XFileSharing Pro v2.2

***m16011*** · 08-01-2015, 08:42 AM

XFileSharing Pro is SibSoft's advanced, professional file sharing
script. Over 500 of our clients are currently using this powerful
platform. They all agree that XFileSharing Pro is the best solution
available on the Internet today.

XFileSharing Pro can be installed on virtual, shared, or dedicated Linux
hosting environments. XFileSharing Pro is fully customizable to blend
perfectly with your site with minimal HTML coding experience. You can
utilize this powerful script to place banners, Adsense, or other
advertising links on your website. XFileSharing Pro is a very fast way
to get your website monetized.

With XFileSharing's upload system you can upload multiple files
simultaneously. You get a visual representation of files that have been
loaded, as well as what is currently uploading. Password authentication
allows your users to protect all of their sensitive upload data. Users
can send links to recently uploaded files to their friends or
themselves.

Download: https://userscloud.com/gaagky2n3tlt

***DaniloIN*** · 08-01-2015, 09:09 AM

(08-01-2015 08:42 AM)m16011 Wrote:
XFileSharing Pro v2.2

XFileSharing Pro is SibSoft's advanced, professional file sharing
script. Over 500 of our clients are currently using this powerful
platform. They all agree that XFileSharing Pro is the best solution
available on the Internet today.

XFileSharing Pro can be installed on virtual, shared, or dedicated Linux
hosting environments. XFileSharing Pro is fully customizable to blend
perfectly with your site with minimal HTML coding experience. You can
utilize this powerful script to place banners, Adsense, or other
advertising links on your website. XFileSharing Pro is a very fast way
to get your website monetized.

With XFileSharing's upload system you can upload multiple files
simultaneously. You get a visual representation of files that have been
loaded, as well as what is currently uploading. Password authentication
allows your users to protect all of their sensitive upload data. Users
can send links to recently uploaded files to their friends or
themselves.

Download: https://userscloud.com/gaagky2n3tlt

Hmm, is it nulled? It is a very secure encryption

***FireHacker*** · 08-01-2015, 09:10 AM

is it nulled? can you confirm if nulled or need to be nulled

***m16011*** · (This post was last modified: 08-01-2015 09:16 AM by m16011.)

(08-01-2015 09:09 AM)DaniloIN Wrote:
(08-01-2015 08:42 AM)m16011 Wrote:
XFileSharing Pro v2.2

XFileSharing Pro is SibSoft's advanced, professional file sharing
script. Over 500 of our clients are currently using this powerful
platform. They all agree that XFileSharing Pro is the best solution
available on the Internet today.

XFileSharing Pro can be installed on virtual, shared, or dedicated Linux
hosting environments. XFileSharing Pro is fully customizable to blend
perfectly with your site with minimal HTML coding experience. You can
utilize this powerful script to place banners, Adsense, or other
advertising links on your website. XFileSharing Pro is a very fast way
to get your website monetized.

With XFileSharing's upload system you can upload multiple files
simultaneously. You get a visual representation of files that have been
loaded, as well as what is currently uploading. Password authentication
allows your users to protect all of their sensitive upload data. Users
can send links to recently uploaded files to their friends or
themselves.

Download: https://userscloud.com/gaagky2n3tlt

Hmm, is it nulled? It is a very secure encryption

I do not know bro, my friend shared to me.

(08-01-2015 09:10 AM)FireHacker Wrote: is it nulled? can you confirm if nulled or need to be nulled

I have no idea

***Mixawy*** · 08-01-2015, 09:23 AM

Thanks Dude, Great Share

Mirrors ++

Quote:http://www.arabloads.net/uftn48q2mzwe/sp2.2.zip.html
http://www.gigamirror.com/download/6KAV0CJM
http://filerio.in/0mn3e4p5kzyl
http://www.mirrorcreator.com/files/TH4RE....zip_links
http://www.maxmirror.com/download/1KP5BFXG
http://turbobit.net/i3v7koxjukd0.html
https://tusfiles.net/f2gyu60ytndb
http://up07.net/9mfi2cd12k48
http://www37.zippyshare.com/v/GfuNmYfE/file.html

VT Scan

Quote:https://www.virustotal.com/en/file/509c1...438384692/

***el matadoor*** · (This post was last modified: 08-01-2015 09:50 AM by el matadoor.)

it is mission impossible to nulled it
i confirm

there is just 1 files that non one can decode it
look here
XFileSharing Pro v2.2\cgi-bin\Modules\Session.pm

***m16011*** · (This post was last modified: 08-01-2015 10:49 AM by m16011.)

(08-01-2015 09:48 AM)el matadoor Wrote: it is mission impossible to nulled it
i confirm

there is just 1 files that non one can decode it
look here
XFileSharing Pro v2.2\cgi-bin\Modules\Session.pm

I have 1.9 nulled verison Session.pm see the same thing too and it works -.-

(08-01-2015 09:10 AM)FireHacker Wrote: is it nulled? can you confirm if nulled or need to be nulled

FireHacker can u confirm it I dont trust this guy

***el matadoor*** · 08-02-2015, 12:41 AM

(08-01-2015 10:47 AM)m16011 Wrote: I have 1.9 nulled verison Session.pm see the same thing too and it works -.-

v1.9 it is available every where but it was difficulte to install it
so i leave that
can you show us Live Demo of your instalation
or tell us how to install

***JustSomeDude*** · 08-02-2015, 06:16 AM

Well I will give you guys a hint. If you want to take a crack at reversing the encoding algorithm use the offsets and code below:

Code:

/ (fcn) fcn.00001780 81

|           ; arg int arg_2        @ ebp+0x8

|           ; arg int arg_3        @ ebp+0xc

|           ; var int local_10     @ ebp-0x28

|           ;-- fcn.00001780:

|           0x00001780    55             push ebp

|           0x00001781    89e5           mov ebp, esp

|           0x00001783    57             push edi

|           0x00001784    56             push esi

|           0x00001785    53             push ebx

|           0x00001786    e85cf9ffff     call fcn.000010e7 ;fcn.000010e7(unk, unk, unk, unk)

|           0x0000178b    81c335210000   add ebx, 0x2135

|           0x00001791    83ec3c         sub esp, 0x3c

|           0x00001794    8b4508         mov eax, dword [ebp + 8]       ; [0x8:4]=0 ; 8

|           0x00001797    890424         mov dword [esp], eax

|           0x0000179a    e8cdf5ffff     call sym.imp.Perl_Irsfp_filters_ptr ;sym.imp.Perl_Irsfp_filters_ptr()

|           0x0000179f    8b550c         mov edx, dword [ebp + 0xc]     ; [0xc:4]=0 ; 12

|           0x000017a2    8b00           mov eax, dword [eax]

|           0x000017a4    8b00           mov eax, dword [eax]

|           0x000017a6    8b00           mov eax, dword [eax]

|           0x000017a8    8b3490         mov esi, dword [eax + edx*4]

|           0x000017ab    c74424040020.  mov dword [esp + 4], 0x2000    ; [0x2000:4]=0

|           0x000017b3    8b4d08         mov ecx, dword [ebp + 8]       ; [0x8:4]=0 ; 8

|           0x000017b6    890c24         mov dword [esp], ecx

|           0x000017b9    e87ef7ffff     call sym.imp.Perl_newSV ;sym.imp.Perl_newSV()

|           0x000017be    89442404       mov dword [esp + 4], eax       ; [0x4:4]=0x10101  ; 4

|           0x000017c2    8b4508         mov eax, dword [ebp + 8]       ; [0x8:4]=0 ; 8

|           0x000017c5    890424         mov dword [esp], eax

|           0x000017c8    e87ff6ffff     call sym.imp.Perl_sv_2mortal ;sym.imp.Perl_sv_2mortal()

|           0x000017cd    8945d8         mov dword [ebp-local_10], eax

\           0x000017d0    cc             int3

/ (fcn) fcn.000017d1 1284

|           ; arg int arg_2        @ ebp+0x8

|           ; arg int arg_3        @ ebp+0xc

|           ; arg int arg_4        @ ebp+0x10

|           ; arg int arg_5        @ ebp+0x14

|           ; var int local_1      @ ebp-0x4

|           ; var int local_2      @ ebp-0x8

|           ; var int local_3      @ ebp-0xc

|           ; var int local_4      @ ebp-0x10

|           ; var int local_5      @ ebp-0x14

|           ; var int local_8      @ ebp-0x20

|           ; var int local_9      @ ebp-0x24

|           ; var int local_10     @ ebp-0x28

|           ; var int local_11     @ ebp-0x2c

|           ; var int local_12     @ ebp-0x30

|           ; var int local_13     @ ebp-0x34

|           0x000017d1    89c2           mov edx, eax

|           0x000017d3    8b4008         mov eax, dword [eax + 8]       ; [0x8:4]=0 ; 8

|           0x000017d6    25fffff048     and eax, 0x48f0ffff

|           0x000017db    0d00000404     or eax, 0x4040000

|           0x000017e0    894208         mov dword [edx + 8], eax       ; [0x8:4]=0 ; 8

|           0x000017e3    c74424087e00.  mov dword [esp + 8], 0x7e      ; [0x7e:4]=0x37d40000  ; '~' ; 126

|           0x000017eb    89742404       mov dword [esp + 4], esi       ; [0x4:4]=0x10101  ; 4

|           0x000017ef    8b4d08         mov ecx, dword [ebp + 8]       ; [0x8:4]=0 ; 8

|           0x000017f2    890c24         mov dword [esp], ecx

|           0x000017f5    e872f7ffff     call sym.imp.Perl_mg_find ;sym.imp.Perl_mg_find()

|           0x000017fa    85c0           test eax, eax

|       ,=< 0x000017fc    0f84b7030000   je 0x1bb9                    

|       |   0x00001802    8b5010         mov edx, dword [eax + 0x10]    ; [0x10:4]=0x30003  ; 16

|       |   0x00001805    85d2           test edx, edx

|       |   0x00001807    8955d0         mov dword [ebp-local_12], edx

|      ,==< 0x0000180a    0f8486030000   je 0x1b96                    

|      ||   0x00001810    8b55d0         mov edx, dword [ebp-local_12]

|      ||   0x00001813    3b02           cmp eax, dword [edx]

|     ,===< 0x00001815    0f854e030000   jne 0x1b69                   

|     |||   0x0000181b    8b55d0         mov edx, dword [ebp-local_12]

|     |||   0x0000181e    8b7210         mov esi, dword [edx + 0x10]    ; [0x10:4]=0x30003  ; 16

|     |||   0x00001821    85f6           test esi, esi

|    ,====< 0x00001823    0f84d8020000   je 0x1b01                    

|           ; JMP XREF from 0x00001b44 (fcn.000017d1)

| --------> 0x00001829    8d932eeeffff   lea edx, [ebx - 0x11d2]

|    ||||   0x0000182f    8955cc         mov dword [ebp-local_13], edx

|           ; JMP XREF from 0x0000197e (fcn.000017d1)

| --------> 0x00001832    8b4dd0         mov ecx, dword [ebp-local_12]

|    ||||   0x00001835    8b4108         mov eax, dword [ecx + 8]       ; [0x8:4]=0 ; 8

|    ||||   0x00001838    8b00           mov eax, dword [eax]

|    ||||   0x0000183a    8b7004         mov esi, dword [eax + 4]       ; [0x4:4]=0x10101  ; 4

|    ||||   0x0000183d    85f6           test esi, esi

|   ,=====< 0x0000183f    7e7a           jle 0x18bb                   

|   |||||   0x00001841    8b5514         mov edx, dword [ebp + 0x14]    ; [0x14:4]=1 ; 20

|   |||||   0x00001844    8b38           mov edi, dword [eax]

|   |||||   0x00001846    85d2           test edx, edx

|  ,======< 0x00001848    0f852c020000   jne 0x1a7a                   

|  ||||||   0x0000184e    8b45cc         mov eax, dword [ebp-local_13]

|  ||||||   0x00001851    8d0c37         lea ecx, [edi + esi]

|  ||||||   0x00001854    894dd4         mov dword [ebp-local_11], ecx

|  ||||||   0x00001857    894c2408       mov dword [esp + 8], ecx       ; [0x8:4]=0 ; 8

|  ||||||   0x0000185b    897c2404       mov dword [esp + 4], edi       ; [0x4:4]=0x10101  ; 4

|  ||||||   0x0000185f    89442410       mov dword [esp + 0x10], eax    ; [0x10:4]=0x30003  ; 16

|  ||||||   0x00001863    8d40ff         lea eax, [eax - 1]

|  ||||||   0x00001866    8944240c       mov dword [esp + 0xc], eax     ; [0xc:4]=0 ; 12

|  ||||||   0x0000186a    8b4d08         mov ecx, dword [ebp + 8]       ; [0x8:4]=0 ; 8

|  ||||||   0x0000186d    890c24         mov dword [esp], ecx

|  ||||||   0x00001870    e817f6ffff     call sym.imp.Perl_ninstr ;sym.imp.Perl_ninstr()

|  ||||||   0x00001875    85c0           test eax, eax

| ,=======< 0x00001877    0f8554020000   jne 0x1ad1                   

| |||||||   0x0000187d    c74424100200.  mov dword [esp + 0x10], 2      ; [0x10:4]=0x30003  ; 16

| |||||||   0x00001885    8974240c       mov dword [esp + 0xc], esi     ; [0xc:4]=0 ; 12

| |||||||   0x00001889    897c2408       mov dword [esp + 8], edi       ; [0x8:4]=0 ; 8

| |||||||   0x0000188d    8b4d10         mov ecx, dword [ebp + 0x10]    ; [0x10:4]=0x30003  ; 16

| |||||||   0x00001890    894c2404       mov dword [esp + 4], ecx       ; [0x4:4]=0x10101  ; 4

| |||||||   0x00001894    8b4508         mov eax, dword [ebp + 8]       ; [0x8:4]=0 ; 8

| |||||||   0x00001897    890424         mov dword [esp], eax

| |||||||   0x0000189a    e88df5ffff     call sym.imp.Perl_sv_catpvn_flags ;0x00000e2c() ; sym.imp.Perl_sv_catpvn_flags

| |||||||   0x0000189f    8b55d4         mov edx, dword [ebp-local_11]

| |||||||   0x000018a2    89542408       mov dword [esp + 8], edx       ; [0x8:4]=0 ; 8

| |||||||   0x000018a6    8b4dd0         mov ecx, dword [ebp-local_12]

| |||||||   0x000018a9    8b4108         mov eax, dword [ecx + 8]       ; [0x8:4]=0 ; 8

| |||||||   0x000018ac    89442404       mov dword [esp + 4], eax       ; [0x4:4]=0x10101  ; 4

| |||||||   0x000018b0    8b4508         mov eax, dword [ebp + 8]       ; [0x8:4]=0 ; 8

| |||||||   0x000018b3    890424         mov dword [esp], eax

| |||||||   0x000018b6    e8a1f4ffff     call sym.imp.Perl_sv_chop      ; fcn.00000d58+0x4 ;fcn.00000d58() ; sym.imp.Perl_sv_chop

| |||       ; JMP XREF from 0x0000183f (fcn.000017d1)

| ||`-----> 0x000018bb    8b55d0         mov edx, dword [ebp-local_12]

| || ||||   0x000018be    837a1002       cmp dword [edx + 0x10], 2      ; [0x2:4]=0x101464c  ; 2

| ========< 0x000018c2    0f8497010000   je 0x1a5f                    

| || ||||   0x000018c8    8b55d0         mov edx, dword [ebp-local_12]

| || ||||   0x000018cb    8b4208         mov eax, dword [edx + 8]       ; [0x8:4]=0 ; 8

| || ||||   0x000018ce    8b00           mov eax, dword [eax]

| || ||||   0x000018d0    c74004000000.  mov dword [eax + 4], 0         ; [0x4:4]=0x10101  ; 4

| || ||||   0x000018d7    8b4208         mov eax, dword [edx + 8]       ; [0x8:4]=0 ; 8

| || ||||   0x000018da    8b00           mov eax, dword [eax]

| || ||||   0x000018dc    8b00           mov eax, dword [eax]

| || ||||   0x000018de    c60000         mov byte [eax], 0

| || ||||   0x000018e1    8b4208         mov eax, dword [edx + 8]       ; [0x8:4]=0 ; 8

| || ||||   0x000018e4    f6400a20       test byte [eax + 0xa], 0x20    ; [0x20:1]=248 ; 32

| ========< 0x000018e8    0f8525010000   jne 0x1a13                   

|           ; JMP XREF from 0x00001a22 (fcn.000017d1)

| --------> 0x000018ee    8b450c         mov eax, dword [ebp + 0xc]     ; [0xc:4]=0 ; 12

| || ||||   0x000018f1    31ff           xor edi, edi

| || ||||   0x000018f3    83c001         add eax, 1

| || ||||   0x000018f6    8945dc         mov dword [ebp-local_9], eax

| || ||||   0x000018f9    8db426000000.  lea esi, [esi]

|           ; JMP XREF from 0x00001937 (fcn.000017d1)

| --------> 0x00001900    b800200000     mov eax, 0x2000

| || ||||   0x00001905    29f8           sub eax, edi

| || ||||   0x00001907    8944240c       mov dword [esp + 0xc], eax     ; [0xc:4]=0 ; 12

| || ||||   0x0000190b    8b55d8         mov edx, dword [ebp-local_10]

| || ||||   0x0000190e    89542408       mov dword [esp + 8], edx       ; [0x8:4]=0 ; 8

| || ||||   0x00001912    8b4ddc         mov ecx, dword [ebp-local_9]

| || ||||   0x00001915    894c2404       mov dword [esp + 4], ecx       ; [0x4:4]=0x10101  ; 4

| || ||||   0x00001919    8b4508         mov eax, dword [ebp + 8]       ; [0x8:4]=0 ; 8

| || ||||   0x0000191c    890424         mov dword [esp], eax

| || ||||   0x0000191f    e8c8f5ffff     call sym.imp.Perl_filter_read ;sym.imp.Perl_filter_read()

| || ||||   0x00001924    83f800         cmp eax, 0

| || ||||   0x00001927    89c6           mov esi, eax

| ========< 0x00001929    0f8ebc000000   jle 0x19eb                   

| || ||||   0x0000192f    01c7           add edi, eax

| || ||||   0x00001931    81ffff1f0000   cmp edi, 0x1fff

| ========< 0x00001937    7ec7           jle 0x1900                   

|           ; JMP XREF from 0x000019ef (fcn.000017d1)

| --------> 0x00001939    8b4dd8         mov ecx, dword [ebp-local_10]

| || ||||   0x0000193c    8b01           mov eax, dword [ecx]

| || ||||   0x0000193e    897804         mov dword [eax + 4], edi       ; [0x4:4]=0x10101  ; 4

| || ||||   ;-- hit0_7:

| || ||||   0x0000193f    7804           js 0x1945                    

| || ||||   0x00001941    8b01           mov eax, dword [ecx]

| || ||||   0x00001943    8b00           mov eax, dword [eax]

| || ||||   0x00001945    c6043800       mov byte [eax + edi], 0

| || ||||   0x00001949    8b45d0         mov eax, dword [ebp-local_12]

| || ||||   0x0000194c    8b55d0         mov edx, dword [ebp-local_12]

| || ||||   0x0000194f    8b4008         mov eax, dword [eax + 8]       ; [0x8:4]=0 ; 8

| || ||||   0x00001952    8945e0         mov dword [ebp-local_8], eax

| || ||||   0x00001955    8b832c020000   mov eax, dword [ebx + 0x22c]   ; [0x22c:4]=28 ; 556

| || ||||   0x0000195b    8b7a04         mov edi, dword [edx + 4]       ; [0x4:4]=0x10101  ; 4

| || ||||   0x0000195e    8d55f0         lea edx, [ebp-local_4]

| || ||||   0x00001961    89542404       mov dword [esp + 4], edx       ; [0x4:4]=0x10101  ; 4

| || ||||   0x00001965    8944240c       mov dword [esp + 0xc], eax     ; [0xc:4]=0 ; 12

| || ||||   0x00001969    8d45ec         lea eax, [ebp-local_5]

| || ||||   0x0000196c    89442408       mov dword [esp + 8], eax       ; [0x8:4]=0 ; 8

| || ||||   0x00001970    8b01           mov eax, dword [ecx]

| || ||||   0x00001972    8b00           mov eax, dword [eax]

| || ||||   0x00001974    890424         mov dword [esp], eax

| || ||||   0x00001977    e890f6ffff     call 0x100c ;0x0000100c() ; sym.imp.Perl_newXS+16

| || ||||   0x0000197c    85c0           test eax, eax

| ========< 0x0000197e    0f85aefeffff   jne 0x1832                   

| || ||||   0x00001984    8b4de0         mov ecx, dword [ebp-local_8]

| || ||||   0x00001987    8b45ec         mov eax, dword [ebp-local_5]

| || ||||   0x0000198a    8b11           mov edx, dword [ecx]

| || ||||   0x0000198c    83c001         add eax, 1

| || ||||   0x0000198f    394208         cmp dword [edx + 8], eax       ; [0x13:4]=256 ; 19

| ========< 0x00001992    0f828f000000   jb 0x1a27                    

| || ||||   0x00001998    8b02           mov eax, dword [edx]

| --------> 0x0000199a    8b7204         mov esi, dword [edx + 4]       ; [0x4:4]=0x10101  ; 4

| || ||||   0x0000199d    8b17           mov edx, dword [edi]

| || ||||   0x0000199f    01f0           add eax, esi

| || ||||   0x000019a1    8902           mov dword [edx], eax

| || ||||   0x000019a3    8b45ec         mov eax, dword [ebp-local_5]

| || ||||   0x000019a6    89442408       mov dword [esp + 8], eax       ; [0x8:4]=0 ; 8

| || ||||   0x000019aa    8b45f0         mov eax, dword [ebp-local_4]

| || ||||   0x000019ad    89442404       mov dword [esp + 4], eax       ; [0x4:4]=0x10101  ; 4

| || ||||   0x000019b1    8b07           mov eax, dword [edi]

| || ||||   0x000019b3    890424         mov dword [esp], eax

| || ||||   0x000019b6    e821f5ffff     call fcn.00000edc ;fcn.00000edc()

| || ||||   0x000019bb    8b07           mov eax, dword [edi]

| || ||||   0x000019bd    8b55e0         mov edx, dword [ebp-local_8]

| || ||||   0x000019c0    03b004010000   add esi, dword [eax + 0x104]

| || ||||   0x000019c6    8b02           mov eax, dword [edx]

| || ||||   0x000019c8    897004         mov dword [eax + 4], esi       ; [0x4:4]=0x10101  ; 4

| || ||||   0x000019cb    8b02           mov eax, dword [edx]

| || ||||   0x000019cd    8b00           mov eax, dword [eax]

| || ||||   0x000019cf    c6043000       mov byte [eax + esi], 0

| || ||||   0x000019d3    8b4dd8         mov ecx, dword [ebp-local_10]

| || ||||   0x000019d6    8b01           mov eax, dword [ecx]

| || ||||   0x000019d8    c74004000000.  mov dword [eax + 4], 0         ; [0x4:4]=0x10101  ; 4

| || ||||   0x000019df    8b01           mov eax, dword [ecx]

| || ||||   0x000019e1    8b00           mov eax, dword [eax]

| || ||||   0x000019e3    c60000         mov byte [eax], 0

| ========< 0x000019e6    e947feffff     jmp 0x1832                   

|           ; JMP XREF from 0x00001929 (fcn.000017d1)

| --------> 0x000019eb    7557           jne 0x1a44                   

|           ; JMP XREF from 0x00001a5d (fcn.000017d1)

| --------> 0x000019ed    85ff           test edi, edi

| ========< 0x000019ef    0f8f44ffffff   jg 0x1939                    

| || ||||   0x000019f5    85f6           test esi, esi

| ========< 0x000019f7    0f8554010000   jne 0x1b51                   

| || ||||   0x000019fd    8b55d0         mov edx, dword [ebp-local_12]

| || ||||   0x00001a00    8b4204         mov eax, dword [edx + 4]       ; [0x4:4]=0x10101  ; 4

| || ||||   0x00001a03    c6400801       mov byte [eax + 8], 1          ; [0x8:1]=0 ; 8

| || ||||   0x00001a07    c74210020000.  mov dword [edx + 0x10], 2      ; [0x10:4]=0x30003  ; 16

| ========< 0x00001a0e    e91ffeffff     jmp 0x1832                   

|           ; JMP XREF from 0x000018e8 (fcn.000017d1)

| --------> 0x00001a13    89442404       mov dword [esp + 4], eax       ; [0x4:4]=0x10101  ; 4

| || ||||   0x00001a17    8b4d08         mov ecx, dword [ebp + 8]       ; [0x8:4]=0 ; 8

| || ||||   0x00001a1a    890c24         mov dword [esp], ecx

| || ||||   0x00001a1d    e80af6ffff     call sym.imp.Perl_sv_backoff ;0x0000102c() ; sym.imp.Perl_sv_backoff

| ========< 0x00001a22    e9c7feffff     jmp 0x18ee                   

| --------> 0x00001a27    894c2404       mov dword [esp + 4], ecx       ; [0x4:4]=0x10101  ; 4

| || ||||   0x00001a2b    89442408       mov dword [esp + 8], eax       ; [0x8:4]=0 ; 8

| || ||||   0x00001a2f    8b4508         mov eax, dword [ebp + 8]       ; [0x8:4]=0 ; 8

| || ||||   0x00001a32    890424         mov dword [esp], eax

| || ||||   0x00001a35    e852f5ffff     call sym.imp.Perl_sv_grow ;0x00000f8c() ; sym.imp.Perl_sv_grow

| || ||||   0x00001a3a    8b4de0         mov ecx, dword [ebp-local_8]

| || ||||   0x00001a3d    8b11           mov edx, dword [ecx]

| ========< 0x00001a3f    e956ffffff     jmp 0x199a                   

|           ; JMP XREF from 0x000019eb (fcn.000017d1)

| --------> 0x00001a44    89442408       mov dword [esp + 8], eax       ; [0x8:4]=0 ; 8

| || ||||   0x00001a48    8d8360eeffff   lea eax, [ebx - 0x11a0]

| || ||||   0x00001a4e    89442404       mov dword [esp + 4], eax       ; [0x4:4]=0x10101  ; 4

| || ||||   0x00001a52    8b5508         mov edx, dword [ebp + 8]       ; [0x8:4]=0 ; 8

| || ||||   0x00001a55    891424         mov dword [esp], edx

| || ||||   0x00001a58    e8c3fcffff     call fcn.00001720 ;fcn.00001720()

| ========< 0x00001a5d    eb8e           jmp 0x19ed                   

|           ; JMP XREF from 0x000018c2 (fcn.000017d1)

| --------> 0x00001a5f    8b4d10         mov ecx, dword [ebp + 0x10]    ; [0x10:4]=0x30003  ; 16

| || ||||   0x00001a62    8b01           mov eax, dword [ecx]

| || ||||   0x00001a64    8b4004         mov eax, dword [eax + 4]       ; [0x4:4]=0x10101  ; 4

| || ||||   0x00001a67    85c0           test eax, eax

| ========< 0x00001a69    7507           jne 0x1a72                   

| || ||||   0x00001a6b    c74210020000.  mov dword [edx + 0x10], 2      ; [0x10:4]=0x30003  ; 16

|           ; JMP XREF from 0x00001a69 (fcn.000017d1)

| --------> 0x00001a72    83c43c         add esp, 0x3c

| || ||||   0x00001a75    5b             pop ebx

| || ||||   0x00001a76    5e             pop esi

| || ||||   0x00001a77    5f             pop edi

| || ||||   0x00001a78    5d             pop ebp

| || ||||   0x00001a79    c3             ret

| ||        ; JMP XREF from 0x00001848 (fcn.000017d1)

| |`------> 0x00001a7a    3b7514         cmp esi, dword [ebp + 0x14]    ; [0x14:4]=1 ; 20

| ========< 0x00001a7d    0f8fc6000000   jg 0x1b49                    

|           ; JMP XREF from 0x00001b4c (fcn.000017d1)

| --------> 0x00001a83    c74424100200.  mov dword [esp + 0x10], 2      ; [0x10:4]=0x30003  ; 16

| |  ||||   0x00001a8b    8974240c       mov dword [esp + 0xc], esi     ; [0xc:4]=0 ; 12

| |  ||||   0x00001a8f    897c2408       mov dword [esp + 8], edi       ; [0x8:4]=0 ; 8

| |  ||||   0x00001a93    8b4510         mov eax, dword [ebp + 0x10]    ; [0x10:4]=0x30003  ; 16

| |  ||||   0x00001a96    89442404       mov dword [esp + 4], eax       ; [0x4:4]=0x10101  ; 4

| |  ||||   0x00001a9a    8b5508         mov edx, dword [ebp + 8]       ; [0x8:4]=0 ; 8

| |  ||||   0x00001a9d    891424         mov dword [esp], edx

| |  ||||   0x00001aa0    e887f3ffff     call sym.imp.Perl_sv_catpvn_flags ;0x00000e2c() ; sym.imp.Perl_sv_catpvn_flags

| |  ||||   0x00001aa5    8d0437         lea eax, [edi + esi]

| |  ||||   0x00001aa8    89442408       mov dword [esp + 8], eax       ; [0x8:4]=0 ; 8

|           ; JMP XREF from 0x00001aff (fcn.000017d1)

| --------> 0x00001aac    8b4dd0         mov ecx, dword [ebp-local_12]

| |  ||||   0x00001aaf    8b4108         mov eax, dword [ecx + 8]       ; [0x8:4]=0 ; 8

| |  ||||   0x00001ab2    89442404       mov dword [esp + 4], eax       ; [0x4:4]=0x10101  ; 4

| |  ||||   0x00001ab6    8b4508         mov eax, dword [ebp + 8]       ; [0x8:4]=0 ; 8

| |  ||||   0x00001ab9    890424         mov dword [esp], eax

| |  ||||   0x00001abc    e89bf2ffff     call sym.imp.Perl_sv_chop      ; fcn.00000d58+0x4 ;fcn.00000d58() ; sym.imp.Perl_sv_chop

| |  ||||   0x00001ac1    8b5510         mov edx, dword [ebp + 0x10]    ; [0x10:4]=0x30003  ; 16

| |  ||||   0x00001ac4    8b02           mov eax, dword [edx]

| |  ||||   0x00001ac6    8b4004         mov eax, dword [eax + 4]       ; [0x4:4]=0x10101  ; 4

| |  ||||   0x00001ac9    83c43c         add esp, 0x3c

| |  ||||   0x00001acc    5b             pop ebx

| |  ||||   0x00001acd    5e             pop esi

| |  ||||   0x00001ace    5f             pop edi

| |  ||||   0x00001acf    5d             pop ebp

| |  ||||   0x00001ad0    c3             ret

| |         ; JMP XREF from 0x00001877 (fcn.000017d1)

| `-------> 0x00001ad1    8d7001         lea esi, [eax + 1]             ; 0x1  ; 1

|    ||||   0x00001ad4    29fe           sub esi, edi

|    ||||   0x00001ad6    8974240c       mov dword [esp + 0xc], esi     ; [0xc:4]=0 ; 12

|    ||||   0x00001ada    8d3437         lea esi, [edi + esi]

|    ||||   0x00001add    c74424100200.  mov dword [esp + 0x10], 2      ; [0x10:4]=0x30003  ; 16

|    ||||   0x00001ae5    897c2408       mov dword [esp + 8], edi       ; [0x8:4]=0 ; 8

|    ||||   0x00001ae9    8b4510         mov eax, dword [ebp + 0x10]    ; [0x10:4]=0x30003  ; 16

|    ||||   0x00001aec    89442404       mov dword [esp + 4], eax       ; [0x4:4]=0x10101  ; 4

|    ||||   0x00001af0    8b5508         mov edx, dword [ebp + 8]       ; [0x8:4]=0 ; 8

|    ||||   0x00001af3    891424         mov dword [esp], edx

|    ||||   0x00001af6    e831f3ffff     call sym.imp.Perl_sv_catpvn_flags ;0x00000e2c() ; sym.imp.Perl_sv_catpvn_flags

|    ||||   0x00001afb    89742408       mov dword [esp + 8], esi       ; [0x8:4]=0 ; 8

| ========< 0x00001aff    ebab           jmp 0x1aac                   

|    |      ; JMP XREF from 0x00001823 (fcn.000017d1)

|    `----> 0x00001b01    8b4d08         mov ecx, dword [ebp + 8]       ; [0x8:4]=0 ; 8

|     |||   0x00001b04    890c24         mov dword [esp], ecx

|     |||   0x00001b07    e860f2ffff     call sym.imp.Perl_Irsfp_filters_ptr ;sym.imp.Perl_Irsfp_filters_ptr()

|     |||   0x00001b0c    31d2           xor edx, edx

|     |||   0x00001b0e    8b08           mov ecx, dword [eax]

|     |||   0x00001b10    85c9           test ecx, ecx

| ========< 0x00001b12    741e           je 0x1b32                    

|     |||   0x00001b14    8b4508         mov eax, dword [ebp + 8]       ; [0x8:4]=0 ; 8

|     |||   0x00001b17    890424         mov dword [esp], eax

|     |||   0x00001b1a    e84df2ffff     call sym.imp.Perl_Irsfp_filters_ptr ;sym.imp.Perl_Irsfp_filters_ptr()

|     |||   0x00001b1f    8b00           mov eax, dword [eax]

|     |||   0x00001b21    89442404       mov dword [esp + 4], eax       ; [0x4:4]=0x10101  ; 4

|     |||   0x00001b25    8b5508         mov edx, dword [ebp + 8]       ; [0x8:4]=0 ; 8

|     |||   0x00001b28    891424         mov dword [esp], edx

|     |||   0x00001b2b    e86cf2ffff     call sym.imp.Perl_av_len ;0x00000d9c() ; sym.imp.Perl_av_len

|     |||   0x00001b30    89c2           mov edx, eax

|           ; JMP XREF from 0x00001b12 (fcn.000017d1)

| --------> 0x00001b32    8b4dd0         mov ecx, dword [ebp-local_12]

|     |||   0x00001b35    3b510c         cmp edx, dword [ecx + 0xc]     ; [0xc:4]=0 ; 12

| ========< 0x00001b38    7f1a           jg 0x1b54                    

|     |||   0x00001b3a    8b45d0         mov eax, dword [ebp-local_12]

|     |||   0x00001b3d    c74010010000.  mov dword [eax + 0x10], 1      ; [0x10:4]=0x30003  ; 16

| ========< 0x00001b44    e9e0fcffff     jmp 0x1829                   

|           ; JMP XREF from 0x00001a7d (fcn.000017d1)

| --------> 0x00001b49    8b7514         mov esi, dword [ebp + 0x14]    ; [0x14:4]=1 ; 20

| ========< 0x00001b4c    e932ffffff     jmp 0x1a83                   

|           ; JMP XREF from 0x000019f7 (fcn.000017d1)

| --------> 0x00001b51    8b4dd0         mov ecx, dword [ebp-local_12]

|           ; JMP XREF from 0x00001b38 (fcn.000017d1)

| --------> 0x00001b54    c74110020000.  mov dword [ecx + 0x10], 2      ; [0x10:4]=0x30003  ; 16

|     |||   0x00001b5b    8d832eeeffff   lea eax, [ebx - 0x11d2]

|     |||   0x00001b61    890424         mov dword [esp], eax

|     |||   0x00001b64    e813f4ffff     call sym.imp.Perl_croak_nocontext ;sym.imp.Perl_croak_nocontext()

|     |     ; JMP XREF from 0x00001815 (fcn.000017d1)

|     `---> 0x00001b69    8d83c0deffff   lea eax, [ebx - 0x2140]

|      ||   0x00001b6f    89442404       mov dword [esp + 4], eax       ; [0x4:4]=0x10101  ; 4

|      ||   0x00001b73    8b4d08         mov ecx, dword [ebp + 8]       ; [0x8:4]=0 ; 8

|      ||   0x00001b76    890c24         mov dword [esp], ecx

|      ||   0x00001b79    e83ef2ffff     call sym.imp.Perl_filter_del ;sym.imp.Perl_filter_del()

|      ||   0x00001b7e    8b45d0         mov eax, dword [ebp-local_12]

|      ||   0x00001b81    c74010020000.  mov dword [eax + 0x10], 2      ; [0x10:4]=0x30003  ; 16

|      ||   0x00001b88    8d832eeeffff   lea eax, [ebx - 0x11d2]

|      ||   0x00001b8e    890424         mov dword [esp], eax

|      ||   0x00001b91    e8e6f3ffff     call sym.imp.Perl_croak_nocontext ;sym.imp.Perl_croak_nocontext()

|      |    ; JMP XREF from 0x0000180a (fcn.000017d1)

|      `--> 0x00001b96    8d83c0deffff   lea eax, [ebx - 0x2140]

|       |   0x00001b9c    89442404       mov dword [esp + 4], eax       ; [0x4:4]=0x10101  ; 4

|       |   0x00001ba0    8b4d08         mov ecx, dword [ebp + 8]       ; [0x8:4]=0 ; 8

|       |   0x00001ba3    890c24         mov dword [esp], ecx

|       |   0x00001ba6    e811f2ffff     call sym.imp.Perl_filter_del ;sym.imp.Perl_filter_del()

|       |   0x00001bab    8d832eeeffff   lea eax, [ebx - 0x11d2]

|       |   0x00001bb1    890424         mov dword [esp], eax

|       |   0x00001bb4    e8c3f3ffff     call sym.imp.Perl_croak_nocontext ;sym.imp.Perl_croak_nocontext()

|       |   ; JMP XREF from 0x000017fc (fcn.000017d1)

|       `-> 0x00001bb9    8d83c0deffff   lea eax, [ebx - 0x2140]

|           0x00001bbf    89442404       mov dword [esp + 4], eax       ; [0x4:4]=0x10101  ; 4

|           0x00001bc3    8b4508         mov eax, dword [ebp + 8]       ; [0x8:4]=0 ; 8

|           0x00001bc6    890424         mov dword [esp], eax

|           0x00001bc9    e8eef1ffff     call sym.imp.Perl_filter_del ;sym.imp.Perl_filter_del()

|           0x00001bce    8d832eeeffff   lea eax, [ebx - 0x11d2]

|           0x00001bd4    890424         mov dword [esp], eax

|           0x00001bd7    e8a0f3ffff     call sym.imp.Perl_croak_nocontext ;sym.imp.Perl_croak_nocontext()

|           0x00001bdc    8d742600       lea esi, [esi]

|           ;-- sym.XS_Sibsoft__Filter_DESTROY:

|           0x00001be0    55             push ebp

|           0x00001be1    89e5           mov ebp, esp

|           0x00001be3    83ec18         sub esp, 0x18

|           0x00001be6    895df4         mov dword [ebp-local_3], ebx

|           0x00001be9    e8f9f4ffff     call fcn.000010e7 ;fcn.000010e7()

|           0x00001bee    81c3d21c0000   add ebx, 0x1cd2

|           0x00001bf4    897dfc         mov dword [ebp-local_1], edi

|           0x00001bf7    8b7d08         mov edi, dword [ebp + 8]       ; [0x8:4]=0 ; 8

|           0x00001bfa    8975f8         mov dword [ebp-local_2], esi

|           0x00001bfd    893c24         mov dword [esp], edi

|           0x00001c00    e857f2ffff     call sym.imp.Perl_Tstack_sp_ptr ;sym.imp.Perl_Tstack_sp_ptr()

|           0x00001c05    8b00           mov eax, dword [eax]

|           0x00001c07    893c24         mov dword [esp], edi

|           0x00001c0a    8945f0         mov dword [ebp-local_4], eax

|           0x00001c0d    e80af3ffff     call sym.imp.Perl_Tmarkstack_ptr_ptr ;0x00000f1c() ; sym.imp.Perl_Tmarkstack_ptr_ptr

|           0x00001c12    8b10           mov edx, dword [eax]

|           0x00001c14    8b32           mov esi, dword [edx]

|           0x00001c16    83ea04         sub edx, 4

|           0x00001c19    8910           mov dword [eax], edx

|           0x00001c1b    893c24         mov dword [esp], edi

|           0x00001c1e    e8a9f1ffff     call sym.imp.Perl_Tstack_base_ptr ;sym.imp.Perl_Tstack_base_ptr()

|           0x00001c23    c1e602         shl esi, 2

|           0x00001c26    0330           add esi, dword [eax]

|           0x00001c28    8b45f0         mov eax, dword [ebp-local_4]

|           0x00001c2b    29f0           sub eax, esi

|           0x00001c2d    c1f802         sar eax, 2

|           0x00001c30    83e801         sub eax, 1

| ========< 0x00001c33    7533           jne 0x1c68                   

|           0x00001c35    893c24         mov dword [esp], edi

|           0x00001c38    e88ff1ffff     call sym.imp.Perl_Tstack_base_ptr ;sym.imp.Perl_Tstack_base_ptr()

|           0x00001c3d    8b8328020000   mov eax, dword [ebx + 0x228]   ; [0x228:4]=22 ; 552

|           0x00001c43    890424         mov dword [esp], eax

|           0x00001c46    e8a1f3ffff     call sym.imp.Perl_safesysfree ;0x00000fec() ; sym.imp.Perl_safesysfree

|           0x00001c4b    893c24         mov dword [esp], edi

|           0x00001c4e    e809f2ffff     call sym.imp.Perl_Tstack_sp_ptr ;sym.imp.Perl_Tstack_sp_ptr()

|           0x00001c53    8b55f0         mov edx, dword [ebp-local_4]

|           0x00001c56    83ea04         sub edx, 4

|           0x00001c59    8910           mov dword [eax], edx

|           0x00001c5b    8b5df4         mov ebx, dword [ebp-local_3]

|           0x00001c5e    8b75f8         mov esi, dword [ebp-local_2]

|           0x00001c61    8b7dfc         mov edi, dword [ebp-local_1]

|           0x00001c64    89ec           mov esp, ebp

|           0x00001c66    5d             pop ebp

|           0x00001c67    c3             ret

|           ; JMP XREF from 0x00001c33 (fcn.000017d1)

| --------> 0x00001c68    8d8384eeffff   lea eax, [ebx - 0x117c]

|           0x00001c6e    89442404       mov dword [esp + 4], eax       ; [0x4:4]=0x10101  ; 4

|           0x00001c72    893c24         mov dword [esp], edi

|           0x00001c75    e862f3ffff     call sym.imp.Perl_croak ;0x00000fdc() ; sym.imp.Perl_croak

|           0x00001c7a    8db600000000   lea esi, [esi]

|           ; CALL XREF from 0x00001f8d (fcn.00001cd5)

|           ; CALL XREF from 0x00001fc3 (fcn.00001cd5)

|           0x00001c80    55             push ebp

|           0x00001c81    89e5           mov ebp, esp

|           0x00001c83    83ec18         sub esp, 0x18

|           0x00001c86    895df4         mov dword [ebp-local_3], ebx

|           0x00001c89    e859f4ffff     call fcn.000010e7 ;fcn.000010e7()

|           0x00001c8e    81c3321c0000   add ebx, 0x1c32

|           0x00001c94    8975f8         mov dword [ebp-local_2], esi

|           0x00001c97    897dfc         mov dword [ebp-local_1], edi

|           0x00001c9a    89d7           mov edi, edx

|           0x00001c9c    8b5208         mov edx, dword [edx + 8]       ; [0x8:4]=0 ; 8

|           0x00001c9f    890424         mov dword [esp], eax

|           0x00001ca2    89542404       mov dword [esp + 4], edx       ; [0x4:4]=0x10101  ; 4

|           0x00001ca6    e8e1f0ffff     call sym.imp.Perl_sv_free ;sym.imp.Perl_sv_free()

|           0x00001cab    8b7704         mov esi, dword [edi + 4]       ; [0x4:4]=0x10101  ; 4

|           0x00001cae    8b06           mov eax, dword [esi]

|           0x00001cb0    890424         mov dword [esp], eax

|           0x00001cb3    e834f3ffff     call sym.imp.Perl_safesysfree ;0x00000fec() ; sym.imp.Perl_safesysfree

|           0x00001cb8    893424         mov dword [esp], esi

|           0x00001cbb    e82cf3ffff     call sym.imp.Perl_safesysfree ;0x00000fec() ; sym.imp.Perl_safesysfree

|           0x00001cc0    893c24         mov dword [esp], edi

|           0x00001cc3    e824f3ffff     call sym.imp.Perl_safesysfree ;0x00000fec() ; sym.imp.Perl_safesysfree

|           0x00001cc8    8b5df4         mov ebx, dword [ebp-local_3]

|           0x00001ccb    8b75f8         mov esi, dword [ebp-local_2]

|           0x00001cce    8b7dfc         mov edi, dword [ebp-local_1]

|           0x00001cd1    89ec           mov esp, ebp

|           0x00001cd3    5d             pop ebp

\           0x00001cd4    c3             ret

***el matadoor*** · 08-02-2015, 09:08 AM

(08-02-2015 06:16 AM)JustSomeDude Wrote: Well I will give you guys a hint. If you want to take a crack at reversing the encoding algorithm use the offsets and code below:

Code:

/ (fcn) fcn.00001780 81 | ; arg int arg_2 @ ebp+0x8 | ; arg int arg_3 @ ebp+0xc | ; var int local_10 @ ebp-0x28 | ;-- fcn.00001780: | 0x00001780 55 push ebp | 0x00001781 89e5 mov ebp, esp | 0x00001783 57 push edi | 0x00001784 56 push esi | 0x00001785 53 push ebx | 0x00001786 e85cf9ffff call fcn.000010e7 ;fcn.000010e7(unk, unk, unk, unk) | 0x0000178b 81c335210000 add ebx, 0x2135 | 0x00001791 83ec3c sub esp, 0x3c | 0x00001794 8b4508 mov eax, dword [ebp + 8] ; [0x8:4]=0 ; 8 | 0x00001797 890424 mov dword [esp], eax | 0x0000179a e8cdf5ffff call sym.imp.Perl_Irsfp_filters_ptr ;sym.imp.Perl_Irsfp_filters_ptr() | 0x0000179f 8b550c mov edx, dword [ebp + 0xc] ; [0xc:4]=0 ; 12 | 0x000017a2 8b00 mov eax, dword [eax] | 0x000017a4 8b00 mov eax, dword [eax] | 0x000017a6 8b00 mov eax, dword [eax] | 0x000017a8 8b3490 mov esi, dword [eax + edx*4] | 0x000017ab c74424040020. mov dword [esp + 4], 0x2000 ; [0x2000:4]=0 | 0x000017b3 8b4d08 mov ecx, dword [ebp + 8] ; [0x8:4]=0 ; 8 | 0x000017b6 890c24 mov dword [esp], ecx | 0x000017b9 e87ef7ffff call sym.imp.Perl_newSV ;sym.imp.Perl_newSV() | 0x000017be 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101 ; 4 | 0x000017c2 8b4508 mov eax, dword [ebp + 8] ; [0x8:4]=0 ; 8 | 0x000017c5 890424 mov dword [esp], eax | 0x000017c8 e87ff6ffff call sym.imp.Perl_sv_2mortal ;sym.imp.Perl_sv_2mortal() | 0x000017cd 8945d8 mov dword [ebp-local_10], eax \ 0x000017d0 cc int3 / (fcn) fcn.000017d1 1284 | ; arg int arg_2 @ ebp+0x8 | ; arg int arg_3 @ ebp+0xc | ; arg int arg_4 @ ebp+0x10 | ; arg int arg_5 @ ebp+0x14 | ; var int local_1 @ ebp-0x4 | ; var int local_2 @ ebp-0x8 | ; var int local_3 @ ebp-0xc | ; var int local_4 @ ebp-0x10 | ; var int local_5 @ ebp-0x14 | ; var int local_8 @ ebp-0x20 | ; var int local_9 @ ebp-0x24 | ; var int local_10 @ ebp-0x28 | ; var int local_11 @ ebp-0x2c | ; var int local_12 @ ebp-0x30 | ; var int local_13 @ ebp-0x34 | 0x000017d1 89c2 mov edx, eax | 0x000017d3 8b4008 mov eax, dword [eax + 8] ; [0x8:4]=0 ; 8 | 0x000017d6 25fffff048 and eax, 0x48f0ffff | 0x000017db 0d00000404 or eax, 0x4040000 | 0x000017e0 894208 mov dword [edx + 8], eax ; [0x8:4]=0 ; 8 | 0x000017e3 c74424087e00. mov dword [esp + 8], 0x7e ; [0x7e:4]=0x37d40000 ; '~' ; 126 | 0x000017eb 89742404 mov dword [esp + 4], esi ; [0x4:4]=0x10101 ; 4 | 0x000017ef 8b4d08 mov ecx, dword [ebp + 8] ; [0x8:4]=0 ; 8 | 0x000017f2 890c24 mov dword [esp], ecx | 0x000017f5 e872f7ffff call sym.imp.Perl_mg_find ;sym.imp.Perl_mg_find() | 0x000017fa 85c0 test eax, eax | ,=< 0x000017fc 0f84b7030000 je 0x1bb9 | | 0x00001802 8b5010 mov edx, dword [eax + 0x10] ; [0x10:4]=0x30003 ; 16 | | 0x00001805 85d2 test edx, edx | | 0x00001807 8955d0 mov dword [ebp-local_12], edx | ,==< 0x0000180a 0f8486030000 je 0x1b96 | || 0x00001810 8b55d0 mov edx, dword [ebp-local_12] | || 0x00001813 3b02 cmp eax, dword [edx] | ,===< 0x00001815 0f854e030000 jne 0x1b69 | ||| 0x0000181b 8b55d0 mov edx, dword [ebp-local_12] | ||| 0x0000181e 8b7210 mov esi, dword [edx + 0x10] ; [0x10:4]=0x30003 ; 16 | ||| 0x00001821 85f6 test esi, esi | ,====< 0x00001823 0f84d8020000 je 0x1b01 | ; JMP XREF from 0x00001b44 (fcn.000017d1) | --------> 0x00001829 8d932eeeffff lea edx, [ebx - 0x11d2] | |||| 0x0000182f 8955cc mov dword [ebp-local_13], edx | ; JMP XREF from 0x0000197e (fcn.000017d1) | --------> 0x00001832 8b4dd0 mov ecx, dword [ebp-local_12] | |||| 0x00001835 8b4108 mov eax, dword [ecx + 8] ; [0x8:4]=0 ; 8 | |||| 0x00001838 8b00 mov eax, dword [eax] | |||| 0x0000183a 8b7004 mov esi, dword [eax + 4] ; [0x4:4]=0x10101 ; 4 | |||| 0x0000183d 85f6 test esi, esi | ,=====< 0x0000183f 7e7a jle 0x18bb | ||||| 0x00001841 8b5514 mov edx, dword [ebp + 0x14] ; [0x14:4]=1 ; 20 | ||||| 0x00001844 8b38 mov edi, dword [eax] | ||||| 0x00001846 85d2 test edx, edx | ,======< 0x00001848 0f852c020000 jne 0x1a7a | |||||| 0x0000184e 8b45cc mov eax, dword [ebp-local_13] | |||||| 0x00001851 8d0c37 lea ecx, [edi + esi] | |||||| 0x00001854 894dd4 mov dword [ebp-local_11], ecx | |||||| 0x00001857 894c2408 mov dword [esp + 8], ecx ; [0x8:4]=0 ; 8 | |||||| 0x0000185b 897c2404 mov dword [esp + 4], edi ; [0x4:4]=0x10101 ; 4 | |||||| 0x0000185f 89442410 mov dword [esp + 0x10], eax ; [0x10:4]=0x30003 ; 16 | |||||| 0x00001863 8d40ff lea eax, [eax - 1] | |||||| 0x00001866 8944240c mov dword [esp + 0xc], eax ; [0xc:4]=0 ; 12 | |||||| 0x0000186a 8b4d08 mov ecx, dword [ebp + 8] ; [0x8:4]=0 ; 8 | |||||| 0x0000186d 890c24 mov dword [esp], ecx | |||||| 0x00001870 e817f6ffff call sym.imp.Perl_ninstr ;sym.imp.Perl_ninstr() | |||||| 0x00001875 85c0 test eax, eax | ,=======< 0x00001877 0f8554020000 jne 0x1ad1 | ||||||| 0x0000187d c74424100200. mov dword [esp + 0x10], 2 ; [0x10:4]=0x30003 ; 16 | ||||||| 0x00001885 8974240c mov dword [esp + 0xc], esi ; [0xc:4]=0 ; 12 | ||||||| 0x00001889 897c2408 mov dword [esp + 8], edi ; [0x8:4]=0 ; 8 | ||||||| 0x0000188d 8b4d10 mov ecx, dword [ebp + 0x10] ; [0x10:4]=0x30003 ; 16 | ||||||| 0x00001890 894c2404 mov dword [esp + 4], ecx ; [0x4:4]=0x10101 ; 4 | ||||||| 0x00001894 8b4508 mov eax, dword [ebp + 8] ; [0x8:4]=0 ; 8 | ||||||| 0x00001897 890424 mov dword [esp], eax | ||||||| 0x0000189a e88df5ffff call sym.imp.Perl_sv_catpvn_flags ;0x00000e2c() ; sym.imp.Perl_sv_catpvn_flags | ||||||| 0x0000189f 8b55d4 mov edx, dword [ebp-local_11] | ||||||| 0x000018a2 89542408 mov dword [esp + 8], edx ; [0x8:4]=0 ; 8 | ||||||| 0x000018a6 8b4dd0 mov ecx, dword [ebp-local_12] | ||||||| 0x000018a9 8b4108 mov eax, dword [ecx + 8] ; [0x8:4]=0 ; 8 | ||||||| 0x000018ac 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101 ; 4 | ||||||| 0x000018b0 8b4508 mov eax, dword [ebp + 8] ; [0x8:4]=0 ; 8 | ||||||| 0x000018b3 890424 mov dword [esp], eax | ||||||| 0x000018b6 e8a1f4ffff call sym.imp.Perl_sv_chop ; fcn.00000d58+0x4 ;fcn.00000d58() ; sym.imp.Perl_sv_chop | ||| ; JMP XREF from 0x0000183f (fcn.000017d1) | ||`-----> 0x000018bb 8b55d0 mov edx, dword [ebp-local_12] | || |||| 0x000018be 837a1002 cmp dword [edx + 0x10], 2 ; [0x2:4]=0x101464c ; 2 | ========< 0x000018c2 0f8497010000 je 0x1a5f | || |||| 0x000018c8 8b55d0 mov edx, dword [ebp-local_12] | || |||| 0x000018cb 8b4208 mov eax, dword [edx + 8] ; [0x8:4]=0 ; 8 | || |||| 0x000018ce 8b00 mov eax, dword [eax] | || |||| 0x000018d0 c74004000000. mov dword [eax + 4], 0 ; [0x4:4]=0x10101 ; 4 | || |||| 0x000018d7 8b4208 mov eax, dword [edx + 8] ; [0x8:4]=0 ; 8 | || |||| 0x000018da 8b00 mov eax, dword [eax] | || |||| 0x000018dc 8b00 mov eax, dword [eax] | || |||| 0x000018de c60000 mov byte [eax], 0 | || |||| 0x000018e1 8b4208 mov eax, dword [edx + 8] ; [0x8:4]=0 ; 8 | || |||| 0x000018e4 f6400a20 test byte [eax + 0xa], 0x20 ; [0x20:1]=248 ; 32 | ========< 0x000018e8 0f8525010000 jne 0x1a13 | ; JMP XREF from 0x00001a22 (fcn.000017d1) | --------> 0x000018ee 8b450c mov eax, dword [ebp + 0xc] ; [0xc:4]=0 ; 12 | || |||| 0x000018f1 31ff xor edi, edi | || |||| 0x000018f3 83c001 add eax, 1 | || |||| 0x000018f6 8945dc mov dword [ebp-local_9], eax | || |||| 0x000018f9 8db426000000. lea esi, [esi] | ; JMP XREF from 0x00001937 (fcn.000017d1) | --------> 0x00001900 b800200000 mov eax, 0x2000 | || |||| 0x00001905 29f8 sub eax, edi | || |||| 0x00001907 8944240c mov dword [esp + 0xc], eax ; [0xc:4]=0 ; 12 | || |||| 0x0000190b 8b55d8 mov edx, dword [ebp-local_10] | || |||| 0x0000190e 89542408 mov dword [esp + 8], edx ; [0x8:4]=0 ; 8 | || |||| 0x00001912 8b4ddc mov ecx, dword [ebp-local_9] | || |||| 0x00001915 894c2404 mov dword [esp + 4], ecx ; [0x4:4]=0x10101 ; 4 | || |||| 0x00001919 8b4508 mov eax, dword [ebp + 8] ; [0x8:4]=0 ; 8 | || |||| 0x0000191c 890424 mov dword [esp], eax | || |||| 0x0000191f e8c8f5ffff call sym.imp.Perl_filter_read ;sym.imp.Perl_filter_read() | || |||| 0x00001924 83f800 cmp eax, 0 | || |||| 0x00001927 89c6 mov esi, eax | ========< 0x00001929 0f8ebc000000 jle 0x19eb | || |||| 0x0000192f 01c7 add edi, eax | || |||| 0x00001931 81ffff1f0000 cmp edi, 0x1fff | ========< 0x00001937 7ec7 jle 0x1900 | ; JMP XREF from 0x000019ef (fcn.000017d1) | --------> 0x00001939 8b4dd8 mov ecx, dword [ebp-local_10] | || |||| 0x0000193c 8b01 mov eax, dword [ecx] | || |||| 0x0000193e 897804 mov dword [eax + 4], edi ; [0x4:4]=0x10101 ; 4 | || |||| ;-- hit0_7: | || |||| 0x0000193f 7804 js 0x1945 | || |||| 0x00001941 8b01 mov eax, dword [ecx] | || |||| 0x00001943 8b00 mov eax, dword [eax] | || |||| 0x00001945 c6043800 mov byte [eax + edi], 0 | || |||| 0x00001949 8b45d0 mov eax, dword [ebp-local_12] | || |||| 0x0000194c 8b55d0 mov edx, dword [ebp-local_12] | || |||| 0x0000194f 8b4008 mov eax, dword [eax + 8] ; [0x8:4]=0 ; 8 | || |||| 0x00001952 8945e0 mov dword [ebp-local_8], eax | || |||| 0x00001955 8b832c020000 mov eax, dword [ebx + 0x22c] ; [0x22c:4]=28 ; 556 | || |||| 0x0000195b 8b7a04 mov edi, dword [edx + 4] ; [0x4:4]=0x10101 ; 4 | || |||| 0x0000195e 8d55f0 lea edx, [ebp-local_4] | || |||| 0x00001961 89542404 mov dword [esp + 4], edx ; [0x4:4]=0x10101 ; 4 | || |||| 0x00001965 8944240c mov dword [esp + 0xc], eax ; [0xc:4]=0 ; 12 | || |||| 0x00001969 8d45ec lea eax, [ebp-local_5] | || |||| 0x0000196c 89442408 mov dword [esp + 8], eax ; [0x8:4]=0 ; 8 | || |||| 0x00001970 8b01 mov eax, dword [ecx] | || |||| 0x00001972 8b00 mov eax, dword [eax] | || |||| 0x00001974 890424 mov dword [esp], eax | || |||| 0x00001977 e890f6ffff call 0x100c ;0x0000100c() ; sym.imp.Perl_newXS+16 | || |||| 0x0000197c 85c0 test eax, eax | ========< 0x0000197e 0f85aefeffff jne 0x1832 | || |||| 0x00001984 8b4de0 mov ecx, dword [ebp-local_8] | || |||| 0x00001987 8b45ec mov eax, dword [ebp-local_5] | || |||| 0x0000198a 8b11 mov edx, dword [ecx] | || |||| 0x0000198c 83c001 add eax, 1 | || |||| 0x0000198f 394208 cmp dword [edx + 8], eax ; [0x13:4]=256 ; 19 | ========< 0x00001992 0f828f000000 jb 0x1a27 | || |||| 0x00001998 8b02 mov eax, dword [edx] | --------> 0x0000199a 8b7204 mov esi, dword [edx + 4] ; [0x4:4]=0x10101 ; 4 | || |||| 0x0000199d 8b17 mov edx, dword [edi] | || |||| 0x0000199f 01f0 add eax, esi | || |||| 0x000019a1 8902 mov dword [edx], eax | || |||| 0x000019a3 8b45ec mov eax, dword [ebp-local_5] | || |||| 0x000019a6 89442408 mov dword [esp + 8], eax ; [0x8:4]=0 ; 8 | || |||| 0x000019aa 8b45f0 mov eax, dword [ebp-local_4] | || |||| 0x000019ad 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101 ; 4 | || |||| 0x000019b1 8b07 mov eax, dword [edi] | || |||| 0x000019b3 890424 mov dword [esp], eax | || |||| 0x000019b6 e821f5ffff call fcn.00000edc ;fcn.00000edc() | || |||| 0x000019bb 8b07 mov eax, dword [edi] | || |||| 0x000019bd 8b55e0 mov edx, dword [ebp-local_8] | || |||| 0x000019c0 03b004010000 add esi, dword [eax + 0x104] | || |||| 0x000019c6 8b02 mov eax, dword [edx] | || |||| 0x000019c8 897004 mov dword [eax + 4], esi ; [0x4:4]=0x10101 ; 4 | || |||| 0x000019cb 8b02 mov eax, dword [edx] | || |||| 0x000019cd 8b00 mov eax, dword [eax] | || |||| 0x000019cf c6043000 mov byte [eax + esi], 0 | || |||| 0x000019d3 8b4dd8 mov ecx, dword [ebp-local_10] | || |||| 0x000019d6 8b01 mov eax, dword [ecx] | || |||| 0x000019d8 c74004000000. mov dword [eax + 4], 0 ; [0x4:4]=0x10101 ; 4 | || |||| 0x000019df 8b01 mov eax, dword [ecx] | || |||| 0x000019e1 8b00 mov eax, dword [eax] | || |||| 0x000019e3 c60000 mov byte [eax], 0 | ========< 0x000019e6 e947feffff jmp 0x1832 | ; JMP XREF from 0x00001929 (fcn.000017d1) | --------> 0x000019eb 7557 jne 0x1a44 | ; JMP XREF from 0x00001a5d (fcn.000017d1) | --------> 0x000019ed 85ff test edi, edi | ========< 0x000019ef 0f8f44ffffff jg 0x1939 | || |||| 0x000019f5 85f6 test esi, esi | ========< 0x000019f7 0f8554010000 jne 0x1b51 | || |||| 0x000019fd 8b55d0 mov edx, dword [ebp-local_12] | || |||| 0x00001a00 8b4204 mov eax, dword [edx + 4] ; [0x4:4]=0x10101 ; 4 | || |||| 0x00001a03 c6400801 mov byte [eax + 8], 1 ; [0x8:1]=0 ; 8 | || |||| 0x00001a07 c74210020000. mov dword [edx + 0x10], 2 ; [0x10:4]=0x30003 ; 16 | ========< 0x00001a0e e91ffeffff jmp 0x1832 | ; JMP XREF from 0x000018e8 (fcn.000017d1) | --------> 0x00001a13 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101 ; 4 | || |||| 0x00001a17 8b4d08 mov ecx, dword [ebp + 8] ; [0x8:4]=0 ; 8 | || |||| 0x00001a1a 890c24 mov dword [esp], ecx | || |||| 0x00001a1d e80af6ffff call sym.imp.Perl_sv_backoff ;0x0000102c() ; sym.imp.Perl_sv_backoff | ========< 0x00001a22 e9c7feffff jmp 0x18ee | --------> 0x00001a27 894c2404 mov dword [esp + 4], ecx ; [0x4:4]=0x10101 ; 4 | || |||| 0x00001a2b 89442408 mov dword [esp + 8], eax ; [0x8:4]=0 ; 8 | || |||| 0x00001a2f 8b4508 mov eax, dword [ebp + 8] ; [0x8:4]=0 ; 8 | || |||| 0x00001a32 890424 mov dword [esp], eax | || |||| 0x00001a35 e852f5ffff call sym.imp.Perl_sv_grow ;0x00000f8c() ; sym.imp.Perl_sv_grow | || |||| 0x00001a3a 8b4de0 mov ecx, dword [ebp-local_8] | || |||| 0x00001a3d 8b11 mov edx, dword [ecx] | ========< 0x00001a3f e956ffffff jmp 0x199a | ; JMP XREF from 0x000019eb (fcn.000017d1) | --------> 0x00001a44 89442408 mov dword [esp + 8], eax ; [0x8:4]=0 ; 8 | || |||| 0x00001a48 8d8360eeffff lea eax, [ebx - 0x11a0] | || |||| 0x00001a4e 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101 ; 4 | || |||| 0x00001a52 8b5508 mov edx, dword [ebp + 8] ; [0x8:4]=0 ; 8 | || |||| 0x00001a55 891424 mov dword [esp], edx | || |||| 0x00001a58 e8c3fcffff call fcn.00001720 ;fcn.00001720() | ========< 0x00001a5d eb8e jmp 0x19ed | ; JMP XREF from 0x000018c2 (fcn.000017d1) | --------> 0x00001a5f 8b4d10 mov ecx, dword [ebp + 0x10] ; [0x10:4]=0x30003 ; 16 | || |||| 0x00001a62 8b01 mov eax, dword [ecx] | || |||| 0x00001a64 8b4004 mov eax, dword [eax + 4] ; [0x4:4]=0x10101 ; 4 | || |||| 0x00001a67 85c0 test eax, eax | ========< 0x00001a69 7507 jne 0x1a72 | || |||| 0x00001a6b c74210020000. mov dword [edx + 0x10], 2 ; [0x10:4]=0x30003 ; 16 | ; JMP XREF from 0x00001a69 (fcn.000017d1) | --------> 0x00001a72 83c43c add esp, 0x3c | || |||| 0x00001a75 5b pop ebx | || |||| 0x00001a76 5e pop esi | || |||| 0x00001a77 5f pop edi | || |||| 0x00001a78 5d pop ebp | || |||| 0x00001a79 c3 ret | || ; JMP XREF from 0x00001848 (fcn.000017d1) | |`------> 0x00001a7a 3b7514 cmp esi, dword [ebp + 0x14] ; [0x14:4]=1 ; 20 | ========< 0x00001a7d 0f8fc6000000 jg 0x1b49 | ; JMP XREF from 0x00001b4c (fcn.000017d1) | --------> 0x00001a83 c74424100200. mov dword [esp + 0x10], 2 ; [0x10:4]=0x30003 ; 16 | | |||| 0x00001a8b 8974240c mov dword [esp + 0xc], esi ; [0xc:4]=0 ; 12 | | |||| 0x00001a8f 897c2408 mov dword [esp + 8], edi ; [0x8:4]=0 ; 8 | | |||| 0x00001a93 8b4510 mov eax, dword [ebp + 0x10] ; [0x10:4]=0x30003 ; 16 | | |||| 0x00001a96 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101 ; 4 | | |||| 0x00001a9a 8b5508 mov edx, dword [ebp + 8] ; [0x8:4]=0 ; 8 | | |||| 0x00001a9d 891424 mov dword [esp], edx | | |||| 0x00001aa0 e887f3ffff call sym.imp.Perl_sv_catpvn_flags ;0x00000e2c() ; sym.imp.Perl_sv_catpvn_flags | | |||| 0x00001aa5 8d0437 lea eax, [edi + esi] | | |||| 0x00001aa8 89442408 mov dword [esp + 8], eax ; [0x8:4]=0 ; 8 | ; JMP XREF from 0x00001aff (fcn.000017d1) | --------> 0x00001aac 8b4dd0 mov ecx, dword [ebp-local_12] | | |||| 0x00001aaf 8b4108 mov eax, dword [ecx + 8] ; [0x8:4]=0 ; 8 | | |||| 0x00001ab2 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101 ; 4 | | |||| 0x00001ab6 8b4508 mov eax, dword [ebp + 8] ; [0x8:4]=0 ; 8 | | |||| 0x00001ab9 890424 mov dword [esp], eax | | |||| 0x00001abc e89bf2ffff call sym.imp.Perl_sv_chop ; fcn.00000d58+0x4 ;fcn.00000d58() ; sym.imp.Perl_sv_chop | | |||| 0x00001ac1 8b5510 mov edx, dword [ebp + 0x10] ; [0x10:4]=0x30003 ; 16 | | |||| 0x00001ac4 8b02 mov eax, dword [edx] | | |||| 0x00001ac6 8b4004 mov eax, dword [eax + 4] ; [0x4:4]=0x10101 ; 4 | | |||| 0x00001ac9 83c43c add esp, 0x3c | | |||| 0x00001acc 5b pop ebx | | |||| 0x00001acd 5e pop esi | | |||| 0x00001ace 5f pop edi | | |||| 0x00001acf 5d pop ebp | | |||| 0x00001ad0 c3 ret | | ; JMP XREF from 0x00001877 (fcn.000017d1) | `-------> 0x00001ad1 8d7001 lea esi, [eax + 1] ; 0x1 ; 1 | |||| 0x00001ad4 29fe sub esi, edi | |||| 0x00001ad6 8974240c mov dword [esp + 0xc], esi ; [0xc:4]=0 ; 12 | |||| 0x00001ada 8d3437 lea esi, [edi + esi] | |||| 0x00001add c74424100200. mov dword [esp + 0x10], 2 ; [0x10:4]=0x30003 ; 16 | |||| 0x00001ae5 897c2408 mov dword [esp + 8], edi ; [0x8:4]=0 ; 8 | |||| 0x00001ae9 8b4510 mov eax, dword [ebp + 0x10] ; [0x10:4]=0x30003 ; 16 | |||| 0x00001aec 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101 ; 4 | |||| 0x00001af0 8b5508 mov edx, dword [ebp + 8] ; [0x8:4]=0 ; 8 | |||| 0x00001af3 891424 mov dword [esp], edx | |||| 0x00001af6 e831f3ffff call sym.imp.Perl_sv_catpvn_flags ;0x00000e2c() ; sym.imp.Perl_sv_catpvn_flags | |||| 0x00001afb 89742408 mov dword [esp + 8], esi ; [0x8:4]=0 ; 8 | ========< 0x00001aff ebab jmp 0x1aac | | ; JMP XREF from 0x00001823 (fcn.000017d1) | `----> 0x00001b01 8b4d08 mov ecx, dword [ebp + 8] ; [0x8:4]=0 ; 8 | ||| 0x00001b04 890c24 mov dword [esp], ecx | ||| 0x00001b07 e860f2ffff call sym.imp.Perl_Irsfp_filters_ptr ;sym.imp.Perl_Irsfp_filters_ptr() | ||| 0x00001b0c 31d2 xor edx, edx | ||| 0x00001b0e 8b08 mov ecx, dword [eax] | ||| 0x00001b10 85c9 test ecx, ecx | ========< 0x00001b12 741e je 0x1b32 | ||| 0x00001b14 8b4508 mov eax, dword [ebp + 8] ; [0x8:4]=0 ; 8 | ||| 0x00001b17 890424 mov dword [esp], eax | ||| 0x00001b1a e84df2ffff call sym.imp.Perl_Irsfp_filters_ptr ;sym.imp.Perl_Irsfp_filters_ptr() | ||| 0x00001b1f 8b00 mov eax, dword [eax] | ||| 0x00001b21 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101 ; 4 | ||| 0x00001b25 8b5508 mov edx, dword [ebp + 8] ; [0x8:4]=0 ; 8 | ||| 0x00001b28 891424 mov dword [esp], edx | ||| 0x00001b2b e86cf2ffff call sym.imp.Perl_av_len ;0x00000d9c() ; sym.imp.Perl_av_len | ||| 0x00001b30 89c2 mov edx, eax | ; JMP XREF from 0x00001b12 (fcn.000017d1) | --------> 0x00001b32 8b4dd0 mov ecx, dword [ebp-local_12] | ||| 0x00001b35 3b510c cmp edx, dword [ecx + 0xc] ; [0xc:4]=0 ; 12 | ========< 0x00001b38 7f1a jg 0x1b54 | ||| 0x00001b3a 8b45d0 mov eax, dword [ebp-local_12] | ||| 0x00001b3d c74010010000. mov dword [eax + 0x10], 1 ; [0x10:4]=0x30003 ; 16 | ========< 0x00001b44 e9e0fcffff jmp 0x1829 | ; JMP XREF from 0x00001a7d (fcn.000017d1) | --------> 0x00001b49 8b7514 mov esi, dword [ebp + 0x14] ; [0x14:4]=1 ; 20 | ========< 0x00001b4c e932ffffff jmp 0x1a83 | ; JMP XREF from 0x000019f7 (fcn.000017d1) | --------> 0x00001b51 8b4dd0 mov ecx, dword [ebp-local_12] | ; JMP XREF from 0x00001b38 (fcn.000017d1) | --------> 0x00001b54 c74110020000. mov dword [ecx + 0x10], 2 ; [0x10:4]=0x30003 ; 16 | ||| 0x00001b5b 8d832eeeffff lea eax, [ebx - 0x11d2] | ||| 0x00001b61 890424 mov dword [esp], eax | ||| 0x00001b64 e813f4ffff call sym.imp.Perl_croak_nocontext ;sym.imp.Perl_croak_nocontext() | | ; JMP XREF from 0x00001815 (fcn.000017d1) | `---> 0x00001b69 8d83c0deffff lea eax, [ebx - 0x2140] | || 0x00001b6f 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101 ; 4 | || 0x00001b73 8b4d08 mov ecx, dword [ebp + 8] ; [0x8:4]=0 ; 8 | || 0x00001b76 890c24 mov dword [esp], ecx | || 0x00001b79 e83ef2ffff call sym.imp.Perl_filter_del ;sym.imp.Perl_filter_del() | || 0x00001b7e 8b45d0 mov eax, dword [ebp-local_12] | || 0x00001b81 c74010020000. mov dword [eax + 0x10], 2 ; [0x10:4]=0x30003 ; 16 | || 0x00001b88 8d832eeeffff lea eax, [ebx - 0x11d2] | || 0x00001b8e 890424 mov dword [esp], eax | || 0x00001b91 e8e6f3ffff call sym.imp.Perl_croak_nocontext ;sym.imp.Perl_croak_nocontext() | | ; JMP XREF from 0x0000180a (fcn.000017d1) | `--> 0x00001b96 8d83c0deffff lea eax, [ebx - 0x2140] | | 0x00001b9c 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101 ; 4 | | 0x00001ba0 8b4d08 mov ecx, dword [ebp + 8] ; [0x8:4]=0 ; 8 | | 0x00001ba3 890c24 mov dword [esp], ecx | | 0x00001ba6 e811f2ffff call sym.imp.Perl_filter_del ;sym.imp.Perl_filter_del() | | 0x00001bab 8d832eeeffff lea eax, [ebx - 0x11d2] | | 0x00001bb1 890424 mov dword [esp], eax | | 0x00001bb4 e8c3f3ffff call sym.imp.Perl_croak_nocontext ;sym.imp.Perl_croak_nocontext() | | ; JMP XREF from 0x000017fc (fcn.000017d1) | `-> 0x00001bb9 8d83c0deffff lea eax, [ebx - 0x2140] | 0x00001bbf 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101 ; 4 | 0x00001bc3 8b4508 mov eax, dword [ebp + 8] ; [0x8:4]=0 ; 8 | 0x00001bc6 890424 mov dword [esp], eax | 0x00001bc9 e8eef1ffff call sym.imp.Perl_filter_del ;sym.imp.Perl_filter_del() | 0x00001bce 8d832eeeffff lea eax, [ebx - 0x11d2] | 0x00001bd4 890424 mov dword [esp], eax | 0x00001bd7 e8a0f3ffff call sym.imp.Perl_croak_nocontext ;sym.imp.Perl_croak_nocontext() | 0x00001bdc 8d742600 lea esi, [esi] | ;-- sym.XS_Sibsoft__Filter_DESTROY: | 0x00001be0 55 push ebp | 0x00001be1 89e5 mov ebp, esp | 0x00001be3 83ec18 sub esp, 0x18 | 0x00001be6 895df4 mov dword [ebp-local_3], ebx | 0x00001be9 e8f9f4ffff call fcn.000010e7 ;fcn.000010e7() | 0x00001bee 81c3d21c0000 add ebx, 0x1cd2 | 0x00001bf4 897dfc mov dword [ebp-local_1], edi | 0x00001bf7 8b7d08 mov edi, dword [ebp + 8] ; [0x8:4]=0 ; 8 | 0x00001bfa 8975f8 mov dword [ebp-local_2], esi | 0x00001bfd 893c24 mov dword [esp], edi | 0x00001c00 e857f2ffff call sym.imp.Perl_Tstack_sp_ptr ;sym.imp.Perl_Tstack_sp_ptr() | 0x00001c05 8b00 mov eax, dword [eax] | 0x00001c07 893c24 mov dword [esp], edi | 0x00001c0a 8945f0 mov dword [ebp-local_4], eax | 0x00001c0d e80af3ffff call sym.imp.Perl_Tmarkstack_ptr_ptr ;0x00000f1c() ; sym.imp.Perl_Tmarkstack_ptr_ptr | 0x00001c12 8b10 mov edx, dword [eax] | 0x00001c14 8b32 mov esi, dword [edx] | 0x00001c16 83ea04 sub edx, 4 | 0x00001c19 8910 mov dword [eax], edx | 0x00001c1b 893c24 mov dword [esp], edi | 0x00001c1e e8a9f1ffff call sym.imp.Perl_Tstack_base_ptr ;sym.imp.Perl_Tstack_base_ptr() | 0x00001c23 c1e602 shl esi, 2 | 0x00001c26 0330 add esi, dword [eax] | 0x00001c28 8b45f0 mov eax, dword [ebp-local_4] | 0x00001c2b 29f0 sub eax, esi | 0x00001c2d c1f802 sar eax, 2 | 0x00001c30 83e801 sub eax, 1 | ========< 0x00001c33 7533 jne 0x1c68 | 0x00001c35 893c24 mov dword [esp], edi | 0x00001c38 e88ff1ffff call sym.imp.Perl_Tstack_base_ptr ;sym.imp.Perl_Tstack_base_ptr() | 0x00001c3d 8b8328020000 mov eax, dword [ebx + 0x228] ; [0x228:4]=22 ; 552 | 0x00001c43 890424 mov dword [esp], eax | 0x00001c46 e8a1f3ffff call sym.imp.Perl_safesysfree ;0x00000fec() ; sym.imp.Perl_safesysfree | 0x00001c4b 893c24 mov dword [esp], edi | 0x00001c4e e809f2ffff call sym.imp.Perl_Tstack_sp_ptr ;sym.imp.Perl_Tstack_sp_ptr() | 0x00001c53 8b55f0 mov edx, dword [ebp-local_4] | 0x00001c56 83ea04 sub edx, 4 | 0x00001c59 8910 mov dword [eax], edx | 0x00001c5b 8b5df4 mov ebx, dword [ebp-local_3] | 0x00001c5e 8b75f8 mov esi, dword [ebp-local_2] | 0x00001c61 8b7dfc mov edi, dword [ebp-local_1] | 0x00001c64 89ec mov esp, ebp | 0x00001c66 5d pop ebp | 0x00001c67 c3 ret | ; JMP XREF from 0x00001c33 (fcn.000017d1) | --------> 0x00001c68 8d8384eeffff lea eax, [ebx - 0x117c] | 0x00001c6e 89442404 mov dword [esp + 4], eax ; [0x4:4]=0x10101 ; 4 | 0x00001c72 893c24 mov dword [esp], edi | 0x00001c75 e862f3ffff call sym.imp.Perl_croak ;0x00000fdc() ; sym.imp.Perl_croak | 0x00001c7a 8db600000000 lea esi, [esi] | ; CALL XREF from 0x00001f8d (fcn.00001cd5) | ; CALL XREF from 0x00001fc3 (fcn.00001cd5) | 0x00001c80 55 push ebp | 0x00001c81 89e5 mov ebp, esp | 0x00001c83 83ec18 sub esp, 0x18 | 0x00001c86 895df4 mov dword [ebp-local_3], ebx | 0x00001c89 e859f4ffff call fcn.000010e7 ;fcn.000010e7() | 0x00001c8e 81c3321c0000 add ebx, 0x1c32 | 0x00001c94 8975f8 mov dword [ebp-local_2], esi | 0x00001c97 897dfc mov dword [ebp-local_1], edi | 0x00001c9a 89d7 mov edi, edx | 0x00001c9c 8b5208 mov edx, dword [edx + 8] ; [0x8:4]=0 ; 8 | 0x00001c9f 890424 mov dword [esp], eax | 0x00001ca2 89542404 mov dword [esp + 4], edx ; [0x4:4]=0x10101 ; 4 | 0x00001ca6 e8e1f0ffff call sym.imp.Perl_sv_free ;sym.imp.Perl_sv_free() | 0x00001cab 8b7704 mov esi, dword [edi + 4] ; [0x4:4]=0x10101 ; 4 | 0x00001cae 8b06 mov eax, dword [esi] | 0x00001cb0 890424 mov dword [esp], eax | 0x00001cb3 e834f3ffff call sym.imp.Perl_safesysfree ;0x00000fec() ; sym.imp.Perl_safesysfree | 0x00001cb8 893424 mov dword [esp], esi | 0x00001cbb e82cf3ffff call sym.imp.Perl_safesysfree ;0x00000fec() ; sym.imp.Perl_safesysfree | 0x00001cc0 893c24 mov dword [esp], edi | 0x00001cc3 e824f3ffff call sym.imp.Perl_safesysfree ;0x00000fec() ; sym.imp.Perl_safesysfree | 0x00001cc8 8b5df4 mov ebx, dword [ebp-local_3] | 0x00001ccb 8b75f8 mov esi, dword [ebp-local_2] | 0x00001cce 8b7dfc mov edi, dword [ebp-local_1] | 0x00001cd1 89ec mov esp, ebp | 0x00001cd3 5d pop ebp \ 0x00001cd4 c3 ret

What do you mean matt
we are not programmers and we dont understant in Hex or olly debugers or opcode or somme thing similar