IDA PRO decompiler expression last question (pseudocode)

Question

memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19);

                 .....

shellcode=(int (__stdcall *)(_DWORD, _DWORD))memory;

                 .....

shellcode(&hkernel32, 0)

If function pointer, for each parameter (_DWORD, _DWORD) is

lpAddress = _DWORD = &hkernel32

flAllocationType = _DWORD=0

Is it right?

Answer 1

memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19);

memory will hold the allocated address

(int (__stdcall *)(_DWORD, _DWORD))

prototype of a function that takes two arguments of type DWORD (can be anything ida cannot know it arbitrarily chose DWORD based on size of parameter )

so  this line 

shellcode=(int (__stdcall *)(_DWORD, _DWORD))memory;

means

shellcode = memory

the next call is calling this addresss by trreating this address as a function pointer

so if you single step this line you will land on the allocated address

and execute shell code

it has nothing to do with flwhatever or &hkernel

from the looks of it it is a shell code that takes the base of kernel and tries to scan some thing in the shell code

Answer 2

It means that memory is treated as a function pointer, of a function with stdcall calling conventions, that receives 2 arguments and returns int value.