위는 메인 함수다.
sub140001000에서 입력값을 비교하는 거 같다.
해당 함수는 위와 같다 (sub_140001000)
.text:0000000140001000 sub_140001000 proc near ; CODE XREF: main+4E↓p
.text:0000000140001000 ; DATA XREF: .pdata:ExceptionDir↓o
.text:0000000140001000
.text:0000000140001000 var_18 = dword ptr -18h
.text:0000000140001000 arg_0 = qword ptr 8
.text:0000000140001000
.text:0000000140001000 mov [rsp+arg_0], rcx
.text:0000000140001005 sub rsp, 18h
.text:0000000140001009 mov [rsp+18h+var_18], 0
.text:0000000140001010 jmp short loc_14000101A
.text:0000000140001012 ; ---------------------------------------------------------------------------
.text:0000000140001012
.text:0000000140001012 loc_140001012: ; CODE XREF: sub_140001000:loc_14000105B↓j
.text:0000000140001012 mov eax, [rsp+18h+var_18]
.text:0000000140001015 inc eax
.text:0000000140001017 mov [rsp+18h+var_18], eax
.text:000000014000101A
.text:000000014000101A loc_14000101A: ; CODE XREF: sub_140001000+10↑j
.text:000000014000101A movsxd rax, [rsp+18h+var_18]
.text:000000014000101E cmp rax, 18h
.text:0000000140001022 jnb short loc_14000105D
.text:0000000140001024 movsxd rax, [rsp+18h+var_18]
.text:0000000140001028 mov rcx, [rsp+18h+arg_0]
.text:000000014000102D movzx eax, byte ptr [rcx+rax]
.text:0000000140001031 mov ecx, [rsp+18h+var_18]
.text:0000000140001034 inc ecx
.text:0000000140001036 movsxd rcx, ecx
.text:0000000140001039 mov rdx, [rsp+18h+arg_0]
.text:000000014000103E movzx ecx, byte ptr [rdx+rcx]
.text:0000000140001042 add eax, ecx
.text:0000000140001044 movsxd rcx, [rsp+18h+var_18]
.text:0000000140001048 lea rdx, byte_140003000
.text:000000014000104F movzx ecx, byte ptr [rdx+rcx]
.text:0000000140001053 cmp eax, ecx
.text:0000000140001055 jz short loc_14000105B
.text:0000000140001057 xor eax, eax
.text:0000000140001059 jmp short loc_140001062
.text:000000014000105B ; ---------------------------------------------------------------------------
.text:000000014000105B
.text:000000014000105B loc_14000105B: ; CODE XREF: sub_140001000+55↑j
.text:000000014000105B jmp short loc_140001012
.text:000000014000105D ; ---------------------------------------------------------------------------
.text:000000014000105D
.text:000000014000105D loc_14000105D: ; CODE XREF: sub_140001000+22↑j
.text:000000014000105D mov eax, 1
.text:0000000140001062
.text:0000000140001062 loc_140001062: ; CODE XREF: sub_140001000+59↑j
.text:0000000140001062 add rsp, 18h
.text:0000000140001066 retn
.text:0000000140001066 sub_140001000 endp
.text:000000014000101A movsxd rax, [rsp+18h+var_18]
.text:000000014000101E cmp rax, 18h
.text:0000000140001022 jnb short loc_14000105D
.text:0000000140001024 movsxd rax, [rsp+18h+var_18]
.text:0000000140001028 mov rcx, [rsp+18h+arg_0]
.text:000000014000102D movzx eax, byte ptr [rcx+rax]
.text:0000000140001031 mov ecx, [rsp+18h+var_18]
.text:0000000140001034 inc ecx
.text:0000000140001036 movsxd rcx, ecx
.text:0000000140001039 mov rdx, [rsp+18h+arg_0]
.text:000000014000103E movzx ecx, byte ptr [rdx+rcx]
.text:0000000140001042 add eax, ecx
.text:0000000140001044 movsxd rcx, [rsp+18h+var_18]
.text:0000000140001048 lea rdx, byte_140003000
.text:000000014000104F movzx ecx, byte ptr [rdx+rcx]
.text:0000000140001053 cmp eax, ecx
.text:0000000140001055 jz short loc_14000105B
.text:0000000140001057 xor eax, eax
.text:0000000140001059 jmp short loc_140001062
__int64 __fastcall sub_140001000(char *a1)
{
int i; // [rsp+0h] [rbp-18h]
for ( i = 0; (unsigned __int64)i < 0x18; ++i )
{
if ( (unsigned __int8)a1[i + 1] + (unsigned __int8)a1[i] != unk_140003000[i] )
return 0i64;
}
return 1i64;
}
디컴파일한 결과값은 위와 같다.