題目 TeaGod.exe(100)：#

/worship

✨ 虔誠的膜拜 ✨. PGpenguin72(茶神教教徒) 向最偉大最可愛的茶神姐姐大人獻上了誠摯的敬意！
累計膜拜次數 / 當前連續天數 666 次 / 666 天茶神照片

題目檔案：
原本題目的檔案：TeaGod.exe

正確應該要放的檔案：TeaGod.exe

題目設計發想：#

這題是致敬我們 THJCC 的一個 Discord bot「最偉大最可愛的茶神姐姐教-教主，這個 bot 忘記是誰做的了」，不過最主要是想要膜拜茶神（檸檬茶）。

然後我會想做這個題目是想說做一個類似惡意軟體，讓他會一直彈窗，所以我把想法跟 ChatGPT 說後，他就協助我製作了這個 Windows 軟體。

但由於我發上去 CTFd 的檔案發錯了，發成內部測試用的了，所以這題變得超簡單（雖然給 AI 解也很簡單就是了==）。

解題步驟：#

方法一#

把檔案下載下來後打開，會看到這個：膜拜茶神然後只要點擊一下按鈕，就可以解開了：

Flag:
THJCC{h77p5://p4s73b1n.com/R58uv133}

方法二#

好吧，剛剛的方法一真的不在我的預期解中，寫個我預期希望的解題思路，也就是方法二。

丟到 Ghidra 中把它 Reverse：


659 collapsed lines
1
#include "out.h"
2

3

4
undefined4 DAT_1400080fc;
5
char DAT_140008070;
6
undefined8 DAT_140008068;
7
undefined4 DAT_140008058;
8
undefined8 DAT_140008060;
9
int DAT_140008054;
10
undefined FUN_1400033b0;
11
undefined FUN_140003580;
12
void *DAT_140008118;
13
int DAT_140008110;
14
LPTOP_LEVEL_EXCEPTION_FILTER DAT_140008100;
15
undefined4 DAT_1400080ec;
16
undefined4 DAT_1400080f0;
17
undefined4 DAT_1400080f4;
18
int DAT_1400080fc;
19
undefined4 DAT_140008128;
20
undefined4 DAT_140008120;
21
int DAT_140008018;
22
int DAT_140008000;
23
undefined4 DAT_14000812c;
24
uint DAT_140008124;
25
undefined DAT_1400013d0;
26
undefined DAT_140006460;
27
void *StackBase;
28
undefined DAT_140006468;
29
undefined8 DAT_140006480;
30
undefined8 DAT_140006488;
31
HWND DAT_1400080c0;
32
undefined FUN_1400017a0;
33
undefined FUN_140001d50;
34
undefined FUN_1400026c0;
35
longlong DAT_140008080;
36
undefined8 DAT_140008078;
37
undefined4 DAT_1400080c8;
38
undefined DAT_140005148;
39
longlong *DAT_140008078;
40
longlong *DAT_140008080;
41
undefined DAT_140008098;
42
pointer PTR_DAT_140005210;
43
undefined1 DAT_140005228;
44
undefined DAT_14000528c;
45
undefined DAT_140005578;
46
undefined4 DAT_1400080d8;
47
undefined DAT_140005ba8;
48
undefined4 DAT_1400080dc;
49
undefined DAT_1400080a9;
50
undefined4 UNK_1400080b4;
51
undefined8 DAT_1400080a1;
52
undefined DAT_1400080d0;
53
int DAT_1400080c8;
54
undefined DAT_140008090;
55
undefined DAT_140008099;
56
HWND DAT_1400080e0;
57
byte DAT_140008090;
58
undefined DAT_140005252;
59
undefined1 DAT_140008091;
60
undefined8 DAT_1400080e0;
61
undefined DAT_140008088;
62
undefined DAT_1400080a1;
63
undefined DAT_1400080b8;
64
undefined8 DAT_140008080;
65
undefined DAT_1400045f0;
66
undefined *PTR_PTR__ZdlPv_1400052a0;
67
undefined *PTR__ZTVSt12length_error_140006b88;
68
undefined DAT_140004610;
69
undefined *PTR_PTR__ZdlPv_140005318;
70
int DAT_140008038;
71
int DAT_140008148;
72
DWORD *DAT_140008178;
73
undefined DAT_140008150;
74
undefined *PTR_DAT_140008008;
75
undefined8 DAT_1400064b0;
76
pointer PTR_FUN_1400064b8;
77
char DAT_1400080f8;
78
undefined *DAT_140008100;
79
longlong DAT_140008108;
80
undefined8 DAT_140008108;
81
undefined DAT_1400060c8;
82
char DAT_140008130;
83
int DAT_140008140;
84
IMAGE_DOS_HEADER IMAGE_DOS_HEADER_140000000;
85
uint switchdataD_1400060e0;
86
undefined DAT_140006248;
87
undefined4 DAT_140006414;
88
pointer PTR__guard_check_icall_140006450;
89
longlong DAT_140008138;
90
undefined DAT_140006298;
91
undefined *PTR_DAT_140008040;
92
undefined4 *DAT_140008178;
93
int *DAT_140008178;
94
IMAGE_SECTION_HEADER IMAGE_SECTION_HEADER_140000180;
95
dword DWORD_1400064e4;
96
undefined DAT_140008048;
97

98
void entry(undefined8 param_1,void **param_2,undefined8 *param_3,ulonglong param_4)
99

100
{
101
  DAT_1400080fc = 1;
102
  FUN_140001020(param_1,param_2,param_3,param_4);
103
  return;
104
}
105

106

107

108
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
109
// WARNING: Removing unreachable block (ram,0x00014000137c)
110
// WARNING: Removing unreachable block (ram,0x0001400011b1)
111
// WARNING: Removing unreachable block (ram,0x0001400011b9)
112

113
ulonglong FUN_140001020(undefined8 param_1,void **param_2,undefined8 *param_3,ulonglong param_4)
114

115
{
116
  void *pvVar1;
117
  undefined4 uVar2;
118
  int iVar3;
119
  undefined8 *puVar4;
120
  ulonglong uVar5;
121
  undefined4 *puVar6;
122
  undefined8 uVar7;
123
  void *pvVar8;
124
  size_t sVar9;
125
  void *pvVar10;
126
  longlong lVar11;
127
  longlong lVar12;
128
  bool bVar13;
129
  undefined4 local_44;
130

131
  pvVar1 = StackBase;
132
  pvVar8 = (void *)0x0;
133
  LOCK();
134
  bVar13 = DAT_140008118 == (void *)0x0;
135
  pvVar10 = pvVar1;
136
  if (!bVar13) {
137
    pvVar8 = DAT_140008118;
138
    pvVar10 = DAT_140008118;
139
  }
140
  DAT_140008118 = pvVar10;
141
  UNLOCK();
142
  if (StackBase != pvVar8 && !bVar13) {
143
    do {
144
      param_1 = 1000;
145
      Sleep(1000);
146
      pvVar8 = (void *)0x0;
147
      LOCK();
148
      bVar13 = DAT_140008118 == (void *)0x0;
149
      pvVar10 = pvVar1;
150
      if (!bVar13) {
151
        pvVar8 = DAT_140008118;
152
        pvVar10 = DAT_140008118;
153
      }
154
      DAT_140008118 = pvVar10;
155
      UNLOCK();
156
    } while ((!bVar13) && (pvVar1 != pvVar8));
157
  }
158
  if (DAT_140008110 != 1) {
159
    if (DAT_140008110 != 0) {
160
      DAT_140008070 = '\x01';
161
joined_r0x0001400010b0:
162
      if (bVar13) {
163
        LOCK();
164
        DAT_140008118 = (void *)0x0;
165
        UNLOCK();
166
      }
167
      tls_callback_0(0,2);
168
      uVar7 = DAT_140008068;
169
      puVar4 = (undefined8 *)FUN_140003bd0();
170
      *puVar4 = uVar7;
171
      uVar5 = FUN_140003b10();
172
      if (DAT_140008054 != 0) {
173
        if (DAT_140008070 == '\0') {
174
          uVar5 = uVar5 & 0xffffffff;
175
          _cexit();
176
        }
177
        return uVar5;
178
      }
179
      goto LAB_140001395;
180
    }
181
    DAT_140008110 = 1;
182
    FUN_1400035f0(param_1,param_2,param_3,param_4);
183
    DAT_140008100 = SetUnhandledExceptionFilter(FUN_1400033b0);
184
    _set_invalid_parameter_handler((_invalid_parameter_handler)&DAT_1400013d0);
185
    FUN_140003570();
186
    DAT_1400080ec = 1;
187
    DAT_1400080f0 = 1;
188
    DAT_1400080f4 = 1;
189
    DAT_140008054 = 0;
190
    param_2 = (void **)0xf8;
191
    _set_app_type(2 - (uint)(DAT_1400080fc == 0));
192
    uVar2 = DAT_140008128;
193
    puVar6 = (undefined4 *)__p__fmode();
194
    *puVar6 = uVar2;
195
    uVar2 = DAT_140008120;
196
    puVar6 = (undefined4 *)__p__commode();
197
    *puVar6 = uVar2;
198
    uVar7 = FUN_140003b00();
199
    if (-1 < (int)uVar7) {
200
      if (DAT_140008018 == 1) {
201
        FUN_140003560(FUN_140003580);
202
      }
203
      if (DAT_140008000 == -1) {
204
        _configthreadlocale(-1);
205
      }
206
      iVar3 = _initterm_e(&DAT_140006480,&DAT_140006488);
207
      if (iVar3 != 0) {
208
        return 0xff;
209
      }
210
      local_44 = DAT_14000812c;
211
      param_4 = (ulonglong)DAT_140008124;
212
      param_2 = &DAT_140008060;
213
      param_3 = &DAT_140008068;
214
      uVar7 = FUN_140003be0(&DAT_140008058,&DAT_140008060,&DAT_140008068,DAT_140008124,&local_44);
215
      iVar3 = DAT_140008058;
216
      if (-1 < (int)uVar7) {
217
        lVar12 = (longlong)DAT_140008058;
218
        pvVar8 = malloc(lVar12 * 8 + 8);
219
        pvVar1 = DAT_140008060;
220
        if (pvVar8 != (void *)0x0) {
221
          if (iVar3 < 1) {
222
            lVar12 = 0;
223
          }
224
          else {
225
            lVar11 = 0;
226
            do {
227
              sVar9 = wcslen(*(wchar_t **)((longlong)pvVar1 + lVar11 * 8));
228
              puVar4 = (undefined8 *)(sVar9 * 2 + 2);
229
              pvVar10 = malloc((size_t)puVar4);
230
              *(void **)((longlong)pvVar8 + lVar11 * 8) = pvVar10;
231
              if (pvVar10 == (void *)0x0) goto LAB_140001381;
232
              param_2 = *(void ***)((longlong)pvVar1 + lVar11 * 8);
233
              memcpy(pvVar10,param_2,(size_t)puVar4);
234
              lVar11 = lVar11 + 1;
235
              param_3 = puVar4;
236
            } while (lVar12 != lVar11);
237
          }
238
          *(undefined8 *)((longlong)pvVar8 + lVar12 * 8) = 0;
239
          DAT_140008060 = pvVar8;
240
          _initterm(&DAT_140006460,&DAT_140006468);
241
          FUN_140003320();
242
          DAT_140008110 = 2;
243
          goto joined_r0x0001400010b0;
244
        }
245
      }
246
    }
247
LAB_140001381:
248
    FUN_140003c50(8,param_2,param_3,param_4);
249
  }
250
  uVar5 = FUN_140003c50(0x1f,param_2,param_3,param_4);
251
LAB_140001395:
252
                    // WARNING: Subroutine does not return
253
  exit((int)uVar5);
254
}
255

256

257

258
void FUN_1400013a0(undefined8 param_1,void **param_2,undefined8 *param_3,ulonglong param_4)
259

260
{
261
  DAT_1400080fc = 0;
262
  FUN_140001020(param_1,param_2,param_3,param_4);
263
  return;
264
}
265

266

267

268
void FUN_1400013c0(void)
269

270
{
271
                    // WARNING: Could not recover jumptable at 0x000140004740. Too many branches
272
                    // WARNING: Treating indirect jump as call
273
  _crt_atexit();
274
  return;
275
}
276

277

278

279
undefined8 FUN_140001440(HINSTANCE param_1,undefined8 param_2,undefined8 param_3,int param_4)
280

281
{
282
  BOOL BVar1;
283
  HMODULE hInstance;
284
  HWND pHVar2;
285
  int iVar3;
286
  ulonglong uVar4;
287
  HWND local_160;
288
  tagMSG local_158;
289
  WNDCLASSW local_128;
290
  WNDCLASSW local_d8;
291
  WNDCLASSW local_88;
292

293
  local_d8.cbClsExtra = 0;
294
  local_d8.cbWndExtra = 0;
295
  local_d8.style = 0;
296
  local_d8._4_4_ = 0;
297
  local_d8.hbrBackground = (HBRUSH)0x0;
298
  local_d8.lpszMenuName = (LPCWSTR)0x0;
299
  local_d8.hIcon = (HICON)0x0;
300
  local_d8.hCursor = (HCURSOR)0x0;
301
  local_d8.lpszClassName = L"TeaGodMain";
302
  local_d8.lpfnWndProc = FUN_1400017a0;
303
  local_d8.hInstance = param_1;
304
  local_d8.hbrBackground = CreateSolidBrush(0x191919);
305
  RegisterClassW(&local_d8);
306
  local_88.cbClsExtra = 0;
307
  local_88.cbWndExtra = 0;
308
  local_88.style = 0;
309
  local_88._4_4_ = 0;
310
  local_88.hbrBackground = (HBRUSH)0x0;
311
  local_88.lpszMenuName = (LPCWSTR)0x0;
312
  local_88.hIcon = (HICON)0x0;
313
  local_88.hCursor = (HCURSOR)0x0;
314
  local_88.lpszClassName = L"TeaGodNote";
315
  local_88.lpfnWndProc = FUN_140001d50;
316
  local_88.hInstance = param_1;
317
  RegisterClassW(&local_88);
318
  local_128.cbClsExtra = 0;
319
  local_128.cbWndExtra = 0;
320
  local_128.style = 0;
321
  local_128._4_4_ = 0;
322
  local_128.lpszMenuName = (LPCWSTR)0x0;
323
  local_128.hIcon = (HICON)0x0;
324
  local_128.hCursor = (HCURSOR)0x0;
325
  local_128.lpszClassName = L"TeaGodReward";
326
  local_128.lpfnWndProc = FUN_1400026c0;
327
  local_128.hbrBackground = (HBRUSH)0x6;
328
  local_128.hInstance = param_1;
329
  RegisterClassW(&local_128);
330
  DAT_1400080c0 =
331
       CreateWindowExW(0,L"TeaGodMain",L"TeaGod Worship Protocol",0xcf0000,-0x80000000,-0x80000000,
332
                       0x2d0,0xb4,(HWND)0x0,(HMENU)0x0,param_1,(LPVOID)0x0);
333
  ShowWindow(DAT_1400080c0,param_4);
334
  UpdateWindow(DAT_1400080c0);
335
  pHVar2 = DAT_1400080c0;
336
  hInstance = GetModuleHandleW((LPCWSTR)0x0);
337
  pHVar2 = CreateWindowExW(0x88,L"TeaGodNote",L"WORSHIP REQUEST",0x80c80000,-0x80000000,-0x80000000,
338
                           0x1ae,0x1d6,pHVar2,(HMENU)0x0,hInstance,(LPVOID)0x0);
339
  local_158.hwnd = (HWND)0x0;
340
  local_158.message = 0;
341
  local_158._12_4_ = 0;
342
  local_160 = pHVar2;
343
  SystemParametersInfoW(0x30,0,&local_158,0);
344
  uVar4 = DAT_140008080 - DAT_140008078 >> 3;
345
  iVar3 = (int)uVar4 + (int)(uVar4 / 6) * -6;
346
  SetWindowPos(pHVar2,(HWND)0xffffffffffffffff,local_158.message + iVar3 * -0x22 + -0x1c7,
347
               local_158._12_4_ + iVar3 * -0x1c + -0x1fe,0x1ae,0x1d6,0x40);
348
  FUN_1400030b0(&DAT_140008078,&local_160);
349
  SetTimer(DAT_1400080c0,0xcafe,3000,(TIMERPROC)0x0);
350
  local_158.time = 0;
351
  local_158.pt.x = 0;
352
  local_158.pt.y = 0;
353
  local_158._44_4_ = 0;
354
  local_158.wParam = 0;
355
  local_158.lParam = 0;
356
  local_158.hwnd = (HWND)0x0;
357
  local_158.message = 0;
358
  local_158._12_4_ = 0;
359
  BVar1 = GetMessageW(&local_158,(HWND)0x0,0,0);
360
  if (0 < BVar1) {
361
    do {
362
      TranslateMessage(&local_158);
363
      DispatchMessageW(&local_158);
364
      BVar1 = GetMessageW(&local_158,(HWND)0x0,0,0);
365
    } while (0 < BVar1);
366
  }
367
  return 0;
368
}
369

370

371

372
// WARNING: Type propagation algorithm not settling
373

374
HBRUSH FUN_1400017a0(HWND param_1,UINT param_2,WPARAM param_3,LPARAM param_4)
375

376
{
377
  undefined1 *puVar1;
378
  HDC hdc;
379
  HFONT h;
380
  HGDIOBJ h_00;
381
  uint *puVar2;
382
  ulonglong *puVar3;
383
  HMODULE hInstance;
384
  HWND hWnd;
385
  HBRUSH pHVar4;
386
  int iVar5;
387
  ulonglong uVar6;
388
  LPCWSTR lpchText;
389
  undefined8 local_128;
390
  ulonglong uStack_120;
391
  LPCWSTR local_118;
392
  byte local_110 [2];
393
  undefined1 local_10e [6];
394
  ulonglong local_108;
395
  undefined1 *local_100;
396
  uint local_f8;
397
  uint uStack_f4;
398
  uint uStack_f0;
399
  uint uStack_ec;
400
  undefined8 local_e8;
401
  ulonglong local_d8;
402
  ulonglong uStack_d0;
403
  ulonglong local_c8;
404
  byte local_c0 [16];
405
  undefined8 local_b0;
406
  tagRECT local_a8;
407
  tagPAINTSTRUCT local_98;
408

409
  if ((int)param_2 < 0x113) {
410
    if (param_2 == 2) {
411
      KillTimer(param_1,0xcafe);
412
      PostQuitMessage(0);
413
    }
414
    else {
415
      if (param_2 != 0xf) goto LAB_140001b5c;
416
      local_98.rgbReserved[0xc] = '\0';
417
      local_98.rgbReserved[0xd] = '\0';
418
      local_98.rgbReserved[0xe] = '\0';
419
      local_98.rgbReserved[0xf] = '\0';
420
      local_98.rgbReserved[0x10] = '\0';
421
      local_98.rgbReserved[0x11] = '\0';
422
      local_98.rgbReserved[0x12] = '\0';
423
      local_98.rgbReserved[0x13] = '\0';
424
      local_98.rgbReserved[0x14] = '\0';
425
      local_98.rgbReserved[0x15] = '\0';
426
      local_98.rgbReserved[0x16] = '\0';
427
      local_98.rgbReserved[0x17] = '\0';
428
      local_98.rgbReserved[0x18] = '\0';
429
      local_98.rgbReserved[0x19] = '\0';
430
      local_98.rgbReserved[0x1a] = '\0';
431
      local_98.rgbReserved[0x1b] = '\0';
432
      local_98.fIncUpdate = 0;
433
      local_98.rgbReserved[0] = '\0';
434
      local_98.rgbReserved[1] = '\0';
435
      local_98.rgbReserved[2] = '\0';
436
      local_98.rgbReserved[3] = '\0';
437
      local_98.rgbReserved[4] = '\0';
438
      local_98.rgbReserved[5] = '\0';
439
      local_98.rgbReserved[6] = '\0';
440
      local_98.rgbReserved[7] = '\0';
441
      local_98.rgbReserved[8] = '\0';
442
      local_98.rgbReserved[9] = '\0';
443
      local_98.rgbReserved[10] = '\0';
444
      local_98.rgbReserved[0xb] = '\0';
445
      local_98.rcPaint.top = 0;
446
      local_98.rcPaint.right = 0;
447
      local_98.rcPaint.bottom = 0;
448
      local_98.fRestore = 0;
449
      local_98.hdc = (HDC)0x0;
450
      local_98.fErase = 0;
451
      local_98.rcPaint.left = 0;
452
      local_98.rgbReserved[0x1c] = '\0';
453
      local_98.rgbReserved[0x1d] = '\0';
454
      local_98.rgbReserved[0x1e] = '\0';
455
      local_98.rgbReserved[0x1f] = '\0';
456
      local_98._68_4_ = 0;
457
      hdc = BeginPaint(param_1,&local_98);
458
      local_a8.left = 0;
459
      local_a8.top = 0;
460
      local_a8.right = 0;
461
      local_a8.bottom = 0;
462
      GetClientRect(param_1,&local_a8);
463
      SetBkMode(hdc,1);
464
      SetTextColor(hdc,0xdcdcdc);
465
      h = CreateFontW(0x16,0,0,0,700,0,0,0,1,0,0,0,0,L"Consolas");
466
      h_00 = SelectObject(hdc,h);
467
      _ZNSt3__110to_wstringEj(local_c0,DAT_1400080c8);
468
      puVar2 = (uint *)_ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6insertEyPKw
469
                                 (local_c0,0,L"Worship count: ");
470
      local_e8 = *(undefined8 *)(puVar2 + 4);
471
      local_f8 = *puVar2;
472
      uStack_f4 = puVar2[1];
473
      uStack_f0 = puVar2[2];
474
      uStack_ec = puVar2[3];
475
      puVar2[0] = 0;
476
      puVar2[1] = 0;
477
      puVar2[2] = 0;
478
      puVar2[3] = 0;
479
      puVar2[4] = 0;
480
      puVar2[5] = 0;
481
      puVar3 = (ulonglong *)
482
               _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKw
483
                         (&local_f8,&DAT_140005148);
484
      local_c8 = puVar3[2];
485
      local_d8 = *puVar3;
486
      uStack_d0 = puVar3[1];
487
      *puVar3 = 0;
488
      puVar3[1] = 0;
489
      puVar3[2] = 0;
490
      _ZNSt3__110to_wstringEj(local_110,1);
491
      uVar6 = (ulonglong)(local_110[0] >> 1);
492
      puVar1 = local_10e;
493
      if ((local_110[0] & 1) != 0) {
494
        uVar6 = local_108;
495
        puVar1 = local_100;
496
      }
497
      puVar3 = (ulonglong *)
498
               _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKwy
499
                         (&local_d8,puVar1,uVar6);
500
      local_118 = (LPCWSTR)puVar3[2];
501
      local_128 = (HWND)*puVar3;
502
      uStack_120 = puVar3[1];
503
      *puVar3 = 0;
504
      puVar3[1] = 0;
505
      puVar3[2] = 0;
506
      if ((local_110[0] & 1) != 0) {
507
        _ZdlPv(local_100);
508
      }
509
      if ((local_d8 & 1) != 0) {
510
        _ZdlPv(local_c8);
511
      }
512
      if ((local_f8 & 1) != 0) {
513
        _ZdlPv(local_e8);
514
      }
515
      if ((local_c0[0] & 1) != 0) {
516
        _ZdlPv(local_b0);
517
      }
518
      lpchText = local_118;
519
      if (((ulonglong)local_128 & 1) == 0) {
520
        lpchText = (LPCWSTR)((longlong)&local_128 + 2);
521
      }
522
      DrawTextW(hdc,lpchText,-1,&local_a8,0x25);
523
      SelectObject(hdc,h_00);
524
      DeleteObject(h);
525
      if (((ulonglong)local_128 & 1) != 0) {
526
        _ZdlPv(local_118);
527
      }
528
      EndPaint(param_1,&local_98);
529
    }
530
    pHVar4 = (HBRUSH)0x0;
531
  }
532
  else {
533
    if (param_2 == 0x138) {
534
      pHVar4 = GetSysColorBrush(5);
535
      return pHVar4;
536
    }
537
    if ((param_2 == 0x113) && (param_3 == 0xcafe)) {
538
      param_2 = 0x113;
539
      hInstance = GetModuleHandleW((LPCWSTR)0x0);
540
      hWnd = CreateWindowExW(0x88,L"TeaGodNote",L"WORSHIP REQUEST",0x80c80000,-0x80000000,
541
                             -0x80000000,0x1ae,0x1d6,param_1,(HMENU)0x0,hInstance,(LPVOID)0x0);
542
      local_98.hdc = (HDC)0x0;
543
      local_98.fErase = 0;
544
      local_98.rcPaint.left = 0;
545
      local_128 = hWnd;
546
      SystemParametersInfoW(0x30,0,&local_98,0);
547
      uVar6 = DAT_140008080 - DAT_140008078 >> 3;
548
      iVar5 = (int)uVar6 + (int)(uVar6 / 6) * -6;
549
      SetWindowPos(hWnd,(HWND)0xffffffffffffffff,local_98.fErase + iVar5 * -0x22 + -0x1c7,
550
                   local_98.rcPaint.left + iVar5 * -0x1c + -0x1fe,0x1ae,0x1d6,0x40);
551
      FUN_1400030b0(&DAT_140008078,&local_128);
552
    }
553
LAB_140001b5c:
554
    pHVar4 = (HBRUSH)DefWindowProcW(param_1,param_2,param_3,param_4);
555
  }
556
  return pHVar4;
557
}
558

559

560

561
// WARNING: Removing unreachable block (ram,0x00014000251a)
562
// WARNING: Globals starting with '_' overlap smaller symbols at the same address
563

564
LRESULT FUN_140001d50(HWND param_1,UINT param_2,WPARAM param_3,LPARAM param_4)
565

566
{
567
  byte bVar1;
568
  char *pcVar2;
569
  longlong *plVar3;
570
  DWORD DVar4;
571
  HRESULT HVar5;
572
  int iVar6;
573
  undefined **ppuVar7;
574
  undefined8 *puVar8;
575
  LRESULT LVar9;
576
  HMODULE pHVar10;
577
  HRSRC hResInfo;
578
  HGLOBAL hResData;
579
  HGLOBAL hMem;
580
  LPVOID _Dst;
581
  LPVOID _Src;
582
  HDC hdc;
583
  longlong *plVar11;
584
  byte *pbVar12;
585
  longlong lVar13;
586
  longlong lVar14;
587
  longlong *plVar15;
588
  longlong *local_d0;
589
  longlong *local_c8;
590
  longlong *local_c0;
591
  undefined8 local_b8;
592
  LONG LStack_b0;
593
  undefined4 uStack_ac;
594
  DWORD DStack_a8;
595
  DWORD DStack_a4;
596
  LONG LStack_a0;
597
  undefined8 uStack_9c;
598
  undefined8 local_94;
599
  tagPAINTSTRUCT local_88;
600

601
  plVar3 = DAT_140008080;
602
  if ((int)param_2 < 0xf) {
603
    if (param_2 == 1) {
604
      CoInitializeEx((LPVOID)0x0,2);
605
      pHVar10 = GetModuleHandleW((LPCWSTR)0x0);
606
      hResInfo = FindResourceW(pHVar10,(LPCWSTR)0x65,(LPCWSTR)0xa);
607
      if (hResInfo != (HRSRC)0x0) {
608
        hResData = LoadResource((HMODULE)0x0,hResInfo);
609
        DVar4 = SizeofResource((HMODULE)0x0,hResInfo);
610
        if (DVar4 != 0 && hResData != (HGLOBAL)0x0) {
611
          hMem = GlobalAlloc(2,(ulonglong)DVar4);
612
          if (hMem != (HGLOBAL)0x0) {
613
            _Dst = GlobalLock(hMem);
614
            _Src = LockResource(hResData);
615
            memcpy(_Dst,_Src,(ulonglong)DVar4);
616
            GlobalUnlock(hMem);
617
            local_88.hdc = (HDC)0x0;
618
            HVar5 = CreateStreamOnHGlobal(hMem,1,(LPSTREAM *)&local_88);
619
            if (-1 < HVar5) {
620
              local_b8 = (longlong *)0x0;
621
              local_c0 = (longlong *)0x0;
622
              local_d0 = (longlong *)0x0;
623
              HVar5 = CoCreateInstance((IID *)&DAT_140005ba8,(LPUNKNOWN)0x0,1,(IID *)&DAT_14000528c,
624
                                       (LPVOID *)&local_b8);
625
              if (((-1 < HVar5) &&
626
                  (iVar6 = (**(code **)(*local_b8 + 0x20))(local_b8,local_88.hdc,0,1,&local_c0),
627
                  -1 < iVar6)) &&
628
                 (iVar6 = (**(code **)(*local_c0 + 0x68))(local_c0,0,&local_d0), -1 < iVar6)) {
629
                local_c8 = (longlong *)0x0;
630
                iVar6 = (**(code **)(*local_b8 + 0x50))(local_b8,&local_c8);
631
                if ((-1 < iVar6) &&
632
                   (iVar6 = (**(code **)(*local_c8 + 0x40))
633
                                      (local_c8,local_d0,&DAT_140005578,0,0,0,0), -1 < iVar6)) {
634
                  (**(code **)(*local_c8 + 0x18))(local_c8,&DAT_1400080d8,&DAT_1400080dc);
635
                  FUN_140002e90((longlong *)((longlong)&DAT_1400080a1 + 7),
636
                                (ulonglong)DAT_1400080dc * (ulonglong)DAT_1400080d8 * 4);
637
                  (**(code **)(*local_c8 + 0x38))
638
                            (local_c8,0,DAT_1400080d8 << 2,
639
                             ram0x0001400080b0 - (int)ram0x0001400080a8,ram0x0001400080a8);
640
                }
641
                if (local_c8 != (longlong *)0x0) {
642
                  (**(code **)(*local_c8 + 0x10))();
643
                }
644
              }
645
              if (local_d0 != (longlong *)0x0) {
646
                (**(code **)(*local_d0 + 0x10))();
647
              }
648
              if (local_c0 != (longlong *)0x0) {
649
                (**(code **)(*local_c0 + 0x10))();
650
              }
651
              if (local_b8 != (longlong *)0x0) {
652
                (**(code **)(*local_b8 + 0x10))();
653
              }
654
              (*(*(IStreamVtbl **)&(local_88.hdc)->unused)->Release)((IStream *)local_88.hdc);
655
            }
656
          }
657
        }
658
      }
659
      pHVar10 = GetModuleHandleW((LPCWSTR)0x0);
660
      CreateWindowExW(0,L"STATIC",L"茶神降臨 // CLICK TO WORSHIP",0x50000001,0x14,0x12,0x186,
661
                      0x1c,param_1,(HMENU)0x0,pHVar10,(LPVOID)0x0);
662
      pHVar10 = GetModuleHandleW((LPCWSTR)0x0);
663
      _DAT_1400080d0 =
664
           CreateWindowExW(0,L"BUTTON",L"WORSHIP TEA GOD",0x50000001,0x6e,0x177,0xd2,0x2a,param_1,
665
                           (HMENU)0x1001,pHVar10,(LPVOID)0x0);
100 collapsed lines
666
    }
667
    else {
668
      if (param_2 != 2) {
669
LAB_140002078:
670
                    // WARNING: Could not recover jumptable at 0x00014000208e. Too many branches
671
                    // WARNING: Treating indirect jump as call
672
        LVar9 = DefWindowProcW(param_1,param_2,param_3,param_4);
673
        return LVar9;
674
      }
675
      plVar15 = DAT_140008078;
676
      if (DAT_140008078 == DAT_140008080) {
677
LAB_140002507:
678
        if (plVar15 != plVar3) {
679
          DAT_140008080 = plVar15;
680
        }
681
      }
682
      else {
683
        do {
684
          if ((HWND)*plVar15 == param_1) {
685
            plVar11 = plVar15 + 1;
686
            if (plVar11 != DAT_140008080 && plVar15 != DAT_140008080) {
687
              do {
688
                if ((HWND)*plVar11 != param_1) {
689
                  *plVar15 = *plVar11;
690
                  plVar15 = plVar15 + 1;
691
                }
692
                plVar11 = plVar11 + 1;
693
              } while (plVar11 != plVar3);
694
            }
695
            goto LAB_140002507;
696
          }
697
          plVar15 = plVar15 + 1;
698
        } while (plVar15 != DAT_140008080);
699
      }
700
      CoUninitialize();
701
    }
702
  }
703
  else if (param_2 == 0xf) {
704
    local_88.rgbReserved[0xc] = '\0';
705
    local_88.rgbReserved[0xd] = '\0';
706
    local_88.rgbReserved[0xe] = '\0';
707
    local_88.rgbReserved[0xf] = '\0';
708
    local_88.rgbReserved[0x10] = '\0';
709
    local_88.rgbReserved[0x11] = '\0';
710
    local_88.rgbReserved[0x12] = '\0';
711
    local_88.rgbReserved[0x13] = '\0';
712
    local_88.rgbReserved[0x14] = '\0';
713
    local_88.rgbReserved[0x15] = '\0';
714
    local_88.rgbReserved[0x16] = '\0';
715
    local_88.rgbReserved[0x17] = '\0';
716
    local_88.rgbReserved[0x18] = '\0';
717
    local_88.rgbReserved[0x19] = '\0';
718
    local_88.rgbReserved[0x1a] = '\0';
719
    local_88.rgbReserved[0x1b] = '\0';
720
    local_88.fIncUpdate = 0;
721
    local_88.rgbReserved[0] = '\0';
722
    local_88.rgbReserved[1] = '\0';
723
    local_88.rgbReserved[2] = '\0';
724
    local_88.rgbReserved[3] = '\0';
725
    local_88.rgbReserved[4] = '\0';
726
    local_88.rgbReserved[5] = '\0';
727
    local_88.rgbReserved[6] = '\0';
728
    local_88.rgbReserved[7] = '\0';
729
    local_88.rgbReserved[8] = '\0';
730
    local_88.rgbReserved[9] = '\0';
731
    local_88.rgbReserved[10] = '\0';
732
    local_88.rgbReserved[0xb] = '\0';
733
    local_88.rcPaint.top = 0;
734
    local_88.rcPaint.right = 0;
735
    local_88.rcPaint.bottom = 0;
736
    local_88.fRestore = 0;
737
    local_88.hdc = (HDC)0x0;
738
    local_88.fErase = 0;
739
    local_88.rcPaint.left = 0;
740
    local_88.rgbReserved[0x1c] = '\0';
741
    local_88.rgbReserved[0x1d] = '\0';
742
    local_88.rgbReserved[0x1e] = '\0';
743
    local_88.rgbReserved[0x1f] = '\0';
744
    local_88._68_4_ = 0;
745
    hdc = BeginPaint(param_1,&local_88);
746
    if (ram0x0001400080a8 != (void *)CONCAT44(uRam00000001400080b4,ram0x0001400080b0)) {
747
      DStack_a4 = 0;
748
      LStack_a0 = 0;
749
      uStack_9c._0_4_ = 0;
750
      uStack_9c._4_4_ = 0;
751
      local_94._0_4_ = 0;
752
      local_94._4_1_ = '\0';
753
      local_94._5_1_ = '\0';
754
      local_94._6_1_ = '\0';
755
      local_94._7_1_ = '\0';
756
      local_b8 = (longlong *)CONCAT44(DAT_1400080d8,0x28);
757
      LStack_b0 = -DAT_1400080dc;
758
      uStack_ac._0_2_ = 1;
759
      uStack_ac._2_2_ = 0x20;
760
      DStack_a8 = 0;
761
      StretchDIBits(hdc,0x23,0x37,0x168,300,0,0,DAT_1400080d8,DAT_1400080dc,ram0x0001400080a8,
762
                    (BITMAPINFO *)&local_b8,0,0xcc0020);
763
    }
764
    EndPaint(param_1,&local_88);
765
  }
766
  else {
767
    if ((param_2 != 0x111) || (((uint)param_3 & 0xffff) != 0x1001)) goto LAB_140002078;
768
    DAT_1400080c8 = DAT_1400080c8 + 1;
769
    InvalidateRect(DAT_1400080c0,(RECT *)0x0,1);
770
    if (param_1 != (HWND)0x0) {
771
      DestroyWindow(param_1);
772
    }
773
    if (DAT_1400080c8 != 0) {
774
      KillTimer(DAT_1400080c0,0xcafe);
775
      if (DAT_140008078 != DAT_140008080) {
776
        do {
777
          DestroyWindow((HWND)DAT_140008080[-1]);
778
        } while (DAT_140008078 != DAT_140008080);
779
      }
780
      local_88.rcPaint.top = 0;
781
      local_88.rcPaint.right = 0;
782
      local_88.rcPaint.bottom = 0;
783
      local_88.fRestore = 0;
784
      local_88.hdc = (HDC)0x0;
785
      local_88.fErase = 0;
786
      local_88.rcPaint.left = 0;
787
      local_88._32_8_ = (ulonglong)(uint)local_88.rgbReserved._0_4_ << 0x20;
788
      ppuVar7 = &PTR_DAT_140005210;
789
      pbVar12 = (byte *)((longlong)&local_88.fErase + 3);
790
      lVar13 = 0;
791
      do {
792
        pcVar2 = *ppuVar7;
793
        bVar1 = (&DAT_140005228)[lVar13];
794
        *(byte *)&((tagPAINTSTRUCT *)(pbVar12 + -0xb))->hdc = *pcVar2 - 0x19U ^ bVar1;
795
        pbVar12[-10] = pcVar2[1] - 0x20U ^ bVar1;
796
        pbVar12[-9] = pcVar2[2] - 0x27U ^ bVar1;
797
        pbVar12[-8] = pcVar2[3] - 0x2eU ^ bVar1;
798
        pbVar12[-7] = pcVar2[4] - 0x35U ^ bVar1;
799
        pbVar12[-6] = pcVar2[5] - 0x3cU ^ bVar1;
800
        pbVar12[-5] = pcVar2[6] + 0xbdU ^ bVar1;
801
        pbVar12[-4] = pcVar2[7] + 0xb6U ^ bVar1;
802
        pbVar12[-3] = pcVar2[8] + 0xafU ^ bVar1;
803
        pbVar12[-2] = pcVar2[9] + 0xa8U ^ bVar1;
804
        pbVar12[-1] = pcVar2[10] + 0xa1U ^ bVar1;
805
        *pbVar12 = pcVar2[0xb] + 0x9aU ^ bVar1;
806
        lVar13 = lVar13 + 1;
807
        ppuVar7 = ppuVar7 + 1;
808
        pbVar12 = pbVar12 + 0xc;
809
      } while (lVar13 != 3);
2143 collapsed lines
810
      local_c0 = (longlong *)0x616e7368655f6368;
811
      DVar4 = GetTickCount();
812
      local_d0 = (longlong *)CONCAT71(local_d0._1_7_,(char)DVar4);
813
      puVar8 = (undefined8 *)_Znwy(0x28);
814
      DStack_a8 = (DWORD)puVar8;
815
      DStack_a4 = (DWORD)((ulonglong)puVar8 >> 0x20);
816
      local_b8 = (LPVOID)0x29;
817
      LStack_b0 = 0x24;
818
      uStack_ac._0_2_ = 0;
819
      uStack_ac._2_2_ = 0;
820
      puVar8[2] = 0;
821
      puVar8[3] = 0;
822
      *puVar8 = 0;
823
      puVar8[1] = 0;
824
      *(undefined8 *)((longlong)puVar8 + 0x1d) = 0;
825
      lVar13 = 1;
826
      lVar14 = 0;
827
      do {
828
        *(BYTE *)(CONCAT44(DStack_a4,DStack_a8) + lVar14) = local_88.rgbReserved[lVar14 + -0x24];
829
        pbVar12 = (byte *)(CONCAT44(DStack_a4,DStack_a8) + lVar14);
830
        *pbVar12 = *pbVar12 ^ *(byte *)((longlong)&local_c0 + (ulonglong)((uint)lVar13 & 7));
831
        *(byte *)(CONCAT44(DStack_a4,DStack_a8) + lVar14) =
832
             *(byte *)(CONCAT44(DStack_a4,DStack_a8) + lVar14) ^ (byte)local_d0;
833
        *(byte *)(CONCAT44(DStack_a4,DStack_a8) + lVar14) =
834
             *(byte *)(CONCAT44(DStack_a4,DStack_a8) + lVar14) ^ (byte)local_d0;
835
        lVar14 = lVar14 + 1;
836
        lVar13 = lVar13 + 3;
837
      } while (lVar13 != 0x6d);
838
      if (((ulonglong)_DAT_140008090 & 1) != 0) {
839
        _ZdlPv();
840
      }
841
      unique0x100009fe = CONCAT44(DStack_a4,DStack_a8);
842
      _DAT_140008098 = CONCAT44(uStack_ac,LStack_b0);
843
      _DAT_140008090 = local_b8;
844
      pHVar10 = GetModuleHandleW((LPCWSTR)0x0);
845
      DAT_1400080e0 =
846
           CreateWindowExW(0x40008,L"TeaGodReward",L"REWARD UNLOCKED",0xc80000,0,0,0x44c,400,
847
                           (HWND)0x0,(HMENU)0x0,pHVar10,(LPVOID)0x0);
848
      local_88.hdc = (HDC)0x0;
849
      local_88.fErase = 0;
850
      local_88.rcPaint.left = 0;
851
      SystemParametersInfoW(0x30,0,&local_88,0);
852
      SetWindowPos(DAT_1400080e0,(HWND)0xffffffffffffffff,
853
                   (local_88.fErase - (local_88.fErase + -0x44c >> 0x1f)) + -0x44c >> 1,
854
                   (local_88.rcPaint.left - (local_88.rcPaint.left + -400 >> 0x1f)) + -400 >> 1,
855
                   0x44c,400,0x10);
856
      ShowWindow(DAT_1400080e0,5);
857
      UpdateWindow(DAT_1400080e0);
858
    }
859
  }
860
  return 0;
861
}
862

863

864

865
// WARNING: Globals starting with '_' overlap smaller symbols at the same address
866

867
LRESULT FUN_1400026c0(HWND param_1,UINT param_2,WPARAM param_3,LPARAM param_4)
868

869
{
870
  LPCWSTR pWVar1;
871
  size_t dwBytes;
872
  ulonglong uVar2;
873
  code *pcVar3;
874
  byte bVar4;
875
  BOOL BVar5;
876
  HMODULE pHVar6;
877
  LRESULT LVar7;
878
  LPCWSTR pWVar8;
879
  HWND pHVar9;
880
  LPCWSTR pWVar10;
881
  LPCWSTR pWVar11;
882
  HGLOBAL pvVar12;
883
  LPVOID pvVar13;
884
  undefined8 uVar14;
885
  ulonglong unaff_RBP;
886
  ulonglong uVar15;
887
  ulonglong uVar16;
888
  uint uVar17;
889
  ulonglong uVar18;
890
  longlong lVar19;
891
  undefined1 auVar20 [16];
892
  undefined1 auVar26 [16];
893
  undefined1 auVar28 [16];
894
  undefined1 auVar36 [16];
895
  undefined1 local_58 [16];
896
  LPCWSTR local_48;
897
  undefined1 auVar21 [16];
898
  undefined1 auVar22 [16];
899
  undefined1 auVar23 [16];
900
  undefined1 auVar24 [16];
901
  undefined1 auVar25 [16];
902
  undefined1 uVar27;
903
  undefined1 auVar29 [16];
904
  undefined1 auVar30 [16];
905
  undefined1 auVar31 [16];
906
  undefined1 auVar32 [16];
907
  undefined1 auVar33 [16];
908
  undefined1 auVar34 [16];
909
  undefined1 auVar35 [16];
910

911
  if (param_2 != 0x111) {
912
    if (param_2 == 2) {
913
      DAT_1400080e0 = 0;
914
      return 0;
915
    }
916
    if (param_2 != 1) {
917
LAB_14000292b:
918
                    // WARNING: Could not recover jumptable at 0x00014000293f. Too many branches
919
                    // WARNING: Treating indirect jump as call
920
      LVar7 = DefWindowProcW(param_1,param_2,param_3,param_4);
921
      return LVar7;
922
    }
923
    pHVar6 = GetModuleHandleW((LPCWSTR)0x0);
924
    CreateWindowExW(0,L"STATIC",L"Your reward:",0x50000000,0x14,0x12,0x1ae,0x16,param_1,(HMENU)0x0,
925
                    pHVar6,(LPVOID)0x0);
926
    local_58 = (undefined1  [16])0x0;
927
    local_48 = (LPCWSTR)0x0;
928
    uVar15 = _DAT_140008098;
929
    if ((DAT_140008090 & 1) == 0) {
930
      uVar15 = (ulonglong)(DAT_140008090 >> 1);
931
    }
932
    _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE7reserveEy
933
              (local_58,uVar15 + (uVar15 / 0x46) * 2);
934
    if ((DAT_140008090 & 1) == 0) {
935
      if (DAT_140008090 >> 1 != 0) goto LAB_140002993;
936
    }
937
    else if (_DAT_140008098 != 0) {
938
LAB_140002993:
939
      pWVar8 = ram0x0001400080a0;
940
      if ((DAT_140008090 & 1) == 0) {
941
        pWVar8 = (LPCWSTR)&DAT_140008091;
942
      }
943
      _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE9push_backEw
944
                (local_58,(char)*pWVar8);
945
      if ((DAT_140008090 & 1) == 0) {
946
        if (1 < DAT_140008090 >> 1) goto LAB_1400029dd;
947
      }
948
      else if (1 < _DAT_140008098) {
949
LAB_1400029dd:
950
        uVar15 = 1;
951
        do {
952
          if (uVar15 == (uVar15 / 0x46) * 0x46) {
953
            _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKw
954
                      (local_58,&DAT_140005252);
955
          }
956
          pWVar8 = (LPCWSTR)&DAT_140008091;
957
          if ((DAT_140008090 & 1) != 0) {
958
            pWVar8 = ram0x0001400080a0;
959
          }
960
          _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE9push_backEw
961
                    (local_58,*(char *)((longlong)pWVar8 + uVar15));
962
          uVar16 = _DAT_140008098;
963
          if ((DAT_140008090 & 1) == 0) {
964
            uVar16 = (ulonglong)(DAT_140008090 >> 1);
965
          }
966
          uVar15 = uVar15 + 1;
967
        } while (uVar15 < uVar16);
968
      }
969
    }
970
    pWVar8 = local_48;
971
    bVar4 = local_58[0];
972
    pHVar6 = GetModuleHandleW((LPCWSTR)0x0);
973
    if ((bVar4 & 1) == 0) {
974
      pWVar8 = (LPCWSTR)(local_58 + 2);
975
    }
976
    pHVar9 = CreateWindowExW(0x200,L"EDIT",pWVar8,0x50201944,0x14,0x30,0x410,0xfa,param_1,
977
                             (HMENU)0x2001,pHVar6,(LPVOID)0x0);
978
    SendMessageW(pHVar9,0xc5,10000,0);
979
    SendMessageW(pHVar9,0xb1,0,-1);
980
    pHVar6 = GetModuleHandleW((LPCWSTR)0x0);
981
    CreateWindowExW(0,L"BUTTON",L"COPY",0x50000001,0x1ea,0x140,0x78,0x20,param_1,(HMENU)0x2002,
982
                    pHVar6,(LPVOID)0x0);
983
    bVar4 = local_58[0];
984
    goto joined_r0x000140002dbd;
985
  }
986
  if (((uint)param_3 & 0xffff) != 0x2002) goto LAB_14000292b;
987
  BVar5 = OpenClipboard(param_1);
988
  if (BVar5 == 0) {
989
    Sleep(10);
990
    BVar5 = OpenClipboard(param_1);
991
    if (BVar5 == 0) {
992
      Sleep(10);
993
      BVar5 = OpenClipboard(param_1);
994
      if (BVar5 == 0) {
995
        Sleep(10);
996
        BVar5 = OpenClipboard(param_1);
997
        if (BVar5 == 0) {
998
          Sleep(10);
999
          BVar5 = OpenClipboard(param_1);
1000
          if (BVar5 == 0) {
1001
            Sleep(10);
1002
            BVar5 = OpenClipboard(param_1);
1003
            if (BVar5 == 0) {
1004
              Sleep(10);
1005
              BVar5 = OpenClipboard(param_1);
1006
              if (BVar5 == 0) {
1007
                Sleep(10);
1008
                BVar5 = OpenClipboard(param_1);
1009
                if (BVar5 == 0) {
1010
                  Sleep(10);
1011
                  BVar5 = OpenClipboard(param_1);
1012
                  if (BVar5 == 0) {
1013
                    Sleep(10);
1014
                    BVar5 = OpenClipboard(param_1);
1015
                    if (BVar5 == 0) {
1016
                      Sleep(10);
1017
                    }
1018
                  }
1019
                }
1020
              }
1021
            }
1022
          }
1023
        }
1024
      }
1025
    }
1026
  }
1027
  pHVar9 = GetOpenClipboardWindow();
1028
  if ((pHVar9 != param_1) && (BVar5 = OpenClipboard(param_1), BVar5 == 0)) {
1029
    return 0;
1030
  }
1031
  EmptyClipboard();
1032
  pWVar8 = ram0x0001400080a0;
1033
  uVar15 = _DAT_140008098;
1034
  if ((DAT_140008090 & 1) == 0) {
1035
    pWVar8 = (LPCWSTR)&DAT_140008091;
1036
    uVar15 = (ulonglong)(DAT_140008090 >> 1);
1037
  }
1038
  if (0x7ffffffffffffff5 < uVar15) {
1039
    uVar14 = FUN_140003090();
1040
    if ((unaff_RBP & 1) != 0) {
1041
      _ZdlPv(local_48);
1042
    }
1043
    _Unwind_Resume(uVar14);
1044
    pcVar3 = (code *)swi(3);
1045
    LVar7 = (*pcVar3)();
1046
    return LVar7;
1047
  }
1048
  if (uVar15 < 0xb) {
1049
    local_58[0] = (char)uVar15 * '\x02';
1050
    pWVar10 = (LPCWSTR)(local_58 + 2);
1051
    if (uVar15 != 0) goto LAB_140002bbb;
1052
  }
1053
  else {
1054
    lVar19 = 0xe;
1055
    if ((uVar15 | 3) != 0xb) {
1056
      lVar19 = (uVar15 | 3) + 1;
1057
    }
1058
    pWVar10 = (LPCWSTR)_Znwy(lVar19 * 2);
1059
    local_58._8_8_ = uVar15;
1060
    local_58._0_8_ = lVar19 + 1;
1061
    local_48 = pWVar10;
1062
LAB_140002bbb:
1063
    pWVar1 = (LPCWSTR)((longlong)pWVar8 + uVar15);
1064
    if ((0xf < uVar15) && ((pWVar1 <= pWVar10 || (pWVar10 + uVar15 <= pWVar8)))) {
1065
      uVar16 = uVar15 & 0x7ffffffffffffff0;
1066
      pWVar11 = pWVar10 + uVar16;
1067
      uVar18 = 0;
1068
      do {
1069
        uVar2 = *(ulonglong *)((longlong)pWVar8 + uVar18);
1070
        uVar27 = (undefined1)(uVar2 >> 0x38);
1071
        auVar25._8_6_ = 0;
1072
        auVar25._0_8_ = uVar2;
1073
        auVar25[0xe] = uVar27;
1074
        auVar25[0xf] = uVar27;
1075
        uVar27 = (undefined1)(uVar2 >> 0x30);
1076
        auVar24._14_2_ = auVar25._14_2_;
1077
        auVar24._8_5_ = 0;
1078
        auVar24._0_8_ = uVar2;
1079
        auVar24[0xd] = uVar27;
1080
        auVar23._13_3_ = auVar24._13_3_;
1081
        auVar23._8_4_ = 0;
1082
        auVar23._0_8_ = uVar2;
1083
        auVar23[0xc] = uVar27;
1084
        uVar27 = (undefined1)(uVar2 >> 0x28);
1085
        auVar22._12_4_ = auVar23._12_4_;
1086
        auVar22._8_3_ = 0;
1087
        auVar22._0_8_ = uVar2;
1088
        auVar22[0xb] = uVar27;
1089
        auVar21._11_5_ = auVar22._11_5_;
1090
        auVar21._8_2_ = 0;
1091
        auVar21._0_8_ = uVar2;
1092
        auVar21[10] = uVar27;
1093
        uVar27 = (undefined1)(uVar2 >> 0x20);
1094
        auVar20._10_6_ = auVar21._10_6_;
1095
        auVar20[8] = 0;
1096
        auVar20._0_8_ = uVar2;
1097
        auVar20[9] = uVar27;
1098
        auVar36._9_7_ = auVar20._9_7_;
1099
        auVar36[8] = uVar27;
1100
        auVar36._0_8_ = uVar2;
1101
        uVar27 = (undefined1)(uVar2 >> 0x18);
1102
        auVar26._8_8_ = auVar36._8_8_;
1103
        auVar26[7] = uVar27;
1104
        auVar26[6] = uVar27;
1105
        uVar27 = (undefined1)(uVar2 >> 0x10);
1106
        auVar26[5] = uVar27;
1107
        auVar26[4] = uVar27;
1108
        uVar27 = (undefined1)(uVar2 >> 8);
1109
        auVar26[3] = uVar27;
1110
        auVar26[2] = uVar27;
1111
        auVar26[0] = (undefined1)uVar2;
1112
        auVar26[1] = auVar26[0];
1113
        uVar2 = *(ulonglong *)((longlong)pWVar8 + uVar18 + 8);
1114
        uVar27 = (undefined1)(uVar2 >> 0x38);
1115
        auVar35._8_6_ = 0;
1116
        auVar35._0_8_ = uVar2;
1117
        auVar35[0xe] = uVar27;
1118
        auVar35[0xf] = uVar27;
1119
        uVar27 = (undefined1)(uVar2 >> 0x30);
1120
        auVar34._14_2_ = auVar35._14_2_;
1121
        auVar34._8_5_ = 0;
1122
        auVar34._0_8_ = uVar2;
1123
        auVar34[0xd] = uVar27;
1124
        auVar33._13_3_ = auVar34._13_3_;
1125
        auVar33._8_4_ = 0;
1126
        auVar33._0_8_ = uVar2;
1127
        auVar33[0xc] = uVar27;
1128
        uVar27 = (undefined1)(uVar2 >> 0x28);
1129
        auVar32._12_4_ = auVar33._12_4_;
1130
        auVar32._8_3_ = 0;
1131
        auVar32._0_8_ = uVar2;
1132
        auVar32[0xb] = uVar27;
1133
        auVar31._11_5_ = auVar32._11_5_;
1134
        auVar31._8_2_ = 0;
1135
        auVar31._0_8_ = uVar2;
1136
        auVar31[10] = uVar27;
1137
        uVar27 = (undefined1)(uVar2 >> 0x20);
1138
        auVar30._10_6_ = auVar31._10_6_;
1139
        auVar30[8] = 0;
1140
        auVar30._0_8_ = uVar2;
1141
        auVar30[9] = uVar27;
1142
        auVar29._9_7_ = auVar30._9_7_;
1143
        auVar29[8] = uVar27;
1144
        auVar29._0_8_ = uVar2;
1145
        uVar27 = (undefined1)(uVar2 >> 0x18);
1146
        auVar28._8_8_ = auVar29._8_8_;
1147
        auVar28[7] = uVar27;
1148
        auVar28[6] = uVar27;
1149
        uVar27 = (undefined1)(uVar2 >> 0x10);
1150
        auVar28[5] = uVar27;
1151
        auVar28[4] = uVar27;
1152
        uVar27 = (undefined1)(uVar2 >> 8);
1153
        auVar28[3] = uVar27;
1154
        auVar28[2] = uVar27;
1155
        auVar28[0] = (undefined1)uVar2;
1156
        auVar28[1] = auVar28[0];
1157
        auVar26 = psraw(auVar26,8);
1158
        auVar36 = psraw(auVar28,8);
1159
        *(undefined1 (*) [16])(pWVar10 + uVar18) = auVar26;
1160
        *(undefined1 (*) [16])(pWVar10 + uVar18 + 8) = auVar36;
1161
        uVar18 = uVar18 + 0x10;
1162
      } while (uVar16 != uVar18);
1163
      pWVar10 = pWVar11;
1164
      pWVar8 = (LPCWSTR)((longlong)pWVar8 + uVar16);
1165
      if (uVar15 == uVar16) goto LAB_140002cce;
1166
    }
1167
    uVar17 = (int)pWVar1 - (int)pWVar8 & 7;
1168
    uVar15 = (ulonglong)uVar17;
1169
    pWVar11 = pWVar8;
1170
    if (uVar17 != 0) {
1171
      do {
1172
        *pWVar10 = (short)(char)*pWVar11;
1173
        pWVar10 = pWVar10 + 1;
1174
        pWVar11 = (LPCWSTR)((longlong)pWVar11 + 1);
1175
        uVar15 = uVar15 - 1;
1176
      } while (uVar15 != 0);
1177
    }
1178
    if ((ulonglong)((longlong)pWVar8 - (longlong)pWVar1) < 0xfffffffffffffff9) {
1179
      do {
1180
        *pWVar10 = (short)(char)*pWVar11;
1181
        pWVar10[1] = (short)*(char *)((longlong)pWVar11 + 1);
1182
        pWVar10[2] = (short)(char)pWVar11[1];
1183
        pWVar10[3] = (short)*(char *)((longlong)pWVar11 + 3);
1184
        pWVar10[4] = (short)(char)pWVar11[2];
1185
        pWVar10[5] = (short)*(char *)((longlong)pWVar11 + 5);
1186
        pWVar10[6] = (short)(char)pWVar11[3];
1187
        pWVar10[7] = (short)*(char *)((longlong)pWVar11 + 7);
1188
        pWVar10 = pWVar10 + 8;
1189
        pWVar11 = pWVar11 + 4;
1190
      } while (pWVar11 != pWVar1);
1191
    }
1192
  }
1193
LAB_140002cce:
1194
  *pWVar10 = L'\0';
1195
  bVar4 = local_58[0];
1196
  if ((local_58[0] & 1) == 0) {
1197
    uVar15 = (ulonglong)(local_58[0] >> 1);
1198
  }
1199
  else {
1200
    uVar15 = local_58._8_8_;
1201
  }
1202
  dwBytes = uVar15 * 2 + 2;
1203
  pvVar12 = GlobalAlloc(2,dwBytes);
1204
  if (pvVar12 != (HGLOBAL)0x0) {
1205
    pvVar13 = GlobalLock(pvVar12);
1206
    pWVar8 = local_48;
1207
    if ((bVar4 & 1) == 0) {
1208
      pWVar8 = (LPCWSTR)(local_58 + 2);
1209
    }
1210
    memcpy(pvVar13,pWVar8,dwBytes);
1211
    GlobalUnlock(pvVar12);
1212
    SetClipboardData(0xd,pvVar12);
1213
  }
1214
  uVar15 = _DAT_140008098;
1215
  if ((DAT_140008090 & 1) == 0) {
1216
    uVar15 = (ulonglong)(DAT_140008090 >> 1);
1217
  }
1218
  pvVar12 = GlobalAlloc(2,uVar15 + 1);
1219
  if (pvVar12 != (HGLOBAL)0x0) {
1220
    pvVar13 = GlobalLock(pvVar12);
1221
    pWVar8 = (LPCWSTR)&DAT_140008091;
1222
    if ((DAT_140008090 & 1) != 0) {
1223
      pWVar8 = ram0x0001400080a0;
1224
    }
1225
    memcpy(pvVar13,pWVar8,uVar15 + 1);
1226
    GlobalUnlock(pvVar12);
1227
    SetClipboardData(1,pvVar12);
1228
  }
1229
  CloseClipboard();
1230
joined_r0x000140002dbd:
1231
  if ((bVar4 & 1) != 0) {
1232
    _ZdlPv(local_48);
1233
  }
1234
  return 0;
1235
}
1236

1237

1238

1239
DWORD __stdcall GetTickCount(void)
1240

1241
{
1242
  DWORD DVar1;
1243

1244
                    // WARNING: Could not recover jumptable at 0x000140002e10. Too many branches
1245
                    // WARNING: Treating indirect jump as call
1246
  DVar1 = GetTickCount();
1247
  return DVar1;
1248
}
1249

1250

1251

1252
// WARNING: Globals starting with '_' overlap smaller symbols at the same address
1253

1254
void FUN_140002e20(void)
1255

1256
{
1257
  DAT_140008078 = 0;
1258
  DAT_140008080 = 0;
1259
  _DAT_140008088 = 0;
1260
  FUN_1400013c0();
1261
  _DAT_140008090 = 0;
1262
  _DAT_140008098 = 0;
1263
  ram0x0001400080a0 = 0;
1264
  FUN_1400013c0();
1265
  ram0x0001400080a8 = 0;
1266
  ram0x0001400080b0 = 0;
1267
  _DAT_1400080b8 = 0;
1268
  FUN_1400013c0();
1269
  return;
1270
}
1271

1272

1273

1274
void FUN_140002e90(longlong *param_1,ulonglong param_2)
1275

1276
{
1277
  longlong lVar1;
1278
  void *pvVar2;
1279
  code *pcVar3;
1280
  ulonglong uVar4;
1281
  longlong lVar5;
1282
  ulonglong _Size;
1283
  void *_Dst;
1284
  ulonglong uVar6;
1285
  ulonglong uVar7;
1286
  ulonglong uVar8;
1287

1288
  lVar1 = *param_1;
1289
  pvVar2 = (void *)param_1[1];
1290
  uVar6 = (longlong)pvVar2 - lVar1;
1291
  _Size = param_2 - uVar6;
1292
  if (param_2 < uVar6 || _Size == 0) {
1293
    if (param_2 < uVar6) {
1294
      param_1[1] = lVar1 + param_2;
1295
    }
1296
  }
1297
  else if ((ulonglong)(param_1[2] - (longlong)pvVar2) < _Size) {
1298
    if ((longlong)param_2 < 0) {
1299
      FUN_140002fb0();
1300
      pcVar3 = (code *)swi(3);
1301
      (*pcVar3)();
1302
      return;
1303
    }
1304
    uVar7 = param_1[2] - lVar1;
1305
    uVar4 = uVar7 * 2;
1306
    if (uVar4 <= param_2) {
1307
      uVar4 = param_2;
1308
    }
1309
    uVar8 = 0x7fffffffffffffff;
1310
    if (uVar7 < 0x3fffffffffffffff) {
1311
      uVar8 = uVar4;
1312
    }
1313
    lVar5 = _Znwy(uVar8);
1314
    pvVar2 = (void *)*param_1;
1315
    lVar1 = param_1[1];
1316
    memset((void *)(uVar6 + lVar5),0,_Size);
1317
    _Dst = (void *)(((longlong)pvVar2 - lVar1) + (longlong)(uVar6 + lVar5));
1318
    memcpy(_Dst,pvVar2,lVar1 - (longlong)pvVar2);
1319
    *param_1 = (longlong)_Dst;
1320
    param_1[1] = lVar5 + param_2;
1321
    param_1[2] = uVar8 + lVar5;
1322
    if (pvVar2 != (void *)0x0) {
1323
      _ZdlPv(pvVar2);
1324
      return;
1325
    }
1326
  }
1327
  else {
1328
    memset(pvVar2,0,_Size);
1329
    param_1[1] = (longlong)pvVar2 + _Size;
1330
  }
1331
  return;
1332
}
1333

1334

1335

1336
void FUN_140002fb0(void)
1337

1338
{
1339
                    // WARNING: Subroutine does not return
1340
  FUN_140002fd0();
1341
}
1342

1343

1344

1345
void FUN_140002fd0(void)
1346

1347
{
1348
  code *pcVar1;
1349
  undefined8 *puVar2;
1350
  undefined8 uVar3;
1351

1352
  puVar2 = (undefined8 *)__cxa_allocate_exception(0x10);
1353
  FUN_140003020(puVar2);
1354
  uVar3 = __cxa_throw(puVar2,&PTR_PTR__ZdlPv_1400052a0,&DAT_1400045f0);
1355
  __cxa_free_exception(puVar2);
1356
  _Unwind_Resume(uVar3);
1357
  pcVar1 = (code *)swi(3);
1358
  (*pcVar1)();
1359
  return;
1360
}
1361

1362

1363

1364
void FUN_140003020(undefined8 *param_1)
1365

1366
{
1367
  _ZNSt11logic_errorC2EPKc();
1368
  *param_1 = _ZTVSt12length_error_exref + 0x10;
1369
  return;
1370
}
1371

1372

1373

1374
void FUN_140003050(void)
1375

1376
{
1377
  code *pcVar1;
1378
  undefined8 uVar2;
1379

1380
  uVar2 = __cxa_allocate_exception(8);
1381
  _ZNSt20bad_array_new_lengthC1Ev(uVar2);
1382
  __cxa_throw(uVar2,&PTR_PTR__ZdlPv_140005318,&DAT_140004610);
1383
  pcVar1 = (code *)swi(3);
1384
  (*pcVar1)();
1385
  return;
1386
}
1387

1388

1389

1390
void FUN_140003090(void)
1391

1392
{
1393
                    // WARNING: Subroutine does not return
1394
  FUN_140002fd0();
1395
}
1396

1397

1398

1399
void FUN_1400030b0(longlong *param_1,undefined8 *param_2)
1400

1401
{
1402
  void *_Src;
1403
  code *pcVar1;
1404
  ulonglong uVar2;
1405
  longlong lVar3;
1406
  ulonglong uVar4;
1407
  void *_Dst;
1408
  longlong lVar5;
1409
  undefined8 *puVar6;
1410
  ulonglong uVar7;
1411

1412
  puVar6 = (undefined8 *)param_1[1];
1413
  if (puVar6 < (undefined8 *)param_1[2]) {
1414
    *puVar6 = *param_2;
1415
    puVar6 = puVar6 + 1;
1416
LAB_14000317e:
1417
    param_1[1] = (longlong)puVar6;
1418
    return;
1419
  }
1420
  lVar5 = (longlong)puVar6 - *param_1;
1421
  uVar4 = (lVar5 >> 3) + 1;
1422
  if (uVar4 >> 0x3d == 0) {
1423
    uVar2 = param_1[2] - *param_1;
1424
    uVar7 = (longlong)uVar2 >> 2;
1425
    if (uVar7 <= uVar4) {
1426
      uVar7 = uVar4;
1427
    }
1428
    if (0x7ffffffffffffff7 < uVar2) {
1429
      uVar7 = 0x1fffffffffffffff;
1430
    }
1431
    if (uVar7 < 0x2000000000000000) {
1432
      lVar3 = _Znwy(uVar7 * 8);
1433
      *(undefined8 *)(lVar3 + lVar5) = *param_2;
1434
      puVar6 = (undefined8 *)(lVar5 + lVar3 + 8);
1435
      _Src = (void *)*param_1;
1436
      _Dst = (void *)((lVar3 + lVar5) - (param_1[1] - (longlong)_Src));
1437
      memcpy(_Dst,_Src,param_1[1] - (longlong)_Src);
1438
      *param_1 = (longlong)_Dst;
1439
      param_1[1] = (longlong)puVar6;
1440
      param_1[2] = lVar3 + uVar7 * 8;
1441
      if (_Src != (void *)0x0) {
1442
        _ZdlPv(_Src);
1443
      }
1444
      goto LAB_14000317e;
1445
    }
1446
  }
1447
  else {
1448
    FUN_1400031a0();
1449
  }
1450
  FUN_140003050();
1451
  pcVar1 = (code *)swi(3);
1452
  (*pcVar1)();
1453
  return;
1454
}
1455

1456

1457

1458
void FUN_1400031a0(void)
1459

1460
{
1461
                    // WARNING: Subroutine does not return
1462
  FUN_140002fd0();
1463
}
1464

1465

1466

1467
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1468
// WARNING: Removing unreachable block (ram,0x000140003209)
1469
// WARNING: Removing unreachable block (ram,0x000140003211)
1470
// WARNING: Removing unreachable block (ram,0x000140003200)
1471

1472
void tls_callback_0(undefined8 param_1,int param_2)
1473

1474
{
1475
  if (DAT_140008038 != 2) {
1476
    DAT_140008038 = 2;
1477
  }
1478
  if (param_2 == 1) {
1479
    FUN_140003d80(param_1,1);
1480
    return;
1481
  }
1482
  return;
1483
}
1484

1485

1486

1487
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1488

1489
undefined8 tls_callback_1(undefined8 param_1,int param_2)
1490

1491
{
1492
  DWORD *pDVar1;
1493
  DWORD *pDVar2;
1494
  DWORD DVar3;
1495
  undefined8 in_RAX;
1496
  LPVOID pvVar4;
1497

1498
  if ((param_2 != 3) && (param_2 != 0)) {
1499
    return in_RAX;
1500
  }
1501
  switch(param_2) {
1502
  case 0:
1503
    if (DAT_140008148 != 0) {
1504
      EnterCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
1505
      for (pDVar1 = DAT_140008178; pDVar1 != (DWORD *)0x0; pDVar1 = *(DWORD **)(pDVar1 + 4)) {
1506
        pvVar4 = TlsGetValue(*pDVar1);
1507
        DVar3 = GetLastError();
1508
        if ((DVar3 == 0) && (pvVar4 != (LPVOID)0x0)) {
1509
          (**(code **)(pDVar1 + 2))(pvVar4);
1510
        }
1511
      }
1512
      LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
1513
    }
1514
    if (DAT_140008148 == 1) {
1515
      DAT_140008148 = 1;
1516
      pDVar1 = DAT_140008178;
1517
      while (pDVar1 != (DWORD *)0x0) {
1518
        pDVar2 = *(DWORD **)(pDVar1 + 4);
1519
        free(pDVar1);
1520
        pDVar1 = pDVar2;
1521
      }
1522
      DAT_140008178 = (DWORD *)0x0;
1523
      DAT_140008148 = 0;
1524
      DeleteCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
1525
    }
1526
    break;
1527
  case 1:
1528
    if (DAT_140008148 == 0) {
1529
      InitializeCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
1530
    }
1531
    DAT_140008148 = 1;
1532
    break;
1533
  case 2:
1534
    FUN_140003570();
1535
    break;
1536
  case 3:
1537
    if (DAT_140008148 != 0) {
1538
      EnterCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
1539
      for (pDVar1 = DAT_140008178; pDVar1 != (DWORD *)0x0; pDVar1 = *(DWORD **)(pDVar1 + 4)) {
1540
        pvVar4 = TlsGetValue(*pDVar1);
1541
        DVar3 = GetLastError();
1542
        if ((DVar3 == 0) && (pvVar4 != (LPVOID)0x0)) {
1543
          (**(code **)(pDVar1 + 2))(pvVar4);
1544
        }
1545
      }
1546
      LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
1547
    }
1548
  }
1549
  return 1;
1550
}
1551

1552

1553

1554
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1555

1556
void FUN_140003260(void)
1557

1558
{
1559
  code *pcVar1;
1560

1561
  pcVar1 = *(code **)PTR_DAT_140008008;
1562
  while (pcVar1 != (code *)0x0) {
1563
    (*pcVar1)();
1564
    pcVar1 = *(code **)(PTR_DAT_140008008 + 8);
1565
    PTR_DAT_140008008 = PTR_DAT_140008008 + 8;
1566
  }
1567
  return;
1568
}
1569

1570

1571

1572
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1573

1574
void FUN_1400032b0(void)
1575

1576
{
1577
  uint uVar1;
1578
  uint uVar2;
1579
  ulonglong uVar3;
1580

1581
  uVar2 = 0xffffffff;
1582
  do {
1583
    uVar1 = uVar2 + 2;
1584
    uVar2 = uVar2 + 1;
1585
  } while ((&DAT_1400064b0)[uVar1] != 0);
1586
  if (uVar2 != 0) {
1587
    uVar3 = (ulonglong)uVar2;
1588
    do {
1589
      uVar3 = uVar3 - 1;
1590
      (*(code *)(&PTR_FUN_1400064b8)[uVar3])();
1591
    } while ((int)uVar3 != 0);
1592
  }
1593
  FUN_1400013c0();
1594
  return;
1595
}
1596

1597

1598

1599
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1600

1601
void FUN_140003320(void)
1602

1603
{
1604
  uint uVar1;
1605
  uint uVar2;
1606
  ulonglong uVar3;
1607

1608
  if (DAT_1400080f8 == '\0') {
1609
    DAT_1400080f8 = '\x01';
1610
    uVar2 = 0xffffffff;
1611
    do {
1612
      uVar1 = uVar2 + 2;
1613
      uVar2 = uVar2 + 1;
1614
    } while ((&DAT_1400064b0)[uVar1] != 0);
1615
    if (uVar2 != 0) {
1616
      uVar3 = (ulonglong)uVar2;
1617
      do {
1618
        uVar3 = uVar3 - 1;
1619
        (*(code *)(&PTR_FUN_1400064b8)[uVar3])();
1620
      } while ((int)uVar3 != 0);
1621
    }
1622
    FUN_1400013c0();
1623
    return;
1624
  }
1625
  return;
1626
}
1627

1628

1629

1630
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1631

1632
undefined8 FUN_1400033b0(undefined8 *param_1)
1633

1634
{
1635
  uint uVar1;
1636
  bool bVar2;
1637
  code *extraout_RAX;
1638
  code *extraout_RAX_00;
1639
  code *extraout_RAX_01;
1640
  code *pcVar3;
1641
  undefined8 uVar4;
1642
  undefined8 uVar5;
1643

1644
  uVar1 = *(uint *)*param_1;
1645
  if (((uVar1 & 0x20ffffff) == 0x20474343) && ((((uint *)*param_1)[1] & 1) == 0)) {
1646
    return 0xffffffff;
1647
  }
1648
  uVar5 = 0xffffffff;
1649
  if ((int)uVar1 < -0x3fffffe3) {
1650
    if (uVar1 == 0x80000002) {
1651
      return 0xffffffff;
1652
    }
1653
    if (uVar1 != 0xc0000005) {
1654
      if (uVar1 == 0xc0000008) {
1655
        return 0xffffffff;
1656
      }
1657
      goto LAB_1400034c3;
1658
    }
1659
    signal(0xb);
1660
    if (extraout_RAX_01 == (code *)0x0) goto LAB_1400034c3;
1661
    if (extraout_RAX_01 == (code *)0x1) {
1662
      signal(0xb);
1663
      return 0xffffffff;
1664
    }
1665
    uVar4 = 0xb;
1666
    pcVar3 = extraout_RAX_01;
1667
    goto LAB_1400034fa;
1668
  }
1669
  switch(uVar1) {
1670
  case 0xc000008c:
1671
  case 0xc0000092:
1672
  case 0xc0000095:
1673
    goto switchD_140003403_caseD_c000008c;
1674
  case 0xc000008d:
1675
  case 0xc000008e:
1676
  case 0xc000008f:
1677
  case 0xc0000090:
1678
  case 0xc0000091:
1679
  case 0xc0000093:
1680
    bVar2 = false;
1681
    break;
1682
  case 0xc0000094:
1683
    bVar2 = true;
1684
    break;
1685
  case 0xc0000096:
1686
    goto switchD_140003403_caseD_c0000096;
1687
  default:
1688
    if (uVar1 != 0xc000001d) goto LAB_1400034c3;
1689
switchD_140003403_caseD_c0000096:
1690
    signal(4);
1691
    if (extraout_RAX_00 == (code *)0x0) goto LAB_1400034c3;
1692
    if (extraout_RAX_00 == (code *)0x1) {
1693
      signal(4);
1694
      return 0xffffffff;
1695
    }
1696
    uVar4 = 4;
1697
    pcVar3 = extraout_RAX_00;
1698
    goto LAB_1400034fa;
1699
  }
1700
  signal(8);
1701
  if (extraout_RAX == (code *)0x0) {
1702
LAB_1400034c3:
1703
    if (DAT_140008100 != (code *)0x0) {
1704
                    // WARNING: Could not recover jumptable at 0x000140004370. Too many branches
1705
                    // WARNING: Treating indirect jump as call
1706
      uVar5 = (*DAT_140008100)(param_1);
1707
      return uVar5;
1708
    }
1709
    uVar5 = 0;
1710
  }
1711
  else if (extraout_RAX == (code *)0x1) {
1712
    signal(8);
1713
    if (!bVar2) {
1714
      FUN_140003570();
1715
    }
1716
  }
1717
  else {
1718
    uVar4 = 8;
1719
    pcVar3 = extraout_RAX;
1720
LAB_1400034fa:
1721
    (*pcVar3)(uVar4);
1722
  }
1723
switchD_140003403_caseD_c000008c:
1724
  return uVar5;
1725
}
1726

1727

1728

1729
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
1730

1731
void FUN_140003510(undefined4 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4,
1732
                  undefined8 param_5)
1733

1734
{
1735
  undefined4 local_28 [2];
1736
  undefined8 local_20;
1737
  undefined8 local_18;
1738
  undefined8 local_10;
1739
  undefined8 local_8;
1740

1741
  if (DAT_140008108 != 0) {
1742
    local_8 = param_5;
1743
    local_28[0] = param_1;
1744
    local_20 = param_2;
1745
    local_18 = param_3;
1746
    local_10 = param_4;
1747
    (*(code *)DAT_140008108)(local_28);
1748
  }
1749
  return;
1750
}
1751

1752

1753

1754
void FUN_140003560(undefined8 param_1)
1755

1756
{
1757
  DAT_140008108 = param_1;
1758
  __setusermatherr();
1759
  return;
1760
}
1761

1762

1763

1764
void FUN_140003570(void)
1765

1766
{
1767
  return;
1768
}
1769

1770

1771

1772
undefined8 FUN_140003580(int *param_1)
1773

1774
{
1775
  undefined8 uVar1;
1776
  char *pcVar2;
1777

1778
  if (*param_1 - 1U < 6) {
1779
    pcVar2 = &DAT_1400060c8 + *(int *)(&DAT_1400060c8 + (ulonglong)(*param_1 - 1U) * 4);
1780
  }
1781
  else {
1782
    pcVar2 = "Unknown error";
1783
  }
1784
  uVar1 = __acrt_iob_func(2);
1785
  FUN_140003f20(uVar1,"_matherr(): %s in %s(%g, %g)  (retval=%g)\n",pcVar2,
1786
                *(undefined8 *)(param_1 + 2));
1787
  return 0;
1788
}
1789

1790

1791

1792
// WARNING: Removing unreachable block (ram,0x0001400038ec)
1793
// WARNING: Removing unreachable block (ram,0x0001400036bd)
1794
// WARNING: Removing unreachable block (ram,0x0001400036e0)
1795

1796
void FUN_1400035f0(undefined8 param_1,undefined8 param_2,void *param_3,ulonglong param_4)
1797

1798
{
1799
  DWORD flNewProtect;
1800
  LPVOID lpAddress;
1801
  SIZE_T dwSize;
1802
  uint uVar1;
1803
  longlong lVar2;
1804
  int iVar3;
1805
  uint uVar4;
1806
  ulonglong uVar5;
1807
  undefined1 *puVar6;
1808
  longlong lVar7;
1809
  undefined **ppuVar8;
1810
  longlong lVar9;
1811
  byte bVar10;
1812
  char *pcVar11;
1813
  ulonglong uVar12;
1814
  bool bVar13;
1815
  longlong alStack_90 [7];
1816
  undefined1 auStack_58 [16];
1817
  longlong local_48;
1818

1819
  if (DAT_140008130 == '\0') {
1820
    DAT_140008130 = '\x01';
1821
    alStack_90[2] = 0x140003622;
1822
    FUN_1400040f0();
1823
    alStack_90[6] = 0x14000363d;
1824
    uVar5 = FUN_140004300();
1825
    lVar2 = -uVar5;
1826
    DAT_140008138 = auStack_58 + lVar2;
1827
    DAT_140008140 = 0;
1828
    ppuVar8 = (undefined **)&DAT_140006414;
1829
    do {
1830
      bVar10 = *(byte *)(ppuVar8 + 1);
1831
      uVar1 = bVar10 - 8 >> 3;
1832
      uVar4 = (uint)bVar10 << 0x1d | uVar1;
1833
      if (7 < uVar4) {
1834
switchD_140003814_caseD_2:
1835
        local_48 = 0;
1836
                    // WARNING: Subroutine does not return
1837
        *(undefined8 *)((longlong)alStack_90 + lVar2 + 0x10) = 0x1400038ec;
1838
        FUN_140003aa0("  Unknown pseudo relocation bit size %d.\n",(ulonglong)bVar10,param_3,param_4
1839
                     );
1840
      }
1841
      pcVar11 = IMAGE_DOS_HEADER_140000000.e_magic + *(uint *)((longlong)ppuVar8 + 4);
1842
      param_4 = *(ulonglong *)(IMAGE_DOS_HEADER_140000000.e_magic + *(uint *)ppuVar8);
1843
      param_3 = (void *)((longlong)&switchD_140003814::switchdataD_1400060e0 +
1844
                        (longlong)(int)(&switchD_140003814::switchdataD_1400060e0)[uVar4]);
1845
      switch(uVar4) {
1846
      case 0:
1847
        uVar12 = (ulonglong)(byte)*pcVar11;
1848
        uVar5 = uVar12 - 0x100;
1849
        bVar13 = *pcVar11 < '\0';
1850
        break;
1851
      case 1:
1852
        uVar12 = (ulonglong)*(ushort *)pcVar11;
1853
        uVar5 = uVar12 - 0x10000;
1854
        bVar13 = (short)*(ushort *)pcVar11 < 0;
1855
        break;
1856
      default:
1857
        goto switchD_140003814_caseD_2;
1858
      case 3:
1859
        uVar12 = (ulonglong)*(uint *)pcVar11;
1860
        uVar5 = uVar12 - 0x100000000;
1861
        bVar13 = (int)*(uint *)pcVar11 < 0;
1862
        break;
1863
      case 7:
1864
        uVar5 = *(ulonglong *)pcVar11;
1865
        goto LAB_14000384b;
1866
      }
1867
      if (!bVar13) {
1868
        uVar5 = uVar12;
1869
      }
1870
LAB_14000384b:
1871
      local_48 = (uVar5 - (longlong)(IMAGE_DOS_HEADER_140000000.e_magic + *(uint *)ppuVar8)) +
1872
                 param_4;
1873
      if ((bVar10 < 0x40) &&
1874
         ((~(-1L << (bVar10 & 0x3f)) < local_48 || (local_48 < -1L << (bVar10 - 1 & 0x3f))))) {
1875
        *(longlong *)((longlong)alStack_90 + lVar2 + 0x28) = local_48;
1876
                    // WARNING: Subroutine does not return
1877
        *(undefined8 *)((longlong)alStack_90 + lVar2) = 0x1400038d4;
1878
        FUN_140003aa0("%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.\n"
1879
                      ,(ulonglong)bVar10,pcVar11,param_4);
1880
      }
1881
      bVar10 = 0x8bU >> ((byte)uVar1 & 0x1f) & uVar4 < 8;
1882
      param_3 = (void *)CONCAT71((int7)((ulonglong)local_48 >> 8),bVar10);
1883
      if (bVar10 == 1) {
1884
        param_3 = *(void **)(&DAT_140006248 + (ulonglong)uVar4 * 8);
1885
        *(undefined8 *)((longlong)alStack_90 + lVar2 + 0x10) = 0x1400038b3;
1886
        FUN_140003900(pcVar11,&local_48,param_3,param_4);
1887
      }
1888
      ppuVar8 = (undefined **)((longlong)ppuVar8 + 0xc);
1889
    } while (ppuVar8 < &PTR__guard_check_icall_140006450);
1890
    if (0 < DAT_140008140) {
1891
      lVar9 = 0x10;
1892
      lVar7 = 0;
1893
      puVar6 = DAT_140008138;
1894
      iVar3 = DAT_140008140;
1895
      do {
1896
        flNewProtect = *(DWORD *)(puVar6 + lVar9 + -0x10);
1897
        if (flNewProtect != 0) {
1898
          lpAddress = *(LPVOID *)(puVar6 + lVar9 + -8);
1899
          dwSize = *(SIZE_T *)(puVar6 + lVar9);
1900
          *(undefined8 *)((longlong)alStack_90 + lVar2 + 0x10) = 0x14000376c;
1901
          VirtualProtect(lpAddress,dwSize,flNewProtect,(PDWORD)&local_48);
1902
          puVar6 = DAT_140008138;
1903
          iVar3 = DAT_140008140;
1904
        }
1905
        lVar7 = lVar7 + 1;
1906
        lVar9 = lVar9 + 0x28;
1907
      } while (lVar7 < iVar3);
1908
    }
1909
  }
1910
  return;
1911
}
1912

1913

1914

1915
// WARNING: Enum "SectionFlags": Some values do not have unique names
1916

1917
void FUN_140003900(void *param_1,void *param_2,void *param_3,ulonglong param_4)
1918

1919
{
1920
  uint uVar1;
1921
  longlong lVar2;
1922
  BOOL BVar3;
1923
  DWORD DVar4;
1924
  IMAGE_SECTION_HEADER *pIVar5;
1925
  IMAGE_DOS_HEADER *pIVar6;
1926
  SIZE_T SVar7;
1927
  longlong lVar8;
1928
  void *pvVar9;
1929
  undefined8 uVar10;
1930
  PDWORD lpflOldProtect;
1931
  longlong lVar11;
1932
  _MEMORY_BASIC_INFORMATION local_60;
1933

1934
  lVar11 = (longlong)DAT_140008140;
1935
  if (lVar11 < 1) {
1936
    lVar11 = 0;
1937
    pvVar9 = param_3;
1938
  }
1939
  else {
1940
    lVar8 = 0;
1941
    do {
1942
      pvVar9 = *(void **)(DAT_140008138 + 0x18 + lVar8);
1943
      if (pvVar9 <= param_1) {
1944
        param_4 = (ulonglong)*(uint *)(*(longlong *)(DAT_140008138 + 0x20 + lVar8) + 8);
1945
        pvVar9 = (void *)((longlong)pvVar9 + param_4);
1946
        if (param_1 < pvVar9) goto LAB_140003a37;
1947
      }
1948
      lVar8 = lVar8 + 0x28;
1949
    } while (lVar11 * 0x28 != lVar8);
1950
  }
1951
  pIVar5 = FUN_140004080((longlong)param_1);
1952
  lVar8 = DAT_140008138;
1953
  if (pIVar5 == (IMAGE_SECTION_HEADER *)0x0) {
1954
                    // WARNING: Subroutine does not return
1955
    FUN_140003aa0("Address %p has no image-section",param_1,pvVar9,param_4);
1956
  }
1957
  lVar2 = lVar11 * 0x28;
1958
  *(IMAGE_SECTION_HEADER **)(DAT_140008138 + 0x20 + lVar2) = pIVar5;
1959
  *(undefined4 *)(lVar8 + lVar2) = 0;
1960
  pIVar6 = FUN_140004180();
1961
  uVar1 = pIVar5->VirtualAddress;
1962
  *(char **)(DAT_140008138 + 0x18 + lVar2) = pIVar6->e_magic + uVar1;
1963
  SVar7 = VirtualQuery(pIVar6->e_magic + uVar1,&local_60,0x30);
1964
  lVar8 = DAT_140008138;
1965
  if (SVar7 == 0) {
1966
                    // WARNING: Subroutine does not return
1967
    FUN_140003aa0("  VirtualQuery failed for %d bytes at address %p",
1968
                  (ulonglong)(pIVar5->Misc).PhysicalAddress,
1969
                  *(undefined8 *)(DAT_140008138 + 0x18 + lVar11 * 0x28),param_4);
1970
  }
1971
  if ((int)local_60.Protect < 8) {
1972
    uVar10 = 4;
1973
    if (local_60.Protect != 2) {
1974
      if (local_60.Protect == 4) goto LAB_140003a31;
1975
      goto LAB_1400039fe;
1976
    }
1977
  }
1978
  else {
1979
    if (((local_60.Protect == 8) || (local_60.Protect == 0x40)) || (local_60.Protect == 0x80))
1980
    goto LAB_140003a31;
1981
LAB_1400039fe:
1982
    uVar10 = 0x40;
1983
  }
1984
  lpflOldProtect = (PDWORD)(DAT_140008138 + lVar11 * 0x28);
1985
  *(PVOID *)(DAT_140008138 + 8 + lVar11 * 0x28) = local_60.BaseAddress;
1986
  *(SIZE_T *)(lVar8 + 0x10 + lVar11 * 0x28) = local_60.RegionSize;
1987
  BVar3 = VirtualProtect(local_60.BaseAddress,local_60.RegionSize,(DWORD)uVar10,lpflOldProtect);
1988
  if (BVar3 == 0) {
1989
    DVar4 = GetLastError();
1990
                    // WARNING: Subroutine does not return
1991
    FUN_140003aa0("  VirtualProtect failed with code 0x%x",(ulonglong)DVar4,uVar10,lpflOldProtect);
1992
  }
1993
LAB_140003a31:
1994
  DAT_140008140 = DAT_140008140 + 1;
1995
LAB_140003a37:
1996
  memcpy(param_1,param_2,(size_t)param_3);
1997
  return;
1998
}
1999

2000

2001

2002
void FUN_140003aa0(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)
2003

2004
{
2005
  undefined8 uVar1;
2006
  undefined8 local_res10;
2007
  undefined8 local_res18;
2008
  undefined8 local_res20;
2009

2010
  local_res10 = param_2;
2011
  local_res18 = param_3;
2012
  local_res20 = param_4;
2013
  uVar1 = __acrt_iob_func(2);
2014
  FUN_140003f20(uVar1,"Mingw-w64 runtime failure:\n",param_3,param_4);
2015
  uVar1 = __acrt_iob_func(2);
2016
  FUN_140004330(uVar1,param_1,&local_res10);
2017
                    // WARNING: Subroutine does not return
2018
  abort();
2019
}
2020

2021

2022

2023
undefined8 FUN_140003b00(void)
2024

2025
{
2026
  return 0;
2027
}
2028

2029

2030

2031
void FUN_140003b10(void)
2032

2033
{
2034
  short *psVar1;
2035
  ushort uVar2;
2036
  bool bVar3;
2037
  longlong *plVar4;
2038
  undefined *puVar5;
2039
  uint uVar6;
2040
  _STARTUPINFOW local_70;
2041

2042
  plVar4 = (longlong *)__p__wcmdln();
2043
  if (*plVar4 == 0) {
2044
    puVar5 = &DAT_140006298;
2045
  }
2046
  else {
2047
    puVar5 = (undefined *)(*plVar4 + -2);
2048
    bVar3 = false;
2049
    while ((uVar2 = *(ushort *)(puVar5 + 2), 0x20 < uVar2 || ((uVar2 != 0 && (bVar3))))) {
2050
      bVar3 = (bool)(bVar3 ^ uVar2 == 0x22);
2051
      puVar5 = puVar5 + 2;
2052
    }
2053
    do {
2054
      psVar1 = (short *)(puVar5 + 2);
2055
      puVar5 = puVar5 + 2;
2056
    } while ((ushort)(*psVar1 - 1U) < 0x20);
2057
  }
2058
  GetStartupInfoW(&local_70);
2059
  uVar6 = 10;
2060
  if (((byte)local_70.dwFlags & 1) != 0) {
2061
    uVar6 = (uint)local_70.wShowWindow;
2062
  }
2063
  FUN_140001440((HINSTANCE)&IMAGE_DOS_HEADER_140000000,0,puVar5,uVar6);
2064
  return;
2065
}
2066

2067

2068

2069
void _guard_check_icall(void)
2070

2071
{
2072
  return;
2073
}
2074

2075

2076

2077
undefined * FUN_140003bd0(void)
2078

2079
{
2080
  return PTR_DAT_140008040;
2081
}
2082

2083

2084

2085
undefined8
2086
FUN_140003be0(undefined4 *param_1,undefined8 *param_2,undefined8 *param_3,int param_4,
2087
             undefined4 *param_5)
2088

2089
{
2090
  undefined4 *puVar1;
2091
  undefined8 *puVar2;
2092

2093
  _initialize_wide_environment();
2094
  _configure_wide_argv(2 - (uint)(param_4 == 0));
2095
  puVar1 = (undefined4 *)__p___argc();
2096
  *param_1 = *puVar1;
2097
  puVar2 = (undefined8 *)__p___wargv();
2098
  *param_2 = *puVar2;
2099
  puVar2 = (undefined8 *)__p__wenviron();
2100
  *param_3 = *puVar2;
2101
  _set_new_mode(*param_5);
2102
  return 0;
2103
}
2104

2105

2106

2107
void FUN_140003c50(uint param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)
2108

2109
{
2110
  undefined8 uVar1;
2111

2112
  uVar1 = __acrt_iob_func(2);
2113
  FUN_140003f20(uVar1,"runtime error %d\n",(ulonglong)param_1,param_4);
2114
                    // WARNING: Subroutine does not return
2115
  _exit(0xff);
2116
}
2117

2118

2119

2120
undefined8 FUN_140003c80(undefined4 param_1,undefined8 param_2)
2121

2122
{
2123
  undefined4 *puVar1;
2124
  undefined8 uVar2;
2125

2126
  uVar2 = 0;
2127
  if (DAT_140008148 != 0) {
2128
    puVar1 = calloc(1,0x18);
2129
    if (puVar1 == (undefined4 *)0x0) {
2130
      uVar2 = 0xffffffff;
2131
    }
2132
    else {
2133
      *puVar1 = param_1;
2134
      *(undefined8 *)(puVar1 + 2) = param_2;
2135
      EnterCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2136
      *(undefined4 **)(puVar1 + 4) = DAT_140008178;
2137
      DAT_140008178 = puVar1;
2138
      LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2139
    }
2140
  }
2141
  return uVar2;
2142
}
2143

2144

2145

2146
undefined8 FUN_140003cf0(int param_1)
2147

2148
{
2149
  int *piVar1;
2150
  int *piVar2;
2151
  int *_Memory;
2152

2153
  if (DAT_140008148 != 0) {
2154
    EnterCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2155
    if (DAT_140008178 != (int *)0x0) {
2156
      _Memory = DAT_140008178;
2157
      if (*DAT_140008178 == param_1) {
2158
        piVar2 = (int *)0x0;
2159
      }
2160
      else {
2161
        do {
2162
          piVar2 = _Memory;
2163
          _Memory = *(int **)(piVar2 + 4);
2164
          if (_Memory == (int *)0x0) goto LAB_140003d62;
2165
        } while (*_Memory != param_1);
2166
      }
2167
      piVar1 = *(int **)(_Memory + 4);
2168
      if (piVar2 != (int *)0x0) {
2169
        *(int **)(piVar2 + 4) = *(int **)(_Memory + 4);
2170
        piVar1 = DAT_140008178;
2171
      }
2172
      DAT_140008178 = piVar1;
2173
      free(_Memory);
2174
    }
2175
LAB_140003d62:
2176
    LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2177
  }
2178
  return 0;
2179
}
2180

2181

2182

2183
// WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall
2184

2185
undefined8 FUN_140003d80(undefined8 param_1,undefined4 param_2)
2186

2187
{
2188
  DWORD *pDVar1;
2189
  DWORD *pDVar2;
2190
  DWORD DVar3;
2191
  LPVOID pvVar4;
2192

2193
  switch(param_2) {
2194
  case 0:
2195
    if (DAT_140008148 != 0) {
2196
      EnterCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2197
      for (pDVar1 = DAT_140008178; pDVar1 != (DWORD *)0x0; pDVar1 = *(DWORD **)(pDVar1 + 4)) {
2198
        pvVar4 = TlsGetValue(*pDVar1);
2199
        DVar3 = GetLastError();
2200
        if ((DVar3 == 0) && (pvVar4 != (LPVOID)0x0)) {
2201
          (**(code **)(pDVar1 + 2))(pvVar4);
2202
        }
2203
      }
2204
      LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2205
    }
2206
    if (DAT_140008148 == 1) {
2207
      DAT_140008148 = 1;
2208
      pDVar1 = DAT_140008178;
2209
      while (pDVar1 != (DWORD *)0x0) {
2210
        pDVar2 = *(DWORD **)(pDVar1 + 4);
2211
        free(pDVar1);
2212
        pDVar1 = pDVar2;
2213
      }
2214
      DAT_140008178 = (DWORD *)0x0;
2215
      DAT_140008148 = 0;
2216
      DeleteCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2217
    }
2218
    break;
2219
  case 1:
2220
    if (DAT_140008148 == 0) {
2221
      InitializeCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2222
    }
2223
    DAT_140008148 = 1;
2224
    break;
2225
  case 2:
2226
    FUN_140003570();
2227
    break;
2228
  case 3:
2229
    if (DAT_140008148 != 0) {
2230
      EnterCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2231
      for (pDVar1 = DAT_140008178; pDVar1 != (DWORD *)0x0; pDVar1 = *(DWORD **)(pDVar1 + 4)) {
2232
        pvVar4 = TlsGetValue(*pDVar1);
2233
        DVar3 = GetLastError();
2234
        if ((DVar3 == 0) && (pvVar4 != (LPVOID)0x0)) {
2235
          (**(code **)(pDVar1 + 2))(pvVar4);
2236
        }
2237
      }
2238
      LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_140008150);
2239
    }
2240
  }
2241
  return 1;
2242
}
2243

2244

2245

2246
void FUN_140003f20(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)
2247

2248
{
2249
  undefined8 *puVar1;
2250
  undefined8 local_res18;
2251
  undefined8 local_res20;
2252

2253
  local_res18 = param_3;
2254
  local_res20 = param_4;
2255
  puVar1 = (undefined8 *)FUN_140004380();
2256
  __stdio_common_vfprintf(*puVar1,param_1,param_2,0,&local_res18);
2257
  return;
2258
}
2259

2260

2261

2262
// WARNING: Enum "SectionFlags": Some values do not have unique names
2263

2264
IMAGE_SECTION_HEADER * FUN_140003fe0(char *param_1)
2265

2266
{
2267
  int iVar1;
2268
  size_t sVar2;
2269
  uint uVar3;
2270
  IMAGE_SECTION_HEADER *_Str1;
2271

2272
  sVar2 = strlen(param_1);
2273
  if (sVar2 < 9) {
2274
    _Str1 = &IMAGE_SECTION_HEADER_140000180;
2275
    uVar3 = 0;
2276
    do {
2277
      iVar1 = strncmp(_Str1->Name,param_1,8);
2278
      if (iVar1 == 0) {
2279
        return _Str1;
2280
      }
2281
      uVar3 = uVar3 + 1;
2282
      _Str1 = _Str1 + 1;
2283
    } while (uVar3 < 7);
2284
  }
2285
  return (IMAGE_SECTION_HEADER *)0x0;
2286
}
2287

2288

2289

2290
// WARNING: Enum "SectionFlags": Some values do not have unique names
2291

2292
IMAGE_SECTION_HEADER * FUN_140004080(longlong param_1)
2293

2294
{
2295
  IMAGE_SECTION_HEADER *pIVar1;
2296
  int iVar2;
2297

2298
  iVar2 = 7;
2299
  pIVar1 = &IMAGE_SECTION_HEADER_140000180;
2300
  while ((param_1 - 0x140000000U < (ulonglong)(uint)pIVar1->VirtualAddress ||
2301
         ((ulonglong)(pIVar1->VirtualAddress + (pIVar1->Misc).PhysicalAddress) <=
2302
          param_1 - 0x140000000U))) {
2303
    pIVar1 = pIVar1 + 1;
2304
    iVar2 = iVar2 + -1;
2305
    if (iVar2 == 0) {
2306
      return (IMAGE_SECTION_HEADER *)0x0;
2307
    }
2308
  }
2309
  return pIVar1;
2310
}
2311

2312

2313

2314
word FUN_1400040f0(void)
2315

2316
{
2317
  return 7;
2318
}
2319

2320

2321

2322
// WARNING: Removing unreachable block (ram,0x0001400041a4)
2323

2324
IMAGE_DOS_HEADER * FUN_140004180(void)
2325

2326
{
2327
  return &IMAGE_DOS_HEADER_140000000;
2328
}
2329

2330

2331

2332
// WARNING: Removing unreachable block (ram,0x0001400042cd)
2333
// WARNING: Enum "SectionFlags": Some values do not have unique names
2334

2335
char * FUN_140004240(int param_1)
2336

2337
{
2338
  uint *puVar1;
2339
  dword *pdVar2;
2340
  uint *puVar3;
2341
  longlong lVar4;
2342

2343
  lVar4 = 0;
2344
  while ((0x64d8 < *(uint *)(IMAGE_SECTION_HEADER_140000180.Name + lVar4 + 0xc) ||
2345
         (*(uint *)(IMAGE_SECTION_HEADER_140000180.Name + lVar4 + 0xc) +
2346
          *(int *)(IMAGE_SECTION_HEADER_140000180.Name + lVar4 + 8) < 0x64d9))) {
2347
    lVar4 = lVar4 + 0x28;
2348
    if ((int)lVar4 == 0x118) {
2349
      return (char *)0x0;
2350
    }
2351
  }
2352
  pdVar2 = &DWORD_1400064e4;
2353
  do {
2354
    puVar3 = pdVar2;
2355
    if (*pdVar2 == 0) {
2356
      return (char *)0x0;
2357
    }
2358
    do {
2359
      if (param_1 < 1) {
2360
        return IMAGE_DOS_HEADER_140000000.e_magic + *puVar3;
2361
      }
2362
      param_1 = param_1 + -1;
2363
      pdVar2 = puVar3 + 5;
2364
      puVar1 = puVar3 + 3;
2365
      puVar3 = pdVar2;
2366
    } while (*puVar1 != 0);
2367
  } while( true );
2368
}
2369

2370

2371

2372
ulonglong FUN_140004300(void)
2373

2374
{
2375
  ulonglong in_RAX;
2376
  ulonglong uVar1;
2377

2378
  uVar1 = in_RAX;
2379
  if (0xfff < in_RAX) {
2380
    do {
2381
      uVar1 = uVar1 - 0x1000;
2382
    } while (0x1000 < uVar1);
2383
  }
2384
  return in_RAX;
2385
}
2386

2387

2388

2389
void FUN_140004330(undefined8 param_1,undefined8 param_2,undefined8 param_3)
2390

2391
{
2392
  undefined8 *puVar1;
2393

2394
  puVar1 = (undefined8 *)FUN_140004380();
2395
  __stdio_common_vfprintf(*puVar1,param_1,param_2,0,param_3);
2396
  return;
2397
}
2398

2399

2400

2401
// WARNING: This is an inlined function
2402

2403
void _guard_dispatch_icall(void)
2404

2405
{
2406
  code *UNRECOVERED_JUMPTABLE;
2407

2408
                    // WARNING: Could not recover jumptable at 0x000140004370. Too many branches
2409
                    // WARNING: Treating indirect jump as call
2410
  (*UNRECOVERED_JUMPTABLE)();
2411
  return;
2412
}
2413

2414

2415

2416
undefined * FUN_140004380(void)
2417

2418
{
2419
  return &DAT_140008048;
2420
}
2421

2422

2423

2424
void _ZNSt11logic_errorC2EPKc(void)
2425

2426
{
2427
                    // WARNING: Could not recover jumptable at 0x0001400045e0. Too many branches
2428
                    // WARNING: Treating indirect jump as call
2429
  _ZNSt11logic_errorC2EPKc();
2430
  return;
2431
}
2432

2433

2434

2435
void _ZNSt20bad_array_new_lengthC1Ev(void)
2436

2437
{
2438
                    // WARNING: Could not recover jumptable at 0x000140004600. Too many branches
2439
                    // WARNING: Treating indirect jump as call
2440
  _ZNSt20bad_array_new_lengthC1Ev();
2441
  return;
2442
}
2443

2444

2445

2446
void _ZNSt3__110to_wstringEj(void)
2447

2448
{
2449
                    // WARNING: Could not recover jumptable at 0x000140004620. Too many branches
2450
                    // WARNING: Treating indirect jump as call
2451
  _ZNSt3__110to_wstringEj();
2452
  return;
2453
}
2454

2455

2456

2457
void _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKw(void)
2458

2459
{
2460
                    // WARNING: Could not recover jumptable at 0x000140004630. Too many branches
2461
                    // WARNING: Treating indirect jump as call
2462
  _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKw();
2463
  return;
2464
}
2465

2466

2467

2468
void _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKwy(void)
2469

2470
{
2471
                    // WARNING: Could not recover jumptable at 0x000140004640. Too many branches
2472
                    // WARNING: Treating indirect jump as call
2473
  _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6appendEPKwy();
2474
  return;
2475
}
2476

2477

2478

2479
void _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6insertEyPKw(void)
2480

2481
{
2482
                    // WARNING: Could not recover jumptable at 0x000140004650. Too many branches
2483
                    // WARNING: Treating indirect jump as call
2484
  _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE6insertEyPKw();
2485
  return;
2486
}
2487

2488

2489

2490
void _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE7reserveEy(void)
2491

2492
{
2493
                    // WARNING: Could not recover jumptable at 0x000140004660. Too many branches
2494
                    // WARNING: Treating indirect jump as call
2495
  _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE7reserveEy();
2496
  return;
2497
}
2498

2499

2500

2501
void _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE9push_backEw(void)
2502

2503
{
2504
                    // WARNING: Could not recover jumptable at 0x000140004670. Too many branches
2505
                    // WARNING: Treating indirect jump as call
2506
  _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEE9push_backEw();
2507
  return;
2508
}
2509

2510

2511

2512
void _ZdlPv(void)
2513

2514
{
2515
                    // WARNING: Could not recover jumptable at 0x000140004680. Too many branches
2516
                    // WARNING: Treating indirect jump as call
2517
  _ZdlPv();
2518
  return;
2519
}
2520

2521

2522

2523
void _Znwy(void)
2524

2525
{
2526
                    // WARNING: Could not recover jumptable at 0x000140004690. Too many branches
2527
                    // WARNING: Treating indirect jump as call
2528
  _Znwy();
2529
  return;
2530
}
2531

2532

2533

2534
void __cxa_allocate_exception(void)
2535

2536
{
2537
                    // WARNING: Could not recover jumptable at 0x0001400046a0. Too many branches
2538
                    // WARNING: Treating indirect jump as call
2539
  __cxa_allocate_exception();
2540
  return;
2541
}
2542

2543

2544

2545
void __cxa_free_exception(void)
2546

2547
{
2548
                    // WARNING: Could not recover jumptable at 0x0001400046b0. Too many branches
2549
                    // WARNING: Treating indirect jump as call
2550
  __cxa_free_exception();
2551
  return;
2552
}
2553

2554

2555

2556
void __cxa_throw(void)
2557

2558
{
2559
                    // WARNING: Could not recover jumptable at 0x0001400046c0. Too many branches
2560
                    // WARNING: Treating indirect jump as call
2561
  __cxa_throw();
2562
  return;
2563
}
2564

2565

2566

2567
void _Unwind_Resume(void)
2568

2569
{
2570
                    // WARNING: Could not recover jumptable at 0x0001400046e0. Too many branches
2571
                    // WARNING: Treating indirect jump as call
2572
  _Unwind_Resume();
2573
  return;
2574
}
2575

2576

2577

2578
void __p__commode(void)
2579

2580
{
2581
                    // WARNING: Could not recover jumptable at 0x000140004700. Too many branches
2582
                    // WARNING: Treating indirect jump as call
2583
  __p__commode();
2584
  return;
2585
}
2586

2587

2588

2589
void __p__fmode(void)
2590

2591
{
2592
                    // WARNING: Could not recover jumptable at 0x000140004710. Too many branches
2593
                    // WARNING: Treating indirect jump as call
2594
  __p__fmode();
2595
  return;
2596
}
2597

2598

2599

2600
void __cdecl _cexit(void)
2601

2602
{
2603
                    // WARNING: Could not recover jumptable at 0x000140004720. Too many branches
2604
                    // WARNING: Treating indirect jump as call
2605
  _cexit();
2606
  return;
2607
}
2608

2609

2610

2611
int __cdecl _configthreadlocale(int _Flag)
2612

2613
{
2614
  int iVar1;
2615

2616
                    // WARNING: Could not recover jumptable at 0x000140004730. Too many branches
2617
                    // WARNING: Treating indirect jump as call
2618
  iVar1 = _configthreadlocale(_Flag);
2619
  return iVar1;
2620
}
2621

2622

2623

2624
void _crt_atexit(void)
2625

2626
{
2627
                    // WARNING: Could not recover jumptable at 0x000140004740. Too many branches
2628
                    // WARNING: Treating indirect jump as call
2629
  _crt_atexit();
2630
  return;
2631
}
2632

2633

2634

2635
void _initterm(void)
2636

2637
{
2638
                    // WARNING: Could not recover jumptable at 0x000140004750. Too many branches
2639
                    // WARNING: Treating indirect jump as call
2640
  _initterm();
2641
  return;
2642
}
2643

2644

2645

2646
void _initterm_e(void)
2647

2648
{
2649
                    // WARNING: Could not recover jumptable at 0x000140004760. Too many branches
2650
                    // WARNING: Treating indirect jump as call
2651
  _initterm_e();
2652
  return;
2653
}
2654

2655

2656

2657
_invalid_parameter_handler __cdecl
2658
_set_invalid_parameter_handler(_invalid_parameter_handler _Handler)
2659

2660
{
2661
  _invalid_parameter_handler p_Var1;
2662

2663
                    // WARNING: Could not recover jumptable at 0x000140004770. Too many branches
2664
                    // WARNING: Treating indirect jump as call
2665
  p_Var1 = _set_invalid_parameter_handler(_Handler);
2666
  return p_Var1;
2667
}
2668

2669

2670

2671
void __cdecl exit(int _Code)
2672

2673
{
2674
                    // WARNING: Could not recover jumptable at 0x000140004780. Too many branches
2675
                    // WARNING: Subroutine does not return
2676
                    // WARNING: Treating indirect jump as call
2677
  exit(_Code);
2678
  return;
2679
}
2680

2681

2682

2683
void * __cdecl malloc(size_t _Size)
2684

2685
{
2686
  void *pvVar1;
2687

2688
                    // WARNING: Could not recover jumptable at 0x000140004790. Too many branches
2689
                    // WARNING: Treating indirect jump as call
2690
  pvVar1 = malloc(_Size);
2691
  return pvVar1;
2692
}
2693

2694

2695

2696
void * __cdecl memcpy(void *_Dst,void *_Src,size_t _Size)
2697

2698
{
2699
  void *pvVar1;
2700

2701
                    // WARNING: Could not recover jumptable at 0x0001400047a0. Too many branches
2702
                    // WARNING: Treating indirect jump as call
2703
  pvVar1 = memcpy(_Dst,_Src,_Size);
2704
  return pvVar1;
2705
}
2706

2707

2708

2709
void * __cdecl memmove(void *_Dst,void *_Src,size_t _Size)
2710

2711
{
2712
  void *pvVar1;
2713

2714
                    // WARNING: Could not recover jumptable at 0x0001400047b0. Too many branches
2715
                    // WARNING: Treating indirect jump as call
2716
  pvVar1 = memmove(_Dst,_Src,_Size);
2717
  return pvVar1;
2718
}
2719

2720

2721

2722
void * __cdecl memset(void *_Dst,int _Val,size_t _Size)
2723

2724
{
2725
  void *pvVar1;
2726

2727
                    // WARNING: Could not recover jumptable at 0x0001400047c0. Too many branches
2728
                    // WARNING: Treating indirect jump as call
2729
  pvVar1 = memset(_Dst,_Val,_Size);
2730
  return pvVar1;
2731
}
2732

2733

2734

2735
size_t __cdecl wcslen(wchar_t *_Str)
2736

2737
{
2738
  size_t sVar1;
2739

2740
                    // WARNING: Could not recover jumptable at 0x0001400047d0. Too many branches
2741
                    // WARNING: Treating indirect jump as call
2742
  sVar1 = wcslen(_Str);
2743
  return sVar1;
2744
}
2745

2746

2747

2748
// WARNING: Unknown calling convention -- yet parameter storage is locked
2749

2750
void signal(int param_1)
2751

2752
{
2753
                    // WARNING: Could not recover jumptable at 0x000140004890. Too many branches
2754
                    // WARNING: Treating indirect jump as call
2755
  signal(param_1);
2756
  return;
2757
}
2758

2759

2760

2761
void __setusermatherr(void)
2762

2763
{
2764
                    // WARNING: Could not recover jumptable at 0x0001400048a0. Too many branches
2765
                    // WARNING: Treating indirect jump as call
2766
  __setusermatherr();
2767
  return;
2768
}
2769

2770

2771

2772
void __acrt_iob_func(void)
2773

2774
{
2775
                    // WARNING: Could not recover jumptable at 0x0001400048b0. Too many branches
2776
                    // WARNING: Treating indirect jump as call
2777
  __acrt_iob_func();
2778
  return;
2779
}
2780

2781

2782

2783
void __cdecl abort(void)
2784

2785
{
2786
                    // WARNING: Could not recover jumptable at 0x0001400048f0. Too many branches
2787
                    // WARNING: Subroutine does not return
2788
                    // WARNING: Treating indirect jump as call
2789
  abort();
2790
  return;
2791
}
2792

2793

2794

2795
void __p__wcmdln(void)
2796

2797
{
2798
                    // WARNING: Could not recover jumptable at 0x000140004900. Too many branches
2799
                    // WARNING: Treating indirect jump as call
2800
  __p__wcmdln();
2801
  return;
2802
}
2803

2804

2805

2806
void _set_app_type(void)
2807

2808
{
2809
                    // WARNING: Could not recover jumptable at 0x000140004920. Too many branches
2810
                    // WARNING: Treating indirect jump as call
2811
  _set_app_type();
2812
  return;
2813
}
2814

2815

2816

2817
void _initialize_wide_environment(void)
2818

2819
{
2820
                    // WARNING: Could not recover jumptable at 0x000140004930. Too many branches
2821
                    // WARNING: Treating indirect jump as call
2822
  _initialize_wide_environment();
2823
  return;
2824
}
2825

2826

2827

2828
void _configure_wide_argv(void)
2829

2830
{
2831
                    // WARNING: Could not recover jumptable at 0x000140004940. Too many branches
2832
                    // WARNING: Treating indirect jump as call
2833
  _configure_wide_argv();
2834
  return;
2835
}
2836

2837

2838

2839
void __p___argc(void)
2840

2841
{
2842
                    // WARNING: Could not recover jumptable at 0x000140004950. Too many branches
2843
                    // WARNING: Treating indirect jump as call
2844
  __p___argc();
2845
  return;
2846
}
2847

2848

2849

2850
void __p___wargv(void)
2851

2852
{
2853
                    // WARNING: Could not recover jumptable at 0x000140004960. Too many branches
2854
                    // WARNING: Treating indirect jump as call
2855
  __p___wargv();
2856
  return;
2857
}
2858

2859

2860

2861
void __p__wenviron(void)
2862

2863
{
2864
                    // WARNING: Could not recover jumptable at 0x000140004970. Too many branches
2865
                    // WARNING: Treating indirect jump as call
2866
  __p__wenviron();
2867
  return;
2868
}
2869

2870

2871

2872
void _set_new_mode(void)
2873

2874
{
2875
                    // WARNING: Could not recover jumptable at 0x000140004980. Too many branches
2876
                    // WARNING: Treating indirect jump as call
2877
  _set_new_mode();
2878
  return;
2879
}
2880

2881

2882

2883
void __cdecl _exit(int _Code)
2884

2885
{
2886
                    // WARNING: Could not recover jumptable at 0x000140004990. Too many branches
2887
                    // WARNING: Subroutine does not return
2888
                    // WARNING: Treating indirect jump as call
2889
  _exit(_Code);
2890
  return;
2891
}
2892

2893

2894

2895
void * __cdecl calloc(size_t _Count,size_t _Size)
2896

2897
{
2898
  void *pvVar1;
2899

2900
                    // WARNING: Could not recover jumptable at 0x0001400049a0. Too many branches
2901
                    // WARNING: Treating indirect jump as call
2902
  pvVar1 = calloc(_Count,_Size);
2903
  return pvVar1;
2904
}
2905

2906

2907

2908
void __cdecl free(void *_Memory)
2909

2910
{
2911
                    // WARNING: Could not recover jumptable at 0x0001400049d0. Too many branches
2912
                    // WARNING: Treating indirect jump as call
2913
  free(_Memory);
2914
  return;
2915
}
2916

2917

2918

2919
void __stdio_common_vfprintf(void)
2920

2921
{
2922
                    // WARNING: Could not recover jumptable at 0x000140004a10. Too many branches
2923
                    // WARNING: Treating indirect jump as call
2924
  __stdio_common_vfprintf();
2925
  return;
2926
}
2927

2928

2929

2930
size_t __cdecl strlen(char *_Str)
2931

2932
{
2933
  size_t sVar1;
2934

2935
                    // WARNING: Could not recover jumptable at 0x000140004a20. Too many branches
2936
                    // WARNING: Treating indirect jump as call
2937
  sVar1 = strlen(_Str);
2938
  return sVar1;
2939
}
2940

2941

2942

2943
int __cdecl strncmp(char *_Str1,char *_Str2,size_t _MaxCount)
2944

2945
{
2946
  int iVar1;
2947

2948
                    // WARNING: Could not recover jumptable at 0x000140004a30. Too many branches
2949
                    // WARNING: Treating indirect jump as call
2950
  iVar1 = strncmp(_Str1,_Str2,_MaxCount);
2951
  return iVar1;
2952
}

這裡我們可以看到有兩段很重要的東西：#

600-665#

1
// 這個是彈窗的說明文字
2
CreateWindowExW(0,L"STATIC",L"茶神降臨 // CLICK TO WORSHIP",0x50000001,0x14,0x12,0x186,
3
                0x1c,param_1,(HMENU)0x0,pHVar10,(LPVOID)0x0);
4
pHVar10 = GetModuleHandleW((LPCWSTR)0x0);
5
// 按鈕會執行一段 0x1001 的程式
6
_DAT_1400080d0 =
7
    CreateWindowExW(0,L"BUTTON",L"WORSHIP TEA GOD",0x50000001,0x6e,0x177,0xd2,0x2a,param_1,
8
                    (HMENU)0x1001,pHVar10,(LPVOID)0x0);

766-767#

1
else {
2
    // 確認是不是按鈕 0x111
3
    if ((param_2 != 0x111) || (((uint)param_3 & 0xffff) != 0x1001)) goto LAB_140002078;
4

5
    // 計數器加上一
6
    DAT_1400080c8 = DAT_1400080c8 + 1;
7

8
    // 更新渲染畫面，讓 worship count 可以顯示最新數據。
9
    InvalidateRect(DAT_1400080c0,(RECT *)0x0,1);
10

11
    // 關閉畫面
12
    if (param_1 != (HWND)0x0) {
13
      DestroyWindow(param_1);
14
    }
15

16
    // 如果到了最後，就開始解密
17
    if (DAT_1400080c8 != 0) {
18
      KillTimer(DAT_1400080c0,0xcafe);
19
      if (DAT_140008078 != DAT_140008080) {
20
        do {
21
          DestroyWindow((HWND)DAT_140008080[-1]);
22
        } while (DAT_140008078 != DAT_140008080);
23
      }
24

25
      // 準備解密
26
      local_88.rcPaint.top = 0;
27
      local_88.rcPaint.right = 0;
28
      local_88.rcPaint.bottom = 0;
29
      local_88.fRestore = 0;
30
      local_88.hdc = (HDC)0x0;
31
      local_88.fErase = 0;
32
      local_88.rcPaint.left = 0;
33
      local_88._32_8_ = (ulonglong)(uint)local_88.rgbReserved._0_4_ << 0x20;
34
      // 下面這個很重要
35
      ppuVar7 = &PTR_DAT_140005210;
36
      // 上面這個很重要
37
      pbVar12 = (byte *)((longlong)&local_88.fErase + 3);
38
      lVar13 = 0;
39

40
      // 解密步驟
41
      do {
42
        pcVar2 = *ppuVar7;
43
        // xor 公式
44
        bVar1 = (&DAT_140005228)[lVar13];
45
        // 上面是公式
46
        *(byte *)&((tagPAINTSTRUCT *)(pbVar12 + -0xb))->hdc = *pcVar2 - 0x19U ^ bVar1;
47
        pbVar12[-10] = pcVar2[1] - 0x20U ^ bVar1;
48
        pbVar12[-9] = pcVar2[2] - 0x27U ^ bVar1;
49
        pbVar12[-8] = pcVar2[3] - 0x2eU ^ bVar1;
50
        pbVar12[-7] = pcVar2[4] - 0x35U ^ bVar1;
51
        pbVar12[-6] = pcVar2[5] - 0x3cU ^ bVar1;
52
        pbVar12[-5] = pcVar2[6] + 0xbdU ^ bVar1;
53
        pbVar12[-4] = pcVar2[7] + 0xb6U ^ bVar1;
54
        pbVar12[-3] = pcVar2[8] + 0xafU ^ bVar1;
55
        pbVar12[-2] = pcVar2[9] + 0xa8U ^ bVar1;
56
        pbVar12[-1] = pcVar2[10] + 0xa1U ^ bVar1;
57
        *pbVar12 = pcVar2[0xb] + 0x9aU ^ bVar1;
58
        lVar13 = lVar13 + 1;
59
        ppuVar7 = ppuVar7 + 1;
60
        pbVar12 = pbVar12 + 0xc;
61
      } while (lVar13 != 3);

PTR_DAT_140005210 他是一個指標表，對應到下面這三個位置：

指標表位置	指向的密文
0x140005210	0x1400051E6
0x140005218	0x1400051F2
0x140005220	0x1400051FE

接下來我們丟 hxd： hxd

根據上面的表，可以找到這裡有三段字串：

1
A9A7B3E9 CCF0ED48 44175228
2
799B5094 619FB14B CF92D697
3
F6F4C60A CCBD0413 D4E2E259

然後再去找 0x140005228 可以找到：

1
A7 3C D1

最後解密腳本#

1
"""Decrypt the reward embedded in TeaGod.exe."""
2

3
CIPHERTEXT_BLOCKS = (
4
    bytes.fromhex("A9 A7 B3 E9 CC F0 ED 48 44 17 52 28"),
5
    bytes.fromhex("79 9B 50 94 61 9F B1 4B CF 92 D6 97"),
6
    bytes.fromhex("F6 F4 C6 0A CC BD 04 13 D4 E2 E2 59"),
7
)
8

9
BLOCK_XOR_KEYS = bytes.fromhex("A7 3C D1")
10
REPEATING_KEY = b"hc_ehsna"
11

12

13
def decrypt() -> bytes:
14
    stage1 = bytearray()
15

16
    # The executable processes three blocks of 12 bytes. For byte j, it
17
    # subtracts 0x19 + 7*j and then XORs with that block's key byte.
18
    for block, block_key in zip(CIPHERTEXT_BLOCKS, BLOCK_XOR_KEYS):
19
        for position, value in enumerate(block):
20
            stage1.append(
21
                ((value - (0x19 + 7 * position)) & 0xFF) ^ block_key
22
            )
23

24
    # The index starts at 1 and increases by 3, reduced modulo 8.
25
    return bytes(
26
        value ^ REPEATING_KEY[(1 + 3 * index) & 7]
27
        for index, value in enumerate(stage1)
28
    )
29

30

31
if __name__ == "__main__":
32
    print(decrypt().decode("ascii"))

輸出結果：

1
➜  ~ py decode.py
2
THJCC{h77p5://p4s73b1n.com/R58uv133}
3
➜  ~

Flag:
THJCC{h77p5://p4s73b1n.com/R58uv133}

彩蛋：#

在製作這題的時候，我其實藏了一個小巧思。

如果你去看這題的 Flag 會發現他其實可以連結到一個網站：

Loading...https://pastebin.com/R58uv133

這個網站放置了這個文字：

1
5q+P5pel6Iac5ouc5pyA5YGJ5aSn5pyA5ryC5Lqu5pyA5Y+v5oSbIOS4jeWPquiDveeUqOiFs+Wvq+WHuui3qOW5s+iHuiBUZWFHb2QgT1Mg6YKE5pyJ6JGX6IO95Zyo6IWm5Lit6JmV55CG5Y+N57eo6K2v55qEIFRlYUdvZCBEZWNvbXBpbGVyIOS7peWPiueUqOaJi+iqv+WHuiA1IOWFhuWPg+aVuOeahCBUZWFHb2QgQWdlbnQg5ZKM55So6Iad6JOL5bu656uLIFRlYUdvZCBQcm90b2NvbCDlj4jog73nlKjnnLznpZ7ntYLntZDmiYDmnIkgQ1RGIOmhjOebrumChOacg+W5q+WHuumhjOeahOmbu+elnuael+a1t+Wci+mam+iRo+S6i+mVt+izh+WuiemZuOe+veiMtuelnuWnkOWnkOWkp+S6uvCfm5Ag8J+bkCDwn5uQ

如果你把它 base64 decode 後會得到：

1
每日膜拜最偉大最漂亮最可愛 不只能用腳寫出跨平臺 TeaGod OS 還有著能在腦中處理反編譯的 TeaGod Decompiler 以及用手調出 5 兆參數的 TeaGod Agent 和用膝蓋建立 TeaGod Protocol 又能用眼神終結所有 CTF 題目還會幫出題的電神林海國際董事長資安陸羽茶神姐姐大人🛐 🛐 🛐

這是我們膜拜茶神的一些用語，之前會發在 THJCC 伺服器中，如果有興趣跟著膜拜茶神的話也一起來發吧