System snapshot taken on 12/10/2002 20:59:50.

*----> Summary/Overview <----*

        TclKit = Tcl + IncrTcl + Tk + MetaKit performed an invalid 
        memory access.
        
        Module Name: TCLKIT.EXE
        Description: TclKit = Tcl + IncrTcl + Tk + MetaKit
        Version: 8.4b1
        Product: TclKit 8.4 for Windows
        Manufacturer: Equi4 Software
        
        Application Name: Tclkit.exe
        Description: TclKit = Tcl + IncrTcl + Tk + MetaKit
        Version: 8.4b1
        Product: TclKit 8.4 for Windows
        Manufacturer: Equi4 Software
        
        User's Remarks:
        

*----> System Information <----*

        Microsoft Windows 98 4.10.2222 A 
        Clean install using Full OEM CD 
        /T:C:\WININST0.400 /SrcDir=D:\WIN98 /IE /NF /IZ /IS /IQ /IT /II /NR /II /C  /U:xxxxxxxxxxxxxxxxx
        IE 5 5.00.3314.2101
        Uptime: 0:00:04:31
        Normal mode
        On "WIN98SE" as "jcw"
        
        GenuineIntel x86 Family 6 Model 8 Stepping 1 
        64MB RAM
        92% system resources free
        Windows-managed swap file on drive C (3748MB free)
        Temporary files on drive C (3748MB free)

*----> Task list <----*

Program
        Type
        Path
------------

1. Kernel32.dll
        4.10.2222
        Microsoft Corporation

2. MSGSRV32.EXE
        4.10.2222
        Microsoft Corporation

3. Mprexe.exe
        4.10.1998
        Microsoft Corporation

4. Mstask.exe
        4.71.1968.1
        Microsoft Corporation

5. Explorer.exe
        4.72.3110.1
        Microsoft Corporation

6. Taskmon.exe
        4.10.1998
        Microsoft Corporation

7. Systray.exe
        4.10.2222
        Microsoft Corporation

8. Vmwaretray.exe
        3.2.0 $Name: build-2230 $
        VMware, Inc.

9. Vmwareservice.exe
        3.2.0 $Name: build-2230 $
        VMware, Inc.

10. Drwatson.exe
        4.03
        Microsoft Corporation

11. Tclkit.exe
        8.4b1
        Equi4 Software

*----> Startup Items <----*

Name
        Loaded from
        Command
-------------------

1. ScanRegistry
        Registry (Machine Run)
        C:\WINDOWS\scanregw.exe /autorun

2. TaskMonitor
        Registry (Machine Run)
        C:\WINDOWS\taskmon.exe

3. SystemTray
        Registry (Machine Run)
        SysTray.Exe

4. LoadPowerProfile
        Registry (Machine Run)
        Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

5. VMware Tools
        Registry (Machine Run)
        C:\Program Files\VMware\VMwareTray.exe

6. VMware Tools Service
        Registry (Machine Run)
        C:\PROGRAM FILES\VMWARE\VMWARESERVICE.EXE

7. LoadPowerProfile
        Registry (Machine Service)
        Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

8. SchedulingAgent
        Registry (Machine Service)
        mstask.exe

9. VMware Tools Service
        Registry (Machine Service)
        C:\PROGRAM FILES\VMWARE\VMWARESERVICE.EXE

*----> Kernel Drivers <----*

Driver
        Loaded from
        Type
        Likely path
-------------------

1. VMM
        
        Microsoft Corporation
        Virtual Machine Manager

2. MTRR
        
        Microsoft Corporation
        ?

3. VCACHE
        
        Microsoft Corporation
        Cache manager

4. DFS
        4.10.2222
        Microsoft Corporation
        DFS Virtual Device  (Version 4.0)

5. PERF
        
        Microsoft Corporation
        System Monitor data collection driver

6. VFIXD
        1.00.02
        Intel Corporation
        Compatibility VxD

7. VPOWERD
        4.10.2223
        Microsoft Corporation
        VPOWERD Virtual Device  (Version 4.0)

8. VPICD
        
        Microsoft Corporation
        Hardware interrupt manager

9. VrtwD
        1.1.075.3
        Intel Corporation
        Real-Time Clock VxD

10. VTD
        
        Microsoft Corporation
        Timer device driver

11. VWIN32
        
        Microsoft Corporation
        Win32 subsystem driver

12. VXDLDR
        
        Microsoft Corporation
        Dynamic device driver loader

13. NTKERN
        
        Microsoft Corporation
        Windows Driver Model

14. CONFIGMG
        
        Microsoft Corporation
        Configuration manager

15. PCI
        4.10.2223
        Microsoft Corporation
        PCI Virtual Device  (Version 4.0)

16. ISAPNP
        4.10.1998
        Microsoft Corporation
        ISAPNP Virtual Device  (Version 4.0)

17. BIOS
        4.10.1998
        Microsoft Corporation
        BIOS Virtual Device  (Version 4.0)

18. VCDFSD
        
        Microsoft Corporation
        CD-ROM filesystem driver

19. IOS
        
        Microsoft Corporation
        I/O Supervisor

20. PAGEFILE
        
        Microsoft Corporation
        Swapfile driver

21. PAGESWAP
        
        Microsoft Corporation
        Swapfile manager

22. PARITY
        
        Microsoft Corporation
        Memory parity driver

23. REBOOT
        
        Microsoft Corporation
        Ctrl+Alt+Del manager

24. EBIOS
        
        Microsoft Corporation
        Extended BIOS driver

25. VDD
        
        Microsoft Corporation
        Display driver

26. VMX_SVGA
        
        
        

27. VSD
        
        Microsoft Corporation
        Speaker driver

28. COMBUFF
        
        Microsoft Corporation
        Communications buffer driver

29. VCD
        
        Microsoft Corporation
        Communications port driver

30. VMOUSE
        
        Microsoft Corporation
        Mouse driver

31. MSMINI
        4.10.1998
        Microsoft Corporation
        MSMINI Virtual Device  (Version 4.0)

32. ENABLE
        
        Microsoft Corporation
        Accessibility driver

33. VKD
        
        Microsoft Corporation
        Keyboard driver

34. INT13
        
        Microsoft Corporation
        BIOS hard disk emulation driver

35. VMCPD
        
        Microsoft Corporation
        Math coprocessor driver

36. BIOSXLAT
        
        Microsoft Corporation
        BIOS emulation driver

37. VNETBIOS
        4.10.1998
        Microsoft Corporation
        VNETBIOS Virtual Device  (Version 4.0)

38. NDIS
        4.10.2222
        Microsoft Corporation
        NDIS Virtual Device  (Version 4.0)

39. VTDI
        4.10.1998
        Microsoft Corporation
        Windows TDI Support Driver

40. VIP
        4.10.2226
        Microsoft Corporation
        Windows IP Driver

41. MSTCP
        4.10.2222
        Microsoft Corporation
        Windows TCP Driver

42. VDHCP
        4.10.2161
        Microsoft Corporation
        DHCP VxD Driver

43. VNBT
        4.10.2148
        Microsoft Corporation
        VNBT VxD Driver

44. DOSMGR
        
        Microsoft Corporation
        MS-DOS emulation manager

45. VMPOLL
        
        Microsoft Corporation
        System idle-time driver

46. JAVASUP
        5.00.3802
        Microsoft Corporation
        Microsoft® Virtual Machine Helper Device for Java

47. VCOMM
        
        Microsoft Corporation
        Communications port Plug and Play driver

48. VCOND
        
        Microsoft Corporation
        Console subsystem driver

49. VTDAPI
        
        Microsoft Corporation
        Multimedia timer driver

50. VFLATD
        
        Microsoft Corporation
        Linear aperture video driver

51. Display1
        
        
        

52. APIX
        4.00.952
        Microsoft Corporation
        APIX Virtual Device  (Version 4.0)

53. CDTSD
        4.10.1998
        Microsoft Corporation
        CDTSD Virtual Device  (Version 4.0)

54. CDVSD
        4.10.2222
        Microsoft Corporation
        CDVSD Virtual Device  (Version 4.0)

55. DiskTSD
        4.10.2222
        Microsoft Corporation
        DiskTSD Virtual Device  (Version 4.0)

56. scsi1hlp
        4.10.1998
        Microsoft Corporation
        scsi1hlp Virtual Device  (Version 4.0)

57. voltrack
        4.10.1998
        Microsoft Corporation
        voltrack Virtual Device  (Version 4.0)

58. BIGMEM
        4.10.1998
        Microsoft Corporation
        BIGMEM Virtual Device  (Version 4.0)

59. VMMOUSE
        Build: $Name: build-2230 $
        VMware, Inc.
        VMware Virtual Pointer Driver

60. HSFLOP
        4.10.2222
        Microsoft Corporation
        HSFLOP Virtual Device  (Version 4.0)

61. ESDI_506
        4.10.2222
        Microsoft Corporation
        ESDI_506 Virtual Device  (Version 4.0)

62. SERENUM
        4.10.2222
        Microsoft Corporation
        SERENUM Virtual Device  (Version 4.0)

63. sage
        4.71.1016
        Microsoft Corporation
        sage Virtual Device  (Version 4.0)

64. mmdevldr
        4.10.1998
        Microsoft Corporation
        mmdevldr Virtual Device        (Version 4.0)

65. vjoyd
        4.05.01.1998
        Microsoft Corporation
        Joystick Virtual Device

66. FIOLOG
        4.10.1998
        Microsoft Corporation
        File I/O Logging VxD for Application Defrag

67. VDMAD
        
        Microsoft Corporation
        Direct Memory Access controller driver

68. V86MMGR
        
        Microsoft Corporation
        MS-DOS memory manager

69. SPOOLER
        
        Microsoft Corporation
        Print spooler

70. UDF
        
        Microsoft Corporation
        ?

71. VFAT
        
        Microsoft Corporation
        FAT filesystem driver

72. VDEF
        
        Microsoft Corporation
        Default filesystem driver

73. CDFS
        4.10.1998
        Microsoft Corporation
        CDFS Virtual Device  (Version 4.0)

74. IFSMGR
        
        Microsoft Corporation
        File system manager

75. VNETSUP
        4.10.1998
        Microsoft Corporation
        VNETSUP Virtual Device  (Version 4.0)

76. VREDIR
        4.10.2222
        Microsoft Corporation
        VREDIR Virtual Device  (Version 4.0)

77. VFBACKUP
        
        Microsoft Corporation
        Floppy backup helper driver

78. SHELL
        
        Microsoft Corporation
        Shell device driver

79. DRWATSON
        4.03
        Microsoft Corporation
        Dr. Watson for Windows 98

80. pcntn4m
        1.00.040
        Advanced Micro Devices.
        Network Driver for AMD PCNET family

81. wmidrv
        
        
        

82. PCIMP
        
        
        

83. hidvkd
        
        
        

84. swenum
        
        
        

85. ks
        
        
        

86. update
        
        
        

87. wdmfs
        
        
        

*----> User-Mode Drivers <----*

Driver
        Type
        Path
------------

1. mmsystem.dll
        4.03.1998
        Microsoft Corporation

2. power.drv
        4.10.1998
        Microsoft Corporation

*----> MS-DOS Drivers <----*

Name
        Type
------------

1. HIMEM   
        Device driver

2. DBLBUFF 
        Device driver

3. IFSHLP  
        Device driver

*----> 32-bit Modules <----*

Name
        Date
        Address
        Path
---------------

1. TCLKIT.EXE
        8.4b1
        Equi4 Software
        TclKit = Tcl + IncrTcl + Tk + MetaKit

2. IMM32.DLL
        4.10.1998
        Microsoft Corporation
        Win32 IMM32 core component

3. COMDLG32.DLL
        4.72.3510.2300
        Microsoft Corporation
        Common Dialogs DLL

4. SHELL32.DLL
        4.72.3612.1700
        Microsoft Corporation
        Windows Shell Common Dll

5. COMCTL32.DLL
        5.81
        Microsoft Corporation
        Common Controls Library

6. SHLWAPI.DLL
        5.00.3314.2100
        Microsoft Corporation
        Shell Light-weight Utility Library

7. MSVCRT.DLL
        6.00.8397.0
        Microsoft Corporation
        Microsoft (R) C Runtime Library

8. USER32.DLL
        4.10.2227
        Microsoft Corporation
        Win32 USER32 core component

9. GDI32.DLL
        4.10.1998
        Microsoft Corporation
        Win32 GDI core component

10. ADVAPI32.DLL
        4.80.1675
        Microsoft Corporation
        Win32 ADVAPI32 core component

11. KERNEL32.DLL
        4.10.2222
        Microsoft Corporation
        Win32 Kernel core component

*----> 16-bit Modules <----*

Name
        Type
        Path
------------

1. KERNEL
        4.10.1998
        Microsoft Corporation

2. SYSTEM
        4.10.1998
        Microsoft Corporation

3. KEYBOARD
        4.10.2222
        Microsoft Corporation

4. MOUSE
        9.01.0.000
        Microsoft Corporation

5. DISPLAY
        Build $Name: build-2230 $
        VMware, Inc.

6. DIBENG
        4.10.1998
        Microsoft Corporation

7. SOUND
        4.10.1998
        Microsoft Corporation

8. COMM
        4.10.1998
        Microsoft Corporation

9. GDI
        4.10.2222
        Microsoft Corporation

10. USER
        4.10.2227
        Microsoft Corporation

11. DDEML
        4.10.1998
        Microsoft Corporation

12. MSPLUS
        4.40.500
        Microsoft Corporation

13. MSGSRV32
        4.10.2222
        Microsoft Corporation

14. MMSYSTEM
        4.03.1998
        Microsoft Corporation

15. POWER
        4.10.1998
        Microsoft Corporation

16. LZEXPAND
        4.00.429
        Microsoft Corporation

17. VER
        4.10.1998
        Microsoft Corporation

18. SHELL
        4.10.1998
        Microsoft Corporation

19. COMMCTRL
        4.10.1998
        Microsoft Corporation

20. SYSTHUNK
        4.10.1998
        Microsoft Corporation

21. OLECLI
        1.20.000
        Microsoft Corporation

22. OLESVR
        1.10.000
        Microsoft Corporation

23. COMMDLG
        4.00.950
        Microsoft Corporation

24. PIFMGR
        4.10.2222
        Microsoft Corporation

25. TOOLHELP
        4.10.1998
        Microsoft Corporation

*----> Details <----*

Command line: "H:\lastkit\tclkit.exe" H:\lastkit\tcl84dok

Trap 0e 0000 - Invalid page fault
eax=00000000 ebx=00a01072 ecx=00000043 edx=008092ec esi=00a01070 edi=007df7a4
eip=0043de8e esp=007df5f8 ebp=00000043         -- -- -- nv up EI pl ZR na PE nc
cs=0167 ss=016f ds=016f es=016f fs=27a7 gs=0000
TCLKIT.EXE:.text+0x3ce8e:
>0167:0043de8e 8b0482              mov     eax,dword ptr [edx+eax*4]

   sel  type base     lim/bot
   ---- ---- -------- --------
cs 0167 r-x- 00000000 ffbfffff
ss 016f rw-e 00000000 000087a0
ds 016f rw-e 00000000 000087a0
es 016f rw-e 00000000 000087a0
fs 27a7 rw-- 8161bb34 00000037
gs 0000 ----

stack base:   006e0000
TIB limits:   007d4000 - 007e0000

-- exception record --

   Exception Code: c0000005 (access violation)
Exception Address: 0043de8e (TCLKIT.EXE:.text+0x3ce8e)
   Exception Info: 00000000
                   008092ec

TCLKIT.EXE:.text+0x3ce8e:
>0167:0043de8e 8b0482              mov     eax,dword ptr [edx+eax*4]

 0167:0043de67 e8342d0300          call    00470ba0 = TCLKIT.EXE:.text+0x6fba0
 0167:0043de6c 8b6c244c            mov     ebp,dword ptr [esp+4c]
 0167:0043de70 8b542420            mov     edx,dword ptr [esp+20]
 0167:0043de74 8bcd                mov     ecx,ebp
 0167:0043de76 89442424            mov     dword ptr [esp+24],eax
 0167:0043de7a 81e1ffff0000        and     ecx,0000ffff
 0167:0043de80 83c408              add     esp,+08
 0167:0043de83 8bc1                mov     eax,ecx
 0167:0043de85 81e1ff000000        and     ecx,000000ff
 0167:0043de8b c1e808              shr     eax,08
TCLKIT.EXE:.text+0x3ce8e:
*0167:0043de8e 8b0482              mov     eax,dword ptr [edx+eax*4]
 0167:0043de91 33d2                xor     edx,edx
 0167:0043de93 668b1448            mov     dx,word ptr [eax+ecx*2]
 0167:0043de97 85d2                test    edx,edx
 0167:0043de99 7512                jnz     0043dead = TCLKIT.EXE:.text+0x3cead
 0167:0043de9b 6685ed              test    bp,bp
 0167:0043de9e 740d                jz      0043dead = TCLKIT.EXE:.text+0x3cead
 0167:0043dea0 f644243804          test    byte ptr [esp+38],04
 0167:0043dea5 7563                jnz     0043df0a = TCLKIT.EXE:.text+0x3cf0a
 0167:0043dea7 8b4c242c            mov     ecx,dword ptr [esp+2c]
 0167:0043deab 8b11                mov     edx,dword ptr [ecx]

--------------------


-- stack summary --

016f:00000042 0167:0043de8e TCLKIT.EXE:.text+0x3ce8e
                            (5d2547f0,00e739fd,0b0240f0,70042d02,
                             0e0a2800,00ff5903,e3002ff0,00fe6e05)
016f:f84dc670 0167:f841f000 0167:f841f000

-- stack trace --

016f:00000042 0167:0043de8e TCLKIT.EXE:.text+0x3ce8e
                            (5d2547f0,00e739fd,0b0240f0,70042d02,
                             0e0a2800,00ff5903,e3002ff0,00fe6e05)
 0167:0043de67 e8342d0300          call    00470ba0 = TCLKIT.EXE:.text+0x6fba0
 0167:0043de6c 8b6c244c            mov     ebp,dword ptr [esp+4c]
 0167:0043de70 8b542420            mov     edx,dword ptr [esp+20]
 0167:0043de74 8bcd                mov     ecx,ebp
 0167:0043de76 89442424            mov     dword ptr [esp+24],eax
 0167:0043de7a 81e1ffff0000        and     ecx,0000ffff
 0167:0043de80 83c408              add     esp,+08
 0167:0043de83 8bc1                mov     eax,ecx
 0167:0043de85 81e1ff000000        and     ecx,000000ff
 0167:0043de8b c1e808              shr     eax,08
TCLKIT.EXE:.text+0x3ce8e:
*0167:0043de8e 8b0482              mov     eax,dword ptr [edx+eax*4]
 0167:0043de91 33d2                xor     edx,edx
 0167:0043de93 668b1448            mov     dx,word ptr [eax+ecx*2]
 0167:0043de97 85d2                test    edx,edx
 0167:0043de99 7512                jnz     0043dead = TCLKIT.EXE:.text+0x3cead
 0167:0043de9b 6685ed              test    bp,bp
 0167:0043de9e 740d                jz      0043dead = TCLKIT.EXE:.text+0x3cead
 0167:0043dea0 f644243804          test    byte ptr [esp+38],04
 0167:0043dea5 7563                jnz     0043df0a = TCLKIT.EXE:.text+0x3cf0a
 0167:0043dea7 8b4c242c            mov     ecx,dword ptr [esp+2c]
 0167:0043deab 8b11                mov     edx,dword ptr [ecx]

--------------------

016f:f84dc670 0167:f841f000 0167:f841f000

-- stack dump --

007df5f8 00000002
007df5fc 000000c7
007df600 007df7a4 -> 00 00 00 00 b1 12 00 78 18 71 03 78 04 f8 7d 00 .......x.q.x..}.
007df604 007df798 -> a4 f7 7d 00 00 00 00 00 c8 00 00 00 00 00 00 00 ..}.............
007df608 00000000
007df60c 00a01072 -> 2f 57 49 4e 44 4f 57 53 2f 54 45 4d 50 2f 54 43 /WINDOWS/TEMP/TC
007df610 008092ec
007df614 00000001
007df618 00a01070 -> 43 3a 2f 57 49 4e 44 4f 57 53 2f 54 45 4d 50 2f C:/WINDOWS/TEMP/
007df61c 007df7a4 -> 00 00 00 00 b1 12 00 78 18 71 03 78 04 f8 7d 00 .......x.q.x..}.
007df620 0043cf13 = TCLKIT.EXE:.text+0x3bf13
                 
--------------------

 0167:0043ceff 8d442430            lea     eax,[esp+30]
 0167:0043cf03 55                  push    ebp
 0167:0043cf04 50                  push    eax
 0167:0043cf05 8b442444            mov     eax,dword ptr [esp+44]
 0167:0043cf09 51                  push    ecx
 0167:0043cf0a 8b4a14              mov     ecx,dword ptr [edx+14]
 0167:0043cf0d 57                  push    edi
 0167:0043cf0e 50                  push    eax
 0167:0043cf0f 51                  push    ecx
 0167:0043cf10 ff5208              call    dword ptr [edx+08]
TCLKIT.EXE:.text+0x3bf13:
*0167:0043cf13 8b74243c            mov     esi,dword ptr [esp+3c]
 0167:0043cf17 8b0b                mov     ecx,dword ptr [ebx]
 0167:0043cf19 2bf1                sub     esi,ecx
 0167:0043cf1b 83c428              add     esp,+28
 0167:0043cf1e 03f5                add     esi,ebp
 0167:0043cf20 83f8fc              cmp     eax,-04
 0167:0043cf23 755a                jnz     0043cf7f = TCLKIT.EXE:.text+0x3bf7f
 0167:0043cf25 8b442418            mov     eax,dword ptr [esp+18]
 0167:0043cf29 8b54242c            mov     edx,dword ptr [esp+2c]
 0167:0043cf2d 8b6c2434            mov     ebp,dword ptr [esp+34]
 0167:0043cf31 03d0                add     edx,eax

--------------------


007df624 009188c0 -> 2c e8 91 00 c0 09 7f 00 00 00 00 00 00 00 00 00 ,...............
007df628 007df7a5 -> 00 00 00 b1 12 00 78 18 71 03 78 04 f8 7d 00 8e ......x.q.x..}..
007df62c 00000000
007df630 00000003
007df634 007df66c -> f0 d3 9e 00 97 b3 48 00 90 88 91 00 70 10 a0 00 ......H.....p...
007df638 007df86a -> 00 78 09 00 00 00 27 cc 00 78 4c 79 81 00 70 11 .x....'..xLy..p.
007df63c 00000043
007df640 007df664 -> 60 5f 83 00 60 5f 83 00 f0 d3 9e 00 97 b3 48 00 `_..`_........H.
007df644 007df660 -> 60 5f 83 00 60 5f 83 00 60 5f 83 00 f0 d3 9e 00 `_..`_..`_......
007df648 007df668 -> 60 5f 83 00 f0 d3 9e 00 97 b3 48 00 90 88 91 00 `_........H.....
007df64c 00000001
007df650 00a01070 -> 43 3a 2f 57 49 4e 44 4f 57 53 2f 54 45 4d 50 2f C:/WINDOWS/TEMP/
007df654 00a01072 -> 2f 57 49 4e 44 4f 57 53 2f 54 45 4d 50 2f 54 43 /WINDOWS/TEMP/TC
007df658 0000002f
007df65c 000000c7
007df660 00835f60 -> 00 00 00 00 00 00 00 00 13 00 00 00 10 e2 55 00 ..............U.
     ...
007df66c 009ed3f0 -> 07 ff 4c 00 20 8a 98 00 00 00 00 00 00 02 a0 00 ..L. ...........
007df670 0048b397 = TCLKIT.EXE:.text+0x8a397
                 
--------------------

 0167:0048b37a 3bf5                cmp     esi,ebp
 0167:0048b37c 0f84ed000000        jz      0048b46f = TCLKIT.EXE:.text+0x8a46f
 0167:0048b382 8bcd                mov     ecx,ebp
 0167:0048b384 8d842414010000      lea     eax,[esp+00000114]
 0167:0048b38b 2bce                sub     ecx,esi
 0167:0048b38d 50                  push    eax
 0167:0048b38e 51                  push    ecx
 0167:0048b38f 56                  push    esi
 0167:0048b390 6a00                push    +00
 0167:0048b392 e8f91afbff          call    0043ce90 = TCLKIT.EXE:.text+0x3be90
TCLKIT.EXE:.text+0x8a397:
*0167:0048b397 83c410              add     esp,+10
 0167:0048b39a 8bf0                mov     esi,eax
 0167:0048b39c 85ff                test    edi,edi
 0167:0048b39e 7432                jz      0048b3d2 = TCLKIT.EXE:.text+0x8a3d2
 0167:0048b3a0 56                  push    esi
 0167:0048b3a1 ff15fc425500        call    dword ptr [005542fc] -> KERNEL32.DLL!GetFileAttributesA
 0167:0048b3a7 83f8ff              cmp     eax,-01
 0167:0048b3aa 0f84c5000000        jz      0048b475 = TCLKIT.EXE:.text+0x8a475
 0167:0048b3b0 8a06                mov     al,byte ptr [esi]
 0167:0048b3b2 3c61                cmp     al,61
 0167:0048b3b4 7c04                jl      0048b3ba = TCLKIT.EXE:.text+0x8a3ba

--------------------


007df674 00918890 -> e0 a4 91 00 d0 dc 43 00 e0 dd 43 00 50 df 43 00 ......C...C.P.C.
007df678 00a01070 -> 43 3a 2f 57 49 4e 44 4f 57 53 2f 54 45 4d 50 2f C:/WINDOWS/TEMP/
007df67c 00000002
007df680 00000003
007df684 00000004
007df688 00814830 -> 01 00 00 00 70 10 a0 00 1b 00 00 00 10 e2 55 00 ....p.........U.
007df68c 00000000
     ...
007df694 00a01070 -> 43 3a 2f 57 49 4e 44 4f 57 53 2f 54 45 4d 50 2f C:/WINDOWS/TEMP/
007df698 78037118 = MSVCRT.DLL:.data+0x2118
                  -> 04 00 00 00 2c 3f 62 81 00 00 00 00 00 00 00 00 ....,?b.........
007df69c 00000000
007df6a0 007df6ac -> 00 00 00 00 50 f7 7d 00 03 00 00 00 80 11 a0 00 ....P.}.........
007df6a4 00000000
007df6a8 000000c8
007df6ac 00000000
007df6b0 007df750 -> 00 3a 2f 00 c0 85 9f 00 c8 f8 7d 00 cf 38 45 00 .:/.......}..8E.
007df6b4 00000003
007df6b8 00a01180 -> 09 00 00 00 00 00 00 00 21 00 00 00 31 00 00 00 ........!...1...
007df6bc 00000004
     ...
007df6c4 007dfe28 -> 68 ff 7d 00 a2 33 55 00 e0 71 55 00 00 00 00 00 h.}..3U..qU.....
007df6c8 7800ef03 = MSVCRT.DLL!_except_handler3
                  -> 55 8b ec 83 ec 08 53 56 57 55 fc 8b 5d 0c 8b 45 U.....SVWU..]..E
007df6cc 7802e248 = MSVCRT.DLL:.rdata+0x248
                  -> ff ff ff ff 00 00 00 00 ac cc 00 78 ff ff ff ff ...........x....
007df6d0 ffffffff
007df6d4 00855f5c -> 01 00 00 00 00 12 a0 00 03 00 00 00 00 00 00 00 ................
007df6d8 780012d9 = MSVCRT.DLL:.text+0x2d9
                 
--------------------

 0167:780012b3 ff3550710378        push    dword ptr [78037150]
 0167:780012b9 ff742408            push    dword ptr [esp+08]
 0167:780012bd e803000000          call    780012c5 = MSVCRT.DLL:.text+0x2c5
 0167:780012c2 59                  pop     ecx
 0167:780012c3 59                  pop     ecx
 0167:780012c4 c3                  retd
 0167:780012c5 837c2404e0          cmp     dword ptr [esp+04],-20
 0167:780012ca 0f878bb90000        ja      7800cc5b = MSVCRT.DLL:.text+0xbc5b
 0167:780012d0 ff742404            push    dword ptr [esp+04]
 0167:780012d4 e80a000000          call    780012e3 = MSVCRT.DLL:.text+0x2e3
MSVCRT.DLL:.text+0x2d9:
*0167:780012d9 85c0                test    eax,eax
 0167:780012db 59                  pop     ecx
 0167:780012dc 0f845db90000        jz      7800cc3f = MSVCRT.DLL:.text+0xbc3f
 0167:780012e2 c3                  retd
 0167:780012e3 55                  push    ebp
 0167:780012e4 8bec                mov     ebp,esp
 0167:780012e6 6aff                push    -01
 0167:780012e8 6848e20278          push    7802e248
 0167:780012ed 6803ef0078          push    7800ef03
 0167:780012f2 64a100000000        mov     eax,dword ptr fs:[00000000]
 0167:780012f8 50                  push    eax

--------------------


007df6dc 00000004
007df6e0 780012c2 = MSVCRT.DLL:.text+0x2c2
                 
--------------------

 0167:7800129e 55                  push    ebp
 0167:7800129f 8bec                mov     ebp,esp
 0167:780012a1 8b4508              mov     eax,dword ptr [ebp+08]
 0167:780012a4 ff348528700378      push    dword ptr [eax*4+78037028]
 0167:780012ab ff1548e00278        call    dword ptr [7802e048] -> KERNEL32.DLL!LeaveCriticalSection
 0167:780012b1 5d                  pop     ebp
 0167:780012b2 c3                  retd
 0167:780012b3 ff3550710378        push    dword ptr [78037150]
 0167:780012b9 ff742408            push    dword ptr [esp+08]
 0167:780012bd e803000000          call    780012c5 = MSVCRT.DLL:.text+0x2c5
MSVCRT.DLL:.text+0x2c2:
*0167:780012c2 59                  pop     ecx
 0167:780012c3 59                  pop     ecx
 0167:780012c4 c3                  retd
 0167:780012c5 837c2404e0          cmp     dword ptr [esp+04],-20
 0167:780012ca 0f878bb90000        ja      7800cc5b = MSVCRT.DLL:.text+0xbc5b
 0167:780012d0 ff742404            push    dword ptr [esp+04]
 0167:780012d4 e80a000000          call    780012e3 = MSVCRT.DLL:.text+0x2e3
 0167:780012d9 85c0                test    eax,eax
 0167:780012db 59                  pop     ecx
 0167:780012dc 0f845db90000        jz      7800cc3f = MSVCRT.DLL:.text+0xbc3f
 0167:780012e2 c3                  retd

--------------------


007df6e4 00000004
007df6e8 00000000
007df6ec 00478a0b = TCLKIT.EXE:.text+0x77a0b
                 
--------------------

 0167:004789f9 90                  nop
 0167:004789fa 90                  nop
 0167:004789fb 90                  nop
 0167:004789fc 90                  nop
 0167:004789fd 90                  nop
 0167:004789fe 90                  nop
 0167:004789ff 90                  nop
 0167:00478a00 8b442404            mov     eax,dword ptr [esp+04]
 0167:00478a04 50                  push    eax
 0167:00478a05 ff1534445500        call    dword ptr [00554434] -> MSVCRT.DLL!malloc
TCLKIT.EXE:.text+0x77a0b:
*0167:00478a0b 83c404              add     esp,+04
 0167:00478a0e c3                  retd
 0167:00478a0f 90                  nop
 0167:00478a10 8b442404            mov     eax,dword ptr [esp+04]
 0167:00478a14 50                  push    eax
 0167:00478a15 ff152c445500        call    dword ptr [0055442c] -> MSVCRT.DLL!free
 0167:00478a1b 59                  pop     ecx
 0167:00478a1c c3                  retd
 0167:00478a1d 90                  nop
 0167:00478a1e 90                  nop
 0167:00478a1f 90                  nop

--------------------


007df6f0 00000004
007df6f4 004381fc = TCLKIT.EXE:.text+0x371fc
                 
--------------------

 0167:004381eb 90                  nop
 0167:004381ec 90                  nop
 0167:004381ed 90                  nop
 0167:004381ee 90                  nop
 0167:004381ef 90                  nop
 0167:004381f0 56                  push    esi
 0167:004381f1 57                  push    edi
 0167:004381f2 8b7c240c            mov     edi,dword ptr [esp+0c]
 0167:004381f6 57                  push    edi
 0167:004381f7 e804080400          call    00478a00 = TCLKIT.EXE:.text+0x77a00
TCLKIT.EXE:.text+0x371fc:
*0167:004381fc 8bf0                mov     esi,eax
 0167:004381fe 83c404              add     esp,+04
 0167:00438201 85f6                test    esi,esi
 0167:00438203 7512                jnz     00438217 = TCLKIT.EXE:.text+0x37217
 0167:00438205 85ff                test    edi,edi
 0167:00438207 740e                jz      00438217 = TCLKIT.EXE:.text+0x37217
 0167:00438209 57                  push    edi
 0167:0043820a 6818e35500          push    0055e318
 0167:0043820f e80c0b0100          call    00448d20 = TCLKIT.EXE:.text+0x47d20
 0167:00438214 83c408              add     esp,+08
 0167:00438217 8bc6                mov     eax,esi

--------------------


007df6f8 00000004
007df6fc 00000000
007df700 007df750 -> 00 3a 2f 00 c0 85 9f 00 c8 f8 7d 00 cf 38 45 00 .:/.......}..8E.
007df704 00437379 = TCLKIT.EXE:.text+0x36379
                 
--------------------

 0167:00437366 5f                  pop     edi
 0167:00437367 895504              mov     dword ptr [ebp+04],edx
 0167:0043736a 8bc5                mov     eax,ebp
 0167:0043736c 5e                  pop     esi
 0167:0043736d 5d                  pop     ebp
 0167:0043736e 5b                  pop     ebx
 0167:0043736f c3                  retd
 0167:00437370 8d4301              lea     eax,[ebx+01]
 0167:00437373 50                  push    eax
 0167:00437374 e8770e0000          call    004381f0 = TCLKIT.EXE:.text+0x371f0
TCLKIT.EXE:.text+0x36379:
*0167:00437379 8bcb                mov     ecx,ebx
 0167:0043737b 8bf8                mov     edi,eax
 0167:0043737d 8bd1                mov     edx,ecx
 0167:0043737f 894504              mov     dword ptr [ebp+04],eax
 0167:00437382 c1e902              shr     ecx,02
 0167:00437385 f3a5                 rep movs  dword ptr es:[edi],dword ptr ds:[esi]
 0167:00437387 8bca                mov     ecx,edx
 0167:00437389 83c404              add     esp,+04
 0167:0043738c 83e103              and     ecx,+03
 0167:0043738f f3a4                 rep movs  byte ptr es:[edi],byte ptr ds:[esi]
 0167:00437391 8b4504              mov     eax,dword ptr [ebp+04]

--------------------


007df708 00000004
007df70c 00a01190 -> 43 3a 2f 57 49 4e 44 4f 57 53 2f 54 45 4d 50 2f C:/WINDOWS/TEMP/
007df710 007df88c -> 20 00 8f 00 ff ff ff ff 90 11 a0 00 28 fe 7d 00  ...........(.}.
007df714 00000001
007df718 00a01190 -> 43 3a 2f 57 49 4e 44 4f 57 53 2f 54 45 4d 50 2f C:/WINDOWS/TEMP/
007df71c 007df88c -> 20 00 8f 00 ff ff ff ff 90 11 a0 00 28 fe 7d 00  ...........(.}.
007df720 004538cf = TCLKIT.EXE:.text+0x528cf
                 
--------------------

 0167:004538b5 50                  push    eax
 0167:004538b6 e8453afeff          call    00437300 = TCLKIT.EXE:.text+0x36300
 0167:004538bb 8906                mov     dword ptr [esi],eax
 0167:004538bd 8b08                mov     ecx,dword ptr [eax]
 0167:004538bf 83c408              add     esp,+08
 0167:004538c2 41                  inc     ecx
 0167:004538c3 8908                mov     dword ptr [eax],ecx
 0167:004538c5 8d4c241c            lea     ecx,[esp+1c]
 0167:004538c9 51                  push    ecx
 0167:004538ca e8b16dfeff          call    0043a680 = TCLKIT.EXE:.text+0x39680
TCLKIT.EXE:.text+0x528cf:
*0167:004538cf 8b442410            mov     eax,dword ptr [esp+10]
 0167:004538d3 83c404              add     esp,+04
 0167:004538d6 5f                  pop     edi
 0167:004538d7 5e                  pop     esi
 0167:004538d8 5b                  pop     ebx
 0167:004538d9 81c4e4000000        add     esp,000000e4
 0167:004538df c3                  retd
 0167:004538e0 3c3a                cmp     al,3a
 0167:004538e2 0f847f010000        jz      00453a67 = TCLKIT.EXE:.text+0x52a67
 0167:004538e8 6a08                push    +08
 0167:004538ea 6828915900          push    00599128

--------------------


007df724 007df744 -> 50 f7 7d 00 00 00 00 00 c8 00 00 00 00 3a 2f 00 P.}..........:/.
007df728 00000000
007df72c 00a01190 -> 43 3a 2f 57 49 4e 44 4f 57 53 2f 54 45 4d 50 2f C:/WINDOWS/TEMP/
     ...
007df734 00000000
     ...
007df73c 007df78c -> 1c 00 00 00 70 11 a0 00 78 e8 86 00 a4 f7 7d 00 ....p...x.....}.
007df740 0000001b
007df744 007df750 -> 00 3a 2f 00 c0 85 9f 00 c8 f8 7d 00 cf 38 45 00 .:/.......}..8E.
007df748 00000000
007df74c 000000c8
007df750 002f3a00
007df754 009f85c0 -> 43 3a 5c 57 49 4e 44 4f 57 53 5c 54 45 4d 50 5c C:\WINDOWS\TEMP\
007df758 007df8c8 -> 1c f9 7d 00 8e 1b 01 78 09 00 00 00 f3 1a 01 78 ..}....x.......x
007df75c 004538cf = TCLKIT.EXE:.text+0x528cf
                 
--------------------

 0167:004538b5 50                  push    eax
 0167:004538b6 e8453afeff          call    00437300 = TCLKIT.EXE:.text+0x36300
 0167:004538bb 8906                mov     dword ptr [esi],eax
 0167:004538bd 8b08                mov     ecx,dword ptr [eax]
 0167:004538bf 83c408              add     esp,+08
 0167:004538c2 41                  inc     ecx
 0167:004538c3 8908                mov     dword ptr [eax],ecx
 0167:004538c5 8d4c241c            lea     ecx,[esp+1c]
 0167:004538c9 51                  push    ecx
 0167:004538ca e8b16dfeff          call    0043a680 = TCLKIT.EXE:.text+0x39680
TCLKIT.EXE:.text+0x528cf:
*0167:004538cf 8b442410            mov     eax,dword ptr [esp+10]
 0167:004538d3 83c404              add     esp,+04
 0167:004538d6 5f                  pop     edi
 0167:004538d7 5e                  pop     esi
 0167:004538d8 5b                  pop     ebx
 0167:004538d9 81c4e4000000        add     esp,000000e4
 0167:004538df c3                  retd
 0167:004538e0 3c3a                cmp     al,3a
 0167:004538e2 0f847f010000        jz      00453a67 = TCLKIT.EXE:.text+0x52a67
 0167:004538e8 6a08                push    +08
 0167:004538ea 6828915900          push    00599128

--------------------


007df760 007df780 -> 8c f7 7d 00 00 00 00 00 00 00 00 00 1c 00 00 00 ..}.............
007df764 00000000
007df768 009f85c0 -> 43 3a 5c 57 49 4e 44 4f 57 53 5c 54 45 4d 50 5c C:\WINDOWS\TEMP\
     ...
007df770 00000000
007df774 ffffffff
007df778 007dfe28 -> 68 ff 7d 00 a2 33 55 00 e0 71 55 00 00 00 00 00 h.}..3U..qU.....
007df77c 0000001b
007df780 007df78c -> 1c 00 00 00 70 11 a0 00 78 e8 86 00 a4 f7 7d 00 ....p...x.....}.
007df784 00000000
     ...
007df78c 0000001c
007df790 00a01170 -> e4 1d 84 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
007df794 0086e878 -> 12 00 00 00 78 e8 86 00 78 e8 86 00 bc 10 a0 00 ....x...x.......
007df798 007df7a4 -> 00 00 00 00 b1 12 00 78 18 71 03 78 04 f8 7d 00 .......x.q.x..}.
007df79c 00000000
007df7a0 000000c8
007df7a4 00000000
007df7a8 780012b1 = MSVCRT.DLL:.text+0x2b1
                 
--------------------

 0167:7800128d 8816                mov     byte ptr [esi],dl
 0167:7800128f 8d4608              lea     eax,[esi+08]
 0167:78001292 e91fffffff          jmp     780011b6 = MSVCRT.DLL:.text+0x1b6
 0167:78001297 33c0                xor     eax,eax
 0167:78001299 e920ffffff          jmp     780011be = MSVCRT.DLL:.text+0x1be
 0167:7800129e 55                  push    ebp
 0167:7800129f 8bec                mov     ebp,esp
 0167:780012a1 8b4508              mov     eax,dword ptr [ebp+08]
 0167:780012a4 ff348528700378      push    dword ptr [eax*4+78037028]
 0167:780012ab ff1548e00278        call    dword ptr [7802e048] -> KERNEL32.DLL!LeaveCriticalSection
MSVCRT.DLL:.text+0x2b1:
*0167:780012b1 5d                  pop     ebp
 0167:780012b2 c3                  retd
 0167:780012b3 ff3550710378        push    dword ptr [78037150]
 0167:780012b9 ff742408            push    dword ptr [esp+08]
 0167:780012bd e803000000          call    780012c5 = MSVCRT.DLL:.text+0x2c5
 0167:780012c2 59                  pop     ecx
 0167:780012c3 59                  pop     ecx
 0167:780012c4 c3                  retd
 0167:780012c5 837c2404e0          cmp     dword ptr [esp+04],-20
 0167:780012ca 0f878bb90000        ja      7800cc5b = MSVCRT.DLL:.text+0xbc5b
 0167:780012d0 ff742404            push    dword ptr [esp+04]

--------------------


007df7ac 78037118 = MSVCRT.DLL:.data+0x2118
                  -> 04 00 00 00 2c 3f 62 81 00 00 00 00 00 00 00 00 ....,?b.........
007df7b0 007df804 -> 1b 00 00 00 30 8a 47 00 70 11 a0 00 1c 00 00 00 ....0.G.p.......
007df7b4 78011b8e = MSVCRT.DLL:.text+0x10b8e
                 
--------------------

 0167:78011b6e 53                  push    ebx
 0167:78011b6f ff75d8              push    dword ptr [ebp-28]
 0167:78011b72 e89eb4ffff          call    7800d015 = MSVCRT.DLL:.text+0xc015
 0167:78011b77 83c414              add     esp,+14
 0167:78011b7a e91bffffff          jmp     78011a9a = MSVCRT.DLL:.text+0x10a9a
 0167:78011b7f 8b750c              mov     esi,dword ptr [ebp+0c]
 0167:78011b82 8b5d08              mov     ebx,dword ptr [ebp+08]
 0167:78011b85 33ff                xor     edi,edi
 0167:78011b87 6a09                push    +09
 0167:78011b89 e810f7feff          call    7800129e = MSVCRT.DLL!_unlock
MSVCRT.DLL:.text+0x10b8e:
*0167:78011b8e 59                  pop     ecx
 0167:78011b8f c3                  retd
 0167:78011b90 6a10                push    +10
 0167:78011b92 5e                  pop     esi
 0167:78011b93 e9befefeff          jmp     78001a56 = MSVCRT.DLL:.text+0xa56
 0167:78011b98 56                  push    esi
 0167:78011b99 6a00                push    +00
 0167:78011b9b ff3500500378        push    dword ptr [78035000]
 0167:78011ba1 ff1594e00278        call    dword ptr [7802e094] -> KERNEL32.DLL!HeapAlloc
 0167:78011ba7 8945dc              mov     dword ptr [ebp-24],eax
 0167:78011baa 85c0                test    eax,eax

--------------------


007df7b8 00000009
007df7bc 78011af3 = MSVCRT.DLL:.text+0x10af3
                 
--------------------

 0167:78011acf c672028b            mov     byte ptr [edx+02],8b
 0167:78011ad3 c65053ff            mov     byte ptr [eax+53],ff
 0167:78011ad7 75dc                jnz     78011ab5 = MSVCRT.DLL:.text+0x10ab5
 0167:78011ad9 e830fbfeff          call    7800160e = MSVCRT.DLL!memcpy
 0167:78011ade 53                  push    ebx
 0167:78011adf ff75d8              push    dword ptr [ebp-28]
 0167:78011ae2 e82eb5ffff          call    7800d015 = MSVCRT.DLL:.text+0xc015
 0167:78011ae7 83c414              add     esp,+14
 0167:78011aea 834dfcff            or      dword ptr [ebp-04],-01
 0167:78011aee e894000000          call    78011b87 = MSVCRT.DLL:.text+0x10b87
MSVCRT.DLL:.text+0x10af3:
*0167:78011af3 397dd8              cmp     dword ptr [ebp-28],edi
 0167:78011af6 7522                jnz     78011b1a = MSVCRT.DLL:.text+0x10b1a
 0167:78011af8 3bf7                cmp     esi,edi
 0167:78011afa 7503                jnz     78011aff = MSVCRT.DLL:.text+0x10aff
 0167:78011afc 6a01                push    +01
 0167:78011afe 5e                  pop     esi
 0167:78011aff 83c60f              add     esi,+0f
 0167:78011b02 83e6f0              and     esi,-10
 0167:78011b05 89750c              mov     dword ptr [ebp+0c],esi
 0167:78011b08 56                  push    esi
 0167:78011b09 53                  push    ebx

--------------------


007df7c0 0000001c
007df7c4 00a01193 -> 57 49 4e 44 4f 57 53 2f 54 45 4d 50 2f 54 43 4c WINDOWS/TEMP/TCL
007df7c8 00841de4 -> 01 00 00 00 20 11 a0 00 1b 00 00 00 10 e2 55 00 .... .........U.
     ...
007df7d4 00a01150 -> ff ff ff ff 1b 00 00 00 00 00 00 00 60 00 00 00 ............`...
007df7d8 81623f2c -> 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
007df7dc 008f0020 -> 00 00 00 44 01 00 80 10 ff ff ff 3f 00 00 a0 00 ...D.......?....
007df7e0 00a01120 -> 43 3a 2f 57 49 4e 44 4f 57 53 2f 54 45 4d 50 2f C:/WINDOWS/TEMP/
007df7e4 00000010
007df7e8 7802e248 = MSVCRT.DLL:.rdata+0x248
                  -> ff ff ff ff 00 00 00 00 ac cc 00 78 ff ff ff ff ...........x....
007df7ec ffffffff
007df7f0 00000000
007df7f4 007dfe28 -> 68 ff 7d 00 a2 33 55 00 e0 71 55 00 00 00 00 00 h.}..3U..qU.....
007df7f8 7800ef03 = MSVCRT.DLL!_except_handler3
                  -> 55 8b ec 83 ec 08 53 56 57 55 fc 8b 5d 0c 8b 45 U.....SVWU..]..E
007df7fc 7802e2d8 = MSVCRT.DLL:.rdata+0x2d8
                  -> ff ff ff ff 00 00 00 00 7f 1b 01 78 ff ff ff ff ...........x....
007df800 ffffffff
007df804 0000001b
007df808 00478a30 = TCLKIT.EXE:.text+0x77a30
                 
--------------------

 0167:00478a1b 59                  pop     ecx
 0167:00478a1c c3                  retd
 0167:00478a1d 90                  nop
 0167:00478a1e 90                  nop
 0167:00478a1f 90                  nop
 0167:00478a20 8b442408            mov     eax,dword ptr [esp+08]
 0167:00478a24 8b4c2404            mov     ecx,dword ptr [esp+04]
 0167:00478a28 50                  push    eax
 0167:00478a29 51                  push    ecx
 0167:00478a2a ff1530445500        call    dword ptr [00554430] -> MSVCRT.DLL!realloc
TCLKIT.EXE:.text+0x77a30:
*0167:00478a30 83c408              add     esp,+08
 0167:00478a33 c3                  retd
 0167:00478a34 90                  nop
 0167:00478a35 90                  nop
 0167:00478a36 90                  nop
 0167:00478a37 90                  nop
 0167:00478a38 90                  nop
 0167:00478a39 90                  nop
 0167:00478a3a 90                  nop
 0167:00478a3b 90                  nop
 0167:00478a3c 90                  nop

--------------------


007df80c 00a01170 -> e4 1d 84 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
007df810 0000001c
007df814 00438291 = TCLKIT.EXE:.text+0x37291
                 
--------------------

 0167:0043827d c3                  retd
 0167:0043827e 90                  nop
 0167:0043827f 90                  nop
 0167:00438280 8b442404            mov     eax,dword ptr [esp+04]
 0167:00438284 56                  push    esi
 0167:00438285 57                  push    edi
 0167:00438286 8b7c2410            mov     edi,dword ptr [esp+10]
 0167:0043828a 57                  push    edi
 0167:0043828b 50                  push    eax
 0167:0043828c e88f070400          call    00478a20 = TCLKIT.EXE:.text+0x77a20
TCLKIT.EXE:.text+0x37291:
*0167:00438291 8bf0                mov     esi,eax
 0167:00438293 83c408              add     esp,+08
 0167:00438296 85f6                test    esi,esi
 0167:00438298 7512                jnz     004382ac = TCLKIT.EXE:.text+0x372ac
 0167:0043829a 85ff                test    edi,edi
 0167:0043829c 740e                jz      004382ac = TCLKIT.EXE:.text+0x372ac
 0167:0043829e 57                  push    edi
 0167:0043829f 685ce35500          push    0055e35c
 0167:004382a4 e8770a0100          call    00448d20 = TCLKIT.EXE:.text+0x47d20
 0167:004382a9 83c408              add     esp,+08
 0167:004382ac 8bc6                mov     eax,esi

--------------------


007df818 00a011e0 -> 88 e8 86 00 88 e8 86 00 21 00 00 00 11 00 00 00 ........!.......
     ...
007df820 bff7b9c5 = KERNEL32.DLL:.text+0x29c5
                 
--------------------

 0167:bff7b9a9 e81389ffff          call    bff742c1 = KERNEL32.DLL:_FREQASM+0x32c1
 0167:bff7b9ae 5e                  pop     esi
 0167:bff7b9af c20400              retd    0004
 0167:bff7b9b2 56                  push    esi
 0167:bff7b9b3 8b742408            mov     esi,dword ptr [esp+08]
 0167:bff7b9b7 8a06                mov     al,byte ptr [esi]
 0167:bff7b9b9 3c04                cmp     al,04
 0167:bff7b9bb 7508                jnz     bff7b9c5 = KERNEL32.DLL:.text+0x29c5
 0167:bff7b9bd ff7604              push    dword ptr [esi+04]
 0167:bff7b9c0 e82989ffff          call    bff742ee = KERNEL32.DLL:_FREQASM+0x32ee
KERNEL32.DLL:.text+0x29c5:
*0167:bff7b9c5 5e                  pop     esi
 0167:bff7b9c6 c20400              retd    0004
 0167:bff7b9c9 64a100000000        mov     eax,dword ptr fs:[00000000]
 0167:bff7b9cf 55                  push    ebp
 0167:bff7b9d0 8bec                mov     ebp,esp
 0167:bff7b9d2 6aff                push    -01
 0167:bff7b9d4 685092f7bf          push    bff79250
 0167:bff7b9d9 68b405fcbf          push    bffc05b4
 0167:bff7b9de 50                  push    eax
 0167:bff7b9df 8b4508              mov     eax,dword ptr [ebp+08]
 0167:bff7b9e2 64892500000000      mov     dword ptr fs:[00000000],esp

--------------------


007df824 81623f2c -> 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
007df828 00a011e0 -> 88 e8 86 00 88 e8 86 00 21 00 00 00 11 00 00 00 ........!.......
007df82c 780012b1 = MSVCRT.DLL:.text+0x2b1
                 
--------------------

 0167:7800128d 8816                mov     byte ptr [esi],dl
 0167:7800128f 8d4608              lea     eax,[esi+08]
 0167:78001292 e91fffffff          jmp     780011b6 = MSVCRT.DLL:.text+0x1b6
 0167:78001297 33c0                xor     eax,eax
 0167:78001299 e920ffffff          jmp     780011be = MSVCRT.DLL:.text+0x1be
 0167:7800129e 55                  push    ebp
 0167:7800129f 8bec                mov     ebp,esp
 0167:780012a1 8b4508              mov     eax,dword ptr [ebp+08]
 0167:780012a4 ff348528700378      push    dword ptr [eax*4+78037028]
 0167:780012ab ff1548e00278        call    dword ptr [7802e048] -> KERNEL32.DLL!LeaveCriticalSection
MSVCRT.DLL:.text+0x2b1:
*0167:780012b1 5d                  pop     ebp
 0167:780012b2 c3                  retd
 0167:780012b3 ff3550710378        push    dword ptr [78037150]
 0167:780012b9 ff742408            push    dword ptr [esp+08]
 0167:780012bd e803000000          call    780012c5 = MSVCRT.DLL:.text+0x2c5
 0167:780012c2 59                  pop     ecx
 0167:780012c3 59                  pop     ecx
 0167:780012c4 c3                  retd
 0167:780012c5 837c2404e0          cmp     dword ptr [esp+04],-20
 0167:780012ca 0f878bb90000        ja      7800cc5b = MSVCRT.DLL:.text+0xbc5b
 0167:780012d0 ff742404            push    dword ptr [esp+04]

--------------------


007df830 78037118 = MSVCRT.DLL:.data+0x2118
                  -> 04 00 00 00 2c 3f 62 81 00 00 00 00 00 00 00 00 ....,?b.........
007df834 007df878 -> 70 11 a0 00 01 00 00 00 e0 11 a0 00 28 fe 7d 00 p...........(.}.
007df838 7800cc37 = MSVCRT.DLL:.text+0xbc37
                 
--------------------

 0167:7800cc16 50                  push    eax
 0167:7800cc17 e8f9030000          call    7800d015 = MSVCRT.DLL:.text+0xc015
 0167:7800cc1c 59                  pop     ecx
 0167:7800cc1d 59                  pop     ecx
 0167:7800cc1e 834dfcff            or      dword ptr [ebp-04],-01
 0167:7800cc22 e809000000          call    7800cc30 = MSVCRT.DLL:.text+0xbc30
 0167:7800cc27 837de400            cmp     dword ptr [ebp-1c],+00
 0167:7800cc2b e9e447ffff          jmp     78001414 = MSVCRT.DLL:.text+0x414
 0167:7800cc30 6a09                push    +09
 0167:7800cc32 e86746ffff          call    7800129e = MSVCRT.DLL!_unlock
MSVCRT.DLL:.text+0xbc37:
*0167:7800cc37 59                  pop     ecx
 0167:7800cc38 c3                  retd
 0167:7800cc39 56                  push    esi
 0167:7800cc3a e9e947ffff          jmp     78001428 = MSVCRT.DLL:.text+0x428
 0167:7800cc3f 39442408            cmp     dword ptr [esp+08],eax
 0167:7800cc43 0f849946ffff        jz      780012e2 = MSVCRT.DLL:.text+0x2e2
 0167:7800cc49 ff742404            push    dword ptr [esp+04]
 0167:7800cc4d e8be8cffff          call    78005910 = MSVCRT.DLL!_callnewh
 0167:7800cc52 85c0                test    eax,eax
 0167:7800cc54 59                  pop     ecx
 0167:7800cc55 0f857546ffff        jnz     780012d0 = MSVCRT.DLL:.text+0x2d0

--------------------


007df83c 00000009
007df840 00000018
     ...
007df848 0081794c -> 01 00 00 00 90 11 a0 00 1b 00 00 00 d0 ef 55 00 ..............U.
007df84c 00a011c0 -> 57 49 4e 44 4f 57 53 00 11 00 00 00 21 00 00 00 WINDOWS.....!...
007df850 bff7b9c5 = KERNEL32.DLL:.text+0x29c5
                 
--------------------

 0167:bff7b9a9 e81389ffff          call    bff742c1 = KERNEL32.DLL:_FREQASM+0x32c1
 0167:bff7b9ae 5e                  pop     esi
 0167:bff7b9af c20400              retd    0004
 0167:bff7b9b2 56                  push    esi
 0167:bff7b9b3 8b742408            mov     esi,dword ptr [esp+08]
 0167:bff7b9b7 8a06                mov     al,byte ptr [esi]
 0167:bff7b9b9 3c04                cmp     al,04
 0167:bff7b9bb 7508                jnz     bff7b9c5 = KERNEL32.DLL:.text+0x29c5
 0167:bff7b9bd ff7604              push    dword ptr [esi+04]
 0167:bff7b9c0 e82989ffff          call    bff742ee = KERNEL32.DLL:_FREQASM+0x32ee
KERNEL32.DLL:.text+0x29c5:
*0167:bff7b9c5 5e                  pop     esi
 0167:bff7b9c6 c20400              retd    0004
 0167:bff7b9c9 64a100000000        mov     eax,dword ptr fs:[00000000]
 0167:bff7b9cf 55                  push    ebp
 0167:bff7b9d0 8bec                mov     ebp,esp
 0167:bff7b9d2 6aff                push    -01
 0167:bff7b9d4 685092f7bf          push    bff79250
 0167:bff7b9d9 68b405fcbf          push    bffc05b4
 0167:bff7b9de 50                  push    eax
 0167:bff7b9df 8b4508              mov     eax,dword ptr [ebp+08]
 0167:bff7b9e2 64892500000000      mov     dword ptr fs:[00000000],esp

--------------------


007df854 81623f2c -> 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
007df858 00a011c0 -> 57 49 4e 44 4f 57 53 00 11 00 00 00 21 00 00 00 WINDOWS.....!...
007df85c 780012b1 = MSVCRT.DLL:.text+0x2b1
                 
--------------------

 0167:7800128d 8816                mov     byte ptr [esi],dl
 0167:7800128f 8d4608              lea     eax,[esi+08]
 0167:78001292 e91fffffff          jmp     780011b6 = MSVCRT.DLL:.text+0x1b6
 0167:78001297 33c0                xor     eax,eax
 0167:78001299 e920ffffff          jmp     780011be = MSVCRT.DLL:.text+0x1be
 0167:7800129e 55                  push    ebp
 0167:7800129f 8bec                mov     ebp,esp
 0167:780012a1 8b4508              mov     eax,dword ptr [ebp+08]
 0167:780012a4 ff348528700378      push    dword ptr [eax*4+78037028]
 0167:780012ab ff1548e00278        call    dword ptr [7802e048] -> KERNEL32.DLL!LeaveCriticalSection
MSVCRT.DLL:.text+0x2b1:
*0167:780012b1 5d                  pop     ebp
 0167:780012b2 c3                  retd
 0167:780012b3 ff3550710378        push    dword ptr [78037150]
 0167:780012b9 ff742408            push    dword ptr [esp+08]
 0167:780012bd e803000000          call    780012c5 = MSVCRT.DLL:.text+0x2c5
 0167:780012c2 59                  pop     ecx
 0167:780012c3 59                  pop     ecx
 0167:780012c4 c3                  retd
 0167:780012c5 837c2404e0          cmp     dword ptr [esp+04],-20
 0167:780012ca 0f878bb90000        ja      7800cc5b = MSVCRT.DLL:.text+0xbc5b
 0167:780012d0 ff742404            push    dword ptr [esp+04]

--------------------


007df860 78037118 = MSVCRT.DLL:.data+0x2118
                  -> 04 00 00 00 2c 3f 62 81 00 00 00 00 00 00 00 00 ....,?b.........
007df864 007df8a8 -> 01 00 00 00 00 00 00 00 17 00 00 00 c5 b9 f7 bf ................
007df868 7800cc37 = MSVCRT.DLL:.text+0xbc37
                 
--------------------

 0167:7800cc16 50                  push    eax
 0167:7800cc17 e8f9030000          call    7800d015 = MSVCRT.DLL:.text+0xc015
 0167:7800cc1c 59                  pop     ecx
 0167:7800cc1d 59                  pop     ecx
 0167:7800cc1e 834dfcff            or      dword ptr [ebp-04],-01
 0167:7800cc22 e809000000          call    7800cc30 = MSVCRT.DLL:.text+0xbc30
 0167:7800cc27 837de400            cmp     dword ptr [ebp-1c],+00
 0167:7800cc2b e9e447ffff          jmp     78001414 = MSVCRT.DLL:.text+0x414
 0167:7800cc30 6a09                push    +09
 0167:7800cc32 e86746ffff          call    7800129e = MSVCRT.DLL!_unlock
MSVCRT.DLL:.text+0xbc37:
*0167:7800cc37 59                  pop     ecx
 0167:7800cc38 c3                  retd
 0167:7800cc39 56                  push    esi
 0167:7800cc3a e9e947ffff          jmp     78001428 = MSVCRT.DLL:.text+0x428
 0167:7800cc3f 39442408            cmp     dword ptr [esp+08],eax
 0167:7800cc43 0f849946ffff        jz      780012e2 = MSVCRT.DLL:.text+0x2e2
 0167:7800cc49 ff742404            push    dword ptr [esp+04]
 0167:7800cc4d e8be8cffff          call    78005910 = MSVCRT.DLL!_callnewh
 0167:7800cc52 85c0                test    eax,eax
 0167:7800cc54 59                  pop     ecx
 0167:7800cc55 0f857546ffff        jnz     780012d0 = MSVCRT.DLL:.text+0x2d0

--------------------


007df86c 00000009
007df870 7800cc27 = MSVCRT.DLL:.text+0xbc27
                 
--------------------

 0167:7800cc0e 8945e4              mov     dword ptr [ebp-1c],eax
 0167:7800cc11 85c0                test    eax,eax
 0167:7800cc13 7409                jz      7800cc1e = MSVCRT.DLL:.text+0xbc1e
 0167:7800cc15 56                  push    esi
 0167:7800cc16 50                  push    eax
 0167:7800cc17 e8f9030000          call    7800d015 = MSVCRT.DLL:.text+0xc015
 0167:7800cc1c 59                  pop     ecx
 0167:7800cc1d 59                  pop     ecx
 0167:7800cc1e 834dfcff            or      dword ptr [ebp-04],-01
 0167:7800cc22 e809000000          call    7800cc30 = MSVCRT.DLL:.text+0xbc30
MSVCRT.DLL:.text+0xbc27:
*0167:7800cc27 837de400            cmp     dword ptr [ebp-1c],+00
 0167:7800cc2b e9e447ffff          jmp     78001414 = MSVCRT.DLL:.text+0x414
 0167:7800cc30 6a09                push    +09
 0167:7800cc32 e86746ffff          call    7800129e = MSVCRT.DLL!_unlock
 0167:7800cc37 59                  pop     ecx
 0167:7800cc38 c3                  retd
 0167:7800cc39 56                  push    esi
 0167:7800cc3a e9e947ffff          jmp     78001428 = MSVCRT.DLL:.text+0x428
 0167:7800cc3f 39442408            cmp     dword ptr [esp+08],eax
 0167:7800cc43 0f849946ffff        jz      780012e2 = MSVCRT.DLL:.text+0x2e2
 0167:7800cc49 ff742404            push    dword ptr [esp+04]

--------------------


007df874 0081794c -> 01 00 00 00 90 11 a0 00 1b 00 00 00 d0 ef 55 00 ..............U.
007df878 00a01170 -> e4 1d 84 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
007df87c 00000001
007df880 00a011e0 -> 88 e8 86 00 88 e8 86 00 21 00 00 00 11 00 00 00 ........!.......
007df884 007dfe28 -> 68 ff 7d 00 a2 33 55 00 e0 71 55 00 00 00 00 00 h.}..3U..qU.....
007df888 7800ef03 = MSVCRT.DLL!_except_handler3
                  -> 55 8b ec 83 ec 08 53 56 57 55 fc 8b 5d 0c 8b 45 U.....SVWU..]..E
007df88c 008f0020 -> 00 00 00 44 01 00 80 10 ff ff ff 3f 00 00 a0 00 ...D.......?....
007df890 ffffffff
007df894 00a01190 -> 43 3a 2f 57 49 4e 44 4f 57 53 2f 54 45 4d 50 2f C:/WINDOWS/TEMP/
007df898 007dfe28 -> 68 ff 7d 00 a2 33 55 00 e0 71 55 00 00 00 00 00 h.}..3U..qU.....
007df89c 00000004
     ...
007df8a4 bff7b9c5 = KERNEL32.DLL:.text+0x29c5
                 
--------------------

 0167:bff7b9a9 e81389ffff          call    bff742c1 = KERNEL32.DLL:_FREQASM+0x32c1
 0167:bff7b9ae 5e                  pop     esi
 0167:bff7b9af c20400              retd    0004
 0167:bff7b9b2 56                  push    esi
 0167:bff7b9b3 8b742408            mov     esi,dword ptr [esp+08]
 0167:bff7b9b7 8a06                mov     al,byte ptr [esi]
 0167:bff7b9b9 3c04                cmp     al,04
 0167:bff7b9bb 7508                jnz     bff7b9c5 = KERNEL32.DLL:.text+0x29c5
 0167:bff7b9bd ff7604              push    dword ptr [esi+04]
 0167:bff7b9c0 e82989ffff          call    bff742ee = KERNEL32.DLL:_FREQASM+0x32ee
KERNEL32.DLL:.text+0x29c5:
*0167:bff7b9c5 5e                  pop     esi
 0167:bff7b9c6 c20400              retd    0004
 0167:bff7b9c9 64a100000000        mov     eax,dword ptr fs:[00000000]
 0167:bff7b9cf 55                  push    ebp
 0167:bff7b9d0 8bec                mov     ebp,esp
 0167:bff7b9d2 6aff                push    -01
 0167:bff7b9d4 685092f7bf          push    bff79250
 0167:bff7b9d9 68b405fcbf          push    bffc05b4
 0167:bff7b9de 50                  push    eax
 0167:bff7b9df 8b4508              mov     eax,dword ptr [ebp+08]
 0167:bff7b9e2 64892500000000      mov     dword ptr fs:[00000000],esp

--------------------


007df8a8 00000001
007df8ac 00000000
007df8b0 00000017
007df8b4 bff7b9c5 = KERNEL32.DLL:.text+0x29c5
                 
--------------------

 0167:bff7b9a9 e81389ffff          call    bff742c1 = KERNEL32.DLL:_FREQASM+0x32c1
 0167:bff7b9ae 5e                  pop     esi
 0167:bff7b9af c20400              retd    0004
 0167:bff7b9b2 56                  push    esi
 0167:bff7b9b3 8b742408            mov     esi,dword ptr [esp+08]
 0167:bff7b9b7 8a06                mov     al,byte ptr [esi]
 0167:bff7b9b9 3c04                cmp     al,04
 0167:bff7b9bb 7508                jnz     bff7b9c5 = KERNEL32.DLL:.text+0x29c5
 0167:bff7b9bd ff7604              push    dword ptr [esi+04]
 0167:bff7b9c0 e82989ffff          call    bff742ee = KERNEL32.DLL:_FREQASM+0x32ee
KERNEL32.DLL:.text+0x29c5:
*0167:bff7b9c5 5e                  pop     esi
 0167:bff7b9c6 c20400              retd    0004
 0167:bff7b9c9 64a100000000        mov     eax,dword ptr fs:[00000000]
 0167:bff7b9cf 55                  push    ebp
 0167:bff7b9d0 8bec                mov     ebp,esp
 0167:bff7b9d2 6aff                push    -01
 0167:bff7b9d4 685092f7bf          push    bff79250
 0167:bff7b9d9 68b405fcbf          push    bffc05b4
 0167:bff7b9de 50                  push    eax
 0167:bff7b9df 8b4508              mov     eax,dword ptr [ebp+08]
 0167:bff7b9e2 64892500000000      mov     dword ptr fs:[00000000],esp

--------------------


007df8b8 81623f2c -> 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
007df8bc 00000017
007df8c0 780012b1 = MSVCRT.DLL:.text+0x2b1
                 
--------------------

 0167:7800128d 8816                mov     byte ptr [esi],dl
 0167:7800128f 8d4608              lea     eax,[esi+08]
 0167:78001292 e91fffffff          jmp     780011b6 = MSVCRT.DLL:.text+0x1b6
 0167:78001297 33c0                xor     eax,eax
 0167:78001299 e920ffffff          jmp     780011be = MSVCRT.DLL:.text+0x1be
 0167:7800129e 55                  push    ebp
 0167:7800129f 8bec                mov     ebp,esp
 0167:780012a1 8b4508              mov     eax,dword ptr [ebp+08]
 0167:780012a4 ff348528700378      push    dword ptr [eax*4+78037028]
 0167:780012ab ff1548e00278        call    dword ptr [7802e048] -> KERNEL32.DLL!LeaveCriticalSection
MSVCRT.DLL:.text+0x2b1:
*0167:780012b1 5d                  pop     ebp
 0167:780012b2 c3                  retd
 0167:780012b3 ff3550710378        push    dword ptr [78037150]
 0167:780012b9 ff742408            push    dword ptr [esp+08]
 0167:780012bd e803000000          call    780012c5 = MSVCRT.DLL:.text+0x2c5
 0167:780012c2 59                  pop     ecx
 0167:780012c3 59                  pop     ecx
 0167:780012c4 c3                  retd
 0167:780012c5 837c2404e0          cmp     dword ptr [esp+04],-20
 0167:780012ca 0f878bb90000        ja      7800cc5b = MSVCRT.DLL:.text+0xbc5b
 0167:780012d0 ff742404            push    dword ptr [esp+04]

--------------------


007df8c4 78037118 = MSVCRT.DLL:.data+0x2118
                  -> 04 00 00 00 2c 3f 62 81 00 00 00 00 00 00 00 00 ....,?b.........
007df8c8 007df91c -> e0 10 a0 00 e0 10 a0 00 01 00 00 00 e0 10 a0 00 ................
007df8cc 78011b8e = MSVCRT.DLL:.text+0x10b8e
                 
--------------------

 0167:78011b6e 53                  push    ebx
 0167:78011b6f ff75d8              push    dword ptr [ebp-28]
 0167:78011b72 e89eb4ffff          call    7800d015 = MSVCRT.DLL:.text+0xc015
 0167:78011b77 83c414              add     esp,+14
 0167:78011b7a e91bffffff          jmp     78011a9a = MSVCRT.DLL:.text+0x10a9a
 0167:78011b7f 8b750c              mov     esi,dword ptr [ebp+0c]
 0167:78011b82 8b5d08              mov     ebx,dword ptr [ebp+08]
 0167:78011b85 33ff                xor     edi,edi
 0167:78011b87 6a09                push    +09
 0167:78011b89 e810f7feff          call    7800129e = MSVCRT.DLL!_unlock
MSVCRT.DLL:.text+0x10b8e:
*0167:78011b8e 59                  pop     ecx
 0167:78011b8f c3                  retd
 0167:78011b90 6a10                push    +10
 0167:78011b92 5e                  pop     esi
 0167:78011b93 e9befefeff          jmp     78001a56 = MSVCRT.DLL:.text+0xa56
 0167:78011b98 56                  push    esi
 0167:78011b99 6a00                push    +00
 0167:78011b9b ff3500500378        push    dword ptr [78035000]
 0167:78011ba1 ff1594e00278        call    dword ptr [7802e094] -> KERNEL32.DLL!HeapAlloc
 0167:78011ba7 8945dc              mov     dword ptr [ebp-24],eax
 0167:78011baa 85c0                test    eax,eax

--------------------


007df8d0 00000009
007df8d4 78011af3 = MSVCRT.DLL:.text+0x10af3
                 
--------------------

 0167:78011acf c672028b            mov     byte ptr [edx+02],8b
 0167:78011ad3 c65053ff            mov     byte ptr [eax+53],ff
 0167:78011ad7 75dc                jnz     78011ab5 = MSVCRT.DLL:.text+0x10ab5
 0167:78011ad9 e830fbfeff          call    7800160e = MSVCRT.DLL!memcpy
 0167:78011ade 53                  push    ebx
 0167:78011adf ff75d8              push    dword ptr [ebp-28]
 0167:78011ae2 e82eb5ffff          call    7800d015 = MSVCRT.DLL:.text+0xc015
 0167:78011ae7 83c414              add     esp,+14
 0167:78011aea 834dfcff            or      dword ptr [ebp-04],-01
 0167:78011aee e894000000          call    78011b87 = MSVCRT.DLL:.text+0x10b87
MSVCRT.DLL:.text+0x10af3:
*0167:78011af3 397dd8              cmp     dword ptr [ebp-28],edi
 0167:78011af6 7522                jnz     78011b1a = MSVCRT.DLL:.text+0x10b1a
 0167:78011af8 3bf7                cmp     esi,edi
 0167:78011afa 7503                jnz     78011aff = MSVCRT.DLL:.text+0x10aff
 0167:78011afc 6a01                push    +01
 0167:78011afe 5e                  pop     esi
 0167:78011aff 83c60f              add     esi,+0f
 0167:78011b02 83e6f0              and     esi,-10
 0167:78011b05 89750c              mov     dword ptr [ebp+0c],esi
 0167:78011b08 56                  push    esi
 0167:78011b09 53                  push    ebx

--------------------


007df8d8 00000016
007df8dc 00a010a0 -> ff ff ff ff 1b 00 00 00 00 00 00 00 60 1a a0 00 ............`...
007df8e0 00814830 -> 01 00 00 00 70 10 a0 00 1b 00 00 00 10 e2 55 00 ....p.........U.
007df8e4 7800ef03 = MSVCRT.DLL!_except_handler3
                  -> 55 8b ec 83 ec 08 53 56 57 55 fc 8b 5d 0c 8b 45 U.....SVWU..]..E
007df8e8 7802e248 = MSVCRT.DLL:.rdata+0x248
                  -> ff ff ff ff 00 00 00 00 ac cc 00 78 ff ff ff ff ...........x....
007df8ec ffffffff
007df8f0 00814818 -> 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 ................
007df8f4 008f0020 -> 00 00 00 44 01 00 80 10 ff ff ff 3f 00 00 a0 00 ...D.......?....
007df8f8 00a010c0 -> 80 e8 86 00 80 e8 86 00 57 53 2f 54 45 4d 50 2f ........WS/TEMP/
007df8fc 780012c2 = MSVCRT.DLL:.text+0x2c2
                 
--------------------

 0167:7800129e 55                  push    ebp
 0167:7800129f 8bec                mov     ebp,esp
 0167:780012a1 8b4508              mov     eax,dword ptr [ebp+08]
 0167:780012a4 ff348528700378      push    dword ptr [eax*4+78037028]
 0167:780012ab ff1548e00278        call    dword ptr [7802e048] -> KERNEL32.DLL!LeaveCriticalSection
 0167:780012b1 5d                  pop     ebp
 0167:780012b2 c3                  retd
 0167:780012b3 ff3550710378        push    dword ptr [78037150]
 0167:780012b9 ff742408            push    dword ptr [esp+08]
 0167:780012bd e803000000          call    780012c5 = MSVCRT.DLL:.text+0x2c5
MSVCRT.DLL:.text+0x2c2:
*0167:780012c2 59                  pop     ecx
 0167:780012c3 59                  pop     ecx
 0167:780012c4 c3                  retd
 0167:780012c5 837c2404e0          cmp     dword ptr [esp+04],-20
 0167:780012ca 0f878bb90000        ja      7800cc5b = MSVCRT.DLL:.text+0xbc5b
 0167:780012d0 ff742404            push    dword ptr [esp+04]
 0167:780012d4 e80a000000          call    780012e3 = MSVCRT.DLL:.text+0x2e3
 0167:780012d9 85c0                test    eax,eax
 0167:780012db 59                  pop     ecx
 0167:780012dc 0f845db90000        jz      7800cc3f = MSVCRT.DLL:.text+0xbc3f
 0167:780012e2 c3                  retd

--------------------


007df900 00000004
007df904 00000000
007df908 00478a0b = TCLKIT.EXE:.text+0x77a0b
                 
--------------------

 0167:004789f9 90                  nop
 0167:004789fa 90                  nop
 0167:004789fb 90                  nop
 0167:004789fc 90                  nop
 0167:004789fd 90                  nop
 0167:004789fe 90                  nop
 0167:004789ff 90                  nop
 0167:00478a00 8b442404            mov     eax,dword ptr [esp+04]
 0167:00478a04 50                  push    eax
 0167:00478a05 ff1534445500        call    dword ptr [00554434] -> MSVCRT.DLL!malloc
TCLKIT.EXE:.text+0x77a0b:
*0167:00478a0b 83c404              add     esp,+04
 0167:00478a0e c3                  retd
 0167:00478a0f 90                  nop
 0167:00478a10 8b442404            mov     eax,dword ptr [esp+04]
 0167:00478a14 50                  push    eax
 0167:00478a15 ff152c445500        call    dword ptr [0055442c] -> MSVCRT.DLL!free
 0167:00478a1b 59                  pop     ecx
 0167:00478a1c c3                  retd
 0167:00478a1d 90                  nop
 0167:00478a1e 90                  nop
 0167:00478a1f 90                  nop

--------------------


007df90c 007dfe28 -> 68 ff 7d 00 a2 33 55 00 e0 71 55 00 00 00 00 00 h.}..3U..qU.....
007df910 7800ef03 = MSVCRT.DLL!_except_handler3
                  -> 55 8b ec 83 ec 08 53 56 57 55 fc 8b 5d 0c 8b 45 U.....SVWU..]..E
007df914 7802e2d8 = MSVCRT.DLL:.rdata+0x2d8
                  -> ff ff ff ff 00 00 00 00 7f 1b 01 78 ff ff ff ff ...........x....
007df918 ffffffff
007df91c 00a010e0 -> 54 43 4c 42 32 45 34 2e 54 4d 50 00 00 00 00 00 TCLB2E4.TMP.....
     ...
007df924 00000001
007df928 00a010e0 -> 54 43 4c 42 32 45 34 2e 54 4d 50 00 00 00 00 00 TCLB2E4.TMP.....
007df92c 0045388b = TCLKIT.EXE:.text+0x5288b
                 
--------------------

 0167:0045386f 8d54241c            lea     edx,[esp+1c]
 0167:00453873 52                  push    edx
 0167:00453874 e8776bfeff          call    0043a3f0 = TCLKIT.EXE:.text+0x393f0
 0167:00453879 8d442410            lea     eax,[esp+10]
 0167:0045387d 8d4c2420            lea     ecx,[esp+20]
 0167:00453881 50                  push    eax
 0167:00453882 6a00                push    +00
 0167:00453884 51                  push    ecx
 0167:00453885 57                  push    edi
 0167:00453886 e835020000          call    00453ac0 = TCLKIT.EXE:.text+0x52ac0
TCLKIT.EXE:.text+0x5288b:
*0167:0045388b 83c414              add     esp,+14
 0167:0045388e 3bc7                cmp     eax,edi
 0167:00453890 7433                jz      004538c5 = TCLKIT.EXE:.text+0x528c5
 0167:00453892 8b8c24f8000000      mov     ecx,dword ptr [esp+000000f8]
 0167:00453899 85c9                test    ecx,ecx
 0167:0045389b 7428                jz      004538c5 = TCLKIT.EXE:.text+0x528c5
 0167:0045389d 8bb424fc000000      mov     esi,dword ptr [esp+000000fc]
 0167:004538a4 2bc7                sub     eax,edi
 0167:004538a6 85f6                test    esi,esi
 0167:004538a8 8901                mov     dword ptr [ecx],eax
 0167:004538aa 7419                jz      004538c5 = TCLKIT.EXE:.text+0x528c5

--------------------


007df930 00a010e0 -> 54 43 4c 42 32 45 34 2e 54 4d 50 00 00 00 00 00 TCLB2E4.TMP.....
     ...
007df93c 004538cf = TCLKIT.EXE:.text+0x528cf
                 
--------------------

 0167:004538b5 50                  push    eax
 0167:004538b6 e8453afeff          call    00437300 = TCLKIT.EXE:.text+0x36300
 0167:004538bb 8906                mov     dword ptr [esi],eax
 0167:004538bd 8b08                mov     ecx,dword ptr [eax]
 0167:004538bf 83c408              add     esp,+08
 0167:004538c2 41                  inc     ecx
 0167:004538c3 8908                mov     dword ptr [eax],ecx
 0167:004538c5 8d4c241c            lea     ecx,[esp+1c]
 0167:004538c9 51                  push    ecx
 0167:004538ca e8b16dfeff          call    0043a680 = TCLKIT.EXE:.text+0x39680
TCLKIT.EXE:.text+0x528cf:
*0167:004538cf 8b442410            mov     eax,dword ptr [esp+10]
 0167:004538d3 83c404              add     esp,+04
 0167:004538d6 5f                  pop     edi
 0167:004538d7 5e                  pop     esi
 0167:004538d8 5b                  pop     ebx
 0167:004538d9 81c4e4000000        add     esp,000000e4
 0167:004538df c3                  retd
 0167:004538e0 3c3a                cmp     al,3a
 0167:004538e2 0f847f010000        jz      00453a67 = TCLKIT.EXE:.text+0x52a67
 0167:004538e8 6a08                push    +08
 0167:004538ea 6828915900          push    00599128

--------------------


007df940 007df960 -> 30 48 81 00 30 48 81 00 c0 10 a0 00 38 f3 55 00 0H..0H......8.U.
007df944 00000000
007df948 00a010e0 -> 54 43 4c 42 32 45 34 2e 54 4d 50 00 00 00 00 00 TCLB2E4.TMP.....
     ...
007df950 00000001
007df954 00437d9a = TCLKIT.EXE:.text+0x36d9a
                 
--------------------

 0167:00437d7e 8b6b08              mov     ebp,dword ptr [ebx+08]
 0167:00437d81 8b4310              mov     eax,dword ptr [ebx+10]
 0167:00437d84 896c241c            mov     dword ptr [esp+1c],ebp
 0167:00437d88 03ef                add     ebp,edi
 0167:00437d8a 3b6804              cmp     ebp,dword ptr [eax+04]
 0167:00437d8d 7e25                jle     00437db4 = TCLKIT.EXE:.text+0x36db4
 0167:00437d8f 8d442d00            lea     eax,[ebp+ebp]
 0167:00437d93 50                  push    eax
 0167:00437d94 53                  push    ebx
 0167:00437d95 e886faffff          call    00437820 = TCLKIT.EXE:.text+0x36820
TCLKIT.EXE:.text+0x36d9a:
*0167:00437d9a 83c408              add     esp,+08
 0167:00437d9d 85c0                test    eax,eax
 0167:00437d9f 7520                jnz     00437dc1 = TCLKIT.EXE:.text+0x36dc1
 0167:00437da1 8d8c2f00040000      lea     ecx,[edi+ebp+00000400]
 0167:00437da8 51                  push    ecx
 0167:00437da9 53                  push    ebx
 0167:00437daa e8a1f9ffff          call    00437750 = TCLKIT.EXE:.text+0x36750
 0167:00437daf 83c408              add     esp,+08
 0167:00437db2 eb0d                jmp     00437dc1 = TCLKIT.EXE:.text+0x36dc1
 0167:00437db4 c700ffffffff        mov     dword ptr [eax],ffffffff
 0167:00437dba c7400800000000      mov     dword ptr [eax+08],00000000

--------------------


007df958 00a010a0 -> ff ff ff ff 1b 00 00 00 00 00 00 00 60 1a a0 00 ............`...
007df95c 0000000b
007df960 00814830 -> 01 00 00 00 70 10 a0 00 1b 00 00 00 10 e2 55 00 ....p.........U.
     ...
007df968 00a010c0 -> 80 e8 86 00 80 e8 86 00 57 53 2f 54 45 4d 50 2f ........WS/TEMP/
007df96c 0055f338 = TCLKIT.EXE:.data+0x5338
                  -> 2f 00 00 00 5c 00 00 00 60 f4 55 00 58 f4 55 00 /...\...`.U.X.U.
007df970 00437a56 = TCLKIT.EXE:.text+0x36a56
                 
--------------------

 0167:00437a43 5b                  pop     ebx
 0167:00437a44 5f                  pop     edi
 0167:00437a45 5e                  pop     esi
 0167:00437a46 5d                  pop     ebp
 0167:00437a47 81c4d4000000        add     esp,000000d4
 0167:00437a4d c3                  retd
 0167:00437a4e 51                  push    ecx
 0167:00437a4f 56                  push    esi
 0167:00437a50 55                  push    ebp
 0167:00437a51 e8fa020000          call    00437d50 = TCLKIT.EXE:.text+0x36d50
TCLKIT.EXE:.text+0x36a56:
*0167:00437a56 83c40c              add     esp,+0c
 0167:00437a59 5f                  pop     edi
 0167:00437a5a 5e                  pop     esi
 0167:00437a5b 5d                  pop     ebp
 0167:00437a5c 81c4d4000000        add     esp,000000d4
 0167:00437a62 c3                  retd
 0167:00437a63 90                  nop
 0167:00437a64 90                  nop
 0167:00437a65 90                  nop
 0167:00437a66 90                  nop
 0167:00437a67 90                  nop

--------------------


007df974 00814830 -> 01 00 00 00 70 10 a0 00 1b 00 00 00 10 e2 55 00 ....p.........U.
007df978 0055f338 = TCLKIT.EXE:.data+0x5338
                  -> 2f 00 00 00 5c 00 00 00 60 f4 55 00 58 f4 55 00 /...\...`.U.X.U.
007df97c 0000000f
007df980 00a010c0 -> 80 e8 86 00 80 e8 86 00 57 53 2f 54 45 4d 50 2f ........WS/TEMP/
007df984 00a010e0 -> 54 43 4c 42 32 45 34 2e 54 4d 50 00 00 00 00 00 TCLB2E4.TMP.....
007df988 00a010c0 -> 80 e8 86 00 80 e8 86 00 57 53 2f 54 45 4d 50 2f ........WS/TEMP/
007df98c 0000000b
007df990 00a011a0 -> 54 43 4c 42 32 45 34 2e 54 4d 50 00 00 02 fc 03 TCLB2E4.TMP.....
007df994 00814848 -> 01 00 00 00 e0 10 a0 00 0b 00 00 00 00 00 00 00 ................
007df998 00a011ab -> 00 00 02 fc 03 00 02 00 00 00 02 02 00 31 00 00 .............1..
007df99c 0000000b
007df9a0 00836ff0 -> 00 00 00 00 00 00 00 00 00 00 00 00 a0 e3 55 00 ..............U.
007df9a4 00000000
007df9a8 0000001c
007df9ac 00a010c0 -> 80 e8 86 00 80 e8 86 00 57 53 2f 54 45 4d 50 2f ........WS/TEMP/
007df9b0 0086e878 -> 12 00 00 00 78 e8 86 00 78 e8 86 00 bc 10 a0 00 ....x...x.......
007df9b4 00000001
007df9b8 bff7b9c5 = KERNEL32.DLL:.text+0x29c5
                 
--------------------

 0167:bff7b9a9 e81389ffff          call    bff742c1 = KERNEL32.DLL:_FREQASM+0x32c1
 0167:bff7b9ae 5e                  pop     esi
 0167:bff7b9af c20400              retd    0004
 0167:bff7b9b2 56                  push    esi
 0167:bff7b9b3 8b742408            mov     esi,dword ptr [esp+08]
 0167:bff7b9b7 8a06                mov     al,byte ptr [esi]
 0167:bff7b9b9 3c04                cmp     al,04
 0167:bff7b9bb 7508                jnz     bff7b9c5 = KERNEL32.DLL:.text+0x29c5
 0167:bff7b9bd ff7604              push    dword ptr [esi+04]
 0167:bff7b9c0 e82989ffff          call    bff742ee = KERNEL32.DLL:_FREQASM+0x32ee
KERNEL32.DLL:.text+0x29c5:
*0167:bff7b9c5 5e                  pop     esi
 0167:bff7b9c6 c20400              retd    0004
 0167:bff7b9c9 64a100000000        mov     eax,dword ptr fs:[00000000]
 0167:bff7b9cf 55                  push    ebp
 0167:bff7b9d0 8bec                mov     ebp,esp
 0167:bff7b9d2 6aff                push    -01
 0167:bff7b9d4 685092f7bf          push    bff79250
 0167:bff7b9d9 68b405fcbf          push    bffc05b4
 0167:bff7b9de 50                  push    eax
 0167:bff7b9df 8b4508              mov     eax,dword ptr [ebp+08]
 0167:bff7b9e2 64892500000000      mov     dword ptr fs:[00000000],esp

--------------------


007df9bc 81623f2c -> 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
007df9c0 0000001c
007df9c4 780012b1 = MSVCRT.DLL:.text+0x2b1
                 
--------------------

 0167:7800128d 8816                mov     byte ptr [esi],dl
 0167:7800128f 8d4608              lea     eax,[esi+08]
 0167:78001292 e91fffffff          jmp     780011b6 = MSVCRT.DLL:.text+0x1b6
 0167:78001297 33c0                xor     eax,eax
 0167:78001299 e920ffffff          jmp     780011be = MSVCRT.DLL:.text+0x1be
 0167:7800129e 55                  push    ebp
 0167:7800129f 8bec                mov     ebp,esp
 0167:780012a1 8b4508              mov     eax,dword ptr [ebp+08]
 0167:780012a4 ff348528700378      push    dword ptr [eax*4+78037028]
 0167:780012ab ff1548e00278        call    dword ptr [7802e048] -> KERNEL32.DLL!LeaveCriticalSection
MSVCRT.DLL:.text+0x2b1:
*0167:780012b1 5d                  pop     ebp
 0167:780012b2 c3                  retd
 0167:780012b3 ff3550710378        push    dword ptr [78037150]
 0167:780012b9 ff742408            push    dword ptr [esp+08]
 0167:780012bd e803000000          call    780012c5 = MSVCRT.DLL:.text+0x2c5
 0167:780012c2 59                  pop     ecx
 0167:780012c3 59                  pop     ecx
 0167:780012c4 c3                  retd
 0167:780012c5 837c2404e0          cmp     dword ptr [esp+04],-20
 0167:780012ca 0f878bb90000        ja      7800cc5b = MSVCRT.DLL:.text+0xbc5b
 0167:780012d0 ff742404            push    dword ptr [esp+04]

--------------------


007df9c8 78037118 = MSVCRT.DLL:.data+0x2118
                  -> 04 00 00 00 2c 3f 62 81 00 00 00 00 00 00 00 00 ....,?b.........
007df9cc 007dfa20 -> 1b 00 00 00 30 8a 47 00 c0 10 a0 00 1c 00 00 00 ....0.G.........
007df9d0 78011b8e = MSVCRT.DLL:.text+0x10b8e
                 
--------------------

 0167:78011b6e 53                  push    ebx
 0167:78011b6f ff75d8              push    dword ptr [ebp-28]
 0167:78011b72 e89eb4ffff          call    7800d015 = MSVCRT.DLL:.text+0xc015
 0167:78011b77 83c414              add     esp,+14
 0167:78011b7a e91bffffff          jmp     78011a9a = MSVCRT.DLL:.text+0x10a9a
 0167:78011b7f 8b750c              mov     esi,dword ptr [ebp+0c]
 0167:78011b82 8b5d08              mov     ebx,dword ptr [ebp+08]
 0167:78011b85 33ff                xor     edi,edi
 0167:78011b87 6a09                push    +09
 0167:78011b89 e810f7feff          call    7800129e = MSVCRT.DLL!_unlock
MSVCRT.DLL:.text+0x10b8e:
*0167:78011b8e 59                  pop     ecx
 0167:78011b8f c3                  retd
 0167:78011b90 6a10                push    +10
 0167:78011b92 5e                  pop     esi
 0167:78011b93 e9befefeff          jmp     78001a56 = MSVCRT.DLL:.text+0xa56
 0167:78011b98 56                  push    esi
 0167:78011b99 6a00                push    +00
 0167:78011b9b ff3500500378        push    dword ptr [78035000]
 0167:78011ba1 ff1594e00278        call    dword ptr [7802e094] -> KERNEL32.DLL!HeapAlloc
 0167:78011ba7 8945dc              mov     dword ptr [ebp-24],eax
 0167:78011baa 85c0                test    eax,eax

--------------------


007df9d4 00000009
007df9d8 78011af3 = MSVCRT.DLL:.text+0x10af3
                 
--------------------

 0167:78011acf c672028b            mov     byte ptr [edx+02],8b
 0167:78011ad3 c65053ff            mov     byte ptr [eax+53],ff
 0167:78011ad7 75dc                jnz     78011ab5 = MSVCRT.DLL:.text+0x10ab5
 0167:78011ad9 e830fbfeff          call    7800160e = MSVCRT.DLL!memcpy
 0167:78011ade 53                  push    ebx
 0167:78011adf ff75d8              push    dword ptr [ebp-28]
 0167:78011ae2 e82eb5ffff          call    7800d015 = MSVCRT.DLL:.text+0xc015
 0167:78011ae7 83c414              add     esp,+14
 0167:78011aea 834dfcff            or      dword ptr [ebp-04],-01
 0167:78011aee e894000000          call    78011b87 = MSVCRT.DLL:.text+0x10b87
MSVCRT.DLL:.text+0x10af3:
*0167:78011af3 397dd8              cmp     dword ptr [ebp-28],edi
 0167:78011af6 7522                jnz     78011b1a = MSVCRT.DLL:.text+0x10b1a
 0167:78011af8 3bf7                cmp     esi,edi
 0167:78011afa 7503                jnz     78011aff = MSVCRT.DLL:.text+0x10aff
 0167:78011afc 6a01                push    +01
 0167:78011afe 5e                  pop     esi
 0167:78011aff 83c60f              add     esi,+0f
 0167:78011b02 83e6f0              and     esi,-10
 0167:78011b05 89750c              mov     dword ptr [ebp+0c],esi
 0167:78011b08 56                  push    esi
 0167:78011b09 53                  push    ebx

--------------------


007df9dc 0000001c
007df9e0 00a010e0 -> 54 43 4c 42 32 45 34 2e 54 4d 50 00 00 00 00 00 TCLB2E4.TMP.....
007df9e4 00814830 -> 01 00 00 00 70 10 a0 00 1b 00 00 00 10 e2 55 00 ....p.........U.
     ...
007df9f0 00a010a0 -> ff ff ff ff 1b 00 00 00 00 00 00 00 60 1a a0 00 ............`...
007df9f4 81623f2c -> 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
007df9f8 008f0020 -> 00 00 00 44 01 00 80 10 ff ff ff 3f 00 00 a0 00 ...D.......?....
007df9fc 00a01070 -> 43 3a 2f 57 49 4e 44 4f 57 53 2f 54 45 4d 50 2f C:/WINDOWS/TEMP/
007dfa00 00000020
007dfa04 7802e248 = MSVCRT.DLL:.rdata+0x248
                  -> ff ff ff ff 00 00 00 00 ac cc 00 78 ff ff ff ff ...........x....
007dfa08 ffffffff
007dfa0c 00000000
007dfa10 007dfe28 -> 68 ff 7d 00 a2 33 55 00 e0 71 55 00 00 00 00 00 h.}..3U..qU.....
007dfa14 7800ef03 = MSVCRT.DLL!_except_handler3
                  -> 55 8b ec 83 ec 08 53 56 57 55 fc 8b 5d 0c 8b 45 U.....SVWU..]..E
007dfa18 7802e2d8 = MSVCRT.DLL:.rdata+0x2d8
                  -> ff ff ff ff 00 00 00 00 7f 1b 01 78 ff ff ff ff ...........x....
007dfa1c ffffffff
007dfa20 0000001b
007dfa24 00478a30 = TCLKIT.EXE:.text+0x77a30
                 
--------------------

 0167:00478a1b 59                  pop     ecx
 0167:00478a1c c3                  retd
 0167:00478a1d 90                  nop
 0167:00478a1e 90                  nop
 0167:00478a1f 90                  nop
 0167:00478a20 8b442408            mov     eax,dword ptr [esp+08]
 0167:00478a24 8b4c2404            mov     ecx,dword ptr [esp+04]
 0167:00478a28 50                  push    eax
 0167:00478a29 51                  push    ecx
 0167:00478a2a ff1530445500        call    dword ptr [00554430] -> MSVCRT.DLL!realloc
TCLKIT.EXE:.text+0x77a30:
*0167:00478a30 83c408              add     esp,+08
 0167:00478a33 c3                  retd
 0167:00478a34 90                  nop
 0167:00478a35 90                  nop
 0167:00478a36 90                  nop
 0167:00478a37 90                  nop
 0167:00478a38 90                  nop
 0167:00478a39 90                  nop
 0167:00478a3a 90                  nop
 0167:00478a3b 90                  nop
 0167:00478a3c 90                  nop

--------------------


007dfa28 00a010c0 -> 80 e8 86 00 80 e8 86 00 57 53 2f 54 45 4d 50 2f ........WS/TEMP/
007dfa2c 0000001c
007dfa30 00438291 = TCLKIT.EXE:.text+0x37291
                 
--------------------

 0167:0043827d c3                  retd
 0167:0043827e 90                  nop
 0167:0043827f 90                  nop
 0167:00438280 8b442404            mov     eax,dword ptr [esp+04]
 0167:00438284 56                  push    esi
 0167:00438285 57                  push    edi
 0167:00438286 8b7c2410            mov     edi,dword ptr [esp+10]
 0167:0043828a 57                  push    edi
 0167:0043828b 50                  push    eax
 0167:0043828c e88f070400          call    00478a20 = TCLKIT.EXE:.text+0x77a20
TCLKIT.EXE:.text+0x37291:
*0167:00438291 8bf0                mov     esi,eax
 0167:00438293 83c408              add     esp,+08
 0167:00438296 85f6                test    esi,esi
 0167:00438298 7512                jnz     004382ac = TCLKIT.EXE:.text+0x372ac
 0167:0043829a 85ff                test    edi,edi
 0167:0043829c 740e                jz      004382ac = TCLKIT.EXE:.text+0x372ac
 0167:0043829e 57                  push    edi
 0167:0043829f 685ce35500          push    0055e35c
 0167:004382a4 e8770a0100          call    00448d20 = TCLKIT.EXE:.text+0x47d20
 0167:004382a9 83c408              add     esp,+08
 0167:004382ac 8bc6                mov     eax,esi

--------------------


007dfa34 00a010c0 -> 80 e8 86 00 80 e8 86 00 57 53 2f 54 45 4d 50 2f ........WS/TEMP/
007dfa38 0000001c
007dfa3c 00a010a0 -> ff ff ff ff 1b 00 00 00 00 00 00 00 60 1a a0 00 ............`...
007dfa40 00a010eb -> 00 00 00 00 00 41 72 69 61 6c 00 00 00 21 00 00 .....Arial...!..
007dfa44 00437772 = TCLKIT.EXE:.text+0x36772
                 
--------------------

 0167:00437756 55                  push    ebp
 0167:00437757 833b01              cmp     dword ptr [ebx],+01
 0167:0043775a 7e0d                jle     00437769 = TCLKIT.EXE:.text+0x36769
 0167:0043775c 6898e05500          push    0055e098
 0167:00437761 e8ba150100          call    00448d20 = TCLKIT.EXE:.text+0x47d20
 0167:00437766 83c404              add     esp,+04
 0167:00437769 57                  push    edi
 0167:0043776a 53                  push    ebx
 0167:0043776b 6a00                push    +00
 0167:0043776d e84e090000          call    004380c0 = TCLKIT.EXE:.text+0x370c0
TCLKIT.EXE:.text+0x36772:
*0167:00437772 8b7b10              mov     edi,dword ptr [ebx+10]
 0167:00437775 8b6c2420            mov     ebp,dword ptr [esp+20]
 0167:00437779 83c408              add     esp,+08
 0167:0043777c 897c240c            mov     dword ptr [esp+0c],edi
 0167:00437780 8b4704              mov     eax,dword ptr [edi+04]
 0167:00437783 c707ffffffff        mov     dword ptr [edi],ffffffff
 0167:00437789 3be8                cmp     ebp,eax
 0167:0043778b c7470800000000      mov     dword ptr [edi+08],00000000
 0167:00437792 7e67                jle     004377fb = TCLKIT.EXE:.text+0x367fb
 0167:00437794 8b4304              mov     eax,dword ptr [ebx+04]
 0167:00437797 8b0d88dd5500        mov     ecx,dword ptr [0055dd88] -> TCLKIT.EXE:.data+0x3ee80

--------------------


007dfa48 00000000
007dfa4c 00814830 -> 01 00 00 00 70 10 a0 00 1b 00 00 00 10 e2 55 00 ....p.........U.
007dfa50 0000001b
007dfa54 00000001
007dfa58 00814830 -> 01 00 00 00 70 10 a0 00 1b 00 00 00 10 e2 55 00 ....p.........U.
007dfa5c 00a010a0 -> ff ff ff ff 1b 00 00 00 00 00 00 00 60 1a a0 00 ............`...
007dfa60 004546f9 = TCLKIT.EXE:.text+0x536f9
                 
--------------------

 0167:004546e1 46                  inc     esi
 0167:004546e2 84c0                test    al,al
 0167:004546e4 75cd                jnz     004546b3 = TCLKIT.EXE:.text+0x536b3
 0167:004546e6 53                  push    ebx
 0167:004546e7 e8c4f6fdff          call    00433db0 = TCLKIT.EXE:.text+0x32db0
 0167:004546ec 2bf8                sub     edi,eax
 0167:004546ee 57                  push    edi
 0167:004546ef 53                  push    ebx
 0167:004546f0 897c241c            mov     dword ptr [esp+1c],edi
 0167:004546f4 e85730feff          call    00437750 = TCLKIT.EXE:.text+0x36750
TCLKIT.EXE:.text+0x536f9:
*0167:004546f9 83c40c              add     esp,+0c
 0167:004546fc 5f                  pop     edi
 0167:004546fd 5e                  pop     esi
 0167:004546fe 5d                  pop     ebp
 0167:004546ff 5b                  pop     ebx
 0167:00454700 59                  pop     ecx
 0167:00454701 c3                  retd
 0167:00454702 90                  nop
 0167:00454703 90                  nop
 0167:00454704 90                  nop
 0167:00454705 90                  nop

--------------------


007dfa64 00814830 -> 01 00 00 00 70 10 a0 00 1b 00 00 00 10 e2 55 00 ....p.........U.
007dfa68 0000001b
007dfa6c 00814830 -> 01 00 00 00 70 10 a0 00 1b 00 00 00 10 e2 55 00 ....p.........U.
007dfa70 00a010c0 -> 80 e8 86 00 80 e8 86 00 57 53 2f 54 45 4d 50 2f ........WS/TEMP/
007dfa74 00a010e0 -> 54 43 4c 42 32 45 34 2e 54 4d 50 00 00 00 00 00 TCLB2E4.TMP.....
007dfa78 00814830 -> 01 00 00 00 70 10 a0 00 1b 00 00 00 10 e2 55 00 ....p.........U.
007dfa7c 00000003
007dfa80 0000001b
007dfa84 00444b49 = TCLKIT.EXE:.text+0x43b49
                 
--------------------

 0167:00444b2e 57                  push    edi
 0167:00444b2f 55                  push    ebp
 0167:00444b30 897c2420            mov     dword ptr [esp+20],edi
 0167:00444b34 e8172cffff          call    00437750 = TCLKIT.EXE:.text+0x36750
 0167:00444b39 8b5c2434            mov     ebx,dword ptr [esp+34]
 0167:00444b3d 83c40c              add     esp,+0c
 0167:00444b40 eb0a                jmp     00444b4c = TCLKIT.EXE:.text+0x43b4c
 0167:00444b42 56                  push    esi
 0167:00444b43 55                  push    ebp
 0167:00444b44 e8e7f80000          call    00454430 = TCLKIT.EXE:.text+0x53430
TCLKIT.EXE:.text+0x43b49:
*0167:00444b49 83c408              add     esp,+08
 0167:00444b4c 8b442438            mov     eax,dword ptr [esp+38]
 0167:00444b50 43                  inc     ebx
 0167:00444b51 3bd8                cmp     ebx,eax
 0167:00444b53 895c2428            mov     dword ptr [esp+28],ebx
 0167:00444b57 0f8c1bfeffff        jl      00444978 = TCLKIT.EXE:.text+0x43978
 0167:00444b5d 5f                  pop     edi
 0167:00444b5e 5e                  pop     esi
 0167:00444b5f 8bc5                mov     eax,ebp
 0167:00444b61 5d                  pop     ebp
 0167:00444b62 5b                  pop     ebx

--------------------


007dfa88 00814830 -> 01 00 00 00 70 10 a0 00 1b 00 00 00 10 e2 55 00 ....p.........U.
007dfa8c 00a010e0 -> 54 43 4c 42 32 45 34 2e 54 4d 50 00 00 00 00 00 TCLB2E4.TMP.....
007dfa90 00000004
007dfa94 0055f2c4 = TCLKIT.EXE:.data+0x52c4
                  -> 2e 2e 00 00 2e 00 00 00 63 6f 75 6c 64 6e 27 74 ........couldn't
007dfa98 00000004
007dfa9c 00000000
007dfaa0 0081794c -> 01 00 00 00 90 11 a0 00 1b 00 00 00 d0 ef 55 00 ..............U.
007dfaa4 0000000f
007dfaa8 00000000
007dfaac 00814848 -> 01 00 00 00 e0 10 a0 00 0b 00 00 00 00 00 00 00 ................
007dfab0 00000003
007dfab4 0055efe8 = TCLKIT.EXE:.data+0x4fe8
                  -> 7c f0 55 00 7c 00 00 00 01 00 00 00 50 5c 44 00 |.U.|.......P\D.
007dfab8 00000004
007dfabc 00443e01 = TCLKIT.EXE:.text+0x42e01
                 
--------------------

 0167:00443dee 75f1                jnz     00443de1 = TCLKIT.EXE:.text+0x42de1
 0167:00443df0 eb18                jmp     00443e0a = TCLKIT.EXE:.text+0x42e0a
 0167:00443df2 8b4904              mov     ecx,dword ptr [ecx+04]
 0167:00443df5 8b4920              mov     ecx,dword ptr [ecx+20]
 0167:00443df8 3bcb                cmp     ecx,ebx
 0167:00443dfa 740e                jz      00443e0a = TCLKIT.EXE:.text+0x42e0a
 0167:00443dfc 53                  push    ebx
 0167:00443dfd 56                  push    esi
 0167:00443dfe 55                  push    ebp
 0167:00443dff ffd1                call    ecx
TCLKIT.EXE:.text+0x42e01:
*0167:00443e01 8b1578f05500        mov     edx,dword ptr [0055f078] -> TCLKIT.EXE:.data+0x5068
 0167:00443e07 83c40c              add     esp,+0c
 0167:00443e0a 8b0dfc905900        mov     ecx,dword ptr [005990fc]
 0167:00443e10 3bd3                cmp     edx,ebx
 0167:00443e12 890dfc905900        mov     dword ptr [005990fc],ecx
 0167:00443e18 8bfa                mov     edi,edx
 0167:00443e1a 7421                jz      00443e3d = TCLKIT.EXE:.text+0x42e3d
 0167:00443e1c 81ff68f05500        cmp     edi,0055f068
 0167:00443e22 7412                jz      00443e36 = TCLKIT.EXE:.text+0x42e36
 0167:00443e24 8b5704              mov     edx,dword ptr [edi+04]
 0167:00443e27 8b4a20              mov     ecx,dword ptr [edx+20]

--------------------


007dfac0 00000000
007dfac4 00814830 -> 01 00 00 00 70 10 a0 00 1b 00 00 00 10 e2 55 00 ....p.........U.
007dfac8 00000000
007dfacc 0055efd0 = TCLKIT.EXE:.data+0x4fd0
                  -> 80 b3 55 00 20 55 44 00 e0 55 44 00 00 00 00 00 ..U. UD..UD.....
007dfad0 00841c94 -> 01 00 00 00 c0 85 9f 00 1b 00 00 00 d0 ef 55 00 ..............U.
007dfad4 00000000
007dfad8 00a01210 -> 4c 79 81 00 00 00 00 00 00 00 00 00 00 00 00 00 Ly..............
007dfadc 00000004
007dfae0 00814848 -> 01 00 00 00 e0 10 a0 00 0b 00 00 00 00 00 00 00 ................
007dfae4 00445939 = TCLKIT.EXE:.text+0x44939
                 
--------------------

 0167:00445919 85c0                test    eax,eax
 0167:0044591b 7f09                jg      00445926 = TCLKIT.EXE:.text+0x44926
 0167:0044591d 57                  push    edi
 0167:0044591e e81de3feff          call    00433c40 = TCLKIT.EXE:.text+0x32c40
 0167:00445923 83c404              add     esp,+04
 0167:00445926 c744241401000000    mov     dword ptr [esp+14],00000001
 0167:0044592e 8b542418            mov     edx,dword ptr [esp+18]
 0167:00445932 52                  push    edx
 0167:00445933 55                  push    ebp
 0167:00445934 e857e3ffff          call    00443c90 = TCLKIT.EXE:.text+0x42c90
TCLKIT.EXE:.text+0x44939:
*0167:00445939 56                  push    esi
 0167:0044593a 894304              mov     dword ptr [ebx+04],eax
 0167:0044593d e86ee4feff          call    00433db0 = TCLKIT.EXE:.text+0x32db0
 0167:00445942 8bf8                mov     edi,eax
 0167:00445944 8b4304              mov     eax,dword ptr [ebx+04]
 0167:00445947 50                  push    eax
 0167:00445948 e863e4feff          call    00433db0 = TCLKIT.EXE:.text+0x32db0
 0167:0044594d 83c410              add     esp,+10
 0167:00445950 8a10                mov     dl,byte ptr [eax]
 0167:00445952 8aca                mov     cl,dl
 0167:00445954 3a17                cmp     dl,byte ptr [edi]

--------------------


007dfae8 00000000
007dfaec 00836ff0 -> 00 00 00 00 00 00 00 00 00 00 00 00 a0 e3 55 00 ..............U.
007dfaf0 00841c94 -> 01 00 00 00 c0 85 9f 00 1b 00 00 00 d0 ef 55 00 ..............U.
007dfaf4 009fa880 -> 00 00 00 10 80 23 47 00 94 1c 84 00 e8 ef 55 00 .....#G.......U.
007dfaf8 00000000
007dfafc 00841c94 -> 01 00 00 00 c0 85 9f 00 1b 00 00 00 d0 ef 55 00 ..............U.
007dfb00 00445d6a = TCLKIT.EXE:.text+0x44d6a
                 
--------------------

 0167:00445d56 33ed                xor     ebp,ebp
 0167:00445d58 833b00              cmp     dword ptr [ebx],+00
 0167:00445d5b 7505                jnz     00445d62 = TCLKIT.EXE:.text+0x44d62
 0167:00445d5d 5d                  pop     ebp
 0167:00445d5e 33c0                xor     eax,eax
 0167:00445d60 5b                  pop     ebx
 0167:00445d61 c3                  retd
 0167:00445d62 53                  push    ebx
 0167:00445d63 6a00                push    +00
 0167:00445d65 e876faffff          call    004457e0 = TCLKIT.EXE:.text+0x447e0
TCLKIT.EXE:.text+0x44d6a:
*0167:00445d6a 83c408              add     esp,+08
 0167:00445d6d 85c0                test    eax,eax
 0167:00445d6f 7503                jnz     00445d74 = TCLKIT.EXE:.text+0x44d74
 0167:00445d71 5d                  pop     ebp
 0167:00445d72 5b                  pop     ebx
 0167:00445d73 c3                  retd
 0167:00445d74 8b15fc905900        mov     edx,dword ptr [005990fc]
 0167:00445d7a 8b0df8905900        mov     ecx,dword ptr [005990f8]
 0167:00445d80 42                  inc     edx
 0167:00445d81 56                  push    esi
 0167:00445d82 8b3578f05500        mov     esi,dword ptr [0055f078] -> TCLKIT.EXE:.data+0x5068

--------------------


007dfb04 00000000
007dfb08 0081794c -> 01 00 00 00 90 11 a0 00 1b 00 00 00 d0 ef 55 00 ..............U.
007dfb0c 007dfc58 -> 02 00 00 00 4a bd 40 00 01 00 00 00 04 0d 90 00 ....J.@.........
007dfb10 00000000
007dfb14 004445c2 = TCLKIT.EXE:.text+0x435c2
                 
--------------------

 0167:004445ac 85c0                test    eax,eax
 0167:004445ae 7408                jz      004445b8 = TCLKIT.EXE:.text+0x435b8
 0167:004445b0 8b0e                mov     ecx,dword ptr [esi]
 0167:004445b2 51                  push    ecx
 0167:004445b3 ffd0                call    eax
 0167:004445b5 83c404              add     esp,+04
 0167:004445b8 57                  push    edi
 0167:004445b9 8b7e08              mov     edi,dword ptr [esi+08]
 0167:004445bc 57                  push    edi
 0167:004445bd e88e170000          call    00445d50 = TCLKIT.EXE:.text+0x44d50
TCLKIT.EXE:.text+0x435c2:
*0167:004445c2 83c404              add     esp,+04
 0167:004445c5 85c0                test    eax,eax
 0167:004445c7 740f                jz      004445d8 = TCLKIT.EXE:.text+0x435d8
 0167:004445c9 8b405c              mov     eax,dword ptr [eax+5c]
 0167:004445cc 85c0                test    eax,eax
 0167:004445ce 7408                jz      004445d8 = TCLKIT.EXE:.text+0x435d8
 0167:004445d0 57                  push    edi
 0167:004445d1 ffd0                call    eax
 0167:004445d3 83c404              add     esp,+04
 0167:004445d6 eb0c                jmp     004445e4 = TCLKIT.EXE:.text+0x435e4
 0167:004445d8 ff15ac445500        call    dword ptr [005544ac] -> MSVCRT.DLL!_errno

--------------------


007dfb18 00841c94 -> 01 00 00 00 c0 85 9f 00 1b 00 00 00 d0 ef 55 00 ..............U.
007dfb1c 00900d00 -> 98 fc 7d 00 22 0d 90 00 00 00 00 00 48 3a 5c 6c ..}.".......H:\l
007dfb20 009f9b40 -> e0 9c 9f 00 b0 87 9f 00 80 a8 9f 00 00 16 01 10 ................
007dfb24 0042c0a7 = TCLKIT.EXE:.text+0x2b0a7
                 
--------------------

 0167:0042c08e a3308e5900          mov     dword ptr [00598e30],eax
 0167:0042c093 8b0e                mov     ecx,dword ptr [esi]
 0167:0042c095 803900              cmp     byte ptr [ecx],00
 0167:0042c098 7410                jz      0042c0aa = TCLKIT.EXE:.text+0x2b0aa
 0167:0042c09a 8b4614              mov     eax,dword ptr [esi+14]
 0167:0042c09d 85c0                test    eax,eax
 0167:0042c09f 7409                jz      0042c0aa = TCLKIT.EXE:.text+0x2b0aa
 0167:0042c0a1 8b5608              mov     edx,dword ptr [esi+08]
 0167:0042c0a4 52                  push    edx
 0167:0042c0a5 ffd0                call    eax
TCLKIT.EXE:.text+0x2b0a7:
*0167:0042c0a7 83c404              add     esp,+04
 0167:0042c0aa 8b06                mov     eax,dword ptr [esi]
 0167:0042c0ac 50                  push    eax
 0167:0042c0ad e87ec20000          call    00438330 = TCLKIT.EXE:.text+0x37330
 0167:0042c0b2 8b4e04              mov     ecx,dword ptr [esi+04]
 0167:0042c0b5 51                  push    ecx
 0167:0042c0b6 e875c20000          call    00438330 = TCLKIT.EXE:.text+0x37330
 0167:0042c0bb 56                  push    esi
 0167:0042c0bc e86fc20000          call    00438330 = TCLKIT.EXE:.text+0x37330
 0167:0042c0c1 8b35308e5900        mov     esi,dword ptr [00598e30]
 0167:0042c0c7 83c40c              add     esp,+0c

--------------------


007dfb28 009fa880 -> 00 00 00 10 80 23 47 00 94 1c 84 00 e8 ef 55 00 .....#G.......U.
007dfb2c 00000002
007dfb30 00442a40 = TCLKIT.EXE:.text+0x41a40
                 
--------------------

 0167:00442a1b 4a                  dec     edx
 0167:00442a1c 8910                mov     dword ptr [eax],edx
 0167:00442a1e a104915900          mov     eax,dword ptr [00599104]
 0167:00442a23 833800              cmp     dword ptr [eax],+00
 0167:00442a26 7f09                jg      00442a31 = TCLKIT.EXE:.text+0x41a31
 0167:00442a28 50                  push    eax
 0167:00442a29 e81212ffff          call    00433c40 = TCLKIT.EXE:.text+0x32c40
 0167:00442a2e 83c404              add     esp,+04
 0167:00442a31 c7050491590000000000 mov     dword ptr [00599104],00000000
 0167:00442a3b e84096feff          call    0042c080 = TCLKIT.EXE:.text+0x2b080
TCLKIT.EXE:.text+0x41a40:
*0167:00442a40 a178f05500          mov     eax,dword ptr [0055f078]
 0167:00442a45 85c0                test    eax,eax
 0167:00442a47 7420                jz      00442a69 = TCLKIT.EXE:.text+0x41a69
 0167:00442a49 56                  push    esi
 0167:00442a4a 8b700c              mov     esi,dword ptr [eax+0c]
 0167:00442a4d 3d68f05500          cmp     eax,0055f068
 0167:00442a52 7409                jz      00442a5d = TCLKIT.EXE:.text+0x41a5d
 0167:00442a54 50                  push    eax
 0167:00442a55 e8d658ffff          call    00438330 = TCLKIT.EXE:.text+0x37330
 0167:00442a5a 83c404              add     esp,+04
 0167:00442a5d 8bc6                mov     eax,esi

--------------------


007dfb34 00441340 = TCLKIT.EXE:.text+0x40340
                 
--------------------

 0167:0044131c 740f                jz      0044132d = TCLKIT.EXE:.text+0x4032d
 0167:0044131e 50                  push    eax
 0167:0044131f e80c70ffff          call    00438330 = TCLKIT.EXE:.text+0x37330
 0167:00441324 83c404              add     esp,+04
 0167:00441327 891dd0905900        mov     dword ptr [005990d0],ebx
 0167:0044132d 53                  push    ebx
 0167:0044132e e80d790000          call    00448c40 = TCLKIT.EXE:.text+0x47c40
 0167:00441333 83c404              add     esp,+04
 0167:00441336 e8350e0300          call    00472170 = TCLKIT.EXE:.text+0x71170
 0167:0044133b e8d0160000          call    00442a10 = TCLKIT.EXE:.text+0x41a10
TCLKIT.EXE:.text+0x40340:
*0167:00441340 e86b0e0300          call    004721b0 = TCLKIT.EXE:.text+0x711b0
 0167:00441345 891de0905900        mov     dword ptr [005990e0],ebx
 0167:0044134b e830110300          call    00472480 = TCLKIT.EXE:.text+0x71480
 0167:00441350 5b                  pop     ebx
 0167:00441351 c3                  retd
 0167:00441352 90                  nop
 0167:00441353 90                  nop
 0167:00441354 90                  nop
 0167:00441355 90                  nop
 0167:00441356 90                  nop
 0167:00441357 90                  nop

--------------------


007dfb38 00000000
007dfb3c 004410d5 = TCLKIT.EXE:.text+0x400d5
                 
--------------------

 0167:004410bf 894208              mov     dword ptr [edx+08],eax
 0167:004410c2 e86972ffff          call    00438330 = TCLKIT.EXE:.text+0x37330
 0167:004410c7 83c404              add     esp,+04
 0167:004410ca 5f                  pop     edi
 0167:004410cb 5e                  pop     esi
 0167:004410cc c3                  retd
 0167:004410cd 90                  nop
 0167:004410ce 90                  nop
 0167:004410cf 90                  nop
 0167:004410d0 e82b010000          call    00441200 = TCLKIT.EXE:.text+0x40200
TCLKIT.EXE:.text+0x400d5:
*0167:004410d5 8b442404            mov     eax,dword ptr [esp+04]
 0167:004410d9 50                  push    eax
 0167:004410da ff15c0445500        call    dword ptr [005544c0] -> MSVCRT.DLL!exit
 0167:004410e0 56                  push    esi
 0167:004410e1 57                  push    edi
 0167:004410e2 6a0c                push    +0c
 0167:004410e4 68d8905900          push    005990d8
 0167:004410e9 e8f20e0300          call    00471fe0 = TCLKIT.EXE:.text+0x70fe0
 0167:004410ee 8b7c2414            mov     edi,dword ptr [esp+14]
 0167:004410f2 83c408              add     esp,+08
 0167:004410f5 85ff                test    edi,edi

--------------------


007dfb40 0049b7d1 = TCLKIT.EXE:.text+0x9a7d1
                 
--------------------

 0167:0049b7b0 51                  push    ecx
 0167:0049b7b1 e8aa39f8ff          call    0041f160 = TCLKIT.EXE:.text+0x1e160
 0167:0049b7b6 83c404              add     esp,+04
 0167:0049b7b9 e899120000          call    0049ca57 = TCLKIT.EXE:.text+0x9ba57
 0167:0049b7be 8b5514              mov     edx,dword ptr [ebp+14]
 0167:0049b7c1 52                  push    edx
 0167:0049b7c2 e86943f8ff          call    0041fb30 = TCLKIT.EXE:.text+0x1eb30
 0167:0049b7c7 83c404              add     esp,+04
 0167:0049b7ca 6a00                push    +00
 0167:0049b7cc e8ff58faff          call    004410d0 = TCLKIT.EXE:.text+0x400d0
TCLKIT.EXE:.text+0x9a7d1:
*0167:0049b7d1 83c404              add     esp,+04
 0167:0049b7d4 8be5                mov     esp,ebp
 0167:0049b7d6 5d                  pop     ebp
 0167:0049b7d7 c3                  retd
 0167:0049b7d8 55                  push    ebp
 0167:0049b7d9 8bec                mov     ebp,esp
 0167:0049b7db 83ec18              sub     esp,+18
 0167:0049b7de 8b4508              mov     eax,dword ptr [ebp+08]
 0167:0049b7e1 8945f8              mov     dword ptr [ebp-08],eax
 0167:0049b7e4 68b0010000          push    000001b0
 0167:0049b7e9 6868955900          push    00599568

--------------------


007dfb44 00000000
007dfb48 0056e998 = TCLKIT.EXE:.data+0x14998
                  -> 30 00 00 00 74 63 6c 5f 69 6e 74 65 72 61 63 74 0...tcl_interact
007dfb4c 00000000
007dfb50 ffffffff
007dfb54 00000020
007dfb58 005641b8 = TCLKIT.EXE:.data+0xa1b8
                  -> 01 00 00 00 00 00 00 00 40 06 47 00 00 06 47 00 ........@.G...G.
007dfb5c 00904d00 -> 0c 00 90 00 3c 0a 90 00 60 00 00 00 21 00 00 00 ....<...`...!...
007dfb60 00900030 -> 65 78 69 74 00 00 00 00 21 00 00 00 20 00 00 00 exit....!... ...
007dfb64 005630e0 = TCLKIT.EXE:.data+0x90e0
                  -> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
007dfb68 00000020
007dfb6c 00000014
     ...
007dfb74 bff7b9c5 = KERNEL32.DLL:.text+0x29c5
                 
--------------------

 0167:bff7b9a9 e81389ffff          call    bff742c1 = KERNEL32.DLL:_FREQASM+0x32c1
 0167:bff7b9ae 5e                  pop     esi
 0167:bff7b9af c20400              retd    0004
 0167:bff7b9b2 56                  push    esi
 0167:bff7b9b3 8b742408            mov     esi,dword ptr [esp+08]
 0167:bff7b9b7 8a06                mov     al,byte ptr [esi]
 0167:bff7b9b9 3c04                cmp     al,04
 0167:bff7b9bb 7508                jnz     bff7b9c5 = KERNEL32.DLL:.text+0x29c5
 0167:bff7b9bd ff7604              push    dword ptr [esi+04]
 0167:bff7b9c0 e82989ffff          call    bff742ee = KERNEL32.DLL:_FREQASM+0x32ee
KERNEL32.DLL:.text+0x29c5:
*0167:bff7b9c5 5e                  pop     esi
 0167:bff7b9c6 c20400              retd    0004
 0167:bff7b9c9 64a100000000        mov     eax,dword ptr fs:[00000000]
 0167:bff7b9cf 55                  push    ebp
 0167:bff7b9d0 8bec                mov     ebp,esp
 0167:bff7b9d2 6aff                push    -01
 0167:bff7b9d4 685092f7bf          push    bff79250
 0167:bff7b9d9 68b405fcbf          push    bffc05b4
 0167:bff7b9de 50                  push    eax
 0167:bff7b9df 8b4508              mov     eax,dword ptr [ebp+08]
 0167:bff7b9e2 64892500000000      mov     dword ptr fs:[00000000],esp

--------------------


007dfb78 00904ea0 -> 10 4e 90 00 04 00 00 00 00 00 00 00 00 00 00 00 .N..............
007dfb7c 007dfb88 -> 00 3a 5c 6c 61 73 74 6b 69 74 5c 74 63 6c 38 34 .:\lastkit\tcl84
007dfb80 00000000
007dfb84 000000c8
007dfb88 6c5c3a00
007dfb8c 6b747361
007dfb90 745c7469
007dfb94 34386c63
007dfb98 006b6f64
007dfb9c 0055b1f0 = TCLKIT.EXE:.data+0x11f0
                  -> 54 63 6c 00 38 2e 34 00 2d 62 6c 6f 63 6b 69 6e Tcl.8.4.-blockin
     ...
007dfba4 00000004
     ...
007dfbac bff7b9c5 = KERNEL32.DLL:.text+0x29c5
                 
--------------------

 0167:bff7b9a9 e81389ffff          call    bff742c1 = KERNEL32.DLL:_FREQASM+0x32c1
 0167:bff7b9ae 5e                  pop     esi
 0167:bff7b9af c20400              retd    0004
 0167:bff7b9b2 56                  push    esi
 0167:bff7b9b3 8b742408            mov     esi,dword ptr [esp+08]
 0167:bff7b9b7 8a06                mov     al,byte ptr [esi]
 0167:bff7b9b9 3c04                cmp     al,04
 0167:bff7b9bb 7508                jnz     bff7b9c5 = KERNEL32.DLL:.text+0x29c5
 0167:bff7b9bd ff7604              push    dword ptr [esi+04]
 0167:bff7b9c0 e82989ffff          call    bff742ee = KERNEL32.DLL:_FREQASM+0x32ee
KERNEL32.DLL:.text+0x29c5:
*0167:bff7b9c5 5e                  pop     esi
 0167:bff7b9c6 c20400              retd    0004
 0167:bff7b9c9 64a100000000        mov     eax,dword ptr fs:[00000000]
 0167:bff7b9cf 55                  push    ebp
 0167:bff7b9d0 8bec                mov     ebp,esp
 0167:bff7b9d2 6aff                push    -01
 0167:bff7b9d4 685092f7bf          push    bff79250
 0167:bff7b9d9 68b405fcbf          push    bffc05b4
 0167:bff7b9de 50                  push    eax
 0167:bff7b9df 8b4508              mov     eax,dword ptr [ebp+08]
 0167:bff7b9e2 64892500000000      mov     dword ptr fs:[00000000],esp

--------------------


007dfbb0 81623f2c -> 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
007dfbb4 00000004
007dfbb8 780012b1 = MSVCRT.DLL:.text+0x2b1
                 
--------------------

 0167:7800128d 8816                mov     byte ptr [esi],dl
 0167:7800128f 8d4608              lea     eax,[esi+08]
 0167:78001292 e91fffffff          jmp     780011b6 = MSVCRT.DLL:.text+0x1b6
 0167:78001297 33c0                xor     eax,eax
 0167:78001299 e920ffffff          jmp     780011be = MSVCRT.DLL:.text+0x1be
 0167:7800129e 55                  push    ebp
 0167:7800129f 8bec                mov     ebp,esp
 0167:780012a1 8b4508              mov     eax,dword ptr [ebp+08]
 0167:780012a4 ff348528700378      push    dword ptr [eax*4+78037028]
 0167:780012ab ff1548e00278        call    dword ptr [7802e048] -> KERNEL32.DLL!LeaveCriticalSection
MSVCRT.DLL:.text+0x2b1:
*0167:780012b1 5d                  pop     ebp
 0167:780012b2 c3                  retd
 0167:780012b3 ff3550710378        push    dword ptr [78037150]
 0167:780012b9 ff742408            push    dword ptr [esp+08]
 0167:780012bd e803000000          call    780012c5 = MSVCRT.DLL:.text+0x2c5
 0167:780012c2 59                  pop     ecx
 0167:780012c3 59                  pop     ecx
 0167:780012c4 c3                  retd
 0167:780012c5 837c2404e0          cmp     dword ptr [esp+04],-20
 0167:780012ca 0f878bb90000        ja      7800cc5b = MSVCRT.DLL:.text+0xbc5b
 0167:780012d0 ff742404            push    dword ptr [esp+04]

--------------------


007dfbbc 78037118 = MSVCRT.DLL:.data+0x2118
                  -> 04 00 00 00 2c 3f 62 81 00 00 00 00 00 00 00 00 ....,?b.........
007dfbc0 007dfbf8 -> f0 b1 55 00 d9 12 00 78 04 00 00 00 c2 12 00 78 ..U....x.......x
007dfbc4 7800ccb3 = MSVCRT.DLL:.text+0xbcb3
                 
--------------------

 0167:7800cc9a 85c0                test    eax,eax
 0167:7800cc9c 7503                jnz     7800cca1 = MSVCRT.DLL:.text+0xbca1
 0167:7800cc9e 6a01                push    +01
 0167:7800cca0 58                  pop     eax
 0167:7800cca1 83c00f              add     eax,+0f
 0167:7800cca4 24f0                and     al,f0
 0167:7800cca6 50                  push    eax
 0167:7800cca7 e9cb46ffff          jmp     78001377 = MSVCRT.DLL:.text+0x377
 0167:7800ccac 6a09                push    +09
 0167:7800ccae e8eb45ffff          call    7800129e = MSVCRT.DLL!_unlock
MSVCRT.DLL:.text+0xbcb3:
*0167:7800ccb3 59                  pop     ecx
 0167:7800ccb4 c3                  retd
 0167:7800ccb5 6a10                push    +10
 0167:7800ccb7 5e                  pop     esi
 0167:7800ccb8 e97146ffff          jmp     7800132e = MSVCRT.DLL:.text+0x32e
 0167:7800ccbd 8b7508              mov     esi,dword ptr [ebp+08]
 0167:7800ccc0 e9c246ffff          jmp     78001387 = MSVCRT.DLL:.text+0x387
 0167:7800ccc5 6a01                push    +01
 0167:7800ccc7 58                  pop     eax
 0167:7800ccc8 e9b06dffff          jmp     78003a7d = MSVCRT.DLL:.text+0x2a7d
 0167:7800cccd 33db                xor     ebx,ebx

--------------------


007dfbc8 00000009
007dfbcc 7800cc8c = MSVCRT.DLL:.text+0xbc8c
                 
--------------------

 0167:7800cc6c 2a6a09              sub     ch,byte ptr [edx+09]
 0167:7800cc6f e8e143ffff          call    78001055 = MSVCRT.DLL!_lock
 0167:7800cc74 59                  pop     ecx
 0167:7800cc75 8365fc00            and     dword ptr [ebp-04],+00
 0167:7800cc79 56                  push    esi
 0167:7800cc7a e8e2060000          call    7800d361 = MSVCRT.DLL:.text+0xc361
 0167:7800cc7f 59                  pop     ecx
 0167:7800cc80 8945e4              mov     dword ptr [ebp-1c],eax
 0167:7800cc83 834dfcff            or      dword ptr [ebp-04],-01
 0167:7800cc87 e820000000          call    7800ccac = MSVCRT.DLL:.text+0xbcac
MSVCRT.DLL:.text+0xbc8c:
*0167:7800cc8c 8b45e4              mov     eax,dword ptr [ebp-1c]
 0167:7800cc8f 85c0                test    eax,eax
 0167:7800cc91 0f85d046ffff        jnz     78001367 = MSVCRT.DLL:.text+0x367
 0167:7800cc97 8b4508              mov     eax,dword ptr [ebp+08]
 0167:7800cc9a 85c0                test    eax,eax
 0167:7800cc9c 7503                jnz     7800cca1 = MSVCRT.DLL:.text+0xbca1
 0167:7800cc9e 6a01                push    +01
 0167:7800cca0 58                  pop     eax
 0167:7800cca1 83c00f              add     eax,+0f
 0167:7800cca4 24f0                and     al,f0
 0167:7800cca6 50                  push    eax

--------------------


007dfbd0 00000004
007dfbd4 0055b1f4 = TCLKIT.EXE:.data+0x11f4
                  -> 38 2e 34 00 2d 62 6c 6f 63 6b 69 6e 67 00 00 00 8.4.-blocking...
007dfbd8 009031f0 -> fc 01 7f 00 fc 01 7f 00 c8 39 56 00 00 00 00 00 .........9V.....
007dfbdc 00903340 -> 0c 6a 90 00 cc 01 7f 00 11 00 00 00 20 00 00 00 .j.......... ...
007dfbe0 004381fc = TCLKIT.EXE:.text+0x371fc
                 
--------------------

 0167:004381eb 90                  nop
 0167:004381ec 90                  nop
 0167:004381ed 90                  nop
 0167:004381ee 90                  nop
 0167:004381ef 90                  nop
 0167:004381f0 56                  push    esi
 0167:004381f1 57                  push    edi
 0167:004381f2 8b7c240c            mov     edi,dword ptr [esp+0c]
 0167:004381f6 57                  push    edi
 0167:004381f7 e804080400          call    00478a00 = TCLKIT.EXE:.text+0x77a00
TCLKIT.EXE:.text+0x371fc:
*0167:004381fc 8bf0                mov     esi,eax
 0167:004381fe 83c404              add     esp,+04
 0167:00438201 85f6                test    esi,esi
 0167:00438203 7512                jnz     00438217 = TCLKIT.EXE:.text+0x37217
 0167:00438205 85ff                test    edi,edi
 0167:00438207 740e                jz      00438217 = TCLKIT.EXE:.text+0x37217
 0167:00438209 57                  push    edi
 0167:0043820a 6818e35500          push    0055e318
 0167:0043820f e80c0b0100          call    00448d20 = TCLKIT.EXE:.text+0x47d20
 0167:00438214 83c408              add     esp,+08
 0167:00438217 8bc6                mov     eax,esi

--------------------


007dfbe4 00000014
007dfbe8 007dfe28 -> 68 ff 7d 00 a2 33 55 00 e0 71 55 00 00 00 00 00 h.}..3U..qU.....
007dfbec 7800ef03 = MSVCRT.DLL!_except_handler3
                  -> 55 8b ec 83 ec 08 53 56 57 55 fc 8b 5d 0c 8b 45 U.....SVWU..]..E
007dfbf0 7802e248 = MSVCRT.DLL:.rdata+0x248
                  -> ff ff ff ff 00 00 00 00 ac cc 00 78 ff ff ff ff ...........x....
007dfbf4 ffffffff
007dfbf8 0055b1f0 = TCLKIT.EXE:.data+0x11f0
                  -> 54 63 6c 00 38 2e 34 00 2d 62 6c 6f 63 6b 69 6e Tcl.8.4.-blockin
007dfbfc 780012d9 = MSVCRT.DLL:.text+0x2d9
                 
--------------------

 0167:780012b3 ff3550710378        push    dword ptr [78037150]
 0167:780012b9 ff742408            push    dword ptr [esp+08]
 0167:780012bd e803000000          call    780012c5 = MSVCRT.DLL:.text+0x2c5
 0167:780012c2 59                  pop     ecx
 0167:780012c3 59                  pop     ecx
 0167:780012c4 c3                  retd
 0167:780012c5 837c2404e0          cmp     dword ptr [esp+04],-20
 0167:780012ca 0f878bb90000        ja      7800cc5b = MSVCRT.DLL:.text+0xbc5b
 0167:780012d0 ff742404            push    dword ptr [esp+04]
 0167:780012d4 e80a000000          call    780012e3 = MSVCRT.DLL:.text+0x2e3
MSVCRT.DLL:.text+0x2d9:
*0167:780012d9 85c0                test    eax,eax
 0167:780012db 59                  pop     ecx
 0167:780012dc 0f845db90000        jz      7800cc3f = MSVCRT.DLL:.text+0xbc3f
 0167:780012e2 c3                  retd
 0167:780012e3 55                  push    ebp
 0167:780012e4 8bec                mov     ebp,esp
 0167:780012e6 6aff                push    -01
 0167:780012e8 6848e20278          push    7802e248
 0167:780012ed 6803ef0078          push    7800ef03
 0167:780012f2 64a100000000        mov     eax,dword ptr fs:[00000000]
 0167:780012f8 50                  push    eax

--------------------


007dfc00 00000004
007dfc04 780012c2 = MSVCRT.DLL:.text+0x2c2
                 
--------------------

 0167:7800129e 55                  push    ebp
 0167:7800129f 8bec                mov     ebp,esp
 0167:780012a1 8b4508              mov     eax,dword ptr [ebp+08]
 0167:780012a4 ff348528700378      push    dword ptr [eax*4+78037028]
 0167:780012ab ff1548e00278        call    dword ptr [7802e048] -> KERNEL32.DLL!LeaveCriticalSection
 0167:780012b1 5d                  pop     ebp
 0167:780012b2 c3                  retd
 0167:780012b3 ff3550710378        push    dword ptr [78037150]
 0167:780012b9 ff742408            push    dword ptr [esp+08]
 0167:780012bd e803000000          call    780012c5 = MSVCRT.DLL:.text+0x2c5
MSVCRT.DLL:.text+0x2c2:
*0167:780012c2 59                  pop     ecx
 0167:780012c3 59                  pop     ecx
 0167:780012c4 c3                  retd
 0167:780012c5 837c2404e0          cmp     dword ptr [esp+04],-20
 0167:780012ca 0f878bb90000        ja      7800cc5b = MSVCRT.DLL:.text+0xbc5b
 0167:780012d0 ff742404            push    dword ptr [esp+04]
 0167:780012d4 e80a000000          call    780012e3 = MSVCRT.DLL:.text+0x2e3
 0167:780012d9 85c0                test    eax,eax
 0167:780012db 59                  pop     ecx
 0167:780012dc 0f845db90000        jz      7800cc3f = MSVCRT.DLL:.text+0xbc3f
 0167:780012e2 c3                  retd

--------------------


007dfc08 00000004
007dfc0c 00000000
007dfc10 00478a0b = TCLKIT.EXE:.text+0x77a0b
                 
--------------------

 0167:004789f9 90                  nop
 0167:004789fa 90                  nop
 0167:004789fb 90                  nop
 0167:004789fc 90                  nop
 0167:004789fd 90                  nop
 0167:004789fe 90                  nop
 0167:004789ff 90                  nop
 0167:00478a00 8b442404            mov     eax,dword ptr [esp+04]
 0167:00478a04 50                  push    eax
 0167:00478a05 ff1534445500        call    dword ptr [00554434] -> MSVCRT.DLL!malloc
TCLKIT.EXE:.text+0x77a0b:
*0167:00478a0b 83c404              add     esp,+04
 0167:00478a0e c3                  retd
 0167:00478a0f 90                  nop
 0167:00478a10 8b442404            mov     eax,dword ptr [esp+04]
 0167:00478a14 50                  push    eax
 0167:00478a15 ff152c445500        call    dword ptr [0055442c] -> MSVCRT.DLL!free
 0167:00478a1b 59                  pop     ecx
 0167:00478a1c c3                  retd
 0167:00478a1d 90                  nop
 0167:00478a1e 90                  nop
 0167:00478a1f 90                  nop

--------------------


007dfc14 00000004
007dfc18 0046847f = TCLKIT.EXE:.text+0x6747f
                 
--------------------

 0167:00468466 c3                  retd
 0167:00468467 8d542408            lea     edx,[esp+08]
 0167:0046846b 52                  push    edx
 0167:0046846c 8b542414            mov     edx,dword ptr [esp+14]
 0167:00468470 52                  push    edx
 0167:00468471 8b542414            mov     edx,dword ptr [esp+14]
 0167:00468475 52                  push    edx
 0167:00468476 68f0b15500          push    0055b1f0
 0167:0046847b 51                  push    ecx
 0167:0046847c ff500c              call    dword ptr [eax+0c]
TCLKIT.EXE:.text+0x6747f:
*0167:0046847f 83c414              add     esp,+14
 0167:00468482 3bc6                cmp     eax,esi
 0167:00468484 750a                jnz     00468490 = TCLKIT.EXE:.text+0x67490
 0167:00468486 893548a95900        mov     dword ptr [0059a948],esi
 0167:0046848c 33c0                xor     eax,eax
 0167:0046848e 5e                  pop     esi
 0167:0046848f c3                  retd
 0167:00468490 8b1548a95900        mov     edx,dword ptr [0059a948] -> TCLKIT.EXE:.data+0x99c8
 0167:00468496 8b4a04              mov     ecx,dword ptr [edx+04]
 0167:00468499 3bce                cmp     ecx,esi
 0167:0046849b 7422                jz      004684bf = TCLKIT.EXE:.text+0x674bf

--------------------


007dfc1c 00900660 -> 00 00 00 00 00 00 00 00 01 00 00 00 c8 39 56 00 .............9V.
007dfc20 0055b1f0 = TCLKIT.EXE:.data+0x11f0
                  -> 54 63 6c 00 38 2e 34 00 2d 62 6c 6f 63 6b 69 6e Tcl.8.4.-blockin
007dfc24 0055b1f4 = TCLKIT.EXE:.data+0x11f4
                  -> 38 2e 34 00 2d 62 6c 6f 63 6b 69 6e 67 00 00 00 8.4.-blocking...
007dfc28 00000001
007dfc2c 007dfc38 -> c8 39 56 00 f4 b1 55 00 01 00 00 00 60 06 90 00 .9V...U.....`...
007dfc30 00900660 -> 00 00 00 00 00 00 00 00 01 00 00 00 c8 39 56 00 .............9V.
007dfc34 0041f89b = TCLKIT.EXE:.text+0x1e89b
                 
--------------------

 0167:0041f874 e807400000          call    00423880 = TCLKIT.EXE:.text+0x22880
 0167:0041f879 68c8395600          push    005639c8
 0167:0041f87e 68f4b15500          push    0055b1f4
 0167:0041f883 68f0b15500          push    0055b1f0
 0167:0041f888 56                  push    esi
 0167:0041f889 e882fe0100          call    0043f710 = TCLKIT.EXE:.text+0x3e710
 0167:0041f88e 6a01                push    +01
 0167:0041f890 68f4b15500          push    0055b1f4
 0167:0041f895 56                  push    esi
 0167:0041f896 e8958b0400          call    00468430 = TCLKIT.EXE:.text+0x67430
TCLKIT.EXE:.text+0x1e89b:
*0167:0041f89b 83c420              add     esp,+20
 0167:0041f89e 8bc6                mov     eax,esi
 0167:0041f8a0 5f                  pop     edi
 0167:0041f8a1 5e                  pop     esi
 0167:0041f8a2 5d                  pop     ebp
 0167:0041f8a3 5b                  pop     ebx
 0167:0041f8a4 59                  pop     ecx
 0167:0041f8a5 c3                  retd
 0167:0041f8a6 8b17                mov     edx,dword ptr [edi]
 0167:0041f8a8 52                  push    edx
 0167:0041f8a9 68f8be5500          push    0055bef8

--------------------


007dfc38 005639c8 = TCLKIT.EXE:.data+0x99c8
                  -> cf ba a3 fc b8 39 56 00 10 f7 43 00 20 f8 43 00 .....9V...C. .C.
007dfc3c 0055b1f4 = TCLKIT.EXE:.data+0x11f4
                  -> 38 2e 34 00 2d 62 6c 6f 63 6b 69 6e 67 00 00 00 8.4.-blocking...
007dfc40 00000001
007dfc44 00900660 -> 00 00 00 00 00 00 00 00 01 00 00 00 c8 39 56 00 .............9V.
007dfc48 00000001
007dfc4c 0055b1f4 = TCLKIT.EXE:.data+0x11f4
                  -> 38 2e 34 00 2d 62 6c 6f 63 6b 69 6e 67 00 00 00 8.4.-blocking...
007dfc50 00903030 -> dc 02 7f 00 dc 02 7f 00 00 00 00 00 c8 00 00 00 ................
007dfc54 00904c90 -> 48 3a 5c 6c 61 73 74 6b 69 74 5c 74 63 6c 38 34 H:\lastkit\tcl84
007dfc58 00000002
007dfc5c 0040bd4a = TCLKIT.EXE:.text+0xad4a
                 
--------------------

 0167:0040bd30 8a4801              mov     cl,byte ptr [eax+01]
 0167:0040bd33 40                  inc     eax
 0167:0040bd34 84c9                test    cl,cl
 0167:0040bd36 75f0                jnz     0040bd28 = TCLKIT.EXE:.text+0xad28
 0167:0040bd38 e863380100          call    0041f5a0 = TCLKIT.EXE:.text+0x1e5a0
 0167:0040bd3d 50                  push    eax
 0167:0040bd3e 6800104000          push    00401000
 0167:0040bd43 57                  push    edi
 0167:0040bd44 56                  push    esi
 0167:0040bd45 e8a6f60800          call    0049b3f0 = TCLKIT.EXE:.text+0x9a3f0
TCLKIT.EXE:.text+0xad4a:
*0167:0040bd4a 83c410              add     esp,+10
 0167:0040bd4d b801000000          mov     eax,00000001
 0167:0040bd52 5f                  pop     edi
 0167:0040bd53 5e                  pop     esi
 0167:0040bd54 5d                  pop     ebp
 0167:0040bd55 5b                  pop     ebx
 0167:0040bd56 81c420010000        add     esp,00000120
 0167:0040bd5c c21000              retd    0010
 0167:0040bd5f 90                  nop
 0167:0040bd60 8b4c2404            mov     ecx,dword ptr [esp+04]
 0167:0040bd64 81ec00040000        sub     esp,00000400

--------------------


007dfc60 00000001
007dfc64 00900d04 -> 22 0d 90 00 00 00 00 00 48 3a 5c 6c 61 73 74 6b ".......H:\lastk
007dfc68 00401000 = TCLKIT.EXE:.text+0x0
                  -> 56 6a 00 68 20 66 54 00 68 9c a2 55 00 6a 00 e8 Vj.h fT.h..U.j..
007dfc6c 00900660 -> 00 00 00 00 00 00 00 00 01 00 00 00 c8 39 56 00 .............9V.
007dfc70 00000000
007dfc74 81624164 -> 48 3a 5c 6c 61 73 74 6b 69 74 5c 74 63 6c 38 34 H:\lastkit\tcl84
007dfc78 007dfe38 -> 78 ff 7d 00 60 b5 f8 bf 00 00 00 00 cc 3f 62 81 x.}.`........?b.
007dfc7c 00000000
007dfc80 00900d08 -> 00 00 00 00 48 3a 5c 6c 61 73 74 6b 69 74 5c 74 ....H:\lastkit\t
007dfc84 00000001
007dfc88 00000002
007dfc8c 00000000
007dfc90 00900d00 -> 98 fc 7d 00 22 0d 90 00 00 00 00 00 48 3a 5c 6c ..}.".......H:\l
007dfc94 00000002
007dfc98 4c2f3a48
007dfc9c 4b545341
007dfca0 542f5449
007dfca4 494b4c43
007dfca8 58452e54
007dfcac 02be0045
007dfcb0 000002be
007dfcb4 bff942e1 = KERNEL32.DLL:.text+0x1b2e1
                 
--------------------

 0167:bff942c9 52                  push    edx
 0167:bff942ca 8b4320              mov     eax,dword ptr [ebx+20]
 0167:bff942cd 0bc0                or      eax,eax
 0167:bff942cf 7400                jz      bff942d1 = KERNEL32.DLL:.text+0x1b2d1
 0167:bff942d1 5a                  pop     edx
 0167:bff942d2 58                  pop     eax
 0167:bff942d3 8d0c24              lea     ecx,[esp]
 0167:bff942d6 51                  push    ecx
 0167:bff942d7 6803000000          push    00000003
 0167:bff942dc e8a8d8fdff          call    bff71b89 = KERNEL32.DLL!UnMapSLFixArray
KERNEL32.DLL:.text+0x1b2e1:
*0167:bff942e1 e902f9ffff          jmp     bff93be8 = KERNEL32.DLL:.text+0x1abe8
 0167:bff942e6 33c0                xor     eax,eax
 0167:bff942e8 50                  push    eax
 0167:bff942e9 8b4316              mov     eax,dword ptr [ebx+16]
 0167:bff942ec 890424              mov     dword ptr [esp],eax
 0167:bff942ef 50                  push    eax
 0167:bff942f0 e8bed7fdff          call    bff71ab3 = KERNEL32.DLL!MapSLFix
 0167:bff942f5 50                  push    eax
 0167:bff942f6 0fb7431a            movzx   eax,word ptr [ebx+1a]
 0167:bff942fa 50                  push    eax
 0167:bff942fb e8050b0000          call    bff94e05 = KERNEL32.DLL:.text+0x1be05

--------------------


007dfcb8 00000000
007dfcbc 007dfcc0 -> c8 0d 8f 24 f4 14 5f 01 20 17 5f 01 00 00 00 00 ...$.._. ._.....
007dfcc0 248f0dc8
007dfcc4 015f14f4
007dfcc8 015f1720
007dfccc 00000000
007dfcd0 bff719b8 = KERNEL32.DLL:_FREQASM+0x9b8
                 
--------------------

 0167:bff71991 51                  push    ecx
 0167:bff71992 c1cf10              ror     edi,10
 0167:bff71995 6664873d0e000000    xchg    word ptr fs:[0000000e],di
 0167:bff7199d 57                  push    edi
 0167:bff7199e 686d18f7bf          push    bff7186d
 0167:bff719a3 64ff3500000000      push    dword ptr fs:[00000000]
 0167:bff719aa 64892500000000      mov     dword ptr fs:[00000000],esp
 0167:bff719b1 55                  push    ebp
 0167:bff719b2 8d6c24fc            lea     ebp,[esp-04]
 0167:bff719b6 ffd2                call    edx
KERNEL32.DLL:_FREQASM+0x9b8:
*0167:bff719b8 5d                  pop     ebp
 0167:bff719b9 0fb6c9              movzx   ecx,cl
 0167:bff719bc 648f0500000000      pop     dword ptr fs:[00000000]
 0167:bff719c3 8d642404            lea     esp,[esp+04]
 0167:bff719c7 5f                  pop     edi
 0167:bff719c8 6664893d0e000000    mov     word ptr fs:[0000000e],di
 0167:bff719d0 5b                  pop     ebx
 0167:bff719d1 660fb22424          lss     sp,dword ptr [esp]
 0167:bff719d6 6664891d1e000000    mov     word ptr fs:[0000001e],bx
 0167:bff719de 5b                  pop     ebx
 0167:bff719df 0bdb                or      ebx,ebx

--------------------


007dfcd4 00008d22
007dfcd8 007dff68 -> ff ff ff ff b4 05 fc bf 38 91 f7 bf 00 00 00 00 ........8.......
007dfcdc bff7186d = KERNEL32.DLL:_FREQASM+0x86d
                 
--------------------

 0167:bff7183d 8b157094fcbf        mov     edx,dword ptr [bffc9470]
 0167:bff71843 e8b3290000          call    bff741fb = KERNEL32.DLL:_FREQASM+0x31fb
 0167:bff71848 6664c7051e000000ffff mov     word ptr fs:[0000001e],ffff
 0167:bff71852 ff5326              call    dword ptr [ebx+26]
 0167:bff71855 8b157094fcbf        mov     edx,dword ptr [bffc9470]
 0167:bff7185b e857290000          call    bff741b7 = KERNEL32.DLL:_FREQASM+0x31b7
 0167:bff71860 6664ff051e000000    inc     word ptr fs:[0000001e]
 0167:bff71868 b114                mov     cl,14
 0167:bff7186a 8be5                mov     esp,ebp
 0167:bff7186c c3                  retd
KERNEL32.DLL:_FREQASM+0x86d:
*0167:bff7186d 8b442404            mov     eax,dword ptr [esp+04]
 0167:bff71871 f7400406000000      test    dword ptr [eax+04],00000006
 0167:bff71878 7419                jz      bff71893 = KERNEL32.DLL:_FREQASM+0x893
 0167:bff7187a 8b442408            mov     eax,dword ptr [esp+08]
 0167:bff7187e 8178046d18f7bf      cmp     dword ptr [eax+04],bff7186d
 0167:bff71885 750c                jnz     bff71893 = KERNEL32.DLL:_FREQASM+0x893
 0167:bff71887 668b4808            mov     cx,word ptr [eax+08]
 0167:bff7188b 6664890d0e000000    mov     word ptr fs:[0000000e],cx
 0167:bff71893 b801000000          mov     eax,00000001
 0167:bff71898 c3                  retd
 0167:bff71899 9d                  popfd

--------------------


007dfce0 8cee0d7f
007dfce4 00000000
007dfce8 000c8cee
007dfcec 0000003f
007dfcf0 8162414c -> 22 48 3a 5c 6c 61 73 74 6b 69 74 5c 74 63 6c 6b "H:\lastkit\tclk
007dfcf4 00000036
007dfcf8 bff7b9c5 = KERNEL32.DLL:.text+0x29c5
                 
--------------------

 0167:bff7b9a9 e81389ffff          call    bff742c1 = KERNEL32.DLL:_FREQASM+0x32c1
 0167:bff7b9ae 5e                  pop     esi
 0167:bff7b9af c20400              retd    0004
 0167:bff7b9b2 56                  push    esi
 0167:bff7b9b3 8b742408            mov     esi,dword ptr [esp+08]
 0167:bff7b9b7 8a06                mov     al,byte ptr [esi]
 0167:bff7b9b9 3c04                cmp     al,04
 0167:bff7b9bb 7508                jnz     bff7b9c5 = KERNEL32.DLL:.text+0x29c5
 0167:bff7b9bd ff7604              push    dword ptr [esi+04]
 0167:bff7b9c0 e82989ffff          call    bff742ee = KERNEL32.DLL:_FREQASM+0x32ee
KERNEL32.DLL:.text+0x29c5:
*0167:bff7b9c5 5e                  pop     esi
 0167:bff7b9c6 c20400              retd    0004
 0167:bff7b9c9 64a100000000        mov     eax,dword ptr fs:[00000000]
 0167:bff7b9cf 55                  push    ebp
 0167:bff7b9d0 8bec                mov     ebp,esp
 0167:bff7b9d2 6aff                push    -01
 0167:bff7b9d4 685092f7bf          push    bff79250
 0167:bff7b9d9 68b405fcbf          push    bffc05b4
 0167:bff7b9de 50                  push    eax
 0167:bff7b9df 8b4508              mov     eax,dword ptr [ebp+08]
 0167:bff7b9e2 64892500000000      mov     dword ptr fs:[00000000],esp

--------------------


007dfcfc 81623f2c -> 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
007dfd00 00000036
007dfd04 780012b1 = MSVCRT.DLL:.text+0x2b1
                 
--------------------

 0167:7800128d 8816                mov     byte ptr [esi],dl
 0167:7800128f 8d4608              lea     eax,[esi+08]
 0167:78001292 e91fffffff          jmp     780011b6 = MSVCRT.DLL:.text+0x1b6
 0167:78001297 33c0                xor     eax,eax
 0167:78001299 e920ffffff          jmp     780011be = MSVCRT.DLL:.text+0x1be
 0167:7800129e 55                  push    ebp
 0167:7800129f 8bec                mov     ebp,esp
 0167:780012a1 8b4508              mov     eax,dword ptr [ebp+08]
 0167:780012a4 ff348528700378      push    dword ptr [eax*4+78037028]
 0167:780012ab ff1548e00278        call    dword ptr [7802e048] -> KERNEL32.DLL!LeaveCriticalSection
MSVCRT.DLL:.text+0x2b1:
*0167:780012b1 5d                  pop     ebp
 0167:780012b2 c3                  retd
 0167:780012b3 ff3550710378        push    dword ptr [78037150]
 0167:780012b9 ff742408            push    dword ptr [esp+08]
 0167:780012bd e803000000          call    780012c5 = MSVCRT.DLL:.text+0x2c5
 0167:780012c2 59                  pop     ecx
 0167:780012c3 59                  pop     ecx
 0167:780012c4 c3                  retd
 0167:780012c5 837c2404e0          cmp     dword ptr [esp+04],-20
 0167:780012ca 0f878bb90000        ja      7800cc5b = MSVCRT.DLL:.text+0xbc5b
 0167:780012d0 ff742404            push    dword ptr [esp+04]

--------------------


007dfd08 78037118 = MSVCRT.DLL:.data+0x2118
                  -> 04 00 00 00 2c 3f 62 81 00 00 00 00 00 00 00 00 ....,?b.........
007dfd0c 007dfd44 -> 88 fd 7d 00 d9 12 00 78 36 00 00 00 4c 41 62 81 ..}....x6...LAb.
007dfd10 7800ccb3 = MSVCRT.DLL:.text+0xbcb3
                 
--------------------

 0167:7800cc9a 85c0                test    eax,eax
 0167:7800cc9c 7503                jnz     7800cca1 = MSVCRT.DLL:.text+0xbca1
 0167:7800cc9e 6a01                push    +01
 0167:7800cca0 58                  pop     eax
 0167:7800cca1 83c00f              add     eax,+0f
 0167:7800cca4 24f0                and     al,f0
 0167:7800cca6 50                  push    eax
 0167:7800cca7 e9cb46ffff          jmp     78001377 = MSVCRT.DLL:.text+0x377
 0167:7800ccac 6a09                push    +09
 0167:7800ccae e8eb45ffff          call    7800129e = MSVCRT.DLL!_unlock
MSVCRT.DLL:.text+0xbcb3:
*0167:7800ccb3 59                  pop     ecx
 0167:7800ccb4 c3                  retd
 0167:7800ccb5 6a10                push    +10
 0167:7800ccb7 5e                  pop     esi
 0167:7800ccb8 e97146ffff          jmp     7800132e = MSVCRT.DLL:.text+0x32e
 0167:7800ccbd 8b7508              mov     esi,dword ptr [ebp+08]
 0167:7800ccc0 e9c246ffff          jmp     78001387 = MSVCRT.DLL:.text+0x387
 0167:7800ccc5 6a01                push    +01
 0167:7800ccc7 58                  pop     eax
 0167:7800ccc8 e9b06dffff          jmp     78003a7d = MSVCRT.DLL:.text+0x2a7d
 0167:7800cccd 33db                xor     ebx,ebx

--------------------


007dfd14 00000009
007dfd18 7800cc8c = MSVCRT.DLL:.text+0xbc8c
                 
--------------------

 0167:7800cc6c 2a6a09              sub     ch,byte ptr [edx+09]
 0167:7800cc6f e8e143ffff          call    78001055 = MSVCRT.DLL!_lock
 0167:7800cc74 59                  pop     ecx
 0167:7800cc75 8365fc00            and     dword ptr [ebp-04],+00
 0167:7800cc79 56                  push    esi
 0167:7800cc7a e8e2060000          call    7800d361 = MSVCRT.DLL:.text+0xc361
 0167:7800cc7f 59                  pop     ecx
 0167:7800cc80 8945e4              mov     dword ptr [ebp-1c],eax
 0167:7800cc83 834dfcff            or      dword ptr [ebp-04],-01
 0167:7800cc87 e820000000          call    7800ccac = MSVCRT.DLL:.text+0xbcac
MSVCRT.DLL:.text+0xbc8c:
*0167:7800cc8c 8b45e4              mov     eax,dword ptr [ebp-1c]
 0167:7800cc8f 85c0                test    eax,eax
 0167:7800cc91 0f85d046ffff        jnz     78001367 = MSVCRT.DLL:.text+0x367
 0167:7800cc97 8b4508              mov     eax,dword ptr [ebp+08]
 0167:7800cc9a 85c0                test    eax,eax
 0167:7800cc9c 7503                jnz     7800cca1 = MSVCRT.DLL:.text+0xbca1
 0167:7800cc9e 6a01                push    +01
 0167:7800cca0 58                  pop     eax
 0167:7800cca1 83c00f              add     eax,+0f
 0167:7800cca4 24f0                and     al,f0
 0167:7800cca6 50                  push    eax

--------------------


007dfd1c 8162414c -> 22 48 3a 5c 6c 61 73 74 6b 69 74 5c 74 63 6c 6b "H:\lastkit\tclk
007dfd20 7803b3f0 = MSVCRT.DLL:.data+0x63f0
                  -> 48 3a 5c 4c 41 53 54 4b 49 54 5c 54 43 4c 4b 49 H:\LASTKIT\TCLKI
007dfd24 00000000
007dfd28 00900d40 -> 4c 0d 90 00 62 0d 90 00 00 00 00 00 48 3a 5c 6c L...b.......H:\l
007dfd2c 00000000
     ...
007dfd34 007dfe28 -> 68 ff 7d 00 a2 33 55 00 e0 71 55 00 00 00 00 00 h.}..3U..qU.....
007dfd38 7800ef03 = MSVCRT.DLL!_except_handler3
                  -> 55 8b ec 83 ec 08 53 56 57 55 fc 8b 5d 0c 8b 45 U.....SVWU..]..E
007dfd3c 7802e248 = MSVCRT.DLL:.rdata+0x248
                  -> ff ff ff ff 00 00 00 00 ac cc 00 78 ff ff ff ff ...........x....
007dfd40 ffffffff
007dfd44 007dfd88 -> 44 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 D...............
007dfd48 780012d9 = MSVCRT.DLL:.text+0x2d9
                 
--------------------

 0167:780012b3 ff3550710378        push    dword ptr [78037150]
 0167:780012b9 ff742408            push    dword ptr [esp+08]
 0167:780012bd e803000000          call    780012c5 = MSVCRT.DLL:.text+0x2c5
 0167:780012c2 59                  pop     ecx
 0167:780012c3 59                  pop     ecx
 0167:780012c4 c3                  retd
 0167:780012c5 837c2404e0          cmp     dword ptr [esp+04],-20
 0167:780012ca 0f878bb90000        ja      7800cc5b = MSVCRT.DLL:.text+0xbc5b
 0167:780012d0 ff742404            push    dword ptr [esp+04]
 0167:780012d4 e80a000000          call    780012e3 = MSVCRT.DLL:.text+0x2e3
MSVCRT.DLL:.text+0x2d9:
*0167:780012d9 85c0                test    eax,eax
 0167:780012db 59                  pop     ecx
 0167:780012dc 0f845db90000        jz      7800cc3f = MSVCRT.DLL:.text+0xbc3f
 0167:780012e2 c3                  retd
 0167:780012e3 55                  push    ebp
 0167:780012e4 8bec                mov     ebp,esp
 0167:780012e6 6aff                push    -01
 0167:780012e8 6848e20278          push    7802e248
 0167:780012ed 6803ef0078          push    7800ef03
 0167:780012f2 64a100000000        mov     eax,dword ptr fs:[00000000]
 0167:780012f8 50                  push    eax

--------------------


007dfd4c 00000036
007dfd50 8162414c -> 22 48 3a 5c 6c 61 73 74 6b 69 74 5c 74 63 6c 6b "H:\lastkit\tclk
007dfd54 00900d40 -> 4c 0d 90 00 62 0d 90 00 00 00 00 00 48 3a 5c 6c L...b.......H:\l
007dfd58 00000000
007dfd5c 007dfd88 -> 44 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 D...............
007dfd60 7800bc32 = MSVCRT.DLL:.text+0xac32
                 
--------------------

 0167:7800bc1c 8d45f8              lea     eax,[ebp-08]
 0167:7800bc1f 50                  push    eax
 0167:7800bc20 8d45fc              lea     eax,[ebp-04]
 0167:7800bc23 50                  push    eax
 0167:7800bc24 8b45fc              mov     eax,dword ptr [ebp-04]
 0167:7800bc27 8d0486              lea     eax,[esi+eax*4]
 0167:7800bc2a 50                  push    eax
 0167:7800bc2b 56                  push    esi
 0167:7800bc2c 57                  push    edi
 0167:7800bc2d e816000000          call    7800bc48 = MSVCRT.DLL:.text+0xac48
MSVCRT.DLL:.text+0xac32:
*0167:7800bc32 8b45fc              mov     eax,dword ptr [ebp-04]
 0167:7800bc35 83c414              add     esp,+14
 0167:7800bc38 48                  dec     eax
 0167:7800bc39 8935d8b30378        mov     dword ptr [7803b3d8],esi
 0167:7800bc3f 5f                  pop     edi
 0167:7800bc40 a3f48e0378          mov     dword ptr [78038ef4],eax
 0167:7800bc45 5e                  pop     esi
 0167:7800bc46 c9                  leave
 0167:7800bc47 c3                  retd
 0167:7800bc48 55                  push    ebp
 0167:7800bc49 8bec                mov     ebp,esp

--------------------


007dfd64 00000001
007dfd68 00900d48 -> 00 00 00 00 48 3a 5c 6c 61 73 74 6b 69 74 5c 74 ....H:\lastkit\t
007dfd6c 00900d4c -> 48 3a 5c 6c 61 73 74 6b 69 74 5c 74 63 6c 6b 69 H:\lastkit\tclki
007dfd70 007dfd84 -> 03 00 00 00 44 00 00 00 00 00 00 00 02 00 00 00 ....D...........
007dfd74 00000000
     ...
007dfd7c 81623fcc -> 06 00 06 00 b0 1e 4a c1 00 00 00 00 00 00 00 00 ......J.........
007dfd80 0000002a
007dfd84 00000003
007dfd88 00000044
007dfd8c 00000000
007dfd90 00000002
007dfd94 00000000
     ...
007dfd9c 007dfe38 -> 78 ff 7d 00 60 b5 f8 bf 00 00 00 00 cc 3f 62 81 x.}.`........?b.
007dfda0 005530ca = TCLKIT.EXE:.text+0x1520ca
                 
--------------------

 0167:005530b5 ebf5                jmp     005530ac = TCLKIT.EXE:.text+0x1520ac
 0167:005530b7 6a0a                push    +0a
 0167:005530b9 58                  pop     eax
 0167:005530ba 50                  push    eax
 0167:005530bb 56                  push    esi
 0167:005530bc 53                  push    ebx
 0167:005530bd 53                  push    ebx
 0167:005530be ff15e8415500        call    dword ptr [005541e8] -> KERNEL32.DLL!GetModuleHandleA
 0167:005530c4 50                  push    eax
 0167:005530c5 e8968aebff          call    0040bb60 = TCLKIT.EXE:.text+0xab60
TCLKIT.EXE:.text+0x1520ca:
*0167:005530ca 894598              mov     dword ptr [ebp-68],eax
 0167:005530cd 50                  push    eax
 0167:005530ce ff15c0445500        call    dword ptr [005544c0] -> MSVCRT.DLL!exit
 0167:005530d4 8b45ec              mov     eax,dword ptr [ebp-14]
 0167:005530d7 8b08                mov     ecx,dword ptr [eax]
 0167:005530d9 8b09                mov     ecx,dword ptr [ecx]
 0167:005530db 894d88              mov     dword ptr [ebp-78],ecx
 0167:005530de 50                  push    eax
 0167:005530df 51                  push    ecx
 0167:005530e0 e885030000          call    0055346a = MSVCRT.DLL!_XcptFilter
 0167:005530e5 59                  pop     ecx

--------------------


007dfda4 00400000 = TCLKIT.EXE+0x0
                  -> 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
007dfda8 00000000
007dfdac 81624164 -> 48 3a 5c 6c 61 73 74 6b 69 74 5c 74 63 6c 38 34 H:\lastkit\tcl84
007dfdb0 00000001
007dfdb4 00000000
007dfdb8 81623fcc -> 06 00 06 00 b0 1e 4a c1 00 00 00 00 00 00 00 00 ......J.........
007dfdbc 006d0000
007dfdc0 c0000005
007dfdc4 81624164 -> 48 3a 5c 6c 61 73 74 6b 69 74 5c 74 63 6c 38 34 H:\lastkit\tcl84
007dfdc8 00900d40 -> 4c 0d 90 00 62 0d 90 00 00 00 00 00 48 3a 5c 6c L...b.......H:\l
007dfdcc 00000000
     ...
007dfdd4 00900e80 -> 60 0e 90 00 40 0e 90 00 20 0e 90 00 00 0e 90 00 `...@... .......
007dfdd8 00000002
007dfddc 00000044
007dfde0 00000000
     ...
007dfe08 00000001
     ...
007dfe10 00000000
     ...
007dfe20 007dfdb4 -> 00 00 00 00 cc 3f 62 81 00 00 6d 00 05 00 00 c0 .....?b...m.....
007dfe24 007df428 -> 00 f5 7d 00 1c f5 7d 00 54 f4 7d 00 49 68 f7 bf ..}...}.T.}.Ih..
007dfe28 007dff68 -> ff ff ff ff b4 05 fc bf 38 91 f7 bf 00 00 00 00 ........8.......
007dfe2c 005533a2 = TCLKIT.EXE:.text+0x1523a2
                 
--------------------

 0167:0055338b 2b44240c            sub     eax,dword ptr [esp+0c]
 0167:0055338f 1b542410            sbb     edx,dword ptr [esp+10]
 0167:00553393 4f                  dec     edi
 0167:00553394 7907                jns     0055339d = TCLKIT.EXE:.text+0x15239d
 0167:00553396 f7da                neg     edx
 0167:00553398 f7d8                neg     eax
 0167:0055339a 83da00              sbb     edx,+00
 0167:0055339d 5f                  pop     edi
 0167:0055339e 5b                  pop     ebx
 0167:0055339f c21000              retd    0010
TCLKIT.EXE:.text+0x1523a2:
*0167:005533a2 ff2520455500        jmp     dword ptr [00554520] -> MSVCRT.DLL!_except_handler3
 0167:005533a8 cc                  int     3
 0167:005533a9 cc                  int     3
 0167:005533aa cc                  int     3
 0167:005533ab cc                  int     3
 0167:005533ac cc                  int     3
 0167:005533ad cc                  int     3
 0167:005533ae cc                  int     3
 0167:005533af cc                  int     3
 0167:005533b0 53                  push    ebx
 0167:005533b1 56                  push    esi

--------------------


007dfe30 005571e0 = TCLKIT.EXE:.rdata+0x31e0
                  -> ff ff ff ff d4 30 55 00 e8 30 55 00 50 74 15 00 .....0U..0U.Pt..
007dfe34 00000000
007dfe38 007dff78 -> f4 ff 7d 00 12 b4 f8 bf 2c bb 61 81 08 00 00 00 ..}.....,.a.....
007dfe3c bff8b560 = KERNEL32!ApplicationStartup
                 
--------------------

 0167:bff8b53c 7413                jz      bff8b551 = KERNEL32.DLL:.text+0x12551
 0167:bff8b53e 6a00                push    +00
 0167:bff8b540 56                  push    esi
 0167:bff8b541 e82859ffff          call    bff80e6e = KERNEL32.DLL:.text+0x7e6e
 0167:bff8b546 50                  push    eax
 0167:bff8b547 6800050000          push    00000500
 0167:bff8b54c e8c45fffff          call    bff81515 = KERNEL32.DLL:.text+0x8515
 0167:bff8b551 c745fc00000000      mov     dword ptr [ebp-04],00000000
 0167:bff8b558 8b45d4              mov     eax,dword ptr [ebp-2c]
 0167:bff8b55b e8b98dfeff          call    bff74319 = KERNEL32.DLL:_FREQASM+0x3319
KERNEL32!ApplicationStartup:
*0167:bff8b560 8945d8              mov     dword ptr [ebp-28],eax
 0167:bff8b563 eb1a                jmp     bff8b57f = KERNEL32.DLL:.text+0x1257f
 0167:bff8b565 ff75ec              push    dword ptr [ebp-14]
 0167:bff8b568 e8c7250100          call    bff9db34 = KERNEL32.DLL!UnhandledExceptionFilter
 0167:bff8b56d c3                  retd
 0167:bff8b56e 8b65e8              mov     esp,dword ptr [ebp-18]
 0167:bff8b571 8b45e0              mov     eax,dword ptr [ebp-20]
 0167:bff8b574 80480308            or      byte ptr [eax+03],08
 0167:bff8b578 6aff                push    -01
 0167:bff8b57a e8501c0000          call    bff8d1cf = KERNEL32.DLL:.text+0x141cf
 0167:bff8b57f c745fcffffffff      mov     dword ptr [ebp-04],ffffffff

--------------------


007dfe40 00000000
007dfe44 81623fcc -> 06 00 06 00 b0 1e 4a c1 00 00 00 00 00 00 00 00 ......J.........
007dfe48 006d0000
007dfe4c 6b6c6354
007dfe50 45007469
007dfe54 00004558
007dfe58 00000000
     ...
007dff38 007dff6c -> b4 05 fc bf 38 91 f7 bf 00 00 00 00 f4 ff 7d 00 ....8.........}.
007dff3c 8160c050 -> 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
007dff40 816203dc -> 1c 00 00 a0 50 b7 70 81 50 b7 70 81 50 b7 70 81 ....P.p.P.p.P.p.
007dff44 c14a2000 -> 01 00 00 00 2c bb 61 81 cc 3f 62 81 50 1f 4a c1 ....,.a..?b.P.J.
007dff48 007dff6c -> b4 05 fc bf 38 91 f7 bf 00 00 00 00 f4 ff 7d 00 ....8.........}.
007dff4c 00552f96 = TCLKIT.EXE:.text+0x151f96
                  -> 55 8b ec 6a ff 68 e0 71 55 00 68 a2 33 55 00 64 U..j.h.qU.h.3U.d
007dff50 bff7b326 = KERNEL32.DLL:.text+0x2326
                 
--------------------

 0167:bff7b309 8b00                mov     eax,dword ptr [eax]
 0167:bff7b30b 894304              mov     dword ptr [ebx+04],eax
 0167:bff7b30e 6800020000          push    00000200
 0167:bff7b313 51                  push    ecx
 0167:bff7b314 ff75fc              push    dword ptr [ebp-04]
 0167:bff7b317 56                  push    esi
 0167:bff7b318 e8f4edffff          call    bff7a111 = KERNEL32.DLL:.text+0x1111
 0167:bff7b31d ff750c              push    dword ptr [ebp+0c]
 0167:bff7b320 56                  push    esi
 0167:bff7b321 e8caedffff          call    bff7a0f0 = KERNEL32.DLL:.text+0x10f0
KERNEL32.DLL:.text+0x2326:
*0167:bff7b326 b801000000          mov     eax,00000001
 0167:bff7b32b 5f                  pop     edi
 0167:bff7b32c 5e                  pop     esi
 0167:bff7b32d 5b                  pop     ebx
 0167:bff7b32e 8be5                mov     esp,ebp
 0167:bff7b330 5d                  pop     ebp
 0167:bff7b331 c20c00              retd    000c
 0167:bff7b334 55                  push    ebp
 0167:bff7b335 8bec                mov     ebp,esp
 0167:bff7b337 83ec04              sub     esp,+04
 0167:bff7b33a a1e49cfcbf          mov     eax,dword ptr [bffc9ce4]

--------------------


007dff54 00000000
007dff58 81623fec -> 00 02 00 00 00 44 01 00 3f 31 29 00 02 00 02 00 .....D..?1).....
007dff5c 0d760000
007dff60 007dfe40 -> 00 00 00 00 cc 3f 62 81 00 00 6d 00 54 63 6c 6b .....?b...m.Tclk
007dff64 006d0000
007dff68 ffffffff
007dff6c bffc05b4 = KERNEL32.DLL:.text+0x475b4
                  -> 55 8b ec 83 ec 08 53 56 57 55 fc 8b 5d 0c 8b 45 U.....SVWU..]..E
007dff70 bff79138 = KERNEL32.DLL:.text+0x138
                  -> ff ff ff ff 65 b5 f8 bf 6e b5 f8 bf 00 00 00 00 ....e...n.......
007dff74 00000000
007dff78 007dfff4 -> ec df a6 82 d5 9d f8 bf 00 00 00 00             ............
007dff7c bff8b412 = KERNEL32.DLL:.text+0x12412
                 
--------------------

 0167:bff8b3f3 ff7508              push    dword ptr [ebp+08]
 0167:bff8b3f6 56                  push    esi
 0167:bff8b3f7 e8c9560000          call    bff90ac5 = KERNEL32.DLL:.text+0x17ac5
 0167:bff8b3fc ff7508              push    dword ptr [ebp+08]
 0167:bff8b3ff 33ff                xor     edi,edi
 0167:bff8b401 57                  push    edi
 0167:bff8b402 ff7634              push    dword ptr [esi+34]
 0167:bff8b405 e80397feff          call    bff74b0d = KERNEL32.DLL:_FREQASM+0x3b0d
 0167:bff8b40a 897d08              mov     dword ptr [ebp+08],edi
 0167:bff8b40d e84a000000          call    bff8b45c = KERNEL32.DLL:.text+0x1245c
KERNEL32.DLL:.text+0x12412:
*0167:bff8b412 a1e49cfcbf          mov     eax,dword ptr [bffc9ce4]
 0167:bff8b417 8b00                mov     eax,dword ptr [eax]
 0167:bff8b419 83c060              add     eax,+60
 0167:bff8b41c 50                  push    eax
 0167:bff8b41d e8cb8dfeff          call    bff741ed = KERNEL32.DLL!98
 0167:bff8b422 e87626ffff          call    bff7da9d = KERNEL32.DLL:.text+0x4a9d
 0167:bff8b427 8945f0              mov     dword ptr [ebp-10],eax
 0167:bff8b42a 837df800            cmp     dword ptr [ebp-08],+00
 0167:bff8b42e 7408                jz      bff8b438 = KERNEL32.DLL:.text+0x12438
 0167:bff8b430 ff75f8              push    dword ptr [ebp-08]
 0167:bff8b433 e843020000          call    bff8b67b = KERNEL32.DLL:.text+0x1267b

--------------------


007dff80 8161bb2c -> 07 00 00 00 e0 1f 4a c1 d4 f3 7d 00 00 00 7e 00 ......J...}.....
007dff84 00000008
007dff88 81623fcc -> 06 00 06 00 b0 1e 4a c1 00 00 00 00 00 00 00 00 ......J.........
007dff8c 00000000
     ...
007dffd0 0002ffff
007dffd4 0000f27d
007dffd8 007de000 -> 34 8e 59 00 34 00 00 00 24 e0 7d 00 1c e0 7d 00 4.Y.4...$.}...}.
007dffdc 007e0000
007dffe0 00000000
007dffe4 ffffffff
007dffe8 8161bdb8 -> 50 45 00 00 4c 01 04 00 80 52 a8 3d 00 00 00 00 PE..L....R.=....
007dffec 00000000
007dfff0 247f0d76
007dfff4 82a6dfec
007dfff8 bff89dd5 = KERNEL32.DLL:.text+0x10dd5
                 
--------------------

 0167:bff89db2 e8a94b0000          call    bff8e960 = KERNEL32.DLL:.text+0x15960
 0167:bff89db7 56                  push    esi
 0167:bff89db8 e8e32bffff          call    bff7c9a0 = KERNEL32.DLL:.text+0x39a0
 0167:bff89dbd 33c0                xor     eax,eax
 0167:bff89dbf ebdf                jmp     bff89da0 = KERNEL32.DLL:.text+0x10da0
 0167:bff89dc1 f644240c10          test    byte ptr [esp+0c],10
 0167:bff89dc6 7505                jnz     bff89dcd = KERNEL32.DLL:.text+0x10dcd
 0167:bff89dc8 e8a1deffff          call    bff87c6e = KERNEL32.DLL:.text+0xec6e
 0167:bff89dcd ff742408            push    dword ptr [esp+08]
 0167:bff89dd1 ff542408            call    dword ptr [esp+08]
KERNEL32.DLL:.text+0x10dd5:
*0167:bff89dd5 c20c00              retd    000c
 0167:bff89dd8 56                  push    esi
 0167:bff89dd9 a1e49cfcbf          mov     eax,dword ptr [bffc9ce4]
 0167:bff89dde 8b742408            mov     esi,dword ptr [esp+08]
 0167:bff89de2 57                  push    edi
 0167:bff89de3 8b38                mov     edi,dword ptr [eax]
 0167:bff89de5 8b4608              mov     eax,dword ptr [esi+08]
 0167:bff89de8 85c0                test    eax,eax
 0167:bff89dea 7413                jz      bff89dff = KERNEL32.DLL:.text+0x10dff
 0167:bff89dec 50                  push    eax
 0167:bff89ded e8feb7feff          call    bff755f0 = KERNEL32.DLL:_FREQASM+0x45f0

--------------------


007dfffc 00000000


