and so i will try something else..
Code: Select all
/$ 55 PUSH EBP
|. 8BEC MOV EBP,ESP
|. 81EC D4000000 SUB ESP,0D4
|. 53 PUSH EBX
|. 8B5D 0C MOV EBX,[ARG.2]
|. 56 PUSH ESI
|. 57 PUSH EDI
|. 33FF XOR EDI,EDI
|. 8BF0 MOV ESI,EAX ; COMCTL32.7745DA80
|. 393B CMP DWORD PTR DS:[EBX],EDI
|. 75 08 JNZ SHORT compress.00418C50
|. 6A 04 PUSH 4
|. 58 POP EAX ; COMCTL32.7745DA80
|. E9 98020000 JMP compress.00418EE8
|> 6A 4C PUSH 4C
|. 8D45 98 LEA EAX,[LOCAL.26]
|. 50 PUSH EAX ; COMCTL32.7745DA80
|. E8 45F3FFFF CALL compress.00417FA0
|. 8B0B MOV ECX,DWORD PTR DS:[EBX]
|. 8D0432 LEA EAX,DWORD PTR DS:[EDX+ESI]
|. 8945 BC MOV [LOCAL.17],EAX ; COMCTL32.7745DA80
|. 8B45 08 MOV EAX,[ARG.1]
|. 03C8 ADD ECX,EAX ; COMCTL32.7745DA80
|. 8945 CC MOV [LOCAL.13],EAX ; COMCTL32.7745DA80
|. B8 00008000 MOV EAX,800000
|. C745 9C 000D0000 MOV [LOCAL.25],0D00
|. C745 98 01100000 MOV [LOCAL.26],1001
|. 8955 B8 MOV [LOCAL.18],EDX
|. 8955 B4 MOV [LOCAL.19],EDX
|. 894D D0 MOV [LOCAL.12],ECX
|. 897D D4 MOV [LOCAL.11],EDI
|. 8955 EC MOV [LOCAL.5],EDX
|. 897D FC MOV [LOCAL.1],EDI
|. 8985 30FFFFFF MOV [LOCAL.52],EAX ; COMCTL32.7745DA80
|. 3BF0 CMP ESI,EAX ; COMCTL32.7745DA80
|. 73 15 JNB SHORT compress.00418CAF
|. B8 00010000 MOV EAX,100
|. 89B5 30FFFFFF MOV [LOCAL.52],ESI
|. 3BF0 CMP ESI,EAX ; COMCTL32.7745DA80
|. 77 06 JA SHORT compress.00418CAF
|. 8985 30FFFFFF MOV [LOCAL.52],EAX ; COMCTL32.7745DA80
|> 8D45 98 LEA EAX,[LOCAL.26]
|. 8DB5 30FFFFFF LEA ESI,[LOCAL.52]
|. 8985 4CFFFFFF MOV [LOCAL.45],EAX ; COMCTL32.7745DA80
|. 897D AC MOV [LOCAL.21],EDI
|. 897D E0 MOV [LOCAL.8],EDI
|. 897D DC MOV [LOCAL.9],EDI
|. 897D D8 MOV [LOCAL.10],EDI
|. E8 E7F7FFFF CALL compress.004184B6
|. 8BD8 MOV EBX,EAX ; COMCTL32.7745DA80
|. 3BDF CMP EBX,EDI
|. 74 0A JE SHORT compress.00418CDF
|. E8 62F9FFFF CALL compress.0041863C
|. 895D F8 MOV [LOCAL.2],EBX
|. EB 03 JMP SHORT compress.00418CE2
|> 897D F8 MOV [LOCAL.2],EDI
|> 8B45 F8 MOV EAX,[LOCAL.2]
|. 3BC7 CMP EAX,EDI
|. 0F85 FB010000 JNZ compress.00418EE8
|. 8B45 D4 MOV EAX,[LOCAL.11]
|. C785 34FFFFFF 00100000 MOV [LOCAL.51],1000
|. C785 38FFFFFF 00080000 MOV [LOCAL.50],800
|. 3BC7 CMP EAX,EDI
|. 74 09 JE SHORT compress.00418D11
|. FF70 04 PUSH DWORD PTR DS:[EAX+4]
|. 6A FF PUSH -1
|. 57 PUSH EDI
|. 57 PUSH EDI
|. FF10 CALL DWORD PTR DS:[EAX]
|> C745 AC 01000000 MOV [LOCAL.21],1
|. 33C0 XOR EAX,EAX ; COMCTL32.7745DA80
|. E9 3D010000 JMP compress.00418E5C
|> 8B45 CC /MOV EAX,[LOCAL.13]
|. 2B45 08 |SUB EAX,[ARG.1]
|. 8B5D A4 |MOV EBX,[LOCAL.23]
|. 8B4D A8 |MOV ECX,[LOCAL.22]
|. 8945 DC |MOV [LOCAL.9],EAX ; COMCTL32.7745DA80
|. 895D F0 |MOV [LOCAL.4],EBX
|. 894D 94 |MOV [LOCAL.27],ECX
|. 397D FC |CMP [LOCAL.1],EDI
|. 75 06 |JNZ SHORT compress.00418D3F
|. 8B45 B0 |MOV EAX,[LOCAL.20]
|. 8945 EC |MOV [LOCAL.5],EAX ; COMCTL32.7745DA80
|> 6A 02 |PUSH 2
|. 5E |POP ESI
|. 3BDE |CMP EBX,ESI
|. 0F82 02010000 |JB compress.00418E4C
|. 75 09 |JNZ SHORT compress.00418D55
|. 3B4D 9C |CMP ECX,[LOCAL.25] ; ntdll.7C91930F
|. 0F87 F7000000 |JA compress.00418E4C
|> 81FB 00080000 |CMP EBX,800
|. 73 23 |JNB SHORT compress.00418D80
|. 3B4D AC |CMP ECX,[LOCAL.21]
|. 74 1E |JE SHORT compress.00418D80
|. 8BD3 |MOV EDX,EBX
|. 8D45 98 |LEA EAX,[LOCAL.26]
|. E8 ABFCFFFF |CALL compress.00418A17
|. 8945 E8 |MOV [LOCAL.6],EAX ; COMCTL32.7745DA80
|. 8D43 FF |LEA EAX,DWORD PTR DS:[EBX-1]
|. 3BC6 |CMP EAX,ESI
|. 76 05 |JBE SHORT compress.00418D7B
|. 8975 F4 |MOV [LOCAL.3],ESI
|. EB 13 |JMP SHORT compress.00418D8E
|> 8945 F4 |MOV [LOCAL.3],EAX ; COMCTL32.7745DA80
|. EB 08 |JMP SHORT compress.00418D88
|> 8365 E8 00 |AND [LOCAL.6],0
|. 8365 F4 00 |AND [LOCAL.3],0
|> 837D F4 00 |CMP [LOCAL.3],0
|. 76 68 |JBE SHORT compress.00418DF6
|> 33F6 |XOR ESI,ESI
|> 8B45 F0 |/MOV EAX,[LOCAL.4]
|. 3945 A0 ||CMP [LOCAL.24],EAX ; COMCTL32.7745DA80
|. 76 5E ||JBE SHORT compress.00418DF6
|. 3D 00080000 ||CMP EAX,800
|. 1BC0 ||SBB EAX,EAX ; COMCTL32.7745DA80
|. 25 000C0000 ||AND EAX,0C00
|. 05 00040000 ||ADD EAX,400
|. 8985 34FFFFFF ||MOV [LOCAL.51],EAX ; COMCTL32.7745DA80
|. 33C0 ||XOR EAX,EAX ; COMCTL32.7745DA80
|. 6A 00 ||PUSH 0
|. 40 ||INC EAX ; COMCTL32.7745DA80
|. 8D8D 30FFFFFF ||LEA ECX,[LOCAL.52]
|. 8D5D 98 ||LEA EBX,[LOCAL.26]
|. E8 C5FBFFFF ||CALL compress.00418987
|. 47 ||INC EDI
|. 83C6 09 ||ADD ESI,9
|. 837D A4 02 ||CMP [LOCAL.23],2
|. 72 25 ||JB SHORT compress.00418DF1
|. 8B4D A8 ||MOV ECX,[LOCAL.22]
|. 8B55 A4 ||MOV EDX,[LOCAL.23]
|. 8BC3 ||MOV EAX,EBX
|. E8 3EFCFFFF ||CALL compress.00418A17
|. 85C0 ||TEST EAX,EAX ; COMCTL32.7745DA80
|. 7C 14 ||JL SHORT compress.00418DF1
|. 8B4D A4 ||MOV ECX,[LOCAL.23]
|. 2B4D F0 ||SUB ECX,[LOCAL.4]
|. 03C6 ||ADD EAX,ESI
|. 03CF ||ADD ECX,EDI
|. 6BC9 05 ||IMUL ECX,ECX,5
|. 034D E8 ||ADD ECX,[LOCAL.6]
|. 3BC8 ||CMP ECX,EAX ; COMCTL32.7745DA80
|. 7F 56 ||JG SHORT compress.00418E47
|> 3B7D F4 ||CMP EDI,[LOCAL.3]
|.^ 72 9A |\JB SHORT compress.00418D90
|> FF75 FC |PUSH [LOCAL.1]
|. 8D45 98 |LEA EAX,[LOCAL.26]
|. 50 |PUSH EAX ; COMCTL32.7745DA80
|. 8B45 EC |MOV EAX,[LOCAL.5]
|. E8 D7FCFFFF |CALL compress.00418ADC
|. 84C0 |TEST AL,AL
|. 0F84 9C000000 |JE compress.00418EA9
|. FF75 F0 |PUSH [LOCAL.4] ; /Arg1 = 00000000
|. 8B5D 94 |MOV EBX,[LOCAL.27] ; |
|. 8365 FC 00 |AND [LOCAL.1],0 ; |
|. 8D75 98 |LEA ESI,[LOCAL.26] ; |
|. E8 41FDFFFF |CALL compress.00418B60 ; \compress.00418B60
|. 84C0 |TEST AL,AL
|. 0F84 82000000 |JE compress.00418EA9
|. 8B45 F0 |MOV EAX,[LOCAL.4]
|. 47 |INC EDI
|. 57 |PUSH EDI
|. 8D8D 30FFFFFF |LEA ECX,[LOCAL.52]
|. 8BDE |MOV EBX,ESI
|. C785 34FFFFFF 00100000 |MOV [LOCAL.51],1000
|. E8 44FBFFFF |CALL compress.00418987
|> 33FF |XOR EDI,EDI
|. EB 24 |JMP SHORT compress.00418E6B
|> 017D FC |ADD [LOCAL.1],EDI
|.^ EB F7 |JMP SHORT compress.00418E43
|> FF45 FC |INC [LOCAL.1]
|. 33C0 |XOR EAX,EAX ; COMCTL32.7745DA80
|. C785 34FFFFFF 00100000 |MOV [LOCAL.51],1000
|. 40 |INC EAX ; COMCTL32.7745DA80
|> 57 PUSH EDI
|. 8D8D 30FFFFFF |LEA ECX,[LOCAL.52]
|. 8D5D 98 |LEA EBX,[LOCAL.26]
|. E8 1CFBFFFF |CALL compress.00418987
|> 397D A0 |CMP [LOCAL.24],EDI
|.^ 0F87 ABFEFFFF \JA compress.00418D1F
|. FF75 FC PUSH [LOCAL.1]
|. 8D45 98 LEA EAX,[LOCAL.26]
|. 50 PUSH EAX ; COMCTL32.7745DA80
|. 8B45 EC MOV EAX,[LOCAL.5]
|. E8 59FCFFFF CALL compress.00418ADC
|. 84C0 TEST AL,AL
|. 74 22 JE SHORT compress.00418EA9
|. 33FF XOR EDI,EDI
|. 8D45 98 LEA EAX,[LOCAL.26]
|. E8 D4FBFFFF CALL compress.00418A65
|. B9 00000001 MOV ECX,1000000
|. E8 7BFCFFFF CALL compress.00418B16
|. 68 FF000000 PUSH 0FF
|. E8 1DFCFFFF CALL compress.00418AC2
|. 84C0 TEST AL,AL
|. 75 09 JNZ SHORT compress.00418EB2
|> C745 F8 04000000 MOV [LOCAL.2],4
|. EB 28 JMP SHORT compress.00418EDA
|> 8D75 98 LEA ESI,[LOCAL.26]
|. E8 33FDFFFF CALL compress.00418BED
|. 8B45 CC MOV EAX,[LOCAL.13]
|. 2B45 08 SUB EAX,[ARG.1]
|. 8B4D 0C MOV ECX,[ARG.2]
|. 8901 MOV DWORD PTR DS:[ECX],EAX ; COMCTL32.7745DA80
|. 8B4D D4 MOV ECX,[LOCAL.11]
|. 8945 DC MOV [LOCAL.9],EAX ; COMCTL32.7745DA80
|. 85C9 TEST ECX,ECX
|. 74 0B JE SHORT compress.00418EDA
|. FF71 04 PUSH DWORD PTR DS:[ECX+4]
|. 6A 04 PUSH 4
|. 50 PUSH EAX ; COMCTL32.7745DA80
|. FF75 D8 PUSH [LOCAL.10]
|. FF11 CALL DWORD PTR DS:[ECX]
|> 8DB5 30FFFFFF LEA ESI,[LOCAL.52]
|. E8 57F7FFFF CALL compress.0041863C
|. 8B45 F8 MOV EAX,[LOCAL.2]
|> 5F POP EDI
|. 5E POP ESI
|. 5B POP EBX
|. C9 LEAVE
\. C2 0800 RETN 8
> A1 5CC64100 MOV EAX,DWORD PTR DS:[41C65C]
. 3D 70020000 CMP EAX,270
. 0F8C AF000000 JL compress.00418FAE
. 56 PUSH ESI
. 57 PUSH EDI
. 33D2 XOR EDX,EDX
. BE FFFFFF7F MOV ESI,7FFFFFFF
> 8BCA MOV ECX,EDX
. C1E1 02 SHL ECX,2
. 8B81 64C64100 MOV EAX,DWORD PTR DS:[ECX+41C664]
. 3381 60C64100 XOR EAX,DWORD PTR DS:[ECX+41C660]
. 23C6 AND EAX,ESI
. 3381 60C64100 XOR EAX,DWORD PTR DS:[ECX+41C660]
. 8BF8 MOV EDI,EAX ; COMCTL32.7745DA80
. D1E8 SHR EAX,1
. 83E7 01 AND EDI,1
. 3304BD 24C04100 XOR EAX,DWORD PTR DS:[EDI*4+41C024]
. 3381 94CC4100 XOR EAX,DWORD PTR DS:[ECX+41CC94]
. 42 INC EDX
. 81FA E3000000 CMP EDX,0E3
. 8981 60C64100 MOV DWORD PTR DS:[ECX+41C660],EAX ; COMCTL32.7745DA80
.^ 7C C4 JL SHORT compress.00418F08
. 81FA 6F020000 CMP EDX,26F
. 7D 34 JGE SHORT compress.00418F80
. 8D0C95 60C64100 LEA ECX,DWORD PTR DS:[EDX*4+41C660]
> 8B01 MOV EAX,DWORD PTR DS:[ECX]
. 8D51 04 LEA EDX,DWORD PTR DS:[ECX+4]
. 3302 XOR EAX,DWORD PTR DS:[EDX]
. 23C6 AND EAX,ESI
. 3301 XOR EAX,DWORD PTR DS:[ECX]
. 8BF8 MOV EDI,EAX ; COMCTL32.7745DA80
. 83E7 01 AND EDI,1
. 8B3CBD 24C04100 MOV EDI,DWORD PTR DS:[EDI*4+41C024]
. 33BA 70FCFFFF XOR EDI,DWORD PTR DS:[EDX-390]
. D1E8 SHR EAX,1
. 33F8 XOR EDI,EAX ; COMCTL32.7745DA80
. 8939 MOV DWORD PTR DS:[ECX],EDI
. 8BCA MOV ECX,EDX
. 81F9 1CD04100 CMP ECX,compress.0041D01C
.^ 7C D3 JL SHORT compress.00418F53
> 8B0D 1CD04100 MOV ECX,DWORD PTR DS:[41D01C]
. A1 60C64100 MOV EAX,DWORD PTR DS:[41C660]
. 33C1 XOR EAX,ECX
. 23C6 AND EAX,ESI
. 33C1 XOR EAX,ECX
. 8BC8 MOV ECX,EAX ; COMCTL32.7745DA80
. D1E8 SHR EAX,1
. 83E1 01 AND ECX,1
. 33048D 24C04100 XOR EAX,DWORD PTR DS:[ECX*4+41C024]
. 5F POP EDI
. 3305 90CC4100 XOR EAX,DWORD PTR DS:[41CC90]
. 5E POP ESI
. A3 1CD04100 MOV DWORD PTR DS:[41D01C],EAX ; COMCTL32.7745DA80
. 33C0 XOR EAX,EAX ; COMCTL32.7745DA80
> 8B0C85 60C64100 MOV ECX,DWORD PTR DS:[EAX*4+41C660]
. 40 INC EAX ; COMCTL32.7745DA80
. A3 5CC64100 MOV DWORD PTR DS:[41C65C],EAX ; COMCTL32.7745DA80
. 8BC1 MOV EAX,ECX
. C1E8 0B SHR EAX,0B
. 33C8 XOR ECX,EAX ; COMCTL32.7745DA80
. 8BC1 MOV EAX,ECX
. 25 AD583AFF AND EAX,FF3A58AD
. C1E0 07 SHL EAX,7
. 33C8 XOR ECX,EAX ; COMCTL32.7745DA80
. 8BC1 MOV EAX,ECX
. 25 8CDFFFFF AND EAX,FFFFDF8C
. C1E0 0F SHL EAX,0F
. 33C8 XOR ECX,EAX ; COMCTL32.7745DA80
. 8BC1 MOV EAX,ECX
. C1E8 12 SHR EAX,12
. 33C1 XOR EAX,ECX
. C3 RETN
I apologize if i added some useless code as well.. it was really hard to follow the whole code in memory.. plus as you can see there are several calls inside here that i didn't include so this post will stay "readable"