Function1: 00401418 55 PUSH EBP 00401419 8BEC MOV EBP,ESP 0040141B 51 PUSH ECX 0040141C 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 0040141F 56 PUSH ESI 00401420 50 PUSH EAX 00401421 E8 4A160000 CALL www_mypa.00402A70 00401426 59 POP ECX 00401427 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 0040142A 50 PUSH EAX 0040142B E8 50140000 CALL www_mypa.00402880 00401430 8140 14 6C070000 ADD DWORD PTR DS:[EAX+14],76C 00401437 8B50 14 MOV EDX,DWORD PTR DS:[EAX+14] 0040143A FF40 10 INC DWORD PTR DS:[EAX+10] 0040143D 8B70 10 MOV ESI,DWORD PTR DS:[EAX+10] 00401440 59 POP ECX 00401441 B9 D2070000 MOV ECX,7D2 00401446 3BD1 CMP EDX,ECX 00401448 7C 16 JL SHORT www_mypa.00401460 0040144A 7F 14 JG SHORT www_mypa.00401460 0040144C 83FE 01 CMP ESI,1 0040144F 7C 0F JL SHORT www_mypa.00401460 00401451 7F 0D JG SHORT www_mypa.00401460 00401453 8B40 0C MOV EAX,DWORD PTR DS:[EAX+C] 00401456 83F8 19 CMP EAX,19 00401459 7C 05 JL SHORT www_mypa.00401460 0040145B 83F8 1D CMP EAX,1D 0040145E 7E 05 JLE SHORT www_mypa.00401465 00401460 E8 C5000000 CALL www_mypa.0040152A 00401465 5E POP ESI 00401466 C9 LEAVE 00401467 C3 RETN Function2: 00402A70 81EC CC000000 SUB ESP,0CC 00402A76 8D4424 10 LEA EAX,DWORD PTR SS:[ESP+10] 00402A7A 50 PUSH EAX 00402A7B FF15 F0214100 CALL DWORD PTR DS:[4121F0] ; kernel32.GetLocalTime 00402A81 8D4C24 00 LEA ECX,DWORD PTR SS:[ESP] 00402A85 51 PUSH ECX 00402A86 FF15 EC214100 CALL DWORD PTR DS:[4121EC] ; kernel32.GetSystemTime 00402A8C 66:8B5424 0A MOV DX,WORD PTR SS:[ESP+A] 00402A91 66:3B15 E2064100 CMP DX,WORD PTR DS:[4106E2] 00402A98 75 3F JNZ SHORT www_mypa.00402AD9 00402A9A 66:8B4424 08 MOV AX,WORD PTR SS:[ESP+8] 00402A9F 66:3B05 E0064100 CMP AX,WORD PTR DS:[4106E0] 00402AA6 75 31 JNZ SHORT www_mypa.00402AD9 00402AA8 66:8B4C24 06 MOV CX,WORD PTR SS:[ESP+6] 00402AAD 66:3B0D DE064100 CMP CX,WORD PTR DS:[4106DE] 00402AB4 75 23 JNZ SHORT www_mypa.00402AD9 00402AB6 66:8B5424 02 MOV DX,WORD PTR SS:[ESP+2] 00402ABB 66:3B15 DA064100 CMP DX,WORD PTR DS:[4106DA] 00402AC2 75 15 JNZ SHORT www_mypa.00402AD9 00402AC4 66:8B4424 00 MOV AX,WORD PTR SS:[ESP] 00402AC9 66:3B05 D8064100 CMP AX,WORD PTR DS:[4106D8] 00402AD0 75 07 JNZ SHORT www_mypa.00402AD9 00402AD2 A1 D0064100 MOV EAX,DWORD PTR DS:[4106D0] 00402AD7 EB 66 JMP SHORT www_mypa.00402B3F 00402AD9 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20] 00402ADD 51 PUSH ECX 00402ADE FF15 E8214100 CALL DWORD PTR DS:[4121E8] ; kernel32.GetTimeZoneInformation 00402AE4 83F8 FF CMP EAX,-1 00402AE7 74 26 JE SHORT www_mypa.00402B0F 00402AE9 83F8 02 CMP EAX,2 00402AEC 75 1D JNZ SHORT www_mypa.00402B0B 00402AEE 66:83BC24 BA0000>CMP WORD PTR SS:[ESP+BA],0 00402AF7 74 12 JE SHORT www_mypa.00402B0B 00402AF9 8B8424 C8000000 MOV EAX,DWORD PTR SS:[ESP+C8] 00402B00 85C0 TEST EAX,EAX 00402B02 74 07 JE SHORT www_mypa.00402B0B 00402B04 B8 01000000 MOV EAX,1 00402B09 EB 07 JMP SHORT www_mypa.00402B12 00402B0B 33C0 XOR EAX,EAX 00402B0D EB 03 JMP SHORT www_mypa.00402B12 00402B0F 83C8 FF OR EAX,FFFFFFFF 00402B12 8B5424 00 MOV EDX,DWORD PTR SS:[ESP] 00402B16 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00402B1A 8915 D8064100 MOV DWORD PTR DS:[4106D8],EDX 00402B20 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8] 00402B24 890D DC064100 MOV DWORD PTR DS:[4106DC],ECX 00402B2A 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C] 00402B2E A3 D0064100 MOV DWORD PTR DS:[4106D0],EAX 00402B33 8915 E0064100 MOV DWORD PTR DS:[4106E0],EDX 00402B39 890D E4064100 MOV DWORD PTR DS:[4106E4],ECX 00402B3F 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+1C] 00402B43 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18] 00402B47 50 PUSH EAX 00402B48 8B4424 1E MOV EAX,DWORD PTR SS:[ESP+1E] 00402B4C 81E2 FFFF0000 AND EDX,0FFFF 00402B52 25 FFFF0000 AND EAX,0FFFF 00402B57 52 PUSH EDX 00402B58 8B5424 1E MOV EDX,DWORD PTR SS:[ESP+1E] 00402B5C 81E1 FFFF0000 AND ECX,0FFFF 00402B62 50 PUSH EAX 00402B63 8B4424 1E MOV EAX,DWORD PTR SS:[ESP+1E] 00402B67 51 PUSH ECX 00402B68 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20] 00402B6C 81E2 FFFF0000 AND EDX,0FFFF 00402B72 25 FFFF0000 AND EAX,0FFFF 00402B77 52 PUSH EDX 00402B78 81E1 FFFF0000 AND ECX,0FFFF 00402B7E 50 PUSH EAX 00402B7F 51 PUSH ECX 00402B80 E8 5B370000 CALL www_mypa.004062E0 00402B85 8B8C24 EC000000 MOV ECX,DWORD PTR SS:[ESP+EC] 00402B8C 83C4 1C ADD ESP,1C 00402B8F 85C9 TEST ECX,ECX 00402B91 74 02 JE SHORT www_mypa.00402B95 00402B93 8901 MOV DWORD PTR DS:[ECX],EAX 00402B95 81C4 CC000000 ADD ESP,0CC 00402B9B C3 RETN Function3: 004062E0 83EC 24 SUB ESP,24 004062E3 53 PUSH EBX 004062E4 8B5C24 2C MOV EBX,DWORD PTR SS:[ESP+2C] 004062E8 81EB 6C070000 SUB EBX,76C 004062EE 55 PUSH EBP 004062EF 56 PUSH ESI 004062F0 83FB 46 CMP EBX,46 004062F3 57 PUSH EDI 004062F4 0F8C BD000000 JL www_mypa.004063B7 004062FA 81FB 8A000000 CMP EBX,8A 00406300 0F8F B1000000 JG www_mypa.004063B7 00406306 8B7C24 3C MOV EDI,DWORD PTR SS:[ESP+3C] 0040630A 8B4C24 40 MOV ECX,DWORD PTR SS:[ESP+40] 0040630E 8B34BD 24F54000 MOV ESI,DWORD PTR DS:[EDI*4+40F524] 00406315 03F1 ADD ESI,ECX 00406317 F6C3 03 TEST BL,3 0040631A 75 06 JNZ SHORT www_mypa.00406322 0040631C 83FF 02 CMP EDI,2 0040631F 7E 01 JLE SHORT www_mypa.00406322 00406321 46 INC ESI 00406322 E8 79F7FFFF CALL www_mypa.00405AA0 00406327 8D04DB LEA EAX,DWORD PTR DS:[EBX+EBX*8] 0040632A 897424 2C MOV DWORD PTR SS:[ESP+2C],ESI 0040632E 895C24 24 MOV DWORD PTR SS:[ESP+24],EBX 00406332 8D0CC3 LEA ECX,DWORD PTR DS:[EBX+EAX*8] 00406335 8D43 FF LEA EAX,DWORD PTR DS:[EBX-1] 00406338 8BD1 MOV EDX,ECX 0040633A 03D6 ADD EDX,ESI 0040633C C1F8 02 SAR EAX,2 0040633F 8D0C8A LEA ECX,DWORD PTR DS:[EDX+ECX*4] 00406342 03C1 ADD EAX,ECX 00406344 8B4C24 44 MOV ECX,DWORD PTR SS:[ESP+44] 00406348 894C24 18 MOV DWORD PTR SS:[ESP+18],ECX 0040634C 8D1440 LEA EDX,DWORD PTR DS:[EAX+EAX*2] 0040634F 8D04D1 LEA EAX,DWORD PTR DS:[ECX+EDX*8] 00406352 8BD0 MOV EDX,EAX 00406354 C1E2 04 SHL EDX,4 00406357 2BD0 SUB EDX,EAX 00406359 8B4424 48 MOV EAX,DWORD PTR SS:[ESP+48] 0040635D 8D0490 LEA EAX,DWORD PTR DS:[EAX+EDX*4] 00406360 8BD0 MOV EDX,EAX 00406362 C1E2 04 SHL EDX,4 00406365 2BD0 SUB EDX,EAX 00406367 8B4424 4C MOV EAX,DWORD PTR SS:[ESP+4C] 0040636B 4F DEC EDI 0040636C 8D1490 LEA EDX,DWORD PTR DS:[EAX+EDX*4] 0040636F A1 00EC4000 MOV EAX,DWORD PTR DS:[40EC00] 00406374 897C24 20 MOV DWORD PTR SS:[ESP+20],EDI 00406378 8DAC02 8081557C LEA EBP,DWORD PTR DS:[EDX+EAX+7C558180] 0040637F 8B4424 50 MOV EAX,DWORD PTR SS:[ESP+50] 00406383 83F8 01 CMP EAX,1 00406386 74 1F JE SHORT www_mypa.004063A7 00406388 83F8 FF CMP EAX,-1 0040638B 75 20 JNZ SHORT www_mypa.004063AD 0040638D A1 04EC4000 MOV EAX,DWORD PTR DS:[40EC04] 00406392 85C0 TEST EAX,EAX 00406394 74 17 JE SHORT www_mypa.004063AD 00406396 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 0040639A 51 PUSH ECX 0040639B E8 D0F9FFFF CALL www_mypa.00405D70 004063A0 83C4 04 ADD ESP,4 004063A3 85C0 TEST EAX,EAX 004063A5 74 06 JE SHORT www_mypa.004063AD 004063A7 032D 08EC4000 ADD EBP,DWORD PTR DS:[40EC08] 004063AD 8BC5 MOV EAX,EBP 004063AF 5F POP EDI 004063B0 5E POP ESI 004063B1 5D POP EBP 004063B2 5B POP EBX 004063B3 83C4 24 ADD ESP,24 004063B6 C3 RETN Function4: 00403190 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00403194 83EC 18 SUB ESP,18 00403197 8338 00 CMP DWORD PTR DS:[EAX],0 0040319A 75 07 JNZ SHORT www_mypa.004031A3 0040319C 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4] 0040319F 85C9 TEST ECX,ECX 004031A1 74 72 JE SHORT www_mypa.00403215 004031A3 8D4C24 00 LEA ECX,DWORD PTR SS:[ESP] 004031A7 51 PUSH ECX 004031A8 50 PUSH EAX 004031A9 FF15 18224100 CALL DWORD PTR DS:[412218] ; kernel32.FileTimeToLocalFileTime 004031AF 85C0 TEST EAX,EAX 004031B1 74 62 JE SHORT www_mypa.00403215 004031B3 8D5424 08 LEA EDX,DWORD PTR SS:[ESP+8] 004031B7 8D4424 00 LEA EAX,DWORD PTR SS:[ESP] 004031BB 52 PUSH EDX 004031BC 50 PUSH EAX 004031BD FF15 14224100 CALL DWORD PTR DS:[412214] ; kernel32.FileTimeToSystemTime 004031C3 85C0 TEST EAX,EAX 004031C5 74 4E JE SHORT www_mypa.00403215 004031C7 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14] 004031CB 8B5424 12 MOV EDX,DWORD PTR SS:[ESP+12] 004031CF 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004031D3 81E1 FFFF0000 AND ECX,0FFFF 004031D9 6A FF PUSH -1 004031DB 81E2 FFFF0000 AND EDX,0FFFF 004031E1 51 PUSH ECX 004031E2 8B4C24 16 MOV ECX,DWORD PTR SS:[ESP+16] 004031E6 25 FFFF0000 AND EAX,0FFFF 004031EB 52 PUSH EDX 004031EC 8B5424 16 MOV EDX,DWORD PTR SS:[ESP+16] 004031F0 50 PUSH EAX 004031F1 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18] 004031F5 81E1 FFFF0000 AND ECX,0FFFF 004031FB 81E2 FFFF0000 AND EDX,0FFFF 00403201 51 PUSH ECX 00403202 25 FFFF0000 AND EAX,0FFFF 00403207 52 PUSH EDX 00403208 50 PUSH EAX 00403209 E8 D2300000 CALL www_mypa.004062E0 0040320E 83C4 1C ADD ESP,1C 00403211 83C4 18 ADD ESP,18 00403214 C3 RETN 00403215 83C8 FF OR EAX,FFFFFFFF 00403218 83C4 18 ADD ESP,18 0040321B C3 RETN Function 5: 00405AA0 A1 08084100 MOV EAX,DWORD PTR DS:[410808] 00405AA5 85C0 TEST EAX,EAX 00405AA7 75 0B JNZ SHORT www_mypa.00405AB4 00405AA9 E8 12000000 CALL www_mypa.00405AC0 00405AAE FF05 08084100 INC DWORD PTR DS:[410808] 00405AB4 C3 RETN 00405AB5 90 NOP 00405AB6 90 NOP 00405AB7 90 NOP 00405AB8 90 NOP 00405AB9 90 NOP 00405ABA 90 NOP 00405ABB 90 NOP 00405ABC 90 NOP 00405ABD 90 NOP 00405ABE 90 NOP 00405ABF 90 NOP 00405AC0 51 PUSH ECX 00405AC1 55 PUSH EBP 00405AC2 56 PUSH ESI 00405AC3 57 PUSH EDI 00405AC4 33F6 XOR ESI,ESI 00405AC6 68 C8A04000 PUSH www_mypa.0040A0C8 ; ASCII "TZ" 00405ACB 897424 10 MOV DWORD PTR SS:[ESP+10],ESI 00405ACF 8935 50074100 MOV DWORD PTR DS:[410750],ESI 00405AD5 C705 A8EC4000 FF>MOV DWORD PTR DS:[40ECA8],-1 00405ADF C705 98EC4000 FF>MOV DWORD PTR DS:[40EC98],-1 00405AE9 E8 A2C6FFFF CALL www_mypa.00402190 00405AEE 8BE8 MOV EBP,EAX 00405AF0 83C4 04 ADD ESP,4 00405AF3 3BEE CMP EBP,ESI 00405AF5 0F85 CC000000 JNZ www_mypa.00405BC7 00405AFB 68 58074100 PUSH www_mypa.00410758 00405B00 FF15 E8214100 CALL DWORD PTR DS:[4121E8] ; kernel32.GetTimeZoneInformation 00405B06 83F8 FF CMP EAX,-1 00405B09 0F84 57020000 JE www_mypa.00405D66 00405B0F A1 58074100 MOV EAX,DWORD PTR DS:[410758] 00405B14 8B0D AC074100 MOV ECX,DWORD PTR DS:[4107AC] 00405B1A 33FF XOR EDI,EDI 00405B1C BE 01000000 MOV ESI,1 00405B21 8D0440 LEA EAX,DWORD PTR DS:[EAX+EAX*2] 00405B24 8935 50074100 MOV DWORD PTR DS:[410750],ESI 00405B2A 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 00405B2D C1E0 02 SHL EAX,2 00405B30 66:393D 9E074100 CMP WORD PTR DS:[41079E],DI 00405B37 A3 00EC4000 MOV DWORD PTR DS:[40EC00],EAX 00405B3C 74 0E JE SHORT www_mypa.00405B4C 00405B3E 8D1449 LEA EDX,DWORD PTR DS:[ECX+ECX*2] 00405B41 8D1492 LEA EDX,DWORD PTR DS:[EDX+EDX*4] 00405B44 8D0490 LEA EAX,DWORD PTR DS:[EAX+EDX*4] 00405B47 A3 00EC4000 MOV DWORD PTR DS:[40EC00],EAX 00405B4C 66:393D F2074100 CMP WORD PTR DS:[4107F2],DI 00405B53 74 22 JE SHORT www_mypa.00405B77 00405B55 A1 00084100 MOV EAX,DWORD PTR DS:[410800] 00405B5A 3BC7 CMP EAX,EDI 00405B5C 74 19 JE SHORT www_mypa.00405B77 00405B5E 2BC1 SUB EAX,ECX 00405B60 8935 04EC4000 MOV DWORD PTR DS:[40EC04],ESI 00405B66 8D0440 LEA EAX,DWORD PTR DS:[EAX+EAX*2] 00405B69 8D0C80 LEA ECX,DWORD PTR DS:[EAX+EAX*4] 00405B6C C1E1 02 SHL ECX,2 00405B6F 890D 08EC4000 MOV DWORD PTR DS:[40EC08],ECX 00405B75 EB 0C JMP SHORT www_mypa.00405B83 00405B77 893D 04EC4000 MOV DWORD PTR DS:[40EC04],EDI 00405B7D 893D 08EC4000 MOV DWORD PTR DS:[40EC08],EDI 00405B83 8B15 90EC4000 MOV EDX,DWORD PTR DS:[40EC90] ; www_mypa.0040EC10 00405B89 6A 40 PUSH 40 00405B8B 68 5C074100 PUSH www_mypa.0041075C 00405B90 52 PUSH EDX 00405B91 E8 CA290000 CALL www_mypa.00408560 00405B96 A1 94EC4000 MOV EAX,DWORD PTR DS:[40EC94] 00405B9B 83C4 0C ADD ESP,0C 00405B9E 6A 40 PUSH 40 00405BA0 68 B0074100 PUSH www_mypa.004107B0 00405BA5 50 PUSH EAX 00405BA6 E8 B5290000 CALL www_mypa.00408560 00405BAB 8B0D 94EC4000 MOV ECX,DWORD PTR DS:[40EC94] ; www_mypa.0040EC50 00405BB1 83C4 0C ADD ESP,0C 00405BB4 C641 3F 00 MOV BYTE PTR DS:[ECX+3F],0 00405BB8 8B15 90EC4000 MOV EDX,DWORD PTR DS:[40EC90] ; www_mypa.0040EC10 00405BBE C642 3F 00 MOV BYTE PTR DS:[EDX+3F],0 00405BC2 5F POP EDI 00405BC3 5E POP ESI 00405BC4 5D POP EBP 00405BC5 59 POP ECX 00405BC6 C3 RETN