SafeAPI.c

/* This file was generated by the Hex-Rays decompiler.
   Copyright (c) 2007-2020 Hex-Rays <info@hex-rays.com>

   Detected compiler: Visual C++
*/

#include <windows.h>
#include <defs.h>


//-------------------------------------------------------------------------
// Function declarations

#define __thiscall __cdecl // Test compile in C mode

CSafeAPI *__thiscall CSafeAPI::CSafeAPI(CSafeAPI *this);
BOOL __thiscall CSafeAPI::Init(CSafeAPI *this, const char *lpLibFileName);
void __thiscall CSafeAPI::Close(CSafeAPI *__hidden this); // idb
HINSTANCE __thiscall CSafeAPI::GetModule(CSafeAPI *__hidden this); // idb
BOOL __thiscall CSafeAPI::LoadDLL(CSafeAPI *this, const char *a2);
void __cdecl DeleteTempSafeDll(); // idb
unsigned int __cdecl myStrlenA(char *); // idb
BOOL __cdecl myStrcmpA(char *a1, char *a2);
char __cdecl readPEInfo(char *a1, struct MZHeader *a2, struct PE_Header *a3, struct PE_ExtHeader *a4, struct SectionHeader **a5);
void __cdecl getKern32AndNtdllAddr(unsigned int *, unsigned int *); // idb
unsigned int __cdecl calcTotalImageSize(struct MZHeader *a1, struct PE_Header *a2, struct PE_ExtHeader *a3, struct SectionHeader *a4);
unsigned int __cdecl getAlignedSize(unsigned int, unsigned int); // idb
char __cdecl loadPE(char *a1, struct MZHeader *a2, struct PE_Header *a3, struct PE_ExtHeader *a4, struct SectionHeader *a5, void *a6);
BOOL __cdecl isStrDifferenti(char *a1, char *a2);
int __cdecl loadDLL(char *a1);
// HMODULE __stdcall LoadLibraryExA(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags);
// BOOL __stdcall CloseHandle(HANDLE hObject);
// BOOL __stdcall WriteFile(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped);
// DWORD __stdcall SetFilePointer(HANDLE hFile, LONG lDistanceToMove, PLONG lpDistanceToMoveHigh, DWORD dwMoveMethod);
// BOOL __stdcall ReadFile(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped);
// HANDLE __stdcall CreateFileA(LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile);
// BOOL __stdcall CopyFileA(LPCSTR lpExistingFileName, LPCSTR lpNewFileName, BOOL bFailIfExists);
// UINT __stdcall GetTempFileNameA(LPCSTR lpPathName, LPCSTR lpPrefixString, UINT uUnique, LPSTR lpTempFileName);
// DWORD __stdcall GetTempPathA(DWORD nBufferLength, LPSTR lpBuffer);
// UINT __stdcall GetSystemDirectoryA(LPSTR lpBuffer, UINT uSize);
// BOOL __stdcall HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem);
// HANDLE __stdcall GetProcessHeap();
// BOOL __stdcall DeleteFileA(LPCSTR lpFileName);
// BOOL __stdcall FreeLibrary(HMODULE hLibModule);
// BOOL __stdcall FindClose(HANDLE hFindFile);
// BOOL __stdcall FindNextFileA(HANDLE hFindFile, LPWIN32_FIND_DATAA lpFindFileData);
// HANDLE __stdcall FindFirstFileA(LPCSTR lpFileName, LPWIN32_FIND_DATAA lpFindFileData);
// char *__cdecl _Dect1(char *); idb
// LPVOID __stdcall HeapAlloc(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes);
// BOOL __stdcall GetFileInformationByHandle(HANDLE hFile, LPBY_HANDLE_FILE_INFORMATION lpFileInformation);

//-------------------------------------------------------------------------
// Data declarations

unsigned int g_CS2array17; // weak
unsigned int g_CS2array12 = 255u; // weak
unsigned int g_CS2array0 = 300u; // weak
char `string' = '\x01'; // idb


//----- (00000024) --------------------------------------------------------
CSafeAPI *__thiscall CSafeAPI::CSafeAPI(CSafeAPI *this)
{
  CSafeAPI *result; // eax

  result = this;
  *(_DWORD *)this = 0;
  *((_BYTE *)this + 4) = 0;
  return result;
}

//----- (00000044) --------------------------------------------------------
BOOL __thiscall CSafeAPI::Init(CSafeAPI *this, const char *lpLibFileName)
{
  HANDLE v3; // eax
  void *v4; // edi
  void (__stdcall *v5)(HANDLE, LONG, PLONG, DWORD); // ebp
  HMODULE (__stdcall *v6)(LPCSTR, HANDLE, DWORD); // edi
  HMODULE v7; // eax
  HMODULE v9; // eax
  DWORD NumberOfBytesRead; // [esp+Ch] [ebp-240h] BYREF
  __int16 v11[30]; // [esp+10h] [ebp-23Ch] BYREF
  LONG lDistanceToMove; // [esp+4Ch] [ebp-200h]
  int v13[13]; // [esp+50h] [ebp-1FCh] BYREF
  unsigned int v14; // [esp+84h] [ebp-1C8h]
  CHAR Buffer[260]; // [esp+148h] [ebp-104h] BYREF

  if ( *(_DWORD *)this )
    CSafeAPI::Close(this);
  GetSystemDirectoryA(Buffer, 0x104u);
  strcat(Buffer, "\\");
  strcat(Buffer, lpLibFileName);
  GetTempPathA(0x104u, (LPSTR)this + 4);
  GetTempFileNameA((LPCSTR)this + 4, "np", 0, (LPSTR)this + 4);
  CopyFileA(Buffer, (LPCSTR)this + 4, 0);
  v3 = CreateFileA((LPCSTR)this + 4, 0xC0000000, 3u, 0, 3u, 0x80u, 0);
  v4 = v3;
  if ( v3 != (HANDLE)-1 )
  {
    ReadFile(v3, v11, 0x40u, &NumberOfBytesRead, 0);
    if ( v11[0] == 23117 )
    {
      v5 = (void (__stdcall *)(HANDLE, LONG, PLONG, DWORD))SetFilePointer;
      SetFilePointer(v4, lDistanceToMove, 0, 0);
      ReadFile(v4, v13, 0xF8u, &NumberOfBytesRead, 0);
      if ( v13[0] == 17744 && v14 > 0x80000000 )
      {
        v14 = 0x10000000;
        v5(v4, lDistanceToMove, 0, 0);
        WriteFile(v4, v13, 0xF8u, &NumberOfBytesRead, 0);
      }
    }
    CloseHandle(v4);
  }
  v6 = LoadLibraryExA;
  v7 = LoadLibraryExA((LPCSTR)this + 4, 0, 8u);
  *(_DWORD *)this = v7;
  if ( v7 )
    return 1;
  *((_BYTE *)this + 4) = 0;
  v9 = v6(lpLibFileName, 0, 8u);
  *(_DWORD *)this = v9;
  return v9 != 0;
}

//----- (0000020C) --------------------------------------------------------
void __thiscall CSafeAPI::Close(CSafeAPI *this)
{
  HANDLE v2; // eax
  HMODULE v3; // [esp-8h] [ebp-Ch]

  if ( *(_DWORD *)this )
  {
    v3 = *(HMODULE *)this;
    if ( *((_BYTE *)this + 4) )
    {
      FreeLibrary(*(HMODULE *)this);
      DeleteFileA((LPCSTR)this + 4);
    }
    else
    {
      v2 = GetProcessHeap();
      HeapFree(v2, 0, v3);
    }
    *(_DWORD *)this = 0;
  }
}

//----- (0000025C) --------------------------------------------------------
HINSTANCE __thiscall CSafeAPI::GetModule(CSafeAPI *this)
{
  return *(HINSTANCE *)this;
}

//----- (0000026C) --------------------------------------------------------
BOOL __thiscall CSafeAPI::LoadDLL(CSafeAPI *this, const char *a2)
{
  int v3; // eax

  v3 = loadDLL((char *)a2);
  *(_DWORD *)this = v3;
  return v3 != 0;
}

//----- (0000028C) --------------------------------------------------------
void __cdecl DeleteTempSafeDll()
{
  HANDLE v0; // ebx
  void (__stdcall *v1)(LPCSTR); // ebp
  CHAR FileName[260]; // [esp+Ch] [ebp-348h] BYREF
  CHAR Buffer[260]; // [esp+110h] [ebp-244h] BYREF
  struct _WIN32_FIND_DATAA FindFileData; // [esp+214h] [ebp-140h] BYREF

  GetTempPathA(0x104u, Buffer);
  strcpy(FileName, Buffer);
  strcat(FileName, _Dect1(&`string'));
  v0 = FindFirstFileA(FileName, &FindFileData);
  if ( v0 != (HANDLE)-1 )
  {
    v1 = (void (__stdcall *)(LPCSTR))DeleteFileA;
    g_CS2array12 = -531212545;
    g_CS2array0 = 1481703285;
    g_CS2array17 = -1946658992;
    do
    {
      strcpy(FileName, Buffer);
      strcat(FileName, FindFileData.cFileName);
      v1(FileName);
    }
    while ( FindNextFileA(v0, &FindFileData) );
    FindClose(v0);
  }
}
// 0: using guessed type unsigned int g_CS2array17;
// 8: using guessed type unsigned int g_CS2array12;
// C: using guessed type unsigned int g_CS2array0;

//----- (000003E8) --------------------------------------------------------
unsigned int __cdecl myStrlenA(char *a1)
{
  char *v1; // ecx
  unsigned int result; // eax
  char v3; // dl

  v1 = a1;
  result = 0;
  if ( *a1 )
  {
    do
    {
      v3 = v1[1];
      ++result;
      ++v1;
    }
    while ( v3 );
  }
  return result;
}

//----- (00000408) --------------------------------------------------------
BOOL __cdecl myStrcmpA(char *a1, char *a2)
{
  char *v2; // ecx
  char i; // al
  char v5; // cl
  char v6; // al

  v2 = a1;
  for ( i = *a1; i; ++a2 )
  {
    if ( !*a2 )
      break;
    if ( i != *a2 )
      return 0;
    i = *++v2;
  }
  v5 = *v2;
  v6 = *a2;
  if ( v5 )
  {
    if ( !v6 )
      return 0;
  }
  else if ( !v6 )
  {
    return 1;
  }
  return v5 != 0;
}

//----- (00000458) --------------------------------------------------------
char __cdecl readPEInfo(char *a1, struct MZHeader *a2, struct PE_Header *a3, struct PE_ExtHeader *a4, struct SectionHeader **a5)
{
  char *v6; // eax

  if ( *(_WORD *)a1 != 23117 )
    return 0;
  v6 = &a1[*((_DWORD *)a1 + 15)];
  if ( *((_WORD *)v6 + 10) != 224 )
    return 0;
  qmemcpy(a2, a1, 0x40u);
  qmemcpy(a3, v6, 0x18u);
  qmemcpy(a4, v6 + 24, 0xE0u);
  *a5 = (struct SectionHeader *)(v6 + 248);
  return 1;
}

//----- (000004B8) --------------------------------------------------------
void __cdecl getKern32AndNtdllAddr(unsigned int *a1, unsigned int *a2)
{
  unsigned int *v2; // eax

  v2 = (unsigned int *)*((_DWORD *)NtCurrentPeb()->ImageBaseAddress + 7);
  *a2 = v2[2];
  *a1 = *(_DWORD *)(*v2 + 8);
}

//----- (000004E8) --------------------------------------------------------
unsigned int __cdecl calcTotalImageSize(struct MZHeader *a1, struct PE_Header *a2, struct PE_ExtHeader *a3, struct SectionHeader *a4)
{
  unsigned int v4; // esi
  unsigned int v5; // edi
  int v6; // ebp
  unsigned int *v7; // ebx
  unsigned int v8; // ecx

  v4 = *((_DWORD *)a3 + 15);
  v5 = *((_DWORD *)a3 + 8);
  if ( v4 % v5 )
    v4 = v5 * (v4 / v5 + 1);
  if ( !*((_WORD *)a2 + 3) )
    return v4;
  v6 = *((unsigned __int16 *)a2 + 3);
  v7 = (unsigned int *)((char *)a4 + 8);
  do
  {
    v8 = *v7;
    if ( *v7 )
    {
      if ( v8 % v5 )
        v4 += v5 * (v8 / v5 + 1);
      else
        v4 += v8;
    }
    v7 += 10;
    --v6;
  }
  while ( v6 );
  return v4;
}

//----- (00000558) --------------------------------------------------------
unsigned int __cdecl getAlignedSize(unsigned int a1, unsigned int a2)
{
  unsigned int result; // eax

  result = a1;
  if ( a1 % a2 )
    result = a2 * (a1 / a2 + 1);
  return result;
}

//----- (00000578) --------------------------------------------------------
char __cdecl loadPE(char *a1, struct MZHeader *a2, struct PE_Header *a3, struct PE_ExtHeader *a4, struct SectionHeader *a5, void *a6)
{
  char *v6; // ebp
  unsigned int *v7; // ebx
  unsigned int v8; // ecx
  char *v10; // [esp+28h] [ebp+18h]

  qmemcpy(a6, a1, *((_DWORD *)a4 + 15));
  v6 = (char *)a6 + getAlignedSize(*((_DWORD *)a4 + 15), *((_DWORD *)a4 + 8));
  v10 = 0;
  if ( *((_WORD *)a3 + 3) )
  {
    v7 = (unsigned int *)((char *)a5 + 8);
    do
    {
      v8 = v7[2];
      if ( v8 )
      {
        if ( v8 > *v7 )
          v8 = *v7;
        qmemcpy(v6, &a1[v7[3]], v8);
        v6 += getAlignedSize(*v7, *((_DWORD *)a4 + 8));
      }
      v7 += 10;
      ++v10;
    }
    while ( (int)v10 < *((unsigned __int16 *)a3 + 3) );
  }
  return 1;
}

//----- (00000628) --------------------------------------------------------
BOOL __cdecl isStrDifferenti(char *a1, char *a2)
{
  char *v2; // edx
  char i; // al
  char v5; // cl
  char v6; // cl

  v2 = a1;
  for ( i = *a1; i; ++a2 )
  {
    v5 = *a2;
    if ( !*a2 )
      break;
    if ( i != v5 )
    {
      if ( i < 97 || i > 122 )
      {
        if ( v5 < 97 || v5 > 122 || v5 - 32 != i )
          return 1;
      }
      else if ( i - 32 != v5 )
      {
        return 1;
      }
    }
    i = *++v2;
  }
  v6 = *a2;
  if ( *v2 )
  {
    if ( !v6 )
      return 1;
  }
  else if ( !v6 )
  {
    return 0;
  }
  return !*v2;
}

//----- (000006A8) --------------------------------------------------------
int __cdecl loadDLL(char *a1)
{
  unsigned int v1; // esi
  HANDLE v3; // eax
  void *v4; // edi
  HANDLE (__stdcall *v5)(); // ebx
  HANDLE v6; // eax
  LPVOID (__stdcall *v7)(HANDLE, DWORD, SIZE_T); // ebp
  char *v8; // esi
  HANDLE v9; // eax
  void *v10; // eax
  HANDLE v11; // eax
  DWORD v12; // [esp-Ch] [ebp-298h]
  unsigned int v13; // [esp-Ch] [ebp-298h]
  struct SectionHeader *v14; // [esp+8h] [ebp-284h] BYREF
  void *v15; // [esp+Ch] [ebp-280h]
  DWORD nNumberOfBytesToRead; // [esp+10h] [ebp-27Ch]
  DWORD NumberOfBytesRead; // [esp+14h] [ebp-278h] BYREF
  char v18[24]; // [esp+18h] [ebp-274h] BYREF
  char v19[64]; // [esp+30h] [ebp-25Ch] BYREF
  struct _BY_HANDLE_FILE_INFORMATION FileInformation; // [esp+70h] [ebp-21Ch] BYREF
  CHAR Buffer[264]; // [esp+A4h] [ebp-1E8h] BYREF
  char v22[224]; // [esp+1ACh] [ebp-E0h] BYREF

  v15 = 0;
  GetSystemDirectoryA(Buffer, 0x104u);
  v1 = myStrlenA(a1);
  if ( myStrlenA(Buffer) + v1 >= 0x104 )
    return 0;
  strcat(Buffer, "\\");
  strcat(Buffer, a1);
  v3 = CreateFileA(Buffer, 0x80000000, 1u, 0, 3u, 0, 0);
  v4 = v3;
  if ( v3 != (HANDLE)-1 )
  {
    GetFileInformationByHandle(v3, &FileInformation);
    nNumberOfBytesToRead = FileInformation.nFileSizeLow;
    if ( FileInformation.nFileSizeLow )
    {
      v5 = GetProcessHeap;
      v12 = FileInformation.nFileSizeLow;
      v6 = GetProcessHeap();
      v7 = HeapAlloc;
      v8 = (char *)HeapAlloc(v6, 0, v12);
      if ( v8 )
      {
        if ( ReadFile(v4, v8, nNumberOfBytesToRead, &NumberOfBytesRead, 0)
          && NumberOfBytesRead == nNumberOfBytesToRead
          && readPEInfo(v8, (struct MZHeader *)v19, (struct PE_Header *)v18, (struct PE_ExtHeader *)v22, &v14) )
        {
          v13 = calcTotalImageSize((struct MZHeader *)v19, (struct PE_Header *)v18, (struct PE_ExtHeader *)v22, v14);
          v9 = v5();
          v10 = v7(v9, 0, v13);
          v15 = v10;
          if ( v10 )
            loadPE(v8, (struct MZHeader *)v19, (struct PE_Header *)v18, (struct PE_ExtHeader *)v22, v14, v10);
        }
        v11 = v5();
        HeapFree(v11, 0, v8);
      }
    }
    CloseHandle(v4);
  }
  return (int)v15;
}

// nfuncs=36 queued=15 decompiled=15 lumina nreq=0 worse=0 better=0
// ALL OK, 15 function(s) have been successfully decompiled