|
|
|
; Listing generated by Microsoft (R) Optimizing Compiler Version 19.29.30038.1
|
|
|
|
|
|
|
|
include listing.inc
|
|
|
|
|
|
|
|
INCLUDELIB MSVCRTD
|
|
|
|
INCLUDELIB OLDNAMES
|
|
|
|
|
|
|
|
msvcjmc SEGMENT
|
|
|
|
__B2D2BA86_ctype@h DB 01H
|
|
|
|
__79C7FC57_basetsd@h DB 01H
|
|
|
|
__1FEB9909_corecrt_memcpy_s@h DB 01H
|
|
|
|
__A751F051_corecrt_memory@h DB 01H
|
|
|
|
__9200769A_corecrt_wstring@h DB 01H
|
|
|
|
__32E5F013_string@h DB 01H
|
|
|
|
__D545DD43_guiddef@h DB 01H
|
|
|
|
__D5DDFBF3_winnt@h DB 01H
|
|
|
|
__439612F0_processthreadsapi@h DB 01H
|
|
|
|
__5733279A_memoryapi@h DB 01H
|
|
|
|
__D4435474_winerror@h DB 01H
|
|
|
|
__B3ED30D4_winbase@h DB 01H
|
|
|
|
__DB057BA3_winuser@h DB 01H
|
|
|
|
__A7113148_winioctl@h DB 01H
|
|
|
|
__B49664B7_stdlib@h DB 01H
|
|
|
|
__EC5BC72C_propidl@h DB 01H
|
|
|
|
__6DA674A0_oleauto@h DB 01H
|
|
|
|
__A118E6DC_stralign@h DB 01H
|
|
|
|
__02E23235_vcruntime_new@h DB 01H
|
|
|
|
__A2143F22_corecrt_stdio_config@h DB 01H
|
|
|
|
__829E1958_corecrt_wstdio@h DB 01H
|
|
|
|
__6DFAE8B8_stdio@h DB 01H
|
|
|
|
__C6E16F6F_corecrt_wconio@h DB 01H
|
|
|
|
__6D390390_corecrt_wio@h DB 01H
|
|
|
|
__1157D6BA_corecrt_wtime@h DB 01H
|
|
|
|
__1DC1E279_stat@h DB 01H
|
|
|
|
__93DC0B45_wchar@h DB 01H
|
|
|
|
__256B8DBF_cstddef DB 01H
|
|
|
|
__741AE07E_corecrt_math@h DB 01H
|
|
|
|
__80A05712_cstdlib DB 01H
|
|
|
|
__44860E64_limits DB 01H
|
|
|
|
__D1154D4E_type_traits DB 01H
|
|
|
|
__20BB4341_malloc@h DB 01H
|
|
|
|
__BDCC0984_vcruntime_exception@h DB 01H
|
|
|
|
__89F7010A_exception DB 01H
|
|
|
|
__7CE971A6_xutility DB 01H
|
|
|
|
__DD38B15A_xmemory DB 01H
|
|
|
|
__CB45C7EF_tuple DB 01H
|
|
|
|
__3033C7F7_xpolymorphic_allocator@h DB 01H
|
|
|
|
__A9EB37C6_xstring DB 01H
|
|
|
|
__8CFB8476_string DB 01H
|
|
|
|
__6D66DEAE_cmath DB 01H
|
|
|
|
__00B93B57_stdexcept DB 01H
|
|
|
|
__79ECA8A5_xcall_once@h DB 01H
|
|
|
|
__A0B61CF9_time@h DB 01H
|
|
|
|
__8476F639_xthreads@h DB 01H
|
|
|
|
__2FB352A6_atomic DB 01H
|
|
|
|
__C6B1BA85_system_error DB 01H
|
|
|
|
__65F43743_vcruntime_typeinfo@h DB 01H
|
|
|
|
__0C3682BF_typeinfo DB 01H
|
|
|
|
__F82802EA_memory DB 01H
|
|
|
|
__D46D55E5_xfacet DB 01H
|
|
|
|
__13BF6177_xlocinfo DB 01H
|
|
|
|
__76D543F7_xlocale DB 01H
|
|
|
|
__2A5A1664_xiosbase DB 01H
|
|
|
|
__E85225E0_xlocnum DB 01H
|
|
|
|
__FD1AE8DD_ios DB 01H
|
|
|
|
__C33030D8_xlocmon DB 01H
|
|
|
|
__B7A2C865_xloctime DB 01H
|
|
|
|
__8660297E_xed-util@h DB 01H
|
|
|
|
__F79B480A_xed-iform-map@h DB 01H
|
|
|
|
__F5B5218E_xed-inst@h DB 01H
|
|
|
|
__68D74A7D_xed-flags@h DB 01H
|
|
|
|
__A4B65E9F_xed-operand-accessors@h DB 01H
|
|
|
|
__E8B35E51_xed-state@h DB 01H
|
|
|
|
__1E3F2A25_xed-encode@h DB 01H
|
|
|
|
__1C89993E_xed-encoder-hl@h DB 01H
|
|
|
|
__0AA8C18B_xed-decoded-inst-api@h DB 01H
|
|
|
|
__A8BC9087_OpaqueBranching@cpp DB 01H
|
|
|
|
__0615AC09_istream DB 01H
|
|
|
|
__65C59933_ostream DB 01H
|
|
|
|
__021983EB_streambuf DB 01H
|
|
|
|
__6D45C6E6_iterator DB 01H
|
|
|
|
__886FDBE2_iosfwd DB 01H
|
|
|
|
__B7ADD299_utility DB 01H
|
|
|
|
__40B2458B_xstddef DB 01H
|
|
|
|
__83FB8DDC_xatomic@h DB 01H
|
|
|
|
msvcjmc ENDS
|
|
|
|
PUBLIC ?__empty_global_delete@@YAXPEAX@Z ; __empty_global_delete
|
|
|
|
PUBLIC ?__empty_global_delete@@YAXPEAX_K@Z ; __empty_global_delete
|
|
|
|
PUBLIC ?__empty_global_delete@@YAXPEAXW4align_val_t@std@@@Z ; __empty_global_delete
|
|
|
|
PUBLIC ?__empty_global_delete@@YAXPEAX_KW4align_val_t@std@@@Z ; __empty_global_delete
|
|
|
|
PUBLIC wmemcpy
|
|
|
|
PUBLIC ??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z ; std::_Maklocstr<wchar_t>
|
|
|
|
PUBLIC ?_Maklocwcs@std@@YAPEA_WPEB_W@Z ; std::_Maklocwcs
|
|
|
|
PUBLIC ??$_Maklocstr@D@std@@YAPEADPEBDPEADAEBU_Cvtvec@@@Z ; std::_Maklocstr<char>
|
|
|
|
PUBLIC ??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z ; std::time_get<char,std::istreambuf_iterator<char,std::char_traits<char> > >::_Getvals<wchar_t>
|
|
|
|
PUBLIC ??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z ; std::time_get<wchar_t,std::istreambuf_iterator<wchar_t,std::char_traits<wchar_t> > >::_Getvals<wchar_t>
|
|
|
|
PUBLIC ??_G_NATIVE_CODE_LINK@@QEAAPEAXI@Z ; _NATIVE_CODE_LINK::`scalar deleting destructor'
|
|
|
|
PUBLIC ?ObfGetRandomJccClass@@YA?AW4xed_iclass_enum_t@@XZ ; ObfGetRandomJccClass
|
|
|
|
PUBLIC ?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z ; ObfGenRandomJcc
|
|
|
|
PUBLIC ?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z ; ObfGenJmpToLabel
|
|
|
|
PUBLIC ?ObfCreateOpaqueBranches@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@1@Z ; ObfCreateOpaqueBranches
|
|
|
|
PUBLIC ?ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z ; ObfCombineOpaqueBranches
|
|
|
|
PUBLIC ?ObfInsertOpaqueBranchBlock@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@@Z ; ObfInsertOpaqueBranchBlock
|
|
|
|
PUBLIC __JustMyCode_Default
|
|
|
|
PUBLIC ??_C@_0GI@LEPEPCM@C?3?2Program?5Files?5?$CIx86?$CJ?2Microsof@ ; `string'
|
|
|
|
PUBLIC ?__LINE__Var@?0??_Maklocwcs@std@@YAPEA_WPEB_W@Z@4JA ; `std::_Maklocwcs'::`1'::__LINE__Var
|
|
|
|
PUBLIC ??_C@_0GI@IIACENIN@C?3?2Program?5Files?5?$CIx86?$CJ?2Microsof@ ; `string'
|
|
|
|
PUBLIC ??_C@_0N@LPFKKEBD@?3AM?3am?3PM?3pm@ ; `string'
|
|
|
|
PUBLIC ??_C@_1BK@MHIKGOKE@?$AA?3?$AAA?$AAM?$AA?3?$AAa?$AAm?$AA?3?$AAP?$AAM?$AA?3?$AAp?$AAm@ ; `string'
|
|
|
|
EXTRN ??2@YAPEAX_K@Z:PROC ; operator new
|
|
|
|
EXTRN ??3@YAXPEAX_K@Z:PROC ; operator delete
|
|
|
|
EXTRN memcpy:PROC
|
|
|
|
EXTRN __imp_wcslen:PROC
|
|
|
|
EXTRN strlen:PROC
|
|
|
|
EXTRN __imp_rand:PROC
|
|
|
|
EXTRN __imp__calloc_dbg:PROC
|
|
|
|
EXTRN ?_Xbad_alloc@std@@YAXXZ:PROC ; std::_Xbad_alloc
|
|
|
|
EXTRN _Mbrtowc:PROC
|
|
|
|
EXTRN __imp_?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ:PROC
|
|
|
|
EXTRN __imp_?_Getdays@_Locinfo@std@@QEBAPEBDXZ:PROC
|
|
|
|
EXTRN __imp_?_Getmonths@_Locinfo@std@@QEBAPEBDXZ:PROC
|
|
|
|
EXTRN __imp_?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ:PROC
|
|
|
|
EXTRN __imp_?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ:PROC
|
|
|
|
EXTRN xed_decode:PROC
|
|
|
|
EXTRN xed_encoder_request_zero_set_mode:PROC
|
|
|
|
EXTRN xed_encode:PROC
|
|
|
|
EXTRN xed_convert_to_encoder_request:PROC
|
|
|
|
EXTRN ??0_NATIVE_CODE_LINK@@QEAA@KPEAU_NATIVE_CODE_BLOCK@@@Z:PROC ; _NATIVE_CODE_LINK::_NATIVE_CODE_LINK
|
|
|
|
EXTRN ??0_NATIVE_CODE_LINK@@QEAA@KPEAXKH@Z:PROC ; _NATIVE_CODE_LINK::_NATIVE_CODE_LINK
|
|
|
|
EXTRN ??1_NATIVE_CODE_LINK@@QEAA@XZ:PROC ; _NATIVE_CODE_LINK::~_NATIVE_CODE_LINK
|
|
|
|
EXTRN ?NcAppendToBlock@@YAXPEAU_NATIVE_CODE_BLOCK@@PEAU_NATIVE_CODE_LINK@@@Z:PROC ; NcAppendToBlock
|
|
|
|
EXTRN ?NcPrependToBlock@@YAXPEAU_NATIVE_CODE_BLOCK@@PEAU_NATIVE_CODE_LINK@@@Z:PROC ; NcPrependToBlock
|
|
|
|
EXTRN ?NcInsertBlockAfter@@YAHPEAU_NATIVE_CODE_LINK@@PEAU_NATIVE_CODE_BLOCK@@H@Z:PROC ; NcInsertBlockAfter
|
|
|
|
EXTRN ?NcDeepCopyPartialBlock@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@@Z:PROC ; NcDeepCopyPartialBlock
|
|
|
|
EXTRN _RTC_CheckStackVars:PROC
|
|
|
|
EXTRN _RTC_InitBase:PROC
|
|
|
|
EXTRN _RTC_Shutdown:PROC
|
|
|
|
EXTRN __CheckForDebuggerJustMyCode:PROC
|
|
|
|
EXTRN __CxxFrameHandler4:PROC
|
|
|
|
EXTRN __GSHandlerCheck:PROC
|
|
|
|
EXTRN __GSHandlerCheck_EH4:PROC
|
|
|
|
EXTRN __security_check_cookie:PROC
|
|
|
|
EXTRN __ImageBase:BYTE
|
|
|
|
EXTRN __security_cookie:QWORD
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?__empty_global_delete@@YAXPEAX@Z DD imagerel $LN3
|
|
|
|
DD imagerel $LN3+41
|
|
|
|
DD imagerel $unwind$?__empty_global_delete@@YAXPEAX@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?__empty_global_delete@@YAXPEAX_K@Z DD imagerel $LN3
|
|
|
|
DD imagerel $LN3+46
|
|
|
|
DD imagerel $unwind$?__empty_global_delete@@YAXPEAX_K@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?__empty_global_delete@@YAXPEAXW4align_val_t@std@@@Z DD imagerel $LN3
|
|
|
|
DD imagerel $LN3+46
|
|
|
|
DD imagerel $unwind$?__empty_global_delete@@YAXPEAXW4align_val_t@std@@@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?__empty_global_delete@@YAXPEAX_KW4align_val_t@std@@@Z DD imagerel $LN3
|
|
|
|
DD imagerel $LN3+51
|
|
|
|
DD imagerel $unwind$?__empty_global_delete@@YAXPEAX_KW4align_val_t@std@@@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$wmemcpy DD imagerel $LN3
|
|
|
|
DD imagerel $LN3+83
|
|
|
|
DD imagerel $unwind$wmemcpy
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z DD imagerel $LN12
|
|
|
|
DD imagerel $LN12+586
|
|
|
|
DD imagerel $unwind$??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?_Maklocwcs@std@@YAPEA_WPEB_W@Z DD imagerel $LN4
|
|
|
|
DD imagerel $LN4+142
|
|
|
|
DD imagerel $unwind$?_Maklocwcs@std@@YAPEA_WPEB_W@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$??$_Maklocstr@D@std@@YAPEADPEBDPEADAEBU_Cvtvec@@@Z DD imagerel $LN7
|
|
|
|
DD imagerel $LN7+200
|
|
|
|
DD imagerel $unwind$??$_Maklocstr@D@std@@YAPEADPEBDPEADAEBU_Cvtvec@@@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z DD imagerel $LN5
|
|
|
|
DD imagerel $LN5+356
|
|
|
|
DD imagerel $unwind$??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z DD imagerel $LN5
|
|
|
|
DD imagerel $LN5+356
|
|
|
|
DD imagerel $unwind$??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$xed_relbr DD imagerel xed_relbr
|
|
|
|
DD imagerel xed_relbr+184
|
|
|
|
DD imagerel $unwind$xed_relbr
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$xed_inst1 DD imagerel xed_inst1
|
|
|
|
DD imagerel xed_inst1+184
|
|
|
|
DD imagerel $unwind$xed_inst1
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$??_G_NATIVE_CODE_LINK@@QEAAPEAXI@Z DD imagerel $LN4
|
|
|
|
DD imagerel $LN4+82
|
|
|
|
DD imagerel $unwind$??_G_NATIVE_CODE_LINK@@QEAAPEAXI@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?ObfGetRandomJccClass@@YA?AW4xed_iclass_enum_t@@XZ DD imagerel $LN21
|
|
|
|
DD imagerel $LN21+268
|
|
|
|
DD imagerel $unwind$?ObfGetRandomJccClass@@YA?AW4xed_iclass_enum_t@@XZ
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z DD imagerel $LN11
|
|
|
|
DD imagerel $LN11+617
|
|
|
|
DD imagerel $unwind$?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?dtor$0@?0??ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA DD imagerel ?dtor$0@?0??ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA
|
|
|
|
DD imagerel ?dtor$0@?0??ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA+44
|
|
|
|
DD imagerel $unwind$?dtor$0@?0??ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z DD imagerel $LN11
|
|
|
|
DD imagerel $LN11+591
|
|
|
|
DD imagerel $unwind$?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?dtor$0@?0??ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA DD imagerel ?dtor$0@?0??ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA
|
|
|
|
DD imagerel ?dtor$0@?0??ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA+44
|
|
|
|
DD imagerel $unwind$?dtor$0@?0??ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?ObfCreateOpaqueBranches@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@1@Z DD imagerel $LN5
|
|
|
|
DD imagerel $LN5+144
|
|
|
|
DD imagerel $unwind$?ObfCreateOpaqueBranches@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@1@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z DD imagerel $LN13
|
|
|
|
DD imagerel $LN13+477
|
|
|
|
DD imagerel $unwind$?ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?dtor$0@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA DD imagerel ?dtor$0@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA
|
|
|
|
DD imagerel ?dtor$0@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA+44
|
|
|
|
DD imagerel $unwind$?dtor$0@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?dtor$1@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA DD imagerel ?dtor$1@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA
|
|
|
|
DD imagerel ?dtor$1@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA+44
|
|
|
|
DD imagerel $unwind$?dtor$1@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT pdata
|
|
|
|
pdata SEGMENT
|
|
|
|
$pdata$?ObfInsertOpaqueBranchBlock@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@@Z DD imagerel $LN13
|
|
|
|
DD imagerel $LN13+377
|
|
|
|
DD imagerel $unwind$?ObfInsertOpaqueBranchBlock@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@@Z
|
|
|
|
pdata ENDS
|
|
|
|
; COMDAT rtc$TMZ
|
|
|
|
rtc$TMZ SEGMENT
|
|
|
|
_RTC_Shutdown.rtc$TMZ DQ FLAT:_RTC_Shutdown
|
|
|
|
rtc$TMZ ENDS
|
|
|
|
; COMDAT rtc$IMZ
|
|
|
|
rtc$IMZ SEGMENT
|
|
|
|
_RTC_InitBase.rtc$IMZ DQ FLAT:_RTC_InitBase
|
|
|
|
rtc$IMZ ENDS
|
|
|
|
; COMDAT ??_C@_1BK@MHIKGOKE@?$AA?3?$AAA?$AAM?$AA?3?$AAa?$AAm?$AA?3?$AAP?$AAM?$AA?3?$AAp?$AAm@
|
|
|
|
CONST SEGMENT
|
|
|
|
??_C@_1BK@MHIKGOKE@?$AA?3?$AAA?$AAM?$AA?3?$AAa?$AAm?$AA?3?$AAP?$AAM?$AA?3?$AAp?$AAm@ DB ':'
|
|
|
|
DB 00H, 'A', 00H, 'M', 00H, ':', 00H, 'a', 00H, 'm', 00H, ':', 00H
|
|
|
|
DB 'P', 00H, 'M', 00H, ':', 00H, 'p', 00H, 'm', 00H, 00H, 00H ; `string'
|
|
|
|
CONST ENDS
|
|
|
|
; COMDAT ??_C@_0N@LPFKKEBD@?3AM?3am?3PM?3pm@
|
|
|
|
CONST SEGMENT
|
|
|
|
??_C@_0N@LPFKKEBD@?3AM?3am?3PM?3pm@ DB ':AM:am:PM:pm', 00H ; `string'
|
|
|
|
CONST ENDS
|
|
|
|
; COMDAT ??_C@_0GI@IIACENIN@C?3?2Program?5Files?5?$CIx86?$CJ?2Microsof@
|
|
|
|
CONST SEGMENT
|
|
|
|
??_C@_0GI@IIACENIN@C?3?2Program?5Files?5?$CIx86?$CJ?2Microsof@ DB 'C:\Pro'
|
|
|
|
DB 'gram Files (x86)\Microsoft Visual Studio\2019\Community\VC\To'
|
|
|
|
DB 'ols\MSVC\14.29.30037\include\xlocnum', 00H ; `string'
|
|
|
|
CONST ENDS
|
|
|
|
; COMDAT ?__LINE__Var@?0??_Maklocwcs@std@@YAPEA_WPEB_W@Z@4JA
|
|
|
|
_DATA SEGMENT
|
|
|
|
?__LINE__Var@?0??_Maklocwcs@std@@YAPEA_WPEB_W@Z@4JA DD 05aH ; `std::_Maklocwcs'::`1'::__LINE__Var
|
|
|
|
_DATA ENDS
|
|
|
|
; COMDAT ??_C@_0GI@LEPEPCM@C?3?2Program?5Files?5?$CIx86?$CJ?2Microsof@
|
|
|
|
CONST SEGMENT
|
|
|
|
??_C@_0GI@LEPEPCM@C?3?2Program?5Files?5?$CIx86?$CJ?2Microsof@ DB 'C:\Prog'
|
|
|
|
DB 'ram Files (x86)\Microsoft Visual Studio\2019\Community\VC\Too'
|
|
|
|
DB 'ls\MSVC\14.29.30037\include\xlocale', 00H ; `string'
|
|
|
|
CONST ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?ObfInsertOpaqueBranchBlock@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@@Z DD 025051d01H
|
|
|
|
DD 0118231dH
|
|
|
|
DD 070110031H
|
|
|
|
DD 05010H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT voltbl
|
|
|
|
voltbl SEGMENT
|
|
|
|
_volmd DB 00H
|
|
|
|
DB 05H
|
|
|
|
voltbl ENDS
|
|
|
|
; COMDAT voltbl
|
|
|
|
voltbl SEGMENT
|
|
|
|
_volmd DB 00H
|
|
|
|
DB 05H
|
|
|
|
voltbl ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?dtor$1@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA DD 031001H
|
|
|
|
DD 0700c4210H
|
|
|
|
DD 0500bH
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?dtor$0@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA DD 031001H
|
|
|
|
DD 0700c4210H
|
|
|
|
DD 0500bH
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$ip2state$?ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z DB 0aH
|
|
|
|
DB 00H
|
|
|
|
DB 00H
|
|
|
|
DB 'u', 03H
|
|
|
|
DB 02H
|
|
|
|
DB 08aH
|
|
|
|
DB 00H
|
|
|
|
DB 'H'
|
|
|
|
DB 04H
|
|
|
|
DB 08aH
|
|
|
|
DB 00H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$stateUnwindMap$?ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z DB 04H
|
|
|
|
DB 0eH
|
|
|
|
DD imagerel ?dtor$0@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA
|
|
|
|
DB 036H
|
|
|
|
DD imagerel ?dtor$1@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$cppxdata$?ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z DB 028H
|
|
|
|
DD imagerel $stateUnwindMap$?ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z
|
|
|
|
DD imagerel $ip2state$?ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z DD 025052211H
|
|
|
|
DD 011d2322H
|
|
|
|
DD 070160039H
|
|
|
|
DD 05015H
|
|
|
|
DD imagerel __CxxFrameHandler4
|
|
|
|
DD imagerel $cppxdata$?ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?ObfCreateOpaqueBranches@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@1@Z DD 025052201H
|
|
|
|
DD 011d2322H
|
|
|
|
DD 07016001fH
|
|
|
|
DD 05015H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT voltbl
|
|
|
|
voltbl SEGMENT
|
|
|
|
_volmd DB 00H
|
|
|
|
DB 05H
|
|
|
|
voltbl ENDS
|
|
|
|
; COMDAT voltbl
|
|
|
|
voltbl SEGMENT
|
|
|
|
_volmd DW 039H
|
|
|
|
DW 0235H
|
|
|
|
voltbl ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?dtor$0@?0??ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA DD 031001H
|
|
|
|
DD 0700c4210H
|
|
|
|
DD 0500bH
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$ip2state$?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z DB 06H
|
|
|
|
DB 00H
|
|
|
|
DB 00H
|
|
|
|
DB 0adH, 04H
|
|
|
|
DB 02H
|
|
|
|
DB 0a6H
|
|
|
|
DB 00H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$stateUnwindMap$?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z DB 02H
|
|
|
|
DB 0eH
|
|
|
|
DD imagerel ?dtor$0@?0??ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$cppxdata$?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z DB 028H
|
|
|
|
DD imagerel $stateUnwindMap$?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z
|
|
|
|
DD imagerel $ip2state$?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z DD 035064019H
|
|
|
|
DD 01123317H
|
|
|
|
DD 0700b00e0H
|
|
|
|
DD 05009600aH
|
|
|
|
DD imagerel __GSHandlerCheck_EH4
|
|
|
|
DD imagerel $cppxdata$?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z
|
|
|
|
DD 06f2H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT CONST
|
|
|
|
CONST SEGMENT
|
|
|
|
?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$0 DB 04dH ; ObfGenJmpToLabel
|
|
|
|
DB 061H
|
|
|
|
DB 063H
|
|
|
|
DB 068H
|
|
|
|
DB 069H
|
|
|
|
DB 06eH
|
|
|
|
DB 065H
|
|
|
|
DB 053H
|
|
|
|
DB 074H
|
|
|
|
DB 061H
|
|
|
|
DB 074H
|
|
|
|
DB 065H
|
|
|
|
DB 00H
|
|
|
|
ORG $+3
|
|
|
|
?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$1 DB 045H ; ObfGenJmpToLabel
|
|
|
|
DB 06eH
|
|
|
|
DB 063H
|
|
|
|
DB 06fH
|
|
|
|
DB 064H
|
|
|
|
DB 065H
|
|
|
|
DB 072H
|
|
|
|
DB 049H
|
|
|
|
DB 06eH
|
|
|
|
DB 073H
|
|
|
|
DB 074H
|
|
|
|
DB 072H
|
|
|
|
DB 075H
|
|
|
|
DB 063H
|
|
|
|
DB 074H
|
|
|
|
DB 069H
|
|
|
|
DB 06fH
|
|
|
|
DB 06eH
|
|
|
|
DB 00H
|
|
|
|
ORG $+5
|
|
|
|
?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$2 DB 045H ; ObfGenJmpToLabel
|
|
|
|
DB 06eH
|
|
|
|
DB 063H
|
|
|
|
DB 06fH
|
|
|
|
DB 064H
|
|
|
|
DB 065H
|
|
|
|
DB 072H
|
|
|
|
DB 052H
|
|
|
|
DB 065H
|
|
|
|
DB 071H
|
|
|
|
DB 075H
|
|
|
|
DB 065H
|
|
|
|
DB 073H
|
|
|
|
DB 074H
|
|
|
|
DB 00H
|
|
|
|
ORG $+1
|
|
|
|
?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$3 DB 045H ; ObfGenJmpToLabel
|
|
|
|
DB 06eH
|
|
|
|
DB 063H
|
|
|
|
DB 06fH
|
|
|
|
DB 064H
|
|
|
|
DB 065H
|
|
|
|
DB 042H
|
|
|
|
DB 075H
|
|
|
|
DB 066H
|
|
|
|
DB 066H
|
|
|
|
DB 065H
|
|
|
|
DB 072H
|
|
|
|
DB 00H
|
|
|
|
ORG $+3
|
|
|
|
?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$4 DB 052H ; ObfGenJmpToLabel
|
|
|
|
DB 065H
|
|
|
|
DB 074H
|
|
|
|
DB 075H
|
|
|
|
DB 072H
|
|
|
|
DB 06eH
|
|
|
|
DB 065H
|
|
|
|
DB 064H
|
|
|
|
DB 053H
|
|
|
|
DB 069H
|
|
|
|
DB 07aH
|
|
|
|
DB 065H
|
|
|
|
DB 00H
|
|
|
|
ORG $+11
|
|
|
|
?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcVarDesc DD 0324H ; ObfGenJmpToLabel
|
|
|
|
DD 04H
|
|
|
|
DQ FLAT:?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$4
|
|
|
|
DD 02f8H
|
|
|
|
DD 0fH
|
|
|
|
DQ FLAT:?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$3
|
|
|
|
DD 0220H
|
|
|
|
DD 0c0H
|
|
|
|
DQ FLAT:?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$2
|
|
|
|
DD 060H
|
|
|
|
DD 01a0H
|
|
|
|
DQ FLAT:?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$1
|
|
|
|
DD 038H
|
|
|
|
DD 08H
|
|
|
|
DQ FLAT:?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$0
|
|
|
|
ORG $+240
|
|
|
|
?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcFrameData DD 05H ; ObfGenJmpToLabel
|
|
|
|
DD 00H
|
|
|
|
DQ FLAT:?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcVarDesc
|
|
|
|
CONST ENDS
|
|
|
|
; COMDAT voltbl
|
|
|
|
voltbl SEGMENT
|
|
|
|
_volmd DB 00H
|
|
|
|
DB 05H
|
|
|
|
voltbl ENDS
|
|
|
|
; COMDAT voltbl
|
|
|
|
voltbl SEGMENT
|
|
|
|
_volmd DW 039H
|
|
|
|
DW 024fH
|
|
|
|
voltbl ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?dtor$0@?0??ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA DD 031001H
|
|
|
|
DD 0700c4210H
|
|
|
|
DD 0500bH
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$ip2state$?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z DB 06H
|
|
|
|
DB 00H
|
|
|
|
DB 00H
|
|
|
|
DB 015H, 05H
|
|
|
|
DB 02H
|
|
|
|
DB 0a6H
|
|
|
|
DB 00H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$stateUnwindMap$?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z DB 02H
|
|
|
|
DB 0eH
|
|
|
|
DD imagerel ?dtor$0@?0??ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$cppxdata$?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z DB 028H
|
|
|
|
DD imagerel $stateUnwindMap$?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z
|
|
|
|
DD imagerel $ip2state$?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z DD 035064019H
|
|
|
|
DD 01123317H
|
|
|
|
DD 0700b00e4H
|
|
|
|
DD 05009600aH
|
|
|
|
DD imagerel __GSHandlerCheck_EH4
|
|
|
|
DD imagerel $cppxdata$?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z
|
|
|
|
DD 0712H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT CONST
|
|
|
|
CONST SEGMENT
|
|
|
|
?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$0 DB 04dH ; ObfGenRandomJcc
|
|
|
|
DB 061H
|
|
|
|
DB 063H
|
|
|
|
DB 068H
|
|
|
|
DB 069H
|
|
|
|
DB 06eH
|
|
|
|
DB 065H
|
|
|
|
DB 053H
|
|
|
|
DB 074H
|
|
|
|
DB 061H
|
|
|
|
DB 074H
|
|
|
|
DB 065H
|
|
|
|
DB 00H
|
|
|
|
ORG $+3
|
|
|
|
?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$1 DB 045H ; ObfGenRandomJcc
|
|
|
|
DB 06eH
|
|
|
|
DB 063H
|
|
|
|
DB 06fH
|
|
|
|
DB 064H
|
|
|
|
DB 065H
|
|
|
|
DB 072H
|
|
|
|
DB 049H
|
|
|
|
DB 06eH
|
|
|
|
DB 073H
|
|
|
|
DB 074H
|
|
|
|
DB 072H
|
|
|
|
DB 075H
|
|
|
|
DB 063H
|
|
|
|
DB 074H
|
|
|
|
DB 069H
|
|
|
|
DB 06fH
|
|
|
|
DB 06eH
|
|
|
|
DB 00H
|
|
|
|
ORG $+5
|
|
|
|
?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$2 DB 045H ; ObfGenRandomJcc
|
|
|
|
DB 06eH
|
|
|
|
DB 063H
|
|
|
|
DB 06fH
|
|
|
|
DB 064H
|
|
|
|
DB 065H
|
|
|
|
DB 072H
|
|
|
|
DB 052H
|
|
|
|
DB 065H
|
|
|
|
DB 071H
|
|
|
|
DB 075H
|
|
|
|
DB 065H
|
|
|
|
DB 073H
|
|
|
|
DB 074H
|
|
|
|
DB 00H
|
|
|
|
ORG $+1
|
|
|
|
?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$3 DB 045H ; ObfGenRandomJcc
|
|
|
|
DB 06eH
|
|
|
|
DB 063H
|
|
|
|
DB 06fH
|
|
|
|
DB 064H
|
|
|
|
DB 065H
|
|
|
|
DB 042H
|
|
|
|
DB 075H
|
|
|
|
DB 066H
|
|
|
|
DB 066H
|
|
|
|
DB 065H
|
|
|
|
DB 072H
|
|
|
|
DB 00H
|
|
|
|
ORG $+3
|
|
|
|
?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$4 DB 052H ; ObfGenRandomJcc
|
|
|
|
DB 065H
|
|
|
|
DB 074H
|
|
|
|
DB 075H
|
|
|
|
DB 072H
|
|
|
|
DB 06eH
|
|
|
|
DB 065H
|
|
|
|
DB 064H
|
|
|
|
DB 053H
|
|
|
|
DB 069H
|
|
|
|
DB 07aH
|
|
|
|
DB 065H
|
|
|
|
DB 00H
|
|
|
|
ORG $+11
|
|
|
|
?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcVarDesc DD 0324H ; ObfGenRandomJcc
|
|
|
|
DD 04H
|
|
|
|
DQ FLAT:?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$4
|
|
|
|
DD 02f8H
|
|
|
|
DD 0fH
|
|
|
|
DQ FLAT:?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$3
|
|
|
|
DD 0220H
|
|
|
|
DD 0c0H
|
|
|
|
DQ FLAT:?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$2
|
|
|
|
DD 060H
|
|
|
|
DD 01a0H
|
|
|
|
DQ FLAT:?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$1
|
|
|
|
DD 038H
|
|
|
|
DD 08H
|
|
|
|
DQ FLAT:?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcName$0
|
|
|
|
ORG $+240
|
|
|
|
?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcFrameData DD 05H ; ObfGenRandomJcc
|
|
|
|
DD 00H
|
|
|
|
DQ FLAT:?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcVarDesc
|
|
|
|
CONST ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?ObfGetRandomJccClass@@YA?AW4xed_iclass_enum_t@@XZ DD 025050f01H
|
|
|
|
DD 010a230fH
|
|
|
|
DD 07003001fH
|
|
|
|
DD 05002H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$??_G_NATIVE_CODE_LINK@@QEAAPEAXI@Z DD 025051701H
|
|
|
|
DD 01122317H
|
|
|
|
DD 0700b001dH
|
|
|
|
DD 0500aH
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$xed_inst1 DD 025062301H
|
|
|
|
DD 011e2323H
|
|
|
|
DD 07017001cH
|
|
|
|
DD 050156016H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT voltbl
|
|
|
|
voltbl SEGMENT
|
|
|
|
_volmd DB 040H
|
|
|
|
DB 09eH
|
|
|
|
voltbl ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$xed_relbr DD 025064719H
|
|
|
|
DD 0118231dH
|
|
|
|
DD 070110026H
|
|
|
|
DD 0500f6010H
|
|
|
|
DD imagerel __GSHandlerCheck
|
|
|
|
DD 0128H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT CONST
|
|
|
|
CONST SEGMENT
|
|
|
|
xed_relbr$rtcName$0 DB 06fH
|
|
|
|
DB 00H
|
|
|
|
ORG $+14
|
|
|
|
xed_relbr$rtcVarDesc DD 028H
|
|
|
|
DD 030H
|
|
|
|
DQ FLAT:xed_relbr$rtcName$0
|
|
|
|
ORG $+48
|
|
|
|
xed_relbr$rtcFrameData DD 01H
|
|
|
|
DD 00H
|
|
|
|
DQ FLAT:xed_relbr$rtcVarDesc
|
|
|
|
CONST ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z DD 025061e01H
|
|
|
|
DD 0119231eH
|
|
|
|
DD 070120026H
|
|
|
|
DD 050106011H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z DD 025061e01H
|
|
|
|
DD 0119231eH
|
|
|
|
DD 070120026H
|
|
|
|
DD 050106011H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$??$_Maklocstr@D@std@@YAPEADPEBDPEADAEBU_Cvtvec@@@Z DD 035051d01H
|
|
|
|
DD 0118331dH
|
|
|
|
DD 07011002bH
|
|
|
|
DD 05010H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?_Maklocwcs@std@@YAPEA_WPEB_W@Z DD 035051301H
|
|
|
|
DD 010e3313H
|
|
|
|
DD 070070027H
|
|
|
|
DD 05006H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT voltbl
|
|
|
|
voltbl SEGMENT
|
|
|
|
_volmd DW 040H
|
|
|
|
DW 0231H
|
|
|
|
voltbl ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z DD 035054719H
|
|
|
|
DD 0118331dH
|
|
|
|
DD 070110047H
|
|
|
|
DD 05010H
|
|
|
|
DD imagerel __GSHandlerCheck
|
|
|
|
DD 0228H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT CONST
|
|
|
|
CONST SEGMENT
|
|
|
|
??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z$rtcName$0 DB 05fH ; std::_Maklocstr<wchar_t>
|
|
|
|
DB 057H
|
|
|
|
DB 063H
|
|
|
|
DB 00H
|
|
|
|
??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z$rtcName$1 DB 05fH ; std::_Maklocstr<wchar_t>
|
|
|
|
DB 04dH
|
|
|
|
DB 062H
|
|
|
|
DB 073H
|
|
|
|
DB 074H
|
|
|
|
DB 031H
|
|
|
|
DB 00H
|
|
|
|
ORG $+1
|
|
|
|
??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z$rtcName$2 DB 05fH ; std::_Maklocstr<wchar_t>
|
|
|
|
DB 04dH
|
|
|
|
DB 062H
|
|
|
|
DB 073H
|
|
|
|
DB 074H
|
|
|
|
DB 032H
|
|
|
|
DB 00H
|
|
|
|
ORG $+13
|
|
|
|
??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z$rtcVarDesc DD 0158H ; std::_Maklocstr<wchar_t>
|
|
|
|
DD 08H
|
|
|
|
DQ FLAT:??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z$rtcName$2
|
|
|
|
DD 0f8H
|
|
|
|
DD 08H
|
|
|
|
DQ FLAT:??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z$rtcName$1
|
|
|
|
DD 0d4H
|
|
|
|
DD 02H
|
|
|
|
DQ FLAT:??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z$rtcName$0
|
|
|
|
ORG $+144
|
|
|
|
??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z$rtcFrameData DD 03H ; std::_Maklocstr<wchar_t>
|
|
|
|
DD 00H
|
|
|
|
DQ FLAT:??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z$rtcVarDesc
|
|
|
|
CONST ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$wmemcpy DD 025051d01H
|
|
|
|
DD 0118231dH
|
|
|
|
DD 07011001dH
|
|
|
|
DD 05010H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?__empty_global_delete@@YAXPEAX_KW4align_val_t@std@@@Z DD 025051d01H
|
|
|
|
DD 0118231dH
|
|
|
|
DD 07011001dH
|
|
|
|
DD 05010H
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?__empty_global_delete@@YAXPEAXW4align_val_t@std@@@Z DD 025051801H
|
|
|
|
DD 01132318H
|
|
|
|
DD 0700c001dH
|
|
|
|
DD 0500bH
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?__empty_global_delete@@YAXPEAX_K@Z DD 025051801H
|
|
|
|
DD 01132318H
|
|
|
|
DD 0700c001dH
|
|
|
|
DD 0500bH
|
|
|
|
xdata ENDS
|
|
|
|
; COMDAT xdata
|
|
|
|
xdata SEGMENT
|
|
|
|
$unwind$?__empty_global_delete@@YAXPEAX@Z DD 025051301H
|
|
|
|
DD 010e2313H
|
|
|
|
DD 07007001dH
|
|
|
|
DD 05006H
|
|
|
|
xdata ENDS
|
|
|
|
; Function compile flags: /Odt
|
|
|
|
; COMDAT __JustMyCode_Default
|
|
|
|
_TEXT SEGMENT
|
|
|
|
__JustMyCode_Default PROC ; COMDAT
|
|
|
|
00000 c2 00 00 ret 0
|
|
|
|
__JustMyCode_Default ENDP
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\@\Work\code-virtualizer\CodeVirtualizer\OpaqueBranching.cpp
|
|
|
|
; COMDAT ?ObfInsertOpaqueBranchBlock@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
T$1 = 8
|
|
|
|
EndBlock$ = 40
|
|
|
|
T$2 = 72
|
|
|
|
RealNext$3 = 104
|
|
|
|
$T4 = 328
|
|
|
|
tv128 = 344
|
|
|
|
Start$ = 384
|
|
|
|
End$ = 392
|
|
|
|
OpaqueBranchBlock$ = 400
|
|
|
|
?ObfInsertOpaqueBranchBlock@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@@Z PROC ; ObfInsertOpaqueBranchBlock, COMDAT
|
|
|
|
|
|
|
|
; 117 : {
|
|
|
|
|
|
|
|
$LN13:
|
|
|
|
00000 4c 89 44 24 18 mov QWORD PTR [rsp+24], r8
|
|
|
|
00005 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000a 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
0000f 55 push rbp
|
|
|
|
00010 57 push rdi
|
|
|
|
00011 48 81 ec 88 01
|
|
|
|
00 00 sub rsp, 392 ; 00000188H
|
|
|
|
00018 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
0001d 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__A8BC9087_OpaqueBranching@cpp
|
|
|
|
00024 e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 118 : OpaqueBranchBlock->Start->Prev = Start->Prev;
|
|
|
|
|
|
|
|
00029 48 8b 85 90 01
|
|
|
|
00 00 mov rax, QWORD PTR OpaqueBranchBlock$[rbp]
|
|
|
|
00030 48 8b 00 mov rax, QWORD PTR [rax]
|
|
|
|
00033 48 8b 8d 80 01
|
|
|
|
00 00 mov rcx, QWORD PTR Start$[rbp]
|
|
|
|
0003a 48 8b 49 08 mov rcx, QWORD PTR [rcx+8]
|
|
|
|
0003e 48 89 48 08 mov QWORD PTR [rax+8], rcx
|
|
|
|
|
|
|
|
; 119 : OpaqueBranchBlock->End->Next = End->Next;
|
|
|
|
|
|
|
|
00042 48 8b 85 90 01
|
|
|
|
00 00 mov rax, QWORD PTR OpaqueBranchBlock$[rbp]
|
|
|
|
00049 48 8b 40 08 mov rax, QWORD PTR [rax+8]
|
|
|
|
0004d 48 8b 8d 88 01
|
|
|
|
00 00 mov rcx, QWORD PTR End$[rbp]
|
|
|
|
00054 48 8b 09 mov rcx, QWORD PTR [rcx]
|
|
|
|
00057 48 89 08 mov QWORD PTR [rax], rcx
|
|
|
|
|
|
|
|
; 120 :
|
|
|
|
; 121 : if (Start->Prev)
|
|
|
|
|
|
|
|
0005a 48 8b 85 80 01
|
|
|
|
00 00 mov rax, QWORD PTR Start$[rbp]
|
|
|
|
00061 48 83 78 08 00 cmp QWORD PTR [rax+8], 0
|
|
|
|
00066 74 18 je SHORT $LN8@ObfInsertO
|
|
|
|
|
|
|
|
; 122 : Start->Prev->Next = OpaqueBranchBlock->Start;
|
|
|
|
|
|
|
|
00068 48 8b 85 80 01
|
|
|
|
00 00 mov rax, QWORD PTR Start$[rbp]
|
|
|
|
0006f 48 8b 40 08 mov rax, QWORD PTR [rax+8]
|
|
|
|
00073 48 8b 8d 90 01
|
|
|
|
00 00 mov rcx, QWORD PTR OpaqueBranchBlock$[rbp]
|
|
|
|
0007a 48 8b 09 mov rcx, QWORD PTR [rcx]
|
|
|
|
0007d 48 89 08 mov QWORD PTR [rax], rcx
|
|
|
|
$LN8@ObfInsertO:
|
|
|
|
|
|
|
|
; 123 : if (End->Next)
|
|
|
|
|
|
|
|
00080 48 8b 85 88 01
|
|
|
|
00 00 mov rax, QWORD PTR End$[rbp]
|
|
|
|
00087 48 83 38 00 cmp QWORD PTR [rax], 0
|
|
|
|
0008b 74 19 je SHORT $LN9@ObfInsertO
|
|
|
|
|
|
|
|
; 124 : End->Next->Prev = OpaqueBranchBlock->End;
|
|
|
|
|
|
|
|
0008d 48 8b 85 88 01
|
|
|
|
00 00 mov rax, QWORD PTR End$[rbp]
|
|
|
|
00094 48 8b 00 mov rax, QWORD PTR [rax]
|
|
|
|
00097 48 8b 8d 90 01
|
|
|
|
00 00 mov rcx, QWORD PTR OpaqueBranchBlock$[rbp]
|
|
|
|
0009e 48 8b 49 08 mov rcx, QWORD PTR [rcx+8]
|
|
|
|
000a2 48 89 48 08 mov QWORD PTR [rax+8], rcx
|
|
|
|
$LN9@ObfInsertO:
|
|
|
|
|
|
|
|
; 125 :
|
|
|
|
; 126 : //Update group for the current isntructions
|
|
|
|
; 127 : for (PNATIVE_CODE_LINK T = OpaqueBranchBlock->Start; T && T != OpaqueBranchBlock->End->Next; T = T->Next)
|
|
|
|
|
|
|
|
000a6 48 8b 85 90 01
|
|
|
|
00 00 mov rax, QWORD PTR OpaqueBranchBlock$[rbp]
|
|
|
|
000ad 48 8b 00 mov rax, QWORD PTR [rax]
|
|
|
|
000b0 48 89 45 08 mov QWORD PTR T$1[rbp], rax
|
|
|
|
000b4 eb 0b jmp SHORT $LN4@ObfInsertO
|
|
|
|
$LN2@ObfInsertO:
|
|
|
|
000b6 48 8b 45 08 mov rax, QWORD PTR T$1[rbp]
|
|
|
|
000ba 48 8b 00 mov rax, QWORD PTR [rax]
|
|
|
|
000bd 48 89 45 08 mov QWORD PTR T$1[rbp], rax
|
|
|
|
$LN4@ObfInsertO:
|
|
|
|
000c1 48 83 7d 08 00 cmp QWORD PTR T$1[rbp], 0
|
|
|
|
000c6 74 29 je SHORT $LN3@ObfInsertO
|
|
|
|
000c8 48 8b 85 90 01
|
|
|
|
00 00 mov rax, QWORD PTR OpaqueBranchBlock$[rbp]
|
|
|
|
000cf 48 8b 40 08 mov rax, QWORD PTR [rax+8]
|
|
|
|
000d3 48 8b 00 mov rax, QWORD PTR [rax]
|
|
|
|
000d6 48 39 45 08 cmp QWORD PTR T$1[rbp], rax
|
|
|
|
000da 74 15 je SHORT $LN3@ObfInsertO
|
|
|
|
|
|
|
|
; 128 : T->Block = Start->Block;
|
|
|
|
|
|
|
|
000dc 48 8b 45 08 mov rax, QWORD PTR T$1[rbp]
|
|
|
|
000e0 48 8b 8d 80 01
|
|
|
|
00 00 mov rcx, QWORD PTR Start$[rbp]
|
|
|
|
000e7 48 8b 49 10 mov rcx, QWORD PTR [rcx+16]
|
|
|
|
000eb 48 89 48 10 mov QWORD PTR [rax+16], rcx
|
|
|
|
000ef eb c5 jmp SHORT $LN2@ObfInsertO
|
|
|
|
$LN3@ObfInsertO:
|
|
|
|
|
|
|
|
; 129 :
|
|
|
|
; 130 : PNATIVE_CODE_LINK EndBlock = End->Next;
|
|
|
|
|
|
|
|
000f1 48 8b 85 88 01
|
|
|
|
00 00 mov rax, QWORD PTR End$[rbp]
|
|
|
|
000f8 48 8b 00 mov rax, QWORD PTR [rax]
|
|
|
|
000fb 48 89 45 28 mov QWORD PTR EndBlock$[rbp], rax
|
|
|
|
|
|
|
|
; 131 : for (PNATIVE_CODE_LINK T = Start; T && T != EndBlock;)
|
|
|
|
|
|
|
|
000ff 48 8b 85 80 01
|
|
|
|
00 00 mov rax, QWORD PTR Start$[rbp]
|
|
|
|
00106 48 89 45 48 mov QWORD PTR T$2[rbp], rax
|
|
|
|
$LN5@ObfInsertO:
|
|
|
|
0010a 48 83 7d 48 00 cmp QWORD PTR T$2[rbp], 0
|
|
|
|
0010f 74 59 je SHORT $LN6@ObfInsertO
|
|
|
|
00111 48 8b 45 28 mov rax, QWORD PTR EndBlock$[rbp]
|
|
|
|
00115 48 39 45 48 cmp QWORD PTR T$2[rbp], rax
|
|
|
|
00119 74 4f je SHORT $LN6@ObfInsertO
|
|
|
|
|
|
|
|
; 132 : {
|
|
|
|
; 133 : PNATIVE_CODE_LINK RealNext = T->Next;
|
|
|
|
|
|
|
|
0011b 48 8b 45 48 mov rax, QWORD PTR T$2[rbp]
|
|
|
|
0011f 48 8b 00 mov rax, QWORD PTR [rax]
|
|
|
|
00122 48 89 45 68 mov QWORD PTR RealNext$3[rbp], rax
|
|
|
|
|
|
|
|
; 134 : delete T;
|
|
|
|
|
|
|
|
00126 48 8b 45 48 mov rax, QWORD PTR T$2[rbp]
|
|
|
|
0012a 48 89 85 48 01
|
|
|
|
00 00 mov QWORD PTR $T4[rbp], rax
|
|
|
|
00131 48 83 bd 48 01
|
|
|
|
00 00 00 cmp QWORD PTR $T4[rbp], 0
|
|
|
|
00139 74 1a je SHORT $LN11@ObfInsertO
|
|
|
|
0013b ba 01 00 00 00 mov edx, 1
|
|
|
|
00140 48 8b 8d 48 01
|
|
|
|
00 00 mov rcx, QWORD PTR $T4[rbp]
|
|
|
|
00147 e8 00 00 00 00 call ??_G_NATIVE_CODE_LINK@@QEAAPEAXI@Z
|
|
|
|
0014c 48 89 85 58 01
|
|
|
|
00 00 mov QWORD PTR tv128[rbp], rax
|
|
|
|
00153 eb 0b jmp SHORT $LN12@ObfInsertO
|
|
|
|
$LN11@ObfInsertO:
|
|
|
|
00155 48 c7 85 58 01
|
|
|
|
00 00 00 00 00
|
|
|
|
00 mov QWORD PTR tv128[rbp], 0
|
|
|
|
$LN12@ObfInsertO:
|
|
|
|
|
|
|
|
; 135 : T = RealNext;
|
|
|
|
|
|
|
|
00160 48 8b 45 68 mov rax, QWORD PTR RealNext$3[rbp]
|
|
|
|
00164 48 89 45 48 mov QWORD PTR T$2[rbp], rax
|
|
|
|
|
|
|
|
; 136 : }
|
|
|
|
|
|
|
|
00168 eb a0 jmp SHORT $LN5@ObfInsertO
|
|
|
|
$LN6@ObfInsertO:
|
|
|
|
|
|
|
|
; 137 : return TRUE;
|
|
|
|
|
|
|
|
0016a b8 01 00 00 00 mov eax, 1
|
|
|
|
|
|
|
|
; 138 : }
|
|
|
|
|
|
|
|
0016f 48 8d a5 68 01
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+360]
|
|
|
|
00176 5f pop rdi
|
|
|
|
00177 5d pop rbp
|
|
|
|
00178 c3 ret 0
|
|
|
|
?ObfInsertOpaqueBranchBlock@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@@Z ENDP ; ObfInsertOpaqueBranchBlock
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\@\Work\code-virtualizer\CodeVirtualizer\OpaqueBranching.cpp
|
|
|
|
; COMDAT ?ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
Jcc$ = 8
|
|
|
|
Jmp$ = 40
|
|
|
|
$T1 = 264
|
|
|
|
$T2 = 296
|
|
|
|
$T3 = 328
|
|
|
|
$T4 = 360
|
|
|
|
$T5 = 392
|
|
|
|
tv141 = 408
|
|
|
|
tv94 = 408
|
|
|
|
tv76 = 408
|
|
|
|
NotTaken$ = 448
|
|
|
|
Taken$ = 456
|
|
|
|
JccLabel$ = 464
|
|
|
|
JmpLabel$ = 472
|
|
|
|
?ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z PROC ; ObfCombineOpaqueBranches, COMDAT
|
|
|
|
|
|
|
|
; 94 : {
|
|
|
|
|
|
|
|
$LN13:
|
|
|
|
00000 44 89 4c 24 20 mov DWORD PTR [rsp+32], r9d
|
|
|
|
00005 44 89 44 24 18 mov DWORD PTR [rsp+24], r8d
|
|
|
|
0000a 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000f 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00014 55 push rbp
|
|
|
|
00015 57 push rdi
|
|
|
|
00016 48 81 ec c8 01
|
|
|
|
00 00 sub rsp, 456 ; 000001c8H
|
|
|
|
0001d 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
00022 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__A8BC9087_OpaqueBranching@cpp
|
|
|
|
00029 e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 95 : PNATIVE_CODE_LINK Jcc = ObfGenRandomJcc(JccLabel);
|
|
|
|
|
|
|
|
0002e ba 20 00 00 00 mov edx, 32 ; 00000020H
|
|
|
|
00033 8b 8d d0 01 00
|
|
|
|
00 mov ecx, DWORD PTR JccLabel$[rbp]
|
|
|
|
00039 e8 00 00 00 00 call ?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z ; ObfGenRandomJcc
|
|
|
|
0003e 48 89 45 08 mov QWORD PTR Jcc$[rbp], rax
|
|
|
|
|
|
|
|
; 96 : if (!Jcc)
|
|
|
|
|
|
|
|
00042 48 83 7d 08 00 cmp QWORD PTR Jcc$[rbp], 0
|
|
|
|
00047 75 07 jne SHORT $LN2@ObfCombine
|
|
|
|
|
|
|
|
; 97 : return FALSE;
|
|
|
|
|
|
|
|
00049 33 c0 xor eax, eax
|
|
|
|
0004b e9 83 01 00 00 jmp $LN1@ObfCombine
|
|
|
|
$LN2@ObfCombine:
|
|
|
|
|
|
|
|
; 98 : PNATIVE_CODE_LINK Jmp = ObfGenJmpToLabel(JmpLabel);
|
|
|
|
|
|
|
|
00050 ba 20 00 00 00 mov edx, 32 ; 00000020H
|
|
|
|
00055 8b 8d d8 01 00
|
|
|
|
00 mov ecx, DWORD PTR JmpLabel$[rbp]
|
|
|
|
0005b e8 00 00 00 00 call ?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z ; ObfGenJmpToLabel
|
|
|
|
00060 48 89 45 28 mov QWORD PTR Jmp$[rbp], rax
|
|
|
|
|
|
|
|
; 99 : if (!Jmp)
|
|
|
|
|
|
|
|
00064 48 83 7d 28 00 cmp QWORD PTR Jmp$[rbp], 0
|
|
|
|
00069 75 41 jne SHORT $LN3@ObfCombine
|
|
|
|
|
|
|
|
; 100 : {
|
|
|
|
; 101 : delete Jcc;
|
|
|
|
|
|
|
|
0006b 48 8b 45 08 mov rax, QWORD PTR Jcc$[rbp]
|
|
|
|
0006f 48 89 85 08 01
|
|
|
|
00 00 mov QWORD PTR $T1[rbp], rax
|
|
|
|
00076 48 83 bd 08 01
|
|
|
|
00 00 00 cmp QWORD PTR $T1[rbp], 0
|
|
|
|
0007e 74 1a je SHORT $LN5@ObfCombine
|
|
|
|
00080 ba 01 00 00 00 mov edx, 1
|
|
|
|
00085 48 8b 8d 08 01
|
|
|
|
00 00 mov rcx, QWORD PTR $T1[rbp]
|
|
|
|
0008c e8 00 00 00 00 call ??_G_NATIVE_CODE_LINK@@QEAAPEAXI@Z
|
|
|
|
00091 48 89 85 98 01
|
|
|
|
00 00 mov QWORD PTR tv76[rbp], rax
|
|
|
|
00098 eb 0b jmp SHORT $LN6@ObfCombine
|
|
|
|
$LN5@ObfCombine:
|
|
|
|
0009a 48 c7 85 98 01
|
|
|
|
00 00 00 00 00
|
|
|
|
00 mov QWORD PTR tv76[rbp], 0
|
|
|
|
$LN6@ObfCombine:
|
|
|
|
|
|
|
|
; 102 : return FALSE;
|
|
|
|
|
|
|
|
000a5 33 c0 xor eax, eax
|
|
|
|
000a7 e9 27 01 00 00 jmp $LN1@ObfCombine
|
|
|
|
$LN3@ObfCombine:
|
|
|
|
|
|
|
|
; 103 : }
|
|
|
|
; 104 :
|
|
|
|
; 105 : NcPrependToBlock(NotTaken, Jcc);
|
|
|
|
|
|
|
|
000ac 48 8b 55 08 mov rdx, QWORD PTR Jcc$[rbp]
|
|
|
|
000b0 48 8b 8d c0 01
|
|
|
|
00 00 mov rcx, QWORD PTR NotTaken$[rbp]
|
|
|
|
000b7 e8 00 00 00 00 call ?NcPrependToBlock@@YAXPEAU_NATIVE_CODE_BLOCK@@PEAU_NATIVE_CODE_LINK@@@Z ; NcPrependToBlock
|
|
|
|
|
|
|
|
; 106 : NcAppendToBlock(NotTaken, Jmp);
|
|
|
|
|
|
|
|
000bc 48 8b 55 28 mov rdx, QWORD PTR Jmp$[rbp]
|
|
|
|
000c0 48 8b 8d c0 01
|
|
|
|
00 00 mov rcx, QWORD PTR NotTaken$[rbp]
|
|
|
|
000c7 e8 00 00 00 00 call ?NcAppendToBlock@@YAXPEAU_NATIVE_CODE_BLOCK@@PEAU_NATIVE_CODE_LINK@@@Z ; NcAppendToBlock
|
|
|
|
|
|
|
|
; 107 :
|
|
|
|
; 108 : NcPrependToBlock(Taken, new NATIVE_CODE_LINK(JccLabel, Taken));
|
|
|
|
|
|
|
|
000cc b9 f0 00 00 00 mov ecx, 240 ; 000000f0H
|
|
|
|
000d1 e8 00 00 00 00 call ??2@YAPEAX_K@Z ; operator new
|
|
|
|
000d6 48 89 85 48 01
|
|
|
|
00 00 mov QWORD PTR $T3[rbp], rax
|
|
|
|
000dd 48 83 bd 48 01
|
|
|
|
00 00 00 cmp QWORD PTR $T3[rbp], 0
|
|
|
|
000e5 74 22 je SHORT $LN7@ObfCombine
|
|
|
|
000e7 4c 8b 85 c8 01
|
|
|
|
00 00 mov r8, QWORD PTR Taken$[rbp]
|
|
|
|
000ee 8b 95 d0 01 00
|
|
|
|
00 mov edx, DWORD PTR JccLabel$[rbp]
|
|
|
|
000f4 48 8b 8d 48 01
|
|
|
|
00 00 mov rcx, QWORD PTR $T3[rbp]
|
|
|
|
000fb e8 00 00 00 00 call ??0_NATIVE_CODE_LINK@@QEAA@KPEAU_NATIVE_CODE_BLOCK@@@Z ; _NATIVE_CODE_LINK::_NATIVE_CODE_LINK
|
|
|
|
00100 48 89 85 98 01
|
|
|
|
00 00 mov QWORD PTR tv94[rbp], rax
|
|
|
|
00107 eb 0b jmp SHORT $LN8@ObfCombine
|
|
|
|
$LN7@ObfCombine:
|
|
|
|
00109 48 c7 85 98 01
|
|
|
|
00 00 00 00 00
|
|
|
|
00 mov QWORD PTR tv94[rbp], 0
|
|
|
|
$LN8@ObfCombine:
|
|
|
|
00114 48 8b 85 98 01
|
|
|
|
00 00 mov rax, QWORD PTR tv94[rbp]
|
|
|
|
0011b 48 89 85 28 01
|
|
|
|
00 00 mov QWORD PTR $T2[rbp], rax
|
|
|
|
00122 48 8b 95 28 01
|
|
|
|
00 00 mov rdx, QWORD PTR $T2[rbp]
|
|
|
|
00129 48 8b 8d c8 01
|
|
|
|
00 00 mov rcx, QWORD PTR Taken$[rbp]
|
|
|
|
00130 e8 00 00 00 00 call ?NcPrependToBlock@@YAXPEAU_NATIVE_CODE_BLOCK@@PEAU_NATIVE_CODE_LINK@@@Z ; NcPrependToBlock
|
|
|
|
|
|
|
|
; 109 : NcAppendToBlock(Taken, new NATIVE_CODE_LINK(JmpLabel, Taken));
|
|
|
|
|
|
|
|
00135 b9 f0 00 00 00 mov ecx, 240 ; 000000f0H
|
|
|
|
0013a e8 00 00 00 00 call ??2@YAPEAX_K@Z ; operator new
|
|
|
|
0013f 48 89 85 88 01
|
|
|
|
00 00 mov QWORD PTR $T5[rbp], rax
|
|
|
|
00146 48 83 bd 88 01
|
|
|
|
00 00 00 cmp QWORD PTR $T5[rbp], 0
|
|
|
|
0014e 74 22 je SHORT $LN9@ObfCombine
|
|
|
|
00150 4c 8b 85 c8 01
|
|
|
|
00 00 mov r8, QWORD PTR Taken$[rbp]
|
|
|
|
00157 8b 95 d8 01 00
|
|
|
|
00 mov edx, DWORD PTR JmpLabel$[rbp]
|
|
|
|
0015d 48 8b 8d 88 01
|
|
|
|
00 00 mov rcx, QWORD PTR $T5[rbp]
|
|
|
|
00164 e8 00 00 00 00 call ??0_NATIVE_CODE_LINK@@QEAA@KPEAU_NATIVE_CODE_BLOCK@@@Z ; _NATIVE_CODE_LINK::_NATIVE_CODE_LINK
|
|
|
|
00169 48 89 85 98 01
|
|
|
|
00 00 mov QWORD PTR tv141[rbp], rax
|
|
|
|
00170 eb 0b jmp SHORT $LN10@ObfCombine
|
|
|
|
$LN9@ObfCombine:
|
|
|
|
00172 48 c7 85 98 01
|
|
|
|
00 00 00 00 00
|
|
|
|
00 mov QWORD PTR tv141[rbp], 0
|
|
|
|
$LN10@ObfCombine:
|
|
|
|
0017d 48 8b 85 98 01
|
|
|
|
00 00 mov rax, QWORD PTR tv141[rbp]
|
|
|
|
00184 48 89 85 68 01
|
|
|
|
00 00 mov QWORD PTR $T4[rbp], rax
|
|
|
|
0018b 48 8b 95 68 01
|
|
|
|
00 00 mov rdx, QWORD PTR $T4[rbp]
|
|
|
|
00192 48 8b 8d c8 01
|
|
|
|
00 00 mov rcx, QWORD PTR Taken$[rbp]
|
|
|
|
00199 e8 00 00 00 00 call ?NcAppendToBlock@@YAXPEAU_NATIVE_CODE_BLOCK@@PEAU_NATIVE_CODE_LINK@@@Z ; NcAppendToBlock
|
|
|
|
|
|
|
|
; 110 :
|
|
|
|
; 111 : NcInsertBlockAfter(NotTaken->End, Taken, FALSE);
|
|
|
|
|
|
|
|
0019e 45 33 c0 xor r8d, r8d
|
|
|
|
001a1 48 8b 95 c8 01
|
|
|
|
00 00 mov rdx, QWORD PTR Taken$[rbp]
|
|
|
|
001a8 48 8b 85 c0 01
|
|
|
|
00 00 mov rax, QWORD PTR NotTaken$[rbp]
|
|
|
|
001af 48 8b 48 08 mov rcx, QWORD PTR [rax+8]
|
|
|
|
001b3 e8 00 00 00 00 call ?NcInsertBlockAfter@@YAHPEAU_NATIVE_CODE_LINK@@PEAU_NATIVE_CODE_BLOCK@@H@Z ; NcInsertBlockAfter
|
|
|
|
|
|
|
|
; 112 : NotTaken->End = Taken->End;
|
|
|
|
|
|
|
|
001b8 48 8b 85 c0 01
|
|
|
|
00 00 mov rax, QWORD PTR NotTaken$[rbp]
|
|
|
|
001bf 48 8b 8d c8 01
|
|
|
|
00 00 mov rcx, QWORD PTR Taken$[rbp]
|
|
|
|
001c6 48 8b 49 08 mov rcx, QWORD PTR [rcx+8]
|
|
|
|
001ca 48 89 48 08 mov QWORD PTR [rax+8], rcx
|
|
|
|
|
|
|
|
; 113 : return TRUE;
|
|
|
|
|
|
|
|
001ce b8 01 00 00 00 mov eax, 1
|
|
|
|
$LN1@ObfCombine:
|
|
|
|
|
|
|
|
; 114 : }
|
|
|
|
|
|
|
|
001d3 48 8d a5 a8 01
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+424]
|
|
|
|
001da 5f pop rdi
|
|
|
|
001db 5d pop rbp
|
|
|
|
001dc c3 ret 0
|
|
|
|
?ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z ENDP ; ObfCombineOpaqueBranches
|
|
|
|
_TEXT ENDS
|
|
|
|
; COMDAT text$x
|
|
|
|
text$x SEGMENT
|
|
|
|
Jcc$ = 8
|
|
|
|
Jmp$ = 40
|
|
|
|
$T1 = 264
|
|
|
|
$T2 = 296
|
|
|
|
$T3 = 328
|
|
|
|
$T4 = 360
|
|
|
|
$T5 = 392
|
|
|
|
tv141 = 408
|
|
|
|
tv94 = 408
|
|
|
|
tv76 = 408
|
|
|
|
NotTaken$ = 448
|
|
|
|
Taken$ = 456
|
|
|
|
JccLabel$ = 464
|
|
|
|
JmpLabel$ = 472
|
|
|
|
?dtor$0@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA PROC ; `ObfCombineOpaqueBranches'::`1'::dtor$0
|
|
|
|
00000 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00005 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000a 55 push rbp
|
|
|
|
0000b 57 push rdi
|
|
|
|
0000c 48 83 ec 28 sub rsp, 40 ; 00000028H
|
|
|
|
00010 48 8d 6a 20 lea rbp, QWORD PTR [rdx+32]
|
|
|
|
00014 ba f0 00 00 00 mov edx, 240 ; 000000f0H
|
|
|
|
00019 48 8b 8d 48 01
|
|
|
|
00 00 mov rcx, QWORD PTR $T3[rbp]
|
|
|
|
00020 e8 00 00 00 00 call ??3@YAXPEAX_K@Z ; operator delete
|
|
|
|
00025 48 83 c4 28 add rsp, 40 ; 00000028H
|
|
|
|
00029 5f pop rdi
|
|
|
|
0002a 5d pop rbp
|
|
|
|
0002b c3 ret 0
|
|
|
|
?dtor$0@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA ENDP ; `ObfCombineOpaqueBranches'::`1'::dtor$0
|
|
|
|
text$x ENDS
|
|
|
|
; COMDAT text$x
|
|
|
|
text$x SEGMENT
|
|
|
|
Jcc$ = 8
|
|
|
|
Jmp$ = 40
|
|
|
|
$T1 = 264
|
|
|
|
$T2 = 296
|
|
|
|
$T3 = 328
|
|
|
|
$T4 = 360
|
|
|
|
$T5 = 392
|
|
|
|
tv141 = 408
|
|
|
|
tv94 = 408
|
|
|
|
tv76 = 408
|
|
|
|
NotTaken$ = 448
|
|
|
|
Taken$ = 456
|
|
|
|
JccLabel$ = 464
|
|
|
|
JmpLabel$ = 472
|
|
|
|
?dtor$1@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA PROC ; `ObfCombineOpaqueBranches'::`1'::dtor$1
|
|
|
|
00000 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00005 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000a 55 push rbp
|
|
|
|
0000b 57 push rdi
|
|
|
|
0000c 48 83 ec 28 sub rsp, 40 ; 00000028H
|
|
|
|
00010 48 8d 6a 20 lea rbp, QWORD PTR [rdx+32]
|
|
|
|
00014 ba f0 00 00 00 mov edx, 240 ; 000000f0H
|
|
|
|
00019 48 8b 8d 88 01
|
|
|
|
00 00 mov rcx, QWORD PTR $T5[rbp]
|
|
|
|
00020 e8 00 00 00 00 call ??3@YAXPEAX_K@Z ; operator delete
|
|
|
|
00025 48 83 c4 28 add rsp, 40 ; 00000028H
|
|
|
|
00029 5f pop rdi
|
|
|
|
0002a 5d pop rbp
|
|
|
|
0002b c3 ret 0
|
|
|
|
?dtor$1@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA ENDP ; `ObfCombineOpaqueBranches'::`1'::dtor$1
|
|
|
|
text$x ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; COMDAT text$x
|
|
|
|
text$x SEGMENT
|
|
|
|
Jcc$ = 8
|
|
|
|
Jmp$ = 40
|
|
|
|
$T1 = 264
|
|
|
|
$T2 = 296
|
|
|
|
$T3 = 328
|
|
|
|
$T4 = 360
|
|
|
|
$T5 = 392
|
|
|
|
tv141 = 408
|
|
|
|
tv94 = 408
|
|
|
|
tv76 = 408
|
|
|
|
NotTaken$ = 448
|
|
|
|
Taken$ = 456
|
|
|
|
JccLabel$ = 464
|
|
|
|
JmpLabel$ = 472
|
|
|
|
?dtor$0@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA PROC ; `ObfCombineOpaqueBranches'::`1'::dtor$0
|
|
|
|
00000 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00005 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000a 55 push rbp
|
|
|
|
0000b 57 push rdi
|
|
|
|
0000c 48 83 ec 28 sub rsp, 40 ; 00000028H
|
|
|
|
00010 48 8d 6a 20 lea rbp, QWORD PTR [rdx+32]
|
|
|
|
00014 ba f0 00 00 00 mov edx, 240 ; 000000f0H
|
|
|
|
00019 48 8b 8d 48 01
|
|
|
|
00 00 mov rcx, QWORD PTR $T3[rbp]
|
|
|
|
00020 e8 00 00 00 00 call ??3@YAXPEAX_K@Z ; operator delete
|
|
|
|
00025 48 83 c4 28 add rsp, 40 ; 00000028H
|
|
|
|
00029 5f pop rdi
|
|
|
|
0002a 5d pop rbp
|
|
|
|
0002b c3 ret 0
|
|
|
|
?dtor$0@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA ENDP ; `ObfCombineOpaqueBranches'::`1'::dtor$0
|
|
|
|
text$x ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; COMDAT text$x
|
|
|
|
text$x SEGMENT
|
|
|
|
Jcc$ = 8
|
|
|
|
Jmp$ = 40
|
|
|
|
$T1 = 264
|
|
|
|
$T2 = 296
|
|
|
|
$T3 = 328
|
|
|
|
$T4 = 360
|
|
|
|
$T5 = 392
|
|
|
|
tv141 = 408
|
|
|
|
tv94 = 408
|
|
|
|
tv76 = 408
|
|
|
|
NotTaken$ = 448
|
|
|
|
Taken$ = 456
|
|
|
|
JccLabel$ = 464
|
|
|
|
JmpLabel$ = 472
|
|
|
|
?dtor$1@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA PROC ; `ObfCombineOpaqueBranches'::`1'::dtor$1
|
|
|
|
00000 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00005 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000a 55 push rbp
|
|
|
|
0000b 57 push rdi
|
|
|
|
0000c 48 83 ec 28 sub rsp, 40 ; 00000028H
|
|
|
|
00010 48 8d 6a 20 lea rbp, QWORD PTR [rdx+32]
|
|
|
|
00014 ba f0 00 00 00 mov edx, 240 ; 000000f0H
|
|
|
|
00019 48 8b 8d 88 01
|
|
|
|
00 00 mov rcx, QWORD PTR $T5[rbp]
|
|
|
|
00020 e8 00 00 00 00 call ??3@YAXPEAX_K@Z ; operator delete
|
|
|
|
00025 48 83 c4 28 add rsp, 40 ; 00000028H
|
|
|
|
00029 5f pop rdi
|
|
|
|
0002a 5d pop rbp
|
|
|
|
0002b c3 ret 0
|
|
|
|
?dtor$1@?0??ObfCombineOpaqueBranches@@YAHPEAU_NATIVE_CODE_BLOCK@@0KK@Z@4HA ENDP ; `ObfCombineOpaqueBranches'::`1'::dtor$1
|
|
|
|
text$x ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\@\Work\code-virtualizer\CodeVirtualizer\OpaqueBranching.cpp
|
|
|
|
; COMDAT ?ObfCreateOpaqueBranches@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@1@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
tv74 = 192
|
|
|
|
Start$ = 240
|
|
|
|
End$ = 248
|
|
|
|
NotTaken$ = 256
|
|
|
|
Taken$ = 264
|
|
|
|
?ObfCreateOpaqueBranches@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@1@Z PROC ; ObfCreateOpaqueBranches, COMDAT
|
|
|
|
|
|
|
|
; 89 : {
|
|
|
|
|
|
|
|
$LN5:
|
|
|
|
00000 4c 89 4c 24 20 mov QWORD PTR [rsp+32], r9
|
|
|
|
00005 4c 89 44 24 18 mov QWORD PTR [rsp+24], r8
|
|
|
|
0000a 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000f 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00014 55 push rbp
|
|
|
|
00015 57 push rdi
|
|
|
|
00016 48 81 ec f8 00
|
|
|
|
00 00 sub rsp, 248 ; 000000f8H
|
|
|
|
0001d 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
00022 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__A8BC9087_OpaqueBranching@cpp
|
|
|
|
00029 e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 90 : return (NcDeepCopyPartialBlock(Start, End, Taken) && !NcDeepCopyPartialBlock(Start, End, NotTaken));
|
|
|
|
|
|
|
|
0002e 4c 8b 85 08 01
|
|
|
|
00 00 mov r8, QWORD PTR Taken$[rbp]
|
|
|
|
00035 48 8b 95 f8 00
|
|
|
|
00 00 mov rdx, QWORD PTR End$[rbp]
|
|
|
|
0003c 48 8b 8d f0 00
|
|
|
|
00 00 mov rcx, QWORD PTR Start$[rbp]
|
|
|
|
00043 e8 00 00 00 00 call ?NcDeepCopyPartialBlock@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@@Z ; NcDeepCopyPartialBlock
|
|
|
|
00048 85 c0 test eax, eax
|
|
|
|
0004a 74 2a je SHORT $LN3@ObfCreateO
|
|
|
|
0004c 4c 8b 85 00 01
|
|
|
|
00 00 mov r8, QWORD PTR NotTaken$[rbp]
|
|
|
|
00053 48 8b 95 f8 00
|
|
|
|
00 00 mov rdx, QWORD PTR End$[rbp]
|
|
|
|
0005a 48 8b 8d f0 00
|
|
|
|
00 00 mov rcx, QWORD PTR Start$[rbp]
|
|
|
|
00061 e8 00 00 00 00 call ?NcDeepCopyPartialBlock@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@@Z ; NcDeepCopyPartialBlock
|
|
|
|
00066 85 c0 test eax, eax
|
|
|
|
00068 75 0c jne SHORT $LN3@ObfCreateO
|
|
|
|
0006a c7 85 c0 00 00
|
|
|
|
00 01 00 00 00 mov DWORD PTR tv74[rbp], 1
|
|
|
|
00074 eb 0a jmp SHORT $LN4@ObfCreateO
|
|
|
|
$LN3@ObfCreateO:
|
|
|
|
00076 c7 85 c0 00 00
|
|
|
|
00 00 00 00 00 mov DWORD PTR tv74[rbp], 0
|
|
|
|
$LN4@ObfCreateO:
|
|
|
|
00080 8b 85 c0 00 00
|
|
|
|
00 mov eax, DWORD PTR tv74[rbp]
|
|
|
|
|
|
|
|
; 91 : }
|
|
|
|
|
|
|
|
00086 48 8d a5 d8 00
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+216]
|
|
|
|
0008d 5f pop rdi
|
|
|
|
0008e 5d pop rbp
|
|
|
|
0008f c3 ret 0
|
|
|
|
?ObfCreateOpaqueBranches@@YAHPEAU_NATIVE_CODE_LINK@@0PEAU_NATIVE_CODE_BLOCK@@1@Z ENDP ; ObfCreateOpaqueBranches
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\@\Work\code-virtualizer\CodeVirtualizer\OpaqueBranching.cpp
|
|
|
|
; COMDAT ?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
MachineState$ = 8
|
|
|
|
EncoderInstruction$ = 48
|
|
|
|
EncoderRequest$ = 496
|
|
|
|
EncodeBuffer$ = 712
|
|
|
|
ReturnedSize$ = 756
|
|
|
|
Link$ = 792
|
|
|
|
$T8 = 1400
|
|
|
|
$T9 = 1480
|
|
|
|
$T10 = 1560
|
|
|
|
$T11 = 1592
|
|
|
|
$T12 = 1624
|
|
|
|
$T13 = 1664
|
|
|
|
tv145 = 1720
|
|
|
|
tv133 = 1720
|
|
|
|
__$ArrayPad$ = 1728
|
|
|
|
LabelId$ = 1776
|
|
|
|
DisplacementWidth$ = 1784
|
|
|
|
?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z PROC ; ObfGenJmpToLabel, COMDAT
|
|
|
|
|
|
|
|
; 58 : {
|
|
|
|
|
|
|
|
$LN11:
|
|
|
|
00000 89 54 24 10 mov DWORD PTR [rsp+16], edx
|
|
|
|
00004 89 4c 24 08 mov DWORD PTR [rsp+8], ecx
|
|
|
|
00008 55 push rbp
|
|
|
|
00009 56 push rsi
|
|
|
|
0000a 57 push rdi
|
|
|
|
0000b 48 81 ec 00 07
|
|
|
|
00 00 sub rsp, 1792 ; 00000700H
|
|
|
|
00012 48 8d 6c 24 30 lea rbp, QWORD PTR [rsp+48]
|
|
|
|
00017 48 8d 7c 24 30 lea rdi, QWORD PTR [rsp+48]
|
|
|
|
0001c b9 24 01 00 00 mov ecx, 292 ; 00000124H
|
|
|
|
00021 b8 cc cc cc cc mov eax, -858993460 ; ccccccccH
|
|
|
|
00026 f3 ab rep stosd
|
|
|
|
00028 8b 8c 24 28 07
|
|
|
|
00 00 mov ecx, DWORD PTR [rsp+1832]
|
|
|
|
0002f 48 8b 05 00 00
|
|
|
|
00 00 mov rax, QWORD PTR __security_cookie
|
|
|
|
00036 48 33 c5 xor rax, rbp
|
|
|
|
00039 48 89 85 c0 06
|
|
|
|
00 00 mov QWORD PTR __$ArrayPad$[rbp], rax
|
|
|
|
00040 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__A8BC9087_OpaqueBranching@cpp
|
|
|
|
00047 e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 59 : XED_STATE MachineState;
|
|
|
|
; 60 : MachineState.mmode = XED_MACHINE_MODE_LONG_64;
|
|
|
|
|
|
|
|
0004c c7 45 08 01 00
|
|
|
|
00 00 mov DWORD PTR MachineState$[rbp], 1
|
|
|
|
|
|
|
|
; 61 : MachineState.stack_addr_width = XED_ADDRESS_WIDTH_64b;
|
|
|
|
|
|
|
|
00053 c7 45 0c 08 00
|
|
|
|
00 00 mov DWORD PTR MachineState$[rbp+4], 8
|
|
|
|
|
|
|
|
; 62 : XED_ENCODER_INSTRUCTION EncoderInstruction;
|
|
|
|
; 63 : XED_ENCODER_REQUEST EncoderRequest;
|
|
|
|
; 64 : UCHAR EncodeBuffer[15];
|
|
|
|
; 65 : UINT ReturnedSize;
|
|
|
|
; 66 :
|
|
|
|
; 67 : XedInst1(&EncoderInstruction, MachineState, XED_ICLASS_JMP, DisplacementWidth, XedRelBr(0, DisplacementWidth));
|
|
|
|
|
|
|
|
0005a 44 8b 85 f8 06
|
|
|
|
00 00 mov r8d, DWORD PTR DisplacementWidth$[rbp]
|
|
|
|
00061 33 d2 xor edx, edx
|
|
|
|
00063 48 8d 8d c8 05
|
|
|
|
00 00 lea rcx, QWORD PTR $T9[rbp]
|
|
|
|
0006a e8 00 00 00 00 call xed_relbr
|
|
|
|
0006f 48 8d 8d 78 05
|
|
|
|
00 00 lea rcx, QWORD PTR $T8[rbp]
|
|
|
|
00076 48 8b f9 mov rdi, rcx
|
|
|
|
00079 48 8b f0 mov rsi, rax
|
|
|
|
0007c b9 30 00 00 00 mov ecx, 48 ; 00000030H
|
|
|
|
00081 f3 a4 rep movsb
|
|
|
|
00083 48 8d 85 80 06
|
|
|
|
00 00 lea rax, QWORD PTR $T13[rbp]
|
|
|
|
0008a 48 8d 8d 78 05
|
|
|
|
00 00 lea rcx, QWORD PTR $T8[rbp]
|
|
|
|
00091 48 8b f8 mov rdi, rax
|
|
|
|
00094 48 8b f1 mov rsi, rcx
|
|
|
|
00097 b9 30 00 00 00 mov ecx, 48 ; 00000030H
|
|
|
|
0009c f3 a4 rep movsb
|
|
|
|
0009e 48 8d 85 80 06
|
|
|
|
00 00 lea rax, QWORD PTR $T13[rbp]
|
|
|
|
000a5 48 89 44 24 20 mov QWORD PTR [rsp+32], rax
|
|
|
|
000aa 44 8b 8d f8 06
|
|
|
|
00 00 mov r9d, DWORD PTR DisplacementWidth$[rbp]
|
|
|
|
000b1 41 b8 3c 01 00
|
|
|
|
00 mov r8d, 316 ; 0000013cH
|
|
|
|
000b7 48 8b 55 08 mov rdx, QWORD PTR MachineState$[rbp]
|
|
|
|
000bb 48 8d 4d 30 lea rcx, QWORD PTR EncoderInstruction$[rbp]
|
|
|
|
000bf e8 00 00 00 00 call xed_inst1
|
|
|
|
|
|
|
|
; 68 :
|
|
|
|
; 69 : XedEncoderRequestZeroSetMode(&EncoderRequest, &MachineState);
|
|
|
|
|
|
|
|
000c4 48 8d 55 08 lea rdx, QWORD PTR MachineState$[rbp]
|
|
|
|
000c8 48 8d 8d f0 01
|
|
|
|
00 00 lea rcx, QWORD PTR EncoderRequest$[rbp]
|
|
|
|
000cf e8 00 00 00 00 call xed_encoder_request_zero_set_mode
|
|
|
|
|
|
|
|
; 70 : if (!XedConvertToEncoderRequest(&EncoderRequest, &EncoderInstruction))
|
|
|
|
|
|
|
|
000d4 48 8d 55 30 lea rdx, QWORD PTR EncoderInstruction$[rbp]
|
|
|
|
000d8 48 8d 8d f0 01
|
|
|
|
00 00 lea rcx, QWORD PTR EncoderRequest$[rbp]
|
|
|
|
000df e8 00 00 00 00 call xed_convert_to_encoder_request
|
|
|
|
000e4 85 c0 test eax, eax
|
|
|
|
000e6 75 07 jne SHORT $LN2@ObfGenJmpT
|
|
|
|
|
|
|
|
; 71 : return NULL;
|
|
|
|
|
|
|
|
000e8 33 c0 xor eax, eax
|
|
|
|
000ea e9 30 01 00 00 jmp $LN1@ObfGenJmpT
|
|
|
|
$LN2@ObfGenJmpT:
|
|
|
|
|
|
|
|
; 72 :
|
|
|
|
; 73 : if (XED_ERROR_NONE != XedEncode(&EncoderRequest, EncodeBuffer, 15, &ReturnedSize))
|
|
|
|
|
|
|
|
000ef 4c 8d 8d f4 02
|
|
|
|
00 00 lea r9, QWORD PTR ReturnedSize$[rbp]
|
|
|
|
000f6 41 b8 0f 00 00
|
|
|
|
00 mov r8d, 15
|
|
|
|
000fc 48 8d 95 c8 02
|
|
|
|
00 00 lea rdx, QWORD PTR EncodeBuffer$[rbp]
|
|
|
|
00103 48 8d 8d f0 01
|
|
|
|
00 00 lea rcx, QWORD PTR EncoderRequest$[rbp]
|
|
|
|
0010a e8 00 00 00 00 call xed_encode
|
|
|
|
0010f 85 c0 test eax, eax
|
|
|
|
00111 74 07 je SHORT $LN3@ObfGenJmpT
|
|
|
|
|
|
|
|
; 74 : return NULL;
|
|
|
|
|
|
|
|
00113 33 c0 xor eax, eax
|
|
|
|
00115 e9 05 01 00 00 jmp $LN1@ObfGenJmpT
|
|
|
|
$LN3@ObfGenJmpT:
|
|
|
|
|
|
|
|
; 75 :
|
|
|
|
; 76 : PNATIVE_CODE_LINK Link = new NATIVE_CODE_LINK(CODE_FLAG_IS_INST, EncodeBuffer, ReturnedSize);
|
|
|
|
|
|
|
|
0011a b9 f0 00 00 00 mov ecx, 240 ; 000000f0H
|
|
|
|
0011f e8 00 00 00 00 call ??2@YAPEAX_K@Z ; operator new
|
|
|
|
00124 48 89 85 38 06
|
|
|
|
00 00 mov QWORD PTR $T11[rbp], rax
|
|
|
|
0012b 48 83 bd 38 06
|
|
|
|
00 00 00 cmp QWORD PTR $T11[rbp], 0
|
|
|
|
00133 74 30 je SHORT $LN6@ObfGenJmpT
|
|
|
|
00135 c7 44 24 20 00
|
|
|
|
00 00 00 mov DWORD PTR [rsp+32], 0
|
|
|
|
0013d 44 8b 8d f4 02
|
|
|
|
00 00 mov r9d, DWORD PTR ReturnedSize$[rbp]
|
|
|
|
00144 4c 8d 85 c8 02
|
|
|
|
00 00 lea r8, QWORD PTR EncodeBuffer$[rbp]
|
|
|
|
0014b ba 04 00 00 00 mov edx, 4
|
|
|
|
00150 48 8b 8d 38 06
|
|
|
|
00 00 mov rcx, QWORD PTR $T11[rbp]
|
|
|
|
00157 e8 00 00 00 00 call ??0_NATIVE_CODE_LINK@@QEAA@KPEAXKH@Z ; _NATIVE_CODE_LINK::_NATIVE_CODE_LINK
|
|
|
|
0015c 48 89 85 b8 06
|
|
|
|
00 00 mov QWORD PTR tv133[rbp], rax
|
|
|
|
00163 eb 0b jmp SHORT $LN7@ObfGenJmpT
|
|
|
|
$LN6@ObfGenJmpT:
|
|
|
|
00165 48 c7 85 b8 06
|
|
|
|
00 00 00 00 00
|
|
|
|
00 mov QWORD PTR tv133[rbp], 0
|
|
|
|
$LN7@ObfGenJmpT:
|
|
|
|
00170 48 8b 85 b8 06
|
|
|
|
00 00 mov rax, QWORD PTR tv133[rbp]
|
|
|
|
00177 48 89 85 18 06
|
|
|
|
00 00 mov QWORD PTR $T10[rbp], rax
|
|
|
|
0017e 48 8b 85 18 06
|
|
|
|
00 00 mov rax, QWORD PTR $T10[rbp]
|
|
|
|
00185 48 89 85 18 03
|
|
|
|
00 00 mov QWORD PTR Link$[rbp], rax
|
|
|
|
|
|
|
|
; 77 : if (XED_ERROR_NONE != XedDecode(&Link->XedInstruction, Link->RawData, Link->RawDataSize))
|
|
|
|
|
|
|
|
0018c 48 8b 85 18 03
|
|
|
|
00 00 mov rax, QWORD PTR Link$[rbp]
|
|
|
|
00193 48 83 c0 30 add rax, 48 ; 00000030H
|
|
|
|
00197 48 8b 8d 18 03
|
|
|
|
00 00 mov rcx, QWORD PTR Link$[rbp]
|
|
|
|
0019e 44 8b 41 28 mov r8d, DWORD PTR [rcx+40]
|
|
|
|
001a2 48 8b 8d 18 03
|
|
|
|
00 00 mov rcx, QWORD PTR Link$[rbp]
|
|
|
|
001a9 48 8b 51 20 mov rdx, QWORD PTR [rcx+32]
|
|
|
|
001ad 48 8b c8 mov rcx, rax
|
|
|
|
001b0 e8 00 00 00 00 call xed_decode
|
|
|
|
001b5 85 c0 test eax, eax
|
|
|
|
001b7 74 41 je SHORT $LN4@ObfGenJmpT
|
|
|
|
|
|
|
|
; 78 : {
|
|
|
|
; 79 : delete Link;
|
|
|
|
|
|
|
|
001b9 48 8b 85 18 03
|
|
|
|
00 00 mov rax, QWORD PTR Link$[rbp]
|
|
|
|
001c0 48 89 85 58 06
|
|
|
|
00 00 mov QWORD PTR $T12[rbp], rax
|
|
|
|
001c7 48 83 bd 58 06
|
|
|
|
00 00 00 cmp QWORD PTR $T12[rbp], 0
|
|
|
|
001cf 74 1a je SHORT $LN8@ObfGenJmpT
|
|
|
|
001d1 ba 01 00 00 00 mov edx, 1
|
|
|
|
001d6 48 8b 8d 58 06
|
|
|
|
00 00 mov rcx, QWORD PTR $T12[rbp]
|
|
|
|
001dd e8 00 00 00 00 call ??_G_NATIVE_CODE_LINK@@QEAAPEAXI@Z
|
|
|
|
001e2 48 89 85 b8 06
|
|
|
|
00 00 mov QWORD PTR tv145[rbp], rax
|
|
|
|
001e9 eb 0b jmp SHORT $LN9@ObfGenJmpT
|
|
|
|
$LN8@ObfGenJmpT:
|
|
|
|
001eb 48 c7 85 b8 06
|
|
|
|
00 00 00 00 00
|
|
|
|
00 mov QWORD PTR tv145[rbp], 0
|
|
|
|
$LN9@ObfGenJmpT:
|
|
|
|
|
|
|
|
; 80 : return NULL;
|
|
|
|
|
|
|
|
001f6 33 c0 xor eax, eax
|
|
|
|
001f8 eb 25 jmp SHORT $LN1@ObfGenJmpT
|
|
|
|
$LN4@ObfGenJmpT:
|
|
|
|
|
|
|
|
; 81 : }
|
|
|
|
; 82 : Link->Label = LabelId;
|
|
|
|
|
|
|
|
001fa 48 8b 85 18 03
|
|
|
|
00 00 mov rax, QWORD PTR Link$[rbp]
|
|
|
|
00201 8b 8d f0 06 00
|
|
|
|
00 mov ecx, DWORD PTR LabelId$[rbp]
|
|
|
|
00207 89 48 1c mov DWORD PTR [rax+28], ecx
|
|
|
|
|
|
|
|
; 83 : Link->Flags = (CODE_FLAG_IS_INST | CODE_FLAG_IS_REL_JMP);
|
|
|
|
|
|
|
|
0020a 48 8b 85 18 03
|
|
|
|
00 00 mov rax, QWORD PTR Link$[rbp]
|
|
|
|
00211 c7 40 18 06 00
|
|
|
|
00 00 mov DWORD PTR [rax+24], 6
|
|
|
|
|
|
|
|
; 84 :
|
|
|
|
; 85 : return Link;
|
|
|
|
|
|
|
|
00218 48 8b 85 18 03
|
|
|
|
00 00 mov rax, QWORD PTR Link$[rbp]
|
|
|
|
$LN1@ObfGenJmpT:
|
|
|
|
|
|
|
|
; 86 : }
|
|
|
|
|
|
|
|
0021f 48 8b f8 mov rdi, rax
|
|
|
|
00222 48 8d 4d d0 lea rcx, QWORD PTR [rbp-48]
|
|
|
|
00226 48 8d 15 00 00
|
|
|
|
00 00 lea rdx, OFFSET FLAT:?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcFrameData
|
|
|
|
0022d e8 00 00 00 00 call _RTC_CheckStackVars
|
|
|
|
00232 48 8b c7 mov rax, rdi
|
|
|
|
00235 48 8b 8d c0 06
|
|
|
|
00 00 mov rcx, QWORD PTR __$ArrayPad$[rbp]
|
|
|
|
0023c 48 33 cd xor rcx, rbp
|
|
|
|
0023f e8 00 00 00 00 call __security_check_cookie
|
|
|
|
00244 48 8d a5 d0 06
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+1744]
|
|
|
|
0024b 5f pop rdi
|
|
|
|
0024c 5e pop rsi
|
|
|
|
0024d 5d pop rbp
|
|
|
|
0024e c3 ret 0
|
|
|
|
?ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z ENDP ; ObfGenJmpToLabel
|
|
|
|
_TEXT ENDS
|
|
|
|
; COMDAT text$x
|
|
|
|
text$x SEGMENT
|
|
|
|
MachineState$ = 8
|
|
|
|
EncoderInstruction$ = 48
|
|
|
|
EncoderRequest$ = 496
|
|
|
|
EncodeBuffer$ = 712
|
|
|
|
ReturnedSize$ = 756
|
|
|
|
Link$ = 792
|
|
|
|
$T8 = 1400
|
|
|
|
$T9 = 1480
|
|
|
|
$T10 = 1560
|
|
|
|
$T11 = 1592
|
|
|
|
$T12 = 1624
|
|
|
|
$T13 = 1664
|
|
|
|
tv145 = 1720
|
|
|
|
tv133 = 1720
|
|
|
|
__$ArrayPad$ = 1728
|
|
|
|
LabelId$ = 1776
|
|
|
|
DisplacementWidth$ = 1784
|
|
|
|
?dtor$0@?0??ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA PROC ; `ObfGenJmpToLabel'::`1'::dtor$0
|
|
|
|
00000 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00005 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000a 55 push rbp
|
|
|
|
0000b 57 push rdi
|
|
|
|
0000c 48 83 ec 28 sub rsp, 40 ; 00000028H
|
|
|
|
00010 48 8d 6a 30 lea rbp, QWORD PTR [rdx+48]
|
|
|
|
00014 ba f0 00 00 00 mov edx, 240 ; 000000f0H
|
|
|
|
00019 48 8b 8d 38 06
|
|
|
|
00 00 mov rcx, QWORD PTR $T11[rbp]
|
|
|
|
00020 e8 00 00 00 00 call ??3@YAXPEAX_K@Z ; operator delete
|
|
|
|
00025 48 83 c4 28 add rsp, 40 ; 00000028H
|
|
|
|
00029 5f pop rdi
|
|
|
|
0002a 5d pop rbp
|
|
|
|
0002b c3 ret 0
|
|
|
|
?dtor$0@?0??ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA ENDP ; `ObfGenJmpToLabel'::`1'::dtor$0
|
|
|
|
text$x ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; COMDAT text$x
|
|
|
|
text$x SEGMENT
|
|
|
|
MachineState$ = 8
|
|
|
|
EncoderInstruction$ = 48
|
|
|
|
EncoderRequest$ = 496
|
|
|
|
EncodeBuffer$ = 712
|
|
|
|
ReturnedSize$ = 756
|
|
|
|
Link$ = 792
|
|
|
|
$T8 = 1400
|
|
|
|
$T9 = 1480
|
|
|
|
$T10 = 1560
|
|
|
|
$T11 = 1592
|
|
|
|
$T12 = 1624
|
|
|
|
$T13 = 1664
|
|
|
|
tv145 = 1720
|
|
|
|
tv133 = 1720
|
|
|
|
__$ArrayPad$ = 1728
|
|
|
|
LabelId$ = 1776
|
|
|
|
DisplacementWidth$ = 1784
|
|
|
|
?dtor$0@?0??ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA PROC ; `ObfGenJmpToLabel'::`1'::dtor$0
|
|
|
|
00000 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00005 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000a 55 push rbp
|
|
|
|
0000b 57 push rdi
|
|
|
|
0000c 48 83 ec 28 sub rsp, 40 ; 00000028H
|
|
|
|
00010 48 8d 6a 30 lea rbp, QWORD PTR [rdx+48]
|
|
|
|
00014 ba f0 00 00 00 mov edx, 240 ; 000000f0H
|
|
|
|
00019 48 8b 8d 38 06
|
|
|
|
00 00 mov rcx, QWORD PTR $T11[rbp]
|
|
|
|
00020 e8 00 00 00 00 call ??3@YAXPEAX_K@Z ; operator delete
|
|
|
|
00025 48 83 c4 28 add rsp, 40 ; 00000028H
|
|
|
|
00029 5f pop rdi
|
|
|
|
0002a 5d pop rbp
|
|
|
|
0002b c3 ret 0
|
|
|
|
?dtor$0@?0??ObfGenJmpToLabel@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA ENDP ; `ObfGenJmpToLabel'::`1'::dtor$0
|
|
|
|
text$x ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\@\Work\code-virtualizer\CodeVirtualizer\OpaqueBranching.cpp
|
|
|
|
; COMDAT ?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
MachineState$ = 8
|
|
|
|
EncoderInstruction$ = 48
|
|
|
|
EncoderRequest$ = 496
|
|
|
|
EncodeBuffer$ = 712
|
|
|
|
ReturnedSize$ = 756
|
|
|
|
Link$ = 792
|
|
|
|
$T8 = 1400
|
|
|
|
$T9 = 1480
|
|
|
|
$T10 = 1560
|
|
|
|
$T11 = 1592
|
|
|
|
$T12 = 1624
|
|
|
|
$T13 = 1656
|
|
|
|
$T14 = 1696
|
|
|
|
tv77 = 1748
|
|
|
|
tv149 = 1752
|
|
|
|
tv137 = 1752
|
|
|
|
__$ArrayPad$ = 1760
|
|
|
|
LabelId$ = 1808
|
|
|
|
DisplacementWidth$ = 1816
|
|
|
|
?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z PROC ; ObfGenRandomJcc, COMDAT
|
|
|
|
|
|
|
|
; 27 : {
|
|
|
|
|
|
|
|
$LN11:
|
|
|
|
00000 89 54 24 10 mov DWORD PTR [rsp+16], edx
|
|
|
|
00004 89 4c 24 08 mov DWORD PTR [rsp+8], ecx
|
|
|
|
00008 55 push rbp
|
|
|
|
00009 56 push rsi
|
|
|
|
0000a 57 push rdi
|
|
|
|
0000b 48 81 ec 20 07
|
|
|
|
00 00 sub rsp, 1824 ; 00000720H
|
|
|
|
00012 48 8d 6c 24 30 lea rbp, QWORD PTR [rsp+48]
|
|
|
|
00017 48 8d 7c 24 30 lea rdi, QWORD PTR [rsp+48]
|
|
|
|
0001c b9 2c 01 00 00 mov ecx, 300 ; 0000012cH
|
|
|
|
00021 b8 cc cc cc cc mov eax, -858993460 ; ccccccccH
|
|
|
|
00026 f3 ab rep stosd
|
|
|
|
00028 8b 8c 24 48 07
|
|
|
|
00 00 mov ecx, DWORD PTR [rsp+1864]
|
|
|
|
0002f 48 8b 05 00 00
|
|
|
|
00 00 mov rax, QWORD PTR __security_cookie
|
|
|
|
00036 48 33 c5 xor rax, rbp
|
|
|
|
00039 48 89 85 e0 06
|
|
|
|
00 00 mov QWORD PTR __$ArrayPad$[rbp], rax
|
|
|
|
00040 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__A8BC9087_OpaqueBranching@cpp
|
|
|
|
00047 e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 28 : XED_STATE MachineState;
|
|
|
|
; 29 : MachineState.mmode = XED_MACHINE_MODE_LONG_64;
|
|
|
|
|
|
|
|
0004c c7 45 08 01 00
|
|
|
|
00 00 mov DWORD PTR MachineState$[rbp], 1
|
|
|
|
|
|
|
|
; 30 : MachineState.stack_addr_width = XED_ADDRESS_WIDTH_64b;
|
|
|
|
|
|
|
|
00053 c7 45 0c 08 00
|
|
|
|
00 00 mov DWORD PTR MachineState$[rbp+4], 8
|
|
|
|
|
|
|
|
; 31 : XED_ENCODER_INSTRUCTION EncoderInstruction;
|
|
|
|
; 32 : XED_ENCODER_REQUEST EncoderRequest;
|
|
|
|
; 33 : UCHAR EncodeBuffer[15];
|
|
|
|
; 34 : UINT ReturnedSize;
|
|
|
|
; 35 :
|
|
|
|
; 36 : XedInst1(&EncoderInstruction, MachineState, ObfGetRandomJccClass(), DisplacementWidth, XedRelBr(0, DisplacementWidth));
|
|
|
|
|
|
|
|
0005a 44 8b 85 18 07
|
|
|
|
00 00 mov r8d, DWORD PTR DisplacementWidth$[rbp]
|
|
|
|
00061 33 d2 xor edx, edx
|
|
|
|
00063 48 8d 8d c8 05
|
|
|
|
00 00 lea rcx, QWORD PTR $T9[rbp]
|
|
|
|
0006a e8 00 00 00 00 call xed_relbr
|
|
|
|
0006f 48 8d 8d 78 05
|
|
|
|
00 00 lea rcx, QWORD PTR $T8[rbp]
|
|
|
|
00076 48 8b f9 mov rdi, rcx
|
|
|
|
00079 48 8b f0 mov rsi, rax
|
|
|
|
0007c b9 30 00 00 00 mov ecx, 48 ; 00000030H
|
|
|
|
00081 f3 a4 rep movsb
|
|
|
|
00083 e8 00 00 00 00 call ?ObfGetRandomJccClass@@YA?AW4xed_iclass_enum_t@@XZ ; ObfGetRandomJccClass
|
|
|
|
00088 89 85 d4 06 00
|
|
|
|
00 mov DWORD PTR tv77[rbp], eax
|
|
|
|
0008e 48 8b 45 08 mov rax, QWORD PTR MachineState$[rbp]
|
|
|
|
00092 48 89 85 18 06
|
|
|
|
00 00 mov QWORD PTR $T10[rbp], rax
|
|
|
|
00099 48 8d 85 a0 06
|
|
|
|
00 00 lea rax, QWORD PTR $T14[rbp]
|
|
|
|
000a0 48 8d 8d 78 05
|
|
|
|
00 00 lea rcx, QWORD PTR $T8[rbp]
|
|
|
|
000a7 48 8b f8 mov rdi, rax
|
|
|
|
000aa 48 8b f1 mov rsi, rcx
|
|
|
|
000ad b9 30 00 00 00 mov ecx, 48 ; 00000030H
|
|
|
|
000b2 f3 a4 rep movsb
|
|
|
|
000b4 48 8d 85 a0 06
|
|
|
|
00 00 lea rax, QWORD PTR $T14[rbp]
|
|
|
|
000bb 48 89 44 24 20 mov QWORD PTR [rsp+32], rax
|
|
|
|
000c0 44 8b 8d 18 07
|
|
|
|
00 00 mov r9d, DWORD PTR DisplacementWidth$[rbp]
|
|
|
|
000c7 44 8b 85 d4 06
|
|
|
|
00 00 mov r8d, DWORD PTR tv77[rbp]
|
|
|
|
000ce 48 8b 95 18 06
|
|
|
|
00 00 mov rdx, QWORD PTR $T10[rbp]
|
|
|
|
000d5 48 8d 4d 30 lea rcx, QWORD PTR EncoderInstruction$[rbp]
|
|
|
|
000d9 e8 00 00 00 00 call xed_inst1
|
|
|
|
|
|
|
|
; 37 :
|
|
|
|
; 38 : XedEncoderRequestZeroSetMode(&EncoderRequest, &MachineState);
|
|
|
|
|
|
|
|
000de 48 8d 55 08 lea rdx, QWORD PTR MachineState$[rbp]
|
|
|
|
000e2 48 8d 8d f0 01
|
|
|
|
00 00 lea rcx, QWORD PTR EncoderRequest$[rbp]
|
|
|
|
000e9 e8 00 00 00 00 call xed_encoder_request_zero_set_mode
|
|
|
|
|
|
|
|
; 39 : if (!XedConvertToEncoderRequest(&EncoderRequest, &EncoderInstruction))
|
|
|
|
|
|
|
|
000ee 48 8d 55 30 lea rdx, QWORD PTR EncoderInstruction$[rbp]
|
|
|
|
000f2 48 8d 8d f0 01
|
|
|
|
00 00 lea rcx, QWORD PTR EncoderRequest$[rbp]
|
|
|
|
000f9 e8 00 00 00 00 call xed_convert_to_encoder_request
|
|
|
|
000fe 85 c0 test eax, eax
|
|
|
|
00100 75 07 jne SHORT $LN2@ObfGenRand
|
|
|
|
|
|
|
|
; 40 : return NULL;
|
|
|
|
|
|
|
|
00102 33 c0 xor eax, eax
|
|
|
|
00104 e9 30 01 00 00 jmp $LN1@ObfGenRand
|
|
|
|
$LN2@ObfGenRand:
|
|
|
|
|
|
|
|
; 41 :
|
|
|
|
; 42 : if (XED_ERROR_NONE != XedEncode(&EncoderRequest, EncodeBuffer, 15, &ReturnedSize))
|
|
|
|
|
|
|
|
00109 4c 8d 8d f4 02
|
|
|
|
00 00 lea r9, QWORD PTR ReturnedSize$[rbp]
|
|
|
|
00110 41 b8 0f 00 00
|
|
|
|
00 mov r8d, 15
|
|
|
|
00116 48 8d 95 c8 02
|
|
|
|
00 00 lea rdx, QWORD PTR EncodeBuffer$[rbp]
|
|
|
|
0011d 48 8d 8d f0 01
|
|
|
|
00 00 lea rcx, QWORD PTR EncoderRequest$[rbp]
|
|
|
|
00124 e8 00 00 00 00 call xed_encode
|
|
|
|
00129 85 c0 test eax, eax
|
|
|
|
0012b 74 07 je SHORT $LN3@ObfGenRand
|
|
|
|
|
|
|
|
; 43 : return NULL;
|
|
|
|
|
|
|
|
0012d 33 c0 xor eax, eax
|
|
|
|
0012f e9 05 01 00 00 jmp $LN1@ObfGenRand
|
|
|
|
$LN3@ObfGenRand:
|
|
|
|
|
|
|
|
; 44 :
|
|
|
|
; 45 : PNATIVE_CODE_LINK Link = new NATIVE_CODE_LINK(CODE_FLAG_IS_INST, EncodeBuffer, ReturnedSize);
|
|
|
|
|
|
|
|
00134 b9 f0 00 00 00 mov ecx, 240 ; 000000f0H
|
|
|
|
00139 e8 00 00 00 00 call ??2@YAPEAX_K@Z ; operator new
|
|
|
|
0013e 48 89 85 58 06
|
|
|
|
00 00 mov QWORD PTR $T12[rbp], rax
|
|
|
|
00145 48 83 bd 58 06
|
|
|
|
00 00 00 cmp QWORD PTR $T12[rbp], 0
|
|
|
|
0014d 74 30 je SHORT $LN6@ObfGenRand
|
|
|
|
0014f c7 44 24 20 00
|
|
|
|
00 00 00 mov DWORD PTR [rsp+32], 0
|
|
|
|
00157 44 8b 8d f4 02
|
|
|
|
00 00 mov r9d, DWORD PTR ReturnedSize$[rbp]
|
|
|
|
0015e 4c 8d 85 c8 02
|
|
|
|
00 00 lea r8, QWORD PTR EncodeBuffer$[rbp]
|
|
|
|
00165 ba 04 00 00 00 mov edx, 4
|
|
|
|
0016a 48 8b 8d 58 06
|
|
|
|
00 00 mov rcx, QWORD PTR $T12[rbp]
|
|
|
|
00171 e8 00 00 00 00 call ??0_NATIVE_CODE_LINK@@QEAA@KPEAXKH@Z ; _NATIVE_CODE_LINK::_NATIVE_CODE_LINK
|
|
|
|
00176 48 89 85 d8 06
|
|
|
|
00 00 mov QWORD PTR tv137[rbp], rax
|
|
|
|
0017d eb 0b jmp SHORT $LN7@ObfGenRand
|
|
|
|
$LN6@ObfGenRand:
|
|
|
|
0017f 48 c7 85 d8 06
|
|
|
|
00 00 00 00 00
|
|
|
|
00 mov QWORD PTR tv137[rbp], 0
|
|
|
|
$LN7@ObfGenRand:
|
|
|
|
0018a 48 8b 85 d8 06
|
|
|
|
00 00 mov rax, QWORD PTR tv137[rbp]
|
|
|
|
00191 48 89 85 38 06
|
|
|
|
00 00 mov QWORD PTR $T11[rbp], rax
|
|
|
|
00198 48 8b 85 38 06
|
|
|
|
00 00 mov rax, QWORD PTR $T11[rbp]
|
|
|
|
0019f 48 89 85 18 03
|
|
|
|
00 00 mov QWORD PTR Link$[rbp], rax
|
|
|
|
|
|
|
|
; 46 : if (XED_ERROR_NONE != XedDecode(&Link->XedInstruction, Link->RawData, Link->RawDataSize))
|
|
|
|
|
|
|
|
001a6 48 8b 85 18 03
|
|
|
|
00 00 mov rax, QWORD PTR Link$[rbp]
|
|
|
|
001ad 48 83 c0 30 add rax, 48 ; 00000030H
|
|
|
|
001b1 48 8b 8d 18 03
|
|
|
|
00 00 mov rcx, QWORD PTR Link$[rbp]
|
|
|
|
001b8 44 8b 41 28 mov r8d, DWORD PTR [rcx+40]
|
|
|
|
001bc 48 8b 8d 18 03
|
|
|
|
00 00 mov rcx, QWORD PTR Link$[rbp]
|
|
|
|
001c3 48 8b 51 20 mov rdx, QWORD PTR [rcx+32]
|
|
|
|
001c7 48 8b c8 mov rcx, rax
|
|
|
|
001ca e8 00 00 00 00 call xed_decode
|
|
|
|
001cf 85 c0 test eax, eax
|
|
|
|
001d1 74 41 je SHORT $LN4@ObfGenRand
|
|
|
|
|
|
|
|
; 47 : {
|
|
|
|
; 48 : delete Link;
|
|
|
|
|
|
|
|
001d3 48 8b 85 18 03
|
|
|
|
00 00 mov rax, QWORD PTR Link$[rbp]
|
|
|
|
001da 48 89 85 78 06
|
|
|
|
00 00 mov QWORD PTR $T13[rbp], rax
|
|
|
|
001e1 48 83 bd 78 06
|
|
|
|
00 00 00 cmp QWORD PTR $T13[rbp], 0
|
|
|
|
001e9 74 1a je SHORT $LN8@ObfGenRand
|
|
|
|
001eb ba 01 00 00 00 mov edx, 1
|
|
|
|
001f0 48 8b 8d 78 06
|
|
|
|
00 00 mov rcx, QWORD PTR $T13[rbp]
|
|
|
|
001f7 e8 00 00 00 00 call ??_G_NATIVE_CODE_LINK@@QEAAPEAXI@Z
|
|
|
|
001fc 48 89 85 d8 06
|
|
|
|
00 00 mov QWORD PTR tv149[rbp], rax
|
|
|
|
00203 eb 0b jmp SHORT $LN9@ObfGenRand
|
|
|
|
$LN8@ObfGenRand:
|
|
|
|
00205 48 c7 85 d8 06
|
|
|
|
00 00 00 00 00
|
|
|
|
00 mov QWORD PTR tv149[rbp], 0
|
|
|
|
$LN9@ObfGenRand:
|
|
|
|
|
|
|
|
; 49 : return NULL;
|
|
|
|
|
|
|
|
00210 33 c0 xor eax, eax
|
|
|
|
00212 eb 25 jmp SHORT $LN1@ObfGenRand
|
|
|
|
$LN4@ObfGenRand:
|
|
|
|
|
|
|
|
; 50 : }
|
|
|
|
; 51 : Link->Label = LabelId;
|
|
|
|
|
|
|
|
00214 48 8b 85 18 03
|
|
|
|
00 00 mov rax, QWORD PTR Link$[rbp]
|
|
|
|
0021b 8b 8d 10 07 00
|
|
|
|
00 mov ecx, DWORD PTR LabelId$[rbp]
|
|
|
|
00221 89 48 1c mov DWORD PTR [rax+28], ecx
|
|
|
|
|
|
|
|
; 52 : Link->Flags = (CODE_FLAG_IS_INST | CODE_FLAG_IS_REL_JMP);
|
|
|
|
|
|
|
|
00224 48 8b 85 18 03
|
|
|
|
00 00 mov rax, QWORD PTR Link$[rbp]
|
|
|
|
0022b c7 40 18 06 00
|
|
|
|
00 00 mov DWORD PTR [rax+24], 6
|
|
|
|
|
|
|
|
; 53 :
|
|
|
|
; 54 : return Link;
|
|
|
|
|
|
|
|
00232 48 8b 85 18 03
|
|
|
|
00 00 mov rax, QWORD PTR Link$[rbp]
|
|
|
|
$LN1@ObfGenRand:
|
|
|
|
|
|
|
|
; 55 : }
|
|
|
|
|
|
|
|
00239 48 8b f8 mov rdi, rax
|
|
|
|
0023c 48 8d 4d d0 lea rcx, QWORD PTR [rbp-48]
|
|
|
|
00240 48 8d 15 00 00
|
|
|
|
00 00 lea rdx, OFFSET FLAT:?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z$rtcFrameData
|
|
|
|
00247 e8 00 00 00 00 call _RTC_CheckStackVars
|
|
|
|
0024c 48 8b c7 mov rax, rdi
|
|
|
|
0024f 48 8b 8d e0 06
|
|
|
|
00 00 mov rcx, QWORD PTR __$ArrayPad$[rbp]
|
|
|
|
00256 48 33 cd xor rcx, rbp
|
|
|
|
00259 e8 00 00 00 00 call __security_check_cookie
|
|
|
|
0025e 48 8d a5 f0 06
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+1776]
|
|
|
|
00265 5f pop rdi
|
|
|
|
00266 5e pop rsi
|
|
|
|
00267 5d pop rbp
|
|
|
|
00268 c3 ret 0
|
|
|
|
?ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z ENDP ; ObfGenRandomJcc
|
|
|
|
_TEXT ENDS
|
|
|
|
; COMDAT text$x
|
|
|
|
text$x SEGMENT
|
|
|
|
MachineState$ = 8
|
|
|
|
EncoderInstruction$ = 48
|
|
|
|
EncoderRequest$ = 496
|
|
|
|
EncodeBuffer$ = 712
|
|
|
|
ReturnedSize$ = 756
|
|
|
|
Link$ = 792
|
|
|
|
$T8 = 1400
|
|
|
|
$T9 = 1480
|
|
|
|
$T10 = 1560
|
|
|
|
$T11 = 1592
|
|
|
|
$T12 = 1624
|
|
|
|
$T13 = 1656
|
|
|
|
$T14 = 1696
|
|
|
|
tv77 = 1748
|
|
|
|
tv149 = 1752
|
|
|
|
tv137 = 1752
|
|
|
|
__$ArrayPad$ = 1760
|
|
|
|
LabelId$ = 1808
|
|
|
|
DisplacementWidth$ = 1816
|
|
|
|
?dtor$0@?0??ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA PROC ; `ObfGenRandomJcc'::`1'::dtor$0
|
|
|
|
00000 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00005 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000a 55 push rbp
|
|
|
|
0000b 57 push rdi
|
|
|
|
0000c 48 83 ec 28 sub rsp, 40 ; 00000028H
|
|
|
|
00010 48 8d 6a 30 lea rbp, QWORD PTR [rdx+48]
|
|
|
|
00014 ba f0 00 00 00 mov edx, 240 ; 000000f0H
|
|
|
|
00019 48 8b 8d 58 06
|
|
|
|
00 00 mov rcx, QWORD PTR $T12[rbp]
|
|
|
|
00020 e8 00 00 00 00 call ??3@YAXPEAX_K@Z ; operator delete
|
|
|
|
00025 48 83 c4 28 add rsp, 40 ; 00000028H
|
|
|
|
00029 5f pop rdi
|
|
|
|
0002a 5d pop rbp
|
|
|
|
0002b c3 ret 0
|
|
|
|
?dtor$0@?0??ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA ENDP ; `ObfGenRandomJcc'::`1'::dtor$0
|
|
|
|
text$x ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; COMDAT text$x
|
|
|
|
text$x SEGMENT
|
|
|
|
MachineState$ = 8
|
|
|
|
EncoderInstruction$ = 48
|
|
|
|
EncoderRequest$ = 496
|
|
|
|
EncodeBuffer$ = 712
|
|
|
|
ReturnedSize$ = 756
|
|
|
|
Link$ = 792
|
|
|
|
$T8 = 1400
|
|
|
|
$T9 = 1480
|
|
|
|
$T10 = 1560
|
|
|
|
$T11 = 1592
|
|
|
|
$T12 = 1624
|
|
|
|
$T13 = 1656
|
|
|
|
$T14 = 1696
|
|
|
|
tv77 = 1748
|
|
|
|
tv149 = 1752
|
|
|
|
tv137 = 1752
|
|
|
|
__$ArrayPad$ = 1760
|
|
|
|
LabelId$ = 1808
|
|
|
|
DisplacementWidth$ = 1816
|
|
|
|
?dtor$0@?0??ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA PROC ; `ObfGenRandomJcc'::`1'::dtor$0
|
|
|
|
00000 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00005 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000a 55 push rbp
|
|
|
|
0000b 57 push rdi
|
|
|
|
0000c 48 83 ec 28 sub rsp, 40 ; 00000028H
|
|
|
|
00010 48 8d 6a 30 lea rbp, QWORD PTR [rdx+48]
|
|
|
|
00014 ba f0 00 00 00 mov edx, 240 ; 000000f0H
|
|
|
|
00019 48 8b 8d 58 06
|
|
|
|
00 00 mov rcx, QWORD PTR $T12[rbp]
|
|
|
|
00020 e8 00 00 00 00 call ??3@YAXPEAX_K@Z ; operator delete
|
|
|
|
00025 48 83 c4 28 add rsp, 40 ; 00000028H
|
|
|
|
00029 5f pop rdi
|
|
|
|
0002a 5d pop rbp
|
|
|
|
0002b c3 ret 0
|
|
|
|
?dtor$0@?0??ObfGenRandomJcc@@YAPEAU_NATIVE_CODE_LINK@@KK@Z@4HA ENDP ; `ObfGenRandomJcc'::`1'::dtor$0
|
|
|
|
text$x ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\@\Work\code-virtualizer\CodeVirtualizer\OpaqueBranching.cpp
|
|
|
|
; COMDAT ?ObfGetRandomJccClass@@YA?AW4xed_iclass_enum_t@@XZ
|
|
|
|
_TEXT SEGMENT
|
|
|
|
tv66 = 192
|
|
|
|
?ObfGetRandomJccClass@@YA?AW4xed_iclass_enum_t@@XZ PROC ; ObfGetRandomJccClass, COMDAT
|
|
|
|
|
|
|
|
; 4 : {
|
|
|
|
|
|
|
|
$LN21:
|
|
|
|
00000 40 55 push rbp
|
|
|
|
00002 57 push rdi
|
|
|
|
00003 48 81 ec f8 00
|
|
|
|
00 00 sub rsp, 248 ; 000000f8H
|
|
|
|
0000a 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
0000f 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__A8BC9087_OpaqueBranching@cpp
|
|
|
|
00016 e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 5 : switch (rand() % 15)
|
|
|
|
|
|
|
|
0001b ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp_rand
|
|
|
|
00021 99 cdq
|
|
|
|
00022 b9 0f 00 00 00 mov ecx, 15
|
|
|
|
00027 f7 f9 idiv ecx
|
|
|
|
00029 8b c2 mov eax, edx
|
|
|
|
0002b 89 85 c0 00 00
|
|
|
|
00 mov DWORD PTR tv66[rbp], eax
|
|
|
|
00031 83 bd c0 00 00
|
|
|
|
00 0e cmp DWORD PTR tv66[rbp], 14
|
|
|
|
00038 0f 87 83 00 00
|
|
|
|
00 ja $LN2@ObfGetRand
|
|
|
|
0003e 48 63 85 c0 00
|
|
|
|
00 00 movsxd rax, DWORD PTR tv66[rbp]
|
|
|
|
00045 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__ImageBase
|
|
|
|
0004c 8b 84 81 00 00
|
|
|
|
00 00 mov eax, DWORD PTR $LN20@ObfGetRand[rcx+rax*4]
|
|
|
|
00053 48 03 c1 add rax, rcx
|
|
|
|
00056 ff e0 jmp rax
|
|
|
|
$LN4@ObfGetRand:
|
|
|
|
|
|
|
|
; 6 : {
|
|
|
|
; 7 : case 0: return XED_ICLASS_JL;
|
|
|
|
|
|
|
|
00058 b8 3a 01 00 00 mov eax, 314 ; 0000013aH
|
|
|
|
0005d eb 67 jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN5@ObfGetRand:
|
|
|
|
|
|
|
|
; 8 : case 1: return XED_ICLASS_JLE;
|
|
|
|
|
|
|
|
0005f b8 3b 01 00 00 mov eax, 315 ; 0000013bH
|
|
|
|
00064 eb 60 jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN6@ObfGetRand:
|
|
|
|
|
|
|
|
; 9 : case 2: return XED_ICLASS_JNB;
|
|
|
|
|
|
|
|
00066 b8 3e 01 00 00 mov eax, 318 ; 0000013eH
|
|
|
|
0006b eb 59 jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN7@ObfGetRand:
|
|
|
|
|
|
|
|
; 10 : case 3: return XED_ICLASS_JNBE;
|
|
|
|
|
|
|
|
0006d b8 3f 01 00 00 mov eax, 319 ; 0000013fH
|
|
|
|
00072 eb 52 jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN8@ObfGetRand:
|
|
|
|
|
|
|
|
; 11 : case 4: return XED_ICLASS_JNL;
|
|
|
|
|
|
|
|
00074 b8 40 01 00 00 mov eax, 320 ; 00000140H
|
|
|
|
00079 eb 4b jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN9@ObfGetRand:
|
|
|
|
|
|
|
|
; 12 : case 5: return XED_ICLASS_JNLE;
|
|
|
|
|
|
|
|
0007b b8 41 01 00 00 mov eax, 321 ; 00000141H
|
|
|
|
00080 eb 44 jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN10@ObfGetRand:
|
|
|
|
|
|
|
|
; 13 : case 6: return XED_ICLASS_JNO;
|
|
|
|
|
|
|
|
00082 b8 42 01 00 00 mov eax, 322 ; 00000142H
|
|
|
|
00087 eb 3d jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN11@ObfGetRand:
|
|
|
|
|
|
|
|
; 14 : case 7: return XED_ICLASS_JNP;
|
|
|
|
|
|
|
|
00089 b8 43 01 00 00 mov eax, 323 ; 00000143H
|
|
|
|
0008e eb 36 jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN12@ObfGetRand:
|
|
|
|
|
|
|
|
; 15 : case 8: return XED_ICLASS_JNS;
|
|
|
|
|
|
|
|
00090 b8 44 01 00 00 mov eax, 324 ; 00000144H
|
|
|
|
00095 eb 2f jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN13@ObfGetRand:
|
|
|
|
|
|
|
|
; 16 : case 9: return XED_ICLASS_JNZ;
|
|
|
|
|
|
|
|
00097 b8 45 01 00 00 mov eax, 325 ; 00000145H
|
|
|
|
0009c eb 28 jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN14@ObfGetRand:
|
|
|
|
|
|
|
|
; 17 : case 10: return XED_ICLASS_JO;
|
|
|
|
|
|
|
|
0009e b8 46 01 00 00 mov eax, 326 ; 00000146H
|
|
|
|
000a3 eb 21 jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN15@ObfGetRand:
|
|
|
|
|
|
|
|
; 18 : case 11: return XED_ICLASS_JP;
|
|
|
|
|
|
|
|
000a5 b8 47 01 00 00 mov eax, 327 ; 00000147H
|
|
|
|
000aa eb 1a jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN16@ObfGetRand:
|
|
|
|
|
|
|
|
; 19 : case 12: return XED_ICLASS_JRCXZ;
|
|
|
|
|
|
|
|
000ac b8 48 01 00 00 mov eax, 328 ; 00000148H
|
|
|
|
000b1 eb 13 jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN17@ObfGetRand:
|
|
|
|
|
|
|
|
; 20 : case 13: return XED_ICLASS_JS;
|
|
|
|
|
|
|
|
000b3 b8 49 01 00 00 mov eax, 329 ; 00000149H
|
|
|
|
000b8 eb 0c jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN18@ObfGetRand:
|
|
|
|
|
|
|
|
; 21 : case 14: return XED_ICLASS_JZ;
|
|
|
|
|
|
|
|
000ba b8 4a 01 00 00 mov eax, 330 ; 0000014aH
|
|
|
|
000bf eb 05 jmp SHORT $LN1@ObfGetRand
|
|
|
|
$LN2@ObfGetRand:
|
|
|
|
|
|
|
|
; 22 : }
|
|
|
|
; 23 : return XED_ICLASS_JLE;
|
|
|
|
|
|
|
|
000c1 b8 3b 01 00 00 mov eax, 315 ; 0000013bH
|
|
|
|
$LN1@ObfGetRand:
|
|
|
|
|
|
|
|
; 24 : }
|
|
|
|
|
|
|
|
000c6 48 8d a5 d8 00
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+216]
|
|
|
|
000cd 5f pop rdi
|
|
|
|
000ce 5d pop rbp
|
|
|
|
000cf c3 ret 0
|
|
|
|
$LN20@ObfGetRand:
|
|
|
|
000d0 00 00 00 00 DD $LN4@ObfGetRand
|
|
|
|
000d4 00 00 00 00 DD $LN5@ObfGetRand
|
|
|
|
000d8 00 00 00 00 DD $LN6@ObfGetRand
|
|
|
|
000dc 00 00 00 00 DD $LN7@ObfGetRand
|
|
|
|
000e0 00 00 00 00 DD $LN8@ObfGetRand
|
|
|
|
000e4 00 00 00 00 DD $LN9@ObfGetRand
|
|
|
|
000e8 00 00 00 00 DD $LN10@ObfGetRand
|
|
|
|
000ec 00 00 00 00 DD $LN11@ObfGetRand
|
|
|
|
000f0 00 00 00 00 DD $LN12@ObfGetRand
|
|
|
|
000f4 00 00 00 00 DD $LN13@ObfGetRand
|
|
|
|
000f8 00 00 00 00 DD $LN14@ObfGetRand
|
|
|
|
000fc 00 00 00 00 DD $LN15@ObfGetRand
|
|
|
|
00100 00 00 00 00 DD $LN16@ObfGetRand
|
|
|
|
00104 00 00 00 00 DD $LN17@ObfGetRand
|
|
|
|
00108 00 00 00 00 DD $LN18@ObfGetRand
|
|
|
|
?ObfGetRandomJccClass@@YA?AW4xed_iclass_enum_t@@XZ ENDP ; ObfGetRandomJccClass
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; COMDAT ??_G_NATIVE_CODE_LINK@@QEAAPEAXI@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
this$ = 224
|
|
|
|
__flags$ = 232
|
|
|
|
??_G_NATIVE_CODE_LINK@@QEAAPEAXI@Z PROC ; _NATIVE_CODE_LINK::`scalar deleting destructor', COMDAT
|
|
|
|
$LN4:
|
|
|
|
00000 89 54 24 10 mov DWORD PTR [rsp+16], edx
|
|
|
|
00004 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00009 55 push rbp
|
|
|
|
0000a 57 push rdi
|
|
|
|
0000b 48 81 ec e8 00
|
|
|
|
00 00 sub rsp, 232 ; 000000e8H
|
|
|
|
00012 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
00017 48 8b 8d e0 00
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
0001e e8 00 00 00 00 call ??1_NATIVE_CODE_LINK@@QEAA@XZ ; _NATIVE_CODE_LINK::~_NATIVE_CODE_LINK
|
|
|
|
00023 8b 85 e8 00 00
|
|
|
|
00 mov eax, DWORD PTR __flags$[rbp]
|
|
|
|
00029 83 e0 01 and eax, 1
|
|
|
|
0002c 85 c0 test eax, eax
|
|
|
|
0002e 74 11 je SHORT $LN2@scalar
|
|
|
|
00030 ba f0 00 00 00 mov edx, 240 ; 000000f0H
|
|
|
|
00035 48 8b 8d e0 00
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
0003c e8 00 00 00 00 call ??3@YAXPEAX_K@Z ; operator delete
|
|
|
|
$LN2@scalar:
|
|
|
|
00041 48 8b 85 e0 00
|
|
|
|
00 00 mov rax, QWORD PTR this$[rbp]
|
|
|
|
00048 48 8d a5 c8 00
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+200]
|
|
|
|
0004f 5f pop rdi
|
|
|
|
00050 5d pop rbp
|
|
|
|
00051 c3 ret 0
|
|
|
|
??_G_NATIVE_CODE_LINK@@QEAAPEAXI@Z ENDP ; _NATIVE_CODE_LINK::`scalar deleting destructor'
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\@\Work\code-virtualizer\CodeVirtualizer\build\obj\wkit\include\xed\xed-encoder-hl.h
|
|
|
|
; COMDAT xed_inst1
|
|
|
|
_TEXT SEGMENT
|
|
|
|
inst$ = 224
|
|
|
|
mode$ = 232
|
|
|
|
iclass$ = 240
|
|
|
|
effective_operand_width$ = 248
|
|
|
|
op0$ = 256
|
|
|
|
xed_inst1 PROC ; COMDAT
|
|
|
|
|
|
|
|
; 490 : xed_encoder_operand_t op0) {
|
|
|
|
|
|
|
|
00000 44 89 4c 24 20 mov DWORD PTR [rsp+32], r9d
|
|
|
|
00005 44 89 44 24 18 mov DWORD PTR [rsp+24], r8d
|
|
|
|
0000a 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000f 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00014 55 push rbp
|
|
|
|
00015 56 push rsi
|
|
|
|
00016 57 push rdi
|
|
|
|
00017 48 81 ec e0 00
|
|
|
|
00 00 sub rsp, 224 ; 000000e0H
|
|
|
|
0001e 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
00023 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__1C89993E_xed-encoder-hl@h
|
|
|
|
0002a e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 491 :
|
|
|
|
; 492 : inst->mode=mode;
|
|
|
|
|
|
|
|
0002f 48 8b 85 e0 00
|
|
|
|
00 00 mov rax, QWORD PTR inst$[rbp]
|
|
|
|
00036 48 8b 8d e8 00
|
|
|
|
00 00 mov rcx, QWORD PTR mode$[rbp]
|
|
|
|
0003d 48 89 08 mov QWORD PTR [rax], rcx
|
|
|
|
|
|
|
|
; 493 : inst->iclass = iclass;
|
|
|
|
|
|
|
|
00040 48 8b 85 e0 00
|
|
|
|
00 00 mov rax, QWORD PTR inst$[rbp]
|
|
|
|
00047 8b 8d f0 00 00
|
|
|
|
00 mov ecx, DWORD PTR iclass$[rbp]
|
|
|
|
0004d 89 48 08 mov DWORD PTR [rax+8], ecx
|
|
|
|
|
|
|
|
; 494 : inst->effective_operand_width = effective_operand_width;
|
|
|
|
|
|
|
|
00050 48 8b 85 e0 00
|
|
|
|
00 00 mov rax, QWORD PTR inst$[rbp]
|
|
|
|
00057 8b 8d f8 00 00
|
|
|
|
00 mov ecx, DWORD PTR effective_operand_width$[rbp]
|
|
|
|
0005d 89 48 0c mov DWORD PTR [rax+12], ecx
|
|
|
|
|
|
|
|
; 495 : inst->effective_address_width = 0;
|
|
|
|
|
|
|
|
00060 48 8b 85 e0 00
|
|
|
|
00 00 mov rax, QWORD PTR inst$[rbp]
|
|
|
|
00067 c7 40 10 00 00
|
|
|
|
00 00 mov DWORD PTR [rax+16], 0
|
|
|
|
|
|
|
|
; 496 : inst->prefixes.i = 0;
|
|
|
|
|
|
|
|
0006e 48 8b 85 e0 00
|
|
|
|
00 00 mov rax, QWORD PTR inst$[rbp]
|
|
|
|
00075 c7 40 14 00 00
|
|
|
|
00 00 mov DWORD PTR [rax+20], 0
|
|
|
|
|
|
|
|
; 497 : inst->operands[0] = op0;
|
|
|
|
|
|
|
|
0007c b8 30 00 00 00 mov eax, 48 ; 00000030H
|
|
|
|
00081 48 6b c0 00 imul rax, rax, 0
|
|
|
|
00085 48 8b 8d e0 00
|
|
|
|
00 00 mov rcx, QWORD PTR inst$[rbp]
|
|
|
|
0008c 48 8d 7c 01 20 lea rdi, QWORD PTR [rcx+rax+32]
|
|
|
|
00091 48 8b b5 00 01
|
|
|
|
00 00 mov rsi, QWORD PTR op0$[rbp]
|
|
|
|
00098 b9 30 00 00 00 mov ecx, 48 ; 00000030H
|
|
|
|
0009d f3 a4 rep movsb
|
|
|
|
|
|
|
|
; 498 : inst->noperands = 1;
|
|
|
|
|
|
|
|
0009f 48 8b 85 e0 00
|
|
|
|
00 00 mov rax, QWORD PTR inst$[rbp]
|
|
|
|
000a6 c7 40 18 01 00
|
|
|
|
00 00 mov DWORD PTR [rax+24], 1
|
|
|
|
|
|
|
|
; 499 : }
|
|
|
|
|
|
|
|
000ad 48 8d a5 c0 00
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+192]
|
|
|
|
000b4 5f pop rdi
|
|
|
|
000b5 5e pop rsi
|
|
|
|
000b6 5d pop rbp
|
|
|
|
000b7 c3 ret 0
|
|
|
|
xed_inst1 ENDP
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\@\Work\code-virtualizer\CodeVirtualizer\build\obj\wkit\include\xed\xed-encoder-hl.h
|
|
|
|
; COMDAT xed_relbr
|
|
|
|
_TEXT SEGMENT
|
|
|
|
o$ = 8
|
|
|
|
__$ArrayPad$ = 264
|
|
|
|
$T4 = 304
|
|
|
|
brdisp$ = 312
|
|
|
|
width_bits$ = 320
|
|
|
|
xed_relbr PROC ; COMDAT
|
|
|
|
|
|
|
|
; 105 : xed_uint_t width_bits) {
|
|
|
|
|
|
|
|
00000 44 89 44 24 18 mov DWORD PTR [rsp+24], r8d
|
|
|
|
00005 89 54 24 10 mov DWORD PTR [rsp+16], edx
|
|
|
|
00009 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
0000e 55 push rbp
|
|
|
|
0000f 56 push rsi
|
|
|
|
00010 57 push rdi
|
|
|
|
00011 48 81 ec 30 01
|
|
|
|
00 00 sub rsp, 304 ; 00000130H
|
|
|
|
00018 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
0001d 48 8d 7c 24 20 lea rdi, QWORD PTR [rsp+32]
|
|
|
|
00022 b9 14 00 00 00 mov ecx, 20
|
|
|
|
00027 b8 cc cc cc cc mov eax, -858993460 ; ccccccccH
|
|
|
|
0002c f3 ab rep stosd
|
|
|
|
0002e 48 8b 8c 24 58
|
|
|
|
01 00 00 mov rcx, QWORD PTR [rsp+344]
|
|
|
|
00036 48 8b 05 00 00
|
|
|
|
00 00 mov rax, QWORD PTR __security_cookie
|
|
|
|
0003d 48 33 c5 xor rax, rbp
|
|
|
|
00040 48 89 85 08 01
|
|
|
|
00 00 mov QWORD PTR __$ArrayPad$[rbp], rax
|
|
|
|
00047 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__1C89993E_xed-encoder-hl@h
|
|
|
|
0004e e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 106 : xed_encoder_operand_t o;
|
|
|
|
; 107 : o.type = XED_ENCODER_OPERAND_TYPE_BRDISP;
|
|
|
|
|
|
|
|
00053 c7 45 08 01 00
|
|
|
|
00 00 mov DWORD PTR o$[rbp], 1
|
|
|
|
|
|
|
|
; 108 : o.u.brdisp = brdisp;
|
|
|
|
|
|
|
|
0005a 8b 85 38 01 00
|
|
|
|
00 mov eax, DWORD PTR brdisp$[rbp]
|
|
|
|
00060 89 45 10 mov DWORD PTR o$[rbp+8], eax
|
|
|
|
|
|
|
|
; 109 : o.width_bits = width_bits;
|
|
|
|
|
|
|
|
00063 8b 85 40 01 00
|
|
|
|
00 mov eax, DWORD PTR width_bits$[rbp]
|
|
|
|
00069 89 45 30 mov DWORD PTR o$[rbp+40], eax
|
|
|
|
|
|
|
|
; 110 : return o;
|
|
|
|
|
|
|
|
0006c 48 8d 45 08 lea rax, QWORD PTR o$[rbp]
|
|
|
|
00070 48 8b bd 30 01
|
|
|
|
00 00 mov rdi, QWORD PTR $T4[rbp]
|
|
|
|
00077 48 8b f0 mov rsi, rax
|
|
|
|
0007a b9 30 00 00 00 mov ecx, 48 ; 00000030H
|
|
|
|
0007f f3 a4 rep movsb
|
|
|
|
00081 48 8b 85 30 01
|
|
|
|
00 00 mov rax, QWORD PTR $T4[rbp]
|
|
|
|
|
|
|
|
; 111 : }
|
|
|
|
|
|
|
|
00088 48 8b f8 mov rdi, rax
|
|
|
|
0008b 48 8d 4d e0 lea rcx, QWORD PTR [rbp-32]
|
|
|
|
0008f 48 8d 15 00 00
|
|
|
|
00 00 lea rdx, OFFSET FLAT:xed_relbr$rtcFrameData
|
|
|
|
00096 e8 00 00 00 00 call _RTC_CheckStackVars
|
|
|
|
0009b 48 8b c7 mov rax, rdi
|
|
|
|
0009e 48 8b 8d 08 01
|
|
|
|
00 00 mov rcx, QWORD PTR __$ArrayPad$[rbp]
|
|
|
|
000a5 48 33 cd xor rcx, rbp
|
|
|
|
000a8 e8 00 00 00 00 call __security_check_cookie
|
|
|
|
000ad 48 8d a5 10 01
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+272]
|
|
|
|
000b4 5f pop rdi
|
|
|
|
000b5 5e pop rsi
|
|
|
|
000b6 5d pop rbp
|
|
|
|
000b7 c3 ret 0
|
|
|
|
xed_relbr ENDP
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30037\include\xloctime
|
|
|
|
; COMDAT ??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
$T1 = 200
|
|
|
|
tv93 = 264
|
|
|
|
tv85 = 264
|
|
|
|
this$ = 304
|
|
|
|
__formal$ = 312
|
|
|
|
_Lobj$ = 320
|
|
|
|
??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z PROC ; std::time_get<wchar_t,std::istreambuf_iterator<wchar_t,std::char_traits<wchar_t> > >::_Getvals<wchar_t>, COMDAT
|
|
|
|
|
|
|
|
; 173 : void __CLR_OR_THIS_CALL _Getvals(_Elem2, const _Locinfo& _Lobj) { // get values
|
|
|
|
|
|
|
|
$LN5:
|
|
|
|
00000 4c 89 44 24 18 mov QWORD PTR [rsp+24], r8
|
|
|
|
00005 66 89 54 24 10 mov WORD PTR [rsp+16], dx
|
|
|
|
0000a 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
0000f 55 push rbp
|
|
|
|
00010 56 push rsi
|
|
|
|
00011 57 push rdi
|
|
|
|
00012 48 81 ec 30 01
|
|
|
|
00 00 sub rsp, 304 ; 00000130H
|
|
|
|
00019 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
0001e 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__B7A2C865_xloctime
|
|
|
|
00025 e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 174 : _Cvt = _Lobj._Getcvt();
|
|
|
|
|
|
|
|
0002a 48 8d 95 c8 00
|
|
|
|
00 00 lea rdx, QWORD PTR $T1[rbp]
|
|
|
|
00031 48 8b 8d 40 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Lobj$[rbp]
|
|
|
|
00038 ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp_?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
|
|
|
|
0003e 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
00045 48 8d 79 2c lea rdi, QWORD PTR [rcx+44]
|
|
|
|
00049 48 8b f0 mov rsi, rax
|
|
|
|
0004c b9 2c 00 00 00 mov ecx, 44 ; 0000002cH
|
|
|
|
00051 f3 a4 rep movsb
|
|
|
|
|
|
|
|
; 175 :
|
|
|
|
; 176 : if (is_same_v<_Elem2, wchar_t>) {
|
|
|
|
|
|
|
|
00053 33 c0 xor eax, eax
|
|
|
|
00055 83 f8 01 cmp eax, 1
|
|
|
|
00058 74 5c je SHORT $LN2@Getvals
|
|
|
|
|
|
|
|
; 177 : _Days = reinterpret_cast<const _Elem*>(_Maklocwcs(reinterpret_cast<const wchar_t*>(_Lobj._W_Getdays())));
|
|
|
|
|
|
|
|
0005a 48 8b 8d 40 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Lobj$[rbp]
|
|
|
|
00061 ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp_?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
|
|
|
|
00067 48 8b c8 mov rcx, rax
|
|
|
|
0006a e8 00 00 00 00 call ?_Maklocwcs@std@@YAPEA_WPEB_W@Z ; std::_Maklocwcs
|
|
|
|
0006f 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
00076 48 89 41 10 mov QWORD PTR [rcx+16], rax
|
|
|
|
|
|
|
|
; 178 : _Months =
|
|
|
|
|
|
|
|
0007a 48 8b 8d 40 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Lobj$[rbp]
|
|
|
|
00081 ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp_?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
|
|
|
|
00087 48 8b c8 mov rcx, rax
|
|
|
|
0008a e8 00 00 00 00 call ?_Maklocwcs@std@@YAPEA_WPEB_W@Z ; std::_Maklocwcs
|
|
|
|
0008f 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
00096 48 89 41 18 mov QWORD PTR [rcx+24], rax
|
|
|
|
|
|
|
|
; 179 : reinterpret_cast<const _Elem*>(_Maklocwcs(reinterpret_cast<const wchar_t*>(_Lobj._W_Getmonths())));
|
|
|
|
; 180 : _Ampm = reinterpret_cast<const _Elem*>(_Maklocwcs(L":AM:am:PM:pm"));
|
|
|
|
|
|
|
|
0009a 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:??_C@_1BK@MHIKGOKE@?$AA?3?$AAA?$AAM?$AA?3?$AAa?$AAm?$AA?3?$AAP?$AAM?$AA?3?$AAp?$AAm@
|
|
|
|
000a1 e8 00 00 00 00 call ?_Maklocwcs@std@@YAPEA_WPEB_W@Z ; std::_Maklocwcs
|
|
|
|
000a6 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
000ad 48 89 41 20 mov QWORD PTR [rcx+32], rax
|
|
|
|
|
|
|
|
; 181 : } else {
|
|
|
|
|
|
|
|
000b1 e9 a3 00 00 00 jmp $LN3@Getvals
|
|
|
|
$LN2@Getvals:
|
|
|
|
|
|
|
|
; 182 : _Days = _Maklocstr(_Lobj._Getdays(), static_cast<_Elem*>(nullptr), _Cvt);
|
|
|
|
|
|
|
|
000b6 48 8b 85 30 01
|
|
|
|
00 00 mov rax, QWORD PTR this$[rbp]
|
|
|
|
000bd 48 83 c0 2c add rax, 44 ; 0000002cH
|
|
|
|
000c1 48 89 85 08 01
|
|
|
|
00 00 mov QWORD PTR tv85[rbp], rax
|
|
|
|
000c8 48 8b 8d 40 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Lobj$[rbp]
|
|
|
|
000cf ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp_?_Getdays@_Locinfo@std@@QEBAPEBDXZ
|
|
|
|
000d5 48 8b 8d 08 01
|
|
|
|
00 00 mov rcx, QWORD PTR tv85[rbp]
|
|
|
|
000dc 4c 8b c1 mov r8, rcx
|
|
|
|
000df 33 d2 xor edx, edx
|
|
|
|
000e1 48 8b c8 mov rcx, rax
|
|
|
|
000e4 e8 00 00 00 00 call ??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z ; std::_Maklocstr<wchar_t>
|
|
|
|
000e9 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
000f0 48 89 41 10 mov QWORD PTR [rcx+16], rax
|
|
|
|
|
|
|
|
; 183 : _Months = _Maklocstr(_Lobj._Getmonths(), static_cast<_Elem*>(nullptr), _Cvt);
|
|
|
|
|
|
|
|
000f4 48 8b 85 30 01
|
|
|
|
00 00 mov rax, QWORD PTR this$[rbp]
|
|
|
|
000fb 48 83 c0 2c add rax, 44 ; 0000002cH
|
|
|
|
000ff 48 89 85 08 01
|
|
|
|
00 00 mov QWORD PTR tv93[rbp], rax
|
|
|
|
00106 48 8b 8d 40 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Lobj$[rbp]
|
|
|
|
0010d ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp_?_Getmonths@_Locinfo@std@@QEBAPEBDXZ
|
|
|
|
00113 48 8b 8d 08 01
|
|
|
|
00 00 mov rcx, QWORD PTR tv93[rbp]
|
|
|
|
0011a 4c 8b c1 mov r8, rcx
|
|
|
|
0011d 33 d2 xor edx, edx
|
|
|
|
0011f 48 8b c8 mov rcx, rax
|
|
|
|
00122 e8 00 00 00 00 call ??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z ; std::_Maklocstr<wchar_t>
|
|
|
|
00127 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
0012e 48 89 41 18 mov QWORD PTR [rcx+24], rax
|
|
|
|
|
|
|
|
; 184 : _Ampm = _Maklocstr(":AM:am:PM:pm", static_cast<_Elem*>(nullptr), _Cvt);
|
|
|
|
|
|
|
|
00132 48 8b 85 30 01
|
|
|
|
00 00 mov rax, QWORD PTR this$[rbp]
|
|
|
|
00139 48 83 c0 2c add rax, 44 ; 0000002cH
|
|
|
|
0013d 4c 8b c0 mov r8, rax
|
|
|
|
00140 33 d2 xor edx, edx
|
|
|
|
00142 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:??_C@_0N@LPFKKEBD@?3AM?3am?3PM?3pm@
|
|
|
|
00149 e8 00 00 00 00 call ??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z ; std::_Maklocstr<wchar_t>
|
|
|
|
0014e 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
00155 48 89 41 20 mov QWORD PTR [rcx+32], rax
|
|
|
|
$LN3@Getvals:
|
|
|
|
|
|
|
|
; 185 : }
|
|
|
|
; 186 : }
|
|
|
|
|
|
|
|
00159 48 8d a5 10 01
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+272]
|
|
|
|
00160 5f pop rdi
|
|
|
|
00161 5e pop rsi
|
|
|
|
00162 5d pop rbp
|
|
|
|
00163 c3 ret 0
|
|
|
|
??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z ENDP ; std::time_get<wchar_t,std::istreambuf_iterator<wchar_t,std::char_traits<wchar_t> > >::_Getvals<wchar_t>
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30037\include\xloctime
|
|
|
|
; COMDAT ??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
$T1 = 200
|
|
|
|
tv93 = 264
|
|
|
|
tv85 = 264
|
|
|
|
this$ = 304
|
|
|
|
__formal$ = 312
|
|
|
|
_Lobj$ = 320
|
|
|
|
??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z PROC ; std::time_get<char,std::istreambuf_iterator<char,std::char_traits<char> > >::_Getvals<wchar_t>, COMDAT
|
|
|
|
|
|
|
|
; 173 : void __CLR_OR_THIS_CALL _Getvals(_Elem2, const _Locinfo& _Lobj) { // get values
|
|
|
|
|
|
|
|
$LN5:
|
|
|
|
00000 4c 89 44 24 18 mov QWORD PTR [rsp+24], r8
|
|
|
|
00005 66 89 54 24 10 mov WORD PTR [rsp+16], dx
|
|
|
|
0000a 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
0000f 55 push rbp
|
|
|
|
00010 56 push rsi
|
|
|
|
00011 57 push rdi
|
|
|
|
00012 48 81 ec 30 01
|
|
|
|
00 00 sub rsp, 304 ; 00000130H
|
|
|
|
00019 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
0001e 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__B7A2C865_xloctime
|
|
|
|
00025 e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 174 : _Cvt = _Lobj._Getcvt();
|
|
|
|
|
|
|
|
0002a 48 8d 95 c8 00
|
|
|
|
00 00 lea rdx, QWORD PTR $T1[rbp]
|
|
|
|
00031 48 8b 8d 40 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Lobj$[rbp]
|
|
|
|
00038 ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp_?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
|
|
|
|
0003e 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
00045 48 8d 79 2c lea rdi, QWORD PTR [rcx+44]
|
|
|
|
00049 48 8b f0 mov rsi, rax
|
|
|
|
0004c b9 2c 00 00 00 mov ecx, 44 ; 0000002cH
|
|
|
|
00051 f3 a4 rep movsb
|
|
|
|
|
|
|
|
; 175 :
|
|
|
|
; 176 : if (is_same_v<_Elem2, wchar_t>) {
|
|
|
|
|
|
|
|
00053 33 c0 xor eax, eax
|
|
|
|
00055 83 f8 01 cmp eax, 1
|
|
|
|
00058 74 5c je SHORT $LN2@Getvals
|
|
|
|
|
|
|
|
; 177 : _Days = reinterpret_cast<const _Elem*>(_Maklocwcs(reinterpret_cast<const wchar_t*>(_Lobj._W_Getdays())));
|
|
|
|
|
|
|
|
0005a 48 8b 8d 40 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Lobj$[rbp]
|
|
|
|
00061 ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp_?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
|
|
|
|
00067 48 8b c8 mov rcx, rax
|
|
|
|
0006a e8 00 00 00 00 call ?_Maklocwcs@std@@YAPEA_WPEB_W@Z ; std::_Maklocwcs
|
|
|
|
0006f 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
00076 48 89 41 10 mov QWORD PTR [rcx+16], rax
|
|
|
|
|
|
|
|
; 178 : _Months =
|
|
|
|
|
|
|
|
0007a 48 8b 8d 40 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Lobj$[rbp]
|
|
|
|
00081 ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp_?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
|
|
|
|
00087 48 8b c8 mov rcx, rax
|
|
|
|
0008a e8 00 00 00 00 call ?_Maklocwcs@std@@YAPEA_WPEB_W@Z ; std::_Maklocwcs
|
|
|
|
0008f 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
00096 48 89 41 18 mov QWORD PTR [rcx+24], rax
|
|
|
|
|
|
|
|
; 179 : reinterpret_cast<const _Elem*>(_Maklocwcs(reinterpret_cast<const wchar_t*>(_Lobj._W_Getmonths())));
|
|
|
|
; 180 : _Ampm = reinterpret_cast<const _Elem*>(_Maklocwcs(L":AM:am:PM:pm"));
|
|
|
|
|
|
|
|
0009a 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:??_C@_1BK@MHIKGOKE@?$AA?3?$AAA?$AAM?$AA?3?$AAa?$AAm?$AA?3?$AAP?$AAM?$AA?3?$AAp?$AAm@
|
|
|
|
000a1 e8 00 00 00 00 call ?_Maklocwcs@std@@YAPEA_WPEB_W@Z ; std::_Maklocwcs
|
|
|
|
000a6 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
000ad 48 89 41 20 mov QWORD PTR [rcx+32], rax
|
|
|
|
|
|
|
|
; 181 : } else {
|
|
|
|
|
|
|
|
000b1 e9 a3 00 00 00 jmp $LN3@Getvals
|
|
|
|
$LN2@Getvals:
|
|
|
|
|
|
|
|
; 182 : _Days = _Maklocstr(_Lobj._Getdays(), static_cast<_Elem*>(nullptr), _Cvt);
|
|
|
|
|
|
|
|
000b6 48 8b 85 30 01
|
|
|
|
00 00 mov rax, QWORD PTR this$[rbp]
|
|
|
|
000bd 48 83 c0 2c add rax, 44 ; 0000002cH
|
|
|
|
000c1 48 89 85 08 01
|
|
|
|
00 00 mov QWORD PTR tv85[rbp], rax
|
|
|
|
000c8 48 8b 8d 40 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Lobj$[rbp]
|
|
|
|
000cf ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp_?_Getdays@_Locinfo@std@@QEBAPEBDXZ
|
|
|
|
000d5 48 8b 8d 08 01
|
|
|
|
00 00 mov rcx, QWORD PTR tv85[rbp]
|
|
|
|
000dc 4c 8b c1 mov r8, rcx
|
|
|
|
000df 33 d2 xor edx, edx
|
|
|
|
000e1 48 8b c8 mov rcx, rax
|
|
|
|
000e4 e8 00 00 00 00 call ??$_Maklocstr@D@std@@YAPEADPEBDPEADAEBU_Cvtvec@@@Z ; std::_Maklocstr<char>
|
|
|
|
000e9 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
000f0 48 89 41 10 mov QWORD PTR [rcx+16], rax
|
|
|
|
|
|
|
|
; 183 : _Months = _Maklocstr(_Lobj._Getmonths(), static_cast<_Elem*>(nullptr), _Cvt);
|
|
|
|
|
|
|
|
000f4 48 8b 85 30 01
|
|
|
|
00 00 mov rax, QWORD PTR this$[rbp]
|
|
|
|
000fb 48 83 c0 2c add rax, 44 ; 0000002cH
|
|
|
|
000ff 48 89 85 08 01
|
|
|
|
00 00 mov QWORD PTR tv93[rbp], rax
|
|
|
|
00106 48 8b 8d 40 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Lobj$[rbp]
|
|
|
|
0010d ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp_?_Getmonths@_Locinfo@std@@QEBAPEBDXZ
|
|
|
|
00113 48 8b 8d 08 01
|
|
|
|
00 00 mov rcx, QWORD PTR tv93[rbp]
|
|
|
|
0011a 4c 8b c1 mov r8, rcx
|
|
|
|
0011d 33 d2 xor edx, edx
|
|
|
|
0011f 48 8b c8 mov rcx, rax
|
|
|
|
00122 e8 00 00 00 00 call ??$_Maklocstr@D@std@@YAPEADPEBDPEADAEBU_Cvtvec@@@Z ; std::_Maklocstr<char>
|
|
|
|
00127 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
0012e 48 89 41 18 mov QWORD PTR [rcx+24], rax
|
|
|
|
|
|
|
|
; 184 : _Ampm = _Maklocstr(":AM:am:PM:pm", static_cast<_Elem*>(nullptr), _Cvt);
|
|
|
|
|
|
|
|
00132 48 8b 85 30 01
|
|
|
|
00 00 mov rax, QWORD PTR this$[rbp]
|
|
|
|
00139 48 83 c0 2c add rax, 44 ; 0000002cH
|
|
|
|
0013d 4c 8b c0 mov r8, rax
|
|
|
|
00140 33 d2 xor edx, edx
|
|
|
|
00142 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:??_C@_0N@LPFKKEBD@?3AM?3am?3PM?3pm@
|
|
|
|
00149 e8 00 00 00 00 call ??$_Maklocstr@D@std@@YAPEADPEBDPEADAEBU_Cvtvec@@@Z ; std::_Maklocstr<char>
|
|
|
|
0014e 48 8b 8d 30 01
|
|
|
|
00 00 mov rcx, QWORD PTR this$[rbp]
|
|
|
|
00155 48 89 41 20 mov QWORD PTR [rcx+32], rax
|
|
|
|
$LN3@Getvals:
|
|
|
|
|
|
|
|
; 185 : }
|
|
|
|
; 186 : }
|
|
|
|
|
|
|
|
00159 48 8d a5 10 01
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+272]
|
|
|
|
00160 5f pop rdi
|
|
|
|
00161 5e pop rsi
|
|
|
|
00162 5d pop rbp
|
|
|
|
00163 c3 ret 0
|
|
|
|
??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z ENDP ; std::time_get<char,std::istreambuf_iterator<char,std::char_traits<char> > >::_Getvals<wchar_t>
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30037\include\xlocale
|
|
|
|
; COMDAT ??$_Maklocstr@D@std@@YAPEADPEBDPEADAEBU_Cvtvec@@@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
_Count$ = 8
|
|
|
|
_Ptrdest$ = 40
|
|
|
|
_Ptrnext$1 = 72
|
|
|
|
_Ptr$ = 320
|
|
|
|
__formal$ = 328
|
|
|
|
__formal$ = 336
|
|
|
|
??$_Maklocstr@D@std@@YAPEADPEBDPEADAEBU_Cvtvec@@@Z PROC ; std::_Maklocstr<char>, COMDAT
|
|
|
|
|
|
|
|
; 522 : _Elem* __CRTDECL _Maklocstr(const char* _Ptr, _Elem*, const _Locinfo::_Cvtvec&) {
|
|
|
|
|
|
|
|
$LN7:
|
|
|
|
00000 4c 89 44 24 18 mov QWORD PTR [rsp+24], r8
|
|
|
|
00005 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000a 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
0000f 55 push rbp
|
|
|
|
00010 57 push rdi
|
|
|
|
00011 48 81 ec 58 01
|
|
|
|
00 00 sub rsp, 344 ; 00000158H
|
|
|
|
00018 48 8d 6c 24 30 lea rbp, QWORD PTR [rsp+48]
|
|
|
|
0001d 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__76D543F7_xlocale
|
|
|
|
00024 e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 523 : // convert C string to _Elem sequence using _Cvtvec
|
|
|
|
; 524 : size_t _Count = _CSTD strlen(_Ptr) + 1;
|
|
|
|
|
|
|
|
00029 48 8b 8d 40 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Ptr$[rbp]
|
|
|
|
00030 e8 00 00 00 00 call strlen
|
|
|
|
00035 48 ff c0 inc rax
|
|
|
|
00038 48 89 45 08 mov QWORD PTR _Count$[rbp], rax
|
|
|
|
|
|
|
|
; 525 :
|
|
|
|
; 526 : _Elem* _Ptrdest = static_cast<_Elem*>(_calloc_dbg(_Count, sizeof(_Elem), _CRT_BLOCK, __FILE__, __LINE__));
|
|
|
|
|
|
|
|
0003c c7 44 24 20 0e
|
|
|
|
02 00 00 mov DWORD PTR [rsp+32], 526 ; 0000020eH
|
|
|
|
00044 4c 8d 0d 00 00
|
|
|
|
00 00 lea r9, OFFSET FLAT:??_C@_0GI@LEPEPCM@C?3?2Program?5Files?5?$CIx86?$CJ?2Microsof@
|
|
|
|
0004b 41 b8 02 00 00
|
|
|
|
00 mov r8d, 2
|
|
|
|
00051 ba 01 00 00 00 mov edx, 1
|
|
|
|
00056 48 8b 4d 08 mov rcx, QWORD PTR _Count$[rbp]
|
|
|
|
0005a ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp__calloc_dbg
|
|
|
|
00060 48 89 45 28 mov QWORD PTR _Ptrdest$[rbp], rax
|
|
|
|
|
|
|
|
; 527 :
|
|
|
|
; 528 : if (!_Ptrdest) {
|
|
|
|
|
|
|
|
00064 48 83 7d 28 00 cmp QWORD PTR _Ptrdest$[rbp], 0
|
|
|
|
00069 75 05 jne SHORT $LN5@Maklocstr
|
|
|
|
|
|
|
|
; 529 : _Xbad_alloc();
|
|
|
|
|
|
|
|
0006b e8 00 00 00 00 call ?_Xbad_alloc@std@@YAXXZ ; std::_Xbad_alloc
|
|
|
|
$LN5@Maklocstr:
|
|
|
|
|
|
|
|
; 530 : }
|
|
|
|
; 531 :
|
|
|
|
; 532 : for (_Elem* _Ptrnext = _Ptrdest; 0 < _Count; --_Count, ++_Ptrnext, ++_Ptr) {
|
|
|
|
|
|
|
|
00070 48 8b 45 28 mov rax, QWORD PTR _Ptrdest$[rbp]
|
|
|
|
00074 48 89 45 48 mov QWORD PTR _Ptrnext$1[rbp], rax
|
|
|
|
00078 eb 27 jmp SHORT $LN4@Maklocstr
|
|
|
|
$LN2@Maklocstr:
|
|
|
|
0007a 48 8b 45 08 mov rax, QWORD PTR _Count$[rbp]
|
|
|
|
0007e 48 ff c8 dec rax
|
|
|
|
00081 48 89 45 08 mov QWORD PTR _Count$[rbp], rax
|
|
|
|
00085 48 8b 45 48 mov rax, QWORD PTR _Ptrnext$1[rbp]
|
|
|
|
00089 48 ff c0 inc rax
|
|
|
|
0008c 48 89 45 48 mov QWORD PTR _Ptrnext$1[rbp], rax
|
|
|
|
00090 48 8b 85 40 01
|
|
|
|
00 00 mov rax, QWORD PTR _Ptr$[rbp]
|
|
|
|
00097 48 ff c0 inc rax
|
|
|
|
0009a 48 89 85 40 01
|
|
|
|
00 00 mov QWORD PTR _Ptr$[rbp], rax
|
|
|
|
$LN4@Maklocstr:
|
|
|
|
000a1 48 83 7d 08 00 cmp QWORD PTR _Count$[rbp], 0
|
|
|
|
000a6 76 12 jbe SHORT $LN3@Maklocstr
|
|
|
|
|
|
|
|
; 533 : *_Ptrnext = static_cast<_Elem>(static_cast<unsigned char>(*_Ptr));
|
|
|
|
|
|
|
|
000a8 48 8b 45 48 mov rax, QWORD PTR _Ptrnext$1[rbp]
|
|
|
|
000ac 48 8b 8d 40 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Ptr$[rbp]
|
|
|
|
000b3 0f b6 09 movzx ecx, BYTE PTR [rcx]
|
|
|
|
000b6 88 08 mov BYTE PTR [rax], cl
|
|
|
|
|
|
|
|
; 534 : }
|
|
|
|
|
|
|
|
000b8 eb c0 jmp SHORT $LN2@Maklocstr
|
|
|
|
$LN3@Maklocstr:
|
|
|
|
|
|
|
|
; 535 :
|
|
|
|
; 536 : return _Ptrdest;
|
|
|
|
|
|
|
|
000ba 48 8b 45 28 mov rax, QWORD PTR _Ptrdest$[rbp]
|
|
|
|
$LN6@Maklocstr:
|
|
|
|
|
|
|
|
; 537 : }
|
|
|
|
|
|
|
|
000be 48 8d a5 28 01
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+296]
|
|
|
|
000c5 5f pop rdi
|
|
|
|
000c6 5d pop rbp
|
|
|
|
000c7 c3 ret 0
|
|
|
|
??$_Maklocstr@D@std@@YAPEADPEBDPEADAEBU_Cvtvec@@@Z ENDP ; std::_Maklocstr<char>
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30037\include\xlocnum
|
|
|
|
; COMDAT ?_Maklocwcs@std@@YAPEA_WPEB_W@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
_Count$ = 8
|
|
|
|
_Ptrdest$ = 40
|
|
|
|
_Ptr$ = 288
|
|
|
|
?_Maklocwcs@std@@YAPEA_WPEB_W@Z PROC ; std::_Maklocwcs, COMDAT
|
|
|
|
|
|
|
|
; 90 : inline wchar_t* _Maklocwcs(const wchar_t* _Ptr) { // copy NTWCS to allocated storage
|
|
|
|
|
|
|
|
$LN4:
|
|
|
|
00000 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00005 55 push rbp
|
|
|
|
00006 57 push rdi
|
|
|
|
00007 48 81 ec 38 01
|
|
|
|
00 00 sub rsp, 312 ; 00000138H
|
|
|
|
0000e 48 8d 6c 24 30 lea rbp, QWORD PTR [rsp+48]
|
|
|
|
00013 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__E85225E0_xlocnum
|
|
|
|
0001a e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 91 : const size_t _Count = _CSTD wcslen(_Ptr) + 1;
|
|
|
|
|
|
|
|
0001f 48 8b 8d 20 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Ptr$[rbp]
|
|
|
|
00026 ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp_wcslen
|
|
|
|
0002c 48 ff c0 inc rax
|
|
|
|
0002f 48 89 45 08 mov QWORD PTR _Count$[rbp], rax
|
|
|
|
|
|
|
|
; 92 :
|
|
|
|
; 93 : wchar_t* _Ptrdest = static_cast<wchar_t*>(_calloc_dbg(_Count, sizeof(wchar_t), _CRT_BLOCK, __FILE__, __LINE__));
|
|
|
|
|
|
|
|
00033 8b 05 00 00 00
|
|
|
|
00 mov eax, DWORD PTR ?__LINE__Var@?0??_Maklocwcs@std@@YAPEA_WPEB_W@Z@4JA
|
|
|
|
00039 83 c0 03 add eax, 3
|
|
|
|
0003c 89 44 24 20 mov DWORD PTR [rsp+32], eax
|
|
|
|
00040 4c 8d 0d 00 00
|
|
|
|
00 00 lea r9, OFFSET FLAT:??_C@_0GI@IIACENIN@C?3?2Program?5Files?5?$CIx86?$CJ?2Microsof@
|
|
|
|
00047 41 b8 02 00 00
|
|
|
|
00 mov r8d, 2
|
|
|
|
0004d ba 02 00 00 00 mov edx, 2
|
|
|
|
00052 48 8b 4d 08 mov rcx, QWORD PTR _Count$[rbp]
|
|
|
|
00056 ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp__calloc_dbg
|
|
|
|
0005c 48 89 45 28 mov QWORD PTR _Ptrdest$[rbp], rax
|
|
|
|
|
|
|
|
; 94 :
|
|
|
|
; 95 : if (!_Ptrdest) {
|
|
|
|
|
|
|
|
00060 48 83 7d 28 00 cmp QWORD PTR _Ptrdest$[rbp], 0
|
|
|
|
00065 75 05 jne SHORT $LN2@Maklocwcs
|
|
|
|
|
|
|
|
; 96 : _Xbad_alloc();
|
|
|
|
|
|
|
|
00067 e8 00 00 00 00 call ?_Xbad_alloc@std@@YAXXZ ; std::_Xbad_alloc
|
|
|
|
$LN2@Maklocwcs:
|
|
|
|
|
|
|
|
; 97 : }
|
|
|
|
; 98 :
|
|
|
|
; 99 : _CSTD wmemcpy(_Ptrdest, _Ptr, _Count);
|
|
|
|
|
|
|
|
0006c 4c 8b 45 08 mov r8, QWORD PTR _Count$[rbp]
|
|
|
|
00070 48 8b 95 20 01
|
|
|
|
00 00 mov rdx, QWORD PTR _Ptr$[rbp]
|
|
|
|
00077 48 8b 4d 28 mov rcx, QWORD PTR _Ptrdest$[rbp]
|
|
|
|
0007b e8 00 00 00 00 call wmemcpy
|
|
|
|
|
|
|
|
; 100 : return _Ptrdest;
|
|
|
|
|
|
|
|
00080 48 8b 45 28 mov rax, QWORD PTR _Ptrdest$[rbp]
|
|
|
|
$LN3@Maklocwcs:
|
|
|
|
|
|
|
|
; 101 : }
|
|
|
|
|
|
|
|
00084 48 8d a5 08 01
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+264]
|
|
|
|
0008b 5f pop rdi
|
|
|
|
0008c 5d pop rbp
|
|
|
|
0008d c3 ret 0
|
|
|
|
?_Maklocwcs@std@@YAPEA_WPEB_W@Z ENDP ; std::_Maklocwcs
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30037\include\xlocale
|
|
|
|
; COMDAT ??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
_Count$ = 8
|
|
|
|
_Count1$ = 40
|
|
|
|
_Wchars$ = 72
|
|
|
|
_Ptr1$ = 104
|
|
|
|
_Bytes$ = 132
|
|
|
|
_Wc$ = 164
|
|
|
|
_Mbst1$ = 200
|
|
|
|
_Ptrdest$ = 232
|
|
|
|
_Ptrnext$ = 264
|
|
|
|
_Mbst2$ = 296
|
|
|
|
__$ArrayPad$ = 504
|
|
|
|
_Ptr$ = 544
|
|
|
|
__formal$ = 552
|
|
|
|
_Cvt$ = 560
|
|
|
|
??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z PROC ; std::_Maklocstr<wchar_t>, COMDAT
|
|
|
|
|
|
|
|
; 540 : inline wchar_t* __CRTDECL _Maklocstr(const char* _Ptr, wchar_t*, const _Locinfo::_Cvtvec& _Cvt) {
|
|
|
|
|
|
|
|
$LN12:
|
|
|
|
00000 4c 89 44 24 18 mov QWORD PTR [rsp+24], r8
|
|
|
|
00005 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000a 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
0000f 55 push rbp
|
|
|
|
00010 57 push rdi
|
|
|
|
00011 48 81 ec 38 02
|
|
|
|
00 00 sub rsp, 568 ; 00000238H
|
|
|
|
00018 48 8d 6c 24 30 lea rbp, QWORD PTR [rsp+48]
|
|
|
|
0001d 48 8d 7c 24 30 lea rdi, QWORD PTR [rsp+48]
|
|
|
|
00022 b9 52 00 00 00 mov ecx, 82 ; 00000052H
|
|
|
|
00027 b8 cc cc cc cc mov eax, -858993460 ; ccccccccH
|
|
|
|
0002c f3 ab rep stosd
|
|
|
|
0002e 48 8b 8c 24 58
|
|
|
|
02 00 00 mov rcx, QWORD PTR [rsp+600]
|
|
|
|
00036 48 8b 05 00 00
|
|
|
|
00 00 mov rax, QWORD PTR __security_cookie
|
|
|
|
0003d 48 33 c5 xor rax, rbp
|
|
|
|
00040 48 89 85 f8 01
|
|
|
|
00 00 mov QWORD PTR __$ArrayPad$[rbp], rax
|
|
|
|
00047 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__76D543F7_xlocale
|
|
|
|
0004e e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 541 : // convert C string to wchar_t sequence using _Cvtvec
|
|
|
|
; 542 : size_t _Count;
|
|
|
|
; 543 : size_t _Count1;
|
|
|
|
; 544 : size_t _Wchars;
|
|
|
|
; 545 : const char* _Ptr1;
|
|
|
|
; 546 : int _Bytes;
|
|
|
|
; 547 : wchar_t _Wc;
|
|
|
|
; 548 : mbstate_t _Mbst1 = {};
|
|
|
|
|
|
|
|
00053 48 8d 85 c8 00
|
|
|
|
00 00 lea rax, QWORD PTR _Mbst1$[rbp]
|
|
|
|
0005a 48 8b f8 mov rdi, rax
|
|
|
|
0005d 33 c0 xor eax, eax
|
|
|
|
0005f b9 08 00 00 00 mov ecx, 8
|
|
|
|
00064 f3 aa rep stosb
|
|
|
|
|
|
|
|
; 549 :
|
|
|
|
; 550 : _Count1 = _CSTD strlen(_Ptr) + 1;
|
|
|
|
|
|
|
|
00066 48 8b 8d 20 02
|
|
|
|
00 00 mov rcx, QWORD PTR _Ptr$[rbp]
|
|
|
|
0006d e8 00 00 00 00 call strlen
|
|
|
|
00072 48 ff c0 inc rax
|
|
|
|
00075 48 89 45 28 mov QWORD PTR _Count1$[rbp], rax
|
|
|
|
|
|
|
|
; 551 : for (_Count = _Count1, _Wchars = 0, _Ptr1 = _Ptr; 0 < _Count; _Count -= _Bytes, _Ptr1 += _Bytes, ++_Wchars) {
|
|
|
|
|
|
|
|
00079 48 8b 45 28 mov rax, QWORD PTR _Count1$[rbp]
|
|
|
|
0007d 48 89 45 08 mov QWORD PTR _Count$[rbp], rax
|
|
|
|
00081 48 c7 45 48 00
|
|
|
|
00 00 00 mov QWORD PTR _Wchars$[rbp], 0
|
|
|
|
00089 48 8b 85 20 02
|
|
|
|
00 00 mov rax, QWORD PTR _Ptr$[rbp]
|
|
|
|
00090 48 89 45 68 mov QWORD PTR _Ptr1$[rbp], rax
|
|
|
|
00094 eb 35 jmp SHORT $LN4@Maklocstr
|
|
|
|
$LN2@Maklocstr:
|
|
|
|
00096 48 63 85 84 00
|
|
|
|
00 00 movsxd rax, DWORD PTR _Bytes$[rbp]
|
|
|
|
0009d 48 8b 4d 08 mov rcx, QWORD PTR _Count$[rbp]
|
|
|
|
000a1 48 2b c8 sub rcx, rax
|
|
|
|
000a4 48 8b c1 mov rax, rcx
|
|
|
|
000a7 48 89 45 08 mov QWORD PTR _Count$[rbp], rax
|
|
|
|
000ab 48 63 85 84 00
|
|
|
|
00 00 movsxd rax, DWORD PTR _Bytes$[rbp]
|
|
|
|
000b2 48 8b 4d 68 mov rcx, QWORD PTR _Ptr1$[rbp]
|
|
|
|
000b6 48 03 c8 add rcx, rax
|
|
|
|
000b9 48 8b c1 mov rax, rcx
|
|
|
|
000bc 48 89 45 68 mov QWORD PTR _Ptr1$[rbp], rax
|
|
|
|
000c0 48 8b 45 48 mov rax, QWORD PTR _Wchars$[rbp]
|
|
|
|
000c4 48 ff c0 inc rax
|
|
|
|
000c7 48 89 45 48 mov QWORD PTR _Wchars$[rbp], rax
|
|
|
|
$LN4@Maklocstr:
|
|
|
|
000cb 48 83 7d 08 00 cmp QWORD PTR _Count$[rbp], 0
|
|
|
|
000d0 76 3a jbe SHORT $LN3@Maklocstr
|
|
|
|
|
|
|
|
; 552 : if ((_Bytes = _Mbrtowc(&_Wc, _Ptr1, _Count, &_Mbst1, &_Cvt)) <= 0) {
|
|
|
|
|
|
|
|
000d2 48 8b 85 30 02
|
|
|
|
00 00 mov rax, QWORD PTR _Cvt$[rbp]
|
|
|
|
000d9 48 89 44 24 20 mov QWORD PTR [rsp+32], rax
|
|
|
|
000de 4c 8d 8d c8 00
|
|
|
|
00 00 lea r9, QWORD PTR _Mbst1$[rbp]
|
|
|
|
000e5 4c 8b 45 08 mov r8, QWORD PTR _Count$[rbp]
|
|
|
|
000e9 48 8b 55 68 mov rdx, QWORD PTR _Ptr1$[rbp]
|
|
|
|
000ed 48 8d 8d a4 00
|
|
|
|
00 00 lea rcx, QWORD PTR _Wc$[rbp]
|
|
|
|
000f4 e8 00 00 00 00 call _Mbrtowc
|
|
|
|
000f9 89 85 84 00 00
|
|
|
|
00 mov DWORD PTR _Bytes$[rbp], eax
|
|
|
|
000ff 83 bd 84 00 00
|
|
|
|
00 00 cmp DWORD PTR _Bytes$[rbp], 0
|
|
|
|
00106 7f 02 jg SHORT $LN8@Maklocstr
|
|
|
|
|
|
|
|
; 553 : break;
|
|
|
|
|
|
|
|
00108 eb 02 jmp SHORT $LN3@Maklocstr
|
|
|
|
$LN8@Maklocstr:
|
|
|
|
|
|
|
|
; 554 : }
|
|
|
|
; 555 : }
|
|
|
|
|
|
|
|
0010a eb 8a jmp SHORT $LN2@Maklocstr
|
|
|
|
$LN3@Maklocstr:
|
|
|
|
|
|
|
|
; 556 :
|
|
|
|
; 557 : ++_Wchars; // count terminating nul
|
|
|
|
|
|
|
|
0010c 48 8b 45 48 mov rax, QWORD PTR _Wchars$[rbp]
|
|
|
|
00110 48 ff c0 inc rax
|
|
|
|
00113 48 89 45 48 mov QWORD PTR _Wchars$[rbp], rax
|
|
|
|
|
|
|
|
; 558 :
|
|
|
|
; 559 : wchar_t* _Ptrdest = static_cast<wchar_t*>(_calloc_dbg(_Wchars, sizeof(wchar_t), _CRT_BLOCK, __FILE__, __LINE__));
|
|
|
|
|
|
|
|
00117 c7 44 24 20 2f
|
|
|
|
02 00 00 mov DWORD PTR [rsp+32], 559 ; 0000022fH
|
|
|
|
0011f 4c 8d 0d 00 00
|
|
|
|
00 00 lea r9, OFFSET FLAT:??_C@_0GI@LEPEPCM@C?3?2Program?5Files?5?$CIx86?$CJ?2Microsof@
|
|
|
|
00126 41 b8 02 00 00
|
|
|
|
00 mov r8d, 2
|
|
|
|
0012c ba 02 00 00 00 mov edx, 2
|
|
|
|
00131 48 8b 4d 48 mov rcx, QWORD PTR _Wchars$[rbp]
|
|
|
|
00135 ff 15 00 00 00
|
|
|
|
00 call QWORD PTR __imp__calloc_dbg
|
|
|
|
0013b 48 89 85 e8 00
|
|
|
|
00 00 mov QWORD PTR _Ptrdest$[rbp], rax
|
|
|
|
|
|
|
|
; 560 :
|
|
|
|
; 561 : if (!_Ptrdest) {
|
|
|
|
|
|
|
|
00142 48 83 bd e8 00
|
|
|
|
00 00 00 cmp QWORD PTR _Ptrdest$[rbp], 0
|
|
|
|
0014a 75 05 jne SHORT $LN9@Maklocstr
|
|
|
|
|
|
|
|
; 562 : _Xbad_alloc();
|
|
|
|
|
|
|
|
0014c e8 00 00 00 00 call ?_Xbad_alloc@std@@YAXXZ ; std::_Xbad_alloc
|
|
|
|
$LN9@Maklocstr:
|
|
|
|
|
|
|
|
; 563 : }
|
|
|
|
; 564 :
|
|
|
|
; 565 : wchar_t* _Ptrnext = _Ptrdest;
|
|
|
|
|
|
|
|
00151 48 8b 85 e8 00
|
|
|
|
00 00 mov rax, QWORD PTR _Ptrdest$[rbp]
|
|
|
|
00158 48 89 85 08 01
|
|
|
|
00 00 mov QWORD PTR _Ptrnext$[rbp], rax
|
|
|
|
|
|
|
|
; 566 : mbstate_t _Mbst2 = {};
|
|
|
|
|
|
|
|
0015f 48 8d 85 28 01
|
|
|
|
00 00 lea rax, QWORD PTR _Mbst2$[rbp]
|
|
|
|
00166 48 8b f8 mov rdi, rax
|
|
|
|
00169 33 c0 xor eax, eax
|
|
|
|
0016b b9 08 00 00 00 mov ecx, 8
|
|
|
|
00170 f3 aa rep stosb
|
|
|
|
|
|
|
|
; 567 :
|
|
|
|
; 568 : for (; 0 < _Wchars; _Count -= _Bytes, _Ptr += _Bytes, --_Wchars, ++_Ptrnext) {
|
|
|
|
|
|
|
|
00172 eb 4d jmp SHORT $LN7@Maklocstr
|
|
|
|
$LN5@Maklocstr:
|
|
|
|
00174 48 63 85 84 00
|
|
|
|
00 00 movsxd rax, DWORD PTR _Bytes$[rbp]
|
|
|
|
0017b 48 8b 4d 08 mov rcx, QWORD PTR _Count$[rbp]
|
|
|
|
0017f 48 2b c8 sub rcx, rax
|
|
|
|
00182 48 8b c1 mov rax, rcx
|
|
|
|
00185 48 89 45 08 mov QWORD PTR _Count$[rbp], rax
|
|
|
|
00189 48 63 85 84 00
|
|
|
|
00 00 movsxd rax, DWORD PTR _Bytes$[rbp]
|
|
|
|
00190 48 8b 8d 20 02
|
|
|
|
00 00 mov rcx, QWORD PTR _Ptr$[rbp]
|
|
|
|
00197 48 03 c8 add rcx, rax
|
|
|
|
0019a 48 8b c1 mov rax, rcx
|
|
|
|
0019d 48 89 85 20 02
|
|
|
|
00 00 mov QWORD PTR _Ptr$[rbp], rax
|
|
|
|
001a4 48 8b 45 48 mov rax, QWORD PTR _Wchars$[rbp]
|
|
|
|
001a8 48 ff c8 dec rax
|
|
|
|
001ab 48 89 45 48 mov QWORD PTR _Wchars$[rbp], rax
|
|
|
|
001af 48 8b 85 08 01
|
|
|
|
00 00 mov rax, QWORD PTR _Ptrnext$[rbp]
|
|
|
|
001b6 48 83 c0 02 add rax, 2
|
|
|
|
001ba 48 89 85 08 01
|
|
|
|
00 00 mov QWORD PTR _Ptrnext$[rbp], rax
|
|
|
|
$LN7@Maklocstr:
|
|
|
|
001c1 48 83 7d 48 00 cmp QWORD PTR _Wchars$[rbp], 0
|
|
|
|
001c6 76 40 jbe SHORT $LN6@Maklocstr
|
|
|
|
|
|
|
|
; 569 : if ((_Bytes = _Mbrtowc(_Ptrnext, _Ptr, _Count1, &_Mbst2, &_Cvt)) <= 0) {
|
|
|
|
|
|
|
|
001c8 48 8b 85 30 02
|
|
|
|
00 00 mov rax, QWORD PTR _Cvt$[rbp]
|
|
|
|
001cf 48 89 44 24 20 mov QWORD PTR [rsp+32], rax
|
|
|
|
001d4 4c 8d 8d 28 01
|
|
|
|
00 00 lea r9, QWORD PTR _Mbst2$[rbp]
|
|
|
|
001db 4c 8b 45 28 mov r8, QWORD PTR _Count1$[rbp]
|
|
|
|
001df 48 8b 95 20 02
|
|
|
|
00 00 mov rdx, QWORD PTR _Ptr$[rbp]
|
|
|
|
001e6 48 8b 8d 08 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Ptrnext$[rbp]
|
|
|
|
001ed e8 00 00 00 00 call _Mbrtowc
|
|
|
|
001f2 89 85 84 00 00
|
|
|
|
00 mov DWORD PTR _Bytes$[rbp], eax
|
|
|
|
001f8 83 bd 84 00 00
|
|
|
|
00 00 cmp DWORD PTR _Bytes$[rbp], 0
|
|
|
|
001ff 7f 02 jg SHORT $LN10@Maklocstr
|
|
|
|
|
|
|
|
; 570 : break;
|
|
|
|
|
|
|
|
00201 eb 05 jmp SHORT $LN6@Maklocstr
|
|
|
|
$LN10@Maklocstr:
|
|
|
|
|
|
|
|
; 571 : }
|
|
|
|
; 572 : }
|
|
|
|
|
|
|
|
00203 e9 6c ff ff ff jmp $LN5@Maklocstr
|
|
|
|
$LN6@Maklocstr:
|
|
|
|
|
|
|
|
; 573 :
|
|
|
|
; 574 : *_Ptrnext = L'\0';
|
|
|
|
|
|
|
|
00208 33 c0 xor eax, eax
|
|
|
|
0020a 48 8b 8d 08 01
|
|
|
|
00 00 mov rcx, QWORD PTR _Ptrnext$[rbp]
|
|
|
|
00211 66 89 01 mov WORD PTR [rcx], ax
|
|
|
|
|
|
|
|
; 575 :
|
|
|
|
; 576 : return _Ptrdest;
|
|
|
|
|
|
|
|
00214 48 8b 85 e8 00
|
|
|
|
00 00 mov rax, QWORD PTR _Ptrdest$[rbp]
|
|
|
|
$LN11@Maklocstr:
|
|
|
|
|
|
|
|
; 577 : }
|
|
|
|
|
|
|
|
0021b 48 8b f8 mov rdi, rax
|
|
|
|
0021e 48 8d 4d d0 lea rcx, QWORD PTR [rbp-48]
|
|
|
|
00222 48 8d 15 00 00
|
|
|
|
00 00 lea rdx, OFFSET FLAT:??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z$rtcFrameData
|
|
|
|
00229 e8 00 00 00 00 call _RTC_CheckStackVars
|
|
|
|
0022e 48 8b c7 mov rax, rdi
|
|
|
|
00231 48 8b 8d f8 01
|
|
|
|
00 00 mov rcx, QWORD PTR __$ArrayPad$[rbp]
|
|
|
|
00238 48 33 cd xor rcx, rbp
|
|
|
|
0023b e8 00 00 00 00 call __security_check_cookie
|
|
|
|
00240 48 8d a5 08 02
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+520]
|
|
|
|
00247 5f pop rdi
|
|
|
|
00248 5d pop rbp
|
|
|
|
00249 c3 ret 0
|
|
|
|
??$_Maklocstr@_W@std@@YAPEA_WPEBDPEA_WAEBU_Cvtvec@@@Z ENDP ; std::_Maklocstr<wchar_t>
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt\wchar.h
|
|
|
|
; COMDAT wmemcpy
|
|
|
|
_TEXT SEGMENT
|
|
|
|
_S1$ = 224
|
|
|
|
_S2$ = 232
|
|
|
|
_N$ = 240
|
|
|
|
wmemcpy PROC ; COMDAT
|
|
|
|
|
|
|
|
; 234 : {
|
|
|
|
|
|
|
|
$LN3:
|
|
|
|
00000 4c 89 44 24 18 mov QWORD PTR [rsp+24], r8
|
|
|
|
00005 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000a 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
0000f 55 push rbp
|
|
|
|
00010 57 push rdi
|
|
|
|
00011 48 81 ec e8 00
|
|
|
|
00 00 sub rsp, 232 ; 000000e8H
|
|
|
|
00018 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
0001d 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__93DC0B45_wchar@h
|
|
|
|
00024 e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
|
|
|
|
; 235 : #pragma warning(suppress: 6386) // Buffer overrun
|
|
|
|
; 236 : return (wchar_t*)memcpy(_S1, _S2, _N*sizeof(wchar_t));
|
|
|
|
|
|
|
|
00029 48 8b 85 f0 00
|
|
|
|
00 00 mov rax, QWORD PTR _N$[rbp]
|
|
|
|
00030 48 d1 e0 shl rax, 1
|
|
|
|
00033 4c 8b c0 mov r8, rax
|
|
|
|
00036 48 8b 95 e8 00
|
|
|
|
00 00 mov rdx, QWORD PTR _S2$[rbp]
|
|
|
|
0003d 48 8b 8d e0 00
|
|
|
|
00 00 mov rcx, QWORD PTR _S1$[rbp]
|
|
|
|
00044 e8 00 00 00 00 call memcpy
|
|
|
|
|
|
|
|
; 237 : }
|
|
|
|
|
|
|
|
00049 48 8d a5 c8 00
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+200]
|
|
|
|
00050 5f pop rdi
|
|
|
|
00051 5d pop rbp
|
|
|
|
00052 c3 ret 0
|
|
|
|
wmemcpy ENDP
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\@\Work\code-virtualizer\CodeVirtualizer\OpaqueBranching.cpp
|
|
|
|
; COMDAT ?__empty_global_delete@@YAXPEAX_KW4align_val_t@std@@@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
__formal$ = 224
|
|
|
|
__formal$ = 232
|
|
|
|
__formal$ = 240
|
|
|
|
?__empty_global_delete@@YAXPEAX_KW4align_val_t@std@@@Z PROC ; __empty_global_delete, COMDAT
|
|
|
|
|
|
|
|
$LN3:
|
|
|
|
00000 4c 89 44 24 18 mov QWORD PTR [rsp+24], r8
|
|
|
|
00005 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
0000a 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
0000f 55 push rbp
|
|
|
|
00010 57 push rdi
|
|
|
|
00011 48 81 ec e8 00
|
|
|
|
00 00 sub rsp, 232 ; 000000e8H
|
|
|
|
00018 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
0001d 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__A8BC9087_OpaqueBranching@cpp
|
|
|
|
00024 e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
00029 48 8d a5 c8 00
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+200]
|
|
|
|
00030 5f pop rdi
|
|
|
|
00031 5d pop rbp
|
|
|
|
00032 c3 ret 0
|
|
|
|
?__empty_global_delete@@YAXPEAX_KW4align_val_t@std@@@Z ENDP ; __empty_global_delete
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\@\Work\code-virtualizer\CodeVirtualizer\OpaqueBranching.cpp
|
|
|
|
; COMDAT ?__empty_global_delete@@YAXPEAXW4align_val_t@std@@@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
__formal$ = 224
|
|
|
|
__formal$ = 232
|
|
|
|
?__empty_global_delete@@YAXPEAXW4align_val_t@std@@@Z PROC ; __empty_global_delete, COMDAT
|
|
|
|
|
|
|
|
$LN3:
|
|
|
|
00000 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
00005 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
0000a 55 push rbp
|
|
|
|
0000b 57 push rdi
|
|
|
|
0000c 48 81 ec e8 00
|
|
|
|
00 00 sub rsp, 232 ; 000000e8H
|
|
|
|
00013 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
00018 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__A8BC9087_OpaqueBranching@cpp
|
|
|
|
0001f e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
00024 48 8d a5 c8 00
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+200]
|
|
|
|
0002b 5f pop rdi
|
|
|
|
0002c 5d pop rbp
|
|
|
|
0002d c3 ret 0
|
|
|
|
?__empty_global_delete@@YAXPEAXW4align_val_t@std@@@Z ENDP ; __empty_global_delete
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\@\Work\code-virtualizer\CodeVirtualizer\OpaqueBranching.cpp
|
|
|
|
; COMDAT ?__empty_global_delete@@YAXPEAX_K@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
__formal$ = 224
|
|
|
|
__formal$ = 232
|
|
|
|
?__empty_global_delete@@YAXPEAX_K@Z PROC ; __empty_global_delete, COMDAT
|
|
|
|
|
|
|
|
$LN3:
|
|
|
|
00000 48 89 54 24 10 mov QWORD PTR [rsp+16], rdx
|
|
|
|
00005 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
0000a 55 push rbp
|
|
|
|
0000b 57 push rdi
|
|
|
|
0000c 48 81 ec e8 00
|
|
|
|
00 00 sub rsp, 232 ; 000000e8H
|
|
|
|
00013 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
00018 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__A8BC9087_OpaqueBranching@cpp
|
|
|
|
0001f e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
00024 48 8d a5 c8 00
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+200]
|
|
|
|
0002b 5f pop rdi
|
|
|
|
0002c 5d pop rbp
|
|
|
|
0002d c3 ret 0
|
|
|
|
?__empty_global_delete@@YAXPEAX_K@Z ENDP ; __empty_global_delete
|
|
|
|
_TEXT ENDS
|
|
|
|
; Function compile flags: /Odtp /RTCsu /ZI
|
|
|
|
; File C:\@\Work\code-virtualizer\CodeVirtualizer\OpaqueBranching.cpp
|
|
|
|
; COMDAT ?__empty_global_delete@@YAXPEAX@Z
|
|
|
|
_TEXT SEGMENT
|
|
|
|
__formal$ = 224
|
|
|
|
?__empty_global_delete@@YAXPEAX@Z PROC ; __empty_global_delete, COMDAT
|
|
|
|
|
|
|
|
$LN3:
|
|
|
|
00000 48 89 4c 24 08 mov QWORD PTR [rsp+8], rcx
|
|
|
|
00005 55 push rbp
|
|
|
|
00006 57 push rdi
|
|
|
|
00007 48 81 ec e8 00
|
|
|
|
00 00 sub rsp, 232 ; 000000e8H
|
|
|
|
0000e 48 8d 6c 24 20 lea rbp, QWORD PTR [rsp+32]
|
|
|
|
00013 48 8d 0d 00 00
|
|
|
|
00 00 lea rcx, OFFSET FLAT:__A8BC9087_OpaqueBranching@cpp
|
|
|
|
0001a e8 00 00 00 00 call __CheckForDebuggerJustMyCode
|
|
|
|
0001f 48 8d a5 c8 00
|
|
|
|
00 00 lea rsp, QWORD PTR [rbp+200]
|
|
|
|
00026 5f pop rdi
|
|
|
|
00027 5d pop rbp
|
|
|
|
00028 c3 ret 0
|
|
|
|
?__empty_global_delete@@YAXPEAX@Z ENDP ; __empty_global_delete
|
|
|
|
_TEXT ENDS
|
|
|
|
END
|