Собственно говоря встретил вот такую конструкцию, Но мозгов чтото не хватает у меня разобрать, может ктото видел уже подобное. Code (Text): .text:004663D3 mb_chtoto_dohera_schitaem proc near ; CODE XREF: sub_4628D2+54p .text:004663D3 ; sub_464063+D0p ... .text:004663D3 .text:004663D3 var_10 = dword ptr -10h .text:004663D3 var_C = dword ptr -0Ch .text:004663D3 var_8 = dword ptr -8 .text:004663D3 var_4 = dword ptr -4 .text:004663D3 arg_0 = dword ptr 8 .text:004663D3 arg_4 = dword ptr 0Ch .text:004663D3 .text:004663D3 push ebp .text:004663D4 mov ebp, esp .text:004663D6 sub esp, 10h .text:004663D9 mov ecx, [ebp+arg_0] .text:004663DC push ebx .text:004663DD push esi .text:004663DE mov esi, [ebp+arg_4] .text:004663E1 mov eax, [ecx+10h] .text:004663E4 push edi .text:004663E5 mov edi, esi .text:004663E7 add esi, 0FFFFFFFCh .text:004663EA sub edi, [ecx+0Ch] .text:004663ED shr edi, 0Fh .text:004663F0 mov ecx, edi .text:004663F2 imul ecx, 204h .text:004663F8 lea ecx, [ecx+eax+144h] .text:004663FF mov [ebp+var_10], ecx .text:00466402 mov ecx, [esi] .text:00466404 dec ecx .text:00466405 test cl, 1 .text:00466408 mov [ebp+var_4], ecx .text:0046640B jnz loc_4666F7 .text:00466411 mov edx, [ecx+esi] .text:00466414 lea ebx, [ecx+esi] .text:00466417 mov [ebp+var_C], edx .text:0046641A mov edx, [esi-4] .text:0046641D mov [ebp+var_8], edx .text:00466420 mov edx, [ebp+var_C] .text:00466423 test dl, 1 .text:00466426 mov [ebp+arg_4], ebx .text:00466429 jnz short loc_4664A9 .text:0046642B sar edx, 4 .text:0046642E dec edx .text:0046642F cmp edx, 3Fh .text:00466432 jbe short loc_466437 .text:00466434 push 3Fh .text:00466436 pop edx .text:00466437 .text:00466437 loc_466437: ; CODE XREF: mb_chtoto_dohera_schitaem+5Fj .text:00466437 mov ecx, [ebx+4] .text:0046643A cmp ecx, [ebx+8] .text:0046643D jnz short loc_46648B .text:0046643F cmp edx, 20h .text:00466442 jnb short loc_466462 .text:00466444 mov ebx, 80000000h .text:00466449 mov ecx, edx .text:0046644B shr ebx, cl .text:0046644D lea ecx, [edx+eax+4] .text:00466451 not ebx .text:00466453 and [eax+edi*4+44h], ebx .text:00466457 dec byte ptr [ecx] .text:00466459 jnz short loc_466483 .text:0046645B mov ecx, [ebp+arg_0] .text:0046645E and [ecx], ebx .text:00466460 jmp short loc_466483 .text:00466462 ; --------------------------------------------------------------------------- .text:00466462 .text:00466462 loc_466462: ; CODE XREF: mb_chtoto_dohera_schitaem+6Fj .text:00466462 lea ecx, [edx-20h] .text:00466465 mov ebx, 80000000h .text:0046646A shr ebx, cl .text:0046646C lea ecx, [edx+eax+4] .text:00466470 not ebx .text:00466472 and [eax+edi*4+0C4h], ebx .text:00466479 dec byte ptr [ecx] .text:0046647B jnz short loc_466483 .text:0046647D mov ecx, [ebp+arg_0] .text:00466480 and [ecx+4], ebx .text:00466483 .text:00466483 loc_466483: ; CODE XREF: mb_chtoto_dohera_schitaem+86j .text:00466483 ; mb_chtoto_dohera_schitaem+8Dj ... .text:00466483 mov ecx, [ebp+var_4] .text:00466486 mov ebx, [ebp+arg_4] .text:00466489 jmp short loc_46648E .text:0046648B ; --------------------------------------------------------------------------- .text:0046648B .text:0046648B loc_46648B: ; CODE XREF: mb_chtoto_dohera_schitaem+6Aj .text:0046648B mov ecx, [ebp+var_4] .text:0046648E .text:0046648E loc_46648E: ; CODE XREF: mb_chtoto_dohera_schitaem+B6j .text:0046648E mov edx, [ebx+8] .text:00466491 mov ebx, [ebx+4] .text:00466494 add ecx, [ebp+var_C] .text:00466497 mov [edx+4], ebx .text:0046649A mov edx, [ebp+arg_4] .text:0046649D mov [ebp+var_4], ecx .text:004664A0 mov ebx, [edx+4] .text:004664A3 mov edx, [edx+8] .text:004664A6 mov [ebx+8], edx .text:004664A9 .text:004664A9 loc_4664A9: ; CODE XREF: mb_chtoto_dohera_schitaem+56j .text:004664A9 mov edx, ecx .text:004664AB sar edx, 4 .text:004664AE dec edx .text:004664AF cmp edx, 3Fh .text:004664B2 jbe short loc_4664B7 .text:004664B4 push 3Fh .text:004664B6 pop edx .text:004664B7 .text:004664B7 loc_4664B7: ; CODE XREF: mb_chtoto_dohera_schitaem+DFj .text:004664B7 mov ebx, [ebp+var_8] .text:004664BA and ebx, 1 .text:004664BD mov [ebp+var_C], ebx .text:004664C0 jnz loc_46655A .text:004664C6 sub esi, [ebp+var_8] .text:004664C9 mov ebx, [ebp+var_8] .text:004664CC sar ebx, 4 .text:004664CF push 3Fh .text:004664D1 mov [ebp+arg_4], esi .text:004664D4 dec ebx .text:004664D5 pop esi .text:004664D6 cmp ebx, esi .text:004664D8 jbe short loc_4664DC .text:004664DA mov ebx, esi .text:004664DC .text:004664DC loc_4664DC: ; CODE XREF: mb_chtoto_dohera_schitaem+105j .text:004664DC add ecx, [ebp+var_8] .text:004664DF mov edx, ecx .text:004664E1 mov [ebp+var_4], ecx .text:004664E4 sar edx, 4 .text:004664E7 dec edx .text:004664E8 cmp edx, esi .text:004664EA jbe short loc_4664EE .text:004664EC mov edx, esi .text:004664EE .text:004664EE loc_4664EE: ; CODE XREF: mb_chtoto_dohera_schitaem+117j .text:004664EE cmp ebx, edx .text:004664F0 jz short loc_466555 .text:004664F2 mov ecx, [ebp+arg_4] .text:004664F5 mov esi, [ecx+4] .text:004664F8 cmp esi, [ecx+8] .text:004664FB jnz short loc_46653D .text:004664FD cmp ebx, 20h .text:00466500 jnb short loc_46651E .text:00466502 mov esi, 80000000h .text:00466507 mov ecx, ebx .text:00466509 shr esi, cl .text:0046650B not esi .text:0046650D and [eax+edi*4+44h], esi .text:00466511 dec byte ptr [ebx+eax+4] .text:00466515 jnz short loc_46653D .text:00466517 mov ecx, [ebp+arg_0] .text:0046651A and [ecx], esi .text:0046651C jmp short loc_46653D .text:0046651E ; --------------------------------------------------------------------------- .text:0046651E .text:0046651E loc_46651E: ; CODE XREF: mb_chtoto_dohera_schitaem+12Dj .text:0046651E lea ecx, [ebx-20h] .text:00466521 mov esi, 80000000h .text:00466526 shr esi, cl .text:00466528 not esi .text:0046652A and [eax+edi*4+0C4h], esi .text:00466531 dec byte ptr [ebx+eax+4] .text:00466535 jnz short loc_46653D .text:00466537 mov ecx, [ebp+arg_0] .text:0046653A and [ecx+4], esi .text:0046653D .text:0046653D loc_46653D: ; CODE XREF: mb_chtoto_dohera_schitaem+128j .text:0046653D ; mb_chtoto_dohera_schitaem+142j ... .text:0046653D mov ecx, [ebp+arg_4] .text:00466540 mov esi, [ecx+8] .text:00466543 mov ecx, [ecx+4] .text:00466546 mov [esi+4], ecx .text:00466549 mov ecx, [ebp+arg_4] .text:0046654C mov esi, [ecx+4] .text:0046654F mov ecx, [ecx+8] .text:00466552 mov [esi+8], ecx .text:00466555 .text:00466555 loc_466555: ; CODE XREF: mb_chtoto_dohera_schitaem+11Dj .text:00466555 mov esi, [ebp+arg_4] .text:00466558 jmp short loc_46655D .text:0046655A ; --------------------------------------------------------------------------- .text:0046655A .text:0046655A loc_46655A: ; CODE XREF: mb_chtoto_dohera_schitaem+EDj .text:0046655A mov ebx, [ebp+arg_0] .text:0046655D .text:0046655D loc_46655D: ; CODE XREF: mb_chtoto_dohera_schitaem+185j .text:0046655D cmp [ebp+var_C], 0 .text:00466561 jnz short loc_46656B .text:00466563 cmp ebx, edx .text:00466565 jz loc_4665EC .text:0046656B .text:0046656B loc_46656B: ; CODE XREF: mb_chtoto_dohera_schitaem+18Ej .text:0046656B mov ecx, [ebp+var_10] .text:0046656E mov ebx, [ecx+edx*8+4] .text:00466572 lea ecx, [ecx+edx*8] .text:00466575 mov [esi+4], ebx .text:00466578 mov [esi+8], ecx .text:0046657B mov [ecx+4], esi .text:0046657E mov ecx, [esi+4] .text:00466581 mov [ecx+8], esi .text:00466584 mov ecx, [esi+4] .text:00466587 cmp ecx, [esi+8] .text:0046658A jnz short loc_4665EC .text:0046658C mov cl, [edx+eax+4] .text:00466590 cmp edx, 20h .text:00466593 mov byte ptr [ebp+arg_4+3], cl .text:00466596 inc cl .text:00466598 mov [edx+eax+4], cl .text:0046659C jnb short loc_4665C3 .text:0046659E cmp byte ptr [ebp+arg_4+3], 0 .text:004665A2 jnz short loc_4665B2 .text:004665A4 mov ebx, 80000000h .text:004665A9 mov ecx, edx .text:004665AB shr ebx, cl .text:004665AD mov ecx, [ebp+arg_0] .text:004665B0 or [ecx], ebx .text:004665B2 .text:004665B2 loc_4665B2: ; CODE XREF: mb_chtoto_dohera_schitaem+1CFj .text:004665B2 mov ebx, 80000000h .text:004665B7 mov ecx, edx .text:004665B9 shr ebx, cl .text:004665BB lea eax, [eax+edi*4+44h] .text:004665BF or [eax], ebx .text:004665C1 jmp short loc_4665EC .text:004665C3 ; --------------------------------------------------------------------------- .text:004665C3 .text:004665C3 loc_4665C3: ; CODE XREF: mb_chtoto_dohera_schitaem+1C9j .text:004665C3 cmp byte ptr [ebp+arg_4+3], 0 .text:004665C7 jnz short loc_4665D9 .text:004665C9 lea ecx, [edx-20h] .text:004665CC mov ebx, 80000000h .text:004665D1 shr ebx, cl .text:004665D3 mov ecx, [ebp+arg_0] .text:004665D6 or [ecx+4], ebx .text:004665D9 .text:004665D9 loc_4665D9: ; CODE XREF: mb_chtoto_dohera_schitaem+1F4j .text:004665D9 lea ecx, [edx-20h] .text:004665DC mov edx, 80000000h .text:004665E1 shr edx, cl .text:004665E3 lea eax, [eax+edi*4+0C4h] .text:004665EA or [eax], edx .text:004665EC .text:004665EC loc_4665EC: ; CODE XREF: mb_chtoto_dohera_schitaem+192j .text:004665EC ; mb_chtoto_dohera_schitaem+1B7j ... .text:004665EC mov eax, [ebp+var_4] .text:004665EF mov [esi], eax .text:004665F1 mov [eax+esi-4], eax .text:004665F5 mov eax, [ebp+var_10] .text:004665F8 dec dword ptr [eax] .text:004665FA jnz loc_4666F7 .text:00466600 mov eax, Dst .text:00466605 test eax, eax .text:00466607 jz loc_4666E9 .text:0046660D mov ecx, dword_488B10 .text:00466613 mov esi, ds:VirtualFree .text:00466619 shl ecx, 0Fh .text:0046661C add ecx, [eax+0Ch] .text:0046661F mov ebx, 8000h .text:00466624 push 4000h ; dwFreeType .text:00466629 push ebx ; dwSize .text:0046662A push ecx ; lpAddress .text:0046662B call esi ; VirtualFree .text:0046662D mov ecx, dword_488B10 .text:00466633 mov eax, Dst .text:00466638 mov edx, 80000000h .text:0046663D shr edx, cl .text:0046663F or [eax+8], edx .text:00466642 mov eax, Dst .text:00466647 mov ecx, dword_488B10 .text:0046664D mov eax, [eax+10h] .text:00466650 and dword ptr [eax+ecx*4+0C4h], 0 .text:00466658 mov eax, Dst .text:0046665D mov eax, [eax+10h] .text:00466660 dec byte ptr [eax+43h] .text:00466663 mov eax, Dst .text:00466668 mov ecx, [eax+10h] .text:0046666B cmp byte ptr [ecx+43h], 0 .text:0046666F jnz short loc_46667A .text:00466671 and dword ptr [eax+4], 0FFFFFFFEh .text:00466675 mov eax, Dst .text:0046667A .text:0046667A loc_46667A: ; CODE XREF: mb_chtoto_dohera_schitaem+29Cj .text:0046667A cmp dword ptr [eax+8], 0FFFFFFFFh .text:0046667E jnz short loc_4666E9 .text:00466680 push ebx ; dwFreeType .text:00466681 push 0 ; dwSize .text:00466683 push dword ptr [eax+0Ch] ; lpAddress .text:00466686 call esi ; VirtualFree .text:00466688 mov eax, Dst .text:0046668D push dword ptr [eax+10h] ; lpMem .text:00466690 push 0 ; dwFlags .text:00466692 push hHeap ; hHeap .text:00466698 call ds:HeapFree .text:0046669E mov eax, dword_488B20 .text:004666A3 mov edx, lpMem .text:004666A9 lea eax, [eax+eax*4] .text:004666AC shl eax, 2 .text:004666AF mov ecx, eax .text:004666B1 mov eax, Dst .text:004666B6 sub ecx, eax .text:004666B8 lea ecx, [ecx+edx-14h] .text:004666BC push ecx ; Size .text:004666BD lea ecx, [eax+14h] .text:004666C0 push ecx ; Src .text:004666C1 push eax ; Dst .text:004666C2 call _memcpy_0 .text:004666C7 mov eax, [ebp+arg_0] .text:004666CA add esp, 0Ch .text:004666CD dec dword_488B20 .text:004666D3 cmp eax, Dst .text:004666D9 jbe short loc_4666DF .text:004666DB sub [ebp+arg_0], 14h .text:004666DF .text:004666DF loc_4666DF: ; CODE XREF: mb_chtoto_dohera_schitaem+306j .text:004666DF mov eax, lpMem .text:004666E4 mov dword_488B14, eax .text:004666E9 .text:004666E9 loc_4666E9: ; CODE XREF: mb_chtoto_dohera_schitaem+234j .text:004666E9 ; mb_chtoto_dohera_schitaem+2ABj .text:004666E9 mov eax, [ebp+arg_0] .text:004666EC mov dword_488B10, edi .text:004666F2 mov Dst, eax .text:004666F7 .text:004666F7 loc_4666F7: ; CODE XREF: mb_chtoto_dohera_schitaem+38j .text:004666F7 ; mb_chtoto_dohera_schitaem+227j .text:004666F7 pop edi .text:004666F8 pop esi .text:004666F9 pop ebx .text:004666FA leave .text:004666FB retn .text:004666FB mb_chtoto_dohera_schitaem endp .text:004666FB
1. Options -> Demangled names - установи в names. IDA способна идентифицировать функции многих компиляторов. 2. может файл зальешь
Это __sbh_free_block из мелкомягкой Сишной библиотеки - вспомогательная функция для функции освобождения памяти free().