С/С++ Вопрос - Ответ

08.03.2025, 02:48

TokyoQq

Новичок

Регистрация: 14.01.2024

Сообщений: 20

С нами: 1228197

Репутация: 3

Цитата:

Сообщение от Спойлер

ida pro:

Код:

.text:5D3F9870 ; __unwind { // loc_5D8ADD39
.text:5D3F9870                 push    ebx
.text:5D3F9871                 mov     ebx, esp
.text:5D3F9873                 sub     esp, 8
.text:5D3F9876                 and     esp, 0FFFFFFF8h
.text:5D3F9879                 add     esp, 4
.text:5D3F987C                 push    ebp
.text:5D3F987D                 mov     ebp, [ebx+4]
.text:5D3F9880                 mov     [esp+0Ch+var_8], ebp
.text:5D3F9884                 mov     ebp, esp
.text:5D3F9886                 push    0FFFFFFFFh
.text:5D3F9888                 push    offset loc_5D8ADD39
.text:5D3F988D                 mov     eax, large fs:0
.text:5D3F9893                 push    eax
.text:5D3F9894                 push    ecx
.text:5D3F9895                 push    ebx
.text:5D3F9896                 sub     esp, 258h
.text:5D3F989C                 mov     eax, ___security_cookie
.text:5D3F98A1                 xor     eax, ebp
.text:5D3F98A3                 mov     [ebp-1Ch], eax
.text:5D3F98A6                 push    esi
.text:5D3F98A7                 push    edi
.text:5D3F98A8                 push    eax
.text:5D3F98A9                 lea     eax, [ebp-0Ch]
.text:5D3F98AC                 mov     large fs:0, eax
.text:5D3F98B2                 mov     [ebp-10h], esp
.text:5D3F98B5                 mov     edi, ecx
.text:5D3F98B7                 mov     [ebp-140h], edi
.text:5D3F98BD                 cmp     byte ptr [edi], 0
.text:5D3F98C0                 mov     [ebp-164h], edi
.text:5D3F98C6                 jz      loc_5D3FB147
.text:5D3F98CC                 mov     eax, dword_5E063C7C
.text:5D3F98D1                 push    0
.text:5D3F98D3                 push    3
.text:5D3F98D5                 mov     ecx, [eax]
.text:5D3F98D7                 call    sub_5D320EA0
.text:5D3F98DC                 call    sub_5D532800
.text:5D3F98E1                 push    1
.text:5D3F98E3                 sub     esp, 0Ch
.text:5D3F98E6                 mov     ecx, esp
.text:5D3F98E8                 mov     [esp+294h+var_28C], 41880000h
.text:5D3F98F0                 mov     dword ptr [ecx], offset aRobotomonoregu ; "RobotoMonoRegular"
.text:5D3F98F6                 mov     dword ptr [ecx+4], 11h
.text:5D3F98FD                 mov     ecx, eax
.text:5D3F98FF                 call    sub_5D534360
.text:5D3F9904                 push    eax
.text:5D3F9905                 call    sub_5D481880
.text:5D3F990A                 push    0
.text:5D3F990C                 call    sub_5D48FBB0
.text:5D3F9911                 push    0
.text:5D3F9913                 push    0
.text:5D3F9915                 push    offset aAmazingRaklogg ; "Amazing Raklogger"
.text:5D3F991A                 call    sub_5D474190
.text:5D3F991F                 mov     eax, large fs:2Ch
.text:5D3F9925                 add     esp, 14h
.text:5D3F9928                 mov     ecx, TlsIndex
.text:5D3F992E                 mov     ecx, [eax+ecx*4]
.text:5D3F9931                 mov     eax, dword_5E07D898
.text:5D3F9936                 cmp     eax, [ecx+4]
.text:5D3F993C                 jg      loc_5D3FB165

Цитата:

Сообщение от Спойлер

psevdocode:

[CODE]
_DWORD *__usercall sub_5D3F9870@(_BYTE *a1@, int a2@)
{
_DWORD *result; // eax
_BYTE *v3; // edi
int v4; // eax
const char *v5; // eax
int v6; // eax
int v7; // ecx
volatile signed __int32 *v8; // esi
int *v9; // eax
int *v10; // esi
int *v11; // edi
int v12; // ecx
int v13; // esi
int v14; // ecx
_DWORD *v15; // eax
__int128 *v16; // esi
int v17; // ecx
int *v18; // eax
int v19; // ecx
int v20; // eax
int v21; // ecx
_DWORD *v22; // esi
const char *v23; // edx
int v24; // eax
char v25; // al
int v26; // esi
char v27; // al
unsigned __int8 *v28; // edi
int v29; // eax
int v30; // eax
int v31; // esi
int v32; // eax
unsigned __int8 v33; // cl
_DWORD *v34; // esi
unsigned int v35; // eax
unsigned int v36; // eax
__int128 *v37; // edi
unsigned int v38; // ecx
unsigned int v39; // eax
__int128 *v40; // eax
__int128 *v41; // eax
int v42; // edx
int v43; // ecx
int v44; // eax
int v45; // eax
int v46; // esi
int v47; // eax
unsigned __int8 v48; // cl
_DWORD *v49; // esi
int v50; // eax
unsigned int v51; // eax
__int128 *v52; // edi
unsigned int v53; // ecx
unsigned int v54; // eax
__int128 *v55; // eax
__int128 *v56; // eax
int v57; // eax
_BYTE *v58; // edi
int v59; // eax
int v60; // esi
int v61; // eax
_DWORD *v62; // esi
int v63; // eax
unsigned int v64; // eax
__int128 *v65; // edi
unsigned int v66; // ecx
unsigned int v67; // eax
__int128 *v68; // eax
__int128 *v69; // eax
int v70; // eax
unsigned int v71; // ecx
unsigned int v72; // edi
unsigned int v73; // eax
int v74; // esi
_BYTE *v75; // edx
__int128 *v76; // esi
int v77; // edi
__int128 *v78; // eax
__m128i *v79; // eax
__m128i v80; // xmm1
__int64 v81; // xmm0_8
__int128 *v82; // ecx
int v83; // eax
__int32 v84; // edx
int v85; // edx
int v86; // edx
int *v87; // esi
__int128 *v88; // ecx
bool v89; // zf
int v90; // eax
int v91; // ecx
int v92; // eax
volatile signed __int32 *v93; // esi
int v94; // edx
int v95; // esi
unsigned int v96; // edi
unsigned int v97; // esi
int v98; // eax
int v99; // esi
unsigned int v100; // edi
int *v101; // eax
int v102; // ecx
int v103; // ecx
volatile signed __int32 *v104; // esi
int v105; // esi
_DWORD *v106; // edi
char v107; // al
int v108; // edx
const char *v109; // eax
int v110; // edx
char v111; // dl
const char *v112; // ecx
int *v113; // esi
int *v114; // eax
_DWORD *v115; // eax
bool v116; // cc
__int32 v117; // edx
unsigned int v118; // esi
unsigned int v119; // eax
__int128 *v120; // eax
int v121; // ecx
__int128 *v122; // eax
_DWORD *v123; // eax
_DWORD *v124; // ecx
_DWORD *v125; // eax
__int32 v126; // edx
int v127; // edx
int v128; // edx
unsigned int v129; // ecx
int *v130; // esi
int *v131; // edi
unsigned int v132; // ecx
int v133; // eax
unsigned int v134; // ecx
int *v135; // eax
unsigned int v136; // ecx
int v137; // [esp-4h] [ebp-290h]
int v138; // [esp-4h] [ebp-290h]
int v139; // [esp-4h] [ebp-290h]
int v140; // [esp+0h] [ebp-28Ch]
int v141; // [esp+0h] [ebp-28Ch]
int v142; // [esp+0h] [ebp-28Ch]
int v143; // [esp+0h] [ebp-28Ch]
float v144; // [esp+4h] [ebp-288h]
unsigned int v145; // [esp+4h] [ebp-288h]
_BYTE *v146; // [esp+4h] [ebp-288h]
_BYTE *v147; // [esp+4h] [ebp-288h]
float v148; // [esp+4h] [ebp-288h]
int v149; // [esp+8h] [ebp-284h] BYREF
int v150; // [esp+18h] [ebp-274h] BYREF
int v151; // [esp+24h] [ebp-268h] BYREF
int v152; // [esp+34h] [ebp-258h] BYREF
_DWORD v153[9]; // [esp+40h] [ebp-24Ch] BYREF
char v154; // [esp+64h] [ebp-228h]
__int64 v155; // [esp+74h] [ebp-218h] BYREF
int v156; // [esp+7Ch] [ebp-210h]
char v157; // [esp+80h] [ebp-20Ch]
char v158; // [esp+84h] [ebp-208h]
unsigned __int64 v159; // [esp+88h] [ebp-204h]
__int64 v160; // [esp+98h] [ebp-1F4h] BYREF
int v161; // [esp+A0h] [ebp-1ECh]
_DWORD v162[2]; // [esp+A4h] [ebp-1E8h] BYREF
int v163; // [esp+ACh] [ebp-1E0h]
_DWORD v164[2]; // [esp+B0h] [ebp-1DCh] BYREF
int v165; // [esp+B8h] [ebp-1D4h]
_DWORD v166[2]; // [esp+BCh] [ebp-1D0h] BYREF
int v167; // [esp+C4h] [ebp-1C8h]
__int128 v168; // [esp+C8h] [ebp-1C4h] BYREF
__int128 v169; // [esp+D8h] [ebp-1B4h] BYREF
int v170; // [esp+E8h] [ebp-1A4h]
__int128 v171; // [esp+ECh] [ebp-1A0h] BYREF
int v172; // [esp+FCh] [ebp-190h]
int *v173; // [esp+100h] [ebp-18Ch] BYREF
int v174; // [esp+104h] [ebp-188h]
int v175; // [esp+108h] [ebp-184h] BYREF
_DWORD *v176; // [esp+10Ch] [ebp-180h]
int v177; // [esp+110h] [ebp-17Ch]
_BYTE *v178; // [esp+11Ch] [ebp-170h]
int *v179; // [esp+120h] [ebp-16Ch] BYREF
unsigned int v180; // [esp+124h] [ebp-168h]
int *v181; // [esp+128h] [ebp-164h] BYREF
int *v182; // [esp+12Ch] [ebp-160h]
__int128 *v183; // [esp+130h] [ebp-15Ch] BYREF
__int64 v184; // [esp+134h] [ebp-158h] BYREF
int *v185; // [esp+13Ch] [ebp-150h]
_BYTE *v186; // [esp+140h] [ebp-14Ch] BYREF
int *v187; // [esp+144h] [ebp-148h] BYREF
unsigned int v188; // [esp+148h] [ebp-144h]
unsigned int v189; // [esp+14Ch] [ebp-140h] BYREF
_BYTE v190[7]; // [esp+150h] [ebp-13Ch] BYREF
unsigned __int8 v191; // [esp+157h] [ebp-135h] BYREF
int v192; // [esp+158h] [ebp-134h] BYREF
__int128 v193; // [esp+170h] [ebp-11Ch] BYREF
__int64 v194; // [esp+180h] [ebp-10Ch]
__int128 v195; // [esp+188h] [ebp-104h] BYREF
unsigned int v196; // [esp+198h] [ebp-F4h]
unsigned int v197; // [esp+19Ch] [ebp-F0h]
__int128 v198; // [esp+1A0h] [ebp-ECh] BYREF
int v199; // [esp+1B0h] [ebp-DCh]
unsigned int v200; // [esp+1B4h] [ebp-D8h]
__int128 v201; // [esp+1B8h] [ebp-D4h] BYREF
unsigned int v202; // [esp+1C8h] [ebp-C4h]
unsigned int v203; // [esp+1CCh] [ebp-C0h]
char v204[16]; // [esp+1D0h] [ebp-BCh] BYREF
__int64 v205; // [esp+1E0h] [ebp-ACh] BYREF
__m128i v206; // [esp+1E8h] [ebp-A4h] BYREF
__int64 v207; // [esp+1F8h] [ebp-94h]
__int128 v208; // [esp+204h] [ebp-88h] BYREF
_BYTE *v209; // [esp+214h] [ebp-78h]
unsigned int v210; // [esp+218h] [ebp-74h]
__int128 v211; // [esp+21Ch] [ebp-70h] BYREF
unsigned int v212; // [esp+22Ch] [ebp-60h]
unsigned int v213; // [esp+230h] [ebp-5Ch]
__int128 v214; // [esp+234h] [ebp-58h] BYREF
int v215; // [esp+244h] [ebp-48h]
unsigned int v216; // [esp+248h] [ebp-44h]
_BYTE v217[15]; // [esp+261h] [ebp-2Bh] BYREF
int *v218; // [esp+270h] [ebp-1Ch]
_DWORD v219[2]; // [esp+274h] [ebp-18h] BYREF
int v220; // [esp+27Ch] [ebp-10h]
int v221[2]; // [esp+280h] [ebp-Ch] BYREF
int v222; // [esp+288h] [ebp-4h] BYREF
int retaddr; // [esp+28Ch] [ebp+0h]

v221[0] = a2;
v221[1] = retaddr;
v220 = -1;
v219[1] = &loc_5D8ADD39;
v219[0] = NtCurrentTeb()->NtTib.ExceptionList;
*(_DWORD *)&v217[11] = &v222;
result = v219;
v218 = &v149;
v3 = a1;
v186 = a1;
v89 = *a1 == 0;
v178 = a1;
if ( !v89 )
{
sub_5D320EA0(*(void **)dword_5E063C7C, 3, 0);
sub_5D532800();
v4 = sub_5D534360("RobotoMonoRegular", 17, 1099431936, 1);
sub_5D481880(v4);
sub_5D48FBB0(0);
sub_5D474190((int)v221, "Amazing Raklogger", 0, 0);
if ( dword_5E07D898 > *(_DWORD *)(*((_DWORD *)NtCurrentTeb()->ThreadLocalStoragePointer + TlsIndex) + 4) )
sub_5D80924F(&dword_5E07D898);
v89 = v3[1] == 0;
v5 = "pause";
v187 = 0;
if ( v89 )
v5 = "start";
v188 = 0;
if ( (unsigned __int8)sub_5D4A93C0(v5, &v187) )
v3[1] = v3[1] == 0;
sub_5D484450(0, -1082130432);
v187 = 0;
v188 = 0;
if ( (unsigned __int8)sub_5D4A93C0("clear", &v187) )
{
v6 = *((_DWORD *)v3 + 1);
v7 = *((_DWORD *)v3 + 2);
if ( v6 != v7 )
{
sub_5D285760(v6, v7);
*((_DWORD *)v3 + 2) = *((_DWORD *)v3 + 1);
}
v8 = (volatile signed __int32 *)dword_5E07D85C;
dword_5E07D858 = 0;
dword_5E07D85C = 0;
if ( v8 )
{
if ( !_InterlockedExchangeAdd(v8 + 1, 0xFFFFFFFF) )
{
(**(void (__thiscall ***)(volatile signed __int32 *))v8)(v8);
if ( !_InterlockedExchangeAdd(v8 + 2, 0xFFFFFFFF) )
(*(void (__thiscall **)(volatile signed __int32 *))(*v8 + 4))(v8);
}
}
}
if ( dword_5E07D89C > *(_DWORD *)(*((_DWORD *)NtCurrentTeb()->ThreadLocalStoragePointer + TlsIndex) + 4) )
sub_5D80924F(&dword_5E07D89C);
if ( dword_5E07D8A0 > *(_DWORD *)(*((_DWORD *)NtCurrentTeb()->ThreadLocalStoragePointer + TlsIndex) + 4) )
sub_5D80924F(&dword_5E07D8A0);
sub_5D4A9C50("Incoming", &byte_5DF34D30);
sub_5D484450(0, -1082130432);
sub_5D4A9C50("Outcoming", &byte_5DF34D31);
sub_5D4A9C50("Packets", &byte_5DF34D32);
sub_5D484450(0, -1082130432);
sub_5D4A9C50(&word_5DBF7614, &byte_5DF34D33);
sub_5D484450(0, -1082130432);
sub_5D4A9C50("Amazing", &byte_5DF34D34);
v9 = &dword_5DF34B40;
if ( (unsigned int)dword_5DF34B54 > 0xF )
v9 = (int *)dword_5DF34B40;
if ( (unsigned __int8)sub_5D4AFDE0("Filter ids", v9, dword_5DF34B50, 0x40000, sub_5D3F92C0, &dword_5DF34B40) )
{
if ( dword_5E07D860 != dword_5E07D864 )
dword_5E07D864 = dword_5E07D860;
LODWORD(v193) = &dword_5DF34B40;
v10 = &dword_5DF34B40;
BYTE4(v193) = 44;
if ( (unsigned int)dword_5DF34B54 > 0xF )
v10 = (int *)dword_5DF34B40;
LOBYTE(v194) = 0;
sub_5D3F8820(&v189, &v193);
LOBYTE(v185) = 0;
LOBYTE(v176) = 0;
v188 = v189;
LOBYTE(v183) = 0;
v187 = v10;
sub_5D3F8840(&v179, &v187, (char *)&v193 + 4, v183, v176, v185);
v187 = v179;
v188 = v180;
sub_5D3F88B0(&v187);
sub_5D3F8DC0(&v193, v10, DWORD2(v193), HIDWORD(v193));
v215 = v172;
v214 = v171;
sub_5D3FB710(&v206);
v11 = (int *)HIDWORD(v214);
v12 = DWORD2(v214);
v13 = DWORD1(v214);
LABEL_24:
v185 = (int *)v12;
while ( v13 != v206.m128i_i32[1] || (_BYTE)v215 != (_BYTE)v207 )
{
v14 = v12 - v13;
v220 = 0;
v199 = 0;
v198 = 0i64;
v200 = 0;
if ( v13 == v13 + v14 )
{
v199 = 0;
v200 = 15;
LOBYTE(v198) = 0;
}
else
{
sub_5D262330(v13, v14);
}
LOBYTE(v220) = 1;
v15 = (_DWORD *)sub_5D86A71D();
v16 = &v198;
v176 = v15;
if ( v200 > 0xF )
v16 = (__int128 *)v198;
*v15 = 0;
v17 = sub_5D86E895(v16, &v183, 10);
v189 = v17;
if ( v16 == v183 )
sub_5D7F1142("invalid stoi argument");
if ( *v176 == 34 )
sub_5D7F1182("stoi argument out of range");
LOBYTE(v220) = 0;
if ( v200 > 0xF )
{
sub_5D261C90(&v198, v198, v200);
v17 = v189;
}
if ( v17 0xFu )
v19 = *v18;
v20 = v19 + v18[4];
v12 = (int)v185;
v13 = (int)v185;
if ( v185 != (int *)v20 )
{
v13 = (int)v11;
if ( v11 == (int *)v20 )
{
v12 = (int)v11;
LOBYTE(v215) = 1;
DWORD2(v214) = v11;
HIDWORD(v214) = v11;
}
else
{
LOBYTE(v177) = 0;
LOBYTE(v180) = 0;
v174 = v20;
LOBYTE(v188) = 0;
v173 = v11;
sub_5D3F8840(&v184, &v173, v214 + 4, v188, v180, v177);
v11 = (int *)HIDWORD(v184);
v12 = v184;
*((_QWORD *)&v214 + 1) = v184;
}
goto LABEL_24;
}
LOBYTE(v215) = 0;
}
v3 = v186;
}
sub_5D484450(0, -1082130432);
sub_5D4B7530(&unk_5DBF322C, v140);
if ( (unsigned __int8)sub_5D47C1D0(0) )
{
sub_5D476A90();
v144 = sub_5D47A170() * 35.0;
sub_5D481FD0(LODWORD(v144));
sub_5D4B7980("Use a ',' as separator", 0);
sub_5D4817C0();
sub_5D4790B0();
}
sub_5D484450(0, -1082130432);
sub_5D4A9C50("Inverted", &byte_5E07D8A4);
v184 = COERCE_UNSIGNED_INT(*(float *)sub_5D47A0B0(&v173) * 0.40000001) | 0x43FA000000000000i64;
sub_5D4761B0("ChildL", &v184, 1, 2048);
HIDWORD(v205) = 0;
v206.m128i_i32[3] = (__int32)(v3 + 4);
LOBYTE(v207) = v191;
v206.m128i_i32[0] = 0;
v206.m128i_i8[4] = 0;
v206.m128i_i32[2] = -1;
sub_5D3F8C40((char *)&v205 + 4);
memset(&v153[6], 0, 12);
v154 = 0;
sub_5D3F8C40(v21);
sub_5D3F9730((char *)&v171 + 4);
v22 = (_DWORD *)DWORD1(v171);
DWORD1(v168) = &v155;
v185 = (int *)DWORD1(v171);
v178 = *(_BYTE **)(HIDWORD(v155) + 4);
if ( (_BYTE *)DWORD1(v171) != v178 )
{
while ( 1 )
{
sub_5D4819A0(*v22);
v23 = "Incoming";
v89 = *(_BYTE *)*v22 == 0;
v214 = 0i64;
if ( v89 )
v23 = "Outcoming";
v215 = 0;
v216 = 0;
sub_5D262330(v23, strlen(v23));
v24 = *v22;
v220 = 3;
v25 = *(_BYTE *)(v24 + 1);
if ( v25 )
{
if ( v25 == 1 )
{
sub_5D2616A0(" RPC", 4);
}
else if ( v25 == 2 )
{
sub_5D2616A0(" amazing_packet", 15);
}
}
else
{
sub_5D2616A0(" packet", 7);
}
v26 = *v22;
v27 = *(_BYTE *)(v26 + 1);
v28 = (unsigned __int8 *)(v26 + 2);
if ( v27 )
{
if ( v27 == 1 )
{
v44 = *(_DWORD *)(sub_5D2C99B0((char *)&v169 + 8, v26 + 2) + 8);
if ( !*(_BYTE *)(v44 + 13) && *v28 >= *(_BYTE *)(v44 + 16) )
{
sub_5D2C99B0(v164, v26 + 2);
v45 = v165;
if ( *(_BYTE *)(v165 + 13) || *v28 0xFu )
v49 = (_DWORD *)*v49;
v51 = v50 + 1;
v52 = &v195;
v53 = 15;
v188 = v51;
v195 = 0i64;
if ( v51 > 0xF )
{
v54 = v51 | 0xF;
if ( v54 0xF )
v56 = (__int128 *)v195;
LOBYTE(v220) = 7;
sub_5D2616A0(v56, v196);
LOBYTE(v220) = 3;
if ( v197 > 0xF )
sub_5D261C90(&v195, v195, v197);
}
}
else if ( v27 == 2 )
{
v57 = *(_DWORD *)(sub_5D2C99B0((char *)&v168 + 4, v26 + 2) + 8);
if ( !*(_BYTE *)(v57 + 13) )
{
v191 = *v28;
if ( v191 >= *(_BYTE *)(v57 + 16) )
{
v58 = (_BYTE *)(v26 + 2);
sub_5D2C99B0(v162, v26 + 2);
v59 = v163;
if ( *(_BYTE *)(v163 + 13) || v191 0xFu )
v62 = (_DWORD *)*v62;
v64 = v63 + 1;
v65 = &v211;
v66 = 15;
v188 = v64;
v211 = 0i64;
if ( v64 > 0xF )
{
v67 = v64 | 0xF;
if ( v67 0xF )
v69 = (__int128 *)v211;
LOBYTE(v220) = 9;
sub_5D2616A0(v69, v212);
LOBYTE(v220) = 3;
if ( v213 > 0xF )
sub_5D261C90(&v211, v211, v213);
}
}
}
}
else
{
v29 = *(_DWORD *)(sub_5D2C99B0(&v150, v26 + 2) + 8);
if ( !*(_BYTE *)(v29 + 13) && *v28 >= *(_BYTE *)(v29 + 16) )
{
sub_5D2C99B0(v166, v26 + 2);
v30 = v167;
if ( *(_BYTE *)(v167 + 13) || *v28 0xFu )
v34 = (_DWORD *)*v34;
v36 = v35 + 1;
v37 = &v201;
v38 = 15;
v188 = v36;
v201 = 0i64;
if ( v36 > 0xF )
{
v39 = v36 | 0xF;
if ( v39 0xF )
v41 = (__int128 *)v201;
LOBYTE(v220) = 5;
sub_5D2616A0(v41, v202);
LOBYTE(v220) = 3;
if ( v203 > 0xF )
{
v42 = v201;
if ( v203 + 1 >= 0x1000 )
{
v42 = *(_DWORD *)(v201 - 4);
v43 = v203 + 36;
if ( (unsigned int)(v201 - v42 - 4) > 0x1F )
goto LABEL_252;
}
sub_5D808EAC(v42);
}
}
}
v70 = sub_5D269CB0(v217, *(unsigned __int8 *)(*v185 + 2));
v188 = v70;
v209 = 0;
v210 = 0;
v208 = 0i64;
if ( (_BYTE *)v70 == v217 )
{
v71 = 15;
v209 = 0;
v210 = 15;
LOBYTE(v208) = 0;
}
else
{
v72 = (unsigned int)&v217[-v70];
if ( (unsigned int)&v217[-v70] > 0x7FFFFFFF )
goto LABEL_250;
if ( v72 > 0xF )
{
v73 = v72 | 0xF;
if ( (v72 | 0xF) 0xF )
v76 = (__int128 *)v208;
v209 += 2;
if ( v76 >= (__int128 *)"" || &v75[(int)v76] (__int128 *)" (" )
{
v77 = (char *)v76 - " (";
}
else
{
v77 = 0;
}
sub_5D85F6B0((char *)v76 + 2, v76, v75 + 1);
sub_5D85F6B0(v76, " (", v77);
sub_5D85F6B0((char *)v76 + v77, &asc_5DBF7E4C[v77 + 2], 2 - v77);
v78 = &v208;
}
v194 = 0i64;
v193 = 0i64;
v193 = *v78;
v194 = *((_QWORD *)v78 + 2);
*((_DWORD *)v78 + 5) = 15;
LOBYTE(v220) = 11;
*((_DWORD *)v78 + 4) = 0;
*(_BYTE *)v78 = 0;
v79 = (__m128i *)sub_5D2616A0(")", 1);
v81 = v79[1].m128i_i64[0];
v206 = *v79;
v80 = v206;
v207 = v81;
LOBYTE(v220) = 12;
v82 = (__int128 *)&v206;
v79[1].m128i_i32[0] = 0;
v79[1].m128i_i32[1] = 15;
v79->m128i_i8[0] = 0;
v83 = _mm_cvtsi128_si32(v80);
if ( HIDWORD(v207) > 0xF )
v82 = (__int128 *)v83;
sub_5D2616A0(v82, v207);
LOBYTE(v220) = 11;
if ( HIDWORD(v207) > 0xF )
{
v84 = v206.m128i_i32[0];
if ( (unsigned int)(HIDWORD(v207) + 1) >= 0x1000 )
{
v84 = *(_DWORD *)(v206.m128i_i32[0] - 4);
v43 = HIDWORD(v207) + 36;
if ( (unsigned int)(v206.m128i_i32[0] - v84 - 4) > 0x1F )
goto LABEL_252;
}
sub_5D808EAC(v84);
}
LOBYTE(v220) = 10;
if ( HIDWORD(v194) > 0xF )
{
v85 = v193;
if ( (unsigned int)(HIDWORD(v194) + 1) >= 0x1000 )
{
v85 = *(_DWORD *)(v193 - 4);
v43 = HIDWORD(v194) + 36;
if ( (unsigned int)(v193 - v85 - 4) > 0x1F )
goto LABEL_252;
}
sub_5D808EAC(v85);
}
v194 = 0xF00000000i64;
LOBYTE(v193) = 0;
LOBYTE(v220) = 3;
if ( v210 > 0xF )
{
v86 = v208;
if ( v210 + 1 >= 0x1000 )
{
v86 = *(_DWORD *)(v208 - 4);
v43 = v210 + 36;
if ( (unsigned int)(v208 - v86 - 4) > 0x1F )
goto LABEL_252;
}
sub_5D808EAC(v86);
}
v87 = v185;
v88 = &v214;
v175 = 0;
v89 = *v185 == dword_5E07D858;
v176 = 0;
if ( v216 > 0xF )
v88 = (__int128 *)v214;
if ( (unsigned __int8)sub_5D4B41C0(v88, v89, 0, &v175) )
{
v90 = v87[1];
if ( v90 )
_InterlockedIncrement((volatile signed __int32 *)(v90 + 4));
v91 = v87[1];
v92 = *v87;
v93 = (volatile signed __int32 *)dword_5E07D85C;
dword_5E07D858 = v92;
dword_5E07D85C = v91;
if ( v93 )
{
if ( !_InterlockedExchangeAdd(v93 + 1, 0xFFFFFFFF) )
{
(**(void (__thiscall ***)(volatile signed __int32 *))v93)(v93);
if ( !_InterlockedExchangeAdd(v93 + 2, 0xFFFFFFFF) )
(*(void (__thiscall **)(volatile signed __int32 *))(*v93 + 4))(v93);
}
}
}
sub_5D481650();
v220 = -1;
if ( v216 > 0xF )
{
v94 = v214;
if ( v216 + 1 >= 0x1000 )
{
v94 = *(_DWORD *)(v214 - 4);
v43 = v216 + 36;
if ( (unsigned int)(v214 - v94 - 4) > 0x1F )
goto LABEL_252;
}
sub_5D808EAC(v94);
}
v95 = *(_DWORD *)(v172 + 32);
v96 = v172 + 28;
v188 = v172 + 44;
v177 = v172 + 16;
v97 = *(_DWORD *)(v95 + 4);
v98 = sub_5D3F91A0((char *)&v171 + 4);
LOBYTE(v180) = 0;
v159 = __PAIR64__(v96, v97);
sub_5D3F8A30(&v160, *(_QWORD *)v98, *(_DWORD *)(v98 + 8), v97);
HIDWORD(v171) = v161;
*(_QWORD *)((char *)&v171 + 4) = v160;
if ( (_BYTE *)v160 == v178 )
break;
v22 = (_DWORD *)DWORD1(v171);
v185 = (int *)DWORD1(v171);
}
}
if ( byte_5E07D8A5 )
{
v206.m128i_i32[3] = v156;
LOBYTE(v207) = v157;
v205 = 0i64;
BYTE4(v207) = v158;
memset(v204, 0, 13);
v206.m128i_i8[0] = 0;
*(__int64 *)((char *)v206.m128i_i64 + 4) = v155;
sub_5D3F8BA0(v204);
sub_5D3F8BA0(&v192);
sub_5D3F8BA0(v204);
v153[5] = 1;
v99 = 1;
v170 = 1;
v100 = *(_DWORD *)(v153[1] + 4);
DWORD2(v169) = &v152;
HIDWORD(v169) = &v151;
*(_QWORD *)&v169 = __PAIR64__(v153, v100);
sub_5D3F9730((char *)&v171 + 4);
while ( v99 && v100 != DWORD1(v171) )
{
v168 = v169;
v101 = *(int **)sub_5D3F9220(&v168);
v102 = v101[1];
if ( v102 )
_InterlockedIncrement((volatile signed __int32 *)(v102 + 4));
v103 = v101[1];
v104 = (volatile signed __int32 *)dword_5E07D85C;
dword_5E07D858 = *v101;
dword_5E07D85C = v103;
if ( v104 )
{
if ( !_InterlockedExchangeAdd(v104 + 1, 0xFFFFFFFF) )
{
(**(void (__thiscall ***)(volatile signed __int32 *))v104)(v104);
if ( !_InterlockedExchangeAdd(v104 + 2, 0xFFFFFFFF) )
(*(void (__thiscall **)(volatile signed __int32 *))(*v104 + 4))(v104);
}
}
sub_5D3F9220(&v169);
v100 = v169;
v99 = --v170;
}
v148 = sub_5D47A9F0();
sub_5D485040(LODWORD(v148));
}
sub_5D478970();
sub_5D484450(0, -1082130432);
v184 = 0x43FA000000000000i64;
sub_5D4761B0("ChildR", &v184, 1, 2048);
v105 = dword_5E07D858;
if ( !dword_5E07D858 )
goto LABEL_243;
v106 = (_DWORD *)(dword_5E07D858 + 3);
v190[0] = *(_BYTE *)(dword_5E07D858 + 2);
v107 = *(_BYTE *)(dword_5E07D858 + 1);
v188 = v190[0];
if ( v107 )
{
if ( v107 == 1 )
{
v110 = *(_DWORD *)(sub_5D2C99B0((char *)&v168 + 4, v190) + 8);
if ( !*(_BYTE *)(v110 + 13) && *(_BYTE *)(v105 + 2) >= *(_BYTE *)(v110 + 16) )
goto LABEL_188;
}
}
else
{
v108 = *(_DWORD *)(sub_5D2C99B0((char *)&v168 + 4, v190) + 8);
if ( !*(_BYTE *)(v108 + 13) && *(_BYTE *)(v105 + 2) >= *(_BYTE *)(v108 + 16) )
{
LABEL_188:
v109 = (const char *)sub_5D3F90D0(v190);
if ( *((_DWORD *)v109 + 5) > 0xFu )
v109 = *(const char **)v109;
v105 = dword_5E07D858;
LABEL_195:
v111 = *(_BYTE *)(v105 + 1);
if ( v111 )
{
if ( v111 == 1 )
{
v112 = (const char *)&word_5DBF7614;
}
else
{
v112 = "Amazing packet";
if ( v111 != 2 )
v112 = (const char *)&unk_5DED1924;
}
}
else
{
v112 = "Packet";
}
sub_5D4B74B0("%s %s id %d", v112, v109, v188);
sub_5D4B74B0("Size %d bytes", (*v106 + 7) >> 3);
sub_5D4B46C0();
sub_5D4B74B0("Parameters:");
v180 = v106[2];
sub_5D3F76A0(&v181, *(_BYTE *)(dword_5E07D858 + 1), *(_BYTE *)(dword_5E07D858 + 2), v106);
v113 = v181;
v220 = 13;
v188 = (unsigned int)v182;
if ( v181 != v182 )
{
do
{
v114 = v113;
if ( (unsigned int)v113[5] > 0xF )
v114 = (int *)*v113;
v115 = (_DWORD *)sub_5D325DF0(&v206, v114, v113[4]);
v116 = v115[5] 0xF )
{
v117 = v206.m128i_i32[0];
if ( (unsigned int)(HIDWORD(v207) + 1) >= 0x1000 )
{
v117 = *(_DWORD *)(v206.m128i_i32[0] - 4);
v43 = HIDWORD(v207) + 36;
if ( (unsigned int)(v206.m128i_i32[0] - v117 - 4) > 0x1F )
goto LABEL_252;
}
sub_5D808EAC(v117);
}
v113 += 6;
}
while ( v113 != (int *)v188 );
}
sub_5D4B46C0();
sub_5D4B74B0("Unreaded bits %d", *v106 - v106[2]);
sub_5D4B74B0("Dump:");
v118 = v180;
v119 = *v106 - v180;
v106[2] = v180;
sub_5D268600((int)(v119 + 7) >> 3, 0);
v120 = &v211;
v121 = *v106 - v106[2];
if ( v213 > 0xF )
v120 = (__int128 *)v211;
LOBYTE(v220) = 15;
sub_5D321C50(v120, v121, 1);
v106[2] = v118;
v122 = &v211;
if ( v213 > 0xF )
v122 = (__int128 *)v211;
v123 = (_DWORD *)sub_5D3FB230(&v201, v122, v212);
v116 = v123[5] 0xF )
{
v126 = v206.m128i_i32[0];
if ( (unsigned int)(HIDWORD(v207) + 1) >= 0x1000 )
{
v126 = *(_DWORD *)(v206.m128i_i32[0] - 4);
v43 = HIDWORD(v207) + 36;
if ( (unsigned int)(v206.m128i_i32[0] - v126 - 4) > 0x1F )
goto LABEL_252;
}
sub_5D808EAC(v126);
}
v207 = 0xF00000000i64;
v206.m128i_i8[0] = 0;
LOBYTE(v220) = 15;
if ( v203 0xF )
{
v128 = v211;
if ( v213 + 1 >= 0x1000 )
{
v128 = *(_DWORD *)(v211 - 4);
v129 = v213 + 36;
if ( (unsigned int)(v211 - v128 - 4) > 0x1F )
goto LABEL_253;
}
sub_5D808EAC(v128);
}
v130 = v181;
v212 = 0;
v213 = 15;
LOBYTE(v211) = 0;
v220 = -1;
if ( !v181 )
{
LABEL_243:
sub_5D478970();
sub_5D4A9C50("Auto select latest", &byte_5E07D8A5);
sub_5D4815E0();
return (_DWORD *)sub_5D478730();
}
v131 = v182;
if ( v181 != v182 )
{
do
{
v132 = v130[5];
if ( v132 > 0xF )
{
v133 = *v130;
v134 = v132 + 1;
if ( v134 >= 0x1000 )
{
v129 = v134 + 35;
if ( (unsigned int)(v133 - *(_DWORD *)(v133 - 4) - 4) > 0x1F )
goto LABEL_253;
v133 = *(_DWORD *)(v133 - 4);
}
sub_5D808EAC(v133);
}
v130[4] = 0;
v130[5] = 15;
*(_BYTE *)v130 = 0;
v130 += 6;
}
while ( v130 != v131 );
v130 = v181;
}
v135 = v130;
v136 = 24 * (((char *)v183 - (char *)v130) / 24);
if ( v136

что тут именно надо для открытия меню раклоггера, и как вообще получить оффсет может кто объяснить я 0 в реверсинге

𝕏 Twitter Reddit Telegram Копировать ссылку