Experienced Elementalist
- Joined
- Aug 26, 2009
- Messages
- 236
- Reaction score
- 27
Any Comment about this?
This is only a small part of this file
Is there any one of you guys can understand this code
If you need to know more i will upload the whole file..
______________
here's the link of disassembled but its only for functioning hope it helps
Code:
/* This file was automatically created by
* Reverse Engineering Compiler 2.2 (C) Giampiero Caprino (Jul 2 2007)
* Input file: 'E:\Program Files\upx\FieldServer.exe'
*/
/* Region map */
/* Id Start End Size Offset Type */
/* 1 : 05c13000 06012e00 003ffe00 00000200 text */
/* 130: 00400000 00500000 00100000 00400000 runtime */
/* 129: 06112e00 0619a2c1 000874c1 00500000 text */
/* 131: 0619a2c1 0619a400 0000013f 005874C1 data */
/* 132: 0619a400 0619a400 00000000 00587600 text */
/* 128: 0619b000 0619f768 00004768 00587600 runtime */
/* 127: 0619f768 0619fb7c 00000414 0058BD68 runtime */
/* 71 : 0619fb7c 0619fc00 00000084 0058C17C data */
/* 133: 00000000 00000b80 00000b80 000000DC data */
/* 134: 00000000 00001b20 00001b20 000000DC data */
/* 135: 00000000 00000460 00000460 000000DC data */
/* 136: 00000000 000000d0 000000d0 000000DC data */
/* 137: 00000000 00000160 00000160 000000DC data */
/* 138: 00000000 00000b90 00000b90 000000DC data */
/* 139: 00000000 00000e00 00000e00 000000DC data */
/* 140: 00000000 00000920 00000920 000000DC data */
/* 141: 00000000 00000160 00000160 000000DC data */
/* 142: 00000000 00000e40 00000e40 000000DC data */
/* 143: 00000000 000000e0 000000e0 000000DC data */
/* 144: 00000000 000000e0 000000e0 000000DC data */
L05c13000: .text 0x3ffe00 # id: 1, high: 0x06012e00
63 bb ff ff 8b 44 arpl [ebx+0x448bffff],di
24 04 and al,0x4
3d 0e 00 07 80 cmp eax,0x8007000e
75 05 jnz 0x5c13014
e8 90 16 b0 e0 call 0xe67146a4
L05c13014: 50 push eax
0b da or ebx,edx
cc int3
01 ef add edi,ebp
ee out dx,al
cf iret
L05c1301c: ff 6a ff jmp far [edx-0x1]
68 03 bb 59 00 push dword 0x59bb03
64 a1 00 50 64 89 mov eax,[fs:0x89645000]
25 0f 83 ec 20 and eax,0x20ec830f
6e outsb
34 6f xor al,0x6f
7f d7 jg 0x5c1300b
fe Unknown opcode 0xfe
56 push esi
50 push eax
8d 4c 24 0c lea ecx,[esp+0xc]
c7 Unknown opcode 0xc7
12 08 adc cl,[eax]
29 ff sub edi,edi
15 fc 82 5f 00 adc eax,0x5f82fc
8b 22 mov esp,[edx]
3c 51 cmp al,0x51
8b c8 mov ecx,eax
76 7b jna 0x5c130c8
b6 7c mov dh,0x7c
28 30 sub [eax],dh
01 58 28 add [eax+0x28],ebx
74 58 jz 0x5c130ae
50 push eax
8b ce mov ecx,esi
43 inc ebx
7c ad jl 0x5c13009
f2 5e repne pop esi
66 08 3c 04 o16 or [esp+eax],bh
c6 Unknown opcode 0xc6
0e push cs
2c 70 sub al,0x70
04 83 add al,0x83
80 7d 69 bf cmp byte [ebp+0x69],0xbf
24 8b and al,0x8b
c6 Unknown opcode 0xc6
5e pop esi
c2 0d c4 ret 0xc40d
L05c13073: 2c c3 sub al,0xc3
ff c9 dec ecx
44 inc esp
25 27 f0 82 ec and eax,0xec82f027
fe Unknown opcode 0xfe
ff 87 44 ce 0c 48 inc dword [edi+0x480cce44]
78 26 js 0x5c130ac
53 push ebx
8b 5c 24 14 mov ebx,[esp+0x14]
55 push ebp
8b 6c 24 10 mov ebp,[esp+0x10]
56 push esi
7f 70 jg 0x5c13103
f8 clc
1f pop ds
98 cwde
10 57 8d adc [edi-0x73],dl
78 01 js 0x5c1309c
8d 9b 51 aa d3 03 lea ebx,[ebx+0x3d3aa51]
f5 cmc
4f dec edi
7c fb jl 0x5c130a0
b7 ff mov bh,0xff
75 f7 jnz 0x5c130a0
5f pop edi
5e pop esi
5d pop ebp
L05c130ac: 5b pop ebx
c2 10 00 ret 0x10
L05c130b0: 46 inc esi
ec in al,dx
83 e4 f8 and esp,byte -0x8
81 ec 04 04 36 53 sub esp,0x53360404
56 push esi
57 push edi
33 c0 xor eax,eax
fb sti
ff 6f 3b jmp far [edi+0x3b]
c4 2a les ebp,[edx]
b9 ff 54 8d 7c mov ecx,0x7c8d54ff
24 11 and al,0x11
f3 ab rep stosd
66 ab stosw
aa stosb
8b 45 08 mov eax,[ebp+0x8]
8d 54 2a 6e lea edx,[edx+ebp+0x6e]
f1 int1
ff Unknown opcode 0xff
7f 2b jg 0x5c13107
d0 8d 49 00 8a 08 ror byte [ebp+0x88a0049],1
88 0c 02 mov [edx+eax],cl
40 inc eax
84 c9 test cl,cl
75 f6 jnz 0x5c130e0
8b 1d 08 84 3a de mov ebx,[0xde3a8408]
c5 Unknown opcode 0xc5
f6 c5 2d test ch,0x2d
ad lodsd
14 51 adc al,0x51
66 48 dec ax
14 20 adc al,0x20
00 bc 8b f0 1a f7 ff add [ebx+ecx*4+0xfff71af0],bh
ed in eax,dx
L05c13103: 7e 08 jng 0x5c1310d
85 f6 test esi,esi
L05c13107: 0f 84 93 df 3d 04 jz near 0x9ff10a0
L05c1310d: 4a dec edx
8b 15 a8 5f 64 00 mov edx,[0x645fa8]
52 push edx
56 push esi
ff d7 call edi
35 79 3f e4 7d xor eax,0x7de43f79
c0 Unknown opcode 0xc0
74 4b jz 0x5c1316b
a1 ac 1e 50 49 mov eax,[0x49501eac]
8b 0d b0 20 51 7d mov ecx,[0x7d5120b0]
07 pop es
d2 0e ror byte [esi],cl
46 inc esi
62 b4 43 d1 6a ec ff bound esi,[ebx+eax*2+0xffec6ad1]
05 a7 bd 75 ab add eax,0xab75bda7
82 Unknown opcode 0x82
5b pop ebx
8b e5 mov esp,ebp
5d pop ebp
c3 ret
L05c13141: c6 05 88 93 6c 00 01 mov byte [0x6c9388],0x1
1b 72 20 sbb esi,[edx+0x20]
07 pop es
72 89 jc 0x5c130d7
8a 8b a3 1b 25 5a mov cl,[ebx+0x5a251ba3]
5f pop edi
9f lahf
68 eb 03 56 6d push dword 0x6d5603eb
3b dd cmp ebx,ebp
1d ac 60 85 5f sbb eax,0x5f8560ac
0d 5c 3b 00 53 or eax,0x53003b5c
70 3b jo 0x5c131a4
c1 0e 7f ror dword [esi],0x7f
0c 57 or al,0x57
8c 39 mov [ecx],segr7
68 ec 50 64 b7 push dword 0xb76450ec
af scasd
60 pusha
24 f4 and al,0xf4
54 push esp
1a 6a 01 sbb ch,[edx+0x1]
58 pop eax
d3 68 ee shr dword [eax-0x12],cl
25 b6 5b a4 13 and eax,0x13a45bb6
32 19 xor bl,[ecx]
eb 89 jmp short 0x5c13113
L05c1318a: 6a 60 push byte +0x60
d0 07 rol byte [edi],1
1a be d3 6e 6a 65 sbb bh,[esi+0x656a6ed3]
56 push esi
1e push ds
58 pop eax
f0 c3 lock ret
a1 2a 6c 9a 19 mov eax,[0x199a6c2a]
0e push cs
9e sahf
1e push ds
64 a4 fs movsb
3e db 04 18 fild dword [ds:eax+ebx]
dc 70 64 fdiv qword [eax+0x64]
46 inc esi
05 aa 6c e2 6a add eax,0x6ae26caa
64 aa fs stosb
0c a7 or al,0xa7
bd 1f dc 08 50 mov ebp,0x5008dc1f
68 ea 9e 51 78 push dword 0x78519eea
50 push eax
42 inc edx
0d 6f 7a e1 73 or eax,0x73e17a6f
0e push cs
04 52 add al,0x52
e4 00 in al,0x0
13 1c 5f adc ebx,[edi+ebx*2]
0a 64 7d 1f or ah,[ebp+edi*2+0x1f]
c9 leave
a7 cmpsd
c3 ret
L05c131d4: df 1b fistp word [ebx]
51 push ecx
a0 80 56 53 bb mov al,[0xbb535680]
78 76 js 0x5c13254
15 3b 65 3a c3 adc eax,0xc33a653b
10 9a 10 7f 85 c9 adc [edx+0xc9857f10],bl
55 push ebp
f2 dd bf a6 c8 20 a5 repne fnstsw [edi+0xa520c8a6]
30 8a 41 7a 84 c0 xor [edx+0xc0847a41],cl
36 5e ss pop esi
88 1d 0d 36 0d be mov [0xbe0d360d],bl
8b 01 mov eax,[ecx]
ff 50 08 call near [eax+0x8]
da ac 2d 4c d9 a4 3c fisubr dword [ebp+ebp+0x3ca4d94c]
2c 38 sub al,0x38
82 Unknown opcode 0x82
87 e3 xchg esp,ebx
d5 cd aad 0xcd
45 inc ebp
db 0f fisttp word [edi]
29 18 sub [eax],ebx
d4 24 aam 0x24
54 push esp
38 99 10 05 36 75 cmp [ecx+0x75360510],bl
17 pop ss
af scasd
1d 9a 0d 44 7c sbb eax,0x7c440d9a
80 53 3a 2d adc byte [ebx+0x3a],0x2d
74 ef jz 0x5c1321c
72 fb jc 0x5c1322a
b0 07 mov al,0x7
58 pop eax
33 bc f9 74 0f 8b 11 xor edi,[ecx+edi*8+0x118b0f74]
42 inc edx
12 c7 adc al,bh
05 60 b4 a4 9d add eax,0x9da4b460
00 c8 add al,cl
9c pushf
25 bd ee 47 f5 and eax,0xf547eebd
00 04 a7 add [edi],al
10 c3 adc bl,al
68 18 88 c5 f2 push dword 0xf2c58818
20 c1 and cl,al
0d db 8b f8 1e or eax,0x1ef88bdb
04 89 add al,0x89
48 dec eax
10 85 ff 47 43 f6 adc [ebp+0xf64347ff],al
ee out dx,al
c3 ret
L05c13265: 15 e4 1c 55 74 adc eax,0x74551ce4
1c 68 sbb al,0x68
ed in eax,dx
87 66 0d xchg esp,[esi+0xd]
77 15 ja 0x5c13287
5b pop ebx
e9 11 70 cf f7 jmp 0xfd90a289
L05c13278: 3c eb cmp al,0xeb
02 cc add cl,ah
a3 ed bb bf 76 mov [0x76bfbbed],eax
df 8b 10 cf 1c ff fisttp qword [ebx+0xff1ccf10]
L05c13287: 01 52 04 add [edx+0x4],edx
3b c3 cmp eax,ebx
75 6a jnz 0x5c132f8
94 xchg eax,esp
e0 d9 loopne 0x5c1326a
83 69 fd 15 sub dword [ecx-0x3],byte +0x15
e9 ee 7b 53 eb jmp 0xf114ae88
L05c1329a: 5f pop edi
c8 41 f0 90 enter 0xf041,0x90
67 29 d1 a16 sub ecx,edx
1e push ds
b6 51 mov dh,0x51
04 f7 add al,0xf7
8d a4 24 f0 df bf c1 lea esp,[esp+0xc1bfdff0]
83 c1 18 add ecx,byte +0x18
87 e6 xchg esp,esi
e4 08 in al,0x8
5b pop ebx
e7 7e out 0x7e,eax
0c 81 or al,0x81
5d pop ebp
cc int3
01 73 72 add [ebx+0x72],esi
8b 81 80 f0 43 83 mov eax,[ecx+0x8343f080]
ef out dx,eax
41 inc ecx
f8 clc
02 56 75 add dl,[esi+0x75]
31 2b xor [ebx],ebp
0c 0c or al,0xc
08 68 b8 or [eax-0x48],ch
bd 2a 2e 69 81 mov ebp,0x81692e2a
ee out dx,al
ec in al,dx
51 push ecx
5e pop esi
c3 ret
L05c132dc: c9 leave
57 push edi
60 pusha
b8 6c 03 75 2f mov eax,0x2f75036c
f6 ec imul ah
10 6b b0 adc [ebx-0x50],ch
30 b0 21 03 01 ff xor [eax+0xff010321],dh
34 43 xor al,0x43
c3 ret
L05c132f2: 95 xchg eax,ebp
d7 xlatb
L05c132f4: 13 80 b9 01 75 1b adc eax,[eax+0x1b7501b9]
c6 Unknown opcode 0xc6
35 16 b8 f8 c1 xor eax,0xc1f8b816
be 64 ff d6 33 mov esi,0x33d6ff64
74 ed jz 0x5c132f4
5e pop esi
e9 ef d3 36 35 jmp 0x3af806fc
L05c1330d: ba 9a 6a 83 48 mov edx,0x48836a9a
a7 cmpsd
9f lahf
1f pop ds
3a 9e 4d 1c 31 10 cmp bl,[esi+0x10311c4d]
bc 8a 10 33 e6 mov esp,0xe633108a
54 push esp
6f outsd
74 80 jz 0x5c132a4
3d 26 c6 08 6a cmp eax,0x6a08c626
11 7a 0d adc [edx+0xd],edi
01 5c 6a 97 add [edx+ebp*2-0x69],ebx
01 7f e8 add [edi-0x18],edi
a6 cmpsb
4f dec edi
26 18 c4 es sbb ah,al
1a 5a a6 sbb bl,[edx-0x5a]
b9 7a 9d fd 69 mov ecx,0x69fd9d7a
80 66 08 89 and byte [esi+0x8],0x89
98 cwde
93 xchg eax,ebx
6a 02 push byte +0x2
c7 Unknown opcode 0xc7
1e push ds
6c insb
05 dd 14 49 89 add eax,0x894914dd
fe Unknown opcode 0xfe
14 86 adc al,0x86
e8 84 6a 05 56 call 0x5bc69ddc
04 f3 add al,0xf3
5a pop edx
2a 06 sub al,[esi]
44 inc esp
1f pop ds
9f lahf
8f c0 pop eax
3e 38 a1 6c 1c 6a 6b cmp [ds:ecx+0x6b6a1c6c],ah
50 push eax
a1 ad 23 ac 34 mov eax,[0x34ac23ad]
5c pop esp
07 pop es
ea 9a 40 38 87 6d 7d jmp 0x7d6d:0x8738409a
75 68 jnz 0x5c133e2
6f outsd
24 51 and al,0x51
fe Unknown opcode 0xfe
24 26 and al,0x26
80 44 70 08 52 add byte [eax+esi*2+0x8],0x52
6a 92 push byte -0x6e
0b 16 or edx,[esi]
1b 61 20 sbb esp,[ecx+0x20]
02 8e 03 00 ee d5 add cl,[esi+0xd5ee0003]
ae scasb
37 aaa
bb 3e 08 53 4e mov ebx,0x4e53083e
68 81 a4 f4 fb push dword 0xfbf4a481
55 push ebp
9e sahf
d6 salc
28 f0 sub al,dh
59 pop ecx
2c 85 sub al,0x85
b3 10 mov bl,0x10
51 push ecx
b4 c9 mov ah,0xc9
2a cd sub cl,ch
1c 2e sbb al,0x2e
30 5c f2 16 xor [edx+esi*8+0x16],bl
34 85 xor al,0x85
68 6d b0 ed f3 push dword 0xf3edb06d
d5 8b aad 0x8b
c8 14 8b 2c enter 0x8b14,0x2c
54 push esp
53 push ebx
04 52 add al,0x52
e7 00 out 0x0,eax
59 pop ecx
3b e8 cmp ebp,eax
57 push edi
48 dec eax
38 35 82 3c 0c 50 cmp [0x500c3c82],dh
9a 54 3a ce d7 86 87 call 0x8786:0xd7ce3a54
c3 ret
L05c133d9: 0f 29 1f movaps [edi],xmm3
3a 3d 9d 04 79 30 cmp bh,[0x3079049d]
L05c133e2: f4 hlt
b3 fd mov bl,0xfd
fb sti
57 push edi
89 35 78 fe 0f 87 mov [0x870ffe78],esi
4d dec ebp
02 00 add al,[eax]
0a 84 34 05 f0 fe ec or al,[esp+esi+0xecfef005]
3f aas
ad lodsd
c3 ret
L05c133fa: 5a pop edx
7c 07 jl 0x5c13404
26 88 ff es mov bh,bh
24 85 and al,0x85
c4 1a les ebx,[edx]
L05c13404: 40 inc eax
58 pop eax
03 0d 57 2f 78 02 add ecx,[0x2782f57]
ec in al,dx
20 5f dc and [edi-0x24],bl
5e pop esi
36 bc 5f b7 8a a0 ss mov esp,0xa08ab75f
8c 6a 9a mov [edx-0x66],gs
85 64 46 83 test [esi+eax*2-0x7d],esp
f4 hlt
14 65 adc al,0x65
d2 cc ror ah,cl
03 38 add edi,[eax]
36 ed ss in eax,dx
18 38 sbb [eax],bh
88 75 0a mov [ebp+0xa],dh
65 f7 74 09 6b div dword [gs:ecx+ecx+0x6b]
03 8c a6 61 01 70 03 add ecx,[esi+0x3700161]
1c 90 sbb al,0x90
79 25 jns 0x5c13461
1e push ds
40 inc eax
8a 48 14 mov cl,[eax+0x14]
1c 74 sbb al,0x74
08 22 or [edx],ah
12 39 adc bh,[ecx]
10 14 5a adc [edx+ebx*2],dl
1c 0a sbb al,0xa
03 a6 ea 3d 6a f7 add esp,[esi+0xf76a3dea]
0b 36 or esi,[esi]
e0 2d loopne 0x5c13483
77 27 ja 0x5c1347f
f9 stc
0b 42 0e or eax,[edx+0xe]
92 xchg eax,edx
6b 71 9c 01 imul esi,[ecx-0x64],byte +0x1
L05c13461: f0 28 78 f0 lock sub [eax-0x10],bh
66 81 64 60 f0 7c a5 and word [eax-0x10],0xa57c
8b f0 mov esi,eax
0e push cs
a8 3c test al,0x3c
4a dec edx
06 push es
dc b8 7e b1 f3 fd fdivr qword [eax+0xfdf3b17e]
e2 8b loop 0x5c13406
be 0f b7 c1 3d mov esi,0x3dc1b70f
08 72 0f or [edx+0xf],dh
8f 80 01 0a 84 a4 pop dword [eax+0xa4840a01]
27 daa
97 xchg eax,edi
1f pop ds
ee out dx,al
L05c1348d: 2d e8 8c 37 6c sub eax,0x6c378ce8
01 e4 add esp,esp
03 66 97 add esp,[esi-0x69]
60 pusha
L05c13498: b0 3c mov al,0x3c
7f f1 jg 0x5c1348d
31 02 xor [edx],eax
cc int3
f8 clc
95 xchg eax,ebp
9c pushf
90 nop
08 05 6c 6a 34 68 or [0x68346a6c],al
dc Unknown opcode 0xdc
d0 ce ror dh,1
c3 ret
L05c134ad: 35 5d c0 08 8c xor eax,0x8c08c05d
20 ce and dh,cl
06 push es
b7 92 mov bh,0x92
2a 53 40 sub dl,[ebx+0x40]
37 aaa
c4 Unknown opcode 0xc4
e8 93 0b c2 34 call 0x3a834054
d8 ec fsubr st4
eb b7 jmp short 0x5c1347c
L05c134c5: 56 push esi
01 01 add [ecx],eax
da 67 86 fisub dword [edi-0x7a]
02 dd add bl,ch
f6 54 41 8c not byte [ecx+eax*2-0x74]
4f dec edi
1f pop ds
d7 xlatb
56 push esi
7f c1 jg 0x5c13498
e9 10 81 f9 01 jmp 0x7bab5ec
L05c134dc: 6c insb
bc d8 24 22 18 mov esp,0x182224d8
39 60 e7 cmp [eax-0x19],esp
dd Unknown opcode 0xdd
68 bf ee b2 24 push dword 0x24b2eebf
51 push ecx
af scasd
1d 42 72 52 4c sbb eax,0x4c527242
51 push ecx
05 06 07 fe 3b add eax,0x3bfe0706
21 3d f6 6e 77 41 and [0x41776ef6],edi
74 1a jz 0x5c1351a
2d f4 2c 05 17 sub eax,0x17052cf4
e9 f8 03 48 75 jmp 0x7b093902
L05c1350a: 3c 1d cmp al,0x1d
0b af 6c 3b cd 42 or ebp,[edi+0x42cd3b6c]
49 dec ecx
3d 7b 74 07 65 cmp eax,0x6507747b
76 1b jna 0x5c13535
L05c1351a: be 1b 57 2d 02 mov esi,0x22d571b
02 22 add ah,[edx]
18 83 2a 75 e9 f1 sbb [ebx+0xf1e9752a],al
07 pop es
L05c13528: 5c pop esp
1e push ds
c8 15 4c 17 enter 0x4c15,0x17
8c 06 mov [esi],es
18 92 cf f3 2a 4a sbb [edx+0x4a2af3cf],dl
f5 cmc
06 push es
d5 16 aad 0x16
87 1a xchg ebx,[edx]
7b 23 jpo 0x5c13561
9b wait
6f outsd
53 push ebx
1e push ds
67 19 d3 a16 sbb ebx,edx
19 22 sbb [edx],esp
0e push cs
35 06 55 e0 3c xor eax,0x3ce05506
cf iret
L05c1354e: fc cld
4e dec esi
ab stosd
3f aas
43 inc ebx
65 8e aa 54 1c 9c 02 mov gs,[gs:edx+0x29c1c54]
e5 0c in eax,0xc
fe Unknown opcode 0xfe
6c insb
9a 15 1a f8 82 50 0b call 0xb50:0x82f81a15
db 0c 8d 0c 24 56 1f fisttp word [ecx*4+0x1f56240c]
0c 31 or al,0x31
5d pop ebp
28 5a 20 sub [edx+0x20],bl
51 push ecx
a3 c1 c1 02 a4 mov [0xa402c1c1],eax
00 cd add ch,cl
bb 48 2f 0c 5c mov ebx,0x5c0c2f48
d5 01 aad 0x1
16 push ss
15 37 54 70 b6 adc eax,0xb6705437
dc Unknown opcode 0xdc
de b3 17 ce 0c 82 fidiv word [ebx+0x820cce17]
44 inc esp
52 push edx
5a pop edx
70 95 jo 0x5c13528
c0 12 69 rcl byte [edx],0x69
98 cwde
5c pop esp
9e sahf
6c insb
01 68 f8 add [eax-0x8],ebp
14 f6 adc al,0xf6
3b 34 c3 cmp esi,[ebx+eax*8]
1e push ds
6e outsb
1c 23 sbb al,0x23
c1 Unknown opcode 0xc1
33 c9 xor ecx,ecx
89 48 08 mov [eax+0x8],ecx
04 78 add al,0x78
bf 69 9a 0c 10 mov edi,0x100c9a69
14 18 adc al,0x18
c7 40 04 50 09 62 00 mov dword [eax+0x4],0x620950
bf 5a 07 4e 54 mov edi,0x544e075a
bb ff d1 c7 42 mov ebx,0x42c7d1ff
fb sti
0e push cs
bb ef 04 cc 0b mov ebx,0xbcc04ef
3c 02 cmp al,0x2
94 xchg eax,esp
ad lodsd
42 inc edx
08 9a 9a 8d 4a 80 or [edx+0x804a8d9a],bl
d3 Unknown opcode 0xd3
34 4d xor al,0x4d
7b 01 jpo 0x5c135de
89 41 04 mov [ecx+0x4],eax
04 08 add al,0x8
0c 10 or al,0x10
14 fc adc al,0xfc
80 db 4d sbb bl,0x4d
18 1c 57 sbb [edi+edx*2],bl
66 08 20 o16 or [eax],ah
b9 19 c6 7a 2e mov ecx,0x2e7ac619
f3 26 d7 es rep xlatb
da 4e 3a fimul dword [esi+0x3a]
c2 5f a9 ret 0xa95f
L05c135fd: ce into
94 xchg eax,esp
04 77 add al,0x77
e3 b7 jecxz 0x5c135ba
0c 7c or al,0x7c
85 ff test edi,edi
75 09 jnz 0x5c13612
b8 57 4c 5f c2 mov eax,0xc25f4c57
0c 26 or al,0x26
fa cli
44 inc esp
L05c13612: af scasd
01 f6 add esi,esi
bd 14 7e 0e 39 mov ebp,0x390e7e14
7b ff jpo 0x5c1361b
bf c4 15 88 0a mov edi,0xa8815c4
42 inc edx
46 inc esi
4f dec edi
75 f3 jnz 0x5c13619
4a dec edx
5e pop esi
b8 7a 46 c6 e4 mov eax,0xe4c6467a
4d dec ebp
69 88 db f7 66 06 4a 21 imul ecx,[eax+0x666f7db],dword 0x235e214a
cc int3
bf 59 e1 0d 68 mov edi,0x680de159
23 9a f1 ec 04 c7 and ebx,[edx+0xc704ecf1]
06 push es
ec in al,dx
dd 70 be fnsave [eax-0x42]
d1 ed shr ebp,1
4e dec esi
a6 cmpsb
10 d7 adc bh,dl
ce into
27 daa
dc 58 c1 fcomp qword [eax-0x3f]
1f pop ds
ca 9c fa retf 0xfa9c
L05c13658: b8 04 d2 84 c0 mov eax,0xc084d204
5e pop esi
92 xchg eax,edx
30 40 03 xor [eax+0x3],al
7e f6 jng 0x5c1365a
0c 6c or al,0x6c
f6 Unknown opcode 0xf6
0e push cs
01 44 ec 6e add [esp+ebp*8+0x6e],eax
38 bd d6 8d b4 c2 cmp [ebp+0xc2b48dd6],bh
04 00 add al,0x0
3f aas
3b 78 08 cmp edi,[eax+0x8]
39 0d 0c c7 01 f4 cmp [0xf401c70c],ecx
04 e9 add al,0xe9
85 86 ef e1 84 9f test [esi+0x9f84e1ef],eax
3b 81 c4 d2 72 05 cmp eax,[ecx+0x572d2c4]
0c c3 or al,0xc3
bd 9d 7e 44 8b mov ebp,0x8b447e9d
89 c8 mov eax,ecx
57 push edi
04 81 add al,0x81
5d pop ebp
3f aas
ae scasb
f1 int1
42 inc edx
1c 9c sbb al,0x9c
11 18 adc [eax],ebx
49 dec ecx
28 52 50 sub [edx+0x50],dl
5c pop esp
50 push eax
df bc ec fb c0 4c ec fistp qword [esp+ebp*8+0xec4cc0fb]
58 pop eax
08 00 or [eax],al
7f 3e jg 0x5c136f1
28 85 d2 74 0e 83 sub [ebp+0x830e74d2],al
3b 1d bf fb fa 63 cmp ebx,[0x63fafbbf]
75 1d jnz 0x5c136de
89 24 c0 mov [eax+eax*8],esp
4a dec edx
6c insb
L05c136c6: 6a 36 push byte +0x36
c0 5e 0f a2 rcr byte [esi+0xf],0xa2
f7 fd idiv ebp
0c fc or al,0xfc
2c 8b sub al,0x8b
c8 0c 8d cc enter 0x8d0c,0xcc
ab stosd
L05c136d7: 1f pop ds
08 8b b7 c3 17 ae or [ebx+0xae17c3b7],cl
L05c136de: 81 12 38 14 24 52 adc dword [edx],0x52241438
f0 cc lock int3
12 81 c1 87 83 ee adc al,[ecx+0xee8387c1]
71 1e jno 0x5c1370c
8a f2 mov dh,dl
f0 56 lock push esi
23 b4 d7 ca 0c 9a 50 and esi,[edi+edx*8+0x509a0cca]
10 e4 adc ah,ah
7f fb jg 0x5c136f8
af scasd
28 78 70 sub [eax+0x70],bh
40 inc eax
db 8c f9 74 30 8b 43 fisttp word [ecx+edi*8+0x438b3074]
24 8b and al,0x8b
8f 04 76 pop dword [esi+esi*2]
7c b6 jl 0x5c136c6
d3 86 08 33 50 8f rol dword [esi+0x8f503308],cl
52 push edx
3c 1f cmp al,0x1f
83 c3 0c add ebx,byte +0xc
53 push ebx
42 inc edx
7b b7 jpo 0x5c136d7
ad lodsd
51 push ecx
fc cld
3f aas
37 aaa
5c pop esp
5e pop esi
5f pop edi
5b pop ebx
9b wait
c3 ret
L05c1372b: 1a 05 09 9f 26 10 sbb al,[0x10269f09]
c7 Unknown opcode 0xc7
e7 89 out 0x89,eax
51 push ecx
b0 ac mov al,0xac
d2 89 2a 89 84 06 ror byte [ecx+0x684892a],cl
08 e1 or cl,ah
d1 bc fb 0c 8b 91 88 sar dword [ebx+edi*8+0x88918b0c],1
00 7c 14 10 add [esp+edx+0x10],bh
8c a5 f2 e0 ed 60 mov [ebp+0x60ede0f2],fs
aa stosb
5f pop edi
29 11 sub [ecx],edx
50 push eax
6c insb
0c 10 or al,0x10
30 b6 58 39 10 6e xor [esi+0x6e103958],dh
12 5e 86 adc bl,[esi-0x7a]
d1 5e 0d rcr dword [esi+0xd],1
91 xchg eax,ecx
62 Unknown opcode 0x62
c4 16 les edx,[esi]
68 4c 30 89 72 push dword 0x7289304c
08 a2 b5 f6 df 08 or [edx+0x8dff6b5],ah
8a 5e 31 mov bl,[esi+0x31]
84 db test bl,bl
75 03 jnz 0x5c1377d
89 56 2a mov [esi+0x2a],edxIs there any one of you guys can understand this code
If you need to know more i will upload the whole file..
______________
here's the link of disassembled but its only for functioning hope it helps
You must be registered to see links
Last edited:
