https://pastein.ru/t/qHf
Загрузка данных
.text:00421200 public start
.text:00421200 start proc near
.text:00421200
.text:00421200 ; FUNCTION CHUNK AT .text:00421272 SIZE 0000009F BYTES
.text:00421200
.text:00421200 call sub_421207
.text:00421205 jmp short loc_421272
.text:00421205 start endp ; sp-analysis failed
.text:00421205
.text:00421207
.text:00421207 ; =============== S U B R O U T I N E =======================================
.text:00421207
.text:00421207 ; Attributes: bp-based frame
.text:00421207
.text:00421207 sub_421207 proc near ; CODE XREF: start↑p
.text:00421207
.text:00421207 PerformanceCount= LARGE_INTEGER ptr -10h
.text:00421207 SystemTimeAsFileTime= _FILETIME ptr -8
.text:00421207
.text:00421207 push ebp
.text:00421208 mov ebp, esp
.text:0042120A sub esp, 10h
.text:0042120D and byte ptr [ebp+SystemTimeAsFileTime.dwLowDateTime], 0
.text:00421211 and byte ptr [ebp+SystemTimeAsFileTime.dwHighDateTime], 0
.text:00421215 push ebx
.text:00421216 push edi
.text:00421217 test eax, eax
.text:00421219 jz short loc_42121F
.text:0042121B not eax
.text:0042121D jmp short loc_42126E
.text:0042121F ; ---------------------------------------------------------------------------
.text:0042121F
.text:0042121F loc_42121F: ; CODE XREF: sub_421207+12↑j
.text:0042121F push esi
.text:00421220 lea eax, [ebp+SystemTimeAsFileTime]
.text:00421223 push eax ; lpSystemTimeAsFileTime
.text:00421224 call ds:GetSystemTimeAsFileTime
.text:0042122A mov esi, [ebp+SystemTimeAsFileTime.dwHighDateTime]
.text:0042122D xor esi, [ebp+SystemTimeAsFileTime.dwLowDateTime]
.text:00421230 call ds:GetCurrentProcessId
.text:00421236 xor esi, eax
.text:00421238 call ds:GetCurrentThreadId
.text:0042123E xor esi, eax
.text:00421240 call ds:GetTickCount
.text:00421246 xor esi, eax
.text:00421248 lea eax, [ebp+PerformanceCount]
.text:0042124B push eax ; lpPerformanceCount
.text:0042124C call ds:QueryPerformanceCounter
.text:00421252 mov eax, dword ptr [ebp+PerformanceCount+4]
.text:00421255 xor eax, dword ptr [ebp+PerformanceCount]
.text:00421258 xor esi, eax
.text:0042125A cmp esi, edi
.text:0042125C jnz short loc_421260
.text:0042125E jmp short loc_42126B
.text:00421260 ; ---------------------------------------------------------------------------
.text:00421260
.text:00421260 loc_421260: ; CODE XREF: sub_421207+55↑j
.text:00421260 test esi, ebx
.text:00421262 jnz short loc_42126B
.text:00421264 mov eax, esi
.text:00421266 shl eax, 10h
.text:00421269 or esi, eax
.text:0042126B
.text:0042126B loc_42126B: ; CODE XREF: sub_421207+57↑j
.text:0042126B ; sub_421207+5B↑j
.text:0042126B not esi
.text:0042126D pop esi
.text:0042126E
.text:0042126E loc_42126E: ; CODE XREF: sub_421207+16↑j
.text:0042126E pop edi
.text:0042126F pop ebx
.text:00421270 leave
.text:00421271 retn
.text:00421271 sub_421207 endp
.text:00421271
.text:00421272 ; ---------------------------------------------------------------------------
.text:00421272 ; START OF FUNCTION CHUNK FOR start
.text:00421272
.text:00421272 loc_421272: ; CODE XREF: start+5↑j
.text:00421272 push 60h ; '`'
.text:00421274 push offset dword_401000
.text:00421279 call sub_421311
.text:0042127E and byte ptr [ebp+14h], 0
.text:00421282 lea eax, [ebp-70h]
.text:00421285 push eax ; lpStartupInfo
.text:00421286 call ds:GetStartupInfoW
.text:0042128C mov byte ptr [ebp+14h], 0FEh ; 'ю'
.text:00421290 mov edi, 94h ; '”'
.text:00421295 push edi ; dwBytes
.text:00421296 push 0 ; dwFlags
.text:00421298 db 3Eh
.text:00421298 mov ebx, GetProcessHeap
.text:0042129F call ebx ; GetProcessHeap
.text:004212A1 push eax ; hHeap
.text:004212A2 call ds:HeapAlloc
.text:004212A8 test eax, eax
.text:004212AA jnz short loc_4212AD
.text:004212AC retn
.text:004212AD ; ---------------------------------------------------------------------------
.text:004212AD
.text:004212AD loc_4212AD: ; CODE XREF: start+AA↑j
.text:004212AD mov [eax], edi
.text:004212AF push eax ; lpVersionInformation
.text:004212B0 mov edi, eax
.text:004212B2 call ds:GetVersionExA
.text:004212B8 push edi ; lpMem
.text:004212B9 push 0 ; dwFlags
.text:004212BB test eax, eax
.text:004212BD jnz short loc_4212C9
.text:004212BF call ebx ; GetProcessHeap
.text:004212C1 push eax ; hHeap
.text:004212C2 call ds:HeapFree
.text:004212C8 retn
.text:004212C9 ; ---------------------------------------------------------------------------
.text:004212C9
.text:004212C9 loc_4212C9: ; CODE XREF: start+BD↑j
.text:004212C9 mov eax, [edi+10h]
.text:004212CC mov [ebp-20h], eax
.text:004212CF mov eax, [edi+4]
.text:004212D2 mov [ebp-24h], eax
.text:004212D5 mov eax, [edi+8]
.text:004212D8 mov [ebp-28h], eax
.text:004212DB call ebx ; GetProcessHeap
.text:004212DD push eax ; hHeap
.text:004212DE call ds:HeapFree
.text:004212E4 mov edi, [ebp-20h]
.text:004212E7 cmp edi, 2
.text:004212EA jz short loc_4212F2
.text:004212EC or edi, 8000h
.text:004212F2
.text:004212F2 loc_4212F2: ; CODE XREF: start+EA↑j
.text:004212F2 mov ecx, [ebp-24h]
.text:004212F5 mov eax, ecx
.text:004212F7 shl eax, 8
.text:004212FA mov edx, [ebp-28h]
.text:004212FD add eax, edx
.text:004212FF mov [ebp-20h], edi
.text:00421302 mov [ebp-24h], eax
.text:00421305 mov [ebp-28h], ecx
.text:00421308 call sub_42134F
.text:0042130D mov [ebp-20h], eax
.text:00421310 retn
.text:00421310 ; END OF FUNCTION CHUNK FOR start
.text:00421311
.text:00421311 ; =============== S U B R O U T I N E =======================================
.text:00421311
.text:00421311
.text:00421311 sub_421311 proc near ; CODE XREF: start+79↑p
.text:00421311
.text:00421311 arg_4 = dword ptr 8
.text:00421311
.text:00421311 push offset dword_401000
.text:00421316 push large dword ptr fs:0
.text:0042131D mov eax, [esp+8+arg_4]
.text:00421321 lea ebp, [esp+8+arg_4]
.text:00421325 sub esp, eax
.text:00421327 push ebx
.text:00421328 push esi
.text:00421329 push edi
.text:0042132A mov eax, offset dword_401000
.text:0042132F xor [ebp-4], eax
.text:00421332 xor eax, ebp
.text:00421334 push eax
.text:00421335 mov [ebp-18h], esp
.text:00421338 push dword ptr [ebp-8]
.text:0042133B mov eax, [ebp-4]
.text:0042133E mov byte ptr [ebp-4], 0FEh ; 'ю'
.text:00421342 mov [ebp-8], eax
.text:00421345 lea eax, [ebp-10h]
.text:00421348 mov large fs:0, eax
.text:0042134E retn
.text:0042134E sub_421311 endp ; sp-analysis failed
.text:0042134E
.text:0042134F
.text:0042134F ; =============== S U B R O U T I N E =======================================
.text:0042134F
.text:0042134F ; Attributes: bp-based frame
.text:0042134F
.text:0042134F sub_42134F proc near ; CODE XREF: start+108↑p
.text:0042134F
.text:0042134F lpAddress = dword ptr -24h
.text:0042134F var_20 = dword ptr -20h
.text:0042134F var_1C = dword ptr -1Ch
.text:0042134F var_18 = dword ptr -18h
.text:0042134F var_C = dword ptr -0Ch
.text:0042134F var_8 = dword ptr -8
.text:0042134F var_4 = dword ptr -4
.text:0042134F arg_70 = dword ptr 78h
.text:0042134F arg_84 = dword ptr 8Ch
.text:0042134F
.text:0042134F push ebp
.text:00421350 mov ebp, esp
.text:00421352 sub esp, 30h
.text:00421355 xor ebx, ebx
.text:00421357 push 4 ; flProtect
.text:00421359 push 1000h ; flAllocationType
.text:0042135E push 20200h ; dwSize
.text:00421363 push ebx ; lpAddress
.text:00421364 call ds:VirtualAlloc
.text:0042136A mov [ebp+var_18], eax
.text:0042136D xor ebx, ebx
.text:0042136F push 4 ; flProtect
.text:00421371 push 1000h ; flAllocationType
.text:00421376 mov ecx, 20200h
.text:0042137B shr ecx, 7
.text:0042137E cmp ecx, 100h
.text:00421384 ja short loc_42138B
.text:00421386 mov ecx, 100h
.text:0042138B
.text:0042138B loc_42138B: ; CODE XREF: sub_42134F+35↑j
.text:0042138B push ecx ; dwSize
.text:0042138C push ebx ; lpAddress
.text:0042138D call ds:VirtualAlloc
.text:00421393 mov [ebp+lpAddress], eax
.text:00421396 mov ecx, 20200h
.text:0042139B shr ecx, 8
.text:0042139E mov edi, 0
.text:004213A3 call sub_421667
.text:004213A8 mov ebx, ecx
.text:004213AA xor edx, edx
.text:004213AC
.text:004213AC loc_4213AC: ; CODE XREF: sub_42134F+7F↓j
.text:004213AC mov eax, [ebp+lpAddress]
.text:004213AF movsx edi, word ptr [eax+edx*2]
.text:004213B3 shl edi, 8
.text:004213B6 add edi, [ebp+var_18]
.text:004213B9 mov esi, edx
.text:004213BB shl esi, 8
.text:004213BE add esi, offset dword_401000
.text:004213C4 mov ecx, 100h
.text:004213C9 rep movsb
.text:004213CB inc edx
.text:004213CC cmp edx, ebx
.text:004213CE jnz short loc_4213AC
.text:004213D0 mov ecx, 80h ; 'Ђ'
.text:004213D5 mov edi, 0
.text:004213DA call sub_421667
.text:004213DF xor ebx, ebx
.text:004213E1 push 4 ; flProtect
.text:004213E3 push 1000h ; flAllocationType
.text:004213E8 push 200h ; dwSize
.text:004213ED push ebx ; lpAddress
.text:004213EE call ds:VirtualAlloc
.text:004213F4 mov [ebp+var_4], eax
.text:004213F7 xor ebx, ebx
.text:004213F9 push 4 ; flProtect
.text:004213FB push 1000h ; flAllocationType
.text:00421400 push 200h ; dwSize
.text:00421405 push ebx ; lpAddress
.text:00421406 call ds:VirtualAlloc
.text:0042140C mov [ebp+var_8], eax
.text:0042140F xor eax, eax
.text:00421411 mov [ebp+var_C], eax
.text:00421414
.text:00421414 loc_421414: ; CODE XREF: sub_42134F+13E↓j
.text:00421414 mov edi, [ebp+var_4]
.text:00421417 mov esi, [ebp+var_18]
.text:0042141A mov eax, [ebp+var_C]
.text:0042141D mov ecx, 200h
.text:00421422 add esi, eax
.text:00421424 rep movsb
.text:00421426 xor ecx, ecx
.text:00421428
.text:00421428 loc_421428: ; CODE XREF: sub_42134F+104↓j
.text:00421428 mov ebx, [ebp+var_4]
.text:0042142B mov bl, [ebx+ecx]
.text:0042142E mov eax, ecx
.text:00421430 xor edx, edx
.text:00421432 mov esi, 80h ; 'Ђ'
.text:00421437 div esi
.text:00421439 push edx
.text:0042143A mul esi
.text:0042143C pop edx
.text:0042143D mov esi, [ebp+lpAddress]
.text:00421440 mov dx, [esi+edx*2]
.text:00421444 add eax, edx
.text:00421446 mov edx, [ebp+var_8]
.text:00421449 mov [edx+eax], bl
.text:0042144C inc ecx
.text:0042144D cmp ecx, 200h
.text:00421453 jnz short loc_421428
.text:00421455 xor ecx, ecx
.text:00421457
.text:00421457 loc_421457: ; CODE XREF: sub_42134F+12E↓j
.text:00421457 mov ebx, [ebp+var_8]
.text:0042145A mov bl, [ebx+ecx]
.text:0042145D mov eax, ecx
.text:0042145F xor edx, edx
.text:00421461 mov esi, 80h ; 'Ђ'
.text:00421466 div esi
.text:00421468 rol edx, 2
.text:0042146B add eax, edx
.text:0042146D mov edx, [ebp+var_18]
.text:00421470 add edx, [ebp+var_C]
.text:00421473 mov [edx+eax], bl
.text:00421476 inc ecx
.text:00421477 cmp ecx, 200h
.text:0042147D jnz short loc_421457
.text:0042147F add [ebp+var_C], 200h
.text:00421486 cmp [ebp+var_C], 20200h
.text:0042148D jnz short loc_421414
.text:0042148F push 8000h ; dwFreeType
.text:00421494 mov ecx, 20200h
.text:00421499 shr ecx, 7
.text:0042149C cmp ecx, 100h
.text:004214A2 ja short loc_4214A9
.text:004214A4 mov ecx, 100h
.text:004214A9
.text:004214A9 loc_4214A9: ; CODE XREF: sub_42134F+153↑j
.text:004214A9 push ecx ; dwSize
.text:004214AA push [ebp+lpAddress] ; lpAddress
.text:004214AD call ds:VirtualFree
.text:004214B3 push 8000h ; dwFreeType
.text:004214B8 push 200h ; dwSize
.text:004214BD push [ebp+var_4] ; lpAddress
.text:004214C0 call ds:VirtualFree
.text:004214C6 push 8000h ; dwFreeType
.text:004214CB push 200h ; dwSize
.text:004214D0 push [ebp+var_8] ; lpAddress
.text:004214D3 call ds:VirtualFree
.text:004214D9 mov eax, [ebp+var_18]
.text:004214DC mov ebx, [eax+3Ch]
.text:004214DF lea edx, [eax+ebx]
.text:004214E2 mov [ebp+var_20], edx
.text:004214E5 mov edx, [ebp+var_20]
.text:004214E8 mov esi, [edx+50h]
.text:004214EB xor ebx, ebx
.text:004214ED push 40h ; '@' ; flProtect
.text:004214EF push 1000h ; flAllocationType
.text:004214F4 push esi ; dwSize
.text:004214F5 push ebx ; lpAddress
.text:004214F6 call ds:VirtualAlloc
.text:004214FC mov [ebp+var_1C], eax
.text:004214FF mov edx, [ebp+var_20]
.text:00421502 mov ecx, [edx+54h]
.text:00421505 mov edi, [ebp+var_1C]
.text:00421508 mov esi, [ebp+var_18]
.text:0042150B rep movsb
.text:0042150D lea eax, [edx+0F8h]
.text:00421513 movzx ebx, word ptr [edx+6]
.text:00421517
.text:00421517 loc_421517: ; CODE XREF: sub_42134F+1DF↓j
.text:00421517 mov esi, [ebp+var_18]
.text:0042151A add esi, [eax+14h]
.text:0042151D mov edi, [ebp+var_1C]
.text:00421520 add edi, [eax+0Ch]
.text:00421523 mov ecx, [eax+10h]
.text:00421526 rep movsb
.text:00421528 dec ebx
.text:00421529 add eax, 28h ; '('
.text:0042152C test ebx, ebx
.text:0042152E jnz short loc_421517
.text:00421530 mov edx, [ebp+var_20]
.text:00421533 mov eax, [ebp+var_1C]
.text:00421536 mov ebx, [edx+34h]
.text:00421539 sub eax, ebx
.text:0042153B mov [ebp+var_4], eax
.text:0042153E mov esi, [edx+0A0h]
.text:00421544 test esi, esi
.text:00421546 jz short loc_421592
.text:00421548 add esi, [ebp+var_1C]
.text:0042154B mov edx, [edx+0A4h]
.text:00421551 xor eax, eax
.text:00421553
.text:00421553 loc_421553: ; CODE XREF: sub_42134F+241↓j
.text:00421553 mov edi, [esi]
.text:00421555 test edi, edi
.text:00421557 jz short loc_421592
.text:00421559 add edi, [ebp+var_1C]
.text:0042155C add esi, 8
.text:0042155F mov ecx, [esi-4]
.text:00421562 sub edx, ecx
.text:00421564 sub ecx, 8
.text:00421567
.text:00421567 loc_421567: ; CODE XREF: sub_42134F+23D↓j
.text:00421567 xor eax, eax
.text:00421569 lodsw
.text:0042156B xor ebx, ebx
.text:0042156D mov bx, ax
.text:00421570 ror eax, 0Ch
.text:00421573 cmp ax, 3
.text:00421577 jnz short loc_421587
.text:00421579 and bx, 0FFFh
.text:0042157E mov eax, [edi+ebx]
.text:00421581 add eax, [ebp+var_4]
.text:00421584 mov [edi+ebx], eax
.text:00421587
.text:00421587 loc_421587: ; CODE XREF: sub_42134F+228↑j
.text:00421587 sub ecx, 2
.text:0042158A test ecx, ecx
.text:0042158C jnz short loc_421567
.text:0042158E test edx, edx
.text:00421590 jnz short loc_421553
.text:00421592
.text:00421592 loc_421592: ; CODE XREF: sub_42134F+1F7↑j
.text:00421592 ; sub_42134F+208↑j
.text:00421592 mov edi, [ebp+var_20]
.text:00421595 mov edi, [edi+28h]
.text:00421598 add edi, [ebp+var_1C]
.text:0042159B mov edx, [ebp+var_20]
.text:0042159E mov eax, [edx+80h]
.text:004215A4 add eax, [ebp+var_1C]
.text:004215A7 mov [ebp+var_C], eax
.text:004215AA
.text:004215AA loc_4215AA: ; CODE XREF: sub_42134F+2AF↓j
.text:004215AA mov eax, [eax+0Ch]
.text:004215AD add eax, [ebp+var_1C]
.text:004215B0 push eax ; lpLibFileName
.text:004215B1 call ds:LoadLibraryA
.text:004215B7 mov esi, eax
.text:004215B9 mov eax, [ebp+var_C]
.text:004215BC mov ebx, [eax+10h]
.text:004215BF add ebx, [ebp+var_1C]
.text:004215C2 mov edi, ebx
.text:004215C4 mov eax, [ebx]
.text:004215C6
.text:004215C6 loc_4215C6: ; CODE XREF: sub_42134F+2A0↓j
.text:004215C6 mov edx, eax
.text:004215C8 and edx, 80000000h
.text:004215CE test edx, edx
.text:004215D0 jz short loc_4215D9
.text:004215D2 and eax, 7FFFFFFFh
.text:004215D7 jmp short loc_4215DF
.text:004215D9 ; ---------------------------------------------------------------------------
.text:004215D9
.text:004215D9 loc_4215D9: ; CODE XREF: sub_42134F+281↑j
.text:004215D9 add eax, [ebp+var_1C]
.text:004215DC add eax, 2
.text:004215DF
.text:004215DF loc_4215DF: ; CODE XREF: sub_42134F+288↑j
.text:004215DF push eax ; lpProcName
.text:004215E0 push esi ; hModule
.text:004215E1 call ds:GetProcAddress
.text:004215E7 stosd
.text:004215E8 lea ebx, [ebx+4]
.text:004215EB mov eax, [ebx]
.text:004215ED test eax, eax
.text:004215EF jnz short loc_4215C6
.text:004215F1 mov eax, [ebp+var_C]
.text:004215F4 add eax, 14h
.text:004215F7 mov [ebp+var_C], eax
.text:004215FA mov ecx, [eax]
.text:004215FC test ecx, ecx
.text:004215FE jnz short loc_4215AA
.text:00421600 mov eax, large fs:30h
.text:00421606 mov ecx, [eax+0Ch]
.text:00421609 mov ecx, [ecx+0Ch]
.text:0042160C
.text:0042160C loc_42160C: ; CODE XREF: sub_42134F+2CA↓j
.text:0042160C mov ebx, [ecx+18h]
.text:0042160F cmp ebx, 400000h
.text:00421615 jz short loc_42161B
.text:00421617 mov ecx, [ecx]
.text:00421619 jmp short loc_42160C
.text:0042161B ; ---------------------------------------------------------------------------
.text:0042161B
.text:0042161B loc_42161B: ; CODE XREF: sub_42134F+2C6↑j
.text:0042161B mov edx, [ebp+var_1C]
.text:0042161E mov ebx, [eax+8]
.text:00421621 cmp ebx, [ecx+18h]
.text:00421624 jnz short loc_421629
.text:00421626 mov [eax+8], edx
.text:00421629
.text:00421629 loc_421629: ; CODE XREF: sub_42134F+2D5↑j
.text:00421629 mov [ecx+18h], edx
.text:0042162C mov dword ptr [ecx+1Ch], 81D0h
.text:00421633 add [ecx+1Ch], edx
.text:00421636 mov dword ptr [ecx+20h], 24000h
.text:0042163D mov eax, [ebp+var_20]
.text:00421640 mov edi, [eax+28h]
.text:00421643 add edi, [ebp+var_1C]
.text:00421646 mov eax, [ebp+arg_70]
.text:00421649 mov large fs:0, eax
.text:0042164F add esp, 30h
.text:00421652 pop ebp
.text:00421653 add esp, 88h
.text:00421659 mov eax, [esp-8Ch+arg_84]
.text:0042165C push eax
.text:0042165D mov [esp-88h+arg_84], 6Ah ; 'j'
.text:00421665 jmp edi
.text:00421665 sub_42134F endp ; sp-analysis failed
.text:00421665