上一篇：ikki_CrackMe变形SHA和变形BlowFish逆向分析（… >>

ikki_CrackMe变形SHA和变形BlowFish逆向分析（…

ikki_CrackMe变形SHA和变形BlowFish逆向分析（三）----SHA1算法(2)
现在我们接着开始分析SHA1的算法，这个SHA1算法分析起来倒是很简单，基本就是将待加密的数据乱七八糟的逻辑运算一通，得出一个固定长度为160位的数字签名。就是代码冗长，分析起来太费时间（分析了两天~~^_^~~)。
还是废话少说的好，转入正题吧。这个函数原型参考如下：
---------------Procedure SHA1(var SHA1_Key, Name_64:array of DWORD);---------------------
00415D6E  |.  8D45 B0       LEA EAX,DWORD PTR SS:[EBP-50]
00415D71  |.  50            PUSH EAX                                 ;  var Name_Init_64:array[0..16] of DOWRD;
00415D72  |.  8B4D 08       MOV ECX,DWORD PTR SS:[EBP+8]
00415D75  |.  51            PUSH ECX                                 ;  var SHA1_Key:array[0..4] of DWORD;
00415D76  |.  E8 0DB7FFFF   CALL CRACKME_.00411488                   ;  CALL SHA1;

-----------------------------CALL SHA1---------------------------------------------------
begin
004126F0  PUSH EBP
004126F1  MOV EBP,ESP
004126F3  SUB ESP,138
004126F9  PUSH EBX
004126FA  PUSH ESI
004126FB  PUSH EDI

004126FC  LEA EDI,DWORD PTR SS:[EBP-138]           ; 程序进行常规初始化。
00412702  MOV ECX,4E
00412707  MOV EAX,CCCCCCCC
0041270C  REP STOS DWORD PTR ES:[EDI]
0041270E  MOV EAX,DWORD PTR SS:[EBP+8]
00412711  MOV ECX,DWORD PTR DS:[EAX]
00412713  MOV DWORD PTR SS:[EBP-8],ECX             ; 保存SHA1_Key[0],设为a1;
00412716  MOV EAX,DWORD PTR SS:[EBP+8]
00412719  MOV ECX,DWORD PTR DS:[EAX+4]
0041271C  MOV DWORD PTR SS:[EBP-14],ECX            ; 保存SHA1_Key[1],设为b1;
0041271F  MOV EAX,DWORD PTR SS:[EBP+8]
00412722  MOV ECX,DWORD PTR DS:[EAX+8]
00412725  MOV DWORD PTR SS:[EBP-20],ECX            ; 保存SHA1_Key[2],设为c1;
00412728  MOV EAX,DWORD PTR SS:[EBP+8]
0041272B  MOV ECX,DWORD PTR DS:[EAX+C]
0041272E  MOV DWORD PTR SS:[EBP-2C],ECX            ; 保存SHA1_Key[3],设为d1;
00412731  MOV EAX,DWORD PTR SS:[EBP+8]
00412734  MOV ECX,DWORD PTR DS:[EAX+10]
00412737  MOV DWORD PTR SS:[EBP-38],ECX            ; 保存SHA1_Key[4],设为e1;
0041273A  MOV EAX,DWORD PTR SS:[EBP+8]
0041273D  MOV ECX,DWORD PTR DS:[EAX]
0041273F  MOV DWORD PTR SS:[EBP-44],ECX            ; 再次保存SHA1_Key[0],设为a2;
00412742  MOV EAX,DWORD PTR SS:[EBP+8]
00412745  MOV ECX,DWORD PTR DS:[EAX+4]
00412748  MOV DWORD PTR SS:[EBP-50],ECX            ; 再次保存SHA1_Key[1],设为b2;
0041274B  MOV EAX,DWORD PTR SS:[EBP+8]
0041274E  MOV ECX,DWORD PTR DS:[EAX+8]
00412751  MOV DWORD PTR SS:[EBP-5C],ECX            ; 再次保存SHA1_Key[2],设为c2;
00412754  MOV EAX,DWORD PTR SS:[EBP+8]
00412757  MOV ECX,DWORD PTR DS:[EAX+C]
0041275A  MOV DWORD PTR SS:[EBP-68],ECX            ; 再次保存SHA1_Key[3],设为d2;
0041275D  MOV EAX,DWORD PTR SS:[EBP+8]
00412760  MOV ECX,DWORD PTR DS:[EAX+10]
00412763  MOV DWORD PTR SS:[EBP-74],ECX            ; 再次保存SHA1_Key[4],设为e2;

//a1 := b1 xor c1 xor d1 + Name_64[0] + a1;
00412766  MOV EAX,DWORD PTR SS:[EBP-14]
00412769  XOR EAX,DWORD PTR SS:[EBP-20]
0041276C  XOR EAX,DWORD PTR SS:[EBP-2C]
0041276F  MOV ECX,DWORD PTR SS:[EBP+C]
00412772  ADD EAX,DWORD PTR DS:[ECX]
00412774  ADD EAX,DWORD PTR SS:[EBP-8]
00412777  MOV DWORD PTR SS:[EBP-8],EAX

//a1 := (a1 shl $0B) or (a1 shr $15) + e1;
0041277A  MOV EAX,DWORD PTR SS:[EBP-8]
0041277D  SHL EAX,0B
00412780  MOV ECX,DWORD PTR SS:[EBP-8]
00412783  SHR ECX,15
00412786  OR EAX,ECX
00412788  ADD EAX,DWORD PTR SS:[EBP-38]
0041278B  MOV DWORD PTR SS:[EBP-8],EAX

//c1 := (c1 shl $0A) or (c1 shr $16);
0041278E  MOV EAX,DWORD PTR SS:[EBP-20]
00412791  SHL EAX,0A
00412794  MOV ECX,DWORD PTR SS:[EBP-20]
00412797  SHR ECX,16
0041279A  OR EAX,ECX
0041279C  MOV DWORD PTR SS:[EBP-20],EAX

//e1 := a1 xor b1 xor c1 + Name_64[1] + e1;
0041279F  MOV EAX,DWORD PTR SS:[EBP-8]
004127A2  XOR EAX,DWORD PTR SS:[EBP-14]
004127A5  XOR EAX,DWORD PTR SS:[EBP-20]
004127A8  MOV ECX,DWORD PTR SS:[EBP+C]
004127AB  ADD EAX,DWORD PTR DS:[ECX+4]
004127AE  ADD EAX,DWORD PTR SS:[EBP-38]
004127B1  MOV DWORD PTR SS:[EBP-38],EAX

//e1 := (e1 shl $0E) or (e1 shr $12) + d1;
004127B4  MOV EAX,DWORD PTR SS:[EBP-38]
004127B7  SHL EAX,0E
004127BA  MOV ECX,DWORD PTR SS:[EBP-38]
004127BD  SHR ECX,12
004127C0  OR EAX,ECX
004127C2  ADD EAX,DWORD PTR SS:[EBP-2C]
004127C5  MOV DWORD PTR SS:[EBP-38],EAX

//b1 := (b1 shl $0A) or (b1 shr $16);
004127C8  MOV EAX,DWORD PTR SS:[EBP-14]
004127CB  SHL EAX,0A
004127CE  MOV ECX,DWORD PTR SS:[EBP-14]
004127D1  SHR ECX,16
004127D4  OR EAX,ECX
004127D6  MOV DWORD PTR SS:[EBP-14],EAX

//d1 := e1 xor a1 xor b1 + Name_64[2] + d1;
004127D9  MOV EAX,DWORD PTR SS:[EBP-38]
004127DC  XOR EAX,DWORD PTR SS:[EBP-8]
004127DF  XOR EAX,DWORD PTR SS:[EBP-14]
004127E2  MOV ECX,DWORD PTR SS:[EBP+C]
004127E5  ADD EAX,DWORD PTR DS:[ECX+8]
004127E8  ADD EAX,DWORD PTR SS:[EBP-2C]
004127EB  MOV DWORD PTR SS:[EBP-2C],EAX

//d1 := (d1 shl $0F) or (d1 shr $11) + c1;
004127EE  MOV EAX,DWORD PTR SS:[EBP-2C]
004127F1  SHL EAX,0F
004127F4  MOV ECX,DWORD PTR SS:[EBP-2C]
004127F7  SHR ECX,11
004127FA  OR EAX,ECX
004127FC  ADD EAX,DWORD PTR SS:[EBP-20]
004127FF  MOV DWORD PTR SS:[EBP-2C],EAX

//a1 := (a1 shl $0A) or (a1 shr $16);
00412802  MOV EAX,DWORD PTR SS:[EBP-8]
00412805  SHL EAX,0A
00412808  MOV ECX,DWORD PTR SS:[EBP-8]
0041280B  SHR ECX,16
0041280E  OR EAX,ECX
00412810  MOV DWORD PTR SS:[EBP-8],EAX

//c1 := d1 xor e1 xor a1 + Name_64[3] + c1;
00412813  MOV EAX,DWORD PTR SS:[EBP-2C]
00412816  XOR EAX,DWORD PTR SS:[EBP-38]
00412819  XOR EAX,DWORD PTR SS:[EBP-8]
0041281C  MOV ECX,DWORD PTR SS:[EBP+C]
0041281F  ADD EAX,DWORD PTR DS:[ECX+C]
00412822  ADD EAX,DWORD PTR SS:[EBP-20]
00412825  MOV DWORD PTR SS:[EBP-20],EAX

//c1 := (c1 shl $0C) or (c1 shr $14) + b1;
00412828  MOV EAX,DWORD PTR SS:[EBP-20]
0041282B  SHL EAX,0C
0041282E  MOV ECX,DWORD PTR SS:[EBP-20]
00412831  SHR ECX,14
00412834  OR EAX,ECX
00412836  ADD EAX,DWORD PTR SS:[EBP-14]
00412839  MOV DWORD PTR SS:[EBP-20],EAX

//e1 := (e1 shl $0A) or (e1 shr $16);
0041283C  MOV EAX,DWORD PTR SS:[EBP-38]
0041283F  SHL EAX,0A
00412842  MOV ECX,DWORD PTR SS:[EBP-38]
00412845  SHR ECX,16
00412848  OR EAX,ECX
0041284A  MOV DWORD PTR SS:[EBP-38],EAX

//b1 := c1 xor d1 xor e1 + Name_64[4] + b1;
0041284D  MOV EAX,DWORD PTR SS:[EBP-20]
00412850  XOR EAX,DWORD PTR SS:[EBP-2C]
00412853  XOR EAX,DWORD PTR SS:[EBP-38]
00412856  MOV ECX,DWORD PTR SS:[EBP+C]
00412859  ADD EAX,DWORD PTR DS:[ECX+10]
0041285C  ADD EAX,DWORD PTR SS:[EBP-14]
0041285F  MOV DWORD PTR SS:[EBP-14],EAX

//b1 := (b1 shl 5) or (b1 shr $1B) + a1;
00412862  MOV EAX,DWORD PTR SS:[EBP-14]
00412865  SHL EAX,5
00412868  MOV ECX,DWORD PTR SS:[EBP-14]
0041286B  SHR ECX,1B
0041286E  OR EAX,ECX
00412870  ADD EAX,DWORD PTR SS:[EBP-8]
00412873  MOV DWORD PTR SS:[EBP-14],EAX

//d1 := (d1 shl $0A) or (d1 shr $16));
00412876  MOV EAX,DWORD PTR SS:[EBP-2C]
00412879  SHL EAX,0A
0041287C  MOV ECX,DWORD PTR SS:[EBP-2C]
0041287F  SHR ECX,16
00412882  OR EAX,ECX
00412884  MOV DWORD PTR SS:[EBP-2C],EAX

//a1 := b1 xor c1 xor d1 + Name_64[5] + a1;
00412887  MOV EAX,DWORD PTR SS:[EBP-14]
0041288A  XOR EAX,DWORD PTR SS:[EBP-20]
0041288D  XOR EAX,DWORD PTR SS:[EBP-2C]
00412890  MOV ECX,DWORD PTR SS:[EBP+C]
00412893  ADD EAX,DWORD PTR DS:[ECX+14]
00412896  ADD EAX,DWORD PTR SS:[EBP-8]
00412899  MOV DWORD PTR SS:[EBP-8],EAX

//a1 := (a1 shl 8) or (a1 shr $18) + e1;
0041289C  MOV EAX,DWORD PTR SS:[EBP-8]
0041289F  SHL EAX,8
004128A2  MOV ECX,DWORD PTR SS:[EBP-8]
004128A5  SHR ECX,18
004128A8  OR EAX,ECX
004128AA  ADD EAX,DWORD PTR SS:[EBP-38]
004128AD  MOV DWORD PTR SS:[EBP-8],EAX

//c1 := (c1 shl $0A) or (c1 shr $16);
004128B0  MOV EAX,DWORD PTR SS:[EBP-20]
004128B3  SHL EAX,0A
004128B6  MOV ECX,DWORD PTR SS:[EBP-20]
004128B9  SHR ECX,16
004128BC  OR EAX,ECX
004128BE  MOV DWORD PTR SS:[EBP-20],EAX

//e1 := a1 xor b1 xor c1 + Name_64[6] + e1;
004128C1  MOV EAX,DWORD PTR SS:[EBP-8]
004128C4  XOR EAX,DWORD PTR SS:[EBP-14]
004128C7  XOR EAX,DWORD PTR SS:[EBP-20]
004128CA  MOV ECX,DWORD PTR SS:[EBP+C]
004128CD  ADD EAX,DWORD PTR DS:[ECX+18]
004128D0  ADD EAX,DWORD PTR SS:[EBP-38]
004128D3  MOV DWORD PTR SS:[EBP-38],EAX

//e1 := (e1 shl 7) or (e1 shr $19) + d1;
004128D6  MOV EAX,DWORD PTR SS:[EBP-38]
004128D9  SHL EAX,7
004128DC  MOV ECX,DWORD PTR SS:[EBP-38]
004128DF  SHR ECX,19
004128E2  OR EAX,ECX
004128E4  ADD EAX,DWORD PTR SS:[EBP-2C]
004128E7  MOV DWORD PTR SS:[EBP-38],EAX

//b1 := (b1 shl $0A) or (b1 shr $16);
004128EA  MOV EAX,DWORD PTR SS:[EBP-14]
004128ED  SHL EAX,0A
004128F0  MOV ECX,DWORD PTR SS:[EBP-14]
004128F3  SHR ECX,16
004128F6  OR EAX,ECX
004128F8  MOV DWORD PTR SS:[EBP-14],EAX

//d1 := e1 xor a1 xor b1 + Name_64[7] + d1;
004128FB  MOV EAX,DWORD PTR SS:[EBP-38]
004128FE  XOR EAX,DWORD PTR SS:[EBP-8]
00412901  XOR EAX,DWORD PTR SS:[EBP-14]
00412904  MOV ECX,DWORD PTR SS:[EBP+C]
00412907  ADD EAX,DWORD PTR DS:[ECX+1C]
0041290A  ADD EAX,DWORD PTR SS:[EBP-2C]
0041290D  MOV DWORD PTR SS:[EBP-2C],EAX

//d1 := (d1 shl 9) or (d1 shr $17) + c1;
00412910  MOV EAX,DWORD PTR SS:[EBP-2C]
00412913  SHL EAX,9
00412916  MOV ECX,DWORD PTR SS:[EBP-2C]
00412919  SHR ECX,17
0041291C  OR EAX,ECX
0041291E  ADD EAX,DWORD PTR SS:[EBP-20]
00412921  MOV DWORD PTR SS:[EBP-2C],EAX

//a1 := (a1 shl $0A) or (a1 shr $16);
00412924  MOV EAX,DWORD PTR SS:[EBP-8]
00412927  SHL EAX,0A
0041292A  MOV ECX,DWORD PTR SS:[EBP-8]
0041292D  SHR ECX,16
00412930  OR EAX,ECX
00412932  MOV DWORD PTR SS:[EBP-8],EAX

//c1 := d1 xor e1 xor a1 + Name_64[8] + c1;
00412935  MOV EAX,DWORD PTR SS:[EBP-2C]
00412938  XOR EAX,DWORD PTR SS:[EBP-38]
0041293B  XOR EAX,DWORD PTR SS:[EBP-8]
0041293E  MOV ECX,DWORD PTR SS:[EBP+C]
00412941  ADD EAX,DWORD PTR DS:[ECX+20]
00412944  ADD EAX,DWORD PTR SS:[EBP-20]
00412947  MOV DWORD PTR SS:[EBP-20],EAX

//c1 := (c1 shl $0B) or (c1 shr $15) + b1;
0041294A  MOV EAX,DWORD PTR SS:[EBP-20]
0041294D  SHL EAX,0B
00412950  MOV ECX,DWORD PTR SS:[EBP-20]
00412953  SHR ECX,15
00412956  OR EAX,ECX
00412958  ADD EAX,DWORD PTR SS:[EBP-14]
0041295B  MOV DWORD PTR SS:[EBP-20],EAX

//e1 := (e1 shl $0A) or (e1 shr $16);
0041295E  MOV EAX,DWORD PTR SS:[EBP-38]
00412961  SHL EAX,0A
00412964  MOV ECX,DWORD PTR SS:[EBP-38]
00412967  SHR ECX,16
0041296A  OR EAX,ECX
0041296C  MOV DWORD PTR SS:[EBP-38],EAX

//b1 := c1 xor d1 xor e1 + Name_64[9] + b1;
0041296F  MOV EAX,DWORD PTR SS:[EBP-20]
00412972  XOR EAX,DWORD PTR SS:[EBP-2C]
00412975  XOR EAX,DWORD PTR SS:[EBP-38]
00412978  MOV ECX,DWORD PTR SS:[EBP+C]
0041297B  ADD EAX,DWORD PTR DS:[ECX+24]
0041297E  ADD EAX,DWORD PTR SS:[EBP-14]
00412981  MOV DWORD PTR SS:[EBP-14],EAX

//b1 := (b1 shl $0D) or (b1 shr $13) + a1;
00412984  MOV EAX,DWORD PTR SS:[EBP-14]
00412987  SHL EAX,0D
0041298A  MOV ECX,DWORD PTR SS:[EBP-14]
0041298D  SHR ECX,13
00412990  OR EAX,ECX
00412992  ADD EAX,DWORD PTR SS:[EBP-8]
00412995  MOV DWORD PTR SS:[EBP-14],EAX

//d1 := (d1 shl $0A) or (d1 shr $16);
00412998  MOV EAX,DWORD PTR SS:[EBP-2C]
0041299B  SHL EAX,0A
0041299E  MOV ECX,DWORD PTR SS:[EBP-2C]
004129A1  SHR ECX,16
004129A4  OR EAX,ECX
004129A6  MOV DWORD PTR SS:[EBP-2C],EAX

//a1 := b1 xor c1 xor d1 + Name_64[10] + a1;
004129A9  MOV EAX,DWORD PTR SS:[EBP-14]
004129AC  XOR EAX,DWORD PTR SS:[EBP-20]
004129AF  XOR EAX,DWORD PTR SS:[EBP-2C]
004129B2  MOV ECX,DWORD PTR SS:[EBP+C]
004129B5  ADD EAX,DWORD PTR DS:[ECX+28]
004129B8  ADD EAX,DWORD PTR SS:[EBP-8]
004129BB  MOV DWORD PTR SS:[EBP-8],EAX

//a1 := (a1 shl $0E) or (a1 shr $12) + e1;
004129BE  MOV EAX,DWORD PTR SS:[EBP-8]
004129C1  SHL EAX,0E
004129C4  MOV ECX,DWORD PTR SS:[EBP-8]
004129C7  SHR ECX,12
004129CA  OR EAX,ECX
004129CC  ADD EAX,DWORD PTR SS:[EBP-38]
004129CF  MOV DWORD PTR SS:[EBP-8],EAX

//c1 := (c1 shl $0A) or (c1 shr ($16);
004129D2  MOV EAX,DWORD PTR SS:[EBP-20]
004129D5  SHL EAX,0A
004129D8  MOV ECX,DWORD PTR SS:[EBP-20]
004129DB  SHR ECX,16
004129DE  OR EAX,ECX
004129E0  MOV DWORD PTR SS:[EBP-20],EAX

//e1 := a1 xor b1 xor c1 + Name_64[11] + e1;
004129E3  MOV EAX,DWORD PTR SS:[EBP-8]
004129E6  XOR EAX,DWORD PTR SS:[EBP-14]
004129E9  XOR EAX,DWORD PTR SS:[EBP-20]
004129EC  MOV ECX,DWORD PTR SS:[EBP+C]
004129EF  ADD EAX,DWORD PTR DS:[ECX+2C]
004129F2  ADD EAX,DWORD PTR SS:[EBP-38]
004129F5  MOV DWORD PTR SS:[EBP-38],EAX

//e1 := (e1 shl $0F) or (e1 shr $11) + d1;
004129F8  MOV EAX,DWORD PTR SS:[EBP-38]
004129FB  SHL EAX,0F
004129FE  MOV ECX,DWORD PTR SS:[EBP-38]
00412A01  SHR ECX,11
00412A04  OR EAX,ECX
00412A06  ADD EAX,DWORD PTR SS:[EBP-2C]
00412A09  MOV DWORD PTR SS:[EBP-38],EAX

//b1 := (b1 shl $0A) or (b1 shr $16);
00412A0C  MOV EAX,DWORD PTR SS:[EBP-14]
00412A0F  SHL EAX,0A
00412A12  MOV ECX,DWORD PTR SS:[EBP-14]
00412A15  SHR ECX,16
00412A18  OR EAX,ECX
00412A1A  MOV DWORD PTR SS:[EBP-14],EAX

//d1 := e1 xor a1 xor b1 + Name_64[12] + d1;
00412A1D  MOV EAX,DWORD PTR SS:[EBP-38]
00412A20  XOR EAX,DWORD PTR SS:[EBP-8]
00412A23  XOR EAX,DWORD PTR SS:[EBP-14]
00412A26  MOV ECX,DWORD PTR SS:[EBP+C]
00412A29  ADD EAX,DWORD PTR DS:[ECX+30]
00412A2C  ADD EAX,DWORD PTR SS:[EBP-2C]
00412A2F  MOV DWORD PTR SS:[EBP-2C],EAX

//d1 := (d1 shl 6) or (d1 shr $1A) + c1;
00412A32  MOV EAX,DWORD PTR SS:[EBP-2C]
00412A35  SHL EAX,6
00412A38  MOV ECX,DWORD PTR SS:[EBP-2C]
00412A3B  SHR ECX,1A
00412A3E  OR EAX,ECX
00412A40  ADD EAX,DWORD PTR SS:[EBP-20]
00412A43  MOV DWORD PTR SS:[EBP-2C],EAX
00412A46  MOV EAX,DWORD PTR SS:[EBP-8]
00412A49  SHL EAX,0A
00412A4C  MOV ECX,DWORD PTR SS:[EBP-8]
00412A4F  SHR ECX,16
00412A52  OR EAX,ECX
00412A54  MOV DWORD PTR SS:[EBP-8],EAX

//c1 := d1 xor e1 xor a1 + Name_64[13] + c1;
00412A57  MOV EAX,DWORD PTR SS:[EBP-2C]
00412A5A  XOR EAX,DWORD PTR SS:[EBP-38]
00412A5D  XOR EAX,DWORD PTR SS:[EBP-8]
00412A60  MOV ECX,DWORD PTR SS:[EBP+C]
00412A63  ADD EAX,DWORD PTR DS:[ECX+34]
00412A66  ADD EAX,DWORD PTR SS:[EBP-20]
00412A69  MOV DWORD PTR SS:[EBP-20],EAX

//c1 := (c1 shl 7) or (c1 shr $19) + b1;
00412A6C  MOV EAX,DWORD PTR SS:[EBP-20]
00412A6F  SHL EAX,7
00412A72  MOV ECX,DWORD PTR SS:[EBP-20]
00412A75  SHR ECX,19
00412A78  OR EAX,ECX
00412A7A  ADD EAX,DWORD PTR SS:[EBP-14]
00412A7D  MOV DWORD PTR SS:[EBP-20],EAX

//e1 := (e1 shl $0A) or (e1 shr $16);
00412A80  MOV EAX,DWORD PTR SS:[EBP-38]
00412A83  SHL EAX,0A
00412A86  MOV ECX,DWORD PTR SS:[EBP-38]
00412A89  SHR ECX,16
00412A8C  OR EAX,ECX
00412A8E  MOV DWORD PTR SS:[EBP-38],EAX

//b1 := c1 xor d1 xor e1 + Name_64[14] + b1;
00412A91  MOV EAX,DWORD PTR SS:[EBP-20]
00412A94  XOR EAX,DWORD PTR SS:[EBP-2C]
00412A97  XOR EAX,DWORD PTR SS:[EBP-38]
00412A9A  MOV ECX,DWORD PTR SS:[EBP+C]
00412A9D  ADD EAX,DWORD PTR DS:[ECX+38]
00412AA0  ADD EAX,DWORD PTR SS:[EBP-14]
00412AA3  MOV DWORD PTR SS:[EBP-14],EAX

//b1 := (b1 shl 9) or (b1 shr $17) + a1;
00412AA6  MOV EAX,DWORD PTR SS:[EBP-14]
00412AA9  SHL EAX,9
00412AAC  MOV ECX,DWORD PTR SS:[EBP-14]
00412AAF  SHR ECX,17
00412AB2  OR EAX,ECX
00412AB4  ADD EAX,DWORD PTR SS:[EBP-8]
00412AB7  MOV DWORD PTR SS:[EBP-14],EAX

//d1 := (d1 shl $0A) or (d1 shr $16);
00412ABA  MOV EAX,DWORD PTR SS:[EBP-2C]
00412ABD  SHL EAX,0A
00412AC0  MOV ECX,DWORD PTR SS:[EBP-2C]
00412AC3  SHR ECX,16
00412AC6  OR EAX,ECX
00412AC8  MOV DWORD PTR SS:[EBP-2C],EAX

//a1 := b1 xor c1 xor d1 + Name_64[15] + a1;
00412ACB  MOV EAX,DWORD PTR SS:[EBP-14]
00412ACE  XOR EAX,DWORD PTR SS:[EBP-20]
00412AD1  XOR EAX,DWORD PTR SS:[EBP-2C]
00412AD4  MOV ECX,DWORD PTR SS:[EBP+C]
00412AD7  ADD EAX,DWORD PTR DS:[ECX+3C]
00412ADA  ADD EAX,DWORD PTR SS:[EBP-8]
00412ADD  MOV DWORD PTR SS:[EBP-8],EAX

//a1 := (a1 shl 8) or (a1 shr $18) + e1;
00412AE0  MOV EAX,DWORD PTR SS:[EBP-8]
00412AE3  SHL EAX,8
00412AE6  MOV ECX,DWORD PTR SS:[EBP-8]
00412AE9  SHR ECX,18
00412AEC  OR EAX,ECX
00412AEE  ADD EAX,DWORD PTR SS:[EBP-38]
00412AF1  MOV DWORD PTR SS:[EBP-8],EAX

//c1 := (c1 shl $0A) or (c1 shr $16);
00412AF4  MOV EAX,DWORD PTR SS:[EBP-20]
00412AF7  SHL EAX,0A
00412AFA  MOV ECX,DWORD PTR SS:[EBP-20]
00412AFD  SHR ECX,16
00412B00  OR EAX,ECX
00412B02  MOV DWORD PTR SS:[EBP-20],EAX

//e1 := (((a1 and b1) or (not(a1) and c1)) + Name_64[7]) + e1 + $5A827999;
00412B05  MOV EAX,DWORD PTR SS:[EBP-8]
00412B08  AND EAX,DWORD PTR SS:[EBP-14]
00412B0B  MOV ECX,DWORD PTR SS:[EBP-8]
00412B0E  NOT ECX
00412B10  AND ECX,DWORD PTR SS:[EBP-20]
00412B13  OR EAX,ECX
00412B15  MOV EDX,DWORD PTR SS:[EBP+C]
00412B18  ADD EAX,DWORD PTR DS:[EDX+1C]
00412B1B  MOV ECX,DWORD PTR SS:[EBP-38]
00412B1E  LEA EDX,DWORD PTR DS:[ECX+EAX+5A827999]
00412B25  MOV DWORD PTR SS:[EBP-38],EDX

//e1 := (e1 shl 7) or (e1 shr $19) + d1;
00412B28  MOV EAX,DWORD PTR SS:[EBP-38]
00412B2B  SHL EAX,7
00412B2E  MOV ECX,DWORD PTR SS:[EBP-38]
00412B31  SHR ECX,19
00412B34  OR EAX,ECX
00412B36  ADD EAX,DWORD PTR SS:[EBP-2C]
00412B39  MOV DWORD PTR SS:[EBP-38],EAX

//b1 := (b1 shl $0A) or (b1 shr $16);
00412B3C  MOV EAX,DWORD PTR SS:[EBP-14]
00412B3F  SHL EAX,0A
00412B42  MOV ECX,DWORD PTR SS:[EBP-14]
00412B45  SHR ECX,16
00412B48  OR EAX,ECX
00412B4A  MOV DWORD PTR SS:[EBP-14],EAX

//d1 := (((e1 and a1) or (not(e1) and b1)) + Name_64[4]) + d1 + $5A827999;
00412B4D  MOV EAX,DWORD PTR SS:[EBP-38]
00412B50  AND EAX,DWORD PTR SS:[EBP-8]
00412B53  MOV ECX,DWORD PTR SS:[EBP-38]
00412B56  NOT ECX
00412B58  AND ECX,DWORD PTR SS:[EBP-14]
00412B5B  OR EAX,ECX
00412B5D  MOV EDX,DWORD PTR SS:[EBP+C]
00412B60  ADD EAX,DWORD PTR DS:[EDX+10]
00412B63  MOV ECX,DWORD PTR SS:[EBP-2C]
00412B66  LEA EDX,DWORD PTR DS:[ECX+EAX+5A827999]
00412B6D  MOV DWORD PTR SS:[EBP-2C],EDX

返回顶部

下一篇：ikki_CrackMe变形SHA和变形BlowFish逆向分析（… >>