Functions — github.com/KasperskyLab/hrtng

CodeHub MCPcopy Create free account

hub / github.com/KasperskyLab/hrtng / functions

Functions805 in github.com/KasperskyLab/hrtng

⨍ Functions 805◇ Types & classes 49

↓ 3 callersFunctionassign2astr

src/hrtng.cpp:3980

↓ 3 callersFunctioncan_be_converted_to_ptr

src/new_struct.cpp:246

↓ 3 callersFunctionconfirm_create_struct

src/structures.cpp:1127

↓ 3 callersFunctionconvert_cc_to_special

src/hrtng.cpp:734

↓ 3 callersFunctioncreate_VT_struc

src/structures.cpp:575

↓ 3 callersFunctiondecompile

src/hrtng.cpp:3679

↓ 3 callersFunctiondeinline_reset

src/deinline.cpp:1870

↓ 3 callersFunctiondeob_done

src/deob.cpp:670

↓ 3 callersFunctiondummy_struct_name

src/hrtng.cpp:3079

↓ 3 callersFunctionfind_if_statement

-------------------------------------------------------------------------- Check if the item under the cursor is 'if' or 'else' keyword If yes, return

src/invert_if.cpp:109

↓ 3 callersFunctionfind_ref_loc

_____________________________________________________________________________ -----------------------------------------------------------------------

src/idb2pat.cpp:121

↓ 3 callersMethodget

src/deinline.cpp:587

↓ 3 callersFunctiongetCallInfo

src/helpers.cpp:667

↓ 3 callersFunctiongetKeyFromValranges

src/unflat.cpp:292

↓ 3 callersFunctiongetLiteralString

src/lit.cpp:244

↓ 3 callersFunctiongetStringFromMem

src/appcall.cpp:78

↓ 3 callersFunctionget_call_dst

src/helpers.cpp:608

↓ 3 callersFunctionget_idx_of

src/helpers.h:157

↓ 3 callersFunctionget_int_idc_value

src/appcall.cpp:449

↓ 3 callersFunctionget_memb2proc_refs

src/structures.cpp:1182

↓ 3 callersFunctiongood_smember_name

src/helpers.cpp:263

↓ 3 callersFunctionhasInlines

src/deinline.cpp:1904

↓ 3 callersFunctionhas_varvals

src/varval.cpp:66

↓ 3 callersFunctionidcVal2str

src/appcall.cpp:539

↓ 3 callersFunctionisCompare

src/unflat.cpp:326

↓ 3 callersFunctionis_VT_assign

src/hrtng.cpp:671

↓ 3 callersFunctionis_appcallable

src/appcall.cpp:95

↓ 3 callersFunctionis_array_char_assign

src/hrtng.cpp:4205

↓ 3 callersFunctionis_decryptable_obj

src/hrtng.cpp:4352

↓ 3 callersFunctionis_ea

src/helpers.cpp:129

↓ 3 callersFunctionis_gap_field

src/hrtng.cpp:2487

↓ 3 callersFunctionis_recastable

src/hrtng.cpp:2429

↓ 3 callersFunctionis_reincast

src/cast.cpp:79

↓ 3 callersFunctionis_stack_var_assign_int

-------------------------------------------------------------------------- stack strings

src/hrtng.cpp:3844

↓ 3 callersFunctionjump_to_call_or_glbl

-------------------------------------------------------------------------

src/callrefs.cpp:280

↓ 3 callersFunctionmsig_add

src/msig.cpp:385

↓ 3 callersFunctionmsig_rename

src/msig.cpp:406

↓ 3 callersFunctionoffset_for_var_idx

var with index idx is ptr to struct+returned_value

src/new_struct.cpp:52

↓ 3 callersFunctionoptype

src/deinline.cpp:109

↓ 3 callersFunctionpatch_jmp

src/helpers.cpp:364

↓ 3 callersFunctionpatch_str

src/helpers.cpp:474

↓ 3 callersFunctionpatch_wstr

src/helpers.cpp:492

↓ 3 callersFunctionrenameEa

src/rename.cpp:273

↓ 3 callersFunctionreplaceReadOnlyInitedVar2Val

This function checks whether the operand is a global variable unchanged since the initialization and replaces op with variable value

src/opt.cpp:607

↓ 3 callersFunctionselection2inline

src/deinline.cpp:1710

↓ 3 callersFunctionset_v_bytes

_____________________________________________________________________________ marks off bytes as variable

src/idb2pat.cpp:146

↓ 3 callersFunctionstore_operand_hack

XXX: why is there a load_operand(), but no inverse.. ?

src/microavx.cpp:84

↓ 3 callersFunctionstr2idcVal

src/appcall.cpp:559

↓ 3 callersFunctionstrtobx

src/helpers.cpp:45

↓ 3 callersFunctionufAddGL

src/unflat.cpp:95

↓ 3 callersFunctionufIsInFL

src/unflat.cpp:104

↓ 3 callersMethodvalidateReplace

--------------------------------------------------------------------------

src/refactoring.cpp:746

↓ 2 callersFunctionAdd

src/unflat.cpp:1156

↓ 2 callersFunctionAppendInsnCopyAndConnect

src/unflat.cpp:1612

↓ 2 callersFunctionCopyMblock

src/unflat.cpp:1569

↓ 2 callersFunctionFindTargets4TwoPreds

This function is used for unflattening constructs that have two successors, such as if statements. Given a block that assigns to the assignment variab

src/unflat.cpp:1496

↓ 2 callersFunctionGetDominatedClusterHead

Find the block that dominates iDispPred, and which is one of the targets of the control flow flattening switch.

src/unflat.cpp:1302

↓ 2 callersFunctionGetIncrBlockNum

src/MicrocodeExplorer.cpp:259

↓ 2 callersFunctionInsGraphCheck

src/MicrocodeExplorer.cpp:537

↓ 2 callersFunctionMakeGotoBlock

src/unflat.cpp:1597

↓ 2 callersFunctionOptimizeInsn

This function just inspects the instruction and calls the pattern-replacement functions above to perform deobfuscation.

src/opt.cpp:1089

↓ 2 callersFunctionPruneUnreachable

The goto-to-goto elimination and unflattening remove edges in the control flow graph. As a result, certain blocks might no longer be reachable anymore

src/unflat.cpp:981

↓ 2 callersFunctionSplitMblocksByJccEnding

For a block with two predecessors, figure out if one of them ends in a jcc instruction. Return the block that ends in a jcc and the one that doesn't.

src/unflat.cpp:910

↓ 2 callersFunctionTraceAndExtractOpsMovAndSubBy1

This function traces 2 operands separately for x and y in y * (x - 1)

src/opt.cpp:334

↓ 2 callersFunction_v_math_ss_sd

VADDSS xmm1, xmm2, xmm3/m32 VADDSD xmm1, xmm2, xmm3/m64 Templated handler for scalar float/double math instructions.

src/microavx.cpp:752

↓ 2 callersFunction_vmov

VMOVD xmm1, r32/m32 VMOVD r32/m32, xmm1 VMOVQ xmm1, r64/m64 VMOVQ r64/m64, xmm1 VMOVAPS xmm1, xmm2/m128 VMOVAPS ymm1, ymm2/m256 VMOVAPS xm

src/microavx.cpp:604

↓ 2 callersFunction_vmov_ss_sd

VMOVSS xmm1, xmm2, xmm3 VMOVSS xmm1, m32 VMOVSS m32, xmm1 VMOVSD xmm1, m64 VMOVSD m64, xmm1 Templated handler for scalar float/double mov instructions

src/microavx.cpp:555

↓ 2 callersFunctionaddOffType

src/hrtng.cpp:1664

↓ 2 callersFunctionadd_cached_cast

src/cast.cpp:481

↓ 2 callersFunctionadd_vt_member

src/structures.cpp:487

↓ 2 callersFunctionadjust_substruct

src/new_struc_view.cpp:124

↓ 2 callersFunctionassign2wstr

src/hrtng.cpp:3969

↓ 2 callersFunctionat_atoea

src/helpers.cpp:36

↓ 2 callersFunctioncallOrJmp2InitedVar

icall cs.2, ($off_1400197B8.8+#0x44927437A5E3AB1C.8)

src/deob.cpp:105

↓ 2 callersFunctioncan_be_n_recast

src/cast.cpp:507

↓ 2 callersFunctioncan_be_reincast

src/cast.cpp:139

↓ 2 callersFunctioncan_be_reincasted

returns exp be used as anchor

src/cast.cpp:127

↓ 2 callersFunctionchkDataHash

src/apihashes.cpp:289

↓ 2 callersFunctionchkVal

src/apihashes.cpp:392

↓ 2 callersFunctionclose_new_struc_view

src/new_struc_view.cpp:504

↓ 2 callersFunctioncollect_block_xrefs

--------------------------------------------------------------------------

src/regrefs.cpp:22

↓ 2 callersFunctioncollect_xrefs

--------------------------------------------------------------------------

src/regrefs.cpp:35

↓ 2 callersFunctioncom_find_guid_type

if type for guis is not found, the "tname" is initialized with GUID string

src/comhelper.cpp:163

↓ 2 callersFunctionconvert

converts "x + n" to "&((struc*)x)->member.submemb1.submemb2" or "(char*)&((struc*)x)->member + remainder" or "&(reinterpret_cast<struc*>x)->member.sub

src/cast.cpp:163

↓ 2 callersFunctioncreate_dec_file

src/hrtng.cpp:3588

↓ 2 callersFunctioncreate_from_head_exit

src/deinline.cpp:717

↓ 2 callersFunctionctor_class_name

returns true if constructor

src/helpers.cpp:300

↓ 2 callersFunctioncv_jump

src/MicrocodeExplorer.cpp:502

↓ 2 callersFunctiondecompile_obfuscated

src/deob.cpp:1278

↓ 2 callersFunctiondecompile_recursive

src/hrtng.cpp:3761

↓ 2 callersFunctiondecr_core

returns decrypted len, 0 if error

src/decr.cpp:474

↓ 2 callersFunctiondecr_init

src/decr.cpp:294

↓ 2 callersFunctiondecr_set_iv

convert IV representation

src/decr.cpp:418

↓ 2 callersFunctiondecr_set_key

convert key representation

src/decr.cpp:334

↓ 2 callersFunctiondeob_postprocess

returns 'true' only on final pass changes

src/deob.cpp:917

↓ 2 callersFunctiondo_invert_if

-------------------------------------------------------------------------- The user has selected to invert the if statement. Update ctree and refresh

src/invert_if.cpp:76

↓ 2 callersFunctioneRFname2kind

src/refactoring.cpp:77

↓ 2 callersFunctionfindStrucMembersByName

src/hrtng.cpp:5446

↓ 2 callersFunctionfind_cached_cast

src/cast.cpp:489

↓ 2 callersFunctiongetBr

src/hrtng.cpp:4730

← previous next →101–200 of 805, ranked by callers