Miseryk

Reversing/Cracking Total Commander x64 9.51

Apr 14th, 2021
895
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Done with a couple of hours:
  2. ---------------------------
  3.  
  4. 0010CF30
  5.  
  6. ------------------------------
  7.  
  8. TOTALCMD64.EXE+2CD29 - 4C 63 C0              - movsxd  r8,eax
  9. 0042CD2C - 4D 6B C0 02 - imul r8,r8,02
  10. 0042CD30 - 66 46 8B 04 01   - mov r8w,[rcx+r8] <<
  11. 0042CD35 - 66 45 85 C0  - test r8w,r8w
  12. 0042CD39 - 75 D5 - jne TOTALCMD64.EXE+2CD10
  13.  
  14. RAX=0000000000000000
  15. RBX=0000000001D1DCDA
  16. RCX=000000000010CF30
  17. RDX=00000000000000E6
  18. RSI=000000000010CF30
  19. RDI=00000000000000E6
  20. RSP=0000000001D1CD70
  21. RBP=0000000001D1CD90
  22. RIP=000000000042CD35
  23. R8=000000000000004E
  24. R9=0000000000000000
  25. R10=0000007200650064
  26. R11=0000000000000246
  27. R12=0000000000000000
  28. R13=0000000000000000
  29. R14=0000000000000001
  30. R15=0000000000000000
  31.  
  32. TOTALCMD64.EXE+4D07 - F6 C2 02              - test dl,02 { 2 }
  33. 00404D0A - 74 0F - je TOTALCMD64.EXE+4D1B
  34. 00404D0C - 66 8B 04 11   - mov ax,[rcx+rdx] <<
  35. 00404D10 - 49 83 E8 02 - sub r8,02
  36. 00404D14 - 66 89 02  - mov [rdx],ax
  37.  
  38. RAX=FFFFFFFFFE3E004E
  39. RBX=0000000001D1DCDA
  40. RCX=FFFFFFFFFE3EF256
  41. RDX=0000000001D1DCDA
  42. RSI=000000000010CF30
  43. RDI=00000000000000E6
  44. RSP=0000000001D1CD98
  45. RBP=0000000001D1CDE0
  46. RIP=0000000000404D10
  47. R8=000000000000001E
  48. R9=0000000000000000
  49. R10=0000007200650064
  50. R11=0000000000000246
  51. R12=000000000000001E
  52. R13=0000000000000000
  53. R14=0000000000000001
  54. R15=0000000000000000
  55.  
  56. TOTALCMD64.EXE+4D1B - F6 C2 04              - test dl,04 { 4 }
  57. 00404D1E - 74 0D - je TOTALCMD64.EXE+4D2D
  58. 00404D20 - 8B 04 11   - mov eax,[rcx+rdx] <<
  59. 00404D23 - 49 83 E8 04 - sub r8,04
  60. 00404D27 - 89 02  - mov [rdx],eax
  61.  
  62. RAX=000000000054004F
  63. RBX=0000000001D1DCDA
  64. RCX=FFFFFFFFFE3EF256
  65. RDX=0000000001D1DCDC
  66. RSI=000000000010CF30
  67. RDI=00000000000000E6
  68. RSP=0000000001D1CD98
  69. RBP=0000000001D1CDE0
  70. RIP=0000000000404D23
  71. R8=000000000000001C
  72. R9=0000000000000000
  73. R10=0000007200650064
  74. R11=0000000000000246
  75. R12=000000000000001E
  76. R13=0000000000000000
  77. R14=0000000000000001
  78. R15=0000000000000000
  79.  
  80. TOTALCMD64.EXE+4D3D - 74 15                 - je TOTALCMD64.EXE+4D54
  81. 00404D3F - 90 - nop
  82. 00404D40 - 48 8B 04 11   - mov rax,[rcx+rdx] <<
  83. 00404D44 - 48 89 02  - mov [rdx],rax
  84. 00404D47 - 48 83 C2 08 - add rdx,08
  85.  
  86. RAX=0047004500520020
  87. RBX=0000000001D1DCDA
  88. RCX=FFFFFFFFFE3EF256
  89. RDX=0000000001D1DCE0
  90. RSI=000000000010CF30
  91. RDI=00000000000000E6
  92. RSP=0000000001D1CD98
  93. RBP=0000000001D1CDE0
  94. RIP=0000000000404D44
  95. R8=0000000000000018
  96. R9=0000000000000003
  97. R10=0000007200650064
  98. R11=0000000000000246
  99. R12=000000000000001E
  100. R13=0000000000000000
  101. R14=0000000000000001
  102. R15=0000000000000000
  103.  
  104.  
  105. TOTALCMD64.EXE+5168 - 74 51                 - je TOTALCMD64.EXE+51BB
  106. 0040516A - 48 83 C1 10 - add rcx,10
  107. 0040516E - 66 0F6F 41 F0  - movdqa xmm0,[rcx-10] <<
  108. 00405173 - 4C 29 C1  - sub rcx,r8
  109. 00405176 - 41 F6 C0 01 - test r8l,01
  110.  
  111. RAX=000000000010CF30
  112. RBX=000000000010CF30
  113. RCX=000000000010CF40
  114. RDX=FFFFFFFFFFFFFFFF
  115. RSI=000000000010CF30
  116. RDI=0000000000000000
  117. RSP=0000000001D1C868
  118. RBP=0000000001D1C8B0
  119. RIP=0000000000405173
  120. R8=000000000010CF30
  121. R9=0000000000000000
  122. R10=0000007200650064
  123. R11=0000000000000246
  124. R12=0000000000000000
  125. R13=0000000000000000
  126. R14=0000000000000001
  127. R15=0000000000000000
  128.  
  129.  
  130. TOTALCMD64.EXE+5199 - 66 66 66 90           - nop
  131. 0040519D - 66 66 90 - nop
  132. 004051A0 - 66 41 0F6F 04 48   - movdqa xmm0,[r8+rcx*2] <<
  133. 004051A6 - 48 83 C1 08 - add rcx,08
  134. 004051AA - 66 0F75 C1  - pcmpeqw xmm0,xmm1
  135.  
  136. RAX=0000000000000000
  137. RBX=000000000010CF30
  138. RCX=0000000000000008
  139. RDX=FFFFFFFFFFFFFFFF
  140. RSI=000000000010CF30
  141. RDI=0000000000000000
  142. RSP=0000000001D1C868
  143. RBP=0000000001D1C8B0
  144. RIP=00000000004051A6
  145. R8=000000000010CF30
  146. R9=0000000000000000
  147. R10=0000007200650064
  148. R11=0000000000000246
  149. R12=0000000000000000
  150. R13=0000000000000000
  151. R14=0000000000000001
  152. R15=0000000000000000
  153.  
  154.  
  155. TOTALCMD64.EXE+4D59 - 66 66 66 90           - nop
  156. 00404D5D - 66 66 90 - nop
  157. 00404D60 - 8A 04 11   - mov al,[rcx+rdx] <<
  158. 00404D63 - 88 02  - mov [rdx],al
  159. 00404D65 - 48 FF C2  - inc rdx
  160.  
  161. RAX=0052004500540045
  162. RBX=000000000010CF30
  163. RCX=FFFFFFFFFFF31398
  164. RDX=00000000001DBBB0
  165. RSI=000000000010CF30
  166. RDI=0000000000000000
  167. RSP=0000000001D1C868
  168. RBP=0000000001D1C8B0
  169. RIP=0000000000404D63
  170. R8=0000000000000004
  171. R9=0000000000000000
  172. R10=0000007200650064
  173. R11=0000000000000246
  174. R12=0000000000000000
  175. R13=0000000000000000
  176. R14=0000000000000001
  177. R15=0000000000000000
  178.  
  179.  
  180.  
  181.  
  182.  
  183.  
  184.  
  185. TOTALCMD64.EXE+57ED5F - E8 4C12A9FF           - call TOTALCMD64.EXE+FFB0
  186.  
  187. TOTALCMD64.EXE+57F07A - E8 C132A8FF           - call TOTALCMD64.EXE+2340 { ->->USER32.CreateWindowExW }
  188.  
  189. TOTALCMD64.EXE+49255E - 74 0E                 - je TOTALCMD64.EXE+49256E
  190.  
  191.  
  192.  
  193. TOTALCMD64.EXE+580185 - 74 09                 - je TOTALCMD64.EXE+580190
  194.  
  195.  
  196.  
  197. TOTALCMD64.EXE+5801A8 - 74 6F                 - je TOTALCMD64.EXE+580219
  198. TOTALCMD64.EXE+58023F - 74 05                 - je TOTALCMD64.EXE+580246
  199. TOTALCMD64.EXE+484ADE - 74 0B                 - je TOTALCMD64.EXE+484AEB
  200. TOTALCMD64.EXE+47F57F - 74 0B                 - je TOTALCMD64.EXE+47F58C
  201. TOTALCMD64.EXE+47F5B2 - 74 05                 - je TOTALCMD64.EXE+47F5B9
  202. TOTALCMD64.EXE+47F52C - 74 1E                 - je TOTALCMD64.EXE+47F54C
  203.  
  204. --------------------------------------------------------------------------------------------
  205. TOTALCMD64.EXE+F55D - 74 02                 - je TOTALCMD64.EXE+F561
  206. TOTALCMD64.EXE+F55F - EB 2E                 - jmp TOTALCMD64.EXE+F58F
  207. TOTALCMD64.EXE+F561 - 48 8B 55 D0           - mov rdx,[rbp-30]
  208. TOTALCMD64.EXE+F565 - 48 63 45 D8           - movsxd  rax,dword ptr [rbp-28]
  209. TOTALCMD64.EXE+F569 - 48 C1 E0 04           - shl rax,04 { 4 }
  210. TOTALCMD64.EXE+F56D - 48 8B 44 02 08        - mov rax,[rdx+rax+08]
  211. TOTALCMD64.EXE+F572 - 48 89 45 B0           - mov [rbp-50],rax
  212. TOTALCMD64.EXE+F576 - 48 8B 45 F0           - mov rax,[rbp-10]
  213. TOTALCMD64.EXE+F57A - 48 89 45 B8           - mov [rbp-48],rax
  214. TOTALCMD64.EXE+F57E - 48 8B 55 F8           - mov rdx,[rbp-08]
  215. TOTALCMD64.EXE+F582 - 48 8B 4D B8           - mov rcx,[rbp-48]
  216. TOTALCMD64.EXE+F586 - 48 8B 45 B0           - mov rax,[rbp-50]
  217. TOTALCMD64.EXE+F58A - 48 FF D0              - call rax
  218.  
  219.  
  220. //PONIENDO ESTO A REP, APRETANDO CUALQUIER BOTON NADA PASA
  221. TOTALCMD64.EXE+4A6600 - 55                    - push rbp
  222. TOTALCMD64.EXE+4A6601 - 48 89 E5              - mov rbp,rsp
  223. TOTALCMD64.EXE+4A6604 - 48 83 EC 30           - sub rsp,30 { 48 }
  224. TOTALCMD64.EXE+4A6608 - 48 89 4D F0           - mov [rbp-10],rcx
  225. TOTALCMD64.EXE+4A660C - 48 89 55 F8           - mov [rbp-08],rdx
  226. TOTALCMD64.EXE+4A6610 - 48 8B 4D F0           - mov rcx,[rbp-10]
  227. TOTALCMD64.EXE+4A6614 - 48 8B 45 F0           - mov rax,[rbp-10]
  228. TOTALCMD64.EXE+4A6618 - 48 8B 00              - mov rax,[rax]
  229. TOTALCMD64.EXE+4A661B - FF 90 80030000        - call qword ptr [rax+00000380]
  230. TOTALCMD64.EXE+4A6621 - C9                    - leave
  231. TOTALCMD64.EXE+4A6622 - C3                    - ret
  232.  
  233.  
  234. TOTALCMD64.EXE+4A7B90 - 55                    - push rbp
  235. TOTALCMD64.EXE+4A7B91 - 48 89 E5              - mov rbp,rsp
  236. TOTALCMD64.EXE+4A7B94 - 48 83 EC 30           - sub rsp,30 { 48 }
  237. TOTALCMD64.EXE+4A7B98 - 48 89 4D F8           - mov [rbp-08],rcx
  238. TOTALCMD64.EXE+4A7B9C - 48 8B 4D F8           - mov rcx,[rbp-08]
  239. TOTALCMD64.EXE+4A7BA0 - E8 9BF9FFFF           - call TOTALCMD64.EXE+4A7540
  240. TOTALCMD64.EXE+4A7BA5 - C9                    - leave
  241. TOTALCMD64.EXE+4A7BA6 - C3                    - ret
  242.  
  243.  
  244.  
  245. TOTALCMD64.EXE+4A7540 - 55                    - push rbp
  246. TOTALCMD64.EXE+4A7541 - 48 89 E5              - mov rbp,rsp
  247. TOTALCMD64.EXE+4A7544 - 48 83 EC 30           - sub rsp,30 { 48 }
  248. TOTALCMD64.EXE+4A7548 - 48 89 4D F8           - mov [rbp-08],rcx
  249. TOTALCMD64.EXE+4A754C - 48 8B 45 F8           - mov rax,[rbp-08]
  250. TOTALCMD64.EXE+4A7550 - 8B 80 58050000        - mov eax,[rax+00000558]
  251. TOTALCMD64.EXE+4A7556 - 85 C0                 - test eax,eax
  252. TOTALCMD64.EXE+4A7558 - 74 2A                 - je TOTALCMD64.EXE+4A7584
  253. TOTALCMD64.EXE+4A755A - 48 8B 4D F8           - mov rcx,[rbp-08]
  254. TOTALCMD64.EXE+4A755E - E8 CDCBB8FF           - call TOTALCMD64.EXE+34130
  255. TOTALCMD64.EXE+4A7563 - 48 89 45 F0           - mov [rbp-10],rax
  256. TOTALCMD64.EXE+4A7567 - 48 8B 45 F0           - mov rax,[rbp-10]
  257. TOTALCMD64.EXE+4A756B - 48 85 C0              - test rax,rax
  258. TOTALCMD64.EXE+4A756E - 74 14                 - je TOTALCMD64.EXE+4A7584
  259. TOTALCMD64.EXE+4A7570 - 48 8B 55 F0           - mov rdx,[rbp-10]
  260. TOTALCMD64.EXE+4A7574 - 48 8B 45 F8           - mov rax,[rbp-08]
  261. TOTALCMD64.EXE+4A7578 - 8B 80 58050000        - mov eax,[rax+00000558]
  262. TOTALCMD64.EXE+4A757E - 89 82 10060000        - mov [rdx+00000610],eax
  263. TOTALCMD64.EXE+4A7584 - 48 8B 4D F8           - mov rcx,[rbp-08]
  264. TOTALCMD64.EXE+4A7588 - E8 83F1FFFF           - call TOTALCMD64.EXE+4A6710
  265. TOTALCMD64.EXE+4A758D - C9                    - leave
  266. TOTALCMD64.EXE+4A758E - C3                    - ret
  267.  
  268.  
  269.  
  270.  
  271.  
  272. TOTALCMD64.EXE+4A6710 - 55                    - push rbp
  273. TOTALCMD64.EXE+4A6711 - 48 89 E5              - mov rbp,rsp
  274. TOTALCMD64.EXE+4A6714 - 48 83 EC 30           - sub rsp,30 { 48 }
  275. TOTALCMD64.EXE+4A6718 - 48 89 4D F8           - mov [rbp-08],rcx
  276. TOTALCMD64.EXE+4A671C - 48 8B 4D F8           - mov rcx,[rbp-08]
  277. TOTALCMD64.EXE+4A6720 - 48 8B 45 F8           - mov rax,[rbp-08]
  278. TOTALCMD64.EXE+4A6724 - 48 8B 00              - mov rax,[rax]
  279. TOTALCMD64.EXE+4A6727 - FF 90 60080000        - call qword ptr [rax+00000860]
  280. TOTALCMD64.EXE+4A672D - 48 8B 4D F8           - mov rcx,[rbp-08]
  281. TOTALCMD64.EXE+4A6731 - E8 5A56FEFF           - call TOTALCMD64.EXE+48BD90
  282.             TOTALCMD64.EXE+48BE32 - 74 1D                 - je TOTALCMD64.EXE+48BE51
  283.             TOTALCMD64.EXE+48BE34 - 48 8B 45 F8           - mov rax,[rbp-08]
  284.             TOTALCMD64.EXE+48BE38 - 48 8B 88 D0010000     - mov rcx,[rax+000001D0]
  285.             TOTALCMD64.EXE+48BE3F - 48 8B 55 F8           - mov rdx,[rbp-08]
  286.             TOTALCMD64.EXE+48BE43 - 48 8B 45 F8           - mov rax,[rbp-08]
  287.             TOTALCMD64.EXE+48BE47 - 48 8B 80 C8010000     - mov rax,[rax+000001C8]
  288.             TOTALCMD64.EXE+48BE4E - 48 FF D0              - call rax
  289.                 TOTALCMD64.EXE+EC5E0 - 55                    - push rbp
  290.  
  291.                 TOTALCMD64.EXE+EC88F - E8 0CF3F4FF           - call TOTALCMD64.EXE+3BBA0        -----> este a nop, si clickeo uno incorrecto no me cierra la ventana
  292.                 TOTALCMD64.EXE+EC894 - E8 173BF2FF           - call TOTALCMD64.EXE+103B0
  293.  
  294.                 TOTALCMD64.EXE+3BBA0 - 55                    - push rbp
  295.                 ...
  296.                 TOTALCMD64.EXE+3BC66 - FF 90 90080000        - call qword ptr [rax+00000890]
  297.  
  298.                 TOTALCMD64.EXE+38948 - 74 21                 - je TOTALCMD64.EXE+3896B
  299.  
  300.                 TOTALCMD64.EXE+36EBB0 - 55                    - push rbp
  301.                 ...
  302.                 TOTALCMD64.EXE+36EBF2 - 75 16                 - jne TOTALCMD64.EXE+36EC0A
  303.  
  304. TOTALCMD64.EXE+4A6736 - C9                    - leave
  305. TOTALCMD64.EXE+4A6737 - C3                    - ret
  306.  
  307.    
  308.    
  309.    
  310.    
  311.    
  312. TOTALCMD64.EXE+EC701 - 0F85 49010000         - jne TOTALCMD64.EXE+EC850 ------------> este a nop y no importa que botón aprite, pasa
  313.  
  314. -----------------------------------------------------------------------------------------
  315.  
  316.  
  317. por haber elegido la opción incorrecta, pasa por acá:
  318. ----------------------------------------------------
  319.  
  320. TOTALCMD64.EXE+356C36 - 0F8C 83070000         - jl TOTALCMD64.EXE+3573BF ----------------------> nop
  321. ...
  322. TOTALCMD64.EXE+356CCA - 74 05                 - je TOTALCMD64.EXE+356CD1
  323. TOTALCMD64.EXE+356CCC - E9 EE060000           - jmp TOTALCMD64.EXE+3573BF ---------------------> nop
  324. TOTALCMD64.EXE+356CD1 - FF 0D B97D3800        - dec [TOTALCMD64.EXE+6DEA90] { (0) } -----------> nop
  325. ...
  326. TOTALCMD64.EXE+35736F - 74 61                 - je TOTALCMD64.EXE+3573D2
  327. ...
  328. TOTALCMD64.EXE+3573BF - 4C 89 E9              - mov rcx,r13
  329. TOTALCMD64.EXE+3573C2 - E8 89A81200           - call TOTALCMD64.EXE+481C50
  330. TOTALCMD64.EXE+3573C7 - 48 89 C1              - mov rcx,rax
  331. TOTALCMD64.EXE+3573CA - 4C 89 F2              - mov rdx,r14
  332. TOTALCMD64.EXE+3573CD - E8 6E3BE3FF           - call TOTALCMD64.EXE+18AF40
  333.     TOTALCMD64.EXE+18AF40 - 55                    - push rbp
  334.     ...
  335.     TOTALCMD64.EXE+18B2EE - 48 8B 4D F8           - mov rcx,[rbp-08]
  336.     TOTALCMD64.EXE+18B2F2 - BA 41050000           - mov edx,00000541 { 1345 }
  337.     TOTALCMD64.EXE+18B2F7 - E8 B475E7FF           - call TOTALCMD64.EXE+28B0 { ->->USER32.KillTimer }
  338.     TOTALCMD64.EXE+18B2FC - 48 8B 05 ADC36E00     - mov rax,[TOTALCMD64.EXE+8776B0] { (07BF7030) }
  339.     TOTALCMD64.EXE+18B303 - C6 80 B2150000 00     - mov byte ptr [rax+000015B2],00 { 0 }
  340.     TOTALCMD64.EXE+18B30A - B9 10000000           - mov ecx,00000010 { 16 }
  341.     TOTALCMD64.EXE+18B30F - E8 BC78E7FF           - call TOTALCMD64.EXE+2BD0 { ->->USER32.MessageBeep }
  342.     TOTALCMD64.EXE+18B314 - 48 8D 8D E8FEFFFF     - lea rcx,[rbp-00000118]
  343.     TOTALCMD64.EXE+18B31B - E8 C052E9FF           - call TOTALCMD64.EXE+205E0
  344.     TOTALCMD64.EXE+18B320 - 48 89 C2              - mov rdx,rax
  345.     TOTALCMD64.EXE+18B323 - 4C 8B 05 46EE5400     - mov r8,[TOTALCMD64.EXE+6DA170] { (00AD70F8) }
  346.     TOTALCMD64.EXE+18B32A - 48 8B 4D F8           - mov rcx,[rbp-08]
  347.     TOTALCMD64.EXE+18B32E - 41 B9 10000000        - mov r9d,00000010 { 16 }
  348.     TOTALCMD64.EXE+18B334 - E8 2789EDFF           - call TOTALCMD64.EXE+63C60
  349.                     TOTALCMD64.EXE+63C60 - 55                    - push rbp
  350.                     TOTALCMD64.EXE+63C61 - 48 89 E5              - mov rbp,rsp
  351.                     TOTALCMD64.EXE+63C64 - 48 83 EC 60           - sub rsp,60 { 96 }
  352.                     TOTALCMD64.EXE+63C68 - 48 89 4D F8           - mov [rbp-08],rcx
  353.                     TOTALCMD64.EXE+63C6C - 48 89 55 F0           - mov [rbp-10],rdx
  354.                     TOTALCMD64.EXE+63C70 - 4C 89 45 E8           - mov [rbp-18],r8
  355.                     TOTALCMD64.EXE+63C74 - 44 89 4D E0           - mov [rbp-20],r9d
  356.                     TOTALCMD64.EXE+63C78 - 8B 45 E0              - mov eax,[rbp-20]
  357.                     TOTALCMD64.EXE+63C7B - 89 44 24 20           - mov [rsp+20],eax
  358.                     TOTALCMD64.EXE+63C7F - 4C 8B 4D E8           - mov r9,[rbp-18]
  359.                     TOTALCMD64.EXE+63C83 - 4C 8B 45 F0           - mov r8,[rbp-10]
  360.                     TOTALCMD64.EXE+63C87 - 48 8B 55 F8           - mov rdx,[rbp-08]
  361.                     TOTALCMD64.EXE+63C8B - 48 8B 0D 3E0C7500     - mov rcx,[TOTALCMD64.EXE+7B48D0] { (07C22AE0) }
  362.                     TOTALCMD64.EXE+63C92 - 48 8B 05 370C7500     - mov rax,[TOTALCMD64.EXE+7B48D0] { (07C22AE0) }
  363.                     TOTALCMD64.EXE+63C99 - 48 8B 00              - mov rax,[rax]
  364.                     TOTALCMD64.EXE+63C9C - FF 90 68050000        - call qword ptr [rax+00000568]
  365.                                     TOTALCMD64.EXE+4BCA80 - 55                    - push rbp
  366.                     TOTALCMD64.EXE+63CA2 - 89 45 D8              - mov [rbp-28],eax
  367.                     TOTALCMD64.EXE+63CA5 - 8B 45 D8              - mov eax,[rbp-28]
  368.                     TOTALCMD64.EXE+63CA8 - C9                    - leave
  369.                     TOTALCMD64.EXE+63CA9 - C3                    - ret
  370.  
  371.  
  372. Conclusion:
  373. ----------
  374.  
  375. To NOPs
  376.  
  377. TOTALCMD64.EXE+EC701
  378. TOTALCMD64.EXE+356C36
  379. TOTALCMD64.EXE+356CCC
  380. TOTALCMD64.EXE+356CD1
RAW Paste Data

Adblocker detected! Please consider disabling it...

We've detected AdBlock Plus or some other adblocking software preventing Pastebin.com from fully loading.

We don't have any obnoxious sound, or popup ads, we actively block these annoying types of ads!

Please add Pastebin.com to your ad blocker whitelist or disable your adblocking software.

×