Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 000000039556424
- .text:0000000039556424 EncryptPacket proc near ; CODE XREF: sub_39558EDC+4j
- .text:0000000039556424 ; DATA XREF: .rdata:stru_395943F8o ...
- .text:0000000039556424
- .text:0000000039556424 var_20040 = qword ptr -20040h
- .text:0000000039556424 var_20038 = qword ptr -20038h
- .text:0000000039556424 var_20030 = qword ptr -20030h
- .text:0000000039556424 var_20028 = qword ptr -20028h
- .text:0000000039556424 var_20020 = qword ptr -20020h
- .text:0000000039556424 var_20018 = qword ptr -20018h
- .text:0000000039556424 var_20008 = qword ptr -20008h
- .text:0000000039556424 var_20000 = byte ptr -20000h
- .text:0000000039556424 var_1FFFF = byte ptr -1FFFFh
- .text:0000000039556424 var_10032 = byte ptr -10032h
- .text:0000000039556424 var_10030 = byte ptr -10030h
- .text:0000000039556424 Dst = byte ptr -1002Fh
- .text:0000000039556424 var_s10 = word ptr 10h
- .text:0000000039556424 var_s28 = qword ptr 28h
- .text:0000000039556424 arg_8 = qword ptr 48h
- .text:0000000039556424 arg_18 = qword ptr 58h
- .text:0000000039556424
- .text:0000000039556424 4C 89 4C 24 20 mov [rsp-38h+arg_18], r9
- .text:0000000039556429 55 push rbp
- .text:000000003955642A 56 push rsi
- .text:000000003955642B 57 push rdi
- .text:000000003955642C 41 54 push r12
- .text:000000003955642E 41 55 push r13
- .text:0000000039556430 41 56 push r14
- .text:0000000039556432 41 57 push r15
- .text:0000000039556434 48 8D AC 24 A0 00 FE FF lea rbp, [rsp-1FF60h]
- .text:000000003955643C B8 60 00 02 00 mov eax, 20060h
- .text:0000000039556441 E8 FA 45 01 00 call __alloca_probe
- .text:0000000039556446 48 2B E0 sub rsp, rax
- .text:0000000039556449 48 C7 44 24 58 FE FF FF FF mov [rsp+20060h+var_20008], 0FFFFFFFFFFFFFFFEh
- .text:0000000039556452 48 89 9C 24 A8 00 02 00 mov [rsp+20060h+arg_8], rbx
- .text:000000003955645A 49 8B F9 mov rdi, r9
- .text:000000003955645D 49 8B D8 mov rbx, r8
- .text:0000000039556460 40 8A F2 mov sil, dl
- .text:0000000039556463 4C 8B E9 mov r13, rcx
- .text:0000000039556466 48 8B 81 F0 01 00 00 mov rax, [rcx+1F0h]
- .text:000000003955646D 48 39 81 E8 01 00 00 cmp [rcx+1E8h], rax
- .text:0000000039556474 0F 84 F0 04 00 00 jz loc_3955696A
- .text:000000003955647A 48 8B 81 30 02 00 00 mov rax, [rcx+230h]
- .text:0000000039556481 48 39 81 28 02 00 00 cmp [rcx+228h], rax
- .text:0000000039556488 0F 85 DC 04 00 00 jnz loc_3955696A
- .text:000000003955648E 80 FA 01 cmp dl, 1
- .text:0000000039556491 0F 85 D3 04 00 00 jnz loc_3955696A
- .text:0000000039556497 48 8D 44 24 60 lea rax, [rsp+20060h+var_20000]
- .text:000000003955649C 48 89 44 24 38 mov [rsp+20060h+var_20028], rax
- .text:00000000395564A1 48 8D 44 24 60 lea rax, [rsp+20060h+var_20000]
- .text:00000000395564A6 48 89 44 24 40 mov [rsp+20060h+var_20020], rax
- .text:00000000395564AB 48 8D 85 5E FF 00 00 lea rax, [rbp+1FF90h+var_10032]
- .text:00000000395564B2 48 89 44 24 48 mov [rsp+20060h+var_20018], rax
- .text:00000000395564B7 48 8D 05 C2 46 02 00 lea rax, off_3957AB80
- .text:00000000395564BE 48 89 44 24 30 mov [rsp+20060h+var_20030], rax
- .text:00000000395564C3
- .text:00000000395564C3 loc_395564C3: ; DATA XREF: .rdata:stru_395943F8o
- .text:00000000395564C3 4C 8D 81 7C 02 00 00 lea r8, [rcx+27Ch]
- .text:00000000395564CA 45 33 C9 xor r9d, r9d
- .text:00000000395564CD 48 8D 15 A8 B5 02 00 lea rdx, aSeq ; "seq"
- .text:00000000395564D4 48 8D 4C 24 30 lea rcx, [rsp+20060h+var_20030]
- .text:00000000395564D9 FF 15 31 47 02 00 call cs:off_3957AC10
- .text:00000000395564DF 45 33 C9 xor r9d, r9d
- .text:00000000395564E2 4C 8D 05 1C CA 04 00 lea r8, unk_395A2F05
- .text:00000000395564E9 48 8D 15 68 BF 02 00 lea rdx, aHeader ; "header"
- .text:00000000395564F0 48 8D 4C 24 30 lea rcx, [rsp+20060h+var_20030]
- .text:00000000395564F5 48 8B 44 24 30 mov rax, [rsp+20060h+var_20030]
- .text:00000000395564FA FF 90 90 00 00 00 call qword ptr [rax+90h]
- .text:0000000039556500 48 8D 4C 24 30 lea rcx, [rsp+20060h+var_20030]
- .text:0000000039556505 48 8B 44 24 30 mov rax, [rsp+20060h+var_20030]
- .text:000000003955650A FF 50 58 call qword ptr [rax+58h]
- .text:000000003955650D 45 33 E4 xor r12d, r12d
- .text:0000000039556510 84 C0 test al, al
- .text:0000000039556512 74 0C jz short loc_39556520
- .text:0000000039556514 44 8B 7C 24 40 mov r15d, dword ptr [rsp+20060h+var_20020]
- .text:0000000039556519 44 2B 7C 24 38 sub r15d, dword ptr [rsp+20060h+var_20028]
- .text:000000003955651E EB 03 jmp short loc_39556523
- .text:0000000039556520 ; ---------------------------------------------------------------------------
- .text:0000000039556520
- .text:0000000039556520 loc_39556520: ; CODE XREF: EncryptPacket+EEj
- .text:0000000039556520 45 8B FC mov r15d, r12d
- .text:0000000039556523
- .text:0000000039556523 loc_39556523: ; CODE XREF: EncryptPacket+FAj
- .text:0000000039556523 48 8B 03 mov rax, [rbx]
- .text:0000000039556526 48 8D 54 24 30 lea rdx, [rsp+20060h+var_20030]
- .text:000000003955652B 48 8B CB mov rcx, rbx
- .text:000000003955652E FF 50 08 call qword ptr [rax+8]
- .text:0000000039556531 4C 8B 1B mov r11, [rbx]
- .text:0000000039556534 48 8D 54 24 30 lea rdx, [rsp+20060h+var_20030]
- .text:0000000039556539 48 8B CB mov rcx, rbx
- .text:000000003955653C 41 FF 53 10 call qword ptr [r11+10h]
- .text:0000000039556540 48 8D 4C 24 30 lea rcx, [rsp+20060h+var_20030]
- .text:0000000039556545 48 8B 44 24 30 mov rax, [rsp+20060h+var_20030]
- .text:000000003955654A FF 50 58 call qword ptr [rax+58h]
- .text:000000003955654D 84 C0 test al, al
- .text:000000003955654F 75 07 jnz short loc_39556558
- .text:0000000039556551
- .text:0000000039556551 loc_39556551: ; CODE XREF: EncryptPacket:loc_39556A23j
- .text:0000000039556551 ; DATA XREF: .rdata:stru_395943F8o
- .text:0000000039556551 32 C0 xor al, al
- .text:0000000039556553 E9 7B 05 00 00 jmp loc_39556AD3
- .text:0000000039556558 ; ---------------------------------------------------------------------------
- .text:0000000039556558
- .text:0000000039556558 loc_39556558: ; CODE XREF: EncryptPacket+12Bj
- .text:0000000039556558 ; DATA XREF: .rdata:stru_395943F8o
- .text:0000000039556558 48 8D 4C 24 30 lea rcx, [rsp+20060h+var_20030]
- .text:000000003955655D 48 8B 44 24 30 mov rax, [rsp+20060h+var_20030]
- .text:0000000039556562 FF 50 58 call qword ptr [rax+58h]
- .text:0000000039556565 84 C0 test al, al
- .text:0000000039556567 74 0C jz short loc_39556575
- .text:0000000039556569 4C 8B 74 24 40 mov r14, [rsp+20060h+var_20020]
- .text:000000003955656E 4C 2B 74 24 38 sub r14, [rsp+20060h+var_20028]
- .text:0000000039556573 EB 03 jmp short loc_39556578
- .text:0000000039556575 ; ---------------------------------------------------------------------------
- .text:0000000039556575
- .text:0000000039556575 loc_39556575: ; CODE XREF: EncryptPacket+143j
- .text:0000000039556575 4D 8B F4 mov r14, r12
- .text:0000000039556578
- .text:0000000039556578 loc_39556578: ; CODE XREF: EncryptPacket+14Fj
- .text:0000000039556578 45 2B F7 sub r14d, r15d
- .text:000000003955657B 41 8B 85 B0 00 00 00 mov eax, [r13+0B0h]
- .text:0000000039556582 05 45 A2 2F 00 add eax, 2FA245h
- .text:0000000039556587 41 89 85 B0 00 00 00 mov [r13+0B0h], eax
- .text:000000003955658E C1 E8 0E shr eax, 0Eh
- .text:0000000039556591 24 73 and al, 73h
- .text:0000000039556593 0F B6 F0 movzx esi, al
- .text:0000000039556596 B8 FE 00 00 00 mov eax, 0FEh
- .text:000000003955659B 0F 44 F0 cmovz esi, eax
- .text:000000003955659E 49 8B 45 08 mov rax, [r13+8]
- .text:00000000395565A2 49 8D 4D 08 lea rcx, [r13+8]
- .text:00000000395565A6 FF 50 28 call qword ptr [rax+28h]
- .text:00000000395565A9 8B F8 mov edi, eax
- .text:00000000395565AB 49 8B 55 08 mov rdx, [r13+8]
- .text:00000000395565AF 49 8D 4D 08 lea rcx, [r13+8]
- .text:00000000395565B3 FF 52 28 call qword ptr [rdx+28h]
- .text:00000000395565B6 0F AF F8 imul edi, eax
- .text:00000000395565B9 41 0F AF FE imul edi, r14d
- .text:00000000395565BD 40 0F B6 CE movzx ecx, sil
- .text:00000000395565C1 81 C1 04 24 A0 75 add ecx, 75A02404h
- .text:00000000395565C7 33 F9 xor edi, ecx
- .text:00000000395565C9 81 F7 4B C5 2D E7 xor edi, 0E72DC54Bh
- .text:00000000395565CF 41 89 BD AC 00 00 00 mov [r13+0ACh], edi
- .text:00000000395565D6 45 8A 8D 7D 02 00 00 mov r9b, [r13+27Dh]
- .text:00000000395565DD 45 84 C9 test r9b, r9b
- .text:00000000395565E0 75 0A jnz short loc_395565EC
- .text:00000000395565E2 BF 09 00 00 00 mov edi, 9
- .text:00000000395565E7 E9 AB 00 00 00 jmp loc_39556697
- .text:00000000395565EC ; ---------------------------------------------------------------------------
- .text:00000000395565EC
- .text:00000000395565EC loc_395565EC: ; CODE XREF: EncryptPacket+1BCj
- .text:00000000395565EC 45 0F B6 C1 movzx r8d, r9b
- .text:00000000395565F0 B8 56 55 55 55 mov eax, 55555556h
- .text:00000000395565F5 41 F7 E8 imul r8d
- .text:00000000395565F8 8B C2 mov eax, edx
- .text:00000000395565FA C1 E8 1F shr eax, 1Fh
- .text:00000000395565FD 03 D0 add edx, eax
- .text:00000000395565FF 8D 0C 52 lea ecx, [rdx+rdx*2]
- .text:0000000039556602 44 3B C1 cmp r8d, ecx
- .text:0000000039556605 75 0A jnz short loc_39556611
- .text:0000000039556607 BF 05 00 00 00 mov edi, 5
- .text:000000003955660C E9 86 00 00 00 jmp loc_39556697
- .text:0000000039556611 ; ---------------------------------------------------------------------------
- .text:0000000039556611
- .text:0000000039556611 loc_39556611: ; CODE XREF: EncryptPacket+1E1j
- .text:0000000039556611 B8 67 66 66 66 mov eax, 66666667h
- .text:0000000039556616 41 F7 E8 imul r8d
- .text:0000000039556619 D1 FA sar edx, 1
- .text:000000003955661B 8B C2 mov eax, edx
- .text:000000003955661D C1 E8 1F shr eax, 1Fh
- .text:0000000039556620 03 D0 add edx, eax
- .text:0000000039556622 8D 0C 92 lea ecx, [rdx+rdx*4]
- .text:0000000039556625 44 3B C1 cmp r8d, ecx
- .text:0000000039556628 75 07 jnz short loc_39556631
- .text:000000003955662A BF 02 00 00 00 mov edi, 2
- .text:000000003955662F EB 66 jmp short loc_39556697
- .text:0000000039556631 ; ---------------------------------------------------------------------------
- .text:0000000039556631
- .text:0000000039556631 loc_39556631: ; CODE XREF: EncryptPacket+204j
- .text:0000000039556631 B8 93 24 49 92 mov eax, 92492493h
- .text:0000000039556636 41 F7 E8 imul r8d
- .text:0000000039556639 41 03 D0 add edx, r8d
- .text:000000003955663C C1 FA 02 sar edx, 2
- .text:000000003955663F 8B C2 mov eax, edx
- .text:0000000039556641 C1 E8 1F shr eax, 1Fh
- .text:0000000039556644 03 D0 add edx, eax
- .text:0000000039556646 6B D2 07 imul edx, 7
- .text:0000000039556649 44 3B C2 cmp r8d, edx
- .text:000000003955664C 75 07 jnz short loc_39556655
- .text:000000003955664E BF 0B 00 00 00 mov edi, 0Bh
- .text:0000000039556653 EB 42 jmp short loc_39556697
- .text:0000000039556655 ; ---------------------------------------------------------------------------
- .text:0000000039556655
- .text:0000000039556655 loc_39556655: ; CODE XREF: EncryptPacket+228j
- .text:0000000039556655 B8 39 8E E3 38 mov eax, 38E38E39h
- .text:000000003955665A 41 F7 E8 imul r8d
- .text:000000003955665D D1 FA sar edx, 1
- .text:000000003955665F 8B C2 mov eax, edx
- .text:0000000039556661 C1 E8 1F shr eax, 1Fh
- .text:0000000039556664 03 D0 add edx, eax
- .text:0000000039556666 8D 0C D2 lea ecx, [rdx+rdx*8]
- .text:0000000039556669 44 3B C1 cmp r8d, ecx
- .text:000000003955666C 75 07 jnz short loc_39556675
- .text:000000003955666E BF 03 00 00 00 mov edi, 3
- .text:0000000039556673 EB 22 jmp short loc_39556697
- .text:0000000039556675 ; ---------------------------------------------------------------------------
- .text:0000000039556675
- .text:0000000039556675 loc_39556675: ; CODE XREF: EncryptPacket+248j
- .text:0000000039556675 B8 E9 A2 8B 2E mov eax, 2E8BA2E9h
- .text:000000003955667A 41 F7 E8 imul r8d
- .text:000000003955667D D1 FA sar edx, 1
- .text:000000003955667F 8B C2 mov eax, edx
- .text:0000000039556681 C1 E8 1F shr eax, 1Fh
- .text:0000000039556684 03 D0 add edx, eax
- .text:0000000039556686 6B D2 0B imul edx, 0Bh
- .text:0000000039556689 44 3B C2 cmp r8d, edx
- .text:000000003955668C BF 04 00 00 00 mov edi, 4
- .text:0000000039556691 8D 47 03 lea eax, [rdi+3]
- .text:0000000039556694 0F 44 F8 cmovz edi, eax
- .text:0000000039556697
- .text:0000000039556697 loc_39556697: ; CODE XREF: EncryptPacket+1C3j
- .text:0000000039556697 ; EncryptPacket+1E8j ...
- .text:0000000039556697 49 63 C7 movsxd rax, r15d
- .text:000000003955669A 48 8D 5C 04 60 lea rbx, [rsp+rax+20060h+var_20000]
- .text:000000003955669F 48 8D 73 01 lea rsi, [rbx+1]
- .text:00000000395566A3 44 88 0E mov [rsi], r9b
- .text:00000000395566A6 41 8B 85 B0 00 00 00 mov eax, [r13+0B0h]
- .text:00000000395566AD 05 45 A2 2F 00 add eax, 2FA245h
- .text:00000000395566B2 41 89 85 B0 00 00 00 mov [r13+0B0h], eax
- .text:00000000395566B9 C1 E8 0E shr eax, 0Eh
- .text:00000000395566BC 24 73 and al, 73h
- .text:00000000395566BE 0F B6 C0 movzx eax, al
- .text:00000000395566C1 B9 FE 00 00 00 mov ecx, 0FEh
- .text:00000000395566C6 0F 44 C1 cmovz eax, ecx
- .text:00000000395566C9 FE C0 inc al
- .text:00000000395566CB 41 00 85 7D 02 00 00 add [r13+27Dh], al
- .text:00000000395566D2 41 8D 56 FF lea edx, [r14-1]
- .text:00000000395566D6 48 8B CE mov rcx, rsi
- .text:00000000395566D9 E8 22 A0 FF FF call sub_39550700
- .text:00000000395566DE 88 03 mov [rbx], al
- .text:00000000395566E0 0F B7 03 movzx eax, word ptr [rbx]
- .text:00000000395566E3 44 0F B7 C8 movzx r9d, ax
- .text:00000000395566E7 66 41 C1 E9 08 shr r9w, 8
- .text:00000000395566EC 44 8A C0 mov r8b, al
- .text:00000000395566EF 41 C0 E8 05 shr r8b, 5
- .text:00000000395566F3 8A D0 mov dl, al
- .text:00000000395566F5 F6 D2 not dl
- .text:00000000395566F7 80 E2 01 and dl, 1
- .text:00000000395566FA 02 D2 add dl, dl
- .text:00000000395566FC 41 8A C9 mov cl, r9b
- .text:00000000395566FF 80 E1 01 and cl, 1
- .text:0000000039556702 0A D1 or dl, cl
- .text:0000000039556704 C0 E2 02 shl dl, 2
- .text:0000000039556707 41 8A C8 mov cl, r8b
- .text:000000003955670A F6 D1 not cl
- .text:000000003955670C 80 E1 01 and cl, 1
- .text:000000003955670F 0A D1 or dl, cl
- .text:0000000039556711 41 8A C9 mov cl, r9b
- .text:0000000039556714 80 E1 02 and cl, 2
- .text:0000000039556717 0A D1 or dl, cl
- .text:0000000039556719 02 D2 add dl, dl
- .text:000000003955671B 41 8A C9 mov cl, r9b
- .text:000000003955671E 80 E1 C0 and cl, 0C0h
- .text:0000000039556721 0A D1 or dl, cl
- .text:0000000039556723 02 D2 add dl, dl
- .text:0000000039556725 41 8A C9 mov cl, r9b
- .text:0000000039556728 D0 E9 shr cl, 1
- .text:000000003955672A F6 D1 not cl
- .text:000000003955672C 80 E1 40 and cl, 40h
- .text:000000003955672F 0A D1 or dl, cl
- .text:0000000039556731 8A C8 mov cl, al
- .text:0000000039556733 D0 E9 shr cl, 1
- .text:0000000039556735 F6 D1 not cl
- .text:0000000039556737 80 E1 01 and cl, 1
- .text:000000003955673A 0A D1 or dl, cl
- .text:000000003955673C 41 80 E0 02 and r8b, 2
- .text:0000000039556740 41 0A D0 or dl, r8b
- .text:0000000039556743 88 95 A1 FF 01 00 mov byte ptr [rbp+1FF90h+var_s10+1], dl
- .text:0000000039556749 41 8A D1 mov dl, r9b
- .text:000000003955674C C0 EA 03 shr dl, 3
- .text:000000003955674F F6 D2 not dl
- .text:0000000039556751 80 E2 01 and dl, 1
- .text:0000000039556754 8A C8 mov cl, al
- .text:0000000039556756 C0 E9 04 shr cl, 4
- .text:0000000039556759 F6 D1 not cl
- .text:000000003955675B C0 E1 03 shl cl, 3
- .text:000000003955675E 0A D1 or dl, cl
- .text:0000000039556760 C0 E2 02 shl dl, 2
- .text:0000000039556763 41 8A C9 mov cl, r9b
- .text:0000000039556766 C0 E9 05 shr cl, 5
- .text:0000000039556769 F6 D1 not cl
- .text:000000003955676B 80 E1 01 and cl, 1
- .text:000000003955676E 0A D1 or dl, cl
- .text:0000000039556770 02 D2 add dl, dl
- .text:0000000039556772 41 8A C9 mov cl, r9b
- .text:0000000039556775 80 E1 10 and cl, 10h
- .text:0000000039556778 0A D1 or dl, cl
- .text:000000003955677A 02 D2 add dl, dl
- .text:000000003955677C 41 D0 E9 shr r9b, 1
- .text:000000003955677F 41 80 E1 02 and r9b, 2
- .text:0000000039556783 8A C8 mov cl, al
- .text:0000000039556785 80 E1 04 and cl, 4
- .text:0000000039556788 44 0A C9 or r9b, cl
- .text:000000003955678B 41 D0 E9 shr r9b, 1
- .text:000000003955678E 41 0A D1 or dl, r9b
- .text:0000000039556791 8A C8 mov cl, al
- .text:0000000039556793 D0 E9 shr cl, 1
- .text:0000000039556795 F6 D1 not cl
- .text:0000000039556797 80 E1 40 and cl, 40h
- .text:000000003955679A 0A D1 or dl, cl
- .text:000000003955679C 24 08 and al, 8
- .text:000000003955679E 0A D0 or dl, al
- .text:00000000395567A0 88 95 A0 FF 01 00 mov byte ptr [rbp+1FF90h+var_s10], dl
- .text:00000000395567A6 0F B7 85 A0 FF 01 00 movzx eax, [rbp+1FF90h+var_s10]
- .text:00000000395567AD 66 89 03 mov [rbx], ax
- .text:00000000395567B0 44 88 A5 60 FF 00 00 mov [rbp+1FF90h+var_10030], r12b
- .text:00000000395567B7 33 D2 xor edx, edx ; Val
- .text:00000000395567B9 41 B8 FD FF 00 00 mov r8d, 0FFFDh ; Size
- .text:00000000395567BF 48 8D 8D 61 FF 00 00 lea rcx, [rbp+1FF90h+Dst] ; Dst
- .text:00000000395567C6 E8 5D 3F 01 00 call memset
- .text:00000000395567CB 49 8B 95 E8 01 00 00 mov rdx, [r13+1E8h]
- .text:00000000395567D2 49 39 95 F0 01 00 00 cmp [r13+1F0h], rdx
- .text:00000000395567D9 75 0E jnz short loc_395567E9
- .text:00000000395567DB 48 8D 0D 26 B6 02 00 lea rcx, aInvalidVectorT ; "invalid vector<T> subscript"
- .text:00000000395567E2 FF 15 58 C9 01 00 call cs:?_Xout_of_range@std@@YAXPEBD@Z ; std::_Xout_of_range(char const *)
- .text:00000000395567E8 CC int 3 ; Trap to Debugger
- .text:00000000395567E9 ; ---------------------------------------------------------------------------
- .text:00000000395567E9
- .text:00000000395567E9 loc_395567E9: ; CODE XREF: EncryptPacket+3B5j
- .text:00000000395567E9 41 B8 80 00 00 00 mov r8d, 80h
- .text:00000000395567EF 49 8D 8D B8 00 00 00 lea rcx, [r13+0B8h]
- .text:00000000395567F6 E8 35 E2 FF FF call sub_39554A30
- .text:00000000395567FB 4D 8D 8D D8 01 00 00 lea r9, [r13+1D8h]
- .text:0000000039556802 48 8D 85 60 FF 00 00 lea rax, [rbp+1FF90h+var_10030]
- .text:0000000039556809 48 89 44 24 28 mov [rsp+20060h+var_20038], rax
- .text:000000003955680E 48 8B C3 mov rax, rbx
- .text:0000000039556811 48 89 5C 24 20 mov [rsp+20060h+var_20040], rbx
- .text:0000000039556816 45 8B C6 mov r8d, r14d
- .text:0000000039556819 BA 01 00 00 00 mov edx, 1
- .text:000000003955681E 49 8D 8D B8 00 00 00 lea rcx, [r13+0B8h]
- .text:0000000039556825 E8 AA EF FF FF call sub_395557D4
- .text:000000003955682A 41 8D 46 0F lea eax, [r14+0Fh]
- .text:000000003955682E 99 cdq
- .text:000000003955682F 83 E2 0F and edx, 0Fh
- .text:0000000039556832 44 8D 04 02 lea r8d, [rdx+rax]
- .text:0000000039556836 41 C1 F8 04 sar r8d, 4
- .text:000000003955683A 41 C1 E0 04 shl r8d, 4
- .text:000000003955683E 41 8A C8 mov cl, r8b
- .text:0000000039556841 41 2A CE sub cl, r14b
- .text:0000000039556844 80 F1 3F xor cl, 3Fh
- .text:0000000039556847 48 8B C3 mov rax, rbx
- .text:000000003955684A 88 0B mov [rbx], cl
- .text:000000003955684C 41 8B C0 mov eax, r8d
- .text:000000003955684F 99 cdq
- .text:0000000039556850 F7 FF idiv edi
- .text:0000000039556852 44 8B C8 mov r9d, eax
- .text:0000000039556855 44 0F AF CF imul r9d, edi
- .text:0000000039556859 41 8D 41 FF lea eax, [r9-1]
- .text:000000003955685D 48 63 D0 movsxd rdx, eax
- .text:0000000039556860 BF FE 00 00 00 mov edi, 0FEh
- .text:0000000039556865 85 C0 test eax, eax
- .text:0000000039556867 78 40 js short loc_395568A9
- .text:0000000039556869 41 8B 9D AC 00 00 00 mov ebx, [r13+0ACh]
- .text:0000000039556870 4C 8D 14 32 lea r10, [rdx+rsi]
- .text:0000000039556874 4C 8D 9D 60 FF 00 00 lea r11, [rbp+1FF90h+var_10030]
- .text:000000003955687B 4C 2B DE sub r11, rsi
- .text:000000003955687E
- .text:000000003955687E loc_3955687E: ; CODE XREF: EncryptPacket+47Cj
- .text:000000003955687E 8D 83 D5 CB 2F 00 lea eax, [rbx+2FCBD5h]
- .text:0000000039556884 8B D8 mov ebx, eax
- .text:0000000039556886 C1 E8 10 shr eax, 10h
- .text:0000000039556889 24 F7 and al, 0F7h
- .text:000000003955688B 0F B6 C8 movzx ecx, al
- .text:000000003955688E 0F 44 CF cmovz ecx, edi
- .text:0000000039556891 43 8A 04 13 mov al, [r11+r10]
- .text:0000000039556895 32 C1 xor al, cl
- .text:0000000039556897 41 88 02 mov [r10], al
- .text:000000003955689A 49 FF CA dec r10
- .text:000000003955689D 48 FF CA dec rdx
- .text:00000000395568A0 79 DC jns short loc_3955687E
- .text:00000000395568A2 41 89 9D AC 00 00 00 mov [r13+0ACh], ebx
- .text:00000000395568A9
- .text:00000000395568A9 loc_395568A9: ; CODE XREF: EncryptPacket+443j
- .text:00000000395568A9 49 63 C1 movsxd rax, r9d
- .text:00000000395568AC 45 3B C8 cmp r9d, r8d
- .text:00000000395568AF 7D 4A jge short loc_395568FB
- .text:00000000395568B1 45 8B 95 AC 00 00 00 mov r10d, [r13+0ACh]
- .text:00000000395568B8 48 8D 14 30 lea rdx, [rax+rsi]
- .text:00000000395568BC 4C 8D 9D 60 FF 00 00 lea r11, [rbp+1FF90h+var_10030]
- .text:00000000395568C3 4C 2B DE sub r11, rsi
- .text:00000000395568C6 41 8B C0 mov eax, r8d
- .text:00000000395568C9 41 2B C1 sub eax, r9d
- .text:00000000395568CC 44 8B C8 mov r9d, eax
- .text:00000000395568CF
- .text:00000000395568CF loc_395568CF: ; CODE XREF: EncryptPacket+4CEj
- .text:00000000395568CF 41 8D 82 D5 CB 2F 00 lea eax, [r10+2FCBD5h]
- .text:00000000395568D6 44 8B D0 mov r10d, eax
- .text:00000000395568D9 C1 E8 10 shr eax, 10h
- .text:00000000395568DC 24 F7 and al, 0F7h
- .text:00000000395568DE 0F B6 C8 movzx ecx, al
- .text:00000000395568E1 0F 44 CF cmovz ecx, edi
- .text:00000000395568E4 42 8A 04 1A mov al, [rdx+r11]
- .text:00000000395568E8 32 C1 xor al, cl
- .text:00000000395568EA 88 02 mov [rdx], al
- .text:00000000395568EC 48 FF C2 inc rdx
- .text:00000000395568EF 49 FF C9 dec r9
- .text:00000000395568F2 75 DB jnz short loc_395568CF
- .text:00000000395568F4 45 89 95 AC 00 00 00 mov [r13+0ACh], r10d
- .text:00000000395568FB
- .text:00000000395568FB loc_395568FB: ; CODE XREF: EncryptPacket+48Bj
- .text:00000000395568FB 43 8D 5C 38 01 lea ebx, [r8+r15+1]
- .text:0000000039556900 48 8B 85 B8 FF 01 00 mov rax, [rbp+1FF90h+var_s28]
- .text:0000000039556907 48 85 C0 test rax, rax
- .text:000000003955690A 74 02 jz short loc_3955690E
- .text:000000003955690C 89 18 mov [rax], ebx
- .text:000000003955690E
- .text:000000003955690E loc_3955690E: ; CODE XREF: EncryptPacket+4E6j
- .text:000000003955690E 48 8B 0D 93 6E 04 00 mov rcx, cs:qword_3959D7A8
- .text:0000000039556915 48 8B 01 mov rax, [rcx]
- .text:0000000039556918 FF 90 88 00 00 00 call qword ptr [rax+88h]
- .text:000000003955691E 84 C0 test al, al
- .text:0000000039556920 74 2F jz short loc_39556951
- .text:0000000039556922 49 8D 4D 28 lea rcx, [r13+28h]
- .text:0000000039556926 4C 8D 05 F3 6E 04 00 lea r8, qword_3959D820
- .text:000000003955692D 48 8D 95 A0 FF 01 00 lea rdx, [rbp+1FF90h+var_s10]
- .text:0000000039556934 E8 C3 EF FA FF call sub_395058FC
- .text:0000000039556939 49 8B 4D 30 mov rcx, [r13+30h]
- .text:000000003955693D 48 8B 01 mov rax, [rcx]
- .text:0000000039556940 4C 63 C3 movsxd r8, ebx
- .text:0000000039556943 48 8D 54 24 60 lea rdx, [rsp+20060h+var_20000]
- .text:0000000039556948 FF 50 20 call qword ptr [rax+20h]
- .text:000000003955694B 90 nop
- .text:000000003955694C
- .text:000000003955694C loc_3955694C: ; DATA XREF: .rdata:stru_395943F8o
- .text:000000003955694C E9 82 01 00 00 jmp loc_39556AD3
- .text:0000000039556951 ; ---------------------------------------------------------------------------
- .text:0000000039556951
- .text:0000000039556951 loc_39556951: ; CODE XREF: EncryptPacket+4FCj
- .text:0000000039556951 ; DATA XREF: .rdata:stru_395943F8o
- .text:0000000039556951 49 8B 4D 30 mov rcx, [r13+30h]
- .text:0000000039556955 4C 8B 09 mov r9, [rcx]
- .text:0000000039556958 4C 63 C3 movsxd r8, ebx
- .text:000000003955695B 48 8D 54 24 60 lea rdx, [rsp+20060h+var_20000]
- .text:0000000039556960 41 FF 51 28 call qword ptr [r9+28h]
- .text:0000000039556964 90 nop
- .text:0000000039556965
- .text:0000000039556965 loc_39556965: ; DATA XREF: .rdata:stru_395943F8o
- .text:0000000039556965 E9 67 01 00 00 jmp loc_39556AD1
- .text:000000003955696A ; ---------------------------------------------------------------------------
- .text:000000003955696A
- .text:000000003955696A loc_3955696A: ; CODE XREF: EncryptPacket+50j
- .text:000000003955696A ; EncryptPacket+64j ...
- .text:000000003955696A 45 33 E4 xor r12d, r12d
- .text:000000003955696D 44 88 64 24 60 mov [rsp+20060h+var_20000], r12b
- .text:0000000039556972 33 D2 xor edx, edx ; Val
- .text:0000000039556974 41 B8 FD FF 00 00 mov r8d, 0FFFDh ; Size
- .text:000000003955697A 48 8D 4C 24 61 lea rcx, [rsp+20060h+var_1FFFF] ; Dst
- .text:000000003955697F E8 A4 3D 01 00 call memset
- .text:0000000039556984 4C 8D 5C 24 60 lea r11, [rsp+20060h+var_20000]
- .text:0000000039556989 4C 89 5C 24 38 mov [rsp+20060h+var_20028], r11
- .text:000000003955698E 48 8D 44 24 60 lea rax, [rsp+20060h+var_20000]
- .text:0000000039556993 48 89 44 24 40 mov [rsp+20060h+var_20020], rax
- .text:0000000039556998 48 8D 85 5E FF 00 00 lea rax, [rbp+1FF90h+var_10032]
- .text:000000003955699F 48 89 44 24 48 mov [rsp+20060h+var_20018], rax
- .text:00000000395569A4 48 8D 05 D5 41 02 00 lea rax, off_3957AB80
- .text:00000000395569AB 48 89 44 24 30 mov [rsp+20060h+var_20030], rax
- .text:00000000395569B0
- .text:00000000395569B0 loc_395569B0: ; DATA XREF: .rdata:stru_395943F8o
- .text:00000000395569B0 4D 8D 85 7C 02 00 00 lea r8, [r13+27Ch]
- .text:00000000395569B7 45 33 C9 xor r9d, r9d
- .text:00000000395569BA 48 8D 15 BB B0 02 00 lea rdx, aSeq ; "seq"
- .text:00000000395569C1 48 8D 4C 24 30 lea rcx, [rsp+20060h+var_20030]
- .text:00000000395569C6 FF 15 44 42 02 00 call cs:off_3957AC10
- .text:00000000395569CC 44 0F B6 C6 movzx r8d, sil
- .text:00000000395569D0 48 8D 05 29 C5 04 00 lea rax, byte_395A2F00
- .text:00000000395569D7 4C 03 C0 add r8, rax
- .text:00000000395569DA 45 33 C9 xor r9d, r9d
- .text:00000000395569DD 48 8D 15 74 BA 02 00 lea rdx, aHeader ; "header"
- .text:00000000395569E4 48 8D 4C 24 30 lea rcx, [rsp+20060h+var_20030]
- .text:00000000395569E9 48 8B 44 24 30 mov rax, [rsp+20060h+var_20030]
- .text:00000000395569EE FF 90 90 00 00 00 call qword ptr [rax+90h]
- .text:00000000395569F4 4C 8B 1B mov r11, [rbx]
- .text:00000000395569F7 48 8D 54 24 30 lea rdx, [rsp+20060h+var_20030]
- .text:00000000395569FC 48 8B CB mov rcx, rbx
- .text:00000000395569FF 41 FF 53 08 call qword ptr [r11+8]
- .text:0000000039556A03 4C 8B 1B mov r11, [rbx]
- .text:0000000039556A06 48 8D 54 24 30 lea rdx, [rsp+20060h+var_20030]
- .text:0000000039556A0B 48 8B CB mov rcx, rbx
- .text:0000000039556A0E 41 FF 53 10 call qword ptr [r11+10h]
- .text:0000000039556A12 48 8D 4C 24 30 lea rcx, [rsp+20060h+var_20030]
- .text:0000000039556A17 48 8B 44 24 30 mov rax, [rsp+20060h+var_20030]
- .text:0000000039556A1C FF 50 58 call qword ptr [rax+58h]
- .text:0000000039556A1F 84 C0 test al, al
- .text:0000000039556A21 75 05 jnz short loc_39556A28
- .text:0000000039556A23
- .text:0000000039556A23 loc_39556A23: ; DATA XREF: .rdata:stru_395943F8o
- .text:0000000039556A23 E9 29 FB FF FF jmp loc_39556551
- .text:0000000039556A28 ; ---------------------------------------------------------------------------
- .text:0000000039556A28
- .text:0000000039556A28 loc_39556A28: ; CODE XREF: EncryptPacket+5FDj
- .text:0000000039556A28 ; DATA XREF: .rdata:stru_395943F8o
- .text:0000000039556A28 48 85 FF test rdi, rdi
- .text:0000000039556A2B 74 22 jz short loc_39556A4F
- .text:0000000039556A2D 48 8D 4C 24 30 lea rcx, [rsp+20060h+var_20030]
- .text:0000000039556A32 48 8B 44 24 30 mov rax, [rsp+20060h+var_20030]
- .text:0000000039556A37 FF 50 58 call qword ptr [rax+58h]
- .text:0000000039556A3A 84 C0 test al, al
- .text:0000000039556A3C 74 0C jz short loc_39556A4A
- .text:0000000039556A3E 48 8B 44 24 40 mov rax, [rsp+20060h+var_20020]
- .text:0000000039556A43 48 2B 44 24 38 sub rax, [rsp+20060h+var_20028]
- .text:0000000039556A48 EB 03 jmp short loc_39556A4D
- .text:0000000039556A4A ; ---------------------------------------------------------------------------
- .text:0000000039556A4A
- .text:0000000039556A4A loc_39556A4A: ; CODE XREF: EncryptPacket+618j
- .text:0000000039556A4A 49 8B C4 mov rax, r12
- .text:0000000039556A4D
- .text:0000000039556A4D loc_39556A4D: ; CODE XREF: EncryptPacket+624j
- .text:0000000039556A4D 89 07 mov [rdi], eax
- .text:0000000039556A4F
- .text:0000000039556A4F loc_39556A4F: ; CODE XREF: EncryptPacket+607j
- .text:0000000039556A4F 48 8B 0D 52 6D 04 00 mov rcx, cs:qword_3959D7A8
- .text:0000000039556A56 48 8B 01 mov rax, [rcx]
- .text:0000000039556A59 FF 90 88 00 00 00 call qword ptr [rax+88h]
- .text:0000000039556A5F 48 8D 4C 24 30 lea rcx, [rsp+20060h+var_20030]
- .text:0000000039556A64 84 C0 test al, al
- .text:0000000039556A66 48 8B 44 24 30 mov rax, [rsp+20060h+var_20030]
- .text:0000000039556A6B 74 3D jz short loc_39556AAA
- .text:0000000039556A6D FF 50 58 call qword ptr [rax+58h]
- .text:0000000039556A70 84 C0 test al, al
- .text:0000000039556A72 74 0A jz short loc_39556A7E
- .text:0000000039556A74 4C 8B 64 24 40 mov r12, [rsp+20060h+var_20020]
- .text:0000000039556A79 4C 2B 64 24 38 sub r12, [rsp+20060h+var_20028]
- .text:0000000039556A7E
- .text:0000000039556A7E loc_39556A7E: ; CODE XREF: EncryptPacket+64Ej
- .text:0000000039556A7E 49 8D 4D 28 lea rcx, [r13+28h]
- .text:0000000039556A82 4C 8D 05 97 6D 04 00 lea r8, qword_3959D820
- .text:0000000039556A89 48 8D 95 A0 FF 01 00 lea rdx, [rbp+1FF90h+var_s10]
- .text:0000000039556A90 E8 67 EE FA FF call sub_395058FC
- .text:0000000039556A95 49 8B 4D 30 mov rcx, [r13+30h]
- .text:0000000039556A99 48 8B 01 mov rax, [rcx]
- .text:0000000039556A9C 4D 8B C4 mov r8, r12
- .text:0000000039556A9F 48 8D 54 24 60 lea rdx, [rsp+20060h+var_20000]
- .text:0000000039556AA4 FF 50 20 call qword ptr [rax+20h]
- .text:0000000039556AA7 90 nop
- .text:0000000039556AA8
- .text:0000000039556AA8 loc_39556AA8: ; DATA XREF: .rdata:stru_395943F8o
- .text:0000000039556AA8 EB 29 jmp short loc_39556AD3
- .text:0000000039556AAA ; ---------------------------------------------------------------------------
- .text:0000000039556AAA
- .text:0000000039556AAA loc_39556AAA: ; CODE XREF: EncryptPacket+647j
- .text:0000000039556AAA ; DATA XREF: .rdata:stru_395943F8o
- .text:0000000039556AAA 49 8B 5D 30 mov rbx, [r13+30h]
- .text:0000000039556AAE FF 50 58 call qword ptr [rax+58h]
- .text:0000000039556AB1 84 C0 test al, al
- .text:0000000039556AB3 74 0A jz short loc_39556ABF
- .text:0000000039556AB5 4C 8B 64 24 40 mov r12, [rsp+20060h+var_20020]
- .text:0000000039556ABA 4C 2B 64 24 38 sub r12, [rsp+20060h+var_20028]
- .text:0000000039556ABF
- .text:0000000039556ABF loc_39556ABF: ; CODE XREF: EncryptPacket+68Fj
- .text:0000000039556ABF 48 8B 03 mov rax, [rbx]
- .text:0000000039556AC2 4D 8B C4 mov r8, r12
- .text:0000000039556AC5 48 8D 54 24 60 lea rdx, [rsp+20060h+var_20000]
- .text:0000000039556ACA 48 8B CB mov rcx, rbx
- .text:0000000039556ACD FF 50 28 call qword ptr [rax+28h]
- .text:0000000039556AD0 90 nop
- .text:0000000039556AD1
- .text:0000000039556AD1 loc_39556AD1: ; CODE XREF: EncryptPacket:loc_39556965j
- .text:0000000039556AD1 ; DATA XREF: .rdata:stru_395943F8o
- .text:0000000039556AD1 B0 01 mov al, 1
- .text:0000000039556AD3
- .text:0000000039556AD3 loc_39556AD3: ; CODE XREF: EncryptPacket+12Fj
- .text:0000000039556AD3 ; EncryptPacket:loc_3955694Cj ...
- .text:0000000039556AD3 48 8B 9C 24 A8 00 02 00 mov rbx, [rsp+20060h+arg_8]
- .text:0000000039556ADB 48 81 C4 60 00 02 00 add rsp, 20060h
- .text:0000000039556AE2 41 5F pop r15
- .text:0000000039556AE4 41 5E pop r14
- .text:0000000039556AE6 41 5D pop r13
- .text:0000000039556AE8 41 5C pop r12
- .text:0000000039556AEA 5F pop rdi
- .text:0000000039556AEB 5E pop rsi
- .text:0000000039556AEC 5D pop rbp
- .text:0000000039556AED C3 retn
- .text:0000000039556AED EncryptPacket endp
- .text:0000000039556AED
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement