Author | Message | Time |
---|---|---|
TheMinistered | I went through and semi-reversed this function in an application my friend gave me, and as an additional clue (after I having figured it out), it has everything to do with iago! [code] .text:00401A10 push ebp .text:00401A11 mov ebp, esp .text:00401A13 sub esp, 0Ch .text:00401A16 push offset loc_4010C6 .text:00401A1B mov eax, large fs:0 .text:00401A21 push eax .text:00401A22 mov large fs:0, esp .text:00401A29 sub esp, 9Ch .text:00401A2F push ebx .text:00401A30 push esi .text:00401A31 push edi .text:00401A32 mov [ebp-0Ch], esp .text:00401A35 mov dword ptr [ebp-8], offset loc_4010B0 .text:00401A3C xor esi, esi .text:00401A3E mov [ebp-4], esi .text:00401A41 mov eax, [ebp+8] .text:00401A44 push eax .text:00401A45 mov ecx, [eax] .text:00401A47 call dword ptr [ecx+4] .text:00401A4A mov edx, [ebp+0Ch] .text:00401A4D xor bl, bl .text:00401A4F lea ecx, [ebp-20h] .text:00401A52 mov [ebp-18h], esi .text:00401A55 mov [ebp-20h], esi .text:00401A58 mov [ebp-2Ch], bl .text:00401A5B mov [ebp-30h], esi .text:00401A5E mov [ebp-40h], esi .text:00401A61 call ds:__vbaStrCopy .text:00401A67 mov esi, ds:__vbaUI1I2 .text:00401A6D mov ecx, 7 .text:00401A72 call esi ; __vbaUI1I2 .text:00401A74 mov ecx, 2 .text:00401A79 mov [ebp-64h], al .text:00401A7C call esi ; __vbaUI1I2 .text:00401A7E mov ecx, 1 .text:00401A83 mov [ebp-60h], al .text:00401A86 call esi ; __vbaUI1I2 .text:00401A88 mov edi, ds:__vbaStrMove .text:00401A8E mov esi, ds:__vbaFpUI1 .text:00401A94 mov [ebp-28h], al .text:00401A97 .text:00401A97 loc_401A97: ; CODE XREF: .text:00401B27j .text:00401A97 mov dl, [ebp-28h] .text:00401A9A mov al, [ebp-64h] .text:00401A9D cmp dl, al .text:00401A9F ja loc_401B2C .text:00401AA5 mov ecx, [ebp-28h] .text:00401AA8 mov edx, [ebp-20h] .text:00401AAB lea eax, [ebp-40h] .text:00401AAE and ecx, 0FFh .text:00401AB4 push eax .text:00401AB5 push ecx .text:00401AB6 push edx .text:00401AB7 mov dword ptr [ebp-38h], 1 .text:00401ABE mov dword ptr [ebp-40h], 2 .text:00401AC5 call ds:rtcMidCharBstr .text:00401ACB mov edx, eax .text:00401ACD lea ecx, [ebp-30h] .text:00401AD0 call edi ; __vbaStrMove .text:00401AD2 push eax .text:00401AD3 call ds:rtcR8ValFromBstr .text:00401AD9 mov eax, [ebp-2Ch] .text:00401ADC fstp qword ptr [ebp-58h] .text:00401ADF and eax, 0FFh .text:00401AE4 mov [ebp-78h], eax .text:00401AE7 fild dword ptr [ebp-78h] .text:00401AEA fstp qword ptr [ebp-80h] .text:00401AED fld qword ptr [ebp-80h] .text:00401AF0 fadd qword ptr [ebp-58h] .text:00401AF3 fnstsw ax .text:00401AF5 test al, 0Dh .text:00401AF7 jnz loc_401D9A .text:00401AFD call esi ; __vbaFpUI1 .text:00401AFF mov bl, al .text:00401B01 lea ecx, [ebp-30h] .text:00401B04 mov [ebp-2Ch], bl .text:00401B07 call ds:__vbaFreeStr .text:00401B0D lea ecx, [ebp-40h] .text:00401B10 call ds:__vbaFreeVar .text:00401B16 mov cl, [ebp-60h] .text:00401B19 mov al, [ebp-28h] .text:00401B1C add cl, al .text:00401B1E jb loc_401D9F .text:00401B24 mov [ebp-28h], cl .text:00401B27 jmp loc_401A97 .text:00401B2C ; --------------------------------------------------------------------------- .text:00401B2C .text:00401B2C loc_401B2C: ; CODE XREF: .text:00401A9Fj .text:00401B2C mov ecx, 8 .text:00401B31 call ds:__vbaUI1I2 .text:00401B37 mov ecx, 2 .text:00401B3C mov [ebp-6Ch], al .text:00401B3F call ds:__vbaUI1I2 .text:00401B45 mov ecx, 2 .text:00401B4A mov [ebp-68h], al .text:00401B4D call ds:__vbaUI1I2 .text:00401B53 mov [ebp-28h], al .text:00401B56 .text:00401B56 loc_401B56: ; CODE XREF: .text:00401C60j .text:00401B56 mov dl, [ebp-28h] .text:00401B59 mov al, [ebp-6Ch] .text:00401B5C cmp dl, al .text:00401B5E ja loc_401C65 .text:00401B64 mov ecx, [ebp-28h] .text:00401B67 mov edx, [ebp-20h] .text:00401B6A lea eax, [ebp-40h] .text:00401B6D and ecx, 0FFh .text:00401B73 push eax .text:00401B74 push ecx .text:00401B75 push edx .text:00401B76 mov dword ptr [ebp-38h], 1 .text:00401B7D mov dword ptr [ebp-40h], 2 .text:00401B84 call ds:rtcMidCharBstr .text:00401B8A mov edx, eax .text:00401B8C lea ecx, [ebp-30h] .text:00401B8F call edi ; __vbaStrMove .text:00401B91 push eax .text:00401B92 call ds:rtcR8ValFromBstr .text:00401B98 call esi ; __vbaFpUI1 .text:00401B9A lea ecx, [ebp-30h] .text:00401B9D mov [ebp-1Ch], al .text:00401BA0 call ds:__vbaFreeStr .text:00401BA6 lea ecx, [ebp-40h] .text:00401BA9 call ds:__vbaFreeVar .text:00401BAF mov al, [ebp-1Ch] .text:00401BB2 mov cl, 2 .text:00401BB4 imul cl .text:00401BB6 mov [ebp-1Ch], al .text:00401BB9 mov edx, [ebp-1Ch] .text:00401BBC and edx, 0FFh .text:00401BC2 mov [ebp-84h], edx .text:00401BC8 fild dword ptr [ebp-84h] .text:00401BCE fstp qword ptr [ebp-8Ch] .text:00401BD4 fld qword ptr [ebp-8Ch] .text:00401BDA cmp dword_403000, 0 .text:00401BE1 jnz short loc_401BEB .text:00401BE3 fdiv ds:dbl_4010A8 .text:00401BE9 jmp short loc_401BFC .text:00401BEB ; --------------------------------------------------------------------------- .text:00401BEB .text:00401BEB loc_401BEB: ; CODE XREF: .text:00401BE1j .text:00401BEB push dword ptr ds:dbl_4010A8+4 .text:00401BF1 push dword ptr ds:dbl_4010A8 .text:00401BF7 call _adj_fdiv_m64 .text:00401BFC .text:00401BFC loc_401BFC: ; CODE XREF: .text:00401BE9j .text:00401BFC fnstsw ax .text:00401BFE test al, 0Dh .text:00401C00 jnz loc_401D9A .text:00401C06 call ds:__vbaFPInt .text:00401C0C movzx ax, byte ptr [ebp-1Ch] .text:00401C11 cwd .text:00401C13 mov cx, 0Ah .text:00401C17 idiv cx .text:00401C1A xor ax, ax .text:00401C1D mov al, bl .text:00401C1F add dx, ax .text:00401C22 jo loc_401D9F .text:00401C28 movsx ecx, dx .text:00401C2B mov [ebp-90h], ecx .text:00401C31 fild dword ptr [ebp-90h] .text:00401C37 fstp qword ptr [ebp-98h] .text:00401C3D fadd qword ptr [ebp-98h] .text:00401C43 fnstsw ax .text:00401C45 test al, 0Dh .text:00401C47 jnz loc_401D9A .text:00401C4D call esi ; __vbaFpUI1 .text:00401C4F mov dl, [ebp-68h] .text:00401C52 mov bl, al .text:00401C54 add dl, [ebp-28h] .text:00401C57 jb loc_401D9F .text:00401C5D mov [ebp-28h], dl .text:00401C60 jmp loc_401B56 .text:00401C65 ; --------------------------------------------------------------------------- .text:00401C65 .text:00401C65 loc_401C65: ; CODE XREF: .text:00401B5Ej .text:00401C65 mov [ebp-2Ch], bl .text:00401C68 mov eax, [ebp-2Ch] .text:00401C6B and eax, 0FFh .text:00401C70 mov [ebp-9Ch], eax .text:00401C76 fild dword ptr [ebp-9Ch] .text:00401C7C fstp qword ptr [ebp-0A4h] .text:00401C82 fld qword ptr [ebp-0A4h] .text:00401C88 cmp dword_403000, 0 .text:00401C8F jnz short loc_401C99 .text:00401C91 fdiv ds:dbl_4010A8 .text:00401C97 jmp short loc_401CAA .text:00401C99 ; --------------------------------------------------------------------------- .text:00401C99 .text:00401C99 loc_401C99: ; CODE XREF: .text:00401C8Fj .text:00401C99 push dword ptr ds:dbl_4010A8+4 .text:00401C9F push dword ptr ds:dbl_4010A8 .text:00401CA5 call _adj_fdiv_m64 .text:00401CAA .text:00401CAA loc_401CAA: ; CODE XREF: .text:00401C97j .text:00401CAA fnstsw ax .text:00401CAC test al, 0Dh .text:00401CAE jnz loc_401D9A .text:00401CB4 call esi ; __vbaFpUI1 .text:00401CB6 xor cx, cx .text:00401CB9 mov cl, al .text:00401CBB imul cx, 0Ah .text:00401CBF jo loc_401D9F .text:00401CC5 xor dx, dx .text:00401CC8 mov dl, bl .text:00401CCA sub cx, dx .text:00401CCD jo loc_401D9F .text:00401CD3 call ds:__vbaUI1I2 .text:00401CD9 mov [ebp-24h], al .text:00401CDC mov eax, [ebp-20h] .text:00401CDF push 1 .text:00401CE1 push eax .text:00401CE2 call ds:rtcRightCharBstr .text:00401CE8 mov edx, eax .text:00401CEA lea ecx, [ebp-30h] .text:00401CED call edi ; __vbaStrMove .text:00401CEF push eax .text:00401CF0 call ds:rtcR8ValFromBstr .text:00401CF6 mov ecx, [ebp-24h] .text:00401CF9 fstp qword ptr [ebp-58h] .text:00401CFC and ecx, 0FFh .text:00401D02 mov [ebp-0A8h], ecx .text:00401D08 fild dword ptr [ebp-0A8h] .text:00401D0E fstp qword ptr [ebp-0B0h] .text:00401D14 fld qword ptr [ebp-58h] .text:00401D17 call ds:__vbaFpR8 .text:00401D1D fcomp qword ptr [ebp-0B0h] .text:00401D23 fnstsw ax .text:00401D25 test ah, 40h .text:00401D28 jz short loc_401D31 .text:00401D2A mov eax, 1 .text:00401D2F jmp short loc_401D33 .text:00401D31 ; --------------------------------------------------------------------------- .text:00401D31 .text:00401D31 loc_401D31: ; CODE XREF: .text:00401D28j .text:00401D31 xor eax, eax .text:00401D33 .text:00401D33 loc_401D33: ; CODE XREF: .text:00401D2Fj .text:00401D33 neg eax .text:00401D35 lea ecx, [ebp-30h] .text:00401D38 mov esi, eax .text:00401D3A call ds:__vbaFreeStr .text:00401D40 test si, si .text:00401D43 jz short loc_401D4C .text:00401D45 mov dword ptr [ebp-18h], 0FFFFFFFFh .text:00401D4C .text:00401D4C loc_401D4C: ; CODE XREF: .text:00401D43j .text:00401D4C wait .text:00401D4D push offset loc_401D71 .text:00401D52 jmp short loc_401D67 .text:00401D54 ; --------------------------------------------------------------------------- .text:00401D54 lea ecx, [ebp-30h] .text:00401D57 call ds:__vbaFreeStr .text:00401D5D lea ecx, [ebp-40h] .text:00401D60 call ds:__vbaFreeVar .text:00401D66 retn .text:00401D67 ; --------------------------------------------------------------------------- .text:00401D67 .text:00401D67 loc_401D67: ; CODE XREF: .text:00401D52j .text:00401D67 lea ecx, [ebp-20h] .text:00401D6A call ds:__vbaFreeStr .text:00401D70 retn .text:00401D71 ; --------------------------------------------------------------------------- .text:00401D71 .text:00401D71 loc_401D71: ; DATA XREF: .text:00401D4Do .text:00401D71 mov eax, [ebp+8] .text:00401D74 push eax .text:00401D75 mov edx, [eax] .text:00401D77 call dword ptr [edx+8] .text:00401D7A mov eax, [ebp+10h] .text:00401D7D mov cx, [ebp-18h] .text:00401D81 mov [eax], cx .text:00401D84 mov eax, [ebp-4] .text:00401D87 mov ecx, [ebp-14h] .text:00401D8A pop edi .text:00401D8B pop esi .text:00401D8C mov large fs:0, ecx .text:00401D93 pop ebx .text:00401D94 mov esp, ebp .text:00401D96 pop ebp .text:00401D97 retn 0Ch .text:00401D9A ; --------------------------------------------------------------------------- .text:00401D9A .text:00401D9A loc_401D9A: ; CODE XREF: .text:00401AF7j .text:00401D9A ; .text:00401C00j ... .text:00401D9A jmp loc_4010CC .text:00401D9F ; --------------------------------------------------------------------------- .text:00401D9F .text:00401D9F loc_401D9F: ; CODE XREF: .text:00401B1Ej .text:00401D9F ; .text:00401C22j ... .text:00401D9F call ds:__vbaErrorOverflow [/code] | December 15, 2004, 5:57 AM |