Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?

Question

I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly gibberish)

It resulted in a pretty big chunk of code, most of which obviously had no proper variables names attributed to it anymore; Instead, variables and functions were either named like the assembly registers they belong to, or by some hex name, or by some number/char combination that did not particularly look like hex.

However, part of the code somehow still had proper names, although they all seemed to be system functions: DrawRect, RegCreateKeyExA, DefWindowProcA, SHBrowseForFolderA, and so on - plenty of calls that seem to interact with the system.

Does that mean that the decompilation preserved Windows system calls, but not the names of functions/variables created by the developer of the file? If so, what should I do next to be able to see whether the file could have malicious intent or not?

It might also be noteworthy to say that the file I'm looking at is a Nullsoft Installer - So technically, a lot of the decompiled code is just overhead, when I actually want to look at what it installs and not the installer itself.

Answer 1

In general, the compilation process removes most of the information not necessary for actual execution. This usually includes:

• comments
• local and global variable names
• local (to the program) function names
• any code deemed dead (not being executed in any situation)
• code exhibiting undefined behavior

The names you are observing are Windows API names; because they are referred by the name, this information has to be kept for the binary to run successfully. All other names are usually removed.

Note: the API names can also be imported by a numerical ordinal in which case the name can be removed ; however this is not common on Win32 since ordinal numbers tend to change from version to version (it was common name on Win16).