Code:
int __cdecl sub_1000274E(int a1, int a2, int a3)
{
unsigned int v3; // eax@8
int v4; // eax@9
signed __int64 v5; // qax@9
int ntdll; // ecx@27
int v7; // eax@44
char v8; // zf@61
signed int v9; // ecx@61
_UNKNOWN *v10; // edi@61
char *v11; // esi@61
char v12; // zf@67
signed int v13; // ecx@67
_UNKNOWN *v14; // edi@67
char *v15; // esi@67
char v16; // zf@72
signed int v17; // ecx@72
_UNKNOWN *v18; // edi@72
char *v19; // esi@72
int v20; // eax@77
int v21; // ecx@77
int v22; // edx@77
int v23; // eax@77
int v24; // edx@77
int v25; // esi@77
int v26; // edi@77
int v27; // eax@77
int v28; // ecx@77
char v29; // zf@88
signed int v30; // ecx@88
_UNKNOWN *v31; // edi@88
char *v32; // esi@88
char v33; // zf@93
signed int v34; // ecx@93
_UNKNOWN *v35; // edi@93
char *v36; // esi@93
int v37; // eax@98
int v38; // ecx@98
int v39; // edx@98
int v40; // eax@98
int v41; // edx@98
int v42; // esi@98
int v43; // edi@98
int v44; // eax@98
int v45; // ecx@98
char v46; // zf@102
signed int v47; // ecx@102
_UNKNOWN *v48; // edi@102
char *v49; // esi@102
char v50; // zf@110
signed int v51; // ecx@110
_UNKNOWN *v52; // edi@110
char *v53; // esi@110
char *v55; // [sp-10h] [bp-524h]@131
char *v56; // [sp-Ch] [bp-520h]@1
int v57; // [sp-8h] [bp-51Ch]@1
int v58; // [sp-4h] [bp-518h]@1
__int16 v59; // [sp+10h] [bp-504h]@24
__int16 v60; // [sp+14h] [bp-500h]@16
char v61; // [sp+18h] [bp-4FCh]@39
int v62; // [sp+1Ch] [bp-4F8h]@49
int v63; // [sp+20h] [bp-4F4h]@1
__int16 v64; // [sp+24h] [bp-4F0h]@1
__int16 v65; // [sp+26h] [bp-4EEh]@1
int NtFsControlFile; // [sp+28h] [bp-4ECh]@37
__int16 *v67; // [sp+2Ch] [bp-4E8h]@85
char v68; // [sp+30h] [bp-4E4h]@1
char v69; // [sp+31h] [bp-4E3h]@1
char v70; // [sp+32h] [bp-4E2h]@1
char v71; // [sp+33h] [bp-4E1h]@1
char v72; // [sp+34h] [bp-4E0h]@1
char v73; // [sp+35h] [bp-4DFh]@1
char v74; // [sp+36h] [bp-4DEh]@1
char v75; // [sp+37h] [bp-4DDh]@1
char v76; // [sp+38h] [bp-4DCh]@1
char v77; // [sp+39h] [bp-4DBh]@1
char v78; // [sp+3Ah] [bp-4DAh]@1
char v79; // [sp+3Bh] [bp-4D9h]@1
char v80; // [sp+3Ch] [bp-4D8h]@1
char v81; // [sp+3Dh] [bp-4D7h]@1
char v82; // [sp+3Eh] [bp-4D6h]@1
char v83; // [sp+3Fh] [bp-4D5h]@1
int NtFsControlFile_string; // [sp+40h] [bp-4D4h]@1
int v85; // [sp+44h] [bp-4D0h]@2
char v86; // [sp+48h] [bp-4CCh]@1
char v87; // [sp+49h] [bp-4CBh]@1
char v88; // [sp+4Ah] [bp-4CAh]@1
char v89; // [sp+4Bh] [bp-4C9h]@1
char v90; // [sp+4Ch] [bp-4C8h]@1
char v91; // [sp+4Dh] [bp-4C7h]@1
char v92; // [sp+4Eh] [bp-4C6h]@1
char v93; // [sp+4Fh] [bp-4C5h]@1
char v94; // [sp+50h] [bp-4C4h]@1
char v95; // [sp+51h] [bp-4C3h]@1
int v96; // [sp+54h] [bp-4C0h]@39
int v97; // [sp+58h] [bp-4BCh]@1
__int64 v98; // [sp+5Ch] [bp-4B8h]@9
__int16 v99[4]; // [sp+68h] [bp-4ACh]@84
int v100; // [sp+70h] [bp-4A4h]@102
int v101; // [sp+78h] [bp-49Ch]@88
int v102; // [sp+7Ch] [bp-498h]@3
int v103; // [sp+80h] [bp-494h]@3
__int64 v104; // [sp+84h] [bp-490h]@46
int v105[4]; // [sp+90h] [bp-484h]@51
unsigned int v106; // [sp+A0h] [bp-474h]@49
__int64 v107; // [sp+A4h] [bp-470h]@5
int v108; // [sp+B0h] [bp-464h]@1
__int16 v109; // [sp+B4h] [bp-460h]@1
__int16 v110; // [sp+B6h] [bp-45Eh]@1
__int16 v111; // [sp+B8h] [bp-45Ch]@1
__int16 v112; // [sp+BAh] [bp-45Ah]@1
__int16 v113; // [sp+BCh] [bp-458h]@1
int v114; // [sp+C0h] [bp-454h]@1
char v115; // [sp+C4h] [bp-450h]@61
__int16 v116[18]; // [sp+11Ch] [bp-3F8h]@3
int v117; // [sp+140h] [bp-3D4h]@11
int v118; // [sp+144h] [bp-3D0h]@52
int v119; // [sp+148h] [bp-3CCh]@55
char v120; // [sp+14Ch] [bp-3C8h]@61
int v121; // [sp+150h] [bp-3C4h]@77
int v122; // [sp+154h] [bp-3C0h]@77
int v123; // [sp+158h] [bp-3BCh]@77
__int16 v124[262]; // [sp+15Ch] [bp-3B8h]@42
__int16 *v125; // [sp+368h] [bp-1ACh]@85
__int64 v126; // [sp+36Ch] [bp-1A8h]@47
unsigned int v127; // [sp+374h] [bp-1A0h]@47
int v128; // [sp+378h] [bp-19Ch]@47
int v129; // [sp+37Ch] [bp-198h]@47
int v130; // [sp+380h] [bp-194h]@47
int v131; // [sp+384h] [bp-190h]@47
int v132; // [sp+388h] [bp-18Ch]@47
int v133; // [sp+38Ch] [bp-188h]@47
int v134; // [sp+390h] [bp-184h]@47
int v135; // [sp+398h] [bp-17Ch]@1
int v136; // [sp+39Ch] [bp-178h]@39
int v137; // [sp+3A0h] [bp-174h]@44
__int64 v138; // [sp+3ACh] [bp-168h]@122
int v139; // [sp+3D8h] [bp-13Ch]@27
int i; // [sp+3DCh] [bp-138h]@13
int v141; // [sp+3E0h] [bp-134h]@1
char v142[264]; // [sp+3E4h] [bp-130h]@9
int v143; // [sp+4ECh] [bp-28h]@49
__int16 v144[16]; // [sp+4F0h] [bp-24h]@60
int v145; // [sp+510h] [bp-4h]@61
NtFsControlFile_string = 0;
v135 = 0;
v114 = -1;
v108 = 4653127;
v109 = 53;
v110 = 71;
v111 = 120;
v112 = 33;
v113 = 0;
v63 = 2162808;
v64 = 71;
v65 = 0;
v86 = 'U';
v87 = 'o';
v88 = '_';
v89 = 'w';
v90 = 'w';
v91 = '5';
v92 = '[censored]';
v93 = 'w';
v94 = 'w';
v95 = 0;
v68 = 'U';
v69 = 'o';
v70 = ']';
v71 = 'h';
v72 = 'X';
v73 = 't';
v74 = 'u';
v75 = 'o';
v76 = 'i';
v77 = 't';
v78 = 'w';
v79 = ']';
v80 = 'r';
v81 = 'w';
v82 = '~';
v83 = 0;
sub_10001EF0((void *)a2, 0, 0x1000u);
*(_DWORD *)a3 = 4096;
v141 = a2;
*(_DWORD *)(a2 + 32) = 0xEBA903ACu;
v97 = 0;
if ( SetupWinAPI() )
{
memset(v116, 0, sizeof(v116));
v102 = 0;
v103 = 0;
while ( v7ffe0018 != v7ffe001c )
;
v107 = v7ffe0014;
while ( v7ffe0324 != v7ffe0328 )
;
if ( v7ffe0320 | v7ffe0328 )
v3 = v7ffe0004 * (v7ffe0324 << 8) + (v7ffe0320 * (unsigned __int64)v7ffe0004 >> 24);
else
v3 = v7ffe0004 * (unsigned __int64)v7ffe0000 >> 24;
v5 = 10000i64 * v3;
v98 = v5;
v107 -= v5;
LODWORD(v5) = v141;
*(_DWORD *)(v141 + 40) = v107;
*(_DWORD *)(v5 + 44) = HIDWORD(v107);
v4 = import_GetSystemDirectoryA(v142, 260);
v117 = v4;
if ( v4 )
{
for ( i = 0; *((_WORD *)&v108 + i); ++i )
{
if ( i == 4 )
v60 = v142[0];
else
v60 = *((_WORD *)&v108 + i) ^ 0x1B;
*((_WORD *)&v108 + i) = v60;
}
v114 = import_CreateFileW(&v108, 0x80000000u, 3, 0, 3, 0, 0);
if ( v114 == -1 )
{
v85 = import_GetLastError();
}
else
{
for ( i = 0; *((_WORD *)&v63 + i); ++i )
{
if ( i )
v59 = *((_WORD *)&v63 + i) ^ 0x1B;
else
v59 = v142[0];
*((_WORD *)&v63 + i) = v59;
}
v139 = import_GetVolumeInformationW(&v63, 0, 0, v141 + 56, 0, 0, 0, 0);
if ( v139 )
{
for ( i = 0; *(&v86 + i); ++i )
{
ntdll = i;
*(&v86 + i) ^= 0x1Bu;
}
v58 = 0;
v57 = 0;
v56 = &v86;
NtFsControlFile_string = import_LoadLibraryExA(ntdll);
if ( NtFsControlFile_string )
{
for ( i = 0; *(&v68 + i); ++i )
*(&v68 + i) ^= 0x1Bu;
v55 = &v68;
NtFsControlFile = import_GetProcAddress(NtFsControlFile_string);
if ( NtFsControlFile )
{
v96 = ((int (__stdcall *)(int, _DWORD, _DWORD, _DWORD, char *, unsigned int, _DWORD, _DWORD, int *, unsigned int))NtFsControlFile)(
v114,
0,
0,
0,
&v61,
0x900F4u,
0,
0,
&v136,
0x38u);
if ( v96 >= 0 )
{
v7 = v141;
*(_DWORD *)(v141 + 48) = v136;
*(_DWORD *)(v7 + 52) = v137;
v135 = import_VirtualAlloc(0, 0x4000000u, 0x3000u, 4);
if ( v135 )
{
v104 = 0i64;
do
{
v126 = v104;
v127 = 0x80000000u;
v128 = 1;
v129 = 0;
v130 = 0;
v131 = 0;
v132 = 0;
v133 = v136;
v134 = v137;
v96 = ((int (__stdcall *)(int, _DWORD, _DWORD, _DWORD, char *, unsigned int, __int64 *, signed int, int, unsigned int))NtFsControlFile)(
v114,
0,
0,
0,
&v61,
0x900BBu,
&v126,
40,
v135,
0x4000000u);
if ( v96 < 0 )
{
v85 = v96;
goto LABEL_125;
}
v104 = *(_QWORD *)v135;
v143 = v62 - 8;
v106 = 0;
for ( i = 0; (unsigned int)i < 4; ++i )
v105[i] = 0;
v118 = v135 + 8;
while ( v143 )
{
if ( (unsigned int)*(_WORD *)(v118 + 56) > 0x20 )
{
v119 = v118 + *(_WORD *)(v118 + 58) + *(_WORD *)(v118 + 56) - 32;
for ( i = 0; (unsigned int)i < 0x10; ++i )
{
if ( (signed int)*(_WORD *)v119 >= 65 )
{
if ( (signed int)*(_WORD *)v119 <= 90 )
*(_WORD *)v119 += 32;
}
v144[i] = *(_WORD *)v119;
v119 += 2;
}
*(_DWORD *)(v118 + 40) &= 0x80303370u;
v145 = *(_DWORD *)(v118 + 40);
MD5Init(&v115);
MD5Update((int)&v115, v144, 0x24u);
MD5Final(&v120, &v115);
v9 = 4;
v10 = &unk_10009008;
v11 = &v120;
v8 = 1;
do
{
if ( !v9 )
break;
v8 = *(_DWORD *)v11 == *(_DWORD *)v10;
v11 += 4;
v10 = (char *)v10 + 4;
--v9;
}
while ( v8 );
if ( v8 )
memcpy(v116, v144, sizeof(v116));
v13 = 4;
v14 = &unk_10009008;
v15 = &v120;
v12 = 1;
do
{
if ( !v13 )
break;
v12 = *(_DWORD *)v15 == *(_DWORD *)v14;
v15 += 4;
v14 = (char *)v14 + 4;
--v13;
}
while ( v12 );
if ( v12 )
goto LABEL_134;
v17 = 4;
v18 = &unk_10009018;
v19 = &v120;
v16 = 1;
do
{
if ( !v17 )
break;
v16 = *(_DWORD *)v19 == *(_DWORD *)v18;
v19 += 4;
v18 = (char *)v18 + 4;
--v17;
}
while ( v16 );
if ( v16 )
{
LABEL_134:
v20 = 32 * v97;
v21 = v141;
v22 = v118;
*(_DWORD *)(v141 + 32 * v97 + 64) = *(_DWORD *)(v118 + 8);
*(_DWORD *)(v21 + v20 + 68) = *(_DWORD *)(v22 + 12);
v23 = *(_DWORD *)(v118 + 36);
v24 = 32 * v97;
v25 = v141;
*(_DWORD *)(v141 + 32 * v97 + 72) = *(_DWORD *)(v118 + 32);
*(_DWORD *)(v25 + v24 + 76) = v23;
v26 = v141 + 32 * v97 + 80;
*(_DWORD *)v26 = *(_DWORD *)&v120;
v26 += 4;
*(_DWORD *)v26 = v121;
v26 += 4;
*(_DWORD *)v26 = v122;
*(_DWORD *)(v26 + 4) = v123;
v97 = (unsigned int)(v97 + 1) < 0x7E ? v97 + 1 : 0;
v27 = 32 * v97;
v28 = v141;
*(_DWORD *)(v141 + 32 * v97 + 64) = 0;
*(_DWORD *)(v28 + v27 + 68) = 0;
}
}
if ( (unsigned int)*(_WORD *)(v118 + 56) > 8 )
{
v119 = v118 + *(_WORD *)(v118 + 58) + *(_WORD *)(v118 + 56) - 8;
for ( i = 0; (unsigned int)i < 4; ++i )
{
if ( (signed int)*(_WORD *)v119 >= 65 )
{
if ( (signed int)*(_WORD *)v119 <= 90 )
*(_WORD *)v119 += 32;
}
v99[i] = *(_WORD *)v119;
v99[i] ^= v116[i] << 8;
v119 += 2;
}
v67 = &v116[i];
v125 = &v99[i];
for ( i = 0; (unsigned int)i < 8; ++i )
*((_BYTE *)v125 + i) = ((unsigned __int16)v67[i] >> 8) ^ v67[i];
*(_DWORD *)(v118 + 40) &= 0x80303372u;
v101 = *(_DWORD *)(v118 + 40);
MD5Init(&v115);
MD5Update((int)&v115, v99, 0x14u);
MD5Final(&v120, &v115);
v30 = 4;
v31 = &unk_10009028;
v32 = &v120;
v29 = 1;
do
{
if ( !v30 )
break;
v29 = *(_DWORD *)v32 == *(_DWORD *)v31;
v32 += 4;
v31 = (char *)v31 + 4;
--v30;
}
while ( v29 );
if ( v29 )
goto LABEL_135;
v34 = 4;
v35 = &unk_10009038;
v36 = &v120;
v33 = 1;
do
{
if ( !v34 )
break;
v33 = *(_DWORD *)v36 == *(_DWORD *)v35;
v36 += 4;
v35 = (char *)v35 + 4;
--v34;
}
while ( v33 );
if ( v33 )
{
LABEL_135:
v37 = 32 * v97;
v38 = v141;
v39 = v118;
*(_DWORD *)(v141 + 32 * v97 + 64) = *(_DWORD *)(v118 + 8);
*(_DWORD *)(v38 + v37 + 68) = *(_DWORD *)(v39 + 12);
v40 = *(_DWORD *)(v118 + 36);
v41 = 32 * v97;
v42 = v141;
*(_DWORD *)(v141 + 32 * v97 + 72) = *(_DWORD *)(v118 + 32);
*(_DWORD *)(v42 + v41 + 76) = v40;
v43 = v141 + 32 * v97 + 80;
*(_DWORD *)v43 = *(_DWORD *)&v120;
v43 += 4;
*(_DWORD *)v43 = v121;
v43 += 4;
*(_DWORD *)v43 = v122;
*(_DWORD *)(v43 + 4) = v123;
v97 = (unsigned int)(v97 + 1) < 0x7E ? v97 + 1 : 0;
v44 = 32 * v97;
v45 = v141;
*(_DWORD *)(v141 + 32 * v97 + 64) = 0;
*(_DWORD *)(v45 + v44 + 68) = 0;
}
v119 = v118 + *(_WORD *)(v118 + 58) + *(_WORD *)(v118 + 56) - 8;
for ( i = 0; (unsigned int)i < 4; ++i )
{
v99[i] = *(_WORD *)v119;
v119 += 2;
}
v100 = *(_DWORD *)(v118 + 40);
MD5Init(&v115);
MD5Update((int)&v115, v99, 0xCu);
MD5Final(&v120, &v115);
v47 = 4;
v48 = &unk_10009048;
v49 = &v120;
v46 = 1;
do
{
if ( !v47 )
break;
v46 = *(_DWORD *)v49 == *(_DWORD *)v48;
v49 += 4;
v48 = (char *)v48 + 4;
--v47;
}
while ( v46 );
if ( v46 )
{
v102 = *(_DWORD *)(v118 + 8);
v103 = *(_DWORD *)(v118 + 12);
}
if ( *(_DWORD *)(v118 + 8) == v102 )
{
if ( *(_DWORD *)(v118 + 12) == v103 )
{
v51 = 4;
v52 = &unk_10009058;
v53 = &v120;
v50 = 1;
do
{
if ( !v51 )
break;
v50 = *(_DWORD *)v53 == *(_DWORD *)v52;
v53 += 4;
v52 = (char *)v52 + 4;
--v51;
}
while ( v50 );
if ( v50 )
{
v105[v106] = v118;
v106 = (v106 + 1) % 4;
v102 = 0;
v103 = 0;
}
}
}
}
v143 -= *(_DWORD *)v118;
v118 += *(_DWORD *)v118;
}
if ( v105[0] )
{
for ( i = 0; (unsigned int)i < 3; ++i )
v124[i] = v142[i];
v124[i] = 0;
sub_10002047(v141, (int)&v97, (int)v105, (int)v124, 0);
}
}
while ( v104 < v138 );
v85 = 0;
}
else
{
v85 = ((int (__cdecl *)(char *, char *, _DWORD, _DWORD))import_GetLastError)(
&v68,
&v86,
0,
0);
}
}
else
{
v85 = v96;
for ( i = 0; (unsigned int)i < 3; ++i )
v124[i] = v142[i];
v124[i] = 0;
sub_10002047(v141, (int)&v97, 0, (int)v124, 0);
}
}
else
{
v85 = ((int (__cdecl *)(char *, char *, _DWORD, _DWORD))import_GetLastError)(&v68, &v86, 0, 0);
}
}
else
{
v85 = ((int (__cdecl *)(char *, _DWORD, _DWORD))import_GetLastError)(&v86, 0, 0);
}
}
else
{
v85 = import_GetLastError();
}
}
}
else
{
v85 = import_GetLastError();
}
}
else
{
v85 = 78;
}
LABEL_125:
if ( v114 != -1 )
import_CloseHandle(v114);
if ( v135 )
import_VirtualFree(v135, 0, 0x8000u);
if ( NtFsControlFile_string )
import_FreeLibrary(NtFsControlFile_string);
sub_10001CB9(v55, v56, v57, v58);
*(_DWORD *)(v141 + 36) = v85;
return 0;
}
Code:
int __cdecl sub_10002047(int a1, int a2, int a3, int a4, __int16 *a5)
{
int v5; // eax@1
int v6; // ecx@1
__int16 v7; // dx@2
int v8; // edi@3
int v9; // eax@3
int *v10; // eax@4
int result; // eax@6
int *v12; // eax@8
int *v13; // eax@11
int *v14; // eax@14
__int16 *v15; // esi@20
__int16 *v16; // eax@21
int v17; // ecx@21
int v18; // ecx@24
__int16 *v19; // eax@25
__int16 *v20; // eax@28
__int16 v21; // cx@29
__int16 *v22; // eax@31
int v23; // edx@31
__int16 v24; // cx@32
int v25; // edx@35
__int16 *v26; // eax@36
unsigned int v27; // ecx@37
int v28; // eax@41
__int16 v29; // cx@42
char v30; // zf@45
signed int v31; // ecx@45
_UNKNOWN *v32; // edi@45
char *v33; // esi@45
char v34; // zf@50
signed int v35; // ecx@50
_UNKNOWN *v36; // edi@50
char *v37; // esi@50
char v38; // zf@55
signed int v39; // ecx@55
_UNKNOWN *v40; // edi@55
char *v41; // esi@55
unsigned int v42; // edi@65
int v43; // eax@66
int v44; // edx@66
__int16 v45; // cx@67
int v46; // eax@69
int v47; // eax@72
int v48; // eax@72
char v49; // zf@74
int v50; // ecx@74
int v51; // edi@74
int v52; // esi@74
int v53; // eax@81
char v54; // zf@83
signed int v55; // ecx@83
_UNKNOWN *v56; // edi@83
char *v57; // esi@83
int v58; // edx@91
int v59; // eax@91
int v60; // edi@91
int v61; // eax@91
int v62; // eax@91
int v63; // eax@96
__int16 v64; // cx@97
char v65; // zf@98
signed int v66; // ecx@98
_UNKNOWN *v67; // edi@98
char *v68; // esi@98
char v69; // zf@106
signed int v70; // ecx@106
_UNKNOWN *v71; // edi@106
char *v72; // esi@106
int v73; // eax@111
int v74; // edi@113
int v75; // ecx@113
int v76; // eax@113
int v77; // [sp-Ch] [bp-90h]@69
int v78; // [sp-8h] [bp-8Ch]@69
__int16 *v79; // [sp-4h] [bp-88h]@69
char ctx; // [sp+Ch] [bp-78h]@45
int v81; // [sp+64h] [bp-20h]@89
int v82; // [sp+68h] [bp-1Ch]@3
int v83; // [sp+6Ch] [bp-18h]@31
__int16 v84; // [sp+70h] [bp-14h]@1
__int16 v85; // [sp+72h] [bp-12h]@1
__int16 v86; // [sp+74h] [bp-10h]@1
__int16 v87; // [sp+76h] [bp-Eh]@1
__int16 v88; // [sp+78h] [bp-Ch]@1
__int16 v89; // [sp+7Ah] [bp-Ah]@1
char digest; // [sp+7Ch] [bp-8h]@45
int v91; // [sp+80h] [bp-4h]@91
int v92; // [sp+84h] [bp+0h]@91
int v93; // [sp+88h] [bp+4h]@91
int v94; // [sp+8Ch] [bp+8h]@3
int v95; // [sp+90h] [bp+Ch]@1
int v96; // [sp+94h] [bp+10h]@1
int v97; // [sp+98h] [bp+14h]@1
char v98; // [sp+9Ch] [bp+18h]@1
int v99; // [sp+A0h] [bp+1Ch]@1
int v100; // [sp+A4h] [bp+20h]@1
int v101; // [sp+A8h] [bp+24h]@1
__int16 v102; // [sp+ACh] [bp+28h]@1
char v103; // [sp+AEh] [bp+2Ah]@1
int v104; // [sp+B0h] [bp+2Ch]@1
int v105; // [sp+B4h] [bp+30h]@1
int v106; // [sp+B8h] [bp+34h]@1
__int16 v107; // [sp+BCh] [bp+38h]@1
unsigned int v108; // [sp+C0h] [bp+3Ch]@71
int v109; // [sp+C4h] [bp+40h]@81
__int16 v110; // [sp+C8h] [bp+44h]@1
__int16 v111; // [sp+CAh] [bp+46h]@1
int v112; // [sp+CCh] [bp+48h]@1
int v113; // [sp+D0h] [bp+4Ch]@1
int v114; // [sp+D4h] [bp+50h]@1
__int16 v115; // [sp+D8h] [bp+54h]@1
int v116; // [sp+DCh] [bp+58h]@1
int v117; // [sp+E0h] [bp+5Ch]@43
int v118; // [sp+E4h] [bp+60h]@33
v110 = '1';
v111 = '5';
v112 = '1';
v84 = '1';
v85 = '5';
v86 = '~';
v87 = 'c';
v88 = '~';
v89 = '\0';
v98 = '\0';
v103 = '\0';
v5 = a4;
v116 = 0;
v95 = 'ui~P';
v96 = ')(w~';
v97 = 'ww[censored]5';
v99 = '[censored]ur]';
v100 = 'hir]';
v101 = 'wr]o';
v102 = 'L~';
v104 = '[censored]ur]';
v105 = 'oc~U';
v106 = '~wr]';
v107 = 'L';
v113 = '[censored]ur]';
v114 = 'htwX';
v115 = '~';
v6 = a4 + 2;
do
{
v7 = *(_WORD *)v5;
v5 += 2;
}
while ( v7 );
v9 = (v5 - v6) >> 1;
v8 = 258 - v9;
v94 = v9;
v82 = 258 - v9;
if ( FindFirstFileW )
{
LABEL_20:
v15 = a5;
if ( !a5 )
{
v17 = 0;
v16 = &v110;
do
{
*v16 ^= 0x1Bu;
++v17;
v16 = &v110 + v17;
}
while ( *v16 );
if ( !a3 )
{
v18 = 0;
if ( v84 )
{
v19 = &v84;
do
{
*v19 ^= 0x1Bu;
++v18;
v19 = &v84 + v18;
}
while ( *v19 );
}
}
v15 = &v110;
}
v20 = v15;
do
{
v21 = *v20;
++v20;
}
while ( v21 );
result = (signed int)((char *)v20 - (char *)(v15 + 1)) >> 1;
if ( v8 < (unsigned int)result )
goto LABEL_117;
v83 = a4 + 2 * v94;
v22 = v15;
v23 = v83 - (_DWORD)v15;
do
{
v24 = *v22;
*(__int16 *)((char *)v22 + v23) = *v22;
++v22;
}
while ( v24 );
result = FindFirstFileW(a4, &dword_10009E08);
v118 = result;
if ( result == -1 )
goto LABEL_117;
while ( 1 )
{
if ( dword_10009E08 & 0x400 )
goto LABEL_115;
v25 = 0;
if ( word_10009E34[0] )
{
v26 = word_10009E34;
do
{
v27 = (unsigned __int16)*v26;
if ( v27 >= 0x41 )
{
if ( v27 <= 0x5A )
*v26 = v27 + 32;
}
++v25;
v26 = &word_10009E34[v25];
}
while ( *v26 );
}
v28 = (int)word_10009E34;
do
{
v29 = *(_WORD *)v28;
v28 += 2;
}
while ( v29 );
v117 = (v28 - (_DWORD)&word_10009E34[1]) >> 1;
if ( dword_10009E08 & 0x10 )
{
if ( v94 == 3 )
{
MD5Init(&ctx);
MD5Update((int)&ctx, word_10009E34, 2 * v117);
MD5Final(&digest, &ctx);
v31 = 4;
v32 = &unk_10009088;
v33 = &digest;
v30 = 1;
do
{
if ( !v31 )
break;
v30 = *(_DWORD *)v33 == *(_DWORD *)v32;
v33 += 4;
v32 = (char *)v32 + 4;
--v31;
}
while ( v30 );
if ( v30 )
goto LABEL_115;
v35 = 4;
v36 = &unk_10009098;
v37 = &digest;
v34 = 1;
do
{
if ( !v35 )
break;
v34 = *(_DWORD *)v37 == *(_DWORD *)v36;
v37 += 4;
v36 = (char *)v36 + 4;
--v35;
}
while ( v34 );
if ( v34 )
goto LABEL_115;
v39 = 4;
v40 = &unk_100090A8;
v41 = &digest;
v38 = 1;
do
{
if ( !v39 )
break;
v38 = *(_DWORD *)v41 == *(_DWORD *)v40;
v41 += 4;
v40 = (char *)v40 + 4;
--v39;
}
while ( v38 );
if ( v38 )
goto LABEL_115;
}
if ( word_10009E34[0] == 46 && (!word_10009E36 || word_10009E36 == 46 && !word_10009E38) || a5 )
goto LABEL_115;
}
v42 = v117;
if ( v117 > (unsigned int)v82 )
goto LABEL_115;
v43 = (int)word_10009E34;
v44 = v83 - (_DWORD)word_10009E34;
do
{
v45 = *(_WORD *)v43;
*(_WORD *)(v43 + v44) = *(_WORD *)v43;
v43 += 2;
}
while ( v45 );
if ( dword_10009E08 & 0x10 )
break;
if ( a3 )
{
v108 = 0;
do
{
v48 = a3 + 4 * v108;
v112 = v48;
v47 = *(_DWORD *)v48;
if ( v47 )
{
if ( 2 * v117 == *(_WORD *)(v47 + 0x38) )
{
v50 = *(_WORD *)(*(_DWORD *)v112 + 56) - 8;
v51 = *(_DWORD *)v112 + 60;
v52 = (int)word_10009E34;
v49 = 1;
do
{
if ( !v50 )
break;
v49 = *(_BYTE *)v52++ == *(_BYTE *)v51++;
--v50;
}
while ( v49 );
if ( v49 )
{
MD5Init(&ctx);
MD5Update((int)&ctx, (char *)&unk_10009E2C + 2 * v117, 8u);
MD5Final(&digest, &ctx);
if ( !strncmp(&digest, (const char *)&unk_10009068, 16)
|| !strncmp(&digest, (const char *)&unk_10009078, 16) )
{
v53 = import_CreateFileW(a4, 0x80000000u, 7, 0, 3, 128, 0);
v109 = v53;
if ( v53 != -1 )
{
if ( import_GetFileInformationByHandle(v53, &unk_10009DD0) )
{
v55 = 4;
v56 = &unk_10009068;
v57 = &digest;
v54 = 1;
do
{
if ( !v55 )
break;
v54 = *(_DWORD *)v57 == *(_DWORD *)v56;
v57 += 4;
v56 = (char *)v56 + 4;
--v55;
}
while ( v54 );
if ( v54 )
{
if ( (unsigned int)dword_10009E28 >= 0x50 )
{
if ( import_ReadFile(v109, &unk_1000A058, 80, &v81, 0) )
{
MD5Init(&ctx);
MD5Update((int)&ctx, &unk_1000A058, 0x50u);
MD5Final(&digest, &ctx);
}
}
}
*(_DWORD *)(32 * (*(_DWORD *)a2 + 2) + a1) = dword_10009E00;
*(_DWORD *)(32 * *(_DWORD *)a2 + a1 + 68) = dword_10009DFC;
v58 = *(_DWORD *)v112;
v59 = 32 * *(_DWORD *)a2;
*(_DWORD *)(v59 + a1 + 72) = *(_DWORD *)(*(_DWORD *)v112 + 32);
*(_DWORD *)(v59 + a1 + 76) = *(_DWORD *)(v58 + 36);
v60 = 32 * *(_DWORD *)a2 + a1 + 80;
*(_DWORD *)v60 = *(_DWORD *)&digest;
v60 += 4;
*(_DWORD *)v60 = v91;
v60 += 4;
*(_DWORD *)v60 = v92;
*(_DWORD *)(v60 + 4) = v93;
v61 = (unsigned int)(*(_DWORD *)a2 + 1) < 0x7E ? *(_DWORD *)a2 + 1 : 0;
*(_DWORD *)a2 = v61;
v62 = 32 * (v61 + 2);
*(_DWORD *)(v62 + a1) = 0;
*(_DWORD *)(v62 + a1 + 4) = 0;
}
import_CloseHandle(v109);
}
}
}
}
}
++v108;
}
while ( v108 < 4 );
goto LABEL_115;
}
if ( a5 )
{
if ( v42 > 8 )
{
MD5Init(&ctx);
MD5Update((int)&ctx, (char *)&unk_10009E2C + 2 * v117, 8u);
MD5Final(&digest, &ctx);
v70 = 4;
v71 = &unk_10009078;
v72 = &digest;
v69 = 1;
do
{
if ( !v70 )
break;
v69 = *(_DWORD *)v72 == *(_DWORD *)v71;
v72 += 4;
v71 = (char *)v71 + 4;
--v70;
}
while ( v69 );
if ( v69 )
{
v73 = import_CreateFileW(a4, 0x80000000u, 7, 0, 3, 128, 0);
v109 = v73;
if ( v73 != -1 )
{
if ( import_GetFileInformationByHandle(v73, &unk_10009DD0) )
{
*(_DWORD *)(32 * (*(_DWORD *)a2 + 2) + a1) = dword_10009E00;
*(_DWORD *)(32 * *(_DWORD *)a2 + a1 + 68) = dword_10009DFC;
*(_DWORD *)(32 * *(_DWORD *)a2 + a1 + 72) = dword_10009DDC;
*(_DWORD *)(32 * *(_DWORD *)a2 + a1 + 76) = dword_10009DE0;
v74 = 32 * *(_DWORD *)a2 + a1 + 80;
*(_DWORD *)v74 = *(_DWORD *)&digest;
v74 += 4;
*(_DWORD *)v74 = v91;
v74 += 4;
*(_DWORD *)v74 = v92;
*(_DWORD *)(v74 + 4) = v93;
v75 = (unsigned int)(*(_DWORD *)a2 + 1) < 0x7E ? *(_DWORD *)a2 + 1 : 0;
*(_DWORD *)a2 = v75;
v76 = 32 * (v75 + 2);
*(_DWORD *)(v76 + a1) = 0;
*(_DWORD *)(v76 + a1 + 4) = 0;
}
import_CloseHandle(v109);
}
}
}
goto LABEL_115;
}
MD5Init(&ctx);
v63 = (int)word_10009E34;
do
{
v64 = *(_WORD *)v63;
v63 += 2;
}
while ( v64 );
MD5Update((int)&ctx, word_10009E34, 2 * ((v63 - (_DWORD)&word_10009E34[1]) >> 1));
MD5Final(&digest, &ctx);
v66 = 4;
v67 = &unk_100090B8;
v68 = &digest;
v65 = 1;
do
{
if ( !v66 )
break;
v65 = *(_DWORD *)v68 == *(_DWORD *)v67;
v68 += 4;
v67 = (char *)v67 + 4;
--v66;
}
while ( v65 );
if ( v65 )
{
*(_WORD *)v83 = 0;
v79 = &v84;
v78 = a4;
v77 = 0;
goto LABEL_104;
}
LABEL_115:
if ( !FindNextFileW(v118, &dword_10009E08) )
{
result = FindClose(v118);
goto LABEL_117;
}
}
v79 = a5;
v46 = a4 + 2 * (v94 + v117);
*(_WORD *)v46 = 92;
v78 = a4;
v77 = a3;
*(_WORD *)(v46 + 2) = 0;
LABEL_104:
sub_10002047(a1, a2, v77, v78, v79);
goto LABEL_115;
}
v10 = &v95;
do
{
*(_BYTE *)v10 ^= 0x1Bu;
v10 = (int *)((char *)v10 + 1);
}
while ( *(_BYTE *)v10 );
result = import_LoadLibraryExA(v6);
v116 = result;
if ( result )
{
if ( (_BYTE)v99 )
{
v12 = &v99;
do
{
*(_BYTE *)v12 ^= 0x1Bu;
v12 = (int *)((char *)v12 + 1);
}
while ( *(_BYTE *)v12 );
}
FindFirstFileW = (int (__stdcall *)(_DWORD, _DWORD))import_GetProcAddress(v116);
if ( (_BYTE)v104 )
{
v13 = &v104;
do
{
*(_BYTE *)v13 ^= 0x1Bu;
v13 = (int *)((char *)v13 + 1);
}
while ( *(_BYTE *)v13 );
}
FindNextFileW = (int (__stdcall *)(_DWORD, _DWORD))import_GetProcAddress(v116);
if ( (_BYTE)v113 )
{
v14 = &v113;
do
{
*(_BYTE *)v14 ^= 0x1Bu;
v14 = (int *)((char *)v14 + 1);
}
while ( *(_BYTE *)v14 );
}
result = import_GetProcAddress(v116);
FindClose = (int (__stdcall *)(_DWORD))result;
if ( !FindFirstFileW || !FindNextFileW || !result )
{
FindFirstFileW = 0;
LABEL_117:
if ( v116 )
result = import_FreeLibrary(v116);
return result;
}
goto LABEL_20;
}
return result;
}
General
Reply With Quote
10
Ultimate guide to help you protect from VAC Ban.
Originally Posted by McStyles189
My bad them.
2588
