Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #1 imul ecx, 1000193h
- #2 movsx eax, al
- #3 inc edi
- #4 xor ecx, eax
- #5 mov al, [edi]
- #6 test al, al
- #7 jnz short 17354d0h #1
- EAX - Accumulator - I/O port access, arithmetic, interrupt calls, etc
- EBX - Base - pointer for memory access, some interrupt return values
- ECX - Counter - loop counter and shifts, some interrupt values
- EDX - Data - I/O port access, arithmetic, some interrupt calls
- CF - Carry -
- PF - Parity -
- SF - Sign -
- OF - Overflow -
- imul ecx, asdf
- signed multiply ASDF into ECX
- AL * byte = AX
- AX * word = DX:AX
- EAX*dword = EDX:EAX
- ecx_from CPSO ecx_to CPSO
- 1 811C9DC5 0100 => 050C5D1F 1001
- 2 050C5D64 0100 => 5677046C 1001
- 3 5677044E 0100 => 6B5BC6CA 1001
- 4 6B5BC6BE 0100 => BF79DD1A 1011
- 5 BF79DD45 0100 => B1D7539F 1111
- 6 B1D753FC 0000 => F1F935B4 1111
- 7 F1F935D5 0000 => C04FBE4F 1011
- 8 C04FBE3C 0100 => F9887874 1011
- # DETERMINED USAGE:
- randomize ecx
- movsx eax, al
- MOV with sign extend
- copy al to eax
- al is smaller than eax
- eax must be a register
- al can be register or mem loc
- eax and al are considered signed
- 1 1597b => 7b
- 2 22 => 22
- 3 74 => 74
- 4 5f => 5f
- 5 63 => 63
- 6 61 => 61
- 7 73 => 73
- 8 74 => 74
- # DETERMINED USAGE:
- chomp EAX to LSB
- inc edi
- 1 31D4EC68 => 31D4EC69
- 2 31D4EC69 => 31D4EC6A
- 3 31D4EC6A => 31D4EC6B
- 4 increasing linearly
- # DETERMINED USAGE:
- pointer to memory location
- xor ecx, eax
- XOR EAX into ECX
- 1 050C5D1F ^= 0000007B = 050C5D64
- 2 5677046C ^= 00000022 = 5677044E
- 3 6B5BC6CA ^= 00000074 = 6B5BC6BE
- 4 BF79DD1A ^= 0000005F = BF79DD45
- 5 B1D7539F ^= 00000063 = B1D753FC
- 6 F1F935B4 ^= 00000061 = F1F935D5
- 7 C04FBE4F ^= 00000073 = C04FBE3C
- 8 F9887874 ^= 00000074 = F9887800
- # DETERMINED USAGE:
- shitty crypto
- mov al, [edi]
- copy value at EDI into AL (EAX)
- 1 0000007B => 00000022
- 2 00000022 => 00000074
- 3 0000005F
- 4 00000063
- 5 00000061
- 6 00000073
- 7 00000074
- 8 00000022
- test al, al
- AL AND AL
- jnz short
Advertisement
Add Comment
Please, Sign In to add comment