Reversing : The Hacker's Guide to Reverse Engineering

(ff) #1
RtlGetElementGenericTable:
7C9624E0 PUSH EBP
7C9624E1 MOV EBP,ESP
7C9624E3 MOV ECX,DWORD PTR [EBP+8]
7C9624E6 MOV EDX,DWORD PTR [ECX+14]
7C9624E9 MOV EAX,DWORD PTR [ECX+C]
7C9624EC PUSH EBX
7C9624ED PUSH ESI
7C9624EE MOV ESI,DWORD PTR [ECX+10]
7C9624F1 PUSH EDI
7C9624F2 MOV EDI,DWORD PTR [EBP+C]
7C9624F5 CMP EDI,-1
7C9624F8 LEA EBX,DWORD PTR [EDI+1]
7C9624FB JE SHORT ntdll.7C962559
7C9624FD CMP EBX,EDX
7C9624FF JA SHORT ntdll.7C962559
7C962501 CMP ESI,EBX
7C962503 JE SHORT ntdll.7C962554
7C962505 JBE SHORT ntdll.7C96252B
7C962507 MOV EDX,ESI
7C962509 SHR EDX,1
7C96250B CMP EBX,EDX
7C96250D JBE SHORT ntdll.7C96251B
7C96250F SUB ESI,EBX
7C962511 JE SHORT ntdll.7C96254E
7C962513 DEC ESI
7C962514 MOV EAX,DWORD PTR [EAX+4]
7C962517 JNZ SHORT ntdll.7C962513
7C962519 JMP SHORT ntdll.7C96254E
7C96251B TEST EBX,EBX
7C96251D LEA EAX,DWORD PTR [ECX+4]
7C962520 JE SHORT ntdll.7C96254E
7C962522 MOV EDX,EBX
7C962524 DEC EDX
7C962525 MOV EAX,DWORD PTR [EAX]
7C962527 JNZ SHORT ntdll.7C962524
7C962529 JMP SHORT ntdll.7C96254E
7C96252B MOV EDI,EBX
7C96252D SUB EDX,EBX
7C96252F SUB EDI,ESI
7C962531 INC EDX
7C962532 CMP EDI,EDX
7C962534 JA SHORT ntdll.7C962541
7C962536 TEST EDI,EDI
7C962538 JE SHORT ntdll.7C96254E
7C96253A DEC EDI
7C96253B MOV EAX,DWORD PTR [EAX]

Listing 5.2 Disassembly of RtlGetElementGenericTable.

154 Chapter 5

Free download pdf