00401DE0 /> 55 PUSH EBP 00401DE1 |. 8BEC MOV EBP,ESP 00401DE3 |. 6A FF PUSH -1 00401DE5 |. 68 D9B74000 PUSH Setup.0040B7D9 ; SE handler installation 00401DEA |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 00401DF0 |. 50 PUSH EAX 00401DF1 |. 64:8925 000000>MOV DWORD PTR FS:[0],ESP 00401DF8 |. 81EC 60010000 SUB ESP,160 00401DFE |. 53 PUSH EBX 00401DFF |. 56 PUSH ESI 00401E00 |. 57 PUSH EDI 00401E01 |. 894D F0 MOV DWORD PTR SS:[EBP-10],ECX 00401E04 |. 8D4D BC LEA ECX,DWORD PTR SS:[EBP-44] 00401E07 |. E8 267C0000 CALL 00401E0C |. C745 FC 000000>MOV DWORD PTR SS:[EBP-4],0 00401E13 |. C745 B4 000000>MOV DWORD PTR SS:[EBP-4C],0 00401E1A |. A0 2CD24100 MOV AL,BYTE PTR DS:[41D22C] 00401E1F |. 8885 78FFFFFF MOV BYTE PTR SS:[EBP-88],AL 00401E25 |. B9 0C000000 MOV ECX,0C 00401E2A |. 33C0 XOR EAX,EAX 00401E2C |. 8DBD 79FFFFFF LEA EDI,DWORD PTR SS:[EBP-87] 00401E32 |. F3:AB REP STOS DWORD PTR ES:[EDI] 00401E34 |. AA STOS BYTE PTR ES:[EDI] 00401E35 |. 8A0D 2CD24100 MOV CL,BYTE PTR DS:[41D22C] 00401E3B |. 888D 40FFFFFF MOV BYTE PTR SS:[EBP-C0],CL 00401E41 |. B9 0C000000 MOV ECX,0C 00401E46 |. 33C0 XOR EAX,EAX 00401E48 |. 8DBD 41FFFFFF LEA EDI,DWORD PTR SS:[EBP-BF] 00401E4E |. F3:AB REP STOS DWORD PTR ES:[EDI] 00401E50 |. AA STOS BYTE PTR ES:[EDI] 00401E51 |. C785 18FFFFFF >MOV DWORD PTR SS:[EBP-E8],0 00401E5B |. 8D55 B4 LEA EDX,DWORD PTR SS:[EBP-4C] 00401E5E |. 8955 B0 MOV DWORD PTR SS:[EBP-50],EDX 00401E61 |. 8D45 B8 LEA EAX,DWORD PTR SS:[EBP-48] 00401E64 |. 8945 AC MOV DWORD PTR SS:[EBP-54],EAX 00401E67 |. 8D8D 40FFFFFF LEA ECX,DWORD PTR SS:[EBP-C0] 00401E6D |. 898D 3CFFFFFF MOV DWORD PTR SS:[EBP-C4],ECX 00401E73 |. 8D95 78FFFFFF LEA EDX,DWORD PTR SS:[EBP-88] 00401E79 |. 8995 74FFFFFF MOV DWORD PTR SS:[EBP-8C],EDX 00401E7F |. 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10] 00401E82 |. 05 98000000 ADD EAX,98 00401E87 |. 50 PUSH EAX 00401E88 |. 8D4D BC LEA ECX,DWORD PTR SS:[EBP-44] 00401E8B |. E8 CC7B0000 CALL 00401E90 |. 8D4D BC LEA ECX,DWORD PTR SS:[EBP-44] 00401E93 |. E8 A07B0000 CALL 00401E98 |. 50 PUSH EAX ; /src 00401E99 |. 8D8D 40FFFFFF LEA ECX,DWORD PTR SS:[EBP-C0] ; | 00401E9F |. 51 PUSH ECX ; |dest 00401EA0 |. E8 DB7D0000 CALL ; \strcpy 00401EA5 |. 83C4 08 ADD ESP,8 00401EA8 |. 8D95 40FFFFFF LEA EDX,DWORD PTR SS:[EBP-C0] 00401EAE |. 52 PUSH EDX ; /s 00401EAF |. E8 D87D0000 CALL ; \strlen 00401EB4 |. 83C4 04 ADD ESP,4 00401EB7 |. C1E8 02 SHR EAX,2 00401EBA |. 8985 18FFFFFF MOV DWORD PTR SS:[EBP-E8],EAX 00401EC0 |. E8 9F790000 CALL 00401EC5 |. 8985 0CFFFFFF MOV DWORD PTR SS:[EBP-F4],EAX 00401ECB |. 8D45 C0 LEA EAX,DWORD PTR SS:[EBP-40] 00401ECE |. 50 PUSH EAX 00401ECF |. 8B8D 0CFFFFFF MOV ECX,DWORD PTR SS:[EBP-F4] 00401ED5 |. 51 PUSH ECX 00401ED6 |. E8 83790000 CALL 00401EDB |. 83C4 08 ADD ESP,8 00401EDE |. C785 08FFFFFF >MOV DWORD PTR SS:[EBP-F8],0 00401EE8 |. EB 0F JMP SHORT Setup.00401EF9 00401EEA |> 8B95 08FFFFFF /MOV EDX,DWORD PTR SS:[EBP-F8] 00401EF0 |. 83C2 01 |ADD EDX,1 00401EF3 |. 8995 08FFFFFF |MOV DWORD PTR SS:[EBP-F8],EDX 00401EF9 |> 8B85 08FFFFFF MOV EAX,DWORD PTR SS:[EBP-F8] 00401EFF |. 3B85 18FFFFFF |CMP EAX,DWORD PTR SS:[EBP-E8] 00401F05 |. 0F8D C7010000 |JGE Setup.004020D2 00401F0B |. 8B8D 08FFFFFF |MOV ECX,DWORD PTR SS:[EBP-F8] 00401F11 |. 33D2 |XOR EDX,EDX 00401F13 |. 8A948D 40FFFFF>|MOV DL,BYTE PTR SS:[EBP+ECX*4-C0] 00401F1A |. 83EA 3C |SUB EDX,3C 00401F1D |. 8895 38FFFFFF |MOV BYTE PTR SS:[EBP-C8],DL 00401F23 |. 8B85 08FFFFFF |MOV EAX,DWORD PTR SS:[EBP-F8] 00401F29 |. 33C9 |XOR ECX,ECX 00401F2B |. 8A8C85 41FFFFF>|MOV CL,BYTE PTR SS:[EBP+EAX*4-BF] 00401F32 |. 83E9 3C |SUB ECX,3C 00401F35 |. 888D 34FFFFFF |MOV BYTE PTR SS:[EBP-CC],CL 00401F3B |. 8B95 08FFFFFF |MOV EDX,DWORD PTR SS:[EBP-F8] 00401F41 |. 33C0 |XOR EAX,EAX 00401F43 |. 8A8495 42FFFFF>|MOV AL,BYTE PTR SS:[EBP+EDX*4-BE] 00401F4A |. 83E8 3C |SUB EAX,3C 00401F4D |. 8885 30FFFFFF |MOV BYTE PTR SS:[EBP-D0],AL 00401F53 |. 8B8D 08FFFFFF |MOV ECX,DWORD PTR SS:[EBP-F8] 00401F59 |. 33D2 |XOR EDX,EDX 00401F5B |. 8A948D 43FFFFF>|MOV DL,BYTE PTR SS:[EBP+ECX*4-BD] 00401F62 |. 83EA 3C |SUB EDX,3C 00401F65 |. 8895 2CFFFFFF |MOV BYTE PTR SS:[EBP-D4],DL 00401F6B |. 8B45 C8 |MOV EAX,DWORD PTR SS:[EBP-38] 00401F6E |. 50 |PUSH EAX 00401F6F |. 8B4D C0 |MOV ECX,DWORD PTR SS:[EBP-40] 00401F72 |. 51 |PUSH ECX 00401F73 |. 8B85 38FFFFFF |MOV EAX,DWORD PTR SS:[EBP-C8] 00401F79 |. 25 FF000000 |AND EAX,0FF 00401F7E |. 99 |CDQ 00401F7F |. 52 |PUSH EDX 00401F80 |. 50 |PUSH EAX 00401F81 |. E8 D2780000 |CALL 00401F86 |. 83C4 0C |ADD ESP,0C 00401F89 |. 52 |PUSH EDX 00401F8A |. 50 |PUSH EAX ; nview.00F71AE5 00401F8B |. E8 C2780000 |CALL 00401F90 |. 83C4 0C |ADD ESP,0C 00401F93 |. 25 FF000000 |AND EAX,0FF 00401F98 |. 83E8 02 |SUB EAX,2 00401F9B |. 8885 28FFFFFF |MOV BYTE PTR SS:[EBP-D8],AL 00401FA1 |. 8B55 D4 |MOV EDX,DWORD PTR SS:[EBP-2C] 00401FA4 |. 52 |PUSH EDX 00401FA5 |. 8B45 CC |MOV EAX,DWORD PTR SS:[EBP-34] 00401FA8 |. 50 |PUSH EAX 00401FA9 |. 8B85 34FFFFFF |MOV EAX,DWORD PTR SS:[EBP-CC] 00401FAF |. 25 FF000000 |AND EAX,0FF 00401FB4 |. 99 |CDQ 00401FB5 |. 52 |PUSH EDX 00401FB6 |. 50 |PUSH EAX 00401FB7 |. E8 9C780000 |CALL 00401FBC |. 83C4 0C |ADD ESP,0C 00401FBF |. 52 |PUSH EDX 00401FC0 |. 50 |PUSH EAX 00401FC1 |. E8 8C780000 |CALL 00401FC6 |. 83C4 0C |ADD ESP,0C 00401FC9 |. 25 FF000000 |AND EAX,0FF 00401FCE |. 83E8 02 |SUB EAX,2 00401FD1 |. 8885 24FFFFFF |MOV BYTE PTR SS:[EBP-DC],AL 00401FD7 |. 8B4D E0 |MOV ECX,DWORD PTR SS:[EBP-20] 00401FDA |. 51 |PUSH ECX 00401FDB |. 8B55 D8 |MOV EDX,DWORD PTR SS:[EBP-28] 00401FDE |. 52 |PUSH EDX 00401FDF |. 8B85 30FFFFFF |MOV EAX,DWORD PTR SS:[EBP-D0] 00401FE5 |. 25 FF000000 |AND EAX,0FF 00401FEA |. 99 |CDQ 00401FEB |. 52 |PUSH EDX 00401FEC |. 50 |PUSH EAX 00401FED |. E8 66780000 |CALL 00401FF2 |. 83C4 0C |ADD ESP,0C 00401FF5 |. 52 |PUSH EDX 00401FF6 |. 50 |PUSH EAX 00401FF7 |. E8 56780000 |CALL 00401FFC |. 83C4 0C |ADD ESP,0C 00401FFF |. 25 FF000000 |AND EAX,0FF 00402004 |. 83E8 02 |SUB EAX,2 00402007 |. 8885 20FFFFFF |MOV BYTE PTR SS:[EBP-E0],AL 0040200D |. 8B45 EC |MOV EAX,DWORD PTR SS:[EBP-14] 00402010 |. 50 |PUSH EAX 00402011 |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C] 00402014 |. 51 |PUSH ECX 00402015 |. 8B85 2CFFFFFF |MOV EAX,DWORD PTR SS:[EBP-D4] 0040201B |. 25 FF000000 |AND EAX,0FF 00402020 |. 99 |CDQ 00402021 |. 52 |PUSH EDX 00402022 |. 50 |PUSH EAX 00402023 |. E8 30780000 |CALL 00402028 |. 83C4 0C |ADD ESP,0C 0040202B |. 52 |PUSH EDX 0040202C |. 50 |PUSH EAX 0040202D |. E8 20780000 |CALL 00402032 |. 83C4 0C |ADD ESP,0C 00402035 |. 25 FF000000 |AND EAX,0FF 0040203A |. 83E8 02 |SUB EAX,2 0040203D |. 8885 1CFFFFFF |MOV BYTE PTR SS:[EBP-E4],AL 00402043 |. 8B95 1CFFFFFF |MOV EDX,DWORD PTR SS:[EBP-E4] 00402049 |. 81E2 FF000000 |AND EDX,0FF 0040204F |. C1E2 06 |SHL EDX,6 00402052 |. 8B85 20FFFFFF |MOV EAX,DWORD PTR SS:[EBP-E0] 00402058 |. 25 FF000000 |AND EAX,0FF 0040205D |. C1E0 04 |SHL EAX,4 00402060 |. 0BD0 |OR EDX,EAX 00402062 |. 8B8D 24FFFFFF |MOV ECX,DWORD PTR SS:[EBP-DC] 00402068 |. 81E1 FF000000 |AND ECX,0FF 0040206E |. C1E1 02 |SHL ECX,2 00402071 |. 0BD1 |OR EDX,ECX 00402073 |. 8B85 28FFFFFF |MOV EAX,DWORD PTR SS:[EBP-D8] 00402079 |. 25 FF000000 |AND EAX,0FF 0040207E |. 0BD0 |OR EDX,EAX 00402080 |. 8B8D 08FFFFFF |MOV ECX,DWORD PTR SS:[EBP-F8] 00402086 |. 88940D 78FFFFF>|MOV BYTE PTR SS:[EBP+ECX-88],DL 0040208D |. 8B95 08FFFFFF |MOV EDX,DWORD PTR SS:[EBP-F8] 00402093 |. 81E2 01000080 |AND EDX,80000001 00402099 |. 79 05 |JNS SHORT Setup.004020A0 0040209B |. 4A |DEC EDX 0040209C |. 83CA FE |OR EDX,FFFFFFFE 0040209F |. 42 |INC EDX 004020A0 |> 83FA 01 |CMP EDX,1 004020A3 |. 75 28 |JNZ SHORT Setup.004020CD 004020A5 |. 8B85 08FFFFFF |MOV EAX,DWORD PTR SS:[EBP-F8] 004020AB |. 33C9 |XOR ECX,ECX 004020AD |. 8A8C05 78FFFFF>|MOV CL,BYTE PTR SS:[EBP+EAX-88] 004020B4 |. 8BD1 |MOV EDX,ECX 004020B6 |. 8B85 08FFFFFF |MOV EAX,DWORD PTR SS:[EBP-F8] 004020BC |. 8D0C85 FCFFFFF>|LEA ECX,DWORD PTR DS:[EAX*4-4] 004020C3 |. D3E2 |SHL EDX,CL 004020C5 |. 8B4D B4 |MOV ECX,DWORD PTR SS:[EBP-4C] 004020C8 |. 0BCA |OR ECX,EDX 004020CA |. 894D B4 |MOV DWORD PTR SS:[EBP-4C],ECX 004020CD |>^E9 18FEFFFF \JMP Setup.00401EEA 004020D2 |> 8B55 B4 MOV EDX,DWORD PTR SS:[EBP-4C] 004020D5 |. 8915 90164200 MOV DWORD PTR DS:[421690],EDX 004020DB |. 8D45 C0 LEA EAX,DWORD PTR SS:[EBP-40] 004020DE |. 50 PUSH EAX 004020DF |. 8B4D B4 MOV ECX,DWORD PTR SS:[EBP-4C] 004020E2 |. 51 PUSH ECX 004020E3 |. E8 76770000 CALL 004020E8 |. 83C4 08 ADD ESP,8 004020EB |. 6A 00 PUSH 0 ; /hTemplateFile = NULL 004020ED |. 68 00000008 PUSH 8000000 ; |Attributes = SEQUENTIAL_SCAN 004020F2 |. 6A 03 PUSH 3 ; |Mode = OPEN_EXISTING 004020F4 |. 6A 00 PUSH 0 ; |pSecurity = NULL 004020F6 |. 6A 00 PUSH 0 ; |ShareMode = 0 004020F8 |. 68 00000080 PUSH 80000000 ; |Access = GENERIC_READ 004020FD |. 68 A4D34100 PUSH Setup.0041D3A4 ; |FileName = "OK.gam" 00402102 |. FF15 14394200 CALL DWORD PTR DS:[<&KERNEL32.CreateFile>; \CreateFileA 00402108 |. 8985 04FFFFFF MOV DWORD PTR SS:[EBP-FC],EAX 0040210E |. 83BD 04FFFFFF >CMP DWORD PTR SS:[EBP-FC],-1 00402115 |. 75 05 JNZ SHORT Setup.0040211C 00402117 |. E9 A8030000 JMP Setup.004024C4 0040211C |> 8D95 E8FEFFFF LEA EDX,DWORD PTR SS:[EBP-118] 00402122 |. 52 PUSH EDX ; /pLastWrite 00402123 |. 8D85 F0FEFFFF LEA EAX,DWORD PTR SS:[EBP-110] ; | 00402129 |. 50 PUSH EAX ; |pLastAccess 0040212A |. 8D8D F8FEFFFF LEA ECX,DWORD PTR SS:[EBP-108] ; | 00402130 |. 51 PUSH ECX ; |pCreationTime 00402131 |. 8B95 04FFFFFF MOV EDX,DWORD PTR SS:[EBP-FC] ; | 00402137 |. 52 PUSH EDX ; |hFile 00402138 |. FF15 18394200 CALL DWORD PTR DS:[<&KERNEL32.GetFileTim>; \GetFileTime 0040213E |. 6A 00 PUSH 0 ; /pFileSizeHigh = NULL 00402140 |. 8B85 04FFFFFF MOV EAX,DWORD PTR SS:[EBP-FC] ; | 00402146 |. 50 PUSH EAX ; |hFile 00402147 |. FF15 1C394200 CALL DWORD PTR DS:[<&KERNEL32.GetFileSiz>; \GetFileSize 0040214D |. 8985 DCFEFFFF MOV DWORD PTR SS:[EBP-124],EAX 00402153 |. 6A 04 PUSH 4 ; /Protect = PAGE_READWRITE 00402155 |. 68 00100000 PUSH 1000 ; |AllocationType = MEM_COMMIT 0040215A |. 8B8D DCFEFFFF MOV ECX,DWORD PTR SS:[EBP-124] ; | 00402160 |. 51 PUSH ECX ; |Size 00402161 |. 6A 00 PUSH 0 ; |Address = NULL 00402163 |. FF15 20394200 CALL DWORD PTR DS:[<&KERNEL32.VirtualAll>; \VirtualAlloc 00402169 |. 8985 10FFFFFF MOV DWORD PTR SS:[EBP-F0],EAX 0040216F |. 6A 00 PUSH 0 ; /pOverlapped = NULL 00402171 |. 8D95 E0FEFFFF LEA EDX,DWORD PTR SS:[EBP-120] ; | 00402177 |. 52 PUSH EDX ; |pBytesRead 00402178 |. 8B85 DCFEFFFF MOV EAX,DWORD PTR SS:[EBP-124] ; | 0040217E |. 50 PUSH EAX ; |BytesToRead 0040217F |. 8B8D 10FFFFFF MOV ECX,DWORD PTR SS:[EBP-F0] ; | 00402185 |. 51 PUSH ECX ; |Buffer 00402186 |. 8B95 04FFFFFF MOV EDX,DWORD PTR SS:[EBP-FC] ; | 0040218C |. 52 PUSH EDX ; |hFile 0040218D |. FF15 24394200 CALL DWORD PTR DS:[<&KERNEL32.ReadFile>] ; \ReadFile 00402193 |. 6A 00 PUSH 0 ; /MapName = NULL 00402195 |. 6A 00 PUSH 0 ; |MaximumSizeLow = 0 00402197 |. 6A 00 PUSH 0 ; |MaximumSizeHigh = 0 00402199 |. 68 02000008 PUSH 8000002 ; |Protection = PAGE_READONLY|SEC_COMMIT 0040219E |. 6A 00 PUSH 0 ; |pSecurity = NULL 004021A0 |. 8B85 04FFFFFF MOV EAX,DWORD PTR SS:[EBP-FC] ; | 004021A6 |. 50 PUSH EAX ; |hFile 004021A7 |. FF15 28394200 CALL DWORD PTR DS:[<&KERNEL32.CreateFile>; \CreateFileMappingA 004021AD |. 8985 00FFFFFF MOV DWORD PTR SS:[EBP-100],EAX 004021B3 |. 83BD 00FFFFFF >CMP DWORD PTR SS:[EBP-100],0 004021BA |. 75 12 JNZ SHORT Setup.004021CE 004021BC |. 8B8D 04FFFFFF MOV ECX,DWORD PTR SS:[EBP-FC] 004021C2 |. 51 PUSH ECX ; /hObject 004021C3 |. FF15 2C394200 CALL DWORD PTR DS:[<&KERNEL32.CloseHandl>; \CloseHandle 004021C9 |. E9 F6020000 JMP Setup.004024C4 004021CE |> 6A 00 PUSH 0 ; /MapSize = 0 004021D0 |. 6A 00 PUSH 0 ; |OffsetLow = 0 004021D2 |. 6A 00 PUSH 0 ; |OffsetHigh = 0 004021D4 |. 6A 04 PUSH 4 ; |AccessMode = FILE_MAP_READ 004021D6 |. 8B95 00FFFFFF MOV EDX,DWORD PTR SS:[EBP-100] ; | 004021DC |. 52 PUSH EDX ; |hMapObject 004021DD |. FF15 30394200 CALL DWORD PTR DS:[<&KERNEL32.MapViewOfF>; \MapViewOfFile 004021E3 |. 8985 E4FEFFFF MOV DWORD PTR SS:[EBP-11C],EAX 004021E9 |. 83BD E4FEFFFF >CMP DWORD PTR SS:[EBP-11C],0 004021F0 |. 75 1F JNZ SHORT Setup.00402211 004021F2 |. 8B85 00FFFFFF MOV EAX,DWORD PTR SS:[EBP-100] 004021F8 |. 50 PUSH EAX ; /hObject 004021F9 |. FF15 2C394200 CALL DWORD PTR DS:[<&KERNEL32.CloseHandl>; \CloseHandle 004021FF |. 8B8D 04FFFFFF MOV ECX,DWORD PTR SS:[EBP-FC] 00402205 |. 51 PUSH ECX ; /hObject 00402206 |. FF15 2C394200 CALL DWORD PTR DS:[<&KERNEL32.CloseHandl>; \CloseHandle 0040220C |. E9 B3020000 JMP Setup.004024C4 00402211 |> 8B95 E4FEFFFF MOV EDX,DWORD PTR SS:[EBP-11C] 00402217 |. 8995 14FFFFFF MOV DWORD PTR SS:[EBP-EC],EDX 0040221D |. 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C] 00402220 |. 8945 B0 MOV DWORD PTR SS:[EBP-50],EAX 00402223 |. 8D4D B8 LEA ECX,DWORD PTR SS:[EBP-48] 00402226 |. 894D AC MOV DWORD PTR SS:[EBP-54],ECX 00402229 |. 8B95 10FFFFFF MOV EDX,DWORD PTR SS:[EBP-F0] 0040222F |. 8995 3CFFFFFF MOV DWORD PTR SS:[EBP-C4],EDX 00402235 |. 8B85 14FFFFFF MOV EAX,DWORD PTR SS:[EBP-EC] 0040223B |. 8985 74FFFFFF MOV DWORD PTR SS:[EBP-8C],EAX 00402241 |. 8B8D DCFEFFFF MOV ECX,DWORD PTR SS:[EBP-124] 00402247 |. C1E9 02 SHR ECX,2 0040224A |. 898D 18FFFFFF MOV DWORD PTR SS:[EBP-E8],ECX 00402250 |. 8D55 C0 LEA EDX,DWORD PTR SS:[EBP-40] 00402253 |. 52 PUSH EDX 00402254 |. 8B45 B4 MOV EAX,DWORD PTR SS:[EBP-4C] 00402257 |. 50 PUSH EAX 00402258 |. E8 01760000 CALL 0040225D |. 83C4 08 ADD ESP,8 00402260 |. C785 08FFFFFF >MOV DWORD PTR SS:[EBP-F8],0 0040226A |. EB 0F JMP SHORT Setup.0040227B 0040226C |> 8B8D 08FFFFFF /MOV ECX,DWORD PTR SS:[EBP-F8] 00402272 |. 83C1 01 |ADD ECX,1 00402275 |. 898D 08FFFFFF |MOV DWORD PTR SS:[EBP-F8],ECX 0040227B |> 8B95 08FFFFFF MOV EDX,DWORD PTR SS:[EBP-F8] 00402281 |. 3B95 18FFFFFF |CMP EDX,DWORD PTR SS:[EBP-E8] 00402287 |. 0F8D AF010000 |JGE Setup.0040243C 0040228D |. 8B85 3CFFFFFF |MOV EAX,DWORD PTR SS:[EBP-C4] 00402293 |. 33C9 |XOR ECX,ECX 00402295 |. 8A08 |MOV CL,BYTE PTR DS:[EAX] 00402297 |. 83E9 3C |SUB ECX,3C 0040229A |. 888D 38FFFFFF |MOV BYTE PTR SS:[EBP-C8],CL 004022A0 |. 8B95 3CFFFFFF |MOV EDX,DWORD PTR SS:[EBP-C4] 004022A6 |. 83C2 01 |ADD EDX,1 004022A9 |. 8995 3CFFFFFF |MOV DWORD PTR SS:[EBP-C4],EDX 004022AF |. 8B85 3CFFFFFF |MOV EAX,DWORD PTR SS:[EBP-C4] 004022B5 |. 33C9 |XOR ECX,ECX 004022B7 |. 8A08 |MOV CL,BYTE PTR DS:[EAX] 004022B9 |. 83E9 3C |SUB ECX,3C 004022BC |. 888D 34FFFFFF |MOV BYTE PTR SS:[EBP-CC],CL 004022C2 |. 8B95 3CFFFFFF |MOV EDX,DWORD PTR SS:[EBP-C4] 004022C8 |. 83C2 01 |ADD EDX,1 004022CB |. 8995 3CFFFFFF |MOV DWORD PTR SS:[EBP-C4],EDX 004022D1 |. 8B85 3CFFFFFF |MOV EAX,DWORD PTR SS:[EBP-C4] 004022D7 |. 33C9 |XOR ECX,ECX 004022D9 |. 8A08 |MOV CL,BYTE PTR DS:[EAX] 004022DB |. 83E9 3C |SUB ECX,3C 004022DE |. 888D 30FFFFFF |MOV BYTE PTR SS:[EBP-D0],CL 004022E4 |. 8B95 3CFFFFFF |MOV EDX,DWORD PTR SS:[EBP-C4] 004022EA |. 83C2 01 |ADD EDX,1 004022ED |. 8995 3CFFFFFF |MOV DWORD PTR SS:[EBP-C4],EDX 004022F3 |. 8B85 3CFFFFFF |MOV EAX,DWORD PTR SS:[EBP-C4] 004022F9 |. 33C9 |XOR ECX,ECX 004022FB |. 8A08 |MOV CL,BYTE PTR DS:[EAX] 004022FD |. 83E9 3C |SUB ECX,3C 00402300 |. 888D 2CFFFFFF |MOV BYTE PTR SS:[EBP-D4],CL 00402306 |. 8B95 3CFFFFFF |MOV EDX,DWORD PTR SS:[EBP-C4] 0040230C |. 83C2 01 |ADD EDX,1 0040230F |. 8995 3CFFFFFF |MOV DWORD PTR SS:[EBP-C4],EDX 00402315 |. 8B45 C8 |MOV EAX,DWORD PTR SS:[EBP-38] 00402318 |. 50 |PUSH EAX 00402319 |. 8B4D C0 |MOV ECX,DWORD PTR SS:[EBP-40] 0040231C |. 51 |PUSH ECX 0040231D |. 8B85 38FFFFFF |MOV EAX,DWORD PTR SS:[EBP-C8] 00402323 |. 25 FF000000 |AND EAX,0FF 00402328 |. 99 |CDQ 00402329 |. 52 |PUSH EDX 0040232A |. 50 |PUSH EAX 0040232B |. E8 28750000 |CALL 00402330 |. 83C4 0C |ADD ESP,0C 00402333 |. 52 |PUSH EDX 00402334 |. 50 |PUSH EAX 00402335 |. E8 18750000 |CALL 0040233A |. 83C4 0C |ADD ESP,0C 0040233D |. 25 FF000000 |AND EAX,0FF 00402342 |. 83E8 02 |SUB EAX,2 00402345 |. 8885 28FFFFFF |MOV BYTE PTR SS:[EBP-D8],AL 0040234B |. 8B55 D4 |MOV EDX,DWORD PTR SS:[EBP-2C] 0040234E |. 52 |PUSH EDX 0040234F |. 8B45 CC |MOV EAX,DWORD PTR SS:[EBP-34] 00402352 |. 50 |PUSH EAX 00402353 |. 8B85 34FFFFFF |MOV EAX,DWORD PTR SS:[EBP-CC] 00402359 |. 25 FF000000 |AND EAX,0FF 0040235E |. 99 |CDQ 0040235F |. 52 |PUSH EDX 00402360 |. 50 |PUSH EAX 00402361 |. E8 F2740000 |CALL 00402366 |. 83C4 0C |ADD ESP,0C 00402369 |. 52 |PUSH EDX 0040236A |. 50 |PUSH EAX 0040236B |. E8 E2740000 |CALL 00402370 |. 83C4 0C |ADD ESP,0C 00402373 |. 25 FF000000 |AND EAX,0FF 00402378 |. 83E8 02 |SUB EAX,2 0040237B |. 8885 24FFFFFF |MOV BYTE PTR SS:[EBP-DC],AL 00402381 |. 8B4D E0 |MOV ECX,DWORD PTR SS:[EBP-20] 00402384 |. 51 |PUSH ECX 00402385 |. 8B55 D8 |MOV EDX,DWORD PTR SS:[EBP-28] 00402388 |. 52 |PUSH EDX 00402389 |. 8B85 30FFFFFF |MOV EAX,DWORD PTR SS:[EBP-D0] 0040238F |. 25 FF000000 |AND EAX,0FF 00402394 |. 99 |CDQ 00402395 |. 52 |PUSH EDX 00402396 |. 50 |PUSH EAX 00402397 |. E8 BC740000 |CALL 0040239C |. 83C4 0C |ADD ESP,0C 0040239F |. 52 |PUSH EDX 004023A0 |. 50 |PUSH EAX 004023A1 |. E8 AC740000 |CALL 004023A6 |. 83C4 0C |ADD ESP,0C 004023A9 |. 25 FF000000 |AND EAX,0FF 004023AE |. 83E8 02 |SUB EAX,2 004023B1 |. 8885 20FFFFFF |MOV BYTE PTR SS:[EBP-E0],AL 004023B7 |. 8B45 EC |MOV EAX,DWORD PTR SS:[EBP-14] 004023BA |. 50 |PUSH EAX 004023BB |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C] 004023BE |. 51 |PUSH ECX 004023BF |. 8B85 2CFFFFFF |MOV EAX,DWORD PTR SS:[EBP-D4] 004023C5 |. 25 FF000000 |AND EAX,0FF 004023CA |. 99 |CDQ 004023CB |. 52 |PUSH EDX 004023CC |. 50 |PUSH EAX 004023CD |. E8 86740000 |CALL 004023D2 |. 83C4 0C |ADD ESP,0C 004023D5 |. 52 |PUSH EDX 004023D6 |. 50 |PUSH EAX 004023D7 |. E8 76740000 |CALL 004023DC |. 83C4 0C |ADD ESP,0C 004023DF |. 25 FF000000 |AND EAX,0FF 004023E4 |. 83E8 02 |SUB EAX,2 004023E7 |. 8885 1CFFFFFF |MOV BYTE PTR SS:[EBP-E4],AL 004023ED |. 8B95 1CFFFFFF |MOV EDX,DWORD PTR SS:[EBP-E4] 004023F3 |. 81E2 FF000000 |AND EDX,0FF 004023F9 |. C1E2 06 |SHL EDX,6 004023FC |. 8B85 20FFFFFF |MOV EAX,DWORD PTR SS:[EBP-E0] 00402402 |. 25 FF000000 |AND EAX,0FF 00402407 |. C1E0 04 |SHL EAX,4 0040240A |. 0BD0 |OR EDX,EAX 0040240C |. 8B8D 24FFFFFF |MOV ECX,DWORD PTR SS:[EBP-DC] 00402412 |. 81E1 FF000000 |AND ECX,0FF 00402418 |. C1E1 02 |SHL ECX,2 0040241B |. 0BD1 |OR EDX,ECX 0040241D |. 8B85 28FFFFFF |MOV EAX,DWORD PTR SS:[EBP-D8] 00402423 |. 25 FF000000 |AND EAX,0FF 00402428 |. 0BD0 |OR EDX,EAX 0040242A |. 8B8D 08FFFFFF |MOV ECX,DWORD PTR SS:[EBP-F8] 00402430 |. 88940D 78FFFFF>|MOV BYTE PTR SS:[EBP+ECX-88],DL 00402437 |.^E9 30FEFFFF \JMP Setup.0040226C 0040243C |> 8B95 08FFFFFF MOV EDX,DWORD PTR SS:[EBP-F8] 00402442 |. C68415 78FFFFF>MOV BYTE PTR SS:[EBP+EDX-88],0 0040244A |. 8B85 E4FEFFFF MOV EAX,DWORD PTR SS:[EBP-11C] 00402450 |. 50 PUSH EAX ; /BaseAddress 00402451 |. FF15 34394200 CALL DWORD PTR DS:[<&KERNEL32.UnmapViewO>; \UnmapViewOfFile 00402457 |. 8B8D 00FFFFFF MOV ECX,DWORD PTR SS:[EBP-100] 0040245D |. 51 PUSH ECX ; /hObject 0040245E |. FF15 2C394200 CALL DWORD PTR DS:[<&KERNEL32.CloseHandl>; \CloseHandle 00402464 |. 8B95 04FFFFFF MOV EDX,DWORD PTR SS:[EBP-FC] 0040246A |. 52 PUSH EDX ; /hObject 0040246B |. FF15 2C394200 CALL DWORD PTR DS:[<&KERNEL32.CloseHandl>; \CloseHandle 00402471 |. 8D85 78FFFFFF LEA EAX,DWORD PTR SS:[EBP-88] 00402477 |. 50 PUSH EAX ; /s2 00402478 |. 68 8CD34100 PUSH Setup.0041D38C ; |s1 = "Everything is OK!" 0040247D |. E8 04780000 CALL ; \strcmp 00402482 |. 83C4 08 ADD ESP,8 00402485 |. 85C0 TEST EAX,EAX 00402487 |. 74 16 JE SHORT Setup.0040249F 00402489 |. 6A 10 PUSH 10 0040248B |. 68 80D34100 PUSH Setup.0041D380 ; ASCII "Warning" 00402490 |. 68 5CD34100 PUSH Setup.0041D35C ; ASCII "CD-key from Eurotax is wrong." 00402495 |. 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10] 00402498 |. E8 B9750000 CALL 0040249D |. EB 25 JMP SHORT Setup.004024C4 0040249F |> 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10] 004024A2 |. E8 F9730000 CALL 004024A7 |. 8985 D8FEFFFF MOV DWORD PTR SS:[EBP-128],EAX 004024AD |. C745 FC FFFFFF>MOV DWORD PTR SS:[EBP-4],-1 004024B4 |. 8D4D BC LEA ECX,DWORD PTR SS:[EBP-44] 004024B7 |. E8 40750000 CALL 004024BC |. 8B85 D8FEFFFF MOV EAX,DWORD PTR SS:[EBP-128] 004024C2 |. EB 23 JMP SHORT Setup.004024E7 004024C4 |> 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10] 004024C7 |. E8 0A740000 CALL 004024CC |. 8985 D4FEFFFF MOV DWORD PTR SS:[EBP-12C],EAX 004024D2 |. C745 FC FFFFFF>MOV DWORD PTR SS:[EBP-4],-1 004024D9 |. 8D4D BC LEA ECX,DWORD PTR SS:[EBP-44] 004024DC |. E8 1B750000 CALL 004024E1 |. 8B85 D4FEFFFF MOV EAX,DWORD PTR SS:[EBP-12C] 004024E7 |> 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] 004024EA |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX 004024F1 |. 5F POP EDI 004024F2 |. 5E POP ESI 004024F3 |. 5B POP EBX 004024F4 |. 8BE5 MOV ESP,EBP 004024F6 |. 5D POP EBP 004024F7 \. C3 RETN