IMPORTANT
This article was translated into English by ChatGPT and may contain errors. For the most accurate and complete experience, please refer to the original Chinese version.

Challenge TeaGod.exe(100)：#

/worship

✨ Devout Worship ✨.

PGpenguin72 (Tea God worshipper) offers their sincere respects to the greatest and cutest Lady Tea God!

Cumulative worship count / Current streak: 666 times / 666 days

TeaGod Avatar

File：
Originally uploaded challenge file: TeaGod.exe

The correct file that should have been uploaded: TeaGod.exe

Challenge Design Inspiration:#

This challenge pays tribute to a Discord bot in our THJCC server, “Leader of the Greatest and Cutest Tea God Sister Church” (I forgot who made this bot). But most importantly, I just wanted to worship the Tea God (Lemon Tea).

I came up with this challenge because I wanted to make something like malware that would keep spawning pop-up windows. So I told ChatGPT about the idea, and it helped me build this Windows program.

But I uploaded the wrong file to CTFd—the one meant for internal testing—so this challenge became super easy (though it would have been very easy for AI to solve anyway==).

Solution:#

Method 1#

Download and open the file, and you will see this: Worship the Tea God Then just click the button once, and you will solve it: Reward

Flag:
THJCC{h77p5://p4s73b1n.com/R58uv133}

Method 2#

Okay, Method 1 really was not my intended solution, so here is the approach I actually expected: Method 2.

Load it into Ghidra and reverse it:


659 collapsed lines
1
#include "out.h"
2

3

4
undefined4 DAT_1400080fc;
5
char DAT_140008070;
6
undefined8 DAT_140008068;
7
undefined4 DAT_140008058;
8
undefined8 DAT_140008060;
9
int DAT_140008054;
10
undefined FUN_1400033b0;
11
undefined FUN_140003580;
12
void *DAT_140008118;
13
int DAT_140008110;
14
LPTOP_LEVEL_EXCEPTION_FILTER DAT_140008100;
15
undefined4 DAT_1400080ec;
16
undefined4 DAT_1400080f0;
17
undefined4 DAT_1400080f4;
18
int DAT_1400080fc;
19
undefined4 DAT_140008128;
20
undefined4 DAT_140008120;
21
int DAT_140008018;
22
int DAT_140008000;
23
undefined4 DAT_14000812c;
24
uint DAT_140008124;
25
undefined DAT_1400013d0;
26
undefined DAT_140006460;
27
void *StackBase;
28
undefined DAT_140006468;
29
undefined8 DAT_140006480;
30
undefined8 DAT_140006488;
31
HWND DAT_1400080c0;
32
undefined FUN_1400017a0;
33
undefined FUN_140001d50;
34
undefined FUN_1400026c0;
35
longlong DAT_140008080;
36
undefined8 DAT_140008078;
37
undefined4 DAT_1400080c8;
38
undefined DAT_140005148;
39
longlong *DAT_140008078;
40
longlong *DAT_140008080;
41
undefined DAT_140008098;
42
pointer PTR_DAT_140005210;
43
undefined1 DAT_140005228;
44
undefined DAT_14000528c;
45
undefined DAT_140005578;
46
undefined4 DAT_1400080d8;
47
undefined DAT_140005ba8;
48
undefined4 DAT_1400080dc;
49
undefined DAT_1400080a9;
50
undefined4 UNK_1400080b4;
51
undefined8 DAT_1400080a1;
52
undefined DAT_1400080d0;
53
int DAT_1400080c8;
54
undefined DAT_140008090;
55
undefined DAT_140008099;
56
HWND DAT_1400080e0;
57
byte DAT_140008090;
58
undefined DAT_140005252;
59
undefined1 DAT_140008091;
60
undefined8 DAT_1400080e0;
61
undefined DAT_140008088;
62
undefined DAT_1400080a1;
63
undefined DAT_1400080b8;
64
undefined8 DAT_140008080;
65
undefined DAT_1400045f0;
66
undefined *PTR_PTR__ZdlPv_1400052a0;
67
undefined *PTR__ZTVSt12length_error_140006b88;
68
undefined DAT_140004610;
69
undefined *PTR_PTR__ZdlPv_140005318;
70
int DAT_140008038;
71
int DAT_140008148;
72
DWORD *DAT_140008178;
73
undefined DAT_140008150;
74
undefined *PTR_DAT_140008008;
75
undefined8 DAT_1400064b0;
76
pointer PTR_FUN_1400064b8;
77
char DAT_1400080f8;
78
undefined *DAT_140008100;
79
longlong DAT_140008108;
80
undefined8 DAT_140008108;
81
undefined DAT_1400060c8;
82
char DAT_140008130;
83
int DAT_140008140;
84
IMAGE_DOS_HEADER IMAGE_DOS_HEADER_140000000;
85
uint switchdataD_1400060e0;
86
undefined DAT_140006248;
87
undefined4 DAT_140006414;
88
pointer PTR__guard_check_icall_140006450;
89
longlong DAT_140008138;
90
undefined DAT_140006298;
91
undefined *PTR_DAT_140008040;
92
undefined4 *DAT_140008178;
93
int *DAT_140008178;
94
IMAGE_SECTION_HEADER IMAGE_SECTION_HEADER_140000180;
95
dword DWORD_1400064e4;
96
undefined DAT_140008048;
97

98
void entry(undefined8 param_1,void **param_2,undefined8 *param_3,ulonglong param_4)
99

100
{
101
  DAT_1400080fc = 1;
102
  FUN_140001020(param_1,param_2,param_3,param_4);
103
  return;
104
}
105

106

107

108
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
109
// WARNING: Removing unreachable block (ram,0x00014000137c)
110
// WARNING: Removing unreachable block (ram,0x0001400011b1)
111
// WARNING: Removing unreachable block (ram,0x0001400011b9)
112

113
ulonglong FUN_140001020(undefined8 param_1,void **param_2,undefined8 *param_3,ulonglong param_4)
114

115
{
116
  void *pvVar1;
117
  undefined4 uVar2;
118
  int iVar3;
119
  undefined8 *puVar4;
120
  ulonglong uVar5;
121
  undefined4 *puVar6;
122
  undefined8 uVar7;
123
  void *pvVar8;
124
  size_t sVar9;
125
  void *pvVar10;
126
  longlong lVar11;
127
  longlong lVar12;
128
  bool bVar13;
129
  undefined4 local_44;
130

131
  pvVar1 = StackBase;
132
  pvVar8 = (void *)0x0;
133
  LOCK();
134
  bVar13 = DAT_140008118 == (void *)0x0;
135
  pvVar10 = pvVar1;
136
  if (!bVar13) {
137
    pvVar8 = DAT_140008118;
138
    pvVar10 = DAT_140008118;
139
  }
140
  DAT_140008118 = pvVar10;
141
  UNLOCK();
142
  if (StackBase != pvVar8 && !bVar13) {
143
    do {
144
      param_1 = 1000;
145
      Sleep(1000);
146
      pvVar8 = (void *)0x0;
147
      LOCK();
148
      bVar13 = DAT_140008118 == (void *)0x0;
149
      pvVar10 = pvVar1;
150
      if (!bVar13) {
151
        pvVar8 = DAT_140008118;
152
        pvVar10 = DAT_140008118;
153
      }
154
      DAT_140008118 = pvVar10;
155
      UNLOCK();
156
    } while ((!bVar13) && (pvVar1 != pvVar8));
157
  }
158
  if (DAT_140008110 != 1) {
159
    if (DAT_140008110 != 0) {
160
      DAT_140008070 = '\x01';
161
joined_r0x0001400010b0:
162
      if (bVar13) {
163
        LOCK();
164
        DAT_140008118 = (void *)0x0;
165
        UNLOCK();
166
      }
167
      tls_callback_0(0,2);
168
      uVar7 = DAT_140008068;
169
      puVar4 = (undefined8 *)FUN_140003bd0();
170
      *puVar4 = uVar7;
171
      uVar5 = FUN_140003b10();
172
      if (DAT_140008054 != 0) {
173
        if (DAT_140008070 == '\0') {
174
          uVar5 = uVar5 & 0xffffffff;
175
          _cexit();
176
        }
177
        return uVar5;
178
      }
179
      goto LAB_140001395;
180
    }
181
    DAT_140008110 = 1;
182
    FUN_1400035f0(param_1,param_2,param_3,param_4);
183
    DAT_140008100 = SetUnhandledExceptionFilter(FUN_1400033b0);
184
    _set_invalid_parameter_handler((_invalid_parameter_handler)&DAT_1400013d0);
185
    FUN_140003570();
186
    DAT_1400080ec = 1;
187
    DAT_1400080f0 = 1;
188
    DAT_1400080f4 = 1;
189
    DAT_140008054 = 0;
190
    param_2 = (void **)0xf8;
191
    _set_app_type(2 - (uint)(DAT_1400080fc == 0));
192
    uVar2 = DAT_140008128;
193
    puVar6 = (undefined4 *)__p__fmode();
194
    *puVar6 = uVar2;
195
    uVar2 = DAT_140008120;
196
    puVar6 = (undefined4 *)__p__commode();
197
    *puVar6 = uVar2;
198
    uVar7 = FUN_140003b00();
199
    if (-1 < (int)uVar7) {
200
      if (DAT_140008018 == 1) {
201
        FUN_140003560(FUN_140003580);
202
      }
203
      if (DAT_140008000 == -1) {
204
        _configthreadlocale(-1);
205
      }
206
      iVar3 = _initterm_e(&DAT_140006480,&DAT_140006488);
207
      if (iVar3 != 0) {
208
        return 0xff;
209
      }
210
      local_44 = DAT_14000812c;
211
      param_4 = (ulonglong)DAT_140008124;
212
      param_2 = &DAT_140008060;
213
      param_3 = &DAT_140008068;
214
      uVar7 = FUN_140003be0(&DAT_140008058,&DAT_140008060,&DAT_140008068,DAT_140008124,&local_44);
215
      iVar3 = DAT_140008058;
216
      if (-1 < (int)uVar7) {
217
        lVar12 = (longlong)DAT_140008058;
218
        pvVar8 = malloc(lVar12 * 8 + 8);
219
        pvVar1 = DAT_140008060;
220
        if (pvVar8 != (void *)0x0) {
221
          if (iVar3 < 1) {
222
            lVar12 = 0;
223
          }
224
          else {
225
            lVar11 = 0;
226
            do {
227
              sVar9 = wcslen(*(wchar_t **)((longlong)pvVar1 + lVar11 * 8));
228
              puVar4 = (undefined8 *)(sVar9 * 2 + 2);
229
              pvVar10 = malloc((size_t)puVar4);
230
              *(void **)((longlong)pvVar8 + lVar11 * 8) = pvVar10;
231
              if (pvVar10 == (void *)0x0) goto LAB_140001381;
232
              param_2 = *(void ***)((longlong)pvVar1 + lVar11 * 8);
233
              memcpy(pvVar10,param_2,(size_t)puVar4);
234
              lVar11 = lVar11 + 1;
235
              param_3 = puVar4;
236
            } while (lVar12 != lVar11);
237
          }
238
          *(undefined8 *)((longlong)pvVar8 + lVar12 * 8) = 0;
239
          DAT_140008060 = pvVar8;
240
          _initterm(&DAT_140006460,&DAT_140006468);
241
          FUN_140003320();
242
          DAT_140008110 = 2;
243
          goto joined_r0x0001400010b0;
244
        }
245
      }
246
    }
247
LAB_140001381:
248
    FUN_140003c50(8,param_2,param_3,param_4);
249
  }
250
  uVar5 = FUN_140003c50(0x1f,param_2,param_3,param_4);
251
LAB_140001395:
252
                    // WARNING: Subroutine does not return
253
  exit((int)uVar5);
254
}
255

256

257

258
void FUN_1400013a0(undefined8 param_1,void **param_2,undefined8 *param_3,ulonglong param_4)
259

260
{
261
  DAT_1400080fc = 0;
262
  FUN_140001020(param_1,param_2,param_3,param_4);
263
  return;
264
}
265

266

267

268
void FUN_1400013c0(void)
269

270
{
271
                    // WARNING: Could not recover jumptable at 0x000140004740. Too many branches
272
                    // WARNING: Treating indirect jump as call
273
  _crt_atexit();
274
  return;
275
}
276

277

278

279
undefined8 FUN_140001440(HINSTANCE param_1,undefined8 param_2,undefined8 param_3,int param_4)
280

281
{
282
  BOOL BVar1;
283
  HMODULE hInstance;
284
  HWND pHVar2;
285
  int iVar3;
286
  ulonglong uVar4;
287
  HWND local_160;
288
  tagMSG local_158;
289
  WNDCLASSW local_128;
290
  WNDCLASSW local_d8;
291
  WNDCLASSW local_88;
292

293
  local_d8.cbClsExtra = 0;
294
  local_d8.cbWndExtra = 0;
295
  local_d8.style = 0;
296
  local_d8._4_4_ = 0;
297
  local_d8.hbrBackground = (HBRUSH)0x0;
298
  local_d8.lpszMenuName = (LPCWSTR)0x0;
299
  local_d8.hIcon = (HICON)0x0;
300
  local_d8.hCursor = (HCURSOR)0x0;
301
  local_d8.lpszClassName = L"TeaGodMain";
302
  local_d8.lpfnWndProc = FUN_1400017a0;
303
  local_d8.hInstance = param_1;
304
  local_d8.hbrBackground = CreateSolidBrush(0x191919);
305
  RegisterClassW(&local_d8);
306
  local_88.cbClsExtra = 0;
307
  local_88.cbWndExtra = 0;
308
  local_88.style = 0;
309
  local_88._4_4_ = 0;
310
  local_88.hbrBackground = (HBRUSH)0x0;
311
  local_88.lpszMenuName = (LPCWSTR)0x0;
312
  local_88.hIcon = (HICON)0x0;
313
  local_88.hCursor = (HCURSOR)0x0;
314
  local_88.lpszClassName = L"TeaGodNote";
315
  local_88.lpfnWndProc = FUN_140001d50;
316
  local_88.hInstance = param_1;
317
  RegisterClassW(&local_88);
318
  local_128.cbClsExtra = 0;
319
  local_128.cbWndExtra = 0;
320
  local_128.style = 0;
321
  local_128._4_4_ = 0;
322
  local_128.lpszMenuName = (LPCWSTR)0x0;
323
  local_128.hIcon = (HICON)0x0;
324
  local_128.hCursor = (HCURSOR)0x0;
325
  local_128.lpszClassName = L"TeaGodReward";
326
  local_128.lpfnWndProc = FUN_1400026c0;
327
  local_128.hbrBackground = (HBRUSH)0x6;
328
  local_128.hInstance = param_1;
329
  RegisterClassW(&local_128);
330
  DAT_1400080c0 =
331
       CreateWindowExW(0,L"TeaGodMain",L"TeaGod Worship Protocol",0xcf0000,-0x80000000,-0x80000000,
332
                       0x2d0,0xb4,(HWND)0x0,(HMENU)0x0,param_1,(LPVOID)0x0);
333
  ShowWindow(DAT_1400080c0,param_4);
334
  UpdateWindow(DAT_1400080c0);
335
  pHVar2 = DAT_1400080c0;
336
  hInstance = GetModuleHandleW((LPCWSTR)0x0);
337
  pHVar2 = CreateWindowExW(0x88,L"TeaGodNote",L"WORSHIP REQUEST",0x80c80000,-0x80000000,-0x80000000,
338
                           0x1ae,0x1d6,pHVar2,(HMENU)0x0,hInstance,(LPVOID)0x0);
339
  local_158.hwnd = (HWND)0x0;
340
  local_158.message = 0;
341
  local_158._12_4_ = 0;
342
  local_160 = pHVar2;
343
  SystemParametersInfoW(0x30,0,&local_158,0);
344
  uVar4 = DAT_140008080 - DAT_140008078 >> 3;
345
  iVar3 = (int)uVar4 + (int)(uVar4 / 6) * -6;
346
  SetWindowPos(pHVar2,(HWND)0xffffffffffffffff,local_158.message + iVar3 * -0x22 + -0x1c7,
347
               local_158._12_4_ + iVar3 * -0x1c + -0x1fe,0x1ae,0x1d6,0x40);
348
  FUN_1400030b0(&DAT_140008078,&local_160);
349
  SetTimer(DAT_1400080c0,0xcafe,3000,(TIMERPROC)0x0);
350
  local_158.time = 0;
351
  local_158.pt.x = 0;
352
  local_158.pt.y = 0;
353
  local_158._44_4_ = 0;
354
  local_158.wParam = 0;
355
  local_158.lParam = 0;
356
  local_158.hwnd = (HWND)0x0;
357
  local_158.message = 0;
358
  local_158._12_4_ = 0;
359
  BVar1 = GetMessageW(&local_158,(HWND)0x0,0,0);
360
  if (0 < BVar1) {
361
    do {
362
      TranslateMessage(&local_158);
363
      DispatchMessageW(&local_158);
364
      BVar1 = GetMessageW(&local_158,(HWND)0x0,0,0);
365
    } while (0 < BVar1);
366
  }
367
  return 0;
368
}
369

370

371

372
// WARNING: Type propagation algorithm not settling
373

374
HBRUSH FUN_1400017a0(HWND param_1,UINT param_2,WPARAM param_3,LPARAM param_4)
375

376
{
377
  undefined1 *puVar1;
378
  HDC hdc;
379
  HFONT h;
380
  HGDIOBJ h_00;
381
  uint *puVar2;
382
  ulonglong *puVar3;
383
  HMODULE hInstance;
384
  HWND hWnd;
385
  HBRUSH pHVar4;
386
  int iVar5;
387
  ulonglong uVar6;
388
  LPCWSTR lpchText;
389
  undefined8 local_128;
390
  ulonglong uStack_120;
391
  LPCWSTR local_118;
392
  byte local_110 [2];
393
  undefined1 local_10e [6];
394
  ulonglong local_108;
395
  undefined1 *local_100;
396
  uint local_f8;
397
  uint uStack_f4;
398
  uint uStack_f0;
399
  uint uStack_ec;
400
  undefined8 local_e8;
401
  ulonglong local_d8;
402
  ulonglong uStack_d0;
403
  ulonglong local_c8;
404
  byte local_c0 [16];
405
  undefined8 local_b0;
406
  tagRECT local_a8;
407
  tagPAINTSTRUCT local_98;
408

409
  if ((int)param_2 < 0x113) {
410
    if (param_2 == 2) {
411
      KillTimer(param_1,0xcafe);
412
      PostQuitMessage(0);
413
    }
414
    else {
415
      if (param_2 != 0xf) goto LAB_140001b5c;
416
      local_98.rgbReserved[0xc] = '\0';
417
      local_98.rgbReserved[0xd] = '\0';
418
      local_98.rgbReserved[0xe] = '\0';
419
      local_98.rgbReserved[0xf] = '\0';
420
      local_98.rgbReserved[0x10] = '\0';
421
      local_98.rgbReserved[0x11] = '\0';
422
      local_98.rgbReserved[0x12] = '\0';
423
      local_98.rgbReserved[0x13] = '\0';
424
      local_98.rgbReserved[0x14] = '\0';
425
      local_98.rgbReserved[0x15] = '\0';
426
      local_98.rgbReserved[0x16] = '\0';
427
      local_98.rgbReserved[0x17] = '\0';
428
      local_98.rgbReserved[0x18] = '\0';
429
      local_98.rgbReserved[0x19] = '\0';
430
      local_98.rgbReserved[0x1a] = '\0';
431
      local_98.rgbReserved[0x1b] = '\0';
432
      local_98.fIncUpdate = 0;
433
      local_98.rgbReserved[0] = '\0';
434
      local_98.rgbReserved[1] = '\0';
435
      local_98.rgbReserved[2] = '\0';
436
      local_98.rgbReserved[3] = '\0';
437
      local_98.rgbReserved[4] = '\0';
438
      local_98.rgbReserved[5] = '\0';
439
      local_98.rgbReserved[6] = '\0';
440
      local_98.rgbReserved[7] = '\0';
441
      local_98.rgbReserved[8] = '\0';
442
      local_98.rgbReserved[9] = '\0';
443
      local_98.rgbReserved[10] = '\0';
444
      local_98.rgbReserved[0xb] = '\0';
445
      local_98.rcPaint.top = 0;
446
      local_98.rcPaint.right = 0;
447
      local_98.rcPaint.bottom = 0;
448
      local_98.fRestore = 0;
449
      local_98.hdc = (HDC)0x0;
450
      local_98.fErase = 0;
451
      local_98.rcPaint.left = 0;
452
      local_98.rgbReserved[0x1c] = '\0';
453
      local_98.rgbReserved[0x1d] = '\0';
454
      local_98.rgbReserved[0x1e] = '\0';
455
      local_98.rgbReserved[0x1f] = '\0';
456
      local_98._68_4_ = 0;
457
      hdc = BeginPaint(param_1,&local_98);
458
      local_a8.left = 0;
459
      local_a8.top = 0;
460
      local_a8.right = 0;
461
      local_a8.bottom = 0;
462
      GetClientRect(param_1,&local_a8);
463
      SetBkMode(hdc,1);
464
      SetTextColor(hdc,0xdcdcdc);
465
      h = CreateFontW(0x16,0,0,0,700,0,0,0,1,0,0,0,0,L"Consolas");
466
      h_00 = SelectObject(hdc,h);
467
      _ZNSt3__110to_wstringEj(local_c0,DAT_1400080c8);
468
      puVar2 = (uint *)_ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6insertEyPKw
469
                                 (local_c0,0,L"Worship count: ");
470
      local_e8 = *(undefined8 *)(puVar2 + 4);
471
      local_f8 = *puVar2;
472
      uStack_f4 = puVar2[1];
473
      uStack_f0 = puVar2[2];
474
      uStack_ec = puVar2[3];
475
      puVar2[0] = 0;
476
      puVar2[1] = 0;
477
      puVar2[2] = 0;
478
      puVar2[3] = 0;
479
      puVar2[4] = 0;
480
      puVar2[5] = 0;
481
      puVar3 = (ulonglong *)
482
               _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKw
483
                         (&local_f8,&DAT_140005148);
484
      local_c8 = puVar3[2];
485
      local_d8 = *puVar3;
486
      uStack_d0 = puVar3[1];
487
      *puVar3 = 0;
488
      puVar3[1] = 0;
489
      puVar3[2] = 0;
490
      _ZNSt3__110to_wstringEj(local_110,1);
491
      uVar6 = (ulonglong)(local_110[0] >> 1);
492
      puVar1 = local_10e;
493
      if ((local_110[0] & 1) != 0) {
494
        uVar6 = local_108;
495
        puVar1 = local_100;
496
      }
497
      puVar3 = (ulonglong *)
498
               _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKwy
499
                         (&local_d8,puVar1,uVar6);
500
      local_118 = (LPCWSTR)puVar3[2];
501
      local_128 = (HWND)*puVar3;
502
      uStack_120 = puVar3[1];
503
      *puVar3 = 0;
504
      puVar3[1] = 0;
505
      puVar3[2] = 0;
506
      if ((local_110[0] & 1) != 0) {
507
        _ZdlPv(local_100);
508
      }
509
      if ((local_d8 & 1) != 0) {
510
        _ZdlPv(local_c8);
511
      }
512
      if ((local_f8 & 1) != 0) {
513
        _ZdlPv(local_e8);
514
      }
515
      if ((local_c0[0] & 1) != 0) {
516
        _ZdlPv(local_b0);
517
      }
518
      lpchText = local_118;
519
      if (((ulonglong)local_128 & 1) == 0) {
520
        lpchText = (LPCWSTR)((longlong)&local_128 + 2);
521
      }
522
      DrawTextW(hdc,lpchText,-1,&local_a8,0x25);
523
      SelectObject(hdc,h_00);
524
      DeleteObject(h);
525
      if (((ulonglong)local_128 & 1) != 0) {
526
        _ZdlPv(local_118);
527
      }
528
      EndPaint(param_1,&local_98);
529
    }
530
    pHVar4 = (HBRUSH)0x0;
531
  }
532
  else {
533
    if (param_2 == 0x138) {
534
      pHVar4 = GetSysColorBrush(5);
535
      return pHVar4;
536
    }
537
    if ((param_2 == 0x113) && (param_3 == 0xcafe)) {
538
      param_2 = 0x113;
539
      hInstance = GetModuleHandleW((LPCWSTR)0x0);
540
      hWnd = CreateWindowExW(0x88,L"TeaGodNote",L"WORSHIP REQUEST",0x80c80000,-0x80000000,
541
                             -0x80000000,0x1ae,0x1d6,param_1,(HMENU)0x0,hInstance,(LPVOID)0x0);
542
      local_98.hdc = (HDC)0x0;
543
      local_98.fErase = 0;
544
      local_98.rcPaint.left = 0;
545
      local_128 = hWnd;
546
      SystemParametersInfoW(0x30,0,&local_98,0);
547
      uVar6 = DAT_140008080 - DAT_140008078 >> 3;
548
      iVar5 = (int)uVar6 + (int)(uVar6 / 6) * -6;
549
      SetWindowPos(hWnd,(HWND)0xffffffffffffffff,local_98.fErase + iVar5 * -0x22 + -0x1c7,
550
                   local_98.rcPaint.left + iVar5 * -0x1c + -0x1fe,0x1ae,0x1d6,0x40);
551
      FUN_1400030b0(&DAT_140008078,&local_128);
552
    }
553
LAB_140001b5c:
554
    pHVar4 = (HBRUSH)DefWindowProcW(param_1,param_2,param_3,param_4);
555
  }
556
  return pHVar4;
557
}
558

559

560

561
// WARNING: Removing unreachable block (ram,0x00014000251a)
562
// WARNING: Globals starting with '_' overlap smaller symbols at the same address
563

564
LRESULT FUN_140001d50(HWND param_1,UINT param_2,WPARAM param_3,LPARAM param_4)
565

566
{
567
  byte bVar1;
568
  char *pcVar2;
569
  longlong *plVar3;
570
  DWORD DVar4;
571
  HRESULT HVar5;
572
  int iVar6;
573
  undefined **ppuVar7;
574
  undefined8 *puVar8;
575
  LRESULT LVar9;
576
  HMODULE pHVar10;
577
  HRSRC hResInfo;
578
  HGLOBAL hResData;
579
  HGLOBAL hMem;
580
  LPVOID _Dst;
581
  LPVOID _Src;
582
  HDC hdc;
583
  longlong *plVar11;
584
  byte *pbVar12;
585
  longlong lVar13;
586
  longlong lVar14;
587
  longlong *plVar15;
588
  longlong *local_d0;
589
  longlong *local_c8;
590
  longlong *local_c0;
591
  undefined8 local_b8;
592
  LONG LStack_b0;
593
  undefined4 uStack_ac;
594
  DWORD DStack_a8;
595
  DWORD DStack_a4;
596
  LONG LStack_a0;
597
  undefined8 uStack_9c;
598
  undefined8 local_94;
599
  tagPAINTSTRUCT local_88;
600

601
  plVar3 = DAT_140008080;
602
  if ((int)param_2 < 0xf) {
603
    if (param_2 == 1) {
604
      CoInitializeEx((LPVOID)0x0,2);
605
      pHVar10 = GetModuleHandleW((LPCWSTR)0x0);
606
      hResInfo = FindResourceW(pHVar10,(LPCWSTR)0x65,(LPCWSTR)0xa);
607
      if (hResInfo != (HRSRC)0x0) {
608
        hResData = LoadResource((HMODULE)0x0,hResInfo);
609
        DVar4 = SizeofResource((HMODULE)0x0,hResInfo);
610
        if (DVar4 != 0 && hResData != (HGLOBAL)0x0) {
611
          hMem = GlobalAlloc(2,(ulonglong)DVar4);
612
          if (hMem != (HGLOBAL)0x0) {
613
            _Dst = GlobalLock(hMem);
614
            _Src = LockResource(hResData);
615
            memcpy(_Dst,_Src,(ulonglong)DVar4);
616
            GlobalUnlock(hMem);
617
            local_88.hdc = (HDC)0x0;
618
            HVar5 = CreateStreamOnHGlobal(hMem,1,(LPSTREAM *)&local_88);
619
            if (-1 < HVar5) {
620
              local_b8 = (longlong *)0x0;
621
              local_c0 = (longlong *)0x0;
622
              local_d0 = (longlong *)0x0;
623
              HVar5 = CoCreateInstance((IID *)&DAT_140005ba8,(LPUNKNOWN)0x0,1,(IID *)&DAT_14000528c,
624
                                       (LPVOID *)&local_b8);
625
              if (((-1 < HVar5) &&
626
                  (iVar6 = (**(code **)(*local_b8 + 0x20))(local_b8,local_88.hdc,0,1,&local_c0),
627
                  -1 < iVar6)) &&
628
                 (iVar6 = (**(code **)(*local_c0 + 0x68))(local_c0,0,&local_d0), -1 < iVar6)) {
629
                local_c8 = (longlong *)0x0;
630
                iVar6 = (**(code **)(*local_b8 + 0x50))(local_b8,&local_c8);
631
                if ((-1 < iVar6) &&
632
                   (iVar6 = (**(code **)(*local_c8 + 0x40))
633
                                      (local_c8,local_d0,&DAT_140005578,0,0,0,0), -1 < iVar6)) {
634
                  (**(code **)(*local_c8 + 0x18))(local_c8,&DAT_1400080d8,&DAT_1400080dc);
635
                  FUN_140002e90((longlong *)((longlong)&DAT_1400080a1 + 7),
636
                                (ulonglong)DAT_1400080dc * (ulonglong)DAT_1400080d8 * 4);
637
                  (**(code **)(*local_c8 + 0x38))
638
                            (local_c8,0,DAT_1400080d8 << 2,
639
                             ram0x0001400080b0 - (int)ram0x0001400080a8,ram0x0001400080a8);
640
                }
641
                if (local_c8 != (longlong *)0x0) {
642
                  (**(code **)(*local_c8 + 0x10))();
643
                }
644
              }
645
              if (local_d0 != (longlong *)0x0) {
646
                (**(code **)(*local_d0 + 0x10))();
647
              }
648
              if (local_c0 != (longlong *)0x0) {
649
                (**(code **)(*local_c0 + 0x10))();
650
              }
651
              if (local_b8 != (longlong *)0x0) {
652
                (**(code **)(*local_b8 + 0x10))();
653
              }
654
              (*(*(IStreamVtbl **)&(local_88.hdc)->unused)->Release)((IStream *)local_88.hdc);
655
            }
656
          }
657
        }
658
      }
659
      pHVar10 = GetModuleHandleW((LPCWSTR)0x0);
660
      CreateWindowExW(0,L"STATIC",L"茶神降臨 // CLICK TO WORSHIP",0x50000001,0x14,0x12,0x186,
661
                      0x1c,param_1,(HMENU)0x0,pHVar10,(LPVOID)0x0);
662
      pHVar10 = GetModuleHandleW((LPCWSTR)0x0);
663
      _DAT_1400080d0 =
664
           CreateWindowExW(0,L"BUTTON",L"WORSHIP TEA GOD",0x50000001,0x6e,0x177,0xd2,0x2a,param_1,
665
                           (HMENU)0x1001,pHVar10,(LPVOID)0x0);
100 collapsed lines
666
    }
667
    else {
668
      if (param_2 != 2) {
669
LAB_140002078:
670
                    // WARNING: Could not recover jumptable at 0x00014000208e. Too many branches
671
                    // WARNING: Treating indirect jump as call
672
        LVar9 = DefWindowProcW(param_1,param_2,param_3,param_4);
673
        return LVar9;
674
      }
675
      plVar15 = DAT_140008078;
676
      if (DAT_140008078 == DAT_140008080) {
677
LAB_140002507:
678
        if (plVar15 != plVar3) {
679
          DAT_140008080 = plVar15;
680
        }
681
      }
682
      else {
683
        do {
684
          if ((HWND)*plVar15 == param_1) {
685
            plVar11 = plVar15 + 1;
686
            if (plVar11 != DAT_140008080 && plVar15 != DAT_140008080) {
687
              do {
688
                if ((HWND)*plVar11 != param_1) {
689
                  *plVar15 = *plVar11;
690
                  plVar15 = plVar15 + 1;
691
                }
692
                plVar11 = plVar11 + 1;
693
              } while (plVar11 != plVar3);
694
            }
695
            goto LAB_140002507;
696
          }
697
          plVar15 = plVar15 + 1;
698
        } while (plVar15 != DAT_140008080);
699
      }
700
      CoUninitialize();
701
    }
702
  }
703
  else if (param_2 == 0xf) {
704
    local_88.rgbReserved[0xc] = '\0';
705
    local_88.rgbReserved[0xd] = '\0';
706
    local_88.rgbReserved[0xe] = '\0';
707
    local_88.rgbReserved[0xf] = '\0';
708
    local_88.rgbReserved[0x10] = '\0';
709
    local_88.rgbReserved[0x11] = '\0';
710
    local_88.rgbReserved[0x12] = '\0';
711
    local_88.rgbReserved[0x13] = '\0';
712
    local_88.rgbReserved[0x14] = '\0';
713
    local_88.rgbReserved[0x15] = '\0';
714
    local_88.rgbReserved[0x16] = '\0';
715
    local_88.rgbReserved[0x17] = '\0';
716
    local_88.rgbReserved[0x18] = '\0';
717
    local_88.rgbReserved[0x19] = '\0';
718
    local_88.rgbReserved[0x1a] = '\0';
719
    local_88.rgbReserved[0x1b] = '\0';
720
    local_88.fIncUpdate = 0;
721
    local_88.rgbReserved[0] = '\0';
722
    local_88.rgbReserved[1] = '\0';
723
    local_88.rgbReserved[2] = '\0';
724
    local_88.rgbReserved[3] = '\0';
725
    local_88.rgbReserved[4] = '\0';
726
    local_88.rgbReserved[5] = '\0';
727
    local_88.rgbReserved[6] = '\0';
728
    local_88.rgbReserved[7] = '\0';
729
    local_88.rgbReserved[8] = '\0';
730
    local_88.rgbReserved[9] = '\0';
731
    local_88.rgbReserved[10] = '\0';
732
    local_88.rgbReserved[0xb] = '\0';
733
    local_88.rcPaint.top = 0;
734
    local_88.rcPaint.right = 0;
735
    local_88.rcPaint.bottom = 0;
736
    local_88.fRestore = 0;
737
    local_88.hdc = (HDC)0x0;
738
    local_88.fErase = 0;
739
    local_88.rcPaint.left = 0;
740
    local_88.rgbReserved[0x1c] = '\0';
741
    local_88.rgbReserved[0x1d] = '\0';
742
    local_88.rgbReserved[0x1e] = '\0';
743
    local_88.rgbReserved[0x1f] = '\0';
744
    local_88._68_4_ = 0;
745
    hdc = BeginPaint(param_1,&local_88);
746
    if (ram0x0001400080a8 != (void *)CONCAT44(uRam00000001400080b4,ram0x0001400080b0)) {
747
      DStack_a4 = 0;
748
      LStack_a0 = 0;
749
      uStack_9c._0_4_ = 0;
750
      uStack_9c._4_4_ = 0;
751
      local_94._0_4_ = 0;
752
      local_94._4_1_ = '\0';
753
      local_94._5_1_ = '\0';
754
      local_94._6_1_ = '\0';
755
      local_94._7_1_ = '\0';
756
      local_b8 = (longlong *)CONCAT44(DAT_1400080d8,0x28);
757
      LStack_b0 = -DAT_1400080dc;
758
      uStack_ac._0_2_ = 1;
759
      uStack_ac._2_2_ = 0x20;
760
      DStack_a8 = 0;
761
      StretchDIBits(hdc,0x23,0x37,0x168,300,0,0,DAT_1400080d8,DAT_1400080dc,ram0x0001400080a8,
762
                    (BITMAPINFO *)&local_b8,0,0xcc0020);
763
    }
764
    EndPaint(param_1,&local_88);
765
  }
766
  else {
767
    if ((param_2 != 0x111) || (((uint)param_3 & 0xffff) != 0x1001)) goto LAB_140002078;
768
    DAT_1400080c8 = DAT_1400080c8 + 1;
769
    InvalidateRect(DAT_1400080c0,(RECT *)0x0,1);
770
    if (param_1 != (HWND)0x0) {
771
      DestroyWindow(param_1);
772
    }
773
    if (DAT_1400080c8 != 0) {
774
      KillTimer(DAT_1400080c0,0xcafe);
775
      if (DAT_140008078 != DAT_140008080) {
776
        do {
777
          DestroyWindow((HWND)DAT_140008080[-1]);
778
        } while (DAT_140008078 != DAT_140008080);
779
      }
780
      local_88.rcPaint.top = 0;
781
      local_88.rcPaint.right = 0;
782
      local_88.rcPaint.bottom = 0;
783
      local_88.fRestore = 0;
784
      local_88.hdc = (HDC)0x0;
785
      local_88.fErase = 0;
786
      local_88.rcPaint.left = 0;
787
      local_88._32_8_ = (ulonglong)(uint)local_88.rgbReserved._0_4_ << 0x20;
788
      ppuVar7 = &PTR_DAT_140005210;
789
      pbVar12 = (byte *)((longlong)&local_88.fErase + 3);
790
      lVar13 = 0;
791
      do {
792
        pcVar2 = *ppuVar7;
793
        bVar1 = (&DAT_140005228)[lVar13];
794
        *(byte *)&((tagPAINTSTRUCT *)(pbVar12 + -0xb))->hdc = *pcVar2 - 0x19U ^ bVar1;
795
        pbVar12[-10] = pcVar2[1] - 0x20U ^ bVar1;
796
        pbVar12[-9] = pcVar2[2] - 0x27U ^ bVar1;
797
        pbVar12[-8] = pcVar2[3] - 0x2eU ^ bVar1;
798
        pbVar12[-7] = pcVar2[4] - 0x35U ^ bVar1;
799
        pbVar12[-6] = pcVar2[5] - 0x3cU ^ bVar1;
800
        pbVar12[-5] = pcVar2[6] + 0xbdU ^ bVar1;
801
        pbVar12[-4] = pcVar2[7] + 0xb6U ^ bVar1;
802
        pbVar12[-3] = pcVar2[8] + 0xafU ^ bVar1;
803
        pbVar12[-2] = pcVar2[9] + 0xa8U ^ bVar1;
804
        pbVar12[-1] = pcVar2[10] + 0xa1U ^ bVar1;
805
        *pbVar12 = pcVar2[0xb] + 0x9aU ^ bVar1;
806
        lVar13 = lVar13 + 1;
807
        ppuVar7 = ppuVar7 + 1;
808
        pbVar12 = pbVar12 + 0xc;
809
      } while (lVar13 != 3);
2143 collapsed lines
810
      local_c0 = (longlong *)0x616e7368655f6368;
811
      DVar4 = GetTickCount();
812
      local_d0 = (longlong *)CONCAT71(local_d0._1_7_,(char)DVar4);
813
      puVar8 = (undefined8 *)_Znwy(0x28);
814
      DStack_a8 = (DWORD)puVar8;
815
      DStack_a4 = (DWORD)((ulonglong)puVar8 >> 0x20);
816
      local_b8 = (LPVOID)0x29;
817
      LStack_b0 = 0x24;
818
      uStack_ac._0_2_ = 0;
819
      uStack_ac._2_2_ = 0;
820
      puVar8[2] = 0;
821
      puVar8[3] = 0;
822
      *puVar8 = 0;
823
      puVar8[1] = 0;
824
      *(undefined8 *)((longlong)puVar8 + 0x1d) = 0;
825
      lVar13 = 1;
826
      lVar14 = 0;
827
      do {
828
        *(BYTE *)(CONCAT44(DStack_a4,DStack_a8) + lVar14) = local_88.rgbReserved[lVar14 + -0x24];
829
        pbVar12 = (byte *)(CONCAT44(DStack_a4,DStack_a8) + lVar14);
830
        *pbVar12 = *pbVar12 ^ *(byte *)((longlong)&local_c0 + (ulonglong)((uint)lVar13 & 7));
831
        *(byte *)(CONCAT44(DStack_a4,DStack_a8) + lVar14) =
832
             *(byte *)(CONCAT44(DStack_a4,DStack_a8) + lVar14) ^ (byte)local_d0;
833
        *(byte *)(CONCAT44(DStack_a4,DStack_a8) + lVar14) =
834
             *(byte *)(CONCAT44(DStack_a4,DStack_a8) + lVar14) ^ (byte)local_d0;
835
        lVar14 = lVar14 + 1;
836
        lVar13 = lVar13 + 3;
837
      } while (lVar13 != 0x6d);
838
      if (((ulonglong)_DAT_140008090 & 1) != 0) {
839
        _ZdlPv();
840
      }
841
      unique0x100009fe = CONCAT44(DStack_a4,DStack_a8);
842
      _DAT_140008098 = CONCAT44(uStack_ac,LStack_b0);
843
      _DAT_140008090 = local_b8;
844
      pHVar10 = GetModuleHandleW((LPCWSTR)0x0);
845
      DAT_1400080e0 =
846
           CreateWindowExW(0x40008,L"TeaGodReward",L"REWARD UNLOCKED",0xc80000,0,0,0x44c,400,
847
                           (HWND)0x0,(HMENU)0x0,pHVar10,(LPVOID)0x0);
848
      local_88.hdc = (HDC)0x0;
849
      local_88.fErase = 0;
850
      local_88.rcPaint.left = 0;
851
      SystemParametersInfoW(0x30,0,&local_88,0);
852
      SetWindowPos(DAT_1400080e0,(HWND)0xffffffffffffffff,
853
                   (local_88.fErase - (local_88.fErase + -0x44c >> 0x1f)) + -0x44c >> 1,
854
                   (local_88.rcPaint.left - (local_88.rcPaint.left + -400 >> 0x1f)) + -400 >> 1,
855
                   0x44c,400,0x10);
856
      ShowWindow(DAT_1400080e0,5);
857
      UpdateWindow(DAT_1400080e0);
858
    }
859
  }
860
  return 0;
861
}
862

863

864

865
// WARNING: Globals starting with '_' overlap smaller symbols at the same address
866

867
LRESULT FUN_1400026c0(HWND param_1,UINT param_2,WPARAM param_3,LPARAM param_4)
868

869
{
870
  LPCWSTR pWVar1;
871
  size_t dwBytes;
872
  ulonglong uVar2;
873
  code *pcVar3;
874
  byte bVar4;
875
  BOOL BVar5;
876
  HMODULE pHVar6;
877
  LRESULT LVar7;
878
  LPCWSTR pWVar8;
879
  HWND pHVar9;
880
  LPCWSTR pWVar10;
881
  LPCWSTR pWVar11;
882
  HGLOBAL pvVar12;
883
  LPVOID pvVar13;
884
  undefined8 uVar14;
885
  ulonglong unaff_RBP;
886
  ulonglong uVar15;
887
  ulonglong uVar16;
888
  uint uVar17;
889
  ulonglong uVar18;
890
  longlong lVar19;
891
  undefined1 auVar20 [16];
892
  undefined1 auVar26 [16];
893
  undefined1 auVar28 [16];
894
  undefined1 auVar36 [16];
895
  undefined1 local_58 [16];
896
  LPCWSTR local_48;
897
  undefined1 auVar21 [16];
898
  undefined1 auVar22 [16];
899
  undefined1 auVar23 [16];
900
  undefined1 auVar24 [16];
901
  undefined1 auVar25 [16];
902
  undefined1 uVar27;
903
  undefined1 auVar29 [16];
904
  undefined1 auVar30 [16];
905
  undefined1 auVar31 [16];
906
  undefined1 auVar32 [16];
907
  undefined1 auVar33 [16];
908
  undefined1 auVar34 [16];
909
  undefined1 auVar35 [16];
910

911
  if (param_2 != 0x111) {
912
    if (param_2 == 2) {
913
      DAT_1400080e0 = 0;
914
      return 0;
915
    }
916
    if (param_2 != 1) {
917
LAB_14000292b:
918
                    // WARNING: Could not recover jumptable at 0x00014000293f. Too many branches
919
                    // WARNING: Treating indirect jump as call
920
      LVar7 = DefWindowProcW(param_1,param_2,param_3,param_4);
921
      return LVar7;
922
    }
923
    pHVar6 = GetModuleHandleW((LPCWSTR)0x0);
924
    CreateWindowExW(0,L"STATIC",L"Your reward:",0x50000000,0x14,0x12,0x1ae,0x16,param_1,(HMENU)0x0,
925
                    pHVar6,(LPVOID)0x0);
926
    local_58 = (undefined1  [16])0x0;
927
    local_48 = (LPCWSTR)0x0;
928
    uVar15 = _DAT_140008098;
929
    if ((DAT_140008090 & 1) == 0) {
930
      uVar15 = (ulonglong)(DAT_140008090 >> 1);
931
    }
932
    _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE7reserveEy
933
              (local_58,uVar15 + (uVar15 / 0x46) * 2);
934
    if ((DAT_140008090 & 1) == 0) {
935
      if (DAT_140008090 >> 1 != 0) goto LAB_140002993;
936
    }
937
    else if (_DAT_140008098 != 0) {
938
LAB_140002993:
939
      pWVar8 = ram0x0001400080a0;
940
      if ((DAT_140008090 & 1) == 0) {
941
        pWVar8 = (LPCWSTR)&DAT_140008091;
942
      }
943
      _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE9push_backEw
944
                (local_58,(char)*pWVar8);
945
      if ((DAT_140008090 & 1) == 0) {
946
        if (1 < DAT_140008090 >> 1) goto LAB_1400029dd;
947
      }
948
      else if (1 < _DAT_140008098) {
949
LAB_1400029dd:
950
        uVar15 = 1;
951
        do {
952
          if (uVar15 == (uVar15 / 0x46) * 0x46) {
953
            _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKw
954
                      (local_58,&DAT_140005252);
955
          }
956
          pWVar8 = (LPCWSTR)&DAT_140008091;
957
          if ((DAT_140008090 & 1) != 0) {
958
            pWVar8 = ram0x0001400080a0;
959
          }
960
          _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE9push_backEw
961
                    (local_58,*(char *)((longlong)pWVar8 + uVar15));
962
          uVar16 = _DAT_140008098;
963
          if ((DAT_140008090 & 1) == 0) {
964
            uVar16 = (ulonglong)(DAT_140008090 >> 1);
965
          }
966
          uVar15 = uVar15 + 1;
967
        } while (uVar15 < uVar16);
968
      }
969
    }
970
    pWVar8 = local_48;
971
    bVar4 = local_58[0];
972
    pHVar6 = GetModuleHandleW((LPCWSTR)0x0);
973
    if ((bVar4 & 1) == 0) {
974
      pWVar8 = (LPCWSTR)(local_58 + 2);
975
    }
976
    pHVar9 = CreateWindowExW(0x200,L"EDIT",pWVar8,0x50201944,0x14,0x30,0x410,0xfa,param_1,
977
                             (HMENU)0x2001,pHVar6,(LPVOID)0x0);
978
    SendMessageW(pHVar9,0xc5,10000,0);
979
    SendMessageW(pHVar9,0xb1,0,-1);
980
    pHVar6 = GetModuleHandleW((LPCWSTR)0x0);
981
    CreateWindowExW(0,L"BUTTON",L"COPY",0x50000001,0x1ea,0x140,0x78,0x20,param_1,(HMENU)0x2002,
982
                    pHVar6,(LPVOID)0x0);
983
    bVar4 = local_58[0];
984
    goto joined_r0x000140002dbd;
985
  }
986
  if (((uint)param_3 & 0xffff) != 0x2002) goto LAB_14000292b;
987
  BVar5 = OpenClipboard(param_1);
988
  if (BVar5 == 0) {
989
    Sleep(10);
990
    BVar5 = OpenClipboard(param_1);
991
    if (BVar5 == 0) {
992
      Sleep(10);
993
      BVar5 = OpenClipboard(param_1);
994
      if (BVar5 == 0) {
995
        Sleep(10);
996
        BVar5 = OpenClipboard(param_1);
997
        if (BVar5 == 0) {
998
          Sleep(10);
999
          BVar5 = OpenClipboard(param_1);
1000
          if (BVar5 == 0) {
1001
            Sleep(10);
1002
            BVar5 = OpenClipboard(param_1);
1003
            if (BVar5 == 0) {
1004
              Sleep(10);
1005
              BVar5 = OpenClipboard(param_1);
1006
              if (BVar5 == 0) {
1007
                Sleep(10);
1008
                BVar5 = OpenClipboard(param_1);
1009
                if (BVar5 == 0) {
1010
                  Sleep(10);
1011
                  BVar5 = OpenClipboard(param_1);
1012
                  if (BVar5 == 0) {
1013
                    Sleep(10);
1014
                    BVar5 = OpenClipboard(param_1);
1015
                    if (BVar5 == 0) {
1016
                      Sleep(10);
1017
                    }
1018
                  }
1019
                }
1020
              }
1021
            }
1022
          }
1023
        }
1024
      }
1025
    }
1026
  }
1027
  pHVar9 = GetOpenClipboardWindow();
1028
  if ((pHVar9 != param_1) && (BVar5 = OpenClipboard(param_1), BVar5 == 0)) {
1029
    return 0;
1030
  }
1031
  EmptyClipboard();
1032
  pWVar8 = ram0x0001400080a0;
1033
  uVar15 = _DAT_140008098;
1034
  if ((DAT_140008090 & 1) == 0) {
1035
    pWVar8 = (LPCWSTR)&DAT_140008091;
1036
    uVar15 = (ulonglong)(DAT_140008090 >> 1);
1037
  }
1038
  if (0x7ffffffffffffff5 < uVar15) {
1039
    uVar14 = FUN_140003090();
1040
    if ((unaff_RBP & 1) != 0) {
1041
      _ZdlPv(local_48);
1042
    }
1043
    _Unwind_Resume(uVar14);
1044
    pcVar3 = (code *)swi(3);
1045
    LVar7 = (*pcVar3)();
1046
    return LVar7;
1047
  }
1048
  if (uVar15 < 0xb) {
1049
    local_58[0] = (char)uVar15 * '\x02';
1050
    pWVar10 = (LPCWSTR)(local_58 + 2);
1051
    if (uVar15 != 0) goto LAB_140002bbb;
1052
  }
1053
  else {
1054
    lVar19 = 0xe;
1055
    if ((uVar15 | 3) != 0xb) {
1056
      lVar19 = (uVar15 | 3) + 1;
1057
    }
1058
    pWVar10 = (LPCWSTR)_Znwy(lVar19 * 2);
1059
    local_58._8_8_ = uVar15;
1060
    local_58._0_8_ = lVar19 + 1;
1061
    local_48 = pWVar10;
1062
LAB_140002bbb:
1063
    pWVar1 = (LPCWSTR)((longlong)pWVar8 + uVar15);
1064
    if ((0xf < uVar15) && ((pWVar1 <= pWVar10 || (pWVar10 + uVar15 <= pWVar8)))) {
1065
      uVar16 = uVar15 & 0x7ffffffffffffff0;
1066
      pWVar11 = pWVar10 + uVar16;
1067
      uVar18 = 0;
1068
      do {
1069
        uVar2 = *(ulonglong *)((longlong)pWVar8 + uVar18);
1070
        uVar27 = (undefined1)(uVar2 >> 0x38);
1071
        auVar25._8_6_ = 0;
1072
        auVar25._0_8_ = uVar2;
1073
        auVar25[0xe] = uVar27;
1074
        auVar25[0xf] = uVar27;
1075
        uVar27 = (undefined1)(uVar2 >> 0x30);
1076
        auVar24._14_2_ = auVar25._14_2_;
1077
        auVar24._8_5_ = 0;
1078
        auVar24._0_8_ = uVar2;
1079
        auVar24[0xd] = uVar27;
1080
        auVar23._13_3_ = auVar24._13_3_;
1081
        auVar23._8_4_ = 0;
1082
        auVar23._0_8_ = uVar2;
1083
        auVar23[0xc] = uVar27;
1084
        uVar27 = (undefined1)(uVar2 >> 0x28);
1085
        auVar22._12_4_ = auVar23._12_4_;
1086
        auVar22._8_3_ = 0;
1087
        auVar22._0_8_ = uVar2;
1088
        auVar22[0xb] = uVar27;
1089
        auVar21._11_5_ = auVar22._11_5_;
1090
        auVar21._8_2_ = 0;
1091
        auVar21._0_8_ = uVar2;
1092
        auVar21[10] = uVar27;
1093
        uVar27 = (undefined1)(uVar2 >> 0x20);
1094
        auVar20._10_6_ = auVar21._10_6_;
1095
        auVar20[8] = 0;
1096
        auVar20._0_8_ = uVar2;
1097
        auVar20[9] = uVar27;
1098
        auVar36._9_7_ = auVar20._9_7_;
1099
        auVar36[8] = uVar27;
1100
        auVar36._0_8_ = uVar2;
1101
        uVar27 = (undefined1)(uVar2 >> 0x18);
1102
        auVar26._8_8_ = auVar36._8_8_;
1103
        auVar26[7] = uVar27;
1104
        auVar26[6] = uVar27;
1105
        uVar27 = (undefined1)(uVar2 >> 0x10);
1106
        auVar26[5] = uVar27;
1107
        auVar26[4] = uVar27;
1108
        uVar27 = (undefined1)(uVar2 >> 8);
1109
        auVar26[3] = uVar27;
1110
        auVar26[2] = uVar27;
1111
        auVar26[0] = (undefined1)uVar2;
1112
        auVar26[1] = auVar26[0];
1113
        uVar2 = *(ulonglong *)((longlong)pWVar8 + uVar18 + 8);
1114
        uVar27 = (undefined1)(uVar2 >> 0x38);
1115
        auVar35._8_6_ = 0;
1116
        auVar35._0_8_ = uVar2;
1117
        auVar35[0xe] = uVar27;
1118
        auVar35[0xf] = uVar27;
1119
        uVar27 = (undefined1)(uVar2 >> 0x30);
1120
        auVar34._14_2_ = auVar35._14_2_;
1121
        auVar34._8_5_ = 0;
1122
        auVar34._0_8_ = uVar2;
1123
        auVar34[0xd] = uVar27;
1124
        auVar33._13_3_ = auVar34._13_3_;
1125
        auVar33._8_4_ = 0;
1126
        auVar33._0_8_ = uVar2;
1127
        auVar33[0xc] = uVar27;
1128
        uVar27 = (undefined1)(uVar2 >> 0x28);
1129
        auVar32._12_4_ = auVar33._12_4_;
1130
        auVar32._8_3_ = 0;
1131
        auVar32._0_8_ = uVar2;
1132
        auVar32[0xb] = uVar27;
1133
        auVar31._11_5_ = auVar32._11_5_;
1134
        auVar31._8_2_ = 0;
1135
        auVar31._0_8_ = uVar2;
1136
        auVar31[10] = uVar27;
1137
        uVar27 = (undefined1)(uVar2 >> 0x20);
1138
        auVar30._10_6_ = auVar31._10_6_;
1139
        auVar30[8] = 0;
1140
        auVar30._0_8_ = uVar2;
1141
        auVar30[9] = uVar27;
1142
        auVar29._9_7_ = auVar30._9_7_;
1143
        auVar29[8] = uVar27;
1144
        auVar29._0_8_ = uVar2;
1145
        uVar27 = (undefined1)(uVar2 >> 0x18);
1146
        auVar28._8_8_ = auVar29._8_8_;
1147
        auVar28[7] = uVar27;
1148
        auVar28[6] = uVar27;
1149
        uVar27 = (undefined1)(uVar2 >> 0x10);
1150
        auVar28[5] = uVar27;
1151
        auVar28[4] = uVar27;
1152
        uVar27 = (undefined1)(uVar2 >> 8);
1153
        auVar28[3] = uVar27;
1154
        auVar28[2] = uVar27;
1155
        auVar28[0] = (undefined1)uVar2;
1156
        auVar28[1] = auVar28[0];
1157
        auVar26 = psraw(auVar26,8);
1158
        auVar36 = psraw(auVar28,8);
1159
        *(undefined1 (*) [16])(pWVar10 + uVar18) = auVar26;
1160
        *(undefined1 (*) [16])(pWVar10 + uVar18 + 8) = auVar36;
1161
        uVar18 = uVar18 + 0x10;
1162
      } while (uVar16 != uVar18);
1163
      pWVar10 = pWVar11;
1164
      pWVar8 = (LPCWSTR)((longlong)pWVar8 + uVar16);
1165
      if (uVar15 == uVar16) goto LAB_140002cce;
1166
    }
1167
    uVar17 = (int)pWVar1 - (int)pWVar8 & 7;
1168
    uVar15 = (ulonglong)uVar17;
1169
    pWVar11 = pWVar8;
1170
    if (uVar17 != 0) {
1171
      do {
1172
        *pWVar10 = (short)(char)*pWVar11;
1173
        pWVar10 = pWVar10 + 1;
1174
        pWVar11 = (LPCWSTR)((longlong)pWVar11 + 1);
1175
        uVar15 = uVar15 - 1;
1176
      } while (uVar15 != 0);
1177
    }
1178
    if ((ulonglong)((longlong)pWVar8 - (longlong)pWVar1) < 0xfffffffffffffff9) {
1179
      do {
1180
        *pWVar10 = (short)(char)*pWVar11;
1181
        pWVar10[1] = (short)*(char *)((longlong)pWVar11 + 1);
1182
        pWVar10[2] = (short)(char)pWVar11[1];
1183
        pWVar10[3] = (short)*(char *)((longlong)pWVar11 + 3);
1184
        pWVar10[4] = (short)(char)pWVar11[2];
1185
        pWVar10[5] = (short)*(char *)((longlong)pWVar11 + 5);
1186
        pWVar10[6] = (short)(char)pWVar11[3];
1187
        pWVar10[7] = (short)*(char *)((longlong)pWVar11 + 7);
1188
        pWVar10 = pWVar10 + 8;
1189
        pWVar11 = pWVar11 + 4;
1190
      } while (pWVar11 != pWVar1);
1191
    }
1192
  }
1193
LAB_140002cce:
1194
  *pWVar10 = L'\0';
1195
  bVar4 = local_58[0];
1196
  if ((local_58[0] & 1) == 0) {
1197
    uVar15 = (ulonglong)(local_58[0] >> 1);
1198
  }
1199
  else {
1200
    uVar15 = local_58._8_8_;
1201
  }
1202
  dwBytes = uVar15 * 2 + 2;
1203
  pvVar12 = GlobalAlloc(2,dwBytes);
1204
  if (pvVar12 != (HGLOBAL)0x0) {
1205
    pvVar13 = GlobalLock(pvVar12);
1206
    pWVar8 = local_48;
1207
    if ((bVar4 & 1) == 0) {
1208
      pWVar8 = (LPCWSTR)(local_58 + 2);
1209
    }
1210
    memcpy(pvVar13,pWVar8,dwBytes);
1211
    GlobalUnlock(pvVar12);
1212
    SetClipboardData(0xd,pvVar12);
1213
  }
1214
  uVar15 = _DAT_140008098;
1215
  if ((DAT_140008090 & 1) == 0) {
1216
    uVar15 = (ulonglong)(DAT_140008090 >> 1);
1217
  }
1218
  pvVar12 = GlobalAlloc(2,uVar15 + 1);
1219
  if (pvVar12 != (HGLOBAL)0x0) {
1220
    pvVar13 = GlobalLock(pvVar12);
1221
    pWVar8 = (LPCWSTR)&DAT_140008091;
1222
    if ((DAT_140008090 & 1) != 0) {
1223
      pWVar8 = ram0x0001400080a0;
1224
    }
1225
    memcpy(pvVar13,pWVar8,uVar15 + 1);
1226
    GlobalUnlock(pvVar12);
1227
    SetClipboardData(1,pvVar12);
1228
  }
1229
  CloseClipboard();
1230
joined_r0x000140002dbd:
1231
  if ((bVar4 & 1) != 0) {
1232
    _ZdlPv(local_48);
1233
  }
1234
  return 0;
1235
}
1236

1237

1238

1239
DWORD __stdcall GetTickCount(void)
1240

1241
{
1242
  DWORD DVar1;
1243

1244
                    // WARNING: Could not recover jumptable at 0x000140002e10. Too many branches
1245
                    // WARNING: Treating indirect jump as call
1246
  DVar1 = GetTickCount();
1247
  return DVar1;
1248
}
1249

1250

1251

1252
// WARNING: Globals starting with '_' overlap smaller symbols at the same address
1253

1254
void FUN_140002e20(void)
1255

1256
{
1257
  DAT_140008078 = 0;
1258
  DAT_140008080 = 0;
1259
  _DAT_140008088 = 0;
1260
  FUN_1400013c0();
1261
  _DAT_140008090 = 0;
1262
  _DAT_140008098 = 0;
1263
  ram0x0001400080a0 = 0;
1264
  FUN_1400013c0();
1265
  ram0x0001400080a8 = 0;
1266
  ram0x0001400080b0 = 0;
1267
  _DAT_1400080b8 = 0;
1268
  FUN_1400013c0();
1269
  return;
1270
}
1271

1272

1273

1274
void FUN_140002e90(longlong *param_1,ulonglong param_2)
1275

1276
{
1277
  longlong lVar1;
1278
  void *pvVar2;
1279
  code *pcVar3;
1280
  ulonglong uVar4;
1281
  longlong lVar5;
1282
  ulonglong _Size;
1283
  void *_Dst;
1284
  ulonglong uVar6;
1285
  ulonglong uVar7;
1286
  ulonglong uVar8;
1287

1288
  lVar1 = *param_1;
1289
  pvVar2 = (void *)param_1[1];
1290
  uVar6 = (longlong)pvVar2 - lVar1;
1291
  _Size = param_2 - uVar6;
1292
  if (param_2 < uVar6 || _Size == 0) {
1293
    if (param_2 < uVar6) {
1294
      param_1[1] = lVar1 + param_2;
1295
    }
1296
  }
1297
  else if ((ulonglong)(param_1[2] - (longlong)pvVar2) < _Size) {
1298
    if ((longlong)param_2 < 0) {
1299
      FUN_140002fb0();
1300
      pcVar3 = (code *)swi(3);
1301
      (*pcVar3)();
1302
      return;
1303
    }
1304
    uVar7 = param_1[2] - lVar1;
1305
    uVar4 = uVar7 * 2;
1306
    if (uVar4 <= param_2) {
1307
      uVar4 = param_2;
1308
    }
1309
    uVar8 = 0x7fffffffffffffff;
1310
    if (uVar7 < 0x3fffffffffffffff) {
1311
      uVar8 = uVar4;
1312
    }
1313
    lVar5 = _Znwy(uVar8);
1314
    pvVar2 = (void *)*param_1;
1315
    lVar1 = param_1[1];
1316
    memset((void *)(uVar6 + lVar5),0,_Size);
1317
    _Dst = (void *)(((longlong)pvVar2 - lVar1) + (longlong)(uVar6 + lVar5));
1318
    memcpy(_Dst,pvVar2,lVar1 - (longlong)pvVar2);
1319
    *param_1 = (longlong)_Dst;
1320
    param_1[1] = lVar5 + param_2;
1321
    param_1[2] = uVar8 + lVar5;
1322
    if (pvVar2 != (void *)0x0) {
1323
      _ZdlPv(pvVar2);
1324
      return;
1325
    }
1326
  }
1327
  else {
1328
    memset(pvVar2,0,_Size);
1329
    param_1[1] = (longlong)pvVar2 + _Size;
1330
  }
1331
  return;
1332
}
1333

1334

1335

1336
void FUN_140002fb0(void)
1337

1338
{
1339
                    // WARNING: Subroutine does not return
1340
  FUN_140002fd0();
1341
}
1342

1343

1344

1345
void FUN_140002fd0(void)
1346

1347
{
1348
  code *pcVar1;
1349
  undefined8 *puVar2;
1350
  undefined8 uVar3;
1351

1352
  puVar2 = (undefined8 *)__cxa_allocate_exception(0x10);
1353
  FUN_140003020(puVar2);
1354
  uVar3 = __cxa_throw(puVar2,&PTR_PTR__ZdlPv_1400052a0,&DAT_1400045f0);
1355
  __cxa_free_exception(puVar2);
1356
  _Unwind_Resume(uVar3);
1357
  pcVar1 = (code *)swi(3);
1358
  (*pcVar1)();
1359
  return;
1360
}
1361

1362

1363

1364
void FUN_140003020(undefined8 *param_1)
1365

1366
{
1367
  _ZNSt11logic_errorC2EPKc();
1368
  *param_1 = _ZTVSt12length_error_exref + 0x10;
1369
  return;
1370
}
1371

1372

1373

1374
void FUN_140003050(void)
1375

1376
{
1377
  code *pcVar1;
1378
  undefined8 uVar2;
1379

1380
  uVar2 = __cxa_allocate_exception(8);
1381
  _ZNSt20bad_array_new_lengthC1Ev(uVar2);
1382
  __cxa_throw(uVar2,&PTR_PTR__ZdlPv_140005318,&DAT_140004610);
1383
  pcVar1 = (code *)swi(3);
1384
  (*pcVar1)();
1385
  return;
1386
}
1387

1388

1389

1390
void FUN_140003090(void)
1391

1392
{
1393
                    // WARNING: Subroutine does not return
1394
  FUN_140002fd0();
1395
}
1396

1397

1398

1399
void FUN_1400030b0(longlong *param_1,undefined8 *param_2)
1400

1401
{
1402
  void *_Src;
1403
  code *pcVar1;
1404
  ulonglong uVar2;
1405
  longlong lVar3;
1406
  ulonglong uVar4;
1407
  void *_Dst;
1408
  longlong lVar5;
1409
  undefined8 *puVar6;
1410
  ulonglong uVar7;
1411

1412
  puVar6 = (undefined8 *)param_1[1];
1413
  if (puVar6 < (undefined8 *)param_1[2]) {
1414
    *puVar6 = *param_2;
1415
    puVar6 = puVar6 + 1;
1416
LAB_14000317e:
1417
    param_1[1] = (longlong)puVar6;
1418
    return;
1419
  }
1420
  lVar5 = (longlong)puVar6 - *param_1;
1421
  uVar4 = (lVar5 >> 3) + 1;
1422
  if (uVar4 >> 0x3d == 0) {
1423
    uVar2 = param_1[2] - *param_1;
1424
    uVar7 = (longlong)uVar2 >> 2;
1425
    if (uVar7 <= uVar4) {
1426
      uVar7 = uVar4;
1427
    }
1428
    if (0x7ffffffffffffff7 < uVar2) {
1429
      uVar7 = 0x1fffffffffffffff;
1430
    }
1431
    if (uVar7 < 0x2000000000000000) {
1432
      lVar3 = _Znwy(uVar7 * 8);
1433
      *(undefined8 *)(lVar3 + lVar5) = *param_2;
1434
      puVar6 = (undefined8 *)(lVar5 + lVar3 + 8);
1435
      _Src = (void *)*param_1;
1436
      _Dst = (void *)((lVar3 + lVar5) - (param_1[1] - (longlong)_Src));
1437
      memcpy(_Dst,_Src,param_1[1] - (longlong)_Src);
1438
      *param_1 = (longlong)_Dst;
1439
      param_1[1] = (longlong)puVar6;
1440
      param_1[2] = lVar3 + uVar7 * 8;
1441
      if (_Src != (void *)0x0) {
1442
        _ZdlPv(_Src);
1443
      }
1444
      goto LAB_14000317e;
1445
    }
1446
  }
1447
  else {
1448
    FUN_1400031a0();
1449
  }
1450
  FUN_140003050();
1451
  pcVar1 = (code *)swi(3);
1452
  (*pcVar1)();
1453
  return;
1454
}
1455

1456

1457

1458
void FUN_1400031a0(void)
1459

1460
{
1461
                    // WARNING: Subroutine does not return
1462
  FUN_140002fd0();
1463
}
1464

1465

1466

1467
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1468
// WARNING: Removing unreachable block (ram,0x000140003209)
1469
// WARNING: Removing unreachable block (ram,0x000140003211)
1470
// WARNING: Removing unreachable block (ram,0x000140003200)
1471

1472
void tls_callback_0(undefined8 param_1,int param_2)
1473

1474
{
1475
  if (DAT_140008038 != 2) {
1476
    DAT_140008038 = 2;
1477
  }
1478
  if (param_2 == 1) {
1479
    FUN_140003d80(param_1,1);
1480
    return;
1481
  }
1482
  return;
1483
}
1484

1485

1486

1487
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1488

1489
undefined8 tls_callback_1(undefined8 param_1,int param_2)
1490

1491
{
1492
  DWORD *pDVar1;
1493
  DWORD *pDVar2;
1494
  DWORD DVar3;
1495
  undefined8 in_RAX;
1496
  LPVOID pvVar4;
1497

1498
  if ((param_2 != 3) && (param_2 != 0)) {
1499
    return in_RAX;
1500
  }
1501
  switch(param_2) {
1502
  case 0:
1503
    if (DAT_140008148 != 0) {
1504
      EnterCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
1505
      for (pDVar1 = DAT_140008178; pDVar1 != (DWORD *)0x0; pDVar1 = *(DWORD **)(pDVar1 + 4)) {
1506
        pvVar4 = TlsGetValue(*pDVar1);
1507
        DVar3 = GetLastError();
1508
        if ((DVar3 == 0) && (pvVar4 != (LPVOID)0x0)) {
1509
          (**(code **)(pDVar1 + 2))(pvVar4);
1510
        }
1511
      }
1512
      LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
1513
    }
1514
    if (DAT_140008148 == 1) {
1515
      DAT_140008148 = 1;
1516
      pDVar1 = DAT_140008178;
1517
      while (pDVar1 != (DWORD *)0x0) {
1518
        pDVar2 = *(DWORD **)(pDVar1 + 4);
1519
        free(pDVar1);
1520
        pDVar1 = pDVar2;
1521
      }
1522
      DAT_140008178 = (DWORD *)0x0;
1523
      DAT_140008148 = 0;
1524
      DeleteCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
1525
    }
1526
    break;
1527
  case 1:
1528
    if (DAT_140008148 == 0) {
1529
      InitializeCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
1530
    }
1531
    DAT_140008148 = 1;
1532
    break;
1533
  case 2:
1534
    FUN_140003570();
1535
    break;
1536
  case 3:
1537
    if (DAT_140008148 != 0) {
1538
      EnterCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
1539
      for (pDVar1 = DAT_140008178; pDVar1 != (DWORD *)0x0; pDVar1 = *(DWORD **)(pDVar1 + 4)) {
1540
        pvVar4 = TlsGetValue(*pDVar1);
1541
        DVar3 = GetLastError();
1542
        if ((DVar3 == 0) && (pvVar4 != (LPVOID)0x0)) {
1543
          (**(code **)(pDVar1 + 2))(pvVar4);
1544
        }
1545
      }
1546
      LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
1547
    }
1548
  }
1549
  return 1;
1550
}
1551

1552

1553

1554
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1555

1556
void FUN_140003260(void)
1557

1558
{
1559
  code *pcVar1;
1560

1561
  pcVar1 = *(code **)PTR_DAT_140008008;
1562
  while (pcVar1 != (code *)0x0) {
1563
    (*pcVar1)();
1564
    pcVar1 = *(code **)(PTR_DAT_140008008 + 8);
1565
    PTR_DAT_140008008 = PTR_DAT_140008008 + 8;
1566
  }
1567
  return;
1568
}
1569

1570

1571

1572
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1573

1574
void FUN_1400032b0(void)
1575

1576
{
1577
  uint uVar1;
1578
  uint uVar2;
1579
  ulonglong uVar3;
1580

1581
  uVar2 = 0xffffffff;
1582
  do {
1583
    uVar1 = uVar2 + 2;
1584
    uVar2 = uVar2 + 1;
1585
  } while ((&DAT_1400064b0)[uVar1] != 0);
1586
  if (uVar2 != 0) {
1587
    uVar3 = (ulonglong)uVar2;
1588
    do {
1589
      uVar3 = uVar3 - 1;
1590
      (*(code *)(&PTR_FUN_1400064b8)[uVar3])();
1591
    } while ((int)uVar3 != 0);
1592
  }
1593
  FUN_1400013c0();
1594
  return;
1595
}
1596

1597

1598

1599
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1600

1601
void FUN_140003320(void)
1602

1603
{
1604
  uint uVar1;
1605
  uint uVar2;
1606
  ulonglong uVar3;
1607

1608
  if (DAT_1400080f8 == '\0') {
1609
    DAT_1400080f8 = '\x01';
1610
    uVar2 = 0xffffffff;
1611
    do {
1612
      uVar1 = uVar2 + 2;
1613
      uVar2 = uVar2 + 1;
1614
    } while ((&DAT_1400064b0)[uVar1] != 0);
1615
    if (uVar2 != 0) {
1616
      uVar3 = (ulonglong)uVar2;
1617
      do {
1618
        uVar3 = uVar3 - 1;
1619
        (*(code *)(&PTR_FUN_1400064b8)[uVar3])();
1620
      } while ((int)uVar3 != 0);
1621
    }
1622
    FUN_1400013c0();
1623
    return;
1624
  }
1625
  return;
1626
}
1627

1628

1629

1630
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1631

1632
undefined8 FUN_1400033b0(undefined8 *param_1)
1633

1634
{
1635
  uint uVar1;
1636
  bool bVar2;
1637
  code *extraout_RAX;
1638
  code *extraout_RAX_00;
1639
  code *extraout_RAX_01;
1640
  code *pcVar3;
1641
  undefined8 uVar4;
1642
  undefined8 uVar5;
1643

1644
  uVar1 = *(uint *)*param_1;
1645
  if (((uVar1 & 0x20ffffff) == 0x20474343) && ((((uint *)*param_1)[1] & 1) == 0)) {
1646
    return 0xffffffff;
1647
  }
1648
  uVar5 = 0xffffffff;
1649
  if ((int)uVar1 < -0x3fffffe3) {
1650
    if (uVar1 == 0x80000002) {
1651
      return 0xffffffff;
1652
    }
1653
    if (uVar1 != 0xc0000005) {
1654
      if (uVar1 == 0xc0000008) {
1655
        return 0xffffffff;
1656
      }
1657
      goto LAB_1400034c3;
1658
    }
1659
    signal(0xb);
1660
    if (extraout_RAX_01 == (code *)0x0) goto LAB_1400034c3;
1661
    if (extraout_RAX_01 == (code *)0x1) {
1662
      signal(0xb);
1663
      return 0xffffffff;
1664
    }
1665
    uVar4 = 0xb;
1666
    pcVar3 = extraout_RAX_01;
1667
    goto LAB_1400034fa;
1668
  }
1669
  switch(uVar1) {
1670
  case 0xc000008c:
1671
  case 0xc0000092:
1672
  case 0xc0000095:
1673
    goto switchD_140003403_caseD_c000008c;
1674
  case 0xc000008d:
1675
  case 0xc000008e:
1676
  case 0xc000008f:
1677
  case 0xc0000090:
1678
  case 0xc0000091:
1679
  case 0xc0000093:
1680
    bVar2 = false;
1681
    break;
1682
  case 0xc0000094:
1683
    bVar2 = true;
1684
    break;
1685
  case 0xc0000096:
1686
    goto switchD_140003403_caseD_c0000096;
1687
  default:
1688
    if (uVar1 != 0xc000001d) goto LAB_1400034c3;
1689
switchD_140003403_caseD_c0000096:
1690
    signal(4);
1691
    if (extraout_RAX_00 == (code *)0x0) goto LAB_1400034c3;
1692
    if (extraout_RAX_00 == (code *)0x1) {
1693
      signal(4);
1694
      return 0xffffffff;
1695
    }
1696
    uVar4 = 4;
1697
    pcVar3 = extraout_RAX_00;
1698
    goto LAB_1400034fa;
1699
  }
1700
  signal(8);
1701
  if (extraout_RAX == (code *)0x0) {
1702
LAB_1400034c3:
1703
    if (DAT_140008100 != (code *)0x0) {
1704
                    // WARNING: Could not recover jumptable at 0x000140004370. Too many branches
1705
                    // WARNING: Treating indirect jump as call
1706
      uVar5 = (*DAT_140008100)(param_1);
1707
      return uVar5;
1708
    }
1709
    uVar5 = 0;
1710
  }
1711
  else if (extraout_RAX == (code *)0x1) {
1712
    signal(8);
1713
    if (!bVar2) {
1714
      FUN_140003570();
1715
    }
1716
  }
1717
  else {
1718
    uVar4 = 8;
1719
    pcVar3 = extraout_RAX;
1720
LAB_1400034fa:
1721
    (*pcVar3)(uVar4);
1722
  }
1723
switchD_140003403_caseD_c000008c:
1724
  return uVar5;
1725
}
1726

1727

1728

1729
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1730

1731
void FUN_140003510(undefined4 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4,
1732
                  undefined8 param_5)
1733

1734
{
1735
  undefined4 local_28 [2];
1736
  undefined8 local_20;
1737
  undefined8 local_18;
1738
  undefined8 local_10;
1739
  undefined8 local_8;
1740

1741
  if (DAT_140008108 != 0) {
1742
    local_8 = param_5;
1743
    local_28[0] = param_1;
1744
    local_20 = param_2;
1745
    local_18 = param_3;
1746
    local_10 = param_4;
1747
    (*(code *)DAT_140008108)(local_28);
1748
  }
1749
  return;
1750
}
1751

1752

1753

1754
void FUN_140003560(undefined8 param_1)
1755

1756
{
1757
  DAT_140008108 = param_1;
1758
  __setusermatherr();
1759
  return;
1760
}
1761

1762

1763

1764
void FUN_140003570(void)
1765

1766
{
1767
  return;
1768
}
1769

1770

1771

1772
undefined8 FUN_140003580(int *param_1)
1773

1774
{
1775
  undefined8 uVar1;
1776
  char *pcVar2;
1777

1778
  if (*param_1 - 1U < 6) {
1779
    pcVar2 = &DAT_1400060c8 + *(int *)(&DAT_1400060c8 + (ulonglong)(*param_1 - 1U) * 4);
1780
  }
1781
  else {
1782
    pcVar2 = "Unknown error";
1783
  }
1784
  uVar1 = __acrt_iob_func(2);
1785
  FUN_140003f20(uVar1,"_matherr(): %s in %s(%g, %g)  (retval=%g)\n",pcVar2,
1786
                *(undefined8 *)(param_1 + 2));
1787
  return 0;
1788
}
1789

1790

1791

1792
// WARNING: Removing unreachable block (ram,0x0001400038ec)
1793
// WARNING: Removing unreachable block (ram,0x0001400036bd)
1794
// WARNING: Removing unreachable block (ram,0x0001400036e0)
1795

1796
void FUN_1400035f0(undefined8 param_1,undefined8 param_2,void *param_3,ulonglong param_4)
1797

1798
{
1799
  DWORD flNewProtect;
1800
  LPVOID lpAddress;
1801
  SIZE_T dwSize;
1802
  uint uVar1;
1803
  longlong lVar2;
1804
  int iVar3;
1805
  uint uVar4;
1806
  ulonglong uVar5;
1807
  undefined1 *puVar6;
1808
  longlong lVar7;
1809
  undefined **ppuVar8;
1810
  longlong lVar9;
1811
  byte bVar10;
1812
  char *pcVar11;
1813
  ulonglong uVar12;
1814
  bool bVar13;
1815
  longlong alStack_90 [7];
1816
  undefined1 auStack_58 [16];
1817
  longlong local_48;
1818

1819
  if (DAT_140008130 == '\0') {
1820
    DAT_140008130 = '\x01';
1821
    alStack_90[2] = 0x140003622;
1822
    FUN_1400040f0();
1823
    alStack_90[6] = 0x14000363d;
1824
    uVar5 = FUN_140004300();
1825
    lVar2 = -uVar5;
1826
    DAT_140008138 = auStack_58 + lVar2;
1827
    DAT_140008140 = 0;
1828
    ppuVar8 = (undefined **)&DAT_140006414;
1829
    do {
1830
      bVar10 = *(byte *)(ppuVar8 + 1);
1831
      uVar1 = bVar10 - 8 >> 3;
1832
      uVar4 = (uint)bVar10 << 0x1d | uVar1;
1833
      if (7 < uVar4) {
1834
switchD_140003814_caseD_2:
1835
        local_48 = 0;
1836
                    // WARNING: Subroutine does not return
1837
        *(undefined8 *)((longlong)alStack_90 + lVar2 + 0x10) = 0x1400038ec;
1838
        FUN_140003aa0("  Unknown pseudo relocation bit size %d.\n",(ulonglong)bVar10,param_3,param_4
1839
                     );
1840
      }
1841
      pcVar11 = IMAGE_DOS_HEADER_140000000.e_magic + *(uint *)((longlong)ppuVar8 + 4);
1842
      param_4 = *(ulonglong *)(IMAGE_DOS_HEADER_140000000.e_magic + *(uint *)ppuVar8);
1843
      param_3 = (void *)((longlong)&switchD_140003814::switchdataD_1400060e0 +
1844
                        (longlong)(int)(&switchD_140003814::switchdataD_1400060e0)[uVar4]);
1845
      switch(uVar4) {
1846
      case 0:
1847
        uVar12 = (ulonglong)(byte)*pcVar11;
1848
        uVar5 = uVar12 - 0x100;
1849
        bVar13 = *pcVar11 < '\0';
1850
        break;
1851
      case 1:
1852
        uVar12 = (ulonglong)*(ushort *)pcVar11;
1853
        uVar5 = uVar12 - 0x10000;
1854
        bVar13 = (short)*(ushort *)pcVar11 < 0;
1855
        break;
1856
      default:
1857
        goto switchD_140003814_caseD_2;
1858
      case 3:
1859
        uVar12 = (ulonglong)*(uint *)pcVar11;
1860
        uVar5 = uVar12 - 0x100000000;
1861
        bVar13 = (int)*(uint *)pcVar11 < 0;
1862
        break;
1863
      case 7:
1864
        uVar5 = *(ulonglong *)pcVar11;
1865
        goto LAB_14000384b;
1866
      }
1867
      if (!bVar13) {
1868
        uVar5 = uVar12;
1869
      }
1870
LAB_14000384b:
1871
      local_48 = (uVar5 - (longlong)(IMAGE_DOS_HEADER_140000000.e_magic + *(uint *)ppuVar8)) +
1872
                 param_4;
1873
      if ((bVar10 < 0x40) &&
1874
         ((~(-1L << (bVar10 & 0x3f)) < local_48 || (local_48 < -1L << (bVar10 - 1 & 0x3f))))) {
1875
        *(longlong *)((longlong)alStack_90 + lVar2 + 0x28) = local_48;
1876
                    // WARNING: Subroutine does not return
1877
        *(undefined8 *)((longlong)alStack_90 + lVar2) = 0x1400038d4;
1878
        FUN_140003aa0("%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.\n"
1879
                      ,(ulonglong)bVar10,pcVar11,param_4);
1880
      }
1881
      bVar10 = 0x8bU >> ((byte)uVar1 & 0x1f) & uVar4 < 8;
1882
      param_3 = (void *)CONCAT71((int7)((ulonglong)local_48 >> 8),bVar10);
1883
      if (bVar10 == 1) {
1884
        param_3 = *(void **)(&DAT_140006248 + (ulonglong)uVar4 * 8);
1885
        *(undefined8 *)((longlong)alStack_90 + lVar2 + 0x10) = 0x1400038b3;
1886
        FUN_140003900(pcVar11,&local_48,param_3,param_4);
1887
      }
1888
      ppuVar8 = (undefined **)((longlong)ppuVar8 + 0xc);
1889
    } while (ppuVar8 < &PTR__guard_check_icall_140006450);
1890
    if (0 < DAT_140008140) {
1891
      lVar9 = 0x10;
1892
      lVar7 = 0;
1893
      puVar6 = DAT_140008138;
1894
      iVar3 = DAT_140008140;
1895
      do {
1896
        flNewProtect = *(DWORD *)(puVar6 + lVar9 + -0x10);
1897
        if (flNewProtect != 0) {
1898
          lpAddress = *(LPVOID *)(puVar6 + lVar9 + -8);
1899
          dwSize = *(SIZE_T *)(puVar6 + lVar9);
1900
          *(undefined8 *)((longlong)alStack_90 + lVar2 + 0x10) = 0x14000376c;
1901
          VirtualProtect(lpAddress,dwSize,flNewProtect,(PDWORD)&local_48);
1902
          puVar6 = DAT_140008138;
1903
          iVar3 = DAT_140008140;
1904
        }
1905
        lVar7 = lVar7 + 1;
1906
        lVar9 = lVar9 + 0x28;
1907
      } while (lVar7 < iVar3);
1908
    }
1909
  }
1910
  return;
1911
}
1912

1913

1914

1915
// WARNING: Enum "SectionFlags": Some values do not have unique names
1916

1917
void FUN_140003900(void *param_1,void *param_2,void *param_3,ulonglong param_4)
1918

1919
{
1920
  uint uVar1;
1921
  longlong lVar2;
1922
  BOOL BVar3;
1923
  DWORD DVar4;
1924
  IMAGE_SECTION_HEADER *pIVar5;
1925
  IMAGE_DOS_HEADER *pIVar6;
1926
  SIZE_T SVar7;
1927
  longlong lVar8;
1928
  void *pvVar9;
1929
  undefined8 uVar10;
1930
  PDWORD lpflOldProtect;
1931
  longlong lVar11;
1932
  _MEMORY_BASIC_INFORMATION local_60;
1933

1934
  lVar11 = (longlong)DAT_140008140;
1935
  if (lVar11 < 1) {
1936
    lVar11 = 0;
1937
    pvVar9 = param_3;
1938
  }
1939
  else {
1940
    lVar8 = 0;
1941
    do {
1942
      pvVar9 = *(void **)(DAT_140008138 + 0x18 + lVar8);
1943
      if (pvVar9 <= param_1) {
1944
        param_4 = (ulonglong)*(uint *)(*(longlong *)(DAT_140008138 + 0x20 + lVar8) + 8);
1945
        pvVar9 = (void *)((longlong)pvVar9 + param_4);
1946
        if (param_1 < pvVar9) goto LAB_140003a37;
1947
      }
1948
      lVar8 = lVar8 + 0x28;
1949
    } while (lVar11 * 0x28 != lVar8);
1950
  }
1951
  pIVar5 = FUN_140004080((longlong)param_1);
1952
  lVar8 = DAT_140008138;
1953
  if (pIVar5 == (IMAGE_SECTION_HEADER *)0x0) {
1954
                    // WARNING: Subroutine does not return
1955
    FUN_140003aa0("Address %p has no image-section",param_1,pvVar9,param_4);
1956
  }
1957
  lVar2 = lVar11 * 0x28;
1958
  *(IMAGE_SECTION_HEADER **)(DAT_140008138 + 0x20 + lVar2) = pIVar5;
1959
  *(undefined4 *)(lVar8 + lVar2) = 0;
1960
  pIVar6 = FUN_140004180();
1961
  uVar1 = pIVar5->VirtualAddress;
1962
  *(char **)(DAT_140008138 + 0x18 + lVar2) = pIVar6->e_magic + uVar1;
1963
  SVar7 = VirtualQuery(pIVar6->e_magic + uVar1,&local_60,0x30);
1964
  lVar8 = DAT_140008138;
1965
  if (SVar7 == 0) {
1966
                    // WARNING: Subroutine does not return
1967
    FUN_140003aa0("  VirtualQuery failed for %d bytes at address %p",
1968
                  (ulonglong)(pIVar5->Misc).PhysicalAddress,
1969
                  *(undefined8 *)(DAT_140008138 + 0x18 + lVar11 * 0x28),param_4);
1970
  }
1971
  if ((int)local_60.Protect < 8) {
1972
    uVar10 = 4;
1973
    if (local_60.Protect != 2) {
1974
      if (local_60.Protect == 4) goto LAB_140003a31;
1975
      goto LAB_1400039fe;
1976
    }
1977
  }
1978
  else {
1979
    if (((local_60.Protect == 8) || (local_60.Protect == 0x40)) || (local_60.Protect == 0x80))
1980
    goto LAB_140003a31;
1981
LAB_1400039fe:
1982
    uVar10 = 0x40;
1983
  }
1984
  lpflOldProtect = (PDWORD)(DAT_140008138 + lVar11 * 0x28);
1985
  *(PVOID *)(DAT_140008138 + 8 + lVar11 * 0x28) = local_60.BaseAddress;
1986
  *(SIZE_T *)(lVar8 + 0x10 + lVar11 * 0x28) = local_60.RegionSize;
1987
  BVar3 = VirtualProtect(local_60.BaseAddress,local_60.RegionSize,(DWORD)uVar10,lpflOldProtect);
1988
  if (BVar3 == 0) {
1989
    DVar4 = GetLastError();
1990
                    // WARNING: Subroutine does not return
1991
    FUN_140003aa0("  VirtualProtect failed with code 0x%x",(ulonglong)DVar4,uVar10,lpflOldProtect);
1992
  }
1993
LAB_140003a31:
1994
  DAT_140008140 = DAT_140008140 + 1;
1995
LAB_140003a37:
1996
  memcpy(param_1,param_2,(size_t)param_3);
1997
  return;
1998
}
1999

2000

2001

2002
void FUN_140003aa0(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)
2003

2004
{
2005
  undefined8 uVar1;
2006
  undefined8 local_res10;
2007
  undefined8 local_res18;
2008
  undefined8 local_res20;
2009

2010
  local_res10 = param_2;
2011
  local_res18 = param_3;
2012
  local_res20 = param_4;
2013
  uVar1 = __acrt_iob_func(2);
2014
  FUN_140003f20(uVar1,"Mingw-w64 runtime failure:\n",param_3,param_4);
2015
  uVar1 = __acrt_iob_func(2);
2016
  FUN_140004330(uVar1,param_1,&local_res10);
2017
                    // WARNING: Subroutine does not return
2018
  abort();
2019
}
2020

2021

2022

2023
undefined8 FUN_140003b00(void)
2024

2025
{
2026
  return 0;
2027
}
2028

2029

2030

2031
void FUN_140003b10(void)
2032

2033
{
2034
  short *psVar1;
2035
  ushort uVar2;
2036
  bool bVar3;
2037
  longlong *plVar4;
2038
  undefined *puVar5;
2039
  uint uVar6;
2040
  _STARTUPINFOW local_70;
2041

2042
  plVar4 = (longlong *)__p__wcmdln();
2043
  if (*plVar4 == 0) {
2044
    puVar5 = &DAT_140006298;
2045
  }
2046
  else {
2047
    puVar5 = (undefined *)(*plVar4 + -2);
2048
    bVar3 = false;
2049
    while ((uVar2 = *(ushort *)(puVar5 + 2), 0x20 < uVar2 || ((uVar2 != 0 && (bVar3))))) {
2050
      bVar3 = (bool)(bVar3 ^ uVar2 == 0x22);
2051
      puVar5 = puVar5 + 2;
2052
    }
2053
    do {
2054
      psVar1 = (short *)(puVar5 + 2);
2055
      puVar5 = puVar5 + 2;
2056
    } while ((ushort)(*psVar1 - 1U) < 0x20);
2057
  }
2058
  GetStartupInfoW(&local_70);
2059
  uVar6 = 10;
2060
  if (((byte)local_70.dwFlags & 1) != 0) {
2061
    uVar6 = (uint)local_70.wShowWindow;
2062
  }
2063
  FUN_140001440((HINSTANCE)&IMAGE_DOS_HEADER_140000000,0,puVar5,uVar6);
2064
  return;
2065
}
2066

2067

2068

2069
void _guard_check_icall(void)
2070

2071
{
2072
  return;
2073
}
2074

2075

2076

2077
undefined * FUN_140003bd0(void)
2078

2079
{
2080
  return PTR_DAT_140008040;
2081
}
2082

2083

2084

2085
undefined8
2086
FUN_140003be0(undefined4 *param_1,undefined8 *param_2,undefined8 *param_3,int param_4,
2087
             undefined4 *param_5)
2088

2089
{
2090
  undefined4 *puVar1;
2091
  undefined8 *puVar2;
2092

2093
  _initialize_wide_environment();
2094
  _configure_wide_argv(2 - (uint)(param_4 == 0));
2095
  puVar1 = (undefined4 *)__p___argc();
2096
  *param_1 = *puVar1;
2097
  puVar2 = (undefined8 *)__p___wargv();
2098
  *param_2 = *puVar2;
2099
  puVar2 = (undefined8 *)__p__wenviron();
2100
  *param_3 = *puVar2;
2101
  _set_new_mode(*param_5);
2102
  return 0;
2103
}
2104

2105

2106

2107
void FUN_140003c50(uint param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)
2108

2109
{
2110
  undefined8 uVar1;
2111

2112
  uVar1 = __acrt_iob_func(2);
2113
  FUN_140003f20(uVar1,"runtime error %d\n",(ulonglong)param_1,param_4);
2114
                    // WARNING: Subroutine does not return
2115
  _exit(0xff);
2116
}
2117

2118

2119

2120
undefined8 FUN_140003c80(undefined4 param_1,undefined8 param_2)
2121

2122
{
2123
  undefined4 *puVar1;
2124
  undefined8 uVar2;
2125

2126
  uVar2 = 0;
2127
  if (DAT_140008148 != 0) {
2128
    puVar1 = calloc(1,0x18);
2129
    if (puVar1 == (undefined4 *)0x0) {
2130
      uVar2 = 0xffffffff;
2131
    }
2132
    else {
2133
      *puVar1 = param_1;
2134
      *(undefined8 *)(puVar1 + 2) = param_2;
2135
      EnterCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2136
      *(undefined4 **)(puVar1 + 4) = DAT_140008178;
2137
      DAT_140008178 = puVar1;
2138
      LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2139
    }
2140
  }
2141
  return uVar2;
2142
}
2143

2144

2145

2146
undefined8 FUN_140003cf0(int param_1)
2147

2148
{
2149
  int *piVar1;
2150
  int *piVar2;
2151
  int *_Memory;
2152

2153
  if (DAT_140008148 != 0) {
2154
    EnterCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2155
    if (DAT_140008178 != (int *)0x0) {
2156
      _Memory = DAT_140008178;
2157
      if (*DAT_140008178 == param_1) {
2158
        piVar2 = (int *)0x0;
2159
      }
2160
      else {
2161
        do {
2162
          piVar2 = _Memory;
2163
          _Memory = *(int **)(piVar2 + 4);
2164
          if (_Memory == (int *)0x0) goto LAB_140003d62;
2165
        } while (*_Memory != param_1);
2166
      }
2167
      piVar1 = *(int **)(_Memory + 4);
2168
      if (piVar2 != (int *)0x0) {
2169
        *(int **)(piVar2 + 4) = *(int **)(_Memory + 4);
2170
        piVar1 = DAT_140008178;
2171
      }
2172
      DAT_140008178 = piVar1;
2173
      free(_Memory);
2174
    }
2175
LAB_140003d62:
2176
    LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2177
  }
2178
  return 0;
2179
}
2180

2181

2182

2183
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
2184

2185
undefined8 FUN_140003d80(undefined8 param_1,undefined4 param_2)
2186

2187
{
2188
  DWORD *pDVar1;
2189
  DWORD *pDVar2;
2190
  DWORD DVar3;
2191
  LPVOID pvVar4;
2192

2193
  switch(param_2) {
2194
  case 0:
2195
    if (DAT_140008148 != 0) {
2196
      EnterCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2197
      for (pDVar1 = DAT_140008178; pDVar1 != (DWORD *)0x0; pDVar1 = *(DWORD **)(pDVar1 + 4)) {
2198
        pvVar4 = TlsGetValue(*pDVar1);
2199
        DVar3 = GetLastError();
2200
        if ((DVar3 == 0) && (pvVar4 != (LPVOID)0x0)) {
2201
          (**(code **)(pDVar1 + 2))(pvVar4);
2202
        }
2203
      }
2204
      LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2205
    }
2206
    if (DAT_140008148 == 1) {
2207
      DAT_140008148 = 1;
2208
      pDVar1 = DAT_140008178;
2209
      while (pDVar1 != (DWORD *)0x0) {
2210
        pDVar2 = *(DWORD **)(pDVar1 + 4);
2211
        free(pDVar1);
2212
        pDVar1 = pDVar2;
2213
      }
2214
      DAT_140008178 = (DWORD *)0x0;
2215
      DAT_140008148 = 0;
2216
      DeleteCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2217
    }
2218
    break;
2219
  case 1:
2220
    if (DAT_140008148 == 0) {
2221
      InitializeCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2222
    }
2223
    DAT_140008148 = 1;
2224
    break;
2225
  case 2:
2226
    FUN_140003570();
2227
    break;
2228
  case 3:
2229
    if (DAT_140008148 != 0) {
2230
      EnterCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2231
      for (pDVar1 = DAT_140008178; pDVar1 != (DWORD *)0x0; pDVar1 = *(DWORD **)(pDVar1 + 4)) {
2232
        pvVar4 = TlsGetValue(*pDVar1);
2233
        DVar3 = GetLastError();
2234
        if ((DVar3 == 0) && (pvVar4 != (LPVOID)0x0)) {
2235
          (**(code **)(pDVar1 + 2))(pvVar4);
2236
        }
2237
      }
2238
      LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2239
    }
2240
  }
2241
  return 1;
2242
}
2243

2244

2245

2246
void FUN_140003f20(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)
2247

2248
{
2249
  undefined8 *puVar1;
2250
  undefined8 local_res18;
2251
  undefined8 local_res20;
2252

2253
  local_res18 = param_3;
2254
  local_res20 = param_4;
2255
  puVar1 = (undefined8 *)FUN_140004380();
2256
  __stdio_common_vfprintf(*puVar1,param_1,param_2,0,&local_res18);
2257
  return;
2258
}
2259

2260

2261

2262
// WARNING: Enum "SectionFlags": Some values do not have unique names
2263

2264
IMAGE_SECTION_HEADER * FUN_140003fe0(char *param_1)
2265

2266
{
2267
  int iVar1;
2268
  size_t sVar2;
2269
  uint uVar3;
2270
  IMAGE_SECTION_HEADER *_Str1;
2271

2272
  sVar2 = strlen(param_1);
2273
  if (sVar2 < 9) {
2274
    _Str1 = &IMAGE_SECTION_HEADER_140000180;
2275
    uVar3 = 0;
2276
    do {
2277
      iVar1 = strncmp(_Str1->Name,param_1,8);
2278
      if (iVar1 == 0) {
2279
        return _Str1;
2280
      }
2281
      uVar3 = uVar3 + 1;
2282
      _Str1 = _Str1 + 1;
2283
    } while (uVar3 < 7);
2284
  }
2285
  return (IMAGE_SECTION_HEADER *)0x0;
2286
}
2287

2288

2289

2290
// WARNING: Enum "SectionFlags": Some values do not have unique names
2291

2292
IMAGE_SECTION_HEADER * FUN_140004080(longlong param_1)
2293

2294
{
2295
  IMAGE_SECTION_HEADER *pIVar1;
2296
  int iVar2;
2297

2298
  iVar2 = 7;
2299
  pIVar1 = &IMAGE_SECTION_HEADER_140000180;
2300
  while ((param_1 - 0x140000000U < (ulonglong)(uint)pIVar1->VirtualAddress ||
2301
         ((ulonglong)(pIVar1->VirtualAddress + (pIVar1->Misc).PhysicalAddress) <=
2302
          param_1 - 0x140000000U))) {
2303
    pIVar1 = pIVar1 + 1;
2304
    iVar2 = iVar2 + -1;
2305
    if (iVar2 == 0) {
2306
      return (IMAGE_SECTION_HEADER *)0x0;
2307
    }
2308
  }
2309
  return pIVar1;
2310
}
2311

2312

2313

2314
word FUN_1400040f0(void)
2315

2316
{
2317
  return 7;
2318
}
2319

2320

2321

2322
// WARNING: Removing unreachable block (ram,0x0001400041a4)
2323

2324
IMAGE_DOS_HEADER * FUN_140004180(void)
2325

2326
{
2327
  return &IMAGE_DOS_HEADER_140000000;
2328
}
2329

2330

2331

2332
// WARNING: Removing unreachable block (ram,0x0001400042cd)
2333
// WARNING: Enum "SectionFlags": Some values do not have unique names
2334

2335
char * FUN_140004240(int param_1)
2336

2337
{
2338
  uint *puVar1;
2339
  dword *pdVar2;
2340
  uint *puVar3;
2341
  longlong lVar4;
2342

2343
  lVar4 = 0;
2344
  while ((0x64d8 < *(uint *)(IMAGE_SECTION_HEADER_140000180.Name + lVar4 + 0xc) ||
2345
         (*(uint *)(IMAGE_SECTION_HEADER_140000180.Name + lVar4 + 0xc) +
2346
          *(int *)(IMAGE_SECTION_HEADER_140000180.Name + lVar4 + 8) < 0x64d9))) {
2347
    lVar4 = lVar4 + 0x28;
2348
    if ((int)lVar4 == 0x118) {
2349
      return (char *)0x0;
2350
    }
2351
  }
2352
  pdVar2 = &DWORD_1400064e4;
2353
  do {
2354
    puVar3 = pdVar2;
2355
    if (*pdVar2 == 0) {
2356
      return (char *)0x0;
2357
    }
2358
    do {
2359
      if (param_1 < 1) {
2360
        return IMAGE_DOS_HEADER_140000000.e_magic + *puVar3;
2361
      }
2362
      param_1 = param_1 + -1;
2363
      pdVar2 = puVar3 + 5;
2364
      puVar1 = puVar3 + 3;
2365
      puVar3 = pdVar2;
2366
    } while (*puVar1 != 0);
2367
  } while( true );
2368
}
2369

2370

2371

2372
ulonglong FUN_140004300(void)
2373

2374
{
2375
  ulonglong in_RAX;
2376
  ulonglong uVar1;
2377

2378
  uVar1 = in_RAX;
2379
  if (0xfff < in_RAX) {
2380
    do {
2381
      uVar1 = uVar1 - 0x1000;
2382
    } while (0x1000 < uVar1);
2383
  }
2384
  return in_RAX;
2385
}
2386

2387

2388

2389
void FUN_140004330(undefined8 param_1,undefined8 param_2,undefined8 param_3)
2390

2391
{
2392
  undefined8 *puVar1;
2393

2394
  puVar1 = (undefined8 *)FUN_140004380();
2395
  __stdio_common_vfprintf(*puVar1,param_1,param_2,0,param_3);
2396
  return;
2397
}
2398

2399

2400

2401
// WARNING: This is an inlined function
2402

2403
void _guard_dispatch_icall(void)
2404

2405
{
2406
  code *UNRECOVERED_JUMPTABLE;
2407

2408
                    // WARNING: Could not recover jumptable at 0x000140004370. Too many branches
2409
                    // WARNING: Treating indirect jump as call
2410
  (*UNRECOVERED_JUMPTABLE)();
2411
  return;
2412
}
2413

2414

2415

2416
undefined * FUN_140004380(void)
2417

2418
{
2419
  return &DAT_140008048;
2420
}
2421

2422

2423

2424
void _ZNSt11logic_errorC2EPKc(void)
2425

2426
{
2427
                    // WARNING: Could not recover jumptable at 0x0001400045e0. Too many branches
2428
                    // WARNING: Treating indirect jump as call
2429
  _ZNSt11logic_errorC2EPKc();
2430
  return;
2431
}
2432

2433

2434

2435
void _ZNSt20bad_array_new_lengthC1Ev(void)
2436

2437
{
2438
                    // WARNING: Could not recover jumptable at 0x000140004600. Too many branches
2439
                    // WARNING: Treating indirect jump as call
2440
  _ZNSt20bad_array_new_lengthC1Ev();
2441
  return;
2442
}
2443

2444

2445

2446
void _ZNSt3__110to_wstringEj(void)
2447

2448
{
2449
                    // WARNING: Could not recover jumptable at 0x000140004620. Too many branches
2450
                    // WARNING: Treating indirect jump as call
2451
  _ZNSt3__110to_wstringEj();
2452
  return;
2453
}
2454

2455

2456

2457
void _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKw(void)
2458

2459
{
2460
                    // WARNING: Could not recover jumptable at 0x000140004630. Too many branches
2461
                    // WARNING: Treating indirect jump as call
2462
  _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKw();
2463
  return;
2464
}
2465

2466

2467

2468
void _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKwy(void)
2469

2470
{
2471
                    // WARNING: Could not recover jumptable at 0x000140004640. Too many branches
2472
                    // WARNING: Treating indirect jump as call
2473
  _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKwy();
2474
  return;
2475
}
2476

2477

2478

2479
void _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6insertEyPKw(void)
2480

2481
{
2482
                    // WARNING: Could not recover jumptable at 0x000140004650. Too many branches
2483
                    // WARNING: Treating indirect jump as call
2484
  _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6insertEyPKw();
2485
  return;
2486
}
2487

2488

2489

2490
void _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE7reserveEy(void)
2491

2492
{
2493
                    // WARNING: Could not recover jumptable at 0x000140004660. Too many branches
2494
                    // WARNING: Treating indirect jump as call
2495
  _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE7reserveEy();
2496
  return;
2497
}
2498

2499

2500

2501
void _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE9push_backEw(void)
2502

2503
{
2504
                    // WARNING: Could not recover jumptable at 0x000140004670. Too many branches
2505
                    // WARNING: Treating indirect jump as call
2506
  _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE9push_backEw();
2507
  return;
2508
}
2509

2510

2511

2512
void _ZdlPv(void)
2513

2514
{
2515
                    // WARNING: Could not recover jumptable at 0x000140004680. Too many branches
2516
                    // WARNING: Treating indirect jump as call
2517
  _ZdlPv();
2518
  return;
2519
}
2520

2521

2522

2523
void _Znwy(void)
2524

2525
{
2526
                    // WARNING: Could not recover jumptable at 0x000140004690. Too many branches
2527
                    // WARNING: Treating indirect jump as call
2528
  _Znwy();
2529
  return;
2530
}
2531

2532

2533

2534
void __cxa_allocate_exception(void)
2535

2536
{
2537
                    // WARNING: Could not recover jumptable at 0x0001400046a0. Too many branches
2538
                    // WARNING: Treating indirect jump as call
2539
  __cxa_allocate_exception();
2540
  return;
2541
}
2542

2543

2544

2545
void __cxa_free_exception(void)
2546

2547
{
2548
                    // WARNING: Could not recover jumptable at 0x0001400046b0. Too many branches
2549
                    // WARNING: Treating indirect jump as call
2550
  __cxa_free_exception();
2551
  return;
2552
}
2553

2554

2555

2556
void __cxa_throw(void)
2557

2558
{
2559
                    // WARNING: Could not recover jumptable at 0x0001400046c0. Too many branches
2560
                    // WARNING: Treating indirect jump as call
2561
  __cxa_throw();
2562
  return;
2563
}
2564

2565

2566

2567
void _Unwind_Resume(void)
2568

2569
{
2570
                    // WARNING: Could not recover jumptable at 0x0001400046e0. Too many branches
2571
                    // WARNING: Treating indirect jump as call
2572
  _Unwind_Resume();
2573
  return;
2574
}
2575

2576

2577

2578
void __p__commode(void)
2579

2580
{
2581
                    // WARNING: Could not recover jumptable at 0x000140004700. Too many branches
2582
                    // WARNING: Treating indirect jump as call
2583
  __p__commode();
2584
  return;
2585
}
2586

2587

2588

2589
void __p__fmode(void)
2590

2591
{
2592
                    // WARNING: Could not recover jumptable at 0x000140004710. Too many branches
2593
                    // WARNING: Treating indirect jump as call
2594
  __p__fmode();
2595
  return;
2596
}
2597

2598

2599

2600
void __cdecl _cexit(void)
2601

2602
{
2603
                    // WARNING: Could not recover jumptable at 0x000140004720. Too many branches
2604
                    // WARNING: Treating indirect jump as call
2605
  _cexit();
2606
  return;
2607
}
2608

2609

2610

2611
int __cdecl _configthreadlocale(int _Flag)
2612

2613
{
2614
  int iVar1;
2615

2616
                    // WARNING: Could not recover jumptable at 0x000140004730. Too many branches
2617
                    // WARNING: Treating indirect jump as call
2618
  iVar1 = _configthreadlocale(_Flag);
2619
  return iVar1;
2620
}
2621

2622

2623

2624
void _crt_atexit(void)
2625

2626
{
2627
                    // WARNING: Could not recover jumptable at 0x000140004740. Too many branches
2628
                    // WARNING: Treating indirect jump as call
2629
  _crt_atexit();
2630
  return;
2631
}
2632

2633

2634

2635
void _initterm(void)
2636

2637
{
2638
                    // WARNING: Could not recover jumptable at 0x000140004750. Too many branches
2639
                    // WARNING: Treating indirect jump as call
2640
  _initterm();
2641
  return;
2642
}
2643

2644

2645

2646
void _initterm_e(void)
2647

2648
{
2649
                    // WARNING: Could not recover jumptable at 0x000140004760. Too many branches
2650
                    // WARNING: Treating indirect jump as call
2651
  _initterm_e();
2652
  return;
2653
}
2654

2655

2656

2657
_invalid_parameter_handler __cdecl
2658
_set_invalid_parameter_handler(_invalid_parameter_handler _Handler)
2659

2660
{
2661
  _invalid_parameter_handler p_Var1;
2662

2663
                    // WARNING: Could not recover jumptable at 0x000140004770. Too many branches
2664
                    // WARNING: Treating indirect jump as call
2665
  p_Var1 = _set_invalid_parameter_handler(_Handler);
2666
  return p_Var1;
2667
}
2668

2669

2670

2671
void __cdecl exit(int _Code)
2672

2673
{
2674
                    // WARNING: Could not recover jumptable at 0x000140004780. Too many branches
2675
                    // WARNING: Subroutine does not return
2676
                    // WARNING: Treating indirect jump as call
2677
  exit(_Code);
2678
  return;
2679
}
2680

2681

2682

2683
void * __cdecl malloc(size_t _Size)
2684

2685
{
2686
  void *pvVar1;
2687

2688
                    // WARNING: Could not recover jumptable at 0x000140004790. Too many branches
2689
                    // WARNING: Treating indirect jump as call
2690
  pvVar1 = malloc(_Size);
2691
  return pvVar1;
2692
}
2693

2694

2695

2696
void * __cdecl memcpy(void *_Dst,void *_Src,size_t _Size)
2697

2698
{
2699
  void *pvVar1;
2700

2701
                    // WARNING: Could not recover jumptable at 0x0001400047a0. Too many branches
2702
                    // WARNING: Treating indirect jump as call
2703
  pvVar1 = memcpy(_Dst,_Src,_Size);
2704
  return pvVar1;
2705
}
2706

2707

2708

2709
void * __cdecl memmove(void *_Dst,void *_Src,size_t _Size)
2710

2711
{
2712
  void *pvVar1;
2713

2714
                    // WARNING: Could not recover jumptable at 0x0001400047b0. Too many branches
2715
                    // WARNING: Treating indirect jump as call
2716
  pvVar1 = memmove(_Dst,_Src,_Size);
2717
  return pvVar1;
2718
}
2719

2720

2721

2722
void * __cdecl memset(void *_Dst,int _Val,size_t _Size)
2723

2724
{
2725
  void *pvVar1;
2726

2727
                    // WARNING: Could not recover jumptable at 0x0001400047c0. Too many branches
2728
                    // WARNING: Treating indirect jump as call
2729
  pvVar1 = memset(_Dst,_Val,_Size);
2730
  return pvVar1;
2731
}
2732

2733

2734

2735
size_t __cdecl wcslen(wchar_t *_Str)
2736

2737
{
2738
  size_t sVar1;
2739

2740
                    // WARNING: Could not recover jumptable at 0x0001400047d0. Too many branches
2741
                    // WARNING: Treating indirect jump as call
2742
  sVar1 = wcslen(_Str);
2743
  return sVar1;
2744
}
2745

2746

2747

2748
// WARNING: Unknown calling convention -- yet parameter storage is locked
2749

2750
void signal(int param_1)
2751

2752
{
2753
                    // WARNING: Could not recover jumptable at 0x000140004890. Too many branches
2754
                    // WARNING: Treating indirect jump as call
2755
  signal(param_1);
2756
  return;
2757
}
2758

2759

2760

2761
void __setusermatherr(void)
2762

2763
{
2764
                    // WARNING: Could not recover jumptable at 0x0001400048a0. Too many branches
2765
                    // WARNING: Treating indirect jump as call
2766
  __setusermatherr();
2767
  return;
2768
}
2769

2770

2771

2772
void __acrt_iob_func(void)
2773

2774
{
2775
                    // WARNING: Could not recover jumptable at 0x0001400048b0. Too many branches
2776
                    // WARNING: Treating indirect jump as call
2777
  __acrt_iob_func();
2778
  return;
2779
}
2780

2781

2782

2783
void __cdecl abort(void)
2784

2785
{
2786
                    // WARNING: Could not recover jumptable at 0x0001400048f0. Too many branches
2787
                    // WARNING: Subroutine does not return
2788
                    // WARNING: Treating indirect jump as call
2789
  abort();
2790
  return;
2791
}
2792

2793

2794

2795
void __p__wcmdln(void)
2796

2797
{
2798
                    // WARNING: Could not recover jumptable at 0x000140004900. Too many branches
2799
                    // WARNING: Treating indirect jump as call
2800
  __p__wcmdln();
2801
  return;
2802
}
2803

2804

2805

2806
void _set_app_type(void)
2807

2808
{
2809
                    // WARNING: Could not recover jumptable at 0x000140004920. Too many branches
2810
                    // WARNING: Treating indirect jump as call
2811
  _set_app_type();
2812
  return;
2813
}
2814

2815

2816

2817
void _initialize_wide_environment(void)
2818

2819
{
2820
                    // WARNING: Could not recover jumptable at 0x000140004930. Too many branches
2821
                    // WARNING: Treating indirect jump as call
2822
  _initialize_wide_environment();
2823
  return;
2824
}
2825

2826

2827

2828
void _configure_wide_argv(void)
2829

2830
{
2831
                    // WARNING: Could not recover jumptable at 0x000140004940. Too many branches
2832
                    // WARNING: Treating indirect jump as call
2833
  _configure_wide_argv();
2834
  return;
2835
}
2836

2837

2838

2839
void __p___argc(void)
2840

2841
{
2842
                    // WARNING: Could not recover jumptable at 0x000140004950. Too many branches
2843
                    // WARNING: Treating indirect jump as call
2844
  __p___argc();
2845
  return;
2846
}
2847

2848

2849

2850
void __p___wargv(void)
2851

2852
{
2853
                    // WARNING: Could not recover jumptable at 0x000140004960. Too many branches
2854
                    // WARNING: Treating indirect jump as call
2855
  __p___wargv();
2856
  return;
2857
}
2858

2859

2860

2861
void __p__wenviron(void)
2862

2863
{
2864
                    // WARNING: Could not recover jumptable at 0x000140004970. Too many branches
2865
                    // WARNING: Treating indirect jump as call
2866
  __p__wenviron();
2867
  return;
2868
}
2869

2870

2871

2872
void _set_new_mode(void)
2873

2874
{
2875
                    // WARNING: Could not recover jumptable at 0x000140004980. Too many branches
2876
                    // WARNING: Treating indirect jump as call
2877
  _set_new_mode();
2878
  return;
2879
}
2880

2881

2882

2883
void __cdecl _exit(int _Code)
2884

2885
{
2886
                    // WARNING: Could not recover jumptable at 0x000140004990. Too many branches
2887
                    // WARNING: Subroutine does not return
2888
                    // WARNING: Treating indirect jump as call
2889
  _exit(_Code);
2890
  return;
2891
}
2892

2893

2894

2895
void * __cdecl calloc(size_t _Count,size_t _Size)
2896

2897
{
2898
  void *pvVar1;
2899

2900
                    // WARNING: Could not recover jumptable at 0x0001400049a0. Too many branches
2901
                    // WARNING: Treating indirect jump as call
2902
  pvVar1 = calloc(_Count,_Size);
2903
  return pvVar1;
2904
}
2905

2906

2907

2908
void __cdecl free(void *_Memory)
2909

2910
{
2911
                    // WARNING: Could not recover jumptable at 0x0001400049d0. Too many branches
2912
                    // WARNING: Treating indirect jump as call
2913
  free(_Memory);
2914
  return;
2915
}
2916

2917

2918

2919
void __stdio_common_vfprintf(void)
2920

2921
{
2922
                    // WARNING: Could not recover jumptable at 0x000140004a10. Too many branches
2923
                    // WARNING: Treating indirect jump as call
2924
  __stdio_common_vfprintf();
2925
  return;
2926
}
2927

2928

2929

2930
size_t __cdecl strlen(char *_Str)
2931

2932
{
2933
  size_t sVar1;
2934

2935
                    // WARNING: Could not recover jumptable at 0x000140004a20. Too many branches
2936
                    // WARNING: Treating indirect jump as call
2937
  sVar1 = strlen(_Str);
2938
  return sVar1;
2939
}
2940

2941

2942

2943
int __cdecl strncmp(char *_Str1,char *_Str2,size_t _MaxCount)
2944

2945
{
2946
  int iVar1;
2947

2948
                    // WARNING: Could not recover jumptable at 0x000140004a30. Too many branches
2949
                    // WARNING: Treating indirect jump as call
2950
  iVar1 = strncmp(_Str1,_Str2,_MaxCount);
2951
  return iVar1;
2952
}

Here, we can see two very important sections:#

600-665#

1
// This is the text shown in the pop-up window
2
CreateWindowExW(0,L"STATIC",L"茶神降臨 // CLICK TO WORSHIP",0x50000001,0x14,0x12,0x186,
3
                0x1c,param_1,(HMENU)0x0,pHVar10,(LPVOID)0x0);
4
pHVar10 = GetModuleHandleW((LPCWSTR)0x0);
5
// The button will execute the routine associated with 0x1001
6
_DAT_1400080d0 =
7
    CreateWindowExW(0,L"BUTTON",L"WORSHIP TEA GOD",0x50000001,0x6e,0x177,0xd2,0x2a,param_1,
8
                    (HMENU)0x1001,pHVar10,(LPVOID)0x0);

766-767#

1
else {
2
    // Check whether this is button 0x111
3
    if ((param_2 != 0x111) || (((uint)param_3 & 0xffff) != 0x1001)) goto LAB_140002078;
4

5
    // Increment the counter by one
6
    DAT_1400080c8 = DAT_1400080c8 + 1;
7

8
    // Refresh the display so the worship count shows the latest value.
9
    InvalidateRect(DAT_1400080c0,(RECT *)0x0,1);
10

11
    // Close the window
12
    if (param_1 != (HWND)0x0) {
13
      DestroyWindow(param_1);
14
    }
15

16
    // Once it reaches the end, start decrypting
17
    if (DAT_1400080c8 != 0) {
18
      KillTimer(DAT_1400080c0,0xcafe);
19
      if (DAT_140008078 != DAT_140008080) {
20
        do {
21
          DestroyWindow((HWND)DAT_140008080[-1]);
22
        } while (DAT_140008078 != DAT_140008080);
23
      }
24

25
      // Prepare for decryption
26
      local_88.rcPaint.top = 0;
27
      local_88.rcPaint.right = 0;
28
      local_88.rcPaint.bottom = 0;
29
      local_88.fRestore = 0;
30
      local_88.hdc = (HDC)0x0;
31
      local_88.fErase = 0;
32
      local_88.rcPaint.left = 0;
33
      local_88._32_8_ = (ulonglong)(uint)local_88.rgbReserved._0_4_ << 0x20;
34
      // The line below is very important
35
      ppuVar7 = &PTR_DAT_140005210;
36
      // The line above is very important
37
      pbVar12 = (byte *)((longlong)&local_88.fErase + 3);
38
      lVar13 = 0;
39

40
      // Decryption steps
41
      do {
42
        pcVar2 = *ppuVar7;
43
        // XOR formula
44
        bVar1 = (&DAT_140005228)[lVar13];
45
        // The line above is the formula
46
        *(byte *)&((tagPAINTSTRUCT *)(pbVar12 + -0xb))->hdc = *pcVar2 - 0x19U ^ bVar1;
47
        pbVar12[-10] = pcVar2[1] - 0x20U ^ bVar1;
48
        pbVar12[-9] = pcVar2[2] - 0x27U ^ bVar1;
49
        pbVar12[-8] = pcVar2[3] - 0x2eU ^ bVar1;
50
        pbVar12[-7] = pcVar2[4] - 0x35U ^ bVar1;
51
        pbVar12[-6] = pcVar2[5] - 0x3cU ^ bVar1;
52
        pbVar12[-5] = pcVar2[6] + 0xbdU ^ bVar1;
53
        pbVar12[-4] = pcVar2[7] + 0xb6U ^ bVar1;
54
        pbVar12[-3] = pcVar2[8] + 0xafU ^ bVar1;
55
        pbVar12[-2] = pcVar2[9] + 0xa8U ^ bVar1;
56
        pbVar12[-1] = pcVar2[10] + 0xa1U ^ bVar1;
57
        *pbVar12 = pcVar2[0xb] + 0x9aU ^ bVar1;
58
        lVar13 = lVar13 + 1;
59
        ppuVar7 = ppuVar7 + 1;
60
        pbVar12 = pbVar12 + 0xc;
61
      } while (lVar13 != 3);

PTR_DAT_140005210 is a pointer table that maps to the following three locations:

Pointer table address	Ciphertext address
0x140005210	0x1400051E6
0x140005218	0x1400051F2
0x140005220	0x1400051FE

Next, we open it in HxD: hxd

Based on the table above, we can find three byte strings here:

1
A9A7B3E9 CCF0ED48 44175228
2
799B5094 619FB14B CF92D697
3
F6F4C60A CCBD0413 D4E2E259

Then, by checking 0x140005228, we can find:

1
A7 3C D1

Final Decryption Script#

1
"""Decrypt the reward embedded in TeaGod.exe."""
2

3
CIPHERTEXT_BLOCKS = (
4
    bytes.fromhex("A9 A7 B3 E9 CC F0 ED 48 44 17 52 28"),
5
    bytes.fromhex("79 9B 50 94 61 9F B1 4B CF 92 D6 97"),
6
    bytes.fromhex("F6 F4 C6 0A CC BD 04 13 D4 E2 E2 59"),
7
)
8

9
BLOCK_XOR_KEYS = bytes.fromhex("A7 3C D1")
10
REPEATING_KEY = b"hc_ehsna"
11

12

13
def decrypt() -> bytes:
14
    stage1 = bytearray()
15

16
    # The executable processes three blocks of 12 bytes. For byte j, it
17
    # subtracts 0x19 + 7*j and then XORs with that block's key byte.
18
    for block, block_key in zip(CIPHERTEXT_BLOCKS, BLOCK_XOR_KEYS):
19
        for position, value in enumerate(block):
20
            stage1.append(
21
                ((value - (0x19 + 7 * position)) & 0xFF) ^ block_key
22
            )
23

24
    # The index starts at 1 and increases by 3, reduced modulo 8.
25
    return bytes(
26
        value ^ REPEATING_KEY[(1 + 3 * index) & 7]
27
        for index, value in enumerate(stage1)
28
    )
29

30

31
if __name__ == "__main__":
32
    print(decrypt().decode("ascii"))

Output:

1
➜  ~ py decode.py
2
THJCC{h77p5://p4s73b1n.com/R58uv133}
3
➜  ~

Flag:
THJCC{h77p5://p4s73b1n.com/R58uv133}

Easter Egg:#

When I was making this challenge, I actually hid a little detail in it.

If you look at the Flag for this challenge, you will notice that it can actually be turned into a link to a website:

Loading...https://pastebin.com/R58uv133

This website contains the following text:

1
5q+P5pel6Iac5ouc5pyA5YGJ5aSn5pyA5ryC5Lqu5pyA5Y+v5oSbIOS4jeWPquiDveeUqOiFs+Wvq+WHuui3qOW5s+iHuiBUZWFHb2QgT1Mg6YKE5pyJ6JGX6IO95Zyo6IWm5Lit6JmV55CG5Y+N57eo6K2v55qEIFRlYUdvZCBEZWNvbXBpbGVyIOS7peWPiueUqOaJi+iqv+WHuiA1IOWFhuWPg+aVuOeahCBUZWFHb2QgQWdlbnQg5ZKM55So6Iad6JOL5bu656uLIFRlYUdvZCBQcm90b2NvbCDlj4jog73nlKjnnLznpZ7ntYLntZDmiYDmnIkgQ1RGIOmhjOebrumChOacg+W5q+WHuumhjOeahOmbu+elnuael+a1t+Wci+mam+iRo+S6i+mVt+izh+WuiemZuOe+veiMtuelnuWnkOWnkOWkp+S6uvCfm5Ag8J+bkCDwn5uQ

If you decode it from Base64, you get:

1
每日膜拜最偉大最漂亮最可愛 不只能用腳寫出跨平臺 TeaGod OS 還有著能在腦中處理反編譯的 TeaGod Decompiler 以及用手調出 5 兆參數的 TeaGod Agent 和用膝蓋建立 TeaGod Protocol 又能用眼神終結所有 CTF 題目還會幫出題的電神林海國際董事長資安陸羽茶神姐姐大人🛐 🛐 🛐

That mean:

1
Daily worship to the greatest, prettiest, and cutest Tea God Sister, who can not only write the cross-platform TeaGod OS with her feet, but also handle decompilation in her head with TeaGod Decompiler, tune a five-trillion-parameter TeaGod Agent by hand, build TeaGod Protocol with her knees, finish every CTF challenge with a single look, and even help create challenges—the tech god, Chairman of Lin Hai International, and the Lu Yu of cybersecurity 🛐 🛐 🛐

These are some of the phrases we use to worship the Tea God. We used to post them in the THJCC server, so if you are interested in worshipping the Tea God with us, come post them too