API tools faq
paste
View difference between Paste ID: G2bgMurr and a1DeRyFN
SHOW: | | - or go back to the newest paste.
1
#include <windows.h>
2
3
#include <defs.h>

4
5
6
7
8
9
//-------------------------------------------------------------------------

10
11
// Data declarations

12
13
14
15
extern const WCHAR aSystemrootSyst[]; // idb

16
17
extern char dword_124C0[]; // idb

18
19
extern char dword_124D0[]; // idb

20
21
extern wchar_t aKernel32_dll[13]; // weak

22
23
// extern PBOOLEAN KdDebuggerEnabled;

24
25
// extern void *InitSafeBootMode; weak

26
27
extern int dword_12628; // weak

28
29
extern char byte_12630[]; // weak

30
31
extern _BYTE byte_12644[20]; // idb

32
33
extern int dword_12658; // weak

34
35
extern char a_text[6]; // weak

36
37
extern char aPage[5]; // weak

38
39
extern char asc_12678[2]; // weak

40
41
extern size_t dword_12680; // idb

42
43
extern int dword_12684; // weak

44
45
extern int dword_12688; // weak

46
47
extern int dword_1268C; // weak

48
49
extern int dword_12690; // weak

50
51
extern _UNKNOWN unk_12694; // weak

52
53
extern _UNKNOWN unk_12EB8; // weak

54
55
extern _UNKNOWN unk_14380; // weak

56
57
extern _UNKNOWN unk_14384; // weak

58
59
extern char byte_14390; // weak

60
61
extern int dword_14391; // weak

62
63
extern const WCHAR word_14395; // idb

64
65
extern const WCHAR word_1445D; // idb

66
67
extern const WCHAR word_14471; // idb

68
69
extern int dword_14539; // weak

70
71
extern int dword_1453D; // weak

72
73
extern const WCHAR SourceString; // idb

74
75
extern char byte_14614; // weak

76
77
extern char byte_14615; // weak

78
79
extern char byte_14616; // weak

80
81
extern char byte_14617; // weak

82
83
extern int dword_1461C; // weak

84
85
extern int dword_14620; // weak

86
87
extern int dword_14624; // weak

88
89
extern char byte_14628; // weak

90
91
extern RTL_GENERIC_TABLE Table; // idb

92
93
extern int dword_14654; // weak

94
95
extern char byte_14658; // weak

96
97
extern int dword_1465C; // weak

98
99
extern int dword_14660; // weak

100
101
extern char byte_14664; // weak

102
103
extern int dword_14668; // weak

104
105
extern struct _KMUTANT Mutex; // idb

106
107
extern int dword_1468C; // weak

108
109
extern int dword_14690; // weak

110
111
extern int dword_14694; // weak

112
113
extern int dword_14698; // weak

114
115
extern int dword_1469C; // weak

116
117
extern int dword_146A0; // weak

118
119
extern int dword_146A4; // weak

120
121
extern int dword_146A8; // weak

122
123
extern int dword_146AC; // weak

124
125
extern int dword_146B0; // weak

126
127
128
129
//-------------------------------------------------------------------------

130
131
// Function declarations

132
133
134
135
#define __thiscall __cdecl // Test compile in C mode

136
137
138
139
char __cdecl sub_10300();

140
141
void __stdcall DriverReinitializationRoutine(PDRIVER_OBJECT DriverObject, int a2, unsigned int a3);

142
143
NTSTATUS __stdcall DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath);

144
145
int __stdcall sub_1048A(int a1);

146
147
int __cdecl sub_10542();

148
149
// int __usercall sub_1056C<eax>(int a1<esi>);

150
151
// int __userpurge sub_105A0<eax>(int a1<ebx>, SIZE_T a2<edi>, int a3<esi>, const void *a4);

152
153
// int __usercall sub_105E4<eax>(LSA_UNICODE_STRING *a1<ecx>, int a2<edi>, int a3<esi>);

154
155
ULONG __thiscall sub_10638(LSA_UNICODE_STRING *this, ULONG a2, int a3);

156
157
// void __userpurge sub_1076E(int a1<ebx>, PVOID *a2);

158
159
signed int __fastcall sub_107A2(int a1, int a2);

160
161
int *__cdecl sub_107E8();

162
163
bool __stdcall sub_10886(int a1);

164
165
int __stdcall sub_108BE(const char *a1);

166
167
int __cdecl sub_1098E();

168
169
// signed int __usercall sub_109B0<eax>(int a1<edi>);

170
171
int __cdecl sub_10A3A();

172
173
// int __usercall sub_10A8A<eax>(int a1<edi>, int *a2<esi>);

174
175
// int __usercall sub_10AE2<eax>(int a1<esi>);

176
177
// int __usercall sub_10B36<eax>(int a1<esi>);

178
179
int __thiscall sub_10B68(int this);

180
181
int __stdcall sub_10BA2(int, int); // weak

182
183
signed int __cdecl sub_10BE8();

184
185
// int __userpurge sub_10BEC<eax>(int a1<ebp>, int a2, int a3);

186
187
// signed int __usercall sub_10C22<eax>(int a1<eax>);

188
189
signed int __stdcall sub_10CFE(int a1, int a2);

190
191
// void __usercall sub_10D7E(int a1<eax>);

192
193
// int __usercall sub_10DA8<eax>(int a1<ecx>, int a2<edi>, int a3<esi>);

194
195
void __stdcall sub_10DCC(int a1, HANDLE Handle, int a3);

196
197
void __stdcall NotifyRoutine(int a1, HANDLE Handle, int a3);

198
199
// int __userpurge sub_10FC4<eax>(int result<eax>, int a2);

200
201
RTL_GENERIC_TABLE *__cdecl sub_10FE6();

202
203
// PVOID __usercall sub_11028<eax>(int a1<eax>, RTL_GENERIC_TABLE *a2<edi>);

204
205
// signed int __usercall sub_11066<eax>(int a1<eax>, RTL_GENERIC_TABLE *a2<edi>);

206
207
// signed int __userpurge sub_110C0<eax>(RTL_GENERIC_TABLE *a1<eax>, int *a2);

208
209
bool __stdcall CompareRoutine(int a1, int a2, int a3);

210
211
PVOID __stdcall AllocateRoutine(int a1, SIZE_T NumberOfBytes);

212
213
void __stdcall FreeRoutine(int a1, PVOID P);

214
215
// int __usercall sub_1118A<eax>(int a1<ebx>, int a2<esi>);

216
217
// int __userpurge sub_111B4<eax>(int a1<eax>, int a2<ebx>, int a3);

218
219
// signed int __userpurge sub_11242<eax>(int a1<eax>, int a2, int a3);

220
221
// PVOID __userpurge sub_113C2<eax>(int a1<edi>, int a2, int a3);

222
223
// void __userpurge sub_1141E(int a1<eax>, int a2<ecx>, int a3<ebx>, int a4, int a5);

224
225
void __fastcall sub_114EC(int a1, int a2, int a3, int a4, int a5);

226
227
LONG_PTR __stdcall sub_11522(int a1, int a2, int a3, int a4, int a5);

228
229
PVOID __stdcall sub_11578(int a1);

230
231
PVOID __stdcall sub_11598(int a1);

232
233
// signed int __userpurge sub_115CC<eax>(const void *a1<eax>, int a2<ebx>, int a3);

234
235
signed int __thiscall sub_11718(int this, int a2, const void *a3);

236
237
__int32 __stdcall sub_1174A(int a1, int a2);

238
239
// char __usercall sub_117A8<al>(WCHAR *a1<eax>, int a2<ecx>);

240
241
// PVOID __usercall sub_1182C<eax>(ULONG a1<esi>);

242
243
// int __usercall sub_11864<eax>(HANDLE *a1<edi>);

244
245
signed int __stdcall sub_118E2(unsigned int a1, int a2);

246
247
char __fastcall sub_119AE(int a1, int a2);

248
249
// char __usercall sub_11A08<al>(int a1<edi>);

250
251
// int __userpurge sub_11A4A<eax>(int a1<eax>, int a2<ebx>, unsigned int a3);

252
253
// const char *__usercall sub_11ABC<eax>(const char *result<eax>, int a2<ecx>);

254
255
int __stdcall sub_11B04(int a1, const char *a2, unsigned int a3, int a4, int a5);

256
257
int *__cdecl sub_11C14();

258
259
int __stdcall sub_11CCC(int a1);

260
261
char __stdcall sub_11D46(int a1, unsigned int a2);

262
263
// NTSTATUS __userpurge sub_11D62<eax>(LSA_UNICODE_STRING *a1<eax>, PUNICODE_STRING ValueName, int a3);

264
265
int __stdcall sub_11DD6(int, PUNICODE_STRING ValueName, int); // idb

266
267
// int __usercall sub_11EC6<eax>(char a1<al>, int a2<ecx>, unsigned int a3<esi>);

268
269
int __stdcall sub_11F42(int, int, HANDLE Handle); // idb

270
271
// int __userpurge sub_11FC0<eax>(int a1<esi>, int a2, int a3);

272
273
int __stdcall sub_12000(HANDLE Handle, PVOID ProcessInformation); // idb

274
275
// int __userpurge sub_12094<eax>(int a1<ebx>, int a2<edi>, int a3);

276
277
// LONG_PTR __usercall sub_120CC<eax>(PVOID Object<ecx>, LONG_PTR result<eax>);

278
279
int __cdecl sub_120DE(int a1);

280
281
int __cdecl sub_1210F(int a1, unsigned int a2);

282
283
// signed int __usercall sub_1216B<eax>(int a1<eax>, unsigned int a2<ebx>);

284
285
signed int __cdecl sub_121E1(int a1, int a2, int a3);

286
287
signed int __cdecl sub_122B3(int a1, unsigned int a2);

288
289
bool __cdecl sub_122D0(int a1, unsigned int a2, int a3, int a4);

290
291
// signed int __usercall sub_12323<eax>(unsigned int a1<eax>, int a2, int a3, unsigned __int16 a4);

292
293
signed int __cdecl sub_1236B(int a1, int a2);

294
295
// NTSTATUS __stdcall ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);

296
297
// void *__cdecl memcpy(void *, const void *, size_t);

298
299
// void *__cdecl memset(void *, int, size_t);

300
301
// int _SEH_epilog(void); weak

302
303
int nullsub_1(); // weak

304
305
int nullsub_2(); // weak

306
307
int sub_124FE(); // weak

308
309
int nullsub_3(); // weak

310
311
// KIRQL __fastcall KfAcquireSpinLock(PKSPIN_LOCK SpinLock);

312
313
// KIRQL __stdcall KeGetCurrentIrql();

314
315
// void __fastcall KfReleaseSpinLock(PKSPIN_LOCK SpinLock, KIRQL NewIrql);

316
317
// NTSTATUS __stdcall ZwReadFile(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID Buffer, ULONG Length, PLARGE_INTEGER ByteOffset, PULONG Key);

318
319
// NTSTATUS __stdcall ZwClose(HANDLE Handle);

320
321
// NTSTATUS __stdcall ZwOpenFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, ULONG ShareAccess, ULONG OpenOptions);

322
323
// NTSTATUS __stdcall ZwQueryInformationFile(HANDLE FileHandle, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass);

324
325
// BOOLEAN __stdcall PsGetVersion(PULONG MajorVersion, PULONG MinorVersion, PULONG BuildNumber, PUNICODE_STRING CSDVersion);

326
327
// int __cdecl stricmp(const char *, const char *);

328
329
// NTSTATUS __stdcall PsSetLoadImageNotifyRoutine(PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine);

330
331
// PVOID __stdcall ExAllocatePool(POOL_TYPE PoolType, SIZE_T NumberOfBytes);

332
333
// void __fastcall IofCompleteRequest(PIRP Irp, CCHAR PriorityBoost);

334
335
// NTSTATUS __stdcall IoCreateDevice(PDRIVER_OBJECT DriverObject, ULONG DeviceExtensionSize, PUNICODE_STRING DeviceName, ULONG DeviceType, ULONG DeviceCharacteristics, BOOLEAN Exclusive, PDEVICE_OBJECT *DeviceObject);

336
337
// BOOLEAN __stdcall RtlDeleteElementGenericTable(PRTL_GENERIC_TABLE Table, PVOID Buffer);

338
339
// PKTHREAD __stdcall KeGetCurrentThread();

340
341
// PVOID __stdcall RtlLookupElementGenericTable(PRTL_GENERIC_TABLE Table, PVOID Buffer);

342
343
// void __stdcall RtlInitializeGenericTable(PRTL_GENERIC_TABLE Table, PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine, PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine, PRTL_GENERIC_FREE_ROUTINE FreeRoutine, PVOID TableContext);

344
345
// PVOID __stdcall RtlInsertElementGenericTable(PRTL_GENERIC_TABLE Table, PVOID Buffer, CLONG BufferSize, PBOOLEAN NewElement);

346
347
// WCHAR __stdcall RtlUpcaseUnicodeChar(WCHAR SourceCharacter);

348
349
// NTSTATUS __stdcall ZwAllocateVirtualMemory(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG ZeroBits, PULONG AllocationSize, ULONG AllocationType, ULONG Protect);

350
351
// void __stdcall RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString);

352
353
// void __stdcall IoRegisterDriverReinitialization(PDRIVER_OBJECT DriverObject, PDRIVER_REINITIALIZE DriverReinitializationRoutine, PVOID Context);

354
355
// void __stdcall ExFreePoolWithTag(PVOID P, ULONG Tag);

356
357
// void __stdcall KeInitializeMutex(PRKMUTEX Mutex, ULONG Level);

358
359
// LONG __stdcall KeReleaseMutex(PRKMUTEX Mutex, BOOLEAN Wait);

360
361
// NTSTATUS __stdcall KeWaitForSingleObject(PVOID Object, KWAIT_REASON WaitReason, KPROCESSOR_MODE WaitMode, BOOLEAN Alertable, PLARGE_INTEGER Timeout);

362
363
// NTSTATUS __stdcall ZwQueryValueKey(HANDLE KeyHandle, PUNICODE_STRING ValueName, KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, PVOID KeyValueInformation, ULONG Length, PULONG ResultLength);

364
365
// NTSTATUS __stdcall ZwOpenKey(PHANDLE KeyHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes);

366
367
// int __stdcall KeUnstackDetachProcess(_DWORD); weak

368
369
// int __stdcall KeStackAttachProcess(_DWORD, _DWORD); weak

370
371
// NTSTATUS __stdcall ZwQueryInformationProcess(HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength);

372
373
// int __stdcall ObOpenObjectByPointer(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD); weak

374
375
// int __stdcall PsLookupProcessByProcessId(_DWORD, _DWORD); weak

376
377
// LONG_PTR __fastcall ObfDereferenceObject(PVOID Object);

378
379
// signed int __usercall sub_12A24<eax>(int a1<esi>);

380
381
signed int __cdecl sub_12A95(int a1);

382
383
// bool __usercall sub_12D37<eax>(int a1<eax>, int a2);

384
385
int __thiscall sub_12D71(void *this);

386
387
// signed int __usercall sub_13343<eax>(int a1<eax>, unsigned int a2);

388
389
// int __usercall sub_133BF<eax>(int a1<eax>, int a2, int a3);

390
391
// int __usercall sub_13409<eax>(int a1<eax>, int a2, int a3, int a4);

392
393
// int __usercall sub_1356E<eax>(unsigned int *a1<eax>, int a2<ebx>, int a3<edi>, int a4, int a5, int a6);

394
395
int __thiscall sub_1369C(void *this);

396
397
signed int __cdecl sub_136F8(int a1, int a2, int a3);

398
399
signed int __cdecl sub_138BE(int a1, unsigned int a2);

400
401
bool __cdecl sub_138DB(int a1, unsigned int a2, int a3, int a4);

402
403
int __cdecl sub_1392E(int a1);

404
405
// signed int __usercall sub_13A4B<eax>(unsigned int a1<eax>, int a2, int a3, unsigned __int16 a4);

406
407
// signed int __usercall sub_13B3A<eax>(int a1<eax>, unsigned int a2<ebx>);

408
409
// int __usercall sub_13BF1<eax>(unsigned int a1<eax>, int a2<ecx>, int a3, int a4, int a5);

410
411
// signed int __usercall sub_13C66<eax>(int a1<eax>, int a2<edx>, int a3<ecx>, unsigned int a4);

412
413
int __cdecl sub_13C92(int a1, char a2, int a3);

414
415
// int __usercall sub_13CC0<eax>(int a1<eax>, int a2<edx>);

416
417
// signed int __usercall sub_13D8E<eax>(int a1<eax>, int a2, int a3, unsigned int a4, int (__cdecl *a5)(_DWORD, _DWORD, _DWORD));

418
419
420
421
422
423
//----- (00010300) --------------------------------------------------------

424
425
char __cdecl sub_10300()

426
427
{

428
429
  LSA_UNICODE_STRING DestinationString; // [sp+8h] [bp-18h]@1

430
431
  char v2; // [sp+10h] [bp-10h]@1

432
433
  HANDLE Handle; // [sp+14h] [bp-Ch]@2

434
435
  int v4; // [sp+18h] [bp-8h]@1

436
437
  char v5; // [sp+1Fh] [bp-1h]@1

438
439
440
441
  RtlInitUnicodeString(&DestinationString, L"\\SystemRoot\\System32\\hal.dll");

442
443
  v4 = 0;

444
445
  sub_105E4(&DestinationString, (int)&v4, (int)&v2);

446
447
  v5 = v4 == 0;

448
449
  if ( v2 )

450
451
  {

452
453
    v2 = 0;

454
455
    ZwClose(Handle);

456
457
  }

458
459
  return v5;

460
461
}

462
463
464
465
//----- (0001034C) --------------------------------------------------------

466
467
void __stdcall DriverReinitializationRoutine(PDRIVER_OBJECT DriverObject, int a2, unsigned int a3)

468
469
{

470
471
  if ( !KeGetCurrentIrql() )

472
473
  {

474
475
    if ( a3 <= 0x65 )

476
477
    {

478
479
      if ( !sub_10542() )

480
481
      {

482
483
        if ( sub_10300() )

484
485
          sub_10A3A();

486
487
        else

488
489
          IoRegisterDriverReinitialization(DriverObject, DriverReinitializationRoutine, 0);

490
491
      }

492
493
    }

494
495
  }

496
497
}

498
499
500
501
//----- (000103AA) --------------------------------------------------------

502
503
NTSTATUS __stdcall DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)

504
505
{

506
507
  signed int v2; // eax@2

508
509
  LSA_UNICODE_STRING DestinationString; // [sp+Ch] [bp-24h]@11

510
511
  unsigned int i; // [sp+14h] [bp-1Ch]@3

512
513
  CPPEH_RECORD ms_exc; // [sp+18h] [bp-18h]@1

514
515
516
517
  ms_exc.disabled = 0;

518
519
  dword_14624 = 128;

520
521
  dword_1461C = (int)ExAllocatePool(0, 0x200u);

522
523
  if ( dword_1461C )

524
525
  {

526
527
    byte_14628 = 1;

528
529
    for ( i = (unsigned int)&unk_14380; i < (unsigned int)&unk_14384; i += 4 )

530
531
    {

532
533
      if ( *(_DWORD *)i )

534
535
        (*(void (**)(void))i)();

536
537
    }

538
539
    v2 = 0;

540
541
  }

542
543
  else

544
545
  {

546
547
    v2 = -1073741823;

548
549
  }

550
551
  if ( !v2 )

552
553
  {

554
555
    if ( !sub_109B0((int)RegistryPath) )

556
557
    {

558
559
      RtlInitUnicodeString(&DestinationString, &SourceString);

560
561
      if ( !IoCreateDevice(DriverObject, 0, &DestinationString, 0x22u, 0x100u, 0, (PDEVICE_OBJECT *)&RegistryPath) )

562
563
      {

564
565
        DriverObject->MajorFunction[0] = (PDRIVER_DISPATCH)sub_10BA2;

566
567
        DriverObject->MajorFunction[2] = (PDRIVER_DISPATCH)sub_10BA2;

568
569
        DriverObject->MajorFunction[14] = (PDRIVER_DISPATCH)sub_10BA2;

570
571
        RegistryPath[3].Buffer = (PWSTR)((unsigned int)RegistryPath[3].Buffer & 0xFFFFFF7F);

572
573
        IoRegisterDriverReinitialization(DriverObject, (PDRIVER_REINITIALIZE)DriverReinitializationRoutine, 0);

574
575
      }

576
577
    }

578
579
  }

580
581
  return 0;

582
583
}

584
585
// 10BA2: using guessed type int __stdcall sub_10BA2(int, int);

586
587
// 1461C: using guessed type int dword_1461C;

588
589
// 14624: using guessed type int dword_14624;

590
591
// 14628: using guessed type char byte_14628;

592
593
594
595
//----- (0001048A) --------------------------------------------------------

596
597
int __stdcall sub_1048A(int a1)

598
599
{

600
601
  int v1; // edi@5

602
603
  int result; // eax@7

604
605
  int (*v3)(void); // edi@11

606
607
  int v4; // [sp+Ch] [bp-128h]@6

608
609
  __int16 v5; // [sp+120h] [bp-14h]@9

610
611
  int v6; // [sp+130h] [bp-4h]@3

612
613
614
615
  *(_BYTE *)a1 = 1;

616
617
  if ( !KeGetCurrentIrql() )

618
619
  {

620
621
    sub_1056C((int)&v6);

622
623
    if ( sub_10886(0) || sub_10886(1) )

624
625
      return 0;

626
627
    v1 = v6;

628
629
    if ( sub_10886(2) )

630
631
    {

632
633
      memset(&v4, 255, 0x11Cu);

634
635
      v4 = 284;

636
637
      if ( !*(_DWORD *)v1 )

638
639
        return -1073741823;

640
641
      result = (*(int (__stdcall **)(int *))v1)(&v4);

642
643
      if ( result )

644
645
        return result;

646
647
      if ( !v5 )

648
649
        return *(_DWORD *)(v1 + 4) != 0 ? 0xC0000001 : 0;

650
651
    }

652
653
    v3 = *(int (**)(void))(v1 + 4);

654
655
    if ( v3 )

656
657
    {

658
659
      if ( (unsigned __int8)v3() )

660
661
        *(_BYTE *)a1 = 0;

662
663
      return 0;

664
665
    }

666
667
    return -1073741823;

668
669
  }

670
671
  *(_BYTE *)a1 = 0;

672
673
  return 0;

674
675
}

676
677
678
679
//----- (00010542) --------------------------------------------------------

680
681
int __cdecl sub_10542()

682
683
{

684
685
  int result; // eax@1

686
687
  char v1; // [sp+7h] [bp-1h]@1

688
689
690
691
  v1 = 0;

692
693
  result = sub_1048A((int)&v1);

694
695
  if ( !result )

696
697
698
699
    result = (v1 != 0 ? 0x3FFFFFFF : 0) - 1073741823;

700
701
  return result;

702
703
}

704
705
706
707
//----- (0001056C) --------------------------------------------------------

708
709
int __usercall sub_1056C<eax>(int a1<esi>)

710
711
{

712
713
  int v1; // ecx@2

714
715
716
717
  *(_DWORD *)a1 = 0;

718
719
  if ( !(dword_146A4 & 1) )

720
721
  {

722
723
    dword_146A4 |= 1u;

724
725
    sub_107E8();

726
727
    sub_107A2(v1, (int)nullsub_1);

728
729
  }

730
731
  byte_14614 = 0;

732
733
  *(_DWORD *)a1 = &dword_14694;

734
735
  return a1;

736
737
}

738
739
// 124FA: using guessed type int nullsub_1();

740
741
// 14614: using guessed type char byte_14614;

742
743
// 14694: using guessed type int dword_14694;

744
745
// 146A4: using guessed type int dword_146A4;

746
747
748
749
//----- (000105A0) --------------------------------------------------------

750
751
int __userpurge sub_105A0<eax>(int a1<ebx>, SIZE_T a2<edi>, int a3<esi>, const void *a4)

752
753
{

754
755
  PVOID v4; // eax@1

756
757
  char v5; // zf@1

758
759
760
761
  v4 = ExAllocatePool(0, a2);

762
763
  v5 = *(_DWORD *)a1 == 0;

764
765
  *(_DWORD *)a3 = v4;

766
767
  *(_DWORD *)(a3 + 4) = a2;

768
769
  *(_DWORD *)(a3 + 8) = v4;

770
771
  *(_DWORD *)(a3 + 12) = a2;

772
773
  if ( v5 )

774
775
  {

776
777
    if ( *(_DWORD *)a3 )

778
779
    {

780
781
      if ( a4 )

782
783
        memcpy(*(void **)a3, a4, a2);

784
785
    }

786
787
    else

788
789
    {

790
791
      *(_DWORD *)a1 = -1073741823;

792
793
    }

794
795
  }

796
797
  return a3;

798
799
}

800
801
802
803
//----- (000105E4) --------------------------------------------------------

804
805
int __usercall sub_105E4<eax>(LSA_UNICODE_STRING *a1<ecx>, int a2<edi>, int a3<esi>)

806
807
{

808
809
  char v3; // zf@1

810
811
  NTSTATUS v4; // eax@2

812
813
  OBJECT_ATTRIBUTES ObjectAttributes; // [sp+8h] [bp-20h]@2

814
815
  struct _IO_STATUS_BLOCK IoStatusBlock; // [sp+20h] [bp-8h]@2

816
817
818
819
  v3 = *(_DWORD *)a2 == 0;

820
821
  *(_BYTE *)a3 = 0;

822
823
  *(_DWORD *)(a3 + 4) = 0;

824
825
  if ( v3 )

826
827
  {

828
829
    ObjectAttributes.ObjectName = a1;

830
831
    ObjectAttributes.Length = 24;

832
833
    ObjectAttributes.RootDirectory = 0;

834
835
    ObjectAttributes.Attributes = 576;

836
837
    ObjectAttributes.SecurityDescriptor = 0;

838
839
    ObjectAttributes.SecurityQualityOfService = 0;

840
841
    v4 = ZwOpenFile((PHANDLE)(a3 + 4), 0x80100000u, &ObjectAttributes, &IoStatusBlock, 1u, 0x60u);

842
843
    *(_DWORD *)a2 = v4;

844
845
    *(_BYTE *)a3 = v4 == 0;

846
847
  }

848
849
  return a3;

850
851
}

852
853
854
855
//----- (00010638) --------------------------------------------------------

856
857
ULONG __thiscall sub_10638(LSA_UNICODE_STRING *this, ULONG a2, int a3)

858
859
{

860
861
  char v3; // bl@1

862
863
  ULONG result; // eax@4

864
865
  HANDLE v5; // ecx@6

866
867
  ULONG v6; // edi@6

868
869
  ULONG v7; // esi@6

870
871
  NTSTATUS v8; // eax@7

872
873
  int v9; // eax@17

874
875
  int v10; // eax@18

876
877
  void **v11; // eax@21

878
879
  void *v12; // eax@22

880
881
  char FileInformation; // [sp+10h] [bp-28h]@7

882
883
  ULONG v14; // [sp+18h] [bp-20h]@7

884
885
  void *v15; // [sp+1Ch] [bp-1Ch]@7

886
887
  ULONG Length; // [sp+28h] [bp-10h]@1

888
889
  HANDLE Handle; // [sp+2Ch] [bp-Ch]@3

890
891
  struct _IO_STATUS_BLOCK IoStatusBlock; // [sp+30h] [bp-8h]@1

892
893
894
895
  v3 = 0;

896
897
  IoStatusBlock.Information = 0;

898
899
  sub_105E4(this, (int)&IoStatusBlock.Information, (int)&Length);

900
901
  if ( IoStatusBlock.Information )

902
903
    goto LABEL_2;

904
905
  if ( (_BYTE)Length )

906
907
  {

908
909
    v8 = ZwQueryInformationFile(Handle, &IoStatusBlock, &FileInformation, 0x18u, FileStandardInformation);

910
911
    v6 = v14;

912
913
    v5 = v15;

914
915
    v7 = v8;

916
917
  }

918
919
  else

920
921
  {

922
923
    v5 = Handle;

924
925
    v6 = Length;

926
927
    v7 = -1073741823;

928
929
  }

930
931
  IoStatusBlock.Information = v7;

932
933
  if ( v7 )

934
935
    goto LABEL_9;

936
937
  if ( v5 || v6 > a2 )

938
939
    goto LABEL_31;

940
941
  v9 = (int)ExAllocatePool(0, 0x10u);

942
943
  if ( v9 )

944
945
    v10 = sub_105A0((int)&IoStatusBlock.Information, v6, v9, 0);

946
947
  else

948
949
    v10 = 0;

950
951
  sub_1076E(a3, (PVOID *)v10);

952
953
  v3 = 0;

954
955
  if ( IoStatusBlock.Information )

956
957
  {

958
959
LABEL_2:

960
961
    if ( (_BYTE)Length != v3 )

962
963
    {

964
965
      LOBYTE(Length) = v3;

966
967
      ZwClose(Handle);

968
969
    }

970
971
    return IoStatusBlock.Information;

972
973
  }

974
975
  v11 = *(void ***)(a3 + 4);

976
977
  if ( !v11 )

978
979
    goto LABEL_31;

980
981
  v12 = *v11;

982
983
  if ( !(_BYTE)Length )

984
985
    return -1073741823;

986
987
  v7 = ZwReadFile(Handle, 0, 0, 0, &IoStatusBlock, v12, v6, 0, 0);

988
989
  if ( v7 )

990
991
  {

992
993
LABEL_9:

994
995
    if ( (_BYTE)Length != v3 )

996
997
    {

998
999
      LOBYTE(Length) = v3;

1000
1001
      ZwClose(Handle);

1002
1003
    }

1004
1005
    return v7;

1006
1007
  }

1008
1009
  if ( IoStatusBlock.Information != v6 )

1010
1011
  {

1012
1013
LABEL_31:

1014
1015
    if ( (_BYTE)Length != v3 )

1016
1017
    {

1018
1019
      LOBYTE(Length) = v3;

1020
1021
      ZwClose(Handle);

1022
1023
    }

1024
1025
    result = -1073741823;

1026
1027
  }

1028
1029
  else

1030
1031
  {

1032
1033
    if ( (_BYTE)Length )

1034
1035
    {

1036
1037
      LOBYTE(Length) = 0;

1038
1039
      ZwClose(Handle);

1040
1041
    }

1042
1043
    result = 0;

1044
1045
  }

1046
1047
  return result;

1048
1049
}

1050
1051
1052
1053
//----- (0001076E) --------------------------------------------------------

1054
1055
void __userpurge sub_1076E(int a1<ebx>, PVOID *a2)

1056
1057
{

1058
1059
  PVOID *v2; // esi@1

1060
1061
1062
1063
  v2 = *(PVOID **)(a1 + 4);

1064
1065
  if ( a2 != v2 )

1066
1067
  {

1068
1069
    if ( v2 )

1070
1071
    {

1072
1073
      if ( *v2 )

1074
1075
        ExFreePoolWithTag(*v2, 0);

1076
1077
      ExFreePoolWithTag(v2, 0);

1078
1079
    }

1080
1081
    *(_DWORD *)(a1 + 4) = a2;

1082
1083
  }

1084
1085
}

1086
1087
1088
1089
//----- (000107A2) --------------------------------------------------------

1090
1091
signed int __fastcall sub_107A2(int a1, int a2)

1092
1093
{

1094
1095
  signed int result; // eax@5

1096
1097
1098
1099
  if ( !byte_14628 )

1100
1101
    goto LABEL_9;

1102
1103
  if ( !dword_1461C )

1104
1105
    goto LABEL_9;

1106
1107
  if ( dword_14624 <= dword_14620 )

1108
1109
    goto LABEL_9;

1110
1111
  _ECX = &dword_14620;

1112
1113
  _EAX = 1;

1114
1115
  __asm { lock xadd [ecx], eax }

1116
1117
  if ( dword_14624 > _EAX )

1118
1119
  {

1120
1121
    *(_DWORD *)(dword_1461C + 4 * _EAX) = a2;

1122
1123
    result = 0;

1124
1125
  }

1126
1127
  else

1128
1129
  {

1130
1131
LABEL_9:

1132
1133
    result = 1;

1134
1135
  }

1136
1137
  return result;

1138
1139
}

1140
1141
// 1461C: using guessed type int dword_1461C;

1142
1143
// 14620: using guessed type int dword_14620;

1144
1145
// 14624: using guessed type int dword_14624;

1146
1147
// 14628: using guessed type char byte_14628;

1148
1149
1150
1151
//----- (000107E8) --------------------------------------------------------

1152
1153
int *__cdecl sub_107E8()

1154
1155
{

1156
1157
  int v0; // eax@2

1158
1159
  char v2; // [sp+4h] [bp-20h]@3

1160
1161
1162
1163
  dword_14694 = 0;

1164
1165
  dword_14698 = 0;

1166
1167
  dword_1469C = 0;

1168
1169
  dword_146A0 = 0;

1170
1171
  if ( !sub_10886(0) )

1172
1173
  {

1174
1175
    v0 = sub_1098E();

1176
1177
    if ( v0 )

1178
1179
    {

1180
1181
      if ( !sub_121E1((int)&v2, v0, 1) )

1182
1183
      {

1184
1185
        dword_14694 = sub_1236B((int)&v2, -899745608);

1186
1187
        dword_14698 = sub_1236B((int)&v2, -1332885072);

1188
1189
        dword_1469C = sub_1236B((int)&v2, -2007787012);

1190
1191
        dword_146A0 = sub_1236B((int)&v2, 1516803388);

1192
1193
      }

1194
1195
    }

1196
1197
  }

1198
1199
  return &dword_14694;

1200
1201
}

1202
1203
// 14694: using guessed type int dword_14694;

1204
1205
// 14698: using guessed type int dword_14698;

1206
1207
// 1469C: using guessed type int dword_1469C;

1208
1209
// 146A0: using guessed type int dword_146A0;

1210
1211
1212
1213
//----- (00010886) --------------------------------------------------------

1214
1215
bool __stdcall sub_10886(int a1)

1216
1217
{

1218
1219
  ULONG MinorVersion; // [sp+0h] [bp-8h]@1

1220
1221
  ULONG MajorVersion; // [sp+4h] [bp-4h]@1

1222
1223
1224
1225
  MajorVersion = 0;

1226
1227
  MinorVersion = 0;

1228
1229
  PsGetVersion(&MajorVersion, &MinorVersion, 0, 0);

1230
1231
  return MajorVersion == 5 && a1 == MinorVersion;

1232
1233
}

1234
1235
1236
1237
//----- (000108BE) --------------------------------------------------------

1238
1239
int __stdcall sub_108BE(const char *a1)

1240
1241
{

1242
1243
  ULONG v1; // edi@3

1244
1245
  PVOID v2; // esi@6

1246
1247
  int v4; // edi@17

1248
1249
  PVOID v5; // [sp-8h] [bp-3Ch]@5

1250
1251
  ULONG v6; // [sp-4h] [bp-38h]@5

1252
1253
  PVOID P; // [sp+10h] [bp-24h]@3

1254
1255
  int SystemInformation; // [sp+20h] [bp-14h]@1

1256
1257
  char *v9; // [sp+24h] [bp-10h]@3

1258
1259
  int v10; // [sp+28h] [bp-Ch]@13

1260
1261
  ULONG SystemInformationLength; // [sp+2Ch] [bp-8h]@1

1262
1263
1264
1265
  SystemInformationLength = 0;

1266
1267
  SystemInformation = 0;

1268
1269
  if ( ZwQuerySystemInformation(SystemModuleInformation, &SystemInformation, 0, &SystemInformationLength) != -1073741820

1270
1271
    || !SystemInformationLength )

1272
1273
    return 0;

1274
1275
  v9 = 0;

1276
1277
  sub_105A0((int)&v9, SystemInformationLength, (int)&P, 0);

1278
1279
  v1 = 0;

1280
1281
  if ( v9 )

1282
1283
  {

1284
1285
    if ( P )

1286
1287
    {

1288
1289
      v6 = 0;

1290
1291
      v5 = P;

1292
1293
LABEL_9:

1294
1295
      ExFreePoolWithTag(v5, v6);

1296
1297
    }

1298
1299
    return 0;

1300
1301
  }

1302
1303
  v2 = P;

1304
1305
  if ( ZwQuerySystemInformation(SystemModuleInformation, P, SystemInformationLength, (PULONG)&SystemInformation) )

1306
1307
  {

1308
1309
    if ( !v2 )

1310
1311
      return 0;

1312
1313
LABEL_8:

1314
1315
    v6 = v1;

1316
1317
    v5 = v2;

1318
1319
    goto LABEL_9;

1320
1321
  }

1322
1323
  if ( *(_DWORD *)v2 <= 0u )

1324
1325
    goto LABEL_8;

1326
1327
  v10 = 0;

1328
1329
  v9 = (char *)v2 + 30;

1330
1331
  while ( stricmp((const char *)v2 + v10 + *(_WORD *)v9 + 32, a1) )

1332
1333
  {

1334
1335
    v10 += 284;

1336
1337
    v9 += 284;

1338
1339
    ++v1;

1340
1341
    if ( v1 >= *(_DWORD *)v2 )

1342
1343
    {

1344
1345
      v1 = 0;

1346
1347
      goto LABEL_8;

1348
1349
    }

1350
1351
  }

1352
1353
  v4 = *((_DWORD *)v2 + 71 * v1 + 3);

1354
1355
  ExFreePoolWithTag(v2, 0);

1356
1357
  return v4;

1358
1359
}

1360
1361
1362
1363
//----- (0001098E) --------------------------------------------------------

1364
1365
int __cdecl sub_1098E()

1366
1367
{

1368
1369
  int result; // eax@1

1370
1371
1372
1373
  result = sub_108BE(dword_124C0);

1374
1375
  if ( !result )

1376
1377
    result = sub_108BE(dword_124D0);

1378
1379
  return result;

1380
1381
}

1382
1383
1384
1385
//----- (000109B0) --------------------------------------------------------

1386
1387
signed int __usercall sub_109B0<eax>(int a1<edi>)

1388
1389
{

1390
1391
  signed int result; // eax@8

1392
1393
1394
1395
  if ( byte_14390 )

1396
1397
  {

1398
1399
    sub_11EC6(0, (int)&dword_14391, 0x278u);

1400
1401
    byte_14390 = 0;

1402
1403
  }

1404
1405
  if ( !word_14395 )

1406
1407
  {

1408
1409
    if ( (unsigned int)*(_WORD *)a1 + 2 <= 0xC8 )

1410
1411
    {

1412
1413
      memset((void *)&word_14395, 0, 0xC8u);

1414
1415
      memcpy((void *)&word_14395, *(const void **)(a1 + 4), *(_WORD *)a1);

1416
1417
    }

1418
1419
  }

1420
1421
  if ( dword_14391 & 1 && InitSafeBootMode || dword_14391 & 2 && (_BYTE)KdDebuggerEnabled )

1422
1423
    result = -1073741823;

1424
1425
  else

1426
1427
    result = 0;

1428
1429
  return result;

1430
1431
}

1432
1433
// 125E4: using guessed type void *InitSafeBootMode;

1434
1435
// 14390: using guessed type char byte_14390;

1436
1437
// 14391: using guessed type int dword_14391;

1438
1439
1440
1441
//----- (00010A3A) --------------------------------------------------------

1442
1443
int __cdecl sub_10A3A()

1444
1445
{

1446
1447
  int result; // eax@1

1448
1449
  char v1; // [sp+8h] [bp-8h]@1

1450
1451
  int v2; // [sp+Ch] [bp-4h]@1

1452
1453
1454
1455
  v2 = 0;

1456
1457
  sub_10A8A((int)&v1, &v2);

1458
1459
  result = v2;

1460
1461
  if ( !v2 )

1462
1463
  {

1464
1465
    sub_10AE2((int)&v2);

1466
1467
    result = sub_10C22(v2);

1468
1469
    if ( !result )

1470
1471
    {

1472
1473
      sub_10B36((int)&v1);

1474
1475
      sub_1056C((int)&v1);

1476
1477
      result = PsSetLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)NotifyRoutine);

1478
1479
    }

1480
1481
  }

1482
1483
  return result;

1484
1485
}

1486
1487
1488
1489
//----- (00010A8A) --------------------------------------------------------

1490
1491
int __usercall sub_10A8A<eax>(int a1<edi>, int *a2<esi>)

1492
1493
{

1494
1495
  int v2; // eax@2

1496
1497
  int v3; // ecx@4

1498
1499
1500
1501
  *(_DWORD *)a1 = 0;

1502
1503
  if ( !(dword_146B0 & 1) )

1504
1505
  {

1506
1507
    v2 = *a2;

1508
1509
    dword_146B0 |= 1u;

1510
1511
    dword_146AC = v2;

1512
1513
  }

1514
1515
  if ( !(dword_146B0 & 2) )

1516
1517
  {

1518
1519
    dword_146B0 |= 2u;

1520
1521
    sub_11C14();

1522
1523
    sub_107A2(v3, (int)nullsub_3);

1524
1525
  }

1526
1527
  if ( dword_146AC )

1528
1529
    *a2 = dword_146AC;

1530
1531
  else

1532
1533
    *(_DWORD *)a1 = &dword_146A8;

1534
1535
  byte_14615 = 0;

1536
1537
  return a1;

1538
1539
}

1540
1541
// 12508: using guessed type int nullsub_3();

1542
1543
// 14615: using guessed type char byte_14615;

1544
1545
// 146A8: using guessed type int dword_146A8;

1546
1547
// 146AC: using guessed type int dword_146AC;

1548
1549
// 146B0: using guessed type int dword_146B0;

1550
1551
1552
1553
//----- (00010AE2) --------------------------------------------------------

1554
1555
int __usercall sub_10AE2<eax>(int a1<esi>)

1556
1557
{

1558
1559
  int v1; // ecx@2

1560
1561
1562
1563
  *(_DWORD *)a1 = 0;

1564
1565
  if ( !(dword_14690 & 1) )

1566
1567
  {

1568
1569
    dword_14668 = 0;

1570
1571
    dword_14690 |= 1u;

1572
1573
    byte_14664 = 1;

1574
1575
    memset(&Mutex, 0, sizeof(Mutex));

1576
1577
    KeInitializeMutex(&Mutex, 0);

1578
1579
    sub_107A2(v1, (int)sub_124FE);

1580
1581
  }

1582
1583
  byte_14616 = 0;

1584
1585
  *(_DWORD *)a1 = &byte_14664;

1586
1587
  return a1;

1588
1589
}

1590
1591
// 124FE: using guessed type int sub_124FE();

1592
1593
// 14616: using guessed type char byte_14616;

1594
1595
// 14664: using guessed type char byte_14664;

1596
1597
// 14668: using guessed type int dword_14668;

1598
1599
// 14690: using guessed type int dword_14690;

1600
1601
1602
1603
//----- (00010B36) --------------------------------------------------------

1604
1605
int __usercall sub_10B36<eax>(int a1<esi>)

1606
1607
{

1608
1609
  int v1; // ecx@2

1610
1611
1612
1613
  *(_DWORD *)a1 = 0;

1614
1615
  if ( !(dword_1468C & 1) )

1616
1617
  {

1618
1619
    dword_1468C |= 1u;

1620
1621
    sub_10FE6();

1622
1623
    sub_107A2(v1, (int)nullsub_2);

1624
1625
  }

1626
1627
  byte_14617 = 0;

1628
1629
  *(_DWORD *)a1 = &Table;

1630
1631
  return a1;

1632
1633
}

1634
1635
// 124FC: using guessed type int nullsub_2();

1636
1637
// 14617: using guessed type char byte_14617;

1638
1639
// 1468C: using guessed type int dword_1468C;

1640
1641
1642
1643
//----- (00010B68) --------------------------------------------------------

1644
1645
int __thiscall sub_10B68(int this)

1646
1647
{

1648
1649
  int result; // eax@3

1650
1651
  int v2; // [sp+0h] [bp-4h]@1

1652
1653
1654
1655
  v2 = this;

1656
1657
  if ( *(_DWORD *)(*(_DWORD *)(this + 96) + 12) == 2242560 )

1658
1659
  {

1660
1661
    result = sub_11CCC(this);

1662
1663
  }

1664
1665
  else

1666
1667
  {

1668
1669
    if ( *(_DWORD *)(*(_DWORD *)(this + 96) + 12) == 2242564 )

1670
1671
    {

1672
1673
      sub_10AE2((int)&v2);

1674
1675
      result = sub_10C22(v2);

1676
1677
    }

1678
1679
    else

1680
1681
    {

1682
1683
      result = -1073741822;

1684
1685
    }

1686
1687
  }

1688
1689
  return result;

1690
1691
}

1692
1693
1694
1695
//----- (00010BE8) --------------------------------------------------------

1696
1697
signed int __cdecl sub_10BE8()

1698
1699
{

1700
1701
  return 1;

1702
1703
}

1704
1705
1706
1707
//----- (00010BEC) --------------------------------------------------------

1708
1709
int __userpurge sub_10BEC<eax>(int a1<ebp>, int a2, int a3)

1710
1711
{

1712
1713
  int v3; // edi@1

1714
1715
  int v4; // esi@1

1716
1717
1718
1719
  *(_DWORD *)(a1 - 4) = -1;

1720
1721
  v4 = *(_DWORD *)(a1 + 12);

1722
1723
  v3 = *(_DWORD *)(a1 - 28);

1724
1725
  if ( v3 != 259 )

1726
1727
  {

1728
1729
    if ( v3 )

1730
1731
      *(_DWORD *)(v4 + 28) = 0;

1732
1733
    *(_DWORD *)(v4 + 24) = v3;

1734
1735
    IofCompleteRequest((PIRP)v4, 0);

1736
1737
  }

1738
1739
  return _SEH_epilog();

1740
1741
}

1742
1743
// 12463: using guessed type int _SEH_epilog(void);

1744
1745
1746
1747
//----- (00010C22) --------------------------------------------------------

1748
1749
signed int __usercall sub_10C22<eax>(int a1<eax>)

1750
1751
{

1752
1753
  int v1; // edi@1

1754
1755
  int v2; // eax@3

1756
1757
  unsigned int v3; // esi@3

1758
1759
  int v4; // ecx@3

1760
1761
  signed int v6; // esi@6

1762
1763
  int v7; // edi@9

1764
1765
  struct _KMUTANT *v8; // [sp+10h] [bp-20h]@1

1766
1767
  ULONG v9; // [sp+14h] [bp-1Ch]@1

1768
1769
  LSA_UNICODE_STRING ValueName; // [sp+18h] [bp-18h]@1

1770
1771
  LSA_UNICODE_STRING DestinationString; // [sp+20h] [bp-10h]@1

1772
1773
  char v12; // [sp+28h] [bp-8h]@2

1774
1775
1776
1777
  v1 = a1;

1778
1779
  RtlInitUnicodeString(&DestinationString, &word_14395);

1780
1781
  RtlInitUnicodeString(&ValueName, &word_1445D);

1782
1783
  v8 = (struct _KMUTANT *)(v1 + 8);

1784
1785
  KeWaitForSingleObject((PVOID)(v1 + 8), 0, 0, 0, 0);

1786
1787
  v9 = sub_11D62(&DestinationString, &ValueName, v1);

1788
1789
  if ( v9 )

1790
1791
  {

1792
1793
    RtlInitUnicodeString((PUNICODE_STRING)&v12, &word_14471);

1794
1795
    v9 = sub_10638((LSA_UNICODE_STRING *)&v12, dword_14539, v1);

1796
1797
    if ( v9 )

1798
1799
    {

1800
1801
LABEL_6:

1802
1803
      v6 = -1073741823;

1804
1805
      goto LABEL_7;

1806
1807
    }

1808
1809
  }

1810
1811
  v2 = *(_DWORD *)(v1 + 4);

1812
1813
  v3 = *(_DWORD *)(v2 + 4);

1814
1815
  sub_11EC6(dword_1453D, *(_DWORD *)v2, v3);

1816
1817
  if ( sub_11D46(v4, v3) )

1818
1819
  {

1820
1821
    KeReleaseMutex(v8, 0);

1822
1823
    return -1073741823;

1824
1825
  }

1826
1827
  v6 = v9;

1828
1829
  if ( !v9 )

1830
1831
  {

1832
1833
    v7 = *(_DWORD *)(v1 + 4);

1834
1835
    if ( v7 && *(_DWORD *)(v7 + 4) > 0u )

1836
1837
    {

1838
1839
      v6 = 0;

1840
1841
      goto LABEL_7;

1842
1843
    }

1844
1845
    goto LABEL_6;

1846
1847
  }

1848
1849
LABEL_7:

1850
1851
  KeReleaseMutex(v8, 0);

1852
1853
  return v6;

1854
1855
}

1856
1857
// 14539: using guessed type int dword_14539;

1858
1859
// 1453D: using guessed type int dword_1453D;

1860
1861
1862
1863
//----- (00010CFE) --------------------------------------------------------

1864
1865
signed int __stdcall sub_10CFE(int a1, int a2)

1866
1867
{

1868
1869
  int v2; // eax@1

1870
1871
  int v3; // edi@1

1872
1873
  int v4; // esi@1

1874
1875
  int v5; // eax@2

1876
1877
  signed int v6; // edi@5

1878
1879
  int v8; // [sp+10h] [bp-4h]@1

1880
1881
1882
1883
  v3 = a1;

1884
1885
  v4 = 0;

1886
1887
  v8 = 0;

1888
1889
  KeWaitForSingleObject((PVOID)(a1 + 8), 0, 0, 0, 0);

1890
1891
  v2 = (int)ExAllocatePool(0, 0x10u);

1892
1893
  if ( v2 )

1894
1895
  {

1896
1897
    v5 = sub_105A0((int)&v8, *(_DWORD *)(*(_DWORD *)(a1 + 4) + 4), v2, **(const void ***)(a1 + 4));

1898
1899
    v3 = a1;

1900
1901
    v4 = 0;

1902
1903
  }

1904
1905
  else

1906
1907
  {

1908
1909
    v5 = 0;

1910
1911
  }

1912
1913
  sub_1076E(a2, (PVOID *)v5);

1914
1915
  if ( v8 == v4 )

1916
1917
  {

1918
1919
    if ( *(_DWORD *)(v3 + 4) == v4 )

1920
1921
      v6 = -1073741823;

1922
1923
    else

1924
1925
      v6 = 0;

1926
1927
  }

1928
1929
  else

1930
1931
  {

1932
1933
    v6 = v8;

1934
1935
  }

1936
1937
  KeReleaseMutex((PRKMUTEX)(a1 + 8), v4);

1938
1939
  return v6;

1940
1941
}

1942
1943
1944
1945
//----- (00010D7E) --------------------------------------------------------

1946
1947
void __usercall sub_10D7E(int a1<eax>)

1948
1949
{

1950
1951
  PVOID *v1; // edi@2

1952
1953
1954
1955
  if ( *(_BYTE *)a1 )

1956
1957
  {

1958
1959
    v1 = *(PVOID **)(a1 + 4);

1960
1961
    *(_BYTE *)a1 = 0;

1962
1963
    if ( v1 )

1964
1965
    {

1966
1967
      if ( *v1 )

1968
1969
        ExFreePoolWithTag(*v1, 0);

1970
1971
      ExFreePoolWithTag(v1, 0);

1972
1973
    }

1974
1975
  }

1976
1977
}

1978
1979
1980
1981
//----- (00010DA8) --------------------------------------------------------

1982
1983
int __usercall sub_10DA8<eax>(int a1<ecx>, int a2<edi>, int a3<esi>)

1984
1985
{

1986
1987
  int v4; // eax@1

1988
1989
  int v5; // [sp+0h] [bp-4h]@1

1990
1991
1992
1993
  v5 = a1;

1994
1995
  sub_10FC4(a3, (int)&v5);

1996
1997
  *(_DWORD *)a2 = *(_DWORD *)(a3 + 8) + *(_DWORD *)a3;

1998
1999
  v4 = v5;

2000
2001
  *(_DWORD *)(a2 + 4) = v5;

2002
2003
  *(_DWORD *)(a3 + 8) += v4;

2004
2005
  return a3;

2006
2007
}

2008
2009
2010
2011
//----- (00010DCC) --------------------------------------------------------

2012
2013
void __stdcall sub_10DCC(int a1, HANDLE Handle, int a3)

2014
2015
{

2016
2017
  int v3; // ecx@9

2018
2019
  int v4; // esi@9

2020
2021
  int v5; // ebx@12

2022
2023
  int v6; // ecx@12

2024
2025
  int v7; // eax@14

2026
2027
  int i; // [sp+10h] [bp-50h]@4

2028
2029
  unsigned int v9; // [sp+14h] [bp-4Ch]@9

2030
2031
  RTL_GENERIC_TABLE *v10; // [sp+18h] [bp-48h]@8

2032
2033
  int v11; // [sp+1Ch] [bp-44h]@8

2034
2035
  int v12; // [sp+20h] [bp-40h]@9

2036
2037
  char v13; // [sp+24h] [bp-3Ch]@8

2038
2039
  int v14; // [sp+28h] [bp-38h]@8

2040
2041
  int v15; // [sp+2Ch] [bp-34h]@9

2042
2043
  int v16; // [sp+30h] [bp-30h]@9

2044
2045
  int v17; // [sp+34h] [bp-2Ch]@11

2046
2047
  int v18; // [sp+38h] [bp-28h]@11

2048
2049
  int v19; // [sp+3Ch] [bp-24h]@4

2050
2051
  char v20; // [sp+40h] [bp-20h]@7

2052
2053
  WCHAR *v21; // [sp+44h] [bp-1Ch]@11

2054
2055
  char v22; // [sp+4Ch] [bp-14h]@14

2056
2057
  int v23; // [sp+54h] [bp-Ch]@9

2058
2059
  unsigned int v24; // [sp+58h] [bp-8h]@9

2060
2061
  int v25; // [sp+5Ch] [bp-4h]@9

2062
2063
2064
2065
  if ( sub_117A8(L"KERNEL32.DLL", a1) )

2066
2067
  {

2068
2069
    sub_1174A((int)Handle, a3);

2070
2071
  }

2072
2073
  else

2074
2075
  {

2076
2077
    if ( !sub_10542() )

2078
2079
    {

2080
2081
      i = 0;

2082
2083
      sub_11F42((int)&v19, (int)&i, Handle);

2084
2085
      if ( !i )

2086
2087
      {

2088
2089
        if ( v19 == *(_DWORD *)(a3 + 4) )

2090
2091
        {

2092
2093
          if ( !(dword_14391 & 4) || !v20 )

2094
2095
          {

2096
2097
            sub_10B36((int)&v10);

2098
2099
            sub_11066((int)Handle, v10);

2100
2101
            v13 = 1;

2102
2103
            v14 = 0;

2104
2105
            sub_10AE2((int)&v11);

2106
2107
            if ( !sub_10CFE(v11, (int)&v13) )

2108
2109
            {

2110
2111
              v3 = *(_DWORD *)v14;

2112
2113
              v24 = *(_DWORD *)(v14 + 4);

2114
2115
              v23 = v3;

2116
2117
              v25 = 0;

2118
2119
              v15 = 0;

2120
2121
              v16 = 0;

2122
2123
              sub_10FC4((int)&v23, (int)&v12);

2124
2125
              sub_10DA8(v3, (int)&v15, (int)&v23);

2126
2127
              sub_10FC4((int)&v23, (int)&v9);

2128
2129
              v4 = v25;

2130
2131
              if ( v25 <= v24 )

2132
2133
              {

2134
2135
                if ( !v12 )

2136
2137
                {

2138
2139
                  v21 = 0;

2140
2141
                  v17 = 0;

2142
2143
                  v18 = 0;

2144
2145
                  for ( i = 0; i < v9; ++i )

2146
2147
                  {

2148
2149
                    v5 = v4 + v23;

2150
2151
                    v25 = v4 + 16;

2152
2153
                    v12 = v4 + v23;

2154
2155
                    sub_10DA8(v3, (int)&v21, (int)&v23);

2156
2157
                    sub_10DA8(v6, (int)&v17, (int)&v23);

2158
2159
                    v4 = v25;

2160
2161
                    if ( v25 > v24 )

2162
2163
                      break;

2164
2165
                    if ( sub_117A8(v21, a1) )

2166
2167
                    {

2168
2169
                      v7 = sub_111B4((int)&v15, (int)&v22, *(_DWORD *)(v5 + 12));

2170
2171
                      sub_11522((int)Handle, a3, v12, (int)&v17, v7);

2172
2173
                    }

2174
2175
                  }

2176
2177
                }

2178
2179
              }

2180
2181
            }

2182
2183
            sub_10D7E((int)&v13);

2184
2185
          }

2186
2187
        }

2188
2189
      }

2190
2191
    }

2192
2193
  }

2194
2195
}

2196
2197
// 124E0: using guessed type wchar_t aKernel32_dll[13];

2198
2199
// 14391: using guessed type int dword_14391;

2200
2201
2202
2203
//----- (00010F80) --------------------------------------------------------

2204
2205
void __stdcall NotifyRoutine(int a1, HANDLE Handle, int a3)

2206
2207
{

2208
2209
  if ( KeGetCurrentIrql() <= 1u )

2210
2211
  {

2212
2213
    if ( Handle )

2214
2215
      sub_10DCC(a1, Handle, a3);

2216
2217
  }

2218
2219
}

2220
2221
2222
2223
//----- (00010FC4) --------------------------------------------------------

2224
2225
int __userpurge sub_10FC4<eax>(int result<eax>, int a2)

2226
2227
{

2228
2229
  int v2; // ecx@1

2230
2231
2232
2233
  v2 = *(_DWORD *)(result + 8);

2234
2235
  if ( (unsigned int)(v2 + 4) <= *(_DWORD *)(result + 4) )

2236
2237
    *(_DWORD *)a2 = *(_DWORD *)(v2 + *(_DWORD *)result);

2238
2239
  *(_DWORD *)(result + 8) = v2 + 4;

2240
2241
  return result;

2242
2243
}

2244
2245
2246
2247
//----- (00010FE6) --------------------------------------------------------

2248
2249
RTL_GENERIC_TABLE *__cdecl sub_10FE6()

2250
2251
{

2252
2253
  memset(&Table, 0, sizeof(Table));

2254
2255
  byte_14658 = -1;

2256
2257
  dword_14654 = 0;

2258
2259
  dword_1465C = 0;

2260
2261
  dword_14660 = 0;

2262
2263
  RtlInitializeGenericTable(

2264
2265
    &Table,

2266
2267
    (PRTL_GENERIC_COMPARE_ROUTINE)CompareRoutine,

2268
2269
    (PRTL_GENERIC_ALLOCATE_ROUTINE)AllocateRoutine,

2270
2271
    (PRTL_GENERIC_FREE_ROUTINE)FreeRoutine,

2272
2273
    0);

2274
2275
  return &Table;

2276
2277
}

2278
2279
// 14654: using guessed type int dword_14654;

2280
2281
// 14658: using guessed type char byte_14658;

2282
2283
// 1465C: using guessed type int dword_1465C;

2284
2285
// 14660: using guessed type int dword_14660;

2286
2287
2288
2289
//----- (00011028) --------------------------------------------------------

2290
2291
PVOID __usercall sub_11028<eax>(int a1<eax>, RTL_GENERIC_TABLE *a2<edi>)

2292
2293
{

2294
2295
  PKSPIN_LOCK v2; // ecx@1

2296
2297
  PVOID v3; // esi@1

2298
2299
  PVOID v4; // eax@1

2300
2301
  char v5; // zf@1

2302
2303
  KIRQL v6; // dl@2

2304
2305
  int Buffer; // [sp+8h] [bp-18h]@1

2306
2307
  PKSPIN_LOCK SpinLock; // [sp+1Ch] [bp-4h]@1

2308
2309
2310
2311
  Buffer = a1;

2312
2313
  sub_1118A((int)&SpinLock, (int)&a2[1]);

2314
2315
  v4 = RtlLookupElementGenericTable(a2, &Buffer);

2316
2317
  v2 = SpinLock;

2318
2319
  v5 = SpinLock[3] == 1;

2320
2321
  --v2[3];

2322
2323
  v3 = v4;

2324
2325
  if ( v5 )

2326
2327
  {

2328
2329
    v6 = *((_BYTE *)v2 + 4);

2330
2331
    v2[2] = 0;

2332
2333
    KfReleaseSpinLock(v2, v6);

2334
2335
  }

2336
2337
  return v3;

2338
2339
}

2340
2341
2342
2343
//----- (00011066) --------------------------------------------------------

2344
2345
signed int __usercall sub_11066<eax>(int a1<eax>, RTL_GENERIC_TABLE *a2<edi>)

2346
2347
{

2348
2349
  int v2; // ecx@1

2350
2351
  BOOLEAN v3; // al@1

2352
2353
  char v4; // zf@2

2354
2355
  KIRQL v5; // dl@3

2356
2357
  signed int result; // eax@4

2358
2359
  char v7; // zf@5

2360
2361
  KIRQL v8; // dl@6

2362
2363
  int Buffer; // [sp+8h] [bp-18h]@1

2364
2365
  int v10; // [sp+1Ch] [bp-4h]@1

2366
2367
2368
2369
  Buffer = a1;

2370
2371
  sub_1118A((int)&v10, (int)&a2[1]);

2372
2373
  v3 = RtlDeleteElementGenericTable(a2, &Buffer);

2374
2375
  v2 = v10;

2376
2377
  if ( v3 )

2378
2379
  {

2380
2381
    v7 = *(_DWORD *)(v10 + 12)-- == 1;

2382
2383
    if ( v7 )

2384
2385
    {

2386
2387
      v8 = *(_BYTE *)(v2 + 4);

2388
2389
      *(_DWORD *)(v2 + 8) = 0;

2390
2391
      KfReleaseSpinLock((PKSPIN_LOCK)v2, v8);

2392
2393
    }

2394
2395
    result = 0;

2396
2397
  }

2398
2399
  else

2400
2401
  {

2402
2403
    v4 = *(_DWORD *)(v10 + 12)-- == 1;

2404
2405
    if ( v4 )

2406
2407
    {

2408
2409
      v5 = *(_BYTE *)(v2 + 4);

2410
2411
      *(_DWORD *)(v2 + 8) = 0;

2412
2413
      KfReleaseSpinLock((PKSPIN_LOCK)v2, v5);

2414
2415
    }

2416
2417
    result = -1073741823;

2418
2419
  }

2420
2421
  return result;

2422
2423
}

2424
2425
2426
2427
//----- (000110C0) --------------------------------------------------------

2428
2429
signed int __userpurge sub_110C0<eax>(RTL_GENERIC_TABLE *a1<eax>, int *a2)

2430
2431
{

2432
2433
  RTL_GENERIC_TABLE *v2; // edi@1

2434
2435
  PKSPIN_LOCK v3; // ecx@3

2436
2437
  char v4; // zf@3

2438
2439
  PVOID v6; // eax@7

2440
2441
  char v7; // zf@8

2442
2443
  char v8; // zf@10

2444
2445
  KIRQL v9; // dl@11

2446
2447
  PKSPIN_LOCK SpinLock; // [sp+Ch] [bp-4h]@1

2448
2449
2450
2451
  v2 = a1;

2452
2453
  sub_1118A((int)&SpinLock, (int)&a1[1]);

2454
2455
  if ( sub_11028(*a2, v2) && sub_11066(*a2, v2) )

2456
2457
  {

2458
2459
    v3 = SpinLock;

2460
2461
    v4 = SpinLock[3] == 1;

2462
2463
    --v3[3];

2464
2465
    if ( !v4 )

2466
2467
      return -1073741823;

2468
2469
    v3[2] = 0;

2470
2471
LABEL_5:

2472
2473
    KfReleaseSpinLock(v3, *((_BYTE *)v3 + 4));

2474
2475
    return -1073741823;

2476
2477
  }

2478
2479
  v6 = RtlInsertElementGenericTable(v2, a2, 0x14u, 0);

2480
2481
  v3 = SpinLock;

2482
2483
  if ( !v6 )

2484
2485
  {

2486
2487
    v7 = SpinLock[3]-- == 1;

2488
2489
    if ( !v7 )

2490
2491
      return -1073741823;

2492
2493
    v3[2] = 0;

2494
2495
    goto LABEL_5;

2496
2497
  }

2498
2499
  v8 = SpinLock[3]-- == 1;

2500
2501
  if ( v8 )

2502
2503
  {

2504
2505
    v9 = *((_BYTE *)v3 + 4);

2506
2507
    v3[2] = 0;

2508
2509
    KfReleaseSpinLock(v3, v9);

2510
2511
  }

2512
2513
  return 0;

2514
2515
}

2516
2517
2518
2519
//----- (00011142) --------------------------------------------------------

2520
2521
bool __stdcall CompareRoutine(int a1, int a2, int a3)

2522
2523
{

2524
2525
  bool result; // eax@2

2526
2527
2528
2529
  if ( *(_DWORD *)a2 == *(_DWORD *)a3 )

2530
2531
    result = 2;

2532
2533
  else

2534
2535
    result = *(_DWORD *)a2 >= *(_DWORD *)a3;

2536
2537
  return result;

2538
2539
}

2540
2541
2542
2543
//----- (00011160) --------------------------------------------------------

2544
2545
PVOID __stdcall AllocateRoutine(int a1, SIZE_T NumberOfBytes)

2546
2547
{

2548
2549
  return ExAllocatePool(0, NumberOfBytes);

2550
2551
}

2552
2553
2554
2555
//----- (00011172) --------------------------------------------------------

2556
2557
void __stdcall FreeRoutine(int a1, PVOID P)

2558
2559
{

2560
2561
  if ( P )

2562
2563
    ExFreePoolWithTag(P, 0);

2564
2565
}

2566
2567
2568
2569
//----- (0001118A) --------------------------------------------------------

2570
2571
int __usercall sub_1118A<eax>(int a1<ebx>, int a2<esi>)

2572
2573
{

2574
2575
  PKTHREAD v2; // edi@1

2576
2577
  KIRQL v3; // al@2

2578
2579
2580
2581
  *(_DWORD *)a1 = a2;

2582
2583
  v2 = KeGetCurrentThread();

2584
2585
  if ( v2 != *(PKTHREAD *)(a2 + 8) )

2586
2587
  {

2588
2589
    v3 = KfAcquireSpinLock((PKSPIN_LOCK)a2);

2590
2591
    *(_DWORD *)(a2 + 12) = 0;

2592
2593
    *(_BYTE *)(a2 + 4) = v3;

2594
2595
    *(_DWORD *)(a2 + 8) = v2;

2596
2597
  }

2598
2599
  ++*(_DWORD *)(a2 + 12);

2600
2601
  return a1;

2602
2603
}

2604
2605
2606
2607
//----- (000111B4) --------------------------------------------------------

2608
2609
int __userpurge sub_111B4<eax>(int a1<eax>, int a2<ebx>, int a3)

2610
2611
{

2612
2613
  int v3; // esi@1

2614
2615
  int v4; // ecx@2

2616
2617
  int v5; // ecx@4

2618
2619
  int v7; // [sp+8h] [bp-24h]@2

2620
2621
  unsigned int v8; // [sp+Ch] [bp-20h]@2

2622
2623
  unsigned int v9; // [sp+10h] [bp-1Ch]@2

2624
2625
  int v10; // [sp+14h] [bp-18h]@2

2626
2627
  int v11; // [sp+18h] [bp-14h]@2

2628
2629
  int v12; // [sp+1Ch] [bp-10h]@4

2630
2631
  unsigned int v13; // [sp+20h] [bp-Ch]@2

2632
2633
  unsigned int v14; // [sp+24h] [bp-8h]@3

2634
2635
2636
2637
  v3 = 0;

2638
2639
  if ( a3

2640
2641
    && (v4 = *(_DWORD *)a1,

2642
2643
        v8 = *(_DWORD *)(a1 + 4),

2644
2645
        v7 = v4,

2646
2647
        v9 = 0,

2648
2649
        v10 = 0,

2650
2651
        v11 = 0,

2652
2653
        sub_10FC4((int)&v7, (int)&v13),

2654
2655
        v9 <= v8)

2656
2657
    && (v14 = 0, v13 > 0) )

2658
2659
  {

2660
2661
    while ( 1 )

2662
2663
    {

2664
2665
      sub_10FC4((int)&v7, (int)&v12);

2666
2667
      sub_10DA8(v5, (int)&v10, (int)&v7);

2668
2669
      if ( v9 > v8 )

2670
2671
      {

2672
2673
LABEL_7:

2674
2675
        v3 = 0;

2676
2677
        goto LABEL_8;

2678
2679
      }

2680
2681
      if ( a3 == v12 )

2682
2683
        break;

2684
2685
      ++v14;

2686
2687
      if ( v14 >= v13 )

2688
2689
        goto LABEL_7;

2690
2691
    }

2692
2693
    *(_DWORD *)a2 = v10;

2694
2695
    *(_DWORD *)(a2 + 4) = v11;

2696
2697
  }

2698
2699
  else

2700
2701
  {

2702
2703
LABEL_8:

2704
2705
    *(_DWORD *)a2 = v3;

2706
2707
    *(_DWORD *)(a2 + 4) = v3;

2708
2709
  }

2710
2711
  return a2;

2712
2713
}

2714
2715
2716
2717
//----- (00011242) --------------------------------------------------------

2718
2719
signed int __userpurge sub_11242<eax>(int a1<eax>, int a2, int a3)

2720
2721
{

2722
2723
  signed int result; // eax@1

2724
2725
  PVOID v4; // eax@2

2726
2727
  PVOID v5; // edi@2

2728
2729
  int v6; // eax@4

2730
2731
  int v7; // ebx@4

2732
2733
  unsigned int v8; // esi@4

2734
2735
  void *v9; // ST08_4@4

2736
2737
  int v10; // ecx@10

2738
2739
  char v11; // [sp+10h] [bp-38h]@1

2740
2741
  int v12; // [sp+18h] [bp-30h]@4

2742
2743
  int v13; // [sp+1Ch] [bp-2Ch]@4

2744
2745
  int v14; // [sp+30h] [bp-18h]@8

2746
2747
  int v15; // [sp+34h] [bp-14h]@7

2748
2749
  unsigned int v16; // [sp+38h] [bp-10h]@8

2750
2751
  int v17; // [sp+3Ch] [bp-Ch]@8

2752
2753
  unsigned int v18; // [sp+40h] [bp-8h]@4

2754
2755
  int v19; // [sp+44h] [bp-4h]@6

2756
2757
2758
2759
  result = sub_121E1((int)&v11, *(_DWORD *)(a1 + 4), 1);

2760
2761
  if ( !result )

2762
2763
  {

2764
2765
    v4 = sub_1182C(dword_12680 + 4981);

2766
2767
    v5 = v4;

2768
2769
    if ( v4

2770
2771
      && (v7 = (int)((char *)v4 + 4981),

2772
2773
          memcpy(v4, &unk_12EB8, 0x1375u),

2774
2775
          memcpy((char *)v5 + 4981, &unk_12694, dword_12680),

2776
2777
          *(_WORD *)v7 = 23117,

2778
2779
          *(_DWORD *)(dword_1268C + v7) = 17744,

2780
2781
          *(_WORD *)(dword_12690 + v7) = 267,

2782
2783
          v9 = (void *)(v7 + dword_12688),

2784
2785
          *(_DWORD *)(a3 + 4) = v7 + dword_12688,

2786
2787
          memset(v9, 0, 0x98u),

2788
2789
          *(_DWORD *)(*(_DWORD *)(a3 + 4) + 88) = v5,

2790
2791
          *(_DWORD *)(*(_DWORD *)(a3 + 4) + 96) = v7,

2792
2793
          *(_DWORD *)(*(_DWORD *)(a3 + 4) + 104) = dword_12680,

2794
2795
          v18 = v12 + *(_DWORD *)(v13 + 40),

2796
2797
          v8 = v18,

2798
2799
          (v6 = sub_1210F((int)&v11, v18)) != 0)

2800
2801
      && v12 + *(_DWORD *)(v6 + 8) + *(_DWORD *)(v6 + 12) >= v8 + 12 )

2802
2803
    {

2804
2805
      result = sub_118E2(v8, (int)&v11);

2806
2807
      v19 = result;

2808
2809
      if ( !result )

2810
2811
      {

2812
2813
        sub_10A8A((int)&v15, &v19);

2814
2815
        result = v19;

2816
2817
        if ( !v19 )

2818
2819
        {

2820
2821
          v16 = v18;

2822
2823
          v17 = 12;

2824
2825
          result = (*(int (__stdcall **)(signed int, unsigned int *, int *, signed int, int *))v15)(

2826
2827
                     -1,

2828
2829
                     &v16,

2830
2831
                     &v17,

2832
2833
                     128,

2834
2835
                     &v14);

2836
2837
          if ( !result )

2838
2839
          {

2840
2841
            result = sub_11864((HANDLE *)(*(_DWORD *)(a3 + 4) + 144));

2842
2843
            if ( !result )

2844
2845
            {

2846
2847
              v10 = v14;

2848
2849
              *(_DWORD *)a3 = a2;

2850
2851
              *(_DWORD *)(a3 + 8) = v7 + dword_12684;

2852
2853
              *(_DWORD *)(a3 + 12) = v18;

2854
2855
              *(_DWORD *)(*(_DWORD *)(a3 + 4) + 136) = v10;

2856
2857
              result = 0;

2858
2859
            }

2860
2861
          }

2862
2863
        }

2864
2865
      }

2866
2867
    }

2868
2869
    else

2870
2871
    {

2872
2873
      result = -1073741823;

2874
2875
    }

2876
2877
  }

2878
2879
  return result;

2880
2881
}

2882
2883
// 12684: using guessed type int dword_12684;

2884
2885
// 12688: using guessed type int dword_12688;

2886
2887
// 1268C: using guessed type int dword_1268C;

2888
2889
// 12690: using guessed type int dword_12690;

2890
2891
2892
2893
//----- (000113C2) --------------------------------------------------------

2894
2895
PVOID __userpurge sub_113C2<eax>(int a1<edi>, int a2, int a3)

2896
2897
{

2898
2899
  PVOID result; // eax@1

2900
2901
  PVOID v4; // esi@1

2902
2903
  int v5; // ebx@2

2904
2905
2906
2907
  result = sub_1182C(*(_DWORD *)(a1 + 4) + 40);

2908
2909
  v4 = result;

2910
2911
  if ( result )

2912
2913
  {

2914
2915
    v5 = (int)((char *)result + 40);

2916
2917
    memcpy((char *)result + 40, *(const void **)a1, *(_DWORD *)(a1 + 4));

2918
2919
    *((_DWORD *)v4 + 2) = v5;

2920
2921
    *((_DWORD *)v4 + 4) = *(_DWORD *)(a1 + 4);

2922
2923
    *((_WORD *)v4 + 12) = *(_WORD *)(a2 + 4);

2924
2925
    *((_BYTE *)v4 + 32) = (*(_BYTE *)(a2 + 6) >> 1) & 1;

2926
2927
    *(_DWORD *)v4 = *(_DWORD *)(*(_DWORD *)(a3 + 4) + 112);

2928
2929
    result = *(PVOID *)(a3 + 4);

2930
2931
    *((_DWORD *)result + 28) = v4;

2932
2933
  }

2934
2935
  return result;

2936
2937
}

2938
2939
2940
2941
//----- (0001141E) --------------------------------------------------------

2942
2943
void __userpurge sub_1141E(int a1<eax>, int a2<ecx>, int a3<ebx>, int a4, int a5)

2944
2945
{

2946
2947
  int v5; // esi@1

2948
2949
  char v6; // zf@1

2950
2951
  int v7; // edi@2

2952
2953
  int v8; // edi@4

2954
2955
  int v9; // eax@6

2956
2957
  int v10; // eax@10

2958
2959
  RTL_GENERIC_TABLE *v11; // edi@10

2960
2961
  char v12; // [sp+8h] [bp-30h]@11

2962
2963
  LSA_UNICODE_STRING DestinationString; // [sp+1Ch] [bp-1Ch]@3

2964
2965
  PCWSTR v14; // [sp+24h] [bp-14h]@2

2966
2967
  int v15; // [sp+28h] [bp-10h]@9

2968
2969
  char v16; // [sp+2Ch] [bp-Ch]@1

2970
2971
  int v17; // [sp+30h] [bp-8h]@1

2972
2973
  RTL_GENERIC_TABLE *v18; // [sp+34h] [bp-4h]@10

2974
2975
2976
2977
  v17 = 0;

2978
2979
  v6 = (*(_BYTE *)(a3 + 6) & 2) == 0;

2980
2981
  v5 = a2;

2982
2983
  v16 = 1;

2984
2985
  if ( v6 )

2986
2987
  {

2988
2989
    v7 = *(_DWORD *)(a1 + 4);

2990
2991
    v14 = *(PCWSTR *)a1;

2992
2993
  }

2994
2995
  else

2996
2997
  {

2998
2999
    RtlInitUnicodeString(&DestinationString, *(PCWSTR *)a1);

3000
3001
    if ( sub_10638(&DestinationString, dword_14539, (int)&v16) )

3002
3003
    {

3004
3005
      v9 = *(_DWORD *)v5;

3006
3007
      v7 = *(_DWORD *)(v5 + 4);

3008
3009
    }

3010
3011
    else

3012
3013
    {

3014
3015
      v8 = v17;

3016
3017
      if ( *(_BYTE *)(a3 + 6) & 1 )

3018
3019
        sub_11EC6(*(_DWORD *)(a3 + 8), *(_DWORD *)v17, *(_DWORD *)(v17 + 4));

3020
3021
      v9 = *(_DWORD *)v8;

3022
3023
      v7 = *(_DWORD *)(v8 + 4);

3024
3025
    }

3026
3027
    v14 = (PCWSTR)v9;

3028
3029
  }

3030
3031
  v15 = v7;

3032
3033
  if ( v7 )

3034
3035
  {

3036
3037
    sub_10B36((int)&v18);

3038
3039
    v11 = v18;

3040
3041
    v10 = (int)sub_11028(a4, v18);

3042
3043
    if ( v10 || !sub_11242(a5, a4, (int)&v12) && !sub_110C0(v11, (int *)&v12) && (v10 = (int)sub_11028(a4, v11)) != 0 )

3044
3045
      sub_113C2((int)&v14, a3, v10);

3046
3047
  }

3048
3049
  sub_10D7E((int)&v16);

3050
3051
}

3052
3053
// 14539: using guessed type int dword_14539;

3054
3055
3056
3057
//----- (000114EC) --------------------------------------------------------

3058
3059
void __fastcall sub_114EC(int a1, int a2, int a3, int a4, int a5)

3060
3061
{

3062
3063
  sub_1141E(a5, a1, a2, a3, a4);

3064
3065
}

3066
3067
3068
3069
//----- (00011522) --------------------------------------------------------

3070
3071
LONG_PTR __stdcall sub_11522(int a1, int a2, int a3, int a4, int a5)

3072
3073
{

3074
3075
  void *v5; // ecx@1

3076
3077
  char v7; // [sp+Ch] [bp-28h]@1

3078
3079
  char v8; // [sp+10h] [bp-24h]@5

3080
3081
  char v9; // [sp+18h] [bp-1Ch]@4

3082
3083
  int v10; // [sp+30h] [bp-4h]@1

3084
3085
3086
3087
  v10 = 0;

3088
3089
  sub_11FC0((int)&v7, (int)&v10, a1);

3090
3091
  if ( !v10 )

3092
3093
    sub_114EC(a5, a3, a1, a2, a4);

3094
3095
  if ( v7 )

3096
3097
  {

3098
3099
    v7 = 0;

3100
3101
    KeUnstackDetachProcess(&v9);

3102
3103
  }

3104
3105
  return sub_120CC(v5, (LONG_PTR)&v8);

3106
3107
}

3108
3109
// 12600: using guessed type int __stdcall KeUnstackDetachProcess(_DWORD);

3110
3111
3112
3113
//----- (00011578) --------------------------------------------------------

3114
3115
PVOID __stdcall sub_11578(int a1)

3116
3117
{

3118
3119
  RTL_GENERIC_TABLE *v2; // [sp+8h] [bp-4h]@1

3120
3121
3122
3123
  sub_10B36((int)&v2);

3124
3125
  return sub_11028(a1, v2);

3126
3127
}

3128
3129
3130
3131
//----- (00011598) --------------------------------------------------------

3132
3133
PVOID __stdcall sub_11598(int a1)

3134
3135
{

3136
3137
  return sub_11578(a1);

3138
3139
}

3140
3141
3142
3143
//----- (000115CC) --------------------------------------------------------

3144
3145
signed int __userpurge sub_115CC<eax>(const void *a1<eax>, int a2<ebx>, int a3)

3146
3147
{

3148
3149
  signed int result; // eax@1

3150
3151
  int v4; // ST38_4@1

3152
3153
  int v5; // esi@2

3154
3155
  char v6; // zf@2

3156
3157
  int v7; // edi@12

3158
3159
  int v8; // ecx@12

3160
3161
  int v9; // esi@12

3162
3163
  char v10; // [sp+8h] [bp-38h]@1

3164
3165
  char v11; // [sp+28h] [bp-18h]@1

3166
3167
  int v12; // [sp+2Ch] [bp-14h]@2

3168
3169
  int v13; // [sp+30h] [bp-10h]@12

3170
3171
  int v14; // [sp+34h] [bp-Ch]@12

3172
3173
  RTL_GENERIC_TABLE *v15; // [sp+3Ch] [bp-4h]@2

3174
3175
3176
3177
  v4 = *(_DWORD *)(a2 + 4);

3178
3179
  memcpy(&v11, a1, 0x14u);

3180
3181
  result = sub_121E1((int)&v10, v4, 1);

3182
3183
  if ( !result )

3184
3185
  {

3186
3187
    sub_10B36((int)&v15);

3188
3189
    sub_11066(a3, v15);

3190
3191
    v5 = v12;

3192
3193
    *(_DWORD *)v12 = *(_DWORD *)(a2 + 4);

3194
3195
    *(_DWORD *)(v5 + 8) = sub_1236B((int)&v10, -934890519);

3196
3197
    *(_DWORD *)(v5 + 16) = sub_1236B((int)&v10, -1871298611);

3198
3199
    *(_DWORD *)(v5 + 24) = sub_1236B((int)&v10, -1680372695);

3200
3201
    *(_DWORD *)(v5 + 32) = sub_1236B((int)&v10, 578844873);

3202
3203
    *(_DWORD *)(v5 + 40) = sub_1236B((int)&v10, 1538632765);

3204
3205
    *(_DWORD *)(v5 + 48) = sub_1236B((int)&v10, 1538689877);

3206
3207
    *(_DWORD *)(v5 + 56) = sub_1236B((int)&v10, -964130467);

3208
3209
    *(_DWORD *)(v5 + 64) = sub_1236B((int)&v10, -411935863);

3210
3211
    *(_DWORD *)(v5 + 72) = sub_1236B((int)&v10, 122157493);

3212
3213
    result = sub_1236B((int)&v10, 201870840);

3214
3215
    v6 = *(_DWORD *)(v5 + 8) == 0;

3216
3217
    *(_DWORD *)(v5 + 80) = result;

3218
3219
    if ( !v6 )

3220
3221
    {

3222
3223
      if ( *(_DWORD *)(v5 + 16) )

3224
3225
      {

3226
3227
        if ( *(_DWORD *)(v5 + 24) )

3228
3229
        {

3230
3231
          if ( *(_DWORD *)(v5 + 32) )

3232
3233
          {

3234
3235
            if ( *(_DWORD *)(v5 + 40) )

3236
3237
            {

3238
3239
              if ( *(_DWORD *)(v5 + 48) )

3240
3241
              {

3242
3243
                if ( *(_DWORD *)(v5 + 56) )

3244
3245
                {

3246
3247
                  if ( *(_DWORD *)(v5 + 64) )

3248
3249
                  {

3250
3251
                    if ( *(_DWORD *)(v5 + 72) )

3252
3253
                    {

3254
3255
                      if ( result )

3256
3257
                      {

3258
3259
                        result = v14;

3260
3261
                        v7 = v5 + 120;

3262
3263
                        v8 = v13;

3264
3265
                        v9 = v14;

3266
3267
                        *(_DWORD *)v7 = *(_DWORD *)v14;

3268
3269
                        v9 += 4;

3270
3271
                        v7 += 4;

3272
3273
                        *(_DWORD *)v7 = *(_DWORD *)v9;

3274
3275
                        *(_DWORD *)(v7 + 4) = *(_DWORD *)(v9 + 4);

3276
3277
                        *(_DWORD *)result = *(_DWORD *)"ž";

3278
3279
                        *(_WORD *)(result + 4) = *(_WORD *)&asc_12678[4];

3280
3281
                        *(_BYTE *)(result + 6) = asc_12678[6];

3282
3283
                        *(_DWORD *)(result + 1) = v8;

3284
3285
                      }

3286
3287
                    }

3288
3289
                  }

3290
3291
                }

3292
3293
              }

3294
3295
            }

3296
3297
          }

3298
3299
        }

3300
3301
      }

3302
3303
    }

3304
3305
  }

3306
3307
  return result;

3308
3309
}

3310
3311
3312
3313
//----- (00011718) --------------------------------------------------------

3314
3315
signed int __thiscall sub_11718(int this, int a2, const void *a3)

3316
3317
{

3318
3319
  return sub_115CC(a3, this, a2);

3320
3321
}

3322
3323
3324
3325
//----- (0001174A) --------------------------------------------------------

3326
3327
__int32 __stdcall sub_1174A(int a1, int a2)

3328
3329
{

3330
3331
  __int32 result; // eax@1

3332
3333
  const void *v3; // edi@1

3334
3335
  void *v4; // ecx@2

3336
3337
  char v5; // [sp+8h] [bp-28h]@2

3338
3339
  char v6; // [sp+Ch] [bp-24h]@6

3340
3341
  char v7; // [sp+14h] [bp-1Ch]@5

3342
3343
  int v8; // [sp+2Ch] [bp-4h]@2

3344
3345
3346
3347
  result = (__int32)sub_11598(a1);

3348
3349
  v3 = (const void *)result;

3350
3351
  if ( result )

3352
3353
  {

3354
3355
    v8 = 0;

3356
3357
    sub_11FC0((int)&v5, (int)&v8, a1);

3358
3359
    if ( !v8 )

3360
3361
      sub_11718(a2, a1, v3);

3362
3363
    if ( v5 )

3364
3365
    {

3366
3367
      v5 = 0;

3368
3369
      KeUnstackDetachProcess(&v7);

3370
3371
    }

3372
3373
    result = sub_120CC(v4, (LONG_PTR)&v6);

3374
3375
  }

3376
3377
  return result;

3378
3379
}

3380
3381
// 12600: using guessed type int __stdcall KeUnstackDetachProcess(_DWORD);

3382
3383
3384
3385
//----- (000117A8) --------------------------------------------------------

3386
3387
char __usercall sub_117A8<al>(WCHAR *a1<eax>, int a2<ecx>)

3388
3389
{

3390
3391
  WCHAR *v2; // edi@1

3392
3393
  int v3; // esi@1

3394
3395
  WCHAR v4; // dx@2

3396
3397
  unsigned int v5; // eax@3

3398
3399
  int v6; // edx@3

3400
3401
  char result; // al@4

3402
3403
  int v8; // eax@5

3404
3405
  WCHAR *v9; // esi@6

3406
3407
  WCHAR v10; // bx@7

3408
3409
  int v11; // [sp+8h] [bp-Ch]@3

3410
3411
  unsigned int v12; // [sp+Ch] [bp-8h]@5

3412
3413
  int v13; // [sp+10h] [bp-4h]@6

3414
3415
3416
3417
  v2 = a1;

3418
3419
  v3 = (int)(a1 + 1);

3420
3421
  do

3422
3423
  {

3424
3425
    v4 = *a1;

3426
3427
    ++a1;

3428
3429
  }

3430
3431
  while ( v4 );

3432
3433
  v6 = (signed int)((char *)a1 - v3) >> 1;

3434
3435
  v5 = (unsigned __int16)(*(_WORD *)a2 >> 1);

3436
3437
  v11 = v6;

3438
3439
  if ( v6 <= v5 )

3440
3441
  {

3442
3443
    v12 = 0;

3444
3445
    v8 = *(_DWORD *)(a2 + 4) + 2 * (v5 - v6);

3446
3447
    if ( v6 )

3448
3449
    {

3450
3451
      v13 = v8 - (_DWORD)v2;

3452
3453
      v9 = v2;

3454
3455
      while ( 1 )

3456
3457
      {

3458
3459
        v10 = RtlUpcaseUnicodeChar(*(WCHAR *)((char *)v9 + v13));

3460
3461
        if ( RtlUpcaseUnicodeChar(*v9) != v10 )

3462
3463
          break;

3464
3465
        ++v12;

3466
3467
        ++v9;

3468
3469
        if ( v12 >= v11 )

3470
3471
          goto LABEL_9;

3472
3473
      }

3474
3475
      result = 0;

3476
3477
    }

3478
3479
    else

3480
3481
    {

3482
3483
LABEL_9:

3484
3485
      result = 1;

3486
3487
    }

3488
3489
  }

3490
3491
  else

3492
3493
  {

3494
3495
    result = 0;

3496
3497
  }

3498
3499
  return result;

3500
3501
}

3502
3503
3504
3505
//----- (0001182C) --------------------------------------------------------

3506
3507
PVOID __usercall sub_1182C<eax>(ULONG a1<esi>)

3508
3509
{

3510
3511
  PVOID result; // eax@3

3512
3513
  PVOID BaseAddress; // [sp+0h] [bp-8h]@1

3514
3515
  ULONG AllocationSize; // [sp+4h] [bp-4h]@1

3516
3517
3518
3519
  BaseAddress = 0;

3520
3521
  AllocationSize = a1;

3522
3523
  if ( ZwAllocateVirtualMemory((HANDLE)0xFFFFFFFF, &BaseAddress, 0, &AllocationSize, 0x1000u, 0x40u)

3524
3525
    || AllocationSize < a1 )

3526
3527
    result = 0;

3528
3529
  else

3530
3531
    result = BaseAddress;

3532
3533
  return result;

3534
3535
}

3536
3537
3538
3539
//----- (00011864) --------------------------------------------------------

3540
3541
int __usercall sub_11864<eax>(HANDLE *a1<edi>)

3542
3543
{

3544
3545
  signed int v1; // esi@1

3546
3547
  int i; // esi@6

3548
3549
  HANDLE Handle; // [sp+4h] [bp-4Ch]@3

3550
3551
  OBJECT_ATTRIBUTES ObjectAttributes; // [sp+24h] [bp-2Ch]@1

3552
3553
  struct _IO_STATUS_BLOCK IoStatusBlock; // [sp+3Ch] [bp-14h]@2

3554
3555
  LSA_UNICODE_STRING DestinationString; // [sp+44h] [bp-Ch]@1

3556
3557
  NTSTATUS v8; // [sp+4Ch] [bp-4h]@2

3558
3559
3560
3561
  RtlInitUnicodeString(&DestinationString, &SourceString);

3562
3563
  ObjectAttributes.RootDirectory = 0;

3564
3565
  ObjectAttributes.SecurityDescriptor = 0;

3566
3567
  ObjectAttributes.SecurityQualityOfService = 0;

3568
3569
  ObjectAttributes.Length = 24;

3570
3571
  ObjectAttributes.Attributes = 64;

3572
3573
  ObjectAttributes.ObjectName = &DestinationString;

3574
3575
  v1 = 0;

3576
3577
  while ( 1 )

3578
3579
  {

3580
3581
    v8 = ZwOpenFile(a1, 0xC0100000u, &ObjectAttributes, &IoStatusBlock, 3u, 0x60u);

3582
3583
    if ( v8 )

3584
3585
      break;

3586
3587
    *(&Handle + v1++) = *a1;

3588
3589
    if ( v1 > 7 )

3590
3591
      goto LABEL_6;

3592
3593
  }

3594
3595
  ++v1;

3596
3597
LABEL_6:

3598
3599
  for ( i = v1 - 2; i >= 0; --i )

3600
3601
    ZwClose(*(&Handle + i));

3602
3603
  return v8;

3604
3605
}

3606
3607
3608
3609
//----- (000118E2) --------------------------------------------------------

3610
3611
signed int __stdcall sub_118E2(unsigned int a1, int a2)

3612
3613
{

3614
3615
  signed int result; // eax@2

3616
3617
  bool v3; // eax@3

3618
3619
  int v4; // edx@6

3620
3621
  int v5; // ecx@6

3622
3623
  unsigned int v6; // eax@7

3624
3625
  unsigned int v7; // eax@9

3626
3627
  unsigned int v8; // edi@10

3628
3629
  int v9; // eax@11

3630
3631
  int i; // [sp+0h] [bp-10h]@6

3632
3633
  unsigned int v11; // [sp+4h] [bp-Ch]@10

3634
3635
  int v12; // [sp+8h] [bp-8h]@3

3636
3637
  int v13; // [sp+Ch] [bp-4h]@3

3638
3639
3640
3641
  if ( *(_DWORD *)(a2 + 8) == *(_DWORD *)(*(_DWORD *)(a2 + 12) + 52)

3642
3643
    || (v13 = 0, v12 = 0, v3 = sub_122D0(a2, 5u, (int)&v13, (int)&v12), v3 == 2) )

3644
3645
  {

3646
3647
    result = 0;

3648
3649
  }

3650
3651
  else

3652
3653
  {

3654
3655
    if ( v3 )

3656
3657
    {

3658
3659
      result = -1073741823;

3660
3661
    }

3662
3663
    else

3664
3665
    {

3666
3667
      v5 = v13;

3668
3669
      v4 = v13 + 8;

3670
3671
      for ( i = v13 + v12; v5 + 8 <= (unsigned int)i; v13 = v5 )

3672
3673
      {

3674
3675
        v6 = *(_DWORD *)(v5 + 4);

3676
3677
        if ( !v6 )

3678
3679
          break;

3680
3681
        if ( v6 < 8 || (v7 = v6 - 8, v7 & 1) )

3682
3683
          return -1073741823;

3684
3685
        v11 = v7 >> 1;

3686
3687
        v8 = 0;

3688
3689
        if ( v7 >> 1 )

3690
3691
        {

3692
3693
          do

3694
3695
          {

3696
3697
            v9 = *(_DWORD *)(a2 + 8) + *(_DWORD *)v5 + (*(_WORD *)(v4 + 2 * v8) & 0xFFF);

3698
3699
            if ( *(_WORD *)(v4 + 2 * v8) & 0xF000 )

3700
3701
            {

3702
3703
              if ( v9 >= a1 && v9 < a1 + 12 )

3704
3705
                return -1073741637;

3706
3707
            }

3708
3709
            ++v8;

3710
3711
          }

3712
3713
          while ( v8 < v11 );

3714
3715
        }

3716
3717
        v5 += *(_DWORD *)(v5 + 4);

3718
3719
        v4 = v5 + 8;

3720
3721
      }

3722
3723
      result = 0;

3724
3725
    }

3726
3727
  }

3728
3729
  return result;

3730
3731
}

3732
3733
3734
3735
//----- (000119AE) --------------------------------------------------------

3736
3737
char __fastcall sub_119AE(int a1, int a2)

3738
3739
{

3740
3741
  int v2; // eax@1

3742
3743
3744
3745
  v2 = *(_DWORD *)(a2 + 36);

3746
3747
  return !(v2 & 0x2000000)

3748
3749
      && v2 & 0x20000000

3750
3751
      && v2 & 0x20

3752
3753
      && v2 & 0x40000000

3754
3755
      && (!strncmp((const char *)a2, ".text", 8) || !strncmp((const char *)a2, "PAGE", 8));

3756
3757
}

3758
3759
3760
3761
//----- (00011A08) --------------------------------------------------------

3762
3763
char __usercall sub_11A08<al>(int a1<edi>)

3764
3765
{

3766
3767
  unsigned int v1; // ecx@1

3768
3769
3770
3771
  v1 = 0;

3772
3773
  while ( (byte_12644[v1] & *(&byte_12644[v1] + a1 - (_DWORD)byte_12644)) == byte_12630[v1] )

3774
3775
  {

3776
3777
    ++v1;

3778
3779
    if ( v1 >= 0x14 )

3780
3781
      return *(_DWORD *)(a1 + 13) - *(_DWORD *)((char *)&ZwAllocateVirtualMemory + 13) == (_DWORD)((char *)ZwAllocateVirtualMemory

3782
3783
                                                                                                 - a1);

3784
3785
  }

3786
3787
  return 0;

3788
3789
}

3790
3791
3792
3793
//----- (00011A4A) --------------------------------------------------------

3794
3795
int __userpurge sub_11A4A<eax>(int a1<eax>, int a2<ebx>, unsigned int a3)

3796
3797
{

3798
3799
  int v3; // esi@1

3800
3801
  int v4; // edx@4

3802
3803
  int v5; // edi@4

3804
3805
  int v6; // edx@5

3806
3807
  unsigned int v7; // eax@6

3808
3809
  int v9; // [sp-4h] [bp-10h]@4

3810
3811
  unsigned int v10; // [sp+8h] [bp-4h]@1

3812
3813
3814
3815
  v10 = 0;

3816
3817
  v3 = a1;

3818
3819
  while ( 1 )

3820
3821
  {

3822
3823
    if ( a3 <= v3 + 5 )

3824
3825
      return 0;

3826
3827
    if ( *(_BYTE *)v3 == -24 )

3828
3829
    {

3830
3831
      v5 = *(_DWORD *)(v3 + 1) + v3 + 5;

3832
3833
      v4 = sub_1210F(a2, v5);

3834
3835
      if ( v4 )

3836
3837
      {

3838
3839
        if ( sub_119AE(v9, v4) )

3840
3841
        {

3842
3843
          v7 = *(_DWORD *)(v6 + 8);

3844
3845
          if ( v7 >= *(_DWORD *)(v6 + 16) )

3846
3847
            v7 = *(_DWORD *)(v6 + 16);

3848
3849
          if ( v5 + 20 <= v7 + *(_DWORD *)(a2 + 8) + *(_DWORD *)(v6 + 12) && sub_11A08(v5) )

3850
3851
            break;

3852
3853
        }

3854
3855
      }

3856
3857
    }

3858
3859
    ++v10;

3860
3861
    ++v3;

3862
3863
    if ( v10 >= 0x1E )

3864
3865
      return 0;

3866
3867
  }

3868
3869
  return v5;

3870
3871
}

3872
3873
3874
3875
//----- (00011ABC) --------------------------------------------------------

3876
3877
const char *__usercall sub_11ABC<eax>(const char *result<eax>, int a2<ecx>)

3878
3879
{

3880
3881
  int v2; // ebx@1

3882
3883
3884
3885
  v2 = a2 - 19;

3886
3887
  while ( (unsigned int)result < v2 )

3888
3889
  {

3890
3891
    while ( (unsigned int)result <= v2 - 4 )

3892
3893
    {

3894
3895
      if ( *(_DWORD *)result == dword_12658 )

3896
3897
        goto LABEL_7;

3898
3899
      ++result;

3900
3901
    }

3902
3903
    result = 0;

3904
3905
LABEL_7:

3906
3907
    if ( !result )

3908
3909
      break;

3910
3911
    if ( !strncmp(result, (const char *)&dword_12658, 14) )

3912
3913
      return result;

3914
3915
    ++result;

3916
3917
  }

3918
3919
  return 0;

3920
3921
}

3922
3923
// 12658: using guessed type int dword_12658;

3924
3925
3926
3927
//----- (00011B04) --------------------------------------------------------

3928
3929
int __stdcall sub_11B04(int a1, const char *a2, unsigned int a3, int a4, int a5)

3930
3931
{

3932
3933
  int result; // eax@2

3934
3935
  const char *v6; // ebx@7

3936
3937
  int v7; // eax@17

3938
3939
  unsigned int v8; // ecx@17

3940
3941
  int v9; // eax@24

3942
3943
  int v10; // [sp+Ch] [bp-4h]@7

3944
3945
  int v11; // [sp+Ch] [bp-4h]@14

3946
3947
3948
3949
  *(_BYTE *)a5 = 0;

3950
3951
  if ( sub_10886(0) )

3952
3953
  {

3954
3955
    result = (int)sub_11ABC(a2, a3);

3956
3957
    if ( result )

3958
3959
    {

3960
3961
      if ( *(_DWORD *)a4 && result != *(_DWORD *)a4 )

3962
3963
        *(_BYTE *)a5 = 1;

3964
3965
      else

3966
3967
        *(_DWORD *)a4 = result;

3968
3969
    }

3970
3971
  }

3972
3973
  else

3974
3975
  {

3976
3977
    v6 = a2;

3978
3979
    result = a3 - 10;

3980
3981
    v10 = (int)a2;

3982
3983
    if ( (unsigned int)a2 < a3 - 10 )

3984
3985
    {

3986
3987
      while ( 2 )

3988
3989
      {

3990
3991
        for ( result = v10; ; ++result )

3992
3993
        {

3994
3995
          if ( result > a3 - 14 )

3996
3997
          {

3998
3999
            v11 = 0;

4000
4001
            goto LABEL_15;

4002
4003
          }

4004
4005
          if ( *(_DWORD *)result == dword_12628 )

4006
4007
            break;

4008
4009
        }

4010
4011
        v11 = result;

4012
4013
LABEL_15:

4014
4015
        if ( v11 )

4016
4017
        {

4018
4019
          if ( !strncmp((const char *)v11, (const char *)&dword_12628, 5) )

4020
4021
          {

4022
4023
            v8 = 0;

4024
4025
            v7 = v11;

4026
4027
            while ( (unsigned int)&v6[v8] < v11 )

4028
4029
            {

4030
4031
              if ( *(_BYTE *)v7 == -24

4032
4033
                && (NTSTATUS (__stdcall *)(HANDLE, PVOID *, ULONG, PULONG, ULONG, ULONG))(*(_DWORD *)(v7 + 1) + v7 + 5) == ZwAllocateVirtualMemory )

4034
4035
              {

4036
4037
                v9 = sub_11A4A(v11, a1, a3);

4038
4039
                if ( !v9 )

4040
4041
                  break;

4042
4043
                if ( !*(_DWORD *)a4 || v9 == *(_DWORD *)a4 )

4044
4045
                {

4046
4047
                  *(_DWORD *)a4 = v9;

4048
4049
                  break;

4050
4051
                }

4052
4053
                result = a5;

4054
4055
                *(_BYTE *)a5 = 1;

4056
4057
                return result;

4058
4059
              }

4060
4061
              ++v8;

4062
4063
              --v7;

4064
4065
              if ( v8 >= 0x78 )

4066
4067
                break;

4068
4069
            }

4070
4071
          }

4072
4073
          v10 = v11 + 1;

4074
4075
          result = v10;

4076
4077
          if ( v10 < a3 - 10 )

4078
4079
          {

4080
4081
            v6 = a2;

4082
4083
            continue;

4084
4085
          }

4086
4087
        }

4088
4089
        break;

4090
4091
      }

4092
4093
    }

4094
4095
  }

4096
4097
  return result;

4098
4099
}

4100
4101
// 12628: using guessed type int dword_12628;

4102
4103
4104
4105
//----- (00011C14) --------------------------------------------------------

4106
4107
int *__cdecl sub_11C14()

4108
4109
{

4110
4111
  int v0; // ebx@1

4112
4113
  int v1; // eax@2

4114
4115
  int v2; // ecx@3

4116
4117
  __int16 v3; // di@4

4118
4119
  int v4; // esi@4

4120
4121
  int v5; // edx@5

4122
4123
  unsigned int v6; // ecx@6

4124
4125
  int v7; // eax@8

4126
4127
  const char *v8; // ST04_4@8

4128
4129
  char v10; // [sp+Ch] [bp-2Ch]@3

4130
4131
  int v11; // [sp+20h] [bp-18h]@4

4132
4133
  unsigned __int16 v12; // [sp+24h] [bp-14h]@4

4134
4135
  int v13; // [sp+2Ch] [bp-Ch]@2

4136
4137
  int v14; // [sp+30h] [bp-8h]@4

4138
4139
  char v15; // [sp+37h] [bp-1h]@8

4140
4141
4142
4143
  v0 = 0;

4144
4145
  dword_146A8 = 0;

4146
4147
  if ( !dword_146AC )

4148
4149
  {

4150
4151
    v1 = sub_1098E();

4152
4153
    v13 = v1;

4154
4155
    if ( v1 )

4156
4157
    {

4158
4159
      if ( !sub_121E1((int)&v10, v1, 1) )

4160
4161
      {

4162
4163
        v3 = v12;

4164
4165
        v4 = v11;

4166
4167
        v14 = 0;

4168
4169
        if ( v12 > 0u )

4170
4171
        {

4172
4173
          while ( 1 )

4174
4175
          {

4176
4177
            if ( sub_119AE(v2, 40 * (unsigned __int16)v0 + v4) )

4178
4179
            {

4180
4181
              v6 = *(_DWORD *)(v5 + 16);

4182
4183
              if ( *(_DWORD *)(v5 + 8) < v6 )

4184
4185
                v6 = *(_DWORD *)(v5 + 8);

4186
4187
              v7 = v13 + *(_DWORD *)(v5 + 12);

4188
4189
              v8 = (const char *)(v13 + *(_DWORD *)(v5 + 12));

4190
4191
              v15 = 1;

4192
4193
              sub_11B04((int)&v10, v8, v7 + v2, (int)&v14, (int)&v15);

4194
4195
              if ( v15 )

4196
4197
                break;

4198
4199
            }

4200
4201
            ++v0;

4202
4203
            if ( (_WORD)v0 >= (unsigned __int16)v3 )

4204
4205
            {

4206
4207
              if ( !v14 )

4208
4209
                break;

4210
4211
              dword_146A8 = v14;

4212
4213
              return &dword_146A8;

4214
4215
            }

4216
4217
          }

4218
4219
        }

4220
4221
      }

4222
4223
    }

4224
4225
    dword_146AC = -1073741823;

4226
4227
  }

4228
4229
  return &dword_146A8;

4230
4231
}

4232
4233
// 146A8: using guessed type int dword_146A8;

4234
4235
// 146AC: using guessed type int dword_146AC;

4236
4237
4238
4239
//----- (00011CCC) --------------------------------------------------------

4240
4241
int __stdcall sub_11CCC(int a1)

4242
4243
{

4244
4245
  int v1; // eax@1

4246
4247
  int result; // eax@2

4248
4249
  int v3; // ebx@4

4250
4251
  int v4; // [sp+0h] [bp-8h]@6

4252
4253
  int v5; // [sp+4h] [bp-4h]@6

4254
4255
4256
4257
  v1 = *(_DWORD *)(a1 + 96);

4258
4259
  *(_DWORD *)(a1 + 28) = 0;

4260
4261
  if ( *(_DWORD *)(v1 + 8) != 40 || *(_DWORD *)(v1 + 4) != 40 )

4262
4263
  {

4264
4265
    result = -1073741811;

4266
4267
  }

4268
4269
  else

4270
4271
  {

4272
4273
    v3 = *(_DWORD *)(a1 + 12);

4274
4275
    if ( *(_DWORD *)v3 == -1347686387 )

4276
4277
    {

4278
4279
      v5 = 0;

4280
4281
      sub_10A8A((int)&v4, &v5);

4282
4283
      result = v5;

4284
4285
      if ( !v5 )

4286
4287
      {

4288
4289
        result = (*(int (__stdcall **)(_DWORD, int, int, _DWORD, int))v4)(

4290
4291
                   *(_DWORD *)(v3 + 8),

4292
4293
                   v3 + 16,

4294
4295
                   v3 + 24,

4296
4297
                   *(_DWORD *)(v3 + 32),

4298
4299
                   v3 + 32);

4300
4301
        if ( !result )

4302
4303
        {

4304
4305
          *(_DWORD *)(a1 + 28) = 40;

4306
4307
          result = 0;

4308
4309
        }

4310
4311
      }

4312
4313
    }

4314
4315
    else

4316
4317
    {

4318
4319
      result = -1073741811;

4320
4321
    }

4322
4323
  }

4324
4325
  return result;

4326
4327
}

4328
4329
4330
4331
//----- (00011D46) --------------------------------------------------------

4332
4333
char __stdcall sub_11D46(int a1, unsigned int a2)

4334
4335
{

4336
4337
  char result; // al@1

4338
4339
  unsigned int v3; // ecx@1

4340
4341
4342
4343
  v3 = 0;

4344
4345
  result = 0;

4346
4347
  if ( a2 )

4348
4349
  {

4350
4351
    do

4352
4353
      result += *(_BYTE *)(v3++ + a1);

4354
4355
    while ( v3 < a2 );

4356
4357
  }

4358
4359
  return result;

4360
4361
}

4362
4363
4364
4365
//----- (00011D62) --------------------------------------------------------

4366
4367
NTSTATUS __userpurge sub_11D62<eax>(LSA_UNICODE_STRING *a1<eax>, PUNICODE_STRING ValueName, int a3)

4368
4369
{

4370
4371
  NTSTATUS v3; // esi@1

4372
4373
  OBJECT_ATTRIBUTES ObjectAttributes; // [sp+8h] [bp-20h]@1

4374
4375
  int v6; // [sp+20h] [bp-8h]@1

4376
4377
  HANDLE Handle; // [sp+24h] [bp-4h]@1

4378
4379
4380
4381
  ObjectAttributes.ObjectName = a1;

4382
4383
  LOBYTE(v6) = 0;

4384
4385
  Handle = 0;

4386
4387
  ObjectAttributes.Length = 24;

4388
4389
  ObjectAttributes.RootDirectory = 0;

4390
4391
  ObjectAttributes.Attributes = 64;

4392
4393
  ObjectAttributes.SecurityDescriptor = 0;

4394
4395
  ObjectAttributes.SecurityQualityOfService = 0;

4396
4397
  v3 = ZwOpenKey(&Handle, 0x20019u, &ObjectAttributes);

4398
4399
  LOBYTE(v6) = v3 == 0;

4400
4401
  if ( !v3 )

4402
4403
    v3 = sub_11DD6((int)&v6, ValueName, a3);

4404
4405
  if ( (_BYTE)v6 )

4406
4407
  {

4408
4409
    LOBYTE(v6) = 0;

4410
4411
    ZwClose(Handle);

4412
4413
  }

4414
4415
  return v3;

4416
4417
}

4418
4419
4420
4421
//----- (00011DD6) --------------------------------------------------------

4422
4423
signed int __stdcall sub_11DD6(int a1, PUNICODE_STRING ValueName, int a3)

4424
4425
{

4426
4427
  PVOID v4; // edi@10

4428
4429
  signed int v5; // esi@14

4430
4431
  int v6; // eax@16

4432
4433
  int v7; // eax@17

4434
4435
  PVOID v8; // [sp-8h] [bp-34h]@7

4436
4437
  ULONG v9; // [sp-4h] [bp-30h]@7

4438
4439
  PVOID P; // [sp+10h] [bp-1Ch]@5

4440
4441
  ULONG ResultLength; // [sp+20h] [bp-Ch]@4

4442
4443
  NTSTATUS v12; // [sp+24h] [bp-8h]@5

4444
4445
4446
4447
  if ( !*(_BYTE *)a1

4448
4449
    || (ResultLength = 0,

4450
4451
        ZwQueryValueKey(*(HANDLE *)(a1 + 4), ValueName, KeyValuePartialInformation, 0, 0, &ResultLength) != -1073741789) )

4452
4453
    return -1073741823;

4454
4455
  v12 = 0;

4456
4457
  sub_105A0((int)&v12, ResultLength, (int)&P, 0);

4458
4459
  if ( v12 )

4460
4461
  {

4462
4463
    if ( !P )

4464
4465
      return v12;

4466
4467
    v9 = 0;

4468
4469
    v8 = P;

4470
4471
LABEL_8:

4472
4473
    ExFreePoolWithTag(v8, v9);

4474
4475
    return v12;

4476
4477
  }

4478
4479
  v4 = P;

4480
4481
  v12 = ZwQueryValueKey(*(HANDLE *)(a1 + 4), ValueName, KeyValuePartialInformation, P, ResultLength, &ResultLength);

4482
4483
  if ( v12 )

4484
4485
  {

4486
4487
    if ( !v4 )

4488
4489
      return v12;

4490
4491
    v9 = 0;

4492
4493
    v8 = v4;

4494
4495
    goto LABEL_8;

4496
4497
  }

4498
4499
  if ( *((_DWORD *)v4 + 1) == 3 )

4500
4501
  {

4502
4503
    v6 = (int)ExAllocatePool(0, 0x10u);

4504
4505
    if ( v6 )

4506
4507
    {

4508
4509
      v7 = sub_105A0((int)&v12, *((_DWORD *)v4 + 2), v6, (char *)v4 + 12);

4510
4511
      v4 = P;

4512
4513
    }

4514
4515
    else

4516
4517
    {

4518
4519
      v7 = 0;

4520
4521
    }

4522
4523
    sub_1076E(a3, (PVOID *)v7);

4524
4525
    v5 = 0;

4526
4527
    if ( v12 )

4528
4529
    {

4530
4531
      v5 = v12;

4532
4533
      goto LABEL_15;

4534
4535
    }

4536
4537
    if ( *(_DWORD *)(a3 + 4) )

4538
4539
      goto LABEL_15;

4540
4541
  }

4542
4543
  v5 = -1073741823;

4544
4545
LABEL_15:

4546
4547
  ExFreePoolWithTag(v4, 0);

4548
4549
  return v5;

4550
4551
}

4552
4553
4554
4555
//----- (00011EC6) --------------------------------------------------------

4556
4557
int __usercall sub_11EC6<eax>(char a1<al>, int a2<ecx>, unsigned int a3<esi>)

4558
4559
{

4560
4561
  unsigned int v3; // edx@2

4562
4563
  unsigned int v4; // eax@4

4564
4565
  int result; // eax@6

4566
4567
  char v7; // [sp+8h] [bp-10h]@1

4568
4569
  char v8; // [sp+Ch] [bp-Ch]@1

4570
4571
  signed int v9; // [sp+10h] [bp-8h]@1

4572
4573
  unsigned int v10; // [sp+14h] [bp-4h]@1

4574
4575
4576
4577
  v10 = a3 >> 1;

4578
4579
  v7 = a1 ^ 0xD;

4580
4581
  v8 = a1 ^ 0xEF;

4582
4583
  v9 = 7;

4584
4585
  do

4586
4587
  {

4588
4589
    v3 = 0;

4590
4591
    if ( a3 )

4592
4593
    {

4594
4595
      do

4596
4597
      {

4598
4599
        *(_BYTE *)(v3 + a2) ^= v9 * v8 + v3 * v7;

4600
4601
        ++v3;

4602
4603
      }

4604
4605
      while ( v3 < a3 );

4606
4607
    }

4608
4609
    v4 = 0;

4610
4611
    if ( v10 )

4612
4613
    {

4614
4615
      do

4616
4617
      {

4618
4619
        *(_BYTE *)(v4 + a2) ^= *(_BYTE *)(((a3 + 1) >> 1) + a2 + v4);

4620
4621
        ++v4;

4622
4623
      }

4624
4625
      while ( v4 < v10 );

4626
4627
    }

4628
4629
    for ( result = a3 - 1; (unsigned int)result >= 1; --result )

4630
4631
      *(_BYTE *)(result + a2) -= *(_BYTE *)(result + a2 - 1);

4632
4633
  }

4634
4635
  while ( v9-- - 1 >= 0 );

4636
4637
  return result;

4638
4639
}

4640
4641
4642
4643
//----- (00011F42) --------------------------------------------------------

4644
4645
int __stdcall sub_11F42(int a1, int a2, HANDLE Handle)

4646
4647
{

4648
4649
  int v3; // eax@2

4650
4651
  int v4; // ecx@3

4652
4653
  int v5; // eax@5

4654
4655
  char ProcessInformation; // [sp+Ch] [bp-34h]@2

4656
4657
  int v8; // [sp+10h] [bp-30h]@3

4658
4659
  CPPEH_RECORD ms_exc; // [sp+28h] [bp-18h]@2

4660
4661
4662
4663
  *(_DWORD *)a1 = 0;

4664
4665
  *(_BYTE *)(a1 + 4) = 1;

4666
4667
  if ( !*(_DWORD *)a2 )

4668
4669
  {

4670
4671
    ms_exc.disabled = 0;

4672
4673
    v3 = sub_12000(Handle, &ProcessInformation);

4674
4675
    *(_DWORD *)a2 = v3;

4676
4677
    if ( !v3 )

4678
4679
    {

4680
4681
      v4 = v8;

4682
4683
      if ( v8 && (v5 = *(_DWORD *)(v8 + 8)) != 0 )

4684
4685
      {

4686
4687
        *(_DWORD *)a1 = v5;

4688
4689
        *(_BYTE *)(a1 + 4) = *(_BYTE *)(v4 + 2) != 0;

4690
4691
      }

4692
4693
      else

4694
4695
      {

4696
4697
        *(_DWORD *)a2 = -1073741823;

4698
4699
      }

4700
4701
    }

4702
4703
    ms_exc.disabled = -1;

4704
4705
  }

4706
4707
  return a1;

4708
4709
}

4710
4711
4712
4713
//----- (00011FC0) --------------------------------------------------------

4714
4715
int __userpurge sub_11FC0<eax>(int a1<esi>, int a2, int a3)

4716
4717
{

4718
4719
  *(_BYTE *)a1 = 0;

4720
4721
  sub_12094(a1 + 4, a2, a3);

4722
4723
  memset((void *)(a1 + 12), 0, 0x18u);

4724
4725
  if ( !*(_DWORD *)a2 )

4726
4727
  {

4728
4729
    KeStackAttachProcess(*(_DWORD *)(a1 + 8), a1 + 12);

4730
4731
    *(_BYTE *)a1 = 1;

4732
4733
  }

4734
4735
  return a1;

4736
4737
}

4738
4739
// 12604: using guessed type int __stdcall KeStackAttachProcess(_DWORD, _DWORD);

4740
4741
4742
4743
//----- (00012000) --------------------------------------------------------

4744
4745
int __stdcall sub_12000(HANDLE Handle, PVOID ProcessInformation)

4746
4747
{

4748
4749
  int result; // eax@4

4750
4751
  NTSTATUS v3; // esi@5

4752
4753
  char v4; // [sp+10h] [bp-10h]@1

4754
4755
  PVOID Object; // [sp+14h] [bp-Ch]@3

4756
4757
  ULONG ReturnLength; // [sp+18h] [bp-8h]@6

4758
4759
  int v7; // [sp+1Ch] [bp-4h]@1

4760
4761
4762
4763
  v7 = 0;

4764
4765
  sub_12094((int)&v4, (int)&v7, (int)Handle);

4766
4767
  if ( v7 )

4768
4769
  {

4770
4771
    if ( v4 )

4772
4773
    {

4774
4775
      v4 = 0;

4776
4777
      ObfDereferenceObject(Object);

4778
4779
    }

4780
4781
    result = v7;

4782
4783
  }

4784
4785
  else

4786
4787
  {

4788
4789
    Handle = 0;

4790
4791
    v3 = ObOpenObjectByPointer(Object, 0, 0, 0, 0, 0, &Handle);

4792
4793
    if ( !v3 )

4794
4795
    {

4796
4797
      ReturnLength = 0;

4798
4799
      v3 = ZwQueryInformationProcess(Handle, 0, ProcessInformation, 0x18u, &ReturnLength);

4800
4801
    }

4802
4803
    if ( Handle )

4804
4805
      ZwClose(Handle);

4806
4807
    if ( v4 )

4808
4809
    {

4810
4811
      v4 = 0;

4812
4813
      ObfDereferenceObject(Object);

4814
4815
    }

4816
4817
    result = v3;

4818
4819
  }

4820
4821
  return result;

4822
4823
}

4824
4825
// 1260C: using guessed type int __stdcall ObOpenObjectByPointer(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD);

4826
4827
4828
4829
//----- (00012094) --------------------------------------------------------

4830
4831
int __userpurge sub_12094<eax>(int a1<ebx>, int a2<edi>, int a3)

4832
4833
{

4834
4835
  char v3; // zf@1

4836
4837
  int v4; // eax@2

4838
4839
4840
4841
  *(_DWORD *)(a1 + 4) = 0;

4842
4843
  v3 = *(_DWORD *)a2 == 0;

4844
4845
  *(_BYTE *)a1 = 0;

4846
4847
  if ( v3 )

4848
4849
  {

4850
4851
    v4 = PsLookupProcessByProcessId(a3, a1 + 4);

4852
4853
    *(_DWORD *)a2 = v4;

4854
4855
    if ( !v4 )

4856
4857
    {

4858
4859
      if ( *(_DWORD *)(a1 + 4) )

4860
4861
        *(_BYTE *)a1 = 1;

4862
4863
      else

4864
4865
        *(_DWORD *)a2 = -1073741823;

4866
4867
    }

4868
4869
  }

4870
4871
  return a1;

4872
4873
}

4874
4875
// 12610: using guessed type int __stdcall PsLookupProcessByProcessId(_DWORD, _DWORD);

4876
4877
4878
4879
//----- (000120CC) --------------------------------------------------------

4880
4881
LONG_PTR __usercall sub_120CC<eax>(PVOID Object<ecx>, LONG_PTR result<eax>)

4882
4883
{

4884
4885
  void *v2; // ecx@2

4886
4887
4888
4889
  if ( *(_BYTE *)result )

4890
4891
  {

4892
4893
    v2 = *(void **)(result + 4);

4894
4895
    *(_BYTE *)result = 0;

4896
4897
    result = ObfDereferenceObject(v2);

4898
4899
  }

4900
4901
  return result;

4902
4903
}

4904
4905
4906
4907
//----- (000120DE) --------------------------------------------------------

4908
4909
int __cdecl sub_120DE(int a1)

4910
4911
{

4912
4913
  int result; // eax@1

4914
4915
  int v2; // edx@1

4916
4917
  char v3; // cl@1

4918
4919
  int v4; // esi@2

4920
4921
4922
4923
  v2 = a1;

4924
4925
  v3 = *(_BYTE *)a1;

4926
4927
  for ( result = 0; *(_BYTE *)v2; result = v4 )

4928
4929
  {

4930
4931
    v4 = result * (7 * result + 1) + v3 * (17 * v3 + 12);

4932
4933
    ++v2;

4934
4935
    v3 = *(_BYTE *)v2;

4936
4937
  }

4938
4939
  return result;

4940
4941
}

4942
4943
4944
4945
//----- (0001210F) --------------------------------------------------------

4946
4947
int __cdecl sub_1210F(int a1, unsigned int a2)

4948
4949
{

4950
4951
  unsigned __int16 v2; // bx@1

4952
4953
  int v3; // edi@1

4954
4955
  int v4; // esi@1

4956
4957
  int v5; // eax@3

4958
4959
  unsigned int v6; // ecx@3

4960
4961
  int v7; // eax@5

4962
4963
  int result; // eax@8

4964
4965
  int v9; // [sp+14h] [bp+8h]@2

4966
4967
4968
4969
  v2 = *(_WORD *)(a1 + 24);

4970
4971
  v4 = *(_DWORD *)(a1 + 20);

4972
4973
  v3 = 0;

4974
4975
  if ( v2 <= 0u )

4976
4977
  {

4978
4979
LABEL_8:

4980
4981
    result = 0;

4982
4983
  }

4984
4985
  else

4986
4987
  {

4988
4989
    v9 = *(_DWORD *)(a1 + 8);

4990
4991
    while ( 1 )

4992
4993
    {

4994
4995
      v5 = v4 + 40 * (unsigned __int16)v3;

4996
4997
      v6 = *(_DWORD *)(v5 + 8);

4998
4999
      if ( v6 >= *(_DWORD *)(v5 + 16) )

5000
5001
        v6 = *(_DWORD *)(v5 + 16);

5002
5003
      v7 = v9 + *(_DWORD *)(v5 + 12);

5004
5005
      if ( a2 >= v7 )

5006
5007
      {

5008
5009
        if ( a2 < v6 + v7 )

5010
5011
          break;

5012
5013
      }

5014
5015
      ++v3;

5016
5017
      if ( (_WORD)v3 >= v2 )

5018
5019
        goto LABEL_8;

5020
5021
    }

5022
5023
    result = v4 + 40 * (unsigned __int16)v3;

5024
5025
  }

5026
5027
  return result;

5028
5029
}

5030
5031
5032
5033
//----- (0001216B) --------------------------------------------------------

5034
5035
signed int __usercall sub_1216B<eax>(int a1<eax>, unsigned int a2<ebx>)

5036
5037
{

5038
5039
  int v2; // esi@1

5040
5041
  signed int result; // eax@2

5042
5043
  int v4; // edi@3

5044
5045
  int v5; // eax@6

5046
5047
  unsigned int v6; // ecx@6

5048
5049
  unsigned int v7; // eax@8

5050
5051
  int v8; // esi@12

5052
5053
  unsigned __int16 v9; // [sp+4h] [bp-4h]@1

5054
5055
5056
5057
  v2 = *(_DWORD *)(a1 + 20);

5058
5059
  v9 = *(_WORD *)(a1 + 24);

5060
5061
  if ( a2 < *(_DWORD *)(a1 + 26) )

5062
5063
  {

5064
5065
    v4 = 0;

5066
5067
    if ( !*(_DWORD *)(a1 + 4) )

5068
5069
      goto LABEL_17;

5070
5071
    if ( *(_WORD *)(a1 + 24) <= 0u )

5072
5073
      goto LABEL_14;

5074
5075
    while ( 1 )

5076
5077
    {

5078
5079
      v5 = v2 + 40 * (unsigned __int16)v4;

5080
5081
      v6 = *(_DWORD *)(v5 + 8);

5082
5083
      if ( v6 >= *(_DWORD *)(v5 + 16) )

5084
5085
        v6 = *(_DWORD *)(v5 + 16);

5086
5087
      v7 = *(_DWORD *)(v5 + 12);

5088
5089
      if ( a2 >= v7 )

5090
5091
      {

5092
5093
        if ( a2 < v6 + v7 )

5094
5095
          break;

5096
5097
      }

5098
5099
      ++v4;

5100
5101
      if ( (_WORD)v4 >= v9 )

5102
5103
        goto LABEL_14;

5104
5105
    }

5106
5107
    v8 = *(_DWORD *)(40 * (unsigned __int16)v4 + v2 + 36);

5108
5109
    if ( v8 & 0x2000000 || !(v8 & 0x40000000) )

5110
5111
LABEL_14:

5112
5113
      result = 0;

5114
5115
    else

5116
5117
LABEL_17:

5118
5119
      result = 1;

5120
5121
  }

5122
5123
  else

5124
5125
  {

5126
5127
    result = 0;

5128
5129
  }

5130
5131
  return result;

5132
5133
}

5134
5135
5136
5137
//----- (000121E1) --------------------------------------------------------

5138
5139
signed int __cdecl sub_121E1(int a1, int a2, int a3)

5140
5141
{

5142
5143
  int v4; // eax@3

5144
5145
  unsigned __int16 v5; // cx@4

5146
5147
  int v6; // edx@7

5148
5149
  int v7; // ecx@7

5150
5151
  __int16 v8; // dx@12

5152
5153
5154
5155
  if ( *(_WORD *)a2 != 23117 || (v4 = a2 + *(_DWORD *)(a2 + 60), (*(_DWORD *)v4 ^ 0xF750F284) != -145705004) )

5156
5157
    return 1;

5158
5159
  v5 = *(_WORD *)(v4 + 4);

5160
5161
  if ( 22531 == (v5 ^ 0x594F) )

5162
5163
  {

5164
5165
    if ( (*(_WORD *)(v4 + 24) ^ 0x5908) == 22531 && *(_WORD *)(v4 + 20) == 224 )

5166
5167
    {

5168
5169
      v7 = a1;

5170
5171
      *(_DWORD *)a1 = 0;

5172
5173
      v6 = v4 + 120;

5174
5175
LABEL_12:

5176
5177
      *(_DWORD *)(v7 + 16) = v6;

5178
5179
      *(_DWORD *)(v7 + 26) = *(_DWORD *)(v4 + 80);

5180
5181
      *(_DWORD *)(v7 + 20) = *(_WORD *)(v4 + 20) + v4 + 24;

5182
5183
      v8 = *(_WORD *)(v4 + 6);

5184
5185
      *(_DWORD *)(v7 + 12) = v4;

5186
5187
      *(_DWORD *)(v7 + 4) = a3;

5188
5189
      *(_WORD *)(v7 + 24) = v8;

5190
5191
      *(_DWORD *)(v7 + 8) = a2;

5192
5193
      return 0;

5194
5195
    }

5196
5197
  }

5198
5199
  else

5200
5201
  {

5202
5203
    if ( 22531 == (v5 ^ 0xDE67) && (*(_WORD *)(v4 + 24) ^ 0x5A08) == 22531 && *(_WORD *)(v4 + 20) == 240 )

5204
5205
    {

5206
5207
      v7 = a1;

5208
5209
      *(_DWORD *)a1 = 1;

5210
5211
      v6 = v4 + 136;

5212
5213
      goto LABEL_12;

5214
5215
    }

5216
5217
  }

5218
5219
  return 1;

5220
5221
}

5222
5223
5224
5225
//----- (000122B3) --------------------------------------------------------

5226
5227
signed int __cdecl sub_122B3(int a1, unsigned int a2)

5228
5229
{

5230
5231
  signed int result; // eax@1

5232
5233
5234
5235
  result = sub_1216B(a1, a2);

5236
5237
  if ( result )

5238
5239
    result = a2 + *(_DWORD *)(a1 + 8);

5240
5241
  return result;

5242
5243
}

5244
5245
5246
5247
//----- (000122D0) --------------------------------------------------------

5248
5249
bool __cdecl sub_122D0(int a1, unsigned int a2, int a3, int a4)

5250
5251
{

5252
5253
  int v4; // esi@1

5254
5255
  bool result; // eax@2

5256
5257
  unsigned int v6; // eax@3

5258
5259
5260
5261
  v4 = *(_DWORD *)(a1 + 16) + 8 * a2;

5262
5263
  if ( a2 >= 0x10 )

5264
5265
    return 1;

5266
5267
  v6 = *(_DWORD *)v4;

5268
5269
  if ( *(_DWORD *)v4 )

5270
5271
  {

5272
5273
    if ( v6 + *(_DWORD *)(v4 + 4) > *(_DWORD *)(a1 + 26) )

5274
5275
      return 1;

5276
5277
    *(_DWORD *)a3 = sub_122B3(a1, *(_DWORD *)v4);

5278
5279
    *(_DWORD *)a4 = *(_DWORD *)(v4 + 4);

5280
5281
    result = *(_DWORD *)a3 == 0;

5282
5283
  }

5284
5285
  else

5286
5287
  {

5288
5289
    LOBYTE(v6) = *(_DWORD *)(v4 + 4) == v6;

5290
5291
    result = v6 + 1;

5292
5293
  }

5294
5295
  return result;

5296
5297
}

5298
5299
5300
5301
//----- (00012323) --------------------------------------------------------

5302
5303
signed int __usercall sub_12323<eax>(unsigned int a1<eax>, int a2, int a3, unsigned __int16 a4)

5304
5305
{

5306
5307
  signed int v4; // eax@1

5308
5309
  unsigned int v5; // esi@1

5310
5311
  unsigned int v6; // eax@3

5312
5313
  signed int result; // eax@4

5314
5315
5316
5317
  v5 = a1;

5318
5319
  v4 = sub_122B3(a2, *(_DWORD *)(a1 + 28));

5320
5321
  if ( !v4

5322
5323
    || (unsigned int)a4 >= *(_DWORD *)(v5 + 20)

5324
5325
    || (v6 = *(_DWORD *)(v4 + 4 * a4), !v6)

5326
5327
    || (result = sub_122B3(a2, v6), !result)

5328
5329
    || result >= v5 && result < a3 + v5 )

5330
5331
    result = 0;

5332
5333
  return result;

5334
5335
}

5336
5337
5338
5339
//----- (0001236B) --------------------------------------------------------

5340
5341
signed int __cdecl sub_1236B(int a1, int a2)

5342
5343
{

5344
5345
  unsigned int v2; // esi@1

5346
5347
  signed int result; // eax@2

5348
5349
  unsigned int v4; // edi@3

5350
5351
  unsigned int v5; // ebx@6

5352
5353
  int v6; // eax@7

5354
5355
  int v7; // [sp+4h] [bp-Ch]@1

5356
5357
  int v8; // [sp+8h] [bp-8h]@4

5358
5359
  int v9; // [sp+Ch] [bp-4h]@1

5360
5361
5362
5363
  v2 = 0;

5364
5365
  if ( sub_122D0(a1, 0, (int)&v9, (int)&v7) )

5366
5367
  {

5368
5369
    result = 0;

5370
5371
  }

5372
5373
  else

5374
5375
  {

5376
5377
    v4 = v9;

5378
5379
    v9 = sub_122B3(a1, *(_DWORD *)(v9 + 32));

5380
5381
    if ( v9 && (v8 = sub_122B3(a1, *(_DWORD *)(v4 + 36))) != 0 )

5382
5383
    {

5384
5385
      v5 = *(_DWORD *)(v4 + 24);

5386
5387
      if ( v5 )

5388
5389
      {

5390
5391
        do

5392
5393
        {

5394
5395
          v6 = sub_122B3(a1, *(_DWORD *)(v9 + 4 * v2));

5396
5397
          if ( !v6 )

5398
5399
            break;

5400
5401
          if ( sub_120DE(v6) == a2 )

5402
5403
            return sub_12323(v4, a1, v7, *(_WORD *)(v8 + 2 * v2));

5404
5405
          ++v2;

5406
5407
        }

5408
5409
        while ( v2 < v5 );

5410
5411
      }

5412
5413
      result = 0;

5414
5415
    }

5416
5417
    else

5418
5419
    {

5420
5421
      result = 0;

5422
5423
    }

5424
5425
  }

5426
5427
  return result;

5428
5429
}

5430
5431
5432
5433
//----- (00012A24) --------------------------------------------------------

5434
5435
signed int __usercall sub_12A24<eax>(int a1<esi>)

5436
5437
{

5438
5439
  int v1; // edi@1

5440
5441
  int (__stdcall *v2)(_DWORD); // ebx@1

5442
5443
  int v3; // eax@1

5444
5445
  int v4; // eax@1

5446
5447
  signed int result; // eax@2

5448
5449
5450
5451
  v1 = sub_12D71((void *)0x2B8);

5452
5453
  v2 = *(int (__stdcall **)(_DWORD))(v1 + 32);

5454
5455
  *(_BYTE *)a1 = 21;

5456
5457
  *(_DWORD *)(a1 + 1) = 57;

5458
5459
  *(_DWORD *)(a1 + 13) = sub_12D71((void *)0x652);

5460
5461
  *(_DWORD *)(a1 + 17) = sub_12D71((void *)0x686);

5462
5463
  *(_DWORD *)(a1 + 21) = *(_DWORD *)(v1 + 40);

5464
5465
  *(_DWORD *)(a1 + 25) = *(_DWORD *)(v1 + 24);

5466
5467
  *(_DWORD *)(a1 + 29) = *(_DWORD *)(v1 + 72);

5468
5469
  v3 = sub_12D71((void *)0x260);

5470
5471
  v4 = v2(v3);

5472
5473
  *(_DWORD *)(a1 + 33) = v4;

5474
5475
  if ( v4 )

5476
5477
  {

5478
5479
    *(_DWORD *)(a1 + 41) = 0;

5480
5481
    *(_DWORD *)(a1 + 45) = 0;

5482
5483
    *(_DWORD *)(a1 + 49) = 1;

5484
5485
    result = 0;

5486
5487
  }

5488
5489
  else

5490
5491
  {

5492
5493
    result = 1;

5494
5495
  }

5496
5497
  return result;

5498
5499
}

5500
5501
5502
5503
//----- (00012A95) --------------------------------------------------------

5504
5505
signed int __cdecl sub_12A95(int a1)

5506
5507
{

5508
5509
  signed int result; // eax@1

5510
5511
  int v2; // edi@1

5512
5513
  int v3; // eax@2

5514
5515
  int v4; // eax@2

5516
5517
  int v5; // ecx@4

5518
5519
  char v6; // [sp+Ch] [bp-84h]@4

5520
5521
  char v7; // [sp+4Ch] [bp-44h]@1

5522
5523
  int v8; // [sp+51h] [bp-3Fh]@2

5524
5525
  int v9; // [sp+55h] [bp-3Bh]@2

5526
5527
  int (__cdecl *v10)(char *); // [sp+88h] [bp-8h]@1

5528
5529
  int (__cdecl *v11)(char *, int); // [sp+8Ch] [bp-4h]@1

5530
5531
5532
5533
  v2 = *(_DWORD *)(a1 + 88);

5534
5535
  v11 = (int (__cdecl *)(char *, int))(v2 + 149 + *(_DWORD *)(v2 + 113));

5536
5537
  v10 = (int (__cdecl *)(char *))(v2 + 149 + *(_DWORD *)(v2 + 129));

5538
5539
  *(_WORD *)(v2 + 149) = 23117;

5540
5541
  *(_DWORD *)(v2 + 149 + *(_DWORD *)(v2 + 141)) = 17744;

5542
5543
  *(_WORD *)(v2 + 149 + *(_DWORD *)(v2 + 145)) = 267;

5544
5545
  result = sub_12A24((int)&v7);

5546
5547
  if ( !result )

5548
5549
  {

5550
5551
    v3 = *(_DWORD *)(v2 + 1);

5552
5553
    v8 = v2 + 149;

5554
5555
    v9 = v3;

5556
5557
    v4 = sub_12D71((void *)0x350);

5558
5559
    result = v11(&v7, v4);

5560
5561
    if ( !result )

5562
5563
    {

5564
5565
      result = sub_12A24((int)&v7);

5566
5567
      if ( !result )

5568
5569
      {

5570
5571
        v5 = *(_DWORD *)(a1 + 96);

5572
5573
        v9 = *(_DWORD *)(a1 + 104);

5574
5575
        v8 = v5;

5576
5577
        result = v11(&v7, (int)&v6);

5578
5579
        if ( !result )

5580
5581
        {

5582
5583
          result = v10(&v6);

5584
5585
          if ( result )

5586
5587
            result = ((int (*)(void))result)();

5588
5589
        }

5590
5591
      }

5592
5593
    }

5594
5595
  }

5596
5597
  return result;

5598
5599
}

5600
5601
5602
5603
//----- (00012D37) --------------------------------------------------------

5604
5605
bool __usercall sub_12D37<eax>(int a1<eax>, int a2)

5606
5607
{

5608
5609
  int (__stdcall *v2)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD); // ecx@1

5610
5611
  bool result; // eax@2

5612
5613
  int v4; // [sp+0h] [bp-4h]@1

5614
5615
5616
5617
  v2 = *(int (__stdcall **)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD))(a1 + 80);

5618
5619
  v4 = 0;

5620
5621
  if ( v2(*(_DWORD *)(a1 + 144), 2242560, a2, 40, a2, 40, &v4, 0) )

5622
5623
    result = v4 != 40;

5624
5625
  else

5626
5627
    result = 1;

5628
5629
  return result;

5630
5631
}

5632
5633
5634
5635
//----- (00012D71) --------------------------------------------------------

5636
5637
int __thiscall sub_12D71(void *this)

5638
5639
{

5640
5641
  return (int)((char *)this + 75412);

5642
5643
}

5644
5645
5646
5647
//----- (00013343) --------------------------------------------------------

5648
5649
signed int __usercall sub_13343<eax>(int a1<eax>, unsigned int a2)

5650
5651
{

5652
5653
  unsigned int v2; // edi@1

5654
5655
  int v4; // ecx@3

5656
5657
  unsigned int v5; // ebx@4

5658
5659
  int v6; // eax@7

5660
5661
  unsigned int v7; // edx@8

5662
5663
  int v8; // ecx@8

5664
5665
  unsigned int v9; // [sp+8h] [bp-4h]@1

5666
5667
5668
5669
  v9 = 0;

5670
5671
  LOWORD(v2) = *(_WORD *)(a1 + 24);

5672
5673
  if ( *(_DWORD *)a1 || (v4 = *(_DWORD *)(a1 + 12), *(_DWORD *)(v4 + 84) > a2) )

5674
5675
    return 2;

5676
5677
  v5 = *(_DWORD *)(a1 + 26);

5678
5679
  if ( !(*(_DWORD *)(a1 + 26) % *(_DWORD *)(v4 + 56)) && *(_WORD *)(v4 + 6) )

5680
5681
  {

5682
5683
    v2 = (unsigned __int16)v2;

5684
5685
    if ( !(_WORD)v2 )

5686
5687
      return 0;

5688
5689
    v6 = *(_DWORD *)(a1 + 20) + 16;

5690
5691
    while ( 1 )

5692
5693
    {

5694
5695
      v8 = *(_DWORD *)v6;

5696
5697
      v7 = *(_DWORD *)(v6 - 8);

5698
5699
      if ( *(_DWORD *)v6 >= v7 )

5700
5701
        v8 = *(_DWORD *)(v6 - 8);

5702
5703
      if ( v8 + *(_DWORD *)(v6 + 4) > a2 || v7 + *(_DWORD *)(v6 - 4) > v5 )

5704
5705
        break;

5706
5707
      v6 += 40;

5708
5709
      ++v9;

5710
5711
      if ( v9 >= v2 )

5712
5713
        return 0;

5714
5715
    }

5716
5717
  }

5718
5719
  return 2;

5720
5721
}

5722
5723
5724
5725
//----- (000133BF) --------------------------------------------------------

5726
5727
int __usercall sub_133BF<eax>(int a1<eax>, int a2, int a3)

5728
5729
{

5730
5731
  int result; // eax@1

5732
5733
  int v4; // ecx@1

5734
5735
  int v5; // ebx@2

5736
5737
  int v6; // esi@2

5738
5739
  int v7; // edx@3

5740
5741
  int v8; // ecx@5

5742
5743
  int i; // edi@5

5744
5745
5746
5747
  v4 = *(_DWORD *)(a1 + 20);

5748
5749
  result = *(_WORD *)(a1 + 24);

5750
5751
  if ( result )

5752
5753
  {

5754
5755
    v6 = v4 + 8;

5756
5757
    v5 = result;

5758
5759
    do

5760
5761
    {

5762
5763
      v7 = *(_DWORD *)v6;

5764
5765
      if ( *(_DWORD *)(v6 + 8) < *(_DWORD *)v6 )

5766
5767
        v7 = *(_DWORD *)(v6 + 8);

5768
5769
      v8 = *(_DWORD *)(a2 + 5) + *(_DWORD *)(v6 + 12);

5770
5771
      result = a3 + *(_DWORD *)(v6 + 4);

5772
5773
      for ( i = v7; i; ++v8 )

5774
5775
      {

5776
5777
        --i;

5778
5779
        *(_BYTE *)result++ = *(_BYTE *)v8;

5780
5781
      }

5782
5783
      v6 += 40;

5784
5785
      --v5;

5786
5787
    }

5788
5789
    while ( v5 );

5790
5791
  }

5792
5793
  return result;

5794
5795
}

5796
5797
5798
5799
//----- (00013409) --------------------------------------------------------

5800
5801
int __usercall sub_13409<eax>(int a1<eax>, int a2, int a3, int a4)

5802
5803
{

5804
5805
  unsigned int v4; // edi@1

5806
5807
5808
5809
  int v5; // eax@4

5810
5811
  char v6; // dl@4

5812
5813
  int v7; // ecx@4

5814
5815
  int v8; // esi@5

5816
5817
  int v10; // [sp+Ch] [bp-Ch]@2

5818
5819
  unsigned int v11; // [sp+10h] [bp-8h]@1

5820
5821
  int v12; // [sp+14h] [bp-4h]@2

5822
5823
5824
5825
  v4 = 0;

5826
5827
  v11 = *(_DWORD *)(a1 + 45);

5828
5829
  if ( v11 )

5830
5831
  {

5832
5833
    v10 = *(_DWORD *)(a1 + 41);

5834
5835
    v12 = *(_DWORD *)(a1 + 41);

5836
5837
    while ( 1 )

5838
5839
    {

5840
5841
      if ( !sub_13CC0(a2, *(_DWORD *)v12) )

5842
5843
      {

5844
5845
        v7 = *(_DWORD *)(v12 + 4);

5846
5847
        v6 = *(_BYTE *)v7;

5848
5849
        v5 = *(_BYTE *)a3 - *(_BYTE *)v7;

5850
5851
        if ( *(_BYTE *)a3 == *(_BYTE *)v7 )

5852
5853
        {

5854
5855
          v8 = a3 - v7;

5856
5857
          do

5858
5859
          {

5860
5861
            if ( !v6 )

5862
5863
              break;

5864
5865
            ++v7;

5866
5867
            v6 = *(_BYTE *)v7;

5868
5869
            v5 = *(_BYTE *)(v8 + v7) - *(_BYTE *)v7;

5870
5871
          }

5872
5873
          while ( *(_BYTE *)(v8 + v7) == *(_BYTE *)v7 );

5874
5875
        }

5876
5877
        if ( v5 >= 0 )

5878
5879
        {

5880
5881
          if ( v5 > 0 )

5882
5883
            v5 = 1;

5884
5885
          if ( !v5 )

5886
5887
            break;

5888
5889
        }

5890
5891
      }

5892
5893
      v12 += 12;

5894
5895
      ++v4;

5896
5897
      if ( v4 >= v11 )

5898
5899
        goto LABEL_13;

5900
5901
    }

5902
5903
    *(_DWORD *)a4 = *(_DWORD *)(12 * v4 + v10 + 8);

5904
5905
  }

5906
5907
  else

5908
5909
  {

5910
5911
LABEL_13:

5912
5913
    *(_DWORD *)a4 = 0;

5914
5915
  }

5916
5917
  return 0;

5918
5919
}

5920
5921
5922
5923
//----- (0001356E) --------------------------------------------------------

5924
5925
int __usercall sub_1356E<eax>(unsigned int *a1<eax>, int a2<ebx>, int a3<edi>, int a4, int a5, int a6)

5926
5927
{

5928
5929
  unsigned int v6; // eax@1

5930
5931
  int v7; // eax@2

5932
5933
  signed int v8; // eax@4

5934
5935
  int result; // eax@5

5936
5937
  int v10; // esi@6

5938
5939
  int v11; // eax@9

5940
5941
5942
5943
  v6 = *a1;

5944
5945
  if ( (signed int)v6 < 0 )

5946
5947
  {

5948
5949
    v7 = (unsigned __int16)v6;

5950
5951
    goto LABEL_9;

5952
5953
  }

5954
5955
  if ( !v6 || (v8 = sub_138BE(a4, v6), !v8) )

5956
5957
    return 4;

5958
5959
  v10 = v8 + 2;

5960
5961
  result = sub_13409(a2, a5, v8 + 2, a3);

5962
5963
  if ( result )

5964
5965
    return result;

5966
5967
  if ( !*(_DWORD *)a3 )

5968
5969
  {

5970
5971
    v7 = v10;

5972
5973
LABEL_9:

5974
5975
    v11 = (*(int (__stdcall **)(int, int))(a2 + 25))(a6, v7);

5976
5977
    *(_DWORD *)a3 = v11;

5978
5979
    if ( v11 )

5980
5981
      return 0;

5982
5983
    return 4;

5984
5985
  }

5986
5987
  return 0;

5988
5989
}

5990
5991
5992
5993
//----- (0001369C) --------------------------------------------------------

5994
5995
int __thiscall sub_1369C(void *this)

5996
5997
{

5998
5999
  return (int)((char *)this - 4116659);

6000
6001
}

6002
6003
6004
6005
//----- (000136F8) --------------------------------------------------------

6006
6007
signed int __cdecl sub_136F8(int a1, int a2, int a3)

6008
6009
{

6010
6011
  int v4; // eax@3

6012
6013
  unsigned __int16 v5; // cx@4

6014
6015
  int v6; // edx@7

6016
6017
  int v7; // ecx@7

6018
6019
  __int16 v8; // dx@12

6020
6021
6022
6023
  if ( *(_WORD *)a2 != 23117 || (v4 = a2 + *(_DWORD *)(a2 + 60), (*(_DWORD *)v4 ^ 0xF750F284) != -145705004) )

6024
6025
    return 1;

6026
6027
  v5 = *(_WORD *)(v4 + 4);

6028
6029
  if ( 22531 == (v5 ^ 0x594F) )

6030
6031
  {

6032
6033
    if ( (*(_WORD *)(v4 + 24) ^ 0x5908) == 22531 && *(_WORD *)(v4 + 20) == 224 )

6034
6035
    {

6036
6037
      v7 = a1;

6038
6039
      *(_DWORD *)a1 = 0;

6040
6041
      v6 = v4 + 120;

6042
6043
LABEL_12:

6044
6045
      *(_DWORD *)(v7 + 16) = v6;

6046
6047
      *(_DWORD *)(v7 + 26) = *(_DWORD *)(v4 + 80);

6048
6049
      *(_DWORD *)(v7 + 20) = *(_WORD *)(v4 + 20) + v4 + 24;

6050
6051
      v8 = *(_WORD *)(v4 + 6);

6052
6053
      *(_DWORD *)(v7 + 12) = v4;

6054
6055
      *(_DWORD *)(v7 + 4) = a3;

6056
6057
      *(_WORD *)(v7 + 24) = v8;

6058
6059
      *(_DWORD *)(v7 + 8) = a2;

6060
6061
      return 0;

6062
6063
    }

6064
6065
  }

6066
6067
  else

6068
6069
  {

6070
6071
    if ( 22531 == (v5 ^ 0xDE67) && (*(_WORD *)(v4 + 24) ^ 0x5A08) == 22531 && *(_WORD *)(v4 + 20) == 240 )

6072
6073
    {

6074
6075
      v7 = a1;

6076
6077
      *(_DWORD *)a1 = 1;

6078
6079
      v6 = v4 + 136;

6080
6081
      goto LABEL_12;

6082
6083
    }

6084
6085
  }

6086
6087
  return 1;

6088
6089
}

6090
6091
6092
6093
//----- (000138BE) --------------------------------------------------------

6094
6095
signed int __cdecl sub_138BE(int a1, unsigned int a2)

6096
6097
{

6098
6099
  signed int result; // eax@1

6100
6101
6102
6103
  result = sub_13B3A(a1, a2);

6104
6105
  if ( result )

6106
6107
    result = a2 + *(_DWORD *)(a1 + 8);

6108
6109
  return result;

6110
6111
}

6112
6113
6114
6115
//----- (000138DB) --------------------------------------------------------

6116
6117
bool __cdecl sub_138DB(int a1, unsigned int a2, int a3, int a4)

6118
6119
{

6120
6121
  int v4; // esi@1

6122
6123
  bool result; // eax@2

6124
6125
  unsigned int v6; // eax@3

6126
6127
6128
6129
  v4 = *(_DWORD *)(a1 + 16) + 8 * a2;

6130
6131
  if ( a2 >= 0x10 )

6132
6133
    return 1;

6134
6135
  v6 = *(_DWORD *)v4;

6136
6137
  if ( *(_DWORD *)v4 )

6138
6139
  {

6140
6141
    if ( v6 + *(_DWORD *)(v4 + 4) > *(_DWORD *)(a1 + 26) )

6142
6143
      return 1;

6144
6145
    *(_DWORD *)a3 = sub_138BE(a1, *(_DWORD *)v4);

6146
6147
    *(_DWORD *)a4 = *(_DWORD *)(v4 + 4);

6148
6149
    result = *(_DWORD *)a3 == 0;

6150
6151
  }

6152
6153
  else

6154
6155
  {

6156
6157
    LOBYTE(v6) = *(_DWORD *)(v4 + 4) == v6;

6158
6159
    result = v6 + 1;

6160
6161
  }

6162
6163
  return result;

6164
6165
}

6166
6167
6168
6169
//----- (0001392E) --------------------------------------------------------

6170
6171
int __cdecl sub_1392E(int a1)

6172
6173
{

6174
6175
  int result; // eax@1

6176
6177
  int v2; // edx@1

6178
6179
  char v3; // cl@1

6180
6181
  int v4; // esi@2

6182
6183
6184
6185
  v2 = a1;

6186
6187
  v3 = *(_BYTE *)a1;

6188
6189
  for ( result = 0; *(_BYTE *)v2; result = v4 )

6190
6191
  {

6192
6193
    v4 = result * (7 * result + 1) + v3 * (17 * v3 + 12);

6194
6195
    ++v2;

6196
6197
    v3 = *(_BYTE *)v2;

6198
6199
  }

6200
6201
  return result;

6202
6203
}

6204
6205
6206
6207
//----- (00013A4B) --------------------------------------------------------

6208
6209
signed int __usercall sub_13A4B<eax>(unsigned int a1<eax>, int a2, int a3, unsigned __int16 a4)

6210
6211
{

6212
6213
  signed int v4; // eax@1

6214
6215
  unsigned int v5; // esi@1

6216
6217
  unsigned int v6; // eax@3

6218
6219
  signed int result; // eax@4

6220
6221
6222
6223
  v5 = a1;

6224
6225
  v4 = sub_138BE(a2, *(_DWORD *)(a1 + 28));

6226
6227
  if ( !v4

6228
6229
    || (unsigned int)a4 >= *(_DWORD *)(v5 + 20)

6230
6231
    || (v6 = *(_DWORD *)(v4 + 4 * a4), !v6)

6232
6233
    || (result = sub_138BE(a2, v6), !result)

6234
6235
    || result >= v5 && result < a3 + v5 )

6236
6237
    result = 0;

6238
6239
  return result;

6240
6241
}

6242
6243
6244
6245
//----- (00013B3A) --------------------------------------------------------

6246
6247
signed int __usercall sub_13B3A<eax>(int a1<eax>, unsigned int a2<ebx>)

6248
6249
{

6250
6251
  int v2; // esi@1

6252
6253
  signed int result; // eax@2

6254
6255
  int v4; // edi@3

6256
6257
  int v5; // eax@6

6258
6259
  unsigned int v6; // ecx@6

6260
6261
  unsigned int v7; // eax@8

6262
6263
  int v8; // esi@12

6264
6265
  unsigned __int16 v9; // [sp+4h] [bp-4h]@1

6266
6267
6268
6269
  v2 = *(_DWORD *)(a1 + 20);

6270
6271
  v9 = *(_WORD *)(a1 + 24);

6272
6273
  if ( a2 < *(_DWORD *)(a1 + 26) )

6274
6275
  {

6276
6277
    v4 = 0;

6278
6279
    if ( !*(_DWORD *)(a1 + 4) )

6280
6281
      goto LABEL_17;

6282
6283
    if ( *(_WORD *)(a1 + 24) <= 0u )

6284
6285
      goto LABEL_14;

6286
6287
    while ( 1 )

6288
6289
    {

6290
6291
      v5 = v2 + 40 * (unsigned __int16)v4;

6292
6293
      v6 = *(_DWORD *)(v5 + 8);

6294
6295
      if ( v6 >= *(_DWORD *)(v5 + 16) )

6296
6297
        v6 = *(_DWORD *)(v5 + 16);

6298
6299
      v7 = *(_DWORD *)(v5 + 12);

6300
6301
      if ( a2 >= v7 )

6302
6303
      {

6304
6305
        if ( a2 < v6 + v7 )

6306
6307
          break;

6308
6309
      }

6310
6311
      ++v4;

6312
6313
      if ( (_WORD)v4 >= v9 )

6314
6315
        goto LABEL_14;

6316
6317
    }

6318
6319
    v8 = *(_DWORD *)(40 * (unsigned __int16)v4 + v2 + 36);

6320
6321
    if ( v8 & 0x2000000 || !(v8 & 0x40000000) )

6322
6323
LABEL_14:

6324
6325
      result = 0;

6326
6327
    else

6328
6329
LABEL_17:

6330
6331
      result = 1;

6332
6333
  }

6334
6335
  else

6336
6337
  {

6338
6339
    result = 0;

6340
6341
  }

6342
6343
  return result;

6344
6345
}

6346
6347
6348
6349
//----- (00013BF1) --------------------------------------------------------

6350
6351
int __usercall sub_13BF1<eax>(unsigned int a1<eax>, int a2<ecx>, int a3, int a4, int a5)

6352
6353
{

6354
6355
  int v5; // ecx@1

6356
6357
  int v6; // edi@1

6358
6359
  int v7; // esi@1

6360
6361
  int result; // eax@2

6362
6363
  int v9; // eax@4

6364
6365
  int v10; // ebx@4

6366
6367
  unsigned int v11; // [sp+Ch] [bp-4h]@1

6368
6369
6370
6371
  v6 = a2 + 4;

6372
6373
  v5 = a2 + a1 - 13;

6374
6375
  v7 = a1 - 4;

6376
6377
  v11 = v5;

6378
6379
  if ( a1 >= 0xD )

6380
6381
  {

6382
6383
    if ( v6 <= (unsigned int)v5 )

6384
6385
    {

6386
6387
      do

6388
6389
      {

6390
6391
        v9 = v7 + v6 - 4;

6392
6393
        v10 = v6;

6394
6395
        if ( v6 > (unsigned int)v9 )

6396
6397
        {

6398
6399
LABEL_7:

6400
6401
          v10 = 0;

6402
6403
        }

6404
6405
        else

6406
6407
        {

6408
6409
          while ( *(_DWORD *)v10 != a3 )

6410
6411
          {

6412
6413
            ++v10;

6414
6415
            if ( v10 > (unsigned int)v9 )

6416
6417
              goto LABEL_7;

6418
6419
          }

6420
6421
        }

6422
6423
        if ( !v10 || v10 - 4 > v11 )

6424
6425
          break;

6426
6427
        if ( sub_13C66(a5, a4, v10 - 4, 0xDu) )

6428
6429
          return v10 - 4;

6430
6431
        v7 = v7 + v6 - v10 - 1;

6432
6433
        v6 = v10 + 1;

6434
6435
      }

6436
6437
      while ( v10 + 1 <= v11 );

6438
6439
    }

6440
6441
    result = 0;

6442
6443
  }

6444
6445
  else

6446
6447
  {

6448
6449
    result = 0;

6450
6451
  }

6452
6453
  return result;

6454
6455
}

6456
6457
6458
6459
//----- (00013C66) --------------------------------------------------------

6460
6461
signed int __usercall sub_13C66<eax>(int a1<eax>, int a2<edx>, int a3<ecx>, unsigned int a4)

6462
6463
{

6464
6465
  unsigned int v4; // edi@1

6466
6467
  int v5; // ecx@2

6468
6469
  int v6; // esi@2

6470
6471
  signed int result; // eax@5

6472
6473
6474
6475
  v4 = 0;

6476
6477
  if ( a4 )

6478
6479
  {

6480
6481
    v5 = a3 - a1;

6482
6483
    v6 = a2 - a1;

6484
6485
    while ( (*(_BYTE *)a1 & *(_BYTE *)(v5 + a1)) == *(_BYTE *)(v6 + a1) )

6486
6487
    {

6488
6489
      ++v4;

6490
6491
      ++a1;

6492
6493
      if ( v4 >= a4 )

6494
6495
        goto LABEL_5;

6496
6497
    }

6498
6499
    result = 0;

6500
6501
  }

6502
6503
  else

6504
6505
  {

6506
6507
LABEL_5:

6508
6509
    result = 1;

6510
6511
  }

6512
6513
  return result;

6514
6515
}

6516
6517
6518
6519
//----- (00013C92) --------------------------------------------------------

6520
6521
int __cdecl sub_13C92(int a1, char a2, int a3)

6522
6523
{

6524
6525
  int v3; // eax@2

6526
6527
  int v5; // [sp+0h] [bp-4h]@1

6528
6529
6530
6531
  v5 = a1;

6532
6533
  while ( 1 )

6534
6535
  {

6536
6537
    v3 = a3--;

6538
6539
    if ( !v3 )

6540
6541
      break;

6542
6543
    *(_BYTE *)a1++ = a2;

6544
6545
  }

6546
6547
  return v5;

6548
6549
}

6550
6551
6552
6553
//----- (00013CC0) --------------------------------------------------------

6554
6555
int __usercall sub_13CC0<eax>(int a1<eax>, int a2<edx>)

6556
6557
{

6558
6559
  int v2; // esi@1

6560
6561
  int v3; // eax@2

6562
6563
  int v4; // ecx@4

6564
6565
6566
6567
  v2 = a1;

6568
6569
  do

6570
6571
  {

6572
6573
    v3 = *(_BYTE *)v2++;

6574
6575
    if ( (unsigned int)(v3 - 65) <= 0x19 )

6576
6577
      v3 += 32;

6578
6579
    v4 = *(_BYTE *)a2++;

6580
6581
    if ( (unsigned int)(v4 - 65) <= 0x19 )

6582
6583
      v4 += 32;

6584
6585
  }

6586
6587
  while ( v3 && v3 == v4 );

6588
6589
  return v3 - v4;

6590
6591
}

6592
6593
6594
6595
//----- (00013D8E) --------------------------------------------------------

6596
6597
signed int __usercall sub_13D8E<eax>(int a1<eax>, int a2, int a3, unsigned int a4, int (__cdecl *a5)(_DWORD, _DWORD, _DWORD))

6598
6599
{

6600
6601
  unsigned int v5; // ebx@1

6602
6603
  int v6; // esi@2

6604
6605
  int v7; // eax@5

6606
6607
  signed int result; // eax@9

6608
6609
6610
6611
  v5 = 0;

6612
6613
  if ( a4 )

6614
6615
  {

6616
6617
    v6 = a1 + 8;

6618
6619
    while ( 1 )

6620
6621
    {

6622
6623
      if ( (*(_DWORD *)(v6 + 28) & 0x60000020) == 1610612768 )

6624
6625
      {

6626
6627
        if ( !(*(_DWORD *)(v6 + 28) & 0x2000000) )

6628
6629
        {

6630
6631
          v7 = *(_DWORD *)v6;

6632
6633
          if ( *(_DWORD *)v6 >= *(_DWORD *)(v6 + 8) )

6634
6635
            v7 = *(_DWORD *)(v6 + 8);

6636
6637
          if ( a5(*(_DWORD *)(a2 + 33) + *(_DWORD *)(v6 + 4), v7, a3) )

6638
6639
            break;

6640
6641
        }

6642
6643
      }

6644
6645
      ++v5;

6646
6647
      v6 += 40;

6648
6649
      if ( v5 >= a4 )

6650
6651
        goto LABEL_9;

6652
6653
    }

6654
6655
    result = 1;

6656
6657
  }

6658
6659
  else

6660
6661
  {

6662
6663
LABEL_9:

6664
6665
    result = 0;

6666
6667
  }

6668
6669
  return result;

6670
6671
}
        

    


            


                                


        

            



                
    

        Public Pastes
    

    
            

    

                    

        

    





    


    
    
    
    
    
    
    
    




    


    



                

            We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.             OK, I Understand
        

    
                

            

                
                    
                
            

            

                Not a member of Pastebin yet?

                Sign Up, it unlocks many cool features!