Advertisement
Guest User

Untitled

a guest
May 25th, 2018
74
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 1.10 KB | None | 0 0
  1. uint64_t tsl_decrypt_1(struct Tsl *tsl, uint64_t prop)
  2. {
  3.     struct uint128_t xmm;
  4.     if (!READ(prop, &xmm, 16))
  5.     {
  6.         return 0;
  7.     }
  8.  
  9.     uint32_t key = (uint32_t)xmm.low;
  10.     if (!IsValid(xmm.high))
  11.         return 0;
  12.     if (!mem->IsValid(xmm.high) || !mem->IsValid(key))
  13.         return 0;
  14.  
  15.     int v9; // ecx
  16.     int v10; // er8
  17.     int v11; // edx
  18.     int v12; // ecx
  19.     char v13; // al
  20.  
  21.     v9 = (unsigned __int16)(IDA_LOWORD(key) + 103);
  22.     v10 = v9 ^ ((unsigned __int16)~((~IDA_HIWORD(key) + 85) ^ 0xFFAB) + 60887);
  23.     v11 = (unsigned __int8)((unsigned __int16)(v9 ^ (~((~IDA_HIWORD(key) + 85) ^ 0xFFAB) - 4649)) >> 8);
  24.     if (((unsigned __int16)(v9 ^ (~((~IDA_HIWORD(key) + 85) ^ 0xFFAB) - 4649)) >> 8) & 2)
  25.     {
  26.         v12 = ~(v11 - 15);
  27.         v13 = v11 + 15;
  28.     }
  29.     else
  30.     {
  31.         LOBYTE(v12) = v11 - 14;
  32.         v13 = v11 ^ 0xF1;
  33.     }
  34.  
  35.     auto index = ((unsigned __int8)(v10 + 31) ^ ((unsigned __int8)(~v13 + v12)
  36.         + 146))
  37.         % 128;
  38.  
  39.     uint64_t func = READ64(GET_ADDR(TABLE) + 0x8 * index);
  40.  
  41.     if (auto encValue = decrypt(tsl, func, (ror8(xmm.high, 8 * (IDA_LOWORD(key) & 7u)) - (unsigned int)IDA_LOWORD(key))))
  42.         return ror8(encValue, 123);
  43.  
  44.     return 0;
  45. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement