Deadlisting

After opening up whatami.exe in IDA Pro, auto-analysis recognizes the WinMain function. In the following screenshot, we can see that the first three APIs that will be executed are LoadStringW, RegisterClassExW, and CreateWindowEx:

When CreateWindowExW is executed, the window properties are taken from the configuration set by RegisterClassExW. The ClassName, which is used as the name of the window, is taken from the file's text string resource using LoadStringW. However, our concern here would only be the code pointed to by lpfnWindProc takes us. When CreateWindowExW is executed, the code pointed to by the lpfnWndProc parameter ...

Get Mastering Reverse Engineering now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.