CrackMe Level 6: part 2

1. Introduction In the previous article, we began studying a level 6 CrackMe and quickly reached the Serial verification routine based on the Name. Here is this routine below: 0x401510: pusha ; Save all general-purpose registers ; ------------------------------------------------------------------------- ; PHASE 1: BASE64 DECODING AND SIZE CHECK ; ------------------------------------------------------------------------- 0x401511: mov ebx,DWORD PTR [esp+0x2c]; ebx = Pointer to Serial (passed as parameter) 0x401515: mov esi,0x404200 ; esi = Destination buffer for decoded Serial 0x40151a: push ebx ; Argument 2: Serial string 0x40151b: push esi ; Argument 1: Output buffer 0x40151c: call 0x401633 ; CALL: Custom Base64 decoder 0x401521: cmp eax,0x10 ; Is the decoded buffer exactly 16 bytes (128 bits)? 0x401524: jne 0x40162f ; No -> Direct failure (Jump to failure) ; ------------------------------------------------------------------------- ; PHASE 2: CHECK AND PREPARATION OF 64-BIT INTEGERS (S1 AND S2) ; ------------------------------------------------------------------------- 0x40152a: lea edi,[esi+0x10] ; edi = Pointer to second memory block (0x404210) ; Verification of the First 64-bit Number: S1 = [esi] (0x404200) 0x40152d: mov eax,DWORD PTR [esi] ; eax = Low 32 bits of S1 0x40152f: mov edx,DWORD PTR [esi+0x4]; edx = High 32 bits of S1 0x401532: test edx,edx ; Is S1 zero? 0x401534: jne 0x40153e 0x401536: test eax,eax 0x401538: je 0x40162f ; If S1 == 0 -> Failure ; Comparison of S1 with Modulus M (stored at 0x40403c) 0x40153e: sub eax,DWORD PTR ds:0x40403c ; S1 - Modulus (low part) 0x401544: sbb edx,DWORD PTR ds:0x404040 ; S1 - Modulus (high part with borrow) 0x40154a: jae 0x40162f ; If S1 >= Modulus -> Failure (S1 must be < M) ; Copy and Verification of the Second 64-bit Number: S2 = [esi+0x8] (0x404208) 0x401550: mov eax,DWORD PTR [esi+0x8]; eax = Low 32 bits of S2 0x401553: mov edx,DWORD PTR [esi+0xc]; edx = High 32 bits of S2 0x401556: mov DWORD PTR [edi],eax ; Copy