Sorry, meant to send this to the list first time around...
SetEvent definitely needs it. The others possibly don't. But I think it would be more robust to preserve the flag through all of them anyway, in case someone makes a change in future that causes one of the others to clear the direction flag too, which seems quite possible.
Are you sure it's not that we need to set the flag before
jumping to the entrypoint?
The flag is normally cleared. PECrypt sets it explicitly, then expects it to remain set across those three API calls.
AFAIK, PECrypt just decrypts and decompresses the executable at startup, then it goes away and the program runs as normal. This bug does happen very early on.
Certainly anything compressed with PECrypt will depend on the flag being preserved. In general I'd imagine it's quite rare for programs to run with the direction flag set for long periods though.
Cheers, James