5

Let's break it down line by line. Assuming x is the thing you want to multiply by 21 and it's stored in eax (as it is in this example after line 34). <39>: mov edx, eax ; so copy the x to edx <41>: mov eax, edx ; it's pointless to do this mov; after those two lines eax & edx has the value of x <43>: shl eax, 2 ; so eax = x * 4 <...


2

Yes, mov DWORD PTR 40[rsp], 6 is the same as mov DWORD PTR [rsp + 40], 6. The first syntax makes a lot more sense in cases where the constant is the base address of an array, and the register contains a byte offset into that array. That's the use case the syntax was designed for.


2

From type == 0 you see that it writes to param_3 and reads from param_4. So those parameters must be pointers to output and input buffers respectively. In fact, if you change them to correct type (byte *), then I believe Ghidra should be able to simplify the rest of the code to easily understandable form. The part that modifies param_2 is a simple pseudo-...


1

0x405044 is the address of your format string. You can print the string with x/s 0x405044 It stores this address at esp cause its your first argument.


1

Yes, this is possible with some cooperation from the debugger. The OllyMigrate plugin supports migration between following debuggers: OllyDbg Immunity Debugger IDA Pro/Freeware WinDbg x64dbg It seems Visual Studio is not supported but you can always do it the manual way: Patch an infinite loop (EB FE) at the current EIP/RIP; Detach the current debugger. ...


Only top voted, non community-wiki answers of a minimum length are eligible