Reversing : The Hacker's Guide to Reverse Engineering

00401051 LEA EDX,SS:[ESP+18] ;

00401055 PUSH EDX ; pOffsetHi

00401056 PUSH EAX ; OffsetLo

00401057 PUSH ESI ; hFile

00401058 CALL DS:[<&KERNEL32.SetFilePointer>]

0040105E PUSH 0 ; pOverlapped = NULL

00401060 LEA EAX,SS:[ESP+C] ;

00401064 PUSH EAX ; pBytesRead

00401065 PUSH 1008 ; BytesToRead = 1008 (4104.)

0040106A PUSH cryptex.00405050 ; Buffer = cryptex.00405050

0040106F PUSH ESI ; hFile

00401070 CALL DS:[<&KERNEL32.ReadFile>]

00401076 TEST EAX,EAX

00401078 JE SHORT cryptex.004010CB

0040107A MOV EAX,SS:[ESP+18]

0040107E TEST EAX,EAX

00401080 MOV DWORD PTR SS:[ESP+14],1008

00401088 JE SHORT cryptex.004010C2

0040108A LEA ECX,SS:[ESP+14]

0040108E PUSH ECX

0040108F PUSH cryptex.00405050

00401094 PUSH 0

00401096 PUSH 1

00401098 PUSH 0

0040109A PUSH EAX

0040109B CALL DS:[<&ADVAPI32.CryptDecrypt>]

004010A1 TEST EAX,EAX

004010A3 JNZ SHORT cryptex.004010C2

004010A5 CALL DS:[<&KERNEL32.GetLastError>]

004010AB PUSH EDI ; <%d>

004010AC PUSH cryptex.004030E8 ; format = “ERROR: Unable to

decrypt block from cluster %d.”

004010B1 CALL DS:[<&MSVCR71.printf>]

004010B7 ADD ESP,8

004010BA PUSH 1 ; status = 1

004010BC CALL DS:[<&MSVCR71.exit>]

004010C2 POP EDI

004010C3 MOV EAX,cryptex.00405050

004010C8 POP ESI

004010C9 POP ECX

004010CA RETN

004010CB POP EDI

004010CC XOR EAX,EAX

004010CE POP ESI

004010CF POP ECX

004010D0 RETN

Listing 6.7 (continued)

222 Chapter 6