Skip to content

Instantly share code, notes, and snippets.

@ghoulgy

ghoulgy/llvm_obfuscated_sample.cpp

Created February 5, 2022 14:37
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save ghoulgy/b1eb1e7e2ae4df807eb71aaff2d2337f to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save ghoulgy/b1eb1e7e2ae4df807eb71aaff2d2337f to your computer and use it in GitHub Desktop.
Download ZIP
[RedDev Series #4] LLVM obfuscated psudocode
Raw
llvm_obfuscated_sample.cpp
__int64 __fastcall sub_140004430(int a1)
{
unsigned int v1; // edi
int v2; // er12
unsigned int v3; // er13
int v5; // eax
unsigned int v6; // edx
bool v7; // bl
unsigned __int8 v8; // cl
bool v9; // dl
int v10; // esi
unsigned int v11; // edx
bool v12; // al
bool v13; // dl
char v14; // cl
char v15; // cl
unsigned int v16; // ecx
bool v17; // dl
char v18; // cl
int v19; // esi
char v20; // cl
unsigned int v21; // ecx
bool v22; // bl
bool v23; // dl
bool v24; // cl
int v25; // ebp
char v26; // cl
unsigned int v27; // edx
char v28; // cl
char v29; // dl
int v30; // ebp
bool v31; // bl
char v32; // dl
int v33; // ebp
int v34; // esi
unsigned __int8 v35; // dl
unsigned int v36; // ebp
unsigned int v37; // edx
bool v38; // al
bool v39; // bl
bool v40; // dl
bool v41; // cl
int v42; // esi
char v43; // cl
unsigned int v44; // edx
bool v45; // al
char v46; // dl
bool v47; // bl
bool v48; // dl
int v49; // esi
int v50; // esi
int v51; // ebp
unsigned int v52; // ecx
bool v54; // [rsp+2Ch] [rbp-5Ch]
bool v55; // [rsp+2Dh] [rbp-5Bh]
bool v56; // [rsp+2Eh] [rbp-5Ah]
bool v57; // [rsp+2Fh] [rbp-59h]
unsigned int v58; // [rsp+30h] [rbp-58h]
bool v59; // [rsp+37h] [rbp-51h]
unsigned int v60; // [rsp+38h] [rbp-50h]
int v61; // [rsp+3Ch] [rbp-4Ch]
v54 = (~(((~(dword_14001214C * (dword_14001214C - 1)) & 0x7B867B2B | (dword_14001214C * (dword_14001214C - 1)) & 0x847984D4) ^ 0x847984D4) & 0xFFFFFFFE | (~(dword_14001214C * (dword_14001214C - 1)) & 0x7B867B2B | (dword_14001214C * (dword_14001214C - 1)) & 0x847984D4) ^ 0x7B867B2A) & 0xFF10192F | ((~(dword_14001214C * (dword_14001214C - 1)) & 0x7B867B2B | (dword_14001214C * (dword_14001214C - 1)) & 0x847984D4) ^ 0x847984D4) & 0xEFE6D0 | ((~(dword_14001214C * (dword_14001214C - 1)) & 0x7B867B2B | (dword_14001214C * (dword_14001214C - 1)) & 0x847984D4) ^ 0x7B867B2A) & 0xEFE6D0) == 0xEFE6D0;
v55 = dword_140012150 < 10;
v5 = 347117341;
while ( 1 )
{
while ( 1 )
{
LABEL_5:
while ( v5 <= 439295779 )
{
if ( v5 <= 209750761 )
{
if ( v5 == -673838089 )
goto LABEL_69;
if ( v5 == -345390353 )
{
v44 = (~(dword_14001214C * (dword_14001214C - 1)) & 0x80C88541 | (dword_14001214C * (dword_14001214C - 1)) & 0x7F377ABE) ^ 0x7F377ABF;
v45 = (v44 & (v44 ^ ~(dword_14001214C * (dword_14001214C - 1)))) != 0;
v28 = ((v44 & (v44 ^ ~(dword_14001214C * (dword_14001214C - 1)))) == 0) ^ (dword_140012150 < 10);
v46 = (v45 && dword_140012150 > 9) | v45 ^ (dword_140012150 > 9);
v5 = -1994909853;
if ( v28 == v46 )
v5 = -1740198421;
v30 = v5;
if ( !v46 )
v30 = -1740198421;
goto LABEL_96;
}
if ( v5 != -242721938 )
goto LABEL_4;
v5 = 295850271;
v2 = 1;
}
else if ( v5 > 347117340 )
{
if ( v5 == 347117341 )
{
v50 = -853117837;
v5 = 439295780;
v51 = -853117837;
if ( (((!v55 && !v54) | !v55 ^ !v54) & 1) == 0 )
v51 = 439295780;
if ( ((v54 ^ v55) & 1) != 0 )
v50 = v51;
if ( ((v54 ^ v55 ^ ((!v55 && !v54) | !v55 ^ !v54)) & 1) != 0 )
v5 = v50;
if ( v5 <= -673838090 )
{
while ( 1 )
{
while ( 1 )
{
while ( 1 )
{
LABEL_10:
while ( v5 > -1405473200 )
{
if ( v5 <= -1051584166 )
{
if ( v5 == -1405473199 )
{
v5 = -1040151695;
if ( v56 )
goto LABEL_4;
v5 = -673838089;
}
else if ( v5 == -1223443054 )
{
v5 = 1109154448;
v3 = v58;
}
else
{
v5 = 209750762;
if ( v57 )
goto LABEL_4;
v5 = 1945631178;
}
goto LABEL_5;
}
if ( v5 > -873674621 )
{
if ( v5 != -873674620 )
{
if ( v5 != -853117837 )
goto LABEL_4;
sub_1400014C0();
v5 = 439295780;
goto LABEL_5;
}
v5 = -1956409894;
}
else if ( v5 == -1051584165 )
{
v31 = (~((((~(dword_14001214C * (dword_14001214C - 1)) & 0xDDA5908E | (dword_14001214C
* (dword_14001214C - 1)) & 0x225A6F71) ^ 0xD001808A) & 0xF0018C9B | ((~(dword_14001214C * (dword_14001214C - 1)) & 0xDDA5908E | (dword_14001214C * (dword_14001214C - 1)) & 0x225A6F71) ^ 0x225A6F71) & 0xFFE7364) ^ 0xFFE7365 | ((~(dword_14001214C * (dword_14001214C - 1)) & 0xDDA5908E | (dword_14001214C * (dword_14001214C - 1)) & 0x225A6F71) ^ 0x225A6F71) & 0xFFFFFFFE) & 0xBCC69143 | ((((~(dword_14001214C * (dword_14001214C - 1)) & 0xDDA5908E | (dword_14001214C * (dword_14001214C - 1)) & 0x225A6F71) ^ 0xD001808A) & 0xF0018C9B | ((~(dword_14001214C * (dword_14001214C - 1)) & 0xDDA5908E | (dword_14001214C * (dword_14001214C - 1)) & 0x225A6F71) ^ 0x225A6F71) & 0xFFE7364) ^ 0xFFE7365) & 0x43396EBC | ((~(dword_14001214C * (dword_14001214C - 1)) & 0xDDA5908E | (dword_14001214C * (dword_14001214C - 1)) & 0x225A6F71) ^ 0x225A6F71) & 0x43396EBC) == 0x43396EBC;
v32 = v31 ^ (dword_140012150 > 9);
v33 = 2063599646;
v5 = -1454101977;
v34 = 2063599646;
if ( !(v31 ^ (dword_140012150 < 10) | (!v31 && dword_140012150 >= 10)) )
v34 = -1454101977;
if ( !v32 )
v33 = v34;
if ( v32 != (v31 ^ (dword_140012150 < 10) | (!v31 && dword_140012150 >= 10)) )
goto LABEL_4;
v5 = v33;
if ( v33 > -673838090 )
goto LABEL_5;
}
else
{
v11 = (~(dword_14001214C * (dword_14001214C - 1)) & 0x1AAAE6C4 | (dword_14001214C
* (dword_14001214C - 1)) & 0xE555193B) ^ 0xE555193A;
v12 = (v11 & (v11 ^ ~(dword_14001214C * (dword_14001214C - 1)))) == 0;
v13 = dword_140012150 < 10 && (v11 & (v11 ^ ~(dword_14001214C * (dword_14001214C - 1)))) != 0
|| v12 && dword_140012150 > 9;
v14 = v12 ^ (dword_140012150 < 10) | (!v12 && dword_140012150 >= 10);
v5 = -1513270377;
if ( !v14 )
v5 = -1499401733;
v15 = v13 ^ v14;
if ( !v13 )
v5 = -1513270377;
if ( v15 )
goto LABEL_4;
LABEL_30:
v5 = -1499401733;
}
}
if ( v5 <= -1740198422 )
break;
if ( v5 > -1499401734 )
{
if ( v5 == -1499401733 )
{
v47 = (~(~(dword_14001214C * (dword_14001214C - 1)) & 0xFFFFFFFE | (dword_14001214C
* (dword_14001214C - 1)) ^ 1) & 0x45A9F432 | ~(dword_14001214C * (dword_14001214C - 1)) & 0xBA560BCC | ((dword_14001214C * (dword_14001214C - 1)) ^ 1) & 0xBA560BCD) != 0xBA560BCD;
v48 = v47 || dword_140012150 > 9;
v5 = -1513270377;
v49 = 347832864;
if ( (dword_140012150 <= 9
|| (~(~(dword_14001214C * (dword_14001214C - 1)) & 0xFFFFFFFE | (dword_14001214C
* (dword_14001214C - 1)) ^ 1) & 0x45A9F432 | ~(dword_14001214C * (dword_14001214C - 1)) & 0xBA560BCC | ((dword_14001214C * (dword_14001214C - 1)) ^ 1) & 0xBA560BCD) != 0xBA560BCD)
&& (!v47 || dword_140012150 >= 10) )
{
v49 = -1513270377;
}
if ( !v48 )
v5 = v49;
if ( v48 != (dword_140012150 > 9
&& (~(~(dword_14001214C * (dword_14001214C - 1)) & 0xFFFFFFFE | (dword_14001214C
* (dword_14001214C - 1)) ^ 1) & 0x45A9F432 | ~(dword_14001214C * (dword_14001214C - 1)) & 0xBA560BCC | ((dword_14001214C * (dword_14001214C - 1)) ^ 1) & 0xBA560BCD) == 0xBA560BCD
|| v47 && dword_140012150 < 10) )
goto LABEL_4;
v5 = 347832864;
}
else
{
v21 = (~(dword_14001214C * (dword_14001214C - 1)) & 0xD6F8576B | (dword_14001214C
* (dword_14001214C - 1)) & 0x2907A894) ^ 0x2907A895;
v22 = (v21 & (v21 ^ ~(dword_14001214C * (dword_14001214C - 1)))) != 0;
v23 = v22 || dword_140012150 > 9;
v24 = dword_140012150 > 9 && (v21 & (v21 ^ ~(dword_14001214C * (dword_14001214C - 1)))) == 0
|| v22 && dword_140012150 < 10;
v5 = 2063599646;
v25 = 1379758927;
if ( !v24 )
v25 = 2063599646;
v26 = v23 ^ v24;
if ( !v23 )
v5 = v25;
if ( v26 )
goto LABEL_4;
v5 = 1379758927;
}
goto LABEL_5;
}
if ( v5 != -1740198421 )
goto LABEL_30;
v58 = v60 + 1;
v27 = ~(dword_14001214C * (dword_14001214C - 1)) | (~(dword_14001214C * (dword_14001214C - 1)) & 0x68799B4F | (dword_14001214C * (dword_14001214C - 1)) & 0x978664B0) ^ 0x68799B4E;
v28 = (v27 == -1) ^ (dword_140012150 < 10);
v29 = (v27 != -1 && dword_140012150 > 9) | (v27 != -1) ^ (dword_140012150 > 9);
v5 = -1994909853;
if ( v28 == v29 )
v5 = -1223443054;
v30 = v5;
if ( !v29 )
v30 = -1223443054;
LABEL_96:
if ( v28 )
v5 = v30;
}
if ( v5 != -1994909853 )
break;
v5 = -1740198421;
}
if ( v5 != -1987620613 )
break;
v57 = v60 < dword_1400111A0[0];
v36 = ((dword_14001214C * (dword_14001214C - 1)) & 0x7FC1649C | ~(dword_14001214C * (dword_14001214C - 1)) & 0x803E9B63) ^ 0x803E9B62;
v37 = ~(v36 | ~(dword_14001214C * (dword_14001214C - 1)) & 0xFFFFFFFE) & 0x75D2E08;
v38 = (v37 | v36 & 0xF8A2D1F7 | ~(dword_14001214C * (dword_14001214C - 1)) & 0xF8A2D1F6) != 0xF8A2D1F7;
v39 = dword_140012150 > 9
&& (v37 | v36 & 0xF8A2D1F7 | ~(dword_14001214C * (dword_14001214C - 1)) & 0xF8A2D1F6) == 0xF8A2D1F7;
v40 = v38 || dword_140012150 > 9;
v41 = v39 || v38 && dword_140012150 < 10;
v5 = 1814130361;
v42 = -1193972481;
if ( !v41 )
v42 = 1814130361;
v43 = v40 ^ v41;
if ( !v40 )
v5 = v42;
if ( v43 )
goto LABEL_4;
v5 = -1193972481;
}
v59 = v61 == 2;
v16 = ~(dword_14001214C * (dword_14001214C - 1)) & 0xFFFFFFFE | (dword_14001214C * (dword_14001214C - 1)) ^ 1;
v17 = v16 != -1 || dword_140012150 > 9;
v18 = (v16 == -1) ^ (dword_140012150 < 10);
v5 = -873674620;
v19 = 1282247834;
if ( !v18 )
v19 = -873674620;
v20 = v17 ^ v18;
if ( !v17 )
v5 = v19;
if ( v20 )
goto LABEL_4;
v5 = 1282247834;
}
}
else
{
v5 = 1109154448;
v3 = 0;
}
}
else
{
if ( v5 != 209750762 )
{
v61 = v2;
v6 = ~(dword_14001214C * (dword_14001214C - 1)) | (~(dword_14001214C * (dword_14001214C - 1)) & 0x359CE073 | (dword_14001214C * (dword_14001214C - 1)) & 0xCA631F8C) ^ 0x359CE072;
v7 = v6 != -1;
v8 = v7 || dword_140012150 > 9;
v9 = dword_140012150 > 9 && v6 == -1 || v7 && dword_140012150 < 10;
v10 = -873674620;
v5 = -1956409894;
if ( v9 == v8 )
v10 = -1956409894;
if ( !v9 )
v5 = v10;
goto LABEL_2;
}
v5 = -242721938;
if ( dword_1400111A0[2 * v60 + 1] == a1 )
goto LABEL_4;
v5 = -345390353;
}
}
if ( v5 <= 1379758926 )
break;
if ( v5 > 1945631177 )
{
if ( v5 != 1945631178 )
{
v5 = -1454101977;
goto LABEL_10;
}
v5 = 295850271;
v2 = 2;
}
else
{
if ( v5 != 1379758927 )
{
v5 = -1987620613;
goto LABEL_10;
}
LABEL_69:
v5 = 855507177;
v1 = -1;
}
}
if ( v5 <= 1109154447 )
break;
if ( v5 == 1109154448 )
{
v60 = v3;
v35 = (dword_140012150 < 10) ^ ((((dword_14001214C * (dword_14001214C - 1)) & 0x33532F68 | ~(dword_14001214C
* (dword_14001214C - 1)) & 0xCCACD097) ^ 0xCCACD096 | ~(dword_14001214C * (dword_14001214C - 1)) & 0xFFFFFFFE) == -1);
v8 = !v35 && dword_140012150 < 10;
v5 = 1814130361;
v10 = -1987620613;
if ( v8 != !v35 )
goto LABEL_118;
v5 = -1987620613;
if ( v35 )
goto LABEL_2;
LABEL_119:
v10 = v5;
LABEL_2:
if ( v8 )
v5 = v10;
LABEL_4:
if ( v5 <= -673838090 )
goto LABEL_10;
}
else
{
v5 = -1051584165;
if ( !v59 )
v5 = 855507177;
v1 = v60;
if ( v5 <= -673838090 )
goto LABEL_10;
}
}
if ( v5 == 439295780 )
{
v56 = (unsigned int)sub_1400014C0() != 0;
v52 = ~(dword_14001214C * (dword_14001214C - 1)) & 0xFFFFFFFE | (dword_14001214C * (dword_14001214C - 1)) & 1;
v35 = (dword_140012150 < 10) ^ ((v52 & (v52 ^ ~(dword_14001214C * (dword_14001214C - 1)))) == 0);
v8 = !v35 && dword_140012150 < 10;
v5 = -853117837;
v10 = -1405473199;
if ( !(v8 ^ v35 ^ 1) )
v5 = -1405473199;
LABEL_118:
if ( v35 )
goto LABEL_2;
goto LABEL_119;
}
return v1;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment