Hello,

sorry for posting what is problably a stupid question, but I was wondering if someone can recognize the following code:

00401620 PUSHAD
00401621 MOV EDI,xxxxxxxx.00401000
00401626 MOV ECX,xxxxxxxx.00401FFF
0040162B SUB ECX,EDI
0040162D MOV AL,0CC
0040162F REPNE SCAS BYTE PTR ES:[EDI]
00401631 JNZ SHORT xxxxxxxx.00401644
00401633 MOV EBX,xxxxxxxx.00402005
00401638 ADD BYTE PTR DS:[EBX],1
0040163B MOV ECX,xxxxxxxx.00401FFF
00401640 SUB ECX,EDI
00401642 JMP SHORT xxxxxxxx.0040162F
00401644 MOV EAX,xxxxxxxx.00402005
00401649 CMP BYTE PTR DS:[EAX],3

This code is somehow able to detect the presence of an application level debugger following code step by step. I was wondering if this is some checksum code. Thx.

yaa