Im Using The LASTED litestep Downloaded it two days ago
Heres What Happens Whine i rigth click on the desktop (you know to get the lil menu)I goto Contral Panel And It crashes!
with Kernal32.dll
I will Run Dr. waston TO get a report of what happend
------------------
System Information
------------------
Time of this report: 3/26/2004, 10:33:58
Machine name: Computer
Operating System: Microsoft Windows ME (4.90, Build 3000)
Language: English (Regional Setting: English)
System Manufacturer: Compaq
System Model: Compaq PC
BIOS:
Processor: Intel Pentium III, ~565MHz
Memory: 190MB RAM
Page File: 125MB used, 1732MB available
DirectX Version: DirectX 8.0 (4.08.00.0400)
DX Setup Parameters: /PackageInstall
DxDiag Version: 4.08.00.0400
------------
DxDiag Notes
------------
DirectX Files Tab: No problems found.
Display Tab 1: The file i81xdw9x.drv is uncertified, which means that it has not been tested by Microsoft's Windows Hardware Quality Labs. You may be able to get a certified driver from the manufacturer of the hardware device.
Sound Tab 1: No problems found.
Music Tab: No problems found.
Input Tab: No input devices detected.
No problems found.
Network Tab: No problems found.
------------------
DirectX Components
------------------
ddraw.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 344064 bytes
ddraw16.dll: 4.07.00.0700 English Final Retail 6/8/2000 17:00:00 28496 bytes
ddrawex.dll: 4.87.00.0700 English Final Retail 6/8/2000 17:00:00 36864 bytes
ddraw.vxd: 4.07.00.0700 English Final Retail 6/8/2000 17:00:00 30469 bytes
ddhelp.exe: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 41984 bytes
dxapi.sys: 4.87.00.0700 English Final Retail 6/8/2000 17:00:00 2416 bytes
d3d8.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 1062400 bytes
d3dref8.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 236544 bytes
d3dim.dll: 4.07.00.0700 English Final Retail 6/8/2000 17:00:00 638976 bytes
d3dim700.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 872960 bytes
d3dref.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 140800 bytes
d3dramp.dll: 4.07.00.0700 English Final Retail 6/8/2000 17:00:00 606208 bytes
d3drm.dll: 4.06.02.0436 English Final Retail 6/8/2000 17:00:00 446464 bytes
d3dxof.dll: 4.06.02.0436 English Final Retail 6/8/2000 17:00:00 118784 bytes
d3dpmesh.dll: 4.06.02.0436 English Final Retail 6/8/2000 17:00:00 102400 bytes
dplayx.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 245760 bytes
dpmodemx.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 36864 bytes
dpwsockx.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 77824 bytes
dplaysvr.exe: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 45056 bytes
dpnsvr.exe: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 69632 bytes
dpnet.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 237568 bytes
dpnlobby.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 98304 bytes
dpnwsock.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 118784 bytes
dpnaddr.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 90112 bytes
dpnmodem.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 110592 bytes
dpvoice.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 282624 bytes
dpvsetup.exe: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 122880 bytes
dpvvox.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 184320 bytes
dpvacm.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 90112 bytes
dpvhelp.exe: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 81920 bytes
dinput.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 176128 bytes
dinput8.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 204800 bytes
dinput.vxd: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 10874 bytes
dimap.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 102400 bytes
diactfrm.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 307200 bytes
vjoyd.vxd: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 33361 bytes
joyhid.vxd: 4.88.00.0400 English Final Retail 11/7/2000 15:16:46 13055 bytes
joy.cpl: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 155648 bytes
gcdef.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 249856 bytes
gchand.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 6144 bytes
pid.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 40960 bytes
gameenum.sys: 4.07.01.3000 English Final Retail 6/8/2000 17:00:00 10608 bytes
hidgame.sys: 4.07.01.3000 English Final Retail 6/8/2000 17:00:00 8912 bytes
dsound.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 455680 bytes
dsound3d.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 1339392 bytes
dsound.vxd: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 48171 bytes
dswave.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 15360 bytes
dsdmo.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 176128 bytes
dsdmoprp.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 66560 bytes
dmusic.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 94208 bytes
dmusic16.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 11008 bytes
dmusic32.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 28672 bytes
dmband.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 25600 bytes
dmcompos.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 59392 bytes
dmime.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 168960 bytes
dmloader.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 30720 bytes
dmstyle.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 110080 bytes
dmsynth.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 130048 bytes
dmscript.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 78336 bytes
dx7vb.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 600576 bytes
dx8vb.dll: 4.08.00.0400 English Final Retail 11/7/2000 15:16:46 1069056 bytes
amstream.dll: 6.03.01.0400 English Final Retail 11/7/2000 15:16:46 63488 bytes
devenum.dll: 6.03.01.0400 English Final Retail 11/7/2000 15:16:46 52224 bytes
dxmasf.dll: 6.04.07.1112 English Final Retail 6/8/2000 17:00:00 507904 bytes
mciqtz.drv: 4.00.96.0729 English Final Retail 8/17/1998 03:21:54 11776 bytes
mciqtz32.dll: 6.03.01.0400 English Final Retail 11/7/2000 15:16:46 33792 bytes
mpg2splt.ax: 6.03.01.0400 English Final Retail 11/7/2000 15:16:46 141312 bytes
qcap.dll: 6.03.01.0400 English Final Retail 11/7/2000 15:16:46 167936 bytes
qdv.dll: 6.03.01.0400 English Final Retail 11/7/2000 15:16:46 229888 bytes
qdvd.dll: 6.03.01.0400 English Final Retail 11/7/2000 15:16:46 344064 bytes
quartz.dll: 6.03.01.0400 English Final Retail 11/7/2000 15:16:46 956416 bytes
quartz.vxd: 4.00.00.0501 English Final Retail 8/17/1998 03:21:56 5672 bytes
strmdll.dll: 4.01.00.3857 English Final Retail 6/8/2000 17:00:00 252736 bytes
vidx16.dll: 0.00.00.0000 English Final Retail 8/17/1998 03:21:56 10240 bytes
iac25_32.ax: 2.00.05.0050 English Final Retail 6/8/2000 17:00:00 198656 bytes
ir41_32.ax: 4.31.16.0002 English Final Retail 6/8/2000 17:00:00 857600 bytes
ir41_qc.dll: 4.30.62.0001 English Final Retail 12/13/2003 22:33:18 120320 bytes
ir41_qcx.dll: 4.30.64.0001 English Final Retail 12/13/2003 22:33:18 338432 bytes
ir50_32.dll: 5.1026.15.0041 English Final Retail 6/8/2000 17:00:00 753664 bytes
ir50_qc.dll: 5.00.63.0038 English Final Retail 6/8/2000 17:00:00 212992 bytes
ir50_qcx.dll: 5.00.64.0038 English Final Retail 6/8/2000 17:00:00 196608 bytes
ivfsrc.ax: 5.03.02.0038 English Final Retail 6/8/2000 17:00:00 139264 bytes
mswebdvd.dll: 6.03.01.0400 English Final Retail 11/7/2000 15:16:46 245248 bytes
msdvdopt.dll: 4.90.3000.0000 English Final Retail 6/8/2000 17:00:00 74512 bytes
ks.sys: 4.90.3000.0400 English Final Retail 11/7/2000 15:16:46 117600 bytes
ksproxy.ax: 4.90.3000.0400 English Final Retail 11/7/2000 15:16:46 116224 bytes
ksuser.dll: 4.90.3000.0400 English Final Retail 11/7/2000 15:16:46 4096 bytes
stream.sys: 4.90.3000.0400 English Final Retail 11/7/2000 15:16:46 41920 bytes
mspclock.sys: 4.90.3000.0400 English Final Retail 11/7/2000 15:16:46 4800 bytes
mspqm.sys: 4.90.3000.0000 English Final Retail 6/8/2000 17:00:00 4848 bytes
mskssrv.sys: 4.90.3000.0400 English Final Retail 11/7/2000 15:16:46 6368 bytes
swenum.sys: 4.90.3000.0400 English Final Retail 11/7/2000 15:16:46 3456 bytes
mstee.sys: 4.90.3000.0400 English Final Retail 11/7/2000 15:16:46 4896 bytes
mpg2splt.ax: 6.03.01.0400 English Final Retail 11/7/2000 15:16:46 141312 bytes
nabtsfec.sys: 4.90.3000.0000 English Final Retail 6/8/2000 17:00:00 78448 bytes
ccdecode.sys: 4.90.3000.0000 English Final Retail 6/8/2000 17:00:00 13520 bytes
vbisurf.ax: 4.90.3000.0000 English Final Retail 6/8/2000 17:00:00 30992 bytes
msyuv.dll: 4.90.00.3000 English Final Retail 6/8/2000 17:00:00 32768 bytes
kstvtune.ax: 4.90.3000.0000 English Final Retail 6/8/2000 17:00:00 54544 bytes
ksxbar.ax: 4.90.3000.0000 English Final Retail 6/8/2000 17:00:00 40720 bytes
kswdmcap.ax: 4.90.3000.0000 English Final Retail 6/8/2000 17:00:00 84752 bytes
vfwwdm32.dll: 4.90.00.3000 English Final Retail 6/8/2000 17:00:00 69632 bytes
wstdecod.dll: 4.90.3000.0000 English Final Retail 6/8/2000 17:00:00 56592 bytes
msdv.sys: 4.90.3000.0000 English Final Retail 6/8/2000 17:00:00 45744 bytes
---------------
Display Devices
---------------
Card name: Intel(r) 82810E Graphics Controller
Manufacturer: Intel Corporation
Chip type:
DAC type:
Device ID: Enum\PCI\VEN_8086&DEV_7125&SUBSYS_B1650E11&REV_03\BUS_00&DEV_01&FUNC_00
Display Memory: 5.0 MB
Current Mode: 800 x 600 (16 bit)(75Hz)
Monitor: COMPAQ CV535
Monitor Max Res: 1024,768
Driver Name: i81xdw9x.drv
Driver Version: 4.12.01.2630 (English)
DDI Version: 7
Driver Attributes: Final Retail
Driver Date/Size: 7/17/2000 16:27:52, 53136 bytes
Driver Certified: No
WHQL Date Stamp: n/a
VDD: *vdd,*vflatd
Mini VDD: i81x.vxd
Mini VDD Date: , 0 bytes
Device Identifier: {D7B78E66-3265-11CF-E767-6491A0C2C935}
Vendor ID: 0x8086
Device ID: 0x7125
SubSys ID: 0xB1650E11
Revision ID: 0x0003
Registry: OK
DDraw Status: Enabled
D3D Status: Enabled
AGP Status: Enabled
DDraw Test Result:
D3D Test Result:
AGP Test Result:
-------------
Sound Devices
-------------
Description: ESS Allegro
Device ID: PCI\VEN_125D&DEV_1988&SUBSYS_B19D0E11&REV_12\28F000
Manufacturer ID: 1
Product ID: 100
Type: WDM
Driver Name: es198x.sys
Driver Version: 5.12.01.1088 (English)
Driver Attributes: Final Retail
Driver Certified: Yes
Date and Size: 7/25/2000 13:43:12, 165190 bytes
Other Files: es198x.sys
Driver Provider: ESS Technology, Inc.
HW Accel Level: Full
Registry: OK
Sound Test Result:
-----------
DirectMusic
-----------
DLS Path: C:\WINDOWS\system32\drivers\gm.dls
Version: 1.00.16.0002
Ports:
Microsoft Synthesizer, Software (Not Kernel Mode), Output, DLS, Internal, Default Port
MPU-401, Hardware (Kernel Mode), Input, No DLS, External
MPU-401, Hardware (Kernel Mode), Output, No DLS, External
ESS Allegro, Software (Kernel Mode), Output, DLS, Internal
MIDI Mapper, Hardware (Not Kernel Mode), Output, No DLS, Internal
Microsoft GS Wavetable SW Synth, Hardware (Not Kernel Mode), Output, No DLS, Internal
MPU-401, Hardware (Not Kernel Mode), Output, No DLS, External
MPU-401, Hardware (Not Kernel Mode), Input, No DLS, External
Registry: OK
Music Test Result:
-------------
Input Devices
-------------
Poll w/ Interrupt: Yes
Registry: OK
-------------
Input Drivers
-------------
Registry Key: msjstick.drv
Active: Yes
DeviceID: ACPI\*PNPB02F\00000001
Matching DevID: *PNPB02F
16-bit Driver: msjstick.drv
32-bit Driver: vjoyd.vxd
----------------------------
DirectPlay Service Providers
----------------------------
Serial Connection For DirectPlay - Registry: OK, File: dpmodemx.dll (4.08.00.0400)
Modem Connection For DirectPlay - Registry: OK, File: dpmodemx.dll (4.08.00.0400)
Internet TCP/IP Connection For DirectPlay - Registry: OK, File: dpwsockx.dll (4.08.00.0400)
IPX Connection For DirectPlay - Registry: OK, File: dpwsockx.dll (4.08.00.0400)
DirectPlay8 IPX Service Provider - Registry: OK, File: dpnwsock.dll (4.08.00.0400)
DirectPlay8 TCP/IP Service Provider - Registry: OK, File: dpnwsock.dll (4.08.00.0400)
DirectPlay8 Modem Service Provider - Registry: OK, File: dpnmodem.dll (4.08.00.0400)
DirectPlay8 Serial Service Provider - Registry: OK, File: dpnmodem.dll (4.08.00.0400)
DirectPlay Test Result:
-------------------------
DirectPlay Lobbyable Apps
-------------------------
Capitalism2 (DX7) - Registry: OK, ExeFile: cap2.exe ()
Duel Slingo (DX7) - Registry: OK, ExeFile: slingo.exe ()
------------------------------------
Inactive Display Entries in Registry
------------------------------------
Card name:
Driver:
Card name:
Driver:
Card name:
Driver:
Card name:
Driver:
Card name:
Driver:
----------------------------------
Inactive Sound Entries in Registry
----------------------------------
None
Here Is The Report From the crash
System snapshot taken on 3/26/2004 10:49:08 AM.
*----> Summary/Overview System Information Task list Startup Items System Hooks Kernel Drivers User-Mode Drivers 32-bit Modules 16-bit Modules Details 018f:bff6a2e9 897d00 mov dword ptr [ebp],edi
sel type base lim/bot
---- ---- -------- --------
cs 018f r-x- 00000000 ffffffff
ss 0197 rw-e 00000000 0000d7a0
ds 0197 rw-e 00000000 0000d7a0
es 0197 rw-e 00000000 0000d7a0
fs 272f rw-- 83abae64 00000037
gs 7b46 rw-- 80543d00 0000021f
stack base: 02100000
TIB limits: 021fd000 - 02200000
-- exception record --
Exception Code: c0000005 (access violation)
Exception Address: bff6a2e9 (KERNEL32.DLL:.text+0x12e9)
Exception Info: 00000001
10000014
KERNEL32.DLL:.text+0x12e9:
>018f:bff6a2e9 897d00 mov dword ptr [ebp],edi
018f:bff6a2cc 8bd1 mov edx,ecx
018f:bff6a2ce 2bd0 sub edx,eax
018f:bff6a2d0 85d2 test edx,edx
018f:bff6a2d2 7e11 jle bff6a2e5 = KERNEL32.DLL:.text+0x12e5
018f:bff6a2d4 6800000020 push 20000000
018f:bff6a2d9 52 push edx
018f:bff6a2da 50 push eax
018f:bff6a2db 6802000100 push 00010002
018f:bff6a2e0 e8ef70ffff call bff613d4 = KERNEL32.DLL!1
018f:bff6a2e5 8b442414 mov eax,dword ptr [esp+14]
KERNEL32.DLL:.text+0x12e9:
*018f:bff6a2e9 897d00 mov dword ptr [ebp],edi
018f:bff6a2ec 83c008 add eax,+08
018f:bff6a2ef 800b02 or byte ptr [ebx],02
018f:bff6a2f2 3930 cmp dword ptr [eax],esi
018f:bff6a2f4 7307 jnc bff6a2fd = KERNEL32.DLL:.text+0x12fd
018f:bff6a2f6 83c010 add eax,+10
018f:bff6a2f9 3930 cmp dword ptr [eax],esi
018f:bff6a2fb 72f9 jc bff6a2f6 = KERNEL32.DLL:.text+0x12f6
018f:bff6a2fd 83c004 add eax,+04
018f:bff6a300 8bd0 mov edx,eax
018f:bff6a302 8b4004 mov eax,dword ptr [eax+04]
--------------------
-- stack summary --
0197:10000014 018f:bff6a2e9 KERNEL32.DLL:.text+0x12e9
(00000000,00000000,00000000,00000000,
00000000,00000000,00000000,00000000)
-- stack trace --
0197:10000014 018f:bff6a2e9 KERNEL32.DLL:.text+0x12e9
(00000000,00000000,00000000,00000000,
00000000,00000000,00000000,00000000)
018f:bff6a2cc 8bd1 mov edx,ecx
018f:bff6a2ce 2bd0 sub edx,eax
018f:bff6a2d0 85d2 test edx,edx
018f:bff6a2d2 7e11 jle bff6a2e5 = KERNEL32.DLL:.text+0x12e5
018f:bff6a2d4 6800000020 push 20000000
018f:bff6a2d9 52 push edx
018f:bff6a2da 50 push eax
018f:bff6a2db 6802000100 push 00010002
018f:bff6a2e0 e8ef70ffff call bff613d4 = KERNEL32.DLL!1
018f:bff6a2e5 8b442414 mov eax,dword ptr [esp+14]
KERNEL32.DLL:.text+0x12e9:
*018f:bff6a2e9 897d00 mov dword ptr [ebp],edi
018f:bff6a2ec 83c008 add eax,+08
018f:bff6a2ef 800b02 or byte ptr [ebx],02
018f:bff6a2f2 3930 cmp dword ptr [eax],esi
018f:bff6a2f4 7307 jnc bff6a2fd = KERNEL32.DLL:.text+0x12fd
018f:bff6a2f6 83c010 add eax,+10
018f:bff6a2f9 3930 cmp dword ptr [eax],esi
018f:bff6a2fb 72f9 jc bff6a2f6 = KERNEL32.DLL:.text+0x12f6
018f:bff6a2fd 83c004 add eax,+04
018f:bff6a300 8bd0 mov edx,eax
018f:bff6a302 8b4004 mov eax,dword ptr [eax+04]
--------------------
-- stack dump --
021ff5c0 021ff600 -> 28 f6 1f 02 b1 a6 f6 bf 00 00 44 00 dc cb 45 00 (.........D...E.
021ff5c4 0fba341c
021ff5c8 0045cbdc -> 3d 34 ba 9f 50 d1 44 00 7c e2 44 00 00 00 00 00 =4..P.D.|.D.....
021ff5cc 00000020
021ff5d0 bff6a501 = KERNEL32.DLL:.text+0x1501
--------------------
018f:bff6a4e6 2bfb sub edi,ebx
018f:bff6a4e8 57 push edi
018f:bff6a4e9 894108 mov dword ptr [ecx+08],eax
018f:bff6a4ec 8b5604 mov edx,dword ptr [esi+04]
018f:bff6a4ef 8b4608 mov eax,dword ptr [esi+08]
018f:bff6a4f2 895004 mov dword ptr [eax+04],edx
018f:bff6a4f5 8d041e lea eax,[esi+ebx]
018f:bff6a4f8 50 push eax
018f:bff6a4f9 ff7508 push dword ptr [ebp+08]
018f:bff6a4fc e870fdffff call bff6a271 = KERNEL32.DLL:.text+0x1271
KERNEL32.DLL:.text+0x1501:
*018f:bff6a501 eb36 jmp bff6a539 = KERNEL32.DLL:.text+0x1539
018f:bff6a503 8b4d08 mov ecx,dword ptr [ebp+08]
018f:bff6a506 0fb64170 movzx eax,byte ptr [ecx+70]
018f:bff6a50a 0b45f4 or eax,dword ptr [ebp-0c]
018f:bff6a50d 50 push eax
018f:bff6a50e 8b45f8 mov eax,dword ptr [ebp-08]
018f:bff6a511 2b45fc sub eax,dword ptr [ebp-04]
018f:bff6a514 50 push eax
018f:bff6a515 ff75fc push dword ptr [ebp-04]
018f:bff6a518 e8f6feffff call bff6a413 = KERNEL32.DLL:.text+0x1413
018f:bff6a51d 85c0 test eax,eax
--------------------
021ff5d4 00440000 -> 00 10 10 00 00 00 00 00 20 00 00 00 01 00 00 a0 ........ .......
021ff5d8 0045cbfc -> 00 00 00 00 46 53 08 cc 45 00 00 00 46 53 10 cc ....FS..E...FS..
021ff5dc 0fba341c
021ff5e0 00000000
021ff5e4 0044000c -> 01 00 00 a0 c4 e0 44 00 4c c8 46 00 80 00 00 00 ......D.L.F.....
021ff5e8 00440000 -> 00 10 10 00 00 00 00 00 20 00 00 00 01 00 00 a0 ........ .......
021ff5ec 0045cbdc -> 3d 34 ba 9f 50 d1 44 00 7c e2 44 00 00 00 00 00 =4..P.D.|.D.....
021ff5f0 00000040
021ff5f4 00000000
021ff5f8 00010000
021ff5fc 0000045d
021ff600 021ff628 -> 4c f6 1f 02 f9 b5 f6 bf 00 00 44 00 20 00 00 00 L.........D. ...
021ff604 bff6a6b1 = KERNEL32.DLL:.text+0x16b1
--------------------
018f:bff6a693 8b4604 mov eax,dword ptr [esi+04]
018f:bff6a696 8b4dfc mov ecx,dword ptr [ebp-04]
018f:bff6a699 894104 mov dword ptr [ecx+04],eax
018f:bff6a69c 894e04 mov dword ptr [esi+04],ecx
018f:bff6a69f e953ffffff jmp bff6a5f7 = KERNEL32.DLL:.text+0x15f7
018f:bff6a6a4 ff7510 push dword ptr [ebp+10]
018f:bff6a6a7 ff750c push dword ptr [ebp+0c]
018f:bff6a6aa 53 push ebx
018f:bff6a6ab 56 push esi
018f:bff6a6ac e8a6fdffff call bff6a457 = KERNEL32.DLL:.text+0x1457
KERNEL32.DLL:.text+0x16b1:
*018f:bff6a6b1 89450c mov dword ptr [ebp+0c],eax
018f:bff6a6b4 85c0 test eax,eax
018f:bff6a6b6 7436 jz bff6a6ee = KERNEL32.DLL:.text+0x16ee
018f:bff6a6b8 ff7510 push dword ptr [ebp+10]
018f:bff6a6bb 56 push esi
018f:bff6a6bc 0d000000a0 or eax,a0000000
018f:bff6a6c1 8903 mov dword ptr [ebx],eax
018f:bff6a6c3 e888fbffff call bff6a250 = KERNEL32.DLL:.text+0x1250
018f:bff6a6c8 8d4304 lea eax,[ebx+04]
018f:bff6a6cb eb49 jmp bff6a716 = KERNEL32.DLL:.text+0x1716
018f:bff6a6cd 6a08 push +08
--------------------
021ff608 00440000 -> 00 10 10 00 00 00 00 00 20 00 00 00 01 00 00 a0 ........ .......
021ff60c 0045cbdc -> 3d 34 ba 9f 50 d1 44 00 7c e2 44 00 00 00 00 00 =4..P.D.|.D.....
021ff610 00000020
021ff614 00000041
...
021ff61c 00000000
...
021ff624 bff6b5f9 = KERNEL32.DLL:.text+0x25f9
--------------------
018f:bff6b5d7 8d7e02 lea edi,[esi+02]
018f:bff6b5da c70700000000 mov dword ptr [edi],00000000
018f:bff6b5e0 eb42 jmp bff6b624 = KERNEL32.DLL:.text+0x2624
018f:bff6b5e2 83cf01 or edi,+01
018f:bff6b5e5 8b0df4bcfbbf mov ecx,dword ptr [bffbbcf4]
018f:bff6b5eb 57 push edi
018f:bff6b5ec 8b11 mov edx,dword ptr [ecx]
018f:bff6b5ee ff750c push dword ptr [ebp+0c]
018f:bff6b5f1 ff7218 push dword ptr [edx+18]
018f:bff6b5f4 e8b2efffff call bff6a5ab = KERNEL32.DLL:.text+0x15ab
KERNEL32.DLL:.text+0x25f9:
*018f:bff6b5f9 8bf8 mov edi,eax
018f:bff6b5fb 85ff test edi,edi
018f:bff6b5fd 7525 jnz bff6b624 = KERNEL32.DLL:.text+0x2624
018f:bff6b5ff 8b75fc mov esi,dword ptr [ebp-04]
018f:bff6b602 85db test ebx,ebx
018f:bff6b604 741c jz bff6b622 = KERNEL32.DLL:.text+0x2622
018f:bff6b606 a1f4bcfbbf mov eax,dword ptr [bffbbcf4]
018f:bff6b60b 8b08 mov ecx,dword ptr [eax]
018f:bff6b60d 8b5158 mov edx,dword ptr [ecx+58]
018f:bff6b610 895602 mov dword ptr [esi+02],edx
018f:bff6b613 a1f4bcfbbf mov eax,dword ptr [bffbbcf4]
--------------------
021ff628 021ff64c -> 8c f6 1f 02 a1 2d 7e 7f 40 00 00 00 1c 00 00 00 .....-..@.......
021ff62c bff6b5f9 = KERNEL32.DLL:.text+0x25f9
--------------------
018f:bff6b5d7 8d7e02 lea edi,[esi+02]
018f:bff6b5da c70700000000 mov dword ptr [edi],00000000
018f:bff6b5e0 eb42 jmp bff6b624 = KERNEL32.DLL:.text+0x2624
018f:bff6b5e2 83cf01 or edi,+01
018f:bff6b5e5 8b0df4bcfbbf mov ecx,dword ptr [bffbbcf4]
018f:bff6b5eb 57 push edi
018f:bff6b5ec 8b11 mov edx,dword ptr [ecx]
018f:bff6b5ee ff750c push dword ptr [ebp+0c]
018f:bff6b5f1 ff7218 push dword ptr [edx+18]
018f:bff6b5f4 e8b2efffff call bff6a5ab = KERNEL32.DLL:.text+0x15ab
KERNEL32.DLL:.text+0x25f9:
*018f:bff6b5f9 8bf8 mov edi,eax
018f:bff6b5fb 85ff test edi,edi
018f:bff6b5fd 7525 jnz bff6b624 = KERNEL32.DLL:.text+0x2624
018f:bff6b5ff 8b75fc mov esi,dword ptr [ebp-04]
018f:bff6b602 85db test ebx,ebx
018f:bff6b604 741c jz bff6b622 = KERNEL32.DLL:.text+0x2622
018f:bff6b606 a1f4bcfbbf mov eax,dword ptr [bffbbcf4]
018f:bff6b60b 8b08 mov ecx,dword ptr [eax]
018f:bff6b60d 8b5158 mov edx,dword ptr [ecx+58]
018f:bff6b610 895602 mov dword ptr [esi+02],edx
018f:bff6b613 a1f4bcfbbf mov eax,dword ptr [bffbbcf4]
--------------------
021ff630 00440000 -> 00 10 10 00 00 00 00 00 20 00 00 00 01 00 00 a0 ........ .......
021ff634 00000020
021ff638 00000041
021ff63c 7f7e0000 = RNAUI.DLL+0x0
-> 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
021ff640 00000000
021ff644 021ff89c -> a0 ff 2c 99 57 f5 1a 10 88 ec 00 dd 01 0c cc 48 ..,.W..........H
021ff648 7fc35702 = SHELL32.DLL:.text+0x64702
--------------------
018f:7fc356e9 57 push edi
018f:7fc356ea 6a10 push +10
018f:7fc356ec bfd0adbd7f mov edi,7fbdadd0
018f:7fc356f1 59 pop ecx
018f:7fc356f2 33c0 xor eax,eax
018f:7fc356f4 f3a6 repz cmps byte ptr ds:[esi],byte ptr es:[edi]
018f:7fc356f6 7536 jnz 7fc3572e = SHELL32.DLL:.text+0x6472e
018f:7fc356f8 6a14 push +14
018f:7fc356fa 6a40 push +40
018f:7fc356fc ff15e416bd7f call dword ptr [7fbd16e4] -> KERNEL32.DLL!GlobalAlloc
SHELL32.DLL:.text+0x64702:
*018f:7fc35702 85c0 test eax,eax
018f:7fc35704 7421 jz 7fc35727 = SHELL32.DLL:.text+0x64727
018f:7fc35706 8b4c241c mov ecx,dword ptr [esp+1c]
018f:7fc3570a ff4004 inc dword ptr [eax+04]
018f:7fc3570d 894810 mov dword ptr [eax+10],ecx
018f:7fc35710 8b4c2418 mov ecx,dword ptr [esp+18]
018f:7fc35714 c70040fec17f mov dword ptr [eax],7fc1fe40
018f:7fc3571a 89480c mov dword ptr [eax+0c],ecx
018f:7fc3571d 8903 mov dword ptr [ebx],eax
018f:7fc3571f 33c0 xor eax,eax
018f:7fc35721 5f pop edi
--------------------
021ff64c 021ff68c -> b0 f6 1f 02 60 74 c4 7f 15 2e 7e 7f 78 71 44 00 ....`t......xqD.
021ff650 7f7e2da1 = RNAUI.DLL:.text+0x1da1
--------------------
018f:7f7e2d84 c20800 retd 0008
018f:7f7e2d87 837c240400 cmp dword ptr [esp+04],+00
018f:7f7e2d8c 56 push esi
018f:7f7e2d8d 57 push edi
018f:7f7e2d8e 7407 jz 7f7e2d97 = RNAUI.DLL:.text+0x1d97
018f:7f7e2d90 bf10010480 mov edi,80040110
018f:7f7e2d95 eb77 jmp 7f7e2e0e = RNAUI.DLL:.text+0x1e0e
018f:7f7e2d97 6a1c push +1c
018f:7f7e2d99 6a40 push +40
018f:7f7e2d9b ff15f4107e7f call dword ptr [7f7e10f4] -> KERNEL32.DLL!GlobalAlloc
RNAUI.DLL:.text+0x1da1:
*018f:7f7e2da1 8bf0 mov esi,eax
018f:7f7e2da3 85f6 test esi,esi
018f:7f7e2da5 7415 jz 7f7e2dbc = RNAUI.DLL:.text+0x1dbc
018f:7f7e2da7 8d4618 lea eax,[esi+18]
018f:7f7e2daa 50 push eax
018f:7f7e2dab ff1564127e7f call dword ptr [7f7e1264] -> SHELL32.DLL!SHGetMalloc
018f:7f7e2db1 85c0 test eax,eax
018f:7f7e2db3 7d0e jge 7f7e2dc3 = RNAUI.DLL:.text+0x1dc3
018f:7f7e2db5 56 push esi
018f:7f7e2db6 ff15f8107e7f call dword ptr [7f7e10f8] -> KERNEL32.DLL!LocalFree
018f:7f7e2dbc bf0e000780 mov edi,8007000e
--------------------
021ff654 00000040
021ff658 0000001c
021ff65c 7f7e0000 = RNAUI.DLL+0x0
-> 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
021ff660 00000000
021ff664 7fc356b8 = SHELL32.DLL:.text+0x646b8
--------------------
018f:7fc3569b 394c2408 cmp dword ptr [esp+08],ecx
018f:7fc3569f 8908 mov dword ptr [eax],ecx
018f:7fc356a1 7408 jz 7fc356ab = SHELL32.DLL:.text+0x646ab
018f:7fc356a3 b810010480 mov eax,80040110
018f:7fc356a8 c21000 retd 0010
018f:7fc356ab 50 push eax
018f:7fc356ac 8b442408 mov eax,dword ptr [esp+08]
018f:7fc356b0 ff742410 push dword ptr [esp+10]
018f:7fc356b4 51 push ecx
018f:7fc356b5 ff500c call dword ptr [eax+0c]
SHELL32.DLL:.text+0x646b8:
*018f:7fc356b8 ebee jmp 7fc356a8 = SHELL32.DLL:.text+0x646a8
018f:7fc356ba 8b4c2404 mov ecx,dword ptr [esp+04]
018f:7fc356be 8b4110 mov eax,dword ptr [ecx+10]
018f:7fc356c1 85c0 test eax,eax
018f:7fc356c3 740d jz 7fc356d2 = SHELL32.DLL:.text+0x646d2
018f:7fc356c5 837c240800 cmp dword ptr [esp+08],+00
018f:7fc356ca 740b jz 7fc356d7 = SHELL32.DLL:.text+0x646d7
018f:7fc356cc 83c004 add eax,+04
018f:7fc356cf 894110 mov dword ptr [ecx+10],eax
018f:7fc356d2 33c0 xor eax,eax
018f:7fc356d4 c20800 retd 0008
--------------------
021ff668 00000000
021ff66c 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff670 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff674 7fbdb6ea = SHELL32.DLL:.text+0xa6ea
--------------------
018f:7fbdb6d2 8bf0 mov esi,eax
018f:7fbdb6d4 85f6 test esi,esi
018f:7fbdb6d6 7c1d jl 7fbdb6f5 = SHELL32.DLL:.text+0xa6f5
018f:7fbdb6d8 ff7518 push dword ptr [ebp+18]
018f:7fbdb6db 8b450c mov eax,dword ptr [ebp+0c]
018f:7fbdb6de ff7514 push dword ptr [ebp+14]
018f:7fbdb6e1 8b08 mov ecx,dword ptr [eax]
018f:7fbdb6e3 ff7510 push dword ptr [ebp+10]
018f:7fbdb6e6 50 push eax
018f:7fbdb6e7 ff510c call dword ptr [ecx+0c]
SHELL32.DLL:.text+0xa6ea:
*018f:7fbdb6ea 8bf0 mov esi,eax
018f:7fbdb6ec 8b450c mov eax,dword ptr [ebp+0c]
018f:7fbdb6ef 50 push eax
018f:7fbdb6f0 8b08 mov ecx,dword ptr [eax]
018f:7fbdb6f2 ff5108 call dword ptr [ecx+08]
018f:7fbdb6f5 8bc6 mov eax,esi
018f:7fbdb6f7 5e pop esi
018f:7fbdb6f8 5d pop ebp
018f:7fbdb6f9 c21400 retd 0014
018f:7fbdb6fc 56 push esi
018f:7fbdb6fd 8b3548b7bd7f mov esi,dword ptr [7fbdb748] -> SHELL32.DLL:.text+0xa713
--------------------
021ff678 00447178 -> 40 fe c1 7f 01 00 00 00 00 00 00 00 87 2d 7e 7f @............-..
021ff67c 00000000
021ff680 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff684 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff688 80040155 -> 06 42 06 26 89 0e 6a 00 8b 4f 08 89 0e ca 00 66 .B.&..j..O.....f
021ff68c 021ff6b0 -> 44 f8 1f 02 ae 74 c4 7f 40 f7 1f 02 9c f8 1f 02 D....t..@.......
021ff690 7fc47460 = SHELL32.DLL:.text+0x76460
--------------------
018f:7fc47443 57 push edi
018f:7fc47444 ff156417bd7f call dword ptr [7fbd1764] -> KERNEL32.DLL!GetProcAddress
018f:7fc4744a 85c0 test eax,eax
018f:7fc4744c 7427 jz 7fc47475 = SHELL32.DLL:.text+0x76475
018f:7fc4744e ff7518 push dword ptr [ebp+18]
018f:7fc47451 ff7514 push dword ptr [ebp+14]
018f:7fc47454 ff7510 push dword ptr [ebp+10]
018f:7fc47457 ff750c push dword ptr [ebp+0c]
018f:7fc4745a 50 push eax
018f:7fc4745b e85f42f9ff call 7fbdb6bf = SHELL32.DLL:.text+0xa6bf
SHELL32.DLL:.text+0x76460:
*018f:7fc47460 8bf0 mov esi,eax
018f:7fc47462 85f6 test esi,esi
018f:7fc47464 7d07 jge 7fc4746d = SHELL32.DLL:.text+0x7646d
018f:7fc47466 57 push edi
018f:7fc47467 ff156c17bd7f call dword ptr [7fbd176c] -> KERNEL32.DLL!FreeLibrary
018f:7fc4746d 8bc6 mov eax,esi
018f:7fc4746f 5f pop edi
018f:7fc47470 5e pop esi
018f:7fc47471 5d pop ebp
018f:7fc47472 c21400 retd 0014
018f:7fc47475 be05400080 mov esi,80004005
--------------------
021ff694 7f7e2e15 = RNAUI.DLL!DllGetClassObject
--------------------
018f:7f7e2e03 56 push esi
018f:7f7e2e04 ff10 call dword ptr [eax]
018f:7f7e2e06 8bf8 mov edi,eax
018f:7f7e2e08 8b06 mov eax,dword ptr [esi]
018f:7f7e2e0a 56 push esi
018f:7f7e2e0b ff5008 call dword ptr [eax+08]
018f:7f7e2e0e 8bc7 mov eax,edi
018f:7f7e2e10 5f pop edi
018f:7f7e2e11 5e pop esi
018f:7f7e2e12 c20c00 retd 000c
RNAUI.DLL!DllGetClassObject:
*018f:7f7e2e15 56 push esi
018f:7f7e2e16 8b742408 mov esi,dword ptr [esp+08]
018f:7f7e2e1a 57 push edi
018f:7f7e2e1b 6a04 push +04
018f:7f7e2e1d 59 pop ecx
018f:7f7e2e1e bf9c1c7e7f mov edi,7f7e1c9c
018f:7f7e2e23 33c0 xor eax,eax
018f:7f7e2e25 f3a7 repz cmps dword ptr ds:[esi],dword ptr es:[edi]
018f:7f7e2e27 5f pop edi
018f:7f7e2e28 5e pop esi
018f:7f7e2e29 751b jnz 7f7e2e46 = RNAUI.DLL:.text+0x1e46
--------------------
021ff698 00447178 -> 40 fe c1 7f 01 00 00 00 00 00 00 00 87 2d 7e 7f @............-..
021ff69c 00000000
021ff6a0 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff6a4 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
...
021ff6ac 80040155 -> 06 42 06 26 89 0e 6a 00 8b 4f 08 89 0e ca 00 66 .B.&..j..O.....f
021ff6b0 021ff844 -> 74 f8 1f 02 8d b6 bd 7f 9c f8 1f 02 00 00 00 00 t...............
021ff6b4 7fc474ae = SHELL32.DLL:.text+0x764ae
--------------------
018f:7fc4748e 25ffff0000 and eax,0000ffff
018f:7fc47493 0d00000780 or eax,80070000
018f:7fc47498 ebd5 jmp 7fc4746f = SHELL32.DLL:.text+0x7646f
018f:7fc4749a 57 push edi
018f:7fc4749b 8d85fcfeffff lea eax,[ebp-00000104]
018f:7fc474a1 ff7518 push dword ptr [ebp+18]
018f:7fc474a4 ff750c push dword ptr [ebp+0c]
018f:7fc474a7 53 push ebx
018f:7fc474a8 50 push eax
018f:7fc474a9 e878ffffff call 7fc47426 = SHELL32.DLL:.text+0x76426
SHELL32.DLL:.text+0x764ae:
*018f:7fc474ae 8bf0 mov esi,eax
018f:7fc474b0 e9b240f9ff jmp 7fbdb567 = SHELL32.DLL:.text+0xa567
018f:7fc474b5 53 push ebx
018f:7fc474b6 ff158c1bbd7f call dword ptr [7fbd1b8c] -> SHLWAPI.DLL!236
018f:7fc474bc e97740f9ff jmp 7fbdb538 = SHELL32.DLL:.text+0xa538
018f:7fc474c1 8d45f0 lea eax,[ebp-10]
018f:7fc474c4 50 push eax
018f:7fc474c5 ff7508 push dword ptr [ebp+08]
018f:7fc474c8 e822d6f8ff call 7fbd4aef = SHELL32.DLL!147
018f:7fc474cd 8d45f0 lea eax,[ebp-10]
018f:7fc474d0 e97143f9ff jmp 7fbdb846 = SHELL32.DLL:.text+0xa846
--------------------
021ff6b8 021ff740 -> 72 6e 61 75 69 2e 64 6c 6c 00 00 65 72 73 69 6f rnaui.dll..ersio
021ff6bc 021ff89c -> a0 ff 2c 99 57 f5 1a 10 88 ec 00 dd 01 0c cc 48 ..,.W..........H
021ff6c0 00000000
021ff6c4 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff6c8 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff6cc 00000000
...
021ff6d4 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff6d8 3239397b
021ff6dc 41464643
021ff6e0 35462d30
021ff6e4 312d3735
021ff6e8 2d413130
021ff6ec 43453838
021ff6f0 4430302d
021ff6f4 30313044
021ff6f8 34434343
021ff6fc 02007d38
021ff700 63183111 = SHLWAPI.DLL:.text+0x2111
-> d3 1b 92 b5 8c cf 11 84 cf 88 58 35 d9 dc 01 70 ..........X5...p
021ff704 00000000
021ff708 021ff854 -> 01 00 00 00 01 00 00 00 18 1f bd 7f 01 00 00 00 ................
021ff70c 6318304f = SHLWAPI.DLL:.text+0x204f
--------------------
018f:63183027 ff6804 jmp fword ptr [eax+04]
018f:6318302a 0100 add dword ptr [eax],eax
018f:6318302c 0050e8 add byte ptr [eax-18],dl
018f:6318302f 864f01 xchg byte ptr [edi+01],cl
018f:63183032 0083c4108d45 add byte ptr [ebx+458d10c4],al
018f:63183038 08506a or byte ptr [eax+6a],dl
018f:6318303b 018d85d4feff add dword ptr [ebp+fffed485],ecx
018f:63183041 ff5650 call dword ptr [esi+50]
018f:63183044 6802000080 push 80000002
018f:63183049 ff1504171863 call dword ptr [63181704] -> ADVAPI32.DLL!RegOpenKeyExA
SHLWAPI.DLL:.text+0x204f:
*018f:6318304f 85c0 test eax,eax
018f:63183051 0f84473c0300 jz 631b6c9e = SHLWAPI.DLL:.text+0x35c9e
018f:63183057 8bc6 mov eax,esi
018f:63183059 5e pop esi
018f:6318305a c9 leave
018f:6318305b c20400 retd 0004
018f:6318305e 90 nop
018f:6318305f 90 nop
018f:63183060 839577e99d93ce adc dword ptr [ebp+939de977],-32
018f:63183067 118a77444553 adc dword ptr [edx+53454477],ecx
018f:6318306d 54 push esp
--------------------
021ff710 80000002
021ff714 021ff728 -> 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f SOFTWARE\Microso
021ff718 00000000
021ff71c 00000001
021ff720 021ff85c -> 18 1f bd 7f 01 00 00 00 00 00 00 00 48 fb 1f 02 ............H...
021ff724 021ff86d -> ff 2c 99 57 f5 1a 10 b4 f8 1f 02 24 2e bd 7f 00 .,.W.......$....
021ff728 54464f53
021ff72c 45524157
021ff730 63694d5c
021ff734 6f736f72
021ff738 575c7466
021ff73c 6f646e69
021ff740 75616e72
021ff744 6c642e69
021ff748 6500006c
021ff74c 6f697372
021ff750 68535c6e
021ff754 436c6c65
021ff758 61706d6f
021ff75c 69626974
021ff760 7974696c
021ff764 6a624f5c
021ff768 73746365
021ff76c 39397b5c
021ff770 46464332
021ff774 462d3041
021ff778 2d373535
021ff77c 41313031
021ff780 4538382d
021ff784 30302d43
021ff788 31304444
021ff78c 43434330
021ff790 007d3834
021ff794 2e32336c
021ff798 006c6c64
021ff79c 6f697300
021ff7a0 68535c6e
021ff7a4 436c6c65
021ff7a8 61706d6f
021ff7ac 69626974
021ff7b0 7974696c
021ff7b4 6a624f5c
021ff7b8 73746365
021ff7bc 31327b5c
021ff7c0 30324345
021ff7c4 332d3032
021ff7c8 2d414541
021ff7cc 39363031
021ff7d0 4432412d
021ff7d4 38302d44
021ff7d8 42323030
021ff7dc 30333033
021ff7e0 007d4439
021ff7e4 00000000
...
021ff810 00443780 -> 30 00 00 a0 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 0......P.O. .:i.
021ff814 bff6a51d = KERNEL32.DLL:.text+0x151d
--------------------
018f:bff6a501 eb36 jmp bff6a539 = KERNEL32.DLL:.text+0x1539
018f:bff6a503 8b4d08 mov ecx,dword ptr [ebp+08]
018f:bff6a506 0fb64170 movzx eax,byte ptr [ecx+70]
018f:bff6a50a 0b45f4 or eax,dword ptr [ebp-0c]
018f:bff6a50d 50 push eax
018f:bff6a50e 8b45f8 mov eax,dword ptr [ebp-08]
018f:bff6a511 2b45fc sub eax,dword ptr [ebp-04]
018f:bff6a514 50 push eax
018f:bff6a515 ff75fc push dword ptr [ebp-04]
018f:bff6a518 e8f6feffff call bff6a413 = KERNEL32.DLL:.text+0x1413
KERNEL32.DLL:.text+0x151d:
*018f:bff6a51d 85c0 test eax,eax
018f:bff6a51f 747d jz bff6a59e = KERNEL32.DLL:.text+0x159e
018f:bff6a521 8b4608 mov eax,dword ptr [esi+08]
018f:bff6a524 8b4e04 mov ecx,dword ptr [esi+04]
018f:bff6a527 8bdf mov ebx,edi
018f:bff6a529 894108 mov dword ptr [ecx+08],eax
018f:bff6a52c 8b5604 mov edx,dword ptr [esi+04]
018f:bff6a52f 8b4608 mov eax,dword ptr [esi+08]
018f:bff6a532 895004 mov dword ptr [eax+04],edx
018f:bff6a535 80243efd and byte ptr [esi+edi],fd
018f:bff6a539 837df000 cmp dword ptr [ebp-10],+00
--------------------
021ff818 00000444
021ff81c ffffffff
021ff820 00000040
021ff824 0044000c -> 01 00 00 a0 c4 e0 44 00 4c c8 46 00 80 00 00 00 ......D.L.F.....
021ff828 00440000 -> 00 10 10 00 00 00 00 00 20 00 00 00 01 00 00 a0 ........ .......
021ff82c 3239397b
021ff830 41464643
021ff834 35462d30
021ff838 312d3735
021ff83c 2d413130
021ff840 43453838
021ff844 021ff874 -> b4 f8 1f 02 24 2e bd 7f 00 00 00 00 9c f8 1f 02 ....$...........
021ff848 7fbdb68d = SHELL32.DLL:.text+0xa68d
--------------------
018f:7fbdb66e 837d0800 cmp dword ptr [ebp+08],+00
018f:7fbdb672 751d jnz 7fbdb691 = SHELL32.DLL:.text+0xa691
018f:7fbdb674 8b450c mov eax,dword ptr [ebp+0c]
018f:7fbdb677 ff7518 push dword ptr [ebp+18]
018f:7fbdb67a ff7514 push dword ptr [ebp+14]
018f:7fbdb67d 6a01 push +01
018f:7fbdb67f 6801040000 push 00000401
018f:7fbdb684 ff7510 push dword ptr [ebp+10]
018f:7fbdb687 50 push eax
018f:7fbdb688 e85bfeffff call 7fbdb4e8 = SHELL32.DLL:.text+0xa4e8
SHELL32.DLL:.text+0xa68d:
*018f:7fbdb68d c9 leave
018f:7fbdb68e c21400 retd 0014
018f:7fbdb691 8d45f0 lea eax,[ebp-10]
018f:7fbdb694 50 push eax
018f:7fbdb695 ff7508 push dword ptr [ebp+08]
018f:7fbdb698 e85294ffff call 7fbd4aef = SHELL32.DLL!147
018f:7fbdb69d 8d45f0 lea eax,[ebp-10]
018f:7fbdb6a0 ebd5 jmp 7fbdb677 = SHELL32.DLL:.text+0xa677
018f:7fbdb6a2 ff742410 push dword ptr [esp+10]
018f:7fbdb6a6 ff742410 push dword ptr [esp+10]
018f:7fbdb6aa ff742410 push dword ptr [esp+10]
--------------------
021ff84c 021ff89c -> a0 ff 2c 99 57 f5 1a 10 88 ec 00 dd 01 0c cc 48 ..,.W..........H
021ff850 00000000
021ff854 00000001
...
021ff85c 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff860 00000001
021ff864 00000000
021ff868 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff86c 992cffa0
021ff870 101af557
021ff874 021ff8b4 -> dc f8 1f 02 d9 2c bd 7f 0c ca 45 00 84 ca 45 00 .....,....E...E.
021ff878 7fbd2e24 = SHELL32.DLL:.text+0x1e24
--------------------
018f:7fbd2e0c 81e700010000 and edi,00000100
018f:7fbd2e12 7503 jnz 7fbd2e17 = SHELL32.DLL:.text+0x1e17
018f:7fbd2e14 8b4510 mov eax,dword ptr [ebp+10]
018f:7fbd2e17 53 push ebx
018f:7fbd2e18 50 push eax
018f:7fbd2e19 8d45e8 lea eax,[ebp-18]
018f:7fbd2e1c 56 push esi
018f:7fbd2e1d 50 push eax
018f:7fbd2e1e 56 push esi
018f:7fbd2e1f e844880000 call 7fbdb668 = SHELL32.DLL:.text+0xa668
SHELL32.DLL:.text+0x1e24:
*018f:7fbd2e24 3bc6 cmp eax,esi
018f:7fbd2e26 8945fc mov dword ptr [ebp-04],eax
018f:7fbd2e29 7c8f jl 7fbd2dba = SHELL32.DLL:.text+0x1dba
018f:7fbd2e2b 8b33 mov esi,dword ptr [ebx]
018f:7fbd2e2d 85ff test edi,edi
018f:7fbd2e2f 0f85488e0a00 jnz 7fc7bc7d = SHELL32.DLL:.text+0xaac7d
018f:7fbd2e35 837dfc00 cmp dword ptr [ebp-04],+00
018f:7fbd2e39 0f8c7bffffff jl 7fbd2dba = SHELL32.DLL:.text+0x1dba
018f:7fbd2e3f 8b4df8 mov ecx,dword ptr [ebp-08]
018f:7fbd2e42 6a00 push +00
018f:7fbd2e44 56 push esi
--------------------
021ff87c 00000000
021ff880 021ff89c -> a0 ff 2c 99 57 f5 1a 10 88 ec 00 dd 01 0c cc 48 ..,.W..........H
021ff884 00000000
021ff888 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff88c 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff890 00000000
021ff894 0045ca2a -> 00 00 00 00 01 00 00 00 00 00 00 00 38 30 3f 84 ............80?.
021ff898 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff89c 992cffa0
021ff8a0 101af557
021ff8a4 dd00ec88
021ff8a8 48cc0c01
021ff8ac 0045ca54 -> d0 c9 bd 7f d8 28 bd 7f 01 00 00 00 44 ac 44 00 .....(......D.D.
021ff8b0 80004005 -> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
021ff8b4 021ff8dc
--------------------
018f:021ff8d8 54 push esp
018f:021ff8d9 ca4500 retfd 0045
*018f:021ff8dc 00f9 add cl,bh
018f:021ff8de 1f pop ds
018f:021ff8df 02412b add al,byte ptr [ecx+2b]
018f:021ff8e2 bd7f0cca45 mov ebp,45ca0c7f
018f:021ff8e7 0000 add byte ptr [eax],al
018f:021ff8e9 0000 add byte ptr [eax],al
018f:021ff8eb 0018 add byte ptr [eax],bl
018f:021ff8ed 1f pop ds
018f:021ff8ee bd7f000000 mov ebp,0000007f
018f:021ff8f3 0001 add byte ptr [ecx],al
018f:021ff8f5 0000 add byte ptr [eax],al
--------------------
021ff8b8 7fbd2cd9 = SHELL32.DLL:.text+0x1cd9
--------------------
018f:7fbd2cba 897d14 mov dword ptr [ebp+14],edi
018f:7fbd2cbd c7451801000000 mov dword ptr [ebp+18],00000001
018f:7fbd2cc4 397d18 cmp dword ptr [ebp+18],edi
018f:7fbd2cc7 7433 jz 7fbd2cfc = SHELL32.DLL:.text+0x1cfc
018f:7fbd2cc9 53 push ebx
018f:7fbd2cca 8b4dfc mov ecx,dword ptr [ebp-04]
018f:7fbd2ccd ff7510 push dword ptr [ebp+10]
018f:7fbd2cd0 ff750c push dword ptr [ebp+0c]
018f:7fbd2cd3 50 push eax
018f:7fbd2cd4 e866000000 call 7fbd2d3f = SHELL32.DLL:.text+0x1d3f
SHELL32.DLL:.text+0x1cd9:
*018f:7fbd2cd9 8bf8 mov edi,eax
018f:7fbd2cdb 837d1400 cmp dword ptr [ebp+14],+00
018f:7fbd2cdf 7554 jnz 7fbd2d35 = SHELL32.DLL:.text+0x1d35
018f:7fbd2ce1 8bc7 mov eax,edi
018f:7fbd2ce3 5f pop edi
018f:7fbd2ce4 5e pop esi
018f:7fbd2ce5 5b pop ebx
018f:7fbd2ce6 c9 leave
018f:7fbd2ce7 c21400 retd 0014
018f:7fbd2cea 50 push eax
018f:7fbd2ceb e8f9010000 call 7fbd2ee9 = SHELL32.DLL!19
--------------------
021ff8bc 0045ca0c -> 1e 00 71 80 00 00 00 00 00 00 00 00 00 00 a0 ff ..q.............
021ff8c0 0045ca84 -> 00 00 00 00 03 00 00 00 58 20 c1 7f 58 0f cd 7f ........X ..X...
021ff8c4 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff8c8 00000000
021ff8cc 0045ca54 -> d0 c9 bd 7f d8 28 bd 7f 01 00 00 00 44 ac 44 00 .....(......D.D.
021ff8d0 0045ca64 -> 80 c9 bd 7f 70 c9 bd 7f 58 c9 bd 7f 50 44 39 38 ....p...X...PD98
021ff8d4 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff8d8 0045ca54 -> d0 c9 bd 7f d8 28 bd 7f 01 00 00 00 44 ac 44 00 .....(......D.D.
021ff8dc 021ff900
--------------------
018f:021ff8fd ca4500 retfd 0045
*018f:021ff900 2cf9 sub al,f9
018f:021ff902 1f pop ds
018f:021ff903 0228 add ch,byte ptr [eax]
018f:021ff905 2dbd7f64ca sub eax,ca647fbd
018f:021ff90a 45 inc ebp
018f:021ff90b 000cca add byte ptr [edx+ecx*8],cl
018f:021ff90e 45 inc ebp
018f:021ff90f 0000 add byte ptr [eax],al
018f:021ff911 0000 add byte ptr [eax],al
018f:021ff913 0018 add byte ptr [eax],bl
018f:021ff915 1f pop ds
--------------------
021ff8e0 7fbd2b41 = SHELL32.DLL:.text+0x1b41
--------------------
018f:7fbd2b25 e8a8ffffff call 7fbd2ad2 = SHELL32.DLL:.text+0x1ad2
018f:7fbd2b2a 85c0 test eax,eax
018f:7fbd2b2c 7419 jz 7fbd2b47 = SHELL32.DLL:.text+0x1b47
018f:7fbd2b2e 6a00 push +00
018f:7fbd2b30 8bcf mov ecx,edi
018f:7fbd2b32 ff7518 push dword ptr [ebp+18]
018f:7fbd2b35 ff7514 push dword ptr [ebp+14]
018f:7fbd2b38 ff7510 push dword ptr [ebp+10]
018f:7fbd2b3b 50 push eax
018f:7fbd2b3c e857010000 call 7fbd2c98 = SHELL32.DLL:.text+0x1c98
SHELL32.DLL:.text+0x1b41:
*018f:7fbd2b41 5f pop edi
018f:7fbd2b42 5e pop esi
018f:7fbd2b43 5d pop ebp
018f:7fbd2b44 c21400 retd 0014
018f:7fbd2b47 ff7518 push dword ptr [ebp+18]
018f:7fbd2b4a 8b4618 mov eax,dword ptr [esi+18]
018f:7fbd2b4d ff7514 push dword ptr [ebp+14]
018f:7fbd2b50 8b08 mov ecx,dword ptr [eax]
018f:7fbd2b52 ff7510 push dword ptr [ebp+10]
018f:7fbd2b55 ff750c push dword ptr [ebp+0c]
018f:7fbd2b58 50 push eax
--------------------
021ff8e4 0045ca0c -> 1e 00 71 80 00 00 00 00 00 00 00 00 00 00 a0 ff ..q.............
021ff8e8 00000000
021ff8ec 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff8f0 00000000
021ff8f4 00000001
021ff8f8 00000000
021ff8fc 0045ca0c -> 1e 00 71 80 00 00 00 00 00 00 00 00 00 00 a0 ff ..q.............
021ff900 021ff92c -> 50 f9 1f 02 41 2b bd 7f f8 c9 45 00 00 00 00 00 P...A+....E.....
021ff904 7fbd2d28 = SHELL32.DLL:.text+0x1d28
--------------------
018f:7fbd2d13 85ff test edi,edi
018f:7fbd2d15 7cc4 jl 7fbd2cdb = SHELL32.DLL:.text+0x1cdb
018f:7fbd2d17 8b4518 mov eax,dword ptr [ebp+18]
018f:7fbd2d1a 53 push ebx
018f:7fbd2d1b ff7510 push dword ptr [ebp+10]
018f:7fbd2d1e 8b08 mov ecx,dword ptr [eax]
018f:7fbd2d20 ff750c push dword ptr [ebp+0c]
018f:7fbd2d23 56 push esi
018f:7fbd2d24 50 push eax
018f:7fbd2d25 ff5114 call dword ptr [ecx+14]
SHELL32.DLL:.text+0x1d28:
*018f:7fbd2d28 8bf8 mov edi,eax
018f:7fbd2d2a 8b4518 mov eax,dword ptr [ebp+18]
018f:7fbd2d2d 50 push eax
018f:7fbd2d2e 8b08 mov ecx,dword ptr [eax]
018f:7fbd2d30 ff5108 call dword ptr [ecx+08]
018f:7fbd2d33 eba6 jmp 7fbd2cdb = SHELL32.DLL:.text+0x1cdb
018f:7fbd2d35 ff7514 push dword ptr [ebp+14]
018f:7fbd2d38 e835f3ffff call 7fbd2072 = SHELL32.DLL!155
018f:7fbd2d3d eba2 jmp 7fbd2ce1 = SHELL32.DLL:.text+0x1ce1
018f:7fbd2d3f 55 push ebp
018f:7fbd2d40 8bec mov ebp,esp
--------------------
021ff908 0045ca64 -> 80 c9 bd 7f 70 c9 bd 7f 58 c9 bd 7f 50 44 39 38 ....p...X...PD98
021ff90c 0045ca0c -> 1e 00 71 80 00 00 00 00 00 00 00 00 00 00 a0 ff ..q.............
021ff910 00000000
021ff914 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff918 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff91c 00440bb8 -> d0 c9 bd 7f d8 28 bd 7f 01 00 00 00 84 04 54 00 .....(........T.
021ff920 00440bc8 -> 80 c9 bd 7f 70 c9 bd 7f 58 c9 bd 7f 50 44 39 38 ....p...X...PD98
021ff924 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff928 00440bb8 -> d0 c9 bd 7f d8 28 bd 7f 01 00 00 00 84 04 54 00 .....(........T.
021ff92c 021ff950 -> 7c f9 1f 02 28 2d bd 7f c8 0b 44 00 f8 c9 45 00 |...(-....D...E.
021ff930 7fbd2b41 = SHELL32.DLL:.text+0x1b41
--------------------
018f:7fbd2b25 e8a8ffffff call 7fbd2ad2 = SHELL32.DLL:.text+0x1ad2
018f:7fbd2b2a 85c0 test eax,eax
018f:7fbd2b2c 7419 jz 7fbd2b47 = SHELL32.DLL:.text+0x1b47
018f:7fbd2b2e 6a00 push +00
018f:7fbd2b30 8bcf mov ecx,edi
018f:7fbd2b32 ff7518 push dword ptr [ebp+18]
018f:7fbd2b35 ff7514 push dword ptr [ebp+14]
018f:7fbd2b38 ff7510 push dword ptr [ebp+10]
018f:7fbd2b3b 50 push eax
018f:7fbd2b3c e857010000 call 7fbd2c98 = SHELL32.DLL:.text+0x1c98
SHELL32.DLL:.text+0x1b41:
*018f:7fbd2b41 5f pop edi
018f:7fbd2b42 5e pop esi
018f:7fbd2b43 5d pop ebp
018f:7fbd2b44 c21400 retd 0014
018f:7fbd2b47 ff7518 push dword ptr [ebp+18]
018f:7fbd2b4a 8b4618 mov eax,dword ptr [esi+18]
018f:7fbd2b4d ff7514 push dword ptr [ebp+14]
018f:7fbd2b50 8b08 mov ecx,dword ptr [eax]
018f:7fbd2b52 ff7510 push dword ptr [ebp+10]
018f:7fbd2b55 ff750c push dword ptr [ebp+0c]
018f:7fbd2b58 50 push eax
--------------------
021ff934 0045c9f8 -> 14 00 2e 1e 20 20 ec 21 ea 3a 69 10 a2 dd 08 00 .... .!.:i.....
021ff938 00000000
021ff93c 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff940 0046becc -> 14 00 2e 1e 20 20 ec 21 ea 3a 69 10 a2 dd 08 00 .... .!.:i.....
021ff944 0045ca64 -> 80 c9 bd 7f 70 c9 bd 7f 58 c9 bd 7f 50 44 39 38 ....p...X...PD98
021ff948 00000000
021ff94c 0045c9f8 -> 14 00 2e 1e 20 20 ec 21 ea 3a 69 10 a2 dd 08 00 .... .!.:i.....
021ff950 021ff97c -> a0 f9 1f 02 41 2b bd 7f e4 c9 45 00 00 00 00 00 ....A+....E.....
021ff954 7fbd2d28 = SHELL32.DLL:.text+0x1d28
--------------------
018f:7fbd2d13 85ff test edi,edi
018f:7fbd2d15 7cc4 jl 7fbd2cdb = SHELL32.DLL:.text+0x1cdb
018f:7fbd2d17 8b4518 mov eax,dword ptr [ebp+18]
018f:7fbd2d1a 53 push ebx
018f:7fbd2d1b ff7510 push dword ptr [ebp+10]
018f:7fbd2d1e 8b08 mov ecx,dword ptr [eax]
018f:7fbd2d20 ff750c push dword ptr [ebp+0c]
018f:7fbd2d23 56 push esi
018f:7fbd2d24 50 push eax
018f:7fbd2d25 ff5114 call dword ptr [ecx+14]
SHELL32.DLL:.text+0x1d28:
*018f:7fbd2d28 8bf8 mov edi,eax
018f:7fbd2d2a 8b4518 mov eax,dword ptr [ebp+18]
018f:7fbd2d2d 50 push eax
018f:7fbd2d2e 8b08 mov ecx,dword ptr [eax]
018f:7fbd2d30 ff5108 call dword ptr [ecx+08]
018f:7fbd2d33 eba6 jmp 7fbd2cdb = SHELL32.DLL:.text+0x1cdb
018f:7fbd2d35 ff7514 push dword ptr [ebp+14]
018f:7fbd2d38 e835f3ffff call 7fbd2072 = SHELL32.DLL!155
018f:7fbd2d3d eba2 jmp 7fbd2ce1 = SHELL32.DLL:.text+0x1ce1
018f:7fbd2d3f 55 push ebp
018f:7fbd2d40 8bec mov ebp,esp
--------------------
021ff958 00440bc8 -> 80 c9 bd 7f 70 c9 bd 7f 58 c9 bd 7f 50 44 39 38 ....p...X...PD98
021ff95c 0045c9f8 -> 14 00 2e 1e 20 20 ec 21 ea 3a 69 10 a2 dd 08 00 .... .!.:i.....
021ff960 00000000
021ff964 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff968 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff96c 00540154 -> d0 c9 bd 7f d8 28 bd 7f 01 00 00 00 30 01 54 00 .....(......0.T.
021ff970 00540164 -> 80 c9 bd 7f 70 c9 bd 7f 58 c9 bd 7f 50 44 39 38 ....p...X...PD98
...
021ff978 00540154 -> d0 c9 bd 7f d8 28 bd 7f 01 00 00 00 30 01 54 00 .....(......0.T.
021ff97c 021ff9a0 -> c4 f9 1f 02 65 4b bd 7f 64 01 54 00 e4 c9 45 00 ....eK..d.T...E.
021ff980 7fbd2b41 = SHELL32.DLL:.text+0x1b41
--------------------
018f:7fbd2b25 e8a8ffffff call 7fbd2ad2 = SHELL32.DLL:.text+0x1ad2
018f:7fbd2b2a 85c0 test eax,eax
018f:7fbd2b2c 7419 jz 7fbd2b47 = SHELL32.DLL:.text+0x1b47
018f:7fbd2b2e 6a00 push +00
018f:7fbd2b30 8bcf mov ecx,edi
018f:7fbd2b32 ff7518 push dword ptr [ebp+18]
018f:7fbd2b35 ff7514 push dword ptr [ebp+14]
018f:7fbd2b38 ff7510 push dword ptr [ebp+10]
018f:7fbd2b3b 50 push eax
018f:7fbd2b3c e857010000 call 7fbd2c98 = SHELL32.DLL:.text+0x1c98
SHELL32.DLL:.text+0x1b41:
*018f:7fbd2b41 5f pop edi
018f:7fbd2b42 5e pop esi
018f:7fbd2b43 5d pop ebp
018f:7fbd2b44 c21400 retd 0014
018f:7fbd2b47 ff7518 push dword ptr [ebp+18]
018f:7fbd2b4a 8b4618 mov eax,dword ptr [esi+18]
018f:7fbd2b4d ff7514 push dword ptr [ebp+14]
018f:7fbd2b50 8b08 mov ecx,dword ptr [eax]
018f:7fbd2b52 ff7510 push dword ptr [ebp+10]
018f:7fbd2b55 ff750c push dword ptr [ebp+0c]
018f:7fbd2b58 50 push eax
--------------------
021ff984 0045c9e4 -> 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 ...P.O. .:i.....
021ff988 00000000
021ff98c 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff990 0044e464 -> 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 ...P.O. .:i.....
021ff994 00440bc8 -> 80 c9 bd 7f 70 c9 bd 7f 58 c9 bd 7f 50 44 39 38 ....p...X...PD98
021ff998 0044e210 -> 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 ...P.O. .:i.....
021ff99c 0045c9e4 -> 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 ...P.O. .:i.....
021ff9a0 021ff9c4 -> e4 f9 1f 02 e0 4b bd 7f 64 01 54 00 18 1f bd 7f .....K..d.T.....
021ff9a4 7fbd4b65 = SHELL32.DLL:.text+0x3b65
--------------------
018f:7fbd4b4e 7439 jz 7fbd4b89 = SHELL32.DLL:.text+0x3b89
018f:7fbd4b50 66833900 cmp word ptr [ecx],+00
018f:7fbd4b54 7433 jz 7fbd4b89 = SHELL32.DLL:.text+0x3b89
018f:7fbd4b56 ff7514 push dword ptr [ebp+14]
018f:7fbd4b59 8b10 mov edx,dword ptr [eax]
018f:7fbd4b5b ff750c push dword ptr [ebp+0c]
018f:7fbd4b5e 6a00 push +00
018f:7fbd4b60 51 push ecx
018f:7fbd4b61 50 push eax
018f:7fbd4b62 ff5214 call dword ptr [edx+14]
SHELL32.DLL:.text+0x3b65:
*018f:7fbd4b65 85db test ebx,ebx
018f:7fbd4b67 8bf0 mov esi,eax
018f:7fbd4b69 7406 jz 7fbd4b71 = SHELL32.DLL:.text+0x3b71
018f:7fbd4b6b 8b03 mov eax,dword ptr [ebx]
018f:7fbd4b6d 53 push ebx
018f:7fbd4b6e ff5008 call dword ptr [eax+08]
018f:7fbd4b71 85f6 test esi,esi
018f:7fbd4b73 7c0c jl 7fbd4b81 = SHELL32.DLL:.text+0x3b81
018f:7fbd4b75 8b4514 mov eax,dword ptr [ebp+14]
018f:7fbd4b78 833800 cmp dword ptr [eax],+00
018f:7fbd4b7b 0f84fb2e0f00 jz 7fcc7a7c = SHELL32.DLL:.text+0xf6a7c
--------------------
021ff9a8 00540164 -> 80 c9 bd 7f 70 c9 bd 7f 58 c9 bd 7f 50 44 39 38 ....p...X...PD98
021ff9ac 0045c9e4 -> 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 ...P.O. .:i.....
021ff9b0 00000000
021ff9b4 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff9b8 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff9bc 0045c9e4 -> 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 ...P.O. .:i.....
021ff9c0 00000001
021ff9c4 021ff9e4 -> 4c fb 1f 02 b7 4b bd 7f 00 00 00 00 10 e2 44 00 L....K........D.
021ff9c8 7fbd4be0 = SHELL32.DLL:.text+0x3be0
--------------------
018f:7fbd4bbf ff750c push dword ptr [ebp+0c]
018f:7fbd4bc2 e83c000000 call 7fbd4c03 = SHELL32.DLL:.text+0x3c03
018f:7fbd4bc7 8bf0 mov esi,eax
018f:7fbd4bc9 85f6 test esi,esi
018f:7fbd4bcb 0f84b52e0f00 jz 7fcc7a86 = SHELL32.DLL:.text+0xf6a86
018f:7fbd4bd1 ff7514 push dword ptr [ebp+14]
018f:7fbd4bd4 56 push esi
018f:7fbd4bd5 ff7510 push dword ptr [ebp+10]
018f:7fbd4bd8 ff7508 push dword ptr [ebp+08]
018f:7fbd4bdb e84affffff call 7fbd4b2a = SHELL32.DLL:.text+0x3b2a
SHELL32.DLL:.text+0x3be0:
*018f:7fbd4be0 56 push esi
018f:7fbd4be1 8bf8 mov edi,eax
018f:7fbd4be3 ff15a84abd7f call dword ptr [7fbd4aa8] -> SHELL32.DLL!155
018f:7fbd4be9 8b7518 mov esi,dword ptr [ebp+18]
018f:7fbd4bec 85f6 test esi,esi
018f:7fbd4bee 740b jz 7fbd4bfb = SHELL32.DLL:.text+0x3bfb
018f:7fbd4bf0 ff750c push dword ptr [ebp+0c]
018f:7fbd4bf3 ff15a44abd7f call dword ptr [7fbd4aa4] -> SHELL32.DLL!16
018f:7fbd4bf9 8906 mov dword ptr [esi],eax
018f:7fbd4bfb 8bc7 mov eax,edi
018f:7fbd4bfd 5f pop edi
--------------------
021ff9cc 00540164 -> 80 c9 bd 7f 70 c9 bd 7f 58 c9 bd 7f 50 44 39 38 ....p...X...PD98
021ff9d0 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff9d4 0045c9e4 -> 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 ...P.O. .:i.....
021ff9d8 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff9dc 0044e210 -> 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 ...P.O. .:i.....
021ff9e0 021ffe0c -> 00 00 00 00 28 00 00 00 63 69 f6 bf 00 b4 fb bf ....(...ci......
021ff9e4 021ffb4c -> b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 0c fe 1f 02 .....l....D.....
021ff9e8 7fbd4bb7 = SHELL32.DLL:.text+0x3bb7
--------------------
018f:7fbd4b98 b826bd7fc4 mov eax,c47fbd26
018f:7fbd4b9d 20bd7fff7424 and byte ptr [ebp+2474ff7f],bh
018f:7fbd4ba3 10ff adc bh,bh
018f:7fbd4ba5 7424 jz 7fbd4bcb = SHELL32.DLL:.text+0x3bcb
018f:7fbd4ba7 10ff adc bh,bh
018f:7fbd4ba9 7424 jz 7fbd4bcf = SHELL32.DLL:.text+0x3bcf
018f:7fbd4bab 10ff adc bh,bh
018f:7fbd4bad 7424 jz 7fbd4bd3 = SHELL32.DLL:.text+0x3bd3
018f:7fbd4baf 106a00 adc byte ptr [edx],ch
018f:7fbd4bb2 e803000000 call 7fbd4bba = SHELL32.DLL:.text+0x3bba
SHELL32.DLL:.text+0x3bb7:
*018f:7fbd4bb7 c21000 retd 0010
018f:7fbd4bba 55 push ebp
018f:7fbd4bbb 8bec mov ebp,esp
018f:7fbd4bbd 56 push esi
018f:7fbd4bbe 57 push edi
018f:7fbd4bbf ff750c push dword ptr [ebp+0c]
018f:7fbd4bc2 e83c000000 call 7fbd4c03 = SHELL32.DLL:.text+0x3c03
018f:7fbd4bc7 8bf0 mov esi,eax
018f:7fbd4bc9 85f6 test esi,esi
018f:7fbd4bcb 0f84b52e0f00 jz 7fcc7a86 = SHELL32.DLL:.text+0xf6a86
018f:7fbd4bd1 ff7514 push dword ptr [ebp+14]
--------------------
021ff9ec 00000000
021ff9f0 0044e210 -> 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 ...P.O. .:i.....
021ff9f4 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ff9f8 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ff9fc 021ffb54 -> 10 e2 44 00 0c fe 1f 02 09 4a 00 00 5c ae ab 83 ..D......J..\...
021ffa00 7fbd6d38 = SHELL32.DLL:.text+0x5d38
--------------------
018f:7fbd6d1d 6a01 push +01
018f:7fbd6d1f 5b pop ebx
018f:7fbd6d20 8d4508 lea eax,[ebp+08]
018f:7fbd6d23 50 push eax
018f:7fbd6d24 8d45fc lea eax,[ebp-04]
018f:7fbd6d27 50 push eax
018f:7fbd6d28 68181fbd7f push 7fbd1f18
018f:7fbd6d2d ff7508 push dword ptr [ebp+08]
018f:7fbd6d30 895df0 mov dword ptr [ebp-10],ebx
018f:7fbd6d33 e868deffff call 7fbd4ba0 = SHELL32.DLL:.text+0x3ba0
SHELL32.DLL:.text+0x5d38:
*018f:7fbd6d38 85c0 test eax,eax
018f:7fbd6d3a 0f8c84b50900 jl 7fc722c4 = SHELL32.DLL:.text+0xa12c4
018f:7fbd6d40 8b4510 mov eax,dword ptr [ebp+10]
018f:7fbd6d43 57 push edi
018f:7fbd6d44 2500080000 and eax,00000800
018f:7fbd6d49 56 push esi
018f:7fbd6d4a 8b750c mov esi,dword ptr [ebp+0c]
018f:7fbd6d4d 8945f8 mov dword ptr [ebp-08],eax
018f:7fbd6d50 7578 jnz 7fbd6dca = SHELL32.DLL:.text+0x5dca
018f:7fbd6d52 f6451110 test byte ptr [ebp+11],10
018f:7fbd6d56 0f85c8b30900 jnz 7fc72124 = SHELL32.DLL:.text+0xa1124
--------------------
021ffa04 0044e210 -> 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 ...P.O. .:i.....
021ffa08 7fbd1f18 = SHELL32.DLL:.text+0xf18
-> e6 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 ...............F
021ffa0c 021ffb48 -> 00 00 00 00 b4 fd 1f 02 86 6c bd 7f 10 e2 44 00 .........l....D.
021ffa10 021ffb54 -> 10 e2 44 00 0c fe 1f 02 09 4a 00 00 5c ae ab 83 ..D......J..\...
021ffa14 00004a09
021ffa18 00000000
...
021ffb3c 00000001
021ffb40 00000000
...
021ffb4c 021ffdb4 -> 8c ff 1f 02 73 36 e8 00 10 e2 44 00 00 00 00 00 ....s6....D.....
021ffb50 7fbd6c86 = SHELL32.DLL:.text+0x5c86
--------------------
018f:7fbd6c65 ff7508 push dword ptr [ebp+08]
018f:7fbd6c68 e88dfcffff call 7fbd68fa = SHELL32.DLL:.text+0x58fa
018f:7fbd6c6d 837d1800 cmp dword ptr [ebp+18],+00
018f:7fbd6c71 0f8468b60900 jz 7fc722df = SHELL32.DLL:.text+0xa12df
018f:7fbd6c77 f6c75f test bh,5f
018f:7fbd6c7a 740d jz 7fbd6c89 = SHELL32.DLL:.text+0x5c89
018f:7fbd6c7c 53 push ebx
018f:7fbd6c7d 56 push esi
018f:7fbd6c7e ff7518 push dword ptr [ebp+18]
018f:7fbd6c81 e88d000000 call 7fbd6d13 = SHELL32.DLL:.text+0x5d13
SHELL32.DLL:.text+0x5c86:
*018f:7fbd6c86 8945fc mov dword ptr [ebp-04],eax
018f:7fbd6c89 837d1000 cmp dword ptr [ebp+10],+00
018f:7fbd6c8d 7508 jnz 7fbd6c97 = SHELL32.DLL:.text+0x5c97
018f:7fbd6c8f ff7518 push dword ptr [ebp+18]
018f:7fbd6c92 e8dbb3ffff call 7fbd2072 = SHELL32.DLL!155
018f:7fbd6c97 8b45fc mov eax,dword ptr [ebp-04]
018f:7fbd6c9a 5f pop edi
018f:7fbd6c9b 5e pop esi
018f:7fbd6c9c 5b pop ebx
018f:7fbd6c9d c9 leave
018f:7fbd6c9e c21400 retd 0014
--------------------
021ffb54 0044e210 -> 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 ...P.O. .:i.....
021ffb58 021ffe0c -> 00 00 00 00 28 00 00 00 63 69 f6 bf 00 b4 fb bf ....(...ci......
021ffb5c 00004a09
021ffb60 83abae5c -> 07 00 01 00 90 8a 6f c1 b8 f3 1f 02 00 00 20 02 ......o....... .
021ffb64 00000008
021ffb68 81845b98 -> 06 00 19 00 80 f0 20 d6 00 00 00 00 00 00 00 00 ...... .........
021ffb6c 00000000
...
021ffc14 7ff37148 = OLE32.DLL:.text+0x16148
--------------------
018f:7ff3712c 57 push edi
018f:7ff3712d 33f6 xor esi,esi
018f:7ff3712f 39750c cmp dword ptr [ebp+0c],esi
018f:7ff37132 741d jz 7ff37151 = OLE32.DLL:.text+0x16151
018f:7ff37134 837d0c01 cmp dword ptr [ebp+0c],+01
018f:7ff37138 747d jz 7ff371b7 = OLE32.DLL:.text+0x161b7
018f:7ff3713a ff7510 push dword ptr [ebp+10]
018f:7ff3713d ff750c push dword ptr [ebp+0c]
018f:7ff37140 ff7508 push dword ptr [ebp+08]
018f:7ff37143 e808010000 call 7ff37250 = OLE32.DLL:.text+0x16250
OLE32.DLL:.text+0x16148:
*018f:7ff37148 5f pop edi
018f:7ff37149 5e pop esi
018f:7ff3714a 5b pop ebx
018f:7ff3714b 8be5 mov esp,ebp
018f:7ff3714d 5d pop ebp
018f:7ff3714e c20c00 retd 000c
018f:7ff37151 393508f1fc7f cmp dword ptr [7ffcf108],esi
018f:7ff37157 0f859ceb0200 jnz 7ff65cf9 = OLE32.DLL:.text+0x44cf9
018f:7ff3715d ff7510 push dword ptr [ebp+10]
018f:7ff37160 ff750c push dword ptr [ebp+0c]
018f:7ff37163 ff7508 push dword ptr [ebp+08]
--------------------
021ffc18 7ff20000 = OLE32.DLL+0x0
-> 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
021ffc1c 00000000
021ffc20 00000197
021ffc24 021ffc40 -> 58 fc 1f 02 89 b9 f6 bf 98 5b 84 81 cf 41 f6 bf X........[...A..
021ffc28 bff6b8dc = KERNEL32.DLL:.text+0x28dc
--------------------
018f:bff6b8b4 36b8f6bf3eb8 ?mov eax,b83ebff6
018f:bff6b8ba f6bf55a120bd idiv byte ptr [edi+bd20a155]
018f:bff6b8c0 fb sti
018f:bff6b8c1 bf8bec5650 mov edi,5056ec8b
018f:bff6b8c6 e8c188ffff call bff6418c = KERNEL32.DLL!97
018f:bff6b8cb ff7514 push dword ptr [ebp+14]
018f:bff6b8ce ff7510 push dword ptr [ebp+10]
018f:bff6b8d1 ff750c push dword ptr [ebp+0c]
018f:bff6b8d4 ff7508 push dword ptr [ebp+08]
018f:bff6b8d7 e890fdffff call bff6b66c = KERNEL32.DLL:.text+0x266c
KERNEL32.DLL:.text+0x28dc:
*018f:bff6b8dc 8bf0 mov esi,eax
018f:bff6b8de 85f6 test esi,esi
018f:bff6b8e0 740a jz bff6b8ec = KERNEL32.DLL:.text+0x28ec
018f:bff6b8e2 f6451380 test byte ptr [ebp+13],80
018f:bff6b8e6 7404 jz bff6b8ec = KERNEL32.DLL:.text+0x28ec
018f:bff6b8e8 66ff4602 inc word ptr [esi+02]
018f:bff6b8ec a120bdfbbf mov eax,dword ptr [bffbbd20]
018f:bff6b8f1 50 push eax
018f:bff6b8f2 e8ce88ffff call bff641c5 = KERNEL32.DLL!98
018f:bff6b8f7 8bc6 mov eax,esi
018f:bff6b8f9 5e pop esi
--------------------
021ffc2c bff641cf = KERNEL32.DLL:_FREQASM+0x31cf
--------------------
018f:bff641b5 51 push ecx
018f:bff641b6 52 push edx
018f:bff641b7 681d002a00 push 002a001d
018f:bff641bc e813d2ffff call bff613d4 = KERNEL32.DLL!1
018f:bff641c1 59 pop ecx
018f:bff641c2 5a pop edx
018f:bff641c3 ebe8 jmp bff641ad = KERNEL32.DLL:_FREQASM+0x31ad
018f:bff641c5 8b542404 mov edx,dword ptr [esp+04]
018f:bff641c9 50 push eax
018f:bff641ca e804000000 call bff641d3 = KERNEL32.DLL:_FREQASM+0x31d3
KERNEL32.DLL:_FREQASM+0x31cf:
*018f:bff641cf 58 pop eax
018f:bff641d0 c20400 retd 0004
018f:bff641d3 833dfcbcfbbf01 cmp dword ptr [bffbbcfc],+01
018f:bff641da 7c32 jl bff6420e = KERNEL32.DLL:_FREQASM+0x320e
018f:bff641dc 3b1570b4fbbf cmp edx,dword ptr [bffbb470]
018f:bff641e2 7506 jnz bff641ea = KERNEL32.DLL:_FREQASM+0x31ea
018f:bff641e4 837a0401 cmp dword ptr [edx+04],+01
018f:bff641e8 7426 jz bff64210 = KERNEL32.DLL:_FREQASM+0x3210
018f:bff641ea ff4a04 dec dword ptr [edx+04]
018f:bff641ed 754a jnz bff64239 = KERNEL32.DLL:_FREQASM+0x3239
018f:bff641ef c7420800000000 mov dword ptr [edx+08],00000000
--------------------
021ffc30 bffbb490 = KERNEL32.DLL:.data+0x490
-> 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
021ffc34 bff6b8f7 = KERNEL32.DLL:.text+0x28f7
--------------------
018f:bff6b8d7 e890fdffff call bff6b66c = KERNEL32.DLL:.text+0x266c
018f:bff6b8dc 8bf0 mov esi,eax
018f:bff6b8de 85f6 test esi,esi
018f:bff6b8e0 740a jz bff6b8ec = KERNEL32.DLL:.text+0x28ec
018f:bff6b8e2 f6451380 test byte ptr [ebp+13],80
018f:bff6b8e6 7404 jz bff6b8ec = KERNEL32.DLL:.text+0x28ec
018f:bff6b8e8 66ff4602 inc word ptr [esi+02]
018f:bff6b8ec a120bdfbbf mov eax,dword ptr [bffbbd20]
018f:bff6b8f1 50 push eax
018f:bff6b8f2 e8ce88ffff call bff641c5 = KERNEL32.DLL!98
KERNEL32.DLL:.text+0x28f7:
*018f:bff6b8f7 8bc6 mov eax,esi
018f:bff6b8f9 5e pop esi
018f:bff6b8fa 5d pop ebp
018f:bff6b8fb c21000 retd 0010
018f:bff6b8fe 55 push ebp
018f:bff6b8ff 8bec mov ebp,esp
018f:bff6b901 53 push ebx
018f:bff6b902 56 push esi
018f:bff6b903 57 push edi
018f:bff6b904 33ff xor edi,edi
018f:bff6b906 837d1801 cmp dword ptr [ebp+18],+01
--------------------
021ffc38 bffbb490 = KERNEL32.DLL:.data+0x490
-> 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
021ffc3c 00000197
021ffc40 021ffc58 -> 01 00 00 00 01 00 00 00 b0 82 23 d6 7c fc 1f 02 ..........#.|...
021ffc44 bff6b989 = KERNEL32.DLL:.text+0x2989
--------------------
018f:bff6b96c 5b pop ebx
018f:bff6b96d c20800 retd 0008
018f:bff6b970 55 push ebp
018f:bff6b971 a1f4bcfbbf mov eax,dword ptr [bffbbcf4]
018f:bff6b976 8bec mov ebp,esp
018f:bff6b978 ff742410 push dword ptr [esp+10]
018f:bff6b97c ff750c push dword ptr [ebp+0c]
018f:bff6b97f ff7508 push dword ptr [ebp+08]
018f:bff6b982 ff30 push dword ptr [eax]
018f:bff6b984 e833ffffff call bff6b8bc = KERNEL32.DLL:.text+0x28bc
KERNEL32.DLL:.text+0x2989:
*018f:bff6b989 5d pop ebp
018f:bff6b98a c20c00 retd 000c
018f:bff6b98d 55 push ebp
018f:bff6b98e 8bec mov ebp,esp
018f:bff6b990 50 push eax
018f:bff6b991 a120bdfbbf mov eax,dword ptr [bffbbd20]
018f:bff6b996 50 push eax
018f:bff6b997 e8f087ffff call bff6418c = KERNEL32.DLL!97
018f:bff6b99c ff7508 push dword ptr [ebp+08]
018f:bff6b99f e8d1fdffff call bff6b775 = KERNEL32.DLL:.text+0x2775
018f:bff6b9a4 a120bdfbbf mov eax,dword ptr [bffbbd20]
--------------------
021ffc48 81845b98 -> 06 00 19 00 80 f0 20 d6 00 00 00 00 00 00 00 00 ...... .........
021ffc4c bff641cf = KERNEL32.DLL:_FREQASM+0x31cf
--------------------
018f:bff641b5 51 push ecx
018f:bff641b6 52 push edx
018f:bff641b7 681d002a00 push 002a001d
018f:bff641bc e813d2ffff call bff613d4 = KERNEL32.DLL!1
018f:bff641c1 59 pop ecx
018f:bff641c2 5a pop edx
018f:bff641c3 ebe8 jmp bff641ad = KERNEL32.DLL:_FREQASM+0x31ad
018f:bff641c5 8b542404 mov edx,dword ptr [esp+04]
018f:bff641c9 50 push eax
018f:bff641ca e804000000 call bff641d3 = KERNEL32.DLL:_FREQASM+0x31d3
KERNEL32.DLL:_FREQASM+0x31cf:
*018f:bff641cf 58 pop eax
018f:bff641d0 c20400 retd 0004
018f:bff641d3 833dfcbcfbbf01