; Listing generated by Microsoft (R) Optimizing Compiler Version 18.00.21005.1 

include listing.inc

INCLUDELIB LIBCMTD
INCLUDELIB OLDNAMES

_DATA	SEGMENT
COMM	trampoline:BYTE:028H
COMM	hLog:QWORD
_DATA	ENDS
_DATA	SEGMENT
$SG90400 DB	'%s\lotus_log.txt', 00H
	ORG $+7
$SG90404 DB	'Loading', 0aH, 00H
	ORG $+7
$SG90405 DB	'actxprxy', 00H
	ORG $+7
$SG90409 DB	'DllCanUnloadNow', 00H
$SG90411 DB	'DllGetClassObject', 00H
	ORG $+6
$SG90413 DB	'DllRegisterServer', 00H
	ORG $+6
$SG90415 DB	'DllUnregisterServer', 00H
	ORG $+4
$SG90417 DB	'GetProxyDllInfo', 00H
$SG90423 DB	'explorer.exe', 00H
_DATA	ENDS
PUBLIC	GetUserHomeDir
PUBLIC	DllMain
EXTRN	memset:PROC
EXTRN	strcmp:PROC
EXTRN	__imp_CreateFileA:PROC
EXTRN	__imp_WriteFile:PROC
EXTRN	__imp_CloseHandle:PROC
EXTRN	__imp_GetCurrentProcess:PROC
EXTRN	__imp_CreateThread:PROC
EXTRN	__imp_OpenProcessToken:PROC
EXTRN	__imp_GetProcAddress:PROC
EXTRN	__imp_LoadLibraryA:PROC
EXTRN	malloc:PROC
EXTRN	__imp_GetUserProfileDirectoryA:PROC
EXTRN	K32GetModuleBaseNameA:PROC
EXTRN	Bootstrap:PROC
EXTRN	_snprintf_s:PROC
EXTRN	_RTC_CheckStackVars:PROC
EXTRN	_RTC_InitBase:PROC
EXTRN	_RTC_Shutdown:PROC
EXTRN	__GSHandlerCheck:PROC
EXTRN	__security_check_cookie:PROC
EXTRN	__security_cookie:QWORD
pdata	SEGMENT
$pdata$GetUserHomeDir DD imagerel $LN3
	DD	imagerel $LN3+176
	DD	imagerel $unwind$GetUserHomeDir
$pdata$DllMain DD imagerel $LN9
	DD	imagerel $LN9+637
	DD	imagerel $unwind$DllMain
pdata	ENDS
;	COMDAT rtc$TMZ
rtc$TMZ	SEGMENT
_RTC_Shutdown.rtc$TMZ DQ FLAT:_RTC_Shutdown
rtc$TMZ	ENDS
;	COMDAT rtc$IMZ
rtc$IMZ	SEGMENT
_RTC_InitBase.rtc$IMZ DQ FLAT:_RTC_InitBase
rtc$IMZ	ENDS
xdata	SEGMENT
$unwind$GetUserHomeDir DD 022719H
	DD	07002f209H
	DD	imagerel __GSHandlerCheck
	DD	070H
$unwind$DllMain DD 033f19H
	DD	0600116H
	DD	0700fH
	DD	imagerel __GSHandlerCheck
	DD	02f8H
xdata	ENDS
CONST	SEGMENT
GetUserHomeDir$rtcName$0 DB 068H
	DB	054H
	DB	06fH
	DB	06bH
	DB	065H
	DB	06eH
	DB	00H
	ORG $+1
GetUserHomeDir$rtcName$1 DB 042H
	DB	075H
	DB	066H
	DB	053H
	DB	069H
	DB	07aH
	DB	065H
	DB	00H
GetUserHomeDir$rtcVarDesc DD 054H
	DD	04H
	DQ	FLAT:GetUserHomeDir$rtcName$1
	DD	038H
	DD	08H
	DQ	FLAT:GetUserHomeDir$rtcName$0
	ORG $+96
GetUserHomeDir$rtcFrameData DD 02H
	DD	00H
	DQ	FLAT:GetUserHomeDir$rtcVarDesc
DllMain$rtcName$0 DB 064H
	DB	077H
	DB	04fH
	DB	075H
	DB	074H
	DB	00H
	ORG $+2
DllMain$rtcName$1 DB 073H
	DB	07aH
	DB	04cH
	DB	06fH
	DB	067H
	DB	046H
	DB	069H
	DB	06cH
	DB	065H
	DB	00H
	ORG $+6
DllMain$rtcName$2 DB 073H
	DB	07aH
	DB	050H
	DB	072H
	DB	06fH
	DB	063H
	DB	065H
	DB	073H
	DB	073H
	DB	04dH
	DB	06fH
	DB	064H
	DB	075H
	DB	06cH
	DB	065H
	DB	050H
	DB	061H
	DB	074H
	DB	068H
	DB	00H
	ORG $+4
DllMain$rtcName$3 DB 064H
	DB	077H
	DB	054H
	DB	068H
	DB	072H
	DB	065H
	DB	061H
	DB	064H
	DB	049H
	DB	064H
	DB	00H
	ORG $+5
DllMain$rtcVarDesc DD 02d4H
	DD	04H
	DQ	FLAT:DllMain$rtcName$3
	DD	01b0H
	DD	0104H
	DQ	FLAT:DllMain$rtcName$2
	DD	080H
	DD	0104H
	DQ	FLAT:DllMain$rtcName$1
	DD	054H
	DD	04H
	DQ	FLAT:DllMain$rtcName$0
	ORG $+192
DllMain$rtcFrameData DD 04H
	DD	00H
	DQ	FLAT:DllMain$rtcVarDesc
CONST	ENDS
; Function compile flags: /Odtp /RTCsu
_TEXT	SEGMENT
hActxprxy$ = 64
dwOut$ = 84
szHome$ = 104
szLogFile$7 = 128
szProcessModulePath$8 = 432
hProcess$9 = 712
dwThreadId$10 = 724
tv64 = 752
__$ArrayPad$ = 760
hModule$ = 784
ul_reason_for_call$ = 792
lpReserved$ = 800
DllMain	PROC
; File c:\users\unknown\stuff\lotus\64bit\actproxy\actproxy\dllmain.c
; Line 21
$LN9:
	mov	QWORD PTR [rsp+24], r8
	mov	DWORD PTR [rsp+16], edx
	mov	QWORD PTR [rsp+8], rcx
	push	rdi
	sub	rsp, 768				; 00000300H
	mov	rdi, rsp
	mov	ecx, 192				; 000000c0H
	mov	eax, -858993460				; ccccccccH
	rep stosd
	mov	rcx, QWORD PTR [rsp+784]
	mov	rax, QWORD PTR __security_cookie
	xor	rax, rsp
	mov	QWORD PTR __$ArrayPad$[rsp], rax
; Line 23
	mov	QWORD PTR hActxprxy$[rsp], 0
; Line 27
	mov	eax, DWORD PTR ul_reason_for_call$[rsp]
	mov	DWORD PTR tv64[rsp], eax
	cmp	DWORD PTR tv64[rsp], 1
	je	SHORT $LN4@DllMain
	jmp	$LN5@DllMain
$LN4@DllMain:
; Line 33
	call	GetUserHomeDir
	mov	QWORD PTR szHome$[rsp], rax
; Line 35
	mov	rax, QWORD PTR szHome$[rsp]
	mov	QWORD PTR [rsp+32], rax
	lea	r9, OFFSET FLAT:$SG90400
	mov	r8, -1
	mov	edx, 260				; 00000104H
	lea	rcx, QWORD PTR szLogFile$7[rsp]
	call	_snprintf_s
; Line 36
	mov	QWORD PTR [rsp+48], 0
	mov	DWORD PTR [rsp+40], 128			; 00000080H
	mov	DWORD PTR [rsp+32], 2
	xor	r9d, r9d
	mov	r8d, 2
	mov	edx, 1179926				; 00120116H
	lea	rcx, QWORD PTR szLogFile$7[rsp]
	call	QWORD PTR __imp_CreateFileA
	mov	QWORD PTR hLog, rax
; Line 37
	mov	QWORD PTR [rsp+32], 0
	lea	r9, QWORD PTR dwOut$[rsp]
	mov	r8d, 4
	lea	rdx, OFFSET FLAT:$SG90404
	mov	rcx, QWORD PTR hLog
	call	QWORD PTR __imp_WriteFile
; Line 40
	lea	rcx, OFFSET FLAT:$SG90405
	call	QWORD PTR __imp_LoadLibraryA
	mov	QWORD PTR hActxprxy$[rsp], rax
; Line 42
	cmp	QWORD PTR hActxprxy$[rsp], 0
	je	SHORT $LN3@DllMain
; Line 44
	lea	rdx, OFFSET FLAT:$SG90409
	mov	rcx, QWORD PTR hActxprxy$[rsp]
	call	QWORD PTR __imp_GetProcAddress
	mov	QWORD PTR trampoline, rax
; Line 45
	lea	rdx, OFFSET FLAT:$SG90411
	mov	rcx, QWORD PTR hActxprxy$[rsp]
	call	QWORD PTR __imp_GetProcAddress
	mov	QWORD PTR trampoline+8, rax
; Line 46
	lea	rdx, OFFSET FLAT:$SG90413
	mov	rcx, QWORD PTR hActxprxy$[rsp]
	call	QWORD PTR __imp_GetProcAddress
	mov	QWORD PTR trampoline+16, rax
; Line 47
	lea	rdx, OFFSET FLAT:$SG90415
	mov	rcx, QWORD PTR hActxprxy$[rsp]
	call	QWORD PTR __imp_GetProcAddress
	mov	QWORD PTR trampoline+24, rax
; Line 48
	lea	rdx, OFFSET FLAT:$SG90417
	mov	rcx, QWORD PTR hActxprxy$[rsp]
	call	QWORD PTR __imp_GetProcAddress
	mov	QWORD PTR trampoline+32, rax
$LN3@DllMain:
; Line 58
	mov	r8d, 260				; 00000104H
	xor	edx, edx
	lea	rcx, QWORD PTR szProcessModulePath$8[rsp]
	call	memset
; Line 60
	call	QWORD PTR __imp_GetCurrentProcess
	mov	QWORD PTR hProcess$9[rsp], rax
; Line 61
	mov	r9d, 259				; 00000103H
	lea	r8, QWORD PTR szProcessModulePath$8[rsp]
	xor	edx, edx
	mov	rcx, QWORD PTR hProcess$9[rsp]
	call	K32GetModuleBaseNameA
; Line 62
	mov	rcx, QWORD PTR hProcess$9[rsp]
	call	QWORD PTR __imp_CloseHandle
; Line 65
	mov	QWORD PTR [rsp+32], 0
	lea	r9, QWORD PTR dwOut$[rsp]
	mov	r8d, 260				; 00000104H
	lea	rdx, QWORD PTR szProcessModulePath$8[rsp]
	mov	rcx, QWORD PTR hLog
	call	QWORD PTR __imp_WriteFile
; Line 68
	lea	rdx, OFFSET FLAT:$SG90423
	lea	rcx, QWORD PTR szProcessModulePath$8[rsp]
	call	strcmp
	test	eax, eax
	jne	SHORT $LN2@DllMain
; Line 71
	lea	rax, QWORD PTR dwThreadId$10[rsp]
	mov	QWORD PTR [rsp+40], rax
	mov	DWORD PTR [rsp+32], 0
	xor	r9d, r9d
	lea	r8, OFFSET FLAT:Bootstrap
	xor	edx, edx
	xor	ecx, ecx
	call	QWORD PTR __imp_CreateThread
$LN2@DllMain:
$LN5@DllMain:
; Line 80
	mov	eax, 1
; Line 81
	mov	edi, eax
	mov	rcx, rsp
	lea	rdx, OFFSET FLAT:DllMain$rtcFrameData
	call	_RTC_CheckStackVars
	mov	eax, edi
	mov	rcx, QWORD PTR __$ArrayPad$[rsp]
	xor	rcx, rsp
	call	__security_check_cookie
	add	rsp, 768				; 00000300H
	pop	rdi
	ret	0
DllMain	ENDP
_TEXT	ENDS
; Function compile flags: /Odtp /RTCsu
_TEXT	SEGMENT
szHomeDirBuf$ = 32
hToken$ = 56
BufSize$ = 84
__$ArrayPad$ = 112
GetUserHomeDir PROC
; File c:\users\unknown\stuff\lotus\64bit\actproxy\actproxy\dllmain.c
; Line 85
$LN3:
	push	rdi
	sub	rsp, 128				; 00000080H
	mov	rdi, rsp
	mov	ecx, 32					; 00000020H
	mov	eax, -858993460				; ccccccccH
	rep stosd
	mov	rax, QWORD PTR __security_cookie
	xor	rax, rsp
	mov	QWORD PTR __$ArrayPad$[rsp], rax
; Line 86
	mov	ecx, 260				; 00000104H
	call	malloc
	mov	QWORD PTR szHomeDirBuf$[rsp], rax
; Line 88
	mov	QWORD PTR hToken$[rsp], 0
; Line 89
	call	QWORD PTR __imp_GetCurrentProcess
	lea	r8, QWORD PTR hToken$[rsp]
	mov	edx, 8
	mov	rcx, rax
	call	QWORD PTR __imp_OpenProcessToken
; Line 91
	mov	DWORD PTR BufSize$[rsp], 260		; 00000104H
; Line 92
	lea	r8, QWORD PTR BufSize$[rsp]
	mov	rdx, QWORD PTR szHomeDirBuf$[rsp]
	mov	rcx, QWORD PTR hToken$[rsp]
	call	QWORD PTR __imp_GetUserProfileDirectoryA
; Line 94
	mov	rcx, QWORD PTR hToken$[rsp]
	call	QWORD PTR __imp_CloseHandle
; Line 95
	mov	rax, QWORD PTR szHomeDirBuf$[rsp]
; Line 96
	mov	rdi, rax
	mov	rcx, rsp
	lea	rdx, OFFSET FLAT:GetUserHomeDir$rtcFrameData
	call	_RTC_CheckStackVars
	mov	rax, rdi
	mov	rcx, QWORD PTR __$ArrayPad$[rsp]
	xor	rcx, rsp
	call	__security_check_cookie
	add	rsp, 128				; 00000080H
	pop	rdi
	ret	0
GetUserHomeDir ENDP
_TEXT	ENDS
END
