| 151 | } |
| 152 | |
| 153 | __int64 __fastcall EAC::Callbacks::LoadLibraryInjection(struct_a1_1 *pInputStruct, char a2) |
| 154 | { |
| 155 | // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND] |
| 156 | |
| 157 | v34 = a2; |
| 158 | v4 = 0xC0000001; |
| 159 | LODWORD(v18) = 0xC0000001; |
| 160 | v25 = 0i64; |
| 161 | if ( !sub_140021608(&pInputStruct->unsigned___int1610, &v26) ) |
| 162 | return 0xC000000Di64; |
| 163 | if ( EAC::Callbacks::KeStackAttachProcess(pInputStruct->HANDLE, v32) ) |
| 164 | { |
| 165 | v8 = EAC::Imports::NtAllocateVirtualMemoryWrapper(v6, 4096i64, v7, 64); |
| 166 | v9 = v8; |
| 167 | v25 = v8; |
| 168 | if ( !v8 ) |
| 169 | goto FREE_MEMORY_AND_UNSTACK_LABEL; |
| 170 | EAC::Memory::CheckAddressBounds(v8, 4096i64); |
| 171 | *v9 = xmmword_14006C490; |
| 172 | *(v9 + 16) = xmmword_14006C4A0; |
| 173 | *(v9 + 32) = xmmword_14006C4B0; |
| 174 | *(v9 + 48) = xmmword_14006C4C0; |
| 175 | v23[0] = 183270618; |
| 176 | v23[1] = -1577622027; |
| 177 | v23[2] = 851333393; |
| 178 | v23[3] = 212456202; |
| 179 | v23[4] = 1264994537; |
| 180 | v23[5] = -444005607; |
| 181 | v24 = 17185; |
| 182 | v10 = EAC::Memory::DecryptStr5(v23, v30); |
| 183 | v11 = EAC::Callbacks::GetUsermodeModuleWrapper(v10); |
| 184 | memset(v30, 0, 0x1Aui64); |
| 185 | if ( !v11 ) |
| 186 | goto FREE_MEMORY_AND_UNSTACK_LABEL; |
| 187 | if ( a2 ) |
| 188 | { |
| 189 | v21[0] = 0x984BB8DA; |
| 190 | v21[1] = -1983652296; |
| 191 | v21[2] = -1640782585; |
| 192 | v22 = 43; |
| 193 | v12 = 1; |
| 194 | str = EAC::Memory::DecryptStr3(v21, v29); |
| 195 | } |
| 196 | else |
| 197 | { |
| 198 | HIDWORD(v18) = 974224348; |
| 199 | v19 = 1879373332; |
| 200 | v20 = -573867558; |
| 201 | v12 = 2; |
| 202 | str = EAC::Memory::DecryptStr4(&v18 + 4, v28); |
| 203 | } |
| 204 | *(v9 + 64) = sub_14004F1A4(v14, str); |
| 205 | if ( (v12 & 2) != 0 ) |
| 206 | { |
| 207 | v12 &= 0xFDu; |
| 208 | memset(v28, 0, sizeof(v28)); |
| 209 | } |
| 210 | if ( (v12 & 1) != 0 ) |
nothing calls this directly
no outgoing calls
no test coverage detected