View difference between Paste ID: 7a1Bn6HH and EWP6XVwm

 #include <windows.h>
-
+
 //-------------------------------------------------------------------------
-
+
-
+
-
+
-
+
-
+
 // extern PBOOLEAN KdDebuggerEnabled;
-
+
 extern int dword_12628; // weak
-
+
-
+
-
+
 extern char a_text[6]; // weak
-
+
 extern char asc_12678[2]; // weak
-
+
 extern int dword_12684; // weak
-
+
 extern int dword_1268C; // weak
-
+
 extern _UNKNOWN unk_12694; // weak
-
+
 extern _UNKNOWN unk_14380; // weak
-
+
 extern char byte_14390; // weak
-
+
 extern const WCHAR word_14395; // idb
-
+
 extern const WCHAR word_14471; // idb
-
+
 extern int dword_1453D; // weak
-
+
 extern char byte_14614; // weak
-
+
 extern char byte_14616; // weak
-
+
 extern int dword_1461C; // weak
-
+
 extern int dword_14624; // weak
-
+
 extern RTL_GENERIC_TABLE Table; // idb
-
+
 extern char byte_14658; // weak
-
+
 extern int dword_14660; // weak
-
+
 extern int dword_14668; // weak
-
+
 extern int dword_1468C; // weak
-
+
 extern int dword_14694; // weak
-
+
 extern int dword_1469C; // weak
-
+
 extern int dword_146A4; // weak
-
+
 extern int dword_146AC; // weak
-
+
 //-------------------------------------------------------------------------
-
+
 #define __thiscall __cdecl // Test compile in C mode
-
+
 void __stdcall DriverReinitializationRoutine(PDRIVER_OBJECT DriverObject, int a2, unsigned int a3);
-
+
 int __stdcall sub_1048A(int a1);
-
+
 // int __usercall sub_1056C<eax>(int a1<esi>);
-
+
 // int __usercall sub_105E4<eax>(LSA_UNICODE_STRING *a1<ecx>, int a2<edi>, int a3<esi>);
-
+
 // void __userpurge sub_1076E(int a1<ebx>, PVOID *a2);
-
+
 int *__cdecl sub_107E8();
-
+
 int __stdcall sub_108BE(const char *a1);
-
+
 // signed int __usercall sub_109B0<eax>(int a1<edi>);
-
+
 // int __usercall sub_10A8A<eax>(int a1<edi>, int *a2<esi>);
-
+
 // int __usercall sub_10B36<eax>(int a1<esi>);
-
+
 int __stdcall sub_10BA2(int, int); // weak
-
+
 // int __userpurge sub_10BEC<eax>(int a1<ebp>, int a2, int a3);
-
+
 signed int __stdcall sub_10CFE(int a1, int a2);
-
+
 // int __usercall sub_10DA8<eax>(int a1<ecx>, int a2<edi>, int a3<esi>);
-
+
 void __stdcall NotifyRoutine(int a1, HANDLE Handle, int a3);
-
+
 RTL_GENERIC_TABLE *__cdecl sub_10FE6();
-
+
 // signed int __usercall sub_11066<eax>(int a1<eax>, RTL_GENERIC_TABLE *a2<edi>);
-
+
 bool __stdcall CompareRoutine(int a1, int a2, int a3);
-
+
 void __stdcall FreeRoutine(int a1, PVOID P);
-
+
 // int __userpurge sub_111B4<eax>(int a1<eax>, int a2<ebx>, int a3);
-
+
 // PVOID __userpurge sub_113C2<eax>(int a1<edi>, int a2, int a3);
-
+
 void __fastcall sub_114EC(int a1, int a2, int a3, int a4, int a5);
-
+
 PVOID __stdcall sub_11578(int a1);
-
+
 // signed int __userpurge sub_115CC<eax>(const void *a1<eax>, int a2<ebx>, int a3);
-
+
 __int32 __stdcall sub_1174A(int a1, int a2);
-
+
 // PVOID __usercall sub_1182C<eax>(ULONG a1<esi>);
-
+
 signed int __stdcall sub_118E2(unsigned int a1, int a2);
-
+
 // char __usercall sub_11A08<al>(int a1<edi>);
-
+
 // const char *__usercall sub_11ABC<eax>(const char *result<eax>, int a2<ecx>);
-
+
 int *__cdecl sub_11C14();
-
+
 char __stdcall sub_11D46(int a1, unsigned int a2);
-
+
-
+
-
+
 int __stdcall sub_11F42(int, int, HANDLE Handle); // idb
-
+
 int __stdcall sub_12000(HANDLE Handle, PVOID ProcessInformation); // idb
-
+
-
+
-
+
 int __cdecl sub_1210F(int a1, unsigned int a2);
-
+
-
+
-
+
 bool __cdecl sub_122D0(int a1, unsigned int a2, int a3, int a4);
-
+
 signed int __cdecl sub_1236B(int a1, int a2);
-
+
 // void *__cdecl memcpy(void *, const void *, size_t);
-
+
 // int _SEH_epilog(void); weak
-
+
 int nullsub_2(); // weak
-
+
 int nullsub_3(); // weak
-
+
 // KIRQL __stdcall KeGetCurrentIrql();
-
+
 // NTSTATUS __stdcall ZwReadFile(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID Buffer, ULONG Length, PLARGE_INTEGER ByteOffset, PULONG Key);
-
+
 // NTSTATUS __stdcall ZwOpenFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, ULONG ShareAccess, ULONG OpenOptions);
-
+
 // BOOLEAN __stdcall PsGetVersion(PULONG MajorVersion, PULONG MinorVersion, PULONG BuildNumber, PUNICODE_STRING CSDVersion);
-
+
 // NTSTATUS __stdcall PsSetLoadImageNotifyRoutine(PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine);
-
+
 // void __fastcall IofCompleteRequest(PIRP Irp, CCHAR PriorityBoost);
-
+
 // BOOLEAN __stdcall RtlDeleteElementGenericTable(PRTL_GENERIC_TABLE Table, PVOID Buffer);
-
+
 // PVOID __stdcall RtlLookupElementGenericTable(PRTL_GENERIC_TABLE Table, PVOID Buffer);
-
+
 // PVOID __stdcall RtlInsertElementGenericTable(PRTL_GENERIC_TABLE Table, PVOID Buffer, CLONG BufferSize, PBOOLEAN NewElement);
-
+
 // NTSTATUS __stdcall ZwAllocateVirtualMemory(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG ZeroBits, PULONG AllocationSize, ULONG AllocationType, ULONG Protect);
-
+
 // void __stdcall IoRegisterDriverReinitialization(PDRIVER_OBJECT DriverObject, PDRIVER_REINITIALIZE DriverReinitializationRoutine, PVOID Context);
-
+
 // void __stdcall KeInitializeMutex(PRKMUTEX Mutex, ULONG Level);
-
+
 // NTSTATUS __stdcall KeWaitForSingleObject(PVOID Object, KWAIT_REASON WaitReason, KPROCESSOR_MODE WaitMode, BOOLEAN Alertable, PLARGE_INTEGER Timeout);
-
+
 // NTSTATUS __stdcall ZwOpenKey(PHANDLE KeyHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes);
-
+
 // int __stdcall KeStackAttachProcess(_DWORD, _DWORD); weak
-
+
 // int __stdcall ObOpenObjectByPointer(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD); weak
-
+
 // LONG_PTR __fastcall ObfDereferenceObject(PVOID Object);
-
+
 signed int __cdecl sub_12A95(int a1);
-
+
 int __thiscall sub_12D71(void *this);
-
+
 // int __usercall sub_133BF<eax>(int a1<eax>, int a2, int a3);
-
+
 // int __usercall sub_1356E<eax>(unsigned int *a1<eax>, int a2<ebx>, int a3<edi>, int a4, int a5, int a6);
-
+
 signed int __cdecl sub_136F8(int a1, int a2, int a3);
-
+
 bool __cdecl sub_138DB(int a1, unsigned int a2, int a3, int a4);
-
+
 // signed int __usercall sub_13A4B<eax>(unsigned int a1<eax>, int a2, int a3, unsigned __int16 a4);
-
+
 // int __usercall sub_13BF1<eax>(unsigned int a1<eax>, int a2<ecx>, int a3, int a4, int a5);
-
+
 int __cdecl sub_13C92(int a1, char a2, int a3);
-
+
 // signed int __usercall sub_13D8E<eax>(int a1<eax>, int a2, int a3, unsigned int a4, int (__cdecl *a5)(_DWORD, _DWORD, _DWORD));
-
+
 char __cdecl sub_10300()
-
+
   LSA_UNICODE_STRING DestinationString; // [sp+8h] [bp-18h]@1
-
+
   HANDLE Handle; // [sp+14h] [bp-Ch]@2
-
+
   char v5; // [sp+1Fh] [bp-1h]@1
-
+
   v4 = 0;
-
+
   v5 = v4 == 0;
-
+
   {
-
+
     ZwClose(Handle);
-
+
   return v5;
-
+
 //----- (0001034C) --------------------------------------------------------
-
+
 {
-
+
   {
-
+
     {
-
+
       {
-
+
           sub_10A3A();
-
+
           IoRegisterDriverReinitialization(DriverObject, DriverReinitializationRoutine, 0);
-
+
     }
-
+
 }
-
+
 NTSTATUS __stdcall DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
-
+
   signed int v2; // eax@2
-
+
   unsigned int i; // [sp+14h] [bp-1Ch]@3
-
+
   ms_exc.disabled = 0;
-
+
   dword_1461C = (int)ExAllocatePool(0, 0x200u);
-
+
   {
-
+
     for ( i = (unsigned int)&unk_14380; i < (unsigned int)&unk_14384; i += 4 )
-
+
       if ( *(_DWORD *)i )
-
+
     }
-
+
   }
-
+
   {
-
+
   }
-
+
   {
-
+
     {
-
+
       if ( !IoCreateDevice(DriverObject, 0, &DestinationString, 0x22u, 0x100u, 0, (PDEVICE_OBJECT *)&RegistryPath) )
-
+
         DriverObject->MajorFunction[0] = (PDRIVER_DISPATCH)sub_10BA2;
-
+
         DriverObject->MajorFunction[14] = (PDRIVER_DISPATCH)sub_10BA2;
-
+
         IoRegisterDriverReinitialization(DriverObject, (PDRIVER_REINITIALIZE)DriverReinitializationRoutine, 0);
-
+
     }
-
+
   return 0;
-
+
 // 10BA2: using guessed type int __stdcall sub_10BA2(int, int);
-
+
 // 14624: using guessed type int dword_14624;
-
+
 //----- (0001048A) --------------------------------------------------------
-
+
 {
-
+
   int result; // eax@7
-
+
   int v4; // [sp+Ch] [bp-128h]@6
-
+
   int v6; // [sp+130h] [bp-4h]@3
-
+
   if ( !KeGetCurrentIrql() )
-
+
     sub_1056C((int)&v6);
-
+
       return 0;
-
+
     if ( sub_10886(2) )
-
+
       memset(&v4, 255, 0x11Cu);
-
+
       if ( !*(_DWORD *)v1 )
-
+
       result = (*(int (__stdcall **)(int *))v1)(&v4);
-
+
         return result;
-
+
         return *(_DWORD *)(v1 + 4) != 0 ? 0xC0000001 : 0;
-
+
     v3 = *(int (**)(void))(v1 + 4);
-
+
     {
-
+
         *(_BYTE *)a1 = 0;
-
+
     }
-
+
   }
-
+
   return 0;
-
+
 //----- (00010542) --------------------------------------------------------
-
+
 {
-
+
   char v1; // [sp+7h] [bp-1h]@1
-
+
   result = sub_1048A((int)&v1);
-
+
     result = (v1 != 0 ? 0x3FFFFFFF : 0) - 1073741823;
-
+
 }
-
+
 int __usercall sub_1056C<eax>(int a1<esi>)
-
+
   int v1; // ecx@2
-
+
   if ( !(dword_146A4 & 1) )
-
+
     dword_146A4 |= 1u;
-
+
     sub_107A2(v1, (int)nullsub_1);
-
+
   byte_14614 = 0;
-
+
   return a1;
-
+
 // 124FA: using guessed type int nullsub_1();
-
+
 // 14694: using guessed type int dword_14694;
-
+
 //----- (000105A0) --------------------------------------------------------
-
+
 {
-
+
   char v5; // zf@1
-
+
   v5 = *(_DWORD *)a1 == 0;
-
+
   *(_DWORD *)(a3 + 4) = a2;
-
+
   *(_DWORD *)(a3 + 12) = a2;
-
+
   {
-
+
     {
-
+
         memcpy(*(void **)a3, a4, a2);
-
+
     else
-
+
       *(_DWORD *)a1 = -1073741823;
-
+
   }
-
+
 }
-
+
 int __usercall sub_105E4<eax>(LSA_UNICODE_STRING *a1<ecx>, int a2<edi>, int a3<esi>)
-
+
   char v3; // zf@1
-
+
   OBJECT_ATTRIBUTES ObjectAttributes; // [sp+8h] [bp-20h]@2
-
+
   v3 = *(_DWORD *)a2 == 0;
-
+
   *(_DWORD *)(a3 + 4) = 0;
-
+
   {
-
+
     ObjectAttributes.Length = 24;
-
+
     ObjectAttributes.Attributes = 576;
-
+
     ObjectAttributes.SecurityQualityOfService = 0;
-
+
     *(_DWORD *)a2 = v4;
-
+
   }
-
+
 }
-
+
 ULONG __thiscall sub_10638(LSA_UNICODE_STRING *this, ULONG a2, int a3)
-
+
   char v3; // bl@1
-
+
   HANDLE v5; // ecx@6
-
+
   ULONG v7; // esi@6
-
+
   int v9; // eax@17
-
+
   void **v11; // eax@21
-
+
   char FileInformation; // [sp+10h] [bp-28h]@7
-
+
-
+
-
+
-
+
-
+
   v3 = 0;
-
+
   sub_105E4(this, (int)&IoStatusBlock.Information, (int)&Length);
-
+
     goto LABEL_2;
-
+
   {
-
+
     v6 = v14;
-
+
     v7 = v8;
-
+
   else
-
+
     v5 = Handle;
-
+
-
+
-
+
   IoStatusBlock.Information = v7;
-
+
     goto LABEL_9;
-
+
     goto LABEL_31;
-
+
   if ( v9 )
-
+
   else
-
+
   sub_1076E(a3, (PVOID *)v10);
-
+
   if ( IoStatusBlock.Information )
-
+
 LABEL_2:
-
+
     {
-
+
       ZwClose(Handle);
-
+
     return IoStatusBlock.Information;
-
+
-
+
-
+
     goto LABEL_31;
-
+
   if ( !(_BYTE)Length )
-
+
   v7 = ZwReadFile(Handle, 0, 0, 0, &IoStatusBlock, v12, v6, 0, 0);
-
+
   {
-
+
     if ( (_BYTE)Length != v3 )
-
+
       LOBYTE(Length) = v3;
-
+
     }
-
+
   }
-
+
   {
-
+
     if ( (_BYTE)Length != v3 )
-
+
       LOBYTE(Length) = v3;
-
+
     }
-
+
   }
-
+
   {
-
+
     {
-
+
       ZwClose(Handle);
-
+
     result = 0;
-
+
-
+
-
+
 //----- (0001076E) --------------------------------------------------------
-
+
 {
-
+
   v2 = *(PVOID **)(a1 + 4);
-
+
   {
-
+
     {
-
+
         ExFreePoolWithTag(*v2, 0);
-
+
     }
-
+
-
+
-
+
 //----- (000107A2) --------------------------------------------------------
-
+
 {
-
+
   if ( !byte_14628 )
-
+
   if ( !dword_1461C )
-
+
   if ( dword_14624 <= dword_14620 )
-
+
   _ECX = &dword_14620;
-
+
   __asm { lock xadd [ecx], eax }
-
+
   {
-
+
     result = 0;
-
+
   else
-
+
 LABEL_9:
-
+
   }
-
+
 }
-
+
 // 14620: using guessed type int dword_14620;
-
+
 // 14628: using guessed type char byte_14628;
-
+
 int *__cdecl sub_107E8()
-
+
   int v0; // eax@2
-
+
   dword_14694 = 0;
-
+
   dword_1469C = 0;
-
+
   if ( !sub_10886(0) )
-
+
     v0 = sub_1098E();
-
+
     {
-
+
       {
-
+
         dword_14698 = sub_1236B((int)&v2, -1332885072);
-
+
         dword_146A0 = sub_1236B((int)&v2, 1516803388);
-
+
     }
-
+
   return &dword_14694;
-
+
 // 14694: using guessed type int dword_14694;
-
+
 // 1469C: using guessed type int dword_1469C;
-
+
 //----- (00010886) --------------------------------------------------------
-
+
 {
-
+
   ULONG MajorVersion; // [sp+4h] [bp-4h]@1
-
+
   MinorVersion = 0;
-
+
   return MajorVersion == 5 && a1 == MinorVersion;
-
+
 //----- (000108BE) --------------------------------------------------------
-
+
 {
-
+
   PVOID v2; // esi@6
-
+
   PVOID v5; // [sp-8h] [bp-3Ch]@5
-
+
-
+
-
+
   char *v9; // [sp+24h] [bp-10h]@3
-
+
   ULONG SystemInformationLength; // [sp+2Ch] [bp-8h]@1
-
+
   SystemInformation = 0;
-
+
     || !SystemInformationLength )
-
+
   v9 = 0;
-
+
   v1 = 0;
-
+
   {
-
+
     {
-
+
       v5 = P;
-
+
-
+
-
+
     return 0;
-
+
   v2 = P;
-
+
   {
-
+
       return 0;
-
+
     v6 = v1;
-
+
     goto LABEL_9;
-
+
   if ( *(_DWORD *)v2 <= 0u )
-
+
   v10 = 0;
-
+
   while ( stricmp((const char *)v2 + v10 + *(_WORD *)v9 + 32, a1) )
-
+
     v10 += 284;
-
+
     ++v1;
-
+
     {
-
+
       goto LABEL_8;
-
+
   }
-
+
   ExFreePoolWithTag(v2, 0);
-
+
 }
-
+
 int __cdecl sub_1098E()
-
+
   int result; // eax@1
-
+
   if ( !result )
-
+
   return result;
-
+
 //----- (000109B0) --------------------------------------------------------
-
+
 {
-
+
   if ( byte_14390 )
-
+
     sub_11EC6(0, (int)&dword_14391, 0x278u);
-
+
   }
-
+
   {
-
+
     {
-
+
       memcpy((void *)&word_14395, *(const void **)(a1 + 4), *(_WORD *)a1);
-
+
   }
-
+
     result = -1073741823;
-
+
     result = 0;
-
+
-
+
-
+
 // 14390: using guessed type char byte_14390;
-
+
 //----- (00010A3A) --------------------------------------------------------
-
+
 {
-
+
   char v1; // [sp+8h] [bp-8h]@1
-
+
   v2 = 0;
-
+
-
+
-
+
   {
-
+
     result = sub_10C22(v2);
-
+
     {
-
+
-
+
-
+
     }
-
+
   return result;
-
+
 //----- (00010A8A) --------------------------------------------------------
-
+
-
+
-
+
   int v3; // ecx@4
-
+
   if ( !(dword_146B0 & 1) )
-
+
     v2 = *a2;
-
+
     dword_146AC = v2;
-
+
-
+
-
+
     dword_146B0 |= 2u;
-
+
     sub_107A2(v3, (int)nullsub_3);
-
+
   if ( dword_146AC )
-
+
   else
-
+
   byte_14615 = 0;
-
+
 }
-
+
 // 14615: using guessed type char byte_14615;
-
+
 // 146AC: using guessed type int dword_146AC;
-
+
 //----- (00010AE2) --------------------------------------------------------
-
+
 {
-
+
   *(_DWORD *)a1 = 0;
-
+
   {
-
+
     dword_14690 |= 1u;
-
+
     memset(&Mutex, 0, sizeof(Mutex));
-
+
     sub_107A2(v1, (int)sub_124FE);
-
+
-
+
-
+
   return a1;
-
+
 // 124FE: using guessed type int sub_124FE();
-
+
 // 14664: using guessed type char byte_14664;
-
+
 // 14690: using guessed type int dword_14690;
-
+
 int __usercall sub_10B36<eax>(int a1<esi>)
-
+
-
+
-
+
   if ( !(dword_1468C & 1) )
-
+
     dword_1468C |= 1u;
-
+
     sub_107A2(v1, (int)nullsub_2);
-
+
   byte_14617 = 0;
-
+
   return a1;
-
+
 // 124FC: using guessed type int nullsub_2();
-
+
 // 1468C: using guessed type int dword_1468C;
-
+
 int __thiscall sub_10B68(int this)
-
+
   int result; // eax@3
-
+
   v2 = this;
-
+
   {
-
+
   }
-
+
   {
-
+
     {
-
+
       result = sub_10C22(v2);
-
+
     else
-
+
       result = -1073741822;
-
+
   }
-
+
 }
-
+
 signed int __cdecl sub_10BE8()
-
+
-
+
-
+
 //----- (00010BEC) --------------------------------------------------------
-
+
 {
-
+
   int v4; // esi@1
-
+
   v4 = *(_DWORD *)(a1 + 12);
-
+
   if ( v3 != 259 )
-
+
     if ( v3 )
-
+
     *(_DWORD *)(v4 + 24) = v3;
-
+
-
+
-
+
 }
-
+
 //----- (00010C22) --------------------------------------------------------
-
+
 {
-
+
   int v2; // eax@3
-
+
   int v4; // ecx@3
-
+
   int v7; // edi@9
-
+
   ULONG v9; // [sp+14h] [bp-1Ch]@1
-
+
   LSA_UNICODE_STRING DestinationString; // [sp+20h] [bp-10h]@1
-
+
   v1 = a1;
-
+
   RtlInitUnicodeString(&ValueName, &word_1445D);
-
+
   KeWaitForSingleObject((PVOID)(v1 + 8), 0, 0, 0, 0);
-
+
   if ( v9 )
-
+
     RtlInitUnicodeString((PUNICODE_STRING)&v12, &word_14471);
-
+
     if ( v9 )
-
+
 LABEL_6:
-
+
       goto LABEL_7;
-
+
   }
-
+
-
+
-
+
   if ( sub_11D46(v4, v3) )
-
+
     KeReleaseMutex(v8, 0);
-
+
   }
-
+
   if ( !v9 )
-
+
     v7 = *(_DWORD *)(v1 + 4);
-
+
     {
-
+
       goto LABEL_7;
-
+
     goto LABEL_6;
-
+
 LABEL_7:
-
+
   return v6;
-
+
 // 14539: using guessed type int dword_14539;
-
+
 //----- (00010CFE) --------------------------------------------------------
-
+
 {
-
+
   int v3; // edi@1
-
+
   int v5; // eax@2
-
+
   int v8; // [sp+10h] [bp-4h]@1
-
+
   v4 = 0;
-
+
   KeWaitForSingleObject((PVOID)(a1 + 8), 0, 0, 0, 0);
-
+
   if ( v2 )
-
+
-
+
-
+
     v4 = 0;
-
+
   else
-
+
     v5 = 0;
-
+
   sub_1076E(a2, (PVOID *)v5);
-
+
   {
-
+
       v6 = -1073741823;
-
+
       v6 = 0;
-
+
   else
-
+
     v6 = v8;
-
+
   KeReleaseMutex((PRKMUTEX)(a1 + 8), v4);
-
+
 }
-
+
 void __usercall sub_10D7E(int a1<eax>)
-
+
   PVOID *v1; // edi@2
-
+
   {
-
+
     *(_BYTE *)a1 = 0;
-
+
     {
-
+
         ExFreePoolWithTag(*v1, 0);
-
+
     }
-
+
 }
-
+
 int __usercall sub_10DA8<eax>(int a1<ecx>, int a2<edi>, int a3<esi>)
-
+
   int v4; // eax@1
-
+
   v5 = a1;
-
+
   *(_DWORD *)a2 = *(_DWORD *)(a3 + 8) + *(_DWORD *)a3;
-
+
   *(_DWORD *)(a2 + 4) = v5;
-
+
   return a3;
-
+
 //----- (00010DCC) --------------------------------------------------------
-
+
 {
-
+
   int v4; // esi@9
-
+
   int v6; // ecx@12
-
+
   int i; // [sp+10h] [bp-50h]@4
-
+
   RTL_GENERIC_TABLE *v10; // [sp+18h] [bp-48h]@8
-
+
   int v12; // [sp+20h] [bp-40h]@9
-
+
   int v14; // [sp+28h] [bp-38h]@8
-
+
   int v16; // [sp+30h] [bp-30h]@9
-
+
   int v18; // [sp+38h] [bp-28h]@11
-
+
   char v20; // [sp+40h] [bp-20h]@7
-
+
   char v22; // [sp+4Ch] [bp-14h]@14
-
+
   unsigned int v24; // [sp+58h] [bp-8h]@9
-
+
   if ( sub_117A8(L"KERNEL32.DLL", a1) )
-
+
     sub_1174A((int)Handle, a3);
-
+
   else
-
+
     if ( !sub_10542() )
-
+
       i = 0;
-
+
       if ( !i )
-
+
         if ( v19 == *(_DWORD *)(a3 + 4) )
-
+
           if ( !(dword_14391 & 4) || !v20 )
-
+
             sub_10B36((int)&v10);
-
+
             v13 = 1;
-
+
             sub_10AE2((int)&v11);
-
+
             {
-
+
               v24 = *(_DWORD *)(v14 + 4);
-
+
               v25 = 0;
-
+
               v16 = 0;
-
+
               sub_10DA8(v3, (int)&v15, (int)&v23);
-
+
               v4 = v25;
-
+
               {
-
+
                 {
-
+
                   v17 = 0;
-
+
                   for ( i = 0; i < v9; ++i )
-
+
                     v5 = v4 + v23;
-
+
                     v12 = v4 + v23;
-
+
                     sub_10DA8(v6, (int)&v17, (int)&v23);
-
+
                     if ( v25 > v24 )
-
+
                     if ( sub_117A8(v21, a1) )
-
+
                       v7 = sub_111B4((int)&v15, (int)&v22, *(_DWORD *)(v5 + 12));
-
+
                     }
-
+
                 }
-
+
             }
-
+
           }
-
+
       }
-
+
   }
-
+
 // 124E0: using guessed type wchar_t aKernel32_dll[13];
-
+
 //----- (00010F80) --------------------------------------------------------
-
+
 {
-
+
   {
-
+
       sub_10DCC(a1, Handle, a3);
-
+
 }
-
+
 int __userpurge sub_10FC4<eax>(int result<eax>, int a2)
-
+
-
+
-
+
   if ( (unsigned int)(v2 + 4) <= *(_DWORD *)(result + 4) )
-
+
   *(_DWORD *)(result + 8) = v2 + 4;
-
+
 }
-
+
 RTL_GENERIC_TABLE *__cdecl sub_10FE6()
-
+
-
+
-
+
   dword_14654 = 0;
-
+
   dword_14660 = 0;
-
+
     &Table,
-
+
     (PRTL_GENERIC_ALLOCATE_ROUTINE)AllocateRoutine,
-
+
     0);
-
+
 }
-
+
 // 14658: using guessed type char byte_14658;
-
+
 // 14660: using guessed type int dword_14660;
-
+
 PVOID __usercall sub_11028<eax>(int a1<eax>, RTL_GENERIC_TABLE *a2<edi>)
-
+
   PKSPIN_LOCK v2; // ecx@1
-
+
   PVOID v4; // eax@1
-
+
   KIRQL v6; // dl@2
-
+
-
+
-
+
   sub_1118A((int)&SpinLock, (int)&a2[1]);
-
+
   v2 = SpinLock;
-
+
   --v2[3];
-
+
   if ( v5 )
-
+
-
+
-
+
     KfReleaseSpinLock(v2, v6);
-
+
   return v3;
-
+
 //----- (00011066) --------------------------------------------------------
-
+
 {
-
+
   BOOLEAN v3; // al@1
-
+
   KIRQL v5; // dl@3
-
+
   char v7; // zf@5
-
+
   int Buffer; // [sp+8h] [bp-18h]@1
-
+
   Buffer = a1;
-
+
   v3 = RtlDeleteElementGenericTable(a2, &Buffer);
-
+
   if ( v3 )
-
+
     v7 = *(_DWORD *)(v10 + 12)-- == 1;
-
+
     {
-
+
       *(_DWORD *)(v2 + 8) = 0;
-
+
     }
-
+
   }
-
+
   {
-
+
     if ( v4 )
-
+
       v5 = *(_BYTE *)(v2 + 4);
-
+
       KfReleaseSpinLock((PKSPIN_LOCK)v2, v5);
-
+
     result = -1073741823;
-
+
   return result;
-
+
 //----- (000110C0) --------------------------------------------------------
-
+
 {
-
+
   PKSPIN_LOCK v3; // ecx@3
-
+
-
+
-
+
   char v8; // zf@10
-
+
   PKSPIN_LOCK SpinLock; // [sp+Ch] [bp-4h]@1
-
+
   sub_1118A((int)&SpinLock, (int)&a1[1]);
-
+
   {
-
+
     v4 = SpinLock[3] == 1;
-
+
-
+
-
+
     v3[2] = 0;
-
+
     KfReleaseSpinLock(v3, *((_BYTE *)v3 + 4));
-
+
   }
-
+
   v3 = SpinLock;
-
+
   {
-
+
     if ( !v7 )
-
+
     v3[2] = 0;
-
+
   }
-
+
   if ( v8 )
-
+
     v9 = *((_BYTE *)v3 + 4);
-
+
     KfReleaseSpinLock(v3, v9);
-
+
   return 0;
-
+
 //----- (00011142) --------------------------------------------------------
-
+
 {
-
+
   if ( *(_DWORD *)a2 == *(_DWORD *)a3 )
-
+
   else
-
+
   return result;
-
+
 //----- (00011160) --------------------------------------------------------
-
+
 {
-
+
 }
-
+
 void __stdcall FreeRoutine(int a1, PVOID P)
-
+
   if ( P )
-
+
 }
-
+
 int __usercall sub_1118A<eax>(int a1<ebx>, int a2<esi>)
-
+
-
+
-
+
   *(_DWORD *)a1 = a2;
-
+
   if ( v2 != *(PKTHREAD *)(a2 + 8) )
-
+
     v3 = KfAcquireSpinLock((PKSPIN_LOCK)a2);
-
+
     *(_BYTE *)(a2 + 4) = v3;
-
+
   }
-
+
-
+
-
+
 //----- (000111B4) --------------------------------------------------------
-
+
 {
-
+
   int v4; // ecx@2
-
+
   int v7; // [sp+8h] [bp-24h]@2
-
+
   unsigned int v9; // [sp+10h] [bp-1Ch]@2
-
+
-
+
-
+
   unsigned int v13; // [sp+20h] [bp-Ch]@2
-
+
   v3 = 0;
-
+
     && (v4 = *(_DWORD *)a1,
-
+
         v7 = v4,
-
+
         v10 = 0,
-
+
         sub_10FC4((int)&v7, (int)&v13),
-
+
     && (v14 = 0, v13 > 0) )
-
+
     while ( 1 )
-
+
       sub_10FC4((int)&v7, (int)&v12);
-
+
       if ( v9 > v8 )
-
+
 LABEL_7:
-
+
         goto LABEL_8;
-
+
       if ( a3 == v12 )
-
+
-
+
-
+
         goto LABEL_7;
-
+
     *(_DWORD *)a2 = v10;
-
+
   }
-
+
   {
-
+
     *(_DWORD *)a2 = v3;
-
+
   }
-
+
 }
-
+
 signed int __userpurge sub_11242<eax>(int a1<eax>, int a2, int a3)
-
+
   signed int result; // eax@1
-
+
   PVOID v5; // edi@2
-
+
   int v7; // ebx@4
-
+
   void *v9; // ST08_4@4
-
+
   char v11; // [sp+10h] [bp-38h]@1
-
+
   int v13; // [sp+1Ch] [bp-2Ch]@4
-
+
   int v15; // [sp+34h] [bp-14h]@7
-
+
   int v17; // [sp+3Ch] [bp-Ch]@8
-
+
   int v19; // [sp+44h] [bp-4h]@6
-
+
   if ( !result )
-
+
     v4 = sub_1182C(dword_12680 + 4981);
-
+
     if ( v4
-
+
           memcpy(v4, &unk_12EB8, 0x1375u),
-
+
           *(_WORD *)v7 = 23117,
-
+
           *(_WORD *)(dword_12690 + v7) = 267,
-
+
           *(_DWORD *)(a3 + 4) = v7 + dword_12688,
-
+
           *(_DWORD *)(*(_DWORD *)(a3 + 4) + 88) = v5,
-
+
           *(_DWORD *)(*(_DWORD *)(a3 + 4) + 104) = dword_12680,
-
+
           v8 = v18,
-
+
       && v12 + *(_DWORD *)(v6 + 8) + *(_DWORD *)(v6 + 12) >= v8 + 12 )
-
+
       result = sub_118E2(v8, (int)&v11);
-
+
       if ( !result )
-
+
         sub_10A8A((int)&v15, &v19);
-
+
         if ( !v19 )
-
+
           v16 = v18;
-
+
           result = (*(int (__stdcall **)(signed int, unsigned int *, int *, signed int, int *))v15)(
-
+
                      &v16,
-
+
                      128,
-
+
           if ( !result )
-
+
             result = sub_11864((HANDLE *)(*(_DWORD *)(a3 + 4) + 144));
-
+
             {
-
+
               *(_DWORD *)a3 = a2;
-
+
               *(_DWORD *)(a3 + 12) = v18;
-
+
               result = 0;
-
+
           }
-
+
       }
-
+
     else
-
+
       result = -1073741823;
-
+
   }
-
+
 }
-
+
-
+
-
+
 // 12690: using guessed type int dword_12690;
-
+
 PVOID __userpurge sub_113C2<eax>(int a1<edi>, int a2, int a3)
-
+
   PVOID result; // eax@1
-
+
   int v5; // ebx@2
-
+
-
+
-
+
   {
-
+
     memcpy((char *)result + 40, *(const void **)a1, *(_DWORD *)(a1 + 4));
-
+
     *((_DWORD *)v4 + 4) = *(_DWORD *)(a1 + 4);
-
+
     *((_BYTE *)v4 + 32) = (*(_BYTE *)(a2 + 6) >> 1) & 1;
-
+
     result = *(PVOID *)(a3 + 4);
-
+
-
+
-
+
 }
-
+
 void __userpurge sub_1141E(int a1<eax>, int a2<ecx>, int a3<ebx>, int a4, int a5)
-
+
   int v5; // esi@1
-
+
   int v7; // edi@2
-
+
-
+
-
+
   RTL_GENERIC_TABLE *v11; // edi@10
-
+
   LSA_UNICODE_STRING DestinationString; // [sp+1Ch] [bp-1Ch]@3
-
+
   int v15; // [sp+28h] [bp-10h]@9
-
+
   int v17; // [sp+30h] [bp-8h]@1
-
+
   v17 = 0;
-
+
   v5 = a2;
-
+
   if ( v6 )
-
+
     v7 = *(_DWORD *)(a1 + 4);
-
+
   }
-
+
   {
-
+
     if ( sub_10638(&DestinationString, dword_14539, (int)&v16) )
-
+
       v9 = *(_DWORD *)v5;
-
+
     }
-
+
     {
-
+
       if ( *(_BYTE *)(a3 + 6) & 1 )
-
+
       v9 = *(_DWORD *)v8;
-
+
     }
-
+
   }
-
+
   if ( v7 )
-
+
     sub_10B36((int)&v18);
-
+
     v10 = (int)sub_11028(a4, v18);
-
+
       sub_113C2((int)&v14, a3, v10);
-
+
-
+
-
+
 // 14539: using guessed type int dword_14539;
-
+
 void __fastcall sub_114EC(int a1, int a2, int a3, int a4, int a5)
-
+
   sub_1141E(a5, a1, a2, a3, a4);
-
+
 //----- (00011522) --------------------------------------------------------
-
+
 {
-
+
   char v7; // [sp+Ch] [bp-28h]@1
-
+
-
+
-
+
   v10 = 0;
-
+
   if ( !v10 )
-
+
   if ( v7 )
-
+
     v7 = 0;
-
+
   }
-
+
 }
-
+
 //----- (00011578) --------------------------------------------------------
-
+
 {
-
+
   sub_10B36((int)&v2);
-
+
 }
-
+
 PVOID __stdcall sub_11598(int a1)
-
+
   return sub_11578(a1);
-
+
 //----- (000115CC) --------------------------------------------------------
-
+
 {
-
+
   int v4; // ST38_4@1
-
+
   char v6; // zf@2
-
+
-
+
-
+
   char v10; // [sp+8h] [bp-38h]@1
-
+
   int v12; // [sp+2Ch] [bp-14h]@2
-
+
   int v14; // [sp+34h] [bp-Ch]@12
-
+
   v4 = *(_DWORD *)(a2 + 4);
-
+
   result = sub_121E1((int)&v10, v4, 1);
-
+
-
+
-
+
     sub_11066(a3, v15);
-
+
     *(_DWORD *)v12 = *(_DWORD *)(a2 + 4);
-
+
     *(_DWORD *)(v5 + 16) = sub_1236B((int)&v10, -1871298611);
-
+
     *(_DWORD *)(v5 + 32) = sub_1236B((int)&v10, 578844873);
-
+
     *(_DWORD *)(v5 + 48) = sub_1236B((int)&v10, 1538689877);
-
+
     *(_DWORD *)(v5 + 64) = sub_1236B((int)&v10, -411935863);
-
+
     result = sub_1236B((int)&v10, 201870840);
-
+
     *(_DWORD *)(v5 + 80) = result;
-
+
     {
-
+
       {
-
+
         {
-
+
           {
-
+
             {
-
+
               {
-
+
                 {
-
+
                   {
-
+
                     {
-
+
                       {
-
+
                         v7 = v5 + 120;
-
+
                         v9 = v14;
-
+
                         v9 += 4;
-
+
                         *(_DWORD *)v7 = *(_DWORD *)v9;
-
+
                         *(_DWORD *)result = *(_DWORD *)"ž";
-
+
                         *(_BYTE *)(result + 6) = asc_12678[6];
-
+
                       }
-
+
-
+
-
+
               }
-
+
           }
-
+
       }
-
+
   }
-
+
-
+
-
+
 signed int __thiscall sub_11718(int this, int a2, const void *a3)
-
+
   return sub_115CC(a3, this, a2);
-
+
 //----- (0001174A) --------------------------------------------------------
-
+
 {
-
+
   const void *v3; // edi@1
-
+
   char v5; // [sp+8h] [bp-28h]@2
-
+
   char v7; // [sp+14h] [bp-1Ch]@5
-
+
   result = (__int32)sub_11598(a1);
-
+
   if ( result )
-
+
     v8 = 0;
-
+
     if ( !v8 )
-
+
     if ( v5 )
-
+
       v5 = 0;
-
+
     }
-
+
   }
-
+
 }
-
+
 //----- (000117A8) --------------------------------------------------------
-
+
 {
-
+
   int v3; // esi@1
-
+
-
+
-
+
   char result; // al@4
-
+
   WCHAR *v9; // esi@6
-
+
   int v11; // [sp+8h] [bp-Ch]@3
-
+
   int v13; // [sp+10h] [bp-4h]@6
-
+
-
+
-
+
   {
-
+
     ++a1;
-
+
   while ( v4 );
-
+
   v5 = (unsigned __int16)(*(_WORD *)a2 >> 1);
-
+
   if ( v6 <= v5 )
-
+
     v12 = 0;
-
+
     if ( v6 )
-
+
       v13 = v8 - (_DWORD)v2;
-
+
       while ( 1 )
-
+
         v10 = RtlUpcaseUnicodeChar(*(WCHAR *)((char *)v9 + v13));
-
+
           break;
-
+
         ++v9;
-
+
           goto LABEL_9;
-
+
       result = 0;
-
+
-
+
-
+
 LABEL_9:
-
+
     }
-
+
   else
-
+
     result = 0;
-
+
   return result;
-
+
-
+
-
+
 {
-
+
   PVOID BaseAddress; // [sp+0h] [bp-8h]@1
-
+
   BaseAddress = 0;
-
+
   if ( ZwAllocateVirtualMemory((HANDLE)0xFFFFFFFF, &BaseAddress, 0, &AllocationSize, 0x1000u, 0x40u)
-
+
     result = 0;
-
+
     result = BaseAddress;
-
+
 }
-
+
 int __usercall sub_11864<eax>(HANDLE *a1<edi>)
-
+
   signed int v1; // esi@1
-
+
   HANDLE Handle; // [sp+4h] [bp-4Ch]@3
-
+
   struct _IO_STATUS_BLOCK IoStatusBlock; // [sp+3Ch] [bp-14h]@2
-
+
   NTSTATUS v8; // [sp+4Ch] [bp-4h]@2
-
+
   ObjectAttributes.RootDirectory = 0;
-
+
   ObjectAttributes.SecurityQualityOfService = 0;
-
+
   ObjectAttributes.Attributes = 64;
-
+
   v1 = 0;
-
+
   {
-
+
     if ( v8 )
-
+
     *(&Handle + v1++) = *a1;
-
+
-
+
-
+
   ++v1;
-
+
   for ( i = v1 - 2; i >= 0; --i )
-
+
   return v8;
-
+
 //----- (000118E2) --------------------------------------------------------
-
+
 {
-
+
-
+
-
+
   int v5; // ecx@6
-
+
   unsigned int v7; // eax@9
-
+
   int v9; // eax@11
-
+
   unsigned int v11; // [sp+4h] [bp-Ch]@10
-
+
   int v13; // [sp+Ch] [bp-4h]@3
-
+
-
+
-
+
     result = 0;
-
+
   else
-
+
     if ( v3 )
-
+
       result = -1073741823;
-
+
     else
-
+
       v5 = v13;
-
+
       for ( i = v13 + v12; v5 + 8 <= (unsigned int)i; v13 = v5 )
-
+
         v6 = *(_DWORD *)(v5 + 4);
-
+
           break;
-
+
           return -1073741823;
-
+
         v8 = 0;
-
+
         {
-
+
           {
-
+
-
+
-
+
               if ( v9 >= a1 && v9 < a1 + 12 )
-
+
             }
-
+
           }
-
+
         }
-
+
         v4 = v5 + 8;
-
+
       result = 0;
-
+
   }
-
+
 }
-
+
 char __fastcall sub_119AE(int a1, int a2)
-
+
   int v2; // eax@1
-
+
   return !(v2 & 0x2000000)
-
+
       && v2 & 0x20
-
+
       && (!strncmp((const char *)a2, ".text", 8) || !strncmp((const char *)a2, "PAGE", 8));
-
+
 //----- (00011A08) --------------------------------------------------------
-
+
-
+
-
+
   v1 = 0;
-
+
   {
-
+
     if ( v1 >= 0x14 )
-
+
                                                                                                  - a1);
-
+
   return 0;
-
+
 //----- (00011A4A) --------------------------------------------------------
-
+
 {
-
+
   int v4; // edx@4
-
+
   int v6; // edx@5
-
+
   int v9; // [sp-4h] [bp-10h]@4
-
+
   v10 = 0;
-
+
   while ( 1 )
-
+
     if ( a3 <= v3 + 5 )
-
+
     if ( *(_BYTE *)v3 == -24 )
-
+
       v5 = *(_DWORD *)(v3 + 1) + v3 + 5;
-
+
       if ( v4 )
-
+
         if ( sub_119AE(v9, v4) )
-
+
           v7 = *(_DWORD *)(v6 + 8);
-
+
             v7 = *(_DWORD *)(v6 + 16);
-
+
             break;
-
+
       }
-
+
     ++v10;
-
+
     if ( v10 >= 0x1E )
-
+
   }
-
+
 }
-
+
 const char *__usercall sub_11ABC<eax>(const char *result<eax>, int a2<ecx>)
-
+
   int v2; // ebx@1
-
+
   while ( (unsigned int)result < v2 )
-
+
     while ( (unsigned int)result <= v2 - 4 )
-
+
       if ( *(_DWORD *)result == dword_12658 )
-
+
       ++result;
-
+
     result = 0;
-
+
     if ( !result )
-
+
     if ( !strncmp(result, (const char *)&dword_12658, 14) )
-
+
     ++result;
-
+
   return 0;
-
+
 // 12658: using guessed type int dword_12658;
-
+
 int __stdcall sub_11B04(int a1, const char *a2, unsigned int a3, int a4, int a5)
-
+
   int result; // eax@2
-
+
   int v7; // eax@17
-
+
   int v9; // eax@24
-
+
   int v11; // [sp+Ch] [bp-4h]@14
-
+
-
+
-
+
     result = (int)sub_11ABC(a2, a3);
-
+
     {
-
+
         *(_BYTE *)a5 = 1;
-
+
         *(_DWORD *)a4 = result;
-
+
   }
-
+
   {
-
+
     result = a3 - 10;
-
+
     if ( (unsigned int)a2 < a3 - 10 )
-
+
       while ( 2 )
-
+
-
+
-
+
           if ( result > a3 - 14 )
-
+
             v11 = 0;
-
+
           }
-
+
             break;
-
+
         v11 = result;
-
+
         if ( v11 )
-
+
           if ( !strncmp((const char *)v11, (const char *)&dword_12628, 5) )
-
+
             v8 = 0;
-
+
             while ( (unsigned int)&v6[v8] < v11 )
-
+
               if ( *(_BYTE *)v7 == -24
-
+
               {
-
+
                 if ( !v9 )
-
+
                 if ( !*(_DWORD *)a4 || v9 == *(_DWORD *)a4 )
-
+
                   *(_DWORD *)a4 = v9;
-
+
                 }
-
+
                 *(_BYTE *)a5 = 1;
-
+
               }
-
+
               --v7;
-
+
                 break;
-
+
           }
-
+
           result = v10;
-
+
           {
-
+
             continue;
-
+
         }
-
+
       }
-
+
   }
-
+
 }
-
+
 //----- (00011C14) --------------------------------------------------------
-
+
 {
-
+
   int v1; // eax@2
-
+
-
+
-
+
   int v5; // edx@5
-
+
   int v7; // eax@8
-
+
   char v10; // [sp+Ch] [bp-2Ch]@3
-
+
   unsigned __int16 v12; // [sp+24h] [bp-14h]@4
-
+
-
+
-
+
   v0 = 0;
-
+
   if ( !dword_146AC )
-
+
     v1 = sub_1098E();
-
+
     if ( v1 )
-
+
       if ( !sub_121E1((int)&v10, v1, 1) )
-
+
         v3 = v12;
-
+
         v14 = 0;
-
+
         {
-
+
           {
-
+
             {
-
+
               if ( *(_DWORD *)(v5 + 8) < v6 )
-
+
               v7 = v13 + *(_DWORD *)(v5 + 12);
-
+
-
+
-
+
               if ( v15 )
-
+
             }
-
+
             if ( (_WORD)v0 >= (unsigned __int16)v3 )
-
+
               if ( !v14 )
-
+
               dword_146A8 = v14;
-
+
-
+
-
+
         }
-
+
     }
-
+
   }
-
+
 }
-
+
 // 146AC: using guessed type int dword_146AC;
-
+
 int __stdcall sub_11CCC(int a1)
-
+
   int v1; // eax@1
-
+
   int v3; // ebx@4
-
+
-
+
-
+
   *(_DWORD *)(a1 + 28) = 0;
-
+
   {
-
+
   }
-
+
   {
-
+
     if ( *(_DWORD *)v3 == -1347686387 )
-
+
       v5 = 0;
-
+
       result = v5;
-
+
       {
-
+
                    *(_DWORD *)(v3 + 8),
-
+
                    v3 + 24,
-
+
                    v3 + 32);
-
+
         {
-
+
           result = 0;
-
+
       }
-
+
     else
-
+
       result = -1073741811;
-
+
   }
-
+
 }
-
+
 char __stdcall sub_11D46(int a1, unsigned int a2)
-
+
   char result; // al@1
-
+
   v3 = 0;
-
+
   if ( a2 )
-
+
     do
-
+
     while ( v3 < a2 );
-
+
   return result;
-
+
 //----- (00011D62) --------------------------------------------------------
-
+
-
+
-
+
   OBJECT_ATTRIBUTES ObjectAttributes; // [sp+8h] [bp-20h]@1
-
+
   HANDLE Handle; // [sp+24h] [bp-4h]@1
-
+
   LOBYTE(v6) = 0;
-
+
   ObjectAttributes.Length = 24;
-
+
   ObjectAttributes.Attributes = 64;
-
+
   ObjectAttributes.SecurityQualityOfService = 0;
-
+
   LOBYTE(v6) = v3 == 0;
-
+
     v3 = sub_11DD6((int)&v6, ValueName, a3);
-
+
   {
-
+
     ZwClose(Handle);
-
+
   return v3;
-
+
 //----- (00011DD6) --------------------------------------------------------
-
+
 {
-
+
   signed int v5; // esi@14
-
+
   int v7; // eax@17
-
+
   ULONG v9; // [sp-4h] [bp-30h]@7
-
+
   ULONG ResultLength; // [sp+20h] [bp-Ch]@4
-
+
   if ( !*(_BYTE *)a1
-
+
         ZwQueryValueKey(*(HANDLE *)(a1 + 4), ValueName, KeyValuePartialInformation, 0, 0, &ResultLength) != -1073741789) )
-
+
   v12 = 0;
-
+
   if ( v12 )
-
+
     if ( !P )
-
+
     v9 = 0;
-
+
 LABEL_8:
-
+
     return v12;
-
+
   v4 = P;
-
+
   if ( v12 )
-
+
     if ( !v4 )
-
+
     v9 = 0;
-
+
     goto LABEL_8;
-
+
   if ( *((_DWORD *)v4 + 1) == 3 )
-
+
     v6 = (int)ExAllocatePool(0, 0x10u);
-
+
     {
-
+
       v4 = P;
-
+
     else
-
+
       v7 = 0;
-
+
     sub_1076E(a3, (PVOID *)v7);
-
+
     if ( v12 )
-
+
       v5 = v12;
-
+
     }
-
+
       goto LABEL_15;
-
+
   v5 = -1073741823;
-
+
   ExFreePoolWithTag(v4, 0);
-
+
 }
-
+
 int __usercall sub_11EC6<eax>(char a1<al>, int a2<ecx>, unsigned int a3<esi>)
-
+
   unsigned int v3; // edx@2
-
+
   int result; // eax@6
-
+
   char v8; // [sp+Ch] [bp-Ch]@1
-
+
   unsigned int v10; // [sp+14h] [bp-4h]@1
-
+
   v7 = a1 ^ 0xD;
-
+
   v9 = 7;
-
+
   {
-
+
     if ( a3 )
-
+
       do
-
+
         *(_BYTE *)(v3 + a2) ^= v9 * v8 + v3 * v7;
-
+
       }
-
+
     }
-
+
     if ( v10 )
-
+
       do
-
+
         *(_BYTE *)(v4 + a2) ^= *(_BYTE *)(((a3 + 1) >> 1) + a2 + v4);
-
+
       }
-
+
     }
-
+
       *(_BYTE *)(result + a2) -= *(_BYTE *)(result + a2 - 1);
-
+
   while ( v9-- - 1 >= 0 );
-
+
 }
-
+
 int __stdcall sub_11F42(int a1, int a2, HANDLE Handle)
-
+
   int v3; // eax@2
-
+
   int v5; // eax@5
-
+
-
+
-
+
   *(_DWORD *)a1 = 0;
-
+
   if ( !*(_DWORD *)a2 )
-
+
     ms_exc.disabled = 0;
-
+
     *(_DWORD *)a2 = v3;
-
+
     {
-
+
       if ( v8 && (v5 = *(_DWORD *)(v8 + 8)) != 0 )
-
+
         *(_DWORD *)a1 = v5;
-
+
       }
-
+
       {
-
+
-
+
-
+
     ms_exc.disabled = -1;
-
+
   return a1;
-
+
 //----- (00011FC0) --------------------------------------------------------
-
+
 {
-
+
-
+
-
+
   if ( !*(_DWORD *)a2 )
-
+
     KeStackAttachProcess(*(_DWORD *)(a1 + 8), a1 + 12);
-
+
   }
-
+
 }
-
+
 //----- (00012000) --------------------------------------------------------
-
+
 {
-
+
-
+
-
+
   PVOID Object; // [sp+14h] [bp-Ch]@3
-
+
   int v7; // [sp+1Ch] [bp-4h]@1
-
+
   sub_12094((int)&v4, (int)&v7, (int)Handle);
-
+
   {
-
+
     {
-
+
       ObfDereferenceObject(Object);
-
+
     result = v7;
-
+
   else
-
+
     Handle = 0;
-
+
     if ( !v3 )
-
+
       ReturnLength = 0;
-
+
     }
-
+
       ZwClose(Handle);
-
+
     {
-
+
       ObfDereferenceObject(Object);
-
+
     result = v3;
-
+
   return result;
-
+
 // 1260C: using guessed type int __stdcall ObOpenObjectByPointer(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD);
-
+
 int __userpurge sub_12094<eax>(int a1<ebx>, int a2<edi>, int a3)
-
+
   char v3; // zf@1
-
+
-
+
-
+
   *(_BYTE *)a1 = 0;
-
+
   {
-
+
     *(_DWORD *)a2 = v4;
-
+
     {
-
+
         *(_BYTE *)a1 = 1;
-
+
         *(_DWORD *)a2 = -1073741823;
-
+
   }
-
+
 }
-
+
 //----- (000120CC) --------------------------------------------------------
-
+
 {
-
+
-
+
-
+
     v2 = *(void **)(result + 4);
-
+
     result = ObfDereferenceObject(v2);
-
+
   return result;
-
+
 //----- (000120DE) --------------------------------------------------------
-
+
 {
-
+
   int v2; // edx@1
-
+
   int v4; // esi@2
-
+
   v3 = *(_BYTE *)a1;
-
+
   {
-
+
     ++v2;
-
+
   }
-
+
 }
-
+
 int __cdecl sub_1210F(int a1, unsigned int a2)
-
+
   unsigned __int16 v2; // bx@1
-
+
   int v4; // esi@1
-
+
-
+
-
+
   int result; // eax@8
-
+
   v2 = *(_WORD *)(a1 + 24);
-
+
   v3 = 0;
-
+
   {
-
+
     result = 0;
-
+
   else
-
+
     v9 = *(_DWORD *)(a1 + 8);
-
+
     {
-
+
       v6 = *(_DWORD *)(v5 + 8);
-
+
         v6 = *(_DWORD *)(v5 + 16);
-
+
       if ( a2 >= v7 )
-
+
         if ( a2 < v6 + v7 )
-
+
-
+
-
+
       if ( (_WORD)v3 >= v2 )
-
+
     }
-
+
   }
-
+
 }
-
+
 signed int __usercall sub_1216B<eax>(int a1<eax>, unsigned int a2<ebx>)
-
+
   int v2; // esi@1
-
+
   int v4; // edi@3
-
+
   unsigned int v6; // ecx@6
-
+
   int v8; // esi@12
-
+
   v2 = *(_DWORD *)(a1 + 20);
-
+
   if ( a2 < *(_DWORD *)(a1 + 26) )
-
+
     v4 = 0;
-
+
       goto LABEL_17;
-
+
       goto LABEL_14;
-
+
     {
-
+
       v6 = *(_DWORD *)(v5 + 8);
-
+
         v6 = *(_DWORD *)(v5 + 16);
-
+
       if ( a2 >= v7 )
-
+
         if ( a2 < v6 + v7 )
-
+
       }
-
+
       if ( (_WORD)v4 >= v9 )
-
+
     }
-
+
     if ( v8 & 0x2000000 || !(v8 & 0x40000000) )
-
+
       result = 0;
-
+
 LABEL_17:
-
+
   }
-
+
   {
-
+
   }
-
+
-
+
-
+
 signed int __cdecl sub_121E1(int a1, int a2, int a3)
-
+
   int v4; // eax@3
-
+
   int v6; // edx@7
-
+
   __int16 v8; // dx@12
-
+
     return 1;
-
+
   if ( 22531 == (v5 ^ 0x594F) )
-
+
     if ( (*(_WORD *)(v4 + 24) ^ 0x5908) == 22531 && *(_WORD *)(v4 + 20) == 224 )
-
+
       v7 = a1;
-
+
       v6 = v4 + 120;
-
+
       *(_DWORD *)(v7 + 16) = v6;
-
+
       *(_DWORD *)(v7 + 20) = *(_WORD *)(v4 + 20) + v4 + 24;
-
+
-
+
-
+
       *(_WORD *)(v7 + 24) = v8;
-
+
       return 0;
-
+
   }
-
+
   {
-
+
     {
-
+
       *(_DWORD *)a1 = 1;
-
+
       goto LABEL_12;
-
+
   }
-
+
 }
-
+
 signed int __cdecl sub_122B3(int a1, unsigned int a2)
-
+
   signed int result; // eax@1
-
+
   if ( result )
-
+
   return result;
-
+
 //----- (000122D0) --------------------------------------------------------
-
+
 {
-
+
   bool result; // eax@2
-
+
   v4 = *(_DWORD *)(a1 + 16) + 8 * a2;
-
+
     return 1;
-
+
   if ( *(_DWORD *)v4 )
-
+
     if ( v6 + *(_DWORD *)(v4 + 4) > *(_DWORD *)(a1 + 26) )
-
+
     *(_DWORD *)a3 = sub_122B3(a1, *(_DWORD *)v4);
-
+
     result = *(_DWORD *)a3 == 0;
-
+
   else
-
+
     LOBYTE(v6) = *(_DWORD *)(v4 + 4) == v6;
-
+
   }
-
+
 }
-
+
 signed int __usercall sub_12323<eax>(unsigned int a1<eax>, int a2, int a3, unsigned __int16 a4)
-
+
   signed int v4; // eax@1
-
+
   unsigned int v6; // eax@3
-
+
   v5 = a1;
-
+
   if ( !v4
-
+
     || (v6 = *(_DWORD *)(v4 + 4 * a4), !v6)
-
+
     || result >= v5 && result < a3 + v5 )
-
+
-
+
-
+
 //----- (0001236B) --------------------------------------------------------
-
+
 {
-
+
   signed int result; // eax@2
-
+
   unsigned int v5; // ebx@6
-
+
-
+
-
+
   int v9; // [sp+Ch] [bp-4h]@1
-
+
   if ( sub_122D0(a1, 0, (int)&v9, (int)&v7) )
-
+
     result = 0;
-
+
   else
-
+
     v4 = v9;
-
+
     if ( v9 && (v8 = sub_122B3(a1, *(_DWORD *)(v4 + 36))) != 0 )
-
+
-
+
-
+
       {
-
+
         {
-
+
           if ( !v6 )
-
+
           if ( sub_120DE(v6) == a2 )
-
+
           ++v2;
-
+
-
+
-
+
       result = 0;
-
+
     else
-
+
       result = 0;
-
+
   }
-
+
 }
-
+
 signed int __usercall sub_12A24<eax>(int a1<esi>)
-
+
-
+
-
+
   int v3; // eax@1
-
+
   signed int result; // eax@2
-
+
   v2 = *(int (__stdcall **)(_DWORD))(v1 + 32);
-
+
   *(_DWORD *)(a1 + 1) = 57;
-
+
   *(_DWORD *)(a1 + 17) = sub_12D71((void *)0x686);
-
+
-
+
-
+
   v3 = sub_12D71((void *)0x260);
-
+
   *(_DWORD *)(a1 + 33) = v4;
-
+
   {
-
+
     *(_DWORD *)(a1 + 45) = 0;
-
+
     result = 0;
-
+
   else
-
+
     result = 1;
-
+
   return result;
-
+
 //----- (00012A95) --------------------------------------------------------
-
+
 {
-
+
   int v2; // edi@1
-
+
   int v4; // eax@2
-
+
-
+
-
+
   int v8; // [sp+51h] [bp-3Fh]@2
-
+
   int (__cdecl *v10)(char *); // [sp+88h] [bp-8h]@1
-
+
   v2 = *(_DWORD *)(a1 + 88);
-
+
   v10 = (int (__cdecl *)(char *))(v2 + 149 + *(_DWORD *)(v2 + 129));
-
+
   *(_DWORD *)(v2 + 149 + *(_DWORD *)(v2 + 141)) = 17744;
-
+
   result = sub_12A24((int)&v7);
-
+
   {
-
+
     v8 = v2 + 149;
-
+
     v4 = sub_12D71((void *)0x350);
-
+
     if ( !result )
-
+
       result = sub_12A24((int)&v7);
-
+
       {
-
+
         v9 = *(_DWORD *)(a1 + 104);
-
+
         result = v11(&v7, (int)&v6);
-
+
-
+
-
+
           if ( result )
-
+
         }
-
+
     }
-
+
   return result;
-
+
 //----- (00012D37) --------------------------------------------------------
-
+
 {
-
+
   bool result; // eax@2
-
+
   v2 = *(int (__stdcall **)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD))(a1 + 80);
-
+
   if ( v2(*(_DWORD *)(a1 + 144), 2242560, a2, 40, a2, 40, &v4, 0) )
-
+
   else
-
+
   return result;
-
+
 //----- (00012D71) --------------------------------------------------------
-
+
 {
-
+
 }
-
+
 signed int __usercall sub_13343<eax>(int a1<eax>, unsigned int a2)
-
+
   unsigned int v2; // edi@1
-
+
   unsigned int v5; // ebx@4
-
+
   unsigned int v7; // edx@8
-
+
   unsigned int v9; // [sp+8h] [bp-4h]@1
-
+
   LOWORD(v2) = *(_WORD *)(a1 + 24);
-
+
     return 2;
-
+
   if ( !(*(_DWORD *)(a1 + 26) % *(_DWORD *)(v4 + 56)) && *(_WORD *)(v4 + 6) )
-
+
     v2 = (unsigned __int16)v2;
-
+
       return 0;
-
+
     while ( 1 )
-
+
       v8 = *(_DWORD *)v6;
-
+
       if ( *(_DWORD *)v6 >= v7 )
-
+
       if ( v8 + *(_DWORD *)(v6 + 4) > a2 || v7 + *(_DWORD *)(v6 - 4) > v5 )
-
+
       v6 += 40;
-
+
       if ( v9 >= v2 )
-
+
     }
-
+
   return 2;
-
+
 //----- (000133BF) --------------------------------------------------------
-
+
 {
-
+
   int v4; // ecx@1
-
+
   int v6; // esi@2
-
+
   int v8; // ecx@5
-
+
   v4 = *(_DWORD *)(a1 + 20);
-
+
   if ( result )
-
+
-
+
-
+
     do
-
+
       v7 = *(_DWORD *)v6;
-
+
         v7 = *(_DWORD *)(v6 + 8);
-
+
       result = a3 + *(_DWORD *)(v6 + 4);
-
+
       {
-
+
         *(_BYTE *)result++ = *(_BYTE *)v8;
-
+
       v6 += 40;
-
+
     }
-
+
   }
-
+
 }
-
+
 int __usercall sub_13409<eax>(int a1<eax>, int a2, int a3, int a4)
-
+
   unsigned int v4; // edi@1
-
+
   char v6; // dl@4
-
+
   int v8; // esi@5
-
+
   unsigned int v11; // [sp+10h] [bp-8h]@1
-
+
   v4 = 0;
-
+
   if ( v11 )
-
+
     v10 = *(_DWORD *)(a1 + 41);
-
+
     while ( 1 )
-
+
       if ( !sub_13CC0(a2, *(_DWORD *)v12) )
-
+
-
+
-
+
         v5 = *(_BYTE *)a3 - *(_BYTE *)v7;
-
+
         {
-
+
           do
-
+
             if ( !v6 )
-
+
             ++v7;
-
+
             v5 = *(_BYTE *)(v8 + v7) - *(_BYTE *)v7;
-
+
           while ( *(_BYTE *)(v8 + v7) == *(_BYTE *)v7 );
-
+
         if ( v5 >= 0 )
-
+
           if ( v5 > 0 )
-
+
           if ( !v5 )
-
+
         }
-
+
       v12 += 12;
-
+
       if ( v4 >= v11 )
-
+
     }
-
+
   }
-
+
   {
-
+
     *(_DWORD *)a4 = 0;
-
+
   return 0;
-
+
 //----- (0001356E) --------------------------------------------------------
-
+
 {
-
+
   int v7; // eax@2
-
+
   int result; // eax@5
-
+
   int v11; // eax@9
-
+
   if ( (signed int)v6 < 0 )
-
+
     v7 = (unsigned __int16)v6;
-
+
   }
-
+
     return 4;
-
+
   result = sub_13409(a2, a5, v8 + 2, a3);
-
+
     return result;
-
+
   {
-
+
 LABEL_9:
-
+
     *(_DWORD *)a3 = v11;
-
+
       return 0;
-
+
   }
-
+
 }
-
+
 int __thiscall sub_1369C(void *this)
-
+
   return (int)((char *)this - 4116659);
-
+
 //----- (000136F8) --------------------------------------------------------
-
+
 {
-
+
   unsigned __int16 v5; // cx@4
-
+
   int v7; // ecx@7
-
+
   if ( *(_WORD *)a2 != 23117 || (v4 = a2 + *(_DWORD *)(a2 + 60), (*(_DWORD *)v4 ^ 0xF750F284) != -145705004) )
-
+
   v5 = *(_WORD *)(v4 + 4);
-
+
   {
-
+
     {
-
+
       *(_DWORD *)a1 = 0;
-
+
 LABEL_12:
-
+
       *(_DWORD *)(v7 + 26) = *(_DWORD *)(v4 + 80);
-
+
       v8 = *(_WORD *)(v4 + 6);
-
+
       *(_DWORD *)(v7 + 4) = a3;
-
+
       *(_DWORD *)(v7 + 8) = a2;
-
+
     }
-
+
   else
-
+
     if ( 22531 == (v5 ^ 0xDE67) && (*(_WORD *)(v4 + 24) ^ 0x5A08) == 22531 && *(_WORD *)(v4 + 20) == 240 )
-
+
       v7 = a1;
-
+
       v6 = v4 + 136;
-
+
     }
-
+
   return 1;
-
+
 //----- (000138BE) --------------------------------------------------------
-
+
 {
-
+
   result = sub_13B3A(a1, a2);
-
+
     result = a2 + *(_DWORD *)(a1 + 8);
-
+
 }
-
+
 bool __cdecl sub_138DB(int a1, unsigned int a2, int a3, int a4)
-
+
   int v4; // esi@1
-
+
   unsigned int v6; // eax@3
-
+
-
+
-
+
   v6 = *(_DWORD *)v4;
-
+
   {
-
+
       return 1;
-
+
     *(_DWORD *)a4 = *(_DWORD *)(v4 + 4);
-
+
   }
-
+
   {
-
+
-
+
-
+
   return result;
-
+
 //----- (0001392E) --------------------------------------------------------
-
+
 {
-
+
   int v2; // edx@1
-
+
   int v4; // esi@2
-
+
   v3 = *(_BYTE *)a1;
-
+
   {
-
+
     ++v2;
-
+
   }
-
+
 }
-
+
 signed int __usercall sub_13A4B<eax>(unsigned int a1<eax>, int a2, int a3, unsigned __int16 a4)
-
+
   signed int v4; // eax@1
-
+
   unsigned int v6; // eax@3
-
+
   v5 = a1;
-
+
   if ( !v4
-
+
     || (v6 = *(_DWORD *)(v4 + 4 * a4), !v6)
-
+
-
+
-
+
   return result;
-
+
 //----- (00013B3A) --------------------------------------------------------
-
+
 {
-
+
   signed int result; // eax@2
-
+
   int v5; // eax@6
-
+
   unsigned int v7; // eax@8
-
+
   unsigned __int16 v9; // [sp+4h] [bp-4h]@1
-
+
   v9 = *(_WORD *)(a1 + 24);
-
+
   {
-
+
     if ( !*(_DWORD *)(a1 + 4) )
-
+
     if ( *(_WORD *)(a1 + 24) <= 0u )
-
+
     while ( 1 )
-
+
       v5 = v2 + 40 * (unsigned __int16)v4;
-
+
       if ( v6 >= *(_DWORD *)(v5 + 16) )
-
+
       v7 = *(_DWORD *)(v5 + 12);
-
+
       {
-
+
           break;
-
+
-
+
-
+
         goto LABEL_14;
-
+
     v8 = *(_DWORD *)(40 * (unsigned __int16)v4 + v2 + 36);
-
+
 LABEL_14:
-
+
     else
-
+
       result = 1;
-
+
   else
-
+
     result = 0;
-
+
   return result;
-
+
 //----- (00013BF1) --------------------------------------------------------
-
+
 {
-
+
   int v6; // edi@1
-
+
   int result; // eax@2
-
+
   int v10; // ebx@4
-
+
   v6 = a2 + 4;
-
+
   v7 = a1 - 4;
-
+
   if ( a1 >= 0xD )
-
+
     if ( v6 <= (unsigned int)v5 )
-
+
       do
-
+
         v9 = v7 + v6 - 4;
-
+
         if ( v6 > (unsigned int)v9 )
-
+
 LABEL_7:
-
+
         }
-
+
         {
-
+
           {
-
+
             if ( v10 > (unsigned int)v9 )
-
+
           }
-
+
         if ( !v10 || v10 - 4 > v11 )
-
+
         if ( sub_13C66(a5, a4, v10 - 4, 0xDu) )
-
+
         v7 = v7 + v6 - v10 - 1;
-
+
       }
-
+
     }
-
+
   }
-
+
   {
-
+
   }
-
+
 }
-
+
 signed int __usercall sub_13C66<eax>(int a1<eax>, int a2<edx>, int a3<ecx>, unsigned int a4)
-
+
   unsigned int v4; // edi@1
-
+
   int v6; // esi@2
-
+
   v4 = 0;
-
+
-
+
-
+
     v6 = a2 - a1;
-
+
     {
-
+
       ++a1;
-
+
         goto LABEL_5;
-
+
     result = 0;
-
+
-
+
-
+
 LABEL_5:
-
+
   }
-
+
 }
-
+
 int __cdecl sub_13C92(int a1, char a2, int a3)
-
+
   int v3; // eax@2
-
+
   v5 = a1;
-
+
   {
-
+
     if ( !v3 )
-
+
-
+
-
+
   return v5;
-
+
 //----- (00013CC0) --------------------------------------------------------
-
+
 {
-
+
   int v3; // eax@2
-
+
   v2 = a1;
-
+
   {
-
+
     if ( (unsigned int)(v3 - 65) <= 0x19 )
-
+
     v4 = *(_BYTE *)a2++;
-
+
       v4 += 32;
-
+
   while ( v3 && v3 == v4 );
-
+
 }
-
+
 signed int __usercall sub_13D8E<eax>(int a1<eax>, int a2, int a3, unsigned int a4, int (__cdecl *a5)(_DWORD, _DWORD, _DWORD))
-
+
-
+
-
+
   int v7; // eax@5
-
+
   v5 = 0;
-
+
   {
-
+
     while ( 1 )
-
+
-
+
-
+
         if ( !(*(_DWORD *)(v6 + 28) & 0x2000000) )
-
+
           v7 = *(_DWORD *)v6;
-
+
             v7 = *(_DWORD *)(v6 + 8);
-
+
-
+
-
+
       }
-
+
       v6 += 40;
-
+
         goto LABEL_9;
-
+
     result = 1;
-
+
   else
-
+
-
+
-
+
   }
-
+
 }