Disassembly of File: C:\Documents and Settings\Desktop\New Folder\SFPDLL.DLL Code Offset = 00001000, Code Size = 0001A000 Data Offset = 0001B000, Data Size = 00004000 Number of Objects = 0004 (dec), Imagebase = 760E0000h Object01: .text RVA: 00001000 Offset: 00001000 Size: 0001A000 Flags: 60000020 Object02: .data RVA: 0001B000 Offset: 0001B000 Size: 00004000 Flags: C0000040 Object03: .rsrc RVA: 0001F000 Offset: 0001F000 Size: 00001000 Flags: 40000040 Object04: .reloc RVA: 00020000 Offset: 00020000 Size: 00002000 Flags: 42000040 +++++++++++++++++++ MENU INFORMATION ++++++++++++++++++ There Are No Menu Resources in This Application +++++++++++++++++ DIALOG INFORMATION ++++++++++++++++++ There Are No Dialog Resources in This Application +++++++++++++++++++ IMPORTED FUNCTIONS ++++++++++++++++++ Number of Imported Modules = 13 (decimal) Import Module 001: MSVCRT.DLL Import Module 002: OLEAUT32.DLL Import Module 003: OLE32.DLL Import Module 004: VERSION.DLL Import Module 005: WINTRUST.DLL Import Module 006: RPCRT4.DLL Import Module 007: SMGR.DLL Import Module 008: ATRACE.DLL Import Module 009: KERNEL32.DLL Import Module 010: USER32.DLL Import Module 011: ADVAPI32.DLL Import Module 012: SHELL32.DLL Import Module 013: CRYPT32.DLL +++++++++++++++++++ IMPORT MODULE DETAILS +++++++++++++++ Import Module 001: MSVCRT.DLL Addr:77F986F1 hint(01E9) Name: _wcslwr Addr:77F74446 hint(0183) Name: _onexit Addr:77F72131 hint(0055) Name: __dllonexit Addr:77FABB70 hint(009B) Name: _adjust_fdiv Addr:77F71000 hint(028E) Name: malloc Addr:77F71DEA hint(010C) Name: _initterm Addr:77F710ED hint(025B) Name: free Addr:77F730B5 hint(0295) Name: memmove Addr:77F721EE hint(000F) Name: ??2@YAPAXI@Z Addr:77F98CEE hint(02C4) Name: strtok Addr:77F98C89 hint(02C0) Name: strrchr Addr:77F8270C hint(01BC) Name: _strdup Addr:77F953CA hint(02AF) Name: sprintf Addr:77F82961 hint(01BE) Name: _stricmp Addr:77F82188 hint(0249) Name: fclose Addr:77F92AA9 hint(0254) Name: fopen Addr:77F7231A hint(02BE) Name: strncpy Addr:77F95147 hint(029B) Name: printf Addr:77F86847 hint(02C6) Name: strtoul Addr:77F7142A hint(0270) Name: isdigit Addr:77F712EF hint(02E3) Name: wcslen Addr:77F7C7D0 hint(023A) Name: atoi Addr:77F744D7 hint(02AA) Name: setlocale Addr:77F7F56A hint(00C7) Name: _except_handler3 Addr:77F7F4C8 hint(0139) Name: _local_unwind2 Addr:77F712B8 hint(02DE) Name: wcscmp Addr:77F815FB hint(0255) Name: fprintf Addr:77F7B20C hint(000E) Name: ??1type_info@@UAE@XZ Addr:77F827CE hint(02B4) Name: strchr Addr:77F71F56 hint(0010) Name: ??3@YAXPAX@Z Addr:77F7ADBB hint(0041) Name: _CxxThrowException Import Module 002: OLEAUT32.DLL Addr:7FE81845 hint(000C) Name: VariantChangeType Addr:7FE81444 hint(0002) Name: SysAllocString Addr:7FE81485 hint(0004) Name: SysAllocStringLen Addr:7FE83F48 hint(0007) Name: SysStringLen Addr:7FE8155F hint(0006) Name: SysFreeString Addr:7FE81705 hint(0008) Name: VariantInit Addr:7FE81834 hint(0095) Name: SysStringByteLen Addr:7FE83CB3 hint(0096) Name: SysAllocStringByteLen Addr:7FE8162B hint(0009) Name: VariantClear Import Module 003: OLE32.DLL Addr:7FF3432D hint(000F) Name: CoCreateInstance Addr:7FF59ADC hint(0059) Name: CoUninitialize Addr:7FF44C08 hint(0031) Name: CoInitialize Import Module 004: VERSION.DLL Addr:BFE5152F hint(0000) Name: GetFileVersionInfoA Addr:BFE51494 hint(0001) Name: GetFileVersionInfoSizeA Addr:BFE51267 hint(000A) Name: VerQueryValueA Import Module 005: WINTRUST.DLL Addr:741E9084 hint(0002) Name: CryptCATAdminAcquireContext Addr:741E929D hint(0007) Name: CryptCATAdminReleaseContext Addr:741E9369 hint(0004) Name: CryptCATAdminCalcHashFromFileHandle Addr:741E9585 hint(0006) Name: CryptCATAdminReleaseCatalogContext Addr:741E95BF hint(0005) Name: CryptCATAdminEnumCatalogFromHash Addr:741E97F1 hint(0010) Name: CryptCATCatalogInfoFromContext Addr:741DC249 hint(0054) Name: WTHelperProvDataFromStateData Addr:741E9827 hint(0003) Name: CryptCATAdminAddCatalog Addr:741E79C6 hint(0011) Name: CryptCATClose Addr:741DB492 hint(006B) Name: WinVerifyTrust Addr:741E7901 hint(0019) Name: CryptCATOpen Addr:741E7B16 hint(0016) Name: CryptCATGetCatAttrInfo Addr:741E81F6 hint(0014) Name: CryptCATEnumerateMember Addr:741E827D hint(0012) Name: CryptCATEnumerateAttr Addr:741DBDEF hint(004F) Name: WTHelperGetProvCertFromChain Addr:741DBDAF hint(0051) Name: WTHelperGetProvSignerFromChain Import Module 006: RPCRT4.DLL Addr:7FAB371C hint(00EF) Name: NdrPointerUnmarshall Addr:7FAB9D0E hint(018F) Name: RpcServerUseProtseqEpA Addr:7FAB4521 hint(0087) Name: NdrComplexStructMarshall Addr:7FABA8FE hint(008F) Name: NdrConformantStringBufferSize Addr:7FABF60E hint(00A4) Name: NdrConvert Addr:7FAC01CE hint(0182) Name: RpcServerListen Addr:7FAC0A0E hint(0185) Name: RpcServerRegisterIf Addr:7FABA31C hint(0189) Name: RpcServerUnregisterIf Addr:7FAC2172 hint(016D) Name: RpcMgmtStopServerListening Addr:7FAB66A2 hint(017A) Name: RpcRaiseException Addr:7FAB1FE9 hint(002D) Name: I_RpcGetBuffer Addr:7FABAA9A hint(0092) Name: NdrConformantStringUnmarshall Addr:7FABF6D1 hint(0106) Name: NdrServerInitializeNew Addr:7FAB396F hint(010D) Name: NdrSimpleStructMarshall Addr:7FAB7243 hint(010B) Name: NdrSimpleStructBufferSize Addr:7FAB39C9 hint(010F) Name: NdrSimpleStructUnmarshall Addr:7FAB3490 hint(00EC) Name: NdrPointerFree Addr:7FABA9AD hint(0090) Name: NdrConformantStringMarshall Addr:7FAB4355 hint(0085) Name: NdrComplexStructBufferSize Import Module 007: SMGR.DLL Addr:75CAF57D hint(0040) Name: _SRSetRestorePointS@8 Addr:75CB0CFC hint(002E) Name: _GetStateMgrDiskMaxS@0 Addr:75CAF7B4 hint(0022) Name: _DisableSRS@4 Addr:75CAF7AE hint(0038) Name: _IsSREnabledS@0 Addr:75CAFB4D hint(003F) Name: _SRDisableSfp@4 Addr:75CB0D4B hint(0042) Name: _SetStateMgrDiskMaxS@4 Addr:75C97EF1 hint(0024) Name: _EnableFIFOS@0 Addr:75CB027D hint(0021) Name: _DisableFIFOS@8 Import Module 008: ATRACE.DLL Addr:7E4A16A3 hint(0006) Name: _SetAsyncTraceParams@16 Addr:7E4A7350 hint(0008) Name: __dwEnabledTraces Addr:7E4A17B6 hint(0001) Name: _AsyncStringTrace@12 Import Module 009: KERNEL32.DLL Addr:BFF7409E hint(02DE) Name: UnmapViewOfFile Addr:BFF67011 hint(023D) Name: ReadFile Addr:BFF67347 hint(0326) Name: lstrcatA Addr:BFF91A23 hint(028D) Name: SetEnvironmentVariableA Addr:BFF7558E hint(012D) Name: GetLastError Addr:BFF8306C hint(0290) Name: SetEvent Addr:BFF6791A hint(0170) Name: GetSystemDirectoryA Addr:BFF91954 hint(0132) Name: GetLogicalDriveStringsA Addr:BFF678EF hint(0117) Name: GetDriveTypeA Addr:BFF67950 hint(0197) Name: GetWindowsDirectoryA Addr:BFF66FA9 hint(030E) Name: WriteFile Addr:BFF67B91 hint(00AC) Name: FindNextFileA Addr:BFF64339 hint(01C8) Name: InterlockedDecrement Addr:BFF67B08 hint(0120) Name: GetFileAttributesA Addr:BFF860B0 hint(0064) Name: DisableThreadLibraryCalls Addr:BFF66F3E hint(004D) Name: CreateThread Addr:BFF6C90D hint(02FB) Name: WaitForMultipleObjects Addr:BFF67113 hint(0295) Name: SetFilePointer Addr:BFF8CDE8 hint(028C) Name: SetEndOfFile Addr:BFF66F89 hint(0125) Name: GetFileSize Addr:BFF67672 hint(0038) Name: CreateFileMappingA Addr:BFF72231 hint(01F5) Name: MapViewOfFile Addr:BFF91337 hint(0135) Name: GetLongPathNameA Addr:BFF66E9C hint(01B4) Name: HeapAlloc Addr:BFF6488C hint(01E5) Name: LocalAlloc Addr:BFF649A8 hint(01E9) Name: LocalFree Addr:BFF7CF67 hint(0155) Name: GetProcessHeap Addr:BFF66EE8 hint(01BA) Name: HeapFree Addr:BFF6742C hint(0336) Name: lstrlenW Addr:BFF672D0 hint(032F) Name: lstrcpyA Addr:BFF67DA1 hint(0301) Name: WideCharToMultiByte Addr:BFF831E5 hint(02C3) Name: Sleep Addr:BFF66E7B hint(01B8) Name: HeapDestroy Addr:BFF79063 hint(01B6) Name: HeapCreate Addr:BFF6730A hint(0332) Name: lstrcpynA Addr:BFF671AC hint(012F) Name: GetLocalTime Addr:BFF675C5 hint(004A) Name: CreateSemaphoreA Addr:BFF66F68 hint(024A) Name: ReleaseSemaphore Addr:BFF74606 hint(01C5) Name: InitializeCriticalSection Addr:BFF67568 hint(0034) Name: CreateEventA Addr:BFF7B07B hint(005A) Name: DeleteCriticalSection Addr:BFF6E1F6 hint(001E) Name: CloseHandle Addr:BFF6CA1E hint(02FD) Name: WaitForSingleObject Addr:BFF6BB13 hint(01DE) Name: LeaveCriticalSection Addr:BFF6BAEE hint(006F) Name: EnterCriticalSection Addr:BFF6789B hint(0313) Name: WritePrivateProfileStringA Addr:BFF92068 hint(002B) Name: CopyFileA Addr:BFF67D83 hint(0202) Name: MultiByteToWideChar Addr:BFF67F3F hint(0030) Name: CreateDirectoryA Addr:BFF67381 hint(0335) Name: lstrlenA Addr:BFF67296 hint(032C) Name: lstrcmpiA Addr:BFF6759E hint(0208) Name: OpenEventA Addr:BFF81ACA hint(018F) Name: GetVersionExA Addr:BFF6725C hint(0329) Name: lstrcmpA Addr:BFF67B2F hint(00A3) Name: FindFirstFileA Addr:BFF67AE8 hint(0293) Name: SetFileAttributesA Addr:BFF92041 hint(005C) Name: DeleteFileA Addr:BFF91A4B hint(008F) Name: ExpandEnvironmentStringsA Addr:BFF7E559 hint(00C3) Name: FreeLibrary Addr:BFF676A8 hint(01DF) Name: LoadLibraryA Addr:BFF67AB3 hint(0037) Name: CreateFileA Addr:BFF66498 hint(009F) Name: FindClose Import Module 010: USER32.DLL Addr:BFF4541A hint(0149) Name: GetSystemMetrics Addr:BFF42FEF hint(0095) Name: DialogBoxParamA Addr:BFF449DD hint(002F) Name: CharUpperA Addr:BFF44146 hint(01C3) Name: MessageBoxA Addr:BFF4232C hint(00D5) Name: ExitWindowsEx Addr:BFF41BA9 hint(00BB) Name: EndDialog Addr:BFF456B5 hint(02B3) Name: wsprintfA Import Module 011: ADVAPI32.DLL Addr:BFE6161A hint(01B2) Name: RegSetValueExA Addr:BFE61674 hint(0184) Name: RegCloseKey Addr:BFE61564 hint(01A7) Name: RegQueryValueExA Addr:BFE619DA hint(019C) Name: RegOpenKeyA Addr:BFE616AD hint(0188) Name: RegCreateKeyExA Addr:BFE61501 hint(019D) Name: RegOpenKeyExA Addr:BFE613A6 hint(018D) Name: RegDeleteValueA Addr:BFE6185B hint(0191) Name: RegEnumKeyExA Addr:BFE613E7 hint(0194) Name: RegEnumValueA Addr:BFE617B7 hint(018B) Name: RegDeleteKeyA Import Module 012: SHELL32.DLL Addr:7FBD91F0 hint(0062) Name: SHGetSpecialFolderPathA Import Module 013: CRYPT32.DLL Addr:7DAA0B21 hint(0041) Name: CertGetEnhancedKeyUsage Addr:7DAA2A9D hint(0092) Name: CryptHashPublicKeyInfo +++++++++++++++++++ EXPORTED FUNCTIONS ++++++++++++++++++ Number of Exported Functions = 0036 (decimal) Addr:760E1830 Ord: 1 (0001h) Name: ??0CReadWriteLock@@QAE@XZ Addr:760EB049 Ord: 2 (0002h) Name: ??0CScopeRWLock@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z Addr:760EAFFE Ord: 3 (0003h) Name: ??0CScopeRWLock@@QAE@PAVCReadWriteLock@@W4RWLOCK_MODE@@@Z Addr:760E1670 Ord: 4 (0004h) Name: ??1CReadWriteLock@@QAE@XZ Addr:760EB067 Ord: 5 (0005h) Name: ??1CScopeRWLock@@QAE@XZ Addr:760EAFEA Ord: 6 (0006h) Name: ??4CReadWriteLock@@QAEAAV0@ABV0@@Z Addr:760EB0AE Ord: 7 (0007h) Name: ??4CScopeRWLock@@QAEAAV0@ABV0@@Z Addr:760EAF47 Ord: 8 (0008h) Name: ?FInit@CReadWriteLock@@QAEHXZ Addr:760EAF8B Ord: 9 (0009h) Name: ?LockCSUnderRead@CReadWriteLock@@QAEXXZ Addr:760EAF4A Ord: 10 (000Ah) Name: ?LockReadMode@CReadWriteLock@@QAEXXZ Addr:760E2147 Ord: 11 (000Bh) Name: ?LockReadModeEx@CReadWriteLock@@QAEHH@Z Addr:760EAFA1 Ord: 12 (000Ch) Name: ?LockWriteMode@CReadWriteLock@@QAEXXZ Addr:760E2848 Ord: 13 (000Dh) Name: ?LockWriteModeEx@CReadWriteLock@@QAEHH@Z Addr:760EAF44 Ord: 14 (000Eh) Name: ?PrwLock@CReadWriteLock@@QAEPAV1@XZ Addr:760EC8B9 Ord: 15 (000Fh) Name: SFPCopyCatalog Addr:760E33D4 Ord: 16 (0010h) Name: SFPInit Addr:760EB527 Ord: 17 (0011h) Name: SFPProcessFileChanges Addr:760E2518 Ord: 18 (0012h) Name: SfpRebootIfNecessary Addr:760ECD79 Ord: 19 (0013h) Name: SfpShutDown Addr:760EAF96 Ord: 20 (0014h) Name: ?UnlockCSUnderRead@CReadWriteLock@@QAEXXZ Addr:760E2310 Ord: 21 (0015h) Name: ?UnlockReadMode@CReadWriteLock@@QAEXXZ Addr:760EAFCE Ord: 22 (0016h) Name: ?UnlockWriteMode@CReadWriteLock@@QAEXXZ Addr:760FB000 Ord: 23 (0017h) Name: objSfpDb Addr:760EBFCD Ord: 24 (0018h) Name: DisableSFPS Addr:760EC5E3 Ord: 25 (0019h) Name: SRUpdateMonitoredListS Addr:760EDC80 Ord: 26 (001Ah) Name: SfpCleanupSfpDb Addr:760E3163 Ord: 27 (001Bh) Name: SfpCreateSfpDb Addr:760EF389 Ord: 28 (001Ch) Name: SfpDeleteCatalogS Addr:760EDE17 Ord: 29 (001Dh) Name: SfpGetCorrectVersionOfFile Addr:760EE6A3 Ord: 30 (001Eh) Name: SfpGetNextProtectedFileS Addr:760EED5E Ord: 31 (001Fh) Name: SfpInstallCatalogS Addr:760E1D46 Ord: 32 (0020h) Name: SfpIsFileProtectedS Addr:760E2081 Ord: 33 (0021h) Name: SfpPersistSfpDb Addr:760EE066 Ord: 34 (0022h) Name: SfpRestoreCorrectVersionOfFile Addr:760E3AE4 Ord: 35 (0023h) Name: SfpSyncDb Addr:760ED4FB Ord: 36 (0024h) Name: SfpVerifyFileS +++++++++++++++++++ ASSEMBLY CODE LISTING ++++++++++++++++++ //********************** Start of Code in Object .text ************** Program Entry Point = 760E138C (C:\Documents and Settings\Desktop\New Folder\SFPDLL.DLL File Offset:0001C38C) :760E1000 F1 BYTE 0f1h :760E1001 86F9 xchg cl, bh :760E1003 7746 ja 760E104B :760E1005 44 inc esp :760E1006 F77731 div [edi+31] :760E1009 21F7 and edi, esi :760E100B 7770 ja 760E107D :760E100D BBFA770010 mov ebx, 100077FA :760E1012 F777EA div [edi-16] :760E1015 1DF777ED10 sbb eax, 10ED77F7 :760E101A F777B5 div [edi-4B] :760E101D 30F7 xor bh, dh :760E101F 77EE ja 760E100F :760E1021 21F7 and edi, esi :760E1023 77EE ja 760E1013 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1053(C) | :760E1025 8CF9 mov cx, xx :760E1027 7789 ja 760E0FB2 :760E1029 8CF9 mov cx, xx :760E102B 770C ja 760E1039 :760E102D 27 daa :760E102E F8 clc :760E102F 77CA ja 760E0FFB :760E1031 53 push ebx :760E1032 F9 stc :760E1033 7761 ja 760E1096 :760E1035 29F8 sub eax, edi :760E1037 7788 ja 760E0FC1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E102B(C) | :760E1039 21F8 and eax, edi :760E103B 77A9 ja 760E0FE6 :760E103D 2AF9 sub bh, cl :760E103F 771A ja 760E105B :760E1041 23F7 and esi, edi :760E1043 7747 ja 760E108C :760E1045 51 push ecx :760E1046 F9 stc :760E1047 7747 ja 760E1090 :760E1049 68F8772A14 push 142A77F8 :760E104E F777EF div [edi-11] :760E1051 12F7 adc dh, bh :760E1053 77D0 ja 760E1025 :760E1055 C7F777D744F7 mov edi, F744D777 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E103F(C) | :760E105B 776A ja 760E10C7 :760E105D F5 cmc :760E105E F777C8 div [edi-38] :760E1061 F4 hlt :760E1062 F777B8 div [edi-48] :760E1065 12F7 adc dh, bh :760E1067 77FB ja 760E1064 :760E1069 15F8770CB2 adc eax, B20C77F8 :760E106E F777CE div [edi-32] :760E1071 27 daa :760E1072 F8 clc :760E1073 7756 ja 760E10CB :760E1075 1F pop ds :760E1076 F777BB div [edi-45] :760E1079 AD lodsd :760E107A F77700 div [edi+00] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E100B(C) | :760E107D 000000 BYTE 3 DUP(0) :760E1080 45 inc ebp :760E1081 18E8 sbb al, ch :760E1083 7F44 jg 760E10C9 :760E1085 14E8 adc al, E8 :760E1087 7F85 jg 760E100E :760E1089 14E8 adc al, E8 :760E108B 7F48 jg 760E10D5 :760E108D 3F aas :760E108E E87F5F15E8 call 5E237012 :760E1093 7F05 jg 760E109A :760E1095 17 pop ss * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1033(C) | :760E1096 E87F3418E8 call 5E26451A :760E109B 7FB3 jg 760E1050 :760E109D 3CE8 cmp al, E8 :760E109F 7F2B jg 760E10CC :760E10A1 16 push ss :760E10A2 E87F000000 call 760E1126 :760E10A7 002D43F37FDC add byte ptr [DC7FF343], ch :760E10AD 9AF57F084CF47F call 7FF4:4C087FF5 :760E10B4 00000000 BYTE 4 DUP(0) :760E10B8 2F das :760E10B9 15E5BF9414 adc eax, 1494BFE5 :760E10BE E5BF in ax, BF :760E10C0 6712E5 adc ah, ch :760E10C3 BF00000000 mov edi, 00000000 :760E10C8 84901E749D92 test byte ptr [eax+929D741E], dl :760E10CE 1E push ds :760E10CF 7469 je 760E113A :760E10D1 93 xchg eax,ebx :760E10D2 1E push ds * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E112F(C), :760E1137(C) | :760E10D3 7485 je 760E105A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E108B(C) | :760E10D5 95 xchg eax,ebp :760E10D6 1E push ds :760E10D7 74BF je 760E1098 :760E10D9 95 xchg eax,ebp :760E10DA 1E push ds :760E10DB 74F1 je 760E10CE :760E10DD 97 xchg eax,edi :760E10DE 1E push ds :760E10DF 7449 je 760E112A :760E10E1 C21D74 ret 741D :760E10E4 27 daa :760E10E5 98 cwde :760E10E6 1E push ds :760E10E7 74C6 je 760E10AF :760E10E9 791E jns 760E1109 :760E10EB 7492 je 760E107F :760E10ED B41D mov ah, 1D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E10F7(C) | :760E10EF 7401 je 760E10F2 :760E10F1 791E jns 760E1111 :760E10F3 7416 je 760E110B :760E10F5 7B1E jpo 760E1115 :760E10F7 74F6 je 760E10EF :760E10F9 811E747D821E sbb dword ptr [esi], 1E827D74 :760E10FF 74EF je 760E10F0 :760E1101 BD1D74AFBD mov ebp, BDAF741D :760E1106 1D74000000 sbb eax, 00000074 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E10F3(C) | :760E110B 001C37 add byte ptr [edi+esi], bl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E113B(C) | :760E110E AB stosd :760E110F 7F0E jg 760E111F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E10F1(C) | :760E1111 9D popfd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1147(C) | :760E1112 AB stosd :760E1113 7F21 jg 760E1136 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E10F5(C) | :760E1115 45 inc ebp :760E1116 AB stosd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1117(C) | :760E1117 7FFE jg 760E1117 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1163(C) | :760E1119 A8AB test al, AB :760E111B 7F0E jg 760E112B :760E111D F6AB7FCE01AC imul byte ptr [ebx+AC01CE7F] :760E1123 7F0E jg 760E1133 :760E1125 0A BYTE 0ah * Referenced by a CALL at Address: |:760E10A2 | :760E1126 AC lodsb :760E1127 7F1C jg 760E1145 :760E1129 A3AB7F7221 mov dword ptr [21727FAB], eax :760E112E AC lodsb :760E112F 7FA2 jg 760E10D3 :760E1131 66AB stosw * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1123(C) | :760E1133 7FE9 jg 760E111E :760E1135 1F pop ds * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1113(C) | :760E1136 AB stosd :760E1137 7F9A jg 760E10D3 :760E1139 AA stosb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E10CF(C) | :760E113A AB stosd :760E113B 7FD1 jg 760E110E :760E113D F6AB7F6F39AB imul byte ptr [ebx+AB396F7F] :760E1143 7F43 jg 760E1188 :760E1145 72AB jb 760E10F2 :760E1147 7FC9 jg 760E1112 :760E1149 39AB7F9034AB cmp dword ptr [ebx+AB34907F], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E112C(C) | :760E114F 7FAD jg 760E10FE :760E1151 A9AB7F5543 test eax, 43557FAB :760E1156 AB stosd :760E1157 7F00 jg 760E1159 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1157(C) | :760E1159 000000 BYTE 3 DUP(0) :760E115C 7DF5 jge 760E1153 :760E115E CA75FC retf FC75 :760E1161 0CCB or al, CB :760E1163 75B4 jne 760E1119 :760E1165 F7 BYTE 0f7h :760E1166 CA75AE retf AE75 :760E1169 F7 BYTE 0f7h :760E116A CA754D retf 4D75 :760E116D FB sti :760E116E CA754B retf 4B75 :760E1171 0DCB75F17E or eax, 7EF175CB :760E1176 C9 leave :760E1177 757D jne 760E11F6 :760E1179 02CB add cl, bl :760E117B 7500 jne 760E117D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E117B(C) | :760E117D 000000 BYTE 3 DUP(0) :760E1180 A3164A7E50 mov dword ptr [507E4A16], eax :760E1185 734A jnb 760E11D1 :760E1187 7EB6 jle 760E113F :760E1189 17 pop ss :760E118A 4A dec edx :760E118B 7E00 jle 760E118D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E118B(C) | :760E118D 000000 BYTE 3 DUP(0) :760E1190 9E sahf * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1199(C) | :760E1191 40 inc eax :760E1192 F7BF1170F6BF idiv dword ptr [edi+BFF67011] :760E1198 47 inc edi :760E1199 73F6 jnb 760E1191 :760E119B BF231AF9BF mov edi, BFF91A23 :760E11A0 8E55F7 mov ss, [ebp-09] :760E11A3 BF6C30F8BF mov edi, BFF8306C :760E11A8 1A79F6 sbb bh, byte ptr [ecx-0A] :760E11AB BF5419F9BF mov edi, BFF91954 :760E11B0 EF out dx, ax :760E11B1 78F6 js 760E11A9 :760E11B3 BF5079F6BF mov edi, BFF67950 :760E11B8 A96FF6BF91 test eax, 91BFF66F :760E11BD 7BF6 jpo 760E11B5 :760E11BF BF3943F6BF mov edi, BFF64339 :760E11C4 087BF6 or byte ptr [ebx-0A], bh :760E11C7 BFB060F8BF mov edi, BFF860B0 :760E11CC 3E BYTE 03eh :760E11CD 6F outsd :760E11CE F6BF0DC9F6BF idiv byte ptr [edi+BFF6C90D] :760E11D4 1371F6 adc esi, dword ptr [ecx-0A] :760E11D7 BFE8CDF8BF mov edi, BFF8CDE8 :760E11DC 896FF6 mov dword ptr [edi-0A], ebp :760E11DF BF7276F6BF mov edi, BFF67672 :760E11E4 3122 xor dword ptr [edx], esp :760E11E6 F7BF3713F9BF idiv dword ptr [edi+BFF91337] :760E11EC 9C pushfd :760E11ED 6E outsb :760E11EE F6BF8C48F6BF idiv byte ptr [edi+BFF6488C] :760E11F4 A849 test al, 49 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1177(C) | :760E11F6 F6BF67CFF7BF idiv byte ptr [edi+BFF7CF67] :760E11FC E86EF6BF2C call A2CE086F :760E1201 74F6 je 760E11F9 :760E1203 BFD072F6BF mov edi, BFF672D0 :760E1208 A17DF6BFE5 mov eax, dword ptr [E5BFF67D] :760E120D 31F8 xor eax, edi :760E120F BF7B6EF6BF mov edi, BFF66E7B :760E1214 6390F7BF0A73 arpl dword ptr [eax+730ABFF7], edx :760E121A F6BFAC71F6BF idiv byte ptr [edi+BFF671AC] :760E1220 C575F6 lds esi, dword ptr [ebp-0A] :760E1223 BF686FF6BF mov edi, BFF66F68 :760E1228 06 push es :760E1229 46 inc esi :760E122A F7BF6875F6BF idiv dword ptr [edi+BFF67568] :760E1230 7BB0 jpo 760E11E2 :760E1232 F7BFF6E1F6BF idiv dword ptr [edi+BFF6E1F6] :760E1238 1E push ds :760E1239 CAF6BF retf BFF6 :760E123C 13BBF6BFEEBA adc edi, dword ptr [ebx+BAEEBFF6] :760E1242 F6BF9B78F6BF idiv byte ptr [edi+BFF6789B] :760E1248 6820F9BF83 push 83BFF920 :760E124D 7DF6 jge 760E1245 :760E124F BF3F7FF6BF mov edi, BFF67F3F :760E1254 8173F6BF9672F6 xor dword ptr [ebx-0A], F67296BF :760E125B BF9E75F6BF mov edi, BFF6759E :760E1260 CA1AF8 retf F81A :760E1263 BF5C72F6BF mov edi, BFF6725C :760E1268 2F das :760E1269 7BF6 jpo 760E1261 :760E126B BFE87AF6BF mov edi, BFF67AE8 :760E1270 41 inc ecx :760E1271 20F9 and cl, bh :760E1273 BF4B1AF9BF mov edi, BFF91A4B :760E1278 59 pop ecx :760E1279 E5F7 in ax, F7 :760E127B BFA876F6BF mov edi, BFF676A8 :760E1280 B37A mov bl, 7A :760E1282 F6BF9864F6BF idiv byte ptr [edi+BFF66498] :760E1288 00000000 BYTE 4 DUP(0) :760E128C 1A54F4BF sbb dl, byte ptr [esp+8*esi-41] :760E1290 EF out dx, ax :760E1291 2F das :760E1292 F4 hlt :760E1293 BFDD49F4BF mov edi, BFF449DD :760E1298 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E12FF(C) | :760E1299 41 inc ecx :760E129A F4 hlt :760E129B BF2C23F4BF mov edi, BFF4232C :760E12A0 A91BF4BFB5 test eax, B5BFF41B :760E12A5 56 push esi :760E12A6 F4 hlt :760E12A7 BF00000000 mov edi, 00000000 :760E12AC 1A16 sbb dl, byte ptr [esi] :760E12AE E6BF out BF, al :760E12B0 7416 je 760E12C8 :760E12B2 E6BF out BF, al :760E12B4 64 BYTE 064h :760E12B5 15E6BFDA19 adc eax, 19DABFE6 :760E12BA E6BF out BF, al :760E12BC AD lodsd :760E12BD 16 push ss :760E12BE E6BF out BF, al :760E12C0 0115E6BFA613 add dword ptr [13A6BFE6], edx :760E12C6 E6BF out BF, al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E12B0(C) | :760E12C8 5B pop ebx :760E12C9 18E6 sbb dh, ah :760E12CB BFE713E6BF mov edi, BFE613E7 :760E12D0 B717 mov bh, 17 :760E12D2 E6BF out BF, al :760E12D4 00000000 BYTE 4 DUP(0) :760E12D8 F0 lock :760E12D9 91 xchg eax,ecx :760E12DA BD7F000000 mov ebp, 0000007F :760E12DF 0021 add byte ptr [ecx], ah :760E12E1 0BAA7D9D2AAA or ebp, dword ptr [edx+AA2A9D7D] :760E12E7 7D00 jge 760E12E9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E12E7(C) | :760E12E9 000000 BYTE 3 DUP(0) :760E12EC 3013 xor byte ptr [ebx], dl :760E12EE 0E push cs :760E12EF 76EF jbe 760E12E0 :760E12F1 1A0F sbb cl, byte ptr [edi] :760E12F3 7690 jbe 760E1285 :760E12F5 90 nop :760E12F6 90 nop :760E12F7 90 nop :760E12F8 7813 js 760E130D :760E12FA 0E push cs :760E12FB 7669 jbe 760E1366 :760E12FD 870F xchg dword ptr [edi], ecx :760E12FF 7698 jbe 760E1299 :760E1301 D20F ror byte ptr [edi], cl :760E1303 7600 jbe 760E1305 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1303(C) | :760E1305 00000000000000 BYTE 7 DUP(0) :760E130C FFFFFFFF BYTE 4 DUP(0ffh) :760E1310 000000000000000000 BYTE 9 DUP(0) :760E1319 130E adc ecx, dword ptr [esi] :760E131B 7600 jbe 760E131D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E131B(C) | :760E131D 90 nop :760E131E 90 nop :760E131F 90 nop :760E1320 0000000000000000 BYTE 8 DUP(0) :760E1328 0100 add dword ptr [eax], eax :760E132A 0000 add byte ptr [eax], al :760E132C 1813 sbb byte ptr [ebx], dl :760E132E 0E push cs :760E132F 7600 jbe 760E1331 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E132F(C) | :760E1331 00000000000000000000 BYTE 10 DUP(0) :760E133B 00 BYTE 0 :760E133C 98 cwde :760E133D D20F ror byte ptr [edi], cl :760E133F 7620 jbe 760E1361 :760E1341 130E adc ecx, dword ptr [esi] :760E1343 7690 jbe 760E12D5 :760E1345 90 nop :760E1346 90 nop :760E1347 90 nop :760E1348 B0D2 mov al, D2 :760E134A 0F7600 pcmpeqd mm0, dword ptr [eax] :760E134D 00000000000000 BYTE 7 DUP(0) :760E1354 FFFFFFFF BYTE 4 DUP(0ffh) :760E1358 0000000000000000 BYTE 8 DUP(0) :760E1360 48 dec eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E133F(C) | :760E1361 130E adc ecx, dword ptr [esi] :760E1363 7600 jbe 760E1365 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1363(C) | :760E1365 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E12FB(C) | :760E1366 90 nop :760E1367 90 nop :760E1368 0000000000000000 BYTE 8 DUP(0) :760E1370 0100 add dword ptr [eax], eax :760E1372 0000 add byte ptr [eax], al :760E1374 60 pushad :760E1375 130E adc ecx, dword ptr [esi] :760E1377 7600 jbe 760E1379 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1377(C) | :760E1379 00000000000000000000 BYTE 10 DUP(0) :760E1383 00 BYTE 0 :760E1384 B0D2 mov al, D2 :760E1386 0F766813 pcmpeqd mm5, dword ptr [eax±13] :760E138A 0E push cs :760E138B 76 BYTE 76h //******************** Program Entry Point ******** :760E138C 53 push ebx :760E138D 55 push ebp :760E138E 56 push esi :760E138F 8B742414 mov esi, dword ptr [esp+14] :760E1393 85F6 test esi, esi :760E1395 57 push edi :760E1396 B801000000 mov eax, 00000001 :760E139B 745C je 760E13F9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1401(C) | :760E139D 8B7C241C mov edi, dword ptr [esp+1C] :760E13A1 8B5C2414 mov ebx, dword ptr [esp+14] :760E13A5 83FE01 cmp esi, 00000001 :760E13A8 755E jne 760E1408 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E140D(U) | :760E13AA 8B0D9CD80F76 mov ecx, dword ptr [760FD89C] :760E13B0 85C9 test ecx, ecx :760E13B2 0F852C040100 jne 760F17E4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F17E9(U) | :760E13B8 85C0 test eax, eax :760E13BA 0F842E040100 je 760F17EE :760E13C0 57 push edi :760E13C1 56 push esi :760E13C2 53 push ebx :760E13C3 E869000000 call 760E1431 :760E13C8 85C0 test eax, eax :760E13CA 0F841E040100 je 760F17EE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E140B(C) | :760E13D0 57 push edi :760E13D1 56 push esi :760E13D2 53 push ebx :760E13D3 E82E010000 call 760E1506 :760E13D8 83FE01 cmp esi, 00000001 :760E13DB 8BE8 mov ebp, eax :760E13DD 7508 jne 760E13E7 :760E13DF 85ED test ebp, ebp :760E13E1 0F8410040100 je 760F17F7 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E13DD(C), :760F17FF(U) | :760E13E7 85F6 test esi, esi :760E13E9 7424 je 760E140F :760E13EB 83FE03 cmp esi, 00000003 :760E13EE 741F je 760E140F * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E1421(C), :760E142A(C), :760F1812(U) | :760E13F0 5F pop edi :760E13F1 8BC5 mov eax, ebp :760E13F3 5E pop esi :760E13F4 5D pop ebp :760E13F5 5B pop ebx :760E13F6 C20C00 ret 000C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E139B(C) | :760E13F9 8B0D28D30F76 mov ecx, dword ptr [760FD328] :760E13FF 85C9 test ecx, ecx :760E1401 759A jne 760E139D :760E1403 E9D3030100 jmp 760F17DB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E13A8(C) | :760E1408 83FE02 cmp esi, 00000002 :760E140B 75C3 jne 760E13D0 :760E140D EB9B jmp 760E13AA * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E13E9(C), :760E13EE(C) | :760E140F 57 push edi :760E1410 56 push esi :760E1411 53 push ebx :760E1412 E81A000000 call 760E1431 :760E1417 85C0 test eax, eax :760E1419 0F84E5030100 je 760F1804 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1806(U) | :760E141F 85ED test ebp, ebp :760E1421 74CD je 760E13F0 :760E1423 A19CD80F76 mov eax, dword ptr [760FD89C] :760E1428 85C0 test eax, eax :760E142A 74C4 je 760E13F0 :760E142C E9DA030100 jmp 760F180B * Referenced by a CALL at Addresses: |:760E13C3 , :760E1412 , :760F17FA | :760E1431 8B442408 mov eax, dword ptr [esp+08] :760E1435 56 push esi :760E1436 85C0 test eax, eax :760E1438 7464 je 760E149E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E14B3(U) | * Reference To: MSVCRT._adjust_fdiv, Ord:009Bh | :760E143A 8B0D0C100E76 mov ecx, dword ptr [760E100C] :760E1440 83F801 cmp eax, 00000001 :760E1443 8B11 mov edx, dword ptr [ecx] :760E1445 891590D80F76 mov dword ptr [760FD890], edx :760E144B 7568 jne 760E14B5 :760E144D 6880000000 push 00000080 * Reference To: MSVCRT.malloc, Ord:028Eh | :760E1452 FF1510100E76 Call dword ptr [760E1010] :760E1458 83C404 add esp, 00000004 :760E145B A398D80F76 mov dword ptr [760FD898], eax :760E1460 85C0 test eax, eax :760E1462 0F846D030100 je 760F17D5 :760E1468 C70000000000 mov dword ptr [eax], 00000000 :760E146E A198D80F76 mov eax, dword ptr [760FD898] :760E1473 68DCD20F76 push 760FD2DC :760E1478 68C8D20F76 push 760FD2C8 :760E147D A394D80F76 mov dword ptr [760FD894], eax * Reference To: MSVCRT._initterm, Ord:010Ch | :760E1482 E8EE020000 Call 760E1775 :760E1487 A128D30F76 mov eax, dword ptr [760FD328] :760E148C 83C408 add esp, 00000008 :760E148F 40 inc eax :760E1490 A328D30F76 mov dword ptr [760FD328], eax :760E1495 B801000000 mov eax, 00000001 :760E149A 5E pop esi :760E149B C20C00 ret 000C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1438(C) | :760E149E 8B0D28D30F76 mov ecx, dword ptr [760FD328] :760E14A4 85C9 test ecx, ecx :760E14A6 0F8E29030100 jle 760F17D5 :760E14AC 49 dec ecx :760E14AD 890D28D30F76 mov dword ptr [760FD328], ecx :760E14B3 EB85 jmp 760E143A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E144B(C) | :760E14B5 85C0 test eax, eax :760E14B7 7544 jne 760E14FD :760E14B9 8B0D98D80F76 mov ecx, dword ptr [760FD898] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E152F(C) | :760E14BF 85C9 test ecx, ecx :760E14C1 743A je 760E14FD :760E14C3 8B3594D80F76 mov esi, dword ptr [760FD894] :760E14C9 83EE04 sub esi, 00000004 :760E14CC 3BF1 cmp esi, ecx :760E14CE 7219 jb 760E14E9 :760E14D0 EB0F jmp 760E14E1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E14E7(U) | :760E14D2 FFD0 call eax :760E14D4 8B0D98D80F76 mov ecx, dword ptr [760FD898] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E14E5(C) | :760E14DA 83EE04 sub esi, 00000004 :760E14DD 3BF1 cmp esi, ecx :760E14DF 7208 jb 760E14E9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E14D0(U) | :760E14E1 8B06 mov eax, dword ptr [esi] :760E14E3 85C0 test eax, eax :760E14E5 74F3 je 760E14DA :760E14E7 EBE9 jmp 760E14D2 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E14CE(C), :760E14DF(C) | :760E14E9 51 push ecx * Reference To: MSVCRT.free, Ord:025Bh | :760E14EA FF1518100E76 Call dword ptr [760E1018] :760E14F0 83C404 add esp, 00000004 :760E14F3 C70598D80F7600000000 mov dword ptr [760FD898], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E14B7(C), :760E14C1(C) | :760E14FD B801000000 mov eax, 00000001 :760E1502 5E pop esi :760E1503 C20C00 ret 000C * Referenced by a CALL at Address: |:760E13D3 | :760E1506 837C240801 cmp dword ptr [esp+08], 00000001 :760E150B 7514 jne 760E1521 :760E150D A19CD80F76 mov eax, dword ptr [760FD89C] :760E1512 85C0 test eax, eax :760E1514 750B jne 760E1521 :760E1516 8B442404 mov eax, dword ptr [esp+04] :760E151A 50 push eax * Reference To: KERNEL32.DisableThreadLibraryCalls, Ord:0064h | :760E151B FF15C8110E76 Call dword ptr [760E11C8] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E150B(C), :760E1514(C) | :760E1521 B801000000 mov eax, 00000001 :760E1526 C20C00 ret 000C :760E1529 90 nop :760E152A 90 nop :760E152B 90 nop :760E152C 7015 jo 760E1543 :760E152E 0E push cs :760E152F 768E jbe 760E14BF :760E1531 1A0F sbb cl, byte ptr [edi] :760E1533 76B8 jbe 760E14ED :760E1535 150E763A3F adc eax, 3F3A760E :760E153A 0F7690909090E0 pcmpeqd mm2, dword ptr [eax+E0909090] :760E1541 D20F ror byte ptr [edi], cl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E152C(C) | :760E1543 7600 jbe 760E1545 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1543(C) | :760E1545 00000000000000 BYTE 7 DUP(0) :760E154C FFFFFFFF BYTE 4 DUP(0ffh) :760E1550 0000000000000000 BYTE 8 DUP(0) :760E1558 40 inc eax :760E1559 150E760090 adc eax, 9000760E :760E155E 90 nop :760E155F 90 nop :760E1560 0000000000000000 BYTE 8 DUP(0) :760E1568 0100 add dword ptr [eax], eax :760E156A 0000 add byte ptr [eax], al :760E156C 58 pop eax :760E156D 150E760000 adc eax, 0000760E :760E1572 00000000000000000000 BYTE 10 DUP(0) :760E157C E0D2 loopnz 760E1550 :760E157E 0F766015 pcmpeqd mm4, dword ptr [eax±15] :760E1582 0E push cs :760E1583 7690 jbe 760E1515 :760E1585 90 nop :760E1586 90 nop :760E1587 90 nop :760E1588 F8 clc :760E1589 D20F ror byte ptr [edi], cl :760E158B 7600 jbe 760E158D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E158B(C) | :760E158D 00000000000000 BYTE 7 DUP(0) :760E1594 FFFFFFFF BYTE 4 DUP(0ffh) :760E1598 0000000000000000 BYTE 8 DUP(0) :760E15A0 88150E760090 mov byte ptr [9000760E], dl :760E15A6 90 nop :760E15A7 90 nop :760E15A8 0000000000000000 BYTE 8 DUP(0) :760E15B0 0100 add dword ptr [eax], eax :760E15B2 0000 add byte ptr [eax], al :760E15B4 A0150E7600 mov al, byte ptr [00760E15] :760E15B9 00000000000000000000 BYTE 10 DUP(0) :760E15C3 00 BYTE 0 :760E15C4 F8 clc :760E15C5 D20F ror byte ptr [edi], cl :760E15C7 76A8 jbe 760E1571 :760E15C9 15 BYTE 15h :760E15CA 0E BYTE 0eh :760E15CB 76 BYTE 76h * Referenced by a CALL at Addresses: |:760E170F , :760E4466 , :760E48F9 , :760E49CB , :760F1AF2 | :760E15CC 56 push esi :760E15CD 8BF1 mov esi, ecx :760E15CF 8B4644 mov eax, dword ptr [esi+44] :760E15D2 C706F0120E76 mov dword ptr [esi], 760E12F0 :760E15D8 85C0 test eax, eax :760E15DA 740A je 760E15E6 :760E15DC 50 push eax :760E15DD E8B4320000 call 760E4896 :760E15E2 83664400 and dword ptr [esi+44], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E15DA(C) | :760E15E6 8B4648 mov eax, dword ptr [esi+48] :760E15E9 85C0 test eax, eax :760E15EB 0F851A050100 jne 760F1B0B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1B15(U) | :760E15F1 8B4608 mov eax, dword ptr [esi+08] :760E15F4 85C0 test eax, eax :760E15F6 740A je 760E1602 :760E15F8 50 push eax :760E15F9 E898320000 call 760E4896 :760E15FE 83660800 and dword ptr [esi+08], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E15F6(C) | :760E1602 5E pop esi :760E1603 C3 ret * Referenced by a CALL at Addresses: |:760E3DE3 , :760E3DEE | * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E171B(U) | :760E1604 56 push esi :760E1605 8BF1 mov esi, ecx :760E1607 E80D000000 call 760E1619 :760E160C 8D8E5C220000 lea ecx, dword ptr [esi+0000225C] * Reference To: SfpDll.??1CReadWriteLock@@QAE@XZ | :760E1612 E859000000 call 760E1670 :760E1617 5E pop esi :760E1618 C3 ret * Referenced by a CALL at Addresses: |:760E1607 , :760EDCD1 | :760E1619 53 push ebx :760E161A 55 push ebp :760E161B 8BD9 mov ebx, ecx :760E161D 56 push esi :760E161E 57 push edi :760E161F BDD3070000 mov ebp, 000007D3 :760E1624 8DBB0C030000 lea edi, dword ptr [ebx+0000030C] :760E162A EB20 jmp 760E164C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E1652(U), :760F5F92(U) | :760E162C 8B4604 mov eax, dword ptr [esi+04] :760E162F 85C0 test eax, eax :760E1631 0F854F490100 jne 760F5F86 :760E1637 8B06 mov eax, dword ptr [esi] :760E1639 56 push esi :760E163A 8907 mov dword ptr [edi], eax :760E163C E8AE030000 call 760E19EF :760E1641 EB09 jmp 760E164C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1650(C) | :760E1643 832700 and dword ptr [edi], 00000000 :760E1646 83C704 add edi, 00000004 :760E1649 4D dec ebp :760E164A 7408 je 760E1654 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E162A(U), :760E1641(U) | :760E164C 8B37 mov esi, dword ptr [edi] :760E164E 85F6 test esi, esi :760E1650 74F1 je 760E1643 :760E1652 EBD8 jmp 760E162C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E164A(C) | :760E1654 8DB358220000 lea esi, dword ptr [ebx+00002258] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5FA1(U) | :760E165A 8B06 mov eax, dword ptr [esi] :760E165C 85C0 test eax, eax :760E165E 0F8533490100 jne 760F5F97 :760E1664 83A35822000000 and dword ptr [ebx+00002258], 00000000 :760E166B 5F pop edi :760E166C 5E pop esi :760E166D 5D pop ebp :760E166E 5B pop ebx :760E166F C3 ret * Referenced by a CALL at Address: |:760E1612 | Exported fn(): ??1CReadWriteLock@@QAE@XZ - Ord:0004h :760E1670 56 push esi :760E1671 8BF1 mov esi, ecx :760E1673 57 push edi :760E1674 8B06 mov eax, dword ptr [esi] :760E1676 85C0 test eax, eax :760E1678 7407 je 760E1681 :760E167A 50 push eax * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760E167B FF1534120E76 Call dword ptr [760E1234] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1678(C) | * Reference To: KERNEL32.DeleteCriticalSection, Ord:005Ah | :760E1681 8B3D30120E76 mov edi, dword ptr [760E1230] :760E1687 8D4604 lea eax, dword ptr [esi+04] :760E168A 50 push eax :760E168B FFD7 call edi :760E168D 83C61C add esi, 0000001C :760E1690 56 push esi :760E1691 FFD7 call edi :760E1693 5F pop edi :760E1694 5E pop esi :760E1695 C3 ret :760E1696 6880D80F76 push 760FD880 * Reference To: OLEAUT32.VariantClear, Ord:0009h | :760E169B FF15A0100E76 Call dword ptr [760E10A0] :760E16A1 85C0 test eax, eax :760E16A3 0F8C68710100 jl 760F8811 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8817(U) | :760E16A9 C3 ret :760E16AA B930D30F76 mov ecx, 760FD330 * Referenced by a CALL at Address: |:760F1A91 | :760E16AF 56 push esi :760E16B0 8BF1 mov esi, ecx :760E16B2 8B8614050000 mov eax, dword ptr [esi+00000514] :760E16B8 C70630150E76 mov dword ptr [esi], 760E1530 :760E16BE 85C0 test eax, eax :760E16C0 0F85E4030100 jne 760F1AAA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1AB0(U) | :760E16C6 8B8618050000 mov eax, dword ptr [esi+00000518] :760E16CC 85C0 test eax, eax :760E16CE 0F85E1030100 jne 760F1AB5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1ABD(U) | :760E16D4 8B8620050000 mov eax, dword ptr [esi+00000520] :760E16DA 85C0 test eax, eax :760E16DC 0F85E0030100 jne 760F1AC2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1AC8(U) | :760E16E2 8B861C050000 mov eax, dword ptr [esi+0000051C] :760E16E8 85C0 test eax, eax :760E16EA 0F85DD030100 jne 760F1ACD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1AD3(U) | :760E16F0 8B8628050000 mov eax, dword ptr [esi+00000528] :760E16F6 85C0 test eax, eax :760E16F8 0F85DA030100 jne 760F1AD8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1ADF(U) | :760E16FE 8B8640050000 mov eax, dword ptr [esi+00000540] :760E1704 85C0 test eax, eax :760E1706 0F85D8030100 jne 760F1AE4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1AEA(U) | :760E170C 8D4E08 lea ecx, dword ptr [esi+08] :760E170F E8B8FEFFFF call 760E15CC :760E1714 5E pop esi :760E1715 C3 ret :760E1716 B900B00F76 mov ecx, 760FB000 :760E171B E9E4FEFFFF jmp 760E1604 :760E1720 B918D30F76 mov ecx, 760FD318 * Referenced by a CALL at Address: |:760F3F3D | :760E1725 56 push esi :760E1726 8BF1 mov esi, ecx :760E1728 8B4608 mov eax, dword ptr [esi+08] :760E172B C70638150E76 mov dword ptr [esi], 760E1538 :760E1731 85C0 test eax, eax :760E1733 0F851D280100 jne 760F3F56 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3F5E(U) | :760E1739 8B7604 mov esi, dword ptr [esi+04] :760E173C 85F6 test esi, esi :760E173E 0F851F280100 jne 760F3F63 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3F6A(U) | :760E1744 5E pop esi :760E1745 C3 ret :760E1746 00 BYTE 0 * Referenced by a CALL at Addresses: |:760E187B , :760E43BE , :760E48BD , :760E498F | :760E1747 8BC1 mov eax, ecx :760E1749 33C9 xor ecx, ecx :760E174B 83480CFF or dword ptr [eax+0C], FFFFFFFF :760E174F 834810FF or dword ptr [eax+10], FFFFFFFF :760E1753 C700F0120E76 mov dword ptr [eax], 760E12F0 :760E1759 894844 mov dword ptr [eax+44], ecx :760E175C 894808 mov dword ptr [eax+08], ecx :760E175F 894848 mov dword ptr [eax+48], ecx :760E1762 894814 mov dword ptr [eax+14], ecx :760E1765 89483C mov dword ptr [eax+3C], ecx :760E1768 894804 mov dword ptr [eax+04], ecx :760E176B 894840 mov dword ptr [eax+40], ecx :760E176E 8988FC040000 mov dword ptr [eax+000004FC], ecx :760E1774 C3 ret * Referenced by a CALL at Address: |:760E1482 | * Reference To: MSVCRT._initterm, Ord:010Ch | :760E1775 FF2514100E76 Jmp dword ptr [760E1014] :760E177B E802000000 call 760E1782 :760E1780 EB16 jmp 760E1798 * Referenced by a CALL at Address: |:760E177B | :760E1782 B918D30F76 mov ecx, 760FD318 :760E1787 8BC1 mov eax, ecx :760E1789 83600400 and dword ptr [eax+04], 00000000 :760E178D 83600800 and dword ptr [eax+08], 00000000 :760E1791 C70038150E76 mov dword ptr [eax], 760E1538 :760E1797 C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1780(U) | :760E1798 6820170E76 push 760E1720 :760E179D E802000000 call 760E17A4 :760E17A2 59 pop ecx :760E17A3 C3 ret * Referenced by a CALL at Addresses: |:760E179D , :760E1862 , :760E18D9 , :760E192E | :760E17A4 8B442404 mov eax, dword ptr [esp+04] :760E17A8 50 push eax :760E17A9 E80B000000 call 760E17B9 :760E17AE 83C404 add esp, 00000004 :760E17B1 F7D8 neg eax :760E17B3 1BC0 sbb eax, eax :760E17B5 F7D8 neg eax :760E17B7 48 dec eax :760E17B8 C3 ret * Referenced by a CALL at Address: |:760E17A9 | :760E17B9 833D98D80F76FF cmp dword ptr [760FD898], FFFFFFFF :760E17C0 0F8451000100 je 760F1817 :760E17C6 8B4C2404 mov ecx, dword ptr [esp+04] :760E17CA 6894D80F76 push 760FD894 :760E17CF 6898D80F76 push 760FD898 :760E17D4 51 push ecx * Reference To: MSVCRT.__dllonexit, Ord:0055h | :760E17D5 E804000000 Call 760E17DE :760E17DA 83C40C add esp, 0000000C :760E17DD C3 ret * Referenced by a CALL at Address: |:760E17D5 | * Reference To: MSVCRT.__dllonexit, Ord:0055h | :760E17DE FF2508100E76 Jmp dword ptr [760E1008] :760E17E4 E802000000 call 760E17EB :760E17E9 EB72 jmp 760E185D * Referenced by a CALL at Address: |:760E17E4 | :760E17EB B900B00F76 mov ecx, 760FB000 * Referenced by a CALL at Addresses: |:760E3AFA , :760E3B05 | :760E17F0 56 push esi :760E17F1 8BF1 mov esi, ecx :760E17F3 57 push edi :760E17F4 83A65822000000 and dword ptr [esi+00002258], 00000000 :760E17FB 8D8E5C220000 lea ecx, dword ptr [esi+0000225C] * Reference To: SfpDll.??0CReadWriteLock@@QAE@XZ | :760E1801 E82A000000 call 760E1830 :760E1806 6846170E76 push 760E1746 :760E180B 56 push esi :760E180C C7869422000001000000 mov dword ptr [esi+00002294], 00000001 * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760E1816 FF1504120E76 Call dword ptr [760E1204] :760E181C B9D3070000 mov ecx, 000007D3 :760E1821 33C0 xor eax, eax :760E1823 8DBE0C030000 lea edi, dword ptr [esi+0000030C] :760E1829 F3 repz :760E182A AB stosd :760E182B 8BC6 mov eax, esi :760E182D 5F pop edi :760E182E 5E pop esi :760E182F C3 ret * Referenced by a CALL at Address: |:760E1801 | Exported fn(): ??0CReadWriteLock@@QAE@XZ - Ord:0001h :760E1830 56 push esi :760E1831 33C0 xor eax, eax :760E1833 57 push edi :760E1834 50 push eax :760E1835 8BF1 mov esi, ecx :760E1837 6A01 push 00000001 :760E1839 50 push eax :760E183A 50 push eax :760E183B 894634 mov dword ptr [esi+34], eax * Reference To: KERNEL32.CreateEventA, Ord:0034h | :760E183E FF152C120E76 Call dword ptr [760E122C] * Reference To: KERNEL32.InitializeCriticalSection, Ord:01C5h | :760E1844 8B3D28120E76 mov edi, dword ptr [760E1228] :760E184A 8906 mov dword ptr [esi], eax :760E184C 8D4604 lea eax, dword ptr [esi+04] :760E184F 50 push eax :760E1850 FFD7 call edi :760E1852 8D461C lea eax, dword ptr [esi+1C] :760E1855 50 push eax :760E1856 FFD7 call edi :760E1858 8BC6 mov eax, esi :760E185A 5F pop edi :760E185B 5E pop esi :760E185C C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E17E9(U) | :760E185D 6816170E76 push 760E1716 :760E1862 E83DFFFFFF call 760E17A4 :760E1867 59 pop ecx :760E1868 C3 ret :760E1869 E802000000 call 760E1870 :760E186E EB64 jmp 760E18D4 * Referenced by a CALL at Address: |:760E1869 | :760E1870 B930D30F76 mov ecx, 760FD330 :760E1875 56 push esi :760E1876 8BF1 mov esi, ecx :760E1878 8D4E08 lea ecx, dword ptr [esi+08] :760E187B E8C7FEFFFF call 760E1747 :760E1880 33C0 xor eax, eax :760E1882 C70630150E76 mov dword ptr [esi], 760E1530 :760E1888 898614050000 mov dword ptr [esi+00000514], eax :760E188E 898620050000 mov dword ptr [esi+00000520], eax :760E1894 89861C050000 mov dword ptr [esi+0000051C], eax :760E189A 898628050000 mov dword ptr [esi+00000528], eax :760E18A0 89862C050000 mov dword ptr [esi+0000052C], eax :760E18A6 898630050000 mov dword ptr [esi+00000530], eax :760E18AC 898640050000 mov dword ptr [esi+00000540], eax :760E18B2 898624050000 mov dword ptr [esi+00000524], eax :760E18B8 898618050000 mov dword ptr [esi+00000518], eax :760E18BE 898648050000 mov dword ptr [esi+00000548], eax :760E18C4 898608050000 mov dword ptr [esi+00000508], eax :760E18CA 898644050000 mov dword ptr [esi+00000544], eax :760E18D0 8BC6 mov eax, esi :760E18D2 5E pop esi :760E18D3 C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E186E(U) | :760E18D4 68AA160E76 push 760E16AA :760E18D9 E8C6FEFFFF call 760E17A4 :760E18DE 59 pop ecx :760E18DF C3 ret :760E18E0 E802000000 call 760E18E7 :760E18E5 EB42 jmp 760E1929 * Referenced by a CALL at Address: |:760E18E0 | :760E18E7 6A0A push 0000000A :760E18E9 6804000280 push 80020004 :760E18EE B980D80F76 mov ecx, 760FD880 :760E18F3 E801000000 call 760E18F9 :760E18F8 C3 ret * Referenced by a CALL at Address: |:760E18F3 | :760E18F9 56 push esi :760E18FA 57 push edi :760E18FB 668B7C2410 mov di, word ptr [esp+10] :760E1900 8BF1 mov esi, ecx :760E1902 6683FF03 cmp di, 0003 :760E1906 0F84D66E0100 je 760F87E2 :760E190C 6683FF0A cmp di, 000A :760E1910 0F85BC6E0100 jne 760F87D2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F87E8(U) | :760E1916 66C7060A00 mov word ptr [esi], 000A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F880C(U) | :760E191B 8B44240C mov eax, dword ptr [esp+0C] :760E191F 894608 mov dword ptr [esi+08], eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8802(U) | :760E1922 8BC6 mov eax, esi :760E1924 5F pop edi :760E1925 5E pop esi :760E1926 C20800 ret 0008 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E18E5(U) | :760E1929 6896160E76 push 760E1696 :760E192E E871FEFFFF call 760E17A4 :760E1933 59 pop ecx :760E1934 C3 ret * Referenced by a CALL at Addresses: |:760E1FBF , :760E2621 , :760E26DF , :760E2800 , :760E290B |:760E2AA5 , :760E3055 , :760E4423 , :760E4515 , :760E480F |:760F2289 , :760F6101 | :760E1935 FF742404 push [esp+04] :760E1939 6A08 push 00000008 * Reference To: KERNEL32.GetProcessHeap, Ord:0155h | :760E193B FF15F8110E76 Call dword ptr [760E11F8] :760E1941 50 push eax * Reference To: KERNEL32.HeapAlloc, Ord:01B4h | :760E1942 FF15EC110E76 Call dword ptr [760E11EC] :760E1948 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E2D5C , :760E3D8C , :760E4073 , :760E4096 , :760EF261 |:760EF360 , :760EF567 , :760EF590 , :760EF634 , :760EF649 |:760F000B , :760F00FF , :760F091B , :760F0974 , :760F0A83 |:760F0ADC , :760F0F09 , :760F0F45 , :760F113F , :760F11E7 |:760F1496 , :760F1A9E , :760F1AFF , :760F2B4E , :760F3F4A |:760F46C5 , :760F4D95 , :760F4F1A , :760F6EF7 , :760F7D0B |:760F8779 , :760F88F1 | * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760E194B FF2574100E76 Jmp dword ptr [760E1074] * Referenced by a CALL at Addresses: |:760E1D1D , :760E25F5 , :760E2BE0 , :760E4CCF , :760F55DE |:760F582B , :760F59C2 | :760E1951 53 push ebx :760E1952 8B5C2408 mov ebx, dword ptr [esp+08] :760E1956 56 push esi :760E1957 57 push edi :760E1958 83CEFF or esi, FFFFFFFF :760E195B 33FF xor edi, edi :760E195D 85DB test ebx, ebx :760E195F 0F84143B0100 je 760F5479 :760E1965 6A5C push 0000005C :760E1967 53 push ebx * Reference To: MSVCRT.strrchr, Ord:02C0h | :760E1968 FF1528100E76 Call dword ptr [760E1028] :760E196E 8BF0 mov esi, eax :760E1970 59 pop ecx :760E1971 85F6 test esi, esi :760E1973 59 pop ecx :760E1974 7403 je 760E1979 :760E1976 46 inc esi :760E1977 EB24 jmp 760E199D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1974(C) | :760E1979 8BF3 mov esi, ebx :760E197B EB20 jmp 760E199D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E19A3(U) | :760E197D 0FBEC0 movsx eax, al :760E1980 50 push eax * Reference To: USER32.CharUpperA, Ord:002Fh | :760E1981 FF1594120E76 Call dword ptr [760E1294] :760E1987 0FBEC0 movsx eax, al :760E198A C1E704 shl edi, 04 :760E198D 03F8 add edi, eax :760E198F 46 inc esi :760E1990 8BC7 mov eax, edi :760E1992 25000000F0 and eax, F0000000 :760E1997 750C jne 760E19A5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E19AC(U) | :760E1999 F7D0 not eax :760E199B 23F8 and edi, eax * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E1977(U), :760E197B(U) | :760E199D 8A06 mov al, byte ptr [esi] :760E199F 84C0 test al, al :760E19A1 740B je 760E19AE :760E19A3 EBD8 jmp 760E197D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1997(C) | :760E19A5 8BC8 mov ecx, eax :760E19A7 C1E918 shr ecx, 18 :760E19AA 33F9 xor edi, ecx :760E19AC EBEB jmp 760E1999 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E19A1(C) | :760E19AE 8BC7 mov eax, edi :760E19B0 33D2 xor edx, edx :760E19B2 B9D3070000 mov ecx, 000007D3 :760E19B7 F7F1 div ecx :760E19B9 8BF2 mov esi, edx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5481(C), :760F549D(C), :760F54B4(U) | :760E19BB 8BC6 mov eax, esi :760E19BD 5F pop edi :760E19BE 5E pop esi :760E19BF 5B pop ebx :760E19C0 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E1D31 , :760E260B , :760E4CE5 , :760F586F , :760F5A57 | :760E19C3 8B442404 mov eax, dword ptr [esp+04] :760E19C7 56 push esi :760E19C8 8BB4810C030000 mov esi, dword ptr [ecx+4*eax+0000030C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E19ED(U) | :760E19CF 85F6 test esi, esi :760E19D1 7412 je 760E19E5 :760E19D3 FF74240C push [esp+0C] :760E19D7 8D4608 lea eax, dword ptr [esi+08] :760E19DA 50 push eax * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760E19DB FF1558120E76 Call dword ptr [760E1258] :760E19E1 85C0 test eax, eax :760E19E3 7506 jne 760E19EB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E19D1(C) | :760E19E5 8BC6 mov eax, esi :760E19E7 5E pop esi :760E19E8 C20800 ret 0008 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E19E3(C) | :760E19EB 8B36 mov esi, dword ptr [esi] :760E19ED EBE0 jmp 760E19CF * Referenced by a CALL at Addresses: |:760E163C , :760E2795 , :760E2A8A , :760E2B6B , :760E2C7E |:760E2C8E , :760E2C9E , :760E2CD2 , :760E3037 , :760ED0B5 |:760ED0DC , :760ED4EE , :760F23A0 , :760F2595 , :760F2668 |:760F460B , :760F5676 , :760F567E , :760F5754 , :760F5914 |:760F5F8D , :760F5F9C , :760F6114 | :760E19EF 837C240400 cmp dword ptr [esp+04], 00000000 :760E19F4 7413 je 760E1A09 :760E19F6 FF742404 push [esp+04] :760E19FA 6A00 push 00000000 * Reference To: KERNEL32.GetProcessHeap, Ord:0155h | :760E19FC FF15F8110E76 Call dword ptr [760E11F8] :760E1A02 50 push eax * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760E1A03 FF15FC110E76 Call dword ptr [760E11FC] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E19F4(C) | :760E1A09 C20400 ret 0004 :760E1A0C 90 nop :760E1A0D 90 nop :760E1A0E 90 nop :760E1A0F 90 nop :760E1A10 44 inc esp :760E1A11 000000 BYTE 3 DUP(0) :760E1A14 86B0773F173A xchg byte ptr [eax+3A173F77], dh :760E1A1A D311 rcl dword ptr [ecx], cl :760E1A1C 91 xchg eax,ecx :760E1A1D 6600C0 add al, al :760E1A20 4F dec edi :760E1A21 688E280100 push 0001288E :760E1A26 0000 add byte ptr [eax], al :760E1A28 045D add al, 5D :760E1A2A 888AEB1CC911 mov byte ptr [edx+11C91CEB], cl :760E1A30 9F lahf :760E1A31 E808002B10 call 86391A3E :760E1A36 48 dec eax :760E1A37 60 pushad :760E1A38 0200 add al, byte ptr [eax] :760E1A3A 000000 BYTE 3 DUP(0) :760E1A3D D9 BYTE 0d9h :760E1A3E 0F7600 pcmpeqd mm0, dword ptr [eax] :760E1A41 00000000000000000000 BYTE 10 DUP(0) :760E1A4B 00000000000000000000 BYTE 10 DUP(0) :760E1A55 000000 BYTE 3 DUP(0) * Referenced by a CALL at Addresses: |:760E1E62 , :760E1E96 , :760E1EC4 , :760E20C3 , :760E3193 |:760E3510 , :760E352C , :760E3558 , :760E361B , :760E3A4D |:760EC689 , :760ECB00 , :760EDF27 , :760F1685 | :760E1A58 56 push esi :760E1A59 6A01 push 00000001 :760E1A5B 5E pop esi :760E1A5C FF742410 push [esp+10] :760E1A60 FF742410 push [esp+10] :760E1A64 FF742410 push [esp+10] * Reference To: KERNEL32.ExpandEnvironmentStringsA, Ord:008Fh | :760E1A68 FF1574120E76 Call dword ptr [760E1274] :760E1A6E 85C0 test eax, eax :760E1A70 0F849ABC0000 je 760ED710 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED74A(U) | :760E1A76 8BC6 mov eax, esi :760E1A78 5E pop esi :760E1A79 C20C00 ret 000C :760E1A7C 2577696E64 and eax, 646E6977 :760E1A81 6972255C737973 imul esi, dword ptr [edx+25], 7379735C :760E1A88 7465 je 760E1AEF :760E1A8A 6D insd :760E1A8B 5C pop esp :760E1A8C 7366 jnb 760E1AF4 :760E1A8E 705C jo 760E1AEC :760E1A90 7366 jnb 760E1AF8 :760E1A92 7064 jo 760E1AF8 :760E1A94 622E bound ebp, dword ptr [esi] :760E1A96 7366 jnb 760E1AFE :760E1A98 7000 jo 760E1A9A * Referenced by a CALL at Addresses: |:760E31BA , :760E3DB8 , :760EDCD8 , :760EF28C , :760EF5A5 |:760EFFF5 | * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1A98(C) | :760E1A9A 8B815C220000 mov eax, dword ptr [ecx+0000225C] :760E1AA0 56 push esi :760E1AA1 8DB15C220000 lea esi, dword ptr [ecx+0000225C] :760E1AA7 85C0 test eax, eax :760E1AA9 7407 je 760E1AB2 :760E1AAB 50 push eax * Reference To: KERNEL32.SetEvent, Ord:0290h | :760E1AAC FF15A4110E76 Call dword ptr [760E11A4] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1AA9(C) | :760E1AB2 83C61C add esi, 0000001C :760E1AB5 56 push esi * Reference To: KERNEL32.LeaveCriticalSection, Ord:01DEh | :760E1AB6 FF153C120E76 Call dword ptr [760E123C] :760E1ABC 6A01 push 00000001 :760E1ABE 58 pop eax :760E1ABF 5E pop esi :760E1AC0 C3 ret * Referenced by a CALL at Address: |:760E35E0 | :760E1AC1 53 push ebx :760E1AC2 55 push ebp :760E1AC3 56 push esi :760E1AC4 33ED xor ebp, ebp :760E1AC6 57 push edi :760E1AC7 55 push ebp * Possible StringData Ref from Code Obj ->"sfprpc" | :760E1AC8 682C1B0E76 push 760E1B2C :760E1ACD 6A02 push 00000002 :760E1ACF 5B pop ebx :760E1AD0 53 push ebx * Possible StringData Ref from Code Obj ->"ncalrpc" | :760E1AD1 68241B0E76 push 760E1B24 * Reference To: RPCRT4.RpcServerUseProtseqEpA, Ord:018Fh | :760E1AD6 FF1510110E76 Call dword ptr [760E1110] :760E1ADC 8BF0 mov esi, eax :760E1ADE 3BF5 cmp esi, ebp :760E1AE0 0F85C0440100 jne 760F5FA6 * Reference To: RPCRT4.RpcServerRegisterIf, Ord:0185h | :760E1AE6 8B3D24110E76 mov edi, dword ptr [760E1124] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1A8E(C) | :760E1AEC 55 push ebp :760E1AED 55 push ebp :760E1AEE FF350CD90F76 push dword ptr [760FD90C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1A8C(C) | :760E1AF4 FFD7 call edi :760E1AF6 8BF0 mov esi, eax * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E1A90(C), :760E1A92(C) | :760E1AF8 3BF5 cmp esi, ebp :760E1AFA 0F85D9440100 jne 760F5FD9 :760E1B00 55 push ebp :760E1B01 55 push ebp :760E1B02 FF353CD90F76 push dword ptr [760FD93C] :760E1B08 FFD7 call edi :760E1B0A 8BF0 mov esi, eax :760E1B0C 3BF5 cmp esi, ebp :760E1B0E 0F85F1440100 jne 760F6005 :760E1B14 55 push ebp :760E1B15 53 push ebx :760E1B16 6A01 push 00000001 * Reference To: RPCRT4.RpcServerListen, Ord:0182h | :760E1B18 FF1520110E76 Call dword ptr [760E1120] :760E1B1E E90A450100 jmp 760F602D :760E1B23 90 nop :760E1B24 6E outsb :760E1B25 63616C arpl dword ptr [ecx+6C], esp :760E1B28 7270 jb 760E1B9A :760E1B2A 6300 arpl dword ptr [eax], eax :760E1B2C 7366 jnb 760E1B94 :760E1B2E 7072 jo 760E1BA2 :760E1B30 7063 jo 760E1B95 :760E1B32 009090909090 add byte ptr [eax+90909090], dl :760E1B38 44 inc esp :760E1B39 000000 BYTE 3 DUP(0) :760E1B3C E00C loopnz 760E1B4A :760E1B3E 6B900BC76710B3 imul edx, dword ptr [eax+1067C70B], FFFFFFB3 :760E1B45 17 pop ss :760E1B46 00DD add ch, bl :760E1B48 0106 add dword ptr [esi], eax :760E1B4A 62DA bound ebx, edx :760E1B4C 0100 add dword ptr [eax], eax :760E1B4E 0000 add byte ptr [eax], al :760E1B50 045D add al, 5D :760E1B52 888AEB1CC911 mov byte ptr [edx+11C91CEB], cl :760E1B58 9F lahf :760E1B59 E808002B10 call 86391B66 :760E1B5E 48 dec eax :760E1B5F 60 pushad :760E1B60 0200 add al, byte ptr [eax] :760E1B62 0000 add byte ptr [eax], al :760E1B64 30D9 xor cl, bl :760E1B66 0F7600 pcmpeqd mm0, dword ptr [eax] :760E1B69 00000000000000000000 BYTE 10 DUP(0) :760E1B73 00000000000000000000 BYTE 10 DUP(0) :760E1B7D 000000 BYTE 3 DUP(0) :760E1B80 55 push ebp :760E1B81 8BEC mov ebp, esp :760E1B83 6AFF push FFFFFFFF :760E1B85 68A01C0E76 push 760E1CA0 :760E1B8A 68A6870F76 push 760F87A6 :760E1B8F 64A100000000 mov eax, dword ptr fs:[00000000] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1B30(C) | :760E1B95 50 push eax :760E1B96 64892500000000 mov dword ptr fs:[00000000], esp :760E1B9D 81ECD4000000 sub esp, 000000D4 :760E1BA3 53 push ebx :760E1BA4 56 push esi :760E1BA5 57 push edi :760E1BA6 68F81B0E76 push 760E1BF8 :760E1BAB 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760E1BB1 50 push eax :760E1BB2 8B7508 mov esi, dword ptr [ebp+08] :760E1BB5 56 push esi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760E1BB6 FF153C110E76 Call dword ptr [760E113C] :760E1BBC 8365FC00 and dword ptr [ebp-04], 00000000 * Reference To: SMGR._EnableFIFOS@0, Ord:0024h | :760E1BC0 E827000000 Call 760E1BEC :760E1BC5 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760E1BC9 E81D000000 call 760E1BEB :760E1BCE 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] :760E1BD4 2B4608 sub eax, dword ptr [esi+08] :760E1BD7 89460C mov dword ptr [esi+0C], eax :760E1BDA 8B4DF0 mov ecx, dword ptr [ebp-10] :760E1BDD 64890D00000000 mov dword ptr fs:[00000000], ecx :760E1BE4 5F pop edi :760E1BE5 5E pop esi :760E1BE6 5B pop ebx :760E1BE7 C9 leave :760E1BE8 C20400 ret 0004 * Referenced by a CALL at Address: |:760E1BC9 | * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6E75(U) | :760E1BEB C3 ret * Referenced by a CALL at Address: |:760E1BC0 | * Reference To: SMGR._EnableFIFOS@0, Ord:0024h | :760E1BEC FF2574110E76 Jmp dword ptr [760E1174] :760E1BF2 90 nop :760E1BF3 90 nop :760E1BF4 90 nop :760E1BF5 90 nop :760E1BF6 90 nop :760E1BF7 90 nop :760E1BF8 101A adc byte ptr [edx], bl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1BFB(C) | :760E1BFA 0E push cs :760E1BFB 76FD jbe 760E1BFA :760E1BFD 60 pushad :760E1BFE 0F7609 pcmpeqd mm1, dword ptr [ecx] :760E1C01 61 popad :760E1C02 0F7600 pcmpeqd mm0, dword ptr [eax] :760E1C05 00000000000000000000 BYTE 10 DUP(0) :760E1C0F 000000000000000000 BYTE 9 DUP(0) :760E1C18 4A dec edx :760E1C19 1C0E sbb al, 0E :760E1C1B 7600 jbe 760E1C1D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1C1B(C) | :760E1C1D 000000 BYTE 3 DUP(0) :760E1C20 0100 add dword ptr [eax], eax :760E1C22 0100 add dword ptr [eax], eax :760E1C24 00000000 BYTE 4 DUP(0) :760E1C28 17 pop ss :760E1C29 0103 add dword ptr [ebx], eax :760E1C2B 0500000000 add eax, 00000000 :760E1C30 0000000000000000 BYTE 8 DUP(0) :760E1C38 0100 add dword ptr [eax], eax :760E1C3A 00000000000000000000 BYTE 10 DUP(0) :760E1C44 0000000000000000 BYTE 8 DUP(0) :760E1C4C 1108 adc dword ptr [eax], ecx :760E1C4E 225C1208 and bl, byte ptr [edx+edx+08] :760E1C52 225C1100 and bl, byte ptr [ecx+edx] :760E1C56 0800 or byte ptr [eax], al :760E1C58 1D01080205 sbb eax, 05020801 :760E1C5D 5B pop ebx :760E1C5E 15030C024C adc eax, 4C020C03 :760E1C63 00F4 add ah, dh :760E1C65 FF08 dec dword ptr [eax] :760E1C67 5B pop ebx :760E1C68 1100 adc dword ptr [eax], eax :760E1C6A 0200 add al, byte ptr [eax] :760E1C6C 22444000 and al, byte ptr [eax+2*eax] :760E1C70 000412 add byte ptr [edx+edx], al :760E1C73 0008 add byte ptr [eax], cl :760E1C75 001D00400002 add byte ptr [02004000], bl :760E1C7B 5B pop ebx :760E1C7C 1507500008 adc eax, 08005007 :760E1C81 080B or byte ptr [ebx], cl :760E1C83 4C dec esp :760E1C84 00F1 add cl, dh :760E1C86 FF5B11 call far [ebx+11] :760E1C89 0402 add al, 02 :760E1C8B 001A add byte ptr [edx], bl :760E1C8D 07 pop es :760E1C8E 0C00 or al, 00 :760E1C90 00000000 BYTE 4 DUP(0) :760E1C94 080B or byte ptr [ebx], cl :760E1C96 5C pop esp :760E1C97 5B pop ebx :760E1C98 0000 add byte ptr [eax], al :760E1C9A 90 nop :760E1C9B 90 nop :760E1C9C 90 nop :760E1C9D 90 nop :760E1C9E 90 nop :760E1C9F 90 nop :760E1CA0 FFFFFFFF BYTE 4 DUP(0ffh) :760E1CA4 00000000 BYTE 4 DUP(0) :760E1CA8 726E jb 760E1D18 :760E1CAA 0F BYTE 0fh :760E1CAB 76 BYTE 76h * Referenced by a CALL at Addresses: |:760E1E76 , :760E1EAA , :760E1ED8 , :760E4DBD , :760EB47F |:760EC9CB , :760ED818 , :760ED8D6 , :760F49AD | :760E1CAC A184110E76 mov eax, dword ptr [760E1184] :760E1CB1 53 push ebx :760E1CB2 55 push ebp :760E1CB3 56 push esi * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E1CB4 8B3580110E76 mov esi, dword ptr [760E1180] :760E1CBA 57 push edi :760E1CBB 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"DoesDirExist" | :760E1CBD BD041D0E76 mov ebp, 760E1D04 :760E1CC2 5B pop ebx * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760E1CC3 BFA0D80F76 mov edi, 760FD8A0 :760E1CC8 8418 test byte ptr [eax], bl :760E1CCA 0F8590070100 jne 760F2460 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F246C(C), :760F2488(U) | :760E1CD0 FF742414 push [esp+14] * Reference To: KERNEL32.GetFileAttributesA, Ord:0120h | :760E1CD4 FF15C4110E76 Call dword ptr [760E11C4] :760E1CDA 83F8FF cmp eax, FFFFFFFF :760E1CDD 0F84AA070100 je 760F248D :760E1CE3 A810 test al, 10 :760E1CE5 A184110E76 mov eax, dword ptr [760E1184] :760E1CEA 0F84F7070100 je 760F24E7 :760E1CF0 8418 test byte ptr [eax], bl :760E1CF2 0F85C7070100 jne 760F24BF * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F24CB(C), :760F24E2(U) | :760E1CF8 6A01 push 00000001 :760E1CFA 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F250C(U) | :760E1CFB 5F pop edi :760E1CFC 5E pop esi :760E1CFD 5D pop ebp :760E1CFE 5B pop ebx :760E1CFF C20400 ret 0004 :760E1D02 90 nop :760E1D03 90 nop :760E1D04 44 inc esp :760E1D05 6F outsd :760E1D06 65 BYTE 065h :760E1D07 7344 jnb 760E1D4D :760E1D09 69724578697374 imul esi, dword ptr [edx+45], 74736978 :760E1D10 00 BYTE 0 * Referenced by a CALL at Addresses: |:760E1D93 , :760E3C04 , :760EF4FE | :760E1D11 55 push ebp :760E1D12 8BEC mov ebp, esp :760E1D14 56 push esi :760E1D15 57 push edi :760E1D16 FF7508 push [ebp+08] :760E1D19 8BF1 mov esi, ecx :760E1D1B 33FF xor edi, edi :760E1D1D E82FFCFFFF call 760E1951 :760E1D22 83F8FF cmp eax, FFFFFFFF :760E1D25 0F844F3E0100 je 760F5B7A :760E1D2B FF7508 push [ebp+08] :760E1D2E 8BCE mov ecx, esi :760E1D30 50 push eax :760E1D31 E88DFCFFFF call 760E19C3 :760E1D36 85C0 test eax, eax :760E1D38 0F857F3E0100 jne 760F5BBD * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5B82(C), :760F5BA1(C), :760F5BB8(U), :760F5BCA(C), :760F5BD8(C) |:760F5BE3(C), :760F5BFB(U) | :760E1D3E 8BC7 mov eax, edi :760E1D40 5F pop edi :760E1D41 5E pop esi :760E1D42 5D pop ebp :760E1D43 C20C00 ret 000C * Referenced by a CALL at Addresses: |:760EB6FE , :760ED527 , :760F0632 , :760F067E , :760F06BF |:760F07E1 , :760F63C9 | Exported fn(): SfpIsFileProtectedS - Ord:0020h :760E1D46 53 push ebx :760E1D47 8B1DD0D80F76 mov ebx, dword ptr [760FD8D0] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1D07(C) | :760E1D4D 56 push esi :760E1D4E BE4F050000 mov esi, 0000054F :760E1D53 85DB test ebx, ebx :760E1D55 0F8458C80000 je 760EE5B3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE5C9(C) | :760E1D5B 57 push edi :760E1D5C 68C0D40100 push 0001D4C0 :760E1D61 FF35D0D80F76 push dword ptr [760FD8D0] * Reference To: KERNEL32.WaitForSingleObject, Ord:02FDh | :760E1D67 FF1538120E76 Call dword ptr [760E1238] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1DDB(C) | :760E1D6D 85C0 test eax, eax :760E1D6F 0F85ABC80000 jne 760EE620 :760E1D75 BF00B00F76 mov edi, 760FB000 :760E1D7A 8BCF mov ecx, edi :760E1D7C E8B0030000 call 760E2131 :760E1D81 85C0 test eax, eax :760E1D83 0F84CBC80000 je 760EE654 :760E1D89 6A00 push 00000000 :760E1D8B 6A00 push 00000000 :760E1D8D FF742418 push [esp+18] :760E1D91 8BCF mov ecx, edi :760E1D93 E879FFFFFF call 760E1D11 :760E1D98 8BF0 mov esi, eax :760E1D9A 8BCF mov ecx, edi :760E1D9C 4E dec esi :760E1D9D F7DE neg esi :760E1D9F 1BF6 sbb esi, esi :760E1DA1 83E602 and esi, 00000002 :760E1DA4 E858050000 call 760E2301 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE628(C), :760EE647(C), :760EE65C(C), :760EE67B(C), :760EE692(U) | :760E1DA9 85DB test ebx, ebx :760E1DAB 5F pop edi :760E1DAC 740C je 760E1DBA :760E1DAE 3B1DD0D80F76 cmp ebx, dword ptr [760FD8D0] :760E1DB4 0F85DDC80000 jne 760EE697 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E1DAC(C), :760EE5D7(C), :760EE5F6(C), :760EE61B(U), :760EE69E(U) | :760E1DBA 8BC6 mov eax, esi :760E1DBC 5E pop esi :760E1DBD 5B pop ebx :760E1DBE C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E3A94 , :760E3DD0 , :760EF36A , :760EF68A | :760E1DC1 8B01 mov eax, dword ptr [ecx] :760E1DC3 85C0 test eax, eax :760E1DC5 740C je 760E1DD3 :760E1DC7 50 push eax :760E1DC8 6A00 push 00000000 :760E1DCA FF7104 push [ecx+04] * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760E1DCD FF15FC110E76 Call dword ptr [760E11FC] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1DC5(C) | :760E1DD3 C3 ret :760E1DD4 101E adc byte ptr [esi], bl :760E1DD6 0E push cs :760E1DD7 763E jbe 760E1E17 :760E1DD9 2B0F sub ecx, dword ptr [edi] :760E1DDB 7690 jbe 760E1D6D :760E1DDD 90 nop :760E1DDE 90 nop :760E1DDF 90 nop :760E1DE0 40 inc eax :760E1DE1 D9 BYTE 0d9h :760E1DE2 0F7600 pcmpeqd mm0, dword ptr [eax] :760E1DE5 00000000000000 BYTE 7 DUP(0) :760E1DEC FFFFFFFF BYTE 4 DUP(0ffh) :760E1DF0 0000000000000000 BYTE 8 DUP(0) :760E1DF8 E01D loopnz 760E1E17 :760E1DFA 0E push cs :760E1DFB 7600 jbe 760E1DFD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1DFB(C) | :760E1DFD 90 nop :760E1DFE 90 nop :760E1DFF 90 nop :760E1E00 0000000000000000 BYTE 8 DUP(0) :760E1E08 0100 add dword ptr [eax], eax :760E1E0A 0000 add byte ptr [eax], al :760E1E0C F8 clc :760E1E0D 1D0E760000 sbb eax, 0000760E :760E1E12 00000000000000000000 BYTE 10 DUP(0) :760E1E1C 40 inc eax :760E1E1D D9 BYTE 0d9h :760E1E1E 0F7600 pcmpeqd mm0, dword ptr [eax] :760E1E21 1E push ds :760E1E22 0E push cs :760E1E23 76 BYTE 76h * Referenced by a CALL at Addresses: |:760E20A5 , :760E3539 , :760EC919 | :760E1E24 55 push ebp :760E1E25 8BEC mov ebp, esp :760E1E27 81EC10030000 sub esp, 00000310 :760E1E2D A046170E76 mov al, byte ptr [760E1746] :760E1E32 56 push esi :760E1E33 57 push edi :760E1E34 8885F0FCFFFF mov byte ptr [ebp+FFFFFCF0], al :760E1E3A B9C2000000 mov ecx, 000000C2 :760E1E3F 33C0 xor eax, eax :760E1E41 8DBDF1FCFFFF lea edi, dword ptr [ebp+FFFFFCF1] :760E1E47 8365FC00 and dword ptr [ebp-04], 00000000 :760E1E4B F3 repz :760E1E4C AB stosd :760E1E4D 66AB stosw :760E1E4F AA stosb :760E1E50 BF0C030000 mov edi, 0000030C :760E1E55 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760E1E5B 57 push edi :760E1E5C 50 push eax * Possible StringData Ref from Code Obj ->"%windir%\system\sfp" | :760E1E5D 68301F0E76 push 760E1F30 :760E1E62 E8F1FBFFFF call 760E1A58 :760E1E67 85C0 test eax, eax :760E1E69 0F84D0990000 je 760EB83F :760E1E6F 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760E1E75 50 push eax :760E1E76 E831FEFFFF call 760E1CAC * Reference To: KERNEL32.CreateDirectoryA, Ord:0030h | :760E1E7B 8B3550120E76 mov esi, dword ptr [760E1250] :760E1E81 85C0 test eax, eax :760E1E83 0F84F9990000 je 760EB882 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB88F(C) | :760E1E89 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760E1E8F 57 push edi :760E1E90 50 push eax * Possible StringData Ref from Code Obj ->"%windir%\system\sfp\archive" | :760E1E91 68141F0E76 push 760E1F14 :760E1E96 E8BDFBFFFF call 760E1A58 :760E1E9B 85C0 test eax, eax :760E1E9D 0F843F9A0000 je 760EB8E2 :760E1EA3 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760E1EA9 50 push eax :760E1EAA E8FDFDFFFF call 760E1CAC :760E1EAF 85C0 test eax, eax :760E1EB1 0F84629A0000 je 760EB919 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB925(C) | :760E1EB7 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760E1EBD 57 push edi :760E1EBE 50 push eax * Possible StringData Ref from Code Obj ->"%windir%\system\sfp\tempcats" | :760E1EBF 68F41E0E76 push 760E1EF4 :760E1EC4 E88FFBFFFF call 760E1A58 :760E1EC9 85C0 test eax, eax :760E1ECB 0F849A9A0000 je 760EB96B :760E1ED1 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760E1ED7 50 push eax :760E1ED8 E8CFFDFFFF call 760E1CAC :760E1EDD 85C0 test eax, eax :760E1EDF 0F84BD9A0000 je 760EB9A2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB9AE(C) | :760E1EE5 C745FC01000000 mov [ebp-04], 00000001 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB847(C), :760EB866(C), :760EB87D(U), :760EB8A5(C), :760EB8C4(C) |:760EB8DD(U), :760EB8EA(C), :760EB909(C), :760EB93B(C), :760EB95A(C) |:760EB973(C), :760EB992(C), :760EB9C4(C), :760EB9E3(C) | :760E1EEC 8B45FC mov eax, dword ptr [ebp-04] :760E1EEF 5F pop edi :760E1EF0 5E pop esi :760E1EF1 C9 leave :760E1EF2 C3 ret :760E1EF3 90 nop :760E1EF4 2577696E64 and eax, 646E6977 :760E1EF9 6972255C737973 imul esi, dword ptr [edx+25], 7379735C :760E1F00 7465 je 760E1F67 :760E1F02 6D insd :760E1F03 5C pop esp :760E1F04 7366 jnb 760E1F6C :760E1F06 705C jo 760E1F64 :760E1F08 7465 je 760E1F6F :760E1F0A 6D insd :760E1F0B 7063 jo 760E1F70 :760E1F0D 61 popad :760E1F0E 7473 je 760E1F83 :760E1F10 009090902577 add byte ptr [eax+77259090], dl :760E1F16 696E646972255C imul ebp, dword ptr [esi+64], 5C257269 :760E1F1D 7379 jnb 760E1F98 :760E1F1F 7374 jnb 760E1F95 :760E1F21 65 BYTE 065h :760E1F22 6D insd :760E1F23 5C pop esp :760E1F24 7366 jnb 760E1F8C :760E1F26 705C jo 760E1F84 :760E1F28 61 popad :760E1F29 7263 jb 760E1F8E :760E1F2B 6869766500 push 00657669 :760E1F30 2577696E64 and eax, 646E6977 :760E1F35 6972255C737973 imul esi, dword ptr [edx+25], 7379735C :760E1F3C 7465 je 760E1FA3 :760E1F3E 6D insd :760E1F3F 5C pop esp :760E1F40 7366 jnb 760E1FA8 :760E1F42 7000 jo 760E1F44 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1F42(C) | :760E1F44 53 push ebx :760E1F45 6F outsd :760E1F46 667477 je 760E1FC0 :760E1F49 61 popad :760E1F4A 7265 jb 760E1FB1 :760E1F4C 5C pop esp :760E1F4D 4D dec ebp :760E1F4E 6963726F736F66 imul esp, dword ptr [ebx+72], 666F736F :760E1F55 745C je 760E1FB3 :760E1F57 57 push edi :760E1F58 696E646F77735C imul ebp, dword ptr [esi+64], 5C73776F :760E1F5F 43 inc ebx :760E1F60 7572 jne 760E1FD4 :760E1F62 7265 jb 760E1FC9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1F06(C) | :760E1F64 6E outsb :760E1F65 7456 je 760E1FBD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1F00(C) | :760E1F67 65 BYTE 065h :760E1F68 7273 jb 760E1FDD :760E1F6A 696F6E5C537973 imul ebp, dword ptr [edi+6E], 7379535C :760E1F71 7465 je 760E1FD8 :760E1F73 6D insd :760E1F74 46 inc esi :760E1F75 696C6550726F7465 imul ebp, dword ptr [ebp+50], 65746F72 :760E1F7D 6374696F arpl dword ptr [ecx+2*ebp+6F], esi :760E1F81 6E outsb :760E1F82 5C pop esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1F0E(C) | :760E1F83 00 BYTE 0 * Referenced by a CALL at Addresses: |:760E20F7 , :760E39C0 , :760ED462 | * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1F26(C) | :760E1F84 55 push ebp :760E1F85 8BEC mov ebp, esp :760E1F87 53 push ebx :760E1F88 56 push esi :760E1F89 33DB xor ebx, ebx :760E1F8B 8B750C mov esi, dword ptr [ebp+0C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1F29(C) | :760E1F8E 57 push edi :760E1F8F 53 push ebx :760E1F90 6880000000 push 00000080 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1F1F(C) | :760E1F95 6A03 push 00000003 :760E1F97 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1F1D(C) | :760E1F98 6A01 push 00000001 :760E1F9A 6800000080 push 80000000 :760E1F9F 891E mov dword ptr [esi], ebx :760E1FA1 FF7508 push [ebp+08] * Reference To: KERNEL32.CreateFileA, Ord:0037h | :760E1FA4 FF1580120E76 Call dword ptr [760E1280] :760E1FAA 83F8FF cmp eax, FFFFFFFF :760E1FAD 894508 mov dword ptr [ebp+08], eax :760E1FB0 0F84B1B00000 je 760ED067 :760E1FB6 8B7D10 mov edi, dword ptr [ebp+10] :760E1FB9 6A64 push 00000064 :760E1FBB 58 pop eax :760E1FBC 8907 mov dword ptr [edi], eax :760E1FBE 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED0EB(U) | :760E1FBF E871F9FFFF call 760E1935 :760E1FC4 3BC3 cmp eax, ebx :760E1FC6 8906 mov dword ptr [esi], eax :760E1FC8 0F8422B10000 je 760ED0F0 :760E1FCE 53 push ebx :760E1FCF 50 push eax :760E1FD0 57 push edi :760E1FD1 FF7508 push [ebp+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1F60(C) | * Reference To: WINTRUST.CryptCATAdminCalcHashFromFileHandle, Ord:0004h | :760E1FD4 E822000000 Call 760E1FFB :760E1FD9 85C0 test eax, eax :760E1FDB 0F84E0B00000 je 760ED0C1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED165(C) | :760E1FE1 33FF xor edi, edi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED0AE(C), :760ED0BC(U) | :760E1FE3 837D08FF cmp dword ptr [ebp+08], FFFFFFFF :760E1FE7 7409 je 760E1FF2 :760E1FE9 FF7508 push [ebp+08] * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760E1FEC FF1534120E76 Call dword ptr [760E1234] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1FE7(C) | :760E1FF2 8BC7 mov eax, edi :760E1FF4 5F pop edi :760E1FF5 5E pop esi :760E1FF6 5B pop ebx :760E1FF7 5D pop ebp :760E1FF8 C20C00 ret 000C * Referenced by a CALL at Address: |:760E1FD4 | * Reference To: WINTRUST.CryptCATAdminCalcHashFromFileHandle, Ord:0004h | :760E1FFB FF25D0100E76 Jmp dword ptr [760E10D0] :760E2001 90 nop :760E2002 90 nop :760E2003 90 nop :760E2004 53 push ebx :760E2005 667044 jo 760E204C :760E2008 624861 bound ecx, dword ptr [eax+61] :760E200B 7368 jnb 760E2075 :760E200D 00 BYTE 0 * Referenced by a CALL at Addresses: |:760E3DA8 , :760EBCBE | :760E200E 55 push ebp :760E200F 8BEC mov ebp, esp :760E2011 53 push ebx :760E2012 33DB xor ebx, ebx :760E2014 395D0C cmp dword ptr [ebp+0C], ebx :760E2017 56 push esi :760E2018 8B7508 mov esi, dword ptr [ebp+08] :760E201B 57 push edi :760E201C 0F84FA2B0100 je 760F4C1C :760E2022 395D10 cmp dword ptr [ebp+10], ebx :760E2025 0F8EF12B0100 jle 760F4C1C :760E202B 3BF3 cmp esi, ebx :760E202D 0F84E92B0100 je 760F4C1C :760E2033 399E44010000 cmp dword ptr [esi+00000144], ebx :760E2039 0F84CC2A0100 je 760F4B0B :760E203F 3919 cmp dword ptr [ecx], ebx :760E2041 0F84FC2A0100 je 760F4B43 :760E2047 8D4604 lea eax, dword ptr [esi+04] :760E204A 50 push eax :760E204B FF36 push dword ptr [esi] * Reference To: KERNEL32.FindNextFileA, Ord:00ACh | :760E204D FF15BC110E76 Call dword ptr [760E11BC] :760E2053 85C0 test eax, eax :760E2055 0F85582B0100 jne 760F4BB3 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760E205B FF15A0110E76 Call dword ptr [760E11A0] :760E2061 83F812 cmp eax, 00000012 :760E2064 0F85112B0100 jne 760F4B7B :760E206A FF36 push dword ptr [esi] :760E206C 899E44010000 mov dword ptr [esi+00000144], ebx * Reference To: KERNEL32.FindClose, Ord:009Fh | :760E2072 FF1584120E76 Call dword ptr [760E1284] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4C52(C), :760F4C62(C), :760F4C71(U) | :760E2078 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4C17(U) | :760E207A 5F pop edi :760E207B 5E pop esi :760E207C 5B pop ebx :760E207D 5D pop ebp :760E207E C20C00 ret 000C * Referenced by a CALL at Addresses: |:760E3DBD , :760EF291 , :760EF5AA | Exported fn(): SfpPersistSfpDb - Ord:0021h :760E2081 55 push ebp :760E2082 8BEC mov ebp, esp :760E2084 81EC14030000 sub esp, 00000314 :760E208A 8365FC00 and dword ptr [ebp-04], 00000000 :760E208E 56 push esi :760E208F 57 push edi :760E2090 BF00B00F76 mov edi, 760FB000 :760E2095 8BCF mov ecx, edi :760E2097 E895000000 call 760E2131 :760E209C 85C0 test eax, eax :760E209E 0F845FBA0000 je 760EDB03 :760E20A4 53 push ebx :760E20A5 E87AFDFFFF call 760E1E24 :760E20AA 85C0 test eax, eax :760E20AC 0F848EBA0000 je 760EDB40 :760E20B2 8D85ECFCFFFF lea eax, dword ptr [ebp+FFFFFCEC] :760E20B8 680C030000 push 0000030C :760E20BD 50 push eax * Possible StringData Ref from Code Obj ->"%windir%\system\sfp\sfpdb.sfp" | :760E20BE 687C1A0E76 push 760E1A7C :760E20C3 E890F9FFFF call 760E1A58 :760E20C8 85C0 test eax, eax :760E20CA 0F84ADBA0000 je 760EDB7D :760E20D0 8D85ECFCFFFF lea eax, dword ptr [ebp+FFFFFCEC] :760E20D6 8BCF mov ecx, edi :760E20D8 50 push eax :760E20D9 E8C8000000 call 760E21A6 :760E20DE 8BF0 mov esi, eax :760E20E0 85F6 test esi, esi :760E20E2 0F84C1BA0000 je 760EDBA9 :760E20E8 8D45F8 lea eax, dword ptr [ebp-08] :760E20EB 50 push eax :760E20EC 8D45FC lea eax, dword ptr [ebp-04] :760E20EF 50 push eax :760E20F0 8D85ECFCFFFF lea eax, dword ptr [ebp+FFFFFCEC] :760E20F6 50 push eax :760E20F7 E888FEFFFF call 760E1F84 :760E20FC 85C0 test eax, eax :760E20FE 0F85E8BA0000 jne 760EDBEC :760E2104 6A03 push 00000003 * Possible StringData Ref from Code Obj ->"SfpDbHash" | :760E2106 6804200E76 push 760E2004 * Possible StringData Ref from Code Obj ->"Software\Microsoft\Windows\CurrentVersion\Syst" ->"emFileProtection\" | :760E210B 68441F0E76 push 760E1F44 :760E2110 FF75F8 push [ebp-08] :760E2113 FF75FC push [ebp-04] :760E2116 E883010000 call 760E229E :760E211B 85C0 test eax, eax :760E211D 0F8410BB0000 je 760EDC33 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDB78(U), :760EDBB1(C), :760EDBD0(C), :760EDBE7(U), :760EDC43(C) |:760EDC62(C), :760EDC7B(U) | :760E2123 8BCF mov ecx, edi :760E2125 E8D7010000 call 760E2301 :760E212A 5B pop ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDB3B(U) | :760E212B 8BC6 mov eax, esi :760E212D 5F pop edi :760E212E 5E pop esi :760E212F C9 leave :760E2130 C3 ret * Referenced by a CALL at Addresses: |:760E1D7C , :760E2097 , :760EDE20 , :760EE0DA , :760EE6D3 |:760EE8AB | :760E2131 68A0BB0D00 push 000DBBA0 :760E2136 81C15C220000 add ecx, 0000225C * Reference To: SfpDll.?LockReadModeEx@CReadWriteLock@@QAEHH@Z | :760E213C E806000000 call 760E2147 :760E2141 F7D8 neg eax :760E2143 1BC0 sbb eax, eax :760E2145 40 inc eax :760E2146 C3 ret * Referenced by a CALL at Address: |:760E213C | Exported fn(): ?LockReadModeEx@CReadWriteLock@@QAEHH@Z - Ord:000Bh :760E2147 51 push ecx :760E2148 53 push ebx * Reference To: KERNEL32.EnterCriticalSection, Ord:006Fh | :760E2149 8B1D40120E76 mov ebx, dword ptr [760E1240] :760E214F 55 push ebp :760E2150 8364240800 and dword ptr [esp+08], 00000000 :760E2155 56 push esi :760E2156 8BF1 mov esi, ecx :760E2158 57 push edi :760E2159 8D7E1C lea edi, dword ptr [esi+1C] :760E215C 57 push edi :760E215D FFD3 call ebx * Reference To: KERNEL32.LeaveCriticalSection, Ord:01DEh | :760E215F 8B2D3C120E76 mov ebp, dword ptr [760E123C] :760E2165 57 push edi :760E2166 FFD5 call ebp :760E2168 8D7E04 lea edi, dword ptr [esi+04] :760E216B 57 push edi :760E216C FFD3 call ebx :760E216E 837E3400 cmp dword ptr [esi+34], 00000000 :760E2172 7520 jne 760E2194 :760E2174 8B06 mov eax, dword ptr [esi] :760E2176 85C0 test eax, eax :760E2178 741A je 760E2194 :760E217A FF742418 push [esp+18] :760E217E 50 push eax * Reference To: KERNEL32.WaitForSingleObject, Ord:02FDh | :760E217F FF1538120E76 Call dword ptr [760E1238] :760E2185 33C9 xor ecx, ecx :760E2187 3D02010000 cmp eax, 00000102 :760E218C 0F95C1 setne cl :760E218F 49 dec ecx :760E2190 894C2410 mov dword ptr [esp+10], ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2172(C), :760E2178(C) | :760E2194 FF4634 inc [esi+34] :760E2197 57 push edi :760E2198 FFD5 call ebp :760E219A 8B442410 mov eax, dword ptr [esp+10] :760E219E 5F pop edi :760E219F 5E pop esi :760E21A0 5D pop ebp :760E21A1 5B pop ebx :760E21A2 59 pop ecx :760E21A3 C20400 ret 0004 * Referenced by a CALL at Address: |:760E20D9 | :760E21A6 83EC0C sub esp, 0000000C :760E21A9 53 push ebx :760E21AA 55 push ebp * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E21AB 8B2D80110E76 mov ebp, dword ptr [760E1180] :760E21B1 56 push esi :760E21B2 8B74241C mov esi, dword ptr [esp+1C] :760E21B6 57 push edi :760E21B7 85F6 test esi, esi :760E21B9 8BF9 mov edi, ecx :760E21BB C744241801000000 mov [esp+18], 00000001 :760E21C3 BB7CD90F76 mov ebx, 760FD97C :760E21C8 0F84963C0100 je 760F5E64 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5E94(U) | :760E21CE 68E8250E76 push 760E25E8 :760E21D3 56 push esi * Reference To: MSVCRT.fopen, Ord:0254h | :760E21D4 FF153C100E76 Call dword ptr [760E103C] :760E21DA 59 pop ecx :760E21DB 89442424 mov dword ptr [esp+24], eax :760E21DF 85C0 test eax, eax :760E21E1 59 pop ecx :760E21E2 0F84B13C0100 je 760F5E99 * Reference To: MSVCRT.fprintf, Ord:0255h | :760E21E8 8B1D68100E76 mov ebx, dword ptr [760E1068] :760E21EE 81C70C030000 add edi, 0000030C :760E21F4 897C2410 mov dword ptr [esp+10], edi :760E21F8 C7442414D3070000 mov [esp+14], 000007D3 :760E2200 EB5E jmp 760E2260 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2266(U) | :760E2202 8B7704 mov esi, dword ptr [edi+04] :760E2205 85F6 test esi, esi :760E2207 7432 je 760E223B :760E2209 8D6F08 lea ebp, dword ptr [edi+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2237(C) | :760E220C 8B4608 mov eax, dword ptr [esi+08] :760E220F 8B5604 mov edx, dword ptr [esi+04] :760E2212 83C004 add eax, 00000004 :760E2215 50 push eax :760E2216 8B06 mov eax, dword ptr [esi] :760E2218 FF36 push dword ptr [esi] :760E221A 6A20 push 00000020 :760E221C 59 pop ecx :760E221D E85F000000 call 760E2281 :760E2222 50 push eax :760E2223 55 push ebp :760E2224 68CC250E76 push 760E25CC :760E2229 FF742434 push [esp+34] :760E222D FFD3 call ebx :760E222F 8B760C mov esi, dword ptr [esi+0C] :760E2232 83C418 add esp, 00000018 :760E2235 85F6 test esi, esi :760E2237 75D3 jne 760E220C :760E2239 EB25 jmp 760E2260 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2207(C) | :760E223B 8D4708 lea eax, dword ptr [edi+08] :760E223E 50 push eax * Possible StringData Ref from Code Obj ->"%s,,," | :760E223F 68E0250E76 push 760E25E0 :760E2244 FF742428 push [esp+28] :760E2248 FFD3 call ebx :760E224A 83C40C add esp, 0000000C :760E224D EB11 jmp 760E2260 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2264(C) | :760E224F 8B7C2410 mov edi, dword ptr [esp+10] :760E2253 83C704 add edi, 00000004 :760E2256 FF4C2414 dec [esp+14] :760E225A 897C2410 mov dword ptr [esp+10], edi :760E225E 7408 je 760E2268 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2200(U), :760E2239(U), :760E224D(U) | :760E2260 8B3F mov edi, dword ptr [edi] :760E2262 85FF test edi, edi :760E2264 74E9 je 760E224F :760E2266 EB9A jmp 760E2202 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E225E(C) | :760E2268 FF742420 push [esp+20] * Reference To: MSVCRT.fclose, Ord:0249h | :760E226C FF1538100E76 Call dword ptr [760E1038] :760E2272 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5ECE(U) | :760E2273 8B442418 mov eax, dword ptr [esp+18] :760E2277 5F pop edi :760E2278 5E pop esi :760E2279 5D pop ebp :760E227A 5B pop ebx :760E227B 83C40C add esp, 0000000C :760E227E C20400 ret 0004 * Referenced by a CALL at Address: |:760E221D | :760E2281 80F940 cmp cl, 40 :760E2284 0F832E650100 jnb 760F87B8 :760E228A 80F920 cmp cl, 20 :760E228D 0F821F650100 jb 760F87B2 :760E2293 8BC2 mov eax, edx :760E2295 C1FA1F sar edx, 1F :760E2298 80E11F and cl, 1F :760E229B D3F8 sar eax, cl :760E229D C3 ret * Referenced by a CALL at Addresses: |:760E2116 , :760EC025 , :760EF728 , :760EFABA , :760F27D0 | :760E229E 55 push ebp :760E229F 8BEC mov ebp, esp :760E22A1 51 push ecx :760E22A2 56 push esi :760E22A3 8D45FC lea eax, dword ptr [ebp-04] :760E22A6 57 push edi :760E22A7 50 push eax :760E22A8 8D4510 lea eax, dword ptr [ebp+10] :760E22AB 33F6 xor esi, esi :760E22AD 50 push eax :760E22AE 56 push esi :760E22AF 6806000200 push 00020006 :760E22B4 56 push esi :760E22B5 56 push esi :760E22B6 56 push esi :760E22B7 FF7510 push [ebp+10] :760E22BA 6802000080 push 80000002 * Reference To: ADVAPI32.RegCreateKeyExA, Ord:0188h | :760E22BF FF15BC120E76 Call dword ptr [760E12BC] :760E22C5 8BF8 mov edi, eax :760E22C7 3BFE cmp edi, esi :760E22C9 0F8570040100 jne 760F273F :760E22CF FF750C push [ebp+0C] :760E22D2 FF7508 push [ebp+08] :760E22D5 FF7518 push [ebp+18] :760E22D8 56 push esi :760E22D9 FF7514 push [ebp+14] :760E22DC FF7510 push [ebp+10] * Reference To: ADVAPI32.RegSetValueExA, Ord:01B2h | :760E22DF FF15AC120E76 Call dword ptr [760E12AC] :760E22E5 8BF8 mov edi, eax :760E22E7 3BFE cmp edi, esi :760E22E9 0F858A040100 jne 760F2779 :760E22EF FF7510 push [ebp+10] * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760E22F2 FF15B0120E76 Call dword ptr [760E12B0] :760E22F8 6A01 push 00000001 :760E22FA 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F27BC(U) | :760E22FB 5F pop edi :760E22FC 5E pop esi :760E22FD C9 leave :760E22FE C21400 ret 0014 * Referenced by a CALL at Addresses: |:760E1DA4 , :760E2125 , :760EDE89 , :760EE1E9 , :760EE884 |:760EE9E7 | :760E2301 81C15C220000 add ecx, 0000225C * Reference To: SfpDll.?UnlockReadMode@CReadWriteLock@@QAEXXZ | :760E2307 E804000000 call 760E2310 :760E230C 6A01 push 00000001 :760E230E 58 pop eax :760E230F C3 ret * Referenced by a CALL at Addresses: |:760E2307 , :760EB081 | Exported fn(): ?UnlockReadMode@CReadWriteLock@@QAEXXZ - Ord:0015h :760E2310 56 push esi :760E2311 8BF1 mov esi, ecx :760E2313 57 push edi :760E2314 8D7E04 lea edi, dword ptr [esi+04] :760E2317 57 push edi * Reference To: KERNEL32.EnterCriticalSection, Ord:006Fh | :760E2318 FF1540120E76 Call dword ptr [760E1240] :760E231E FF4E34 dec [esi+34] :760E2321 750D jne 760E2330 :760E2323 8B36 mov esi, dword ptr [esi] :760E2325 85F6 test esi, esi :760E2327 7407 je 760E2330 :760E2329 56 push esi * Reference To: KERNEL32.SetEvent, Ord:0290h | :760E232A FF15A4110E76 Call dword ptr [760E11A4] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2321(C), :760E2327(C) | :760E2330 57 push edi * Reference To: KERNEL32.LeaveCriticalSection, Ord:01DEh | :760E2331 FF153C120E76 Call dword ptr [760E123C] :760E2337 5F pop edi :760E2338 5E pop esi :760E2339 C3 ret * Referenced by a CALL at Addresses: |:760E3DD8 , :760F2B41 , :760F6F24 | :760E233A 53 push ebx :760E233B 55 push ebp :760E233C 56 push esi :760E233D 57 push edi :760E233E 8BF9 mov edi, ecx :760E2340 6A03 push 00000003 :760E2342 5D pop ebp :760E2343 33DB xor ebx, ebx :760E2345 C707D81D0E76 mov dword ptr [edi], 760E1DD8 :760E234B 8D7724 lea esi, dword ptr [edi+24] :760E234E EB25 jmp 760E2375 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E237C(U) | :760E2350 8B08 mov ecx, dword ptr [eax] :760E2352 50 push eax :760E2353 FF5108 call [ecx+08] :760E2356 895EE8 mov dword ptr [esi-18], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E237A(C) | :760E2359 8B06 mov eax, dword ptr [esi] :760E235B 3BC3 cmp eax, ebx :760E235D 751F jne 760E237E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2386(U) | :760E235F 8B46F4 mov eax, dword ptr [esi-0C] :760E2362 3BC3 cmp eax, ebx :760E2364 7409 je 760E236F :760E2366 8B08 mov ecx, dword ptr [eax] :760E2368 50 push eax :760E2369 FF5108 call [ecx+08] :760E236C 895EF4 mov dword ptr [esi-0C], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2364(C) | :760E236F 83C604 add esi, 00000004 :760E2372 4D dec ebp :760E2373 7413 je 760E2388 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E234E(U) | :760E2375 8B46E8 mov eax, dword ptr [esi-18] :760E2378 3BC3 cmp eax, ebx :760E237A 74DD je 760E2359 :760E237C EBD2 jmp 760E2350 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E235D(C) | :760E237E 8B08 mov ecx, dword ptr [eax] :760E2380 50 push eax :760E2381 FF5108 call [ecx+08] :760E2384 891E mov dword ptr [esi], ebx :760E2386 EBD7 jmp 760E235F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2373(C) | :760E2388 8B4708 mov eax, dword ptr [edi+08] :760E238B 3BC3 cmp eax, ebx :760E238D 7409 je 760E2398 :760E238F 8B08 mov ecx, dword ptr [eax] :760E2391 50 push eax :760E2392 FF5108 call [ecx+08] :760E2395 895F08 mov dword ptr [edi+08], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E238D(C) | :760E2398 33F6 xor esi, esi :760E239A 395F04 cmp dword ptr [edi+04], ebx :760E239D 7E0C jle 760E23AB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E23A9(C) | * Reference To: OLE32.CoUninitialize, Ord:0059h | :760E239F FF15AC100E76 Call dword ptr [760E10AC] :760E23A5 46 inc esi :760E23A6 3B7704 cmp esi, dword ptr [edi+04] :760E23A9 7CF4 jl 760E239F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E239D(C) | :760E23AB 5F pop edi :760E23AC 5E pop esi :760E23AD 5D pop ebp :760E23AE 5B pop ebx :760E23AF C3 ret * Referenced by a CALL at Addresses: |:760E3691 , :760EB43A , :760EB7C9 , :760EBC51 , :760EE3DA |:760EE53C , :760EE59F , :760EED40 , :760EEF09 , :760EF2F1 |:760EF680 , :760F057B , :760F05C4 , :760F1464 | :760E23B0 55 push ebp :760E23B1 8BEC mov ebp, esp :760E23B3 6AFF push FFFFFFFF :760E23B5 68C0250E76 push 760E25C0 :760E23BA 68A6870F76 push 760F87A6 :760E23BF 64A100000000 mov eax, dword ptr fs:[00000000] :760E23C5 50 push eax :760E23C6 64892500000000 mov dword ptr fs:[00000000], esp :760E23CD 81EC2C020000 sub esp, 0000022C :760E23D3 53 push ebx :760E23D4 56 push esi :760E23D5 57 push edi :760E23D6 8BF1 mov esi, ecx :760E23D8 89B5C4FDFFFF mov dword ptr [ebp+FFFFFDC4], esi :760E23DE 33DB xor ebx, ebx :760E23E0 899DD4FDFFFF mov dword ptr [ebp+FFFFFDD4], ebx :760E23E6 53 push ebx :760E23E7 6800000010 push 10000000 :760E23EC 6A04 push 00000004 :760E23EE 53 push ebx :760E23EF 6A03 push 00000003 :760E23F1 68000000C0 push C0000000 :760E23F6 FF7608 push [esi+08] * Reference To: KERNEL32.CreateFileA, Ord:0037h | :760E23F9 FF1580120E76 Call dword ptr [760E1280] :760E23FF 8945E4 mov dword ptr [ebp-1C], eax :760E2402 83F8FF cmp eax, FFFFFFFF :760E2405 0F84D21B0100 je 760F3FDD :760E240B 8B4604 mov eax, dword ptr [esi+04] :760E240E 3BC3 cmp eax, ebx :760E2410 0F84191C0100 je 760F402F :760E2416 8B7D08 mov edi, dword ptr [ebp+08] :760E2419 3B7E0C cmp edi, dword ptr [esi+0C] :760E241C 0F871C1C0100 ja 760F403E :760E2422 6884030000 push 00000384 :760E2427 50 push eax * Reference To: KERNEL32.WaitForSingleObject, Ord:02FDh | :760E2428 FF1538120E76 Call dword ptr [760E1238] :760E242E B902010000 mov ecx, 00000102 :760E2433 3BC1 cmp eax, ecx :760E2435 0F840E1C0100 je 760F4049 :760E243B 895DFC mov dword ptr [ebp-04], ebx :760E243E 6A02 push 00000002 :760E2440 53 push ebx :760E2441 53 push ebx :760E2442 FF75E4 push [ebp-1C] * Reference To: KERNEL32.SetFilePointer, Ord:0295h | :760E2445 FF15D4110E76 Call dword ptr [760E11D4] :760E244B 83F8FF cmp eax, FFFFFFFF :760E244E 0F84001C0100 je 760F4054 :760E2454 8D45D4 lea eax, dword ptr [ebp-2C] :760E2457 50 push eax * Reference To: KERNEL32.GetLocalTime, Ord:012Fh | :760E2458 FF151C120E76 Call dword ptr [760E121C] :760E245E FF750C push [ebp+0C] :760E2461 0FB745E2 movzx eax, word ptr [ebp-1E] :760E2465 50 push eax :760E2466 0FB745E0 movzx eax, word ptr [ebp-20] :760E246A 50 push eax :760E246B 0FB745DE movzx eax, word ptr [ebp-22] :760E246F 50 push eax :760E2470 0FB745DC movzx eax, word ptr [ebp-24] :760E2474 50 push eax :760E2475 0FB745D4 movzx eax, word ptr [ebp-2C] :760E2479 50 push eax :760E247A 0FB745DA movzx eax, word ptr [ebp-26] :760E247E 50 push eax :760E247F 0FB745D6 movzx eax, word ptr [ebp-2A] :760E2483 50 push eax :760E2484 FF34BD64D90F76 push dword ptr [4*edi+760FD964] * Possible StringData Ref from Code Obj ->"%s [%02d/%02d/%d %02d:%02d:%02d:%03d] " ->"%s" | :760E248B 6890250E76 push 760E2590 :760E2490 8D85DCFDFFFF lea eax, dword ptr [ebp+FFFFFDDC] :760E2496 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760E2497 FF1530100E76 Call dword ptr [760E1030] :760E249D 83C42C add esp, 0000002C :760E24A0 53 push ebx :760E24A1 8D45D0 lea eax, dword ptr [ebp-30] :760E24A4 50 push eax :760E24A5 8DBDDCFDFFFF lea edi, dword ptr [ebp+FFFFFDDC] :760E24AB 83C9FF or ecx, FFFFFFFF :760E24AE 33C0 xor eax, eax :760E24B0 F2 repnz :760E24B1 AE scasb :760E24B2 F7D1 not ecx :760E24B4 49 dec ecx :760E24B5 51 push ecx :760E24B6 8D85DCFDFFFF lea eax, dword ptr [ebp+FFFFFDDC] :760E24BC 50 push eax :760E24BD FF75E4 push [ebp-1C] * Reference To: KERNEL32.WriteFile, Ord:030Eh | :760E24C0 FF15B8110E76 Call dword ptr [760E11B8] :760E24C6 85C0 test eax, eax :760E24C8 0F84CE1B0100 je 760F409C :760E24CE 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760E24D2 E834000000 call 760E250B :760E24D7 395D10 cmp dword ptr [ebp+10], ebx :760E24DA 0F85131C0100 jne 760F40F3 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3FF1(C), :760F4010(C), :760F402A(U), :760F4039(U), :760F4044(U) |:760F404F(U), :760F40EE(U), :760F4147(U), :760F4172(C), :760F417F(U) | :760E24E0 395DE4 cmp dword ptr [ebp-1C], ebx :760E24E3 740F je 760E24F4 :760E24E5 837DE4FF cmp dword ptr [ebp-1C], FFFFFFFF :760E24E9 7409 je 760E24F4 :760E24EB FF75E4 push [ebp-1C] * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760E24EE FF1534120E76 Call dword ptr [760E1234] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E24E3(C), :760E24E9(C) | :760E24F4 8B85D4FDFFFF mov eax, dword ptr [ebp+FFFFFDD4] :760E24FA 8B4DF0 mov ecx, dword ptr [ebp-10] :760E24FD 64890D00000000 mov dword ptr fs:[00000000], ecx :760E2504 5F pop edi :760E2505 5E pop esi :760E2506 5B pop ebx :760E2507 C9 leave :760E2508 C20C00 ret 000C * Referenced by a CALL at Address: |:760E24D2 | * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4154(U) | :760E250B 53 push ebx :760E250C 6A01 push 00000001 :760E250E FF7604 push [esi+04] * Reference To: KERNEL32.ReleaseSemaphore, Ord:024Ah | :760E2511 FF1524120E76 Call dword ptr [760E1224] :760E2517 C3 ret Exported fn(): SfpRebootIfNecessary - Ord:0012h :760E2518 51 push ecx :760E2519 55 push ebp :760E251A 56 push esi :760E251B 33F6 xor esi, esi :760E251D C744240801000000 mov [esp+08], 00000001 :760E2525 3935A4D90F76 cmp dword ptr [760FD9A4], esi :760E252B 0F8598A60000 jne 760ECBC9 :760E2531 A184110E76 mov eax, dword ptr [760E1184] :760E2536 F60004 test byte ptr [eax], 04 :760E2539 0F8561A60000 jne 760ECBA0 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECBB9(C), :760ECC31(U), :760ECC4A(C), :760ECC69(C), :760ECC80(U) |:760ECD67(C), :760ECD74(U) | :760E253F 8B442408 mov eax, dword ptr [esp+08] :760E2543 5E pop esi :760E2544 5D pop ebp :760E2545 59 pop ecx :760E2546 C3 ret :760E2547 90 nop :760E2548 44 inc esp :760E2549 45 inc ebp :760E254A 42 inc edx :760E254B 55 push ebp :760E254C 47 inc edi :760E254D 2020 and byte ptr [eax], ah :760E254F 203A and byte ptr [edx], bh :760E2551 0090904D494E add byte ptr [eax+4E494D90], dl :760E2557 49 dec ecx :760E2558 4D dec ebp :760E2559 41 inc ecx :760E255A 4C dec esp :760E255B 203A and byte ptr [edx], bh :760E255D 0090904E4F52 add byte ptr [eax+524F4E90], dl :760E2563 4D dec ebp :760E2564 41 inc ecx :760E2565 4C dec esp :760E2566 2020 and byte ptr [eax], ah :760E2568 3A00 cmp al, byte ptr [eax] :760E256A 90 nop :760E256B 90 nop :760E256C 55 push ebp :760E256D 4E dec esi :760E256E 44 inc esp :760E256F 45 inc ebp :760E2570 46 inc esi :760E2571 2020 and byte ptr [eax], ah :760E2573 203A and byte ptr [edx], bh :760E2575 009090435249 add byte ptr [eax+49524390], dl :760E257B 54 push esp :760E257C 49 dec ecx :760E257D 43 inc ebx :760E257E 41 inc ecx :760E257F 4C dec esp :760E2580 3A00 cmp al, byte ptr [eax] :760E2582 90 nop :760E2583 90 nop :760E2584 4E dec esi :760E2585 6F outsd :760E2586 6E outsb :760E2587 652020 and byte ptr gs:[eax], ah :760E258A 2020 and byte ptr [eax], ah :760E258C 3A00 cmp al, byte ptr [eax] :760E258E 90 nop :760E258F 90 nop :760E2590 2573205B25 and eax, 255B2073 :760E2595 3032 xor byte ptr [edx], dh :760E2597 64 BYTE 064h :760E2598 2F das :760E2599 253032642F and eax, 2F643230 :760E259E 2564202530 and eax, 30252064 :760E25A3 32643A25 xor ah, byte ptr [edx+edi+25] :760E25A7 3032 xor byte ptr [edx], dh :760E25A9 643A253032643A cmp ah, byte ptr fs:[3A643230] :760E25B0 253033645D and eax, 5D643330 :760E25B5 2025730D0A00 and byte ptr [000A0D73], ah :760E25BB 90 nop :760E25BC 90 nop :760E25BD 90 nop :760E25BE 90 nop :760E25BF 90 nop :760E25C0 FFFFFFFF BYTE 4 DUP(0ffh) :760E25C4 00000000 BYTE 4 DUP(0) :760E25C8 4C dec esp :760E25C9 41 inc ecx :760E25CA 0F7625732C2530 pcmpeqd mm4, dword ptr [30252C73] :760E25D1 38582C cmp byte ptr [eax+2C], bl :760E25D4 253038582C and eax, 2C583830 :760E25D9 25730A0090 and eax, 90000A73 :760E25DE 90 nop :760E25DF 90 nop :760E25E0 25732C2C2C and eax, 2C2C2C73 :760E25E5 0A00 or al, byte ptr [eax] :760E25E7 90 nop :760E25E8 7700 ja 760E25EA * Referenced by a CALL at Addresses: |:760E2713 , :760E3B5D , :760E3C8E , :760EFD65 | * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E25E8(C) | :760E25EA 53 push ebx :760E25EB 55 push ebp :760E25EC 8B6C240C mov ebp, dword ptr [esp+0C] :760E25F0 56 push esi :760E25F1 57 push edi :760E25F2 8BF9 mov edi, ecx :760E25F4 55 push ebp :760E25F5 E857F3FFFF call 760E1951 :760E25FA 8BD8 mov ebx, eax :760E25FC 33F6 xor esi, esi :760E25FE 83FBFF cmp ebx, FFFFFFFF :760E2601 0F84112F0100 je 760F5518 :760E2607 55 push ebp :760E2608 53 push ebx :760E2609 8BCF mov ecx, edi :760E260B E8B3F3FFFF call 760E19C3 :760E2610 8BF0 mov esi, eax :760E2612 85F6 test esi, esi :760E2614 7537 jne 760E264D :760E2616 55 push ebp * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760E2617 FF1554120E76 Call dword ptr [760E1254] :760E261D 83C009 add eax, 00000009 :760E2620 50 push eax :760E2621 E80FF3FFFF call 760E1935 :760E2626 8BF0 mov esi, eax :760E2628 85F6 test esi, esi :760E262A 0F842B2F0100 je 760F555B :760E2630 8D4608 lea eax, dword ptr [esi+08] :760E2633 55 push ebp :760E2634 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760E2635 FF1504120E76 Call dword ptr [760E1204] :760E263B 8B8C9F0C030000 mov ecx, dword ptr [edi+4*ebx+0000030C] :760E2642 8D849F0C030000 lea eax, dword ptr [edi+4*ebx+0000030C] :760E2649 890E mov dword ptr [esi], ecx :760E264B 8930 mov dword ptr [eax], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2614(C) | :760E264D 8B8794220000 mov eax, dword ptr [edi+00002294] :760E2653 8D8F94220000 lea ecx, dword ptr [edi+00002294] :760E2659 33D2 xor edx, edx :760E265B BFA0860100 mov edi, 000186A0 :760E2660 F7F7 div edi :760E2662 42 inc edx :760E2663 8911 mov dword ptr [ecx], edx :760E2665 A184110E76 mov eax, dword ptr [760E1184] :760E266A F60004 test byte ptr [eax], 04 :760E266D 0F851C2F0100 jne 760F558F * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5520(C), :760F553F(C), :760F5556(U), :760F5563(C), :760F5582(C) |:760F55A8(C), :760F55C1(U) | :760E2673 8BC6 mov eax, esi :760E2675 5F pop edi :760E2676 5E pop esi :760E2677 5D pop ebp :760E2678 5B pop ebx :760E2679 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E2B31 , :760E33AB | :760E267C 8B442408 mov eax, dword ptr [esp+08] :760E2680 8B4C2410 mov ecx, dword ptr [esp+10] :760E2684 0BC8 or ecx, eax :760E2686 8B4C240C mov ecx, dword ptr [esp+0C] :760E268A 7509 jne 760E2695 :760E268C 8B442404 mov eax, dword ptr [esp+04] :760E2690 F7E1 mul ecx :760E2692 C21000 ret 0010 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E268A(C) | :760E2695 53 push ebx :760E2696 F7E1 mul ecx :760E2698 8BD8 mov ebx, eax :760E269A 8B442408 mov eax, dword ptr [esp+08] :760E269E F7642414 mul [esp+14] :760E26A2 03D8 add ebx, eax :760E26A4 8B442408 mov eax, dword ptr [esp+08] :760E26A8 F7E1 mul ecx :760E26AA 03D3 add edx, ebx :760E26AC 5B pop ebx :760E26AD C21000 ret 0010 * Referenced by a CALL at Addresses: |:760E2DAA , :760E3289 , :760EF247 | :760E26B0 55 push ebp :760E26B1 8BEC mov ebp, esp :760E26B3 51 push ecx :760E26B4 53 push ebx :760E26B5 33DB xor ebx, ebx :760E26B7 395D14 cmp dword ptr [ebp+14], ebx :760E26BA 56 push esi :760E26BB 57 push edi :760E26BC 8BF9 mov edi, ecx :760E26BE C745FC01000000 mov [ebp-04], 00000001 :760E26C5 0F8483000000 je 760E274E :760E26CB 6846170E76 push 760E1746 :760E26D0 FF7514 push [ebp+14] * Reference To: KERNEL32.lstrcmpA, Ord:0329h | :760E26D3 FF1564120E76 Call dword ptr [760E1264] :760E26D9 85C0 test eax, eax :760E26DB 7471 je 760E274E :760E26DD 6A10 push 00000010 :760E26DF E851F2FFFF call 760E1935 :760E26E4 8BF0 mov esi, eax :760E26E6 3BF3 cmp esi, ebx :760E26E8 0F84F12F0100 je 760F56DF :760E26EE FF7514 push [ebp+14] :760E26F1 8BCF mov ecx, edi :760E26F3 E8C3000000 call 760E27BB :760E26F8 3BC3 cmp eax, ebx :760E26FA 0F841D300100 je 760F571D :760E2700 894608 mov dword ptr [esi+08], eax :760E2703 8B450C mov eax, dword ptr [ebp+0C] :760E2706 8906 mov dword ptr [esi], eax :760E2708 8B4510 mov eax, dword ptr [ebp+10] :760E270B 894604 mov dword ptr [esi+04], eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2750(U) | :760E270E FF7508 push [ebp+08] :760E2711 8BCF mov ecx, edi :760E2713 E8D2FEFFFF call 760E25EA :760E2718 8BF8 mov edi, eax :760E271A 3BFB cmp edi, ebx :760E271C 0F8439300100 je 760F575B :760E2722 3BF3 cmp esi, ebx :760E2724 741E je 760E2744 :760E2726 8B4704 mov eax, dword ptr [edi+04] :760E2729 85C0 test eax, eax :760E272B 7532 jne 760E275F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E27AB(C) | :760E272D 8B4704 mov eax, dword ptr [edi+04] :760E2730 89460C mov dword ptr [esi+0C], eax :760E2733 897704 mov dword ptr [edi+04], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E27B6(U) | :760E2736 A184110E76 mov eax, dword ptr [760E1184] :760E273B F60004 test byte ptr [eax], 04 :760E273E 0F8595300100 jne 760F57D9 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2724(C), :760E27A2(C), :760F5718(U), :760F57B0(C), :760F57D4(U) |:760F57F2(C), :760F5813(U) | :760E2744 8B45FC mov eax, dword ptr [ebp-04] :760E2747 5F pop edi :760E2748 5E pop esi :760E2749 5B pop ebx :760E274A C9 leave :760E274B C21000 ret 0010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E26C5(C), :760E26DB(C) | :760E274E 33F6 xor esi, esi :760E2750 EBBC jmp 760E270E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2767(U) | :760E2752 7C02 jl 760E2756 :760E2754 EB13 jmp 760E2769 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2752(C), :760E276E(C) | :760E2756 8BD8 mov ebx, eax :760E2758 8B400C mov eax, dword ptr [eax+0C] :760E275B 85C0 test eax, eax :760E275D 744A je 760E27A9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E272B(C) | :760E275F 8B4D10 mov ecx, dword ptr [ebp+10] :760E2762 3B4804 cmp ecx, dword ptr [eax+04] :760E2765 7F09 jg 760E2770 :760E2767 EBE9 jmp 760E2752 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2754(U) | :760E2769 8B550C mov edx, dword ptr [ebp+0C] :760E276C 3B10 cmp edx, dword ptr [eax] :760E276E 72E6 jb 760E2756 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2765(C) | :760E2770 8B550C mov edx, dword ptr [ebp+0C] :760E2773 3B10 cmp edx, dword ptr [eax] :760E2775 7532 jne 760E27A9 :760E2777 3B4804 cmp ecx, dword ptr [eax+04] :760E277A 752D jne 760E27A9 :760E277C 8B4008 mov eax, dword ptr [eax+08] :760E277F 85C0 test eax, eax :760E2781 7426 je 760E27A9 :760E2783 FF7514 push [ebp+14] :760E2786 83C004 add eax, 00000004 :760E2789 50 push eax * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760E278A FF1558120E76 Call dword ptr [760E1258] :760E2790 85C0 test eax, eax :760E2792 7515 jne 760E27A9 :760E2794 56 push esi :760E2795 E855F2FFFF call 760E19EF :760E279A A184110E76 mov eax, dword ptr [760E1184] :760E279F F60004 test byte ptr [eax], 04 :760E27A2 74A0 je 760E2744 :760E27A4 E9EE2F0100 jmp 760F5797 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E275D(C), :760E2775(C), :760E277A(C), :760E2781(C), :760E2792(C) | :760E27A9 85DB test ebx, ebx :760E27AB 7480 je 760E272D :760E27AD 8B430C mov eax, dword ptr [ebx+0C] :760E27B0 89460C mov dword ptr [esi+0C], eax :760E27B3 89730C mov dword ptr [ebx+0C], esi :760E27B6 E97BFFFFFF jmp 760E2736 * Referenced by a CALL at Address: |:760E26F3 | :760E27BB 53 push ebx :760E27BC 8BD9 mov ebx, ecx :760E27BE 55 push ebp :760E27BF 8B6C240C mov ebp, dword ptr [esp+0C] :760E27C3 56 push esi :760E27C4 8BB358220000 mov esi, dword ptr [ebx+00002258] :760E27CA 57 push edi :760E27CB 33FF xor edi, edi :760E27CD 85F6 test esi, esi :760E27CF 7424 je 760E27F5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F54BF(C) | :760E27D1 8D4604 lea eax, dword ptr [esi+04] :760E27D4 55 push ebp :760E27D5 50 push eax * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760E27D6 FF1558120E76 Call dword ptr [760E1258] :760E27DC 85C0 test eax, eax :760E27DE 0F8CD52C0100 jl 760F54B9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F54C5(U) | :760E27E4 85F6 test esi, esi :760E27E6 740D je 760E27F5 :760E27E8 85C0 test eax, eax :760E27EA 7509 jne 760E27F5 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2830(U), :760F54D2(C), :760F54F1(C), :760F5508(U), :760F5513(U) | :760E27EC 8BC6 mov eax, esi :760E27EE 5F pop edi :760E27EF 5E pop esi :760E27F0 5D pop ebp :760E27F1 5B pop ebx :760E27F2 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E27CF(C), :760E27E6(C), :760E27EA(C) | :760E27F5 55 push ebp * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760E27F6 FF1554120E76 Call dword ptr [760E1254] :760E27FC 83C005 add eax, 00000005 :760E27FF 50 push eax :760E2800 E830F1FFFF call 760E1935 :760E2805 8BF0 mov esi, eax :760E2807 85F6 test esi, esi :760E2809 0F84BB2C0100 je 760F54CA :760E280F 8D4604 lea eax, dword ptr [esi+04] :760E2812 55 push ebp :760E2813 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760E2814 FF1504120E76 Call dword ptr [760E1204] :760E281A 85FF test edi, edi :760E281C 0F85EB2C0100 jne 760F550D :760E2822 8B8358220000 mov eax, dword ptr [ebx+00002258] :760E2828 8906 mov dword ptr [esi], eax :760E282A 89B358220000 mov dword ptr [ebx+00002258], esi :760E2830 EBBA jmp 760E27EC * Referenced by a CALL at Addresses: |:760E3175 , :760E3B84 , :760EDC8C , :760EF1BF , :760EF47D | :760E2832 68A0BB0D00 push 000DBBA0 :760E2837 81C15C220000 add ecx, 0000225C * Reference To: SfpDll.?LockWriteModeEx@CReadWriteLock@@QAEHH@Z | :760E283D E806000000 call 760E2848 :760E2842 F7D8 neg eax :760E2844 1BC0 sbb eax, eax :760E2846 40 inc eax :760E2847 C3 ret * Referenced by a CALL at Address: |:760E283D | Exported fn(): ?LockWriteModeEx@CReadWriteLock@@QAEHH@Z - Ord:000Dh :760E2848 53 push ebx :760E2849 56 push esi :760E284A 8BF1 mov esi, ecx :760E284C 57 push edi :760E284D 33DB xor ebx, ebx :760E284F 8D7E1C lea edi, dword ptr [esi+1C] :760E2852 57 push edi * Reference To: KERNEL32.EnterCriticalSection, Ord:006Fh | :760E2853 FF1540120E76 Call dword ptr [760E1240] :760E2859 8B36 mov esi, dword ptr [esi] :760E285B 85F6 test esi, esi :760E285D 7418 je 760E2877 :760E285F FF742410 push [esp+10] :760E2863 56 push esi * Reference To: KERNEL32.WaitForSingleObject, Ord:02FDh | :760E2864 FF1538120E76 Call dword ptr [760E1238] :760E286A 3D02010000 cmp eax, 00000102 :760E286F 0F844A870000 je 760EAFBF :760E2875 33DB xor ebx, ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E285D(C), :760EAFC9(U) | :760E2877 5F pop edi :760E2878 8BC3 mov eax, ebx :760E287A 5E pop esi :760E287B 5B pop ebx :760E287C C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E2951 , :760E2F6C , :760E411D , :760E41EA , :760E5136 |:760F0885 , :760F09ED , :760F0EA2 , :760F0F1C , :760F10A7 |:760F1146 , :760F46E6 , :760F4E76 | * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760E287F FF2520100E76 Jmp dword ptr [760E1020] * Referenced by a CALL at Addresses: |:760E2AC0 , :760E3070 , :760E426A , :760E431F , :760EE791 |:760EE825 , :760F8173 , :760F8711 | :760E2885 55 push ebp :760E2886 8BEC mov ebp, esp :760E2888 81EC00010000 sub esp, 00000100 :760E288E 56 push esi :760E288F 33F6 xor esi, esi :760E2891 3935A8D90F76 cmp dword ptr [760FD9A8], esi :760E2897 7408 je 760E28A1 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E28FC(U), :760F2AAF(C), :760F2ACE(C), :760F2AE7(U), :760F2AF4(C) |:760F2B13(C) | :760E2899 A1ACD90F76 mov eax, dword ptr [760FD9AC] :760E289E 5E pop esi :760E289F C9 leave :760E28A0 C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2897(C) | :760E28A1 6846170E76 push 760E1746 :760E28A6 6A02 push 00000002 :760E28A8 8935ACD90F76 mov dword ptr [760FD9AC], esi * Reference To: MSVCRT.setlocale, Ord:02AAh | :760E28AE FF1558100E76 Call dword ptr [760E1058] :760E28B4 59 pop ecx :760E28B5 3BC6 cmp eax, esi :760E28B7 59 pop ecx :760E28B8 0F84E9010100 je 760F2AA7 :760E28BE 6A2E push 0000002E :760E28C0 8D8D00FFFFFF lea ecx, dword ptr [ebp+FFFFFF00] :760E28C6 6A01 push 00000001 :760E28C8 51 push ecx :760E28C9 50 push eax :760E28CA E8A22C0000 call 760E5571 :760E28CF 85C0 test eax, eax :760E28D1 0F8415020100 je 760F2AEC :760E28D7 8D8500FFFFFF lea eax, dword ptr [ebp+FFFFFF00] :760E28DD 50 push eax * Reference To: MSVCRT.atoi, Ord:023Ah | :760E28DE FF1554100E76 Call dword ptr [760E1054] :760E28E4 3BC6 cmp eax, esi :760E28E6 59 pop ecx :760E28E7 A3ACD90F76 mov dword ptr [760FD9AC], eax :760E28EC 0F842F020100 je 760F2B21 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2B27(U) | :760E28F2 C705A8D90F7601000000 mov dword ptr [760FD9A8], 00000001 :760E28FC EB9B jmp 760E2899 * Referenced by a CALL at Addresses: |:760E29D1 , :760E2AF7 , :760E3025 | :760E28FE 56 push esi :760E28FF FF742408 push [esp+08] * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760E2903 FF1554120E76 Call dword ptr [760E1254] :760E2909 40 inc eax :760E290A 50 push eax :760E290B E825F0FFFF call 760E1935 :760E2910 8BF0 mov esi, eax :760E2912 85F6 test esi, esi :760E2914 0F8487FC0000 je 760F25A1 :760E291A FF742408 push [esp+08] :760E291E 56 push esi * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760E291F FF1504120E76 Call dword ptr [760E1204] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F25A9(C), :760F25C8(C), :760F25DF(U) | :760E2925 8BC6 mov eax, esi :760E2927 5E pop esi :760E2928 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E2D6E , :760E2DC0 , :760EF279 , :760EF57B | :760E292B 53 push ebx :760E292C 55 push ebp :760E292D 56 push esi :760E292E 57 push edi :760E292F 8B7C2418 mov edi, dword ptr [esp+18] :760E2933 FF742414 push [esp+14] :760E2937 8BF1 mov esi, ecx :760E2939 33ED xor ebp, ebp :760E293B 892F mov dword ptr [edi], ebp :760E293D FF7604 push [esi+04] * Reference To: WINTRUST.CryptCATEnumerateMember, Ord:0014h | :760E2940 E86D000000 Call 760E29B2 :760E2945 8BD8 mov ebx, eax :760E2947 3BDD cmp ebx, ebp :760E2949 895C2418 mov dword ptr [esp+18], ebx :760E294D 7448 je 760E2997 :760E294F 6A18 push 00000018 * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760E2951 E829FFFFFF Call 760E287F :760E2956 3BC5 cmp eax, ebp :760E2958 59 pop ecx :760E2959 0F84EF1C0100 je 760F464E :760E295F 896808 mov dword ptr [eax+08], ebp :760E2962 8928 mov dword ptr [eax], ebp :760E2964 896810 mov dword ptr [eax+10], ebp :760E2967 896814 mov dword ptr [eax+14], ebp :760E296A 89680C mov dword ptr [eax+0C], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4650(U) | :760E296D 3BC5 cmp eax, ebp :760E296F 8907 mov dword ptr [edi], eax :760E2971 0F84DE1C0100 je 760F4655 :760E2977 FF36 push dword ptr [esi] :760E2979 8BC8 mov ecx, eax :760E297B 53 push ebx :760E297C FF7604 push [esi+04] :760E297F E834000000 call 760E29B8 :760E2984 85C0 test eax, eax :760E2986 0F84F31C0100 je 760F467F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F471F(U) | :760E298C 8B442418 mov eax, dword ptr [esp+18] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E29B0(U) | :760E2990 5F pop edi :760E2991 5E pop esi :760E2992 5D pop ebp :760E2993 5B pop ebx :760E2994 C20800 ret 0008 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E294D(C) | :760E2997 A184110E76 mov eax, dword ptr [760E1184] :760E299C F60004 test byte ptr [eax], 04 :760E299F 0F85721C0100 jne 760F4617 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4630(C), :760F4649(U), :760F465D(C), :760F472C(C), :760F4747(C) |:760F475C(C), :760F4777(C), :760F478E(U) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760E29A5 FF15A0110E76 Call dword ptr [760E11A0] :760E29AB 832700 and dword ptr [edi], 00000000 :760E29AE 33C0 xor eax, eax :760E29B0 EBDE jmp 760E2990 * Referenced by a CALL at Addresses: |:760E2940 , :760F46D5 | * Reference To: WINTRUST.CryptCATEnumerateMember, Ord:0014h | :760E29B2 FF25F8100E76 Jmp dword ptr [760E10F8] * Referenced by a CALL at Addresses: |:760E297F , :760F4712 | :760E29B8 55 push ebp :760E29B9 8BEC mov ebp, esp :760E29BB 51 push ecx :760E29BC 53 push ebx :760E29BD 56 push esi :760E29BE 57 push edi :760E29BF 8BF1 mov esi, ecx :760E29C1 FF7510 push [ebp+10] :760E29C4 33FF xor edi, edi :760E29C6 897E08 mov dword ptr [esi+08], edi :760E29C9 897DFC mov dword ptr [ebp-04], edi :760E29CC 897E0C mov dword ptr [esi+0C], edi :760E29CF 893E mov dword ptr [esi], edi :760E29D1 E828FFFFFF call 760E28FE :760E29D6 3BC7 cmp eax, edi :760E29D8 894610 mov dword ptr [esi+10], eax :760E29DB 0F84B21D0100 je 760F4793 :760E29E1 8B5D0C mov ebx, dword ptr [ebp+0C] :760E29E4 FF7304 push [ebx+04] * Reference To: MSVCRT.wcslen, Ord:02E3h | :760E29E7 FF1550100E76 Call dword ptr [760E1050] :760E29ED 59 pop ecx :760E29EE 8D440002 lea eax, dword ptr [eax+eax+02] :760E29F2 50 push eax :760E29F3 FF7304 push [ebx+04] :760E29F6 E89D000000 call 760E2A98 :760E29FB 894614 mov dword ptr [esi+14], eax :760E29FE EB2E jmp 760E2A2E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2A38(U) | :760E2A00 8BF8 mov edi, eax :760E2A02 85FF test edi, edi :760E2A04 746F je 760E2A75 :760E2A06 68B82C0E76 push 760E2CB8 :760E2A0B FF7704 push [edi+04] * Reference To: MSVCRT.wcscmp, Ord:02DEh | :760E2A0E FF1564100E76 Call dword ptr [760E1064] :760E2A14 59 pop ecx :760E2A15 85C0 test eax, eax :760E2A17 59 pop ecx :760E2A18 7420 je 760E2A3A :760E2A1A 68AC2C0E76 push 760E2CAC :760E2A1F FF7704 push [edi+04] * Reference To: MSVCRT.wcscmp, Ord:02DEh | :760E2A22 FF1564100E76 Call dword ptr [760E1064] :760E2A28 59 pop ecx :760E2A29 85C0 test eax, eax :760E2A2B 59 pop ecx :760E2A2C 7430 je 760E2A5E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E29FE(U), :760E2A5C(U), :760E2A73(U) | :760E2A2E 57 push edi :760E2A2F 53 push ebx :760E2A30 FF7508 push [ebp+08] * Reference To: WINTRUST.CryptCATEnumerateAttr, Ord:0012h | :760E2A33 E8A9000000 Call 760E2AE1 :760E2A38 EBC6 jmp 760E2A00 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2A18(C) | :760E2A3A FF770C push [edi+0C] :760E2A3D FF7710 push [edi+10] :760E2A40 E853000000 call 760E2A98 :760E2A45 85C0 test eax, eax :760E2A47 8945FC mov dword ptr [ebp-04], eax :760E2A4A 0F84861D0100 je 760F47D6 :760E2A50 50 push eax :760E2A51 E891000000 call 760E2AE7 :760E2A56 894608 mov dword ptr [esi+08], eax :760E2A59 89560C mov dword ptr [esi+0C], edx :760E2A5C EBD0 jmp 760E2A2E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2A2C(C) | :760E2A5E FF770C push [edi+0C] :760E2A61 FF7710 push [edi+10] :760E2A64 E82F000000 call 760E2A98 :760E2A69 85C0 test eax, eax :760E2A6B 8906 mov dword ptr [esi], eax :760E2A6D 0F84A01D0100 je 760F4813 :760E2A73 EBB9 jmp 760E2A2E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2A04(C) | :760E2A75 833E00 cmp dword ptr [esi], 00000000 :760E2A78 0F84D21D0100 je 760F4850 :760E2A7E 6A01 push 00000001 :760E2A80 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F484B(U) | :760E2A81 837DFC00 cmp dword ptr [ebp-04], 00000000 :760E2A85 7408 je 760E2A8F :760E2A87 FF75FC push [ebp-04] :760E2A8A E860EFFFFF call 760E19EF * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2A85(C), :760F479B(C), :760F47BA(C), :760F47D1(U), :760F480E(U) | :760E2A8F 8BC7 mov eax, edi :760E2A91 5F pop edi :760E2A92 5E pop esi :760E2A93 5B pop ebx :760E2A94 C9 leave :760E2A95 C20C00 ret 000C * Referenced by a CALL at Addresses: |:760E29F6 , :760E2A40 , :760E2A64 , :760F45B2 | :760E2A98 53 push ebx :760E2A99 56 push esi :760E2A9A 8B742410 mov esi, dword ptr [esp+10] :760E2A9E 57 push edi :760E2A9F D1EE shr esi, 1 :760E2AA1 8D7E01 lea edi, dword ptr [esi+01] :760E2AA4 57 push edi :760E2AA5 E88BEEFFFF call 760E1935 :760E2AAA 8BD8 mov ebx, eax :760E2AAC 33C0 xor eax, eax :760E2AAE 3BD8 cmp ebx, eax :760E2AB0 0F842EFB0000 je 760F25E4 :760E2AB6 50 push eax :760E2AB7 50 push eax :760E2AB8 57 push edi :760E2AB9 53 push ebx :760E2ABA 56 push esi :760E2ABB FF742424 push [esp+24] :760E2ABF 50 push eax :760E2AC0 E8C0FDFFFF call 760E2885 :760E2AC5 50 push eax * Reference To: KERNEL32.WideCharToMultiByte, Ord:0301h | :760E2AC6 FF1508120E76 Call dword ptr [760E1208] :760E2ACC 85C0 test eax, eax :760E2ACE 0F8453FB0000 je 760F2627 :760E2AD4 80643BFF00 and byte ptr [ebx+edi-01], 00 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F25EC(C), :760F260B(C), :760F2622(U), :760F266F(U) | :760E2AD9 5F pop edi :760E2ADA 8BC3 mov eax, ebx :760E2ADC 5E pop esi :760E2ADD 5B pop ebx :760E2ADE C20800 ret 0008 * Referenced by a CALL at Address: |:760E2A33 | * Reference To: WINTRUST.CryptCATEnumerateAttr, Ord:0012h | :760E2AE1 FF25FC100E76 Jmp dword ptr [760E10FC] * Referenced by a CALL at Addresses: |:760E2A51 , :760F45F5 | :760E2AE7 55 push ebp :760E2AE8 8BEC mov ebp, esp :760E2AEA 83EC14 sub esp, 00000014 :760E2AED 53 push ebx :760E2AEE 57 push edi :760E2AEF FF7508 push [ebp+08] :760E2AF2 33DB xor ebx, ebx :760E2AF4 895DF0 mov dword ptr [ebp-10], ebx :760E2AF7 E802FEFFFF call 760E28FE :760E2AFC 8BF8 mov edi, eax :760E2AFE 3BFB cmp edi, ebx :760E2B00 0F84B1FB0000 je 760F26B7 :760E2B06 56 push esi :760E2B07 57 push edi :760E2B08 897DFC mov dword ptr [ebp-04], edi * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760E2B0B FF1554120E76 Call dword ptr [760E1254] :760E2B11 8BF0 mov esi, eax :760E2B13 03F7 add esi, edi :760E2B15 83650800 and dword ptr [ebp+08], 00000000 :760E2B19 EB32 jmp 760E2B4D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2B5E(U) | :760E2B1B 85C0 test eax, eax :760E2B1D 8945F4 mov dword ptr [ebp-0C], eax :760E2B20 0F84D4FB0000 je 760F26FA :760E2B26 6A00 push 00000000 :760E2B28 6800000100 push 00010000 :760E2B2D FF75F0 push [ebp-10] :760E2B30 53 push ebx :760E2B31 E846FBFFFF call 760E267C :760E2B36 8B4DF8 mov ecx, dword ptr [ebp-08] :760E2B39 33DB xor ebx, ebx :760E2B3B 03C1 add eax, ecx :760E2B3D 13D3 adc edx, ebx :760E2B3F FF4508 inc [ebp+08] :760E2B42 837D0804 cmp dword ptr [ebp+08], 00000004 :760E2B46 8BD8 mov ebx, eax :760E2B48 8955F0 mov dword ptr [ebp-10], edx :760E2B4B 7313 jnb 760E2B60 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2B19(U) | :760E2B4D 8D45F8 lea eax, dword ptr [ebp-08] :760E2B50 50 push eax :760E2B51 8D45FC lea eax, dword ptr [ebp-04] :760E2B54 50 push eax :760E2B55 56 push esi :760E2B56 FF75FC push [ebp-04] :760E2B59 E81E000000 call 760E2B7C :760E2B5E EBBB jmp 760E2B1B * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2B4B(C), :760F2730(U) | :760E2B60 837DF400 cmp dword ptr [ebp-0C], 00000000 :760E2B64 0F84CBFB0000 je 760F2735 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F273A(U) | :760E2B6A 57 push edi :760E2B6B E87FEEFFFF call 760E19EF :760E2B70 5E pop esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F26BF(C), :760F26DE(C), :760F26F5(U) | :760E2B71 8B55F0 mov edx, dword ptr [ebp-10] :760E2B74 8BC3 mov eax, ebx :760E2B76 5F pop edi :760E2B77 5B pop ebx :760E2B78 C9 leave :760E2B79 C20400 ret 0004 * Referenced by a CALL at Address: |:760E2B59 | :760E2B7C 55 push ebp :760E2B7D 8BEC mov ebp, esp :760E2B7F 53 push ebx :760E2B80 56 push esi :760E2B81 8B7508 mov esi, dword ptr [ebp+08] :760E2B84 57 push edi * Reference To: MSVCRT.isdigit, Ord:0270h | :760E2B85 8B3D4C100E76 mov edi, dword ptr [760E104C] :760E2B8B 33DB xor ebx, ebx :760E2B8D 0FBE06 movsx eax, byte ptr [esi] :760E2B90 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2BD0(U) | :760E2B91 FFD7 call edi :760E2B93 85C0 test eax, eax :760E2B95 59 pop ecx :760E2B96 7429 je 760E2BC1 :760E2B98 3B750C cmp esi, dword ptr [ebp+0C] :760E2B9B 0F87D3FA0000 ja 760F2674 :760E2BA1 6A0A push 0000000A :760E2BA3 FF7510 push [ebp+10] :760E2BA6 56 push esi * Reference To: MSVCRT.strtoul, Ord:02C6h | :760E2BA7 FF1548100E76 Call dword ptr [760E1048] :760E2BAD 8B4D14 mov ecx, dword ptr [ebp+14] :760E2BB0 83C40C add esp, 0000000C :760E2BB3 6A01 push 00000001 :760E2BB5 8901 mov dword ptr [ecx], eax :760E2BB7 5B pop ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F267C(C), :760F269B(C), :760F26B2(U) | :760E2BB8 5F pop edi :760E2BB9 8BC3 mov eax, ebx :760E2BBB 5E pop esi :760E2BBC 5B pop ebx :760E2BBD 5D pop ebp :760E2BBE C21000 ret 0010 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2B96(C) | :760E2BC1 3B750C cmp esi, dword ptr [ebp+0C] :760E2BC4 0F87AAFA0000 ja 760F2674 :760E2BCA 0FBE4601 movsx eax, byte ptr [esi+01] :760E2BCE 46 inc esi :760E2BCF 50 push eax :760E2BD0 EBBF jmp 760E2B91 * Referenced by a CALL at Addresses: |:760E2D8D , :760EF22A , :760EF4E0 | :760E2BD2 53 push ebx :760E2BD3 55 push ebp :760E2BD4 56 push esi :760E2BD5 57 push edi :760E2BD6 8B7C2414 mov edi, dword ptr [esp+14] :760E2BDA 6A01 push 00000001 :760E2BDC 5D pop ebp :760E2BDD 8BF1 mov esi, ecx :760E2BDF 57 push edi :760E2BE0 E86CEDFFFF call 760E1951 :760E2BE5 85FF test edi, edi :760E2BE7 0F84BC300100 je 760F5CA9 :760E2BED 8B5C2418 mov ebx, dword ptr [esp+18] :760E2BF1 85DB test ebx, ebx :760E2BF3 0F84B0300100 je 760F5CA9 :760E2BF9 837C241C00 cmp dword ptr [esp+1C], 00000000 :760E2BFE 0F8EA5300100 jle 760F5CA9 :760E2C04 802300 and byte ptr [ebx], 00 :760E2C07 83F8FF cmp eax, FFFFFFFF :760E2C0A 0F84F02F0100 je 760F5C00 :760E2C10 8BB4860C030000 mov esi, dword ptr [esi+4*eax+0000030C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2C40(U) | :760E2C17 85F6 test esi, esi :760E2C19 743F je 760E2C5A :760E2C1B 8D4608 lea eax, dword ptr [esi+08] :760E2C1E 6A5C push 0000005C :760E2C20 50 push eax * Reference To: MSVCRT.strrchr, Ord:02C0h | :760E2C21 FF1528100E76 Call dword ptr [760E1028] :760E2C27 59 pop ecx :760E2C28 85C0 test eax, eax :760E2C2A 59 pop ecx :760E2C2B 0F8406300100 je 760F5C37 :760E2C31 40 inc eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5C39(U) | :760E2C32 50 push eax :760E2C33 57 push edi * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760E2C34 FF1558120E76 Call dword ptr [760E1258] :760E2C3A 85C0 test eax, eax :760E2C3C 7404 je 760E2C42 :760E2C3E 8B36 mov esi, dword ptr [esi] :760E2C40 EBD5 jmp 760E2C17 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2C3C(C) | :760E2C42 FF74241C push [esp+1C] :760E2C46 83C608 add esi, 00000008 :760E2C49 56 push esi :760E2C4A 53 push ebx * Reference To: KERNEL32.lstrcpynA, Ord:0332h | :760E2C4B FF1518120E76 Call dword ptr [760E1218] :760E2C51 85C0 test eax, eax :760E2C53 7515 jne 760E2C6A :760E2C55 E9E42F0100 jmp 760F5C3E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2C19(C) | :760E2C5A A184110E76 mov eax, dword ptr [760E1184] :760E2C5F F60002 test byte ptr [eax], 02 :760E2C62 0F850A300100 jne 760F5C72 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5C08(C), :760F5C27(C), :760F5C46(C), :760F5C65(C), :760F5C8B(C) |:760F5CA4(U), :760F5CB1(C), :760F5CD0(C), :760F5CE7(U) | :760E2C68 33ED xor ebp, ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2C53(C) | :760E2C6A 5F pop edi :760E2C6B 8BC5 mov eax, ebp :760E2C6D 5E pop esi :760E2C6E 5D pop ebp :760E2C6F 5B pop ebx :760E2C70 C20C00 ret 000C * Referenced by a CALL at Addresses: |:760E2D56 , :760EF258 , :760EF35A , :760EF55F , :760EF643 |:760F46BF | :760E2C73 56 push esi :760E2C74 8BF1 mov esi, ecx :760E2C76 8B4610 mov eax, dword ptr [esi+10] :760E2C79 85C0 test eax, eax :760E2C7B 740A je 760E2C87 :760E2C7D 50 push eax :760E2C7E E86CEDFFFF call 760E19EF :760E2C83 83661000 and dword ptr [esi+10], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2C7B(C) | :760E2C87 8B06 mov eax, dword ptr [esi] :760E2C89 85C0 test eax, eax :760E2C8B 7409 je 760E2C96 :760E2C8D 50 push eax :760E2C8E E85CEDFFFF call 760E19EF :760E2C93 832600 and dword ptr [esi], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2C8B(C) | :760E2C96 8B4614 mov eax, dword ptr [esi+14] :760E2C99 85C0 test eax, eax :760E2C9B 740A je 760E2CA7 :760E2C9D 50 push eax :760E2C9E E84CEDFFFF call 760E19EF :760E2CA3 83661400 and dword ptr [esi+14], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2C9B(C) | :760E2CA7 5E pop esi :760E2CA8 C3 ret :760E2CA9 90 nop :760E2CAA 90 nop :760E2CAB 90 nop :760E2CAC 4E dec esi :760E2CAD 006100 add byte ptr [ecx+00], ah :760E2CB0 6D insd :760E2CB1 006500 add byte ptr [ebp+00], ah :760E2CB4 0000 add byte ptr [eax], al :760E2CB6 90 nop :760E2CB7 90 nop :760E2CB8 56 push esi :760E2CB9 006500 add byte ptr [ebp+00], ah :760E2CBC 7200 jb 760E2CBE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2CBC(C) | :760E2CBE 7300 jnb 760E2CC0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2CBE(C) | :760E2CC0 69006F006E00 imul eax, dword ptr [eax], 006E006F :760E2CC6 0000 add byte ptr [eax], al * Referenced by a CALL at Addresses: |:760E3D86 , :760EED48 , :760EED50 , :760EF373 , :760EF588 |:760EF62C , :760F0003 , :760F4D8F , :760F4F14 | :760E2CC8 56 push esi :760E2CC9 8BF1 mov esi, ecx :760E2CCB 8B06 mov eax, dword ptr [esi] :760E2CCD 85C0 test eax, eax :760E2CCF 7409 je 760E2CDA :760E2CD1 50 push eax :760E2CD2 E818EDFFFF call 760E19EF :760E2CD7 832600 and dword ptr [esi], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2CCF(C) | :760E2CDA 8B4604 mov eax, dword ptr [esi+04] :760E2CDD 83F8FF cmp eax, FFFFFFFF :760E2CE0 740A je 760E2CEC :760E2CE2 50 push eax * Reference To: WINTRUST.CryptCATClose, Ord:0011h | :760E2CE3 E806000000 Call 760E2CEE :760E2CE8 834E04FF or dword ptr [esi+04], FFFFFFFF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2CE0(C) | :760E2CEC 5E pop esi :760E2CED C3 ret * Referenced by a CALL at Address: |:760E2CE3 | * Reference To: WINTRUST.CryptCATClose, Ord:0011h | :760E2CEE FF25E8100E76 Jmp dword ptr [760E10E8] * Referenced by a CALL at Addresses: |:760E301F , :760ECA29 , :760ED9DE , :760EDF80 , :760EEFF4 |:760F137A | :760E2CF4 8B4C2404 mov ecx, dword ptr [esp+04] :760E2CF8 8BC1 mov eax, ecx :760E2CFA EB15 jmp 760E2D11 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2D18(U) | :760E2CFC 8A11 mov dl, byte ptr [ecx] :760E2CFE 84D2 test dl, dl :760E2D00 7425 je 760E2D27 :760E2D02 80FA5C cmp dl, 5C :760E2D05 7413 je 760E2D1A :760E2D07 80FA3A cmp dl, 3A :760E2D0A 740E je 760E2D1A * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2D21(C), :760E2D25(U) | :760E2D0C 41 inc ecx :760E2D0D FF4C2408 dec [esp+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2CFA(U) | :760E2D11 837C240800 cmp dword ptr [esp+08], 00000000 :760E2D16 7E0F jle 760E2D27 :760E2D18 EBE2 jmp 760E2CFC * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2D05(C), :760E2D0A(C) | :760E2D1A 80790100 cmp byte ptr [ecx+01], 00 :760E2D1E 8D5101 lea edx, dword ptr [ecx+01] :760E2D21 74E9 je 760E2D0C :760E2D23 8BC2 mov eax, edx :760E2D25 EBE5 jmp 760E2D0C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2D00(C), :760E2D16(C) | :760E2D27 C20800 ret 0008 * Referenced by a CALL at Address: |:760E3D77 | :760E2D2A 55 push ebp :760E2D2B 8BEC mov ebp, esp :760E2D2D 81EC04040000 sub esp, 00000404 :760E2D33 8B4D10 mov ecx, dword ptr [ebp+10] :760E2D36 8D45FC lea eax, dword ptr [ebp-04] :760E2D39 56 push esi :760E2D3A 50 push eax :760E2D3B E87A000000 call 760E2DBA :760E2D40 8BF0 mov esi, eax :760E2D42 85F6 test esi, esi :760E2D44 746C je 760E2DB2 :760E2D46 57 push edi :760E2D47 EB30 jmp 760E2D79 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2D92(U) | :760E2D49 85C0 test eax, eax :760E2D4B 7547 jne 760E2D94 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2DAF(U) | :760E2D4D 8B4DFC mov ecx, dword ptr [ebp-04] :760E2D50 85C9 test ecx, ecx :760E2D52 8BF9 mov edi, ecx :760E2D54 740C je 760E2D62 :760E2D56 E818FFFFFF call 760E2C73 :760E2D5B 57 push edi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760E2D5C E8EAEBFFFF Call 760E194B :760E2D61 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2D54(C) | :760E2D62 8B4D10 mov ecx, dword ptr [ebp+10] :760E2D65 8365FC00 and dword ptr [ebp-04], 00000000 :760E2D69 8D45FC lea eax, dword ptr [ebp-04] :760E2D6C 50 push eax :760E2D6D 56 push esi :760E2D6E E8B8FBFFFF call 760E292B :760E2D73 8BF0 mov esi, eax :760E2D75 85F6 test esi, esi :760E2D77 7438 je 760E2DB1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2D47(U) | :760E2D79 8B4D08 mov ecx, dword ptr [ebp+08] :760E2D7C 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760E2D82 6800040000 push 00000400 :760E2D87 50 push eax :760E2D88 8B45FC mov eax, dword ptr [ebp-04] :760E2D8B FF30 push dword ptr [eax] :760E2D8D E840FEFFFF call 760E2BD2 :760E2D92 EBB5 jmp 760E2D49 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2D4B(C) | :760E2D94 8B45FC mov eax, dword ptr [ebp-04] :760E2D97 8B4D0C mov ecx, dword ptr [ebp+0C] :760E2D9A FF7010 push [eax+10] :760E2D9D FF700C push [eax+0C] :760E2DA0 FF7008 push [eax+08] :760E2DA3 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760E2DA9 50 push eax :760E2DAA E801F9FFFF call 760E26B0 :760E2DAF EB9C jmp 760E2D4D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2D77(C) | :760E2DB1 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2D44(C) | :760E2DB2 6A01 push 00000001 :760E2DB4 58 pop eax :760E2DB5 5E pop esi :760E2DB6 C9 leave :760E2DB7 C20C00 ret 000C * Referenced by a CALL at Addresses: |:760E2D3B , :760EF20B , :760EF4BA | :760E2DBA FF742404 push [esp+04] :760E2DBE 6A00 push 00000000 :760E2DC0 E866FBFFFF call 760E292B :760E2DC5 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E2FBE , :760E3D28 , :760EEF5A , :760EF05F , :760F4E34 |:760F4FBE | :760E2DC8 55 push ebp :760E2DC9 8BEC mov ebp, esp :760E2DCB 81EC00040000 sub esp, 00000400 :760E2DD1 8B01 mov eax, dword ptr [ecx] :760E2DD3 56 push esi :760E2DD4 33F6 xor esi, esi :760E2DD6 57 push edi :760E2DD7 3BC6 cmp eax, esi :760E2DD9 0F84971E0100 je 760F4C76 :760E2DDF FF7508 push [ebp+08] :760E2DE2 50 push eax :760E2DE3 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760E2DE9 68442E0E76 push 760E2E44 :760E2DEE 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760E2DEF FF1530100E76 Call dword ptr [760E1030] :760E2DF5 8DBD00FCFFFF lea edi, dword ptr [ebp+FFFFFC00] :760E2DFB 83C9FF or ecx, FFFFFFFF :760E2DFE 33C0 xor eax, eax :760E2E00 83C410 add esp, 00000010 :760E2E03 F2 repnz :760E2E04 AE scasb :760E2E05 F7D1 not ecx :760E2E07 49 dec ecx :760E2E08 3B4D0C cmp ecx, dword ptr [ebp+0C] :760E2E0B 0F83991E0100 jnb 760F4CAA :760E2E11 8DBD00FCFFFF lea edi, dword ptr [ebp+FFFFFC00] :760E2E17 83C9FF or ecx, FFFFFFFF :760E2E1A 33C0 xor eax, eax :760E2E1C 6A01 push 00000001 :760E2E1E F2 repnz :760E2E1F AE scasb :760E2E20 F7D1 not ecx :760E2E22 2BF9 sub edi, ecx :760E2E24 8BC1 mov eax, ecx :760E2E26 8BF7 mov esi, edi :760E2E28 8B7D08 mov edi, dword ptr [ebp+08] :760E2E2B C1E902 shr ecx, 02 :760E2E2E F3 repz :760E2E2F A5 movsd :760E2E30 8BC8 mov ecx, eax :760E2E32 58 pop eax :760E2E33 83E103 and ecx, 00000003 :760E2E36 F3 repz :760E2E37 A4 movsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4CE0(U) | :760E2E38 5F pop edi :760E2E39 5E pop esi :760E2E3A C9 leave :760E2E3B C20800 ret 0008 * Referenced by a CALL at Addresses: |:760E4E83 , :760E4F6D , :760ED302 | * Reference To: WINTRUST.WinVerifyTrust, Ord:006Bh | :760E2E3E FF25EC100E76 Jmp dword ptr [760E10EC] :760E2E44 25735C2573 and eax, 73255C73 :760E2E49 00 BYTE 00h * Referenced by a CALL at Address: |:760E4E95 | * Reference To: WINTRUST.WTHelperProvDataFromStateData, Ord:0054h | :760E2E4A FF25E0100E76 Jmp dword ptr [760E10E0] * Referenced by a CALL at Address: |:760E4EAF | * Reference To: WINTRUST.WTHelperGetProvSignerFromChain, Ord:0051h | :760E2E50 FF2504110E76 Jmp dword ptr [760E1104] * Referenced by a CALL at Addresses: |:760E2E6E , :760E4EC4 | * Reference To: WINTRUST.WTHelperGetProvCertFromChain, Ord:004Fh | :760E2E56 FF2500110E76 Jmp dword ptr [760E1100] * Referenced by a CALL at Address: |:760E4F01 | :760E2E5C 55 push ebp :760E2E5D 8BEC mov ebp, esp :760E2E5F 83EC0C sub esp, 0000000C :760E2E62 53 push ebx :760E2E63 56 push esi :760E2E64 33DB xor ebx, ebx :760E2E66 57 push edi :760E2E67 53 push ebx :760E2E68 895DF4 mov dword ptr [ebp-0C], ebx :760E2E6B FF7508 push [ebp+08] * Reference To: WINTRUST.WTHelperGetProvCertFromChain, Ord:004Fh | :760E2E6E E8E3FFFFFF Call 760E2E56 :760E2E73 3BC3 cmp eax, ebx :760E2E75 0F84CF210100 je 760F504A :760E2E7B 8B7804 mov edi, dword ptr [eax+04] * Reference To: CRYPT32.CertGetEnhancedKeyUsage, Ord:0041h | :760E2E7E 8B35E0120E76 mov esi, dword ptr [760E12E0] :760E2E84 8D45F8 lea eax, dword ptr [ebp-08] :760E2E87 50 push eax :760E2E88 53 push ebx :760E2E89 6A02 push 00000002 :760E2E8B 57 push edi :760E2E8C FFD6 call esi :760E2E8E 85C0 test eax, eax :760E2E90 0F84F1210100 je 760F5087 :760E2E96 395DF8 cmp dword ptr [ebp-08], ebx :760E2E99 0F8431220100 je 760F50D0 :760E2E9F FF75F8 push [ebp-08] * Reference To: MSVCRT.malloc, Ord:028Eh | :760E2EA2 FF1510100E76 Call dword ptr [760E1010] :760E2EA8 3BC3 cmp eax, ebx :760E2EAA 59 pop ecx :760E2EAB 894508 mov dword ptr [ebp+08], eax :760E2EAE 0F845A220100 je 760F510E :760E2EB4 8D4DF8 lea ecx, dword ptr [ebp-08] :760E2EB7 51 push ecx :760E2EB8 50 push eax :760E2EB9 6A02 push 00000002 :760E2EBB 57 push edi :760E2EBC FFD6 call esi :760E2EBE 85C0 test eax, eax :760E2EC0 0F8487220100 je 760F514D :760E2EC6 8B4508 mov eax, dword ptr [ebp+08] :760E2EC9 895DFC mov dword ptr [ebp-04], ebx :760E2ECC 3918 cmp dword ptr [eax], ebx :760E2ECE 7661 jbe 760E2F31 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E2ED0 8B3580110E76 mov esi, dword ptr [760E1180] * Possible StringData Ref from Code Obj ->"CheckEKU" | :760E2ED6 BBAC300E76 mov ebx, 760E30AC * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760E2EDB BFC0D90F76 mov edi, 760FD9C0 :760E2EE0 EB29 jmp 760E2F0B * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2F13(C), :760F51A3(C), :760F51C4(U) | :760E2EE2 8B4508 mov eax, dword ptr [ebp+08] :760E2EE5 FF3500DA0F76 push dword ptr [760FDA00] :760E2EEB 8B4DFC mov ecx, dword ptr [ebp-04] :760E2EEE 8B4004 mov eax, dword ptr [eax+04] :760E2EF1 FF3488 push dword ptr [eax+4*ecx] * Reference To: KERNEL32.lstrcmpA, Ord:0329h | :760E2EF4 FF1564120E76 Call dword ptr [760E1264] :760E2EFA 85C0 test eax, eax :760E2EFC 741C je 760E2F1A :760E2EFE FF45FC inc [ebp-04] :760E2F01 8B4508 mov eax, dword ptr [ebp+08] :760E2F04 8B4DFC mov ecx, dword ptr [ebp-04] :760E2F07 3B08 cmp ecx, dword ptr [eax] :760E2F09 7324 jnb 760E2F2F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2EE0(U) | :760E2F0B A184110E76 mov eax, dword ptr [760E1184] :760E2F10 F60004 test byte ptr [eax], 04 :760E2F13 74CD je 760E2EE2 :760E2F15 E97C220100 jmp 760F5196 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2EFC(C) | :760E2F1A A184110E76 mov eax, dword ptr [760E1184] :760E2F1F F60004 test byte ptr [eax], 04 :760E2F22 0F85A1220100 jne 760F51C9 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F51D6(C), :760F51EA(U) | :760E2F28 C745F401000000 mov [ebp-0C], 00000001 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2F09(C) | :760E2F2F 33DB xor ebx, ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2ECE(C), :760F5116(C), :760F5135(C), :760F5148(U), :760F515D(C) |:760F517C(C), :760F5191(U) | :760E2F31 395D08 cmp dword ptr [ebp+08], ebx :760E2F34 740A je 760E2F40 :760E2F36 FF7508 push [ebp+08] * Reference To: MSVCRT.free, Ord:025Bh | :760E2F39 FF1518100E76 Call dword ptr [760E1018] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5109(U) | :760E2F3F 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2F34(C), :760F505A(C), :760F5079(C), :760F5097(C), :760F50B6(C) |:760F50CB(U), :760F50D8(C), :760F50F7(C) | :760E2F40 8B45F4 mov eax, dword ptr [ebp-0C] :760E2F43 5F pop edi :760E2F44 5E pop esi :760E2F45 5B pop ebx :760E2F46 C9 leave :760E2F47 C20400 ret 0004 * Referenced by a CALL at Address: |:760E3D5A | :760E2F4A 55 push ebp :760E2F4B 8BEC mov ebp, esp :760E2F4D 81EC04040000 sub esp, 00000404 :760E2F53 53 push ebx :760E2F54 56 push esi :760E2F55 8B7508 mov esi, dword ptr [ebp+08] :760E2F58 57 push edi :760E2F59 33FF xor edi, edi :760E2F5B 894DFC mov dword ptr [ebp-04], ecx :760E2F5E 39BE44010000 cmp dword ptr [esi+00000144], edi :760E2F64 0F847B1D0100 je 760F4CE5 :760E2F6A 6A08 push 00000008 * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760E2F6C E80EF9FFFF Call 760E287F :760E2F71 59 pop ecx :760E2F72 83C9FF or ecx, FFFFFFFF :760E2F75 3BC7 cmp eax, edi :760E2F77 0F849D1D0100 je 760F4D1A :760E2F7D 8938 mov dword ptr [eax], edi :760E2F7F 894804 mov dword ptr [eax+04], ecx :760E2F82 8BD8 mov ebx, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4D1C(U) | :760E2F84 3BDF cmp ebx, edi :760E2F86 0F84951D0100 je 760F4D21 :760E2F8C 8D7E30 lea edi, dword ptr [esi+30] :760E2F8F 33C0 xor eax, eax :760E2F91 F2 repnz :760E2F92 AE scasb :760E2F93 F7D1 not ecx :760E2F95 2BF9 sub edi, ecx :760E2F97 8D95FCFBFFFF lea edx, dword ptr [ebp+FFFFFBFC] :760E2F9D 8BC1 mov eax, ecx :760E2F9F 8BF7 mov esi, edi :760E2FA1 8BFA mov edi, edx :760E2FA3 6800040000 push 00000400 :760E2FA8 C1E902 shr ecx, 02 :760E2FAB F3 repz :760E2FAC A5 movsd :760E2FAD 8BC8 mov ecx, eax :760E2FAF 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760E2FB5 83E103 and ecx, 00000003 :760E2FB8 50 push eax :760E2FB9 F3 repz :760E2FBA A4 movsb :760E2FBB 8B4DFC mov ecx, dword ptr [ebp-04] :760E2FBE E805FEFFFF call 760E2DC8 :760E2FC3 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760E2FC9 8BCB mov ecx, ebx :760E2FCB 50 push eax :760E2FCC E811000000 call 760E2FE2 :760E2FD1 85C0 test eax, eax :760E2FD3 0F857E1D0100 jne 760F4D57 :760E2FD9 8BC3 mov eax, ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4D9D(U) | :760E2FDB 5F pop edi :760E2FDC 5E pop esi :760E2FDD 5B pop ebx :760E2FDE C9 leave :760E2FDF C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E2FCC , :760EEB5A , :760EEBAD , :760EF143 , :760F4ED5 | :760E2FE2 53 push ebx :760E2FE3 56 push esi :760E2FE4 57 push edi :760E2FE5 8B7C2410 mov edi, dword ptr [esp+10] :760E2FE9 8BF1 mov esi, ecx :760E2FEB 57 push edi :760E2FEC E853000000 call 760E3044 :760E2FF1 8BD8 mov ebx, eax :760E2FF3 85DB test ebx, ebx :760E2FF5 0F849B140100 je 760F4496 :760E2FFB 6A00 push 00000000 :760E2FFD 6A00 push 00000000 :760E2FFF 6A00 push 00000000 :760E3001 6A00 push 00000000 :760E3003 53 push ebx * Reference To: WINTRUST.CryptCATOpen, Ord:0019h | :760E3004 E882000000 Call 760E308B :760E3009 83F8FF cmp eax, FFFFFFFF :760E300C 894604 mov dword ptr [esi+04], eax :760E300F 0F84BE140100 je 760F44D3 :760E3015 57 push edi * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760E3016 FF1554120E76 Call dword ptr [760E1254] :760E301C 40 inc eax :760E301D 50 push eax :760E301E 57 push edi :760E301F E8D0FCFFFF call 760E2CF4 :760E3024 50 push eax :760E3025 E8D4F8FFFF call 760E28FE :760E302A 85C0 test eax, eax :760E302C 8906 mov dword ptr [esi], eax :760E302E 0F84EC140100 je 760F4520 :760E3034 33F6 xor esi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4512(C), :760F451B(U), :760F4558(U) | :760E3036 53 push ebx :760E3037 E8B3E9FFFF call 760E19EF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F44CE(U) | :760E303C 8BC6 mov eax, esi :760E303E 5F pop edi :760E303F 5E pop esi :760E3040 5B pop ebx :760E3041 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E2FEC , :760EEA63 | :760E3044 56 push esi :760E3045 57 push edi :760E3046 FF74240C push [esp+0C] * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760E304A FF1554120E76 Call dword ptr [760E1254] :760E3050 8D740002 lea esi, dword ptr [eax+eax+02] :760E3054 56 push esi :760E3055 E8DBE8FFFF call 760E1935 :760E305A 8BF8 mov edi, eax :760E305C 85FF test edi, edi :760E305E 0F84ADF40000 je 760F2511 :760E3064 D1EE shr esi, 1 :760E3066 56 push esi :760E3067 57 push edi :760E3068 6AFF push FFFFFFFF :760E306A FF742418 push [esp+18] :760E306E 6A00 push 00000000 :760E3070 E810F8FFFF call 760E2885 :760E3075 50 push eax * Reference To: KERNEL32.MultiByteToWideChar, Ord:0202h | :760E3076 FF154C120E76 Call dword ptr [760E124C] :760E307C 85C0 test eax, eax :760E307E 0F84D0F40000 je 760F2554 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2519(C), :760F2538(C), :760F254F(U), :760F259C(U) | :760E3084 8BC7 mov eax, edi :760E3086 5F pop edi :760E3087 5E pop esi :760E3088 C20400 ret 0004 * Referenced by a CALL at Address: |:760E3004 | * Reference To: WINTRUST.CryptCATOpen, Ord:0019h | :760E308B FF25F0100E76 Jmp dword ptr [760E10F0] :760E3091 90 nop :760E3092 90 nop :760E3093 90 nop :760E3094 312E xor dword ptr [esi], ebp :760E3096 332E xor ebp, dword ptr [esi] :760E3098 36 BYTE 036h :760E3099 2E312E xor dword ptr cs:[esi], ebp :760E309C 342E xor al, 2E :760E309E 312E xor dword ptr [esi], ebp :760E30A0 3331 xor esi, dword ptr [ecx] :760E30A2 312E xor dword ptr [esi], ebp :760E30A4 3130 xor dword ptr [eax], esi :760E30A6 2E332E xor ebp, dword ptr cs:[esi] :760E30A9 36009043686563 add byte ptr ss:[eax+63656843], dl :760E30B0 6B454B55 imul eax, dword ptr [ebp+4B], 00000055 :760E30B4 00 BYTE 0 * Referenced by a CALL at Addresses: |:760E346D , :760E36B2 , :760E39E4 , :760F27E9 | :760E30B5 55 push ebp :760E30B6 8BEC mov ebp, esp :760E30B8 51 push ecx :760E30B9 51 push ecx :760E30BA A184110E76 mov eax, dword ptr [760E1184] :760E30BF 53 push ebx :760E30C0 56 push esi * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E30C1 8B3580110E76 mov esi, dword ptr [760E1180] :760E30C7 F60004 test byte ptr [eax], 04 :760E30CA 57 push edi * Possible StringData Ref from Code Obj ->"ReadRegKey" | :760E30CB BB58310E76 mov ebx, 760E3158 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760E30D0 BFA0D80F76 mov edi, 760FD8A0 :760E30D5 0F851FF70000 jne 760F27FA * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2807(C), :760F2825(U) | :760E30DB 8D45FC lea eax, dword ptr [ebp-04] :760E30DE 50 push eax :760E30DF 6819000200 push 00020019 :760E30E4 6A00 push 00000000 :760E30E6 FF7510 push [ebp+10] :760E30E9 6802000080 push 80000002 * Reference To: ADVAPI32.RegOpenKeyExA, Ord:019Dh | :760E30EE FF15C0120E76 Call dword ptr [760E12C0] :760E30F4 85C0 test eax, eax :760E30F6 894510 mov dword ptr [ebp+10], eax :760E30F9 0F852BF70000 jne 760F282A :760E30FF FF750C push [ebp+0C] :760E3102 8D45F8 lea eax, dword ptr [ebp-08] :760E3105 FF7508 push [ebp+08] :760E3108 50 push eax :760E3109 6A00 push 00000000 :760E310B FF7514 push [ebp+14] :760E310E FF75FC push [ebp-04] * Reference To: ADVAPI32.RegQueryValueExA, Ord:01A7h | :760E3111 FF15B4120E76 Call dword ptr [760E12B4] :760E3117 FF75FC push [ebp-04] :760E311A 894510 mov dword ptr [ebp+10], eax :760E311D 85C0 test eax, eax :760E311F 751C jne 760E313D * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760E3121 FF15B0120E76 Call dword ptr [760E12B0] :760E3127 8B4518 mov eax, dword ptr [ebp+18] :760E312A 3945F8 cmp dword ptr [ebp-08], eax :760E312D 0F854FF70000 jne 760F2882 :760E3133 6A01 push 00000001 :760E3135 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3153(U) | :760E3136 5F pop edi :760E3137 5E pop esi :760E3138 5B pop ebx :760E3139 C9 leave :760E313A C21400 ret 0014 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E311F(C) | * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760E313D FF15B0120E76 Call dword ptr [760E12B0] :760E3143 A184110E76 mov eax, dword ptr [760E1184] :760E3148 F60002 test byte ptr [eax], 02 :760E314B 0F8514F70000 jne 760F2865 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2832(C), :760F2845(C), :760F2860(U), :760F2872(C), :760F288A(C) |:760F289D(C), :760F28BB(U) | :760E3151 33C0 xor eax, eax :760E3153 EBE1 jmp 760E3136 :760E3155 90 nop :760E3156 90 nop :760E3157 90 nop :760E3158 52 push edx :760E3159 65 BYTE 065h :760E315A 61 popad :760E315B 64 BYTE 064h :760E315C 52 push edx :760E315D 65674B dec ebx :760E3160 65 BYTE 065h :760E3161 7900 jns 760E3163 * Referenced by a CALL at Address: |:760E35BC | * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3161(C) | Exported fn(): SfpCreateSfpDb - Ord:001Bh :760E3163 55 push ebp :760E3164 8BEC mov ebp, esp :760E3166 81EC0C030000 sub esp, 0000030C :760E316C 56 push esi :760E316D BE00B00F76 mov esi, 760FB000 :760E3172 57 push edi :760E3173 8BCE mov ecx, esi :760E3175 E8B8F6FFFF call 760E2832 :760E317A 85C0 test eax, eax :760E317C 0F84C4A80000 je 760EDA46 :760E3182 8D85F4FCFFFF lea eax, dword ptr [ebp+FFFFFCF4] :760E3188 680C030000 push 0000030C :760E318D 50 push eax * Possible StringData Ref from Code Obj ->"%windir%\system\sfp\sfpdb.sfp" | :760E318E 687C1A0E76 push 760E1A7C :760E3193 E8C0E8FFFF call 760E1A58 :760E3198 85C0 test eax, eax :760E319A 0F84E3A80000 je 760EDA83 :760E31A0 8D85F4FCFFFF lea eax, dword ptr [ebp+FFFFFCF4] :760E31A6 8BCE mov ecx, esi :760E31A8 50 push eax :760E31A9 E817000000 call 760E31C5 :760E31AE 8BF8 mov edi, eax :760E31B0 85FF test edi, edi :760E31B2 0F8408A90000 je 760EDAC0 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDABB(U), :760EDAC8(C), :760EDAE7(C), :760EDAFE(U) | :760E31B8 8BCE mov ecx, esi :760E31BA E8DBE8FFFF call 760E1A9A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDA7E(U) | :760E31BF 8BC7 mov eax, edi :760E31C1 5F pop edi :760E31C2 5E pop esi :760E31C3 C9 leave :760E31C4 C3 ret * Referenced by a CALL at Address: |:760E31A9 | :760E31C5 55 push ebp :760E31C6 8BEC mov ebp, esp :760E31C8 83EC20 sub esp, 00000020 :760E31CB 53 push ebx :760E31CC 8B5D08 mov ebx, dword ptr [ebp+08] :760E31CF 57 push edi :760E31D0 33FF xor edi, edi :760E31D2 3BDF cmp ebx, edi :760E31D4 894DF8 mov dword ptr [ebp-08], ecx :760E31D7 C745FC01000000 mov [ebp-04], 00000001 :760E31DE 0F84082B0100 je 760F5CEC :760E31E4 57 push edi :760E31E5 6880000000 push 00000080 :760E31EA 6A03 push 00000003 :760E31EC 57 push edi :760E31ED 6A03 push 00000003 :760E31EF 68000000C0 push C0000000 :760E31F4 53 push ebx * Reference To: KERNEL32.CreateFileA, Ord:0037h | :760E31F5 FF1580120E76 Call dword ptr [760E1280] :760E31FB 83F8FF cmp eax, FFFFFFFF :760E31FE 8945F4 mov dword ptr [ebp-0C], eax :760E3201 0F841D2B0100 je 760F5D24 :760E3207 56 push esi :760E3208 57 push edi :760E3209 50 push eax * Reference To: KERNEL32.GetFileSize, Ord:0125h | :760E320A FF15DC110E76 Call dword ptr [760E11DC] :760E3210 8BF0 mov esi, eax :760E3212 3BF7 cmp esi, edi :760E3214 0F844A2B0100 je 760F5D64 :760E321A 57 push edi :760E321B 57 push edi :760E321C 57 push edi :760E321D 6A08 push 00000008 :760E321F 57 push edi :760E3220 FF75F4 push [ebp-0C] * Reference To: KERNEL32.CreateFileMappingA, Ord:0038h | :760E3223 FF15E0110E76 Call dword ptr [760E11E0] :760E3229 3BC7 cmp eax, edi :760E322B 8945F0 mov dword ptr [ebp-10], eax :760E322E 0F84732B0100 je 760F5DA7 :760E3234 57 push edi :760E3235 57 push edi :760E3236 57 push edi :760E3237 6A01 push 00000001 :760E3239 50 push eax * Reference To: KERNEL32.MapViewOfFile, Ord:01F5h | :760E323A FF15E4110E76 Call dword ptr [760E11E4] :760E3240 8BD8 mov ebx, eax :760E3242 3BDF cmp ebx, edi :760E3244 0F849D2B0100 je 760F5DE7 :760E324A 8B55F8 mov edx, dword ptr [ebp-08] :760E324D FF7508 push [ebp+08] :760E3250 B9D3070000 mov ecx, 000007D3 :760E3255 33C0 xor eax, eax :760E3257 8DBA0C030000 lea edi, dword ptr [edx+0000030C] :760E325D 52 push edx :760E325E F3 repz :760E325F AB stosd * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760E3260 FF1504120E76 Call dword ptr [760E1204] :760E3266 03F3 add esi, ebx :760E3268 8BFB mov edi, ebx :760E326A 3BDE cmp ebx, esi :760E326C 7344 jnb 760E32B2 :760E326E EB2A jmp 760E329A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E32B0(U) | :760E3270 8BF8 mov edi, eax :760E3272 85FF test edi, edi :760E3274 0F84AB2B0100 je 760F5E25 :760E327A FF75EC push [ebp-14] :760E327D 8B4DF8 mov ecx, dword ptr [ebp-08] :760E3280 FF75E4 push [ebp-1C] :760E3283 FF75E0 push [ebp-20] :760E3286 FF75E8 push [ebp-18] :760E3289 E822F4FFFF call 760E26B0 :760E328E 85C0 test eax, eax :760E3290 0F84C52B0100 je 760F5E5B :760E3296 3BFE cmp edi, esi :760E3298 7318 jnb 760E32B2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E326E(U) | :760E329A 8D45EC lea eax, dword ptr [ebp-14] :760E329D 8B4DF8 mov ecx, dword ptr [ebp-08] :760E32A0 50 push eax :760E32A1 8D45E0 lea eax, dword ptr [ebp-20] :760E32A4 50 push eax :760E32A5 8D45E8 lea eax, dword ptr [ebp-18] :760E32A8 50 push eax :760E32A9 56 push esi :760E32AA 57 push edi :760E32AB E835000000 call 760E32E5 :760E32B0 EBBE jmp 760E3270 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E326C(C), :760E3298(C), :760F5E5F(U) | :760E32B2 33FF xor edi, edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5E20(U) | :760E32B4 3BDF cmp ebx, edi :760E32B6 7407 je 760E32BF :760E32B8 53 push ebx * Reference To: KERNEL32.UnmapViewOfFile, Ord:02DEh | :760E32B9 FF1590110E76 Call dword ptr [760E1190] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E32B6(C), :760F5DE2(U) | :760E32BF 397DF0 cmp dword ptr [ebp-10], edi :760E32C2 7409 je 760E32CD :760E32C4 FF75F0 push [ebp-10] * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760E32C7 FF1534120E76 Call dword ptr [760E1234] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E32C2(C), :760F5D6C(C), :760F5D8B(C), :760F5DA2(U) | :760E32CD 397DF4 cmp dword ptr [ebp-0C], edi :760E32D0 5E pop esi :760E32D1 7409 je 760E32DC :760E32D3 FF75F4 push [ebp-0C] * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760E32D6 FF1534120E76 Call dword ptr [760E1234] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E32D1(C), :760F5D5F(U) | :760E32DC 8B45FC mov eax, dword ptr [ebp-04] :760E32DF 5F pop edi :760E32E0 5B pop ebx :760E32E1 C9 leave :760E32E2 C20400 ret 0004 * Referenced by a CALL at Address: |:760E32AB | :760E32E5 55 push ebp :760E32E6 8BEC mov ebp, esp :760E32E8 51 push ecx :760E32E9 8B4510 mov eax, dword ptr [ebp+10] :760E32EC 8B4D0C mov ecx, dword ptr [ebp+0C] :760E32EF 53 push ebx :760E32F0 56 push esi :760E32F1 8B7508 mov esi, dword ptr [ebp+08] :760E32F4 C745FC01000000 mov [ebp-04], 00000001 :760E32FB 8930 mov dword ptr [eax], esi :760E32FD B32C mov bl, 2C :760E32FF EB0F jmp 760E3310 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3314(U) | :760E3301 8A06 mov al, byte ptr [esi] :760E3303 3AC3 cmp al, bl :760E3305 740F je 760E3316 :760E3307 3C0D cmp al, 0D :760E3309 0F849D260100 je 760F59AC :760E330F 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E32FF(U) | :760E3310 3BF1 cmp esi, ecx :760E3312 7302 jnb 760E3316 :760E3314 EBEB jmp 760E3301 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3305(C), :760E3312(C) | :760E3316 802600 and byte ptr [esi], 00 :760E3319 46 inc esi :760E331A 8BD6 mov edx, esi :760E331C EB0F jmp 760E332D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3331(U) | :760E331E 8A06 mov al, byte ptr [esi] :760E3320 3AC3 cmp al, bl :760E3322 740F je 760E3333 :760E3324 3C0D cmp al, 0D :760E3326 0F8480260100 je 760F59AC :760E332C 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E331C(U) | :760E332D 3BF1 cmp esi, ecx :760E332F 7302 jnb 760E3333 :760E3331 EBEB jmp 760E331E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3322(C), :760E332F(C) | :760E3333 802600 and byte ptr [esi], 00 :760E3336 46 inc esi :760E3337 897510 mov dword ptr [ebp+10], esi :760E333A EB0F jmp 760E334B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E334F(U) | :760E333C 8A06 mov al, byte ptr [esi] :760E333E 3AC3 cmp al, bl :760E3340 740F je 760E3351 :760E3342 3C0D cmp al, 0D :760E3344 0F8462260100 je 760F59AC :760E334A 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E333A(U) | :760E334B 3BF1 cmp esi, ecx :760E334D 7302 jnb 760E3351 :760E334F EBEB jmp 760E333C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3340(C), :760E334D(C) | :760E3351 802600 and byte ptr [esi], 00 :760E3354 8B4518 mov eax, dword ptr [ebp+18] :760E3357 46 inc esi :760E3358 8930 mov dword ptr [eax], esi :760E335A EB0F jmp 760E336B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E336F(U) | :760E335C 8A06 mov al, byte ptr [esi] :760E335E 3C0D cmp al, 0D :760E3360 740F je 760E3371 :760E3362 3AC3 cmp al, bl :760E3364 0F8442260100 je 760F59AC :760E336A 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E335A(U) | :760E336B 3BF1 cmp esi, ecx :760E336D 7302 jnb 760E3371 :760E336F EBEB jmp 760E335C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3360(C), :760E336D(C) | :760E3371 802600 and byte ptr [esi], 00 * Reference To: MSVCRT.strtoul, Ord:02C6h | :760E3374 8B1D48100E76 mov ebx, dword ptr [760E1048] :760E337A 57 push edi :760E337B 8D4508 lea eax, dword ptr [ebp+08] :760E337E 6A10 push 00000010 :760E3380 50 push eax :760E3381 52 push edx :760E3382 46 inc esi :760E3383 FFD3 call ebx :760E3385 8B7D14 mov edi, dword ptr [ebp+14] :760E3388 6A10 push 00000010 :760E338A 8907 mov dword ptr [edi], eax :760E338C 83670400 and dword ptr [edi+04], 00000000 :760E3390 8D4508 lea eax, dword ptr [ebp+08] :760E3393 50 push eax :760E3394 FF7510 push [ebp+10] :760E3397 FFD3 call ebx :760E3399 8BD8 mov ebx, eax :760E339B 83C418 add esp, 00000018 :760E339E 895D08 mov dword ptr [ebp+08], ebx :760E33A1 33DB xor ebx, ebx :760E33A3 6A01 push 00000001 :760E33A5 53 push ebx :760E33A6 FF7704 push [edi+04] :760E33A9 FF37 push dword ptr [edi] :760E33AB E8CCF2FFFF call 760E267C :760E33B0 8B4D08 mov ecx, dword ptr [ebp+08] :760E33B3 03C8 add ecx, eax :760E33B5 8BC7 mov eax, edi :760E33B7 13DA adc ebx, edx :760E33B9 5F pop edi :760E33BA 8908 mov dword ptr [eax], ecx :760E33BC 895804 mov dword ptr [eax+04], ebx :760E33BF 803E0A cmp byte ptr [esi], 0A :760E33C2 7501 jne 760E33C5 :760E33C4 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E33C2(C), :760F59B0(U) | :760E33C5 8B45FC mov eax, dword ptr [ebp-04] :760E33C8 F7D8 neg eax :760E33CA 1BC0 sbb eax, eax :760E33CC 23C6 and eax, esi :760E33CE 5E pop esi :760E33CF 5B pop ebx :760E33D0 C9 leave :760E33D1 C21400 ret 0014 Exported fn(): SFPInit - Ord:0010h :760E33D4 81ECD00B0000 sub esp, 00000BD0 :760E33DA 8A1546170E76 mov dl, byte ptr [760E1746] :760E33E0 53 push ebx :760E33E1 55 push ebp :760E33E2 56 push esi :760E33E3 57 push edi :760E33E4 6A40 push 00000040 :760E33E6 59 pop ecx :760E33E7 33C0 xor eax, eax :760E33E9 8DBC24B5000000 lea edi, dword ptr [esp+000000B5] :760E33F0 889424B4000000 mov byte ptr [esp+000000B4], dl :760E33F7 F3 repz :760E33F8 AB stosd :760E33F9 66AB stosw :760E33FB AA stosb :760E33FC BEC2000000 mov esi, 000000C2 :760E3401 33C0 xor eax, eax :760E3403 8BCE mov ecx, esi :760E3405 8DBC24BD020000 lea edi, dword ptr [esp+000002BD] :760E340C 889424BC020000 mov byte ptr [esp+000002BC], dl :760E3413 889424C8050000 mov byte ptr [esp+000005C8], dl :760E341A F3 repz :760E341B AB stosd :760E341C 66AB stosw :760E341E AA stosb :760E341F 8BCE mov ecx, esi :760E3421 33C0 xor eax, eax :760E3423 8DBC24C9050000 lea edi, dword ptr [esp+000005C9] :760E342A 6A01 push 00000001 :760E342C F3 repz :760E342D AB stosd :760E342E 66AB stosw :760E3430 AA stosb :760E3431 8B8424E80B0000 mov eax, dword ptr [esp+00000BE8] :760E3438 C74424184F050000 mov [esp+18], 0000054F :760E3440 A3D0D80F76 mov dword ptr [760FD8D0], eax :760E3445 58 pop eax :760E3446 50 push eax :760E3447 A3A4DA0F76 mov dword ptr [760FDAA4], eax :760E344C FF3574DA0F76 push dword ptr [760FDA74] :760E3452 8D442418 lea eax, dword ptr [esp+18] :760E3456 C744241804010000 mov [esp+18], 00000104 :760E345E FF3578DA0F76 push dword ptr [760FDA78] :760E3464 50 push eax :760E3465 8D8424C4000000 lea eax, dword ptr [esp+000000C4] :760E346C 50 push eax :760E346D E843FCFFFF call 760E30B5 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E3472 8B3580110E76 mov esi, dword ptr [760E1180] * Possible StringData Ref from Code Obj ->"SFPInit" | :760E3478 BB88390E76 mov ebx, 760E3988 :760E347D 85C0 test eax, eax :760E347F BD7CDA0F76 mov ebp, 760FDA7C :760E3484 0F8599880000 jne 760EBD23 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760E348A FF15A0110E76 Call dword ptr [760E11A0] :760E3490 8BF8 mov edi, eax :760E3492 A184110E76 mov eax, dword ptr [760E1184] :760E3497 F60004 test byte ptr [eax], 04 :760E349A 0F8532880000 jne 760EBCD2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBCDF(C) | :760E34A0 BF06030000 mov edi, 00000306 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBCF9(U) | :760E34A5 A184110E76 mov eax, dword ptr [760E1184] :760E34AA F60004 test byte ptr [eax], 04 :760E34AD 0F854B880000 jne 760EBCFE * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EBD0B(C), :760EBD1E(U), :760EBD98(U) | :760E34B3 6A43 push 00000043 * Reference To: USER32.GetSystemMetrics, Ord:0149h | :760E34B5 FF158C120E76 Call dword ptr [760E128C] :760E34BB 85C0 test eax, eax :760E34BD 0F85DA880000 jne 760EBD9D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBDCA(U) | :760E34C3 6A04 push 00000004 :760E34C5 8325A8DA0F7600 and dword ptr [760FDAA8], 00000000 :760E34CC 58 pop eax :760E34CD 8364241800 and dword ptr [esp+18], 00000000 :760E34D2 8D4C2418 lea ecx, dword ptr [esp+18] :760E34D6 50 push eax :760E34D7 51 push ecx :760E34D8 89442418 mov dword ptr [esp+18], eax :760E34DC 50 push eax * Possible StringData Ref from Code Obj ->"ShowPopups" | :760E34DD 687C390E76 push 760E397C :760E34E2 8D442420 lea eax, dword ptr [esp+20] * Possible StringData Ref from Code Obj ->"Software\Microsoft\Windows\CurrentVersion\Syst" ->"emFileProtection\" | :760E34E6 68441F0E76 push 760E1F44 :760E34EB 50 push eax :760E34EC 68A8DA0F76 push 760FDAA8 :760E34F1 E8AA010000 call 760E36A0 :760E34F6 85C0 test eax, eax :760E34F8 0F84D1880000 je 760EBDCF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBDD5(U) | :760E34FE 8D8424BC020000 lea eax, dword ptr [esp+000002BC] :760E3505 680C030000 push 0000030C :760E350A 50 push eax * Possible StringData Ref from Code Obj ->"%windir%\system\sfp\sfpdb.sfp" | :760E350B 687C1A0E76 push 760E1A7C :760E3510 E843E5FFFF call 760E1A58 :760E3515 85C0 test eax, eax :760E3517 0F84BD880000 je 760EBDDA :760E351D 6800040000 push 00000400 :760E3522 68B0DA0F76 push 760FDAB0 * Possible StringData Ref from Code Obj ->"%windir%\wininit.ini" | :760E3527 6864390E76 push 760E3964 :760E352C E827E5FFFF call 760E1A58 :760E3531 85C0 test eax, eax :760E3533 0F84D4880000 je 760EBE0D :760E3539 E8E6E8FFFF call 760E1E24 :760E353E 85C0 test eax, eax :760E3540 0F84EF880000 je 760EBE35 :760E3546 8D8424C8050000 lea eax, dword ptr [esp+000005C8] :760E354D 680C030000 push 0000030C :760E3552 50 push eax * Possible StringData Ref from Code Obj ->"%windir%\system\sfp\sfplog.txt" | :760E3553 6844390E76 push 760E3944 :760E3558 E8FBE4FFFF call 760E1A58 :760E355D 85C0 test eax, eax :760E355F 0F84F8880000 je 760EBE5D :760E3565 8D8424C8050000 lea eax, dword ptr [esp+000005C8] :760E356C B918D30F76 mov ecx, 760FD318 :760E3571 50 push eax :760E3572 E84F010000 call 760E36C6 :760E3577 85C0 test eax, eax :760E3579 8944241C mov dword ptr [esp+1C], eax :760E357D 0F8505890000 jne 760EBE88 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EBE90(C), :760EBEA3(C), :760EBEBB(U) | :760E3583 E87F020000 call 760E3807 :760E3588 85C0 test eax, eax :760E358A 0F8430890000 je 760EBEC0 :760E3590 83BC24E80B000001 cmp dword ptr [esp+00000BE8], 00000001 :760E3598 7450 je 760E35EA :760E359A 8D8424BC020000 lea eax, dword ptr [esp+000002BC] :760E35A1 50 push eax :760E35A2 E894020000 call 760E383B :760E35A7 85C0 test eax, eax :760E35A9 743F je 760E35EA :760E35AB 8D8424BC020000 lea eax, dword ptr [esp+000002BC] :760E35B2 50 push eax :760E35B3 E8E6030000 call 760E399E :760E35B8 85C0 test eax, eax :760E35BA 742E je 760E35EA * Reference To: SfpDll.SfpCreateSfpDb | :760E35BC E8A2FBFFFF call 760E3163 :760E35C1 85C0 test eax, eax :760E35C3 0F842D890000 je 760EBEF6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E369B(U) | :760E35C9 FFB424E40B0000 push dword ptr [esp+00000BE4] * Reference To: KERNEL32.SetEvent, Ord:0290h | :760E35D0 FF15A4110E76 Call dword ptr [760E11A4] :760E35D6 85C0 test eax, eax :760E35D8 0F848F890000 je 760EBF6D :760E35DE 6A00 push 00000000 :760E35E0 E8DCE4FFFF call 760E1AC1 :760E35E5 E9A6890000 jmp 760EBF90 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3598(C), :760E35A9(C), :760E35BA(C) | :760E35EA A046170E76 mov al, byte ptr [760E1746] :760E35EF B9C2000000 mov ecx, 000000C2 :760E35F4 888424D4080000 mov byte ptr [esp+000008D4], al :760E35FB 33C0 xor eax, eax :760E35FD 8DBC24D5080000 lea edi, dword ptr [esp+000008D5] :760E3604 680C030000 push 0000030C :760E3609 F3 repz :760E360A AB stosd :760E360B 66AB stosw :760E360D AA stosb :760E360E 8D8424D8080000 lea eax, dword ptr [esp+000008D8] :760E3615 50 push eax * Possible StringData Ref from Code Obj ->"%windir%\system\restore\filelist.xml" | :760E3616 681C390E76 push 760E391C :760E361B E838E4FFFF call 760E1A58 :760E3620 85C0 test eax, eax :760E3622 0F84F9880000 je 760EBF21 :760E3628 E8F8030000 call 760E3A25 :760E362D 6A00 push 00000000 :760E362F 8D8424D8080000 lea eax, dword ptr [esp+000008D8] :760E3636 6800B00F76 push 760FB000 :760E363B 50 push eax * Reference To: SfpDll.SfpSyncDb | :760E363C E8A3040000 call 760E3AE4 :760E3641 85C0 test eax, eax :760E3643 0F84FC880000 je 760EBF45 :760E3649 8D442420 lea eax, dword ptr [esp+20] :760E364D C744242094000000 mov [esp+20], 00000094 :760E3655 50 push eax * Reference To: KERNEL32.GetVersionExA, Ord:018Fh | :760E3656 FF1560120E76 Call dword ptr [760E1260] :760E365C 0FB744242C movzx eax, word ptr [esp+2C] :760E3661 50 push eax :760E3662 8D8424BC010000 lea eax, dword ptr [esp+000001BC] :760E3669 FF74242C push [esp+2C] :760E366D FF74242C push [esp+2C] * Possible StringData Ref from Code Obj ->"SFP FirstRun - OS Version Major=%ld " ->"Minor=%ld Build=%ld" | :760E3671 68E4380E76 push 760E38E4 :760E3676 50 push eax * Reference To: USER32.wsprintfA, Ord:02B3h | :760E3677 FF15A4120E76 Call dword ptr [760E12A4] :760E367D 83C414 add esp, 00000014 :760E3680 8D8424B8010000 lea eax, dword ptr [esp+000001B8] :760E3687 B918D30F76 mov ecx, 760FD318 :760E368C 6A00 push 00000000 :760E368E 50 push eax :760E368F 6A03 push 00000003 :760E3691 E81AEDFFFF call 760E23B0 :760E3696 BF06030000 mov edi, 00000306 :760E369B E929FFFFFF jmp 760E35C9 * Referenced by a CALL at Address: |:760E34F1 | :760E36A0 55 push ebp :760E36A1 8BEC mov ebp, esp :760E36A3 FF7518 push [ebp+18] :760E36A6 FF7514 push [ebp+14] :760E36A9 FF7510 push [ebp+10] :760E36AC FF750C push [ebp+0C] :760E36AF FF7508 push [ebp+08] :760E36B2 E8FEF9FFFF call 760E30B5 :760E36B7 85C0 test eax, eax :760E36B9 0F8402F10000 je 760F27C1 :760E36BF 6A01 push 00000001 :760E36C1 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F27EE(U), :760F27F5(U) | :760E36C2 5D pop ebp :760E36C3 C21C00 ret 001C * Referenced by a CALL at Address: |:760E3572 | :760E36C6 6A03 push 00000003 :760E36C8 FF742408 push [esp+08] :760E36CC E803000000 call 760E36D4 :760E36D1 C20400 ret 0004 * Referenced by a CALL at Address: |:760E36CC | :760E36D4 55 push ebp :760E36D5 8BEC mov ebp, esp :760E36D7 81EC00040000 sub esp, 00000400 :760E36DD 8B450C mov eax, dword ptr [ebp+0C] :760E36E0 53 push ebx :760E36E1 56 push esi :760E36E2 8BD9 mov ebx, ecx :760E36E4 FF7508 push [ebp+08] :760E36E7 89430C mov dword ptr [ebx+0C], eax * Reference To: MSVCRT._strdup, Ord:01BCh | :760E36EA FF152C100E76 Call dword ptr [760E102C] :760E36F0 85C0 test eax, eax :760E36F2 59 pop ecx :760E36F3 894308 mov dword ptr [ebx+08], eax :760E36F6 0F8473080100 je 760F3F6F :760E36FC 57 push edi :760E36FD 8BF8 mov edi, eax :760E36FF 83C9FF or ecx, FFFFFFFF :760E3702 33C0 xor eax, eax :760E3704 F2 repnz :760E3705 AE scasb :760E3706 F7D1 not ecx :760E3708 2BF9 sub edi, ecx :760E370A 8D9500FCFFFF lea edx, dword ptr [ebp+FFFFFC00] :760E3710 8BC1 mov eax, ecx :760E3712 8BF7 mov esi, edi :760E3714 8BFA mov edi, edx :760E3716 C1E902 shr ecx, 02 :760E3719 F3 repz :760E371A A5 movsd :760E371B 8BC8 mov ecx, eax :760E371D 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760E3723 83E103 and ecx, 00000003 :760E3726 50 push eax :760E3727 F3 repz :760E3728 A4 movsb * Reference To: USER32.CharUpperA, Ord:002Fh | :760E3729 FF1594120E76 Call dword ptr [760E1294] :760E372F 80BD00FCFFFF00 cmp byte ptr [ebp+FFFFFC00], 00 :760E3736 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760E373C 5F pop edi :760E373D 7412 je 760E3751 :760E373F EB09 jmp 760E374A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E374F(U) | :760E3741 C60020 mov byte ptr [eax], 20 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E374D(C) | :760E3744 40 inc eax :760E3745 803800 cmp byte ptr [eax], 00 :760E3748 7407 je 760E3751 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E373F(U) | :760E374A 80385C cmp byte ptr [eax], 5C :760E374D 75F5 jne 760E3744 :760E374F EBF0 jmp 760E3741 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E373D(C), :760E3748(C) | :760E3751 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760E3757 33F6 xor esi, esi :760E3759 50 push eax :760E375A 6A01 push 00000001 :760E375C 56 push esi :760E375D 56 push esi * Reference To: KERNEL32.CreateSemaphoreA, Ord:004Ah | :760E375E FF1520120E76 Call dword ptr [760E1220] :760E3764 3BC6 cmp eax, esi :760E3766 894304 mov dword ptr [ebx+04], eax :760E3769 0F8408080100 je 760F3F77 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760E376F FF15A0110E76 Call dword ptr [760E11A0] :760E3775 3DB7000000 cmp eax, 000000B7 :760E377A 7413 je 760E378F :760E377C 8BCB mov ecx, ebx :760E377E E814000000 call 760E3797 :760E3783 56 push esi :760E3784 6A01 push 00000001 :760E3786 FF7304 push [ebx+04] * Reference To: KERNEL32.ReleaseSemaphore, Ord:024Ah | :760E3789 FF1524120E76 Call dword ptr [760E1224] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E377A(C) | :760E378F 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3F72(U), :760F3FB5(U) | :760E3791 5E pop esi :760E3792 5B pop ebx :760E3793 C9 leave :760E3794 C20800 ret 0008 * Referenced by a CALL at Address: |:760E377E | :760E3797 83EC14 sub esp, 00000014 :760E379A 53 push ebx :760E379B 55 push ebp :760E379C 56 push esi :760E379D 57 push edi :760E379E 33FF xor edi, edi * Reference To: KERNEL32.CreateFileA, Ord:0037h | :760E37A0 8B1D80120E76 mov ebx, dword ptr [760E1280] :760E37A6 57 push edi :760E37A7 6800000010 push 10000000 :760E37AC 6A04 push 00000004 :760E37AE 57 push edi :760E37AF 8BF1 mov esi, ecx :760E37B1 6A03 push 00000003 :760E37B3 68000000C0 push C0000000 :760E37B8 897C2434 mov dword ptr [esp+34], edi :760E37BC FF7608 push [esi+08] :760E37BF 897C243C mov dword ptr [esp+3C], edi :760E37C3 C744242C01000000 mov [esp+2C], 00000001 :760E37CB FFD3 call ebx :760E37CD 8BE8 mov ebp, eax :760E37CF 83FDFF cmp ebp, FFFFFFFF :760E37D2 0F84AC090100 je 760F4184 :760E37D8 57 push edi :760E37D9 55 push ebp * Reference To: KERNEL32.GetFileSize, Ord:0125h | :760E37DA FF15DC110E76 Call dword ptr [760E11DC] :760E37E0 3D400D0300 cmp eax, 00030D40 :760E37E5 0F83DE090100 jnb 760F41C9 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F421C(U), :760F4459(U) | :760E37EB 3BEF cmp ebp, edi :760E37ED 740C je 760E37FB :760E37EF 83FDFF cmp ebp, FFFFFFFF :760E37F2 7407 je 760E37FB :760E37F4 55 push ebp * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760E37F5 FF1534120E76 Call dword ptr [760E1234] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E37ED(C), :760E37F2(C), :760F41C4(U) | :760E37FB 8B442410 mov eax, dword ptr [esp+10] :760E37FF 5F pop edi :760E3800 5E pop esi :760E3801 5D pop ebp :760E3802 5B pop ebx :760E3803 83C414 add esp, 00000014 :760E3806 C3 ret * Referenced by a CALL at Addresses: |:760E3583 , :760EF285 , :760EF59B | :760E3807 56 push esi :760E3808 33F6 xor esi, esi :760E380A 3935B0DE0F76 cmp dword ptr [760FDEB0], esi :760E3810 0F8529970000 jne 760ECF3F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECF46(C) | :760E3816 6A00 push 00000000 :760E3818 68B0D90F76 push 760FD9B0 :760E381D 68B0DE0F76 push 760FDEB0 * Reference To: WINTRUST.CryptCATAdminAcquireContext, Ord:0002h | :760E3822 E80E000000 Call 760E3835 :760E3827 8BF0 mov esi, eax :760E3829 85F6 test esi, esi :760E382B 0F845D970000 je 760ECF8E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECF54(C), :760ECF70(C), :760ECF89(U), :760ECFD4(U) | :760E3831 8BC6 mov eax, esi :760E3833 5E pop esi :760E3834 C3 ret * Referenced by a CALL at Addresses: |:760E3822 , :760EEA10 | * Reference To: WINTRUST.CryptCATAdminAcquireContext, Ord:0002h | :760E3835 FF25C8100E76 Jmp dword ptr [760E10C8] * Referenced by a CALL at Addresses: |:760E35A2 , :760EB768 , :760EC8D0 , :760ED560 , :760EDEC5 |:760EEE19 , :760EEF99 , :760EF08C , :760F0705 | :760E383B A184110E76 mov eax, dword ptr [760E1184] :760E3840 53 push ebx :760E3841 55 push ebp :760E3842 56 push esi * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E3843 8B3580110E76 mov esi, dword ptr [760E1180] :760E3849 57 push edi :760E384A 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"DoesFileExist" | :760E384C BD90390E76 mov ebp, 760E3990 :760E3851 5B pop ebx * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760E3852 BFA0D80F76 mov edi, 760FD8A0 :760E3857 8418 test byte ptr [eax], bl :760E3859 0F854FEB0000 jne 760F23AE * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F23BA(C), :760F23D6(U) | :760E385F FF742414 push [esp+14] * Reference To: KERNEL32.GetFileAttributesA, Ord:0120h | :760E3863 FF15C4110E76 Call dword ptr [760E11C4] :760E3869 83F8FF cmp eax, FFFFFFFF :760E386C 7520 jne 760E388E * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760E386E FF15A0110E76 Call dword ptr [760E11A0] :760E3874 89442414 mov dword ptr [esp+14], eax :760E3878 A184110E76 mov eax, dword ptr [760E1184] :760E387D 8418 test byte ptr [eax], bl :760E387F 0F8556EB0000 jne 760F23DB * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F23E7(C), :760F2403(U), :760F240A(C), :760F241C(C), :760F2433(U) | :760E3885 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E38A6(U) | :760E3887 5F pop edi :760E3888 5E pop esi :760E3889 5D pop ebp :760E388A 5B pop ebx :760E388B C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E386C(C) | :760E388E A810 test al, 10 :760E3890 A184110E76 mov eax, dword ptr [760E1184] :760E3895 0F856DEB0000 jne 760F2408 :760E389B 8418 test byte ptr [eax], bl :760E389D 0F8595EB0000 jne 760F2438 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2444(C), :760F245B(U) | :760E38A3 6A01 push 00000001 :760E38A5 58 pop eax :760E38A6 EBDF jmp 760E3887 :760E38A8 53 push ebx :760E38A9 7973 jns 760E391E :760E38AB 7465 je 760E3912 :760E38AD 6D insd :760E38AE 5C pop esp :760E38AF 43 inc ebx :760E38B0 7572 jne 760E3924 :760E38B2 7265 jb 760E3919 :760E38B4 6E outsb :760E38B5 7443 je 760E38FA :760E38B7 6F outsd :760E38B8 6E outsb :760E38B9 7472 je 760E392D :760E38BB 6F outsd :760E38BC 6C insb :760E38BD 53 push ebx :760E38BE 65 BYTE 065h :760E38BF 745C je 760E391D :760E38C1 53 push ebx :760E38C2 65 BYTE 065h :760E38C3 7276 jb 760E393B :760E38C5 696365735C5678 imul esp, dword ptr [ebx+65], 78565C73 :760E38CC 44 inc esp :760E38CD 5C pop esp :760E38CE 56 push esi :760E38CF 7844 js 760E3915 :760E38D1 4D dec ebp :760E38D2 6F outsd :760E38D3 6E outsb :760E38D4 009090905678 add byte ptr [eax+78569090], dl :760E38DA 64 BYTE 064h :760E38DB 43 inc ebx :760E38DC 64 BYTE 064h :760E38DD 50 push eax :760E38DE 61 popad :760E38DF 676500909053 add gs:[bx+si+5390], dl :760E38E5 46 inc esi :760E38E6 50 push eax :760E38E7 204669 and byte ptr [esi+69], al :760E38EA 7273 jb 760E395F :760E38EC 7452 je 760E3940 :760E38EE 756E jne 760E395E :760E38F0 202D204F5320 and byte ptr [20534F20], ch :760E38F6 56 push esi :760E38F7 65 BYTE 065h :760E38F8 7273 jb 760E396D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E38B5(C) | :760E38FA 696F6E204D616A imul ebp, dword ptr [edi+6E], 6A614D20 :760E3901 6F outsd :760E3902 723D jb 760E3941 :760E3904 256C64204D and eax, 4D20646C :760E3909 696E6F723D256C imul ebp, dword ptr [esi+6F], 6C253D72 :760E3910 64204275 and byte ptr fs:[edx+75], al :760E3914 696C643D256C6400 imul ebp, dword ptr [esp+3D], 00646C25 :760E391C 2577696E64 and eax, 646E6977 :760E3921 6972255C737973 imul esi, dword ptr [edx+25], 7379735C :760E3928 7465 je 760E398F :760E392A 6D insd :760E392B 5C pop esp :760E392C 7265 jb 760E3993 :760E392E 7374 jnb 760E39A4 :760E3930 6F outsd :760E3931 7265 jb 760E3998 :760E3933 5C pop esp :760E3934 66696C656C6973 imul bp, word ptr [ebp+6C], 7369 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E38C3(C) | :760E393B 742E je 760E396B :760E393D 786D js 760E39AC :760E393F 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E38EC(C) | :760E3940 009090902577 add byte ptr [eax+77259090], dl :760E3946 696E646972255C imul ebp, dword ptr [esi+64], 5C257269 :760E394D 7379 jnb 760E39C8 :760E394F 7374 jnb 760E39C5 :760E3951 65 BYTE 065h :760E3952 6D insd :760E3953 5C pop esp :760E3954 7366 jnb 760E39BC :760E3956 705C jo 760E39B4 :760E3958 7366 jnb 760E39C0 :760E395A 706C jo 760E39C8 :760E395C 6F outsd :760E395D 67 BYTE 067h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E38EE(C) | :760E395E 2E BYTE 02eh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E38EA(C) | :760E395F 7478 je 760E39D9 :760E3961 7400 je 760E3963 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3961(C) | :760E3963 90 nop :760E3964 2577696E64 and eax, 646E6977 :760E3969 6972255C77696E imul esi, dword ptr [edx+25], 6E69775C :760E3970 696E69742E696E imul ebp, dword ptr [esi+69], 6E692E74 :760E3977 690090909053 imul eax, dword ptr [eax], 53909090 :760E397D 686F77506F push 6F50776F :760E3982 7075 jo 760E39F9 :760E3984 7073 jo 760E39F9 :760E3986 009053465049 add byte ptr [eax+49504653], dl :760E398C 6E outsb :760E398D 697400446F657346 imul esi, dword ptr [eax+eax+44], 4673656F :760E3995 696C654578697374 imul ebp, dword ptr [ebp+45], 74736978 :760E399D 00 BYTE 0 * Referenced by a CALL at Address: |:760E35B3 | :760E399E 55 push ebp :760E399F 8BEC mov ebp, esp :760E39A1 81EC18030000 sub esp, 00000318 :760E39A7 53 push ebx :760E39A8 8D45F4 lea eax, dword ptr [ebp-0C] :760E39AB 56 push esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E393D(C) | :760E39AC 50 push eax :760E39AD 8D45FC lea eax, dword ptr [ebp-04] :760E39B0 33DB xor ebx, ebx :760E39B2 50 push eax :760E39B3 895DFC mov dword ptr [ebp-04], ebx :760E39B6 FF7508 push [ebp+08] :760E39B9 C745F80C030000 mov [ebp-08], 0000030C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3958(C) | :760E39C0 E8BFE5FFFF call 760E1F84 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E394F(C) | :760E39C5 85C0 test eax, eax :760E39C7 0F8527800000 jne 760EB9F4 :760E39CD 6A03 push 00000003 * Possible StringData Ref from Code Obj ->"SfpDbHash" | :760E39CF 6804200E76 push 760E2004 :760E39D4 8D45F8 lea eax, dword ptr [ebp-08] * Possible StringData Ref from Code Obj ->"Software\Microsoft\Windows\CurrentVersion\Syst" ->"emFileProtection\" | :760E39D7 68441F0E76 push 760E1F44 :760E39DC 50 push eax :760E39DD 8D85E8FCFFFF lea eax, dword ptr [ebp+FFFFFCE8] :760E39E3 50 push eax :760E39E4 E8CCF6FFFF call 760E30B5 :760E39E9 85C0 test eax, eax :760E39EB 0F843A800000 je 760EBA2B :760E39F1 8B4DF8 mov ecx, dword ptr [ebp-08] :760E39F4 394DF4 cmp dword ptr [ebp-0C], ecx :760E39F7 0F8575800000 jne 760EBA72 :760E39FD 57 push edi :760E39FE 8B7DFC mov edi, dword ptr [ebp-04] :760E3A01 8DB5E8FCFFFF lea esi, dword ptr [ebp+FFFFFCE8] :760E3A07 33C0 xor eax, eax :760E3A09 F3 repz :760E3A0A A6 cmpsb :760E3A0B 5F pop edi :760E3A0C 0F8556800000 jne 760EBA68 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBA6D(U) | :760E3A12 3BC3 cmp eax, ebx :760E3A14 0F8558800000 jne 760EBA72 :760E3A1A 6A01 push 00000001 :760E3A1C 5B pop ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB9FC(C), :760EBA1B(C), :760EBA3B(C), :760EBA5A(C), :760EBA7A(C) |:760EBA99(C), :760EBAB4(U) | :760E3A1D 8BC3 mov eax, ebx :760E3A1F 5E pop esi :760E3A20 5B pop ebx :760E3A21 C9 leave :760E3A22 C20400 ret 0004 * Referenced by a CALL at Address: |:760E3628 | :760E3A25 55 push ebp :760E3A26 8BEC mov ebp, esp :760E3A28 B83C110000 mov eax, 0000113C :760E3A2D E846090000 call 760E4378 :760E3A32 56 push esi :760E3A33 8D4DF8 lea ecx, dword ptr [ebp-08] :760E3A36 E861000000 call 760E3A9C :760E3A3B BE00040000 mov esi, 00000400 :760E3A40 8D85ACF2FFFF lea eax, dword ptr [ebp+FFFFF2AC] :760E3A46 56 push esi :760E3A47 50 push eax * Possible StringData Ref from Code Obj ->"%windir%\system\sfp\tempcats" | :760E3A48 68F41E0E76 push 760E1EF4 :760E3A4D E806E0FFFF call 760E1A58 :760E3A52 85C0 test eax, eax :760E3A54 0F845F800000 je 760EBAB9 :760E3A5A 8D85ACF2FFFF lea eax, dword ptr [ebp+FFFFF2AC] :760E3A60 8D4DF8 lea ecx, dword ptr [ebp-08] :760E3A63 50 push eax :760E3A64 E846000000 call 760E3AAF :760E3A69 85C0 test eax, eax :760E3A6B 0F848B800000 je 760EBAFC :760E3A71 8D85ACF6FFFF lea eax, dword ptr [ebp+FFFFF6AC] :760E3A77 56 push esi :760E3A78 50 push eax :760E3A79 8D85ACFEFFFF lea eax, dword ptr [ebp+FFFFFEAC] :760E3A7F 50 push eax :760E3A80 8D4DF8 lea ecx, dword ptr [ebp-08] :760E3A83 E8DE040000 call 760E3F66 :760E3A88 83F801 cmp eax, 00000001 :760E3A8B 0F84B1800000 je 760EBB42 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EBAC1(C), :760EBAE0(C), :760EBAF7(U), :760EBB04(C), :760EBB23(C) |:760EBB3D(U), :760EBCCD(U) | :760E3A91 8D4DF8 lea ecx, dword ptr [ebp-08] :760E3A94 E828E3FFFF call 760E1DC1 :760E3A99 5E pop esi :760E3A9A C9 leave :760E3A9B C3 ret * Referenced by a CALL at Addresses: |:760E3A36 , :760E3B15 , :760EED83 , :760EF3A3 | :760E3A9C 56 push esi :760E3A9D 8BF1 mov esi, ecx :760E3A9F 832600 and dword ptr [esi], 00000000 * Reference To: KERNEL32.GetProcessHeap, Ord:0155h | :760E3AA2 FF15F8110E76 Call dword ptr [760E11F8] :760E3AA8 894604 mov dword ptr [esi+04], eax :760E3AAB 8BC6 mov eax, esi :760E3AAD 5E pop esi :760E3AAE C3 ret * Referenced by a CALL at Addresses: |:760E3A64 , :760EFEB2 | :760E3AAF 53 push ebx :760E3AB0 56 push esi :760E3AB1 8BF1 mov esi, ecx :760E3AB3 33DB xor ebx, ebx :760E3AB5 57 push edi * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760E3AB6 8B3DFC110E76 mov edi, dword ptr [760E11FC] :760E3ABC 8B06 mov eax, dword ptr [esi] :760E3ABE 3BC3 cmp eax, ebx :760E3AC0 0F85B60D0100 jne 760F487C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4883(U) | :760E3AC6 FF742410 push [esp+10] :760E3ACA 8BCE mov ecx, esi :760E3ACC E83F040000 call 760E3F10 :760E3AD1 3BC3 cmp eax, ebx :760E3AD3 8906 mov dword ptr [esi], eax :760E3AD5 0F84AD0D0100 je 760F4888 :760E3ADB 6A01 push 00000001 :760E3ADD 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F48CA(U) | :760E3ADE 5F pop edi :760E3ADF 5E pop esi :760E3AE0 5B pop ebx :760E3AE1 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E363C , :760EC806 | Exported fn(): SfpSyncDb - Ord:0023h :760E3AE4 55 push ebp :760E3AE5 8BEC mov ebp, esp :760E3AE7 B8C8520000 mov eax, 000052C8 :760E3AEC E887080000 call 760E4378 :760E3AF1 53 push ebx :760E3AF2 56 push esi :760E3AF3 57 push edi :760E3AF4 8D8DD0CFFFFF lea ecx, dword ptr [ebp+FFFFCFD0] :760E3AFA E8F1DCFFFF call 760E17F0 :760E3AFF 8D8D38ADFFFF lea ecx, dword ptr [ebp+FFFFAD38] :760E3B05 E8E6DCFFFF call 760E17F0 :760E3B0A 8D4DB0 lea ecx, dword ptr [ebp-50] :760E3B0D E8EA020000 call 760E3DFC :760E3B12 8D4DF4 lea ecx, dword ptr [ebp-0C] :760E3B15 E882FFFFFF call 760E3A9C :760E3B1A FF7508 push [ebp+08] :760E3B1D 33F6 xor esi, esi :760E3B1F 8D4DB0 lea ecx, dword ptr [ebp-50] :760E3B22 8975FC mov dword ptr [ebp-04], esi :760E3B25 E8FD020000 call 760E3E27 :760E3B2A 85C0 test eax, eax :760E3B2C 0F8476C10000 je 760EFCA8 :760E3B32 6A73 push 00000073 :760E3B34 8D4DB0 lea ecx, dword ptr [ebp-50] :760E3B37 E8140F0000 call 760E4A50 :760E3B3C 8BF8 mov edi, eax :760E3B3E 3BFE cmp edi, esi :760E3B40 0F8EC8C10000 jle 760EFD0E :760E3B46 EB1F jmp 760E3B67 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3B7F(U) | :760E3B48 3BC3 cmp eax, ebx :760E3B4A 0F858BC10000 jne 760EFCDB :760E3B50 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760E3B56 8D8DD0CFFFFF lea ecx, dword ptr [ebp+FFFFCFD0] :760E3B5C 50 push eax :760E3B5D E888EAFFFF call 760E25EA :760E3B62 46 inc esi :760E3B63 3BF7 cmp esi, edi :760E3B65 7D1A jge 760E3B81 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3B46(U) | :760E3B67 BB00040000 mov ebx, 00000400 :760E3B6C 6A73 push 00000073 :760E3B6E 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760E3B74 53 push ebx :760E3B75 50 push eax :760E3B76 56 push esi :760E3B77 8D4DB0 lea ecx, dword ptr [ebp-50] :760E3B7A E84D0F0000 call 760E4ACC :760E3B7F EBC7 jmp 760E3B48 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3B65(C), :760EFD13(U) | :760E3B81 8B4D0C mov ecx, dword ptr [ebp+0C] :760E3B84 E8A9ECFFFF call 760E2832 :760E3B89 85C0 test eax, eax :760E3B8B 0F8487C10000 je 760EFD18 :760E3B91 8B4D0C mov ecx, dword ptr [ebp+0C] :760E3B94 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760E3B9A 6A01 push 00000001 :760E3B9C 50 push eax :760E3B9D E817110000 call 760E4CB9 :760E3BA2 83F801 cmp eax, 00000001 :760E3BA5 0F84ADC10000 je 760EFD58 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFD81(C) | :760E3BAB 8D8568F6FFFF lea eax, dword ptr [ebp+FFFFF668] :760E3BB1 6A01 push 00000001 :760E3BB3 50 push eax :760E3BB4 8D8DD0CFFFFF lea ecx, dword ptr [ebp+FFFFCFD0] :760E3BBA E8FA100000 call 760E4CB9 :760E3BBF 85C0 test eax, eax :760E3BC1 0F84F8C10000 je 760EFDBF :760E3BC7 8DBD68F6FFFF lea edi, dword ptr [ebp+FFFFF668] :760E3BCD 83C9FF or ecx, FFFFFFFF :760E3BD0 33C0 xor eax, eax :760E3BD2 8D95B0FBFFFF lea edx, dword ptr [ebp+FFFFFBB0] :760E3BD8 F2 repnz :760E3BD9 AE scasb :760E3BDA F7D1 not ecx :760E3BDC 2BF9 sub edi, ecx :760E3BDE 8BC1 mov eax, ecx :760E3BE0 8BF7 mov esi, edi :760E3BE2 8BFA mov edi, edx :760E3BE4 C1E902 shr ecx, 02 :760E3BE7 F3 repz :760E3BE8 A5 movsd :760E3BE9 8BC8 mov ecx, eax :760E3BEB 83E103 and ecx, 00000003 :760E3BEE F3 repz :760E3BEF A4 movsb :760E3BF0 EB2A jmp 760E3C1C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3C31(U) | :760E3BF2 894508 mov dword ptr [ebp+08], eax :760E3BF5 56 push esi :760E3BF6 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760E3BFC 56 push esi :760E3BFD 50 push eax :760E3BFE 8D8D38ADFFFF lea ecx, dword ptr [ebp+FFFFAD38] :760E3C04 E808E1FFFF call 760E1D11 :760E3C09 85C0 test eax, eax :760E3C0B 0F85E7C10000 jne 760EFDF8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFE1C(U) | :760E3C11 397508 cmp dword ptr [ebp+08], esi :760E3C14 751D jne 760E3C33 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3C5E(U) | :760E3C16 837D0801 cmp dword ptr [ebp+08], 00000001 :760E3C1A 7544 jne 760E3C60 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3BF0(U) | :760E3C1C 33F6 xor esi, esi :760E3C1E 8D8568F6FFFF lea eax, dword ptr [ebp+FFFFF668] :760E3C24 56 push esi :760E3C25 50 push eax :760E3C26 8D8DD0CFFFFF lea ecx, dword ptr [ebp+FFFFCFD0] :760E3C2C E888100000 call 760E4CB9 :760E3C31 EBBF jmp 760E3BF2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3C14(C) | :760E3C33 8DBD68F6FFFF lea edi, dword ptr [ebp+FFFFF668] :760E3C39 83C9FF or ecx, FFFFFFFF :760E3C3C 33C0 xor eax, eax :760E3C3E 8D95B0FBFFFF lea edx, dword ptr [ebp+FFFFFBB0] :760E3C44 F2 repnz :760E3C45 AE scasb :760E3C46 F7D1 not ecx :760E3C48 2BF9 sub edi, ecx :760E3C4A 8BC1 mov eax, ecx :760E3C4C 8BF7 mov esi, edi :760E3C4E 8BFA mov edi, edx :760E3C50 C1E902 shr ecx, 02 :760E3C53 F3 repz :760E3C54 A5 movsd :760E3C55 8BC8 mov ecx, eax :760E3C57 83E103 and ecx, 00000003 :760E3C5A F3 repz :760E3C5B A4 movsb :760E3C5C 33F6 xor esi, esi :760E3C5E EBB6 jmp 760E3C16 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3C1A(C) | :760E3C60 6A01 push 00000001 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFE35(U) | :760E3C62 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760E3C68 8D8D38ADFFFF lea ecx, dword ptr [ebp+FFFFAD38] :760E3C6E 50 push eax :760E3C6F E845100000 call 760E4CB9 :760E3C74 85C0 test eax, eax :760E3C76 0F85A5C10000 jne 760EFE21 :760E3C7C 6A01 push 00000001 :760E3C7E EB1C jmp 760E3C9C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3CAE(U) | :760E3C80 85C0 test eax, eax :760E3C82 742C je 760E3CB0 :760E3C84 8B4D0C mov ecx, dword ptr [ebp+0C] :760E3C87 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760E3C8D 50 push eax :760E3C8E E857E9FFFF call 760E25EA :760E3C93 85C0 test eax, eax :760E3C95 0F84D8C10000 je 760EFE73 :760E3C9B 56 push esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3C7E(U) | :760E3C9C 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760E3CA2 8D8DD0CFFFFF lea ecx, dword ptr [ebp+FFFFCFD0] :760E3CA8 50 push eax :760E3CA9 E80B100000 call 760E4CB9 :760E3CAE EBD0 jmp 760E3C80 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3C82(C) | :760E3CB0 397510 cmp dword ptr [ebp+10], esi :760E3CB3 0F85F3C10000 jne 760EFEAC :760E3CB9 8D4DF4 lea ecx, dword ptr [ebp-0C] :760E3CBC E89F100000 call 760E4D60 :760E3CC1 85C0 test eax, eax :760E3CC3 0F842FC20000 je 760EFEF8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFEB9(C) | :760E3CC9 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760E3CCF 53 push ebx :760E3CD0 50 push eax :760E3CD1 8D8568FAFFFF lea eax, dword ptr [ebp+FFFFFA68] :760E3CD7 50 push eax :760E3CD8 8D4DF4 lea ecx, dword ptr [ebp-0C] :760E3CDB E886020000 call 760E3F66 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E3CE0 8B1D80110E76 mov ebx, dword ptr [760E1180] :760E3CE6 83F801 cmp eax, 00000001 :760E3CE9 0F8529C30000 jne 760F0018 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3DAF(C) | :760E3CEF 8DBD98FAFFFF lea edi, dword ptr [ebp+FFFFFA98] :760E3CF5 83C9FF or ecx, FFFFFFFF :760E3CF8 33C0 xor eax, eax :760E3CFA 8D9568F2FFFF lea edx, dword ptr [ebp+FFFFF268] :760E3D00 F2 repnz :760E3D01 AE scasb :760E3D02 F7D1 not ecx :760E3D04 2BF9 sub edi, ecx :760E3D06 8BC1 mov eax, ecx :760E3D08 8BF7 mov esi, edi :760E3D0A 8BFA mov edi, edx :760E3D0C C1E902 shr ecx, 02 :760E3D0F F3 repz :760E3D10 A5 movsd :760E3D11 8BC8 mov ecx, eax :760E3D13 8D8568F2FFFF lea eax, dword ptr [ebp+FFFFF268] :760E3D19 83E103 and ecx, 00000003 :760E3D1C F3 repz :760E3D1D A4 movsb :760E3D1E BF00040000 mov edi, 00000400 :760E3D23 8D4DF4 lea ecx, dword ptr [ebp-0C] :760E3D26 57 push edi :760E3D27 50 push eax :760E3D28 E89BF0FFFF call 760E2DC8 :760E3D2D 8D8568F2FFFF lea eax, dword ptr [ebp+FFFFF268] :760E3D33 8D4DF4 lea ecx, dword ptr [ebp-0C] :760E3D36 50 push eax :760E3D37 E8C2100000 call 760E4DFE :760E3D3C 3D4F050000 cmp eax, 0000054F :760E3D41 0F84CDC10000 je 760EFF14 :760E3D47 83F801 cmp eax, 00000001 :760E3D4A 0F84FBC10000 je 760EFF4B :760E3D50 8D8568FAFFFF lea eax, dword ptr [ebp+FFFFFA68] :760E3D56 8D4DF4 lea ecx, dword ptr [ebp-0C] :760E3D59 50 push eax :760E3D5A E8EBF1FFFF call 760E2F4A :760E3D5F 8BF0 mov esi, eax :760E3D61 85F6 test esi, esi :760E3D63 8975FC mov dword ptr [ebp-04], esi :760E3D66 0F8416C20000 je 760EFF82 :760E3D6C 56 push esi :760E3D6D 8D85D0CFFFFF lea eax, dword ptr [ebp+FFFFCFD0] :760E3D73 FF750C push [ebp+0C] :760E3D76 50 push eax :760E3D77 E8AEEFFFFF call 760E2D2A :760E3D7C 85C0 test eax, eax :760E3D7E 0F843CC20000 je 760EFFC0 :760E3D84 8BCE mov ecx, esi :760E3D86 E83DEFFFFF call 760E2CC8 :760E3D8B 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760E3D8C E8BADBFFFF Call 760E194B :760E3D91 8365FC00 and dword ptr [ebp-04], 00000000 :760E3D95 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EFF1C(C), :760EFF37(C), :760EFF53(C), :760EFF6E(C), :760EFF8A(C) |:760EFFA5(C), :760EFFBB(U) | :760E3D96 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760E3D9C 57 push edi :760E3D9D 50 push eax :760E3D9E 8D8568FAFFFF lea eax, dword ptr [ebp+FFFFFA68] :760E3DA4 50 push eax :760E3DA5 8D4DF4 lea ecx, dword ptr [ebp-0C] :760E3DA8 E861E2FFFF call 760E200E :760E3DAD 85C0 test eax, eax :760E3DAF 0F853AFFFFFF jne 760E3CEF * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0020(C), :760F003B(C), :760F0052(U) | :760E3DB5 8B4D0C mov ecx, dword ptr [ebp+0C] :760E3DB8 E8DDDCFFFF call 760E1A9A * Reference To: SfpDll.SfpPersistSfpDb | :760E3DBD E8BFE2FFFF call 760E2081 :760E3DC2 85C0 test eax, eax :760E3DC4 0F848DC20000 je 760F0057 :760E3DCA 6A01 push 00000001 :760E3DCC 5E pop esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0013(U) | :760E3DCD 8D4DF4 lea ecx, dword ptr [ebp-0C] :760E3DD0 E8ECDFFFFF call 760E1DC1 :760E3DD5 8D4DB0 lea ecx, dword ptr [ebp-50] :760E3DD8 E85DE5FFFF call 760E233A :760E3DDD 8D8D38ADFFFF lea ecx, dword ptr [ebp+FFFFAD38] :760E3DE3 E81CD8FFFF call 760E1604 :760E3DE8 8D8DD0CFFFFF lea ecx, dword ptr [ebp+FFFFCFD0] :760E3DEE E811D8FFFF call 760E1604 :760E3DF3 8BC6 mov eax, esi :760E3DF5 5F pop edi :760E3DF6 5E pop esi :760E3DF7 5B pop ebx :760E3DF8 C9 leave :760E3DF9 C20C00 ret 000C * Referenced by a CALL at Addresses: |:760E3B0D , :760F6EA5 | :760E3DFC 56 push esi :760E3DFD 8BC1 mov eax, ecx :760E3DFF 33D2 xor edx, edx :760E3E01 6A03 push 00000003 :760E3E03 C700D81D0E76 mov dword ptr [eax], 760E1DD8 :760E3E09 895008 mov dword ptr [eax+08], edx :760E3E0C 8D4824 lea ecx, dword ptr [eax+24] :760E3E0F 5E pop esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3E1C(C) | :760E3E10 8951F4 mov dword ptr [ecx-0C], edx :760E3E13 8911 mov dword ptr [ecx], edx :760E3E15 8951E8 mov dword ptr [ecx-18], edx :760E3E18 83C104 add ecx, 00000004 :760E3E1B 4E dec esi :760E3E1C 75F2 jne 760E3E10 :760E3E1E C6404069 mov [eax+40], 69 :760E3E22 895004 mov dword ptr [eax+04], edx :760E3E25 5E pop esi :760E3E26 C3 ret * Referenced by a CALL at Addresses: |:760E3B25 , :760F756D | :760E3E27 56 push esi :760E3E28 8BF1 mov esi, ecx :760E3E2A E83B000000 call 760E3E6A :760E3E2F 85C0 test eax, eax :760E3E31 0F8423ED0000 je 760F2B5A :760E3E37 FF742408 push [esp+08] :760E3E3B 8BCE mov ecx, esi :760E3E3D E891120000 call 760E50D3 :760E3E42 85C0 test eax, eax :760E3E44 0F8410ED0000 je 760F2B5A :760E3E4A 8BCE mov ecx, esi :760E3E4C E8B7130000 call 760E5208 :760E3E51 85C0 test eax, eax :760E3E53 0F8401ED0000 je 760F2B5A :760E3E59 8BCE mov ecx, esi :760E3E5B E8D6190000 call 760E5836 :760E3E60 F7D8 neg eax :760E3E62 1BC0 sbb eax, eax :760E3E64 F7D8 neg eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2B5C(U) | :760E3E66 5E pop esi :760E3E67 C20400 ret 0004 * Referenced by a CALL at Address: |:760E3E2A | :760E3E6A 53 push ebx :760E3E6B 55 push ebp :760E3E6C 56 push esi :760E3E6D 57 push edi :760E3E6E 8BF1 mov esi, ecx :760E3E70 6A03 push 00000003 :760E3E72 5D pop ebp :760E3E73 33DB xor ebx, ebx :760E3E75 8D7E24 lea edi, dword ptr [esi+24] :760E3E78 EB1B jmp 760E3E95 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3E9A(C), :760F2B6A(U) | :760E3E7A 8B07 mov eax, dword ptr [edi] :760E3E7C 3BC3 cmp eax, ebx :760E3E7E 0F85EBEC0000 jne 760F2B6F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2B77(U) | :760E3E84 8B47F4 mov eax, dword ptr [edi-0C] :760E3E87 3BC3 cmp eax, ebx :760E3E89 0F85EDEC0000 jne 760F2B7C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2B85(U) | :760E3E8F 83C704 add edi, 00000004 :760E3E92 4D dec ebp :760E3E93 740C je 760E3EA1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3E78(U) | :760E3E95 8B47E8 mov eax, dword ptr [edi-18] :760E3E98 3BC3 cmp eax, ebx :760E3E9A 74DE je 760E3E7A :760E3E9C E9C0EC0000 jmp 760F2B61 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3E93(C) | :760E3EA1 33C0 xor eax, eax :760E3EA3 8D7E30 lea edi, dword ptr [esi+30] :760E3EA6 AB stosd :760E3EA7 AB stosd :760E3EA8 AB stosd :760E3EA9 53 push ebx :760E3EAA AB stosd * Reference To: OLE32.CoInitialize, Ord:0031h | :760E3EAB FF15B0100E76 Call dword ptr [760E10B0] :760E3EB1 FF4604 inc [esi+04] :760E3EB4 8BF8 mov edi, eax :760E3EB6 3BFB cmp edi, ebx :760E3EB8 0F85CCEC0000 jne 760F2B8A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2B8D(C) | :760E3EBE 8D7E08 lea edi, dword ptr [esi+08] :760E3EC1 57 push edi * Possible StringData Ref from Code Obj ->"a+." | :760E3EC2 68003F0E76 push 760E3F00 :760E3EC7 6A01 push 00000001 :760E3EC9 53 push ebx :760E3ECA 68F03E0E76 push 760E3EF0 * Reference To: OLE32.CoCreateInstance, Ord:000Fh | :760E3ECF FF15A8100E76 Call dword ptr [760E10A8] :760E3ED5 391F cmp dword ptr [edi], ebx :760E3ED7 0F84EFEC0000 je 760F2BCC :760E3EDD 3BC3 cmp eax, ebx :760E3EDF 0F8CE7EC0000 jl 760F2BCC :760E3EE5 6A01 push 00000001 :760E3EE7 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2C18(U) | :760E3EE8 5F pop edi :760E3EE9 5E pop esi :760E3EEA 5D pop ebp :760E3EEB 5B pop ebx :760E3EEC C3 ret :760E3EED 90 nop :760E3EEE 90 nop :760E3EEF 90 nop :760E3EF0 AF scasd :760E3EF1 99 cdq :760E3EF2 C3 ret :760E3EF3 CF iret :760E3EF4 76D8 jbe 760E3ECE :760E3EF6 D011 rcl byte ptr [ecx], 1 :760E3EF8 9C pushfd :760E3EF9 1000 adc byte ptr [eax], al :760E3EFB C04FC99C ror byte ptr [edi-37], 9C :760E3EFF 8E612B mov fs, [ecx+2B] :760E3F02 2EF5 cmc :760E3F04 A118D111B1 mov eax, dword ptr [B111D118] :760E3F09 0500805F49 add eax, 495F8000 :760E3F0E 91 xchg eax,ecx :760E3F0F 6B BYTE 6bh * Referenced by a CALL at Addresses: |:760E3ACC , :760E4DE1 | :760E3F10 56 push esi :760E3F11 8B742408 mov esi, dword ptr [esp+08] :760E3F15 85F6 test esi, esi :760E3F17 57 push edi :760E3F18 8BD1 mov edx, ecx :760E3F1A 0F8452150100 je 760F5472 :760E3F20 8BFE mov edi, esi :760E3F22 83C9FF or ecx, FFFFFFFF :760E3F25 33C0 xor eax, eax :760E3F27 F2 repnz :760E3F28 AE scasb :760E3F29 F7D1 not ecx :760E3F2B 51 push ecx :760E3F2C 50 push eax :760E3F2D FF7204 push [edx+04] * Reference To: KERNEL32.HeapAlloc, Ord:01B4h | :760E3F30 FF15EC110E76 Call dword ptr [760E11EC] :760E3F36 8BD0 mov edx, eax :760E3F38 85D2 test edx, edx :760E3F3A 0F8432150100 je 760F5472 :760E3F40 8BFE mov edi, esi :760E3F42 83C9FF or ecx, FFFFFFFF :760E3F45 33C0 xor eax, eax :760E3F47 F2 repnz :760E3F48 AE scasb :760E3F49 F7D1 not ecx :760E3F4B 2BF9 sub edi, ecx :760E3F4D 8BC1 mov eax, ecx :760E3F4F 8BF7 mov esi, edi :760E3F51 8BFA mov edi, edx :760E3F53 C1E902 shr ecx, 02 :760E3F56 F3 repz :760E3F57 A5 movsd :760E3F58 8BC8 mov ecx, eax :760E3F5A 8BC2 mov eax, edx :760E3F5C 83E103 and ecx, 00000003 :760E3F5F F3 repz :760E3F60 A4 movsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5474(U) | :760E3F61 5F pop edi :760E3F62 5E pop esi :760E3F63 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E3A83 , :760E3CDB | :760E3F66 55 push ebp :760E3F67 8BEC mov ebp, esp :760E3F69 81EC00040000 sub esp, 00000400 :760E3F6F 53 push ebx :760E3F70 33DB xor ebx, ebx :760E3F72 395D0C cmp dword ptr [ebp+0C], ebx :760E3F75 56 push esi :760E3F76 8B7508 mov esi, dword ptr [ebp+08] :760E3F79 57 push edi :760E3F7A 8BD1 mov edx, ecx :760E3F7C 0F84480B0100 je 760F4ACA :760E3F82 395D10 cmp dword ptr [ebp+10], ebx :760E3F85 0F8E3F0B0100 jle 760F4ACA :760E3F8B 3BF3 cmp esi, ebx :760E3F8D 0F84370B0100 je 760F4ACA :760E3F93 391A cmp dword ptr [edx], ebx :760E3F95 0F84840A0100 je 760F4A1F :760E3F9B 6A52 push 00000052 :760E3F9D 33C0 xor eax, eax :760E3F9F 59 pop ecx :760E3FA0 8BFE mov edi, esi :760E3FA2 F3 repz :760E3FA3 AB stosd :760E3FA4 FF32 push dword ptr [edx] :760E3FA6 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] * Possible StringData Ref from Code Obj ->"%s\*.cat" | :760E3FAC 6848400E76 push 760E4048 :760E3FB1 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760E3FB2 FF1530100E76 Call dword ptr [760E1030] :760E3FB8 83C40C add esp, 0000000C :760E3FBB 8D4604 lea eax, dword ptr [esi+04] :760E3FBE 50 push eax :760E3FBF 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760E3FC5 50 push eax * Reference To: KERNEL32.FindFirstFileA, Ord:00A3h | :760E3FC6 FF1568120E76 Call dword ptr [760E1268] :760E3FCC 83C9FF or ecx, FFFFFFFF :760E3FCF 8906 mov dword ptr [esi], eax :760E3FD1 3BC1 cmp eax, ecx :760E3FD3 7531 jne 760E4006 :760E3FD5 A184110E76 mov eax, dword ptr [760E1184] :760E3FDA F60002 test byte ptr [eax], 02 :760E3FDD 0F85740A0100 jne 760F4A57 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4A27(C), :760F4A46(C), :760F4A70(C), :760F4AB6(U), :760F4AD2(C) |:760F4AF1(C), :760F4B06(U) | :760E3FE3 3BF3 cmp esi, ebx :760E3FE5 7416 je 760E3FFD :760E3FE7 399E44010000 cmp dword ptr [esi+00000144], ebx :760E3FED 8DBE44010000 lea edi, dword ptr [esi+00000144] :760E3FF3 0F85C20A0100 jne 760F4ABB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4AC5(U) | :760E3FF9 891F mov dword ptr [edi], ebx :760E3FFB 891E mov dword ptr [esi], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3FE5(C) | :760E3FFD 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4046(U) | :760E3FFF 5F pop edi :760E4000 5E pop esi :760E4001 5B pop ebx :760E4002 C9 leave :760E4003 C20C00 ret 000C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3FD3(C) | :760E4006 6A01 push 00000001 :760E4008 8D5630 lea edx, dword ptr [esi+30] :760E400B 5B pop ebx :760E400C 8BFA mov edi, edx :760E400E 33C0 xor eax, eax :760E4010 899E44010000 mov dword ptr [esi+00000144], ebx :760E4016 F2 repnz :760E4017 AE scasb :760E4018 F7D1 not ecx :760E401A 49 dec ecx :760E401B 3B4D10 cmp ecx, dword ptr [ebp+10] :760E401E 0F835A0A0100 jnb 760F4A7E :760E4024 8BFA mov edi, edx :760E4026 83C9FF or ecx, FFFFFFFF :760E4029 33C0 xor eax, eax :760E402B F2 repnz :760E402C AE scasb :760E402D F7D1 not ecx :760E402F 2BF9 sub edi, ecx :760E4031 8BC1 mov eax, ecx :760E4033 8BF7 mov esi, edi :760E4035 8B7D0C mov edi, dword ptr [ebp+0C] :760E4038 C1E902 shr ecx, 02 :760E403B F3 repz :760E403C A5 movsd :760E403D 8BC8 mov ecx, eax :760E403F 8BC3 mov eax, ebx :760E4041 83E103 and ecx, 00000003 :760E4044 F3 repz :760E4045 A4 movsb :760E4046 EBB7 jmp 760E3FFF :760E4048 25735C2A2E and eax, 2E2A5C73 :760E404D 636174 arpl dword ptr [ecx+74], esp :760E4050 00 BYTE 00h * Referenced by a CALL at Addresses: |:760E410A , :760E5122 , :760F324E , :760F35D7 , :760F3EA4 | :760E4051 56 push esi :760E4052 8BF1 mov esi, ecx :760E4054 57 push edi :760E4055 8D7E08 lea edi, dword ptr [esi+08] :760E4058 57 push edi * Reference To: KERNEL32.InterlockedDecrement, Ord:01C8h | :760E4059 FF15C0110E76 Call dword ptr [760E11C0] :760E405F 85C0 test eax, eax :760E4061 0F8522F20000 jne 760F3289 :760E4067 85F6 test esi, esi :760E4069 740E je 760E4079 :760E406B 8BCE mov ecx, esi :760E406D E80C000000 call 760E407E :760E4072 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760E4073 E8D3D8FFFF Call 760E194B :760E4078 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4069(C) | :760E4079 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F328B(U) | :760E407B 5F pop edi :760E407C 5E pop esi :760E407D C3 ret * Referenced by a CALL at Address: |:760E406D | :760E407E 56 push esi :760E407F 8BF1 mov esi, ecx :760E4081 8B06 mov eax, dword ptr [esi] :760E4083 85C0 test eax, eax :760E4085 7407 je 760E408E :760E4087 50 push eax * Reference To: OLEAUT32.SysFreeString, Ord:0006h | :760E4088 FF1590100E76 Call dword ptr [760E1090] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4085(C) | :760E408E 8B7604 mov esi, dword ptr [esi+04] :760E4091 85F6 test esi, esi :760E4093 7407 je 760E409C :760E4095 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760E4096 E8B0D8FFFF Call 760E194B :760E409B 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4093(C) | :760E409C 5E pop esi :760E409D C3 ret * Referenced by a CALL at Addresses: |:760E4C06 , :760E5264 , :760E532E , :760E53DD , :760E551F |:760E5717 | :760E409E 55 push ebp :760E409F 8BEC mov ebp, esp :760E40A1 51 push ecx :760E40A2 53 push ebx :760E40A3 56 push esi :760E40A4 57 push edi :760E40A5 6A01 push 00000001 :760E40A7 FF7508 push [ebp+08] :760E40AA 8D4DFC lea ecx, dword ptr [ebp-04] :760E40AD E866000000 call 760E4118 :760E40B2 8D4DFC lea ecx, dword ptr [ebp-04] :760E40B5 E8D6000000 call 760E4190 :760E40BA 8B5D10 mov ebx, dword ptr [ebp+10] :760E40BD 8B4DFC mov ecx, dword ptr [ebp-04] :760E40C0 8BF8 mov edi, eax :760E40C2 8D4301 lea eax, dword ptr [ebx+01] :760E40C5 3BF8 cmp edi, eax :760E40C7 0F8FA4FD0000 jg 760F3E71 :760E40CD 85C9 test ecx, ecx :760E40CF 0F84DBFD0000 je 760F3EB0 :760E40D5 E8D2000000 call 760E41AC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3EB2(U) | :760E40DA 8BF8 mov edi, eax :760E40DC 83C9FF or ecx, FFFFFFFF :760E40DF 33C0 xor eax, eax :760E40E1 FF7508 push [ebp+08] :760E40E4 F2 repnz :760E40E5 AE scasb :760E40E6 F7D1 not ecx :760E40E8 2BF9 sub edi, ecx :760E40EA 8BC1 mov eax, ecx :760E40EC 8BF7 mov esi, edi :760E40EE 8B7D0C mov edi, dword ptr [ebp+0C] :760E40F1 C1E902 shr ecx, 02 :760E40F4 F3 repz :760E40F5 A5 movsd :760E40F6 8BC8 mov ecx, eax :760E40F8 83E103 and ecx, 00000003 :760E40FB F3 repz :760E40FC A4 movsb * Reference To: OLEAUT32.SysFreeString, Ord:0006h | :760E40FD FF1590100E76 Call dword ptr [760E1090] :760E4103 8B4DFC mov ecx, dword ptr [ebp-04] :760E4106 85C9 test ecx, ecx :760E4108 7405 je 760E410F :760E410A E842FFFFFF call 760E4051 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4108(C) | :760E410F 8BC3 mov eax, ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3EAB(U) | :760E4111 5F pop edi :760E4112 5E pop esi :760E4113 5B pop ebx :760E4114 C9 leave :760E4115 C20C00 ret 000C * Referenced by a CALL at Address: |:760E40AD | :760E4118 56 push esi :760E4119 8BF1 mov esi, ecx :760E411B 6A0C push 0000000C * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760E411D E85DE7FFFF Call 760E287F :760E4122 85C0 test eax, eax :760E4124 59 pop ecx :760E4125 0F848CFD0000 je 760F3EB7 :760E412B FF74240C push [esp+0C] :760E412F 8BC8 mov ecx, eax :760E4131 FF74240C push [esp+0C] :760E4135 E810000000 call 760E414A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3EB9(U) | :760E413A 85C0 test eax, eax :760E413C 8906 mov dword ptr [esi], eax :760E413E 0F847AFD0000 je 760F3EBE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3EC8(U) | :760E4144 8BC6 mov eax, esi :760E4146 5E pop esi :760E4147 C20800 ret 0008 * Referenced by a CALL at Address: |:760E4135 | :760E414A 56 push esi :760E414B 8BF1 mov esi, ecx :760E414D 57 push edi :760E414E 8B7C240C mov edi, dword ptr [esp+0C] :760E4152 83660400 and dword ptr [esi+04], 00000000 :760E4156 807C241000 cmp byte ptr [esp+10], 00 :760E415B C7460801000000 mov [esi+08], 00000001 :760E4162 0F8477FD0000 je 760F3EDF :760E4168 85FF test edi, edi :760E416A 0F846FFD0000 je 760F3EDF :760E4170 57 push edi * Reference To: OLEAUT32.SysStringByteLen, Ord:0095h | :760E4171 FF1598100E76 Call dword ptr [760E1098] :760E4177 50 push eax :760E4178 57 push edi * Reference To: OLEAUT32.SysAllocStringByteLen, Ord:0096h | :760E4179 FF159C100E76 Call dword ptr [760E109C] :760E417F 85C0 test eax, eax :760E4181 8906 mov dword ptr [esi], eax :760E4183 0F8447FD0000 je 760F3ED0 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3EDA(U), :760F3EE1(U) | :760E4189 8BC6 mov eax, esi :760E418B 5F pop edi :760E418C 5E pop esi :760E418D C20800 ret 0008 * Referenced by a CALL at Address: |:760E40B5 | :760E4190 8B01 mov eax, dword ptr [ecx] :760E4192 85C0 test eax, eax :760E4194 0F8433FD0000 je 760F3ECD :760E419A 8B00 mov eax, dword ptr [eax] :760E419C 85C0 test eax, eax :760E419E 0F8429FD0000 je 760F3ECD :760E41A4 50 push eax * Reference To: OLEAUT32.SysStringLen, Ord:0007h | :760E41A5 FF158C100E76 Call dword ptr [760E108C] :760E41AB C3 ret * Referenced by a CALL at Addresses: |:760E40D5 , :760F3E75 | :760E41AC 56 push esi :760E41AD 8BF1 mov esi, ecx :760E41AF 837E0400 cmp dword ptr [esi+04], 00000000 :760E41B3 7512 jne 760E41C7 :760E41B5 FF36 push dword ptr [esi] :760E41B7 E810000000 call 760E41CC :760E41BC 85C0 test eax, eax :760E41BE 894604 mov dword ptr [esi+04], eax :760E41C1 0F841FFD0000 je 760F3EE6 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E41B3(C), :760F3EE8(C), :760F3EF8(U) | :760E41C7 8B4604 mov eax, dword ptr [esi+04] :760E41CA 5E pop esi :760E41CB C3 ret * Referenced by a CALL at Address: |:760E41B7 | :760E41CC 53 push ebx :760E41CD 55 push ebp :760E41CE 8B6C240C mov ebp, dword ptr [esp+0C] :760E41D2 33DB xor ebx, ebx :760E41D4 3BEB cmp ebp, ebx :760E41D6 0F846E460100 je 760F884A :760E41DC 57 push edi :760E41DD 56 push esi :760E41DE 55 push ebp * Reference To: MSVCRT.wcslen, Ord:02E3h | :760E41DF E838000000 Call 760E421C :760E41E4 59 pop ecx :760E41E5 8D7C0002 lea edi, dword ptr [eax+eax+02] :760E41E9 57 push edi * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760E41EA E890E6FFFF Call 760E287F :760E41EF 8BF0 mov esi, eax :760E41F1 59 pop ecx :760E41F2 3BF3 cmp esi, ebx :760E41F4 0F8457460100 je 760F8851 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F885B(U) | :760E41FA 53 push ebx :760E41FB 53 push ebx :760E41FC 57 push edi :760E41FD 56 push esi :760E41FE 6AFF push FFFFFFFF :760E4200 55 push ebp :760E4201 53 push ebx :760E4202 53 push ebx :760E4203 881E mov byte ptr [esi], bl * Reference To: KERNEL32.WideCharToMultiByte, Ord:0301h | :760E4205 FF1508120E76 Call dword ptr [760E1208] :760E420B 85C0 test eax, eax :760E420D 0F844D460100 je 760F8860 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8882(U) | :760E4213 8BC6 mov eax, esi :760E4215 5E pop esi :760E4216 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F884C(U) | :760E4217 5D pop ebp :760E4218 5B pop ebx :760E4219 C20400 ret 0004 * Referenced by a CALL at Address: |:760E41DF | * Reference To: MSVCRT.wcslen, Ord:02E3h | :760E421C FF2550100E76 Jmp dword ptr [760E1050] * Referenced by a CALL at Addresses: |:760E4252 , :760E561A , :760F29E9 | :760E4222 57 push edi :760E4223 8B7C2408 mov edi, dword ptr [esp+08] :760E4227 83C9FF or ecx, FFFFFFFF :760E422A 33C0 xor eax, eax :760E422C F2 repnz :760E422D AE scasb :760E422E F7D1 not ecx :760E4230 49 dec ecx :760E4231 5F pop edi :760E4232 8BC1 mov eax, ecx :760E4234 40 inc eax :760E4235 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E4B29 , :760E53F1 , :760F0468 , :760F3362 , :760F33C9 | :760E4238 55 push ebp :760E4239 8BEC mov ebp, esp :760E423B 81EC00080000 sub esp, 00000800 :760E4241 53 push ebx :760E4242 8B5D08 mov ebx, dword ptr [ebp+08] :760E4245 56 push esi :760E4246 57 push edi :760E4247 33FF xor edi, edi :760E4249 3BDF cmp ebx, edi :760E424B 0F846FE60000 je 760F28C0 :760E4251 53 push ebx :760E4252 E8CBFFFFFF call 760E4222 :760E4257 894508 mov dword ptr [ebp+08], eax :760E425A 8D8500F8FFFF lea eax, dword ptr [ebp+FFFFF800] :760E4260 6800040000 push 00000400 :760E4265 50 push eax :760E4266 6AFF push FFFFFFFF :760E4268 53 push ebx :760E4269 57 push edi :760E426A E816E6FFFF call 760E2885 :760E426F 50 push eax * Reference To: KERNEL32.MultiByteToWideChar, Ord:0202h | :760E4270 FF154C120E76 Call dword ptr [760E124C] :760E4276 85C0 test eax, eax :760E4278 0F8485E60000 je 760F2903 :760E427E 8DB500F8FFFF lea esi, dword ptr [ebp+FFFFF800] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F292C(U) | :760E4284 668B06 mov ax, word ptr [esi] :760E4287 663D2000 cmp ax, 0020 :760E428B 0F8499E60000 je 760F292A :760E4291 663D0900 cmp ax, 0009 :760E4295 0F848FE60000 je 760F292A :760E429B 663D0A00 cmp ax, 000A :760E429F 0F8485E60000 je 760F292A :760E42A5 663D0D00 cmp ax, 000D :760E42A9 0F847BE60000 je 760F292A :760E42AF 56 push esi * Reference To: MSVCRT.wcslen, Ord:02E3h | :760E42B0 FF1550100E76 Call dword ptr [760E1050] :760E42B6 3BC7 cmp eax, edi :760E42B8 59 pop ecx :760E42B9 0F8472E60000 je 760F2931 :760E42BF 48 dec eax :760E42C0 782E js 760E42F0 :760E42C2 8D0C46 lea ecx, dword ptr [esi+2*eax] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2955(C) | :760E42C5 668B11 mov dx, word ptr [ecx] :760E42C8 6683FA20 cmp dx, 0020 :760E42CC 0F847BE60000 je 760F294D :760E42D2 6683FA09 cmp dx, 0009 :760E42D6 0F8471E60000 je 760F294D :760E42DC 6683FA0A cmp dx, 000A :760E42E0 0F8467E60000 je 760F294D :760E42E6 6683FA0D cmp dx, 000D :760E42EA 0F845DE60000 je 760F294D * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E42C0(C), :760F295B(U) | :760E42F0 83F8FF cmp eax, FFFFFFFF :760E42F3 0F8467E60000 je 760F2960 :760E42F9 8D440004 lea eax, dword ptr [eax+eax+04] :760E42FD 50 push eax :760E42FE 8D8500F8FFFF lea eax, dword ptr [ebp+FFFFF800] :760E4304 56 push esi :760E4305 50 push eax * Reference To: MSVCRT.memmove, Ord:0295h | :760E4306 FF151C100E76 Call dword ptr [760E101C] :760E430C 83C40C add esp, 0000000C :760E430F 8D8500F8FFFF lea eax, dword ptr [ebp+FFFFF800] :760E4315 57 push edi :760E4316 57 push edi :760E4317 FF7508 push [ebp+08] :760E431A 53 push ebx :760E431B 6AFF push FFFFFFFF :760E431D 50 push eax :760E431E 57 push edi :760E431F E861E5FFFF call 760E2885 :760E4324 50 push eax * Reference To: KERNEL32.WideCharToMultiByte, Ord:0301h | :760E4325 FF1508120E76 Call dword ptr [760E1208] :760E432B 85C0 test eax, eax :760E432D 0F8462E60000 je 760F2995 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F28C8(C), :760F28E7(C), :760F28FE(U), :760F2913(C), :760F2939(C) |:760F2968(C), :760F2987(C), :760F29A5(C), :760F29C4(C), :760F29DD(U) | :760E4333 5F pop edi :760E4334 5E pop esi :760E4335 5B pop ebx :760E4336 C9 leave :760E4337 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E5872 , :760E58A2 , :760E5913 , :760E593F , :760E599F |:760E59CB , :760E5A2B , :760E5A8B , :760E5AEB , :760E5B17 |:760E5B43 , :760E5B6F , :760E5B9B , :760E5BC7 , :760E5BF3 |:760E5C1F , :760E5C4B , :760E5C77 , :760E5CA8 , :760E5D08 |:760E5D4B | :760E433A 8B542404 mov edx, dword ptr [esp+04] :760E433E 57 push edi :760E433F 8BFA mov edi, edx :760E4341 83C9FF or ecx, FFFFFFFF :760E4344 33C0 xor eax, eax :760E4346 F2 repnz :760E4347 AE scasb :760E4348 F7D1 not ecx :760E434A 49 dec ecx :760E434B 5F pop edi :760E434C 85C9 test ecx, ecx :760E434E 7E0F jle 760E435F :760E4350 807C11FF5C cmp byte ptr [ecx+edx-01], 5C :760E4355 8D4411FF lea eax, dword ptr [ecx+edx-01] :760E4359 0F84B5FB0000 je 760F3F14 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E434E(C), :760F3F17(U) | :760E435F C20400 ret 0004 :760E4362 90 nop :760E4363 90 nop :760E4364 53 push ebx :760E4365 46 inc esi :760E4366 50 push eax :760E4367 00AC317F3F5FE1 add byte ptr [ecx+esi-1EA0C081], ch :760E436E D011 rcl byte ptr [ecx], 1 :760E4370 9C pushfd :760E4371 2500C04FC9 and eax, C94FC000 :760E4376 9C pushfd :760E4377 8E BYTE 8eh * Referenced by a CALL at Addresses: |:760E3A2D , :760E3AEC , :760E51A9 , :760E5579 , :760ECEE5 | :760E4378 51 push ecx :760E4379 3D00100000 cmp eax, 00001000 :760E437E 8D4C2408 lea ecx, dword ptr [esp+08] :760E4382 7214 jb 760E4398 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4396(C) | :760E4384 81E900100000 sub ecx, 00001000 :760E438A 2D00100000 sub eax, 00001000 :760E438F 8501 test dword ptr [ecx], eax :760E4391 3D00100000 cmp eax, 00001000 :760E4396 73EC jnb 760E4384 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4382(C) | :760E4398 2BC8 sub ecx, eax :760E439A 8BC4 mov eax, esp :760E439C 8501 test dword ptr [ecx], eax :760E439E 8BE1 mov esp, ecx :760E43A0 8B08 mov ecx, dword ptr [eax] :760E43A2 8B4004 mov eax, dword ptr [eax+04] :760E43A5 50 push eax :760E43A6 C3 ret * Referenced by a CALL at Addresses: |:760E5E2F , :760F193D | :760E43A7 55 push ebp :760E43A8 8BEC mov ebp, esp :760E43AA 81EC0C050000 sub esp, 0000050C :760E43B0 53 push ebx :760E43B1 56 push esi :760E43B2 33F6 xor esi, esi :760E43B4 57 push edi :760E43B5 8D8DF4FAFFFF lea ecx, dword ptr [ebp+FFFFFAF4] :760E43BB 8975F8 mov dword ptr [ebp-08], esi :760E43BE E884D3FFFF call 760E1747 :760E43C3 8B4508 mov eax, dword ptr [ebp+08] :760E43C6 3BC6 cmp eax, esi :760E43C8 0F8458D40000 je 760F1826 :760E43CE 8D8DF4FAFFFF lea ecx, dword ptr [ebp+FFFFFAF4] :760E43D4 8930 mov dword ptr [eax], esi :760E43D6 E89A000000 call 760E4475 :760E43DB 3BC6 cmp eax, esi :760E43DD 8945FC mov dword ptr [ebp-04], eax :760E43E0 0F847AD40000 je 760F1860 :760E43E6 8D45F8 lea eax, dword ptr [ebp-08] :760E43E9 8D8DF4FAFFFF lea ecx, dword ptr [ebp+FFFFFAF4] :760E43EF 50 push eax :760E43F0 E887040000 call 760E487C :760E43F5 3BC6 cmp eax, esi :760E43F7 8945FC mov dword ptr [ebp-04], eax :760E43FA 0F8494D40000 je 760F1894 :760E4400 A184110E76 mov eax, dword ptr [760E1184] * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E4405 8B3580110E76 mov esi, dword ptr [760E1180] * Possible StringData Ref from Code Obj ->"GetDSRoot" | :760E440B BB14500E76 mov ebx, 760E5014 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\chglogap" ->"i.cpp" | :760E4410 BFE04F0E76 mov edi, 760E4FE0 :760E4415 F60004 test byte ptr [eax], 04 :760E4418 0F85B5D40000 jne 760F18D3 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F18E0(C), :760F18F8(U) | :760E441E 6804010000 push 00000104 :760E4423 E80DD5FFFF call 760E1935 :760E4428 8B5508 mov edx, dword ptr [ebp+08] :760E442B 8945F4 mov dword ptr [ebp-0C], eax :760E442E 85C0 test eax, eax :760E4430 8902 mov dword ptr [edx], eax :760E4432 0F84C5D40000 je 760F18FD :760E4438 8B7DF4 mov edi, dword ptr [ebp-0C] :760E443B 6A41 push 00000041 :760E443D 59 pop ecx :760E443E 33C0 xor eax, eax :760E4440 F3 repz :760E4441 AB stosd :760E4442 8B7DF8 mov edi, dword ptr [ebp-08] :760E4445 83C9FF or ecx, FFFFFFFF :760E4448 F2 repnz :760E4449 AE scasb :760E444A F7D1 not ecx :760E444C 2BF9 sub edi, ecx :760E444E 8BC1 mov eax, ecx :760E4450 8BF7 mov esi, edi :760E4452 8B3A mov edi, dword ptr [edx] :760E4454 C1E902 shr ecx, 02 :760E4457 F3 repz :760E4458 A5 movsd :760E4459 8BC8 mov ecx, eax :760E445B 83E103 and ecx, 00000003 :760E445E F3 repz :760E445F A4 movsb * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F185B(U), :760F1868(C), :760F1887(C), :760F189C(C), :760F18BB(C) |:760F18CE(U), :760F1928(U) | :760E4460 8D8DF4FAFFFF lea ecx, dword ptr [ebp+FFFFFAF4] :760E4466 E861D1FFFF call 760E15CC :760E446B 8B45FC mov eax, dword ptr [ebp-04] :760E446E 5F pop edi :760E446F 5E pop esi :760E4470 5B pop ebx :760E4471 C9 leave :760E4472 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E43D6 , :760E48CE , :760E49A0 | :760E4475 81EC08010000 sub esp, 00000108 :760E447B 53 push ebx :760E447C 55 push ebp :760E447D 56 push esi :760E447E 57 push edi :760E447F 6A01 push 00000001 :760E4481 8BE9 mov ebp, ecx :760E4483 58 pop eax :760E4484 3985FC040000 cmp dword ptr [ebp+000004FC], eax :760E448A 89442410 mov dword ptr [esp+10], eax :760E448E A184110E76 mov eax, dword ptr [760E1184] :760E4493 0F8460DA0000 je 760F1EF9 :760E4499 F60004 test byte ptr [eax], 04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E449C 8B1D80110E76 mov ebx, dword ptr [760E1180] :760E44A2 0F858CDA0000 jne 760F1F34 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760E44A8 BF20500E76 mov edi, 760E5020 * Possible StringData Ref from Code Obj ->"CDataStor::Init" | :760E44AD BE74500E76 mov esi, 760E5074 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1F4B(C), :760F1F5F(U) | :760E44B2 8BCD mov ecx, ebp :760E44B4 E8E5000000 call 760E459E :760E44B9 85C0 test eax, eax :760E44BB 89442410 mov dword ptr [esp+10], eax :760E44BF 0F849FDA0000 je 760F1F64 :760E44C5 8D85F8030000 lea eax, dword ptr [ebp+000003F8] :760E44CB 6804010000 push 00000104 :760E44D0 50 push eax * Reference To: KERNEL32.GetWindowsDirectoryA, Ord:0197h | :760E44D1 FF15B4110E76 Call dword ptr [760E11B4] :760E44D7 85C0 test eax, eax :760E44D9 0F84ADDA0000 je 760F1F8C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1FE4(U) | :760E44DF 8D4508 lea eax, dword ptr [ebp+08] :760E44E2 50 push eax :760E44E3 8D85F4020000 lea eax, dword ptr [ebp+000002F4] :760E44E9 50 push eax :760E44EA 8D85F8030000 lea eax, dword ptr [ebp+000003F8] :760E44F0 50 push eax :760E44F1 E8C2020000 call 760E47B8 :760E44F6 85C0 test eax, eax :760E44F8 89442410 mov dword ptr [esp+10], eax :760E44FC 0F84E7DA0000 je 760F1FE9 :760E4502 A184110E76 mov eax, dword ptr [760E1184] :760E4507 F60004 test byte ptr [eax], 04 :760E450A 0F8517DB0000 jne 760F2027 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2034(C), :760F204C(U) | :760E4510 6804010000 push 00000104 :760E4515 E81BD4FFFF call 760E1935 :760E451A 85C0 test eax, eax :760E451C 894544 mov dword ptr [ebp+44], eax :760E451F 0F842CDB0000 je 760F2051 :760E4525 8DBDF8030000 lea edi, dword ptr [ebp+000003F8] :760E452B 83C9FF or ecx, FFFFFFFF :760E452E 33C0 xor eax, eax :760E4530 8D542414 lea edx, dword ptr [esp+14] :760E4534 F2 repnz :760E4535 AE scasb :760E4536 F7D1 not ecx :760E4538 2BF9 sub edi, ecx :760E453A FF350CDA0F76 push dword ptr [760FDA0C] :760E4540 8BC1 mov eax, ecx :760E4542 8BF7 mov esi, edi :760E4544 8BFA mov edi, edx :760E4546 FF3508DA0F76 push dword ptr [760FDA08] :760E454C C1E902 shr ecx, 02 :760E454F F3 repz :760E4550 A5 movsd :760E4551 8BC8 mov ecx, eax :760E4553 8D44241C lea eax, dword ptr [esp+1C] :760E4557 83E103 and ecx, 00000003 :760E455A 50 push eax :760E455B F3 repz :760E455C A4 movsb * Reference To: MSVCRT.strtok, Ord:02C4h | :760E455D FF1524100E76 Call dword ptr [760E1024] :760E4563 59 pop ecx :760E4564 59 pop ecx :760E4565 50 push eax * Possible StringData Ref from Code Obj ->"%s:\%s" | :760E4566 686C500E76 push 760E506C :760E456B FF7544 push [ebp+44] * Reference To: MSVCRT.sprintf, Ord:02AFh | :760E456E FF1530100E76 Call dword ptr [760E1030] :760E4574 A184110E76 mov eax, dword ptr [760E1184] :760E4579 83C410 add esp, 00000010 :760E457C F60004 test byte ptr [eax], 04 :760E457F 0F8507DB0000 jne 760F208C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F20A1(C), :760F20B9(U) | :760E4585 C785FC04000001000000 mov dword ptr [ebp+000004FC], 00000001 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1EFC(C), :760F1F1B(C), :760F1F2F(U), :760F1F6C(C), :760F1F7F(C) |:760F1FF9(C), :760F200C(C), :760F2022(U), :760F2087(U) | :760E458F 8B442410 mov eax, dword ptr [esp+10] :760E4593 5F pop edi :760E4594 5E pop esi :760E4595 5D pop ebp :760E4596 5B pop ebx :760E4597 81C408010000 add esp, 00000108 :760E459D C3 ret * Referenced by a CALL at Address: |:760E44B4 | :760E459E 83EC20 sub esp, 00000020 :760E45A1 53 push ebx :760E45A2 55 push ebp :760E45A3 8BD1 mov edx, ecx :760E45A5 56 push esi :760E45A6 83CDFF or ebp, FFFFFFFF :760E45A9 57 push edi * Possible StringData Ref from Code Obj ->"_RESTORE" | :760E45AA 8B3D0CDA0F76 mov edi, dword ptr [760FDA0C] :760E45B0 8BCD mov ecx, ebp :760E45B2 33C0 xor eax, eax :760E45B4 8D5A4C lea ebx, dword ptr [edx+4C] :760E45B7 F2 repnz :760E45B8 AE scasb :760E45B9 F7D1 not ecx :760E45BB 2BF9 sub edi, ecx :760E45BD 6A03 push 00000003 :760E45BF 8BC1 mov eax, ecx :760E45C1 8BF7 mov esi, edi :760E45C3 C1E902 shr ecx, 02 :760E45C6 8BFB mov edi, ebx :760E45C8 895C242C mov dword ptr [esp+2C], ebx :760E45CC F3 repz :760E45CD A5 movsd :760E45CE 8BC8 mov ecx, eax :760E45D0 5B pop ebx :760E45D1 23CB and ecx, ebx :760E45D3 8D425C lea eax, dword ptr [edx+5C] :760E45D6 F3 repz :760E45D7 A4 movsb * Possible StringData Ref from Code Obj ->"TEMP" | :760E45D8 8B3D10DA0F76 mov edi, dword ptr [760FDA10] :760E45DE 89442410 mov dword ptr [esp+10], eax :760E45E2 8BCD mov ecx, ebp :760E45E4 33C0 xor eax, eax :760E45E6 F2 repnz :760E45E7 AE scasb :760E45E8 F7D1 not ecx :760E45EA 2BF9 sub edi, ecx :760E45EC 8BC1 mov eax, ecx :760E45EE 8BF7 mov esi, edi :760E45F0 8B7C2410 mov edi, dword ptr [esp+10] :760E45F4 C1E902 shr ecx, 02 :760E45F7 F3 repz :760E45F8 A5 movsd :760E45F9 8BC8 mov ecx, eax :760E45FB 8D426C lea eax, dword ptr [edx+6C] :760E45FE 23CB and ecx, ebx :760E4600 89442414 mov dword ptr [esp+14], eax :760E4604 F3 repz :760E4605 A4 movsb * Possible StringData Ref from Code Obj ->"ARCHIVE" | :760E4606 8B3D14DA0F76 mov edi, dword ptr [760FDA14] :760E460C 8BCD mov ecx, ebp :760E460E 33C0 xor eax, eax :760E4610 F2 repnz :760E4611 AE scasb :760E4612 F7D1 not ecx :760E4614 2BF9 sub edi, ecx :760E4616 8BC1 mov eax, ecx :760E4618 8BF7 mov esi, edi :760E461A 8B7C2414 mov edi, dword ptr [esp+14] :760E461E C1E902 shr ecx, 02 :760E4621 F3 repz :760E4622 A5 movsd :760E4623 8BC8 mov ecx, eax :760E4625 8D427C lea eax, dword ptr [edx+7C] :760E4628 23CB and ecx, ebx :760E462A 89442418 mov dword ptr [esp+18], eax :760E462E F3 repz :760E462F A4 movsb * Possible StringData Ref from Code Obj ->"LOGS" | :760E4630 8B3D18DA0F76 mov edi, dword ptr [760FDA18] :760E4636 8BCD mov ecx, ebp :760E4638 33C0 xor eax, eax :760E463A F2 repnz :760E463B AE scasb :760E463C F7D1 not ecx :760E463E 2BF9 sub edi, ecx :760E4640 8BC1 mov eax, ecx :760E4642 8BF7 mov esi, edi :760E4644 8B7C2418 mov edi, dword ptr [esp+18] :760E4648 C1E902 shr ecx, 02 :760E464B F3 repz :760E464C A5 movsd :760E464D 8BC8 mov ecx, eax :760E464F 8D828C000000 lea eax, dword ptr [edx+0000008C] :760E4655 23CB and ecx, ebx :760E4657 8944241C mov dword ptr [esp+1C], eax :760E465B F3 repz :760E465C A4 movsb * Possible StringData Ref from Code Obj ->"SFP" | :760E465D 8B3D2CDA0F76 mov edi, dword ptr [760FDA2C] :760E4663 8BCD mov ecx, ebp :760E4665 33C0 xor eax, eax :760E4667 F2 repnz :760E4668 AE scasb :760E4669 F7D1 not ecx :760E466B 2BF9 sub edi, ecx :760E466D 8BC1 mov eax, ecx :760E466F 8BF7 mov esi, edi :760E4671 8B7C241C mov edi, dword ptr [esp+1C] :760E4675 C1E902 shr ecx, 02 :760E4678 F3 repz :760E4679 A5 movsd :760E467A 8BC8 mov ecx, eax :760E467C 33C0 xor eax, eax :760E467E 23CB and ecx, ebx :760E4680 6A04 push 00000004 :760E4682 F3 repz :760E4683 A4 movsb * Possible StringData Ref from Code Obj ->"EXTRACT" | :760E4684 8B3D1CDA0F76 mov edi, dword ptr [760FDA1C] :760E468A 8BCD mov ecx, ebp :760E468C F2 repnz :760E468D AE scasb :760E468E F7D1 not ecx :760E4690 2BF9 sub edi, ecx :760E4692 8DB29C000000 lea esi, dword ptr [edx+0000009C] :760E4698 8BC1 mov eax, ecx :760E469A 89742428 mov dword ptr [esp+28], esi :760E469E 8BF7 mov esi, edi :760E46A0 8B7C2428 mov edi, dword ptr [esp+28] :760E46A4 C1E902 shr ecx, 02 :760E46A7 F3 repz :760E46A8 A5 movsd :760E46A9 8BC8 mov ecx, eax :760E46AB 8D82EC000000 lea eax, dword ptr [edx+000000EC] :760E46B1 23CB and ecx, ebx :760E46B3 89442424 mov dword ptr [esp+24], eax :760E46B7 F3 repz :760E46B8 A4 movsb * Possible StringData Ref from Code Obj ->"DSINFO.DAT" | :760E46B9 8B3D20DA0F76 mov edi, dword ptr [760FDA20] :760E46BF 8BCD mov ecx, ebp :760E46C1 33C0 xor eax, eax :760E46C3 F2 repnz :760E46C4 AE scasb :760E46C5 F7D1 not ecx :760E46C7 2BF9 sub edi, ecx :760E46C9 8BC1 mov eax, ecx :760E46CB 8BF7 mov esi, edi :760E46CD 8B7C2424 mov edi, dword ptr [esp+24] :760E46D1 C1E902 shr ecx, 02 :760E46D4 F3 repz :760E46D5 A5 movsd :760E46D6 8BC8 mov ecx, eax :760E46D8 8D82F0010000 lea eax, dword ptr [edx+000001F0] :760E46DE 23CB and ecx, ebx :760E46E0 89442428 mov dword ptr [esp+28], eax :760E46E4 F3 repz :760E46E5 A4 movsb * Possible StringData Ref from Code Obj ->"DSROOT" | :760E46E6 8B3D24DA0F76 mov edi, dword ptr [760FDA24] :760E46EC 8BCD mov ecx, ebp :760E46EE 33C0 xor eax, eax :760E46F0 81C2F4020000 add edx, 000002F4 :760E46F6 F2 repnz :760E46F7 AE scasb :760E46F8 F7D1 not ecx :760E46FA 2BF9 sub edi, ecx :760E46FC 89542430 mov dword ptr [esp+30], edx :760E4700 8BC1 mov eax, ecx :760E4702 8BF7 mov esi, edi :760E4704 8B7C2428 mov edi, dword ptr [esp+28] :760E4708 C1E902 shr ecx, 02 :760E470B F3 repz :760E470C A5 movsd :760E470D 8BC8 mov ecx, eax :760E470F 33C0 xor eax, eax :760E4711 23CB and ecx, ebx :760E4713 F3 repz :760E4714 A4 movsb * Possible StringData Ref from Code Obj ->"\System\Restore\DataStor.ini" | :760E4715 8B3D28DA0F76 mov edi, dword ptr [760FDA28] :760E471B 8BCD mov ecx, ebp :760E471D F2 repnz :760E471E AE scasb :760E471F F7D1 not ecx :760E4721 2BF9 sub edi, ecx * Possible StringData Ref from Code Obj ->"CDataStor::LoadRestorRc" | :760E4723 BD54500E76 mov ebp, 760E5054 :760E4728 8BC1 mov eax, ecx :760E472A 8BF7 mov esi, edi :760E472C 8BFA mov edi, edx :760E472E C1E902 shr ecx, 02 :760E4731 F3 repz :760E4732 A5 movsd :760E4733 8BC8 mov ecx, eax :760E4735 23CB and ecx, ebx :760E4737 5B pop ebx :760E4738 F3 repz :760E4739 A4 movsb :760E473A A184110E76 mov eax, dword ptr [760E1184] * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E473F 8B3580110E76 mov esi, dword ptr [760E1180] * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760E4745 BF20500E76 mov edi, 760E5020 :760E474A 8418 test byte ptr [eax], bl :760E474C 0F85C8D30000 jne 760F1B1A * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1B26(C), :760F1B3F(U) | :760E4752 A184110E76 mov eax, dword ptr [760E1184] :760E4757 8418 test byte ptr [eax], bl :760E4759 0F85E5D30000 jne 760F1B44 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1B50(C), :760F1B69(U) | :760E475F A184110E76 mov eax, dword ptr [760E1184] :760E4764 8418 test byte ptr [eax], bl :760E4766 0F8502D40000 jne 760F1B6E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1B7A(C), :760F1B93(U) | :760E476C A184110E76 mov eax, dword ptr [760E1184] :760E4771 8418 test byte ptr [eax], bl :760E4773 0F851FD40000 jne 760F1B98 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1BA4(C), :760F1BBD(U) | :760E4779 A184110E76 mov eax, dword ptr [760E1184] :760E477E 8418 test byte ptr [eax], bl :760E4780 0F853CD40000 jne 760F1BC2 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1BCE(C), :760F1BE7(U) | :760E4786 A184110E76 mov eax, dword ptr [760E1184] :760E478B 8418 test byte ptr [eax], bl :760E478D 0F8559D40000 jne 760F1BEC * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1BF8(C), :760F1C11(U) | :760E4793 A184110E76 mov eax, dword ptr [760E1184] :760E4798 8418 test byte ptr [eax], bl :760E479A 0F8576D40000 jne 760F1C16 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1C22(C), :760F1C3B(U) | :760E47A0 A184110E76 mov eax, dword ptr [760E1184] :760E47A5 8418 test byte ptr [eax], bl :760E47A7 0F8593D40000 jne 760F1C40 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1C4C(C), :760F1C65(U) | :760E47AD 6A01 push 00000001 :760E47AF 58 pop eax :760E47B0 5F pop edi :760E47B1 5E pop esi :760E47B2 5D pop ebp :760E47B3 5B pop ebx :760E47B4 83C420 add esp, 00000020 :760E47B7 C3 ret * Referenced by a CALL at Addresses: |:760E44F1 , :760E4935 , :760E494A , :760E4A07 , :760E4A1C | :760E47B8 55 push ebp :760E47B9 8BEC mov ebp, esp :760E47BB 51 push ecx :760E47BC 53 push ebx :760E47BD 56 push esi :760E47BE 57 push edi :760E47BF 8B7D08 mov edi, dword ptr [ebp+08] :760E47C2 6A01 push 00000001 :760E47C4 33DB xor ebx, ebx :760E47C6 58 pop eax :760E47C7 3BFB cmp edi, ebx :760E47C9 8945FC mov dword ptr [ebp-04], eax :760E47CC 0F84ECD80000 je 760F20BE :760E47D2 395D0C cmp dword ptr [ebp+0C], ebx :760E47D5 0F8418D90000 je 760F20F3 :760E47DB 8B7510 mov esi, dword ptr [ebp+10] :760E47DE 3BF3 cmp esi, ebx :760E47E0 0F8435D90000 je 760F211B :760E47E6 57 push edi :760E47E7 E863000000 call 760E484F :760E47EC FF750C push [ebp+0C] :760E47EF 8BD8 mov ebx, eax :760E47F1 E859000000 call 760E484F :760E47F6 833E00 cmp dword ptr [esi], 00000000 :760E47F9 8D440301 lea eax, dword ptr [ebx+eax+01] * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E47FD 8B1D80110E76 mov ebx, dword ptr [760E1180] :760E4803 894508 mov dword ptr [ebp+08], eax :760E4806 0F8537D90000 jne 760F2143 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2179(U) | :760E480C FF7508 push [ebp+08] :760E480F E821D1FFFF call 760E1935 :760E4814 8BC8 mov ecx, eax :760E4816 8906 mov dword ptr [esi], eax :760E4818 85C9 test ecx, ecx :760E481A 0F845ED90000 je 760F217E :760E4820 33D2 xor edx, edx :760E4822 EB05 jmp 760E4829 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E482F(U) | :760E4824 8801 mov byte ptr [ecx], al :760E4826 41 inc ecx :760E4827 47 inc edi :760E4828 42 inc edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4822(U) | :760E4829 8A07 mov al, byte ptr [edi] :760E482B 84C0 test al, al :760E482D 7402 je 760E4831 :760E482F EBF3 jmp 760E4824 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E482D(C) | :760E4831 8B550C mov edx, dword ptr [ebp+0C] :760E4834 EB04 jmp 760E483A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4840(U) | :760E4836 8801 mov byte ptr [ecx], al :760E4838 41 inc ecx :760E4839 42 inc edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4834(U) | :760E483A 8A02 mov al, byte ptr [edx] :760E483C 84C0 test al, al :760E483E 7402 je 760E4842 :760E4840 EBF4 jmp 760E4836 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E483E(C) | :760E4842 802100 and byte ptr [ecx], 00 :760E4845 8B45FC mov eax, dword ptr [ebp-04] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F20EE(U) | :760E4848 5F pop edi :760E4849 5E pop esi :760E484A 5B pop ebx :760E484B C9 leave :760E484C C20C00 ret 000C * Referenced by a CALL at Addresses: |:760E47E7 , :760E47F1 | :760E484F 8B442404 mov eax, dword ptr [esp+04] :760E4853 56 push esi :760E4854 33F6 xor esi, esi :760E4856 85C0 test eax, eax :760E4858 7507 jne 760E4861 :760E485A E951D90000 jmp 760F21B0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4866(U) | :760E485F 40 inc eax :760E4860 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4858(C) | :760E4861 803800 cmp byte ptr [eax], 00 :760E4864 7402 je 760E4868 :760E4866 EBF7 jmp 760E485F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4864(C) | :760E4868 A184110E76 mov eax, dword ptr [760E1184] :760E486D F60004 test byte ptr [eax], 04 :760E4870 0F8571D90000 jne 760F21E7 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F21E2(U), :760F2200(C), :760F2216(U) | :760E4876 8BC6 mov eax, esi :760E4878 5E pop esi :760E4879 C20400 ret 0004 * Referenced by a CALL at Address: |:760E43F0 | :760E487C 8B542404 mov edx, dword ptr [esp+04] :760E4880 6A01 push 00000001 :760E4882 58 pop eax :760E4883 832200 and dword ptr [edx], 00000000 :760E4886 8B4944 mov ecx, dword ptr [ecx+44] :760E4889 85C9 test ecx, ecx :760E488B 0F84D9D30000 je 760F1C6A :760E4891 890A mov dword ptr [edx], ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1C9E(U) | :760E4893 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E15DD , :760E15F9 , :760E4970 , :760E4A42 , :760F199A |:760F1AAB , :760F1AC3 , :760F1ACE , :760F1AE5 , :760F1B0C |:760F2171 | :760E4896 FF742404 push [esp+04] :760E489A 6A00 push 00000000 * Reference To: KERNEL32.GetProcessHeap, Ord:0155h | :760E489C FF15F8110E76 Call dword ptr [760E11F8] :760E48A2 50 push eax * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760E48A3 FF15FC110E76 Call dword ptr [760E11FC] :760E48A9 C20400 ret 0004 * Referenced by a CALL at Address: |:760E5E4D | :760E48AC 55 push ebp :760E48AD 8BEC mov ebp, esp :760E48AF 81EC00050000 sub esp, 00000500 :760E48B5 56 push esi :760E48B6 57 push edi :760E48B7 8D8D00FBFFFF lea ecx, dword ptr [ebp+FFFFFB00] :760E48BD E885CEFFFF call 760E1747 :760E48C2 8B7508 mov esi, dword ptr [ebp+08] :760E48C5 8D8D00FBFFFF lea ecx, dword ptr [ebp+FFFFFB00] :760E48CB 832600 and dword ptr [esi], 00000000 :760E48CE E8A2FBFFFF call 760E4475 :760E48D3 8BF8 mov edi, eax :760E48D5 85FF test edi, edi :760E48D7 0F84C9D00000 je 760F19A6 :760E48DD 56 push esi :760E48DE 8D8D00FBFFFF lea ecx, dword ptr [ebp+FFFFFB00] :760E48E4 E81D000000 call 760E4906 :760E48E9 8BF8 mov edi, eax :760E48EB 85FF test edi, edi :760E48ED 0F84E7D00000 je 760F19DA * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F19AE(C), :760F19CD(C), :760F19E2(C), :760F1A01(C), :760F1A15(U) | :760E48F3 8D8D00FBFFFF lea ecx, dword ptr [ebp+FFFFFB00] :760E48F9 E8CECCFFFF call 760E15CC :760E48FE 8BC7 mov eax, edi :760E4900 5F pop edi :760E4901 5E pop esi :760E4902 C9 leave :760E4903 C20400 ret 0004 * Referenced by a CALL at Address: |:760E48E4 | :760E4906 55 push ebp :760E4907 8BEC mov ebp, esp :760E4909 51 push ecx :760E490A 53 push ebx :760E490B 8B5D08 mov ebx, dword ptr [ebp+08] :760E490E 56 push esi :760E490F 57 push edi :760E4910 33FF xor edi, edi :760E4912 8BF1 mov esi, ecx :760E4914 3BDF cmp ebx, edi :760E4916 897DFC mov dword ptr [ebp-04], edi :760E4919 0F84AFD40000 je 760F1DCE :760E491F 8B4644 mov eax, dword ptr [esi+44] :760E4922 3BC7 cmp eax, edi :760E4924 0F84E3D40000 je 760F1E0D :760E492A 8D4DFC lea ecx, dword ptr [ebp-04] :760E492D 51 push ecx :760E492E FF3504DA0F76 push dword ptr [760FDA04] :760E4934 50 push eax :760E4935 E87EFEFFFF call 760E47B8 :760E493A 85C0 test eax, eax :760E493C 0F84FFD40000 je 760F1E41 :760E4942 83C66C add esi, 0000006C :760E4945 53 push ebx :760E4946 56 push esi :760E4947 FF75FC push [ebp-04] :760E494A E869FEFFFF call 760E47B8 :760E494F 8BF8 mov edi, eax :760E4951 A184110E76 mov eax, dword ptr [760E1184] :760E4956 85FF test edi, edi :760E4958 0F842CD50000 je 760F1E8A :760E495E F60004 test byte ptr [eax], 04 :760E4961 0F855DD50000 jne 760F1EC4 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1DD6(C), :760F1DF5(C), :760F1E08(U), :760F1E15(C), :760F1E34(C) |:760F1E49(C), :760F1E68(C), :760F1E85(U), :760F1EBF(U), :760F1EDD(C) |:760F1EF4(U) | :760E4967 837DFC00 cmp dword ptr [ebp-04], 00000000 :760E496B 7408 je 760E4975 :760E496D FF75FC push [ebp-04] :760E4970 E821FFFFFF call 760E4896 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E496B(C) | :760E4975 8BC7 mov eax, edi :760E4977 5F pop edi :760E4978 5E pop esi :760E4979 5B pop ebx :760E497A C9 leave :760E497B C20400 ret 0004 * Referenced by a CALL at Address: |:760E5E6B | :760E497E 55 push ebp :760E497F 8BEC mov ebp, esp :760E4981 81EC00050000 sub esp, 00000500 :760E4987 56 push esi :760E4988 57 push edi :760E4989 8D8D00FBFFFF lea ecx, dword ptr [ebp+FFFFFB00] :760E498F E8B3CDFFFF call 760E1747 :760E4994 8B7508 mov esi, dword ptr [ebp+08] :760E4997 8D8D00FBFFFF lea ecx, dword ptr [ebp+FFFFFB00] :760E499D 832600 and dword ptr [esi], 00000000 :760E49A0 E8D0FAFFFF call 760E4475 :760E49A5 8BF8 mov edi, eax :760E49A7 85FF test edi, edi :760E49A9 0F846BD00000 je 760F1A1A :760E49AF 56 push esi :760E49B0 8D8D00FBFFFF lea ecx, dword ptr [ebp+FFFFFB00] :760E49B6 E81D000000 call 760E49D8 :760E49BB 8BF8 mov edi, eax :760E49BD 85FF test edi, edi :760E49BF 0F8489D00000 je 760F1A4E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1A22(C), :760F1A41(C), :760F1A56(C), :760F1A75(C), :760F1A89(U) | :760E49C5 8D8D00FBFFFF lea ecx, dword ptr [ebp+FFFFFB00] :760E49CB E8FCCBFFFF call 760E15CC :760E49D0 8BC7 mov eax, edi :760E49D2 5F pop edi :760E49D3 5E pop esi :760E49D4 C9 leave :760E49D5 C20400 ret 0004 * Referenced by a CALL at Address: |:760E49B6 | :760E49D8 55 push ebp :760E49D9 8BEC mov ebp, esp :760E49DB 51 push ecx :760E49DC 53 push ebx :760E49DD 8B5D08 mov ebx, dword ptr [ebp+08] :760E49E0 56 push esi :760E49E1 57 push edi :760E49E2 33FF xor edi, edi :760E49E4 8BF1 mov esi, ecx :760E49E6 3BDF cmp ebx, edi :760E49E8 897DFC mov dword ptr [ebp-04], edi :760E49EB 0F84B2D20000 je 760F1CA3 :760E49F1 8B4644 mov eax, dword ptr [esi+44] :760E49F4 3BC7 cmp eax, edi :760E49F6 0F84E6D20000 je 760F1CE2 :760E49FC 8D4DFC lea ecx, dword ptr [ebp-04] :760E49FF 51 push ecx :760E4A00 FF3504DA0F76 push dword ptr [760FDA04] :760E4A06 50 push eax :760E4A07 E8ACFDFFFF call 760E47B8 :760E4A0C 85C0 test eax, eax :760E4A0E 0F8402D30000 je 760F1D16 :760E4A14 83C65C add esi, 0000005C :760E4A17 53 push ebx :760E4A18 56 push esi :760E4A19 FF75FC push [ebp-04] :760E4A1C E897FDFFFF call 760E47B8 :760E4A21 8BF8 mov edi, eax :760E4A23 A184110E76 mov eax, dword ptr [760E1184] :760E4A28 85FF test edi, edi :760E4A2A 0F842FD30000 je 760F1D5F :760E4A30 F60004 test byte ptr [eax], 04 :760E4A33 0F8560D30000 jne 760F1D99 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1CAB(C), :760F1CCA(C), :760F1CDD(U), :760F1CEA(C), :760F1D09(C) |:760F1D1E(C), :760F1D3D(C), :760F1D5A(U), :760F1D94(U), :760F1DB2(C) |:760F1DC9(U) | :760E4A39 837DFC00 cmp dword ptr [ebp-04], 00000000 :760E4A3D 7408 je 760E4A47 :760E4A3F FF75FC push [ebp-04] :760E4A42 E84FFEFFFF call 760E4896 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4A3D(C) | :760E4A47 8BC7 mov eax, edi :760E4A49 5F pop edi :760E4A4A 5E pop esi :760E4A4B 5B pop ebx :760E4A4C C9 leave :760E4A4D C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E3B37 , :760F76BB | :760E4A50 56 push esi :760E4A51 8BF1 mov esi, ecx :760E4A53 FF742408 push [esp+08] :760E4A57 E80F000000 call 760E4A6B :760E4A5C FF748618 push [esi+4*eax+18] :760E4A60 8BCE mov ecx, esi :760E4A62 E836000000 call 760E4A9D :760E4A67 5E pop esi :760E4A68 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E4A57 , :760E4AD5 , :760F3315 , :760F337D , :760F33E9 |:760F3404 | :760E4A6B 8A442404 mov al, byte ptr [esp+04] :760E4A6F 3C69 cmp al, 69 :760E4A71 0F8496F40000 je 760F3F0D :760E4A77 3C49 cmp al, 49 :760E4A79 0F848EF40000 je 760F3F0D :760E4A7F 3C65 cmp al, 65 :760E4A81 0F847FF40000 je 760F3F06 :760E4A87 3C45 cmp al, 45 :760E4A89 0F8477F40000 je 760F3F06 :760E4A8F 3C73 cmp al, 73 :760E4A91 0F8566F40000 jne 760F3EFD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3F01(U) | :760E4A97 6A02 push 00000002 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3F08(U) | :760E4A99 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3F0F(U) | :760E4A9A C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E4A62 , :760F33F4 , :760F340F | :760E4A9D 55 push ebp :760E4A9E 8BEC mov ebp, esp :760E4AA0 8B4508 mov eax, dword ptr [ebp+08] :760E4AA3 56 push esi :760E4AA4 57 push edi :760E4AA5 8BF9 mov edi, ecx :760E4AA7 85C0 test eax, eax :760E4AA9 0F849DE90000 je 760F344C :760E4AAF 8B08 mov ecx, dword ptr [eax] :760E4AB1 8D5508 lea edx, dword ptr [ebp+08] :760E4AB4 52 push edx :760E4AB5 50 push eax :760E4AB6 FF5120 call [ecx+20] :760E4AB9 8BF0 mov esi, eax :760E4ABB 85F6 test esi, esi :760E4ABD 0F8555E90000 jne 760F3418 :760E4AC3 8B4508 mov eax, dword ptr [ebp+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F344E(U) | :760E4AC6 5F pop edi :760E4AC7 5E pop esi :760E4AC8 5D pop ebp :760E4AC9 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E3B7A , :760F76DE | :760E4ACC 55 push ebp :760E4ACD 8BEC mov ebp, esp :760E4ACF 56 push esi :760E4AD0 8BF1 mov esi, ecx :760E4AD2 FF7514 push [ebp+14] :760E4AD5 E891FFFFFF call 760E4A6B :760E4ADA 837E0800 cmp dword ptr [esi+08], 00000000 :760E4ADE 0F84F7E80000 je 760F33DB :760E4AE4 8B448618 mov eax, dword ptr [esi+4*eax+18] :760E4AE8 85C0 test eax, eax :760E4AEA 0F84EBE80000 je 760F33DB :760E4AF0 53 push ebx :760E4AF1 8B5D10 mov ebx, dword ptr [ebp+10] :760E4AF4 57 push edi :760E4AF5 6A00 push 00000000 :760E4AF7 53 push ebx :760E4AF8 8BCE mov ecx, esi :760E4AFA FF750C push [ebp+0C] :760E4AFD FF7508 push [ebp+08] :760E4B00 50 push eax :760E4B01 E831000000 call 760E4B37 :760E4B06 8BF8 mov edi, eax :760E4B08 3BFB cmp edi, ebx :760E4B0A 7522 jne 760E4B2E :760E4B0C 53 push ebx :760E4B0D 8BCE mov ecx, esi :760E4B0F FF750C push [ebp+0C] :760E4B12 E842010000 call 760E4C59 :760E4B17 8BF8 mov edi, eax :760E4B19 3BFB cmp edi, ebx :760E4B1B 7511 jne 760E4B2E :760E4B1D FF750C push [ebp+0C] * Reference To: USER32.CharUpperA, Ord:002Fh | :760E4B20 FF1594120E76 Call dword ptr [760E1294] :760E4B26 FF750C push [ebp+0C] :760E4B29 E80AF7FFFF call 760E4238 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E4B0A(C), :760E4B1B(C) | :760E4B2E 8BC7 mov eax, edi :760E4B30 5F pop edi :760E4B31 5B pop ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F33DD(U) | :760E4B32 5E pop esi :760E4B33 5D pop ebp :760E4B34 C21000 ret 0010 * Referenced by a CALL at Addresses: |:760E4B01 , :760F333A , :760F33A1 | :760E4B37 55 push ebp :760E4B38 8BEC mov ebp, esp :760E4B3A 81EC38040000 sub esp, 00000438 :760E4B40 53 push ebx :760E4B41 8B5D08 mov ebx, dword ptr [ebp+08] :760E4B44 894DF8 mov dword ptr [ebp-08], ecx :760E4B47 56 push esi :760E4B48 8B03 mov eax, dword ptr [ebx] :760E4B4A 8D4DEC lea ecx, dword ptr [ebp-14] :760E4B4D 57 push edi :760E4B4E 33FF xor edi, edi :760E4B50 51 push ecx :760E4B51 53 push ebx :760E4B52 897DEC mov dword ptr [ebp-14], edi :760E4B55 897DF0 mov dword ptr [ebp-10], edi :760E4B58 897DF4 mov dword ptr [ebp-0C], edi :760E4B5B 897DFC mov dword ptr [ebp-04], edi :760E4B5E FF5020 call [eax+20] :760E4B61 8BF0 mov esi, eax :760E4B63 3BF7 cmp esi, edi :760E4B65 0F85E8E80000 jne 760F3453 :760E4B6B 8B450C mov eax, dword ptr [ebp+0C] :760E4B6E 3B45EC cmp eax, dword ptr [ebp-14] :760E4B71 0F8D14E90000 jnl 760F348B :760E4B77 8D4DF4 lea ecx, dword ptr [ebp-0C] :760E4B7A 66897DC8 mov word ptr [ebp-38], di :760E4B7E 51 push ecx :760E4B7F 8D75C8 lea esi, dword ptr [ebp-38] :760E4B82 83EC10 sub esp, 00000010 :760E4B85 66C745D80300 mov [ebp-28], 0003 :760E4B8B 8BFC mov edi, esp :760E4B8D 83EC10 sub esp, 00000010 :760E4B90 A5 movsd :760E4B91 A5 movsd :760E4B92 A5 movsd :760E4B93 A5 movsd :760E4B94 8D75D8 lea esi, dword ptr [ebp-28] :760E4B97 8BFC mov edi, esp :760E4B99 8945E0 mov dword ptr [ebp-20], eax :760E4B9C 8B03 mov eax, dword ptr [ebx] :760E4B9E A5 movsd :760E4B9F A5 movsd :760E4BA0 A5 movsd :760E4BA1 53 push ebx :760E4BA2 A5 movsd :760E4BA3 FF5028 call [eax+28] :760E4BA6 8BF0 mov esi, eax :760E4BA8 85F6 test esi, esi :760E4BAA 0F8513E90000 jne 760F34C3 :760E4BB0 8B45F4 mov eax, dword ptr [ebp-0C] :760E4BB3 8D55FC lea edx, dword ptr [ebp-04] :760E4BB6 52 push edx :760E4BB7 6868430E76 push 760E4368 :760E4BBC 8B08 mov ecx, dword ptr [eax] :760E4BBE 50 push eax :760E4BBF FF11 call dword ptr [ecx] :760E4BC1 8BF0 mov esi, eax :760E4BC3 85F6 test esi, esi :760E4BC5 0F8529E90000 jne 760F34F4 :760E4BCB 8B45F4 mov eax, dword ptr [ebp-0C] :760E4BCE 85C0 test eax, eax :760E4BD0 740A je 760E4BDC :760E4BD2 8B08 mov ecx, dword ptr [eax] :760E4BD4 50 push eax :760E4BD5 FF5108 call [ecx+08] :760E4BD8 8365F400 and dword ptr [ebp-0C], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4BD0(C) | :760E4BDC 8B45FC mov eax, dword ptr [ebp-04] :760E4BDF 8D55E8 lea edx, dword ptr [ebp-18] :760E4BE2 52 push edx :760E4BE3 50 push eax :760E4BE4 8B08 mov ecx, dword ptr [eax] :760E4BE6 FF513C call [ecx+3C] :760E4BE9 8BF0 mov esi, eax :760E4BEB 85F6 test esi, esi :760E4BED 0F852EE90000 jne 760F3521 :760E4BF3 8B4DF8 mov ecx, dword ptr [ebp-08] :760E4BF6 BE00040000 mov esi, 00000400 :760E4BFB 8D85C8FBFFFF lea eax, dword ptr [ebp+FFFFFBC8] :760E4C01 56 push esi :760E4C02 50 push eax :760E4C03 FF75E8 push [ebp-18] :760E4C06 E893F4FFFF call 760E409E :760E4C0B 3BC6 cmp eax, esi :760E4C0D 0F8F46E90000 jg 760F3559 :760E4C13 8DBDC8FBFFFF lea edi, dword ptr [ebp+FFFFFBC8] :760E4C19 83C9FF or ecx, FFFFFFFF :760E4C1C 33C0 xor eax, eax :760E4C1E F2 repnz :760E4C1F AE scasb :760E4C20 F7D1 not ecx :760E4C22 2BF9 sub edi, ecx :760E4C24 8BC1 mov eax, ecx :760E4C26 8BF7 mov esi, edi :760E4C28 8B7D10 mov edi, dword ptr [ebp+10] :760E4C2B C1E902 shr ecx, 02 :760E4C2E F3 repz :760E4C2F A5 movsd :760E4C30 8BC8 mov ecx, eax :760E4C32 83E103 and ecx, 00000003 :760E4C35 F3 repz :760E4C36 A4 movsb :760E4C37 8B7518 mov esi, dword ptr [ebp+18] :760E4C3A 85F6 test esi, esi :760E4C3C 0F8541E90000 jne 760F3583 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F35D1(C), :760F35DC(U) | :760E4C42 8B45FC mov eax, dword ptr [ebp-04] :760E4C45 85C0 test eax, eax :760E4C47 7406 je 760E4C4F :760E4C49 8B08 mov ecx, dword ptr [eax] :760E4C4B 50 push eax :760E4C4C FF5108 call [ecx+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4C47(C) | :760E4C4F 8B4514 mov eax, dword ptr [ebp+14] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F357E(U) | :760E4C52 5F pop edi :760E4C53 5E pop esi :760E4C54 5B pop ebx :760E4C55 C9 leave :760E4C56 C21400 ret 0014 * Referenced by a CALL at Addresses: |:760E4B12 , :760F334B , :760F33B2 | :760E4C59 55 push ebp :760E4C5A 8BEC mov ebp, esp :760E4C5C 81EC00040000 sub esp, 00000400 :760E4C62 56 push esi :760E4C63 57 push edi :760E4C64 FF750C push [ebp+0C] :760E4C67 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760E4C6D 8BF9 mov edi, ecx :760E4C6F 50 push eax :760E4C70 FF7508 push [ebp+08] * Reference To: KERNEL32.ExpandEnvironmentStringsA, Ord:008Fh | :760E4C73 FF1574120E76 Call dword ptr [760E1274] :760E4C79 8BF0 mov esi, eax :760E4C7B 85F6 test esi, esi :760E4C7D 0F846AE90000 je 760F35ED :760E4C83 3B750C cmp esi, dword ptr [ebp+0C] :760E4C86 0F87A4E90000 ja 760F3630 :760E4C8C 8DBD00FCFFFF lea edi, dword ptr [ebp+FFFFFC00] :760E4C92 83C9FF or ecx, FFFFFFFF :760E4C95 33C0 xor eax, eax :760E4C97 F2 repnz :760E4C98 AE scasb :760E4C99 F7D1 not ecx :760E4C9B 2BF9 sub edi, ecx :760E4C9D 8BC1 mov eax, ecx :760E4C9F 8BF7 mov esi, edi :760E4CA1 8B7D08 mov edi, dword ptr [ebp+08] :760E4CA4 C1E902 shr ecx, 02 :760E4CA7 F3 repz :760E4CA8 A5 movsd :760E4CA9 8BC8 mov ecx, eax :760E4CAB 8B450C mov eax, dword ptr [ebp+0C] :760E4CAE 83E103 and ecx, 00000003 :760E4CB1 F3 repz :760E4CB2 A4 movsb * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F362B(U), :760F3667(U) | :760E4CB3 5F pop edi :760E4CB4 5E pop esi :760E4CB5 C9 leave :760E4CB6 C20800 ret 0008 * Referenced by a CALL at Addresses: |:760E3B9D , :760E3BBA , :760E3C2C , :760E3C6F , :760E3CA9 |:760EE807 , :760EFD7A | :760E4CB9 55 push ebp :760E4CBA 8BEC mov ebp, esp :760E4CBC 53 push ebx :760E4CBD 56 push esi :760E4CBE 57 push edi :760E4CBF 33FF xor edi, edi :760E4CC1 33DB xor ebx, ebx :760E4CC3 397D0C cmp dword ptr [ebp+0C], edi :760E4CC6 8BF1 mov esi, ecx :760E4CC8 753C jne 760E4D06 :760E4CCA FF7508 push [ebp+08] :760E4CCD 8BCE mov ecx, esi :760E4CCF E87DCCFFFF call 760E1951 :760E4CD4 8BF8 mov edi, eax :760E4CD6 83FFFF cmp edi, FFFFFFFF :760E4CD9 0F84F4110100 je 760F5ED3 :760E4CDF FF7508 push [ebp+08] :760E4CE2 8BCE mov ecx, esi :760E4CE4 57 push edi :760E4CE5 E8D9CCFFFF call 760E19C3 :760E4CEA 85C0 test eax, eax :760E4CEC 0F8424120100 je 760F5F16 :760E4CF2 8B00 mov eax, dword ptr [eax] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4D0C(U) | :760E4CF4 85C0 test eax, eax :760E4CF6 BAD3070000 mov edx, 000007D3 :760E4CFB 7526 jne 760E4D23 :760E4CFD 8D8CBE0C030000 lea ecx, dword ptr [esi+4*edi+0000030C] :760E4D04 EB13 jmp 760E4D19 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4CC8(C) | :760E4D06 8B860C030000 mov eax, dword ptr [esi+0000030C] :760E4D0C EBE6 jmp 760E4CF4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4D1D(U) | :760E4D0E 8B4104 mov eax, dword ptr [ecx+04] :760E4D11 83C104 add ecx, 00000004 :760E4D14 47 inc edi :760E4D15 85C0 test eax, eax :760E4D17 7506 jne 760E4D1F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4D04(U) | :760E4D19 3BFA cmp edi, edx :760E4D1B 7302 jnb 760E4D1F :760E4D1D EBEF jmp 760E4D0E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E4D17(C), :760E4D1B(C) | :760E4D1F 85C0 test eax, eax :760E4D21 7435 je 760E4D58 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4CFB(C) | :760E4D23 3BFA cmp edi, edx :760E4D25 7331 jnb 760E4D58 :760E4D27 83C008 add eax, 00000008 :760E4D2A 6804010000 push 00000104 :760E4D2F 50 push eax :760E4D30 FF7508 push [ebp+08] * Reference To: KERNEL32.lstrcpynA, Ord:0332h | :760E4D33 FF1518120E76 Call dword ptr [760E1218] :760E4D39 8BD8 mov ebx, eax :760E4D3B A184110E76 mov eax, dword ptr [760E1184] :760E4D40 F7DB neg ebx :760E4D42 1BDB sbb ebx, ebx :760E4D44 F7DB neg ebx :760E4D46 F60004 test byte ptr [eax], 04 :760E4D49 0F85FE110100 jne 760F5F4D * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E4D5E(U), :760F5EDB(C), :760F5EFA(C), :760F5F11(U), :760F5F1E(C) |:760F5F3D(C), :760F5F66(C), :760F5F81(U) | :760E4D4F 5F pop edi :760E4D50 8BC3 mov eax, ebx :760E4D52 5E pop esi :760E4D53 5B pop ebx :760E4D54 5D pop ebp :760E4D55 C20800 ret 0008 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E4D21(C), :760E4D25(C) | :760E4D58 8B4508 mov eax, dword ptr [ebp+08] :760E4D5B 802000 and byte ptr [eax], 00 :760E4D5E EBEF jmp 760E4D4F * Referenced by a CALL at Addresses: |:760E3CBC , :760EEDDB , :760EF3E9 | :760E4D60 81EC00080000 sub esp, 00000800 :760E4D66 53 push ebx :760E4D67 8BD9 mov ebx, ecx :760E4D69 55 push ebp :760E4D6A 56 push esi :760E4D6B 8B03 mov eax, dword ptr [ebx] :760E4D6D 33F6 xor esi, esi :760E4D6F 3BC6 cmp eax, esi :760E4D71 57 push edi :760E4D72 0F8557FB0000 jne 760F48CF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F48DA(U) | :760E4D78 8D842410040000 lea eax, dword ptr [esp+00000410] :760E4D7F 6800040000 push 00000400 :760E4D84 50 push eax * Reference To: KERNEL32.GetSystemDirectoryA, Ord:0170h | :760E4D85 FF15A8110E76 Call dword ptr [760E11A8] :760E4D8B 85C0 test eax, eax :760E4D8D 0F844CFB0000 je 760F48DF * Possible StringData Ref from Code Obj ->"{F750E6C3-38EE-11D1-85E5-00C04FC295EE}" | :760E4D93 68AC500E76 push 760E50AC :760E4D98 8D842414040000 lea eax, dword ptr [esp+00000414] * Possible StringData Ref from Code Obj ->"CatRoot" | :760E4D9F 68A4500E76 push 760E50A4 :760E4DA4 50 push eax :760E4DA5 8D44241C lea eax, dword ptr [esp+1C] * Possible StringData Ref from Code Obj ->"%s\%s\%s" | :760E4DA9 6898500E76 push 760E5098 :760E4DAE 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760E4DAF FF1530100E76 Call dword ptr [760E1030] :760E4DB5 83C414 add esp, 00000014 :760E4DB8 8D442410 lea eax, dword ptr [esp+10] :760E4DBC 50 push eax :760E4DBD E8EACEFFFF call 760E1CAC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E4DC2 8B3580110E76 mov esi, dword ptr [760E1180] * Possible StringData Ref from Code Obj ->"CCatUtils::Init()" | :760E4DC8 BD84500E76 mov ebp, 760E5084 :760E4DCD 85C0 test eax, eax * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760E4DCF BFC0D90F76 mov edi, 760FD9C0 :760E4DD4 0F843EFB0000 je 760F4918 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F49B4(C) | :760E4DDA 8D442410 lea eax, dword ptr [esp+10] :760E4DDE 8BCB mov ecx, ebx :760E4DE0 50 push eax :760E4DE1 E82AF1FFFF call 760E3F10 :760E4DE6 85C0 test eax, eax :760E4DE8 8903 mov dword ptr [ebx], eax :760E4DEA 0F84ECFB0000 je 760F49DC :760E4DF0 6A01 push 00000001 :760E4DF2 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4A1A(U) | :760E4DF3 5F pop edi :760E4DF4 5E pop esi :760E4DF5 5D pop ebp :760E4DF6 5B pop ebx :760E4DF7 81C400080000 add esp, 00000800 :760E4DFD C3 ret * Referenced by a CALL at Addresses: |:760E3D37 , :760EBBAB , :760EEE68 | :760E4DFE 55 push ebp :760E4DFF 8BEC mov ebp, esp :760E4E01 81EC54080000 sub esp, 00000854 :760E4E07 53 push ebx :760E4E08 56 push esi :760E4E09 57 push edi :760E4E0A 8D85ACF7FFFF lea eax, dword ptr [ebp+FFFFF7AC] :760E4E10 6800040000 push 00000400 :760E4E15 50 push eax :760E4E16 6AFF push FFFFFFFF :760E4E18 33F6 xor esi, esi :760E4E1A FF7508 push [ebp+08] :760E4E1D C745FC4F050000 mov [ebp-04], 0000054F :760E4E24 56 push esi :760E4E25 56 push esi * Reference To: KERNEL32.MultiByteToWideChar, Ord:0202h | :760E4E26 FF154C120E76 Call dword ptr [760E124C] :760E4E2C 85C0 test eax, eax :760E4E2E 0F84BB030100 je 760F51EF :760E4E34 6A0B push 0000000B :760E4E36 33C0 xor eax, eax :760E4E38 59 pop ecx :760E4E39 8D7DD0 lea edi, dword ptr [ebp-30] :760E4E3C F3 repz :760E4E3D AB stosd :760E4E3E 8D45C0 lea eax, dword ptr [ebp-40] :760E4E41 8D7DC0 lea edi, dword ptr [ebp-40] :760E4E44 8945E8 mov dword ptr [ebp-18], eax :760E4E47 33C0 xor eax, eax :760E4E49 AB stosd :760E4E4A AB stosd :760E4E4B AB stosd :760E4E4C 6A01 push 00000001 :760E4E4E C745D02C000000 mov [ebp-30], 0000002C :760E4E55 5B pop ebx :760E4E56 C745DC02000000 mov [ebp-24], 00000002 :760E4E5D AB stosd :760E4E5E 8D85ACF7FFFF lea eax, dword ptr [ebp+FFFFF7AC] :760E4E64 6A10 push 00000010 :760E4E66 8945C4 mov dword ptr [ebp-3C], eax :760E4E69 59 pop ecx :760E4E6A 8D45D0 lea eax, dword ptr [ebp-30] :760E4E6D 8975E0 mov dword ptr [ebp-20], esi :760E4E70 50 push eax :760E4E71 68B0D90F76 push 760FD9B0 :760E4E76 56 push esi :760E4E77 895DEC mov dword ptr [ebp-14], ebx :760E4E7A 894DF8 mov dword ptr [ebp-08], ecx :760E4E7D 895DE4 mov dword ptr [ebp-1C], ebx :760E4E80 894DC0 mov dword ptr [ebp-40], ecx * Reference To: WINTRUST.WinVerifyTrust, Ord:006Bh | :760E4E83 E8B6DFFFFF Call 760E2E3E :760E4E88 8BF8 mov edi, eax :760E4E8A 3BFE cmp edi, esi :760E4E8C 0F859A030100 jne 760F522C :760E4E92 FF75F0 push [ebp-10] * Reference To: WINTRUST.WTHelperProvDataFromStateData, Ord:0054h | :760E4E95 E8B0DFFFFF Call 760E2E4A :760E4E9A 3BC6 cmp eax, esi :760E4E9C 0F84CE030100 je 760F5270 :760E4EA2 397040 cmp dword ptr [eax+40], esi :760E4EA5 0F840E040100 je 760F52B9 :760E4EAB 56 push esi :760E4EAC 56 push esi :760E4EAD 56 push esi :760E4EAE 50 push eax * Reference To: WINTRUST.WTHelperGetProvSignerFromChain, Ord:0051h | :760E4EAF E89CDFFFFF Call 760E2E50 :760E4EB4 8BF8 mov edi, eax :760E4EB6 3BFE cmp edi, esi :760E4EB8 0F843A040100 je 760F52F8 :760E4EBE 8B470C mov eax, dword ptr [edi+0C] :760E4EC1 48 dec eax :760E4EC2 50 push eax :760E4EC3 57 push edi * Reference To: WINTRUST.WTHelperGetProvCertFromChain, Ord:004Fh | :760E4EC4 E88DDFFFFF Call 760E2E56 :760E4EC9 3BC6 cmp eax, esi :760E4ECB 0F844B040100 je 760F531C :760E4ED1 8B4004 mov eax, dword ptr [eax+04] :760E4ED4 8D4D08 lea ecx, dword ptr [ebp+08] :760E4ED7 C7450814000000 mov [ebp+08], 00000014 :760E4EDE 51 push ecx :760E4EDF 8B400C mov eax, dword ptr [eax+0C] :760E4EE2 8D4DAC lea ecx, dword ptr [ebp-54] :760E4EE5 83C038 add eax, 00000038 :760E4EE8 51 push ecx :760E4EE9 50 push eax :760E4EEA 53 push ebx :760E4EEB 56 push esi :760E4EEC 6804800000 push 00008004 :760E4EF1 56 push esi * Reference To: CRYPT32.CryptHashPublicKeyInfo, Ord:0092h | :760E4EF2 FF15E4120E76 Call dword ptr [760E12E4] :760E4EF8 85C0 test eax, eax :760E4EFA 0F845C040100 je 760F535C :760E4F00 57 push edi :760E4F01 E856DFFFFF call 760E2E5C :760E4F06 3BC3 cmp eax, ebx :760E4F08 A184110E76 mov eax, dword ptr [760E1184] :760E4F0D 0F852A050100 jne 760F543D :760E4F13 F60004 test byte ptr [eax], 04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E4F16 8B1D80110E76 mov ebx, dword ptr [760E1180] :760E4F1C 0F857A040100 jne 760F539C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F53B1(C), :760F53C4(U) | :760E4F22 6A14 push 00000014 :760E4F24 59 pop ecx :760E4F25 394D08 cmp dword ptr [ebp+08], ecx :760E4F28 0F85D5040100 jne 760F5403 :760E4F2E 8D7DAC lea edi, dword ptr [ebp-54] :760E4F31 BE30DA0F76 mov esi, 760FDA30 :760E4F36 33C0 xor eax, eax :760E4F38 F3 repz :760E4F39 A6 cmpsb :760E4F3A 0F8589040100 jne 760F53C9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F53CE(U) | :760E4F40 85C0 test eax, eax :760E4F42 0F85B9040100 jne 760F5401 :760E4F48 A184110E76 mov eax, dword ptr [760E1184] :760E4F4D F60004 test byte ptr [eax], 04 :760E4F50 0F857D040100 jne 760F53D3 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F53E8(C), :760F53FC(U) | :760E4F56 8365FC00 and dword ptr [ebp-04], 00000000 :760E4F5A 33F6 xor esi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5280(C), :760F529F(C), :760F52B4(U), :760F52C1(C), :760F52E0(C) |:760F52F3(U), :760F5308(C), :760F532C(C), :760F534B(C), :760F536C(C) |:760F538B(C), :760F5438(U), :760F546D(U) | :760E4F5C 8D45D0 lea eax, dword ptr [ebp-30] :760E4F5F C745EC02000000 mov [ebp-14], 00000002 :760E4F66 50 push eax :760E4F67 68B0D90F76 push 760FD9B0 :760E4F6C 56 push esi * Reference To: WINTRUST.WinVerifyTrust, Ord:006Bh | :760E4F6D E8CCDEFFFF Call 760E2E3E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F51FF(C), :760F521E(C), :760F5237(C), :760F5256(C), :760F526B(U) | :760E4F72 8B45FC mov eax, dword ptr [ebp-04] :760E4F75 5F pop edi :760E4F76 5E pop esi :760E4F77 5B pop ebx :760E4F78 C9 leave :760E4F79 C20400 ret 0004 :760E4F7C 5C pop esp :760E4F7D 53 push ebx :760E4F7E 7973 jns 760E4FF3 :760E4F80 7465 je 760E4FE7 :760E4F82 6D insd :760E4F83 5C pop esp :760E4F84 52 push edx :760E4F85 65 BYTE 065h :760E4F86 7374 jnb 760E4FFC :760E4F88 6F outsd :760E4F89 7265 jb 760E4FF0 :760E4F8B 5C pop esp :760E4F8C 44 inc esp :760E4F8D 61 popad :760E4F8E 7461 je 760E4FF1 :760E4F90 53 push ebx :760E4F91 746F je 760E5002 :760E4F93 722E jb 760E4FC3 :760E4F95 696E6900909090 imul ebp, dword ptr [esi+69], 90909000 :760E4F9C 44 inc esp :760E4F9D 53 push ebx :760E4F9E 52 push edx :760E4F9F 4F dec edi :760E4FA0 4F dec edi :760E4FA1 54 push esp :760E4FA2 00904453494E add byte ptr [eax+4E495344], dl :760E4FA8 46 inc esi :760E4FA9 4F dec edi :760E4FAA 2E BYTE 02eh :760E4FAB 44 inc esp :760E4FAC 41 inc ecx :760E4FAD 54 push esp :760E4FAE 009045585452 add byte ptr [eax+52545845], dl :760E4FB4 41 inc ecx :760E4FB5 43 inc ebx :760E4FB6 54 push esp :760E4FB7 004C4F47 add byte ptr [edi+2*ecx+47], cl :760E4FBB 53 push ebx :760E4FBC 009090904152 add byte ptr [eax+52419090], dl :760E4FC2 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4F93(C) | :760E4FC3 48 dec eax :760E4FC4 49 dec ecx :760E4FC5 56 push esi :760E4FC6 45 inc ebp :760E4FC7 0054454D add byte ptr [ebp+2*eax+4D], dl :760E4FCB 50 push eax :760E4FCC 009090905F52 add byte ptr [eax+525F9090], dl :760E4FD2 45 inc ebp :760E4FD3 53 push ebx :760E4FD4 54 push esp :760E4FD5 4F dec edi :760E4FD6 52 push edx :760E4FD7 45 inc ebp :760E4FD8 00903A005C00 add byte ptr [eax+005C003A], dl :760E4FDE 90 nop :760E4FDF 90 nop :760E4FE0 44 inc esp :760E4FE1 3A5C6D70 cmp bl, byte ptr [ebp+2*ebp+70] :760E4FE5 636672 arpl dword ptr [esi+72], esp :760E4FE8 65 BYTE 065h :760E4FE9 5C pop esp :760E4FEA 52 push edx :760E4FEB 65 BYTE 065h :760E4FEC 7374 jnb 760E5062 :760E4FEE 6F outsd :760E4FEF 7265 jb 760E5056 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4F8E(C) | :760E4FF1 5C pop esp :760E4FF2 7372 jnb 760E5066 :760E4FF4 635C7374 arpl dword ptr [ebx+2*esi+74], ebx :760E4FF8 61 popad :760E4FF9 7465 je 760E5060 :760E4FFB 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4F86(C) | :760E4FFC 67725C jb 760E505B :760E4FFF 64 BYTE 064h :760E5000 736D jnb 760E506F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4F91(C) | :760E5002 676D insd :760E5004 745C je 760E5062 :760E5006 636867 arpl dword ptr [eax+67], ebp :760E5009 6C insb :760E500A 6F outsd :760E500B 6761 popad :760E500D 7069 jo 760E5078 :760E500F 2E637070 arpl dword ptr cs:[eax+70], esi :760E5013 004765 add byte ptr [edi+65], al :760E5016 7444 je 760E505C :760E5018 53 push ebx :760E5019 52 push edx :760E501A 6F outsd :760E501B 6F outsd :760E501C 7400 je 760E501E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E501C(C) | :760E501E 90 nop :760E501F 90 nop :760E5020 44 inc esp :760E5021 3A5C6D70 cmp bl, byte ptr [ebp+2*ebp+70] :760E5025 636672 arpl dword ptr [esi+72], esp :760E5028 65 BYTE 065h :760E5029 5C pop esp :760E502A 52 push edx :760E502B 65 BYTE 065h :760E502C 7374 jnb 760E50A2 :760E502E 6F outsd :760E502F 7265 jb 760E5096 :760E5031 5C pop esp :760E5032 7372 jnb 760E50A6 :760E5034 635C7374 arpl dword ptr [ebx+2*esi+74], ebx :760E5038 61 popad :760E5039 7465 je 760E50A0 :760E503B 6D insd :760E503C 67725C jb 760E509B :760E503F 64 BYTE 064h :760E5040 736D jnb 760E50AF :760E5042 676D insd :760E5044 745C je 760E50A2 :760E5046 64 BYTE 064h :760E5047 61 popad :760E5048 7461 je 760E50AB :760E504A 7374 jnb 760E50C0 :760E504C 6F outsd :760E504D 722E jb 760E507D :760E504F 637070 arpl dword ptr [eax+70], esi :760E5052 009043446174 add byte ptr [eax+74614443], dl :760E5058 61 popad :760E5059 53 push ebx :760E505A 746F je 760E50CB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5016(C) | :760E505C 723A jb 760E5098 :760E505E 3A4C6F61 cmp cl, byte ptr [edi+2*ebp+61] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E4FEC(C), :760E5004(C) | :760E5062 64 BYTE 064h :760E5063 52 push edx :760E5064 65 BYTE 065h :760E5065 7374 jnb 760E50DB :760E5067 6F outsd :760E5068 7252 jb 760E50BC :760E506A 6300 arpl dword ptr [eax], eax :760E506C 25733A5C25 and eax, 255C3A73 :760E5071 7300 jnb 760E5073 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5071(C) | :760E5073 90 nop :760E5074 43 inc ebx :760E5075 44 inc esp :760E5076 61 popad :760E5077 7461 je 760E50DA :760E5079 53 push ebx :760E507A 746F je 760E50EB :760E507C 723A jb 760E50B8 :760E507E 3A496E cmp cl, byte ptr [ecx+6E] :760E5081 6974004343617455 imul esi, dword ptr [eax+eax+43], 55746143 :760E5089 7469 je 760E50F4 :760E508B 6C insb :760E508C 733A jnb 760E50C8 :760E508E 3A496E cmp cl, byte ptr [ecx+6E] :760E5091 6974282900909025 imul esi, dword ptr [eax+ebp+29], 25909000 :760E5099 735C jnb 760E50F7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E503D(C) | :760E509B 25735C2573 and eax, 73255C73 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5039(C) | :760E50A0 009090904361 add byte ptr [eax+61439090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5032(C) | :760E50A6 7452 je 760E50FA :760E50A8 6F outsd :760E50A9 6F outsd :760E50AA 7400 je 760E50AC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E50AA(C) | :760E50AC 7B46 jpo 760E50F4 :760E50AE 37 aaa * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5040(C) | :760E50AF 3530453643 xor eax, 43364530 :760E50B4 332D33384545 xor ebp, dword ptr [45453833] :760E50BA 2D31314431 sub eax, 31443131 :760E50BF 2D38354535 sub eax, 35453538 :760E50C4 2D30304330 sub eax, 30433030 :760E50C9 3446 xor al, 46 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E505A(C) | :760E50CB 43 inc ebx :760E50CC 3239 xor bh, byte ptr [ecx] :760E50CE 3545457D00 xor eax, 007D4545 * Referenced by a CALL at Address: |:760E3E3D | :760E50D3 55 push ebp :760E50D4 8BEC mov ebp, esp :760E50D6 53 push ebx :760E50D7 56 push esi :760E50D8 57 push edi :760E50D9 8BF1 mov esi, ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5065(C) | :760E50DB FF7508 push [ebp+08] :760E50DE 8D4D08 lea ecx, dword ptr [ebp+08] :760E50E1 E84B000000 call 760E5131 :760E50E6 8B4D08 mov ecx, dword ptr [ebp+08] :760E50E9 85C9 test ecx, ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E507A(C) | :760E50EB 0F84DEE00000 je 760F31CF :760E50F1 E8E7000000 call 760E51DD :760E50F6 8BF8 mov edi, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F31D1(U) | :760E50F8 85FF test edi, edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E50A6(C) | :760E50FA 0F84D6E00000 je 760F31D6 :760E5100 8B4608 mov eax, dword ptr [esi+08] :760E5103 57 push edi :760E5104 50 push eax :760E5105 8B08 mov ecx, dword ptr [eax] :760E5107 FF5130 call [ecx+30] :760E510A 8BD8 mov ebx, eax :760E510C 85DB test ebx, ebx :760E510E 0F85F8E00000 jne 760F320C :760E5114 57 push edi * Reference To: OLEAUT32.SysFreeString, Ord:0006h | :760E5115 FF1590100E76 Call dword ptr [760E1090] :760E511B 8B4D08 mov ecx, dword ptr [ebp+08] :760E511E 85C9 test ecx, ecx :760E5120 7405 je 760E5127 :760E5122 E82AEFFFFF call 760E4051 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5120(C) | :760E5127 6A01 push 00000001 :760E5129 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3255(U) | :760E512A 5F pop edi :760E512B 5E pop esi :760E512C 5B pop ebx :760E512D 5D pop ebp :760E512E C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E50E1 , :760F358B | :760E5131 56 push esi :760E5132 8BF1 mov esi, ecx :760E5134 6A0C push 0000000C * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760E5136 E844D7FFFF Call 760E287F :760E513B 85C0 test eax, eax :760E513D 59 pop ecx :760E513E 0F8416E10000 je 760F325A :760E5144 FF742408 push [esp+08] :760E5148 8BC8 mov ecx, eax :760E514A E810000000 call 760E515F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F325C(U) | :760E514F 85C0 test eax, eax :760E5151 8906 mov dword ptr [esi], eax :760E5153 0F8408E10000 je 760F3261 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F326B(U) | :760E5159 8BC6 mov eax, esi :760E515B 5E pop esi :760E515C C20400 ret 0004 * Referenced by a CALL at Address: |:760E514A | :760E515F 56 push esi :760E5160 8BF1 mov esi, ecx :760E5162 FF742408 push [esp+08] :760E5166 83660400 and dword ptr [esi+04], 00000000 :760E516A C7460801000000 mov [esi+08], 00000001 :760E5171 E810000000 call 760E5186 :760E5176 85C0 test eax, eax :760E5178 8906 mov dword ptr [esi], eax :760E517A 0F84F0E00000 je 760F3270 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3274(C), :760F3284(U) | :760E5180 8BC6 mov eax, esi :760E5182 5E pop esi :760E5183 C20400 ret 0004 * Referenced by a CALL at Address: |:760E5171 | :760E5186 55 push ebp :760E5187 8BEC mov ebp, esp :760E5189 837D0800 cmp dword ptr [ebp+08], 00000000 :760E518D 56 push esi :760E518E 57 push edi :760E518F 0F8487360100 je 760F881C :760E5195 FF7508 push [ebp+08] * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760E5198 FF1554120E76 Call dword ptr [760E1254] :760E519E 8BF0 mov esi, eax :760E51A0 46 inc esi :760E51A1 8D0436 lea eax, dword ptr [esi+esi] :760E51A4 83C003 add eax, 00000003 :760E51A7 24FC and al, FC :760E51A9 E8CAF1FFFF call 760E4378 :760E51AE 8BFC mov edi, esp :760E51B0 56 push esi :760E51B1 57 push edi :760E51B2 6AFF push FFFFFFFF :760E51B4 FF7508 push [ebp+08] :760E51B7 66832700 and word ptr [edi], 0000 :760E51BB 6A00 push 00000000 :760E51BD 6A00 push 00000000 * Reference To: KERNEL32.MultiByteToWideChar, Ord:0202h | :760E51BF FF154C120E76 Call dword ptr [760E124C] :760E51C5 85C0 test eax, eax :760E51C7 0F8456360100 je 760F8823 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8845(U) | :760E51CD 57 push edi * Reference To: OLEAUT32.SysAllocString, Ord:0002h | :760E51CE FF1584100E76 Call dword ptr [760E1084] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F881E(U) | :760E51D4 8D65F8 lea esp, dword ptr [ebp-08] :760E51D7 5F pop edi :760E51D8 5E pop esi :760E51D9 5D pop ebp :760E51DA C20400 ret 0004 * Referenced by a CALL at Address: |:760E50F1 | :760E51DD 56 push esi :760E51DE 8BF1 mov esi, ecx :760E51E0 8B06 mov eax, dword ptr [esi] :760E51E2 85C0 test eax, eax :760E51E4 0F84B5E00000 je 760F329F :760E51EA 50 push eax * Reference To: OLEAUT32.SysStringByteLen, Ord:0095h | :760E51EB FF1598100E76 Call dword ptr [760E1098] :760E51F1 50 push eax :760E51F2 FF36 push dword ptr [esi] * Reference To: OLEAUT32.SysAllocStringByteLen, Ord:0096h | :760E51F4 FF159C100E76 Call dword ptr [760E109C] :760E51FA 8BF0 mov esi, eax :760E51FC 85F6 test esi, esi :760E51FE 0F848CE00000 je 760F3290 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F329A(U) | :760E5204 8BC6 mov eax, esi :760E5206 5E pop esi :760E5207 C3 ret * Referenced by a CALL at Address: |:760E3E4C | :760E5208 55 push ebp :760E5209 8BEC mov ebp, esp :760E520B 81EC44040000 sub esp, 00000444 :760E5211 8B4108 mov eax, dword ptr [ecx+08] :760E5214 53 push ebx :760E5215 56 push esi :760E5216 57 push edi :760E5217 33FF xor edi, edi :760E5219 8D55F4 lea edx, dword ptr [ebp-0C] :760E521C 894DFC mov dword ptr [ebp-04], ecx :760E521F 897DF4 mov dword ptr [ebp-0C], edi :760E5222 897DF8 mov dword ptr [ebp-08], edi :760E5225 897DEC mov dword ptr [ebp-14], edi :760E5228 897DF0 mov dword ptr [ebp-10], edi :760E522B 8B08 mov ecx, dword ptr [eax] :760E522D 52 push edx :760E522E 50 push eax :760E522F FF511C call [ecx+1C] :760E5232 85C0 test eax, eax :760E5234 0F85E3D90000 jne 760F2C1D :760E523A 8B45F4 mov eax, dword ptr [ebp-0C] :760E523D 8D55E4 lea edx, dword ptr [ebp-1C] :760E5240 52 push edx :760E5241 50 push eax :760E5242 8B08 mov ecx, dword ptr [eax] :760E5244 FF511C call [ecx+1C] :760E5247 8BF0 mov esi, eax :760E5249 3BF7 cmp esi, edi :760E524B 0F850ADA0000 jne 760F2C5B :760E5251 8B4DFC mov ecx, dword ptr [ebp-04] :760E5254 BB00040000 mov ebx, 00000400 :760E5259 8D85BCFBFFFF lea eax, dword ptr [ebp+FFFFFBBC] :760E525F 53 push ebx :760E5260 50 push eax :760E5261 FF75E4 push [ebp-1C] :760E5264 E835EEFFFF call 760E409E :760E5269 3BC3 cmp eax, ebx :760E526B 0F8F22DA0000 jg 760F2C93 :760E5271 8D85BCFBFFFF lea eax, dword ptr [ebp+FFFFFBBC] :760E5277 50 push eax * Possible StringData Ref from Code Obj ->"PCHealthProtect" | :760E5278 68D05E0E76 push 760E5ED0 * Reference To: MSVCRT._stricmp, Ord:01BEh | :760E527D FF1534100E76 Call dword ptr [760E1034] :760E5283 59 pop ecx :760E5284 85C0 test eax, eax :760E5286 59 pop ecx :760E5287 0F853FDA0000 jne 760F2CCC :760E528D 8B45F4 mov eax, dword ptr [ebp-0C] :760E5290 8D55EC lea edx, dword ptr [ebp-14] :760E5293 52 push edx :760E5294 50 push eax :760E5295 8B08 mov ecx, dword ptr [eax] :760E5297 FF5134 call [ecx+34] :760E529A 8BF0 mov esi, eax :760E529C 3BF7 cmp esi, edi :760E529E 0F8561DA0000 jne 760F2D05 :760E52A4 8B45F4 mov eax, dword ptr [ebp-0C] :760E52A7 3BC7 cmp eax, edi :760E52A9 7409 je 760E52B4 :760E52AB 8B08 mov ecx, dword ptr [eax] :760E52AD 50 push eax :760E52AE FF5108 call [ecx+08] :760E52B1 897DF4 mov dword ptr [ebp-0C], edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E52A9(C) | :760E52B4 8B45EC mov eax, dword ptr [ebp-14] :760E52B7 8D55E0 lea edx, dword ptr [ebp-20] :760E52BA 52 push edx :760E52BB 50 push eax :760E52BC 8B08 mov ecx, dword ptr [eax] :760E52BE FF5120 call [ecx+20] :760E52C1 8BF0 mov esi, eax :760E52C3 3BF7 cmp esi, edi :760E52C5 0F8572DA0000 jne 760F2D3D :760E52CB 397DE0 cmp dword ptr [ebp-20], edi :760E52CE 897DE8 mov dword ptr [ebp-18], edi :760E52D1 0F8EFD010000 jle 760E54D4 :760E52D7 66C745CC0300 mov [ebp-34], 0003 :760E52DD E956010000 jmp 760E5438 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5468(U) | :760E52E2 8BF0 mov esi, eax :760E52E4 85F6 test esi, esi :760E52E6 0F8589DA0000 jne 760F2D75 :760E52EC 8B45F0 mov eax, dword ptr [ebp-10] :760E52EF 8D55F8 lea edx, dword ptr [ebp-08] :760E52F2 52 push edx :760E52F3 6868430E76 push 760E4368 :760E52F8 8B08 mov ecx, dword ptr [eax] :760E52FA 50 push eax :760E52FB FF11 call dword ptr [ecx] :760E52FD 8BF0 mov esi, eax :760E52FF 85F6 test esi, esi :760E5301 0F85A3DA0000 jne 760F2DAA :760E5307 8B45F8 mov eax, dword ptr [ebp-08] :760E530A 8D55E4 lea edx, dword ptr [ebp-1C] :760E530D 52 push edx :760E530E 50 push eax :760E530F 8B08 mov ecx, dword ptr [eax] :760E5311 FF511C call [ecx+1C] :760E5314 8BF0 mov esi, eax :760E5316 85F6 test esi, esi :760E5318 0F85C1DA0000 jne 760F2DDF :760E531E 8B7DFC mov edi, dword ptr [ebp-04] :760E5321 8D85BCFBFFFF lea eax, dword ptr [ebp+FFFFFBBC] :760E5327 53 push ebx :760E5328 50 push eax :760E5329 FF75E4 push [ebp-1C] :760E532C 8BCF mov ecx, edi :760E532E E86BEDFFFF call 760E409E :760E5333 3BC3 cmp eax, ebx :760E5335 0F8FDFDA0000 jg 760F2E1A * Reference To: MSVCRT._stricmp, Ord:01BEh | :760E533B 8B3534100E76 mov esi, dword ptr [760E1034] :760E5341 8D85BCFBFFFF lea eax, dword ptr [ebp+FFFFFBBC] :760E5347 50 push eax * Possible StringData Ref from Code Obj ->"DIRECTORIES" | :760E5348 68C45E0E76 push 760E5EC4 :760E534D FFD6 call esi :760E534F 59 pop ecx :760E5350 85C0 test eax, eax :760E5352 59 pop ecx :760E5353 0F8414010000 je 760E546D :760E5359 8D85BCFBFFFF lea eax, dword ptr [ebp+FFFFFBBC] :760E535F 50 push eax * Possible StringData Ref from Code Obj ->"FILES" | :760E5360 68BC5E0E76 push 760E5EBC :760E5365 FFD6 call esi :760E5367 59 pop ecx :760E5368 85C0 test eax, eax :760E536A 59 pop ecx :760E536B 0F8414010000 je 760E5485 :760E5371 8D85BCFBFFFF lea eax, dword ptr [ebp+FFFFFBBC] :760E5377 50 push eax * Possible StringData Ref from Code Obj ->"EXTENSIONS" | :760E5378 68B05E0E76 push 760E5EB0 :760E537D FFD6 call esi :760E537F 59 pop ecx :760E5380 85C0 test eax, eax :760E5382 59 pop ecx :760E5383 0F8417010000 je 760E54A0 :760E5389 8D85BCFBFFFF lea eax, dword ptr [ebp+FFFFFBBC] :760E538F 50 push eax * Possible StringData Ref from Code Obj ->"VERSION" | :760E5390 68A05E0E76 push 760E5EA0 :760E5395 FFD6 call esi :760E5397 59 pop ecx :760E5398 85C0 test eax, eax :760E539A 59 pop ecx :760E539B 0F841A010000 je 760E54BB :760E53A1 8D85BCFBFFFF lea eax, dword ptr [ebp+FFFFFBBC] :760E53A7 50 push eax * Possible StringData Ref from Code Obj ->"DEFTYPE" | :760E53A8 68A85E0E76 push 760E5EA8 :760E53AD FFD6 call esi :760E53AF 59 pop ecx :760E53B0 85C0 test eax, eax :760E53B2 59 pop ecx :760E53B3 0F85A3DB0000 jne 760F2F5C :760E53B9 8B45F8 mov eax, dword ptr [ebp-08] :760E53BC 8D55DC lea edx, dword ptr [ebp-24] :760E53BF 52 push edx :760E53C0 50 push eax :760E53C1 8B08 mov ecx, dword ptr [eax] :760E53C3 FF513C call [ecx+3C] :760E53C6 8BF0 mov esi, eax :760E53C8 85F6 test esi, esi :760E53CA 0F85F4DA0000 jne 760F2EC4 :760E53D0 8D85BCFBFFFF lea eax, dword ptr [ebp+FFFFFBBC] :760E53D6 53 push ebx :760E53D7 50 push eax :760E53D8 8BCF mov ecx, edi :760E53DA FF75DC push [ebp-24] :760E53DD E8BCECFFFF call 760E409E :760E53E2 3BC3 cmp eax, ebx :760E53E4 0F8F12DB0000 jg 760F2EFC :760E53EA 8D85BCFBFFFF lea eax, dword ptr [ebp+FFFFFBBC] :760E53F0 50 push eax :760E53F1 E842EEFFFF call 760E4238 :760E53F6 8A85BCFBFFFF mov al, byte ptr [ebp+FFFFFBBC] :760E53FC 84C0 test al, al :760E53FE 0F842ADB0000 je 760F2F2E :760E5404 884740 mov byte ptr [edi+40], al * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E5483(U), :760E549B(U), :760E54B6(U), :760E54CD(U) | :760E5407 8B45F8 mov eax, dword ptr [ebp-08] :760E540A 85C0 test eax, eax :760E540C 740A je 760E5418 :760E540E 8B08 mov ecx, dword ptr [eax] :760E5410 50 push eax :760E5411 FF5108 call [ecx+08] :760E5414 8365F800 and dword ptr [ebp-08], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E540C(C) | :760E5418 8B45F0 mov eax, dword ptr [ebp-10] :760E541B 85C0 test eax, eax :760E541D 740A je 760E5429 :760E541F 8B08 mov ecx, dword ptr [eax] :760E5421 50 push eax :760E5422 FF5108 call [ecx+08] :760E5425 8365F000 and dword ptr [ebp-10], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E541D(C) | :760E5429 FF45E8 inc [ebp-18] :760E542C 8B45E8 mov eax, dword ptr [ebp-18] :760E542F 3B45E0 cmp eax, dword ptr [ebp-20] :760E5432 0F8D9A000000 jnl 760E54D2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E52DD(U) | :760E5438 668365BC00 and word ptr [ebp-44], 0000 :760E543D 8D55F0 lea edx, dword ptr [ebp-10] :760E5440 52 push edx :760E5441 8D75BC lea esi, dword ptr [ebp-44] :760E5444 83EC10 sub esp, 00000010 :760E5447 8B45E8 mov eax, dword ptr [ebp-18] :760E544A 8BFC mov edi, esp :760E544C 83EC10 sub esp, 00000010 :760E544F A5 movsd :760E5450 A5 movsd :760E5451 A5 movsd :760E5452 A5 movsd :760E5453 8D75CC lea esi, dword ptr [ebp-34] :760E5456 8BFC mov edi, esp :760E5458 8945D4 mov dword ptr [ebp-2C], eax :760E545B 8B45EC mov eax, dword ptr [ebp-14] :760E545E A5 movsd :760E545F 8B08 mov ecx, dword ptr [eax] :760E5461 50 push eax :760E5462 A5 movsd :760E5463 A5 movsd :760E5464 A5 movsd :760E5465 FF5128 call [ecx+28] :760E5468 E975FEFFFF jmp 760E52E2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5353(C) | :760E546D 8D470C lea eax, dword ptr [edi+0C] :760E5470 8BCF mov ecx, edi :760E5472 50 push eax :760E5473 FF75F8 push [ebp-08] :760E5476 E8D0010000 call 760E564B :760E547B 85C0 test eax, eax :760E547D 0F84D0D90000 je 760F2E53 :760E5483 EB82 jmp 760E5407 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E536B(C) | :760E5485 8D4718 lea eax, dword ptr [edi+18] :760E5488 8BCF mov ecx, edi :760E548A 50 push eax :760E548B FF75F8 push [ebp-08] :760E548E E8B8010000 call 760E564B :760E5493 85C0 test eax, eax :760E5495 0F84D4D90000 je 760F2E6F :760E549B E967FFFFFF jmp 760E5407 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5383(C) | :760E54A0 8D4724 lea eax, dword ptr [edi+24] :760E54A3 8BCF mov ecx, edi :760E54A5 50 push eax :760E54A6 FF75F8 push [ebp-08] :760E54A9 E89D010000 call 760E564B :760E54AE 85C0 test eax, eax :760E54B0 0F84D5D90000 je 760F2E8B :760E54B6 E94CFFFFFF jmp 760E5407 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E539B(C) | :760E54BB FF75F8 push [ebp-08] :760E54BE 8BCF mov ecx, edi :760E54C0 E824000000 call 760E54E9 :760E54C5 85C0 test eax, eax :760E54C7 0F84C4DA0000 je 760F2F91 :760E54CD E935FFFFFF jmp 760E5407 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5432(C) | :760E54D2 33FF xor edi, edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E52D1(C) | :760E54D4 8B45EC mov eax, dword ptr [ebp-14] :760E54D7 3BC7 cmp eax, edi :760E54D9 7406 je 760E54E1 :760E54DB 8B08 mov ecx, dword ptr [eax] :760E54DD 50 push eax :760E54DE FF5108 call [ecx+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E54D9(C) | :760E54E1 6A01 push 00000001 :760E54E3 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2FD2(U) | :760E54E4 5F pop edi :760E54E5 5E pop esi :760E54E6 5B pop ebx :760E54E7 C9 leave :760E54E8 C3 ret * Referenced by a CALL at Address: |:760E54C0 | :760E54E9 55 push ebp :760E54EA 8BEC mov ebp, esp :760E54EC 81EC00050000 sub esp, 00000500 :760E54F2 8B4508 mov eax, dword ptr [ebp+08] :760E54F5 56 push esi :760E54F6 8BF1 mov esi, ecx :760E54F8 8D5508 lea edx, dword ptr [ebp+08] :760E54FB 8B08 mov ecx, dword ptr [eax] :760E54FD 57 push edi :760E54FE 52 push edx :760E54FF 50 push eax :760E5500 FF513C call [ecx+3C] :760E5503 8BF8 mov edi, eax :760E5505 85FF test edi, edi :760E5507 0F8596DD0000 jne 760F32A3 :760E550D BF00040000 mov edi, 00000400 :760E5512 8D8500FBFFFF lea eax, dword ptr [ebp+FFFFFB00] :760E5518 57 push edi :760E5519 50 push eax :760E551A FF7508 push [ebp+08] :760E551D 8BCE mov ecx, esi :760E551F E87AEBFFFF call 760E409E :760E5524 3BC7 cmp eax, edi :760E5526 0F8FA4DD0000 jg 760F32D0 :760E552C 33FF xor edi, edi :760E552E 83C630 add esi, 00000030 :760E5531 EB1D jmp 760E5550 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5566(U) | :760E5533 85C0 test eax, eax :760E5535 7431 je 760E5568 :760E5537 8D8500FFFFFF lea eax, dword ptr [ebp+FFFFFF00] :760E553D 50 push eax * Reference To: MSVCRT.atoi, Ord:023Ah | :760E553E FF1554100E76 Call dword ptr [760E1054] :760E5544 8906 mov dword ptr [esi], eax :760E5546 47 inc edi :760E5547 83C604 add esi, 00000004 :760E554A 83FF04 cmp edi, 00000004 :760E554D 59 pop ecx :760E554E 7D18 jge 760E5568 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5531(U) | :760E5550 6A2E push 0000002E :760E5552 8D8500FFFFFF lea eax, dword ptr [ebp+FFFFFF00] :760E5558 57 push edi :760E5559 50 push eax :760E555A 8D8500FBFFFF lea eax, dword ptr [ebp+FFFFFB00] :760E5560 50 push eax :760E5561 E80B000000 call 760E5571 :760E5566 EBCB jmp 760E5533 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E5535(C), :760E554E(C) | :760E5568 6A01 push 00000001 :760E556A 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3307(U) | :760E556B 5F pop edi :760E556C 5E pop esi :760E556D C9 leave :760E556E C20400 ret 0004 * Referenced by a CALL at Addresses: |:760E28CA , :760E5561 , :760F7180 | :760E5571 55 push ebp :760E5572 8BEC mov ebp, esp :760E5574 B804100000 mov eax, 00001004 :760E5579 E8FAEDFFFF call 760E4378 :760E557E 56 push esi :760E557F 57 push edi :760E5580 33FF xor edi, edi :760E5582 397D08 cmp dword ptr [ebp+08], edi :760E5585 897DFC mov dword ptr [ebp-04], edi :760E5588 0F84B4000000 je 760E5642 :760E558E 397D0C cmp dword ptr [ebp+0C], edi :760E5591 0F84AB000000 je 760E5642 :760E5597 8D85FCF7FFFF lea eax, dword ptr [ebp+FFFFF7FC] :760E559D 6800040000 push 00000400 :760E55A2 50 push eax :760E55A3 6AFF push FFFFFFFF :760E55A5 FF7508 push [ebp+08] :760E55A8 57 push edi :760E55A9 6A01 push 00000001 * Reference To: KERNEL32.MultiByteToWideChar, Ord:0202h | :760E55AB FF154C120E76 Call dword ptr [760E124C] :760E55B1 85C0 test eax, eax :760E55B3 0F847DD40000 je 760F2A36 :760E55B9 6639BDFCF7FFFF cmp word ptr [ebp+FFFFF7FC], di :760E55C0 8B7510 mov esi, dword ptr [ebp+10] :760E55C3 8D85FCF7FFFF lea eax, dword ptr [ebp+FFFFF7FC] :760E55C9 8D8DFCEFFFFF lea ecx, dword ptr [ebp+FFFFEFFC] :760E55CF 741C je 760E55ED :760E55D1 EB11 jmp 760E55E4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E55E8(U) | :760E55D3 660FB65514 movzx dx, byte ptr [ebp+14] :760E55D8 663910 cmp word ptr [eax], dx :760E55DB 740D je 760E55EA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E55EB(U) | :760E55DD 40 inc eax :760E55DE 40 inc eax :760E55DF 663938 cmp word ptr [eax], di :760E55E2 7409 je 760E55ED * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E55D1(U) | :760E55E4 3BF7 cmp esi, edi :760E55E6 7E05 jle 760E55ED :760E55E8 EBE9 jmp 760E55D3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E55DB(C) | :760E55EA 4E dec esi :760E55EB EBF0 jmp 760E55DD * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E55CF(C), :760E55E2(C), :760E55E6(C) | :760E55ED 668B30 mov si, word ptr [eax] :760E55F0 663BF7 cmp si, di :760E55F3 744D je 760E5642 :760E55F5 660FB65514 movzx dx, byte ptr [ebp+14] :760E55FA EB0F jmp 760E560B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5610(U) | :760E55FC 668931 mov word ptr [ecx], si :760E55FF 41 inc ecx :760E5600 41 inc ecx :760E5601 40 inc eax :760E5602 40 inc eax :760E5603 668B30 mov si, word ptr [eax] :760E5606 663BF7 cmp si, di :760E5609 7407 je 760E5612 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E55FA(U) | :760E560B 663BF2 cmp si, dx :760E560E 7402 je 760E5612 :760E5610 EBEA jmp 760E55FC * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E5609(C), :760E560E(C) | :760E5612 57 push edi :760E5613 57 push edi :760E5614 FF7508 push [ebp+08] :760E5617 668939 mov word ptr [ecx], di :760E561A E803ECFFFF call 760E4222 :760E561F 50 push eax :760E5620 8D85FCEFFFFF lea eax, dword ptr [ebp+FFFFEFFC] :760E5626 FF750C push [ebp+0C] :760E5629 6AFF push FFFFFFFF :760E562B 50 push eax :760E562C 57 push edi :760E562D 6A01 push 00000001 :760E562F 5E pop esi :760E5630 56 push esi * Reference To: KERNEL32.WideCharToMultiByte, Ord:0301h | :760E5631 FF1508120E76 Call dword ptr [760E1208] :760E5637 85C0 test eax, eax :760E5639 0F8444D40000 je 760F2A83 :760E563F 8975FC mov dword ptr [ebp-04], esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E5588(C), :760E5591(C), :760E55F3(C), :760F2A46(C), :760F2A65(C) |:760F2A7E(U), :760F2A93(C) | :760E5642 8B45FC mov eax, dword ptr [ebp-04] :760E5645 5F pop edi :760E5646 5E pop esi :760E5647 C9 leave :760E5648 C21000 ret 0010 * Referenced by a CALL at Addresses: |:760E5476 , :760E548E , :760E54A9 | :760E564B 55 push ebp :760E564C 8BEC mov ebp, esp :760E564E 81EC3C040000 sub esp, 0000043C :760E5654 8B4508 mov eax, dword ptr [ebp+08] :760E5657 53 push ebx :760E5658 56 push esi :760E5659 894DFC mov dword ptr [ebp-04], ecx :760E565C 8B08 mov ecx, dword ptr [eax] :760E565E 8D55F0 lea edx, dword ptr [ebp-10] :760E5661 57 push edi :760E5662 33FF xor edi, edi :760E5664 52 push edx :760E5665 50 push eax :760E5666 897DF0 mov dword ptr [ebp-10], edi :760E5669 897DF8 mov dword ptr [ebp-08], edi :760E566C 897DF4 mov dword ptr [ebp-0C], edi :760E566F FF5134 call [ecx+34] :760E5672 85C0 test eax, eax :760E5674 0F855DD90000 jne 760F2FD7 :760E567A 8B45F0 mov eax, dword ptr [ebp-10] :760E567D 8D55E8 lea edx, dword ptr [ebp-18] :760E5680 52 push edx :760E5681 50 push eax :760E5682 8B08 mov ecx, dword ptr [eax] :760E5684 FF5120 call [ecx+20] :760E5687 8BF0 mov esi, eax :760E5689 3BF7 cmp esi, edi :760E568B 0F8589D90000 jne 760F301A :760E5691 397DE8 cmp dword ptr [ebp-18], edi :760E5694 897DEC mov dword ptr [ebp-14], edi :760E5697 0F8E82010000 jle 760E581F * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E569D 8B1D80110E76 mov ebx, dword ptr [760E1180] :760E56A3 66C745D40300 mov [ebp-2C], 0003 :760E56A9 E9C8000000 jmp 760E5776 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E57A6(U) | :760E56AE 8BF0 mov esi, eax :760E56B0 85F6 test esi, esi :760E56B2 0F85DDD90000 jne 760F3095 :760E56B8 8B45F4 mov eax, dword ptr [ebp-0C] :760E56BB 8D55F8 lea edx, dword ptr [ebp-08] :760E56BE 52 push edx :760E56BF 6868430E76 push 760E4368 :760E56C4 8B08 mov ecx, dword ptr [eax] :760E56C6 50 push eax :760E56C7 FF11 call dword ptr [ecx] :760E56C9 8BF0 mov esi, eax :760E56CB 85F6 test esi, esi :760E56CD 0F85F6D90000 jne 760F30C9 :760E56D3 8B45F4 mov eax, dword ptr [ebp-0C] :760E56D6 85C0 test eax, eax :760E56D8 7409 je 760E56E3 :760E56DA 8B08 mov ecx, dword ptr [eax] :760E56DC 50 push eax :760E56DD FF5108 call [ecx+08] :760E56E0 2175F4 and dword ptr [ebp-0C], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E56D8(C) | :760E56E3 8B45F8 mov eax, dword ptr [ebp-08] :760E56E6 8D55E4 lea edx, dword ptr [ebp-1C] :760E56E9 52 push edx :760E56EA 50 push eax :760E56EB 8B08 mov ecx, dword ptr [eax] :760E56ED FF511C call [ecx+1C] :760E56F0 85C0 test eax, eax :760E56F2 894508 mov dword ptr [ebp+08], eax :760E56F5 0F8557D90000 jne 760F3052 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F305A(C) | * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadOneCollection" | :760E56FB BFF05E0E76 mov edi, 760E5EF0 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760E5700 BE44DA0F76 mov esi, 760FDA44 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3077(C), :760F3090(U) | :760E5705 8B4DFC mov ecx, dword ptr [ebp-04] :760E5708 8D85C4FBFFFF lea eax, dword ptr [ebp+FFFFFBC4] :760E570E 6800040000 push 00000400 :760E5713 50 push eax :760E5714 FF75E4 push [ebp-1C] :760E5717 E882E9FFFF call 760E409E :760E571C 3D00040000 cmp eax, 00000400 :760E5721 0F8FD6D90000 jg 760F30FD :760E5727 8D85C4FBFFFF lea eax, dword ptr [ebp+FFFFFBC4] :760E572D 50 push eax * Possible StringData Ref from Code Obj ->"INCLUDE" | :760E572E 68E85E0E76 push 760E5EE8 * Reference To: MSVCRT._stricmp, Ord:01BEh | :760E5733 FF1534100E76 Call dword ptr [760E1034] :760E5739 59 pop ecx :760E573A 85C0 test eax, eax :760E573C 59 pop ecx :760E573D 756C jne 760E57AB :760E573F 8B45F8 mov eax, dword ptr [ebp-08] :760E5742 FF750C push [ebp+0C] :760E5745 8B08 mov ecx, dword ptr [eax] :760E5747 50 push eax :760E5748 FF5134 call [ecx+34] :760E574B 85C0 test eax, eax :760E574D 894508 mov dword ptr [ebp+08], eax :760E5750 0F85CDD90000 jne 760F3123 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E57DE(U), :760E581A(U) | :760E5756 8B45F8 mov eax, dword ptr [ebp-08] :760E5759 85C0 test eax, eax :760E575B 740A je 760E5767 :760E575D 8B08 mov ecx, dword ptr [eax] :760E575F 50 push eax :760E5760 FF5108 call [ecx+08] :760E5763 8365F800 and dword ptr [ebp-08], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E575B(C) | :760E5767 FF45EC inc [ebp-14] :760E576A 8B45EC mov eax, dword ptr [ebp-14] :760E576D 3B45E8 cmp eax, dword ptr [ebp-18] :760E5770 0F8DA9000000 jnl 760E581F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E56A9(U) | :760E5776 668365C400 and word ptr [ebp-3C], 0000 :760E577B 8D55F4 lea edx, dword ptr [ebp-0C] :760E577E 52 push edx :760E577F 8D75C4 lea esi, dword ptr [ebp-3C] :760E5782 83EC10 sub esp, 00000010 :760E5785 8B45EC mov eax, dword ptr [ebp-14] :760E5788 8BFC mov edi, esp :760E578A 83EC10 sub esp, 00000010 :760E578D A5 movsd :760E578E A5 movsd :760E578F A5 movsd :760E5790 A5 movsd :760E5791 8D75D4 lea esi, dword ptr [ebp-2C] :760E5794 8BFC mov edi, esp :760E5796 8945DC mov dword ptr [ebp-24], eax :760E5799 8B45F0 mov eax, dword ptr [ebp-10] :760E579C A5 movsd :760E579D 8B08 mov ecx, dword ptr [eax] :760E579F 50 push eax :760E57A0 A5 movsd :760E57A1 A5 movsd :760E57A2 A5 movsd :760E57A3 FF5128 call [ecx+28] :760E57A6 E903FFFFFF jmp 760E56AE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E573D(C) | :760E57AB 8D85C4FBFFFF lea eax, dword ptr [ebp+FFFFFBC4] :760E57B1 50 push eax * Possible StringData Ref from Code Obj ->"EXCLUDE" | :760E57B2 68E05E0E76 push 760E5EE0 * Reference To: MSVCRT._stricmp, Ord:01BEh | :760E57B7 FF1534100E76 Call dword ptr [760E1034] :760E57BD 59 pop ecx :760E57BE 85C0 test eax, eax :760E57C0 59 pop ecx :760E57C1 7520 jne 760E57E3 :760E57C3 8B550C mov edx, dword ptr [ebp+0C] :760E57C6 8B45F8 mov eax, dword ptr [ebp-08] :760E57C9 83C204 add edx, 00000004 :760E57CC 8B08 mov ecx, dword ptr [eax] :760E57CE 52 push edx :760E57CF 50 push eax :760E57D0 FF5134 call [ecx+34] :760E57D3 85C0 test eax, eax :760E57D5 894508 mov dword ptr [ebp+08], eax :760E57D8 0F8559D90000 jne 760F3137 :760E57DE E973FFFFFF jmp 760E5756 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E57C1(C) | :760E57E3 8D85C4FBFFFF lea eax, dword ptr [ebp+FFFFFBC4] :760E57E9 50 push eax * Possible StringData Ref from Code Obj ->"SFP" | :760E57EA 6864430E76 push 760E4364 * Reference To: MSVCRT._stricmp, Ord:01BEh | :760E57EF FF1534100E76 Call dword ptr [760E1034] :760E57F5 59 pop ecx :760E57F6 85C0 test eax, eax :760E57F8 59 pop ecx :760E57F9 0F856FD90000 jne 760F316E :760E57FF 8B550C mov edx, dword ptr [ebp+0C] :760E5802 8B45F8 mov eax, dword ptr [ebp-08] :760E5805 83C208 add edx, 00000008 :760E5808 8B08 mov ecx, dword ptr [eax] :760E580A 52 push edx :760E580B 50 push eax :760E580C FF5134 call [ecx+34] :760E580F 85C0 test eax, eax :760E5811 894508 mov dword ptr [ebp+08], eax :760E5814 0F8531D90000 jne 760F314B :760E581A E937FFFFFF jmp 760E5756 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E5697(C), :760E5770(C) | :760E581F 8B45F0 mov eax, dword ptr [ebp-10] :760E5822 85C0 test eax, eax :760E5824 7406 je 760E582C :760E5826 8B08 mov ecx, dword ptr [eax] :760E5828 50 push eax :760E5829 FF5108 call [ecx+08] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E5824(C), :760F2FDF(C), :760F2FFE(C), :760F3015(U) | :760E582C 6A01 push 00000001 :760E582E 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F31CA(U) | :760E582F 5F pop edi :760E5830 5E pop esi :760E5831 5B pop ebx :760E5832 C9 leave :760E5833 C20800 ret 0008 * Referenced by a CALL at Address: |:760E3E5B | :760E5836 81EC18080000 sub esp, 00000818 :760E583C 53 push ebx :760E583D 55 push ebp :760E583E 56 push esi :760E583F BE00040000 mov esi, 00000400 :760E5844 57 push edi :760E5845 8D442428 lea eax, dword ptr [esp+28] :760E5849 8BD9 mov ebx, ecx :760E584B 33ED xor ebp, ebp :760E584D 56 push esi :760E584E 50 push eax :760E584F 895C241C mov dword ptr [esp+1C], ebx :760E5853 896C2420 mov dword ptr [esp+20], ebp :760E5857 896C242C mov dword ptr [esp+2C], ebp :760E585B 896C2424 mov dword ptr [esp+24], ebp * Reference To: KERNEL32.GetWindowsDirectoryA, Ord:0197h | :760E585F FF15B4110E76 Call dword ptr [760E11B4] :760E5865 3BC6 cmp eax, esi :760E5867 0F87FFDD0000 ja 760F366C :760E586D 8D442428 lea eax, dword ptr [esp+28] :760E5871 50 push eax :760E5872 E8C3EAFFFF call 760E433A * Reference To: KERNEL32.SetEnvironmentVariableA, Ord:028Dh | :760E5877 8B3D9C110E76 mov edi, dword ptr [760E119C] :760E587D 8D442428 lea eax, dword ptr [esp+28] :760E5881 50 push eax * Possible StringData Ref from Code Obj ->"WinDir" | :760E5882 6818610E76 push 760E6118 :760E5887 FFD7 call edi :760E5889 8D442428 lea eax, dword ptr [esp+28] :760E588D 56 push esi :760E588E 50 push eax * Reference To: KERNEL32.GetSystemDirectoryA, Ord:0170h | :760E588F FF15A8110E76 Call dword ptr [760E11A8] :760E5895 3BC6 cmp eax, esi :760E5897 0F87EBDD0000 ja 760F3688 :760E589D 8D442428 lea eax, dword ptr [esp+28] :760E58A1 50 push eax :760E58A2 E893EAFFFF call 760E433A :760E58A7 8D442428 lea eax, dword ptr [esp+28] :760E58AB 50 push eax * Possible StringData Ref from Code Obj ->"WinSys" | :760E58AC 6810610E76 push 760E6110 :760E58B1 FFD7 call edi * Reference To: SHELL32.SHGetSpecialFolderPathA, Ord:0062h | :760E58B3 8B35D8120E76 mov esi, dword ptr [760E12D8] :760E58B9 6A00 push 00000000 :760E58BB 8D44242C lea eax, dword ptr [esp+2C] :760E58BF 6A1D push 0000001D :760E58C1 50 push eax :760E58C2 6A00 push 00000000 :760E58C4 FFD6 call esi * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760E58C6 8B2D80110E76 mov ebp, dword ptr [760E1180] :760E58CC 83F801 cmp eax, 00000001 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760E58CF BB44DA0F76 mov ebx, 760FDA44 :760E58D4 7438 je 760E590E * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760E58D6 FF15A0110E76 Call dword ptr [760E11A0] :760E58DC 89442410 mov dword ptr [esp+10], eax :760E58E0 A184110E76 mov eax, dword ptr [760E1184] :760E58E5 F60002 test byte ptr [eax], 02 :760E58E8 0F85D3DD0000 jne 760F36C1 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F36D2(C), :760F36ED(U) | :760E58EE 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"C:\Unknown_" | :760E58F2 6804610E76 push 760E6104 :760E58F7 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760E58F8 FF1504120E76 Call dword ptr [760E1204] :760E58FE 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"AltStartUp" | :760E5902 68F8600E76 push 760E60F8 :760E5907 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760E5908 FF1598110E76 Call dword ptr [760E1198] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E58D4(C) | :760E590E 8D442428 lea eax, dword ptr [esp+28] :760E5912 50 push eax :760E5913 E822EAFFFF call 760E433A :760E5918 8D442428 lea eax, dword ptr [esp+28] :760E591C 50 push eax * Possible StringData Ref from Code Obj ->"AltStartup" | :760E591D 68EC600E76 push 760E60EC :760E5922 FFD7 call edi :760E5924 6A00 push 00000000 :760E5926 8D44242C lea eax, dword ptr [esp+2C] :760E592A 6A1A push 0000001A :760E592C 50 push eax :760E592D 6A00 push 00000000 :760E592F FFD6 call esi :760E5931 83F801 cmp eax, 00000001 :760E5934 0F85B8DD0000 jne 760F36F2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F374E(U) | :760E593A 8D442428 lea eax, dword ptr [esp+28] :760E593E 50 push eax :760E593F E8F6E9FFFF call 760E433A :760E5944 8D442428 lea eax, dword ptr [esp+28] :760E5948 50 push eax * Possible StringData Ref from Code Obj ->"AppData" | :760E5949 68E4600E76 push 760E60E4 :760E594E FFD7 call edi :760E5950 6A00 push 00000000 :760E5952 8D44242C lea eax, dword ptr [esp+2C] :760E5956 6A0A push 0000000A :760E5958 50 push eax :760E5959 6A00 push 00000000 :760E595B FFD6 call esi :760E595D 83F801 cmp eax, 00000001 :760E5960 7438 je 760E599A * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760E5962 FF15A0110E76 Call dword ptr [760E11A0] :760E5968 89442410 mov dword ptr [esp+10], eax :760E596C A184110E76 mov eax, dword ptr [760E1184] :760E5971 F60002 test byte ptr [eax], 02 :760E5974 0F85D9DD0000 jne 760F3753 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3764(C), :760F377F(U) | :760E597A 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"C:\Unknown_" | :760E597E 6804610E76 push 760E6104 :760E5983 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760E5984 FF1504120E76 Call dword ptr [760E1204] :760E598A 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"RecycleBin" | :760E598E 68D8600E76 push 760E60D8 :760E5993 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760E5994 FF1598110E76 Call dword ptr [760E1198] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5960(C) | :760E599A 8D442428 lea eax, dword ptr [esp+28] :760E599E 50 push eax :760E599F E896E9FFFF call 760E433A :760E59A4 8D442428 lea eax, dword ptr [esp+28] :760E59A8 50 push eax * Possible StringData Ref from Code Obj ->"RecycleBin" | :760E59A9 68D8600E76 push 760E60D8 :760E59AE FFD7 call edi :760E59B0 6A00 push 00000000 :760E59B2 8D44242C lea eax, dword ptr [esp+2C] :760E59B6 6A19 push 00000019 :760E59B8 50 push eax :760E59B9 6A00 push 00000000 :760E59BB FFD6 call esi :760E59BD 83F801 cmp eax, 00000001 :760E59C0 0F85BEDD0000 jne 760F3784 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F37E0(U) | :760E59C6 8D442428 lea eax, dword ptr [esp+28] :760E59CA 50 push eax :760E59CB E86AE9FFFF call 760E433A :760E59D0 8D442428 lea eax, dword ptr [esp+28] :760E59D4 50 push eax * Possible StringData Ref from Code Obj ->"CommonDesktop" | :760E59D5 68C8600E76 push 760E60C8 :760E59DA FFD7 call edi :760E59DC 6A00 push 00000000 :760E59DE 8D44242C lea eax, dword ptr [esp+2C] :760E59E2 6A1F push 0000001F :760E59E4 50 push eax :760E59E5 6A00 push 00000000 :760E59E7 FFD6 call esi :760E59E9 83F801 cmp eax, 00000001 :760E59EC 7438 je 760E5A26 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760E59EE FF15A0110E76 Call dword ptr [760E11A0] :760E59F4 89442410 mov dword ptr [esp+10], eax :760E59F8 A184110E76 mov eax, dword ptr [760E1184] :760E59FD F60002 test byte ptr [eax], 02 :760E5A00 0F85DFDD0000 jne 760F37E5 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F37F6(C), :760F3811(U) | :760E5A06 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"C:\Unknown_" | :760E5A0A 6804610E76 push 760E6104 :760E5A0F 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760E5A10 FF1504120E76 Call dword ptr [760E1204] :760E5A16 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"CommonFavorites" | :760E5A1A 68B8600E76 push 760E60B8 :760E5A1F 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760E5A20 FF1598110E76 Call dword ptr [760E1198] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E59EC(C) | :760E5A26 8D442428 lea eax, dword ptr [esp+28] :760E5A2A 50 push eax :760E5A2B E80AE9FFFF call 760E433A :760E5A30 8D442428 lea eax, dword ptr [esp+28] :760E5A34 50 push eax * Possible StringData Ref from Code Obj ->"CommonFavorites" | :760E5A35 68B8600E76 push 760E60B8 :760E5A3A FFD7 call edi :760E5A3C 6A00 push 00000000 :760E5A3E 8D44242C lea eax, dword ptr [esp+2C] :760E5A42 6A17 push 00000017 :760E5A44 50 push eax :760E5A45 6A00 push 00000000 :760E5A47 FFD6 call esi :760E5A49 83F801 cmp eax, 00000001 :760E5A4C 7438 je 760E5A86 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760E5A4E FF15A0110E76 Call dword ptr [760E11A0] :760E5A54 89442410 mov dword ptr [esp+10], eax :760E5A58 A184110E76 mov eax, dword ptr [760E1184] :760E5A5D F60002 test byte ptr [eax], 02 :760E5A60 0F85B0DD0000 jne 760F3816 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3827(C), :760F3842(U) | :760E5A66 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"C:\Unknown_" | :760E5A6A 6804610E76 push 760E6104 :760E5A6F 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760E5A70 FF1504120E76 Call dword ptr [760E1204] :760E5A76 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"CommonProgramGroups" | :760E5A7A 68A4600E76 push 760E60A4 :760E5A7F 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760E5A80 FF1598110E76 Call dword ptr [760E1198] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5A4C(C) | :760E5A86 8D442428 lea eax, dword ptr [esp+28] :760E5A8A 50 push eax :760E5A8B E8AAE8FFFF call 760E433A :760E5A90 8D442428 lea eax, dword ptr [esp+28] :760E5A94 50 push eax * Possible StringData Ref from Code Obj ->"CommonProgramGroups" | :760E5A95 68A4600E76 push 760E60A4 :760E5A9A FFD7 call edi :760E5A9C 6A00 push 00000000 :760E5A9E 8D44242C lea eax, dword ptr [esp+2C] :760E5AA2 6A16 push 00000016 :760E5AA4 50 push eax :760E5AA5 6A00 push 00000000 :760E5AA7 FFD6 call esi :760E5AA9 83F801 cmp eax, 00000001 :760E5AAC 7438 je 760E5AE6 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760E5AAE FF15A0110E76 Call dword ptr [760E11A0] :760E5AB4 89442410 mov dword ptr [esp+10], eax :760E5AB8 A184110E76 mov eax, dword ptr [760E1184] :760E5ABD F60002 test byte ptr [eax], 02 :760E5AC0 0F8581DD0000 jne 760F3847 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3858(C), :760F3873(U) | :760E5AC6 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"C:\Unknown_" | :760E5ACA 6804610E76 push 760E6104 :760E5ACF 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760E5AD0 FF1504120E76 Call dword ptr [760E1204] :760E5AD6 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"CommonStartMenu" | :760E5ADA 6894600E76 push 760E6094 :760E5ADF 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760E5AE0 FF1598110E76 Call dword ptr [760E1198] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5AAC(C) | :760E5AE6 8D442428 lea eax, dword ptr [esp+28] :760E5AEA 50 push eax :760E5AEB E84AE8FFFF call 760E433A :760E5AF0 8D442428 lea eax, dword ptr [esp+28] :760E5AF4 50 push eax * Possible StringData Ref from Code Obj ->"CommonStartMenu" | :760E5AF5 6894600E76 push 760E6094 :760E5AFA FFD7 call edi :760E5AFC 6A00 push 00000000 :760E5AFE 8D44242C lea eax, dword ptr [esp+2C] :760E5B02 6A18 push 00000018 :760E5B04 50 push eax :760E5B05 6A00 push 00000000 :760E5B07 FFD6 call esi :760E5B09 83F801 cmp eax, 00000001 :760E5B0C 0F8566DD0000 jne 760F3878 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F38D4(U) | :760E5B12 8D442428 lea eax, dword ptr [esp+28] :760E5B16 50 push eax :760E5B17 E81EE8FFFF call 760E433A :760E5B1C 8D442428 lea eax, dword ptr [esp+28] :760E5B20 50 push eax * Possible StringData Ref from Code Obj ->"CommonStartUp" | :760E5B21 6884600E76 push 760E6084 :760E5B26 FFD7 call edi :760E5B28 6A00 push 00000000 :760E5B2A 8D44242C lea eax, dword ptr [esp+2C] :760E5B2E 6A21 push 00000021 :760E5B30 50 push eax :760E5B31 6A00 push 00000000 :760E5B33 FFD6 call esi :760E5B35 83F801 cmp eax, 00000001 :760E5B38 0F859BDD0000 jne 760F38D9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3935(U) | :760E5B3E 8D442428 lea eax, dword ptr [esp+28] :760E5B42 50 push eax :760E5B43 E8F2E7FFFF call 760E433A :760E5B48 8D442428 lea eax, dword ptr [esp+28] :760E5B4C 50 push eax * Possible StringData Ref from Code Obj ->"Cookies" | :760E5B4D 687C600E76 push 760E607C :760E5B52 FFD7 call edi :760E5B54 6A00 push 00000000 :760E5B56 8D44242C lea eax, dword ptr [esp+2C] :760E5B5A 6A10 push 00000010 :760E5B5C 50 push eax :760E5B5D 6A00 push 00000000 :760E5B5F FFD6 call esi :760E5B61 83F801 cmp eax, 00000001 :760E5B64 0F85D0DD0000 jne 760F393A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3996(U) | :760E5B6A 8D442428 lea eax, dword ptr [esp+28] :760E5B6E 50 push eax :760E5B6F E8C6E7FFFF call 760E433A :760E5B74 8D442428 lea eax, dword ptr [esp+28] :760E5B78 50 push eax * Possible StringData Ref from Code Obj ->"DesktopDirectory" | :760E5B79 6868600E76 push 760E6068 :760E5B7E FFD7 call edi :760E5B80 6A00 push 00000000 :760E5B82 8D44242C lea eax, dword ptr [esp+2C] :760E5B86 6A06 push 00000006 :760E5B88 50 push eax :760E5B89 6A00 push 00000000 :760E5B8B FFD6 call esi :760E5B8D 83F801 cmp eax, 00000001 :760E5B90 0F8505DE0000 jne 760F399B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F39F7(U) | :760E5B96 8D442428 lea eax, dword ptr [esp+28] :760E5B9A 50 push eax :760E5B9B E89AE7FFFF call 760E433A :760E5BA0 8D442428 lea eax, dword ptr [esp+28] :760E5BA4 50 push eax * Possible StringData Ref from Code Obj ->"Favorites" | :760E5BA5 685C600E76 push 760E605C :760E5BAA FFD7 call edi :760E5BAC 6A00 push 00000000 :760E5BAE 8D44242C lea eax, dword ptr [esp+2C] :760E5BB2 6A20 push 00000020 :760E5BB4 50 push eax :760E5BB5 6A00 push 00000000 :760E5BB7 FFD6 call esi :760E5BB9 83F801 cmp eax, 00000001 :760E5BBC 0F853ADE0000 jne 760F39FC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3A58(U) | :760E5BC2 8D442428 lea eax, dword ptr [esp+28] :760E5BC6 50 push eax :760E5BC7 E86EE7FFFF call 760E433A :760E5BCC 8D442428 lea eax, dword ptr [esp+28] :760E5BD0 50 push eax * Possible StringData Ref from Code Obj ->"InternetCache" | :760E5BD1 684C600E76 push 760E604C :760E5BD6 FFD7 call edi :760E5BD8 6A00 push 00000000 :760E5BDA 8D44242C lea eax, dword ptr [esp+2C] :760E5BDE 6A13 push 00000013 :760E5BE0 50 push eax :760E5BE1 6A00 push 00000000 :760E5BE3 FFD6 call esi :760E5BE5 83F801 cmp eax, 00000001 :760E5BE8 0F856FDE0000 jne 760F3A5D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3AB9(U) | :760E5BEE 8D442428 lea eax, dword ptr [esp+28] :760E5BF2 50 push eax :760E5BF3 E842E7FFFF call 760E433A :760E5BF8 8D442428 lea eax, dword ptr [esp+28] :760E5BFC 50 push eax * Possible StringData Ref from Code Obj ->"NetHood" | :760E5BFD 6844600E76 push 760E6044 :760E5C02 FFD7 call edi :760E5C04 6A00 push 00000000 :760E5C06 8D44242C lea eax, dword ptr [esp+2C] :760E5C0A 6A05 push 00000005 :760E5C0C 50 push eax :760E5C0D 6A00 push 00000000 :760E5C0F FFD6 call esi :760E5C11 83F801 cmp eax, 00000001 :760E5C14 0F85A4DE0000 jne 760F3ABE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3B1A(U) | :760E5C1A 8D442428 lea eax, dword ptr [esp+28] :760E5C1E 50 push eax :760E5C1F E816E7FFFF call 760E433A :760E5C24 8D442428 lea eax, dword ptr [esp+28] :760E5C28 50 push eax * Possible StringData Ref from Code Obj ->"PersonalDocuments" | :760E5C29 6830600E76 push 760E6030 :760E5C2E FFD7 call edi :760E5C30 6A00 push 00000000 :760E5C32 8D44242C lea eax, dword ptr [esp+2C] :760E5C36 6A0B push 0000000B :760E5C38 50 push eax :760E5C39 6A00 push 00000000 :760E5C3B FFD6 call esi :760E5C3D 83F801 cmp eax, 00000001 :760E5C40 0F85D9DE0000 jne 760F3B1F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3B7B(U) | :760E5C46 8D442428 lea eax, dword ptr [esp+28] :760E5C4A 50 push eax :760E5C4B E8EAE6FFFF call 760E433A :760E5C50 8D442428 lea eax, dword ptr [esp+28] :760E5C54 50 push eax * Possible StringData Ref from Code Obj ->"StartMenu" | :760E5C55 6824600E76 push 760E6024 :760E5C5A FFD7 call edi :760E5C5C 6A00 push 00000000 :760E5C5E 8D44242C lea eax, dword ptr [esp+2C] :760E5C62 6A15 push 00000015 :760E5C64 50 push eax :760E5C65 6A00 push 00000000 :760E5C67 FFD6 call esi :760E5C69 83F801 cmp eax, 00000001 :760E5C6C 0F850EDF0000 jne 760F3B80 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3BDC(U) | :760E5C72 8D442428 lea eax, dword ptr [esp+28] :760E5C76 50 push eax :760E5C77 E8BEE6FFFF call 760E433A :760E5C7C 8D442428 lea eax, dword ptr [esp+28] :760E5C80 50 push eax * Possible StringData Ref from Code Obj ->"Templates" | :760E5C81 6818600E76 push 760E6018 :760E5C86 FFD7 call edi :760E5C88 6A00 push 00000000 :760E5C8A 8D44242C lea eax, dword ptr [esp+2C] :760E5C8E 6A22 push 00000022 :760E5C90 50 push eax :760E5C91 6A00 push 00000000 :760E5C93 FFD6 call esi :760E5C95 83F801 cmp eax, 00000001 :760E5C98 0F8543DF0000 jne 760F3BE1 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760E5C9E BE20610E76 mov esi, 760E6120 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3C45(U) | :760E5CA3 8D442428 lea eax, dword ptr [esp+28] :760E5CA7 50 push eax :760E5CA8 E88DE6FFFF call 760E433A :760E5CAD 8D442428 lea eax, dword ptr [esp+28] :760E5CB1 50 push eax * Possible StringData Ref from Code Obj ->"History" | :760E5CB2 6810600E76 push 760E6010 :760E5CB7 FFD7 call edi :760E5CB9 8D442418 lea eax, dword ptr [esp+18] :760E5CBD 50 push eax * Possible StringData Ref from Code Obj ->"Software\Microsoft\Windows\CurrentVersion" | :760E5CBE 68E45F0E76 push 760E5FE4 :760E5CC3 6802000080 push 80000002 * Reference To: ADVAPI32.RegOpenKeyA, Ord:019Ch | :760E5CC8 FF15B8120E76 Call dword ptr [760E12B8] :760E5CCE 85C0 test eax, eax :760E5CD0 0F8574DF0000 jne 760F3C4A :760E5CD6 8D442420 lea eax, dword ptr [esp+20] :760E5CDA C744242000040000 mov [esp+20], 00000400 :760E5CE2 50 push eax :760E5CE3 8D44242C lea eax, dword ptr [esp+2C] :760E5CE7 50 push eax :760E5CE8 6A00 push 00000000 :760E5CEA 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"ProgramFilesDir" | :760E5CEC 68D45F0E76 push 760E5FD4 :760E5CF1 FF74242C push [esp+2C] * Reference To: ADVAPI32.RegQueryValueExA, Ord:01A7h | :760E5CF5 FF15B4120E76 Call dword ptr [760E12B4] :760E5CFB 85C0 test eax, eax :760E5CFD 0F858FDF0000 jne 760F3C92 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3CDE(U) | :760E5D03 8D442428 lea eax, dword ptr [esp+28] :760E5D07 50 push eax :760E5D08 E82DE6FFFF call 760E433A :760E5D0D 8D442428 lea eax, dword ptr [esp+28] :760E5D11 50 push eax * Possible StringData Ref from Code Obj ->"ProgramFiles" | :760E5D12 68C45F0E76 push 760E5FC4 :760E5D17 FFD7 call edi :760E5D19 8D442420 lea eax, dword ptr [esp+20] :760E5D1D C744242000040000 mov [esp+20], 00000400 :760E5D25 50 push eax :760E5D26 8D44242C lea eax, dword ptr [esp+2C] :760E5D2A 50 push eax :760E5D2B 6A00 push 00000000 :760E5D2D 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"CommonFilesDir" | :760E5D2F 68B45F0E76 push 760E5FB4 :760E5D34 FF74242C push [esp+2C] * Reference To: ADVAPI32.RegQueryValueExA, Ord:01A7h | :760E5D38 FF15B4120E76 Call dword ptr [760E12B4] :760E5D3E 85C0 test eax, eax :760E5D40 0F859DDF0000 jne 760F3CE3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3D2F(U) | :760E5D46 8D442428 lea eax, dword ptr [esp+28] :760E5D4A 50 push eax :760E5D4B E8EAE5FFFF call 760E433A :760E5D50 8D442428 lea eax, dword ptr [esp+28] :760E5D54 50 push eax * Possible StringData Ref from Code Obj ->"CommonFiles" | :760E5D55 68A85F0E76 push 760E5FA8 :760E5D5A FFD7 call edi :760E5D5C 8D442424 lea eax, dword ptr [esp+24] :760E5D60 50 push eax :760E5D61 6A01 push 00000001 :760E5D63 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"App Paths\ICWCONN1.EXE" | :760E5D65 68905F0E76 push 760E5F90 :760E5D6A FF742428 push [esp+28] * Reference To: ADVAPI32.RegOpenKeyExA, Ord:019Dh | :760E5D6E FF15C0120E76 Call dword ptr [760E12C0] :760E5D74 85C0 test eax, eax :760E5D76 0F85EEDF0000 jne 760F3D6A :760E5D7C 8D442420 lea eax, dword ptr [esp+20] :760E5D80 C744242000040000 mov [esp+20], 00000400 :760E5D88 50 push eax :760E5D89 8D44242C lea eax, dword ptr [esp+2C] :760E5D8D 50 push eax :760E5D8E 6A00 push 00000000 :760E5D90 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Path" | :760E5D92 68885F0E76 push 760E5F88 :760E5D97 FF742438 push [esp+38] * Reference To: ADVAPI32.RegQueryValueExA, Ord:01A7h | :760E5D9B FF15B4120E76 Call dword ptr [760E12B4] :760E5DA1 85C0 test eax, eax :760E5DA3 0F85C1DF0000 jne 760F3D6A :760E5DA9 8D442428 lea eax, dword ptr [esp+28] :760E5DAD 50 push eax * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760E5DAE FF1554120E76 Call dword ptr [760E1254] :760E5DB4 85C0 test eax, eax :760E5DB6 89442420 mov dword ptr [esp+20], eax :760E5DBA 760E jbe 760E5DCA :760E5DBC 807C04273B cmp byte ptr [esp+eax+27], 3B :760E5DC1 8D440427 lea eax, dword ptr [esp+eax+27] :760E5DC5 7503 jne 760E5DCA :760E5DC7 802000 and byte ptr [eax], 00 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E5DBA(C), :760E5DC5(C) | :760E5DCA 8D842428040000 lea eax, dword ptr [esp+00000428] :760E5DD1 6800040000 push 00000400 :760E5DD6 50 push eax :760E5DD7 8D442430 lea eax, dword ptr [esp+30] :760E5DDB 50 push eax * Reference To: KERNEL32.GetLongPathNameA, Ord:0135h | :760E5DDC FF15E8110E76 Call dword ptr [760E11E8] :760E5DE2 3D00040000 cmp eax, 00000400 :760E5DE7 0F8347DF0000 jnb 760F3D34 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3D90(U) | :760E5DED 8D842428040000 lea eax, dword ptr [esp+00000428] :760E5DF4 50 push eax * Possible StringData Ref from Code Obj ->"ConnectionWizard" | :760E5DF5 68745F0E76 push 760E5F74 :760E5DFA FFD7 call edi :760E5DFC A184110E76 mov eax, dword ptr [760E1184] :760E5E01 F60004 test byte ptr [eax], 04 :760E5E04 0F858BDF0000 jne 760F3D95 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3DA2(C), :760F3DC1(U) | :760E5E0A 837C242400 cmp dword ptr [esp+24], 00000000 :760E5E0F 740A je 760E5E1B :760E5E11 FF742424 push [esp+24] * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760E5E15 FF15B0120E76 Call dword ptr [760E12B0] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5E0F(C) | :760E5E1B FF742418 push [esp+18] * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760E5E1F FF15B0120E76 Call dword ptr [760E12B0] :760E5E25 8364241800 and dword ptr [esp+18], 00000000 :760E5E2A 8D44241C lea eax, dword ptr [esp+1C] :760E5E2E 50 push eax :760E5E2F E873E5FFFF call 760E43A7 :760E5E34 83F801 cmp eax, 00000001 :760E5E37 0F8589DF0000 jne 760F3DC6 :760E5E3D FF74241C push [esp+1C] * Possible StringData Ref from Code Obj ->"SRDataStoreRoot" | :760E5E41 68645F0E76 push 760E5F64 :760E5E46 FFD7 call edi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3DCE(C), :760F3DE1(C), :760F3DFA(U) | :760E5E48 8D44241C lea eax, dword ptr [esp+1C] :760E5E4C 50 push eax :760E5E4D E85AEAFFFF call 760E48AC :760E5E52 83F801 cmp eax, 00000001 :760E5E55 0F85A4DF0000 jne 760F3DFF :760E5E5B FF74241C push [esp+1C] * Possible StringData Ref from Code Obj ->"SRArchiveDir" | :760E5E5F 68545F0E76 push 760E5F54 :760E5E64 FFD7 call edi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3E07(C), :760F3E1A(C), :760F3E33(U) | :760E5E66 8D44241C lea eax, dword ptr [esp+1C] :760E5E6A 50 push eax :760E5E6B E80EEBFFFF call 760E497E :760E5E70 83F801 cmp eax, 00000001 :760E5E73 0F85BFDF0000 jne 760F3E38 :760E5E79 FF74241C push [esp+1C] * Possible StringData Ref from Code Obj ->"SRTempDir" | :760E5E7D 68485F0E76 push 760E5F48 :760E5E82 FFD7 call edi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3E40(C), :760F3E53(C), :760F3E6C(U) | * Possible StringData Ref from Code Obj ->"C:\Documents And Settings" | :760E5E84 682C5F0E76 push 760E5F2C * Possible StringData Ref from Code Obj ->"DocAndSettingRoot" | :760E5E89 68185F0E76 push 760E5F18 :760E5E8E FFD7 call edi :760E5E90 6A01 push 00000001 :760E5E92 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3C8D(U) | :760E5E93 5F pop edi :760E5E94 5E pop esi :760E5E95 5D pop ebp :760E5E96 5B pop ebx :760E5E97 81C418080000 add esp, 00000818 :760E5E9D C3 ret :760E5E9E 90 nop :760E5E9F 90 nop :760E5EA0 56 push esi :760E5EA1 45 inc ebp :760E5EA2 52 push edx :760E5EA3 53 push ebx :760E5EA4 49 dec ecx :760E5EA5 4F dec edi :760E5EA6 4E dec esi :760E5EA7 00444546 add byte ptr [ebp+2*eax+46], al :760E5EAB 54 push esp :760E5EAC 59 pop ecx :760E5EAD 50 push eax :760E5EAE 45 inc ebp :760E5EAF 004558 add byte ptr [ebp+58], al :760E5EB2 54 push esp :760E5EB3 45 inc ebp :760E5EB4 4E dec esi :760E5EB5 53 push ebx :760E5EB6 49 dec ecx :760E5EB7 4F dec edi :760E5EB8 4E dec esi :760E5EB9 53 push ebx :760E5EBA 009046494C45 add byte ptr [eax+454C4946], dl :760E5EC0 53 push ebx :760E5EC1 009090444952 add byte ptr [eax+52494490], dl :760E5EC7 45 inc ebp :760E5EC8 43 inc ebx :760E5EC9 54 push esp :760E5ECA 4F dec edi :760E5ECB 52 push edx :760E5ECC 49 dec ecx :760E5ECD 45 inc ebp :760E5ECE 53 push ebx :760E5ECF 005043 add byte ptr [eax+43], dl :760E5ED2 48 dec eax :760E5ED3 65 BYTE 065h :760E5ED4 61 popad :760E5ED5 6C insb :760E5ED6 7468 je 760E5F40 :760E5ED8 50 push eax :760E5ED9 726F jb 760E5F4A :760E5EDB 7465 je 760E5F42 :760E5EDD 63740045 arpl dword ptr [eax+eax+45], esi :760E5EE1 58 pop eax :760E5EE2 43 inc ebx :760E5EE3 4C dec esp :760E5EE4 55 push ebp :760E5EE5 44 inc esp :760E5EE6 45 inc ebp :760E5EE7 00494E add byte ptr [ecx+4E], cl :760E5EEA 43 inc ebx :760E5EEB 4C dec esp :760E5EEC 55 push ebp :760E5EED 44 inc esp :760E5EEE 45 inc ebp :760E5EEF 004358 add byte ptr [ebx+58], al :760E5EF2 4D dec ebp :760E5EF3 4C dec esp :760E5EF4 46 inc esi :760E5EF5 696C654C69737450 imul ebp, dword ptr [ebp+4C], 50747369 :760E5EFD 61 popad :760E5EFE 7273 jb 760E5F73 :760E5F00 65 BYTE 065h :760E5F01 723A jb 760E5F3D :760E5F03 3A4C6F61 cmp cl, byte ptr [edi+2*ebp+61] :760E5F07 64 BYTE 064h :760E5F08 4F dec edi :760E5F09 6E outsb :760E5F0A 65 BYTE 065h :760E5F0B 43 inc ebx :760E5F0C 6F outsd :760E5F0D 6C insb :760E5F0E 6C insb :760E5F0F 656374696F arpl dword ptr gs:[ecx+2*ebp+6F], esi :760E5F14 6E outsb :760E5F15 009090446F63 add byte ptr [eax+636F4490], dl :760E5F1B 41 inc ecx :760E5F1C 6E outsb :760E5F1D 64 BYTE 064h :760E5F1E 53 push ebx :760E5F1F 65 BYTE 065h :760E5F20 7474 je 760E5F96 :760E5F22 696E67526F6F74 imul ebp, dword ptr [esi+67], 746F6F52 :760E5F29 009090433A5C add byte ptr [eax+5C3A4390], dl :760E5F2F 44 inc esp :760E5F30 6F outsd :760E5F31 63756D arpl dword ptr [ebp+6D], esi :760E5F34 65 BYTE 065h :760E5F35 6E outsb :760E5F36 7473 je 760E5FAB :760E5F38 20416E and byte ptr [ecx+6E], al :760E5F3B 64205365 and byte ptr fs:[ebx+65], dl :760E5F3F 7474 je 760E5FB5 :760E5F41 696E6773009090 imul ebp, dword ptr [esi+67], 90900073 :760E5F48 53 push ebx :760E5F49 52 push edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5ED9(C) | :760E5F4A 54 push esp :760E5F4B 65 BYTE 065h :760E5F4C 6D insd :760E5F4D 7044 jo 760E5F93 :760E5F4F 69720090905352 imul esi, dword ptr [edx+00], 52539090 :760E5F56 41 inc ecx :760E5F57 7263 jb 760E5FBC :760E5F59 6869766544 push 44657669 :760E5F5E 69720090909053 imul esi, dword ptr [edx+00], 53909090 :760E5F65 52 push edx :760E5F66 44 inc esp :760E5F67 61 popad :760E5F68 7461 je 760E5FCB :760E5F6A 53 push ebx :760E5F6B 746F je 760E5FDC :760E5F6D 7265 jb 760E5FD4 :760E5F6F 52 push edx :760E5F70 6F outsd :760E5F71 6F outsd :760E5F72 7400 je 760E5F74 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5F72(C) | :760E5F74 43 inc ebx :760E5F75 6F outsd :760E5F76 6E outsb :760E5F77 6E outsb :760E5F78 656374696F arpl dword ptr gs:[ecx+2*ebp+6F], esi :760E5F7D 6E outsb :760E5F7E 57 push edi :760E5F7F 697A6172640090 imul edi, dword ptr [edx+61], 90006472 :760E5F86 90 nop :760E5F87 90 nop :760E5F88 50 push eax :760E5F89 61 popad :760E5F8A 7468 je 760E5FF4 :760E5F8C 009090904170 add byte ptr [eax+70419090], dl :760E5F92 7020 jo 760E5FB4 :760E5F94 50 push eax :760E5F95 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5F20(C) | :760E5F96 7468 je 760E6000 :760E5F98 735C jnb 760E5FF6 :760E5F9A 49 dec ecx :760E5F9B 43 inc ebx :760E5F9C 57 push edi :760E5F9D 43 inc ebx :760E5F9E 4F dec edi :760E5F9F 4E dec esi :760E5FA0 4E dec esi :760E5FA1 312E xor dword ptr [esi], ebp :760E5FA3 45 inc ebp :760E5FA4 58 pop eax :760E5FA5 45 inc ebp :760E5FA6 0090436F6D6D add byte ptr [eax+6D6D6F43], dl :760E5FAC 6F outsd :760E5FAD 6E outsb :760E5FAE 46 inc esi :760E5FAF 696C657300436F6D imul ebp, dword ptr [ebp+73], 6D6F4300 :760E5FB7 6D insd :760E5FB8 6F outsd :760E5FB9 6E outsb :760E5FBA 46 inc esi :760E5FBB 696C657344697200 imul ebp, dword ptr [ebp+73], 00726944 :760E5FC3 90 nop :760E5FC4 50 push eax :760E5FC5 726F jb 760E6036 :760E5FC7 677261 jb 760E602B :760E5FCA 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5F68(C) | :760E5FCB 46 inc esi :760E5FCC 696C657300909090 imul ebp, dword ptr [ebp+73], 90909000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5F6D(C) | :760E5FD4 50 push eax :760E5FD5 726F jb 760E6046 :760E5FD7 677261 jb 760E603B :760E5FDA 6D insd :760E5FDB 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5F6B(C) | :760E5FDC 696C657344697200 imul ebp, dword ptr [ebp+73], 00726944 :760E5FE4 53 push ebx :760E5FE5 6F outsd :760E5FE6 667477 je 760E6060 :760E5FE9 61 popad :760E5FEA 7265 jb 760E6051 :760E5FEC 5C pop esp :760E5FED 4D dec ebp :760E5FEE 6963726F736F66 imul esp, dword ptr [ebx+72], 666F736F :760E5FF5 745C je 760E6053 :760E5FF7 57 push edi :760E5FF8 696E646F77735C imul ebp, dword ptr [esi+64], 5C73776F :760E5FFF 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5F96(C) | :760E6000 7572 jne 760E6074 :760E6002 7265 jb 760E6069 :760E6004 6E outsb :760E6005 7456 je 760E605D :760E6007 65 BYTE 065h :760E6008 7273 jb 760E607D :760E600A 696F6E00909048 imul ebp, dword ptr [edi+6E], 48909000 :760E6011 6973746F727900 imul esi, dword ptr [ebx+74], 0079726F :760E6018 54 push esp :760E6019 65 BYTE 065h :760E601A 6D insd :760E601B 706C jo 760E6089 :760E601D 61 popad :760E601E 7465 je 760E6085 :760E6020 7300 jnb 760E6022 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6020(C) | :760E6022 90 nop :760E6023 90 nop :760E6024 53 push ebx :760E6025 7461 je 760E6088 :760E6027 7274 jb 760E609D :760E6029 4D dec ebp :760E602A 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5FC8(C) | :760E602B 6E outsb :760E602C 7500 jne 760E602E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E602C(C) | :760E602E 90 nop :760E602F 90 nop :760E6030 50 push eax :760E6031 65 BYTE 065h :760E6032 7273 jb 760E60A7 :760E6034 6F outsd :760E6035 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5FC5(C) | :760E6036 61 popad :760E6037 6C insb :760E6038 44 inc esp :760E6039 6F outsd :760E603A 63756D arpl dword ptr [ebp+6D], esi :760E603D 65 BYTE 065h :760E603E 6E outsb :760E603F 7473 je 760E60B4 :760E6041 0090904E6574 add byte ptr [eax+74654E90], dl :760E6047 48 dec eax :760E6048 6F outsd :760E6049 6F outsd :760E604A 6400496E add byte ptr fs:[ecx+6E], cl :760E604E 7465 je 760E60B5 :760E6050 726E jb 760E60C0 :760E6052 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5FF5(C) | :760E6053 7443 je 760E6098 :760E6055 61 popad :760E6056 636865 arpl dword ptr [eax+65], ebp :760E6059 009090466176 add byte ptr [eax+76614690], dl :760E605F 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5FE7(C) | :760E6060 7269 jb 760E60CB :760E6062 7465 je 760E60C9 :760E6064 7300 jnb 760E6066 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6064(C) | :760E6066 90 nop :760E6067 90 nop :760E6068 44 inc esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6002(C) | :760E6069 65 BYTE 065h :760E606A 736B jnb 760E60D7 :760E606C 746F je 760E60DD :760E606E 7044 jo 760E60B4 :760E6070 69726563746F72 imul esi, dword ptr [edx+65], 726F7463 :760E6077 7900 jns 760E6079 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6077(C) | :760E6079 90 nop :760E607A 90 nop :760E607B 90 nop :760E607C 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6008(C) | :760E607D 6F outsd :760E607E 6F outsd :760E607F 6B696573 imul ebp, dword ptr [ecx+65], 00000073 :760E6083 00436F add byte ptr [ebx+6F], al :760E6086 6D insd :760E6087 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6025(C) | :760E6088 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E601B(C) | :760E6089 6E outsb :760E608A 53 push ebx :760E608B 7461 je 760E60EE :760E608D 7274 jb 760E6103 :760E608F 55 push ebp :760E6090 7000 jo 760E6092 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6090(C) | :760E6092 90 nop :760E6093 90 nop :760E6094 43 inc ebx :760E6095 6F outsd :760E6096 6D insd :760E6097 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6053(C) | :760E6098 6F outsd :760E6099 6E outsb :760E609A 53 push ebx :760E609B 7461 je 760E60FE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6027(C) | :760E609D 7274 jb 760E6113 :760E609F 4D dec ebp :760E60A0 65 BYTE 065h :760E60A1 6E outsb :760E60A2 7500 jne 760E60A4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E60A2(C) | :760E60A4 43 inc ebx :760E60A5 6F outsd :760E60A6 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6032(C) | :760E60A7 6D insd :760E60A8 6F outsd :760E60A9 6E outsb :760E60AA 50 push eax :760E60AB 726F jb 760E611C :760E60AD 677261 jb 760E6111 :760E60B0 6D insd :760E60B1 47 inc edi :760E60B2 726F jb 760E6123 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E603F(C), :760E606E(C) | :760E60B4 7570 jne 760E6126 :760E60B6 7300 jnb 760E60B8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E60B6(C) | :760E60B8 43 inc ebx :760E60B9 6F outsd :760E60BA 6D insd :760E60BB 6D insd :760E60BC 6F outsd :760E60BD 6E outsb :760E60BE 46 inc esi :760E60BF 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6050(C) | :760E60C0 766F jbe 760E6131 :760E60C2 7269 jb 760E612D :760E60C4 7465 je 760E612B :760E60C6 7300 jnb 760E60C8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E60C6(C) | :760E60C8 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6062(C) | :760E60C9 6F outsd :760E60CA 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6060(C) | :760E60CB 6D insd :760E60CC 6F outsd :760E60CD 6E outsb :760E60CE 44 inc esp :760E60CF 65 BYTE 065h :760E60D0 736B jnb 760E613D :760E60D2 746F je 760E6143 :760E60D4 7000 jo 760E60D6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E60D4(C) | :760E60D6 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E606A(C) | :760E60D7 90 nop :760E60D8 52 push edx :760E60D9 65637963 arpl dword ptr gs:[ecx+63], edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E606C(C) | :760E60DD 6C insb :760E60DE 65 BYTE 065h :760E60DF 42 inc edx :760E60E0 696E0090417070 imul ebp, dword ptr [esi+00], 70704190 :760E60E7 44 inc esp :760E60E8 61 popad :760E60E9 7461 je 760E614C :760E60EB 00416C add byte ptr [ecx+6C], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E608B(C) | :760E60EE 7453 je 760E6143 :760E60F0 7461 je 760E6153 :760E60F2 7274 jb 760E6168 :760E60F4 7570 jne 760E6166 :760E60F6 0090416C7453 add byte ptr [eax+53746C41], dl :760E60FC 7461 je 760E615F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E609B(C) | :760E60FE 7274 jb 760E6174 :760E6100 55 push ebp :760E6101 7000 jo 760E6103 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E608D(C), :760E6101(C) | :760E6103 90 nop :760E6104 43 inc ebx :760E6105 3A5C556E cmp bl, byte ptr [ebp+2*edx+6E] :760E6109 6B6E6F77 imul ebp, dword ptr [esi+6F], 00000077 :760E610D 6E outsb :760E610E 5F pop edi :760E610F 005769 add byte ptr [edi+69], dl :760E6112 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E609D(C) | :760E6113 53 push ebx :760E6114 7973 jns 760E6189 :760E6116 009057696E44 add byte ptr [eax+446E6957], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E60AB(C) | :760E611C 6972009043584D imul esi, dword ptr [edx+00], 4D584390 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E60B2(C) | :760E6123 4C dec esp :760E6124 46 inc esi :760E6125 696C654C69737450 imul ebp, dword ptr [ebp+4C], 50747369 :760E612D 61 popad :760E612E 7273 jb 760E61A3 :760E6130 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E60C0(C) | :760E6131 723A jb 760E616D :760E6133 3A506F cmp dl, byte ptr [eax+6F] :760E6136 7075 jo 760E61AD :760E6138 6C insb :760E6139 61 popad :760E613A 7465 je 760E61A1 :760E613C 52 push edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E60D0(C) | :760E613D 65 BYTE 065h :760E613E 706C jo 760E61AC :760E6140 61 popad :760E6141 636545 arpl dword ptr [ebp+45], esp :760E6144 6E outsb :760E6145 7472 je 760E61B9 :760E6147 69657328290090 imul esp, dword ptr [ebp+73], 90002928 :760E614E 90 nop :760E614F 90 nop :760E6150 43 inc ebx :760E6151 3A5C5749 cmp bl, byte ptr [edi+2*edx+49] :760E6155 4E dec esi :760E6156 44 inc esp :760E6157 4F dec edi :760E6158 57 push edi :760E6159 53 push ebx :760E615A 00905678444D add byte ptr [eax+4D447856], dl :760E6160 6F outsd :760E6161 6E outsb :760E6162 2E BYTE 02eh :760E6163 64 BYTE 064h :760E6164 61 popad :760E6165 7400 je 760E6167 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6165(C) | :760E6167 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E60F2(C) | :760E6168 3238 xor bh, byte ptr [eax] :760E616A 3033 xor byte ptr [ebx], dh :760E616C 009090905366 add byte ptr [eax+66539090], dl :760E6172 705F jo 760E61D3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E60FE(C) | :760E6174 49 dec ecx :760E6175 6E outsb :760E6176 69745F4576656E74 imul esi, dword ptr [edi+2*ebx+45], 746E6576 :760E617E 009053687574 add byte ptr [eax+74756853], dl :760E6184 44 inc esp :760E6185 6F outsd :760E6186 776E ja 760E61F6 :760E6188 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6114(C) | :760E6189 45 inc ebp :760E618A 7665 jbe 760E61F1 :760E618C 6E outsb :760E618D 7400 je 760E618F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E618D(C) | :760E618F 90 nop :760E6190 52 push edx :760E6191 65 BYTE 065h :760E6192 7374 jnb 760E6208 :760E6194 6F outsd :760E6195 7252 jb 760E61E9 :760E6197 6300 arpl dword ptr [eax], eax :760E6199 90 nop :760E619A 90 nop :760E619B 90 nop :760E619C 25642E2564 and eax, 64252E64 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E613A(C) | :760E61A1 2E BYTE 02eh :760E61A2 25642E2564 and eax, 64252E64 :760E61A7 00436F add byte ptr [ebx+6F], al :760E61AA 7272 jb 760E621E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E613E(C) | :760E61AC 6563742076 arpl dword ptr gs:[eax+76], esi :760E61B1 65 BYTE 065h :760E61B2 7273 jb 760E6227 :760E61B4 696F6E20697320 imul ebp, dword ptr [edi+6E], 20736920 :760E61BB 2573009090 and eax, 90900073 :760E61C0 4E dec esi :760E61C1 65 BYTE 065h :760E61C2 7720 ja 760E61E4 :760E61C4 66696C65206861 imul bp, word ptr [ebp+20], 6168 :760E61CB 7320 jnb 760E61ED :760E61CD 636F72 arpl dword ptr [edi+72], ebp :760E61D0 7265 jb 760E6237 :760E61D2 63742076 arpl dword ptr [eax+76], esi :760E61D6 65 BYTE 065h :760E61D7 7273 jb 760E624C :760E61D9 696F6E20627574 imul ebp, dword ptr [edi+6E], 74756220 :760E61E0 20696E and byte ptr [ecx+6E], ch :760E61E3 7661 jbe 760E6246 :760E61E5 6C insb :760E61E6 6964206861736800 imul esp, dword ptr [eax+68], 00687361 :760E61EE 90 nop :760E61EF 90 nop :760E61F0 49 dec ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E618A(C) | :760E61F1 6E outsb :760E61F2 7661 jbe 760E6255 :760E61F4 6C insb :760E61F5 69642066696C6520 imul esp, dword ptr [eax+66], 20656C69 :760E61FD 25732C2076 and eax, 76202C73 :760E6202 65 BYTE 065h :760E6203 7273 jb 760E6278 :760E6205 696F6E20257320 imul ebp, dword ptr [edi+6E], 20732520 :760E620C 636F70 arpl dword ptr [edi+70], ebp :760E620F 6965642E200090 imul esp, dword ptr [ebp+64], 9000202E :760E6216 90 nop :760E6217 90 nop :760E6218 49 dec ecx :760E6219 6E outsb :760E621A 7661 jbe 760E627D :760E621C 6C insb :760E621D 696420656E747279 imul esp, dword ptr [eax+65], 7972746E :760E6225 20666F and byte ptr [esi+6F], ah :760E6228 7220 jb 760E624A :760E622A 66696C65202573 imul bp, word ptr [ebp+20], 7325 :760E6231 2C20 sub al, 20 :760E6233 7665 jbe 760E629A :760E6235 7273 jb 760E62AA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E61D0(C) | :760E6237 696F6E20257320 imul ebp, dword ptr [edi+6E], 20732520 :760E623E 6D insd :760E623F 61 popad :760E6240 64 BYTE 064h :760E6241 6520696E and byte ptr gs:[ecx+6E], ch :760E6245 207769 and byte ptr [edi+69], dh :760E6248 6E outsb :760E6249 696E69742E696E imul ebp, dword ptr [esi+69], 6E692E74 :760E6250 692E20004375 imul ebp, dword ptr [esi], 75430020 :760E6256 7272 jb 760E62CA :760E6258 65 BYTE 065h :760E6259 6E outsb :760E625A 7420 je 760E627C :760E625C 66696C65206861 imul bp, word ptr [ebp+20], 6168 :760E6263 7368 jnb 760E62CD :760E6265 20666F and byte ptr [esi+6F], ah :760E6268 7220 jb 760E628A :760E626A 2573206973 and eax, 73692073 :760E626F 20696E and byte ptr [ecx+6E], ch :760E6272 7661 jbe 760E62D5 :760E6274 6C insb :760E6275 6964004E65772066 imul esp, dword ptr [eax+eax+4E], 66207765 :760E627D 696C652076657273 imul ebp, dword ptr [ebp+20], 73726576 :760E6285 696F6E20697320 imul ebp, dword ptr [edi+6E], 20736920 :760E628C 2549363478 and eax, 78343649 :760E6291 2E205346 and byte ptr cs:[ebx+46], dl :760E6295 50 push eax :760E6296 206669 and byte ptr [esi+69], ah :760E6299 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6233(C) | :760E629A 65207665 and byte ptr gs:[esi+65], dh :760E629E 7273 jb 760E6313 :760E62A0 696F6E20697320 imul ebp, dword ptr [edi+6E], 20736920 :760E62A7 207265 and byte ptr [edx+65], dh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6235(C) | :760E62AA 706C jo 760E6318 :760E62AC 61 popad :760E62AD 636564 arpl dword ptr [ebp+64], esp :760E62B0 206973 and byte ptr [ecx+73], ch :760E62B3 202549363478 and byte ptr [78343649], ah :760E62B9 00909046696C add byte ptr [eax+6C694690], dl :760E62BF 65206265 and byte ptr gs:[edx+65], ah :760E62C3 696E6720726570 imul ebp, dword ptr [esi+67], 70657220 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6256(C) | :760E62CA 6C insb :760E62CB 61 popad :760E62CC 636564 arpl dword ptr [ebp+64], esp :760E62CF 206973 and byte ptr [ecx+73], ch :760E62D2 207661 and byte ptr [esi+61], dh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6272(C) | :760E62D5 6C insb :760E62D6 6964009090904572 imul esp, dword ptr [eax+eax-70], 72459090 :760E62DE 726F jb 760E634F :760E62E0 7220 jb 760E6302 :760E62E2 256420696E and eax, 6E692064 :760E62E7 206765 and byte ptr [edi+65], ah :760E62EA 7474 je 760E6360 :760E62EC 696E6720766572 imul ebp, dword ptr [esi+67], 72657620 :760E62F3 7369 jnb 760E635E :760E62F5 6F outsd :760E62F6 6E outsb :760E62F7 206672 and byte ptr [esi+72], ah :760E62FA 6F outsd :760E62FB 6D insd :760E62FC 66696C65206F6E imul bp, word ptr [ebp+20], 6E6F :760E6303 20646973 and byte ptr [ecx+2*ebp+73], ah :760E6307 6B0090 imul eax, dword ptr [eax], FFFFFF90 :760E630A 90 nop :760E630B 90 nop :760E630C 46 inc esi :760E630D 696C6520636F7069 imul ebp, dword ptr [ebp+20], 69706F63 :760E6315 65 BYTE 065h :760E6316 64206973 and byte ptr fs:[ecx+73], ch :760E631A 207661 and byte ptr [esi+61], dh :760E631D 6C insb :760E631E 6964009090904462 imul esp, dword ptr [eax+eax-70], 62449090 :760E6326 206861 and byte ptr [eax+61], ch :760E6329 7320 jnb 760E634B :760E632B 6E outsb :760E632C 6F outsd :760E632D 206361 and byte ptr [ebx+61], ah :760E6330 7461 je 760E6393 :760E6332 6C insb :760E6333 6F outsd :760E6334 6720656E and [di+6E], ah :760E6338 7472 je 760E63AC :760E633A 7920 jns 760E635C :760E633C 666F outsw :760E633E 7220 jb 760E6360 :760E6340 2573009045 and eax, 45900073 :760E6345 7272 jb 760E63B9 :760E6347 6F outsd :760E6348 7220 jb 760E636A :760E634A 256420696E and eax, 6E692064 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E62DE(C) | :760E634F 206765 and byte ptr [edi+65], ah :760E6352 7474 je 760E63C8 :760E6354 696E6720766572 imul ebp, dword ptr [esi+67], 72657620 :760E635B 7369 jnb 760E63C6 :760E635D 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E62F3(C) | :760E635E 6E outsb :760E635F 206672 and byte ptr [esi+72], ah :760E6362 6F outsd :760E6363 6D insd :760E6364 206669 and byte ptr [esi+69], ah :760E6367 6C insb :760E6368 65206F6E and byte ptr gs:[edi+6E], ch :760E636C 20646973 and byte ptr [ecx+2*ebp+73], ah :760E6370 6B0090 imul eax, dword ptr [eax], FFFFFF90 :760E6373 90 nop :760E6374 49 dec ecx :760E6375 734E jnb 760E63C5 :760E6377 65 BYTE 065h :760E6378 7746 ja 760E63C0 :760E637A 696C6556616C6964 imul ebp, dword ptr [ebp+56], 64696C61 :760E6382 0090436F756C add byte ptr [eax+6C756F43], dl :760E6388 64206E6F and byte ptr fs:[esi+6F], ch :760E638C 7420 je 760E63AE :760E638E 637265 arpl dword ptr [edx+65], esi :760E6391 61 popad :760E6392 7465 je 760E63F9 :760E6394 20646972 and byte ptr [ecx+2*ebp+72], ah :760E6398 6563746F72 arpl dword ptr gs:[edi+2*ebp+72], esi :760E639D 7920 jns 760E63BF :760E639F 2573206563 and eax, 63652073 :760E63A4 3D25640043 cmp eax, 43006425 :760E63A9 7265 jb 760E6410 :760E63AB 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6338(C) | :760E63AC 7465 je 760E6413 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E638C(C) | :760E63AE 6420646972 and byte ptr fs:[ecx+2*ebp+72], ah :760E63B3 6563746F72 arpl dword ptr gs:[edi+2*ebp+72], esi :760E63B8 7920 jns 760E63DA :760E63BA 2573009090 and eax, 90900073 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E639D(C) | :760E63BF 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6378(C) | :760E63C0 43 inc ebx :760E63C1 7265 jb 760E6428 :760E63C3 61 popad :760E63C4 7465 je 760E642B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E635B(C) | :760E63C6 42 inc edx :760E63C7 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6352(C) | :760E63C8 7365 jnb 760E642F :760E63CA 44 inc esp :760E63CB 69726563746F72 imul esi, dword ptr [edx+65], 726F7463 :760E63D2 7900 jns 760E63D4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E63D2(C) | :760E63D4 46 inc esi :760E63D5 696C652025732020 imul ebp, dword ptr [ebp+20], 20207325 :760E63DD 6861732062 push 62207361 :760E63E2 65 BYTE 065h :760E63E3 65 BYTE 065h :760E63E4 6E outsb :760E63E5 2064656C and byte ptr [ebp+6C], ah :760E63E9 65 BYTE 065h :760E63EA 7465 je 760E6451 :760E63EC 64009090257320 add byte ptr fs:[eax+20732590], dl :760E63F3 6861732062 push 62207361 :760E63F8 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6392(C) | :760E63F9 65 BYTE 065h :760E63FA 6E outsb :760E63FB 2064656C and byte ptr [ebp+6C], ah :760E63FF 65 BYTE 065h :760E6400 7465 je 760E6467 :760E6402 64002573206973 add byte ptr fs:[73692073], ah :760E6409 206E6F and byte ptr [esi+6F], ch :760E640C 7420 je 760E642E :760E640E 7072 jo 760E6482 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E63A9(C) | :760E6410 6F outsd :760E6411 7465 je 760E6478 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E63AC(C) | :760E6413 63746564 arpl dword ptr [ebp+64], esi :760E6417 005346 add byte ptr [ebx+46], dl :760E641A 50 push eax :760E641B 206E6F and byte ptr [esi+6F], ch :760E641E 7469 je 760E6489 :760E6420 666963617469 imul sp, word ptr [ebx+61], 6974 :760E6426 6F outsd :760E6427 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E63C1(C) | :760E6428 20746861 and byte ptr [eax+2*ebp+61], dh :760E642C 7420 je 760E644E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E640C(C) | :760E642E 66696C65202573 imul bp, word ptr [ebp+20], 7325 :760E6435 206368 and byte ptr [ebx+68], ah :760E6438 61 popad :760E6439 6E outsb :760E643A 67 BYTE 067h :760E643B 65 BYTE 065h :760E643C 640090904F7065 add byte ptr fs:[eax+65704F90], dl :760E6443 6E outsb :760E6444 45 inc ebp :760E6445 7665 jbe 760E64AC :760E6447 6E outsb :760E6448 7420 je 760E646A :760E644A 6661 popa :760E644C 696C656420666F72 imul ebp, dword ptr [ebp+64], 726F6620 :760E6454 3A20 cmp ah, byte ptr [eax] :760E6456 25733B2065 and eax, 65203B73 :760E645B 7272 jb 760E64CF :760E645D 6F outsd :760E645E 723D jb 760E649D :760E6460 256C640053 and eax, 5300646C :760E6465 46 inc esi :760E6466 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6400(C) | :760E6467 206861 and byte ptr [eax+61], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6448(C) | :760E646A 7320 jnb 760E648C :760E646C 6E outsb :760E646D 6F outsd :760E646E 7420 je 760E6490 :760E6470 626565 bound esp, dword ptr [ebp+65] :760E6473 6E outsb :760E6474 20696E and byte ptr [ecx+6E], ch :760E6477 6974746564202D20 imul esi, dword ptr [esp+2*esi+65], 202D2064 :760E647F 7469 je 760E64EA :760E6481 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E640E(C) | :760E6482 696E67206F7574 imul ebp, dword ptr [esi+67], 74756F20 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E641E(C) | :760E6489 00909043616E add byte ptr [eax+6E614390], dl :760E648F 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E646E(C) | :760E6490 6F outsd :760E6491 7420 je 760E64B3 :760E6493 6F outsd :760E6494 7065 jo 760E64FB :760E6496 6E outsb :760E6497 206576 and byte ptr [ebp+76], ah :760E649A 65 BYTE 065h :760E649B 6E outsb :760E649C 7420 je 760E64BE :760E649E 25732C2065 and eax, 65202C73 :760E64A3 7272 jb 760E6517 :760E64A5 6F outsd :760E64A6 7220 jb 760E64C8 :760E64A8 307825 xor byte ptr [eax+25], bh :760E64AB 7800 js 760E64AD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E64AB(C) | :760E64AD 90 nop :760E64AE 90 nop :760E64AF 90 nop :760E64B0 4E dec esi :760E64B1 6F outsd :760E64B2 7420 je 760E64D4 :760E64B4 65 BYTE 065h :760E64B5 6E outsb :760E64B6 61 popad :760E64B7 626C6564 bound ebp, dword ptr [ebp+64] :760E64BB 2E204578 and byte ptr cs:[ebp+78], al :760E64BF 6974696E67009090 imul esi, dword ptr [ecx+2*ebp+6E], 90900067 :760E64C7 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E64A6(C) | :760E64C8 53 push ebx :760E64C9 46 inc esi :760E64CA 50 push eax :760E64CB 50 push eax :760E64CC 726F jb 760E653D :760E64CE 636573 arpl dword ptr [ebp+73], esp :760E64D1 7346 jnb 760E6519 :760E64D3 696C654368616E67 imul ebp, dword ptr [ebp+43], 676E6168 :760E64DB 65 BYTE 065h :760E64DC 7300 jnb 760E64DE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E64DC(C) | :760E64DE 90 nop :760E64DF 90 nop :760E64E0 43 inc ebx :760E64E1 61 popad :760E64E2 6E outsb :760E64E3 6E outsb :760E64E4 6F outsd :760E64E5 7420 je 760E6507 :760E64E7 637265 arpl dword ptr [edx+65], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E647F(C) | :760E64EA 61 popad :760E64EB 7465 je 760E6552 :760E64ED 2074656D and byte ptr [ebp+6D], dh :760E64F1 7063 jo 760E6556 :760E64F3 61 popad :760E64F4 7473 je 760E6569 :760E64F6 20646972 and byte ptr [ecx+2*ebp+72], ah :760E64FA 206563 and byte ptr [ebp+63], ah :760E64FD 3D25640090 cmp eax, 90006425 :760E6502 90 nop :760E6503 90 nop :760E6504 43 inc ebx :760E6505 61 popad :760E6506 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E64E5(C) | :760E6507 6E outsb :760E6508 6F outsd :760E6509 7420 je 760E652B :760E650B 67 BYTE 067h :760E650C 65 BYTE 065h :760E650D 7420 je 760E652F :760E650F 7366 jnb 760E6577 :760E6511 7020 jo 760E6533 :760E6513 7465 je 760E657A :760E6515 6D insd :760E6516 7063 jo 760E657B :760E6518 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E64D1(C) | :760E6519 7473 je 760E658E :760E651B 20646972 and byte ptr [ecx+2*ebp+72], ah :760E651F 6563746F72 arpl dword ptr gs:[edi+2*ebp+72], esi :760E6524 7900 jns 760E6526 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6524(C) | :760E6526 90 nop :760E6527 90 nop :760E6528 43 inc ebx :760E6529 61 popad :760E652A 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6509(C) | :760E652B 6E outsb :760E652C 6F outsd :760E652D 7420 je 760E654F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E650D(C) | :760E652F 637265 arpl dword ptr [edx+65], esi :760E6532 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6511(C) | :760E6533 7465 je 760E659A :760E6535 206F76 and byte ptr [edi+76], ch :760E6538 65 BYTE 065h :760E6539 7277 jb 760E65B2 :760E653B 7269 jb 760E65A6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E64CC(C) | :760E653D 7474 je 760E65B3 :760E653F 65 BYTE 065h :760E6540 6E outsb :760E6541 206669 and byte ptr [esi+69], ah :760E6544 6C insb :760E6545 65 BYTE 065h :760E6546 7320 jnb 760E6568 :760E6548 6469722065633D25 imul esi, dword ptr fs:[edx+20], 253D6365 :760E6550 6400909043616E add byte ptr fs:[eax+6E614390], dl :760E6557 6E outsb :760E6558 6F outsd :760E6559 7420 je 760E657B :760E655B 67 BYTE 067h :760E655C 65 BYTE 065h :760E655D 7420 je 760E657F :760E655F 7366 jnb 760E65C7 :760E6561 7020 jo 760E6583 :760E6563 6F outsd :760E6564 7665 jbe 760E65CB :760E6566 7277 jb 760E65DF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6546(C) | :760E6568 7269 jb 760E65D3 :760E656A 7474 je 760E65E0 :760E656C 65 BYTE 065h :760E656D 6E outsb :760E656E 206669 and byte ptr [esi+69], ah :760E6571 6C insb :760E6572 65 BYTE 065h :760E6573 7320 jnb 760E6595 :760E6575 6C insb :760E6576 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E650F(C) | :760E6577 636174 arpl dword ptr [ecx+74], esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6513(C) | :760E657A 696F6E00909043 imul ebp, dword ptr [edi+6E], 43909000 :760E6581 61 popad :760E6582 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6561(C) | :760E6583 6E outsb :760E6584 6F outsd :760E6585 7420 je 760E65A7 :760E6587 637265 arpl dword ptr [edx+65], esi :760E658A 61 popad :760E658B 7465 je 760E65F2 :760E658D 205346 and byte ptr [ebx+46], dl :760E6590 50 push eax :760E6591 20646972 and byte ptr [ecx+2*ebp+72], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6573(C) | :760E6595 206563 and byte ptr [ebp+63], ah :760E6598 3D25640043 cmp eax, 43006425 :760E659D 61 popad :760E659E 6E outsb :760E659F 6E outsb :760E65A0 6F outsd :760E65A1 7420 je 760E65C3 :760E65A3 67 BYTE 067h :760E65A4 65 BYTE 065h :760E65A5 7420 je 760E65C7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6585(C) | :760E65A7 7366 jnb 760E660F :760E65A9 7064 jo 760E660F :760E65AB 6220 bound esp, dword ptr [eax] :760E65AD 66696C65206C6F imul bp, word ptr [ebp+20], 6F6C :760E65B4 636174 arpl dword ptr [ecx+74], esp :760E65B7 696F6E00904372 imul ebp, dword ptr [edi+6E], 72439000 :760E65BE 65 BYTE 065h :760E65BF 61 popad :760E65C0 7465 je 760E6627 :760E65C2 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E65A1(C) | :760E65C3 46 inc esi :760E65C4 50 push eax :760E65C5 44 inc esp :760E65C6 69720090909053 imul esi, dword ptr [edx+00], 53909090 :760E65CD 667020 jo 760E65F0 :760E65D0 646220 bound esp, dword ptr fs:[eax] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6568(C) | :760E65D3 66696C65202573 imul bp, word ptr [ebp+20], 7325 :760E65DA 206973 and byte ptr [ecx+73], ch :760E65DD 20636F and byte ptr [ebx+6F], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E656A(C) | :760E65E0 7272 jb 760E6654 :760E65E2 7570 jne 760E6654 :760E65E4 7400 je 760E65E6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E65E4(C) | :760E65E6 90 nop :760E65E7 90 nop :760E65E8 43 inc ebx :760E65E9 61 popad :760E65EA 6E outsb :760E65EB 6E outsb :760E65EC 6F outsd :760E65ED 7420 je 760E660F :760E65EF 7265 jb 760E6656 :760E65F1 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E658B(C) | :760E65F2 64205366 and byte ptr fs:[ebx+66], dl :760E65F6 7044 jo 760E663C :760E65F8 624861 bound ecx, dword ptr [eax+61] :760E65FB 7368 jnb 760E6665 :760E65FD 207661 and byte ptr [esi+61], dh :760E6600 6C insb :760E6601 7565 jne 760E6668 :760E6603 206672 and byte ptr [esi+72], ah :760E6606 6F outsd :760E6607 6D insd :760E6608 207265 and byte ptr [edx+65], dh :760E660B 6769737472793A20 imul esi, [bp+di+74], 203A7972 :760E6613 65 BYTE 065h :760E6614 7272 jb 760E6688 :760E6616 6F outsd :760E6617 7220 jb 760E6639 :760E6619 2530387800 and eax, 00783830 :760E661E 90 nop :760E661F 90 nop :760E6620 43 inc ebx :760E6621 61 popad :760E6622 6E outsb :760E6623 6E outsb :760E6624 6F outsd :760E6625 7420 je 760E6647 :760E6627 67 BYTE 067h :760E6628 65 BYTE 065h :760E6629 7420 je 760E664B :760E662B 66696C65206861 imul bp, word ptr [ebp+20], 6168 :760E6632 7368 jnb 760E669C :760E6634 20666F and byte ptr [esi+6F], ah :760E6637 7220 jb 760E6659 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6617(C) | :760E6639 2573004973 and eax, 73490073 :760E663E 44 inc esp :760E663F 624669 bound eax, dword ptr [esi+69] :760E6642 6C insb :760E6643 65 BYTE 065h :760E6644 56 push esi :760E6645 61 popad :760E6646 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6625(C) | :760E6647 6964009090416464 imul esp, dword ptr [eax+eax-70], 64644190 :760E664F 43 inc ebx :760E6650 61 popad :760E6651 7461 je 760E66B4 :760E6653 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E65E0(C), :760E65E2(C) | :760E6654 6F outsd :760E6655 6754 push esp :760E6657 6F outsd :760E6658 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6637(C) | :760E6659 7279 jb 760E66D4 :760E665B 7074 jo 760E66D1 :760E665D 6F outsd :760E665E 44 inc esp :760E665F 42 inc edx :760E6660 206661 and byte ptr [esi+61], ah :760E6663 696C65642E206563 imul ebp, dword ptr [ebp+64], 6365202E :760E666B 3D25640090 cmp eax, 90006425 :760E6670 53 push ebx :760E6671 46 inc esi :760E6672 50 push eax :760E6673 20636F and byte ptr [ebx+6F], ah :760E6676 756C jne 760E66E4 :760E6678 64206E6F and byte ptr fs:[esi+6F], ch :760E667C 7420 je 760E669E :760E667E 696E7374616C6C imul ebp, dword ptr [esi+73], 6C6C6174 :760E6685 206361 and byte ptr [ebx+61], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6614(C) | :760E6688 7461 je 760E66EB :760E668A 6C insb :760E668B 6F outsd :760E668C 672025 and [di], ah :760E668F 7320 jnb 760E66B1 :760E6691 2D20636572 sub eax, 72656320 :760E6696 7469 je 760E6701 :760E6698 666963617465 imul sp, word ptr [ebx+61], 6574 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E667C(C) | :760E669E 206973 and byte ptr [ecx+73], ch :760E66A1 206E6F and byte ptr [esi+6F], ch :760E66A4 7420 je 760E66C6 :760E66A6 7472 je 760E671A :760E66A8 7573 jne 760E671D :760E66AA 7465 je 760E6711 :760E66AC 64009090436572 add byte ptr fs:[eax+72654390], dl :760E66B3 7469 je 760E671E :760E66B5 666963617465 imul sp, word ptr [ebx+61], 6574 :760E66BB 206E6F and byte ptr [esi+6F], ch :760E66BE 7420 je 760E66E0 :760E66C0 696E2074727573 imul ebp, dword ptr [esi+20], 73757274 :760E66C7 7465 je 760E672E :760E66C9 6420726F and byte ptr fs:[edx+6F], dh :760E66CD 6F outsd :760E66CE 7420 je 760E66F0 :760E66D0 7374 jnb 760E6746 :760E66D2 6F outsd :760E66D3 7265 jb 760E673A :760E66D5 009090457272 add byte ptr [eax+72724590], dl :760E66DB 6F outsd :760E66DC 7220 jb 760E66FE :760E66DE 7665 jbe 760E6745 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E66BE(C) | :760E66E0 7269 jb 760E674B :760E66E2 667969 jns 760E674E :760E66E5 6E outsb :760E66E6 67206361 and [bp+di+61], ah :760E66EA 7461 je 760E674D :760E66EC 6C insb :760E66ED 6F outsd :760E66EE 67004572 add [di+72], al :760E66F2 726F jb 760E6763 :760E66F4 7220 jb 760E6716 :760E66F6 6F outsd :760E66F7 7065 jo 760E675E :760E66F9 6E outsb :760E66FA 696E6720636174 imul ebp, dword ptr [esi+67], 74616320 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6696(C) | :760E6701 61 popad :760E6702 6C insb :760E6703 6F outsd :760E6704 67207574 and [di+74], dh :760E6708 696C697469657300 imul ebp, dword ptr [ecx+2*ebp+74], 00736569 :760E6710 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E66AA(C) | :760E6711 6F outsd :760E6712 7079 jo 760E678D :760E6714 43 inc ebx :760E6715 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E66F4(C) | :760E6716 7473 je 760E678B :760E6718 46 inc esi :760E6719 726F jb 760E678A :760E671B 6D insd :760E671C 54 push esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E66A8(C) | :760E671D 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E66B3(C) | :760E671E 6D insd :760E671F 7044 jo 760E6765 :760E6721 6972004572726F imul esi, dword ptr [edx+00], 6F727245 :760E6728 7220 jb 760E674A :760E672A 637265 arpl dword ptr [edx+65], esi :760E672D 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E66C7(C) | :760E672E 7469 je 760E6799 :760E6730 6E outsb :760E6731 67207270 and [bp+si+70], dh :760E6735 6320 arpl dword ptr [eax], esp :760E6737 7365 jnb 760E679E :760E6739 7276 jb 760E67B1 :760E673B 65 BYTE 065h :760E673C 7200 jb 760E673E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E673C(C) | :760E673E 90 nop :760E673F 90 nop :760E6740 43 inc ebx :760E6741 61 popad :760E6742 6E outsb :760E6743 6E outsb :760E6744 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E66DE(C) | :760E6745 7420 je 760E6767 :760E6747 7369 jnb 760E67B2 :760E6749 676E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E66E0(C) | :760E674B 61 popad :760E674C 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E66EA(C) | :760E674D 205366 and byte ptr [ebx+66], dl :760E6750 7020 jo 760E6772 :760E6752 49 dec ecx :760E6753 6E outsb :760E6754 6974204576656E74 imul esi, dword ptr [eax+45], 746E6576 :760E675C 009090904572 add byte ptr [eax+72459090], dl :760E6762 726F jb 760E67D3 :760E6764 7220 jb 760E6786 :760E6766 637265 arpl dword ptr [edx+65], esi :760E6769 61 popad :760E676A 7469 je 760E67D5 :760E676C 6E outsb :760E676D 67206E65 and [bp+65], ch :760E6771 7720 ja 760E6793 :760E6773 53 push ebx :760E6774 46 inc esi :760E6775 50 push eax :760E6776 20646174 and byte ptr [ecx+74], ah :760E677A 61 popad :760E677B 626173 bound esp, dword ptr [ecx+73] :760E677E 65206669 and byte ptr gs:[esi+69], ah :760E6782 6C insb :760E6783 65009090904361 add byte ptr gs:[eax+61439090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6719(C) | :760E678A 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6716(C) | :760E678B 6E outsb :760E678C 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6712(C) | :760E678D 7420 je 760E67AF :760E678F 666F outsw :760E6791 726D jb 760E6800 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6771(C) | :760E6793 207072 and byte ptr [eax+72], dh :760E6796 6F outsd :760E6797 7465 je 760E67FE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E672E(C) | :760E6799 63746564 arpl dword ptr [ebp+64], esi :760E679D 206C6973 and byte ptr [ecx+2*ebp+73], ch :760E67A1 7420 je 760E67C3 :760E67A3 786D js 760E6812 :760E67A5 6C insb :760E67A6 206669 and byte ptr [esi+69], ah :760E67A9 6C insb :760E67AA 65207061 and byte ptr gs:[eax+61], dh :760E67AE 7468 je 760E6818 :760E67B0 009090904572 add byte ptr [eax+72459090], dl :760E67B6 726F jb 760E6827 :760E67B8 7220 jb 760E67DA :760E67BA 627569 bound esi, dword ptr [ebp+69] :760E67BD 6C insb :760E67BE 64696E6720534650 imul ebp, dword ptr fs:[esi+67], 50465320 :760E67C6 20646174 and byte ptr [ecx+74], ah :760E67CA 61 popad :760E67CB 626173 bound esp, dword ptr [ecx+73] :760E67CE 65206672 and byte ptr gs:[esi+72], ah :760E67D2 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6762(C) | :760E67D3 6D insd :760E67D4 206578 and byte ptr [ebp+78], ah :760E67D7 697374696E6720 imul esi, dword ptr [ebx+74], 20676E69 :760E67DE 66696C65009045 imul bp, word ptr [ebp], 4590 :760E67E5 7272 jb 760E6859 :760E67E7 6F outsd :760E67E8 7220 jb 760E680A :760E67EA 696E697469616C imul ebp, dword ptr [esi+69], 6C616974 :760E67F1 697A696E672074 imul edi, dword ptr [edx+69], 7420676E :760E67F8 6865206361 push 61632065 :760E67FD 7461 je 760E6860 :760E67FF 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6791(C) | :760E6800 6F outsd :760E6801 67206372 and [bp+di+72], ah :760E6805 7970 jns 760E6877 :760E6807 746F je 760E6878 :760E6809 20646174 and byte ptr [ecx+74], ah :760E680D 61 popad :760E680E 626173 bound esp, dword ptr [ecx+73] :760E6811 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E67A3(C) | :760E6812 2E00675F add byte ptr cs:[edi+5F], ah :760E6816 43 inc ebx :760E6817 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E67AE(C) | :760E6818 7665 jbe 760E687F :760E681A 6E outsb :760E681B 744C je 760E6869 :760E681D 6F outsd :760E681E 67 BYTE 067h :760E681F 67 BYTE 067h :760E6820 65 BYTE 065h :760E6821 722E jb 760E6851 :760E6823 49 dec ecx :760E6824 6E outsb :760E6825 6974206661696C65 imul esi, dword ptr [eax+66], 656C6961 :760E682D 64206563 and byte ptr fs:[ebp+63], ah :760E6831 3D25640090 cmp eax, 90006425 :760E6836 90 nop :760E6837 90 nop :760E6838 43 inc ebx :760E6839 61 popad :760E683A 6E outsb :760E683B 6E outsb :760E683C 6F outsd :760E683D 7420 je 760E685F :760E683F 637265 arpl dword ptr [edx+65], esi :760E6842 61 popad :760E6843 7465 je 760E68AA :760E6845 205346 and byte ptr [ebx+46], dl :760E6848 50 push eax :760E6849 20646972 and byte ptr [ecx+2*ebp+72], ah :760E684D 6563746F72 arpl dword ptr gs:[edi+2*ebp+72], esi :760E6852 7900 jns 760E6854 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6852(C) | :760E6854 43 inc ebx :760E6855 61 popad :760E6856 6E outsb :760E6857 6E outsb :760E6858 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E67E5(C) | :760E6859 7420 je 760E687B :760E685B 666F outsw :760E685D 726D jb 760E68CC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E683D(C) | :760E685F 207061 and byte ptr [eax+61], dh :760E6862 7468 je 760E68CC :760E6864 20666F and byte ptr [esi+6F], ah :760E6867 7220 jb 760E6889 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E681B(C) | :760E6869 7769 ja 760E68D4 :760E686B 6E outsb :760E686C 696E69742E696E imul ebp, dword ptr [esi+69], 6E692E74 :760E6873 690090909043 imul eax, dword ptr [eax], 43909090 :760E6879 61 popad :760E687A 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6859(C) | :760E687B 6E outsb :760E687C 6F outsd :760E687D 7420 je 760E689F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6818(C) | :760E687F 666F outsw :760E6881 726D jb 760E68F0 :760E6883 207366 and byte ptr [ebx+66], dh :760E6886 7064 jo 760E68EC :760E6888 6220 bound esp, dword ptr [eax] :760E688A 66696C65207061 imul bp, word ptr [ebp+20], 6170 :760E6891 7468 je 760E68FB :760E6893 005361 add byte ptr [ebx+61], dl :760E6896 66 BYTE 066h :760E6897 65 BYTE 065h :760E6898 4D dec ebp :760E6899 6F outsd :760E689A 64 BYTE 064h :760E689B 652121 and dword ptr gs:[ecx], esp :760E689E 2120 and dword ptr [eax], esp :760E68A0 2D20536670 sub eax, 70665320 :760E68A5 20646973 and byte ptr [ecx+2*ebp+73], ah :760E68A9 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6843(C) | :760E68AA 626C6564 bound ebp, dword ptr [ebp+64] :760E68AE 009053465020 add byte ptr [eax+20504653], dl :760E68B4 64697361626C6564 imul esi, dword ptr fs:[ebx+61], 64656C62 :760E68BC 00909090456E add byte ptr [eax+6E459090], dl :760E68C2 61 popad :760E68C3 626C696E bound ebp, dword ptr [ecx+2*ebp+6E] :760E68C7 67205346 and [bp+di+46], dl :760E68CB 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E685D(C), :760E6862(C) | :760E68CC 009090905346 add byte ptr [eax+46539090], dl :760E68D2 50 push eax :760E68D3 206973 and byte ptr [ecx+73], ch :760E68D6 20656E and byte ptr [ebp+6E], ah :760E68D9 61 popad :760E68DA 626C6564 bound ebp, dword ptr [ebp+64] :760E68DE 009043616E6E add byte ptr [eax+6E6E6143], dl :760E68E4 6F outsd :760E68E5 7420 je 760E6907 :760E68E7 7265 jb 760E694E :760E68E9 61 popad :760E68EA 64205346 and byte ptr fs:[ebx+46], dl :760E68EE 50 push eax :760E68EF 20666C and byte ptr [esi+6C], ah :760E68F2 61 popad :760E68F3 67206672 and [bp+72], ah :760E68F7 6F outsd :760E68F8 6D insd :760E68F9 207265 and byte ptr [edx+65], dh :760E68FC 6769737472793A20 imul esi, [bp+di+74], 203A7972 :760E6904 65 BYTE 065h :760E6905 7272 jb 760E6979 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E68E5(C) | :760E6907 6F outsd :760E6908 7220 jb 760E692A :760E690A 2530387800 and eax, 00783830 :760E690F 90 nop :760E6910 57 push edi :760E6911 726F jb 760E6982 :760E6913 6E outsb :760E6914 67206B65 and [bp+di+65], ch :760E6918 7920 jns 760E693A :760E691A 7061 jo 760E697D :760E691C 7373 jnb 760E6991 :760E691E 65 BYTE 065h :760E691F 64202D20626169 and byte ptr fs:[69616220], ch :760E6926 6C insb :760E6927 696E6721004361 imul ebp, dword ptr [esi+67], 61430021 :760E692E 6E outsb :760E692F 6E outsb :760E6930 6F outsd :760E6931 7420 je 760E6953 :760E6933 7265 jb 760E699A :760E6935 2D656E6162 sub eax, 62616E65 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6918(C) | :760E693A 6C insb :760E693B 65205346 and byte ptr gs:[ebx+46], dl :760E693F 50 push eax :760E6940 009090905265 add byte ptr [eax+65529090], dl :760E6946 2D656E6162 sub eax, 62616E65 :760E694B 6C insb :760E694C 65 BYTE 065h :760E694D 64205346 and byte ptr fs:[ebx+46], dl :760E6951 50 push eax :760E6952 009053524469 add byte ptr [eax+69445253], dl :760E6958 7361 jnb 760E69BB :760E695A 626C6553 bound ebp, dword ptr [ebp+53] :760E695E 667020 jo 760E6981 :760E6961 6661 popa :760E6963 696C65640043616E imul ebp, dword ptr [ebp+64], 6E614300 :760E696B 6E outsb :760E696C 6F outsd :760E696D 7420 je 760E698F :760E696F 64697361626C6520 imul esi, dword ptr fs:[ebx+61], 20656C62 :760E6977 53 push ebx :760E6978 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6905(C) | :760E6979 50 push eax :760E697A 20696E and byte ptr [ecx+6E], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E691A(C) | :760E697D 207265 and byte ptr [edx+65], dh :760E6980 6769737472793A20 imul esi, [bp+di+74], 203A7972 :760E6988 65 BYTE 065h :760E6989 7272 jb 760E69FD :760E698B 6F outsd :760E698C 7220 jb 760E69AE :760E698E 2530387800 and eax, 00783830 :760E6993 90 nop :760E6994 44 inc esp :760E6995 697361626C6553 imul esi, dword ptr [ebx+61], 53656C62 :760E699C 46 inc esi :760E699D 50 push eax :760E699E 53 push ebx :760E699F 00436F add byte ptr [ebx+6F], al :760E69A2 43 inc ebx :760E69A3 7265 jb 760E6A0A :760E69A5 61 popad :760E69A6 7465 je 760E6A0D :760E69A8 49 dec ecx :760E69A9 6E outsb :760E69AA 7374 jnb 760E6A20 :760E69AC 61 popad :760E69AD 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E698C(C) | :760E69AE 636520 arpl dword ptr [ebp+20], esp :760E69B1 6661 popa :760E69B3 696C65643A206872 imul ebp, dword ptr [ebp+64], 7268203A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6958(C) | :760E69BB 203D20256C64 and byte ptr [646C2520], bh :760E69C1 00909043616E add byte ptr [eax+6E614390], dl :760E69C7 6E outsb :760E69C8 6F outsd :760E69C9 7420 je 760E69EB :760E69CB 6C insb :760E69CC 6F outsd :760E69CD 61 popad :760E69CE 6420646F63 and byte ptr fs:[edi+2*ebp+63], ah :760E69D3 756D jne 760E6A42 :760E69D5 65 BYTE 065h :760E69D6 6E outsb :760E69D7 743A je 760E6A13 :760E69D9 206872 and byte ptr [eax+72], ch :760E69DC 203D20256C64 and byte ptr [646C2520], bh :760E69E2 009043616E6E add byte ptr [eax+6E6E6143], dl :760E69E8 6F outsd :760E69E9 7420 je 760E6A0B :760E69EB 67 BYTE 067h :760E69EC 65 BYTE 065h :760E69ED 7420 je 760E6A0F :760E69EF 5B pop ebx :760E69F0 25535D2069 and eax, 69205D53 :760E69F5 6E outsb :760E69F6 205B25 and byte ptr [ebx+25], bl :760E69F9 735D jnb 760E6A58 :760E69FB 004361 add byte ptr [ebx+61], al :760E69FE 6E outsb :760E69FF 6E outsb :760E6A00 6F outsd :760E6A01 7420 je 760E6A23 :760E6A03 67 BYTE 067h :760E6A04 65 BYTE 065h :760E6A05 7420 je 760E6A27 :760E6A07 6E outsb :760E6A08 6F outsd :760E6A09 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E69A3(C) | :760E6A0A 6520696E and byte ptr gs:[ecx+6E], ch :760E6A0E 20746865 and byte ptr [eax+2*ebp+65], dh :760E6A12 206E6F and byte ptr [esi+6F], ch :760E6A15 64 BYTE 064h :760E6A16 65206C6973 and byte ptr gs:[ecx+2*ebp+73], ch :760E6A1B 7400 je 760E6A1D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6A1B(C) | :760E6A1D 90 nop :760E6A1E 90 nop :760E6A1F 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E69AA(C) | :760E6A20 56 push esi :760E6A21 65 BYTE 065h :760E6A22 7273 jb 760E6A97 :760E6A24 696F6E20496E74 imul ebp, dword ptr [edi+6E], 746E4920 :760E6A2B 36 BYTE 036h :760E6A2C 3420 xor al, 20 :760E6A2E 3D20254936 cmp eax, 36492520 :760E6A33 3478 xor al, 78 :760E6A35 00909043616E add byte ptr [eax+6E614390], dl :760E6A3B 6E outsb :760E6A3C 6F outsd :760E6A3D 7420 je 760E6A5F :760E6A3F 636F6E arpl dword ptr [edi+6E], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E69D3(C) | :760E6A42 7665 jbe 760E6AA9 :760E6A44 7274 jb 760E6ABA :760E6A46 204253 and byte ptr [edx+53], al :760E6A49 54 push esp :760E6A4A 52 push edx :760E6A4B 20746F20 and byte ptr [edi+2*ebp+20], dh :760E6A4F 696E7400905665 imul ebp, dword ptr [esi+74], 65569000 :760E6A56 7273 jb 760E6ACB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E69F9(C) | :760E6A58 696F6E20546578 imul ebp, dword ptr [edi+6E], 78655420 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6A3D(C) | :760E6A5F 7420 je 760E6A81 :760E6A61 3D205B2553 cmp eax, 53255B20 :760E6A66 5D pop ebp :760E6A67 004361 add byte ptr [ebx+61], al :760E6A6A 6E outsb :760E6A6B 6E outsb :760E6A6C 6F outsd :760E6A6D 7420 je 760E6A8F :760E6A6F 67 BYTE 067h :760E6A70 65 BYTE 065h :760E6A71 7420 je 760E6A93 :760E6A73 7665 jbe 760E6ADA :760E6A75 7273 jb 760E6AEA :760E6A77 696F6E20746578 imul ebp, dword ptr [edi+6E], 78657420 :760E6A7E 7400 je 760E6A80 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6A7E(C) | :760E6A80 47 inc edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6A5F(C) | :760E6A81 65 BYTE 065h :760E6A82 7456 je 760E6ADA :760E6A84 65 BYTE 065h :760E6A85 7273 jb 760E6AFA :760E6A87 696F6E46726F6D imul ebp, dword ptr [edi+6E], 6D6F7246 :760E6A8E 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6A6D(C) | :760E6A8F 4D dec ebp :760E6A90 4C dec esp :760E6A91 46 inc esi :760E6A92 696C65009090436F imul ebp, dword ptr [ebp], 6F439090 :760E6A9A 49 dec ecx :760E6A9B 6E outsb :760E6A9C 697469616C697A65 imul esi, dword ptr [ecx+2*ebp+61], 657A696C :760E6AA4 206661 and byte ptr [esi+61], ah :760E6AA7 696C65643A206872 imul ebp, dword ptr [ebp+64], 7268203A :760E6AAF 203D20256C64 and byte ptr [646C2520], bh :760E6AB5 009090497346 add byte ptr [eax+46734990], dl :760E6ABB 696C656C6973744E imul ebp, dword ptr [ebp+6C], 4E747369 :760E6AC3 65 BYTE 065h :760E6AC4 7765 ja 760E6B2B :760E6AC6 7200 jb 760E6AC8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6AC6(C) | :760E6AC8 45 inc ebp :760E6AC9 7272 jb 760E6B3D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6A56(C) | :760E6ACB 6F outsd :760E6ACC 7220 jb 760E6AEE :760E6ACE 636F70 arpl dword ptr [edi+70], ebp :760E6AD1 7969 jns 760E6B3C :760E6AD3 6E outsb :760E6AD4 672025 and [di], ah :760E6AD7 7320 jnb 760E6AF9 :760E6AD9 746F je 760E6B4A :760E6ADB 2025733A2065 and byte ptr [65203A73], ah :760E6AE1 7272 jb 760E6B55 :760E6AE3 6F outsd :760E6AE4 723D jb 760E6B23 :760E6AE6 256C640090 and eax, 9000646C :760E6AEB 90 nop :760E6AEC 43 inc ebx :760E6AED 7265 jb 760E6B54 :760E6AEF 61 popad :760E6AF0 7469 je 760E6B5B :760E6AF2 6E outsb :760E6AF3 67206E65 and [bp+65], ch :760E6AF7 7720 ja 760E6B19 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6AD7(C) | :760E6AF9 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6A85(C) | :760E6AFA 61 popad :760E6AFB 7461 je 760E6B5E :760E6AFD 626173 bound esp, dword ptr [ecx+73] :760E6B00 65206669 and byte ptr gs:[esi+69], ah :760E6B04 6C insb :760E6B05 65206661 and byte ptr gs:[esi+61], ah :760E6B09 696C656400909056 imul ebp, dword ptr [ebp+64], 56909000 :760E6B11 7864 js 760E6B77 :760E6B13 6D insd :760E6B14 6F outsd :760E6B15 6E outsb :760E6B16 2E BYTE 02eh :760E6B17 64 BYTE 064h :760E6B18 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6AF7(C) | :760E6B19 7420 je 760E6B3B :760E6B1B 637265 arpl dword ptr [edx+65], esi :760E6B1E 61 popad :760E6B1F 7469 je 760E6B8A :760E6B21 6F outsd :760E6B22 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6AE4(C) | :760E6B23 206661 and byte ptr [esi+61], ah :760E6B26 696C656400904361 imul ebp, dword ptr [ebp+64], 61439000 :760E6B2E 6E outsb :760E6B2F 6E outsb :760E6B30 6F outsd :760E6B31 7420 je 760E6B53 :760E6B33 666F outsw :760E6B35 726D jb 760E6BA4 :760E6B37 207678 and byte ptr [esi+78], dh :760E6B3A 6420646174 and byte ptr fs:[ecx+74], ah :760E6B3F 206669 and byte ptr [esi+69], ah :760E6B42 6C insb :760E6B43 65207061 and byte ptr gs:[eax+61], dh :760E6B47 7468 je 760E6BB1 :760E6B49 009090257320 add byte ptr [eax+20732590], dl :760E6B4F 6973206E6F7420 imul esi, dword ptr [ebx+20], 20746F6E :760E6B56 61 popad :760E6B57 207369 and byte ptr [ebx+69], dh :760E6B5A 676E outsb :760E6B5C 65 BYTE 065h :760E6B5D 6420616E and byte ptr fs:[ecx+6E], ah :760E6B61 64207661 and byte ptr fs:[esi+61], dh :760E6B65 6C insb :760E6B66 69642066696C656C imul esp, dword ptr [eax+66], 6C656C69 :760E6B6E 69737400909056 imul esi, dword ptr [ebx+74], 56909000 :760E6B75 65 BYTE 065h :760E6B76 7273 jb 760E6BEB :760E6B78 696F6E206F6620 imul ebp, dword ptr [edi+6E], 20666F20 :760E6B7F 6E outsb :760E6B80 65 BYTE 065h :760E6B81 7720 ja 760E6BA3 :760E6B83 58 pop eax :760E6B84 4D dec ebp :760E6B85 4C dec esp :760E6B86 206669 and byte ptr [esi+69], ah :760E6B89 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6B1F(C) | :760E6B8A 65206973 and byte ptr gs:[ecx+73], ch :760E6B8E 206F6C and byte ptr [edi+6C], ch :760E6B91 64 BYTE 064h :760E6B92 65 BYTE 065h :760E6B93 7220 jb 760E6BB5 :760E6B95 7468 je 760E6BFF :760E6B97 61 popad :760E6B98 6E outsb :760E6B99 20746865 and byte ptr [eax+2*ebp+65], dh :760E6B9D 206375 and byte ptr [ebx+75], ah :760E6BA0 7272 jb 760E6C14 :760E6BA2 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6B81(C) | :760E6BA3 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6B35(C) | :760E6BA4 7420 je 760E6BC6 :760E6BA6 6F outsd :760E6BA7 6E outsb :760E6BA8 65202D206E6F74 and byte ptr gs:[746F6E20], ch :760E6BAF 207570 and byte ptr [ebp+70], dh :760E6BB2 64 BYTE 064h :760E6BB3 61 popad :760E6BB4 7469 je 760E6C1F :760E6BB6 6E outsb :760E6BB7 6700909090 add [bx+si+9090], dl :760E6BBC 4E dec esi :760E6BBD 756C jne 760E6C2B :760E6BBF 6C insb :760E6BC0 206669 and byte ptr [esi+69], ah :760E6BC3 6C insb :760E6BC4 65 BYTE 065h :760E6BC5 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6BA4(C) | :760E6BC6 61 popad :760E6BC7 6D insd :760E6BC8 65009090535255 add byte ptr gs:[eax+55525390], dl :760E6BCF 7064 jo 760E6C35 :760E6BD1 61 popad :760E6BD2 7465 je 760E6C39 :760E6BD4 4D dec ebp :760E6BD5 6F outsd :760E6BD6 6E outsb :760E6BD7 69746F7265644C69 imul esi, dword ptr [edi+2*ebp+72], 694C6465 :760E6BDF 7374 jnb 760E6C55 :760E6BE1 53 push ebx :760E6BE2 00904572726F add byte ptr [eax+6F727245], dl :760E6BE8 7220 jb 760E6C0A :760E6BEA 636F70 arpl dword ptr [edi+70], ebp :760E6BED 7969 jns 760E6C58 :760E6BEF 6E outsb :760E6BF0 67206361 and [bp+di+61], ah :760E6BF4 7461 je 760E6C57 :760E6BF6 6C insb :760E6BF7 6F outsd :760E6BF8 6720746F and [si+6F], dh :760E6BFC 206669 and byte ptr [esi+69], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6B95(C) | :760E6BFF 6E outsb :760E6C00 61 popad :760E6C01 6C insb :760E6C02 206C6F63 and byte ptr [edi+2*ebp+63], ch :760E6C06 61 popad :760E6C07 7469 je 760E6C72 :760E6C09 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6BE8(C) | :760E6C0A 6E outsb :760E6C0B 202564009045 and byte ptr [45900064], ah :760E6C11 7272 jb 760E6C85 :760E6C13 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6BA0(C) | :760E6C14 7220 jb 760E6C36 :760E6C16 67 BYTE 067h :760E6C17 65 BYTE 065h :760E6C18 7474 je 760E6C8E :760E6C1A 696E672073686F imul ebp, dword ptr [esi+67], 6F687320 :760E6C21 7274 jb 760E6C97 :760E6C23 207061 and byte ptr [eax+61], dh :760E6C26 7468 je 760E6C90 :760E6C28 6E outsb :760E6C29 61 popad :760E6C2A 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6BBD(C) | :760E6C2B 6520666F and byte ptr gs:[esi+6F], ah :760E6C2F 7220 jb 760E6C51 :760E6C31 7468 je 760E6C9B :760E6C33 65206361 and byte ptr gs:[ebx+61], ah :760E6C37 7461 je 760E6C9A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6BD2(C) | :760E6C39 6C insb :760E6C3A 6F outsd :760E6C3B 67206669 and [bp+69], ah :760E6C3F 6C insb :760E6C40 65 BYTE 065h :760E6C41 2E00904572726F add byte ptr cs:[eax+6F727245], dl :760E6C48 7220 jb 760E6C6A :760E6C4A 43 inc ebx :760E6C4B 7265 jb 760E6CB2 :760E6C4D 61 popad :760E6C4E 7469 je 760E6CB9 :760E6C50 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6C2F(C) | :760E6C51 67204361 and [bp+di+61], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6BDF(C) | :760E6C55 7461 je 760E6CB8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6BF4(C) | :760E6C57 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6BED(C) | :760E6C58 6F outsd :760E6C59 67205465 and [si+65], dl :760E6C5D 6D insd :760E6C5E 7020 jo 760E6C80 :760E6C60 44 inc esp :760E6C61 69726563746F72 imul esi, dword ptr [edx+65], 726F7463 :760E6C68 7920 jns 760E6C8A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6C48(C) | :760E6C6A 2564009090 and eax, 90900064 :760E6C6F 90 nop :760E6C70 45 inc ebp :760E6C71 7870 js 760E6CE3 :760E6C73 61 popad :760E6C74 6E outsb :760E6C75 64 BYTE 064h :760E6C76 45 inc ebp :760E6C77 6E outsb :760E6C78 7669 jbe 760E6CE3 :760E6C7A 726F jb 760E6CEB :760E6C7C 6E outsb :760E6C7D 6D insd :760E6C7E 65 BYTE 065h :760E6C7F 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6C5E(C) | :760E6C80 7453 je 760E6CD5 :760E6C82 7472 je 760E6CF6 :760E6C84 696E6773206661 imul ebp, dword ptr [esi+67], 61662073 :760E6C8B 696C65642045433D imul ebp, dword ptr [ebp+64], 3D434520 :760E6C93 2564009090 and eax, 90900064 :760E6C98 46 inc esi :760E6C99 696C653A20257320 imul ebp, dword ptr [ebp+3A], 20732520 :760E6CA1 64 BYTE 064h :760E6CA2 6F outsd :760E6CA3 65 BYTE 065h :760E6CA4 7320 jnb 760E6CC6 :760E6CA6 6E outsb :760E6CA7 6F outsd :760E6CA8 7420 je 760E6CCA :760E6CAA 65 BYTE 065h :760E6CAB 7869 js 760E6D16 :760E6CAD 7374 jnb 760E6D23 :760E6CAF 005366 add byte ptr [ebx+66], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6C4B(C) | :760E6CB2 7043 jo 760E6CF7 :760E6CB4 6F outsd :760E6CB5 7079 jo 760E6D30 :760E6CB7 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6C55(C) | :760E6CB8 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6C4E(C) | :760E6CB9 7461 je 760E6D1C :760E6CBB 6C insb :760E6CBC 6F outsd :760E6CBD 6700904572 add [bx+si+7245], dl :760E6CC2 726F jb 760E6D33 :760E6CC4 7220 jb 760E6CE6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6CA4(C) | :760E6CC6 307825 xor byte ptr [eax+25], bh :760E6CC9 7820 js 760E6CEB :760E6CCB 7368 jnb 760E6D35 :760E6CCD 7574 jne 760E6D43 :760E6CCF 7469 je 760E6D3A :760E6CD1 6E outsb :760E6CD2 6720646F and [si+6F], ah :760E6CD6 776E ja 760E6D46 :760E6CD8 207379 and byte ptr [ebx+79], dh :760E6CDB 7374 jnb 760E6D51 :760E6CDD 65 BYTE 065h :760E6CDE 6D insd :760E6CDF 004572 add byte ptr [ebp+72], al :760E6CE2 726F jb 760E6D53 :760E6CE4 7220 jb 760E6D06 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6CC4(C) | :760E6CE6 307825 xor byte ptr [eax+25], bh :760E6CE9 783A js 760E6D25 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E6C7A(C), :760E6CC9(C) | :760E6CEB 206361 and byte ptr [ebx+61], ah :760E6CEE 6E outsb :760E6CEF 6E outsb :760E6CF0 6F outsd :760E6CF1 7420 je 760E6D13 :760E6CF3 67 BYTE 067h :760E6CF4 65 BYTE 065h :760E6CF5 7420 je 760E6D17 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6CB2(C) | :760E6CF7 696E7374616E63 imul ebp, dword ptr [esi+73], 636E6174 :760E6CFE 65206861 and byte ptr gs:[eax+61], ch :760E6D02 6E outsb :760E6D03 64 BYTE 064h :760E6D04 6C insb :760E6D05 6500905265626F add byte ptr gs:[eax+6F626552], dl :760E6D0C 6F outsd :760E6D0D 7469 je 760E6D78 :760E6D0F 6E outsb :760E6D10 67207468 and [si+68], dh :760E6D14 65207379 and byte ptr gs:[ebx+79], dh :760E6D18 7374 jnb 760E6D8E :760E6D1A 65 BYTE 065h :760E6D1B 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6CB9(C) | :760E6D1C 009090905468 add byte ptr [eax+68549090], dl :760E6D22 69732069732073 imul esi, dword ptr [ebx+20], 73207369 :760E6D29 687574646F push 6F647475 :760E6D2E 776E ja 760E6D9E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6CB5(C) | :760E6D30 202D20737570 and byte ptr [70757320], ch :760E6D36 7072 jo 760E6DAA :760E6D38 65 BYTE 065h :760E6D39 7373 jnb 760E6DAE :760E6D3B 696E6720646961 imul ebp, dword ptr [esi+67], 61696420 :760E6D42 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6CCD(C) | :760E6D43 6F outsd :760E6D44 6700909044 add [bx+si+4490], dl :760E6D49 6F outsd :760E6D4A 6E outsb :760E6D4B 27 daa :760E6D4C 7420 je 760E6D6E :760E6D4E 6E outsb :760E6D4F 65 BYTE 065h :760E6D50 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6CDB(C) | :760E6D51 6420746F20 and byte ptr fs:[edi+2*ebp+20], dh :760E6D56 7265 jb 760E6DBD :760E6D58 626F6F bound ebp, dword ptr [edi+6F] :760E6D5B 7400 je 760E6D5D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6D5B(C) | :760E6D5D 90 nop :760E6D5E 90 nop :760E6D5F 90 nop :760E6D60 53 push ebx :760E6D61 667052 jo 760E6DB6 :760E6D64 65626F6F bound ebp, dword ptr gs:[edi+6F] :760E6D68 7449 je 760E6DB3 :760E6D6A 664E dec si :760E6D6C 65636573 arpl dword ptr gs:[ebp+73], esp :760E6D70 7361 jnb 760E6DD3 :760E6D72 7279 jb 760E6DED :760E6D74 009090904572 add byte ptr [eax+72459090], dl :760E6D7A 726F jb 760E6DEB :760E6D7C 7220 jb 760E6D9E :760E6D7E 636C6561 arpl dword ptr [ebp+61], ebp :760E6D82 6E outsb :760E6D83 696E6720757020 imul ebp, dword ptr [esi+67], 20707520 :760E6D8A 7366 jnb 760E6DF2 :760E6D8C 7020 jo 760E6DAE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6D18(C) | :760E6D8E 646200 bound eax, dword ptr fs:[eax] :760E6D91 90 nop :760E6D92 90 nop :760E6D93 90 nop :760E6D94 43 inc ebx :760E6D95 61 popad :760E6D96 6E outsb :760E6D97 6E outsb :760E6D98 6F outsd :760E6D99 7420 je 760E6DBB :760E6D9B 636C6F73 arpl dword ptr [edi+2*ebp+73], ebp :760E6D9F 65206372 and byte ptr gs:[ebx+72], ah :760E6DA3 7970 jns 760E6E15 :760E6DA5 746F je 760E6E16 :760E6DA7 20646220 and byte ptr [edx+20], ah :760E6DAB 636F6E arpl dword ptr [edi+6E], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E6D39(C), :760E6D8C(C) | :760E6DAE 7465 je 760E6E15 :760E6DB0 7874 js 760E6E26 :760E6DB2 009043616E6E add byte ptr [eax+6E6E6143], dl :760E6DB8 6F outsd :760E6DB9 7420 je 760E6DDB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6D99(C) | :760E6DBB 7368 jnb 760E6E25 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6D56(C) | :760E6DBD 7574 jne 760E6E33 :760E6DBF 64 BYTE 064h :760E6DC0 6F outsd :760E6DC1 776E ja 760E6E31 :760E6DC3 207270 and byte ptr [edx+70], dh :760E6DC6 6320 arpl dword ptr [eax], esp :760E6DC8 7365 jnb 760E6E2F :760E6DCA 7276 jb 760E6E42 :760E6DCC 65 BYTE 065h :760E6DCD 7200 jb 760E6DCF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6DCD(C) | :760E6DCF 90 nop :760E6DD0 53 push ebx :760E6DD1 667053 jo 760E6E27 :760E6DD4 687574446F push 6F447475 :760E6DD9 776E ja 760E6E49 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6DB9(C) | :760E6DDB 004372 add byte ptr [ebx+72], al :760E6DDE 7970 jns 760E6E50 :760E6DE0 7443 je 760E6E25 :760E6DE2 41 inc ecx :760E6DE3 54 push esp :760E6DE4 41 inc ecx :760E6DE5 64 BYTE 064h :760E6DE6 6D insd :760E6DE7 696E4163717569 imul ebp, dword ptr [esi+41], 69757163 :760E6DEE 7265 jb 760E6E55 :760E6DF0 43 inc ebx :760E6DF1 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6D8A(C) | :760E6DF2 6E outsb :760E6DF3 7465 je 760E6E5A :760E6DF5 7874 js 760E6E6B :760E6DF7 2829 sub byte ptr [ecx], ch :760E6DF9 206661 and byte ptr [esi+61], ah :760E6DFC 696C65642C206563 imul ebp, dword ptr [ebp+64], 6365202C :760E6E04 3D25640045 cmp eax, 45006425 :760E6E09 7272 jb 760E6E7D :760E6E0B 6F outsd :760E6E0C 7220 jb 760E6E2E :760E6E0E 7265 jb 760E6E75 :760E6E10 6C insb :760E6E11 65 BYTE 065h :760E6E12 61 popad :760E6E13 7369 jnb 760E6E7E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E6DA3(C), :760E6DAE(C) | :760E6E15 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6DA5(C) | :760E6E16 67207468 and [si+68], dh :760E6E1A 65206372 and byte ptr gs:[ebx+72], ah :760E6E1E 7970 jns 760E6E90 :760E6E20 746F je 760E6E91 :760E6E22 20636F and byte ptr [ebx+6F], ah * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E6DBB(C), :760E6DE0(C) | :760E6E25 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6DB0(C) | :760E6E26 7465 je 760E6E8D :760E6E28 7874 js 760E6E9E :760E6E2A 2E00496E add byte ptr cs:[ecx+6E], cl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6E0C(C) | :760E6E2E 697443727970746F imul esi, dword ptr [ebx+2*eax+72], 6F747079 :760E6E36 44 inc esp :760E6E37 62436F bound eax, dword ptr [ebx+6F] :760E6E3A 6E outsb :760E6E3B 7465 je 760E6EA2 :760E6E3D 7874 js 760E6EB3 :760E6E3F 004372 add byte ptr [ebx+72], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6DCA(C) | :760E6E42 7970 jns 760E6EB4 :760E6E44 7443 je 760E6E89 :760E6E46 41 inc ecx :760E6E47 54 push esp :760E6E48 41 inc ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6DD9(C) | :760E6E49 64 BYTE 064h :760E6E4A 6D insd :760E6E4B 696E52656C6561 imul ebp, dword ptr [esi+52], 61656C65 :760E6E52 7365 jnb 760E6EB9 :760E6E54 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6DEE(C) | :760E6E55 6F outsd :760E6E56 6E outsb :760E6E57 7465 je 760E6EBE :760E6E59 7874 js 760E6ECF :760E6E5B 2829 sub byte ptr [ecx], ch :760E6E5D 206661 and byte ptr [esi+61], ah :760E6E60 696C65642C206563 imul ebp, dword ptr [ebp+64], 6365202C :760E6E68 3D25640052 cmp eax, 52006425 :760E6E6D 65 BYTE 065h :760E6E6E 6C insb :760E6E6F 65 BYTE 065h :760E6E70 61 popad :760E6E71 7369 jnb 760E6EDC :760E6E73 6E outsb :760E6E74 67204E55 and [bp+55], cl :760E6E78 4C dec esp :760E6E79 4C dec esp :760E6E7A 206372 and byte ptr [ebx+72], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6E09(C) | :760E6E7D 7970 jns 760E6EEF :760E6E7F 746F je 760E6EF0 :760E6E81 206164 and byte ptr [ecx+64], ah :760E6E84 6D insd :760E6E85 696E20636F6E74 imul ebp, dword ptr [esi+20], 746E6F63 :760E6E8C 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6E26(C) | :760E6E8D 7874 js 760E6F03 :760E6E8F 2E009090905265 add byte ptr cs:[eax+65529090], dl :760E6E96 6C insb :760E6E97 65 BYTE 065h :760E6E98 61 popad :760E6E99 7365 jnb 760E6F00 :760E6E9B 43 inc ebx :760E6E9C 7279 jb 760E6F17 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6E28(C) | :760E6E9E 7074 jo 760E6F14 :760E6EA0 6F outsd :760E6EA1 44 inc esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6E3B(C) | :760E6EA2 62436F bound eax, dword ptr [ebx+6F] :760E6EA5 6E outsb :760E6EA6 7465 je 760E6F0D :760E6EA8 7874 js 760E6F1E :760E6EAA 009043727970 add byte ptr [eax+70797243], dl :760E6EB0 7443 je 760E6EF5 :760E6EB2 41 inc ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6E3D(C) | :760E6EB3 54 push esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6E42(C) | :760E6EB4 41 inc ecx :760E6EB5 64 BYTE 064h :760E6EB6 6D insd :760E6EB7 696E43616C6348 imul ebp, dword ptr [esi+43], 48636C61 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6E57(C) | :760E6EBE 61 popad :760E6EBF 7368 jnb 760E6F29 :760E6EC1 46 inc esi :760E6EC2 726F jb 760E6F33 :760E6EC4 6D insd :760E6EC5 46 inc esi :760E6EC6 696C6548616E646C imul ebp, dword ptr [ebp+48], 6C646E61 :760E6ECE 652829 sub byte ptr gs:[ecx], ch :760E6ED1 6661 popa :760E6ED3 696C65642C206563 imul ebp, dword ptr [ebp+64], 6365202C :760E6EDB 3D25640090 cmp eax, 90006425 :760E6EE0 4E dec esi :760E6EE1 6F outsd :760E6EE2 7420 je 760E6F04 :760E6EE4 65 BYTE 065h :760E6EE5 6E outsb :760E6EE6 6F outsd :760E6EE7 7567 jne 760E6F50 :760E6EE9 68206D656D push 6D656D20 :760E6EEE 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6E7D(C) | :760E6EEF 7279 jb 760E6F6A :760E6EF1 20746F20 and byte ptr [edi+2*ebp+20], dh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6EB0(C) | :760E6EF5 7665 jbe 760E6F5C :760E6EF7 7269 jb 760E6F62 :760E6EF9 667920 jns 760E6F1C :760E6EFC 66696C65207369 imul bp, word ptr [ebp+20], 6973 :760E6F03 676E outsb :760E6F05 61 popad :760E6F06 7475 je 760E6F7D :760E6F08 7265 jb 760E6F6F :760E6F0A 009043726561 add byte ptr [eax+61657243], dl :760E6F10 7465 je 760E6F77 :760E6F12 46 inc esi :760E6F13 696C65206661696C imul ebp, dword ptr [ebp+20], 6C696166 :760E6F1B 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6EFA(C) | :760E6F1C 64202564009090 and byte ptr fs:[90900064], ah :760E6F23 90 nop :760E6F24 52 push edx :760E6F25 65 BYTE 065h :760E6F26 61 popad :760E6F27 64 BYTE 064h :760E6F28 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6EBF(C) | :760E6F29 696C654861736800 imul ebp, dword ptr [ebp+48], 00687361 :760E6F31 90 nop :760E6F32 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6EC2(C) | :760E6F33 90 nop :760E6F34 57 push edi :760E6F35 696E5665726966 imul ebp, dword ptr [esi+56], 66697265 :760E6F3C 7954 jns 760E6F92 :760E6F3E 7275 jb 760E6FB5 :760E6F40 7374 jnb 760E6FB6 :760E6F42 2831 sub byte ptr [ecx], dh :760E6F44 2920 sub dword ptr [eax], esp :760E6F46 6661 popa :760E6F48 696C65642C206563 imul ebp, dword ptr [ebp+64], 6365202C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6EE7(C) | :760E6F50 3D30782530 cmp eax, 30257830 :760E6F55 387800 cmp byte ptr [eax+00], bh :760E6F58 43 inc ebx :760E6F59 7279 jb 760E6FD4 :760E6F5B 7074 jo 760E6FD1 :760E6F5D 43 inc ebx :760E6F5E 41 inc ecx :760E6F5F 54 push esp :760E6F60 41 inc ecx :760E6F61 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6EF7(C) | :760E6F62 6D insd :760E6F63 696E456E756D43 imul ebp, dword ptr [esi+45], 436D756E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6EEF(C) | :760E6F6A 61 popad :760E6F6B 7461 je 760E6FCE :760E6F6D 6C insb :760E6F6E 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6F08(C) | :760E6F6F 6746 inc esi :760E6F71 726F jb 760E6FE2 :760E6F73 6D insd :760E6F74 48 dec eax :760E6F75 61 popad :760E6F76 7368 jnb 760E6FE0 :760E6F78 2829 sub byte ptr [ecx], ch :760E6F7A 6661 popa :760E6F7C 696C656420666F72 imul ebp, dword ptr [ebp+64], 726F6620 :760E6F84 2028 and byte ptr [eax], ch :760E6F86 257773292C and eax, 2C297377 :760E6F8B 206563 and byte ptr [ebp+63], ah :760E6F8E 3D25640090 cmp eax, 90006425 :760E6F93 90 nop :760E6F94 46 inc esi :760E6F95 61 popad :760E6F96 696C656420746F20 imul ebp, dword ptr [ebp+64], 206F7420 :760E6F9E 64 BYTE 064h :760E6F9F 6F outsd :760E6FA0 20636F and byte ptr [ebx+6F], ah :760E6FA3 6E outsb :760E6FA4 7665 jbe 760E700B :760E6FA6 7273 jb 760E701B :760E6FA8 696F6E2065633D imul ebp, dword ptr [edi+6E], 3D636520 :760E6FAF 2564009090 and eax, 90900064 :760E6FB4 56 push esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6F3E(C) | :760E6FB5 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6F40(C) | :760E6FB6 7269 jb 760E7021 :760E6FB8 667946 jns 760E7001 :760E6FBB 696C654861736800 imul ebp, dword ptr [ebp+48], 00687361 :760E6FC3 90 nop :760E6FC4 56 push esi :760E6FC5 65 BYTE 065h :760E6FC6 7269 jb 760E7031 :760E6FC8 667946 jns 760E7011 :760E6FCB 696C654861736820 imul ebp, dword ptr [ebp+48], 20687361 :760E6FD3 6661 popa :760E6FD5 696C656420256400 imul ebp, dword ptr [ebp+64], 00642520 :760E6FDD 90 nop :760E6FDE 90 nop :760E6FDF 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6F76(C) | :760E6FE0 52 push edx :760E6FE1 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6F71(C) | :760E6FE2 61 popad :760E6FE3 64 BYTE 064h :760E6FE4 46 inc esi :760E6FE5 696C654861736820 imul ebp, dword ptr [ebp+48], 20687361 :760E6FED 6661 popa :760E6FEF 696C656420256400 imul ebp, dword ptr [ebp+64], 00642520 :760E6FF7 90 nop :760E6FF8 3020 xor byte ptr [eax], ah :760E6FFA 42 inc edx :760E6FFB 7974 jns 760E7071 :760E6FFD 65206669 and byte ptr gs:[esi+69], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6FB9(C) | :760E7001 6C insb :760E7002 6520666F and byte ptr gs:[esi+6F], ah :760E7006 756E jne 760E7076 :760E7008 64 BYTE 064h :760E7009 2C20 sub al, 20 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6FA4(C) | :760E700B 7265 jb 760E7072 :760E700D 7475 je 760E7084 :760E700F 726E jb 760E707F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6FC9(C) | :760E7011 696E6720766572 imul ebp, dword ptr [esi+67], 72657620 :760E7018 69667966696C65 imul esp, dword ptr [esi+79], 656C6966 :760E701F 206861 and byte ptr [eax+61], ch :760E7022 7368 jnb 760E708C :760E7024 206661 and byte ptr [esi+61], ah :760E7027 696C65642E009090 imul ebp, dword ptr [ebp+64], 9090002E :760E702F 90 nop :760E7030 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6FC6(C) | :760E7031 696E6446697273 imul ebp, dword ptr [esi+64], 73726946 :760E7038 7446 je 760E7080 :760E703A 696C65206661696C imul ebp, dword ptr [ebp+20], 6C696166 :760E7042 65 BYTE 065h :760E7043 64206563 and byte ptr fs:[ebp+63], ah :760E7047 3D25640090 cmp eax, 90006425 :760E704C 49 dec ecx :760E704D 7346 jnb 760E7095 :760E704F 696C654861736856 imul ebp, dword ptr [ebp+48], 56687361 :760E7057 61 popad :760E7058 6C insb :760E7059 696400494E544552 imul esp, dword ptr [eax+eax+49], 5245544E :760E7061 4E dec esi :760E7062 41 inc ecx :760E7063 4C dec esp :760E7064 204552 and byte ptr [ebp+52], al :760E7067 52 push edx :760E7068 4F dec edi :760E7069 52 push edx :760E706A 0090496E7661 add byte ptr [eax+61766E49], dl :760E7070 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E6FFB(C) | :760E7071 6964204275666665 imul esp, dword ptr [eax+42], 65666675 :760E7079 7220 jb 760E709B :760E707B 41 inc ecx :760E707C 7267 jb 760E70E5 :760E707E 756D jne 760E70ED * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7038(C) | :760E7080 65 BYTE 065h :760E7081 6E outsb :760E7082 7473 je 760E70F7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E700D(C) | :760E7084 2E00909025733A add byte ptr cs:[eax+3A732590], dl :760E708B 0D0A090946 or eax, 4609090A :760E7090 696C652068617320 imul ebp, dword ptr [ebp+20], 20736168 :760E7098 636F72 arpl dword ptr [edi+72], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7079(C) | :760E709B 7265 jb 760E7102 :760E709D 63742076 arpl dword ptr [eax+76], esi :760E70A1 65 BYTE 065h :760E70A2 7273 jb 760E7117 :760E70A4 696F6E2C206275 imul ebp, dword ptr [edi+6E], 7562202C :760E70AB 7420 je 760E70CD :760E70AD 6E outsb :760E70AE 6F outsd :760E70AF 206861 and byte ptr [eax+61], ch :760E70B2 7368 jnb 760E711C :760E70B4 20666F and byte ptr [esi+6F], ah :760E70B7 756E jne 760E7127 :760E70B9 6420696E and byte ptr fs:[ecx+6E], ch :760E70BD 20646174 and byte ptr [ecx+74], ah :760E70C1 61 popad :760E70C2 626173 bound esp, dword ptr [ecx+73] :760E70C5 65 BYTE 065h :760E70C6 2E0025733A0D0A add byte ptr cs:[0A0D3A73], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E70AB(C) | :760E70CD 0909 or dword ptr [ecx], ecx :760E70CF 48 dec eax :760E70D0 61 popad :760E70D1 7368 jnb 760E713B :760E70D3 20666F and byte ptr [esi+6F], ah :760E70D6 756E jne 760E7146 :760E70D8 64 BYTE 064h :760E70D9 2C20 sub al, 20 :760E70DB 627574 bound esi, dword ptr [ebp+74] :760E70DE 20696E and byte ptr [ecx+6E], ch :760E70E1 636F72 arpl dword ptr [edi+72], ebp :760E70E4 7265 jb 760E714B :760E70E6 63742076 arpl dword ptr [eax+76], esi :760E70EA 65 BYTE 065h :760E70EB 7273 jb 760E7160 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E707E(C) | :760E70ED 696F6E206F6620 imul ebp, dword ptr [edi+6E], 20666F20 :760E70F4 66696C652E0090 imul bp, word ptr [ebp+2E], 9000 :760E70FB 90 nop :760E70FC 25733A0D0A and eax, 0A0D3A73 :760E7101 0909 or dword ptr [ecx], ecx :760E7103 46 inc esi :760E7104 696C652056657273 imul ebp, dword ptr [ebp+20], 73726556 :760E710C 696F6E20262048 imul ebp, dword ptr [edi+6E], 48202620 :760E7113 41 inc ecx :760E7114 53 push ebx :760E7115 48 dec eax :760E7116 20646F6E and byte ptr [edi+2*ebp+6E], ah :760E711A 27 daa :760E711B 7420 je 760E713D :760E711D 6D insd :760E711E 61 popad :760E711F 7463 je 760E7184 :760E7121 6820646174 push 74616420 :760E7126 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E70B7(C) | :760E7127 626173 bound esp, dword ptr [ecx+73] :760E712A 65 BYTE 065h :760E712B 2E BYTE 02eh :760E712C 2E00909025733A add byte ptr cs:[eax+3A732590], dl :760E7133 0D0A090954 or eax, 5409090A :760E7138 6869732028 push 28207369 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E711B(C) | :760E713D 7665 jbe 760E71A4 :760E713F 7273 jb 760E71B4 :760E7141 696F6E6C657373 imul ebp, dword ptr [edi+6E], 7373656C :760E7148 2920 sub dword ptr [eax], esp :760E714A 66696C65204841 imul bp, word ptr [ebp+20], 4148 :760E7151 53 push ebx :760E7152 48 dec eax :760E7153 206661 and byte ptr [esi+61], ah :760E7156 696C656420746F20 imul ebp, dword ptr [ebp+64], 206F7420 :760E715E 6D insd :760E715F 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E70EB(C) | :760E7160 7463 je 760E71C5 :760E7162 6820776974 push 74697720 :760E7167 6820746865 push 65687420 :760E716C 20646174 and byte ptr [ecx+74], ah :760E7170 61 popad :760E7171 626173 bound esp, dword ptr [ecx+73] :760E7174 65 BYTE 065h :760E7175 0D0A090928 or eax, 2809090A :760E717A 4D dec ebp :760E717B 69676874206D69 imul esp, dword ptr [edi+68], 696D2074 :760E7182 676874206E6F push 6F6E2074 :760E7188 7420 je 760E71AA :760E718A 626520 bound esp, dword ptr [ebp+20] :760E718D 7369 jnb 760E71F8 :760E718F 676E outsb :760E7191 65 BYTE 065h :760E7192 6420696E and byte ptr fs:[ecx+6E], ch :760E7196 206120 and byte ptr [ecx+20], ah :760E7199 636174 arpl dword ptr [ecx+74], esp :760E719C 61 popad :760E719D 6C insb :760E719E 6F outsd :760E719F 67290A sub [bp+si], ecx :760E71A2 009054686572 add byte ptr [eax+72656854], dl :760E71A8 65207761 and byte ptr gs:[edi+61], dh :760E71AC 7320 jnb 760E71CE :760E71AE 61 popad :760E71AF 6E outsb :760E71B0 20696E and byte ptr [ecx+6E], ch :760E71B3 7465 je 760E721A :760E71B5 726E jb 760E7225 :760E71B7 61 popad :760E71B8 6C insb :760E71B9 20646174 and byte ptr [ecx+74], ah :760E71BD 61 popad :760E71BE 626173 bound esp, dword ptr [ecx+73] :760E71C1 65206572 and byte ptr gs:[ebp+72], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7160(C) | :760E71C5 726F jb 760E7236 :760E71C7 7200 jb 760E71C9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E71C7(C) | :760E71C9 90 nop :760E71CA 90 nop :760E71CB 90 nop :760E71CC 25733A0D0A and eax, 0A0D3A73 :760E71D1 0909 or dword ptr [ecx], ecx :760E71D3 44 inc esp :760E71D4 61 popad :760E71D5 7461 je 760E7238 :760E71D7 626173 bound esp, dword ptr [ecx+73] :760E71DA 652028 and byte ptr gs:[eax], ch :760E71DD 636174 arpl dword ptr [ecx+74], esp :760E71E0 61 popad :760E71E1 6C insb :760E71E2 6F outsd :760E71E3 672920 sub [bx+si], esp :760E71E6 6861732061 push 61207361 :760E71EB 207665 and byte ptr [esi+65], dh :760E71EE 7273 jb 760E7263 :760E71F0 696F6E2C206C6F imul ebp, dword ptr [edi+6E], 6F6C202C :760E71F7 63616C arpl dword ptr [ecx+6C], esp :760E71FA 206669 and byte ptr [esi+69], ah :760E71FD 6C insb :760E71FE 65206861 and byte ptr gs:[eax+61], ch :760E7202 7320 jnb 760E7224 :760E7204 6E outsb :760E7205 6F outsd :760E7206 207665 and byte ptr [esi+65], dh :760E7209 7273 jb 760E727E :760E720B 696F6E2E2E0090 imul ebp, dword ptr [edi+6E], 90002E2E :760E7212 90 nop :760E7213 90 nop :760E7214 25733A0D0A and eax, 0A0D3A73 :760E7219 0909 or dword ptr [ecx], ecx :760E721B 46 inc esi :760E721C 696C652050726F74 imul ebp, dword ptr [ebp+20], 746F7250 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7202(C) | :760E7224 6563746564 arpl dword ptr gs:[ebp+64], esi :760E7229 20696E and byte ptr [ecx+6E], ch :760E722C 204120 and byte ptr [ecx+20], al :760E722F 43 inc ebx :760E7230 61 popad :760E7231 7461 je 760E7294 :760E7233 6C insb :760E7234 6F outsd :760E7235 672C20 sub al, 20 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E71D5(C) | :760E7238 627574 bound esi, dword ptr [ebp+74] :760E723B 20746865 and byte ptr [eax+2*ebp+65], dh :760E723F 206669 and byte ptr [esi+69], ah :760E7242 6C insb :760E7243 6520646F73 and byte ptr gs:[edi+2*ebp+73], ah :760E7248 6E outsb :760E7249 27 daa :760E724A 7420 je 760E726C :760E724C 65 BYTE 065h :760E724D 7869 js 760E72B8 :760E724F 7374 jnb 760E72C5 :760E7251 206C6F63 and byte ptr [edi+2*ebp+63], ch :760E7255 61 popad :760E7256 6C insb :760E7257 6C insb :760E7258 792E jns 760E7288 :760E725A 009053667056 add byte ptr [eax+56706653], dl :760E7260 61 popad :760E7261 6C insb :760E7262 696461746546696C imul esp, dword ptr [ecx+74], 6C694665 :760E726A 65002573206973 add byte ptr gs:[73692073], ah :760E7271 206E6F and byte ptr [esi+6F], ch :760E7274 7420 je 760E7296 :760E7276 61 popad :760E7277 207072 and byte ptr [eax+72], dh :760E727A 6F outsd :760E727B 7465 je 760E72E2 :760E727D 63746564 arpl dword ptr [ebp+64], esi :760E7281 204669 and byte ptr [esi+69], al :760E7284 6C insb :760E7285 65 BYTE 065h :760E7286 2E004361 add byte ptr cs:[ebx+61], al :760E728A 6E outsb :760E728B 6E outsb :760E728C 6F outsd :760E728D 7420 je 760E72AF :760E728F 65 BYTE 065h :760E7290 7870 js 760E7302 :760E7292 61 popad :760E7293 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7231(C) | :760E7294 64202573009090 and byte ptr fs:[90900073], ah :760E729B 90 nop :760E729C 47 inc edi :760E729D 65 BYTE 065h :760E729E 7458 je 760E72F8 :760E72A0 4D dec ebp :760E72A1 4C dec esp :760E72A2 46 inc esi :760E72A3 696C655061746800 imul ebp, dword ptr [ebp+50], 00687461 :760E72AB 90 nop :760E72AC 50 push eax :760E72AD 61 popad :760E72AE 7468 je 760E7318 :760E72B0 206E75 and byte ptr [esi+75], ch :760E72B3 6C insb :760E72B4 6C insb :760E72B5 009090476574 add byte ptr [eax+74654790], dl :760E72BB 44 inc esp :760E72BC 7269 jb 760E7327 :760E72BE 7665 jbe 760E7325 :760E72C0 46 inc esi :760E72C1 726F jb 760E7332 :760E72C3 6D insd :760E72C4 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E724F(C) | :760E72C5 61 popad :760E72C6 7468 je 760E7330 :760E72C8 009090904361 add byte ptr [eax+61439090], dl :760E72CE 6E outsb :760E72CF 6E outsb :760E72D0 6F outsd :760E72D1 7420 je 760E72F3 :760E72D3 637265 arpl dword ptr [edx+65], esi :760E72D6 61 popad :760E72D7 7465 je 760E733E :760E72D9 20646972 and byte ptr [ecx+2*ebp+72], ah :760E72DD 6563746F72 arpl dword ptr gs:[edi+2*ebp+72], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E727B(C) | :760E72E2 7920 jns 760E7304 :760E72E4 2573009043 and eax, 43900073 :760E72E9 61 popad :760E72EA 6E outsb :760E72EB 6E outsb :760E72EC 6F outsd :760E72ED 7420 je 760E730F :760E72EF 6D insd :760E72F0 61 popad :760E72F1 6B652064 imul esp, dword ptr [ebp+20], 00000064 :760E72F5 69722025732073 imul esi, dword ptr [edx+20], 73207325 :760E72FC 7973 jns 760E7371 :760E72FE 7465 je 760E7365 :760E7300 6D insd :760E7301 206869 and byte ptr [eax+69], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E72E2(C) | :760E7304 64 BYTE 064h :760E7305 64 BYTE 064h :760E7306 65 BYTE 065h :760E7307 6E outsb :760E7308 3A20 cmp ah, byte ptr [eax] :760E730A 65 BYTE 065h :760E730B 7272 jb 760E737F :760E730D 6F outsd :760E730E 7220 jb 760E7330 :760E7310 307825 xor byte ptr [eax+25], bh :760E7313 7800 js 760E7315 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7313(C) | :760E7315 90 nop :760E7316 90 nop :760E7317 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E72AE(C) | :760E7318 43 inc ebx :760E7319 61 popad :760E731A 6E outsb :760E731B 6E outsb :760E731C 6F outsd :760E731D 7420 je 760E733F :760E731F 637265 arpl dword ptr [edx+65], esi :760E7322 61 popad :760E7323 7465 je 760E738A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E72BE(C) | :760E7325 20646972 and byte ptr [ecx+2*ebp+72], ah :760E7329 6563746F72 arpl dword ptr gs:[edi+2*ebp+72], esi :760E732E 7920 jns 760E7350 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E72C6(C), :760E730E(C) | :760E7330 25733A2065 and eax, 65203A73 :760E7335 7272 jb 760E73A9 :760E7337 6F outsd :760E7338 7220 jb 760E735A :760E733A 307825 xor byte ptr [eax+25], bh :760E733D 7800 js 760E733F * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E731D(C), :760E733D(C) | :760E733F 90 nop :760E7340 44 inc esp :760E7341 53 push ebx :760E7342 20526F and byte ptr [edx+6F], dl :760E7345 6F outsd :760E7346 7420 je 760E7368 :760E7348 7769 ja 760E73B3 :760E734A 7468 je 760E73B4 :760E734C 206E65 and byte ptr [esi+65], ch :760E734F 7720 ja 760E7371 :760E7351 64 BYTE 064h :760E7352 7269 jb 760E73BD :760E7354 7665 jbe 760E73BB :760E7356 203D20257300 and byte ptr [00732520], bh :760E735C 47 inc edi :760E735D 65 BYTE 065h :760E735E 7453 je 760E73B3 :760E7360 667054 jo 760E73B7 :760E7363 65 BYTE 065h :760E7364 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E72FE(C) | :760E7365 7044 jo 760E73AB :760E7367 69720090902563 imul esi, dword ptr [edx+00], 63259090 :760E736E 3A5C2573 cmp bl, byte ptr [ebp+73] :760E7372 00904572726F add byte ptr [eax+6F727245], dl :760E7378 7220 jb 760E739A :760E737A 67 BYTE 067h :760E737B 65 BYTE 065h :760E737C 7474 je 760E73F2 :760E737E 696E672066696C imul ebp, dword ptr [esi+67], 6C696620 :760E7385 65 BYTE 065h :760E7386 6E outsb :760E7387 61 popad :760E7388 6D insd :760E7389 65206672 and byte ptr gs:[esi+72], ah :760E738D 6F outsd :760E738E 6D insd :760E738F 207061 and byte ptr [eax+61], dh :760E7392 7468 je 760E73FC :760E7394 202573004361 and byte ptr [61430073], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7378(C) | :760E739A 6E outsb :760E739B 6E outsb :760E739C 6F outsd :760E739D 7420 je 760E73BF :760E739F 67 BYTE 067h :760E73A0 65 BYTE 065h :760E73A1 7420 je 760E73C3 :760E73A3 53 push ebx :760E73A4 46 inc esi :760E73A5 50 push eax :760E73A6 2074656D and byte ptr [ebp+6D], dh :760E73AA 7020 jo 760E73CC :760E73AC 646972004D616B65 imul esi, dword ptr fs:[edx+00], 656B614D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E734A(C) | :760E73B4 54 push esp :760E73B5 65 BYTE 065h :760E73B6 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7361(C) | :760E73B7 7046 jo 760E73FF :760E73B9 696C65496E536670 imul ebp, dword ptr [ebp+49], 7066536E :760E73C1 44 inc esp :760E73C2 69720090909042 imul esi, dword ptr [edx+00], 42909090 :760E73C9 7569 jne 760E7434 :760E73CB 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E73AA(C) | :760E73CC 64 BYTE 064h :760E73CD 53 push ebx :760E73CE 46 inc esi :760E73CF 50 push eax :760E73D0 54 push esp :760E73D1 61 popad :760E73D2 626C6546 bound ebp, dword ptr [ebp+46] :760E73D6 726F jb 760E7447 :760E73D8 6D insd :760E73D9 44 inc esp :760E73DA 61 popad :760E73DB 7461 je 760E743E :760E73DD 46 inc esi :760E73DE 696C65206661696C imul ebp, dword ptr [ebp+20], 6C696166 :760E73E6 65 BYTE 065h :760E73E7 64009090904361 add byte ptr fs:[eax+61439090], dl :760E73EE 6E outsb :760E73EF 6E outsb :760E73F0 6F outsd :760E73F1 7420 je 760E7413 :760E73F3 67 BYTE 067h :760E73F4 65 BYTE 065h :760E73F5 7420 je 760E7417 :760E73F7 7772 ja 760E746B :760E73F9 697465206C6F636B imul esi, dword ptr [ebp+20], 6B636F6C :760E7401 009090536670 add byte ptr [eax+70665390], dl :760E7407 43 inc ebx :760E7408 7265 jb 760E746F :760E740A 61 popad :760E740B 7465 je 760E7472 :760E740D 53 push ebx :760E740E 667044 jo 760E7455 :760E7411 6200 bound eax, dword ptr [eax] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E73F1(C) | :760E7413 90 nop :760E7414 43 inc ebx :760E7415 61 popad :760E7416 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E73F5(C) | :760E7417 6E outsb :760E7418 6F outsd :760E7419 7420 je 760E743B :760E741B 7772 ja 760E748F :760E741D 6974652053667044 imul esi, dword ptr [ebp+20], 44706653 :760E7425 624861 bound ecx, dword ptr [eax+61] :760E7428 7368 jnb 760E7492 :760E742A 207661 and byte ptr [esi+61], dh :760E742D 6C insb :760E742E 7565 jne 760E7495 :760E7430 20746F20 and byte ptr [edi+2*ebp+20], dh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E73C9(C) | :760E7434 7265 jb 760E749B :760E7436 6769737472793A20 imul esi, [bp+di+74], 203A7972 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E73DB(C) | :760E743E 65 BYTE 065h :760E743F 7272 jb 760E74B3 :760E7441 6F outsd :760E7442 7220 jb 760E7464 :760E7444 2530387800 and eax, 00783830 :760E7449 90 nop :760E744A 90 nop :760E744B 90 nop :760E744C 45 inc ebp :760E744D 7272 jb 760E74C1 :760E744F 6F outsd :760E7450 7220 jb 760E7472 :760E7452 7772 ja 760E74C6 :760E7454 6974696E6720746F imul esi, dword ptr [ecx+2*ebp+6E], 6F742067 :760E745C 20646220 and byte ptr [edx+20], ah :760E7460 66696C65009090 imul bp, word ptr [ebp], 9090 :760E7467 90 nop :760E7468 43 inc ebx :760E7469 61 popad :760E746A 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E73F7(C) | :760E746B 6E outsb :760E746C 6F outsd :760E746D 7420 je 760E748F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7408(C) | :760E746F 637265 arpl dword ptr [edx+65], esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E740B(C), :760E7450(C) | :760E7472 61 popad :760E7473 7465 je 760E74DA :760E7475 205346 and byte ptr [ebx+46], dl :760E7478 50 push eax :760E7479 20646972 and byte ptr [ecx+2*ebp+72], ah :760E747D 00909043616E add byte ptr [eax+6E614390], dl :760E7483 6E outsb :760E7484 6F outsd :760E7485 7420 je 760E74A7 :760E7487 67 BYTE 067h :760E7488 65 BYTE 065h :760E7489 7420 je 760E74AB :760E748B 7265 jb 760E74F2 :760E748D 61 popad :760E748E 64206C6F63 and byte ptr fs:[edi+2*ebp+63], ch :760E7493 6B0090 imul eax, dword ptr [eax], FFFFFF90 :760E7496 90 nop :760E7497 90 nop :760E7498 53 push ebx :760E7499 667050 jo 760E74EC :760E749C 65 BYTE 065h :760E749D 7273 jb 760E7512 :760E749F 69737453667044 imul esi, dword ptr [ebx+74], 44706653 :760E74A6 6200 bound eax, dword ptr [eax] :760E74A8 43 inc ebx :760E74A9 6F outsd :760E74AA 756C jne 760E7518 :760E74AC 64206E6F and byte ptr fs:[esi+6F], ch :760E74B0 7420 je 760E74D2 :760E74B2 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E743F(C) | :760E74B3 65 BYTE 065h :760E74B4 6C insb :760E74B5 65 BYTE 065h :760E74B6 7465 je 760E751D :760E74B8 206669 and byte ptr [esi+69], ah :760E74BB 6C insb :760E74BC 65202573009090 and byte ptr gs:[90900073], ah :760E74C3 90 nop :760E74C4 44 inc esp :760E74C5 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7452(C) | :760E74C6 6C insb :760E74C7 65 BYTE 065h :760E74C8 7465 je 760E752F :760E74CA 64206669 and byte ptr fs:[esi+69], ah :760E74CE 6C insb :760E74CF 65202573004465 and byte ptr gs:[65440073], ah :760E74D6 6C insb :760E74D7 65 BYTE 065h :760E74D8 7465 je 760E753F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7473(C) | :760E74DA 57 push edi :760E74DB 6974685472616365 imul esi, dword ptr [eax+2*ebp+54], 65636172 :760E74E3 004669 add byte ptr [esi+69], al :760E74E6 6C insb :760E74E7 652025733A2044 and byte ptr gs:[44203A73], ah :760E74EE 6220 bound esp, dword ptr [eax] :760E74F0 7665 jbe 760E7557 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E748B(C) | :760E74F2 7220 jb 760E7514 :760E74F4 2549363478 and eax, 78343649 :760E74F9 2021 and byte ptr [ecx], ah :760E74FB 3D2074656D cmp eax, 6D657420 :760E7500 7066 jo 760E7568 :760E7502 696C652076657220 imul ebp, dword ptr [ebp+20], 20726576 :760E750A 2549363478 and eax, 78343649 :760E750F 004368 add byte ptr [ebx+68], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E749D(C) | :760E7512 65636B46 arpl dword ptr gs:[ebx+46], ebp :760E7516 696C655665727369 imul ebp, dword ptr [ebp+56], 69737265 :760E751E 6F outsd :760E751F 6E outsb :760E7520 41 inc ecx :760E7521 6E outsb :760E7522 64 BYTE 064h :760E7523 48 dec eax :760E7524 61 popad :760E7525 7368 jnb 760E758F :760E7527 005366 add byte ptr [ebx+66], dl :760E752A 7047 jo 760E7573 :760E752C 65 BYTE 065h :760E752D 7452 je 760E7581 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E74C8(C) | :760E752F 69676874566572 imul esp, dword ptr [edi+68], 72655674 :760E7536 7369 jnb 760E75A1 :760E7538 6F outsd :760E7539 6E outsb :760E753A 4F dec edi :760E753B 6646 inc si :760E753D 696C650090909045 imul ebp, dword ptr [ebp], 45909090 :760E7545 7272 jb 760E75B9 :760E7547 6F outsd :760E7548 7220 jb 760E756A :760E754A 61 popad :760E754B 7263 jb 760E75B0 :760E754D 686976696E push 6E697669 :760E7552 67206669 and [bp+69], ah :760E7556 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E74F0(C) | :760E7557 65206563 and byte ptr gs:[ebp+63], ah :760E755B 3D25640090 cmp eax, 90006425 :760E7560 45 inc ebp :760E7561 7272 jb 760E75D5 :760E7563 6F outsd :760E7564 7220 jb 760E7586 :760E7566 67 BYTE 067h :760E7567 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7500(C) | :760E7568 7474 je 760E75DE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7548(C) | :760E756A 696E6720746F20 imul ebp, dword ptr [esi+67], 206F7420 :760E7571 7468 je 760E75DB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E752A(C) | :760E7573 65207368 and byte ptr gs:[ebx+68], dh :760E7577 6F outsd :760E7578 7274 jb 760E75EE :760E757A 207061 and byte ptr [eax+61], dh :760E757D 7468 je 760E75E7 :760E757F 206E61 and byte ptr [esi+61], ch :760E7582 6D insd :760E7583 652000 and byte ptr gs:[eax], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7564(C) | :760E7586 90 nop :760E7587 90 nop :760E7588 46 inc esi :760E7589 696C6520646F6573 imul ebp, dword ptr [ebp+20], 73656F64 :760E7591 206E6F and byte ptr [esi+6F], ch :760E7594 7420 je 760E75B6 :760E7596 65 BYTE 065h :760E7597 7869 js 760E7602 :760E7599 7374 jnb 760E760F :760E759B 2E204E6F and byte ptr cs:[esi+6F], cl :760E759F 206E65 and byte ptr [esi+65], ch :760E75A2 65 BYTE 065h :760E75A3 6420746F20 and byte ptr fs:[edi+2*ebp+20], dh :760E75A8 626163 bound esp, dword ptr [ecx+63] :760E75AB 6B75702E imul esi, dword ptr [ebp+70], 0000002E :760E75AF 005346 add byte ptr [ebx+46], dl :760E75B2 50 push eax :760E75B3 42 inc edx :760E75B4 61 popad :760E75B5 636B75 arpl dword ptr [ebx+75], ebp :760E75B8 7046 jo 760E7600 :760E75BA 696C650090904669 imul ebp, dword ptr [ebp], 69469090 :760E75C2 6C insb :760E75C3 65202573206973 and byte ptr gs:[73692073], ah :760E75CA 20696E and byte ptr [ecx+6E], ch :760E75CD 207573 and byte ptr [ebp+73], dh :760E75D0 65 BYTE 065h :760E75D1 2E205346 and byte ptr cs:[ebx+46], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7561(C) | :760E75D5 50 push eax :760E75D6 206D61 and byte ptr [ebp+61], ch :760E75D9 64 BYTE 064h :760E75DA 6520616E and byte ptr gs:[ecx+6E], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7568(C) | :760E75DE 20656E and byte ptr [ebp+6E], ah :760E75E1 7472 je 760E7655 :760E75E3 7920 jns 760E7605 :760E75E5 696E746F207769 imul ebp, dword ptr [esi+74], 6977206F :760E75EC 6E outsb :760E75ED 696E69742E696E imul ebp, dword ptr [esi+69], 6E692E74 :760E75F4 6920746F2072 imul esp, dword ptr [eax], 72206F74 :760E75FA 65 BYTE 065h :760E75FB 7374 jnb 760E7671 :760E75FD 6F outsd :760E75FE 7265 jb 760E7665 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E75B8(C) | :760E7600 20746865 and byte ptr [eax+2*ebp+65], dh :760E7604 206669 and byte ptr [esi+69], ah :760E7607 6C insb :760E7608 6500909057726F add byte ptr gs:[eax+6F725790], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7599(C) | :760E760F 7465 je 760E7676 :760E7611 206669 and byte ptr [esi+69], ah :760E7614 6C insb :760E7615 65207265 and byte ptr gs:[edx+65], dh :760E7619 6E outsb :760E761A 61 popad :760E761B 6D insd :760E761C 6520746F20 and byte ptr gs:[edi+2*ebp+20], dh :760E7621 7769 ja 760E768C :760E7623 6E outsb :760E7624 696E69742E696E imul ebp, dword ptr [esi+69], 6E692E74 :760E762B 690090909053 imul eax, dword ptr [eax], 53909090 :760E7631 46 inc esi :760E7632 50 push eax :760E7633 206361 and byte ptr [ebx+61], ah :760E7636 6E outsb :760E7637 6E outsb :760E7638 6F outsd :760E7639 7420 je 760E765B :760E763B 7265 jb 760E76A2 :760E763D 7374 jnb 760E76B3 :760E763F 6F outsd :760E7640 7265 jb 760E76A7 :760E7642 206669 and byte ptr [esi+69], ah :760E7645 6C insb :760E7646 65202573206261 and byte ptr gs:[61622073], ah :760E764D 636B2E arpl dword ptr [ebx+2E], ebp :760E7650 204572 and byte ptr [ebp+72], al :760E7653 726F jb 760E76C4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E75E1(C) | :760E7655 7220 jb 760E7677 :760E7657 7772 ja 760E76CB :760E7659 6974696E6720746F imul esi, dword ptr [ecx+2*ebp+6E], 6F742067 :760E7661 207769 and byte ptr [edi+69], dh :760E7664 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E75FE(C) | :760E7665 696E69742E696E imul ebp, dword ptr [esi+69], 6E692E74 :760E766C 690090904361 imul eax, dword ptr [eax], 61439090 :760E7672 6E outsb :760E7673 6E outsb :760E7674 6F outsd :760E7675 7420 je 760E7697 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7655(C) | :760E7677 7772 ja 760E76EB :760E7679 69746520746F2077 imul esi, dword ptr [ebp+20], 77206F74 :760E7681 696E696E69742E imul ebp, dword ptr [esi+69], 2E74696E :760E7688 696E690072656E imul ebp, dword ptr [esi+69], 6E657200 :760E768F 61 popad :760E7690 6D insd :760E7691 65009077696E69 add byte ptr gs:[eax+696E6977], dl :760E7698 6E outsb :760E7699 69742E696E690043 imul esi, dword ptr [esi+ebp+69], 4300696E :760E76A1 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E763B(C) | :760E76A2 6E outsb :760E76A3 6E outsb :760E76A4 6F outsd :760E76A5 7420 je 760E76C7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7640(C) | :760E76A7 6D insd :760E76A8 61 popad :760E76A9 6B652074 imul esp, dword ptr [ebp+20], 00000074 :760E76AD 65 BYTE 065h :760E76AE 6D insd :760E76AF 7020 jo 760E76D1 :760E76B1 66696C65207061 imul bp, word ptr [ebp+20], 6170 :760E76B8 7468 je 760E7722 :760E76BA 009053465020 add byte ptr [eax+20504653], dl :760E76C0 63616E arpl dword ptr [ecx+6E], esp :760E76C3 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7653(C) | :760E76C4 6F outsd :760E76C5 7420 je 760E76E7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E76A5(C) | :760E76C7 7265 jb 760E772E :760E76C9 7374 jnb 760E773F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7657(C) | :760E76CB 6F outsd :760E76CC 7265 jb 760E7733 :760E76CE 206669 and byte ptr [esi+69], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E76AF(C) | :760E76D1 6C insb :760E76D2 65202573206261 and byte ptr gs:[61622073], ah :760E76D9 636B2E arpl dword ptr [ebx+2E], ebp :760E76DC 204572 and byte ptr [ebp+72], al :760E76DF 726F jb 760E7750 :760E76E1 7220 jb 760E7703 :760E76E3 6D insd :760E76E4 61 popad :760E76E5 6B696E67 imul ebp, dword ptr [ecx+6E], 00000067 :760E76E9 20636F and byte ptr [ebx+6F], ah :760E76EC 7079 jo 760E7767 :760E76EE 206F66 and byte ptr [edi+66], ch :760E76F1 206669 and byte ptr [esi+69], ah :760E76F4 6C insb :760E76F5 6520666F and byte ptr gs:[esi+6F], ah :760E76F9 7220 jb 760E771B :760E76FB 7772 ja 760E776F :760E76FD 6974696E6720746F imul esi, dword ptr [ecx+2*ebp+6E], 6F742067 :760E7705 207769 and byte ptr [edi+69], dh :760E7708 6E outsb :760E7709 696E69742E696E imul ebp, dword ptr [esi+69], 6E692E74 :760E7710 690090904361 imul eax, dword ptr [eax], 61439090 :760E7716 6E outsb :760E7717 6E outsb :760E7718 6F outsd :760E7719 7420 je 760E773B :760E771B 67 BYTE 067h :760E771C 65 BYTE 065h :760E771D 7420 je 760E773F :760E771F 64 BYTE 064h :760E7720 7269 jb 760E778B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E76B8(C) | :760E7722 7665 jbe 760E7789 :760E7724 206672 and byte ptr [esi+72], ah :760E7727 6F outsd :760E7728 6D insd :760E7729 206669 and byte ptr [esi+69], ah :760E772C 6C insb :760E772D 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E76C7(C) | :760E772E 6E outsb :760E772F 61 popad :760E7730 6D insd :760E7731 65202573009090 and byte ptr gs:[90900073], ah :760E7738 53 push ebx :760E7739 46 inc esi :760E773A 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7719(C) | :760E773B 207265 and byte ptr [edx+65], dh :760E773E 7374 jnb 760E77B4 :760E7740 6F outsd :760E7741 7265 jb 760E77A8 :760E7743 64206669 and byte ptr fs:[esi+69], ah :760E7747 6C insb :760E7748 6520257320746F and byte ptr gs:[6F742073], ah :760E774F 207665 and byte ptr [esi+65], dh :760E7752 7273 jb 760E77C7 :760E7754 696F6E20257300 imul ebp, dword ptr [edi+6E], 00732520 :760E775B 90 nop :760E775C 46 inc esi :760E775D 696C6520636F7069 imul ebp, dword ptr [ebp+20], 69706F63 :760E7765 65 BYTE 065h :760E7766 64206261 and byte ptr fs:[edx+61], ah :760E776A 636B00 arpl dword ptr [ebx+00], ebp :760E776D 90 nop :760E776E 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E76FB(C) | :760E776F 90 nop :760E7770 52 push edx :760E7771 65 BYTE 065h :760E7772 7472 je 760E77E6 :760E7774 7969 jns 760E77DF :760E7776 6E outsb :760E7777 6720636F and [bp+di+6F], ah :760E777B 7079 jo 760E77F6 :760E777D 696E672066696C imul ebp, dword ptr [esi+67], 6C696620 :760E7784 65202573009090 and byte ptr gs:[90900073], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7720(C) | :760E778B 90 nop :760E778C 43 inc ebx :760E778D 6F outsd :760E778E 7079 jo 760E7809 :760E7790 46 inc esi :760E7791 696C65206661696C imul ebp, dword ptr [ebp+20], 6C696166 :760E7799 65 BYTE 065h :760E779A 643A20 cmp ah, byte ptr fs:[eax] :760E779D 65 BYTE 065h :760E779E 7272 jb 760E7812 :760E77A0 6F outsd :760E77A1 7220 jb 760E77C3 :760E77A3 2530387800 and eax, 00783830 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7741(C) | :760E77A8 43 inc ebx :760E77A9 6F outsd :760E77AA 7079 jo 760E7825 :760E77AC 696E672074656D imul ebp, dword ptr [esi+67], 6D657420 :760E77B3 7020 jo 760E77D5 :760E77B5 66696C65202573 imul bp, word ptr [ebp+20], 7325 :760E77BC 20746F20 and byte ptr [edi+2*ebp+20], dh :760E77C0 257300904F and eax, 4F900073 :760E77C5 7269 jb 760E7830 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7752(C) | :760E77C7 67696E616C206669 imul ebp, [bp+61], 6966206C :760E77CF 6C insb :760E77D0 65206861 and byte ptr gs:[eax+61], ch :760E77D4 7320 jnb 760E77F6 :760E77D6 696E76616C6964 imul ebp, dword ptr [esi+76], 64696C61 :760E77DD 206861 and byte ptr [eax+61], ch :760E77E0 7368 jnb 760E784A :760E77E2 00904F726967 add byte ptr [eax+6769724F], dl :760E77E8 696E616C206669 imul ebp, dword ptr [esi+61], 6966206C :760E77EF 6C insb :760E77F0 65206861 and byte ptr gs:[eax+61], ch :760E77F4 7320 jnb 760E7816 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E777B(C), :760E77D4(C) | :760E77F6 696E76616C6964 imul ebp, dword ptr [esi+76], 64696C61 :760E77FD 207665 and byte ptr [esi+65], dh :760E7800 7273 jb 760E7875 :760E7802 696F6E20009053 imul ebp, dword ptr [edi+6E], 53900020 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E778E(C) | :760E7809 46 inc esi :760E780A 50 push eax :760E780B 206361 and byte ptr [ebx+61], ah :760E780E 6E outsb :760E780F 6E outsb :760E7810 6F outsd :760E7811 7420 je 760E7833 :760E7813 7265 jb 760E787A :760E7815 7374 jnb 760E788B :760E7817 6F outsd :760E7818 7265 jb 760E787F :760E781A 206669 and byte ptr [esi+69], ah :760E781D 6C insb :760E781E 65202573206261 and byte ptr gs:[61622073], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E77AA(C) | :760E7825 636B2E arpl dword ptr [ebx+2E], ebp :760E7828 2000 and byte ptr [eax], al :760E782A 90 nop :760E782B 90 nop :760E782C 53 push ebx :760E782D 46 inc esi :760E782E 50 push eax :760E782F 206361 and byte ptr [ebx+61], ah :760E7832 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7811(C) | :760E7833 6E outsb :760E7834 6F outsd :760E7835 7420 je 760E7857 :760E7837 7265 jb 760E789E :760E7839 7374 jnb 760E78AF :760E783B 6F outsd :760E783C 7265 jb 760E78A3 :760E783E 206669 and byte ptr [esi+69], ah :760E7841 6C insb :760E7842 65202573206261 and byte ptr gs:[61622073], ah :760E7849 636B2E arpl dword ptr [ebx+2E], ebp :760E784C 2054656D and byte ptr [ebp+6D], dl :760E7850 7020 jo 760E7872 :760E7852 66696C65206E6F imul bp, word ptr [ebp+20], 6F6E :760E7859 7420 je 760E787B :760E785B 7661 jbe 760E78BE :760E785D 6C insb :760E785E 6964009090904361 imul esp, dword ptr [eax+eax-70], 61439090 :760E7866 6E outsb :760E7867 6E outsb :760E7868 6F outsd :760E7869 7420 je 760E788B :760E786B 67 BYTE 067h :760E786C 65 BYTE 065h :760E786D 7420 je 760E788F :760E786F 7665 jbe 760E78D6 :760E7871 7273 jb 760E78E6 :760E7873 696F6E20666F72 imul ebp, dword ptr [edi+6E], 726F6620 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7813(C) | :760E787A 202573009090 and byte ptr [90900073], ah :760E7880 53 push ebx :760E7881 46 inc esi :760E7882 50 push eax :760E7883 206361 and byte ptr [ebx+61], ah :760E7886 6E outsb :760E7887 6E outsb :760E7888 6F outsd :760E7889 7420 je 760E78AB * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E7815(C), :760E7869(C) | :760E788B 7265 jb 760E78F2 :760E788D 7374 jnb 760E7903 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E786D(C) | :760E788F 6F outsd :760E7890 7265 jb 760E78F7 :760E7892 206669 and byte ptr [esi+69], ah :760E7895 6C insb :760E7896 65202573206261 and byte ptr gs:[61622073], ah :760E789D 636B00 arpl dword ptr [ebx+00], ebp :760E78A0 4E dec esi :760E78A1 756C jne 760E790F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E783C(C) | :760E78A3 6C insb :760E78A4 2074656D and byte ptr [ebp+6D], dh :760E78A8 7020 jo 760E78CA :760E78AA 66696C656E616D imul bp, word ptr [ebp+6E], 6D61 :760E78B1 65009053667052 add byte ptr gs:[eax+52706653], dl :760E78B8 65 BYTE 065h :760E78B9 7374 jnb 760E792F :760E78BB 6F outsd :760E78BC 7265 jb 760E7923 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E785B(C) | :760E78BE 43 inc ebx :760E78BF 6F outsd :760E78C0 7272 jb 760E7934 :760E78C2 6563745665 arpl dword ptr gs:[esi+2*edx+65], esi :760E78C7 7273 jb 760E793C :760E78C9 696F6E4F664669 imul ebp, dword ptr [edi+6E], 6946664F :760E78D0 6C insb :760E78D1 65009053667049 add byte ptr gs:[eax+49706653], dl :760E78D8 7346 jnb 760E7920 :760E78DA 696C6550726F7465 imul ebp, dword ptr [ebp+50], 65746F72 :760E78E2 63746564 arpl dword ptr [ebp+64], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7871(C) | :760E78E6 53 push ebx :760E78E7 004661 add byte ptr [esi+61], al :760E78EA 696C656420746F20 imul ebp, dword ptr [ebp+64], 206F7420 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E788B(C) | :760E78F2 636F6E arpl dword ptr [edi+6E], ebp :760E78F5 7665 jbe 760E795C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7890(C) | :760E78F7 7274 jb 760E796D :760E78F9 20257320746F and byte ptr [6F742073], ah :760E78FF 205743 and byte ptr [edi+43], dl :760E7902 48 dec eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E788D(C) | :760E7903 41 inc ecx :760E7904 52 push edx :760E7905 2C20 sub al, 20 :760E7907 65 BYTE 065h :760E7908 7272 jb 760E797C :760E790A 6F outsd :760E790B 7220 jb 760E792D :760E790D 256C640090 and eax, 9000646C :760E7912 90 nop :760E7913 90 nop :760E7914 46 inc esi :760E7915 61 popad :760E7916 696C656420746F20 imul ebp, dword ptr [ebp+64], 206F7420 :760E791E 636F6E arpl dword ptr [edi+6E], ebp :760E7921 7665 jbe 760E7988 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E78BC(C) | :760E7923 7274 jb 760E7999 :760E7925 20255320746F and byte ptr [6F742053], ah :760E792B 20414E and byte ptr [ecx+4E], al :760E792E 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E78B9(C) | :760E792F 49 dec ecx :760E7930 2C20 sub al, 20 :760E7932 65 BYTE 065h :760E7933 7272 jb 760E79A7 :760E7935 6F outsd :760E7936 7220 jb 760E7958 :760E7938 256C640044 and eax, 4400646C :760E793D 6220 bound esp, dword ptr [eax] :760E793F 6861732062 push 62207361 :760E7944 65 BYTE 065h :760E7945 65 BYTE 065h :760E7946 6E outsb :760E7947 206D6F and byte ptr [ebp+6F], ch :760E794A 6469666965640090 imul esp, dword ptr fs:[esi+69], 90006465 :760E7952 90 nop :760E7953 90 nop :760E7954 53 push ebx :760E7955 66634765 arpl word ptr [edi+65], ax :760E7959 744E je 760E79A9 :760E795B 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E78F5(C) | :760E795C 7874 js 760E79D2 :760E795E 50 push eax :760E795F 726F jb 760E79D0 :760E7961 7465 je 760E79C8 :760E7963 63746564 arpl dword ptr [ebp+64], esi :760E7967 46 inc esi :760E7968 696C655300909090 imul ebp, dword ptr [ebp+53], 90909000 :760E7970 46 inc esi :760E7971 6F outsd :760E7972 756E jne 760E79E2 :760E7974 64207665 and byte ptr fs:[esi+65], dh :760E7978 7273 jb 760E79ED :760E797A 696F6E20776520 imul ebp, dword ptr [edi+6E], 20657720 :760E7981 61 popad :760E7982 7265 jb 760E79E9 :760E7984 206C6F6F and byte ptr [edi+2*ebp+6F], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7921(C) | :760E7988 6B696E67 imul ebp, dword ptr [ecx+6E], 00000067 :760E798C 20666F and byte ptr [esi+6F], ah :760E798F 7200 jb 760E7991 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E798F(C) | :760E7991 90 nop :760E7992 90 nop :760E7993 90 nop :760E7994 43 inc ebx :760E7995 7572 jne 760E7A09 :760E7997 65 BYTE 065h :760E7998 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7923(C) | :760E7999 7420 je 760E79BB :760E799B 7665 jbe 760E7A02 :760E799D 7273 jb 760E7A12 :760E799F 696F6E20697320 imul ebp, dword ptr [edi+6E], 20736920 :760E79A6 2549363478 and eax, 78343649 :760E79AB 004669 add byte ptr [esi+69], al :760E79AE 6C insb :760E79AF 65207665 and byte ptr gs:[esi+65], dh :760E79B3 7273 jb 760E7A28 :760E79B5 696F6E20776520 imul ebp, dword ptr [edi+6E], 20657720 :760E79BC 61 popad :760E79BD 7265 jb 760E7A24 :760E79BF 206C6F6F and byte ptr [edi+2*ebp+6F], ch :760E79C3 6B696E67 imul ebp, dword ptr [ecx+6E], 00000067 :760E79C7 20666F and byte ptr [esi+6F], ah :760E79CA 7220 jb 760E79EC :760E79CC 69732025493634 imul esi, dword ptr [ebx+20], 34364925 :760E79D3 7800 js 760E79D5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E79D3(C) | :760E79D5 90 nop :760E79D6 90 nop :760E79D7 90 nop :760E79D8 44 inc esp :760E79D9 6F outsd :760E79DA 65 BYTE 065h :760E79DB 7356 jnb 760E7A33 :760E79DD 65 BYTE 065h :760E79DE 7273 jb 760E7A53 :760E79E0 696F6E45786973 imul ebp, dword ptr [edi+6E], 73697845 :760E79E7 7469 je 760E7A52 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7982(C) | :760E79E9 6E outsb :760E79EA 44 inc esp :760E79EB 42 inc edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E79CA(C) | :760E79EC 009090904372 add byte ptr [eax+72439090], dl :760E79F2 7970 jns 760E7A64 :760E79F4 7443 je 760E7A39 :760E79F6 41 inc ecx :760E79F7 54 push esp :760E79F8 41 inc ecx :760E79F9 64 BYTE 064h :760E79FA 6D insd :760E79FB 696E4164644361 imul ebp, dword ptr [esi+41], 61436464 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E799B(C) | :760E7A02 7461 je 760E7A65 :760E7A04 6C insb :760E7A05 6F outsd :760E7A06 672829 sub [bx+di], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7995(C) | :760E7A09 206661 and byte ptr [esi+61], ah :760E7A0C 696C65642C206563 imul ebp, dword ptr [ebp+64], 6365202C :760E7A14 3D2564004E cmp eax, 4E006425 :760E7A19 6F outsd :760E7A1A 7420 je 760E7A3C :760E7A1C 65 BYTE 065h :760E7A1D 6E outsb :760E7A1E 6F outsd :760E7A1F 7567 jne 760E7A88 :760E7A21 68206D656D push 6D656D20 :760E7A26 6F outsd :760E7A27 7279 jb 760E7AA2 :760E7A29 009090416464 add byte ptr [eax+64644190], dl :760E7A2F 43 inc ebx :760E7A30 61 popad :760E7A31 7461 je 760E7A94 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E79DB(C) | :760E7A33 6C insb :760E7A34 6F outsd :760E7A35 6754 push esp :760E7A37 6F outsd :760E7A38 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E79F4(C) | :760E7A39 7279 jb 760E7AB4 :760E7A3B 7074 jo 760E7AB1 :760E7A3D 6F outsd :760E7A3E 44 inc esp :760E7A3F 42 inc edx :760E7A40 009090905346 add byte ptr [eax+46539090], dl :760E7A46 50 push eax :760E7A47 20636F and byte ptr [ebx+6F], ah :760E7A4A 756C jne 760E7AB8 :760E7A4C 64206E6F and byte ptr fs:[esi+6F], ch :760E7A50 7420 je 760E7A72 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E79E7(C) | :760E7A52 696E7374616C6C imul ebp, dword ptr [esi+73], 6C6C6174 :760E7A59 206361 and byte ptr [ebx+61], ah :760E7A5C 7461 je 760E7ABF :760E7A5E 6C insb :760E7A5F 6F outsd :760E7A60 672025 and [di], ah :760E7A63 732E jnb 760E7A93 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7A02(C) | :760E7A65 205665 and byte ptr [esi+65], dl :760E7A68 7273 jb 760E7ADD :760E7A6A 696F6E206F6620 imul ebp, dword ptr [edi+6E], 20666F20 :760E7A71 636174 arpl dword ptr [ecx+74], esp :760E7A74 61 popad :760E7A75 6C insb :760E7A76 6F outsd :760E7A77 672028 and [bx+si], ch :760E7A7A 2549363478 and eax, 78343649 :760E7A7F 2920 sub dword ptr [eax], esp :760E7A81 6973206C6F7765 imul esi, dword ptr [ebx+20], 65776F6C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7A1F(C) | :760E7A88 7220 jb 760E7AAA :760E7A8A 7468 je 760E7AF4 :760E7A8C 61 popad :760E7A8D 6E outsb :760E7A8E 20746861 and byte ptr [eax+2*ebp+61], dh :760E7A92 7420 je 760E7AB4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7A31(C) | :760E7A94 6F outsd :760E7A95 66206361 and byte ptr [ebx+61], ah :760E7A99 7461 je 760E7AFC :760E7A9B 6C insb :760E7A9C 6F outsd :760E7A9D 6720616C and [bx+di+6C], ah :760E7AA1 7265 jb 760E7B08 :760E7AA3 61 popad :760E7AA4 64 BYTE 064h :760E7AA5 7920 jns 760E7AC7 :760E7AA7 6F outsd :760E7AA8 6E outsb :760E7AA9 20746865 and byte ptr [eax+2*ebp+65], dh :760E7AAD 207379 and byte ptr [ebx+79], dh :760E7AB0 7374 jnb 760E7B26 :760E7AB2 65 BYTE 065h :760E7AB3 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E7A39(C), :760E7A92(C) | :760E7AB4 2028 and byte ptr [eax], ch :760E7AB6 2549363478 and eax, 78343649 :760E7ABB 2900 sub dword ptr [eax], eax :760E7ABD 90 nop :760E7ABE 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7A5C(C) | :760E7ABF 90 nop :760E7AC0 4F dec edi :760E7AC1 6C insb :760E7AC2 64206361 and byte ptr fs:[ebx+61], ah :760E7AC6 7461 je 760E7B29 :760E7AC8 6C insb :760E7AC9 6F outsd :760E7ACA 672020 and [bx+si], ah :760E7ACD 7665 jbe 760E7B34 :760E7ACF 7273 jb 760E7B44 :760E7AD1 696F6E20697320 imul ebp, dword ptr [edi+6E], 20736920 :760E7AD8 2549363478 and eax, 78343649 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7A68(C) | :760E7ADD 0090904E6577 add byte ptr [eax+77654E90], dl :760E7AE3 206361 and byte ptr [ebx+61], ah :760E7AE6 7461 je 760E7B49 :760E7AE8 6C insb :760E7AE9 6F outsd :760E7AEA 672020 and [bx+si], ah :760E7AED 7665 jbe 760E7B54 :760E7AEF 7273 jb 760E7B64 :760E7AF1 696F6E20697320 imul ebp, dword ptr [edi+6E], 20736920 :760E7AF8 2549363478 and eax, 78343649 :760E7AFD 0090904F6C64 add byte ptr [eax+646C4F90], dl :760E7B03 206361 and byte ptr [ebx+61], ah :760E7B06 7461 je 760E7B69 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7AA1(C) | :760E7B08 6C insb :760E7B09 6F outsd :760E7B0A 6720646F and [si+6F], ah :760E7B0E 65 BYTE 065h :760E7B0F 7320 jnb 760E7B31 :760E7B11 6E outsb :760E7B12 6F outsd :760E7B13 7420 je 760E7B35 :760E7B15 636F6E arpl dword ptr [edi+6E], ebp :760E7B18 7461 je 760E7B7B :760E7B1A 696E2076657273 imul ebp, dword ptr [esi+20], 73726576 :760E7B21 696F6E00909090 imul ebp, dword ptr [edi+6E], 90909000 :760E7B28 4E dec esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7AC6(C) | :760E7B29 65 BYTE 065h :760E7B2A 7720 ja 760E7B4C :760E7B2C 636174 arpl dword ptr [ecx+74], esp :760E7B2F 61 popad :760E7B30 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7B0F(C) | :760E7B31 6F outsd :760E7B32 6720646F and [si+6F], ah :760E7B36 65 BYTE 065h :760E7B37 7320 jnb 760E7B59 :760E7B39 6E outsb :760E7B3A 6F outsd :760E7B3B 7420 je 760E7B5D :760E7B3D 636F6E arpl dword ptr [edi+6E], ebp :760E7B40 7461 je 760E7BA3 :760E7B42 696E2076657273 imul ebp, dword ptr [esi+20], 73726576 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7AE6(C) | :760E7B49 696F6E00909090 imul ebp, dword ptr [edi+6E], 90909000 :760E7B50 43 inc ebx :760E7B51 4F dec edi :760E7B52 6C insb :760E7B53 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7AED(C) | :760E7B54 43 inc ebx :760E7B55 61 popad :760E7B56 7461 je 760E7BB9 :760E7B58 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7B37(C) | :760E7B59 6F outsd :760E7B5A 67 BYTE 067h :760E7B5B 2E BYTE 02eh :760E7B5C 49 dec ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7B3B(C) | :760E7B5D 6E outsb :760E7B5E 6974206661696C65 imul esi, dword ptr [eax+66], 656C6961 :760E7B66 64202564009043 and byte ptr fs:[43900064], ah :760E7B6D 4E dec esi :760E7B6E 65 BYTE 065h :760E7B6F 7743 ja 760E7BB4 :760E7B71 61 popad :760E7B72 7461 je 760E7BD5 :760E7B74 6C insb :760E7B75 6F outsd :760E7B76 67 BYTE 067h :760E7B77 2E BYTE 02eh :760E7B78 49 dec ecx :760E7B79 6E outsb :760E7B7A 6974206661696C65 imul esi, dword ptr [eax+66], 656C6961 :760E7B82 64202564009043 and byte ptr fs:[43900064], ah :760E7B89 6865636B56 push 566B6365 :760E7B8E 65 BYTE 065h :760E7B8F 7273 jb 760E7C04 :760E7B91 696F6E4F664E65 imul ebp, dword ptr [edi+6E], 654E664F :760E7B98 7743 ja 760E7BDD :760E7B9A 61 popad :760E7B9B 7461 je 760E7BFE :760E7B9D 6C insb :760E7B9E 6F outsd :760E7B9F 6700909090 add [bx+si+9090], dl :760E7BA4 45 inc ebp :760E7BA5 7272 jb 760E7C19 :760E7BA7 6F outsd :760E7BA8 7220 jb 760E7BCA :760E7BAA 7570 jne 760E7C1C :760E7BAC 64 BYTE 064h :760E7BAD 61 popad :760E7BAE 7469 je 760E7C19 :760E7BB0 6E outsb :760E7BB1 67206361 and [bp+di+61], ah :760E7BB5 7461 je 760E7C18 :760E7BB7 6C insb :760E7BB8 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7B56(C) | :760E7BB9 67206465 and [si+65], ah :760E7BBD 7065 jo 760E7C24 :760E7BBF 6E outsb :760E7BC0 64 BYTE 064h :760E7BC1 65 BYTE 065h :760E7BC2 6E outsb :760E7BC3 636965 arpl dword ptr [ecx+65], ebp :760E7BC6 732E jnb 760E7BF6 :760E7BC8 00909090202D add byte ptr [eax+2D209090], dl :760E7BCE 20616C and byte ptr [ecx+6C], ah :760E7BD1 6C insb :760E7BD2 6F outsd :760E7BD3 7769 ja 760E7C3E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7B72(C) | :760E7BD5 6E outsb :760E7BD6 67206E6F and [bp+6F], ch :760E7BDA 6E outsb :760E7BDB 2D4D696C6C sub eax, 6C6C694D :760E7BE0 65 BYTE 065h :760E7BE1 6E outsb :760E7BE2 6E outsb :760E7BE3 69756D20636572 imul esi, dword ptr [ebp+6D], 72656320 :760E7BEA 7469 je 760E7C55 :760E7BEC 666963617465 imul sp, word ptr [ebx+61], 6574 :760E7BF2 009053465020 add byte ptr [eax+20504653], dl :760E7BF8 696E7374616C6C imul ebp, dword ptr [esi+73], 6C6C6174 :760E7BFF 65 BYTE 065h :760E7C00 64206361 and byte ptr fs:[ebx+61], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7B8F(C) | :760E7C04 7461 je 760E7C67 :760E7C06 6C insb :760E7C07 6F outsd :760E7C08 672025 and [di], ah :760E7C0B 7300 jnb 760E7C0D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7C0B(C) | :760E7C0D 90 nop :760E7C0E 90 nop :760E7C0F 90 nop :760E7C10 46 inc esi :760E7C11 61 popad :760E7C12 696C656420746F20 imul ebp, dword ptr [ebp+64], 206F7420 :760E7C1A 67 BYTE 067h :760E7C1B 65 BYTE 065h :760E7C1C 7420 je 760E7C3E :760E7C1E 7772 ja 760E7C92 :760E7C20 697465206C6F636B imul esi, dword ptr [ebp+20], 6B636F6C :760E7C28 206F6E and byte ptr [edi+6E], ch :760E7C2B 205346 and byte ptr [ebx+46], dl :760E7C2E 50 push eax :760E7C2F 20646174 and byte ptr [ecx+74], ah :760E7C33 61 popad :760E7C34 626173 bound esp, dword ptr [ecx+73] :760E7C37 65 BYTE 065h :760E7C38 2E009090434361 add byte ptr cs:[eax+61434390], dl :760E7C3F 7461 je 760E7CA2 :760E7C41 6C insb :760E7C42 6F outsd :760E7C43 67 BYTE 067h :760E7C44 2E BYTE 02eh :760E7C45 49 dec ecx :760E7C46 6E outsb :760E7C47 6974206661696C65 imul esi, dword ptr [eax+66], 656C6961 :760E7C4F 64202564004572 and byte ptr fs:[72450064], ah :760E7C56 726F jb 760E7CC7 :760E7C58 7220 jb 760E7C7A :760E7C5A 7265 jb 760E7CC1 :760E7C5C 6D insd :760E7C5D 6F outsd :760E7C5E 7669 jbe 760E7CC9 :760E7C60 6E outsb :760E7C61 67206361 and [bp+di+61], ah :760E7C65 7461 je 760E7CC8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7C04(C) | :760E7C67 6C insb :760E7C68 6F outsd :760E7C69 673A20 cmp ah, [bx+si] :760E7C6C 2573009045 and eax, 45900073 :760E7C71 7272 jb 760E7CE5 :760E7C73 6F outsd :760E7C74 7220 jb 760E7C96 :760E7C76 67 BYTE 067h :760E7C77 65 BYTE 065h :760E7C78 7474 je 760E7CEE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7C58(C) | :760E7C7A 696E6720746F20 imul ebp, dword ptr [esi+67], 206F7420 :760E7C81 7468 je 760E7CEB :760E7C83 65207368 and byte ptr gs:[ebx+68], dh :760E7C87 6F outsd :760E7C88 7274 jb 760E7CFE :760E7C8A 207061 and byte ptr [eax+61], dh :760E7C8D 7468 je 760E7CF7 :760E7C8F 206E61 and byte ptr [esi+61], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7C1E(C) | :760E7C92 6D insd :760E7C93 6520666F and byte ptr gs:[esi+6F], ah :760E7C97 7220 jb 760E7CB9 :760E7C99 7468 je 760E7D03 :760E7C9B 65206361 and byte ptr gs:[ebx+61], ah :760E7C9F 7461 je 760E7D02 :760E7CA1 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7C3F(C) | :760E7CA2 6F outsd :760E7CA3 672E00909044 add cs:[bx+si+4490], dl :760E7CA9 65 BYTE 065h :760E7CAA 7064 jo 760E7D10 :760E7CAC 65 BYTE 065h :760E7CAD 6E outsb :760E7CAE 64 BYTE 064h :760E7CAF 65 BYTE 065h :760E7CB0 6E outsb :760E7CB1 637920 arpl dword ptr [ecx+20], edi :760E7CB4 636174 arpl dword ptr [ecx+74], esp :760E7CB7 61 popad :760E7CB8 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7C97(C) | :760E7CB9 6F outsd :760E7CBA 673A20 cmp ah, [bx+si] :760E7CBD 257320646F and eax, 6F642073 :760E7CC2 65 BYTE 065h :760E7CC3 7320 jnb 760E7CE5 :760E7CC5 6E outsb :760E7CC6 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7C56(C) | :760E7CC7 7420 je 760E7CE9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7C5E(C) | :760E7CC9 65 BYTE 065h :760E7CCA 7869 js 760E7D35 :760E7CCC 7374 jnb 760E7D42 :760E7CCE 00904572726F add byte ptr [eax+6F727245], dl :760E7CD4 7220 jb 760E7CF6 :760E7CD6 67 BYTE 067h :760E7CD7 65 BYTE 065h :760E7CD8 7474 je 760E7D4E :760E7CDA 696E6720746865 imul ebp, dword ptr [esi+67], 65687420 :760E7CE1 206675 and byte ptr [esi+75], ah :760E7CE4 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E7C71(C), :760E7CC3(C) | :760E7CE5 6C insb :760E7CE6 206361 and byte ptr [ebx+61], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7CC7(C) | :760E7CE9 7461 je 760E7D4C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7C81(C) | :760E7CEB 6C insb :760E7CEC 6F outsd :760E7CED 67207061 and [bx+si+61], dh :760E7CF1 7468 je 760E7D5B :760E7CF3 2E009090904361 add byte ptr cs:[eax+61439090], dl :760E7CFA 7461 je 760E7D5D :760E7CFC 6C insb :760E7CFD 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7C88(C) | :760E7CFE 672025 and [di], ah :760E7D01 7320 jnb 760E7D23 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7C99(C) | :760E7D03 64 BYTE 064h :760E7D04 6F outsd :760E7D05 65 BYTE 065h :760E7D06 7320 jnb 760E7D28 :760E7D08 6E outsb :760E7D09 6F outsd :760E7D0A 7420 je 760E7D2C :760E7D0C 65 BYTE 065h :760E7D0D 7869 js 760E7D78 :760E7D0F 7374 jnb 760E7D85 :760E7D11 009090457272 add byte ptr [eax+72724590], dl :760E7D17 6F outsd :760E7D18 7220 jb 760E7D3A :760E7D1A 696E697469616C imul ebp, dword ptr [esi+69], 6C616974 :760E7D21 697A696E672063 imul edi, dword ptr [edx+69], 6320676E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7D06(C) | :760E7D28 61 popad :760E7D29 7461 je 760E7D8C :760E7D2B 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7D0A(C) | :760E7D2C 6F outsd :760E7D2D 67207574 and [di+74], dh :760E7D31 696C697469657300 imul ebp, dword ptr [ecx+2*ebp+74], 00736569 :760E7D39 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7D18(C) | :760E7D3A 90 nop :760E7D3B 90 nop :760E7D3C 49 dec ecx :760E7D3D 6E outsb :760E7D3E 7374 jnb 760E7DB4 :760E7D40 61 popad :760E7D41 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7CCC(C) | :760E7D42 6C insb :760E7D43 696E6720636174 imul ebp, dword ptr [esi+67], 74616320 :760E7D4A 61 popad :760E7D4B 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7CE9(C) | :760E7D4C 6F outsd :760E7D4D 672025 and [di], ah :760E7D50 7300 jnb 760E7D52 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7D50(C) | :760E7D52 90 nop :760E7D53 90 nop :760E7D54 53 push ebx :760E7D55 667049 jo 760E7DA1 :760E7D58 6E outsb :760E7D59 7374 jnb 760E7DCF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7CF1(C) | :760E7D5B 61 popad :760E7D5C 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7CFA(C) | :760E7D5D 6C insb :760E7D5E 43 inc ebx :760E7D5F 61 popad :760E7D60 7461 je 760E7DC3 :760E7D62 6C insb :760E7D63 6F outsd :760E7D64 6753 push ebx :760E7D66 009053465020 add byte ptr [eax+20504653], dl :760E7D6C 7265 jb 760E7DD3 :760E7D6E 6D insd :760E7D6F 6F outsd :760E7D70 7665 jbe 760E7DD7 :760E7D72 64206361 and byte ptr fs:[ebx+61], ah :760E7D76 7461 je 760E7DD9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7D0D(C) | :760E7D78 6C insb :760E7D79 6F outsd :760E7D7A 672025 and [di], ah :760E7D7D 7300 jnb 760E7D7F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7D7D(C) | :760E7D7F 90 nop :760E7D80 45 inc ebp :760E7D81 7272 jb 760E7DF5 :760E7D83 6F outsd :760E7D84 7220 jb 760E7DA6 :760E7D86 7265 jb 760E7DED :760E7D88 6D insd :760E7D89 6F outsd :760E7D8A 7669 jbe 760E7DF5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7D29(C) | :760E7D8C 6E outsb :760E7D8D 67206361 and [bp+di+61], ah :760E7D91 7461 je 760E7DF4 :760E7D93 6C insb :760E7D94 6F outsd :760E7D95 67206669 and [bp+69], ah :760E7D99 6C insb :760E7D9A 65202573206672 and byte ptr gs:[72662073], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7D56(C) | :760E7DA1 6F outsd :760E7DA2 6D insd :760E7DA3 206361 and byte ptr [ebx+61], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7D84(C) | :760E7DA6 7461 je 760E7E09 :760E7DA8 6C insb :760E7DA9 6F outsd :760E7DAA 67207374 and [bp+di+74], dh :760E7DAE 6F outsd :760E7DAF 7265 jb 760E7E16 :760E7DB1 2E00904572726F add byte ptr cs:[eax+6F727245], dl :760E7DB8 7220 jb 760E7DDA :760E7DBA 7265 jb 760E7E21 :760E7DBC 6D insd :760E7DBD 6F outsd :760E7DBE 7669 jbe 760E7E29 :760E7DC0 6E outsb :760E7DC1 67206361 and [bp+di+61], ah :760E7DC5 7461 je 760E7E28 :760E7DC7 6C insb :760E7DC8 6F outsd :760E7DC9 67206465 and [si+65], ah :760E7DCD 7065 jo 760E7E34 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7D59(C) | :760E7DCF 6E outsb :760E7DD0 65 BYTE 065h :760E7DD1 6E outsb :760E7DD2 6469657320666F72 imul esp, dword ptr fs:[ebp+73], 726F6620 :760E7DDA 206361 and byte ptr [ebx+61], ah :760E7DDD 7461 je 760E7E40 :760E7DDF 6C insb :760E7DE0 6F outsd :760E7DE1 672025 and [di], ah :760E7DE4 7300 jnb 760E7DE6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7DE4(C) | :760E7DE6 90 nop :760E7DE7 90 nop :760E7DE8 46 inc esi :760E7DE9 61 popad :760E7DEA 696C656420746F20 imul ebp, dword ptr [ebp+64], 206F7420 :760E7DF2 7265 jb 760E7E59 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7D91(C) | :760E7DF4 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E7D81(C), :760E7D8A(C) | :760E7DF5 6F outsd :760E7DF6 7665 jbe 760E7E5D :760E7DF8 206361 and byte ptr [ebx+61], ah :760E7DFB 7461 je 760E7E5E :760E7DFD 6C insb :760E7DFE 6F outsd :760E7DFF 6720656E and [di+6E], ah :760E7E03 7472 je 760E7E77 :760E7E05 7920 jns 760E7E27 :760E7E07 66726F jb 760E7E79 :760E7E0A 6D insd :760E7E0B 205346 and byte ptr [ebx+46], dl :760E7E0E 50 push eax :760E7E0F 44 inc esp :760E7E10 6200 bound eax, dword ptr [eax] :760E7E12 90 nop :760E7E13 90 nop :760E7E14 46 inc esi :760E7E15 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7DAF(C) | :760E7E16 696C656420746F20 imul ebp, dword ptr [ebp+64], 206F7420 :760E7E1E 6F outsd :760E7E1F 7065 jo 760E7E86 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7DBA(C) | :760E7E21 6E outsb :760E7E22 206361 and byte ptr [ebx+61], ah :760E7E25 7461 je 760E7E88 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7E05(C) | :760E7E27 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7DC5(C) | :760E7E28 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7DBE(C) | :760E7E29 672025 and [di], ah :760E7E2C 7300 jnb 760E7E2E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7E2C(C) | :760E7E2E 90 nop :760E7E2F 90 nop :760E7E30 45 inc ebp :760E7E31 7272 jb 760E7EA5 :760E7E33 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7DCD(C) | :760E7E34 7220 jb 760E7E56 :760E7E36 696E697469616C imul ebp, dword ptr [esi+69], 6C616974 :760E7E3D 697A696E672074 imul edi, dword ptr [edx+69], 7420676E :760E7E44 6865206361 push 61632065 :760E7E49 7461 je 760E7EAC :760E7E4B 6C insb :760E7E4C 6F outsd :760E7E4D 67207574 and [di+74], dh :760E7E51 696C69746965732E imul ebp, dword ptr [ecx+2*ebp+74], 2E736569 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7DF2(C) | :760E7E59 00909044656C add byte ptr [eax+6C654490], dl :760E7E5F 65 BYTE 065h :760E7E60 7469 je 760E7ECB :760E7E62 6E outsb :760E7E63 67206361 and [bp+di+61], ah :760E7E67 7461 je 760E7ECA :760E7E69 6C insb :760E7E6A 6F outsd :760E7E6B 672025 and [di], ah :760E7E6E 7300 jnb 760E7E70 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7E6E(C) | :760E7E70 53 push ebx :760E7E71 667044 jo 760E7EB8 :760E7E74 65 BYTE 065h :760E7E75 6C insb :760E7E76 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7E03(C) | :760E7E77 7465 je 760E7EDE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7E08(C) | :760E7E79 43 inc ebx :760E7E7A 61 popad :760E7E7B 7461 je 760E7EDE :760E7E7D 6C insb :760E7E7E 6F outsd :760E7E7F 6753 push ebx :760E7E81 0090904E756C add byte ptr [eax+6C754E90], dl :760E7E87 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7E25(C) | :760E7E88 20706F and byte ptr [eax+6F], dh :760E7E8B 696E7465722773 imul ebp, dword ptr [esi+74], 73277265 :760E7E92 207061 and byte ptr [eax+61], dh :760E7E95 7373 jnb 760E7F0A :760E7E97 65 BYTE 065h :760E7E98 6420746F20 and byte ptr fs:[edi+2*ebp+20], dh :760E7E9D 55 push ebp :760E7E9E 7064 jo 760E7F04 :760E7EA0 61 popad :760E7EA1 7465 je 760E7F08 :760E7EA3 43 inc ebx :760E7EA4 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7E31(C) | :760E7EA5 7461 je 760E7F08 :760E7EA7 6C insb :760E7EA8 6F outsd :760E7EA9 6744 inc esp :760E7EAB 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7E49(C) | :760E7EAC 7065 jo 760E7F13 :760E7EAE 6E outsb :760E7EAF 64 BYTE 064h :760E7EB0 65 BYTE 065h :760E7EB1 6E outsb :760E7EB2 637900 arpl dword ptr [ecx+00], edi :760E7EB5 90 nop :760E7EB6 90 nop :760E7EB7 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7E72(C) | :760E7EB8 45 inc ebp :760E7EB9 7272 jb 760E7F2D :760E7EBB 6F outsd :760E7EBC 7220 jb 760E7EDE :760E7EBE 7772 ja 760E7F32 :760E7EC0 6974696E67206465 imul esi, dword ptr [ecx+2*ebp+6E], 65642067 :760E7EC8 7065 jo 760E7F2F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7E67(C) | :760E7ECA 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7E60(C) | :760E7ECB 64 BYTE 064h :760E7ECC 65 BYTE 065h :760E7ECD 6E outsb :760E7ECE 637920 arpl dword ptr [ecx+20], edi :760E7ED1 6B657900 imul esp, dword ptr [ebp+79], 00000000 :760E7ED5 90 nop :760E7ED6 90 nop :760E7ED7 90 nop :760E7ED8 46 inc esi :760E7ED9 61 popad :760E7EDA 7461 je 760E7F3D :760E7EDC 6C insb :760E7EDD 206572 and byte ptr [ebp+72], ah :760E7EE0 726F jb 760E7F51 :760E7EE2 722C jb 760E7F10 :760E7EE4 206275 and byte ptr [edx+75], ah :760E7EE7 66 BYTE 066h :760E7EE8 66 BYTE 066h :760E7EE9 65 BYTE 065h :760E7EEA 7220 jb 760E7F0C :760E7EEC 6F outsd :760E7EED 7665 jbe 760E7F54 :760E7EEF 7272 jb 760E7F63 :760E7EF1 756E jne 760E7F61 :760E7EF3 20696E and byte ptr [ecx+6E], ch :760E7EF6 205570 and byte ptr [ebp+70], dl :760E7EF9 64 BYTE 064h :760E7EFA 61 popad :760E7EFB 7465 je 760E7F62 :760E7EFD 43 inc ebx :760E7EFE 61 popad :760E7EFF 7461 je 760E7F62 :760E7F01 6C insb :760E7F02 6F outsd :760E7F03 6744 inc esp :760E7F05 65 BYTE 065h :760E7F06 7065 jo 760E7F6D * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E7EA1(C), :760E7EA5(C) | :760E7F08 6E outsb :760E7F09 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7E95(C) | :760E7F0A 65 BYTE 065h :760E7F0B 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7EEA(C) | :760E7F0C 637900 arpl dword ptr [ecx+00], edi :760E7F0F 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7EE2(C) | :760E7F10 41 inc ecx :760E7F11 64 BYTE 064h :760E7F12 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7EAC(C) | :760E7F13 43 inc ebx :760E7F14 61 popad :760E7F15 7461 je 760E7F78 :760E7F17 6C insb :760E7F18 6F outsd :760E7F19 6744 inc esp :760E7F1B 65 BYTE 065h :760E7F1C 7065 jo 760E7F83 :760E7F1E 6E outsb :760E7F1F 64 BYTE 064h :760E7F20 65 BYTE 065h :760E7F21 6E outsb :760E7F22 637928 arpl dword ptr [ecx+28], edi :760E7F25 4C dec esp :760E7F26 50 push eax :760E7F27 54 push esp :760E7F28 53 push ebx :760E7F29 54 push esp :760E7F2A 52 push edx :760E7F2B 207073 and byte ptr [eax+73], dh :760E7F2E 7A43 jpe 760E7F73 :760E7F30 61 popad :760E7F31 7461 je 760E7F94 :760E7F33 6C insb :760E7F34 6F outsd :760E7F35 672C20 sub al, 20 :760E7F38 4C dec esp :760E7F39 50 push eax :760E7F3A 54 push esp :760E7F3B 53 push ebx :760E7F3C 54 push esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7EDA(C) | :760E7F3D 52 push edx :760E7F3E 207073 and byte ptr [eax+73], dh :760E7F41 7A44 jpe 760E7F87 :760E7F43 65 BYTE 065h :760E7F44 7065 jo 760E7FAB :760E7F46 6E outsb :760E7F47 64 BYTE 064h :760E7F48 65 BYTE 065h :760E7F49 6E outsb :760E7F4A 637929 arpl dword ptr [ecx+29], edi :760E7F4D 009090536F66 add byte ptr [eax+666F5390], dl :760E7F53 7477 je 760E7FCC :760E7F55 61 popad :760E7F56 7265 jb 760E7FBD :760E7F58 5C pop esp :760E7F59 4D dec ebp :760E7F5A 6963726F736F66 imul esp, dword ptr [ebx+72], 666F736F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7EF1(C) | :760E7F61 745C je 760E7FBF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7EEF(C) | :760E7F63 57 push edi :760E7F64 696E646F77735C imul ebp, dword ptr [esi+64], 5C73776F :760E7F6B 43 inc ebx :760E7F6C 7572 jne 760E7FE0 :760E7F6E 7265 jb 760E7FD5 :760E7F70 6E outsb :760E7F71 7456 je 760E7FC9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7F2E(C) | :760E7F73 65 BYTE 065h :760E7F74 7273 jb 760E7FE9 :760E7F76 696F6E5C537973 imul ebp, dword ptr [edi+6E], 7379535C :760E7F7D 7465 je 760E7FE4 :760E7F7F 6D insd :760E7F80 46 inc esi :760E7F81 696C6550726F7465 imul ebp, dword ptr [ebp+50], 65746F72 :760E7F89 6374696F arpl dword ptr [ecx+2*ebp+6F], esi :760E7F8D 6E outsb :760E7F8E 5C pop esp :760E7F8F 43 inc ebx :760E7F90 61 popad :760E7F91 7444 je 760E7FD7 :760E7F93 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7F31(C) | :760E7F94 7065 jo 760E7FFB :760E7F96 6E outsb :760E7F97 64009090904572 add byte ptr fs:[eax+72459090], dl :760E7F9E 726F jb 760E800F :760E7FA0 7220 jb 760E7FC2 :760E7FA2 636C6F73 arpl dword ptr [edi+2*ebp+73], ebp :760E7FA6 696E6720726567 imul ebp, dword ptr [esi+67], 67657220 :760E7FAD 6973747279206B imul esi, dword ptr [ebx+74], 6B207972 :760E7FB4 65 BYTE 065h :760E7FB5 7920 jns 760E7FD7 :760E7FB7 696E2052656D6F imul ebp, dword ptr [esi+20], 6F6D6552 :760E7FBE 7665 jbe 760E8025 :760E7FC0 43 inc ebx :760E7FC1 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7FA0(C) | :760E7FC2 7461 je 760E8025 :760E7FC4 6C insb :760E7FC5 6F outsd :760E7FC6 6744 inc esp :760E7FC8 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7F71(C) | :760E7FC9 7065 jo 760E8030 :760E7FCB 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7F53(C) | :760E7FCC 64 BYTE 064h :760E7FCD 65 BYTE 065h :760E7FCE 6E outsb :760E7FCF 636965 arpl dword ptr [ecx+65], ebp :760E7FD2 7300 jnb 760E7FD4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7FD2(C) | :760E7FD4 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7F6E(C) | :760E7FD5 7272 jb 760E8049 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E7F91(C), :760E7FB5(C) | :760E7FD7 6F outsd :760E7FD8 7220 jb 760E7FFA :760E7FDA 7265 jb 760E8041 :760E7FDC 6D insd :760E7FDD 6F outsd :760E7FDE 7669 jbe 760E8049 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7F6C(C) | :760E7FE0 6E outsb :760E7FE1 67207265 and [bp+si+65], dh :760E7FE5 676973747279206B imul esi, [bp+di+74], 6B207972 :760E7FED 65 BYTE 065h :760E7FEE 7920 jns 760E8010 :760E7FF0 666F outsw :760E7FF2 7220 jb 760E8014 :760E7FF4 636174 arpl dword ptr [ecx+74], esp :760E7FF7 61 popad :760E7FF8 6C insb :760E7FF9 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7FD8(C) | :760E7FFA 672E00909090 add cs:[bx+si+9090], dl :760E8000 45 inc ebp :760E8001 7272 jb 760E8075 :760E8003 6F outsd :760E8004 7220 jb 760E8026 :760E8006 697465726174696E imul esi, dword ptr [ebp+72], 6E697461 :760E800E 67207468 and [si+68], dh :760E8012 726F jb 760E8083 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7FF2(C) | :760E8014 7567 jne 760E807D :760E8016 6820646570 push 70656420 :760E801B 65 BYTE 065h :760E801C 6E outsb :760E801D 64 BYTE 064h :760E801E 61 popad :760E801F 6E outsb :760E8020 7420 je 760E8042 :760E8022 636174 arpl dword ptr [ecx+74], esp * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E7FBE(C), :760E7FC2(C) | :760E8025 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8004(C) | :760E8026 6C insb :760E8027 6F outsd :760E8028 67207375 and [bp+di+75], dh :760E802C 622D76616C75 bound ebp, dword ptr [756C6176] :760E8032 65 BYTE 065h :760E8033 7320 jnb 760E8055 :760E8035 2564004572 and eax, 72450064 :760E803A 726F jb 760E80AB :760E803C 7220 jb 760E805E :760E803E 7265 jb 760E80A5 :760E8040 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E7FDA(C) | :760E8041 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8020(C) | :760E8042 7669 jbe 760E80AD :760E8044 6E outsb :760E8045 67206465 and [si+65], ah * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E7FD5(C), :760E7FDE(C) | :760E8049 7065 jo 760E80B0 :760E804B 6E outsb :760E804C 64 BYTE 064h :760E804D 65 BYTE 065h :760E804E 6E outsb :760E804F 61 popad :760E8050 6E outsb :760E8051 7420 je 760E8073 :760E8053 636174 arpl dword ptr [ecx+74], esp :760E8056 61 popad :760E8057 6C insb :760E8058 6F outsd :760E8059 672E004572 add cs:[di+72], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E803C(C) | :760E805E 726F jb 760E80CF :760E8060 7220 jb 760E8082 :760E8062 6D insd :760E8063 61 popad :760E8064 726B jb 760E80D1 :760E8066 696E6720726567 imul ebp, dword ptr [esi+67], 67657220 :760E806D 69737472792076 imul esi, dword ptr [ebx+74], 76207972 :760E8074 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8001(C) | :760E8075 6C insb :760E8076 7565 jne 760E80DD :760E8078 206173 and byte ptr [ecx+73], ah :760E807B 207669 and byte ptr [esi+69], dh :760E807E 7369 jnb 760E80E9 :760E8080 7465 je 760E80E7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8060(C) | :760E8082 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8012(C) | :760E8083 2E00909090496E add byte ptr cs:[eax+6E499090], dl :760E808A 7661 jbe 760E80ED :760E808C 6C insb :760E808D 6964207265676973 imul esp, dword ptr [eax+72], 73696765 :760E8095 7472 je 760E8109 :760E8097 7920 jns 760E80B9 :760E8099 7661 jbe 760E80FC :760E809B 6C insb :760E809C 7565 jne 760E8103 :760E809E 20656E and byte ptr [ebp+6E], ah :760E80A1 7472 je 760E8115 :760E80A3 7920 jns 760E80C5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E803E(C) | :760E80A5 7479 je 760E8120 :760E80A7 7065 jo 760E810E :760E80A9 2C20 sub al, 20 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E803A(C) | :760E80AB 6E outsb :760E80AC 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8042(C) | :760E80AD 7420 je 760E80CF :760E80AF 52 push edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8049(C) | :760E80B0 45 inc ebp :760E80B1 47 inc edi :760E80B2 5F pop edi :760E80B3 44 inc esp :760E80B4 57 push edi :760E80B5 4F dec edi :760E80B6 52 push edx :760E80B7 44 inc esp :760E80B8 2E009090457272 add byte ptr cs:[eax+72724590], dl :760E80BF 6F outsd :760E80C0 7220 jb 760E80E2 :760E80C2 64 BYTE 064h :760E80C3 65 BYTE 065h :760E80C4 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E80A3(C) | :760E80C5 65 BYTE 065h :760E80C6 7469 je 760E8131 :760E80C8 6E outsb :760E80C9 672025 and [di], ah :760E80CC 7320 jnb 760E80EE :760E80CE 66726F jb 760E8140 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8064(C) | :760E80D1 6D insd :760E80D2 2025732C2065 and byte ptr [65202C73], ah :760E80D8 633D256C6400 arpl dword ptr [00646C25], edi :760E80DE 90 nop :760E80DF 90 nop :760E80E0 45 inc ebp :760E80E1 7272 jb 760E8155 :760E80E3 6F outsd :760E80E4 7220 jb 760E8106 :760E80E6 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8080(C) | :760E80E7 7065 jo 760E814E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E807E(C) | :760E80E9 6E outsb :760E80EA 696E672025732C imul ebp, dword ptr [esi+67], 2C732520 :760E80F1 206563 and byte ptr [ebp+63], ah :760E80F4 3D256C6400 cmp eax, 00646C25 :760E80F9 90 nop :760E80FA 90 nop :760E80FB 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8099(C) | :760E80FC 52 push edx :760E80FD 65 BYTE 065h :760E80FE 6D insd :760E80FF 6F outsd :760E8100 7665 jbe 760E8167 :760E8102 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E809C(C) | :760E8103 61 popad :760E8104 7461 je 760E8167 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E80E4(C) | :760E8106 6C insb :760E8107 6F outsd :760E8108 6744 inc esp :760E810A 65 BYTE 065h :760E810B 7065 jo 760E8172 :760E810D 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E80A7(C) | :760E810E 64 BYTE 064h :760E810F 65 BYTE 065h :760E8110 6E outsb :760E8111 636965 arpl dword ptr [ecx+65], ebp :760E8114 7328 jnb 760E813E :760E8116 4C dec esp :760E8117 50 push eax :760E8118 54 push esp :760E8119 53 push ebx :760E811A 54 push esp :760E811B 52 push edx :760E811C 207073 and byte ptr [eax+73], dh :760E811F 7A43 jpe 760E8164 :760E8121 61 popad :760E8122 7461 je 760E8185 :760E8124 6C insb :760E8125 6F outsd :760E8126 672900 sub [bx+si], eax :760E8129 90 nop :760E812A 90 nop :760E812B 90 nop :760E812C 45 inc ebp :760E812D 7272 jb 760E81A1 :760E812F 6F outsd :760E8130 7220 jb 760E8152 :760E8132 53 push ebx :760E8133 61 popad :760E8134 7665 jbe 760E819B :760E8136 696E6720746865 imul ebp, dword ptr [esi+67], 65687420 :760E813D 205346 and byte ptr [ebx+46], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E80CF(C) | :760E8140 50 push eax :760E8141 20446174 and byte ptr [ecx+74], al :760E8145 61 popad :760E8146 626173 bound esp, dword ptr [ecx+73] :760E8149 65 BYTE 065h :760E814A 2E004E6F add byte ptr cs:[esi+6F], cl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E80E7(C) | :760E814E 206361 and byte ptr [ebx+61], ah :760E8151 7461 je 760E81B4 :760E8153 6C insb :760E8154 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E80E1(C) | :760E8155 677320 jnb 760E8178 :760E8158 696E7374616C6C imul ebp, dword ptr [esi+73], 6C6C6174 :760E815F 65 BYTE 065h :760E8160 64206F6E and byte ptr fs:[edi+6E], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E811F(C) | :760E8164 20746865 and byte ptr [eax+2*ebp+65], dh :760E8168 207379 and byte ptr [ebx+79], dh :760E816B 7374 jnb 760E81E1 :760E816D 65 BYTE 065h :760E816E 6D insd :760E816F 004572 add byte ptr [ebp+72], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E810B(C) | :760E8172 726F jb 760E81E3 :760E8174 7220 jb 760E8196 :760E8176 7379 jnb 760E81F1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8156(C) | :760E8178 6E outsb :760E8179 63696E arpl dword ptr [ecx+6E], ebp :760E817C 67206361 and [bp+di+61], ah :760E8180 7461 je 760E81E3 :760E8182 6C insb :760E8183 6F outsd :760E8184 6720746F and [si+6F], dh :760E8188 20646200 and byte ptr [edx], ah :760E818C 45 inc ebp :760E818D 7272 jb 760E8201 :760E818F 6F outsd :760E8190 7220 jb 760E81B2 :760E8192 7061 jo 760E81F5 :760E8194 7273 jb 760E8209 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8174(C) | :760E8196 696E6720636174 imul ebp, dword ptr [esi+67], 74616320 :760E819D 61 popad :760E819E 6C insb :760E819F 6F outsd :760E81A0 672E00904365 add cs:[bx+si+6543], dl :760E81A6 7274 jb 760E821C :760E81A8 69666963617465 imul esp, dword ptr [esi+69], 65746163 :760E81AF 206E6F and byte ptr [esi+6F], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8190(C) | :760E81B2 7420 je 760E81D4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8151(C) | :760E81B4 696E2074727573 imul ebp, dword ptr [esi+20], 73757274 :760E81BB 7465 je 760E8222 :760E81BD 6420726F and byte ptr fs:[edx+6F], dh :760E81C1 6F outsd :760E81C2 7420 je 760E81E4 :760E81C4 7374 jnb 760E823A :760E81C6 6F outsd :760E81C7 7265 jb 760E822E :760E81C9 202573009090 and byte ptr [90900073], ah :760E81CF 90 nop :760E81D0 45 inc ebp :760E81D1 7272 jb 760E8245 :760E81D3 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E81B2(C) | :760E81D4 7220 jb 760E81F6 :760E81D6 7665 jbe 760E823D :760E81D8 7269 jb 760E8243 :760E81DA 667969 jns 760E8246 :760E81DD 6E outsb :760E81DE 67206361 and [bp+di+61], ah :760E81E2 7461 je 760E8245 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E81C2(C) | :760E81E4 6C insb :760E81E5 6F outsd :760E81E6 672025 and [di], ah :760E81E9 7300 jnb 760E81EB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E81E9(C) | :760E81EB 90 nop :760E81EC 45 inc ebp :760E81ED 7272 jb 760E8261 :760E81EF 6F outsd :760E81F0 7220 jb 760E8212 :760E81F2 61 popad :760E81F3 64 BYTE 064h :760E81F4 64696E672066696C imul ebp, dword ptr fs:[esi+67], 6C696620 :760E81FC 6520746F20 and byte ptr gs:[edi+2*ebp+20], dh :760E8201 7468 je 760E826B :760E8203 65205346 and byte ptr gs:[ebx+46], dl :760E8207 50 push eax :760E8208 2044422E and byte ptr [edx+2*eax+2E], al :760E820C 009090904572 add byte ptr [eax+72459090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E81F0(C) | :760E8212 726F jb 760E8283 :760E8214 7220 jb 760E8236 :760E8216 7265 jb 760E827D :760E8218 6D insd :760E8219 6F outsd :760E821A 7669 jbe 760E8285 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E81A6(C) | :760E821C 6E outsb :760E821D 67206669 and [bp+69], ah :760E8221 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E81BB(C) | :760E8222 65206672 and byte ptr gs:[esi+72], ah :760E8226 6F outsd :760E8227 6D insd :760E8228 20746865 and byte ptr [eax+2*ebp+65], dh :760E822C 205346 and byte ptr [ebx+46], dl :760E822F 50 push eax :760E8230 2044422E and byte ptr [edx+2*eax+2E], al :760E8234 009090904F75 add byte ptr [eax+754F9090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E81C4(C) | :760E823A 7220 jb 760E825C :760E823C 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E81D6(C) | :760E823D 65 BYTE 065h :760E823E 7720 ja 760E8260 :760E8240 64 BYTE 064h :760E8241 61 popad :760E8242 7461 je 760E82A5 :760E8244 626173 bound esp, dword ptr [ecx+73] :760E8247 65206973 and byte ptr gs:[ecx+73], ch :760E824B 20656D and byte ptr [ebp+6D], ah :760E824E 7074 jo 760E82C4 :760E8250 792C jns 760E827E :760E8252 206D75 and byte ptr [ebp+75], ch :760E8255 7374 jnb 760E82CB :760E8257 206265 and byte ptr [edx+65], ah :760E825A 20616E and byte ptr [ecx+6E], ah :760E825D 206572 and byte ptr [ebp+72], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E823E(C) | :760E8260 726F jb 760E82D1 :760E8262 722E jb 760E8292 :760E8264 009090904572 add byte ptr [eax+72459090], dl :760E826A 726F jb 760E82DB :760E826C 7220 jb 760E828E :760E826E 61 popad :760E826F 64 BYTE 064h :760E8270 64696E672066696C imul ebp, dword ptr fs:[esi+67], 6C696620 :760E8278 6520656E and byte ptr gs:[ebp+6E], ah :760E827C 7472 je 760E82F0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8250(C) | :760E827E 7920 jns 760E82A0 :760E8280 746F je 760E82F1 :760E8282 20636F and byte ptr [ebx+6F], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E821A(C) | :760E8285 7079 jo 760E8300 :760E8287 206F66 and byte ptr [edi+66], ch :760E828A 205346 and byte ptr [ebx+46], dl :760E828D 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E826C(C) | :760E828E 2064622E and byte ptr [edx+2E], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8262(C) | :760E8292 00904572726F add byte ptr [eax+6F727245], dl :760E8298 7220 jb 760E82BA :760E829A 67 BYTE 067h :760E829B 65 BYTE 065h :760E829C 7474 je 760E8312 :760E829E 696E6720777269 imul ebp, dword ptr [esi+67], 69727720 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8242(C) | :760E82A5 7465 je 760E830C :760E82A7 206C6F63 and byte ptr [edi+2*ebp+63], ch :760E82AB 6B206F imul esp, dword ptr [eax], 0000006F :760E82AE 6E outsb :760E82AF 207366 and byte ptr [ebx+66], dh :760E82B2 7020 jo 760E82D4 :760E82B4 646200 bound eax, dword ptr fs:[eax] :760E82B7 90 nop :760E82B8 45 inc ebp :760E82B9 7272 jb 760E832D :760E82BB 6F outsd :760E82BC 7220 jb 760E82DE :760E82BE 4C dec esp :760E82BF 6F outsd :760E82C0 61 popad :760E82C1 64696E672046696C imul ebp, dword ptr fs:[esi+67], 6C694620 :760E82C9 65206672 and byte ptr gs:[esi+72], ah :760E82CD 6F outsd :760E82CE 6D insd :760E82CF 20786D and byte ptr [eax+6D], bh :760E82D2 6C insb :760E82D3 206669 and byte ptr [esi+69], ah :760E82D6 6C insb :760E82D7 65 BYTE 065h :760E82D8 2C20 sub al, 20 :760E82DA 627566 bound esi, dword ptr [ebp+66] :760E82DD 66 BYTE 066h :760E82DE 65 BYTE 065h :760E82DF 7220 jb 760E8301 :760E82E1 65 BYTE 065h :760E82E2 7863 js 760E8347 :760E82E4 65 BYTE 065h :760E82E5 65 BYTE 065h :760E82E6 64 BYTE 064h :760E82E7 65 BYTE 065h :760E82E8 64009090457272 add byte ptr fs:[eax+72724590], dl :760E82EF 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E827C(C) | :760E82F0 7220 jb 760E8312 :760E82F2 4C dec esp :760E82F3 6F outsd :760E82F4 61 popad :760E82F5 64696E6720584D4C imul ebp, dword ptr fs:[esi+67], 4C4D5820 :760E82FD 204649 and byte ptr [esi+49], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8285(C) | :760E8300 4C dec esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E82DF(C) | :760E8301 45 inc ebp :760E8302 009053667053 add byte ptr [eax+53706653], dl :760E8308 796E jns 760E8378 :760E830A 63446200 arpl dword ptr [edx], eax :760E830E 90 nop :760E830F 90 nop :760E8310 5B pop ebx :760E8311 44 inc esp * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E829C(C), :760E82F0(C) | :760E8312 69724E756C5D00 imul esi, dword ptr [edx+4E], 005D6C75 :760E8319 90 nop :760E831A 90 nop :760E831B 90 nop :760E831C 5B pop ebx :760E831D 4E dec esi :760E831E 756C jne 760E838C :760E8320 5D pop ebp :760E8321 0090905B5265 add byte ptr [eax+65525B90], dl :760E8327 6E outsb :760E8328 61 popad :760E8329 6D insd :760E832A 65 BYTE 065h :760E832B 5D pop ebp :760E832C 009090904C6F add byte ptr [eax+6F4C9090], dl :760E8332 63616C arpl dword ptr [ecx+6C], esp :760E8335 41 inc ecx :760E8336 6C insb :760E8337 6C insb :760E8338 6F outsd :760E8339 6320 arpl dword ptr [eax], esp :760E833B 6661 popa :760E833D 696C656400909043 imul ebp, dword ptr [ebp+64], 43909000 :760E8345 41 inc ecx :760E8346 7272 jb 760E83BA :760E8348 61 popad :760E8349 7949 jns 760E8394 :760E834B 6E outsb :760E834C 64 BYTE 064h :760E834D 65 BYTE 065h :760E834E 783A js 760E838A :760E8350 3A496E cmp cl, byte ptr [ecx+6E] :760E8353 697400909047726F imul esi, dword ptr [eax+eax-70], 6F724790 :760E835B 7720 ja 760E837D :760E835D 6F outsd :760E835E 66207369 and byte ptr [ebx+69], dh :760E8362 7A65 jpe 760E83C9 :760E8364 202564206661 and byte ptr [61662064], ah :760E836A 696C656400906477 imul ebp, dword ptr [ebp+64], 77649000 :760E8372 49 dec ecx :760E8373 6E outsb :760E8374 64 BYTE 064h :760E8375 65 BYTE 065h :760E8376 7820 js 760E8398 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8308(C) | :760E8378 2564203E20 and eax, 203E2064 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E835B(C) | :760E837D 6D insd :760E837E 5F pop edi :760E837F 64 BYTE 064h :760E8380 7753 ja 760E83D5 :760E8382 697A6520256400 imul edi, dword ptr [edx+65], 00642520 :760E8389 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E834E(C) | :760E838A 90 nop :760E838B 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E831E(C) | :760E838C 43 inc ebx :760E838D 41 inc ecx :760E838E 7272 jb 760E8402 :760E8390 61 popad :760E8391 7949 jns 760E83DC :760E8393 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8349(C) | :760E8394 64 BYTE 064h :760E8395 65 BYTE 065h :760E8396 783A js 760E83D2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8376(C) | :760E8398 3A5365 cmp dl, byte ptr [ebx+65] :760E839B 7456 je 760E83F3 :760E839D 61 popad :760E839E 6C insb :760E839F 7565 jne 760E8406 :760E83A1 009090434172 add byte ptr [eax+72414390], dl :760E83A7 7261 jb 760E840A :760E83A9 7949 jns 760E83F4 :760E83AB 6E outsb :760E83AC 64 BYTE 064h :760E83AD 65 BYTE 065h :760E83AE 783A js 760E83EA :760E83B0 3A4772 cmp al, byte ptr [edi+72] :760E83B3 6F outsd :760E83B4 7700 ja 760E83B6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E83B4(C) | :760E83B6 3100 xor dword ptr [eax], eax :760E83B8 4E dec esi :760E83B9 756C jne 760E8427 :760E83BB 00496E add byte ptr [ecx+6E], cl :760E83BE 7661 jbe 760E8421 :760E83C0 6C insb :760E83C1 696420656E747279 imul esp, dword ptr [eax+65], 7972746E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8362(C) | :760E83C9 20746F20 and byte ptr [edi+2*ebp+20], dh :760E83CD 64 BYTE 064h :760E83CE 65 BYTE 065h :760E83CF 6C insb :760E83D0 65 BYTE 065h :760E83D1 7465 je 760E8438 :760E83D3 206669 and byte ptr [esi+69], ah :760E83D6 6C insb :760E83D7 65202573206861 and byte ptr gs:[61682073], ah :760E83DE 7320 jnb 760E8400 :760E83E0 626565 bound esp, dword ptr [ebp+65] :760E83E3 6E outsb :760E83E4 207772 and byte ptr [edi+72], dh :760E83E7 697474656E20696E imul esi, dword ptr [esp+2*esi+65], 6E69206E :760E83EF 207769 and byte ptr [edi+69], dh :760E83F2 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E839B(C) | :760E83F3 696E69742E696E imul ebp, dword ptr [esi+69], 6E692E74 :760E83FA 690053465020 imul eax, dword ptr [eax], 20504653 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E83DE(C) | :760E8400 7265 jb 760E8467 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E838E(C) | :760E8402 6D insd :760E8403 6F outsd :760E8404 7665 jbe 760E846B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E839F(C) | :760E8406 6420696E and byte ptr fs:[ecx+6E], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E83A7(C) | :760E840A 7661 jbe 760E846D :760E840C 6C insb :760E840D 696420656E747279 imul esp, dword ptr [eax+65], 7972746E :760E8415 2025733D2573 and byte ptr [73253D73], ah :760E841B 20696E and byte ptr [ecx+6E], ch :760E841E 20746865 and byte ptr [eax+2*ebp+65], dh :760E8422 202573207365 and byte ptr [65732073], ah :760E8428 6374696F arpl dword ptr [ecx+2*ebp+6F], esi :760E842C 6E outsb :760E842D 206672 and byte ptr [esi+72], ah :760E8430 6F outsd :760E8431 6D insd :760E8432 207769 and byte ptr [edi+69], dh :760E8435 6E outsb :760E8436 696E69742E696E imul ebp, dword ptr [esi+69], 6E692E74 :760E843D 69009052454E imul eax, dword ptr [eax], 4E455290 :760E8443 41 inc ecx :760E8444 4D dec ebp :760E8445 45 inc ebp :760E8446 20656E and byte ptr [ebp+6E], ah :760E8449 7472 je 760E84BD :760E844B 7920 jns 760E846D :760E844D 25733D2573 and eax, 73253D73 :760E8452 206973 and byte ptr [ecx+73], ch :760E8455 20696E and byte ptr [ecx+6E], ch :760E8458 7661 jbe 760E84BB :760E845A 6C insb :760E845B 6964009090536F75 imul esp, dword ptr [eax+eax-70], 756F5390 :760E8463 7263 jb 760E84C8 :760E8465 65206669 and byte ptr gs:[esi+69], ah :760E8469 6C insb :760E846A 6520257320646F and byte ptr gs:[6F642073], ah :760E8471 65 BYTE 065h :760E8472 7320 jnb 760E8494 :760E8474 6E outsb :760E8475 6F outsd :760E8476 7420 je 760E8498 :760E8478 65 BYTE 065h :760E8479 7869 js 760E84E4 :760E847B 7374 jnb 760E84F1 :760E847D 00909046696C add byte ptr [eax+6C694690], dl :760E8483 65202573206973 and byte ptr gs:[73692073], ah :760E848A 206E6F and byte ptr [esi+6F], ch :760E848D 7420 je 760E84AF :760E848F 61 popad :760E8490 6E outsb :760E8491 205346 and byte ptr [ebx+46], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8472(C) | :760E8494 50 push eax :760E8495 206669 and byte ptr [esi+69], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8476(C) | :760E8498 6C insb :760E8499 65009053465020 add byte ptr gs:[eax+20504653], dl :760E84A0 66696C65202573 imul bp, word ptr [ebp+20], 7325 :760E84A7 206973 and byte ptr [ecx+73], ch :760E84AA 206F6E and byte ptr [edi+6E], ch :760E84AD 20746865 and byte ptr [eax+2*ebp+65], dh :760E84B1 205248 and byte ptr [edx+48], dl :760E84B4 53 push ebx :760E84B5 206F66 and byte ptr [edi+66], ch :760E84B8 206120 and byte ptr [ecx+20], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8458(C) | :760E84BB 7265 jb 760E8522 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8449(C) | :760E84BD 6E outsb :760E84BE 61 popad :760E84BF 6D insd :760E84C0 65 BYTE 065h :760E84C1 2E204C6873 and byte ptr cs:[eax+2*ebp+73], cl :760E84C6 206973 and byte ptr [ecx+73], ch :760E84C9 202573009090 and byte ptr [90900073], ah :760E84CF 90 nop :760E84D0 53 push ebx :760E84D1 46 inc esi :760E84D2 50 push eax :760E84D3 206669 and byte ptr [esi+69], ah :760E84D6 6C insb :760E84D7 65202573206973 and byte ptr gs:[73692073], ah :760E84DE 206265 and byte ptr [edx+65], ah :760E84E1 696E672064656C imul ebp, dword ptr [esi+67], 6C656420 :760E84E8 65 BYTE 065h :760E84E9 7465 je 760E8550 :760E84EB 64009090905072 add byte ptr fs:[eax+72509090], dl :760E84F2 6F outsd :760E84F3 636573 arpl dword ptr [ebp+73], esp :760E84F6 7369 jnb 760E8561 :760E84F8 6E outsb :760E84F9 67205245 and [bp+si+45], dl :760E84FD 4E dec esi :760E84FE 41 inc ecx :760E84FF 4D dec ebp :760E8500 45 inc ebp :760E8501 20656E and byte ptr [ebp+6E], ah :760E8504 7472 je 760E8578 :760E8506 7920 jns 760E8528 :760E8508 25733D2573 and eax, 73253D73 :760E850D 009090497352 add byte ptr [eax+52734990], dl :760E8513 65 BYTE 065h :760E8514 6E outsb :760E8515 61 popad :760E8516 6D insd :760E8517 65 BYTE 065h :760E8518 45 inc ebp :760E8519 6E outsb :760E851A 7472 je 760E858E :760E851C 7956 jns 760E8574 :760E851E 61 popad :760E851F 6C insb :760E8520 6964009050726F63 imul esp, dword ptr [eax+eax-70], 636F7250 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8506(C) | :760E8528 65 BYTE 065h :760E8529 7373 jnb 760E859E :760E852B 696E67204E554C imul ebp, dword ptr [esi+67], 4C554E20 :760E8532 20656E and byte ptr [ebp+6E], ah :760E8535 7472 je 760E85A9 :760E8537 7920 jns 760E8559 :760E8539 2573004973 and eax, 73490073 :760E853E 4E dec esi :760E853F 55 push ebp :760E8540 4C dec esp :760E8541 45 inc ebp :760E8542 6E outsb :760E8543 7472 je 760E85B7 :760E8545 7956 jns 760E859D :760E8547 61 popad :760E8548 6C insb :760E8549 6964005365745661 imul esp, dword ptr [eax+eax+53], 61567465 :760E8551 6C insb :760E8552 7565 jne 760E85B9 :760E8554 206661 and byte ptr [esi+61], ah :760E8557 696C656400675F70 imul ebp, dword ptr [ebp+64], 705F6700 :760E855F 56 push esi :760E8560 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E84F6(C) | :760E8561 6C insb :760E8562 6964456E74726965 imul esp, dword ptr [ebp+2*eax+6E], 65697274 :760E856A 732D jnb 760E8599 :760E856C 3E BYTE 03eh :760E856D 49 dec ecx :760E856E 6E outsb :760E856F 6974282920666169 imul esi, dword ptr [eax+ebp+29], 69616620 :760E8577 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8504(C) | :760E8578 65 BYTE 065h :760E8579 6400906E657720 add byte ptr fs:[eax+2077656E], dl :760E8580 43 inc ebx :760E8581 41 inc ecx :760E8582 7272 jb 760E85F6 :760E8584 61 popad :760E8585 7949 jns 760E85D0 :760E8587 6E outsb :760E8588 64 BYTE 064h :760E8589 65 BYTE 065h :760E858A 7820 js 760E85AC :760E858C 6661 popa * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E851A(C) | :760E858E 696C656400904372 imul ebp, dword ptr [ebp+64], 72439000 :760E8596 65 BYTE 065h :760E8597 61 popad :760E8598 7469 je 760E8603 :760E859A 6E outsb :760E859B 67206E65 and [bp+65], ch :760E859F 7720 ja 760E85C1 :760E85A1 7661 jbe 760E8604 :760E85A3 6C insb :760E85A4 696420656E747269 imul esp, dword ptr [eax+65], 6972746E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E858A(C) | :760E85AC 65 BYTE 065h :760E85AD 7320 jnb 760E85CF :760E85AF 7461 je 760E8612 :760E85B1 626C6500 bound ebp, dword ptr [ebp] :760E85B5 90 nop :760E85B6 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8543(C) | :760E85B7 90 nop :760E85B8 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8552(C) | :760E85B9 746F je 760E862A :760E85BB 7265 jb 760E8622 :760E85BD 49 dec ecx :760E85BE 6E outsb :760E85BF 56 push esi :760E85C0 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E859F(C) | :760E85C1 6C insb :760E85C2 6964456E74726965 imul esp, dword ptr [ebp+2*eax+6E], 65697274 :760E85CA 7300 jnb 760E85CC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E85CA(C) | :760E85CC 675F pop edi :760E85CE 7045 jo 760E8615 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8585(C) | :760E85D0 6E outsb :760E85D1 7472 je 760E8645 :760E85D3 696573546F4465 imul esp, dword ptr [ebp+73], 65446F54 :760E85DA 6C insb :760E85DB 65 BYTE 065h :760E85DC 7465 je 760E8643 :760E85DE 2D3E496E69 sub eax, 696E493E :760E85E3 7428 je 760E860D :760E85E5 2920 sub dword ptr [eax], esp :760E85E7 6661 popa :760E85E9 696C656400909043 imul ebp, dword ptr [ebp+64], 43909000 :760E85F1 7265 jb 760E8658 :760E85F3 61 popad :760E85F4 7469 je 760E865F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8582(C) | :760E85F6 6E outsb :760E85F7 67206E65 and [bp+65], ch :760E85FB 7720 ja 760E861D :760E85FD 7461 je 760E8660 :760E85FF 626C6500 bound ebp, dword ptr [ebp] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8598(C) | :760E8603 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E85A1(C) | :760E8604 53 push ebx :760E8605 746F je 760E8676 :760E8607 7265 jb 760E866E :760E8609 49 dec ecx :760E860A 6E outsb :760E860B 54 push esp :760E860C 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E85E3(C) | :760E860D 45 inc ebp :760E860E 6E outsb :760E860F 7472 je 760E8683 :760E8611 696573546F4465 imul esp, dword ptr [ebp+73], 65446F54 :760E8618 6C insb :760E8619 65 BYTE 065h :760E861A 7465 je 760E8681 :760E861C 009090904D61 add byte ptr [eax+614D9090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E85BB(C) | :760E8622 7056 jo 760E867A :760E8624 6965774F664669 imul esp, dword ptr [ebp+77], 6946664F :760E862B 6C insb :760E862C 65206661 and byte ptr gs:[esi+61], ah :760E8630 696C65642065633D imul ebp, dword ptr [ebp+64], 3D636520 :760E8638 2564009043 and eax, 43900064 :760E863D 7265 jb 760E86A4 :760E863F 61 popad :760E8640 7465 je 760E86A7 :760E8642 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E85DC(C) | :760E8643 696C654D61707069 imul ebp, dword ptr [ebp+4D], 69707061 :760E864B 6E outsb :760E864C 67206661 and [bp+61], ah :760E8650 696C65642065633D imul ebp, dword ptr [ebp+64], 3D636520 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E85F1(C) | :760E8658 2564009043 and eax, 43900064 :760E865D 7265 jb 760E86C4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E85F4(C) | :760E865F 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E85FD(C) | :760E8660 7465 je 760E86C7 :760E8662 46 inc esi :760E8663 696C652020666169 imul ebp, dword ptr [ebp+20], 69616620 :760E866B 6C insb :760E866C 65 BYTE 065h :760E866D 64206563 and byte ptr fs:[ebp+63], ah :760E8671 3D25640090 cmp eax, 90006425 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8605(C) | :760E8676 90 nop :760E8677 90 nop :760E8678 4D dec ebp :760E8679 794D jns 760E86C8 :760E867B 61 popad :760E867C 7046 jo 760E86C4 :760E867E 696C650090904572 imul ebp, dword ptr [ebp], 72459090 :760E8686 726F jb 760E86F7 :760E8688 7220 jb 760E86AA :760E868A 636F70 arpl dword ptr [edi+70], ebp :760E868D 7969 jns 760E86F8 :760E868F 6E outsb :760E8690 67207769 and [bx+69], dh :760E8694 6E outsb :760E8695 696E6974206563 imul ebp, dword ptr [esi+69], 63652074 :760E869C 3D2564004D cmp eax, 4D006425 :760E86A1 61 popad :760E86A2 6B65436F imul esp, dword ptr [ebp+43], 0000006F :760E86A6 7079 jo 760E8721 :760E86A8 4F dec edi :760E86A9 6657 push di :760E86AB 696E696E697400 imul ebp, dword ptr [esi+69], 0074696E :760E86B2 90 nop :760E86B3 90 nop :760E86B4 6E outsb :760E86B5 6F outsd :760E86B6 207375 and byte ptr [ebx+75], dh :760E86B9 636820 arpl dword ptr [eax+20], ebp :760E86BC 7365 jnb 760E8723 :760E86BE 6374696F arpl dword ptr [ecx+2*ebp+6F], esi :760E86C2 6E outsb :760E86C3 202573009043 and byte ptr [43900073], ah :760E86C9 61 popad :760E86CA 6E outsb :760E86CB 6E outsb :760E86CC 6F outsd :760E86CD 7420 je 760E86EF :760E86CF 6F outsd :760E86D0 7065 jo 760E8737 :760E86D2 6E outsb :760E86D3 207769 and byte ptr [edi+69], dh :760E86D6 6E outsb :760E86D7 696E697420636F imul ebp, dword ptr [esi+69], 6F632074 :760E86DE 7079 jo 760E8759 :760E86E0 009090904361 add byte ptr [eax+61439090], dl :760E86E6 6E outsb :760E86E7 6E outsb :760E86E8 6F outsd :760E86E9 7420 je 760E870B :760E86EB 6D insd :760E86EC 61 popad :760E86ED 6B652063 imul esp, dword ptr [ebp+20], 00000063 :760E86F1 6F outsd :760E86F2 7079 jo 760E876D :760E86F4 206F66 and byte ptr [edi+66], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8686(C) | :760E86F7 2020 and byte ptr [eax], ah :760E86F9 7769 ja 760E8764 :760E86FB 6E outsb :760E86FC 696E6974009090 imul ebp, dword ptr [esi+69], 90900074 :760E8703 90 nop :760E8704 50 push eax :760E8705 726F jb 760E8776 :760E8707 636573 arpl dword ptr [ebp+73], esp :760E870A 7357 jnb 760E8763 :760E870C 696E696E697400 imul ebp, dword ptr [esi+69], 0074696E :760E8713 90 nop :760E8714 46 inc esi :760E8715 6F outsd :760E8716 756E jne 760E8786 :760E8718 64207769 and byte ptr fs:[edi+69], dh :760E871C 6E outsb :760E871D 696E697420656E imul ebp, dword ptr [esi+69], 6E652074 :760E8724 7472 je 760E8798 :760E8726 7900 jns 760E8728 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8726(C) | :760E8728 6E outsb :760E8729 65 BYTE 065h :760E872A 7720 ja 760E874C :760E872C 6661 popa :760E872E 696C656400904465 imul ebp, dword ptr [ebp+64], 65449000 :760E8736 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E86D0(C) | :760E8737 65 BYTE 065h :760E8738 7469 je 760E87A3 :760E873A 6E outsb :760E873B 6720656E and [di+6E], ah :760E873F 7472 je 760E87B3 :760E8741 7920 jns 760E8763 :760E8743 25733D2573 and eax, 73253D73 :760E8748 207365 and byte ptr [ebx+65], dh :760E874B 6374696F arpl dword ptr [ecx+2*ebp+6F], esi :760E874F 6E outsb :760E8750 202564004465 and byte ptr [65440064], ah :760E8756 6C insb :760E8757 65 BYTE 065h :760E8758 7465 je 760E87BF :760E875A 45 inc ebp :760E875B 6E outsb :760E875C 7472 je 760E87D0 :760E875E 7946 jns 760E87A6 :760E8760 726F jb 760E87D1 :760E8762 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E870A(C), :760E8741(C) | :760E8763 57 push edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E86F9(C) | :760E8764 696E696E697400 imul ebp, dword ptr [esi+69], 0074696E :760E876B 90 nop :760E876C 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E86F2(C) | :760E876D 46 inc esi :760E876E 50 push eax :760E876F 206361 and byte ptr [ebx+61], ah :760E8772 6E outsb :760E8773 6E outsb :760E8774 6F outsd :760E8775 7420 je 760E8797 :760E8777 7265 jb 760E87DE :760E8779 7374 jnb 760E87EF :760E877B 6F outsd :760E877C 7265 jb 760E87E3 :760E877E 206669 and byte ptr [esi+69], ah :760E8781 6C insb :760E8782 65202573206261 and byte ptr gs:[61622073], ah :760E8789 636B2E arpl dword ptr [ebx+2E], ebp :760E878C 20436F and byte ptr [ebx+6F], al :760E878F 756C jne 760E87FD :760E8791 64206E6F and byte ptr fs:[esi+6F], ch :760E8795 7420 je 760E87B7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8775(C) | :760E8797 7265 jb 760E87FE :760E8799 6D insd :760E879A 6F outsd :760E879B 7665 jbe 760E8802 :760E879D 20656E and byte ptr [ebp+6E], ah :760E87A0 7472 je 760E8814 :760E87A2 7920 jns 760E87C4 :760E87A4 66726F jb 760E8816 :760E87A7 6D insd :760E87A8 207769 and byte ptr [edi+69], dh :760E87AB 6E outsb :760E87AC 696E69742E696E imul ebp, dword ptr [esi+69], 6E692E74 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E873F(C) | :760E87B3 690090909043 imul eax, dword ptr [eax], 43909090 :760E87B9 6F outsd :760E87BA 756C jne 760E8828 :760E87BC 64206E6F and byte ptr fs:[esi+6F], ch :760E87C0 7420 je 760E87E2 :760E87C2 64 BYTE 064h :760E87C3 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E87A2(C) | :760E87C4 6C insb :760E87C5 65 BYTE 065h :760E87C6 7465 je 760E882D :760E87C8 20656E and byte ptr [ebp+6E], ah :760E87CB 7472 je 760E883F :760E87CD 7900 jns 760E87CF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E87CD(C) | :760E87CF 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E875C(C) | :760E87D0 44 inc esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8760(C) | :760E87D1 65 BYTE 065h :760E87D2 6C insb :760E87D3 65 BYTE 065h :760E87D4 7465 je 760E883B :760E87D6 6420656E and byte ptr fs:[ebp+6E], ah :760E87DA 7472 je 760E884E :760E87DC 7900 jns 760E87DE * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E8777(C), :760E87DC(C) | :760E87DE 90 nop :760E87DF 90 nop :760E87E0 4E dec esi :760E87E1 55 push ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E87C0(C) | :760E87E2 4C dec esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E877C(C) | :760E87E3 00547279 add byte ptr [edx+2*esi+79], dl :760E87E7 696E6720746F20 imul ebp, dword ptr [esi+67], 206F7420 :760E87EE 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8779(C) | :760E87EF 65 BYTE 065h :760E87F0 6C insb :760E87F1 65 BYTE 065h :760E87F2 7465 je 760E8859 :760E87F4 20656E and byte ptr [ebp+6E], ah :760E87F7 7472 je 760E886B :760E87F9 7920 jns 760E881B :760E87FB 25733D2573 and eax, 73253D73 :760E8800 20696E and byte ptr [ecx+6E], ch :760E8803 202573207365 and byte ptr [65732073], ah :760E8809 6374696F arpl dword ptr [ecx+2*ebp+6F], esi :760E880D 6E outsb :760E880E 009043616E6E add byte ptr [eax+6E6E6143], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E87A0(C) | :760E8814 6F outsd :760E8815 7420 je 760E8837 :760E8817 6F outsd :760E8818 7065 jo 760E887F :760E881A 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E87F9(C) | :760E881B 207769 and byte ptr [edi+69], dh :760E881E 6E outsb :760E881F 696E697420666F imul ebp, dword ptr [esi+69], 6F662074 :760E8826 7220 jb 760E8848 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E87BA(C) | :760E8828 7772 ja 760E889C :760E882A 6974696E67004E6F imul esi, dword ptr [ecx+2*ebp+6E], 6F4E0067 :760E8832 20656E and byte ptr [ebp+6E], ah :760E8835 7472 je 760E88A9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8815(C) | :760E8837 69657320746F20 imul esp, dword ptr [ebp+73], 206F7420 :760E883E 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E87CB(C) | :760E883F 65 BYTE 065h :760E8840 6C insb :760E8841 65 BYTE 065h :760E8842 7465 je 760E88A9 :760E8844 009090905772 add byte ptr [eax+72579090], dl :760E884A 69746557696E696E imul esi, dword ptr [ebp+57], 6E696E69 :760E8852 69744368616E6765 imul esi, dword ptr [ebx+2*eax+68], 65676E61 :760E885A 7300 jnb 760E885C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E885A(C) | :760E885C 57 push edi :760E885D 61 popad :760E885E 6974204661696C65 imul esi, dword ptr [eax+46], 656C6961 :760E8866 64206563 and byte ptr fs:[ebp+63], ah :760E886A 3D25640090 cmp eax, 90006425 :760E886F 90 nop :760E8870 57 push edi :760E8871 696E696E697420 imul ebp, dword ptr [esi+69], 2074696E :760E8878 65 BYTE 065h :760E8879 7665 jbe 760E88E0 :760E887B 6E outsb :760E887C 7420 je 760E889E :760E887E 6973207369676E imul esi, dword ptr [ebx+20], 6E676973 :760E8885 61 popad :760E8886 6C insb :760E8887 6C insb :760E8888 65 BYTE 065h :760E8889 64009054696D65 add byte ptr fs:[eax+656D6954], dl :760E8890 6F outsd :760E8891 7574 jne 760E8907 :760E8893 206F63 and byte ptr [edi+63], ch :760E8896 637572 arpl dword ptr [ebp+72], esi :760E8899 7265 jb 760E8900 :760E889B 64009090905368 add byte ptr fs:[eax+68539090], dl :760E88A2 7574 jne 760E8918 :760E88A4 64 BYTE 064h :760E88A5 6F outsd :760E88A6 776E ja 760E8916 :760E88A8 206576 and byte ptr [ebp+76], ah :760E88AB 65 BYTE 065h :760E88AC 6E outsb :760E88AD 7420 je 760E88CF :760E88AF 6973207369676E imul esi, dword ptr [ebx+20], 6E676973 :760E88B6 61 popad :760E88B7 6C insb :760E88B8 6C insb :760E88B9 65 BYTE 065h :760E88BA 64005769 add byte ptr fs:[edi+69], dl :760E88BE 6E outsb :760E88BF 696E6974546872 imul ebp, dword ptr [esi+69], 72685474 :760E88C6 65 BYTE 065h :760E88C7 61 popad :760E88C8 6400909043616E add byte ptr fs:[eax+6E614390], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E88AD(C) | :760E88CF 6E outsb :760E88D0 6F outsd :760E88D1 7420 je 760E88F3 :760E88D3 7369 jnb 760E893E :760E88D5 676E outsb :760E88D7 61 popad :760E88D8 6C insb :760E88D9 207769 and byte ptr [edi+69], dh :760E88DC 6E outsb :760E88DD 696E6974206576 imul ebp, dword ptr [esi+69], 76652074 :760E88E4 65 BYTE 065h :760E88E5 6E outsb :760E88E6 7420 je 760E8908 :760E88E8 65633D25640090 arpl dword ptr gs:[90006425], edi :760E88EF 90 nop :760E88F0 43 inc ebx :760E88F1 61 popad :760E88F2 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E88D1(C) | :760E88F3 6E outsb :760E88F4 6F outsd :760E88F5 7420 je 760E8917 :760E88F7 637265 arpl dword ptr [edx+65], esi :760E88FA 61 popad :760E88FB 7465 je 760E8962 :760E88FD 207769 and byte ptr [edi+69], dh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8899(C) | :760E8900 6E outsb :760E8901 696E6974207468 imul ebp, dword ptr [esi+69], 68742074 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E88E6(C) | :760E8908 7265 jb 760E896F :760E890A 61 popad :760E890B 64206563 and byte ptr fs:[ebp+63], ah :760E890F 3D25640090 cmp eax, 90006425 :760E8914 43 inc ebx :760E8915 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E88A6(C) | :760E8916 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E88F5(C) | :760E8917 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E88A2(C) | :760E8918 6F outsd :760E8919 7420 je 760E893B :760E891B 637265 arpl dword ptr [edx+65], esi :760E891E 61 popad :760E891F 7465 je 760E8986 :760E8921 207769 and byte ptr [edi+69], dh :760E8924 6E outsb :760E8925 696E6974206576 imul ebp, dword ptr [esi+69], 76652074 :760E892C 65 BYTE 065h :760E892D 6E outsb :760E892E 7420 je 760E8950 :760E8930 65633D25640090 arpl dword ptr gs:[90006425], edi :760E8937 90 nop :760E8938 43 inc ebx :760E8939 61 popad :760E893A 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8919(C) | :760E893B 6E outsb :760E893C 6F outsd :760E893D 7420 je 760E895F :760E893F 67 BYTE 067h :760E8940 65 BYTE 065h :760E8941 7420 je 760E8963 :760E8943 6C insb :760E8944 6F outsd :760E8945 636174 arpl dword ptr [ecx+74], esp :760E8948 696F6E206F6620 imul ebp, dword ptr [edi+6E], 20666F20 :760E894F 57 push edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E892E(C) | :760E8950 696E696E697420 imul ebp, dword ptr [esi+69], 2074696E :760E8957 636F70 arpl dword ptr [edi+70], ebp :760E895A 7900 jns 760E895C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E895A(C) | :760E895C 48 dec eax :760E895D 61 popad :760E895E 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E893D(C) | :760E895F 64 BYTE 064h :760E8960 6C insb :760E8961 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E88FB(C) | :760E8962 57 push edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8941(C) | :760E8963 696E696E697443 imul ebp, dword ptr [esi+69], 4374696E :760E896A 68616E6765 push 65676E61 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8908(C) | :760E896F 64009090902577 add byte ptr fs:[eax+77259090], dl :760E8976 696E646972255C imul ebp, dword ptr [esi+64], 5C257269 :760E897D 7379 jnb 760E89F8 :760E897F 7374 jnb 760E89F5 :760E8981 65 BYTE 065h :760E8982 6D insd :760E8983 5C pop esp :760E8984 7366 jnb 760E89EC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E891F(C) | :760E8986 705C jo 760E89E4 :760E8988 7769 ja 760E89F3 :760E898A 6E outsb :760E898B 696E69742E6370 imul ebp, dword ptr [esi+69], 70632E74 :760E8992 7900 jns 760E8994 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8992(C) | :760E8994 90 nop :760E8995 90 nop :760E8996 90 nop :760E8997 90 nop :760E8998 90 nop :760E8999 BF3329367B mov edi, 7B362933 :760E899E D211 rcl byte ptr [ecx], cl :760E89A0 B20E mov dl, 0E :760E89A2 00C0 add al, al :760E89A4 4F dec edi :760E89A5 98 cwde :760E89A6 3E BYTE 03eh :760E89A7 60 pushad :760E89A8 81BF3329367BD211B20E cmp dword ptr [edi+7B362933], 0EB211D2 :760E89B2 00C0 add al, al :760E89B4 4F dec edi :760E89B5 98 cwde :760E89B6 3E BYTE 03eh :760E89B7 60 pushad :760E89B8 4F dec edi :760E89B9 7574 jne 760E8A2F :760E89BB 206F66 and byte ptr [edi+66], ch :760E89BE 204D65 and byte ptr [ebp+65], cl :760E89C1 6D insd :760E89C2 6F outsd :760E89C3 7279 jb 760E8A3E :760E89C5 0090906C7073 add byte ptr [eax+73706C90], dl :760E89CB 7A44 jpe 760E8A11 :760E89CD 53 push ebx :760E89CE 52 push edx :760E89CF 6F outsd :760E89D0 6F outsd :760E89D1 743A je 760E8A0D :760E89D3 202573009047 and byte ptr [47900073], ah :760E89D9 65 BYTE 065h :760E89DA 7444 je 760E8A20 :760E89DC 53 push ebx :760E89DD 52 push edx :760E89DE 6F outsd :760E89DF 6F outsd :760E89E0 7420 je 760E8A02 :760E89E2 6661 popa * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8986(C) | :760E89E4 696C656400909090 imul ebp, dword ptr [ebp+64], 90909000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8984(C) | :760E89EC 5F pop edi :760E89ED 53 push ebx :760E89EE 7472 je 760E8A62 :760E89F0 43 inc ebx :760E89F1 61 popad :760E89F2 7420 je 760E8A14 :760E89F4 6661 popa :760E89F6 696C656420666F72 imul ebp, dword ptr [ebp+64], 726F6620 :760E89FE 20257320616E and byte ptr [6E612073], ah :760E8A04 64202573009090 and byte ptr fs:[90900073], ah :760E8A0B 90 nop :760E8A0C 44 inc esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E89D1(C) | :760E8A0D 61 popad :760E8A0E 7461 je 760E8A71 :760E8A10 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E89CB(C) | :760E8A11 746F je 760E8A82 :760E8A13 7220 jb 760E8A35 :760E8A15 49 dec ecx :760E8A16 6E outsb :760E8A17 6974206661696C65 imul esi, dword ptr [eax+66], 656C6961 :760E8A1F 64009090907070 add byte ptr fs:[eax+70709090], dl :760E8A26 737A jnb 760E8AA2 :760E8A28 44 inc esp :760E8A29 53 push ebx :760E8A2A 52 push edx :760E8A2B 6F outsd :760E8A2C 6F outsd :760E8A2D 7420 je 760E8A4F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E89B9(C) | :760E8A2F 6973204E554C4C imul esi, dword ptr [ebx+20], 4C4C554E :760E8A36 009047657456 add byte ptr [eax+56746547], dl :760E8A3C 7844 js 760E8A82 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E89C3(C) | :760E8A3E 44 inc esp :760E8A3F 61 popad :760E8A40 7450 je 760E8A92 :760E8A42 61 popad :760E8A43 7468 je 760E8AAD :760E8A45 009090476574 add byte ptr [eax+74654790], dl :760E8A4B 41 inc ecx :760E8A4C 7263 jb 760E8AB1 :760E8A4E 6869766544 push 44657669 :760E8A53 6972206661696C imul esi, dword ptr [edx+20], 6C696166 :760E8A5A 65 BYTE 065h :760E8A5B 64009090904765 add byte ptr fs:[eax+65479090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E89EE(C) | :760E8A62 7441 je 760E8AA5 :760E8A64 7263 jb 760E8AC9 :760E8A66 6869766544 push 44657669 :760E8A6B 69720090904765 imul esi, dword ptr [edx+00], 65479090 :760E8A72 7444 je 760E8AB8 :760E8A74 53 push ebx :760E8A75 54 push esp :760E8A76 65 BYTE 065h :760E8A77 6D insd :760E8A78 7020 jo 760E8A9A :760E8A7A 6661 popa :760E8A7C 696C656400909090 imul ebp, dword ptr [ebp+64], 90909000 :760E8A84 47 inc edi :760E8A85 65 BYTE 065h :760E8A86 7444 je 760E8ACC :760E8A88 53 push ebx :760E8A89 54 push esp :760E8A8A 65 BYTE 065h :760E8A8B 6D insd :760E8A8C 7000 jo 760E8A8E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8A8C(C) | :760E8A8E 90 nop :760E8A8F 90 nop :760E8A90 6D insd :760E8A91 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8A40(C) | :760E8A92 6C insb :760E8A93 7073 jo 760E8B08 :760E8A95 7A44 jpe 760E8ADB :760E8A97 53 push ebx :760E8A98 52 push edx :760E8A99 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8A78(C) | :760E8A9A 6F outsd :760E8A9B 7420 je 760E8ABD :760E8A9D 6973204E554C4C imul esi, dword ptr [ebx+20], 4C4C554E :760E8AA4 009090904465 add byte ptr [eax+65449090], dl :760E8AAA 6661 popa :760E8AAC 756C jne 760E8B1A :760E8AAE 7420 je 760E8AD0 :760E8AB0 7661 jbe 760E8B13 :760E8AB2 6C insb :760E8AB3 7565 jne 760E8B1A :760E8AB5 3D25732073 cmp eax, 73207325 :760E8ABA 65 BYTE 065h :760E8ABB 7420 je 760E8ADD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8A9B(C) | :760E8ABD 6F outsd :760E8ABE 66204944 and byte ptr [ecx+44], cl :760E8AC2 53 push ebx :760E8AC3 5F pop edi :760E8AC4 49 dec ecx :760E8AC5 4E dec esi :760E8AC6 49 dec ecx :760E8AC7 46 inc esi :760E8AC8 49 dec ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8A64(C) | :760E8AC9 4C dec esp :760E8ACA 45 inc ebp :760E8ACB 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8A86(C) | :760E8ACC 41 inc ecx :760E8ACD 54 push esp :760E8ACE 48 dec eax :760E8ACF 00446566 add byte ptr [ebp+66], al :760E8AD3 61 popad :760E8AD4 756C jne 760E8B42 :760E8AD6 7420 je 760E8AF8 :760E8AD8 7661 jbe 760E8B3B :760E8ADA 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8A95(C) | :760E8ADB 7565 jne 760E8B42 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8ABB(C) | :760E8ADD 3D25732073 cmp eax, 73207325 :760E8AE2 65 BYTE 065h :760E8AE3 7420 je 760E8B05 :760E8AE5 6F outsd :760E8AE6 66204944 and byte ptr [ecx+44], cl :760E8AEA 53 push ebx :760E8AEB 5F pop edi :760E8AEC 44 inc esp :760E8AED 53 push ebx :760E8AEE 52 push edx :760E8AEF 4F dec edi :760E8AF0 4F dec edi :760E8AF1 54 push esp :760E8AF2 009044656661 add byte ptr [eax+61666544], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8AD6(C) | :760E8AF8 756C jne 760E8B66 :760E8AFA 7420 je 760E8B1C :760E8AFC 7661 jbe 760E8B5F :760E8AFE 6C insb :760E8AFF 7565 jne 760E8B66 :760E8B01 3D25732073 cmp eax, 73207325 :760E8B06 65 BYTE 065h :760E8B07 7420 je 760E8B29 :760E8B09 6F outsd :760E8B0A 66204944 and byte ptr [ecx+44], cl :760E8B0E 53 push ebx :760E8B0F 5F pop edi :760E8B10 44 inc esp :760E8B11 53 push ebx :760E8B12 49 dec ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8AB0(C) | :760E8B13 4E dec esi :760E8B14 46 inc esi :760E8B15 4F dec edi :760E8B16 009044656661 add byte ptr [eax+61666544], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8AFA(C) | :760E8B1C 756C jne 760E8B8A :760E8B1E 7420 je 760E8B40 :760E8B20 7661 jbe 760E8B83 :760E8B22 6C insb :760E8B23 7565 jne 760E8B8A :760E8B25 3D25732073 cmp eax, 73207325 :760E8B2A 65 BYTE 065h :760E8B2B 7420 je 760E8B4D :760E8B2D 6F outsd :760E8B2E 66204944 and byte ptr [ecx+44], cl :760E8B32 53 push ebx :760E8B33 5F pop edi :760E8B34 53 push ebx :760E8B35 46 inc esi :760E8B36 50 push eax :760E8B37 00446566 add byte ptr [ebp+66], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8AD8(C) | :760E8B3B 61 popad :760E8B3C 756C jne 760E8BAA :760E8B3E 7420 je 760E8B60 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8B1E(C) | :760E8B40 7661 jbe 760E8BA3 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E8AD4(C), :760E8ADB(C) | :760E8B42 6C insb :760E8B43 7565 jne 760E8BAA :760E8B45 3D25732073 cmp eax, 73207325 :760E8B4A 65 BYTE 065h :760E8B4B 7420 je 760E8B6D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8B2B(C) | :760E8B4D 6F outsd :760E8B4E 66204944 and byte ptr [ecx+44], cl :760E8B52 53 push ebx :760E8B53 5F pop edi :760E8B54 4C dec esp :760E8B55 4F dec edi :760E8B56 47 inc edi :760E8B57 53 push ebx :760E8B58 009090904465 add byte ptr [eax+65449090], dl :760E8B5E 6661 popa * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8B3E(C) | :760E8B60 756C jne 760E8BCE :760E8B62 7420 je 760E8B84 :760E8B64 7661 jbe 760E8BC7 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E8AF8(C), :760E8AFF(C) | :760E8B66 6C insb :760E8B67 7565 jne 760E8BCE :760E8B69 3D25732073 cmp eax, 73207325 :760E8B6E 65 BYTE 065h :760E8B6F 7420 je 760E8B91 :760E8B71 6F outsd :760E8B72 66204944 and byte ptr [ecx+44], cl :760E8B76 53 push ebx :760E8B77 5F pop edi :760E8B78 41 inc ecx :760E8B79 52 push edx :760E8B7A 43 inc ebx :760E8B7B 48 dec eax :760E8B7C 49 dec ecx :760E8B7D 56 push esi :760E8B7E 45 inc ebp :760E8B7F 00446566 add byte ptr [ebp+66], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8B20(C) | :760E8B83 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8B62(C) | :760E8B84 756C jne 760E8BF2 :760E8B86 7420 je 760E8BA8 :760E8B88 7661 jbe 760E8BEB * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E8B1C(C), :760E8B23(C) | :760E8B8A 6C insb :760E8B8B 7565 jne 760E8BF2 :760E8B8D 3D25732073 cmp eax, 73207325 :760E8B92 65 BYTE 065h :760E8B93 7420 je 760E8BB5 :760E8B95 6F outsd :760E8B96 66204944 and byte ptr [ecx+44], cl :760E8B9A 53 push ebx :760E8B9B 5F pop edi :760E8B9C 54 push esp :760E8B9D 45 inc ebp :760E8B9E 4D dec ebp :760E8B9F 50 push eax :760E8BA0 009090904465 add byte ptr [eax+65449090], dl :760E8BA6 6661 popa * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8B86(C) | :760E8BA8 756C jne 760E8C16 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E8B3C(C), :760E8B43(C) | :760E8BAA 7420 je 760E8BCC :760E8BAC 7661 jbe 760E8C0F :760E8BAE 6C insb :760E8BAF 7565 jne 760E8C16 :760E8BB1 3D25732073 cmp eax, 73207325 :760E8BB6 65 BYTE 065h :760E8BB7 7420 je 760E8BD9 :760E8BB9 6F outsd :760E8BBA 66204944 and byte ptr [ecx+44], cl :760E8BBE 53 push ebx :760E8BBF 5F pop edi :760E8BC0 52 push edx :760E8BC1 45 inc ebp :760E8BC2 53 push ebx :760E8BC3 54 push esp :760E8BC4 4F dec edi :760E8BC5 52 push edx :760E8BC6 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8B64(C) | :760E8BC7 006D5F add byte ptr [ebp+5F], ch :760E8BCA 6C insb :760E8BCB 7073 jo 760E8C40 :760E8BCD 7A44 jpe 760E8C13 :760E8BCF 53 push ebx :760E8BD0 52 push edx :760E8BD1 6F outsd :760E8BD2 6F outsd :760E8BD3 743A je 760E8C0F :760E8BD5 202573009090 and byte ptr [90900073], ah :760E8BDB 90 nop :760E8BDC 5F pop edi :760E8BDD 53 push ebx :760E8BDE 7472 je 760E8C52 :760E8BE0 43 inc ebx :760E8BE1 61 popad :760E8BE2 7420 je 760E8C04 :760E8BE4 6661 popa :760E8BE6 696C65643B206872 imul ebp, dword ptr [ebp+64], 7268203B :760E8BEE 3D30782578 cmp eax, 78257830 :760E8BF3 004F75 add byte ptr [edi+75], cl :760E8BF6 7420 je 760E8C18 :760E8BF8 6F outsd :760E8BF9 66204D65 and byte ptr [ebp+65], cl :760E8BFD 6D insd :760E8BFE 6F outsd :760E8BFF 7279 jb 760E8C7A :760E8C01 3B20 cmp esp, dword ptr [eax] :760E8C03 68723D3078 push 78303D72 :760E8C08 2578009043 and eax, 43900078 :760E8C0D 44 inc esp :760E8C0E 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E8BAC(C), :760E8BD3(C) | :760E8C0F 7461 je 760E8C72 :760E8C11 53 push ebx :760E8C12 746F je 760E8C83 :760E8C14 723A jb 760E8C50 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E8BA8(C), :760E8BAF(C) | :760E8C16 3A4765 cmp al, byte ptr [edi+65] :760E8C19 7444 je 760E8C5F :760E8C1B 53 push ebx :760E8C1C 52 push edx :760E8C1D 6F outsd :760E8C1E 6F outsd :760E8C1F 7400 je 760E8C21 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8C1F(C) | :760E8C21 90 nop :760E8C22 90 nop :760E8C23 90 nop :760E8C24 2A7070 sub dh, byte ptr [eax+70] :760E8C27 44 inc esp :760E8C28 53 push ebx :760E8C29 54 push esp :760E8C2A 65 BYTE 065h :760E8C2B 6D insd :760E8C2C 7044 jo 760E8C72 :760E8C2E 69723D25730070 imul esi, dword ptr [edx+3D], 70007325 :760E8C35 7044 jo 760E8C7B :760E8C37 53 push ebx :760E8C38 54 push esp :760E8C39 65 BYTE 065h :760E8C3A 6D insd :760E8C3B 7044 jo 760E8C81 :760E8C3D 6972206973204E imul esi, dword ptr [edx+20], 4E207369 :760E8C44 55 push ebp :760E8C45 4C dec esp :760E8C46 4C dec esp :760E8C47 004344 add byte ptr [ebx+44], al :760E8C4A 61 popad :760E8C4B 7461 je 760E8CAE :760E8C4D 53 push ebx :760E8C4E 746F je 760E8CBF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8C14(C) | :760E8C50 723A jb 760E8C8C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8BDE(C) | :760E8C52 3A4765 cmp al, byte ptr [edi+65] :760E8C55 7444 je 760E8C9B :760E8C57 53 push ebx :760E8C58 54 push esp :760E8C59 65 BYTE 065h :760E8C5A 6D insd :760E8C5B 7000 jo 760E8C5D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8C5B(C) | :760E8C5D 90 nop :760E8C5E 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8C19(C) | :760E8C5F 90 nop :760E8C60 47 inc edi :760E8C61 65 BYTE 065h :760E8C62 744C je 760E8CB0 :760E8C64 6F outsd :760E8C65 676963616C447269 imul esp, [bp+di+61], 6972446C :760E8C6D 7665 jbe 760E8CD4 :760E8C6F 53 push ebx :760E8C70 7472 je 760E8CE4 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E8C0F(C), :760E8C2C(C) | :760E8C72 696E6773206661 imul ebp, dword ptr [esi+67], 61662073 :760E8C79 696C65643B206872 imul ebp, dword ptr [ebp+64], 7268203B :760E8C81 3D30782578 cmp eax, 78257830 :760E8C86 00902A707073 add byte ptr [eax+7370702A], dl :760E8C8C 7A41 jpe 760E8CCF :760E8C8E 7263 jb 760E8CF3 :760E8C90 6869766544 push 44657669 :760E8C95 69723D25730090 imul esi, dword ptr [edx+3D], 90007325 :760E8C9C 7070 jo 760E8D0E :760E8C9E 737A jnb 760E8D1A :760E8CA0 41 inc ecx :760E8CA1 7263 jb 760E8D06 :760E8CA3 6869766544 push 44657669 :760E8CA8 6972206973204E imul esi, dword ptr [edx+20], 4E207369 :760E8CAF 55 push ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8C62(C) | :760E8CB0 4C dec esp :760E8CB1 4C dec esp :760E8CB2 009043446174 add byte ptr [eax+74614443], dl :760E8CB8 61 popad :760E8CB9 53 push ebx :760E8CBA 746F je 760E8D2B :760E8CBC 723A jb 760E8CF8 :760E8CBE 3A4765 cmp al, byte ptr [edi+65] :760E8CC1 7441 je 760E8D04 :760E8CC3 7263 jb 760E8D28 :760E8CC5 6869766544 push 44657669 :760E8CCA 6972009090906D imul esi, dword ptr [edx+00], 6D909090 :760E8CD1 5F pop edi :760E8CD2 6C insb :760E8CD3 7073 jo 760E8D48 :760E8CD5 7A49 jpe 760E8D20 :760E8CD7 6E outsb :760E8CD8 6946696C653D25 imul eax, dword ptr [esi+69], 253D656C :760E8CDF 7300 jnb 760E8CE1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8CDF(C) | :760E8CE1 90 nop :760E8CE2 90 nop :760E8CE3 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8C70(C) | :760E8CE4 47 inc edi :760E8CE5 65 BYTE 065h :760E8CE6 7457 je 760E8D3F :760E8CE8 696E646F777344 imul ebp, dword ptr [esi+64], 4473776F :760E8CEF 69726563746F72 imul esi, dword ptr [edx+65], 726F7463 :760E8CF6 7920 jns 760E8D18 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8CBC(C) | :760E8CF8 6661 popa :760E8CFA 696C65642E205573 imul ebp, dword ptr [ebp+64], 7355202E :760E8D02 696E6720446566 imul ebp, dword ptr [esi+67], 66654420 :760E8D09 61 popad :760E8D0A 756C jne 760E8D78 :760E8D0C 7400 je 760E8D0E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E8C9C(C), :760E8D0C(C) | :760E8D0E 90 nop :760E8D0F 90 nop :760E8D10 4C dec esp :760E8D11 6F outsd :760E8D12 61 popad :760E8D13 64 BYTE 064h :760E8D14 52 push edx :760E8D15 65 BYTE 065h :760E8D16 7374 jnb 760E8D8C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8CF6(C) | :760E8D18 6F outsd :760E8D19 7252 jb 760E8D6D :760E8D1B 6320 arpl dword ptr [eax], esp :760E8D1D 6661 popa :760E8D1F 696C65640043616C imul ebp, dword ptr [ebp+64], 6C614300 :760E8D27 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8CC3(C) | :760E8D28 696E67204C6F61 imul ebp, dword ptr [esi+67], 616F4C20 :760E8D2F 64 BYTE 064h :760E8D30 52 push edx :760E8D31 65 BYTE 065h :760E8D32 7374 jnb 760E8DA8 :760E8D34 6F outsd :760E8D35 7252 jb 760E8D89 :760E8D37 6300 arpl dword ptr [eax], eax :760E8D39 90 nop :760E8D3A 90 nop :760E8D3B 90 nop :760E8D3C 41 inc ecx :760E8D3D 6C insb :760E8D3E 7265 jb 760E8DA5 :760E8D40 61 popad :760E8D41 64 BYTE 064h :760E8D42 7920 jns 760E8D64 :760E8D44 696E697469616C imul ebp, dword ptr [esi+69], 6C616974 :760E8D4B 697A6564006F75 imul edi, dword ptr [edx+65], 756F0064 :760E8D52 7420 je 760E8D74 :760E8D54 6F outsd :760E8D55 66206D65 and byte ptr [ebp+65], ch :760E8D59 6D insd :760E8D5A 6F outsd :760E8D5B 7279 jb 760E8DD6 :760E8D5D 009090576520 add byte ptr [eax+20655790], dl :760E8D63 6861766520 push 20657661 :760E8D68 61 popad :760E8D69 206D65 and byte ptr [ebp+65], ch :760E8D6C 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8D19(C) | :760E8D6D 6F outsd :760E8D6E 7279 jb 760E8DE9 :760E8D70 206C6561 and byte ptr [ebp+61], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8D52(C) | :760E8D74 6B2068 imul esp, dword ptr [eax], 00000068 :760E8D77 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8D0A(C) | :760E8D78 7265 jb 760E8DDF :760E8D7A 2E BYTE 02eh :760E8D7B 2E BYTE 02eh :760E8D7C 2E0090906C7073 add byte ptr cs:[eax+73706C90], dl :760E8D83 7A52 jpe 760E8DD7 :760E8D85 65 BYTE 065h :760E8D86 7320 jnb 760E8DA8 :760E8D88 6973204E554C4C imul esi, dword ptr [ebx+20], 4C4C554E :760E8D8F 006C7073 add byte ptr [eax+2*esi+73], ch :760E8D93 7A53 jpe 760E8DE8 :760E8D95 3220 xor ah, byte ptr [eax] :760E8D97 6973204E554C4C imul esi, dword ptr [ebx+20], 4C4C554E :760E8D9E 00906C70737A add byte ptr [eax+7A73706C], dl :760E8DA4 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8D3E(C) | :760E8DA5 3120 xor dword ptr [eax], esp :760E8DA7 6973204E554C4C imul esi, dword ptr [ebx+20], 4C4C554E :760E8DAE 00905F537472 add byte ptr [eax+7274535F], dl :760E8DB4 43 inc ebx :760E8DB5 61 popad :760E8DB6 7400 je 760E8DB8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8DB6(C) | :760E8DB8 64 BYTE 064h :760E8DB9 7752 ja 760E8E0D :760E8DBB 65 BYTE 065h :760E8DBC 7456 je 760E8E14 :760E8DBE 61 popad :760E8DBF 6C insb :760E8DC0 3D256C6400 cmp eax, 00646C25 :760E8DC5 90 nop :760E8DC6 90 nop :760E8DC7 90 nop :760E8DC8 5F pop edi :760E8DC9 53 push ebx :760E8DCA 7472 je 760E8E3E :760E8DCC 4C dec esp :760E8DCD 65 BYTE 065h :760E8DCE 6E outsb :760E8DCF 004572 add byte ptr [ebp+72], al :760E8DD2 726F jb 760E8E43 :760E8DD4 7220 jb 760E8DF6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8D5B(C) | :760E8DD6 696E2056657251 imul ebp, dword ptr [esi+20], 51726556 :760E8DDD 7565 jne 760E8E44 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8D78(C) | :760E8DDF 7279 jb 760E8E5A :760E8DE1 56 push esi :760E8DE2 61 popad :760E8DE3 6C insb :760E8DE4 7565 jne 760E8E4B :760E8DE6 20666F and byte ptr [esi+6F], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8D6E(C) | :760E8DE9 7220 jb 760E8E0B :760E8DEB 25732E2065 and eax, 65202E73 :760E8DF0 633D25640090 arpl dword ptr [90006425], edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8DD4(C) | :760E8DF6 90 nop :760E8DF7 90 nop :760E8DF8 45 inc ebp :760E8DF9 7272 jb 760E8E6D :760E8DFB 6F outsd :760E8DFC 7220 jb 760E8E1E :760E8DFE 696E2047657446 imul ebp, dword ptr [esi+20], 46746547 :760E8E05 696C655665727369 imul ebp, dword ptr [ebp+56], 69737265 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8DB9(C) | :760E8E0D 6F outsd :760E8E0E 6E outsb :760E8E0F 49 dec ecx :760E8E10 6E outsb :760E8E11 666F outsw :760E8E13 20666F and byte ptr [esi+6F], ah :760E8E16 7220 jb 760E8E38 :760E8E18 25732E2065 and eax, 65202E73 :760E8E1D 633D25640090 arpl dword ptr [90006425], edi :760E8E23 90 nop :760E8E24 45 inc ebp :760E8E25 7272 jb 760E8E99 :760E8E27 6F outsd :760E8E28 7220 jb 760E8E4A :760E8E2A 61 popad :760E8E2B 6C insb :760E8E2C 6C insb :760E8E2D 6F outsd :760E8E2E 636174 arpl dword ptr [ecx+74], esp :760E8E31 696E67206D656D imul ebp, dword ptr [esi+67], 6D656D20 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8E16(C) | :760E8E38 6F outsd :760E8E39 7279 jb 760E8EB4 :760E8E3B 206672 and byte ptr [esi+72], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8DCA(C) | :760E8E3E 6F outsd :760E8E3F 6D insd :760E8E40 20746865 and byte ptr [eax+2*ebp+65], dh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8DDD(C) | :760E8E44 206865 and byte ptr [eax+65], ch :760E8E47 61 popad :760E8E48 7000 jo 760E8E4A * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E8E28(C), :760E8E48(C) | :760E8E4A 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8DE4(C) | :760E8E4B 90 nop :760E8E4C 45 inc ebp :760E8E4D 7272 jb 760E8EC1 :760E8E4F 6F outsd :760E8E50 7220 jb 760E8E72 :760E8E52 696E2047657446 imul ebp, dword ptr [esi+20], 46746547 :760E8E59 696C655665727369 imul ebp, dword ptr [ebp+56], 69737265 :760E8E61 6F outsd :760E8E62 6E outsb :760E8E63 49 dec ecx :760E8E64 6E outsb :760E8E65 666F outsw :760E8E67 53 push ebx :760E8E68 697A6520666F72 imul edi, dword ptr [edx+65], 726F6620 :760E8E6F 202573206563 and byte ptr [63652073], ah :760E8E75 3D25640090 cmp eax, 90006425 :760E8E7A 90 nop :760E8E7B 90 nop :760E8E7C 47 inc edi :760E8E7D 65 BYTE 065h :760E8E7E 7446 je 760E8EC6 :760E8E80 696C655665727369 imul ebp, dword ptr [ebp+56], 69737265 :760E8E88 6F outsd :760E8E89 6E outsb :760E8E8A 009046696C65 add byte ptr [eax+656C6946], dl :760E8E90 2020 and byte ptr [eax], ah :760E8E92 65 BYTE 065h :760E8E93 7869 js 760E8EFE :760E8E95 7374 jnb 760E8F0B :760E8E97 7300 jnb 760E8E99 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E8E25(C), :760E8E97(C) | :760E8E99 90 nop :760E8E9A 90 nop :760E8E9B 90 nop :760E8E9C 49 dec ecx :760E8E9D 7420 je 760E8EBF :760E8E9F 69732061204469 imul esi, dword ptr [ebx+20], 69442061 :760E8EA6 7265 jb 760E8F0D :760E8EA8 63746F72 arpl dword ptr [edi+2*ebp+72], esi :760E8EAC 7920 jns 760E8ECE :760E8EAE 009047657446 add byte ptr [eax+46746547], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8E39(C) | :760E8EB4 696C654174747269 imul ebp, dword ptr [ebp+41], 69727474 :760E8EBC 627574 bound esi, dword ptr [ebp+74] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8E9D(C) | :760E8EBF 65 BYTE 065h :760E8EC0 7320 jnb 760E8EE2 :760E8EC2 6661 popa :760E8EC4 696C656420307825 imul ebp, dword ptr [ebp+64], 25783020 :760E8ECC 7800 js 760E8ECE * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E8EAC(C), :760E8ECC(C) | :760E8ECE 90 nop :760E8ECF 90 nop :760E8ED0 43 inc ebx :760E8ED1 6865636B69 push 696B6365 :760E8ED6 6E outsb :760E8ED7 6720666F and [bp+6F], ah :760E8EDB 7220 jb 760E8EFD :760E8EDD 2573004469 and eax, 69440073 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8EC0(C) | :760E8EE2 7265 jb 760E8F49 :760E8EE4 63746F72 arpl dword ptr [edi+2*ebp+72], esi :760E8EE8 7920 jns 760E8F0A :760E8EEA 64 BYTE 064h :760E8EEB 6F outsd :760E8EEC 65 BYTE 065h :760E8EED 7320 jnb 760E8F0F :760E8EEF 6E outsb :760E8EF0 6F outsd :760E8EF1 7420 je 760E8F13 :760E8EF3 65 BYTE 065h :760E8EF4 7869 js 760E8F5F :760E8EF6 7374 jnb 760E8F6C :760E8EF8 009090904469 add byte ptr [eax+69449090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8E93(C) | :760E8EFE 7265 jb 760E8F65 :760E8F00 63746F72 arpl dword ptr [edi+2*ebp+72], esi :760E8F04 7920 jns 760E8F26 :760E8F06 65 BYTE 065h :760E8F07 7869 js 760E8F72 :760E8F09 7374 jnb 760E8F7F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8E95(C) | :760E8F0B 7320 jnb 760E8F2D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8EA6(C) | :760E8F0D 009090204368 add byte ptr [eax+68432090], dl :760E8F13 65636B69 arpl dword ptr gs:[ebx+69], ebp :760E8F17 6E outsb :760E8F18 6720666F and [bp+6F], ah :760E8F1C 7220 jb 760E8F3E :760E8F1E 2573009090 and eax, 90900073 :760E8F23 90 nop :760E8F24 53 push ebx :760E8F25 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8F04(C) | :760E8F26 50 push eax :760E8F27 43 inc ebx :760E8F28 6F outsd :760E8F29 6E outsb :760E8F2A 7665 jbe 760E8F91 :760E8F2C 7274 jb 760E8FA2 :760E8F2E 54 push esp :760E8F2F 6F outsd :760E8F30 55 push ebp :760E8F31 6E outsb :760E8F32 69636F64650053 imul esp, dword ptr [ebx+6F], 53006564 :760E8F39 46 inc esi :760E8F3A 50 push eax :760E8F3B 44 inc esp :760E8F3C 7570 jne 760E8FAE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8F1C(C) | :760E8F3E 6C insb :760E8F3F 69636174655374 imul esp, dword ptr [ebx+61], 74536574 :760E8F46 7269 jb 760E8FB1 :760E8F48 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8EE2(C) | :760E8F49 6700905346 add [bx+si+4653], dl :760E8F4E 50 push eax :760E8F4F 43 inc ebx :760E8F50 6F outsd :760E8F51 6E outsb :760E8F52 7665 jbe 760E8FB9 :760E8F54 7274 jb 760E8FCA :760E8F56 54 push esp :760E8F57 6F outsd :760E8F58 41 inc ecx :760E8F59 4E dec esi :760E8F5A 53 push ebx :760E8F5B 49 dec ecx :760E8F5C 009090904361 add byte ptr [eax+61439090], dl :760E8F62 6E outsb :760E8F63 6E outsb :760E8F64 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8EFE(C) | :760E8F65 7420 je 760E8F87 :760E8F67 66696E642073 imul bp, word ptr [esi+64], 7320 :760E8F6D 7461 je 760E8FD0 :760E8F6F 7274 jb 760E8FE5 :760E8F71 206F66 and byte ptr [edi+66], ch :760E8F74 207661 and byte ptr [esi+61], dh :760E8F77 6C insb :760E8F78 7565 jne 760E8FDF :760E8F7A 00904765744E add byte ptr [eax+4E746547], dl :760E8F80 65 BYTE 065h :760E8F81 7874 js 760E8FF7 :760E8F83 49 dec ecx :760E8F84 6E outsb :760E8F85 7465 je 760E8FEC :760E8F87 67 BYTE 067h :760E8F88 65 BYTE 065h :760E8F89 7200 jb 760E8F8B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8F89(C) | :760E8F8B 90 nop :760E8F8C 47 inc edi :760E8F8D 65 BYTE 065h :760E8F8E 744E je 760E8FDE :760E8F90 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8F2A(C) | :760E8F91 7874 js 760E9007 :760E8F93 49 dec ecx :760E8F94 6E outsb :760E8F95 7465 je 760E8FFC :760E8F97 67 BYTE 067h :760E8F98 65 BYTE 065h :760E8F99 7220 jb 760E8FBB :760E8F9B 6661 popa :760E8F9D 696C65640090904D imul ebp, dword ptr [ebp+64], 4D909000 :760E8FA5 61 popad :760E8FA6 6B655665 imul esp, dword ptr [ebp+56], 00000065 :760E8FAA 7273 jb 760E901F :760E8FAC 696F6E46726F6D imul ebp, dword ptr [edi+6E], 6D6F7246 :760E8FB3 53 push ebx :760E8FB4 7472 je 760E9028 :760E8FB6 696E6700909052 imul ebp, dword ptr [esi+67], 52909000 :760E8FBD 656753 push ebx :760E8FC0 65 BYTE 065h :760E8FC1 7456 je 760E9019 :760E8FC3 61 popad :760E8FC4 6C insb :760E8FC5 7565 jne 760E902C :760E8FC7 45 inc ebp :760E8FC8 7820 js 760E8FEA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8F54(C) | :760E8FCA 65 BYTE 065h :760E8FCB 7272 jb 760E903F :760E8FCD 6F outsd :760E8FCE 7220 jb 760E8FF0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8F6D(C) | :760E8FD0 307825 xor byte ptr [eax+25], bh :760E8FD3 7800 js 760E8FD5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8FD3(C) | :760E8FD5 90 nop :760E8FD6 90 nop :760E8FD7 90 nop :760E8FD8 52 push edx :760E8FD9 656743 inc ebx :760E8FDC 7265 jb 760E9043 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8F8E(C) | :760E8FDE 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8F78(C) | :760E8FDF 7465 je 760E9046 :760E8FE1 4B dec ebx :760E8FE2 65 BYTE 065h :760E8FE3 7945 jns 760E902A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8F6F(C) | :760E8FE5 7820 js 760E9007 :760E8FE7 65 BYTE 065h :760E8FE8 7272 jb 760E905C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8FC8(C) | :760E8FEA 6F outsd :760E8FEB 7220 jb 760E900D :760E8FED 307825 xor byte ptr [eax+25], bh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8FCE(C) | :760E8FF0 7800 js 760E8FF2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8FF0(C) | :760E8FF2 90 nop :760E8FF3 90 nop :760E8FF4 57 push edi :760E8FF5 7269 jb 760E9060 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8F81(C) | :760E8FF7 7465 je 760E905E :760E8FF9 52 push edx :760E8FFA 65674B dec ebx :760E8FFD 65 BYTE 065h :760E8FFE 7900 jns 760E9000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8FFE(C) | :760E9000 52 push edx :760E9001 656754 push esp :760E9004 7970 jns 760E9076 :760E9006 65206973 and byte ptr gs:[ecx+73], ch :760E900A 2025642C206E and byte ptr [6E202C64], ah :760E9010 6F outsd :760E9011 7420 je 760E9033 :760E9013 2564009090 and eax, 90900064 :760E9018 52 push edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8FC1(C) | :760E9019 656751 push ecx :760E901C 7565 jne 760E9083 :760E901E 7279 jb 760E9099 :760E9020 56 push esi :760E9021 61 popad :760E9022 6C insb :760E9023 7565 jne 760E908A :760E9025 45 inc ebp :760E9026 7820 js 760E9048 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8FB4(C) | :760E9028 6661 popa * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8FE3(C) | :760E902A 696C656420657272 imul ebp, dword ptr [ebp+64], 72726520 :760E9032 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9011(C) | :760E9033 7220 jb 760E9055 :760E9035 307825 xor byte ptr [eax+25], bh :760E9038 7800 js 760E903A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9038(C) | :760E903A 90 nop :760E903B 90 nop :760E903C 52 push edx :760E903D 65674F dec edi :760E9040 7065 jo 760E90A7 :760E9042 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8FDC(C) | :760E9043 4B dec ebx :760E9044 65 BYTE 065h :760E9045 7945 jns 760E908C :760E9047 7820 js 760E9069 :760E9049 6F outsd :760E904A 7065 jo 760E90B1 :760E904C 6E outsb :760E904D 206572 and byte ptr [ebp+72], ah :760E9050 726F jb 760E90C1 :760E9052 7220 jb 760E9074 :760E9054 307825 xor byte ptr [eax+25], bh :760E9057 7800 js 760E9059 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9057(C) | :760E9059 90 nop :760E905A 90 nop :760E905B 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E8FE8(C) | :760E905C 54 push esp :760E905D 7279 jb 760E90D8 :760E905F 696E6720746F20 imul ebp, dword ptr [esi+67], 206F7420 :760E9066 6F outsd :760E9067 7065 jo 760E90CE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9047(C) | :760E9069 6E outsb :760E906A 202573202573 and byte ptr [73252073], ah :760E9070 009090904D75 add byte ptr [eax+754D9090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9004(C) | :760E9076 6C insb :760E9077 7469 je 760E90E2 :760E9079 42 inc edx :760E907A 7974 jns 760E90F0 :760E907C 65 BYTE 065h :760E907D 54 push esp :760E907E 6F outsd :760E907F 57 push edi :760E9080 6964654368617228 imul esp, dword ptr [ebp+43], 28726168 :760E9088 2029 and byte ptr [ecx], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9023(C) | :760E908A 206661 and byte ptr [esi+61], ah :760E908D 696C65642D202065 imul ebp, dword ptr [ebp+64], 6520202D :760E9095 632D2D256400 arpl dword ptr [0064252D], ebp :760E909B 90 nop :760E909C 45 inc ebp :760E909D 6D insd :760E909E 7074 jo 760E9114 :760E90A0 7920 jns 760E90C2 :760E90A2 7374 jnb 760E9118 :760E90A4 7269 jb 760E910F :760E90A6 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9040(C) | :760E90A7 6720696E and [bx+di+6E], ch :760E90AB 20547269 and byte ptr [edx+2*esi+69], dl :760E90AF 6D insd :760E90B0 205374 and byte ptr [ebx+74], dl :760E90B3 7269 jb 760E911E :760E90B5 6E outsb :760E90B6 672E00909090 add cs:[bx+si+9090], dl :760E90BC 4E dec esi :760E90BD 55 push ebp :760E90BE 4C dec esp :760E90BF 4C dec esp :760E90C0 205374 and byte ptr [ebx+74], dl :760E90C3 7269 jb 760E912E :760E90C5 6E outsb :760E90C6 67207061 and [bx+si+61], dh :760E90CA 7373 jnb 760E913F :760E90CC 65 BYTE 065h :760E90CD 6420746F20 and byte ptr fs:[edi+2*ebp+20], dh :760E90D2 7472 je 760E9146 :760E90D4 696D2073747269 imul ebp, dword ptr [ebp+20], 69727473 :760E90DB 6E outsb :760E90DC 6700909054 add [bx+si+5490], dl :760E90E1 7269 jb 760E914C :760E90E3 6D insd :760E90E4 53 push ebx :760E90E5 7472 je 760E9159 :760E90E7 696E6700904358 imul ebp, dword ptr [esi+67], 58439000 :760E90EE 4D dec ebp :760E90EF 4C dec esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E907A(C) | :760E90F0 46 inc esi :760E90F1 696C654C69737450 imul ebp, dword ptr [ebp+4C], 50747369 :760E90F9 61 popad :760E90FA 7273 jb 760E916F :760E90FC 65 BYTE 065h :760E90FD 723A jb 760E9139 :760E90FF 3A4765 cmp al, byte ptr [edi+65] :760E9102 7446 je 760E914A :760E9104 69656C64009090 imul esp, dword ptr [ebp+6C], 90900064 :760E910B 90 nop :760E910C 45 inc ebp :760E910D 7272 jb 760E9181 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E90A4(C) | :760E910F 6F outsd :760E9110 7220 jb 760E9132 :760E9112 67 BYTE 067h :760E9113 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E909E(C) | :760E9114 7474 je 760E918A :760E9116 696E6720636F64 imul ebp, dword ptr [esi+67], 646F6320 :760E911D 65207061 and byte ptr gs:[eax+61], dh :760E9121 67 BYTE 067h :760E9122 65 BYTE 065h :760E9123 2E009090904572 add byte ptr cs:[eax+72459090], dl :760E912A 726F jb 760E919B :760E912C 7220 jb 760E914E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E90C3(C) | :760E912E 7175 jno 760E91A5 :760E9130 65 BYTE 065h :760E9131 7279 jb 760E91AC :760E9133 696E6720636F64 imul ebp, dword ptr [esi+67], 646F6320 :760E913A 65206C6F63 and byte ptr gs:[edi+2*ebp+63], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E90CA(C) | :760E913F 61 popad :760E9140 6C insb :760E9141 65 BYTE 065h :760E9142 2E004765 add byte ptr cs:[edi+65], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E90D2(C) | :760E9146 7443 je 760E918B :760E9148 7572 jne 760E91BC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9102(C) | :760E914A 7265 jb 760E91B1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E90E1(C) | :760E914C 6E outsb :760E914D 7443 je 760E9192 :760E914F 6F outsd :760E9150 64 BYTE 064h :760E9151 65 BYTE 065h :760E9152 50 push eax :760E9153 61 popad :760E9154 67650090436F add gs:[bx+si+6F43], dl :760E915A 43 inc ebx :760E915B 7265 jb 760E91C2 :760E915D 61 popad :760E915E 7465 je 760E91C5 :760E9160 49 dec ecx :760E9161 6E outsb :760E9162 7374 jnb 760E91D8 :760E9164 61 popad :760E9165 6E outsb :760E9166 636520 arpl dword ptr [ebp+20], esp :760E9169 46 inc esi :760E916A 61 popad :760E916B 696C656420307825 imul ebp, dword ptr [ebp+64], 25783020 :760E9173 7800 js 760E9175 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9173(C) | :760E9175 90 nop :760E9176 90 nop :760E9177 90 nop :760E9178 43 inc ebx :760E9179 6F outsd :760E917A 49 dec ecx :760E917B 6E outsb :760E917C 697469616C697A65 imul esi, dword ptr [ecx+2*ebp+61], 657A696C :760E9184 204661 and byte ptr [esi+61], al :760E9187 696C656420307825 imul ebp, dword ptr [ebp+64], 25783020 :760E918F 7800 js 760E9191 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E918F(C) | :760E9191 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E914D(C) | :760E9192 90 nop :760E9193 90 nop :760E9194 49 dec ecx :760E9195 6E outsb :760E9196 697400909090556E imul esi, dword ptr [eax+eax-70], 6E559090 :760E919E 64 BYTE 064h :760E919F 656669656E6420 imul sp, word ptr gs:[ebp+6E], 2064 :760E91A6 58 pop eax :760E91A7 4D dec ebp :760E91A8 4C dec esp :760E91A9 20746167 and byte ptr [ecx+67], dh :760E91AD 20696E and byte ptr [ecx+6E], ch :760E91B0 206669 and byte ptr [esi+69], ah :760E91B3 6C insb :760E91B4 65 BYTE 065h :760E91B5 2E0090456D7074 add byte ptr cs:[eax+74706D45], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9148(C) | :760E91BC 7920 jns 760E91DE :760E91BE 7374 jnb 760E9234 :760E91C0 7269 jb 760E922B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E915B(C) | :760E91C2 6E outsb :760E91C3 67207061 and [bx+si+61], dh :760E91C7 7373 jnb 760E923C :760E91C9 65 BYTE 065h :760E91CA 6420746F20 and byte ptr fs:[edi+2*ebp+20], dh :760E91CF 64 BYTE 064h :760E91D0 656661 popa :760E91D3 756C jne 760E9241 :760E91D5 7420 je 760E91F7 :760E91D7 7479 je 760E9252 :760E91D9 7065 jo 760E9240 :760E91DB 2E009090906E6F add byte ptr cs:[eax+6F6E9090], dl :760E91E2 7420 je 760E9204 :760E91E4 65 BYTE 065h :760E91E5 6E outsb :760E91E6 6F outsd :760E91E7 7567 jne 760E9250 :760E91E9 6820737061 push 61707320 :760E91EE 636520 arpl dword ptr [ebp+20], esp :760E91F1 746F je 760E9262 :760E91F3 20696E and byte ptr [ecx+6E], ch :760E91F6 204253 and byte ptr [edx+53], al :760E91F9 54 push esp :760E91FA 52 push edx :760E91FB 20746F20 and byte ptr [edi+2*ebp+20], dh :760E91FF 7374 jnb 760E9275 :760E9201 7269 jb 760E926C :760E9203 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E91E2(C) | :760E9204 67206275 and [bp+si+75], ah :760E9208 66 BYTE 066h :760E9209 66 BYTE 066h :760E920A 65 BYTE 065h :760E920B 7200 jb 760E920D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E920B(C) | :760E920D 90 nop :760E920E 90 nop :760E920F 90 nop :760E9210 45 inc ebp :760E9211 7272 jb 760E9285 :760E9213 6F outsd :760E9214 7220 jb 760E9236 :760E9216 696E2049584D4C imul ebp, dword ptr [esi+20], 4C4D5849 :760E921D 45 inc ebp :760E921E 6C insb :760E921F 65 BYTE 065h :760E9220 6D insd :760E9221 65 BYTE 065h :760E9222 6E outsb :760E9223 743A je 760E925F :760E9225 3A6765 cmp ah, byte ptr [edi+65] :760E9228 745F je 760E9289 :760E922A 7465 je 760E9291 :760E922C 7874 js 760E92A2 :760E922E 2030 and byte ptr [eax], dh :760E9230 7825 js 760E9257 :760E9232 7800 js 760E9234 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E91BE(C), :760E9232(C) | :760E9234 45 inc ebp :760E9235 7272 jb 760E92A9 :760E9237 6F outsd :760E9238 7220 jb 760E925A :760E923A 4C dec esp :760E923B 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E91C7(C) | :760E923C 61 popad :760E923D 64696E6720436F6C imul ebp, dword ptr fs:[esi+67], 6C6F4320 :760E9245 6C insb :760E9246 656374696F arpl dword ptr gs:[ecx+2*ebp+6F], esi :760E924B 6E outsb :760E924C 009090904572 add byte ptr [eax+72459090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E91D7(C) | :760E9252 726F jb 760E92C3 :760E9254 7220 jb 760E9276 :760E9256 696E206765745F imul ebp, dword ptr [esi+20], 5F746567 :760E925D 7461 je 760E92C0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9223(C) | :760E925F 674E dec esi :760E9261 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E91F1(C) | :760E9262 6D insd :760E9263 652030 and byte ptr gs:[eax], dh :760E9266 7825 js 760E928D :760E9268 7800 js 760E926A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9268(C) | :760E926A 90 nop :760E926B 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9201(C) | :760E926C 45 inc ebp :760E926D 7272 jb 760E92E1 :760E926F 6F outsd :760E9270 7220 jb 760E9292 :760E9272 49 dec ecx :760E9273 44 inc esp :760E9274 69737061746368 imul esi, dword ptr [ebx+70], 68637461 :760E927B 3A3A cmp bh, byte ptr [edx] :760E927D 51 push ecx :760E927E 7565 jne 760E92E5 :760E9280 7279 jb 760E92FB :760E9282 49 dec ecx :760E9283 6E outsb :760E9284 7465 je 760E92EB :760E9286 7266 jb 760E92EE :760E9288 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9228(C) | :760E9289 636520 arpl dword ptr [ebp+20], esp :760E928C 307825 xor byte ptr [eax+25], bh :760E928F 64009090904572 add byte ptr fs:[eax+72459090], dl :760E9296 726F jb 760E9307 :760E9298 7220 jb 760E92BA :760E929A 7043 jo 760E92DF :760E929C 68696C6472 push 72646C69 :760E92A1 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E922C(C) | :760E92A2 6E outsb :760E92A3 2D3E697465 sub eax, 6574693E :760E92A8 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9235(C) | :760E92A9 2030 and byte ptr [eax], dh :760E92AB 7825 js 760E92D2 :760E92AD 7800 js 760E92AF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E92AD(C) | :760E92AF 90 nop :760E92B0 45 inc ebp :760E92B1 7272 jb 760E9325 :760E92B3 6F outsd :760E92B4 7220 jb 760E92D6 :760E92B6 46 inc esi :760E92B7 696E64696E6720 imul ebp, dword ptr [esi+64], 20676E69 :760E92BE 4C dec esp :760E92BF 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E925D(C) | :760E92C0 6E outsb :760E92C1 677468 je 760E932C :760E92C4 2030 and byte ptr [eax], dh :760E92C6 7825 js 760E92ED :760E92C8 7800 js 760E92CA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E92C8(C) | :760E92CA 90 nop :760E92CB 90 nop :760E92CC 49 dec ecx :760E92CD 58 pop eax :760E92CE 4D dec ebp :760E92CF 4C dec esp :760E92D0 45 inc ebp :760E92D1 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E92AB(C) | :760E92D2 65 BYTE 065h :760E92D3 6D insd :760E92D4 65 BYTE 065h :760E92D5 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E92B4(C) | :760E92D6 743A je 760E9312 :760E92D8 3A6765 cmp ah, byte ptr [edi+65] :760E92DB 745F je 760E933C :760E92DD 636869 arpl dword ptr [eax+69], ebp :760E92E0 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E926D(C) | :760E92E1 64 BYTE 064h :760E92E2 7265 jb 760E9349 :760E92E4 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E927E(C) | :760E92E5 206661 and byte ptr [esi+61], ah :760E92E8 696C656420307825 imul ebp, dword ptr [ebp+64], 25783020 :760E92F0 7800 js 760E92F2 :760E92F2 90 nop :760E92F3 90 nop :760E92F4 4D dec ebp :760E92F5 61 popad :760E92F6 6C insb :760E92F7 666F outsw :760E92F9 726D jb 760E9368 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9280(C) | :760E92FB 65 BYTE 065h :760E92FC 6420584D and byte ptr fs:[eax+4D], bl :760E9300 4C dec esp :760E9301 206669 and byte ptr [esi+69], ah :760E9304 6C insb :760E9305 65009042535452 add byte ptr gs:[eax+52545342], dl :760E930C 20746F6F and byte ptr [edi+2*ebp+6F], dh :760E9310 206C6172 and byte ptr [ecx+72], ch :760E9314 676520666F and gs:[bp+6F], ah :760E9319 7220 jb 760E933B :760E931B 627566 bound esi, dword ptr [ebp+66] :760E931E 66 BYTE 066h :760E931F 65 BYTE 065h :760E9320 7200 jb 760E9322 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9320(C) | :760E9322 90 nop :760E9323 90 nop :760E9324 49 dec ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E92B1(C) | :760E9325 58 pop eax :760E9326 4D dec ebp :760E9327 4C dec esp :760E9328 45 inc ebp :760E9329 6C insb :760E932A 65 BYTE 065h :760E932B 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E92C2(C) | :760E932C 65 BYTE 065h :760E932D 6E outsb :760E932E 743A je 760E936A :760E9330 3A6765 cmp ah, byte ptr [edi+65] :760E9333 745F je 760E9394 :760E9335 7461 je 760E9398 :760E9337 674E dec esi :760E9339 61 popad :760E933A 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9319(C) | :760E933B 65206661 and byte ptr gs:[esi+61], ah :760E933F 696C656420307825 imul ebp, dword ptr [ebp+64], 25783020 :760E9347 7800 js 760E9349 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E92E2(C), :760E9347(C) | :760E9349 90 nop :760E934A 90 nop :760E934B 90 nop :760E934C 49 dec ecx :760E934D 58 pop eax :760E934E 4D dec ebp :760E934F 4C dec esp :760E9350 44 inc esp :760E9351 6F outsd :760E9352 63756D arpl dword ptr [ebp+6D], esi :760E9355 65 BYTE 065h :760E9356 6E outsb :760E9357 743A je 760E9393 :760E9359 3A4765 cmp al, byte ptr [edi+65] :760E935C 7452 je 760E93B0 :760E935E 6F outsd :760E935F 6F outsd :760E9360 7420 je 760E9382 :760E9362 6661 popa :760E9364 696C656420307825 imul ebp, dword ptr [ebp+64], 25783020 :760E936C 7800 js 760E936E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E936C(C) | :760E936E 90 nop :760E936F 90 nop :760E9370 43 inc ebx :760E9371 58 pop eax :760E9372 4D dec ebp :760E9373 4C dec esp :760E9374 46 inc esi :760E9375 696C654C69737450 imul ebp, dword ptr [ebp+4C], 50747369 :760E937D 61 popad :760E937E 7273 jb 760E93F3 :760E9380 65 BYTE 065h :760E9381 723A jb 760E93BD :760E9383 3A4C6F61 cmp cl, byte ptr [edi+2*ebp+61] :760E9387 64 BYTE 064h :760E9388 43 inc ebx :760E9389 6F outsd :760E938A 6C insb :760E938B 6C insb :760E938C 656374696F arpl dword ptr gs:[ecx+2*ebp+6F], esi :760E9391 6E outsb :760E9392 7300 jnb 760E9394 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E9333(C), :760E9392(C) | :760E9394 45 inc ebp :760E9395 7272 jb 760E9409 :760E9397 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9335(C) | :760E9398 7220 jb 760E93BA :760E939A 696E2049584D4C imul ebp, dword ptr [esi+20], 4C4D5849 :760E93A1 45 inc ebp :760E93A2 6C insb :760E93A3 65 BYTE 065h :760E93A4 6D insd :760E93A5 65 BYTE 065h :760E93A6 6E outsb :760E93A7 743A je 760E93E3 :760E93A9 3A6765 cmp ah, byte ptr [edi+65] :760E93AC 745F je 760E940D :760E93AE 636869 arpl dword ptr [eax+69], ebp :760E93B1 6C insb :760E93B2 64 BYTE 064h :760E93B3 7265 jb 760E941A :760E93B5 6E outsb :760E93B6 2030 and byte ptr [eax], dh :760E93B8 7825 js 760E93DF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9398(C) | :760E93BA 7800 js 760E93BC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E93BA(C) | :760E93BC 4E dec esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9381(C) | :760E93BD 6F outsd :760E93BE 7420 je 760E93E0 :760E93C0 65 BYTE 065h :760E93C1 6E outsb :760E93C2 6F outsd :760E93C3 7567 jne 760E942C :760E93C5 6820737061 push 61707320 :760E93CA 636520 arpl dword ptr [ebp+20], esp :760E93CD 746F je 760E943E :760E93CF 20636F and byte ptr [ebx+6F], ah :760E93D2 6E outsb :760E93D3 7665 jbe 760E943A :760E93D5 7274 jb 760E944B :760E93D7 204253 and byte ptr [edx+53], al :760E93DA 7472 je 760E944E :760E93DC 696E672E009090 imul ebp, dword ptr [esi+67], 9090002E :760E93E3 90 nop :760E93E4 45 inc ebp :760E93E5 7272 jb 760E9459 :760E93E7 6F outsd :760E93E8 7220 jb 760E940A :760E93EA 67 BYTE 067h :760E93EB 65 BYTE 065h :760E93EC 7474 je 760E9462 :760E93EE 696E6720636F6C imul ebp, dword ptr [esi+67], 6C6F6320 :760E93F5 6C insb :760E93F6 656374696F arpl dword ptr gs:[ecx+2*ebp+6F], esi :760E93FB 6E outsb :760E93FC 207369 and byte ptr [ebx+69], dh :760E93FF 7A65 jpe 760E9466 :760E9401 2E2030 and byte ptr cs:[eax], dh :760E9404 7825 js 760E942B :760E9406 7800 js 760E9408 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9406(C) | :760E9408 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9395(C) | :760E9409 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E93E8(C) | :760E940A 7074 jo 760E9480 :760E940C 7920 jns 760E942E :760E940E 3C46 cmp al, 46 :760E9410 49 dec ecx :760E9411 4C dec esp :760E9412 45 inc ebp :760E9413 53 push ebx :760E9414 2C45 sub al, 45 :760E9416 58 pop eax :760E9417 54 push esp :760E9418 2C44 sub al, 44 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E93B3(C) | :760E941A 49 dec ecx :760E941B 52 push edx :760E941C 45 inc ebp :760E941D 43 inc ebx :760E941E 54 push esp :760E941F 4F dec edi :760E9420 52 push edx :760E9421 59 pop ecx :760E9422 2C65 sub al, 65 :760E9424 7463 je 760E9489 :760E9426 207365 and byte ptr [ebx+65], dh :760E9429 6374696F arpl dword ptr [ecx+2*ebp+6F], esi :760E942D 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E940C(C) | :760E942E 00904572726F add byte ptr [eax+6F727245], dl :760E9434 7220 jb 760E9456 :760E9436 6D insd :760E9437 5F pop edi :760E9438 7044 jo 760E947E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E93D3(C) | :760E943A 6F outsd :760E943B 632D3E707574 arpl dword ptr [7475703E], ebp :760E9441 55 push ebp :760E9442 726C jb 760E94B0 :760E9444 202530782578 and byte ptr [78257830], ah :760E944A 00904572726F add byte ptr [eax+6F727245], dl :760E9450 7220 jb 760E9472 :760E9452 61 popad :760E9453 6C insb :760E9454 6C insb :760E9455 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9434(C) | :760E9456 636174 arpl dword ptr [ecx+74], esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E93E5(C) | :760E9459 696E6720737061 imul ebp, dword ptr [esi+67], 61707320 :760E9460 636520 arpl dword ptr [ebp+20], esp :760E9463 666F outsw :760E9465 7220 jb 760E9487 :760E9467 61 popad :760E9468 204253 and byte ptr [edx+53], al :760E946B 54 push esp :760E946C 52 push edx :760E946D 009090506172 add byte ptr [eax+72615090], dl :760E9473 7365 jnb 760E94DA :760E9475 46 inc esi :760E9476 696C650090904572 imul ebp, dword ptr [ebp], 72459090 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9438(C) | :760E947E 726F jb 760E94EF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E940A(C) | :760E9480 7220 jb 760E94A2 :760E9482 636F6E arpl dword ptr [edi+6E], ebp :760E9485 7665 jbe 760E94EC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9465(C) | :760E9487 7469 je 760E94F2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9424(C) | :760E9489 6E outsb :760E948A 67207468 and [si+68], dh :760E948E 65204273 and byte ptr gs:[edx+73], al :760E9492 7472 je 760E9506 :760E9494 696E672E204E6F imul ebp, dword ptr [esi+67], 6F4E202E :760E949B 7420 je 760E94BD :760E949D 65 BYTE 065h :760E949E 6E outsb :760E949F 6F outsd :760E94A0 7567 jne 760E9509 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9480(C) | :760E94A2 6820627566 push 66756220 :760E94A7 66 BYTE 066h :760E94A8 65 BYTE 065h :760E94A9 722E jb 760E94D9 :760E94AB 004358 add byte ptr [ebx+58], al :760E94AE 4D dec ebp :760E94AF 4C dec esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9442(C) | :760E94B0 46 inc esi :760E94B1 696C654C69737450 imul ebp, dword ptr [ebp+4C], 50747369 :760E94B9 61 popad :760E94BA 7273 jb 760E952F :760E94BC 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E949B(C) | :760E94BD 723A jb 760E94F9 :760E94BF 3A5061 cmp dl, byte ptr [eax+61] :760E94C2 7273 jb 760E9537 :760E94C4 65 BYTE 065h :760E94C5 56 push esi :760E94C6 65 BYTE 065h :760E94C7 7273 jb 760E953C :760E94C9 696F6E456C656D imul ebp, dword ptr [edi+6E], 6D656C45 :760E94D0 65 BYTE 065h :760E94D1 6E outsb :760E94D2 7400 je 760E94D4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E94D2(C) | :760E94D4 43 inc ebx :760E94D5 58 pop eax :760E94D6 4D dec ebp :760E94D7 4C dec esp :760E94D8 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E94A9(C) | :760E94D9 696C654C69737450 imul ebp, dword ptr [ebp+4C], 50747369 :760E94E1 61 popad :760E94E2 7273 jb 760E9557 :760E94E4 65 BYTE 065h :760E94E5 723A jb 760E9521 :760E94E7 3A4765 cmp al, byte ptr [edi+65] :760E94EA 7443 je 760E952F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9485(C) | :760E94EC 6F outsd :760E94ED 6C insb :760E94EE 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E947E(C) | :760E94EF 656374696F arpl dword ptr gs:[ecx+2*ebp+6F], esi :760E94F4 6E outsb :760E94F5 53 push ebx :760E94F6 697A6500909050 imul edi, dword ptr [edx+65], 50909000 :760E94FD 52 push edx :760E94FE 4F dec edi :760E94FF 54 push esp :760E9500 009090904358 add byte ptr [eax+58439090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9492(C) | :760E9506 4D dec ebp :760E9507 4C dec esp :760E9508 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E94A0(C) | :760E9509 696C654C69737450 imul ebp, dword ptr [ebp+4C], 50747369 :760E9511 61 popad :760E9512 7273 jb 760E9587 :760E9514 65 BYTE 065h :760E9515 723A jb 760E9551 :760E9517 3A4765 cmp al, byte ptr [edi+65] :760E951A 7446 je 760E9562 :760E951C 696C65496E666F20 imul ebp, dword ptr [ebp+49], 206F666E :760E9524 28456C sub byte ptr [ebp+6C], al :760E9527 65 BYTE 065h :760E9528 6D insd :760E9529 65 BYTE 065h :760E952A 6E outsb :760E952B 7420 je 760E954D :760E952D 6F outsd :760E952E 7574 jne 760E95A4 :760E9530 206F66 and byte ptr [edi+66], ch :760E9533 207261 and byte ptr [edx+61], dh :760E9536 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E94C2(C) | :760E9537 67652900 sub gs:[bx+si], eax :760E953B 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E94C7(C) | :760E953C 43 inc ebx :760E953D 58 pop eax :760E953E 4D dec ebp :760E953F 4C dec esp :760E9540 46 inc esi :760E9541 696C654C69737450 imul ebp, dword ptr [ebp+4C], 50747369 :760E9549 61 popad :760E954A 7273 jb 760E95BF :760E954C 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E952B(C) | :760E954D 723A jb 760E9589 :760E954F 3A4765 cmp al, byte ptr [edi+65] :760E9552 7446 je 760E959A :760E9554 696C65496E666F00 imul ebp, dword ptr [ebp+49], 006F666E :760E955C 42 inc edx :760E955D 7566 jne 760E95C5 :760E955F 66 BYTE 066h :760E9560 65 BYTE 065h :760E9561 7220 jb 760E9583 :760E9563 746F je 760E95D4 :760E9565 6F outsd :760E9566 20736D and byte ptr [ebx+6D], dh :760E9569 61 popad :760E956A 6C insb :760E956B 6C insb :760E956C 20696E and byte ptr [ecx+6E], ch :760E956F 205365 and byte ptr [ebx+65], dl :760E9572 61 popad :760E9573 7263 jb 760E95D8 :760E9575 6820616E64 push 646E6120 :760E957A 207265 and byte ptr [edx+65], dh :760E957D 706C jo 760E95EB :760E957F 61 popad :760E9580 63652E arpl dword ptr [ebp+2E], esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9561(C) | :760E9583 004572 add byte ptr [ebp+72], al :760E9586 726F jb 760E95F7 :760E9588 7220 jb 760E95AA :760E958A 696E2073656172 imul ebp, dword ptr [esi+20], 72616573 :760E9591 636820 arpl dword ptr [eax+20], ebp :760E9594 61 popad :760E9595 6E outsb :760E9596 64207265 and byte ptr fs:[edx+65], dh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9552(C) | :760E959A 706C jo 760E9608 :760E959C 61 popad :760E959D 636520 arpl dword ptr [ebp+20], esp :760E95A0 65632D25640090 arpl dword ptr gs:[90006425], ebp :760E95A7 90 nop :760E95A8 43 inc ebx :760E95A9 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9588(C) | :760E95AA 4D dec ebp :760E95AB 4C dec esp :760E95AC 46 inc esi :760E95AD 696C654C69737450 imul ebp, dword ptr [ebp+4C], 50747369 :760E95B5 61 popad :760E95B6 7273 jb 760E962B :760E95B8 65 BYTE 065h :760E95B9 723A jb 760E95F5 :760E95BB 3A5365 cmp dl, byte ptr [ebx+65] :760E95BE 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E954A(C) | :760E95BF 7263 jb 760E9624 :760E95C1 68416E6452 push 52646E41 :760E95C6 65 BYTE 065h :760E95C7 706C jo 760E9635 :760E95C9 61 popad :760E95CA 636500 arpl dword ptr [ebp+00], esp :760E95CD 90 nop :760E95CE 90 nop :760E95CF 90 nop :760E95D0 45 inc ebp :760E95D1 7272 jb 760E9645 :760E95D3 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9563(C) | :760E95D4 7220 jb 760E95F6 :760E95D6 67 BYTE 067h :760E95D7 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9573(C) | :760E95D8 7474 je 760E964E :760E95DA 696E6720737973 imul ebp, dword ptr [esi+67], 73797320 :760E95E1 7465 je 760E9648 :760E95E3 6D insd :760E95E4 207265 and byte ptr [edx+65], dh :760E95E7 7374 jnb 760E965D :760E95E9 6F outsd :760E95EA 7265 jb 760E9651 :760E95EC 2074656D and byte ptr [ebp+6D], dh :760E95F0 7020 jo 760E9612 :760E95F2 6469726563746F72 imul esi, dword ptr fs:[edx+65], 726F7463 :760E95FA 7900 jns 760E95FC :760E95FC 45 inc ebp :760E95FD 7272 jb 760E9671 :760E95FF 6F outsd :760E9600 7220 jb 760E9622 :760E9602 67 BYTE 067h :760E9603 65 BYTE 065h :760E9604 7474 je 760E967A :760E9606 696E6720737973 imul ebp, dword ptr [esi+67], 73797320 :760E960D 7465 je 760E9674 :760E960F 6D insd :760E9610 207265 and byte ptr [edx+65], dh :760E9613 7374 jnb 760E9689 :760E9615 6F outsd :760E9616 7265 jb 760E967D :760E9618 206172 and byte ptr [ecx+72], ah :760E961B 636869 arpl dword ptr [eax+69], ebp :760E961E 7665 jbe 760E9685 :760E9620 20646972 and byte ptr [ecx+2*ebp+72], ah :760E9624 6563746F72 arpl dword ptr gs:[edi+2*ebp+72], esi :760E9629 7900 jns 760E962B * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E95B6(C), :760E9629(C) | :760E962B 90 nop :760E962C 45 inc ebp :760E962D 7272 jb 760E96A1 :760E962F 6F outsd :760E9630 7220 jb 760E9652 :760E9632 67 BYTE 067h :760E9633 65 BYTE 065h :760E9634 7474 je 760E96AA :760E9636 696E6720737973 imul ebp, dword ptr [esi+67], 73797320 :760E963D 7465 je 760E96A4 :760E963F 6D insd :760E9640 207265 and byte ptr [edx+65], dh :760E9643 7374 jnb 760E96B9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E95D1(C) | :760E9645 6F outsd :760E9646 7265 jb 760E96AD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E95E1(C) | :760E9648 20726F and byte ptr [edx+6F], dh :760E964B 6F outsd :760E964C 7420 je 760E966E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E95D8(C) | :760E964E 6469726563746F72 imul esi, dword ptr fs:[edx+65], 726F7463 :760E9656 7900 jns 760E9658 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9656(C) | :760E9658 49 dec ecx :760E9659 43 inc ebx :760E965A 57 push edi :760E965B 205061 and byte ptr [eax+61], dl :760E965E 7468 je 760E96C8 :760E9660 203D20257300 and byte ptr [00732520], bh :760E9666 90 nop :760E9667 90 nop :760E9668 43 inc ebx :760E9669 6F outsd :760E966A 6E outsb :760E966B 6E outsb :760E966C 656374696F arpl dword ptr gs:[ecx+2*ebp+6F], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E95FD(C) | :760E9671 6E outsb :760E9672 57 push edi :760E9673 697A6172644469 imul edi, dword ptr [edx+61], 69446472 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9604(C) | :760E967A 7200 jb 760E967C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E967A(C) | :760E967C 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9616(C) | :760E967D 7272 jb 760E96F1 :760E967F 6F outsd :760E9680 7220 jb 760E96A2 :760E9682 67 BYTE 067h :760E9683 65 BYTE 065h :760E9684 7474 je 760E96FA :760E9686 696E67204C504E imul ebp, dword ptr [esi+67], 4E504C20 :760E968D 20666F and byte ptr [esi+6F], ah :760E9690 7220 jb 760E96B2 :760E9692 25733B2065 and eax, 65203B73 :760E9697 7272 jb 760E970B :760E9699 6F outsd :760E969A 723D jb 760E96D9 :760E969C 256C640045 and eax, 4500646C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E962D(C) | :760E96A1 7272 jb 760E9715 :760E96A3 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E963D(C) | :760E96A4 7220 jb 760E96C6 :760E96A6 7175 jno 760E971D :760E96A8 65 BYTE 065h :760E96A9 7279 jb 760E9724 :760E96AB 696E6720636F6D imul ebp, dword ptr [esi+67], 6D6F6320 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9690(C) | :760E96B2 6D insd :760E96B3 6F outsd :760E96B4 6E outsb :760E96B5 206669 and byte ptr [esi+69], ah :760E96B8 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9643(C) | :760E96B9 65 BYTE 065h :760E96BA 7320 jnb 760E96DC :760E96BC 7265 jb 760E9723 :760E96BE 676973747279206B imul esi, [bp+di+74], 6B207972 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E96A4(C) | :760E96C6 65 BYTE 065h :760E96C7 792E jns 760E96F7 :760E96C9 009090457272 add byte ptr [eax+72724590], dl :760E96CF 6F outsd :760E96D0 7220 jb 760E96F2 :760E96D2 7175 jno 760E9749 :760E96D4 65 BYTE 065h :760E96D5 7279 jb 760E9750 :760E96D7 696E672070726F imul ebp, dword ptr [esi+67], 6F727020 :760E96DE 677261 jb 760E9742 :760E96E1 6D insd :760E96E2 206669 and byte ptr [esi+69], ah :760E96E5 6C insb :760E96E6 65 BYTE 065h :760E96E7 7320 jnb 760E9709 :760E96E9 7265 jb 760E9750 :760E96EB 676973747279206B imul esi, [bp+di+74], 6B207972 :760E96F3 65 BYTE 065h :760E96F4 792E jns 760E9724 :760E96F6 00904572726F add byte ptr [eax+6F727245], dl :760E96FC 7220 jb 760E971E :760E96FE 6F outsd :760E96FF 7065 jo 760E9766 :760E9701 6E outsb :760E9702 696E6720726567 imul ebp, dword ptr [esi+67], 67657220 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E96E7(C) | :760E9709 6973747279206B imul esi, dword ptr [ebx+74], 6B207972 :760E9710 65 BYTE 065h :760E9711 7920 jns 760E9733 :760E9713 746F je 760E9784 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E96A1(C) | :760E9715 207265 and byte ptr [edx+65], dh :760E9718 7472 je 760E978C :760E971A 69657665207072 imul esp, dword ptr [ebp+76], 72702065 :760E9721 6F outsd :760E9722 677261 jb 760E9786 :760E9725 6D insd :760E9726 206669 and byte ptr [esi+69], ah :760E9729 6C insb :760E972A 65 BYTE 065h :760E972B 7300 jnb 760E972D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E972B(C) | :760E972D 90 nop :760E972E 90 nop :760E972F 90 nop :760E9730 5C pop esp :760E9731 48 dec eax :760E9732 6973746F727900 imul esi, dword ptr [ebx+74], 0079726F :760E9739 90 nop :760E973A 90 nop :760E973B 90 nop :760E973C 45 inc ebp :760E973D 7272 jb 760E97B1 :760E973F 6F outsd :760E9740 7220 jb 760E9762 :760E9742 67 BYTE 067h :760E9743 65 BYTE 065h :760E9744 7474 je 760E97BA :760E9746 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E974D 636961 arpl dword ptr [ecx+61], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E96D5(C), :760E96E9(C) | :760E9750 6C insb :760E9751 20666F and byte ptr [esi+6F], ah :760E9754 6C insb :760E9755 64 BYTE 064h :760E9756 65 BYTE 065h :760E9757 723A jb 760E9793 :760E9759 204869 and byte ptr [eax+69], cl :760E975C 7374 jnb 760E97D2 :760E975E 6F outsd :760E975F 7279 jb 760E97DA :760E9761 2C20 sub al, 20 :760E9763 65 BYTE 065h :760E9764 7272 jb 760E97D8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E96FF(C) | :760E9766 6F outsd :760E9767 7220 jb 760E9789 :760E9769 307825 xor byte ptr [eax+25], bh :760E976C 7800 js 760E976E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E976C(C) | :760E976E 90 nop :760E976F 90 nop :760E9770 45 inc ebp :760E9771 7272 jb 760E97E5 :760E9773 6F outsd :760E9774 7220 jb 760E9796 :760E9776 67 BYTE 067h :760E9777 65 BYTE 065h :760E9778 7474 je 760E97EE :760E977A 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E9781 636961 arpl dword ptr [ecx+61], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9713(C) | :760E9784 6C insb :760E9785 20666F and byte ptr [esi+6F], ah :760E9788 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9767(C) | :760E9789 64 BYTE 064h :760E978A 65 BYTE 065h :760E978B 723A jb 760E97C7 :760E978D 2054656D and byte ptr [ebp+6D], dl :760E9791 706C jo 760E97FF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9757(C) | :760E9793 61 popad :760E9794 7465 je 760E97FB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9774(C) | :760E9796 732C jnb 760E97C4 :760E9798 206572 and byte ptr [ebp+72], ah :760E979B 726F jb 760E980C :760E979D 7220 jb 760E97BF :760E979F 307825 xor byte ptr [eax+25], bh :760E97A2 7800 js 760E97A4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97A2(C) | :760E97A4 5C pop esp :760E97A5 53 push ebx :760E97A6 7461 je 760E9809 :760E97A8 7274 jb 760E981E :760E97AA 204D65 and byte ptr [ebp+65], cl :760E97AD 6E outsb :760E97AE 7500 jne 760E97B0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97AE(C) | :760E97B0 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E973D(C) | :760E97B1 7272 jb 760E9825 :760E97B3 6F outsd :760E97B4 7220 jb 760E97D6 :760E97B6 67 BYTE 067h :760E97B7 65 BYTE 065h :760E97B8 7474 je 760E982E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9744(C) | :760E97BA 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E97C1 636961 arpl dword ptr [ecx+61], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9796(C) | :760E97C4 6C insb :760E97C5 20666F and byte ptr [esi+6F], ah :760E97C8 6C insb :760E97C9 64 BYTE 064h :760E97CA 65 BYTE 065h :760E97CB 723A jb 760E9807 :760E97CD 205374 and byte ptr [ebx+74], dl :760E97D0 61 popad :760E97D1 7274 jb 760E9847 :760E97D3 4D dec ebp :760E97D4 65 BYTE 065h :760E97D5 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97B4(C) | :760E97D6 752C jne 760E9804 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9764(C) | :760E97D8 206572 and byte ptr [ebp+72], ah :760E97DB 726F jb 760E984C :760E97DD 7220 jb 760E97FF :760E97DF 307825 xor byte ptr [eax+25], bh :760E97E2 7800 js 760E97E4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97E2(C) | :760E97E4 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9771(C) | :760E97E5 7272 jb 760E9859 :760E97E7 6F outsd :760E97E8 7220 jb 760E980A :760E97EA 67 BYTE 067h :760E97EB 65 BYTE 065h :760E97EC 7474 je 760E9862 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9778(C) | :760E97EE 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E97F5 636961 arpl dword ptr [ecx+61], ebp :760E97F8 6C insb :760E97F9 20666F and byte ptr [esi+6F], ah :760E97FC 6C insb :760E97FD 64 BYTE 064h :760E97FE 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E9791(C), :760E97DD(C) | :760E97FF 723A jb 760E983B :760E9801 205065 and byte ptr [eax+65], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97D6(C) | :760E9804 7273 jb 760E9879 :760E9806 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97CB(C) | :760E9807 6E outsb :760E9808 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97A6(C) | :760E9809 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97E8(C) | :760E980A 44 inc esp :760E980B 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E979B(C) | :760E980C 63756D arpl dword ptr [ebp+6D], esi :760E980F 65 BYTE 065h :760E9810 6E outsb :760E9811 7473 je 760E9886 :760E9813 2C20 sub al, 20 :760E9815 65 BYTE 065h :760E9816 7272 jb 760E988A :760E9818 6F outsd :760E9819 7220 jb 760E983B :760E981B 307825 xor byte ptr [eax+25], bh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97A8(C) | :760E981E 7800 js 760E9820 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E981E(C) | :760E9820 5C pop esp :760E9821 4E dec esi :760E9822 65 BYTE 065h :760E9823 7468 je 760E988D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97B1(C) | :760E9825 6F outsd :760E9826 6F outsd :760E9827 64009090904572 add byte ptr fs:[eax+72459090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97B8(C) | :760E982E 726F jb 760E989F :760E9830 7220 jb 760E9852 :760E9832 67 BYTE 067h :760E9833 65 BYTE 065h :760E9834 7474 je 760E98AA :760E9836 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E983D 636961 arpl dword ptr [ecx+61], ebp :760E9840 6C insb :760E9841 20666F and byte ptr [esi+6F], ah :760E9844 6C insb :760E9845 64 BYTE 064h :760E9846 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97D1(C) | :760E9847 723A jb 760E9883 :760E9849 204E65 and byte ptr [esi+65], cl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97DB(C) | :760E984C 7468 je 760E98B6 :760E984E 6F outsd :760E984F 6F outsd :760E9850 64 BYTE 064h :760E9851 2C20 sub al, 20 :760E9853 65 BYTE 065h :760E9854 7272 jb 760E98C8 :760E9856 6F outsd :760E9857 7220 jb 760E9879 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97E5(C) | :760E9859 307825 xor byte ptr [eax+25], bh :760E985C 7800 js 760E985E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E985C(C) | :760E985E 90 nop :760E985F 90 nop :760E9860 5C pop esp :760E9861 54 push esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E97EC(C) | :760E9862 65 BYTE 065h :760E9863 6D insd :760E9864 706F jo 760E98D5 :760E9866 7261 jb 760E98C9 :760E9868 7279 jb 760E98E3 :760E986A 20496E and byte ptr [ecx+6E], cl :760E986D 7465 je 760E98D4 :760E986F 726E jb 760E98DF :760E9871 65 BYTE 065h :760E9872 7420 je 760E9894 :760E9874 46 inc esi :760E9875 696C657300909045 imul ebp, dword ptr [ebp+73], 45909000 :760E987D 7272 jb 760E98F1 :760E987F 6F outsd :760E9880 7220 jb 760E98A2 :760E9882 67 BYTE 067h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9847(C) | :760E9883 65 BYTE 065h :760E9884 7474 je 760E98FA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9811(C) | :760E9886 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9823(C) | :760E988D 636961 arpl dword ptr [ecx+61], ebp :760E9890 6C insb :760E9891 20666F and byte ptr [esi+6F], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9872(C) | :760E9894 6C insb :760E9895 64 BYTE 064h :760E9896 65 BYTE 065h :760E9897 723A jb 760E98D3 :760E9899 20496E and byte ptr [ecx+6E], cl :760E989C 7465 je 760E9903 :760E989E 726E jb 760E990E :760E98A0 65 BYTE 065h :760E98A1 7443 je 760E98E6 :760E98A3 61 popad :760E98A4 636865 arpl dword ptr [eax+65], ebp :760E98A7 2C20 sub al, 20 :760E98A9 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9834(C) | :760E98AA 7272 jb 760E991E :760E98AC 6F outsd :760E98AD 7220 jb 760E98CF :760E98AF 307825 xor byte ptr [eax+25], bh :760E98B2 7800 js 760E98B4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E98B2(C) | :760E98B4 5C pop esp :760E98B5 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E984C(C) | :760E98B6 61 popad :760E98B7 766F jbe 760E9928 :760E98B9 7269 jb 760E9924 :760E98BB 7465 je 760E9922 :760E98BD 7300 jnb 760E98BF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E98BD(C) | :760E98BF 90 nop :760E98C0 45 inc ebp :760E98C1 7272 jb 760E9935 :760E98C3 6F outsd :760E98C4 7220 jb 760E98E6 :760E98C6 67 BYTE 067h :760E98C7 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9854(C) | :760E98C8 7474 je 760E993E :760E98CA 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E98D1 636961 arpl dword ptr [ecx+61], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E986D(C) | :760E98D4 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9864(C) | :760E98D5 20666F and byte ptr [esi+6F], ah :760E98D8 6C insb :760E98D9 64 BYTE 064h :760E98DA 65 BYTE 065h :760E98DB 723A jb 760E9917 :760E98DD 204661 and byte ptr [esi+61], al :760E98E0 766F jbe 760E9951 :760E98E2 7269 jb 760E994D :760E98E4 7465 je 760E994B * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E98A1(C), :760E98C4(C) | :760E98E6 732C jnb 760E9914 :760E98E8 206572 and byte ptr [ebp+72], ah :760E98EB 726F jb 760E995C :760E98ED 7220 jb 760E990F :760E98EF 307825 xor byte ptr [eax+25], bh :760E98F2 7800 js 760E98F4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E98F2(C) | :760E98F4 5C pop esp :760E98F5 44 inc esp :760E98F6 65 BYTE 065h :760E98F7 736B jnb 760E9964 :760E98F9 746F je 760E996A :760E98FB 7000 jo 760E98FD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E98FB(C) | :760E98FD 90 nop :760E98FE 90 nop :760E98FF 90 nop :760E9900 45 inc ebp :760E9901 7272 jb 760E9975 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E989C(C) | :760E9903 6F outsd :760E9904 7220 jb 760E9926 :760E9906 67 BYTE 067h :760E9907 65 BYTE 065h :760E9908 7474 je 760E997E :760E990A 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E9911 636961 arpl dword ptr [ecx+61], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E98E6(C) | :760E9914 6C insb :760E9915 20666F and byte ptr [esi+6F], ah :760E9918 6C insb :760E9919 64 BYTE 064h :760E991A 65 BYTE 065h :760E991B 723A jb 760E9957 :760E991D 20446573 and byte ptr [ebp+73], al :760E9921 6B746F7044 imul esi, dword ptr [edi+2*ebp+70], 00000044 :760E9926 69726563746F72 imul esi, dword ptr [edx+65], 726F7463 :760E992D 792C jns 760E995B :760E992F 206572 and byte ptr [ebp+72], ah :760E9932 726F jb 760E99A3 :760E9934 7220 jb 760E9956 :760E9936 307825 xor byte ptr [eax+25], bh :760E9939 7800 js 760E993B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9939(C) | :760E993B 90 nop :760E993C 5C pop esp :760E993D 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E98C8(C) | :760E993E 6F outsd :760E993F 6F outsd :760E9940 6B696573 imul ebp, dword ptr [ecx+65], 00000073 :760E9944 009090904572 add byte ptr [eax+72459090], dl :760E994A 726F jb 760E99BB :760E994C 7220 jb 760E996E :760E994E 67 BYTE 067h :760E994F 65 BYTE 065h :760E9950 7474 je 760E99C6 :760E9952 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E9959 636961 arpl dword ptr [ecx+61], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E98EB(C) | :760E995C 6C insb :760E995D 20666F and byte ptr [esi+6F], ah :760E9960 6C insb :760E9961 64 BYTE 064h :760E9962 65 BYTE 065h :760E9963 723A jb 760E999F :760E9965 20436F and byte ptr [ebx+6F], al :760E9968 6F outsd :760E9969 6B696573 imul ebp, dword ptr [ecx+65], 00000073 :760E996D 2C20 sub al, 20 :760E996F 65 BYTE 065h :760E9970 7272 jb 760E99E4 :760E9972 6F outsd :760E9973 7220 jb 760E9995 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9901(C) | :760E9975 307825 xor byte ptr [eax+25], bh :760E9978 7800 js 760E997A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9978(C) | :760E997A 90 nop :760E997B 90 nop :760E997C 45 inc ebp :760E997D 7272 jb 760E99F1 :760E997F 6F outsd :760E9980 7220 jb 760E99A2 :760E9982 67 BYTE 067h :760E9983 65 BYTE 065h :760E9984 7474 je 760E99FA :760E9986 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E998D 636961 arpl dword ptr [ecx+61], ebp :760E9990 6C insb :760E9991 20666F and byte ptr [esi+6F], ah :760E9994 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9973(C) | :760E9995 64 BYTE 064h :760E9996 65 BYTE 065h :760E9997 723A jb 760E99D3 :760E9999 20436F and byte ptr [ebx+6F], al :760E999C 6D insd :760E999D 6D insd :760E999E 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9963(C) | :760E999F 6E outsb :760E99A0 53 push ebx :760E99A1 7461 je 760E9A04 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9932(C) | :760E99A3 7274 jb 760E9A19 :760E99A5 55 push ebp :760E99A6 702C jo 760E99D4 :760E99A8 206572 and byte ptr [ebp+72], ah :760E99AB 726F jb 760E9A1C :760E99AD 7220 jb 760E99CF :760E99AF 307825 xor byte ptr [eax+25], bh :760E99B2 7800 js 760E99B4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E99B2(C) | :760E99B4 45 inc ebp :760E99B5 7272 jb 760E9A29 :760E99B7 6F outsd :760E99B8 7220 jb 760E99DA :760E99BA 67 BYTE 067h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E994A(C) | :760E99BB 65 BYTE 065h :760E99BC 7474 je 760E9A32 :760E99BE 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E99C5 636961 arpl dword ptr [ecx+61], ebp :760E99C8 6C insb :760E99C9 20666F and byte ptr [esi+6F], ah :760E99CC 6C insb :760E99CD 64 BYTE 064h :760E99CE 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E99AD(C) | :760E99CF 723A jb 760E9A0B :760E99D1 20436F and byte ptr [ebx+6F], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E99A6(C) | :760E99D4 6D insd :760E99D5 6D insd :760E99D6 6F outsd :760E99D7 6E outsb :760E99D8 53 push ebx :760E99D9 7461 je 760E9A3C :760E99DB 7274 jb 760E9A51 :760E99DD 4D dec ebp :760E99DE 65 BYTE 065h :760E99DF 6E outsb :760E99E0 752C jne 760E9A0E :760E99E2 206572 and byte ptr [ebp+72], ah :760E99E5 726F jb 760E9A56 :760E99E7 7220 jb 760E9A09 :760E99E9 307825 xor byte ptr [eax+25], bh :760E99EC 7800 js 760E99EE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E99EC(C) | :760E99EE 90 nop :760E99EF 90 nop :760E99F0 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E997D(C) | :760E99F1 7272 jb 760E9A65 :760E99F3 6F outsd :760E99F4 7220 jb 760E9A16 :760E99F6 67 BYTE 067h :760E99F7 65 BYTE 065h :760E99F8 7474 je 760E9A6E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9984(C) | :760E99FA 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E9A01 636961 arpl dword ptr [ecx+61], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E99A1(C) | :760E9A04 6C insb :760E9A05 20666F and byte ptr [esi+6F], ah :760E9A08 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E99E7(C) | :760E9A09 64 BYTE 064h :760E9A0A 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E99CF(C) | :760E9A0B 723A jb 760E9A47 :760E9A0D 20436F and byte ptr [ebx+6F], al :760E9A10 6D insd :760E9A11 6D insd :760E9A12 6F outsd :760E9A13 6E outsb :760E9A14 50 push eax :760E9A15 726F jb 760E9A86 :760E9A17 677261 jb 760E9A7B :760E9A1A 6D insd :760E9A1B 47 inc edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E99AB(C) | :760E9A1C 726F jb 760E9A8D :760E9A1E 7570 jne 760E9A90 :760E9A20 732C jnb 760E9A4E :760E9A22 206572 and byte ptr [ebp+72], ah :760E9A25 726F jb 760E9A96 :760E9A27 7220 jb 760E9A49 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E99B5(C) | :760E9A29 307825 xor byte ptr [eax+25], bh :760E9A2C 7800 js 760E9A2E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A2C(C) | :760E9A2E 90 nop :760E9A2F 90 nop :760E9A30 45 inc ebp :760E9A31 7272 jb 760E9AA5 :760E9A33 6F outsd :760E9A34 7220 jb 760E9A56 :760E9A36 67 BYTE 067h :760E9A37 65 BYTE 065h :760E9A38 7474 je 760E9AAE :760E9A3A 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E9A41 636961 arpl dword ptr [ecx+61], ebp :760E9A44 6C insb :760E9A45 20666F and byte ptr [esi+6F], ah :760E9A48 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A27(C) | :760E9A49 64 BYTE 064h :760E9A4A 65 BYTE 065h :760E9A4B 723A jb 760E9A87 :760E9A4D 20436F and byte ptr [ebx+6F], al :760E9A50 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E99DB(C) | :760E9A51 6D insd :760E9A52 6F outsd :760E9A53 6E outsb :760E9A54 46 inc esi :760E9A55 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E99E5(C), :760E9A34(C) | :760E9A56 766F jbe 760E9AC7 :760E9A58 7269 jb 760E9AC3 :760E9A5A 7465 je 760E9AC1 :760E9A5C 732C jnb 760E9A8A :760E9A5E 206572 and byte ptr [ebp+72], ah :760E9A61 726F jb 760E9AD2 :760E9A63 7220 jb 760E9A85 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E99F1(C) | :760E9A65 307825 xor byte ptr [eax+25], bh :760E9A68 7800 js 760E9A6A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A68(C) | :760E9A6A 90 nop :760E9A6B 90 nop :760E9A6C 45 inc ebp :760E9A6D 7272 jb 760E9AE1 :760E9A6F 6F outsd :760E9A70 7220 jb 760E9A92 :760E9A72 67 BYTE 067h :760E9A73 65 BYTE 065h :760E9A74 7474 je 760E9AEA :760E9A76 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E9A7D 636961 arpl dword ptr [ecx+61], ebp :760E9A80 6C insb :760E9A81 20666F and byte ptr [esi+6F], ah :760E9A84 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A63(C) | :760E9A85 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A15(C) | :760E9A86 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A4B(C) | :760E9A87 723A jb 760E9AC3 :760E9A89 20436F and byte ptr [ebx+6F], al :760E9A8C 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A1C(C) | :760E9A8D 6D insd :760E9A8E 6F outsd :760E9A8F 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A1E(C) | :760E9A90 44 inc esp :760E9A91 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A70(C) | :760E9A92 736B jnb 760E9AFF :760E9A94 746F je 760E9B05 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A25(C) | :760E9A96 702C jo 760E9AC4 :760E9A98 206572 and byte ptr [ebp+72], ah :760E9A9B 726F jb 760E9B0C :760E9A9D 7220 jb 760E9ABF :760E9A9F 307825 xor byte ptr [eax+25], bh :760E9AA2 7800 js 760E9AA4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9AA2(C) | :760E9AA4 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A31(C) | :760E9AA5 7272 jb 760E9B19 :760E9AA7 6F outsd :760E9AA8 7220 jb 760E9ACA :760E9AAA 67 BYTE 067h :760E9AAB 65 BYTE 065h :760E9AAC 7474 je 760E9B22 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A38(C) | :760E9AAE 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E9AB5 636961 arpl dword ptr [ecx+61], ebp :760E9AB8 6C insb :760E9AB9 20666F and byte ptr [esi+6F], ah :760E9ABC 6C insb :760E9ABD 64 BYTE 064h :760E9ABE 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A9D(C) | :760E9ABF 723A jb 760E9AFB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A5A(C) | :760E9AC1 205265 and byte ptr [edx+65], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A96(C) | :760E9AC4 637963 arpl dword ptr [ecx+63], edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A56(C) | :760E9AC7 6C insb :760E9AC8 65 BYTE 065h :760E9AC9 42 inc edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9AA8(C) | :760E9ACA 696E2C20657272 imul ebp, dword ptr [esi+2C], 72726520 :760E9AD1 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A61(C) | :760E9AD2 7220 jb 760E9AF4 :760E9AD4 307825 xor byte ptr [eax+25], bh :760E9AD7 7800 js 760E9AD9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9AD7(C) | :760E9AD9 90 nop :760E9ADA 90 nop :760E9ADB 90 nop :760E9ADC 45 inc ebp :760E9ADD 7272 jb 760E9B51 :760E9ADF 6F outsd :760E9AE0 7220 jb 760E9B02 :760E9AE2 67 BYTE 067h :760E9AE3 65 BYTE 065h :760E9AE4 7474 je 760E9B5A :760E9AE6 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E9AED 636961 arpl dword ptr [ecx+61], ebp :760E9AF0 6C insb :760E9AF1 20666F and byte ptr [esi+6F], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9AD2(C) | :760E9AF4 6C insb :760E9AF5 64 BYTE 064h :760E9AF6 65 BYTE 065h :760E9AF7 723A jb 760E9B33 :760E9AF9 204170 and byte ptr [ecx+70], al :760E9AFC 7044 jo 760E9B42 :760E9AFE 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A92(C) | :760E9AFF 7461 je 760E9B62 :760E9B01 2C20 sub al, 20 :760E9B03 65 BYTE 065h :760E9B04 7272 jb 760E9B78 :760E9B06 6F outsd :760E9B07 7220 jb 760E9B29 :760E9B09 307825 xor byte ptr [eax+25], bh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9A9B(C) | :760E9B0C 7800 js 760E9B0E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9B0C(C) | :760E9B0E 90 nop :760E9B0F 90 nop :760E9B10 45 inc ebp :760E9B11 7272 jb 760E9B85 :760E9B13 6F outsd :760E9B14 7220 jb 760E9B36 :760E9B16 67 BYTE 067h :760E9B17 65 BYTE 065h :760E9B18 7474 je 760E9B8E :760E9B1A 696E6720737065 imul ebp, dword ptr [esi+67], 65707320 :760E9B21 636961 arpl dword ptr [ecx+61], ebp :760E9B24 6C insb :760E9B25 20666F and byte ptr [esi+6F], ah :760E9B28 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9B07(C) | :760E9B29 64 BYTE 064h :760E9B2A 65 BYTE 065h :760E9B2B 723A jb 760E9B67 :760E9B2D 20416C and byte ptr [ecx+6C], al :760E9B30 7453 je 760E9B85 :760E9B32 7461 je 760E9B95 :760E9B34 7274 jb 760E9BAA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9B14(C) | :760E9B36 55 push ebp :760E9B37 702C jo 760E9B65 :760E9B39 206572 and byte ptr [ebp+72], ah :760E9B3C 726F jb 760E9BAD :760E9B3E 7220 jb 760E9B60 :760E9B40 307825 xor byte ptr [eax+25], bh :760E9B43 7800 js 760E9B45 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9B43(C) | :760E9B45 90 nop :760E9B46 90 nop :760E9B47 90 nop :760E9B48 45 inc ebp :760E9B49 7272 jb 760E9BBD :760E9B4B 6F outsd :760E9B4C 7220 jb 760E9B6E :760E9B4E 67 BYTE 067h :760E9B4F 65 BYTE 065h :760E9B50 7474 je 760E9BC6 :760E9B52 696E672077696E imul ebp, dword ptr [esi+67], 6E697720 :760E9B59 6469720090909043 imul esi, dword ptr fs:[edx+00], 43909090 :760E9B61 7265 jb 760E9BC8 :760E9B63 61 popad :760E9B64 7465 je 760E9BCB :760E9B66 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9B2B(C) | :760E9B67 65 BYTE 065h :760E9B68 6D insd :760E9B69 61 popad :760E9B6A 7068 jo 760E9BD4 :760E9B6C 6F outsd :760E9B6D 7265 jb 760E9BD4 :760E9B6F 204661 and byte ptr [esi+61], al :760E9B72 696C656420307825 imul ebp, dword ptr [ebp+64], 25783020 :760E9B7A 7800 js 760E9B7C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9B7A(C) | :760E9B7C 57 push edi :760E9B7D 696E646F777320 imul ebp, dword ptr [esi+64], 2073776F :760E9B84 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E9B11(C), :760E9B30(C) | :760E9B85 7973 jns 760E9BFA :760E9B87 7465 je 760E9BEE :760E9B89 6D insd :760E9B8A 204669 and byte ptr [esi+69], al :760E9B8D 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9B18(C) | :760E9B8E 65205072 and byte ptr gs:[eax+72], dl :760E9B92 6F outsd :760E9B93 7465 je 760E9BFA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9B32(C) | :760E9B95 6374696F arpl dword ptr [ecx+2*ebp+6F], esi :760E9B99 6E outsb :760E9B9A 00904572726F add byte ptr [eax+6F727245], dl :760E9BA0 7220 jb 760E9BC2 :760E9BA2 64 BYTE 064h :760E9BA3 7570 jne 760E9C15 :760E9BA5 6C insb :760E9BA6 69636174696E67 imul esp, dword ptr [ebx+61], 676E6974 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9B3C(C) | :760E9BAD 207374 and byte ptr [ebx+74], dh :760E9BB0 7269 jb 760E9C1B :760E9BB2 6E outsb :760E9BB3 6720666F and [bp+6F], ah :760E9BB7 7220 jb 760E9BD9 :760E9BB9 66696C6520706F imul bp, word ptr [ebp+20], 6F70 :760E9BC0 7075 jo 760E9C37 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9BA0(C) | :760E9BC2 7020 jo 760E9BE4 :760E9BC4 65633A arpl dword ptr gs:[edx], edi :760E9BC7 202564009057 and byte ptr [57900064], ah :760E9BCD 7269 jb 760E9C38 :760E9BCF 7465 je 760E9C36 :760E9BD1 46 inc esi :760E9BD2 696C65204661696C imul ebp, dword ptr [ebp+20], 6C696146 :760E9BDA 65 BYTE 065h :760E9BDB 642030 and byte ptr fs:[eax], dh :760E9BDE 7825 js 760E9C05 :760E9BE0 7800 js 760E9BE2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9BE0(C) | :760E9BE2 90 nop :760E9BE3 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9BC2(C) | :760E9BE4 53 push ebx :760E9BE5 65 BYTE 065h :760E9BE6 7446 je 760E9C2E :760E9BE8 696C65506F696E74 imul ebp, dword ptr [ebp+50], 746E696F :760E9BF0 65 BYTE 065h :760E9BF1 7220 jb 760E9C13 :760E9BF3 46 inc esi :760E9BF4 61 popad :760E9BF5 696C656420307825 imul ebp, dword ptr [ebp+64], 25783020 :760E9BFD 7800 js 760E9BFF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9BFD(C) | :760E9BFF 90 nop :760E9C00 43 inc ebx :760E9C01 7265 jb 760E9C68 :760E9C03 61 popad :760E9C04 7465 je 760E9C6B :760E9C06 46 inc esi :760E9C07 696C65204661696C imul ebp, dword ptr [ebp+20], 6C696146 :760E9C0F 65 BYTE 065h :760E9C10 642030 and byte ptr fs:[eax], dh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9BF1(C) | :760E9C13 7825 js 760E9C3A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9BA3(C) | :760E9C15 7800 js 760E9C17 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9C15(C) | :760E9C17 90 nop :760E9C18 4C dec esp :760E9C19 6F outsd :760E9C1A 6745 inc ebp :760E9C1C 7665 jbe 760E9C83 :760E9C1E 6E outsb :760E9C1F 7400 je 760E9C21 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9C1F(C) | :760E9C21 90 nop :760E9C22 90 nop :760E9C23 90 nop :760E9C24 52 push edx :760E9C25 65 BYTE 065h :760E9C26 61 popad :760E9C27 64 BYTE 064h :760E9C28 46 inc esi :760E9C29 696C65206661696C imul ebp, dword ptr [ebp+20], 6C696166 :760E9C31 65 BYTE 065h :760E9C32 642030 and byte ptr fs:[eax], dh :760E9C35 7825 js 760E9C5C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9BC0(C) | :760E9C37 7800 js 760E9C39 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9C37(C) | :760E9C39 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9C13(C) | :760E9C3A 90 nop :760E9C3B 90 nop :760E9C3C 57 push edi :760E9C3D 7269 jb 760E9CA8 :760E9C3F 7465 je 760E9CA6 :760E9C41 46 inc esi :760E9C42 696C65206661696C imul ebp, dword ptr [ebp+20], 6C696166 :760E9C4A 65 BYTE 065h :760E9C4B 642030 and byte ptr fs:[eax], dh :760E9C4E 7825 js 760E9C75 :760E9C50 7800 js 760E9C52 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9C50(C) | :760E9C52 90 nop :760E9C53 90 nop :760E9C54 43 inc ebx :760E9C55 6C insb :760E9C56 6F outsd :760E9C57 7365 jnb 760E9CBE :760E9C59 48 dec eax :760E9C5A 61 popad :760E9C5B 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9C35(C) | :760E9C5C 64 BYTE 064h :760E9C5D 6C insb :760E9C5E 65206661 and byte ptr gs:[esi+61], ah :760E9C62 696C656420307825 imul ebp, dword ptr [ebp+64], 25783020 :760E9C6A 7800 js 760E9C6C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9C6A(C) | :760E9C6C 4E dec esi :760E9C6D 6F outsd :760E9C6E 206E65 and byte ptr [esi+65], ch :760E9C71 776C ja 760E9CDF :760E9C73 696E6520666F75 imul ebp, dword ptr [esi+65], 756F6620 :760E9C7A 6E outsb :760E9C7B 64009090904F75 add byte ptr fs:[eax+754F9090], dl :760E9C82 7420 je 760E9CA4 :760E9C84 6F outsd :760E9C85 66206D65 and byte ptr [ebp+65], ch :760E9C89 6D insd :760E9C8A 6F outsd :760E9C8B 7279 jb 760E9D06 :760E9C8D 009090536574 add byte ptr [eax+74655390], dl :760E9C93 46 inc esi :760E9C94 696C65506F696E74 imul ebp, dword ptr [ebp+50], 746E696F :760E9C9C 65 BYTE 065h :760E9C9D 7220 jb 760E9CBF :760E9C9F 6661 popa :760E9CA1 696C656420307825 imul ebp, dword ptr [ebp+64], 25783020 :760E9CA9 7800 js 760E9CAB :760E9CAB 90 nop :760E9CAC 54 push esp :760E9CAD 7275 jb 760E9D24 :760E9CAF 6E outsb :760E9CB0 636174 arpl dword ptr [ecx+74], esp :760E9CB3 65 BYTE 065h :760E9CB4 46 inc esi :760E9CB5 696C6553697A6500 imul ebp, dword ptr [ebp+53], 00657A69 :760E9CBD 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9C57(C) | :760E9CBE 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9C9D(C) | :760E9CBF 90 nop :760E9CC0 53 push ebx :760E9CC1 46 inc esi :760E9CC2 50 push eax :760E9CC3 44 inc esp :760E9CC4 7570 jne 760E9D36 :760E9CC6 6C insb :760E9CC7 69636174655374 imul esp, dword ptr [ebx+61], 74536574 :760E9CCE 7269 jb 760E9D39 :760E9CD0 6E outsb :760E9CD1 67206661 and [bp+61], ah :760E9CD5 696C656400909043 imul ebp, dword ptr [ebp+64], 43909000 :760E9CDD 61 popad :760E9CDE 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9C71(C) | :760E9CDF 6E outsb :760E9CE0 6F outsd :760E9CE1 7420 je 760E9D03 :760E9CE3 6F outsd :760E9CE4 7065 jo 760E9D4B :760E9CE6 6E outsb :760E9CE7 206361 and byte ptr [ebx+61], ah :760E9CEA 7461 je 760E9D4D :760E9CEC 6C insb :760E9CED 6F outsd :760E9CEE 67206669 and [bp+69], ah :760E9CF2 6C insb :760E9CF3 65202564005346 and byte ptr gs:[46530064], ah :760E9CFA 50 push eax :760E9CFB 43 inc ebx :760E9CFC 6F outsd :760E9CFD 6E outsb :760E9CFE 7665 jbe 760E9D65 :760E9D00 7274 jb 760E9D76 :760E9D02 54 push esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9CE1(C) | :760E9D03 6F outsd :760E9D04 55 push ebp :760E9D05 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9C8B(C) | :760E9D06 69636F64652066 imul esp, dword ptr [ebx+6F], 66206564 :760E9D0D 61 popad :760E9D0E 696C656400904350 imul ebp, dword ptr [ebp+64], 50439000 :760E9D16 61 popad :760E9D17 7273 jb 760E9D8C :760E9D19 65 BYTE 065h :760E9D1A 43 inc ebx :760E9D1B 61 popad :760E9D1C 7461 je 760E9D7F :760E9D1E 6C insb :760E9D1F 6F outsd :760E9D20 673A3A cmp bh, [bp+si] :760E9D23 49 dec ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9CAD(C) | :760E9D24 6E outsb :760E9D25 697400534650436F imul esi, dword ptr [eax+eax+53], 6F435046 :760E9D2D 6E outsb :760E9D2E 7665 jbe 760E9D95 :760E9D30 7274 jb 760E9DA6 :760E9D32 54 push esp :760E9D33 6F outsd :760E9D34 41 inc ecx :760E9D35 4E dec esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9CC4(C) | :760E9D36 53 push ebx :760E9D37 49 dec ecx :760E9D38 206661 and byte ptr [esi+61], ah :760E9D3B 696C6564004E6F20 imul ebp, dword ptr [ebp+64], 206F4E00 :760E9D43 50 push eax :760E9D44 726F jb 760E9DB5 :760E9D46 64 BYTE 064h :760E9D47 7563 jne 760E9DAC :760E9D49 7456 je 760E9DA1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9CE4(C) | :760E9D4B 65 BYTE 065h :760E9D4C 7273 jb 760E9DC1 :760E9D4E 696F6E20617474 imul ebp, dword ptr [edi+6E], 74746120 :760E9D55 7269 jb 760E9DC0 :760E9D57 627574 bound esi, dword ptr [ebp+74] :760E9D5A 65004350 add byte ptr gs:[ebx+50], al :760E9D5E 61 popad :760E9D5F 7273 jb 760E9DD4 :760E9D61 65 BYTE 065h :760E9D62 43 inc ebx :760E9D63 61 popad :760E9D64 7461 je 760E9DC7 :760E9D66 6C insb :760E9D67 6F outsd :760E9D68 673A3A cmp bh, [bp+si] :760E9D6B 47 inc edi :760E9D6C 65 BYTE 065h :760E9D6D 7456 je 760E9DC5 :760E9D6F 65 BYTE 065h :760E9D70 7273 jb 760E9DE5 :760E9D72 696F6E496E666F imul ebp, dword ptr [edi+6E], 6F666E49 :760E9D79 009090500072 add byte ptr [eax+72005090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9D1C(C) | :760E9D7F 006F00 add byte ptr [edi+00], ch :760E9D82 64007500 add byte ptr fs:[ebp+00], dh :760E9D86 6300 arpl dword ptr [eax], eax :760E9D88 7400 je 760E9D8A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9D88(C) | :760E9D8A 56 push esi :760E9D8B 006500 add byte ptr [ebp+00], ah :760E9D8E 7200 jb 760E9D90 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9D8E(C) | :760E9D90 7300 jnb 760E9D92 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9D90(C) | :760E9D92 69006F006E00 imul eax, dword ptr [eax], 006E006F :760E9D98 0000 add byte ptr [eax], al :760E9D9A 90 nop :760E9D9B 90 nop :760E9D9C 4F dec edi :760E9D9D 7574 jne 760E9E13 :760E9D9F 206F66 and byte ptr [edi+66], ch :760E9DA2 206D65 and byte ptr [ebp+65], ch :760E9DA5 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9D30(C) | :760E9DA6 6F outsd :760E9DA7 7279 jb 760E9E22 :760E9DA9 202D206E6577 and byte ptr [77656E20], ch :760E9DAF 204343 and byte ptr [ebx+43], al :760E9DB2 41 inc ecx :760E9DB3 54 push esp :760E9DB4 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9D44(C) | :760E9DB5 4E dec esi :760E9DB6 54 push esp :760E9DB7 52 push edx :760E9DB8 59 pop ecx :760E9DB9 009090704361 add byte ptr [eax+61437090], dl :760E9DBF 7445 je 760E9E06 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9D4C(C) | :760E9DC1 6E outsb :760E9DC2 7472 je 760E9E36 :760E9DC4 792D jns 760E9DF3 :760E9DC6 3E BYTE 03eh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9D64(C) | :760E9DC7 49 dec ecx :760E9DC8 6E outsb :760E9DC9 6974282920666169 imul esi, dword ptr [eax+ebp+29], 69616620 :760E9DD1 6C insb :760E9DD2 65 BYTE 065h :760E9DD3 64009090904372 add byte ptr fs:[eax+72439090], dl :760E9DDA 7970 jns 760E9E4C :760E9DDC 7443 je 760E9E21 :760E9DDE 41 inc ecx :760E9DDF 54 push esp :760E9DE0 45 inc ebp :760E9DE1 6E outsb :760E9DE2 756D jne 760E9E51 :760E9DE4 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9D70(C) | :760E9DE5 7261 jb 760E9E48 :760E9DE7 7465 je 760E9E4E :760E9DE9 4D dec ebp :760E9DEA 65 BYTE 065h :760E9DEB 6D insd :760E9DEC 626572 bound esp, dword ptr [ebp+72] :760E9DEF 206661 and byte ptr [esi+61], ah :760E9DF2 696C656400904350 imul ebp, dword ptr [ebp+64], 50439000 :760E9DFA 61 popad :760E9DFB 7273 jb 760E9E70 :760E9DFD 65 BYTE 065h :760E9DFE 43 inc ebx :760E9DFF 61 popad :760E9E00 7461 je 760E9E63 :760E9E02 6C insb :760E9E03 6F outsd :760E9E04 673A3A cmp bh, [bp+si] :760E9E07 47 inc edi :760E9E08 65 BYTE 065h :760E9E09 744E je 760E9E59 :760E9E0B 65 BYTE 065h :760E9E0C 7874 js 760E9E82 :760E9E0E 43 inc ebx :760E9E0F 61 popad :760E9E10 7445 je 760E9E57 :760E9E12 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9D9D(C) | :760E9E13 7472 je 760E9E87 :760E9E15 7900 jns 760E9E17 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9E15(C) | :760E9E17 90 nop :760E9E18 4E dec esi :760E9E19 6F outsd :760E9E1A 206669 and byte ptr [esi+69], ah :760E9E1D 6C insb :760E9E1E 65 BYTE 065h :760E9E1F 6E outsb :760E9E20 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9DDC(C) | :760E9E21 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9DA7(C) | :760E9E22 6520666F and byte ptr gs:[esi+6F], ah :760E9E26 756E jne 760E9E96 :760E9E28 64009090434361 add byte ptr fs:[eax+61434390], dl :760E9E2F 7445 je 760E9E76 :760E9E31 6E outsb :760E9E32 7472 je 760E9EA6 :760E9E34 793A jns 760E9E70 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9DC2(C) | :760E9E36 3A496E cmp cl, byte ptr [ecx+6E] :760E9E39 6974004572726F72 imul esi, dword ptr [eax+eax+45], 726F7272 :760E9E41 20647570 and byte ptr [ebp+2*esi+70], ah :760E9E45 6C insb :760E9E46 69636174696E67 imul esp, dword ptr [ebx+61], 676E6974 :760E9E4D 206361 and byte ptr [ebx+61], ah :760E9E50 7461 je 760E9EB3 :760E9E52 6C insb :760E9E53 6F outsd :760E9E54 6720726F and [bp+si+6F], dh :760E9E58 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9E09(C) | :760E9E59 7420 je 760E9E7B :760E9E5B 7061 jo 760E9EBE :760E9E5D 7468 je 760E9EC7 :760E9E5F 00416C add byte ptr [ecx+6C], al :760E9E62 7465 je 760E9EC9 :760E9E64 726E jb 760E9ED4 :760E9E66 61 popad :760E9E67 7465 je 760E9ECE :760E9E69 206361 and byte ptr [ebx+61], ah :760E9E6C 7420 je 760E9E8E :760E9E6E 6469726563746F72 imul esi, dword ptr fs:[edx+65], 726F7463 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9E2F(C) | :760E9E76 7920 jns 760E9E98 :760E9E78 6E outsb :760E9E79 6F outsd :760E9E7A 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9E59(C) | :760E9E7B 2D65786973 sub eax, 73697865 :760E9E80 7461 je 760E9EE3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9E0C(C) | :760E9E82 6E outsb :760E9E83 742E je 760E9EB3 :760E9E85 009090434154 add byte ptr [eax+54414390], dl :760E9E8B 41 inc ecx :760E9E8C 4C dec esp :760E9E8D 4F dec edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9E6C(C) | :760E9E8E 47 inc edi :760E9E8F 20646972 and byte ptr [ecx+2*ebp+72], ah :760E9E93 6563746F72 arpl dword ptr gs:[edi+2*ebp+72], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9E76(C) | :760E9E98 7920 jns 760E9EBA :760E9E9A 6E outsb :760E9E9B 6F outsd :760E9E9C 7420 je 760E9EBE :760E9E9E 666F outsw :760E9EA0 756E jne 760E9F10 :760E9EA2 64 BYTE 064h :760E9EA3 2D2D206368 sub eax, 6863202D :760E9EA8 65636B69 arpl dword ptr gs:[ebx+69], ebp :760E9EAC 6E outsb :760E9EAD 6720433A and [bp+di+3A], al :760E9EB1 5C pop esp :760E9EB2 7769 ja 760E9F1D :760E9EB4 6E outsb :760E9EB5 64 BYTE 064h :760E9EB6 6F outsd :760E9EB7 7773 ja 760E9F2C :760E9EB9 5C pop esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9E98(C) | :760E9EBA 636174 arpl dword ptr [ecx+74], esp :760E9EBD 726F jb 760E9F2E :760E9EBF 6F outsd :760E9EC0 7420 je 760E9EE2 :760E9EC2 2E BYTE 02eh :760E9EC3 2E009090904572 add byte ptr cs:[eax+72459090], dl :760E9ECA 726F jb 760E9F3B :760E9ECC 7220 jb 760E9EEE :760E9ECE 67 BYTE 067h :760E9ECF 65 BYTE 065h :760E9ED0 7474 je 760E9F46 :760E9ED2 696E6720746865 imul ebp, dword ptr [esi+67], 65687420 :760E9ED9 207379 and byte ptr [ebx+79], dh :760E9EDC 7374 jnb 760E9F52 :760E9EDE 65 BYTE 065h :760E9EDF 6D insd :760E9EE0 20646972 and byte ptr [ecx+2*ebp+72], ah :760E9EE4 6563746F72 arpl dword ptr gs:[edi+2*ebp+72], esi :760E9EE9 7900 jns 760E9EEB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9EE9(C) | :760E9EEB 90 nop :760E9EEC 49 dec ecx :760E9EED 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9ECC(C) | :760E9EEE 7661 jbe 760E9F51 :760E9EF0 6C insb :760E9EF1 69642066756E6374 imul esp, dword ptr [eax+66], 74636E75 :760E9EF9 696F6E20706172 imul ebp, dword ptr [edi+6E], 72617020 :760E9F00 61 popad :760E9F01 6D insd :760E9F02 65 BYTE 065h :760E9F03 7465 je 760E9F6A :760E9F05 722E jb 760E9F35 :760E9F07 004275 add byte ptr [edx+75], al :760E9F0A 66 BYTE 066h :760E9F0B 66 BYTE 066h :760E9F0C 65 BYTE 065h :760E9F0D 7220 jb 760E9F2F :760E9F0F 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9EA0(C) | :760E9F10 7665 jbe 760E9F77 :760E9F12 7266 jb 760E9F7A :760E9F14 6C insb :760E9F15 6F outsd :760E9F16 772E ja 760E9F46 :760E9F18 009090904572 add byte ptr [eax+72459090], dl :760E9F1E 726F jb 760E9F8F :760E9F20 7220 jb 760E9F42 :760E9F22 67 BYTE 067h :760E9F23 65 BYTE 065h :760E9F24 7474 je 760E9F9A :760E9F26 696E6720746865 imul ebp, dword ptr [esi+67], 65687420 :760E9F2D 206669 and byte ptr [esi+69], ah :760E9F30 7273 jb 760E9FA5 :760E9F32 7420 je 760E9F54 :760E9F34 66696C6520696E imul bp, word ptr [ebp+20], 6E69 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9ECA(C) | :760E9F3B 20746865 and byte ptr [eax+2*ebp+65], dh :760E9F3F 206C6973 and byte ptr [ecx+2*ebp+73], ch :760E9F43 742E je 760E9F73 :760E9F45 009090436174 add byte ptr [eax+74614390], dl :760E9F4B 55 push ebp :760E9F4C 7469 je 760E9FB7 :760E9F4E 6C insb :760E9F4F 7320 jnb 760E9F71 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9EEE(C) | :760E9F51 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9EDC(C) | :760E9F52 6F outsd :760E9F53 7420 je 760E9F75 :760E9F55 696E697469616C imul ebp, dword ptr [esi+69], 6C616974 :760E9F5C 697A6564009090 imul edi, dword ptr [edx+65], 90900064 :760E9F63 90 nop :760E9F64 43 inc ebx :760E9F65 43 inc ebx :760E9F66 61 popad :760E9F67 7455 je 760E9FBE :760E9F69 7469 je 760E9FD4 :760E9F6B 6C insb :760E9F6C 733A jnb 760E9FA8 :760E9F6E 3A4669 cmp al, byte ptr [esi+69] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9F4F(C) | :760E9F71 7273 jb 760E9FE6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9F43(C) | :760E9F73 7443 je 760E9FB8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9F53(C) | :760E9F75 61 popad :760E9F76 7446 je 760E9FBE :760E9F78 696C65004572726F imul ebp, dword ptr [ebp], 6F727245 :760E9F80 7220 jb 760E9FA2 :760E9F82 67 BYTE 067h :760E9F83 65 BYTE 065h :760E9F84 7474 je 760E9FFA :760E9F86 696E6720746865 imul ebp, dword ptr [esi+67], 65687420 :760E9F8D 206E65 and byte ptr [esi+65], ch :760E9F90 7874 js 760EA006 :760E9F92 206669 and byte ptr [esi+69], ah :760E9F95 6C insb :760E9F96 65 BYTE 065h :760E9F97 2E00909090496E add byte ptr cs:[eax+6E499090], dl :760E9F9E 7661 jbe 760EA001 :760E9FA0 6C insb :760E9FA1 696420656E756D65 imul esp, dword ptr [eax+65], 656D756E :760E9FA9 7261 jb 760EA00C :760E9FAB 7469 je 760EA016 :760E9FAD 6F outsd :760E9FAE 6E outsb :760E9FAF 004343 add byte ptr [ebx+43], al :760E9FB2 61 popad :760E9FB3 7455 je 760EA00A :760E9FB5 7469 je 760EA020 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9F4C(C) | :760E9FB7 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9F73(C) | :760E9FB8 733A jnb 760E9FF4 :760E9FBA 3A4765 cmp al, byte ptr [edi+65] :760E9FBD 744E je 760EA00D :760E9FBF 65 BYTE 065h :760E9FC0 7874 js 760EA036 :760E9FC2 43 inc ebx :760E9FC3 61 popad :760E9FC4 7446 je 760EA00C :760E9FC6 696C650090904275 imul ebp, dword ptr [ebp], 75429090 :760E9FCE 66 BYTE 066h :760E9FCF 66 BYTE 066h :760E9FD0 65 BYTE 065h :760E9FD1 7220 jb 760E9FF3 :760E9FD3 746F je 760EA044 :760E9FD5 6F outsd :760E9FD6 20736D and byte ptr [ebx+6D], dh :760E9FD9 61 popad :760E9FDA 6C insb :760E9FDB 6C insb :760E9FDC 00909090556E add byte ptr [eax+6E559090], dl :760E9FE2 697469616C697A65 imul esi, dword ptr [ecx+2*ebp+61], 657A696C :760E9FEA 64205574 and byte ptr fs:[ebp+74], dl :760E9FEE 696C697469657300 imul ebp, dword ptr [ecx+2*ebp+74], 00736569 :760E9FF6 90 nop :760E9FF7 90 nop :760E9FF8 43 inc ebx :760E9FF9 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9F84(C) | :760E9FFA 61 popad :760E9FFB 7455 je 760EA052 :760E9FFD 7469 je 760EA068 :760E9FFF 6C insb :760EA000 733A jnb 760EA03C :760EA002 3A4765 cmp al, byte ptr [edi+65] :760EA005 7446 je 760EA04D :760EA007 756C jne 760EA075 :760EA009 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9FB3(C) | :760EA00A 43 inc ebx :760EA00B 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E9FA9(C), :760E9FC4(C) | :760EA00C 7450 je 760EA05E :760EA00E 61 popad :760EA00F 7468 je 760EA079 :760EA011 009090457272 add byte ptr [eax+72724590], dl :760EA017 6F outsd :760EA018 7220 jb 760EA03A :760EA01A 696E697469616C imul ebp, dword ptr [esi+69], 6C616974 :760EA021 697A6520504152 imul edi, dword ptr [edx+65], 52415020 :760EA028 53 push ebx :760EA029 45 inc ebp :760EA02A 43 inc ebx :760EA02B 41 inc ecx :760EA02C 54 push esp :760EA02D 41 inc ecx :760EA02E 4C dec esp :760EA02F 4F dec edi :760EA030 47 inc edi :760EA031 20636C and byte ptr [ebx+6C], ah :760EA034 61 popad :760EA035 7373 jnb 760EA0AA :760EA037 004572 add byte ptr [ebp+72], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA018(C) | :760EA03A 726F jb 760EA0AB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA000(C) | :760EA03C 7220 jb 760EA05E :760EA03E 61 popad :760EA03F 6C insb :760EA040 6C insb :760EA041 6F outsd :760EA042 636174 arpl dword ptr [ecx+74], esp :760EA045 696E6720706172 imul ebp, dword ptr [esi+67], 72617020 :760EA04C 7365 jnb 760EA0B3 :760EA04E 206361 and byte ptr [ebx+61], ah :760EA051 7461 je 760EA0B4 :760EA053 6C insb :760EA054 6F outsd :760EA055 6720636C and [bp+di+6C], ah :760EA059 61 popad :760EA05A 7373 jnb 760EA0CF :760EA05C 009090904343 add byte ptr [eax+43439090], dl :760EA062 61 popad :760EA063 7455 je 760EA0BA :760EA065 7469 je 760EA0D0 :760EA067 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E9FFD(C) | :760EA068 733A jnb 760EA0A4 :760EA06A 3A4765 cmp al, byte ptr [edi+65] :760EA06D 7443 je 760EA0B2 :760EA06F 61 popad :760EA070 7461 je 760EA0D3 :760EA072 6C insb :760EA073 6F outsd :760EA074 672820 sub [bx+si], ah :760EA077 4C dec esp :760EA078 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA00F(C) | :760EA079 43 inc ebx :760EA07A 41 inc ecx :760EA07B 54 push esp :760EA07C 5F pop edi :760EA07D 45 inc ebp :760EA07E 4E dec esi :760EA07F 55 push ebp :760EA080 4D dec ebp :760EA081 45 inc ebp :760EA082 52 push edx :760EA083 41 inc ecx :760EA084 54 push esp :760EA085 49 dec ecx :760EA086 4F dec edi :760EA087 4E dec esi :760EA088 207043 and byte ptr [eax+43], dh :760EA08B 61 popad :760EA08C 7445 je 760EA0D3 :760EA08E 6E outsb :760EA08F 756D jne 760EA0FE :760EA091 2900 sub dword ptr [eax], eax :760EA093 90 nop :760EA094 45 inc ebp :760EA095 7272 jb 760EA109 :760EA097 6F outsd :760EA098 7220 jb 760EA0BA :760EA09A 67 BYTE 067h :760EA09B 65 BYTE 065h :760EA09C 7474 je 760EA112 :760EA09E 696E6720746865 imul ebp, dword ptr [esi+67], 65687420 :760EA0A5 206361 and byte ptr [ebx+61], ah :760EA0A8 7461 je 760EA10B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA035(C) | :760EA0AA 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA03A(C) | :760EA0AB 6F outsd :760EA0AC 67206675 and [bp+75], ah :760EA0B0 6C insb :760EA0B1 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA06D(C) | :760EA0B2 207061 and byte ptr [eax+61], dh :760EA0B5 7468 je 760EA11F :760EA0B7 2E009090904269 add byte ptr cs:[eax+69429090], dl :760EA0BE 67 BYTE 067h :760EA0BF 67 BYTE 067h :760EA0C0 65 BYTE 065h :760EA0C1 7220 jb 760EA0E3 :760EA0C3 7468 je 760EA12D :760EA0C5 61 popad :760EA0C6 6E outsb :760EA0C7 20696E and byte ptr [ecx+6E], ch :760EA0CA 7465 je 760EA131 :760EA0CC 726E jb 760EA13C :760EA0CE 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA05A(C) | :760EA0CF 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA065(C) | :760EA0D0 206275 and byte ptr [edx+75], ah * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EA070(C), :760EA08C(C) | :760EA0D3 66 BYTE 066h :760EA0D4 66 BYTE 066h :760EA0D5 65 BYTE 065h :760EA0D6 722E jb 760EA106 :760EA0D8 009090904343 add byte ptr [eax+43439090], dl :760EA0DE 61 popad :760EA0DF 7455 je 760EA136 :760EA0E1 7469 je 760EA14C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA0C1(C) | :760EA0E3 6C insb :760EA0E4 733A jnb 760EA120 :760EA0E6 3A4765 cmp al, byte ptr [edi+65] :760EA0E9 7443 je 760EA12E :760EA0EB 61 popad :760EA0EC 7461 je 760EA14F :760EA0EE 6C insb :760EA0EF 6F outsd :760EA0F0 67284C50 sub [si+50], cl :760EA0F4 43 inc ebx :760EA0F5 54 push esp :760EA0F6 53 push ebx :760EA0F7 54 push esp :760EA0F8 52 push edx :760EA0F9 207073 and byte ptr [eax+73], dh :760EA0FC 7A43 jpe 760EA141 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA08F(C) | :760EA0FE 61 popad :760EA0FF 7446 je 760EA147 :760EA101 696C654E616D6529 imul ebp, dword ptr [ebp+4E], 29656D61 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA095(C) | :760EA109 009090457272 add byte ptr [eax+72724590], dl :760EA10F 6F outsd :760EA110 7220 jb 760EA132 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA09C(C) | :760EA112 64 BYTE 064h :760EA113 65 BYTE 065h :760EA114 6C insb :760EA115 65 BYTE 065h :760EA116 7469 je 760EA181 :760EA118 6E outsb :760EA119 67206361 and [bp+di+61], ah :760EA11D 7461 je 760EA180 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA0B5(C) | :760EA11F 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA0E4(C) | :760EA120 6F outsd :760EA121 67206669 and [bp+69], ah :760EA125 6C insb :760EA126 65 BYTE 065h :760EA127 2E00909090466F add byte ptr cs:[eax+6F469090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA0E9(C) | :760EA12E 756E jne 760EA19E :760EA130 6420636F and byte ptr fs:[ebx+6F], ah :760EA134 7272 jb 760EA1A8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA0DF(C) | :760EA136 6563742045 arpl dword ptr gs:[eax+45], esi :760EA13B 4B dec ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA0CC(C) | :760EA13C 55 push ebp :760EA13D 009090557361 add byte ptr [eax+61735590], dl :760EA143 6765206669 and gs:[bp+69], ah :760EA148 65 BYTE 065h :760EA149 6C insb :760EA14A 64202564206973 and byte ptr fs:[73692064], ah :760EA151 202573009090 and byte ptr [90900073], ah :760EA157 90 nop :760EA158 43 inc ebx :760EA159 65 BYTE 065h :760EA15A 7274 jb 760EA1D0 :760EA15C 47 inc edi :760EA15D 65 BYTE 065h :760EA15E 7445 je 760EA1A5 :760EA160 6E outsb :760EA161 68616E6365 push 65636E61 :760EA166 64 BYTE 064h :760EA167 4B dec ebx :760EA168 65 BYTE 065h :760EA169 7955 jns 760EA1C0 :760EA16B 7361 jnb 760EA1CE :760EA16D 6765206661 and gs:[bp+61], ah :760EA172 696C656420256400 imul ebp, dword ptr [ebp+64], 00642520 :760EA17A 90 nop :760EA17B 90 nop :760EA17C 4D dec ebp :760EA17D 61 popad :760EA17E 6C insb :760EA17F 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA11D(C) | :760EA180 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA116(C) | :760EA181 6320 arpl dword ptr [eax], esp :760EA183 6661 popa :760EA185 696C656400909043 imul ebp, dword ptr [ebp+64], 43909000 :760EA18D 65 BYTE 065h :760EA18E 7274 jb 760EA204 :760EA190 47 inc edi :760EA191 65 BYTE 065h :760EA192 7445 je 760EA1D9 :760EA194 6E outsb :760EA195 68616E6365 push 65636E61 :760EA19A 64 BYTE 064h :760EA19B 4B dec ebx :760EA19C 65 BYTE 065h :760EA19D 7955 jns 760EA1F4 :760EA19F 7361 jnb 760EA202 :760EA1A1 6765207265 and gs:[bp+si+65], dh :760EA1A6 7475 je 760EA21D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA134(C) | :760EA1A8 726E jb 760EA218 :760EA1AA 65 BYTE 065h :760EA1AB 642030 and byte ptr fs:[eax], dh :760EA1AE 20666F and byte ptr [esi+6F], ah :760EA1B1 7220 jb 760EA1D3 :760EA1B3 7369 jnb 760EA21E :760EA1B5 7A65 jpe 760EA21C :760EA1B7 004365 add byte ptr [ebx+65], al :760EA1BA 7274 jb 760EA230 :760EA1BC 47 inc edi :760EA1BD 65 BYTE 065h :760EA1BE 7445 je 760EA205 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA169(C) | :760EA1C0 6E outsb :760EA1C1 68616E6365 push 65636E61 :760EA1C6 64 BYTE 064h :760EA1C7 4B dec ebx :760EA1C8 65 BYTE 065h :760EA1C9 7955 jns 760EA220 :760EA1CB 7361 jnb 760EA22E :760EA1CD 6765207769 and gs:[bx+69], dh :760EA1D2 7468 je 760EA23C :760EA1D4 204E55 and byte ptr [esi+55], cl :760EA1D7 4C dec esp :760EA1D8 4C dec esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA192(C) | :760EA1D9 206661 and byte ptr [esi+61], ah :760EA1DC 696C656420256400 imul ebp, dword ptr [ebp+64], 00642520 :760EA1E4 57 push edi :760EA1E5 54 push esp :760EA1E6 48 dec eax :760EA1E7 65 BYTE 065h :760EA1E8 6C insb :760EA1E9 7065 jo 760EA250 :760EA1EB 7247 jb 760EA234 :760EA1ED 65 BYTE 065h :760EA1EE 7450 je 760EA240 :760EA1F0 726F jb 760EA261 :760EA1F2 7653 jbe 760EA247 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA19D(C) | :760EA1F4 69676E65724672 imul esp, dword ptr [edi+6E], 72467265 :760EA1FB 6F outsd :760EA1FC 6D insd :760EA1FD 43 inc ebx :760EA1FE 6861696E20 push 206E6961 :760EA203 6661 popa * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA1BE(C) | :760EA205 696C65643A206563 imul ebp, dword ptr [ebp+64], 6365203A :760EA20D 3D25640090 cmp eax, 90006425 :760EA212 90 nop :760EA213 90 nop :760EA214 54 push esp :760EA215 6869732063 push 63207369 :760EA21A 65 BYTE 065h :760EA21B 7274 jb 760EA291 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA1A6(C) | :760EA21D 206861 and byte ptr [eax+61], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA1C9(C) | :760EA220 7320 jnb 760EA242 :760EA222 7468 je 760EA28C :760EA224 65207772 and byte ptr gs:[edi+72], dh :760EA228 6F outsd :760EA229 6E outsb :760EA22A 6720454B and [di+4B], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA1CB(C) | :760EA22E 55 push ebp :760EA22F 00546869 add byte ptr [eax+2*ebp+69], dl :760EA233 7320 jnb 760EA255 :760EA235 6973206E6F7420 imul esi, dword ptr [ebx+20], 20746F6E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA1D2(C) | :760EA23C 61 popad :760EA23D 206365 and byte ptr [ebx+65], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA1EE(C) | :760EA240 7274 jb 760EA2B6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA220(C) | :760EA242 20646572 and byte ptr [ebp+72], ah :760EA246 69766564206672 imul esi, dword ptr [esi+65], 72662064 :760EA24D 6F outsd :760EA24E 6D insd :760EA24F 20746865 and byte ptr [eax+2*ebp+65], dh :760EA253 204D53 and byte ptr [ebp+53], cl :760EA256 20726F and byte ptr [edx+6F], dh :760EA259 6F outsd :760EA25A 7400 je 760EA25C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA25A(C) | :760EA25C 54 push esp :760EA25D 6869732063 push 63207369 :760EA262 65 BYTE 065h :760EA263 7274 jb 760EA2D9 :760EA265 206973 and byte ptr [ecx+73], ch :760EA268 20646572 and byte ptr [ebp+72], ah :760EA26C 69766564206672 imul esi, dword ptr [esi+65], 72662064 :760EA273 6F outsd :760EA274 6D insd :760EA275 20746865 and byte ptr [eax+2*ebp+65], dh :760EA279 204D53 and byte ptr [ebp+53], cl :760EA27C 20726F and byte ptr [edx+6F], dh :760EA27F 6F outsd :760EA280 7400 je 760EA282 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA280(C) | :760EA282 90 nop :760EA283 90 nop :760EA284 54 push esp :760EA285 6869732063 push 63207369 :760EA28A 65 BYTE 065h :760EA28B 7274 jb 760EA301 :760EA28D 206861 and byte ptr [eax+61], ch :760EA290 7320 jnb 760EA2B2 :760EA292 7468 je 760EA2FC :760EA294 6520636F and byte ptr gs:[ebx+6F], ah :760EA298 7272 jb 760EA30C :760EA29A 6563742045 arpl dword ptr gs:[eax+45], esi :760EA29F 4B dec ebx :760EA2A0 55 push ebp :760EA2A1 009090437279 add byte ptr [eax+79724390], dl :760EA2A7 7074 jo 760EA31D :760EA2A9 48 dec eax :760EA2AA 61 popad :760EA2AB 7368 jnb 760EA315 :760EA2AD 50 push eax :760EA2AE 7562 jne 760EA312 :760EA2B0 6C insb :760EA2B1 69634B6579496E imul esp, dword ptr [ebx+4B], 6E497965 :760EA2B8 666F outsw :760EA2BA 206661 and byte ptr [esi+61], ah :760EA2BD 696C656420256400 imul ebp, dword ptr [ebp+64], 00642520 :760EA2C5 90 nop :760EA2C6 90 nop :760EA2C7 90 nop :760EA2C8 54 push esp :760EA2C9 6865726520 push 20657265 :760EA2CE 61 popad :760EA2CF 7265 jb 760EA336 :760EA2D1 206E6F and byte ptr [esi+6F], ch :760EA2D4 207369 and byte ptr [ebx+69], dh :760EA2D7 676E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA263(C) | :760EA2D9 65 BYTE 065h :760EA2DA 7273 jb 760EA34F :760EA2DC 206F66 and byte ptr [edi+66], ch :760EA2DF 20746865 and byte ptr [eax+2*ebp+65], dh :760EA2E3 206365 and byte ptr [ebx+65], ah :760EA2E6 7274 jb 760EA35C :760EA2E8 009090905754 add byte ptr [eax+54579090], dl :760EA2EE 48 dec eax :760EA2EF 65 BYTE 065h :760EA2F0 6C insb :760EA2F1 7065 jo 760EA358 :760EA2F3 7250 jb 760EA345 :760EA2F5 726F jb 760EA366 :760EA2F7 7644 jbe 760EA33D :760EA2F9 61 popad :760EA2FA 7461 je 760EA35D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA292(C) | :760EA2FC 46 inc esi :760EA2FD 726F jb 760EA36E :760EA2FF 6D insd :760EA300 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA28B(C) | :760EA301 7461 je 760EA364 :760EA303 7465 je 760EA36A :760EA305 44 inc esp :760EA306 61 popad :760EA307 7461 je 760EA36A :760EA309 206661 and byte ptr [esi+61], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA298(C) | :760EA30C 696C65643A206563 imul ebp, dword ptr [ebp+64], 6365203A :760EA314 3D25640057 cmp eax, 57006425 :760EA319 696E5665726966 imul ebp, dword ptr [esi+56], 66697265 :760EA320 7954 jns 760EA376 :760EA322 7275 jb 760EA399 :760EA324 7374 jnb 760EA39A :760EA326 2832 sub byte ptr [edx], dh :760EA328 2920 sub dword ptr [eax], esp :760EA32A 6661 popa :760EA32C 696C65643A206563 imul ebp, dword ptr [ebp+64], 6365203A :760EA334 3D30782530 cmp eax, 30257830 :760EA339 387800 cmp byte ptr [eax+00], bh :760EA33C 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA2F7(C) | :760EA33D 43 inc ebx :760EA33E 61 popad :760EA33F 7455 je 760EA396 :760EA341 7469 je 760EA3AC :760EA343 6C insb :760EA344 733A jnb 760EA380 :760EA346 3A5665 cmp dl, byte ptr [esi+65] :760EA349 7269 jb 760EA3B4 :760EA34B 667943 jns 760EA391 :760EA34E 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA2DA(C) | :760EA34F 7461 je 760EA3B2 :760EA351 6C insb :760EA352 6F outsd :760EA353 6700909090 add [bx+si+9090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA2F1(C) | :760EA358 49 dec ecx :760EA359 6E outsb :760EA35A 7661 jbe 760EA3BD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA2E6(C) | :760EA35C 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA2FA(C) | :760EA35D 69642066696C656E imul esp, dword ptr [eax+66], 6E656C69 :760EA365 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA2F5(C) | :760EA366 6D insd :760EA367 65009090904353 add byte ptr gs:[eax+53439090], dl :760EA36E 667044 jo 760EA3B5 :760EA371 623A bound edi, dword ptr [edx] :760EA373 3A4765 cmp al, byte ptr [edi+65] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA320(C) | :760EA376 7448 je 760EA3C0 :760EA378 61 popad :760EA379 7368 jnb 760EA3E3 :760EA37B 46 inc esi :760EA37C 726F jb 760EA3ED :760EA37E 6D insd :760EA37F 4E dec esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA344(C) | :760EA380 61 popad :760EA381 6D insd :760EA382 65004353 add byte ptr gs:[ebx+53], al :760EA386 667044 jo 760EA3CD :760EA389 623A bound edi, dword ptr [edx] :760EA38B 3A4164 cmp al, byte ptr [ecx+64] :760EA38E 64 BYTE 064h :760EA38F 43 inc ebx :760EA390 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA34C(C) | :760EA391 744E je 760EA3E1 :760EA393 61 popad :760EA394 6D insd :760EA395 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA33F(C) | :760EA396 54 push esp :760EA397 6F outsd :760EA398 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA322(C) | :760EA399 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA324(C) | :760EA39A 744C je 760EA3E8 :760EA39C 69737400416464 imul esi, dword ptr [ebx+74], 64644100 :760EA3A3 696E672F676574 imul ebp, dword ptr [esi+67], 7465672F :760EA3AA 7469 je 760EA415 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA341(C) | :760EA3AC 6E outsb :760EA3AD 67206669 and [bp+69], ah :760EA3B1 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA34F(C) | :760EA3B2 65202573009048 and byte ptr gs:[48900073], ah :760EA3B9 61 popad :760EA3BA 7368 jnb 760EA424 :760EA3BC 206572 and byte ptr [ebp+72], ah :760EA3BF 726F jb 760EA430 :760EA3C1 7200 jb 760EA3C3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA3C1(C) | :760EA3C3 90 nop :760EA3C4 43 inc ebx :760EA3C5 53 push ebx :760EA3C6 667044 jo 760EA40D :760EA3C9 623A bound edi, dword ptr [edx] :760EA3CB 3A4164 cmp al, byte ptr [ecx+64] :760EA3CE 64 BYTE 064h :760EA3CF 46 inc esi :760EA3D0 696C65456E747279 imul ebp, dword ptr [ebp+45], 7972746E :760EA3D8 54 push esp :760EA3D9 6F outsd :760EA3DA 53 push ebx :760EA3DB 46 inc esi :760EA3DC 50 push eax :760EA3DD 54 push esp :760EA3DE 61 popad :760EA3DF 626C6500 bound ebp, dword ptr [ebp] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA379(C) | :760EA3E3 90 nop :760EA3E4 52 push edx :760EA3E5 65 BYTE 065h :760EA3E6 6D insd :760EA3E7 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA39A(C) | :760EA3E8 7665 jbe 760EA44F :760EA3EA 64206669 and byte ptr fs:[esi+69], ah :760EA3EE 6C insb :760EA3EF 65202573206672 and byte ptr gs:[72662073], ah :760EA3F6 6F outsd :760EA3F7 6D insd :760EA3F8 207366 and byte ptr [ebx+66], dh :760EA3FB 7020 jo 760EA41D :760EA3FD 646200 bound eax, dword ptr fs:[eax] :760EA400 43 inc ebx :760EA401 53 push ebx :760EA402 667044 jo 760EA449 :760EA405 623A bound edi, dword ptr [edx] :760EA407 3A5265 cmp dl, byte ptr [edx+65] :760EA40A 6D insd :760EA40B 6F outsd :760EA40C 7665 jbe 760EA473 :760EA40E 46 inc esi :760EA40F 696C65456E747279 imul ebp, dword ptr [ebp+45], 7972746E :760EA417 46 inc esi :760EA418 726F jb 760EA489 :760EA41A 6D insd :760EA41B 53 push ebx :760EA41C 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA3FB(C) | :760EA41D 50 push eax :760EA41E 54 push esp :760EA41F 61 popad :760EA420 626C6500 bound ebp, dword ptr [ebp] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA3BA(C) | :760EA424 41 inc ecx :760EA425 64 BYTE 064h :760EA426 64 BYTE 064h :760EA427 65 BYTE 065h :760EA428 64206361 and byte ptr fs:[ebx+61], ah :760EA42C 7420 je 760EA44E :760EA42E 65 BYTE 065h :760EA42F 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA3BF(C) | :760EA430 7472 je 760EA4A4 :760EA432 7920 jns 760EA454 :760EA434 7665 jbe 760EA49B :760EA436 7273 jb 760EA4AB :760EA438 696F6E3D254936 imul ebp, dword ptr [edi+6E], 3649253D :760EA43F 3478 xor al, 78 :760EA441 2C20 sub al, 20 :760EA443 636174 arpl dword ptr [ecx+74], esp :760EA446 3D25730090 cmp eax, 90007325 :760EA44B 90 nop :760EA44C 43 inc ebx :760EA44D 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA42C(C) | :760EA44E 7461 je 760EA4B1 :760EA450 6C insb :760EA451 6F outsd :760EA452 6720656E and [di+6E], ah :760EA456 7472 je 760EA4CA :760EA458 7920 jns 760EA47A :760EA45A 666F outsw :760EA45C 7220 jb 760EA47E :760EA45E 636174 arpl dword ptr [ecx+74], esp :760EA461 3D25732C20 cmp eax, 202C7325 :760EA466 7665 jbe 760EA4CD :760EA468 7273 jb 760EA4DD :760EA46A 696F6E3D254936 imul ebp, dword ptr [edi+6E], 3649253D :760EA471 3478 xor al, 78 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA40C(C) | :760EA473 20616C and byte ptr [ecx+6C], ah :760EA476 7265 jb 760EA4DD :760EA478 61 popad :760EA479 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA458(C) | :760EA47A 7920 jns 760EA49C :760EA47C 65 BYTE 065h :760EA47D 7869 js 760EA4E8 :760EA47F 7374 jnb 760EA4F5 :760EA481 7300 jnb 760EA483 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA481(C) | :760EA483 90 nop :760EA484 4E dec esi :760EA485 55 push ebp :760EA486 4C dec esp :760EA487 4C dec esp :760EA488 206669 and byte ptr [esi+69], ah :760EA48B 6C insb :760EA48C 6520656E and byte ptr gs:[ebp+6E], ah :760EA490 7472 je 760EA504 :760EA492 7920 jns 760EA4B4 :760EA494 7074 jo 760EA50A :760EA496 7200 jb 760EA498 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA496(C) | :760EA498 4E dec esi :760EA499 55 push ebp :760EA49A 4C dec esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA434(C) | :760EA49B 4C dec esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA47A(C) | :760EA49C 206361 and byte ptr [ebx+61], ah :760EA49F 746E je 760EA50F :760EA4A1 61 popad :760EA4A2 6D insd :760EA4A3 65207074 and byte ptr gs:[eax+74], dh :760EA4A7 7200 jb 760EA4A9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA4A7(C) | :760EA4A9 90 nop :760EA4AA 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA436(C) | :760EA4AB 90 nop :760EA4AC 43 inc ebx :760EA4AD 53 push ebx :760EA4AE 667044 jo 760EA4F5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA44E(C) | :760EA4B1 623A bound edi, dword ptr [edx] :760EA4B3 3A4164 cmp al, byte ptr [ecx+64] :760EA4B6 64 BYTE 064h :760EA4B7 43 inc ebx :760EA4B8 61 popad :760EA4B9 7461 je 760EA51C :760EA4BB 6C insb :760EA4BC 6F outsd :760EA4BD 6745 inc ebp :760EA4BF 6E outsb :760EA4C0 7472 je 760EA534 :760EA4C2 7954 jns 760EA518 :760EA4C4 6F outsd :760EA4C5 53 push ebx :760EA4C6 46 inc esi :760EA4C7 50 push eax :760EA4C8 54 push esp :760EA4C9 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA456(C) | :760EA4CA 626C6500 bound ebp, dword ptr [ebp] :760EA4CE 90 nop :760EA4CF 90 nop :760EA4D0 46 inc esi :760EA4D1 696C656E616D6520 imul ebp, dword ptr [ebp+6E], 20656D61 :760EA4D9 2573207665 and eax, 65762073 :760EA4DE 7273 jb 760EA553 :760EA4E0 696F6E20254936 imul ebp, dword ptr [edi+6E], 36492520 :760EA4E7 3478 xor al, 78 :760EA4E9 206E6F and byte ptr [esi+6F], ch :760EA4EC 7420 je 760EA50E :760EA4EE 666F outsw :760EA4F0 756E jne 760EA560 :760EA4F2 6420696E and byte ptr fs:[ecx+6E], ch :760EA4F6 20746162 and byte ptr [ecx+62], dh :760EA4FA 6C insb :760EA4FB 65009090905265 add byte ptr gs:[eax+65529090], dl :760EA502 6D insd :760EA503 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA490(C) | :760EA504 7665 jbe 760EA56B :760EA506 64206361 and byte ptr fs:[ebx+61], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA494(C) | :760EA50A 7420 je 760EA52C :760EA50C 65 BYTE 065h :760EA50D 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA4EC(C) | :760EA50E 7472 je 760EA582 :760EA510 7920 jns 760EA532 :760EA512 66696C653D2573 imul bp, word ptr [ebp+3D], 7325 :760EA519 2C20 sub al, 20 :760EA51B 7665 jbe 760EA582 :760EA51D 723D jb 760EA55C :760EA51F 2549363478 and eax, 78343649 :760EA524 2C20 sub al, 20 :760EA526 636174 arpl dword ptr [ecx+74], esp :760EA529 3D25730090 cmp eax, 90007325 :760EA52E 90 nop :760EA52F 90 nop :760EA530 4E dec esi :760EA531 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA510(C) | :760EA532 206669 and byte ptr [esi+69], ah :760EA535 6C insb :760EA536 6520746F20 and byte ptr gs:[edi+2*ebp+20], dh :760EA53B 7265 jb 760EA5A2 :760EA53D 6D insd :760EA53E 6F outsd :760EA53F 7665 jbe 760EA5A6 :760EA541 009090435366 add byte ptr [eax+66534390], dl :760EA547 7044 jo 760EA58D :760EA549 623A bound edi, dword ptr [edx] :760EA54B 3A5265 cmp dl, byte ptr [edx+65] :760EA54E 6D insd :760EA54F 6F outsd :760EA550 7665 jbe 760EA5B7 :760EA552 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA4DE(C) | :760EA553 61 popad :760EA554 7461 je 760EA5B7 :760EA556 6C insb :760EA557 6F outsd :760EA558 6745 inc ebp :760EA55A 6E outsb :760EA55B 7472 je 760EA5CF :760EA55D 7946 jns 760EA5A5 :760EA55F 726F jb 760EA5D0 :760EA561 6D insd :760EA562 53 push ebx :760EA563 46 inc esi :760EA564 50 push eax :760EA565 54 push esp :760EA566 61 popad :760EA567 626C6500 bound ebp, dword ptr [ebp] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA504(C) | :760EA56B 90 nop :760EA56C 46 inc esi :760EA56D 696C652025732068 imul ebp, dword ptr [ebp+20], 68207325 :760EA575 61 popad :760EA576 7320 jnb 760EA598 :760EA578 6E outsb :760EA579 6F outsd :760EA57A 206361 and byte ptr [ebx+61], ah :760EA57D 7461 je 760EA5E0 :760EA57F 6C insb :760EA580 6F outsd :760EA581 6720656E and [di+6E], ah :760EA585 7472 je 760EA5F9 :760EA587 7920 jns 760EA5A9 :760EA589 696E207461626C imul ebp, dword ptr [esi+20], 6C626174 :760EA590 6500909046696C add byte ptr gs:[eax+6C694690], dl :760EA597 6520257320646F and byte ptr gs:[6F642073], ah :760EA59E 65 BYTE 065h :760EA59F 7320 jnb 760EA5C1 :760EA5A1 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA53B(C) | :760EA5A2 6F outsd :760EA5A3 7420 je 760EA5C5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA55D(C) | :760EA5A5 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA53F(C) | :760EA5A6 7869 js 760EA611 :760EA5A8 7374 jnb 760EA61E :760EA5AA 20696E and byte ptr [ecx+6E], ch :760EA5AD 20746162 and byte ptr [ecx+62], dh :760EA5B1 6C insb :760EA5B2 65004E75 add byte ptr gs:[esi+75], cl :760EA5B6 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EA550(C), :760EA554(C) | :760EA5B7 6C insb :760EA5B8 207665 and byte ptr [esi+65], dh :760EA5BB 7273 jb 760EA630 :760EA5BD 696F6E20706F69 imul ebp, dword ptr [edi+6E], 696F7020 :760EA5C4 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA5A3(C) | :760EA5C5 7465 je 760EA62C :760EA5C7 7200 jb 760EA5C9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA5C7(C) | :760EA5C9 90 nop :760EA5CA 90 nop :760EA5CB 90 nop :760EA5CC 43 inc ebx :760EA5CD 53 push ebx :760EA5CE 667044 jo 760EA615 :760EA5D1 623A bound edi, dword ptr [edx] :760EA5D3 3A4765 cmp al, byte ptr [edi+65] :760EA5D6 7446 je 760EA61E :760EA5D8 697273744C6174 imul esi, dword ptr [edx+73], 74614C74 :760EA5DF 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA57D(C) | :760EA5E0 7374 jnb 760EA656 :760EA5E2 56 push esi :760EA5E3 65 BYTE 065h :760EA5E4 7273 jb 760EA659 :760EA5E6 696F6E4F664669 imul ebp, dword ptr [edi+6E], 6946664F :760EA5ED 6C insb :760EA5EE 6500496E add byte ptr gs:[ecx+6E], cl :760EA5F2 7661 jbe 760EA655 :760EA5F4 6C insb :760EA5F5 69642068616E646C imul esp, dword ptr [eax+68], 6C646E61 :760EA5FD 65009043536670 add byte ptr gs:[eax+70665343], dl :760EA604 44 inc esp :760EA605 623A bound edi, dword ptr [edx] :760EA607 3A4765 cmp al, byte ptr [edi+65] :760EA60A 744E je 760EA65A :760EA60C 65 BYTE 065h :760EA60D 7874 js 760EA683 :760EA60F 4C dec esp :760EA610 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA5A6(C) | :760EA611 7465 je 760EA678 :760EA613 7374 jnb 760EA689 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA5CF(C) | :760EA615 56 push esi :760EA616 65 BYTE 065h :760EA617 7273 jb 760EA68C :760EA619 696F6E4F664669 imul ebp, dword ptr [edi+6E], 6946664F :760EA620 6C insb :760EA621 65009043536670 add byte ptr gs:[eax+70665343], dl :760EA628 44 inc esp :760EA629 623A bound edi, dword ptr [edx] :760EA62B 3A4973 cmp cl, byte ptr [ecx+73] :760EA62E 46 inc esi :760EA62F 696C65496E534650 imul ebp, dword ptr [ebp+49], 5046536E :760EA637 44 inc esp :760EA638 6200 bound eax, dword ptr [eax] :760EA63A 90 nop :760EA63B 90 nop :760EA63C 49 dec ecx :760EA63D 6E outsb :760EA63E 7661 jbe 760EA6A1 :760EA640 6C insb :760EA641 696420706172616D imul esp, dword ptr [eax+70], 6D617261 :760EA649 65 BYTE 065h :760EA64A 7465 je 760EA6B1 :760EA64C 7200 jb 760EA64E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA64C(C) | :760EA64E 90 nop :760EA64F 90 nop :760EA650 43 inc ebx :760EA651 61 popad :760EA652 6E outsb :760EA653 6E outsb :760EA654 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA5F2(C) | :760EA655 7420 je 760EA677 :760EA657 66696E642066 imul bp, word ptr [esi+64], 6620 :760EA65D 696C652025732069 imul ebp, dword ptr [ebp+20], 69207325 :760EA665 6E outsb :760EA666 207366 and byte ptr [ebx+66], dh :760EA669 7020 jo 760EA68B :760EA66B 646200 bound eax, dword ptr fs:[eax] :760EA66E 90 nop :760EA66F 90 nop :760EA670 43 inc ebx :760EA671 61 popad :760EA672 6E outsb :760EA673 6E outsb :760EA674 6F outsd :760EA675 7420 je 760EA697 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA655(C) | :760EA677 636F70 arpl dword ptr [edi+70], ebp :760EA67A 7900 jns 760EA67C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA67A(C) | :760EA67C 43 inc ebx :760EA67D 53 push ebx :760EA67E 667044 jo 760EA6C5 :760EA681 623A bound edi, dword ptr [edx] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA60D(C) | :760EA683 3A4765 cmp al, byte ptr [edi+65] :760EA686 7446 je 760EA6CE :760EA688 756C jne 760EA6F6 :760EA68A 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA669(C) | :760EA68B 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA617(C) | :760EA68C 696C654E616D6546 imul ebp, dword ptr [ebp+4E], 46656D61 :760EA694 726F jb 760EA705 :760EA696 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA675(C) | :760EA697 46 inc esi :760EA698 696C654E616D6500 imul ebp, dword ptr [ebp+4E], 00656D61 :760EA6A0 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA63E(C) | :760EA6A1 7272 jb 760EA715 :760EA6A3 6F outsd :760EA6A4 7220 jb 760EA6C6 :760EA6A6 696E2070617273 imul ebp, dword ptr [esi+20], 73726170 :760EA6AD 696E6720646174 imul ebp, dword ptr [esi+67], 74616420 :760EA6B4 61 popad :760EA6B5 206669 and byte ptr [esi+69], ah :760EA6B8 6C insb :760EA6B9 65009043616E6E add byte ptr gs:[eax+6E6E6143], dl :760EA6C0 6F outsd :760EA6C1 7420 je 760EA6E3 :760EA6C3 637265 arpl dword ptr [edx+65], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA6A4(C) | :760EA6C6 61 popad :760EA6C7 7465 je 760EA72E :760EA6C9 207669 and byte ptr [esi+69], dh :760EA6CC 65 BYTE 065h :760EA6CD 7720 ja 760EA6EF :760EA6CF 6F outsd :760EA6D0 66206669 and byte ptr [esi+69], ah :760EA6D4 6C insb :760EA6D5 65009043616E6E add byte ptr gs:[eax+6E6E6143], dl :760EA6DC 6F outsd :760EA6DD 7420 je 760EA6FF :760EA6DF 637265 arpl dword ptr [edx+65], esi :760EA6E2 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA6C1(C) | :760EA6E3 7465 je 760EA74A :760EA6E5 206669 and byte ptr [esi+69], ah :760EA6E8 6C insb :760EA6E9 65206D61 and byte ptr gs:[ebp+61], ch :760EA6ED 7070 jo 760EA75F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA6CD(C) | :760EA6EF 696E6720666F72 imul ebp, dword ptr [esi+67], 726F6620 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA688(C) | :760EA6F6 202573009090 and byte ptr [90900073], ah :760EA6FC 5A pop edx :760EA6FD 65 BYTE 065h :760EA6FE 726F jb 760EA76F :760EA700 2D73697A65 sub eax, 657A6973 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA694(C) | :760EA705 6420646220 and byte ptr fs:[edx+20], ah :760EA70A 66696C65009043 imul bp, word ptr [ebp], 4390 :760EA711 61 popad :760EA712 6E outsb :760EA713 6E outsb :760EA714 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA6A1(C) | :760EA715 7420 je 760EA737 :760EA717 6F outsd :760EA718 7065 jo 760EA77F :760EA71A 6E outsb :760EA71B 206669 and byte ptr [esi+69], ah :760EA71E 6C insb :760EA71F 6520257320666F and byte ptr gs:[6F662073], ah :760EA726 7220 jb 760EA748 :760EA728 7265 jb 760EA78F :760EA72A 61 popad :760EA72B 64696E6700435366 imul ebp, dword ptr fs:[esi+67], 66534300 :760EA733 7044 jo 760EA779 :760EA735 623A bound edi, dword ptr [edx] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA715(C) | :760EA737 3A4275 cmp al, byte ptr [edx+75] :760EA73A 696C645346505461 imul ebp, dword ptr [esp+53], 61545046 :760EA742 626C6546 bound ebp, dword ptr [ebp+46] :760EA746 726F jb 760EA7B7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA726(C) | :760EA748 6D insd :760EA749 44 inc esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA6E3(C) | :760EA74A 61 popad :760EA74B 7461 je 760EA7AE :760EA74D 46 inc esi :760EA74E 696C650090904361 imul ebp, dword ptr [ebp], 61439090 :760EA756 6E outsb :760EA757 6E outsb :760EA758 6F outsd :760EA759 7420 je 760EA77B :760EA75B 6F outsd :760EA75C 7065 jo 760EA7C3 :760EA75E 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA6ED(C) | :760EA75F 20646174 and byte ptr [ecx+74], ah :760EA763 61 popad :760EA764 206669 and byte ptr [esi+69], ah :760EA767 6C insb :760EA768 6520257320746F and byte ptr gs:[6F742073], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA6FE(C) | :760EA76F 207772 and byte ptr [edi+72], dh :760EA772 697465009090496E imul esi, dword ptr [ebp], 6E499090 :760EA77A 7661 jbe 760EA7DD :760EA77C 6C insb :760EA77D 69642066696C656E imul esp, dword ptr [eax+66], 6E656C69 :760EA785 61 popad :760EA786 6D insd :760EA787 65202D20777269 and byte ptr gs:[69727720], ch :760EA78E 7469 je 760EA7F9 :760EA790 6E outsb :760EA791 6720746F and [si+6F], dh :760EA795 206F72 and byte ptr [edi+72], ch :760EA798 6967696E616C20 imul esp, dword ptr [edi+69], 206C616E :760EA79F 66696C65004353 imul bp, word ptr [ebp], 5343 :760EA7A6 667044 jo 760EA7ED :760EA7A9 623A bound edi, dword ptr [edx] :760EA7AB 3A5772 cmp dl, byte ptr [edi+72] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA74B(C) | :760EA7AE 6974655346505461 imul esi, dword ptr [ebp+53], 61545046 :760EA7B6 626C6554 bound ebp, dword ptr [ebp+54] :760EA7BA 6F outsd :760EA7BB 44 inc esp :760EA7BC 61 popad :760EA7BD 7461 je 760EA820 :760EA7BF 46 inc esi :760EA7C0 696C6500476F7420 imul ebp, dword ptr [ebp], 20746F47 :760EA7C8 7072 jo 760EA83C :760EA7CA 6F outsd :760EA7CB 7465 je 760EA832 :760EA7CD 63746564 arpl dword ptr [ebp+64], esi :760EA7D1 206669 and byte ptr [esi+69], ah :760EA7D4 6C insb :760EA7D5 65202573009090 and byte ptr gs:[90900073], ah :760EA7DC 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA77A(C) | :760EA7DD 696C65202573206E imul ebp, dword ptr [ebp+20], 6E207325 :760EA7E5 6F outsd :760EA7E6 7420 je 760EA808 :760EA7E8 696E2073667064 imul ebp, dword ptr [esi+20], 64706673 :760EA7EF 6200 bound eax, dword ptr [eax] :760EA7F1 90 nop :760EA7F2 90 nop :760EA7F3 90 nop :760EA7F4 43 inc ebx :760EA7F5 53 push ebx :760EA7F6 667044 jo 760EA83D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA78E(C) | :760EA7F9 623A bound edi, dword ptr [edx] :760EA7FB 3A4765 cmp al, byte ptr [edi+65] :760EA7FE 744E je 760EA84E :760EA800 65 BYTE 065h :760EA801 7874 js 760EA877 :760EA803 50 push eax :760EA804 726F jb 760EA875 :760EA806 7465 je 760EA86D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA7E6(C) | :760EA808 63746564 arpl dword ptr [ebp+64], esi :760EA80C 46 inc esi :760EA80D 696C650090909045 imul ebp, dword ptr [ebp], 45909090 :760EA815 7272 jb 760EA889 :760EA817 6F outsd :760EA818 7220 jb 760EA83A :760EA81A 25783A204C and eax, 4C203A78 :760EA81F 697374656E2066 imul esi, dword ptr [ebx+74], 66206E65 :760EA826 61 popad :760EA827 696C656400457272 imul ebp, dword ptr [ebp+64], 72724500 :760EA82F 6F outsd :760EA830 7220 jb 760EA852 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA7CB(C) | :760EA832 25783A2043 and eax, 43203A78 :760EA837 61 popad :760EA838 6E outsb :760EA839 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA818(C) | :760EA83A 6F outsd :760EA83B 7420 je 760EA85D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA7F7(C) | :760EA83D 7265 jb 760EA8A4 :760EA83F 6769737465722073 imul esi, [bp+di+74], 73207265 :760EA847 7272 jb 760EA8BB :760EA849 7063 jo 760EA8AE :760EA84B 20696E and byte ptr [ecx+6E], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA7FE(C) | :760EA84E 7465 je 760EA8B5 :760EA850 7266 jb 760EA8B8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA830(C) | :760EA852 61 popad :760EA853 636500 arpl dword ptr [ebp+00], esp :760EA856 90 nop :760EA857 90 nop :760EA858 45 inc ebp :760EA859 7272 jb 760EA8CD :760EA85B 6F outsd :760EA85C 7220 jb 760EA87E :760EA85E 25783A2043 and eax, 43203A78 :760EA863 61 popad :760EA864 6E outsb :760EA865 6E outsb :760EA866 6F outsd :760EA867 7420 je 760EA889 :760EA869 7265 jb 760EA8D0 :760EA86B 6769737465722073 imul esi, [bp+di+74], 73207265 :760EA873 667072 jo 760EA8E8 :760EA876 7063 jo 760EA8DB :760EA878 20696E and byte ptr [ecx+6E], ch :760EA87B 7465 je 760EA8E2 :760EA87D 7266 jb 760EA8E5 :760EA87F 61 popad :760EA880 636500 arpl dword ptr [ebp+00], esp :760EA883 90 nop :760EA884 45 inc ebp :760EA885 7272 jb 760EA8F9 :760EA887 6F outsd :760EA888 7220 jb 760EA8AA :760EA88A 25783A2043 and eax, 43203A78 :760EA88F 61 popad :760EA890 6E outsb :760EA891 6E outsb :760EA892 6F outsd :760EA893 7420 je 760EA8B5 :760EA895 7365 jnb 760EA8FC :760EA897 7420 je 760EA8B9 :760EA899 7072 jo 760EA90D :760EA89B 6F outsd :760EA89C 746F je 760EA90D :760EA89E 636F6C arpl dword ptr [edi+6C], ebp :760EA8A1 207365 and byte ptr [ebx+65], dh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA83D(C) | :760EA8A4 7175 jno 760EA91B :760EA8A6 65 BYTE 065h :760EA8A7 6E outsb :760EA8A8 636500 arpl dword ptr [ebp+00], esp :760EA8AB 90 nop :760EA8AC 53 push ebx :760EA8AD 667052 jo 760EA902 :760EA8B0 7063 jo 760EA915 :760EA8B2 53 push ebx :760EA8B3 65 BYTE 065h :760EA8B4 7276 jb 760EA92C :760EA8B6 65 BYTE 065h :760EA8B7 7254 jb 760EA90D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA897(C) | :760EA8B9 6872656164 push 64616572 :760EA8BE 00904572726F add byte ptr [eax+6F727245], dl :760EA8C4 7220 jb 760EA8E6 :760EA8C6 25783A2055 and eax, 55203A78 :760EA8CB 6E outsb :760EA8CC 7265 jb 760EA933 :760EA8CE 6769737465722073 imul esi, [bp+di+74], 73207265 :760EA8D6 65 BYTE 065h :760EA8D7 7276 jb 760EA94F :760EA8D9 65 BYTE 065h :760EA8DA 7220 jb 760EA8FC :760EA8DC 6661 popa :760EA8DE 696C656400904572 imul ebp, dword ptr [ebp+64], 72459000 :760EA8E6 726F jb 760EA957 :760EA8E8 7220 jb 760EA90A :760EA8EA 25783A2053 and eax, 53203A78 :760EA8EF 746F je 760EA960 :760EA8F1 7020 jo 760EA913 :760EA8F3 6C insb :760EA8F4 697374656E696E imul esi, dword ptr [ebx+74], 6E696E65 :760EA8FB 67206661 and [bp+61], ah :760EA8FF 696C656400536875 imul ebp, dword ptr [ebp+64], 75685300 :760EA907 7464 je 760EA96D :760EA909 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA8E8(C) | :760EA90A 776E ja 760EA97A :760EA90C 00909090381B add byte ptr [eax+1B389090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA913(C) | :760EA912 0E push cs * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA8F1(C) | :760EA913 76FD jbe 760EA912 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA8B0(C) | :760EA915 60 pushad :760EA916 0F7609 pcmpeqd mm1, dword ptr [ecx] :760EA919 61 popad :760EA91A 0F7600 pcmpeqd mm0, dword ptr [eax] :760EA91D 00000000000000000000 BYTE 10 DUP(0) :760EA927 000000000000000000 BYTE 9 DUP(0) :760EA930 4A dec edx :760EA931 1C0E sbb al, 0E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA8CC(C) | :760EA933 7600 jbe 760EA935 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA933(C) | :760EA935 000000 BYTE 3 DUP(0) :760EA938 0100 add dword ptr [eax], eax :760EA93A 0100 add dword ptr [eax], eax :760EA93C 00000000 BYTE 4 DUP(0) :760EA940 17 pop ss :760EA941 0103 add dword ptr [ebx], eax :760EA943 0500000000 add eax, 00000000 :760EA948 0000000000000000 BYTE 8 DUP(0) :760EA950 0100 add dword ptr [eax], eax :760EA952 00000000000000000000 BYTE 10 DUP(0) :760EA95C 000000000000 BYTE 6 DUP(0) :760EA962 4D dec ebp :760EA963 0102 add dword ptr [edx], eax :760EA965 004D01 add byte ptr [ebp+01], cl :760EA968 06 push es :760EA969 005308 add byte ptr [ebx+08], dl :760EA96C 4D dec ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA907(C) | :760EA96D 0102 add dword ptr [edx], eax :760EA96F 004E08 add byte ptr [esi+08], cl :760EA972 53 push ebx :760EA973 084D01 or byte ptr [ebp+01], cl :760EA976 0200 add al, byte ptr [eax] :760EA978 53 push ebx :760EA979 085001 or byte ptr [eax+01], dl :760EA97C 0A00 or al, byte ptr [eax] :760EA97E 53 push ebx :760EA97F 084D01 or byte ptr [ebp+01], cl :760EA982 0200 add al, byte ptr [eax] :760EA984 51 push ecx :760EA985 011E add dword ptr [esi], ebx :760EA987 004E08 add byte ptr [esi+08], cl :760EA98A 53 push ebx :760EA98B 084E08 or byte ptr [esi+08], cl :760EA98E 4D dec ebp :760EA98F 0102 add dword ptr [edx], eax :760EA991 005308 add byte ptr [ebx+08], dl :760EA994 4E dec esi :760EA995 085308 or byte ptr [ebx+08], dl :760EA998 53 push ebx :760EA999 084D01 or byte ptr [ebp+01], cl :760EA99C 2800 sub byte ptr [eax], al :760EA99E 51 push ecx :760EA99F 013E add dword ptr [esi], edi :760EA9A1 005308 add byte ptr [ebx+08], dl :760EA9A4 4E dec esi :760EA9A5 0B5B5C or ebx, dword ptr [ebx+5C] :760EA9A8 5B pop ebx :760EA9A9 5C pop esp :760EA9AA 000000000000 BYTE 6 DUP(0) :760EA9B0 FFFFFFFF BYTE 4 DUP(0ffh) :760EA9B4 00000000 BYTE 4 DUP(0) :760EA9B8 29620F sub dword ptr [edx+0F], esp :760EA9BB 7690 jbe 760EA94D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAA2B(C) | :760EA9BD 90 nop :760EA9BE 90 nop :760EA9BF 90 nop :760EA9C0 FFFFFFFF BYTE 4 DUP(0ffh) :760EA9C4 00000000 BYTE 4 DUP(0) :760EA9C8 42 inc edx :760EA9C9 630F arpl dword ptr [edi], ecx :760EA9CB 7690 jbe 760EA95D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAA3B(C) | :760EA9CD 90 nop :760EA9CE 90 nop :760EA9CF 90 nop :760EA9D0 FFFFFFFF BYTE 4 DUP(0ffh) :760EA9D4 00000000 BYTE 4 DUP(0) :760EA9D8 3C64 cmp al, 64 :760EA9DA 0F7690909090FF pcmpeqd mm2, dword ptr [eax+FF909090] :760EA9E1 FFFFFF BYTE 3 DUP(0ffh) :760EA9E4 00000000 BYTE 4 DUP(0) :760EA9E8 7465 je 760EAA4F :760EA9EA 0F7690909090FF pcmpeqd mm2, dword ptr [eax+FF909090] :760EA9F1 FFFFFF BYTE 3 DUP(0ffh) :760EA9F4 00000000 BYTE 4 DUP(0) :760EA9F8 FC cld :760EA9F9 660F7690909090FF pcmpeqd mm2, dword ptr [eax+FF909090] :760EAA01 FFFFFF BYTE 3 DUP(0ffh) :760EAA04 00000000 BYTE 4 DUP(0) :760EAA08 29680F sub dword ptr [eax+0F], ebp :760EAA0B 7690 jbe 760EA99D :760EAA0D 90 nop :760EAA0E 90 nop :760EAA0F 90 nop :760EAA10 FFFFFFFF BYTE 4 DUP(0ffh) :760EAA14 00000000 BYTE 4 DUP(0) :760EAA18 11690F adc dword ptr [ecx+0F], ebp :760EAA1B 7690 jbe 760EA9AD :760EAA1D 90 nop :760EAA1E 90 nop :760EAA1F 90 nop :760EAA20 FFFFFFFF BYTE 4 DUP(0ffh) :760EAA24 00000000 BYTE 4 DUP(0) :760EAA28 C5690F lds ebp, dword ptr [ecx+0F] :760EAA2B 7690 jbe 760EA9BD :760EAA2D 90 nop :760EAA2E 90 nop :760EAA2F 90 nop :760EAA30 FFFFFFFF BYTE 4 DUP(0ffh) :760EAA34 00000000 BYTE 4 DUP(0) :760EAA38 AD lodsd :760EAA39 6A0F push 0000000F :760EAA3B 7690 jbe 760EA9CD :760EAA3D 90 nop :760EAA3E 90 nop :760EAA3F 90 nop :760EAA40 FFFFFFFF BYTE 4 DUP(0ffh) :760EAA44 00000000 BYTE 4 DUP(0) :760EAA48 61 popad :760EAA49 6B0F76 imul ecx, dword ptr [edi], 00000076 :760EAA4C 90 nop :760EAA4D 90 nop :760EAA4E 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EA9E8(C) | :760EAA4F 90 nop :760EAA50 FFFFFFFF BYTE 4 DUP(0ffh) :760EAA54 00000000 BYTE 4 DUP(0) :760EAA58 64 BYTE 064h :760EAA59 6C insb :760EAA5A 0F7690909090FF pcmpeqd mm2, dword ptr [eax+FF909090] :760EAA61 FFFFFF BYTE 3 DUP(0ffh) :760EAA64 00000000 BYTE 4 DUP(0) * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAA7F(C) | :760EAA68 A96D0F7690 test eax, 90760F6D :760EAA6D 90 nop :760EAA6E 90 nop :760EAA6F 90 nop :760EAA70 FFFFFFFF BYTE 4 DUP(0ffh) :760EAA74 00000000 BYTE 4 DUP(0) :760EAA78 6E outsb :760EAA79 6E outsb :760EAA7A 0F76E8 pcmpeqd mm5, mm0 :760EAA7D AE scasb :760EAA7E 0E push cs :760EAA7F 76E7 jbe 760EAA68 :760EAA81 6E outsb :760EAA82 0F764572 pcmpeqd mm0, dword ptr [ebp±72] :760EAA86 726F jb 760EAAF7 :760EAA88 7220 jb 760EAAAA :760EAA8A 61 popad :760EAA8B 6C insb :760EAA8C 6C insb :760EAA8D 6F outsd :760EAA8E 636174 arpl dword ptr [ecx+74], esp :760EAA91 696E67206D656D imul ebp, dword ptr [esi+67], 6D656D20 :760EAA98 6F outsd :760EAA99 7279 jb 760EAB14 :760EAA9B 004356 add byte ptr [ebx+56], al :760EAA9E 58 pop eax :760EAA9F 44 inc esp :760EAAA0 44 inc esp :760EAAA1 61 popad :760EAAA2 7442 je 760EAAE6 :760EAAA4 7569 jne 760EAB0F :760EAAA6 6C insb :760EAAA7 64 BYTE 064h :760EAAA8 65 BYTE 065h :760EAAA9 723A jb 760EAAE5 :760EAAAB 3A4164 cmp al, byte ptr [ecx+64] :760EAAAE 64 BYTE 064h :760EAAAF 46 inc esi :760EAAB0 696C65546F4C6973 imul ebp, dword ptr [ebp+54], 73694C6F :760EAAB8 7400 je 760EAABA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAAB8(C) | :760EAABA 90 nop :760EAABB 90 nop :760EAABC 55 push ebp :760EAABD 7870 js 760EAB2F :760EAABF 6563746564 arpl dword ptr gs:[ebp+64], esi :760EAAC4 206572 and byte ptr [ebp+72], ah :760EAAC7 726F jb 760EAB38 :760EAAC9 7220 jb 760EAAEB :760EAACB 636F6E arpl dword ptr [edi+6E], ebp :760EAACE 646974696F6E20696E imul esi, dword ptr fs:[ecx+2*ebp+6F], 6E69206E :760EAAD7 204164 and byte ptr [ecx+64], al :760EAADA 64 BYTE 064h :760EAADB 54 push esp :760EAADC 7265 jb 760EAB43 :760EAADE 65 BYTE 065h :760EAADF 4E dec esi :760EAAE0 6F outsd :760EAAE1 64 BYTE 064h :760EAAE2 653A20 cmp ah, byte ptr gs:[eax] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAAA9(C) | :760EAAE5 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAAA2(C) | :760EAAE6 6F outsd :760EAAE7 206C696E and byte ptr [ecx+2*ebp+6E], ch * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAAC9(C) | :760EAAEB 6B2064 imul esp, dword ptr [eax], 00000064 :760EAAEE 65 BYTE 065h :760EAAEF 7465 je 760EAB56 :760EAAF1 726D jb 760EAB60 :760EAAF3 696E6564004572 imul ebp, dword ptr [esi+65], 72450064 :760EAAFA 726F jb 760EAB6B :760EAAFC 7220 jb 760EAB1E :760EAAFE 61 popad :760EAAFF 64 BYTE 064h :760EAB00 64696E6720612066 imul ebp, dword ptr fs:[esi+67], 66206120 :760EAB08 696C6520746F2074 imul ebp, dword ptr [ebp+20], 74206F74 :760EAB10 6865206669 push 69662065 :760EAB15 6C insb :760EAB16 65 BYTE 065h :760EAB17 6C insb :760EAB18 6973742E009090 imul esi, dword ptr [ebx+74], 9090002E :760EAB1F 90 nop :760EAB20 45 inc ebp :760EAB21 7272 jb 760EAB95 :760EAB23 6F outsd :760EAB24 7220 jb 760EAB46 :760EAB26 65 BYTE 065h :760EAB27 7874 js 760EAB9D :760EAB29 7261 jb 760EAB8C :760EAB2B 6374696E arpl dword ptr [ecx+2*ebp+6E], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAABD(C) | :760EAB2F 67207061 and [bx+si+61], dh :760EAB33 7468 je 760EAB9D :760EAB35 20656C and byte ptr [ebp+6C], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAAC7(C) | :760EAB38 65 BYTE 065h :760EAB39 6D insd :760EAB3A 65 BYTE 065h :760EAB3B 6E outsb :760EAB3C 742E je 760EAB6C :760EAB3E 009043565844 add byte ptr [eax+44585643], dl :760EAB44 44 inc esp :760EAB45 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAB24(C) | :760EAB46 7442 je 760EAB8A :760EAB48 7569 jne 760EABB3 :760EAB4A 6C insb :760EAB4B 64 BYTE 064h :760EAB4C 65 BYTE 065h :760EAB4D 723A jb 760EAB89 :760EAB4F 3A4164 cmp al, byte ptr [ecx+64] :760EAB52 64 BYTE 064h :760EAB53 54 push esp :760EAB54 7265 jb 760EABBB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAAEF(C) | :760EAB56 65 BYTE 065h :760EAB57 4E dec esi :760EAB58 6F outsd :760EAB59 64 BYTE 064h :760EAB5A 65004572 add byte ptr gs:[ebp+72], al :760EAB5E 726F jb 760EABCF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAAF1(C) | :760EAB60 7220 jb 760EAB82 :760EAB62 61 popad :760EAB63 64 BYTE 064h :760EAB64 64696E6720747265 imul ebp, dword ptr fs:[esi+67], 65727420 :760EAB6C 65206E6F and byte ptr gs:[esi+6F], ch :760EAB70 64 BYTE 064h :760EAB71 6520696E and byte ptr gs:[ecx+6E], ch :760EAB75 206D65 and byte ptr [ebp+65], ch :760EAB78 7461 je 760EABDB :760EAB7A 64 BYTE 064h :760EAB7B 7269 jb 760EABE6 :760EAB7D 7665 jbe 760EABE4 :760EAB7F 206669 and byte ptr [esi+69], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAB60(C) | :760EAB82 6C insb :760EAB83 65 BYTE 065h :760EAB84 61 popad :760EAB85 64 BYTE 064h :760EAB86 64 BYTE 064h :760EAB87 2E009090907678 add byte ptr cs:[eax+78769090], dl :760EAB8E 64 BYTE 064h :760EAB8F 52 push edx :760EAB90 6F outsd :760EAB91 6F outsd :760EAB92 745C je 760EABF0 :760EAB94 2573009041 and eax, 41900073 :760EAB99 64 BYTE 064h :760EAB9A 64 BYTE 064h :760EAB9B 4D dec ebp :760EAB9C 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EAB27(C), :760EAB33(C) | :760EAB9D 7461 je 760EAC00 :760EAB9F 44 inc esp :760EABA0 7269 jb 760EAC0B :760EABA2 7665 jbe 760EAC09 :760EABA4 46 inc esi :760EABA5 696C65446972004E imul ebp, dword ptr [ebp+44], 4E007269 :760EABAD 6F outsd :760EABAE 7420 je 760EABD0 :760EABB0 65 BYTE 065h :760EABB1 6E outsb :760EABB2 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAB48(C) | :760EABB3 7567 jne 760EAC1C :760EABB5 6820627566 push 66756220 :760EABBA 66 BYTE 066h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAB54(C) | :760EABBB 65 BYTE 065h :760EABBC 7220 jb 760EABDE :760EABBE 7370 jnb 760EAC30 :760EABC0 61 popad :760EABC1 63652E arpl dword ptr [ebp+2E], esp :760EABC4 009090906572 add byte ptr [eax+72659090], dl :760EABCA 726F jb 760EAC3B :760EABCC 7220 jb 760EABEE :760EABCE 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAB5E(C) | :760EABCF 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EABAE(C) | :760EABD0 64696E67206D6574 imul ebp, dword ptr fs:[esi+67], 74656D20 :760EABD8 61 popad :760EABD9 20647269 and byte ptr [edx+2*esi+69], ah :760EABDD 7665 jbe 760EAC44 :760EABDF 206669 and byte ptr [esi+69], ah :760EABE2 6C insb :760EABE3 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAB7D(C) | :760EABE4 2E009090457272 add byte ptr cs:[eax+72724590], dl :760EABEB 6F outsd :760EABEC 7220 jb 760EAC0E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EABCC(C) | :760EABEE 61 popad :760EABEF 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAB92(C) | :760EABF0 64696E67206E6F64 imul ebp, dword ptr fs:[esi+67], 646F6E20 :760EABF8 65 BYTE 065h :760EABF9 2E00906572726F add byte ptr cs:[eax+6F727265], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAB9D(C) | :760EAC00 7220 jb 760EAC22 :760EAC02 61 popad :760EAC03 64 BYTE 064h :760EAC04 64696E67206D6574 imul ebp, dword ptr fs:[esi+67], 74656D20 :760EAC0C 61 popad :760EAC0D 20647269 and byte ptr [edx+2*esi+69], ah :760EAC11 7665 jbe 760EAC78 :760EAC13 20646972 and byte ptr [ecx+2*ebp+72], ah :760EAC17 6563746F72 arpl dword ptr gs:[edi+2*ebp+72], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EABB3(C) | :760EAC1C 792E jns 760EAC4C :760EAC1E 00904572726F add byte ptr [eax+6F727245], dl :760EAC24 7220 jb 760EAC46 :760EAC26 627569 bound esi, dword ptr [ebp+69] :760EAC29 6C insb :760EAC2A 6469676E20706174 imul esp, dword ptr fs:[edi+6E], 74617020 :760EAC32 6874726565 push 65657274 :760EAC37 20626C and byte ptr [edx+6C], ah :760EAC3A 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EABCA(C) | :760EAC3B 622E bound ebp, dword ptr [esi] :760EAC3D 009090546865 add byte ptr [eax+65685490], dl :760EAC43 7265 jb 760EACAA :760EAC45 207761 and byte ptr [edi+61], dh :760EAC48 7320 jnb 760EAC6A :760EAC4A 61 popad :760EAC4B 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAC1C(C) | :760EAC4C 206572 and byte ptr [ebp+72], ah :760EAC4F 726F jb 760EACC0 :760EAC51 7220 jb 760EAC73 :760EAC53 7061 jo 760EACB6 :760EAC55 7273 jb 760EACCA :760EAC57 696E6720746865 imul ebp, dword ptr [esi+67], 65687420 :760EAC5E 207072 and byte ptr [eax+72], dh :760EAC61 6F outsd :760EAC62 7465 je 760EACC9 :760EAC64 63746564 arpl dword ptr [ebp+64], esi :760EAC68 20584D and byte ptr [eax+4D], bl :760EAC6B 4C dec esp :760EAC6C 206669 and byte ptr [esi+69], ah :760EAC6F 6C insb :760EAC70 65 BYTE 065h :760EAC71 2E009043565844 add byte ptr cs:[eax+44585643], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAC11(C) | :760EAC78 44 inc esp :760EAC79 61 popad :760EAC7A 7442 je 760EACBE :760EAC7C 7569 jne 760EACE7 :760EAC7E 6C insb :760EAC7F 64 BYTE 064h :760EAC80 65 BYTE 065h :760EAC81 723A jb 760EACBD :760EAC83 3A4275 cmp al, byte ptr [edx+75] :760EAC86 696C645472656500 imul ebp, dword ptr [esp+54], 00656572 :760EAC8E 90 nop :760EAC8F 90 nop :760EAC90 30AF0E76FB7C xor byte ptr [edi+7CFB760E], ch :760EAC96 0F764572 pcmpeqd mm0, dword ptr [ebp72] :760EAC9A 726F jb 760EAD0B :760EAC9C 7220 jb 760EACBE :760EAC9E 61 popad :760EAC9F 6C insb :760EACA0 6C insb :760EACA1 6F outsd :760EACA2 636174 arpl dword ptr [ecx+74], esp :760EACA5 696E67206D656D imul ebp, dword ptr [esi+67], 6D656D20 :760EACAC 6F outsd :760EACAD 7279 jb 760EAD28 :760EACAF 2E009090904572 add byte ptr cs:[eax+72459090], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAC53(C) | :760EACB6 726F jb 760EAD27 :760EACB8 7220 jb 760EACDA :760EACBA 636C6561 arpl dword ptr [ebp+61], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EAC7A(C), :760EAC9C(C) | :760EACBE 6E outsb :760EACBF 696E6720757020 imul ebp, dword ptr [esi+67], 20707520 :760EACC6 6D insd :760EACC7 65 BYTE 065h :760EACC8 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAC62(C) | :760EACC9 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAC55(C) | :760EACCA 7279 jb 760EAD45 :760EACCC 2E009090435658 add byte ptr cs:[eax+58564390], dl :760EACD3 44 inc esp :760EACD4 48 dec eax :760EACD5 61 popad :760EACD6 7368 jnb 760EAD40 :760EACD8 4C dec esp :760EACD9 6973743A3A496E imul esi, dword ptr [ebx+74], 6E493A3A :760EACE0 69740090496E7375 imul esi, dword ptr [eax+eax-70], 75736E49 :760EACE8 66 BYTE 066h :760EACE9 6669656E6374 imul sp, word ptr [ebp+6E], 7463 :760EACEF 207370 and byte ptr [ebx+70], dh :760EACF2 61 popad :760EACF3 636520 arpl dword ptr [ebp+20], esp :760EACF6 6C insb :760EACF7 65667420 je 760EAD1B :760EACFB 696E2064617461 imul ebp, dword ptr [esi+20], 61746164 :760EAD02 207365 and byte ptr [ebx+65], dh :760EAD05 6374696F arpl dword ptr [ecx+2*ebp+6F], esi :760EAD09 6E outsb :760EAD0A 0090546F6F20 add byte ptr [eax+206F6F54], dl :760EAD10 6D insd :760EAD11 61 popad :760EAD12 6E outsb :760EAD13 7920 jns 760EAD35 :760EAD15 65 BYTE 065h :760EAD16 6C insb :760EAD17 65 BYTE 065h :760EAD18 6D insd :760EAD19 65 BYTE 065h :760EAD1A 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EACF9(C) | :760EAD1B 7473 je 760EAD90 :760EAD1D 20696E and byte ptr [ecx+6E], ch :760EAD20 204861 and byte ptr [eax+61], cl :760EAD23 7368 jnb 760EAD8D :760EAD25 4C dec esp :760EAD26 6973742E009045 imul esi, dword ptr [ebx+74], 4590002E :760EAD2D 7272 jb 760EADA1 :760EAD2F 6F outsd :760EAD30 7220 jb 760EAD52 :760EAD32 637265 arpl dword ptr [edx+65], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAD13(C) | :760EAD35 61 popad :760EAD36 7469 je 760EADA1 :760EAD38 6E outsb :760EAD39 67205061 and [bx+si+61], dl :760EAD3D 7468 je 760EADA7 :760EAD3F 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EACD6(C) | :760EAD40 6C insb :760EAD41 65 BYTE 065h :760EAD42 6D insd :760EAD43 65 BYTE 065h :760EAD44 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EACCA(C) | :760EAD45 7400 je 760EAD47 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAD45(C) | :760EAD47 90 nop :760EAD48 43 inc ebx :760EAD49 56 push esi :760EAD4A 58 pop eax :760EAD4B 44 inc esp :760EAD4C 48 dec eax :760EAD4D 61 popad :760EAD4E 7368 jnb 760EADB8 :760EAD50 4C dec esp :760EAD51 6973743A3A4164 imul esi, dword ptr [ebx+74], 64413A3A :760EAD58 64 BYTE 064h :760EAD59 46 inc esi :760EAD5A 696C650090904572 imul ebp, dword ptr [ebp], 72459090 :760EAD62 726F jb 760EADD3 :760EAD64 7220 jb 760EAD86 :760EAD66 636F6E arpl dword ptr [edi+6E], ebp :760EAD69 7665 jbe 760EADD0 :760EAD6B 7274 jb 760EADE1 :760EAD6D 696E6720746F20 imul ebp, dword ptr [esi+67], 206F7420 :760EAD74 57 push edi :760EAD75 6964652063686172 imul esp, dword ptr [ebp+20], 72616863 :760EAD7D 206563 and byte ptr [ebp+63], ah :760EAD80 2D2564004E sub eax, 4E006425 :760EAD85 55 push ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAD64(C) | :760EAD86 4C dec esp :760EAD87 4C dec esp :760EAD88 207073 and byte ptr [eax+73], dh :760EAD8B 7A44 jpe 760EADD1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAD23(C) | :760EAD8D 61 popad :760EAD8E 7461 je 760EADF1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAD1B(C) | :760EAD90 207365 and byte ptr [ebx+65], dh :760EAD93 6E outsb :760EAD94 7420 je 760EADB6 :760EAD96 746F je 760EAE07 :760EAD98 204372 and byte ptr [ebx+72], al :760EAD9B 65 BYTE 065h :760EAD9C 61 popad :760EAD9D 7465 je 760EAE04 :760EAD9F 50 push eax :760EADA0 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EAD2D(C), :760EAD36(C) | :760EADA1 7468 je 760EAE0B :760EADA3 45 inc ebp :760EADA4 6C insb :760EADA5 65 BYTE 065h :760EADA6 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAD3D(C) | :760EADA7 004356 add byte ptr [ebx+56], al :760EADAA 58 pop eax :760EADAB 44 inc esp :760EADAC 48 dec eax :760EADAD 61 popad :760EADAE 7368 jnb 760EAE18 :760EADB0 4C dec esp :760EADB1 6973743A3A4372 imul esi, dword ptr [ebx+74], 72433A3A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAD4E(C) | :760EADB8 65 BYTE 065h :760EADB9 61 popad :760EADBA 7465 je 760EAE21 :760EADBC 50 push eax :760EADBD 61 popad :760EADBE 7468 je 760EAE28 :760EADC0 45 inc ebp :760EADC1 6C insb :760EADC2 65 BYTE 065h :760EADC3 6D insd :760EADC4 009090902564 add byte ptr [eax+64259090], dl :760EADCA 0A00 or al, byte ptr [eax] :760EADCC 45 inc ebp :760EADCD 7272 jb 760EAE41 :760EADCF 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAD69(C) | :760EADD0 7220 jb 760EADF2 :760EADD2 627569 bound esi, dword ptr [ebp+69] :760EADD5 6C insb :760EADD6 64696E6720706174 imul ebp, dword ptr fs:[esi+67], 74617020 :760EADDE 6820747265 push 65727420 :760EADE3 6520626C and byte ptr gs:[edx+6C], ah :760EADE7 6F outsd :760EADE8 6200 bound eax, dword ptr [eax] :760EADEA 90 nop :760EADEB 90 nop :760EADEC 43 inc ebx :760EADED 56 push esi :760EADEE 58 pop eax :760EADEF 44 inc esp :760EADF0 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAD8E(C) | :760EADF1 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EADD0(C) | :760EADF2 7468 je 760EAE5C :760EADF4 54 push esp :760EADF5 7265 jb 760EAE5C :760EADF7 653A3A cmp bh, byte ptr gs:[edx] :760EADFA 42 inc edx :760EADFB 7569 jne 760EAE66 :760EADFD 6C insb :760EADFE 64 BYTE 064h :760EADFF 54 push esp :760EAE00 7265 jb 760EAE67 :760EAE02 65004861 add byte ptr gs:[eax+61], cl :760EAE06 7368 jnb 760EAE70 :760EAE08 20626C and byte ptr [edx+6C], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EADA1(C) | :760EAE0B 6F outsd :760EAE0C 6220 bound esp, dword ptr [eax] :760EAE0E 746F je 760EAE7F :760EAE10 6F outsd :760EAE11 206269 and byte ptr [edx+69], ah :760EAE14 6720746F and [si+6F], dh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EADAE(C) | :760EAE18 206669 and byte ptr [esi+69], ah :760EAE1B 7420 je 760EAE3D :760EAE1D 696E206D656D6F imul ebp, dword ptr [esi+20], 6F6D656D :760EAE24 7279 jb 760EAE9F :760EAE26 2E004572 add byte ptr cs:[ebp+72], al :760EAE2A 726F jb 760EAE9B :760EAE2C 7220 jb 760EAE4E :760EAE2E 696E697469616C imul ebp, dword ptr [esi+69], 6C616974 :760EAE35 697A65696E6720 imul edi, dword ptr [edx+65], 20676E69 :760EAE3C 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAE1B(C) | :760EAE3D 206861 and byte ptr [eax+61], ch :760EAE40 7368 jnb 760EAEAA :760EAE42 6C insb :760EAE43 69737420626C6F imul esi, dword ptr [ebx+74], 6F6C6220 :760EAE4A 6200 bound eax, dword ptr [eax] :760EAE4C 4E dec esi :760EAE4D 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAE2C(C) | :760EAE4E 7420 je 760EAE70 :760EAE50 65 BYTE 065h :760EAE51 6E outsb :760EAE52 6F outsd :760EAE53 7567 jne 760EAEBC :760EAE55 6E outsb :760EAE56 206D65 and byte ptr [ebp+65], ch :760EAE59 6D insd :760EAE5A 6F outsd :760EAE5B 7279 jb 760EAED6 :760EAE5D 20746F20 and byte ptr [edi+2*ebp+20], dh :760EAE61 61 popad :760EAE62 6C insb :760EAE63 6C insb :760EAE64 6F outsd :760EAE65 636174 arpl dword ptr [ecx+74], esp :760EAE68 65207061 and byte ptr gs:[eax+61], dh :760EAE6C 7468 je 760EAED6 :760EAE6E 20656C and byte ptr [ebp+6C], ah :760EAE71 65 BYTE 065h :760EAE72 6D insd :760EAE73 65 BYTE 065h :760EAE74 6E outsb :760EAE75 742E je 760EAEA5 :760EAE77 004572 add byte ptr [ebp+72], al :760EAE7A 726F jb 760EAEEB :760EAE7C 7220 jb 760EAE9E :760EAE7E 637265 arpl dword ptr [edx+65], esi :760EAE81 61 popad :760EAE82 7469 je 760EAEED :760EAE84 6E outsb :760EAE85 67207061 and [bx+si+61], dh :760EAE89 7468 je 760EAEF3 :760EAE8B 20656C and byte ptr [ebp+6C], ah :760EAE8E 65 BYTE 065h :760EAE8F 6D insd :760EAE90 65 BYTE 065h :760EAE91 6E outsb :760EAE92 7400 je 760EAE94 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAE92(C) | :760EAE94 43 inc ebx :760EAE95 56 push esi :760EAE96 58 pop eax :760EAE97 44 inc esp :760EAE98 50 push eax :760EAE99 61 popad :760EAE9A 7468 je 760EAF04 :760EAE9C 54 push esp :760EAE9D 7265 jb 760EAF04 :760EAE9F 653A3A cmp bh, byte ptr gs:[edx] :760EAEA2 52 push edx :760EAEA3 65634275 arpl dword ptr gs:[edx+75], eax :760EAEA7 696C645472656500 imul ebp, dword ptr [esp+54], 00656572 :760EAEAF 90 nop :760EAEB0 E188 loopz 760EAE3A :760EAEB2 0F7690909090B8 pcmpeqd mm2, dword ptr [eax+B8909090] :760EAEB9 E00F loopnz 760EAECA :760EAEBB 7600 jbe 760EAEBD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAEBB(C) | :760EAEBD 00000000000000 BYTE 7 DUP(0) :760EAEC4 FFFFFFFF BYTE 4 DUP(0ffh) :760EAEC8 0000000000000000 BYTE 8 DUP(0) * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAF43(C) | :760EAED0 B8AE0E7600 mov eax, 00760EAE :760EAED5 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EAE5B(C), :760EAE6C(C) | :760EAED6 90 nop :760EAED7 90 nop :760EAED8 0000000000000000 BYTE 8 DUP(0) :760EAEE0 0100 add dword ptr [eax], eax :760EAEE2 0000 add byte ptr [eax], al :760EAEE4 D0AE0E760000 shr byte ptr [esi+0000760E], 1 :760EAEEA 00000000000000000000 BYTE 10 DUP(0) :760EAEF4 B8E00F76D8 mov eax, D8760FE0 :760EAEF9 AE scasb :760EAEFA 0E push cs :760EAEFB 7690 jbe 760EAE8D :760EAEFD 90 nop :760EAEFE 90 nop :760EAEFF 90 nop :760EAF00 10E1 adc cl, ah :760EAF02 0F7600 pcmpeqd mm0, dword ptr [eax] :760EAF05 00000000000000 BYTE 7 DUP(0) :760EAF0C FFFFFFFF BYTE 4 DUP(0ffh) :760EAF10 000000000000000000 BYTE 9 DUP(0) :760EAF19 AF scasd :760EAF1A 0E push cs :760EAF1B 7600 jbe 760EAF1D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAF1B(C) | :760EAF1D 90 nop :760EAF1E 90 nop :760EAF1F 90 nop :760EAF20 0000000000000000 BYTE 8 DUP(0) :760EAF28 0100 add dword ptr [eax], eax :760EAF2A 0000 add byte ptr [eax], al :760EAF2C 18AF0E760000 sbb byte ptr [edi+0000760E], ch :760EAF32 00000000000000000000 BYTE 10 DUP(0) :760EAF3C 10E1 adc cl, ah :760EAF3E 0F7620 pcmpeqd mm4, dword ptr [eax] :760EAF41 AF scasd :760EAF42 0E push cs :760EAF43 768B jbe 760EAED0 :760EAF45 C1C38B rol ebx, 8B :760EAF48 01C3 add ebx, eax * Referenced by a CALL at Address: |:760EB01D | Exported fn(): ?LockReadMode@CReadWriteLock@@QAEXXZ - Ord:000Ah :760EAF4A 53 push ebx * Reference To: KERNEL32.EnterCriticalSection, Ord:006Fh | :760EAF4B 8B1D40120E76 mov ebx, dword ptr [760E1240] :760EAF51 55 push ebp :760EAF52 56 push esi :760EAF53 8BF1 mov esi, ecx :760EAF55 57 push edi :760EAF56 8D7E1C lea edi, dword ptr [esi+1C] :760EAF59 57 push edi :760EAF5A FFD3 call ebx * Reference To: KERNEL32.LeaveCriticalSection, Ord:01DEh | :760EAF5C 8B2D3C120E76 mov ebp, dword ptr [760E123C] :760EAF62 57 push edi :760EAF63 FFD5 call ebp :760EAF65 8D7E04 lea edi, dword ptr [esi+04] :760EAF68 57 push edi :760EAF69 FFD3 call ebx :760EAF6B 837E3400 cmp dword ptr [esi+34], 00000000 :760EAF6F 750F jne 760EAF80 :760EAF71 8B06 mov eax, dword ptr [esi] :760EAF73 85C0 test eax, eax :760EAF75 7409 je 760EAF80 :760EAF77 6AFF push FFFFFFFF :760EAF79 50 push eax * Reference To: KERNEL32.WaitForSingleObject, Ord:02FDh | :760EAF7A FF1538120E76 Call dword ptr [760E1238] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EAF6F(C), :760EAF75(C) | :760EAF80 FF4634 inc [esi+34] :760EAF83 57 push edi :760EAF84 FFD5 call ebp :760EAF86 5F pop edi :760EAF87 5E pop esi :760EAF88 5D pop ebp :760EAF89 5B pop ebx :760EAF8A C3 ret Exported fn(): ?LockCSUnderRead@CReadWriteLock@@QAEXXZ - Ord:0009h :760EAF8B 83C104 add ecx, 00000004 :760EAF8E 51 push ecx * Reference To: KERNEL32.EnterCriticalSection, Ord:006Fh | :760EAF8F FF1540120E76 Call dword ptr [760E1240] :760EAF95 C3 ret Exported fn(): ?UnlockCSUnderRead@CReadWriteLock@@QAEXXZ - Ord:0014h :760EAF96 83C104 add ecx, 00000004 :760EAF99 51 push ecx * Reference To: KERNEL32.LeaveCriticalSection, Ord:01DEh | :760EAF9A FF153C120E76 Call dword ptr [760E123C] :760EAFA0 C3 ret Exported fn(): ?LockWriteMode@CReadWriteLock@@QAEXXZ - Ord:000Ch :760EAFA1 56 push esi :760EAFA2 8BF1 mov esi, ecx :760EAFA4 8D461C lea eax, dword ptr [esi+1C] :760EAFA7 50 push eax * Reference To: KERNEL32.EnterCriticalSection, Ord:006Fh | :760EAFA8 FF1540120E76 Call dword ptr [760E1240] :760EAFAE 8B36 mov esi, dword ptr [esi] :760EAFB0 85F6 test esi, esi :760EAFB2 7409 je 760EAFBD :760EAFB4 6AFF push FFFFFFFF :760EAFB6 56 push esi * Reference To: KERNEL32.WaitForSingleObject, Ord:02FDh | :760EAFB7 FF1538120E76 Call dword ptr [760E1238] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAFB2(C) | :760EAFBD 5E pop esi :760EAFBE C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E286F(C) | :760EAFBF 57 push edi * Reference To: KERNEL32.LeaveCriticalSection, Ord:01DEh | :760EAFC0 FF153C120E76 Call dword ptr [760E123C] :760EAFC6 83CBFF or ebx, FFFFFFFF :760EAFC9 E9A978FFFF jmp 760E2877 Exported fn(): ?UnlockWriteMode@CReadWriteLock@@QAEXXZ - Ord:0016h :760EAFCE 56 push esi :760EAFCF 8BF1 mov esi, ecx :760EAFD1 8B06 mov eax, dword ptr [esi] :760EAFD3 85C0 test eax, eax :760EAFD5 7407 je 760EAFDE :760EAFD7 50 push eax * Reference To: KERNEL32.SetEvent, Ord:0290h | :760EAFD8 FF15A4110E76 Call dword ptr [760E11A4] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EAFD5(C) | :760EAFDE 83C61C add esi, 0000001C :760EAFE1 56 push esi * Reference To: KERNEL32.LeaveCriticalSection, Ord:01DEh | :760EAFE2 FF153C120E76 Call dword ptr [760E123C] :760EAFE8 5E pop esi :760EAFE9 C3 ret Exported fn(): ??4CReadWriteLock@@QAEAAV0@ABV0@@Z - Ord:0006h :760EAFEA 56 push esi :760EAFEB 8B742408 mov esi, dword ptr [esp+08] :760EAFEF 57 push edi :760EAFF0 8BC1 mov eax, ecx :760EAFF2 6A0E push 0000000E :760EAFF4 8BF8 mov edi, eax :760EAFF6 59 pop ecx :760EAFF7 F3 repz :760EAFF8 A5 movsd :760EAFF9 5F pop edi :760EAFFA 5E pop esi :760EAFFB C20400 ret 0004 Exported fn(): ??0CScopeRWLock@@QAE@PAVCReadWriteLock@@W4RWLOCK_MODE@@@Z - Ord:0003h :760EAFFE 8B442408 mov eax, dword ptr [esp+08] :760EB002 56 push esi :760EB003 8BF1 mov esi, ecx :760EB005 57 push edi :760EB006 8B7C240C mov edi, dword ptr [esp+0C] :760EB00A 83660400 and dword ptr [esi+04], 00000000 :760EB00E 893E mov dword ptr [esi], edi :760EB010 85FF test edi, edi :760EB012 894608 mov dword ptr [esi+08], eax :760EB015 742B je 760EB042 :760EB017 85C0 test eax, eax :760EB019 7509 jne 760EB024 :760EB01B 8BCF mov ecx, edi * Reference To: SfpDll.?LockReadMode@CReadWriteLock@@QAEXXZ | :760EB01D E828FFFFFF call 760EAF4A :760EB022 EB1E jmp 760EB042 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB019(C) | :760EB024 83F801 cmp eax, 00000001 :760EB027 7519 jne 760EB042 :760EB029 8D471C lea eax, dword ptr [edi+1C] :760EB02C 50 push eax * Reference To: KERNEL32.EnterCriticalSection, Ord:006Fh | :760EB02D FF1540120E76 Call dword ptr [760E1240] :760EB033 8B3F mov edi, dword ptr [edi] :760EB035 85FF test edi, edi :760EB037 7409 je 760EB042 :760EB039 6AFF push FFFFFFFF :760EB03B 57 push edi * Reference To: KERNEL32.WaitForSingleObject, Ord:02FDh | :760EB03C FF1538120E76 Call dword ptr [760E1238] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB015(C), :760EB022(U), :760EB027(C), :760EB037(C) | :760EB042 8BC6 mov eax, esi :760EB044 5F pop edi :760EB045 5E pop esi :760EB046 C20800 ret 0008 Exported fn(): ??0CScopeRWLock@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z - Ord:0002h :760EB049 8B442404 mov eax, dword ptr [esp+04] :760EB04D 56 push esi :760EB04E 8BF1 mov esi, ecx :760EB050 832600 and dword ptr [esi], 00000000 :760EB053 894604 mov dword ptr [esi+04], eax :760EB056 85C0 test eax, eax :760EB058 7407 je 760EB061 :760EB05A 50 push eax * Reference To: KERNEL32.EnterCriticalSection, Ord:006Fh | :760EB05B FF1540120E76 Call dword ptr [760E1240] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB058(C) | :760EB061 8BC6 mov eax, esi :760EB063 5E pop esi :760EB064 C20400 ret 0004 Exported fn(): ??1CScopeRWLock@@QAE@XZ - Ord:0005h :760EB067 53 push ebx :760EB068 56 push esi * Reference To: KERNEL32.LeaveCriticalSection, Ord:01DEh | :760EB069 8B1D3C120E76 mov ebx, dword ptr [760E123C] :760EB06F 57 push edi :760EB070 8BF9 mov edi, ecx :760EB072 8B37 mov esi, dword ptr [edi] :760EB074 85F6 test esi, esi :760EB076 7428 je 760EB0A0 :760EB078 8B4708 mov eax, dword ptr [edi+08] :760EB07B 85C0 test eax, eax :760EB07D 7509 jne 760EB088 :760EB07F 8BCE mov ecx, esi * Reference To: SfpDll.?UnlockReadMode@CReadWriteLock@@QAEXXZ | :760EB081 E88A72FFFF call 760E2310 :760EB086 EB18 jmp 760EB0A0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB07D(C) | :760EB088 83F801 cmp eax, 00000001 :760EB08B 7513 jne 760EB0A0 :760EB08D 8B06 mov eax, dword ptr [esi] :760EB08F 85C0 test eax, eax :760EB091 7407 je 760EB09A :760EB093 50 push eax * Reference To: KERNEL32.SetEvent, Ord:0290h | :760EB094 FF15A4110E76 Call dword ptr [760E11A4] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB091(C) | :760EB09A 83C61C add esi, 0000001C :760EB09D 56 push esi :760EB09E FFD3 call ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB076(C), :760EB086(U), :760EB08B(C) | :760EB0A0 8B7F04 mov edi, dword ptr [edi+04] :760EB0A3 85FF test edi, edi :760EB0A5 7403 je 760EB0AA :760EB0A7 57 push edi :760EB0A8 FFD3 call ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB0A5(C) | :760EB0AA 5F pop edi :760EB0AB 5E pop esi :760EB0AC 5B pop ebx :760EB0AD C3 ret Exported fn(): ??4CScopeRWLock@@QAEAAV0@ABV0@@Z - Ord:0007h :760EB0AE 56 push esi :760EB0AF 8B742408 mov esi, dword ptr [esp+08] :760EB0B3 8BC1 mov eax, ecx :760EB0B5 57 push edi :760EB0B6 8BF8 mov edi, eax :760EB0B8 A5 movsd :760EB0B9 A5 movsd :760EB0BA A5 movsd :760EB0BB 5F pop edi :760EB0BC 5E pop esi :760EB0BD C20400 ret 0004 * Referenced by a CALL at Addresses: |:760EB39E , :760EB3B9 , :760EB3FB , :760EE171 | :760EB0C0 8B442408 mov eax, dword ptr [esp+08] :760EB0C4 8BC8 mov ecx, eax :760EB0C6 C1F91F sar ecx, 1F :760EB0C9 8B4C2404 mov ecx, dword ptr [esp+04] :760EB0CD 0FB7D1 movzx edx, cx :760EB0D0 C1E910 shr ecx, 10 :760EB0D3 52 push edx :760EB0D4 51 push ecx :760EB0D5 0FB7C8 movzx ecx, ax :760EB0D8 C1E810 shr eax, 10 :760EB0DB 51 push ecx :760EB0DC 50 push eax * Possible StringData Ref from Code Obj ->"%d.%d.%d.%d" | :760EB0DD 689C610E76 push 760E619C :760EB0E2 FF742420 push [esp+20] * Reference To: USER32.wsprintfA, Ord:02B3h | :760EB0E6 FF15A4120E76 Call dword ptr [760E12A4] :760EB0EC 8B442424 mov eax, dword ptr [esp+24] :760EB0F0 83C418 add esp, 00000018 :760EB0F3 C20C00 ret 000C * Referenced by a CALL at Addresses: |:760EB7F1 , :760EC725 , :760F0753 | :760EB0F6 55 push ebp :760EB0F7 8BEC mov ebp, esp :760EB0F9 81EC10060000 sub esp, 00000610 :760EB0FF 53 push ebx :760EB100 56 push esi :760EB101 8D45F8 lea eax, dword ptr [ebp-08] :760EB104 57 push edi :760EB105 50 push eax :760EB106 C745F401000000 mov [ebp-0C], 00000001 :760EB10D FF750C push [ebp+0C] :760EB110 E806710000 call 760F221B * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EB115 8B3580110E76 mov esi, dword ptr [760E1180] :760EB11B 8945F0 mov dword ptr [ebp-10], eax :760EB11E 85C0 test eax, eax * Possible StringData Ref from Code Obj ->"IsNewFileValid" | :760EB120 BB74630E76 mov ebx, 760E6374 :760EB125 BF7CDA0F76 mov edi, 760FDA7C :760EB12A 7433 je 760EB15F :760EB12C A184110E76 mov eax, dword ptr [760E1184] :760EB131 F60004 test byte ptr [eax], 04 :760EB134 7421 je 760EB157 :760EB136 6A04 push 00000004 :760EB138 53 push ebx :760EB139 6A5F push 0000005F :760EB13B 57 push edi :760EB13C FFD6 call esi :760EB13E 85C0 test eax, eax :760EB140 7415 je 760EB157 :760EB142 FF75F0 push [ebp-10] * Possible StringData Ref from Code Obj ->"Error %d in getting version from " ->"file on disk" | :760EB145 6844630E76 push 760E6344 :760EB14A 6806030000 push 00000306 :760EB14F E8D71D0000 call 760ECF2B :760EB154 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB134(C), :760EB140(C) | :760EB157 8365F800 and dword ptr [ebp-08], 00000000 :760EB15B 8365FC00 and dword ptr [ebp-04], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB12A(C) | :760EB15F 8D45E0 lea eax, dword ptr [ebp-20] :760EB162 50 push eax :760EB163 FF7508 push [ebp+08] * Reference To: SfpDll.SfpGetCorrectVersionOfFile | :760EB166 E8AC2C0000 call 760EDE17 :760EB16B 85C0 test eax, eax :760EB16D 7434 je 760EB1A3 :760EB16F A184110E76 mov eax, dword ptr [760E1184] :760EB174 F60004 test byte ptr [eax], 04 :760EB177 7421 je 760EB19A :760EB179 6A04 push 00000004 :760EB17B 53 push ebx :760EB17C 6A71 push 00000071 :760EB17E 57 push edi :760EB17F FFD6 call esi :760EB181 85C0 test eax, eax :760EB183 7415 je 760EB19A :760EB185 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Db has no catalog entry for %s" | :760EB188 6824630E76 push 760E6324 :760EB18D 6806030000 push 00000306 :760EB192 E8941D0000 call 760ECF2B :760EB197 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB177(C), :760EB183(C) | :760EB19A 8365F400 and dword ptr [ebp-0C], 00000000 :760EB19E E99C020000 jmp 760EB43F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB16D(C) | :760EB1A3 FF750C push [ebp+0C] :760EB1A6 E8ED210000 call 760ED398 :760EB1AB 8B4DF8 mov ecx, dword ptr [ebp-08] :760EB1AE 8BD0 mov edx, eax :760EB1B0 3B4DE0 cmp ecx, dword ptr [ebp-20] :760EB1B3 89550C mov dword ptr [ebp+0C], edx :760EB1B6 7540 jne 760EB1F8 :760EB1B8 8B45FC mov eax, dword ptr [ebp-04] :760EB1BB 3B45E4 cmp eax, dword ptr [ebp-1C] :760EB1BE 7538 jne 760EB1F8 :760EB1C0 85D2 test edx, edx :760EB1C2 7534 jne 760EB1F8 :760EB1C4 A184110E76 mov eax, dword ptr [760E1184] :760EB1C9 F60004 test byte ptr [eax], 04 :760EB1CC 0F846D020000 je 760EB43F :760EB1D2 6A04 push 00000004 :760EB1D4 53 push ebx :760EB1D5 6A7D push 0000007D :760EB1D7 57 push edi :760EB1D8 FFD6 call esi :760EB1DA 85C0 test eax, eax :760EB1DC 0F845D020000 je 760EB43F * Possible StringData Ref from Code Obj ->"File copied is valid" | :760EB1E2 680C630E76 push 760E630C :760EB1E7 6806030000 push 00000306 :760EB1EC E83A1D0000 call 760ECF2B :760EB1F1 59 pop ecx :760EB1F2 59 pop ecx :760EB1F3 E947020000 jmp 760EB43F * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB1B6(C), :760EB1BE(C), :760EB1C2(C) | :760EB1F8 8B4518 mov eax, dword ptr [ebp+18] :760EB1FB 8365F400 and dword ptr [ebp-0C], 00000000 :760EB1FF 85C0 test eax, eax :760EB201 7402 je 760EB205 :760EB203 8910 mov dword ptr [eax], edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB201(C) | :760EB205 8B4514 mov eax, dword ptr [ebp+14] :760EB208 85C0 test eax, eax :760EB20A 7408 je 760EB214 :760EB20C 8B55FC mov edx, dword ptr [ebp-04] :760EB20F 8908 mov dword ptr [eax], ecx :760EB211 895004 mov dword ptr [eax+04], edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB20A(C) | :760EB214 837D1001 cmp dword ptr [ebp+10], 00000001 :760EB218 0F8590010000 jne 760EB3AE :760EB21E 837D0C00 cmp dword ptr [ebp+0C], 00000000 :760EB222 0F856B010000 jne 760EB393 :760EB228 FF7508 push [ebp+08] :760EB22B E868210000 call 760ED398 :760EB230 85C0 test eax, eax :760EB232 0F85E7000000 jne 760EB31F :760EB238 8D45E8 lea eax, dword ptr [ebp-18] :760EB23B 50 push eax :760EB23C FF7508 push [ebp+08] :760EB23F E8D76F0000 call 760F221B :760EB244 85C0 test eax, eax :760EB246 8945F0 mov dword ptr [ebp-10], eax :760EB249 7436 je 760EB281 :760EB24B A184110E76 mov eax, dword ptr [760E1184] :760EB250 F60004 test byte ptr [eax], 04 :760EB253 7424 je 760EB279 :760EB255 6A04 push 00000004 :760EB257 53 push ebx :760EB258 68A1000000 push 000000A1 :760EB25D 57 push edi :760EB25E FFD6 call esi :760EB260 85C0 test eax, eax :760EB262 7415 je 760EB279 :760EB264 FF75F0 push [ebp-10] * Possible StringData Ref from Code Obj ->"Error %d in getting version fromfile " ->"on disk" | :760EB267 68DC620E76 push 760E62DC :760EB26C 6806030000 push 00000306 :760EB271 E8B51C0000 call 760ECF2B :760EB276 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB253(C), :760EB262(C) | :760EB279 8365E800 and dword ptr [ebp-18], 00000000 :760EB27D 8365EC00 and dword ptr [ebp-14], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB249(C) | :760EB281 8B45FC mov eax, dword ptr [ebp-04] :760EB284 8B4DF8 mov ecx, dword ptr [ebp-08] :760EB287 3B45EC cmp eax, dword ptr [ebp-14] :760EB28A 0F8C03010000 jl 760EB393 :760EB290 7F09 jg 760EB29B :760EB292 3B4DE8 cmp ecx, dword ptr [ebp-18] :760EB295 0F86F8000000 jbe 760EB393 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB290(C) | :760EB29B 50 push eax :760EB29C 51 push ecx :760EB29D FF7508 push [ebp+08] :760EB2A0 E8ED350000 call 760EE892 :760EB2A5 83F801 cmp eax, 00000001 :760EB2A8 0F85E2000000 jne 760EB390 :760EB2AE A184110E76 mov eax, dword ptr [760E1184] :760EB2B3 F60004 test byte ptr [eax], 04 :760EB2B6 7424 je 760EB2DC :760EB2B8 6A04 push 00000004 :760EB2BA 53 push ebx :760EB2BB 68A8000000 push 000000A8 :760EB2C0 57 push edi :760EB2C1 FFD6 call esi :760EB2C3 85C0 test eax, eax :760EB2C5 7415 je 760EB2DC :760EB2C7 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"File being replaced is valid" | :760EB2CA 68BC620E76 push 760E62BC :760EB2CF 6806030000 push 00000306 :760EB2D4 E8521C0000 call 760ECF2B :760EB2D9 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB2B6(C), :760EB2C5(C) | :760EB2DC A184110E76 mov eax, dword ptr [760E1184] :760EB2E1 F60004 test byte ptr [eax], 04 :760EB2E4 742D je 760EB313 :760EB2E6 6A04 push 00000004 :760EB2E8 53 push ebx :760EB2E9 68AA000000 push 000000AA :760EB2EE 57 push edi :760EB2EF FFD6 call esi :760EB2F1 85C0 test eax, eax :760EB2F3 741E je 760EB313 :760EB2F5 FF75EC push [ebp-14] :760EB2F8 FF75E8 push [ebp-18] :760EB2FB FF75FC push [ebp-04] :760EB2FE FF75F8 push [ebp-08] * Possible StringData Ref from Code Obj ->"New file version is %I64x. SFP " ->"file version is replaced is %I64x" | :760EB301 6878620E76 push 760E6278 :760EB306 6806030000 push 00000306 :760EB30B E81B1C0000 call 760ECF2B :760EB310 83C418 add esp, 00000018 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB2E4(C), :760EB2F3(C), :760EB368(C), :760EB377(C), :760EB38E(U) | :760EB313 C745F401000000 mov [ebp-0C], 00000001 :760EB31A E920010000 jmp 760EB43F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB232(C) | :760EB31F A184110E76 mov eax, dword ptr [760E1184] :760EB324 F60004 test byte ptr [eax], 04 :760EB327 7424 je 760EB34D :760EB329 6A04 push 00000004 :760EB32B 53 push ebx :760EB32C 68B3000000 push 000000B3 :760EB331 57 push edi :760EB332 FFD6 call esi :760EB334 85C0 test eax, eax :760EB336 7415 je 760EB34D :760EB338 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Current file hash for %s is invalid" | :760EB33B 6854620E76 push 760E6254 :760EB340 6806030000 push 00000306 :760EB345 E8E11B0000 call 760ECF2B :760EB34A 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB327(C), :760EB336(C) | :760EB34D FF75FC push [ebp-04] :760EB350 FF75F8 push [ebp-08] :760EB353 FF7508 push [ebp+08] :760EB356 E837350000 call 760EE892 :760EB35B 83F801 cmp eax, 00000001 :760EB35E 7530 jne 760EB390 :760EB360 A184110E76 mov eax, dword ptr [760E1184] :760EB365 F60004 test byte ptr [eax], 04 :760EB368 74A9 je 760EB313 :760EB36A 6A04 push 00000004 :760EB36C 53 push ebx :760EB36D 68B7000000 push 000000B7 :760EB372 57 push edi :760EB373 FFD6 call esi :760EB375 85C0 test eax, eax :760EB377 749A je 760EB313 :760EB379 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"File being replaced is valid" | :760EB37C 68BC620E76 push 760E62BC :760EB381 6806030000 push 00000306 :760EB386 E8A01B0000 call 760ECF2B :760EB38B 83C40C add esp, 0000000C :760EB38E EB83 jmp 760EB313 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB2A8(C), :760EB35E(C) | :760EB390 8B4DF8 mov ecx, dword ptr [ebp-08] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB222(C), :760EB28A(C), :760EB295(C) | :760EB393 8D85DCFEFFFF lea eax, dword ptr [ebp+FFFFFEDC] :760EB399 50 push eax :760EB39A FF75FC push [ebp-04] :760EB39D 51 push ecx :760EB39E E81DFDFFFF call 760EB0C0 :760EB3A3 50 push eax :760EB3A4 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Invalid entry for file %s, version " ->"%s made in wininit.ini. " | :760EB3A7 6818620E76 push 760E6218 :760EB3AC EB19 jmp 760EB3C7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB218(C) | :760EB3AE 8D85DCFEFFFF lea eax, dword ptr [ebp+FFFFFEDC] :760EB3B4 50 push eax :760EB3B5 FF75FC push [ebp-04] :760EB3B8 51 push ecx :760EB3B9 E802FDFFFF call 760EB0C0 :760EB3BE 50 push eax :760EB3BF FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Invalid file %s, version %s copied. " | :760EB3C2 68F0610E76 push 760E61F0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB3AC(U) | :760EB3C7 8D85F0F9FFFF lea eax, dword ptr [ebp+FFFFF9F0] :760EB3CD 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EB3CE FF1530100E76 Call dword ptr [760E1030] :760EB3D4 8B45F8 mov eax, dword ptr [ebp-08] :760EB3D7 83C410 add esp, 00000010 :760EB3DA 3B45E0 cmp eax, dword ptr [ebp-20] :760EB3DD 750F jne 760EB3EE :760EB3DF 8B45FC mov eax, dword ptr [ebp-04] :760EB3E2 3B45E4 cmp eax, dword ptr [ebp-1C] :760EB3E5 7507 jne 760EB3EE * Possible StringData Ref from Code Obj ->"New file has correct version but " ->"invalid hash" | :760EB3E7 68C0610E76 push 760E61C0 :760EB3EC EB2F jmp 760EB41D * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB3DD(C), :760EB3E5(C) | :760EB3EE 8D85DCFEFFFF lea eax, dword ptr [ebp+FFFFFEDC] :760EB3F4 50 push eax :760EB3F5 FF75E4 push [ebp-1C] :760EB3F8 FF75E0 push [ebp-20] :760EB3FB E8C0FCFFFF call 760EB0C0 :760EB400 50 push eax :760EB401 8D85D8FDFFFF lea eax, dword ptr [ebp+FFFFFDD8] * Possible StringData Ref from Code Obj ->"Correct version is %s" | :760EB407 68A8610E76 push 760E61A8 :760EB40C 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EB40D FF1530100E76 Call dword ptr [760E1030] :760EB413 83C40C add esp, 0000000C :760EB416 8D85D8FDFFFF lea eax, dword ptr [ebp+FFFFFDD8] :760EB41C 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB3EC(U) | :760EB41D 8D85F0F9FFFF lea eax, dword ptr [ebp+FFFFF9F0] :760EB423 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760EB424 FF1598110E76 Call dword ptr [760E1198] :760EB42A 8D85F0F9FFFF lea eax, dword ptr [ebp+FFFFF9F0] :760EB430 6A00 push 00000000 :760EB432 50 push eax :760EB433 6A03 push 00000003 :760EB435 B918D30F76 mov ecx, 760FD318 :760EB43A E8716FFFFF call 760E23B0 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB19E(U), :760EB1CC(C), :760EB1DC(C), :760EB1F3(U), :760EB31A(U) | :760EB43F 8B45F4 mov eax, dword ptr [ebp-0C] :760EB442 5F pop edi :760EB443 5E pop esi :760EB444 5B pop ebx :760EB445 C9 leave :760EB446 C21400 ret 0014 * Referenced by a CALL at Address: |:760EB7D2 | :760EB449 51 push ecx :760EB44A 53 push ebx :760EB44B 55 push ebp :760EB44C 8364240800 and dword ptr [esp+08], 00000000 :760EB451 56 push esi :760EB452 8B742414 mov esi, dword ptr [esp+14] :760EB456 57 push edi :760EB457 6A01 push 00000001 :760EB459 5F pop edi :760EB45A 56 push esi * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760EB45B FF1554120E76 Call dword ptr [760E1254] :760EB461 3BC7 cmp eax, edi :760EB463 89442418 mov dword ptr [esp+18], eax :760EB467 7666 jbe 760EB4CF * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EB469 8B1D80110E76 mov ebx, dword ptr [760E1180] :760EB46F BD7CDA0F76 mov ebp, 760FDA7C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB4CD(C) | :760EB474 803C375C cmp byte ptr [edi+esi], 5C :760EB478 754E jne 760EB4C8 :760EB47A 80243700 and byte ptr [edi+esi], 00 :760EB47E 56 push esi :760EB47F E82868FFFF call 760E1CAC :760EB484 85C0 test eax, eax :760EB486 753C jne 760EB4C4 :760EB488 50 push eax :760EB489 56 push esi * Reference To: KERNEL32.CreateDirectoryA, Ord:0030h | :760EB48A FF1550120E76 Call dword ptr [760E1250] :760EB490 85C0 test eax, eax :760EB492 744F je 760EB4E3 :760EB494 A184110E76 mov eax, dword ptr [760E1184] :760EB499 F60004 test byte ptr [eax], 04 :760EB49C 7426 je 760EB4C4 :760EB49E 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CreateBaseDirectory" | :760EB4A0 68C0630E76 push 760E63C0 :760EB4A5 6807010000 push 00000107 :760EB4AA 55 push ebp :760EB4AB FFD3 call ebx :760EB4AD 85C0 test eax, eax :760EB4AF 7413 je 760EB4C4 :760EB4B1 56 push esi * Possible StringData Ref from Code Obj ->"Created directory %s" | :760EB4B2 68A8630E76 push 760E63A8 :760EB4B7 6806030000 push 00000306 :760EB4BC E86A1A0000 call 760ECF2B :760EB4C1 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB486(C), :760EB49C(C), :760EB4AF(C) | :760EB4C4 C604375C mov byte ptr [edi+esi], 5C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB478(C) | :760EB4C8 47 inc edi :760EB4C9 3B7C2418 cmp edi, dword ptr [esp+18] :760EB4CD 72A5 jb 760EB474 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB467(C) | :760EB4CF C744241001000000 mov [esp+10], 00000001 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB525(U) | :760EB4D7 8B442410 mov eax, dword ptr [esp+10] :760EB4DB 5F pop edi :760EB4DC 5E pop esi :760EB4DD 5D pop ebp :760EB4DE 5B pop ebx :760EB4DF 59 pop ecx :760EB4E0 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB492(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EB4E3 FF15A0110E76 Call dword ptr [760E11A0] :760EB4E9 89442418 mov dword ptr [esp+18], eax :760EB4ED A184110E76 mov eax, dword ptr [760E1184] :760EB4F2 F60002 test byte ptr [eax], 02 :760EB4F5 742A je 760EB521 :760EB4F7 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CreateBaseDirectory" | :760EB4F9 68C0630E76 push 760E63C0 :760EB4FE 6802010000 push 00000102 :760EB503 55 push ebp :760EB504 FFD3 call ebx :760EB506 85C0 test eax, eax :760EB508 7417 je 760EB521 :760EB50A FF742418 push [esp+18] :760EB50E 56 push esi * Possible StringData Ref from Code Obj ->"Could not create directory %s " ->"ec=%d" | :760EB50F 6884630E76 push 760E6384 :760EB514 6806030000 push 00000306 :760EB519 E80D1A0000 call 760ECF2B :760EB51E 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB4F5(C), :760EB508(C) | :760EB521 C604375C mov byte ptr [edi+esi], 5C :760EB525 EBB0 jmp 760EB4D7 Exported fn(): SFPProcessFileChanges - Ord:0011h :760EB527 81ECF8030000 sub esp, 000003F8 :760EB52D 55 push ebp :760EB52E 33ED xor ebp, ebp :760EB530 392DA4DA0F76 cmp dword ptr [760FDAA4], ebp :760EB536 7543 jne 760EB57B :760EB538 A184110E76 mov eax, dword ptr [760E1184] :760EB53D F60004 test byte ptr [eax], 04 :760EB540 0F84EF020000 je 760EB835 :760EB546 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SFPProcessFileChanges" | :760EB548 68C8640E76 push 760E64C8 :760EB54D 6840010000 push 00000140 :760EB552 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EB557 FF1580110E76 Call dword ptr [760E1180] :760EB55D 85C0 test eax, eax :760EB55F 0F84D0020000 je 760EB835 * Possible StringData Ref from Code Obj ->"Not enabled. Exiting" | :760EB565 68B0640E76 push 760E64B0 :760EB56A 6806030000 push 00000306 :760EB56F E8B7190000 call 760ECF2B :760EB574 59 pop ecx :760EB575 59 pop ecx :760EB576 E9BA020000 jmp 760EB835 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB536(C) | :760EB57B A1D0D80F76 mov eax, dword ptr [760FD8D0] :760EB580 56 push esi * Reference To: KERNEL32.OpenEventA, Ord:0208h | :760EB581 8B355C120E76 mov esi, dword ptr [760E125C] :760EB587 57 push edi :760EB588 3BC5 cmp eax, ebp :760EB58A BF03001F00 mov edi, 001F0003 :760EB58F 7563 jne 760EB5F4 :760EB591 FF35BCDE0F76 push dword ptr [760FDEBC] :760EB597 55 push ebp :760EB598 57 push edi :760EB599 FFD6 call esi :760EB59B 3BC5 cmp eax, ebp :760EB59D 8944240C mov dword ptr [esp+0C], eax :760EB5A1 7557 jne 760EB5FA :760EB5A3 A184110E76 mov eax, dword ptr [760E1184] :760EB5A8 F60002 test byte ptr [eax], 02 :760EB5AB 0F846B020000 je 760EB81C :760EB5B1 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SFPProcessFileChanges" | :760EB5B3 68C8640E76 push 760E64C8 :760EB5B8 684A010000 push 0000014A :760EB5BD 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EB5C2 FF1580110E76 Call dword ptr [760E1180] :760EB5C8 85C0 test eax, eax :760EB5CA 0F844C020000 je 760EB81C * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EB5D0 FF15A0110E76 Call dword ptr [760E11A0] :760EB5D6 50 push eax :760EB5D7 FF35BCDE0F76 push dword ptr [760FDEBC] * Possible StringData Ref from Code Obj ->"Cannot open event %s, error 0x%x" | :760EB5DD 688C640E76 push 760E648C :760EB5E2 6806030000 push 00000306 :760EB5E7 E83F190000 call 760ECF2B :760EB5EC 83C410 add esp, 00000010 :760EB5EF E928020000 jmp 760EB81C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB58F(C) | :760EB5F4 8944240C mov dword ptr [esp+0C], eax :760EB5F8 EB05 jmp 760EB5FF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB5A1(C) | :760EB5FA A1D0D80F76 mov eax, dword ptr [760FD8D0] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB5F8(U) | :760EB5FF 68C0D40100 push 0001D4C0 :760EB604 50 push eax * Reference To: KERNEL32.WaitForSingleObject, Ord:02FDh | :760EB605 FF1538120E76 Call dword ptr [760E1238] :760EB60B 85C0 test eax, eax :760EB60D 7443 je 760EB652 :760EB60F A184110E76 mov eax, dword ptr [760E1184] :760EB614 F60001 test byte ptr [eax], 01 :760EB617 0F84FF010000 je 760EB81C :760EB61D 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"SFPProcessFileChanges" | :760EB61F 68C8640E76 push 760E64C8 :760EB624 6856010000 push 00000156 :760EB629 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EB62E FF1580110E76 Call dword ptr [760E1180] :760EB634 85C0 test eax, eax :760EB636 0F84E0010000 je 760EB81C * Possible StringData Ref from Code Obj ->"SFP has not been initted - timing " ->"out" | :760EB63C 6864640E76 push 760E6464 :760EB641 6806030000 push 00000306 :760EB646 E8E0180000 call 760ECF2B :760EB64B 59 pop ecx :760EB64C 59 pop ecx :760EB64D E9CA010000 jmp 760EB81C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB60D(C) | :760EB652 392D84E10F76 cmp dword ptr [760FE184], ebp * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EB658 8B2D80110E76 mov ebp, dword ptr [760E1180] :760EB65E 53 push ebx :760EB65F BB7CDA0F76 mov ebx, 760FDA7C :760EB664 754D jne 760EB6B3 :760EB666 FF35B8DE0F76 push dword ptr [760FDEB8] :760EB66C 6A00 push 00000000 :760EB66E 57 push edi :760EB66F FFD6 call esi :760EB671 85C0 test eax, eax :760EB673 A384E10F76 mov dword ptr [760FE184], eax :760EB678 7539 jne 760EB6B3 :760EB67A A184110E76 mov eax, dword ptr [760E1184] :760EB67F F60002 test byte ptr [eax], 02 :760EB682 742F je 760EB6B3 :760EB684 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SFPProcessFileChanges" | :760EB686 68C8640E76 push 760E64C8 :760EB68B 6861010000 push 00000161 :760EB690 53 push ebx :760EB691 FFD5 call ebp :760EB693 85C0 test eax, eax :760EB695 741C je 760EB6B3 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EB697 FF15A0110E76 Call dword ptr [760E11A0] :760EB69D 50 push eax :760EB69E FF35B8DE0F76 push dword ptr [760FDEB8] * Possible StringData Ref from Code Obj ->"OpenEvent failed for: %s; error=%ld" | :760EB6A4 6840640E76 push 760E6440 :760EB6A9 6A00 push 00000000 :760EB6AB E87B180000 call 760ECF2B :760EB6B0 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB664(C), :760EB678(C), :760EB682(C), :760EB695(C) | :760EB6B3 8BB4240C040000 mov esi, dword ptr [esp+0000040C] :760EB6BA 833E00 cmp dword ptr [esi], 00000000 :760EB6BD 0F8458010000 je 760EB81B :760EB6C3 8BFE mov edi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB815(C) | :760EB6C5 A184110E76 mov eax, dword ptr [760E1184] :760EB6CA F60004 test byte ptr [eax], 04 :760EB6CD 742B je 760EB6FA :760EB6CF 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SFPProcessFileChanges" | :760EB6D1 68C8640E76 push 760E64C8 :760EB6D6 686B010000 push 0000016B :760EB6DB 53 push ebx :760EB6DC FFD5 call ebp :760EB6DE 85C0 test eax, eax :760EB6E0 7418 je 760EB6FA :760EB6E2 8B06 mov eax, dword ptr [esi] :760EB6E4 8BFE mov edi, esi :760EB6E6 FF30 push dword ptr [eax] * Possible StringData Ref from Code Obj ->"SFP notification that file %s " ->"changed" | :760EB6E8 6818640E76 push 760E6418 :760EB6ED 6806030000 push 00000306 :760EB6F2 E834180000 call 760ECF2B :760EB6F7 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB6CD(C), :760EB6E0(C) | :760EB6FA 8B07 mov eax, dword ptr [edi] :760EB6FC FF30 push dword ptr [eax] * Reference To: SfpDll.SfpIsFileProtectedS | :760EB6FE E84366FFFF call 760E1D46 :760EB703 85C0 test eax, eax :760EB705 7440 je 760EB747 :760EB707 A184110E76 mov eax, dword ptr [760E1184] :760EB70C F60004 test byte ptr [eax], 04 :760EB70F 0F84F8000000 je 760EB80D :760EB715 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SFPProcessFileChanges" | :760EB717 68C8640E76 push 760E64C8 :760EB71C 6880010000 push 00000180 :760EB721 53 push ebx :760EB722 FFD5 call ebp :760EB724 85C0 test eax, eax :760EB726 0F84E1000000 je 760EB80D :760EB72C 8B06 mov eax, dword ptr [esi] :760EB72E FF30 push dword ptr [eax] * Possible StringData Ref from Code Obj ->"%s is not protected" | :760EB730 6804640E76 push 760E6404 :760EB735 6806030000 push 00000306 :760EB73A E8EC170000 call 760ECF2B :760EB73F 83C40C add esp, 0000000C :760EB742 E9C6000000 jmp 760EB80D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB705(C) | :760EB747 8B06 mov eax, dword ptr [esi] :760EB749 FF30 push dword ptr [eax] :760EB74B 68B0DA0F76 push 760FDAB0 * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760EB750 FF1558120E76 Call dword ptr [760E1258] :760EB756 85C0 test eax, eax :760EB758 750A jne 760EB764 :760EB75A E8075F0000 call 760F1666 :760EB75F E9A9000000 jmp 760EB80D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB758(C) | :760EB764 8B06 mov eax, dword ptr [esi] :760EB766 FF30 push dword ptr [eax] :760EB768 E8CE80FFFF call 760E383B :760EB76D 85C0 test eax, eax :760EB76F 756E jne 760EB7DF :760EB771 A184110E76 mov eax, dword ptr [760E1184] :760EB776 F60004 test byte ptr [eax], 04 :760EB779 7429 je 760EB7A4 :760EB77B 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SFPProcessFileChanges" | :760EB77D 68C8640E76 push 760E64C8 :760EB782 688F010000 push 0000018F :760EB787 53 push ebx :760EB788 FFD5 call ebp :760EB78A 85C0 test eax, eax :760EB78C 7416 je 760EB7A4 :760EB78E 8B06 mov eax, dword ptr [esi] :760EB790 FF30 push dword ptr [eax] * Possible StringData Ref from Code Obj ->"%s has been deleted" | :760EB792 68F0630E76 push 760E63F0 :760EB797 6806030000 push 00000306 :760EB79C E88A170000 call 760ECF2B :760EB7A1 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB779(C), :760EB78C(C) | :760EB7A4 8B06 mov eax, dword ptr [esi] :760EB7A6 FF30 push dword ptr [eax] :760EB7A8 8D442424 lea eax, dword ptr [esp+24] * Possible StringData Ref from Code Obj ->"File %s has been deleted" | :760EB7AC 68D4630E76 push 760E63D4 :760EB7B1 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EB7B2 FF1530100E76 Call dword ptr [760E1030] :760EB7B8 83C40C add esp, 0000000C :760EB7BB 8D442420 lea eax, dword ptr [esp+20] :760EB7BF B918D30F76 mov ecx, 760FD318 :760EB7C4 6A00 push 00000000 :760EB7C6 50 push eax :760EB7C7 6A03 push 00000003 :760EB7C9 E8E26BFFFF call 760E23B0 :760EB7CE 8B06 mov eax, dword ptr [esi] :760EB7D0 FF30 push dword ptr [eax] :760EB7D2 E872FCFFFF call 760EB449 :760EB7D7 6AFF push FFFFFFFF :760EB7D9 6AFF push FFFFFFFF :760EB7DB 6AFF push FFFFFFFF :760EB7DD EB27 jmp 760EB806 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB76F(C) | :760EB7DF 8B06 mov eax, dword ptr [esi] :760EB7E1 8D4C2414 lea ecx, dword ptr [esp+14] :760EB7E5 51 push ecx :760EB7E6 8D4C241C lea ecx, dword ptr [esp+1C] :760EB7EA 8B00 mov eax, dword ptr [eax] :760EB7EC 51 push ecx :760EB7ED 6A00 push 00000000 :760EB7EF 50 push eax :760EB7F0 50 push eax :760EB7F1 E800F9FFFF call 760EB0F6 :760EB7F6 85C0 test eax, eax :760EB7F8 7513 jne 760EB80D :760EB7FA FF742414 push [esp+14] :760EB7FE FF742420 push [esp+20] :760EB802 FF742420 push [esp+20] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB7DD(U) | :760EB806 FF36 push dword ptr [esi] * Reference To: SfpDll.SfpRestoreCorrectVersionOfFile | :760EB808 E859280000 call 760EE066 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB70F(C), :760EB726(C), :760EB742(U), :760EB75F(U), :760EB7F8(C) | :760EB80D 83C604 add esi, 00000004 :760EB810 8BFE mov edi, esi :760EB812 833E00 cmp dword ptr [esi], 00000000 :760EB815 0F85AAFEFFFF jne 760EB6C5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EB6BD(C) | :760EB81B 5B pop ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB5AB(C), :760EB5CA(C), :760EB5EF(U), :760EB617(C), :760EB636(C) |:760EB64D(U) | :760EB81C 8B44240C mov eax, dword ptr [esp+0C] :760EB820 5F pop edi :760EB821 85C0 test eax, eax :760EB823 5E pop esi :760EB824 740F je 760EB835 :760EB826 3B05D0D80F76 cmp eax, dword ptr [760FD8D0] :760EB82C 7407 je 760EB835 :760EB82E 50 push eax * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760EB82F FF1534120E76 Call dword ptr [760E1234] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB540(C), :760EB55F(C), :760EB576(U), :760EB824(C), :760EB82C(C) | :760EB835 5D pop ebp :760EB836 81C4F8030000 add esp, 000003F8 :760EB83C C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1E69(C) | :760EB83F A184110E76 mov eax, dword ptr [760E1184] :760EB844 F60002 test byte ptr [eax], 02 :760EB847 0F849F66FFFF je 760E1EEC :760EB84D 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CreateSFPDir" | :760EB84F 68BC650E76 push 760E65BC :760EB854 68C7010000 push 000001C7 :760EB859 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EB85E FF1580110E76 Call dword ptr [760E1180] :760EB864 85C0 test eax, eax :760EB866 0F848066FFFF je 760E1EEC * Possible StringData Ref from Code Obj ->"Cannot get sfpdb file location" | :760EB86C 689C650E76 push 760E659C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB914(U), :760EB99D(U) | :760EB871 6806030000 push 00000306 :760EB876 E8B0160000 call 760ECF2B :760EB87B 59 pop ecx :760EB87C 59 pop ecx :760EB87D E96A66FFFF jmp 760E1EEC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1E83(C) | :760EB882 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760EB888 6A00 push 00000000 :760EB88A 50 push eax :760EB88B FFD6 call esi :760EB88D 85C0 test eax, eax :760EB88F 0F85F465FFFF jne 760E1E89 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EB895 FF15A0110E76 Call dword ptr [760E11A0] :760EB89B 8BF0 mov esi, eax :760EB89D A184110E76 mov eax, dword ptr [760E1184] :760EB8A2 F60002 test byte ptr [eax], 02 :760EB8A5 0F844166FFFF je 760E1EEC :760EB8AB 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CreateSFPDir" | :760EB8AD 68BC650E76 push 760E65BC :760EB8B2 68D2010000 push 000001D2 :760EB8B7 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EB8BC FF1580110E76 Call dword ptr [760E1180] :760EB8C2 85C0 test eax, eax :760EB8C4 0F842266FFFF je 760E1EEC :760EB8CA 56 push esi * Possible StringData Ref from Code Obj ->"Cannot create SFP dir ec=%d" | :760EB8CB 6880650E76 push 760E6580 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EB966(U), :760EB9EF(U) | :760EB8D0 6806030000 push 00000306 :760EB8D5 E851160000 call 760ECF2B :760EB8DA 83C40C add esp, 0000000C :760EB8DD E90A66FFFF jmp 760E1EEC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1E9D(C) | :760EB8E2 A184110E76 mov eax, dword ptr [760E1184] :760EB8E7 F60002 test byte ptr [eax], 02 :760EB8EA 0F84FC65FFFF je 760E1EEC :760EB8F0 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CreateSFPDir" | :760EB8F2 68BC650E76 push 760E65BC :760EB8F7 68DB010000 push 000001DB :760EB8FC 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EB901 FF1580110E76 Call dword ptr [760E1180] :760EB907 85C0 test eax, eax :760EB909 0F84DD65FFFF je 760E1EEC * Possible StringData Ref from Code Obj ->"Cannot get sfp overwritten files " ->"location" | :760EB90F 6854650E76 push 760E6554 :760EB914 E958FFFFFF jmp 760EB871 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1EB1(C) | :760EB919 50 push eax :760EB91A 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760EB920 50 push eax :760EB921 FFD6 call esi :760EB923 85C0 test eax, eax :760EB925 0F858C65FFFF jne 760E1EB7 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EB92B FF15A0110E76 Call dword ptr [760E11A0] :760EB931 8BF0 mov esi, eax :760EB933 A184110E76 mov eax, dword ptr [760E1184] :760EB938 F60002 test byte ptr [eax], 02 :760EB93B 0F84AB65FFFF je 760E1EEC :760EB941 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CreateSFPDir" | :760EB943 68BC650E76 push 760E65BC :760EB948 68E6010000 push 000001E6 :760EB94D 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EB952 FF1580110E76 Call dword ptr [760E1180] :760EB958 85C0 test eax, eax :760EB95A 0F848C65FFFF je 760E1EEC :760EB960 56 push esi * Possible StringData Ref from Code Obj ->"Cannot create overwritten files " ->"dir ec=%d" | :760EB961 6828650E76 push 760E6528 :760EB966 E965FFFFFF jmp 760EB8D0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1ECB(C) | :760EB96B A184110E76 mov eax, dword ptr [760E1184] :760EB970 F60002 test byte ptr [eax], 02 :760EB973 0F847365FFFF je 760E1EEC :760EB979 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CreateSFPDir" | :760EB97B 68BC650E76 push 760E65BC :760EB980 68F1010000 push 000001F1 :760EB985 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EB98A FF1580110E76 Call dword ptr [760E1180] :760EB990 85C0 test eax, eax :760EB992 0F845465FFFF je 760E1EEC * Possible StringData Ref from Code Obj ->"Cannot get sfp tempcats directory" | :760EB998 6804650E76 push 760E6504 :760EB99D E9CFFEFFFF jmp 760EB871 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1EDF(C) | :760EB9A2 50 push eax :760EB9A3 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760EB9A9 50 push eax :760EB9AA FFD6 call esi :760EB9AC 85C0 test eax, eax :760EB9AE 0F853165FFFF jne 760E1EE5 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EB9B4 FF15A0110E76 Call dword ptr [760E11A0] :760EB9BA 8BF0 mov esi, eax :760EB9BC A184110E76 mov eax, dword ptr [760E1184] :760EB9C1 F60002 test byte ptr [eax], 02 :760EB9C4 0F842265FFFF je 760E1EEC :760EB9CA 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CreateSFPDir" | :760EB9CC 68BC650E76 push 760E65BC :760EB9D1 68FC010000 push 000001FC :760EB9D6 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EB9DB FF1580110E76 Call dword ptr [760E1180] :760EB9E1 85C0 test eax, eax :760EB9E3 0F840365FFFF je 760E1EEC :760EB9E9 56 push esi * Possible StringData Ref from Code Obj ->"Cannot create tempcats dir ec=%d" | :760EB9EA 68E0640E76 push 760E64E0 :760EB9EF E9DCFEFFFF jmp 760EB8D0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E39C7(C) | :760EB9F4 A184110E76 mov eax, dword ptr [760E1184] :760EB9F9 F60002 test byte ptr [eax], 02 :760EB9FC 0F841B80FFFF je 760E3A1D :760EBA02 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"IsDbFileValid" | :760EBA04 683C660E76 push 760E663C :760EBA09 6818020000 push 00000218 :760EBA0E 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EBA13 FF1580110E76 Call dword ptr [760E1180] :760EBA19 85C0 test eax, eax :760EBA1B 0F84FC7FFFFF je 760E3A1D :760EBA21 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Cannot get file hash for %s" | :760EBA24 6820660E76 push 760E6620 :760EBA29 EB7C jmp 760EBAA7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E39EB(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EBA2B FF15A0110E76 Call dword ptr [760E11A0] :760EBA31 8BF0 mov esi, eax :760EBA33 A184110E76 mov eax, dword ptr [760E1184] :760EBA38 F60002 test byte ptr [eax], 02 :760EBA3B 0F84DC7FFFFF je 760E3A1D :760EBA41 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"IsDbFileValid" | :760EBA43 683C660E76 push 760E663C :760EBA48 6824020000 push 00000224 :760EBA4D 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EBA52 FF1580110E76 Call dword ptr [760E1180] :760EBA58 85C0 test eax, eax :760EBA5A 0F84BD7FFFFF je 760E3A1D :760EBA60 56 push esi * Possible StringData Ref from Code Obj ->"Cannot read SfpDbHash value from " ->"registry: error %08x" | :760EBA61 68E8650E76 push 760E65E8 :760EBA66 EB3F jmp 760EBAA7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3A0C(C) | :760EBA68 1BC0 sbb eax, eax :760EBA6A 83D8FF sbb eax, FFFFFFFF :760EBA6D E9A07FFFFF jmp 760E3A12 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E39F7(C), :760E3A14(C) | :760EBA72 A184110E76 mov eax, dword ptr [760E1184] :760EBA77 F60004 test byte ptr [eax], 04 :760EBA7A 0F849D7FFFFF je 760E3A1D :760EBA80 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"IsDbFileValid" | :760EBA82 683C660E76 push 760E663C :760EBA87 682C020000 push 0000022C :760EBA8C 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EBA91 FF1580110E76 Call dword ptr [760E1180] :760EBA97 85C0 test eax, eax :760EBA99 0F847E7FFFFF je 760E3A1D :760EBA9F FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Sfp db file %s is corrupt" | :760EBAA2 68CC650E76 push 760E65CC * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EBA29(U), :760EBA66(U) | :760EBAA7 6806030000 push 00000306 :760EBAAC E87A140000 call 760ECF2B :760EBAB1 83C40C add esp, 0000000C :760EBAB4 E9647FFFFF jmp 760E3A1D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3A54(C) | :760EBAB9 A184110E76 mov eax, dword ptr [760E1184] :760EBABE F60002 test byte ptr [eax], 02 :760EBAC1 0F84CA7FFFFF je 760E3A91 :760EBAC7 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CopyCatsFromTempDir" | :760EBAC9 6810670E76 push 760E6710 :760EBACE 6848020000 push 00000248 :760EBAD3 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EBAD8 FF1580110E76 Call dword ptr [760E1180] :760EBADE 85C0 test eax, eax :760EBAE0 0F84AB7FFFFF je 760E3A91 * Possible StringData Ref from Code Obj ->"Cannot get sfp overwritten files " ->"location" | :760EBAE6 6854650E76 push 760E6554 :760EBAEB 6806030000 push 00000306 :760EBAF0 E836140000 call 760ECF2B :760EBAF5 59 pop ecx :760EBAF6 59 pop ecx :760EBAF7 E9957FFFFF jmp 760E3A91 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3A6B(C) | :760EBAFC A184110E76 mov eax, dword ptr [760E1184] :760EBB01 F60002 test byte ptr [eax], 02 :760EBB04 0F84877FFFFF je 760E3A91 :760EBB0A 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CopyCatsFromTempDir" | :760EBB0C 6810670E76 push 760E6710 :760EBB11 684F020000 push 0000024F :760EBB16 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EBB1B FF1580110E76 Call dword ptr [760E1180] :760EBB21 85C0 test eax, eax :760EBB23 0F84687FFFFF je 760E3A91 :760EBB29 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error opening catalog utilities" | :760EBB2B 68F0660E76 push 760E66F0 :760EBB30 6806030000 push 00000306 :760EBB35 E8F1130000 call 760ECF2B :760EBB3A 83C40C add esp, 0000000C :760EBB3D E94F7FFFFF jmp 760E3A91 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3A8B(C) | * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EBB42 8B3580110E76 mov esi, dword ptr [760E1180] :760EBB48 53 push ebx :760EBB49 57 push edi :760EBB4A BF7CDA0F76 mov edi, 760FDA7C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBCC5(C) | * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760EBB4F 8B1D54120E76 mov ebx, dword ptr [760E1254] :760EBB55 8D85ACF6FFFF lea eax, dword ptr [ebp+FFFFF6AC] :760EBB5B 50 push eax :760EBB5C FFD3 call ebx :760EBB5E 8BD0 mov edx, eax :760EBB60 8D85ACF2FFFF lea eax, dword ptr [ebp+FFFFF2AC] :760EBB66 50 push eax :760EBB67 8955F4 mov dword ptr [ebp-0C], edx :760EBB6A FFD3 call ebx :760EBB6C 8B4DF4 mov ecx, dword ptr [ebp-0C] :760EBB6F 8D440101 lea eax, dword ptr [ecx+eax+01] :760EBB73 3D00040000 cmp eax, 00000400 :760EBB78 0F832A010000 jnb 760EBCA8 :760EBB7E 8D85ACF6FFFF lea eax, dword ptr [ebp+FFFFF6AC] :760EBB84 50 push eax :760EBB85 8D85ACF2FFFF lea eax, dword ptr [ebp+FFFFF2AC] :760EBB8B 50 push eax :760EBB8C 8D85ACFAFFFF lea eax, dword ptr [ebp+FFFFFAAC] :760EBB92 68442E0E76 push 760E2E44 :760EBB97 50 push eax * Reference To: USER32.wsprintfA, Ord:02B3h | :760EBB98 FF15A4120E76 Call dword ptr [760E12A4] :760EBB9E 83C410 add esp, 00000010 :760EBBA1 8D85ACFAFFFF lea eax, dword ptr [ebp+FFFFFAAC] :760EBBA7 8D4DF8 lea ecx, dword ptr [ebp-08] :760EBBAA 50 push eax :760EBBAB E84E92FFFF call 760E4DFE :760EBBB0 3D4F050000 cmp eax, 0000054F :760EBBB5 753B jne 760EBBF2 :760EBBB7 A184110E76 mov eax, dword ptr [760E1184] :760EBBBC F60002 test byte ptr [eax], 02 :760EBBBF 0F84E3000000 je 760EBCA8 :760EBBC5 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CopyCatsFromTempDir" | :760EBBC7 6810670E76 push 760E6710 :760EBBCC 686D020000 push 0000026D :760EBBD1 57 push edi :760EBBD2 FFD6 call esi :760EBBD4 85C0 test eax, eax :760EBBD6 0F84CC000000 je 760EBCA8 * Possible StringData Ref from Code Obj ->"Error verifying catalog" | :760EBBDC 68D8660E76 push 760E66D8 :760EBBE1 6806030000 push 00000306 :760EBBE6 E840130000 call 760ECF2B :760EBBEB 59 pop ecx :760EBBEC 59 pop ecx :760EBBED E9B6000000 jmp 760EBCA8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBBB5(C) | :760EBBF2 83F801 cmp eax, 00000001 :760EBBF5 7561 jne 760EBC58 :760EBBF7 A184110E76 mov eax, dword ptr [760E1184] :760EBBFC F60002 test byte ptr [eax], 02 :760EBBFF 7424 je 760EBC25 :760EBC01 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CopyCatsFromTempDir" | :760EBC03 6810670E76 push 760E6710 :760EBC08 6872020000 push 00000272 :760EBC0D 57 push edi :760EBC0E FFD6 call esi :760EBC10 85C0 test eax, eax :760EBC12 7411 je 760EBC25 * Possible StringData Ref from Code Obj ->"Certificate not in trusted root " ->"store" | :760EBC14 68B0660E76 push 760E66B0 :760EBC19 6806030000 push 00000306 :760EBC1E E808130000 call 760ECF2B :760EBC23 59 pop ecx :760EBC24 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EBBFF(C), :760EBC12(C) | :760EBC25 8D85ACFAFFFF lea eax, dword ptr [ebp+FFFFFAAC] :760EBC2B 50 push eax :760EBC2C 8D85C4EEFFFF lea eax, dword ptr [ebp+FFFFEEC4] * Possible StringData Ref from Code Obj ->"SFP could not install catalog " ->"%s - certificate is not trusted" | :760EBC32 6870660E76 push 760E6670 :760EBC37 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EBC38 FF1530100E76 Call dword ptr [760E1030] :760EBC3E 83C40C add esp, 0000000C :760EBC41 8D85C4EEFFFF lea eax, dword ptr [ebp+FFFFEEC4] :760EBC47 B918D30F76 mov ecx, 760FD318 :760EBC4C 6A00 push 00000000 :760EBC4E 50 push eax :760EBC4F 6A01 push 00000001 :760EBC51 E85A67FFFF call 760E23B0 :760EBC56 EB50 jmp 760EBCA8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBBF5(C) | :760EBC58 8D85ACFAFFFF lea eax, dword ptr [ebp+FFFFFAAC] :760EBC5E 50 push eax :760EBC5F E8962D0000 call 760EE9FA :760EBC64 8BD8 mov ebx, eax :760EBC66 85DB test ebx, ebx :760EBC68 7432 je 760EBC9C :760EBC6A A184110E76 mov eax, dword ptr [760E1184] :760EBC6F F60002 test byte ptr [eax], 02 :760EBC72 7434 je 760EBCA8 :760EBC74 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CopyCatsFromTempDir" | :760EBC76 6810670E76 push 760E6710 :760EBC7B 687D020000 push 0000027D :760EBC80 57 push edi :760EBC81 FFD6 call esi :760EBC83 85C0 test eax, eax :760EBC85 7421 je 760EBCA8 :760EBC87 53 push ebx * Possible StringData Ref from Code Obj ->"AddCatalogToCryptoDB failed. ec=%d" | :760EBC88 684C660E76 push 760E664C :760EBC8D 6806030000 push 00000306 :760EBC92 E894120000 call 760ECF2B :760EBC97 83C40C add esp, 0000000C :760EBC9A EB0C jmp 760EBCA8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBC68(C) | :760EBC9C 8D85ACFAFFFF lea eax, dword ptr [ebp+FFFFFAAC] :760EBCA2 50 push eax :760EBCA3 E83A200000 call 760EDCE2 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EBB78(C), :760EBBBF(C), :760EBBD6(C), :760EBBED(U), :760EBC56(U) |:760EBC72(C), :760EBC85(C), :760EBC9A(U) | :760EBCA8 8D85ACF6FFFF lea eax, dword ptr [ebp+FFFFF6AC] :760EBCAE 6800040000 push 00000400 :760EBCB3 50 push eax :760EBCB4 8D85ACFEFFFF lea eax, dword ptr [ebp+FFFFFEAC] :760EBCBA 50 push eax :760EBCBB 8D4DF8 lea ecx, dword ptr [ebp-08] :760EBCBE E84B63FFFF call 760E200E :760EBCC3 85C0 test eax, eax :760EBCC5 0F8584FEFFFF jne 760EBB4F :760EBCCB 5F pop edi :760EBCCC 5B pop ebx :760EBCCD E9BF7DFFFF jmp 760E3A91 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E349A(C) | :760EBCD2 6A04 push 00000004 :760EBCD4 53 push ebx :760EBCD5 68B7020000 push 000002B7 :760EBCDA 55 push ebp :760EBCDB FFD6 call esi :760EBCDD 85C0 test eax, eax :760EBCDF 0F84BB77FFFF je 760E34A0 :760EBCE5 57 push edi :760EBCE6 BF06030000 mov edi, 00000306 * Possible StringData Ref from Code Obj ->"Cannot read SFP flag from registry: " ->"error %08x" | :760EBCEB 68E0680E76 push 760E68E0 :760EBCF0 57 push edi :760EBCF1 E835120000 call 760ECF2B :760EBCF6 83C40C add esp, 0000000C :760EBCF9 E9A777FFFF jmp 760E34A5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E34AD(C) | :760EBCFE 6A04 push 00000004 :760EBD00 53 push ebx :760EBD01 68B8020000 push 000002B8 :760EBD06 55 push ebp :760EBD07 FFD6 call esi :760EBD09 85C0 test eax, eax :760EBD0B 0F84A277FFFF je 760E34B3 * Possible StringData Ref from Code Obj ->"SFP is enabled" | :760EBD11 68D0680E76 push 760E68D0 :760EBD16 57 push edi :760EBD17 E80F120000 call 760ECF2B :760EBD1C 59 pop ecx :760EBD1D 59 pop ecx :760EBD1E E99077FFFF jmp 760E34B3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3484(C) | :760EBD23 FF35C0DE0F76 push dword ptr [760FDEC0] :760EBD29 8D8424B8000000 lea eax, dword ptr [esp+000000B8] :760EBD30 50 push eax * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760EBD31 FF1558120E76 Call dword ptr [760E1258] :760EBD37 85C0 test eax, eax :760EBD39 A184110E76 mov eax, dword ptr [760E1184] :760EBD3E 7427 je 760EBD67 :760EBD40 F60004 test byte ptr [eax], 04 :760EBD43 744E je 760EBD93 :760EBD45 6A04 push 00000004 :760EBD47 53 push ebx :760EBD48 68BF020000 push 000002BF :760EBD4D 55 push ebp :760EBD4E FFD6 call esi :760EBD50 85C0 test eax, eax :760EBD52 743F je 760EBD93 * Possible StringData Ref from Code Obj ->"Enabling SFP" | :760EBD54 68C0680E76 push 760E68C0 :760EBD59 6806030000 push 00000306 :760EBD5E E8C8110000 call 760ECF2B :760EBD63 59 pop ecx :760EBD64 59 pop ecx :760EBD65 EB2C jmp 760EBD93 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBD3E(C) | :760EBD67 F60004 test byte ptr [eax], 04 :760EBD6A 7420 je 760EBD8C :760EBD6C 6A04 push 00000004 :760EBD6E 53 push ebx :760EBD6F 68C3020000 push 000002C3 :760EBD74 55 push ebp :760EBD75 FFD6 call esi :760EBD77 85C0 test eax, eax :760EBD79 7411 je 760EBD8C * Possible StringData Ref from Code Obj ->"SFP disabled" | :760EBD7B 68B0680E76 push 760E68B0 :760EBD80 6806030000 push 00000306 :760EBD85 E8A1110000 call 760ECF2B :760EBD8A 59 pop ecx :760EBD8B 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EBD6A(C), :760EBD79(C) | :760EBD8C 8325A4DA0F7600 and dword ptr [760FDAA4], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EBD43(C), :760EBD52(C), :760EBD65(U) | :760EBD93 BF06030000 mov edi, 00000306 :760EBD98 E91677FFFF jmp 760E34B3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E34BD(C) | :760EBD9D A184110E76 mov eax, dword ptr [760E1184] :760EBDA2 F60004 test byte ptr [eax], 04 :760EBDA5 741C je 760EBDC3 :760EBDA7 6A04 push 00000004 :760EBDA9 53 push ebx :760EBDAA 68CF020000 push 000002CF :760EBDAF 55 push ebp :760EBDB0 FFD6 call esi :760EBDB2 85C0 test eax, eax :760EBDB4 740D je 760EBDC3 * Possible StringData Ref from Code Obj ->"SafeMode!!! - Sfp disabled" | :760EBDB6 6894680E76 push 760E6894 :760EBDBB 57 push edi :760EBDBC E86A110000 call 760ECF2B :760EBDC1 59 pop ecx :760EBDC2 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EBDA5(C), :760EBDB4(C) | :760EBDC3 8325A4DA0F7600 and dword ptr [760FDAA4], 00000000 :760EBDCA E9F476FFFF jmp 760E34C3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E34F8(C) | :760EBDCF 2105A8DA0F76 and dword ptr [760FDAA8], eax :760EBDD5 E92477FFFF jmp 760E34FE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3517(C) | :760EBDDA A184110E76 mov eax, dword ptr [760E1184] :760EBDDF F60002 test byte ptr [eax], 02 :760EBDE2 0F84D4010000 je 760EBFBC :760EBDE8 6A02 push 00000002 :760EBDEA 53 push ebx :760EBDEB 68E7020000 push 000002E7 :760EBDF0 55 push ebp :760EBDF1 FFD6 call esi :760EBDF3 85C0 test eax, eax :760EBDF5 0F84C1010000 je 760EBFBC * Possible StringData Ref from Code Obj ->"Cannot form sfpdb file path" | :760EBDFB 6878680E76 push 760E6878 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EBE33(U), :760EBE5B(U), :760EBE83(U), :760EBF1C(U), :760EBF8B(U) |:760EBFB2(U) | :760EBE00 57 push edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBF68(U) | :760EBE01 E825110000 call 760ECF2B :760EBE06 59 pop ecx :760EBE07 59 pop ecx :760EBE08 E9AF010000 jmp 760EBFBC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3533(C) | :760EBE0D A184110E76 mov eax, dword ptr [760E1184] :760EBE12 F60002 test byte ptr [eax], 02 :760EBE15 0F84A1010000 je 760EBFBC :760EBE1B 6A02 push 00000002 :760EBE1D 53 push ebx :760EBE1E 68F0020000 push 000002F0 :760EBE23 55 push ebp :760EBE24 FFD6 call esi :760EBE26 85C0 test eax, eax :760EBE28 0F848E010000 je 760EBFBC * Possible StringData Ref from Code Obj ->"Cannot form path for wininit.ini" | :760EBE2E 6854680E76 push 760E6854 :760EBE33 EBCB jmp 760EBE00 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3540(C) | :760EBE35 A184110E76 mov eax, dword ptr [760E1184] :760EBE3A F60002 test byte ptr [eax], 02 :760EBE3D 0F8479010000 je 760EBFBC :760EBE43 6A02 push 00000002 :760EBE45 53 push ebx :760EBE46 68F7020000 push 000002F7 :760EBE4B 55 push ebp :760EBE4C FFD6 call esi :760EBE4E 85C0 test eax, eax :760EBE50 0F8466010000 je 760EBFBC * Possible StringData Ref from Code Obj ->"Cannot create SFP directory" | :760EBE56 6838680E76 push 760E6838 :760EBE5B EBA3 jmp 760EBE00 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E355F(C) | :760EBE5D A184110E76 mov eax, dword ptr [760E1184] :760EBE62 F60002 test byte ptr [eax], 02 :760EBE65 0F8451010000 je 760EBFBC :760EBE6B 6A02 push 00000002 :760EBE6D 53 push ebx :760EBE6E 6800030000 push 00000300 :760EBE73 55 push ebp :760EBE74 FFD6 call esi :760EBE76 85C0 test eax, eax :760EBE78 0F843E010000 je 760EBFBC * Possible StringData Ref from Code Obj ->"Cannot get sfpdb file location" | :760EBE7E 689C650E76 push 760E659C :760EBE83 E978FFFFFF jmp 760EBE00 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E357D(C) | :760EBE88 A184110E76 mov eax, dword ptr [760E1184] :760EBE8D F60002 test byte ptr [eax], 02 :760EBE90 0F84ED76FFFF je 760E3583 :760EBE96 6A02 push 00000002 :760EBE98 53 push ebx :760EBE99 6808030000 push 00000308 :760EBE9E 55 push ebp :760EBE9F FFD6 call esi :760EBEA1 85C0 test eax, eax :760EBEA3 0F84DA76FFFF je 760E3583 :760EBEA9 FF74241C push [esp+1C] * Possible StringData Ref from Code Obj ->"g_CEventLogger.Init failed ec=%d" | :760EBEAD 6814680E76 push 760E6814 :760EBEB2 57 push edi :760EBEB3 E873100000 call 760ECF2B :760EBEB8 83C40C add esp, 0000000C :760EBEBB E9C376FFFF jmp 760E3583 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E358A(C) | :760EBEC0 A184110E76 mov eax, dword ptr [760E1184] :760EBEC5 F60001 test byte ptr [eax], 01 :760EBEC8 0F84EE000000 je 760EBFBC :760EBECE 6A01 push 00000001 :760EBED0 53 push ebx :760EBED1 6811030000 push 00000311 :760EBED6 55 push ebp :760EBED7 FFD6 call esi :760EBED9 85C0 test eax, eax :760EBEDB 0F84DB000000 je 760EBFBC :760EBEE1 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error initializing the catalog " ->"crypto database." | :760EBEE3 68E4670E76 push 760E67E4 :760EBEE8 57 push edi :760EBEE9 E83D100000 call 760ECF2B :760EBEEE 83C40C add esp, 0000000C :760EBEF1 E9C6000000 jmp 760EBFBC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E35C3(C) | :760EBEF6 A184110E76 mov eax, dword ptr [760E1184] :760EBEFB F60001 test byte ptr [eax], 01 :760EBEFE 0F84B8000000 je 760EBFBC :760EBF04 6A01 push 00000001 :760EBF06 53 push ebx :760EBF07 6842030000 push 00000342 :760EBF0C 55 push ebp :760EBF0D FFD6 call esi :760EBF0F 85C0 test eax, eax :760EBF11 0F84A5000000 je 760EBFBC * Possible StringData Ref from Code Obj ->"Error building SFP database from " ->"existing file" | :760EBF17 68B4670E76 push 760E67B4 :760EBF1C E9DFFEFFFF jmp 760EBE00 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3622(C) | :760EBF21 A184110E76 mov eax, dword ptr [760E1184] :760EBF26 F60002 test byte ptr [eax], 02 :760EBF29 0F848D000000 je 760EBFBC :760EBF2F 6A02 push 00000002 :760EBF31 53 push ebx :760EBF32 6826030000 push 00000326 :760EBF37 55 push ebp :760EBF38 FFD6 call esi :760EBF3A 85C0 test eax, eax :760EBF3C 747E je 760EBFBC * Possible StringData Ref from Code Obj ->"Cannot form protected list xml " ->"file path" | :760EBF3E 6888670E76 push 760E6788 :760EBF43 EB1E jmp 760EBF63 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3643(C) | :760EBF45 A184110E76 mov eax, dword ptr [760E1184] :760EBF4A F60001 test byte ptr [eax], 01 :760EBF4D 746D je 760EBFBC :760EBF4F 6A01 push 00000001 :760EBF51 53 push ebx :760EBF52 6832030000 push 00000332 :760EBF57 55 push ebp :760EBF58 FFD6 call esi :760EBF5A 85C0 test eax, eax :760EBF5C 745E je 760EBFBC * Possible StringData Ref from Code Obj ->"Error creating new SFP database " ->"file" | :760EBF5E 6860670E76 push 760E6760 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBF43(U) | :760EBF63 6806030000 push 00000306 :760EBF68 E994FEFFFF jmp 760EBE01 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E35D8(C) | :760EBF6D A184110E76 mov eax, dword ptr [760E1184] :760EBF72 F60001 test byte ptr [eax], 01 :760EBF75 7445 je 760EBFBC :760EBF77 6A01 push 00000001 :760EBF79 53 push ebx :760EBF7A 684D030000 push 0000034D :760EBF7F 55 push ebp :760EBF80 FFD6 call esi :760EBF82 85C0 test eax, eax :760EBF84 7436 je 760EBFBC * Possible StringData Ref from Code Obj ->"Cannot signal Sfp Init Event" | :760EBF86 6840670E76 push 760E6740 :760EBF8B E970FEFFFF jmp 760EBE00 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E35E5(U) | :760EBF90 85C0 test eax, eax :760EBF92 7523 jne 760EBFB7 :760EBF94 A184110E76 mov eax, dword ptr [760E1184] :760EBF99 F60001 test byte ptr [eax], 01 :760EBF9C 741E je 760EBFBC :760EBF9E 6A01 push 00000001 :760EBFA0 53 push ebx :760EBFA1 6857030000 push 00000357 :760EBFA6 55 push ebp :760EBFA7 FFD6 call esi :760EBFA9 85C0 test eax, eax :760EBFAB 740F je 760EBFBC * Possible StringData Ref from Code Obj ->"Error creating rpc server" | :760EBFAD 6824670E76 push 760E6724 :760EBFB2 E949FEFFFF jmp 760EBE00 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBF92(C) | :760EBFB7 8364241400 and dword ptr [esp+14], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EBDE2(C), :760EBDF5(C), :760EBE08(U), :760EBE15(C), :760EBE28(C) |:760EBE3D(C), :760EBE50(C), :760EBE65(C), :760EBE78(C), :760EBEC8(C) |:760EBEDB(C), :760EBEF1(U), :760EBEFE(C), :760EBF11(C), :760EBF29(C) |:760EBF3C(C), :760EBF4D(C), :760EBF5C(C), :760EBF75(C), :760EBF84(C) |:760EBF9C(C), :760EBFAB(C) | :760EBFBC 8B442414 mov eax, dword ptr [esp+14] :760EBFC0 5F pop edi :760EBFC1 5E pop esi :760EBFC2 5D pop ebp :760EBFC3 5B pop ebx :760EBFC4 81C4D00B0000 add esp, 00000BD0 :760EBFCA C20800 ret 0008 * Referenced by a CALL at Address: |:760F67B9 | Exported fn(): DisableSFPS - Ord:0018h :760EBFCD 55 push ebp :760EBFCE 8BEC mov ebp, esp :760EBFD0 56 push esi :760EBFD1 33F6 xor esi, esi :760EBFD3 39750C cmp dword ptr [ebp+0C], esi :760EBFD6 57 push edi :760EBFD7 BF4F050000 mov edi, 0000054F :760EBFDC 0F84BE010000 je 760EC1A0 :760EBFE2 FF750C push [ebp+0C] :760EBFE5 FF35C0DE0F76 push dword ptr [760FDEC0] * Reference To: KERNEL32.lstrcmpA, Ord:0329h | :760EBFEB FF1564120E76 Call dword ptr [760E1264] :760EBFF1 85C0 test eax, eax :760EBFF3 0F85A7010000 jne 760EC1A0 :760EBFF9 837D0801 cmp dword ptr [ebp+08], 00000001 :760EBFFD 0F85FA000000 jne 760EC0FD :760EC003 6A01 push 00000001 :760EC005 FF3574DA0F76 push dword ptr [760FDA74] :760EC00B FF3578DA0F76 push dword ptr [760FDA78] :760EC011 FF35C0DE0F76 push dword ptr [760FDEC0] * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760EC017 FF1554120E76 Call dword ptr [760E1254] :760EC01D 40 inc eax :760EC01E 50 push eax :760EC01F FF35C0DE0F76 push dword ptr [760FDEC0] :760EC025 E87462FFFF call 760E229E :760EC02A 85C0 test eax, eax :760EC02C 754D jne 760EC07B * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EC02E FF15A0110E76 Call dword ptr [760E11A0] :760EC034 8BF0 mov esi, eax :760EC036 A184110E76 mov eax, dword ptr [760E1184] :760EC03B F60002 test byte ptr [eax], 02 :760EC03E 0F8492010000 je 760EC1D6 :760EC044 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"DisableSFPS" | :760EC046 6894690E76 push 760E6994 :760EC04B 6884030000 push 00000384 :760EC050 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC055 FF1580110E76 Call dword ptr [760E1180] :760EC05B 85C0 test eax, eax :760EC05D 0F8473010000 je 760EC1D6 :760EC063 56 push esi * Possible StringData Ref from Code Obj ->"Cannot disable SFP in registry: " ->"error %08x" | :760EC064 6868690E76 push 760E6968 :760EC069 6806030000 push 00000306 :760EC06E E8B80E0000 call 760ECF2B :760EC073 83C40C add esp, 0000000C :760EC076 E95B010000 jmp 760EC1D6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC02C(C) | :760EC07B 6A01 push 00000001 * Reference To: SMGR._SRDisableSfp@4, Ord:003Fh | :760EC07D FF156C110E76 Call dword ptr [760E116C] :760EC083 85C0 test eax, eax :760EC085 7437 je 760EC0BE :760EC087 A184110E76 mov eax, dword ptr [760E1184] :760EC08C F60002 test byte ptr [eax], 02 :760EC08F 0F8441010000 je 760EC1D6 :760EC095 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"DisableSFPS" | :760EC097 6894690E76 push 760E6994 :760EC09C 688C030000 push 0000038C :760EC0A1 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC0A6 FF1580110E76 Call dword ptr [760E1180] :760EC0AC 85C0 test eax, eax :760EC0AE 0F8422010000 je 760EC1D6 * Possible StringData Ref from Code Obj ->"SRDisableSfp failed" | :760EC0B4 6854690E76 push 760E6954 :760EC0B9 E90C010000 jmp 760EC1CA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC085(C) | :760EC0BE A184110E76 mov eax, dword ptr [760E1184] :760EC0C3 8935A4DA0F76 mov dword ptr [760FDAA4], esi :760EC0C9 33FF xor edi, edi :760EC0CB F60004 test byte ptr [eax], 04 :760EC0CE 0F8402010000 je 760EC1D6 :760EC0D4 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"DisableSFPS" | :760EC0D6 6894690E76 push 760E6994 :760EC0DB 6892030000 push 00000392 :760EC0E0 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC0E5 FF1580110E76 Call dword ptr [760E1180] :760EC0EB 85C0 test eax, eax :760EC0ED 0F84E3000000 je 760EC1D6 * Possible StringData Ref from Code Obj ->"SFP disabled" | :760EC0F3 68B0680E76 push 760E68B0 :760EC0F8 E9CD000000 jmp 760EC1CA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EBFFD(C) | :760EC0FD 8D450C lea eax, dword ptr [ebp+0C] :760EC100 50 push eax :760EC101 56 push esi :760EC102 56 push esi :760EC103 FF3578DA0F76 push dword ptr [760FDA78] :760EC109 6802000080 push 80000002 * Reference To: ADVAPI32.RegOpenKeyExA, Ord:019Dh | :760EC10E FF15C0120E76 Call dword ptr [760E12C0] :760EC114 85C0 test eax, eax :760EC116 755C jne 760EC174 :760EC118 FF3574DA0F76 push dword ptr [760FDA74] :760EC11E FF750C push [ebp+0C] * Reference To: ADVAPI32.RegDeleteValueA, Ord:018Dh | :760EC121 FF15C4120E76 Call dword ptr [760E12C4] :760EC127 A184110E76 mov eax, dword ptr [760E1184] :760EC12C C705A4DA0F7601000000 mov dword ptr [760FDAA4], 00000001 :760EC136 F60004 test byte ptr [eax], 04 :760EC139 742C je 760EC167 :760EC13B 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"DisableSFPS" | :760EC13D 6894690E76 push 760E6994 :760EC142 689F030000 push 0000039F :760EC147 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC14C FF1580110E76 Call dword ptr [760E1180] :760EC152 85C0 test eax, eax :760EC154 7411 je 760EC167 * Possible StringData Ref from Code Obj ->"Re-enabled SFP" | :760EC156 6844690E76 push 760E6944 :760EC15B 6806030000 push 00000306 :760EC160 E8C60D0000 call 760ECF2B :760EC165 59 pop ecx :760EC166 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC139(C), :760EC154(C) | :760EC167 FF750C push [ebp+0C] :760EC16A 33FF xor edi, edi * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760EC16C FF15B0120E76 Call dword ptr [760E12B0] :760EC172 EB62 jmp 760EC1D6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC116(C) | :760EC174 A184110E76 mov eax, dword ptr [760E1184] :760EC179 F60002 test byte ptr [eax], 02 :760EC17C 7458 je 760EC1D6 :760EC17E 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"DisableSFPS" | :760EC180 6894690E76 push 760E6994 :760EC185 68A5030000 push 000003A5 :760EC18A 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC18F FF1580110E76 Call dword ptr [760E1180] :760EC195 85C0 test eax, eax :760EC197 743D je 760EC1D6 * Possible StringData Ref from Code Obj ->"Cannot re-enable SFP" | :760EC199 682C690E76 push 760E692C :760EC19E EB2A jmp 760EC1CA * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EBFDC(C), :760EBFF3(C) | :760EC1A0 A184110E76 mov eax, dword ptr [760E1184] :760EC1A5 F60001 test byte ptr [eax], 01 :760EC1A8 742C je 760EC1D6 :760EC1AA 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"DisableSFPS" | :760EC1AC 6894690E76 push 760E6994 :760EC1B1 6876030000 push 00000376 :760EC1B6 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC1BB FF1580110E76 Call dword ptr [760E1180] :760EC1C1 85C0 test eax, eax :760EC1C3 7411 je 760EC1D6 * Possible StringData Ref from Code Obj ->"Wrong key passed - bailing!" | :760EC1C5 6810690E76 push 760E6910 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC0B9(U), :760EC0F8(U), :760EC19E(U) | :760EC1CA 6806030000 push 00000306 :760EC1CF E8570D0000 call 760ECF2B :760EC1D4 59 pop ecx :760EC1D5 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC03E(C), :760EC05D(C), :760EC076(U), :760EC08F(C), :760EC0AE(C) |:760EC0CE(C), :760EC0ED(C), :760EC172(U), :760EC17C(C), :760EC197(C) |:760EC1A8(C), :760EC1C3(C) | :760EC1D6 8BC7 mov eax, edi :760EC1D8 5F pop edi :760EC1D9 5E pop esi :760EC1DA 5D pop ebp :760EC1DB C20800 ret 0008 * Referenced by a CALL at Addresses: |:760EC5B6 , :760EC5C3 | :760EC1DE 55 push ebp :760EC1DF 8BEC mov ebp, esp :760EC1E1 83EC40 sub esp, 00000040 :760EC1E4 53 push ebx :760EC1E5 56 push esi :760EC1E6 57 push edi :760EC1E7 33DB xor ebx, ebx :760EC1E9 FF7508 push [ebp+08] :760EC1EC 8D4DC0 lea ecx, dword ptr [ebp-40] :760EC1EF 66895DC0 mov word ptr [ebp-40], bx :760EC1F3 E8B20C0000 call 760ECEAA :760EC1F8 6AFF push FFFFFFFF :760EC1FA 895DE0 mov dword ptr [ebp-20], ebx :760EC1FD FF35C4DE0F76 push dword ptr [760FDEC4] :760EC203 895DE4 mov dword ptr [ebp-1C], ebx :760EC206 895DF4 mov dword ptr [ebp-0C], ebx :760EC209 895DE8 mov dword ptr [ebp-18], ebx :760EC20C 895DEC mov dword ptr [ebp-14], ebx :760EC20F E811030000 call 760EC525 :760EC214 8945F0 mov dword ptr [ebp-10], eax :760EC217 8D45F4 lea eax, dword ptr [ebp-0C] :760EC21A 50 push eax :760EC21B 68A8890E76 push 760E89A8 :760EC220 6A01 push 00000001 :760EC222 53 push ebx :760EC223 6898890E76 push 760E8998 :760EC228 66895DD0 mov word ptr [ebp-30], bx :760EC22C 895DF8 mov dword ptr [ebp-08], ebx * Reference To: OLE32.CoCreateInstance, Ord:000Fh | :760EC22F FF15A8100E76 Call dword ptr [760E10A8] :760EC235 8BF0 mov esi, eax :760EC237 3BF3 cmp esi, ebx :760EC239 0F8CA1020000 jl 760EC4E0 :760EC23F 8B45F4 mov eax, dword ptr [ebp-0C] :760EC242 3BC3 cmp eax, ebx :760EC244 0F8496020000 je 760EC4E0 :760EC24A 8D55FE lea edx, dword ptr [ebp-02] :760EC24D 8D75C0 lea esi, dword ptr [ebp-40] :760EC250 52 push edx :760EC251 8B08 mov ecx, dword ptr [eax] :760EC253 83EC10 sub esp, 00000010 :760EC256 8BFC mov edi, esp :760EC258 A5 movsd :760EC259 A5 movsd :760EC25A A5 movsd :760EC25B 50 push eax :760EC25C A5 movsd :760EC25D FF91E8000000 call dword ptr [ecx+000000E8] :760EC263 8BF0 mov esi, eax :760EC265 3BF3 cmp esi, ebx :760EC267 0F8C3E020000 jl 760EC4AB :760EC26D 66395DFE cmp word ptr [ebp-02], bx :760EC271 0F8434020000 je 760EC4AB :760EC277 8B45F4 mov eax, dword ptr [ebp-0C] :760EC27A 8D55E8 lea edx, dword ptr [ebp-18] :760EC27D 52 push edx :760EC27E FF75F0 push [ebp-10] :760EC281 8B08 mov ecx, dword ptr [eax] :760EC283 50 push eax :760EC284 FF91DC000000 call dword ptr [ecx+000000DC] :760EC28A 85C0 test eax, eax :760EC28C 0F8CCF010000 jl 760EC461 :760EC292 8B45E8 mov eax, dword ptr [ebp-18] :760EC295 3BC3 cmp eax, ebx :760EC297 0F84C4010000 je 760EC461 :760EC29D 8B08 mov ecx, dword ptr [eax] :760EC29F 8D55EC lea edx, dword ptr [ebp-14] :760EC2A2 52 push edx :760EC2A3 50 push eax :760EC2A4 FF5124 call [ecx+24] :760EC2A7 85C0 test eax, eax :760EC2A9 0F8C7B010000 jl 760EC42A :760EC2AF 8B45EC mov eax, dword ptr [ebp-14] :760EC2B2 3BC3 cmp eax, ebx :760EC2B4 0F8470010000 je 760EC42A :760EC2BA 8B08 mov ecx, dword ptr [eax] :760EC2BC 8D55F8 lea edx, dword ptr [ebp-08] :760EC2BF 52 push edx :760EC2C0 50 push eax :760EC2C1 FF5168 call [ecx+68] :760EC2C4 85C0 test eax, eax :760EC2C6 7D43 jge 760EC30B :760EC2C8 A184110E76 mov eax, dword ptr [760E1184] :760EC2CD F60002 test byte ptr [eax], 02 :760EC2D0 0F84BD000000 je 760EC393 :760EC2D6 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"GetVersionFromXMLFile" | :760EC2D8 68806A0E76 push 760E6A80 :760EC2DD 68E6030000 push 000003E6 :760EC2E2 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC2E7 FF1580110E76 Call dword ptr [760E1180] :760EC2ED 85C0 test eax, eax :760EC2EF 0F849E000000 je 760EC393 * Possible StringData Ref from Code Obj ->"Cannot get version text" | :760EC2F5 68686A0E76 push 760E6A68 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC45C(U) | :760EC2FA 6806030000 push 00000306 :760EC2FF E8270C0000 call 760ECF2B :760EC304 59 pop ecx :760EC305 59 pop ecx :760EC306 E988000000 jmp 760EC393 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC2C6(C) | :760EC30B A184110E76 mov eax, dword ptr [760E1184] * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC310 8B3580110E76 mov esi, dword ptr [760E1180] * Possible StringData Ref from Code Obj ->"GetVersionFromXMLFile" | :760EC316 BB806A0E76 mov ebx, 760E6A80 :760EC31B BF7CDA0F76 mov edi, 760FDA7C :760EC320 F60004 test byte ptr [eax], 04 :760EC323 7424 je 760EC349 :760EC325 6A04 push 00000004 :760EC327 53 push ebx :760EC328 68EA030000 push 000003EA :760EC32D 57 push edi :760EC32E FFD6 call esi :760EC330 85C0 test eax, eax :760EC332 7415 je 760EC349 :760EC334 FF75F8 push [ebp-08] * Possible StringData Ref from Code Obj ->"Version Text = [%S]" | :760EC337 68546A0E76 push 760E6A54 :760EC33C 6806030000 push 00000306 :760EC341 E8E50B0000 call 760ECF2B :760EC346 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC323(C), :760EC332(C) | :760EC349 FF75F8 push [ebp-08] :760EC34C 8D4DD0 lea ecx, dword ptr [ebp-30] :760EC34F E8120B0000 call 760ECE66 :760EC354 6A02 push 00000002 :760EC356 8D45D0 lea eax, dword ptr [ebp-30] :760EC359 6A00 push 00000000 :760EC35B 50 push eax :760EC35C 8D45D0 lea eax, dword ptr [ebp-30] :760EC35F 50 push eax * Reference To: OLEAUT32.VariantChangeType, Ord:000Ch | :760EC360 FF1580100E76 Call dword ptr [760E1080] :760EC366 85C0 test eax, eax :760EC368 747F je 760EC3E9 :760EC36A A184110E76 mov eax, dword ptr [760E1184] :760EC36F F60002 test byte ptr [eax], 02 :760EC372 741D je 760EC391 :760EC374 6A02 push 00000002 :760EC376 53 push ebx :760EC377 68F0030000 push 000003F0 :760EC37C 57 push edi :760EC37D FFD6 call esi :760EC37F 85C0 test eax, eax :760EC381 740E je 760EC391 * Possible StringData Ref from Code Obj ->"Cannot convert BSTR to int" | :760EC383 68386A0E76 push 760E6A38 :760EC388 6A00 push 00000000 :760EC38A E89C0B0000 call 760ECF2B :760EC38F 59 pop ecx :760EC390 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC372(C), :760EC381(C), :760EC3FC(C), :760EC40B(C), :760EC425(U) | :760EC391 33DB xor ebx, ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC2D0(C), :760EC2EF(C), :760EC306(U), :760EC432(C), :760EC451(C) |:760EC469(C), :760EC488(C), :760EC4A6(U), :760EC4B3(C), :760EC4D2(C) |:760EC4E8(C), :760EC507(C), :760EC520(U) | :760EC393 FF75F8 push [ebp-08] * Reference To: OLEAUT32.SysFreeString, Ord:0006h | :760EC396 8B3590100E76 mov esi, dword ptr [760E1090] :760EC39C FFD6 call esi * Reference To: OLEAUT32.VariantClear, Ord:0009h | :760EC39E 8B3DA0100E76 mov edi, dword ptr [760E10A0] :760EC3A4 8D45D0 lea eax, dword ptr [ebp-30] :760EC3A7 50 push eax :760EC3A8 FFD7 call edi :760EC3AA FF75F0 push [ebp-10] :760EC3AD FFD6 call esi :760EC3AF 8B45EC mov eax, dword ptr [ebp-14] :760EC3B2 3BC3 cmp eax, ebx :760EC3B4 7406 je 760EC3BC :760EC3B6 8B08 mov ecx, dword ptr [eax] :760EC3B8 50 push eax :760EC3B9 FF5108 call [ecx+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC3B4(C) | :760EC3BC 8B45E8 mov eax, dword ptr [ebp-18] :760EC3BF 3BC3 cmp eax, ebx :760EC3C1 7406 je 760EC3C9 :760EC3C3 8B08 mov ecx, dword ptr [eax] :760EC3C5 50 push eax :760EC3C6 FF5108 call [ecx+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC3C1(C) | :760EC3C9 8B45F4 mov eax, dword ptr [ebp-0C] :760EC3CC 3BC3 cmp eax, ebx :760EC3CE 7406 je 760EC3D6 :760EC3D0 8B08 mov ecx, dword ptr [eax] :760EC3D2 50 push eax :760EC3D3 FF5108 call [ecx+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC3CE(C) | :760EC3D6 8D45C0 lea eax, dword ptr [ebp-40] :760EC3D9 50 push eax :760EC3DA FFD7 call edi :760EC3DC 8B45E0 mov eax, dword ptr [ebp-20] :760EC3DF 8B55E4 mov edx, dword ptr [ebp-1C] :760EC3E2 5F pop edi :760EC3E3 5E pop esi :760EC3E4 5B pop ebx :760EC3E5 C9 leave :760EC3E6 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC368(C) | :760EC3E9 0FBF45D8 movsx eax, word ptr [ebp-28] :760EC3ED 99 cdq :760EC3EE 8945E0 mov dword ptr [ebp-20], eax :760EC3F1 A184110E76 mov eax, dword ptr [760E1184] :760EC3F6 8955E4 mov dword ptr [ebp-1C], edx :760EC3F9 F60004 test byte ptr [eax], 04 :760EC3FC 7493 je 760EC391 :760EC3FE 6A04 push 00000004 :760EC400 53 push ebx :760EC401 68F5030000 push 000003F5 :760EC406 57 push edi :760EC407 FFD6 call esi :760EC409 85C0 test eax, eax :760EC40B 7484 je 760EC391 :760EC40D FF75E4 push [ebp-1C] :760EC410 FF75E0 push [ebp-20] * Possible StringData Ref from Code Obj ->"Version Int64 = %I64x" | :760EC413 68206A0E76 push 760E6A20 :760EC418 6806030000 push 00000306 :760EC41D E8090B0000 call 760ECF2B :760EC422 83C410 add esp, 00000010 :760EC425 E967FFFFFF jmp 760EC391 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC2A9(C), :760EC2B4(C) | :760EC42A A184110E76 mov eax, dword ptr [760E1184] :760EC42F F60002 test byte ptr [eax], 02 :760EC432 0F845BFFFFFF je 760EC393 :760EC438 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"GetVersionFromXMLFile" | :760EC43A 68806A0E76 push 760E6A80 :760EC43F 68DE030000 push 000003DE :760EC444 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC449 FF1580110E76 Call dword ptr [760E1180] :760EC44F 85C0 test eax, eax :760EC451 0F843CFFFFFF je 760EC393 * Possible StringData Ref from Code Obj ->"Cannot get node in the node list" | :760EC457 68FC690E76 push 760E69FC :760EC45C E999FEFFFF jmp 760EC2FA * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC28C(C), :760EC297(C) | :760EC461 A184110E76 mov eax, dword ptr [760E1184] :760EC466 F60002 test byte ptr [eax], 02 :760EC469 0F8424FFFFFF je 760EC393 :760EC46F 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"GetVersionFromXMLFile" | :760EC471 68806A0E76 push 760E6A80 :760EC476 68D6030000 push 000003D6 :760EC47B 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC480 FF1580110E76 Call dword ptr [760E1180] :760EC486 85C0 test eax, eax :760EC488 0F8405FFFFFF je 760EC393 :760EC48E FF7508 push [ebp+08] :760EC491 FF75F0 push [ebp-10] * Possible StringData Ref from Code Obj ->"Cannot get [%S] in [%s]" | :760EC494 68E4690E76 push 760E69E4 :760EC499 6806030000 push 00000306 :760EC49E E8880A0000 call 760ECF2B :760EC4A3 83C410 add esp, 00000010 :760EC4A6 E9E8FEFFFF jmp 760EC393 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC267(C), :760EC271(C) | :760EC4AB A184110E76 mov eax, dword ptr [760E1184] :760EC4B0 F60002 test byte ptr [eax], 02 :760EC4B3 0F84DAFEFFFF je 760EC393 :760EC4B9 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"GetVersionFromXMLFile" | :760EC4BB 68806A0E76 push 760E6A80 :760EC4C0 68CE030000 push 000003CE :760EC4C5 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC4CA FF1580110E76 Call dword ptr [760E1180] :760EC4D0 85C0 test eax, eax :760EC4D2 0F84BBFEFFFF je 760EC393 :760EC4D8 56 push esi * Possible StringData Ref from Code Obj ->"Cannot load document: hr = %ld" | :760EC4D9 68C4690E76 push 760E69C4 :760EC4DE EB33 jmp 760EC513 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC239(C), :760EC244(C) | :760EC4E0 A184110E76 mov eax, dword ptr [760E1184] :760EC4E5 F60002 test byte ptr [eax], 02 :760EC4E8 0F84A5FEFFFF je 760EC393 :760EC4EE 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"GetVersionFromXMLFile" | :760EC4F0 68806A0E76 push 760E6A80 :760EC4F5 68C6030000 push 000003C6 :760EC4FA 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC4FF FF1580110E76 Call dword ptr [760E1180] :760EC505 85C0 test eax, eax :760EC507 0F8486FEFFFF je 760EC393 :760EC50D 56 push esi * Possible StringData Ref from Code Obj ->"CoCreateInstance failed: hr = " ->"%ld" | :760EC50E 68A0690E76 push 760E69A0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC4DE(U) | :760EC513 6806030000 push 00000306 :760EC518 E80E0A0000 call 760ECF2B :760EC51D 83C40C add esp, 0000000C :760EC520 E96EFEFFFF jmp 760EC393 * Referenced by a CALL at Address: |:760EC20F | :760EC525 55 push ebp :760EC526 8BEC mov ebp, esp :760EC528 53 push ebx :760EC529 56 push esi :760EC52A 33DB xor ebx, ebx :760EC52C 57 push edi :760EC52D 53 push ebx :760EC52E 53 push ebx :760EC52F FF750C push [ebp+0C] * Reference To: KERNEL32.MultiByteToWideChar, Ord:0202h | :760EC532 8B3D4C120E76 mov edi, dword ptr [760E124C] :760EC538 FF7508 push [ebp+08] :760EC53B 53 push ebx :760EC53C 53 push ebx :760EC53D FFD7 call edi :760EC53F 8BF0 mov esi, eax :760EC541 4E dec esi :760EC542 56 push esi :760EC543 53 push ebx * Reference To: OLEAUT32.SysAllocStringLen, Ord:0004h | :760EC544 FF1588100E76 Call dword ptr [760E1088] :760EC54A 3BC3 cmp eax, ebx :760EC54C 89450C mov dword ptr [ebp+0C], eax :760EC54F 740B je 760EC55C :760EC551 56 push esi :760EC552 50 push eax :760EC553 6AFF push FFFFFFFF :760EC555 FF7508 push [ebp+08] :760EC558 53 push ebx :760EC559 53 push ebx :760EC55A FFD7 call edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC54F(C) | :760EC55C 8B450C mov eax, dword ptr [ebp+0C] :760EC55F 5F pop edi :760EC560 5E pop esi :760EC561 5B pop ebx :760EC562 5D pop ebp :760EC563 C20800 ret 0008 * Referenced by a CALL at Address: |:760EC6D1 | :760EC566 53 push ebx :760EC567 56 push esi :760EC568 33DB xor ebx, ebx :760EC56A 57 push edi :760EC56B 53 push ebx * Reference To: OLE32.CoInitialize, Ord:0031h | :760EC56C FF15B0100E76 Call dword ptr [760E10B0] :760EC572 8BF0 mov esi, eax :760EC574 3BF3 cmp esi, ebx :760EC576 7D3A jge 760EC5B2 :760EC578 A184110E76 mov eax, dword ptr [760E1184] :760EC57D F60002 test byte ptr [eax], 02 :760EC580 7453 je 760EC5D5 :760EC582 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"IsFilelistNewer" | :760EC584 68B86A0E76 push 760E6AB8 :760EC589 680B040000 push 0000040B :760EC58E 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC593 FF1580110E76 Call dword ptr [760E1180] :760EC599 85C0 test eax, eax :760EC59B 7438 je 760EC5D5 :760EC59D 56 push esi * Possible StringData Ref from Code Obj ->"CoInitialize failed: hr = %ld" | :760EC59E 68986A0E76 push 760E6A98 :760EC5A3 6806030000 push 00000306 :760EC5A8 E87E090000 call 760ECF2B :760EC5AD 83C40C add esp, 0000000C :760EC5B0 EB23 jmp 760EC5D5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC576(C) | :760EC5B2 FF742410 push [esp+10] :760EC5B6 E823FCFFFF call 760EC1DE :760EC5BB 8BF8 mov edi, eax :760EC5BD 8BF2 mov esi, edx :760EC5BF FF742414 push [esp+14] :760EC5C3 E816FCFFFF call 760EC1DE :760EC5C8 3BF2 cmp esi, edx :760EC5CA 7F09 jg 760EC5D5 :760EC5CC 7C04 jl 760EC5D2 :760EC5CE 3BF8 cmp edi, eax :760EC5D0 7703 ja 760EC5D5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC5CC(C) | :760EC5D2 6A01 push 00000001 :760EC5D4 5B pop ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC580(C), :760EC59B(C), :760EC5B0(U), :760EC5CA(C), :760EC5D0(C) | * Reference To: OLE32.CoUninitialize, Ord:0059h | :760EC5D5 FF15AC100E76 Call dword ptr [760E10AC] :760EC5DB 5F pop edi :760EC5DC 8BC3 mov eax, ebx :760EC5DE 5E pop esi :760EC5DF 5B pop ebx :760EC5E0 C20800 ret 0008 * Referenced by a CALL at Address: |:760F6BF1 | Exported fn(): SRUpdateMonitoredListS - Ord:0019h :760EC5E3 55 push ebp :760EC5E4 8BEC mov ebp, esp :760EC5E6 81EC7C060000 sub esp, 0000067C :760EC5EC 8A1546170E76 mov dl, byte ptr [760E1746] :760EC5F2 53 push ebx :760EC5F3 56 push esi :760EC5F4 BEC2000000 mov esi, 000000C2 :760EC5F9 57 push edi :760EC5FA 8BCE mov ecx, esi :760EC5FC 33C0 xor eax, eax :760EC5FE 8DBD85F9FFFF lea edi, dword ptr [ebp+FFFFF985] :760EC604 889584F9FFFF mov byte ptr [ebp+FFFFF984], dl :760EC60A 889590FCFFFF mov byte ptr [ebp+FFFFFC90], dl :760EC610 F3 repz :760EC611 AB stosd :760EC612 66AB stosw :760EC614 AA stosb :760EC615 8BCE mov ecx, esi :760EC617 33C0 xor eax, eax :760EC619 8DBD91FCFFFF lea edi, dword ptr [ebp+FFFFFC91] :760EC61F BB4F050000 mov ebx, 0000054F :760EC624 F3 repz :760EC625 AB stosd :760EC626 66AB stosw :760EC628 8D4D9C lea ecx, dword ptr [ebp-64] :760EC62B AA stosb :760EC62C E86DA80000 call 760F6E9E :760EC631 8B7508 mov esi, dword ptr [ebp+08] :760EC634 33FF xor edi, edi :760EC636 3BF7 cmp esi, edi :760EC638 753E jne 760EC678 :760EC63A A184110E76 mov eax, dword ptr [760E1184] :760EC63F F60002 test byte ptr [eax], 02 :760EC642 742C je 760EC670 :760EC644 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SRUpdateMonitoredListS" | :760EC646 68CC6B0E76 push 760E6BCC :760EC64B 6831040000 push 00000431 :760EC650 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC655 FF1580110E76 Call dword ptr [760E1180] :760EC65B 85C0 test eax, eax :760EC65D 7411 je 760EC670 * Possible StringData Ref from Code Obj ->"Null filename" | :760EC65F 68BC6B0E76 push 760E6BBC :760EC664 6806030000 push 00000306 :760EC669 E8BD080000 call 760ECF2B :760EC66E 59 pop ecx :760EC66F 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC642(C), :760EC65D(C) | :760EC670 6A57 push 00000057 :760EC672 5B pop ebx :760EC673 E930020000 jmp 760EC8A8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC638(C) | :760EC678 8D8590FCFFFF lea eax, dword ptr [ebp+FFFFFC90] :760EC67E 680C030000 push 0000030C :760EC683 50 push eax * Possible StringData Ref from Code Obj ->"%windir%\system\restore\filelist.xml" | :760EC684 681C390E76 push 760E391C :760EC689 E8CA53FFFF call 760E1A58 :760EC68E 85C0 test eax, eax :760EC690 7537 jne 760EC6C9 :760EC692 A184110E76 mov eax, dword ptr [760E1184] :760EC697 F60002 test byte ptr [eax], 02 :760EC69A 0F8408020000 je 760EC8A8 :760EC6A0 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SRUpdateMonitoredListS" | :760EC6A2 68CC6B0E76 push 760E6BCC :760EC6A7 683A040000 push 0000043A :760EC6AC 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC6B1 FF1580110E76 Call dword ptr [760E1180] :760EC6B7 85C0 test eax, eax :760EC6B9 0F84E9010000 je 760EC8A8 * Possible StringData Ref from Code Obj ->"Cannot form protected list xml " ->"file path" | :760EC6BF 6888670E76 push 760E6788 :760EC6C4 E974010000 jmp 760EC83D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC690(C) | :760EC6C9 8D8590FCFFFF lea eax, dword ptr [ebp+FFFFFC90] :760EC6CF 56 push esi :760EC6D0 50 push eax :760EC6D1 E890FEFFFF call 760EC566 :760EC6D6 85C0 test eax, eax :760EC6D8 7540 jne 760EC71A :760EC6DA A184110E76 mov eax, dword ptr [760E1184] :760EC6DF F60002 test byte ptr [eax], 02 :760EC6E2 742C je 760EC710 :760EC6E4 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SRUpdateMonitoredListS" | :760EC6E6 68CC6B0E76 push 760E6BCC :760EC6EB 6841040000 push 00000441 :760EC6F0 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC6F5 FF1580110E76 Call dword ptr [760E1180] :760EC6FB 85C0 test eax, eax :760EC6FD 7411 je 760EC710 * Possible StringData Ref from Code Obj ->"Version of new XML file is older " ->"than the current one - not updating" | :760EC6FF 68746B0E76 push 760E6B74 :760EC704 6806030000 push 00000306 :760EC709 E81D080000 call 760ECF2B :760EC70E 59 pop ecx :760EC70F 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC6E2(C), :760EC6FD(C) | :760EC710 BB66060000 mov ebx, 00000666 :760EC715 E98E010000 jmp 760EC8A8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC6D8(C) | :760EC71A 57 push edi :760EC71B 57 push edi :760EC71C 57 push edi :760EC71D 8D8590FCFFFF lea eax, dword ptr [ebp+FFFFFC90] :760EC723 56 push esi :760EC724 50 push eax :760EC725 E8CCE9FFFF call 760EB0F6 :760EC72A 85C0 test eax, eax :760EC72C 7542 jne 760EC770 :760EC72E A184110E76 mov eax, dword ptr [760E1184] :760EC733 F60002 test byte ptr [eax], 02 :760EC736 742E je 760EC766 :760EC738 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SRUpdateMonitoredListS" | :760EC73A 68CC6B0E76 push 760E6BCC :760EC73F 684D040000 push 0000044D :760EC744 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC749 FF1580110E76 Call dword ptr [760E1180] :760EC74F 85C0 test eax, eax :760EC751 7413 je 760EC766 :760EC753 56 push esi * Possible StringData Ref from Code Obj ->"%s is not a signed and valid filelist" | :760EC754 684C6B0E76 push 760E6B4C :760EC759 6806030000 push 00000306 :760EC75E E8C8070000 call 760ECF2B :760EC763 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC736(C), :760EC751(C) | :760EC766 BBEE030000 mov ebx, 000003EE :760EC76B E938010000 jmp 760EC8A8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC72C(C) | :760EC770 8D8584F9FFFF lea eax, dword ptr [ebp+FFFFF984] :760EC776 50 push eax :760EC777 E8B1510000 call 760F192D :760EC77C 85C0 test eax, eax :760EC77E 7537 jne 760EC7B7 :760EC780 A184110E76 mov eax, dword ptr [760E1184] :760EC785 F60002 test byte ptr [eax], 02 :760EC788 0F841A010000 je 760EC8A8 :760EC78E 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SRUpdateMonitoredListS" | :760EC790 68CC6B0E76 push 760E6BCC :760EC795 6856040000 push 00000456 :760EC79A 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC79F FF1580110E76 Call dword ptr [760E1180] :760EC7A5 85C0 test eax, eax :760EC7A7 0F84FB000000 je 760EC8A8 * Possible StringData Ref from Code Obj ->"Cannot form vxd dat file path" | :760EC7AD 682C6B0E76 push 760E6B2C :760EC7B2 E986000000 jmp 760EC83D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC77E(C) | :760EC7B7 8D8584F9FFFF lea eax, dword ptr [ebp+FFFFF984] :760EC7BD 8D4D9C lea ecx, dword ptr [ebp-64] :760EC7C0 50 push eax :760EC7C1 56 push esi :760EC7C2 E857AD0000 call 760F751E :760EC7C7 85C0 test eax, eax :760EC7C9 7534 jne 760EC7FF :760EC7CB A184110E76 mov eax, dword ptr [760E1184] :760EC7D0 F60002 test byte ptr [eax], 02 :760EC7D3 0F84CF000000 je 760EC8A8 :760EC7D9 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SRUpdateMonitoredListS" | :760EC7DB 68CC6B0E76 push 760E6BCC :760EC7E0 685D040000 push 0000045D :760EC7E5 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC7EA FF1580110E76 Call dword ptr [760E1180] :760EC7F0 85C0 test eax, eax :760EC7F2 0F84B0000000 je 760EC8A8 * Possible StringData Ref from Code Obj ->"Vxdmon.dat creation failed" | :760EC7F8 68106B0E76 push 760E6B10 :760EC7FD EB3E jmp 760EC83D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC7C9(C) | :760EC7FF 57 push edi :760EC800 6800B00F76 push 760FB000 :760EC805 56 push esi * Reference To: SfpDll.SfpSyncDb | :760EC806 E8D972FFFF call 760E3AE4 :760EC80B 85C0 test eax, eax :760EC80D 753C jne 760EC84B :760EC80F A184110E76 mov eax, dword ptr [760E1184] :760EC814 F60002 test byte ptr [eax], 02 :760EC817 0F848B000000 je 760EC8A8 :760EC81D 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SRUpdateMonitoredListS" | :760EC81F 68CC6B0E76 push 760E6BCC :760EC824 6865040000 push 00000465 :760EC829 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC82E FF1580110E76 Call dword ptr [760E1180] :760EC834 85C0 test eax, eax :760EC836 7470 je 760EC8A8 * Possible StringData Ref from Code Obj ->"Creating new database file failed" | :760EC838 68EC6A0E76 push 760E6AEC * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC6C4(U), :760EC7B2(U), :760EC7FD(U) | :760EC83D 6806030000 push 00000306 :760EC842 E8E4060000 call 760ECF2B :760EC847 59 pop ecx :760EC848 59 pop ecx :760EC849 EB5D jmp 760EC8A8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC80D(C) | :760EC84B 8D8590FCFFFF lea eax, dword ptr [ebp+FFFFFC90] :760EC851 57 push edi :760EC852 50 push eax :760EC853 56 push esi * Reference To: KERNEL32.CopyFileA, Ord:002Bh | :760EC854 FF1548120E76 Call dword ptr [760E1248] :760EC85A 85C0 test eax, eax :760EC85C 7548 jne 760EC8A6 :760EC85E A184110E76 mov eax, dword ptr [760E1184] :760EC863 F60002 test byte ptr [eax], 02 :760EC866 7440 je 760EC8A8 :760EC868 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SRUpdateMonitoredListS" | :760EC86A 68CC6B0E76 push 760E6BCC :760EC86F 6875040000 push 00000475 :760EC874 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC879 FF1580110E76 Call dword ptr [760E1180] :760EC87F 85C0 test eax, eax :760EC881 7425 je 760EC8A8 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EC883 FF15A0110E76 Call dword ptr [760E11A0] :760EC889 50 push eax :760EC88A 8D8590FCFFFF lea eax, dword ptr [ebp+FFFFFC90] :760EC890 50 push eax :760EC891 56 push esi * Possible StringData Ref from Code Obj ->"Error copying %s to %s: error=%ld" | :760EC892 68C86A0E76 push 760E6AC8 :760EC897 6806030000 push 00000306 :760EC89C E88A060000 call 760ECF2B :760EC8A1 83C414 add esp, 00000014 :760EC8A4 EB02 jmp 760EC8A8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC85C(C) | :760EC8A6 33DB xor ebx, ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC673(U), :760EC69A(C), :760EC6B9(C), :760EC715(U), :760EC76B(U) |:760EC788(C), :760EC7A7(C), :760EC7D3(C), :760EC7F2(C), :760EC817(C) |:760EC836(C), :760EC849(U), :760EC866(C), :760EC881(C), :760EC8A4(U) | :760EC8A8 8D4D9C lea ecx, dword ptr [ebp-64] :760EC8AB E853A60000 call 760F6F03 :760EC8B0 5F pop edi :760EC8B1 8BC3 mov eax, ebx :760EC8B3 5E pop esi :760EC8B4 5B pop ebx :760EC8B5 C9 leave :760EC8B6 C20400 ret 0004 Exported fn(): SFPCopyCatalog - Ord:000Fh :760EC8B9 55 push ebp :760EC8BA 8BEC mov ebp, esp :760EC8BC 81EC04090000 sub esp, 00000904 :760EC8C2 53 push ebx :760EC8C3 8B5D08 mov ebx, dword ptr [ebp+08] :760EC8C6 56 push esi :760EC8C7 57 push edi :760EC8C8 BF4F050000 mov edi, 0000054F :760EC8CD 53 push ebx :760EC8CE 8BF7 mov esi, edi :760EC8D0 E8666FFFFF call 760E383B :760EC8D5 85C0 test eax, eax :760EC8D7 7540 jne 760EC919 :760EC8D9 A184110E76 mov eax, dword ptr [760E1184] :760EC8DE F60002 test byte ptr [eax], 02 :760EC8E1 742E je 760EC911 :760EC8E3 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpCopyCatalog" | :760EC8E5 68B06C0E76 push 760E6CB0 :760EC8EA 6891040000 push 00000491 :760EC8EF 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC8F4 FF1580110E76 Call dword ptr [760E1180] :760EC8FA 85C0 test eax, eax :760EC8FC 7413 je 760EC911 :760EC8FE 53 push ebx * Possible StringData Ref from Code Obj ->"File: %s does not exist" | :760EC8FF 68986C0E76 push 760E6C98 :760EC904 6806030000 push 00000306 :760EC909 E81D060000 call 760ECF2B :760EC90E 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC8E1(C), :760EC8FC(C), :760EC92A(C), :760EC945(C), :760EC958(U) | :760EC911 6A57 push 00000057 :760EC913 5E pop esi :760EC914 E937020000 jmp 760ECB50 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC8D7(C) | :760EC919 E80655FFFF call 760E1E24 :760EC91E 85C0 test eax, eax :760EC920 7538 jne 760EC95A :760EC922 A184110E76 mov eax, dword ptr [760E1184] :760EC927 F60002 test byte ptr [eax], 02 :760EC92A 74E5 je 760EC911 :760EC92C 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpCopyCatalog" | :760EC92E 68B06C0E76 push 760E6CB0 :760EC933 6898040000 push 00000498 :760EC938 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC93D FF1580110E76 Call dword ptr [760E1180] :760EC943 85C0 test eax, eax :760EC945 74CA je 760EC911 * Possible StringData Ref from Code Obj ->"Cannot create SFP directory" | :760EC947 6838680E76 push 760E6838 :760EC94C 6806030000 push 00000306 :760EC951 E8D5050000 call 760ECF2B :760EC956 59 pop ecx :760EC957 59 pop ecx :760EC958 EBB7 jmp 760EC911 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC920(C) | :760EC95A 8D85FCFAFFFF lea eax, dword ptr [ebp+FFFFFAFC] :760EC960 6800040000 push 00000400 :760EC965 50 push eax * Possible StringData Ref from Code Obj ->"%windir%\system\sfp\tempcats" | :760EC966 68F41E0E76 push 760E1EF4 * Reference To: KERNEL32.ExpandEnvironmentStringsA, Ord:008Fh | :760EC96B FF1574120E76 Call dword ptr [760E1274] :760EC971 85C0 test eax, eax :760EC973 754F jne 760EC9C4 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EC975 FF15A0110E76 Call dword ptr [760E11A0] :760EC97B 8BF0 mov esi, eax :760EC97D A184110E76 mov eax, dword ptr [760E1184] :760EC982 F60002 test byte ptr [eax], 02 :760EC985 742E je 760EC9B5 :760EC987 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpCopyCatalog" | :760EC989 68B06C0E76 push 760E6CB0 :760EC98E 68A2040000 push 000004A2 :760EC993 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EC998 FF1580110E76 Call dword ptr [760E1180] :760EC99E 85C0 test eax, eax :760EC9A0 7413 je 760EC9B5 :760EC9A2 56 push esi * Possible StringData Ref from Code Obj ->"ExpandEnvironmentStrings failed " ->"EC=%d" | :760EC9A3 68706C0E76 push 760E6C70 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECA19(U) | :760EC9A8 6806030000 push 00000306 :760EC9AD E879050000 call 760ECF2B :760EC9B2 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC985(C), :760EC9A0(C), :760EC9F6(C), :760ECA11(C) | :760EC9B5 85F6 test esi, esi :760EC9B7 0F8493010000 je 760ECB50 :760EC9BD 8BF7 mov esi, edi :760EC9BF E98C010000 jmp 760ECB50 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EC973(C) | :760EC9C4 8D85FCFAFFFF lea eax, dword ptr [ebp+FFFFFAFC] :760EC9CA 50 push eax :760EC9CB E8DC52FFFF call 760E1CAC :760EC9D0 85C0 test eax, eax :760EC9D2 7547 jne 760ECA1B :760EC9D4 50 push eax :760EC9D5 8D85FCFAFFFF lea eax, dword ptr [ebp+FFFFFAFC] :760EC9DB 50 push eax * Reference To: KERNEL32.CreateDirectoryA, Ord:0030h | :760EC9DC FF1550120E76 Call dword ptr [760E1250] :760EC9E2 85C0 test eax, eax :760EC9E4 7535 jne 760ECA1B * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EC9E6 FF15A0110E76 Call dword ptr [760E11A0] :760EC9EC 8BF0 mov esi, eax :760EC9EE A184110E76 mov eax, dword ptr [760E1184] :760EC9F3 F60002 test byte ptr [eax], 02 :760EC9F6 74BD je 760EC9B5 :760EC9F8 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpCopyCatalog" | :760EC9FA 68B06C0E76 push 760E6CB0 :760EC9FF 68B1040000 push 000004B1 :760ECA04 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ECA09 FF1580110E76 Call dword ptr [760E1180] :760ECA0F 85C0 test eax, eax :760ECA11 74A2 je 760EC9B5 :760ECA13 56 push esi * Possible StringData Ref from Code Obj ->"Error Creating Catalog Temp Directory " ->"%d" | :760ECA14 68446C0E76 push 760E6C44 :760ECA19 EB8D jmp 760EC9A8 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC9D2(C), :760EC9E4(C) | :760ECA1B 8BFB mov edi, ebx :760ECA1D 83C9FF or ecx, FFFFFFFF :760ECA20 33C0 xor eax, eax :760ECA22 F2 repnz :760ECA23 AE scasb :760ECA24 F7D1 not ecx :760ECA26 49 dec ecx :760ECA27 51 push ecx :760ECA28 53 push ebx :760ECA29 E8C662FFFF call 760E2CF4 :760ECA2E 85C0 test eax, eax :760ECA30 7543 jne 760ECA75 :760ECA32 A184110E76 mov eax, dword ptr [760E1184] :760ECA37 F60002 test byte ptr [eax], 02 :760ECA3A 742F je 760ECA6B :760ECA3C 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpCopyCatalog" | :760ECA3E 68B06C0E76 push 760E6CB0 :760ECA43 68BD040000 push 000004BD :760ECA48 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ECA4D FF1580110E76 Call dword ptr [760E1180] :760ECA53 85C0 test eax, eax :760ECA55 7414 je 760ECA6B :760ECA57 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error getting short pathname for " ->"the catalog file." | :760ECA59 68106C0E76 push 760E6C10 :760ECA5E 6806030000 push 00000306 :760ECA63 E8C3040000 call 760ECF2B :760ECA68 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECA3A(C), :760ECA55(C), :760ECAEA(U) | :760ECA6B BE4F050000 mov esi, 0000054F :760ECA70 E9DB000000 jmp 760ECB50 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECA30(C) | :760ECA75 50 push eax :760ECA76 8D85FCFAFFFF lea eax, dword ptr [ebp+FFFFFAFC] :760ECA7C 50 push eax :760ECA7D 8D85FCF6FFFF lea eax, dword ptr [ebp+FFFFF6FC] :760ECA83 68442E0E76 push 760E2E44 :760ECA88 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760ECA89 FF1530100E76 Call dword ptr [760E1030] :760ECA8F 83C410 add esp, 00000010 :760ECA92 8D85FCF6FFFF lea eax, dword ptr [ebp+FFFFF6FC] :760ECA98 6A00 push 00000000 :760ECA9A 50 push eax :760ECA9B 53 push ebx * Reference To: KERNEL32.CopyFileA, Ord:002Bh | :760ECA9C FF1548120E76 Call dword ptr [760E1248] :760ECAA2 85C0 test eax, eax :760ECAA4 7549 jne 760ECAEF * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ECAA6 FF15A0110E76 Call dword ptr [760E11A0] :760ECAAC 8BF0 mov esi, eax :760ECAAE A184110E76 mov eax, dword ptr [760E1184] :760ECAB3 F60002 test byte ptr [eax], 02 :760ECAB6 742E je 760ECAE6 :760ECAB8 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpCopyCatalog" | :760ECABA 68B06C0E76 push 760E6CB0 :760ECABF 68CA040000 push 000004CA :760ECAC4 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ECAC9 FF1580110E76 Call dword ptr [760E1180] :760ECACF 85C0 test eax, eax :760ECAD1 7413 je 760ECAE6 :760ECAD3 56 push esi * Possible StringData Ref from Code Obj ->"Error copying catalog to final " ->"location %d" | :760ECAD4 68E46B0E76 push 760E6BE4 :760ECAD9 6806030000 push 00000306 :760ECADE E848040000 call 760ECF2B :760ECAE3 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECAB6(C), :760ECAD1(C) | :760ECAE6 85F6 test esi, esi :760ECAE8 7466 je 760ECB50 :760ECAEA E97CFFFFFF jmp 760ECA6B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECAA4(C) | :760ECAEF 8D85FCFEFFFF lea eax, dword ptr [ebp+FFFFFEFC] :760ECAF5 6804010000 push 00000104 :760ECAFA 50 push eax * Possible StringData Ref from Code Obj ->"%windir%\system\sfp\sfpdb.sfp" | :760ECAFB 687C1A0E76 push 760E1A7C :760ECB00 E8534FFFFF call 760E1A58 :760ECB05 85C0 test eax, eax :760ECB07 7538 jne 760ECB41 :760ECB09 A184110E76 mov eax, dword ptr [760E1184] :760ECB0E F60002 test byte ptr [eax], 02 :760ECB11 743D je 760ECB50 :760ECB13 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpCopyCatalog" | :760ECB15 68B06C0E76 push 760E6CB0 :760ECB1A 68D9040000 push 000004D9 :760ECB1F 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ECB24 FF1580110E76 Call dword ptr [760E1180] :760ECB2A 85C0 test eax, eax :760ECB2C 7422 je 760ECB50 * Possible StringData Ref from Code Obj ->"Cannot form sfpdb file path" | :760ECB2E 6878680E76 push 760E6878 :760ECB33 6806030000 push 00000306 :760ECB38 E8EE030000 call 760ECF2B :760ECB3D 59 pop ecx :760ECB3E 59 pop ecx :760ECB3F EB0F jmp 760ECB50 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECB07(C) | :760ECB41 8D85FCFEFFFF lea eax, dword ptr [ebp+FFFFFEFC] :760ECB47 50 push eax * Reference To: KERNEL32.DeleteFileA, Ord:005Ch | :760ECB48 FF1570120E76 Call dword ptr [760E1270] :760ECB4E 33F6 xor esi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EC914(U), :760EC9B7(C), :760EC9BF(U), :760ECA70(U), :760ECAE8(C) |:760ECB11(C), :760ECB2C(C), :760ECB3F(U) | :760ECB50 8BC6 mov eax, esi :760ECB52 5F pop edi :760ECB53 5E pop esi :760ECB54 5B pop ebx :760ECB55 C9 leave :760ECB56 C20400 ret 0004 :760ECB59 55 push ebp :760ECB5A 8BEC mov ebp, esp :760ECB5C 8B450C mov eax, dword ptr [ebp+0C] :760ECB5F 83E810 sub eax, 00000010 :760ECB62 742B je 760ECB8F :760ECB64 48 dec eax :760ECB65 48 dec eax :760ECB66 7427 je 760ECB8F :760ECB68 2DFE000000 sub eax, 000000FE :760ECB6D 741B je 760ECB8A :760ECB6F 48 dec eax :760ECB70 7528 jne 760ECB9A :760ECB72 837D1003 cmp dword ptr [ebp+10], 00000003 :760ECB76 7222 jb 760ECB9A :760ECB78 837D1004 cmp dword ptr [ebp+10], 00000004 :760ECB7C 771C ja 760ECB9A :760ECB7E FF7510 push [ebp+10] :760ECB81 FF7508 push [ebp+08] * Reference To: USER32.EndDialog, Ord:00BBh | :760ECB84 FF15A0120E76 Call dword ptr [760E12A0] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECB6D(C) | :760ECB8A 6A01 push 00000001 :760ECB8C 58 pop eax :760ECB8D EB0D jmp 760ECB9C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECB62(C), :760ECB66(C) | :760ECB8F 6A04 push 00000004 :760ECB91 FF7508 push [ebp+08] * Reference To: USER32.EndDialog, Ord:00BBh | :760ECB94 FF15A0120E76 Call dword ptr [760E12A0] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECB70(C), :760ECB76(C), :760ECB7C(C) | :760ECB9A 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECB8D(U) | :760ECB9C 5D pop ebp :760ECB9D C21000 ret 0010 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2539(C) | :760ECBA0 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SfpRebootIfNecessary" | :760ECBA2 68606D0E76 push 760E6D60 :760ECBA7 6828050000 push 00000528 :760ECBAC 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ECBB1 FF1580110E76 Call dword ptr [760E1180] :760ECBB7 85C0 test eax, eax :760ECBB9 0F848059FFFF je 760E253F * Possible StringData Ref from Code Obj ->"Don't need to reboot" | :760ECBBF 68486D0E76 push 760E6D48 :760ECBC4 E9AB000000 jmp 760ECC74 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E252B(C) | :760ECBC9 A184E10F76 mov eax, dword ptr [760FE184] :760ECBCE 3BC6 cmp eax, esi :760ECBD0 7564 jne 760ECC36 :760ECBD2 FF35B8DE0F76 push dword ptr [760FDEB8] :760ECBD8 56 push esi :760ECBD9 6803001F00 push 001F0003 * Reference To: KERNEL32.OpenEventA, Ord:0208h | :760ECBDE FF155C120E76 Call dword ptr [760E125C] :760ECBE4 3BC6 cmp eax, esi :760ECBE6 A384E10F76 mov dword ptr [760FE184], eax :760ECBEB 7549 jne 760ECC36 :760ECBED A184110E76 mov eax, dword ptr [760E1184] :760ECBF2 F60002 test byte ptr [eax], 02 :760ECBF5 7436 je 760ECC2D :760ECBF7 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpRebootIfNecessary" | :760ECBF9 68606D0E76 push 760E6D60 :760ECBFE 6835050000 push 00000535 :760ECC03 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ECC08 FF1580110E76 Call dword ptr [760E1180] :760ECC0E 85C0 test eax, eax :760ECC10 741B je 760ECC2D * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ECC12 FF15A0110E76 Call dword ptr [760E11A0] :760ECC18 50 push eax :760ECC19 FF35B8DE0F76 push dword ptr [760FDEB8] * Possible StringData Ref from Code Obj ->"OpenEvent failed for: %s; error=%ld" | :760ECC1F 6840640E76 push 760E6440 :760ECC24 56 push esi :760ECC25 E801030000 call 760ECF2B :760ECC2A 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECBF5(C), :760ECC10(C) | :760ECC2D 89742408 mov dword ptr [esp+08], esi :760ECC31 E90959FFFF jmp 760E253F * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECBD0(C), :760ECBEB(C) | :760ECC36 56 push esi :760ECC37 50 push eax * Reference To: KERNEL32.WaitForSingleObject, Ord:02FDh | :760ECC38 FF1538120E76 Call dword ptr [760E1238] :760ECC3E 85C0 test eax, eax :760ECC40 7543 jne 760ECC85 :760ECC42 A184110E76 mov eax, dword ptr [760E1184] :760ECC47 F60004 test byte ptr [eax], 04 :760ECC4A 0F84EF58FFFF je 760E253F :760ECC50 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SfpRebootIfNecessary" | :760ECC52 68606D0E76 push 760E6D60 :760ECC57 6840050000 push 00000540 :760ECC5C 687CDA0F76 push 760FDA7C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ECC61 FF1580110E76 Call dword ptr [760E1180] :760ECC67 85C0 test eax, eax :760ECC69 0F84D058FFFF je 760E253F * Possible StringData Ref from Code Obj ->"This is shutdown - suppressing " ->"dialog" | :760ECC6F 68206D0E76 push 760E6D20 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECBC4(U) | :760ECC74 6806030000 push 00000306 :760ECC79 E8AD020000 call 760ECF2B :760ECC7E 59 pop ecx :760ECC7F 59 pop ecx :760ECC80 E9BA58FFFF jmp 760E253F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECC40(C) | :760ECC85 A184110E76 mov eax, dword ptr [760E1184] * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ECC8A 8B3580110E76 mov esi, dword ptr [760E1180] :760ECC90 53 push ebx :760ECC91 57 push edi :760ECC92 F60004 test byte ptr [eax], 04 * Possible StringData Ref from Code Obj ->"SfpRebootIfNecessary" | :760ECC95 BB606D0E76 mov ebx, 760E6D60 :760ECC9A BF7CDA0F76 mov edi, 760FDA7C :760ECC9F 7420 je 760ECCC1 :760ECCA1 6A04 push 00000004 :760ECCA3 53 push ebx :760ECCA4 6845050000 push 00000545 :760ECCA9 57 push edi :760ECCAA FFD6 call esi :760ECCAC 85C0 test eax, eax :760ECCAE 7411 je 760ECCC1 * Possible StringData Ref from Code Obj ->"Rebooting the system" | :760ECCB0 68086D0E76 push 760E6D08 :760ECCB5 6806030000 push 00000306 :760ECCBA E86C020000 call 760ECF2B :760ECCBF 59 pop ecx :760ECCC0 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECC9F(C), :760ECCAE(C) | :760ECCC1 FF35B4DE0F76 push dword ptr [760FDEB4] * Reference To: KERNEL32.LoadLibraryA, Ord:01DFh | :760ECCC7 FF157C120E76 Call dword ptr [760E127C] :760ECCCD 8BE8 mov ebp, eax :760ECCCF 85ED test ebp, ebp :760ECCD1 7535 jne 760ECD08 :760ECCD3 A184110E76 mov eax, dword ptr [760E1184] :760ECCD8 F60002 test byte ptr [eax], 02 :760ECCDB 7424 je 760ECD01 :760ECCDD 6A02 push 00000002 :760ECCDF 53 push ebx :760ECCE0 684C050000 push 0000054C :760ECCE5 57 push edi :760ECCE6 FFD6 call esi :760ECCE8 85C0 test eax, eax :760ECCEA 7415 je 760ECD01 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ECCEC FF15A0110E76 Call dword ptr [760E11A0] :760ECCF2 50 push eax * Possible StringData Ref from Code Obj ->"Error 0x%x: cannot get instance " ->"handle" | :760ECCF3 68E06C0E76 push 760E6CE0 :760ECCF8 55 push ebp :760ECCF9 E82D020000 call 760ECF2B :760ECCFE 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECCDB(C), :760ECCEA(C) | :760ECD01 8364241000 and dword ptr [esp+10], 00000000 :760ECD06 EB5B jmp 760ECD63 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECCD1(C) | :760ECD08 6A00 push 00000000 :760ECD0A 6859CB0E76 push 760ECB59 :760ECD0F 6A00 push 00000000 :760ECD11 6A65 push 00000065 :760ECD13 55 push ebp * Reference To: USER32.DialogBoxParamA, Ord:0095h | :760ECD14 FF1590120E76 Call dword ptr [760E1290] :760ECD1A 83F803 cmp eax, 00000003 :760ECD1D 7544 jne 760ECD63 :760ECD1F 6A00 push 00000000 :760ECD21 6A02 push 00000002 * Reference To: USER32.ExitWindowsEx, Ord:00D5h | :760ECD23 FF159C120E76 Call dword ptr [760E129C] :760ECD29 85C0 test eax, eax :760ECD2B 89442410 mov dword ptr [esp+10], eax :760ECD2F 7532 jne 760ECD63 :760ECD31 A184110E76 mov eax, dword ptr [760E1184] :760ECD36 F60002 test byte ptr [eax], 02 :760ECD39 7428 je 760ECD63 :760ECD3B 6A02 push 00000002 :760ECD3D 53 push ebx :760ECD3E 685E050000 push 0000055E :760ECD43 57 push edi :760ECD44 FFD6 call esi :760ECD46 85C0 test eax, eax :760ECD48 7419 je 760ECD63 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ECD4A FF15A0110E76 Call dword ptr [760E11A0] :760ECD50 50 push eax * Possible StringData Ref from Code Obj ->"Error 0x%x shutting down system" | :760ECD51 68C06C0E76 push 760E6CC0 :760ECD56 6806030000 push 00000306 :760ECD5B E8CB010000 call 760ECF2B :760ECD60 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECD06(U), :760ECD1D(C), :760ECD2F(C), :760ECD39(C), :760ECD48(C) | :760ECD63 5F pop edi :760ECD64 5B pop ebx :760ECD65 85ED test ebp, ebp :760ECD67 0F84D257FFFF je 760E253F :760ECD6D 55 push ebp * Reference To: KERNEL32.FreeLibrary, Ord:00C3h | :760ECD6E FF1578120E76 Call dword ptr [760E1278] :760ECD74 E9C657FFFF jmp 760E253F Exported fn(): SfpShutDown - Ord:0013h :760ECD79 51 push ecx :760ECD7A A188E50F76 mov eax, dword ptr [760FE588] :760ECD7F C7042401000000 mov dword ptr [esp], 00000001 :760ECD86 85C0 test eax, eax :760ECD88 740C je 760ECD96 :760ECD8A 6810270000 push 00002710 :760ECD8F 50 push eax * Reference To: KERNEL32.WaitForSingleObject, Ord:02FDh | :760ECD90 FF1538120E76 Call dword ptr [760E1238] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECD88(C) | :760ECD96 53 push ebx :760ECD97 55 push ebp :760ECD98 56 push esi :760ECD99 57 push edi :760ECD9A E8D5920000 call 760F6074 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ECD9F 8B3580110E76 mov esi, dword ptr [760E1180] :760ECDA5 6A02 push 00000002 :760ECDA7 85C0 test eax, eax :760ECDA9 5B pop ebx * Possible StringData Ref from Code Obj ->"SfpShutDown" | :760ECDAA BDD06D0E76 mov ebp, 760E6DD0 :760ECDAF BF7CDA0F76 mov edi, 760FDA7C :760ECDB4 752D jne 760ECDE3 :760ECDB6 A184110E76 mov eax, dword ptr [760E1184] :760ECDBB 8364241000 and dword ptr [esp+10], 00000000 :760ECDC0 8418 test byte ptr [eax], bl :760ECDC2 741F je 760ECDE3 :760ECDC4 53 push ebx :760ECDC5 55 push ebp :760ECDC6 6880050000 push 00000580 :760ECDCB 57 push edi :760ECDCC FFD6 call esi :760ECDCE 85C0 test eax, eax :760ECDD0 7411 je 760ECDE3 * Possible StringData Ref from Code Obj ->"Cannot shutdown rpc server" | :760ECDD2 68B46D0E76 push 760E6DB4 :760ECDD7 6806030000 push 00000306 :760ECDDC E84A010000 call 760ECF2B :760ECDE1 59 pop ecx :760ECDE2 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECDB4(C), :760ECDC2(C), :760ECDD0(C) | :760ECDE3 E8F1010000 call 760ECFD9 :760ECDE8 85C0 test eax, eax :760ECDEA 752C jne 760ECE18 :760ECDEC 21442410 and dword ptr [esp+10], eax :760ECDF0 A184110E76 mov eax, dword ptr [760E1184] :760ECDF5 8418 test byte ptr [eax], bl :760ECDF7 741F je 760ECE18 :760ECDF9 53 push ebx :760ECDFA 55 push ebp :760ECDFB 6886050000 push 00000586 :760ECE00 57 push edi :760ECE01 FFD6 call esi :760ECE03 85C0 test eax, eax :760ECE05 7411 je 760ECE18 * Possible StringData Ref from Code Obj ->"Cannot close crypto db context" | :760ECE07 68946D0E76 push 760E6D94 :760ECE0C 6806030000 push 00000306 :760ECE11 E815010000 call 760ECF2B :760ECE16 59 pop ecx :760ECE17 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECDEA(C), :760ECDF7(C), :760ECE05(C) | * Reference To: SfpDll.SfpCleanupSfpDb | :760ECE18 E8630E0000 call 760EDC80 :760ECE1D 85C0 test eax, eax :760ECE1F 752C jne 760ECE4D :760ECE21 21442410 and dword ptr [esp+10], eax :760ECE25 A184110E76 mov eax, dword ptr [760E1184] :760ECE2A 8418 test byte ptr [eax], bl :760ECE2C 741F je 760ECE4D :760ECE2E 53 push ebx :760ECE2F 55 push ebp :760ECE30 688C050000 push 0000058C :760ECE35 57 push edi :760ECE36 FFD6 call esi :760ECE38 85C0 test eax, eax :760ECE3A 7411 je 760ECE4D * Possible StringData Ref from Code Obj ->"Error cleaning up sfp db" | :760ECE3C 68786D0E76 push 760E6D78 :760ECE41 6806030000 push 00000306 :760ECE46 E8E0000000 call 760ECF2B :760ECE4B 59 pop ecx :760ECE4C 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECE1F(C), :760ECE2C(C), :760ECE3A(C) | :760ECE4D A1D0D80F76 mov eax, dword ptr [760FD8D0] :760ECE52 5F pop edi :760ECE53 5E pop esi :760ECE54 5D pop ebp :760ECE55 85C0 test eax, eax :760ECE57 5B pop ebx :760ECE58 7407 je 760ECE61 :760ECE5A 50 push eax * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760ECE5B FF1534120E76 Call dword ptr [760E1234] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECE58(C) | :760ECE61 8B0424 mov eax, dword ptr [esp] :760ECE64 59 pop ecx :760ECE65 C3 ret * Referenced by a CALL at Address: |:760EC34F | :760ECE66 56 push esi :760ECE67 8BF1 mov esi, ecx :760ECE69 56 push esi * Reference To: OLEAUT32.VariantClear, Ord:0009h | :760ECE6A FF15A0100E76 Call dword ptr [760E10A0] :760ECE70 85C0 test eax, eax :760ECE72 7D08 jge 760ECE7C :760ECE74 66C7060A00 mov word ptr [esi], 000A :760ECE79 894608 mov dword ptr [esi+08], eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECE72(C) | :760ECE7C FF742408 push [esp+08] :760ECE80 66C7060800 mov word ptr [esi], 0008 * Reference To: OLEAUT32.SysAllocString, Ord:0002h | :760ECE85 FF1584100E76 Call dword ptr [760E1084] :760ECE8B 85C0 test eax, eax :760ECE8D 894608 mov dword ptr [esi+08], eax :760ECE90 7512 jne 760ECEA4 :760ECE92 39442408 cmp dword ptr [esp+08], eax :760ECE96 740C je 760ECEA4 :760ECE98 66C7060A00 mov word ptr [esi], 000A :760ECE9D C746080E000780 mov [esi+08], 8007000E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECE90(C), :760ECE96(C) | :760ECEA4 8BC6 mov eax, esi :760ECEA6 5E pop esi :760ECEA7 C20400 ret 0004 * Referenced by a CALL at Address: |:760EC1F3 | :760ECEAA 55 push ebp :760ECEAB 8BEC mov ebp, esp :760ECEAD 53 push ebx :760ECEAE 56 push esi :760ECEAF 57 push edi :760ECEB0 8BF9 mov edi, ecx :760ECEB2 57 push edi * Reference To: OLEAUT32.VariantClear, Ord:0009h | :760ECEB3 FF15A0100E76 Call dword ptr [760E10A0] :760ECEB9 33DB xor ebx, ebx :760ECEBB 3BC3 cmp eax, ebx :760ECEBD 7D08 jge 760ECEC7 :760ECEBF 66C7070A00 mov word ptr [edi], 000A :760ECEC4 894708 mov dword ptr [edi+08], eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECEBD(C) | :760ECEC7 395D08 cmp dword ptr [ebp+08], ebx :760ECECA 66C7070800 mov word ptr [edi], 0008 :760ECECF 742F je 760ECF00 :760ECED1 FF7508 push [ebp+08] * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760ECED4 FF1554120E76 Call dword ptr [760E1254] :760ECEDA 8BF0 mov esi, eax :760ECEDC 46 inc esi :760ECEDD 8D0436 lea eax, dword ptr [esi+esi] :760ECEE0 83C003 add eax, 00000003 :760ECEE3 24FC and al, FC :760ECEE5 E88E74FFFF call 760E4378 :760ECEEA 8BDC mov ebx, esp :760ECEEC 56 push esi :760ECEED 53 push ebx :760ECEEE 6AFF push FFFFFFFF :760ECEF0 FF7508 push [ebp+08] :760ECEF3 33C0 xor eax, eax :760ECEF5 668903 mov word ptr [ebx], ax :760ECEF8 50 push eax :760ECEF9 50 push eax * Reference To: KERNEL32.MultiByteToWideChar, Ord:0202h | :760ECEFA FF154C120E76 Call dword ptr [760E124C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECECF(C) | :760ECF00 53 push ebx * Reference To: OLEAUT32.SysAllocString, Ord:0002h | :760ECF01 FF1584100E76 Call dword ptr [760E1084] :760ECF07 85C0 test eax, eax :760ECF09 894708 mov dword ptr [edi+08], eax :760ECF0C 7511 jne 760ECF1F :760ECF0E 394508 cmp dword ptr [ebp+08], eax :760ECF11 740C je 760ECF1F :760ECF13 66C7070A00 mov word ptr [edi], 000A :760ECF18 C747080E000780 mov [edi+08], 8007000E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECF0C(C), :760ECF11(C) | :760ECF1F 8D65F4 lea esp, dword ptr [ebp-0C] :760ECF22 8BC7 mov eax, edi :760ECF24 5F pop edi :760ECF25 5E pop esi :760ECF26 5B pop ebx :760ECF27 5D pop ebp :760ECF28 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760EB14F , :760EB192 , :760EB1EC , :760EB271 , :760EB2D4 |:760EB30B , :760EB345 , :760EB386 , :760EB4BC , :760EB519 |:760EB56F , :760EB5E7 , :760EB646 , :760EB6AB , :760EB6F2 |:760EB73A , :760EB79C , :760EB876 , :760EB8D5 , :760EBAAC |:760EBAF0 , :760EBB35 , :760EBBE6 , :760EBC1E , :760EBC92 |:760EBCF1 , :760EBD17 , :760EBD5E , :760EBD85 , :760EBDBC |:760EBE01 , :760EBEB3 , :760EBEE9 , :760EC06E , :760EC160 |:760EC1CF , :760EC2FF , :760EC341 , :760EC38A , :760EC41D |:760EC49E , :760EC518 , :760EC5A8 , :760EC669 , :760EC709 |:760EC75E , :760EC842 , :760EC89C , :760EC909 , :760EC951 |:760EC9AD , :760ECA63 , :760ECADE , :760ECB38 , :760ECC25 |:760ECC79 , :760ECCBA , :760ECCF9 , :760ECD5B , :760ECDDC |:760ECE11 , :760ECE46 , :760ECF81 , :760ECFC4 , :760ED053 |:760ED09F , :760ED11F , :760ED15A , :760ED240 , :760ED2C6 |:760ED340 , :760ED447 , :760ED4DE , :760ED5AF , :760ED6E4 |:760ED740 , :760ED786 , :760ED80F , :760ED863 , :760ED8B4 |:760ED91B , :760ED967 , :760ED9C8 , :760EDA1B , :760EDA75 |:760EDAB2 , :760EDAF7 , :760EDB32 , :760EDB6F , :760EDBE0 |:760EDC26 , :760EDC73 , :760EDCC4 , :760EDD4F , :760EDDAD |:760EDE58 , :760EDEFD , :760EDF5F , :760EE059 , :760EE0C2 |:760EE154 , :760EE221 , :760EE2B9 , :760EE324 , :760EE362 |:760EE3A1 , :760EE41F , :760EE470 , :760EE50A , :760EE56D |:760EE613 , :760EE68B , :760EE713 , :760EE76E , :760EE7E2 |:760EE8EB , :760EE935 , :760EE982 , :760EE9D3 , :760EEA4E |:760EEA9A , :760EEB00 , :760EEB9A , :760EEBF0 , :760EEC41 |:760EEC83 , :760EECBB , :760EECEC , :760EEDC3 , :760EEE48 |:760EEECB , :760EF0D9 , :760EF129 , :760EF1AB , :760EF1ED |:760EF339 , :760EF3DE , :760EF41F , :760EF464 , :760EF54D |:760EF61D , :760EF793 , :760EF9D8 , :760EFA31 , :760EFC68 |:760EFD4B , :760EFFB3 , :760EFFEA , :760F004A , :760F0081 |:760F016A , :760F01CB , :760F0207 , :760F0285 , :760F0616 |:760F0669 , :760F06B3 , :760F06F5 , :760F0734 , :760F0784 |:760F07D7 , :760F0875 , :760F08CA , :760F0902 , :760F0961 |:760F09DD , :760F0A32 , :760F0A6A , :760F0AC9 , :760F0B65 |:760F0CA5 , :760F0DCC , :760F0E93 , :760F1035 , :760F1098 |:760F10ED , :760F118B , :760F11D4 , :760F1259 , :760F1335 |:760F13AC , :760F140E , :760F143E , :760F156B , :760F1595 |:760F160D , :760F1652 , :760F16C5 , :760F17CA , :760F1851 |:760F18C7 , :760F18F0 , :760F191D , :760F1972 , :760F1A0E |:760F1A82 , :760F1B37 , :760F1B61 , :760F1B8B , :760F1BB5 |:760F1BDF , :760F1C09 , :760F1C33 , :760F1C5D , :760F1C95 |:760F1CD6 , :760F1D52 , :760F1D8A , :760F1DC1 , :760F1E01 |:760F1E7D , :760F1EB5 , :760F1EEC , :760F1F28 , :760F1F58 |:760F1FAC , :760F201A , :760F2044 , :760F207A , :760F20B1 |:760F20E5 , :760F2168 , :760F21D8 , :760F220E , :760F226C |:760F22C0 , :760F2316 , :760F23CE , :760F23FB , :760F242C |:760F2454 , :760F2480 , :760F24B5 , :760F24DB , :760F2503 |:760F2548 , :760F258C , :760F25D8 , :760F261B , :760F265F |:760F26AB , :760F26EE , :760F2729 , :760F276F , :760F27A9 |:760F281D , :760F2858 , :760F28B3 , :760F28F7 , :760F29D5 |:760F2A76 , :760F2ADF , :760F2BBF , :760F2BFE , :760F2F89 |:760F300D , :760F3088 , :760F3191 , :760F3202 , :760F3238 |:760F32FD , :760F3444 , :760F354F , :760F3621 , :760F365D |:760F36E5 , :760F3726 , :760F3777 , :760F37B8 , :760F3809 |:760F383A , :760F386B , :760F38AC , :760F390D , :760F396E |:760F39CF , :760F3A30 , :760F3A91 , :760F3AF2 , :760F3B53 |:760F3BB4 , :760F3C16 , :760F3C72 , :760F3CB6 , :760F3D07 |:760F3D62 , :760F3DB9 , :760F3DF2 , :760F3E2B , :760F3E64 |:760F3FAB , :760F4022 , :760F4086 , :760F40D9 , :760F4135 |:760F41B8 , :760F4210 , :760F4271 , :760F4430 , :760F44C2 |:760F4508 , :760F454C , :760F45A2 , :760F45E9 , :760F4641 |:760F46B0 , :760F4787 , :760F47CA , :760F4805 , :760F4842 |:760F48B1 , :760F493A , :760F49FE , :760F4AAC , :760F4AFE |:760F4C48 , :760F4CA1 , :760F4CD6 , :760F4D4D , :760F4D85 |:760F4EC2 , :760F4F0A , :760F5035 , :760F50C3 , :760F5103 |:760F5141 , :760F5189 , :760F51BC , :760F51E3 , :760F5263 |:760F52AC , :760F52EC , :760F53BD , :760F53F5 , :760F542A |:760F5463 , :760F54AD , :760F5501 , :760F554F , :760F55B9 |:760F5617 , :760F56CD , :760F570E , :760F574C , :760F578A |:760F57CC , :760F580B , :760F58B1 , :760F5954 , :760F5996 |:760F5A05 , :760F5AD4 , :760F5B1F , :760F5BB1 , :760F5C9C |:760F5CE0 , :760F5D1B , :760F5D54 , :760F5D9B , :760F5DD7 |:760F5E16 , :760F5E54 , :760F5E8B , :760F5EC1 , :760F5F0A |:760F5F79 , :760F605E , :760F60EC , :760F70A9 , :760F70FD |:760F7396 , :760F7512 , :760F7A24 , :760F7A66 , :760F7B5E |:760F7E25 , :760F7FE8 , :760F812D , :760F8364 , :760F849A |:760F85AE , :760F86CB | :760ECF2B 8D44240C lea eax, dword ptr [esp+0C] :760ECF2F 50 push eax :760ECF30 FF74240C push [esp+0C] :760ECF34 FF74240C push [esp+0C] * Reference To: ATRACE._AsyncStringTrace@12, Ord:0001h | :760ECF38 FF1588110E76 Call dword ptr [760E1188] :760ECF3E C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3810(C) | :760ECF3F E895000000 call 760ECFD9 :760ECF44 85C0 test eax, eax :760ECF46 0F85CA68FFFF jne 760E3816 :760ECF4C A184110E76 mov eax, dword ptr [760E1184] :760ECF51 F60002 test byte ptr [eax], 02 :760ECF54 0F84D768FFFF je 760E3831 :760ECF5A 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"InitCryptoDbContext" | :760ECF5C 682C6E0E76 push 760E6E2C :760ECF61 6A3E push 0000003E :760ECF63 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ECF68 FF1580110E76 Call dword ptr [760E1180] :760ECF6E 85C0 test eax, eax :760ECF70 0F84BB68FFFF je 760E3831 :760ECF76 56 push esi * Possible StringData Ref from Code Obj ->"Error releasing the crypto context." | :760ECF77 68086E0E76 push 760E6E08 :760ECF7C 6806030000 push 00000306 :760ECF81 E8A5FFFFFF call 760ECF2B :760ECF86 83C40C add esp, 0000000C :760ECF89 E9A368FFFF jmp 760E3831 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E382B(C) | :760ECF8E 57 push edi * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ECF8F FF15A0110E76 Call dword ptr [760E11A0] :760ECF95 8BF8 mov edi, eax :760ECF97 A184110E76 mov eax, dword ptr [760E1184] :760ECF9C F60002 test byte ptr [eax], 02 :760ECF9F 742B je 760ECFCC :760ECFA1 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"InitCryptoDbContext" | :760ECFA3 682C6E0E76 push 760E6E2C :760ECFA8 6A49 push 00000049 :760ECFAA 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ECFAF FF1580110E76 Call dword ptr [760E1180] :760ECFB5 85C0 test eax, eax :760ECFB7 7413 je 760ECFCC :760ECFB9 57 push edi * Possible StringData Ref from Code Obj ->"CryptCATAdminAcquireContext() " ->"failed, ec=%d" | :760ECFBA 68DC6D0E76 push 760E6DDC :760ECFBF 6806030000 push 00000306 :760ECFC4 E862FFFFFF call 760ECF2B :760ECFC9 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECF9F(C), :760ECFB7(C) | :760ECFCC 8325B0DE0F7600 and dword ptr [760FDEB0], 00000000 :760ECFD3 5F pop edi :760ECFD4 E95868FFFF jmp 760E3831 * Referenced by a CALL at Addresses: |:760ECDE3 , :760ECF3F , :760EF280 , :760EF596 | :760ECFD9 A1B0DE0F76 mov eax, dword ptr [760FDEB0] :760ECFDE 56 push esi :760ECFDF 33F6 xor esi, esi :760ECFE1 57 push edi :760ECFE2 85C0 test eax, eax :760ECFE4 752A jne 760ED010 :760ECFE6 A184110E76 mov eax, dword ptr [760E1184] :760ECFEB F60002 test byte ptr [eax], 02 :760ECFEE 746B je 760ED05B :760ECFF0 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"ReleaseCryptoDbContext" | :760ECFF2 68946E0E76 push 760E6E94 :760ECFF7 6A63 push 00000063 :760ECFF9 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ECFFE FF1580110E76 Call dword ptr [760E1180] :760ED004 85C0 test eax, eax :760ED006 7453 je 760ED05B :760ED008 56 push esi * Possible StringData Ref from Code Obj ->"Releasing NULL crypto admin context." | :760ED009 686C6E0E76 push 760E6E6C :760ED00E EB3E jmp 760ED04E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ECFE4(C) | :760ED010 6A00 push 00000000 :760ED012 50 push eax * Reference To: WINTRUST.CryptCATAdminReleaseContext, Ord:0007h | :760ED013 E8046F0000 Call 760F3F1C :760ED018 8BF0 mov esi, eax :760ED01A 85F6 test esi, esi :760ED01C 753D jne 760ED05B * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ED01E FF15A0110E76 Call dword ptr [760E11A0] :760ED024 8BF8 mov edi, eax :760ED026 A184110E76 mov eax, dword ptr [760E1184] :760ED02B F60002 test byte ptr [eax], 02 :760ED02E 742B je 760ED05B :760ED030 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"ReleaseCryptoDbContext" | :760ED032 68946E0E76 push 760E6E94 :760ED037 6A6D push 0000006D :760ED039 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED03E FF1580110E76 Call dword ptr [760E1180] :760ED044 85C0 test eax, eax :760ED046 7413 je 760ED05B :760ED048 57 push edi * Possible StringData Ref from Code Obj ->"CryptCATAdminReleaseContext() " ->"failed, ec=%d" | :760ED049 68406E0E76 push 760E6E40 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED00E(U) | :760ED04E 6806030000 push 00000306 :760ED053 E8D3FEFFFF call 760ECF2B :760ED058 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ECFEE(C), :760ED006(C), :760ED01C(C), :760ED02E(C), :760ED046(C) | :760ED05B 8325B0DE0F7600 and dword ptr [760FDEB0], 00000000 :760ED062 8BC6 mov eax, esi :760ED064 5F pop edi :760ED065 5E pop esi :760ED066 C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1FB0(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ED067 FF15A0110E76 Call dword ptr [760E11A0] :760ED06D 8BF8 mov edi, eax :760ED06F A184110E76 mov eax, dword ptr [760E1184] :760ED074 F60004 test byte ptr [eax], 04 :760ED077 742E je 760ED0A7 :760ED079 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"ReadFileHash" | :760ED07B 68246F0E76 push 760E6F24 :760ED080 6892000000 push 00000092 :760ED085 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED08A FF1580110E76 Call dword ptr [760E1180] :760ED090 85C0 test eax, eax :760ED092 7413 je 760ED0A7 :760ED094 57 push edi * Possible StringData Ref from Code Obj ->"CreateFile failed %d" | :760ED095 680C6F0E76 push 760E6F0C :760ED09A 6806030000 push 00000306 :760ED09F E887FEFFFF call 760ECF2B :760ED0A4 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED077(C), :760ED092(C) | :760ED0A7 6A6E push 0000006E :760ED0A9 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED170(U) | :760ED0AA 8B06 mov eax, dword ptr [esi] :760ED0AC 3BC3 cmp eax, ebx :760ED0AE 0F842F4FFFFF je 760E1FE3 :760ED0B4 50 push eax :760ED0B5 E83549FFFF call 760E19EF :760ED0BA 891E mov dword ptr [esi], ebx :760ED0BC E9224FFFFF jmp 760E1FE3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1FDB(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ED0C1 FF15A0110E76 Call dword ptr [760E11A0] :760ED0C7 3BC3 cmp eax, ebx :760ED0C9 89450C mov dword ptr [ebp+0C], eax :760ED0CC 7507 jne 760ED0D5 :760ED0CE C7450C0D000000 mov [ebp+0C], 0000000D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED0CC(C) | :760ED0D5 8B06 mov eax, dword ptr [esi] :760ED0D7 3BC3 cmp eax, ebx :760ED0D9 7408 je 760ED0E3 :760ED0DB 50 push eax :760ED0DC E80E49FFFF call 760E19EF :760ED0E1 891E mov dword ptr [esi], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED0D9(C) | :760ED0E3 837D0C7A cmp dword ptr [ebp+0C], 0000007A :760ED0E7 753F jne 760ED128 :760ED0E9 FF37 push dword ptr [edi] :760ED0EB E9CF4EFFFF jmp 760E1FBF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1FC8(C) | :760ED0F0 A184110E76 mov eax, dword ptr [760E1184] :760ED0F5 F60004 test byte ptr [eax], 04 :760ED0F8 7471 je 760ED16B :760ED0FA 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"ReadFileHash" | :760ED0FC 68246F0E76 push 760E6F24 :760ED101 689D000000 push 0000009D :760ED106 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED10B FF1580110E76 Call dword ptr [760E1180] :760ED111 85C0 test eax, eax :760ED113 7456 je 760ED16B * Possible StringData Ref from Code Obj ->"Not enough memory to verify file " ->"signature" | :760ED115 68E06E0E76 push 760E6EE0 :760ED11A 6806030000 push 00000306 :760ED11F E807FEFFFF call 760ECF2B :760ED124 59 pop ecx :760ED125 59 pop ecx :760ED126 EB43 jmp 760ED16B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED0E7(C) | :760ED128 A184110E76 mov eax, dword ptr [760E1184] :760ED12D F60004 test byte ptr [eax], 04 :760ED130 7430 je 760ED162 :760ED132 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"ReadFileHash" | :760ED134 68246F0E76 push 760E6F24 :760ED139 68BC000000 push 000000BC :760ED13E 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED143 FF1580110E76 Call dword ptr [760E1180] :760ED149 85C0 test eax, eax :760ED14B 7415 je 760ED162 :760ED14D FF750C push [ebp+0C] * Possible StringData Ref from Code Obj ->"CryptCATAdminCalcHashFromFileHandle()failed, " ->"ec=%d" | :760ED150 68AC6E0E76 push 760E6EAC :760ED155 6806030000 push 00000306 :760ED15A E8CCFDFFFF call 760ECF2B :760ED15F 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED130(C), :760ED14B(C) | :760ED162 395D0C cmp dword ptr [ebp+0C], ebx :760ED165 0F84764EFFFF je 760E1FE1 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED0F8(C), :760ED113(C), :760ED126(U) | :760ED16B BF4F050000 mov edi, 0000054F :760ED170 E935FFFFFF jmp 760ED0AA * Referenced by a CALL at Address: |:760ED4A3 | :760ED175 55 push ebp :760ED176 8BEC mov ebp, esp :760ED178 81EC64040000 sub esp, 00000464 :760ED17E 53 push ebx :760ED17F 33DB xor ebx, ebx :760ED181 391DB0DE0F76 cmp dword ptr [760FDEB0], ebx :760ED187 56 push esi :760ED188 57 push edi :760ED189 750A jne 760ED195 :760ED18B BE4F050000 mov esi, 0000054F :760ED190 E9FA010000 jmp 760ED38F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED189(C) | :760ED195 6A0B push 0000000B :760ED197 33C0 xor eax, eax :760ED199 59 pop ecx :760ED19A 8D7DD4 lea edi, dword ptr [ebp-2C] :760ED19D 6A02 push 00000002 :760ED19F 8B7510 mov esi, dword ptr [ebp+10] :760ED1A2 F3 repz :760ED1A3 AB stosd :760ED1A4 58 pop eax :760ED1A5 8D7DB0 lea edi, dword ptr [ebp-50] :760ED1A8 8945E0 mov dword ptr [ebp-20], eax :760ED1AB 8945E8 mov dword ptr [ebp-18], eax :760ED1AE 8D45B0 lea eax, dword ptr [ebp-50] :760ED1B1 6A09 push 00000009 :760ED1B3 8945EC mov dword ptr [ebp-14], eax :760ED1B6 59 pop ecx :760ED1B7 33C0 xor eax, eax :760ED1B9 6804010000 push 00000104 :760ED1BE F3 repz :760ED1BF AB stosd :760ED1C0 8B7D0C mov edi, dword ptr [ebp+0C] :760ED1C3 8D85A8FDFFFF lea eax, dword ptr [ebp+FFFFFDA8] :760ED1C9 50 push eax :760ED1CA 6AFF push FFFFFFFF :760ED1CC FF7508 push [ebp+08] :760ED1CF C745D42C000000 mov [ebp-2C], 0000002C :760ED1D6 895DE4 mov dword ptr [ebp-1C], ebx :760ED1D9 C745F003000000 mov [ebp-10], 00000003 :760ED1E0 53 push ebx :760ED1E1 53 push ebx :760ED1E2 C745FC10000000 mov [ebp-04], 00000010 :760ED1E9 C745B024000000 mov [ebp-50], 00000024 :760ED1F0 897DC8 mov dword ptr [ebp-38], edi :760ED1F3 8975CC mov dword ptr [ebp-34], esi * Reference To: KERNEL32.MultiByteToWideChar, Ord:0202h | :760ED1F6 FF154C120E76 Call dword ptr [760E124C] :760ED1FC 85C0 test eax, eax :760ED1FE 754D jne 760ED24D * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ED200 FF15A0110E76 Call dword ptr [760E11A0] :760ED206 8BF0 mov esi, eax :760ED208 A184110E76 mov eax, dword ptr [760E1184] :760ED20D F60004 test byte ptr [eax], 04 :760ED210 0F8479010000 je 760ED38F :760ED216 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"VerifyFileHash" | :760ED218 68B46F0E76 push 760E6FB4 :760ED21D 6817010000 push 00000117 :760ED222 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED227 FF1580110E76 Call dword ptr [760E1180] :760ED22D 85C0 test eax, eax :760ED22F 0F845A010000 je 760ED38F :760ED235 56 push esi * Possible StringData Ref from Code Obj ->"Failed to do conversion ec=%d" | :760ED236 68946F0E76 push 760E6F94 :760ED23B 6806030000 push 00000306 :760ED240 E8E6FCFFFF call 760ECF2B :760ED245 83C40C add esp, 0000000C :760ED248 E942010000 jmp 760ED38F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED1FE(C) | :760ED24D 8D85A8FDFFFF lea eax, dword ptr [ebp+FFFFFDA8] :760ED253 50 push eax * Reference To: MSVCRT._wcslwr, Ord:01E9h | :760ED254 FF1500100E76 Call dword ptr [760E1000] :760ED25A 8D85A8FDFFFF lea eax, dword ptr [ebp+FFFFFDA8] :760ED260 59 pop ecx :760ED261 8945BC mov dword ptr [ebp-44], eax :760ED264 8D450C lea eax, dword ptr [ebp+0C] :760ED267 50 push eax :760ED268 53 push ebx :760ED269 56 push esi :760ED26A 57 push edi :760ED26B FF35B0DE0F76 push dword ptr [760FDEB0] :760ED271 895D0C mov dword ptr [ebp+0C], ebx * Reference To: WINTRUST.CryptCATAdminEnumCatalogFromHash, Ord:0005h | :760ED274 E8B56C0000 Call 760F3F2E :760ED279 8BF0 mov esi, eax :760ED27B 3BF3 cmp esi, ebx :760ED27D 7554 jne 760ED2D3 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ED27F FF15A0110E76 Call dword ptr [760E11A0] :760ED285 8BF0 mov esi, eax :760ED287 A184110E76 mov eax, dword ptr [760E1184] :760ED28C F60004 test byte ptr [eax], 04 :760ED28F 0F84E7000000 je 760ED37C :760ED295 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"VerifyFileHash" | :760ED297 68B46F0E76 push 760E6FB4 :760ED29C 6834010000 push 00000134 :760ED2A1 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED2A6 FF1580110E76 Call dword ptr [760E1180] :760ED2AC 85C0 test eax, eax :760ED2AE 0F84C8000000 je 760ED37C :760ED2B4 8D85A8FDFFFF lea eax, dword ptr [ebp+FFFFFDA8] :760ED2BA 56 push esi :760ED2BB 50 push eax * Possible StringData Ref from Code Obj ->"CryptCATAdminEnumCatalogFromHash()failed " ->"for (%ws), ec=%d" | :760ED2BC 68586F0E76 push 760E6F58 :760ED2C1 6806030000 push 00000306 :760ED2C6 E860FCFFFF call 760ECF2B :760ED2CB 83C410 add esp, 00000010 :760ED2CE E9A9000000 jmp 760ED37C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED27D(C), :760ED363(C) | :760ED2D3 8D859CFBFFFF lea eax, dword ptr [ebp+FFFFFB9C] :760ED2D9 53 push ebx :760ED2DA 50 push eax :760ED2DB 56 push esi :760ED2DC C7859CFBFFFF0C020000 mov dword ptr [ebp+FFFFFB9C], 0000020C * Reference To: WINTRUST.CryptCATCatalogInfoFromContext, Ord:0010h | :760ED2E6 E83D6C0000 Call 760F3F28 :760ED2EB 85C0 test eax, eax :760ED2ED 7459 je 760ED348 :760ED2EF 8D85A0FBFFFF lea eax, dword ptr [ebp+FFFFFBA0] :760ED2F5 8945B8 mov dword ptr [ebp-48], eax :760ED2F8 8D45D4 lea eax, dword ptr [ebp-2C] :760ED2FB 50 push eax :760ED2FC 68B0D90F76 push 760FD9B0 :760ED301 53 push ebx * Reference To: WINTRUST.WinVerifyTrust, Ord:006Bh | :760ED302 E8375BFFFF Call 760E2E3E :760ED307 3BC3 cmp eax, ebx :760ED309 894508 mov dword ptr [ebp+08], eax :760ED30C 745D je 760ED36B :760ED30E A184110E76 mov eax, dword ptr [760E1184] :760ED313 F60004 test byte ptr [eax], 04 :760ED316 7430 je 760ED348 :760ED318 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"VerifyFileHash" | :760ED31A 68B46F0E76 push 760E6FB4 :760ED31F 686B010000 push 0000016B :760ED324 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED329 FF1580110E76 Call dword ptr [760E1180] :760ED32F 85C0 test eax, eax :760ED331 7415 je 760ED348 :760ED333 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"WinVerifyTrust(1) failed, ec=0x%08x" | :760ED336 68346F0E76 push 760E6F34 :760ED33B 6806030000 push 00000306 :760ED340 E8E6FBFFFF call 760ECF2B :760ED345 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED2ED(C), :760ED316(C), :760ED331(C) | :760ED348 8D450C lea eax, dword ptr [ebp+0C] :760ED34B 89750C mov dword ptr [ebp+0C], esi :760ED34E 50 push eax :760ED34F 53 push ebx :760ED350 FF7510 push [ebp+10] :760ED353 57 push edi :760ED354 FF35B0DE0F76 push dword ptr [760FDEB0] * Reference To: WINTRUST.CryptCATAdminEnumCatalogFromHash, Ord:0005h | :760ED35A E8CF6B0000 Call 760F3F2E :760ED35F 8BF0 mov esi, eax :760ED361 3BF3 cmp esi, ebx :760ED363 0F856AFFFFFF jne 760ED2D3 :760ED369 EB11 jmp 760ED37C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED30C(C) | :760ED36B 53 push ebx :760ED36C 56 push esi :760ED36D FF35B0DE0F76 push dword ptr [760FDEB0] * Reference To: WINTRUST.CryptCATAdminReleaseCatalogContext, Ord:0006h | :760ED373 E8AA6B0000 Call 760F3F22 :760ED378 3BF3 cmp esi, ebx :760ED37A 7511 jne 760ED38D * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED28F(C), :760ED2AE(C), :760ED2CE(U), :760ED369(U) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ED37C FF15A0110E76 Call dword ptr [760E11A0] :760ED382 8BF0 mov esi, eax :760ED384 3BF3 cmp esi, ebx :760ED386 7507 jne 760ED38F :760ED388 6A0D push 0000000D :760ED38A 5E pop esi :760ED38B EB02 jmp 760ED38F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED37A(C) | :760ED38D 33F6 xor esi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED190(U), :760ED210(C), :760ED22F(C), :760ED248(U), :760ED386(C) |:760ED38B(U) | :760ED38F 8BC6 mov eax, esi :760ED391 5F pop edi :760ED392 5E pop esi :760ED393 5B pop ebx :760ED394 C9 leave :760ED395 C20C00 ret 000C * Referenced by a CALL at Addresses: |:760EB1A6 , :760EB22B , :760ED62C , :760ED66F , :760ED695 |:760EDDBA | :760ED398 55 push ebp :760ED399 8BEC mov ebp, esp :760ED39B 81EC48010000 sub esp, 00000148 :760ED3A1 56 push esi :760ED3A2 8D85B8FEFFFF lea eax, dword ptr [ebp+FFFFFEB8] :760ED3A8 57 push edi :760ED3A9 50 push eax :760ED3AA FF7508 push [ebp+08] :760ED3AD 33FF xor edi, edi :760ED3AF 897DFC mov dword ptr [ebp-04], edi :760ED3B2 897DF8 mov dword ptr [ebp-08], edi * Reference To: KERNEL32.FindFirstFileA, Ord:00A3h | :760ED3B5 FF1568120E76 Call dword ptr [760E1268] :760ED3BB 83F8FF cmp eax, FFFFFFFF :760ED3BE 7540 jne 760ED400 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ED3C0 FF15A0110E76 Call dword ptr [760E11A0] :760ED3C6 8BF0 mov esi, eax :760ED3C8 A184110E76 mov eax, dword ptr [760E1184] :760ED3CD F60002 test byte ptr [eax], 02 :760ED3D0 0F8410010000 je 760ED4E6 :760ED3D6 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"IsFileHashValid" | :760ED3D8 684C700E76 push 760E704C :760ED3DD 68BC010000 push 000001BC :760ED3E2 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED3E7 FF1580110E76 Call dword ptr [760E1180] :760ED3ED 85C0 test eax, eax :760ED3EF 0F84F1000000 je 760ED4E6 :760ED3F5 56 push esi * Possible StringData Ref from Code Obj ->"FindFirstFile failed ec=%d" | :760ED3F6 6830700E76 push 760E7030 :760ED3FB E9D9000000 jmp 760ED4D9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED3BE(C) | :760ED400 50 push eax * Reference To: KERNEL32.FindClose, Ord:009Fh | :760ED401 FF1584120E76 Call dword ptr [760E1284] :760ED407 39BDD8FEFFFF cmp dword ptr [ebp+FFFFFED8], edi :760ED40D 7548 jne 760ED457 :760ED40F 39BDD4FEFFFF cmp dword ptr [ebp+FFFFFED4], edi :760ED415 7540 jne 760ED457 :760ED417 A184110E76 mov eax, dword ptr [760E1184] :760ED41C F60004 test byte ptr [eax], 04 :760ED41F 742E je 760ED44F :760ED421 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"IsFileHashValid" | :760ED423 684C700E76 push 760E704C :760ED428 68CA010000 push 000001CA :760ED42D 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED432 FF1580110E76 Call dword ptr [760E1180] :760ED438 85C0 test eax, eax :760ED43A 7413 je 760ED44F :760ED43C 57 push edi * Possible StringData Ref from Code Obj ->"0 Byte file found, returning verifyfile " ->"hash failed." | :760ED43D 68F86F0E76 push 760E6FF8 :760ED442 6806030000 push 00000306 :760ED447 E8DFFAFFFF call 760ECF2B :760ED44C 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED41F(C), :760ED43A(C) | :760ED44F 6A0D push 0000000D :760ED451 5E pop esi :760ED452 E98F000000 jmp 760ED4E6 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED40D(C), :760ED415(C) | :760ED457 8D45F8 lea eax, dword ptr [ebp-08] :760ED45A 50 push eax :760ED45B 8D45FC lea eax, dword ptr [ebp-04] :760ED45E 50 push eax :760ED45F FF7508 push [ebp+08] :760ED462 E81D4BFFFF call 760E1F84 :760ED467 8BF0 mov esi, eax :760ED469 3BF7 cmp esi, edi :760ED46B 742D je 760ED49A :760ED46D A184110E76 mov eax, dword ptr [760E1184] :760ED472 F60004 test byte ptr [eax], 04 :760ED475 746F je 760ED4E6 :760ED477 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"IsFileHashValid" | :760ED479 684C700E76 push 760E704C :760ED47E 68D4010000 push 000001D4 :760ED483 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED488 FF1580110E76 Call dword ptr [760E1180] :760ED48E 85C0 test eax, eax :760ED490 7454 je 760ED4E6 :760ED492 56 push esi * Possible StringData Ref from Code Obj ->"ReadFileHash failed %d" | :760ED493 68E06F0E76 push 760E6FE0 :760ED498 EB3F jmp 760ED4D9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED46B(C) | :760ED49A FF75F8 push [ebp-08] :760ED49D FF75FC push [ebp-04] :760ED4A0 FF7508 push [ebp+08] :760ED4A3 E8CDFCFFFF call 760ED175 :760ED4A8 8BF0 mov esi, eax :760ED4AA 3BF7 cmp esi, edi :760ED4AC 7438 je 760ED4E6 :760ED4AE A184110E76 mov eax, dword ptr [760E1184] :760ED4B3 F60004 test byte ptr [eax], 04 :760ED4B6 742E je 760ED4E6 :760ED4B8 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"IsFileHashValid" | :760ED4BA 684C700E76 push 760E704C :760ED4BF 68DD010000 push 000001DD :760ED4C4 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED4C9 FF1580110E76 Call dword ptr [760E1180] :760ED4CF 85C0 test eax, eax :760ED4D1 7413 je 760ED4E6 :760ED4D3 56 push esi * Possible StringData Ref from Code Obj ->"VerifyFileHash failed %d" | :760ED4D4 68C46F0E76 push 760E6FC4 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED3FB(U), :760ED498(U) | :760ED4D9 6806030000 push 00000306 :760ED4DE E848FAFFFF call 760ECF2B :760ED4E3 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED3D0(C), :760ED3EF(C), :760ED452(U), :760ED475(C), :760ED490(C) |:760ED4AC(C), :760ED4B6(C), :760ED4D1(C) | :760ED4E6 397DFC cmp dword ptr [ebp-04], edi :760ED4E9 7408 je 760ED4F3 :760ED4EB FF75FC push [ebp-04] :760ED4EE E8FC44FFFF call 760E19EF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED4E9(C) | :760ED4F3 8BC6 mov eax, esi :760ED4F5 5F pop edi :760ED4F6 5E pop esi :760ED4F7 C9 leave :760ED4F8 C20400 ret 0004 * Referenced by a CALL at Address: |:760F6637 | Exported fn(): SfpVerifyFileS - Ord:0024h :760ED4FB 55 push ebp :760ED4FC 8BEC mov ebp, esp :760ED4FE 81EC10040000 sub esp, 00000410 :760ED504 53 push ebx :760ED505 56 push esi :760ED506 57 push edi :760ED507 8B7D08 mov edi, dword ptr [ebp+08] :760ED50A 33F6 xor esi, esi :760ED50C 3BFE cmp edi, esi :760ED50E 0F84A0010000 je 760ED6B4 :760ED514 803F00 cmp byte ptr [edi], 00 :760ED517 0F8497010000 je 760ED6B4 :760ED51D 39750C cmp dword ptr [ebp+0C], esi :760ED520 0F848E010000 je 760ED6B4 :760ED526 57 push edi * Reference To: SfpDll.SfpIsFileProtectedS | :760ED527 E81A48FFFF call 760E1D46 :760ED52C 85C0 test eax, eax :760ED52E 57 push edi :760ED52F 742F je 760ED560 :760ED531 8D85F0FBFFFF lea eax, dword ptr [ebp+FFFFFBF0] * Possible StringData Ref from Code Obj ->"%s is not a protected File." | :760ED537 686C720E76 push 760E726C :760ED53C 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760ED53D FF1530100E76 Call dword ptr [760E1030] :760ED543 B800040000 mov eax, 00000400 :760ED548 83C40C add esp, 0000000C :760ED54B 394510 cmp dword ptr [ebp+10], eax :760ED54E 7703 ja 760ED553 :760ED550 8B4510 mov eax, dword ptr [ebp+10] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED54E(C) | :760ED553 50 push eax :760ED554 8D85F0FBFFFF lea eax, dword ptr [ebp+FFFFFBF0] :760ED55A 50 push eax :760ED55B E99F010000 jmp 760ED6FF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED52F(C) | :760ED560 E8D662FFFF call 760E383B :760ED565 3BC6 cmp eax, esi :760ED567 894508 mov dword ptr [ebp+08], eax :760ED56A 744D je 760ED5B9 :760ED56C 6A01 push 00000001 :760ED56E 8D45F0 lea eax, dword ptr [ebp-10] :760ED571 5E pop esi :760ED572 50 push eax :760ED573 57 push edi :760ED574 E8A24C0000 call 760F221B :760ED579 8BD8 mov ebx, eax :760ED57B 85DB test ebx, ebx :760ED57D 743A je 760ED5B9 :760ED57F A184110E76 mov eax, dword ptr [760E1184] :760ED584 F60004 test byte ptr [eax], 04 :760ED587 742E je 760ED5B7 :760ED589 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SfpValidateFile" | :760ED58B 685C720E76 push 760E725C :760ED590 6817020000 push 00000217 :760ED595 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED59A FF1580110E76 Call dword ptr [760E1180] :760ED5A0 85C0 test eax, eax :760ED5A2 7413 je 760ED5B7 :760ED5A4 53 push ebx * Possible StringData Ref from Code Obj ->"Error %d in getting version from " ->"file on disk" | :760ED5A5 6844630E76 push 760E6344 :760ED5AA 6806030000 push 00000306 :760ED5AF E877F9FFFF call 760ECF2B :760ED5B4 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED587(C), :760ED5A2(C) | :760ED5B7 33F6 xor esi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED56A(C), :760ED57D(C) | :760ED5B9 6A01 push 00000001 :760ED5BB 8D45F8 lea eax, dword ptr [ebp-08] :760ED5BE 5B pop ebx :760ED5BF 50 push eax :760ED5C0 57 push edi * Reference To: SfpDll.SfpGetCorrectVersionOfFile | :760ED5C1 E851080000 call 760EDE17 :760ED5C6 85C0 test eax, eax :760ED5C8 740E je 760ED5D8 :760ED5CA 33DB xor ebx, ebx :760ED5CC 85F6 test esi, esi :760ED5CE 7408 je 760ED5D8 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED5E0(C), :760ED650(C), :760ED6A3(C) | :760ED5D0 6A01 push 00000001 :760ED5D2 5E pop esi :760ED5D3 E92F010000 jmp 760ED707 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED5C8(C), :760ED5CE(C) | :760ED5D8 837D0800 cmp dword ptr [ebp+08], 00000000 :760ED5DC 753E jne 760ED61C :760ED5DE 85DB test ebx, ebx :760ED5E0 74EE je 760ED5D0 :760ED5E2 57 push edi * Possible StringData Ref from Code Obj ->"%s:" | :760ED5E3 6814720E76 push 760E7214 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED62A(U), :760ED65C(U), :760ED685(U), :760ED68F(U), :760ED6AF(U) | :760ED5E8 8D85F0FBFFFF lea eax, dword ptr [ebp+FFFFFBF0] :760ED5EE 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760ED5EF FF1530100E76 Call dword ptr [760E1030] :760ED5F5 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED64C(U) | :760ED5F8 B800040000 mov eax, 00000400 :760ED5FD 394510 cmp dword ptr [ebp+10], eax :760ED600 7703 ja 760ED605 :760ED602 8B4510 mov eax, dword ptr [ebp+10] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED600(C) | :760ED605 50 push eax :760ED606 8D85F0FBFFFF lea eax, dword ptr [ebp+FFFFFBF0] :760ED60C 50 push eax :760ED60D FF750C push [ebp+0C] :760ED610 E8CD530000 call 760F29E2 :760ED615 33F6 xor esi, esi :760ED617 E9EB000000 jmp 760ED707 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED5DC(C) | :760ED61C 85F6 test esi, esi :760ED61E 753E jne 760ED65E :760ED620 85DB test ebx, ebx :760ED622 57 push edi :760ED623 7407 je 760ED62C * Possible StringData Ref from Code Obj ->"%s:" | :760ED625 68CC710E76 push 760E71CC :760ED62A EBBC jmp 760ED5E8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED623(C) | :760ED62C E867FDFFFF call 760ED398 :760ED631 3D4F050000 cmp eax, 0000054F :760ED636 7516 jne 760ED64E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED679(C), :760ED69F(C) | :760ED638 8D85F0FBFFFF lea eax, dword ptr [ebp+FFFFFBF0] * Possible StringData Ref from Code Obj ->"There was an internal database " ->"error" | :760ED63E 68A4710E76 push 760E71A4 :760ED643 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760ED644 FF1530100E76 Call dword ptr [760E1030] :760ED64A 59 pop ecx :760ED64B 59 pop ecx :760ED64C EBAA jmp 760ED5F8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED636(C) | :760ED64E 85C0 test eax, eax :760ED650 0F847AFFFFFF je 760ED5D0 :760ED656 57 push edi * Possible StringData Ref from Code Obj ->"%s:" | :760ED657 6830710E76 push 760E7130 :760ED65C EB8A jmp 760ED5E8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED61E(C) | :760ED65E 8B45F0 mov eax, dword ptr [ebp-10] :760ED661 3B45F8 cmp eax, dword ptr [ebp-08] :760ED664 7508 jne 760ED66E :760ED666 8B45F4 mov eax, dword ptr [ebp-0C] :760ED669 3B45FC cmp eax, dword ptr [ebp-04] :760ED66C 7426 je 760ED694 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED664(C) | :760ED66E 57 push edi :760ED66F E824FDFFFF call 760ED398 :760ED674 3D4F050000 cmp eax, 0000054F :760ED679 74BD je 760ED638 :760ED67B 85C0 test eax, eax :760ED67D 57 push edi :760ED67E 740A je 760ED68A * Possible StringData Ref from Code Obj ->"%s:" | :760ED680 68FC700E76 push 760E70FC :760ED685 E95EFFFFFF jmp 760ED5E8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED67E(C) | * Possible StringData Ref from Code Obj ->"%s:" | :760ED68A 68C8700E76 push 760E70C8 :760ED68F E954FFFFFF jmp 760ED5E8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED66C(C) | :760ED694 57 push edi :760ED695 E8FEFCFFFF call 760ED398 :760ED69A 3D4F050000 cmp eax, 0000054F :760ED69F 7497 je 760ED638 :760ED6A1 85C0 test eax, eax :760ED6A3 0F8427FFFFFF je 760ED5D0 :760ED6A9 57 push edi * Possible StringData Ref from Code Obj ->"%s:" | :760ED6AA 6888700E76 push 760E7088 :760ED6AF E934FFFFFF jmp 760ED5E8 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED50E(C), :760ED517(C), :760ED520(C) | :760ED6B4 A184110E76 mov eax, dword ptr [760E1184] :760ED6B9 F60002 test byte ptr [eax], 02 :760ED6BC 742E je 760ED6EC :760ED6BE 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpValidateFile" | :760ED6C0 685C720E76 push 760E725C :760ED6C5 68FC010000 push 000001FC :760ED6CA 68C8DE0F76 push 760FDEC8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED6CF FF1580110E76 Call dword ptr [760E1180] :760ED6D5 85C0 test eax, eax :760ED6D7 7413 je 760ED6EC :760ED6D9 56 push esi * Possible StringData Ref from Code Obj ->"Invalid Buffer Arguments." | :760ED6DA 686C700E76 push 760E706C :760ED6DF 6806030000 push 00000306 :760ED6E4 E842F8FFFF call 760ECF2B :760ED6E9 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED6BC(C), :760ED6D7(C) | :760ED6EC B800040000 mov eax, 00000400 :760ED6F1 394510 cmp dword ptr [ebp+10], eax :760ED6F4 7703 ja 760ED6F9 :760ED6F6 8B4510 mov eax, dword ptr [ebp+10] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED6F4(C) | :760ED6F9 50 push eax * Possible StringData Ref from Code Obj ->"INTERNAL ERROR" | :760ED6FA 685C700E76 push 760E705C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED55B(U) | :760ED6FF FF750C push [ebp+0C] :760ED702 E8DB520000 call 760F29E2 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED5D3(U), :760ED617(U) | :760ED707 8BC6 mov eax, esi :760ED709 5F pop edi :760ED70A 5E pop esi :760ED70B 5B pop ebx :760ED70C C9 leave :760ED70D C20C00 ret 000C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1A70(C) | :760ED710 A184110E76 mov eax, dword ptr [760E1184] :760ED715 F60002 test byte ptr [eax], 02 :760ED718 742E je 760ED748 :760ED71A 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"GetXMLFilePath" | :760ED71C 689C720E76 push 760E729C :760ED721 6A45 push 00000045 :760ED723 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED728 FF1580110E76 Call dword ptr [760E1180] :760ED72E 85C0 test eax, eax :760ED730 7416 je 760ED748 :760ED732 FF742408 push [esp+08] * Possible StringData Ref from Code Obj ->"Cannot expand %s" | :760ED736 6888720E76 push 760E7288 :760ED73B 6803020000 push 00000203 :760ED740 E8E6F7FFFF call 760ECF2B :760ED745 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED718(C), :760ED730(C) | :760ED748 33F6 xor esi, esi :760ED74A E92743FFFF jmp 760E1A76 * Referenced by a CALL at Address: |:760EE3EA | :760ED74F 8B442404 mov eax, dword ptr [esp+04] :760ED753 53 push ebx :760ED754 32DB xor bl, bl :760ED756 85C0 test eax, eax :760ED758 7535 jne 760ED78F :760ED75A A184110E76 mov eax, dword ptr [760E1184] :760ED75F F60002 test byte ptr [eax], 02 :760ED762 7448 je 760ED7AC :760ED764 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"GetDriveFromPath" | :760ED766 68B8720E76 push 760E72B8 :760ED76B 6A59 push 00000059 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED7A8(U) | :760ED76D 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED772 FF1580110E76 Call dword ptr [760E1180] :760ED778 85C0 test eax, eax :760ED77A 7430 je 760ED7AC * Possible StringData Ref from Code Obj ->"Path null" | :760ED77C 68AC720E76 push 760E72AC :760ED781 6803020000 push 00000203 :760ED786 E8A0F7FFFF call 760ECF2B :760ED78B 59 pop ecx :760ED78C 59 pop ecx :760ED78D EB1D jmp 760ED7AC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED758(C) | :760ED78F 8078013A cmp byte ptr [eax+01], 3A :760ED793 7415 je 760ED7AA :760ED795 A184110E76 mov eax, dword ptr [760E1184] :760ED79A F60002 test byte ptr [eax], 02 :760ED79D 740D je 760ED7AC :760ED79F 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"GetDriveFromPath" | :760ED7A1 68B8720E76 push 760E72B8 :760ED7A6 6A60 push 00000060 :760ED7A8 EBC3 jmp 760ED76D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED793(C) | :760ED7AA 8A18 mov bl, byte ptr [eax] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED762(C), :760ED77A(C), :760ED78D(U), :760ED79D(C) | :760ED7AC 8AC3 mov al, bl :760ED7AE 5B pop ebx :760ED7AF C20400 ret 0004 * Referenced by a CALL at Address: |:760ED988 | :760ED7B2 51 push ecx :760ED7B3 0FBE442408 movsx eax, byte ptr [esp+08] :760ED7B8 53 push ebx :760ED7B9 55 push ebp :760ED7BA 56 push esi :760ED7BB 8B742418 mov esi, dword ptr [esp+18] :760ED7BF 57 push edi :760ED7C0 C744241001000000 mov [esp+10], 00000001 :760ED7C8 FF35FCDE0F76 push dword ptr [760FDEFC] :760ED7CE 50 push eax * Possible StringData Ref from Code Obj ->"%c:\%s" | :760ED7CF 686C730E76 push 760E736C :760ED7D4 56 push esi * Reference To: USER32.wsprintfA, Ord:02B3h | :760ED7D5 FF15A4120E76 Call dword ptr [760E12A4] :760ED7DB A184110E76 mov eax, dword ptr [760E1184] * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED7E0 8B3D80110E76 mov edi, dword ptr [760E1180] :760ED7E6 83C410 add esp, 00000010 * Possible StringData Ref from Code Obj ->"GetSfpTempDir" | :760ED7E9 BB5C730E76 mov ebx, 760E735C :760ED7EE F60004 test byte ptr [eax], 04 :760ED7F1 BD04DF0F76 mov ebp, 760FDF04 :760ED7F6 741F je 760ED817 :760ED7F8 6A04 push 00000004 :760ED7FA 53 push ebx :760ED7FB 6A7B push 0000007B :760ED7FD 55 push ebp :760ED7FE FFD7 call edi :760ED800 85C0 test eax, eax :760ED802 7413 je 760ED817 :760ED804 56 push esi * Possible StringData Ref from Code Obj ->"DS Root with new drive = %s" | :760ED805 6840730E76 push 760E7340 :760ED80A 6803020000 push 00000203 :760ED80F E817F7FFFF call 760ECF2B :760ED814 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED7F6(C), :760ED802(C) | :760ED817 56 push esi :760ED818 E88F44FFFF call 760E1CAC :760ED81D 85C0 test eax, eax :760ED81F 0F8597000000 jne 760ED8BC :760ED825 50 push eax :760ED826 56 push esi * Reference To: KERNEL32.CreateDirectoryA, Ord:0030h | :760ED827 FF1550120E76 Call dword ptr [760E1250] :760ED82D 85C0 test eax, eax :760ED82F 7544 jne 760ED875 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ED831 FF15A0110E76 Call dword ptr [760E11A0] :760ED837 89442418 mov dword ptr [esp+18], eax :760ED83B A184110E76 mov eax, dword ptr [760E1184] :760ED840 F60002 test byte ptr [eax], 02 :760ED843 7426 je 760ED86B :760ED845 6A02 push 00000002 :760ED847 53 push ebx :760ED848 6883000000 push 00000083 :760ED84D 55 push ebp :760ED84E FFD7 call edi :760ED850 85C0 test eax, eax :760ED852 7417 je 760ED86B :760ED854 FF742418 push [esp+18] :760ED858 56 push esi * Possible StringData Ref from Code Obj ->"Cannot create directory %s: error " ->"0x%x" | :760ED859 6818730E76 push 760E7318 :760ED85E 6803020000 push 00000203 :760ED863 E8C3F6FFFF call 760ECF2B :760ED868 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED843(C), :760ED852(C), :760ED8F7(C), :760ED90A(C), :760ED923(U) | :760ED86B 8364241000 and dword ptr [esp+10], 00000000 :760ED870 E9FA000000 jmp 760ED96F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED82F(C) | :760ED875 6A06 push 00000006 :760ED877 56 push esi * Reference To: KERNEL32.SetFileAttributesA, Ord:0293h | :760ED878 FF156C120E76 Call dword ptr [760E126C] :760ED87E 85C0 test eax, eax :760ED880 753A jne 760ED8BC * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ED882 FF15A0110E76 Call dword ptr [760E11A0] :760ED888 89442418 mov dword ptr [esp+18], eax :760ED88C A184110E76 mov eax, dword ptr [760E1184] :760ED891 F60002 test byte ptr [eax], 02 :760ED894 7426 je 760ED8BC :760ED896 6A02 push 00000002 :760ED898 53 push ebx :760ED899 688C000000 push 0000008C :760ED89E 55 push ebp :760ED89F FFD7 call edi :760ED8A1 85C0 test eax, eax :760ED8A3 7417 je 760ED8BC :760ED8A5 FF742418 push [esp+18] :760ED8A9 56 push esi * Possible StringData Ref from Code Obj ->"Cannot make dir %s system hidden: " ->"error 0x%x" | :760ED8AA 68E8720E76 push 760E72E8 :760ED8AF 6803020000 push 00000203 :760ED8B4 E872F6FFFF call 760ECF2B :760ED8B9 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED81F(C), :760ED880(C), :760ED894(C), :760ED8A3(C) | :760ED8BC 68DC4F0E76 push 760E4FDC :760ED8C1 56 push esi * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760ED8C2 FF1598110E76 Call dword ptr [760E1198] :760ED8C8 FF3500DF0F76 push dword ptr [760FDF00] :760ED8CE 56 push esi * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760ED8CF FF1598110E76 Call dword ptr [760E1198] :760ED8D5 56 push esi :760ED8D6 E8D143FFFF call 760E1CAC :760ED8DB 85C0 test eax, eax :760ED8DD 0F858C000000 jne 760ED96F :760ED8E3 50 push eax :760ED8E4 56 push esi * Reference To: KERNEL32.CreateDirectoryA, Ord:0030h | :760ED8E5 FF1550120E76 Call dword ptr [760E1250] :760ED8EB 85C0 test eax, eax :760ED8ED 7539 jne 760ED928 :760ED8EF A184110E76 mov eax, dword ptr [760E1184] :760ED8F4 F60002 test byte ptr [eax], 02 :760ED8F7 0F846EFFFFFF je 760ED86B :760ED8FD 6A02 push 00000002 :760ED8FF 53 push ebx :760ED900 689A000000 push 0000009A :760ED905 55 push ebp :760ED906 FFD7 call edi :760ED908 85C0 test eax, eax :760ED90A 0F845BFFFFFF je 760ED86B :760ED910 56 push esi * Possible StringData Ref from Code Obj ->"Cannot create directory %s" | :760ED911 68CC720E76 push 760E72CC :760ED916 6803020000 push 00000203 :760ED91B E80BF6FFFF call 760ECF2B :760ED920 83C40C add esp, 0000000C :760ED923 E943FFFFFF jmp 760ED86B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED8ED(C) | :760ED928 6A06 push 00000006 :760ED92A 56 push esi * Reference To: KERNEL32.SetFileAttributesA, Ord:0293h | :760ED92B FF156C120E76 Call dword ptr [760E126C] :760ED931 85C0 test eax, eax :760ED933 753A jne 760ED96F * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760ED935 FF15A0110E76 Call dword ptr [760E11A0] :760ED93B 89442418 mov dword ptr [esp+18], eax :760ED93F A184110E76 mov eax, dword ptr [760E1184] :760ED944 F60002 test byte ptr [eax], 02 :760ED947 7426 je 760ED96F :760ED949 6A02 push 00000002 :760ED94B 53 push ebx :760ED94C 68A3000000 push 000000A3 :760ED951 55 push ebp :760ED952 FFD7 call edi :760ED954 85C0 test eax, eax :760ED956 7417 je 760ED96F :760ED958 FF742418 push [esp+18] :760ED95C 56 push esi * Possible StringData Ref from Code Obj ->"Cannot make dir %s system hidden: " ->"error 0x%x" | :760ED95D 68E8720E76 push 760E72E8 :760ED962 6803020000 push 00000203 :760ED967 E8BFF5FFFF call 760ECF2B :760ED96C 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED870(U), :760ED8DD(C), :760ED933(C), :760ED947(C), :760ED956(C) | :760ED96F 8B442410 mov eax, dword ptr [esp+10] :760ED973 5F pop edi :760ED974 5E pop esi :760ED975 5D pop ebp :760ED976 5B pop ebx :760ED977 59 pop ecx :760ED978 C20800 ret 0008 * Referenced by a CALL at Address: |:760EE440 | :760ED97B 55 push ebp :760ED97C 8BEC mov ebp, esp :760ED97E 56 push esi :760ED97F 57 push edi :760ED980 FF7510 push [ebp+10] :760ED983 33F6 xor esi, esi :760ED985 FF7508 push [ebp+08] :760ED988 E825FEFFFF call 760ED7B2 :760ED98D 85C0 test eax, eax :760ED98F 7540 jne 760ED9D1 :760ED991 A184110E76 mov eax, dword ptr [760E1184] :760ED996 F60002 test byte ptr [eax], 02 :760ED999 0F849F000000 je 760EDA3E :760ED99F 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"MakeTempFileInSfpDir" | :760ED9A1 68B0730E76 push 760E73B0 :760ED9A6 68BE000000 push 000000BE :760ED9AB 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760ED9B0 FF1580110E76 Call dword ptr [760E1180] :760ED9B6 85C0 test eax, eax :760ED9B8 0F8480000000 je 760EDA3E * Possible StringData Ref from Code Obj ->"Cannot get SFP temp dir" | :760ED9BE 6898730E76 push 760E7398 :760ED9C3 6803020000 push 00000203 :760ED9C8 E85EF5FFFF call 760ECF2B :760ED9CD 59 pop ecx :760ED9CE 59 pop ecx :760ED9CF EB6D jmp 760EDA3E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED98F(C) | :760ED9D1 FF750C push [ebp+0C] * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760ED9D4 FF1554120E76 Call dword ptr [760E1254] :760ED9DA 50 push eax :760ED9DB FF750C push [ebp+0C] :760ED9DE E81153FFFF call 760E2CF4 :760ED9E3 8BF8 mov edi, eax :760ED9E5 85FF test edi, edi :760ED9E7 753C jne 760EDA25 :760ED9E9 A184110E76 mov eax, dword ptr [760E1184] :760ED9EE F60002 test byte ptr [eax], 02 :760ED9F1 744B je 760EDA3E :760ED9F3 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"MakeTempFileInSfpDir" | :760ED9F5 68B0730E76 push 760E73B0 :760ED9FA 68C5000000 push 000000C5 :760ED9FF 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDA04 FF1580110E76 Call dword ptr [760E1180] :760EDA0A 85C0 test eax, eax :760EDA0C 7430 je 760EDA3E :760EDA0E FF750C push [ebp+0C] * Possible StringData Ref from Code Obj ->"Error getting filename from path " ->"%s" | :760EDA11 6874730E76 push 760E7374 :760EDA16 6803020000 push 00000203 :760EDA1B E80BF5FFFF call 760ECF2B :760EDA20 83C40C add esp, 0000000C :760EDA23 EB19 jmp 760EDA3E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760ED9E7(C) | * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760EDA25 8B3598110E76 mov esi, dword ptr [760E1198] :760EDA2B 68DC4F0E76 push 760E4FDC :760EDA30 FF7510 push [ebp+10] :760EDA33 FFD6 call esi :760EDA35 57 push edi :760EDA36 FF7510 push [ebp+10] :760EDA39 FFD6 call esi :760EDA3B 6A01 push 00000001 :760EDA3D 5E pop esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760ED999(C), :760ED9B8(C), :760ED9CF(U), :760ED9F1(C), :760EDA0C(C) |:760EDA23(U) | :760EDA3E 8BC6 mov eax, esi :760EDA40 5F pop edi :760EDA41 5E pop esi :760EDA42 5D pop ebp :760EDA43 C20C00 ret 000C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E317C(C) | :760EDA46 A184110E76 mov eax, dword ptr [760E1184] :760EDA4B F60002 test byte ptr [eax], 02 :760EDA4E 742C je 760EDA7C :760EDA50 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpCreateSfpDb" | :760EDA52 6804740E76 push 760E7404 :760EDA57 68E0000000 push 000000E0 :760EDA5C 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDA61 FF1580110E76 Call dword ptr [760E1180] :760EDA67 85C0 test eax, eax :760EDA69 7411 je 760EDA7C * Possible StringData Ref from Code Obj ->"Cannot get write lock" | :760EDA6B 68EC730E76 push 760E73EC :760EDA70 6803020000 push 00000203 :760EDA75 E8B1F4FFFF call 760ECF2B :760EDA7A 59 pop ecx :760EDA7B 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDA4E(C), :760EDA69(C) | :760EDA7C 33FF xor edi, edi :760EDA7E E93C57FFFF jmp 760E31BF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E319A(C) | :760EDA83 A184110E76 mov eax, dword ptr [760E1184] :760EDA88 F60002 test byte ptr [eax], 02 :760EDA8B 742C je 760EDAB9 :760EDA8D 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpCreateSfpDb" | :760EDA8F 6804740E76 push 760E7404 :760EDA94 68EC000000 push 000000EC :760EDA99 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDA9E FF1580110E76 Call dword ptr [760E1180] :760EDAA4 85C0 test eax, eax :760EDAA6 7411 je 760EDAB9 * Possible StringData Ref from Code Obj ->"Cannot get sfpdb file location" | :760EDAA8 689C650E76 push 760E659C :760EDAAD 6803020000 push 00000203 :760EDAB2 E874F4FFFF call 760ECF2B :760EDAB7 59 pop ecx :760EDAB8 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDA8B(C), :760EDAA6(C) | :760EDAB9 33FF xor edi, edi :760EDABB E9F856FFFF jmp 760E31B8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E31B2(C) | :760EDAC0 A184110E76 mov eax, dword ptr [760E1184] :760EDAC5 F60002 test byte ptr [eax], 02 :760EDAC8 0F84EA56FFFF je 760E31B8 :760EDACE 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpCreateSfpDb" | :760EDAD0 6804740E76 push 760E7404 :760EDAD5 68F7000000 push 000000F7 :760EDADA 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDADF FF1580110E76 Call dword ptr [760E1180] :760EDAE5 85C0 test eax, eax :760EDAE7 0F84CB56FFFF je 760E31B8 * Possible StringData Ref from Code Obj ->"BuildSFPTableFromDataFile failed" | :760EDAED 68C8730E76 push 760E73C8 :760EDAF2 6803020000 push 00000203 :760EDAF7 E82FF4FFFF call 760ECF2B :760EDAFC 59 pop ecx :760EDAFD 59 pop ecx :760EDAFE E9B556FFFF jmp 760E31B8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E209E(C) | :760EDB03 A184110E76 mov eax, dword ptr [760E1184] :760EDB08 F60002 test byte ptr [eax], 02 :760EDB0B 742C je 760EDB39 :760EDB0D 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpPersistSfpDb" | :760EDB0F 6898740E76 push 760E7498 :760EDB14 6813010000 push 00000113 :760EDB19 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDB1E FF1580110E76 Call dword ptr [760E1180] :760EDB24 85C0 test eax, eax :760EDB26 7411 je 760EDB39 * Possible StringData Ref from Code Obj ->"Cannot get read lock" | :760EDB28 6880740E76 push 760E7480 :760EDB2D 6803020000 push 00000203 :760EDB32 E8F4F3FFFF call 760ECF2B :760EDB37 59 pop ecx :760EDB38 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDB0B(C), :760EDB26(C) | :760EDB39 33F6 xor esi, esi :760EDB3B E9EB45FFFF jmp 760E212B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E20AC(C) | :760EDB40 A184110E76 mov eax, dword ptr [760E1184] :760EDB45 F60002 test byte ptr [eax], 02 :760EDB48 742C je 760EDB76 :760EDB4A 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpPersistSfpDb" | :760EDB4C 6898740E76 push 760E7498 :760EDB51 681D010000 push 0000011D :760EDB56 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDB5B FF1580110E76 Call dword ptr [760E1180] :760EDB61 85C0 test eax, eax :760EDB63 7411 je 760EDB76 * Possible StringData Ref from Code Obj ->"Cannot create SFP dir" | :760EDB65 6868740E76 push 760E7468 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDBA7(U) | :760EDB6A 6803020000 push 00000203 :760EDB6F E8B7F3FFFF call 760ECF2B :760EDB74 59 pop ecx :760EDB75 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDB48(C), :760EDB63(C), :760EDB85(C), :760EDBA0(C), :760EDBF4(C) |:760EDC0F(C), :760EDC2E(U) | :760EDB76 33F6 xor esi, esi :760EDB78 E9A645FFFF jmp 760E2123 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E20CA(C) | :760EDB7D A184110E76 mov eax, dword ptr [760E1184] :760EDB82 F60002 test byte ptr [eax], 02 :760EDB85 74EF je 760EDB76 :760EDB87 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpPersistSfpDb" | :760EDB89 6898740E76 push 760E7498 :760EDB8E 6828010000 push 00000128 :760EDB93 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDB98 FF1580110E76 Call dword ptr [760E1180] :760EDB9E 85C0 test eax, eax :760EDBA0 74D4 je 760EDB76 * Possible StringData Ref from Code Obj ->"Cannot get sfpdb file location" | :760EDBA2 689C650E76 push 760E659C :760EDBA7 EBC1 jmp 760EDB6A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E20E2(C) | :760EDBA9 A184110E76 mov eax, dword ptr [760E1184] :760EDBAE F60002 test byte ptr [eax], 02 :760EDBB1 0F846C45FFFF je 760E2123 :760EDBB7 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpPersistSfpDb" | :760EDBB9 6898740E76 push 760E7498 :760EDBBE 6832010000 push 00000132 :760EDBC3 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDBC8 FF1580110E76 Call dword ptr [760E1180] :760EDBCE 85C0 test eax, eax :760EDBD0 0F844D45FFFF je 760E2123 * Possible StringData Ref from Code Obj ->"Error writing to db file" | :760EDBD6 684C740E76 push 760E744C :760EDBDB 6803020000 push 00000203 :760EDBE0 E846F3FFFF call 760ECF2B :760EDBE5 59 pop ecx :760EDBE6 59 pop ecx :760EDBE7 E93745FFFF jmp 760E2123 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E20FE(C) | :760EDBEC A184110E76 mov eax, dword ptr [760E1184] :760EDBF1 F60002 test byte ptr [eax], 02 :760EDBF4 7480 je 760EDB76 :760EDBF6 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpPersistSfpDb" | :760EDBF8 6898740E76 push 760E7498 :760EDBFD 6839010000 push 00000139 :760EDC02 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDC07 FF1580110E76 Call dword ptr [760E1180] :760EDC0D 85C0 test eax, eax :760EDC0F 0F8461FFFFFF je 760EDB76 :760EDC15 8D85ECFCFFFF lea eax, dword ptr [ebp+FFFFFCEC] :760EDC1B 50 push eax * Possible StringData Ref from Code Obj ->"Cannot get file hash for %s" | :760EDC1C 6820660E76 push 760E6620 :760EDC21 6803020000 push 00000203 :760EDC26 E800F3FFFF call 760ECF2B :760EDC2B 83C40C add esp, 0000000C :760EDC2E E943FFFFFF jmp 760EDB76 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E211D(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EDC33 FF15A0110E76 Call dword ptr [760E11A0] :760EDC39 8BD8 mov ebx, eax :760EDC3B A184110E76 mov eax, dword ptr [760E1184] :760EDC40 F60002 test byte ptr [eax], 02 :760EDC43 0F84DA44FFFF je 760E2123 :760EDC49 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpPersistSfpDb" | :760EDC4B 6898740E76 push 760E7498 :760EDC50 6845010000 push 00000145 :760EDC55 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDC5A FF1580110E76 Call dword ptr [760E1180] :760EDC60 85C0 test eax, eax :760EDC62 0F84BB44FFFF je 760E2123 :760EDC68 53 push ebx * Possible StringData Ref from Code Obj ->"Cannot write SfpDbHash value to " ->"registry: error %08x" | :760EDC69 6814740E76 push 760E7414 :760EDC6E 6803020000 push 00000203 :760EDC73 E8B3F2FFFF call 760ECF2B :760EDC78 83C40C add esp, 0000000C :760EDC7B E9A344FFFF jmp 760E2123 * Referenced by a CALL at Address: |:760ECE18 | Exported fn(): SfpCleanupSfpDb - Ord:001Ah :760EDC80 56 push esi :760EDC81 57 push edi :760EDC82 6A01 push 00000001 :760EDC84 BE00B00F76 mov esi, 760FB000 :760EDC89 5F pop edi :760EDC8A 8BCE mov ecx, esi :760EDC8C E8A14BFFFF call 760E2832 :760EDC91 85C0 test eax, eax :760EDC93 753A jne 760EDCCF :760EDC95 A184110E76 mov eax, dword ptr [760E1184] :760EDC9A F60002 test byte ptr [eax], 02 :760EDC9D 742C je 760EDCCB :760EDC9F 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpCreateSfpDb" | :760EDCA1 6804740E76 push 760E7404 :760EDCA6 6860010000 push 00000160 :760EDCAB 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDCB0 FF1580110E76 Call dword ptr [760E1180] :760EDCB6 85C0 test eax, eax :760EDCB8 7411 je 760EDCCB * Possible StringData Ref from Code Obj ->"Cannot get write lock" | :760EDCBA 68EC730E76 push 760E73EC :760EDCBF 6803020000 push 00000203 :760EDCC4 E862F2FFFF call 760ECF2B :760EDCC9 59 pop ecx :760EDCCA 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDC9D(C), :760EDCB8(C) | :760EDCCB 33FF xor edi, edi :760EDCCD EB0E jmp 760EDCDD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDC93(C) | :760EDCCF 8BCE mov ecx, esi :760EDCD1 E84339FFFF call 760E1619 :760EDCD6 8BCE mov ecx, esi :760EDCD8 E8BD3DFFFF call 760E1A9A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDCCD(U) | :760EDCDD 8BC7 mov eax, edi :760EDCDF 5F pop edi :760EDCE0 5E pop esi :760EDCE1 C3 ret * Referenced by a CALL at Address: |:760EBCA3 | :760EDCE2 56 push esi :760EDCE3 8B742408 mov esi, dword ptr [esp+08] :760EDCE7 85F6 test esi, esi :760EDCE9 746C je 760EDD57 :760EDCEB 56 push esi * Reference To: KERNEL32.DeleteFileA, Ord:005Ch | :760EDCEC FF1570120E76 Call dword ptr [760E1270] :760EDCF2 83F801 cmp eax, 00000001 :760EDCF5 A184110E76 mov eax, dword ptr [760E1184] :760EDCFA 7528 jne 760EDD24 :760EDCFC F60004 test byte ptr [eax], 04 :760EDCFF 7456 je 760EDD57 :760EDD01 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"DeleteWithTrace" | :760EDD03 68D4740E76 push 760E74D4 :760EDD08 6884010000 push 00000184 :760EDD0D 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDD12 FF1580110E76 Call dword ptr [760E1180] :760EDD18 85C0 test eax, eax :760EDD1A 743B je 760EDD57 :760EDD1C 56 push esi * Possible StringData Ref from Code Obj ->"Deleted file %s" | :760EDD1D 68C4740E76 push 760E74C4 :760EDD22 EB26 jmp 760EDD4A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDCFA(C) | :760EDD24 F60004 test byte ptr [eax], 04 :760EDD27 742E je 760EDD57 :760EDD29 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"DeleteWithTrace" | :760EDD2B 68D4740E76 push 760E74D4 :760EDD30 6888010000 push 00000188 :760EDD35 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDD3A FF1580110E76 Call dword ptr [760E1180] :760EDD40 85C0 test eax, eax :760EDD42 7413 je 760EDD57 :760EDD44 56 push esi * Possible StringData Ref from Code Obj ->"Could not delete file %s" | :760EDD45 68A8740E76 push 760E74A8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDD22(U) | :760EDD4A 6803020000 push 00000203 :760EDD4F E8D7F1FFFF call 760ECF2B :760EDD54 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDCE9(C), :760EDCFF(C), :760EDD1A(C), :760EDD27(C), :760EDD42(C) | :760EDD57 5E pop esi :760EDD58 C20400 ret 0004 * Referenced by a CALL at Address: |:760EDDE5 | :760EDD5B 55 push ebp :760EDD5C 8BEC mov ebp, esp :760EDD5E 53 push ebx :760EDD5F 8B5D14 mov ebx, dword ptr [ebp+14] :760EDD62 56 push esi :760EDD63 33F6 xor esi, esi :760EDD65 3B5D0C cmp ebx, dword ptr [ebp+0C] :760EDD68 57 push edi :760EDD69 8B7D18 mov edi, dword ptr [ebp+18] :760EDD6C 7505 jne 760EDD73 :760EDD6E 3B7D10 cmp edi, dword ptr [ebp+10] :760EDD71 7444 je 760EDDB7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDD6C(C) | :760EDD73 A184110E76 mov eax, dword ptr [760E1184] :760EDD78 F60004 test byte ptr [eax], 04 :760EDD7B 7449 je 760EDDC6 :760EDD7D 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CheckFileVersionAndHash" | :760EDD7F 6810750E76 push 760E7510 :760EDD84 68A0010000 push 000001A0 :760EDD89 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDD8E FF1580110E76 Call dword ptr [760E1180] :760EDD94 85C0 test eax, eax :760EDD96 742E je 760EDDC6 :760EDD98 57 push edi :760EDD99 53 push ebx :760EDD9A FF7510 push [ebp+10] :760EDD9D FF750C push [ebp+0C] :760EDDA0 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"File %s: Db ver %I64x != tempfile " ->"ver %I64x" | :760EDDA3 68E4740E76 push 760E74E4 :760EDDA8 6803020000 push 00000203 :760EDDAD E879F1FFFF call 760ECF2B :760EDDB2 83C41C add esp, 0000001C :760EDDB5 EB0F jmp 760EDDC6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDD71(C) | :760EDDB7 FF7508 push [ebp+08] :760EDDBA E8D9F5FFFF call 760ED398 :760EDDBF 85C0 test eax, eax :760EDDC1 7503 jne 760EDDC6 :760EDDC3 6A01 push 00000001 :760EDDC5 5E pop esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDD7B(C), :760EDD96(C), :760EDDB5(U), :760EDDC1(C) | :760EDDC6 8BC6 mov eax, esi :760EDDC8 5F pop edi :760EDDC9 5E pop esi :760EDDCA 5B pop ebx :760EDDCB 5D pop ebp :760EDDCC C21400 ret 0014 * Referenced by a CALL at Address: |:760EE1BF | :760EDDCF 55 push ebp :760EDDD0 8BEC mov ebp, esp :760EDDD2 56 push esi :760EDDD3 8B7510 mov esi, dword ptr [ebp+10] :760EDDD6 57 push edi :760EDDD7 8B7D0C mov edi, dword ptr [ebp+0C] :760EDDDA FF7520 push [ebp+20] :760EDDDD FF751C push [ebp+1C] :760EDDE0 56 push esi :760EDDE1 57 push edi :760EDDE2 FF7508 push [ebp+08] :760EDDE5 E871FFFFFF call 760EDD5B :760EDDEA 85C0 test eax, eax :760EDDEC 7504 jne 760EDDF2 :760EDDEE 6A01 push 00000001 :760EDDF0 EB1E jmp 760EDE10 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDDEC(C) | :760EDDF2 837D2800 cmp dword ptr [ebp+28], 00000000 :760EDDF6 7516 jne 760EDE0E :760EDDF8 837D2400 cmp dword ptr [ebp+24], 00000000 :760EDDFC 7410 je 760EDE0E :760EDDFE 3B7518 cmp esi, dword ptr [ebp+18] :760EDE01 7F0B jg 760EDE0E :760EDE03 7C05 jl 760EDE0A :760EDE05 3B7D14 cmp edi, dword ptr [ebp+14] :760EDE08 7704 ja 760EDE0E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDE03(C) | :760EDE0A 6A02 push 00000002 :760EDE0C EB02 jmp 760EDE10 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDDF6(C), :760EDDFC(C), :760EDE01(C), :760EDE08(C) | :760EDE0E 6A03 push 00000003 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDDF0(U), :760EDE0C(U) | :760EDE10 58 pop eax :760EDE11 5F pop edi :760EDE12 5E pop esi :760EDE13 5D pop ebp :760EDE14 C22400 ret 0024 * Referenced by a CALL at Addresses: |:760EB166 , :760ED5C1 | Exported fn(): SfpGetCorrectVersionOfFile - Ord:001Dh :760EDE17 56 push esi :760EDE18 57 push edi :760EDE19 BF00B00F76 mov edi, 760FB000 :760EDE1E 8BCF mov ecx, edi :760EDE20 E80C43FFFF call 760E2131 :760EDE25 85C0 test eax, eax :760EDE27 753D jne 760EDE66 :760EDE29 A184110E76 mov eax, dword ptr [760E1184] :760EDE2E F60002 test byte ptr [eax], 02 :760EDE31 742C je 760EDE5F :760EDE33 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpGetRightVersionOfFile" | :760EDE35 6828750E76 push 760E7528 :760EDE3A 68F6010000 push 000001F6 :760EDE3F 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDE44 FF1580110E76 Call dword ptr [760E1180] :760EDE4A 85C0 test eax, eax :760EDE4C 7411 je 760EDE5F * Possible StringData Ref from Code Obj ->"Cannot get read lock" | :760EDE4E 6880740E76 push 760E7480 :760EDE53 6803020000 push 00000203 :760EDE58 E8CEF0FFFF call 760ECF2B :760EDE5D 59 pop ecx :760EDE5E 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDE31(C), :760EDE4C(C) | :760EDE5F BE4F050000 mov esi, 0000054F :760EDE64 EB28 jmp 760EDE8E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDE27(C) | :760EDE66 FF742410 push [esp+10] :760EDE6A 8BCF mov ecx, edi :760EDE6C FF742410 push [esp+10] :760EDE70 E8407B0000 call 760F59B5 :760EDE75 8BF0 mov esi, eax :760EDE77 8BCF mov ecx, edi :760EDE79 F7DE neg esi :760EDE7B 1BF6 sbb esi, esi :760EDE7D 81E6CCBDDCDC and esi, DCDCBDCC :760EDE83 81C634422323 add esi, 23234234 :760EDE89 E87344FFFF call 760E2301 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDE64(U) | :760EDE8E 8BC6 mov eax, esi :760EDE90 5F pop edi :760EDE91 5E pop esi :760EDE92 C20800 ret 0008 * Referenced by a CALL at Addresses: |:760EE2C5 , :760F13D3 | :760EDE95 55 push ebp :760EDE96 8BEC mov ebp, esp :760EDE98 81EC10030000 sub esp, 00000310 :760EDE9E A046170E76 mov al, byte ptr [760E1746] :760EDEA3 53 push ebx :760EDEA4 56 push esi :760EDEA5 57 push edi :760EDEA6 8885F0FCFFFF mov byte ptr [ebp+FFFFFCF0], al :760EDEAC B9C2000000 mov ecx, 000000C2 :760EDEB1 33C0 xor eax, eax :760EDEB3 8DBDF1FCFFFF lea edi, dword ptr [ebp+FFFFFCF1] :760EDEB9 F3 repz :760EDEBA AB stosd :760EDEBB FF7508 push [ebp+08] :760EDEBE 8365FC00 and dword ptr [ebp-04], 00000000 :760EDEC2 66AB stosw :760EDEC4 AA stosb :760EDEC5 E87159FFFF call 760E383B :760EDECA 85C0 test eax, eax :760EDECC 7547 jne 760EDF15 :760EDECE A184110E76 mov eax, dword ptr [760E1184] :760EDED3 F60004 test byte ptr [eax], 04 :760EDED6 742C je 760EDF04 :760EDED8 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SFPBackupFile" | :760EDEDA 68B0750E76 push 760E75B0 :760EDEDF 681A020000 push 0000021A :760EDEE4 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDEE9 FF1580110E76 Call dword ptr [760E1180] :760EDEEF 85C0 test eax, eax :760EDEF1 7411 je 760EDF04 * Possible StringData Ref from Code Obj ->"File does not exist. No need to " ->"backup." | :760EDEF3 6888750E76 push 760E7588 :760EDEF8 6803020000 push 00000203 :760EDEFD E829F0FFFF call 760ECF2B :760EDF02 59 pop ecx :760EDF03 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDED6(C), :760EDEF1(C), :760EE013(C) | :760EDF04 C745FC01000000 mov [ebp-04], 00000001 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDF38(C), :760EDF53(C), :760EDF66(U), :760EDF93(C), :760EDFB2(C) |:760EE029(C), :760EE048(C), :760EE061(U) | :760EDF0B 8B45FC mov eax, dword ptr [ebp-04] :760EDF0E 5F pop edi :760EDF0F 5E pop esi :760EDF10 5B pop ebx :760EDF11 C9 leave :760EDF12 C20800 ret 0008 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDECC(C) | :760EDF15 BB0C030000 mov ebx, 0000030C :760EDF1A 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760EDF20 53 push ebx :760EDF21 50 push eax * Possible StringData Ref from Code Obj ->"%windir%\system\sfp\archive" | :760EDF22 68141F0E76 push 760E1F14 :760EDF27 E82C3BFFFF call 760E1A58 :760EDF2C 85C0 test eax, eax :760EDF2E 7538 jne 760EDF68 :760EDF30 A184110E76 mov eax, dword ptr [760E1184] :760EDF35 F60002 test byte ptr [eax], 02 :760EDF38 74D1 je 760EDF0B :760EDF3A 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SFPBackupFile" | :760EDF3C 68B0750E76 push 760E75B0 :760EDF41 6823020000 push 00000223 :760EDF46 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDF4B FF1580110E76 Call dword ptr [760E1180] :760EDF51 85C0 test eax, eax :760EDF53 74B6 je 760EDF0B * Possible StringData Ref from Code Obj ->"Cannot get sfp overwritten files " ->"location" | :760EDF55 6854650E76 push 760E6554 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDFBD(U) | :760EDF5A 6803020000 push 00000203 :760EDF5F E8C7EFFFFF call 760ECF2B :760EDF64 59 pop ecx :760EDF65 59 pop ecx :760EDF66 EBA3 jmp 760EDF0B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDF2E(C) | :760EDF68 8B7D0C mov edi, dword ptr [ebp+0C] :760EDF6B 85FF test edi, edi :760EDF6D 7550 jne 760EDFBF :760EDF6F 8B7D08 mov edi, dword ptr [ebp+08] :760EDF72 83C9FF or ecx, FFFFFFFF :760EDF75 33C0 xor eax, eax :760EDF77 F2 repnz :760EDF78 AE scasb :760EDF79 F7D1 not ecx :760EDF7B 49 dec ecx :760EDF7C 51 push ecx :760EDF7D FF7508 push [ebp+08] :760EDF80 E86F4DFFFF call 760E2CF4 :760EDF85 8BF8 mov edi, eax :760EDF87 85FF test edi, edi :760EDF89 7534 jne 760EDFBF :760EDF8B A184110E76 mov eax, dword ptr [760E1184] :760EDF90 F60002 test byte ptr [eax], 02 :760EDF93 0F8472FFFFFF je 760EDF0B :760EDF99 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SFPBackupFile" | :760EDF9B 68B0750E76 push 760E75B0 :760EDFA0 682D020000 push 0000022D :760EDFA5 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EDFAA FF1580110E76 Call dword ptr [760E1180] :760EDFB0 85C0 test eax, eax :760EDFB2 0F8453FFFFFF je 760EDF0B * Possible StringData Ref from Code Obj ->"Error getting to the short path " ->"name " | :760EDFB8 6860750E76 push 760E7560 :760EDFBD EB9B jmp 760EDF5A * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EDF6D(C), :760EDF89(C) | * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760EDFBF 8B3554120E76 mov esi, dword ptr [760E1254] :760EDFC5 57 push edi :760EDFC6 FFD6 call esi :760EDFC8 8BD0 mov edx, eax :760EDFCA 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760EDFD0 50 push eax :760EDFD1 89550C mov dword ptr [ebp+0C], edx :760EDFD4 FFD6 call esi :760EDFD6 8B4D0C mov ecx, dword ptr [ebp+0C] :760EDFD9 8D440101 lea eax, dword ptr [ecx+eax+01] :760EDFDD 3BC3 cmp eax, ebx :760EDFDF 731E jnb 760EDFFF * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760EDFE1 8B3598110E76 mov esi, dword ptr [760E1198] :760EDFE7 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760EDFED 68DC4F0E76 push 760E4FDC :760EDFF2 50 push eax :760EDFF3 FFD6 call esi :760EDFF5 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760EDFFB 57 push edi :760EDFFC 50 push eax :760EDFFD FFD6 call esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EDFDF(C) | :760EDFFF 8D85F0FCFFFF lea eax, dword ptr [ebp+FFFFFCF0] :760EE005 6A00 push 00000000 :760EE007 50 push eax :760EE008 FF7508 push [ebp+08] * Reference To: KERNEL32.CopyFileA, Ord:002Bh | :760EE00B FF1548120E76 Call dword ptr [760E1248] :760EE011 85C0 test eax, eax :760EE013 0F85EBFEFFFF jne 760EDF04 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EE019 FF15A0110E76 Call dword ptr [760E11A0] :760EE01F 8BF0 mov esi, eax :760EE021 A184110E76 mov eax, dword ptr [760E1184] :760EE026 F60002 test byte ptr [eax], 02 :760EE029 0F84DCFEFFFF je 760EDF0B :760EE02F 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SFPBackupFile" | :760EE031 68B0750E76 push 760E75B0 :760EE036 6841020000 push 00000241 :760EE03B 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EE040 FF1580110E76 Call dword ptr [760E1180] :760EE046 85C0 test eax, eax :760EE048 0F84BDFEFFFF je 760EDF0B :760EE04E 56 push esi * Possible StringData Ref from Code Obj ->"Error archiving file ec=%d" | :760EE04F 6844750E76 push 760E7544 :760EE054 6803020000 push 00000203 :760EE059 E8CDEEFFFF call 760ECF2B :760EE05E 83C40C add esp, 0000000C :760EE061 E9A5FEFFFF jmp 760EDF0B * Referenced by a CALL at Address: |:760EB808 | Exported fn(): SfpRestoreCorrectVersionOfFile - Ord:0022h :760EE066 55 push ebp :760EE067 8BEC mov ebp, esp :760EE069 81EC14080000 sub esp, 00000814 :760EE06F 53 push ebx :760EE070 56 push esi :760EE071 8B7508 mov esi, dword ptr [ebp+08] :760EE074 33C9 xor ecx, ecx :760EE076 B84F050000 mov eax, 0000054F :760EE07B 57 push edi :760EE07C 394E04 cmp dword ptr [esi+04], ecx :760EE07F 8945FC mov dword ptr [ebp-04], eax :760EE082 894DE8 mov dword ptr [ebp-18], ecx :760EE085 894DEC mov dword ptr [ebp-14], ecx :760EE088 894DF4 mov dword ptr [ebp-0C], ecx :760EE08B 894DF8 mov dword ptr [ebp-08], ecx :760EE08E 8945F0 mov dword ptr [ebp-10], eax :760EE091 7542 jne 760EE0D5 :760EE093 A184110E76 mov eax, dword ptr [760E1184] :760EE098 F60004 test byte ptr [eax], 04 :760EE09B 742C je 760EE0C9 :760EE09D 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SfpRestoreCorrectVersionOfFile" | :760EE09F 68B4780E76 push 760E78B4 :760EE0A4 6868020000 push 00000268 :760EE0A9 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EE0AE FF1580110E76 Call dword ptr [760E1180] :760EE0B4 85C0 test eax, eax :760EE0B6 7411 je 760EE0C9 * Possible StringData Ref from Code Obj ->"Null temp filename" | :760EE0B8 68A0780E76 push 760E78A0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE10D(U) | :760EE0BD 6803020000 push 00000203 :760EE0C2 E864EEFFFF call 760ECF2B :760EE0C7 59 pop ecx :760EE0C8 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE09B(C), :760EE0B6(C), :760EE0EB(C), :760EE106(C) | :760EE0C9 FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"SFP cannot restore file %s back" | :760EE0CB 6880780E76 push 760E7880 :760EE0D0 E943040000 jmp 760EE518 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE091(C) | :760EE0D5 B900B00F76 mov ecx, 760FB000 :760EE0DA E85240FFFF call 760E2131 :760EE0DF 85C0 test eax, eax :760EE0E1 752C jne 760EE10F :760EE0E3 A184110E76 mov eax, dword ptr [760E1184] :760EE0E8 F60002 test byte ptr [eax], 02 :760EE0EB 74DC je 760EE0C9 :760EE0ED 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpRestoreCorrectVersionOfFile" | :760EE0EF 68B4780E76 push 760E78B4 :760EE0F4 6870020000 push 00000270 :760EE0F9 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EE0FE FF1580110E76 Call dword ptr [760E1180] :760EE104 85C0 test eax, eax :760EE106 74C1 je 760EE0C9 * Possible StringData Ref from Code Obj ->"Cannot get read lock" | :760EE108 6880740E76 push 760E7480 :760EE10D EBAE jmp 760EE0BD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE0E1(C) | :760EE10F 8D45F4 lea eax, dword ptr [ebp-0C] :760EE112 50 push eax :760EE113 FF7604 push [esi+04] :760EE116 E800410000 call 760F221B * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EE11B 8B3D80110E76 mov edi, dword ptr [760E1180] :760EE121 BB04DF0F76 mov ebx, 760FDF04 :760EE126 85C0 test eax, eax :760EE128 743A je 760EE164 :760EE12A A184110E76 mov eax, dword ptr [760E1184] :760EE12F F60002 test byte ptr [eax], 02 :760EE132 7428 je 760EE15C :760EE134 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpRestoreCorrectVersionOfFile" | :760EE136 68B4780E76 push 760E78B4 :760EE13B 6878020000 push 00000278 :760EE140 53 push ebx :760EE141 FFD7 call edi :760EE143 85C0 test eax, eax :760EE145 7415 je 760EE15C :760EE147 FF7604 push [esi+04] * Possible StringData Ref from Code Obj ->"Cannot get version for %s" | :760EE14A 6864780E76 push 760E7864 :760EE14F 6803020000 push 00000203 :760EE154 E8D2EDFFFF call 760ECF2B :760EE159 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE132(C), :760EE145(C) | :760EE15C 8365F400 and dword ptr [ebp-0C], 00000000 :760EE160 8365F800 and dword ptr [ebp-08], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE128(C) | :760EE164 8D85F8FAFFFF lea eax, dword ptr [ebp+FFFFFAF8] :760EE16A 50 push eax :760EE16B FF75F8 push [ebp-08] :760EE16E FF75F4 push [ebp-0C] :760EE171 E84ACFFFFF call 760EB0C0 :760EE176 83650800 and dword ptr [ebp+08], 00000000 :760EE17A 8D45E8 lea eax, dword ptr [ebp-18] :760EE17D 50 push eax :760EE17E B900B00F76 mov ecx, 760FB000 :760EE183 FF36 push dword ptr [esi] :760EE185 E82B780000 call 760F59B5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE1E2(U) | :760EE18A 85C0 test eax, eax :760EE18C 8945E4 mov dword ptr [ebp-1C], eax :760EE18F 7453 je 760EE1E4 :760EE191 8B45E8 mov eax, dword ptr [ebp-18] :760EE194 8B4DEC mov ecx, dword ptr [ebp-14] :760EE197 3B450C cmp eax, dword ptr [ebp+0C] :760EE19A 750C jne 760EE1A8 :760EE19C 3B4D10 cmp ecx, dword ptr [ebp+10] :760EE19F 7507 jne 760EE1A8 :760EE1A1 C7450801000000 mov [ebp+08], 00000001 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE19A(C), :760EE19F(C) | :760EE1A8 FF7514 push [ebp+14] :760EE1AB FF7508 push [ebp+08] :760EE1AE FF75F8 push [ebp-08] :760EE1B1 FF75F4 push [ebp-0C] :760EE1B4 FF7510 push [ebp+10] :760EE1B7 FF750C push [ebp+0C] :760EE1BA 51 push ecx :760EE1BB 50 push eax :760EE1BC FF7604 push [esi+04] :760EE1BF E80BFCFFFF call 760EDDCF :760EE1C4 83F803 cmp eax, 00000003 :760EE1C7 8945F0 mov dword ptr [ebp-10], eax :760EE1CA 7418 je 760EE1E4 :760EE1CC 83F802 cmp eax, 00000002 :760EE1CF 7413 je 760EE1E4 :760EE1D1 8D45E8 lea eax, dword ptr [ebp-18] :760EE1D4 B900B00F76 mov ecx, 760FB000 :760EE1D9 50 push eax :760EE1DA FF75E4 push [ebp-1C] :760EE1DD E803790000 call 760F5AE5 :760EE1E2 EBA6 jmp 760EE18A * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE18F(C), :760EE1CA(C), :760EE1CF(C) | :760EE1E4 B900B00F76 mov ecx, 760FB000 :760EE1E9 E81341FFFF call 760E2301 :760EE1EE 837DF003 cmp dword ptr [ebp-10], 00000003 :760EE1F2 A184110E76 mov eax, dword ptr [760E1184] :760EE1F7 0F8495000000 je 760EE292 :760EE1FD F60002 test byte ptr [eax], 02 :760EE200 7427 je 760EE229 :760EE202 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpRestoreCorrectVersionOfFile" | :760EE204 68B4780E76 push 760E78B4 :760EE209 68A1020000 push 000002A1 :760EE20E 53 push ebx :760EE20F FFD7 call edi :760EE211 85C0 test eax, eax :760EE213 7414 je 760EE229 :760EE215 FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"SFP cannot restore file %s back. " ->"Temp file not valid" | :760EE217 682C780E76 push 760E782C :760EE21C 6803020000 push 00000203 :760EE221 E805EDFFFF call 760ECF2B :760EE226 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE200(C), :760EE213(C) | :760EE229 FF36 push dword ptr [esi] :760EE22B 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] * Possible StringData Ref from Code Obj ->"SFP cannot restore file %s back. " | :760EE231 6808780E76 push 760E7808 :760EE236 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EE237 FF1530100E76 Call dword ptr [760E1030] :760EE23D 83C40C add esp, 0000000C :760EE240 837DF002 cmp dword ptr [ebp-10], 00000002 :760EE244 7526 jne 760EE26C * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760EE246 8B3598110E76 mov esi, dword ptr [760E1198] :760EE24C 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] * Possible StringData Ref from Code Obj ->"Original file has invalid version " | :760EE252 68E4770E76 push 760E77E4 :760EE257 50 push eax :760EE258 FFD6 call esi :760EE25A 8D85F8FAFFFF lea eax, dword ptr [ebp+FFFFFAF8] :760EE260 50 push eax :760EE261 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760EE267 50 push eax :760EE268 FFD6 call esi :760EE26A EB12 jmp 760EE27E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE244(C) | :760EE26C 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] * Possible StringData Ref from Code Obj ->"Original file has invalid hash" | :760EE272 68C4770E76 push 760E77C4 :760EE277 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760EE278 FF1598110E76 Call dword ptr [760E1198] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE26A(U) | :760EE27E FF35A8DA0F76 push dword ptr [760FDAA8] :760EE284 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760EE28A 50 push eax :760EE28B 6A01 push 00000001 :760EE28D E943010000 jmp 760EE3D5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE1F7(C) | :760EE292 F60004 test byte ptr [eax], 04 :760EE295 742A je 760EE2C1 :760EE297 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SfpRestoreCorrectVersionOfFile" | :760EE299 68B4780E76 push 760E78B4 :760EE29E 68B7020000 push 000002B7 :760EE2A3 53 push ebx :760EE2A4 FFD7 call edi :760EE2A6 85C0 test eax, eax :760EE2A8 7417 je 760EE2C1 :760EE2AA FF36 push dword ptr [esi] :760EE2AC FF7604 push [esi+04] * Possible StringData Ref from Code Obj ->"Copying temp file %s to %s" | :760EE2AF 68A8770E76 push 760E77A8 :760EE2B4 6803020000 push 00000203 :760EE2B9 E86DECFFFF call 760ECF2B :760EE2BE 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE295(C), :760EE2A8(C) | :760EE2C1 6A00 push 00000000 :760EE2C3 FF36 push dword ptr [esi] :760EE2C5 E8CBFBFFFF call 760EDE95 :760EE2CA 83650800 and dword ptr [ebp+08], 00000000 :760EE2CE 6880000000 push 00000080 :760EE2D3 FF36 push dword ptr [esi] * Reference To: KERNEL32.SetFileAttributesA, Ord:0293h | :760EE2D5 FF156C120E76 Call dword ptr [760E126C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE375(U) | :760EE2DB 6A00 push 00000000 :760EE2DD FF36 push dword ptr [esi] :760EE2DF FF7604 push [esi+04] * Reference To: KERNEL32.CopyFileA, Ord:002Bh | :760EE2E2 FF1548120E76 Call dword ptr [760E1248] :760EE2E8 83F801 cmp eax, 00000001 :760EE2EB 0F8489000000 je 760EE37A * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EE2F1 FF15A0110E76 Call dword ptr [760E11A0] :760EE2F7 894514 mov dword ptr [ebp+14], eax :760EE2FA A184110E76 mov eax, dword ptr [760E1184] :760EE2FF F60002 test byte ptr [eax], 02 :760EE302 7428 je 760EE32C :760EE304 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpRestoreCorrectVersionOfFile" | :760EE306 68B4780E76 push 760E78B4 :760EE30B 68D6020000 push 000002D6 :760EE310 53 push ebx :760EE311 FFD7 call edi :760EE313 85C0 test eax, eax :760EE315 7415 je 760EE32C :760EE317 FF7514 push [ebp+14] * Possible StringData Ref from Code Obj ->"CopyFile failed: error %08x" | :760EE31A 688C770E76 push 760E778C :760EE31F 6803020000 push 00000203 :760EE324 E802ECFFFF call 760ECF2B :760EE329 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE302(C), :760EE315(C) | :760EE32C FF4508 inc [ebp+08] :760EE32F 837D0802 cmp dword ptr [ebp+08], 00000002 :760EE333 0F87AF000000 ja 760EE3E8 :760EE339 A184110E76 mov eax, dword ptr [760E1184] :760EE33E F60004 test byte ptr [eax], 04 :760EE341 7427 je 760EE36A :760EE343 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SfpRestoreCorrectVersionOfFile" | :760EE345 68B4780E76 push 760E78B4 :760EE34A 68DB020000 push 000002DB :760EE34F 53 push ebx :760EE350 FFD7 call edi :760EE352 85C0 test eax, eax :760EE354 7414 je 760EE36A :760EE356 FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"Retrying copying file %s" | :760EE358 6870770E76 push 760E7770 :760EE35D 6803020000 push 00000203 :760EE362 E8C4EBFFFF call 760ECF2B :760EE367 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE341(C), :760EE354(C) | :760EE36A 68D0070000 push 000007D0 * Reference To: KERNEL32.Sleep, Ord:02C3h | :760EE36F FF150C120E76 Call dword ptr [760E120C] :760EE375 E961FFFFFF jmp 760EE2DB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE2EB(C) | :760EE37A A184110E76 mov eax, dword ptr [760E1184] :760EE37F F60004 test byte ptr [eax], 04 :760EE382 7424 je 760EE3A8 :760EE384 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SfpRestoreCorrectVersionOfFile" | :760EE386 68B4780E76 push 760E78B4 :760EE38B 68CA020000 push 000002CA :760EE390 53 push ebx :760EE391 FFD7 call edi :760EE393 85C0 test eax, eax :760EE395 7411 je 760EE3A8 * Possible StringData Ref from Code Obj ->"File copied back" | :760EE397 685C770E76 push 760E775C :760EE39C 6803020000 push 00000203 :760EE3A1 E885EBFFFF call 760ECF2B :760EE3A6 59 pop ecx :760EE3A7 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE382(C), :760EE395(C) | :760EE3A8 8D85F8FAFFFF lea eax, dword ptr [ebp+FFFFFAF8] :760EE3AE 50 push eax :760EE3AF 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760EE3B5 FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"SFP restored file %s to version " ->"%s" | :760EE3B7 6838770E76 push 760E7738 :760EE3BC 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EE3BD FF1530100E76 Call dword ptr [760E1030] :760EE3C3 83C410 add esp, 00000010 :760EE3C6 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760EE3CC FF35A8DA0F76 push dword ptr [760FDAA8] :760EE3D2 50 push eax :760EE3D3 6A03 push 00000003 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE28D(U) | :760EE3D5 B918D30F76 mov ecx, 760FD318 :760EE3DA E8D13FFFFF call 760E23B0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE5AE(U) | :760EE3DF 8365FC00 and dword ptr [ebp-04], 00000000 :760EE3E3 E959010000 jmp 760EE541 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE333(C) | :760EE3E8 FF36 push dword ptr [esi] :760EE3EA E860F3FFFF call 760ED74F :760EE3EF 84C0 test al, al :760EE3F1 884508 mov byte ptr [ebp+08], al :760EE3F4 753D jne 760EE433 :760EE3F6 A184110E76 mov eax, dword ptr [760E1184] :760EE3FB F60002 test byte ptr [eax], 02 :760EE3FE 7427 je 760EE427 :760EE400 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpRestoreCorrectVersionOfFile" | :760EE402 68B4780E76 push 760E78B4 :760EE407 68F1020000 push 000002F1 :760EE40C 53 push ebx :760EE40D FFD7 call edi :760EE40F 85C0 test eax, eax :760EE411 7414 je 760EE427 :760EE413 FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"Cannot get drive from filename " ->"%s" | :760EE415 6814770E76 push 760E7714 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE4C1(U) | :760EE41A 6803020000 push 00000203 :760EE41F E807EBFFFF call 760ECF2B :760EE424 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE3FE(C), :760EE411(C), :760EE451(C), :760EE464(C), :760EE477(U) |:760EE4A0(C), :760EE4B3(C) | :760EE427 FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"SFP cannot restore file %s back. " ->"Error making copy of file for " ->"writing to wininit.ini" | :760EE429 68BC760E76 push 760E76BC :760EE42E E9E5000000 jmp 760EE518 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE3F4(C) | :760EE433 8D85ECF7FFFF lea eax, dword ptr [ebp+FFFFF7EC] :760EE439 50 push eax :760EE43A FF7604 push [esi+04] :760EE43D FF7508 push [ebp+08] :760EE440 E836F5FFFF call 760ED97B :760EE445 85C0 test eax, eax :760EE447 7530 jne 760EE479 :760EE449 A184110E76 mov eax, dword ptr [760E1184] :760EE44E F60002 test byte ptr [eax], 02 :760EE451 74D4 je 760EE427 :760EE453 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpRestoreCorrectVersionOfFile" | :760EE455 68B4780E76 push 760E78B4 :760EE45A 68FA020000 push 000002FA :760EE45F 53 push ebx :760EE460 FFD7 call edi :760EE462 85C0 test eax, eax :760EE464 74C1 je 760EE427 * Possible StringData Ref from Code Obj ->"Cannot make temp file path" | :760EE466 68A0760E76 push 760E76A0 :760EE46B 6803020000 push 00000203 :760EE470 E8B6EAFFFF call 760ECF2B :760EE475 59 pop ecx :760EE476 59 pop ecx :760EE477 EBAE jmp 760EE427 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE447(C) | :760EE479 8D85ECF7FFFF lea eax, dword ptr [ebp+FFFFF7EC] :760EE47F 6A00 push 00000000 :760EE481 50 push eax :760EE482 FF7604 push [esi+04] * Reference To: KERNEL32.CopyFileA, Ord:002Bh | :760EE485 FF1548120E76 Call dword ptr [760E1248] :760EE48B 85C0 test eax, eax :760EE48D 7537 jne 760EE4C6 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EE48F FF15A0110E76 Call dword ptr [760E11A0] :760EE495 894514 mov dword ptr [ebp+14], eax :760EE498 A184110E76 mov eax, dword ptr [760E1184] :760EE49D F60002 test byte ptr [eax], 02 :760EE4A0 7485 je 760EE427 :760EE4A2 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpRestoreCorrectVersionOfFile" | :760EE4A4 68B4780E76 push 760E78B4 :760EE4A9 6802030000 push 00000302 :760EE4AE 53 push ebx :760EE4AF FFD7 call edi :760EE4B1 85C0 test eax, eax :760EE4B3 0F846EFFFFFF je 760EE427 :760EE4B9 FF7514 push [ebp+14] * Possible StringData Ref from Code Obj ->"CopyFile failed: error %08x" | :760EE4BC 688C770E76 push 760E778C :760EE4C1 E954FFFFFF jmp 760EE41A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE48D(C) | :760EE4C6 8D85ECF7FFFF lea eax, dword ptr [ebp+FFFFF7EC] * Possible StringData Ref from Code Obj ->"wininit.ini" | :760EE4CC 6894760E76 push 760E7694 :760EE4D1 50 push eax :760EE4D2 FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"rename" | :760EE4D4 688C760E76 push 760E768C * Reference To: KERNEL32.WritePrivateProfileStringA, Ord:0313h | :760EE4D9 FF1544120E76 Call dword ptr [760E1244] :760EE4DF 85C0 test eax, eax :760EE4E1 A184110E76 mov eax, dword ptr [760E1184] :760EE4E6 7563 jne 760EE54B :760EE4E8 F60002 test byte ptr [eax], 02 :760EE4EB 7424 je 760EE511 :760EE4ED 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpRestoreCorrectVersionOfFile" | :760EE4EF 68B4780E76 push 760E78B4 :760EE4F4 680E030000 push 0000030E :760EE4F9 53 push ebx :760EE4FA FFD7 call edi :760EE4FC 85C0 test eax, eax :760EE4FE 7411 je 760EE511 * Possible StringData Ref from Code Obj ->"Cannot write to wininit.ini" | :760EE500 6870760E76 push 760E7670 :760EE505 6803020000 push 00000203 :760EE50A E81CEAFFFF call 760ECF2B :760EE50F 59 pop ecx :760EE510 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE4EB(C), :760EE4FE(C) | :760EE511 FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"SFP cannot restore file %s back. " ->"Error writing to wininit.ini" | :760EE513 6830760E76 push 760E7630 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE0D0(U), :760EE42E(U) | :760EE518 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760EE51E 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EE51F FF1530100E76 Call dword ptr [760E1030] :760EE525 83C40C add esp, 0000000C :760EE528 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760EE52E B918D30F76 mov ecx, 760FD318 :760EE533 FF35A8DA0F76 push dword ptr [760FDAA8] :760EE539 50 push eax :760EE53A 6A01 push 00000001 :760EE53C E86F3EFFFF call 760E23B0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE3E3(U) | :760EE541 8B45FC mov eax, dword ptr [ebp-04] :760EE544 5F pop edi :760EE545 5E pop esi :760EE546 5B pop ebx :760EE547 C9 leave :760EE548 C21000 ret 0010 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE4E6(C) | :760EE54B F60004 test byte ptr [eax], 04 :760EE54E 7424 je 760EE574 :760EE550 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SfpRestoreCorrectVersionOfFile" | :760EE552 68B4780E76 push 760E78B4 :760EE557 6813030000 push 00000313 :760EE55C 53 push ebx :760EE55D FFD7 call edi :760EE55F 85C0 test eax, eax :760EE561 7411 je 760EE574 * Possible StringData Ref from Code Obj ->"Wrote file rename to wininit.ini" | :760EE563 680C760E76 push 760E760C :760EE568 6803020000 push 00000203 :760EE56D E8B9E9FFFF call 760ECF2B :760EE572 59 pop ecx :760EE573 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE54E(C), :760EE561(C) | :760EE574 FF36 push dword ptr [esi] :760EE576 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] * Possible StringData Ref from Code Obj ->"File %s is in use. SFP made an " ->"entry into wininit.ini to restore " ->"the file" | :760EE57C 68C0750E76 push 760E75C0 :760EE581 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EE582 FF1530100E76 Call dword ptr [760E1030] :760EE588 83C40C add esp, 0000000C :760EE58B 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760EE591 B918D30F76 mov ecx, 760FD318 :760EE596 FF35A8DA0F76 push dword ptr [760FDAA8] :760EE59C 50 push eax :760EE59D 6A03 push 00000003 :760EE59F E80C3EFFFF call 760E23B0 :760EE5A4 C705A4D90F7601000000 mov dword ptr [760FD9A4], 00000001 :760EE5AE E92CFEFFFF jmp 760EE3DF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1D55(C) | :760EE5B3 FF35F8DE0F76 push dword ptr [760FDEF8] :760EE5B9 53 push ebx :760EE5BA 6803001F00 push 001F0003 * Reference To: KERNEL32.OpenEventA, Ord:0208h | :760EE5BF FF155C120E76 Call dword ptr [760E125C] :760EE5C5 8BD8 mov ebx, eax :760EE5C7 85DB test ebx, ebx :760EE5C9 0F858C37FFFF jne 760E1D5B :760EE5CF A184110E76 mov eax, dword ptr [760E1184] :760EE5D4 F60002 test byte ptr [eax], 02 :760EE5D7 0F84DD37FFFF je 760E1DBA :760EE5DD 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpIsFileProtectedS" | :760EE5DF 68D4780E76 push 760E78D4 :760EE5E4 683F030000 push 0000033F :760EE5E9 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EE5EE FF1580110E76 Call dword ptr [760E1180] :760EE5F4 85C0 test eax, eax :760EE5F6 0F84BE37FFFF je 760E1DBA * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EE5FC FF15A0110E76 Call dword ptr [760E11A0] :760EE602 50 push eax :760EE603 FF35F8DE0F76 push dword ptr [760FDEF8] * Possible StringData Ref from Code Obj ->"Cannot open event %s, error 0x%x" | :760EE609 688C640E76 push 760E648C :760EE60E 6803020000 push 00000203 :760EE613 E813E9FFFF call 760ECF2B :760EE618 83C410 add esp, 00000010 :760EE61B E99A37FFFF jmp 760E1DBA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1D6F(C) | :760EE620 A184110E76 mov eax, dword ptr [760E1184] :760EE625 F60001 test byte ptr [eax], 01 :760EE628 0F847B37FFFF je 760E1DA9 :760EE62E 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"SfpIsFileProtectedS" | :760EE630 68D4780E76 push 760E78D4 :760EE635 684B030000 push 0000034B :760EE63A 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EE63F FF1580110E76 Call dword ptr [760E1180] :760EE645 85C0 test eax, eax :760EE647 0F845C37FFFF je 760E1DA9 * Possible StringData Ref from Code Obj ->"SFP has not been initted - timing " ->"out" | :760EE64D 6864640E76 push 760E6464 :760EE652 EB32 jmp 760EE686 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1D83(C) | :760EE654 A184110E76 mov eax, dword ptr [760E1184] :760EE659 F60002 test byte ptr [eax], 02 :760EE65C 0F844737FFFF je 760E1DA9 :760EE662 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpIsFileProtectedS" | :760EE664 68D4780E76 push 760E78D4 :760EE669 6852030000 push 00000352 :760EE66E 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EE673 FF1580110E76 Call dword ptr [760E1180] :760EE679 85C0 test eax, eax :760EE67B 0F842837FFFF je 760E1DA9 * Possible StringData Ref from Code Obj ->"Cannot get read lock" | :760EE681 6880740E76 push 760E7480 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE652(U) | :760EE686 6803020000 push 00000203 :760EE68B E89BE8FFFF call 760ECF2B :760EE690 59 pop ecx :760EE691 59 pop ecx :760EE692 E91237FFFF jmp 760E1DA9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1DB4(C) | :760EE697 53 push ebx * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760EE698 FF1534120E76 Call dword ptr [760E1234] :760EE69E E91737FFFF jmp 760E1DBA * Referenced by a CALL at Address: |:760F64CD | Exported fn(): SfpGetNextProtectedFileS - Ord:001Eh :760EE6A3 55 push ebp :760EE6A4 8BEC mov ebp, esp :760EE6A6 81EC04010000 sub esp, 00000104 :760EE6AC A046170E76 mov al, byte ptr [760E1746] :760EE6B1 56 push esi :760EE6B2 57 push edi :760EE6B3 6A40 push 00000040 :760EE6B5 8885FCFEFFFF mov byte ptr [ebp+FFFFFEFC], al :760EE6BB 59 pop ecx :760EE6BC 33C0 xor eax, eax :760EE6BE 8DBDFDFEFFFF lea edi, dword ptr [ebp+FFFFFEFD] :760EE6C4 F3 repz :760EE6C5 AB stosd :760EE6C6 66AB stosw :760EE6C8 B900B00F76 mov ecx, 760FB000 :760EE6CD BE4F050000 mov esi, 0000054F :760EE6D2 AA stosb :760EE6D3 E8593AFFFF call 760E2131 :760EE6D8 85C0 test eax, eax :760EE6DA 7543 jne 760EE71F :760EE6DC A184110E76 mov eax, dword ptr [760E1184] :760EE6E1 F60002 test byte ptr [eax], 02 :760EE6E4 0F84A0010000 je 760EE88A :760EE6EA 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfcGetNextProtectedFileS" | :760EE6EC 6854790E76 push 760E7954 :760EE6F1 6881030000 push 00000381 :760EE6F6 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EE6FB FF1580110E76 Call dword ptr [760E1180] :760EE701 85C0 test eax, eax :760EE703 0F8481010000 je 760EE88A * Possible StringData Ref from Code Obj ->"Cannot get read lock" | :760EE709 6880740E76 push 760E7480 :760EE70E 6803020000 push 00000203 :760EE713 E813E8FFFF call 760ECF2B :760EE718 59 pop ecx :760EE719 59 pop ecx :760EE71A E96B010000 jmp 760EE88A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE6DA(C) | :760EE71F 53 push ebx :760EE720 8B5D08 mov ebx, dword ptr [ebp+08] :760EE723 33C9 xor ecx, ecx :760EE725 8B8308020000 mov eax, dword ptr [ebx+00000208] :760EE72B 3BC1 cmp eax, ecx :760EE72D 744B je 760EE77A :760EE72F 3B0594D20F76 cmp eax, dword ptr [760FD294] :760EE735 7443 je 760EE77A :760EE737 A184110E76 mov eax, dword ptr [760E1184] :760EE73C F60002 test byte ptr [eax], 02 :760EE73F 0F843A010000 je 760EE87F :760EE745 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfcGetNextProtectedFileS" | :760EE747 6854790E76 push 760E7954 :760EE74C 688B030000 push 0000038B :760EE751 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EE756 FF1580110E76 Call dword ptr [760E1180] :760EE75C 85C0 test eax, eax :760EE75E 0F841B010000 je 760EE87F * Possible StringData Ref from Code Obj ->"Db has been modified" | :760EE764 683C790E76 push 760E793C :760EE769 6803020000 push 00000203 :760EE76E E8B8E7FFFF call 760ECF2B :760EE773 59 pop ecx :760EE774 59 pop ecx :760EE775 E905010000 jmp 760EE87F * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE72D(C), :760EE735(C) | :760EE77A 3BC1 cmp eax, ecx :760EE77C BF04010000 mov edi, 00000104 :760EE781 746C je 760EE7EF :760EE783 51 push ecx :760EE784 51 push ecx :760EE785 8D85FCFEFFFF lea eax, dword ptr [ebp+FFFFFEFC] :760EE78B 57 push edi :760EE78C 50 push eax :760EE78D 6AFF push FFFFFFFF :760EE78F 53 push ebx :760EE790 51 push ecx :760EE791 E8EF40FFFF call 760E2885 :760EE796 50 push eax * Reference To: KERNEL32.WideCharToMultiByte, Ord:0301h | :760EE797 FF1508120E76 Call dword ptr [760E1208] :760EE79D 85C0 test eax, eax :760EE79F 754E jne 760EE7EF * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EE7A1 FF15A0110E76 Call dword ptr [760E11A0] :760EE7A7 8BF8 mov edi, eax :760EE7A9 A184110E76 mov eax, dword ptr [760E1184] :760EE7AE F60002 test byte ptr [eax], 02 :760EE7B1 0F84C8000000 je 760EE87F :760EE7B7 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfcGetNextProtectedFileS" | :760EE7B9 6854790E76 push 760E7954 :760EE7BE 689F030000 push 0000039F :760EE7C3 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EE7C8 FF1580110E76 Call dword ptr [760E1180] :760EE7CE 85C0 test eax, eax :760EE7D0 0F84A9000000 je 760EE87F :760EE7D6 57 push edi :760EE7D7 53 push ebx * Possible StringData Ref from Code Obj ->"Failed to convert %S to ANSI, " ->"error %ld" | :760EE7D8 6814790E76 push 760E7914 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE86F(U) | :760EE7DD 6803020000 push 00000203 :760EE7E2 E844E7FFFF call 760ECF2B :760EE7E7 83C410 add esp, 00000010 :760EE7EA E990000000 jmp 760EE87F * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE781(C), :760EE79F(C) | :760EE7EF 33C0 xor eax, eax :760EE7F1 B900B00F76 mov ecx, 760FB000 :760EE7F6 398308020000 cmp dword ptr [ebx+00000208], eax :760EE7FC 0F94C0 sete al :760EE7FF 50 push eax :760EE800 8D85FCFEFFFF lea eax, dword ptr [ebp+FFFFFEFC] :760EE806 50 push eax :760EE807 E8AD64FFFF call 760E4CB9 :760EE80C 8BF0 mov esi, eax :760EE80E 4E dec esi :760EE80F F7DE neg esi :760EE811 1BF6 sbb esi, esi :760EE813 83E612 and esi, 00000012 :760EE816 755C jne 760EE874 :760EE818 57 push edi :760EE819 53 push ebx :760EE81A 8D85FCFEFFFF lea eax, dword ptr [ebp+FFFFFEFC] :760EE820 6AFF push FFFFFFFF :760EE822 50 push eax :760EE823 6A00 push 00000000 :760EE825 E85B40FFFF call 760E2885 :760EE82A 50 push eax * Reference To: KERNEL32.MultiByteToWideChar, Ord:0202h | :760EE82B FF154C120E76 Call dword ptr [760E124C] :760EE831 85C0 test eax, eax :760EE833 753F jne 760EE874 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EE835 FF15A0110E76 Call dword ptr [760E11A0] :760EE83B 8BF8 mov edi, eax :760EE83D A184110E76 mov eax, dword ptr [760E1184] :760EE842 F60002 test byte ptr [eax], 02 :760EE845 7438 je 760EE87F :760EE847 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfcGetNextProtectedFileS" | :760EE849 6854790E76 push 760E7954 :760EE84E 68BC030000 push 000003BC :760EE853 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EE858 FF1580110E76 Call dword ptr [760E1180] :760EE85E 85C0 test eax, eax :760EE860 741D je 760EE87F :760EE862 8D85FCFEFFFF lea eax, dword ptr [ebp+FFFFFEFC] :760EE868 57 push edi :760EE869 50 push eax * Possible StringData Ref from Code Obj ->"Failed to convert %s to WCHAR, " ->"error %ld" | :760EE86A 68E8780E76 push 760E78E8 :760EE86F E969FFFFFF jmp 760EE7DD * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE816(C), :760EE833(C) | :760EE874 A194D20F76 mov eax, dword ptr [760FD294] :760EE879 898308020000 mov dword ptr [ebx+00000208], eax * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE73F(C), :760EE75E(C), :760EE775(U), :760EE7B1(C), :760EE7D0(C) |:760EE7EA(U), :760EE845(C), :760EE860(C) | :760EE87F B900B00F76 mov ecx, 760FB000 :760EE884 E8783AFFFF call 760E2301 :760EE889 5B pop ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE6E4(C), :760EE703(C), :760EE71A(U) | :760EE88A 8BC6 mov eax, esi :760EE88C 5F pop edi :760EE88D 5E pop esi :760EE88E C9 leave :760EE88F C20400 ret 0004 * Referenced by a CALL at Addresses: |:760EB2A0 , :760EB356 | :760EE892 83EC0C sub esp, 0000000C :760EE895 53 push ebx :760EE896 BB00B00F76 mov ebx, 760FB000 :760EE89B 33C0 xor eax, eax :760EE89D 8BCB mov ecx, ebx :760EE89F 89442404 mov dword ptr [esp+04], eax :760EE8A3 89442408 mov dword ptr [esp+08], eax :760EE8A7 8944240C mov dword ptr [esp+0C], eax :760EE8AB E88138FFFF call 760E2131 :760EE8B0 85C0 test eax, eax :760EE8B2 7543 jne 760EE8F7 :760EE8B4 A184110E76 mov eax, dword ptr [760E1184] :760EE8B9 F60002 test byte ptr [eax], 02 :760EE8BC 0F842D010000 je 760EE9EF :760EE8C2 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"DoesVersionExistinDB" | :760EE8C4 68D8790E76 push 760E79D8 :760EE8C9 68DE030000 push 000003DE :760EE8CE 6804DF0F76 push 760FDF04 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EE8D3 FF1580110E76 Call dword ptr [760E1180] :760EE8D9 85C0 test eax, eax :760EE8DB 0F840E010000 je 760EE9EF * Possible StringData Ref from Code Obj ->"Cannot get read lock" | :760EE8E1 6880740E76 push 760E7480 :760EE8E6 6803020000 push 00000203 :760EE8EB E83BE6FFFF call 760ECF2B :760EE8F0 59 pop ecx :760EE8F1 59 pop ecx :760EE8F2 E9F8000000 jmp 760EE9EF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE8B2(C) | :760EE8F7 A184110E76 mov eax, dword ptr [760E1184] :760EE8FC 55 push ebp :760EE8FD 56 push esi * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EE8FE 8B3580110E76 mov esi, dword ptr [760E1180] :760EE904 F60004 test byte ptr [eax], 04 :760EE907 57 push edi * Possible StringData Ref from Code Obj ->"DoesVersionExistinDB" | :760EE908 BDD8790E76 mov ebp, 760E79D8 :760EE90D BF04DF0F76 mov edi, 760FDF04 :760EE912 7429 je 760EE93D :760EE914 6A04 push 00000004 :760EE916 55 push ebp :760EE917 68E4030000 push 000003E4 :760EE91C 57 push edi :760EE91D FFD6 call esi :760EE91F 85C0 test eax, eax :760EE921 741A je 760EE93D :760EE923 FF742428 push [esp+28] :760EE927 FF742428 push [esp+28] * Possible StringData Ref from Code Obj ->"File version we are looking for " ->"is %I64x" | :760EE92B 68AC790E76 push 760E79AC :760EE930 6803020000 push 00000203 :760EE935 E8F1E5FFFF call 760ECF2B :760EE93A 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE912(C), :760EE921(C) | :760EE93D 8D442414 lea eax, dword ptr [esp+14] :760EE941 8BCB mov ecx, ebx :760EE943 50 push eax :760EE944 FF742424 push [esp+24] :760EE948 E868700000 call 760F59B5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE9AE(U) | :760EE94D 8BD8 mov ebx, eax :760EE94F 85DB test ebx, ebx :760EE951 0F848B000000 je 760EE9E2 :760EE957 A184110E76 mov eax, dword ptr [760E1184] :760EE95C F60004 test byte ptr [eax], 04 :760EE95F 7429 je 760EE98A :760EE961 6A04 push 00000004 :760EE963 55 push ebp :760EE964 68EE030000 push 000003EE :760EE969 57 push edi :760EE96A FFD6 call esi :760EE96C 85C0 test eax, eax :760EE96E 741A je 760EE98A :760EE970 FF742418 push [esp+18] :760EE974 FF742418 push [esp+18] * Possible StringData Ref from Code Obj ->"Curent version is %I64x" | :760EE978 6894790E76 push 760E7994 :760EE97D 6803020000 push 00000203 :760EE982 E8A4E5FFFF call 760ECF2B :760EE987 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE95F(C), :760EE96E(C) | :760EE98A 8B442414 mov eax, dword ptr [esp+14] :760EE98E 3B442424 cmp eax, dword ptr [esp+24] :760EE992 750A jne 760EE99E :760EE994 8B442418 mov eax, dword ptr [esp+18] :760EE998 3B442428 cmp eax, dword ptr [esp+28] :760EE99C 7412 je 760EE9B0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE992(C) | :760EE99E 8D442414 lea eax, dword ptr [esp+14] :760EE9A2 B900B00F76 mov ecx, 760FB000 :760EE9A7 50 push eax :760EE9A8 53 push ebx :760EE9A9 E837710000 call 760F5AE5 :760EE9AE EB9D jmp 760EE94D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE99C(C) | :760EE9B0 A184110E76 mov eax, dword ptr [760E1184] :760EE9B5 F60004 test byte ptr [eax], 04 :760EE9B8 7420 je 760EE9DA :760EE9BA 6A04 push 00000004 :760EE9BC 55 push ebp :760EE9BD 68F1030000 push 000003F1 :760EE9C2 57 push edi :760EE9C3 FFD6 call esi :760EE9C5 85C0 test eax, eax :760EE9C7 7411 je 760EE9DA * Possible StringData Ref from Code Obj ->"Found version we are looking for" | :760EE9C9 6870790E76 push 760E7970 :760EE9CE 6803020000 push 00000203 :760EE9D3 E853E5FFFF call 760ECF2B :760EE9D8 59 pop ecx :760EE9D9 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE9B8(C), :760EE9C7(C) | :760EE9DA C744241001000000 mov [esp+10], 00000001 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EE951(C) | :760EE9E2 B900B00F76 mov ecx, 760FB000 :760EE9E7 E81539FFFF call 760E2301 :760EE9EC 5F pop edi :760EE9ED 5E pop esi :760EE9EE 5D pop ebp * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EE8BC(C), :760EE8DB(C), :760EE8F2(U) | :760EE9EF 8B442404 mov eax, dword ptr [esp+04] :760EE9F3 5B pop ebx :760EE9F4 83C40C add esp, 0000000C :760EE9F7 C20C00 ret 000C * Referenced by a CALL at Addresses: |:760EBC5F , :760EF16F | :760EE9FA 55 push ebp :760EE9FB 8BEC mov ebp, esp :760EE9FD 51 push ecx :760EE9FE 53 push ebx :760EE9FF 56 push esi :760EEA00 33DB xor ebx, ebx :760EEA02 57 push edi :760EEA03 53 push ebx :760EEA04 8D45FC lea eax, dword ptr [ebp-04] :760EEA07 68B0D90F76 push 760FD9B0 :760EEA0C 50 push eax :760EEA0D 895DFC mov dword ptr [ebp-04], ebx * Reference To: WINTRUST.CryptCATAdminAcquireContext, Ord:0002h | :760EEA10 E8204EFFFF Call 760E3835 :760EEA15 85C0 test eax, eax :760EEA17 7547 jne 760EEA60 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EEA19 FF15A0110E76 Call dword ptr [760E11A0] :760EEA1F 8BF0 mov esi, eax :760EEA21 A184110E76 mov eax, dword ptr [760E1184] :760EEA26 F60004 test byte ptr [eax], 04 :760EEA29 742B je 760EEA56 :760EEA2B 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"AddCatalogToCryptoDB" | :760EEA2D 682C7A0E76 push 760E7A2C :760EEA32 6A32 push 00000032 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EEA34 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EEA39 FF1580110E76 Call dword ptr [760E1180] :760EEA3F 85C0 test eax, eax :760EEA41 7413 je 760EEA56 :760EEA43 56 push esi * Possible StringData Ref from Code Obj ->"CryptCATAdminAcquireContext() " ->"failed, ec=%d" | :760EEA44 68DC6D0E76 push 760E6DDC :760EEA49 6806030000 push 00000306 :760EEA4E E8D8E4FFFF call 760ECF2B :760EEA53 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEA29(C), :760EEA41(C) | :760EEA56 BF4F050000 mov edi, 0000054F :760EEA5B E9CD000000 jmp 760EEB2D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEA17(C) | :760EEA60 FF7508 push [ebp+08] :760EEA63 E8DC45FFFF call 760E3044 :760EEA68 8BF0 mov esi, eax :760EEA6A 3BF3 cmp esi, ebx :760EEA6C 753A jne 760EEAA8 :760EEA6E A184110E76 mov eax, dword ptr [760E1184] :760EEA73 F60004 test byte ptr [eax], 04 :760EEA76 7429 je 760EEAA1 :760EEA78 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"AddCatalogToCryptoDB" | :760EEA7A 682C7A0E76 push 760E7A2C :760EEA7F 6A3D push 0000003D * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EEA81 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EEA86 FF1580110E76 Call dword ptr [760E1180] :760EEA8C 85C0 test eax, eax :760EEA8E 7411 je 760EEAA1 * Possible StringData Ref from Code Obj ->"Not enough memory" | :760EEA90 68187A0E76 push 760E7A18 :760EEA95 6806030000 push 00000306 :760EEA9A E88CE4FFFF call 760ECF2B :760EEA9F 59 pop ecx :760EEAA0 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEA76(C), :760EEA8E(C) | :760EEAA1 BF4F050000 mov edi, 0000054F :760EEAA6 EB77 jmp 760EEB1F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEA6C(C) | :760EEAA8 56 push esi * Reference To: KERNEL32.lstrlenW, Ord:0336h | :760EEAA9 FF1500120E76 Call dword ptr [760E1200] :760EEAAF 8D440002 lea eax, dword ptr [eax+eax+02] :760EEAB3 50 push eax :760EEAB4 56 push esi :760EEAB5 E8A4590000 call 760F445E :760EEABA 53 push ebx :760EEABB 50 push eax :760EEABC 56 push esi :760EEABD FF75FC push [ebp-04] * Reference To: WINTRUST.CryptCATAdminAddCatalog, Ord:0003h | :760EEAC0 E86F540000 Call 760F3F34 :760EEAC5 8BF0 mov esi, eax :760EEAC7 3BF3 cmp esi, ebx :760EEAC9 7544 jne 760EEB0F * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EEACB FF15A0110E76 Call dword ptr [760E11A0] :760EEAD1 8BF8 mov edi, eax :760EEAD3 A184110E76 mov eax, dword ptr [760E1184] :760EEAD8 F60004 test byte ptr [eax], 04 :760EEADB 742B je 760EEB08 :760EEADD 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"AddCatalogToCryptoDB" | :760EEADF 682C7A0E76 push 760E7A2C :760EEAE4 6A52 push 00000052 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EEAE6 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EEAEB FF1580110E76 Call dword ptr [760E1180] :760EEAF1 85C0 test eax, eax :760EEAF3 7413 je 760EEB08 :760EEAF5 57 push edi * Possible StringData Ref from Code Obj ->"CryptCATAdminAddCatalog() failed, " ->"ec=%d" | :760EEAF6 68F0790E76 push 760E79F0 :760EEAFB 6806030000 push 00000306 :760EEB00 E826E4FFFF call 760ECF2B :760EEB05 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEADB(C), :760EEAF3(C) | :760EEB08 BF4F050000 mov edi, 0000054F :760EEB0D EB02 jmp 760EEB11 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEAC9(C) | :760EEB0F 33FF xor edi, edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEB0D(U) | :760EEB11 3BF3 cmp esi, ebx :760EEB13 740A je 760EEB1F :760EEB15 53 push ebx :760EEB16 56 push esi :760EEB17 FF75FC push [ebp-04] * Reference To: WINTRUST.CryptCATAdminReleaseCatalogContext, Ord:0006h | :760EEB1A E803540000 Call 760F3F22 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEAA6(U), :760EEB13(C) | :760EEB1F 395DFC cmp dword ptr [ebp-04], ebx :760EEB22 7409 je 760EEB2D :760EEB24 53 push ebx :760EEB25 FF75FC push [ebp-04] * Reference To: WINTRUST.CryptCATAdminReleaseContext, Ord:0007h | :760EEB28 E8EF530000 Call 760F3F1C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEA5B(U), :760EEB22(C) | :760EEB2D 8BC7 mov eax, edi :760EEB2F 5F pop edi :760EEB30 5E pop esi :760EEB31 5B pop ebx :760EEB32 C9 leave :760EEB33 C20400 ret 0004 * Referenced by a CALL at Address: |:760EF0A5 | :760EEB36 55 push ebp :760EEB37 8BEC mov ebp, esp :760EEB39 81ECF4070000 sub esp, 000007F4 :760EEB3F 834DE8FF or dword ptr [ebp-18], FFFFFFFF :760EEB43 834DE0FF or dword ptr [ebp-20], FFFFFFFF :760EEB47 56 push esi :760EEB48 57 push edi :760EEB49 FF7508 push [ebp+08] :760EEB4C 33FF xor edi, edi :760EEB4E 8D4DE4 lea ecx, dword ptr [ebp-1C] :760EEB51 897DF4 mov dword ptr [ebp-0C], edi :760EEB54 897DE4 mov dword ptr [ebp-1C], edi :760EEB57 897DDC mov dword ptr [ebp-24], edi :760EEB5A E88344FFFF call 760E2FE2 :760EEB5F 8BF0 mov esi, eax :760EEB61 3BF7 cmp esi, edi :760EEB63 7442 je 760EEBA7 :760EEB65 A184110E76 mov eax, dword ptr [760E1184] :760EEB6A F60002 test byte ptr [eax], 02 :760EEB6D 0F84D2010000 je 760EED45 :760EEB73 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CheckVersionOfNewCatalog" | :760EEB75 68887B0E76 push 760E7B88 :760EEB7A 6A7A push 0000007A * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EEB7C 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EEB81 FF1580110E76 Call dword ptr [760E1180] :760EEB87 85C0 test eax, eax :760EEB89 0F84B6010000 je 760EED45 :760EEB8F 56 push esi * Possible StringData Ref from Code Obj ->"CNewCatalog.Init failed %d" | :760EEB90 686C7B0E76 push 760E7B6C :760EEB95 6806030000 push 00000306 :760EEB9A E88CE3FFFF call 760ECF2B :760EEB9F 83C40C add esp, 0000000C :760EEBA2 E99E010000 jmp 760EED45 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEB63(C) | :760EEBA7 FF750C push [ebp+0C] :760EEBAA 8D4DDC lea ecx, dword ptr [ebp-24] :760EEBAD E83044FFFF call 760E2FE2 :760EEBB2 8BF0 mov esi, eax :760EEBB4 3BF7 cmp esi, edi :760EEBB6 7445 je 760EEBFD :760EEBB8 A184110E76 mov eax, dword ptr [760E1184] :760EEBBD F60002 test byte ptr [eax], 02 :760EEBC0 0F8441010000 je 760EED07 :760EEBC6 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CheckVersionOfNewCatalog" | :760EEBC8 68887B0E76 push 760E7B88 :760EEBCD 6881000000 push 00000081 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EEBD2 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EEBD7 FF1580110E76 Call dword ptr [760E1180] :760EEBDD 85C0 test eax, eax :760EEBDF 0F8422010000 je 760EED07 :760EEBE5 56 push esi * Possible StringData Ref from Code Obj ->"COldCatalog.Init failed %d" | :760EEBE6 68507B0E76 push 760E7B50 :760EEBEB 6806030000 push 00000306 :760EEBF0 E836E3FFFF call 760ECF2B :760EEBF5 83C40C add esp, 0000000C :760EEBF8 E90A010000 jmp 760EED07 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEBB6(C) | :760EEBFD 8D45EC lea eax, dword ptr [ebp-14] :760EEC00 53 push ebx :760EEC01 50 push eax :760EEC02 8D4DE4 lea ecx, dword ptr [ebp-1C] :760EEC05 E853590000 call 760F455D * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EEC0A 8B3580110E76 mov esi, dword ptr [760E1180] * Possible StringData Ref from Code Obj ->"CheckVersionOfNewCatalog" | :760EEC10 BB887B0E76 mov ebx, 760E7B88 :760EEC15 85C0 test eax, eax * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EEC17 BF30DF0F76 mov edi, 760FDF30 :760EEC1C 7532 jne 760EEC50 :760EEC1E A184110E76 mov eax, dword ptr [760E1184] :760EEC23 F60004 test byte ptr [eax], 04 :760EEC26 7420 je 760EEC48 :760EEC28 6A04 push 00000004 :760EEC2A 53 push ebx :760EEC2B 688A000000 push 0000008A :760EEC30 57 push edi :760EEC31 FFD6 call esi :760EEC33 85C0 test eax, eax :760EEC35 7411 je 760EEC48 * Possible StringData Ref from Code Obj ->"New catalog does not contain version" | :760EEC37 68287B0E76 push 760E7B28 :760EEC3C 6806030000 push 00000306 :760EEC41 E8E5E2FFFF call 760ECF2B :760EEC46 59 pop ecx :760EEC47 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEC26(C), :760EEC35(C) | :760EEC48 8365EC00 and dword ptr [ebp-14], 00000000 :760EEC4C 8365F000 and dword ptr [ebp-10], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEC1C(C) | :760EEC50 8D45F8 lea eax, dword ptr [ebp-08] :760EEC53 8D4DDC lea ecx, dword ptr [ebp-24] :760EEC56 50 push eax :760EEC57 E801590000 call 760F455D :760EEC5C 85C0 test eax, eax :760EEC5E 7532 jne 760EEC92 :760EEC60 A184110E76 mov eax, dword ptr [760E1184] :760EEC65 F60004 test byte ptr [eax], 04 :760EEC68 7420 je 760EEC8A :760EEC6A 6A04 push 00000004 :760EEC6C 53 push ebx :760EEC6D 6890000000 push 00000090 :760EEC72 57 push edi :760EEC73 FFD6 call esi :760EEC75 85C0 test eax, eax :760EEC77 7411 je 760EEC8A * Possible StringData Ref from Code Obj ->"Old catalog does not contain version" | :760EEC79 68007B0E76 push 760E7B00 :760EEC7E 6806030000 push 00000306 :760EEC83 E8A3E2FFFF call 760ECF2B :760EEC88 59 pop ecx :760EEC89 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEC68(C), :760EEC77(C) | :760EEC8A 8365F800 and dword ptr [ebp-08], 00000000 :760EEC8E 8365FC00 and dword ptr [ebp-04], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEC5E(C) | :760EEC92 A184110E76 mov eax, dword ptr [760E1184] :760EEC97 F60004 test byte ptr [eax], 04 :760EEC9A 7427 je 760EECC3 :760EEC9C 6A04 push 00000004 :760EEC9E 53 push ebx :760EEC9F 6894000000 push 00000094 :760EECA4 57 push edi :760EECA5 FFD6 call esi :760EECA7 85C0 test eax, eax :760EECA9 7418 je 760EECC3 :760EECAB FF75F0 push [ebp-10] :760EECAE FF75EC push [ebp-14] * Possible StringData Ref from Code Obj ->"New catalog version is %I64x" | :760EECB1 68E07A0E76 push 760E7AE0 :760EECB6 6806030000 push 00000306 :760EECBB E86BE2FFFF call 760ECF2B :760EECC0 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEC9A(C), :760EECA9(C) | :760EECC3 A184110E76 mov eax, dword ptr [760E1184] :760EECC8 F60004 test byte ptr [eax], 04 :760EECCB 7427 je 760EECF4 :760EECCD 6A04 push 00000004 :760EECCF 53 push ebx :760EECD0 6895000000 push 00000095 :760EECD5 57 push edi :760EECD6 FFD6 call esi :760EECD8 85C0 test eax, eax :760EECDA 7418 je 760EECF4 :760EECDC FF75FC push [ebp-04] :760EECDF FF75F8 push [ebp-08] * Possible StringData Ref from Code Obj ->"Old catalog version is %I64x" | :760EECE2 68C07A0E76 push 760E7AC0 :760EECE7 6806030000 push 00000306 :760EECEC E83AE2FFFF call 760ECF2B :760EECF1 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EECCB(C), :760EECDA(C) | :760EECF4 8B45F0 mov eax, dword ptr [ebp-10] :760EECF7 8B4DEC mov ecx, dword ptr [ebp-14] :760EECFA 3B45FC cmp eax, dword ptr [ebp-04] :760EECFD 5B pop ebx :760EECFE 7C10 jl 760EED10 :760EED00 7F05 jg 760EED07 :760EED02 3B4DF8 cmp ecx, dword ptr [ebp-08] :760EED05 7209 jb 760EED10 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEBC0(C), :760EEBDF(C), :760EEBF8(U), :760EED00(C) | :760EED07 C745F401000000 mov [ebp-0C], 00000001 :760EED0E EB35 jmp 760EED45 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EECFE(C), :760EED05(C) | :760EED10 FF75FC push [ebp-04] :760EED13 FF75F8 push [ebp-08] :760EED16 50 push eax :760EED17 51 push ecx :760EED18 FF7508 push [ebp+08] :760EED1B 8D850CF8FFFF lea eax, dword ptr [ebp+FFFFF80C] * Possible StringData Ref from Code Obj ->"SFP could not install catalog " ->"%s. Version of catalog (%I64x) " ->"is lower than that of catalog " ->"already on the system (%I64x)" | :760EED21 68447A0E76 push 760E7A44 :760EED26 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EED27 FF1530100E76 Call dword ptr [760E1030] :760EED2D 83C41C add esp, 0000001C :760EED30 8D850CF8FFFF lea eax, dword ptr [ebp+FFFFF80C] :760EED36 B918D30F76 mov ecx, 760FD318 :760EED3B 6A00 push 00000000 :760EED3D 50 push eax :760EED3E 6A01 push 00000001 :760EED40 E86B36FFFF call 760E23B0 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEB6D(C), :760EEB89(C), :760EEBA2(U), :760EED0E(U) | :760EED45 8D4DDC lea ecx, dword ptr [ebp-24] :760EED48 E87B3FFFFF call 760E2CC8 :760EED4D 8D4DE4 lea ecx, dword ptr [ebp-1C] :760EED50 E8733FFFFF call 760E2CC8 :760EED55 8B45F4 mov eax, dword ptr [ebp-0C] :760EED58 5F pop edi :760EED59 5E pop esi :760EED5A C9 leave :760EED5B C20800 ret 0008 * Referenced by a CALL at Address: |:760F61B6 | Exported fn(): SfpInstallCatalogS - Ord:001Fh :760EED5E 81EC0C080000 sub esp, 0000080C :760EED64 8364240C00 and dword ptr [esp+0C], 00000000 :760EED69 834C2410FF or dword ptr [esp+10], FFFFFFFF :760EED6E 8364240400 and dword ptr [esp+04], 00000000 :760EED73 53 push ebx :760EED74 55 push ebp :760EED75 56 push esi :760EED76 57 push edi :760EED77 8D4C2428 lea ecx, dword ptr [esp+28] :760EED7B C74424104F050000 mov [esp+10], 0000054F :760EED83 E8144DFFFF call 760E3A9C :760EED88 A184110E76 mov eax, dword ptr [760E1184] * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EED8D 8B2D80110E76 mov ebp, dword ptr [760E1180] * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EED93 BB30DF0F76 mov ebx, 760FDF30 :760EED98 F60004 test byte ptr [eax], 04 :760EED9B 7430 je 760EEDCD * Possible StringData Ref from Code Obj ->"SfpInstallCatalogS" | :760EED9D BE547D0E76 mov esi, 760E7D54 :760EEDA2 6A04 push 00000004 :760EEDA4 56 push esi :760EEDA5 68C5000000 push 000000C5 :760EEDAA 53 push ebx :760EEDAB FFD5 call ebp :760EEDAD 85C0 test eax, eax :760EEDAF 7421 je 760EEDD2 :760EEDB1 FFB42420080000 push dword ptr [esp+00000820] :760EEDB8 BF06030000 mov edi, 00000306 * Possible StringData Ref from Code Obj ->"Installing catalog %s" | :760EEDBD 683C7D0E76 push 760E7D3C :760EEDC2 57 push edi :760EEDC3 E863E1FFFF call 760ECF2B :760EEDC8 83C40C add esp, 0000000C :760EEDCB EB0A jmp 760EEDD7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EED9B(C) | * Possible StringData Ref from Code Obj ->"SfpInstallCatalogS" | :760EEDCD BE547D0E76 mov esi, 760E7D54 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEDAF(C) | :760EEDD2 BF06030000 mov edi, 00000306 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEDCB(U) | :760EEDD7 8D4C2428 lea ecx, dword ptr [esp+28] :760EEDDB E8805FFFFF call 760E4D60 :760EEDE0 85C0 test eax, eax :760EEDE2 752E jne 760EEE12 :760EEDE4 A184110E76 mov eax, dword ptr [760E1184] :760EEDE9 F60002 test byte ptr [eax], 02 :760EEDEC 0F845E050000 je 760EF350 :760EEDF2 6A02 push 00000002 :760EEDF4 56 push esi :760EEDF5 68CF000000 push 000000CF :760EEDFA 53 push ebx :760EEDFB FFD5 call ebp :760EEDFD 85C0 test eax, eax :760EEDFF 0F844B050000 je 760EF350 :760EEE05 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error initializing catalog utilities" | :760EEE07 68147D0E76 push 760E7D14 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEEA0(U) | :760EEE0C 57 push edi :760EEE0D E999030000 jmp 760EF1AB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEDE2(C) | :760EEE12 FFB42420080000 push dword ptr [esp+00000820] :760EEE19 E81D4AFFFF call 760E383B :760EEE1E 85C0 test eax, eax :760EEE20 753B jne 760EEE5D :760EEE22 A184110E76 mov eax, dword ptr [760E1184] :760EEE27 F60002 test byte ptr [eax], 02 :760EEE2A 7424 je 760EEE50 :760EEE2C 6A02 push 00000002 :760EEE2E 56 push esi :760EEE2F 68D6000000 push 000000D6 :760EEE34 53 push ebx :760EEE35 FFD5 call ebp :760EEE37 85C0 test eax, eax :760EEE39 7415 je 760EEE50 :760EEE3B FFB42420080000 push dword ptr [esp+00000820] * Possible StringData Ref from Code Obj ->"Catalog %s does not exist" | :760EEE42 68F87C0E76 push 760E7CF8 :760EEE47 57 push edi :760EEE48 E8DEE0FFFF call 760ECF2B :760EEE4D 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEE2A(C), :760EEE39(C) | :760EEE50 C744241002000000 mov [esp+10], 00000002 :760EEE58 E9F3040000 jmp 760EF350 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEE20(C) | :760EEE5D FFB42420080000 push dword ptr [esp+00000820] :760EEE64 8D4C242C lea ecx, dword ptr [esp+2C] :760EEE68 E8915FFFFF call 760E4DFE :760EEE6D 3D4F050000 cmp eax, 0000054F :760EEE72 89442424 mov dword ptr [esp+24], eax :760EEE76 752D jne 760EEEA5 :760EEE78 A184110E76 mov eax, dword ptr [760E1184] :760EEE7D F60002 test byte ptr [eax], 02 :760EEE80 0F84CA040000 je 760EF350 :760EEE86 6A02 push 00000002 :760EEE88 56 push esi :760EEE89 68E0000000 push 000000E0 :760EEE8E 53 push ebx :760EEE8F FFD5 call ebp :760EEE91 85C0 test eax, eax :760EEE93 0F84B7040000 je 760EF350 :760EEE99 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error verifying catalog" | :760EEE9B 68D8660E76 push 760E66D8 :760EEEA0 E967FFFFFF jmp 760EEE0C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEE76(C) | :760EEEA5 83F801 cmp eax, 00000001 :760EEEA8 7569 jne 760EEF13 :760EEEAA A184110E76 mov eax, dword ptr [760E1184] :760EEEAF F60002 test byte ptr [eax], 02 :760EEEB2 741F je 760EEED3 :760EEEB4 6A02 push 00000002 :760EEEB6 56 push esi :760EEEB7 68E6000000 push 000000E6 :760EEEBC 53 push ebx :760EEEBD FFD5 call ebp :760EEEBF 85C0 test eax, eax :760EEEC1 7410 je 760EEED3 :760EEEC3 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Certificate not in trusted root " ->"store" | :760EEEC5 68B0660E76 push 760E66B0 :760EEECA 57 push edi :760EEECB E85BE0FFFF call 760ECF2B :760EEED0 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEEB2(C), :760EEEC1(C) | :760EEED3 FFB42420080000 push dword ptr [esp+00000820] :760EEEDA 8D842438040000 lea eax, dword ptr [esp+00000438] :760EEEE1 C744241404000B80 mov [esp+14], 800B0004 * Possible StringData Ref from Code Obj ->"SFP could not install catalog " ->"%s - certificate is not trusted" | :760EEEE9 6870660E76 push 760E6670 :760EEEEE 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EEEEF FF1530100E76 Call dword ptr [760E1030] :760EEEF5 83C40C add esp, 0000000C :760EEEF8 8D842434040000 lea eax, dword ptr [esp+00000434] :760EEEFF B918D30F76 mov ecx, 760FD318 :760EEF04 6A00 push 00000000 :760EEF06 50 push eax :760EEF07 6A01 push 00000001 :760EEF09 E8A234FFFF call 760E23B0 :760EEF0E E93D040000 jmp 760EF350 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEEA8(C) | :760EEF13 8BBC2424080000 mov edi, dword ptr [esp+00000824] :760EEF1A 85FF test edi, edi :760EEF1C 0F84B9000000 je 760EEFDB :760EEF22 803F00 cmp byte ptr [edi], 00 :760EEF25 0F84B0000000 je 760EEFDB :760EEF2B 83C9FF or ecx, FFFFFFFF :760EEF2E 33C0 xor eax, eax :760EEF30 F2 repnz :760EEF31 AE scasb :760EEF32 F7D1 not ecx :760EEF34 2BF9 sub edi, ecx :760EEF36 8D542434 lea edx, dword ptr [esp+34] :760EEF3A 8BC1 mov eax, ecx :760EEF3C 8BF7 mov esi, edi :760EEF3E 8BFA mov edi, edx :760EEF40 6800040000 push 00000400 :760EEF45 C1E902 shr ecx, 02 :760EEF48 F3 repz :760EEF49 A5 movsd :760EEF4A 8BC8 mov ecx, eax :760EEF4C 8D442438 lea eax, dword ptr [esp+38] :760EEF50 83E103 and ecx, 00000003 :760EEF53 50 push eax :760EEF54 F3 repz :760EEF55 A4 movsb :760EEF56 8D4C2430 lea ecx, dword ptr [esp+30] :760EEF5A E8693EFFFF call 760E2DC8 :760EEF5F 85C0 test eax, eax :760EEF61 7531 jne 760EEF94 :760EEF63 A184110E76 mov eax, dword ptr [760E1184] :760EEF68 F60002 test byte ptr [eax], 02 :760EEF6B 0F84DF030000 je 760EF350 :760EEF71 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpInstallCatalogS" | :760EEF73 68547D0E76 push 760E7D54 :760EEF78 68F9000000 push 000000F9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF082(U) | :760EEF7D 53 push ebx :760EEF7E FFD5 call ebp :760EEF80 85C0 test eax, eax :760EEF82 0F84C8030000 je 760EF350 :760EEF88 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error getting the full catalog " ->"path." | :760EEF8A 68D07C0E76 push 760E7CD0 :760EEF8F E912020000 jmp 760EF1A6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEF61(C) | :760EEF94 8D442434 lea eax, dword ptr [esp+34] :760EEF98 50 push eax :760EEF99 E89D48FFFF call 760E383B :760EEF9E 85C0 test eax, eax :760EEFA0 7534 jne 760EEFD6 :760EEFA2 A184110E76 mov eax, dword ptr [760E1184] :760EEFA7 F60002 test byte ptr [eax], 02 :760EEFAA 0F8491030000 je 760EF341 :760EEFB0 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpInstallCatalogS" | :760EEFB2 68547D0E76 push 760E7D54 :760EEFB7 6800010000 push 00000100 :760EEFBC 53 push ebx :760EEFBD FFD5 call ebp :760EEFBF 85C0 test eax, eax :760EEFC1 0F847A030000 je 760EF341 :760EEFC7 8D442434 lea eax, dword ptr [esp+34] :760EEFCB 50 push eax * Possible StringData Ref from Code Obj ->"Depdendency catalog: %s does not " ->"exist" | :760EEFCC 68A87C0E76 push 760E7CA8 :760EEFD1 E95E030000 jmp 760EF334 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEFA0(C) | * Possible StringData Ref from Code Obj ->"SfpInstallCatalogS" | :760EEFD6 BE547D0E76 mov esi, 760E7D54 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEF1C(C), :760EEF25(C) | :760EEFDB 8BBC2420080000 mov edi, dword ptr [esp+00000820] :760EEFE2 83C9FF or ecx, FFFFFFFF :760EEFE5 33C0 xor eax, eax :760EEFE7 F2 repnz :760EEFE8 AE scasb :760EEFE9 F7D1 not ecx :760EEFEB 49 dec ecx :760EEFEC 51 push ecx :760EEFED FFB42424080000 push dword ptr [esp+00000824] :760EEFF4 E8FB3CFFFF call 760E2CF4 :760EEFF9 85C0 test eax, eax :760EEFFB 89442418 mov dword ptr [esp+18], eax :760EEFFF 752D jne 760EF02E :760EF001 A184110E76 mov eax, dword ptr [760E1184] :760EF006 F60002 test byte ptr [eax], 02 :760EF009 0F8441030000 je 760EF350 :760EF00F 6A02 push 00000002 :760EF011 56 push esi :760EF012 680A010000 push 0000010A :760EF017 53 push ebx :760EF018 FFD5 call ebp :760EF01A 85C0 test eax, eax :760EF01C 0F842E030000 je 760EF350 :760EF022 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error getting to the short path " ->"name for the catalog." | :760EF024 68707C0E76 push 760E7C70 :760EF029 E978010000 jmp 760EF1A6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEFFF(C) | :760EF02E 8BF8 mov edi, eax :760EF030 83C9FF or ecx, FFFFFFFF :760EF033 33C0 xor eax, eax :760EF035 8D542434 lea edx, dword ptr [esp+34] :760EF039 F2 repnz :760EF03A AE scasb :760EF03B F7D1 not ecx :760EF03D 2BF9 sub edi, ecx :760EF03F 6800040000 push 00000400 :760EF044 8BC1 mov eax, ecx :760EF046 8BF7 mov esi, edi :760EF048 8BFA mov edi, edx :760EF04A C1E902 shr ecx, 02 :760EF04D F3 repz :760EF04E A5 movsd :760EF04F 8BC8 mov ecx, eax :760EF051 8D442438 lea eax, dword ptr [esp+38] :760EF055 83E103 and ecx, 00000003 :760EF058 50 push eax :760EF059 F3 repz :760EF05A A4 movsb :760EF05B 8D4C2430 lea ecx, dword ptr [esp+30] :760EF05F E8643DFFFF call 760E2DC8 :760EF064 85C0 test eax, eax :760EF066 751F jne 760EF087 :760EF068 A184110E76 mov eax, dword ptr [760E1184] :760EF06D F60002 test byte ptr [eax], 02 :760EF070 0F84DA020000 je 760EF350 :760EF076 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpInstallCatalogS" | :760EF078 68547D0E76 push 760E7D54 :760EF07D 6815010000 push 00000115 :760EF082 E9F6FEFFFF jmp 760EEF7D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF066(C) | :760EF087 8D442434 lea eax, dword ptr [esp+34] :760EF08B 50 push eax :760EF08C E8AA47FFFF call 760E383B :760EF091 85C0 test eax, eax :760EF093 0F849A000000 je 760EF133 :760EF099 8D442434 lea eax, dword ptr [esp+34] :760EF09D 50 push eax :760EF09E FFB42424080000 push dword ptr [esp+00000824] :760EF0A5 E88CFAFFFF call 760EEB36 :760EF0AA 85C0 test eax, eax :760EF0AC 7540 jne 760EF0EE :760EF0AE A184110E76 mov eax, dword ptr [760E1184] :760EF0B3 F60002 test byte ptr [eax], 02 :760EF0B6 7429 je 760EF0E1 :760EF0B8 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpInstallCatalogS" | :760EF0BA 68547D0E76 push 760E7D54 :760EF0BF 6820010000 push 00000120 :760EF0C4 53 push ebx :760EF0C5 FFD5 call ebp :760EF0C7 85C0 test eax, eax :760EF0C9 7416 je 760EF0E1 :760EF0CB FF742418 push [esp+18] * Possible StringData Ref from Code Obj ->"Error removing catalog: %s" | :760EF0CF 68547C0E76 push 760E7C54 :760EF0D4 6806030000 push 00000306 :760EF0D9 E84DDEFFFF call 760ECF2B :760EF0DE 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF0B6(C), :760EF0C9(C) | :760EF0E1 C744241066060000 mov [esp+10], 00000666 :760EF0E9 E962020000 jmp 760EF350 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF0AC(C) | :760EF0EE 6A00 push 00000000 :760EF0F0 FF74241C push [esp+1C] * Reference To: SfpDll.SfpDeleteCatalogS | :760EF0F4 E890020000 call 760EF389 :760EF0F9 85C0 test eax, eax :760EF0FB 7436 je 760EF133 :760EF0FD A184110E76 mov eax, dword ptr [760E1184] :760EF102 F60002 test byte ptr [eax], 02 :760EF105 742C je 760EF133 * Possible StringData Ref from Code Obj ->"SfpInstallCatalogS" | :760EF107 BE547D0E76 mov esi, 760E7D54 :760EF10C 6A02 push 00000002 :760EF10E 56 push esi :760EF10F 6828010000 push 00000128 :760EF114 53 push ebx :760EF115 FFD5 call ebp :760EF117 85C0 test eax, eax :760EF119 741D je 760EF138 :760EF11B FF742418 push [esp+18] * Possible StringData Ref from Code Obj ->"Error removing catalog: %s" | :760EF11F 68547C0E76 push 760E7C54 :760EF124 6806030000 push 00000306 :760EF129 E8FDDDFFFF call 760ECF2B :760EF12E 83C40C add esp, 0000000C :760EF131 EB05 jmp 760EF138 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF093(C), :760EF0FB(C), :760EF105(C) | * Possible StringData Ref from Code Obj ->"SfpInstallCatalogS" | :760EF133 BE547D0E76 mov esi, 760E7D54 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF119(C), :760EF131(U) | :760EF138 FFB42420080000 push dword ptr [esp+00000820] :760EF13F 8D4C2420 lea ecx, dword ptr [esp+20] :760EF143 E89A3EFFFF call 760E2FE2 :760EF148 85C0 test eax, eax :760EF14A 89442410 mov dword ptr [esp+10], eax :760EF14E 7418 je 760EF168 :760EF150 A184110E76 mov eax, dword ptr [760E1184] :760EF155 F60002 test byte ptr [eax], 02 :760EF158 0F84F2010000 je 760EF350 :760EF15E 6A02 push 00000002 :760EF160 56 push esi :760EF161 6835010000 push 00000135 :760EF166 EB2A jmp 760EF192 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF14E(C) | :760EF168 FFB42420080000 push dword ptr [esp+00000820] :760EF16F E886F8FFFF call 760EE9FA :760EF174 85C0 test eax, eax :760EF176 89442410 mov dword ptr [esp+10], eax :760EF17A 743C je 760EF1B8 :760EF17C A184110E76 mov eax, dword ptr [760E1184] :760EF181 F60002 test byte ptr [eax], 02 :760EF184 0F84C6010000 je 760EF350 :760EF18A 6A02 push 00000002 :760EF18C 56 push esi :760EF18D 683D010000 push 0000013D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF166(U) | :760EF192 53 push ebx :760EF193 FFD5 call ebp :760EF195 85C0 test eax, eax :760EF197 0F84B3010000 je 760EF350 :760EF19D FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"CCatalog.Init failed %d" | :760EF1A1 683C7C0E76 push 760E7C3C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEF8F(U), :760EF029(U) | :760EF1A6 6806030000 push 00000306 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEE0D(U) | :760EF1AB E87BDDFFFF call 760ECF2B :760EF1B0 83C40C add esp, 0000000C :760EF1B3 E998010000 jmp 760EF350 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF17A(C) | :760EF1B8 BF00B00F76 mov edi, 760FB000 :760EF1BD 8BCF mov ecx, edi :760EF1BF E86E36FFFF call 760E2832 :760EF1C4 85C0 test eax, eax :760EF1C6 753A jne 760EF202 :760EF1C8 A184110E76 mov eax, dword ptr [760E1184] :760EF1CD F60002 test byte ptr [eax], 02 :760EF1D0 7423 je 760EF1F5 :760EF1D2 6A02 push 00000002 :760EF1D4 56 push esi :760EF1D5 6845010000 push 00000145 :760EF1DA 53 push ebx :760EF1DB FFD5 call ebp :760EF1DD 85C0 test eax, eax :760EF1DF 7414 je 760EF1F5 :760EF1E1 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Failed to get write lock on SFP " ->"database." | :760EF1E3 68107C0E76 push 760E7C10 :760EF1E8 6806030000 push 00000306 :760EF1ED E839DDFFFF call 760ECF2B :760EF1F2 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF1D0(C), :760EF1DF(C) | :760EF1F5 C74424104F050000 mov [esp+10], 0000054F :760EF1FD E94E010000 jmp 760EF350 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF1C6(C) | :760EF202 8D442414 lea eax, dword ptr [esp+14] :760EF206 8D4C241C lea ecx, dword ptr [esp+1C] :760EF20A 50 push eax :760EF20B E8AA3BFFFF call 760E2DBA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF27E(U) | :760EF210 85C0 test eax, eax :760EF212 89442410 mov dword ptr [esp+10], eax :760EF216 7468 je 760EF280 :760EF218 8D442434 lea eax, dword ptr [esp+34] :760EF21C 6800040000 push 00000400 :760EF221 50 push eax :760EF222 8B44241C mov eax, dword ptr [esp+1C] :760EF226 8BCF mov ecx, edi :760EF228 FF30 push dword ptr [eax] :760EF22A E8A339FFFF call 760E2BD2 :760EF22F 85C0 test eax, eax :760EF231 7419 je 760EF24C :760EF233 8B442414 mov eax, dword ptr [esp+14] :760EF237 8BCF mov ecx, edi :760EF239 FF7010 push [eax+10] :760EF23C FF700C push [eax+0C] :760EF23F FF7008 push [eax+08] :760EF242 8D442440 lea eax, dword ptr [esp+40] :760EF246 50 push eax :760EF247 E86434FFFF call 760E26B0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF231(C) | :760EF24C 8B4C2414 mov ecx, dword ptr [esp+14] :760EF250 85C9 test ecx, ecx :760EF252 894C2430 mov dword ptr [esp+30], ecx :760EF256 740F je 760EF267 :760EF258 E8163AFFFF call 760E2C73 :760EF25D FF742430 push [esp+30] * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760EF261 E8E526FFFF Call 760E194B :760EF266 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF256(C) | :760EF267 8364241400 and dword ptr [esp+14], 00000000 :760EF26C 8D442414 lea eax, dword ptr [esp+14] :760EF270 50 push eax :760EF271 8D4C2420 lea ecx, dword ptr [esp+20] :760EF275 FF742414 push [esp+14] :760EF279 E8AD36FFFF call 760E292B :760EF27E EB90 jmp 760EF210 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF216(C) | :760EF280 E854DDFFFF call 760ECFD9 :760EF285 E87D45FFFF call 760E3807 :760EF28A 8BCF mov ecx, edi :760EF28C E80928FFFF call 760E1A9A * Reference To: SfpDll.SfpPersistSfpDb | :760EF291 E8EB2DFFFF call 760E2081 :760EF296 FFB42420080000 push dword ptr [esp+00000820] :760EF29D 8D842438040000 lea eax, dword ptr [esp+00000438] * Possible StringData Ref from Code Obj ->"SFP installed catalog %s" | :760EF2A4 68F47B0E76 push 760E7BF4 :760EF2A9 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EF2AA FF1530100E76 Call dword ptr [760E1030] :760EF2B0 83C40C add esp, 0000000C :760EF2B3 837C242402 cmp dword ptr [esp+24], 00000002 :760EF2B8 7513 jne 760EF2CD :760EF2BA 8D842434040000 lea eax, dword ptr [esp+00000434] * Possible StringData Ref from Code Obj ->" - allowing non-Millennium certificate" | :760EF2C1 68CC7B0E76 push 760E7BCC :760EF2C6 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760EF2C7 FF1598110E76 Call dword ptr [760E1198] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF2B8(C) | :760EF2CD FF35A8DA0F76 push dword ptr [760FDAA8] :760EF2D3 8D842438040000 lea eax, dword ptr [esp+00000438] :760EF2DA B918D30F76 mov ecx, 760FD318 :760EF2DF 50 push eax :760EF2E0 33C0 xor eax, eax :760EF2E2 837C242C02 cmp dword ptr [esp+2C], 00000002 :760EF2E7 0F95C0 setne al :760EF2EA 48 dec eax :760EF2EB 24FE and al, FE :760EF2ED 83C003 add eax, 00000003 :760EF2F0 50 push eax :760EF2F1 E8BA30FFFF call 760E23B0 :760EF2F6 8B842424080000 mov eax, dword ptr [esp+00000824] :760EF2FD 85C0 test eax, eax :760EF2FF 744A je 760EF34B :760EF301 803800 cmp byte ptr [eax], 00 :760EF304 7445 je 760EF34B :760EF306 50 push eax :760EF307 FF74241C push [esp+1C] :760EF30B E888030000 call 760EF698 :760EF310 85C0 test eax, eax :760EF312 7537 jne 760EF34B :760EF314 A184110E76 mov eax, dword ptr [760E1184] :760EF319 F60002 test byte ptr [eax], 02 :760EF31C 7423 je 760EF341 :760EF31E 6A02 push 00000002 :760EF320 56 push esi :760EF321 6886010000 push 00000186 :760EF326 53 push ebx :760EF327 FFD5 call ebp :760EF329 85C0 test eax, eax :760EF32B 7414 je 760EF341 :760EF32D 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error updating catalog dependencies." | :760EF32F 68A47B0E76 push 760E7BA4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EEFD1(U) | :760EF334 6806030000 push 00000306 :760EF339 E8EDDBFFFF call 760ECF2B :760EF33E 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEFAA(C), :760EEFC1(C), :760EF31C(C), :760EF32B(C) | :760EF341 C744241057000000 mov [esp+10], 00000057 :760EF349 EB05 jmp 760EF350 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF2FF(C), :760EF304(C), :760EF312(C) | :760EF34B 8364241000 and dword ptr [esp+10], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EEDEC(C), :760EEDFF(C), :760EEE58(U), :760EEE80(C), :760EEE93(C) |:760EEF0E(U), :760EEF6B(C), :760EEF82(C), :760EF009(C), :760EF01C(C) |:760EF070(C), :760EF0E9(U), :760EF158(C), :760EF184(C), :760EF197(C) |:760EF1B3(U), :760EF1FD(U), :760EF349(U) | :760EF350 8B4C2414 mov ecx, dword ptr [esp+14] :760EF354 85C9 test ecx, ecx :760EF356 740E je 760EF366 :760EF358 8BF1 mov esi, ecx :760EF35A E81439FFFF call 760E2C73 :760EF35F 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760EF360 E8E625FFFF Call 760E194B :760EF365 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF356(C) | :760EF366 8D4C2428 lea ecx, dword ptr [esp+28] :760EF36A E8522AFFFF call 760E1DC1 :760EF36F 8D4C241C lea ecx, dword ptr [esp+1C] :760EF373 E85039FFFF call 760E2CC8 :760EF378 8B442410 mov eax, dword ptr [esp+10] :760EF37C 5F pop edi :760EF37D 5E pop esi :760EF37E 5D pop ebp :760EF37F 5B pop ebx :760EF380 81C40C080000 add esp, 0000080C :760EF386 C20800 ret 0008 * Referenced by a CALL at Addresses: |:760EF0F4 , :760EFACC , :760F62D2 | Exported fn(): SfpDeleteCatalogS - Ord:001Ch :760EF389 55 push ebp :760EF38A 8BEC mov ebp, esp :760EF38C 81EC04080000 sub esp, 00000804 :760EF392 8365FC00 and dword ptr [ebp-04], 00000000 :760EF396 53 push ebx :760EF397 56 push esi :760EF398 57 push edi :760EF399 8D4DE8 lea ecx, dword ptr [ebp-18] :760EF39C C745F44F050000 mov [ebp-0C], 0000054F :760EF3A3 E8F446FFFF call 760E3A9C :760EF3A8 A184110E76 mov eax, dword ptr [760E1184] * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EF3AD 8B3580110E76 mov esi, dword ptr [760E1180] * Possible StringData Ref from Code Obj ->"SfpDeleteCatalogS" | :760EF3B3 BB707E0E76 mov ebx, 760E7E70 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EF3B8 BF30DF0F76 mov edi, 760FDF30 :760EF3BD F60004 test byte ptr [eax], 04 :760EF3C0 7424 je 760EF3E6 :760EF3C2 6A04 push 00000004 :760EF3C4 53 push ebx :760EF3C5 68B3010000 push 000001B3 :760EF3CA 57 push edi :760EF3CB FFD6 call esi :760EF3CD 85C0 test eax, eax :760EF3CF 7415 je 760EF3E6 :760EF3D1 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Deleting catalog %s" | :760EF3D4 685C7E0E76 push 760E7E5C :760EF3D9 6806030000 push 00000306 :760EF3DE E848DBFFFF call 760ECF2B :760EF3E3 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF3C0(C), :760EF3CF(C) | :760EF3E6 8D4DE8 lea ecx, dword ptr [ebp-18] :760EF3E9 E87259FFFF call 760E4D60 :760EF3EE 85C0 test eax, eax :760EF3F0 753A jne 760EF42C :760EF3F2 A184110E76 mov eax, dword ptr [760E1184] :760EF3F7 F60002 test byte ptr [eax], 02 :760EF3FA 0F843A020000 je 760EF63A :760EF400 6A02 push 00000002 :760EF402 53 push ebx :760EF403 68BD010000 push 000001BD :760EF408 57 push edi :760EF409 FFD6 call esi :760EF40B 85C0 test eax, eax :760EF40D 0F8427020000 je 760EF63A :760EF413 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error initializing the catalog " ->"utilities." | :760EF415 68307E0E76 push 760E7E30 :760EF41A 6806030000 push 00000306 :760EF41F E807DBFFFF call 760ECF2B :760EF424 83C40C add esp, 0000000C :760EF427 E90E020000 jmp 760EF63A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF3F0(C) | :760EF42C FF7508 push [ebp+08] :760EF42F 8D4DE8 lea ecx, dword ptr [ebp-18] :760EF432 E86B590000 call 760F4DA2 :760EF437 85C0 test eax, eax :760EF439 8945F8 mov dword ptr [ebp-08], eax :760EF43C 753A jne 760EF478 :760EF43E A184110E76 mov eax, dword ptr [760E1184] :760EF443 F60002 test byte ptr [eax], 02 :760EF446 7424 je 760EF46C :760EF448 6A02 push 00000002 :760EF44A 53 push ebx :760EF44B 68C5010000 push 000001C5 :760EF450 57 push edi :760EF451 FFD6 call esi :760EF453 85C0 test eax, eax :760EF455 7415 je 760EF46C :760EF457 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Failed to open catalog %s" | :760EF45A 68147E0E76 push 760E7E14 :760EF45F 6806030000 push 00000306 :760EF464 E8C2DAFFFF call 760ECF2B :760EF469 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF446(C), :760EF455(C) | :760EF46C C745F46E000000 mov [ebp-0C], 0000006E :760EF473 E9AD010000 jmp 760EF625 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF43C(C) | :760EF478 B900B00F76 mov ecx, 760FB000 :760EF47D E8B033FFFF call 760E2832 :760EF482 85C0 test eax, eax :760EF484 752D jne 760EF4B3 :760EF486 A184110E76 mov eax, dword ptr [760E1184] :760EF48B F60002 test byte ptr [eax], 02 :760EF48E 0F8491010000 je 760EF625 :760EF494 6A02 push 00000002 :760EF496 53 push ebx :760EF497 68D0010000 push 000001D0 :760EF49C 57 push edi :760EF49D FFD6 call esi :760EF49F 85C0 test eax, eax :760EF4A1 0F847E010000 je 760EF625 :760EF4A7 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Failed to get write lock on SFP " ->"database." | :760EF4A9 68107C0E76 push 760E7C10 :760EF4AE E965010000 jmp 760EF618 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF484(C) | :760EF4B3 8B4DF8 mov ecx, dword ptr [ebp-08] :760EF4B6 8D45FC lea eax, dword ptr [ebp-04] :760EF4B9 50 push eax :760EF4BA E8FB38FFFF call 760E2DBA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF580(U) | :760EF4BF 85C0 test eax, eax :760EF4C1 8945F0 mov dword ptr [ebp-10], eax :760EF4C4 0F84BB000000 je 760EF585 :760EF4CA 8D85FCF7FFFF lea eax, dword ptr [ebp+FFFFF7FC] :760EF4D0 6800040000 push 00000400 :760EF4D5 50 push eax :760EF4D6 8B45FC mov eax, dword ptr [ebp-04] :760EF4D9 B900B00F76 mov ecx, 760FB000 :760EF4DE FF30 push dword ptr [eax] :760EF4E0 E8ED36FFFF call 760E2BD2 :760EF4E5 85C0 test eax, eax :760EF4E7 746C je 760EF555 :760EF4E9 8B45FC mov eax, dword ptr [ebp-04] :760EF4EC B900B00F76 mov ecx, 760FB000 :760EF4F1 FF700C push [eax+0C] :760EF4F4 FF7008 push [eax+08] :760EF4F7 8D85FCF7FFFF lea eax, dword ptr [ebp+FFFFF7FC] :760EF4FD 50 push eax :760EF4FE E80E28FFFF call 760E1D11 :760EF503 85C0 test eax, eax :760EF505 744E je 760EF555 :760EF507 8B45FC mov eax, dword ptr [ebp-04] :760EF50A B900B00F76 mov ecx, 760FB000 :760EF50F FF7010 push [eax+10] :760EF512 FF700C push [eax+0C] :760EF515 FF7008 push [eax+08] :760EF518 8D85FCF7FFFF lea eax, dword ptr [ebp+FFFFF7FC] :760EF51E 50 push eax :760EF51F E8F4620000 call 760F5818 :760EF524 85C0 test eax, eax :760EF526 752D jne 760EF555 :760EF528 A184110E76 mov eax, dword ptr [760E1184] :760EF52D F60002 test byte ptr [eax], 02 :760EF530 7423 je 760EF555 :760EF532 6A02 push 00000002 :760EF534 53 push ebx :760EF535 68EB010000 push 000001EB :760EF53A 57 push edi :760EF53B FFD6 call esi :760EF53D 85C0 test eax, eax :760EF53F 7414 je 760EF555 :760EF541 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Failed to remove catalog entry " ->"from SFPDb" | :760EF543 68E87D0E76 push 760E7DE8 :760EF548 6806030000 push 00000306 :760EF54D E8D9D9FFFF call 760ECF2B :760EF552 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF4E7(C), :760EF505(C), :760EF526(C), :760EF530(C), :760EF53F(C) | :760EF555 8B4DFC mov ecx, dword ptr [ebp-04] :760EF558 85C9 test ecx, ecx :760EF55A 894DE4 mov dword ptr [ebp-1C], ecx :760EF55D 740E je 760EF56D :760EF55F E80F37FFFF call 760E2C73 :760EF564 FF75E4 push [ebp-1C] * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760EF567 E8DF23FFFF Call 760E194B :760EF56C 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF55D(C) | :760EF56D 8B4DF8 mov ecx, dword ptr [ebp-08] :760EF570 8365FC00 and dword ptr [ebp-04], 00000000 :760EF574 8D45FC lea eax, dword ptr [ebp-04] :760EF577 50 push eax :760EF578 FF75F0 push [ebp-10] :760EF57B E8AB33FFFF call 760E292B :760EF580 E93AFFFFFF jmp 760EF4BF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF4C4(C) | :760EF585 8B4DF8 mov ecx, dword ptr [ebp-08] :760EF588 E83B37FFFF call 760E2CC8 :760EF58D FF75F8 push [ebp-08] * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760EF590 E8B623FFFF Call 760E194B :760EF595 59 pop ecx :760EF596 E83EDAFFFF call 760ECFD9 :760EF59B E86742FFFF call 760E3807 :760EF5A0 B900B00F76 mov ecx, 760FB000 :760EF5A5 E8F024FFFF call 760E1A9A * Reference To: SfpDll.SfpPersistSfpDb | :760EF5AA E8D22AFFFF call 760E2081 :760EF5AF 837D0C00 cmp dword ptr [ebp+0C], 00000000 :760EF5B3 0F84CC000000 je 760EF685 :760EF5B9 FF7508 push [ebp+08] :760EF5BC E8E1010000 call 760EF7A2 :760EF5C1 85C0 test eax, eax :760EF5C3 7523 jne 760EF5E8 :760EF5C5 A184110E76 mov eax, dword ptr [760E1184] :760EF5CA F60002 test byte ptr [eax], 02 :760EF5CD 7456 je 760EF625 :760EF5CF 6A02 push 00000002 :760EF5D1 53 push ebx :760EF5D2 681F020000 push 0000021F :760EF5D7 57 push edi :760EF5D8 FFD6 call esi :760EF5DA 85C0 test eax, eax :760EF5DC 7447 je 760EF625 :760EF5DE FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Error removing catalog depenendies " ->"for catalog %s" | :760EF5E1 68B47D0E76 push 760E7DB4 :760EF5E6 EB30 jmp 760EF618 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF5C3(C) | :760EF5E8 FF7508 push [ebp+08] :760EF5EB 8D4DE8 lea ecx, dword ptr [ebp-18] :760EF5EE E83A590000 call 760F4F2D :760EF5F3 85C0 test eax, eax :760EF5F5 755D jne 760EF654 :760EF5F7 A184110E76 mov eax, dword ptr [760E1184] :760EF5FC F60002 test byte ptr [eax], 02 :760EF5FF 7424 je 760EF625 :760EF601 6A02 push 00000002 :760EF603 53 push ebx :760EF604 6826020000 push 00000226 :760EF609 57 push edi :760EF60A FFD6 call esi :760EF60C 85C0 test eax, eax :760EF60E 7415 je 760EF625 :760EF610 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Error removing catalog file %s " ->"from catalog store." | :760EF613 68807D0E76 push 760E7D80 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF4AE(U), :760EF5E6(U) | :760EF618 6806030000 push 00000306 :760EF61D E809D9FFFF call 760ECF2B :760EF622 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF473(U), :760EF48E(C), :760EF4A1(C), :760EF5CD(C), :760EF5DC(C) |:760EF5FF(C), :760EF60E(C) | :760EF625 8B4DF8 mov ecx, dword ptr [ebp-08] :760EF628 85C9 test ecx, ecx :760EF62A 740E je 760EF63A :760EF62C E89736FFFF call 760E2CC8 :760EF631 FF75F8 push [ebp-08] * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760EF634 E81223FFFF Call 760E194B :760EF639 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF3FA(C), :760EF40D(C), :760EF427(U), :760EF62A(C) | :760EF63A 8B4DFC mov ecx, dword ptr [ebp-04] :760EF63D 85C9 test ecx, ecx :760EF63F 740E je 760EF64F :760EF641 8BF1 mov esi, ecx :760EF643 E82B36FFFF call 760E2C73 :760EF648 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760EF649 E8FD22FFFF Call 760E194B :760EF64E 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF63F(C) | :760EF64F 8B75F4 mov esi, dword ptr [ebp-0C] :760EF652 EB33 jmp 760EF687 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF5F5(C) | :760EF654 FF7508 push [ebp+08] :760EF657 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] * Possible StringData Ref from Code Obj ->"SFP removed catalog %s" | :760EF65D 68687D0E76 push 760E7D68 :760EF662 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EF663 FF1530100E76 Call dword ptr [760E1030] :760EF669 83C40C add esp, 0000000C :760EF66C 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760EF672 B918D30F76 mov ecx, 760FD318 :760EF677 FF35A8DA0F76 push dword ptr [760FDAA8] :760EF67D 50 push eax :760EF67E 6A03 push 00000003 :760EF680 E82B2DFFFF call 760E23B0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF5B3(C) | :760EF685 33F6 xor esi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF652(U) | :760EF687 8D4DE8 lea ecx, dword ptr [ebp-18] :760EF68A E83227FFFF call 760E1DC1 :760EF68F 8BC6 mov eax, esi :760EF691 5F pop edi :760EF692 5E pop esi :760EF693 5B pop ebx :760EF694 C9 leave :760EF695 C20800 ret 0008 * Referenced by a CALL at Address: |:760EF30B | :760EF698 55 push ebp :760EF699 8BEC mov ebp, esp :760EF69B 81EC00040000 sub esp, 00000400 :760EF6A1 57 push edi :760EF6A2 33FF xor edi, edi :760EF6A4 397D0C cmp dword ptr [ebp+0C], edi :760EF6A7 0F84B6000000 je 760EF763 :760EF6AD 397D08 cmp dword ptr [ebp+08], edi :760EF6B0 0F84AD000000 je 760EF763 :760EF6B6 FF750C push [ebp+0C] :760EF6B9 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] * Possible StringData Ref from Code Obj ->"Software\Microsoft\Windows\CurrentVersion\Syst" ->"emFileProtection\CatDepend" | :760EF6BF 68507F0E76 push 760E7F50 :760EF6C4 68442E0E76 push 760E2E44 :760EF6C9 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EF6CA FF1530100E76 Call dword ptr [760E1030] :760EF6D0 83C410 add esp, 00000010 :760EF6D3 3D00040000 cmp eax, 00000400 :760EF6D8 7C35 jl 760EF70F :760EF6DA A184110E76 mov eax, dword ptr [760E1184] :760EF6DF F60002 test byte ptr [eax], 02 :760EF6E2 0F84B3000000 je 760EF79B :760EF6E8 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"AddCatalogDependency(LPTSTR pszCatalog, " ->"LPTSTR pszDependency)" | :760EF6EA 68107F0E76 push 760E7F10 :760EF6EF 686C020000 push 0000026C * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EF6F4 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EF6F9 FF1580110E76 Call dword ptr [760E1180] :760EF6FF 85C0 test eax, eax :760EF701 0F8494000000 je 760EF79B :760EF707 57 push edi * Possible StringData Ref from Code Obj ->"Fatal error, buffer overrun in " ->"UpdateCatalogDependency" | :760EF708 68D87E0E76 push 760E7ED8 :760EF70D EB7F jmp 760EF78E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF6D8(C) | :760EF70F 6A04 push 00000004 :760EF711 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760EF717 FF7508 push [ebp+08] :760EF71A C7450C01000000 mov [ebp+0C], 00000001 :760EF721 50 push eax :760EF722 8D450C lea eax, dword ptr [ebp+0C] :760EF725 6A04 push 00000004 :760EF727 50 push eax :760EF728 E8712BFFFF call 760E229E :760EF72D 85C0 test eax, eax :760EF72F 752D jne 760EF75E :760EF731 A184110E76 mov eax, dword ptr [760E1184] :760EF736 F60002 test byte ptr [eax], 02 :760EF739 7460 je 760EF79B :760EF73B 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"AddCatalogDependency(LPTSTR pszCatalog, " ->"LPTSTR pszDependency)" | :760EF73D 68107F0E76 push 760E7F10 :760EF742 6877020000 push 00000277 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EF747 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EF74C FF1580110E76 Call dword ptr [760E1180] :760EF752 85C0 test eax, eax :760EF754 7445 je 760EF79B :760EF756 57 push edi * Possible StringData Ref from Code Obj ->"Error writing dependency key" | :760EF757 68B87E0E76 push 760E7EB8 :760EF75C EB30 jmp 760EF78E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF72F(C) | :760EF75E 6A01 push 00000001 :760EF760 58 pop eax :760EF761 EB3A jmp 760EF79D * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF6A7(C), :760EF6B0(C) | :760EF763 A184110E76 mov eax, dword ptr [760E1184] :760EF768 F60002 test byte ptr [eax], 02 :760EF76B 742E je 760EF79B :760EF76D 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"AddCatalogDependency(LPTSTR pszCatalog, " ->"LPTSTR pszDependency)" | :760EF76F 68107F0E76 push 760E7F10 :760EF774 6866020000 push 00000266 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EF779 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EF77E FF1580110E76 Call dword ptr [760E1180] :760EF784 85C0 test eax, eax :760EF786 7413 je 760EF79B :760EF788 57 push edi * Possible StringData Ref from Code Obj ->"Null pointer's passed to UpdateCatalogDependen" ->"cy" | :760EF789 68847E0E76 push 760E7E84 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF70D(U), :760EF75C(U) | :760EF78E 6806030000 push 00000306 :760EF793 E893D7FFFF call 760ECF2B :760EF798 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF6E2(C), :760EF701(C), :760EF739(C), :760EF754(C), :760EF76B(C) |:760EF786(C) | :760EF79B 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF761(U) | :760EF79D 5F pop edi :760EF79E C9 leave :760EF79F C20800 ret 0008 * Referenced by a CALL at Address: |:760EF5BC | :760EF7A2 55 push ebp :760EF7A3 8BEC mov ebp, esp :760EF7A5 81EC340C0000 sub esp, 00000C34 :760EF7AB 53 push ebx :760EF7AC 56 push esi :760EF7AD 57 push edi :760EF7AE 33F6 xor esi, esi :760EF7B0 397508 cmp dword ptr [ebp+08], esi :760EF7B3 BF00040000 mov edi, 00000400 :760EF7B8 8975EC mov dword ptr [ebp-14], esi :760EF7BB 8975FC mov dword ptr [ebp-04], esi :760EF7BE 8975F8 mov dword ptr [ebp-08], esi :760EF7C1 897DF4 mov dword ptr [ebp-0C], edi :760EF7C4 C745E804000000 mov [ebp-18], 00000004 :760EF7CB 7538 jne 760EF805 :760EF7CD A184110E76 mov eax, dword ptr [760E1184] :760EF7D2 F60002 test byte ptr [eax], 02 :760EF7D5 0F84BF040000 je 760EFC9A :760EF7DB 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"RemoveCatalogDependencies(LPTSTR " ->"pszCatalog)" | :760EF7DD 68FC800E76 push 760E80FC :760EF7E2 68A8020000 push 000002A8 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EF7E7 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EF7EC FF1580110E76 Call dword ptr [760E1180] :760EF7F2 85C0 test eax, eax :760EF7F4 0F8476040000 je 760EFC70 :760EF7FA 56 push esi * Possible StringData Ref from Code Obj ->"Null pointer's passed to UpdateCatalogDependen" ->"cy" | :760EF7FB 68847E0E76 push 760E7E84 :760EF800 E95E040000 jmp 760EFC63 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF7CB(C) | :760EF805 8D45FC lea eax, dword ptr [ebp-04] :760EF808 50 push eax :760EF809 683F000F00 push 000F003F :760EF80E 56 push esi * Possible StringData Ref from Code Obj ->"Software\Microsoft\Windows\CurrentVersion\Syst" ->"emFileProtection\CatDepend" | :760EF80F 68507F0E76 push 760E7F50 :760EF814 6802000080 push 80000002 * Reference To: ADVAPI32.RegOpenKeyExA, Ord:019Dh | :760EF819 FF15C0120E76 Call dword ptr [760E12C0] :760EF81F 85C0 test eax, eax :760EF821 0F8577040000 jne 760EFC9E :760EF827 8D45CC lea eax, dword ptr [ebp-34] :760EF82A 897DE0 mov dword ptr [ebp-20], edi :760EF82D 50 push eax :760EF82E 56 push esi :760EF82F 56 push esi :760EF830 8D45E0 lea eax, dword ptr [ebp-20] :760EF833 56 push esi :760EF834 50 push eax :760EF835 8D85CCF7FFFF lea eax, dword ptr [ebp+FFFFF7CC] :760EF83B C745E401000000 mov [ebp-1C], 00000001 :760EF842 50 push eax :760EF843 56 push esi :760EF844 FF75FC push [ebp-04] * Reference To: ADVAPI32.RegEnumKeyExA, Ord:0191h | :760EF847 FF15C8120E76 Call dword ptr [760E12C8] * Reference To: ADVAPI32.RegEnumValueA, Ord:0194h | :760EF84D 8B1DCC120E76 mov ebx, dword ptr [760E12CC] :760EF853 85C0 test eax, eax :760EF855 0F85B9000000 jne 760EF914 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF90E(C) | :760EF85B 8D45F8 lea eax, dword ptr [ebp-08] :760EF85E 50 push eax :760EF85F 683F000F00 push 000F003F :760EF864 8D85CCF7FFFF lea eax, dword ptr [ebp+FFFFF7CC] :760EF86A 56 push esi :760EF86B 50 push eax :760EF86C FF75FC push [ebp-04] * Reference To: ADVAPI32.RegOpenKeyExA, Ord:019Dh | :760EF86F FF15C0120E76 Call dword ptr [760E12C0] :760EF875 85C0 test eax, eax :760EF877 0F8516010000 jne 760EF993 :760EF87D 56 push esi :760EF87E 56 push esi :760EF87F 56 push esi :760EF880 8D45F4 lea eax, dword ptr [ebp-0C] :760EF883 56 push esi :760EF884 50 push eax :760EF885 8D85CCFBFFFF lea eax, dword ptr [ebp+FFFFFBCC] :760EF88B 897DF4 mov dword ptr [ebp-0C], edi :760EF88E 50 push eax :760EF88F C745F001000000 mov [ebp-10], 00000001 :760EF896 56 push esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF8E5(U) | :760EF897 FF75F8 push [ebp-08] :760EF89A FFD3 call ebx :760EF89C 85C0 test eax, eax :760EF89E 7547 jne 760EF8E7 :760EF8A0 FF7508 push [ebp+08] :760EF8A3 8D85CCFBFFFF lea eax, dword ptr [ebp+FFFFFBCC] :760EF8A9 50 push eax * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760EF8AA FF1558120E76 Call dword ptr [760E1258] :760EF8B0 85C0 test eax, eax :760EF8B2 7518 jne 760EF8CC :760EF8B4 8D85CCFBFFFF lea eax, dword ptr [ebp+FFFFFBCC] :760EF8BA 50 push eax :760EF8BB FF75F8 push [ebp-08] * Reference To: ADVAPI32.RegDeleteValueA, Ord:018Dh | :760EF8BE FF15C4120E76 Call dword ptr [760E12C4] :760EF8C4 85C0 test eax, eax :760EF8C6 0F8519010000 jne 760EF9E5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF8B2(C) | :760EF8CC 8B45F0 mov eax, dword ptr [ebp-10] :760EF8CF FF45F0 inc [ebp-10] :760EF8D2 56 push esi :760EF8D3 56 push esi :760EF8D4 56 push esi :760EF8D5 8D4DF4 lea ecx, dword ptr [ebp-0C] :760EF8D8 56 push esi :760EF8D9 51 push ecx :760EF8DA 8D8DCCFBFFFF lea ecx, dword ptr [ebp+FFFFFBCC] :760EF8E0 897DF4 mov dword ptr [ebp-0C], edi :760EF8E3 51 push ecx :760EF8E4 50 push eax :760EF8E5 EBB0 jmp 760EF897 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF89E(C) | :760EF8E7 8B45E4 mov eax, dword ptr [ebp-1C] :760EF8EA 8D4DCC lea ecx, dword ptr [ebp-34] :760EF8ED 51 push ecx :760EF8EE 56 push esi :760EF8EF 56 push esi :760EF8F0 8D4DE0 lea ecx, dword ptr [ebp-20] :760EF8F3 56 push esi :760EF8F4 FF45E4 inc [ebp-1C] :760EF8F7 51 push ecx :760EF8F8 8D8DCCF7FFFF lea ecx, dword ptr [ebp+FFFFF7CC] :760EF8FE 51 push ecx :760EF8FF 50 push eax :760EF900 FF75FC push [ebp-04] :760EF903 897DE0 mov dword ptr [ebp-20], edi * Reference To: ADVAPI32.RegEnumKeyExA, Ord:0191h | :760EF906 FF15C8120E76 Call dword ptr [760E12C8] :760EF90C 85C0 test eax, eax :760EF90E 0F8447FFFFFF je 760EF85B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF855(C) | :760EF914 3975FC cmp dword ptr [ebp-04], esi :760EF917 740C je 760EF925 :760EF919 FF75FC push [ebp-04] * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760EF91C FF15B0120E76 Call dword ptr [760E12B0] :760EF922 8975FC mov dword ptr [ebp-04], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF917(C) | :760EF925 3975F8 cmp dword ptr [ebp-08], esi :760EF928 740C je 760EF936 :760EF92A FF75F8 push [ebp-08] * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760EF92D FF15B0120E76 Call dword ptr [760E12B0] :760EF933 8975F8 mov dword ptr [ebp-08], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF928(C) | :760EF936 FF7508 push [ebp+08] :760EF939 8D85CCF3FFFF lea eax, dword ptr [ebp+FFFFF3CC] * Possible StringData Ref from Code Obj ->"Software\Microsoft\Windows\CurrentVersion\Syst" ->"emFileProtection\CatDepend" | :760EF93F 68507F0E76 push 760E7F50 :760EF944 68442E0E76 push 760E2E44 :760EF949 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760EF94A FF1530100E76 Call dword ptr [760E1030] :760EF950 83C410 add esp, 00000010 :760EF953 3BC7 cmp eax, edi :760EF955 0F8CE3000000 jl 760EFA3E :760EF95B A184110E76 mov eax, dword ptr [760E1184] :760EF960 F60002 test byte ptr [eax], 02 :760EF963 0F8407030000 je 760EFC70 :760EF969 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"RemoveCatalogDependencies(LPTSTR " ->"pszCatalog)" | :760EF96B 68FC800E76 push 760E80FC :760EF970 68F7020000 push 000002F7 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EF975 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EF97A FF1580110E76 Call dword ptr [760E1180] :760EF980 85C0 test eax, eax :760EF982 0F84E8020000 je 760EFC70 :760EF988 56 push esi * Possible StringData Ref from Code Obj ->"Fatal error, buffer overrun in " ->"UpdateCatalogDependency" | :760EF989 68D87E0E76 push 760E7ED8 :760EF98E E9D0020000 jmp 760EFC63 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF877(C) | :760EF993 A184110E76 mov eax, dword ptr [760E1184] :760EF998 F60002 test byte ptr [eax], 02 :760EF99B 0F84CF020000 je 760EFC70 :760EF9A1 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"RemoveCatalogDependencies(LPTSTR " ->"pszCatalog)" | :760EF9A3 68FC800E76 push 760E80FC :760EF9A8 68CB020000 push 000002CB * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EF9AD 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EF9B2 FF1580110E76 Call dword ptr [760E1180] :760EF9B8 85C0 test eax, eax :760EF9BA 0F84B0020000 je 760EFC70 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EF9C0 FF15A0110E76 Call dword ptr [760E11A0] :760EF9C6 50 push eax :760EF9C7 8D85CCF7FFFF lea eax, dword ptr [ebp+FFFFF7CC] :760EF9CD 50 push eax * Possible StringData Ref from Code Obj ->"Error opening %s, ec=%ld" | :760EF9CE 68E0800E76 push 760E80E0 :760EF9D3 6806030000 push 00000306 :760EF9D8 E84ED5FFFF call 760ECF2B :760EF9DD 83C410 add esp, 00000010 :760EF9E0 E98B020000 jmp 760EFC70 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF8C6(C) | :760EF9E5 A184110E76 mov eax, dword ptr [760E1184] :760EF9EA F60002 test byte ptr [eax], 02 :760EF9ED 0F847D020000 je 760EFC70 :760EF9F3 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"RemoveCatalogDependencies(LPTSTR " ->"pszCatalog)" | :760EF9F5 68FC800E76 push 760E80FC :760EF9FA 68DF020000 push 000002DF * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EF9FF 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFA04 FF1580110E76 Call dword ptr [760E1180] :760EFA0A 85C0 test eax, eax :760EFA0C 0F845E020000 je 760EFC70 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760EFA12 FF15A0110E76 Call dword ptr [760E11A0] :760EFA18 50 push eax :760EFA19 8D85CCF7FFFF lea eax, dword ptr [ebp+FFFFF7CC] :760EFA1F 50 push eax :760EFA20 8D85CCFBFFFF lea eax, dword ptr [ebp+FFFFFBCC] :760EFA26 50 push eax * Possible StringData Ref from Code Obj ->"Error deleting %s from %s, ec=%ld" | :760EFA27 68BC800E76 push 760E80BC :760EFA2C 6806030000 push 00000306 :760EFA31 E8F5D4FFFF call 760ECF2B :760EFA36 83C414 add esp, 00000014 :760EFA39 E932020000 jmp 760EFC70 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EF955(C) | :760EFA3E 8D45EC lea eax, dword ptr [ebp-14] :760EFA41 50 push eax :760EFA42 683F000F00 push 000F003F :760EFA47 8D85CCF3FFFF lea eax, dword ptr [ebp+FFFFF3CC] :760EFA4D 56 push esi :760EFA4E 50 push eax :760EFA4F 6802000080 push 80000002 * Reference To: ADVAPI32.RegOpenKeyExA, Ord:019Dh | :760EFA54 FF15C0120E76 Call dword ptr [760E12C0] :760EFA5A 85C0 test eax, eax :760EFA5C 0F853C020000 jne 760EFC9E :760EFA62 8D45E8 lea eax, dword ptr [ebp-18] :760EFA65 897DF4 mov dword ptr [ebp-0C], edi :760EFA68 50 push eax :760EFA69 8D45DC lea eax, dword ptr [ebp-24] :760EFA6C 50 push eax :760EFA6D 8D45D8 lea eax, dword ptr [ebp-28] :760EFA70 50 push eax :760EFA71 8D45F4 lea eax, dword ptr [ebp-0C] :760EFA74 56 push esi :760EFA75 50 push eax :760EFA76 8D85CCFBFFFF lea eax, dword ptr [ebp+FFFFFBCC] :760EFA7C C745F001000000 mov [ebp-10], 00000001 :760EFA83 50 push eax :760EFA84 56 push esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFB02(U) | :760EFA85 FF75EC push [ebp-14] :760EFA88 FFD3 call ebx :760EFA8A 3BC6 cmp eax, esi :760EFA8C 894508 mov dword ptr [ebp+08], eax :760EFA8F 0F8517010000 jne 760EFBAC :760EFA95 837DD804 cmp dword ptr [ebp-28], 00000004 :760EFA99 7569 jne 760EFB04 :760EFA9B 837DDC01 cmp dword ptr [ebp-24], 00000001 :760EFA9F 7542 jne 760EFAE3 :760EFAA1 8D85CCFBFFFF lea eax, dword ptr [ebp+FFFFFBCC] :760EFAA7 6A04 push 00000004 :760EFAA9 50 push eax :760EFAAA 8D85CCF3FFFF lea eax, dword ptr [ebp+FFFFF3CC] :760EFAB0 50 push eax :760EFAB1 8D45D4 lea eax, dword ptr [ebp-2C] :760EFAB4 6A04 push 00000004 :760EFAB6 50 push eax :760EFAB7 8975D4 mov dword ptr [ebp-2C], esi :760EFABA E8DF27FFFF call 760E229E :760EFABF 85C0 test eax, eax :760EFAC1 7479 je 760EFB3C :760EFAC3 8D85CCFBFFFF lea eax, dword ptr [ebp+FFFFFBCC] :760EFAC9 6A01 push 00000001 :760EFACB 50 push eax * Reference To: SfpDll.SfpDeleteCatalogS | :760EFACC E8B8F8FFFF call 760EF389 :760EFAD1 85C0 test eax, eax :760EFAD3 0F859B000000 jne 760EFB74 :760EFAD9 C745E804000000 mov [ebp-18], 00000004 :760EFAE0 897DF4 mov dword ptr [ebp-0C], edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFA9F(C) | :760EFAE3 8D4DE8 lea ecx, dword ptr [ebp-18] :760EFAE6 8B45F0 mov eax, dword ptr [ebp-10] :760EFAE9 51 push ecx :760EFAEA 8D4DDC lea ecx, dword ptr [ebp-24] :760EFAED 51 push ecx :760EFAEE 8D4DD8 lea ecx, dword ptr [ebp-28] :760EFAF1 FF45F0 inc [ebp-10] :760EFAF4 51 push ecx :760EFAF5 8D4DF4 lea ecx, dword ptr [ebp-0C] :760EFAF8 56 push esi :760EFAF9 51 push ecx :760EFAFA 8D8DCCFBFFFF lea ecx, dword ptr [ebp+FFFFFBCC] :760EFB00 51 push ecx :760EFB01 50 push eax :760EFB02 EB81 jmp 760EFA85 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFA99(C) | :760EFB04 A184110E76 mov eax, dword ptr [760E1184] :760EFB09 F60002 test byte ptr [eax], 02 :760EFB0C 0F845E010000 je 760EFC70 :760EFB12 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"RemoveCatalogDependencies(LPTSTR " ->"pszCatalog)" | :760EFB14 68FC800E76 push 760E80FC :760EFB19 6815030000 push 00000315 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EFB1E 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFB23 FF1580110E76 Call dword ptr [760E1180] :760EFB29 85C0 test eax, eax :760EFB2B 0F843F010000 je 760EFC70 :760EFB31 56 push esi * Possible StringData Ref from Code Obj ->"Invalid registry value entry type, " ->"not REG_DWORD." | :760EFB32 6888800E76 push 760E8088 :760EFB37 E927010000 jmp 760EFC63 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFAC1(C) | :760EFB3C A184110E76 mov eax, dword ptr [760E1184] :760EFB41 F60002 test byte ptr [eax], 02 :760EFB44 0F8426010000 je 760EFC70 :760EFB4A 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"RemoveCatalogDependencies(LPTSTR " ->"pszCatalog)" | :760EFB4C 68FC800E76 push 760E80FC :760EFB51 682E030000 push 0000032E * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EFB56 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFB5B FF1580110E76 Call dword ptr [760E1180] :760EFB61 85C0 test eax, eax :760EFB63 0F8407010000 je 760EFC70 :760EFB69 56 push esi * Possible StringData Ref from Code Obj ->"Error marking registry value as " ->"visited." | :760EFB6A 685C800E76 push 760E805C :760EFB6F E9EF000000 jmp 760EFC63 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFAD3(C) | :760EFB74 A184110E76 mov eax, dword ptr [760E1184] :760EFB79 F60002 test byte ptr [eax], 02 :760EFB7C 0F84EE000000 je 760EFC70 :760EFB82 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"RemoveCatalogDependencies(LPTSTR " ->"pszCatalog)" | :760EFB84 68FC800E76 push 760E80FC :760EFB89 6835030000 push 00000335 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EFB8E 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFB93 FF1580110E76 Call dword ptr [760E1180] :760EFB99 85C0 test eax, eax :760EFB9B 0F84CF000000 je 760EFC70 :760EFBA1 56 push esi * Possible StringData Ref from Code Obj ->"Error removing dependenant catalog." | :760EFBA2 6838800E76 push 760E8038 :760EFBA7 E9B7000000 jmp 760EFC63 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFA8F(C) | :760EFBAC 817D0803010000 cmp dword ptr [ebp+08], 00000103 :760EFBB3 7437 je 760EFBEC :760EFBB5 A184110E76 mov eax, dword ptr [760E1184] :760EFBBA F60002 test byte ptr [eax], 02 :760EFBBD 0F84AD000000 je 760EFC70 :760EFBC3 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"RemoveCatalogDependencies(LPTSTR " ->"pszCatalog)" | :760EFBC5 68FC800E76 push 760E80FC :760EFBCA 6844030000 push 00000344 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EFBCF 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFBD4 FF1580110E76 Call dword ptr [760E1180] :760EFBDA 85C0 test eax, eax :760EFBDC 0F848E000000 je 760EFC70 :760EFBE2 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Error iterating through dependant " ->"catalog sub-values %d" | :760EFBE5 6800800E76 push 760E8000 :760EFBEA EB77 jmp 760EFC63 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFBB3(C) | :760EFBEC 6846170E76 push 760E1746 :760EFBF1 FF75EC push [ebp-14] * Reference To: ADVAPI32.RegDeleteKeyA, Ord:018Bh | :760EFBF4 FF15D0120E76 Call dword ptr [760E12D0] :760EFBFA 85C0 test eax, eax :760EFBFC 742D je 760EFC2B :760EFBFE A184110E76 mov eax, dword ptr [760E1184] :760EFC03 F60002 test byte ptr [eax], 02 :760EFC06 7468 je 760EFC70 :760EFC08 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"RemoveCatalogDependencies(LPTSTR " ->"pszCatalog)" | :760EFC0A 68FC800E76 push 760E80FC :760EFC0F 684C030000 push 0000034C * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EFC14 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFC19 FF1580110E76 Call dword ptr [760E1180] :760EFC1F 85C0 test eax, eax :760EFC21 744D je 760EFC70 :760EFC23 56 push esi * Possible StringData Ref from Code Obj ->"Error removing registry key for " ->"catalog." | :760EFC24 68D47F0E76 push 760E7FD4 :760EFC29 EB38 jmp 760EFC63 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFBFC(C) | :760EFC2B FF75EC push [ebp-14] * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760EFC2E FF15B0120E76 Call dword ptr [760E12B0] :760EFC34 85C0 test eax, eax :760EFC36 7466 je 760EFC9E :760EFC38 A184110E76 mov eax, dword ptr [760E1184] :760EFC3D F60002 test byte ptr [eax], 02 :760EFC40 742E je 760EFC70 :760EFC42 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"RemoveCatalogDependencies(LPTSTR " ->"pszCatalog)" | :760EFC44 68FC800E76 push 760E80FC :760EFC49 6852030000 push 00000352 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\addcat.cpp" | :760EFC4E 6830DF0F76 push 760FDF30 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFC53 FF1580110E76 Call dword ptr [760E1180] :760EFC59 85C0 test eax, eax :760EFC5B 7413 je 760EFC70 :760EFC5D 56 push esi * Possible StringData Ref from Code Obj ->"Error closing registry key in " ->"RemoveCatalogDependencies" | :760EFC5E 689C7F0E76 push 760E7F9C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF800(U), :760EF98E(U), :760EFB37(U), :760EFB6F(U), :760EFBA7(U) |:760EFBEA(U), :760EFC29(U) | :760EFC63 6806030000 push 00000306 :760EFC68 E8BED2FFFF call 760ECF2B :760EFC6D 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF7F4(C), :760EF963(C), :760EF982(C), :760EF99B(C), :760EF9BA(C) |:760EF9E0(U), :760EF9ED(C), :760EFA0C(C), :760EFA39(U), :760EFB0C(C) |:760EFB2B(C), :760EFB44(C), :760EFB63(C), :760EFB7C(C), :760EFB9B(C) |:760EFBBD(C), :760EFBDC(C), :760EFC06(C), :760EFC21(C), :760EFC40(C) |:760EFC5B(C) | :760EFC70 3975EC cmp dword ptr [ebp-14], esi :760EFC73 7409 je 760EFC7E :760EFC75 FF75EC push [ebp-14] * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760EFC78 FF15B0120E76 Call dword ptr [760E12B0] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFC73(C) | :760EFC7E 3975FC cmp dword ptr [ebp-04], esi :760EFC81 7409 je 760EFC8C :760EFC83 FF75FC push [ebp-04] * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760EFC86 FF15B0120E76 Call dword ptr [760E12B0] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFC81(C) | :760EFC8C 3975F8 cmp dword ptr [ebp-08], esi :760EFC8F 7409 je 760EFC9A :760EFC91 FF75F8 push [ebp-08] * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760EFC94 FF15B0120E76 Call dword ptr [760E12B0] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF7D5(C), :760EFC8F(C) | :760EFC9A 33C0 xor eax, eax :760EFC9C EB03 jmp 760EFCA1 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EF821(C), :760EFA5C(C), :760EFC36(C) | :760EFC9E 6A01 push 00000001 :760EFCA0 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFC9C(U) | :760EFCA1 5F pop edi :760EFCA2 5E pop esi :760EFCA3 5B pop ebx :760EFCA4 C9 leave :760EFCA5 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3B2C(C) | :760EFCA8 A184110E76 mov eax, dword ptr [760E1184] :760EFCAD F60002 test byte ptr [eax], 02 :760EFCB0 0F845B030000 je 760F0011 :760EFCB6 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760EFCB8 6804830E76 push 760E8304 :760EFCBD 6A49 push 00000049 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760EFCBF 6868DF0F76 push 760FDF68 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFCC4 FF1580110E76 Call dword ptr [760E1180] :760EFCCA 85C0 test eax, eax :760EFCCC 0F843F030000 je 760F0011 :760EFCD2 56 push esi * Possible StringData Ref from Code Obj ->"Error Loading XML FILE" | :760EFCD3 68EC820E76 push 760E82EC :760EFCD8 56 push esi :760EFCD9 EB70 jmp 760EFD4B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3B4A(C) | :760EFCDB A184110E76 mov eax, dword ptr [760E1184] :760EFCE0 F60002 test byte ptr [eax], 02 :760EFCE3 0F8428030000 je 760F0011 :760EFCE9 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760EFCEB 6804830E76 push 760E8304 :760EFCF0 6A53 push 00000053 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760EFCF2 6868DF0F76 push 760FDF68 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFCF7 FF1580110E76 Call dword ptr [760E1180] :760EFCFD 85C0 test eax, eax :760EFCFF 0F840C030000 je 760F0011 :760EFD05 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error Loading File from xml file, " ->"buffer exceeded" | :760EFD07 68B8820E76 push 760E82B8 :760EFD0C EB3B jmp 760EFD49 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3B40(C) | :760EFD0E BB00040000 mov ebx, 00000400 :760EFD13 E9693EFFFF jmp 760E3B81 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3B8B(C) | :760EFD18 A184110E76 mov eax, dword ptr [760E1184] :760EFD1D F60002 test byte ptr [eax], 02 :760EFD20 0F84EB020000 je 760F0011 :760EFD26 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760EFD28 6804830E76 push 760E8304 :760EFD2D 6A62 push 00000062 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760EFD2F 6868DF0F76 push 760FDF68 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFD34 FF1580110E76 Call dword ptr [760E1180] :760EFD3A 85C0 test eax, eax :760EFD3C 0F84CF020000 je 760F0011 :760EFD42 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error getting write lock on sfp " ->"db" | :760EFD44 6894820E76 push 760E8294 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFD0C(U) | :760EFD49 6A00 push 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFCD9(U) | :760EFD4B E8DBD1FFFF call 760ECF2B :760EFD50 83C40C add esp, 0000000C :760EFD53 E9B9020000 jmp 760F0011 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3BA5(C), :760EFD87(U) | :760EFD58 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760EFD5E 8D8D38ADFFFF lea ecx, dword ptr [ebp+FFFFAD38] :760EFD64 50 push eax :760EFD65 E88028FFFF call 760E25EA :760EFD6A 85C0 test eax, eax :760EFD6C 741B je 760EFD89 :760EFD6E 8B4D0C mov ecx, dword ptr [ebp+0C] :760EFD71 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760EFD77 6A00 push 00000000 :760EFD79 50 push eax :760EFD7A E83A4FFFFF call 760E4CB9 :760EFD7F 85C0 test eax, eax :760EFD81 0F84243EFFFF je 760E3BAB :760EFD87 EBCF jmp 760EFD58 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFD6C(C) | :760EFD89 A184110E76 mov eax, dword ptr [760E1184] :760EFD8E F60002 test byte ptr [eax], 02 :760EFD91 0F845B020000 je 760EFFF2 :760EFD97 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760EFD99 6804830E76 push 760E8304 :760EFD9E 6A77 push 00000077 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760EFDA0 6868DF0F76 push 760FDF68 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFDA5 FF1580110E76 Call dword ptr [760E1180] :760EFDAB 85C0 test eax, eax :760EFDAD 0F843F020000 je 760EFFF2 :760EFDB3 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error adding file entry to copy " ->"of SFP db." | :760EFDB5 6868820E76 push 760E8268 :760EFDBA E929020000 jmp 760EFFE8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3BC1(C) | :760EFDBF A184110E76 mov eax, dword ptr [760E1184] :760EFDC4 F60002 test byte ptr [eax], 02 :760EFDC7 0F8425020000 je 760EFFF2 :760EFDCD 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760EFDCF 6804830E76 push 760E8304 :760EFDD4 688A000000 push 0000008A * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760EFDD9 6868DF0F76 push 760FDF68 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFDDE FF1580110E76 Call dword ptr [760E1180] :760EFDE4 85C0 test eax, eax :760EFDE6 0F8406020000 je 760EFFF2 :760EFDEC 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Our new database is empty, must " ->"be an error." | :760EFDEE 6838820E76 push 760E8238 :760EFDF3 E9F0010000 jmp 760EFFE8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3C0B(C) | :760EFDF8 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760EFDFE 8D8D38ADFFFF lea ecx, dword ptr [ebp+FFFFAD38] :760EFE04 50 push eax :760EFE05 E8BC570000 call 760F55C6 :760EFE0A 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760EFE10 8D8DD0CFFFFF lea ecx, dword ptr [ebp+FFFFCFD0] :760EFE16 50 push eax :760EFE17 E8AA570000 call 760F55C6 :760EFE1C E9F03DFFFF jmp 760E3C11 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3C76(C) | :760EFE21 8B4D0C mov ecx, dword ptr [ebp+0C] :760EFE24 8D85B0FBFFFF lea eax, dword ptr [ebp+FFFFFBB0] :760EFE2A 50 push eax :760EFE2B E896570000 call 760F55C6 :760EFE30 85C0 test eax, eax :760EFE32 7406 je 760EFE3A :760EFE34 56 push esi :760EFE35 E9283EFFFF jmp 760E3C62 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFE32(C) | :760EFE3A A184110E76 mov eax, dword ptr [760E1184] :760EFE3F F60002 test byte ptr [eax], 02 :760EFE42 0F84AA010000 je 760EFFF2 :760EFE48 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760EFE4A 6804830E76 push 760E8304 :760EFE4F 68B4000000 push 000000B4 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760EFE54 6868DF0F76 push 760FDF68 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFE59 FF1580110E76 Call dword ptr [760E1180] :760EFE5F 85C0 test eax, eax :760EFE61 0F848B010000 je 760EFFF2 :760EFE67 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error removing file from the SFP " ->"DB." | :760EFE69 6810820E76 push 760E8210 :760EFE6E E975010000 jmp 760EFFE8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3C95(C) | :760EFE73 A184110E76 mov eax, dword ptr [760E1184] :760EFE78 F60002 test byte ptr [eax], 02 :760EFE7B 0F8471010000 je 760EFFF2 :760EFE81 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760EFE83 6804830E76 push 760E8304 :760EFE88 68C9000000 push 000000C9 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760EFE8D 6868DF0F76 push 760FDF68 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFE92 FF1580110E76 Call dword ptr [760E1180] :760EFE98 85C0 test eax, eax :760EFE9A 0F8452010000 je 760EFFF2 :760EFEA0 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error adding file to the SFP DB." | :760EFEA2 68EC810E76 push 760E81EC :760EFEA7 E93C010000 jmp 760EFFE8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3CB3(C) | :760EFEAC FF7510 push [ebp+10] :760EFEAF 8D4DF4 lea ecx, dword ptr [ebp-0C] :760EFEB2 E8F83BFFFF call 760E3AAF :760EFEB7 85C0 test eax, eax :760EFEB9 0F850A3EFFFF jne 760E3CC9 :760EFEBF A184110E76 mov eax, dword ptr [760E1184] :760EFEC4 F60002 test byte ptr [eax], 02 :760EFEC7 0F8425010000 je 760EFFF2 :760EFECD 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760EFECF 6804830E76 push 760E8304 :760EFED4 68DD000000 push 000000DD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760EFF12(U) | * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760EFED9 6868DF0F76 push 760FDF68 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760EFEDE FF1580110E76 Call dword ptr [760E1180] :760EFEE4 85C0 test eax, eax :760EFEE6 0F8406010000 je 760EFFF2 :760EFEEC 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error opening catalog utilities" | :760EFEEE 68F0660E76 push 760E66F0 :760EFEF3 E9F0000000 jmp 760EFFE8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3CC3(C) | :760EFEF8 A184110E76 mov eax, dword ptr [760E1184] :760EFEFD F60002 test byte ptr [eax], 02 :760EFF00 0F84EC000000 je 760EFFF2 :760EFF06 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760EFF08 6804830E76 push 760E8304 :760EFF0D 68E4000000 push 000000E4 :760EFF12 EBC5 jmp 760EFED9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3D41(C) | :760EFF14 A184110E76 mov eax, dword ptr [760E1184] :760EFF19 F60002 test byte ptr [eax], 02 :760EFF1C 0F84743EFFFF je 760E3D96 :760EFF22 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760EFF24 6804830E76 push 760E8304 :760EFF29 68FC000000 push 000000FC * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760EFF2E 6868DF0F76 push 760FDF68 :760EFF33 FFD3 call ebx :760EFF35 85C0 test eax, eax :760EFF37 0F84593EFFFF je 760E3D96 :760EFF3D 8D8598FAFFFF lea eax, dword ptr [ebp+FFFFFA98] :760EFF43 50 push eax * Possible StringData Ref from Code Obj ->"Error verifying catalog %s" | :760EFF44 68D0810E76 push 760E81D0 :760EFF49 EB66 jmp 760EFFB1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3D4A(C) | :760EFF4B A184110E76 mov eax, dword ptr [760E1184] :760EFF50 F60002 test byte ptr [eax], 02 :760EFF53 0F843D3EFFFF je 760E3D96 :760EFF59 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760EFF5B 6804830E76 push 760E8304 :760EFF60 6802010000 push 00000102 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760EFF65 6868DF0F76 push 760FDF68 :760EFF6A FFD3 call ebx :760EFF6C 85C0 test eax, eax :760EFF6E 0F84223EFFFF je 760E3D96 :760EFF74 8D8598FAFFFF lea eax, dword ptr [ebp+FFFFFA98] :760EFF7A 50 push eax * Possible StringData Ref from Code Obj ->"Certificate not in trusted root " ->"store %s" | :760EFF7B 68A4810E76 push 760E81A4 :760EFF80 EB2F jmp 760EFFB1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3D66(C) | :760EFF82 A184110E76 mov eax, dword ptr [760E1184] :760EFF87 F60002 test byte ptr [eax], 02 :760EFF8A 0F84063EFFFF je 760E3D96 :760EFF90 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760EFF92 6804830E76 push 760E8304 :760EFF97 6809010000 push 00000109 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760EFF9C 6868DF0F76 push 760FDF68 :760EFFA1 FFD3 call ebx :760EFFA3 85C0 test eax, eax :760EFFA5 0F84EB3DFFFF je 760E3D96 :760EFFAB 56 push esi * Possible StringData Ref from Code Obj ->"Error parsing catalog." | :760EFFAC 688C810E76 push 760E818C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EFF49(U), :760EFF80(U) | :760EFFB1 6A00 push 00000000 :760EFFB3 E873CFFFFF call 760ECF2B :760EFFB8 83C40C add esp, 0000000C :760EFFBB E9D63DFFFF jmp 760E3D96 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3D7E(C) | :760EFFC0 A184110E76 mov eax, dword ptr [760E1184] :760EFFC5 F60002 test byte ptr [eax], 02 :760EFFC8 7428 je 760EFFF2 :760EFFCA 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760EFFCC 6804830E76 push 760E8304 :760EFFD1 680F010000 push 0000010F * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760EFFD6 6868DF0F76 push 760FDF68 :760EFFDB FFD3 call ebx :760EFFDD 85C0 test eax, eax :760EFFDF 7411 je 760EFFF2 :760EFFE1 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error syncing catalog to db" | :760EFFE3 6870810E76 push 760E8170 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EFDBA(U), :760EFDF3(U), :760EFE6E(U), :760EFEA7(U), :760EFEF3(U) | :760EFFE8 6A00 push 00000000 :760EFFEA E83CCFFFFF call 760ECF2B :760EFFEF 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EFD91(C), :760EFDAD(C), :760EFDC7(C), :760EFDE6(C), :760EFE42(C) |:760EFE61(C), :760EFE7B(C), :760EFE9A(C), :760EFEC7(C), :760EFEE6(C) |:760EFF00(C), :760EFFC8(C), :760EFFDF(C) | :760EFFF2 8B4D0C mov ecx, dword ptr [ebp+0C] :760EFFF5 E8A01AFFFF call 760E1A9A * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F005F(C), :760F0076(C), :760F0089(U) | :760EFFFA 837DFC00 cmp dword ptr [ebp-04], 00000000 :760EFFFE 7411 je 760F0011 :760F0000 8B4DFC mov ecx, dword ptr [ebp-04] :760F0003 E8C02CFFFF call 760E2CC8 :760F0008 FF75FC push [ebp-04] * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F000B E83B19FFFF Call 760E194B :760F0010 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760EFCB0(C), :760EFCCC(C), :760EFCE3(C), :760EFCFF(C), :760EFD20(C) |:760EFD3C(C), :760EFD53(U), :760EFFFE(C) | :760F0011 33F6 xor esi, esi :760F0013 E9B53DFFFF jmp 760E3DCD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3CE9(C) | :760F0018 A184110E76 mov eax, dword ptr [760E1184] :760F001D F60002 test byte ptr [eax], 02 :760F0020 0F848F3DFFFF je 760E3DB5 :760F0026 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760F0028 6804830E76 push 760E8304 :760F002D 681A010000 push 0000011A * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760F0032 6868DF0F76 push 760FDF68 :760F0037 FFD3 call ebx :760F0039 85C0 test eax, eax :760F003B 0F84743DFFFF je 760E3DB5 :760F0041 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"No catalogs installed on the system" | :760F0043 684C810E76 push 760E814C :760F0048 6A00 push 00000000 :760F004A E8DCCEFFFF call 760ECF2B :760F004F 83C40C add esp, 0000000C :760F0052 E95E3DFFFF jmp 760E3DB5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3DC4(C) | :760F0057 A184110E76 mov eax, dword ptr [760E1184] :760F005C F60002 test byte ptr [eax], 02 :760F005F 7499 je 760EFFFA :760F0061 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"SfpSyncDb" | :760F0063 6804830E76 push 760E8304 :760F0068 682C010000 push 0000012C * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\dbsync.cpp" | :760F006D 6868DF0F76 push 760FDF68 :760F0072 FFD3 call ebx :760F0074 85C0 test eax, eax :760F0076 7482 je 760EFFFA :760F0078 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error Saveing the SFP Database." | :760F007A 682C810E76 push 760E812C :760F007F 6A00 push 00000000 :760F0081 E8A5CEFFFF call 760ECF2B :760F0086 83C40C add esp, 0000000C :760F0089 E96CFFFFFF jmp 760EFFFA * Referenced by a CALL at Addresses: |:760F0EAE , :760F0F28 , :760F10B3 , :760F1153 | :760F008E 8BC1 mov eax, ecx :760F0090 83600400 and dword ptr [eax+04], 00000000 :760F0094 832000 and dword ptr [eax], 00000000 :760F0097 834808FF or dword ptr [eax+08], FFFFFFFF :760F009B C3 ret * Referenced by a CALL at Addresses: |:760F00F9 , :760F096E , :760F0AD6 , :760F0F03 , :760F0F3F |:760F1139 , :760F11E1 | :760F009C 53 push ebx * Reference To: KERNEL32.GetProcessHeap, Ord:0155h | :760F009D 8B1DF8110E76 mov ebx, dword ptr [760E11F8] :760F00A3 56 push esi :760F00A4 8BF1 mov esi, ecx :760F00A6 57 push edi * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760F00A7 8B3DFC110E76 mov edi, dword ptr [760E11FC] :760F00AD 8B4604 mov eax, dword ptr [esi+04] :760F00B0 85C0 test eax, eax :760F00B2 740C je 760F00C0 :760F00B4 50 push eax :760F00B5 6A00 push 00000000 :760F00B7 FFD3 call ebx :760F00B9 50 push eax :760F00BA FFD7 call edi :760F00BC 83660400 and dword ptr [esi+04], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F00B2(C) | :760F00C0 8B06 mov eax, dword ptr [esi] :760F00C2 85C0 test eax, eax :760F00C4 740B je 760F00D1 :760F00C6 50 push eax :760F00C7 6A00 push 00000000 :760F00C9 FFD3 call ebx :760F00CB 50 push eax :760F00CC FFD7 call edi :760F00CE 832600 and dword ptr [esi], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F00C4(C) | :760F00D1 5F pop edi :760F00D2 5E pop esi :760F00D3 5B pop ebx :760F00D4 C3 ret * Referenced by a CALL at Addresses: |:760F0891 , :760F09F9 | :760F00D5 8BC1 mov eax, ecx :760F00D7 33C9 xor ecx, ecx :760F00D9 8908 mov dword ptr [eax], ecx :760F00DB 894804 mov dword ptr [eax+04], ecx :760F00DE 894808 mov dword ptr [eax+08], ecx :760F00E1 C3 ret * Referenced by a CALL at Addresses: |:760F0915 , :760F0A7D , :760F1490 | :760F00E2 53 push ebx :760F00E3 56 push esi :760F00E4 8BF1 mov esi, ecx :760F00E6 33DB xor ebx, ebx :760F00E8 395E08 cmp dword ptr [esi+08], ebx :760F00EB 7625 jbe 760F0112 :760F00ED 57 push edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F010F(C) | :760F00EE 8B06 mov eax, dword ptr [esi] :760F00F0 8B3C98 mov edi, dword ptr [eax+4*ebx] :760F00F3 85FF test edi, edi :760F00F5 7414 je 760F010B :760F00F7 8BCF mov ecx, edi :760F00F9 E89EFFFFFF call 760F009C :760F00FE 57 push edi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F00FF E84718FFFF Call 760E194B :760F0104 8B06 mov eax, dword ptr [esi] :760F0106 59 pop ecx :760F0107 83249800 and dword ptr [eax+4*ebx], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F00F5(C) | :760F010B 43 inc ebx :760F010C 3B5E08 cmp ebx, dword ptr [esi+08] :760F010F 72DD jb 760F00EE :760F0111 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F00EB(C) | :760F0112 8B36 mov esi, dword ptr [esi] :760F0114 85F6 test esi, esi :760F0116 7407 je 760F011F :760F0118 56 push esi * Reference To: KERNEL32.LocalFree, Ord:01E9h | :760F0119 FF15F4110E76 Call dword ptr [760E11F4] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0116(C) | :760F011F 5E pop esi :760F0120 5B pop ebx :760F0121 C3 ret * Referenced by a CALL at Addresses: |:760F08DA , :760F0A42 | :760F0122 56 push esi :760F0123 57 push edi :760F0124 8B7C240C mov edi, dword ptr [esp+0C] :760F0128 8BF1 mov esi, ecx :760F012A 8BC7 mov eax, edi :760F012C C1E002 shl eax, 02 :760F012F 50 push eax :760F0130 6A40 push 00000040 * Reference To: KERNEL32.LocalAlloc, Ord:01E5h | :760F0132 FF15F0110E76 Call dword ptr [760E11F0] :760F0138 85C0 test eax, eax :760F013A 8906 mov dword ptr [esi], eax :760F013C 7537 jne 760F0175 :760F013E A184110E76 mov eax, dword ptr [760E1184] :760F0143 F60002 test byte ptr [eax], 02 :760F0146 7429 je 760F0171 :760F0148 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CArrayIndex::Init" | :760F014A 6844830E76 push 760E8344 :760F014F 6A75 push 00000075 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F0151 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F0156 FF1580110E76 Call dword ptr [760E1180] :760F015C 85C0 test eax, eax :760F015E 7411 je 760F0171 * Possible StringData Ref from Code Obj ->"LocalAlloc failed" | :760F0160 6830830E76 push 760E8330 :760F0165 6806030000 push 00000306 :760F016A E8BCCDFFFF call 760ECF2B :760F016F 59 pop ecx :760F0170 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0146(C), :760F015E(C) | :760F0171 33C0 xor eax, eax :760F0173 EB06 jmp 760F017B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F013C(C) | :760F0175 6A01 push 00000001 :760F0177 897E04 mov dword ptr [esi+04], edi :760F017A 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0173(U) | :760F017B 5F pop edi :760F017C 5E pop esi :760F017D C20400 ret 0004 * Referenced by a CALL at Addresses: |:760F0935 , :760F0A9D | :760F0180 53 push ebx :760F0181 55 push ebp :760F0182 56 push esi :760F0183 8BF1 mov esi, ecx :760F0185 57 push edi :760F0186 8B4608 mov eax, dword ptr [esi+08] :760F0189 3B4604 cmp eax, dword ptr [esi+04] :760F018C 0F8281000000 jb 760F0213 :760F0192 A184110E76 mov eax, dword ptr [760E1184] * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F0197 8B3D80110E76 mov edi, dword ptr [760E1180] * Possible StringData Ref from Code Obj ->"CArrayIndex::SetValue" | :760F019D BB8C830E76 mov ebx, 760E838C * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F01A2 BD90DF0F76 mov ebp, 760FDF90 :760F01A7 F60004 test byte ptr [eax], 04 :760F01AA 7427 je 760F01D3 :760F01AC 6A04 push 00000004 :760F01AE 53 push ebx :760F01AF 6888000000 push 00000088 :760F01B4 55 push ebp :760F01B5 FFD7 call edi :760F01B7 85C0 test eax, eax :760F01B9 7418 je 760F01D3 :760F01BB FF7604 push [esi+04] :760F01BE FF7608 push [esi+08] * Possible StringData Ref from Code Obj ->"dwIndex %d > m_dwSize %d" | :760F01C1 6870830E76 push 760E8370 :760F01C6 6806030000 push 00000306 :760F01CB E85BCDFFFF call 760ECF2B :760F01D0 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F01AA(C), :760F01B9(C) | :760F01D3 FF7608 push [esi+08] :760F01D6 8BCE mov ecx, esi :760F01D8 E84F000000 call 760F022C :760F01DD 85C0 test eax, eax :760F01DF 7532 jne 760F0213 :760F01E1 A184110E76 mov eax, dword ptr [760E1184] :760F01E6 F60004 test byte ptr [eax], 04 :760F01E9 7424 je 760F020F :760F01EB 6A04 push 00000004 :760F01ED 53 push ebx :760F01EE 688C000000 push 0000008C :760F01F3 55 push ebp :760F01F4 FFD7 call edi :760F01F6 85C0 test eax, eax :760F01F8 7415 je 760F020F :760F01FA FF7608 push [esi+08] * Possible StringData Ref from Code Obj ->"Grow of size %d failed" | :760F01FD 6858830E76 push 760E8358 :760F0202 6806030000 push 00000306 :760F0207 E81FCDFFFF call 760ECF2B :760F020C 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F01E9(C), :760F01F8(C) | :760F020F 33C0 xor eax, eax :760F0211 EB12 jmp 760F0225 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F018C(C), :760F01DF(C) | :760F0213 8B4608 mov eax, dword ptr [esi+08] :760F0216 8B0E mov ecx, dword ptr [esi] :760F0218 8B542414 mov edx, dword ptr [esp+14] :760F021C 6A01 push 00000001 :760F021E 891481 mov dword ptr [ecx+4*eax], edx :760F0221 FF4608 inc [esi+08] :760F0224 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0211(U) | :760F0225 5F pop edi :760F0226 5E pop esi :760F0227 5D pop ebp :760F0228 5B pop ebx :760F0229 C20400 ret 0004 * Referenced by a CALL at Address: |:760F01D8 | :760F022C 8B442404 mov eax, dword ptr [esp+04] :760F0230 53 push ebx :760F0231 8BD9 mov ebx, ecx :760F0233 55 push ebp :760F0234 8B6B04 mov ebp, dword ptr [ebx+04] :760F0237 D1E5 shl ebp, 1 :760F0239 3BC5 cmp eax, ebp :760F023B 7603 jbe 760F0240 :760F023D 8D6864 lea ebp, dword ptr [eax+64] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F023B(C) | :760F0240 8BC5 mov eax, ebp :760F0242 C1E002 shl eax, 02 :760F0245 50 push eax :760F0246 6A40 push 00000040 * Reference To: KERNEL32.LocalAlloc, Ord:01E5h | :760F0248 FF15F0110E76 Call dword ptr [760E11F0] :760F024E 85C0 test eax, eax :760F0250 8944240C mov dword ptr [esp+0C], eax :760F0254 753A jne 760F0290 :760F0256 A184110E76 mov eax, dword ptr [760E1184] :760F025B F60002 test byte ptr [eax], 02 :760F025E 742C je 760F028C :760F0260 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CArrayIndex::Grow" | :760F0262 68A4830E76 push 760E83A4 :760F0267 68B0000000 push 000000B0 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F026C 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F0271 FF1580110E76 Call dword ptr [760E1180] :760F0277 85C0 test eax, eax :760F0279 7411 je 760F028C * Possible StringData Ref from Code Obj ->"LocalAlloc failed" | :760F027B 6830830E76 push 760E8330 :760F0280 6806030000 push 00000306 :760F0285 E8A1CCFFFF call 760ECF2B :760F028A 59 pop ecx :760F028B 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F025E(C), :760F0279(C) | :760F028C 33C0 xor eax, eax :760F028E EB34 jmp 760F02C4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0254(C) | :760F0290 56 push esi :760F0291 8B33 mov esi, dword ptr [ebx] :760F0293 85F6 test esi, esi :760F0295 7424 je 760F02BB :760F0297 8B4B04 mov ecx, dword ptr [ebx+04] :760F029A 57 push edi :760F029B C1E102 shl ecx, 02 :760F029E 8BF8 mov edi, eax :760F02A0 8BC1 mov eax, ecx :760F02A2 C1E902 shr ecx, 02 :760F02A5 F3 repz :760F02A6 A5 movsd :760F02A7 8BC8 mov ecx, eax :760F02A9 83E103 and ecx, 00000003 :760F02AC F3 repz :760F02AD A4 movsb :760F02AE FF33 push dword ptr [ebx] * Reference To: KERNEL32.LocalFree, Ord:01E9h | :760F02B0 FF15F4110E76 Call dword ptr [760E11F4] :760F02B6 8B442414 mov eax, dword ptr [esp+14] :760F02BA 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0295(C) | :760F02BB 6A01 push 00000001 :760F02BD 8903 mov dword ptr [ebx], eax :760F02BF 58 pop eax :760F02C0 896B04 mov dword ptr [ebx+04], ebp :760F02C3 5E pop esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F028E(U) | :760F02C4 5D pop ebp :760F02C5 5B pop ebx :760F02C6 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760F038B , :760F0396 | :760F02C9 51 push ecx :760F02CA 53 push ebx :760F02CB 55 push ebp :760F02CC 56 push esi * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760F02CD 8B3558120E76 mov esi, dword ptr [760E1258] :760F02D3 57 push edi :760F02D4 8B7C2418 mov edi, dword ptr [esp+18] :760F02D8 33DB xor ebx, ebx :760F02DA 57 push edi * Possible StringData Ref from Code Obj ->"Nul" | :760F02DB 68B8830E76 push 760E83B8 :760F02E0 895C2418 mov dword ptr [esp+18], ebx :760F02E4 FFD6 call esi * Reference To: KERNEL32.GetLongPathNameA, Ord:0135h | :760F02E6 8B2DE8110E76 mov ebp, dword ptr [760E11E8] :760F02EC 85C0 test eax, eax :760F02EE 741A je 760F030A :760F02F0 57 push edi :760F02F1 68B6830E76 push 760E83B6 :760F02F6 FFD6 call esi :760F02F8 85C0 test eax, eax :760F02FA 740E je 760F030A :760F02FC 53 push ebx :760F02FD 53 push ebx :760F02FE 57 push edi :760F02FF FFD5 call ebp :760F0301 8BF0 mov esi, eax :760F0303 85F6 test esi, esi :760F0305 7403 je 760F030A :760F0307 46 inc esi :760F0308 EB0D jmp 760F0317 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F02EE(C), :760F02FA(C), :760F0305(C) | :760F030A 57 push edi * Reference To: KERNEL32.lstrlenA, Ord:0335h | :760F030B FF1554120E76 Call dword ptr [760E1254] :760F0311 8BF0 mov esi, eax :760F0313 6A01 push 00000001 :760F0315 46 inc esi :760F0316 5B pop ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0308(U) | :760F0317 56 push esi :760F0318 6A00 push 00000000 * Reference To: KERNEL32.GetProcessHeap, Ord:0155h | :760F031A FF15F8110E76 Call dword ptr [760E11F8] :760F0320 50 push eax * Reference To: KERNEL32.HeapAlloc, Ord:01B4h | :760F0321 FF15EC110E76 Call dword ptr [760E11EC] :760F0327 85C0 test eax, eax :760F0329 8B4C241C mov ecx, dword ptr [esp+1C] :760F032D 8901 mov dword ptr [ecx], eax :760F032F 741F je 760F0350 :760F0331 85DB test ebx, ebx :760F0333 750B jne 760F0340 :760F0335 56 push esi :760F0336 50 push eax :760F0337 57 push edi :760F0338 FFD5 call ebp :760F033A 85C0 test eax, eax :760F033C 7412 je 760F0350 :760F033E EB08 jmp 760F0348 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0333(C) | :760F0340 57 push edi :760F0341 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760F0342 FF1504120E76 Call dword ptr [760E1204] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F033E(U) | :760F0348 C744241001000000 mov [esp+10], 00000001 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F032F(C), :760F033C(C) | :760F0350 8B442410 mov eax, dword ptr [esp+10] :760F0354 5F pop edi :760F0355 5E pop esi :760F0356 5D pop ebp :760F0357 5B pop ebx :760F0358 59 pop ecx :760F0359 C20800 ret 0008 * Referenced by a CALL at Address: |:760F04DC | :760F035C 51 push ecx :760F035D 53 push ebx :760F035E 55 push ebp :760F035F 56 push esi :760F0360 8BF1 mov esi, ecx :760F0362 8B4C241C mov ecx, dword ptr [esp+1C] :760F0366 57 push edi :760F0367 8D7E04 lea edi, dword ptr [esi+04] :760F036A 33C0 xor eax, eax :760F036C 89442410 mov dword ptr [esp+10], eax :760F0370 8906 mov dword ptr [esi], eax :760F0372 8907 mov dword ptr [edi], eax :760F0374 8B442418 mov eax, dword ptr [esp+18] :760F0378 894E08 mov dword ptr [esi+08], ecx :760F037B 803800 cmp byte ptr [eax], 00 :760F037E 7429 je 760F03A9 :760F0380 8B5C241C mov ebx, dword ptr [esp+1C] :760F0384 803B00 cmp byte ptr [ebx], 00 :760F0387 7420 je 760F03A9 :760F0389 56 push esi :760F038A 50 push eax :760F038B E839FFFFFF call 760F02C9 :760F0390 85C0 test eax, eax :760F0392 7415 je 760F03A9 :760F0394 57 push edi :760F0395 53 push ebx :760F0396 E82EFFFFFF call 760F02C9 :760F039B 85C0 test eax, eax :760F039D 740A je 760F03A9 :760F039F C744241001000000 mov [esp+10], 00000001 :760F03A7 EB2E jmp 760F03D7 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F037E(C), :760F0387(C), :760F0392(C), :760F039D(C) | :760F03A9 8B07 mov eax, dword ptr [edi] * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760F03AB 8B2DFC110E76 mov ebp, dword ptr [760E11FC] * Reference To: KERNEL32.GetProcessHeap, Ord:0155h | :760F03B1 8B1DF8110E76 mov ebx, dword ptr [760E11F8] :760F03B7 85C0 test eax, eax :760F03B9 740B je 760F03C6 :760F03BB 50 push eax :760F03BC 6A00 push 00000000 :760F03BE FFD3 call ebx :760F03C0 50 push eax :760F03C1 FFD5 call ebp :760F03C3 832700 and dword ptr [edi], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F03B9(C) | :760F03C6 8B06 mov eax, dword ptr [esi] :760F03C8 85C0 test eax, eax :760F03CA 740B je 760F03D7 :760F03CC 50 push eax :760F03CD 6A00 push 00000000 :760F03CF FFD3 call ebx :760F03D1 50 push eax :760F03D2 FFD5 call ebp :760F03D4 832600 and dword ptr [esi], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F03A7(U), :760F03CA(C) | :760F03D7 8B442410 mov eax, dword ptr [esp+10] :760F03DB 5F pop edi :760F03DC 5E pop esi :760F03DD 5D pop ebp :760F03DE 5B pop ebx :760F03DF 59 pop ecx :760F03E0 C20C00 ret 000C * Referenced by a CALL at Addresses: |:760F049A , :760F0D3A | :760F03E3 55 push ebp :760F03E4 8BEC mov ebp, esp :760F03E6 51 push ecx :760F03E7 53 push ebx :760F03E8 56 push esi :760F03E9 33F6 xor esi, esi :760F03EB 57 push edi :760F03EC 397518 cmp dword ptr [ebp+18], esi :760F03EF 8975FC mov dword ptr [ebp-04], esi :760F03F2 7679 jbe 760F046D :760F03F4 8B7D14 mov edi, dword ptr [ebp+14] :760F03F7 8B450C mov eax, dword ptr [ebp+0C] :760F03FA 8B5D10 mov ebx, dword ptr [ebp+10] :760F03FD 802700 and byte ptr [edi], 00 :760F0400 3918 cmp dword ptr [eax], ebx :760F0402 732E jnb 760F0432 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0429(C) | :760F0404 3B7518 cmp esi, dword ptr [ebp+18] :760F0407 7364 jnb 760F046D :760F0409 8B08 mov ecx, dword ptr [eax] :760F040B 8B5508 mov edx, dword ptr [ebp+08] :760F040E 8A0C11 mov cl, byte ptr [ecx+edx] :760F0411 880C3E mov byte ptr [esi+edi], cl :760F0414 8B08 mov ecx, dword ptr [eax] :760F0416 46 inc esi :760F0417 8A1411 mov dl, byte ptr [ecx+edx] :760F041A 80FA0D cmp dl, 0D :760F041D 740E je 760F042D :760F041F 80FA0A cmp dl, 0A :760F0422 7409 je 760F042D :760F0424 41 inc ecx :760F0425 3BCB cmp ecx, ebx :760F0427 8908 mov dword ptr [eax], ecx :760F0429 72D9 jb 760F0404 :760F042B EB05 jmp 760F0432 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F041D(C), :760F0422(C) | :760F042D 80643EFF00 and byte ptr [esi+edi-01], 00 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0402(C), :760F042B(U) | :760F0432 3B7518 cmp esi, dword ptr [ebp+18] :760F0435 7336 jnb 760F046D :760F0437 3918 cmp dword ptr [eax], ebx :760F0439 7206 jb 760F0441 :760F043B 8918 mov dword ptr [eax], ebx :760F043D 80243700 and byte ptr [edi+esi], 00 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0439(C) | :760F0441 85F6 test esi, esi :760F0443 7428 je 760F046D :760F0445 C745FC01000000 mov [ebp-04], 00000001 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0463(C) | :760F044C 8B08 mov ecx, dword ptr [eax] :760F044E 8B5508 mov edx, dword ptr [ebp+08] :760F0451 8A1411 mov dl, byte ptr [ecx+edx] :760F0454 80FA0D cmp dl, 0D :760F0457 7405 je 760F045E :760F0459 80FA0A cmp dl, 0A :760F045C 7509 jne 760F0467 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0457(C) | :760F045E 41 inc ecx :760F045F 3BCB cmp ecx, ebx :760F0461 8908 mov dword ptr [eax], ecx :760F0463 72E7 jb 760F044C :760F0465 8918 mov dword ptr [eax], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F045C(C) | :760F0467 57 push edi :760F0468 E8CB3DFFFF call 760E4238 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F03F2(C), :760F0407(C), :760F0435(C), :760F0443(C) | :760F046D 8B45FC mov eax, dword ptr [ebp-04] :760F0470 5F pop edi :760F0471 5E pop esi :760F0472 5B pop ebx :760F0473 C9 leave :760F0474 C21400 ret 0014 * Referenced by a CALL at Addresses: |:760F0ECF , :760F110B | :760F0477 55 push ebp :760F0478 8BEC mov ebp, esp :760F047A 81EC00040000 sub esp, 00000400 :760F0480 56 push esi :760F0481 57 push edi :760F0482 33FF xor edi, edi :760F0484 BE00040000 mov esi, 00000400 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F04AA(C), :760F04C8(C), :760F04E4(C) | :760F0489 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760F048F 56 push esi :760F0490 50 push eax :760F0491 FF7510 push [ebp+10] :760F0494 FF750C push [ebp+0C] :760F0497 FF7508 push [ebp+08] :760F049A E844FFFFFF call 760F03E3 :760F049F 85C0 test eax, eax :760F04A1 7445 je 760F04E8 :760F04A3 80BD00FCFFFF00 cmp byte ptr [ebp+FFFFFC00], 00 :760F04AA 74DD je 760F0489 :760F04AC 80BD00FCFFFF5B cmp byte ptr [ebp+FFFFFC00], 5B :760F04B3 7433 je 760F04E8 :760F04B5 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760F04BB 6A3D push 0000003D :760F04BD 50 push eax * Reference To: MSVCRT.strchr, Ord:02B4h | :760F04BE FF1570100E76 Call dword ptr [760E1070] :760F04C4 59 pop ecx :760F04C5 85C0 test eax, eax :760F04C7 59 pop ecx :760F04C8 74BF je 760F0489 :760F04CA 802000 and byte ptr [eax], 00 :760F04CD FF7518 push [ebp+18] :760F04D0 8B4D14 mov ecx, dword ptr [ebp+14] :760F04D3 40 inc eax :760F04D4 50 push eax :760F04D5 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760F04DB 50 push eax :760F04DC E87BFEFFFF call 760F035C :760F04E1 83F801 cmp eax, 00000001 :760F04E4 75A3 jne 760F0489 :760F04E6 50 push eax :760F04E7 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F04A1(C), :760F04B3(C) | :760F04E8 8BC7 mov eax, edi :760F04EA 5F pop edi :760F04EB 5E pop esi :760F04EC C9 leave :760F04ED C21400 ret 0014 * Referenced by a CALL at Address: |:760F0ED9 | :760F04F0 A198E50F76 mov eax, dword ptr [760FE598] :760F04F5 53 push ebx :760F04F6 33DB xor ebx, ebx :760F04F8 55 push ebp :760F04F9 56 push esi :760F04FA 3BC3 cmp eax, ebx :760F04FC 57 push edi :760F04FD 743D je 760F053C :760F04FF 395808 cmp dword ptr [eax+08], ebx :760F0502 7638 jbe 760F053C :760F0504 8B7C2414 mov edi, dword ptr [esp+14] * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760F0508 8B2D58120E76 mov ebp, dword ptr [760E1258] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F053A(C) | :760F050E 8B00 mov eax, dword ptr [eax] :760F0510 FF7704 push [edi+04] :760F0513 8B3498 mov esi, dword ptr [eax+4*ebx] :760F0516 FF7604 push [esi+04] :760F0519 FFD5 call ebp :760F051B 85C0 test eax, eax :760F051D 7512 jne 760F0531 :760F051F FF37 push dword ptr [edi] :760F0521 FF36 push dword ptr [esi] :760F0523 FFD5 call ebp :760F0525 85C0 test eax, eax :760F0527 7508 jne 760F0531 :760F0529 8B4608 mov eax, dword ptr [esi+08] :760F052C 3B4708 cmp eax, dword ptr [edi+08] :760F052F 7414 je 760F0545 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F051D(C), :760F0527(C) | :760F0531 A198E50F76 mov eax, dword ptr [760FE598] :760F0536 43 inc ebx :760F0537 3B5808 cmp ebx, dword ptr [eax+08] :760F053A 72D2 jb 760F050E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F04FD(C), :760F0502(C) | :760F053C 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0548(U) | :760F053E 5F pop edi :760F053F 5E pop esi :760F0540 5D pop ebp :760F0541 5B pop ebx :760F0542 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F052F(C) | :760F0545 6A01 push 00000001 :760F0547 58 pop eax :760F0548 EBF4 jmp 760F053E * Referenced by a CALL at Addresses: |:760F0674 , :760F07EE | :760F054A 55 push ebp :760F054B 8BEC mov ebp, esp :760F054D 81ECE8030000 sub esp, 000003E8 :760F0553 FF7508 push [ebp+08] :760F0556 8D8518FCFFFF lea eax, dword ptr [ebp+FFFFFC18] * Possible StringData Ref from Code Obj ->"Invalid entry to delete file %s " ->"has been written in wininit.ini" | :760F055C 68BC830E76 push 760E83BC :760F0561 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760F0562 FF1530100E76 Call dword ptr [760E1030] :760F0568 83C40C add esp, 0000000C :760F056B 8D8518FCFFFF lea eax, dword ptr [ebp+FFFFFC18] :760F0571 B918D30F76 mov ecx, 760FD318 :760F0576 6A00 push 00000000 :760F0578 50 push eax :760F0579 6A03 push 00000003 :760F057B E8301EFFFF call 760E23B0 :760F0580 C9 leave :760F0581 C20400 ret 0004 * Referenced by a CALL at Address: |:760F13E2 | :760F0584 55 push ebp :760F0585 8BEC mov ebp, esp :760F0587 81ECE8030000 sub esp, 000003E8 :760F058D 8B4508 mov eax, dword ptr [ebp+08] :760F0590 8B4808 mov ecx, dword ptr [eax+08] :760F0593 FF348DBCDF0F76 push dword ptr [4*ecx+760FDFBC] :760F059A FF7004 push [eax+04] :760F059D FF30 push dword ptr [eax] :760F059F 8D8518FCFFFF lea eax, dword ptr [ebp+FFFFFC18] * Possible StringData Ref from Code Obj ->"SFP removed invalid entry %s=%s " ->"in the %s section from wininit.ini" | :760F05A5 68FC830E76 push 760E83FC :760F05AA 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760F05AB FF1530100E76 Call dword ptr [760E1030] :760F05B1 83C414 add esp, 00000014 :760F05B4 8D8518FCFFFF lea eax, dword ptr [ebp+FFFFFC18] :760F05BA B918D30F76 mov ecx, 760FD318 :760F05BF 6A00 push 00000000 :760F05C1 50 push eax :760F05C2 6A03 push 00000003 :760F05C4 E8E71DFFFF call 760E23B0 :760F05C9 C9 leave :760F05CA C20400 ret 0004 * Referenced by a CALL at Address: |:760F081F | :760F05CD 51 push ecx :760F05CE A184110E76 mov eax, dword ptr [760E1184] :760F05D3 53 push ebx :760F05D4 55 push ebp :760F05D5 56 push esi :760F05D6 F60004 test byte ptr [eax], 04 :760F05D9 8B742414 mov esi, dword ptr [esp+14] :760F05DD 57 push edi * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F05DE 8B3D80110E76 mov edi, dword ptr [760E1180] :760F05E4 C744241001000000 mov [esp+10], 00000001 * Possible StringData Ref from Code Obj ->"IsRenameEntryValid" | :760F05EC BB10850E76 mov ebx, 760E8510 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F05F1 BD90DF0F76 mov ebp, 760FDF90 :760F05F6 7426 je 760F061E :760F05F8 6A04 push 00000004 :760F05FA 53 push ebx :760F05FB 6815020000 push 00000215 :760F0600 55 push ebp :760F0601 FFD7 call edi :760F0603 85C0 test eax, eax :760F0605 7417 je 760F061E :760F0607 FF7604 push [esi+04] :760F060A FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"Processing RENAME entry %s=%s" | :760F060C 68F0840E76 push 760E84F0 :760F0611 6806030000 push 00000306 :760F0616 E810C9FFFF call 760ECF2B :760F061B 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F05F6(C), :760F0605(C) | :760F061E FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"Nul" | :760F0620 68B8830E76 push 760E83B8 * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760F0625 FF1558120E76 Call dword ptr [760E1258] :760F062B FF7604 push [esi+04] :760F062E 85C0 test eax, eax :760F0630 754C jne 760F067E * Reference To: SfpDll.SfpIsFileProtectedS | :760F0632 E80F17FFFF call 760E1D46 :760F0637 85C0 test eax, eax :760F0639 0F8552010000 jne 760F0791 :760F063F 21442410 and dword ptr [esp+10], eax :760F0643 A184110E76 mov eax, dword ptr [760E1184] :760F0648 F60004 test byte ptr [eax], 04 :760F064B 7424 je 760F0671 :760F064D 6A04 push 00000004 :760F064F 53 push ebx :760F0650 681E020000 push 0000021E :760F0655 55 push ebp :760F0656 FFD7 call edi :760F0658 85C0 test eax, eax :760F065A 7415 je 760F0671 :760F065C FF7604 push [esi+04] * Possible StringData Ref from Code Obj ->"SFP file %s is being deleted" | :760F065F 68D0840E76 push 760E84D0 :760F0664 6806030000 push 00000306 :760F0669 E8BDC8FFFF call 760ECF2B :760F066E 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F064B(C), :760F065A(C), :760F0693(C), :760F06A2(C), :760F06BB(U) | :760F0671 FF7604 push [esi+04] :760F0674 E8D1FEFFFF call 760F054A :760F0679 E913010000 jmp 760F0791 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0630(C) | * Reference To: SfpDll.SfpIsFileProtectedS | :760F067E E8C316FFFF call 760E1D46 :760F0683 85C0 test eax, eax :760F0685 7536 jne 760F06BD :760F0687 21442410 and dword ptr [esp+10], eax :760F068B A184110E76 mov eax, dword ptr [760E1184] :760F0690 F60004 test byte ptr [eax], 04 :760F0693 74DC je 760F0671 :760F0695 6A04 push 00000004 :760F0697 53 push ebx :760F0698 682B020000 push 0000022B :760F069D 55 push ebp :760F069E FFD7 call edi :760F06A0 85C0 test eax, eax :760F06A2 74CD je 760F0671 :760F06A4 FF36 push dword ptr [esi] :760F06A6 FF7604 push [esi+04] * Possible StringData Ref from Code Obj ->"SFP file %s is on the RHS of a " ->"rename. Lhs is %s" | :760F06A9 689C840E76 push 760E849C :760F06AE 6806030000 push 00000306 :760F06B3 E873C8FFFF call 760ECF2B :760F06B8 83C410 add esp, 00000010 :760F06BB EBB4 jmp 760F0671 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0685(C) | :760F06BD FF36 push dword ptr [esi] * Reference To: SfpDll.SfpIsFileProtectedS | :760F06BF E88216FFFF call 760E1D46 :760F06C4 85C0 test eax, eax :760F06C6 743A je 760F0702 :760F06C8 A184110E76 mov eax, dword ptr [760E1184] :760F06CD F60004 test byte ptr [eax], 04 :760F06D0 0F84BB000000 je 760F0791 :760F06D6 6A04 push 00000004 :760F06D8 53 push ebx :760F06D9 6835020000 push 00000235 :760F06DE 55 push ebp :760F06DF FFD7 call edi :760F06E1 85C0 test eax, eax :760F06E3 0F84A8000000 je 760F0791 :760F06E9 FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"File %s is not an SFP file" | :760F06EB 6880840E76 push 760E8480 :760F06F0 6806030000 push 00000306 :760F06F5 E831C8FFFF call 760ECF2B :760F06FA 83C40C add esp, 0000000C :760F06FD E98F000000 jmp 760F0791 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F06C6(C) | :760F0702 FF7604 push [esi+04] :760F0705 E83131FFFF call 760E383B :760F070A 85C0 test eax, eax :760F070C 753A jne 760F0748 :760F070E A184110E76 mov eax, dword ptr [760E1184] :760F0713 F60004 test byte ptr [eax], 04 :760F0716 7424 je 760F073C :760F0718 6A04 push 00000004 :760F071A 53 push ebx :760F071B 683D020000 push 0000023D :760F0720 55 push ebp :760F0721 FFD7 call edi :760F0723 85C0 test eax, eax :760F0725 7415 je 760F073C :760F0727 FF7604 push [esi+04] * Possible StringData Ref from Code Obj ->"Source file %s does not exist" | :760F072A 6860840E76 push 760E8460 :760F072F 6806030000 push 00000306 :760F0734 E8F2C7FFFF call 760ECF2B :760F0739 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0716(C), :760F0725(C) | :760F073C 8B44241C mov eax, dword ptr [esp+1C] :760F0740 C70001000000 mov dword ptr [eax], 00000001 :760F0746 EB49 jmp 760F0791 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F070C(C) | :760F0748 6A00 push 00000000 :760F074A 6A00 push 00000000 :760F074C 6A01 push 00000001 :760F074E FF7604 push [esi+04] :760F0751 FF36 push dword ptr [esi] :760F0753 E89EA9FFFF call 760EB0F6 :760F0758 85C0 test eax, eax :760F075A 7535 jne 760F0791 :760F075C A184110E76 mov eax, dword ptr [760E1184] :760F0761 F60004 test byte ptr [eax], 04 :760F0764 7426 je 760F078C :760F0766 6A04 push 00000004 :760F0768 53 push ebx :760F0769 684A020000 push 0000024A :760F076E 55 push ebp :760F076F FFD7 call edi :760F0771 85C0 test eax, eax :760F0773 7417 je 760F078C :760F0775 FF7604 push [esi+04] :760F0778 FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"RENAME entry %s=%s is invalid" | :760F077A 6840840E76 push 760E8440 :760F077F 6806030000 push 00000306 :760F0784 E8A2C7FFFF call 760ECF2B :760F0789 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0764(C), :760F0773(C) | :760F078C 8364241000 and dword ptr [esp+10], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0639(C), :760F0679(U), :760F06D0(C), :760F06E3(C), :760F06FD(U) |:760F0746(U), :760F075A(C) | :760F0791 8B442410 mov eax, dword ptr [esp+10] :760F0795 5F pop edi :760F0796 5E pop esi :760F0797 5D pop ebp :760F0798 5B pop ebx :760F0799 59 pop ecx :760F079A C20800 ret 0008 * Referenced by a CALL at Address: |:760F0816 | :760F079D A184110E76 mov eax, dword ptr [760E1184] :760F07A2 56 push esi :760F07A3 8B742408 mov esi, dword ptr [esp+08] :760F07A7 57 push edi :760F07A8 F60004 test byte ptr [eax], 04 :760F07AB 6A01 push 00000001 :760F07AD 5F pop edi :760F07AE 742F je 760F07DF :760F07B0 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"IsNULEntryValid" | :760F07B2 683C850E76 push 760E853C :760F07B7 685B020000 push 0000025B * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F07BC 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F07C1 FF1580110E76 Call dword ptr [760E1180] :760F07C7 85C0 test eax, eax :760F07C9 7414 je 760F07DF :760F07CB FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"Processing NUL entry %s" | :760F07CD 6824850E76 push 760E8524 :760F07D2 6806030000 push 00000306 :760F07D7 E84FC7FFFF call 760ECF2B :760F07DC 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F07AE(C), :760F07C9(C) | :760F07DF FF36 push dword ptr [esi] * Reference To: SfpDll.SfpIsFileProtectedS | :760F07E1 E86015FFFF call 760E1D46 :760F07E6 85C0 test eax, eax :760F07E8 7509 jne 760F07F3 :760F07EA FF36 push dword ptr [esi] :760F07EC 33FF xor edi, edi :760F07EE E857FDFFFF call 760F054A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F07E8(C) | :760F07F3 8BC7 mov eax, edi :760F07F5 5F pop edi :760F07F6 5E pop esi :760F07F7 C20400 ret 0004 * Referenced by a CALL at Address: |:760F0EE7 | :760F07FA 8B4C2408 mov ecx, dword ptr [esp+08] :760F07FE 8B542404 mov edx, dword ptr [esp+04] :760F0802 832100 and dword ptr [ecx], 00000000 :760F0805 8B4208 mov eax, dword ptr [edx+08] :760F0808 83E800 sub eax, 00000000 :760F080B 7410 je 760F081D :760F080D 48 dec eax :760F080E 7405 je 760F0815 :760F0810 6A01 push 00000001 :760F0812 58 pop eax :760F0813 EB0F jmp 760F0824 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F080E(C) | :760F0815 52 push edx :760F0816 E882FFFFFF call 760F079D :760F081B EB07 jmp 760F0824 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F080B(C) | :760F081D 51 push ecx :760F081E 52 push edx :760F081F E8A9FDFFFF call 760F05CD * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0813(U), :760F081B(U) | :760F0824 C20800 ret 0008 * Referenced by a CALL at Address: |:760F0EF6 | :760F0827 51 push ecx :760F0828 833D98E50F7600 cmp dword ptr [760FE598], 00000000 :760F082F 53 push ebx :760F0830 55 push ebp :760F0831 56 push esi * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F0832 8B3580110E76 mov esi, dword ptr [760E1180] :760F0838 57 push edi :760F0839 C74424104F050000 mov [esp+10], 0000054F * Possible StringData Ref from Code Obj ->"StoreInValidEntries" | :760F0841 BBB8850E76 mov ebx, 760E85B8 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F0846 BF90DF0F76 mov edi, 760FDF90 :760F084B 0F85D9000000 jne 760F092A :760F0851 A184110E76 mov eax, dword ptr [760E1184] :760F0856 F60004 test byte ptr [eax], 04 :760F0859 7423 je 760F087E :760F085B 6A04 push 00000004 :760F085D 53 push ebx :760F085E 688B020000 push 0000028B :760F0863 57 push edi :760F0864 FFD6 call esi :760F0866 85C0 test eax, eax :760F0868 7414 je 760F087E :760F086A BD06030000 mov ebp, 00000306 * Possible StringData Ref from Code Obj ->"Creating new valid entries table" | :760F086F 6894850E76 push 760E8594 :760F0874 55 push ebp :760F0875 E8B1C6FFFF call 760ECF2B :760F087A 59 pop ecx :760F087B 59 pop ecx :760F087C EB05 jmp 760F0883 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0859(C), :760F0868(C) | :760F087E BD06030000 mov ebp, 00000306 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F087C(U) | :760F0883 6A0C push 0000000C * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760F0885 E8F51FFFFF Call 760E287F :760F088A 85C0 test eax, eax :760F088C 59 pop ecx :760F088D 7409 je 760F0898 :760F088F 8BC8 mov ecx, eax :760F0891 E83FF8FFFF call 760F00D5 :760F0896 EB02 jmp 760F089A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F088D(C) | :760F0898 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0896(U) | :760F089A 85C0 test eax, eax :760F089C A398E50F76 mov dword ptr [760FE598], eax :760F08A1 7533 jne 760F08D6 :760F08A3 A184110E76 mov eax, dword ptr [760E1184] :760F08A8 F60002 test byte ptr [eax], 02 :760F08AB 0F84D2000000 je 760F0983 :760F08B1 6A02 push 00000002 :760F08B3 53 push ebx :760F08B4 688F020000 push 0000028F :760F08B9 57 push edi :760F08BA FFD6 call esi :760F08BC 85C0 test eax, eax :760F08BE 0F84BF000000 je 760F0983 * Possible StringData Ref from Code Obj ->"new CArrayIndex failed" | :760F08C4 687C850E76 push 760E857C :760F08C9 55 push ebp :760F08CA E85CC6FFFF call 760ECF2B :760F08CF 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0979(U) | :760F08D0 59 pop ecx :760F08D1 E9AD000000 jmp 760F0983 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F08A1(C) | :760F08D6 6A64 push 00000064 :760F08D8 8BC8 mov ecx, eax :760F08DA E843F8FFFF call 760F0122 :760F08DF 85C0 test eax, eax :760F08E1 7547 jne 760F092A :760F08E3 A184110E76 mov eax, dword ptr [760E1184] :760F08E8 F60002 test byte ptr [eax], 02 :760F08EB 741C je 760F0909 :760F08ED 6A02 push 00000002 :760F08EF 53 push ebx :760F08F0 6895020000 push 00000295 :760F08F5 57 push edi :760F08F6 FFD6 call esi :760F08F8 85C0 test eax, eax :760F08FA 740D je 760F0909 * Possible StringData Ref from Code Obj ->"g_pValidEntries->Init() failed" | :760F08FC 685C850E76 push 760E855C :760F0901 55 push ebp :760F0902 E824C6FFFF call 760ECF2B :760F0907 59 pop ecx :760F0908 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F08EB(C), :760F08FA(C) | :760F0909 8B3598E50F76 mov esi, dword ptr [760FE598] :760F090F 85F6 test esi, esi :760F0911 740E je 760F0921 :760F0913 8BCE mov ecx, esi :760F0915 E8C8F7FFFF call 760F00E2 :760F091A 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F091B E82B10FFFF Call 760E194B :760F0920 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0911(C) | :760F0921 832598E50F7600 and dword ptr [760FE598], 00000000 :760F0928 EB59 jmp 760F0983 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F084B(C), :760F08E1(C) | :760F092A 8B6C2418 mov ebp, dword ptr [esp+18] :760F092E 8B0D98E50F76 mov ecx, dword ptr [760FE598] :760F0934 55 push ebp :760F0935 E846F8FFFF call 760F0180 :760F093A 85C0 test eax, eax :760F093C 7540 jne 760F097E :760F093E A184110E76 mov eax, dword ptr [760E1184] :760F0943 F60002 test byte ptr [eax], 02 :760F0946 7420 je 760F0968 :760F0948 6A02 push 00000002 :760F094A 53 push ebx :760F094B 689F020000 push 0000029F :760F0950 57 push edi :760F0951 FFD6 call esi :760F0953 85C0 test eax, eax :760F0955 7411 je 760F0968 * Possible StringData Ref from Code Obj ->"SetValue failed" | :760F0957 684C850E76 push 760E854C :760F095C 6806030000 push 00000306 :760F0961 E8C5C5FFFF call 760ECF2B :760F0966 59 pop ecx :760F0967 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0946(C), :760F0955(C) | :760F0968 85ED test ebp, ebp :760F096A 7417 je 760F0983 :760F096C 8BCD mov ecx, ebp :760F096E E829F7FFFF call 760F009C :760F0973 55 push ebp * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F0974 E8D20FFFFF Call 760E194B :760F0979 E952FFFFFF jmp 760F08D0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F093C(C) | :760F097E 8364241000 and dword ptr [esp+10], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F08AB(C), :760F08BE(C), :760F08D1(U), :760F0928(U), :760F096A(C) | :760F0983 8B442410 mov eax, dword ptr [esp+10] :760F0987 5F pop edi :760F0988 5E pop esi :760F0989 5D pop ebp :760F098A 5B pop ebx :760F098B 59 pop ecx :760F098C C20400 ret 0004 * Referenced by a CALL at Address: |:760F0F15 | :760F098F 51 push ecx :760F0990 833D94E50F7600 cmp dword ptr [760FE594], 00000000 :760F0997 53 push ebx :760F0998 55 push ebp :760F0999 56 push esi * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F099A 8B3580110E76 mov esi, dword ptr [760E1180] :760F09A0 57 push edi :760F09A1 C74424104F050000 mov [esp+10], 0000054F * Possible StringData Ref from Code Obj ->"StoreInToEntriesToDelete" | :760F09A9 BB04860E76 mov ebx, 760E8604 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F09AE BF90DF0F76 mov edi, 760FDF90 :760F09B3 0F85D9000000 jne 760F0A92 :760F09B9 A184110E76 mov eax, dword ptr [760E1184] :760F09BE F60004 test byte ptr [eax], 04 :760F09C1 7423 je 760F09E6 :760F09C3 6A04 push 00000004 :760F09C5 53 push ebx :760F09C6 68B1020000 push 000002B1 :760F09CB 57 push edi :760F09CC FFD6 call esi :760F09CE 85C0 test eax, eax :760F09D0 7414 je 760F09E6 :760F09D2 BD06030000 mov ebp, 00000306 * Possible StringData Ref from Code Obj ->"Creating new table" | :760F09D7 68F0850E76 push 760E85F0 :760F09DC 55 push ebp :760F09DD E849C5FFFF call 760ECF2B :760F09E2 59 pop ecx :760F09E3 59 pop ecx :760F09E4 EB05 jmp 760F09EB * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F09C1(C), :760F09D0(C) | :760F09E6 BD06030000 mov ebp, 00000306 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F09E4(U) | :760F09EB 6A0C push 0000000C * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760F09ED E88D1EFFFF Call 760E287F :760F09F2 85C0 test eax, eax :760F09F4 59 pop ecx :760F09F5 7409 je 760F0A00 :760F09F7 8BC8 mov ecx, eax :760F09F9 E8D7F6FFFF call 760F00D5 :760F09FE EB02 jmp 760F0A02 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F09F5(C) | :760F0A00 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F09FE(U) | :760F0A02 85C0 test eax, eax :760F0A04 A394E50F76 mov dword ptr [760FE594], eax :760F0A09 7533 jne 760F0A3E :760F0A0B A184110E76 mov eax, dword ptr [760E1184] :760F0A10 F60002 test byte ptr [eax], 02 :760F0A13 0F84D2000000 je 760F0AEB :760F0A19 6A02 push 00000002 :760F0A1B 53 push ebx :760F0A1C 68B5020000 push 000002B5 :760F0A21 57 push edi :760F0A22 FFD6 call esi :760F0A24 85C0 test eax, eax :760F0A26 0F84BF000000 je 760F0AEB * Possible StringData Ref from Code Obj ->"new CArrayIndex failed" | :760F0A2C 687C850E76 push 760E857C :760F0A31 55 push ebp :760F0A32 E8F4C4FFFF call 760ECF2B :760F0A37 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0AE1(U) | :760F0A38 59 pop ecx :760F0A39 E9AD000000 jmp 760F0AEB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0A09(C) | :760F0A3E 6A64 push 00000064 :760F0A40 8BC8 mov ecx, eax :760F0A42 E8DBF6FFFF call 760F0122 :760F0A47 85C0 test eax, eax :760F0A49 7547 jne 760F0A92 :760F0A4B A184110E76 mov eax, dword ptr [760E1184] :760F0A50 F60002 test byte ptr [eax], 02 :760F0A53 741C je 760F0A71 :760F0A55 6A02 push 00000002 :760F0A57 53 push ebx :760F0A58 68BB020000 push 000002BB :760F0A5D 57 push edi :760F0A5E FFD6 call esi :760F0A60 85C0 test eax, eax :760F0A62 740D je 760F0A71 * Possible StringData Ref from Code Obj ->"g_pEntriesToDelete->Init() failed" | :760F0A64 68CC850E76 push 760E85CC :760F0A69 55 push ebp :760F0A6A E8BCC4FFFF call 760ECF2B :760F0A6F 59 pop ecx :760F0A70 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0A53(C), :760F0A62(C) | :760F0A71 8B3594E50F76 mov esi, dword ptr [760FE594] :760F0A77 85F6 test esi, esi :760F0A79 740E je 760F0A89 :760F0A7B 8BCE mov ecx, esi :760F0A7D E860F6FFFF call 760F00E2 :760F0A82 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F0A83 E8C30EFFFF Call 760E194B :760F0A88 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0A79(C) | :760F0A89 832594E50F7600 and dword ptr [760FE594], 00000000 :760F0A90 EB59 jmp 760F0AEB * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F09B3(C), :760F0A49(C) | :760F0A92 8B6C2418 mov ebp, dword ptr [esp+18] :760F0A96 8B0D94E50F76 mov ecx, dword ptr [760FE594] :760F0A9C 55 push ebp :760F0A9D E8DEF6FFFF call 760F0180 :760F0AA2 85C0 test eax, eax :760F0AA4 7540 jne 760F0AE6 :760F0AA6 A184110E76 mov eax, dword ptr [760E1184] :760F0AAB F60002 test byte ptr [eax], 02 :760F0AAE 7420 je 760F0AD0 :760F0AB0 6A02 push 00000002 :760F0AB2 53 push ebx :760F0AB3 68C5020000 push 000002C5 :760F0AB8 57 push edi :760F0AB9 FFD6 call esi :760F0ABB 85C0 test eax, eax :760F0ABD 7411 je 760F0AD0 * Possible StringData Ref from Code Obj ->"SetValue failed" | :760F0ABF 684C850E76 push 760E854C :760F0AC4 6806030000 push 00000306 :760F0AC9 E85DC4FFFF call 760ECF2B :760F0ACE 59 pop ecx :760F0ACF 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0AAE(C), :760F0ABD(C) | :760F0AD0 85ED test ebp, ebp :760F0AD2 7417 je 760F0AEB :760F0AD4 8BCD mov ecx, ebp :760F0AD6 E8C1F5FFFF call 760F009C :760F0ADB 55 push ebp * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F0ADC E86A0EFFFF Call 760E194B :760F0AE1 E952FFFFFF jmp 760F0A38 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0AA4(C) | :760F0AE6 8364241000 and dword ptr [esp+10], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0A13(C), :760F0A26(C), :760F0A39(U), :760F0A90(U), :760F0AD2(C) | :760F0AEB 8B442410 mov eax, dword ptr [esp+10] :760F0AEF 5F pop edi :760F0AF0 5E pop esi :760F0AF1 5D pop ebp :760F0AF2 5B pop ebx :760F0AF3 59 pop ecx :760F0AF4 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760F0DF2 , :760F1290 | :760F0AF7 55 push ebp :760F0AF8 8BEC mov ebp, esp :760F0AFA 8B4514 mov eax, dword ptr [ebp+14] :760F0AFD 53 push ebx :760F0AFE 8B5D0C mov ebx, dword ptr [ebp+0C] :760F0B01 56 push esi :760F0B02 8B7518 mov esi, dword ptr [ebp+18] :760F0B05 57 push edi :760F0B06 830BFF or dword ptr [ebx], FFFFFFFF :760F0B09 33FF xor edi, edi :760F0B0B 57 push edi :760F0B0C 6880000008 push 08000080 :760F0B11 6A03 push 00000003 :760F0B13 57 push edi :760F0B14 57 push edi :760F0B15 8938 mov dword ptr [eax], edi :760F0B17 8B4510 mov eax, dword ptr [ebp+10] :760F0B1A 56 push esi :760F0B1B FF7508 push [ebp+08] :760F0B1E 8938 mov dword ptr [eax], edi * Reference To: KERNEL32.CreateFileA, Ord:0037h | :760F0B20 FF1580120E76 Call dword ptr [760E1280] :760F0B26 83F8FF cmp eax, FFFFFFFF :760F0B29 8903 mov dword ptr [ebx], eax :760F0B2B 7552 jne 760F0B7F * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F0B2D FF15A0110E76 Call dword ptr [760E11A0] :760F0B33 8BF0 mov esi, eax :760F0B35 A184110E76 mov eax, dword ptr [760E1184] :760F0B3A F60002 test byte ptr [eax], 02 :760F0B3D 742E je 760F0B6D :760F0B3F 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"MyMapFile" | :760F0B41 6878860E76 push 760E8678 :760F0B46 68F0020000 push 000002F0 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F0B4B 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F0B50 FF1580110E76 Call dword ptr [760E1180] :760F0B56 85C0 test eax, eax :760F0B58 7413 je 760F0B6D :760F0B5A 56 push esi * Possible StringData Ref from Code Obj ->"CreateFile failed ec=%d" | :760F0B5B 685C860E76 push 760E865C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0BE6(U), :760F0C44(U) | :760F0B60 6806030000 push 00000306 :760F0B65 E8C1C3FFFF call 760ECF2B :760F0B6A 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0B3D(C), :760F0B58(C), :760F0BC3(C), :760F0BDE(C), :760F0C19(C) |:760F0C38(C) | :760F0B6D 3BF7 cmp esi, edi :760F0B6F 0F85D6000000 jne 760F0C4B :760F0B75 BE4F050000 mov esi, 0000054F :760F0B7A E9CC000000 jmp 760F0C4B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0B2B(C) | :760F0B7F 57 push edi :760F0B80 50 push eax * Reference To: KERNEL32.GetFileSize, Ord:0125h | :760F0B81 FF15DC110E76 Call dword ptr [760E11DC] :760F0B87 8B4D1C mov ecx, dword ptr [ebp+1C] :760F0B8A 81E600000040 and esi, 40000000 :760F0B90 57 push edi :760F0B91 57 push edi :760F0B92 8901 mov dword ptr [ecx], eax :760F0B94 8BC6 mov eax, esi :760F0B96 F7D8 neg eax :760F0B98 1BC0 sbb eax, eax :760F0B9A 57 push edi :760F0B9B 83E002 and eax, 00000002 :760F0B9E 40 inc eax :760F0B9F 40 inc eax :760F0BA0 50 push eax :760F0BA1 57 push edi :760F0BA2 FF33 push dword ptr [ebx] * Reference To: KERNEL32.CreateFileMappingA, Ord:0038h | :760F0BA4 FF15E0110E76 Call dword ptr [760E11E0] :760F0BAA 8B4D14 mov ecx, dword ptr [ebp+14] :760F0BAD 3BC7 cmp eax, edi :760F0BAF 8901 mov dword ptr [ecx], eax :760F0BB1 7538 jne 760F0BEB * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F0BB3 FF15A0110E76 Call dword ptr [760E11A0] :760F0BB9 8BF0 mov esi, eax :760F0BBB A184110E76 mov eax, dword ptr [760E1184] :760F0BC0 F60002 test byte ptr [eax], 02 :760F0BC3 74A8 je 760F0B6D :760F0BC5 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"MyMapFile" | :760F0BC7 6878860E76 push 760E8678 :760F0BCC 6812030000 push 00000312 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F0BD1 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F0BD6 FF1580110E76 Call dword ptr [760E1180] :760F0BDC 85C0 test eax, eax :760F0BDE 748D je 760F0B6D :760F0BE0 56 push esi * Possible StringData Ref from Code Obj ->"CreateFileMapping failed ec=%d" | :760F0BE1 683C860E76 push 760E863C :760F0BE6 E975FFFFFF jmp 760F0B60 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0BB1(C) | :760F0BEB F7DE neg esi :760F0BED 1BF6 sbb esi, esi :760F0BEF 57 push edi :760F0BF0 83E6FE and esi, FFFFFFFE :760F0BF3 57 push edi :760F0BF4 83C604 add esi, 00000004 :760F0BF7 57 push edi :760F0BF8 56 push esi :760F0BF9 50 push eax * Reference To: KERNEL32.MapViewOfFile, Ord:01F5h | :760F0BFA FF15E4110E76 Call dword ptr [760E11E4] :760F0C00 8B4D10 mov ecx, dword ptr [ebp+10] :760F0C03 3BC7 cmp eax, edi :760F0C05 8901 mov dword ptr [ecx], eax :760F0C07 7540 jne 760F0C49 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F0C09 FF15A0110E76 Call dword ptr [760E11A0] :760F0C0F 8BF0 mov esi, eax :760F0C11 A184110E76 mov eax, dword ptr [760E1184] :760F0C16 F60002 test byte ptr [eax], 02 :760F0C19 0F844EFFFFFF je 760F0B6D :760F0C1F 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"MyMapFile" | :760F0C21 6878860E76 push 760E8678 :760F0C26 682E030000 push 0000032E * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F0C2B 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F0C30 FF1580110E76 Call dword ptr [760E1180] :760F0C36 85C0 test eax, eax :760F0C38 0F842FFFFFFF je 760F0B6D :760F0C3E 56 push esi * Possible StringData Ref from Code Obj ->"MapViewOfFile failed ec=%d" | :760F0C3F 6820860E76 push 760E8620 :760F0C44 E917FFFFFF jmp 760F0B60 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0C07(C) | :760F0C49 33F6 xor esi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0B6F(C), :760F0B7A(U) | :760F0C4B 8BC6 mov eax, esi :760F0C4D 5F pop edi :760F0C4E 5E pop esi :760F0C4F 5B pop ebx :760F0C50 5D pop ebp :760F0C51 C21800 ret 0018 * Referenced by a CALL at Address: |:760F0D8C | :760F0C54 56 push esi :760F0C55 57 push edi :760F0C56 33FF xor edi, edi :760F0C58 57 push edi :760F0C59 6888E10F76 push 760FE188 :760F0C5E 68B0DA0F76 push 760FDAB0 * Reference To: KERNEL32.CopyFileA, Ord:002Bh | :760F0C63 FF1548120E76 Call dword ptr [760E1248] :760F0C69 85C0 test eax, eax :760F0C6B 7542 jne 760F0CAF * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F0C6D FF15A0110E76 Call dword ptr [760E11A0] :760F0C73 8BF0 mov esi, eax :760F0C75 A184110E76 mov eax, dword ptr [760E1184] :760F0C7A F60002 test byte ptr [eax], 02 :760F0C7D 7433 je 760F0CB2 :760F0C7F 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"MakeCopyOfWininit" | :760F0C81 68A0860E76 push 760E86A0 :760F0C86 684A030000 push 0000034A * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F0C8B 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F0C90 FF1580110E76 Call dword ptr [760E1180] :760F0C96 85C0 test eax, eax :760F0C98 7418 je 760F0CB2 :760F0C9A 56 push esi * Possible StringData Ref from Code Obj ->"Error copying wininit ec=%d" | :760F0C9B 6884860E76 push 760E8684 :760F0CA0 6806030000 push 00000306 :760F0CA5 E881C2FFFF call 760ECF2B :760F0CAA 83C40C add esp, 0000000C :760F0CAD EB03 jmp 760F0CB2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0C6B(C) | :760F0CAF 6A01 push 00000001 :760F0CB1 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0C7D(C), :760F0C98(C), :760F0CAD(U) | :760F0CB2 8BC7 mov eax, edi :760F0CB4 5F pop edi :760F0CB5 5E pop esi :760F0CB6 C3 ret * Referenced by a CALL at Addresses: |:760F0F6D , :760F14B7 | :760F0CB7 55 push ebp :760F0CB8 8BEC mov ebp, esp :760F0CBA 56 push esi :760F0CBB 8B750C mov esi, dword ptr [ebp+0C] :760F0CBE 57 push edi :760F0CBF 8B06 mov eax, dword ptr [esi] :760F0CC1 85C0 test eax, eax :760F0CC3 740A je 760F0CCF :760F0CC5 50 push eax * Reference To: KERNEL32.UnmapViewOfFile, Ord:02DEh | :760F0CC6 FF1590110E76 Call dword ptr [760E1190] :760F0CCC 832600 and dword ptr [esi], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0CC3(C) | :760F0CCF 8B7510 mov esi, dword ptr [ebp+10] * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760F0CD2 8B3D34120E76 mov edi, dword ptr [760E1234] :760F0CD8 8B06 mov eax, dword ptr [esi] :760F0CDA 85C0 test eax, eax :760F0CDC 7406 je 760F0CE4 :760F0CDE 50 push eax :760F0CDF FFD7 call edi :760F0CE1 832600 and dword ptr [esi], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0CDC(C) | :760F0CE4 8B7508 mov esi, dword ptr [ebp+08] :760F0CE7 8B06 mov eax, dword ptr [esi] :760F0CE9 83F8FF cmp eax, FFFFFFFF :760F0CEC 7423 je 760F0D11 :760F0CEE 837D1801 cmp dword ptr [ebp+18], 00000001 :760F0CF2 7516 jne 760F0D0A :760F0CF4 6A00 push 00000000 :760F0CF6 6A00 push 00000000 :760F0CF8 FF7514 push [ebp+14] :760F0CFB 50 push eax * Reference To: KERNEL32.SetFilePointer, Ord:0295h | :760F0CFC FF15D4110E76 Call dword ptr [760E11D4] :760F0D02 FF36 push dword ptr [esi] * Reference To: KERNEL32.SetEndOfFile, Ord:028Ch | :760F0D04 FF15D8110E76 Call dword ptr [760E11D8] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0CF2(C) | :760F0D0A FF36 push dword ptr [esi] :760F0D0C FFD7 call edi :760F0D0E 830EFF or dword ptr [esi], FFFFFFFF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0CEC(C) | :760F0D11 5F pop edi :760F0D12 5E pop esi :760F0D13 5D pop ebp :760F0D14 C21400 ret 0014 * Referenced by a CALL at Addresses: |:760F0E4E , :760F1056 | :760F0D17 55 push ebp :760F0D18 8BEC mov ebp, esp :760F0D1A 81EC00040000 sub esp, 00000400 :760F0D20 56 push esi :760F0D21 57 push edi :760F0D22 33FF xor edi, edi :760F0D24 BE00040000 mov esi, 00000400 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0D4A(C), :760F0D5E(C) | :760F0D29 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760F0D2F 56 push esi :760F0D30 50 push eax :760F0D31 FF7514 push [ebp+14] :760F0D34 FF7510 push [ebp+10] :760F0D37 FF7508 push [ebp+08] :760F0D3A E8A4F6FFFF call 760F03E3 :760F0D3F 85C0 test eax, eax :760F0D41 7420 je 760F0D63 :760F0D43 80BD00FCFFFF00 cmp byte ptr [ebp+FFFFFC00], 00 :760F0D4A 74DD je 760F0D29 :760F0D4C 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760F0D52 50 push eax :760F0D53 FF750C push [ebp+0C] * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760F0D56 FF1558120E76 Call dword ptr [760E1258] :760F0D5C 85C0 test eax, eax :760F0D5E 75C9 jne 760F0D29 :760F0D60 6A01 push 00000001 :760F0D62 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0D41(C) | :760F0D63 8BC7 mov eax, edi :760F0D65 5F pop edi :760F0D66 5E pop esi :760F0D67 C9 leave :760F0D68 C21000 ret 0010 * Referenced by a CALL at Address: |:760F15A3 | :760F0D6B 55 push ebp :760F0D6C 8BEC mov ebp, esp :760F0D6E 83EC24 sub esp, 00000024 :760F0D71 834DE0FF or dword ptr [ebp-20], FFFFFFFF :760F0D75 53 push ebx :760F0D76 56 push esi :760F0D77 57 push edi :760F0D78 33FF xor edi, edi :760F0D7A 897DDC mov dword ptr [ebp-24], edi :760F0D7D 897DE8 mov dword ptr [ebp-18], edi :760F0D80 897DF8 mov dword ptr [ebp-08], edi :760F0D83 897DE4 mov dword ptr [ebp-1C], edi :760F0D86 897DF4 mov dword ptr [ebp-0C], edi :760F0D89 897DF0 mov dword ptr [ebp-10], edi :760F0D8C E8C3FEFFFF call 760F0C54 :760F0D91 85C0 test eax, eax :760F0D93 7543 jne 760F0DD8 :760F0D95 A184110E76 mov eax, dword ptr [760E1184] :760F0D9A F60002 test byte ptr [eax], 02 :760F0D9D 0F84BC010000 je 760F0F5F :760F0DA3 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"ProcessWininit" | :760F0DA5 6804870E76 push 760E8704 :760F0DAA 68B2030000 push 000003B2 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F0DAF 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F0DB4 FF1580110E76 Call dword ptr [760E1180] :760F0DBA 85C0 test eax, eax :760F0DBC 0F849D010000 je 760F0F5F * Possible StringData Ref from Code Obj ->"Cannot make copy of wininit" | :760F0DC2 68E4860E76 push 760E86E4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0E2D(U) | :760F0DC7 6806030000 push 00000306 :760F0DCC E85AC1FFFF call 760ECF2B :760F0DD1 59 pop ecx :760F0DD2 59 pop ecx :760F0DD3 E987010000 jmp 760F0F5F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0D93(C) | :760F0DD8 8D45F4 lea eax, dword ptr [ebp-0C] :760F0DDB 50 push eax :760F0DDC 8D45E4 lea eax, dword ptr [ebp-1C] :760F0DDF 6800000080 push 80000000 :760F0DE4 50 push eax :760F0DE5 8D45F8 lea eax, dword ptr [ebp-08] :760F0DE8 50 push eax :760F0DE9 8D45E0 lea eax, dword ptr [ebp-20] :760F0DEC 50 push eax :760F0DED 6888E10F76 push 760FE188 :760F0DF2 E800FDFFFF call 760F0AF7 :760F0DF7 85C0 test eax, eax :760F0DF9 7434 je 760F0E2F :760F0DFB A184110E76 mov eax, dword ptr [760E1184] :760F0E00 F60002 test byte ptr [eax], 02 :760F0E03 0F8456010000 je 760F0F5F :760F0E09 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"ProcessWininit" | :760F0E0B 6804870E76 push 760E8704 :760F0E10 68BE030000 push 000003BE * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F0E15 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F0E1A FF1580110E76 Call dword ptr [760E1180] :760F0E20 85C0 test eax, eax :760F0E22 0F8437010000 je 760F0F5F * Possible StringData Ref from Code Obj ->"Cannot open wininit copy" | :760F0E28 68C8860E76 push 760E86C8 :760F0E2D EB98 jmp 760F0DC7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0DF9(C) | :760F0E2F 6A01 push 00000001 :760F0E31 897DEC mov dword ptr [ebp-14], edi * Possible StringData Ref from Data Obj ->"$" | :760F0E34 C745FCBCDF0F76 mov [ebp-04], 760FDFBC :760F0E3B 5B pop ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0F59(C) | :760F0E3C FF75F4 push [ebp-0C] :760F0E3F 8D45F0 lea eax, dword ptr [ebp-10] :760F0E42 897DF0 mov dword ptr [ebp-10], edi :760F0E45 50 push eax :760F0E46 8B45FC mov eax, dword ptr [ebp-04] :760F0E49 FF30 push dword ptr [eax] :760F0E4B FF75F8 push [ebp-08] :760F0E4E E8C4FEFFFF call 760F0D17 :760F0E53 85C0 test eax, eax :760F0E55 7549 jne 760F0EA0 :760F0E57 A184110E76 mov eax, dword ptr [760E1184] :760F0E5C F60004 test byte ptr [eax], 04 :760F0E5F 0F84E6000000 je 760F0F4B :760F0E65 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"ProcessWininit" | :760F0E67 6804870E76 push 760E8704 :760F0E6C 68CC030000 push 000003CC * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F0E71 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F0E76 FF1580110E76 Call dword ptr [760E1180] :760F0E7C 85C0 test eax, eax :760F0E7E 0F84C7000000 je 760F0F4B :760F0E84 8B45FC mov eax, dword ptr [ebp-04] :760F0E87 FF30 push dword ptr [eax] * Possible StringData Ref from Code Obj ->"no such section %s" | :760F0E89 68B4860E76 push 760E86B4 :760F0E8E 6806030000 push 00000306 :760F0E93 E893C0FFFF call 760ECF2B :760F0E98 83C40C add esp, 0000000C :760F0E9B E9AB000000 jmp 760F0F4B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0E55(C) | :760F0EA0 6A0C push 0000000C * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760F0EA2 E8D819FFFF Call 760E287F :760F0EA7 3BC7 cmp eax, edi :760F0EA9 59 pop ecx :760F0EAA 740B je 760F0EB7 :760F0EAC 8BC8 mov ecx, eax :760F0EAE E8DBF1FFFF call 760F008E :760F0EB3 8BF0 mov esi, eax :760F0EB5 EB02 jmp 760F0EB9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0EAA(C) | :760F0EB7 33F6 xor esi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0EB5(U) | :760F0EB9 3BF7 cmp esi, edi :760F0EBB 0F849E000000 je 760F0F5F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0F37(U) | :760F0EC1 FF75EC push [ebp-14] :760F0EC4 8D45F0 lea eax, dword ptr [ebp-10] :760F0EC7 56 push esi :760F0EC8 FF75F4 push [ebp-0C] :760F0ECB 50 push eax :760F0ECC FF75F8 push [ebp-08] :760F0ECF E8A3F5FFFF call 760F0477 :760F0ED4 3BC3 cmp eax, ebx :760F0ED6 7561 jne 760F0F39 :760F0ED8 56 push esi :760F0ED9 E812F6FFFF call 760F04F0 :760F0EDE 3BC3 cmp eax, ebx :760F0EE0 741B je 760F0EFD :760F0EE2 8D45E8 lea eax, dword ptr [ebp-18] :760F0EE5 50 push eax :760F0EE6 56 push esi :760F0EE7 E80EF9FFFF call 760F07FA :760F0EEC 3BC3 cmp eax, ebx :760F0EEE 7521 jne 760F0F11 :760F0EF0 397DE8 cmp dword ptr [ebp-18], edi :760F0EF3 7508 jne 760F0EFD :760F0EF5 56 push esi :760F0EF6 E82CF9FFFF call 760F0827 :760F0EFB EB1D jmp 760F0F1A * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0EE0(C), :760F0EF3(C) | :760F0EFD 3BF7 cmp esi, edi :760F0EFF 7419 je 760F0F1A :760F0F01 8BCE mov ecx, esi :760F0F03 E894F1FFFF call 760F009C :760F0F08 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F0F09 E83D0AFFFF Call 760E194B :760F0F0E 59 pop ecx :760F0F0F EB09 jmp 760F0F1A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0EEE(C) | :760F0F11 56 push esi :760F0F12 895DDC mov dword ptr [ebp-24], ebx :760F0F15 E875FAFFFF call 760F098F * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0EFB(U), :760F0EFF(C), :760F0F0F(U) | :760F0F1A 6A0C push 0000000C * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760F0F1C E85E19FFFF Call 760E287F :760F0F21 3BC7 cmp eax, edi :760F0F23 59 pop ecx :760F0F24 740B je 760F0F31 :760F0F26 8BC8 mov ecx, eax :760F0F28 E861F1FFFF call 760F008E :760F0F2D 8BF0 mov esi, eax :760F0F2F EB02 jmp 760F0F33 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0F24(C) | :760F0F31 33F6 xor esi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0F2F(U) | :760F0F33 3BF7 cmp esi, edi :760F0F35 7414 je 760F0F4B :760F0F37 EB88 jmp 760F0EC1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0ED6(C) | :760F0F39 3BF7 cmp esi, edi :760F0F3B 740E je 760F0F4B :760F0F3D 8BCE mov ecx, esi :760F0F3F E858F1FFFF call 760F009C :760F0F44 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F0F45 E8010AFFFF Call 760E194B :760F0F4A 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0E5F(C), :760F0E7E(C), :760F0E9B(U), :760F0F35(C), :760F0F3B(C) | :760F0F4B 8345FC04 add dword ptr [ebp-04], 00000004 :760F0F4F FF45EC inc [ebp-14] :760F0F52 817DFCC0DF0F76 cmp dword ptr [ebp-04], 760FDFC0 :760F0F59 0F8EDDFEFFFF jle 760F0E3C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0D9D(C), :760F0DBC(C), :760F0DD3(U), :760F0E03(C), :760F0E22(C) |:760F0EBB(C) | :760F0F5F 57 push edi :760F0F60 8D45E4 lea eax, dword ptr [ebp-1C] :760F0F63 57 push edi :760F0F64 50 push eax :760F0F65 8D45F8 lea eax, dword ptr [ebp-08] :760F0F68 50 push eax :760F0F69 8D45E0 lea eax, dword ptr [ebp-20] :760F0F6C 50 push eax :760F0F6D E845FDFFFF call 760F0CB7 :760F0F72 BE88E10F76 mov esi, 760FE188 :760F0F77 6880000000 push 00000080 :760F0F7C 56 push esi * Reference To: KERNEL32.SetFileAttributesA, Ord:0293h | :760F0F7D FF156C120E76 Call dword ptr [760E126C] :760F0F83 56 push esi * Reference To: KERNEL32.DeleteFileA, Ord:005Ch | :760F0F84 FF1570120E76 Call dword ptr [760E1270] :760F0F8A 8B45DC mov eax, dword ptr [ebp-24] :760F0F8D 5F pop edi :760F0F8E 5E pop esi :760F0F8F 5B pop ebx :760F0F90 C9 leave :760F0F91 C3 ret * Referenced by a CALL at Address: |:760F119E | :760F0F92 8B442404 mov eax, dword ptr [esp+04] :760F0F96 53 push ebx :760F0F97 8B5C240C mov ebx, dword ptr [esp+0C] :760F0F9B 56 push esi :760F0F9C 57 push edi :760F0F9D 8D73FF lea esi, dword ptr [ebx-01] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0FAE(U) | :760F0FA0 8A0C06 mov cl, byte ptr [esi+eax] :760F0FA3 80F90D cmp cl, 0D :760F0FA6 7405 je 760F0FAD :760F0FA8 80F90A cmp cl, 0A :760F0FAB 7503 jne 760F0FB0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F0FA6(C) | :760F0FAD 4E dec esi :760F0FAE EBF0 jmp 760F0FA0 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0FAB(C), :760F0FBE(U) | :760F0FB0 8A0C06 mov cl, byte ptr [esi+eax] :760F0FB3 80F90D cmp cl, 0D :760F0FB6 7408 je 760F0FC0 :760F0FB8 80F90A cmp cl, 0A :760F0FBB 7403 je 760F0FC0 :760F0FBD 4E dec esi :760F0FBE EBF0 jmp 760F0FB0 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F0FB6(C), :760F0FBB(C) | :760F0FC0 8B7C2418 mov edi, dword ptr [esp+18] :760F0FC4 46 inc esi :760F0FC5 8B0F mov ecx, dword ptr [edi] :760F0FC7 2BCB sub ecx, ebx :760F0FC9 51 push ecx :760F0FCA 8D0C18 lea ecx, dword ptr [eax+ebx] :760F0FCD 03C6 add eax, esi :760F0FCF 51 push ecx :760F0FD0 50 push eax * Reference To: MSVCRT.memmove, Ord:0295h | :760F0FD1 FF151C100E76 Call dword ptr [760E101C] :760F0FD7 83C40C add esp, 0000000C :760F0FDA 2BF3 sub esi, ebx :760F0FDC 0137 add dword ptr [edi], esi :760F0FDE 6A01 push 00000001 :760F0FE0 58 pop eax :760F0FE1 5F pop edi :760F0FE2 5E pop esi :760F0FE3 5B pop ebx :760F0FE4 C20C00 ret 000C * Referenced by a CALL at Address: |:760F1353 | :760F0FE7 51 push ecx :760F0FE8 51 push ecx :760F0FE9 A184110E76 mov eax, dword ptr [760E1184] :760F0FEE 53 push ebx :760F0FEF 55 push ebp * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F0FF0 8B2D80110E76 mov ebp, dword ptr [760E1180] :760F0FF6 56 push esi :760F0FF7 8B74241C mov esi, dword ptr [esp+1C] :760F0FFB 57 push edi :760F0FFC 33FF xor edi, edi :760F0FFE 897C2410 mov dword ptr [esp+10], edi :760F1002 897C2414 mov dword ptr [esp+14], edi :760F1006 F60004 test byte ptr [eax], 04 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F1009 BB90DF0F76 mov ebx, 760FDF90 :760F100E 742D je 760F103D :760F1010 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"DeleteEntryFromWininit" | :760F1012 6854870E76 push 760E8754 :760F1017 6864040000 push 00000464 :760F101C 53 push ebx :760F101D FFD5 call ebp :760F101F 85C0 test eax, eax :760F1021 741A je 760F103D :760F1023 FF7608 push [esi+08] :760F1026 FF7604 push [esi+04] :760F1029 FF36 push dword ptr [esi] * Possible StringData Ref from Code Obj ->"Deleting entry %s=%s section %d" | :760F102B 6834870E76 push 760E8734 :760F1030 6806030000 push 00000306 :760F1035 E8F1BEFFFF call 760ECF2B :760F103A 83C414 add esp, 00000014 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F100E(C), :760F1021(C) | :760F103D 8B442424 mov eax, dword ptr [esp+24] :760F1041 FF30 push dword ptr [eax] :760F1043 8D442414 lea eax, dword ptr [esp+14] :760F1047 50 push eax :760F1048 8B4608 mov eax, dword ptr [esi+08] :760F104B FF3485BCDF0F76 push dword ptr [4*eax+760FDFBC] :760F1052 FF742428 push [esp+28] :760F1056 E8BCFCFFFF call 760F0D17 :760F105B 85C0 test eax, eax :760F105D 7546 jne 760F10A5 :760F105F A184110E76 mov eax, dword ptr [760E1184] :760F1064 F60004 test byte ptr [eax], 04 :760F1067 0F8480010000 je 760F11ED :760F106D 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"DeleteEntryFromWininit" | :760F106F 6854870E76 push 760E8754 :760F1074 686F040000 push 0000046F :760F1079 53 push ebx :760F107A FFD5 call ebp :760F107C 85C0 test eax, eax :760F107E 0F8469010000 je 760F11ED :760F1084 8B4608 mov eax, dword ptr [esi+08] :760F1087 FF3485BCDF0F76 push dword ptr [4*eax+760FDFBC] * Possible StringData Ref from Code Obj ->"no such section %s" | :760F108E 68B4860E76 push 760E86B4 :760F1093 6806030000 push 00000306 :760F1098 E88EBEFFFF call 760ECF2B :760F109D 83C40C add esp, 0000000C :760F10A0 E948010000 jmp 760F11ED * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F105D(C) | :760F10A5 6A0C push 0000000C * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760F10A7 E8D317FFFF Call 760E287F :760F10AC 3BC7 cmp eax, edi :760F10AE 59 pop ecx :760F10AF 7409 je 760F10BA :760F10B1 8BC8 mov ecx, eax :760F10B3 E8D6EFFFFF call 760F008E :760F10B8 8BF8 mov edi, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F10AF(C) | :760F10BA 85FF test edi, edi :760F10BC 753A jne 760F10F8 :760F10BE A184110E76 mov eax, dword ptr [760E1184] :760F10C3 F60004 test byte ptr [eax], 04 :760F10C6 0F8421010000 je 760F11ED :760F10CC 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"DeleteEntryFromWininit" | :760F10CE 6854870E76 push 760E8754 :760F10D3 6877040000 push 00000477 :760F10D8 53 push ebx :760F10D9 FFD5 call ebp :760F10DB 85C0 test eax, eax :760F10DD 0F840A010000 je 760F11ED * Possible StringData Ref from Code Obj ->"new failed" | :760F10E3 6828870E76 push 760E8728 :760F10E8 6806030000 push 00000306 :760F10ED E839BEFFFF call 760ECF2B :760F10F2 59 pop ecx :760F10F3 E9F4000000 jmp 760F11EC * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F10BC(C), :760F1162(U) | :760F10F8 FF7608 push [esi+08] :760F10FB 8B442428 mov eax, dword ptr [esp+28] :760F10FF 57 push edi :760F1100 FF30 push dword ptr [eax] :760F1102 8D44241C lea eax, dword ptr [esp+1C] :760F1106 50 push eax :760F1107 FF74242C push [esp+2C] :760F110B E867F3FFFF call 760F0477 :760F1110 83F801 cmp eax, 00000001 :760F1113 0F85C2000000 jne 760F11DB :760F1119 FF7604 push [esi+04] :760F111C FF7704 push [edi+04] * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760F111F FF1558120E76 Call dword ptr [760E1258] :760F1125 85C0 test eax, eax :760F1127 750E jne 760F1137 :760F1129 FF36 push dword ptr [esi] :760F112B FF37 push dword ptr [edi] * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760F112D FF1558120E76 Call dword ptr [760E1258] :760F1133 85C0 test eax, eax :760F1135 742D je 760F1164 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1127(C) | :760F1137 8BCF mov ecx, edi :760F1139 E85EEFFFFF call 760F009C :760F113E 57 push edi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F113F E80708FFFF Call 760E194B :760F1144 6A0C push 0000000C * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760F1146 E83417FFFF Call 760E287F :760F114B 59 pop ecx :760F114C 85C0 test eax, eax :760F114E 59 pop ecx :760F114F 740B je 760F115C :760F1151 8BC8 mov ecx, eax :760F1153 E836EFFFFF call 760F008E :760F1158 8BF8 mov edi, eax :760F115A EB02 jmp 760F115E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F114F(C) | :760F115C 33FF xor edi, edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F115A(U) | :760F115E 85FF test edi, edi :760F1160 744B je 760F11AD :760F1162 EB94 jmp 760F10F8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1135(C) | :760F1164 A184110E76 mov eax, dword ptr [760E1184] :760F1169 F60004 test byte ptr [eax], 04 :760F116C 7424 je 760F1192 :760F116E 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"DeleteEntryFromWininit" | :760F1170 6854870E76 push 760E8754 :760F1175 6886040000 push 00000486 :760F117A 53 push ebx :760F117B FFD5 call ebp :760F117D 85C0 test eax, eax :760F117F 7411 je 760F1192 * Possible StringData Ref from Code Obj ->"Found wininit entry" | :760F1181 6814870E76 push 760E8714 :760F1186 6806030000 push 00000306 :760F118B E89BBDFFFF call 760ECF2B :760F1190 59 pop ecx :760F1191 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F116C(C), :760F117F(C) | :760F1192 FF742424 push [esp+24] :760F1196 FF742414 push [esp+14] :760F119A FF742424 push [esp+24] :760F119E E8EFFDFFFF call 760F0F92 :760F11A3 C744241401000000 mov [esp+14], 00000001 :760F11AB EB2E jmp 760F11DB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1160(C) | :760F11AD A184110E76 mov eax, dword ptr [760E1184] :760F11B2 F60004 test byte ptr [eax], 04 :760F11B5 7436 je 760F11ED :760F11B7 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"DeleteEntryFromWininit" | :760F11B9 6854870E76 push 760E8754 :760F11BE 6896040000 push 00000496 :760F11C3 53 push ebx :760F11C4 FFD5 call ebp :760F11C6 85C0 test eax, eax :760F11C8 7423 je 760F11ED * Possible StringData Ref from Code Obj ->"new failed" | :760F11CA 6828870E76 push 760E8728 :760F11CF 6806030000 push 00000306 :760F11D4 E852BDFFFF call 760ECF2B :760F11D9 59 pop ecx :760F11DA 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1113(C), :760F11AB(U) | :760F11DB 85FF test edi, edi :760F11DD 740E je 760F11ED :760F11DF 8BCF mov ecx, edi :760F11E1 E8B6EEFFFF call 760F009C :760F11E6 57 push edi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F11E7 E85F07FFFF Call 760E194B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F10F3(U) | :760F11EC 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1067(C), :760F107E(C), :760F10A0(U), :760F10C6(C), :760F10DD(C) |:760F11B5(C), :760F11C8(C), :760F11DD(C) | :760F11ED 8B442414 mov eax, dword ptr [esp+14] :760F11F1 5F pop edi :760F11F2 5E pop esi :760F11F3 5D pop ebp :760F11F4 5B pop ebx :760F11F5 59 pop ecx :760F11F6 59 pop ecx :760F11F7 C20C00 ret 000C * Referenced by a CALL at Address: |:760F15B8 | :760F11FA 81ECFC030000 sub esp, 000003FC :760F1200 834C240CFF or dword ptr [esp+0C], FFFFFFFF :760F1205 56 push esi :760F1206 57 push edi :760F1207 33FF xor edi, edi :760F1209 393D94E50F76 cmp dword ptr [760FE594], edi :760F120F BE4F050000 mov esi, 0000054F :760F1214 897C240C mov dword ptr [esp+0C], edi :760F1218 897C2418 mov dword ptr [esp+18], edi :760F121C 897C2408 mov dword ptr [esp+08], edi :760F1220 7543 jne 760F1265 :760F1222 A184110E76 mov eax, dword ptr [760E1184] :760F1227 F60002 test byte ptr [eax], 02 :760F122A 0F848E020000 je 760F14BE :760F1230 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"WriteWininitChanges" | :760F1232 6848880E76 push 760E8848 :760F1237 68B9040000 push 000004B9 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F123C 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1241 FF1580110E76 Call dword ptr [760E1180] :760F1247 85C0 test eax, eax :760F1249 0F846F020000 je 760F14BE * Possible StringData Ref from Code Obj ->"No entries to delete" | :760F124F 6830880E76 push 760E8830 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F12CD(U) | :760F1254 6806030000 push 00000306 :760F1259 E8CDBCFFFF call 760ECF2B :760F125E 59 pop ecx :760F125F 59 pop ecx :760F1260 E959020000 jmp 760F14BE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1220(C) | :760F1265 BEB0DA0F76 mov esi, 760FDAB0 :760F126A 6880000000 push 00000080 :760F126F 56 push esi * Reference To: KERNEL32.SetFileAttributesA, Ord:0293h | :760F1270 FF156C120E76 Call dword ptr [760E126C] :760F1276 8D442408 lea eax, dword ptr [esp+08] :760F127A 50 push eax :760F127B 8D44241C lea eax, dword ptr [esp+1C] :760F127F 68000000C0 push C0000000 :760F1284 50 push eax :760F1285 8D442418 lea eax, dword ptr [esp+18] :760F1289 50 push eax :760F128A 8D442424 lea eax, dword ptr [esp+24] :760F128E 50 push eax :760F128F 56 push esi :760F1290 E862F8FFFF call 760F0AF7 :760F1295 8BF0 mov esi, eax :760F1297 3BF7 cmp esi, edi :760F1299 7434 je 760F12CF :760F129B A184110E76 mov eax, dword ptr [760E1184] :760F12A0 F60002 test byte ptr [eax], 02 :760F12A3 0F8415020000 je 760F14BE :760F12A9 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"WriteWininitChanges" | :760F12AB 6848880E76 push 760E8848 :760F12B0 68CC040000 push 000004CC * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F12B5 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F12BA FF1580110E76 Call dword ptr [760E1180] :760F12C0 85C0 test eax, eax :760F12C2 0F84F6010000 je 760F14BE * Possible StringData Ref from Code Obj ->"Cannot open wininit for writing" | :760F12C8 6810880E76 push 760E8810 :760F12CD EB85 jmp 760F1254 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1299(C) | :760F12CF A194E50F76 mov eax, dword ptr [760FE594] :760F12D4 33F6 xor esi, esi :760F12D6 89742410 mov dword ptr [esp+10], esi :760F12DA 397808 cmp dword ptr [eax+08], edi :760F12DD 0F86A1010000 jbe 760F1484 :760F12E3 53 push ebx :760F12E4 55 push ebp * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F12E5 8B2D80110E76 mov ebp, dword ptr [760E1180] * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F12EB BB90DF0F76 mov ebx, 760FDF90 :760F12F0 EB02 jmp 760F12F4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F147A(C) | :760F12F2 33FF xor edi, edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F12F0(U) | * Reference To: ATRACE.__dwEnabledTraces, Ord:0008h | :760F12F4 8B0D84110E76 mov ecx, dword ptr [760E1184] :760F12FA F60104 test byte ptr [ecx], 04 :760F12FD 7443 je 760F1342 :760F12FF 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"WriteWininitChanges" | :760F1301 6848880E76 push 760E8848 :760F1306 68D3040000 push 000004D3 :760F130B 53 push ebx :760F130C FFD5 call ebp :760F130E 85C0 test eax, eax :760F1310 A194E50F76 mov eax, dword ptr [760FE594] :760F1315 742B je 760F1342 :760F1317 8B00 mov eax, dword ptr [eax] :760F1319 8B04B0 mov eax, dword ptr [eax+4*esi] :760F131C 8B4808 mov ecx, dword ptr [eax+08] :760F131F FF348DBCDF0F76 push dword ptr [4*ecx+760FDFBC] :760F1326 FF7004 push [eax+04] :760F1329 FF30 push dword ptr [eax] * Possible StringData Ref from Code Obj ->"Trying to delete entry %s=%s in " ->"%s section" | :760F132B 68E4870E76 push 760E87E4 :760F1330 6806030000 push 00000306 :760F1335 E8F1BBFFFF call 760ECF2B :760F133A A194E50F76 mov eax, dword ptr [760FE594] :760F133F 83C414 add esp, 00000014 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F12FD(C), :760F1315(C) | :760F1342 8B00 mov eax, dword ptr [eax] :760F1344 8D4C2410 lea ecx, dword ptr [esp+10] :760F1348 C1E602 shl esi, 02 :760F134B 51 push ecx :760F134C FF3406 push dword ptr [esi+eax] :760F134F FF74241C push [esp+1C] :760F1353 E88FFCFFFF call 760F0FE7 :760F1358 85C0 test eax, eax :760F135A 0F84B7000000 je 760F1417 :760F1360 A194E50F76 mov eax, dword ptr [760FE594] :760F1365 83C9FF or ecx, FFFFFFFF :760F1368 8B00 mov eax, dword ptr [eax] :760F136A 8B0406 mov eax, dword ptr [esi+eax] :760F136D 8B10 mov edx, dword ptr [eax] :760F136F 33C0 xor eax, eax :760F1371 8BFA mov edi, edx :760F1373 F2 repnz :760F1374 AE scasb :760F1375 F7D1 not ecx :760F1377 49 dec ecx :760F1378 51 push ecx :760F1379 52 push edx :760F137A E87519FFFF call 760E2CF4 :760F137F 8BF8 mov edi, eax :760F1381 85FF test edi, edi :760F1383 7530 jne 760F13B5 :760F1385 A184110E76 mov eax, dword ptr [760E1184] :760F138A F60002 test byte ptr [eax], 02 :760F138D 7449 je 760F13D8 :760F138F 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"WriteWininitChanges" | :760F1391 6848880E76 push 760E8848 :760F1396 68E4040000 push 000004E4 :760F139B 53 push ebx :760F139C FFD5 call ebp :760F139E 85C0 test eax, eax :760F13A0 7436 je 760F13D8 * Possible StringData Ref from Code Obj ->"Error getting to the short path " ->"name " | :760F13A2 6860750E76 push 760E7560 :760F13A7 6806030000 push 00000306 :760F13AC E87ABBFFFF call 760ECF2B :760F13B1 59 pop ecx :760F13B2 59 pop ecx :760F13B3 EB23 jmp 760F13D8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1383(C) | * Possible StringData Ref from Code Obj ->"NUL" | :760F13B5 68E0870E76 push 760E87E0 :760F13BA 57 push edi * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760F13BB FF1558120E76 Call dword ptr [760E1258] :760F13C1 85C0 test eax, eax :760F13C3 7413 je 760F13D8 :760F13C5 A194E50F76 mov eax, dword ptr [760FE594] :760F13CA 57 push edi :760F13CB 8B00 mov eax, dword ptr [eax] :760F13CD 8B0406 mov eax, dword ptr [esi+eax] :760F13D0 FF7004 push [eax+04] :760F13D3 E8BDCAFFFF call 760EDE95 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F138D(C), :760F13A0(C), :760F13B3(U), :760F13C3(C) | :760F13D8 A194E50F76 mov eax, dword ptr [760FE594] :760F13DD 8B00 mov eax, dword ptr [eax] :760F13DF FF3406 push dword ptr [esi+eax] :760F13E2 E89DF1FFFF call 760F0584 :760F13E7 A184110E76 mov eax, dword ptr [760E1184] :760F13EC F60004 test byte ptr [eax], 04 :760F13EF 7478 je 760F1469 :760F13F1 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"WriteWininitChanges" | :760F13F3 6848880E76 push 760E8848 :760F13F8 68EC040000 push 000004EC :760F13FD 53 push ebx :760F13FE FFD5 call ebp :760F1400 85C0 test eax, eax :760F1402 7465 je 760F1469 * Possible StringData Ref from Code Obj ->"Deleted entry" | :760F1404 68D0870E76 push 760E87D0 :760F1409 6806030000 push 00000306 :760F140E E818BBFFFF call 760ECF2B :760F1413 59 pop ecx :760F1414 59 pop ecx :760F1415 EB52 jmp 760F1469 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F135A(C) | :760F1417 A184110E76 mov eax, dword ptr [760E1184] :760F141C F60004 test byte ptr [eax], 04 :760F141F 7424 je 760F1445 :760F1421 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"WriteWininitChanges" | :760F1423 6848880E76 push 760E8848 :760F1428 68F0040000 push 000004F0 :760F142D 53 push ebx :760F142E FFD5 call ebp :760F1430 85C0 test eax, eax :760F1432 7411 je 760F1445 * Possible StringData Ref from Code Obj ->"Could not delete entry" | :760F1434 68B8870E76 push 760E87B8 :760F1439 6806030000 push 00000306 :760F143E E8E8BAFFFF call 760ECF2B :760F1443 59 pop ecx :760F1444 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F141F(C), :760F1432(C) | :760F1445 8D442424 lea eax, dword ptr [esp+24] * Possible StringData Ref from Code Obj ->"SFP cannot restore file %s back. " ->"Could not remove entry from wininit.ini" | :760F1449 686C870E76 push 760E876C :760F144E 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760F144F FF1530100E76 Call dword ptr [760E1030] :760F1455 59 pop ecx :760F1456 8D442428 lea eax, dword ptr [esp+28] :760F145A 59 pop ecx :760F145B 57 push edi :760F145C 50 push eax :760F145D 6A01 push 00000001 :760F145F B918D30F76 mov ecx, 760FD318 :760F1464 E8470FFFFF call 760E23B0 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F13EF(C), :760F1402(C), :760F1415(U) | :760F1469 8B742418 mov esi, dword ptr [esp+18] :760F146D A194E50F76 mov eax, dword ptr [760FE594] :760F1472 46 inc esi :760F1473 3B7008 cmp esi, dword ptr [eax+08] :760F1476 89742418 mov dword ptr [esp+18], esi :760F147A 0F8272FEFFFF jb 760F12F2 :760F1480 5D pop ebp :760F1481 33FF xor edi, edi :760F1483 5B pop ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F12DD(C) | :760F1484 3BC7 cmp eax, edi :760F1486 741A je 760F14A2 :760F1488 8BF0 mov esi, eax :760F148A 3BF7 cmp esi, edi :760F148C 740E je 760F149C :760F148E 8BCE mov ecx, esi :760F1490 E84DECFFFF call 760F00E2 :760F1495 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F1496 E8B004FFFF Call 760E194B :760F149B 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F148C(C) | :760F149C 893D94E50F76 mov dword ptr [760FE594], edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1486(C) | :760F14A2 6A01 push 00000001 :760F14A4 8D44241C lea eax, dword ptr [esp+1C] :760F14A8 FF74240C push [esp+0C] :760F14AC 50 push eax :760F14AD 8D442418 lea eax, dword ptr [esp+18] :760F14B1 50 push eax :760F14B2 8D442424 lea eax, dword ptr [esp+24] :760F14B6 50 push eax :760F14B7 E8FBF7FFFF call 760F0CB7 :760F14BC 33F6 xor esi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F122A(C), :760F1249(C), :760F1260(U), :760F12A3(C), :760F12C2(C) | :760F14BE 8BC6 mov eax, esi :760F14C0 5F pop edi :760F14C1 5E pop esi :760F14C2 81C4FC030000 add esp, 000003FC :760F14C8 C3 ret :760F14C9 83EC18 sub esp, 00000018 :760F14CC 6A01 push 00000001 :760F14CE 8364240400 and dword ptr [esp+04], 00000000 :760F14D3 58 pop eax :760F14D4 89442408 mov dword ptr [esp+08], eax :760F14D8 89442404 mov dword ptr [esp+04], eax :760F14DC A18CE50F76 mov eax, dword ptr [760FE58C] :760F14E1 89442410 mov dword ptr [esp+10], eax :760F14E5 A184E10F76 mov eax, dword ptr [760FE184] :760F14EA 85C0 test eax, eax :760F14EC 740C je 760F14FA :760F14EE 89442414 mov dword ptr [esp+14], eax :760F14F2 C744240802000000 mov [esp+08], 00000002 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F14EC(C) | :760F14FA 53 push ebx :760F14FB 55 push ebp :760F14FC 56 push esi * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F14FD 8B3580110E76 mov esi, dword ptr [760E1180] :760F1503 57 push edi :760F1504 BB60EA0000 mov ebx, 0000EA60 * Possible StringData Ref from Code Obj ->"WininitThread" | :760F1509 BDBC880E76 mov ebp, 760E88BC * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F150E BF90DF0F76 mov edi, 760FDF90 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1546(U), :760F15E5(U), :760F1621(U) | :760F1513 53 push ebx :760F1514 8D442424 lea eax, dword ptr [esp+24] :760F1518 6A00 push 00000000 :760F151A 50 push eax :760F151B FF742424 push [esp+24] * Reference To: KERNEL32.WaitForMultipleObjects, Ord:02FBh | :760F151F FF15D0110E76 Call dword ptr [760E11D0] :760F1525 85C0 test eax, eax :760F1527 8944241C mov dword ptr [esp+1C], eax :760F152B 0F84B9000000 je 760F15EA :760F1531 83F801 cmp eax, 00000001 :760F1534 7412 je 760F1548 :760F1536 3D02010000 cmp eax, 00000102 :760F153B 7435 je 760F1572 :760F153D 83F8FF cmp eax, FFFFFFFF :760F1540 0F84E0000000 je 760F1626 :760F1546 EBCB jmp 760F1513 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1534(C) | :760F1548 A184110E76 mov eax, dword ptr [760E1184] :760F154D F60004 test byte ptr [eax], 04 :760F1550 7420 je 760F1572 :760F1552 6A04 push 00000004 :760F1554 55 push ebp :760F1555 6830050000 push 00000530 :760F155A 57 push edi :760F155B FFD6 call esi :760F155D 85C0 test eax, eax :760F155F 7411 je 760F1572 * Possible StringData Ref from Code Obj ->"Shutdown event is signalled" | :760F1561 68A0880E76 push 760E88A0 :760F1566 6806030000 push 00000306 :760F156B E8BBB9FFFF call 760ECF2B :760F1570 59 pop ecx :760F1571 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F153B(C), :760F1550(C), :760F155F(C) | :760F1572 A184110E76 mov eax, dword ptr [760E1184] :760F1577 F60004 test byte ptr [eax], 04 :760F157A 7420 je 760F159C :760F157C 6A04 push 00000004 :760F157E 55 push ebp :760F157F 6834050000 push 00000534 :760F1584 57 push edi :760F1585 FFD6 call esi :760F1587 85C0 test eax, eax :760F1589 7411 je 760F159C * Possible StringData Ref from Code Obj ->"Timeout occurred" | :760F158B 688C880E76 push 760E888C :760F1590 6806030000 push 00000306 :760F1595 E891B9FFFF call 760ECF2B :760F159A 59 pop ecx :760F159B 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F157A(C), :760F1589(C) | :760F159C 837C241401 cmp dword ptr [esp+14], 00000001 :760F15A1 750E jne 760F15B1 :760F15A3 E8C3F7FFFF call 760F0D6B :760F15A8 09442410 or dword ptr [esp+10], eax :760F15AC 8364241400 and dword ptr [esp+14], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F15A1(C) | :760F15B1 837C241001 cmp dword ptr [esp+10], 00000001 :760F15B6 7523 jne 760F15DB :760F15B8 E83DFCFFFF call 760F11FA :760F15BD 85C0 test eax, eax :760F15BF 7415 je 760F15D6 :760F15C1 83F820 cmp eax, 00000020 :760F15C4 7409 je 760F15CF :760F15C6 3D4F050000 cmp eax, 0000054F :760F15CB 7511 jne 760F15DE :760F15CD EB0C jmp 760F15DB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F15C4(C) | :760F15CF BBB80B0000 mov ebx, 00000BB8 :760F15D4 EB08 jmp 760F15DE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F15BF(C) | :760F15D6 8364241000 and dword ptr [esp+10], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F15B6(C), :760F15CD(U) | :760F15DB 83CBFF or ebx, FFFFFFFF * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F15CB(C), :760F15D4(U) | :760F15DE 837C241C01 cmp dword ptr [esp+1C], 00000001 :760F15E3 7475 je 760F165A :760F15E5 E929FFFFFF jmp 760F1513 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F152B(C) | :760F15EA A184110E76 mov eax, dword ptr [760E1184] :760F15EF F60004 test byte ptr [eax], 04 :760F15F2 7420 je 760F1614 :760F15F4 6A04 push 00000004 :760F15F6 55 push ebp :760F15F7 682A050000 push 0000052A :760F15FC 57 push edi :760F15FD FFD6 call esi :760F15FF 85C0 test eax, eax :760F1601 7411 je 760F1614 * Possible StringData Ref from Code Obj ->"Wininit event is signalled" | :760F1603 6870880E76 push 760E8870 :760F1608 6806030000 push 00000306 :760F160D E819B9FFFF call 760ECF2B :760F1612 59 pop ecx :760F1613 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F15F2(C), :760F1601(C) | :760F1614 C744241401000000 mov [esp+14], 00000001 :760F161C BB60EA0000 mov ebx, 0000EA60 :760F1621 E9EDFEFFFF jmp 760F1513 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1540(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F1626 FF15A0110E76 Call dword ptr [760E11A0] :760F162C 8BD8 mov ebx, eax :760F162E A184110E76 mov eax, dword ptr [760E1184] :760F1633 F60002 test byte ptr [eax], 02 :760F1636 7422 je 760F165A :760F1638 6A02 push 00000002 :760F163A 55 push ebp :760F163B 6864050000 push 00000564 :760F1640 57 push edi :760F1641 FFD6 call esi :760F1643 85C0 test eax, eax :760F1645 7413 je 760F165A :760F1647 53 push ebx * Possible StringData Ref from Code Obj ->"Wait Failed ec=%d" | :760F1648 685C880E76 push 760E885C :760F164D 6806030000 push 00000306 :760F1652 E8D4B8FFFF call 760ECF2B :760F1657 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F15E3(C), :760F1636(C), :760F1645(C) | :760F165A 5F pop edi :760F165B 5E pop esi :760F165C 5D pop ebp :760F165D 33C0 xor eax, eax :760F165F 5B pop ebx :760F1660 83C418 add esp, 00000018 :760F1663 C20400 ret 0004 * Referenced by a CALL at Address: |:760EB75A | :760F1666 51 push ecx :760F1667 56 push esi :760F1668 33F6 xor esi, esi :760F166A 393588E50F76 cmp dword ptr [760FE588], esi :760F1670 0F850C010000 jne 760F1782 :760F1676 6800040000 push 00000400 :760F167B 6888E10F76 push 760FE188 * Possible StringData Ref from Code Obj ->"%windir%\system\sfp\wininit.cpy" | :760F1680 6874890E76 push 760E8974 :760F1685 E8CE03FFFF call 760E1A58 :760F168A 85C0 test eax, eax :760F168C 7543 jne 760F16D1 :760F168E A184110E76 mov eax, dword ptr [760E1184] :760F1693 F60002 test byte ptr [eax], 02 :760F1696 0F8436010000 je 760F17D2 :760F169C 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"HandleWininitChanged" | :760F169E 685C890E76 push 760E895C :760F16A3 6884050000 push 00000584 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F16A8 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F16AD FF1580110E76 Call dword ptr [760E1180] :760F16B3 85C0 test eax, eax :760F16B5 0F8417010000 je 760F17D2 * Possible StringData Ref from Code Obj ->"Cannot get location of Wininit " ->"copy" | :760F16BB 6838890E76 push 760E8938 :760F16C0 6806030000 push 00000306 :760F16C5 E861B8FFFF call 760ECF2B :760F16CA 59 pop ecx :760F16CB 59 pop ecx :760F16CC E901010000 jmp 760F17D2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F168C(C) | :760F16D1 39358CE50F76 cmp dword ptr [760FE58C], esi :760F16D7 7553 jne 760F172C :760F16D9 56 push esi :760F16DA 56 push esi :760F16DB 56 push esi :760F16DC 56 push esi * Reference To: KERNEL32.CreateEventA, Ord:0034h | :760F16DD FF152C120E76 Call dword ptr [760E122C] :760F16E3 3BC6 cmp eax, esi :760F16E5 A38CE50F76 mov dword ptr [760FE58C], eax :760F16EA 7540 jne 760F172C * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F16EC FF15A0110E76 Call dword ptr [760E11A0] :760F16F2 8BF0 mov esi, eax :760F16F4 A184110E76 mov eax, dword ptr [760E1184] :760F16F9 F60002 test byte ptr [eax], 02 :760F16FC 0F84D0000000 je 760F17D2 :760F1702 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"HandleWininitChanged" | :760F1704 685C890E76 push 760E895C :760F1709 6893050000 push 00000593 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F170E 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1713 FF1580110E76 Call dword ptr [760E1180] :760F1719 85C0 test eax, eax :760F171B 0F84B1000000 je 760F17D2 :760F1721 56 push esi * Possible StringData Ref from Code Obj ->"Cannot create wininit event ec=%d" | :760F1722 6814890E76 push 760E8914 :760F1727 E999000000 jmp 760F17C5 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F16D7(C), :760F16EA(C) | :760F172C 8D442404 lea eax, dword ptr [esp+04] :760F1730 50 push eax :760F1731 56 push esi :760F1732 56 push esi :760F1733 68C9140F76 push 760F14C9 :760F1738 56 push esi :760F1739 56 push esi * Reference To: KERNEL32.CreateThread, Ord:004Dh | :760F173A FF15CC110E76 Call dword ptr [760E11CC] :760F1740 3BC6 cmp eax, esi :760F1742 A388E50F76 mov dword ptr [760FE588], eax :760F1747 0F8585000000 jne 760F17D2 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F174D FF15A0110E76 Call dword ptr [760E11A0] :760F1753 8BF0 mov esi, eax :760F1755 A184110E76 mov eax, dword ptr [760E1184] :760F175A F60002 test byte ptr [eax], 02 :760F175D 7473 je 760F17D2 :760F175F 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"HandleWininitChanged" | :760F1761 685C890E76 push 760E895C :760F1766 68A4050000 push 000005A4 * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F176B 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1770 FF1580110E76 Call dword ptr [760E1180] :760F1776 85C0 test eax, eax :760F1778 7458 je 760F17D2 :760F177A 56 push esi * Possible StringData Ref from Code Obj ->"Cannot create wininit thread ec=%d" | :760F177B 68F0880E76 push 760E88F0 :760F1780 EB43 jmp 760F17C5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1670(C) | :760F1782 FF358CE50F76 push dword ptr [760FE58C] * Reference To: KERNEL32.SetEvent, Ord:0290h | :760F1788 FF15A4110E76 Call dword ptr [760E11A4] :760F178E 85C0 test eax, eax :760F1790 7540 jne 760F17D2 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F1792 FF15A0110E76 Call dword ptr [760E11A0] :760F1798 8BF0 mov esi, eax :760F179A A184110E76 mov eax, dword ptr [760E1184] :760F179F F60002 test byte ptr [eax], 02 :760F17A2 742E je 760F17D2 :760F17A4 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"HandleWininitChanged" | :760F17A6 685C890E76 push 760E895C :760F17AB 68AF050000 push 000005AF * Possible StringData Ref from Data Obj ->"D:\mpcfre\Restore\src\sfpdll\wininit.cpp" | :760F17B0 6890DF0F76 push 760FDF90 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F17B5 FF1580110E76 Call dword ptr [760E1180] :760F17BB 85C0 test eax, eax :760F17BD 7413 je 760F17D2 :760F17BF 56 push esi * Possible StringData Ref from Code Obj ->"Cannot signal wininit event ec=%d" | :760F17C0 68CC880E76 push 760E88CC * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1727(U), :760F1780(U) | :760F17C5 6806030000 push 00000306 :760F17CA E85CB7FFFF call 760ECF2B :760F17CF 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1696(C), :760F16B5(C), :760F16CC(U), :760F16FC(C), :760F171B(C) |:760F1747(C), :760F175D(C), :760F1778(C), :760F1790(C), :760F17A2(C) |:760F17BD(C) | :760F17D2 5E pop esi :760F17D3 59 pop ecx :760F17D4 C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E1462(C), :760E14A6(C) | :760F17D5 33C0 xor eax, eax :760F17D7 5E pop esi :760F17D8 C20C00 ret 000C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1403(U) | :760F17DB 33C0 xor eax, eax :760F17DD 5F pop edi :760F17DE 5E pop esi :760F17DF 5D pop ebp :760F17E0 5B pop ebx :760F17E1 C20C00 ret 000C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E13B2(C) | :760F17E4 57 push edi :760F17E5 56 push esi :760F17E6 53 push ebx :760F17E7 FFD1 call ecx :760F17E9 E9CAFBFEFF jmp 760E13B8 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E13BA(C), :760E13CA(C) | :760F17EE 33C0 xor eax, eax :760F17F0 5F pop edi :760F17F1 5E pop esi :760F17F2 5D pop ebp :760F17F3 5B pop ebx :760F17F4 C20C00 ret 000C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E13E1(C) | :760F17F7 57 push edi :760F17F8 50 push eax :760F17F9 53 push ebx :760F17FA E832FCFEFF call 760E1431 :760F17FF E9E3FBFEFF jmp 760E13E7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1419(C) | :760F1804 33ED xor ebp, ebp :760F1806 E914FCFEFF jmp 760E141F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E142C(U) | :760F180B 57 push edi :760F180C 56 push esi :760F180D 53 push ebx :760F180E FFD0 call eax :760F1810 8BE8 mov ebp, eax :760F1812 E9D9FBFEFF jmp 760E13F0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E17C0(C) | :760F1817 8B442404 mov eax, dword ptr [esp+04] :760F181B 50 push eax * Reference To: MSVCRT._onexit, Ord:0183h | :760F181C FF1504100E76 Call dword ptr [760E1004] :760F1822 83C404 add esp, 00000004 :760F1825 C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E43C8(C) | :760F1826 A184110E76 mov eax, dword ptr [760E1184] :760F182B F60001 test byte ptr [eax], 01 :760F182E 7428 je 760F1858 :760F1830 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"GetDSRoot" | :760F1832 6814500E76 push 760E5014 :760F1837 684D030000 push 0000034D * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\chglogap" ->"i.cpp" | :760F183C 68E04F0E76 push 760E4FE0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1841 FF1580110E76 Call dword ptr [760E1180] :760F1847 85C0 test eax, eax :760F1849 740D je 760F1858 * Possible StringData Ref from Code Obj ->"ppszDSRoot is NULL" | :760F184B 68248A0E76 push 760E8A24 :760F1850 56 push esi :760F1851 E8D5B6FFFF call 760ECF2B :760F1856 59 pop ecx :760F1857 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F182E(C), :760F1849(C) | :760F1858 8975FC mov dword ptr [ebp-04], esi :760F185B E9002CFFFF jmp 760E4460 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E43E0(C) | :760F1860 A184110E76 mov eax, dword ptr [760E1184] :760F1865 F60001 test byte ptr [eax], 01 :760F1868 0F84F22BFFFF je 760E4460 :760F186E 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"GetDSRoot" | :760F1870 6814500E76 push 760E5014 :760F1875 6857030000 push 00000357 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\chglogap" ->"i.cpp" | :760F187A 68E04F0E76 push 760E4FE0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F187F FF1580110E76 Call dword ptr [760E1180] :760F1885 85C0 test eax, eax :760F1887 0F84D32BFFFF je 760E4460 * Possible StringData Ref from Code Obj ->"DataStor Init failed" | :760F188D 680C8A0E76 push 760E8A0C :760F1892 EB32 jmp 760F18C6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E43FA(C) | :760F1894 A184110E76 mov eax, dword ptr [760E1184] :760F1899 F60001 test byte ptr [eax], 01 :760F189C 0F84BE2BFFFF je 760E4460 :760F18A2 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"GetDSRoot" | :760F18A4 6814500E76 push 760E5014 :760F18A9 685E030000 push 0000035E * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\chglogap" ->"i.cpp" | :760F18AE 68E04F0E76 push 760E4FE0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F18B3 FF1580110E76 Call dword ptr [760E1180] :760F18B9 85C0 test eax, eax :760F18BB 0F849F2BFFFF je 760E4460 * Possible StringData Ref from Code Obj ->"GetDSRoot failed" | :760F18C1 68D8890E76 push 760E89D8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1892(U) | :760F18C6 56 push esi :760F18C7 E85FB6FFFF call 760ECF2B :760F18CC 59 pop ecx :760F18CD 59 pop ecx :760F18CE E98D2BFFFF jmp 760E4460 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4418(C) | :760F18D3 6A04 push 00000004 :760F18D5 53 push ebx :760F18D6 6862030000 push 00000362 :760F18DB 57 push edi :760F18DC FFD6 call esi :760F18DE 85C0 test eax, eax :760F18E0 0F84382BFFFF je 760E441E :760F18E6 FF75F8 push [ebp-08] * Possible StringData Ref from Code Obj ->"lpszDSRoot: %s" | :760F18E9 68C8890E76 push 760E89C8 :760F18EE 6A00 push 00000000 :760F18F0 E836B6FFFF call 760ECF2B :760F18F5 83C40C add esp, 0000000C :760F18F8 E9212BFFFF jmp 760E441E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4432(C) | :760F18FD A184110E76 mov eax, dword ptr [760E1184] :760F1902 F60001 test byte ptr [eax], 01 :760F1905 741D je 760F1924 :760F1907 6A01 push 00000001 :760F1909 53 push ebx :760F190A 6867030000 push 00000367 :760F190F 57 push edi :760F1910 FFD6 call esi :760F1912 85C0 test eax, eax :760F1914 740E je 760F1924 :760F1916 68B8890E76 push 760E89B8 :760F191B 6A00 push 00000000 :760F191D E809B6FFFF call 760ECF2B :760F1922 59 pop ecx :760F1923 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1905(C), :760F1914(C) | :760F1924 8365FC00 and dword ptr [ebp-04], 00000000 :760F1928 E9332BFFFF jmp 760E4460 * Referenced by a CALL at Address: |:760EC777 | :760F192D 55 push ebp :760F192E 8BEC mov ebp, esp :760F1930 51 push ecx :760F1931 8365FC00 and dword ptr [ebp-04], 00000000 :760F1935 56 push esi :760F1936 6A01 push 00000001 :760F1938 8D45FC lea eax, dword ptr [ebp-04] :760F193B 5E pop esi :760F193C 50 push eax :760F193D E8652AFFFF call 760E43A7 :760F1942 85C0 test eax, eax :760F1944 7537 jne 760F197D :760F1946 A184110E76 mov eax, dword ptr [760E1184] :760F194B F60002 test byte ptr [eax], 02 :760F194E 7429 je 760F1979 :760F1950 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"GetVxDDatPath" | :760F1952 68388A0E76 push 760E8A38 :760F1957 6881030000 push 00000381 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\chglogap" ->"i.cpp" | :760F195C 68E04F0E76 push 760E4FE0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1961 FF1580110E76 Call dword ptr [760E1180] :760F1967 85C0 test eax, eax :760F1969 740E je 760F1979 * Possible StringData Ref from Code Obj ->"GetDSRoot failed" | :760F196B 68D8890E76 push 760E89D8 :760F1970 6A00 push 00000000 :760F1972 E8B4B5FFFF call 760ECF2B :760F1977 59 pop ecx :760F1978 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F194E(C), :760F1969(C) | :760F1979 33F6 xor esi, esi :760F197B EB22 jmp 760F199F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1944(C) | :760F197D FF35C8DF0F76 push dword ptr [760FDFC8] :760F1983 FF75FC push [ebp-04] :760F1986 68442E0E76 push 760E2E44 :760F198B FF7508 push [ebp+08] * Reference To: USER32.wsprintfA, Ord:02B3h | :760F198E FF15A4120E76 Call dword ptr [760E12A4] :760F1994 83C410 add esp, 00000010 :760F1997 FF75FC push [ebp-04] :760F199A E8F72EFFFF call 760E4896 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F197B(U) | :760F199F 8BC6 mov eax, esi :760F19A1 5E pop esi :760F19A2 C9 leave :760F19A3 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E48D7(C) | :760F19A6 A184110E76 mov eax, dword ptr [760E1184] :760F19AB F60001 test byte ptr [eax], 01 :760F19AE 0F843F2FFFFF je 760E48F3 :760F19B4 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"GetArchiveDir" | :760F19B6 68608A0E76 push 760E8A60 :760F19BB 68BB030000 push 000003BB * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\chglogap" ->"i.cpp" | :760F19C0 68E04F0E76 push 760E4FE0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F19C5 FF1580110E76 Call dword ptr [760E1180] :760F19CB 85C0 test eax, eax :760F19CD 0F84202FFFFF je 760E48F3 * Possible StringData Ref from Code Obj ->"DataStor Init failed" | :760F19D3 680C8A0E76 push 760E8A0C :760F19D8 EB32 jmp 760F1A0C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E48ED(C) | :760F19DA A184110E76 mov eax, dword ptr [760E1184] :760F19DF F60001 test byte ptr [eax], 01 :760F19E2 0F840B2FFFFF je 760E48F3 :760F19E8 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"GetArchiveDir" | :760F19EA 68608A0E76 push 760E8A60 :760F19EF 68C2030000 push 000003C2 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\chglogap" ->"i.cpp" | :760F19F4 68E04F0E76 push 760E4FE0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F19F9 FF1580110E76 Call dword ptr [760E1180] :760F19FF 85C0 test eax, eax :760F1A01 0F84EC2EFFFF je 760E48F3 * Possible StringData Ref from Code Obj ->"GetArchiveDir failed" | :760F1A07 68488A0E76 push 760E8A48 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F19D8(U) | :760F1A0C 6A00 push 00000000 :760F1A0E E818B5FFFF call 760ECF2B :760F1A13 59 pop ecx :760F1A14 59 pop ecx :760F1A15 E9D92EFFFF jmp 760E48F3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E49A9(C) | :760F1A1A A184110E76 mov eax, dword ptr [760E1184] :760F1A1F F60001 test byte ptr [eax], 01 :760F1A22 0F849D2FFFFF je 760E49C5 :760F1A28 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"GetDSTemp" | :760F1A2A 68848A0E76 push 760E8A84 :760F1A2F 68DC030000 push 000003DC * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\chglogap" ->"i.cpp" | :760F1A34 68E04F0E76 push 760E4FE0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1A39 FF1580110E76 Call dword ptr [760E1180] :760F1A3F 85C0 test eax, eax :760F1A41 0F847E2FFFFF je 760E49C5 * Possible StringData Ref from Code Obj ->"DataStor Init failed" | :760F1A47 680C8A0E76 push 760E8A0C :760F1A4C EB32 jmp 760F1A80 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E49BF(C) | :760F1A4E A184110E76 mov eax, dword ptr [760E1184] :760F1A53 F60001 test byte ptr [eax], 01 :760F1A56 0F84692FFFFF je 760E49C5 :760F1A5C 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"GetDSTemp" | :760F1A5E 68848A0E76 push 760E8A84 :760F1A63 68E3030000 push 000003E3 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\chglogap" ->"i.cpp" | :760F1A68 68E04F0E76 push 760E4FE0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1A6D FF1580110E76 Call dword ptr [760E1180] :760F1A73 85C0 test eax, eax :760F1A75 0F844A2FFFFF je 760E49C5 * Possible StringData Ref from Code Obj ->"GetDSTemp failed" | :760F1A7B 68708A0E76 push 760E8A70 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1A4C(U) | :760F1A80 6A00 push 00000000 :760F1A82 E8A4B4FFFF call 760ECF2B :760F1A87 59 pop ecx :760F1A88 59 pop ecx :760F1A89 E9372FFFFF jmp 760E49C5 :760F1A8E 56 push esi :760F1A8F 8BF1 mov esi, ecx :760F1A91 E819FCFEFF call 760E16AF :760F1A96 F644240801 test [esp+08], 01 :760F1A9B 7407 je 760F1AA4 :760F1A9D 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F1A9E E8A8FEFEFF Call 760E194B :760F1AA3 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1A9B(C) | :760F1AA4 8BC6 mov eax, esi :760F1AA6 5E pop esi :760F1AA7 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E16C0(C) | :760F1AAA 50 push eax :760F1AAB E8E62DFFFF call 760E4896 :760F1AB0 E911FCFEFF jmp 760E16C6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E16CE(C) | :760F1AB5 50 push eax * Reference To: MSVCRT.free, Ord:025Bh | :760F1AB6 FF1518100E76 Call dword ptr [760E1018] :760F1ABC 59 pop ecx :760F1ABD E912FCFEFF jmp 760E16D4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E16DC(C) | :760F1AC2 50 push eax :760F1AC3 E8CE2DFFFF call 760E4896 :760F1AC8 E915FCFEFF jmp 760E16E2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E16EA(C) | :760F1ACD 50 push eax :760F1ACE E8C32DFFFF call 760E4896 :760F1AD3 E918FCFEFF jmp 760E16F0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E16F8(C) | :760F1AD8 50 push eax * Reference To: KERNEL32.FindClose, Ord:009Fh | :760F1AD9 FF1584120E76 Call dword ptr [760E1284] :760F1ADF E91AFCFEFF jmp 760E16FE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1706(C) | :760F1AE4 50 push eax :760F1AE5 E8AC2DFFFF call 760E4896 :760F1AEA E91DFCFEFF jmp 760E170C :760F1AEF 56 push esi :760F1AF0 8BF1 mov esi, ecx :760F1AF2 E8D5FAFEFF call 760E15CC :760F1AF7 F644240801 test [esp+08], 01 :760F1AFC 7407 je 760F1B05 :760F1AFE 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F1AFF E847FEFEFF Call 760E194B :760F1B04 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1AFC(C) | :760F1B05 8BC6 mov eax, esi :760F1B07 5E pop esi :760F1B08 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E15EB(C) | :760F1B0B 50 push eax :760F1B0C E8852DFFFF call 760E4896 :760F1B11 83664800 and dword ptr [esi+48], 00000000 :760F1B15 E9D7FAFEFF jmp 760E15F1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E474C(C) | :760F1B1A 53 push ebx :760F1B1B 55 push ebp :760F1B1C 6851010000 push 00000151 :760F1B21 57 push edi :760F1B22 FFD6 call esi :760F1B24 85C0 test eax, eax :760F1B26 0F84262CFFFF je 760E4752 :760F1B2C FF742428 push [esp+28] * Possible StringData Ref from Code Obj ->"Default value=%s set of IDS_RESTORE" | :760F1B30 68A48B0E76 push 760E8BA4 :760F1B35 6A00 push 00000000 :760F1B37 E8EFB3FFFF call 760ECF2B :760F1B3C 83C40C add esp, 0000000C :760F1B3F E90E2CFFFF jmp 760E4752 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4759(C) | :760F1B44 53 push ebx :760F1B45 55 push ebp :760F1B46 6852010000 push 00000152 :760F1B4B 57 push edi :760F1B4C FFD6 call esi :760F1B4E 85C0 test eax, eax :760F1B50 0F84092CFFFF je 760E475F :760F1B56 FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Default value=%s set of IDS_TEMP" | :760F1B5A 68808B0E76 push 760E8B80 :760F1B5F 6A00 push 00000000 :760F1B61 E8C5B3FFFF call 760ECF2B :760F1B66 83C40C add esp, 0000000C :760F1B69 E9F12BFFFF jmp 760E475F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4766(C) | :760F1B6E 53 push ebx :760F1B6F 55 push ebp :760F1B70 6853010000 push 00000153 :760F1B75 57 push edi :760F1B76 FFD6 call esi :760F1B78 85C0 test eax, eax :760F1B7A 0F84EC2BFFFF je 760E476C :760F1B80 FF742414 push [esp+14] * Possible StringData Ref from Code Obj ->"Default value=%s set of IDS_ARCHIVE" | :760F1B84 685C8B0E76 push 760E8B5C :760F1B89 6A00 push 00000000 :760F1B8B E89BB3FFFF call 760ECF2B :760F1B90 83C40C add esp, 0000000C :760F1B93 E9D42BFFFF jmp 760E476C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4773(C) | :760F1B98 53 push ebx :760F1B99 55 push ebp :760F1B9A 6854010000 push 00000154 :760F1B9F 57 push edi :760F1BA0 FFD6 call esi :760F1BA2 85C0 test eax, eax :760F1BA4 0F84CF2BFFFF je 760E4779 :760F1BAA FF742418 push [esp+18] * Possible StringData Ref from Code Obj ->"Default value=%s set of IDS_LOGS" | :760F1BAE 68388B0E76 push 760E8B38 :760F1BB3 6A00 push 00000000 :760F1BB5 E871B3FFFF call 760ECF2B :760F1BBA 83C40C add esp, 0000000C :760F1BBD E9B72BFFFF jmp 760E4779 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4780(C) | :760F1BC2 53 push ebx :760F1BC3 55 push ebp :760F1BC4 6855010000 push 00000155 :760F1BC9 57 push edi :760F1BCA FFD6 call esi :760F1BCC 85C0 test eax, eax :760F1BCE 0F84B22BFFFF je 760E4786 :760F1BD4 FF74241C push [esp+1C] * Possible StringData Ref from Code Obj ->"Default value=%s set of IDS_SFP" | :760F1BD8 68188B0E76 push 760E8B18 :760F1BDD 6A00 push 00000000 :760F1BDF E847B3FFFF call 760ECF2B :760F1BE4 83C40C add esp, 0000000C :760F1BE7 E99A2BFFFF jmp 760E4786 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E478D(C) | :760F1BEC 53 push ebx :760F1BED 55 push ebp :760F1BEE 6856010000 push 00000156 :760F1BF3 57 push edi :760F1BF4 FFD6 call esi :760F1BF6 85C0 test eax, eax :760F1BF8 0F84952BFFFF je 760E4793 :760F1BFE FF742420 push [esp+20] * Possible StringData Ref from Code Obj ->"Default value=%s set of IDS_DSINFO" | :760F1C02 68F48A0E76 push 760E8AF4 :760F1C07 6A00 push 00000000 :760F1C09 E81DB3FFFF call 760ECF2B :760F1C0E 83C40C add esp, 0000000C :760F1C11 E97D2BFFFF jmp 760E4793 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E479A(C) | :760F1C16 53 push ebx :760F1C17 55 push ebp :760F1C18 6857010000 push 00000157 :760F1C1D 57 push edi :760F1C1E FFD6 call esi :760F1C20 85C0 test eax, eax :760F1C22 0F84782BFFFF je 760E47A0 :760F1C28 FF742424 push [esp+24] * Possible StringData Ref from Code Obj ->"Default value=%s set of IDS_DSROOT" | :760F1C2C 68D08A0E76 push 760E8AD0 :760F1C31 6A00 push 00000000 :760F1C33 E8F3B2FFFF call 760ECF2B :760F1C38 83C40C add esp, 0000000C :760F1C3B E9602BFFFF jmp 760E47A0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E47A7(C) | :760F1C40 53 push ebx :760F1C41 55 push ebp :760F1C42 6858010000 push 00000158 :760F1C47 57 push edi :760F1C48 FFD6 call esi :760F1C4A 85C0 test eax, eax :760F1C4C 0F845B2BFFFF je 760E47AD :760F1C52 FF74242C push [esp+2C] * Possible StringData Ref from Code Obj ->"Default value=%s set of IDS_INIFILEPATH" | :760F1C56 68A88A0E76 push 760E8AA8 :760F1C5B 6A00 push 00000000 :760F1C5D E8C9B2FFFF call 760ECF2B :760F1C62 83C40C add esp, 0000000C :760F1C65 E9432BFFFF jmp 760E47AD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E488B(C) | * Reference To: ATRACE.__dwEnabledTraces, Ord:0008h | :760F1C6A 8B0D84110E76 mov ecx, dword ptr [760E1184] :760F1C70 8401 test byte ptr [ecx], al :760F1C72 7428 je 760F1C9C :760F1C74 50 push eax * Possible StringData Ref from Code Obj ->"CDataStor::GetDSRoot" | :760F1C75 680C8C0E76 push 760E8C0C :760F1C7A 68C3040000 push 000004C3 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1C7F 6820500E76 push 760E5020 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1C84 FF1580110E76 Call dword ptr [760E1180] :760F1C8A 85C0 test eax, eax :760F1C8C 740E je 760F1C9C * Possible StringData Ref from Code Obj ->"m_lpszDSRoot is NULL" | :760F1C8E 68908A0E76 push 760E8A90 :760F1C93 6A00 push 00000000 :760F1C95 E891B2FFFF call 760ECF2B :760F1C9A 59 pop ecx :760F1C9B 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1C72(C), :760F1C8C(C) | :760F1C9C 33C0 xor eax, eax :760F1C9E E9F02BFFFF jmp 760E4893 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E49EB(C) | :760F1CA3 A184110E76 mov eax, dword ptr [760E1184] :760F1CA8 F60001 test byte ptr [eax], 01 :760F1CAB 0F84882DFFFF je 760E4A39 :760F1CB1 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"CDataStor::GetDSTemp" | :760F1CB3 68488C0E76 push 760E8C48 :760F1CB8 68CE050000 push 000005CE * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1CBD 6820500E76 push 760E5020 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1CC2 FF1580110E76 Call dword ptr [760E1180] :760F1CC8 85C0 test eax, eax :760F1CCA 0F84692DFFFF je 760E4A39 * Possible StringData Ref from Code Obj ->"ppDSTempDir is NULL" | :760F1CD0 68348C0E76 push 760E8C34 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1D14(U) | :760F1CD5 57 push edi :760F1CD6 E850B2FFFF call 760ECF2B :760F1CDB 59 pop ecx :760F1CDC 59 pop ecx :760F1CDD E9572DFFFF jmp 760E4A39 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E49F6(C) | :760F1CE2 A184110E76 mov eax, dword ptr [760E1184] :760F1CE7 F60001 test byte ptr [eax], 01 :760F1CEA 0F84492DFFFF je 760E4A39 :760F1CF0 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"CDataStor::GetDSTemp" | :760F1CF2 68488C0E76 push 760E8C48 :760F1CF7 68D6050000 push 000005D6 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1CFC 6820500E76 push 760E5020 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1D01 FF1580110E76 Call dword ptr [760E1180] :760F1D07 85C0 test eax, eax :760F1D09 0F842A2DFFFF je 760E4A39 * Possible StringData Ref from Code Obj ->"m_lpszDSRoot is NULL" | :760F1D0F 68908A0E76 push 760E8A90 :760F1D14 EBBF jmp 760F1CD5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4A0E(C) | :760F1D16 A184110E76 mov eax, dword ptr [760E1184] :760F1D1B F60001 test byte ptr [eax], 01 :760F1D1E 0F84152DFFFF je 760E4A39 :760F1D24 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"CDataStor::GetDSTemp" | :760F1D26 68488C0E76 push 760E8C48 :760F1D2B 68DF050000 push 000005DF * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1D30 6820500E76 push 760E5020 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1D35 FF1580110E76 Call dword ptr [760E1180] :760F1D3B 85C0 test eax, eax :760F1D3D 0F84F62CFFFF je 760E4A39 :760F1D43 FF3504DA0F76 push dword ptr [760FDA04] :760F1D49 FF7644 push [esi+44] * Possible StringData Ref from Code Obj ->"_StrCat failed for %s and %s" | :760F1D4C 68EC890E76 push 760E89EC :760F1D51 57 push edi :760F1D52 E8D4B1FFFF call 760ECF2B :760F1D57 83C410 add esp, 00000010 :760F1D5A E9DA2CFFFF jmp 760E4A39 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4A2A(C) | :760F1D5F F60001 test byte ptr [eax], 01 :760F1D62 742E je 760F1D92 :760F1D64 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"CDataStor::GetDSTemp" | :760F1D66 68488C0E76 push 760E8C48 :760F1D6B 68E8050000 push 000005E8 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1D70 6820500E76 push 760E5020 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1D75 FF1580110E76 Call dword ptr [760E1180] :760F1D7B 85C0 test eax, eax :760F1D7D 7413 je 760F1D92 :760F1D7F 56 push esi :760F1D80 FF75FC push [ebp-04] * Possible StringData Ref from Code Obj ->"_StrCat failed for %s and %s" | :760F1D83 68EC890E76 push 760E89EC :760F1D88 6A00 push 00000000 :760F1D8A E89CB1FFFF call 760ECF2B :760F1D8F 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1D62(C), :760F1D7D(C) | :760F1D92 33FF xor edi, edi :760F1D94 E9A02CFFFF jmp 760E4A39 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4A33(C) | :760F1D99 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CDataStor::GetDSTemp" | :760F1D9B 68488C0E76 push 760E8C48 :760F1DA0 68ED050000 push 000005ED * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1DA5 6820500E76 push 760E5020 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1DAA FF1580110E76 Call dword ptr [760E1180] :760F1DB0 85C0 test eax, eax :760F1DB2 0F84812CFFFF je 760E4A39 :760F1DB8 FF33 push dword ptr [ebx] * Possible StringData Ref from Code Obj ->"*ppDSTempDir=%s" | :760F1DBA 68248C0E76 push 760E8C24 :760F1DBF 6A00 push 00000000 :760F1DC1 E865B1FFFF call 760ECF2B :760F1DC6 83C40C add esp, 0000000C :760F1DC9 E96B2CFFFF jmp 760E4A39 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4919(C) | :760F1DCE A184110E76 mov eax, dword ptr [760E1184] :760F1DD3 F60001 test byte ptr [eax], 01 :760F1DD6 0F848B2BFFFF je 760E4967 :760F1DDC 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"CDataStor::GetArchiveDir" | :760F1DDE 68B48C0E76 push 760E8CB4 :760F1DE3 680A080000 push 0000080A * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1DE8 6820500E76 push 760E5020 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1DED FF1580110E76 Call dword ptr [760E1180] :760F1DF3 85C0 test eax, eax :760F1DF5 0F846C2BFFFF je 760E4967 * Possible StringData Ref from Code Obj ->"ppszArchiveDir is NULL" | :760F1DFB 689C8C0E76 push 760E8C9C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1E3F(U) | :760F1E00 57 push edi :760F1E01 E825B1FFFF call 760ECF2B :760F1E06 59 pop ecx :760F1E07 59 pop ecx :760F1E08 E95A2BFFFF jmp 760E4967 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4924(C) | :760F1E0D A184110E76 mov eax, dword ptr [760E1184] :760F1E12 F60001 test byte ptr [eax], 01 :760F1E15 0F844C2BFFFF je 760E4967 :760F1E1B 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"CDataStor::GetArchiveDir" | :760F1E1D 68B48C0E76 push 760E8CB4 :760F1E22 6812080000 push 00000812 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1E27 6820500E76 push 760E5020 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1E2C FF1580110E76 Call dword ptr [760E1180] :760F1E32 85C0 test eax, eax :760F1E34 0F842D2BFFFF je 760E4967 * Possible StringData Ref from Code Obj ->"m_lpszDSRoot is NULL" | :760F1E3A 68908A0E76 push 760E8A90 :760F1E3F EBBF jmp 760F1E00 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E493C(C) | :760F1E41 A184110E76 mov eax, dword ptr [760E1184] :760F1E46 F60001 test byte ptr [eax], 01 :760F1E49 0F84182BFFFF je 760E4967 :760F1E4F 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"CDataStor::GetArchiveDir" | :760F1E51 68B48C0E76 push 760E8CB4 :760F1E56 681B080000 push 0000081B * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1E5B 6820500E76 push 760E5020 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1E60 FF1580110E76 Call dword ptr [760E1180] :760F1E66 85C0 test eax, eax :760F1E68 0F84F92AFFFF je 760E4967 :760F1E6E FF3504DA0F76 push dword ptr [760FDA04] :760F1E74 FF7644 push [esi+44] * Possible StringData Ref from Code Obj ->"_StrCat failed for %s and %s" | :760F1E77 68EC890E76 push 760E89EC :760F1E7C 57 push edi :760F1E7D E8A9B0FFFF call 760ECF2B :760F1E82 83C410 add esp, 00000010 :760F1E85 E9DD2AFFFF jmp 760E4967 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4958(C) | :760F1E8A F60001 test byte ptr [eax], 01 :760F1E8D 742E je 760F1EBD :760F1E8F 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"CDataStor::GetArchiveDir" | :760F1E91 68B48C0E76 push 760E8CB4 :760F1E96 6824080000 push 00000824 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1E9B 6820500E76 push 760E5020 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1EA0 FF1580110E76 Call dword ptr [760E1180] :760F1EA6 85C0 test eax, eax :760F1EA8 7413 je 760F1EBD :760F1EAA 56 push esi :760F1EAB FF75FC push [ebp-04] * Possible StringData Ref from Code Obj ->"_StrCat failed for %s and %s" | :760F1EAE 68EC890E76 push 760E89EC :760F1EB3 6A00 push 00000000 :760F1EB5 E871B0FFFF call 760ECF2B :760F1EBA 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1E8D(C), :760F1EA8(C) | :760F1EBD 33FF xor edi, edi :760F1EBF E9A32AFFFF jmp 760E4967 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4961(C) | :760F1EC4 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CDataStor::GetArchiveDir" | :760F1EC6 68B48C0E76 push 760E8CB4 :760F1ECB 6829080000 push 00000829 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1ED0 6820500E76 push 760E5020 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1ED5 FF1580110E76 Call dword ptr [760E1180] :760F1EDB 85C0 test eax, eax :760F1EDD 0F84842AFFFF je 760E4967 :760F1EE3 FF33 push dword ptr [ebx] * Possible StringData Ref from Code Obj ->"*ppszArchiveDir=%s" | :760F1EE5 68888C0E76 push 760E8C88 :760F1EEA 6A00 push 00000000 :760F1EEC E83AB0FFFF call 760ECF2B :760F1EF1 83C40C add esp, 0000000C :760F1EF4 E96E2AFFFF jmp 760E4967 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4493(C) | :760F1EF9 F60004 test byte ptr [eax], 04 :760F1EFC 0F848D26FFFF je 760E458F :760F1F02 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CDataStor::Init" | :760F1F04 6874500E76 push 760E5074 :760F1F09 6847080000 push 00000847 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1F0E 6820500E76 push 760E5020 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F1F13 FF1580110E76 Call dword ptr [760E1180] :760F1F19 85C0 test eax, eax :760F1F1B 0F846E26FFFF je 760E458F * Possible StringData Ref from Code Obj ->"Already initialized" | :760F1F21 683C8D0E76 push 760E8D3C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F1F8A(U) | :760F1F26 6A00 push 00000000 :760F1F28 E8FEAFFFFF call 760ECF2B :760F1F2D 59 pop ecx :760F1F2E 59 pop ecx :760F1F2F E95B26FFFF jmp 760E458F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E44A2(C) | * Possible StringData Ref from Code Obj ->"CDataStor::Init" | :760F1F34 BE74500E76 mov esi, 760E5074 :760F1F39 6A04 push 00000004 :760F1F3B 56 push esi * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1F3C BF20500E76 mov edi, 760E5020 :760F1F41 684C080000 push 0000084C :760F1F46 57 push edi :760F1F47 FFD3 call ebx :760F1F49 85C0 test eax, eax :760F1F4B 0F846125FFFF je 760E44B2 * Possible StringData Ref from Code Obj ->"Calling LoadRestorRc" | :760F1F51 68248D0E76 push 760E8D24 :760F1F56 6A00 push 00000000 :760F1F58 E8CEAFFFFF call 760ECF2B :760F1F5D 59 pop ecx :760F1F5E 59 pop ecx :760F1F5F E94E25FFFF jmp 760E44B2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E44BF(C) | :760F1F64 A184110E76 mov eax, dword ptr [760E1184] :760F1F69 F60001 test byte ptr [eax], 01 :760F1F6C 0F841D26FFFF je 760E458F :760F1F72 6A01 push 00000001 :760F1F74 56 push esi :760F1F75 6850080000 push 00000850 :760F1F7A 57 push edi :760F1F7B FFD3 call ebx :760F1F7D 85C0 test eax, eax :760F1F7F 0F840A26FFFF je 760E458F * Possible StringData Ref from Code Obj ->"LoadRestorRc failed" | :760F1F85 68108D0E76 push 760E8D10 :760F1F8A EB9A jmp 760F1F26 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E44D9(C) | :760F1F8C A184110E76 mov eax, dword ptr [760E1184] :760F1F91 F60001 test byte ptr [eax], 01 :760F1F94 741D je 760F1FB3 :760F1F96 6A01 push 00000001 :760F1F98 56 push esi :760F1F99 6859080000 push 00000859 :760F1F9E 57 push edi :760F1F9F FFD3 call ebx :760F1FA1 85C0 test eax, eax :760F1FA3 740E je 760F1FB3 * Possible StringData Ref from Code Obj ->"GetWindowsDirectory failed. Using " ->"Default" | :760F1FA5 68E48C0E76 push 760E8CE4 :760F1FAA 6A00 push 00000000 :760F1FAC E87AAFFFFF call 760ECF2B :760F1FB1 59 pop ecx :760F1FB2 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F1F94(C), :760F1FA3(C) | * Possible StringData Ref from Code Obj ->"C:\WINDOWS" | :760F1FB3 8B3DCCDF0F76 mov edi, dword ptr [760FDFCC] :760F1FB9 83C9FF or ecx, FFFFFFFF :760F1FBC 33C0 xor eax, eax :760F1FBE F2 repnz :760F1FBF AE scasb :760F1FC0 F7D1 not ecx :760F1FC2 2BF9 sub edi, ecx :760F1FC4 8BC1 mov eax, ecx :760F1FC6 8BF7 mov esi, edi :760F1FC8 8DBDF8030000 lea edi, dword ptr [ebp+000003F8] :760F1FCE C1E902 shr ecx, 02 :760F1FD1 F3 repz :760F1FD2 A5 movsd :760F1FD3 8BC8 mov ecx, eax :760F1FD5 83E103 and ecx, 00000003 :760F1FD8 F3 repz :760F1FD9 A4 movsb * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F1FDA BF20500E76 mov edi, 760E5020 * Possible StringData Ref from Code Obj ->"CDataStor::Init" | :760F1FDF BE74500E76 mov esi, 760E5074 :760F1FE4 E9F624FFFF jmp 760E44DF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E44FC(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F1FE9 FF15A0110E76 Call dword ptr [760E11A0] :760F1FEF 8BE8 mov ebp, eax :760F1FF1 A184110E76 mov eax, dword ptr [760E1184] :760F1FF6 F60001 test byte ptr [eax], 01 :760F1FF9 0F849025FFFF je 760E458F :760F1FFF 6A01 push 00000001 :760F2001 56 push esi :760F2002 6862080000 push 00000862 :760F2007 57 push edi :760F2008 FFD3 call ebx :760F200A 85C0 test eax, eax :760F200C 0F847D25FFFF je 760E458F :760F2012 55 push ebp * Possible StringData Ref from Code Obj ->"_StrCat failed; hr=0x%x" | :760F2013 68DC8B0E76 push 760E8BDC :760F2018 6A00 push 00000000 :760F201A E80CAFFFFF call 760ECF2B :760F201F 83C40C add esp, 0000000C :760F2022 E96825FFFF jmp 760E458F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E450A(C) | :760F2027 6A04 push 00000004 :760F2029 56 push esi :760F202A 6866080000 push 00000866 :760F202F 57 push edi :760F2030 FFD3 call ebx :760F2032 85C0 test eax, eax :760F2034 0F84D624FFFF je 760E4510 :760F203A FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"m_lpszIniFile=%s" | :760F203D 68D08C0E76 push 760E8CD0 :760F2042 6A00 push 00000000 :760F2044 E8E2AEFFFF call 760ECF2B :760F2049 83C40C add esp, 0000000C :760F204C E9BF24FFFF jmp 760E4510 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E451F(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F2051 FF15A0110E76 Call dword ptr [760E11A0] :760F2057 8BE8 mov ebp, eax :760F2059 A184110E76 mov eax, dword ptr [760E1184] :760F205E F60001 test byte ptr [eax], 01 :760F2061 741F je 760F2082 :760F2063 6A01 push 00000001 :760F2065 56 push esi :760F2066 686D080000 push 0000086D :760F206B 57 push edi :760F206C FFD3 call ebx :760F206E 85C0 test eax, eax :760F2070 7410 je 760F2082 :760F2072 55 push ebp * Possible StringData Ref from Code Obj ->"Out of Memory; hr=0x%x" | :760F2073 68F48B0E76 push 760E8BF4 :760F2078 6A00 push 00000000 :760F207A E8ACAEFFFF call 760ECF2B :760F207F 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2061(C), :760F2070(C) | :760F2082 8364241000 and dword ptr [esp+10], 00000000 :760F2087 E90325FFFF jmp 760E458F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E457F(C) | :760F208C 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CDataStor::Init" | :760F208E 6874500E76 push 760E5074 :760F2093 6876080000 push 00000876 * Possible StringData Ref from Code Obj ->"D:\mpcfre\Restore\src\statemgr\dsmgmt\datastor" ->".cpp" | :760F2098 6820500E76 push 760E5020 :760F209D FFD3 call ebx :760F209F 85C0 test eax, eax :760F20A1 0F84DE24FFFF je 760E4585 :760F20A7 FF7544 push [ebp+44] * Possible StringData Ref from Code Obj ->"m_lpszDSRoot: %s" | :760F20AA 68C88B0E76 push 760E8BC8 :760F20AF 6A00 push 00000000 :760F20B1 E875AEFFFF call 760ECF2B :760F20B6 83C40C add esp, 0000000C :760F20B9 E9C724FFFF jmp 760E4585 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E47CC(C) | * Reference To: ATRACE.__dwEnabledTraces, Ord:0008h | :760F20BE 8B0D84110E76 mov ecx, dword ptr [760E1184] :760F20C4 8401 test byte ptr [ecx], al :760F20C6 7424 je 760F20EC :760F20C8 50 push eax * Possible StringData Ref from Code Obj ->"_StrCat" | :760F20C9 68B08D0E76 push 760E8DB0 :760F20CE 6A30 push 00000030 :760F20D0 68D0DF0F76 push 760FDFD0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F20D5 FF1580110E76 Call dword ptr [760E1180] :760F20DB 85C0 test eax, eax :760F20DD 740D je 760F20EC * Possible StringData Ref from Code Obj ->"lpszS1 is NULL" | :760F20DF 68A08D0E76 push 760E8DA0 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2119(U), :760F2141(U) | :760F20E4 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F21AB(U) | :760F20E5 E841AEFFFF call 760ECF2B :760F20EA 59 pop ecx :760F20EB 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F20C6(C), :760F20DD(C), :760F20FB(C), :760F2112(C), :760F2123(C) |:760F213A(C), :760F2186(C), :760F219E(C) | :760F20EC 33C0 xor eax, eax :760F20EE E95527FFFF jmp 760E4848 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E47D5(C) | * Reference To: ATRACE.__dwEnabledTraces, Ord:0008h | :760F20F3 8B0D84110E76 mov ecx, dword ptr [760E1184] :760F20F9 8401 test byte ptr [ecx], al :760F20FB 74EF je 760F20EC :760F20FD 50 push eax * Possible StringData Ref from Code Obj ->"_StrCat" | :760F20FE 68B08D0E76 push 760E8DB0 :760F2103 6A37 push 00000037 :760F2105 68D0DF0F76 push 760FDFD0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F210A FF1580110E76 Call dword ptr [760E1180] :760F2110 85C0 test eax, eax :760F2112 74D8 je 760F20EC * Possible StringData Ref from Code Obj ->"lpszS2 is NULL" | :760F2114 68908D0E76 push 760E8D90 :760F2119 EBC9 jmp 760F20E4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E47E0(C) | * Reference To: ATRACE.__dwEnabledTraces, Ord:0008h | :760F211B 8B0D84110E76 mov ecx, dword ptr [760E1184] :760F2121 8401 test byte ptr [ecx], al :760F2123 74C7 je 760F20EC :760F2125 50 push eax * Possible StringData Ref from Code Obj ->"_StrCat" | :760F2126 68B08D0E76 push 760E8DB0 :760F212B 6A3E push 0000003E :760F212D 68D0DF0F76 push 760FDFD0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2132 FF1580110E76 Call dword ptr [760E1180] :760F2138 85C0 test eax, eax :760F213A 74B0 je 760F20EC * Possible StringData Ref from Code Obj ->"lpszRes is NULL" | :760F213C 68808D0E76 push 760E8D80 :760F2141 EBA1 jmp 760F20E4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4806(C) | :760F2143 A184110E76 mov eax, dword ptr [760E1184] :760F2148 F60004 test byte ptr [eax], 04 :760F214B 7422 je 760F216F :760F214D 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"_StrCat" | :760F214F 68B08D0E76 push 760E8DB0 :760F2154 6A48 push 00000048 :760F2156 68D0DF0F76 push 760FDFD0 :760F215B FFD3 call ebx :760F215D 85C0 test eax, eax :760F215F 740E je 760F216F * Possible StringData Ref from Code Obj ->"We have a memory leak here..." | :760F2161 68608D0E76 push 760E8D60 :760F2166 6A00 push 00000000 :760F2168 E8BEADFFFF call 760ECF2B :760F216D 59 pop ecx :760F216E 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F214B(C), :760F215F(C) | :760F216F FF36 push dword ptr [esi] :760F2171 E82027FFFF call 760E4896 :760F2176 832600 and dword ptr [esi], 00000000 :760F2179 E98E26FFFF jmp 760E480C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E481A(C) | :760F217E A184110E76 mov eax, dword ptr [760E1184] :760F2183 F60001 test byte ptr [eax], 01 :760F2186 0F8460FFFFFF je 760F20EC :760F218C 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"_StrCat" | :760F218E 68B08D0E76 push 760E8DB0 :760F2193 6A53 push 00000053 :760F2195 68D0DF0F76 push 760FDFD0 :760F219A FFD3 call ebx :760F219C 85C0 test eax, eax :760F219E 0F8448FFFFFF je 760F20EC * Possible StringData Ref from Code Obj ->"out of memory" | :760F21A4 68508D0E76 push 760E8D50 :760F21A9 6A00 push 00000000 :760F21AB E935FFFFFF jmp 760F20E5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E485A(U) | :760F21B0 A184110E76 mov eax, dword ptr [760E1184] :760F21B5 F60001 test byte ptr [eax], 01 :760F21B8 7425 je 760F21DF :760F21BA 6A01 push 00000001 * Possible StringData Ref from Code Obj ->"_StrLen" | :760F21BC 68C88D0E76 push 760E8DC8 :760F21C1 6A7D push 0000007D :760F21C3 68D0DF0F76 push 760FDFD0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F21C8 FF1580110E76 Call dword ptr [760E1180] :760F21CE 85C0 test eax, eax :760F21D0 740D je 760F21DF * Possible StringData Ref from Code Obj ->"lpszS1 is NULL" | :760F21D2 68A08D0E76 push 760E8DA0 :760F21D7 56 push esi :760F21D8 E84EADFFFF call 760ECF2B :760F21DD 59 pop ecx :760F21DE 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F21B8(C), :760F21D0(C) | :760F21DF 83CEFF or esi, FFFFFFFF :760F21E2 E98F26FFFF jmp 760E4876 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4870(C) | :760F21E7 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"_StrLen" | :760F21E9 68C88D0E76 push 760E8DC8 :760F21EE 6889000000 push 00000089 :760F21F3 68D0DF0F76 push 760FDFD0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F21F8 FF1580110E76 Call dword ptr [760E1180] :760F21FE 85C0 test eax, eax :760F2200 0F847026FFFF je 760E4876 :760F2206 56 push esi * Possible StringData Ref from Code Obj ->"dwRetVal=%ld" | :760F2207 68B88D0E76 push 760E8DB8 :760F220C 6A00 push 00000000 :760F220E E818ADFFFF call 760ECF2B :760F2213 83C40C add esp, 0000000C :760F2216 E95B26FFFF jmp 760E4876 * Referenced by a CALL at Addresses: |:760EB110 , :760EB23F , :760ED574 , :760EE116 | :760F221B 55 push ebp :760F221C 8BEC mov ebp, esp :760F221E 51 push ecx :760F221F 51 push ecx :760F2220 53 push ebx :760F2221 56 push esi :760F2222 57 push edi :760F2223 8B7D08 mov edi, dword ptr [ebp+08] :760F2226 8D4508 lea eax, dword ptr [ebp+08] :760F2229 50 push eax :760F222A 57 push edi * Reference To: VERSION.GetFileVersionInfoSizeA, Ord:0001h | :760F222B E808090000 Call 760F2B38 :760F2230 8BF0 mov esi, eax :760F2232 85F6 test esi, esi :760F2234 7552 jne 760F2288 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F2236 FF15A0110E76 Call dword ptr [760E11A0] :760F223C 8BF0 mov esi, eax :760F223E A184110E76 mov eax, dword ptr [760E1184] :760F2243 F60004 test byte ptr [eax], 04 :760F2246 742C je 760F2274 :760F2248 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"GetFileVersion" | :760F224A 687C8E0E76 push 760E8E7C :760F224F 6A42 push 00000042 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F2251 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2256 FF1580110E76 Call dword ptr [760E1180] :760F225C 85C0 test eax, eax :760F225E 7414 je 760F2274 :760F2260 56 push esi :760F2261 57 push edi * Possible StringData Ref from Code Obj ->"Error in GetFileVersionInfoSize " ->"for %s ec=%d" | :760F2262 684C8E0E76 push 760E8E4C :760F2267 6807030000 push 00000307 :760F226C E8BAACFFFF call 760ECF2B :760F2271 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2246(C), :760F225E(C) | :760F2274 8B450C mov eax, dword ptr [ebp+0C] :760F2277 BE34422323 mov esi, 23234234 :760F227C 832000 and dword ptr [eax], 00000000 :760F227F 83600400 and dword ptr [eax+04], 00000000 :760F2283 E91D010000 jmp 760F23A5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2234(C) | :760F2288 56 push esi :760F2289 E8A7F6FEFF call 760E1935 :760F228E 8BD8 mov ebx, eax :760F2290 85DB test ebx, ebx :760F2292 753D jne 760F22D1 :760F2294 A184110E76 mov eax, dword ptr [760E1184] :760F2299 F60004 test byte ptr [eax], 04 :760F229C 7429 je 760F22C7 :760F229E 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"GetFileVersion" | :760F22A0 687C8E0E76 push 760E8E7C :760F22A5 6A4D push 0000004D * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F22A7 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F22AC FF1580110E76 Call dword ptr [760E1180] :760F22B2 85C0 test eax, eax :760F22B4 7411 je 760F22C7 * Possible StringData Ref from Code Obj ->"Error allocating memory from the " ->"heap" | :760F22B6 68248E0E76 push 760E8E24 :760F22BB 6807030000 push 00000307 :760F22C0 E866ACFFFF call 760ECF2B :760F22C5 59 pop ecx :760F22C6 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F229C(C), :760F22B4(C) | :760F22C7 BE4F050000 mov esi, 0000054F :760F22CC E9CA000000 jmp 760F239B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2292(C) | :760F22D1 53 push ebx :760F22D2 56 push esi :760F22D3 FF7508 push [ebp+08] :760F22D6 57 push edi * Reference To: VERSION.GetFileVersionInfoA, Ord:0000h | :760F22D7 E856080000 Call 760F2B32 :760F22DC 85C0 test eax, eax :760F22DE 7545 jne 760F2325 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F22E0 FF15A0110E76 Call dword ptr [760E11A0] :760F22E6 8BF0 mov esi, eax :760F22E8 A184110E76 mov eax, dword ptr [760E1184] :760F22ED F60004 test byte ptr [eax], 04 :760F22F0 742C je 760F231E :760F22F2 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"GetFileVersion" | :760F22F4 687C8E0E76 push 760E8E7C :760F22F9 6A56 push 00000056 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F22FB 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2300 FF1580110E76 Call dword ptr [760E1180] :760F2306 85C0 test eax, eax :760F2308 7414 je 760F231E :760F230A 56 push esi :760F230B 57 push edi * Possible StringData Ref from Code Obj ->"Error in GetFileVersionInfo for " ->"%s. ec=%d" | :760F230C 68F88D0E76 push 760E8DF8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F236D(U) | :760F2311 6807030000 push 00000307 :760F2316 E810ACFFFF call 760ECF2B :760F231B 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F22F0(C), :760F2308(C), :760F234C(C), :760F2364(C) | :760F231E BE34422323 mov esi, 23234234 :760F2323 EB76 jmp 760F239B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F22DE(C) | :760F2325 8D45F8 lea eax, dword ptr [ebp-08] :760F2328 50 push eax :760F2329 8D45FC lea eax, dword ptr [ebp-04] :760F232C 50 push eax :760F232D 68DC4F0E76 push 760E4FDC :760F2332 53 push ebx * Reference To: VERSION.VerQueryValueA, Ord:000Ah | :760F2333 E8F4070000 Call 760F2B2C :760F2338 85C0 test eax, eax :760F233A 7533 jne 760F236F * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F233C FF15A0110E76 Call dword ptr [760E11A0] :760F2342 8BF0 mov esi, eax :760F2344 A184110E76 mov eax, dword ptr [760E1184] :760F2349 F60004 test byte ptr [eax], 04 :760F234C 74D0 je 760F231E :760F234E 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"GetFileVersion" | :760F2350 687C8E0E76 push 760E8E7C :760F2355 6A64 push 00000064 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F2357 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F235C FF1580110E76 Call dword ptr [760E1180] :760F2362 85C0 test eax, eax :760F2364 74B8 je 760F231E :760F2366 56 push esi :760F2367 57 push edi * Possible StringData Ref from Code Obj ->"Error in VerQueryValue for %s. " ->"ec=%d" | :760F2368 68D08D0E76 push 760E8DD0 :760F236D EBA2 jmp 760F2311 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F233A(C) | :760F236F 8B7DFC mov edi, dword ptr [ebp-04] :760F2372 8B750C mov esi, dword ptr [ebp+0C] :760F2375 6A20 push 00000020 :760F2377 8B4708 mov eax, dword ptr [edi+08] :760F237A 59 pop ecx :760F237B 8906 mov dword ptr [esi], eax :760F237D 83660400 and dword ptr [esi+04], 00000000 :760F2381 8B06 mov eax, dword ptr [esi] :760F2383 8B5604 mov edx, dword ptr [esi+04] :760F2386 E8FC630000 call 760F8787 :760F238B 8906 mov dword ptr [esi], eax :760F238D 895604 mov dword ptr [esi+04], edx :760F2390 8B470C mov eax, dword ptr [edi+0C] :760F2393 0106 add dword ptr [esi], eax :760F2395 83560400 adc dword ptr [esi+04], 00000000 :760F2399 33F6 xor esi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F22CC(U), :760F2323(U) | :760F239B 85DB test ebx, ebx :760F239D 7406 je 760F23A5 :760F239F 53 push ebx :760F23A0 E84AF6FEFF call 760E19EF * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2283(U), :760F239D(C) | :760F23A5 8BC6 mov eax, esi :760F23A7 5F pop edi :760F23A8 5E pop esi :760F23A9 5B pop ebx :760F23AA C9 leave :760F23AB C20800 ret 0008 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3859(C) | :760F23AE 53 push ebx :760F23AF 55 push ebp :760F23B0 6892000000 push 00000092 :760F23B5 57 push edi :760F23B6 FFD6 call esi :760F23B8 85C0 test eax, eax :760F23BA 0F849F14FFFF je 760E385F :760F23C0 FF742414 push [esp+14] * Possible StringData Ref from Code Obj ->"Checking for %s" | :760F23C4 68D08E0E76 push 760E8ED0 :760F23C9 6807030000 push 00000307 :760F23CE E858ABFFFF call 760ECF2B :760F23D3 83C40C add esp, 0000000C :760F23D6 E98414FFFF jmp 760E385F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E387F(C) | :760F23DB 53 push ebx :760F23DC 55 push ebp :760F23DD 6899000000 push 00000099 :760F23E2 57 push edi :760F23E3 FFD6 call esi :760F23E5 85C0 test eax, eax :760F23E7 0F849814FFFF je 760E3885 :760F23ED FF742414 push [esp+14] * Possible StringData Ref from Code Obj ->"GetFileAttributes failed 0x%x" | :760F23F1 68B08E0E76 push 760E8EB0 :760F23F6 6807030000 push 00000307 :760F23FB E82BABFFFF call 760ECF2B :760F2400 83C40C add esp, 0000000C :760F2403 E97D14FFFF jmp 760E3885 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3895(C) | :760F2408 8418 test byte ptr [eax], bl :760F240A 0F847514FFFF je 760E3885 :760F2410 53 push ebx :760F2411 55 push ebp :760F2412 68A0000000 push 000000A0 :760F2417 57 push edi :760F2418 FFD6 call esi :760F241A 85C0 test eax, eax :760F241C 0F846314FFFF je 760E3885 * Possible StringData Ref from Code Obj ->"It is a Directory " | :760F2422 689C8E0E76 push 760E8E9C :760F2427 6807030000 push 00000307 :760F242C E8FAAAFFFF call 760ECF2B :760F2431 59 pop ecx :760F2432 59 pop ecx :760F2433 E94D14FFFF jmp 760E3885 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E389D(C) | :760F2438 53 push ebx :760F2439 55 push ebp :760F243A 68A5000000 push 000000A5 :760F243F 57 push edi :760F2440 FFD6 call esi :760F2442 85C0 test eax, eax :760F2444 0F845914FFFF je 760E38A3 * Possible StringData Ref from Code Obj ->"File exists" | :760F244A 688C8E0E76 push 760E8E8C :760F244F 6807030000 push 00000307 :760F2454 E8D2AAFFFF call 760ECF2B :760F2459 59 pop ecx :760F245A 59 pop ecx :760F245B E94314FFFF jmp 760E38A3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1CCA(C) | :760F2460 53 push ebx :760F2461 55 push ebp :760F2462 68C2000000 push 000000C2 :760F2467 57 push edi :760F2468 FFD6 call esi :760F246A 85C0 test eax, eax :760F246C 0F845EF8FEFF je 760E1CD0 :760F2472 FF742414 push [esp+14] * Possible StringData Ref from Code Obj ->" Checking for %s" | :760F2476 68108F0E76 push 760E8F10 :760F247B 6807030000 push 00000307 :760F2480 E8A6AAFFFF call 760ECF2B :760F2485 83C40C add esp, 0000000C :760F2488 E943F8FEFF jmp 760E1CD0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1CDD(C) | :760F248D A184110E76 mov eax, dword ptr [760E1184] :760F2492 8418 test byte ptr [eax], bl :760F2494 7474 je 760F250A :760F2496 53 push ebx :760F2497 55 push ebp :760F2498 68C8000000 push 000000C8 :760F249D 57 push edi :760F249E FFD6 call esi :760F24A0 85C0 test eax, eax :760F24A2 7466 je 760F250A * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F24A4 FF15A0110E76 Call dword ptr [760E11A0] :760F24AA 50 push eax * Possible StringData Ref from Code Obj ->"GetFileAttributes failed 0x%x" | :760F24AB 68B08E0E76 push 760E8EB0 :760F24B0 6807030000 push 00000307 :760F24B5 E871AAFFFF call 760ECF2B :760F24BA 83C40C add esp, 0000000C :760F24BD EB4B jmp 760F250A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1CF2(C) | :760F24BF 53 push ebx :760F24C0 55 push ebp :760F24C1 68D0000000 push 000000D0 :760F24C6 57 push edi :760F24C7 FFD6 call esi :760F24C9 85C0 test eax, eax :760F24CB 0F8427F8FEFF je 760E1CF8 * Possible StringData Ref from Code Obj ->"Directory exists " | :760F24D1 68FC8E0E76 push 760E8EFC :760F24D6 6807030000 push 00000307 :760F24DB E84BAAFFFF call 760ECF2B :760F24E0 59 pop ecx :760F24E1 59 pop ecx :760F24E2 E911F8FEFF jmp 760E1CF8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1CEA(C) | :760F24E7 8418 test byte ptr [eax], bl :760F24E9 741F je 760F250A :760F24EB 53 push ebx :760F24EC 55 push ebp :760F24ED 68D5000000 push 000000D5 :760F24F2 57 push edi :760F24F3 FFD6 call esi :760F24F5 85C0 test eax, eax :760F24F7 7411 je 760F250A * Possible StringData Ref from Code Obj ->"Directory does not exist" | :760F24F9 68E08E0E76 push 760E8EE0 :760F24FE 6807030000 push 00000307 :760F2503 E823AAFFFF call 760ECF2B :760F2508 59 pop ecx :760F2509 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2494(C), :760F24A2(C), :760F24BD(U), :760F24E9(C), :760F24F7(C) | :760F250A 33C0 xor eax, eax :760F250C E9EAF7FEFF jmp 760E1CFB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E305E(C) | :760F2511 A184110E76 mov eax, dword ptr [760E1184] :760F2516 F60004 test byte ptr [eax], 04 :760F2519 0F84650BFFFF je 760E3084 :760F251F 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SFPConvertToUnicode" | :760F2521 68248F0E76 push 760E8F24 :760F2526 68EA000000 push 000000EA * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F252B 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2530 FF1580110E76 Call dword ptr [760E1180] :760F2536 85C0 test eax, eax :760F2538 0F84460BFFFF je 760E3084 * Possible StringData Ref from Code Obj ->"Not enough memory" | :760F253E 68187A0E76 push 760E7A18 :760F2543 6807030000 push 00000307 :760F2548 E8DEA9FFFF call 760ECF2B :760F254D 59 pop ecx :760F254E 59 pop ecx :760F254F E9300BFFFF jmp 760E3084 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E307E(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F2554 FF15A0110E76 Call dword ptr [760E11A0] :760F255A 8BF0 mov esi, eax :760F255C A184110E76 mov eax, dword ptr [760E1184] :760F2561 F60004 test byte ptr [eax], 04 :760F2564 742E je 760F2594 :760F2566 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SFPConvertToUnicode" | :760F2568 68248F0E76 push 760E8F24 :760F256D 68F9000000 push 000000F9 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F2572 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2577 FF1580110E76 Call dword ptr [760E1180] :760F257D 85C0 test eax, eax :760F257F 7413 je 760F2594 :760F2581 56 push esi * Possible StringData Ref from Code Obj ->"Failed to do conversion ec=%d" | :760F2582 68946F0E76 push 760E6F94 :760F2587 6807030000 push 00000307 :760F258C E89AA9FFFF call 760ECF2B :760F2591 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2564(C), :760F257F(C) | :760F2594 57 push edi :760F2595 E855F4FEFF call 760E19EF :760F259A 33FF xor edi, edi :760F259C E9E30AFFFF jmp 760E3084 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2914(C) | :760F25A1 A184110E76 mov eax, dword ptr [760E1184] :760F25A6 F60004 test byte ptr [eax], 04 :760F25A9 0F847603FFFF je 760E2925 :760F25AF 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SFPDuplicateString" | :760F25B1 68388F0E76 push 760E8F38 :760F25B6 6813010000 push 00000113 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F25BB 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F25C0 FF1580110E76 Call dword ptr [760E1180] :760F25C6 85C0 test eax, eax :760F25C8 0F845703FFFF je 760E2925 * Possible StringData Ref from Code Obj ->"Not enough memory" | :760F25CE 68187A0E76 push 760E7A18 :760F25D3 6807030000 push 00000307 :760F25D8 E84EA9FFFF call 760ECF2B :760F25DD 59 pop ecx :760F25DE 59 pop ecx :760F25DF E94103FFFF jmp 760E2925 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2AB0(C) | :760F25E4 A184110E76 mov eax, dword ptr [760E1184] :760F25E9 F60004 test byte ptr [eax], 04 :760F25EC 0F84E704FFFF je 760E2AD9 :760F25F2 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SFPConvertToANSI" | :760F25F4 684C8F0E76 push 760E8F4C :760F25F9 682E010000 push 0000012E * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F25FE 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2603 FF1580110E76 Call dword ptr [760E1180] :760F2609 85C0 test eax, eax :760F260B 0F84C804FFFF je 760E2AD9 * Possible StringData Ref from Code Obj ->"Not enough memory" | :760F2611 68187A0E76 push 760E7A18 :760F2616 6807030000 push 00000307 :760F261B E80BA9FFFF call 760ECF2B :760F2620 59 pop ecx :760F2621 59 pop ecx :760F2622 E9B204FFFF jmp 760E2AD9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2ACE(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F2627 FF15A0110E76 Call dword ptr [760E11A0] :760F262D 8BF0 mov esi, eax :760F262F A184110E76 mov eax, dword ptr [760E1184] :760F2634 F60004 test byte ptr [eax], 04 :760F2637 742E je 760F2667 :760F2639 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"SFPConvertToANSI" | :760F263B 684C8F0E76 push 760E8F4C :760F2640 6840010000 push 00000140 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F2645 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F264A FF1580110E76 Call dword ptr [760E1180] :760F2650 85C0 test eax, eax :760F2652 7413 je 760F2667 :760F2654 56 push esi * Possible StringData Ref from Code Obj ->"Failed to do conversion ec=%d" | :760F2655 68946F0E76 push 760E6F94 :760F265A 6807030000 push 00000307 :760F265F E8C7A8FFFF call 760ECF2B :760F2664 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2637(C), :760F2652(C) | :760F2667 53 push ebx :760F2668 E882F3FEFF call 760E19EF :760F266D 33DB xor ebx, ebx :760F266F E96504FFFF jmp 760E2AD9 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2B9B(C), :760E2BC4(C) | :760F2674 A184110E76 mov eax, dword ptr [760E1184] :760F2679 F60002 test byte ptr [eax], 02 :760F267C 0F843605FFFF je 760E2BB8 :760F2682 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"GetNextInteger" | :760F2684 687C8F0E76 push 760E8F7C :760F2689 6881010000 push 00000181 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F268E 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2693 FF1580110E76 Call dword ptr [760E1180] :760F2699 85C0 test eax, eax :760F269B 0F841705FFFF je 760E2BB8 * Possible StringData Ref from Code Obj ->"Cannot find start of value" | :760F26A1 68608F0E76 push 760E8F60 :760F26A6 6807030000 push 00000307 :760F26AB E87BA8FFFF call 760ECF2B :760F26B0 59 pop ecx :760F26B1 59 pop ecx :760F26B2 E90105FFFF jmp 760E2BB8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2B00(C) | :760F26B7 A184110E76 mov eax, dword ptr [760E1184] :760F26BC F60002 test byte ptr [eax], 02 :760F26BF 0F84AC04FFFF je 760E2B71 :760F26C5 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"MakeVersionFromString" | :760F26C7 68A48F0E76 push 760E8FA4 :760F26CC 68A0010000 push 000001A0 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F26D1 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F26D6 FF1580110E76 Call dword ptr [760E1180] :760F26DC 85C0 test eax, eax :760F26DE 0F848D04FFFF je 760E2B71 * Possible StringData Ref from Code Obj ->"Not enough memory" | :760F26E4 68187A0E76 push 760E7A18 :760F26E9 6807030000 push 00000307 :760F26EE E838A8FFFF call 760ECF2B :760F26F3 59 pop ecx :760F26F4 59 pop ecx :760F26F5 E97704FFFF jmp 760E2B71 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2B20(C) | :760F26FA A184110E76 mov eax, dword ptr [760E1184] :760F26FF F60002 test byte ptr [eax], 02 :760F2702 7431 je 760F2735 :760F2704 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"MakeVersionFromString" | :760F2706 68A48F0E76 push 760E8FA4 :760F270B 68AF010000 push 000001AF * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F2710 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2715 FF1580110E76 Call dword ptr [760E1180] :760F271B 85C0 test eax, eax :760F271D 7416 je 760F2735 * Possible StringData Ref from Code Obj ->"GetNextInteger failed" | :760F271F 688C8F0E76 push 760E8F8C :760F2724 6807030000 push 00000307 :760F2729 E8FDA7FFFF call 760ECF2B :760F272E 59 pop ecx :760F272F 59 pop ecx :760F2730 E92B04FFFF jmp 760E2B60 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2B64(C), :760F2702(C), :760F271D(C) | :760F2735 33DB xor ebx, ebx :760F2737 895DF0 mov dword ptr [ebp-10], ebx :760F273A E92B04FFFF jmp 760E2B6A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E22C9(C) | :760F273F A184110E76 mov eax, dword ptr [760E1184] :760F2744 F60002 test byte ptr [eax], 02 :760F2747 7471 je 760F27BA :760F2749 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"WriteRegKey" | :760F274B 68F48F0E76 push 760E8FF4 :760F2750 68E8010000 push 000001E8 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F2755 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F275A FF1580110E76 Call dword ptr [760E1180] :760F2760 85C0 test eax, eax :760F2762 7456 je 760F27BA :760F2764 57 push edi * Possible StringData Ref from Code Obj ->"RegCreateKeyEx error 0x%x" | :760F2765 68D88F0E76 push 760E8FD8 :760F276A 6807030000 push 00000307 :760F276F E8B7A7FFFF call 760ECF2B :760F2774 83C40C add esp, 0000000C :760F2777 EB41 jmp 760F27BA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E22E9(C) | :760F2779 A184110E76 mov eax, dword ptr [760E1184] :760F277E F60002 test byte ptr [eax], 02 :760F2781 742E je 760F27B1 :760F2783 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"WriteRegKey" | :760F2785 68F48F0E76 push 760E8FF4 :760F278A 68F5010000 push 000001F5 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F278F 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2794 FF1580110E76 Call dword ptr [760E1180] :760F279A 85C0 test eax, eax :760F279C 7413 je 760F27B1 :760F279E 57 push edi * Possible StringData Ref from Code Obj ->"RegSetValueEx error 0x%x" | :760F279F 68BC8F0E76 push 760E8FBC :760F27A4 6807030000 push 00000307 :760F27A9 E87DA7FFFF call 760ECF2B :760F27AE 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2781(C), :760F279C(C) | :760F27B1 FF7510 push [ebp+10] * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760F27B4 FF15B0120E76 Call dword ptr [760E12B0] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2747(C), :760F2762(C), :760F2777(U) | :760F27BA 33C0 xor eax, eax :760F27BC E93AFBFEFF jmp 760E22FB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E36B9(C) | :760F27C1 FF7518 push [ebp+18] :760F27C4 FF7514 push [ebp+14] :760F27C7 FF7510 push [ebp+10] :760F27CA FF7520 push [ebp+20] :760F27CD FF751C push [ebp+1C] :760F27D0 E8C9FAFEFF call 760E229E :760F27D5 83F801 cmp eax, 00000001 :760F27D8 7519 jne 760F27F3 :760F27DA FF7518 push [ebp+18] :760F27DD FF7514 push [ebp+14] :760F27E0 FF7510 push [ebp+10] :760F27E3 FF750C push [ebp+0C] :760F27E6 FF7508 push [ebp+08] :760F27E9 E8C708FFFF call 760E30B5 :760F27EE E9CF0EFFFF jmp 760E36C2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F27D8(C) | :760F27F3 33C0 xor eax, eax :760F27F5 E9C80EFFFF jmp 760E36C2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E30D5(C) | :760F27FA 6A04 push 00000004 :760F27FC 53 push ebx :760F27FD 6858020000 push 00000258 :760F2802 57 push edi :760F2803 FFD6 call esi :760F2805 85C0 test eax, eax :760F2807 0F84CE08FFFF je 760E30DB :760F280D FF7514 push [ebp+14] :760F2810 FF7510 push [ebp+10] * Possible StringData Ref from Code Obj ->"Trying to open %s %s" | :760F2813 685C900E76 push 760E905C :760F2818 6807030000 push 00000307 :760F281D E809A7FFFF call 760ECF2B :760F2822 83C410 add esp, 00000010 :760F2825 E9B108FFFF jmp 760E30DB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E30F9(C) | :760F282A A184110E76 mov eax, dword ptr [760E1184] :760F282F F60002 test byte ptr [eax], 02 :760F2832 0F841909FFFF je 760E3151 :760F2838 6A02 push 00000002 :760F283A 53 push ebx :760F283B 6864020000 push 00000264 :760F2840 57 push edi :760F2841 FFD6 call esi :760F2843 85C0 test eax, eax :760F2845 0F840609FFFF je 760E3151 :760F284B FF7510 push [ebp+10] * Possible StringData Ref from Code Obj ->"RegOpenKeyEx open error 0x%x" | :760F284E 683C900E76 push 760E903C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2880(U) | :760F2853 6807030000 push 00000307 :760F2858 E8CEA6FFFF call 760ECF2B :760F285D 83C40C add esp, 0000000C :760F2860 E9EC08FFFF jmp 760E3151 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E314B(C) | :760F2865 6A02 push 00000002 :760F2867 53 push ebx :760F2868 6872020000 push 00000272 :760F286D 57 push edi :760F286E FFD6 call esi :760F2870 85C0 test eax, eax :760F2872 0F84D908FFFF je 760E3151 :760F2878 FF7510 push [ebp+10] * Possible StringData Ref from Code Obj ->"RegQueryValueEx failed error 0x%x" | :760F287B 6818900E76 push 760E9018 :760F2880 EBD1 jmp 760F2853 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E312D(C) | :760F2882 A184110E76 mov eax, dword ptr [760E1184] :760F2887 F60002 test byte ptr [eax], 02 :760F288A 0F84C108FFFF je 760E3151 :760F2890 6A02 push 00000002 :760F2892 53 push ebx :760F2893 687B020000 push 0000027B :760F2898 57 push edi :760F2899 FFD6 call esi :760F289B 85C0 test eax, eax :760F289D 0F84AE08FFFF je 760E3151 :760F28A3 FF7518 push [ebp+18] :760F28A6 FF75F8 push [ebp-08] * Possible StringData Ref from Code Obj ->"RegType is %d, not %d" | :760F28A9 6800900E76 push 760E9000 :760F28AE 6807030000 push 00000307 :760F28B3 E873A6FFFF call 760ECF2B :760F28B8 83C410 add esp, 00000010 :760F28BB E99108FFFF jmp 760E3151 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E424B(C) | :760F28C0 A184110E76 mov eax, dword ptr [760E1184] :760F28C5 F60002 test byte ptr [eax], 02 :760F28C8 0F84651AFFFF je 760E4333 :760F28CE 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"TrimString" | :760F28D0 68E0900E76 push 760E90E0 :760F28D5 68EC020000 push 000002EC * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F28DA 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F28DF FF1580110E76 Call dword ptr [760E1180] :760F28E5 85C0 test eax, eax :760F28E7 0F84461AFFFF je 760E4333 * Possible StringData Ref from Code Obj ->"NULL String passed to trim string" | :760F28ED 68BC900E76 push 760E90BC :760F28F2 6807030000 push 00000307 :760F28F7 E82FA6FFFF call 760ECF2B :760F28FC 59 pop ecx :760F28FD 59 pop ecx :760F28FE E9301AFFFF jmp 760E4333 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4278(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F2903 FF15A0110E76 Call dword ptr [760E11A0] :760F2909 8BF0 mov esi, eax :760F290B A184110E76 mov eax, dword ptr [760E1184] :760F2910 F60002 test byte ptr [eax], 02 :760F2913 0F841A1AFFFF je 760E4333 :760F2919 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"TrimString" | :760F291B 68E0900E76 push 760E90E0 :760F2920 6801030000 push 00000301 :760F2925 E98D000000 jmp 760F29B7 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E428B(C), :760E4295(C), :760E429F(C), :760E42A9(C) | :760F292A 46 inc esi :760F292B 46 inc esi :760F292C E95319FFFF jmp 760E4284 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E42B9(C) | :760F2931 A184110E76 mov eax, dword ptr [760E1184] :760F2936 F60004 test byte ptr [eax], 04 :760F2939 0F84F419FFFF je 760E4333 :760F293F 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"TrimString" | :760F2941 68E0900E76 push 760E90E0 :760F2946 6818030000 push 00000318 :760F294B EB2D jmp 760F297A * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E42CC(C), :760E42D6(C), :760E42E0(C), :760E42EA(C) | :760F294D 668939 mov word ptr [ecx], di :760F2950 48 dec eax :760F2951 49 dec ecx :760F2952 49 dec ecx :760F2953 3BC7 cmp eax, edi :760F2955 0F8D6A19FFFF jnl 760E42C5 :760F295B E99019FFFF jmp 760E42F0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E42F3(C) | :760F2960 A184110E76 mov eax, dword ptr [760E1184] :760F2965 F60004 test byte ptr [eax], 04 :760F2968 0F84C519FFFF je 760E4333 :760F296E 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"TrimString" | :760F2970 68E0900E76 push 760E90E0 :760F2975 6829030000 push 00000329 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F294B(U) | * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F297A 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F297F FF1580110E76 Call dword ptr [760E1180] :760F2985 85C0 test eax, eax :760F2987 0F84A619FFFF je 760E4333 :760F298D 57 push edi * Possible StringData Ref from Code Obj ->"Empty string in Trim String." | :760F298E 689C900E76 push 760E909C :760F2993 EB3B jmp 760F29D0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E432D(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F2995 FF15A0110E76 Call dword ptr [760E11A0] :760F299B 8BF0 mov esi, eax :760F299D A184110E76 mov eax, dword ptr [760E1184] :760F29A2 F60002 test byte ptr [eax], 02 :760F29A5 0F848819FFFF je 760E4333 :760F29AB 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"TrimString" | :760F29AD 68E0900E76 push 760E90E0 :760F29B2 6842030000 push 00000342 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2925(U) | * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F29B7 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F29BC FF1580110E76 Call dword ptr [760E1180] :760F29C2 85C0 test eax, eax :760F29C4 0F846919FFFF je 760E4333 :760F29CA 56 push esi * Possible StringData Ref from Code Obj ->"MultiByteToWideChar( ) failed- " ->" ec--%d" | :760F29CB 6874900E76 push 760E9074 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2993(U) | :760F29D0 6807030000 push 00000307 :760F29D5 E851A5FFFF call 760ECF2B :760F29DA 83C40C add esp, 0000000C :760F29DD E95119FFFF jmp 760E4333 * Referenced by a CALL at Addresses: |:760ED610 , :760ED702 | :760F29E2 56 push esi :760F29E3 57 push edi :760F29E4 8B7C2410 mov edi, dword ptr [esp+10] :760F29E8 57 push edi :760F29E9 E83418FFFF call 760E4222 :760F29EE 8B4C2414 mov ecx, dword ptr [esp+14] :760F29F2 3BC8 cmp ecx, eax :760F29F4 7221 jb 760F2A17 :760F29F6 83C9FF or ecx, FFFFFFFF :760F29F9 33C0 xor eax, eax :760F29FB F2 repnz :760F29FC AE scasb :760F29FD F7D1 not ecx :760F29FF 2BF9 sub edi, ecx :760F2A01 8BC1 mov eax, ecx :760F2A03 8BF7 mov esi, edi :760F2A05 8B7C240C mov edi, dword ptr [esp+0C] :760F2A09 C1E902 shr ecx, 02 :760F2A0C F3 repz :760F2A0D A5 movsd :760F2A0E 8BC8 mov ecx, eax :760F2A10 83E103 and ecx, 00000003 :760F2A13 F3 repz :760F2A14 A4 movsb :760F2A15 EB17 jmp 760F2A2E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F29F4(C) | :760F2A17 8D71FF lea esi, dword ptr [ecx-01] :760F2A1A 56 push esi :760F2A1B 57 push edi :760F2A1C 8B7C2414 mov edi, dword ptr [esp+14] :760F2A20 57 push edi * Reference To: MSVCRT.strncpy, Ord:02BEh | :760F2A21 FF1540100E76 Call dword ptr [760E1040] :760F2A27 83C40C add esp, 0000000C :760F2A2A 80243700 and byte ptr [edi+esi], 00 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2A15(U) | :760F2A2E 6A01 push 00000001 :760F2A30 58 pop eax :760F2A31 5F pop edi :760F2A32 5E pop esi :760F2A33 C20C00 ret 000C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E55B3(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F2A36 FF15A0110E76 Call dword ptr [760E11A0] :760F2A3C 8BF0 mov esi, eax :760F2A3E A184110E76 mov eax, dword ptr [760E1184] :760F2A43 F60002 test byte ptr [eax], 02 :760F2A46 0F84F62BFFFF je 760E5642 :760F2A4C 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::GetField" | :760F2A4E 68EC900E76 push 760E90EC :760F2A53 68E6030000 push 000003E6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2AA5(U) | * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F2A58 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2A5D FF1580110E76 Call dword ptr [760E1180] :760F2A63 85C0 test eax, eax :760F2A65 0F84D72BFFFF je 760E5642 :760F2A6B 56 push esi * Possible StringData Ref from Code Obj ->"MultiByteToWideChar( ) failed- " ->" ec--%d" | :760F2A6C 6874900E76 push 760E9074 :760F2A71 6807030000 push 00000307 :760F2A76 E8B0A4FFFF call 760ECF2B :760F2A7B 83C40C add esp, 0000000C :760F2A7E E9BF2BFFFF jmp 760E5642 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5639(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F2A83 FF15A0110E76 Call dword ptr [760E11A0] :760F2A89 8BF0 mov esi, eax :760F2A8B A184110E76 mov eax, dword ptr [760E1184] :760F2A90 F60002 test byte ptr [eax], 02 :760F2A93 0F84A92BFFFF je 760E5642 :760F2A99 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::GetField" | :760F2A9B 68EC900E76 push 760E90EC :760F2AA0 6820040000 push 00000420 :760F2AA5 EBB1 jmp 760F2A58 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E28B8(C) | :760F2AA7 A184110E76 mov eax, dword ptr [760E1184] :760F2AAC F60002 test byte ptr [eax], 02 :760F2AAF 0F84E4FDFEFF je 760E2899 :760F2AB5 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"GetCurrentCodePage" | :760F2AB7 6844910E76 push 760E9144 :760F2ABC 684C040000 push 0000044C * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F2AC1 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2AC6 FF1580110E76 Call dword ptr [760E1180] :760F2ACC 85C0 test eax, eax :760F2ACE 0F84C5FDFEFF je 760E2899 :760F2AD4 56 push esi * Possible StringData Ref from Code Obj ->"Error querying code locale." | :760F2AD5 6828910E76 push 760E9128 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2B1F(U) | :760F2ADA 6807030000 push 00000307 :760F2ADF E847A4FFFF call 760ECF2B :760F2AE4 83C40C add esp, 0000000C :760F2AE7 E9ADFDFEFF jmp 760E2899 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E28D1(C) | :760F2AEC A184110E76 mov eax, dword ptr [760E1184] :760F2AF1 F60002 test byte ptr [eax], 02 :760F2AF4 0F849FFDFEFF je 760E2899 :760F2AFA 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"GetCurrentCodePage" | :760F2AFC 6844910E76 push 760E9144 :760F2B01 6852040000 push 00000452 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\commonlib\commonlib.cpp" | :760F2B06 68A0D80F76 push 760FD8A0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2B0B FF1580110E76 Call dword ptr [760E1180] :760F2B11 85C0 test eax, eax :760F2B13 0F8480FDFEFF je 760E2899 :760F2B19 56 push esi * Possible StringData Ref from Code Obj ->"Error getting code page." | :760F2B1A 680C910E76 push 760E910C :760F2B1F EBB9 jmp 760F2ADA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E28EC(C) | :760F2B21 8935ACD90F76 mov dword ptr [760FD9AC], esi :760F2B27 E9C6FDFEFF jmp 760E28F2 * Referenced by a CALL at Address: |:760F2333 | * Reference To: VERSION.VerQueryValueA, Ord:000Ah | :760F2B2C FF25C0100E76 Jmp dword ptr [760E10C0] * Referenced by a CALL at Address: |:760F22D7 | * Reference To: VERSION.GetFileVersionInfoA, Ord:0000h | :760F2B32 FF25B8100E76 Jmp dword ptr [760E10B8] * Referenced by a CALL at Address: |:760F222B | * Reference To: VERSION.GetFileVersionInfoSizeA, Ord:0001h | :760F2B38 FF25BC100E76 Jmp dword ptr [760E10BC] :760F2B3E 56 push esi :760F2B3F 8BF1 mov esi, ecx :760F2B41 E8F4F7FEFF call 760E233A :760F2B46 F644240801 test [esp+08], 01 :760F2B4B 7407 je 760F2B54 :760F2B4D 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F2B4E E8F8EDFEFF Call 760E194B :760F2B53 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2B4B(C) | :760F2B54 8BC6 mov eax, esi :760F2B56 5E pop esi :760F2B57 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3E31(C), :760E3E44(C), :760E3E53(C) | :760F2B5A 33C0 xor eax, eax :760F2B5C E90513FFFF jmp 760E3E66 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3E9C(U) | :760F2B61 8B08 mov ecx, dword ptr [eax] :760F2B63 50 push eax :760F2B64 FF5108 call [ecx+08] :760F2B67 895FE8 mov dword ptr [edi-18], ebx :760F2B6A E90B13FFFF jmp 760E3E7A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3E7E(C) | :760F2B6F 8B08 mov ecx, dword ptr [eax] :760F2B71 50 push eax :760F2B72 FF5108 call [ecx+08] :760F2B75 891F mov dword ptr [edi], ebx :760F2B77 E90813FFFF jmp 760E3E84 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3E89(C) | :760F2B7C 8B08 mov ecx, dword ptr [eax] :760F2B7E 50 push eax :760F2B7F FF5108 call [ecx+08] :760F2B82 895FF4 mov dword ptr [edi-0C], ebx :760F2B85 E90513FFFF jmp 760E3E8F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3EB8(C) | :760F2B8A 83FF01 cmp edi, 00000001 :760F2B8D 0F842B13FFFF je 760E3EBE :760F2B93 A184110E76 mov eax, dword ptr [760E1184] :760F2B98 F60002 test byte ptr [eax], 02 :760F2B9B 742A je 760F2BC7 :760F2B9D 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"Init" | :760F2B9F 6894910E76 push 760E9194 :760F2BA4 68DE000000 push 000000DE * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2BA9 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2BAE FF1580110E76 Call dword ptr [760E1180] :760F2BB4 85C0 test eax, eax :760F2BB6 740F je 760F2BC7 :760F2BB8 57 push edi * Possible StringData Ref from Code Obj ->"CoInitialize Failed 0x%x" | :760F2BB9 6878910E76 push 760E9178 :760F2BBE 56 push esi :760F2BBF E867A3FFFF call 760ECF2B :760F2BC4 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2B9B(C), :760F2BB6(C) | :760F2BC7 FF4E04 dec [esi+04] :760F2BCA EB3A jmp 760F2C06 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3ED7(C), :760E3EDF(C) | :760F2BCC A184110E76 mov eax, dword ptr [760E1184] :760F2BD1 F60002 test byte ptr [eax], 02 :760F2BD4 7430 je 760F2C06 :760F2BD6 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"Init" | :760F2BD8 6894910E76 push 760E9194 :760F2BDD 68ED000000 push 000000ED * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2BE2 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2BE7 FF1580110E76 Call dword ptr [760E1180] :760F2BED 85C0 test eax, eax :760F2BEF 7415 je 760F2C06 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F2BF1 FF15A0110E76 Call dword ptr [760E11A0] :760F2BF7 50 push eax * Possible StringData Ref from Code Obj ->"CoCreateInstance Failed 0x%x" | :760F2BF8 6858910E76 push 760E9158 :760F2BFD 56 push esi :760F2BFE E828A3FFFF call 760ECF2B :760F2C03 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2BCA(U), :760F2BD4(C), :760F2BEF(C) | :760F2C06 8B4608 mov eax, dword ptr [esi+08] :760F2C09 3BC3 cmp eax, ebx :760F2C0B 7409 je 760F2C16 :760F2C0D 8B08 mov ecx, dword ptr [eax] :760F2C0F 50 push eax :760F2C10 FF5108 call [ecx+08] :760F2C13 895E08 mov dword ptr [esi+08], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2C0B(C) | :760F2C16 33C0 xor eax, eax :760F2C18 E9CB12FFFF jmp 760E3EE8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5234(C) | :760F2C1D A184110E76 mov eax, dword ptr [760E1184] :760F2C22 F60002 test byte ptr [eax], 02 :760F2C25 0F8466030000 je 760F2F91 :760F2C2B 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2C2D 6870930E76 push 760E9370 :760F2C32 6823010000 push 00000123 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2C37 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2C3C FF1580110E76 Call dword ptr [760E1180] :760F2C42 85C0 test eax, eax :760F2C44 0F8447030000 je 760F2F91 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F2C4A FF15A0110E76 Call dword ptr [760E11A0] :760F2C50 50 push eax * Possible StringData Ref from Code Obj ->"IXMLDocument::GetRoot failed 0x%x" | :760F2C51 684C930E76 push 760E934C :760F2C56 E9B7010000 jmp 760F2E12 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E524B(C) | :760F2C5B A184110E76 mov eax, dword ptr [760E1184] :760F2C60 F60002 test byte ptr [eax], 02 :760F2C63 0F8428030000 je 760F2F91 :760F2C69 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2C6B 6870930E76 push 760E9370 :760F2C70 6829010000 push 00000129 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2C75 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2C7A FF1580110E76 Call dword ptr [760E1180] :760F2C80 85C0 test eax, eax :760F2C82 0F8409030000 je 760F2F91 :760F2C88 56 push esi * Possible StringData Ref from Code Obj ->"IXMLElement::get_tagName failed " ->"0x%x" | :760F2C89 6824930E76 push 760E9324 :760F2C8E E97F010000 jmp 760F2E12 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E526B(C) | :760F2C93 A184110E76 mov eax, dword ptr [760E1184] :760F2C98 F60002 test byte ptr [eax], 02 :760F2C9B 0F84F0020000 je 760F2F91 :760F2CA1 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2CA3 6870930E76 push 760E9370 :760F2CA8 6830010000 push 00000130 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2CAD 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2CB2 FF1580110E76 Call dword ptr [760E1180] :760F2CB8 85C0 test eax, eax :760F2CBA 0F84D1020000 je 760F2F91 :760F2CC0 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"BSTR too large for buffer" | :760F2CC2 6808930E76 push 760E9308 :760F2CC7 E946010000 jmp 760F2E12 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5287(C) | :760F2CCC A184110E76 mov eax, dword ptr [760E1184] :760F2CD1 F60002 test byte ptr [eax], 02 :760F2CD4 0F84B7020000 je 760F2F91 :760F2CDA 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2CDC 6870930E76 push 760E9370 :760F2CE1 6838010000 push 00000138 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2CE6 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2CEB FF1580110E76 Call dword ptr [760E1180] :760F2CF1 85C0 test eax, eax :760F2CF3 0F8498020000 je 760F2F91 :760F2CF9 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Malformed XML file" | :760F2CFB 68F4920E76 push 760E92F4 :760F2D00 E90D010000 jmp 760F2E12 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E529E(C) | :760F2D05 A184110E76 mov eax, dword ptr [760E1184] :760F2D0A F60002 test byte ptr [eax], 02 :760F2D0D 0F847E020000 je 760F2F91 :760F2D13 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2D15 6870930E76 push 760E9370 :760F2D1A 683F010000 push 0000013F * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2D1F 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2D24 FF1580110E76 Call dword ptr [760E1180] :760F2D2A 85C0 test eax, eax :760F2D2C 0F845F020000 je 760F2F91 :760F2D32 56 push esi * Possible StringData Ref from Code Obj ->"IXMLElement::get_children failed " ->"0x%x" | :760F2D33 68CC920E76 push 760E92CC :760F2D38 E9D5000000 jmp 760F2E12 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E52C5(C) | :760F2D3D A184110E76 mov eax, dword ptr [760E1184] :760F2D42 F60004 test byte ptr [eax], 04 :760F2D45 0F8446020000 je 760F2F91 :760F2D4B 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2D4D 6870930E76 push 760E9370 :760F2D52 6849010000 push 00000149 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2D57 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2D5C FF1580110E76 Call dword ptr [760E1180] :760F2D62 85C0 test eax, eax :760F2D64 0F8427020000 je 760F2F91 :760F2D6A 56 push esi * Possible StringData Ref from Code Obj ->"Error Finding Length 0x%x" | :760F2D6B 68B0920E76 push 760E92B0 :760F2D70 E99D000000 jmp 760F2E12 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E52E6(C) | :760F2D75 A184110E76 mov eax, dword ptr [760E1184] :760F2D7A F60002 test byte ptr [eax], 02 :760F2D7D 0F840E020000 je 760F2F91 :760F2D83 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2D85 6870930E76 push 760E9370 :760F2D8A 685C010000 push 0000015C * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2D8F 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2D94 FF1580110E76 Call dword ptr [760E1180] :760F2D9A 85C0 test eax, eax :760F2D9C 0F84EF010000 je 760F2F91 :760F2DA2 56 push esi * Possible StringData Ref from Code Obj ->"Error pChildren->item 0x%x" | :760F2DA3 6894920E76 push 760E9294 :760F2DA8 EB68 jmp 760F2E12 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5301(C) | :760F2DAA A184110E76 mov eax, dword ptr [760E1184] :760F2DAF F60002 test byte ptr [eax], 02 :760F2DB2 0F84D9010000 je 760F2F91 :760F2DB8 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2DBA 6870930E76 push 760E9370 :760F2DBF 6862010000 push 00000162 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2DC4 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2DC9 FF1580110E76 Call dword ptr [760E1180] :760F2DCF 85C0 test eax, eax :760F2DD1 0F84BA010000 je 760F2F91 :760F2DD7 56 push esi * Possible StringData Ref from Code Obj ->"Error IDispatch::QueryInterface " ->"0x%d" | :760F2DD8 686C920E76 push 760E926C :760F2DDD EB33 jmp 760F2E12 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5318(C) | :760F2DDF A184110E76 mov eax, dword ptr [760E1184] :760F2DE4 F60004 test byte ptr [eax], 04 :760F2DE7 0F84A4010000 je 760F2F91 :760F2DED 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2DEF 6870930E76 push 760E9370 :760F2DF4 6869010000 push 00000169 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2DF9 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2DFE FF1580110E76 Call dword ptr [760E1180] :760F2E04 85C0 test eax, eax :760F2E06 0F8485010000 je 760F2F91 :760F2E0C 56 push esi * Possible StringData Ref from Code Obj ->"Error in get_tagName 0x%x" | :760F2E0D 6850920E76 push 760E9250 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2C56(U), :760F2C8E(U), :760F2CC7(U), :760F2D00(U), :760F2D38(U) |:760F2D70(U), :760F2DA8(U), :760F2DDD(U) | :760F2E12 FF75FC push [ebp-04] :760F2E15 E96F010000 jmp 760F2F89 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5335(C) | :760F2E1A A184110E76 mov eax, dword ptr [760E1184] :760F2E1F F60002 test byte ptr [eax], 02 :760F2E22 0F8469010000 je 760F2F91 :760F2E28 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2E2A 6870930E76 push 760E9370 :760F2E2F 6870010000 push 00000170 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2E34 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2E39 FF1580110E76 Call dword ptr [760E1180] :760F2E3F 85C0 test eax, eax :760F2E41 0F844A010000 je 760F2F91 :760F2E47 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"BSTR too large for buffer" | :760F2E49 6808930E76 push 760E9308 :760F2E4E E935010000 jmp 760F2F88 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E547D(C) | :760F2E53 A184110E76 mov eax, dword ptr [760E1184] :760F2E58 F60002 test byte ptr [eax], 02 :760F2E5B 0F8430010000 je 760F2F91 :760F2E61 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2E63 6870930E76 push 760E9370 :760F2E68 687B010000 push 0000017B :760F2E6D EB36 jmp 760F2EA5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5495(C) | :760F2E6F A184110E76 mov eax, dword ptr [760E1184] :760F2E74 F60002 test byte ptr [eax], 02 :760F2E77 0F8414010000 je 760F2F91 :760F2E7D 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2E7F 6870930E76 push 760E9370 :760F2E84 6885010000 push 00000185 :760F2E89 EB1A jmp 760F2EA5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E54B0(C) | :760F2E8B A184110E76 mov eax, dword ptr [760E1184] :760F2E90 F60002 test byte ptr [eax], 02 :760F2E93 0F84F8000000 je 760F2F91 :760F2E99 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2E9B 6870930E76 push 760E9370 :760F2EA0 688E010000 push 0000018E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2E6D(U), :760F2E89(U) | * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2EA5 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2EAA FF1580110E76 Call dword ptr [760E1180] :760F2EB0 85C0 test eax, eax :760F2EB2 0F84D9000000 je 760F2F91 :760F2EB8 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error Loading Collection" | :760F2EBA 6834920E76 push 760E9234 :760F2EBF E9C4000000 jmp 760F2F88 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E53CA(C) | :760F2EC4 A184110E76 mov eax, dword ptr [760E1184] :760F2EC9 F60002 test byte ptr [eax], 02 :760F2ECC 0F84BF000000 je 760F2F91 :760F2ED2 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2ED4 6870930E76 push 760E9370 :760F2ED9 68A0010000 push 000001A0 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2EDE 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2EE3 FF1580110E76 Call dword ptr [760E1180] :760F2EE9 85C0 test eax, eax :760F2EEB 0F84A0000000 je 760F2F91 :760F2EF1 56 push esi * Possible StringData Ref from Code Obj ->"Error in IXMLElement::get_text " ->"0x%x" | :760F2EF2 6810920E76 push 760E9210 :760F2EF7 E98C000000 jmp 760F2F88 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E53E4(C) | :760F2EFC A184110E76 mov eax, dword ptr [760E1184] :760F2F01 F60002 test byte ptr [eax], 02 :760F2F04 0F8487000000 je 760F2F91 :760F2F0A 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2F0C 6870930E76 push 760E9370 :760F2F11 68A7010000 push 000001A7 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2F16 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2F1B FF1580110E76 Call dword ptr [760E1180] :760F2F21 85C0 test eax, eax :760F2F23 746C je 760F2F91 :760F2F25 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"not enough space to in BSTR to " ->"string buffer" | :760F2F27 68E0910E76 push 760E91E0 :760F2F2C EB5A jmp 760F2F88 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E53FE(C) | :760F2F2E A184110E76 mov eax, dword ptr [760E1184] :760F2F33 F60002 test byte ptr [eax], 02 :760F2F36 7459 je 760F2F91 :760F2F38 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2F3A 6870930E76 push 760E9370 :760F2F3F 68B1010000 push 000001B1 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2F44 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2F49 FF1580110E76 Call dword ptr [760E1180] :760F2F4F 85C0 test eax, eax :760F2F51 743E je 760F2F91 :760F2F53 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Empty string passed to default " ->"type." | :760F2F55 68B8910E76 push 760E91B8 :760F2F5A EB2C jmp 760F2F88 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E53B3(C) | :760F2F5C A184110E76 mov eax, dword ptr [760E1184] :760F2F61 F60002 test byte ptr [eax], 02 :760F2F64 742B je 760F2F91 :760F2F66 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadCollections" | :760F2F68 6870930E76 push 760E9370 :760F2F6D 68BA010000 push 000001BA * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2F72 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2F77 FF1580110E76 Call dword ptr [760E1180] :760F2F7D 85C0 test eax, eax :760F2F7F 7410 je 760F2F91 :760F2F81 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Undefiend XML tag in file." | :760F2F83 689C910E76 push 760E919C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F2E4E(U), :760F2EBF(U), :760F2EF7(U), :760F2F2C(U), :760F2F5A(U) | :760F2F88 57 push edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2E15(U) | :760F2F89 E89D9FFFFF call 760ECF2B :760F2F8E 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E54C7(C), :760F2C25(C), :760F2C44(C), :760F2C63(C), :760F2C82(C) |:760F2C9B(C), :760F2CBA(C), :760F2CD4(C), :760F2CF3(C), :760F2D0D(C) |:760F2D2C(C), :760F2D45(C), :760F2D64(C), :760F2D7D(C), :760F2D9C(C) |:760F2DB2(C), :760F2DD1(C), :760F2DE7(C), :760F2E06(C), :760F2E22(C) |:760F2E41(C), :760F2E5B(C), :760F2E77(C), :760F2E93(C), :760F2EB2(C) |:760F2ECC(C), :760F2EEB(C), :760F2F04(C), :760F2F23(C), :760F2F36(C) |:760F2F51(C), :760F2F64(C), :760F2F7F(C) | :760F2F91 8B45F8 mov eax, dword ptr [ebp-08] :760F2F94 33F6 xor esi, esi :760F2F96 3BC6 cmp eax, esi :760F2F98 7409 je 760F2FA3 :760F2F9A 8B08 mov ecx, dword ptr [eax] :760F2F9C 50 push eax :760F2F9D FF5108 call [ecx+08] :760F2FA0 8975F8 mov dword ptr [ebp-08], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2F98(C) | :760F2FA3 8B45F0 mov eax, dword ptr [ebp-10] :760F2FA6 3BC6 cmp eax, esi :760F2FA8 7409 je 760F2FB3 :760F2FAA 8B08 mov ecx, dword ptr [eax] :760F2FAC 50 push eax :760F2FAD FF5108 call [ecx+08] :760F2FB0 8975F0 mov dword ptr [ebp-10], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2FA8(C) | :760F2FB3 8B45F4 mov eax, dword ptr [ebp-0C] :760F2FB6 3BC6 cmp eax, esi :760F2FB8 7409 je 760F2FC3 :760F2FBA 8B08 mov ecx, dword ptr [eax] :760F2FBC 50 push eax :760F2FBD FF5108 call [ecx+08] :760F2FC0 8975F4 mov dword ptr [ebp-0C], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2FB8(C) | :760F2FC3 8B45EC mov eax, dword ptr [ebp-14] :760F2FC6 3BC6 cmp eax, esi :760F2FC8 7406 je 760F2FD0 :760F2FCA 8B08 mov ecx, dword ptr [eax] :760F2FCC 50 push eax :760F2FCD FF5108 call [ecx+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F2FC8(C) | :760F2FD0 33C0 xor eax, eax :760F2FD2 E90D25FFFF jmp 760E54E4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5674(C) | :760F2FD7 A184110E76 mov eax, dword ptr [760E1184] :760F2FDC F60002 test byte ptr [eax], 02 :760F2FDF 0F844728FFFF je 760E582C :760F2FE5 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadOneCollection" | :760F2FE7 68F05E0E76 push 760E5EF0 :760F2FEC 68F9010000 push 000001F9 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F2FF1 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F2FF6 FF1580110E76 Call dword ptr [760E1180] :760F2FFC 85C0 test eax, eax :760F2FFE 0F842828FFFF je 760E582C :760F3004 57 push edi * Possible StringData Ref from Code Obj ->"Empty "section" | :760F3005 6808940E76 push 760E9408 :760F300A FF75FC push [ebp-04] :760F300D E8199FFFFF call 760ECF2B :760F3012 83C40C add esp, 0000000C :760F3015 E91228FFFF jmp 760E582C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E568B(C) | :760F301A A184110E76 mov eax, dword ptr [760E1184] :760F301F F60004 test byte ptr [eax], 04 :760F3022 0F8471010000 je 760F3199 :760F3028 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadOneCollection" | :760F302A 68F05E0E76 push 760E5EF0 :760F302F 6800020000 push 00000200 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F3034 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F3039 FF1580110E76 Call dword ptr [760E1180] :760F303F 85C0 test eax, eax :760F3041 0F8452010000 je 760F3199 :760F3047 56 push esi * Possible StringData Ref from Code Obj ->"Error getting collection size. " ->"0x%x" | :760F3048 68E4930E76 push 760E93E4 :760F304D E93C010000 jmp 760F318E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E56F5(C) | :760F3052 A184110E76 mov eax, dword ptr [760E1184] :760F3057 F60002 test byte ptr [eax], 02 :760F305A 0F849B26FFFF je 760E56FB * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadOneCollection" | :760F3060 BFF05E0E76 mov edi, 760E5EF0 :760F3065 6A02 push 00000002 :760F3067 57 push edi * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F3068 BE44DA0F76 mov esi, 760FDA44 :760F306D 6822020000 push 00000222 :760F3072 56 push esi :760F3073 FFD3 call ebx :760F3075 85C0 test eax, eax :760F3077 0F848826FFFF je 760E5705 :760F307D FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Error in get_tagName 0x%x" | :760F3080 6850920E76 push 760E9250 :760F3085 FF75FC push [ebp-04] :760F3088 E89E9EFFFF call 760ECF2B :760F308D 83C40C add esp, 0000000C :760F3090 E97026FFFF jmp 760E5705 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E56B2(C) | :760F3095 A184110E76 mov eax, dword ptr [760E1184] :760F309A F60002 test byte ptr [eax], 02 :760F309D 0F84F6000000 je 760F3199 :760F30A3 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadOneCollection" | :760F30A5 68F05E0E76 push 760E5EF0 :760F30AA 6812020000 push 00000212 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F30AF 6844DA0F76 push 760FDA44 :760F30B4 FFD3 call ebx :760F30B6 85C0 test eax, eax :760F30B8 0F84DB000000 je 760F3199 :760F30BE 56 push esi * Possible StringData Ref from Code Obj ->"Error pChildren->item 0x%x" | :760F30BF 6894920E76 push 760E9294 :760F30C4 E9C5000000 jmp 760F318E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E56CD(C) | :760F30C9 A184110E76 mov eax, dword ptr [760E1184] :760F30CE F60002 test byte ptr [eax], 02 :760F30D1 0F84C2000000 je 760F3199 :760F30D7 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::LoadOneCollection" | :760F30D9 68F05E0E76 push 760E5EF0 :760F30DE 6818020000 push 00000218 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F30E3 6844DA0F76 push 760FDA44 :760F30E8 FFD3 call ebx :760F30EA 85C0 test eax, eax :760F30EC 0F84A7000000 je 760F3199 :760F30F2 56 push esi * Possible StringData Ref from Code Obj ->"Error IDispatch::QueryInterface " ->"0x%d" | :760F30F3 686C920E76 push 760E926C :760F30F8 E991000000 jmp 760F318E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5721(C) | :760F30FD A184110E76 mov eax, dword ptr [760E1184] :760F3102 F60002 test byte ptr [eax], 02 :760F3105 0F848E000000 je 760F3199 :760F310B 6A02 push 00000002 :760F310D 57 push edi :760F310E 6828020000 push 00000228 :760F3113 56 push esi :760F3114 FFD3 call ebx :760F3116 85C0 test eax, eax :760F3118 747F je 760F3199 :760F311A 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Not enough space to convert BString." | :760F311C 68BC930E76 push 760E93BC :760F3121 EB6B jmp 760F318E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5750(C) | :760F3123 A184110E76 mov eax, dword ptr [760E1184] :760F3128 F60004 test byte ptr [eax], 04 :760F312B 746C je 760F3199 :760F312D 6A04 push 00000004 :760F312F 57 push edi :760F3130 6831020000 push 00000231 :760F3135 EB26 jmp 760F315D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E57D8(C) | :760F3137 A184110E76 mov eax, dword ptr [760E1184] :760F313C F60004 test byte ptr [eax], 04 :760F313F 7458 je 760F3199 :760F3141 6A04 push 00000004 :760F3143 57 push edi :760F3144 6839020000 push 00000239 :760F3149 EB12 jmp 760F315D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5814(C) | :760F314B A184110E76 mov eax, dword ptr [760E1184] :760F3150 F60004 test byte ptr [eax], 04 :760F3153 7444 je 760F3199 :760F3155 6A04 push 00000004 :760F3157 57 push edi :760F3158 6841020000 push 00000241 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3135(U), :760F3149(U) | :760F315D 56 push esi :760F315E FFD3 call ebx :760F3160 85C0 test eax, eax :760F3162 7435 je 760F3199 :760F3164 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Error in IXMLElement::get_children " ->"0x%x" | :760F3167 6894930E76 push 760E9394 :760F316C EB20 jmp 760F318E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E57F9(C) | :760F316E A184110E76 mov eax, dword ptr [760E1184] :760F3173 F60002 test byte ptr [eax], 02 :760F3176 7421 je 760F3199 :760F3178 6A02 push 00000002 :760F317A 57 push edi :760F317B 6847020000 push 00000247 :760F3180 56 push esi :760F3181 FFD3 call ebx :760F3183 85C0 test eax, eax :760F3185 7412 je 760F3199 :760F3187 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Undefiend XML tag in file." | :760F3189 689C910E76 push 760E919C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F304D(U), :760F30C4(U), :760F30F8(U), :760F3121(U), :760F316C(U) | :760F318E FF75FC push [ebp-04] :760F3191 E8959DFFFF call 760ECF2B :760F3196 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3022(C), :760F3041(C), :760F309D(C), :760F30B8(C), :760F30D1(C) |:760F30EC(C), :760F3105(C), :760F3118(C), :760F312B(C), :760F313F(C) |:760F3153(C), :760F3162(C), :760F3176(C), :760F3185(C) | :760F3199 8B45F8 mov eax, dword ptr [ebp-08] :760F319C 85C0 test eax, eax :760F319E 740A je 760F31AA :760F31A0 8B08 mov ecx, dword ptr [eax] :760F31A2 50 push eax :760F31A3 FF5108 call [ecx+08] :760F31A6 8365F800 and dword ptr [ebp-08], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F319E(C) | :760F31AA 8B45F4 mov eax, dword ptr [ebp-0C] :760F31AD 85C0 test eax, eax :760F31AF 740A je 760F31BB :760F31B1 8B08 mov ecx, dword ptr [eax] :760F31B3 50 push eax :760F31B4 FF5108 call [ecx+08] :760F31B7 8365F400 and dword ptr [ebp-0C], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F31AF(C) | :760F31BB 8B45F0 mov eax, dword ptr [ebp-10] :760F31BE 85C0 test eax, eax :760F31C0 7406 je 760F31C8 :760F31C2 8B08 mov ecx, dword ptr [eax] :760F31C4 50 push eax :760F31C5 FF5108 call [ecx+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F31C0(C) | :760F31C8 33C0 xor eax, eax :760F31CA E96026FFFF jmp 760E582F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E50EB(C) | :760F31CF 33FF xor edi, edi :760F31D1 E9221FFFFF jmp 760E50F8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E50FA(C) | :760F31D6 A184110E76 mov eax, dword ptr [760E1184] :760F31DB F60002 test byte ptr [eax], 02 :760F31DE 7467 je 760F3247 :760F31E0 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"ParseFile" | :760F31E2 6870940E76 push 760E9470 :760F31E7 687D020000 push 0000027D * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F31EC 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F31F1 FF1580110E76 Call dword ptr [760E1180] :760F31F7 85C0 test eax, eax :760F31F9 744C je 760F3247 :760F31FB 57 push edi * Possible StringData Ref from Code Obj ->"Error allocating space for a BSTR" | :760F31FC 684C940E76 push 760E944C :760F3201 56 push esi :760F3202 E8249DFFFF call 760ECF2B :760F3207 83C40C add esp, 0000000C :760F320A EB3B jmp 760F3247 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E510E(C) | :760F320C A184110E76 mov eax, dword ptr [760E1184] :760F3211 F60004 test byte ptr [eax], 04 :760F3214 742A je 760F3240 :760F3216 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"ParseFile" | :760F3218 6870940E76 push 760E9470 :760F321D 6883020000 push 00000283 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F3222 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F3227 FF1580110E76 Call dword ptr [760E1180] :760F322D 85C0 test eax, eax :760F322F 740F je 760F3240 :760F3231 53 push ebx * Possible StringData Ref from Code Obj ->"Error m_pDoc->putUrl %0x%x" | :760F3232 6830940E76 push 760E9430 :760F3237 56 push esi :760F3238 E8EE9CFFFF call 760ECF2B :760F323D 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3214(C), :760F322F(C) | :760F3240 57 push edi * Reference To: OLEAUT32.SysFreeString, Ord:0006h | :760F3241 FF1590100E76 Call dword ptr [760E1090] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F31DE(C), :760F31F9(C), :760F320A(U) | :760F3247 8B4D08 mov ecx, dword ptr [ebp+08] :760F324A 85C9 test ecx, ecx :760F324C 7405 je 760F3253 :760F324E E8FE0DFFFF call 760E4051 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F324C(C) | :760F3253 33C0 xor eax, eax :760F3255 E9D01EFFFF jmp 760E512A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E513E(C) | :760F325A 33C0 xor eax, eax :760F325C E9EE1EFFFF jmp 760E514F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5153(C) | :760F3261 680E000780 push 8007000E :760F3266 E859550000 call 760F87C4 :760F326B E9E91EFFFF jmp 760E5159 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E517A(C) | :760F3270 39442408 cmp dword ptr [esp+08], eax :760F3274 0F84061FFFFF je 760E5180 :760F327A 680E000780 push 8007000E :760F327F E840550000 call 760F87C4 :760F3284 E9F71EFFFF jmp 760E5180 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4061(C) | :760F3289 8B07 mov eax, dword ptr [edi] :760F328B E9EB0DFFFF jmp 760E407B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E51FE(C) | :760F3290 680E000780 push 8007000E :760F3295 E82A550000 call 760F87C4 :760F329A E9651FFFFF jmp 760E5204 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E51E4(C) | :760F329F 33C0 xor eax, eax :760F32A1 5E pop esi :760F32A2 C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5507(C) | :760F32A3 A184110E76 mov eax, dword ptr [760E1184] :760F32A8 F60004 test byte ptr [eax], 04 :760F32AB 7458 je 760F3305 :760F32AD 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::ParseVersionElement" | :760F32AF 68AC940E76 push 760E94AC :760F32B4 68BA020000 push 000002BA * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F32B9 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F32BE FF1580110E76 Call dword ptr [760E1180] :760F32C4 85C0 test eax, eax :760F32C6 743D je 760F3305 :760F32C8 57 push edi * Possible StringData Ref from Code Obj ->"Error in IXMLElement::get_text " ->"0x%x" | :760F32C9 6810920E76 push 760E9210 :760F32CE EB2C jmp 760F32FC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5526(C) | :760F32D0 A184110E76 mov eax, dword ptr [760E1184] :760F32D5 F60002 test byte ptr [eax], 02 :760F32D8 742B je 760F3305 :760F32DA 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::ParseVersionElement" | :760F32DC 68AC940E76 push 760E94AC :760F32E1 68C1020000 push 000002C1 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F32E6 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F32EB FF1580110E76 Call dword ptr [760E1180] :760F32F1 85C0 test eax, eax :760F32F3 7410 je 760F3305 :760F32F5 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error conveting the Bstring. Not " ->"enough buffer." | :760F32F7 687C940E76 push 760E947C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F32CE(U) | :760F32FC 56 push esi :760F32FD E8299CFFFF call 760ECF2B :760F3302 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F32AB(C), :760F32C6(C), :760F32D8(C), :760F32F3(C) | :760F3305 33C0 xor eax, eax :760F3307 E95F22FFFF jmp 760E556B * Referenced by a CALL at Address: |:760F761E | :760F330C 55 push ebp :760F330D 8BEC mov ebp, esp :760F330F 56 push esi :760F3310 8BF1 mov esi, ecx :760F3312 FF7514 push [ebp+14] :760F3315 E85117FFFF call 760E4A6B :760F331A 837E0800 cmp dword ptr [esi+08], 00000000 :760F331E 744D je 760F336D :760F3320 8B44860C mov eax, dword ptr [esi+4*eax+0C] :760F3324 85C0 test eax, eax :760F3326 7445 je 760F336D :760F3328 53 push ebx :760F3329 8B5D10 mov ebx, dword ptr [ebp+10] :760F332C 57 push edi :760F332D 8BCE mov ecx, esi :760F332F FF7518 push [ebp+18] :760F3332 53 push ebx :760F3333 FF750C push [ebp+0C] :760F3336 FF7508 push [ebp+08] :760F3339 50 push eax :760F333A E8F817FFFF call 760E4B37 :760F333F 8BF8 mov edi, eax :760F3341 3BFB cmp edi, ebx :760F3343 7522 jne 760F3367 :760F3345 53 push ebx :760F3346 8BCE mov ecx, esi :760F3348 FF750C push [ebp+0C] :760F334B E80919FFFF call 760E4C59 :760F3350 8BF8 mov edi, eax :760F3352 3BFB cmp edi, ebx :760F3354 7511 jne 760F3367 :760F3356 FF750C push [ebp+0C] * Reference To: USER32.CharUpperA, Ord:002Fh | :760F3359 FF1594120E76 Call dword ptr [760E1294] :760F335F FF750C push [ebp+0C] :760F3362 E8D10EFFFF call 760E4238 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3343(C), :760F3354(C) | :760F3367 8BC7 mov eax, edi :760F3369 5F pop edi :760F336A 5B pop ebx :760F336B EB02 jmp 760F336F * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F331E(C), :760F3326(C) | :760F336D 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F336B(U) | :760F336F 5E pop esi :760F3370 5D pop ebp :760F3371 C21400 ret 0014 * Referenced by a CALL at Addresses: |:760F7925 , :760F799B | :760F3374 55 push ebp :760F3375 8BEC mov ebp, esp :760F3377 56 push esi :760F3378 8BF1 mov esi, ecx :760F337A FF7514 push [ebp+14] :760F337D E8E916FFFF call 760E4A6B :760F3382 837E0800 cmp dword ptr [esi+08], 00000000 :760F3386 744C je 760F33D4 :760F3388 8B448624 mov eax, dword ptr [esi+4*eax+24] :760F338C 85C0 test eax, eax :760F338E 7444 je 760F33D4 :760F3390 53 push ebx :760F3391 8B5D10 mov ebx, dword ptr [ebp+10] :760F3394 57 push edi :760F3395 6A00 push 00000000 :760F3397 53 push ebx :760F3398 8BCE mov ecx, esi :760F339A FF750C push [ebp+0C] :760F339D FF7508 push [ebp+08] :760F33A0 50 push eax :760F33A1 E89117FFFF call 760E4B37 :760F33A6 8BF8 mov edi, eax :760F33A8 3BFB cmp edi, ebx :760F33AA 7522 jne 760F33CE :760F33AC 53 push ebx :760F33AD 8BCE mov ecx, esi :760F33AF FF750C push [ebp+0C] :760F33B2 E8A218FFFF call 760E4C59 :760F33B7 8BF8 mov edi, eax :760F33B9 3BFB cmp edi, ebx :760F33BB 7511 jne 760F33CE :760F33BD FF750C push [ebp+0C] * Reference To: USER32.CharUpperA, Ord:002Fh | :760F33C0 FF1594120E76 Call dword ptr [760E1294] :760F33C6 FF750C push [ebp+0C] :760F33C9 E86A0EFFFF call 760E4238 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F33AA(C), :760F33BB(C) | :760F33CE 8BC7 mov eax, edi :760F33D0 5F pop edi :760F33D1 5B pop ebx :760F33D2 EB02 jmp 760F33D6 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3386(C), :760F338E(C) | :760F33D4 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F33D2(U) | :760F33D6 5E pop esi :760F33D7 5D pop ebp :760F33D8 C21000 ret 0010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E4ADE(C), :760E4AEA(C) | :760F33DB 33C0 xor eax, eax :760F33DD E95017FFFF jmp 760E4B32 * Referenced by a CALL at Address: |:760F75EE | :760F33E2 56 push esi :760F33E3 8BF1 mov esi, ecx :760F33E5 FF742408 push [esp+08] :760F33E9 E87D16FFFF call 760E4A6B :760F33EE FF74860C push [esi+4*eax+0C] :760F33F2 8BCE mov ecx, esi :760F33F4 E8A416FFFF call 760E4A9D :760F33F9 5E pop esi :760F33FA C20400 ret 0004 * Referenced by a CALL at Addresses: |:760F78FF , :760F7979 | :760F33FD 56 push esi :760F33FE 8BF1 mov esi, ecx :760F3400 FF742408 push [esp+08] :760F3404 E86216FFFF call 760E4A6B :760F3409 FF748624 push [esi+4*eax+24] :760F340D 8BCE mov ecx, esi :760F340F E88916FFFF call 760E4A9D :760F3414 5E pop esi :760F3415 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4ABD(C) | :760F3418 A184110E76 mov eax, dword ptr [760E1184] :760F341D F60004 test byte ptr [eax], 04 :760F3420 742A je 760F344C :760F3422 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::GetCollectionSize" | :760F3424 68D4940E76 push 760E94D4 :760F3429 68BA030000 push 000003BA * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F342E 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F3433 FF1580110E76 Call dword ptr [760E1180] :760F3439 85C0 test eax, eax :760F343B 740F je 760F344C :760F343D 56 push esi * Possible StringData Ref from Code Obj ->"Error Finding Length 0x%x" | :760F343E 68B0920E76 push 760E92B0 :760F3443 57 push edi :760F3444 E8E29AFFFF call 760ECF2B :760F3449 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E4AA9(C), :760F3420(C), :760F343B(C) | :760F344C 33C0 xor eax, eax :760F344E E97316FFFF jmp 760E4AC6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4B65(C) | :760F3453 A184110E76 mov eax, dword ptr [760E1184] :760F3458 F60004 test byte ptr [eax], 04 :760F345B 0F84FC000000 je 760F355D :760F3461 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::GetFileInfo" | :760F3463 683C950E76 push 760E953C :760F3468 68F9030000 push 000003F9 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F346D 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F3472 FF1580110E76 Call dword ptr [760E1180] :760F3478 85C0 test eax, eax :760F347A 0F84DD000000 je 760F355D :760F3480 56 push esi * Possible StringData Ref from Code Obj ->"Error Finding Length 0x%x" | :760F3481 68B0920E76 push 760E92B0 :760F3486 E9C1000000 jmp 760F354C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4B71(C) | :760F348B A184110E76 mov eax, dword ptr [760E1184] :760F3490 F60002 test byte ptr [eax], 02 :760F3493 0F84C4000000 je 760F355D :760F3499 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::GetFileInfo" | :760F349B 683C950E76 push 760E953C :760F34A0 68FF030000 push 000003FF * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F34A5 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F34AA FF1580110E76 Call dword ptr [760E1180] :760F34B0 85C0 test eax, eax :760F34B2 0F84A5000000 je 760F355D :760F34B8 57 push edi * Possible StringData Ref from Code Obj ->"CXMLFileListParser::GetFileInfo " ->"(Element out of range)" | :760F34B9 6804950E76 push 760E9504 :760F34BE E989000000 jmp 760F354C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4BAA(C) | :760F34C3 A184110E76 mov eax, dword ptr [760E1184] :760F34C8 F60002 test byte ptr [eax], 02 :760F34CB 0F848C000000 je 760F355D :760F34D1 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::GetFileInfo" | :760F34D3 683C950E76 push 760E953C :760F34D8 680B040000 push 0000040B * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F34DD 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F34E2 FF1580110E76 Call dword ptr [760E1180] :760F34E8 85C0 test eax, eax :760F34EA 7471 je 760F355D :760F34EC 56 push esi * Possible StringData Ref from Code Obj ->"Error pChildren->item 0x%x" | :760F34ED 6894920E76 push 760E9294 :760F34F2 EB58 jmp 760F354C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4BC5(C) | :760F34F4 A184110E76 mov eax, dword ptr [760E1184] :760F34F9 F60002 test byte ptr [eax], 02 :760F34FC 745F je 760F355D :760F34FE 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::GetFileInfo" | :760F3500 683C950E76 push 760E953C :760F3505 6811040000 push 00000411 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F350A 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F350F FF1580110E76 Call dword ptr [760E1180] :760F3515 85C0 test eax, eax :760F3517 7444 je 760F355D :760F3519 56 push esi * Possible StringData Ref from Code Obj ->"Error IDispatch::QueryInterface " ->"0x%d" | :760F351A 686C920E76 push 760E926C :760F351F EB2B jmp 760F354C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4BED(C) | :760F3521 A184110E76 mov eax, dword ptr [760E1184] :760F3526 F60004 test byte ptr [eax], 04 :760F3529 7432 je 760F355D :760F352B 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::GetFileInfo" | :760F352D 683C950E76 push 760E953C :760F3532 681A040000 push 0000041A * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F3537 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F353C FF1580110E76 Call dword ptr [760E1180] :760F3542 85C0 test eax, eax :760F3544 7417 je 760F355D :760F3546 56 push esi * Possible StringData Ref from Code Obj ->"Error in IXMLElement::get_text " ->"0x%x" | :760F3547 6810920E76 push 760E9210 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3486(U), :760F34BE(U), :760F34F2(U), :760F351F(U) | :760F354C FF75F8 push [ebp-08] :760F354F E8D799FFFF call 760ECF2B :760F3554 83C40C add esp, 0000000C :760F3557 EB04 jmp 760F355D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4C0D(C) | :760F3559 40 inc eax :760F355A 8945F0 mov dword ptr [ebp-10], eax * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F345B(C), :760F347A(C), :760F3493(C), :760F34B2(C), :760F34CB(C) |:760F34EA(C), :760F34FC(C), :760F3517(C), :760F3529(C), :760F3544(C) |:760F3557(U) | :760F355D 8B45FC mov eax, dword ptr [ebp-04] :760F3560 85C0 test eax, eax :760F3562 740A je 760F356E :760F3564 8B08 mov ecx, dword ptr [eax] :760F3566 50 push eax :760F3567 FF5108 call [ecx+08] :760F356A 8365FC00 and dword ptr [ebp-04], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3562(C) | :760F356E 8B45F4 mov eax, dword ptr [ebp-0C] :760F3571 85C0 test eax, eax :760F3573 7406 je 760F357B :760F3575 8B08 mov ecx, dword ptr [eax] :760F3577 50 push eax :760F3578 FF5108 call [ecx+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3573(C) | :760F357B 8B45F0 mov eax, dword ptr [ebp-10] :760F357E E9CF16FFFF jmp 760E4C52 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4C3C(C) | * Possible StringData Ref from Code Obj ->"PROT" | :760F3583 68FC940E76 push 760E94FC :760F3588 8D4D08 lea ecx, dword ptr [ebp+08] :760F358B E8A11BFFFF call 760E5131 :760F3590 832600 and dword ptr [esi], 00000000 :760F3593 8D45D8 lea eax, dword ptr [ebp-28] :760F3596 50 push eax * Reference To: OLEAUT32.VariantInit, Ord:0008h | :760F3597 FF1594100E76 Call dword ptr [760E1094] :760F359D 8B4508 mov eax, dword ptr [ebp+08] :760F35A0 85C0 test eax, eax :760F35A2 7404 je 760F35A8 :760F35A4 8B00 mov eax, dword ptr [eax] :760F35A6 EB02 jmp 760F35AA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F35A2(C) | :760F35A8 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F35A6(U) | :760F35AA 8B4DFC mov ecx, dword ptr [ebp-04] :760F35AD 8D7DD8 lea edi, dword ptr [ebp-28] :760F35B0 57 push edi :760F35B1 50 push eax :760F35B2 8B11 mov edx, dword ptr [ecx] :760F35B4 51 push ecx :760F35B5 FF522C call [edx+2C] :760F35B8 85C0 test eax, eax :760F35BA 7510 jne 760F35CC :760F35BC 8D45D8 lea eax, dword ptr [ebp-28] :760F35BF C70601000000 mov dword ptr [esi], 00000001 :760F35C5 50 push eax * Reference To: OLEAUT32.VariantClear, Ord:0009h | :760F35C6 FF15A0100E76 Call dword ptr [760E10A0] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F35BA(C) | :760F35CC 8B4D08 mov ecx, dword ptr [ebp+08] :760F35CF 85C9 test ecx, ecx :760F35D1 0F846B16FFFF je 760E4C42 :760F35D7 E8750AFFFF call 760E4051 :760F35DC E96116FFFF jmp 760E4C42 * Referenced by a CALL at Address: |:760F75B0 | :760F35E1 0FBE4140 movsx eax, byte ptr [ecx+40] :760F35E5 50 push eax * Reference To: USER32.CharUpperA, Ord:002Fh | :760F35E6 FF1594120E76 Call dword ptr [760E1294] :760F35EC C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4C7D(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F35ED FF15A0110E76 Call dword ptr [760E11A0] :760F35F3 8BF0 mov esi, eax :760F35F5 A184110E76 mov eax, dword ptr [760E1184] :760F35FA F60002 test byte ptr [eax], 02 :760F35FD 742A je 760F3629 :760F35FF 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::SearchAndReplace" | :760F3601 68A8950E76 push 760E95A8 :760F3606 6882040000 push 00000482 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F360B 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F3610 FF1580110E76 Call dword ptr [760E1180] :760F3616 85C0 test eax, eax :760F3618 740F je 760F3629 :760F361A 56 push esi * Possible StringData Ref from Code Obj ->"Error in search and replace ec-%d" | :760F361B 6884950E76 push 760E9584 :760F3620 57 push edi :760F3621 E80599FFFF call 760ECF2B :760F3626 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F35FD(C), :760F3618(C) | :760F3629 33C0 xor eax, eax :760F362B E98316FFFF jmp 760E4CB3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4C86(C) | :760F3630 A184110E76 mov eax, dword ptr [760E1184] :760F3635 F60002 test byte ptr [eax], 02 :760F3638 742B je 760F3665 :760F363A 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::SearchAndReplace" | :760F363C 68A8950E76 push 760E95A8 :760F3641 6889040000 push 00000489 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F3646 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F364B FF1580110E76 Call dword ptr [760E1180] :760F3651 85C0 test eax, eax :760F3653 7410 je 760F3665 :760F3655 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Buffer too small in Search and " ->"replace." | :760F3657 685C950E76 push 760E955C :760F365C 57 push edi :760F365D E8C998FFFF call 760ECF2B :760F3662 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3638(C), :760F3653(C) | :760F3665 8BC6 mov eax, esi :760F3667 E94716FFFF jmp 760E4CB3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5867(C) | :760F366C A184110E76 mov eax, dword ptr [760E1184] :760F3671 F60002 test byte ptr [eax], 02 :760F3674 0F8400060000 je 760F3C7A :760F367A 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F367C 6820610E76 push 760E6120 :760F3681 68BF040000 push 000004BF :760F3686 EB1A jmp 760F36A2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5897(C) | :760F3688 A184110E76 mov eax, dword ptr [760E1184] :760F368D F60002 test byte ptr [eax], 02 :760F3690 0F84E4050000 je 760F3C7A :760F3696 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3698 6820610E76 push 760E6120 :760F369D 68C8040000 push 000004C8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3686(U) | * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\xmlparser\cxmlparser.cpp" | :760F36A2 6844DA0F76 push 760FDA44 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F36A7 FF1580110E76 Call dword ptr [760E1180] :760F36AD 85C0 test eax, eax :760F36AF 0F84C5050000 je 760F3C7A :760F36B5 55 push ebp * Possible StringData Ref from Code Obj ->"Error getting windir" | :760F36B6 68489B0E76 push 760E9B48 :760F36BB 53 push ebx :760F36BC E9B1050000 jmp 760F3C72 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E58E8(C) | :760F36C1 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F36C3 6820610E76 push 760E6120 :760F36C8 68D3040000 push 000004D3 :760F36CD 53 push ebx :760F36CE FFD5 call ebp :760F36D0 85C0 test eax, eax :760F36D2 0F841622FFFF je 760E58EE :760F36D8 FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"AltStartUp, error 0x%x" | :760F36DC 68109B0E76 push 760E9B10 :760F36E1 FF74241C push [esp+1C] :760F36E5 E84198FFFF call 760ECF2B :760F36EA 83C40C add esp, 0000000C :760F36ED E9FC21FFFF jmp 760E58EE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5934(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F36F2 FF15A0110E76 Call dword ptr [760E11A0] :760F36F8 89442410 mov dword ptr [esp+10], eax :760F36FC A184110E76 mov eax, dword ptr [760E1184] :760F3701 F60002 test byte ptr [eax], 02 :760F3704 7428 je 760F372E :760F3706 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3708 6820610E76 push 760E6120 :760F370D 68DF040000 push 000004DF :760F3712 53 push ebx :760F3713 FFD5 call ebp :760F3715 85C0 test eax, eax :760F3717 7415 je 760F372E :760F3719 FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"AppData, error 0x%x" | :760F371D 68DC9A0E76 push 760E9ADC :760F3722 FF74241C push [esp+1C] :760F3726 E80098FFFF call 760ECF2B :760F372B 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3704(C), :760F3717(C) | :760F372E 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"C:\Unknown_" | :760F3732 6804610E76 push 760E6104 :760F3737 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760F3738 FF1504120E76 Call dword ptr [760E1204] :760F373E 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"AppData" | :760F3742 68E4600E76 push 760E60E4 :760F3747 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F3748 FF1598110E76 Call dword ptr [760E1198] :760F374E E9E721FFFF jmp 760E593A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5974(C) | :760F3753 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3755 6820610E76 push 760E6120 :760F375A 68EC040000 push 000004EC :760F375F 53 push ebx :760F3760 FFD5 call ebp :760F3762 85C0 test eax, eax :760F3764 0F841022FFFF je 760E597A :760F376A FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"RecycleBin, error 0x%x" | :760F376E 68A49A0E76 push 760E9AA4 :760F3773 FF74241C push [esp+1C] :760F3777 E8AF97FFFF call 760ECF2B :760F377C 83C40C add esp, 0000000C :760F377F E9F621FFFF jmp 760E597A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E59C0(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F3784 FF15A0110E76 Call dword ptr [760E11A0] :760F378A 89442410 mov dword ptr [esp+10], eax :760F378E A184110E76 mov eax, dword ptr [760E1184] :760F3793 F60002 test byte ptr [eax], 02 :760F3796 7428 je 760F37C0 :760F3798 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F379A 6820610E76 push 760E6120 :760F379F 68F9040000 push 000004F9 :760F37A4 53 push ebx :760F37A5 FFD5 call ebp :760F37A7 85C0 test eax, eax :760F37A9 7415 je 760F37C0 :760F37AB FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"CommonDesktop, error 0x%x" | :760F37AF 686C9A0E76 push 760E9A6C :760F37B4 FF74241C push [esp+1C] :760F37B8 E86E97FFFF call 760ECF2B :760F37BD 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3796(C), :760F37A9(C) | :760F37C0 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"C:\Unknown_" | :760F37C4 6804610E76 push 760E6104 :760F37C9 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760F37CA FF1504120E76 Call dword ptr [760E1204] :760F37D0 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"CommonDesktop" | :760F37D4 68C8600E76 push 760E60C8 :760F37D9 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F37DA FF1598110E76 Call dword ptr [760E1198] :760F37E0 E9E121FFFF jmp 760E59C6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5A00(C) | :760F37E5 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F37E7 6820610E76 push 760E6120 :760F37EC 6805050000 push 00000505 :760F37F1 53 push ebx :760F37F2 FFD5 call ebp :760F37F4 85C0 test eax, eax :760F37F6 0F840A22FFFF je 760E5A06 :760F37FC FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"CommonFavorites, error 0x%x" | :760F3800 68309A0E76 push 760E9A30 :760F3805 FF74241C push [esp+1C] :760F3809 E81D97FFFF call 760ECF2B :760F380E 83C40C add esp, 0000000C :760F3811 E9F021FFFF jmp 760E5A06 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5A60(C) | :760F3816 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3818 6820610E76 push 760E6120 :760F381D 6812050000 push 00000512 :760F3822 53 push ebx :760F3823 FFD5 call ebp :760F3825 85C0 test eax, eax :760F3827 0F843922FFFF je 760E5A66 :760F382D FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"CommonProgramGroups, error 0x%x" | :760F3831 68F0990E76 push 760E99F0 :760F3836 FF74241C push [esp+1C] :760F383A E8EC96FFFF call 760ECF2B :760F383F 83C40C add esp, 0000000C :760F3842 E91F22FFFF jmp 760E5A66 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5AC0(C) | :760F3847 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3849 6820610E76 push 760E6120 :760F384E 681E050000 push 0000051E :760F3853 53 push ebx :760F3854 FFD5 call ebp :760F3856 85C0 test eax, eax :760F3858 0F846822FFFF je 760E5AC6 :760F385E FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"CommonStartMenu, error 0x%x" | :760F3862 68B4990E76 push 760E99B4 :760F3867 FF74241C push [esp+1C] :760F386B E8BB96FFFF call 760ECF2B :760F3870 83C40C add esp, 0000000C :760F3873 E94E22FFFF jmp 760E5AC6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5B0C(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F3878 FF15A0110E76 Call dword ptr [760E11A0] :760F387E 89442410 mov dword ptr [esp+10], eax :760F3882 A184110E76 mov eax, dword ptr [760E1184] :760F3887 F60002 test byte ptr [eax], 02 :760F388A 7428 je 760F38B4 :760F388C 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F388E 6820610E76 push 760E6120 :760F3893 682A050000 push 0000052A :760F3898 53 push ebx :760F3899 FFD5 call ebp :760F389B 85C0 test eax, eax :760F389D 7415 je 760F38B4 :760F389F FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"CommonStartUp, error 0x%x" | :760F38A3 687C990E76 push 760E997C :760F38A8 FF74241C push [esp+1C] :760F38AC E87A96FFFF call 760ECF2B :760F38B1 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F388A(C), :760F389D(C) | :760F38B4 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"C:\Unknown_" | :760F38B8 6804610E76 push 760E6104 :760F38BD 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760F38BE FF1504120E76 Call dword ptr [760E1204] :760F38C4 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"CommonStartUp" | :760F38C8 6884600E76 push 760E6084 :760F38CD 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F38CE FF1598110E76 Call dword ptr [760E1198] :760F38D4 E93922FFFF jmp 760E5B12 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5B38(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F38D9 FF15A0110E76 Call dword ptr [760E11A0] :760F38DF 89442410 mov dword ptr [esp+10], eax :760F38E3 A184110E76 mov eax, dword ptr [760E1184] :760F38E8 F60002 test byte ptr [eax], 02 :760F38EB 7428 je 760F3915 :760F38ED 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F38EF 6820610E76 push 760E6120 :760F38F4 6836050000 push 00000536 :760F38F9 53 push ebx :760F38FA FFD5 call ebp :760F38FC 85C0 test eax, eax :760F38FE 7415 je 760F3915 :760F3900 FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"Cookies, error 0x%x" | :760F3904 6848990E76 push 760E9948 :760F3909 FF74241C push [esp+1C] :760F390D E81996FFFF call 760ECF2B :760F3912 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F38EB(C), :760F38FE(C) | :760F3915 8D442428 lea eax, dword ptr [esp+28] :760F3919 6800040000 push 00000400 :760F391E 50 push eax * Reference To: KERNEL32.GetWindowsDirectoryA, Ord:0197h | :760F391F FF15B4110E76 Call dword ptr [760E11B4] :760F3925 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"\Cookies" | :760F3929 683C990E76 push 760E993C :760F392E 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F392F FF1598110E76 Call dword ptr [760E1198] :760F3935 E90422FFFF jmp 760E5B3E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5B64(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F393A FF15A0110E76 Call dword ptr [760E11A0] :760F3940 89442410 mov dword ptr [esp+10], eax :760F3944 A184110E76 mov eax, dword ptr [760E1184] :760F3949 F60002 test byte ptr [eax], 02 :760F394C 7428 je 760F3976 :760F394E 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3950 6820610E76 push 760E6120 :760F3955 6842050000 push 00000542 :760F395A 53 push ebx :760F395B FFD5 call ebp :760F395D 85C0 test eax, eax :760F395F 7415 je 760F3976 :760F3961 FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"DesktopDirectory, error 0x%x" | :760F3965 6800990E76 push 760E9900 :760F396A FF74241C push [esp+1C] :760F396E E8B895FFFF call 760ECF2B :760F3973 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F394C(C), :760F395F(C) | :760F3976 8D442428 lea eax, dword ptr [esp+28] :760F397A 6800040000 push 00000400 :760F397F 50 push eax * Reference To: KERNEL32.GetWindowsDirectoryA, Ord:0197h | :760F3980 FF15B4110E76 Call dword ptr [760E11B4] :760F3986 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"\Desktop" | :760F398A 68F4980E76 push 760E98F4 :760F398F 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F3990 FF1598110E76 Call dword ptr [760E1198] :760F3996 E9CF21FFFF jmp 760E5B6A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5B90(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F399B FF15A0110E76 Call dword ptr [760E11A0] :760F39A1 89442410 mov dword ptr [esp+10], eax :760F39A5 A184110E76 mov eax, dword ptr [760E1184] :760F39AA F60002 test byte ptr [eax], 02 :760F39AD 7428 je 760F39D7 :760F39AF 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F39B1 6820610E76 push 760E6120 :760F39B6 684E050000 push 0000054E :760F39BB 53 push ebx :760F39BC FFD5 call ebp :760F39BE 85C0 test eax, eax :760F39C0 7415 je 760F39D7 :760F39C2 FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"Favorites, error 0x%x" | :760F39C6 68C0980E76 push 760E98C0 :760F39CB FF74241C push [esp+1C] :760F39CF E85795FFFF call 760ECF2B :760F39D4 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F39AD(C), :760F39C0(C) | :760F39D7 8D442428 lea eax, dword ptr [esp+28] :760F39DB 6800040000 push 00000400 :760F39E0 50 push eax * Reference To: KERNEL32.GetWindowsDirectoryA, Ord:0197h | :760F39E1 FF15B4110E76 Call dword ptr [760E11B4] :760F39E7 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"\Favorites" | :760F39EB 68B4980E76 push 760E98B4 :760F39F0 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F39F1 FF1598110E76 Call dword ptr [760E1198] :760F39F7 E99A21FFFF jmp 760E5B96 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5BBC(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F39FC FF15A0110E76 Call dword ptr [760E11A0] :760F3A02 89442410 mov dword ptr [esp+10], eax :760F3A06 A184110E76 mov eax, dword ptr [760E1184] :760F3A0B F60002 test byte ptr [eax], 02 :760F3A0E 7428 je 760F3A38 :760F3A10 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3A12 6820610E76 push 760E6120 :760F3A17 685A050000 push 0000055A :760F3A1C 53 push ebx :760F3A1D FFD5 call ebp :760F3A1F 85C0 test eax, eax :760F3A21 7415 je 760F3A38 :760F3A23 FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"InternetCache, error 0x%x" | :760F3A27 687C980E76 push 760E987C :760F3A2C FF74241C push [esp+1C] :760F3A30 E8F694FFFF call 760ECF2B :760F3A35 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3A0E(C), :760F3A21(C) | :760F3A38 8D442428 lea eax, dword ptr [esp+28] :760F3A3C 6800040000 push 00000400 :760F3A41 50 push eax * Reference To: KERNEL32.GetWindowsDirectoryA, Ord:0197h | :760F3A42 FF15B4110E76 Call dword ptr [760E11B4] :760F3A48 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"\Temporary Internet Files" | :760F3A4C 6860980E76 push 760E9860 :760F3A51 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F3A52 FF1598110E76 Call dword ptr [760E1198] :760F3A58 E96521FFFF jmp 760E5BC2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5BE8(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F3A5D FF15A0110E76 Call dword ptr [760E11A0] :760F3A63 89442410 mov dword ptr [esp+10], eax :760F3A67 A184110E76 mov eax, dword ptr [760E1184] :760F3A6C F60002 test byte ptr [eax], 02 :760F3A6F 7428 je 760F3A99 :760F3A71 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3A73 6820610E76 push 760E6120 :760F3A78 6866050000 push 00000566 :760F3A7D 53 push ebx :760F3A7E FFD5 call ebp :760F3A80 85C0 test eax, eax :760F3A82 7415 je 760F3A99 :760F3A84 FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"Nethood, error 0x%x" | :760F3A88 682C980E76 push 760E982C :760F3A8D FF74241C push [esp+1C] :760F3A91 E89594FFFF call 760ECF2B :760F3A96 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3A6F(C), :760F3A82(C) | :760F3A99 8D442428 lea eax, dword ptr [esp+28] :760F3A9D 6800040000 push 00000400 :760F3AA2 50 push eax * Reference To: KERNEL32.GetWindowsDirectoryA, Ord:0197h | :760F3AA3 FF15B4110E76 Call dword ptr [760E11B4] :760F3AA9 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"\Nethood" | :760F3AAD 6820980E76 push 760E9820 :760F3AB2 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F3AB3 FF1598110E76 Call dword ptr [760E1198] :760F3AB9 E93021FFFF jmp 760E5BEE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5C14(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F3ABE FF15A0110E76 Call dword ptr [760E11A0] :760F3AC4 89442410 mov dword ptr [esp+10], eax :760F3AC8 A184110E76 mov eax, dword ptr [760E1184] :760F3ACD F60002 test byte ptr [eax], 02 :760F3AD0 7428 je 760F3AFA :760F3AD2 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3AD4 6820610E76 push 760E6120 :760F3AD9 6872050000 push 00000572 :760F3ADE 53 push ebx :760F3ADF FFD5 call ebp :760F3AE1 85C0 test eax, eax :760F3AE3 7415 je 760F3AFA :760F3AE5 FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"PersonalDocuments, error 0x%x" | :760F3AE9 68E4970E76 push 760E97E4 :760F3AEE FF74241C push [esp+1C] :760F3AF2 E83494FFFF call 760ECF2B :760F3AF7 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3AD0(C), :760F3AE3(C) | :760F3AFA 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"C:\Unknown_" | :760F3AFE 6804610E76 push 760E6104 :760F3B03 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760F3B04 FF1504120E76 Call dword ptr [760E1204] :760F3B0A 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"PersonalDocuments" | :760F3B0E 6830600E76 push 760E6030 :760F3B13 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F3B14 FF1598110E76 Call dword ptr [760E1198] :760F3B1A E9FB20FFFF jmp 760E5C1A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5C40(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F3B1F FF15A0110E76 Call dword ptr [760E11A0] :760F3B25 89442410 mov dword ptr [esp+10], eax :760F3B29 A184110E76 mov eax, dword ptr [760E1184] :760F3B2E F60002 test byte ptr [eax], 02 :760F3B31 7428 je 760F3B5B :760F3B33 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3B35 6820610E76 push 760E6120 :760F3B3A 687E050000 push 0000057E :760F3B3F 53 push ebx :760F3B40 FFD5 call ebp :760F3B42 85C0 test eax, eax :760F3B44 7415 je 760F3B5B :760F3B46 FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"StartMenu, error 0x%x" | :760F3B4A 68B0970E76 push 760E97B0 :760F3B4F FF74241C push [esp+1C] :760F3B53 E8D393FFFF call 760ECF2B :760F3B58 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3B31(C), :760F3B44(C) | :760F3B5B 8D442428 lea eax, dword ptr [esp+28] :760F3B5F 6800040000 push 00000400 :760F3B64 50 push eax * Reference To: KERNEL32.GetWindowsDirectoryA, Ord:0197h | :760F3B65 FF15B4110E76 Call dword ptr [760E11B4] :760F3B6B 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"\Start Menu" | :760F3B6F 68A4970E76 push 760E97A4 :760F3B74 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F3B75 FF1598110E76 Call dword ptr [760E1198] :760F3B7B E9C620FFFF jmp 760E5C46 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5C6C(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F3B80 FF15A0110E76 Call dword ptr [760E11A0] :760F3B86 89442410 mov dword ptr [esp+10], eax :760F3B8A A184110E76 mov eax, dword ptr [760E1184] :760F3B8F F60002 test byte ptr [eax], 02 :760F3B92 7428 je 760F3BBC :760F3B94 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3B96 6820610E76 push 760E6120 :760F3B9B 688A050000 push 0000058A :760F3BA0 53 push ebx :760F3BA1 FFD5 call ebp :760F3BA3 85C0 test eax, eax :760F3BA5 7415 je 760F3BBC :760F3BA7 FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"Templates, error 0x%x" | :760F3BAB 6870970E76 push 760E9770 :760F3BB0 FF74241C push [esp+1C] :760F3BB4 E87293FFFF call 760ECF2B :760F3BB9 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3B92(C), :760F3BA5(C) | :760F3BBC 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"C:\Unknown_" | :760F3BC0 6804610E76 push 760E6104 :760F3BC5 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760F3BC6 FF1504120E76 Call dword ptr [760E1204] :760F3BCC 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"Templates" | :760F3BD0 6818600E76 push 760E6018 :760F3BD5 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F3BD6 FF1598110E76 Call dword ptr [760E1198] :760F3BDC E99120FFFF jmp 760E5C72 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5C98(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F3BE1 FF15A0110E76 Call dword ptr [760E11A0] :760F3BE7 89442410 mov dword ptr [esp+10], eax :760F3BEB A184110E76 mov eax, dword ptr [760E1184] :760F3BF0 F60002 test byte ptr [eax], 02 :760F3BF3 742B je 760F3C20 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3BF5 BE20610E76 mov esi, 760E6120 :760F3BFA 6A02 push 00000002 :760F3BFC 56 push esi :760F3BFD 6896050000 push 00000596 :760F3C02 53 push ebx :760F3C03 FFD5 call ebp :760F3C05 85C0 test eax, eax :760F3C07 741C je 760F3C25 :760F3C09 FF742410 push [esp+10] * Possible StringData Ref from Code Obj ->"Error getting special folder: " ->"History, error 0x%x" | :760F3C0D 683C970E76 push 760E973C :760F3C12 FF74241C push [esp+1C] :760F3C16 E81093FFFF call 760ECF2B :760F3C1B 83C40C add esp, 0000000C :760F3C1E EB05 jmp 760F3C25 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3BF3(C) | * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3C20 BE20610E76 mov esi, 760E6120 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3C07(C), :760F3C1E(U) | :760F3C25 8D442428 lea eax, dword ptr [esp+28] :760F3C29 6800040000 push 00000400 :760F3C2E 50 push eax * Reference To: KERNEL32.GetWindowsDirectoryA, Ord:0197h | :760F3C2F FF15B4110E76 Call dword ptr [760E11B4] :760F3C35 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"\History" | :760F3C39 6830970E76 push 760E9730 :760F3C3E 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F3C3F FF1598110E76 Call dword ptr [760E1198] :760F3C45 E95920FFFF jmp 760E5CA3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5CD0(C) | :760F3C4A A184110E76 mov eax, dword ptr [760E1184] :760F3C4F F60002 test byte ptr [eax], 02 :760F3C52 7426 je 760F3C7A :760F3C54 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CXMLFileListParser::PopulateReplaceEntries()" | :760F3C56 6820610E76 push 760E6120 :760F3C5B 68A1050000 push 000005A1 :760F3C60 53 push ebx :760F3C61 FFD5 call ebp :760F3C63 85C0 test eax, eax :760F3C65 7413 je 760F3C7A :760F3C67 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error opening registry key to " ->"retrieve program files" | :760F3C69 68F8960E76 push 760E96F8 :760F3C6E FF74241C push [esp+1C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F36BC(U) | :760F3C72 E8B492FFFF call 760ECF2B :760F3C77 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3674(C), :760F3690(C), :760F36AF(C), :760F3C52(C), :760F3C65(C) | :760F3C7A 837C241800 cmp dword ptr [esp+18], 00000000 :760F3C7F 740A je 760F3C8B :760F3C81 FF742418 push [esp+18] * Reference To: ADVAPI32.RegCloseKey, Ord:0184h | :760F3C85 FF15B0120E76 Call dword ptr [760E12B0] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3C7F(C) | :760F3C8B 33C0 xor eax, eax :760F3C8D E90122FFFF jmp 760E5E93 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5CFD(C) | :760F3C92 A184110E76 mov eax, dword ptr [760E1184] :760F3C97 F60002 test byte ptr [eax], 02 :760F3C9A 7422 je 760F3CBE :760F3C9C 6A02 push 00000002 :760F3C9E 56 push esi :760F3C9F 68A8050000 push 000005A8 :760F3CA4 53 push ebx :760F3CA5 FFD5 call ebp :760F3CA7 85C0 test eax, eax :760F3CA9 7413 je 760F3CBE :760F3CAB 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error querying program files registry " ->"key." | :760F3CAD 68CC960E76 push 760E96CC :760F3CB2 FF74241C push [esp+1C] :760F3CB6 E87092FFFF call 760ECF2B :760F3CBB 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3C9A(C), :760F3CA9(C) | :760F3CBE 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"C:\Unknown_" | :760F3CC2 6804610E76 push 760E6104 :760F3CC7 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760F3CC8 FF1504120E76 Call dword ptr [760E1204] :760F3CCE 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"ProgramFilesDir" | :760F3CD2 68D45F0E76 push 760E5FD4 :760F3CD7 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F3CD8 FF1598110E76 Call dword ptr [760E1198] :760F3CDE E92020FFFF jmp 760E5D03 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5D40(C) | :760F3CE3 A184110E76 mov eax, dword ptr [760E1184] :760F3CE8 F60002 test byte ptr [eax], 02 :760F3CEB 7422 je 760F3D0F :760F3CED 6A02 push 00000002 :760F3CEF 56 push esi :760F3CF0 68B5050000 push 000005B5 :760F3CF5 53 push ebx :760F3CF6 FFD5 call ebp :760F3CF8 85C0 test eax, eax :760F3CFA 7413 je 760F3D0F :760F3CFC 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error querying common files registry " ->"key." | :760F3CFE 68A0960E76 push 760E96A0 :760F3D03 FF74241C push [esp+1C] :760F3D07 E81F92FFFF call 760ECF2B :760F3D0C 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3CEB(C), :760F3CFA(C) | :760F3D0F 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"C:\Unknown_" | :760F3D13 6804610E76 push 760E6104 :760F3D18 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760F3D19 FF1504120E76 Call dword ptr [760E1204] :760F3D1F 8D442428 lea eax, dword ptr [esp+28] * Possible StringData Ref from Code Obj ->"CommonFilesDir" | :760F3D23 68B45F0E76 push 760E5FB4 :760F3D28 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F3D29 FF1598110E76 Call dword ptr [760E1198] :760F3D2F E91220FFFF jmp 760E5D46 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5DE7(C) | :760F3D34 A184110E76 mov eax, dword ptr [760E1184] :760F3D39 F60002 test byte ptr [eax], 02 :760F3D3C 742C je 760F3D6A :760F3D3E 6A02 push 00000002 :760F3D40 56 push esi :760F3D41 68D3050000 push 000005D3 :760F3D46 53 push ebx :760F3D47 FFD5 call ebp :760F3D49 85C0 test eax, eax :760F3D4B 741D je 760F3D6A * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F3D4D FF15A0110E76 Call dword ptr [760E11A0] :760F3D53 50 push eax :760F3D54 8D44242C lea eax, dword ptr [esp+2C] :760F3D58 50 push eax * Possible StringData Ref from Code Obj ->"Error getting LPN for %s; error=%ld" | :760F3D59 687C960E76 push 760E967C :760F3D5E FF742420 push [esp+20] :760F3D62 E8C491FFFF call 760ECF2B :760F3D67 83C410 add esp, 00000010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E5D76(C), :760E5DA3(C), :760F3D3C(C), :760F3D4B(C) | :760F3D6A 8D842428040000 lea eax, dword ptr [esp+00000428] * Possible StringData Ref from Code Obj ->"C:\Unknown_" | :760F3D71 6804610E76 push 760E6104 :760F3D76 50 push eax * Reference To: KERNEL32.lstrcpyA, Ord:032Fh | :760F3D77 FF1504120E76 Call dword ptr [760E1204] :760F3D7D 8D842428040000 lea eax, dword ptr [esp+00000428] * Possible StringData Ref from Code Obj ->"ConnectionWizardDir" | :760F3D84 6868960E76 push 760E9668 :760F3D89 50 push eax * Reference To: KERNEL32.lstrcatA, Ord:0326h | :760F3D8A FF1598110E76 Call dword ptr [760E1198] :760F3D90 E95820FFFF jmp 760E5DED * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5E04(C) | :760F3D95 6A04 push 00000004 :760F3D97 56 push esi :760F3D98 68E5050000 push 000005E5 :760F3D9D 53 push ebx :760F3D9E FFD5 call ebp :760F3DA0 85C0 test eax, eax :760F3DA2 0F846220FFFF je 760E5E0A :760F3DA8 8D842428040000 lea eax, dword ptr [esp+00000428] :760F3DAF 50 push eax * Possible StringData Ref from Code Obj ->"ICW Path = %s" | :760F3DB0 6858960E76 push 760E9658 :760F3DB5 FF74241C push [esp+1C] :760F3DB9 E86D91FFFF call 760ECF2B :760F3DBE 83C40C add esp, 0000000C :760F3DC1 E94420FFFF jmp 760E5E0A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5E37(C) | :760F3DC6 A184110E76 mov eax, dword ptr [760E1184] :760F3DCB F60004 test byte ptr [eax], 04 :760F3DCE 0F847420FFFF je 760E5E48 :760F3DD4 6A04 push 00000004 :760F3DD6 56 push esi :760F3DD7 68FC050000 push 000005FC :760F3DDC 53 push ebx :760F3DDD FFD5 call ebp :760F3DDF 85C0 test eax, eax :760F3DE1 0F846120FFFF je 760E5E48 :760F3DE7 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error getting system restore root " ->"directory" | :760F3DE9 682C960E76 push 760E962C :760F3DEE FF74241C push [esp+1C] :760F3DF2 E83491FFFF call 760ECF2B :760F3DF7 83C40C add esp, 0000000C :760F3DFA E94920FFFF jmp 760E5E48 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5E55(C) | :760F3DFF A184110E76 mov eax, dword ptr [760E1184] :760F3E04 F60004 test byte ptr [eax], 04 :760F3E07 0F845920FFFF je 760E5E66 :760F3E0D 6A04 push 00000004 :760F3E0F 56 push esi :760F3E10 6809060000 push 00000609 :760F3E15 53 push ebx :760F3E16 FFD5 call ebp :760F3E18 85C0 test eax, eax :760F3E1A 0F844620FFFF je 760E5E66 :760F3E20 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error getting system restore archive " ->"directory" | :760F3E22 68FC950E76 push 760E95FC :760F3E27 FF74241C push [esp+1C] :760F3E2B E8FB90FFFF call 760ECF2B :760F3E30 83C40C add esp, 0000000C :760F3E33 E92E20FFFF jmp 760E5E66 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E5E73(C) | :760F3E38 A184110E76 mov eax, dword ptr [760E1184] :760F3E3D F60004 test byte ptr [eax], 04 :760F3E40 0F843E20FFFF je 760E5E84 :760F3E46 6A04 push 00000004 :760F3E48 56 push esi :760F3E49 6814060000 push 00000614 :760F3E4E 53 push ebx :760F3E4F FFD5 call ebp :760F3E51 85C0 test eax, eax :760F3E53 0F842B20FFFF je 760E5E84 :760F3E59 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error getting system restore temp " ->"directory" | :760F3E5B 68D0950E76 push 760E95D0 :760F3E60 FF74241C push [esp+1C] :760F3E64 E8C290FFFF call 760ECF2B :760F3E69 83C40C add esp, 0000000C :760F3E6C E91320FFFF jmp 760E5E84 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E40C7(C) | :760F3E71 85C9 test ecx, ecx :760F3E73 7407 je 760F3E7C :760F3E75 E83203FFFF call 760E41AC :760F3E7A EB02 jmp 760F3E7E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3E73(C) | :760F3E7C 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3E7A(U) | :760F3E7E 8B750C mov esi, dword ptr [ebp+0C] :760F3E81 53 push ebx :760F3E82 50 push eax :760F3E83 56 push esi * Reference To: MSVCRT.strncpy, Ord:02BEh | :760F3E84 FF1540100E76 Call dword ptr [760E1040] :760F3E8A 80241E00 and byte ptr [esi+ebx], 00 :760F3E8E 83C40C add esp, 0000000C :760F3E91 FF7508 push [ebp+08] * Reference To: OLEAUT32.SysFreeString, Ord:0006h | :760F3E94 FF1590100E76 Call dword ptr [760E1090] :760F3E9A 8B4DFC mov ecx, dword ptr [ebp-04] :760F3E9D 8D7701 lea esi, dword ptr [edi+01] :760F3EA0 85C9 test ecx, ecx :760F3EA2 7405 je 760F3EA9 :760F3EA4 E8A801FFFF call 760E4051 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3EA2(C) | :760F3EA9 8BC6 mov eax, esi :760F3EAB E96102FFFF jmp 760E4111 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E40CF(C) | :760F3EB0 33C0 xor eax, eax :760F3EB2 E92302FFFF jmp 760E40DA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4125(C) | :760F3EB7 33C0 xor eax, eax :760F3EB9 E97C02FFFF jmp 760E413A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E413E(C) | :760F3EBE 680E000780 push 8007000E :760F3EC3 E8FC480000 call 760F87C4 :760F3EC8 E97702FFFF jmp 760E4144 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E4194(C), :760E419E(C) | :760F3ECD 33C0 xor eax, eax :760F3ECF C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4183(C) | :760F3ED0 680E000780 push 8007000E :760F3ED5 E8EA480000 call 760F87C4 :760F3EDA E9AA02FFFF jmp 760E4189 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E4162(C), :760E416A(C) | :760F3EDF 893E mov dword ptr [esi], edi :760F3EE1 E9A302FFFF jmp 760E4189 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E41C1(C) | :760F3EE6 3906 cmp dword ptr [esi], eax :760F3EE8 0F84D902FFFF je 760E41C7 :760F3EEE 680E000780 push 8007000E :760F3EF3 E8CC480000 call 760F87C4 :760F3EF8 E9CA02FFFF jmp 760E41C7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4A91(C) | :760F3EFD 3C53 cmp al, 53 :760F3EFF 750C jne 760F3F0D :760F3F01 E9910BFFFF jmp 760E4A97 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E4A81(C), :760E4A89(C) | :760F3F06 6A01 push 00000001 :760F3F08 E98C0BFFFF jmp 760E4A99 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E4A71(C), :760E4A79(C), :760F3EFF(C) | :760F3F0D 33C0 xor eax, eax :760F3F0F E9860BFFFF jmp 760E4A9A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4359(C) | :760F3F14 802000 and byte ptr [eax], 00 :760F3F17 E94304FFFF jmp 760E435F * Referenced by a CALL at Addresses: |:760ED013 , :760EEB28 | * Reference To: WINTRUST.CryptCATAdminReleaseContext, Ord:0007h | :760F3F1C FF25CC100E76 Jmp dword ptr [760E10CC] * Referenced by a CALL at Addresses: |:760ED373 , :760EEB1A | * Reference To: WINTRUST.CryptCATAdminReleaseCatalogContext, Ord:0006h | :760F3F22 FF25D4100E76 Jmp dword ptr [760E10D4] * Referenced by a CALL at Address: |:760ED2E6 | * Reference To: WINTRUST.CryptCATCatalogInfoFromContext, Ord:0010h | :760F3F28 FF25DC100E76 Jmp dword ptr [760E10DC] * Referenced by a CALL at Addresses: |:760ED274 , :760ED35A | * Reference To: WINTRUST.CryptCATAdminEnumCatalogFromHash, Ord:0005h | :760F3F2E FF25D8100E76 Jmp dword ptr [760E10D8] * Referenced by a CALL at Address: |:760EEAC0 | * Reference To: WINTRUST.CryptCATAdminAddCatalog, Ord:0003h | :760F3F34 FF25E4100E76 Jmp dword ptr [760E10E4] :760F3F3A 56 push esi :760F3F3B 8BF1 mov esi, ecx :760F3F3D E8E3D7FEFF call 760E1725 :760F3F42 F644240801 test [esp+08], 01 :760F3F47 7407 je 760F3F50 :760F3F49 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F3F4A E8FCD9FEFF Call 760E194B :760F3F4F 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F3F47(C) | :760F3F50 8BC6 mov eax, esi :760F3F52 5E pop esi :760F3F53 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1733(C) | :760F3F56 50 push eax * Reference To: MSVCRT.free, Ord:025Bh | :760F3F57 FF1518100E76 Call dword ptr [760E1018] :760F3F5D 59 pop ecx :760F3F5E E9D6D7FEFF jmp 760E1739 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E173E(C) | :760F3F63 56 push esi * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760F3F64 FF1534120E76 Call dword ptr [760E1234] :760F3F6A E9D5D7FEFF jmp 760E1744 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E36F6(C) | :760F3F6F 6A57 push 00000057 :760F3F71 58 pop eax :760F3F72 E91AF8FEFF jmp 760E3791 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3769(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F3F77 FF15A0110E76 Call dword ptr [760E11A0] :760F3F7D 8BF0 mov esi, eax :760F3F7F A184110E76 mov eax, dword ptr [760E1184] :760F3F84 F60004 test byte ptr [eax], 04 :760F3F87 742A je 760F3FB3 :760F3F89 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"Init" | :760F3F8B 6894910E76 push 760E9194 :760F3F90 6898000000 push 00000098 * Possible StringData Ref from Data Obj ->"d:\mpcfre\core\logging\ceventlogger.cpp" | :760F3F95 68FCDF0F76 push 760FDFFC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F3F9A FF1580110E76 Call dword ptr [760E1180] :760F3FA0 85C0 test eax, eax :760F3FA2 740F je 760F3FB3 :760F3FA4 56 push esi * Possible StringData Ref from Code Obj ->"CreateSemaphore Failed 0x%x" | :760F3FA5 68609B0E76 push 760E9B60 :760F3FAA 53 push ebx :760F3FAB E87B8FFFFF call 760ECF2B :760F3FB0 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F3F87(C), :760F3FA2(C) | :760F3FB3 8BC6 mov eax, esi :760F3FB5 E9D7F7FEFF jmp 760E3791 :760F3FBA 6A30 push 00000030 * Possible StringData Ref from Code Obj ->"Windows System File Protection" | :760F3FBC 687C9B0E76 push 760E9B7C :760F3FC1 FF74240C push [esp+0C] :760F3FC5 6A00 push 00000000 * Reference To: USER32.MessageBoxA, Ord:01C3h | :760F3FC7 FF1598120E76 Call dword ptr [760E1298] :760F3FCD FF742404 push [esp+04] * Reference To: MSVCRT.free, Ord:025Bh | :760F3FD1 FF1518100E76 Call dword ptr [760E1018] :760F3FD7 59 pop ecx :760F3FD8 33C0 xor eax, eax :760F3FDA C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2405(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F3FDD FF15A0110E76 Call dword ptr [760E11A0] :760F3FE3 8985D4FDFFFF mov dword ptr [ebp+FFFFFDD4], eax :760F3FE9 A184110E76 mov eax, dword ptr [760E1184] :760F3FEE F60004 test byte ptr [eax], 04 :760F3FF1 0F84E9E4FEFF je 760E24E0 :760F3FF7 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"LogEvent" | :760F3FF9 68189C0E76 push 760E9C18 :760F3FFE 68E1000000 push 000000E1 * Possible StringData Ref from Data Obj ->"d:\mpcfre\core\logging\ceventlogger.cpp" | :760F4003 68FCDF0F76 push 760FDFFC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4008 FF1580110E76 Call dword ptr [760E1180] :760F400E 85C0 test eax, eax :760F4010 0F84CAE4FEFF je 760E24E0 :760F4016 FFB5D4FDFFFF push dword ptr [ebp+FFFFFDD4] * Possible StringData Ref from Code Obj ->"CreateFile Failed 0x%x" | :760F401C 68009C0E76 push 760E9C00 :760F4021 56 push esi :760F4022 E8048FFFFF call 760ECF2B :760F4027 83C40C add esp, 0000000C :760F402A E9B1E4FEFF jmp 760E24E0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2410(C) | :760F402F C785D4FDFFFF57000000 mov dword ptr [ebp+FFFFFDD4], 00000057 :760F4039 E9A2E4FEFF jmp 760E24E0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E241C(C) | :760F403E 899DD4FDFFFF mov dword ptr [ebp+FFFFFDD4], ebx :760F4044 E997E4FEFF jmp 760E24E0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2435(C) | :760F4049 898DD4FDFFFF mov dword ptr [ebp+FFFFFDD4], ecx :760F404F E98CE4FEFF jmp 760E24E0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E244E(C) | :760F4054 A184110E76 mov eax, dword ptr [760E1184] :760F4059 F60004 test byte ptr [eax], 04 :760F405C 7430 je 760F408E :760F405E 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"LogEvent" | :760F4060 68189C0E76 push 760E9C18 :760F4065 6800010000 push 00000100 * Possible StringData Ref from Data Obj ->"d:\mpcfre\core\logging\ceventlogger.cpp" | :760F406A 68FCDF0F76 push 760FDFFC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F406F FF1580110E76 Call dword ptr [760E1180] :760F4075 85C0 test eax, eax :760F4077 7415 je 760F408E * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F4079 FF15A0110E76 Call dword ptr [760E11A0] :760F407F 50 push eax * Possible StringData Ref from Code Obj ->"SetFilePointer Failed 0x%x" | :760F4080 68E49B0E76 push 760E9BE4 :760F4085 56 push esi :760F4086 E8A08EFFFF call 760ECF2B :760F408B 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F405C(C), :760F4077(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F408E FF15A0110E76 Call dword ptr [760E11A0] :760F4094 8985D4FDFFFF mov dword ptr [ebp+FFFFFDD4], eax :760F409A EB45 jmp 760F40E1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E24C8(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F409C FF15A0110E76 Call dword ptr [760E11A0] :760F40A2 8985D4FDFFFF mov dword ptr [ebp+FFFFFDD4], eax :760F40A8 A184110E76 mov eax, dword ptr [760E1184] :760F40AD F60004 test byte ptr [eax], 04 :760F40B0 742F je 760F40E1 :760F40B2 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"LogEvent" | :760F40B4 68189C0E76 push 760E9C18 :760F40B9 681A010000 push 0000011A * Possible StringData Ref from Data Obj ->"d:\mpcfre\core\logging\ceventlogger.cpp" | :760F40BE 68FCDF0F76 push 760FDFFC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F40C3 FF1580110E76 Call dword ptr [760E1180] :760F40C9 85C0 test eax, eax :760F40CB 7414 je 760F40E1 :760F40CD FFB5D4FDFFFF push dword ptr [ebp+FFFFFDD4] * Possible StringData Ref from Code Obj ->"WriteFile Failed 0x%x" | :760F40D3 68CC9B0E76 push 760E9BCC :760F40D8 56 push esi :760F40D9 E84D8EFFFF call 760ECF2B :760F40DE 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F409A(U), :760F40B0(C), :760F40CB(C) | :760F40E1 6AFF push FFFFFFFF :760F40E3 8D45F0 lea eax, dword ptr [ebp-10] :760F40E6 50 push eax * Reference To: MSVCRT._local_unwind2, Ord:0139h | :760F40E7 E8C0460000 Call 760F87AC :760F40EC 59 pop ecx :760F40ED 59 pop ecx :760F40EE E9EDE3FEFF jmp 760E24E0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E24DA(C) | :760F40F3 FF750C push [ebp+0C] * Reference To: MSVCRT._strdup, Ord:01BCh | :760F40F6 FF152C100E76 Call dword ptr [760E102C] :760F40FC 59 pop ecx :760F40FD 3BC3 cmp eax, ebx :760F40FF 7558 jne 760F4159 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F4101 FF15A0110E76 Call dword ptr [760E11A0] :760F4107 8BF8 mov edi, eax :760F4109 A184110E76 mov eax, dword ptr [760E1184] :760F410E F60002 test byte ptr [eax], 02 :760F4111 742A je 760F413D :760F4113 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"LogEvent" | :760F4115 68189C0E76 push 760E9C18 :760F411A 682F010000 push 0000012F * Possible StringData Ref from Data Obj ->"d:\mpcfre\core\logging\ceventlogger.cpp" | :760F411F 68FCDF0F76 push 760FDFFC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4124 FF1580110E76 Call dword ptr [760E1180] :760F412A 85C0 test eax, eax :760F412C 740F je 760F413D :760F412E 57 push edi * Possible StringData Ref from Code Obj ->"Error duplicating string for file " ->"popup ec: %d" | :760F412F 689C9B0E76 push 760E9B9C :760F4134 56 push esi :760F4135 E8F18DFFFF call 760ECF2B :760F413A 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4111(C), :760F412C(C) | :760F413D C785D4FDFFFF4F050000 mov dword ptr [ebp+FFFFFDD4], 0000054F :760F4147 E994E3FEFF jmp 760E24E0 :760F414C 33DB xor ebx, ebx :760F414E 8BB5C4FDFFFF mov esi, dword ptr [ebp+FFFFFDC4] :760F4154 E9B2E3FEFF jmp 760E250B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F40FF(C) | :760F4159 8D8DCCFDFFFF lea ecx, dword ptr [ebp+FFFFFDCC] :760F415F 51 push ecx :760F4160 53 push ebx :760F4161 50 push eax * Possible StringData Ref from Code Obj ->"j0h|" | :760F4162 68BA3F0F76 push 760F3FBA :760F4167 53 push ebx :760F4168 53 push ebx * Reference To: KERNEL32.CreateThread, Ord:004Dh | :760F4169 FF15CC110E76 Call dword ptr [760E11CC] :760F416F 83F8FF cmp eax, FFFFFFFF :760F4172 0F8468E3FEFF je 760E24E0 :760F4178 50 push eax * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760F4179 FF1534120E76 Call dword ptr [760E1234] :760F417F E95CE3FEFF jmp 760E24E0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E37D2(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F4184 FF15A0110E76 Call dword ptr [760E11A0] :760F418A 8BD8 mov ebx, eax :760F418C A184110E76 mov eax, dword ptr [760E1184] :760F4191 F60004 test byte ptr [eax], 04 :760F4194 742A je 760F41C0 :760F4196 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"TruncateFileSize" | :760F4198 68AC9C0E76 push 760E9CAC :760F419D 686A010000 push 0000016A * Possible StringData Ref from Data Obj ->"d:\mpcfre\core\logging\ceventlogger.cpp" | :760F41A2 68FCDF0F76 push 760FDFFC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F41A7 FF1580110E76 Call dword ptr [760E1180] :760F41AD 85C0 test eax, eax :760F41AF 740F je 760F41C0 :760F41B1 53 push ebx * Possible StringData Ref from Code Obj ->"CreateFile Failed 0x%x" | :760F41B2 68009C0E76 push 760E9C00 :760F41B7 56 push esi :760F41B8 E86E8DFFFF call 760ECF2B :760F41BD 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4194(C), :760F41AF(C) | :760F41C0 897C2410 mov dword ptr [esp+10], edi :760F41C4 E932F6FEFF jmp 760E37FB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E37E5(C) | :760F41C9 6A02 push 00000002 :760F41CB 57 push edi :760F41CC 686079FEFF push FFFE7960 :760F41D1 55 push ebp * Reference To: KERNEL32.SetFilePointer, Ord:0295h | :760F41D2 FF15D4110E76 Call dword ptr [760E11D4] :760F41D8 85C0 test eax, eax :760F41DA 7545 jne 760F4221 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F41DC FF15A0110E76 Call dword ptr [760E11A0] :760F41E2 8BD8 mov ebx, eax :760F41E4 A184110E76 mov eax, dword ptr [760E1184] :760F41E9 F60002 test byte ptr [eax], 02 :760F41EC 742A je 760F4218 :760F41EE 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"TruncateFileSize" | :760F41F0 68AC9C0E76 push 760E9CAC :760F41F5 687D010000 push 0000017D * Possible StringData Ref from Data Obj ->"d:\mpcfre\core\logging\ceventlogger.cpp" | :760F41FA 68FCDF0F76 push 760FDFFC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F41FF FF1580110E76 Call dword ptr [760E1180] :760F4205 85C0 test eax, eax :760F4207 740F je 760F4218 :760F4209 53 push ebx * Possible StringData Ref from Code Obj ->"SetFilePointer failed 0x%x" | :760F420A 68909C0E76 push 760E9C90 :760F420F 56 push esi :760F4210 E8168DFFFF call 760ECF2B :760F4215 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F41EC(C), :760F4207(C) | :760F4218 897C2410 mov dword ptr [esp+10], edi :760F421C E9CAF5FEFF jmp 760E37EB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F41DA(C) | :760F4221 BFA0860100 mov edi, 000186A0 :760F4226 57 push edi :760F4227 6A08 push 00000008 * Reference To: KERNEL32.GetProcessHeap, Ord:0155h | :760F4229 FF15F8110E76 Call dword ptr [760E11F8] :760F422F 50 push eax * Reference To: KERNEL32.HeapAlloc, Ord:01B4h | :760F4230 FF15EC110E76 Call dword ptr [760E11EC] :760F4236 85C0 test eax, eax :760F4238 89442414 mov dword ptr [esp+14], eax :760F423C 753F jne 760F427D :760F423E A184110E76 mov eax, dword ptr [760E1184] :760F4243 F60002 test byte ptr [eax], 02 :760F4246 0F84EC010000 je 760F4438 :760F424C 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"TruncateFileSize" | :760F424E 68AC9C0E76 push 760E9CAC :760F4253 6887010000 push 00000187 * Possible StringData Ref from Data Obj ->"d:\mpcfre\core\logging\ceventlogger.cpp" | :760F4258 68FCDF0F76 push 760FDFFC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F425D FF1580110E76 Call dword ptr [760E1180] :760F4263 85C0 test eax, eax :760F4265 0F84CD010000 je 760F4438 * Possible StringData Ref from Code Obj ->"Out of memory" | :760F426B 68809C0E76 push 760E9C80 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F42F3(U) | :760F4270 56 push esi :760F4271 E8B58CFFFF call 760ECF2B :760F4276 59 pop ecx :760F4277 59 pop ecx :760F4278 E9BB010000 jmp 760F4438 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F423C(C) | :760F427D 8D4C241C lea ecx, dword ptr [esp+1C] :760F4281 6A00 push 00000000 :760F4283 51 push ecx :760F4284 57 push edi :760F4285 50 push eax :760F4286 55 push ebp * Reference To: KERNEL32.ReadFile, Ord:023Dh | :760F4287 FF1594110E76 Call dword ptr [760E1194] :760F428D 85C0 test eax, eax :760F428F 0F8467010000 je 760F43FC :760F4295 397C241C cmp dword ptr [esp+1C], edi :760F4299 0F855D010000 jne 760F43FC :760F429F 8B442414 mov eax, dword ptr [esp+14] :760F42A3 8DB89F860100 lea edi, dword ptr [eax+0001869F] :760F42A9 3BC7 cmp eax, edi :760F42AB 7414 je 760F42C1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F42BB(C) | :760F42AD 8A08 mov cl, byte ptr [eax] :760F42AF 40 inc eax :760F42B0 80F90D cmp cl, 0D :760F42B3 89442418 mov dword ptr [esp+18], eax :760F42B7 7404 je 760F42BD :760F42B9 3BC7 cmp eax, edi :760F42BB 75F0 jne 760F42AD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F42B7(C) | :760F42BD 3BC7 cmp eax, edi :760F42BF 7537 jne 760F42F8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F42AB(C) | :760F42C1 A184110E76 mov eax, dword ptr [760E1184] :760F42C6 F60002 test byte ptr [eax], 02 :760F42C9 0F8469010000 je 760F4438 :760F42CF 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"TruncateFileSize" | :760F42D1 68AC9C0E76 push 760E9CAC :760F42D6 68A1010000 push 000001A1 * Possible StringData Ref from Data Obj ->"d:\mpcfre\core\logging\ceventlogger.cpp" | :760F42DB 68FCDF0F76 push 760FDFFC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F42E0 FF1580110E76 Call dword ptr [760E1180] :760F42E6 85C0 test eax, eax :760F42E8 0F844A010000 je 760F4438 * Possible StringData Ref from Code Obj ->"No newline found" | :760F42EE 686C9C0E76 push 760E9C6C :760F42F3 E978FFFFFF jmp 760F4270 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F42BF(C) | :760F42F8 80380A cmp byte ptr [eax], 0A :760F42FB 7505 jne 760F4302 :760F42FD 40 inc eax :760F42FE 89442418 mov dword ptr [esp+18], eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F42FB(C) | :760F4302 55 push ebp * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760F4303 FF1534120E76 Call dword ptr [760E1234] :760F4309 85C0 test eax, eax :760F430B 7540 jne 760F434D * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F430D FF15A0110E76 Call dword ptr [760E11A0] :760F4313 8BF8 mov edi, eax :760F4315 A184110E76 mov eax, dword ptr [760E1184] :760F431A F60002 test byte ptr [eax], 02 :760F431D 0F8415010000 je 760F4438 :760F4323 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"TruncateFileSize" | :760F4325 68AC9C0E76 push 760E9CAC :760F432A 68B1010000 push 000001B1 * Possible StringData Ref from Data Obj ->"d:\mpcfre\core\logging\ceventlogger.cpp" | :760F432F 68FCDF0F76 push 760FDFFC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4334 FF1580110E76 Call dword ptr [760E1180] :760F433A 85C0 test eax, eax :760F433C 0F84F6000000 je 760F4438 :760F4342 57 push edi * Possible StringData Ref from Code Obj ->"CloseHandle failed 0x%x" | :760F4343 68549C0E76 push 760E9C54 :760F4348 E9E2000000 jmp 760F442F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F430B(C) | :760F434D 6A00 push 00000000 :760F434F 6800000010 push 10000000 :760F4354 6A02 push 00000002 :760F4356 6A00 push 00000000 :760F4358 6A03 push 00000003 :760F435A 68000000C0 push C0000000 :760F435F FF7608 push [esi+08] :760F4362 FFD3 call ebx :760F4364 8BE8 mov ebp, eax :760F4366 83FDFF cmp ebp, FFFFFFFF :760F4369 7540 jne 760F43AB * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F436B FF15A0110E76 Call dword ptr [760E11A0] :760F4371 8BF8 mov edi, eax :760F4373 A184110E76 mov eax, dword ptr [760E1184] :760F4378 F60002 test byte ptr [eax], 02 :760F437B 0F84B7000000 je 760F4438 :760F4381 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"TruncateFileSize" | :760F4383 68AC9C0E76 push 760E9CAC :760F4388 68C3010000 push 000001C3 * Possible StringData Ref from Data Obj ->"d:\mpcfre\core\logging\ceventlogger.cpp" | :760F438D 68FCDF0F76 push 760FDFFC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4392 FF1580110E76 Call dword ptr [760E1180] :760F4398 85C0 test eax, eax :760F439A 0F8498000000 je 760F4438 :760F43A0 57 push edi * Possible StringData Ref from Code Obj ->"CreateFile Failed 0x%x" | :760F43A1 68009C0E76 push 760E9C00 :760F43A6 E984000000 jmp 760F442F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4369(C) | :760F43AB 2B7C2418 sub edi, dword ptr [esp+18] :760F43AF 8D442420 lea eax, dword ptr [esp+20] :760F43B3 6A00 push 00000000 :760F43B5 50 push eax :760F43B6 47 inc edi :760F43B7 57 push edi :760F43B8 FF742424 push [esp+24] :760F43BC 55 push ebp * Reference To: KERNEL32.WriteFile, Ord:030Eh | :760F43BD FF15B8110E76 Call dword ptr [760E11B8] :760F43C3 85C0 test eax, eax :760F43C5 7576 jne 760F443D * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F43C7 FF15A0110E76 Call dword ptr [760E11A0] :760F43CD 8BF8 mov edi, eax :760F43CF A184110E76 mov eax, dword ptr [760E1184] :760F43D4 F60004 test byte ptr [eax], 04 :760F43D7 745F je 760F4438 :760F43D9 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"TruncateFileSize" | :760F43DB 68AC9C0E76 push 760E9CAC :760F43E0 68D2010000 push 000001D2 * Possible StringData Ref from Data Obj ->"d:\mpcfre\core\logging\ceventlogger.cpp" | :760F43E5 68FCDF0F76 push 760FDFFC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F43EA FF1580110E76 Call dword ptr [760E1180] :760F43F0 85C0 test eax, eax :760F43F2 7444 je 760F4438 :760F43F4 57 push edi * Possible StringData Ref from Code Obj ->"WriteFile failed 0x%x" | :760F43F5 683C9C0E76 push 760E9C3C :760F43FA EB33 jmp 760F442F * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F428F(C), :760F4299(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F43FC FF15A0110E76 Call dword ptr [760E11A0] :760F4402 8BF8 mov edi, eax :760F4404 A184110E76 mov eax, dword ptr [760E1184] :760F4409 F60002 test byte ptr [eax], 02 :760F440C 742A je 760F4438 :760F440E 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"TruncateFileSize" | :760F4410 68AC9C0E76 push 760E9CAC :760F4415 6892010000 push 00000192 * Possible StringData Ref from Data Obj ->"d:\mpcfre\core\logging\ceventlogger.cpp" | :760F441A 68FCDF0F76 push 760FDFFC * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F441F FF1580110E76 Call dword ptr [760E1180] :760F4425 85C0 test eax, eax :760F4427 740F je 760F4438 :760F4429 57 push edi * Possible StringData Ref from Code Obj ->"ReadFile failed 0x%x" | :760F442A 68249C0E76 push 760E9C24 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4348(U), :760F43A6(U), :760F43FA(U) | :760F442F 56 push esi :760F4430 E8F68AFFFF call 760ECF2B :760F4435 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4246(C), :760F4265(C), :760F4278(U), :760F42C9(C), :760F42E8(C) |:760F431D(C), :760F433C(C), :760F437B(C), :760F439A(C), :760F43D7(C) |:760F43F2(C), :760F440C(C), :760F4427(C) | :760F4438 8364241000 and dword ptr [esp+10], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F43C5(C) | :760F443D 837C241400 cmp dword ptr [esp+14], 00000000 :760F4442 7413 je 760F4457 :760F4444 FF742414 push [esp+14] :760F4448 6A00 push 00000000 * Reference To: KERNEL32.GetProcessHeap, Ord:0155h | :760F444A FF15F8110E76 Call dword ptr [760E11F8] :760F4450 50 push eax * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760F4451 FF15FC110E76 Call dword ptr [760E11FC] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4442(C) | :760F4457 33FF xor edi, edi :760F4459 E98DF3FEFF jmp 760E37EB * Referenced by a CALL at Address: |:760EEAB5 | :760F445E 8B4C2404 mov ecx, dword ptr [esp+04] :760F4462 8BC1 mov eax, ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4491(U) | :760F4464 837C240800 cmp dword ptr [esp+08], 00000000 :760F4469 7E28 jle 760F4493 :760F446B 668B11 mov dx, word ptr [ecx] :760F446E 6685D2 test dx, dx :760F4471 7420 je 760F4493 :760F4473 6683FA5C cmp dx, 005C :760F4477 7406 je 760F447F :760F4479 6683FA3A cmp dx, 003A :760F447D 750C jne 760F448B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4477(C) | :760F447F 6683790200 cmp word ptr [ecx+02], 0000 :760F4484 8D5102 lea edx, dword ptr [ecx+02] :760F4487 7402 je 760F448B :760F4489 8BC2 mov eax, edx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F447D(C), :760F4487(C) | :760F448B 41 inc ecx :760F448C 41 inc ecx :760F448D FF4C2408 dec [esp+08] :760F4491 EBD1 jmp 760F4464 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4469(C), :760F4471(C) | :760F4493 C20800 ret 0008 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2FF5(C) | :760F4496 A184110E76 mov eax, dword ptr [760E1184] :760F449B F60004 test byte ptr [eax], 04 :760F449E 7429 je 760F44C9 :760F44A0 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CParseCatalog::Init" | :760F44A2 68149D0E76 push 760E9D14 :760F44A7 6A2C push 0000002C * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F44A9 6824E00F76 push 760FE024 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F44AE FF1580110E76 Call dword ptr [760E1180] :760F44B4 85C0 test eax, eax :760F44B6 7411 je 760F44C9 * Possible StringData Ref from Code Obj ->"SFPConvertToUnicode failed" | :760F44B8 68F89C0E76 push 760E9CF8 :760F44BD 6872450000 push 00004572 :760F44C2 E8648AFFFF call 760ECF2B :760F44C7 59 pop ecx :760F44C8 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F449E(C), :760F44B6(C) | :760F44C9 BE4F050000 mov esi, 0000054F :760F44CE E969EBFEFF jmp 760E303C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E300F(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F44D3 FF15A0110E76 Call dword ptr [760E11A0] :760F44D9 8BF0 mov esi, eax :760F44DB A184110E76 mov eax, dword ptr [760E1184] :760F44E0 F60004 test byte ptr [eax], 04 :760F44E3 742B je 760F4510 :760F44E5 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CParseCatalog::Init" | :760F44E7 68149D0E76 push 760E9D14 :760F44EC 6A3B push 0000003B * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F44EE 6824E00F76 push 760FE024 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F44F3 FF1580110E76 Call dword ptr [760E1180] :760F44F9 85C0 test eax, eax :760F44FB 7413 je 760F4510 :760F44FD 56 push esi * Possible StringData Ref from Code Obj ->"Cannot open catalog file %d" | :760F44FE 68DC9C0E76 push 760E9CDC :760F4503 6872450000 push 00004572 :760F4508 E81E8AFFFF call 760ECF2B :760F450D 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F44E3(C), :760F44FB(C) | :760F4510 85F6 test esi, esi :760F4512 0F851EEBFEFF jne 760E3036 :760F4518 6A57 push 00000057 :760F451A 5E pop esi :760F451B E916EBFEFF jmp 760E3036 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E302E(C) | :760F4520 A184110E76 mov eax, dword ptr [760E1184] :760F4525 F60004 test byte ptr [eax], 04 :760F4528 7429 je 760F4553 :760F452A 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CParseCatalog::Init" | :760F452C 68149D0E76 push 760E9D14 :760F4531 6A51 push 00000051 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F4533 6824E00F76 push 760FE024 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4538 FF1580110E76 Call dword ptr [760E1180] :760F453E 85C0 test eax, eax :760F4540 7411 je 760F4553 * Possible StringData Ref from Code Obj ->"SFPDuplicateString failed" | :760F4542 68C09C0E76 push 760E9CC0 :760F4547 6872450000 push 00004572 :760F454C E8DA89FFFF call 760ECF2B :760F4551 59 pop ecx :760F4552 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4528(C), :760F4540(C) | :760F4553 BE4F050000 mov esi, 0000054F :760F4558 E9D9EAFEFF jmp 760E3036 * Referenced by a CALL at Addresses: |:760EEC05 , :760EEC57 | :760F455D 56 push esi :760F455E 57 push edi :760F455F 687C9D0E76 push 760E9D7C :760F4564 33FF xor edi, edi :760F4566 FF7104 push [ecx+04] * Reference To: WINTRUST.CryptCATGetCatAttrInfo, Ord:0016h | :760F4569 E8E2430000 Call 760F8950 :760F456E 85C0 test eax, eax :760F4570 7539 jne 760F45AB :760F4572 A184110E76 mov eax, dword ptr [760E1184] :760F4577 F60004 test byte ptr [eax], 04 :760F457A 0F8490000000 je 760F4610 :760F4580 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CParseCatalog::GetVersionInfo" | :760F4582 685C9D0E76 push 760E9D5C :760F4587 6A6D push 0000006D * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F4589 6824E00F76 push 760FE024 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F458E FF1580110E76 Call dword ptr [760E1180] :760F4594 85C0 test eax, eax :760F4596 7478 je 760F4610 * Possible StringData Ref from Code Obj ->"No ProductVersion attribute" | :760F4598 68409D0E76 push 760E9D40 :760F459D 6872450000 push 00004572 :760F45A2 E88489FFFF call 760ECF2B :760F45A7 59 pop ecx :760F45A8 59 pop ecx :760F45A9 EB65 jmp 760F4610 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4570(C) | :760F45AB FF700C push [eax+0C] :760F45AE 8B4810 mov ecx, dword ptr [eax+10] :760F45B1 51 push ecx :760F45B2 E8E1E4FEFF call 760E2A98 :760F45B7 8BF0 mov esi, eax :760F45B9 85F6 test esi, esi :760F45BB 7537 jne 760F45F4 :760F45BD A184110E76 mov eax, dword ptr [760E1184] :760F45C2 F60004 test byte ptr [eax], 04 :760F45C5 7429 je 760F45F0 :760F45C7 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CParseCatalog::GetVersionInfo" | :760F45C9 685C9D0E76 push 760E9D5C :760F45CE 6A7E push 0000007E * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F45D0 6824E00F76 push 760FE024 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F45D5 FF1580110E76 Call dword ptr [760E1180] :760F45DB 85C0 test eax, eax :760F45DD 7411 je 760F45F0 * Possible StringData Ref from Code Obj ->"SFPConvertToANSI failed" | :760F45DF 68289D0E76 push 760E9D28 :760F45E4 6872450000 push 00004572 :760F45E9 E83D89FFFF call 760ECF2B :760F45EE 59 pop ecx :760F45EF 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F45C5(C), :760F45DD(C) | :760F45F0 33FF xor edi, edi :760F45F2 EB12 jmp 760F4606 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F45BB(C) | :760F45F4 56 push esi :760F45F5 E8EDE4FEFF call 760E2AE7 :760F45FA 8B4C240C mov ecx, dword ptr [esp+0C] :760F45FE 6A01 push 00000001 :760F4600 5F pop edi :760F4601 8901 mov dword ptr [ecx], eax :760F4603 895104 mov dword ptr [ecx+04], edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F45F2(U) | :760F4606 85F6 test esi, esi :760F4608 7406 je 760F4610 :760F460A 56 push esi :760F460B E8DFD3FEFF call 760E19EF * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F457A(C), :760F4596(C), :760F45A9(U), :760F4608(C) | :760F4610 8BC7 mov eax, edi :760F4612 5F pop edi :760F4613 5E pop esi :760F4614 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E299F(C) | :760F4617 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CParseCatalog::GetNextCatEntry" | :760F4619 68F89D0E76 push 760E9DF8 :760F461E 68B6000000 push 000000B6 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F4623 6824E00F76 push 760FE024 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4628 FF1580110E76 Call dword ptr [760E1180] :760F462E 85C0 test eax, eax :760F4630 0F846FE3FEFF je 760E29A5 :760F4636 55 push ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F474F(U) | * Possible StringData Ref from Code Obj ->"CryptCATEnumerateMember failed" | :760F4637 68D89D0E76 push 760E9DD8 :760F463C 6872450000 push 00004572 :760F4641 E8E588FFFF call 760ECF2B :760F4646 83C40C add esp, 0000000C :760F4649 E957E3FEFF jmp 760E29A5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2959(C) | :760F464E 33C0 xor eax, eax :760F4650 E918E3FEFF jmp 760E296D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2971(C) | :760F4655 A184110E76 mov eax, dword ptr [760E1184] :760F465A F60002 test byte ptr [eax], 02 :760F465D 0F8442E3FEFF je 760E29A5 :760F4663 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CParseCatalog::GetNextCatEntry" | :760F4665 68F89D0E76 push 760E9DF8 :760F466A 68BF000000 push 000000BF * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F466F 6824E00F76 push 760FE024 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4674 FF1580110E76 Call dword ptr [760E1180] :760F467A E9F6000000 jmp 760F4775 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2986(C) | * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F467F 8B2D80110E76 mov ebp, dword ptr [760E1180] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4719(C) | :760F4685 A184110E76 mov eax, dword ptr [760E1184] :760F468A F60004 test byte ptr [eax], 04 :760F468D 7428 je 760F46B7 :760F468F 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CParseCatalog::GetNextCatEntry" | :760F4691 68F89D0E76 push 760E9DF8 :760F4696 68C7000000 push 000000C7 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F469B 6824E00F76 push 760FE024 :760F46A0 FFD5 call ebp :760F46A2 85C0 test eax, eax :760F46A4 7411 je 760F46B7 * Possible StringData Ref from Code Obj ->"pCatEntry->Init() failed" | :760F46A6 68BC9D0E76 push 760E9DBC :760F46AB 6872450000 push 00004572 :760F46B0 E87688FFFF call 760ECF2B :760F46B5 59 pop ecx :760F46B6 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F468D(C), :760F46A4(C) | :760F46B7 8B1F mov ebx, dword ptr [edi] :760F46B9 85DB test ebx, ebx :760F46BB 740E je 760F46CB :760F46BD 8BCB mov ecx, ebx :760F46BF E8AFE5FEFF call 760E2C73 :760F46C4 53 push ebx * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F46C5 E881D2FEFF Call 760E194B :760F46CA 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F46BB(C) | :760F46CB FF742418 push [esp+18] :760F46CF 832700 and dword ptr [edi], 00000000 :760F46D2 FF7604 push [esi+04] * Reference To: WINTRUST.CryptCATEnumerateMember, Ord:0014h | :760F46D5 E8D8E2FEFF Call 760E29B2 :760F46DA 8BD8 mov ebx, eax :760F46DC 85DB test ebx, ebx :760F46DE 895C2418 mov dword ptr [esp+18], ebx :760F46E2 7440 je 760F4724 :760F46E4 6A18 push 00000018 * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760F46E6 E894E1FEFF Call 760E287F :760F46EB 59 pop ecx :760F46EC 33C9 xor ecx, ecx :760F46EE 3BC1 cmp eax, ecx :760F46F0 7410 je 760F4702 :760F46F2 894808 mov dword ptr [eax+08], ecx :760F46F5 8908 mov dword ptr [eax], ecx :760F46F7 894810 mov dword ptr [eax+10], ecx :760F46FA 894814 mov dword ptr [eax+14], ecx :760F46FD 89480C mov dword ptr [eax+0C], ecx :760F4700 EB02 jmp 760F4704 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F46F0(C) | :760F4702 33C0 xor eax, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4700(U) | :760F4704 3BC1 cmp eax, ecx :760F4706 8907 mov dword ptr [edi], eax :760F4708 744A je 760F4754 :760F470A FF36 push dword ptr [esi] :760F470C 8BC8 mov ecx, eax :760F470E 53 push ebx :760F470F FF7604 push [esi+04] :760F4712 E8A1E2FEFF call 760E29B8 :760F4717 85C0 test eax, eax :760F4719 0F8466FFFFFF je 760F4685 :760F471F E968E2FEFF jmp 760E298C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F46E2(C) | :760F4724 A184110E76 mov eax, dword ptr [760E1184] :760F4729 F60004 test byte ptr [eax], 04 :760F472C 0F8473E2FEFF je 760E29A5 :760F4732 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CParseCatalog::GetNextCatEntry" | :760F4734 68F89D0E76 push 760E9DF8 :760F4739 68D1000000 push 000000D1 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F473E 6824E00F76 push 760FE024 :760F4743 FFD5 call ebp :760F4745 85C0 test eax, eax :760F4747 0F8458E2FEFF je 760E29A5 :760F474D 6A00 push 00000000 :760F474F E9E3FEFFFF jmp 760F4637 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4708(C) | :760F4754 A184110E76 mov eax, dword ptr [760E1184] :760F4759 F60002 test byte ptr [eax], 02 :760F475C 0F8443E2FEFF je 760E29A5 :760F4762 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CParseCatalog::GetNextCatEntry" | :760F4764 68F89D0E76 push 760E9DF8 :760F4769 68D8000000 push 000000D8 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F476E 6824E00F76 push 760FE024 :760F4773 FFD5 call ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F467A(U) | :760F4775 85C0 test eax, eax :760F4777 0F8428E2FEFF je 760E29A5 * Possible StringData Ref from Code Obj ->"Out of memory - new CCATENTRY" | :760F477D 689C9D0E76 push 760E9D9C :760F4782 6872450000 push 00004572 :760F4787 E89F87FFFF call 760ECF2B :760F478C 59 pop ecx :760F478D 59 pop ecx :760F478E E912E2FEFF jmp 760E29A5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E29DB(C) | :760F4793 A184110E76 mov eax, dword ptr [760E1184] :760F4798 F60004 test byte ptr [eax], 04 :760F479B 0F84EEE2FEFF je 760E2A8F :760F47A1 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CCatEntry::Init" | :760F47A3 682C9E0E76 push 760E9E2C :760F47A8 68FA000000 push 000000FA * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F47AD 6824E00F76 push 760FE024 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F47B2 FF1580110E76 Call dword ptr [760E1180] :760F47B8 85C0 test eax, eax :760F47BA 0F84CFE2FEFF je 760E2A8F * Possible StringData Ref from Code Obj ->"SFPDuplicateString failed" | :760F47C0 68C09C0E76 push 760E9CC0 :760F47C5 6872450000 push 00004572 :760F47CA E85C87FFFF call 760ECF2B :760F47CF 59 pop ecx :760F47D0 59 pop ecx :760F47D1 E9B9E2FEFF jmp 760E2A8F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2A4A(C) | :760F47D6 A184110E76 mov eax, dword ptr [760E1184] :760F47DB F60004 test byte ptr [eax], 04 :760F47DE 742C je 760F480C :760F47E0 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CCatEntry::Init" | :760F47E2 682C9E0E76 push 760E9E2C :760F47E7 6818010000 push 00000118 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F47EC 6824E00F76 push 760FE024 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F47F1 FF1580110E76 Call dword ptr [760E1180] :760F47F7 85C0 test eax, eax :760F47F9 7411 je 760F480C * Possible StringData Ref from Code Obj ->"SFPConvertToANSI failed" | :760F47FB 68289D0E76 push 760E9D28 :760F4800 6872450000 push 00004572 :760F4805 E82187FFFF call 760ECF2B :760F480A 59 pop ecx :760F480B 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F47DE(C), :760F47F9(C) | :760F480C 33FF xor edi, edi :760F480E E97CE2FEFF jmp 760E2A8F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2A6D(C) | :760F4813 A184110E76 mov eax, dword ptr [760E1184] :760F4818 F60004 test byte ptr [eax], 04 :760F481B 742C je 760F4849 :760F481D 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CCatEntry::Init" | :760F481F 682C9E0E76 push 760E9E2C :760F4824 682A010000 push 0000012A * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F4829 6824E00F76 push 760FE024 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F482E FF1580110E76 Call dword ptr [760E1180] :760F4834 85C0 test eax, eax :760F4836 7411 je 760F4849 * Possible StringData Ref from Code Obj ->"SFPConvertToANSI failed" | :760F4838 68289D0E76 push 760E9D28 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F487A(U) | :760F483D 6872450000 push 00004572 :760F4842 E8E486FFFF call 760ECF2B :760F4847 59 pop ecx :760F4848 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F481B(C), :760F4836(C), :760F4858(C), :760F4873(C) | :760F4849 33FF xor edi, edi :760F484B E931E2FEFF jmp 760E2A81 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2A78(C) | :760F4850 A184110E76 mov eax, dword ptr [760E1184] :760F4855 F60004 test byte ptr [eax], 04 :760F4858 74EF je 760F4849 :760F485A 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CCatEntry::Init" | :760F485C 682C9E0E76 push 760E9E2C :760F4861 6834010000 push 00000134 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\parsecat\parsecat.cpp" | :760F4866 6824E00F76 push 760FE024 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F486B FF1580110E76 Call dword ptr [760E1180] :760F4871 85C0 test eax, eax :760F4873 74D4 je 760F4849 * Possible StringData Ref from Code Obj ->"No filename found" | :760F4875 68189E0E76 push 760E9E18 :760F487A EBC1 jmp 760F483D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3AC0(C) | :760F487C 50 push eax :760F487D 53 push ebx :760F487E FF7604 push [esi+04] :760F4881 FFD7 call edi :760F4883 E93EF2FEFF jmp 760E3AC6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3AD5(C) | :760F4888 A184110E76 mov eax, dword ptr [760E1184] :760F488D F60002 test byte ptr [eax], 02 :760F4890 7427 je 760F48B9 :760F4892 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::Init()" | :760F4894 6884500E76 push 760E5084 :760F4899 6A68 push 00000068 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F489B 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F48A0 FF1580110E76 Call dword ptr [760E1180] :760F48A6 85C0 test eax, eax :760F48A8 740F je 760F48B9 :760F48AA 53 push ebx * Possible StringData Ref from Code Obj ->"Error duplicating catalog root " ->"path" | :760F48AB 683C9E0E76 push 760E9E3C :760F48B0 53 push ebx :760F48B1 E87586FFFF call 760ECF2B :760F48B6 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4890(C), :760F48A8(C) | :760F48B9 8B06 mov eax, dword ptr [esi] :760F48BB 3BC3 cmp eax, ebx :760F48BD 7409 je 760F48C8 :760F48BF 50 push eax :760F48C0 53 push ebx :760F48C1 FF7604 push [esi+04] :760F48C4 FFD7 call edi :760F48C6 891E mov dword ptr [esi], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F48BD(C) | :760F48C8 33C0 xor eax, eax :760F48CA E90FF2FEFF jmp 760E3ADE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4D72(C) | :760F48CF 50 push eax :760F48D0 56 push esi :760F48D1 FF7304 push [ebx+04] * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760F48D4 FF15FC110E76 Call dword ptr [760E11FC] :760F48DA E99904FFFF jmp 760E4D78 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4D8D(C) | :760F48DF A184110E76 mov eax, dword ptr [760E1184] :760F48E4 F60002 test byte ptr [eax], 02 :760F48E7 0F8419010000 je 760F4A06 :760F48ED 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::Init()" | :760F48EF 6884500E76 push 760E5084 :760F48F4 688D000000 push 0000008D * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F48F9 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F48FE FF1580110E76 Call dword ptr [760E1180] :760F4904 85C0 test eax, eax :760F4906 0F84FA000000 je 760F4A06 :760F490C 56 push esi * Possible StringData Ref from Code Obj ->"Error getting the system directory" | :760F490D 68C89E0E76 push 760E9EC8 :760F4912 56 push esi :760F4913 E9E6000000 jmp 760F49FE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4DD4(C) | :760F4918 A184110E76 mov eax, dword ptr [760E1184] :760F491D F60002 test byte ptr [eax], 02 :760F4920 7420 je 760F4942 :760F4922 6A02 push 00000002 :760F4924 55 push ebp :760F4925 689A000000 push 0000009A :760F492A 57 push edi :760F492B FFD6 call esi :760F492D 85C0 test eax, eax :760F492F 7411 je 760F4942 :760F4931 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"CATALOG directory not found-- " ->"checking C:\windows\catroot .." | :760F4933 68889E0E76 push 760E9E88 :760F4938 6A00 push 00000000 :760F493A E8EC85FFFF call 760ECF2B :760F493F 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4920(C), :760F492F(C) | :760F4942 8D842410040000 lea eax, dword ptr [esp+00000410] :760F4949 6800040000 push 00000400 :760F494E 50 push eax * Reference To: KERNEL32.GetWindowsDirectoryA, Ord:0197h | :760F494F FF15B4110E76 Call dword ptr [760E11B4] :760F4955 85C0 test eax, eax :760F4957 752A jne 760F4983 :760F4959 A184110E76 mov eax, dword ptr [760E1184] :760F495E F60002 test byte ptr [eax], 02 :760F4961 0F849F000000 je 760F4A06 :760F4967 6A02 push 00000002 :760F4969 55 push ebp :760F496A 689E000000 push 0000009E :760F496F 57 push edi :760F4970 FFD6 call esi :760F4972 85C0 test eax, eax :760F4974 0F848C000000 je 760F4A06 :760F497A 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error getting the system directory" | :760F497C 68C89E0E76 push 760E9EC8 :760F4981 EB79 jmp 760F49FC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4957(C) | * Possible StringData Ref from Code Obj ->"{F750E6C3-38EE-11D1-85E5-00C04FC295EE}" | :760F4983 68AC500E76 push 760E50AC :760F4988 8D842414040000 lea eax, dword ptr [esp+00000414] * Possible StringData Ref from Code Obj ->"CatRoot" | :760F498F 68A4500E76 push 760E50A4 :760F4994 50 push eax :760F4995 8D44241C lea eax, dword ptr [esp+1C] * Possible StringData Ref from Code Obj ->"%s\%s\%s" | :760F4999 6898500E76 push 760E5098 :760F499E 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760F499F FF1530100E76 Call dword ptr [760E1030] :760F49A5 83C414 add esp, 00000014 :760F49A8 8D442410 lea eax, dword ptr [esp+10] :760F49AC 50 push eax :760F49AD E8FAD2FEFF call 760E1CAC :760F49B2 85C0 test eax, eax :760F49B4 0F852004FFFF jne 760E4DDA :760F49BA A184110E76 mov eax, dword ptr [760E1184] :760F49BF F60002 test byte ptr [eax], 02 :760F49C2 7442 je 760F4A06 :760F49C4 6A02 push 00000002 :760F49C6 55 push ebp :760F49C7 68A5000000 push 000000A5 :760F49CC 57 push edi :760F49CD FFD6 call esi :760F49CF 85C0 test eax, eax :760F49D1 7433 je 760F4A06 :760F49D3 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Alternate cat directory non-existant." | :760F49D5 68609E0E76 push 760E9E60 :760F49DA EB20 jmp 760F49FC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4DEA(C) | :760F49DC A184110E76 mov eax, dword ptr [760E1184] :760F49E1 F60002 test byte ptr [eax], 02 :760F49E4 7420 je 760F4A06 :760F49E6 6A02 push 00000002 :760F49E8 55 push ebp :760F49E9 68AC000000 push 000000AC :760F49EE 57 push edi :760F49EF FFD6 call esi :760F49F1 85C0 test eax, eax :760F49F3 7411 je 760F4A06 :760F49F5 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error duplicating catalog root " ->"path" | :760F49F7 683C9E0E76 push 760E9E3C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4981(U), :760F49DA(U) | :760F49FC 6A00 push 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4913(U) | :760F49FE E82885FFFF call 760ECF2B :760F4A03 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F48E7(C), :760F4906(C), :760F4961(C), :760F4974(C), :760F49C2(C) |:760F49D1(C), :760F49E4(C), :760F49F3(C) | :760F4A06 8B03 mov eax, dword ptr [ebx] :760F4A08 85C0 test eax, eax :760F4A0A 740C je 760F4A18 :760F4A0C 50 push eax :760F4A0D 6A00 push 00000000 :760F4A0F FF7304 push [ebx+04] * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760F4A12 FF15FC110E76 Call dword ptr [760E11FC] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4A0A(C) | :760F4A18 33C0 xor eax, eax :760F4A1A E9D403FFFF jmp 760E4DF3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3F95(C) | :760F4A1F A184110E76 mov eax, dword ptr [760E1184] :760F4A24 F60002 test byte ptr [eax], 02 :760F4A27 0F84B6F5FEFF je 760E3FE3 :760F4A2D 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::FirstCatFile" | :760F4A2F 68649F0E76 push 760E9F64 :760F4A34 68D6000000 push 000000D6 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4A39 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4A3E FF1580110E76 Call dword ptr [760E1180] :760F4A44 85C0 test eax, eax :760F4A46 0F8497F5FEFF je 760E3FE3 :760F4A4C 53 push ebx * Possible StringData Ref from Code Obj ->"CatUtils not initialized" | :760F4A4D 68489F0E76 push 760E9F48 :760F4A52 E9A6000000 jmp 760F4AFD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3FDD(C) | :760F4A57 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::FirstCatFile" | :760F4A59 68649F0E76 push 760E9F64 :760F4A5E 68E1000000 push 000000E1 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4A63 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4A68 FF1580110E76 Call dword ptr [760E1180] :760F4A6E 85C0 test eax, eax :760F4A70 0F846DF5FEFF je 760E3FE3 :760F4A76 53 push ebx * Possible StringData Ref from Code Obj ->"Error getting the first file in " ->"the list." | :760F4A77 681C9F0E76 push 760E9F1C :760F4A7C EB7F jmp 760F4AFD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E401E(C) | :760F4A7E A184110E76 mov eax, dword ptr [760E1184] :760F4A83 F60002 test byte ptr [eax], 02 :760F4A86 742C je 760F4AB4 :760F4A88 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::FirstCatFile" | :760F4A8A 68649F0E76 push 760E9F64 :760F4A8F 68EB000000 push 000000EB * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4A94 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4A99 FF1580110E76 Call dword ptr [760E1180] :760F4A9F 85C0 test eax, eax :760F4AA1 7411 je 760F4AB4 :760F4AA3 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Buffer overflow." | :760F4AA5 68089F0E76 push 760E9F08 :760F4AAA 6A00 push 00000000 :760F4AAC E87A84FFFF call 760ECF2B :760F4AB1 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4A86(C), :760F4AA1(C) | :760F4AB4 33DB xor ebx, ebx :760F4AB6 E928F5FEFF jmp 760E3FE3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3FF3(C) | :760F4ABB FF36 push dword ptr [esi] * Reference To: KERNEL32.FindClose, Ord:009Fh | :760F4ABD FF1584120E76 Call dword ptr [760E1284] :760F4AC3 891E mov dword ptr [esi], ebx :760F4AC5 E92FF5FEFF jmp 760E3FF9 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3F7C(C), :760E3F85(C), :760E3F8D(C) | :760F4ACA A184110E76 mov eax, dword ptr [760E1184] :760F4ACF F60002 test byte ptr [eax], 02 :760F4AD2 0F840BF5FEFF je 760E3FE3 :760F4AD8 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::FirstCatFile" | :760F4ADA 68649F0E76 push 760E9F64 :760F4ADF 68D1000000 push 000000D1 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4AE4 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4AE9 FF1580110E76 Call dword ptr [760E1180] :760F4AEF 85C0 test eax, eax :760F4AF1 0F84ECF4FEFF je 760E3FE3 :760F4AF7 53 push ebx * Possible StringData Ref from Code Obj ->"Invalid function parameter." | :760F4AF8 68EC9E0E76 push 760E9EEC * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4A52(U), :760F4A7C(U) | :760F4AFD 53 push ebx :760F4AFE E82884FFFF call 760ECF2B :760F4B03 83C40C add esp, 0000000C :760F4B06 E9D8F4FEFF jmp 760E3FE3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2039(C) | :760F4B0B A184110E76 mov eax, dword ptr [760E1184] :760F4B10 F60002 test byte ptr [eax], 02 :760F4B13 0F8437010000 je 760F4C50 :760F4B19 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetNextCatFile" | :760F4B1B 68B09F0E76 push 760E9FB0 :760F4B20 6810010000 push 00000110 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4B25 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4B2A FF1580110E76 Call dword ptr [760E1180] :760F4B30 85C0 test eax, eax :760F4B32 0F8418010000 je 760F4C50 :760F4B38 53 push ebx * Possible StringData Ref from Code Obj ->"Invalid enumeration" | :760F4B39 689C9F0E76 push 760E9F9C :760F4B3E E904010000 jmp 760F4C47 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2041(C) | :760F4B43 A184110E76 mov eax, dword ptr [760E1184] :760F4B48 F60002 test byte ptr [eax], 02 :760F4B4B 0F84FF000000 je 760F4C50 :760F4B51 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetNextCatFile" | :760F4B53 68B09F0E76 push 760E9FB0 :760F4B58 6816010000 push 00000116 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4B5D 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4B62 FF1580110E76 Call dword ptr [760E1180] :760F4B68 85C0 test eax, eax :760F4B6A 0F84E0000000 je 760F4C50 :760F4B70 53 push ebx * Possible StringData Ref from Code Obj ->"CatUtils not initialized" | :760F4B71 68489F0E76 push 760E9F48 :760F4B76 E9CC000000 jmp 760F4C47 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2064(C) | :760F4B7B A184110E76 mov eax, dword ptr [760E1184] :760F4B80 F60002 test byte ptr [eax], 02 :760F4B83 0F84C7000000 je 760F4C50 :760F4B89 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetNextCatFile" | :760F4B8B 68B09F0E76 push 760E9FB0 :760F4B90 6820010000 push 00000120 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4B95 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4B9A FF1580110E76 Call dword ptr [760E1180] :760F4BA0 85C0 test eax, eax :760F4BA2 0F84A8000000 je 760F4C50 :760F4BA8 53 push ebx * Possible StringData Ref from Code Obj ->"Error getting the next file." | :760F4BA9 687C9F0E76 push 760E9F7C :760F4BAE E994000000 jmp 760F4C47 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2055(C) | :760F4BB3 8D5630 lea edx, dword ptr [esi+30] :760F4BB6 83C9FF or ecx, FFFFFFFF :760F4BB9 8BFA mov edi, edx :760F4BBB 33C0 xor eax, eax :760F4BBD F2 repnz :760F4BBE AE scasb :760F4BBF F7D1 not ecx :760F4BC1 49 dec ecx :760F4BC2 3B4D10 cmp ecx, dword ptr [ebp+10] :760F4BC5 722D jb 760F4BF4 :760F4BC7 A184110E76 mov eax, dword ptr [760E1184] :760F4BCC F60002 test byte ptr [eax], 02 :760F4BCF 747F je 760F4C50 :760F4BD1 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetNextCatFile" | :760F4BD3 68B09F0E76 push 760E9FB0 :760F4BD8 682F010000 push 0000012F * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4BDD 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4BE2 FF1580110E76 Call dword ptr [760E1180] :760F4BE8 85C0 test eax, eax :760F4BEA 7464 je 760F4C50 :760F4BEC 53 push ebx * Possible StringData Ref from Code Obj ->"Buffer overflow." | :760F4BED 68089F0E76 push 760E9F08 :760F4BF2 EB53 jmp 760F4C47 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4BC5(C) | :760F4BF4 8BFA mov edi, edx :760F4BF6 83C9FF or ecx, FFFFFFFF :760F4BF9 33C0 xor eax, eax :760F4BFB 6A01 push 00000001 :760F4BFD F2 repnz :760F4BFE AE scasb :760F4BFF F7D1 not ecx :760F4C01 2BF9 sub edi, ecx :760F4C03 8BC1 mov eax, ecx :760F4C05 8BF7 mov esi, edi :760F4C07 8B7D0C mov edi, dword ptr [ebp+0C] :760F4C0A C1E902 shr ecx, 02 :760F4C0D F3 repz :760F4C0E A5 movsd :760F4C0F 8BC8 mov ecx, eax :760F4C11 58 pop eax :760F4C12 83E103 and ecx, 00000003 :760F4C15 F3 repz :760F4C16 A4 movsb :760F4C17 E95ED4FEFF jmp 760E207A * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E201C(C), :760E2025(C), :760E202D(C) | :760F4C1C A184110E76 mov eax, dword ptr [760E1184] :760F4C21 F60002 test byte ptr [eax], 02 :760F4C24 742A je 760F4C50 :760F4C26 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetNextCatFile" | :760F4C28 68B09F0E76 push 760E9FB0 :760F4C2D 680A010000 push 0000010A * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4C32 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4C37 FF1580110E76 Call dword ptr [760E1180] :760F4C3D 85C0 test eax, eax :760F4C3F 740F je 760F4C50 :760F4C41 53 push ebx * Possible StringData Ref from Code Obj ->"Invalid function parameter." | :760F4C42 68EC9E0E76 push 760E9EEC * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4B3E(U), :760F4B76(U), :760F4BAE(U), :760F4BF2(U) | :760F4C47 53 push ebx :760F4C48 E8DE82FFFF call 760ECF2B :760F4C4D 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4B13(C), :760F4B32(C), :760F4B4B(C), :760F4B6A(C), :760F4B83(C) |:760F4BA2(C), :760F4BCF(C), :760F4BEA(C), :760F4C24(C), :760F4C3F(C) | :760F4C50 3BF3 cmp esi, ebx :760F4C52 0F8420D4FEFF je 760E2078 :760F4C58 8B06 mov eax, dword ptr [esi] :760F4C5A 899E44010000 mov dword ptr [esi+00000144], ebx :760F4C60 3BC3 cmp eax, ebx :760F4C62 0F8410D4FEFF je 760E2078 :760F4C68 50 push eax * Reference To: KERNEL32.FindClose, Ord:009Fh | :760F4C69 FF1584120E76 Call dword ptr [760E1284] :760F4C6F 891E mov dword ptr [esi], ebx :760F4C71 E902D4FEFF jmp 760E2078 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2DD9(C) | :760F4C76 A184110E76 mov eax, dword ptr [760E1184] :760F4C7B F60002 test byte ptr [eax], 02 :760F4C7E 745E je 760F4CDE :760F4C80 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetFullCatPath" | :760F4C82 68F89F0E76 push 760E9FF8 :760F4C87 685B010000 push 0000015B * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4C8C 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4C91 FF1580110E76 Call dword ptr [760E1180] :760F4C97 85C0 test eax, eax :760F4C99 7443 je 760F4CDE * Possible StringData Ref from Code Obj ->"Unitialized Utilities" | :760F4C9B 68E09F0E76 push 760E9FE0 :760F4CA0 56 push esi :760F4CA1 E88582FFFF call 760ECF2B :760F4CA6 59 pop ecx :760F4CA7 59 pop ecx :760F4CA8 EB34 jmp 760F4CDE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2E0B(C) | :760F4CAA A184110E76 mov eax, dword ptr [760E1184] :760F4CAF F60002 test byte ptr [eax], 02 :760F4CB2 742A je 760F4CDE :760F4CB4 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetFullCatPath" | :760F4CB6 68F89F0E76 push 760E9FF8 :760F4CBB 6863010000 push 00000163 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4CC0 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4CC5 FF1580110E76 Call dword ptr [760E1180] :760F4CCB 85C0 test eax, eax :760F4CCD 740F je 760F4CDE :760F4CCF 56 push esi * Possible StringData Ref from Code Obj ->"Buffer too small" | :760F4CD0 68CC9F0E76 push 760E9FCC :760F4CD5 56 push esi :760F4CD6 E85082FFFF call 760ECF2B :760F4CDB 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4C7E(C), :760F4C99(C), :760F4CA8(U), :760F4CB2(C), :760F4CCD(C) | :760F4CDE 33C0 xor eax, eax :760F4CE0 E953E1FEFF jmp 760E2E38 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2F64(C) | :760F4CE5 A184110E76 mov eax, dword ptr [760E1184] :760F4CEA F60002 test byte ptr [eax], 02 :760F4CED 0F84A8000000 je 760F4D9B :760F4CF3 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetCatalog( LPCAT_ENUMERATION " ->"pCatEnum)" | :760F4CF5 6860A00E76 push 760EA060 :760F4CFA 6885010000 push 00000185 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4CFF 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4D04 FF1580110E76 Call dword ptr [760E1180] :760F4D0A 85C0 test eax, eax :760F4D0C 0F8489000000 je 760F4D9B :760F4D12 57 push edi * Possible StringData Ref from Code Obj ->"Invalid enumeration" | :760F4D13 689C9F0E76 push 760E9F9C :760F4D18 EB32 jmp 760F4D4C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2F77(C) | :760F4D1A 33DB xor ebx, ebx :760F4D1C E963E2FEFF jmp 760E2F84 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2F86(C) | :760F4D21 A184110E76 mov eax, dword ptr [760E1184] :760F4D26 F60002 test byte ptr [eax], 02 :760F4D29 7470 je 760F4D9B :760F4D2B 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetCatalog( LPCAT_ENUMERATION " ->"pCatEnum)" | :760F4D2D 6860A00E76 push 760EA060 :760F4D32 688B010000 push 0000018B * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4D37 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4D3C FF1580110E76 Call dword ptr [760E1180] :760F4D42 85C0 test eax, eax :760F4D44 7455 je 760F4D9B :760F4D46 57 push edi * Possible StringData Ref from Code Obj ->"Error allocating parse catalog " ->"class" | :760F4D47 6838A00E76 push 760EA038 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4D18(U) | :760F4D4C 57 push edi :760F4D4D E8D981FFFF call 760ECF2B :760F4D52 83C40C add esp, 0000000C :760F4D55 EB44 jmp 760F4D9B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2FD3(C) | :760F4D57 A184110E76 mov eax, dword ptr [760E1184] :760F4D5C F60002 test byte ptr [eax], 02 :760F4D5F 742C je 760F4D8D :760F4D61 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetCatalog( LPCAT_ENUMERATION " ->"pCatEnum)" | :760F4D63 6860A00E76 push 760EA060 :760F4D68 6894010000 push 00000194 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4D6D 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4D72 FF1580110E76 Call dword ptr [760E1180] :760F4D78 85C0 test eax, eax :760F4D7A 7411 je 760F4D8D :760F4D7C 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error initialize PARSECATALOG " ->"class" | :760F4D7E 6814A00E76 push 760EA014 :760F4D83 6A00 push 00000000 :760F4D85 E8A181FFFF call 760ECF2B :760F4D8A 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4D5F(C), :760F4D7A(C) | :760F4D8D 8BCB mov ecx, ebx :760F4D8F E834DFFEFF call 760E2CC8 :760F4D94 53 push ebx * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F4D95 E8B1CBFEFF Call 760E194B :760F4D9A 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4CED(C), :760F4D0C(C), :760F4D29(C), :760F4D44(C), :760F4D55(U) | :760F4D9B 33C0 xor eax, eax :760F4D9D E939E2FEFF jmp 760E2FDB * Referenced by a CALL at Address: |:760EF432 | :760F4DA2 55 push ebp :760F4DA3 8BEC mov ebp, esp :760F4DA5 81EC00040000 sub esp, 00000400 :760F4DAB 53 push ebx :760F4DAC 56 push esi :760F4DAD 8BD9 mov ebx, ecx :760F4DAF 57 push edi :760F4DB0 8B7D08 mov edi, dword ptr [ebp+08] :760F4DB3 83C9FF or ecx, FFFFFFFF :760F4DB6 33C0 xor eax, eax :760F4DB8 BA00040000 mov edx, 00000400 :760F4DBD F2 repnz :760F4DBE AE scasb :760F4DBF F7D1 not ecx :760F4DC1 49 dec ecx :760F4DC2 3BCA cmp ecx, edx :760F4DC4 723A jb 760F4E00 :760F4DC6 A184110E76 mov eax, dword ptr [760E1184] :760F4DCB F60002 test byte ptr [eax], 02 :760F4DCE 0F844C010000 je 760F4F20 :760F4DD4 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetCatalog(LPCTSTR " ->"pszCatFileName)" | :760F4DD6 68DCA00E76 push 760EA0DC :760F4DDB 68B2010000 push 000001B2 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4DE0 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4DE5 FF1580110E76 Call dword ptr [760E1180] :760F4DEB 85C0 test eax, eax :760F4DED 0F842D010000 je 760F4F20 :760F4DF3 33FF xor edi, edi :760F4DF5 57 push edi * Possible StringData Ref from Code Obj ->"Bigger than internal buffer." | :760F4DF6 68BCA00E76 push 760EA0BC :760F4DFB E9C1000000 jmp 760F4EC1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4DC4(C) | :760F4E00 8B7D08 mov edi, dword ptr [ebp+08] :760F4E03 83C9FF or ecx, FFFFFFFF :760F4E06 33C0 xor eax, eax :760F4E08 8DB500FCFFFF lea esi, dword ptr [ebp+FFFFFC00] :760F4E0E F2 repnz :760F4E0F AE scasb :760F4E10 F7D1 not ecx :760F4E12 2BF9 sub edi, ecx :760F4E14 897508 mov dword ptr [ebp+08], esi :760F4E17 8BC1 mov eax, ecx :760F4E19 8BF7 mov esi, edi :760F4E1B 8B7D08 mov edi, dword ptr [ebp+08] :760F4E1E 52 push edx :760F4E1F C1E902 shr ecx, 02 :760F4E22 F3 repz :760F4E23 A5 movsd :760F4E24 8BC8 mov ecx, eax :760F4E26 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760F4E2C 83E103 and ecx, 00000003 :760F4E2F 50 push eax :760F4E30 F3 repz :760F4E31 A4 movsb :760F4E32 8BCB mov ecx, ebx :760F4E34 E88FDFFEFF call 760E2DC8 :760F4E39 85C0 test eax, eax :760F4E3B 7537 jne 760F4E74 :760F4E3D A184110E76 mov eax, dword ptr [760E1184] :760F4E42 F60002 test byte ptr [eax], 02 :760F4E45 0F84D5000000 je 760F4F20 :760F4E4B 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetCatalog(LPCTSTR " ->"pszCatFileName)" | :760F4E4D 68DCA00E76 push 760EA0DC :760F4E52 68BA010000 push 000001BA * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4E57 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4E5C FF1580110E76 Call dword ptr [760E1180] :760F4E62 85C0 test eax, eax :760F4E64 0F84B6000000 je 760F4F20 :760F4E6A 33FF xor edi, edi :760F4E6C 57 push edi * Possible StringData Ref from Code Obj ->"Error getting the catalog full " ->"path." | :760F4E6D 6894A00E76 push 760EA094 :760F4E72 EB4D jmp 760F4EC1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4E3B(C) | :760F4E74 6A08 push 00000008 * Reference To: MSVCRT.??2@YAPAXI@Z, Ord:000Fh | :760F4E76 E804DAFEFF Call 760E287F :760F4E7B 33FF xor edi, edi :760F4E7D 59 pop ecx :760F4E7E 3BC7 cmp eax, edi :760F4E80 740A je 760F4E8C :760F4E82 834804FF or dword ptr [eax+04], FFFFFFFF :760F4E86 8938 mov dword ptr [eax], edi :760F4E88 8BF0 mov esi, eax :760F4E8A EB02 jmp 760F4E8E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4E80(C) | :760F4E8C 33F6 xor esi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4E8A(U) | :760F4E8E 3BF7 cmp esi, edi :760F4E90 753A jne 760F4ECC :760F4E92 A184110E76 mov eax, dword ptr [760E1184] :760F4E97 F60002 test byte ptr [eax], 02 :760F4E9A 0F8480000000 je 760F4F20 :760F4EA0 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetCatalog(LPCTSTR " ->"pszCatFileName)" | :760F4EA2 68DCA00E76 push 760EA0DC :760F4EA7 68C1010000 push 000001C1 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4EAC 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4EB1 FF1580110E76 Call dword ptr [760E1180] :760F4EB7 85C0 test eax, eax :760F4EB9 7465 je 760F4F20 :760F4EBB 57 push edi * Possible StringData Ref from Code Obj ->"Error allocating parse catalog " ->"class" | :760F4EBC 6838A00E76 push 760EA038 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4DFB(U), :760F4E72(U) | :760F4EC1 57 push edi :760F4EC2 E86480FFFF call 760ECF2B :760F4EC7 83C40C add esp, 0000000C :760F4ECA EB54 jmp 760F4F20 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4E90(C) | :760F4ECC 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760F4ED2 8BCE mov ecx, esi :760F4ED4 50 push eax :760F4ED5 E808E1FEFF call 760E2FE2 :760F4EDA 85C0 test eax, eax :760F4EDC 7446 je 760F4F24 :760F4EDE A184110E76 mov eax, dword ptr [760E1184] :760F4EE3 F60002 test byte ptr [eax], 02 :760F4EE6 742A je 760F4F12 :760F4EE8 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetCatalog(LPCTSTR " ->"pszCatFileName)" | :760F4EEA 68DCA00E76 push 760EA0DC :760F4EEF 68C7010000 push 000001C7 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4EF4 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4EF9 FF1580110E76 Call dword ptr [760E1180] :760F4EFF 85C0 test eax, eax :760F4F01 740F je 760F4F12 :760F4F03 57 push edi * Possible StringData Ref from Code Obj ->"Error initialize PARSECATALOG " ->"class" | :760F4F04 6814A00E76 push 760EA014 :760F4F09 57 push edi :760F4F0A E81C80FFFF call 760ECF2B :760F4F0F 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4EE6(C), :760F4F01(C) | :760F4F12 8BCE mov ecx, esi :760F4F14 E8AFDDFEFF call 760E2CC8 :760F4F19 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F4F1A E82CCAFEFF Call 760E194B :760F4F1F 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4DCE(C), :760F4DED(C), :760F4E45(C), :760F4E64(C), :760F4E9A(C) |:760F4EB9(C), :760F4ECA(U) | :760F4F20 33C0 xor eax, eax :760F4F22 EB02 jmp 760F4F26 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4EDC(C) | :760F4F24 8BC6 mov eax, esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4F22(U) | :760F4F26 5F pop edi :760F4F27 5E pop esi :760F4F28 5B pop ebx :760F4F29 C9 leave :760F4F2A C20400 ret 0004 * Referenced by a CALL at Address: |:760EF5EE | :760F4F2D 55 push ebp :760F4F2E 8BEC mov ebp, esp :760F4F30 81EC00040000 sub esp, 00000400 :760F4F36 53 push ebx :760F4F37 8BD9 mov ebx, ecx :760F4F39 57 push edi :760F4F3A 8B7D08 mov edi, dword ptr [ebp+08] :760F4F3D 83C9FF or ecx, FFFFFFFF :760F4F40 33C0 xor eax, eax :760F4F42 F2 repnz :760F4F43 AE scasb :760F4F44 F7D1 not ecx :760F4F46 49 dec ecx :760F4F47 BA00040000 mov edx, 00000400 :760F4F4C 3BCA cmp ecx, edx :760F4F4E 7239 jb 760F4F89 :760F4F50 A184110E76 mov eax, dword ptr [760E1184] :760F4F55 F60002 test byte ptr [eax], 02 :760F4F58 0F84DF000000 je 760F503D :760F4F5E 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetCatalog(LPCTSTR " ->"pszCatFileName)" | :760F4F60 68DCA00E76 push 760EA0DC :760F4F65 68E2010000 push 000001E2 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4F6A 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4F6F FF1580110E76 Call dword ptr [760E1180] :760F4F75 85C0 test eax, eax :760F4F77 0F84C0000000 je 760F503D :760F4F7D 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Bigger than internal buffer." | :760F4F7F 68BCA00E76 push 760EA0BC :760F4F84 E9AA000000 jmp 760F5033 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4F4E(C) | :760F4F89 8B7D08 mov edi, dword ptr [ebp+08] :760F4F8C 83C9FF or ecx, FFFFFFFF :760F4F8F 33C0 xor eax, eax :760F4F91 56 push esi :760F4F92 F2 repnz :760F4F93 AE scasb :760F4F94 F7D1 not ecx :760F4F96 8DB500FCFFFF lea esi, dword ptr [ebp+FFFFFC00] :760F4F9C 2BF9 sub edi, ecx :760F4F9E 8BC1 mov eax, ecx :760F4FA0 897508 mov dword ptr [ebp+08], esi :760F4FA3 8BF7 mov esi, edi :760F4FA5 8B7D08 mov edi, dword ptr [ebp+08] :760F4FA8 C1E902 shr ecx, 02 :760F4FAB F3 repz :760F4FAC A5 movsd :760F4FAD 8BC8 mov ecx, eax :760F4FAF 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760F4FB5 83E103 and ecx, 00000003 :760F4FB8 52 push edx :760F4FB9 F3 repz :760F4FBA A4 movsb :760F4FBB 50 push eax :760F4FBC 8BCB mov ecx, ebx :760F4FBE E805DEFEFF call 760E2DC8 :760F4FC3 85C0 test eax, eax :760F4FC5 5E pop esi :760F4FC6 752E jne 760F4FF6 :760F4FC8 A184110E76 mov eax, dword ptr [760E1184] :760F4FCD F60002 test byte ptr [eax], 02 :760F4FD0 746B je 760F503D :760F4FD2 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetCatalog(LPCTSTR " ->"pszCatFileName)" | :760F4FD4 68DCA00E76 push 760EA0DC :760F4FD9 68EA010000 push 000001EA * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F4FDE 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F4FE3 FF1580110E76 Call dword ptr [760E1180] :760F4FE9 85C0 test eax, eax :760F4FEB 7450 je 760F503D :760F4FED 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error getting the catalog full " ->"path." | :760F4FEF 6894A00E76 push 760EA094 :760F4FF4 EB3D jmp 760F5033 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F4FC6(C) | :760F4FF6 8D8500FCFFFF lea eax, dword ptr [ebp+FFFFFC00] :760F4FFC 50 push eax * Reference To: KERNEL32.DeleteFileA, Ord:005Ch | :760F4FFD FF1570120E76 Call dword ptr [760E1270] :760F5003 85C0 test eax, eax :760F5005 753A jne 760F5041 :760F5007 A184110E76 mov eax, dword ptr [760E1184] :760F500C F60002 test byte ptr [eax], 02 :760F500F 742C je 760F503D :760F5011 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::GetCatalog(LPCTSTR " ->"pszCatFileName)" | :760F5013 68DCA00E76 push 760EA0DC :760F5018 68F1010000 push 000001F1 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F501D 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5022 FF1580110E76 Call dword ptr [760E1180] :760F5028 85C0 test eax, eax :760F502A 7411 je 760F503D :760F502C 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error deleting catalog file." | :760F502E 680CA10E76 push 760EA10C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4F84(U), :760F4FF4(U) | :760F5033 6A00 push 00000000 :760F5035 E8F17EFFFF call 760ECF2B :760F503A 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F4F58(C), :760F4F77(C), :760F4FD0(C), :760F4FEB(C), :760F500F(C) |:760F502A(C) | :760F503D 33C0 xor eax, eax :760F503F EB03 jmp 760F5044 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5005(C) | :760F5041 6A01 push 00000001 :760F5043 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F503F(U) | :760F5044 5F pop edi :760F5045 5B pop ebx :760F5046 C9 leave :760F5047 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2E75(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F504A FF15A0110E76 Call dword ptr [760E11A0] :760F5050 8BF0 mov esi, eax :760F5052 A184110E76 mov eax, dword ptr [760E1184] :760F5057 F60004 test byte ptr [eax], 04 :760F505A 0F84E0DEFEFF je 760E2F40 :760F5060 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CheckEKU" | :760F5062 68AC300E76 push 760E30AC :760F5067 6816020000 push 00000216 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F506C 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5071 FF1580110E76 Call dword ptr [760E1180] :760F5077 85C0 test eax, eax :760F5079 0F84C1DEFEFF je 760E2F40 :760F507F 56 push esi * Possible StringData Ref from Code Obj ->"WTHelperGetProvSignerFromChain " ->"failed: ec=%d" | :760F5080 68E4A10E76 push 760EA1E4 :760F5085 EB3B jmp 760F50C2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2E90(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F5087 FF15A0110E76 Call dword ptr [760E11A0] :760F508D 8BF0 mov esi, eax :760F508F A184110E76 mov eax, dword ptr [760E1184] :760F5094 F60004 test byte ptr [eax], 04 :760F5097 0F84A3DEFEFF je 760E2F40 :760F509D 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CheckEKU" | :760F509F 68AC300E76 push 760E30AC :760F50A4 6823020000 push 00000223 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F50A9 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F50AE FF1580110E76 Call dword ptr [760E1180] :760F50B4 85C0 test eax, eax :760F50B6 0F8484DEFEFF je 760E2F40 :760F50BC 56 push esi * Possible StringData Ref from Code Obj ->"CertGetEnhancedKeyUsage with NULL " ->"failed %d" | :760F50BD 68B8A10E76 push 760EA1B8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5085(U) | :760F50C2 53 push ebx :760F50C3 E8637EFFFF call 760ECF2B :760F50C8 83C40C add esp, 0000000C :760F50CB E970DEFEFF jmp 760E2F40 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2E99(C) | :760F50D0 A184110E76 mov eax, dword ptr [760E1184] :760F50D5 F60004 test byte ptr [eax], 04 :760F50D8 0F8462DEFEFF je 760E2F40 :760F50DE 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CheckEKU" | :760F50E0 68AC300E76 push 760E30AC :760F50E5 682A020000 push 0000022A * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F50EA 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F50EF FF1580110E76 Call dword ptr [760E1180] :760F50F5 85C0 test eax, eax :760F50F7 0F8443DEFEFF je 760E2F40 * Possible StringData Ref from Code Obj ->"CertGetEnhancedKeyUsage returned " ->"0 for size" | :760F50FD 688CA10E76 push 760EA18C :760F5102 53 push ebx :760F5103 E8237EFFFF call 760ECF2B :760F5108 59 pop ecx :760F5109 E931DEFEFF jmp 760E2F3F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2EAE(C) | :760F510E A184110E76 mov eax, dword ptr [760E1184] :760F5113 F60004 test byte ptr [eax], 04 :760F5116 0F8415DEFEFF je 760E2F31 :760F511C 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CheckEKU" | :760F511E 68AC300E76 push 760E30AC :760F5123 6832020000 push 00000232 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F5128 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F512D FF1580110E76 Call dword ptr [760E1180] :760F5133 85C0 test eax, eax :760F5135 0F84F6DDFEFF je 760E2F31 * Possible StringData Ref from Code Obj ->"Malloc failed" | :760F513B 687CA10E76 push 760EA17C :760F5140 53 push ebx :760F5141 E8E57DFFFF call 760ECF2B :760F5146 59 pop ecx :760F5147 59 pop ecx :760F5148 E9E4DDFEFF jmp 760E2F31 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2EC0(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F514D FF15A0110E76 Call dword ptr [760E11A0] :760F5153 8BF0 mov esi, eax :760F5155 A184110E76 mov eax, dword ptr [760E1184] :760F515A F60004 test byte ptr [eax], 04 :760F515D 0F84CEDDFEFF je 760E2F31 :760F5163 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CheckEKU" | :760F5165 68AC300E76 push 760E30AC :760F516A 683D020000 push 0000023D * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F516F 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5174 FF1580110E76 Call dword ptr [760E1180] :760F517A 85C0 test eax, eax :760F517C 0F84AFDDFEFF je 760E2F31 :760F5182 56 push esi * Possible StringData Ref from Code Obj ->"CertGetEnhancedKeyUsage failed " ->"%d" | :760F5183 6858A10E76 push 760EA158 :760F5188 53 push ebx :760F5189 E89D7DFFFF call 760ECF2B :760F518E 83C40C add esp, 0000000C :760F5191 E99BDDFEFF jmp 760E2F31 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2F15(U) | :760F5196 6A04 push 00000004 :760F5198 53 push ebx :760F5199 6843020000 push 00000243 :760F519E 57 push edi :760F519F FFD6 call esi :760F51A1 85C0 test eax, eax :760F51A3 0F8439DDFEFF je 760E2EE2 :760F51A9 8B4508 mov eax, dword ptr [ebp+08] :760F51AC 8B4004 mov eax, dword ptr [eax+04] :760F51AF FF7004 push [eax+04] :760F51B2 FF75FC push [ebp-04] * Possible StringData Ref from Code Obj ->"Usage field %d is %s" | :760F51B5 6840A10E76 push 760EA140 :760F51BA 6A00 push 00000000 :760F51BC E86A7DFFFF call 760ECF2B :760F51C1 83C410 add esp, 00000010 :760F51C4 E919DDFEFF jmp 760E2EE2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2F22(C) | :760F51C9 6A04 push 00000004 :760F51CB 53 push ebx :760F51CC 6848020000 push 00000248 :760F51D1 57 push edi :760F51D2 FFD6 call esi :760F51D4 85C0 test eax, eax :760F51D6 0F844CDDFEFF je 760E2F28 * Possible StringData Ref from Code Obj ->"Found correct EKU" | :760F51DC 682CA10E76 push 760EA12C :760F51E1 6A00 push 00000000 :760F51E3 E8437DFFFF call 760ECF2B :760F51E8 59 pop ecx :760F51E9 59 pop ecx :760F51EA E939DDFEFF jmp 760E2F28 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4E2E(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F51EF FF15A0110E76 Call dword ptr [760E11A0] :760F51F5 8BF8 mov edi, eax :760F51F7 A184110E76 mov eax, dword ptr [760E1184] :760F51FC F60004 test byte ptr [eax], 04 :760F51FF 0F846DFDFEFF je 760E4F72 :760F5205 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CCatUtils::VerifyCatalog" | :760F5207 683CA30E76 push 760EA33C :760F520C 6881020000 push 00000281 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F5211 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5216 FF1580110E76 Call dword ptr [760E1180] :760F521C 85C0 test eax, eax :760F521E 0F844EFDFEFF je 760E4F72 :760F5224 57 push edi * Possible StringData Ref from Code Obj ->"Failed to do conversion ec=%d" | :760F5225 68946F0E76 push 760E6F94 :760F522A EB36 jmp 760F5262 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4E8C(C) | :760F522C A184110E76 mov eax, dword ptr [760E1184] :760F5231 895DFC mov dword ptr [ebp-04], ebx :760F5234 F60004 test byte ptr [eax], 04 :760F5237 0F8435FDFEFF je 760E4F72 :760F523D 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CCatUtils::VerifyCatalog" | :760F523F 683CA30E76 push 760EA33C :760F5244 68A1020000 push 000002A1 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F5249 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F524E FF1580110E76 Call dword ptr [760E1180] :760F5254 85C0 test eax, eax :760F5256 0F8416FDFEFF je 760E4F72 :760F525C 57 push edi * Possible StringData Ref from Code Obj ->"WinVerifyTrust(2) failed: ec=0x%08x" | :760F525D 6818A30E76 push 760EA318 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F522A(U) | :760F5262 56 push esi :760F5263 E8C37CFFFF call 760ECF2B :760F5268 83C40C add esp, 0000000C :760F526B E902FDFEFF jmp 760E4F72 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4E9C(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F5270 FF15A0110E76 Call dword ptr [760E11A0] :760F5276 8BF8 mov edi, eax :760F5278 A184110E76 mov eax, dword ptr [760E1184] :760F527D F60002 test byte ptr [eax], 02 :760F5280 0F84D6FCFEFF je 760E4F5C :760F5286 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::VerifyCatalog" | :760F5288 683CA30E76 push 760EA33C :760F528D 68AF020000 push 000002AF * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F5292 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5297 FF1580110E76 Call dword ptr [760E1180] :760F529D 85C0 test eax, eax :760F529F 0F84B7FCFEFF je 760E4F5C :760F52A5 57 push edi * Possible StringData Ref from Code Obj ->"WTHelperProvDataFromStateData " ->"failed: ec=%d" | :760F52A6 68ECA20E76 push 760EA2EC * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5357(U), :760F5397(U) | :760F52AB 56 push esi :760F52AC E87A7CFFFF call 760ECF2B :760F52B1 83C40C add esp, 0000000C :760F52B4 E9A3FCFEFF jmp 760E4F5C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4EA5(C) | :760F52B9 A184110E76 mov eax, dword ptr [760E1184] :760F52BE F60002 test byte ptr [eax], 02 :760F52C1 0F8495FCFEFF je 760E4F5C :760F52C7 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::VerifyCatalog" | :760F52C9 683CA30E76 push 760EA33C :760F52CE 68B6020000 push 000002B6 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F52D3 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F52D8 FF1580110E76 Call dword ptr [760E1180] :760F52DE 85C0 test eax, eax :760F52E0 0F8476FCFEFF je 760E4F5C * Possible StringData Ref from Code Obj ->"There are no signers of the cert" | :760F52E6 68C8A20E76 push 760EA2C8 :760F52EB 56 push esi :760F52EC E83A7CFFFF call 760ECF2B :760F52F1 59 pop ecx :760F52F2 59 pop ecx :760F52F3 E964FCFEFF jmp 760E4F5C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4EB8(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F52F8 FF15A0110E76 Call dword ptr [760E11A0] :760F52FE 8BF8 mov edi, eax :760F5300 A184110E76 mov eax, dword ptr [760E1184] :760F5305 F60004 test byte ptr [eax], 04 :760F5308 0F844EFCFEFF je 760E4F5C :760F530E 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CCatUtils::VerifyCatalog" | :760F5310 683CA30E76 push 760EA33C :760F5315 68C4020000 push 000002C4 :760F531A EB22 jmp 760F533E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4ECB(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F531C FF15A0110E76 Call dword ptr [760E11A0] :760F5322 8BF8 mov edi, eax :760F5324 A184110E76 mov eax, dword ptr [760E1184] :760F5329 F60004 test byte ptr [eax], 04 :760F532C 0F842AFCFEFF je 760E4F5C :760F5332 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CCatUtils::VerifyCatalog" | :760F5334 683CA30E76 push 760EA33C :760F5339 68D7020000 push 000002D7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F531A(U) | * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F533E 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5343 FF1580110E76 Call dword ptr [760E1180] :760F5349 85C0 test eax, eax :760F534B 0F840BFCFEFF je 760E4F5C :760F5351 57 push edi * Possible StringData Ref from Code Obj ->"WTHelperGetProvSignerFromChain " ->"failed: ec=%d" | :760F5352 68E4A10E76 push 760EA1E4 :760F5357 E94FFFFFFF jmp 760F52AB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4EFA(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F535C FF15A0110E76 Call dword ptr [760E11A0] :760F5362 8BF8 mov edi, eax :760F5364 A184110E76 mov eax, dword ptr [760E1184] :760F5369 F60004 test byte ptr [eax], 04 :760F536C 0F84EAFBFEFF je 760E4F5C :760F5372 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CCatUtils::VerifyCatalog" | :760F5374 683CA30E76 push 760EA33C :760F5379 68ED020000 push 000002ED * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F537E 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5383 FF1580110E76 Call dword ptr [760E1180] :760F5389 85C0 test eax, eax :760F538B 0F84CBFBFEFF je 760E4F5C :760F5391 57 push edi * Possible StringData Ref from Code Obj ->"CryptHashPublicKeyInfo failed " ->"%d" | :760F5392 68A4A20E76 push 760EA2A4 :760F5397 E90FFFFFFF jmp 760F52AB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4F1C(C) | :760F539C 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CCatUtils::VerifyCatalog" | :760F539E 683CA30E76 push 760EA33C :760F53A3 68F7020000 push 000002F7 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F53A8 68C0D90F76 push 760FD9C0 :760F53AD FFD3 call ebx :760F53AF 85C0 test eax, eax :760F53B1 0F846BFBFEFF je 760E4F22 * Possible StringData Ref from Code Obj ->"This cert has the correct EKU" | :760F53B7 6884A20E76 push 760EA284 :760F53BC 56 push esi :760F53BD E8697BFFFF call 760ECF2B :760F53C2 59 pop ecx :760F53C3 59 pop ecx :760F53C4 E959FBFEFF jmp 760E4F22 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4F3A(C) | :760F53C9 1BC0 sbb eax, eax :760F53CB 83D8FF sbb eax, FFFFFFFF :760F53CE E96DFBFEFF jmp 760E4F40 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4F50(C) | :760F53D3 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CCatUtils::VerifyCatalog" | :760F53D5 683CA30E76 push 760EA33C :760F53DA 680C030000 push 0000030C * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F53DF 68C0D90F76 push 760FD9C0 :760F53E4 FFD3 call ebx :760F53E6 85C0 test eax, eax :760F53E8 0F8468FBFEFF je 760E4F56 * Possible StringData Ref from Code Obj ->"This cert is derived from the " ->"MS root" | :760F53EE 685CA20E76 push 760EA25C :760F53F3 6A00 push 00000000 :760F53F5 E8317BFFFF call 760ECF2B :760F53FA 59 pop ecx :760F53FB 59 pop ecx :760F53FC E955FBFEFF jmp 760E4F56 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4F42(C) | :760F5401 33F6 xor esi, esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4F28(C) | :760F5403 A184110E76 mov eax, dword ptr [760E1184] :760F5408 F60002 test byte ptr [eax], 02 :760F540B 7424 je 760F5431 :760F540D 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CCatUtils::VerifyCatalog" | :760F540F 683CA30E76 push 760EA33C :760F5414 6806030000 push 00000306 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F5419 68C0D90F76 push 760FD9C0 :760F541E FFD3 call ebx :760F5420 85C0 test eax, eax :760F5422 740D je 760F5431 * Possible StringData Ref from Code Obj ->"This is not a cert derived from " ->"the MS root" | :760F5424 6830A20E76 push 760EA230 :760F5429 56 push esi :760F542A E8FC7AFFFF call 760ECF2B :760F542F 59 pop ecx :760F5430 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F540B(C), :760F5422(C) | :760F5431 C745FC01000000 mov [ebp-04], 00000001 :760F5438 E91FFBFEFF jmp 760E4F5C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4F0D(C) | :760F543D F60004 test byte ptr [eax], 04 :760F5440 7428 je 760F546A :760F5442 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CCatUtils::VerifyCatalog" | :760F5444 683CA30E76 push 760EA33C :760F5449 68FC020000 push 000002FC * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\catutils\catutils.cpp" | :760F544E 68C0D90F76 push 760FD9C0 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5453 FF1580110E76 Call dword ptr [760E1180] :760F5459 85C0 test eax, eax :760F545B 740D je 760F546A * Possible StringData Ref from Code Obj ->"This cert has the wrong EKU" | :760F545D 6814A20E76 push 760EA214 :760F5462 56 push esi :760F5463 E8C37AFFFF call 760ECF2B :760F5468 59 pop ecx :760F5469 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5440(C), :760F545B(C) | :760F546A 895DFC mov dword ptr [ebp-04], ebx :760F546D E9EAFAFEFF jmp 760E4F5C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3F1A(C), :760E3F3A(C) | :760F5472 33C0 xor eax, eax :760F5474 E9E8EAFEFF jmp 760E3F61 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E195F(C) | :760F5479 A184110E76 mov eax, dword ptr [760E1184] :760F547E F60002 test byte ptr [eax], 02 :760F5481 0F8434C5FEFF je 760E19BB :760F5487 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::GetHashFromName" | :760F5489 686CA30E76 push 760EA36C :760F548E 6A39 push 00000039 :760F5490 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5495 FF1580110E76 Call dword ptr [760E1180] :760F549B 85C0 test eax, eax :760F549D 0F8418C5FEFF je 760E19BB * Possible StringData Ref from Code Obj ->"Invalid filename" | :760F54A3 6858A30E76 push 760EA358 :760F54A8 6801010000 push 00000101 :760F54AD E8797AFFFF call 760ECF2B :760F54B2 59 pop ecx :760F54B3 59 pop ecx :760F54B4 E902C5FEFF jmp 760E19BB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E27DE(C) | :760F54B9 8BFE mov edi, esi :760F54BB 8B36 mov esi, dword ptr [esi] :760F54BD 85F6 test esi, esi :760F54BF 0F850CD3FEFF jne 760E27D1 :760F54C5 E91AD3FEFF jmp 760E27E4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2809(C) | :760F54CA A184110E76 mov eax, dword ptr [760E1184] :760F54CF F60002 test byte ptr [eax], 02 :760F54D2 0F8414D3FEFF je 760E27EC :760F54D8 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::AddCatNameToCatList" | :760F54DA 6884A30E76 push 760EA384 :760F54DF 6896000000 push 00000096 :760F54E4 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F54E9 FF1580110E76 Call dword ptr [760E1180] :760F54EF 85C0 test eax, eax :760F54F1 0F84F5D2FEFF je 760E27EC * Possible StringData Ref from Code Obj ->"Out of memory" | :760F54F7 68809C0E76 push 760E9C80 :760F54FC 6801010000 push 00000101 :760F5501 E8257AFFFF call 760ECF2B :760F5506 59 pop ecx :760F5507 59 pop ecx :760F5508 E9DFD2FEFF jmp 760E27EC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E281C(C) | :760F550D 8B07 mov eax, dword ptr [edi] :760F550F 8906 mov dword ptr [esi], eax :760F5511 8937 mov dword ptr [edi], esi :760F5513 E9D4D2FEFF jmp 760E27EC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2601(C) | :760F5518 A184110E76 mov eax, dword ptr [760E1184] :760F551D F60002 test byte ptr [eax], 02 :760F5520 0F844DD1FEFF je 760E2673 :760F5526 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::AddFileEntryToSFPTable" | :760F5528 68C4A30E76 push 760EA3C4 :760F552D 68EE000000 push 000000EE :760F5532 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5537 FF1580110E76 Call dword ptr [760E1180] :760F553D 85C0 test eax, eax :760F553F 0F842ED1FEFF je 760E2673 * Possible StringData Ref from Code Obj ->"Hash error" | :760F5545 68B8A30E76 push 760EA3B8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F558D(U) | :760F554A 6801010000 push 00000101 :760F554F E8D779FFFF call 760ECF2B :760F5554 59 pop ecx :760F5555 59 pop ecx :760F5556 E918D1FEFF jmp 760E2673 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E262A(C) | :760F555B A184110E76 mov eax, dword ptr [760E1184] :760F5560 F60002 test byte ptr [eax], 02 :760F5563 0F840AD1FEFF je 760E2673 :760F5569 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::AddFileEntryToSFPTable" | :760F556B 68C4A30E76 push 760EA3C4 :760F5570 68FF000000 push 000000FF :760F5575 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F557A FF1580110E76 Call dword ptr [760E1180] :760F5580 85C0 test eax, eax :760F5582 0F84EBD0FEFF je 760E2673 * Possible StringData Ref from Code Obj ->"Out of memory" | :760F5588 68809C0E76 push 760E9C80 :760F558D EBBB jmp 760F554A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E266D(C) | :760F558F 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CSfpDb::AddFileEntryToSFPTable" | :760F5591 68C4A30E76 push 760EA3C4 :760F5596 680C010000 push 0000010C :760F559B 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F55A0 FF1580110E76 Call dword ptr [760E1180] :760F55A6 85C0 test eax, eax :760F55A8 0F84C5D0FEFF je 760E2673 :760F55AE 55 push ebp * Possible StringData Ref from Code Obj ->"Adding/getting file %s" | :760F55AF 68A0A30E76 push 760EA3A0 :760F55B4 6801010000 push 00000101 :760F55B9 E86D79FFFF call 760ECF2B :760F55BE 83C40C add esp, 0000000C :760F55C1 E9ADD0FEFF jmp 760E2673 * Referenced by a CALL at Addresses: |:760EFE05 , :760EFE17 , :760EFE2B | :760F55C6 55 push ebp :760F55C7 8BEC mov ebp, esp :760F55C9 51 push ecx :760F55CA 51 push ecx :760F55CB 8365F800 and dword ptr [ebp-08], 00000000 :760F55CF 53 push ebx :760F55D0 56 push esi :760F55D1 57 push edi :760F55D2 FF7508 push [ebp+08] :760F55D5 8BD9 mov ebx, ecx :760F55D7 C745FC01000000 mov [ebp-04], 00000001 :760F55DE E86EC3FEFF call 760E1951 :760F55E3 83F8FF cmp eax, FFFFFFFF :760F55E6 753F jne 760F5627 :760F55E8 A184110E76 mov eax, dword ptr [760E1184] :760F55ED F60002 test byte ptr [eax], 02 :760F55F0 742C je 760F561E :760F55F2 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::RemoveFileEntryFromSFPTable" | :760F55F4 6800A40E76 push 760EA400 :760F55F9 6827010000 push 00000127 :760F55FE 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5603 FF1580110E76 Call dword ptr [760E1180] :760F5609 85C0 test eax, eax :760F560B 7411 je 760F561E * Possible StringData Ref from Code Obj ->"Hash error" | :760F560D 68B8A30E76 push 760EA3B8 :760F5612 6801010000 push 00000101 :760F5617 E80F79FFFF call 760ECF2B :760F561C 59 pop ecx :760F561D 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F55F0(C), :760F560B(C), :760F5637(C), :760F5655(C) | :760F561E 8365FC00 and dword ptr [ebp-04], 00000000 :760F5622 E9AE000000 jmp 760F56D5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F55E6(C) | :760F5627 8BB4830C030000 mov esi, dword ptr [ebx+4*eax+0000030C] :760F562E 8DBC830C030000 lea edi, dword ptr [ebx+4*eax+0000030C] :760F5635 85F6 test esi, esi :760F5637 74E5 je 760F561E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5651(C) | :760F5639 FF7508 push [ebp+08] :760F563C 8D4608 lea eax, dword ptr [esi+08] :760F563F 50 push eax * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760F5640 FF1558120E76 Call dword ptr [760E1258] :760F5646 85C0 test eax, eax :760F5648 7409 je 760F5653 :760F564A 8975F8 mov dword ptr [ebp-08], esi :760F564D 8B36 mov esi, dword ptr [esi] :760F564F 85F6 test esi, esi :760F5651 75E6 jne 760F5639 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5648(C) | :760F5653 85F6 test esi, esi :760F5655 74C7 je 760F561E :760F5657 8B45F8 mov eax, dword ptr [ebp-08] :760F565A 85C0 test eax, eax :760F565C 7506 jne 760F5664 :760F565E 8B06 mov eax, dword ptr [esi] :760F5660 8907 mov dword ptr [edi], eax :760F5662 EB04 jmp 760F5668 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F565C(C) | :760F5664 8B0E mov ecx, dword ptr [esi] :760F5666 8908 mov dword ptr [eax], ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5662(U), :760F567B(U) | :760F5668 8B4604 mov eax, dword ptr [esi+04] :760F566B 85C0 test eax, eax :760F566D 740E je 760F567D :760F566F 8B480C mov ecx, dword ptr [eax+0C] :760F5672 50 push eax :760F5673 894E04 mov dword ptr [esi+04], ecx :760F5676 E874C3FEFF call 760E19EF :760F567B EBEB jmp 760F5668 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F566D(C) | :760F567D 56 push esi :760F567E E86CC3FEFF call 760E19EF :760F5683 8B8394220000 mov eax, dword ptr [ebx+00002294] :760F5689 8D8B94220000 lea ecx, dword ptr [ebx+00002294] :760F568F 33D2 xor edx, edx :760F5691 BEA0860100 mov esi, 000186A0 :760F5696 F7F6 div esi :760F5698 42 inc edx :760F5699 8911 mov dword ptr [ecx], edx :760F569B A184110E76 mov eax, dword ptr [760E1184] :760F56A0 F60004 test byte ptr [eax], 04 :760F56A3 7430 je 760F56D5 :760F56A5 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CSfpDb::RemoveFileEntryFromSFPTable" | :760F56A7 6800A40E76 push 760EA400 :760F56AC 6857010000 push 00000157 :760F56B1 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F56B6 FF1580110E76 Call dword ptr [760E1180] :760F56BC 85C0 test eax, eax :760F56BE 7415 je 760F56D5 :760F56C0 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Removed file %s from sfp db" | :760F56C3 68E4A30E76 push 760EA3E4 :760F56C8 6801010000 push 00000101 :760F56CD E85978FFFF call 760ECF2B :760F56D2 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5622(U), :760F56A3(C), :760F56BE(C) | :760F56D5 8B45FC mov eax, dword ptr [ebp-04] :760F56D8 5F pop edi :760F56D9 5E pop esi :760F56DA 5B pop ebx :760F56DB C9 leave :760F56DC C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E26E8(C) | :760F56DF A184110E76 mov eax, dword ptr [760E1184] :760F56E4 F60002 test byte ptr [eax], 02 :760F56E7 742C je 760F5715 :760F56E9 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::AddCatalogEntryToSFPTable" | :760F56EB 68ACA40E76 push 760EA4AC :760F56F0 6884010000 push 00000184 :760F56F5 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F56FA FF1580110E76 Call dword ptr [760E1180] :760F5700 85C0 test eax, eax :760F5702 7411 je 760F5715 * Possible StringData Ref from Code Obj ->"Out of memory" | :760F5704 68809C0E76 push 760E9C80 :760F5709 6801010000 push 00000101 :760F570E E81878FFFF call 760ECF2B :760F5713 59 pop ecx :760F5714 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F56E7(C), :760F5702(C), :760F5759(U), :760F5793(C) | :760F5715 895DFC mov dword ptr [ebp-04], ebx :760F5718 E927D0FEFF jmp 760E2744 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E26FA(C) | :760F571D A184110E76 mov eax, dword ptr [760E1184] :760F5722 F60002 test byte ptr [eax], 02 :760F5725 742C je 760F5753 :760F5727 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::AddCatalogEntryToSFPTable" | :760F5729 68ACA40E76 push 760EA4AC :760F572E 688D010000 push 0000018D :760F5733 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5738 FF1580110E76 Call dword ptr [760E1180] :760F573E 85C0 test eax, eax :760F5740 7411 je 760F5753 * Possible StringData Ref from Code Obj ->"NULL catname ptr" | :760F5742 6898A40E76 push 760EA498 :760F5747 6801010000 push 00000101 :760F574C E8DA77FFFF call 760ECF2B :760F5751 59 pop ecx :760F5752 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5725(C), :760F5740(C), :760F5795(U) | :760F5753 56 push esi :760F5754 E896C2FEFF call 760E19EF :760F5759 EBBA jmp 760F5715 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E271C(C) | :760F575B A184110E76 mov eax, dword ptr [760E1184] :760F5760 F60002 test byte ptr [eax], 02 :760F5763 742C je 760F5791 :760F5765 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::AddCatalogEntryToSFPTable" | :760F5767 68ACA40E76 push 760EA4AC :760F576C 689D010000 push 0000019D :760F5771 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5776 FF1580110E76 Call dword ptr [760E1180] :760F577C 85C0 test eax, eax :760F577E 7411 je 760F5791 * Possible StringData Ref from Code Obj ->"NULL file entry ptr" | :760F5780 6884A40E76 push 760EA484 :760F5785 6801010000 push 00000101 :760F578A E89C77FFFF call 760ECF2B :760F578F 59 pop ecx :760F5790 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5763(C), :760F577E(C) | :760F5791 3BF3 cmp esi, ebx :760F5793 7480 je 760F5715 :760F5795 EBBC jmp 760F5753 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E27A4(U) | :760F5797 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CSfpDb::AddCatalogEntryToSFPTable" | :760F5799 68ACA40E76 push 760EA4AC :760F579E 68BB010000 push 000001BB :760F57A3 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F57A8 FF1580110E76 Call dword ptr [760E1180] :760F57AE 85C0 test eax, eax :760F57B0 0F848ECFFEFF je 760E2744 :760F57B6 FF7510 push [ebp+10] :760F57B9 FF750C push [ebp+0C] :760F57BC FF7514 push [ebp+14] :760F57BF FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Catalog entry for cat=%s, version=%I64x " ->"already exists" | :760F57C2 684CA40E76 push 760EA44C :760F57C7 6801010000 push 00000101 :760F57CC E85A77FFFF call 760ECF2B :760F57D1 83C418 add esp, 00000018 :760F57D4 E96BCFFEFF jmp 760E2744 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E273E(C) | :760F57D9 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CSfpDb::AddCatalogEntryToSFPTable" | :760F57DB 68ACA40E76 push 760EA4AC :760F57E0 68D3010000 push 000001D3 :760F57E5 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F57EA FF1580110E76 Call dword ptr [760E1180] :760F57F0 85C0 test eax, eax :760F57F2 0F844CCFFEFF je 760E2744 :760F57F8 FF7514 push [ebp+14] :760F57FB FF7510 push [ebp+10] :760F57FE FF750C push [ebp+0C] * Possible StringData Ref from Code Obj ->"Added cat entry version=%I64x, " ->"cat=%s" | :760F5801 6824A40E76 push 760EA424 :760F5806 6801010000 push 00000101 :760F580B E81B77FFFF call 760ECF2B :760F5810 83C414 add esp, 00000014 :760F5813 E92CCFFEFF jmp 760E2744 * Referenced by a CALL at Address: |:760EF51F | :760F5818 55 push ebp :760F5819 8BEC mov ebp, esp :760F581B 51 push ecx :760F581C 53 push ebx :760F581D 56 push esi :760F581E 57 push edi :760F581F 8BF1 mov esi, ecx :760F5821 FF7508 push [ebp+08] :760F5824 C745FC01000000 mov [ebp-04], 00000001 :760F582B E821C1FEFF call 760E1951 :760F5830 83F8FF cmp eax, FFFFFFFF :760F5833 7534 jne 760F5869 :760F5835 A184110E76 mov eax, dword ptr [760E1184] :760F583A F60002 test byte ptr [eax], 02 :760F583D 0F845B010000 je 760F599E :760F5843 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::RemoveCatalogEntryFromSFPTable" | :760F5845 6844A50E76 push 760EA544 :760F584A 68F3010000 push 000001F3 :760F584F 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5854 FF1580110E76 Call dword ptr [760E1180] :760F585A 85C0 test eax, eax :760F585C 0F843C010000 je 760F599E * Possible StringData Ref from Code Obj ->"Hash error" | :760F5862 68B8A30E76 push 760EA3B8 :760F5867 EB43 jmp 760F58AC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5833(C) | :760F5869 FF7508 push [ebp+08] :760F586C 8BCE mov ecx, esi :760F586E 50 push eax :760F586F E84FC1FEFF call 760E19C3 :760F5874 8BF8 mov edi, eax :760F5876 85FF test edi, edi :760F5878 7543 jne 760F58BD :760F587A A184110E76 mov eax, dword ptr [760E1184] :760F587F F60002 test byte ptr [eax], 02 :760F5882 0F8416010000 je 760F599E :760F5888 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::RemoveCatalogEntryFromSFPTable" | :760F588A 6844A50E76 push 760EA544 :760F588F 68FE010000 push 000001FE :760F5894 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5899 FF1580110E76 Call dword ptr [760E1180] :760F589F 85C0 test eax, eax :760F58A1 0F84F7000000 je 760F599E * Possible StringData Ref from Code Obj ->"No file to remove" | :760F58A7 6830A50E76 push 760EA530 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5867(U) | :760F58AC 6801010000 push 00000101 :760F58B1 E87576FFFF call 760ECF2B :760F58B6 59 pop ecx :760F58B7 59 pop ecx :760F58B8 E9E1000000 jmp 760F599E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5878(C) | :760F58BD 8B7704 mov esi, dword ptr [edi+04] :760F58C0 33DB xor ebx, ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5902(U) | :760F58C2 85F6 test esi, esi :760F58C4 0F8494000000 je 760F595E :760F58CA 8B4E04 mov ecx, dword ptr [esi+04] :760F58CD 8B06 mov eax, dword ptr [esi] :760F58CF 394D10 cmp dword ptr [ebp+10], ecx :760F58D2 0F8F86000000 jg 760F595E :760F58D8 7C05 jl 760F58DF :760F58DA 39450C cmp dword ptr [ebp+0C], eax :760F58DD 777F ja 760F595E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F58D8(C) | :760F58DF 39450C cmp dword ptr [ebp+0C], eax :760F58E2 7519 jne 760F58FD :760F58E4 394D10 cmp dword ptr [ebp+10], ecx :760F58E7 7514 jne 760F58FD :760F58E9 8B4608 mov eax, dword ptr [esi+08] :760F58EC FF7514 push [ebp+14] :760F58EF 83C004 add eax, 00000004 :760F58F2 50 push eax * Reference To: KERNEL32.lstrcmpiA, Ord:032Ch | :760F58F3 FF1558120E76 Call dword ptr [760E1258] :760F58F9 85C0 test eax, eax :760F58FB 7407 je 760F5904 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F58E2(C), :760F58E7(C) | :760F58FD 8BDE mov ebx, esi :760F58FF 8B760C mov esi, dword ptr [esi+0C] :760F5902 EBBE jmp 760F58C2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F58FB(C) | :760F5904 8B460C mov eax, dword ptr [esi+0C] :760F5907 85DB test ebx, ebx :760F5909 7505 jne 760F5910 :760F590B 894704 mov dword ptr [edi+04], eax :760F590E EB03 jmp 760F5913 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5909(C) | :760F5910 89430C mov dword ptr [ebx+0C], eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F590E(U) | :760F5913 56 push esi :760F5914 E8D6C0FEFF call 760E19EF :760F5919 A184110E76 mov eax, dword ptr [760E1184] :760F591E F60004 test byte ptr [eax], 04 :760F5921 747F je 760F59A2 :760F5923 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CSfpDb::RemoveCatalogEntryFromSFPTable" | :760F5925 6844A50E76 push 760EA544 :760F592A 6825020000 push 00000225 :760F592F 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5934 FF1580110E76 Call dword ptr [760E1180] :760F593A 85C0 test eax, eax :760F593C 7464 je 760F59A2 :760F593E FF7514 push [ebp+14] :760F5941 FF7510 push [ebp+10] :760F5944 FF750C push [ebp+0C] :760F5947 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Removed cat entry file=%s, ver=%I64x, " ->"cat=%s" | :760F594A 6800A50E76 push 760EA500 :760F594F 6801010000 push 00000101 :760F5954 E8D275FFFF call 760ECF2B :760F5959 83C418 add esp, 00000018 :760F595C EB44 jmp 760F59A2 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F58C4(C), :760F58D2(C), :760F58DD(C) | :760F595E A184110E76 mov eax, dword ptr [760E1184] :760F5963 F60002 test byte ptr [eax], 02 :760F5966 7436 je 760F599E :760F5968 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::RemoveCatalogEntryFromSFPTable" | :760F596A 6844A50E76 push 760EA544 :760F596F 6831020000 push 00000231 :760F5974 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5979 FF1580110E76 Call dword ptr [760E1180] :760F597F 85C0 test eax, eax :760F5981 741B je 760F599E :760F5983 FF7510 push [ebp+10] :760F5986 FF750C push [ebp+0C] :760F5989 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Filename %s version %I64x not " ->"found in table" | :760F598C 68D0A40E76 push 760EA4D0 :760F5991 6801010000 push 00000101 :760F5996 E89075FFFF call 760ECF2B :760F599B 83C414 add esp, 00000014 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F583D(C), :760F585C(C), :760F5882(C), :760F58A1(C), :760F58B8(U) |:760F5966(C), :760F5981(C) | :760F599E 8365FC00 and dword ptr [ebp-04], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5921(C), :760F593C(C), :760F595C(U) | :760F59A2 8B45FC mov eax, dword ptr [ebp-04] :760F59A5 5F pop edi :760F59A6 5E pop esi :760F59A7 5B pop ebx :760F59A8 C9 leave :760F59A9 C21000 ret 0010 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3309(C), :760E3326(C), :760E3344(C), :760E3364(C) | :760F59AC 8365FC00 and dword ptr [ebp-04], 00000000 :760F59B0 E910DAFEFF jmp 760E33C5 * Referenced by a CALL at Addresses: |:760EDE70 , :760EE185 , :760EE948 | :760F59B5 55 push ebp :760F59B6 8BEC mov ebp, esp :760F59B8 53 push ebx :760F59B9 56 push esi :760F59BA 57 push edi :760F59BB 8BF9 mov edi, ecx :760F59BD FF7508 push [ebp+08] :760F59C0 33DB xor ebx, ebx :760F59C2 E88ABFFEFF call 760E1951 :760F59C7 8B750C mov esi, dword ptr [ebp+0C] :760F59CA 85F6 test esi, esi :760F59CC 7543 jne 760F5A11 :760F59CE A184110E76 mov eax, dword ptr [760E1184] :760F59D3 F60002 test byte ptr [eax], 02 :760F59D6 0F8400010000 je 760F5ADC :760F59DC 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::GetFirstLatestVersionOfFile" | :760F59DE 68CCA50E76 push 760EA5CC :760F59E3 68B2020000 push 000002B2 :760F59E8 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F59ED FF1580110E76 Call dword ptr [760E1180] :760F59F3 85C0 test eax, eax :760F59F5 0F84E1000000 je 760F5ADC * Possible StringData Ref from Code Obj ->"Null version pointer" | :760F59FB 68B4A50E76 push 760EA5B4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5A4F(U) | :760F5A00 6801010000 push 00000101 :760F5A05 E82175FFFF call 760ECF2B :760F5A0A 59 pop ecx :760F5A0B 59 pop ecx :760F5A0C E9CB000000 jmp 760F5ADC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F59CC(C) | :760F5A11 832600 and dword ptr [esi], 00000000 :760F5A14 83660400 and dword ptr [esi+04], 00000000 :760F5A18 83F8FF cmp eax, FFFFFFFF :760F5A1B 7534 jne 760F5A51 :760F5A1D A184110E76 mov eax, dword ptr [760E1184] :760F5A22 F60002 test byte ptr [eax], 02 :760F5A25 0F84B1000000 je 760F5ADC :760F5A2B 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::GetFirstLatestVersionOfFile" | :760F5A2D 68CCA50E76 push 760EA5CC :760F5A32 68BA020000 push 000002BA :760F5A37 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5A3C FF1580110E76 Call dword ptr [760E1180] :760F5A42 85C0 test eax, eax :760F5A44 0F8492000000 je 760F5ADC * Possible StringData Ref from Code Obj ->"Hash error" | :760F5A4A 68B8A30E76 push 760EA3B8 :760F5A4F EBAF jmp 760F5A00 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5A1B(C) | :760F5A51 FF7508 push [ebp+08] :760F5A54 8BCF mov ecx, edi :760F5A56 50 push eax :760F5A57 E867BFFEFF call 760E19C3 :760F5A5C 85C0 test eax, eax :760F5A5E 752F jne 760F5A8F :760F5A60 A184110E76 mov eax, dword ptr [760E1184] :760F5A65 F60002 test byte ptr [eax], 02 :760F5A68 7472 je 760F5ADC :760F5A6A 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::GetFirstLatestVersionOfFile" | :760F5A6C 68CCA50E76 push 760EA5CC :760F5A71 68C3020000 push 000002C3 :760F5A76 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5A7B FF1580110E76 Call dword ptr [760E1180] :760F5A81 85C0 test eax, eax :760F5A83 7457 je 760F5ADC :760F5A85 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"File %s does not exist in table" | :760F5A88 6894A50E76 push 760EA594 :760F5A8D EB40 jmp 760F5ACF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5A5E(C) | :760F5A8F 8B5804 mov ebx, dword ptr [eax+04] :760F5A92 85DB test ebx, ebx :760F5A94 740C je 760F5AA2 :760F5A96 8B03 mov eax, dword ptr [ebx] :760F5A98 8906 mov dword ptr [esi], eax :760F5A9A 8B4304 mov eax, dword ptr [ebx+04] :760F5A9D 894604 mov dword ptr [esi+04], eax :760F5AA0 EB3A jmp 760F5ADC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5A94(C) | :760F5AA2 A184110E76 mov eax, dword ptr [760E1184] :760F5AA7 F60002 test byte ptr [eax], 02 :760F5AAA 7430 je 760F5ADC :760F5AAC 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::GetFirstLatestVersionOfFile" | :760F5AAE 68CCA50E76 push 760EA5CC :760F5AB3 68D1020000 push 000002D1 :760F5AB8 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5ABD FF1580110E76 Call dword ptr [760E1180] :760F5AC3 85C0 test eax, eax :760F5AC5 7415 je 760F5ADC :760F5AC7 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"File %s has no catalog entry in " ->"table" | :760F5ACA 686CA50E76 push 760EA56C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5A8D(U) | :760F5ACF 6801010000 push 00000101 :760F5AD4 E85274FFFF call 760ECF2B :760F5AD9 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F59D6(C), :760F59F5(C), :760F5A0C(U), :760F5A25(C), :760F5A44(C) |:760F5A68(C), :760F5A83(C), :760F5AA0(U), :760F5AAA(C), :760F5AC5(C) | :760F5ADC 5F pop edi :760F5ADD 8BC3 mov eax, ebx :760F5ADF 5E pop esi :760F5AE0 5B pop ebx :760F5AE1 5D pop ebp :760F5AE2 C20800 ret 0008 * Referenced by a CALL at Addresses: |:760EE1DD , :760EE9A9 | :760F5AE5 8B442408 mov eax, dword ptr [esp+08] :760F5AE9 56 push esi :760F5AEA 33F6 xor esi, esi :760F5AEC 85C0 test eax, eax :760F5AEE 7538 jne 760F5B28 :760F5AF0 A184110E76 mov eax, dword ptr [760E1184] :760F5AF5 F60002 test byte ptr [eax], 02 :760F5AF8 747A je 760F5B74 :760F5AFA 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::GetNextLatestVersionOfFile" | :760F5AFC 6800A60E76 push 760EA600 :760F5B01 68EA020000 push 000002EA :760F5B06 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5B0B FF1580110E76 Call dword ptr [760E1180] :760F5B11 85C0 test eax, eax :760F5B13 745F je 760F5B74 * Possible StringData Ref from Code Obj ->"Null version pointer" | :760F5B15 68B4A50E76 push 760EA5B4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5B61(U) | :760F5B1A 6801010000 push 00000101 :760F5B1F E80774FFFF call 760ECF2B :760F5B24 59 pop ecx :760F5B25 59 pop ecx :760F5B26 EB4C jmp 760F5B74 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5AEE(C) | :760F5B28 832000 and dword ptr [eax], 00000000 :760F5B2B 8B742408 mov esi, dword ptr [esp+08] :760F5B2F 83600400 and dword ptr [eax+04], 00000000 :760F5B33 85F6 test esi, esi :760F5B35 752C jne 760F5B63 :760F5B37 A184110E76 mov eax, dword ptr [760E1184] :760F5B3C F60002 test byte ptr [eax], 02 :760F5B3F 7433 je 760F5B74 :760F5B41 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::GetNextLatestVersionOfFile" | :760F5B43 6800A60E76 push 760EA600 :760F5B48 68F4020000 push 000002F4 :760F5B4D 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5B52 FF1580110E76 Call dword ptr [760E1180] :760F5B58 85C0 test eax, eax :760F5B5A 7418 je 760F5B74 * Possible StringData Ref from Code Obj ->"Invalid handle" | :760F5B5C 68F0A50E76 push 760EA5F0 :760F5B61 EBB7 jmp 760F5B1A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5B35(C) | :760F5B63 8B760C mov esi, dword ptr [esi+0C] :760F5B66 85F6 test esi, esi :760F5B68 740A je 760F5B74 :760F5B6A 8B0E mov ecx, dword ptr [esi] :760F5B6C 8908 mov dword ptr [eax], ecx :760F5B6E 8B4E04 mov ecx, dword ptr [esi+04] :760F5B71 894804 mov dword ptr [eax+04], ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5AF8(C), :760F5B13(C), :760F5B26(U), :760F5B3F(C), :760F5B5A(C) |:760F5B68(C) | :760F5B74 8BC6 mov eax, esi :760F5B76 5E pop esi :760F5B77 C20800 ret 0008 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1D25(C) | :760F5B7A A184110E76 mov eax, dword ptr [760E1184] :760F5B7F F60002 test byte ptr [eax], 02 :760F5B82 0F84B6C1FEFF je 760E1D3E :760F5B88 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::IsFileInSFPDb" | :760F5B8A 6824A60E76 push 760EA624 :760F5B8F 681A030000 push 0000031A :760F5B94 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5B99 FF1580110E76 Call dword ptr [760E1180] :760F5B9F 85C0 test eax, eax :760F5BA1 0F8497C1FEFF je 760E1D3E * Possible StringData Ref from Code Obj ->"Hash error" | :760F5BA7 68B8A30E76 push 760EA3B8 :760F5BAC 6801010000 push 00000101 :760F5BB1 E87573FFFF call 760ECF2B :760F5BB6 59 pop ecx :760F5BB7 59 pop ecx :760F5BB8 E981C1FEFF jmp 760E1D3E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1D38(C) | :760F5BBD 8B4D0C mov ecx, dword ptr [ebp+0C] :760F5BC0 0B4D10 or ecx, dword ptr [ebp+10] :760F5BC3 7433 je 760F5BF8 :760F5BC5 8B4004 mov eax, dword ptr [eax+04] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5BF6(U) | :760F5BC8 85C0 test eax, eax :760F5BCA 0F846EC1FEFF je 760E1D3E :760F5BD0 8B5004 mov edx, dword ptr [eax+04] :760F5BD3 8B08 mov ecx, dword ptr [eax] :760F5BD5 3B5510 cmp edx, dword ptr [ebp+10] :760F5BD8 0F8C60C1FEFF jl 760E1D3E :760F5BDE 7F09 jg 760F5BE9 :760F5BE0 3B4D0C cmp ecx, dword ptr [ebp+0C] :760F5BE3 0F8255C1FEFF jb 760E1D3E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5BDE(C) | :760F5BE9 3B4D0C cmp ecx, dword ptr [ebp+0C] :760F5BEC 7505 jne 760F5BF3 :760F5BEE 3B5510 cmp edx, dword ptr [ebp+10] :760F5BF1 7405 je 760F5BF8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5BEC(C) | :760F5BF3 8B400C mov eax, dword ptr [eax+0C] :760F5BF6 EBD0 jmp 760F5BC8 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5BC3(C), :760F5BF1(C) | :760F5BF8 6A01 push 00000001 :760F5BFA 5F pop edi :760F5BFB E93EC1FEFF jmp 760E1D3E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2C0A(C) | :760F5C00 A184110E76 mov eax, dword ptr [760E1184] :760F5C05 F60002 test byte ptr [eax], 02 :760F5C08 0F845AD0FEFF je 760E2C68 :760F5C0E 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::GetFullFileNameFromFileName" | :760F5C10 687CA60E76 push 760EA67C :760F5C15 6859030000 push 00000359 :760F5C1A 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5C1F FF1580110E76 Call dword ptr [760E1180] :760F5C25 85C0 test eax, eax :760F5C27 0F843BD0FEFF je 760E2C68 * Possible StringData Ref from Code Obj ->"Hash error" | :760F5C2D 68B8A30E76 push 760EA3B8 :760F5C32 E9A4000000 jmp 760F5CDB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2C2B(C) | :760F5C37 8BC7 mov eax, edi :760F5C39 E9F4CFFEFF jmp 760E2C32 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2C55(U) | :760F5C3E A184110E76 mov eax, dword ptr [760E1184] :760F5C43 F60002 test byte ptr [eax], 02 :760F5C46 0F841CD0FEFF je 760E2C68 :760F5C4C 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::GetFullFileNameFromFileName" | :760F5C4E 687CA60E76 push 760EA67C :760F5C53 6875030000 push 00000375 :760F5C58 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5C5D FF1580110E76 Call dword ptr [760E1180] :760F5C63 85C0 test eax, eax :760F5C65 0F84FDCFFEFF je 760E2C68 * Possible StringData Ref from Code Obj ->"Cannot copy" | :760F5C6B 6870A60E76 push 760EA670 :760F5C70 EB69 jmp 760F5CDB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2C62(C) | :760F5C72 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::GetFullFileNameFromFileName" | :760F5C74 687CA60E76 push 760EA67C :760F5C79 687E030000 push 0000037E :760F5C7E 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5C83 FF1580110E76 Call dword ptr [760E1180] :760F5C89 85C0 test eax, eax :760F5C8B 0F84D7CFFEFF je 760E2C68 :760F5C91 57 push edi * Possible StringData Ref from Code Obj ->"Cannot find file %s in sfp db" | :760F5C92 6850A60E76 push 760EA650 :760F5C97 6801010000 push 00000101 :760F5C9C E88A72FFFF call 760ECF2B :760F5CA1 83C40C add esp, 0000000C :760F5CA4 E9BFCFFEFF jmp 760E2C68 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E2BE7(C), :760E2BF3(C), :760E2BFE(C) | :760F5CA9 A184110E76 mov eax, dword ptr [760E1184] :760F5CAE F60002 test byte ptr [eax], 02 :760F5CB1 0F84B1CFFEFF je 760E2C68 :760F5CB7 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::GetFullFileNameFromFileName" | :760F5CB9 687CA60E76 push 760EA67C :760F5CBE 6850030000 push 00000350 :760F5CC3 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5CC8 FF1580110E76 Call dword ptr [760E1180] :760F5CCE 85C0 test eax, eax :760F5CD0 0F8492CFFEFF je 760E2C68 * Possible StringData Ref from Code Obj ->"Invalid parameter" | :760F5CD6 683CA60E76 push 760EA63C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5C32(U), :760F5C70(U) | :760F5CDB 6801010000 push 00000101 :760F5CE0 E84672FFFF call 760ECF2B :760F5CE5 59 pop ecx :760F5CE6 59 pop ecx :760F5CE7 E97CCFFEFF jmp 760E2C68 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E31DE(C) | :760F5CEC A184110E76 mov eax, dword ptr [760E1184] :760F5CF1 F60002 test byte ptr [eax], 02 :760F5CF4 7466 je 760F5D5C :760F5CF6 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::BuildSFPTableFromDataFile" | :760F5CF8 6830A70E76 push 760EA730 :760F5CFD 689D030000 push 0000039D :760F5D02 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5D07 FF1580110E76 Call dword ptr [760E1180] :760F5D0D 85C0 test eax, eax :760F5D0F 744B je 760F5D5C * Possible StringData Ref from Code Obj ->"Invalid filename" | :760F5D11 6858A30E76 push 760EA358 :760F5D16 6801010000 push 00000101 :760F5D1B E80B72FFFF call 760ECF2B :760F5D20 59 pop ecx :760F5D21 59 pop ecx :760F5D22 EB38 jmp 760F5D5C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3201(C) | :760F5D24 A184110E76 mov eax, dword ptr [760E1184] :760F5D29 F60002 test byte ptr [eax], 02 :760F5D2C 742E je 760F5D5C :760F5D2E 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::BuildSFPTableFromDataFile" | :760F5D30 6830A70E76 push 760EA730 :760F5D35 68AD030000 push 000003AD :760F5D3A 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5D3F FF1580110E76 Call dword ptr [760E1180] :760F5D45 85C0 test eax, eax :760F5D47 7413 je 760F5D5C :760F5D49 53 push ebx * Possible StringData Ref from Code Obj ->"Cannot open file %s for reading" | :760F5D4A 6810A70E76 push 760EA710 :760F5D4F 6801010000 push 00000101 :760F5D54 E8D271FFFF call 760ECF2B :760F5D59 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5CF4(C), :760F5D0F(C), :760F5D22(U), :760F5D2C(C), :760F5D47(C) | :760F5D5C 897DFC mov dword ptr [ebp-04], edi :760F5D5F E978D5FEFF jmp 760E32DC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3214(C) | :760F5D64 A184110E76 mov eax, dword ptr [760E1184] :760F5D69 F60004 test byte ptr [eax], 04 :760F5D6C 0F845BD5FEFF je 760E32CD :760F5D72 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CSfpDb::BuildSFPTableFromDataFile" | :760F5D74 6830A70E76 push 760EA730 :760F5D79 68B8030000 push 000003B8 :760F5D7E 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5D83 FF1580110E76 Call dword ptr [760E1180] :760F5D89 85C0 test eax, eax :760F5D8B 0F843CD5FEFF je 760E32CD * Possible StringData Ref from Code Obj ->"Zero-sized db file" | :760F5D91 68FCA60E76 push 760EA6FC :760F5D96 6801010000 push 00000101 :760F5D9B E88B71FFFF call 760ECF2B :760F5DA0 59 pop ecx :760F5DA1 59 pop ecx :760F5DA2 E926D5FEFF jmp 760E32CD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E322E(C) | :760F5DA7 A184110E76 mov eax, dword ptr [760E1184] :760F5DAC F60002 test byte ptr [eax], 02 :760F5DAF 742E je 760F5DDF :760F5DB1 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::BuildSFPTableFromDataFile" | :760F5DB3 6830A70E76 push 760EA730 :760F5DB8 68C7030000 push 000003C7 :760F5DBD 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5DC2 FF1580110E76 Call dword ptr [760E1180] :760F5DC8 85C0 test eax, eax :760F5DCA 7413 je 760F5DDF :760F5DCC 53 push ebx * Possible StringData Ref from Code Obj ->"Cannot create file mapping for " ->"%s" | :760F5DCD 68D8A60E76 push 760EA6D8 :760F5DD2 6801010000 push 00000101 :760F5DD7 E84F71FFFF call 760ECF2B :760F5DDC 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5DAF(C), :760F5DCA(C) | :760F5DDF 897DFC mov dword ptr [ebp-04], edi :760F5DE2 E9D8D4FEFF jmp 760E32BF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3244(C) | :760F5DE7 A184110E76 mov eax, dword ptr [760E1184] :760F5DEC F60002 test byte ptr [eax], 02 :760F5DEF 742C je 760F5E1D :760F5DF1 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::BuildSFPTableFromDataFile" | :760F5DF3 6830A70E76 push 760EA730 :760F5DF8 68D5030000 push 000003D5 :760F5DFD 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5E02 FF1580110E76 Call dword ptr [760E1180] :760F5E08 85C0 test eax, eax :760F5E0A 7411 je 760F5E1D * Possible StringData Ref from Code Obj ->"Cannot create view of file" | :760F5E0C 68BCA60E76 push 760EA6BC :760F5E11 6801010000 push 00000101 :760F5E16 E81071FFFF call 760ECF2B :760F5E1B 59 pop ecx :760F5E1C 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5DEF(C), :760F5E0A(C) | :760F5E1D 897DFC mov dword ptr [ebp-04], edi :760F5E20 E98FD4FEFF jmp 760E32B4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E3274(C) | :760F5E25 A184110E76 mov eax, dword ptr [760E1184] :760F5E2A F60002 test byte ptr [eax], 02 :760F5E2D 742C je 760F5E5B :760F5E2F 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::BuildSFPTableFromDataFile" | :760F5E31 6830A70E76 push 760EA730 :760F5E36 68ED030000 push 000003ED :760F5E3B 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5E40 FF1580110E76 Call dword ptr [760E1180] :760F5E46 85C0 test eax, eax :760F5E48 7411 je 760F5E5B * Possible StringData Ref from Code Obj ->"Error in parsing data file" | :760F5E4A 68A0A60E76 push 760EA6A0 :760F5E4F 6801010000 push 00000101 :760F5E54 E8D270FFFF call 760ECF2B :760F5E59 59 pop ecx :760F5E5A 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E3290(C), :760F5E2D(C), :760F5E48(C) | :760F5E5B 8365FC00 and dword ptr [ebp-04], 00000000 :760F5E5F E94ED4FEFF jmp 760E32B2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E21C8(C) | :760F5E64 A184110E76 mov eax, dword ptr [760E1184] :760F5E69 F60002 test byte ptr [eax], 02 :760F5E6C 7424 je 760F5E92 :760F5E6E 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::WriteSFPTableToDataFile" | :760F5E70 68A4A70E76 push 760EA7A4 :760F5E75 6828040000 push 00000428 :760F5E7A 53 push ebx :760F5E7B FFD5 call ebp :760F5E7D 85C0 test eax, eax :760F5E7F 7411 je 760F5E92 * Possible StringData Ref from Code Obj ->"Invalid filename - writing to " ->"original file" | :760F5E81 6878A70E76 push 760EA778 :760F5E86 6801010000 push 00000101 :760F5E8B E89B70FFFF call 760ECF2B :760F5E90 59 pop ecx :760F5E91 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5E6C(C), :760F5E7F(C) | :760F5E92 8BF7 mov esi, edi :760F5E94 E935C3FEFF jmp 760E21CE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E21E2(C) | :760F5E99 A184110E76 mov eax, dword ptr [760E1184] :760F5E9E F60002 test byte ptr [eax], 02 :760F5EA1 7426 je 760F5EC9 :760F5EA3 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::WriteSFPTableToDataFile" | :760F5EA5 68A4A70E76 push 760EA7A4 :760F5EAA 6830040000 push 00000430 :760F5EAF 53 push ebx :760F5EB0 FFD5 call ebp :760F5EB2 85C0 test eax, eax :760F5EB4 7413 je 760F5EC9 :760F5EB6 56 push esi * Possible StringData Ref from Code Obj ->"Cannot open data file %s to write" | :760F5EB7 6854A70E76 push 760EA754 :760F5EBC 6801010000 push 00000101 :760F5EC1 E86570FFFF call 760ECF2B :760F5EC6 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5EA1(C), :760F5EB4(C) | :760F5EC9 8364241800 and dword ptr [esp+18], 00000000 :760F5ECE E9A0C3FEFF jmp 760E2273 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4CD9(C) | :760F5ED3 A184110E76 mov eax, dword ptr [760E1184] :760F5ED8 F60002 test byte ptr [eax], 02 :760F5EDB 0F846EEEFEFF je 760E4D4F :760F5EE1 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::GetNextProtectedFile" | :760F5EE3 68F4A70E76 push 760EA7F4 :760F5EE8 6881040000 push 00000481 :760F5EED 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5EF2 FF1580110E76 Call dword ptr [760E1180] :760F5EF8 85C0 test eax, eax :760F5EFA 0F844FEEFEFF je 760E4D4F * Possible StringData Ref from Code Obj ->"Hash error" | :760F5F00 68B8A30E76 push 760EA3B8 :760F5F05 6801010000 push 00000101 :760F5F0A E81C70FFFF call 760ECF2B :760F5F0F 59 pop ecx :760F5F10 59 pop ecx :760F5F11 E939EEFEFF jmp 760E4D4F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4CEC(C) | :760F5F16 A184110E76 mov eax, dword ptr [760E1184] :760F5F1B F60002 test byte ptr [eax], 02 :760F5F1E 0F842BEEFEFF je 760E4D4F :760F5F24 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CSfpDb::GetNextProtectedFile" | :760F5F26 68F4A70E76 push 760EA7F4 :760F5F2B 6889040000 push 00000489 :760F5F30 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5F35 FF1580110E76 Call dword ptr [760E1180] :760F5F3B 85C0 test eax, eax :760F5F3D 0F840CEEFEFF je 760E4D4F :760F5F43 FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"File %s not in sfpdb" | :760F5F46 68DCA70E76 push 760EA7DC :760F5F4B EB27 jmp 760F5F74 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E4D49(C) | :760F5F4D 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CSfpDb::GetNextProtectedFile" | :760F5F4F 68F4A70E76 push 760EA7F4 :760F5F54 68A2040000 push 000004A2 :760F5F59 687CD90F76 push 760FD97C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5F5E FF1580110E76 Call dword ptr [760E1180] :760F5F64 85C0 test eax, eax :760F5F66 0F84E3EDFEFF je 760E4D4F :760F5F6C FF7508 push [ebp+08] * Possible StringData Ref from Code Obj ->"Got protected file %s" | :760F5F6F 68C4A70E76 push 760EA7C4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F5F4B(U) | :760F5F74 6801010000 push 00000101 :760F5F79 E8AD6FFFFF call 760ECF2B :760F5F7E 83C40C add esp, 0000000C :760F5F81 E9C9EDFEFF jmp 760E4D4F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1631(C) | :760F5F86 8B480C mov ecx, dword ptr [eax+0C] :760F5F89 50 push eax :760F5F8A 894E04 mov dword ptr [esi+04], ecx :760F5F8D E85DBAFEFF call 760E19EF :760F5F92 E995B6FEFF jmp 760E162C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E165E(C) | :760F5F97 8B08 mov ecx, dword ptr [eax] :760F5F99 50 push eax :760F5F9A 890E mov dword ptr [esi], ecx :760F5F9C E84EBAFEFF call 760E19EF :760F5FA1 E9B4B6FEFF jmp 760E165A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1AE0(C) | :760F5FA6 A184110E76 mov eax, dword ptr [760E1184] :760F5FAB 8418 test byte ptr [eax], bl :760F5FAD 0F84B3000000 je 760F6066 :760F5FB3 53 push ebx * Possible StringData Ref from Code Obj ->"SfpRpcServerThread" | :760F5FB4 68ACA80E76 push 760EA8AC :760F5FB9 6A3D push 0000003D * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\rpc\server\sfprpcs.cpp" | :760F5FBB 6850E00F76 push 760FE050 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5FC0 FF1580110E76 Call dword ptr [760E1180] :760F5FC6 85C0 test eax, eax :760F5FC8 0F8498000000 je 760F6066 :760F5FCE 56 push esi * Possible StringData Ref from Code Obj ->"Error %x: Cannot set protocol " ->"sequence" | :760F5FCF 6884A80E76 push 760EA884 :760F5FD4 E980000000 jmp 760F6059 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1AFA(C) | :760F5FD9 A184110E76 mov eax, dword ptr [760E1184] :760F5FDE 8418 test byte ptr [eax], bl :760F5FE0 0F8480000000 je 760F6066 :760F5FE6 53 push ebx * Possible StringData Ref from Code Obj ->"SfpRpcServerThread" | :760F5FE7 68ACA80E76 push 760EA8AC :760F5FEC 6A47 push 00000047 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\rpc\server\sfprpcs.cpp" | :760F5FEE 6850E00F76 push 760FE050 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F5FF3 FF1580110E76 Call dword ptr [760E1180] :760F5FF9 85C0 test eax, eax :760F5FFB 7469 je 760F6066 :760F5FFD 56 push esi * Possible StringData Ref from Code Obj ->"Error %x: Cannot register sfprpc " ->"interface" | :760F5FFE 6858A80E76 push 760EA858 :760F6003 EB54 jmp 760F6059 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1B0E(C) | :760F6005 A184110E76 mov eax, dword ptr [760E1184] :760F600A 8418 test byte ptr [eax], bl :760F600C 7458 je 760F6066 :760F600E 53 push ebx * Possible StringData Ref from Code Obj ->"SfpRpcServerThread" | :760F600F 68ACA80E76 push 760EA8AC :760F6014 6A51 push 00000051 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\rpc\server\sfprpcs.cpp" | :760F6016 6850E00F76 push 760FE050 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F601B FF1580110E76 Call dword ptr [760E1180] :760F6021 85C0 test eax, eax :760F6023 7441 je 760F6066 :760F6025 56 push esi * Possible StringData Ref from Code Obj ->"Error %x: Cannot register srrpc " ->"interface" | :760F6026 682CA80E76 push 760EA82C :760F602B EB2C jmp 760F6059 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1B1E(U) | :760F602D 8BF0 mov esi, eax :760F602F 3BF5 cmp esi, ebp :760F6031 7433 je 760F6066 :760F6033 A184110E76 mov eax, dword ptr [760E1184] :760F6038 8418 test byte ptr [eax], bl :760F603A 742A je 760F6066 :760F603C 53 push ebx * Possible StringData Ref from Code Obj ->"SfpRpcServerThread" | :760F603D 68ACA80E76 push 760EA8AC :760F6042 6A5B push 0000005B * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\rpc\server\sfprpcs.cpp" | :760F6044 6850E00F76 push 760FE050 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F6049 FF1580110E76 Call dword ptr [760E1180] :760F604F 85C0 test eax, eax :760F6051 7413 je 760F6066 :760F6053 56 push esi * Possible StringData Ref from Code Obj ->"Error %x: Listen failed" | :760F6054 6814A80E76 push 760EA814 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5FD4(U), :760F6003(U), :760F602B(U) | :760F6059 6802020000 push 00000202 :760F605E E8C86EFFFF call 760ECF2B :760F6063 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F5FAD(C), :760F5FC8(C), :760F5FE0(C), :760F5FFB(C), :760F600C(C) |:760F6023(C), :760F6031(C), :760F603A(C), :760F6051(C) | :760F6066 33C0 xor eax, eax :760F6068 3BF5 cmp esi, ebp :760F606A 5F pop edi :760F606B 5E pop esi :760F606C 5D pop ebp :760F606D 5B pop ebx :760F606E 0F94C0 sete al :760F6071 C20400 ret 0004 * Referenced by a CALL at Address: |:760ECD9A | :760F6074 56 push esi :760F6075 6A00 push 00000000 * Reference To: RPCRT4.RpcMgmtStopServerListening, Ord:016Dh | :760F6077 FF152C110E76 Call dword ptr [760E112C] :760F607D 8BF0 mov esi, eax :760F607F 85F6 test esi, esi :760F6081 742A je 760F60AD :760F6083 A184110E76 mov eax, dword ptr [760E1184] :760F6088 F60002 test byte ptr [eax], 02 :760F608B 7467 je 760F60F4 :760F608D 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"Shutdown" | :760F608F 6804A90E76 push 760EA904 :760F6094 6A71 push 00000071 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\rpc\server\sfprpcs.cpp" | :760F6096 6850E00F76 push 760FE050 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F609B FF1580110E76 Call dword ptr [760E1180] :760F60A1 85C0 test eax, eax :760F60A3 744F je 760F60F4 :760F60A5 56 push esi * Possible StringData Ref from Code Obj ->"Error %x: Stop listening failed" | :760F60A6 68E4A80E76 push 760EA8E4 :760F60AB EB3A jmp 760F60E7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6081(C) | :760F60AD 6A00 push 00000000 :760F60AF 6A00 push 00000000 :760F60B1 6A00 push 00000000 * Reference To: RPCRT4.RpcServerUnregisterIf, Ord:0189h | :760F60B3 FF1528110E76 Call dword ptr [760E1128] :760F60B9 8BF0 mov esi, eax :760F60BB 85F6 test esi, esi :760F60BD 7435 je 760F60F4 :760F60BF A184110E76 mov eax, dword ptr [760E1184] :760F60C4 F60002 test byte ptr [eax], 02 :760F60C7 742B je 760F60F4 :760F60C9 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"Shutdown" | :760F60CB 6804A90E76 push 760EA904 :760F60D0 6A79 push 00000079 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\rpc\server\sfprpcs.cpp" | :760F60D2 6850E00F76 push 760FE050 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F60D7 FF1580110E76 Call dword ptr [760E1180] :760F60DD 85C0 test eax, eax :760F60DF 7413 je 760F60F4 :760F60E1 56 push esi * Possible StringData Ref from Code Obj ->"Error %x: Unregister server failed" | :760F60E2 68C0A80E76 push 760EA8C0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F60AB(U) | :760F60E7 6802020000 push 00000202 :760F60EC E83A6EFFFF call 760ECF2B :760F60F1 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F608B(C), :760F60A3(C), :760F60BD(C), :760F60C7(C), :760F60DF(C) | :760F60F4 33C0 xor eax, eax :760F60F6 85F6 test esi, esi :760F60F8 0F94C0 sete al :760F60FB 5E pop esi :760F60FC C3 ret :760F60FD FF742404 push [esp+04] :760F6101 E82FB8FEFF call 760E1935 :760F6106 C20400 ret 0004 :760F6109 837C240400 cmp dword ptr [esp+04], 00000000 :760F610E 7409 je 760F6119 :760F6110 FF742404 push [esp+04] :760F6114 E8D6B8FEFF call 760E19EF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F610E(C) | :760F6119 C20400 ret 0004 :760F611C 55 push ebp :760F611D 8BEC mov ebp, esp :760F611F 6AFF push FFFFFFFF :760F6121 68B0A90E76 push 760EA9B0 :760F6126 68A6870F76 push 760F87A6 :760F612B 64A100000000 mov eax, dword ptr fs:[00000000] :760F6131 50 push eax :760F6132 64892500000000 mov dword ptr fs:[00000000], esp :760F6139 81ECE0000000 sub esp, 000000E0 :760F613F 53 push ebx :760F6140 56 push esi :760F6141 57 push edi :760F6142 6810A90E76 push 760EA910 :760F6147 8D8518FFFFFF lea eax, dword ptr [ebp+FFFFFF18] :760F614D 50 push eax :760F614E 8B7508 mov esi, dword ptr [ebp+08] :760F6151 56 push esi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760F6152 FF153C110E76 Call dword ptr [760E113C] :760F6158 33FF xor edi, edi :760F615A 897DE4 mov dword ptr [ebp-1C], edi :760F615D 897DE0 mov dword ptr [ebp-20], edi :760F6160 897DFC mov dword ptr [ebp-04], edi :760F6163 8B4604 mov eax, dword ptr [esi+04] :760F6166 25FFFF0000 and eax, 0000FFFF :760F616B 83F810 cmp eax, 00000010 :760F616E 7412 je 760F6182 :760F6170 6862A90E76 push 760EA962 :760F6175 8D8518FFFFFF lea eax, dword ptr [ebp+FFFFFF18] :760F617B 50 push eax * Reference To: RPCRT4.NdrConvert, Ord:00A4h | :760F617C FF151C110E76 Call dword ptr [760E111C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F616E(C) | :760F6182 57 push edi :760F6183 684E1C0E76 push 760E1C4E :760F6188 8D45E4 lea eax, dword ptr [ebp-1C] :760F618B 50 push eax :760F618C 8D8518FFFFFF lea eax, dword ptr [ebp+FFFFFF18] :760F6192 50 push eax * Reference To: RPCRT4.NdrConformantStringUnmarshall, Ord:0092h | :760F6193 FF1538110E76 Call dword ptr [760E1138] :760F6199 57 push edi :760F619A 68501C0E76 push 760E1C50 :760F619F 8D45E0 lea eax, dword ptr [ebp-20] :760F61A2 50 push eax :760F61A3 8D8518FFFFFF lea eax, dword ptr [ebp+FFFFFF18] :760F61A9 50 push eax * Reference To: RPCRT4.NdrPointerUnmarshall, Ord:00EFh | :760F61AA FF150C110E76 Call dword ptr [760E110C] :760F61B0 FF75E0 push [ebp-20] :760F61B3 FF75E4 push [ebp-1C] * Reference To: SfpDll.SfpInstallCatalogS | :760F61B6 E8A38BFFFF call 760EED5E :760F61BB 8BD8 mov ebx, eax :760F61BD 899D10FFFFFF mov dword ptr [ebp+FFFFFF10], ebx :760F61C3 6A04 push 00000004 :760F61C5 5F pop edi :760F61C6 89BD2CFFFFFF mov dword ptr [ebp+FFFFFF2C], edi :760F61CC 6A14 push 00000014 :760F61CE 58 pop eax :760F61CF 89852CFFFFFF mov dword ptr [ebp+FFFFFF2C], eax :760F61D5 89460C mov dword ptr [esi+0C], eax :760F61D8 56 push esi * Reference To: RPCRT4.I_RpcGetBuffer, Ord:002Dh | :760F61D9 FF1534110E76 Call dword ptr [760E1134] :760F61DF 898514FFFFFF mov dword ptr [ebp+FFFFFF14], eax :760F61E5 85C0 test eax, eax :760F61E7 7407 je 760F61F0 :760F61E9 50 push eax * Reference To: RPCRT4.RpcRaiseException, Ord:017Ah | :760F61EA FF1530110E76 Call dword ptr [760E1130] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F61E7(C) | :760F61F0 8B4608 mov eax, dword ptr [esi+08] :760F61F3 89851CFFFFFF mov dword ptr [ebp+FFFFFF1C], eax :760F61F9 8918 mov dword ptr [eax], ebx :760F61FB 8B851CFFFFFF mov eax, dword ptr [ebp+FFFFFF1C] :760F6201 03C7 add eax, edi :760F6203 89851CFFFFFF mov dword ptr [ebp+FFFFFF1C], eax :760F6209 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760F620D E820000000 call 760F6232 :760F6212 2B4608 sub eax, dword ptr [esi+08] :760F6215 89460C mov dword ptr [esi+0C], eax :760F6218 8B4DF0 mov ecx, dword ptr [ebp-10] :760F621B 64890D00000000 mov dword ptr fs:[00000000], ecx :760F6222 5F pop edi :760F6223 5E pop esi :760F6224 5B pop ebx :760F6225 C9 leave :760F6226 C20400 ret 0004 :760F6229 8B7508 mov esi, dword ptr [ebp+08] :760F622C 8B851CFFFFFF mov eax, dword ptr [ebp+FFFFFF1C] * Referenced by a CALL at Address: |:760F620D | :760F6232 C3 ret :760F6233 55 push ebp :760F6234 8BEC mov ebp, esp :760F6236 6AFF push FFFFFFFF :760F6238 68C0A90E76 push 760EA9C0 :760F623D 68A6870F76 push 760F87A6 :760F6242 64A100000000 mov eax, dword ptr fs:[00000000] :760F6248 50 push eax :760F6249 64892500000000 mov dword ptr fs:[00000000], esp :760F6250 81ECE0000000 sub esp, 000000E0 :760F6256 53 push ebx :760F6257 56 push esi :760F6258 57 push edi :760F6259 6810A90E76 push 760EA910 :760F625E 8D8518FFFFFF lea eax, dword ptr [ebp+FFFFFF18] :760F6264 50 push eax :760F6265 8B7508 mov esi, dword ptr [ebp+08] :760F6268 56 push esi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760F6269 FF153C110E76 Call dword ptr [760E113C] :760F626F 33FF xor edi, edi :760F6271 897DE0 mov dword ptr [ebp-20], edi :760F6274 897DFC mov dword ptr [ebp-04], edi :760F6277 8B4604 mov eax, dword ptr [esi+04] :760F627A 25FFFF0000 and eax, 0000FFFF :760F627F 83F810 cmp eax, 00000010 :760F6282 7412 je 760F6296 :760F6284 686CA90E76 push 760EA96C :760F6289 8D8518FFFFFF lea eax, dword ptr [ebp+FFFFFF18] :760F628F 50 push eax * Reference To: RPCRT4.NdrConvert, Ord:00A4h | :760F6290 FF151C110E76 Call dword ptr [760E111C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6282(C) | :760F6296 57 push edi :760F6297 684E1C0E76 push 760E1C4E :760F629C 8D45E0 lea eax, dword ptr [ebp-20] :760F629F 50 push eax :760F62A0 8D8518FFFFFF lea eax, dword ptr [ebp+FFFFFF18] :760F62A6 50 push eax * Reference To: RPCRT4.NdrConformantStringUnmarshall, Ord:0092h | :760F62A7 FF1538110E76 Call dword ptr [760E1138] :760F62AD 8B851CFFFFFF mov eax, dword ptr [ebp+FFFFFF1C] :760F62B3 83C003 add eax, 00000003 :760F62B6 24FC and al, FC :760F62B8 89851CFFFFFF mov dword ptr [ebp+FFFFFF1C], eax :760F62BE 8B08 mov ecx, dword ptr [eax] :760F62C0 894DE4 mov dword ptr [ebp-1C], ecx :760F62C3 6A04 push 00000004 :760F62C5 5F pop edi :760F62C6 03C7 add eax, edi :760F62C8 89851CFFFFFF mov dword ptr [ebp+FFFFFF1C], eax :760F62CE 51 push ecx :760F62CF FF75E0 push [ebp-20] * Reference To: SfpDll.SfpDeleteCatalogS | :760F62D2 E8B290FFFF call 760EF389 :760F62D7 8BD8 mov ebx, eax :760F62D9 899D10FFFFFF mov dword ptr [ebp+FFFFFF10], ebx :760F62DF 89BD2CFFFFFF mov dword ptr [ebp+FFFFFF2C], edi :760F62E5 6A14 push 00000014 :760F62E7 58 pop eax :760F62E8 89852CFFFFFF mov dword ptr [ebp+FFFFFF2C], eax :760F62EE 89460C mov dword ptr [esi+0C], eax :760F62F1 56 push esi * Reference To: RPCRT4.I_RpcGetBuffer, Ord:002Dh | :760F62F2 FF1534110E76 Call dword ptr [760E1134] :760F62F8 898514FFFFFF mov dword ptr [ebp+FFFFFF14], eax :760F62FE 85C0 test eax, eax :760F6300 7407 je 760F6309 :760F6302 50 push eax * Reference To: RPCRT4.RpcRaiseException, Ord:017Ah | :760F6303 FF1530110E76 Call dword ptr [760E1130] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6300(C) | :760F6309 8B4608 mov eax, dword ptr [esi+08] :760F630C 89851CFFFFFF mov dword ptr [ebp+FFFFFF1C], eax :760F6312 8918 mov dword ptr [eax], ebx :760F6314 8B851CFFFFFF mov eax, dword ptr [ebp+FFFFFF1C] :760F631A 03C7 add eax, edi :760F631C 89851CFFFFFF mov dword ptr [ebp+FFFFFF1C], eax :760F6322 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760F6326 E820000000 call 760F634B :760F632B 2B4608 sub eax, dword ptr [esi+08] :760F632E 89460C mov dword ptr [esi+0C], eax :760F6331 8B4DF0 mov ecx, dword ptr [ebp-10] :760F6334 64890D00000000 mov dword ptr fs:[00000000], ecx :760F633B 5F pop edi :760F633C 5E pop esi :760F633D 5B pop ebx :760F633E C9 leave :760F633F C20400 ret 0004 :760F6342 8B7508 mov esi, dword ptr [ebp+08] :760F6345 8B851CFFFFFF mov eax, dword ptr [ebp+FFFFFF1C] * Referenced by a CALL at Address: |:760F6326 | :760F634B C3 ret :760F634C 55 push ebp :760F634D 8BEC mov ebp, esp :760F634F 6AFF push FFFFFFFF :760F6351 68D0A90E76 push 760EA9D0 :760F6356 68A6870F76 push 760F87A6 :760F635B 64A100000000 mov eax, dword ptr fs:[00000000] :760F6361 50 push eax :760F6362 64892500000000 mov dword ptr fs:[00000000], esp :760F6369 81ECDC000000 sub esp, 000000DC :760F636F 53 push ebx :760F6370 56 push esi :760F6371 57 push edi :760F6372 6810A90E76 push 760EA910 :760F6377 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F637D 50 push eax :760F637E 8B7508 mov esi, dword ptr [ebp+08] :760F6381 56 push esi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760F6382 FF153C110E76 Call dword ptr [760E113C] :760F6388 33FF xor edi, edi :760F638A 897DE4 mov dword ptr [ebp-1C], edi :760F638D 897DFC mov dword ptr [ebp-04], edi :760F6390 8B4604 mov eax, dword ptr [esi+04] :760F6393 25FFFF0000 and eax, 0000FFFF :760F6398 83F810 cmp eax, 00000010 :760F639B 7412 je 760F63AF :760F639D 6874A90E76 push 760EA974 :760F63A2 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F63A8 50 push eax * Reference To: RPCRT4.NdrConvert, Ord:00A4h | :760F63A9 FF151C110E76 Call dword ptr [760E111C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F639B(C) | :760F63AF 57 push edi :760F63B0 684E1C0E76 push 760E1C4E :760F63B5 8D45E4 lea eax, dword ptr [ebp-1C] :760F63B8 50 push eax :760F63B9 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F63BF 50 push eax * Reference To: RPCRT4.NdrConformantStringUnmarshall, Ord:0092h | :760F63C0 FF1538110E76 Call dword ptr [760E1138] :760F63C6 FF75E4 push [ebp-1C] * Reference To: SfpDll.SfpIsFileProtectedS | :760F63C9 E878B9FEFF call 760E1D46 :760F63CE 8BD8 mov ebx, eax :760F63D0 899D14FFFFFF mov dword ptr [ebp+FFFFFF14], ebx :760F63D6 6A04 push 00000004 :760F63D8 5F pop edi :760F63D9 89BD30FFFFFF mov dword ptr [ebp+FFFFFF30], edi :760F63DF 6A14 push 00000014 :760F63E1 58 pop eax :760F63E2 898530FFFFFF mov dword ptr [ebp+FFFFFF30], eax :760F63E8 89460C mov dword ptr [esi+0C], eax :760F63EB 56 push esi * Reference To: RPCRT4.I_RpcGetBuffer, Ord:002Dh | :760F63EC FF1534110E76 Call dword ptr [760E1134] :760F63F2 898518FFFFFF mov dword ptr [ebp+FFFFFF18], eax :760F63F8 85C0 test eax, eax :760F63FA 7407 je 760F6403 :760F63FC 50 push eax * Reference To: RPCRT4.RpcRaiseException, Ord:017Ah | :760F63FD FF1530110E76 Call dword ptr [760E1130] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F63FA(C) | :760F6403 8B4608 mov eax, dword ptr [esi+08] :760F6406 898520FFFFFF mov dword ptr [ebp+FFFFFF20], eax :760F640C 8918 mov dword ptr [eax], ebx :760F640E 8B8520FFFFFF mov eax, dword ptr [ebp+FFFFFF20] :760F6414 03C7 add eax, edi :760F6416 898520FFFFFF mov dword ptr [ebp+FFFFFF20], eax :760F641C 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760F6420 E820000000 call 760F6445 :760F6425 2B4608 sub eax, dword ptr [esi+08] :760F6428 89460C mov dword ptr [esi+0C], eax :760F642B 8B4DF0 mov ecx, dword ptr [ebp-10] :760F642E 64890D00000000 mov dword ptr fs:[00000000], ecx :760F6435 5F pop edi :760F6436 5E pop esi :760F6437 5B pop ebx :760F6438 C9 leave :760F6439 C20400 ret 0004 :760F643C 8B7508 mov esi, dword ptr [ebp+08] :760F643F 8B8520FFFFFF mov eax, dword ptr [ebp+FFFFFF20] * Referenced by a CALL at Address: |:760F6420 | :760F6445 C3 ret :760F6446 55 push ebp :760F6447 8BEC mov ebp, esp :760F6449 6AFF push FFFFFFFF :760F644B 68E0A90E76 push 760EA9E0 :760F6450 68A6870F76 push 760F87A6 :760F6455 64A100000000 mov eax, dword ptr fs:[00000000] :760F645B 50 push eax :760F645C 64892500000000 mov dword ptr fs:[00000000], esp :760F6463 81ECDC000000 sub esp, 000000DC :760F6469 53 push ebx :760F646A 56 push esi :760F646B 57 push edi :760F646C 6810A90E76 push 760EA910 :760F6471 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F6477 50 push eax :760F6478 8B7D08 mov edi, dword ptr [ebp+08] :760F647B 57 push edi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760F647C FF153C110E76 Call dword ptr [760E113C] :760F6482 33F6 xor esi, esi :760F6484 89B51CFFFFFF mov dword ptr [ebp+FFFFFF1C], esi :760F648A 8975FC mov dword ptr [ebp-04], esi :760F648D 8B4704 mov eax, dword ptr [edi+04] :760F6490 25FFFF0000 and eax, 0000FFFF :760F6495 83F810 cmp eax, 00000010 :760F6498 7412 je 760F64AC :760F649A 687AA90E76 push 760EA97A :760F649F 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F64A5 50 push eax * Reference To: RPCRT4.NdrConvert, Ord:00A4h | :760F64A6 FF151C110E76 Call dword ptr [760E111C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6498(C) | :760F64AC 56 push esi :760F64AD BE5E1C0E76 mov esi, 760E1C5E :760F64B2 56 push esi :760F64B3 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F64B9 50 push eax :760F64BA 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F64C0 50 push eax * Reference To: RPCRT4.NdrSimpleStructUnmarshall, Ord:010Fh | :760F64C1 FF1548110E76 Call dword ptr [760E1148] :760F64C7 FFB51CFFFFFF push dword ptr [ebp+FFFFFF1C] * Reference To: SfpDll.SfpGetNextProtectedFileS | :760F64CD E8D181FFFF call 760EE6A3 :760F64D2 8BD8 mov ebx, eax :760F64D4 899D14FFFFFF mov dword ptr [ebp+FFFFFF14], ebx :760F64DA C78534FFFFFF0B000000 mov dword ptr [ebp+FFFFFF34], 0000000B :760F64E4 56 push esi :760F64E5 FFB51CFFFFFF push dword ptr [ebp+FFFFFF1C] :760F64EB 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F64F1 50 push eax * Reference To: RPCRT4.NdrSimpleStructBufferSize, Ord:010Bh | :760F64F2 FF1544110E76 Call dword ptr [760E1144] :760F64F8 838534FFFFFF10 add dword ptr [ebp+FFFFFF34], 00000010 :760F64FF 8B8534FFFFFF mov eax, dword ptr [ebp+FFFFFF34] :760F6505 89470C mov dword ptr [edi+0C], eax :760F6508 57 push edi * Reference To: RPCRT4.I_RpcGetBuffer, Ord:002Dh | :760F6509 FF1534110E76 Call dword ptr [760E1134] :760F650F 898518FFFFFF mov dword ptr [ebp+FFFFFF18], eax :760F6515 85C0 test eax, eax :760F6517 7407 je 760F6520 :760F6519 50 push eax * Reference To: RPCRT4.RpcRaiseException, Ord:017Ah | :760F651A FF1530110E76 Call dword ptr [760E1130] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6517(C) | :760F6520 8B4708 mov eax, dword ptr [edi+08] :760F6523 898524FFFFFF mov dword ptr [ebp+FFFFFF24], eax :760F6529 56 push esi :760F652A FFB51CFFFFFF push dword ptr [ebp+FFFFFF1C] :760F6530 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F6536 50 push eax * Reference To: RPCRT4.NdrSimpleStructMarshall, Ord:010Dh | :760F6537 FF1540110E76 Call dword ptr [760E1140] :760F653D 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] :760F6543 8918 mov dword ptr [eax], ebx :760F6545 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] :760F654B 83C004 add eax, 00000004 :760F654E 898524FFFFFF mov dword ptr [ebp+FFFFFF24], eax :760F6554 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760F6558 E820000000 call 760F657D :760F655D 2B4708 sub eax, dword ptr [edi+08] :760F6560 89470C mov dword ptr [edi+0C], eax :760F6563 8B4DF0 mov ecx, dword ptr [ebp-10] :760F6566 64890D00000000 mov dword ptr fs:[00000000], ecx :760F656D 5F pop edi :760F656E 5E pop esi :760F656F 5B pop ebx :760F6570 C9 leave :760F6571 C20400 ret 0004 :760F6574 8B7D08 mov edi, dword ptr [ebp+08] :760F6577 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] * Referenced by a CALL at Address: |:760F6558 | :760F657D C3 ret :760F657E 55 push ebp :760F657F 8BEC mov ebp, esp :760F6581 6AFF push FFFFFFFF :760F6583 68F0A90E76 push 760EA9F0 :760F6588 68A6870F76 push 760F87A6 :760F658D 64A100000000 mov eax, dword ptr fs:[00000000] :760F6593 50 push eax :760F6594 64892500000000 mov dword ptr fs:[00000000], esp :760F659B 81ECE4000000 sub esp, 000000E4 :760F65A1 53 push ebx :760F65A2 56 push esi :760F65A3 57 push edi :760F65A4 6810A90E76 push 760EA910 :760F65A9 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F65AF 50 push eax :760F65B0 8B7D08 mov edi, dword ptr [ebp+08] :760F65B3 57 push edi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760F65B4 FF153C110E76 Call dword ptr [760E113C] :760F65BA 33F6 xor esi, esi :760F65BC 8975E4 mov dword ptr [ebp-1C], esi :760F65BF 89B518FFFFFF mov dword ptr [ebp+FFFFFF18], esi :760F65C5 8975FC mov dword ptr [ebp-04], esi :760F65C8 8B4704 mov eax, dword ptr [edi+04] :760F65CB 25FFFF0000 and eax, 0000FFFF :760F65D0 83F810 cmp eax, 00000010 :760F65D3 7412 je 760F65E7 :760F65D5 6880A90E76 push 760EA980 :760F65DA 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F65E0 50 push eax * Reference To: RPCRT4.NdrConvert, Ord:00A4h | :760F65E1 FF151C110E76 Call dword ptr [760E111C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F65D3(C) | :760F65E7 56 push esi :760F65E8 684E1C0E76 push 760E1C4E :760F65ED 8D45E4 lea eax, dword ptr [ebp-1C] :760F65F0 50 push eax :760F65F1 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F65F7 50 push eax * Reference To: RPCRT4.NdrConformantStringUnmarshall, Ord:0092h | :760F65F8 FF1538110E76 Call dword ptr [760E1138] :760F65FE 8B8520FFFFFF mov eax, dword ptr [ebp+FFFFFF20] :760F6604 83C003 add eax, 00000003 :760F6607 24FC and al, FC :760F6609 898520FFFFFF mov dword ptr [ebp+FFFFFF20], eax :760F660F 8B18 mov ebx, dword ptr [eax] :760F6611 899D14FFFFFF mov dword ptr [ebp+FFFFFF14], ebx :760F6617 83C004 add eax, 00000004 :760F661A 898520FFFFFF mov dword ptr [ebp+FFFFFF20], eax :760F6620 BE00040000 mov esi, 00000400 :760F6625 56 push esi :760F6626 FF9564FFFFFF call dword ptr [ebp+FFFFFF64] :760F662C 898518FFFFFF mov dword ptr [ebp+FFFFFF18], eax :760F6632 53 push ebx :760F6633 50 push eax :760F6634 FF75E4 push [ebp-1C] * Reference To: SfpDll.SfpVerifyFileS | :760F6637 E8BF6EFFFF call 760ED4FB :760F663C 89850CFFFFFF mov dword ptr [ebp+FFFFFF0C], eax :760F6642 C78530FFFFFF17000000 mov dword ptr [ebp+FFFFFF30], 00000017 :760F664C 89B558FFFFFF mov dword ptr [ebp+FFFFFF58], esi * Possible StringData Ref from Code Obj ->""D@" | :760F6652 BB6C1C0E76 mov ebx, 760E1C6C :760F6657 53 push ebx :760F6658 FFB518FFFFFF push dword ptr [ebp+FFFFFF18] :760F665E 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F6664 50 push eax * Reference To: RPCRT4.NdrConformantStringBufferSize, Ord:008Fh | :760F6665 FF1518110E76 Call dword ptr [760E1118] :760F666B 838530FFFFFF10 add dword ptr [ebp+FFFFFF30], 00000010 :760F6672 8B8530FFFFFF mov eax, dword ptr [ebp+FFFFFF30] :760F6678 89470C mov dword ptr [edi+0C], eax :760F667B 57 push edi * Reference To: RPCRT4.I_RpcGetBuffer, Ord:002Dh | :760F667C FF1534110E76 Call dword ptr [760E1134] :760F6682 898510FFFFFF mov dword ptr [ebp+FFFFFF10], eax :760F6688 85C0 test eax, eax :760F668A 7407 je 760F6693 :760F668C 50 push eax * Reference To: RPCRT4.RpcRaiseException, Ord:017Ah | :760F668D FF1530110E76 Call dword ptr [760E1130] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F668A(C) | :760F6693 8B4708 mov eax, dword ptr [edi+08] :760F6696 898520FFFFFF mov dword ptr [ebp+FFFFFF20], eax :760F669C 89B558FFFFFF mov dword ptr [ebp+FFFFFF58], esi :760F66A2 53 push ebx :760F66A3 FFB518FFFFFF push dword ptr [ebp+FFFFFF18] :760F66A9 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F66AF 50 push eax * Reference To: RPCRT4.NdrConformantStringMarshall, Ord:0090h | :760F66B0 FF1550110E76 Call dword ptr [760E1150] :760F66B6 8B8520FFFFFF mov eax, dword ptr [ebp+FFFFFF20] :760F66BC 83C003 add eax, 00000003 :760F66BF 24FC and al, FC :760F66C1 898520FFFFFF mov dword ptr [ebp+FFFFFF20], eax :760F66C7 8B8D0CFFFFFF mov ecx, dword ptr [ebp+FFFFFF0C] :760F66CD 8908 mov dword ptr [eax], ecx :760F66CF 838520FFFFFF04 add dword ptr [ebp+FFFFFF20], 00000004 :760F66D6 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760F66DA E825000000 call 760F6704 :760F66DF 8B8520FFFFFF mov eax, dword ptr [ebp+FFFFFF20] :760F66E5 2B4708 sub eax, dword ptr [edi+08] :760F66E8 89470C mov dword ptr [edi+0C], eax :760F66EB 8B4DF0 mov ecx, dword ptr [ebp-10] :760F66EE 64890D00000000 mov dword ptr fs:[00000000], ecx :760F66F5 5F pop edi :760F66F6 5E pop esi :760F66F7 5B pop ebx :760F66F8 C9 leave :760F66F9 C20400 ret 0004 :760F66FC BE00040000 mov esi, 00000400 :760F6701 8B7D08 mov edi, dword ptr [ebp+08] * Referenced by a CALL at Address: |:760F66DA | :760F6704 89B558FFFFFF mov dword ptr [ebp+FFFFFF58], esi :760F670A 68681C0E76 push 760E1C68 :760F670F FFB518FFFFFF push dword ptr [ebp+FFFFFF18] :760F6715 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F671B 50 push eax * Reference To: RPCRT4.NdrPointerFree, Ord:00ECh | :760F671C FF154C110E76 Call dword ptr [760E114C] :760F6722 C3 ret :760F6723 55 push ebp :760F6724 8BEC mov ebp, esp :760F6726 6AFF push FFFFFFFF :760F6728 6800AA0E76 push 760EAA00 :760F672D 68A6870F76 push 760F87A6 :760F6732 64A100000000 mov eax, dword ptr fs:[00000000] :760F6738 50 push eax :760F6739 64892500000000 mov dword ptr fs:[00000000], esp :760F6740 81ECE0000000 sub esp, 000000E0 :760F6746 53 push ebx :760F6747 56 push esi :760F6748 57 push edi :760F6749 68F81B0E76 push 760E1BF8 :760F674E 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F6754 50 push eax :760F6755 8B7508 mov esi, dword ptr [ebp+08] :760F6758 56 push esi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760F6759 FF153C110E76 Call dword ptr [760E113C] :760F675F 8365E400 and dword ptr [ebp-1C], 00000000 :760F6763 8365FC00 and dword ptr [ebp-04], 00000000 :760F6767 8B4604 mov eax, dword ptr [esi+04] :760F676A 25FFFF0000 and eax, 0000FFFF :760F676F 83F810 cmp eax, 00000010 :760F6772 7412 je 760F6786 :760F6774 688CA90E76 push 760EA98C :760F6779 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F677F 50 push eax * Reference To: RPCRT4.NdrConvert, Ord:00A4h | :760F6780 FF151C110E76 Call dword ptr [760E111C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6772(C) | :760F6786 8B8520FFFFFF mov eax, dword ptr [ebp+FFFFFF20] :760F678C 8B18 mov ebx, dword ptr [eax] :760F678E 899D18FFFFFF mov dword ptr [ebp+FFFFFF18], ebx :760F6794 6A04 push 00000004 :760F6796 5F pop edi :760F6797 01BD20FFFFFF add dword ptr [ebp+FFFFFF20], edi :760F679D 6A00 push 00000000 :760F679F 684E1C0E76 push 760E1C4E :760F67A4 8D45E4 lea eax, dword ptr [ebp-1C] :760F67A7 50 push eax :760F67A8 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F67AE 50 push eax * Reference To: RPCRT4.NdrConformantStringUnmarshall, Ord:0092h | :760F67AF FF1538110E76 Call dword ptr [760E1138] :760F67B5 FF75E4 push [ebp-1C] :760F67B8 53 push ebx * Reference To: SfpDll.DisableSFPS | :760F67B9 E80F58FFFF call 760EBFCD :760F67BE 8BD8 mov ebx, eax :760F67C0 899D10FFFFFF mov dword ptr [ebp+FFFFFF10], ebx :760F67C6 89BD30FFFFFF mov dword ptr [ebp+FFFFFF30], edi :760F67CC 6A14 push 00000014 :760F67CE 58 pop eax :760F67CF 898530FFFFFF mov dword ptr [ebp+FFFFFF30], eax :760F67D5 89460C mov dword ptr [esi+0C], eax :760F67D8 56 push esi * Reference To: RPCRT4.I_RpcGetBuffer, Ord:002Dh | :760F67D9 FF1534110E76 Call dword ptr [760E1134] :760F67DF 898514FFFFFF mov dword ptr [ebp+FFFFFF14], eax :760F67E5 85C0 test eax, eax :760F67E7 7407 je 760F67F0 :760F67E9 50 push eax * Reference To: RPCRT4.RpcRaiseException, Ord:017Ah | :760F67EA FF1530110E76 Call dword ptr [760E1130] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F67E7(C) | :760F67F0 8B4608 mov eax, dword ptr [esi+08] :760F67F3 898520FFFFFF mov dword ptr [ebp+FFFFFF20], eax :760F67F9 8918 mov dword ptr [eax], ebx :760F67FB 8B8520FFFFFF mov eax, dword ptr [ebp+FFFFFF20] :760F6801 03C7 add eax, edi :760F6803 898520FFFFFF mov dword ptr [ebp+FFFFFF20], eax :760F6809 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760F680D E820000000 call 760F6832 :760F6812 2B4608 sub eax, dword ptr [esi+08] :760F6815 89460C mov dword ptr [esi+0C], eax :760F6818 8B4DF0 mov ecx, dword ptr [ebp-10] :760F681B 64890D00000000 mov dword ptr fs:[00000000], ecx :760F6822 5F pop edi :760F6823 5E pop esi :760F6824 5B pop ebx :760F6825 C9 leave :760F6826 C20400 ret 0004 :760F6829 8B7508 mov esi, dword ptr [ebp+08] :760F682C 8B8520FFFFFF mov eax, dword ptr [ebp+FFFFFF20] * Referenced by a CALL at Address: |:760F680D | :760F6832 C3 ret :760F6833 55 push ebp :760F6834 8BEC mov ebp, esp :760F6836 6AFF push FFFFFFFF :760F6838 6810AA0E76 push 760EAA10 :760F683D 68A6870F76 push 760F87A6 :760F6842 64A100000000 mov eax, dword ptr fs:[00000000] :760F6848 50 push eax :760F6849 64892500000000 mov dword ptr fs:[00000000], esp :760F6850 81ECDC000000 sub esp, 000000DC :760F6856 53 push ebx :760F6857 56 push esi :760F6858 57 push edi :760F6859 68F81B0E76 push 760E1BF8 :760F685E 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F6864 50 push eax :760F6865 8B7508 mov esi, dword ptr [ebp+08] :760F6868 56 push esi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760F6869 FF153C110E76 Call dword ptr [760E113C] :760F686F 8365FC00 and dword ptr [ebp-04], 00000000 :760F6873 8B4604 mov eax, dword ptr [esi+04] :760F6876 25FFFF0000 and eax, 0000FFFF :760F687B 83F810 cmp eax, 00000010 :760F687E 7412 je 760F6892 :760F6880 6894A90E76 push 760EA994 :760F6885 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F688B 50 push eax * Reference To: RPCRT4.NdrConvert, Ord:00A4h | :760F688C FF151C110E76 Call dword ptr [760E111C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F687E(C) | :760F6892 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] :760F6898 8B00 mov eax, dword ptr [eax] :760F689A 89851CFFFFFF mov dword ptr [ebp+FFFFFF1C], eax :760F68A0 6A04 push 00000004 :760F68A2 5F pop edi :760F68A3 01BD24FFFFFF add dword ptr [ebp+FFFFFF24], edi :760F68A9 50 push eax * Reference To: SMGR._DisableSRS@4, Ord:0022h | :760F68AA E8CB050000 Call 760F6E7A :760F68AF 8BD8 mov ebx, eax :760F68B1 899D14FFFFFF mov dword ptr [ebp+FFFFFF14], ebx :760F68B7 89BD34FFFFFF mov dword ptr [ebp+FFFFFF34], edi :760F68BD 897E0C mov dword ptr [esi+0C], edi :760F68C0 56 push esi * Reference To: RPCRT4.I_RpcGetBuffer, Ord:002Dh | :760F68C1 FF1534110E76 Call dword ptr [760E1134] :760F68C7 898518FFFFFF mov dword ptr [ebp+FFFFFF18], eax :760F68CD 85C0 test eax, eax :760F68CF 7407 je 760F68D8 :760F68D1 50 push eax * Reference To: RPCRT4.RpcRaiseException, Ord:017Ah | :760F68D2 FF1530110E76 Call dword ptr [760E1130] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F68CF(C) | :760F68D8 8B4608 mov eax, dword ptr [esi+08] :760F68DB 898524FFFFFF mov dword ptr [ebp+FFFFFF24], eax :760F68E1 8918 mov dword ptr [eax], ebx :760F68E3 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] :760F68E9 03C7 add eax, edi :760F68EB 898524FFFFFF mov dword ptr [ebp+FFFFFF24], eax :760F68F1 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760F68F5 E820000000 call 760F691A :760F68FA 2B4608 sub eax, dword ptr [esi+08] :760F68FD 89460C mov dword ptr [esi+0C], eax :760F6900 8B4DF0 mov ecx, dword ptr [ebp-10] :760F6903 64890D00000000 mov dword ptr fs:[00000000], ecx :760F690A 5F pop edi :760F690B 5E pop esi :760F690C 5B pop ebx :760F690D C9 leave :760F690E C20400 ret 0004 :760F6911 8B7508 mov esi, dword ptr [ebp+08] :760F6914 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] * Referenced by a CALL at Address: |:760F68F5 | :760F691A C3 ret :760F691B 55 push ebp :760F691C 8BEC mov ebp, esp :760F691E 6AFF push FFFFFFFF :760F6920 6820AA0E76 push 760EAA20 :760F6925 68A6870F76 push 760F87A6 :760F692A 64A100000000 mov eax, dword ptr fs:[00000000] :760F6930 50 push eax :760F6931 64892500000000 mov dword ptr fs:[00000000], esp :760F6938 81ECD8000000 sub esp, 000000D8 :760F693E 53 push ebx :760F693F 56 push esi :760F6940 57 push edi :760F6941 68F81B0E76 push 760E1BF8 :760F6946 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F694C 50 push eax :760F694D 8B7508 mov esi, dword ptr [ebp+08] :760F6950 56 push esi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760F6951 FF153C110E76 Call dword ptr [760E113C] :760F6957 8365FC00 and dword ptr [ebp-04], 00000000 * Reference To: SMGR._IsSREnabledS@0, Ord:0038h | :760F695B E820050000 Call 760F6E80 :760F6960 8BD8 mov ebx, eax :760F6962 899D18FFFFFF mov dword ptr [ebp+FFFFFF18], ebx :760F6968 6A04 push 00000004 :760F696A 5F pop edi :760F696B 89BD34FFFFFF mov dword ptr [ebp+FFFFFF34], edi :760F6971 897E0C mov dword ptr [esi+0C], edi :760F6974 56 push esi * Reference To: RPCRT4.I_RpcGetBuffer, Ord:002Dh | :760F6975 FF1534110E76 Call dword ptr [760E1134] :760F697B 89851CFFFFFF mov dword ptr [ebp+FFFFFF1C], eax :760F6981 85C0 test eax, eax :760F6983 7407 je 760F698C :760F6985 50 push eax * Reference To: RPCRT4.RpcRaiseException, Ord:017Ah | :760F6986 FF1530110E76 Call dword ptr [760E1130] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6983(C) | :760F698C 8B4608 mov eax, dword ptr [esi+08] :760F698F 898524FFFFFF mov dword ptr [ebp+FFFFFF24], eax :760F6995 8918 mov dword ptr [eax], ebx :760F6997 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] :760F699D 03C7 add eax, edi :760F699F 898524FFFFFF mov dword ptr [ebp+FFFFFF24], eax :760F69A5 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760F69A9 E820000000 call 760F69CE :760F69AE 2B4608 sub eax, dword ptr [esi+08] :760F69B1 89460C mov dword ptr [esi+0C], eax :760F69B4 8B4DF0 mov ecx, dword ptr [ebp-10] :760F69B7 64890D00000000 mov dword ptr fs:[00000000], ecx :760F69BE 5F pop edi :760F69BF 5E pop esi :760F69C0 5B pop ebx :760F69C1 C9 leave :760F69C2 C20400 ret 0004 :760F69C5 8B7508 mov esi, dword ptr [ebp+08] :760F69C8 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] * Referenced by a CALL at Address: |:760F69A9 | :760F69CE C3 ret :760F69CF 55 push ebp :760F69D0 8BEC mov ebp, esp :760F69D2 6AFF push FFFFFFFF :760F69D4 6830AA0E76 push 760EAA30 :760F69D9 68A6870F76 push 760F87A6 :760F69DE 64A100000000 mov eax, dword ptr fs:[00000000] :760F69E4 50 push eax :760F69E5 64892500000000 mov dword ptr fs:[00000000], esp :760F69EC 81ECDC000000 sub esp, 000000DC :760F69F2 53 push ebx :760F69F3 56 push esi :760F69F4 57 push edi :760F69F5 68F81B0E76 push 760E1BF8 :760F69FA 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F6A00 50 push eax :760F6A01 8B7508 mov esi, dword ptr [ebp+08] :760F6A04 56 push esi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760F6A05 FF153C110E76 Call dword ptr [760E113C] :760F6A0B 8365FC00 and dword ptr [ebp-04], 00000000 :760F6A0F 8B4604 mov eax, dword ptr [esi+04] :760F6A12 25FFFF0000 and eax, 0000FFFF :760F6A17 83F810 cmp eax, 00000010 :760F6A1A 7412 je 760F6A2E :760F6A1C 6894A90E76 push 760EA994 :760F6A21 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F6A27 50 push eax * Reference To: RPCRT4.NdrConvert, Ord:00A4h | :760F6A28 FF151C110E76 Call dword ptr [760E111C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6A1A(C) | :760F6A2E 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] :760F6A34 8B00 mov eax, dword ptr [eax] :760F6A36 898514FFFFFF mov dword ptr [ebp+FFFFFF14], eax :760F6A3C 6A04 push 00000004 :760F6A3E 5F pop edi :760F6A3F 01BD24FFFFFF add dword ptr [ebp+FFFFFF24], edi :760F6A45 50 push eax * Reference To: SMGR._SetStateMgrDiskMaxS@4, Ord:0042h | :760F6A46 E83B040000 Call 760F6E86 :760F6A4B 8BD8 mov ebx, eax :760F6A4D 899D18FFFFFF mov dword ptr [ebp+FFFFFF18], ebx :760F6A53 89BD34FFFFFF mov dword ptr [ebp+FFFFFF34], edi :760F6A59 897E0C mov dword ptr [esi+0C], edi :760F6A5C 56 push esi * Reference To: RPCRT4.I_RpcGetBuffer, Ord:002Dh | :760F6A5D FF1534110E76 Call dword ptr [760E1134] :760F6A63 89851CFFFFFF mov dword ptr [ebp+FFFFFF1C], eax :760F6A69 85C0 test eax, eax :760F6A6B 7407 je 760F6A74 :760F6A6D 50 push eax * Reference To: RPCRT4.RpcRaiseException, Ord:017Ah | :760F6A6E FF1530110E76 Call dword ptr [760E1130] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6A6B(C) | :760F6A74 8B4608 mov eax, dword ptr [esi+08] :760F6A77 898524FFFFFF mov dword ptr [ebp+FFFFFF24], eax :760F6A7D 8918 mov dword ptr [eax], ebx :760F6A7F 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] :760F6A85 03C7 add eax, edi :760F6A87 898524FFFFFF mov dword ptr [ebp+FFFFFF24], eax :760F6A8D 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760F6A91 E820000000 call 760F6AB6 :760F6A96 2B4608 sub eax, dword ptr [esi+08] :760F6A99 89460C mov dword ptr [esi+0C], eax :760F6A9C 8B4DF0 mov ecx, dword ptr [ebp-10] :760F6A9F 64890D00000000 mov dword ptr fs:[00000000], ecx :760F6AA6 5F pop edi :760F6AA7 5E pop esi :760F6AA8 5B pop ebx :760F6AA9 C9 leave :760F6AAA C20400 ret 0004 :760F6AAD 8B7508 mov esi, dword ptr [ebp+08] :760F6AB0 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] * Referenced by a CALL at Address: |:760F6A91 | :760F6AB6 C3 ret :760F6AB7 55 push ebp :760F6AB8 8BEC mov ebp, esp :760F6ABA 6AFF push FFFFFFFF :760F6ABC 6840AA0E76 push 760EAA40 :760F6AC1 68A6870F76 push 760F87A6 :760F6AC6 64A100000000 mov eax, dword ptr fs:[00000000] :760F6ACC 50 push eax :760F6ACD 64892500000000 mov dword ptr fs:[00000000], esp :760F6AD4 81ECD8000000 sub esp, 000000D8 :760F6ADA 53 push ebx :760F6ADB 56 push esi :760F6ADC 57 push edi :760F6ADD 68F81B0E76 push 760E1BF8 :760F6AE2 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F6AE8 50 push eax :760F6AE9 8B7508 mov esi, dword ptr [ebp+08] :760F6AEC 56 push esi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760F6AED FF153C110E76 Call dword ptr [760E113C] :760F6AF3 8365FC00 and dword ptr [ebp-04], 00000000 * Reference To: SMGR._GetStateMgrDiskMaxS@0, Ord:002Eh | :760F6AF7 E890030000 Call 760F6E8C :760F6AFC 8BD8 mov ebx, eax :760F6AFE 899D18FFFFFF mov dword ptr [ebp+FFFFFF18], ebx :760F6B04 6A04 push 00000004 :760F6B06 5F pop edi :760F6B07 89BD34FFFFFF mov dword ptr [ebp+FFFFFF34], edi :760F6B0D 897E0C mov dword ptr [esi+0C], edi :760F6B10 56 push esi * Reference To: RPCRT4.I_RpcGetBuffer, Ord:002Dh | :760F6B11 FF1534110E76 Call dword ptr [760E1134] :760F6B17 89851CFFFFFF mov dword ptr [ebp+FFFFFF1C], eax :760F6B1D 85C0 test eax, eax :760F6B1F 7407 je 760F6B28 :760F6B21 50 push eax * Reference To: RPCRT4.RpcRaiseException, Ord:017Ah | :760F6B22 FF1530110E76 Call dword ptr [760E1130] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6B1F(C) | :760F6B28 8B4608 mov eax, dword ptr [esi+08] :760F6B2B 898524FFFFFF mov dword ptr [ebp+FFFFFF24], eax :760F6B31 8918 mov dword ptr [eax], ebx :760F6B33 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] :760F6B39 03C7 add eax, edi :760F6B3B 898524FFFFFF mov dword ptr [ebp+FFFFFF24], eax :760F6B41 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760F6B45 E820000000 call 760F6B6A :760F6B4A 2B4608 sub eax, dword ptr [esi+08] :760F6B4D 89460C mov dword ptr [esi+0C], eax :760F6B50 8B4DF0 mov ecx, dword ptr [ebp-10] :760F6B53 64890D00000000 mov dword ptr fs:[00000000], ecx :760F6B5A 5F pop edi :760F6B5B 5E pop esi :760F6B5C 5B pop ebx :760F6B5D C9 leave :760F6B5E C20400 ret 0004 :760F6B61 8B7508 mov esi, dword ptr [ebp+08] :760F6B64 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] * Referenced by a CALL at Address: |:760F6B45 | :760F6B6A C3 ret :760F6B6B 55 push ebp :760F6B6C 8BEC mov ebp, esp :760F6B6E 6AFF push FFFFFFFF :760F6B70 6850AA0E76 push 760EAA50 :760F6B75 68A6870F76 push 760F87A6 :760F6B7A 64A100000000 mov eax, dword ptr fs:[00000000] :760F6B80 50 push eax :760F6B81 64892500000000 mov dword ptr fs:[00000000], esp :760F6B88 81ECDC000000 sub esp, 000000DC :760F6B8E 53 push ebx :760F6B8F 56 push esi :760F6B90 57 push edi :760F6B91 68F81B0E76 push 760E1BF8 :760F6B96 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F6B9C 50 push eax :760F6B9D 8B7508 mov esi, dword ptr [ebp+08] :760F6BA0 56 push esi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760F6BA1 FF153C110E76 Call dword ptr [760E113C] :760F6BA7 33FF xor edi, edi :760F6BA9 89BD1CFFFFFF mov dword ptr [ebp+FFFFFF1C], edi :760F6BAF 897DFC mov dword ptr [ebp-04], edi :760F6BB2 8B4604 mov eax, dword ptr [esi+04] :760F6BB5 25FFFF0000 and eax, 0000FFFF :760F6BBA 83F810 cmp eax, 00000010 :760F6BBD 7412 je 760F6BD1 :760F6BBF 6874A90E76 push 760EA974 :760F6BC4 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F6BCA 50 push eax * Reference To: RPCRT4.NdrConvert, Ord:00A4h | :760F6BCB FF151C110E76 Call dword ptr [760E111C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6BBD(C) | :760F6BD1 57 push edi :760F6BD2 684E1C0E76 push 760E1C4E :760F6BD7 8D851CFFFFFF lea eax, dword ptr [ebp+FFFFFF1C] :760F6BDD 50 push eax :760F6BDE 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F6BE4 50 push eax * Reference To: RPCRT4.NdrConformantStringUnmarshall, Ord:0092h | :760F6BE5 FF1538110E76 Call dword ptr [760E1138] :760F6BEB FFB51CFFFFFF push dword ptr [ebp+FFFFFF1C] * Reference To: SfpDll.SRUpdateMonitoredListS | :760F6BF1 E8ED59FFFF call 760EC5E3 :760F6BF6 8BD8 mov ebx, eax :760F6BF8 899D14FFFFFF mov dword ptr [ebp+FFFFFF14], ebx :760F6BFE 6A04 push 00000004 :760F6C00 5F pop edi :760F6C01 89BD34FFFFFF mov dword ptr [ebp+FFFFFF34], edi :760F6C07 6A14 push 00000014 :760F6C09 58 pop eax :760F6C0A 898534FFFFFF mov dword ptr [ebp+FFFFFF34], eax :760F6C10 89460C mov dword ptr [esi+0C], eax :760F6C13 56 push esi * Reference To: RPCRT4.I_RpcGetBuffer, Ord:002Dh | :760F6C14 FF1534110E76 Call dword ptr [760E1134] :760F6C1A 898518FFFFFF mov dword ptr [ebp+FFFFFF18], eax :760F6C20 85C0 test eax, eax :760F6C22 7407 je 760F6C2B :760F6C24 50 push eax * Reference To: RPCRT4.RpcRaiseException, Ord:017Ah | :760F6C25 FF1530110E76 Call dword ptr [760E1130] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6C22(C) | :760F6C2B 8B4608 mov eax, dword ptr [esi+08] :760F6C2E 898524FFFFFF mov dword ptr [ebp+FFFFFF24], eax :760F6C34 8918 mov dword ptr [eax], ebx :760F6C36 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] :760F6C3C 03C7 add eax, edi :760F6C3E 898524FFFFFF mov dword ptr [ebp+FFFFFF24], eax :760F6C44 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760F6C48 E820000000 call 760F6C6D :760F6C4D 2B4608 sub eax, dword ptr [esi+08] :760F6C50 89460C mov dword ptr [esi+0C], eax :760F6C53 8B4DF0 mov ecx, dword ptr [ebp-10] :760F6C56 64890D00000000 mov dword ptr fs:[00000000], ecx :760F6C5D 5F pop edi :760F6C5E 5E pop esi :760F6C5F 5B pop ebx :760F6C60 C9 leave :760F6C61 C20400 ret 0004 :760F6C64 8B7508 mov esi, dword ptr [ebp+08] :760F6C67 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] * Referenced by a CALL at Address: |:760F6C48 | :760F6C6D C3 ret :760F6C6E 55 push ebp :760F6C6F 8BEC mov ebp, esp :760F6C71 6AFF push FFFFFFFF :760F6C73 6860AA0E76 push 760EAA60 :760F6C78 68A6870F76 push 760F87A6 :760F6C7D 64A100000000 mov eax, dword ptr fs:[00000000] :760F6C83 50 push eax :760F6C84 64892500000000 mov dword ptr fs:[00000000], esp :760F6C8B 81ECEC000000 sub esp, 000000EC :760F6C91 53 push ebx :760F6C92 56 push esi :760F6C93 57 push edi :760F6C94 68F81B0E76 push 760E1BF8 :760F6C99 8D850CFFFFFF lea eax, dword ptr [ebp+FFFFFF0C] :760F6C9F 50 push eax :760F6CA0 8B7508 mov esi, dword ptr [ebp+08] :760F6CA3 56 push esi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760F6CA4 FF153C110E76 Call dword ptr [760E113C] :760F6CAA 33FF xor edi, edi :760F6CAC 897DE0 mov dword ptr [ebp-20], edi :760F6CAF 897DE4 mov dword ptr [ebp-1C], edi :760F6CB2 897DFC mov dword ptr [ebp-04], edi :760F6CB5 8B4604 mov eax, dword ptr [esi+04] :760F6CB8 25FFFF0000 and eax, 0000FFFF :760F6CBD 83F810 cmp eax, 00000010 :760F6CC0 7412 je 760F6CD4 :760F6CC2 689AA90E76 push 760EA99A :760F6CC7 8D850CFFFFFF lea eax, dword ptr [ebp+FFFFFF0C] :760F6CCD 50 push eax * Reference To: RPCRT4.NdrConvert, Ord:00A4h | :760F6CCE FF151C110E76 Call dword ptr [760E111C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6CC0(C) | :760F6CD4 57 push edi :760F6CD5 68721C0E76 push 760E1C72 :760F6CDA 8D45E0 lea eax, dword ptr [ebp-20] :760F6CDD 50 push eax :760F6CDE 8D850CFFFFFF lea eax, dword ptr [ebp+FFFFFF0C] :760F6CE4 50 push eax * Reference To: RPCRT4.NdrPointerUnmarshall, Ord:00EFh | :760F6CE5 FF150C110E76 Call dword ptr [760E110C] :760F6CEB 8D45D4 lea eax, dword ptr [ebp-2C] :760F6CEE 8945E4 mov dword ptr [ebp-1C], eax :760F6CF1 8D45D4 lea eax, dword ptr [ebp-2C] :760F6CF4 50 push eax :760F6CF5 FF75E0 push [ebp-20] * Reference To: SMGR._SRSetRestorePointS@8, Ord:0040h | :760F6CF8 E895010000 Call 760F6E92 :760F6CFD 8BD8 mov ebx, eax :760F6CFF 899D04FFFFFF mov dword ptr [ebp+FFFFFF04], ebx :760F6D05 C78520FFFFFF0B000000 mov dword ptr [ebp+FFFFFF20], 0000000B :760F6D0F BF8C1C0E76 mov edi, 760E1C8C :760F6D14 57 push edi :760F6D15 8D45D4 lea eax, dword ptr [ebp-2C] :760F6D18 50 push eax :760F6D19 8D850CFFFFFF lea eax, dword ptr [ebp+FFFFFF0C] :760F6D1F 50 push eax * Reference To: RPCRT4.NdrComplexStructBufferSize, Ord:0085h | :760F6D20 FF1554110E76 Call dword ptr [760E1154] :760F6D26 838520FFFFFF10 add dword ptr [ebp+FFFFFF20], 00000010 :760F6D2D 8B8520FFFFFF mov eax, dword ptr [ebp+FFFFFF20] :760F6D33 89460C mov dword ptr [esi+0C], eax :760F6D36 56 push esi * Reference To: RPCRT4.I_RpcGetBuffer, Ord:002Dh | :760F6D37 FF1534110E76 Call dword ptr [760E1134] :760F6D3D 898508FFFFFF mov dword ptr [ebp+FFFFFF08], eax :760F6D43 85C0 test eax, eax :760F6D45 7407 je 760F6D4E :760F6D47 50 push eax * Reference To: RPCRT4.RpcRaiseException, Ord:017Ah | :760F6D48 FF1530110E76 Call dword ptr [760E1130] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6D45(C) | :760F6D4E 8B4608 mov eax, dword ptr [esi+08] :760F6D51 898510FFFFFF mov dword ptr [ebp+FFFFFF10], eax :760F6D57 57 push edi :760F6D58 8D45D4 lea eax, dword ptr [ebp-2C] :760F6D5B 50 push eax :760F6D5C 8D850CFFFFFF lea eax, dword ptr [ebp+FFFFFF0C] :760F6D62 50 push eax * Reference To: RPCRT4.NdrComplexStructMarshall, Ord:0087h | :760F6D63 FF1514110E76 Call dword ptr [760E1114] :760F6D69 8B8510FFFFFF mov eax, dword ptr [ebp+FFFFFF10] :760F6D6F 83C003 add eax, 00000003 :760F6D72 24FC and al, FC :760F6D74 898510FFFFFF mov dword ptr [ebp+FFFFFF10], eax :760F6D7A 8918 mov dword ptr [eax], ebx :760F6D7C 838510FFFFFF04 add dword ptr [ebp+FFFFFF10], 00000004 :760F6D83 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760F6D87 E820000000 call 760F6DAC :760F6D8C 8B8510FFFFFF mov eax, dword ptr [ebp+FFFFFF10] :760F6D92 2B4608 sub eax, dword ptr [esi+08] :760F6D95 89460C mov dword ptr [esi+0C], eax :760F6D98 8B4DF0 mov ecx, dword ptr [ebp-10] :760F6D9B 64890D00000000 mov dword ptr fs:[00000000], ecx :760F6DA2 5F pop edi :760F6DA3 5E pop esi :760F6DA4 5B pop ebx :760F6DA5 C9 leave :760F6DA6 C20400 ret 0004 :760F6DA9 8B7508 mov esi, dword ptr [ebp+08] * Referenced by a CALL at Address: |:760F6D87 | :760F6DAC 68881C0E76 push 760E1C88 :760F6DB1 FF75E4 push [ebp-1C] :760F6DB4 8D850CFFFFFF lea eax, dword ptr [ebp+FFFFFF0C] :760F6DBA 50 push eax * Reference To: RPCRT4.NdrPointerFree, Ord:00ECh | :760F6DBB FF154C110E76 Call dword ptr [760E114C] :760F6DC1 C3 ret :760F6DC2 55 push ebp :760F6DC3 8BEC mov ebp, esp :760F6DC5 6AFF push FFFFFFFF :760F6DC7 6870AA0E76 push 760EAA70 :760F6DCC 68A6870F76 push 760F87A6 :760F6DD1 64A100000000 mov eax, dword ptr fs:[00000000] :760F6DD7 50 push eax :760F6DD8 64892500000000 mov dword ptr fs:[00000000], esp :760F6DDF 81ECDC000000 sub esp, 000000DC :760F6DE5 53 push ebx :760F6DE6 56 push esi :760F6DE7 57 push edi :760F6DE8 68F81B0E76 push 760E1BF8 :760F6DED 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F6DF3 50 push eax :760F6DF4 8B7508 mov esi, dword ptr [ebp+08] :760F6DF7 56 push esi * Reference To: RPCRT4.NdrServerInitializeNew, Ord:0106h | :760F6DF8 FF153C110E76 Call dword ptr [760E113C] :760F6DFE 8365FC00 and dword ptr [ebp-04], 00000000 :760F6E02 8B4604 mov eax, dword ptr [esi+04] :760F6E05 25FFFF0000 and eax, 0000FFFF :760F6E0A 83F810 cmp eax, 00000010 :760F6E0D 7412 je 760F6E21 :760F6E0F 68A4A90E76 push 760EA9A4 :760F6E14 8D8520FFFFFF lea eax, dword ptr [ebp+FFFFFF20] :760F6E1A 50 push eax * Reference To: RPCRT4.NdrConvert, Ord:00A4h | :760F6E1B FF151C110E76 Call dword ptr [760E111C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6E0D(C) | :760F6E21 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] :760F6E27 8B08 mov ecx, dword ptr [eax] :760F6E29 898D18FFFFFF mov dword ptr [ebp+FFFFFF18], ecx :760F6E2F 8B5004 mov edx, dword ptr [eax+04] :760F6E32 89951CFFFFFF mov dword ptr [ebp+FFFFFF1C], edx :760F6E38 83C008 add eax, 00000008 :760F6E3B 898524FFFFFF mov dword ptr [ebp+FFFFFF24], eax :760F6E41 52 push edx :760F6E42 51 push ecx * Reference To: SMGR._DisableFIFOS@8, Ord:0021h | :760F6E43 E850000000 Call 760F6E98 :760F6E48 834DFCFF or dword ptr [ebp-04], FFFFFFFF :760F6E4C E820000000 call 760F6E71 :760F6E51 8B8524FFFFFF mov eax, dword ptr [ebp+FFFFFF24] :760F6E57 2B4608 sub eax, dword ptr [esi+08] :760F6E5A 89460C mov dword ptr [esi+0C], eax :760F6E5D 8B4DF0 mov ecx, dword ptr [ebp-10] :760F6E60 64890D00000000 mov dword ptr fs:[00000000], ecx :760F6E67 5F pop edi :760F6E68 5E pop esi :760F6E69 5B pop ebx :760F6E6A C9 leave :760F6E6B C20400 ret 0004 :760F6E6E 8B7508 mov esi, dword ptr [ebp+08] * Referenced by a CALL at Address: |:760F6E4C | :760F6E71 C3 ret :760F6E72 8B7508 mov esi, dword ptr [ebp+08] :760F6E75 E971ADFEFF jmp 760E1BEB * Referenced by a CALL at Address: |:760F68AA | * Reference To: SMGR._DisableSRS@4, Ord:0022h | :760F6E7A FF2564110E76 Jmp dword ptr [760E1164] * Referenced by a CALL at Address: |:760F695B | * Reference To: SMGR._IsSREnabledS@0, Ord:0038h | :760F6E80 FF2568110E76 Jmp dword ptr [760E1168] * Referenced by a CALL at Address: |:760F6A46 | * Reference To: SMGR._SetStateMgrDiskMaxS@4, Ord:0042h | :760F6E86 FF2570110E76 Jmp dword ptr [760E1170] * Referenced by a CALL at Address: |:760F6AF7 | * Reference To: SMGR._GetStateMgrDiskMaxS@0, Ord:002Eh | :760F6E8C FF2560110E76 Jmp dword ptr [760E1160] * Referenced by a CALL at Address: |:760F6CF8 | * Reference To: SMGR._SRSetRestorePointS@8, Ord:0040h | :760F6E92 FF255C110E76 Jmp dword ptr [760E115C] * Referenced by a CALL at Address: |:760F6E43 | * Reference To: SMGR._DisableFIFOS@8, Ord:0021h | :760F6E98 FF2578110E76 Jmp dword ptr [760E1178] * Referenced by a CALL at Address: |:760EC62C | :760F6E9E 56 push esi :760F6E9F 8BF1 mov esi, ecx :760F6EA1 57 push edi :760F6EA2 8D4E14 lea ecx, dword ptr [esi+14] :760F6EA5 E852CFFEFF call 760E3DFC :760F6EAA 33FF xor edi, edi :760F6EAC C70680AA0E76 mov dword ptr [esi], 760EAA80 :760F6EB2 57 push edi :760F6EB3 6800001000 push 00100000 :760F6EB8 57 push edi :760F6EB9 897E10 mov dword ptr [esi+10], edi :760F6EBC 897E0C mov dword ptr [esi+0C], edi :760F6EBF 897E08 mov dword ptr [esi+08], edi :760F6EC2 897E04 mov dword ptr [esi+04], edi :760F6EC5 897E58 mov dword ptr [esi+58], edi :760F6EC8 C6465C69 mov [esi+5C], 69 * Reference To: KERNEL32.HeapCreate, Ord:01B6h | :760F6ECC FF1514120E76 Call dword ptr [760E1214] :760F6ED2 3BC7 cmp eax, edi :760F6ED4 894660 mov dword ptr [esi+60], eax :760F6ED7 7509 jne 760F6EE2 * Reference To: KERNEL32.GetProcessHeap, Ord:0155h | :760F6ED9 FF15F8110E76 Call dword ptr [760E11F8] :760F6EDF 894660 mov dword ptr [esi+60], eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6ED7(C) | :760F6EE2 8BC6 mov eax, esi :760F6EE4 5F pop edi :760F6EE5 5E pop esi :760F6EE6 C3 ret :760F6EE7 56 push esi :760F6EE8 8BF1 mov esi, ecx :760F6EEA E814000000 call 760F6F03 :760F6EEF F644240801 test [esp+08], 01 :760F6EF4 7407 je 760F6EFD :760F6EF6 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F6EF7 E84FAAFEFF Call 760E194B :760F6EFC 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6EF4(C) | :760F6EFD 8BC6 mov eax, esi :760F6EFF 5E pop esi :760F6F00 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760EC8AB , :760F6EEA | :760F6F03 56 push esi :760F6F04 8BF1 mov esi, ecx :760F6F06 57 push edi :760F6F07 8B7E60 mov edi, dword ptr [esi+60] :760F6F0A C70680AA0E76 mov dword ptr [esi], 760EAA80 * Reference To: KERNEL32.GetProcessHeap, Ord:0155h | :760F6F10 FF15F8110E76 Call dword ptr [760E11F8] :760F6F16 3BF8 cmp edi, eax :760F6F18 7407 je 760F6F21 :760F6F1A 57 push edi * Reference To: KERNEL32.HeapDestroy, Ord:01B8h | :760F6F1B FF1510120E76 Call dword ptr [760E1210] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6F18(C) | :760F6F21 8D4E14 lea ecx, dword ptr [esi+14] :760F6F24 E811B4FEFF call 760E233A :760F6F29 5F pop edi :760F6F2A 5E pop esi :760F6F2B C3 ret * Referenced by a CALL at Address: |:760F6F99 | :760F6F2C 53 push ebx :760F6F2D 56 push esi :760F6F2E 8B74240C mov esi, dword ptr [esp+0C] :760F6F32 8BD9 mov ebx, ecx :760F6F34 85F6 test esi, esi :760F6F36 7429 je 760F6F61 :760F6F38 55 push ebp * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760F6F39 8B2DFC110E76 mov ebp, dword ptr [760E11FC] :760F6F3F 57 push edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6F5D(C) | :760F6F40 8B06 mov eax, dword ptr [esi] :760F6F42 85C0 test eax, eax :760F6F44 7408 je 760F6F4E :760F6F46 50 push eax :760F6F47 6A00 push 00000000 :760F6F49 FF7360 push [ebx+60] :760F6F4C FFD5 call ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6F44(C) | :760F6F4E 8B7E08 mov edi, dword ptr [esi+08] :760F6F51 56 push esi :760F6F52 6A00 push 00000000 :760F6F54 FF7360 push [ebx+60] :760F6F57 FFD5 call ebp :760F6F59 85FF test edi, edi :760F6F5B 8BF7 mov esi, edi :760F6F5D 75E1 jne 760F6F40 :760F6F5F 5F pop edi :760F6F60 5D pop ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6F36(C) | :760F6F61 6A01 push 00000001 :760F6F63 58 pop eax :760F6F64 5E pop esi :760F6F65 5B pop ebx :760F6F66 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760F6FA8 , :760F6FB7 , :760F755D , :760F7B8E , :760F7BB9 | :760F6F69 56 push esi :760F6F6A 8B742408 mov esi, dword ptr [esp+08] :760F6F6E 57 push edi :760F6F6F 8BF9 mov edi, ecx :760F6F71 85F6 test esi, esi :760F6F73 7505 jne 760F6F7A :760F6F75 6A01 push 00000001 :760F6F77 58 pop eax :760F6F78 EB4E jmp 760F6FC8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6F73(C) | :760F6F7A 8B06 mov eax, dword ptr [esi] :760F6F7C 53 push ebx * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760F6F7D 8B1DFC110E76 mov ebx, dword ptr [760E11FC] :760F6F83 85C0 test eax, eax :760F6F85 7408 je 760F6F8F :760F6F87 50 push eax :760F6F88 6A00 push 00000000 :760F6F8A FF7760 push [edi+60] :760F6F8D FFD3 call ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6F85(C) | :760F6F8F 8B4608 mov eax, dword ptr [esi+08] :760F6F92 85C0 test eax, eax :760F6F94 7408 je 760F6F9E :760F6F96 50 push eax :760F6F97 8BCF mov ecx, edi :760F6F99 E88EFFFFFF call 760F6F2C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6F94(C) | :760F6F9E 8B4618 mov eax, dword ptr [esi+18] :760F6FA1 85C0 test eax, eax :760F6FA3 7408 je 760F6FAD :760F6FA5 50 push eax :760F6FA6 8BCF mov ecx, edi :760F6FA8 E8BCFFFFFF call 760F6F69 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6FA3(C) | :760F6FAD 8B461C mov eax, dword ptr [esi+1C] :760F6FB0 85C0 test eax, eax :760F6FB2 7408 je 760F6FBC :760F6FB4 50 push eax :760F6FB5 8BCF mov ecx, edi :760F6FB7 E8ADFFFFFF call 760F6F69 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6FB2(C) | :760F6FBC 56 push esi :760F6FBD 6A00 push 00000000 :760F6FBF FF7760 push [edi+60] :760F6FC2 FFD3 call ebx :760F6FC4 6A01 push 00000001 :760F6FC6 58 pop eax :760F6FC7 5B pop ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6F78(U) | :760F6FC8 5F pop edi :760F6FC9 5E pop esi :760F6FCA C20400 ret 0004 * Referenced by a CALL at Address: |:760F72BE | :760F6FCD 55 push ebp :760F6FCE 8BEC mov ebp, esp :760F6FD0 53 push ebx :760F6FD1 56 push esi :760F6FD2 57 push edi :760F6FD3 8BF1 mov esi, ecx :760F6FD5 6A28 push 00000028 :760F6FD7 6A00 push 00000000 :760F6FD9 FF7660 push [esi+60] * Reference To: KERNEL32.HeapAlloc, Ord:01B4h | :760F6FDC FF15EC110E76 Call dword ptr [760E11EC] :760F6FE2 8BD8 mov ebx, eax :760F6FE4 85DB test ebx, ebx :760F6FE6 7431 je 760F7019 :760F6FE8 6A0A push 0000000A :760F6FEA 33C0 xor eax, eax :760F6FEC 59 pop ecx :760F6FED 8BFB mov edi, ebx :760F6FEF F3 repz :760F6FF0 AB stosd :760F6FF1 8B7D08 mov edi, dword ptr [ebp+08] :760F6FF4 83C9FF or ecx, FFFFFFFF :760F6FF7 F2 repnz :760F6FF8 AE scasb :760F6FF9 FF7508 push [ebp+08] :760F6FFC F7D1 not ecx :760F6FFE 49 dec ecx :760F6FFF 8BF9 mov edi, ecx :760F7001 8BCE mov ecx, esi :760F7003 E8F80B0000 call 760F7C00 :760F7008 85C0 test eax, eax :760F700A 8903 mov dword ptr [ebx], eax :760F700C 750F jne 760F701D :760F700E 53 push ebx :760F700F 50 push eax :760F7010 FF7660 push [esi+60] * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760F7013 FF15FC110E76 Call dword ptr [760E11FC] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F6FE6(C) | :760F7019 33C0 xor eax, eax :760F701B EB24 jmp 760F7041 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F700C(C) | :760F701D 8A450C mov al, byte ptr [ebp+0C] :760F7020 884304 mov byte ptr [ebx+04], al :760F7023 8B4604 mov eax, dword ptr [esi+04] :760F7026 894320 mov dword ptr [ebx+20], eax :760F7029 8B4510 mov eax, dword ptr [ebp+10] :760F702C FF4604 inc [esi+04] :760F702F 017E10 add dword ptr [esi+10], edi :760F7032 85C0 test eax, eax :760F7034 7403 je 760F7039 :760F7036 894314 mov dword ptr [ebx+14], eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7034(C) | :760F7039 8B4514 mov eax, dword ptr [ebp+14] :760F703C 894324 mov dword ptr [ebx+24], eax :760F703F 8BC3 mov eax, ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F701B(U) | :760F7041 5F pop edi :760F7042 5E pop esi :760F7043 5B pop ebx :760F7044 5D pop ebp :760F7045 C21000 ret 0010 * Referenced by a CALL at Address: |:760F706E | :760F7048 6A0C push 0000000C :760F704A 6A00 push 00000000 :760F704C FF7160 push [ecx+60] * Reference To: KERNEL32.HeapAlloc, Ord:01B4h | :760F704F FF15EC110E76 Call dword ptr [760E11EC] :760F7055 8BC8 mov ecx, eax :760F7057 85C9 test ecx, ecx :760F7059 7501 jne 760F705C :760F705B C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7059(C) | :760F705C 57 push edi :760F705D 33C0 xor eax, eax :760F705F 8BF9 mov edi, ecx :760F7061 AB stosd :760F7062 8BC1 mov eax, ecx :760F7064 5F pop edi :760F7065 C3 ret * Referenced by a CALL at Address: |:760F71E4 | :760F7066 55 push ebp :760F7067 8BEC mov ebp, esp :760F7069 53 push ebx :760F706A 56 push esi :760F706B 57 push edi :760F706C 8BF1 mov esi, ecx :760F706E E8D5FFFFFF call 760F7048 :760F7073 8BD8 mov ebx, eax :760F7075 85DB test ebx, ebx :760F7077 753A jne 760F70B3 :760F7079 A184110E76 mov eax, dword ptr [760E1184] :760F707E F60002 test byte ptr [eax], 02 :760F7081 0F848A000000 je 760F7111 :760F7087 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::AddFileToList" | :760F7089 689CAA0E76 push 760EAA9C :760F708E 6831010000 push 00000131 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F7093 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7098 FF1580110E76 Call dword ptr [760E1180] :760F709E 85C0 test eax, eax :760F70A0 746F je 760F7111 :760F70A2 53 push ebx :760F70A3 6884AA0E76 push 760EAA84 :760F70A8 56 push esi :760F70A9 E87D5EFFFF call 760ECF2B :760F70AE 83C40C add esp, 0000000C :760F70B1 EB5E jmp 760F7111 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7077(C) | :760F70B3 8B7D10 mov edi, dword ptr [ebp+10] :760F70B6 83C9FF or ecx, FFFFFFFF :760F70B9 33C0 xor eax, eax :760F70BB FF7510 push [ebp+10] :760F70BE F2 repnz :760F70BF AE scasb :760F70C0 F7D1 not ecx :760F70C2 49 dec ecx :760F70C3 8BF9 mov edi, ecx :760F70C5 8BCE mov ecx, esi :760F70C7 E8340B0000 call 760F7C00 :760F70CC 85C0 test eax, eax :760F70CE 7545 jne 760F7115 :760F70D0 A184110E76 mov eax, dword ptr [760E1184] :760F70D5 F60002 test byte ptr [eax], 02 :760F70D8 742B je 760F7105 :760F70DA 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::AddFileToList" | :760F70DC 689CAA0E76 push 760EAA9C :760F70E1 683A010000 push 0000013A * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F70E6 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F70EB FF1580110E76 Call dword ptr [760E1180] :760F70F1 85C0 test eax, eax :760F70F3 7410 je 760F7105 :760F70F5 6A00 push 00000000 :760F70F7 6884AA0E76 push 760EAA84 :760F70FC 56 push esi :760F70FD E8295EFFFF call 760ECF2B :760F7102 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F70D8(C), :760F70F3(C) | :760F7105 53 push ebx :760F7106 6A00 push 00000000 :760F7108 FF7660 push [esi+60] * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760F710B FF15FC110E76 Call dword ptr [760E11FC] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7081(C), :760F70A0(C), :760F70B1(U) | :760F7111 33C0 xor eax, eax :760F7113 EB2C jmp 760F7141 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F70CE(C) | :760F7115 8B4D0C mov ecx, dword ptr [ebp+0C] :760F7118 8903 mov dword ptr [ebx], eax :760F711A 8A4514 mov al, byte ptr [ebp+14] :760F711D 884304 mov byte ptr [ebx+04], al :760F7120 833900 cmp dword ptr [ecx], 00000000 :760F7123 7503 jne 760F7128 :760F7125 FF4608 inc [esi+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7123(C) | :760F7128 8B4508 mov eax, dword ptr [ebp+08] :760F712B FF460C inc [esi+0C] :760F712E 017E10 add dword ptr [esi+10], edi :760F7131 6A01 push 00000001 :760F7133 FF400C inc [eax+0C] :760F7136 017810 add dword ptr [eax+10], edi :760F7139 8B01 mov eax, dword ptr [ecx] :760F713B 894308 mov dword ptr [ebx+08], eax :760F713E 8919 mov dword ptr [ecx], ebx :760F7140 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7113(U) | :760F7141 5F pop edi :760F7142 5E pop esi :760F7143 5B pop ebx :760F7144 5D pop ebp :760F7145 C21000 ret 0010 * Referenced by a CALL at Addresses: |:760F72A2 , :760F735E , :760F74C6 , :760F7694 , :760F7752 | :760F7148 55 push ebp :760F7149 8BEC mov ebp, esp :760F714B 81EC14010000 sub esp, 00000114 :760F7151 53 push ebx :760F7152 56 push esi :760F7153 8B7514 mov esi, dword ptr [ebp+14] :760F7156 57 push edi :760F7157 8B7D18 mov edi, dword ptr [ebp+18] :760F715A 33DB xor ebx, ebx :760F715C 3BFE cmp edi, esi :760F715E 894DFC mov dword ptr [ebp-04], ecx :760F7161 895DF0 mov dword ptr [ebp-10], ebx :760F7164 0F841A010000 je 760F7284 :760F716A 6A5C push 0000005C :760F716C 8D85ECFEFFFF lea eax, dword ptr [ebp+FFFFFEEC] :760F7172 57 push edi :760F7173 50 push eax :760F7174 FF750C push [ebp+0C] :760F7177 895DF8 mov dword ptr [ebp-08], ebx :760F717A 895DF4 mov dword ptr [ebp-0C], ebx :760F717D 895D18 mov dword ptr [ebp+18], ebx :760F7180 E8ECE3FEFF call 760E5571 :760F7185 85C0 test eax, eax :760F7187 7538 jne 760F71C1 :760F7189 A184110E76 mov eax, dword ptr [760E1184] :760F718E F60002 test byte ptr [eax], 02 :760F7191 0F8407020000 je 760F739E :760F7197 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::AddTreeNode" | :760F7199 6840AB0E76 push 760EAB40 :760F719E 688F010000 push 0000018F * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F71A3 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F71A8 FF1580110E76 Call dword ptr [760E1180] :760F71AE 85C0 test eax, eax :760F71B0 0F84E8010000 je 760F739E :760F71B6 53 push ebx * Possible StringData Ref from Code Obj ->"Error extracting path element." | :760F71B7 6820AB0E76 push 760EAB20 :760F71BC E9D2010000 jmp 760F7393 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7187(C) | :760F71C1 8D46FF lea eax, dword ptr [esi-01] :760F71C4 3BF8 cmp edi, eax :760F71C6 7561 jne 760F7229 :760F71C8 395D1C cmp dword ptr [ebp+1C], ebx :760F71CB 745C je 760F7229 :760F71CD 8B4508 mov eax, dword ptr [ebp+08] :760F71D0 FF7510 push [ebp+10] :760F71D3 8D8DECFEFFFF lea ecx, dword ptr [ebp+FFFFFEEC] :760F71D9 8B00 mov eax, dword ptr [eax] :760F71DB 51 push ecx :760F71DC 8D4808 lea ecx, dword ptr [eax+08] :760F71DF 51 push ecx :760F71E0 8B4DFC mov ecx, dword ptr [ebp-04] :760F71E3 50 push eax :760F71E4 E87DFEFFFF call 760F7066 :760F71E9 85C0 test eax, eax :760F71EB 0F8593000000 jne 760F7284 :760F71F1 A184110E76 mov eax, dword ptr [760E1184] :760F71F6 F60002 test byte ptr [eax], 02 :760F71F9 0F849F010000 je 760F739E :760F71FF 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::AddTreeNode" | :760F7201 6840AB0E76 push 760EAB40 :760F7206 6898010000 push 00000198 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F720B 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7210 FF1580110E76 Call dword ptr [760E1180] :760F7216 85C0 test eax, eax :760F7218 0F8480010000 je 760F739E :760F721E 53 push ebx * Possible StringData Ref from Code Obj ->"Error adding a file to the filelist." | :760F721F 68F8AA0E76 push 760EAAF8 :760F7224 E96A010000 jmp 760F7393 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F71C6(C), :760F71CB(C) | :760F7229 8B7508 mov esi, dword ptr [ebp+08] :760F722C 8B06 mov eax, dword ptr [esi] :760F722E 3BC3 cmp eax, ebx :760F7230 747A je 760F72AC :760F7232 3BFB cmp edi, ebx :760F7234 7403 je 760F7239 :760F7236 8B4018 mov eax, dword ptr [eax+18] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7234(C), :760F725E(U) | :760F7239 3BC3 cmp eax, ebx :760F723B 894518 mov dword ptr [ebp+18], eax :760F723E 746C je 760F72AC :760F7240 8D8DECFEFFFF lea ecx, dword ptr [ebp+FFFFFEEC] :760F7246 51 push ecx :760F7247 FF30 push dword ptr [eax] * Reference To: MSVCRT._stricmp, Ord:01BEh | :760F7249 FF1534100E76 Call dword ptr [760E1034] :760F724F 59 pop ecx :760F7250 85C0 test eax, eax :760F7252 59 pop ecx :760F7253 740B je 760F7260 :760F7255 8B4518 mov eax, dword ptr [ebp+18] :760F7258 8945F4 mov dword ptr [ebp-0C], eax :760F725B 8B401C mov eax, dword ptr [eax+1C] :760F725E EBD9 jmp 760F7239 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7253(C) | :760F7260 8B4510 mov eax, dword ptr [ebp+10] :760F7263 3C73 cmp al, 73 :760F7265 7506 jne 760F726D :760F7267 8B4D18 mov ecx, dword ptr [ebp+18] :760F726A 884104 mov byte ptr [ecx+04], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7265(C) | :760F726D 8B4D14 mov ecx, dword ptr [ebp+14] :760F7270 49 dec ecx :760F7271 3BF9 cmp edi, ecx :760F7273 7517 jne 760F728C :760F7275 8B4D18 mov ecx, dword ptr [ebp+18] :760F7278 884104 mov byte ptr [ecx+04], al :760F727B 8B4D18 mov ecx, dword ptr [ebp+18] :760F727E 8B4520 mov eax, dword ptr [ebp+20] :760F7281 894124 mov dword ptr [ecx+24], eax * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7164(C), :760F71EB(C) | :760F7284 6A01 push 00000001 :760F7286 58 pop eax :760F7287 E915010000 jmp 760F73A1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7273(C) | :760F728C FF7520 push [ebp+20] :760F728F 47 inc edi :760F7290 8B4DFC mov ecx, dword ptr [ebp-04] :760F7293 FF751C push [ebp+1C] :760F7296 57 push edi :760F7297 FF7514 push [ebp+14] :760F729A 50 push eax :760F729B 8D4518 lea eax, dword ptr [ebp+18] :760F729E FF750C push [ebp+0C] :760F72A1 50 push eax :760F72A2 E8A1FEFFFF call 760F7148 :760F72A7 E9F5000000 jmp 760F73A1 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7230(C), :760F723E(C) | :760F72AC FF7520 push [ebp+20] :760F72AF 8B4DFC mov ecx, dword ptr [ebp-04] :760F72B2 8D85ECFEFFFF lea eax, dword ptr [ebp+FFFFFEEC] :760F72B8 FF36 push dword ptr [esi] :760F72BA FF7510 push [ebp+10] :760F72BD 50 push eax :760F72BE E80AFDFFFF call 760F6FCD :760F72C3 3BC3 cmp eax, ebx :760F72C5 8945F8 mov dword ptr [ebp-08], eax :760F72C8 7538 jne 760F7302 :760F72CA A184110E76 mov eax, dword ptr [760E1184] :760F72CF F60002 test byte ptr [eax], 02 :760F72D2 0F84C6000000 je 760F739E :760F72D8 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::AddTreeNode" | :760F72DA 6840AB0E76 push 760EAB40 :760F72DF 68D6010000 push 000001D6 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F72E4 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F72E9 FF1580110E76 Call dword ptr [760E1180] :760F72EF 85C0 test eax, eax :760F72F1 0F84A7000000 je 760F739E :760F72F7 53 push ebx :760F72F8 6884AA0E76 push 760EAA84 :760F72FD E991000000 jmp 760F7393 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F72C8(C) | :760F7302 8B4D14 mov ecx, dword ptr [ebp+14] :760F7305 49 dec ecx :760F7306 3BF9 cmp edi, ecx :760F7308 7418 je 760F7322 :760F730A 807D1073 cmp byte ptr [ebp+10], 73 :760F730E 7506 jne 760F7316 :760F7310 C6400473 mov [eax+04], 73 :760F7314 EB03 jmp 760F7319 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F730E(C) | :760F7316 885804 mov byte ptr [eax+04], bl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7314(U) | :760F7319 8B45F8 mov eax, dword ptr [ebp-08] :760F731C 895824 mov dword ptr [eax+24], ebx :760F731F 8B45F8 mov eax, dword ptr [ebp-08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7308(C) | :760F7322 8B0E mov ecx, dword ptr [esi] :760F7324 3BCB cmp ecx, ebx :760F7326 7504 jne 760F732C :760F7328 8906 mov dword ptr [esi], eax :760F732A EB1A jmp 760F7346 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7326(C) | :760F732C 395918 cmp dword ptr [ecx+18], ebx :760F732F 7505 jne 760F7336 :760F7331 894118 mov dword ptr [ecx+18], eax :760F7334 EB10 jmp 760F7346 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F732F(C) | :760F7336 8B4DF4 mov ecx, dword ptr [ebp-0C] :760F7339 3BCB cmp ecx, ebx :760F733B 742B je 760F7368 :760F733D 89411C mov dword ptr [ecx+1C], eax :760F7340 8B45F8 mov eax, dword ptr [ebp-08] :760F7343 89581C mov dword ptr [eax+1C], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F732A(U), :760F7334(U) | :760F7346 FF7520 push [ebp+20] :760F7349 47 inc edi :760F734A 8B4DFC mov ecx, dword ptr [ebp-04] :760F734D 8D45F8 lea eax, dword ptr [ebp-08] :760F7350 FF751C push [ebp+1C] :760F7353 57 push edi :760F7354 FF7514 push [ebp+14] :760F7357 FF7510 push [ebp+10] :760F735A FF750C push [ebp+0C] :760F735D 50 push eax :760F735E E8E5FDFFFF call 760F7148 :760F7363 8945F0 mov dword ptr [ebp-10], eax :760F7366 EB36 jmp 760F739E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F733B(C) | :760F7368 A184110E76 mov eax, dword ptr [760E1184] :760F736D F60002 test byte ptr [eax], 02 :760F7370 742C je 760F739E :760F7372 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::AddTreeNode" | :760F7374 6840AB0E76 push 760EAB40 :760F7379 6805020000 push 00000205 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F737E 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7383 FF1580110E76 Call dword ptr [760E1180] :760F7389 85C0 test eax, eax :760F738B 7411 je 760F739E :760F738D 53 push ebx * Possible StringData Ref from Code Obj ->"Uxpected error condition in AddTreeNode: " ->"no link determined" | :760F738E 68BCAA0E76 push 760EAABC * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F71BC(U), :760F7224(U), :760F72FD(U) | :760F7393 FF75FC push [ebp-04] :760F7396 E8905BFFFF call 760ECF2B :760F739B 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7191(C), :760F71B0(C), :760F71F9(C), :760F7218(C), :760F72D2(C) |:760F72F1(C), :760F7366(U), :760F7370(C), :760F738B(C) | :760F739E 8B45F0 mov eax, dword ptr [ebp-10] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7287(U), :760F72A7(U) | :760F73A1 5F pop edi :760F73A2 5E pop esi :760F73A3 5B pop ebx :760F73A4 C9 leave :760F73A5 C21C00 ret 001C * Referenced by a CALL at Addresses: |:760F7643 , :760F7702 | :760F73A8 55 push ebp :760F73A9 8BEC mov ebp, esp :760F73AB 81EC14090000 sub esp, 00000914 :760F73B1 53 push ebx :760F73B2 56 push esi :760F73B3 8D85ECFEFFFF lea eax, dword ptr [ebp+FFFFFEEC] :760F73B9 57 push edi :760F73BA 50 push eax :760F73BB 8BD9 mov ebx, ecx :760F73BD 6804010000 push 00000104 * Reference To: KERNEL32.GetLogicalDriveStringsA, Ord:0132h | :760F73C2 FF15AC110E76 Call dword ptr [760E11AC] :760F73C8 85C0 test eax, eax :760F73CA 8945F4 mov dword ptr [ebp-0C], eax :760F73CD 7540 jne 760F740F * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F73CF FF15A0110E76 Call dword ptr [760E11A0] :760F73D5 8BF0 mov esi, eax :760F73D7 A184110E76 mov eax, dword ptr [760E1184] :760F73DC F60002 test byte ptr [eax], 02 :760F73DF 0F8435010000 je 760F751A :760F73E5 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"AddMetaDriveFileDir" | :760F73E7 6898AB0E76 push 760EAB98 :760F73EC 6832020000 push 00000232 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F73F1 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F73F6 FF1580110E76 Call dword ptr [760E1180] :760F73FC 85C0 test eax, eax :760F73FE 0F8416010000 je 760F751A :760F7404 56 push esi * Possible StringData Ref from Code Obj ->"GetLogicalDriveStrings failed; " ->"hr=0x%x" | :760F7405 68608C0E76 push 760E8C60 :760F740A E902010000 jmp 760F7511 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F73CD(C) | :760F740F 33F6 xor esi, esi :760F7411 85C0 test eax, eax :760F7413 0F86C2000000 jbe 760F74DB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F74D5(C) | :760F7419 33C9 xor ecx, ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F742C(U) | :760F741B 8A8435ECFEFFFF mov al, byte ptr [ebp+esi-00000114] :760F7422 84C0 test al, al :760F7424 7408 je 760F742E :760F7426 88440DF8 mov byte ptr [ebp+ecx-08], al :760F742A 41 inc ecx :760F742B 46 inc esi :760F742C EBED jmp 760F741B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7424(C) | :760F742E 80640DF800 and byte ptr [ebp+ecx-08], 00 :760F7433 8D45F8 lea eax, dword ptr [ebp-08] :760F7436 46 inc esi :760F7437 50 push eax :760F7438 8975F0 mov dword ptr [ebp-10], esi * Reference To: KERNEL32.GetDriveTypeA, Ord:0117h | :760F743B FF15B0110E76 Call dword ptr [760E11B0] :760F7441 83F803 cmp eax, 00000003 :760F7444 0F8588000000 jne 760F74D2 :760F744A 8B7D08 mov edi, dword ptr [ebp+08] :760F744D 83C9FF or ecx, FFFFFFFF :760F7450 33C0 xor eax, eax :760F7452 8D95ECFAFFFF lea edx, dword ptr [ebp+FFFFFAEC] :760F7458 F2 repnz :760F7459 AE scasb :760F745A F7D1 not ecx :760F745C 2BF9 sub edi, ecx :760F745E 8BC1 mov eax, ecx :760F7460 8BF7 mov esi, edi :760F7462 8BFA mov edi, edx :760F7464 C1E902 shr ecx, 02 :760F7467 F3 repz :760F7468 A5 movsd :760F7469 8BC8 mov ecx, eax :760F746B 0FBE45F8 movsx eax, byte ptr [ebp-08] :760F746F 83E103 and ecx, 00000003 :760F7472 50 push eax :760F7473 F3 repz :760F7474 A4 movsb * Reference To: USER32.CharUpperA, Ord:002Fh | :760F7475 FF1594120E76 Call dword ptr [760E1294] :760F747B 8885ECFAFFFF mov byte ptr [ebp+FFFFFAEC], al :760F7481 8D85ECFAFFFF lea eax, dword ptr [ebp+FFFFFAEC] :760F7487 50 push eax :760F7488 8D85ECF6FFFF lea eax, dword ptr [ebp+FFFFF6EC] * Possible StringData Ref from Code Obj ->"vxdRoot\%s" | :760F748E 688CAB0E76 push 760EAB8C :760F7493 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760F7494 FF1530100E76 Call dword ptr [760E1030] :760F749A 83C40C add esp, 0000000C :760F749D 8D85ECF6FFFF lea eax, dword ptr [ebp+FFFFF6EC] :760F74A3 8BCB mov ecx, ebx :760F74A5 6A5C push 0000005C :760F74A7 50 push eax :760F74A8 E830070000 call 760F7BDD :760F74AD FF7514 push [ebp+14] :760F74B0 8BCB mov ecx, ebx :760F74B2 FF7510 push [ebp+10] :760F74B5 6A00 push 00000000 :760F74B7 50 push eax :760F74B8 FF750C push [ebp+0C] :760F74BB 8D85ECF6FFFF lea eax, dword ptr [ebp+FFFFF6EC] :760F74C1 50 push eax :760F74C2 8D4358 lea eax, dword ptr [ebx+58] :760F74C5 50 push eax :760F74C6 E87DFCFFFF call 760F7148 :760F74CB 85C0 test eax, eax :760F74CD 7416 je 760F74E5 :760F74CF 8B75F0 mov esi, dword ptr [ebp-10] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7444(C) | :760F74D2 3B75F4 cmp esi, dword ptr [ebp-0C] :760F74D5 0F823EFFFFFF jb 760F7419 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7413(C) | :760F74DB 6A01 push 00000001 :760F74DD 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F751C(U) | :760F74DE 5F pop edi :760F74DF 5E pop esi :760F74E0 5B pop ebx :760F74E1 C9 leave :760F74E2 C21000 ret 0010 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F74CD(C) | :760F74E5 A184110E76 mov eax, dword ptr [760E1184] :760F74EA F60002 test byte ptr [eax], 02 :760F74ED 742B je 760F751A :760F74EF 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"AddMetaDriveFileDir" | :760F74F1 6898AB0E76 push 760EAB98 :760F74F6 6853020000 push 00000253 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F74FB 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7500 FF1580110E76 Call dword ptr [760E1180] :760F7506 85C0 test eax, eax :760F7508 7410 je 760F751A :760F750A 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error adding tree node in metadrive " ->"fileadd." | :760F750C 685CAB0E76 push 760EAB5C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F740A(U) | :760F7511 53 push ebx :760F7512 E8145AFFFF call 760ECF2B :760F7517 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F73DF(C), :760F73FE(C), :760F74ED(C), :760F7508(C) | :760F751A 33C0 xor eax, eax :760F751C EBC0 jmp 760F74DE * Referenced by a CALL at Address: |:760EC7C2 | :760F751E 55 push ebp :760F751F 8BEC mov ebp, esp :760F7521 81EC7C080000 sub esp, 0000087C :760F7527 53 push ebx :760F7528 56 push esi :760F7529 8BF1 mov esi, ecx :760F752B 57 push edi :760F752C 8D4D8C lea ecx, dword ptr [ebp-74] :760F752F FF7660 push [esi+60] :760F7532 E8E0070000 call 760F7D17 :760F7537 FF7660 push [esi+60] :760F753A 8D4DB8 lea ecx, dword ptr [ebp-48] :760F753D E8910C0000 call 760F81D3 :760F7542 8B4658 mov eax, dword ptr [esi+58] :760F7545 33DB xor ebx, ebx :760F7547 3BC3 cmp eax, ebx :760F7549 C645F469 mov [ebp-0C], 69 :760F754D C645F565 mov [ebp-0B], 65 :760F7551 C645F673 mov [ebp-0A], 73 :760F7555 895DEC mov dword ptr [ebp-14], ebx :760F7558 740B je 760F7565 :760F755A 50 push eax :760F755B 8BCE mov ecx, esi :760F755D E807FAFFFF call 760F6F69 :760F7562 895E58 mov dword ptr [esi+58], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7558(C) | :760F7565 FF7508 push [ebp+08] :760F7568 8D7E14 lea edi, dword ptr [esi+14] :760F756B 8BCF mov ecx, edi :760F756D E8B5C8FEFF call 760E3E27 :760F7572 85C0 test eax, eax :760F7574 7538 jne 760F75AE :760F7576 A184110E76 mov eax, dword ptr [760E1184] :760F757B F60002 test byte ptr [eax], 02 :760F757E 0F84ED050000 je 760F7B71 :760F7584 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::BuildTree" | :760F7586 6874AC0E76 push 760EAC74 :760F758B 68CD020000 push 000002CD * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F7590 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7595 FF1580110E76 Call dword ptr [760E1180] :760F759B 85C0 test eax, eax :760F759D 0F84CE050000 je 760F7B71 :760F75A3 53 push ebx * Possible StringData Ref from Code Obj ->"There was an error parsing the " ->"protected XML file." | :760F75A4 6840AC0E76 push 760EAC40 :760F75A9 E9B7040000 jmp 760F7A65 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7574(C) | :760F75AE 8BCF mov ecx, edi :760F75B0 E82CC0FFFF call 760F35E1 :760F75B5 3C49 cmp al, 49 :760F75B7 88465C mov byte ptr [esi+5C], al :760F75BA 7509 jne 760F75C5 :760F75BC C745F801000000 mov [ebp-08], 00000001 :760F75C3 EB1B jmp 760F75E0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F75BA(C) | :760F75C5 3C45 cmp al, 45 :760F75C7 7509 jne 760F75D2 :760F75C9 C745F802000000 mov [ebp-08], 00000002 :760F75D0 EB0E jmp 760F75E0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F75C7(C) | :760F75D2 3C53 cmp al, 53 :760F75D4 C745F803000000 mov [ebp-08], 00000003 :760F75DB 7403 je 760F75E0 :760F75DD 895DF8 mov dword ptr [ebp-08], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F75C3(U), :760F75D0(U), :760F75DB(C) | :760F75E0 895DFC mov dword ptr [ebp-04], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7775(C) | :760F75E3 8B45FC mov eax, dword ptr [ebp-04] :760F75E6 8D4E14 lea ecx, dword ptr [esi+14] :760F75E9 8A5C05F4 mov bl, byte ptr [ebp+eax-0C] :760F75ED 53 push ebx :760F75EE E8EFBDFFFF call 760F33E2 :760F75F3 83650800 and dword ptr [ebp+08], 00000000 :760F75F7 8945F0 mov dword ptr [ebp-10], eax :760F75FA 85C0 test eax, eax :760F75FC 0F8EB0000000 jle 760F76B2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F76AA(C) | :760F7602 8D45EC lea eax, dword ptr [ebp-14] :760F7605 8365EC00 and dword ptr [ebp-14], 00000000 :760F7609 50 push eax :760F760A BF00040000 mov edi, 00000400 :760F760F 53 push ebx :760F7610 8D858CFBFFFF lea eax, dword ptr [ebp+FFFFFB8C] :760F7616 57 push edi :760F7617 50 push eax :760F7618 FF7508 push [ebp+08] :760F761B 8D4E14 lea ecx, dword ptr [esi+14] :760F761E E8E9BCFFFF call 760F330C :760F7623 3BC7 cmp eax, edi :760F7625 0F85B6010000 jne 760F77E1 :760F762B 80BD8CFBFFFF2A cmp byte ptr [ebp+FFFFFB8C], 2A :760F7632 751E jne 760F7652 :760F7634 FF75EC push [ebp-14] :760F7637 8D858CFBFFFF lea eax, dword ptr [ebp+FFFFFB8C] :760F763D 8BCE mov ecx, esi :760F763F 6A00 push 00000000 :760F7641 53 push ebx :760F7642 50 push eax :760F7643 E860FDFFFF call 760F73A8 :760F7648 85C0 test eax, eax :760F764A 0F84B0010000 je 760F7800 :760F7650 EB4F jmp 760F76A1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7632(C) | :760F7652 8D858CFBFFFF lea eax, dword ptr [ebp+FFFFFB8C] :760F7658 50 push eax :760F7659 8D8584F7FFFF lea eax, dword ptr [ebp+FFFFF784] * Possible StringData Ref from Code Obj ->"vxdRoot\%s" | :760F765F 688CAB0E76 push 760EAB8C :760F7664 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760F7665 FF1530100E76 Call dword ptr [760E1030] :760F766B 83C40C add esp, 0000000C :760F766E 8D8584F7FFFF lea eax, dword ptr [ebp+FFFFF784] :760F7674 8BCE mov ecx, esi :760F7676 6A5C push 0000005C :760F7678 50 push eax :760F7679 E85F050000 call 760F7BDD :760F767E FF75EC push [ebp-14] :760F7681 8BCE mov ecx, esi :760F7683 6A00 push 00000000 :760F7685 6A00 push 00000000 :760F7687 50 push eax :760F7688 8D8584F7FFFF lea eax, dword ptr [ebp+FFFFF784] :760F768E 53 push ebx :760F768F 50 push eax :760F7690 8D4658 lea eax, dword ptr [esi+58] :760F7693 50 push eax :760F7694 E8AFFAFFFF call 760F7148 :760F7699 85C0 test eax, eax :760F769B 0F8498010000 je 760F7839 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7650(U) | :760F76A1 FF4508 inc [ebp+08] :760F76A4 8B4508 mov eax, dword ptr [ebp+08] :760F76A7 3B45F0 cmp eax, dword ptr [ebp-10] :760F76AA 0F8C52FFFFFF jl 760F7602 :760F76B0 EB05 jmp 760F76B7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F75FC(C) | :760F76B2 BF00040000 mov edi, 00000400 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F76B0(U) | :760F76B7 53 push ebx :760F76B8 8D4E14 lea ecx, dword ptr [esi+14] :760F76BB E890D3FEFF call 760E4A50 :760F76C0 83650800 and dword ptr [ebp+08], 00000000 :760F76C4 8945F0 mov dword ptr [ebp-10], eax :760F76C7 85C0 test eax, eax :760F76C9 0F8E9F000000 jle 760F776E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7768(C) | :760F76CF 53 push ebx :760F76D0 8D858CFBFFFF lea eax, dword ptr [ebp+FFFFFB8C] :760F76D6 57 push edi :760F76D7 50 push eax :760F76D8 FF7508 push [ebp+08] :760F76DB 8D4E14 lea ecx, dword ptr [esi+14] :760F76DE E8E9D3FEFF call 760E4ACC :760F76E3 3BC7 cmp eax, edi :760F76E5 0F8587010000 jne 760F7872 :760F76EB 80BD8CFBFFFF2A cmp byte ptr [ebp+FFFFFB8C], 2A :760F76F2 751D jne 760F7711 :760F76F4 6A00 push 00000000 :760F76F6 6A01 push 00000001 :760F76F8 8D858CFBFFFF lea eax, dword ptr [ebp+FFFFFB8C] :760F76FE 53 push ebx :760F76FF 50 push eax :760F7700 8BCE mov ecx, esi :760F7702 E8A1FCFFFF call 760F73A8 :760F7707 85C0 test eax, eax :760F7709 0F8482010000 je 760F7891 :760F770F EB4E jmp 760F775F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F76F2(C) | :760F7711 8D858CFBFFFF lea eax, dword ptr [ebp+FFFFFB8C] :760F7717 50 push eax :760F7718 8D8584F7FFFF lea eax, dword ptr [ebp+FFFFF784] * Possible StringData Ref from Code Obj ->"vxdRoot\%s" | :760F771E 688CAB0E76 push 760EAB8C :760F7723 50 push eax * Reference To: MSVCRT.sprintf, Ord:02AFh | :760F7724 FF1530100E76 Call dword ptr [760E1030] :760F772A 83C40C add esp, 0000000C :760F772D 8D8584F7FFFF lea eax, dword ptr [ebp+FFFFF784] :760F7733 8BCE mov ecx, esi :760F7735 6A5C push 0000005C :760F7737 50 push eax :760F7738 E8A0040000 call 760F7BDD :760F773D 6A00 push 00000000 :760F773F 6A01 push 00000001 :760F7741 6A00 push 00000000 :760F7743 50 push eax :760F7744 8D8584F7FFFF lea eax, dword ptr [ebp+FFFFF784] :760F774A 53 push ebx :760F774B 50 push eax :760F774C 8D4658 lea eax, dword ptr [esi+58] :760F774F 50 push eax :760F7750 8BCE mov ecx, esi :760F7752 E8F1F9FFFF call 760F7148 :760F7757 85C0 test eax, eax :760F7759 0F846B010000 je 760F78CA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F770F(U) | :760F775F FF4508 inc [ebp+08] :760F7762 8B4508 mov eax, dword ptr [ebp+08] :760F7765 3B45F0 cmp eax, dword ptr [ebp-10] :760F7768 0F8C61FFFFFF jl 760F76CF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F76C9(C) | :760F776E FF45FC inc [ebp-04] :760F7771 837DFC03 cmp dword ptr [ebp-04], 00000003 :760F7775 0F8C68FEFFFF jl 760F75E3 :760F777B FF7610 push [esi+10] :760F777E 8BCE mov ecx, esi :760F7780 FF7658 push [esi+58] :760F7783 E8CA040000 call 760F7C52 :760F7788 50 push eax :760F7789 8D4DB8 lea ecx, dword ptr [ebp-48] :760F778C FF760C push [esi+0C] :760F778F FF7608 push [esi+08] :760F7792 FF75F8 push [ebp-08] :760F7795 FF7604 push [esi+04] :760F7798 FF7658 push [esi+58] :760F779B E8950A0000 call 760F8235 :760F77A0 85C0 test eax, eax :760F77A2 0F8541010000 jne 760F78E9 :760F77A8 A184110E76 mov eax, dword ptr [760E1184] :760F77AD F60002 test byte ptr [eax], 02 :760F77B0 0F84BB030000 je 760F7B71 :760F77B6 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::BuildTree" | :760F77B8 6874AC0E76 push 760EAC74 :760F77BD 683D030000 push 0000033D * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F77C2 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F77C7 FF1580110E76 Call dword ptr [760E1180] :760F77CD 85C0 test eax, eax :760F77CF 0F849C030000 je 760F7B71 :760F77D5 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error buildign pathtree blob." | :760F77D7 6820AC0E76 push 760EAC20 :760F77DC E984020000 jmp 760F7A65 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7625(C) | :760F77E1 A184110E76 mov eax, dword ptr [760E1184] :760F77E6 F60002 test byte ptr [eax], 02 :760F77E9 0F8482030000 je 760F7B71 :760F77EF 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::BuildTree" | :760F77F1 6874AC0E76 push 760EAC74 :760F77F6 68EE020000 push 000002EE :760F77FB E94B020000 jmp 760F7A4B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F764A(C) | :760F7800 A184110E76 mov eax, dword ptr [760E1184] :760F7805 F60002 test byte ptr [eax], 02 :760F7808 0F8463030000 je 760F7B71 :760F780E 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::BuildTree" | :760F7810 6874AC0E76 push 760EAC74 :760F7815 68F6020000 push 000002F6 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F781A 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F781F FF1580110E76 Call dword ptr [760E1180] :760F7825 85C0 test eax, eax :760F7827 0F8444030000 je 760F7B71 :760F782D 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"error adding meta drive directory." | :760F782F 68FCAB0E76 push 760EABFC :760F7834 E92C020000 jmp 760F7A65 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F769B(C) | :760F7839 A184110E76 mov eax, dword ptr [760E1184] :760F783E F60002 test byte ptr [eax], 02 :760F7841 0F842A030000 je 760F7B71 :760F7847 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::BuildTree" | :760F7849 6874AC0E76 push 760EAC74 :760F784E 6803030000 push 00000303 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F78E4(U) | * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F7853 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7858 FF1580110E76 Call dword ptr [760E1180] :760F785E 85C0 test eax, eax :760F7860 0F840B030000 je 760F7B71 :760F7866 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error adding node." | :760F7868 68E8AB0E76 push 760EABE8 :760F786D E9F3010000 jmp 760F7A65 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F76E5(C) | :760F7872 A184110E76 mov eax, dword ptr [760E1184] :760F7877 F60002 test byte ptr [eax], 02 :760F787A 0F84F1020000 je 760F7B71 :760F7880 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::BuildTree" | :760F7882 6874AC0E76 push 760EAC74 :760F7887 6812030000 push 00000312 :760F788C E9BA010000 jmp 760F7A4B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7709(C) | :760F7891 A184110E76 mov eax, dword ptr [760E1184] :760F7896 F60002 test byte ptr [eax], 02 :760F7899 0F84D2020000 je 760F7B71 :760F789F 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::BuildTree" | :760F78A1 6874AC0E76 push 760EAC74 :760F78A6 6819030000 push 00000319 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F78AB 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F78B0 FF1580110E76 Call dword ptr [760E1180] :760F78B6 85C0 test eax, eax :760F78B8 0F84B3020000 je 760F7B71 :760F78BE 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"error adding meta drive file." | :760F78C0 68C8AB0E76 push 760EABC8 :760F78C5 E99B010000 jmp 760F7A65 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7759(C) | :760F78CA A184110E76 mov eax, dword ptr [760E1184] :760F78CF F60002 test byte ptr [eax], 02 :760F78D2 0F8499020000 je 760F7B71 :760F78D8 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::BuildTree" | :760F78DA 6874AC0E76 push 760EAC74 :760F78DF 6826030000 push 00000326 :760F78E4 E96AFFFFFF jmp 760F7853 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F77A2(C) | :760F78E9 33FF xor edi, edi :760F78EB 897DF0 mov dword ptr [ebp-10], edi :760F78EE 897DF8 mov dword ptr [ebp-08], edi :760F78F1 897DFC mov dword ptr [ebp-04], edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7959(C) | :760F78F4 8B45FC mov eax, dword ptr [ebp-04] :760F78F7 8D4E14 lea ecx, dword ptr [esi+14] :760F78FA 8A5C05F4 mov bl, byte ptr [ebp+eax-0C] :760F78FE 53 push ebx :760F78FF E8F9BAFFFF call 760F33FD :760F7904 0145F8 add dword ptr [ebp-08], eax :760F7907 3BC7 cmp eax, edi :760F7909 8945E8 mov dword ptr [ebp-18], eax :760F790C 897D08 mov dword ptr [ebp+08], edi :760F790F 7E41 jle 760F7952 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F794E(C) | :760F7911 BF00040000 mov edi, 00000400 :760F7916 53 push ebx :760F7917 8D858CFBFFFF lea eax, dword ptr [ebp+FFFFFB8C] :760F791D 57 push edi :760F791E 50 push eax :760F791F 8D4E14 lea ecx, dword ptr [esi+14] :760F7922 FF7508 push [ebp+08] :760F7925 E84ABAFFFF call 760F3374 :760F792A 3BC7 cmp eax, edi :760F792C 0F85FF000000 jne 760F7A31 :760F7932 8DBD8CFBFFFF lea edi, dword ptr [ebp+FFFFFB8C] :760F7938 83C9FF or ecx, FFFFFFFF :760F793B 33C0 xor eax, eax :760F793D F2 repnz :760F793E AE scasb :760F793F F7D1 not ecx :760F7941 49 dec ecx :760F7942 014DF0 add dword ptr [ebp-10], ecx :760F7945 FF4508 inc [ebp+08] :760F7948 8B4508 mov eax, dword ptr [ebp+08] :760F794B 3B45E8 cmp eax, dword ptr [ebp-18] :760F794E 7CC1 jl 760F7911 :760F7950 33FF xor edi, edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F790F(C) | :760F7952 FF45FC inc [ebp-04] :760F7955 837DFC03 cmp dword ptr [ebp-04], 00000003 :760F7959 7C99 jl 760F78F4 :760F795B FF75F0 push [ebp-10] :760F795E 8D4D8C lea ecx, dword ptr [ebp-74] :760F7961 FF75F8 push [ebp-08] :760F7964 E813040000 call 760F7D7C :760F7969 897DFC mov dword ptr [ebp-04], edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F79C2(C) | :760F796C 8B45FC mov eax, dword ptr [ebp-04] :760F796F 8D7E14 lea edi, dword ptr [esi+14] :760F7972 8BCF mov ecx, edi :760F7974 8A5C05F4 mov bl, byte ptr [ebp+eax-0C] :760F7978 53 push ebx :760F7979 E87FBAFFFF call 760F33FD :760F797E 83650800 and dword ptr [ebp+08], 00000000 :760F7982 8945E8 mov dword ptr [ebp-18], eax :760F7985 85C0 test eax, eax :760F7987 7E32 jle 760F79BB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F79B9(C) | :760F7989 53 push ebx :760F798A 8D858CFBFFFF lea eax, dword ptr [ebp+FFFFFB8C] :760F7990 6800040000 push 00000400 :760F7995 50 push eax :760F7996 FF7508 push [ebp+08] :760F7999 8BCF mov ecx, edi :760F799B E8D4B9FFFF call 760F3374 :760F79A0 8D858CFBFFFF lea eax, dword ptr [ebp+FFFFFB8C] :760F79A6 53 push ebx :760F79A7 50 push eax :760F79A8 8D4D8C lea ecx, dword ptr [ebp-74] :760F79AB E86F050000 call 760F7F1F :760F79B0 FF4508 inc [ebp+08] :760F79B3 8B4508 mov eax, dword ptr [ebp+08] :760F79B6 3B45E8 cmp eax, dword ptr [ebp-18] :760F79B9 7CCE jl 760F7989 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7987(C) | :760F79BB FF45FC inc [ebp-04] :760F79BE 837DFC03 cmp dword ptr [ebp-04], 00000003 :760F79C2 7CA8 jl 760F796C :760F79C4 6A00 push 00000000 :760F79C6 6800000010 push 10000000 :760F79CB 6A04 push 00000004 :760F79CD 6A00 push 00000000 :760F79CF 6A03 push 00000003 :760F79D1 68000000C0 push C0000000 :760F79D6 FF750C push [ebp+0C] * Reference To: KERNEL32.CreateFileA, Ord:0037h | :760F79D9 FF1580120E76 Call dword ptr [760E1280] :760F79DF 8BD8 mov ebx, eax :760F79E1 83FBFF cmp ebx, FFFFFFFF :760F79E4 0F8589000000 jne 760F7A73 :760F79EA A184110E76 mov eax, dword ptr [760E1184] :760F79EF F60002 test byte ptr [eax], 02 :760F79F2 0F8472010000 je 760F7B6A :760F79F8 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::BuildTree" | :760F79FA 6874AC0E76 push 760EAC74 :760F79FF 6877030000 push 00000377 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F7A04 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7A09 FF1580110E76 Call dword ptr [760E1180] :760F7A0F 85C0 test eax, eax :760F7A11 0F8453010000 je 760F7B6A * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F7A17 FF15A0110E76 Call dword ptr [760E11A0] :760F7A1D 50 push eax * Possible StringData Ref from Code Obj ->"CreateFile Failed 0x%x" | :760F7A1E 68009C0E76 push 760E9C00 :760F7A23 56 push esi :760F7A24 E80255FFFF call 760ECF2B :760F7A29 83C40C add esp, 0000000C :760F7A2C E939010000 jmp 760F7B6A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F792C(C) | :760F7A31 A184110E76 mov eax, dword ptr [760E1184] :760F7A36 F60002 test byte ptr [eax], 02 :760F7A39 0F8432010000 je 760F7B71 :760F7A3F 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::BuildTree" | :760F7A41 6874AC0E76 push 760EAC74 :760F7A46 6855030000 push 00000355 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F77FB(U), :760F788C(U) | * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F7A4B 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7A50 FF1580110E76 Call dword ptr [760E1180] :760F7A56 85C0 test eax, eax :760F7A58 0F8413010000 je 760F7B71 :760F7A5E 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Not enough buffer space." | :760F7A60 68ACAB0E76 push 760EABAC * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F75A9(U), :760F77DC(U), :760F7834(U), :760F786D(U), :760F78C5(U) | :760F7A65 56 push esi :760F7A66 E8C054FFFF call 760ECF2B :760F7A6B 83C40C add esp, 0000000C :760F7A6E E9FE000000 jmp 760F7B71 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F79E4(C) | :760F7A73 8D4D8C lea ecx, dword ptr [ebp-74] :760F7A76 E850070000 call 760F81CB :760F7A7B 8D4DB8 lea ecx, dword ptr [ebp-48] :760F7A7E 8BF8 mov edi, eax :760F7A80 E8F70B0000 call 760F867C :760F7A85 8D440710 lea eax, dword ptr [edi+eax+10] * Reference To: KERNEL32.WriteFile, Ord:030Eh | :760F7A89 8B3DB8110E76 mov edi, dword ptr [760E11B8] :760F7A8F 8945D4 mov dword ptr [ebp-2C], eax :760F7A92 8D45E4 lea eax, dword ptr [ebp-1C] :760F7A95 6A00 push 00000000 :760F7A97 50 push eax :760F7A98 8D45D4 lea eax, dword ptr [ebp-2C] :760F7A9B 6A10 push 00000010 :760F7A9D 50 push eax :760F7A9E 53 push ebx :760F7A9F C745D801000000 mov [ebp-28], 00000001 :760F7AA6 C745DC03000000 mov [ebp-24], 00000003 :760F7AAD C745E002000000 mov [ebp-20], 00000002 :760F7AB4 FFD7 call edi :760F7AB6 85C0 test eax, eax :760F7AB8 751C jne 760F7AD6 :760F7ABA A184110E76 mov eax, dword ptr [760E1184] :760F7ABF F60002 test byte ptr [eax], 02 :760F7AC2 0F849E000000 je 760F7B66 :760F7AC8 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::BuildTree" | :760F7ACA 6874AC0E76 push 760EAC74 :760F7ACF 6887030000 push 00000387 :760F7AD4 EB6C jmp 760F7B42 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7AB8(C) | :760F7AD6 8D45E4 lea eax, dword ptr [ebp-1C] :760F7AD9 6A00 push 00000000 :760F7ADB 50 push eax :760F7ADC 8D4DB8 lea ecx, dword ptr [ebp-48] :760F7ADF E8980B0000 call 760F867C :760F7AE4 50 push eax :760F7AE5 8D4DB8 lea ecx, dword ptr [ebp-48] :760F7AE8 E8930B0000 call 760F8680 :760F7AED 50 push eax :760F7AEE 53 push ebx :760F7AEF FFD7 call edi :760F7AF1 85C0 test eax, eax :760F7AF3 7518 jne 760F7B0D :760F7AF5 A184110E76 mov eax, dword ptr [760E1184] :760F7AFA F60002 test byte ptr [eax], 02 :760F7AFD 7467 je 760F7B66 :760F7AFF 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::BuildTree" | :760F7B01 6874AC0E76 push 760EAC74 :760F7B06 688D030000 push 0000038D :760F7B0B EB35 jmp 760F7B42 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7AF3(C) | :760F7B0D 8D45E4 lea eax, dword ptr [ebp-1C] :760F7B10 6A00 push 00000000 :760F7B12 50 push eax :760F7B13 8D4D8C lea ecx, dword ptr [ebp-74] :760F7B16 E8B0060000 call 760F81CB :760F7B1B 50 push eax :760F7B1C 8D4D8C lea ecx, dword ptr [ebp-74] :760F7B1F E8AB060000 call 760F81CF :760F7B24 50 push eax :760F7B25 53 push ebx :760F7B26 FFD7 call edi :760F7B28 85C0 test eax, eax :760F7B2A 756E jne 760F7B9A :760F7B2C A184110E76 mov eax, dword ptr [760E1184] :760F7B31 F60002 test byte ptr [eax], 02 :760F7B34 7430 je 760F7B66 :760F7B36 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDDatBuilder::BuildTree" | :760F7B38 6874AC0E76 push 760EAC74 :760F7B3D 6892030000 push 00000392 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7AD4(U), :760F7B0B(U) | * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\vxdbuilde" ->"r.cpp" | :760F7B42 6880E00F76 push 760FE080 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7B47 FF1580110E76 Call dword ptr [760E1180] :760F7B4D 85C0 test eax, eax :760F7B4F 7415 je 760F7B66 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F7B51 FF15A0110E76 Call dword ptr [760E11A0] :760F7B57 50 push eax * Possible StringData Ref from Code Obj ->"WriteFile Failed 0x%x" | :760F7B58 68CC9B0E76 push 760E9BCC :760F7B5D 56 push esi :760F7B5E E8C853FFFF call 760ECF2B :760F7B63 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7AC2(C), :760F7AFD(C), :760F7B34(C), :760F7B4F(C) | :760F7B66 85DB test ebx, ebx :760F7B68 7407 je 760F7B71 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F79F2(C), :760F7A11(C), :760F7A2C(U) | :760F7B6A 53 push ebx * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760F7B6B FF1534120E76 Call dword ptr [760E1234] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F757E(C), :760F759D(C), :760F77B0(C), :760F77CF(C), :760F77E9(C) |:760F7808(C), :760F7827(C), :760F7841(C), :760F7860(C), :760F787A(C) |:760F7899(C), :760F78B8(C), :760F78D2(C), :760F7A39(C), :760F7A58(C) |:760F7A6E(U), :760F7B68(C) | :760F7B71 8D4D8C lea ecx, dword ptr [ebp-74] :760F7B74 E8CD010000 call 760F7D46 :760F7B79 8D4DB8 lea ecx, dword ptr [ebp-48] :760F7B7C E871060000 call 760F81F2 :760F7B81 8B4658 mov eax, dword ptr [esi+58] :760F7B84 8D7E58 lea edi, dword ptr [esi+58] :760F7B87 85C0 test eax, eax :760F7B89 740B je 760F7B96 :760F7B8B 50 push eax :760F7B8C 8BCE mov ecx, esi :760F7B8E E8D6F3FFFF call 760F6F69 :760F7B93 832700 and dword ptr [edi], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7B89(C) | :760F7B96 33F6 xor esi, esi :760F7B98 EB2A jmp 760F7BC4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7B2A(C) | :760F7B9A 53 push ebx * Reference To: KERNEL32.CloseHandle, Ord:001Eh | :760F7B9B FF1534120E76 Call dword ptr [760E1234] :760F7BA1 8D4D8C lea ecx, dword ptr [ebp-74] :760F7BA4 E89D010000 call 760F7D46 :760F7BA9 8D4DB8 lea ecx, dword ptr [ebp-48] :760F7BAC E841060000 call 760F81F2 :760F7BB1 FF7658 push [esi+58] :760F7BB4 8D7E58 lea edi, dword ptr [esi+58] :760F7BB7 8BCE mov ecx, esi :760F7BB9 E8ABF3FFFF call 760F6F69 :760F7BBE 832700 and dword ptr [edi], 00000000 :760F7BC1 6A01 push 00000001 :760F7BC3 5E pop esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7B98(U) | :760F7BC4 8D4DB8 lea ecx, dword ptr [ebp-48] :760F7BC7 E826060000 call 760F81F2 :760F7BCC 8D4D8C lea ecx, dword ptr [ebp-74] :760F7BCF E86C010000 call 760F7D40 :760F7BD4 8BC6 mov eax, esi :760F7BD6 5F pop edi :760F7BD7 5E pop esi :760F7BD8 5B pop ebx :760F7BD9 C9 leave :760F7BDA C20800 ret 0008 * Referenced by a CALL at Addresses: |:760F74A8 , :760F7679 , :760F7738 | :760F7BDD 8B542404 mov edx, dword ptr [esp+04] :760F7BE1 6A01 push 00000001 :760F7BE3 58 pop eax :760F7BE4 8A0A mov cl, byte ptr [edx] :760F7BE6 84C9 test cl, cl :760F7BE8 7504 jne 760F7BEE :760F7BEA 33C0 xor eax, eax :760F7BEC EB0F jmp 760F7BFD * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7BE8(C), :760F7BFB(C) | :760F7BEE 3A4C2408 cmp cl, byte ptr [esp+08] :760F7BF2 7501 jne 760F7BF5 :760F7BF4 40 inc eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7BF2(C) | :760F7BF5 8A4A01 mov cl, byte ptr [edx+01] :760F7BF8 42 inc edx :760F7BF9 84C9 test cl, cl :760F7BFB 75F1 jne 760F7BEE * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7BEC(U) | :760F7BFD C20800 ret 0008 * Referenced by a CALL at Addresses: |:760F7003 , :760F70C7 | :760F7C00 56 push esi :760F7C01 8B742408 mov esi, dword ptr [esp+08] :760F7C05 85F6 test esi, esi :760F7C07 57 push edi :760F7C08 8BD1 mov edx, ecx :760F7C0A 741C je 760F7C28 :760F7C0C 8BFE mov edi, esi :760F7C0E 83C9FF or ecx, FFFFFFFF :760F7C11 33C0 xor eax, eax :760F7C13 F2 repnz :760F7C14 AE scasb :760F7C15 F7D1 not ecx :760F7C17 51 push ecx :760F7C18 50 push eax :760F7C19 FF7260 push [edx+60] * Reference To: KERNEL32.HeapAlloc, Ord:01B4h | :760F7C1C FF15EC110E76 Call dword ptr [760E11EC] :760F7C22 8BD0 mov edx, eax :760F7C24 85D2 test edx, edx :760F7C26 7504 jne 760F7C2C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7C0A(C) | :760F7C28 33C0 xor eax, eax :760F7C2A EB21 jmp 760F7C4D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7C26(C) | :760F7C2C 8BFE mov edi, esi :760F7C2E 83C9FF or ecx, FFFFFFFF :760F7C31 33C0 xor eax, eax :760F7C33 F2 repnz :760F7C34 AE scasb :760F7C35 F7D1 not ecx :760F7C37 2BF9 sub edi, ecx :760F7C39 8BC1 mov eax, ecx :760F7C3B 8BF7 mov esi, edi :760F7C3D 8BFA mov edi, edx :760F7C3F C1E902 shr ecx, 02 :760F7C42 F3 repz :760F7C43 A5 movsd :760F7C44 8BC8 mov ecx, eax :760F7C46 8BC2 mov eax, edx :760F7C48 83E103 and ecx, 00000003 :760F7C4B F3 repz :760F7C4C A4 movsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7C2A(U) | :760F7C4D 5F pop edi :760F7C4E 5E pop esi :760F7C4F C20400 ret 0004 * Referenced by a CALL at Addresses: |:760F7783 , :760F7C6F , :760F7C80 | :760F7C52 53 push ebx :760F7C53 56 push esi :760F7C54 8B74240C mov esi, dword ptr [esp+0C] :760F7C58 57 push edi :760F7C59 33FF xor edi, edi :760F7C5B 8BD9 mov ebx, ecx :760F7C5D 85F6 test esi, esi :760F7C5F 7504 jne 760F7C65 :760F7C61 33C0 xor eax, eax :760F7C63 EB35 jmp 760F7C9A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7C5F(C) | :760F7C65 8B4618 mov eax, dword ptr [esi+18] :760F7C68 85C0 test eax, eax :760F7C6A 740A je 760F7C76 :760F7C6C 50 push eax :760F7C6D 8BCB mov ecx, ebx :760F7C6F E8DEFFFFFF call 760F7C52 :760F7C74 8BF8 mov edi, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7C6A(C) | :760F7C76 8B461C mov eax, dword ptr [esi+1C] :760F7C79 85C0 test eax, eax :760F7C7B 740A je 760F7C87 :760F7C7D 50 push eax :760F7C7E 8BCB mov ecx, ebx :760F7C80 E8CDFFFFFF call 760F7C52 :760F7C85 03F8 add edi, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7C7B(C) | :760F7C87 8B760C mov esi, dword ptr [esi+0C] :760F7C8A 85F6 test esi, esi :760F7C8C 7E0A jle 760F7C98 :760F7C8E 56 push esi :760F7C8F 8BCB mov ecx, ebx :760F7C91 E838000000 call 760F7CCE :760F7C96 03F8 add edi, eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7C8C(C) | :760F7C98 8BC7 mov eax, edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7C63(U) | :760F7C9A 5F pop edi :760F7C9B 5E pop esi :760F7C9C 5B pop ebx :760F7C9D C20400 ret 0004 * Referenced by a CALL at Address: |:760F7CE3 | :760F7CA0 8B4C2404 mov ecx, dword ptr [esp+04] :760F7CA4 56 push esi :760F7CA5 85C9 test ecx, ecx :760F7CA7 7421 je 760F7CCA :760F7CA9 83F901 cmp ecx, 00000001 :760F7CAC 7415 je 760F7CC3 :760F7CAE 6A02 push 00000002 :760F7CB0 5E pop esi :760F7CB1 3BCE cmp ecx, esi :760F7CB3 7E0E jle 760F7CC3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7CC1(C) | :760F7CB5 8BC1 mov eax, ecx :760F7CB7 99 cdq :760F7CB8 F7FE idiv esi :760F7CBA 85D2 test edx, edx :760F7CBC 740C je 760F7CCA :760F7CBE 46 inc esi :760F7CBF 3BF1 cmp esi, ecx :760F7CC1 7CF2 jl 760F7CB5 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7CAC(C), :760F7CB3(C) | :760F7CC3 6A01 push 00000001 :760F7CC5 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7CCC(U) | :760F7CC6 5E pop esi :760F7CC7 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7CA7(C), :760F7CBC(C) | :760F7CCA 33C0 xor eax, eax :760F7CCC EBF8 jmp 760F7CC6 * Referenced by a CALL at Address: |:760F7C91 | :760F7CCE 53 push ebx :760F7CCF 56 push esi :760F7CD0 57 push edi :760F7CD1 8B7C2410 mov edi, dword ptr [esp+10] :760F7CD5 8BD9 mov ebx, ecx :760F7CD7 BEEB030000 mov esi, 000003EB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7CED(U) | :760F7CDC 3BFE cmp edi, esi :760F7CDE 7D13 jge 760F7CF3 :760F7CE0 57 push edi :760F7CE1 8BCB mov ecx, ebx :760F7CE3 E8B8FFFFFF call 760F7CA0 :760F7CE8 85C0 test eax, eax :760F7CEA 7503 jne 760F7CEF :760F7CEC 47 inc edi :760F7CED EBED jmp 760F7CDC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7CEA(C) | :760F7CEF 8BC7 mov eax, edi :760F7CF1 EB02 jmp 760F7CF5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7CDE(C) | :760F7CF3 8BC6 mov eax, esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7CF1(U) | :760F7CF5 5F pop edi :760F7CF6 5E pop esi :760F7CF7 5B pop ebx :760F7CF8 C20400 ret 0004 :760F7CFB 56 push esi :760F7CFC 8BF1 mov esi, ecx :760F7CFE E83D000000 call 760F7D40 :760F7D03 F644240801 test [esp+08], 01 :760F7D08 7407 je 760F7D11 :760F7D0A 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F7D0B E83B9CFEFF Call 760E194B :760F7D10 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7D08(C) | :760F7D11 8BC6 mov eax, esi :760F7D13 5E pop esi :760F7D14 C20400 ret 0004 * Referenced by a CALL at Addresses: |:760F7532 , :760F84EA | :760F7D17 8BC1 mov eax, ecx :760F7D19 33C9 xor ecx, ecx :760F7D1B 894804 mov dword ptr [eax+04], ecx :760F7D1E 894818 mov dword ptr [eax+18], ecx :760F7D21 894824 mov dword ptr [eax+24], ecx :760F7D24 894820 mov dword ptr [eax+20], ecx :760F7D27 894808 mov dword ptr [eax+08], ecx :760F7D2A 894814 mov dword ptr [eax+14], ecx :760F7D2D 894810 mov dword ptr [eax+10], ecx :760F7D30 8B4C2404 mov ecx, dword ptr [esp+04] :760F7D34 C70094AC0E76 mov dword ptr [eax], 760EAC94 :760F7D3A 894828 mov dword ptr [eax+28], ecx :760F7D3D C20400 ret 0004 * Referenced by a CALL at Addresses: |:760F7BCF , :760F7CFE , :760F85B9 , :760F860F | :760F7D40 C70194AC0E76 mov dword ptr [ecx], 760EAC94 * Referenced by a CALL at Addresses: |:760F7B74 , :760F7BA4 , :760F7DAC , :760F8558 , :760F857C |:760F8607 | :760F7D46 56 push esi :760F7D47 8BF1 mov esi, ecx :760F7D49 57 push edi :760F7D4A 33FF xor edi, edi :760F7D4C 8B4604 mov eax, dword ptr [esi+04] :760F7D4F 3BC7 cmp eax, edi :760F7D51 740E je 760F7D61 :760F7D53 50 push eax :760F7D54 57 push edi :760F7D55 FF7628 push [esi+28] * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760F7D58 FF15FC110E76 Call dword ptr [760E11FC] :760F7D5E 897E04 mov dword ptr [esi+04], edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7D51(C) | :760F7D61 6A01 push 00000001 :760F7D63 897E14 mov dword ptr [esi+14], edi :760F7D66 897E10 mov dword ptr [esi+10], edi :760F7D69 897E08 mov dword ptr [esi+08], edi :760F7D6C 897E04 mov dword ptr [esi+04], edi :760F7D6F 897E20 mov dword ptr [esi+20], edi :760F7D72 897E24 mov dword ptr [esi+24], edi :760F7D75 897E18 mov dword ptr [esi+18], edi :760F7D78 58 pop eax :760F7D79 5F pop edi :760F7D7A 5E pop esi :760F7D7B C3 ret * Referenced by a CALL at Addresses: |:760F7964 , :760F84F8 | :760F7D7C 55 push ebp :760F7D7D 8BEC mov ebp, esp :760F7D7F 51 push ecx :760F7D80 53 push ebx :760F7D81 8B5D08 mov ebx, dword ptr [ebp+08] :760F7D84 56 push esi :760F7D85 57 push edi :760F7D86 8BF1 mov esi, ecx :760F7D88 53 push ebx :760F7D89 E860010000 call 760F7EEE :760F7D8E 8B4D0C mov ecx, dword ptr [ebp+0C] :760F7D91 43 inc ebx :760F7D92 03CB add ecx, ebx :760F7D94 837E0400 cmp dword ptr [esi+04], 00000000 :760F7D98 8945FC mov dword ptr [ebp-04], eax :760F7D9B 8D0CD9 lea ecx, dword ptr [ecx+8*ebx] :760F7D9E 8D0441 lea eax, dword ptr [ecx+2*eax] :760F7DA1 8D7C001A lea edi, dword ptr [eax+eax+1A] :760F7DA5 897D08 mov dword ptr [ebp+08], edi :760F7DA8 7439 je 760F7DE3 :760F7DAA 8BCE mov ecx, esi :760F7DAC E895FFFFFF call 760F7D46 :760F7DB1 85C0 test eax, eax :760F7DB3 752E jne 760F7DE3 :760F7DB5 A184110E76 mov eax, dword ptr [760E1184] :760F7DBA F60004 test byte ptr [eax], 04 :760F7DBD 746E je 760F7E2D :760F7DBF 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CVXDHashList::Init" | :760F7DC1 68D0AC0E76 push 760EACD0 :760F7DC6 688C000000 push 0000008C * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdhashl" ->"ist.cpp" | :760F7DCB 68D8E00F76 push 760FE0D8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7DD0 FF1580110E76 Call dword ptr [760E1180] :760F7DD6 85C0 test eax, eax :760F7DD8 7453 je 760F7E2D :760F7DDA 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error cleaning up memory." | :760F7DDC 68B4AC0E76 push 760EACB4 :760F7DE1 EB41 jmp 760F7E24 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7DA8(C), :760F7DB3(C) | :760F7DE3 57 push edi :760F7DE4 6A00 push 00000000 :760F7DE6 FF7628 push [esi+28] * Reference To: KERNEL32.HeapAlloc, Ord:01B4h | :760F7DE9 FF15EC110E76 Call dword ptr [760E11EC] :760F7DEF 8BD0 mov edx, eax :760F7DF1 85D2 test edx, edx :760F7DF3 895604 mov dword ptr [esi+04], edx :760F7DF6 7550 jne 760F7E48 :760F7DF8 A184110E76 mov eax, dword ptr [760E1184] :760F7DFD F60004 test byte ptr [eax], 04 :760F7E00 742B je 760F7E2D :760F7E02 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CVXDHashList::Init" | :760F7E04 68D0AC0E76 push 760EACD0 :760F7E09 6893000000 push 00000093 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdhashl" ->"ist.cpp" | :760F7E0E 68D8E00F76 push 760FE0D8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7E13 FF1580110E76 Call dword ptr [760E1180] :760F7E19 85C0 test eax, eax :760F7E1B 7410 je 760F7E2D :760F7E1D 6A00 push 00000000 :760F7E1F 6898AC0E76 push 760EAC98 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7DE1(U) | :760F7E24 56 push esi :760F7E25 E80151FFFF call 760ECF2B :760F7E2A 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7DBD(C), :760F7DD8(C), :760F7E00(C), :760F7E1B(C) | :760F7E2D 8B4604 mov eax, dword ptr [esi+04] :760F7E30 85C0 test eax, eax :760F7E32 7410 je 760F7E44 :760F7E34 50 push eax :760F7E35 6A00 push 00000000 :760F7E37 FF7628 push [esi+28] * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760F7E3A FF15FC110E76 Call dword ptr [760E11FC] :760F7E40 83660400 and dword ptr [esi+04], 00000000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7E32(C) | :760F7E44 33C0 xor eax, eax :760F7E46 EB70 jmp 760F7EB8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7DF6(C) | :760F7E48 8BCF mov ecx, edi :760F7E4A 8BFA mov edi, edx :760F7E4C 8BD1 mov edx, ecx :760F7E4E 33C0 xor eax, eax :760F7E50 C1E902 shr ecx, 02 :760F7E53 F3 repz :760F7E54 AB stosd :760F7E55 8BCA mov ecx, edx :760F7E57 6A01 push 00000001 :760F7E59 83E103 and ecx, 00000003 :760F7E5C F3 repz :760F7E5D AA stosb :760F7E5E 8B4604 mov eax, dword ptr [esi+04] :760F7E61 8B4DFC mov ecx, dword ptr [ebp-04] :760F7E64 894620 mov dword ptr [esi+20], eax :760F7E67 894618 mov dword ptr [esi+18], eax :760F7E6A 8D54881C lea edx, dword ptr [eax+4*ecx+1C] :760F7E6E 89561C mov dword ptr [esi+1C], edx :760F7E71 8D501C lea edx, dword ptr [eax+1C] :760F7E74 895624 mov dword ptr [esi+24], edx :760F7E77 C7400802000000 mov [eax+08], 00000002 :760F7E7E 8B5620 mov edx, dword ptr [esi+20] :760F7E81 58 pop eax :760F7E82 894204 mov dword ptr [edx+04], eax :760F7E85 8B7E20 mov edi, dword ptr [esi+20] :760F7E88 8D53FF lea edx, dword ptr [ebx-01] :760F7E8B 89570C mov dword ptr [edi+0C], edx :760F7E8E 8B5620 mov edx, dword ptr [esi+20] :760F7E91 8B7D08 mov edi, dword ptr [ebp+08] :760F7E94 893A mov dword ptr [edx], edi :760F7E96 8B7E18 mov edi, dword ptr [esi+18] :760F7E99 8D1499 lea edx, dword ptr [ecx+4*ebx] :760F7E9C 8D14951C000000 lea edx, dword ptr [4*edx+0000001C] :760F7EA3 895710 mov dword ptr [edi+10], edx :760F7EA6 8B5618 mov edx, dword ptr [esi+18] :760F7EA9 894A18 mov dword ptr [edx+18], ecx :760F7EAC 8B4D08 mov ecx, dword ptr [ebp+08] :760F7EAF 894E14 mov dword ptr [esi+14], ecx :760F7EB2 894610 mov dword ptr [esi+10], eax :760F7EB5 895E08 mov dword ptr [esi+08], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7E46(U) | :760F7EB8 5F pop edi :760F7EB9 5E pop esi :760F7EBA 5B pop ebx :760F7EBB C9 leave :760F7EBC C20800 ret 0008 * Referenced by a CALL at Address: |:760F7F05 | :760F7EBF 8B4C2404 mov ecx, dword ptr [esp+04] :760F7EC3 56 push esi :760F7EC4 85C9 test ecx, ecx :760F7EC6 7422 je 760F7EEA :760F7EC8 83F901 cmp ecx, 00000001 :760F7ECB 7416 je 760F7EE3 :760F7ECD 6A02 push 00000002 :760F7ECF 5E pop esi :760F7ED0 3BCE cmp ecx, esi :760F7ED2 760F jbe 760F7EE3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7EE1(C) | :760F7ED4 8BC1 mov eax, ecx :760F7ED6 33D2 xor edx, edx :760F7ED8 F7F6 div esi :760F7EDA 85D2 test edx, edx :760F7EDC 740C je 760F7EEA :760F7EDE 46 inc esi :760F7EDF 3BF1 cmp esi, ecx :760F7EE1 72F1 jb 760F7ED4 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7ECB(C), :760F7ED2(C) | :760F7EE3 6A01 push 00000001 :760F7EE5 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7EEC(U) | :760F7EE6 5E pop esi :760F7EE7 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7EC6(C), :760F7EDC(C) | :760F7EEA 33C0 xor eax, eax :760F7EEC EBF8 jmp 760F7EE6 * Referenced by a CALL at Address: |:760F7D89 | :760F7EEE 53 push ebx :760F7EEF 56 push esi :760F7EF0 57 push edi :760F7EF1 8B7C2410 mov edi, dword ptr [esp+10] :760F7EF5 BEEB030000 mov esi, 000003EB :760F7EFA 8BD9 mov ebx, ecx :760F7EFC 3BFE cmp edi, esi :760F7EFE 7313 jnb 760F7F13 :760F7F00 7D11 jge 760F7F13 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7F11(C) | :760F7F02 57 push edi :760F7F03 8BCB mov ecx, ebx :760F7F05 E8B5FFFFFF call 760F7EBF :760F7F0A 85C0 test eax, eax :760F7F0C 750D jne 760F7F1B :760F7F0E 47 inc edi :760F7F0F 3BFE cmp edi, esi :760F7F11 7CEF jl 760F7F02 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7EFE(C), :760F7F00(C) | :760F7F13 8BC6 mov eax, esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7F1D(U) | :760F7F15 5F pop edi :760F7F16 5E pop esi :760F7F17 5B pop ebx :760F7F18 C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7F0C(C) | :760F7F1B 8BC7 mov eax, edi :760F7F1D EBF6 jmp 760F7F15 * Referenced by a CALL at Addresses: |:760F79AB , :760F8547 | :760F7F1F 55 push ebp :760F7F20 8BEC mov ebp, esp :760F7F22 81EC04040000 sub esp, 00000404 :760F7F28 53 push ebx :760F7F29 56 push esi :760F7F2A 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760F7F30 57 push edi :760F7F31 50 push eax :760F7F32 8BD9 mov ebx, ecx :760F7F34 FF7508 push [ebp+08] :760F7F37 E8A9010000 call 760F80E5 :760F7F3C 33F6 xor esi, esi :760F7F3E 3BC6 cmp eax, esi :760F7F40 7535 jne 760F7F77 :760F7F42 A184110E76 mov eax, dword ptr [760E1184] :760F7F47 F60004 test byte ptr [eax], 04 :760F7F4A 0F84A0000000 je 760F7FF0 :760F7F50 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CVXDHashList::AddFile" | :760F7F52 6848AD0E76 push 760EAD48 :760F7F57 6807010000 push 00000107 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdhashl" ->"ist.cpp" | :760F7F5C 68D8E00F76 push 760FE0D8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7F61 FF1580110E76 Call dword ptr [760E1180] :760F7F67 85C0 test eax, eax :760F7F69 0F8481000000 je 760F7FF0 :760F7F6F 56 push esi * Possible StringData Ref from Code Obj ->"Error creating PathElement" | :760F7F70 682CAD0E76 push 760EAD2C :760F7F75 EB70 jmp 760F7FE7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7F40(C) | :760F7F77 8B5310 mov edx, dword ptr [ebx+10] :760F7F7A 3B5308 cmp edx, dword ptr [ebx+08] :760F7F7D 8955FC mov dword ptr [ebp-04], edx :760F7F80 752D jne 760F7FAF :760F7F82 A184110E76 mov eax, dword ptr [760E1184] :760F7F87 F60004 test byte ptr [eax], 04 :760F7F8A 7464 je 760F7FF0 :760F7F8C 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CVXDHashList::AddFile" | :760F7F8E 6848AD0E76 push 760EAD48 :760F7F93 680D010000 push 0000010D * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdhashl" ->"ist.cpp" | :760F7F98 68D8E00F76 push 760FE0D8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7F9D FF1580110E76 Call dword ptr [760E1180] :760F7FA3 85C0 test eax, eax :760F7FA5 7449 je 760F7FF0 :760F7FA7 56 push esi * Possible StringData Ref from Code Obj ->"Too many elements in HashList." | :760F7FA8 680CAD0E76 push 760EAD0C :760F7FAD EB38 jmp 760F7FE7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7F80(C) | :760F7FAF 8B4B18 mov ecx, dword ptr [ebx+18] :760F7FB2 8B7B14 mov edi, dword ptr [ebx+14] :760F7FB5 2B7910 sub edi, dword ptr [ecx+10] :760F7FB8 3BC7 cmp eax, edi :760F7FBA 763B jbe 760F7FF7 :760F7FBC A184110E76 mov eax, dword ptr [760E1184] :760F7FC1 F60004 test byte ptr [eax], 04 :760F7FC4 742A je 760F7FF0 :760F7FC6 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CVXDHashList::AddFile" | :760F7FC8 6848AD0E76 push 760EAD48 :760F7FCD 6813010000 push 00000113 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdhashl" ->"ist.cpp" | :760F7FD2 68D8E00F76 push 760FE0D8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F7FD7 FF1580110E76 Call dword ptr [760E1180] :760F7FDD 85C0 test eax, eax :760F7FDF 740F je 760F7FF0 :760F7FE1 56 push esi * Possible StringData Ref from Code Obj ->"Insuffienct space left in data " ->"section" | :760F7FE2 68E4AC0E76 push 760EACE4 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7F75(U), :760F7FAD(U) | :760F7FE7 53 push ebx :760F7FE8 E83E4FFFFF call 760ECF2B :760F7FED 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7F4A(C), :760F7F69(C), :760F7F8A(C), :760F7FA5(C), :760F7FC4(C) |:760F7FDF(C) | :760F7FF0 33C0 xor eax, eax :760F7FF2 E9A0000000 jmp 760F8097 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F7FBA(C) | :760F7FF7 8D4A01 lea ecx, dword ptr [edx+01] :760F7FFA C1E204 shl edx, 04 :760F7FFD 03531C add edx, dword ptr [ebx+1C] :760F8000 894B10 mov dword ptr [ebx+10], ecx :760F8003 895508 mov dword ptr [ebp+08], edx :760F8006 894208 mov dword ptr [edx+08], eax :760F8009 8B4B18 mov ecx, dword ptr [ebx+18] :760F800C 8B4910 mov ecx, dword ptr [ecx+10] :760F800F 894A04 mov dword ptr [edx+04], ecx :760F8012 8B7318 mov esi, dword ptr [ebx+18] :760F8015 8BC8 mov ecx, eax :760F8017 014610 add dword ptr [esi+10], eax :760F801A 8B7B04 mov edi, dword ptr [ebx+04] :760F801D 037A04 add edi, dword ptr [edx+04] :760F8020 8DB5FCFBFFFF lea esi, dword ptr [ebp+FFFFFBFC] :760F8026 C1E902 shr ecx, 02 :760F8029 F3 repz :760F802A A5 movsd :760F802B 8BC8 mov ecx, eax :760F802D 8D85FCFBFFFF lea eax, dword ptr [ebp+FFFFFBFC] :760F8033 83E103 and ecx, 00000003 :760F8036 50 push eax :760F8037 F3 repz :760F8038 A4 movsb :760F8039 FF7318 push [ebx+18] :760F803C E85D000000 call 760F809E :760F8041 8B4B24 mov ecx, dword ptr [ebx+24] :760F8044 8B75FC mov esi, dword ptr [ebp-04] :760F8047 C1E002 shl eax, 02 :760F804A 6A01 push 00000001 :760F804C 8B1401 mov edx, dword ptr [ecx+eax] :760F804F 8B4D08 mov ecx, dword ptr [ebp+08] :760F8052 8911 mov dword ptr [ecx], edx :760F8054 8B5324 mov edx, dword ptr [ebx+24] :760F8057 893402 mov dword ptr [edx+eax], esi :760F805A 8A550C mov dl, byte ptr [ebp+0C] :760F805D 80FA69 cmp dl, 69 :760F8060 58 pop eax :760F8061 7431 je 760F8094 :760F8063 80FA49 cmp dl, 49 :760F8066 742C je 760F8094 :760F8068 80FA65 cmp dl, 65 :760F806B 741E je 760F808B :760F806D 80FA45 cmp dl, 45 :760F8070 7419 je 760F808B :760F8072 80FA73 cmp dl, 73 :760F8075 740B je 760F8082 :760F8077 80FA53 cmp dl, 53 :760F807A 7406 je 760F8082 :760F807C 83610C00 and dword ptr [ecx+0C], 00000000 :760F8080 EB15 jmp 760F8097 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F8075(C), :760F807A(C) | :760F8082 C7410C03000000 mov [ecx+0C], 00000003 :760F8089 EB0C jmp 760F8097 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F806B(C), :760F8070(C) | :760F808B C7410C02000000 mov [ecx+0C], 00000002 :760F8092 EB03 jmp 760F8097 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F8061(C), :760F8066(C) | :760F8094 89410C mov dword ptr [ecx+0C], eax * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F7FF2(U), :760F8080(U), :760F8089(U), :760F8092(U) | :760F8097 5F pop edi :760F8098 5E pop esi :760F8099 5B pop ebx :760F809A C9 leave :760F809B C20800 ret 0008 * Referenced by a CALL at Address: |:760F803C | :760F809E 8B542408 mov edx, dword ptr [esp+08] :760F80A2 33C0 xor eax, eax :760F80A4 56 push esi :760F80A5 0FB70A movzx ecx, word ptr [edx] :760F80A8 D1E9 shr ecx, 1 :760F80AA 49 dec ecx :760F80AB 8D7202 lea esi, dword ptr [edx+02] :760F80AE 85C9 test ecx, ecx :760F80B0 7E24 jle 760F80D6 :760F80B2 57 push edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F80D3(C) | :760F80B3 0FB716 movzx edx, word ptr [esi] :760F80B6 C1E004 shl eax, 04 :760F80B9 03C2 add eax, edx :760F80BB 46 inc esi :760F80BC 8BD0 mov edx, eax :760F80BE 46 inc esi :760F80BF 81E2000000F0 and edx, F0000000 :760F80C5 7407 je 760F80CE :760F80C7 8BFA mov edi, edx :760F80C9 C1EF18 shr edi, 18 :760F80CC 33C7 xor eax, edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F80C5(C) | :760F80CE F7D2 not edx :760F80D0 23C2 and eax, edx :760F80D2 49 dec ecx :760F80D3 75DE jne 760F80B3 :760F80D5 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F80B0(C) | :760F80D6 8B4C2408 mov ecx, dword ptr [esp+08] :760F80DA 33D2 xor edx, edx :760F80DC 5E pop esi :760F80DD F77118 div [ecx+18] :760F80E0 8BC2 mov eax, edx :760F80E2 C20800 ret 0008 * Referenced by a CALL at Address: |:760F7F37 | :760F80E5 55 push ebp :760F80E6 8BEC mov ebp, esp :760F80E8 51 push ecx :760F80E9 8365FC00 and dword ptr [ebp-04], 00000000 :760F80ED 53 push ebx :760F80EE 56 push esi :760F80EF 57 push edi :760F80F0 8B7D08 mov edi, dword ptr [ebp+08] :760F80F3 8BD9 mov ebx, ecx :760F80F5 85FF test edi, edi :760F80F7 7541 jne 760F813A :760F80F9 A184110E76 mov eax, dword ptr [760E1184] :760F80FE F60002 test byte ptr [eax], 02 :760F8101 0F84BA000000 je 760F81C1 :760F8107 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDHashList::CreatePathElem" | :760F8109 68A8AD0E76 push 760EADA8 :760F810E 6858010000 push 00000158 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdhashl" ->"ist.cpp" | :760F8113 68D8E00F76 push 760FE0D8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F8118 FF1580110E76 Call dword ptr [760E1180] :760F811E 85C0 test eax, eax :760F8120 0F849B000000 je 760F81C1 :760F8126 57 push edi * Possible StringData Ref from Code Obj ->"NULL pszData sent to CreatePathElem" | :760F8127 6884AD0E76 push 760EAD84 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F81B6(U) | :760F812C 53 push ebx :760F812D E8F94DFFFF call 760ECF2B :760F8132 83C40C add esp, 0000000C :760F8135 E987000000 jmp 760F81C1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F80F7(C) | :760F813A 83C9FF or ecx, FFFFFFFF :760F813D 33C0 xor eax, eax :760F813F F2 repnz :760F8140 AE scasb :760F8141 8B750C mov esi, dword ptr [ebp+0C] :760F8144 6800040000 push 00000400 :760F8149 F7D1 not ecx :760F814B 49 dec ecx :760F814C 8D7E08 lea edi, dword ptr [esi+08] :760F814F 8D440902 lea eax, dword ptr [ecx+ecx+02] :760F8153 03C9 add ecx, ecx :760F8155 8BD1 mov edx, ecx :760F8157 668906 mov word ptr [esi], ax :760F815A 33C0 xor eax, eax :760F815C C1E902 shr ecx, 02 :760F815F F3 repz :760F8160 AB stosd :760F8161 8BCA mov ecx, edx :760F8163 83E103 and ecx, 00000003 :760F8166 F3 repz :760F8167 AA stosb :760F8168 8D4602 lea eax, dword ptr [esi+02] :760F816B 50 push eax :760F816C 6AFF push FFFFFFFF :760F816E FF7508 push [ebp+08] :760F8171 6A00 push 00000000 :760F8173 E80DA7FEFF call 760E2885 :760F8178 50 push eax * Reference To: KERNEL32.MultiByteToWideChar, Ord:0202h | :760F8179 FF154C120E76 Call dword ptr [760E124C] :760F817F 85C0 test eax, eax :760F8181 7538 jne 760F81BB * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F8183 FF15A0110E76 Call dword ptr [760E11A0] :760F8189 8BF0 mov esi, eax :760F818B A184110E76 mov eax, dword ptr [760E1184] :760F8190 F60002 test byte ptr [eax], 02 :760F8193 742C je 760F81C1 :760F8195 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDHashList::CreatePathElem" | :760F8197 68A8AD0E76 push 760EADA8 :760F819C 686F010000 push 0000016F * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdhashl" ->"ist.cpp" | :760F81A1 68D8E00F76 push 760FE0D8 * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F81A6 FF1580110E76 Call dword ptr [760E1180] :760F81AC 85C0 test eax, eax :760F81AE 7411 je 760F81C1 :760F81B0 56 push esi * Possible StringData Ref from Code Obj ->"Error converting to Wide char " ->"ec-%d" | :760F81B1 6860AD0E76 push 760EAD60 :760F81B6 E971FFFFFF jmp 760F812C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8181(C) | :760F81BB 0FB706 movzx eax, word ptr [esi] :760F81BE 8945FC mov dword ptr [ebp-04], eax * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F8101(C), :760F8120(C), :760F8135(U), :760F8193(C), :760F81AE(C) | :760F81C1 8B45FC mov eax, dword ptr [ebp-04] :760F81C4 5F pop edi :760F81C5 5E pop esi :760F81C6 5B pop ebx :760F81C7 C9 leave :760F81C8 C20800 ret 0008 * Referenced by a CALL at Addresses: |:760F7A76 , :760F7B16 , :760F856B , :760F85CC , :760F85D7 | :760F81CB 8B4114 mov eax, dword ptr [ecx+14] :760F81CE C3 ret * Referenced by a CALL at Addresses: |:760F7B1F , :760F85E1 | :760F81CF 8B4104 mov eax, dword ptr [ecx+04] :760F81D2 C3 ret * Referenced by a CALL at Address: |:760F753D | :760F81D3 8BC1 mov eax, ecx :760F81D5 33C9 xor ecx, ecx :760F81D7 8908 mov dword ptr [eax], ecx :760F81D9 894804 mov dword ptr [eax+04], ecx :760F81DC 894808 mov dword ptr [eax+08], ecx :760F81DF 89480C mov dword ptr [eax+0C], ecx :760F81E2 894810 mov dword ptr [eax+10], ecx :760F81E5 894814 mov dword ptr [eax+14], ecx :760F81E8 8B4C2404 mov ecx, dword ptr [esp+04] :760F81EC 894818 mov dword ptr [eax+18], ecx :760F81EF C20400 ret 0004 * Referenced by a CALL at Addresses: |:760F7B7C , :760F7BAC , :760F7BC7 , :760F8263 | :760F81F2 56 push esi :760F81F3 8BF1 mov esi, ecx :760F81F5 57 push edi :760F81F6 33FF xor edi, edi :760F81F8 8B06 mov eax, dword ptr [esi] :760F81FA 3BC7 cmp eax, edi :760F81FC 7425 je 760F8223 :760F81FE 50 push eax :760F81FF 57 push edi :760F8200 FF7618 push [esi+18] * Reference To: KERNEL32.HeapFree, Ord:01BAh | :760F8203 FF15FC110E76 Call dword ptr [760E11FC] :760F8209 85C0 test eax, eax :760F820B 7514 jne 760F8221 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F820D FF15A0110E76 Call dword ptr [760E11A0] :760F8213 50 push eax :760F8214 68C8AD0E76 push 760EADC8 * Reference To: MSVCRT.printf, Ord:029Bh | :760F8219 FF1544100E76 Call dword ptr [760E1044] :760F821F 59 pop ecx :760F8220 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F820B(C) | :760F8221 893E mov dword ptr [esi], edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F81FC(C) | :760F8223 897E04 mov dword ptr [esi+04], edi :760F8226 897E08 mov dword ptr [esi+08], edi :760F8229 897E0C mov dword ptr [esi+0C], edi :760F822C 897E10 mov dword ptr [esi+10], edi :760F822F 897E14 mov dword ptr [esi+14], edi :760F8232 5F pop edi :760F8233 5E pop esi :760F8234 C3 ret * Referenced by a CALL at Address: |:760F779B | :760F8235 55 push ebp :760F8236 8BEC mov ebp, esp :760F8238 53 push ebx :760F8239 8B5D0C mov ebx, dword ptr [ebp+0C] :760F823C 56 push esi :760F823D 8BF1 mov esi, ecx :760F823F 8B4D14 mov ecx, dword ptr [ebp+14] :760F8242 8BC3 mov eax, ebx :760F8244 6BC90B imul ecx, 0000000B :760F8247 6BC00E imul eax, 0000000E :760F824A 034D1C add ecx, dword ptr [ebp+1C] :760F824D 57 push edi :760F824E 03C8 add ecx, eax :760F8250 8B4518 mov eax, dword ptr [ebp+18] :760F8253 8D0C81 lea ecx, dword ptr [ecx+4*eax] :760F8256 8D5C4B46 lea ebx, dword ptr [ebx+2*ecx+46] :760F825A 8BCE mov ecx, esi :760F825C 03D8 add ebx, eax :760F825E 035D20 add ebx, dword ptr [ebp+20] :760F8261 D1E3 shl ebx, 1 :760F8263 E88AFFFFFF call 760F81F2 :760F8268 53 push ebx :760F8269 6A00 push 00000000 :760F826B FF7618 push [esi+18] * Reference To: KERNEL32.HeapAlloc, Ord:01B4h | :760F826E FF15EC110E76 Call dword ptr [760E11EC] :760F8274 8BF8 mov edi, eax :760F8276 85FF test edi, edi :760F8278 893E mov dword ptr [esi], edi :760F827A 7538 jne 760F82B4 :760F827C A184110E76 mov eax, dword ptr [760E1184] :760F8281 F60004 test byte ptr [eax], 04 :760F8284 0F84E2000000 je 760F836C :760F828A 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CVXDPathTree::BuildTree" | :760F828C 68ECAD0E76 push 760EADEC :760F8291 6896000000 push 00000096 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdpatht" ->"ree.cpp" | :760F8296 682CE10F76 push 760FE12C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F829B FF1580110E76 Call dword ptr [760E1180] :760F82A1 85C0 test eax, eax :760F82A3 0F84C3000000 je 760F836C :760F82A9 57 push edi :760F82AA 6898AC0E76 push 760EAC98 :760F82AF E9AF000000 jmp 760F8363 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F827A(C) | :760F82B4 8BCB mov ecx, ebx :760F82B6 33C0 xor eax, eax :760F82B8 8BD1 mov edx, ecx :760F82BA 6A01 push 00000001 :760F82BC C1E902 shr ecx, 02 :760F82BF F3 repz :760F82C0 AB stosd :760F82C1 8BCA mov ecx, edx :760F82C3 83E103 and ecx, 00000003 :760F82C6 F3 repz :760F82C7 AA stosb :760F82C8 8B06 mov eax, dword ptr [esi] :760F82CA 894614 mov dword ptr [esi+14], eax :760F82CD 89460C mov dword ptr [esi+0C], eax :760F82D0 8D888C000000 lea ecx, dword ptr [eax+0000008C] :760F82D6 894E10 mov dword ptr [esi+10], ecx :760F82D9 59 pop ecx :760F82DA 894808 mov dword ptr [eax+08], ecx :760F82DD 8B4614 mov eax, dword ptr [esi+14] :760F82E0 6A00 push 00000000 :760F82E2 894804 mov dword ptr [eax+04], ecx :760F82E5 8B4614 mov eax, dword ptr [esi+14] :760F82E8 8B4D0C mov ecx, dword ptr [ebp+0C] :760F82EB FF7508 push [ebp+08] :760F82EE 89480C mov dword ptr [eax+0C], ecx :760F82F1 8B4614 mov eax, dword ptr [esi+14] :760F82F4 8918 mov dword ptr [eax], ebx :760F82F6 8BC1 mov eax, ecx :760F82F8 6BC038 imul eax, 00000038 :760F82FB 8B7E0C mov edi, dword ptr [esi+0C] :760F82FE 8D908C000000 lea edx, dword ptr [eax+0000008C] :760F8304 895718 mov dword ptr [edi+18], edx :760F8307 8B560C mov edx, dword ptr [esi+0C] :760F830A 894A10 mov dword ptr [edx+10], ecx :760F830D 8BD3 mov edx, ebx :760F830F 2BD0 sub edx, eax :760F8311 8B460C mov eax, dword ptr [esi+0C] :760F8314 81EA8C000000 sub edx, 0000008C :760F831A 895014 mov dword ptr [eax+14], edx :760F831D 8B460C mov eax, dword ptr [esi+0C] :760F8320 8B5510 mov edx, dword ptr [ebp+10] :760F8323 895020 mov dword ptr [eax+20], edx :760F8326 894E04 mov dword ptr [esi+04], ecx :760F8329 8BCE mov ecx, esi :760F832B 895E08 mov dword ptr [esi+08], ebx :760F832E E847000000 call 760F837A :760F8333 85C0 test eax, eax :760F8335 7539 jne 760F8370 :760F8337 A184110E76 mov eax, dword ptr [760E1184] :760F833C F60004 test byte ptr [eax], 04 :760F833F 742B je 760F836C :760F8341 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CVXDPathTree::BuildTree" | :760F8343 68ECAD0E76 push 760EADEC :760F8348 68B2000000 push 000000B2 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdpatht" ->"ree.cpp" | :760F834D 682CE10F76 push 760FE12C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F8352 FF1580110E76 Call dword ptr [760E1180] :760F8358 85C0 test eax, eax :760F835A 7410 je 760F836C :760F835C 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error building path tree blob" | :760F835E 68CCAD0E76 push 760EADCC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F82AF(U) | :760F8363 56 push esi :760F8364 E8C24BFFFF call 760ECF2B :760F8369 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F8284(C), :760F82A3(C), :760F833F(C), :760F835A(C) | :760F836C 33C0 xor eax, eax :760F836E EB03 jmp 760F8373 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8335(C) | :760F8370 6A01 push 00000001 :760F8372 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F836E(U) | :760F8373 5F pop edi :760F8374 5E pop esi :760F8375 5B pop ebx :760F8376 5D pop ebp :760F8377 C21C00 ret 001C * Referenced by a CALL at Addresses: |:760F832E , :760F864E , :760F8665 | :760F837A 55 push ebp :760F837B 8BEC mov ebp, esp :760F837D 81EC34040000 sub esp, 00000434 :760F8383 53 push ebx :760F8384 56 push esi :760F8385 57 push edi :760F8386 8BF1 mov esi, ecx :760F8388 33FF xor edi, edi :760F838A 8975FC mov dword ptr [ebp-04], esi :760F838D 393E cmp dword ptr [esi], edi :760F838F 0F84D9020000 je 760F866E :760F8395 8B4508 mov eax, dword ptr [ebp+08] :760F8398 3BC7 cmp eax, edi :760F839A 0F84D2020000 je 760F8672 :760F83A0 8B5820 mov ebx, dword ptr [eax+20] :760F83A3 8B4814 mov ecx, dword ptr [eax+14] :760F83A6 6BDB38 imul ebx, 00000038 :760F83A9 035E10 add ebx, dword ptr [esi+10] :760F83AC 3BCF cmp ecx, edi :760F83AE 7405 je 760F83B5 :760F83B0 8B4920 mov ecx, dword ptr [ecx+20] :760F83B3 890B mov dword ptr [ebx], ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F83AE(C) | :760F83B5 8B481C mov ecx, dword ptr [eax+1C] :760F83B8 3BCF cmp ecx, edi :760F83BA 7406 je 760F83C2 :760F83BC 8B4920 mov ecx, dword ptr [ecx+20] :760F83BF 894B08 mov dword ptr [ebx+08], ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F83BA(C) | :760F83C2 8B4818 mov ecx, dword ptr [eax+18] :760F83C5 3BCF cmp ecx, edi :760F83C7 7406 je 760F83CF :760F83C9 8B4920 mov ecx, dword ptr [ecx+20] :760F83CC 894B04 mov dword ptr [ebx+04], ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F83C7(C) | :760F83CF 8A4804 mov cl, byte ptr [eax+04] :760F83D2 80F969 cmp cl, 69 :760F83D5 7430 je 760F8407 :760F83D7 80F949 cmp cl, 49 :760F83DA 742B je 760F8407 :760F83DC 80F965 cmp cl, 65 :760F83DF 741D je 760F83FE :760F83E1 80F945 cmp cl, 45 :760F83E4 7418 je 760F83FE :760F83E6 80F973 cmp cl, 73 :760F83E9 740A je 760F83F5 :760F83EB 80F953 cmp cl, 53 :760F83EE 7405 je 760F83F5 :760F83F0 897B14 mov dword ptr [ebx+14], edi :760F83F3 EB19 jmp 760F840E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F83E9(C), :760F83EE(C) | :760F83F5 C7431403000000 mov [ebx+14], 00000003 :760F83FC EB10 jmp 760F840E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F83DF(C), :760F83E4(C) | :760F83FE C7431402000000 mov [ebx+14], 00000002 :760F8405 EB07 jmp 760F840E * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F83D5(C), :760F83DA(C) | :760F8407 C7431401000000 mov [ebx+14], 00000001 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F83F3(U), :760F83FC(U), :760F8405(U) | :760F840E 8D8DCCFBFFFF lea ecx, dword ptr [ebp+FFFFFBCC] :760F8414 51 push ecx :760F8415 8BCE mov ecx, esi :760F8417 FF30 push dword ptr [eax] :760F8419 E865020000 call 760F8683 :760F841E 3BC7 cmp eax, edi :760F8420 7535 jne 760F8457 :760F8422 A184110E76 mov eax, dword ptr [760E1184] :760F8427 F60004 test byte ptr [eax], 04 :760F842A 0F843E020000 je 760F866E :760F8430 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CVXDPathTree::RecBuildTree" | :760F8432 6894AE0E76 push 760EAE94 :760F8437 68FA000000 push 000000FA * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdpatht" ->"ree.cpp" | :760F843C 682CE10F76 push 760FE12C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F8441 FF1580110E76 Call dword ptr [760E1180] :760F8447 85C0 test eax, eax :760F8449 0F841F020000 je 760F866E :760F844F 57 push edi * Possible StringData Ref from Code Obj ->"Error creating path element" | :760F8450 6878AE0E76 push 760EAE78 :760F8455 EB42 jmp 760F8499 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8420(C) | :760F8457 8B4E0C mov ecx, dword ptr [esi+0C] :760F845A 8B5608 mov edx, dword ptr [esi+08] :760F845D 8B4918 mov ecx, dword ptr [ecx+18] :760F8460 2BD1 sub edx, ecx :760F8462 3BC2 cmp eax, edx :760F8464 7641 jbe 760F84A7 :760F8466 A184110E76 mov eax, dword ptr [760E1184] :760F846B F60004 test byte ptr [eax], 04 :760F846E 0F84FA010000 je 760F866E :760F8474 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CVXDPathTree::RecBuildTree" | :760F8476 6894AE0E76 push 760EAE94 :760F847B 6800010000 push 00000100 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdpatht" ->"ree.cpp" | :760F8480 682CE10F76 push 760FE12C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F8485 FF1580110E76 Call dword ptr [760E1180] :760F848B 85C0 test eax, eax :760F848D 0F84DB010000 je 760F866E :760F8493 57 push edi * Possible StringData Ref from Code Obj ->"Not enougn memory to allocate " ->"path element." | :760F8494 684CAE0E76 push 760EAE4C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8455(U) | :760F8499 56 push esi :760F849A E88C4AFFFF call 760ECF2B :760F849F 83C40C add esp, 0000000C :760F84A2 E9C7010000 jmp 760F866E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8464(C) | :760F84A7 894B0C mov dword ptr [ebx+0C], ecx :760F84AA 8B560C mov edx, dword ptr [esi+0C] :760F84AD 8BC8 mov ecx, eax :760F84AF 8DB5CCFBFFFF lea esi, dword ptr [ebp+FFFFFBCC] :760F84B5 014218 add dword ptr [edx+18], eax :760F84B8 8B45FC mov eax, dword ptr [ebp-04] :760F84BB 8B7B0C mov edi, dword ptr [ebx+0C] :760F84BE 8BD1 mov edx, ecx :760F84C0 0338 add edi, dword ptr [eax] :760F84C2 C1E902 shr ecx, 02 :760F84C5 F3 repz :760F84C6 A5 movsd :760F84C7 8BCA mov ecx, edx :760F84C9 83E103 and ecx, 00000003 :760F84CC F3 repz :760F84CD A4 movsb :760F84CE 8B7508 mov esi, dword ptr [ebp+08] :760F84D1 8B4E24 mov ecx, dword ptr [esi+24] :760F84D4 894B18 mov dword ptr [ebx+18], ecx :760F84D7 8B4E08 mov ecx, dword ptr [esi+08] :760F84DA 85C9 test ecx, ecx :760F84DC 0F8438010000 je 760F861A :760F84E2 FF7018 push [eax+18] :760F84E5 8BF9 mov edi, ecx :760F84E7 8D4DCC lea ecx, dword ptr [ebp-34] :760F84EA E828F8FFFF call 760F7D17 :760F84EF FF7610 push [esi+10] :760F84F2 8D4DCC lea ecx, dword ptr [ebp-34] :760F84F5 FF760C push [esi+0C] :760F84F8 E87FF8FFFF call 760F7D7C :760F84FD 85C0 test eax, eax :760F84FF 7539 jne 760F853A :760F8501 A184110E76 mov eax, dword ptr [760E1184] :760F8506 F60004 test byte ptr [eax], 04 :760F8509 0F84A7000000 je 760F85B6 :760F850F 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CVXDPathTree::RecBuildTree" | :760F8511 6894AE0E76 push 760EAE94 :760F8516 6815010000 push 00000115 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdpatht" ->"ree.cpp" | :760F851B 682CE10F76 push 760FE12C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F8520 FF1580110E76 Call dword ptr [760E1180] :760F8526 85C0 test eax, eax :760F8528 0F8488000000 je 760F85B6 :760F852E 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Error initializeing a hashlist " ->"blob" | :760F8530 6828AE0E76 push 760EAE28 :760F8535 FF75FC push [ebp-04] :760F8538 EB74 jmp 760F85AE * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F84FF(C), :760F8553(U) | :760F853A 85FF test edi, edi :760F853C 7421 je 760F855F :760F853E 8A4704 mov al, byte ptr [edi+04] :760F8541 8D4DCC lea ecx, dword ptr [ebp-34] :760F8544 50 push eax :760F8545 FF37 push dword ptr [edi] :760F8547 E8D3F9FFFF call 760F7F1F :760F854C 85C0 test eax, eax :760F854E 7405 je 760F8555 :760F8550 8B7F08 mov edi, dword ptr [edi+08] :760F8553 EBE5 jmp 760F853A * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F854E(C) | :760F8555 8D4DCC lea ecx, dword ptr [ebp-34] :760F8558 E8E9F7FFFF call 760F7D46 :760F855D EB57 jmp 760F85B6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F853C(C) | :760F855F 8B75FC mov esi, dword ptr [ebp-04] :760F8562 8D4DCC lea ecx, dword ptr [ebp-34] :760F8565 8B460C mov eax, dword ptr [esi+0C] :760F8568 8B7818 mov edi, dword ptr [eax+18] :760F856B E85BFCFFFF call 760F81CB :760F8570 8B4E08 mov ecx, dword ptr [esi+08] :760F8573 2BCF sub ecx, edi :760F8575 3BC1 cmp eax, ecx :760F8577 764A jbe 760F85C3 :760F8579 8D4DCC lea ecx, dword ptr [ebp-34] :760F857C E8C5F7FFFF call 760F7D46 :760F8581 A184110E76 mov eax, dword ptr [760E1184] :760F8586 F60004 test byte ptr [eax], 04 :760F8589 742B je 760F85B6 :760F858B 6A04 push 00000004 * Possible StringData Ref from Code Obj ->"CVXDPathTree::RecBuildTree" | :760F858D 6894AE0E76 push 760EAE94 :760F8592 6827010000 push 00000127 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdpatht" ->"ree.cpp" | :760F8597 682CE10F76 push 760FE12C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F859C FF1580110E76 Call dword ptr [760E1180] :760F85A2 85C0 test eax, eax :760F85A4 7410 je 760F85B6 :760F85A6 6A00 push 00000000 * Possible StringData Ref from Code Obj ->"Hash blob too big to fit in memory." | :760F85A8 6804AE0E76 push 760EAE04 :760F85AD 56 push esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8538(U) | :760F85AE E87849FFFF call 760ECF2B :760F85B3 83C40C add esp, 0000000C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F8509(C), :760F8528(C), :760F855D(U), :760F8589(C), :760F85A4(C) | :760F85B6 8D4DCC lea ecx, dword ptr [ebp-34] :760F85B9 E882F7FFFF call 760F7D40 :760F85BE E9AB000000 jmp 760F866E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8577(C) | :760F85C3 897B10 mov dword ptr [ebx+10], edi :760F85C6 8B760C mov esi, dword ptr [esi+0C] :760F85C9 8D4DCC lea ecx, dword ptr [ebp-34] :760F85CC E8FAFBFFFF call 760F81CB :760F85D1 014618 add dword ptr [esi+18], eax :760F85D4 8D4DCC lea ecx, dword ptr [ebp-34] :760F85D7 E8EFFBFFFF call 760F81CB :760F85DC 8D4DCC lea ecx, dword ptr [ebp-34] :760F85DF 8BF8 mov edi, eax :760F85E1 E8E9FBFFFF call 760F81CF :760F85E6 8BF0 mov esi, eax :760F85E8 8B45FC mov eax, dword ptr [ebp-04] :760F85EB 897DF8 mov dword ptr [ebp-08], edi :760F85EE 8B7B10 mov edi, dword ptr [ebx+10] :760F85F1 0338 add edi, dword ptr [eax] :760F85F3 8B45F8 mov eax, dword ptr [ebp-08] :760F85F6 8BC8 mov ecx, eax :760F85F8 C1E902 shr ecx, 02 :760F85FB F3 repz :760F85FC A5 movsd :760F85FD 8BC8 mov ecx, eax :760F85FF 83E103 and ecx, 00000003 :760F8602 F3 repz :760F8603 A4 movsb :760F8604 8D4DCC lea ecx, dword ptr [ebp-34] :760F8607 E83AF7FFFF call 760F7D46 :760F860C 8D4DCC lea ecx, dword ptr [ebp-34] :760F860F E82CF7FFFF call 760F7D40 :760F8614 8B45FC mov eax, dword ptr [ebp-04] :760F8617 8B7508 mov esi, dword ptr [ebp+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F84DC(C) | :760F861A 8B7D0C mov edi, dword ptr [ebp+0C] :760F861D 83FF01 cmp edi, 00000001 :760F8620 751E jne 760F8640 :760F8622 8B0E mov ecx, dword ptr [esi] :760F8624 8A09 mov cl, byte ptr [ecx] :760F8626 80F941 cmp cl, 41 :760F8629 7C43 jl 760F866E :760F862B 80F95A cmp cl, 5A :760F862E 7F3E jg 760F866E :760F8630 8B500C mov edx, dword ptr [eax+0C] :760F8633 8B5E20 mov ebx, dword ptr [esi+20] :760F8636 0FBEC9 movsx ecx, cl :760F8639 899C8A20FFFFFF mov dword ptr [edx+4*ecx-000000E0], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8620(C) | :760F8640 8B4E18 mov ecx, dword ptr [esi+18] :760F8643 85C9 test ecx, ecx :760F8645 7413 je 760F865A :760F8647 8D5701 lea edx, dword ptr [edi+01] :760F864A 52 push edx :760F864B 51 push ecx :760F864C 8BC8 mov ecx, eax :760F864E E827FDFFFF call 760F837A :760F8653 85C0 test eax, eax :760F8655 7417 je 760F866E :760F8657 8B45FC mov eax, dword ptr [ebp-04] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8645(C) | :760F865A 8B761C mov esi, dword ptr [esi+1C] :760F865D 85F6 test esi, esi :760F865F 7411 je 760F8672 :760F8661 57 push edi :760F8662 56 push esi :760F8663 8BC8 mov ecx, eax :760F8665 E810FDFFFF call 760F837A :760F866A 85C0 test eax, eax :760F866C 7504 jne 760F8672 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F838F(C), :760F842A(C), :760F8449(C), :760F846E(C), :760F848D(C) |:760F84A2(U), :760F85BE(U), :760F8629(C), :760F862E(C), :760F8655(C) | :760F866E 33C0 xor eax, eax :760F8670 EB03 jmp 760F8675 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F839A(C), :760F865F(C), :760F866C(C) | :760F8672 6A01 push 00000001 :760F8674 58 pop eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8670(U) | :760F8675 5F pop edi :760F8676 5E pop esi :760F8677 5B pop ebx :760F8678 C9 leave :760F8679 C20800 ret 0008 * Referenced by a CALL at Addresses: |:760F7A80 , :760F7ADF | :760F867C 8B4108 mov eax, dword ptr [ecx+08] :760F867F C3 ret * Referenced by a CALL at Address: |:760F7AE8 | :760F8680 8B01 mov eax, dword ptr [ecx] :760F8682 C3 ret * Referenced by a CALL at Address: |:760F8419 | :760F8683 55 push ebp :760F8684 8BEC mov ebp, esp :760F8686 51 push ecx :760F8687 8365FC00 and dword ptr [ebp-04], 00000000 :760F868B 53 push ebx :760F868C 56 push esi :760F868D 57 push edi :760F868E 8B7D08 mov edi, dword ptr [ebp+08] :760F8691 8BD9 mov ebx, ecx :760F8693 85FF test edi, edi :760F8695 7541 jne 760F86D8 :760F8697 A184110E76 mov eax, dword ptr [760E1184] :760F869C F60002 test byte ptr [eax], 02 :760F869F 0F84BA000000 je 760F875F :760F86A5 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDHashList::CreatePathElem" | :760F86A7 68A8AD0E76 push 760EADA8 :760F86AC 6877010000 push 00000177 * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdpatht" ->"ree.cpp" | :760F86B1 682CE10F76 push 760FE12C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F86B6 FF1580110E76 Call dword ptr [760E1180] :760F86BC 85C0 test eax, eax :760F86BE 0F849B000000 je 760F875F :760F86C4 57 push edi * Possible StringData Ref from Code Obj ->"NULL pszData sent to CreatePathElem" | :760F86C5 6884AD0E76 push 760EAD84 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8754(U) | :760F86CA 53 push ebx :760F86CB E85B48FFFF call 760ECF2B :760F86D0 83C40C add esp, 0000000C :760F86D3 E987000000 jmp 760F875F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8695(C) | :760F86D8 83C9FF or ecx, FFFFFFFF :760F86DB 33C0 xor eax, eax :760F86DD F2 repnz :760F86DE AE scasb :760F86DF 8B750C mov esi, dword ptr [ebp+0C] :760F86E2 6800040000 push 00000400 :760F86E7 F7D1 not ecx :760F86E9 49 dec ecx :760F86EA 8D7E08 lea edi, dword ptr [esi+08] :760F86ED 8D440902 lea eax, dword ptr [ecx+ecx+02] :760F86F1 03C9 add ecx, ecx :760F86F3 8BD1 mov edx, ecx :760F86F5 668906 mov word ptr [esi], ax :760F86F8 33C0 xor eax, eax :760F86FA C1E902 shr ecx, 02 :760F86FD F3 repz :760F86FE AB stosd :760F86FF 8BCA mov ecx, edx :760F8701 83E103 and ecx, 00000003 :760F8704 F3 repz :760F8705 AA stosb :760F8706 8D4602 lea eax, dword ptr [esi+02] :760F8709 50 push eax :760F870A 6AFF push FFFFFFFF :760F870C FF7508 push [ebp+08] :760F870F 6A00 push 00000000 :760F8711 E86FA1FEFF call 760E2885 :760F8716 50 push eax * Reference To: KERNEL32.MultiByteToWideChar, Ord:0202h | :760F8717 FF154C120E76 Call dword ptr [760E124C] :760F871D 85C0 test eax, eax :760F871F 7538 jne 760F8759 * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F8721 FF15A0110E76 Call dword ptr [760E11A0] :760F8727 8BF0 mov esi, eax :760F8729 A184110E76 mov eax, dword ptr [760E1184] :760F872E F60002 test byte ptr [eax], 02 :760F8731 742C je 760F875F :760F8733 6A02 push 00000002 * Possible StringData Ref from Code Obj ->"CVXDHashList::CreatePathElem" | :760F8735 68A8AD0E76 push 760EADA8 :760F873A 688D010000 push 0000018D * Possible StringData Ref from Data Obj ->"d:\mpcfre\restore\src\vxd\vxdbuilder\cvxdpatht" ->"ree.cpp" | :760F873F 682CE10F76 push 760FE12C * Reference To: ATRACE._SetAsyncTraceParams@16, Ord:0006h | :760F8744 FF1580110E76 Call dword ptr [760E1180] :760F874A 85C0 test eax, eax :760F874C 7411 je 760F875F :760F874E 56 push esi * Possible StringData Ref from Code Obj ->"Error converting to Wide char " ->"ec-%d" | :760F874F 6860AD0E76 push 760EAD60 :760F8754 E971FFFFFF jmp 760F86CA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F871F(C) | :760F8759 0FB706 movzx eax, word ptr [esi] :760F875C 8945FC mov dword ptr [ebp-04], eax * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F869F(C), :760F86BE(C), :760F86D3(U), :760F8731(C), :760F874C(C) | :760F875F 8B45FC mov eax, dword ptr [ebp-04] :760F8762 5F pop edi :760F8763 5E pop esi :760F8764 5B pop ebx :760F8765 C9 leave :760F8766 C20800 ret 0008 :760F8769 56 push esi :760F876A 8BF1 mov esi, ecx * Reference To: MSVCRT.??1type_info@@UAE@XZ, Ord:000Eh | :760F876C E84D000000 Call 760F87BE :760F8771 F644240801 test [esp+08], 01 :760F8776 7409 je 760F8781 :760F8778 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F8779 E8CD91FEFF Call 760E194B :760F877E 83C404 add esp, 00000004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8776(C) | :760F8781 8BC6 mov eax, esi :760F8783 5E pop esi :760F8784 C20400 ret 0004 * Referenced by a CALL at Address: |:760F2386 | :760F8787 80F940 cmp cl, 40 :760F878A 7315 jnb 760F87A1 :760F878C 80F920 cmp cl, 20 :760F878F 7306 jnb 760F8797 :760F8791 0FA5C2 shld edx, eax, cl :760F8794 D3E0 shl eax, cl :760F8796 C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F878F(C) | :760F8797 8BD0 mov edx, eax :760F8799 33C0 xor eax, eax :760F879B 80E11F and cl, 1F :760F879E D3E2 shl edx, cl :760F87A0 C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F878A(C) | :760F87A1 33C0 xor eax, eax :760F87A3 33D2 xor edx, edx :760F87A5 C3 ret * Reference To: MSVCRT._except_handler3, Ord:00C7h | :760F87A6 FF255C100E76 Jmp dword ptr [760E105C] * Referenced by a CALL at Address: |:760F40E7 | * Reference To: MSVCRT._local_unwind2, Ord:0139h | :760F87AC FF2560100E76 Jmp dword ptr [760E1060] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E228D(C) | :760F87B2 0FADD0 shrd eax, edx, cl :760F87B5 D3FA sar edx, cl :760F87B7 C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E2284(C) | :760F87B8 C1FA1F sar edx, 1F :760F87BB 8BC2 mov eax, edx :760F87BD C3 ret * Referenced by a CALL at Address: |:760F876C | * Reference To: MSVCRT.??1type_info@@UAE@XZ, Ord:000Eh | :760F87BE FF256C100E76 Jmp dword ptr [760E106C] * Referenced by a CALL at Addresses: |:760F3266 , :760F327F , :760F3295 , :760F3EC3 , :760F3ED5 |:760F3EF3 , :760F87DD , :760F8812 , :760F8840 , :760F8856 |:760F887D | :760F87C4 6A00 push 00000000 :760F87C6 FF742408 push [esp+08] :760F87CA E8B8000000 call 760F8887 :760F87CF C20400 ret 0004 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E1910(C) | :760F87D2 6683FF0B cmp di, 000B :760F87D6 740A je 760F87E2 :760F87D8 6857000780 push 80070057 :760F87DD E8E2FFFFFF call 760F87C4 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760E1906(C), :760F87D6(C) | :760F87E2 6683FF0A cmp di, 000A :760F87E6 7505 jne 760F87ED :760F87E8 E92991FEFF jmp 760E1916 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F87E6(C) | :760F87ED 6683FF0B cmp di, 000B :760F87F1 7514 jne 760F8807 :760F87F3 8B44240C mov eax, dword ptr [esp+0C] :760F87F7 66893E mov word ptr [esi], di :760F87FA F7D8 neg eax :760F87FC 1BC0 sbb eax, eax :760F87FE 66894608 mov word ptr [esi+08], ax :760F8802 E91B91FEFF jmp 760E1922 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F87F1(C) | :760F8807 66C7060300 mov word ptr [esi], 0003 :760F880C E90A91FEFF jmp 760E191B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E16A3(C) | :760F8811 50 push eax :760F8812 E8ADFFFFFF call 760F87C4 :760F8817 E98D8EFEFF jmp 760E16A9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E518F(C) | :760F881C 33C0 xor eax, eax :760F881E E9B1C9FEFF jmp 760E51D4 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E51C7(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F8823 8B35A0110E76 mov esi, dword ptr [760E11A0] :760F8829 FFD6 call esi :760F882B 85C0 test eax, eax :760F882D 7F04 jg 760F8833 :760F882F FFD6 call esi :760F8831 EB0C jmp 760F883F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F882D(C) | :760F8833 FFD6 call esi :760F8835 25FFFF0000 and eax, 0000FFFF :760F883A 0D00000780 or eax, 80070000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8831(U) | :760F883F 50 push eax :760F8840 E87FFFFFFF call 760F87C4 :760F8845 E983C9FEFF jmp 760E51CD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E41D6(C) | :760F884A 33C0 xor eax, eax :760F884C E9C6B9FEFF jmp 760E4217 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E41F4(C) | :760F8851 680E000780 push 8007000E :760F8856 E869FFFFFF call 760F87C4 :760F885B E99AB9FEFF jmp 760E41FA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760E420D(C) | * Reference To: KERNEL32.GetLastError, Ord:012Dh | :760F8860 8B3DA0110E76 mov edi, dword ptr [760E11A0] :760F8866 FFD7 call edi :760F8868 85C0 test eax, eax :760F886A 7F04 jg 760F8870 :760F886C FFD7 call edi :760F886E EB0C jmp 760F887C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F886A(C) | :760F8870 FFD7 call edi :760F8872 25FFFF0000 and eax, 0000FFFF :760F8877 0D00000780 or eax, 80070000 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F886E(U) | :760F887C 50 push eax :760F887D E842FFFFFF call 760F87C4 :760F8882 E98CB9FEFF jmp 760E4213 * Referenced by a CALL at Address: |:760F87CA | :760F8887 55 push ebp :760F8888 8BEC mov ebp, esp :760F888A 83EC10 sub esp, 00000010 :760F888D 6A00 push 00000000 :760F888F 8D4DF0 lea ecx, dword ptr [ebp-10] :760F8892 FF750C push [ebp+0C] :760F8895 FF7508 push [ebp+08] :760F8898 E812000000 call 760F88AF :760F889D 8D45F0 lea eax, dword ptr [ebp-10] :760F88A0 6888890F76 push 760F8988 :760F88A5 50 push eax * Reference To: MSVCRT._CxxThrowException, Ord:0041h | :760F88A6 E8AB000000 Call 760F8956 :760F88AB C9 leave :760F88AC C20800 ret 0008 * Referenced by a CALL at Address: |:760F8898 | :760F88AF 8B442404 mov eax, dword ptr [esp+04] :760F88B3 56 push esi :760F88B4 8BF1 mov esi, ecx :760F88B6 83660C00 and dword ptr [esi+0C], 00000000 :760F88BA 894604 mov dword ptr [esi+04], eax :760F88BD 8B44240C mov eax, dword ptr [esp+0C] :760F88C1 C706B0AE0E76 mov dword ptr [esi], 760EAEB0 :760F88C7 85C0 test eax, eax :760F88C9 894608 mov dword ptr [esi+08], eax :760F88CC 740D je 760F88DB :760F88CE 807C241000 cmp byte ptr [esp+10], 00 :760F88D3 7406 je 760F88DB :760F88D5 8B08 mov ecx, dword ptr [eax] :760F88D7 50 push eax :760F88D8 FF5104 call [ecx+04] * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F88CC(C), :760F88D3(C) | :760F88DB 8BC6 mov eax, esi :760F88DD 5E pop esi :760F88DE C20C00 ret 000C :760F88E1 56 push esi :760F88E2 8BF1 mov esi, ecx :760F88E4 E841000000 call 760F892A :760F88E9 F644240801 test [esp+08], 01 :760F88EE 7407 je 760F88F7 :760F88F0 56 push esi * Reference To: MSVCRT.??3@YAXPAX@Z, Ord:0010h | :760F88F1 E85590FEFF Call 760E194B :760F88F6 59 pop ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F88EE(C) | :760F88F7 8BC6 mov eax, esi :760F88F9 5E pop esi :760F88FA C20400 ret 0004 :760F88FD 8B442404 mov eax, dword ptr [esp+04] :760F8901 56 push esi :760F8902 8BF1 mov esi, ecx :760F8904 8B4804 mov ecx, dword ptr [eax+04] :760F8907 894E04 mov dword ptr [esi+04], ecx :760F890A 8B4008 mov eax, dword ptr [eax+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F897B(C) | :760F890D 83660C00 and dword ptr [esi+0C], 00000000 :760F8911 894608 mov dword ptr [esi+08], eax :760F8914 85C0 test eax, eax :760F8916 C706B0AE0E76 mov dword ptr [esi], 760EAEB0 :760F891C 7406 je 760F8924 :760F891E 8B08 mov ecx, dword ptr [eax] :760F8920 50 push eax :760F8921 FF5104 call [ecx+04] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F891C(C) | :760F8924 8BC6 mov eax, esi :760F8926 5E pop esi :760F8927 C20400 ret 0004 * Referenced by a CALL at Address: |:760F88E4 | :760F892A 56 push esi :760F892B 8BF1 mov esi, ecx :760F892D 8B4608 mov eax, dword ptr [esi+08] :760F8930 C706B0AE0E76 mov dword ptr [esi], 760EAEB0 :760F8936 85C0 test eax, eax :760F8938 7406 je 760F8940 :760F893A 8B08 mov ecx, dword ptr [eax] :760F893C 50 push eax :760F893D FF5108 call [ecx+08] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8938(C) | :760F8940 8B760C mov esi, dword ptr [esi+0C] :760F8943 85F6 test esi, esi :760F8945 7407 je 760F894E :760F8947 56 push esi * Reference To: KERNEL32.LocalFree, Ord:01E9h | :760F8948 FF15F4110E76 Call dword ptr [760E11F4] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8945(C) | :760F894E 5E pop esi :760F894F C3 ret * Referenced by a CALL at Address: |:760F4569 | * Reference To: WINTRUST.CryptCATGetCatAttrInfo, Ord:0016h | :760F8950 FF25F4100E76 Jmp dword ptr [760E10F4] * Referenced by a CALL at Address: |:760F88A6 | * Reference To: MSVCRT._CxxThrowException, Ord:0041h | :760F8956 FF2578100E76 Jmp dword ptr [760E1078] :760F895C 90 nop :760F895D 90 nop :760F895E 90 nop :760F895F 90 nop :760F8960 00000000 BYTE 4 DUP(0) :760F8964 68E10F7600 push 00760FE1 :760F8969 000000 BYTE 3 DUP(0) :760F896C FFFFFFFF BYTE 4 DUP(0ffh) :760F8970 00000000 BYTE 4 DUP(0) :760F8974 1000 adc byte ptr [eax], al :760F8976 0000 add byte ptr [eax], al :760F8978 FD std :760F8979 880F mov byte ptr [edi], cl :760F897B 7690 jbe 760F890D :760F897D 90 nop :760F897E 90 nop :760F897F 90 nop :760F8980 0100 add dword ptr [eax], eax :760F8982 0000 add byte ptr [eax], al :760F8984 60 pushad :760F8985 890F mov dword ptr [edi], ecx :760F8987 7600 jbe 760F8989 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8987(C) | :760F8989 000000 BYTE 3 DUP(0) :760F898C 2A890F760000 sub cl, byte ptr [ecx+0000760F] :760F8992 0000 add byte ptr [eax], al :760F8994 80890F76909090 or byte ptr [ecx+9090760F], 90 :760F899B 90 nop :760F899C 90 nop :760F899D 90 nop :760F899E 90 nop :760F899F 90 nop :760F89A0 00000000 BYTE 4 DUP(0) :760F89A4 E537 in ax, 37 :760F89A6 3539000000 xor eax, 00000039 :760F89AB 0030 add byte ptr [eax], dh :760F89AD 8B01 mov eax, dword ptr [ecx] :760F89AF 0001 add byte ptr [ecx], al :760F89B1 000000 BYTE 3 DUP(0) :760F89B4 2400 and al, 00 :760F89B6 0000 add byte ptr [eax], al :760F89B8 2400 and al, 00 :760F89BA 0000 add byte ptr [eax], al :760F89BC C8890100 enter 0189, 00 :760F89C0 A08A010058 mov al, byte ptr [5800018A] :760F89C5 8A01 mov al, byte ptr [ecx] :760F89C7 0030 add byte ptr [eax], dh :760F89C9 1800 sbb byte ptr [eax], al :760F89CB 0049B0 add byte ptr [ecx-50], cl :760F89CE 0000 add byte ptr [eax], al :760F89D0 FE BYTE 0feh :760F89D1 AF scasd :760F89D2 0000 add byte ptr [eax], al :760F89D4 7016 jo 760F89EC :760F89D6 0000 add byte ptr [eax], al :760F89D8 67B000 mov al, 00 :760F89DB 00EA add dl, ch :760F89DD AF scasd :760F89DE 0000 add byte ptr [eax], al :760F89E0 AE scasb :760F89E1 B000 mov al, 00 :760F89E3 0047AF add byte ptr [edi-51], al :760F89E6 0000 add byte ptr [eax], al :760F89E8 8BAF00004AAF mov ebp, dword ptr [edi+AF4A0000] :760F89EE 0000 add byte ptr [eax], al :760F89F0 47 inc edi :760F89F1 2100 and dword ptr [eax], eax :760F89F3 00A1AF000048 add byte ptr [ecx+480000AF], ah :760F89F9 2800 sub byte ptr [eax], al :760F89FB 0044AF00 add byte ptr [edi+4*ebp], al :760F89FF 00B9C80000D4 add byte ptr [ecx+D40000C8], bh :760F8A05 3300 xor eax, dword ptr [eax] :760F8A07 0027 add byte ptr [edi], ah :760F8A09 B500 mov ch, 00 :760F8A0B 0018 add byte ptr [eax], bl :760F8A0D 25000079CD and eax, CD790000 :760F8A12 0000 add byte ptr [eax], al :760F8A14 96 xchg eax,esi :760F8A15 AF scasd :760F8A16 0000 add byte ptr [eax], al :760F8A18 1023 adc byte ptr [ebx], ah :760F8A1A 0000 add byte ptr [eax], al :760F8A1C CE into :760F8A1D AF scasd :760F8A1E 000000 BYTE 3 DUP(0) :760F8A21 B001 mov al, 01 :760F8A23 00CD add ch, cl :760F8A25 BF0000E3C5 mov edi, C5E30000 :760F8A2A 0000 add byte ptr [eax], al :760F8A2C 80DC00 sbb ah, 00 :760F8A2F 006331 add byte ptr [ebx+31], ah :760F8A32 0000 add byte ptr [eax], al :760F8A34 89F3 mov ebx, esi :760F8A36 0000 add byte ptr [eax], al :760F8A38 17 pop ss :760F8A39 DE00 fiadd word ptr [eax] :760F8A3B 00A3E600005E add byte ptr [ebx+5E0000E6], ah :760F8A41 ED in ax, dx :760F8A42 0000 add byte ptr [eax], al :760F8A44 46 inc esi :760F8A45 1D00008120 sbb eax, 20810000 :760F8A4A 0000 add byte ptr [eax], al :760F8A4C 66E000 loopnz 760F8A4F :760F8A4F 00E4 add ah, ah :760F8A51 3A00 cmp al, byte ptr [eax] :760F8A53 00FB add bl, bh :760F8A55 D400 aam (base0) :760F8A57 000000 BYTE 3 DUP(0) :760F8A5A 0100 add dword ptr [eax], eax :760F8A5C 0200 add al, byte ptr [eax] :760F8A5E 0300 add eax, dword ptr [eax] :760F8A60 0400 add al, 00 :760F8A62 0500060007 add eax, 07000600 :760F8A67 0008 add byte ptr [eax], cl :760F8A69 0009 add byte ptr [ecx], cl :760F8A6B 000A add byte ptr [edx], cl :760F8A6D 000B add byte ptr [ebx], cl :760F8A6F 000C00 add byte ptr [eax+eax], cl :760F8A72 0D00130014 or eax, 14001300 :760F8A77 00150017000E add byte ptr [0E001700], dl :760F8A7D 000F add byte ptr [edi], cl :760F8A7F 0010 add byte ptr [eax], dl :760F8A81 0018 add byte ptr [eax], bl :760F8A83 0019 add byte ptr [ecx], bl :760F8A85 001A add byte ptr [edx], bl :760F8A87 001B add byte ptr [ebx], bl :760F8A89 001C00 add byte ptr [eax+eax], bl :760F8A8C 1D001E001F sbb eax, 1F001E00 :760F8A91 0020 add byte ptr [eax], ah :760F8A93 0011 add byte ptr [ecx], dl :760F8A95 0021 add byte ptr [ecx], ah :760F8A97 0012 add byte ptr [edx], dl :760F8A99 0022 add byte ptr [edx], ah :760F8A9B 0023 add byte ptr [ebx], ah :760F8A9D 0016 add byte ptr [esi], dl :760F8A9F 003B add byte ptr [ebx], bh :760F8AA1 8B01 mov eax, dword ptr [ecx] :760F8AA3 00558B add byte ptr [ebp-75], dl :760F8AA6 0100 add dword ptr [eax], eax :760F8AA8 878B0100C18B xchg dword ptr [ebx+8BC10001], ecx :760F8AAE 0100 add dword ptr [eax], eax :760F8AB0 DB BYTE 0dbh :760F8AB1 8B01 mov eax, dword ptr [ecx] :760F8AB3 00F3 add bl, dh :760F8AB5 8B01 mov eax, dword ptr [ecx] :760F8AB7 0016 add byte ptr [esi], dl :760F8AB9 8C01 mov [ecx], es :760F8ABB 0037 add byte ptr [edi], dh :760F8ABD 8C01 mov [ecx], es :760F8ABF 00558C add byte ptr [ebp-74], dl :760F8AC2 0100 add dword ptr [eax], eax :760F8AC4 7D8C jge 760F8A52 :760F8AC6 0100 add dword ptr [eax], eax :760F8AC8 A28C0100CA mov byte ptr [CA00018C], al :760F8ACD 8C01 mov [ecx], es :760F8ACF 00F0 add al, dh :760F8AD1 8C01 mov [ecx], es :760F8AD3 0019 add byte ptr [ecx], bl :760F8AD5 8D01 lea eax, dword ptr [ecx] :760F8AD7 003D8D010067 add byte ptr [6700018D], bh :760F8ADD 8D01 lea eax, dword ptr [ecx] :760F8ADF 008E8D0100B6 add byte ptr [esi+B600018D], cl :760F8AE5 8D01 lea eax, dword ptr [ecx] :760F8AE7 00C2 add dl, al :760F8AE9 8D01 lea eax, dword ptr [ecx] :760F8AEB 00D1 add cl, dl :760F8AED 8D01 lea eax, dword ptr [ecx] :760F8AEF 00D9 add cl, bl :760F8AF1 8D01 lea eax, dword ptr [ecx] :760F8AF3 00EF add bh, ch :760F8AF5 8D01 lea eax, dword ptr [ecx] :760F8AF7 0006 add byte ptr [esi], al :760F8AF9 8E01 mov es, [ecx] :760F8AFB 0016 add byte ptr [esi], dl :760F8AFD 8E01 mov es, [ecx] :760F8AFF 00258E010037 add byte ptr [3700018E], ah :760F8B05 8E01 mov es, [ecx] :760F8B07 00528E add byte ptr [edx-72], dl :760F8B0A 0100 add dword ptr [eax], eax :760F8B0C 6B8E01007E8E01 imul ecx, dword ptr [esi+8E7E0001], 00000001 :760F8B13 00928E0100A2 add byte ptr [edx+A200018E], dl :760F8B19 8E01 mov es, [ecx] :760F8B1B 00B78E0100D6 add byte ptr [edi+D600018E], dh :760F8B21 8E01 mov es, [ecx] :760F8B23 00E2 add dl, ah :760F8B25 8E01 mov es, [ecx] :760F8B27 00EC add ah, ch :760F8B29 8E01 mov es, [ecx] :760F8B2B 00FB add bl, bh :760F8B2D 8E01 mov es, [ecx] :760F8B2F 005366 add byte ptr [ebx+66], dl :760F8B32 7044 jo 760F8B78 :760F8B34 6C insb :760F8B35 6C insb :760F8B36 2E BYTE 02eh :760F8B37 64 BYTE 064h :760F8B38 6C insb :760F8B39 6C insb :760F8B3A 003F add byte ptr [edi], bh :760F8B3C 3F aas :760F8B3D 304352 xor byte ptr [ebx+52], al :760F8B40 65 BYTE 065h :760F8B41 61 popad :760F8B42 64 BYTE 064h :760F8B43 57 push edi :760F8B44 7269 jb 760F8BAF :760F8B46 7465 je 760F8BAD :760F8B48 4C dec esp :760F8B49 6F outsd :760F8B4A 636B40 arpl dword ptr [ebx+40], ebp :760F8B4D 40 inc eax :760F8B4E 51 push ecx :760F8B4F 41 inc ecx :760F8B50 45 inc ebp :760F8B51 40 inc eax :760F8B52 58 pop eax :760F8B53 5A pop edx :760F8B54 003F add byte ptr [edi], bh :760F8B56 3F aas :760F8B57 304353 xor byte ptr [ebx+53], al :760F8B5A 636F70 arpl dword ptr [edi+70], ebp :760F8B5D 65 BYTE 065h :760F8B5E 52 push edx :760F8B5F 57 push edi :760F8B60 4C dec esp :760F8B61 6F outsd :760F8B62 636B40 arpl dword ptr [ebx+40], ebp :760F8B65 40 inc eax :760F8B66 51 push ecx :760F8B67 41 inc ecx :760F8B68 45 inc ebp :760F8B69 40 inc eax :760F8B6A 50 push eax :760F8B6B 41 inc ecx :760F8B6C 55 push ebp :760F8B6D 5F pop edi :760F8B6E 52 push edx :760F8B6F 54 push esp :760F8B70 4C dec esp :760F8B71 5F pop edi :760F8B72 43 inc ebx :760F8B73 52 push edx :760F8B74 49 dec ecx :760F8B75 54 push esp :760F8B76 49 dec ecx :760F8B77 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8B32(C) | :760F8B78 41 inc ecx :760F8B79 4C dec esp :760F8B7A 5F pop edi :760F8B7B 53 push ebx :760F8B7C 45 inc ebp :760F8B7D 43 inc ebx :760F8B7E 54 push esp :760F8B7F 49 dec ecx :760F8B80 4F dec edi :760F8B81 4E dec esi :760F8B82 40 inc eax :760F8B83 40 inc eax :760F8B84 40 inc eax :760F8B85 5A pop edx :760F8B86 003F add byte ptr [edi], bh :760F8B88 3F aas :760F8B89 304353 xor byte ptr [ebx+53], al :760F8B8C 636F70 arpl dword ptr [edi+70], ebp :760F8B8F 65 BYTE 065h :760F8B90 52 push edx :760F8B91 57 push edi :760F8B92 4C dec esp :760F8B93 6F outsd :760F8B94 636B40 arpl dword ptr [ebx+40], ebp :760F8B97 40 inc eax :760F8B98 51 push ecx :760F8B99 41 inc ecx :760F8B9A 45 inc ebp :760F8B9B 40 inc eax :760F8B9C 50 push eax :760F8B9D 41 inc ecx :760F8B9E 56 push esi :760F8B9F 43 inc ebx :760F8BA0 52 push edx :760F8BA1 65 BYTE 065h :760F8BA2 61 popad :760F8BA3 64 BYTE 064h :760F8BA4 57 push edi :760F8BA5 7269 jb 760F8C10 :760F8BA7 7465 je 760F8C0E :760F8BA9 4C dec esp :760F8BAA 6F outsd :760F8BAB 636B40 arpl dword ptr [ebx+40], ebp :760F8BAE 40 inc eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8B44(C) | :760F8BAF 57 push edi :760F8BB0 3452 xor al, 52 :760F8BB2 57 push edi :760F8BB3 4C dec esp :760F8BB4 4F dec edi :760F8BB5 43 inc ebx :760F8BB6 4B dec ebx :760F8BB7 5F pop edi :760F8BB8 4D dec ebp :760F8BB9 4F dec edi :760F8BBA 44 inc esp :760F8BBB 45 inc ebp :760F8BBC 40 inc eax :760F8BBD 40 inc eax :760F8BBE 40 inc eax :760F8BBF 5A pop edx :760F8BC0 003F add byte ptr [edi], bh :760F8BC2 3F aas :760F8BC3 314352 xor dword ptr [ebx+52], eax :760F8BC6 65 BYTE 065h :760F8BC7 61 popad :760F8BC8 64 BYTE 064h :760F8BC9 57 push edi :760F8BCA 7269 jb 760F8C35 :760F8BCC 7465 je 760F8C33 :760F8BCE 4C dec esp :760F8BCF 6F outsd :760F8BD0 636B40 arpl dword ptr [ebx+40], ebp :760F8BD3 40 inc eax :760F8BD4 51 push ecx :760F8BD5 41 inc ecx :760F8BD6 45 inc ebp :760F8BD7 40 inc eax :760F8BD8 58 pop eax :760F8BD9 5A pop edx :760F8BDA 003F add byte ptr [edi], bh :760F8BDC 3F aas :760F8BDD 314353 xor dword ptr [ebx+53], eax :760F8BE0 636F70 arpl dword ptr [edi+70], ebp :760F8BE3 65 BYTE 065h :760F8BE4 52 push edx :760F8BE5 57 push edi :760F8BE6 4C dec esp :760F8BE7 6F outsd :760F8BE8 636B40 arpl dword ptr [ebx+40], ebp :760F8BEB 40 inc eax :760F8BEC 51 push ecx :760F8BED 41 inc ecx :760F8BEE 45 inc ebp :760F8BEF 40 inc eax :760F8BF0 58 pop eax :760F8BF1 5A pop edx :760F8BF2 003F add byte ptr [edi], bh :760F8BF4 3F aas :760F8BF5 3443 xor al, 43 :760F8BF7 52 push edx :760F8BF8 65 BYTE 065h :760F8BF9 61 popad :760F8BFA 64 BYTE 064h :760F8BFB 57 push edi :760F8BFC 7269 jb 760F8C67 :760F8BFE 7465 je 760F8C65 :760F8C00 4C dec esp :760F8C01 6F outsd :760F8C02 636B40 arpl dword ptr [ebx+40], ebp :760F8C05 40 inc eax :760F8C06 51 push ecx :760F8C07 41 inc ecx :760F8C08 45 inc ebp :760F8C09 41 inc ecx :760F8C0A 41 inc ecx :760F8C0B 56 push esi :760F8C0C 304041 xor byte ptr [eax+41], al :760F8C0F 42 inc edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8BA5(C) | :760F8C10 56 push esi :760F8C11 304040 xor byte ptr [eax+40], al :760F8C14 5A pop edx :760F8C15 003F add byte ptr [edi], bh :760F8C17 3F aas :760F8C18 3443 xor al, 43 :760F8C1A 53 push ebx :760F8C1B 636F70 arpl dword ptr [edi+70], ebp :760F8C1E 65 BYTE 065h :760F8C1F 52 push edx :760F8C20 57 push edi :760F8C21 4C dec esp :760F8C22 6F outsd :760F8C23 636B40 arpl dword ptr [ebx+40], ebp :760F8C26 40 inc eax :760F8C27 51 push ecx :760F8C28 41 inc ecx :760F8C29 45 inc ebp :760F8C2A 41 inc ecx :760F8C2B 41 inc ecx :760F8C2C 56 push esi :760F8C2D 304041 xor byte ptr [eax+41], al :760F8C30 42 inc edx :760F8C31 56 push esi :760F8C32 304040 xor byte ptr [eax+40], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8BCA(C) | :760F8C35 5A pop edx :760F8C36 003F add byte ptr [edi], bh :760F8C38 46 inc esi :760F8C39 49 dec ecx :760F8C3A 6E outsb :760F8C3B 6974404352656164 imul esi, dword ptr [eax+2*eax+43], 64616552 :760F8C43 57 push edi :760F8C44 7269 jb 760F8CAF :760F8C46 7465 je 760F8CAD :760F8C48 4C dec esp :760F8C49 6F outsd :760F8C4A 636B40 arpl dword ptr [ebx+40], ebp :760F8C4D 40 inc eax :760F8C4E 51 push ecx :760F8C4F 41 inc ecx :760F8C50 45 inc ebp :760F8C51 48 dec eax :760F8C52 58 pop eax :760F8C53 5A pop edx :760F8C54 003F add byte ptr [edi], bh :760F8C56 4C dec esp :760F8C57 6F outsd :760F8C58 636B43 arpl dword ptr [ebx+43], ebp :760F8C5B 53 push ebx :760F8C5C 55 push ebp :760F8C5D 6E outsb :760F8C5E 64 BYTE 064h :760F8C5F 65 BYTE 065h :760F8C60 7252 jb 760F8CB4 :760F8C62 65 BYTE 065h :760F8C63 61 popad :760F8C64 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8BFE(C) | :760F8C65 40 inc eax :760F8C66 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8BFC(C) | :760F8C67 52 push edx :760F8C68 65 BYTE 065h :760F8C69 61 popad :760F8C6A 64 BYTE 064h :760F8C6B 57 push edi :760F8C6C 7269 jb 760F8CD7 :760F8C6E 7465 je 760F8CD5 :760F8C70 4C dec esp :760F8C71 6F outsd :760F8C72 636B40 arpl dword ptr [ebx+40], ebp :760F8C75 40 inc eax :760F8C76 51 push ecx :760F8C77 41 inc ecx :760F8C78 45 inc ebp :760F8C79 58 pop eax :760F8C7A 58 pop eax :760F8C7B 5A pop edx :760F8C7C 003F add byte ptr [edi], bh :760F8C7E 4C dec esp :760F8C7F 6F outsd :760F8C80 636B52 arpl dword ptr [ebx+52], ebp :760F8C83 65 BYTE 065h :760F8C84 61 popad :760F8C85 64 BYTE 064h :760F8C86 4D dec ebp :760F8C87 6F outsd :760F8C88 64 BYTE 064h :760F8C89 65 BYTE 065h :760F8C8A 40 inc eax :760F8C8B 43 inc ebx :760F8C8C 52 push edx :760F8C8D 65 BYTE 065h :760F8C8E 61 popad :760F8C8F 64 BYTE 064h :760F8C90 57 push edi :760F8C91 7269 jb 760F8CFC :760F8C93 7465 je 760F8CFA :760F8C95 4C dec esp :760F8C96 6F outsd :760F8C97 636B40 arpl dword ptr [ebx+40], ebp :760F8C9A 40 inc eax :760F8C9B 51 push ecx :760F8C9C 41 inc ecx :760F8C9D 45 inc ebp :760F8C9E 58 pop eax :760F8C9F 58 pop eax :760F8CA0 5A pop edx :760F8CA1 003F add byte ptr [edi], bh :760F8CA3 4C dec esp :760F8CA4 6F outsd :760F8CA5 636B52 arpl dword ptr [ebx+52], ebp :760F8CA8 65 BYTE 065h :760F8CA9 61 popad :760F8CAA 64 BYTE 064h :760F8CAB 4D dec ebp :760F8CAC 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8C46(C) | :760F8CAD 64 BYTE 064h :760F8CAE 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8C44(C) | :760F8CAF 45 inc ebp :760F8CB0 7840 js 760F8CF2 :760F8CB2 43 inc ebx :760F8CB3 52 push edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8C60(C) | :760F8CB4 65 BYTE 065h :760F8CB5 61 popad :760F8CB6 64 BYTE 064h :760F8CB7 57 push edi :760F8CB8 7269 jb 760F8D23 :760F8CBA 7465 je 760F8D21 :760F8CBC 4C dec esp :760F8CBD 6F outsd :760F8CBE 636B40 arpl dword ptr [ebx+40], ebp :760F8CC1 40 inc eax :760F8CC2 51 push ecx :760F8CC3 41 inc ecx :760F8CC4 45 inc ebp :760F8CC5 48 dec eax :760F8CC6 48 dec eax :760F8CC7 40 inc eax :760F8CC8 5A pop edx :760F8CC9 003F add byte ptr [edi], bh :760F8CCB 4C dec esp :760F8CCC 6F outsd :760F8CCD 636B57 arpl dword ptr [ebx+57], ebp :760F8CD0 7269 jb 760F8D3B :760F8CD2 7465 je 760F8D39 :760F8CD4 4D dec ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8C6E(C) | :760F8CD5 6F outsd :760F8CD6 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8C6C(C) | :760F8CD7 65 BYTE 065h :760F8CD8 40 inc eax :760F8CD9 43 inc ebx :760F8CDA 52 push edx :760F8CDB 65 BYTE 065h :760F8CDC 61 popad :760F8CDD 64 BYTE 064h :760F8CDE 57 push edi :760F8CDF 7269 jb 760F8D4A :760F8CE1 7465 je 760F8D48 :760F8CE3 4C dec esp :760F8CE4 6F outsd :760F8CE5 636B40 arpl dword ptr [ebx+40], ebp :760F8CE8 40 inc eax :760F8CE9 51 push ecx :760F8CEA 41 inc ecx :760F8CEB 45 inc ebp :760F8CEC 58 pop eax :760F8CED 58 pop eax :760F8CEE 5A pop edx :760F8CEF 003F add byte ptr [edi], bh :760F8CF1 4C dec esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8CB0(C) | :760F8CF2 6F outsd :760F8CF3 636B57 arpl dword ptr [ebx+57], ebp :760F8CF6 7269 jb 760F8D61 :760F8CF8 7465 je 760F8D5F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8C93(C) | :760F8CFA 4D dec ebp :760F8CFB 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8C91(C) | :760F8CFC 64 BYTE 064h :760F8CFD 65 BYTE 065h :760F8CFE 45 inc ebp :760F8CFF 7840 js 760F8D41 :760F8D01 43 inc ebx :760F8D02 52 push edx :760F8D03 65 BYTE 065h :760F8D04 61 popad :760F8D05 64 BYTE 064h :760F8D06 57 push edi :760F8D07 7269 jb 760F8D72 :760F8D09 7465 je 760F8D70 :760F8D0B 4C dec esp :760F8D0C 6F outsd :760F8D0D 636B40 arpl dword ptr [ebx+40], ebp :760F8D10 40 inc eax :760F8D11 51 push ecx :760F8D12 41 inc ecx :760F8D13 45 inc ebp :760F8D14 48 dec eax :760F8D15 48 dec eax :760F8D16 40 inc eax :760F8D17 5A pop edx :760F8D18 003F add byte ptr [edi], bh :760F8D1A 50 push eax :760F8D1B 7277 jb 760F8D94 :760F8D1D 4C dec esp :760F8D1E 6F outsd :760F8D1F 636B40 arpl dword ptr [ebx+40], ebp :760F8D22 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8CB8(C) | :760F8D23 52 push edx :760F8D24 65 BYTE 065h :760F8D25 61 popad :760F8D26 64 BYTE 064h :760F8D27 57 push edi :760F8D28 7269 jb 760F8D93 :760F8D2A 7465 je 760F8D91 :760F8D2C 4C dec esp :760F8D2D 6F outsd :760F8D2E 636B40 arpl dword ptr [ebx+40], ebp :760F8D31 40 inc eax :760F8D32 51 push ecx :760F8D33 41 inc ecx :760F8D34 45 inc ebp :760F8D35 50 push eax :760F8D36 41 inc ecx :760F8D37 56 push esi :760F8D38 314058 xor dword ptr [eax+58], eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8CD0(C) | :760F8D3B 5A pop edx :760F8D3C 003F add byte ptr [edi], bh :760F8D3E 55 push ebp :760F8D3F 6E outsb :760F8D40 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8CFF(C) | :760F8D41 6F outsd :760F8D42 636B43 arpl dword ptr [ebx+43], ebp :760F8D45 53 push ebx :760F8D46 55 push ebp :760F8D47 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8CE1(C) | :760F8D48 64 BYTE 064h :760F8D49 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8CDF(C) | :760F8D4A 7252 jb 760F8D9E :760F8D4C 65 BYTE 065h :760F8D4D 61 popad :760F8D4E 64 BYTE 064h :760F8D4F 40 inc eax :760F8D50 43 inc ebx :760F8D51 52 push edx :760F8D52 65 BYTE 065h :760F8D53 61 popad :760F8D54 64 BYTE 064h :760F8D55 57 push edi :760F8D56 7269 jb 760F8DC1 :760F8D58 7465 je 760F8DBF :760F8D5A 4C dec esp :760F8D5B 6F outsd :760F8D5C 636B40 arpl dword ptr [ebx+40], ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8CF8(C) | :760F8D5F 40 inc eax :760F8D60 51 push ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8CF6(C) | :760F8D61 41 inc ecx :760F8D62 45 inc ebp :760F8D63 58 pop eax :760F8D64 58 pop eax :760F8D65 5A pop edx :760F8D66 003F add byte ptr [edi], bh :760F8D68 55 push ebp :760F8D69 6E outsb :760F8D6A 6C insb :760F8D6B 6F outsd :760F8D6C 636B52 arpl dword ptr [ebx+52], ebp :760F8D6F 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8D09(C) | :760F8D70 61 popad :760F8D71 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8D07(C) | :760F8D72 4D dec ebp :760F8D73 6F outsd :760F8D74 64 BYTE 064h :760F8D75 65 BYTE 065h :760F8D76 40 inc eax :760F8D77 43 inc ebx :760F8D78 52 push edx :760F8D79 65 BYTE 065h :760F8D7A 61 popad :760F8D7B 64 BYTE 064h :760F8D7C 57 push edi :760F8D7D 7269 jb 760F8DE8 :760F8D7F 7465 je 760F8DE6 :760F8D81 4C dec esp :760F8D82 6F outsd :760F8D83 636B40 arpl dword ptr [ebx+40], ebp :760F8D86 40 inc eax :760F8D87 51 push ecx :760F8D88 41 inc ecx :760F8D89 45 inc ebp :760F8D8A 58 pop eax :760F8D8B 58 pop eax :760F8D8C 5A pop edx :760F8D8D 003F add byte ptr [edi], bh :760F8D8F 55 push ebp :760F8D90 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8D2A(C) | :760F8D91 6C insb :760F8D92 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8D28(C) | :760F8D93 636B57 arpl dword ptr [ebx+57], ebp :760F8D96 7269 jb 760F8E01 :760F8D98 7465 je 760F8DFF :760F8D9A 4D dec ebp :760F8D9B 6F outsd :760F8D9C 64 BYTE 064h :760F8D9D 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8D4A(C) | :760F8D9E 40 inc eax :760F8D9F 43 inc ebx :760F8DA0 52 push edx :760F8DA1 65 BYTE 065h :760F8DA2 61 popad :760F8DA3 64 BYTE 064h :760F8DA4 57 push edi :760F8DA5 7269 jb 760F8E10 :760F8DA7 7465 je 760F8E0E :760F8DA9 4C dec esp :760F8DAA 6F outsd :760F8DAB 636B40 arpl dword ptr [ebx+40], ebp :760F8DAE 40 inc eax :760F8DAF 51 push ecx :760F8DB0 41 inc ecx :760F8DB1 45 inc ebp :760F8DB2 58 pop eax :760F8DB3 58 pop eax :760F8DB4 5A pop edx :760F8DB5 00446973 add byte ptr [ecx+2*ebp+73], al :760F8DB9 61 popad :760F8DBA 626C6553 bound ebp, dword ptr [ebp+53] :760F8DBE 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8D58(C) | :760F8DBF 50 push eax :760F8DC0 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8D56(C) | :760F8DC1 005346 add byte ptr [ebx+46], dl :760F8DC4 50 push eax :760F8DC5 43 inc ebx :760F8DC6 6F outsd :760F8DC7 7079 jo 760F8E42 :760F8DC9 43 inc ebx :760F8DCA 61 popad :760F8DCB 7461 je 760F8E2E :760F8DCD 6C insb :760F8DCE 6F outsd :760F8DCF 67005346 add [bp+di+46], dl :760F8DD3 50 push eax :760F8DD4 49 dec ecx :760F8DD5 6E outsb :760F8DD6 6974005346505072 imul esi, dword ptr [eax+eax+53], 72505046 :760F8DDE 6F outsd :760F8DDF 636573 arpl dword ptr [ebp+73], esp :760F8DE2 7346 jnb 760F8E2A :760F8DE4 696C654368616E67 imul ebp, dword ptr [ebp+43], 676E6168 :760F8DEC 65 BYTE 065h :760F8DED 7300 jnb 760F8DEF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8DED(C) | :760F8DEF 53 push ebx :760F8DF0 52 push edx :760F8DF1 55 push ebp :760F8DF2 7064 jo 760F8E58 :760F8DF4 61 popad :760F8DF5 7465 je 760F8E5C :760F8DF7 4D dec ebp :760F8DF8 6F outsd :760F8DF9 6E outsb :760F8DFA 69746F7265644C69 imul esi, dword ptr [edi+2*ebp+72], 694C6465 :760F8E02 7374 jnb 760F8E78 :760F8E04 53 push ebx :760F8E05 005366 add byte ptr [ebx+66], dl :760F8E08 7043 jo 760F8E4D :760F8E0A 6C insb :760F8E0B 65 BYTE 065h :760F8E0C 61 popad :760F8E0D 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8DA7(C) | :760F8E0E 7570 jne 760F8E80 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8DA5(C) | :760F8E10 53 push ebx :760F8E11 667044 jo 760F8E58 :760F8E14 6200 bound eax, dword ptr [eax] :760F8E16 53 push ebx :760F8E17 667043 jo 760F8E5D :760F8E1A 7265 jb 760F8E81 :760F8E1C 61 popad :760F8E1D 7465 je 760F8E84 :760F8E1F 53 push ebx :760F8E20 667044 jo 760F8E67 :760F8E23 6200 bound eax, dword ptr [eax] :760F8E25 53 push ebx :760F8E26 667044 jo 760F8E6D :760F8E29 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8DE2(C) | :760F8E2A 6C insb :760F8E2B 65 BYTE 065h :760F8E2C 7465 je 760F8E93 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8DCB(C) | :760F8E2E 43 inc ebx :760F8E2F 61 popad :760F8E30 7461 je 760F8E93 :760F8E32 6C insb :760F8E33 6F outsd :760F8E34 6753 push ebx :760F8E36 005366 add byte ptr [ebx+66], dl :760F8E39 7047 jo 760F8E82 :760F8E3B 65 BYTE 065h :760F8E3C 7443 je 760F8E81 :760F8E3E 6F outsd :760F8E3F 7272 jb 760F8EB3 :760F8E41 6563745665 arpl dword ptr gs:[esi+2*edx+65], esi :760F8E46 7273 jb 760F8EBB :760F8E48 696F6E4F664669 imul ebp, dword ptr [edi+6E], 6946664F :760F8E4F 6C insb :760F8E50 65005366 add byte ptr gs:[ebx+66], dl :760F8E54 7047 jo 760F8E9D :760F8E56 65 BYTE 065h :760F8E57 744E je 760F8EA7 :760F8E59 65 BYTE 065h :760F8E5A 7874 js 760F8ED0 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8DF5(C) | :760F8E5C 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8E18(C) | :760F8E5D 726F jb 760F8ECE :760F8E5F 7465 je 760F8EC6 :760F8E61 63746564 arpl dword ptr [ebp+64], esi :760F8E65 46 inc esi :760F8E66 696C655300536670 imul ebp, dword ptr [ebp+53], 70665300 :760F8E6E 49 dec ecx :760F8E6F 6E outsb :760F8E70 7374 jnb 760F8EE6 :760F8E72 61 popad :760F8E73 6C insb :760F8E74 6C insb :760F8E75 43 inc ebx :760F8E76 61 popad :760F8E77 7461 je 760F8EDA :760F8E79 6C insb :760F8E7A 6F outsd :760F8E7B 6753 push ebx :760F8E7D 005366 add byte ptr [ebx+66], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8E0E(C) | :760F8E80 7049 jo 760F8ECB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8E39(C) | :760F8E82 7346 jnb 760F8ECA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8E1D(C) | :760F8E84 696C6550726F7465 imul ebp, dword ptr [ebp+50], 65746F72 :760F8E8C 63746564 arpl dword ptr [ebp+64], esi :760F8E90 53 push ebx :760F8E91 005366 add byte ptr [ebx+66], dl :760F8E94 7050 jo 760F8EE6 :760F8E96 65 BYTE 065h :760F8E97 7273 jb 760F8F0C :760F8E99 69737453667044 imul esi, dword ptr [ebx+74], 44706653 :760F8EA0 6200 bound eax, dword ptr [eax] :760F8EA2 53 push ebx :760F8EA3 667052 jo 760F8EF8 :760F8EA6 65626F6F bound ebp, dword ptr gs:[edi+6F] :760F8EAA 7449 je 760F8EF5 :760F8EAC 664E dec si :760F8EAE 65636573 arpl dword ptr gs:[ebp+73], esp :760F8EB2 7361 jnb 760F8F15 :760F8EB4 7279 jb 760F8F2F :760F8EB6 005366 add byte ptr [ebx+66], dl :760F8EB9 7052 jo 760F8F0D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8E46(C) | :760F8EBB 65 BYTE 065h :760F8EBC 7374 jnb 760F8F32 :760F8EBE 6F outsd :760F8EBF 7265 jb 760F8F26 :760F8EC1 43 inc ebx :760F8EC2 6F outsd :760F8EC3 7272 jb 760F8F37 :760F8EC5 6563745665 arpl dword ptr gs:[esi+2*edx+65], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8E82(C) | :760F8ECA 7273 jb 760F8F3F :760F8ECC 696F6E4F664669 imul ebp, dword ptr [edi+6E], 6946664F :760F8ED3 6C insb :760F8ED4 65005366 add byte ptr gs:[ebx+66], dl :760F8ED8 7053 jo 760F8F2D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8E77(C) | :760F8EDA 687574446F push 6F447475 :760F8EDF 776E ja 760F8F4F :760F8EE1 005366 add byte ptr [ebx+66], dl :760F8EE4 7053 jo 760F8F39 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F8E70(C), :760F8E94(C) | :760F8EE6 796E jns 760F8F56 :760F8EE8 63446200 arpl dword ptr [edx], eax :760F8EEC 53 push ebx :760F8EED 667056 jo 760F8F46 :760F8EF0 65 BYTE 065h :760F8EF1 7269 jb 760F8F5C :760F8EF3 667946 jns 760F8F3C :760F8EF6 696C6553006F626A imul ebp, dword ptr [ebp+53], 6A626F00 :760F8EFE 53 push ebx :760F8EFF 667044 jo 760F8F46 :760F8F02 6200 bound eax, dword ptr [eax] :760F8F04 BC9001001F mov esp, 1F000190 :760F8F09 3C40 cmp al, 40 :760F8F0B 39FF cmp edi, edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8EB9(C) | :760F8F0D FFFFFF BYTE 3 DUP(0ffh) :760F8F10 1C90 sbb al, 90 :760F8F12 0100 add dword ptr [eax], eax :760F8F14 0010 add byte ptr [eax], dl :760F8F16 0000 add byte ptr [eax], al :760F8F18 3C91 cmp al, 91 :760F8F1A 0100 add dword ptr [eax], eax :760F8F1C E33B jcxz 760F8F59 :760F8F1E 40 inc eax :760F8F1F 39FF cmp edi, edi :760F8F21 FFFFFF BYTE 3 DUP(0ffh) :760F8F24 289001008010 sub byte ptr [eax+10800001], dl :760F8F2A 0000 add byte ptr [eax], al :760F8F2C 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8ED8(C) | :760F8F2D 91 xchg eax,ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8F9C(C) | :760F8F2E 0100 add dword ptr [eax], eax :760F8F30 E33B jcxz 760F8F6D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8EBC(C) | :760F8F32 40 inc eax :760F8F33 39FF cmp edi, edi :760F8F35 FFFFFF BYTE 3 DUP(0ffh) :760F8F38 36 BYTE 036h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8EE4(C) | :760F8F39 90 nop :760F8F3A 0100 add dword ptr [eax], eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8EF4(C) | :760F8F3C A810 test al, 10 :760F8F3E 0000 add byte ptr [eax], al :760F8F40 7491 je 760F8ED3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8FB0(C) | :760F8F42 0100 add dword ptr [eax], eax :760F8F44 E13B loopz 760F8F81 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F8EEE(C), :760F8F00(C) | :760F8F46 40 inc eax :760F8F47 39FF cmp edi, edi :760F8F49 FFFFFF BYTE 3 DUP(0ffh) :760F8F4C 40 inc eax :760F8F4D 90 nop :760F8F4E 0100 add dword ptr [eax], eax :760F8F50 B810000084 mov eax, 84000010 :760F8F55 91 xchg eax,ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F8EE6(C) | :760F8F56 0100 add dword ptr [eax], eax :760F8F58 4B dec ebx :760F8F59 3C40 cmp al, 40 :760F8F5B 39FF cmp edi, edi :760F8F5D FFFFFF BYTE 3 DUP(0ffh) :760F8F60 4C dec esp :760F8F61 90 nop :760F8F62 0100 add dword ptr [eax], eax :760F8F64 C8100000 enter 0010, 00 :760F8F68 C8910100 enter 0191, 00 :760F8F6C E43B in al, 3B :760F8F6E 40 inc eax :760F8F6F 39FF cmp edi, edi :760F8F71 FFFFFF BYTE 3 DUP(0ffh) :760F8F74 5A pop edx :760F8F75 90 nop :760F8F76 0100 add dword ptr [eax], eax :760F8F78 0C11 or al, 11 :760F8F7A 0000 add byte ptr [eax], al :760F8F7C 18920100363C sbb byte ptr [edx+3C360001], dl :760F8F82 40 inc eax :760F8F83 39FF cmp edi, edi :760F8F85 FFFFFF BYTE 3 DUP(0ffh) :760F8F88 6690 nop :760F8F8A 0100 add dword ptr [eax], eax :760F8F8C 5C pop esp :760F8F8D 1100 adc dword ptr [eax], eax :760F8F8F 003C92 add byte ptr [edx+4*edx], bh :760F8F92 0100 add dword ptr [eax], eax :760F8F94 ED in ax, dx :760F8F95 3B4039 cmp eax, dword ptr [eax+39] :760F8F98 FFFFFFFF BYTE 4 DUP(0ffh) :760F8F9C 7090 jo 760F8F2E :760F8F9E 0100 add dword ptr [eax], eax :760F8FA0 801100 adc byte ptr [ecx], 00 :760F8FA3 004C9201 add byte ptr [edx+4*edx+01], cl :760F8FA7 000E add byte ptr [esi], cl :760F8FA9 3C3F cmp al, 3F :760F8FAB 39FF cmp edi, edi :760F8FAD FFFFFF BYTE 3 DUP(0ffh) :760F8FB0 7C90 jl 760F8F42 :760F8FB2 0100 add dword ptr [eax], eax :760F8FB4 90 nop :760F8FB5 1100 adc dword ptr [eax], eax :760F8FB7 004893 add byte ptr [eax-6D], cl :760F8FBA 0100 add dword ptr [eax], eax :760F8FBC E03B loopnz 760F8FF9 :760F8FBE 40 inc eax :760F8FBF 39FF cmp edi, edi :760F8FC1 FFFFFF BYTE 3 DUP(0ffh) :760F8FC4 8A9001008C12 mov dl, byte ptr [eax+128C0001] :760F8FCA 0000 add byte ptr [eax], al :760F8FCC 68930100E1 push E1000193 :760F8FD1 3B4039 cmp eax, dword ptr [eax+39] :760F8FD4 FFFFFFFF BYTE 4 DUP(0ffh) :760F8FD8 96 xchg eax,esi :760F8FD9 90 nop :760F8FDA 0100 add dword ptr [eax], eax :760F8FDC AC lodsb :760F8FDD 1200 adc al, byte ptr [eax] :760F8FDF 0094930100E33B add byte ptr [ebx+4*edx+3BE30001], dl :760F8FE6 40 inc eax :760F8FE7 39FF cmp edi, edi :760F8FE9 FFFFFF BYTE 3 DUP(0ffh) :760F8FEC A4 movsb :760F8FED 90 nop :760F8FEE 0100 add dword ptr [eax], eax :760F8FF0 D812 fcom dword ptr [edx] :760F8FF2 0000 add byte ptr [eax], al :760F8FF4 9C pushfd :760F8FF5 93 xchg eax,ebx :760F8FF6 0100 add dword ptr [eax], eax :760F8FF8 EE out dx, al :760F8FF9 3B4039 cmp eax, dword ptr [eax+39] :760F8FFC FFFFFFFF BYTE 4 DUP(0ffh) :760F9000 B090 mov al, 90 :760F9002 0100 add dword ptr [eax], eax :760F9004 E012 loopnz 760F9018 :760F9006 00000000000000000000 BYTE 10 DUP(0) :760F9010 00000000000000000000 BYTE 10 DUP(0) :760F901A 0000 BYTE 2 DUP(0) :760F901C 4D dec ebp :760F901D 53 push ebx :760F901E 56 push esi :760F901F 43 inc ebx :760F9020 52 push edx :760F9021 54 push esp :760F9022 2E BYTE 02eh :760F9023 44 inc esp :760F9024 4C dec esp :760F9025 4C dec esp :760F9026 0000 add byte ptr [eax], al :760F9028 4F dec edi :760F9029 4C dec esp :760F902A 45 inc ebp :760F902B 41 inc ecx :760F902C 55 push ebp :760F902D 54 push esp :760F902E 3332 xor esi, dword ptr [edx] :760F9030 2E BYTE 02eh :760F9031 44 inc esp :760F9032 4C dec esp :760F9033 4C dec esp :760F9034 0000 add byte ptr [eax], al :760F9036 4F dec edi :760F9037 4C dec esp :760F9038 45 inc ebp :760F9039 3332 xor esi, dword ptr [edx] :760F903B 2E BYTE 02eh :760F903C 44 inc esp :760F903D 4C dec esp :760F903E 4C dec esp :760F903F 005645 add byte ptr [esi+45], dl :760F9042 52 push edx :760F9043 53 push ebx :760F9044 49 dec ecx :760F9045 4F dec edi :760F9046 4E dec esi :760F9047 2E BYTE 02eh :760F9048 44 inc esp :760F9049 4C dec esp :760F904A 4C dec esp :760F904B 005749 add byte ptr [edi+49], dl :760F904E 4E dec esi :760F904F 54 push esp :760F9050 52 push edx :760F9051 55 push ebp :760F9052 53 push ebx :760F9053 54 push esp :760F9054 2E BYTE 02eh :760F9055 44 inc esp :760F9056 4C dec esp :760F9057 4C dec esp :760F9058 0000 add byte ptr [eax], al :760F905A 52 push edx :760F905B 50 push eax :760F905C 43 inc ebx :760F905D 52 push edx :760F905E 54 push esp :760F905F 342E xor al, 2E :760F9061 44 inc esp :760F9062 4C dec esp :760F9063 4C dec esp :760F9064 0000 add byte ptr [eax], al :760F9066 53 push ebx :760F9067 4D dec ebp :760F9068 47 inc edi :760F9069 52 push edx :760F906A 2E BYTE 02eh :760F906B 44 inc esp :760F906C 4C dec esp :760F906D 4C dec esp :760F906E 0000 add byte ptr [eax], al :760F9070 41 inc ecx :760F9071 54 push esp :760F9072 52 push edx :760F9073 41 inc ecx :760F9074 43 inc ebx :760F9075 45 inc ebp :760F9076 2E BYTE 02eh :760F9077 44 inc esp :760F9078 4C dec esp :760F9079 4C dec esp :760F907A 0000 add byte ptr [eax], al :760F907C 4B dec ebx :760F907D 45 inc ebp :760F907E 52 push edx :760F907F 4E dec esi :760F9080 45 inc ebp :760F9081 4C dec esp :760F9082 3332 xor esi, dword ptr [edx] :760F9084 2E BYTE 02eh :760F9085 44 inc esp :760F9086 4C dec esp :760F9087 4C dec esp :760F9088 0000 add byte ptr [eax], al :760F908A 55 push ebp :760F908B 53 push ebx :760F908C 45 inc ebp :760F908D 52 push edx :760F908E 3332 xor esi, dword ptr [edx] :760F9090 2E BYTE 02eh :760F9091 44 inc esp :760F9092 4C dec esp :760F9093 4C dec esp :760F9094 0000 add byte ptr [eax], al :760F9096 41 inc ecx :760F9097 44 inc esp :760F9098 56 push esi :760F9099 41 inc ecx :760F909A 50 push eax :760F909B 49 dec ecx :760F909C 3332 xor esi, dword ptr [edx] :760F909E 2E BYTE 02eh :760F909F 44 inc esp :760F90A0 4C dec esp :760F90A1 4C dec esp :760F90A2 0000 add byte ptr [eax], al :760F90A4 53 push ebx :760F90A5 48 dec eax :760F90A6 45 inc ebp :760F90A7 4C dec esp :760F90A8 4C dec esp :760F90A9 3332 xor esi, dword ptr [edx] :760F90AB 2E BYTE 02eh :760F90AC 44 inc esp :760F90AD 4C dec esp :760F90AE 4C dec esp :760F90AF 004352 add byte ptr [ebx+52], al :760F90B2 59 pop ecx :760F90B3 50 push eax :760F90B4 54 push esp :760F90B5 3332 xor esi, dword ptr [edx] :760F90B7 2E BYTE 02eh :760F90B8 44 inc esp :760F90B9 4C dec esp :760F90BA 4C dec esp :760F90BB 00A8930100B2 add byte ptr [eax+B2000193], ch :760F90C1 93 xchg eax,ebx :760F90C2 0100 add dword ptr [eax], eax :760F90C4 BC930100CA mov esp, CA000193 :760F90C9 93 xchg eax,ebx :760F90CA 0100 add dword ptr [eax], eax :760F90CC DA930100E493 ficom dword ptr [ebx+93E40001] :760F90D2 0100 add dword ptr [eax], eax :760F90D4 F0 lock :760F90D5 93 xchg eax,ebx :760F90D6 0100 add dword ptr [eax], eax :760F90D8 F8 clc :760F90D9 93 xchg eax,ebx :760F90DA 0100 add dword ptr [eax], eax :760F90DC 02940100129401 add dl, byte ptr [ecx+eax+01941200] :760F90E3 001C94 add byte ptr [esp+4*edx], bl :760F90E6 0100 add dword ptr [eax], eax :760F90E8 26 BYTE 026h :760F90E9 94 xchg eax,esp :760F90EA 0100 add dword ptr [eax], eax :760F90EC 309401003A9401 xor byte ptr [ecx+eax+01943A00], dl :760F90F3 004694 add byte ptr [esi-6C], al :760F90F6 0100 add dword ptr [eax], eax :760F90F8 50 push eax :760F90F9 94 xchg eax,esp :760F90FA 0100 add dword ptr [eax], eax :760F90FC 58 pop eax :760F90FD 94 xchg eax,esp :760F90FE 0100 add dword ptr [eax], eax :760F9100 629401006C9401 bound edx, dword ptr [ecx+eax+01946C00] :760F9107 007694 add byte ptr [esi-6C], dh :760F910A 0100 add dword ptr [eax], eax :760F910C 809401008A940100 adc byte ptr [ecx+eax+01948A00], 00 :760F9114 92 xchg eax,edx :760F9115 94 xchg eax,esp :760F9116 0100 add dword ptr [eax], eax :760F9118 9E sahf :760F9119 94 xchg eax,esp :760F911A 0100 add dword ptr [eax], eax :760F911C B294 mov dl, 94 :760F911E 0100 add dword ptr [eax], eax :760F9120 C4940100CE9401 les edx, dword ptr [ecx+eax+0194CE00] :760F9127 00D8 add al, bl :760F9129 94 xchg eax,esp :760F912A 0100 add dword ptr [eax], eax :760F912C F0 lock :760F912D 94 xchg eax,esp :760F912E 0100 add dword ptr [eax], eax :760F9130 FA cli :760F9131 94 xchg eax,esp :760F9132 0100 add dword ptr [eax], eax :760F9134 0A9501000000 or dl, byte ptr [ebp+00000001] :760F913A 0000 add byte ptr [eax], al :760F913C 0C00 or al, 00 :760F913E 008002000080 add byte ptr [eax+80000002], al :760F9144 0400 add al, 00 :760F9146 008007000080 add byte ptr [eax+80000007], al :760F914C 06 push es :760F914D 0000 add byte ptr [eax], al :760F914F 800800 or byte ptr [eax], 00 :760F9152 008095000080 add byte ptr [eax+80000095], al :760F9158 96 xchg eax,esi :760F9159 0000 add byte ptr [eax], al :760F915B 800900 or byte ptr [ecx], 00 :760F915E 008000000000 add byte ptr [eax+00000000], al :760F9164 209501003495 and byte ptr [ebp+95340001], dl :760F916A 0100 add dword ptr [eax], eax :760F916C 46 inc esi :760F916D 95 xchg eax,ebp :760F916E 0100 add dword ptr [eax], eax :760F9170 00000000 BYTE 4 DUP(0) :760F9174 56 push esi :760F9175 95 xchg eax,ebp :760F9176 0100 add dword ptr [eax], eax :760F9178 6C insb :760F9179 95 xchg eax,ebp :760F917A 0100 add dword ptr [eax], eax :760F917C 869501000000 xchg byte ptr [ebp+00000001], dl :760F9182 0000 add byte ptr [eax], al :760F9184 98 cwde :760F9185 95 xchg eax,ebp :760F9186 0100 add dword ptr [eax], eax :760F9188 B695 mov dh, 95 :760F918A 0100 add dword ptr [eax], eax :760F918C D495 aam (base149) :760F918E 0100 add dword ptr [eax], eax :760F9190 FA cli :760F9191 95 xchg eax,ebp :760F9192 0100 add dword ptr [eax], eax :760F9194 209601004496 and byte ptr [esi+96440001], dl :760F919A 0100 add dword ptr [eax], eax :760F919C 6696 xchg ax,si :760F919E 0100 add dword ptr [eax], eax :760F91A0 86960100A096 xchg byte ptr [esi+96A00001], dl :760F91A6 0100 add dword ptr [eax], eax :760F91A8 B096 mov al, 96 :760F91AA 0100 add dword ptr [eax], eax :760F91AC C29601 ret 0196 :760F91AF 00 BYTE 0 :760F91B0 D2960100EC96 rcl byte ptr [esi+96EC0001], cl :760F91B6 0100 add dword ptr [eax], eax :760F91B8 06 push es :760F91B9 97 xchg eax,edi :760F91BA 0100 add dword ptr [eax], eax :760F91BC 1E push ds :760F91BD 97 xchg eax,edi :760F91BE 0100 add dword ptr [eax], eax :760F91C0 3E BYTE 03eh :760F91C1 97 xchg eax,edi :760F91C2 0100 add dword ptr [eax], eax :760F91C4 00000000 BYTE 4 DUP(0) :760F91C8 60 pushad :760F91C9 97 xchg eax,edi :760F91CA 0100 add dword ptr [eax], eax :760F91CC 7897 js 760F9165 :760F91CE 0100 add dword ptr [eax], eax :760F91D0 92 xchg eax,edx :760F91D1 97 xchg eax,edi :760F91D2 0100 add dword ptr [eax], eax :760F91D4 AE scasb :760F91D5 97 xchg eax,edi :760F91D6 0100 add dword ptr [eax], eax :760F91D8 CE into :760F91D9 97 xchg eax,edi :760F91DA 0100 add dword ptr [eax], eax :760F91DC DC970100EE97 fcom qword ptr [edi+97EE0001] :760F91E2 0100 add dword ptr [eax], eax :760F91E4 0498 add al, 98 :760F91E6 0100 add dword ptr [eax], eax :760F91E8 1C98 sbb al, 98 :760F91EA 0100 add dword ptr [eax], eax :760F91EC 3A9801004E98 cmp bl, byte ptr [eax+984E0001] :760F91F2 0100 add dword ptr [eax], eax :760F91F4 60 pushad :760F91F5 98 cwde :760F91F6 0100 add dword ptr [eax], eax :760F91F8 809801009A9801 sbb byte ptr [eax+989A0001], 01 :760F91FF 00B4980100D098 add byte ptr [eax+4*ebx-672FFFFF], dh :760F9206 0100 add dword ptr [eax], eax :760F9208 EC in al, dx :760F9209 98 cwde :760F920A 0100 add dword ptr [eax], eax :760F920C FE BYTE 0feh :760F920D 98 cwde :760F920E 0100 add dword ptr [eax], eax :760F9210 1C99 sbb al, 99 :760F9212 0100 add dword ptr [eax], eax :760F9214 00000000 BYTE 4 DUP(0) :760F9218 3A9901005299 cmp bl, byte ptr [ecx+99520001] :760F921E 0100 add dword ptr [eax], eax :760F9220 6C insb :760F9221 99 cdq :760F9222 0100 add dword ptr [eax], eax :760F9224 7C99 jl 760F91BF :760F9226 0100 add dword ptr [eax], eax :760F9228 8E990100A099 mov ds, [ecx+99A00001] :760F922E 0100 add dword ptr [eax], eax :760F9230 BA990100CC mov edx, CC000199 :760F9235 99 cdq :760F9236 0100 add dword ptr [eax], eax :760F9238 00000000 BYTE 4 DUP(0) :760F923C DE990100F899 ficomp word ptr [ecx+99F80001] :760F9242 0100 add dword ptr [eax], eax :760F9244 0C9A or al, 9A :760F9246 0100 add dword ptr [eax], eax :760F9248 00000000 BYTE 4 DUP(0) :760F924C 249A and al, 9A :760F924E 0100 add dword ptr [eax], eax :760F9250 36 BYTE 036h :760F9251 9A0100429A0100 call 0001:9A420001 :760F9258 4E dec esi :760F9259 9A0100689A0100 call 0001:9A680001 :760F9260 789A js 760F91FC :760F9262 0100 add dword ptr [eax], eax :760F9264 849A01009A9A test byte ptr [edx+9A9A0001], bl :760F926A 0100 add dword ptr [eax], eax :760F926C B49A mov ah, 9A :760F926E 0100 add dword ptr [eax], eax :760F9270 C49A0100DC9A les ebx, dword ptr [edx+9ADC0001] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F92D8(C) | :760F9276 0100 add dword ptr [eax], eax :760F9278 E89A0100F8 call 6E0F9417 :760F927D 9A0100109B0100 call 0001:9B100001 :760F9284 26 BYTE 026h :760F9285 9B wait :760F9286 0100 add dword ptr [eax], eax :760F9288 42 inc edx :760F9289 9B wait :760F928A 0100 add dword ptr [eax], eax :760F928C 52 push edx :760F928D 9B wait :760F928E 0100 add dword ptr [eax], eax :760F9290 6C insb :760F9291 9B wait :760F9292 0100 add dword ptr [eax], eax :760F9294 7E9B jle 760F9231 :760F9296 0100 add dword ptr [eax], eax :760F9298 8E9B01009C9B mov ds, [ebx+9B9C0001] :760F929E 0100 add dword ptr [eax], eax :760F92A0 B29B mov dl, 9B :760F92A2 0100 add dword ptr [eax], eax :760F92A4 C29B01 ret 019B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9308(C) | :760F92A7 00 BYTE 0 :760F92A8 D6 BYTE 0d6h :760F92A9 9B wait :760F92AA 0100 add dword ptr [eax], eax :760F92AC E29B loop 760F9249 :760F92AE 0100 add dword ptr [eax], eax :760F92B0 F0 lock :760F92B1 9B wait :760F92B2 0100 add dword ptr [eax], eax :760F92B4 FC cld :760F92B5 9B wait :760F92B6 0100 add dword ptr [eax], eax :760F92B8 0E push cs :760F92B9 9C pushfd :760F92BA 0100 add dword ptr [eax], eax :760F92BC 1A9C0100269C01 sbb bl, byte ptr [ecx+eax+019C2600] :760F92C3 0032 add byte ptr [edx], dh :760F92C5 9C pushfd :760F92C6 0100 add dword ptr [eax], eax :760F92C8 48 dec eax :760F92C9 9C pushfd :760F92CA 0100 add dword ptr [eax], eax :760F92CC 50 push eax :760F92CD 9C pushfd :760F92CE 0100 add dword ptr [eax], eax :760F92D0 5E pop esi :760F92D1 9C pushfd :760F92D2 0100 add dword ptr [eax], eax :760F92D4 6C insb :760F92D5 9C pushfd :760F92D6 0100 add dword ptr [eax], eax :760F92D8 789C js 760F9276 :760F92DA 0100 add dword ptr [eax], eax :760F92DC 889C01009C9C01 mov byte ptr [ecx+eax+019C9C00], bl :760F92E3 00B09C0100CC add byte ptr [eax+CC00019C], dh :760F92E9 9C pushfd :760F92EA 0100 add dword ptr [eax], eax :760F92EC DC9C0100F49C01 fcomp qword ptr [ecx+eax+019CF400] :760F92F3 0002 add byte ptr [edx], al :760F92F5 9D popfd :760F92F6 0100 add dword ptr [eax], eax :760F92F8 189D0100309D sbb byte ptr [ebp+9D300001], bl :760F92FE 0100 add dword ptr [eax], eax :760F9300 48 dec eax :760F9301 9D popfd :760F9302 0100 add dword ptr [eax], eax :760F9304 669D popf :760F9306 0100 add dword ptr [eax], eax :760F9308 729D jb 760F92A7 :760F930A 0100 add dword ptr [eax], eax :760F930C 889D01009C9D mov byte ptr [ebp+9D9C0001], bl :760F9312 0100 add dword ptr [eax], eax :760F9314 A89D test al, 9D :760F9316 0100 add dword ptr [eax], eax :760F9318 B49D mov ah, 9D :760F931A 0100 add dword ptr [eax], eax :760F931C C29D01 ret 019D :760F931F 00 BYTE 0 :760F9320 D29D0100DE9D rcr byte ptr [ebp+9DDE0001], cl :760F9326 0100 add dword ptr [eax], eax :760F9328 F0 lock :760F9329 9D popfd :760F932A 0100 add dword ptr [eax], eax :760F932C 06 push es :760F932D 9E sahf :760F932E 0100 add dword ptr [eax], eax :760F9330 149E adc al, 9E :760F9332 0100 add dword ptr [eax], eax :760F9334 309E01003E9E xor byte ptr [esi+9E3E0001], bl :760F933A 0100 add dword ptr [eax], eax :760F933C 4E dec esi :760F933D 9E sahf :760F933E 0100 add dword ptr [eax], eax :760F9340 5C pop esp :760F9341 9E sahf :760F9342 0100 add dword ptr [eax], eax :760F9344 00000000 BYTE 4 DUP(0) :760F9348 689E01007C push 7C00019E :760F934D 9E sahf :760F934E 0100 add dword ptr [eax], eax :760F9350 8E9E01009C9E mov ds, [esi+9E9C0001] :760F9356 0100 add dword ptr [eax], eax :760F9358 AA stosb :760F9359 9E sahf :760F935A 0100 add dword ptr [eax], eax :760F935C BA9E0100C6 mov edx, C600019E :760F9361 9E sahf :760F9362 0100 add dword ptr [eax], eax :760F9364 00000000 BYTE 4 DUP(0) :760F9368 D29E0100E49E rcr byte ptr [esi+9EE40001], cl :760F936E 0100 add dword ptr [eax], eax :760F9370 F2 repnz :760F9371 9E sahf :760F9372 0100 add dword ptr [eax], eax :760F9374 06 push es :760F9375 9F lahf :760F9376 0100 add dword ptr [eax], eax :760F9378 149F adc al, 9F :760F937A 0100 add dword ptr [eax], eax :760F937C 26 BYTE 026h :760F937D 9F lahf :760F937E 0100 add dword ptr [eax], eax :760F9380 36 BYTE 036h :760F9381 9F lahf :760F9382 0100 add dword ptr [eax], eax :760F9384 48 dec eax :760F9385 9F lahf :760F9386 0100 add dword ptr [eax], eax :760F9388 58 pop eax :760F9389 9F lahf :760F938A 0100 add dword ptr [eax], eax :760F938C 689F010000 push 0000019F :760F9391 000000 BYTE 3 DUP(0) :760F9394 789F js 760F9335 :760F9396 0100 add dword ptr [eax], eax :760F9398 00000000 BYTE 4 DUP(0) :760F939C 92 xchg eax,edx :760F939D 9F lahf :760F939E 0100 add dword ptr [eax], eax :760F93A0 AC lodsb :760F93A1 9F lahf :760F93A2 0100 add dword ptr [eax], eax :760F93A4 00000000 BYTE 4 DUP(0) :760F93A8 E9015F7763 jmp D986F2AE :760F93AD 736C jnb 760F941B :760F93AF 7772 ja 760F9423 :760F93B1 0083015F6F6E add byte ptr [ebx+6E6F5F01], al :760F93B7 65 BYTE 065h :760F93B8 7869 js 760F9423 :760F93BA 7400 je 760F93BC * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F93BA(C) | :760F93BC 55 push ebp :760F93BD 005F5F add byte ptr [edi+5F], bl :760F93C0 64 BYTE 064h :760F93C1 6C insb :760F93C2 6C insb :760F93C3 6F outsd :760F93C4 6E outsb :760F93C5 65 BYTE 065h :760F93C6 7869 js 760F9431 :760F93C8 7400 je 760F93CA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F93C8(C) | :760F93CA 9B wait :760F93CB 005F61 add byte ptr [edi+61], bl :760F93CE 64 BYTE 064h :760F93CF 6A75 push 00000075 :760F93D1 7374 jnb 760F9447 :760F93D3 5F pop edi :760F93D4 6664697600008E imul si, word ptr fs:[esi+00], 8E00 :760F93DB 026D61 add ch, byte ptr [ebp+61] :760F93DE 6C insb :760F93DF 6C insb :760F93E0 6F outsd :760F93E1 6300 arpl dword ptr [eax], eax :760F93E3 000C01 add byte ptr [ecx+eax], cl :760F93E6 5F pop edi :760F93E7 696E6974746572 imul ebp, dword ptr [esi+69], 72657474 :760F93EE 6D insd :760F93EF 005B02 add byte ptr [ebx+02], bl :760F93F2 667265 jb 760F945A :760F93F5 65 BYTE 065h :760F93F6 0000 add byte ptr [eax], al :760F93F8 95 xchg eax,ebp :760F93F9 026D65 add ch, byte ptr [ebp+65] :760F93FC 6D insd :760F93FD 6D insd :760F93FE 6F outsd :760F93FF 7665 jbe 760F9466 :760F9401 000F add byte ptr [edi], cl :760F9403 003F add byte ptr [edi], bh :760F9405 3F aas :760F9406 324059 xor al, byte ptr [eax+59] :760F9409 41 inc ecx :760F940A 50 push eax :760F940B 41 inc ecx :760F940C 58 pop eax :760F940D 49 dec ecx :760F940E 40 inc eax :760F940F 5A pop edx :760F9410 0000 add byte ptr [eax], al :760F9412 C402 les eax, dword ptr [edx] :760F9414 7374 jnb 760F948A :760F9416 7274 jb 760F948C :760F9418 6F outsd :760F9419 6B0000 imul eax, dword ptr [eax], 00000000 :760F941C C00273 rol byte ptr [edx], 73 :760F941F 7472 je 760F9493 :760F9421 7263 jb 760F9486 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F93AF(C), :760F93B8(C) | :760F9423 687200BC01 push 01BC0072 :760F9428 5F pop edi :760F9429 7374 jnb 760F949F :760F942B 7264 jb 760F9491 :760F942D 7570 jne 760F949F :760F942F 00AF02737072 add byte ptr [edi+72707302], ch :760F9435 696E746600BE01 imul ebp, dword ptr [esi+74], 01BE0066 :760F943C 5F pop edi :760F943D 7374 jnb 760F94B3 :760F943F 7269 jb 760F94AA :760F9441 636D70 arpl dword ptr [ebp+70], ebp :760F9444 0000 add byte ptr [eax], al :760F9446 49 dec ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F93D1(C) | :760F9447 026663 add ah, byte ptr [esi+63] :760F944A 6C insb :760F944B 6F outsd :760F944C 7365 jnb 760F94B3 :760F944E 0000 add byte ptr [eax], al :760F9450 54 push esp :760F9451 02666F add ah, byte ptr [esi+6F] :760F9454 7065 jo 760F94BB :760F9456 6E outsb :760F9457 00BE02737472 add byte ptr [esi+72747302], bh :760F945D 6E outsb :760F945E 637079 arpl dword ptr [eax+79], esi :760F9461 009B02707269 add byte ptr [ebx+69727002], bl :760F9467 6E outsb :760F9468 7466 je 760F94D0 :760F946A 0000 add byte ptr [eax], al :760F946C C60273 mov byte ptr [edx], 73 :760F946F 7472 je 760F94E3 :760F9471 746F je 760F94E2 :760F9473 756C jne 760F94E1 :760F9475 007002 add byte ptr [eax+02], dh :760F9478 69736469676974 imul esi, dword ptr [ebx+64], 74696769 :760F947F 00E3 add bl, ah :760F9481 027763 add dh, byte ptr [edi+63] :760F9484 736C jnb 760F94F2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9421(C) | :760F9486 65 BYTE 065h :760F9487 6E outsb :760F9488 0000 add byte ptr [eax], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9414(C) | :760F948A 3A02 cmp al, byte ptr [edx] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9416(C) | :760F948C 61 popad :760F948D 746F je 760F94FE :760F948F 690000AA0273 imul eax, dword ptr [eax], 7302AA00 :760F9495 65 BYTE 065h :760F9496 746C je 760F9504 :760F9498 6F outsd :760F9499 63616C arpl dword ptr [ecx+6C], esp :760F949C 6500C7 add bh, al * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F9429(C), :760F942D(C) | :760F949F 005F65 add byte ptr [edi+65], bl :760F94A2 7863 js 760F9507 :760F94A4 65 BYTE 065h :760F94A5 7074 jo 760F951B :760F94A7 5F pop edi :760F94A8 68616E646C push 6C646E61 :760F94AD 65 BYTE 065h :760F94AE 7233 jb 760F94E3 :760F94B0 0000 add byte ptr [eax], al :760F94B2 3901 cmp dword ptr [ecx], eax :760F94B4 5F pop edi :760F94B5 6C insb :760F94B6 6F outsd :760F94B7 63616C arpl dword ptr [ecx+6C], esp :760F94BA 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9454(C) | :760F94BB 756E jne 760F952B :760F94BD 7769 ja 760F9528 :760F94BF 6E outsb :760F94C0 643200 xor al, byte ptr fs:[eax] :760F94C3 00DE add dh, bl :760F94C5 027763 add dh, byte ptr [edi+63] :760F94C8 7363 jnb 760F952D :760F94CA 6D insd :760F94CB 7000 jo 760F94CD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F94CB(C) | :760F94CD 005502 add byte ptr [ebp+02], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9468(C) | :760F94D0 667072 jo 760F9545 :760F94D3 696E7466000E00 imul ebp, dword ptr [esi+74], 000E0066 :760F94DA 3F aas :760F94DB 3F aas :760F94DC 31747970 xor dword ptr [ecx+2*edi+70], esi :760F94E0 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9473(C) | :760F94E1 5F pop edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9471(C) | :760F94E2 696E666F404055 imul ebp, dword ptr [esi+66], 5540406F :760F94E9 41 inc ecx :760F94EA 45 inc ebp :760F94EB 40 inc eax :760F94EC 58 pop eax :760F94ED 5A pop edx :760F94EE 0000 add byte ptr [eax], al :760F94F0 B402 mov ah, 02 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9484(C) | :760F94F2 7374 jnb 760F9568 :760F94F4 7263 jb 760F9559 :760F94F6 6872000010 push 10000072 :760F94FB 003F add byte ptr [edi], bh :760F94FD 3F aas * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F948D(C) | :760F94FE 334059 xor eax, dword ptr [eax+59] :760F9501 41 inc ecx :760F9502 58 pop eax :760F9503 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9496(C) | :760F9504 41 inc ecx :760F9505 58 pop eax :760F9506 40 inc eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F94A2(C) | :760F9507 5A pop edx :760F9508 0000 add byte ptr [eax], al :760F950A 41 inc ecx :760F950B 005F43 add byte ptr [edi+43], bl :760F950E 7878 js 760F9588 :760F9510 54 push esp :760F9511 68726F7745 push 45776F72 :760F9516 7863 js 760F957B :760F9518 65 BYTE 065h :760F9519 7074 jo 760F958F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F94A5(C) | :760F951B 696F6E00000F00 imul ebp, dword ptr [edi+6E], 000F0000 :760F9522 43 inc ebx :760F9523 6F outsd :760F9524 43 inc ebx :760F9525 7265 jb 760F958C :760F9527 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F94BD(C) | :760F9528 7465 je 760F958F :760F952A 49 dec ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F94BB(C) | :760F952B 6E outsb :760F952C 7374 jnb 760F95A2 :760F952E 61 popad :760F952F 6E outsb :760F9530 636500 arpl dword ptr [ebp+00], esp :760F9533 005900 add byte ptr [ecx+00], bl :760F9536 43 inc ebx :760F9537 6F outsd :760F9538 55 push ebp :760F9539 6E outsb :760F953A 696E697469616C imul ebp, dword ptr [esi+69], 6C616974 :760F9541 697A6500003100 imul edi, dword ptr [edx+65], 00310000 :760F9548 43 inc ebx :760F9549 6F outsd :760F954A 49 dec ecx :760F954B 6E outsb :760F954C 697469616C697A65 imul esi, dword ptr [ecx+2*ebp+61], 657A696C :760F9554 00000000 BYTE 4 DUP(0) :760F9558 47 inc edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F94F4(C) | :760F9559 65 BYTE 065h :760F955A 7446 je 760F95A2 :760F955C 696C655665727369 imul ebp, dword ptr [ebp+56], 69737265 :760F9564 6F outsd :760F9565 6E outsb :760F9566 49 dec ecx :760F9567 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F94F2(C) | :760F9568 666F outsw :760F956A 41 inc ecx :760F956B 0001 add byte ptr [ecx], al :760F956D 004765 add byte ptr [edi+65], al :760F9570 7446 je 760F95B8 :760F9572 696C655665727369 imul ebp, dword ptr [ebp+56], 69737265 :760F957A 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9516(C) | :760F957B 6E outsb :760F957C 49 dec ecx :760F957D 6E outsb :760F957E 666F outsw :760F9580 53 push ebx :760F9581 697A6541000A00 imul edi, dword ptr [edx+65], 000A0041 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F950E(C) | :760F9588 56 push esi :760F9589 65 BYTE 065h :760F958A 7251 jb 760F95DD * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9525(C) | :760F958C 7565 jne 760F95F3 :760F958E 7279 jb 760F9609 :760F9590 56 push esi :760F9591 61 popad :760F9592 6C insb :760F9593 7565 jne 760F95FA :760F9595 41 inc ecx :760F9596 0000 add byte ptr [eax], al :760F9598 0200 add al, byte ptr [eax] :760F959A 43 inc ebx :760F959B 7279 jb 760F9616 :760F959D 7074 jo 760F9613 :760F959F 43 inc ebx :760F95A0 41 inc ecx :760F95A1 54 push esp * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F952C(C), :760F955A(C) | :760F95A2 41 inc ecx :760F95A3 64 BYTE 064h :760F95A4 6D insd :760F95A5 696E4163717569 imul ebp, dword ptr [esi+41], 69757163 :760F95AC 7265 jb 760F9613 :760F95AE 43 inc ebx :760F95AF 6F outsd :760F95B0 6E outsb :760F95B1 7465 je 760F9618 :760F95B3 7874 js 760F9629 :760F95B5 0007 add byte ptr [edi], al :760F95B7 004372 add byte ptr [ebx+72], al :760F95BA 7970 jns 760F962C :760F95BC 7443 je 760F9601 :760F95BE 41 inc ecx :760F95BF 54 push esp :760F95C0 41 inc ecx :760F95C1 64 BYTE 064h :760F95C2 6D insd :760F95C3 696E52656C6561 imul ebp, dword ptr [esi+52], 61656C65 :760F95CA 7365 jnb 760F9631 :760F95CC 43 inc ebx :760F95CD 6F outsd :760F95CE 6E outsb :760F95CF 7465 je 760F9636 :760F95D1 7874 js 760F9647 :760F95D3 000400 add byte ptr [eax+eax], al :760F95D6 43 inc ebx :760F95D7 7279 jb 760F9652 :760F95D9 7074 jo 760F964F :760F95DB 43 inc ebx :760F95DC 41 inc ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F958A(C) | :760F95DD 54 push esp :760F95DE 41 inc ecx :760F95DF 64 BYTE 064h :760F95E0 6D insd :760F95E1 696E43616C6348 imul ebp, dword ptr [esi+43], 48636C61 :760F95E8 61 popad :760F95E9 7368 jnb 760F9653 :760F95EB 46 inc esi :760F95EC 726F jb 760F965D :760F95EE 6D insd :760F95EF 46 inc esi :760F95F0 696C6548616E646C imul ebp, dword ptr [ebp+48], 6C646E61 :760F95F8 650006 add byte ptr gs:[esi], al :760F95FB 004372 add byte ptr [ebx+72], al :760F95FE 7970 jns 760F9670 :760F9600 7443 je 760F9645 :760F9602 41 inc ecx :760F9603 54 push esp :760F9604 41 inc ecx :760F9605 64 BYTE 064h :760F9606 6D insd :760F9607 696E52656C6561 imul ebp, dword ptr [esi+52], 61656C65 :760F960E 7365 jnb 760F9675 :760F9610 43 inc ebx :760F9611 61 popad :760F9612 7461 je 760F9675 :760F9614 6C insb :760F9615 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F959B(C) | :760F9616 6743 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F95B1(C) | :760F9618 6F outsd :760F9619 6E outsb :760F961A 7465 je 760F9681 :760F961C 7874 js 760F9692 :760F961E 0000 add byte ptr [eax], al :760F9620 0500437279 add eax, 79724300 :760F9625 7074 jo 760F969B :760F9627 43 inc ebx :760F9628 41 inc ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F95B3(C) | :760F9629 54 push esp :760F962A 41 inc ecx :760F962B 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F95BA(C) | :760F962C 6D insd :760F962D 696E456E756D43 imul ebp, dword ptr [esi+45], 436D756E :760F9634 61 popad :760F9635 7461 je 760F9698 :760F9637 6C insb :760F9638 6F outsd :760F9639 6746 inc esi :760F963B 726F jb 760F96AC :760F963D 6D insd :760F963E 48 dec eax :760F963F 61 popad :760F9640 7368 jnb 760F96AA :760F9642 0000 add byte ptr [eax], al :760F9644 1000 adc byte ptr [eax], al :760F9646 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F95D1(C) | :760F9647 7279 jb 760F96C2 :760F9649 7074 jo 760F96BF :760F964B 43 inc ebx :760F964C 41 inc ecx :760F964D 54 push esp :760F964E 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F95D9(C) | :760F964F 61 popad :760F9650 7461 je 760F96B3 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F95D7(C) | :760F9652 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F95E9(C) | :760F9653 6F outsd :760F9654 6749 dec ecx :760F9656 6E outsb :760F9657 666F outsw :760F9659 46 inc esi :760F965A 726F jb 760F96CB :760F965C 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F95EC(C) | :760F965D 43 inc ebx :760F965E 6F outsd :760F965F 6E outsb :760F9660 7465 je 760F96C7 :760F9662 7874 js 760F96D8 :760F9664 0000 add byte ptr [eax], al :760F9666 54 push esp :760F9667 005754 add byte ptr [edi+54], dl :760F966A 48 dec eax :760F966B 65 BYTE 065h :760F966C 6C insb :760F966D 7065 jo 760F96D4 :760F966F 7250 jb 760F96C1 :760F9671 726F jb 760F96E2 :760F9673 7644 jbe 760F96B9 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F960E(C), :760F9612(C) | :760F9675 61 popad :760F9676 7461 je 760F96D9 :760F9678 46 inc esi :760F9679 726F jb 760F96EA :760F967B 6D insd :760F967C 53 push ebx :760F967D 7461 je 760F96E0 :760F967F 7465 je 760F96E6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F961A(C) | :760F9681 44 inc esp :760F9682 61 popad :760F9683 7461 je 760F96E6 :760F9685 0003 add byte ptr [ebx], al :760F9687 004372 add byte ptr [ebx+72], al :760F968A 7970 jns 760F96FC :760F968C 7443 je 760F96D1 :760F968E 41 inc ecx :760F968F 54 push esp :760F9690 41 inc ecx :760F9691 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F961C(C) | :760F9692 6D insd :760F9693 696E4164644361 imul ebp, dword ptr [esi+41], 61436464 :760F969A 7461 je 760F96FD :760F969C 6C insb :760F969D 6F outsd :760F969E 670011 add [bx+di], dl :760F96A1 004372 add byte ptr [ebx+72], al :760F96A4 7970 jns 760F9716 :760F96A6 7443 je 760F96EB :760F96A8 41 inc ecx :760F96A9 54 push esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9640(C) | :760F96AA 43 inc ebx :760F96AB 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F963B(C) | :760F96AC 6F outsd :760F96AD 7365 jnb 760F9714 :760F96AF 006B00 add byte ptr [ebx+00], ch :760F96B2 57 push edi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9650(C) | :760F96B3 696E5665726966 imul ebp, dword ptr [esi+56], 66697265 :760F96BA 7954 jns 760F9710 :760F96BC 7275 jb 760F9733 :760F96BE 7374 jnb 760F9734 :760F96C0 0000 add byte ptr [eax], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9647(C) | :760F96C2 1900 sbb dword ptr [eax], eax :760F96C4 43 inc ebx :760F96C5 7279 jb 760F9740 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9660(C) | :760F96C7 7074 jo 760F973D :760F96C9 43 inc ebx :760F96CA 41 inc ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F965A(C) | :760F96CB 54 push esp :760F96CC 4F dec edi :760F96CD 7065 jo 760F9734 :760F96CF 6E outsb :760F96D0 0000 add byte ptr [eax], al :760F96D2 16 push ss :760F96D3 004372 add byte ptr [ebx+72], al :760F96D6 7970 jns 760F9748 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9662(C) | :760F96D8 7443 je 760F971D :760F96DA 41 inc ecx :760F96DB 54 push esp :760F96DC 47 inc edi :760F96DD 65 BYTE 065h :760F96DE 7443 je 760F9723 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F967D(C) | :760F96E0 61 popad :760F96E1 7441 je 760F9724 :760F96E3 7474 je 760F9759 :760F96E5 7249 jb 760F9730 :760F96E7 6E outsb :760F96E8 666F outsw * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9679(C) | :760F96EA 0000 add byte ptr [eax], al :760F96EC 1400 adc al, 00 :760F96EE 43 inc ebx :760F96EF 7279 jb 760F976A :760F96F1 7074 jo 760F9767 :760F96F3 43 inc ebx :760F96F4 41 inc ecx :760F96F5 54 push esp :760F96F6 45 inc ebp :760F96F7 6E outsb :760F96F8 756D jne 760F9767 :760F96FA 65 BYTE 065h :760F96FB 7261 jb 760F975E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F969A(C) | :760F96FD 7465 je 760F9764 :760F96FF 4D dec ebp :760F9700 65 BYTE 065h :760F9701 6D insd :760F9702 626572 bound esp, dword ptr [ebp+72] :760F9705 0012 add byte ptr [edx], dl :760F9707 004372 add byte ptr [ebx+72], al :760F970A 7970 jns 760F977C :760F970C 7443 je 760F9751 :760F970E 41 inc ecx :760F970F 54 push esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F96BA(C) | :760F9710 45 inc ebp :760F9711 6E outsb :760F9712 756D jne 760F9781 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F96AD(C) | :760F9714 65 BYTE 065h :760F9715 7261 jb 760F9778 :760F9717 7465 je 760F977E :760F9719 41 inc ecx :760F971A 7474 je 760F9790 :760F971C 7200 jb 760F971E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F971C(C) | :760F971E 4F dec edi :760F971F 005754 add byte ptr [edi+54], dl :760F9722 48 dec eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F96DE(C) | :760F9723 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F96E1(C) | :760F9724 6C insb :760F9725 7065 jo 760F978C :760F9727 7247 jb 760F9770 :760F9729 65 BYTE 065h :760F972A 7450 je 760F977C :760F972C 726F jb 760F979D :760F972E 7643 jbe 760F9773 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F96E5(C) | :760F9730 65 BYTE 065h :760F9731 7274 jb 760F97A7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F96BC(C) | :760F9733 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F96BE(C), :760F96CD(C) | :760F9734 726F jb 760F97A5 :760F9736 6D insd :760F9737 43 inc ebx :760F9738 6861696E00 push 006E6961 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F96C7(C) | :760F973D 005100 add byte ptr [ecx+00], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F96C5(C) | :760F9740 57 push edi :760F9741 54 push esp :760F9742 48 dec eax :760F9743 65 BYTE 065h :760F9744 6C insb :760F9745 7065 jo 760F97AC :760F9747 7247 jb 760F9790 :760F9749 65 BYTE 065h :760F974A 7450 je 760F979C :760F974C 726F jb 760F97BD :760F974E 7653 jbe 760F97A3 :760F9750 69676E65724672 imul esp, dword ptr [edi+6E], 72467265 :760F9757 6F outsd :760F9758 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F96E3(C) | :760F9759 43 inc ebx :760F975A 6861696E00 push 006E6961 :760F975F 00EF add bh, ch :760F9761 004E64 add byte ptr [esi+64], cl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F96FD(C) | :760F9764 7250 jb 760F97B6 :760F9766 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F96F1(C), :760F96F8(C) | :760F9767 696E746572556E imul ebp, dword ptr [esi+74], 6E557265 :760F976E 6D insd :760F976F 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9727(C) | :760F9770 7273 jb 760F97E5 :760F9772 68616C6C00 push 006C6C61 :760F9777 008F01527063 add byte ptr [edi+63705201], cl :760F977D 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9717(C) | :760F977E 65 BYTE 065h :760F977F 7276 jb 760F97F7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9712(C) | :760F9781 65 BYTE 065h :760F9782 7255 jb 760F97D9 :760F9784 7365 jnb 760F97EB :760F9786 50 push eax :760F9787 726F jb 760F97F8 :760F9789 7473 je 760F97FE :760F978B 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9725(C) | :760F978C 7145 jno 760F97D3 :760F978E 7041 jo 760F97D1 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F971A(C), :760F9747(C) | :760F9790 0000 add byte ptr [eax], al :760F9792 8700 xchg dword ptr [eax], eax :760F9794 4E dec esi :760F9795 64 BYTE 064h :760F9796 7243 jb 760F97DB :760F9798 6F outsd :760F9799 6D insd :760F979A 706C jo 760F9808 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F974A(C) | :760F979C 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F972C(C) | :760F979D 7853 js 760F97F2 :760F979F 7472 je 760F9813 :760F97A1 7563 jne 760F9806 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F974E(C) | :760F97A3 744D je 760F97F2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9734(C) | :760F97A5 61 popad :760F97A6 7273 jb 760F981B :760F97A8 68616C6C00 push 006C6C61 :760F97AD 008F004E6472 add byte ptr [edi+72644E00], cl :760F97B3 43 inc ebx :760F97B4 6F outsd :760F97B5 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9764(C) | :760F97B6 666F outsw :760F97B8 726D jb 760F9827 :760F97BA 61 popad :760F97BB 6E outsb :760F97BC 7453 je 760F9811 :760F97BE 7472 je 760F9832 :760F97C0 696E6742756666 imul ebp, dword ptr [esi+67], 66667542 :760F97C7 65 BYTE 065h :760F97C8 7253 jb 760F981D :760F97CA 697A6500A4004E imul edi, dword ptr [edx+65], 4E00A400 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F978E(C) | :760F97D1 64 BYTE 064h :760F97D2 7243 jb 760F9817 :760F97D4 6F outsd :760F97D5 6E outsb :760F97D6 7665 jbe 760F983D :760F97D8 7274 jb 760F984E :760F97DA 0000 add byte ptr [eax], al :760F97DC 820152 add byte ptr [ecx], 52 :760F97DF 7063 jo 760F9844 :760F97E1 53 push ebx :760F97E2 65 BYTE 065h :760F97E3 7276 jb 760F985B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9770(C) | :760F97E5 65 BYTE 065h :760F97E6 724C jb 760F9834 :760F97E8 697374656E0085 imul esi, dword ptr [ebx+74], 85006E65 :760F97EF 015270 add dword ptr [edx+70], edx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F979D(C), :760F97A3(C) | :760F97F2 635365 arpl dword ptr [ebx+65], edx :760F97F5 7276 jb 760F986D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F977F(C) | :760F97F7 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9787(C) | :760F97F8 7252 jb 760F984C :760F97FA 656769737465724966 imul esi, gs:[bp+di+74], 66497265 :760F9803 008901527063 add byte ptr [ecx+63705201], cl :760F9809 53 push ebx :760F980A 65 BYTE 065h :760F980B 7276 jb 760F9883 :760F980D 65 BYTE 065h :760F980E 7255 jb 760F9865 :760F9810 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F97BC(C) | :760F9811 7265 jb 760F9878 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F979F(C) | :760F9813 6769737465724966 imul esi, [bp+di+74], 66497265 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F97A6(C) | :760F981B 006D01 add byte ptr [ebp+01], ch :760F981E 52 push edx :760F981F 7063 jo 760F9884 :760F9821 4D dec ebp :760F9822 676D insd :760F9824 7453 je 760F9879 :760F9826 746F je 760F9897 :760F9828 7053 jo 760F987D :760F982A 65 BYTE 065h :760F982B 7276 jb 760F98A3 :760F982D 65 BYTE 065h :760F982E 724C jb 760F987C :760F9830 697374656E696E imul esi, dword ptr [ebx+74], 6E696E65 :760F9837 670000 add [bx+si], al :760F983A 7A01 jpe 760F983D :760F983C 52 push edx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F97D6(C), :760F983A(C) | :760F983D 7063 jo 760F98A2 :760F983F 52 push edx :760F9840 61 popad :760F9841 69736545786365 imul esi, dword ptr [ebx+65], 65637845 :760F9848 7074 jo 760F98BE :760F984A 696F6E002D0049 imul ebp, dword ptr [edi+6E], 49002D00 :760F9851 5F pop edi :760F9852 52 push edx :760F9853 7063 jo 760F98B8 :760F9855 47 inc edi :760F9856 65 BYTE 065h :760F9857 7442 je 760F989B :760F9859 7566 jne 760F98C1 :760F985B 66 BYTE 066h :760F985C 65 BYTE 065h :760F985D 7200 jb 760F985F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F985D(C) | :760F985F 0092004E6472 add byte ptr [edx+72644E00], dl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F980E(C) | :760F9865 43 inc ebx :760F9866 6F outsd :760F9867 6E outsb :760F9868 666F outsw :760F986A 726D jb 760F98D9 :760F986C 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F97F5(C) | :760F986D 6E outsb :760F986E 7453 je 760F98C3 :760F9870 7472 je 760F98E4 :760F9872 696E67556E6D61 imul ebp, dword ptr [esi+67], 616D6E55 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9824(C) | :760F9879 7273 jb 760F98EE :760F987B 68616C6C00 push 006C6C61 :760F9880 06 push es :760F9881 014E64 add dword ptr [esi+64], ecx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F981F(C) | :760F9884 7253 jb 760F98D9 :760F9886 65 BYTE 065h :760F9887 7276 jb 760F98FF :760F9889 65 BYTE 065h :760F988A 7249 jb 760F98D5 :760F988C 6E outsb :760F988D 697469616C697A65 imul esi, dword ptr [ecx+2*ebp+61], 657A696C :760F9895 4E dec esi :760F9896 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9826(C) | :760F9897 7700 ja 760F9899 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9897(C) | :760F9899 000D014E6472 add byte ptr [72644E01], cl :760F989F 53 push ebx :760F98A0 696D706C655374 imul ebp, dword ptr [ebp+70], 7453656C :760F98A7 7275 jb 760F991E :760F98A9 63744D61 arpl dword ptr [ebp+2*ecx+61], esi :760F98AD 7273 jb 760F9922 :760F98AF 68616C6C00 push 006C6C61 :760F98B4 0B01 or eax, dword ptr [ecx] :760F98B6 4E dec esi :760F98B7 64 BYTE 064h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9853(C) | :760F98B8 7253 jb 760F990D :760F98BA 696D706C655374 imul ebp, dword ptr [ebp+70], 7453656C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9859(C) | :760F98C1 7275 jb 760F9938 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F986E(C) | :760F98C3 63744275 arpl dword ptr [edx+2*eax+75], esi :760F98C7 66 BYTE 066h :760F98C8 66 BYTE 066h :760F98C9 65 BYTE 065h :760F98CA 7253 jb 760F991F :760F98CC 697A65000F014E imul edi, dword ptr [edx+65], 4E010F00 :760F98D3 64 BYTE 064h :760F98D4 7253 jb 760F9929 :760F98D6 696D706C655374 imul ebp, dword ptr [ebp+70], 7453656C :760F98DD 7275 jb 760F9954 :760F98DF 6374556E arpl dword ptr [ebp+2*edx+6E], esi :760F98E3 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9870(C) | :760F98E4 61 popad :760F98E5 7273 jb 760F995A :760F98E7 68616C6C00 push 006C6C61 :760F98EC EC in al, dx :760F98ED 004E64 add byte ptr [esi+64], cl :760F98F0 7250 jb 760F9942 :760F98F2 6F outsd :760F98F3 696E7465724672 imul ebp, dword ptr [esi+74], 72467265 :760F98FA 65 BYTE 065h :760F98FB 65 BYTE 065h :760F98FC 0000 add byte ptr [eax], al :760F98FE 90 nop * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9887(C) | :760F98FF 004E64 add byte ptr [esi+64], cl :760F9902 7243 jb 760F9947 :760F9904 6F outsd :760F9905 6E outsb :760F9906 666F outsw :760F9908 726D jb 760F9977 :760F990A 61 popad :760F990B 6E outsb :760F990C 7453 je 760F9961 :760F990E 7472 je 760F9982 :760F9910 696E674D617273 imul ebp, dword ptr [esi+67], 7372614D :760F9917 68616C6C00 push 006C6C61 :760F991C 8500 test dword ptr [eax], eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F98A7(C) | :760F991E 4E dec esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F98CA(C) | :760F991F 64 BYTE 064h :760F9920 7243 jb 760F9965 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F98AD(C) | :760F9922 6F outsd :760F9923 6D insd :760F9924 706C jo 760F9992 :760F9926 65 BYTE 065h :760F9927 7853 js 760F997C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F98D4(C) | :760F9929 7472 je 760F999D :760F992B 7563 jne 760F9990 :760F992D 7442 je 760F9971 :760F992F 7566 jne 760F9997 :760F9931 66 BYTE 066h :760F9932 65 BYTE 065h :760F9933 7253 jb 760F9988 :760F9935 697A6500004000 imul edi, dword ptr [edx+65], 00400000 :760F993C 5F pop edi :760F993D 53 push ebx :760F993E 52 push edx :760F993F 53 push ebx :760F9940 65 BYTE 065h :760F9941 7452 je 760F9995 :760F9943 65 BYTE 065h :760F9944 7374 jnb 760F99BA :760F9946 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9902(C) | :760F9947 7265 jb 760F99AE :760F9949 50 push eax :760F994A 6F outsd :760F994B 696E7453403800 imul ebp, dword ptr [esi+74], 00384053 :760F9952 2E005F47 add byte ptr cs:[edi+47], bl :760F9956 65 BYTE 065h :760F9957 7453 je 760F99AC :760F9959 7461 je 760F99BC :760F995B 7465 je 760F99C2 :760F995D 4D dec ebp :760F995E 677244 jb 760F99A5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F990C(C) | :760F9961 69736B4D617853 imul esi, dword ptr [ebx+6B], 5378614D :760F9968 40 inc eax :760F9969 3000 xor byte ptr [eax], al :760F996B 0022 add byte ptr [edx], ah :760F996D 005F44 add byte ptr [edi+44], bl :760F9970 697361626C6553 imul esi, dword ptr [ebx+61], 53656C62 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9908(C) | :760F9977 52 push edx :760F9978 53 push ebx :760F9979 40 inc eax :760F997A 3400 xor al, 00 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9927(C) | :760F997C 3800 cmp byte ptr [eax], al :760F997E 5F pop edi :760F997F 49 dec ecx :760F9980 7353 jnb 760F99D5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F990E(C) | :760F9982 52 push edx :760F9983 45 inc ebp :760F9984 6E outsb :760F9985 61 popad :760F9986 626C6564 bound ebp, dword ptr [ebp+64] :760F998A 53 push ebx :760F998B 40 inc eax :760F998C 3000 xor byte ptr [eax], al :760F998E 3F aas :760F998F 005F53 add byte ptr [edi+53], bl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9924(C) | :760F9992 52 push edx :760F9993 44 inc esp :760F9994 697361626C6553 imul esi, dword ptr [ebx+61], 53656C62 :760F999B 667040 jo 760F99DE :760F999E 3400 xor al, 00 :760F99A0 42 inc edx :760F99A1 005F53 add byte ptr [edi+53], bl :760F99A4 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F995F(C) | :760F99A5 7453 je 760F99FA :760F99A7 7461 je 760F9A0A :760F99A9 7465 je 760F9A10 :760F99AB 4D dec ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9957(C) | :760F99AC 677244 jb 760F99F3 :760F99AF 69736B4D617853 imul esi, dword ptr [ebx+6B], 5378614D :760F99B6 40 inc eax :760F99B7 3400 xor al, 00 :760F99B9 002400 add byte ptr [eax+eax], ah * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9959(C) | :760F99BC 5F pop edi :760F99BD 45 inc ebp :760F99BE 6E outsb :760F99BF 61 popad :760F99C0 626C6546 bound ebp, dword ptr [ebp+46] :760F99C4 49 dec ecx :760F99C5 46 inc esi :760F99C6 4F dec edi :760F99C7 53 push ebx :760F99C8 40 inc eax :760F99C9 3000 xor byte ptr [eax], al :760F99CB 0021 add byte ptr [ecx], ah :760F99CD 005F44 add byte ptr [edi+44], bl :760F99D0 697361626C6546 imul esi, dword ptr [ebx+61], 46656C62 :760F99D7 49 dec ecx :760F99D8 46 inc esi :760F99D9 4F dec edi :760F99DA 53 push ebx :760F99DB 40 inc eax :760F99DC 3800 cmp byte ptr [eax], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F999C(C) | :760F99DE 06 push es :760F99DF 005F53 add byte ptr [edi+53], bl :760F99E2 65 BYTE 065h :760F99E3 7441 je 760F9A26 :760F99E5 7379 jnb 760F9A60 :760F99E7 6E outsb :760F99E8 63547261 arpl dword ptr [edx+2*esi+61], edx :760F99EC 636550 arpl dword ptr [ebp+50], esp :760F99EF 61 popad :760F99F0 7261 jb 760F9A53 :760F99F2 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F99AD(C) | :760F99F3 7340 jnb 760F9A35 :760F99F5 3136 xor dword ptr [esi], esi :760F99F7 0008 add byte ptr [eax], cl :760F99F9 005F5F add byte ptr [edi+5F], bl :760F99FC 64 BYTE 064h :760F99FD 7745 ja 760F9A44 :760F99FF 6E outsb :760F9A00 61 popad :760F9A01 626C6564 bound ebp, dword ptr [ebp+64] :760F9A05 54 push esp :760F9A06 7261 jb 760F9A69 :760F9A08 636573 arpl dword ptr [ebp+73], esp :760F9A0B 0001 add byte ptr [ecx], al :760F9A0D 005F41 add byte ptr [edi+41], bl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F99A9(C) | :760F9A10 7379 jnb 760F9A8B :760F9A12 6E outsb :760F9A13 635374 arpl dword ptr [ebx+74], edx :760F9A16 7269 jb 760F9A81 :760F9A18 6E outsb :760F9A19 6754 push esp :760F9A1B 7261 jb 760F9A7E :760F9A1D 636540 arpl dword ptr [ebp+40], esp :760F9A20 3132 xor dword ptr [edx], esi :760F9A22 0000 add byte ptr [eax], al :760F9A24 DE02 fiadd word ptr [edx] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F99E3(C) | :760F9A26 55 push ebp :760F9A27 6E outsb :760F9A28 6D insd :760F9A29 61 popad :760F9A2A 7056 jo 760F9A82 :760F9A2C 6965774F664669 imul esp, dword ptr [ebp+77], 6946664F :760F9A33 6C insb :760F9A34 65003D02526561 add byte ptr gs:[61655202], bh :760F9A3B 64 BYTE 064h :760F9A3C 46 inc esi :760F9A3D 696C65000026036C imul ebp, dword ptr [ebp], 6C032600 :760F9A45 7374 jnb 760F9ABB :760F9A47 7263 jb 760F9AAC :760F9A49 61 popad :760F9A4A 7441 je 760F9A8D :760F9A4C 0000 add byte ptr [eax], al :760F9A4E 8D02 lea eax, dword ptr [edx] :760F9A50 53 push ebx :760F9A51 65 BYTE 065h :760F9A52 7445 je 760F9A99 :760F9A54 6E outsb :760F9A55 7669 jbe 760F9AC0 :760F9A57 726F jb 760F9AC8 :760F9A59 6E outsb :760F9A5A 6D insd :760F9A5B 65 BYTE 065h :760F9A5C 6E outsb :760F9A5D 7456 je 760F9AB5 :760F9A5F 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F99E5(C) | :760F9A60 7269 jb 760F9ACB :760F9A62 61 popad :760F9A63 626C6541 bound ebp, dword ptr [ebp+41] :760F9A67 002D01476574 add byte ptr [74654701], ch :760F9A6D 4C dec esp :760F9A6E 61 popad :760F9A6F 7374 jnb 760F9AE5 :760F9A71 45 inc ebp :760F9A72 7272 jb 760F9AE6 :760F9A74 6F outsd :760F9A75 7200 jb 760F9A77 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9A75(C) | :760F9A77 009002536574 add byte ptr [eax+74655302], dl :760F9A7D 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9A1B(C) | :760F9A7E 7665 jbe 760F9AE5 :760F9A80 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9A16(C) | :760F9A81 7400 je 760F9A83 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9A81(C) | :760F9A83 007001 add byte ptr [eax+01], dh :760F9A86 47 inc edi :760F9A87 65 BYTE 065h :760F9A88 7453 je 760F9ADD :760F9A8A 7973 jns 760F9AFF :760F9A8C 7465 je 760F9AF3 :760F9A8E 6D insd :760F9A8F 44 inc esp :760F9A90 69726563746F72 imul esi, dword ptr [edx+65], 726F7463 :760F9A97 7941 jns 760F9ADA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9A52(C) | :760F9A99 0032 add byte ptr [edx], dh :760F9A9B 014765 add dword ptr [edi+65], eax :760F9A9E 744C je 760F9AEC :760F9AA0 6F outsd :760F9AA1 676963616C447269 imul esp, [bp+di+61], 6972446C :760F9AA9 7665 jbe 760F9B10 :760F9AAB 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9A47(C) | :760F9AAC 7472 je 760F9B20 :760F9AAE 696E6773410017 imul ebp, dword ptr [esi+67], 17004173 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9A5D(C) | :760F9AB5 014765 add dword ptr [edi+65], eax :760F9AB8 7444 je 760F9AFE :760F9ABA 7269 jb 760F9B25 :760F9ABC 7665 jbe 760F9B23 :760F9ABE 54 push esp :760F9ABF 7970 jns 760F9B31 :760F9AC1 65 BYTE 065h :760F9AC2 41 inc ecx :760F9AC3 009701476574 add byte ptr [edi+74654701], dl :760F9AC9 57 push edi :760F9ACA 696E646F777344 imul ebp, dword ptr [esi+64], 4473776F :760F9AD1 69726563746F72 imul esi, dword ptr [edx+65], 726F7463 :760F9AD8 7941 jns 760F9B1B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9A97(C) | :760F9ADA 0000 add byte ptr [eax], al :760F9ADC 0E push cs * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9A88(C) | :760F9ADD 035772 add edx, dword ptr [edi+72] :760F9AE0 69746546696C6500 imul esi, dword ptr [ebp+46], 00656C69 :760F9AE8 AC lodsb :760F9AE9 004669 add byte ptr [esi+69], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9A9E(C) | :760F9AEC 6E outsb :760F9AED 64 BYTE 064h :760F9AEE 4E dec esi :760F9AEF 65 BYTE 065h :760F9AF0 7874 js 760F9B66 :760F9AF2 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9A8C(C) | :760F9AF3 696C654100C80149 imul ebp, dword ptr [ebp+41], 4901C800 :760F9AFB 6E outsb :760F9AFC 7465 je 760F9B63 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9AB8(C) | :760F9AFE 726C jb 760F9B6C :760F9B00 6F outsd :760F9B01 636B65 arpl dword ptr [ebx+65], ebp :760F9B04 64 BYTE 064h :760F9B05 44 inc esp :760F9B06 65637265 arpl dword ptr gs:[edx+65], esi :760F9B0A 6D insd :760F9B0B 65 BYTE 065h :760F9B0C 6E outsb :760F9B0D 7400 je 760F9B0F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9B0D(C) | :760F9B0F 0020 add byte ptr [eax], ah :760F9B11 014765 add dword ptr [edi+65], eax :760F9B14 7446 je 760F9B5C :760F9B16 696C654174747269 imul ebp, dword ptr [ebp+41], 69727474 :760F9B1E 627574 bound esi, dword ptr [ebp+74] :760F9B21 65 BYTE 065h :760F9B22 7341 jnb 760F9B65 :760F9B24 0000 add byte ptr [eax], al :760F9B26 6400446973 add byte ptr fs:[ecx+2*ebp+73], al :760F9B2B 61 popad :760F9B2C 626C6554 bound ebp, dword ptr [ebp+54] :760F9B30 6872656164 push 64616572 :760F9B35 4C dec esp :760F9B36 69627261727943 imul esp, dword ptr [edx+72], 43797261 :760F9B3D 61 popad :760F9B3E 6C insb :760F9B3F 6C insb :760F9B40 7300 jnb 760F9B42 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9B40(C) | :760F9B42 4D dec ebp :760F9B43 004372 add byte ptr [ebx+72], al :760F9B46 65 BYTE 065h :760F9B47 61 popad :760F9B48 7465 je 760F9BAF :760F9B4A 54 push esp :760F9B4B 6872656164 push 64616572 :760F9B50 0000 add byte ptr [eax], al :760F9B52 FB sti :760F9B53 025761 add dl, byte ptr [edi+61] :760F9B56 6974466F724D756C imul esi, dword ptr [esi+2*eax+6F], 6C754D72 :760F9B5E 7469 je 760F9BC9 :760F9B60 706C jo 760F9BCE :760F9B62 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9AFC(C) | :760F9B63 4F dec edi :760F9B64 626A65 bound ebp, dword ptr [edx+65] :760F9B67 63747300 arpl dword ptr [ebx+2*esi], esi :760F9B6B 009502536574 add byte ptr [ebp+74655302], dl :760F9B71 46 inc esi :760F9B72 696C65506F696E74 imul ebp, dword ptr [ebp+50], 746E696F :760F9B7A 65 BYTE 065h :760F9B7B 7200 jb 760F9B7D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9B7B(C) | :760F9B7D 008C0253657445 add byte ptr [edx+eax+45746553], cl :760F9B84 6E outsb :760F9B85 64 BYTE 064h :760F9B86 4F dec edi :760F9B87 6646 inc si :760F9B89 696C650000250147 imul ebp, dword ptr [ebp], 47012500 :760F9B91 65 BYTE 065h :760F9B92 7446 je 760F9BDA :760F9B94 696C6553697A6500 imul ebp, dword ptr [ebp+53], 00657A69 :760F9B9C 3800 cmp byte ptr [eax], al :760F9B9E 43 inc ebx :760F9B9F 7265 jb 760F9C06 :760F9BA1 61 popad :760F9BA2 7465 je 760F9C09 :760F9BA4 46 inc esi :760F9BA5 696C654D61707069 imul ebp, dword ptr [ebp+4D], 69707061 :760F9BAD 6E outsb :760F9BAE 6741 inc ecx :760F9BB0 0000 add byte ptr [eax], al :760F9BB2 F5 cmc :760F9BB3 014D61 add dword ptr [ebp+61], ecx :760F9BB6 7056 jo 760F9C0E :760F9BB8 6965774F664669 imul esp, dword ptr [ebp+77], 6946664F :760F9BBF 6C insb :760F9BC0 65003501476574 add byte ptr gs:[74654701], dh :760F9BC7 4C dec esp :760F9BC8 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9B5E(C) | :760F9BC9 6E outsb :760F9BCA 6750 push eax :760F9BCC 61 popad :760F9BCD 7468 je 760F9C37 :760F9BCF 4E dec esi :760F9BD0 61 popad :760F9BD1 6D insd :760F9BD2 65 BYTE 065h :760F9BD3 41 inc ecx :760F9BD4 0000 add byte ptr [eax], al :760F9BD6 B401 mov ah, 01 :760F9BD8 48 dec eax :760F9BD9 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9B92(C) | :760F9BDA 61 popad :760F9BDB 7041 jo 760F9C1E :760F9BDD 6C insb :760F9BDE 6C insb :760F9BDF 6F outsd :760F9BE0 6300 arpl dword ptr [eax], eax :760F9BE2 E501 in ax, 01 :760F9BE4 4C dec esp :760F9BE5 6F outsd :760F9BE6 63616C arpl dword ptr [ecx+6C], esp :760F9BE9 41 inc ecx :760F9BEA 6C insb :760F9BEB 6C insb :760F9BEC 6F outsd :760F9BED 6300 arpl dword ptr [eax], eax :760F9BEF 00E9 add cl, ch :760F9BF1 014C6F63 add dword ptr [edi+2*ebp+63], ecx :760F9BF5 61 popad :760F9BF6 6C insb :760F9BF7 46 inc esi :760F9BF8 7265 jb 760F9C5F :760F9BFA 65005501 add byte ptr gs:[ebp+01], dl :760F9BFE 47 inc edi :760F9BFF 65 BYTE 065h :760F9C00 7450 je 760F9C52 :760F9C02 726F jb 760F9C73 :760F9C04 636573 arpl dword ptr [ebp+73], esp :760F9C07 7348 jnb 760F9C51 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9BA2(C) | :760F9C09 65 BYTE 065h :760F9C0A 61 popad :760F9C0B 7000 jo 760F9C0D * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C0B(C) | :760F9C0D 00BA01486561 add byte ptr [edx+61654801], bh :760F9C13 7046 jo 760F9C5B :760F9C15 7265 jb 760F9C7C :760F9C17 65 BYTE 065h :760F9C18 0000 add byte ptr [eax], al :760F9C1A 36036C7374 add ebp, dword ptr ss:[ebx+2*esi+74] :760F9C1F 726C jb 760F9C8D :760F9C21 65 BYTE 065h :760F9C22 6E outsb :760F9C23 57 push edi :760F9C24 0000 add byte ptr [eax], al :760F9C26 2F das :760F9C27 036C7374 add ebp, dword ptr [ebx+2*esi+74] :760F9C2B 7263 jb 760F9C90 :760F9C2D 7079 jo 760F9CA8 :760F9C2F 41 inc ecx :760F9C30 0000 add byte ptr [eax], al :760F9C32 0103 add dword ptr [ebx], eax :760F9C34 57 push edi :760F9C35 6964654368617254 imul esp, dword ptr [ebp+43], 54726168 :760F9C3D 6F outsd :760F9C3E 4D dec ebp :760F9C3F 756C jne 760F9CAD :760F9C41 7469 je 760F9CAC :760F9C43 42 inc edx :760F9C44 7974 jns 760F9CBA :760F9C46 6500C3 add bl, al :760F9C49 02536C add dl, byte ptr [ebx+6C] :760F9C4C 65 BYTE 065h :760F9C4D 65 BYTE 065h :760F9C4E 7000 jo 760F9C50 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C4E(C) | :760F9C50 B801486561 mov eax, 61654801 :760F9C55 7044 jo 760F9C9B :760F9C57 65 BYTE 065h :760F9C58 7374 jnb 760F9CCE :760F9C5A 726F jb 760F9CCB :760F9C5C 7900 jns 760F9C5E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C5C(C) | :760F9C5E B601 mov dh, 01 :760F9C60 48 dec eax :760F9C61 65 BYTE 065h :760F9C62 61 popad :760F9C63 7043 jo 760F9CA8 :760F9C65 7265 jb 760F9CCC :760F9C67 61 popad :760F9C68 7465 je 760F9CCF :760F9C6A 0000 add byte ptr [eax], al :760F9C6C 3203 xor al, byte ptr [ebx] :760F9C6E 6C insb :760F9C6F 7374 jnb 760F9CE5 :760F9C71 7263 jb 760F9CD6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C02(C) | :760F9C73 7079 jo 760F9CEE :760F9C75 6E outsb :760F9C76 41 inc ecx :760F9C77 002F add byte ptr [edi], ch :760F9C79 014765 add dword ptr [edi+65], eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C15(C) | :760F9C7C 744C je 760F9CCA :760F9C7E 6F outsd :760F9C7F 63616C arpl dword ptr [ecx+6C], esp :760F9C82 54 push esp :760F9C83 696D6500004A00 imul ebp, dword ptr [ebp+65], 004A0000 :760F9C8A 43 inc ebx :760F9C8B 7265 jb 760F9CF2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C1F(C) | :760F9C8D 61 popad :760F9C8E 7465 je 760F9CF5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C2B(C) | :760F9C90 53 push ebx :760F9C91 65 BYTE 065h :760F9C92 6D insd :760F9C93 61 popad :760F9C94 7068 jo 760F9CFE :760F9C96 6F outsd :760F9C97 7265 jb 760F9CFE :760F9C99 41 inc ecx :760F9C9A 0000 add byte ptr [eax], al :760F9C9C 4A dec edx :760F9C9D 025265 add dl, byte ptr [edx+65] :760F9CA0 6C insb :760F9CA1 65 BYTE 065h :760F9CA2 61 popad :760F9CA3 7365 jnb 760F9D0A :760F9CA5 53 push ebx :760F9CA6 65 BYTE 065h :760F9CA7 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F9C2D(C), :760F9C63(C) | :760F9CA8 61 popad :760F9CA9 7068 jo 760F9D13 :760F9CAB 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C41(C) | :760F9CAC 7265 jb 760F9D13 :760F9CAE 0000 add byte ptr [eax], al :760F9CB0 C501 lds eax, dword ptr [ecx] :760F9CB2 49 dec ecx :760F9CB3 6E outsb :760F9CB4 697469616C697A65 imul esi, dword ptr [ecx+2*ebp+61], 657A696C :760F9CBC 43 inc ebx :760F9CBD 7269 jb 760F9D28 :760F9CBF 7469 je 760F9D2A :760F9CC1 63616C arpl dword ptr [ecx+6C], esp :760F9CC4 53 push ebx :760F9CC5 656374696F arpl dword ptr gs:[ecx+2*ebp+6F], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C7C(C) | :760F9CCA 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C5A(C) | :760F9CCB 003400 add byte ptr [eax+eax], dh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C58(C) | :760F9CCE 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C68(C) | :760F9CCF 7265 jb 760F9D36 :760F9CD1 61 popad :760F9CD2 7465 je 760F9D39 :760F9CD4 45 inc ebp :760F9CD5 7665 jbe 760F9D3C :760F9CD7 6E outsb :760F9CD8 7441 je 760F9D1B :760F9CDA 0000 add byte ptr [eax], al :760F9CDC 5A pop edx :760F9CDD 0044656C add byte ptr [ebp+6C], al :760F9CE1 65 BYTE 065h :760F9CE2 7465 je 760F9D49 :760F9CE4 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C6F(C) | :760F9CE5 7269 jb 760F9D50 :760F9CE7 7469 je 760F9D52 :760F9CE9 63616C arpl dword ptr [ecx+6C], esp :760F9CEC 53 push ebx :760F9CED 656374696F arpl dword ptr gs:[ecx+2*ebp+6F], esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C8B(C) | :760F9CF2 6E outsb :760F9CF3 001E add byte ptr [esi], bl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9C8E(C) | :760F9CF5 00436C add byte ptr [ebx+6C], al :760F9CF8 6F outsd :760F9CF9 7365 jnb 760F9D60 :760F9CFB 48 dec eax :760F9CFC 61 popad :760F9CFD 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F9C94(C), :760F9C97(C) | :760F9CFE 64 BYTE 064h :760F9CFF 6C insb :760F9D00 6500FD add ch, bh :760F9D03 025761 add dl, byte ptr [edi+61] :760F9D06 6974466F7253696E imul esi, dword ptr [esi+2*eax+6F], 6E695372 :760F9D0E 676C insb :760F9D10 65 BYTE 065h :760F9D11 4F dec edi :760F9D12 626A65 bound ebp, dword ptr [edx+65] :760F9D15 637400DE arpl dword ptr [eax+eax-22], esi :760F9D19 014C6561 add dword ptr [ebp+61], ecx :760F9D1D 7665 jbe 760F9D84 :760F9D1F 43 inc ebx :760F9D20 7269 jb 760F9D8B :760F9D22 7469 je 760F9D8D :760F9D24 63616C arpl dword ptr [ecx+6C], esp :760F9D27 53 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9CBD(C) | :760F9D28 656374696F arpl dword ptr gs:[ecx+2*ebp+6F], esi :760F9D2D 6E outsb :760F9D2E 0000 add byte ptr [eax], al :760F9D30 6F outsd :760F9D31 00456E add byte ptr [ebp+6E], al :760F9D34 7465 je 760F9D9B * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9CCF(C) | :760F9D36 7243 jb 760F9D7B :760F9D38 7269 jb 760F9DA3 :760F9D3A 7469 je 760F9DA5 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9CD5(C) | :760F9D3C 63616C arpl dword ptr [ecx+6C], esp :760F9D3F 53 push ebx :760F9D40 656374696F arpl dword ptr gs:[ecx+2*ebp+6F], esi :760F9D45 6E outsb :760F9D46 0000 add byte ptr [eax], al :760F9D48 1303 adc eax, dword ptr [ebx] :760F9D4A 57 push edi :760F9D4B 7269 jb 760F9DB6 :760F9D4D 7465 je 760F9DB4 :760F9D4F 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9CE5(C) | :760F9D50 7269 jb 760F9DBB * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9CE7(C) | :760F9D52 7661 jbe 760F9DB5 :760F9D54 7465 je 760F9DBB :760F9D56 50 push eax :760F9D57 726F jb 760F9DC8 :760F9D59 66696C65537472 imul bp, word ptr [ebp+53], 7274 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9CF9(C) | :760F9D60 696E674100002B imul ebp, dword ptr [esi+67], 2B000041 :760F9D67 00436F add byte ptr [ebx+6F], al :760F9D6A 7079 jo 760F9DE5 :760F9D6C 46 inc esi :760F9D6D 696C65410002024D imul ebp, dword ptr [ebp+41], 4D020200 :760F9D75 756C jne 760F9DE3 :760F9D77 7469 je 760F9DE2 :760F9D79 42 inc edx :760F9D7A 7974 jns 760F9DF0 :760F9D7C 65 BYTE 065h :760F9D7D 54 push esp :760F9D7E 6F outsd :760F9D7F 57 push edi :760F9D80 6964654368617200 imul esp, dword ptr [ebp+43], 00726168 :760F9D88 3000 xor byte ptr [eax], al :760F9D8A 43 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9D20(C) | :760F9D8B 7265 jb 760F9DF2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9D22(C) | :760F9D8D 61 popad :760F9D8E 7465 je 760F9DF5 :760F9D90 44 inc esp :760F9D91 69726563746F72 imul esi, dword ptr [edx+65], 726F7463 :760F9D98 7941 jns 760F9DDB :760F9D9A 0000 add byte ptr [eax], al :760F9D9C 35036C7374 xor eax, 74736C03 :760F9DA1 726C jb 760F9E0F * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9D38(C) | :760F9DA3 65 BYTE 065h :760F9DA4 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9D3A(C) | :760F9DA5 41 inc ecx :760F9DA6 0000 add byte ptr [eax], al :760F9DA8 2C03 sub al, 03 :760F9DAA 6C insb :760F9DAB 7374 jnb 760F9E21 :760F9DAD 7263 jb 760F9E12 :760F9DAF 6D insd :760F9DB0 7069 jo 760F9E1B :760F9DB2 41 inc ecx :760F9DB3 0008 add byte ptr [eax], cl * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9D52(C) | :760F9DB5 024F70 add cl, byte ptr [edi+70] :760F9DB8 65 BYTE 065h :760F9DB9 6E outsb :760F9DBA 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F9D50(C), :760F9D54(C) | :760F9DBB 7665 jbe 760F9E22 :760F9DBD 6E outsb :760F9DBE 7441 je 760F9E01 :760F9DC0 0000 add byte ptr [eax], al :760F9DC2 8F01 pop dword ptr [ecx] :760F9DC4 47 inc edi :760F9DC5 65 BYTE 065h :760F9DC6 7456 je 760F9E1E * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9D57(C) | :760F9DC8 65 BYTE 065h :760F9DC9 7273 jb 760F9E3E :760F9DCB 696F6E45784100 imul ebp, dword ptr [edi+6E], 00417845 :760F9DD2 2903 sub dword ptr [ebx], eax :760F9DD4 6C insb :760F9DD5 7374 jnb 760F9E4B :760F9DD7 7263 jb 760F9E3C :760F9DD9 6D insd :760F9DDA 7041 jo 760F9E1D :760F9DDC 0000 add byte ptr [eax], al :760F9DDE A30046696E mov dword ptr [6E694600], eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9D75(C) | :760F9DE3 64 BYTE 064h :760F9DE4 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9D6A(C) | :760F9DE5 6972737446696C imul esi, dword ptr [edx+73], 6C694674 :760F9DEC 65 BYTE 065h :760F9DED 41 inc ecx :760F9DEE 0000 add byte ptr [eax], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9D7A(C) | :760F9DF0 93 xchg eax,ebx :760F9DF1 025365 add dl, byte ptr [ebx+65] :760F9DF4 7446 je 760F9E3C :760F9DF6 696C654174747269 imul ebp, dword ptr [ebp+41], 69727474 :760F9DFE 627574 bound esi, dword ptr [ebp+74] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9DBE(C) | :760F9E01 65 BYTE 065h :760F9E02 7341 jnb 760F9E45 :760F9E04 0000 add byte ptr [eax], al :760F9E06 5C pop esp :760F9E07 0044656C add byte ptr [ebp+6C], al :760F9E0B 65 BYTE 065h :760F9E0C 7465 je 760F9E73 :760F9E0E 46 inc esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9DA1(C) | :760F9E0F 696C6541008F0045 imul ebp, dword ptr [ebp+41], 45008F00 :760F9E17 7870 js 760F9E89 :760F9E19 61 popad :760F9E1A 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9DB0(C) | :760F9E1B 64 BYTE 064h :760F9E1C 45 inc ebp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9DDA(C) | :760F9E1D 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9DC6(C) | :760F9E1E 7669 jbe 760F9E89 :760F9E20 726F jb 760F9E91 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9DBB(C) | :760F9E22 6E outsb :760F9E23 6D insd :760F9E24 65 BYTE 065h :760F9E25 6E outsb :760F9E26 7453 je 760F9E7B :760F9E28 7472 je 760F9E9C :760F9E2A 696E67734100C3 imul ebp, dword ptr [esi+67], C3004173 :760F9E31 004672 add byte ptr [esi+72], al :760F9E34 65 BYTE 065h :760F9E35 65 BYTE 065h :760F9E36 4C dec esp :760F9E37 69627261727900 imul esp, dword ptr [edx+72], 00797261 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9DC9(C) | :760F9E3E DF01 fild word ptr [ecx] :760F9E40 4C dec esp :760F9E41 6F outsd :760F9E42 61 popad :760F9E43 64 BYTE 064h :760F9E44 4C dec esp * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9E02(C) | :760F9E45 69627261727941 imul esp, dword ptr [edx+72], 41797261 :760F9E4C 0000 add byte ptr [eax], al :760F9E4E 37 aaa :760F9E4F 004372 add byte ptr [ebx+72], al :760F9E52 65 BYTE 065h :760F9E53 61 popad :760F9E54 7465 je 760F9EBB :760F9E56 46 inc esi :760F9E57 696C6541009F0046 imul ebp, dword ptr [ebp+41], 46009F00 :760F9E5F 696E64436C6F73 imul ebp, dword ptr [esi+64], 736F6C43 :760F9E66 65004901 add byte ptr gs:[ecx+01], cl :760F9E6A 47 inc edi :760F9E6B 65 BYTE 065h :760F9E6C 7453 je 760F9EC1 :760F9E6E 7973 jns 760F9EE3 :760F9E70 7465 je 760F9ED7 :760F9E72 6D insd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9E0C(C) | :760F9E73 4D dec ebp :760F9E74 65 BYTE 065h :760F9E75 7472 je 760F9EE9 :760F9E77 69637300009500 imul esp, dword ptr [ebx+73], 00950000 :760F9E7E 44 inc esp :760F9E7F 69616C6F67426F imul esp, dword ptr [ecx+6C], 6F42676F :760F9E86 7850 js 760F9ED8 :760F9E88 61 popad * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F9E17(C), :760F9E1E(C) | :760F9E89 7261 jb 760F9EEC :760F9E8B 6D insd :760F9E8C 41 inc ecx :760F9E8D 002F add byte ptr [edi], ch :760F9E8F 004368 add byte ptr [ebx+68], al :760F9E92 61 popad :760F9E93 7255 jb 760F9EEA :760F9E95 7070 jo 760F9F07 :760F9E97 65 BYTE 065h :760F9E98 7241 jb 760F9EDB :760F9E9A 0000 add byte ptr [eax], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9E28(C) | :760F9E9C C3 ret :760F9E9D 014D65 add dword ptr [ebp+65], ecx :760F9EA0 7373 jnb 760F9F15 :760F9EA2 61 popad :760F9EA3 67 BYTE 067h :760F9EA4 65 BYTE 065h :760F9EA5 42 inc edx :760F9EA6 6F outsd :760F9EA7 7841 js 760F9EEA :760F9EA9 00D5 add ch, dl :760F9EAB 004578 add byte ptr [ebp+78], al :760F9EAE 697457696E646F77 imul esi, dword ptr [edi+2*edx+69], 776F646E :760F9EB6 7345 jnb 760F9EFD :760F9EB8 7800 js 760F9EBA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9EB8(C) | :760F9EBA BB00456E64 mov ebx, 646E4500 :760F9EBF 44 inc esp :760F9EC0 69616C6F6700B3 imul esp, dword ptr [ecx+6C], B300676F :760F9EC7 027773 add dh, byte ptr [edi+73] :760F9ECA 7072 jo 760F9F3E :760F9ECC 696E74664100B2 imul ebp, dword ptr [esi+74], B2004166 :760F9ED3 015265 add dword ptr [edx+65], edx :760F9ED6 6753 push ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9E86(C) | :760F9ED8 65 BYTE 065h :760F9ED9 7456 je 760F9F31 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9E98(C) | :760F9EDB 61 popad :760F9EDC 6C insb :760F9EDD 7565 jne 760F9F44 :760F9EDF 45 inc ebp :760F9EE0 7841 js 760F9F23 :760F9EE2 0000 add byte ptr [eax], al :760F9EE4 8401 test byte ptr [ecx], al :760F9EE6 52 push edx :760F9EE7 656743 inc ebx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F9E93(C), :760F9EA7(C) | :760F9EEA 6C insb :760F9EEB 6F outsd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9E89(C) | :760F9EEC 7365 jnb 760F9F53 :760F9EEE 4B dec ebx :760F9EEF 65 BYTE 065h :760F9EF0 7900 jns 760F9EF2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9EF0(C) | :760F9EF2 A7 cmpsd :760F9EF3 015265 add dword ptr [edx+65], edx :760F9EF6 6751 push ecx :760F9EF8 7565 jne 760F9F5F :760F9EFA 7279 jb 760F9F75 :760F9EFC 56 push esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9EB6(C) | :760F9EFD 61 popad :760F9EFE 6C insb :760F9EFF 7565 jne 760F9F66 :760F9F01 45 inc ebp :760F9F02 7841 js 760F9F45 :760F9F04 0000 add byte ptr [eax], al :760F9F06 9C pushfd * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9E95(C) | :760F9F07 015265 add dword ptr [edx+65], edx :760F9F0A 674F dec edi :760F9F0C 7065 jo 760F9F73 :760F9F0E 6E outsb :760F9F0F 4B dec ebx :760F9F10 65 BYTE 065h :760F9F11 7941 jns 760F9F54 :760F9F13 008801526567 add byte ptr [eax+67655201], cl :760F9F19 43 inc ebx :760F9F1A 7265 jb 760F9F81 :760F9F1C 61 popad :760F9F1D 7465 je 760F9F84 :760F9F1F 4B dec ebx :760F9F20 65 BYTE 065h :760F9F21 7945 jns 760F9F68 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9EE0(C) | :760F9F23 7841 js 760F9F66 :760F9F25 009D01526567 add byte ptr [ebp+67655201], bl :760F9F2B 4F dec edi :760F9F2C 7065 jo 760F9F93 :760F9F2E 6E outsb :760F9F2F 4B dec ebx :760F9F30 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9ED9(C) | :760F9F31 7945 jns 760F9F78 :760F9F33 7841 js 760F9F76 :760F9F35 008D01526567 add byte ptr [ebp+67655201], cl :760F9F3B 44 inc esp :760F9F3C 65 BYTE 065h :760F9F3D 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9ECA(C) | :760F9F3E 65 BYTE 065h :760F9F3F 7465 je 760F9FA6 :760F9F41 56 push esi :760F9F42 61 popad :760F9F43 6C insb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9EDD(C) | :760F9F44 7565 jne 760F9FAB :760F9F46 41 inc ecx :760F9F47 009101526567 add byte ptr [ecx+67655201], dl :760F9F4D 45 inc ebp :760F9F4E 6E outsb :760F9F4F 756D jne 760F9FBE :760F9F51 4B dec ebx :760F9F52 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9EEC(C) | :760F9F53 7945 jns 760F9F9A :760F9F55 7841 js 760F9F98 :760F9F57 00940152656745 add byte ptr [ecx+eax+45676552], dl :760F9F5E 6E outsb * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9EF8(C) | :760F9F5F 756D jne 760F9FCE :760F9F61 56 push esi :760F9F62 61 popad :760F9F63 6C insb :760F9F64 7565 jne 760F9FCB * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:760F9EFF(C), :760F9F23(C) | :760F9F66 41 inc ecx :760F9F67 008B01526567 add byte ptr [ebx+67655201], cl :760F9F6D 44 inc esp :760F9F6E 65 BYTE 065h :760F9F6F 6C insb :760F9F70 65 BYTE 065h :760F9F71 7465 je 760F9FD8 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9F0C(C) | :760F9F73 4B dec ebx :760F9F74 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9EFA(C) | :760F9F75 7941 jns 760F9FB8 :760F9F77 006200 add byte ptr [edx+00], ah :760F9F7A 53 push ebx :760F9F7B 48 dec eax :760F9F7C 47 inc edi :760F9F7D 65 BYTE 065h :760F9F7E 7453 je 760F9FD3 :760F9F80 7065 jo 760F9FE7 :760F9F82 636961 arpl dword ptr [ecx+61], ebp :760F9F85 6C insb :760F9F86 46 inc esi :760F9F87 6F outsd :760F9F88 6C insb :760F9F89 64 BYTE 064h :760F9F8A 65 BYTE 065h :760F9F8B 7250 jb 760F9FDD :760F9F8D 61 popad :760F9F8E 7468 je 760F9FF8 :760F9F90 41 inc ecx :760F9F91 004100 add byte ptr [ecx+00], al :760F9F94 43 inc ebx :760F9F95 65 BYTE 065h :760F9F96 7274 jb 760FA00C * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9F55(C) | :760F9F98 47 inc edi :760F9F99 65 BYTE 065h * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9F53(C) | :760F9F9A 7445 je 760F9FE1 :760F9F9C 6E outsb :760F9F9D 68616E6365 push 65636E61 :760F9FA2 64 BYTE 064h :760F9FA3 4B dec ebx :760F9FA4 65 BYTE 065h :760F9FA5 7955 jns 760F9FFC :760F9FA7 7361 jnb 760FA00A :760F9FA9 676500920043 add gs:[bp+si+4300], dl :760F9FAF 7279 jb 760FA02A :760F9FB1 7074 jo 760FA027 :760F9FB3 48 dec eax :760F9FB4 61 popad :760F9FB5 7368 jnb 760FA01F :760F9FB7 50 push eax * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9F75(C) | :760F9FB8 7562 jne 760FA01C :760F9FBA 6C insb :760F9FBB 69634B6579496E imul esp, dword ptr [ebx+4B], 6E497965 :760F9FC2 666F outsw :760F9FC4 000000000000 BYTE 6 DUP(0) :760F9FCA 1338 adc edi, dword ptr [eax] :760F9FCC 3539000000 xor eax, 00000039 :760F9FD1 000400 add byte ptr [eax+eax], al :760F9FD4 0000 add byte ptr [eax], al :760F9FD6 1001 adc byte ptr [ecx], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9F71(C) | :760F9FD8 00000000000000 BYTE 7 DUP(0) :760F9FDF 2002 and byte ptr [edx], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9F9A(C) | :760F9FE1 0000000000 BYTE 5 DUP(0) :760F9FE6 1338 adc edi, dword ptr [eax] :760F9FE8 3539000000 xor eax, 00000039 :760F9FED 0002 add byte ptr [edx], al :760F9FEF 000000 BYTE 3 DUP(0) :760F9FF2 1F pop ds :760F9FF3 00000000000000 BYTE 7 DUP(0) :760F9FFA 90 nop :760F9FFB FE BYTE 0feh * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9FA5(C) | :760F9FFC A3FF000000 mov dword ptr [000000FF], eax :760FA001 0013 add byte ptr [ebx], dl :760FA003 383539000000 cmp byte ptr [00000039], dh :760FA009 000400 add byte ptr [eax+eax], al * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:760F9F96(C) | :760FA00C 0000 add byte ptr [eax], al :760FA00E 1001 adc byte ptr [ecx], al :760FA010 00000000000000 BYTE 7 DUP(0) :760FA017 2A0500000000 sub al, byte ptr [00000000] :760FA01D 000000000000000000 BYTE 9 DUP(0) :760FA026 0A00 or al, byte ptr [eax] :760FA028 00000000000000000000 BYTE 10 DUP(0) :760FA032 00000000000000000000 BYTE 10 DUP(0) :760FA03C 00000000000000000000 BYTE 10 DUP(0) :760FA046 00000000000000000000 BYTE 10 DUP(0) :760FA050 00000000000000000000 BYTE 10 DUP(0) :760FA05A 00000000000000000000 BYTE 10 DUP(0) :760FA064 00000000000000000000 BYTE 10 DUP(0) :760FA06E 00000000000000000000 BYTE 10 DUP(0) :760FA078 00000000000000000000 BYTE 10 DUP(0) :760FA082 00000000000000000000 BYTE 10 DUP(0) :760FA08C 00000000000000000000 BYTE 10 DUP(0) :760FA096 00000000000000000000 BYTE 10 DUP(0) :760FA0A0 00000000000000000000 BYTE 10 DUP(0) :760FA0AA 00000000000000000000 BYTE 10 DUP(0) :760FA0B4 00000000000000000000 BYTE 10 DUP(0) :760FA0BE 00000000000000000000 BYTE 10 DUP(0) :760FA0C8 00000000000000000000 BYTE 10 DUP(0) :760FA0D2 00000000000000000000 BYTE 10 DUP(0) :760FA0DC 00000000000000000000 BYTE 10 DUP(0) :760FA0E6 00000000000000000000 BYTE 10 DUP(0) :760FA0F0 00000000000000000000 BYTE 10 DUP(0) :760FA0FA 00000000000000000000 BYTE 10 DUP(0) :760FA104 00000000000000000000 BYTE 10 DUP(0) :760FA10E 00000000000000000000 BYTE 10 DUP(0) :760FA118 00000000000000000000 BYTE 10 DUP(0) :760FA122 00000000000000000000 BYTE 10 DUP(0) :760FA12C 00000000000000000000 BYTE 10 DUP(0) :760FA136 00000000000000000000 BYTE 10 DUP(0) :760FA140 00000000000000000000 BYTE 10 DUP(0) :760FA14A 00000000000000000000 BYTE 10 DUP(0) :760FA154 00000000000000000000 BYTE 10 DUP(0) :760FA15E 00000000000000000000 BYTE 10 DUP(0) :760FA168 00000000000000000000 BYTE 10 DUP(0) :760FA172 00000000000000000000 BYTE 10 DUP(0) :760FA17C 00000000000000000000 BYTE 10 DUP(0) :760FA186 00000000000000000000 BYTE 10 DUP(0) :760FA190 00000000000000000000 BYTE 10 DUP(0) :760FA19A 00000000000000000000 BYTE 10 DUP(0) :760FA1A4 00000000000000000000 BYTE 10 DUP(0) :760FA1AE 00000000000000000000 BYTE 10 DUP(0) :760FA1B8 00000000000000000000 BYTE 10 DUP(0) :760FA1C2 00000000000000000000 BYTE 10 DUP(0) :760FA1CC 00000000000000000000 BYTE 10 DUP(0) :760FA1D6 00000000000000000000 BYTE 10 DUP(0) :760FA1E0 00000000000000000000 BYTE 10 DUP(0) :760FA1EA 00000000000000000000 BYTE 10 DUP(0) :760FA1F4 00000000000000000000 BYTE 10 DUP(0) :760FA1FE 00000000000000000000 BYTE 10 DUP(0) :760FA208 00000000000000000000 BYTE 10 DUP(0) :760FA212 00000000000000000000 BYTE 10 DUP(0) :760FA21C 00000000000000000000 BYTE 10 DUP(0) :760FA226 00000000000000000000 BYTE 10 DUP(0) :760FA230 00000000000000000000 BYTE 10 DUP(0) :760FA23A 00000000000000000000 BYTE 10 DUP(0) :760FA244 00000000000000000000 BYTE 10 DUP(0) :760FA24E 00000000000000000000 BYTE 10 DUP(0) :760FA258 00000000000000000000 BYTE 10 DUP(0) :760FA262 00000000000000000000 BYTE 10 DUP(0) :760FA26C 00000000000000000000 BYTE 10 DUP(0) :760FA276 00000000000000000000 BYTE 10 DUP(0) :760FA280 00000000000000000000 BYTE 10 DUP(0) :760FA28A 00000000000000000000 BYTE 10 DUP(0) :760FA294 00000000000000000000 BYTE 10 DUP(0) :760FA29E 00000000000000000000 BYTE 10 DUP(0) :760FA2A8 00000000000000000000 BYTE 10 DUP(0) :760FA2B2 00000000000000000000 BYTE 10 DUP(0) :760FA2BC 00000000000000000000 BYTE 10 DUP(0) :760FA2C6 00000000000000000000 BYTE 10 DUP(0) :760FA2D0 00000000000000000000 BYTE 10 DUP(0) :760FA2DA 00000000000000000000 BYTE 10 DUP(0) :760FA2E4 00000000000000000000 BYTE 10 DUP(0) :760FA2EE 00000000000000000000 BYTE 10 DUP(0) :760FA2F8 00000000000000000000 BYTE 10 DUP(0) :760FA302 00000000000000000000 BYTE 10 DUP(0) :760FA30C 00000000000000000000 BYTE 10 DUP(0) :760FA316 00000000000000000000 BYTE 10 DUP(0) :760FA320 00000000000000000000 BYTE 10 DUP(0) :760FA32A 00000000000000000000 BYTE 10 DUP(0) :760FA334 00000000000000000000 BYTE 10 DUP(0) :760FA33E 00000000000000000000 BYTE 10 DUP(0) :760FA348 00000000000000000000 BYTE 10 DUP(0) :760FA352 00000000000000000000 BYTE 10 DUP(0) :760FA35C 00000000000000000000 BYTE 10 DUP(0) :760FA366 00000000000000000000 BYTE 10 DUP(0) :760FA370 00000000000000000000 BYTE 10 DUP(0) :760FA37A 00000000000000000000 BYTE 10 DUP(0) :760FA384 00000000000000000000 BYTE 10 DUP(0) :760FA38E 00000000000000000000 BYTE 10 DUP(0) :760FA398 00000000000000000000 BYTE 10 DUP(0) :760FA3A2 00000000000000000000 BYTE 10 DUP(0) :760FA3AC 00000000000000000000 BYTE 10 DUP(0) :760FA3B6 00000000000000000000 BYTE 10 DUP(0) :760FA3C0 00000000000000000000 BYTE 10 DUP(0) :760FA3CA 00000000000000000000 BYTE 10 DUP(0) :760FA3D4 00000000000000000000 BYTE 10 DUP(0) :760FA3DE 00000000000000000000 BYTE 10 DUP(0) :760FA3E8 00000000000000000000 BYTE 10 DUP(0) :760FA3F2 00000000000000000000 BYTE 10 DUP(0) :760FA3FC 00000000000000000000 BYTE 10 DUP(0) :760FA406 00000000000000000000 BYTE 10 DUP(0) :760FA410 00000000000000000000 BYTE 10 DUP(0) :760FA41A 00000000000000000000 BYTE 10 DUP(0) :760FA424 00000000000000000000 BYTE 10 DUP(0) :760FA42E 00000000000000000000 BYTE 10 DUP(0) :760FA438 00000000000000000000 BYTE 10 DUP(0) :760FA442 00000000000000000000 BYTE 10 DUP(0) :760FA44C 00000000000000000000 BYTE 10 DUP(0) :760FA456 00000000000000000000 BYTE 10 DUP(0) :760FA460 00000000000000000000 BYTE 10 DUP(0) :760FA46A 00000000000000000000 BYTE 10 DUP(0) :760FA474 00000000000000000000 BYTE 10 DUP(0) :760FA47E 00000000000000000000 BYTE 10 DUP(0) :760FA488 00000000000000000000 BYTE 10 DUP(0) :760FA492 00000000000000000000 BYTE 10 DUP(0) :760FA49C 00000000000000000000 BYTE 10 DUP(0) :760FA4A6 00000000000000000000 BYTE 10 DUP(0) :760FA4B0 00000000000000000000 BYTE 10 DUP(0) :760FA4BA 00000000000000000000 BYTE 10 DUP(0) :760FA4C4 00000000000000000000 BYTE 10 DUP(0) :760FA4CE 00000000000000000000 BYTE 10 DUP(0) :760FA4D8 00000000000000000000 BYTE 10 DUP(0) :760FA4E2 00000000000000000000 BYTE 10 DUP(0) :760FA4EC 00000000000000000000 BYTE 10 DUP(0) :760FA4F6 00000000000000000000 BYTE 10 DUP(0) :760FA500 00000000000000000000 BYTE 10 DUP(0) :760FA50A 00000000000000000000 BYTE 10 DUP(0) :760FA514 00000000000000000000 BYTE 10 DUP(0) :760FA51E 00000000000000000000 BYTE 10 DUP(0) :760FA528 00000000000000000000 BYTE 10 DUP(0) :760FA532 00000000000000000000 BYTE 10 DUP(0) :760FA53C 00000000000000000000 BYTE 10 DUP(0) :760FA546 00000000000000000000 BYTE 10 DUP(0) :760FA550 00000000000000000000 BYTE 10 DUP(0) :760FA55A 00000000000000000000 BYTE 10 DUP(0) :760FA564 00000000000000000000 BYTE 10 DUP(0) :760FA56E 00000000000000000000 BYTE 10 DUP(0) :760FA578 00000000000000000000 BYTE 10 DUP(0) :760FA582 00000000000000000000 BYTE 10 DUP(0) :760FA58C 00000000000000000000 BYTE 10 DUP(0) :760FA596 00000000000000000000 BYTE 10 DUP(0) :760FA5A0 00000000000000000000 BYTE 10 DUP(0) :760FA5AA 00000000000000000000 BYTE 10 DUP(0) :760FA5B4 00000000000000000000 BYTE 10 DUP(0) :760FA5BE 00000000000000000000 BYTE 10 DUP(0) :760FA5C8 00000000000000000000 BYTE 10 DUP(0) :760FA5D2 00000000000000000000 BYTE 10 DUP(0) :760FA5DC 00000000000000000000 BYTE 10 DUP(0) :760FA5E6 00000000000000000000 BYTE 10 DUP(0) :760FA5F0 00000000000000000000 BYTE 10 DUP(0) :760FA5FA 00000000000000000000 BYTE 10 DUP(0) :760FA604 00000000000000000000 BYTE 10 DUP(0) :760FA60E 00000000000000000000 BYTE 10 DUP(0) :760FA618 00000000000000000000 BYTE 10 DUP(0) :760FA622 00000000000000000000 BYTE 10 DUP(0) :760FA62C 00000000000000000000 BYTE 10 DUP(0) :760FA636 00000000000000000000 BYTE 10 DUP(0) :760FA640 00000000000000000000 BYTE 10 DUP(0) :760FA64A 00000000000000000000 BYTE 10 DUP(0) :760FA654 00000000000000000000 BYTE 10 DUP(0) :760FA65E 00000000000000000000 BYTE 10 DUP(0) :760FA668 00000000000000000000 BYTE 10 DUP(0) :760FA672 00000000000000000000 BYTE 10 DUP(0) :760FA67C 00000000000000000000 BYTE 10 DUP(0) :760FA686 00000000000000000000 BYTE 10 DUP(0) :760FA690 00000000000000000000 BYTE 10 DUP(0) :760FA69A 00000000000000000000 BYTE 10 DUP(0) :760FA6A4 00000000000000000000 BYTE 10 DUP(0) :760FA6AE 00000000000000000000 BYTE 10 DUP(0) :760FA6B8 00000000000000000000 BYTE 10 DUP(0) :760FA6C2 00000000000000000000 BYTE 10 DUP(0) :760FA6CC 00000000000000000000 BYTE 10 DUP(0) :760FA6D6 00000000000000000000 BYTE 10 DUP(0) :760FA6E0 00000000000000000000 BYTE 10 DUP(0) :760FA6EA 00000000000000000000 BYTE 10 DUP(0) :760FA6F4 00000000000000000000 BYTE 10 DUP(0) :760FA6FE 00000000000000000000 BYTE 10 DUP(0) :760FA708 00000000000000000000 BYTE 10 DUP(0) :760FA712 00000000000000000000 BYTE 10 DUP(0) :760FA71C 00000000000000000000 BYTE 10 DUP(0) :760FA726 00000000000000000000 BYTE 10 DUP(0) :760FA730 00000000000000000000 BYTE 10 DUP(0) :760FA73A 00000000000000000000 BYTE 10 DUP(0) :760FA744 00000000000000000000 BYTE 10 DUP(0) :760FA74E 00000000000000000000 BYTE 10 DUP(0) :760FA758 00000000000000000000 BYTE 10 DUP(0) :760FA762 00000000000000000000 BYTE 10 DUP(0) :760FA76C 00000000000000000000 BYTE 10 DUP(0) :760FA776 00000000000000000000 BYTE 10 DUP(0) :760FA780 00000000000000000000 BYTE 10 DUP(0) :760FA78A 00000000000000000000 BYTE 10 DUP(0) :760FA794 00000000000000000000 BYTE 10 DUP(0) :760FA79E 00000000000000000000 BYTE 10 DUP(0) :760FA7A8 00000000000000000000 BYTE 10 DUP(0) :760FA7B2 00000000000000000000 BYTE 10 DUP(0) :760FA7BC 00000000000000000000 BYTE 10 DUP(0) :760FA7C6 00000000000000000000 BYTE 10 DUP(0) :760FA7D0 00000000000000000000 BYTE 10 DUP(0) :760FA7DA 00000000000000000000 BYTE 10 DUP(0) :760FA7E4 00000000000000000000 BYTE 10 DUP(0) :760FA7EE 00000000000000000000 BYTE 10 DUP(0) :760FA7F8 00000000000000000000 BYTE 10 DUP(0) :760FA802 00000000000000000000 BYTE 10 DUP(0) :760FA80C 00000000000000000000 BYTE 10 DUP(0) :760FA816 00000000000000000000 BYTE 10 DUP(0) :760FA820 00000000000000000000 BYTE 10 DUP(0) :760FA82A 00000000000000000000 BYTE 10 DUP(0) :760FA834 00000000000000000000 BYTE 10 DUP(0) :760FA83E 00000000000000000000 BYTE 10 DUP(0) :760FA848 00000000000000000000 BYTE 10 DUP(0) :760FA852 00000000000000000000 BYTE 10 DUP(0) :760FA85C 00000000000000000000 BYTE 10 DUP(0) :760FA866 00000000000000000000 BYTE 10 DUP(0) :760FA870 00000000000000000000 BYTE 10 DUP(0) :760FA87A 00000000000000000000 BYTE 10 DUP(0) :760FA884 00000000000000000000 BYTE 10 DUP(0) :760FA88E 00000000000000000000 BYTE 10 DUP(0) :760FA898 00000000000000000000 BYTE 10 DUP(0) :760FA8A2 00000000000000000000 BYTE 10 DUP(0) :760FA8AC 00000000000000000000 BYTE 10 DUP(0) :760FA8B6 00000000000000000000 BYTE 10 DUP(0) :760FA8C0 00000000000000000000 BYTE 10 DUP(0) :760FA8CA 00000000000000000000 BYTE 10 DUP(0) :760FA8D4 00000000000000000000 BYTE 10 DUP(0) :760FA8DE 00000000000000000000 BYTE 10 DUP(0) :760FA8E8 00000000000000000000 BYTE 10 DUP(0) :760FA8F2 00000000000000000000 BYTE 10 DUP(0) :760FA8FC 00000000000000000000 BYTE 10 DUP(0) :760FA906 00000000000000000000 BYTE 10 DUP(0) :760FA910 00000000000000000000 BYTE 10 DUP(0) :760FA91A 00000000000000000000 BYTE 10 DUP(0) :760FA924 00000000000000000000 BYTE 10 DUP(0) :760FA92E 00000000000000000000 BYTE 10 DUP(0) :760FA938 00000000000000000000 BYTE 10 DUP(0) :760FA942 00000000000000000000 BYTE 10 DUP(0) :760FA94C 00000000000000000000 BYTE 10 DUP(0) :760FA956 00000000000000000000 BYTE 10 DUP(0) :760FA960 00000000000000000000 BYTE 10 DUP(0) :760FA96A 00000000000000000000 BYTE 10 DUP(0) :760FA974 00000000000000000000 BYTE 10 DUP(0) :760FA97E 00000000000000000000 BYTE 10 DUP(0) :760FA988 00000000000000000000 BYTE 10 DUP(0) :760FA992 00000000000000000000 BYTE 10 DUP(0) :760FA99C 00000000000000000000 BYTE 10 DUP(0) :760FA9A6 00000000000000000000 BYTE 10 DUP(0) :760FA9B0 00000000000000000000 BYTE 10 DUP(0) :760FA9BA 00000000000000000000 BYTE 10 DUP(0) :760FA9C4 00000000000000000000 BYTE 10 DUP(0) :760FA9CE 00000000000000000000 BYTE 10 DUP(0) :760FA9D8 00000000000000000000 BYTE 10 DUP(0) :760FA9E2 00000000000000000000 BYTE 10 DUP(0) :760FA9EC 00000000000000000000 BYTE 10 DUP(0) :760FA9F6 00000000000000000000 BYTE 10 DUP(0) :760FAA00 00000000000000000000 BYTE 10 DUP(0) :760FAA0A 00000000000000000000 BYTE 10 DUP(0) :760FAA14 00000000000000000000 BYTE 10 DUP(0) :760FAA1E 00000000000000000000 BYTE 10 DUP(0) :760FAA28 00000000000000000000 BYTE 10 DUP(0) :760FAA32 00000000000000000000 BYTE 10 DUP(0) :760FAA3C 00000000000000000000 BYTE 10 DUP(0) :760FAA46 00000000000000000000 BYTE 10 DUP(0) :760FAA50 00000000000000000000 BYTE 10 DUP(0) :760FAA5A 00000000000000000000 BYTE 10 DUP(0) :760FAA64 00000000000000000000 BYTE 10 DUP(0) :760FAA6E 00000000000000000000 BYTE 10 DUP(0) :760FAA78 00000000000000000000 BYTE 10 DUP(0) :760FAA82 00000000000000000000 BYTE 10 DUP(0) :760FAA8C 00000000000000000000 BYTE 10 DUP(0) :760FAA96 00000000000000000000 BYTE 10 DUP(0) :760FAAA0 00000000000000000000 BYTE 10 DUP(0) :760FAAAA 00000000000000000000 BYTE 10 DUP(0) :760FAAB4 00000000000000000000 BYTE 10 DUP(0) :760FAABE 00000000000000000000 BYTE 10 DUP(0) :760FAAC8 00000000000000000000 BYTE 10 DUP(0) :760FAAD2 00000000000000000000 BYTE 10 DUP(0) :760FAADC 00000000000000000000 BYTE 10 DUP(0) :760FAAE6 00000000000000000000 BYTE 10 DUP(0) :760FAAF0 00000000000000000000 BYTE 10 DUP(0) :760FAAFA 00000000000000000000 BYTE 10 DUP(0) :760FAB04 00000000000000000000 BYTE 10 DUP(0) :760FAB0E 00000000000000000000 BYTE 10 DUP(0) :760FAB18 00000000000000000000 BYTE 10 DUP(0) :760FAB22 00000000000000000000 BYTE 10 DUP(0) :760FAB2C 00000000000000000000 BYTE 10 DUP(0) :760FAB36 00000000000000000000 BYTE 10 DUP(0) :760FAB40 00000000000000000000 BYTE 10 DUP(0) :760FAB4A 00000000000000000000 BYTE 10 DUP(0) :760FAB54 00000000000000000000 BYTE 10 DUP(0) :760FAB5E 00000000000000000000 BYTE 10 DUP(0) :760FAB68 00000000000000000000 BYTE 10 DUP(0) :760FAB72 00000000000000000000 BYTE 10 DUP(0) :760FAB7C 00000000000000000000 BYTE 10 DUP(0) :760FAB86 00000000000000000000 BYTE 10 DUP(0) :760FAB90 00000000000000000000 BYTE 10 DUP(0) :760FAB9A 00000000000000000000 BYTE 10 DUP(0) :760FABA4 00000000000000000000 BYTE 10 DUP(0) :760FABAE 00000000000000000000 BYTE 10 DUP(0) :760FABB8 00000000000000000000 BYTE 10 DUP(0) :760FABC2 00000000000000000000 BYTE 10 DUP(0) :760FABCC 00000000000000000000 BYTE 10 DUP(0) :760FABD6 00000000000000000000 BYTE 10 DUP(0) :760FABE0 00000000000000000000 BYTE 10 DUP(0) :760FABEA 00000000000000000000 BYTE 10 DUP(0) :760FABF4 00000000000000000000 BYTE 10 DUP(0) :760FABFE 00000000000000000000 BYTE 10 DUP(0) :760FAC08 00000000000000000000 BYTE 10 DUP(0) :760FAC12 00000000000000000000 BYTE 10 DUP(0) :760FAC1C 00000000000000000000 BYTE 10 DUP(0) :760FAC26 00000000000000000000 BYTE 10 DUP(0) :760FAC30 00000000000000000000 BYTE 10 DUP(0) :760FAC3A 00000000000000000000 BYTE 10 DUP(0) :760FAC44 00000000000000000000 BYTE 10 DUP(0) :760FAC4E 00000000000000000000 BYTE 10 DUP(0) :760FAC58 00000000000000000000 BYTE 10 DUP(0) :760FAC62 00000000000000000000 BYTE 10 DUP(0) :760FAC6C 00000000000000000000 BYTE 10 DUP(0) :760FAC76 00000000000000000000 BYTE 10 DUP(0) :760FAC80 00000000000000000000 BYTE 10 DUP(0) :760FAC8A 00000000000000000000 BYTE 10 DUP(0) :760FAC94 00000000000000000000 BYTE 10 DUP(0) :760FAC9E 00000000000000000000 BYTE 10 DUP(0) :760FACA8 00000000000000000000 BYTE 10 DUP(0) :760FACB2 00000000000000000000 BYTE 10 DUP(0) :760FACBC 00000000000000000000 BYTE 10 DUP(0) :760FACC6 00000000000000000000 BYTE 10 DUP(0) :760FACD0 00000000000000000000 BYTE 10 DUP(0) :760FACDA 00000000000000000000 BYTE 10 DUP(0) :760FACE4 00000000000000000000 BYTE 10 DUP(0) :760FACEE 00000000000000000000 BYTE 10 DUP(0) :760FACF8 00000000000000000000 BYTE 10 DUP(0) :760FAD02 00000000000000000000 BYTE 10 DUP(0) :760FAD0C 00000000000000000000 BYTE 10 DUP(0) :760FAD16 00000000000000000000 BYTE 10 DUP(0) :760FAD20 00000000000000000000 BYTE 10 DUP(0) :760FAD2A 00000000000000000000 BYTE 10 DUP(0) :760FAD34 00000000000000000000 BYTE 10 DUP(0) :760FAD3E 00000000000000000000 BYTE 10 DUP(0) :760FAD48 00000000000000000000 BYTE 10 DUP(0) :760FAD52 00000000000000000000 BYTE 10 DUP(0) :760FAD5C 00000000000000000000 BYTE 10 DUP(0) :760FAD66 00000000000000000000 BYTE 10 DUP(0) :760FAD70 00000000000000000000 BYTE 10 DUP(0) :760FAD7A 00000000000000000000 BYTE 10 DUP(0) :760FAD84 00000000000000000000 BYTE 10 DUP(0) :760FAD8E 00000000000000000000 BYTE 10 DUP(0) :760FAD98 00000000000000000000 BYTE 10 DUP(0) :760FADA2 00000000000000000000 BYTE 10 DUP(0) :760FADAC 00000000000000000000 BYTE 10 DUP(0) :760FADB6 00000000000000000000 BYTE 10 DUP(0) :760FADC0 00000000000000000000 BYTE 10 DUP(0) :760FADCA 00000000000000000000 BYTE 10 DUP(0) :760FADD4 00000000000000000000 BYTE 10 DUP(0) :760FADDE 00000000000000000000 BYTE 10 DUP(0) :760FADE8 00000000000000000000 BYTE 10 DUP(0) :760FADF2 00000000000000000000 BYTE 10 DUP(0) :760FADFC 00000000000000000000 BYTE 10 DUP(0) :760FAE06 00000000000000000000 BYTE 10 DUP(0) :760FAE10 00000000000000000000 BYTE 10 DUP(0) :760FAE1A 00000000000000000000 BYTE 10 DUP(0) :760FAE24 00000000000000000000 BYTE 10 DUP(0) :760FAE2E 00000000000000000000 BYTE 10 DUP(0) :760FAE38 00000000000000000000 BYTE 10 DUP(0) :760FAE42 00000000000000000000 BYTE 10 DUP(0) :760FAE4C 00000000000000000000 BYTE 10 DUP(0) :760FAE56 00000000000000000000 BYTE 10 DUP(0) :760FAE60 00000000000000000000 BYTE 10 DUP(0) :760FAE6A 00000000000000000000 BYTE 10 DUP(0) :760FAE74 00000000000000000000 BYTE 10 DUP(0) :760FAE7E 00000000000000000000 BYTE 10 DUP(0) :760FAE88 00000000000000000000 BYTE 10 DUP(0) :760FAE92 00000000000000000000 BYTE 10 DUP(0) :760FAE9C 00000000000000000000 BYTE 10 DUP(0) :760FAEA6 00000000000000000000 BYTE 10 DUP(0) :760FAEB0 00000000000000000000 BYTE 10 DUP(0) :760FAEBA 00000000000000000000 BYTE 10 DUP(0) :760FAEC4 00000000000000000000 BYTE 10 DUP(0) :760FAECE 00000000000000000000 BYTE 10 DUP(0) :760FAED8 00000000000000000000 BYTE 10 DUP(0) :760FAEE2 00000000000000000000 BYTE 10 DUP(0) :760FAEEC 00000000000000000000 BYTE 10 DUP(0) :760FAEF6 00000000000000000000 BYTE 10 DUP(0) :760FAF00 00000000000000000000 BYTE 10 DUP(0) :760FAF0A 00000000000000000000 BYTE 10 DUP(0) :760FAF14 00000000000000000000 BYTE 10 DUP(0) :760FAF1E 00000000000000000000 BYTE 10 DUP(0) :760FAF28 00000000000000000000 BYTE 10 DUP(0) :760FAF32 00000000000000000000 BYTE 10 DUP(0) :760FAF3C 00000000000000000000 BYTE 10 DUP(0) :760FAF46 00000000000000000000 BYTE 10 DUP(0) :760FAF50 00000000000000000000 BYTE 10 DUP(0) :760FAF5A 00000000000000000000 BYTE 10 DUP(0) :760FAF64 00000000000000000000 BYTE 10 DUP(0) :760FAF6E 00000000000000000000 BYTE 10 DUP(0) :760FAF78 00000000000000000000 BYTE 10 DUP(0) :760FAF82 00000000000000000000 BYTE 10 DUP(0) :760FAF8C 00000000000000000000 BYTE 10 DUP(0) :760FAF96 00000000000000000000 BYTE 10 DUP(0) :760FAFA0 00000000000000000000 BYTE 10 DUP(0) :760FAFAA 00000000000000000000 BYTE 10 DUP(0) :760FAFB4 00000000000000000000 BYTE 10 DUP(0) :760FAFBE 00000000000000000000 BYTE 10 DUP(0) :760FAFC8 00000000000000000000 BYTE 10 DUP(0) :760FAFD2 00000000000000000000 BYTE 10 DUP(0) :760FAFDC 00000000000000000000 BYTE 10 DUP(0) :760FAFE6 00000000000000000000 BYTE 10 DUP(0) :760FAFF0 00000000000000000000 BYTE 10 DUP(0) :760FAFFA 00000000000000000000 BYTE 10 DUP(0) :FFFFFFFF End Of Listing