I use nasm (intel syntax) to produce object file. "nasm myasm.asm -f win32"
then use polink to link. "polink -machine:x86 -subsystem:console -out:myasm.exe myasm.obj crt.lib kernel32.lib"
the problematic call instruction is at 0x004160B7, 0x00413CAB should not be called.
CPU Disasm
Address Hex dump Command Comments
00416000 /. 55 PUSH EBP
00416001 |. 89E5 MOV EBP,ESP
00416003 |. 6A FF PUSH -1
00416005 |. 68 00804100 PUSH OFFSET 00418000
0041600A |. 68 08614100 PUSH 00416108
0041600F |. 64:FF35 00000 PUSH DWORD PTR FS:[0]
00416016 |. 64:8925 00000 MOV DWORD PTR FS:[0],ESP ; Installs SE handler 416108
0041601D |. 83EC 0C SUB ESP,0C
00416020 |. 53 PUSH EBX
00416021 |. 56 PUSH ESI
00416022 |. 57 PUSH EDI
00416023 |. 8965 E8 MOV DWORD PTR SS:[LOCAL.6],ESP
00416026 |. 68 00000002 PUSH 2000000 ; /Arg1 = 2000000
0041602B |. E8 300C0000 CALL 00416C60 ; \win32.00416C60
00416030 |. 59 POP ECX
00416031 |. A3 8C914100 MOV DWORD PTR DS:[41918C],EAX
00416036 |. E8 E5020000 CALL 00416320
0041603B |. 85C0 TEST EAX,EAX
0041603D |. 75 0D JNE SHORT 0041604C
0041603F |. 6A 01 PUSH 1 ; /Arg1 = 1
00416041 |. E8 1A050000 CALL 00416560 ; \win32.00416560
00416046 |. 59 POP ECX
00416047 |. E9 9B000000 JMP 004160E7
0041604C |> C745 FC 00000 MOV DWORD PTR SS:[LOCAL.1],0
00416053 |. E8 18050000 CALL 00416570
00416058 |. E8 D3050000 CALL 00416630 ; [win32.00416630
0041605D |. E8 1E060000 CALL 00416680 ; [win32.00416680
00416062 |. E8 290A0000 CALL 00416A90 ; [win32.00416A90
00416067 |. E8 C40A0000 CALL 00416B30 ; [win32.00416B30
0041606C |. BB 84804100 MOV EBX,OFFSET 00418084
00416071 |. 81FB 84804100 CMP EBX,OFFSET 00418084
00416077 |. 73 0D JNB SHORT 00416086
00416079 |> FF13 /CALL DWORD PTR DS:[EBX]
0041607B |. 83C3 04 |ADD EBX,4
0041607E |. 81FB 84804100 |CMP EBX,OFFSET 00418084
00416084 |.^ 72 F3 \JB SHORT 00416079
00416086 |> A1 78914100 MOV EAX,DWORD PTR DS:[419178]
0041608B |. 50 PUSH EAX ; /Arg2 => [419178] = 0
0041608C |. A1 74914100 MOV EAX,DWORD PTR DS:[419174] ; |
00416091 |. 50 PUSH EAX ; |Arg1 => [419174] = 0
00416092 |. E8 69AFFEFF CALL 00401000 ; \win32.00401000
00416097 |. 83C4 08 ADD ESP,8
0041609A |. 89C3 MOV EBX,EAX
0041609C |. BE 84804100 MOV ESI,OFFSET 00418084
004160A1 |. 81FE 84804100 CMP ESI,OFFSET 00418084
004160A7 |. 73 0D JNB SHORT 004160B6
004160A9 |> FF16 /CALL DWORD PTR DS:[ESI]
004160AB |. 83C6 04 |ADD ESI,4
004160AE |. 81FE 84804100 |CMP ESI,OFFSET 00418084
004160B4 |.^ 72 F3 \JB SHORT 004160A9
004160B6 |> 53 PUSH EBX ; /Arg1
004160B7 |. E8 EFDBFFFF CALL 00413CAB ; \win32.00413CAB
004160BC |. 59 POP ECX
004160BD \. EB 28 JMP SHORT 004160E7
004160BF /. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
004160C2 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004160C4 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
004160C6 |. 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
004160C9 |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
004160CC |. 50 PUSH EAX
004160CD |. 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
004160D0 |. 50 PUSH EAX
004160D1 |. E8 1A0B0000 CALL 00416BF0
004160D6 |. 83C4 08 ADD ESP,8
004160D9 \. C3 RETN
004160DA /. 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18]
004160DD |. 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
004160E0 |. 50 PUSH EAX ; /Arg1 => [ARG.EBP-1C]
004160E1 |. E8 7A040000 CALL 00416560 ; \win32.00416560
004160E6 |. 59 POP ECX
004160E7 |> 8B4D F0 MOV ECX,DWORD PTR SS:[LOCAL.4]
004160EA |. 64:890D 00000 MOV DWORD PTR FS:[0],ECX
004160F1 |. 5F POP EDI
004160F2 |. 5E POP ESI
004160F3 |. 5B POP EBX
004160F4 |. 89EC MOV ESP,EBP
004160F6 |. 5D POP EBP
004160F7 \. C3 RETN