cdkey3 - www.skullsecurity.org

cdkey3

; Continuation from cdkey2 asm practice, this time we look at simple function call
; and try to interpret what this asm code does.
; esi = cdkey

    mov     ebp, 13AC9741h            ; ebp = 0x13AC9741
    mov     ebx, 0Bh                  ; ebx = 11

top:
    movsx   eax, byte ptr [ebx+esi]   ; eax = cdkey[ebx]
    push    eax                       ; arg for function call
    call    _toupper                  ; Call toupper(ebx), eax = return value of toupper(ebx)
    add     esp, 4                    ; Fix the stack (don't worry about this)
    cmp     al, 37h                   ; cmp al to 0x37, not sure what the return value after toupper function call?
    mov     byte ptr [ebx+esi], al    ; move 0x?? to cdkey[ebx]
    jg      short body1               ; jump to short1 if al>0x37
    mov     ecx, ebp                  ; ecx = 0x13AC9741
    mov     dl, cl                    ; dl = 0x41
    and     dl, 7                     ; 0x41 & 0x07 = 1. dl = 1
    xor     dl, al                    ; 0x01 ^ 0x??.  dl = 0x?? 
    shr     ecx, 3                    ; bit shift right by 3 position, ecx / 2^3. ecx = 0x27592E8
    mov     byte ptr [ebx+esi], dl    ; move 0x?? to cdkey[ebx]
    mov     ebp, ecx                  ; ebp = 0x27592E8
    jmp     short body2               ; jump to body2

body1:
    cmp     al, 41h                   ; 0x?? cmp 0x41
    jge     short body2               ; jump to body2 if al >= 0x41
    mov     cl, bl                    
    and     cl, 1                     ; cl = cl & 1
    xor     cl, al                    ; cl = cl ^ al
    mov     byte ptr [ebx+esi], cl    ; cdkey[ebx] = cl

body2:
    dec     ebx                       ; ebx = ebx - 1
    jns     short top                 ; jump back up to top