr [esp],0FFFFh
004015BA call 00410AF0
004015BF sub esp,10h
004015C2 mov dword ptr [esp],0Ah
004015C9 call 00410B70
004015CE sub esp,4
004015D1 jmp 0040154D
004015D6 mov eax,0
004015DB leave
004015DC ret
004015DD nop
004015DE push ebp
004015DF mov ebp,esp
004015E1 sub esp,8
004015E4 cmp dword ptr [ebp+0Ch],0FFFFh
004015EB jne 004015FF
004015ED cmp dword ptr [ebp+8],1
004015F1 jne 004015FF
004015F3 mov dword ptr [esp],443010h
004015FA call 00401820
004015FF cmp dword ptr [ebp+0Ch],0FFFFh
00401606 jne 0040161A
00401608 cmp dword ptr [ebp+8],0
0040160C jne 0040161A
0040160E mov dword ptr [esp],443010h
00401615 call 00401740
0040161A leave
0040161B ret
0040161C push ebp
0040161D mov ebp,esp
0040161F sub esp,8
00401622 mov dword ptr [esp+4],0FFFFh
0040162A mov dword ptr [esp],1
00401631 call 004015DE
00401636 leave
00401637 ret
00401638 push ebp
00401639 mov ebp,esp
0040163B sub esp,8
0040163E mov dword ptr [esp+4],0FFFFh
00401646 mov dword ptr [esp],0
0040164D call 004015DE
00401652 leave
00401653 ret
00401654 nop
00401655 nop
00401656 nop
00401657 nop
00401658 nop
00401659 nop
************
Thats my disassembly of it.
*************
'lockout.exe': Loaded 'C:\Documents and Settings\Administrator\Desktop\lockout.exe', Binary was not built with debug information.
'lockout.exe': Loaded 'C:\WINDOWS\system32\ntdll.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\kernel32.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\advapi32.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\rpcrt4.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\msvcrt.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\user32.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\gdi32.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\imm32.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\lpk.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\usp10.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\Program Files\NewDotNet\newdotnet7_48.dll', Binary was not built with debug information.
'lockout.exe': Loaded 'C:\WINDOWS\system32\ole32.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\oleaut32.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\urlmon.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\shlwapi.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\version.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\ws2_32.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\ws2help.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\wininet.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\crypt32.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\msasn1.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\setupapi.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\mpr.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\wintrust.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\imagehlp.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\shell32.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll', No symbols loaded.
'lockout.exe': Loaded 'C:\WINDOWS\system32\comctl32.dll', No symbols loaded.