-
Notifications
You must be signed in to change notification settings - Fork 5
REF:EnCode
congma edited this page Mar 7, 2013
·
1 revision
The function EnCode is called when obfuscating text strings.
srun3_client: file format elf64-x86-64
Disassembly of section .text:
00000000004055c0 <EnCode>:
4055c0: 41 54 push %r12
4055c2: 49 89 d4 mov %rdx,%r12
4055c5: 55 push %rbp
4055c6: 48 89 f5 mov %rsi,%rbp
4055c9: 53 push %rbx
4055ca: 48 89 fb mov %rdi,%rbx
4055cd: 48 89 f7 mov %rsi,%rdi
4055d0: e8 db f4 ff ff callq 404ab0 <strlen@plt>
4055d5: 0f b6 0b movzbl (%rbx),%ecx
4055d8: 84 c9 test %cl,%cl
4055da: 74 5c je 405638 <EnCode+0x78>
4055dc: 8d 78 ff lea -0x1(%rax),%edi
4055df: 49 83 c4 01 add $0x1,%r12
4055e3: 89 fa mov %edi,%edx
4055e5: eb 27 jmp 40560e <EnCode+0x4e>
4055e7: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1)
4055ee: 00 00
4055f0: 41 88 4c 24 ff mov %cl,-0x1(%r12)
4055f5: 83 ea 01 sub $0x1,%edx
4055f8: 41 88 34 24 mov %sil,(%r12)
4055fc: 0f 48 d7 cmovs %edi,%edx
4055ff: 48 83 c3 01 add $0x1,%rbx
405603: 49 83 c4 02 add $0x2,%r12
405607: 0f b6 0b movzbl (%rbx),%ecx
40560a: 84 c9 test %cl,%cl
40560c: 74 2a je 405638 <EnCode+0x78>
40560e: 48 63 f2 movslq %edx,%rsi
405611: 32 4c 35 00 xor 0x0(%rbp,%rsi,1),%cl
405615: 89 c8 mov %ecx,%eax
405617: 83 e1 0f and $0xf,%ecx
40561a: c0 e8 04 shr $0x4,%al
40561d: 83 c1 36 add $0x36,%ecx
405620: 89 c6 mov %eax,%esi
405622: 83 c6 63 add $0x63,%esi
405625: f6 c2 01 test $0x1,%dl
405628: 75 c6 jne 4055f0 <EnCode+0x30>
40562a: 41 88 74 24 ff mov %sil,-0x1(%r12)
40562f: 89 ce mov %ecx,%esi
405631: eb c2 jmp 4055f5 <EnCode+0x35>
405633: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
405638: 5b pop %rbx
405639: 5d pop %rbp
40563a: 41 5c pop %r12
40563c: c3 retq
40563d: 0f 1f 00 nopl (%rax)