Miseryk

Reversing/Cracking Total Commander x64 9.51

Apr 14th, 2021
1,108
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Done with a couple of hours:
  2. ---------------------------
  3.  
  4. 0010CF30
  5.  
  6. ------------------------------
  7.  
  8. TOTALCMD64.EXE+2CD29 - 4C 63 C0              - movsxd  r8,eax
  9. 0042CD2C - 4D 6B C0 02 - imul r8,r8,02
  10. 0042CD30 - 66 46 8B 04 01   - mov r8w,[rcx+r8] <<
  11. 0042CD35 - 66 45 85 C0  - test r8w,r8w
  12. 0042CD39 - 75 D5 - jne TOTALCMD64.EXE+2CD10
  13.  
  14. RAX=0000000000000000
  15. RBX=0000000001D1DCDA
  16. RCX=000000000010CF30
  17. RDX=00000000000000E6
  18. RSI=000000000010CF30
  19. RDI=00000000000000E6
  20. RSP=0000000001D1CD70
  21. RBP=0000000001D1CD90
  22. RIP=000000000042CD35
  23. R8=000000000000004E
  24. R9=0000000000000000
  25. R10=0000007200650064
  26. R11=0000000000000246
  27. R12=0000000000000000
  28. R13=0000000000000000
  29. R14=0000000000000001
  30. R15=0000000000000000
  31.  
  32. TOTALCMD64.EXE+4D07 - F6 C2 02              - test dl,02 { 2 }
  33. 00404D0A - 74 0F - je TOTALCMD64.EXE+4D1B
  34. 00404D0C - 66 8B 04 11   - mov ax,[rcx+rdx] <<
  35. 00404D10 - 49 83 E8 02 - sub r8,02
  36. 00404D14 - 66 89 02  - mov [rdx],ax
  37.  
  38. RAX=FFFFFFFFFE3E004E
  39. RBX=0000000001D1DCDA
  40. RCX=FFFFFFFFFE3EF256
  41. RDX=0000000001D1DCDA
  42. RSI=000000000010CF30
  43. RDI=00000000000000E6
  44. RSP=0000000001D1CD98
  45. RBP=0000000001D1CDE0
  46. RIP=0000000000404D10
  47. R8=000000000000001E
  48. R9=0000000000000000
  49. R10=0000007200650064
  50. R11=0000000000000246
  51. R12=000000000000001E
  52. R13=0000000000000000
  53. R14=0000000000000001
  54. R15=0000000000000000
  55.  
  56. TOTALCMD64.EXE+4D1B - F6 C2 04              - test dl,04 { 4 }
  57. 00404D1E - 74 0D - je TOTALCMD64.EXE+4D2D
  58. 00404D20 - 8B 04 11   - mov eax,[rcx+rdx] <<
  59. 00404D23 - 49 83 E8 04 - sub r8,04
  60. 00404D27 - 89 02  - mov [rdx],eax
  61.  
  62. RAX=000000000054004F
  63. RBX=0000000001D1DCDA
  64. RCX=FFFFFFFFFE3EF256
  65. RDX=0000000001D1DCDC
  66. RSI=000000000010CF30
  67. RDI=00000000000000E6
  68. RSP=0000000001D1CD98
  69. RBP=0000000001D1CDE0
  70. RIP=0000000000404D23
  71. R8=000000000000001C
  72. R9=0000000000000000
  73. R10=0000007200650064
  74. R11=0000000000000246
  75. R12=000000000000001E
  76. R13=0000000000000000
  77. R14=0000000000000001
  78. R15=0000000000000000
  79.  
  80. TOTALCMD64.EXE+4D3D - 74 15                 - je TOTALCMD64.EXE+4D54
  81. 00404D3F - 90 - nop
  82. 00404D40 - 48 8B 04 11   - mov rax,[rcx+rdx] <<
  83. 00404D44 - 48 89 02  - mov [rdx],rax
  84. 00404D47 - 48 83 C2 08 - add rdx,08
  85.  
  86. RAX=0047004500520020
  87. RBX=0000000001D1DCDA
  88. RCX=FFFFFFFFFE3EF256
  89. RDX=0000000001D1DCE0
  90. RSI=000000000010CF30
  91. RDI=00000000000000E6
  92. RSP=0000000001D1CD98
  93. RBP=0000000001D1CDE0
  94. RIP=0000000000404D44
  95. R8=0000000000000018
  96. R9=0000000000000003
  97. R10=0000007200650064
  98. R11=0000000000000246
  99. R12=000000000000001E
  100. R13=0000000000000000
  101. R14=0000000000000001
  102. R15=0000000000000000
  103.  
  104.  
  105. TOTALCMD64.EXE+5168 - 74 51                 - je TOTALCMD64.EXE+51BB
  106. 0040516A - 48 83 C1 10 - add rcx,10
  107. 0040516E - 66 0F6F 41 F0  - movdqa xmm0,[rcx-10] <<
  108. 00405173 - 4C 29 C1  - sub rcx,r8
  109. 00405176 - 41 F6 C0 01 - test r8l,01
  110.  
  111. RAX=000000000010CF30
  112. RBX=000000000010CF30
  113. RCX=000000000010CF40
  114. RDX=FFFFFFFFFFFFFFFF
  115. RSI=000000000010CF30
  116. RDI=0000000000000000
  117. RSP=0000000001D1C868
  118. RBP=0000000001D1C8B0
  119. RIP=0000000000405173
  120. R8=000000000010CF30
  121. R9=0000000000000000
  122. R10=0000007200650064
  123. R11=0000000000000246
  124. R12=0000000000000000
  125. R13=0000000000000000
  126. R14=0000000000000001
  127. R15=0000000000000000
  128.  
  129.  
  130. TOTALCMD64.EXE+5199 - 66 66 66 90           - nop
  131. 0040519D - 66 66 90 - nop
  132. 004051A0 - 66 41 0F6F 04 48   - movdqa xmm0,[r8+rcx*2] <<
  133. 004051A6 - 48 83 C1 08 - add rcx,08
  134. 004051AA - 66 0F75 C1  - pcmpeqw xmm0,xmm1
  135.  
  136. RAX=0000000000000000
  137. RBX=000000000010CF30
  138. RCX=0000000000000008
  139. RDX=FFFFFFFFFFFFFFFF
  140. RSI=000000000010CF30
  141. RDI=0000000000000000
  142. RSP=0000000001D1C868
  143. RBP=0000000001D1C8B0
  144. RIP=00000000004051A6
  145. R8=000000000010CF30
  146. R9=0000000000000000
  147. R10=0000007200650064
  148. R11=0000000000000246
  149. R12=0000000000000000
  150. R13=0000000000000000
  151. R14=0000000000000001
  152. R15=0000000000000000
  153.  
  154.  
  155. TOTALCMD64.EXE+4D59 - 66 66 66 90           - nop
  156. 00404D5D - 66 66 90 - nop
  157. 00404D60 - 8A 04 11   - mov al,[rcx+rdx] <<
  158. 00404D63 - 88 02  - mov [rdx],al
  159. 00404D65 - 48 FF C2  - inc rdx
  160.  
  161. RAX=0052004500540045
  162. RBX=000000000010CF30
  163. RCX=FFFFFFFFFFF31398
  164. RDX=00000000001DBBB0
  165. RSI=000000000010CF30
  166. RDI=0000000000000000
  167. RSP=0000000001D1C868
  168. RBP=0000000001D1C8B0
  169. RIP=0000000000404D63
  170. R8=0000000000000004
  171. R9=0000000000000000
  172. R10=0000007200650064
  173. R11=0000000000000246
  174. R12=0000000000000000
  175. R13=0000000000000000
  176. R14=0000000000000001
  177. R15=0000000000000000
  178.  
  179.  
  180.  
  181.  
  182.  
  183.  
  184.  
  185. TOTALCMD64.EXE+57ED5F - E8 4C12A9FF           - call TOTALCMD64.EXE+FFB0
  186.  
  187. TOTALCMD64.EXE+57F07A - E8 C132A8FF           - call TOTALCMD64.EXE+2340 { ->->USER32.CreateWindowExW }
  188.  
  189. TOTALCMD64.EXE+49255E - 74 0E                 - je TOTALCMD64.EXE+49256E
  190.  
  191.  
  192.  
  193. TOTALCMD64.EXE+580185 - 74 09                 - je TOTALCMD64.EXE+580190
  194.  
  195.  
  196.  
  197. TOTALCMD64.EXE+5801A8 - 74 6F                 - je TOTALCMD64.EXE+580219
  198. TOTALCMD64.EXE+58023F - 74 05                 - je TOTALCMD64.EXE+580246
  199. TOTALCMD64.EXE+484ADE - 74 0B                 - je TOTALCMD64.EXE+484AEB
  200. TOTALCMD64.EXE+47F57F - 74 0B                 - je TOTALCMD64.EXE+47F58C
  201. TOTALCMD64.EXE+47F5B2 - 74 05                 - je TOTALCMD64.EXE+47F5B9
  202. TOTALCMD64.EXE+47F52C - 74 1E                 - je TOTALCMD64.EXE+47F54C
  203.  
  204. --------------------------------------------------------------------------------------------
  205. TOTALCMD64.EXE+F55D - 74 02                 - je TOTALCMD64.EXE+F561
  206. TOTALCMD64.EXE+F55F - EB 2E                 - jmp TOTALCMD64.EXE+F58F
  207. TOTALCMD64.EXE+F561 - 48 8B 55 D0           - mov rdx,[rbp-30]
  208. TOTALCMD64.EXE+F565 - 48 63 45 D8           - movsxd  rax,dword ptr [rbp-28]
  209. TOTALCMD64.EXE+F569 - 48 C1 E0 04           - shl rax,04 { 4 }
  210. TOTALCMD64.EXE+F56D - 48 8B 44 02 08        - mov rax,[rdx+rax+08]
  211. TOTALCMD64.EXE+F572 - 48 89 45 B0           - mov [rbp-50],rax
  212. TOTALCMD64.EXE+F576 - 48 8B 45 F0           - mov rax,[rbp-10]
  213. TOTALCMD64.EXE+F57A - 48 89 45 B8           - mov [rbp-48],rax
  214. TOTALCMD64.EXE+F57E - 48 8B 55 F8           - mov rdx,[rbp-08]
  215. TOTALCMD64.EXE+F582 - 48 8B 4D B8           - mov rcx,[rbp-48]
  216. TOTALCMD64.EXE+F586 - 48 8B 45 B0           - mov rax,[rbp-50]
  217. TOTALCMD64.EXE+F58A - 48 FF D0              - call rax
  218.  
  219.  
  220. //PONIENDO ESTO A REP, APRETANDO CUALQUIER BOTON NADA PASA
  221. TOTALCMD64.EXE+4A6600 - 55                    - push rbp
  222. TOTALCMD64.EXE+4A6601 - 48 89 E5              - mov rbp,rsp
  223. TOTALCMD64.EXE+4A6604 - 48 83 EC 30           - sub rsp,30 { 48 }
  224. TOTALCMD64.EXE+4A6608 - 48 89 4D F0           - mov [rbp-10],rcx
  225. TOTALCMD64.EXE+4A660C - 48 89 55 F8           - mov [rbp-08],rdx
  226. TOTALCMD64.EXE+4A6610 - 48 8B 4D F0           - mov rcx,[rbp-10]
  227. TOTALCMD64.EXE+4A6614 - 48 8B 45 F0           - mov rax,[rbp-10]
  228. TOTALCMD64.EXE+4A6618 - 48 8B 00              - mov rax,[rax]
  229. TOTALCMD64.EXE+4A661B - FF 90 80030000        - call qword ptr [rax+00000380]
  230. TOTALCMD64.EXE+4A6621 - C9                    - leave
  231. TOTALCMD64.EXE+4A6622 - C3                    - ret
  232.  
  233.  
  234. TOTALCMD64.EXE+4A7B90 - 55                    - push rbp
  235. TOTALCMD64.EXE+4A7B91 - 48 89 E5              - mov rbp,rsp
  236. TOTALCMD64.EXE+4A7B94 - 48 83 EC 30           - sub rsp,30 { 48 }
  237. TOTALCMD64.EXE+4A7B98 - 48 89 4D F8           - mov [rbp-08],rcx
  238. TOTALCMD64.EXE+4A7B9C - 48 8B 4D F8           - mov rcx,[rbp-08]
  239. TOTALCMD64.EXE+4A7BA0 - E8 9BF9FFFF           - call TOTALCMD64.EXE+4A7540
  240. TOTALCMD64.EXE+4A7BA5 - C9                    - leave
  241. TOTALCMD64.EXE+4A7BA6 - C3                    - ret
  242.  
  243.  
  244.  
  245. TOTALCMD64.EXE+4A7540 - 55                    - push rbp
  246. TOTALCMD64.EXE+4A7541 - 48 89 E5              - mov rbp,rsp
  247. TOTALCMD64.EXE+4A7544 - 48 83 EC 30           - sub rsp,30 { 48 }
  248. TOTALCMD64.EXE+4A7548 - 48 89 4D F8           - mov [rbp-08],rcx
  249. TOTALCMD64.EXE+4A754C - 48 8B 45 F8           - mov rax,[rbp-08]
  250. TOTALCMD64.EXE+4A7550 - 8B 80 58050000        - mov eax,[rax+00000558]
  251. TOTALCMD64.EXE+4A7556 - 85 C0                 - test eax,eax
  252. TOTALCMD64.EXE+4A7558 - 74 2A                 - je TOTALCMD64.EXE+4A7584
  253. TOTALCMD64.EXE+4A755A - 48 8B 4D F8           - mov rcx,[rbp-08]
  254. TOTALCMD64.EXE+4A755E - E8 CDCBB8FF           - call TOTALCMD64.EXE+34130
  255. TOTALCMD64.EXE+4A7563 - 48 89 45 F0           - mov [rbp-10],rax
  256. TOTALCMD64.EXE+4A7567 - 48 8B 45 F0           - mov rax,[rbp-10]
  257. TOTALCMD64.EXE+4A756B - 48 85 C0              - test rax,rax
  258. TOTALCMD64.EXE+4A756E - 74 14                 - je TOTALCMD64.EXE+4A7584
  259. TOTALCMD64.EXE+4A7570 - 48 8B 55 F0           - mov rdx,[rbp-10]
  260. TOTALCMD64.EXE+4A7574 - 48 8B 45 F8           - mov rax,[rbp-08]
  261. TOTALCMD64.EXE+4A7578 - 8B 80 58050000        - mov eax,[rax+00000558]
  262. TOTALCMD64.EXE+4A757E - 89 82 10060000        - mov [rdx+00000610],eax
  263. TOTALCMD64.EXE+4A7584 - 48 8B 4D F8           - mov rcx,[rbp-08]
  264. TOTALCMD64.EXE+4A7588 - E8 83F1FFFF           - call TOTALCMD64.EXE+4A6710
  265. TOTALCMD64.EXE+4A758D - C9                    - leave
  266. TOTALCMD64.EXE+4A758E - C3                    - ret
  267.  
  268.  
  269.  
  270.  
  271.  
  272. TOTALCMD64.EXE+4A6710 - 55                    - push rbp
  273. TOTALCMD64.EXE+4A6711 - 48 89 E5              - mov rbp,rsp
  274. TOTALCMD64.EXE+4A6714 - 48 83 EC 30           - sub rsp,30 { 48 }
  275. TOTALCMD64.EXE+4A6718 - 48 89 4D F8           - mov [rbp-08],rcx
  276. TOTALCMD64.EXE+4A671C - 48 8B 4D F8           - mov rcx,[rbp-08]
  277. TOTALCMD64.EXE+4A6720 - 48 8B 45 F8           - mov rax,[rbp-08]
  278. TOTALCMD64.EXE+4A6724 - 48 8B 00              - mov rax,[rax]
  279. TOTALCMD64.EXE+4A6727 - FF 90 60080000        - call qword ptr [rax+00000860]
  280. TOTALCMD64.EXE+4A672D - 48 8B 4D F8           - mov rcx,[rbp-08]
  281. TOTALCMD64.EXE+4A6731 - E8 5A56FEFF           - call TOTALCMD64.EXE+48BD90
  282.             TOTALCMD64.EXE+48BE32 - 74 1D                 - je TOTALCMD64.EXE+48BE51
  283.             TOTALCMD64.EXE+48BE34 - 48 8B 45 F8           - mov rax,[rbp-08]
  284.             TOTALCMD64.EXE+48BE38 - 48 8B 88 D0010000     - mov rcx,[rax+000001D0]
  285.             TOTALCMD64.EXE+48BE3F - 48 8B 55 F8           - mov rdx,[rbp-08]
  286.             TOTALCMD64.EXE+48BE43 - 48 8B 45 F8           - mov rax,[rbp-08]
  287.             TOTALCMD64.EXE+48BE47 - 48 8B 80 C8010000     - mov rax,[rax+000001C8]
  288.             TOTALCMD64.EXE+48BE4E - 48 FF D0              - call rax
  289.                 TOTALCMD64.EXE+EC5E0 - 55                    - push rbp
  290.  
  291.                 TOTALCMD64.EXE+EC88F - E8 0CF3F4FF           - call TOTALCMD64.EXE+3BBA0        -----> este a nop, si clickeo uno incorrecto no me cierra la ventana
  292.                 TOTALCMD64.EXE+EC894 - E8 173BF2FF           - call TOTALCMD64.EXE+103B0
  293.  
  294.                 TOTALCMD64.EXE+3BBA0 - 55                    - push rbp
  295.                 ...
  296.                 TOTALCMD64.EXE+3BC66 - FF 90 90080000        - call qword ptr [rax+00000890]
  297.  
  298.                 TOTALCMD64.EXE+38948 - 74 21                 - je TOTALCMD64.EXE+3896B
  299.  
  300.                 TOTALCMD64.EXE+36EBB0 - 55                    - push rbp
  301.                 ...
  302.                 TOTALCMD64.EXE+36EBF2 - 75 16                 - jne TOTALCMD64.EXE+36EC0A
  303.  
  304. TOTALCMD64.EXE+4A6736 - C9                    - leave
  305. TOTALCMD64.EXE+4A6737 - C3                    - ret
  306.  
  307.    
  308.    
  309.    
  310.    
  311.    
  312. TOTALCMD64.EXE+EC701 - 0F85 49010000         - jne TOTALCMD64.EXE+EC850 ------------> este a nop y no importa que botón aprite, pasa
  313.  
  314. -----------------------------------------------------------------------------------------
  315.  
  316.  
  317. por haber elegido la opción incorrecta, pasa por acá:
  318. ----------------------------------------------------
  319.  
  320. TOTALCMD64.EXE+356C36 - 0F8C 83070000         - jl TOTALCMD64.EXE+3573BF ----------------------> nop
  321. ...
  322. TOTALCMD64.EXE+356CCA - 74 05                 - je TOTALCMD64.EXE+356CD1
  323. TOTALCMD64.EXE+356CCC - E9 EE060000           - jmp TOTALCMD64.EXE+3573BF ---------------------> nop
  324. TOTALCMD64.EXE+356CD1 - FF 0D B97D3800        - dec [TOTALCMD64.EXE+6DEA90] { (0) } -----------> nop
  325. ...
  326. TOTALCMD64.EXE+35736F - 74 61                 - je TOTALCMD64.EXE+3573D2
  327. ...
  328. TOTALCMD64.EXE+3573BF - 4C 89 E9              - mov rcx,r13
  329. TOTALCMD64.EXE+3573C2 - E8 89A81200           - call TOTALCMD64.EXE+481C50
  330. TOTALCMD64.EXE+3573C7 - 48 89 C1              - mov rcx,rax
  331. TOTALCMD64.EXE+3573CA - 4C 89 F2              - mov rdx,r14
  332. TOTALCMD64.EXE+3573CD - E8 6E3BE3FF           - call TOTALCMD64.EXE+18AF40
  333.     TOTALCMD64.EXE+18AF40 - 55                    - push rbp
  334.     ...
  335.     TOTALCMD64.EXE+18B2EE - 48 8B 4D F8           - mov rcx,[rbp-08]
  336.     TOTALCMD64.EXE+18B2F2 - BA 41050000           - mov edx,00000541 { 1345 }
  337.     TOTALCMD64.EXE+18B2F7 - E8 B475E7FF           - call TOTALCMD64.EXE+28B0 { ->->USER32.KillTimer }
  338.     TOTALCMD64.EXE+18B2FC - 48 8B 05 ADC36E00     - mov rax,[TOTALCMD64.EXE+8776B0] { (07BF7030) }
  339.     TOTALCMD64.EXE+18B303 - C6 80 B2150000 00     - mov byte ptr [rax+000015B2],00 { 0 }
  340.     TOTALCMD64.EXE+18B30A - B9 10000000           - mov ecx,00000010 { 16 }
  341.     TOTALCMD64.EXE+18B30F - E8 BC78E7FF           - call TOTALCMD64.EXE+2BD0 { ->->USER32.MessageBeep }
  342.     TOTALCMD64.EXE+18B314 - 48 8D 8D E8FEFFFF     - lea rcx,[rbp-00000118]
  343.     TOTALCMD64.EXE+18B31B - E8 C052E9FF           - call TOTALCMD64.EXE+205E0
  344.     TOTALCMD64.EXE+18B320 - 48 89 C2              - mov rdx,rax
  345.     TOTALCMD64.EXE+18B323 - 4C 8B 05 46EE5400     - mov r8,[TOTALCMD64.EXE+6DA170] { (00AD70F8) }
  346.     TOTALCMD64.EXE+18B32A - 48 8B 4D F8           - mov rcx,[rbp-08]
  347.     TOTALCMD64.EXE+18B32E - 41 B9 10000000        - mov r9d,00000010 { 16 }
  348.     TOTALCMD64.EXE+18B334 - E8 2789EDFF           - call TOTALCMD64.EXE+63C60
  349.                     TOTALCMD64.EXE+63C60 - 55                    - push rbp
  350.                     TOTALCMD64.EXE+63C61 - 48 89 E5              - mov rbp,rsp
  351.                     TOTALCMD64.EXE+63C64 - 48 83 EC 60           - sub rsp,60 { 96 }
  352.                     TOTALCMD64.EXE+63C68 - 48 89 4D F8           - mov [rbp-08],rcx
  353.                     TOTALCMD64.EXE+63C6C - 48 89 55 F0           - mov [rbp-10],rdx
  354.                     TOTALCMD64.EXE+63C70 - 4C 89 45 E8           - mov [rbp-18],r8
  355.                     TOTALCMD64.EXE+63C74 - 44 89 4D E0           - mov [rbp-20],r9d
  356.                     TOTALCMD64.EXE+63C78 - 8B 45 E0              - mov eax,[rbp-20]
  357.                     TOTALCMD64.EXE+63C7B - 89 44 24 20           - mov [rsp+20],eax
  358.                     TOTALCMD64.EXE+63C7F - 4C 8B 4D E8           - mov r9,[rbp-18]
  359.                     TOTALCMD64.EXE+63C83 - 4C 8B 45 F0           - mov r8,[rbp-10]
  360.                     TOTALCMD64.EXE+63C87 - 48 8B 55 F8           - mov rdx,[rbp-08]
  361.                     TOTALCMD64.EXE+63C8B - 48 8B 0D 3E0C7500     - mov rcx,[TOTALCMD64.EXE+7B48D0] { (07C22AE0) }
  362.                     TOTALCMD64.EXE+63C92 - 48 8B 05 370C7500     - mov rax,[TOTALCMD64.EXE+7B48D0] { (07C22AE0) }
  363.                     TOTALCMD64.EXE+63C99 - 48 8B 00              - mov rax,[rax]
  364.                     TOTALCMD64.EXE+63C9C - FF 90 68050000        - call qword ptr [rax+00000568]
  365.                                     TOTALCMD64.EXE+4BCA80 - 55                    - push rbp
  366.                     TOTALCMD64.EXE+63CA2 - 89 45 D8              - mov [rbp-28],eax
  367.                     TOTALCMD64.EXE+63CA5 - 8B 45 D8              - mov eax,[rbp-28]
  368.                     TOTALCMD64.EXE+63CA8 - C9                    - leave
  369.                     TOTALCMD64.EXE+63CA9 - C3                    - ret
  370.  
  371.  
  372. Conclusion:
  373. ----------
  374.  
  375. To NOPs
  376.  
  377. TOTALCMD64.EXE+EC701
  378. TOTALCMD64.EXE+356C36
  379. TOTALCMD64.EXE+356CCC
  380. TOTALCMD64.EXE+356CD1
RAW Paste Data