Functions — github.com/KasperskyLab/hrtng

CodeHub MCPcopy Create free account

hub / github.com/KasperskyLab/hrtng / functions

Functions805 in github.com/KasperskyLab/hrtng

⨍ Functions 805◇ Types & classes 49

↓ 388 callersFunctionLog

src/helpers.cpp:779

↓ 361 callersMethodsize

src/ordered_set.h:80

↓ 149 callersMethodpush_back

Returns true if the item was inserted. False if it was already in the set.

src/ordered_set.h:93

↓ 129 callersMethodappend

src/ordered_set.h:119

↓ 122 callersMethodend

src/ordered_set.h:41

↓ 117 callersMethodbegin

src/ordered_set.h:40

↓ 103 callersMethodempty

src/ordered_set.h:83

↓ 52 callersMethodclear

src/new_struct.cpp:455

↓ 52 callersMethodprint

src/comhelper.cpp:77

↓ 26 callersMethodfront

src/ordered_set.h:44

↓ 25 callersFunctionskipCast

src/helpers.h:214

↓ 23 callersFunctionstripName

src/helpers.cpp:174

↓ 22 callersFunctionmatch

src/refactoring.cpp:190

↓ 19 callersFunctionis_func

↓ 19 callersFunctionis_xmm_reg

src/microavx.cpp:46

↓ 18 callersFunctionsize

src/ctreeg.cpp:132

↓ 17 callersFunctionLogTail

src/helpers.cpp:792

↓ 16 callersFunctionget_ea

src/regrefs.cpp:82

↓ 16 callersFunctionis_mem_op

Return true if the given operand *looks* like a mem op.

src/microavx.cpp:44

↓ 15 callersFunctionExtractNumAndNonNum

For microinstructions with two or more operands (in l and r), check to see if one of them is numeric and the other one isn't. If this is the case, ret

↓ 15 callersFunctionis_avx_reg

src/microavx.cpp:49

↓ 14 callersFunctionclear_upper

Extend the given xmm reg, clearing the upper bits (through ymm).

src/microavx.cpp:74

↓ 13 callersFunctionprintExp

src/helpers.cpp:695

↓ 12 callersFunctionadd

src/refactoring.cpp:243

↓ 12 callersMethodremove

src/ordered_set.h:55

↓ 12 callersFunctionsafe_advance

src/helpers.h:143

↓ 10 callersFunctionaddTarget

src/unflat.cpp:350

↓ 10 callersMethoddeserialize

src/deinline.cpp:642

↓ 10 callersFunctionisRegOvar

src/helpers.h:213

↓ 9 callersFunctionXXable_inlines

src/deinline.cpp:1916

↓ 9 callersFunctiongetType4Name

src/helpers.cpp:78

↓ 9 callersFunctionreplaceExp

src/helpers.cpp:711

↓ 9 callersFunctionunique_nameD

src/helpers.h:262

↓ 8 callersFunctionFindInsWithTheOp

This function traces the operand until getting the instruction with it

src/opt.cpp:288

↓ 8 callersMethodback

src/ordered_set.h:45

↓ 8 callersFunctioncreate_type_from_size

src/helpers.cpp:148

↓ 8 callersFunctiongood_udm_name

src/helpers.cpp:242

↓ 7 callersFunctionFindBlockTargetOrLastCopy

This function attempts to locate the numeric assignment to a given variable "what" starting from the end of the block "mb". It follows definitions bac

src/unflat.cpp:1461

↓ 7 callersFunctionTunnelThroughAnd1

The obfuscation techniques upon conditional operations have "&1" miscellaneously present or not present within them. Writing pattern-matching rules fo

↓ 7 callersFunctionkill_toolbar

src/hrtng.cpp:3440

↓ 7 callersFunctionrenameExp

src/rename.cpp:596

↓ 6 callersFunctionCopyBlocksAndConnectPredNDest

src/unflat.cpp:1619

↓ 6 callersFunctionadd_proc2memb_ref

src/structures.cpp:1168

↓ 6 callersFunctiondecrypt_string

src/decr.cpp:716

↓ 6 callersFunctionisMsig

src/msig.cpp:451

↓ 6 callersFunctionisRenameble

src/helpers.h:215

↓ 6 callersMethodserialize

src/deinline.cpp:632

↓ 6 callersFunctiontype_by_tid

src/structures.cpp:532

↓ 6 callersFunctionufIsInGL

src/unflat.cpp:91

↓ 5 callersFunctionExtractLogicallyNegatedTerm

The obfuscator implements boolean inversion via "x ^ 1". Hex-Rays, or one of our other deobfuscation rules, could also convert these to m_lnot instruc

src/opt.cpp:162

↓ 5 callersFunctionInsertOp

Put an mop_t into an mlist_t. The op must be either a register or a stack variable.

src/opt.cpp:267

↓ 5 callersFunctionProcessErasures

Erase the now-superfluous chain of instructions that were used to copy a numeric value into the assignment variable.

src/unflat.cpp:1732

↓ 5 callersFunctionShowMicrocodeExplorer

src/MicrocodeExplorer.cpp:752

↓ 5 callersFunctionadd_patch_cmt

src/helpers.cpp:332

↓ 5 callersFunctionchain_append_list

src/helpers.h:114

↓ 5 callersFunctioneRFkindName

src/refactoring.cpp:60

↓ 5 callersMethodhas_item

src/ordered_set.h:87

↓ 5 callersFunctionisDummyType

src/helpers.h:216

↓ 5 callersFunctionisVarNameGood

for Vars and Args only (globals and struct members have own checks)

src/rename.cpp:50

↓ 5 callersFunctionis_our

src/new_struct.cpp:27

↓ 5 callersFunctionll_error

src/lit.cpp:104

↓ 5 callersFunctionmake_pattern_wcheck

src/idb2pat.cpp:525

↓ 5 callersFunctionstruct_get_member

src/structures.cpp:107

↓ 5 callersMethodtypes_at_idx_qty

src/new_struct.cpp:468

↓ 4 callersFunctionAppendGoto

src/unflat.cpp:928

↓ 4 callersFunctionGetBlk

src/unflat.cpp:1168

↓ 4 callersFunctionaddType

src/hrtng.cpp:1078

↓ 4 callersFunctionappendComment

src/helpers.cpp:537

↓ 4 callersFunctionclear

src/new_struct.h:42

↓ 4 callersFunctiondecrypt_str

src/decr.cpp:152

↓ 4 callersMethoddestroy

src/deinline.cpp:580

↓ 4 callersFunctiongetBasePath

src/deinline.cpp:1080

↓ 4 callersFunctiongetGotoTargEa

src/deob.cpp:247

↓ 4 callersFunctionget_assign_or_helper

src/hrtng.cpp:3063

↓ 4 callersFunctionget_idx

src/appcall_view.cpp:85

↓ 4 callersFunctionget_memb2proc_ref

src/structures.cpp:1196

↓ 4 callersFunctionget_name_ea_ex

ATT: it may change 'name'

src/helpers.cpp:598

↓ 4 callersFunctionisNamedTypeExists

src/helpers.cpp:115

↓ 4 callersFunctionisUfJc

src/unflat.cpp:118

↓ 4 callersFunctionis_arg_var

src/hrtng.cpp:970

↓ 4 callersFunctionis_number

-----------------------------------------------------

src/hrtng.cpp:2116

↓ 4 callersFunctionis_stack_var_assign

src/hrtng.cpp:3901

↓ 4 callersFunctionmatch_minsn

src/deinline.cpp:372

↓ 4 callersFunctionmatch_mop

src/deinline.cpp:318

↓ 4 callersFunctionmreg2regWchk

src/deinline.cpp:1282

↓ 4 callersFunctionmy_find_def_backwards

Walks backwards through a block, looking at what each instruction defines. It stops when it finds definitions for everything in the mlist_t, or when i

src/opt.cpp:277

↓ 4 callersFunctionpatch_nops

src/helpers.cpp:354

↓ 4 callersFunctionprint_struct_member_name

src/structures.cpp:223

↓ 4 callersFunctionreplace_colortag_inplace

src/helpers.cpp:684

↓ 4 callersFunctionsetComment4Exp

src/helpers.cpp:550

↓ 4 callersFunctionset_var_type

src/hrtng.cpp:2240

↓ 4 callersFunctionufIsInWL

src/unflat.cpp:82

↓ 4 callersFunctionwrite_cmt_or_ptch

src/appcall_view.cpp:189

↓ 3 callersFunctionCopyMinsns

src/unflat.cpp:1538

↓ 3 callersFunctionExtractByOpcodeType

For microinstructions with two or more operands (in l and r), check to see if one of them is a mop_d (result of another microinstruction), where the p

↓ 3 callersFunctionPostHandleTwoPreds

src/unflat.cpp:1633

↓ 3 callersFunctionSerializeInsn

src/msig.cpp:112

↓ 3 callersFunctionSerializeOp

src/msig.cpp:49

↓ 3 callersFunctionadd

src/deinline.cpp:72

↓ 3 callersFunctionadd_bb

src/deob.cpp:1091

next →1–100 of 805, ranked by callers