PrincessCalc routineMon Dec 28 14:38:03 1998 The letter calculation routine is really a pickup from a table where is stored the converted letters for our name. The table is at location 440334 to location 4404D8Wdasm does not display this correctly in that location 4403E4 shows 00 whereas it should be 67 likewise with location 4403F0 which should show 66.However checking the program with Ultraedit we see the right numbers in these locations.Our calculation routine starts here:0043FB36 8B45F8 mov eax, dword ptr [ebp-08] <= address of our name:0043FB39 8A4438FF mov al, byte ptr [eax+edi-01] <=edi is the # of the letter :0043FB3D 25FF000000 and eax, 000000FF:0043FB42 83C0E0 add eax, FFFFFFE0:0043FB45 83F83A cmp eax, 0000003A <=is it a capital letter, it has already been made so somewhere else,:0043FB48 0F87AB070000 ja 004402F9:0043FB4E FF248555FB4300 jmp dword ptr [4*eax+0043FB55] <=calculate where to jump in the calculation jump table. This is a first table where it picks up from our data table. Here it calulates where to store the converted number.Hmemcpy is called more than once for each letter, aproximately four times for each letter.Also it runs through each letter the prescribed times every time a new letter is input.That means first letter hmemcpy is called 4 times, 2nd letter hmemcpy is called 8 times etc.Set your bpx on location 0043FB36 in order not to run through too much code.First letter "P"Hmemcpy pops, F5 three times until you land on 43FB36 and F10 through the code to see what it does.From location 43FB4E you will land at 43FEF3:0043FEF3 8D55F4 lea edx, dword ptr [ebp-0C] <= location of first letter "P":0043FEF6 8B83F8010000 mov eax, dword ptr [ebx+000001F8]:0043FEFC E8B3D1FDFF call 0041D0B4 <=if this is the first letter it will jump over this call:0043FF01 8D45F4 lea eax, dword ptr [ebp-0C]:0043FF04 BAF0034400 mov edx, 004403F0 <=move converted letter from table into edx ("P" = "f"):0043FF09 E8EE3BFCFF call 00403AFC <= you can jump over this call:0043FF0E 8B55F4 mov edx, dword ptr [ebp-0C] <=store "f" at this location. This location changes every time a new letter is added to the input. It does not stay constant.:0043FF11 8B83F8010000 mov eax, dword ptr [ebx+000001F8]:0043FF17 E8C8D1FDFF call 0041D0E4 <=step over and you land in hmemcpy:0043FF1C E9D8030000 jmp 004402F92 nd letter "i"hmemcpy F5 three times you will break at 0043FB36 which will land you again at 43FEF3 which is the frist letter so F5 6 times to get to the second letter "i".Now after the jump you land on 43 FDB10043FDB1 8D55F4 lea edx, dword ptr [ebp-0C] <= picks up the address if the first converted letter "f":0043FDB4 8B83F8010000 mov eax, dword ptr [ebx+000001F8].:0043FDBA E8F5D2FDFF call 0041D0B4 <=step into this call one step then step out of it again with F12 ( it will take about 12 F12's to get back here. If you step over it with F10 you will get lost as you will end up in hmemcpy and will not be able to follow the code.:0043FDBF 8D45F4 lea eax, dword ptr [ebp-0C]:0043FDC2 BA9C034400 mov edx,0044039C <=converted letter from table ("i" = "w" ):0043FDC7 E8303DFCFF call 00403AFC <=you can step over:0043FDCC 8B55F4 mov edx, dword ptr [ebp-0C] <= this id the new location of the converted letters (fw):0043FDCF 8B83F8010000 mov eax, dword ptr [ebx+000001F8]:0043FDD5 E80AD3FDFF call 0041D0E4:0043FDDA E91A050000 jmp 004402F9Letter 3 "r" …………etcPrincessI hope the formatting is ok, it is sure hard to see.