Here is an example of a subroutine as pseudocode in IDA:
HRESULT __stdcall func(PCWSTR name, PCWSTR command, BOOL folder, DWORD *pCode) {
_OWORD *v4;
__int128 v5, v12, v13;
__int64 v6;
HRESULT v11;
DWORD **v14;
PCWSTR v16, v17; BOOL v18; DWORD *v19;
v19 = pCode; v18 = folder; v17 = command; v16 = name;
v11 = 0x80004005;
*(_QWORD *)&v12 = &v11;
*((_QWORD *)&v12 + 1) = &v16;
*(_QWORD *)&v13 = &v17;
*((_QWORD *)&v13 + 1) = &v18;
v14 = &v19;
v4 = (_OWORD *)sub_1800050B4(40i64); //contains malloc
if ( v4 ) {
v5 = v13;
*v4 = v12;
v6 = (__int64)v14;
v4[1] = v5;
*((_QWORD *)v4 + 4) = v6;
}
function(v4);
}
It is easy to understand the pointer offsets with v12
and v13
. But some subroutines have many more variables which is not easy to follow. So can I convert that pointer offsets to an array? And why IDA shows so many local variables?