API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Mar 31st, 2022
92
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 20.93 KB | None | 0 0
raw download clone embed print report
  1. ; Don't focus too much on the actual x86 code, just looking at the calls
  2. ; and the annotations that windbg has added makes it very clear what's
  3. ; going on roughly, which happens to be enough for this challenge.
  4.  
  5. ; -----------------------------------------------------
  6. ; Token: 0x0600003f
  7. ; Description: Creates a MD5 uppercase hex digest
  8. ; -----------------------------------------------------
  9.  
  10. 02b7d950 55 push ebp
  11. 02b7d951 8bec mov ebp,esp
  12. 02b7d953 57 push edi
  13. 02b7d954 56 push esi
  14. 02b7d955 53 push ebx
  15. 02b7d956 83ec28 sub esp,28h
  16. 02b7d959 8bf1 mov esi,ecx
  17. 02b7d95b 8d7dcc lea edi,[ebp-34h]
  18. 02b7d95e b909000000 mov ecx,9
  19. 02b7d963 33c0 xor eax,eax
  20. 02b7d965 f3ab rep stos dword ptr es:[edi]
  21. 02b7d967 8bce mov ecx,esi
  22. 02b7d969 8bf1 mov esi,ecx
  23. 02b7d96b 33db xor ebx,ebx
  24. 02b7d96d ff15582fde72 call dword ptr [mscorlib_ni+0x252f58 (72de2f58)] (System.Security.Cryptography.MD5.Create(), mdToken: 06002221)
  25. 02b7d973 8945dc mov dword ptr [ebp-24h],eax
  26. 02b7d976 e805ba4a70 call mscorlib_ni+0x499380 (73029380) (System.Text.Encoding.get_ASCII(), mdToken: 0600672f)
  27. 02b7d97b 8bc8 mov ecx,eax
  28. 02b7d97d 8bd6 mov edx,esi
  29. 02b7d97f 8b01 mov eax,dword ptr [ecx]
  30. 02b7d981 8b4034 mov eax,dword ptr [eax+34h]
  31. 02b7d984 ff5004 call dword ptr [eax+4]
  32. 02b7d987 8945d8 mov dword ptr [ebp-28h],eax
  33. 02b7d98a b8dc2f5515 mov eax,15552FDCh
  34. 02b7d98f 354972f945 xor eax,45F97249h
  35. 02b7d994 8bf0 mov esi,eax
  36. 02b7d996 8bc6 mov eax,esi
  37. 02b7d998 b909000000 mov ecx,9
  38. 02b7d99d 33d2 xor edx,edx
  39. 02b7d99f f7f1 div eax,ecx
  40. 02b7d9a1 83fa09 cmp edx,9
  41. 02b7d9a4 0f8301010000 jae 02b7daab
  42. 02b7d9aa ff249520dbb702 jmp dword ptr [edx*4+2B7DB20h]
  43. 02b7d9b1 8b4ddc mov ecx,dword ptr [ebp-24h]
  44. 02b7d9b4 8b55d8 mov edx,dword ptr [ebp-28h]
  45. 02b7d9b7 3909 cmp dword ptr [ecx],ecx
  46. 02b7d9b9 e8e2654b70 call mscorlib_ni+0x4a3fa0 (73033fa0) (System.Security.Cryptography.HashAlgorithm.ComputeHash(Byte[]), mdToken: 060021d4)
  47. 02b7d9be 8945d4 mov dword ptr [ebp-2Ch],eax
  48. 02b7d9c1 b94c52ba72 mov ecx,offset mscorlib_ni+0x1524c (72ba524c) (MT: System.Text.StringBuilder)
  49. 02b7d9c6 e8fd566afe call 012230c8 (JitHelp: CORINFO_HELP_NEWSFAST)
  50. 02b7d9cb 8bf8 mov edi,eax
  51. 02b7d9cd 8b154023cf03 mov edx,dword ptr ds:[3CF2340h] ("")
  52. 02b7d9d3 85d2 test edx,edx
  53. 02b7d9d5 7504 jne 02b7d9db
  54. 02b7d9d7 33c9 xor ecx,ecx
  55. 02b7d9d9 eb03 jmp 02b7d9de
  56. 02b7d9db 8b4a04 mov ecx,dword ptr [edx+4]
  57. 02b7d9de 6a00 push 0
  58. 02b7d9e0 51 push ecx
  59. 02b7d9e1 6a10 push 10h
  60. 02b7d9e3 8bcf mov ecx,edi
  61. 02b7d9e5 e886bb3d70 call mscorlib_ni+0x3c9570 (72f59570) (System.Text.StringBuilder..ctor(System.String, Int32, Int32, Int32), mdToken: 060065c2)
  62. 02b7d9ea 897dd0 mov dword ptr [ebp-30h],edi
  63. 02b7d9ed 69c67580d208 imul eax,esi,8D28075h
  64. 02b7d9f3 357319540f xor eax,0F541973h
  65. 02b7d9f8 eb95 jmp 02b7d98f
  66. 02b7d9fa 33db xor ebx,ebx
  67. 02b7d9fc 69c6d690642c imul eax,esi,2C6490D6h
  68. 02b7da02 35758ffa4a xor eax,4AFA8F75h
  69. 02b7da07 eb86 jmp 02b7d98f
  70. 02b7da09 8b4dd0 mov ecx,dword ptr [ebp-30h]
  71. 02b7da0c 8b01 mov eax,dword ptr [ecx]
  72. 02b7da0e 8b4028 mov eax,dword ptr [eax+28h]
  73. 02b7da11 ff10 call dword ptr [eax]
  74. 02b7da13 8945cc mov dword ptr [ebp-34h],eax
  75. 02b7da16 69c6ece497d4 imul eax,esi,0D497E4ECh
  76. 02b7da1c 35e2d0ab75 xor eax,offset mscoreei!RuntimeDesc::ShutdownAllActiveRuntimes+0x24e (75abd0e2)
  77. 02b7da21 e969ffffff jmp 02b7d98f
  78. 02b7da26 8b45d4 mov eax,dword ptr [ebp-2Ch]
  79. 02b7da29 3b5804 cmp ebx,dword ptr [eax+4]
  80. 02b7da2c 0f838e000000 jae 02b7dac0
  81. 02b7da32 8d741808 lea esi,[eax+ebx+8]
  82. 02b7da36 b990273c5f mov ecx,5F3C2790h
  83. 02b7da3b ba28c02301 mov edx,123C028h (MD: UNKNOWN)
  84. 02b7da40 e8b3e6ffff call 02b7c0f8 (UNKNOWN, mdToken: 06000008)
  85. 02b7da45 8bf8 mov edi,eax
  86. 02b7da47 0fb636 movzx esi,byte ptr [esi]
  87. 02b7da4a e8e1b94070 call mscorlib_ni+0x3f9430 (72f89430) (System.Globalization.NumberFormatInfo.get_CurrentInfo(), mdToken: 06003105)
  88. 02b7da4f 50 push eax
  89. 02b7da50 8bd7 mov edx,edi
  90. 02b7da52 8bce mov ecx,esi
  91. 02b7da54 e8374b0372 call clr!COMNumber::FormatInt32 (74bb2590)
  92. 02b7da59 8b4dd0 mov ecx,dword ptr [ebp-30h]
  93. 02b7da5c 8bd0 mov edx,eax
  94. 02b7da5e 3909 cmp dword ptr [ecx],ecx
  95. 02b7da60 e8fbcd3d70 call mscorlib_ni+0x3ca860 (72f5a860) (System.Text.StringBuilder.Append(System.String), mdToken: 060065d4)
  96. 02b7da65 b8f5f79b41 mov eax,419BF7F5h
  97. 02b7da6a e920ffffff jmp 02b7d98f
  98. 02b7da6f 83c301 add ebx,1
  99. 02b7da72 69c64c6e559e imul eax,esi,9E556E4Ch
  100. 02b7da78 35e29a511a xor eax,1A519AE2h
  101. 02b7da7d e90dffffff jmp 02b7d98f
  102. 02b7da82 8b45d4 mov eax,dword ptr [ebp-2Ch]
  103. 02b7da85 395804 cmp dword ptr [eax+4],ebx
  104. 02b7da88 7f07 jg 02b7da91
  105. 02b7da8a b8e1e7f729 mov eax,29F7E7E1h
  106. 02b7da8f eb05 jmp 02b7da96
  107. 02b7da91 b8b5247941 mov eax,417924B5h
  108. 02b7da96 e9f4feffff jmp 02b7d98f
  109. 02b7da9b 69c688d04c9c imul eax,esi,9C4CD088h
  110. 02b7daa1 35c263c943 xor eax,43C963C2h
  111. 02b7daa6 e9e4feffff jmp 02b7d98f
  112. 02b7daab c745e400000000 mov dword ptr [ebp-1Ch],0
  113. 02b7dab2 c745e8fc000000 mov dword ptr [ebp-18h],0FCh
  114. 02b7dab9 6812dbb702 push 2B7DB12h
  115. 02b7dabe eb05 jmp 02b7dac5
  116. 02b7dac0 e8eb163c72 call clr!JIT_RngChkFail (74f3f1b0)
  117. 02b7dac5 837ddc00 cmp dword ptr [ebp-24h],0
  118. 02b7dac9 7439 je 02b7db04
  119. 02b7dacb b84f543608 mov eax,836544Fh
  120. 02b7dad0 354972f945 xor eax,45F97249h
  121. 02b7dad5 8bf0 mov esi,eax
  122. 02b7dad7 8bc6 mov eax,esi
  123. 02b7dad9 b903000000 mov ecx,3
  124. 02b7dade 33d2 xor edx,edx
  125. 02b7dae0 f7f1 div eax,ecx
  126. 02b7dae2 83fa03 cmp edx,3
  127. 02b7dae5 731d jae 02b7db04
  128. 02b7dae7 ff249544dbb702 jmp dword ptr [edx*4+2B7DB44h]
  129. 02b7daee 8b4ddc mov ecx,dword ptr [ebp-24h]
  130. 02b7daf1 ff151c002401 call dword ptr ds:[124001Ch]
  131. 02b7daf7 69c6b08e175e imul eax,esi,5E178EB0h
  132. 02b7dafd 35144fd768 xor eax,68D74F14h
  133. 02b7db02 ebcc jmp 02b7dad0
  134. 02b7db04 58 pop eax
  135. 02b7db05 ffe0 jmp eax
  136. 02b7db07 8b45cc mov eax,dword ptr [ebp-34h]
  137. 02b7db0a 8d65f4 lea esp,[ebp-0Ch]
  138. 02b7db0d 5b pop ebx
  139. 02b7db0e 5e pop esi
  140. 02b7db0f 5f pop edi
  141. 02b7db10 5d pop ebp
  142. 02b7db11 c3 ret
  143. 02b7db12 c745e800000000 mov dword ptr [ebp-18h],0
  144. 02b7db19 ebec jmp 02b7db07
  145.  
  146.  
  147. ; -----------------------------------------------------
  148. ; Token: 0x06000040
  149. ; Description: Actual verification
  150. ; -----------------------------------------------------
  151.  
  152. 02b7d5d8 55 push ebp
  153. 02b7d5d9 8bec mov ebp,esp
  154. 02b7d5db 57 push edi
  155. 02b7d5dc 56 push esi
  156. 02b7d5dd 53 push ebx
  157. 02b7d5de 8bf1 mov esi,ecx
  158. 02b7d5e0 8bda mov ebx,edx
  159. 02b7d5e2 b9677d10f5 mov ecx,0F5107D67h
  160. 02b7d5e7 bab4a62301 mov edx,123A6B4h (MD: UNKNOWN)
  161. 02b7d5ec e827c4ffff call 02b79a18 (UNKNOWN, mdToken: 06000009)
  162. 02b7d5f1 8bc8 mov ecx,eax
  163. 02b7d5f3 8b01 mov eax,dword ptr [ecx]
  164. 02b7d5f5 8b4028 mov eax,dword ptr [eax+28h]
  165. 02b7d5f8 ff10 call dword ptr [eax]
  166. 02b7d5fa 8bf8 mov edi,eax
  167. 02b7d5fc 8bcb mov ecx,ebx
  168. 02b7d5fe 8b01 mov eax,dword ptr [ecx]
  169. 02b7d600 8b4028 mov eax,dword ptr [eax+28h]
  170. 02b7d603 ff10 call dword ptr [eax]
  171. 02b7d605 8bcf mov ecx,edi
  172. 02b7d607 8bd0 mov edx,eax
  173. 02b7d609 e802853d70 call mscorlib_ni+0x3c5b10 (72f55b10) (System.String.Concat(System.String, System.String), mdToken: 06000556) ; basically "Hello World. New Year 2022 - " + usernameTextBox.ToString()
  174. 02b7d60e 8bc8 mov ecx,eax
  175. 02b7d610 ff1550992301 call dword ptr ds:[1239950h] (UNKNOWN, mdToken: 0600003f) ; md5
  176. 02b7d616 8bc8 mov ecx,eax
  177. 02b7d618 8b01 mov eax,dword ptr [ecx]
  178. 02b7d61a 8b4028 mov eax,dword ptr [eax+28h]
  179. 02b7d61d ff10 call dword ptr [eax]
  180. 02b7d61f 8bf8 mov edi,eax
  181. 02b7d621 8b8e60010000 mov ecx,dword ptr [esi+160h]
  182. 02b7d627 8b01 mov eax,dword ptr [ecx]
  183. 02b7d629 8b404c mov eax,dword ptr [eax+4Ch]
  184. 02b7d62c ff501c call dword ptr [eax+1Ch]
  185. 02b7d62f 8bcf mov ecx,edi
  186. 02b7d631 8bd0 mov edx,eax
  187. 02b7d633 e8888e3d70 call mscorlib_ni+0x3c64c0 (72f564c0) (System.String.Equals(System.String, System.String), mdToken: 060004c3) ; compare with user.
  188. 02b7d638 25ff000000 and eax,0FFh
  189. 02b7d63d 0f84b5020000 je 02b7d8f8 ; end
  190.  
  191. 02b7d643 b874446374 mov eax,74634474h
  192.  
  193. 02b7d648 3583d0554c xor eax,4C55D083h
  194. 02b7d64d 8bf8 mov edi,eax
  195. 02b7d64f 8bc7 mov eax,edi
  196. 02b7d651 b90e000000 mov ecx,0Eh
  197. 02b7d656 33d2 xor edx,edx
  198. 02b7d658 f7f1 div eax,ecx
  199. 02b7d65a 83fa0e cmp edx,0Eh
  200. 02b7d65d 0f8395020000 jae 02b7d8f8 ;end
  201.  
  202. 02b7d663 ff249508d9b702 jmp dword ptr [edx*4+2B7D908h]
  203.  
  204. 02b7d66a 8b8e60010000 mov ecx,dword ptr [esi+160h]
  205. 02b7d670 8b01 mov eax,dword ptr [ecx]
  206. 02b7d672 8b404c mov eax,dword ptr [eax+4Ch]
  207. 02b7d675 ff501c call dword ptr [eax+1Ch]
  208. 02b7d678 8bc8 mov ecx,eax
  209. 02b7d67a 6a04 push 4
  210. 02b7d67c ba14000000 mov edx,14h
  211. 02b7d681 3909 cmp dword ptr [ecx],ecx
  212. 02b7d683 e838823d70 call mscorlib_ni+0x3c58c0 (72f558c0) (System.String.Substring(Int32, Int32), mdToken: 060004df) ; parse key at position 20, length 4 as a hex value, then check if even.
  213. 02b7d688 8bf8 mov edi,eax
  214. 02b7d68a b903020000 mov ecx,203h
  215. 02b7d68f e8cc4e4070 call mscorlib_ni+0x3f2560 (72f82560) (System.Globalization.NumberFormatInfo.ValidateParseStyleInteger(System.Globalization.NumberStyles), mdToken: 06003130)
  216. 02b7d694 e897bd4070 call mscorlib_ni+0x3f9430 (72f89430) (System.Globalization.NumberFormatInfo.get_CurrentInfo(), mdToken: 06003105)
  217. 02b7d699 50 push eax
  218. 02b7d69a 8bcf mov ecx,edi
  219. 02b7d69c ba03020000 mov edx,203h
  220. 02b7d6a1 e8fa834070 call mscorlib_ni+0x3f5aa0 (72f85aa0) (System.Number.ParseInt32(System.String, System.Globalization.NumberStyles, System.Globalization.NumberFormatInfo), mdToken: 060010a2)
  221. 02b7d6a6 2501000080 and eax,80000001h
  222. 02b7d6ab 7905 jns 02b7d6b2
  223. 02b7d6ad 48 dec eax
  224. 02b7d6ae 83c8fe or eax,0FFFFFFFEh
  225. 02b7d6b1 40 inc eax
  226. 02b7d6b2 83f801 cmp eax,1
  227. 02b7d6b5 7407 je 02b7d6be
  228. 02b7d6b7 b8d4b2f606 mov eax,6F6B2D4h
  229. 02b7d6bc eb05 jmp 02b7d6c3
  230.  
  231. 02b7d6be b8acaa707d mov eax,7D70AAACh
  232.  
  233. 02b7d6c3 eb83 jmp 02b7d648 ; loop
  234.  
  235. 02b7d6c5 8b8e4c010000 mov ecx,dword ptr [esi+14Ch]
  236. 02b7d6cb 3909 cmp dword ptr [ecx],ecx
  237. 02b7d6cd e87afbffff call 02b7d24c (System.Windows.Forms.CheckBox.get_Checked(), mdToken: 06000999)
  238. 02b7d6d2 85c0 test eax,eax
  239. 02b7d6d4 7507 jne 02b7d6dd
  240.  
  241. 02b7d6d6 ba24b1b425 mov edx,25B4B124h
  242. 02b7d6db eb05 jmp 02b7d6e2
  243.  
  244. 02b7d6dd bab8da584e mov edx,4E58DAB8h
  245.  
  246. 02b7d6e2 69c7106f1032 imul eax,edi,32106F10h
  247. 02b7d6e8 33c2 xor eax,edx
  248. 02b7d6ea e959ffffff jmp 02b7d648 ; loop
  249.  
  250. 02b7d6ef 8bbe48010000 mov edi,dword ptr [esi+148h]
  251. 02b7d6f5 b99f099e1a mov ecx,1A9E099Fh
  252. 02b7d6fa baacbf2301 mov edx,123BFACh (MD: UNKNOWN)
  253. 02b7d6ff e884e5ffff call 02b7bc88 (UNKNOWN, mdToken: 06000006)
  254. 02b7d704 8bcf mov ecx,edi
  255. 02b7d706 8bd0 mov edx,eax
  256. 02b7d708 8b01 mov eax,dword ptr [ecx]
  257. 02b7d70a 8b4050 mov eax,dword ptr [eax+50h]
  258. 02b7d70d ff10 call dword ptr [eax]
  259. 02b7d70f b84955da6e mov eax,6EDA5549h
  260. 02b7d714 e92fffffff jmp 02b7d648 ; loop
  261.  
  262. 02b7d719 8b8e60010000 mov ecx,dword ptr [esi+160h]
  263. 02b7d71f 8b01 mov eax,dword ptr [ecx]
  264. 02b7d721 8b404c mov eax,dword ptr [eax+4Ch]
  265. 02b7d724 ff501c call dword ptr [eax+1Ch]
  266. 02b7d727 8bc8 mov ecx,eax
  267. 02b7d729 6a04 push 4
  268. 02b7d72b ba14000000 mov edx,14h
  269. 02b7d730 3909 cmp dword ptr [ecx],ecx
  270. 02b7d732 e889813d70 call mscorlib_ni+0x3c58c0 (72f558c0) (System.String.Substring(Int32, Int32), mdToken: 060004df)
  271. 02b7d737 8bf8 mov edi,eax
  272. 02b7d739 b903020000 mov ecx,203h
  273. 02b7d73e e81d4e4070 call mscorlib_ni+0x3f2560 (72f82560) (System.Globalization.NumberFormatInfo.ValidateParseStyleInteger(System.Globalization.NumberStyles), mdToken: 06003130)
  274. 02b7d743 e8e8bc4070 call mscorlib_ni+0x3f9430 (72f89430) (System.Globalization.NumberFormatInfo.get_CurrentInfo(), mdToken: 06003105)
  275. 02b7d748 50 push eax
  276. 02b7d749 8bcf mov ecx,edi
  277. 02b7d74b ba03020000 mov edx,203h
  278. 02b7d750 e84b834070 call mscorlib_ni+0x3f5aa0 (72f85aa0) (System.Number.ParseInt32(System.String, System.Globalization.NumberStyles, System.Globalization.NumberFormatInfo), mdToken: 060010a2)
  279. 02b7d755 2501000080 and eax,80000001h
  280. 02b7d75a 7905 jns 02b7d761
  281.  
  282. 02b7d75c 48 dec eax
  283. 02b7d75d 83c8fe or eax,0FFFFFFFEh
  284. 02b7d760 40 inc eax
  285. 02b7d761 83f801 cmp eax,1
  286. 02b7d764 7507 jne 02b7d76d
  287.  
  288. 02b7d766 b899ef6839 mov eax,3968EF99h
  289. 02b7d76b eb05 jmp 02b7d772
  290.  
  291. 02b7d76d b82913eb7f mov eax,7FEB1329h
  292. 02b7d772 e9d1feffff jmp 02b7d648 ; loop
  293.  
  294. 02b7d777 8b8e48010000 mov ecx,dword ptr [esi+148h]
  295. 02b7d77d 33d2 xor edx,edx
  296. 02b7d77f 3909 cmp dword ptr [ecx],ecx
  297. 02b7d781 e8d6faffff call 02b7d25c (System.Windows.Forms.Control.set_Enabled(Boolean), mdToken: 06000c96)
  298. 02b7d786 8bbe48010000 mov edi,dword ptr [esi+148h]
  299. 02b7d78c b906ea65ca mov ecx,0CA65EA06h
  300. 02b7d791 ba38a62301 mov edx,123A638h (MD: UNKNOWN)
  301. 02b7d796 e845beffff call 02b795e0 (UNKNOWN, mdToken: 06000005)
  302. 02b7d79b 8bcf mov ecx,edi
  303. 02b7d79d 8bd0 mov edx,eax
  304. 02b7d79f 8b01 mov eax,dword ptr [ecx]
  305. 02b7d7a1 8b4050 mov eax,dword ptr [eax+50h]
  306. 02b7d7a4 ff10 call dword ptr [eax]
  307. 02b7d7a6 b876730875 mov eax,offset clr!CAssemblyCache::InstallAssembly+0x148 (75087376)
  308. 02b7d7ab e998feffff jmp 02b7d648 ; loop
  309.  
  310. 02b7d7b0 8bbe48010000 mov edi,dword ptr [esi+148h]
  311. 02b7d7b6 b972ddaa77 mov ecx,offset sechost!GetEmbeddedContainerIsolationPolicy+0x8eb2 (77aadd72)
  312. 02b7d7bb ba30a72301 mov edx,123A730h (MD: UNKNOWN)
  313. 02b7d7c0 e8a3c6ffff call 02b79e68 (UNKNOWN, mdToken: 06000007)
  314. 02b7d7c5 8bcf mov ecx,edi
  315. 02b7d7c7 8bd0 mov edx,eax
  316. 02b7d7c9 8b01 mov eax,dword ptr [ecx]
  317. 02b7d7cb 8b4050 mov eax,dword ptr [eax+50h]
  318. 02b7d7ce ff10 call dword ptr [eax]
  319. 02b7d7d0 b876730875 mov eax,offset clr!CAssemblyCache::InstallAssembly+0x148 (75087376)
  320. 02b7d7d5 e96efeffff jmp 02b7d648 ; loop
  321.  
  322. 02b7d7da 8b8e60010000 mov ecx,dword ptr [esi+160h]
  323. 02b7d7e0 8b01 mov eax,dword ptr [ecx]
  324. 02b7d7e2 8b404c mov eax,dword ptr [eax+4Ch]
  325. 02b7d7e5 ff501c call dword ptr [eax+1Ch]
  326. 02b7d7e8 8bc8 mov ecx,eax
  327. 02b7d7ea 6a04 push 4
  328. 02b7d7ec ba14000000 mov edx,14h
  329. 02b7d7f1 3909 cmp dword ptr [ecx],ecx
  330. 02b7d7f3 e8c8803d70 call mscorlib_ni+0x3c58c0 (72f558c0) (System.String.Substring(Int32, Int32), mdToken: 060004df)
  331. 02b7d7f8 8bd8 mov ebx,eax
  332. 02b7d7fa b903020000 mov ecx,203h
  333. 02b7d7ff e85c4d4070 call mscorlib_ni+0x3f2560 (72f82560) (System.Globalization.NumberFormatInfo.ValidateParseStyleInteger(System.Globalization.NumberStyles), mdToken: 06003130)
  334. 02b7d804 e827bc4070 call mscorlib_ni+0x3f9430 (72f89430) (System.Globalization.NumberFormatInfo.get_CurrentInfo(), mdToken: 06003105)
  335. 02b7d809 50 push eax
  336. 02b7d80a 8bcb mov ecx,ebx
  337. 02b7d80c ba03020000 mov edx,203h
  338. 02b7d811 e88a824070 call mscorlib_ni+0x3f5aa0 (72f85aa0) (System.Number.ParseInt32(System.String, System.Globalization.NumberStyles, System.Globalization.NumberFormatInfo), mdToken: 060010a2)
  339. 02b7d816 2501000080 and eax,80000001h
  340. 02b7d81b 7905 jns 02b7d822
  341.  
  342. 02b7d81d 48 dec eax
  343. 02b7d81e 83c8fe or eax,0FFFFFFFEh
  344. 02b7d821 40 inc eax
  345. 02b7d822 83f801 cmp eax,1
  346. 02b7d825 7407 je 02b7d82e
  347.  
  348. 02b7d827 bacc17e0fa mov edx,0FAE017CCh
  349. 02b7d82c eb05 jmp 02b7d833
  350.  
  351. 02b7d82e baf902ab93 mov edx,93AB02F9h
  352.  
  353. 02b7d833 69c7fd0145d2 imul eax,edi,0D24501FDh
  354. 02b7d839 33c2 xor eax,edx
  355. 02b7d83b e908feffff jmp 02b7d648 ; loop
  356.  
  357. 02b7d840 8b8e4c010000 mov ecx,dword ptr [esi+14Ch]
  358. 02b7d846 3909 cmp dword ptr [ecx],ecx
  359. 02b7d848 e8fff9ffff call 02b7d24c (System.Windows.Forms.CheckBox.get_Checked(), mdToken: 06000999)
  360. 02b7d84d 85c0 test eax,eax
  361. 02b7d84f 7507 jne 02b7d858
  362.  
  363. 02b7d851 ba1e78bc78 mov edx,78BC781Eh
  364. 02b7d856 eb05 jmp 02b7d85d
  365.  
  366. 02b7d858 ba3000aa60 mov edx,60AA0030h
  367. 02b7d85d 69c7bbaa82bf imul eax,edi,0BF82AABBh
  368. 02b7d863 33c2 xor eax,edx
  369. 02b7d865 e9defdffff jmp 02b7d648 ; loop
  370.  
  371. 02b7d86a 8b8e50010000 mov ecx,dword ptr [esi+150h]
  372. 02b7d870 3909 cmp dword ptr [ecx],ecx
  373. 02b7d872 e8d5f9ffff call 02b7d24c (System.Windows.Forms.CheckBox.get_Checked(), mdToken: 06000999)
  374. 02b7d877 85c0 test eax,eax
  375. 02b7d879 7507 jne 02b7d882
  376.  
  377. 02b7d87b ba41003aea mov edx,0EA3A0041h
  378. 02b7d880 eb05 jmp 02b7d887
  379.  
  380. 02b7d882 ba3bab9fe3 mov edx,0E39FAB3Bh
  381. 02b7d887 69c784998fb4 imul eax,edi,0B48F9984h
  382. 02b7d88d 33c2 xor eax,edx
  383.  
  384. 02b7d88f e9b4fdffff jmp 02b7d648; loop
  385.  
  386. 02b7d894 8bbe48010000 mov edi,dword ptr [esi+148h]
  387. 02b7d89a b98cd950b6 mov ecx,0B650D98Ch
  388. 02b7d89f ba38a62301 mov edx,123A638h (MD: UNKNOWN)
  389. 02b7d8a4 e837bdffff call 02b795e0 (UNKNOWN, mdToken: 06000005)
  390. 02b7d8a9 8bcf mov ecx,edi
  391. 02b7d8ab 8bd0 mov edx,eax
  392. 02b7d8ad 8b01 mov eax,dword ptr [ecx]
  393. 02b7d8af 8b4050 mov eax,dword ptr [eax+50h]
  394. 02b7d8b2 ff10 call dword ptr [eax]
  395. 02b7d8b4 b876730875 mov eax,offset clr!CAssemblyCache::InstallAssembly+0x148 (75087376)
  396. 02b7d8b9 e98afdffff jmp 02b7d648 ; loop
  397.  
  398. 02b7d8be 69c7d125e8c2 imul eax,edi,0C2E825D1h
  399. 02b7d8c4 359c189a3d xor eax,3D9A189Ch
  400. 02b7d8c9 e97afdffff jmp 02b7d648 ; loop
  401.  
  402. 02b7d8ce 8b8e50010000 mov ecx,dword ptr [esi+150h]
  403. 02b7d8d4 3909 cmp dword ptr [ecx],ecx
  404. 02b7d8d6 e871f9ffff call 02b7d24c (System.Windows.Forms.CheckBox.get_Checked(), mdToken: 06000999)
  405. 02b7d8db 85c0 test eax,eax
  406. 02b7d8dd 7407 je 02b7d8e6
  407.  
  408. 02b7d8df ba03a09840 mov edx,4098A003h
  409. 02b7d8e4 eb05 jmp 02b7d8eb
  410.  
  411. 02b7d8e6 ba1cbc2d64 mov edx,642DBC1Ch
  412. 02b7d8eb 69c7ab6547fe imul eax,edi,0FE4765ABh
  413. 02b7d8f1 33c2 xor eax,edx
  414. 02b7d8f3 e950fdffff jmp 02b7d648 ; loop
  415.  
  416. 02b7d8f8 b801000000 mov eax,1
  417. 02b7d8fd 5b pop ebx
  418. 02b7d8fe 5e pop esi
  419. 02b7d8ff 5f pop edi
  420. 02b7d900 5d pop ebp
  421. 02b7d901 c3 ret
  422.  
  423.  
  424.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!