Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- char sub_4E8D00()
- {
- HMODULE v0; // eax
- HMODULE v1; // edi
- int v2; // esi
- _DWORD *v3; // ecx
- unsigned int v4; // ebx
- int v5; // eax
- int v6; // edx
- int v7; // esi
- int v9; // ST00_4
- int v10; // eax
- int v11; // ST04_4
- int v12; // ST08_4
- int v13; // ST0C_4
- int v14; // ST10_4
- DWORD NumberOfBytesWritten; // [esp+Ch] [ebp-18h]
- int Buffer; // [esp+10h] [ebp-14h]
- int v17; // [esp+14h] [ebp-10h]
- int v18; // [esp+18h] [ebp-Ch]
- int v19; // [esp+1Ch] [ebp-8h]
- char v20; // [esp+23h] [ebp-1h]
- v20 = 0;
- v0 = GetModuleHandleA_2("ntdll");
- v1 = v0;
- v2 = 0;
- v3 = (_DWORD *)((char *)v0 + *(_DWORD *)((char *)v0 + *((_DWORD *)v0 + 15) + 120));
- v4 = v3[6];
- v5 = (int)v0 + v3[8];
- v17 = (int)v1 + v3[7];
- v6 = (int)v1 + v3[9];
- v19 = v5;
- v18 = v6;
- if ( v4 )
- {
- while ( !(unsigned __int8)sub_5354E0((char *)v1 + *(_DWORD *)(v5 + 4 * v2)) )
- {
- v5 = v19;
- if ( ++v2 >= v4 )
- goto LABEL_4;
- }
- v7 = (int)v1 + *(_DWORD *)(v17 + 4 * *(unsigned __int16 *)(v18 + 2 * v2));
- }
- else
- {
- LABEL_4:
- v7 = 0;
- }
- if ( !v7 )
- {
- sub_13633B0(&unk_1BA46A8);
- unk_1BA4690 |= 0x40000u;
- goto LABEL_19;
- }
- if ( *(_DWORD *)v7 != unk_1742264
- || *(_DWORD *)(v7 + 4) != *((_DWORD *)&unk_1742264 + 1)
- || *(_WORD *)(v7 + 8) != *((_WORD *)&unk_1742264 + 4) )
- {
- if ( (unsigned __int8)sub_535570(v7) )
- v7 += 23;
- v10 = *(_DWORD *)(v7++ + 1);
- if ( v10 != unk_1742264
- || *(_DWORD *)(v7 + 4) != *((_DWORD *)&unk_1742264 + 1)
- || *(_WORD *)(v7 + 8) != *((_WORD *)&unk_1742264 + 4) )
- {
- sub_13633B0(&unk_1BA46A8);
- unk_1BA4690 |= 0x20000u;
- goto LABEL_19;
- }
- }
- unk_1B9C7DC = v7 + 10;
- Buffer = (int)((char *)&loc_4B6C4F - v7 - 13);
- unk_1BAB008 = v7 + 10 + *(_DWORD *)(v7 + 10) + 4;
- v9 = (*(&loc_136337C + 1))(v7 + 10, &Buffer, 4, &NumberOfBytesWritten);
- if ( !(*(int (__stdcall **)(int, int, int, int, int))((char *)&loc_1363342 + 2))(v9, v11, v12, v13, v14)
- || NumberOfBytesWritten != 4 )
- {
- sub_13633B0(&unk_1BA46A8);
- unk_1BA4690 |= 0x10000u;
- LABEL_19:
- (*(void (__stdcall **)(void *))&algn_13633A7[5])(&unk_1BA46A8);
- return v20;
- }
- return 1;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement