Deadlisting

After opening up whatami.exe in IDA Pro, auto-analysis recognizes the WinMain function. In the following screenshot, we can see that the first three APIs that will be executed are LoadStringW, RegisterClassExW, and CreateWindowEx:

When CreateWindowExW is executed, the window properties are taken from the configuration set by RegisterClassExW. The ClassName, which is used as the name of the window, is taken from the file's text string resource using LoadStringW. However, our concern here would only be the code pointed to by lpfnWindProc takes us. When CreateWindowExW is executed, the code pointed to by the lpfnWndProc parameter ...

Get Mastering Reverse Engineering now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.