_android_log_print(3, "tdog-loader", "ADDR %x", [COLOR="Red"]dword_60000[/COLOR]);
  f = *(_DWORD *)v10;
  l = *(_DWORD *)(v10 + 4);
  _android_log_print(3, "tdog-loader", "MM %x _F %x   _L %x", *(_DWORD *)v10, 0, 0);
  cxa_demangle(1, [COLOR="Blue"]_cxa_atexit[/COLOR], &s);
  _android_log_print(3, "tdog-loader", "HOOK SUCCESS");

LOAD:00060000 dword_60000     DCD 0x6610, 0x104       ; DATA XREF: LOAD:abs_export_function_block_offseto

int __fastcall _cxa_atexit(int a1, int a2)
{
  int v2; // ST0C_4@1
  int v3; // ST08_4@1

  v2 = a1;
  v3 = a2;
  tdog_decrypt(20, -20, 20, (int)&ll, 0x5F7C8B38u);//解密
  ((void (__fastcall *)(_DWORD, _DWORD))dword_0)(v2, v3);//执行
  return tdog_encrypt(20, -20, 20, (int)&ll, 0x5F7C8B38u);//加密
}

libcrackme.so:5B4E3610 sub_5B4E3610
libcrackme.so:5B4E3610 BX      PC//跳到5B4E3614
libcrackme.so:5B4E3610 ; ---------------------------------------------------------------------------
libcrackme.so:5B4E3612 DCB 0xC0 ; 
libcrackme.so:5B4E3613 DCB 0x46 ; F
libcrackme.so:5B4E3614 ; ---------------------------------------------------------------------------
libcrackme.so:5B4E3614
libcrackme.so:5B4E3614 _5B50AB28
libcrackme.so:5B4E3614 LDR             PC, =loc_5B50AB28//跳到_cxa_atexit
libcrackme.so:5B4E3614 ; ---------------------------------------------------------------------------
libcrackme.so:5B4E3618 off_5B4E3618 DCD loc_5B50AB28           ; DATA XREF: libcrackme.so:_5B50AB28r

int __fastcall sub_5B50AB28(int a1, int a2)
{
  int v2; // ST0C_4@1
  int v3; // ST08_4@1

  v2 = a1;
  v3 = a2;
  sub_5B5157F8(0x5B4E3624u, 0xF0u, 0x5B4E3624u, 0x5B524DD4u, 0x5F7C8B38u);//tdog_decrypt
  ((void (__fastcall *)(_DWORD, _DWORD))*loc_5B523E58)(v2, v3);
  return sub_5B51579C(0x5B4E3624u, 0xF0u, 0x5B4E3624u, 0x5B524DD4u, 0x5F7C8B38u);//tdog_encrypt
}

tdog_decrypt((UINT*)(base+0x6624), 0xF0, (UINT*)(base+0x6624), &new_size, 0x5F7C8B38);

signed int __fastcall sub_5B4E256C(int a1)
{
  int v2; // [sp+4h] [bp-Ch]@1

  v2 = a1;
  if ( setjmp_0(&unk_5B4F2B28) )
  {
    ((void (*)(void))dispatch)();
  }
  else
  {
    sub_5B4E1E54(v2);                           // 长度检测
    sub_5B4E1D48(v2);                           // 通过帐户名获取DES算法的KEY
    sub_5B4E20A0(v2);                           // DES解密
    sub_5B4E1F70(v2);                           // 检验结果
  }
  return 1;
}

    do
    {
      if ( setjmp_0(&unk_5B4F2B28) )
        ((void (*)(void))dispatch)();
      else
        v2 = *(_BYTE *)(*(_DWORD *)(v5 + 52) + v3);
      v4 = 0;
      do
      {
        if ( setjmp_0(&unk_5B4F2B28) )
          ((void (*)(void))dispatch)();
        else
          v2 = (*(_BYTE *)(v4 + 0x5B4F22BC) ^ v2) & 0xFF;
        ++v4;
      }
      while ( v4 != 0x100 );
      if ( setjmp_0(&unk_5B4F2B28) )
      {
        ((void (*)(void))dispatch)();
      }
      else if ( !v2 )
      {
        v2 = 0x99u;                             // 为0就填充0x99
        if ( setjmp_0(&unk_5B4F2B28) )
        {
          ((void (*)(void))dispatch)();
          v2 = 0;
        }
      }
      *(_BYTE *)(v5 + v3++ + 90) = v2;          // 加密账户的前8个字节放入des_key
    }
    while ( v3 != 8 );

   ((void (__fastcall *)(int))unk_5B4E17D4)(v5 + 90);
    v2 = (unsigned int)strlen_0(*(_DWORD *)(v5 + 0x38)) >> 4;
    memset_0(v5 + 0x3C, 0, 30);
    while ( v1 < (signed int)v2 )               // 密码每16个字节进行一次DES解密
    {
      v3 = 16 * v1++;
      ((void (__fastcall *)(char *, int))sub_5B4E18F8)(&v6, *(_DWORD *)(v5 + 56) + v3);// [COLOR="Red"]des_decrypt[/COLOR]
      strcat_0(v5 + 0x3C, &v6);//把分别解密的文本拼接起来
    }