Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- A few functions from the "new" Razor911.dll
- -------------------------------------------
- BOOL sub_10001490()
- {
- HWND v0; // eax@1
- LPVOID v1; // ST4C_4@1
- __m128i v2; // xmm0@2
- void *v3; // esi@8
- HWND hWnd; // [sp+18h] [bp-68h]@1
- struct tagRECT Rect; // [sp+20h] [bp-60h]@1
- struct tagMSG Msg; // [sp+30h] [bp-50h]@2
- WNDCLASSEXW v8; // [sp+50h] [bp-30h]@1
- v8.cbSize = 48;
- v8.style = 64;
- v8.lpfnWndProc = (WNDPROC)sub_10001440;
- v8.cbClsExtra = 0;
- v8.cbWndExtra = 0;
- v8.hInstance = GetModuleHandleW(0);
- v8.lpszClassName = L"Razor1911";
- *(_OWORD *)&v8.hIcon = 0i64;
- v8.hIconSm = 0;
- RegisterClassExW(&v8);
- v0 = GetDesktopWindow();
- GetClientRect(v0, &Rect);
- hWnd = CreateWindowExW(
- 0,
- L"Razor1911",
- L"Razor 1911",
- 0x80000000,
- (Rect.right - Rect.left - 800) >> 1,
- (Rect.bottom - Rect.top - 300) >> 1,
- 800,
- 300,
- 0,
- 0,
- v8.hInstance,
- 0);
- v1 = sub_10004C58(0x58u);
- *(_BYTE *)v1 = 1;
- *((_DWORD *)v1 + 6) = 0;
- *((_DWORD *)v1 + 7) = 0;
- *((_DWORD *)v1 + 8) = 0;
- *((_DWORD *)v1 + 11) = 0;
- *((_DWORD *)v1 + 12) = 0;
- *((_DWORD *)v1 + 14) = 0;
- *((_DWORD *)v1 + 15) = 0;
- *((_DWORD *)v1 + 16) = 0;
- *((_DWORD *)v1 + 21) = 0;
- QueryPerformanceFrequency((LARGE_INTEGER *)v1 + 1);
- lpMem = v1;
- if ( !sub_100017D0(hWnd) )
- {
- Msg.pt.y = 0;
- *(_OWORD *)&Msg.hwnd = 0i64;
- _mm_storel_epi64((__m128i *)&Msg.time, 0i64);
- v2 = _mm_srli_si128(0i64, 4);
- if ( _mm_cvtsi128_si32(v2) != 18 )
- {
- do
- {
- if ( PeekMessageW(&Msg, 0, 0, 0, 1u) )
- {
- TranslateMessage(&Msg);
- DispatchMessageW(&Msg);
- }
- else if ( sub_10001B20(*(double *)&v2.m128i_i64[0]) )
- {
- DestroyWindow(hWnd);
- }
- }
- while ( Msg.message != 18 );
- }
- }
- v3 = lpMem;
- if ( lpMem )
- {
- sub_10001730((int)lpMem);
- sub_10004C53(v3);
- }
- return UnregisterClassW(L"Razor1911", v8.hInstance);
- }
- -------------------------------------------
- int __thiscall sub_10001730(int this)
- {
- int v1; // esi@1
- void *v2; // ecx@1
- int result; // eax@3
- int v4; // ecx@5
- int v5; // ecx@7
- int v6; // ecx@9
- int v7; // ecx@11
- int v8; // ecx@13
- int v9; // ecx@15
- v1 = this;
- v2 = *(void **)(this + 84);
- if ( v2 )
- sub_10002450(v2);
- result = *(_DWORD *)(v1 + 48);
- if ( result )
- result = DeleteObject(*(HGDIOBJ *)(v1 + 48));
- v4 = *(_DWORD *)(v1 + 64);
- if ( v4 )
- {
- result = (*(int (__stdcall **)(_DWORD))(*(_DWORD *)v4 + 8))(*(_DWORD *)(v1 + 64));
- *(_DWORD *)(v1 + 64) = 0;
- }
- v5 = *(_DWORD *)(v1 + 60);
- if ( v5 )
- {
- result = (*(int (__stdcall **)(_DWORD))(*(_DWORD *)v5 + 8))(*(_DWORD *)(v1 + 60));
- *(_DWORD *)(v1 + 60) = 0;
- }
- v6 = *(_DWORD *)(v1 + 56);
- if ( v6 )
- {
- result = (*(int (__stdcall **)(_DWORD))(*(_DWORD *)v6 + 8))(*(_DWORD *)(v1 + 56));
- *(_DWORD *)(v1 + 56) = 0;
- }
- v7 = *(_DWORD *)(v1 + 44);
- if ( v7 )
- {
- result = (*(int (__stdcall **)(_DWORD))(*(_DWORD *)v7 + 8))(*(_DWORD *)(v1 + 44));
- *(_DWORD *)(v1 + 44) = 0;
- }
- v8 = *(_DWORD *)(v1 + 32);
- if ( v8 )
- {
- result = (*(int (__stdcall **)(_DWORD))(*(_DWORD *)v8 + 8))(*(_DWORD *)(v1 + 32));
- *(_DWORD *)(v1 + 32) = 0;
- }
- v9 = *(_DWORD *)(v1 + 28);
- if ( v9 )
- {
- result = (*(int (__stdcall **)(_DWORD))(*(_DWORD *)v9 + 8))(*(_DWORD *)(v1 + 28));
- *(_DWORD *)(v1 + 28) = 0;
- }
- return result;
- }
- ------------------------------------------- WOW, cosmetic changes ;P
- char *__stdcall sub_100011F0(int a1, int a2, int a3, LPCVOID lpBaseAddress)
- {
- char *v4; // esi@3
- char v5; // al@10
- int v7; // [sp+0h] [bp-B8h]@1
- SIZE_T NumberOfBytesRead; // [sp+4h] [bp-B4h]@4
- __int64 v9; // [sp+8h] [bp-B0h]@1
- __int64 v10; // [sp+10h] [bp-A8h]@1
- __int64 v11; // [sp+18h] [bp-A0h]@1
- __int64 v12; // [sp+20h] [bp-98h]@1
- __int64 v13; // [sp+28h] [bp-90h]@1
- __int64 v14; // [sp+30h] [bp-88h]@1
- __int64 v15; // [sp+38h] [bp-80h]@1
- __int64 v16; // [sp+40h] [bp-78h]@1
- DWORD Buffer[4]; // [sp+48h] [bp-70h]@4
- int v18; // [sp+58h] [bp-60h]@4
- LPVOID v19; // [sp+5Ch] [bp-5Ch]@13
- char *v20; // [sp+60h] [bp-58h]@7
- v16 = qword_10016288;
- v15 = qword_10016280;
- v14 = qword_10016278;
- v7 = 1;
- v13 = qword_10016270;
- v12 = qword_10016268;
- v11 = qword_10016260;
- v10 = qword_10016258;
- v9 = qword_10016250;
- if ( a2 == 43869 )
- {
- if ( a3 == 2 )
- {
- v4 = (char *)sub_10007541(1u, 0x14u);
- *((_WORD *)v4 + 8) = 101;
- *((_DWORD *)v4 + 3) = 7864421;
- *((_DWORD *)v4 + 2) = 3014742;
- *((_DWORD *)v4 + 1) = 4784193;
- *(_DWORD *)v4 = 5505095;
- }
- else
- {
- v4 = 0;
- if ( a3 == 1 )
- {
- hProcess = (HANDLE)lpBaseAddress;
- hWnd = 0;
- v5 = GetProcessId((HANDLE)lpBaseAddress);
- sub_10001080((int *)Buffer, (int)"v7_%04d", v5 ^ 0xD3);
- CreateEventA(0, 1, 1, (LPCSTR)Buffer);
- v4 = (char *)100;
- }
- }
- }
- else if ( a2 == 43860 )
- {
- v4 = (char *)hWnd;
- hWnd = (HWND)lpBaseAddress;
- CreateThread(0, 0x1000u, (LPTHREAD_START_ROUTINE)sub_100013F0, (LPVOID)lpBaseAddress, 0, Buffer);
- }
- else
- {
- v4 = (char *)1;
- if ( a2 == 43858 )
- {
- ReadProcessMemory(hProcess, lpBaseAddress, Buffer, 0x40u, &NumberOfBytesRead);
- v4 = 0;
- switch ( v18 )
- {
- case 100:
- WriteProcessMemory(hProcess, v19, &v7, 4u, &NumberOfBytesRead);
- break;
- case 51:
- v4 = &v20[(_DWORD)v19];
- break;
- case 18:
- WriteProcessMemory(hProcess, v20, &v9, 0x40u, &NumberOfBytesRead);
- break;
- }
- }
- }
- sub_10004917();
- return v4;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement