DIP
public text v1 · immutable4FD98830 8BFF MOV EDI,EDI
4FD98832 55 PUSH EBP
4FD98833 8BEC MOV EBP,ESP
4FD98835 6A FF PUSH -1
4FD98837 |. 68 5816E94F PUSH 4FE91658 ; SE handler installation
4FD9883C |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
4FD98842 50 PUSH EAX
4FD98843 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
4FD9884A |. 83EC 0C SUB ESP,0C
4FD9884D 53 PUSH EBX
4FD9884E 56 PUSH ESI
4FD9884F 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]
4FD98852 57 PUSH EDI
4FD98853 33FF XOR EDI,EDI
4FD98855 3BF7 CMP ESI,EDI
4FD98857 8965 F0 MOV DWORD PTR SS:[EBP-10],ESP
4FD9885A 74 05 JE SHORT 4FD98861
4FD9885C 8D5E 04 LEA EBX,DWORD PTR DS:[ESI+4]
4FD9885F EB 02 JMP SHORT 4FD98863
4FD98861 33DB XOR EBX,EBX
4FD98863 397B 18 CMP DWORD PTR DS:[EBX+18],EDI
4FD98866 895D E8 MOV DWORD PTR SS:[EBP-18],EBX
4FD98869 897D EC MOV DWORD PTR SS:[EBP-14],EDI
4FD9886C 74 07 JE SHORT 4FD98875
4FD9886E 53 PUSH EBX ; /pCriticalSection
4FD9886F FF15 2811D14F CALL DWORD PTR DS:[<&KERNEL32.EnterCriticalSection>] ; \EnterCriticalSection
4FD98875 F646 2C 02 TEST BYTE PTR DS:[ESI+2C],2
4FD98879 897D FC MOV DWORD PTR SS:[EBP-4],EDI
4FD9887C 74 24 JE SHORT 4FD988A2
4FD9887E 397B 18 CMP DWORD PTR DS:[EBX+18],EDI
4FD98881 74 07 JE SHORT 4FD9888A
4FD98883 53 PUSH EBX ; /pCriticalSection
4FD98884 FF15 C010D14F CALL DWORD PTR DS:[<&KERNEL32.LeaveCriticalSection>] ; \LeaveCriticalSection
4FD9888A B8 6C087688 MOV EAX,8876086C
4FD9888F 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
4FD98892 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
4FD98899 5F POP EDI
4FD9889A 5E POP ESI
4FD9889B 5B POP EBX
4FD9889C 8BE5 MOV ESP,EBP
4FD9889E 5D POP EBP
4FD9889F C2 1C00 RET 1C
4FD988A2 F646 2C 08 TEST BYTE PTR DS:[ESI+2C],8
4FD988A6 C645 FC 01 MOV BYTE PTR SS:[EBP-4],1
4FD988AA 74 28 JE SHORT 4FD988D4
4FD988AC 8B4D 1C MOV ECX,DWORD PTR SS:[EBP+1C]
4FD988AF 8B55 18 MOV EDX,DWORD PTR SS:[EBP+18]
4FD988B2 8B06 MOV EAX,DWORD PTR DS:[ESI]
4FD988B4 57 PUSH EDI
4FD988B5 8B7D 10 MOV EDI,DWORD PTR SS:[EBP+10]
4FD988B8 51 PUSH ECX
4FD988B9 8B4D 20 MOV ECX,DWORD PTR SS:[EBP+20]
4FD988BC 6A 01 PUSH 1
4FD988BE 52 PUSH EDX
4FD988BF |. 8B55 14 MOV EDX,DWORD PTR SS:[EBP+14]
4FD988C2 51 PUSH ECX
4FD988C3 8D0C17 LEA ECX,DWORD PTR DS:[EDI+EDX]
4FD988C6 8B55 0C MOV EDX,DWORD PTR SS:[EBP+C]
4FD988C9 51 PUSH ECX
4FD988CA |. 52 PUSH EDX
4FD988CB |. 56 PUSH ESI
4FD988CC |. FF90 6C020000 CALL DWORD PTR DS:[EAX+26C]
4FD988D2 |. EB 03 JMP SHORT 4FD988D7
4FD988D4 8B7D 10 MOV EDI,DWORD PTR SS:[EBP+10]
4FD988D7 8B86 0C210000 MOV EAX,DWORD PTR DS:[ESI+210C]
4FD988DD 8978 14 MOV DWORD PTR DS:[EAX+14],EDI
4FD988E0 8B86 A01F0000 MOV EAX,DWORD PTR DS:[ESI+1FA0]
4FD988E6 |. F6C4 02 TEST AH,2
4FD988E9 |. 74 09 JE SHORT 4FD988F4
4FD988EB |. 8B0E MOV ECX,DWORD PTR DS:[ESI]
4FD988ED |. 56 PUSH ESI
4FD988EE |. FF91 68020000 CALL DWORD PTR DS:[ECX+268]
4FD988F4 8B55 20 MOV EDX,DWORD PTR SS:[EBP+20]
4FD988F7 8B45 1C MOV EAX,DWORD PTR SS:[EBP+1C]
4FD988FA 8B4D 18 MOV ECX,DWORD PTR SS:[EBP+18]
4FD988FD 52 PUSH EDX
4FD988FE 8B55 14 MOV EDX,DWORD PTR SS:[EBP+14]
4FD98901 50 PUSH EAX
4FD98902 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C]
4FD98905 51 PUSH ECX
4FD98906 52 PUSH EDX
4FD98907 57 PUSH EDI
4FD98908 50 PUSH EAX
4FD98909 56 PUSH ESI
4FD9890A FF96 28210000 CALL DWORD PTR DS:[ESI+2128]
4FD98910 |. 8B43 18 MOV EAX,DWORD PTR DS:[EBX+18]
4FD98913 |. 83C4 1C ADD ESP,1C
4FD98916 |. 85C0 TEST EAX,EAX
4FD98918 |. 74 07 JE SHORT 4FD98921
4FD9891A |. 53 PUSH EBX ; /pCriticalSection
4FD9891B |. FF15 C010D14F CALL DWORD PTR DS:[<&KERNEL32.LeaveCriticalSection>] ; \LeaveCriticalSection
4FD98921 |> 33C0 XOR EAX,EAX
4FD98923 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
4FD98926 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
4FD9892D 5F POP EDI
4FD9892E 5E POP ESI
4FD9892F 5B POP EBX
4FD98930 8BE5 MOV ESP,EBP
4FD98932 5D POP EBP
4FD98933 C2 1C00 RET 1C
4FD98936 B8 3C89D94F MOV EAX,4FD9893C
4FD9893B C3 RET
4FD9893C 8D4D E8 LEA ECX,DWORD PTR SS:[EBP-18]
4FD9893F C745 FC FFFFFFFF MOV DWORD PTR SS:[EBP-4],-1
4FD98946 E8 C5D4F9FF CALL 4FD35E10
4FD9894B 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
4FD9894E 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
4FD98951 5F POP EDI
4FD98952 5E POP ESI
4FD98953 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
4FD9895A . 5B POP EBX
4FD9895B . 8BE5 MOV ESP,EBP
4FD9895D . 5D POP EBP
4FD9895E . C2 1C00 RET 1C