Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Done with a couple of hours:
- ---------------------------
- 0010CF30
- ------------------------------
- TOTALCMD64.EXE+2CD29 - 4C 63 C0 - movsxd r8,eax
- 0042CD2C - 4D 6B C0 02 - imul r8,r8,02
- 0042CD30 - 66 46 8B 04 01 - mov r8w,[rcx+r8] <<
- 0042CD35 - 66 45 85 C0 - test r8w,r8w
- 0042CD39 - 75 D5 - jne TOTALCMD64.EXE+2CD10
- RAX=0000000000000000
- RBX=0000000001D1DCDA
- RCX=000000000010CF30
- RDX=00000000000000E6
- RSI=000000000010CF30
- RDI=00000000000000E6
- RSP=0000000001D1CD70
- RBP=0000000001D1CD90
- RIP=000000000042CD35
- R8=000000000000004E
- R9=0000000000000000
- R10=0000007200650064
- R11=0000000000000246
- R12=0000000000000000
- R13=0000000000000000
- R14=0000000000000001
- R15=0000000000000000
- TOTALCMD64.EXE+4D07 - F6 C2 02 - test dl,02 { 2 }
- 00404D0A - 74 0F - je TOTALCMD64.EXE+4D1B
- 00404D0C - 66 8B 04 11 - mov ax,[rcx+rdx] <<
- 00404D10 - 49 83 E8 02 - sub r8,02
- 00404D14 - 66 89 02 - mov [rdx],ax
- RAX=FFFFFFFFFE3E004E
- RBX=0000000001D1DCDA
- RCX=FFFFFFFFFE3EF256
- RDX=0000000001D1DCDA
- RSI=000000000010CF30
- RDI=00000000000000E6
- RSP=0000000001D1CD98
- RBP=0000000001D1CDE0
- RIP=0000000000404D10
- R8=000000000000001E
- R9=0000000000000000
- R10=0000007200650064
- R11=0000000000000246
- R12=000000000000001E
- R13=0000000000000000
- R14=0000000000000001
- R15=0000000000000000
- TOTALCMD64.EXE+4D1B - F6 C2 04 - test dl,04 { 4 }
- 00404D1E - 74 0D - je TOTALCMD64.EXE+4D2D
- 00404D20 - 8B 04 11 - mov eax,[rcx+rdx] <<
- 00404D23 - 49 83 E8 04 - sub r8,04
- 00404D27 - 89 02 - mov [rdx],eax
- RAX=000000000054004F
- RBX=0000000001D1DCDA
- RCX=FFFFFFFFFE3EF256
- RDX=0000000001D1DCDC
- RSI=000000000010CF30
- RDI=00000000000000E6
- RSP=0000000001D1CD98
- RBP=0000000001D1CDE0
- RIP=0000000000404D23
- R8=000000000000001C
- R9=0000000000000000
- R10=0000007200650064
- R11=0000000000000246
- R12=000000000000001E
- R13=0000000000000000
- R14=0000000000000001
- R15=0000000000000000
- TOTALCMD64.EXE+4D3D - 74 15 - je TOTALCMD64.EXE+4D54
- 00404D3F - 90 - nop
- 00404D40 - 48 8B 04 11 - mov rax,[rcx+rdx] <<
- 00404D44 - 48 89 02 - mov [rdx],rax
- 00404D47 - 48 83 C2 08 - add rdx,08
- RAX=0047004500520020
- RBX=0000000001D1DCDA
- RCX=FFFFFFFFFE3EF256
- RDX=0000000001D1DCE0
- RSI=000000000010CF30
- RDI=00000000000000E6
- RSP=0000000001D1CD98
- RBP=0000000001D1CDE0
- RIP=0000000000404D44
- R8=0000000000000018
- R9=0000000000000003
- R10=0000007200650064
- R11=0000000000000246
- R12=000000000000001E
- R13=0000000000000000
- R14=0000000000000001
- R15=0000000000000000
- TOTALCMD64.EXE+5168 - 74 51 - je TOTALCMD64.EXE+51BB
- 0040516A - 48 83 C1 10 - add rcx,10
- 0040516E - 66 0F6F 41 F0 - movdqa xmm0,[rcx-10] <<
- 00405173 - 4C 29 C1 - sub rcx,r8
- 00405176 - 41 F6 C0 01 - test r8l,01
- RAX=000000000010CF30
- RBX=000000000010CF30
- RCX=000000000010CF40
- RDX=FFFFFFFFFFFFFFFF
- RSI=000000000010CF30
- RDI=0000000000000000
- RSP=0000000001D1C868
- RBP=0000000001D1C8B0
- RIP=0000000000405173
- R8=000000000010CF30
- R9=0000000000000000
- R10=0000007200650064
- R11=0000000000000246
- R12=0000000000000000
- R13=0000000000000000
- R14=0000000000000001
- R15=0000000000000000
- TOTALCMD64.EXE+5199 - 66 66 66 90 - nop
- 0040519D - 66 66 90 - nop
- 004051A0 - 66 41 0F6F 04 48 - movdqa xmm0,[r8+rcx*2] <<
- 004051A6 - 48 83 C1 08 - add rcx,08
- 004051AA - 66 0F75 C1 - pcmpeqw xmm0,xmm1
- RAX=0000000000000000
- RBX=000000000010CF30
- RCX=0000000000000008
- RDX=FFFFFFFFFFFFFFFF
- RSI=000000000010CF30
- RDI=0000000000000000
- RSP=0000000001D1C868
- RBP=0000000001D1C8B0
- RIP=00000000004051A6
- R8=000000000010CF30
- R9=0000000000000000
- R10=0000007200650064
- R11=0000000000000246
- R12=0000000000000000
- R13=0000000000000000
- R14=0000000000000001
- R15=0000000000000000
- TOTALCMD64.EXE+4D59 - 66 66 66 90 - nop
- 00404D5D - 66 66 90 - nop
- 00404D60 - 8A 04 11 - mov al,[rcx+rdx] <<
- 00404D63 - 88 02 - mov [rdx],al
- 00404D65 - 48 FF C2 - inc rdx
- RAX=0052004500540045
- RBX=000000000010CF30
- RCX=FFFFFFFFFFF31398
- RDX=00000000001DBBB0
- RSI=000000000010CF30
- RDI=0000000000000000
- RSP=0000000001D1C868
- RBP=0000000001D1C8B0
- RIP=0000000000404D63
- R8=0000000000000004
- R9=0000000000000000
- R10=0000007200650064
- R11=0000000000000246
- R12=0000000000000000
- R13=0000000000000000
- R14=0000000000000001
- R15=0000000000000000
- TOTALCMD64.EXE+57ED5F - E8 4C12A9FF - call TOTALCMD64.EXE+FFB0
- TOTALCMD64.EXE+57F07A - E8 C132A8FF - call TOTALCMD64.EXE+2340 { ->->USER32.CreateWindowExW }
- TOTALCMD64.EXE+49255E - 74 0E - je TOTALCMD64.EXE+49256E
- TOTALCMD64.EXE+580185 - 74 09 - je TOTALCMD64.EXE+580190
- TOTALCMD64.EXE+5801A8 - 74 6F - je TOTALCMD64.EXE+580219
- TOTALCMD64.EXE+58023F - 74 05 - je TOTALCMD64.EXE+580246
- TOTALCMD64.EXE+484ADE - 74 0B - je TOTALCMD64.EXE+484AEB
- TOTALCMD64.EXE+47F57F - 74 0B - je TOTALCMD64.EXE+47F58C
- TOTALCMD64.EXE+47F5B2 - 74 05 - je TOTALCMD64.EXE+47F5B9
- TOTALCMD64.EXE+47F52C - 74 1E - je TOTALCMD64.EXE+47F54C
- --------------------------------------------------------------------------------------------
- TOTALCMD64.EXE+F55D - 74 02 - je TOTALCMD64.EXE+F561
- TOTALCMD64.EXE+F55F - EB 2E - jmp TOTALCMD64.EXE+F58F
- TOTALCMD64.EXE+F561 - 48 8B 55 D0 - mov rdx,[rbp-30]
- TOTALCMD64.EXE+F565 - 48 63 45 D8 - movsxd rax,dword ptr [rbp-28]
- TOTALCMD64.EXE+F569 - 48 C1 E0 04 - shl rax,04 { 4 }
- TOTALCMD64.EXE+F56D - 48 8B 44 02 08 - mov rax,[rdx+rax+08]
- TOTALCMD64.EXE+F572 - 48 89 45 B0 - mov [rbp-50],rax
- TOTALCMD64.EXE+F576 - 48 8B 45 F0 - mov rax,[rbp-10]
- TOTALCMD64.EXE+F57A - 48 89 45 B8 - mov [rbp-48],rax
- TOTALCMD64.EXE+F57E - 48 8B 55 F8 - mov rdx,[rbp-08]
- TOTALCMD64.EXE+F582 - 48 8B 4D B8 - mov rcx,[rbp-48]
- TOTALCMD64.EXE+F586 - 48 8B 45 B0 - mov rax,[rbp-50]
- TOTALCMD64.EXE+F58A - 48 FF D0 - call rax
- //PONIENDO ESTO A REP, APRETANDO CUALQUIER BOTON NADA PASA
- TOTALCMD64.EXE+4A6600 - 55 - push rbp
- TOTALCMD64.EXE+4A6601 - 48 89 E5 - mov rbp,rsp
- TOTALCMD64.EXE+4A6604 - 48 83 EC 30 - sub rsp,30 { 48 }
- TOTALCMD64.EXE+4A6608 - 48 89 4D F0 - mov [rbp-10],rcx
- TOTALCMD64.EXE+4A660C - 48 89 55 F8 - mov [rbp-08],rdx
- TOTALCMD64.EXE+4A6610 - 48 8B 4D F0 - mov rcx,[rbp-10]
- TOTALCMD64.EXE+4A6614 - 48 8B 45 F0 - mov rax,[rbp-10]
- TOTALCMD64.EXE+4A6618 - 48 8B 00 - mov rax,[rax]
- TOTALCMD64.EXE+4A661B - FF 90 80030000 - call qword ptr [rax+00000380]
- TOTALCMD64.EXE+4A6621 - C9 - leave
- TOTALCMD64.EXE+4A6622 - C3 - ret
- TOTALCMD64.EXE+4A7B90 - 55 - push rbp
- TOTALCMD64.EXE+4A7B91 - 48 89 E5 - mov rbp,rsp
- TOTALCMD64.EXE+4A7B94 - 48 83 EC 30 - sub rsp,30 { 48 }
- TOTALCMD64.EXE+4A7B98 - 48 89 4D F8 - mov [rbp-08],rcx
- TOTALCMD64.EXE+4A7B9C - 48 8B 4D F8 - mov rcx,[rbp-08]
- TOTALCMD64.EXE+4A7BA0 - E8 9BF9FFFF - call TOTALCMD64.EXE+4A7540
- TOTALCMD64.EXE+4A7BA5 - C9 - leave
- TOTALCMD64.EXE+4A7BA6 - C3 - ret
- TOTALCMD64.EXE+4A7540 - 55 - push rbp
- TOTALCMD64.EXE+4A7541 - 48 89 E5 - mov rbp,rsp
- TOTALCMD64.EXE+4A7544 - 48 83 EC 30 - sub rsp,30 { 48 }
- TOTALCMD64.EXE+4A7548 - 48 89 4D F8 - mov [rbp-08],rcx
- TOTALCMD64.EXE+4A754C - 48 8B 45 F8 - mov rax,[rbp-08]
- TOTALCMD64.EXE+4A7550 - 8B 80 58050000 - mov eax,[rax+00000558]
- TOTALCMD64.EXE+4A7556 - 85 C0 - test eax,eax
- TOTALCMD64.EXE+4A7558 - 74 2A - je TOTALCMD64.EXE+4A7584
- TOTALCMD64.EXE+4A755A - 48 8B 4D F8 - mov rcx,[rbp-08]
- TOTALCMD64.EXE+4A755E - E8 CDCBB8FF - call TOTALCMD64.EXE+34130
- TOTALCMD64.EXE+4A7563 - 48 89 45 F0 - mov [rbp-10],rax
- TOTALCMD64.EXE+4A7567 - 48 8B 45 F0 - mov rax,[rbp-10]
- TOTALCMD64.EXE+4A756B - 48 85 C0 - test rax,rax
- TOTALCMD64.EXE+4A756E - 74 14 - je TOTALCMD64.EXE+4A7584
- TOTALCMD64.EXE+4A7570 - 48 8B 55 F0 - mov rdx,[rbp-10]
- TOTALCMD64.EXE+4A7574 - 48 8B 45 F8 - mov rax,[rbp-08]
- TOTALCMD64.EXE+4A7578 - 8B 80 58050000 - mov eax,[rax+00000558]
- TOTALCMD64.EXE+4A757E - 89 82 10060000 - mov [rdx+00000610],eax
- TOTALCMD64.EXE+4A7584 - 48 8B 4D F8 - mov rcx,[rbp-08]
- TOTALCMD64.EXE+4A7588 - E8 83F1FFFF - call TOTALCMD64.EXE+4A6710
- TOTALCMD64.EXE+4A758D - C9 - leave
- TOTALCMD64.EXE+4A758E - C3 - ret
- TOTALCMD64.EXE+4A6710 - 55 - push rbp
- TOTALCMD64.EXE+4A6711 - 48 89 E5 - mov rbp,rsp
- TOTALCMD64.EXE+4A6714 - 48 83 EC 30 - sub rsp,30 { 48 }
- TOTALCMD64.EXE+4A6718 - 48 89 4D F8 - mov [rbp-08],rcx
- TOTALCMD64.EXE+4A671C - 48 8B 4D F8 - mov rcx,[rbp-08]
- TOTALCMD64.EXE+4A6720 - 48 8B 45 F8 - mov rax,[rbp-08]
- TOTALCMD64.EXE+4A6724 - 48 8B 00 - mov rax,[rax]
- TOTALCMD64.EXE+4A6727 - FF 90 60080000 - call qword ptr [rax+00000860]
- TOTALCMD64.EXE+4A672D - 48 8B 4D F8 - mov rcx,[rbp-08]
- TOTALCMD64.EXE+4A6731 - E8 5A56FEFF - call TOTALCMD64.EXE+48BD90
- TOTALCMD64.EXE+48BE32 - 74 1D - je TOTALCMD64.EXE+48BE51
- TOTALCMD64.EXE+48BE34 - 48 8B 45 F8 - mov rax,[rbp-08]
- TOTALCMD64.EXE+48BE38 - 48 8B 88 D0010000 - mov rcx,[rax+000001D0]
- TOTALCMD64.EXE+48BE3F - 48 8B 55 F8 - mov rdx,[rbp-08]
- TOTALCMD64.EXE+48BE43 - 48 8B 45 F8 - mov rax,[rbp-08]
- TOTALCMD64.EXE+48BE47 - 48 8B 80 C8010000 - mov rax,[rax+000001C8]
- TOTALCMD64.EXE+48BE4E - 48 FF D0 - call rax
- TOTALCMD64.EXE+EC5E0 - 55 - push rbp
- TOTALCMD64.EXE+EC88F - E8 0CF3F4FF - call TOTALCMD64.EXE+3BBA0 -----> este a nop, si clickeo uno incorrecto no me cierra la ventana
- TOTALCMD64.EXE+EC894 - E8 173BF2FF - call TOTALCMD64.EXE+103B0
- TOTALCMD64.EXE+3BBA0 - 55 - push rbp
- ...
- TOTALCMD64.EXE+3BC66 - FF 90 90080000 - call qword ptr [rax+00000890]
- TOTALCMD64.EXE+38948 - 74 21 - je TOTALCMD64.EXE+3896B
- TOTALCMD64.EXE+36EBB0 - 55 - push rbp
- ...
- TOTALCMD64.EXE+36EBF2 - 75 16 - jne TOTALCMD64.EXE+36EC0A
- TOTALCMD64.EXE+4A6736 - C9 - leave
- TOTALCMD64.EXE+4A6737 - C3 - ret
- TOTALCMD64.EXE+EC701 - 0F85 49010000 - jne TOTALCMD64.EXE+EC850 ------------> este a nop y no importa que botón aprite, pasa
- -----------------------------------------------------------------------------------------
- por haber elegido la opción incorrecta, pasa por acá:
- ----------------------------------------------------
- TOTALCMD64.EXE+356C36 - 0F8C 83070000 - jl TOTALCMD64.EXE+3573BF ----------------------> nop
- ...
- TOTALCMD64.EXE+356CCA - 74 05 - je TOTALCMD64.EXE+356CD1
- TOTALCMD64.EXE+356CCC - E9 EE060000 - jmp TOTALCMD64.EXE+3573BF ---------------------> nop
- TOTALCMD64.EXE+356CD1 - FF 0D B97D3800 - dec [TOTALCMD64.EXE+6DEA90] { (0) } -----------> nop
- ...
- TOTALCMD64.EXE+35736F - 74 61 - je TOTALCMD64.EXE+3573D2
- ...
- TOTALCMD64.EXE+3573BF - 4C 89 E9 - mov rcx,r13
- TOTALCMD64.EXE+3573C2 - E8 89A81200 - call TOTALCMD64.EXE+481C50
- TOTALCMD64.EXE+3573C7 - 48 89 C1 - mov rcx,rax
- TOTALCMD64.EXE+3573CA - 4C 89 F2 - mov rdx,r14
- TOTALCMD64.EXE+3573CD - E8 6E3BE3FF - call TOTALCMD64.EXE+18AF40
- TOTALCMD64.EXE+18AF40 - 55 - push rbp
- ...
- TOTALCMD64.EXE+18B2EE - 48 8B 4D F8 - mov rcx,[rbp-08]
- TOTALCMD64.EXE+18B2F2 - BA 41050000 - mov edx,00000541 { 1345 }
- TOTALCMD64.EXE+18B2F7 - E8 B475E7FF - call TOTALCMD64.EXE+28B0 { ->->USER32.KillTimer }
- TOTALCMD64.EXE+18B2FC - 48 8B 05 ADC36E00 - mov rax,[TOTALCMD64.EXE+8776B0] { (07BF7030) }
- TOTALCMD64.EXE+18B303 - C6 80 B2150000 00 - mov byte ptr [rax+000015B2],00 { 0 }
- TOTALCMD64.EXE+18B30A - B9 10000000 - mov ecx,00000010 { 16 }
- TOTALCMD64.EXE+18B30F - E8 BC78E7FF - call TOTALCMD64.EXE+2BD0 { ->->USER32.MessageBeep }
- TOTALCMD64.EXE+18B314 - 48 8D 8D E8FEFFFF - lea rcx,[rbp-00000118]
- TOTALCMD64.EXE+18B31B - E8 C052E9FF - call TOTALCMD64.EXE+205E0
- TOTALCMD64.EXE+18B320 - 48 89 C2 - mov rdx,rax
- TOTALCMD64.EXE+18B323 - 4C 8B 05 46EE5400 - mov r8,[TOTALCMD64.EXE+6DA170] { (00AD70F8) }
- TOTALCMD64.EXE+18B32A - 48 8B 4D F8 - mov rcx,[rbp-08]
- TOTALCMD64.EXE+18B32E - 41 B9 10000000 - mov r9d,00000010 { 16 }
- TOTALCMD64.EXE+18B334 - E8 2789EDFF - call TOTALCMD64.EXE+63C60
- TOTALCMD64.EXE+63C60 - 55 - push rbp
- TOTALCMD64.EXE+63C61 - 48 89 E5 - mov rbp,rsp
- TOTALCMD64.EXE+63C64 - 48 83 EC 60 - sub rsp,60 { 96 }
- TOTALCMD64.EXE+63C68 - 48 89 4D F8 - mov [rbp-08],rcx
- TOTALCMD64.EXE+63C6C - 48 89 55 F0 - mov [rbp-10],rdx
- TOTALCMD64.EXE+63C70 - 4C 89 45 E8 - mov [rbp-18],r8
- TOTALCMD64.EXE+63C74 - 44 89 4D E0 - mov [rbp-20],r9d
- TOTALCMD64.EXE+63C78 - 8B 45 E0 - mov eax,[rbp-20]
- TOTALCMD64.EXE+63C7B - 89 44 24 20 - mov [rsp+20],eax
- TOTALCMD64.EXE+63C7F - 4C 8B 4D E8 - mov r9,[rbp-18]
- TOTALCMD64.EXE+63C83 - 4C 8B 45 F0 - mov r8,[rbp-10]
- TOTALCMD64.EXE+63C87 - 48 8B 55 F8 - mov rdx,[rbp-08]
- TOTALCMD64.EXE+63C8B - 48 8B 0D 3E0C7500 - mov rcx,[TOTALCMD64.EXE+7B48D0] { (07C22AE0) }
- TOTALCMD64.EXE+63C92 - 48 8B 05 370C7500 - mov rax,[TOTALCMD64.EXE+7B48D0] { (07C22AE0) }
- TOTALCMD64.EXE+63C99 - 48 8B 00 - mov rax,[rax]
- TOTALCMD64.EXE+63C9C - FF 90 68050000 - call qword ptr [rax+00000568]
- TOTALCMD64.EXE+4BCA80 - 55 - push rbp
- TOTALCMD64.EXE+63CA2 - 89 45 D8 - mov [rbp-28],eax
- TOTALCMD64.EXE+63CA5 - 8B 45 D8 - mov eax,[rbp-28]
- TOTALCMD64.EXE+63CA8 - C9 - leave
- TOTALCMD64.EXE+63CA9 - C3 - ret
- Conclusion:
- ----------
- To NOPs
- TOTALCMD64.EXE+EC701
- TOTALCMD64.EXE+356C36
- TOTALCMD64.EXE+356CCC
- TOTALCMD64.EXE+356CD1
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement