;
; ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ»
; º	This file is generated by The Interactive Disassembler (IDA)	    º
; º	Copyright (c) 2010 by Hex-Rays SA, <support@hex-rays.com>	    º
; º			 Licensed to: Freeware version			    º
; ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ
;
; Input	MD5   :	7471BF8E300489C386715DD3E35D1BA0

; File Name   :	X:\Python\cyber-challenge\keygen.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	400000
; Section 1. (virtual address 00001000)
; Virtual size			: 00000A50 (   2640.)
; Section size in file		: 00000C00 (   3072.)
; Offset to raw	data for section: 00000400
; Flags	60500020: Text Executable Readable
; Alignment	: 16 bytes

.686p
.mmx
.model flat


; Segment type:	Pure code
; Segment permissions: Read/Execute
_text segment para public 'CODE' use32
assume cs:_text
;org 401000h
assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing


; Attributes: bp-based frame

public start
start proc near

var_18=	dword ptr -18h
var_14=	dword ptr -14h
var_10=	dword ptr -10h

push	ebp
mov	ebp, esp
sub	esp, 18h
and	esp, 0FFFFFFF0h
mov	[esp+18h+var_18], offset main_function
call	init_crt_and_something
mov	[esp+18h+var_10], 0
mov	[esp+18h+var_14], 0
mov	[esp+18h+var_18], 0
call	sub_4014A0
mov	[esp+18h+var_10], 0
mov	[esp+18h+var_14], 0
mov	[esp+18h+var_18], 0
call	sub_4014B0
mov	[esp+18h+var_10], 0
mov	[esp+18h+var_14], 0
mov	[esp+18h+var_18], 0
call	sub_4014C0
mov	[esp+18h+var_10], 0
mov	[esp+18h+var_14], 0
mov	[esp+18h+var_18], 0
call	sub_4014D0
leave
retn
start endp

align 10h


; Attributes: bp-based frame

main_function proc	near

var_78=	dword ptr -78h
var_74=	dword ptr -74h
var_70=	dword ptr -70h
var_5C=	dword ptr -5Ch
var_50=	dword ptr -50h
var_4C=	dword ptr -4Ch          ; FILE *fd
var_48=	dword ptr -48h          ; xxxx 12 bytes copied from licence file
var_44=	dword ptr -44h          ; yyyy
var_40=	dword ptr -40h          ; zzzz
var_38=	dword ptr -38h          ; buffer: memset 0x18 bytes from here to var 0x20
        ;; -38 gchq
        ;; -34 cybe
        ;; -30 rwin
        ;; -2c xxxx
        ;; -28 yyyy
        ;; -24 zzzz
var_2C=	dword ptr -2Ch          ; 4 bytes copied from here
var_28=	dword ptr -28h
var_24=	dword ptr -24h
var_C= dword ptr -0Ch
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 78h	; char *
and	esp, 0FFFFFFF0h
mov	eax, 0
add	eax, 0Fh
add	eax, 0Fh
shr	eax, 4
shl	eax, 4
mov	[ebp+var_5C], eax
mov	eax, [ebp+var_5C]
call	sub_401434
call	__main
mov	[ebp+var_C], 0
mov	[esp+78h+var_78], offset aKeygen_exe ; "\nkeygen.exe\n\n"
call	printf
cmp	[ebp+arg_0], 2
jz	short loc_4010EB
mov	[esp+78h+var_78], offset aUsageKeygen_ex ; "usage: keygen.exe hostname\n"
call	printf
mov	[ebp+var_50], 0FFFFFFFFh
jmp	auth_exit

loc_4010EB:		; "r"
mov	[esp+78h+var_74], offset aR
mov	[esp+78h+var_78], offset aLicense_txt ;	"license.txt"
call	_fopen64
mov	[ebp+var_4C], eax
cmp	[ebp+var_4C], 0
jnz	short loc_401120
mov	[esp+78h+var_78], offset aErrorLicense_t ; "error: license.txt not found\n"
call	printf
mov	[ebp+var_50], 0FFFFFFFFh
jmp	auth_exit

loc_401120:
mov	[esp+78h+var_70], 18h
mov	[esp+78h+var_74], 0
lea	eax, [ebp+var_38]
mov	[esp+78h+var_78], eax
call	memset
lea	eax, [ebp+var_38]       ; pointer buffer to read key to
mov	[esp+78h+var_70], eax
mov	[esp+78h+var_74], offset aS ; "%s"
mov	eax, [ebp+var_4C]           ; fd
mov	[esp+78h+var_78], eax
call	fscanf
mov	eax, [ebp+var_4C]
mov	[esp+78h+var_78], eax
call	fclose
mov	[ebp+var_4C], 0
cmp	[ebp+var_38], 71686367h ; gchq
jnz	short invalid_license
mov	eax, off_402000
mov	[esp+78h+var_74], eax
lea	eax, [ebp+var_38]
add	eax, 4                  ; pointer to password
mov	[esp+78h+var_78], eax
call	crypt
mov	edx, eax
mov	eax, off_402000
mov	[esp+78h+var_74], eax
mov	[esp+78h+var_78], edx
call	strcmp
test	eax, eax
jnz	short loc_4011A5
mov	[ebp+var_C], 1

loc_4011A5:		; "loading stage1 license key(s)...\n"
mov	[esp+78h+var_78], offset aLoadingStage1L
call	printf
mov	eax, [ebp+var_2C]       ; copy 4 bytes of the licence file
mov	[ebp+var_48], eax
mov	[esp+78h+var_78], offset aLoadingStage2L ; "loading stage2 license key(s)...\n\n"
call	printf
mov	eax, [ebp+var_28]       ; ...and another 4 bytes
mov	[ebp+var_44], eax
mov	eax, [ebp+var_24]       ; ..and another 4 bytes
mov	[ebp+var_40], eax

invalid_license:
cmp	[ebp+var_C], 0
jnz	short auth_ok
mov	[esp+78h+var_78], offset aErrorLicense_0 ; "error: license.txt invalid\n"
call	printf
mov	[ebp+var_50], 0FFFFFFFFh
jmp	short auth_exit

auth_ok:
lea	eax, [ebp+var_48]       ; the pointer to the 12 bytes???
mov	[esp+78h+var_74], eax
mov	eax, [ebp+arg_4]
add	eax, 4
mov	eax, [eax]              ; host name argv[1]
mov	[esp+78h+var_78], eax
call	fetch_stuff
mov	[ebp+var_50], eax

auth_exit:
mov	eax, [ebp+var_50]
leave
retn
main_function endp



; Attributes: bp-based frame

fetch_stuff proc	near

var_168= dword ptr -168h
var_164= dword ptr -164h
var_160= dword ptr -160h
var_15C= dword ptr -15Ch
var_158= dword ptr -158h
var_154= dword ptr -154h
var_150= dword ptr -150h
var_14C= dword ptr -14Ch
var_148= dword ptr -148h
var_144= dword ptr -144h
var_140= dword ptr -140h
var_13C= dword ptr -13Ch
var_138= dword ptr -138h
var_134= dword ptr -134h
var_130= dword ptr -130h
var_12C= dword ptr -12Ch
var_128= dword ptr -128h
var_124= dword ptr -124h
var_2C=	dword ptr -2Ch
var_28=	dword ptr -28h
var_C= dword ptr -0Ch
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 168h	; name
mov	[ebp+var_13C], 0
mov	[ebp+var_140], 0
mov	eax, [ebp+arg_0]
mov	[esp+168h+var_168], eax
call	gethostbyname
mov	[ebp+var_2C], eax       ; struct *hostent
cmp	[ebp+var_2C], 0
jnz	short loc_401255
mov	[esp+164h+var_164], offset aErrorGethostby ; "error: gethostbyname() failed\n"
call	printf
mov	[ebp+var_144], 0FFFFFFFFh
jmp	loc_401423

loc_401255:
mov	eax, [ebp+var_2C]
movsx	eax, word ptr [eax+0Ah]
mov	[esp+164h+var_15C], eax
mov	eax, [ebp+var_2C]
mov	eax, [eax+0Ch]
mov	eax, [eax]
mov	[esp+164h+var_160], eax
lea	eax, [ebp+var_28]
add	eax, 4
mov	[esp+164h+var_164], eax
call	memcpy
mov	word ptr [ebp+var_28], 2
mov	[esp+164h+var_164], 50h
call	htons
mov	word ptr [ebp+var_28+2], ax
mov	[esp+160h+var_158], 6
mov	[esp+160h+var_15C], 1
mov	[esp+160h+var_160], 2
call	socket
mov	[ebp+var_C], eax
mov	[esp+154h+var_14C], 10h
lea	eax, [ebp+var_28]
mov	[esp+154h+var_150], eax
mov	eax, [ebp+var_C]
mov	[esp+154h+var_154], eax
call	connect
test	eax, eax
jns	short loc_4012EF
mov	eax, [ebp+arg_0]        ;arg0 is host name (checked by running!)
mov	[esp+148h+var_144], eax
mov	[esp+148h+var_148], offset aErrorConnectSF ; "error: connect(\"%s\") failed\n"
call	printf
mov	[ebp+var_144], 0FFFFFFFFh
jmp	loc_401423

        ;;  called with a pointer to 3 quads at arg_4 - arg_4 is argv
loc_4012EF:
mov	eax, [ebp+arg_4]
add	eax, 8
mov	eax, [eax]
mov	[esp+148h+var_134], eax
mov	eax, [ebp+arg_4]
add	eax, 4
mov	eax, [eax]
mov	[esp+148h+var_138], eax
mov	eax, [ebp+arg_4]
mov	eax, [eax]
mov	[esp+148h+var_13C], eax
mov	eax, off_402000
mov	[esp+148h+var_140], eax
mov	[esp+148h+var_144], offset aGetSXXXKey_txt ; "GET /%s/%x/%x/%x/key.txt HTTP/1.0\r\n\r\n"
lea	eax, [ebp+var_138]
mov	[esp+148h+var_148], eax
call	sprintf
lea	eax, [ebp+var_138]
mov	[esp+148h+var_144], eax
mov	[esp+148h+var_148], offset aRequestS ; "request:\n\n%s"
call	printf
lea	eax, [ebp+var_138]
mov	[esp+148h+var_148], eax
call	strlen
mov	[esp+148h+var_13C], 0
mov	[esp+148h+var_140], eax
lea	eax, [ebp+var_138]
mov	[esp+148h+var_144], eax
mov	eax, [ebp+var_C]
mov	[esp+148h+var_148], eax
call	send
test	eax, eax
jg	short loc_401393
mov	[esp+138h+var_138], offset aErrorSendFaile ; "error: send() failed\n"
call	printf
mov	[ebp+var_144], 0FFFFFFFFh
jmp	loc_401423

loc_401393:		; "response:\n\n"
mov	[esp+138h+var_138], offset aResponse
call	printf

loc_40139F:
mov	[esp+138h+var_130], 100h
mov	[esp+138h+var_134], 0
lea	eax, [ebp+var_138]
mov	[esp+138h+var_138], eax
call	memset
mov	[esp+138h+var_12C], 0
mov	[esp+138h+var_130], 0FFh
lea	eax, [ebp+var_138]
mov	[esp+138h+var_134], eax
mov	eax, [ebp+var_C]
mov	[esp+138h+var_138], eax
call	recv
mov	[ebp+var_13C], eax
cmp	[ebp+var_13C], 0
jg	short loc_4013F3
jmp	short loc_40140B

loc_4013F3:
lea	eax, [ebp+var_138]
mov	[esp+128h+var_124], eax
mov	[esp+128h+var_128], offset aS ;	"%s"
call	printf
jmp	short loc_40139F

loc_40140B:		; "\n"
mov	[esp+128h+var_128], offset asc_40219D
call	printf
mov	eax, [ebp+var_13C]
mov	[ebp+var_144], eax

loc_401423:
mov	eax, [ebp+var_144]
leave
retn
fetch_stuff endp

align 4
; [00000006 BYTES: COLLAPSED FUNCTION crypt. PRESS KEYPAD "+" TO EXPAND]
align 4



sub_401434 proc	near
push	ecx
mov	ecx, esp
add	ecx, 8

loc_40143A:
cmp	eax, 1000h
jb	short loc_401451
sub	ecx, 1000h
or	dword ptr [ecx], 0
sub	eax, 1000h
jmp	short loc_40143A

loc_401451:
sub	ecx, eax
or	dword ptr [ecx], 0
mov	eax, esp
mov	esp, ecx
mov	ecx, [eax]
mov	eax, [eax+4]
jmp	eax
sub_401434 endp

align 10h


; Attributes: bp-based frame

init_crt_and_something proc	near

var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8             ; pointer to auth function

push	ebp
mov	ebp, esp
sub	esp, 8
mov	eax, [ebp+arg_0]
mov	[esp+8+var_4], 0
mov	[esp+8+var_8], eax
call	sub_401560
sub	esp, 8
call	ds:_dll_crt0@0	; dll_crt0()
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
init_crt_and_something endp



; Attributes: bp-based frame

sub_4014A0 proc	near
push	ebp
mov	ebp, esp
pop	ebp
retn
sub_4014A0 endp

align 10h


; Attributes: bp-based frame

sub_4014B0 proc	near
push	ebp
mov	ebp, esp
pop	ebp
retn
sub_4014B0 endp

align 10h


; Attributes: bp-based frame

sub_4014C0 proc	near
push	ebp
mov	ebp, esp
pop	ebp
retn
sub_4014C0 endp

align 10h


; Attributes: bp-based frame

sub_4014D0 proc	near
push	ebp
mov	ebp, esp
pop	ebp
retn
sub_4014D0 endp

align 10h
; [00000006 BYTES: COLLAPSED FUNCTION __main. PRESS KEYPAD "+" TO EXPAND]
align 4
; [00000006 BYTES: COLLAPSED FUNCTION recv. PRESS KEYPAD "+" TO	EXPAND]
align 10h
; [00000006 BYTES: COLLAPSED FUNCTION strlen. PRESS KEYPAD "+" TO EXPAND]
align 4
; [00000006 BYTES: COLLAPSED FUNCTION send. PRESS KEYPAD "+" TO	EXPAND]
align 10h
; [00000006 BYTES: COLLAPSED FUNCTION sprintf. PRESS KEYPAD "+"	TO EXPAND]
align 4
; [00000006 BYTES: COLLAPSED FUNCTION connect. PRESS KEYPAD "+"	TO EXPAND]
align 10h
; [00000006 BYTES: COLLAPSED FUNCTION socket. PRESS KEYPAD "+" TO EXPAND]
align 4
; [00000006 BYTES: COLLAPSED FUNCTION htons. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000006 BYTES: COLLAPSED FUNCTION memcpy. PRESS KEYPAD "+" TO EXPAND]
align 4
; [00000006 BYTES: COLLAPSED FUNCTION gethostbyname. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000006 BYTES: COLLAPSED FUNCTION strcmp. PRESS KEYPAD "+" TO EXPAND]
align 4
; [00000006 BYTES: COLLAPSED FUNCTION fclose. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000006 BYTES: COLLAPSED FUNCTION fscanf. PRESS KEYPAD "+" TO EXPAND]
align 4
; [00000006 BYTES: COLLAPSED FUNCTION memset. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000006 BYTES: COLLAPSED FUNCTION _fopen64.	PRESS KEYPAD "+" TO EXPAND]
align 4
; [00000006 BYTES: COLLAPSED FUNCTION printf. PRESS KEYPAD "+" TO EXPAND]
align 10h


; Attributes: bp-based frame

sub_401560 proc	near

var_18=	dword ptr -18h
var_8= dword ptr -8
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	esi
push	ebx
sub	esp, 10h	; lpModuleName
mov	ebx, [ebp+arg_4]
mov	esi, [ebp+arg_0]
mov	[esp+18h+var_18], 8
call	cygwin_internal
test	ebx, ebx
mov	ecx, eax
jz	loc_401740
mov	eax, ds:_impure_ptr
test	ecx, ecx
mov	dword ptr [ebx+4], 0A8h
mov	dword ptr [ebx+8], 3EFh
mov	dword ptr [ebx+0Ch], 9
mov	[ebx+10h], eax
mov	eax, [ebp+0]
mov	dword ptr [ebx+80h], 0
mov	dword ptr [ebx+84h], 0EDh
mov	dword ptr [ebx+2Ch], offset dword_401A40
mov	dword ptr [ebx+30h], offset dword_401A48
mov	dword ptr [ebx+14h], offset unk_403000
mov	[ebx+28h], esi
mov	dword ptr [ebx+48h], offset sub_4014A0
mov	dword ptr [ebx+4Ch], offset sub_4014B0
mov	dword ptr [ebx+50h], offset sub_4014C0
mov	dword ptr [ebx+54h], offset sub_4014D0
mov	dword ptr [ebx+24h], offset unk_403004
mov	[ebx], eax
mov	dword ptr [ebx+18h], offset loc_4019B0
mov	dword ptr [ebx+1Ch], offset loc_4019B8
mov	dword ptr [ebx+20h], offset loc_4019C0
mov	dword ptr [ebx+44h], offset loc_4019C8
jz	loc_4016DA

loc_401619:
mov	edx, [ecx+78h]
test	edx, edx
jz	loc_4016DA
mov	eax, ds:dword_403008
test	eax, eax
jnz	loc_4016DA
mov	eax, dword_402020
test	eax, eax
jz	loc_401850

loc_40163E:
mov	eax, dword_402024
test	eax, eax
jz	loc_401840

loc_40164B:
mov	eax, dword_402028
test	eax, eax
jz	loc_401830

loc_401658:
mov	eax, dword_40202C
test	eax, eax
jz	loc_401820

loc_401665:
mov	eax, dword_402030
test	eax, eax
jz	loc_401810

loc_401672:
mov	esi, dword_402034
test	esi, esi
jz	loc_401800

loc_401680:
mov	ecx, dword_402038
test	ecx, ecx
jz	loc_4017F0

loc_40168E:
mov	eax, dword_40203C
test	eax, eax
jz	loc_4017E2

loc_40169B:
mov	eax, dword_402020
mov	[edx], eax
mov	eax, dword_402024
mov	[edx+4], eax
mov	eax, dword_402028
mov	[edx+8], eax
mov	eax, dword_40202C
mov	[edx+0Ch], eax
mov	eax, dword_402030
mov	[edx+10h], eax
mov	eax, dword_402034
mov	[edx+14h], eax
mov	eax, dword_402038
mov	[edx+18h], eax
mov	eax, dword_40203C
mov	[edx+1Ch], eax

loc_4016DA:
mov	[esp+18h+var_18], 0
call	GetModuleHandleA
mov	dword ptr [ebx+34h], offset off_402000
mov	dword ptr [ebx+38h], offset unk_4021A0
mov	dword ptr [ebx+3Ch], offset unk_403000
mov	dword ptr [ebx+40h], 403120h
mov	dword ptr [ebx+94h], offset unk_403000
mov	[ebx+7Ch], eax
sub	esp, 4
mov	dword ptr [ebx+98h], offset unk_403000
mov	dword ptr [ebx+9Ch], 400000h
call	sub_4019A0
lea	esp, [ebp-8]
mov	eax, 1
pop	ebx
pop	esi
pop	ebp
retn	8
align 10h

loc_401740:
mov	dword ptr [eax+4], 0A8h
mov	edx, ds:_impure_ptr
test	ecx, ecx
mov	dword ptr [eax+8], 3EFh
mov	ebx, ecx
mov	dword ptr [eax+0Ch], 9
mov	dword ptr [eax+80h], 0
mov	dword ptr [eax+84h], 0EDh
mov	dword ptr [eax+2Ch], offset dword_401A40
mov	dword ptr [eax+30h], offset dword_401A48
mov	dword ptr [eax+14h], offset unk_403000
mov	eax, [eax+0A4h]
mov	[ecx+28h], esi
mov	dword ptr [ecx+48h], offset sub_4014A0
mov	dword ptr [ecx+4Ch], offset sub_4014B0
mov	[edx], eax
mov	eax, [ebp+0]
mov	dword ptr [ecx+50h], offset sub_4014C0
mov	dword ptr [ecx+54h], offset sub_4014D0
mov	dword ptr [ecx+24h], offset unk_403004
mov	[ecx], eax
mov	dword ptr [ecx+18h], offset loc_4019B0
mov	dword ptr [ecx+1Ch], offset loc_4019B8
mov	dword ptr [ecx+20h], offset loc_4019C0
mov	dword ptr [ecx+44h], offset loc_4019C8
jnz	loc_401619
jmp	loc_4016DA

loc_4017E2:
mov	eax, [edx+1Ch]
mov	dword_40203C, eax
jmp	loc_40169B
align 10h

loc_4017F0:
mov	eax, [edx+18h]
mov	dword_402038, eax
jmp	loc_40168E
align 10h

loc_401800:
mov	eax, [edx+14h]
mov	dword_402034, eax
jmp	loc_401680
align 10h

loc_401810:
mov	eax, [edx+10h]
mov	dword_402030, eax
jmp	loc_401672
align 10h

loc_401820:
mov	eax, [edx+0Ch]
mov	dword_40202C, eax
jmp	loc_401665
align 10h

loc_401830:
mov	eax, [edx+8]
mov	dword_402028, eax
jmp	loc_401658
align 10h

loc_401840:
mov	eax, [edx+4]
mov	dword_402024, eax
jmp	loc_40164B
align 10h

loc_401850:
mov	eax, [edx]
mov	dword_402020, eax
jmp	loc_40163E
sub_401560 endp

align 10h


; Attributes: bp-based frame

sub_401860 proc	near

var_18=	dword ptr -18h
var_14=	dword ptr -14h
var_10=	dword ptr -10h

push	ebp
mov	ebp, esp
sub	esp, 18h
mov	eax, ds:dword_403030
mov	[esp+18h+var_10], eax
mov	eax, ds:dword_403020
mov	[esp+18h+var_14], eax
mov	eax, ds:dword_403010
mov	[esp+18h+var_18], eax
call	sub_401A20
sub	esp, 0Ch
leave
retn
sub_401860 endp

align 10h

loc_401890:
push	ebp
mov	ebp, esp
push	ebx
sub	esp, 14h
mov	eax, [ebp+0Ch]
mov	ecx, [ebp+8]
mov	edx, [ebp+10h]
cmp	eax, 1
jz	loc_401930
jb	short loc_4018C3
cmp	eax, 2
jz	short loc_401916
cmp	eax, 3
mov	ebx, 1
jz	short loc_401900

loc_4018BA:
mov	eax, ebx
mov	ebx, [ebp-4]
leave
retn	0Ch

loc_4018C3:
mov	[esp+8], edx
mov	dword ptr [esp+4], 0
mov	[esp], ecx
call	sub_401A20
sub	esp, 0Ch
test	eax, eax
mov	ebx, eax
jz	short loc_4018BA
mov	eax, ds:dword_403040
mov	[esp], eax
call	cygwin_detach_dll
mov	ds:dword_403040, 0FFFFFFFFh
jmp	short loc_4018BA
align 10h

loc_401900:
mov	[ebp+10h], edx
mov	ebx, [ebp-4]
mov	dword ptr [ebp+0Ch], 3
mov	[ebp+8], ecx
leave
jmp	sub_401A20

loc_401916:
mov	[ebp+10h], edx
mov	ebx, [ebp-4]
mov	dword ptr [ebp+0Ch], 2
mov	[ebp+8], ecx
leave
jmp	sub_401A20
align 10h

loc_401930:
xor	eax, eax
test	edx, edx
setz	al
xor	ebx, ebx
mov	ds:dword_403010, ecx
mov	ds:dword_403020, 1
mov	ds:dword_403030, edx
mov	ds:dword_403008, eax
mov	dword ptr [esp+4], offset sub_401860
mov	[esp], ecx
call	sub_4019D0
cmp	eax, 0FFFFFFFFh
setnz	bl
mov	ds:dword_403040, eax
mov	eax, ebx
mov	ebx, [ebp-4]
leave
retn	0Ch
align 10h
push	ebp
mov	ebp, esp
leave
jmp	loc_401890
align 10h


; Attributes: thunk

cygwin_internal	proc near
jmp	ds:__imp_cygwin_internal
cygwin_internal	endp

align 10h


; Attributes: bp-based frame

sub_4019A0 proc	near
push	ebp
mov	ebp, esp
pop	ebp
retn
sub_4019A0 endp

align 10h

loc_4019B0:
jmp	ds:malloc
align 4

loc_4019B8:
jmp	ds:free
align 10h

loc_4019C0:
jmp	ds:realloc
align 4

loc_4019C8:
jmp	ds:calloc
align 10h


; Attributes: bp-based frame

sub_4019D0 proc	near

var_18=	dword ptr -18h
var_14=	dword ptr -14h
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

; FUNCTION CHUNK AT 00401A30 SIZE 00000006 BYTES

push	ebp
mov	ebp, esp
push	ebx
sub	esp, 14h
mov	ebx, [ebp+arg_0]
mov	[esp+18h+var_14], offset unk_403050
mov	eax, [ebp+arg_4]
mov	[esp+18h+var_18], eax
call	sub_401560
mov	[ebp+arg_0], ebx
mov	ebx, [ebp+var_4]
mov	[ebp+arg_4], offset unk_403050
sub	esp, 8
leave
jmp	loc_401A30
sub_4019D0 endp

align 10h
; [00000006 BYTES: COLLAPSED FUNCTION cygwin_detach_dll. PRESS KEYPAD "+" TO EXPAND]
align 10h


; Attributes: bp-based frame

sub_401A20 proc	near
push	ebp
mov	eax, 1
mov	ebp, esp
pop	ebp
retn	0Ch
sub_401A20 endp

align 10h
; START	OF FUNCTION CHUNK FOR sub_4019D0

loc_401A30:
jmp	ds:dll_dllcrt0
; END OF FUNCTION CHUNK	FOR sub_4019D0
align 4
; [00000006 BYTES: COLLAPSED FUNCTION GetModuleHandleA.	PRESS KEYPAD "+" TO EXPAND]
align 10h
dword_401A40 dd	0FFFFFFFFh, 0
dword_401A48 dd	0FFFFFFFFh, 6Dh	dup(0)
_text ends

; Section 2. (virtual address 00002000)
; Virtual size			: 000001A0 (	416.)
; Section size in file		: 00000200 (	512.)
; Offset to raw	data for section: 00001000
; Flags	C0600040: Data Readable	Writable
; Alignment	: 32 bytes

; Segment type:	Pure data
; Segment permissions: Read/Write
; Segment alignment '32byte' can not be represented in assembly
_data segment para public 'DATA' use32
assume cs:_data
;org 402000h
off_402000 dd offset aHqdtk7b8k2rvw ; "hqDTK7b8K2rvw"
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
dword_402020 dd	0
dword_402024 dd	0
dword_402028 dd	0
dword_40202C dd	0
dword_402030 dd	0
dword_402034 dd	0
dword_402038 dd	0
dword_40203C dd	0
aHqdtk7b8k2rvw db 'hqDTK7b8K2rvw',0
aKeygen_exe db 0Ah
db 'keygen.exe',0Ah
db 0Ah,0
aUsageKeygen_ex	db 'usage: keygen.exe hostname',0Ah,0
aR db 'r',0
aLicense_txt db	'license.txt',0
aErrorLicense_t	db 'error: license.txt not found',0Ah,0
aS db '%s',0
align 4
aLoadingStage1L	db 'loading stage1 license key(s)...',0Ah,0
align 4
aLoadingStage2L	db 'loading stage2 license key(s)...',0Ah
db 0Ah,0
aErrorLicense_0	db 'error: license.txt invalid',0Ah,0
align 4
aErrorGethostby	db 'error: gethostbyname() failed',0Ah,0
aErrorConnectSF	db 'error: connect("%s") failed',0Ah,0
aGetSXXXKey_txt	db 'GET /%s/%x/%x/%x/key.txt HTTP/1.0',0Dh
db 0Ah
db 0Dh,0Ah,0
aRequestS db 'request:',0Ah
db 0Ah
db '%s',0
aErrorSendFaile	db 'error: send() failed',0Ah,0
aResponse db 'response:',0Ah
db 0Ah,0
asc_40219D db 0Ah,0
align 10h
unk_4021A0 db	 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
_data ends

; Section 3. (virtual address 00003000)
; Virtual size			: 00000120 (	288.)
; Section size in file		: 00000000 (	  0.)
; Offset to raw	data for section: 00000000
; Flags	C0400080: Bss Readable Writable
; Alignment	: 8 bytes

; Segment type:	Uninitialized
; Segment permissions: Read/Write
; Segment alignment 'qword' can not be represented in assembly
_bss segment para public 'BSS' use32
assume cs:_bss
;org 403000h
assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
unk_403000 db	 ? ;
db    ?	;
db    ?	;
db    ?	;
unk_403004 db	 ? ;
db    ?	;
db    ?	;
db    ?	;
dword_403008 dd	?
align 10h
dword_403010 dd	?
align 10h
dword_403020 dd	?
align 10h
dword_403030 dd	?
align 10h
dword_403040 dd	?
align 10h
unk_403050 db	 ? ;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
_bss ends

;
; Imports from cygcrypt-0.dll
;
; Section 4. (virtual address 00004000)
; Virtual size			: 00000338 (	824.)
; Section size in file		: 00000400 (   1024.)
; Offset to raw	data for section: 00001200
; Flags	C0300040: Data Readable	Writable
; Alignment	: 4 bytes

; Segment type:	Externs
; _idata
extrn __imp_crypt:dword

;
; Imports from cygwin1.dll
;
extrn __imp___main:dword
; __stdcall dll_crt0()
extrn _dll_crt0@0:dword
extrn __imp__fopen64:dword
extrn _impure_ptr:dword
; void *__cdecl	calloc(size_t,size_t)
extrn calloc:dword
; int __stdcall	connect(SOCKET s,const struct sockaddr *name,int namelen)
extrn __imp_connect:dword
extrn __imp_cygwin_detach_dll:dword
extrn __imp_cygwin_internal:dword
extrn dll_dllcrt0:dword
; int __cdecl fclose(FILE *)
extrn __imp_fclose:dword
; void __cdecl free(void *)
extrn free:dword
; int fscanf(FILE *,const char *,...)
extrn __imp_fscanf:dword
; struct hostent *__stdcall gethostbyname(const	char *name)
extrn __imp_gethostbyname:dword
; u_short __stdcall htons(u_short hostshort)
extrn __imp_htons:dword
; void *__cdecl	malloc(size_t)
extrn malloc:dword
; void *__cdecl	memcpy(void *,const void *,size_t)
extrn __imp_memcpy:dword
; void *__cdecl	memset(void *,int,size_t)
extrn __imp_memset:dword
; int printf(const char	*,...)
extrn __imp_printf:dword
; void *__cdecl	realloc(void *,size_t)
extrn realloc:dword
; int __stdcall	recv(SOCKET s,char *buf,int len,int flags)
extrn __imp_recv:dword
; int __stdcall	send(SOCKET s,const char *buf,int len,int flags)
extrn __imp_send:dword
; SOCKET __stdcall socket(int af,int type,int protocol)
extrn __imp_socket:dword
; int sprintf(char *,const char	*,...)
extrn __imp_sprintf:dword
; int __cdecl strcmp(const char	*,const	char *)
extrn __imp_strcmp:dword
; size_t __cdecl strlen(const char *)
extrn __imp_strlen:dword

;
; Imports from KERNEL32.dll
;
; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName)
extrn __imp_GetModuleHandleA:dword



end start