![]() |
|
#1
|
|||
|
|||
|
Crypto or not?
it's the second time I see this sort of code and I don't know if this is a crypto algo or not.
It's always a function wich is call several times. example : 0041901F |> 8B4C24 14 /MOV ECX,DWORD PTR SS:[ESP+14] 00419023 |> 8D441C 20 LEA EAX,DWORD PTR SS:[ESP+EBX+20] 00419027 |. 0FB63C08 |MOVZX EDI,BYTE PTR DS:[EAX+ECX] 0041902B |. 33D2 |XOR EDX,EDX 0041902D |. 8BF0 |MOV ESI,EAX 0041902F |. 90 |NOP 00419030 |> 8B4424 40 |/MOV EAX,DWORD PTR SS:[ESP+40] 00419034 |. 0FB60402 ||MOVZX EAX,BYTE PTR DS:[EDX+EAX] 00419038 0FAFC7 IMUL EAX,EDI 0041903B |. 85C0 ||TEST EAX,EAX 0041903D |. 74 13 ||JE SHORT 00419052 0041903F |. 8BCE ||MOV ECX,ESI 00419041 |> 0FB629 ||/MOVZX EBP,BYTE PTR DS:[ECX] 00419044 |. 03C5 |||ADD EAX,EBP 00419046 |. 8801 |||MOV BYTE PTR DS:[ECX],AL 00419048 |. C1E8 08 |||SHR EAX,8 0041904B |. 83C1 01 |||ADD ECX,1 0041904E |. 85C0 |||TEST EAX,EAX 00419050 |.^ 75 EF ||\JNZ SHORT 00419041 00419052 |> 83C2 01 ||ADD EDX,1 00419055 |. 83C6 01 ||ADD ESI,1 00419058 |. 83FA 08 ||CMP EDX,8 0041905B |.^ 7C D3 |\JL SHORT 00419030 0041905D |. 83C3 01 |ADD EBX,1 00419060 |. 83FB 08 |CMP EBX,8 00419063 |.^ 7C BA \JL SHORT 0041901F Someone recognize this algo and it is possible to reverse it? Thank you
|
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Help identify crypto | The Old Pirate | General Discussion | 5 | 12-27-2014 04:15 |