I just tried to convert the asm code shown belown, but I failed to get the same result
00ACDE11 /MOV AL,BYTE PTR DS:[EBX]
00ACDE13 |MOV EDX,EAX
00ACDE15 |ADD DL,0CF
00ACDE18 |SUB DL,9
00ACDE1B |JB SHORT 00ACDE46 ;Especially this
00ACDE1D |ADD DL,0F9
00ACDE20 |SUB DL,0E
00ACDE23 |JB SHORT 00ACDE46 ;Especially this
00ACDE25 |DEC EDX
00ACDE26 |SUB DL,0B
00ACDE29 |JB SHORT 00ACDE46 ;Especially this
00ACDE2B |XOR EAX,EAX
00ACDE2D |MOV AL,BYTE PTR SS:[EBP-310]
00ACDE33 |DEC EAX
00ACDE34 |CALL 009E2D24
00ACDE39 |MOV EDI,EAX
00ACDE3B |MOV AL,BYTE PTR SS:[EDI+EBP-30F]
00ACDE42 |MOV BYTE PTR DS:[EBX],AL
00ACDE44 |JMP SHORT 00ACDE48
00ACDE46 |MOV BYTE PTR DS:[EBX],AL
00ACDE48 |INC EBX
00ACDE49 |DEC ESI
00ACDE4A \JNZ SHORT 00ACDE11
I already does some research effort on the internet and found that carry flag is set when an overflow is caused. This is what I already tried:
for(int i=0; i < n ;i++)
{
int c = buffer[i] + 0xC6;
if(c > 0xFF) // <---- this is not producing the same result
{
c = ((unsigned char) c) + 0xEB;
if(c > 0xFF) // <---- this is not producing the same result
{
c = ((unsigned char) c) - 0xC;
if(c > 0xFF) // <---- this is not producing the same result
{
//...
//func_009E2D24(...);
}
}
}
//...
}
< 14
before doing the subtraction.