I have the following two lines:
.... push 401150h call sub_401253 ....
So, when I click on push 401150h IDA PRO shows:
seg0001 : 00401120 dword_401120 dd 6F662F3Ch, 3C3E746Eh, 3E702Fh, 253A4E52h, 54522073h dd 2073253Ah, 73253A55h, 253A5020h, 656C774h, 616223Dh, 72676B63h, 646E756Fh dd 0D73h, 7320703Ch, 335504h, 7265464h, 5484531h 55E4ADEh, A585B5448h, .....(and so on)
So, my first question would be : what is this? what it can be?
My own results: that thing which I mentioned above is a string because in the function sub_401253 they copy it using lstrcpy() into a buffer:
... lea eax, [esp+1FC + Buffer] ... mov edi, [esp+208+arg_0] push edi, push eax, call lstrcpy ...
After that, in a next block the content of the buffer(which are the hexadecimal numbers now) is XORed in a loop. I assume that they encrypt or decrypt it (but that is not so importan for me right now.)
I only want to know what IDA PRO try to depict with push 401150h which represents the hexadecimal numbers. Thats it. I hope you can help me.