Start of _mktemp()
[b]7816433B[/b] push esi
7816433C mov esi,dword ptr [esp+8]
78164340 push edi
78164341 xor edi,edi
78164343 cmp esi,edi
78164345 jne 78164363
78164347 call 7813434E
7816434C push edi
7816434D push edi
7816434E push edi
7816434F push edi
78164350 push edi
78164351 mov dword ptr [eax],16h
78164357 call 781388FC
7816435C add esp,14h
7816435F xor eax,eax
78164361 jmp 7816437C
78164363 push esi
78164364 call 78144340
78164369 inc eax
7816436A push eax
7816436B push esi
7816436C call 7816422D <-- Boom in here!
78164371 add esp,0Ch
78164374 neg eax
78164376 sbb eax,eax
78164378 not eax
7816437A and eax,esi
7816437C pop edi
7816437D pop esi
7816437E ret
-----------------------------------------------------
[b]7816422D[/b] push ebp
7816422E mov ebp,esp
78164230 push ecx
78164231 push ebx
78164232 push esi
78164233 push edi
78164234 mov edi,dword ptr [ebp+8]
78164237 xor ebx,ebx
78164239 cmp edi,ebx
7816423B je 78164242
7816423D cmp dword ptr [ebp+0Ch],ebx
78164240 ja 78164260
78164242 call 7813434E
78164247 push 16h
78164249 pop esi
7816424A push ebx
7816424B push ebx
7816424C push ebx
7816424D push ebx
7816424E push ebx
7816424F mov dword ptr [eax],esi
78164251 call 781388FC <-- Boom in here!
78164256 add esp,14h
78164259 mov eax,esi
7816425B jmp 78164336
78164260 push dword ptr [ebp+0Ch]
78164263 push edi
78164264 call 781500DF
78164269 mov esi,eax
7816426B cmp esi,dword ptr [ebp+0Ch]
7816426E pop ecx
7816426F pop ecx
78164270 mov dword ptr [ebp+8],esi
78164273 jb 78164279
78164275 mov byte ptr [edi],bl
78164277 jmp 78164242
78164279 call 78132FCD
7816427E mov dword ptr [ebp-4],eax
78164281 mov eax,dword ptr [ebp+8]
78164284 add esi,edi
78164286 cmp eax,6
78164289 jb 78164275
7816428B cmp dword ptr [ebp+0Ch],eax
7816428E jbe 78164275
78164290 mov dword ptr [ebp+8],ebx
78164293 jmp 781642C2
78164295 push esi
78164296 push edi
78164297 call 78166A0D
7816429C test eax,eax
7816429E pop ecx
7816429F pop ecx
781642A0 jne 781642C7
781642A2 cmp byte ptr [esi],58h
781642A5 jne 78164275
781642A7 cmp dword ptr [ebp+8],5
781642AB jae 781642C7
781642AD mov eax,dword ptr [ebp-4]
781642B0 push 0Ah
781642B2 xor edx,edx
781642B4 pop ecx
781642B5 div eax,ecx
781642B7 inc dword ptr [ebp+8]
781642BA add dl,30h
781642BD mov byte ptr [esi],dl
781642BF mov dword ptr [ebp-4],eax
781642C2 dec esi
781642C3 cmp esi,edi
781642C5 jae 78164295
781642C7 cmp byte ptr [esi],58h
781642CA jne 78164275
781642CC cmp dword ptr [ebp+8],5
781642D0 jb 78164275
781642D2 mov byte ptr [esi],61h
781642D5 mov dword ptr [ebp+8],62h
781642DC call 7813434E
781642E1 mov eax,dword ptr [eax]
781642E3 mov dword ptr [ebp-4],eax
781642E6 call 7813434E
781642EB push ebx
781642EC push edi
781642ED mov dword ptr [eax],ebx
781642EF call 7815471C
781642F4 test eax,eax
781642F6 pop ecx
781642F7 pop ecx
781642F8 je 78164304
781642FA call 7813434E
781642FF cmp dword ptr [eax],0Dh
78164302 jne 78164314
78164304 cmp dword ptr [ebp+8],7Bh
78164308 je 78164322
7816430A mov al,byte ptr [ebp+8]
7816430D inc dword ptr [ebp+8]
78164310 mov byte ptr [esi],al
78164312 jmp 781642E6
78164314 call 7813434E
78164319 mov ecx,dword ptr [ebp-4]
7816431C mov dword ptr [eax],ecx
7816431E xor eax,eax
78164320 jmp 78164336
78164322 mov byte ptr [edi],bl
78164324 call 7813434E
78164329 mov dword ptr [eax],11h
7816432F call 7813434E
78164334 mov eax,dword ptr [eax]
78164336 pop edi
78164337 pop esi
78164338 pop ebx
78164339 leave
7816433A ret
7816433B push esi
7816433C mov esi,dword ptr [esp+8]
78164340 push edi
78164341 xor edi,edi
78164343 cmp esi,edi
78164345 jne 78164363
78164347 call 7813434E
7816434C push edi
7816434D push edi
7816434E push edi
7816434F push edi
78164350 push edi
78164351 mov dword ptr [eax],16h
78164357 call 781388FC
7816435C add esp,14h
7816435F xor eax,eax
78164361 jmp 7816437C
78164363 push esi
78164364 call 78144340
78164369 inc eax
7816436A push eax
7816436B push esi
7816436C call 7816422D
78164371 add esp,0Ch
78164374 neg eax
78164376 sbb eax,eax
78164378 not eax
7816437A and eax,esi
7816437C pop edi
7816437D pop esi
7816437E ret
-----------------------------------------------------
[b]781388FC[/b] push ebp
781388FD mov ebp,esp
781388FF push dword ptr ds:[781C4028h]
78138905 call 78132BD7
7813890A test eax,eax
7813890C pop ecx
7813890D je 78138912
7813890F pop ebp
78138910 jmp eax
78138912 push 2
78138914 call 7813BBF2
78138919 pop ecx
7813891A pop ebp
7813891B jmp 781387D1 <-- Jump & boom in here
78138920 xor eax,eax
78138922 push eax
78138923 push eax
78138924 push eax
78138925 push eax
78138926 push eax
78138927 call 781388FC
7813892C add esp,14h
7813892F ret
-----------------------------------------------------
[b]781387D1[/b] push ebp
781387D2 lea ebp,[esp-2A8h]
781387D9 sub esp,328h
781387DF mov eax,dword ptr ds:[781C19C8h]
781387E4 xor eax,ebp
781387E6 mov dword ptr [ebp+2A4h],eax
781387EC push esi
781387ED mov dword ptr [ebp+88h],eax
781387F3 mov dword ptr [ebp+84h],ecx
781387F9 mov dword ptr [ebp+80h],edx
781387FF mov dword ptr [ebp+7Ch],ebx
78138802 mov dword ptr [ebp+78h],esi
78138805 mov dword ptr [ebp+74h],edi
78138808 mov word ptr [ebp+0A0h],ss
7813880F mov word ptr [ebp+94h],cs
78138816 mov word ptr [ebp+70h],ds
7813881A mov word ptr [ebp+6Ch],es
7813881E mov word ptr [ebp+68h],fs
78138822 mov word ptr [ebp+64h],gs
78138826 pushfd
78138827 pop dword ptr [ebp+98h]
7813882D mov esi,dword ptr [ebp+2ACh]
78138833 lea eax,[ebp+2ACh]
78138839 mov dword ptr [ebp+9Ch],eax
7813883F mov dword ptr [ebp-28h],10001h
78138846 mov dword ptr [ebp+90h],esi
7813884C mov eax,dword ptr [eax-4]
7813884F push 50h
78138851 mov dword ptr [ebp+8Ch],eax
78138857 lea eax,[ebp-80h]
7813885A push 0
7813885C push eax
7813885D call 78144890
78138862 lea eax,[ebp-80h]
78138865 mov dword ptr [ebp-30h],eax
78138868 lea eax,[ebp-28h]
7813886B add esp,0Ch
7813886E mov dword ptr [ebp-80h],0C000000Dh
78138875 mov dword ptr [ebp-74h],esi
78138878 mov dword ptr [ebp-2Ch],eax
7813887B call dword ptr ds:[781940F0h]
78138881 push 0
78138883 mov esi,eax
78138885 call dword ptr ds:[781940ECh]
7813888B lea eax,[ebp-30h]
7813888E push eax
7813888F call dword ptr ds:[781940E8h]
78138895 test eax,eax
78138897 jne 781388A5
78138899 test esi,esi
7813889B jne 781388A5
7813889D push 2
7813889F call 7813BBF2
781388A4 pop ecx
781388A5 push 0C000000Dh
781388AA call dword ptr ds:[781940E4h]
781388B0 push eax
781388B1 call dword ptr ds:[781940E0h] <-- Boom in here!
781388B7 mov ecx,dword ptr [ebp+2A4h]
781388BD xor ecx,ebp
781388BF pop esi
781388C0 call 781398EF
781388C5 add ebp,2A8h
781388CB leave
781388CC ret
-----------------------------------------------------
[b]7C801E16[/b] mov edi,edi
7C801E18 push ebp
7C801E19 mov ebp,esp
7C801E1B cmp dword ptr [ebp+8],0
7C801E1F jne 7C801E2A
7C801E21 push 6
7C801E23 call 7C8092B0
7C801E28 jmp 7C801E45
7C801E2A push dword ptr [ebp+0Ch]
7C801E2D push dword ptr [ebp+8]
7C801E30 call dword ptr ds:[7C8013FCh] <-- Boom in here!
7C801E36 test eax,eax
7C801E38 jl 7C801E3F
7C801E3A xor eax,eax
7C801E3C inc eax
7C801E3D jmp 7C801E47
7C801E3F push eax
7C801E40 call 7C80936B
7C801E45 xor eax,eax
7C801E47 pop ebp
7C801E48 ret 8
-----------------------------------------------------
[b]7C90E88E[/b] mov eax,101h
7C90E893 mov edx,7FFE0300h
7C90E898 call dword ptr [edx] <-- Boom in here!
7C90E89A ret 8
-----------------------------------------------------
[b]7C90EB8B[/b] mov edx,esp
7C90EB8D sysenter <-- Boom in here!
7C90EB8F nop
7C90EB90 nop
7C90EB91 nop
7C90EB92 nop
7C90EB93 nop
7C90EB94 ret
State of registers before entering "sysenter":
EAX = 00000101 EBX = 00000000 ECX = 7C8637FA EDX = 0012FBD4 ESI = 00000001
EDI = 00403380 EIP = 7C90EB8D ESP = 0012FBD4 EBP = 0012FBE4 EFL = 00000286