Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- uint64_t tsl_decrypt_1(struct Tsl *tsl, uint64_t prop)
- {
- struct uint128_t xmm;
- if (!READ(prop, &xmm, 16))
- {
- return 0;
- }
- uint32_t key = (uint32_t)xmm.low;
- if (!IsValid(xmm.high))
- return 0;
- if (!mem->IsValid(xmm.high) || !mem->IsValid(key))
- return 0;
- int v9; // ecx
- int v10; // er8
- int v11; // edx
- int v12; // ecx
- char v13; // al
- v9 = (unsigned __int16)(IDA_LOWORD(key) + 103);
- v10 = v9 ^ ((unsigned __int16)~((~IDA_HIWORD(key) + 85) ^ 0xFFAB) + 60887);
- v11 = (unsigned __int8)((unsigned __int16)(v9 ^ (~((~IDA_HIWORD(key) + 85) ^ 0xFFAB) - 4649)) >> 8);
- if (((unsigned __int16)(v9 ^ (~((~IDA_HIWORD(key) + 85) ^ 0xFFAB) - 4649)) >> 8) & 2)
- {
- v12 = ~(v11 - 15);
- v13 = v11 + 15;
- }
- else
- {
- LOBYTE(v12) = v11 - 14;
- v13 = v11 ^ 0xF1;
- }
- auto index = ((unsigned __int8)(v10 + 31) ^ ((unsigned __int8)(~v13 + v12)
- + 146))
- % 128;
- uint64_t func = READ64(GET_ADDR(TABLE) + 0x8 * index);
- if (auto encValue = decrypt(tsl, func, (ror8(xmm.high, 8 * (IDA_LOWORD(key) & 7u)) - (unsigned int)IDA_LOWORD(key))))
- return ror8(encValue, 123);
- return 0;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement