IDA pseudo code decompilation

Question

I am trying to reverse engineer exe file and have some difficulties of pseudo code understanding.

Can someone please help me understand what is doing the code below:

char __userpurge sub_41C140@<al>(int a1@<esi>, void *Src)
{
  size_t v2; // ebp@1
  int v3; // eax@1
  unsigned int v4; // edi@2
  void *v5; // ebx@2
  const void *v6; // eax@4
  int v7; // edx@9
  char result; // al@9
  int v9; // edx@9

  v2 = strlen((const char *)Src);
  v3 = *(_DWORD *)(a1 + 44);
  *(_DWORD *)(a1 + 48) = v3;
  if ( v3 + v2 + 3 <= *(_DWORD *)(a1 + 40) )
  {
LABEL_9:
    memcpy((void *)(*(_DWORD *)(a1 + 48) + *(_DWORD *)(a1 + 36)), Src, v2);
    *(_DWORD *)(a1 + 48) += v2;
    *(_BYTE *)(*(_DWORD *)(a1 + 48) + *(_DWORD *)(a1 + 36)) = 13;
    v7 = *(_DWORD *)(a1 + 36);
    result = 1;
    *(_BYTE *)(++*(_DWORD *)(a1 + 48) + v7) = 10;
    v9 = ++*(_DWORD *)(a1 + 48);
    *(_DWORD *)(a1 + 44) = *(_DWORD *)(a1 + 48);
    *(_BYTE *)(*(_DWORD *)(a1 + 36) + v9) = 0;
  }
  else
  {
    while ( 1 )
    {
      v4 = *(_DWORD *)(a1 + 40) + 2048;
      v5 = operator new(v4);
      if ( !v5 )
        break;
      if ( *(_DWORD *)(a1 + 40) )
      {
        v6 = *(const void **)(a1 + 36);
        if ( v6 )
          memcpy(v5, v6, *(_DWORD *)(a1 + 48));
      }
      if ( *(_DWORD *)(a1 + 36) )
        operator delete(*(void **)(a1 + 36));
      *(_DWORD *)(a1 + 40) = v4;
      *(_DWORD *)(a1 + 36) = v5;
      if ( *(_DWORD *)(a1 + 48) + v2 + 3 <= v4 )
        goto LABEL_9;
    }
    result = 0;
  }
  return result;
}

Answer 1

As far as I can tell a1 here is pointer to structure or object, so I'd suggest to use IDA structures to make the generated code simpler:

• Decompile the function you are working with.
• Right click on a1 variable inside a function
• Press "create new struct type" menu item and press OK.

This should convert all the references like *(_DWORD *)(a1 + 40) to a1->fieldname and a1 will be treated as structure pointer.

You'll be able to rename the structure in the structures window and you'll be able to rename fields by pressing n on the fields just as like on variables.

Good luck.