此程序建立了一个TCP服务端,端口号为10010,之后accept等待连接,如果接受到连接,那么就发送一些欢迎信息,以及提示信息---发送quit退出.

 

之后不停地调用recv,如果接受到数据,那么判断是否为quit,是则退出,否则进入401e00对接收到的数据进行加密

,之后把加密后的数据发送回客户端:

 

之后跳回recv等待.

加密过程401e00抠出,如下:

;第一步 抠出加密函数
.586
.model flat,stdcall 
                     
                     
option casemap:none

   include msvcrt.inc       ; 
   include windows.inc      ;
   include kernel32.inc     ; 
   ;
   includelib msvcrt.lib
   includelib KERNEL32.LIB

.data

   format db "%s",0
   string db "1234567890",0
   
   ecode  db 041h, 00eh, 097h, 0a3h, 02bh, 05ah, 0b7h, 06dh, 039h, 030h, 036h

   
   src  db 100 dup(1)
   buf  db 100 dup(0)
   
   var_98C         dd 000000000h
   var_988      dd 000000000h
   var_984      dd 000000002h
   
    var_980 dd 000802001h, 000002081h, 000002081h, 000000080h, 000802080h, 000800081h, 000800001h, 000002001h, 000000000h, 000802000h, 000802000h, 000802081h, 000000081h, 000000000h, 000800080h, 000800001h
        dd 000000001h, 000002000h, 000800000h, 000802001h, 000000080h, 000800000h, 000002001h, 000002080h, 000800081h, 000000001h, 000002080h, 000800080h, 000002000h, 000802080h, 000802081h, 000000081h
        dd 000800080h, 000800001h, 000802000h, 000802081h, 000000081h, 000000000h, 000000000h, 000802000h, 000002080h, 000800080h, 000800081h, 000000001h, 000802001h, 000002081h, 000002081h, 000000080h
        dd 000802081h, 000000081h, 000000001h, 000002000h, 000800001h, 000002001h, 000802080h, 000800081h, 000002001h, 000002080h, 000800000h, 000802001h, 000000080h, 000800000h, 000002000h, 000802080h
    var_880 dd 080108020h, 080008000h, 000008000h, 000108020h, 000100000h, 000000020h, 080100020h, 080008020h, 080000020h, 080108020h, 080108000h, 080000000h, 080008000h, 000100000h, 000000020h, 080100020h
        dd 000108000h, 000100020h, 080008020h, 000000000h, 080000000h, 000008000h, 000108020h, 080100000h, 000100020h, 080000020h, 000000000h, 000108000h, 000008020h, 080108000h, 080100000h, 000008020h
        dd 000000000h, 000108020h, 080100020h, 000100000h, 080008020h, 080100000h, 080108000h, 000008000h, 080100000h, 080008000h, 000000020h, 080108020h, 000108020h, 000000020h, 000008000h, 080000000h
        dd 000008020h, 080108000h, 000100000h, 080000020h, 000100020h, 080008020h, 080000020h, 000100020h, 000108000h, 000000000h, 080008000h, 000008020h, 080000000h, 080100020h, 080108020h, 000108000h
    var_780 dd 001010400h, 000000000h, 000010000h, 001010404h, 001010004h, 000010404h, 000000004h, 000010000h, 000000400h, 001010400h, 001010404h, 000000400h, 001000404h, 001010004h, 001000000h, 000000004h
        dd 000000404h, 001000400h, 001000400h, 000010400h, 000010400h, 001010000h, 001010000h, 001000404h, 000010004h, 001000004h, 001000004h, 000010004h, 000000000h, 000000404h, 000010404h, 001000000h
        dd 000010000h, 001010404h, 000000004h, 001010000h, 001010400h, 001000000h, 001000000h, 000000400h, 001010004h, 000010000h, 000010400h, 001000004h, 000000400h, 000000004h, 001000404h, 000010404h
        dd 001010404h, 000010004h, 001010000h, 001000404h, 001000004h, 000000404h, 000010404h, 001010400h, 000000404h, 001000400h, 001000400h, 000000000h, 000010004h, 000010400h, 000000000h, 001010004h
    var_680 dd 020000010h, 020400000h, 000004000h, 020404010h, 020400000h, 000000010h, 020404010h, 000400000h, 020004000h, 000404010h, 000400000h, 020000010h, 000400010h, 020004000h, 020000000h, 000004010h
        dd 000000000h, 000400010h, 020004010h, 000004000h, 000404000h, 020004010h, 000000010h, 020400010h, 020400010h, 000000000h, 000404010h, 020404000h, 000004010h, 000404000h, 020404000h, 020000000h
        dd 020004000h, 000000010h, 020400010h, 000404000h, 020404010h, 000400000h, 000004010h, 020000010h, 000400000h, 020004000h, 020000000h, 000004010h, 020000010h, 020404010h, 000404000h, 020400000h
        dd 000404010h, 020404000h, 000000000h, 020400010h, 000000010h, 000004000h, 020400000h, 000404010h, 000004000h, 000400010h, 020004010h, 000000000h, 020404000h, 020000000h, 000400010h, 020004010h
    var_580 dd 010001040h, 000001000h, 000040000h, 010041040h, 010000000h, 010001040h, 000000040h, 010000000h, 000040040h, 010040000h, 010041040h, 000041000h, 010041000h, 000041040h, 000001000h, 000000040h
        dd 010040000h, 010000040h, 010001000h, 000001040h, 000041000h, 000040040h, 010040040h, 010041000h, 000001040h, 000000000h, 000000000h, 010040040h, 010000040h, 010001000h, 000041040h, 000040000h
        dd 000041040h, 000040000h, 010041000h, 000001000h, 000000040h, 010040040h, 000001000h, 000041040h, 010001000h, 000000040h, 010000040h, 010040000h, 010040040h, 010000000h, 000040000h, 010001040h
        dd 000000000h, 010041040h, 000040040h, 010000040h, 010040000h, 010001000h, 010001040h, 000000000h, 010041040h, 000041000h, 000041000h, 000001040h, 000001040h, 000040040h, 010000000h, 010041000h
    var_480    dd 000000100h, 002080100h, 002080000h, 042000100h, 000080000h, 000000100h, 040000000h, 002080000h, 040080100h, 000080000h, 002000100h, 040080100h, 042000100h, 042080000h, 000080100h, 040000000h
        dd 002000000h, 040080000h, 040080000h, 000000000h, 040000100h, 042080100h, 042080100h, 002000100h, 042080000h, 040000100h, 000000000h, 042000000h, 002080100h, 002000000h, 042000000h, 000080100h
        dd 000080000h, 042000100h, 000000100h, 002000000h, 040000000h, 002080000h, 042000100h, 040080100h, 002000100h, 040000000h, 042080000h, 002080100h, 040080100h, 000000100h, 002000000h, 042080000h
        dd 042080100h, 000080100h, 042000000h, 042080100h, 002080000h, 000000000h, 040080000h, 042000000h, 000080100h, 002000100h, 040000100h, 000080000h, 000000000h, 040080000h, 002080100h, 040000100h
    var_380 dd 000200000h, 004200002h, 004000802h, 000000000h, 000000800h, 004000802h, 000200802h, 004200800h, 004200802h, 000200000h, 000000000h, 004000002h, 000000002h, 004000000h, 004200002h, 000000802h
        dd 004000800h, 000200802h, 000200002h, 004000800h, 004000002h, 004200000h, 004200800h, 000200002h, 004200000h, 000000800h, 000000802h, 004200802h, 000200800h, 000000002h, 004000000h, 000200800h
        dd 004000000h, 000200800h, 000200000h, 004000802h, 004000802h, 004200002h, 004200002h, 000000002h, 000200002h, 004000000h, 004000800h, 000200000h, 004200800h, 000000802h, 000200802h, 004200800h
        dd 000000802h, 004000002h, 004200802h, 004200000h, 000200800h, 000000000h, 000000002h, 004200802h, 000000000h, 000200802h, 004200000h, 000000800h, 004000002h, 004000800h, 000000800h, 000200002h
    var_280 dd 000000208h, 008020200h, 000000000h, 008020008h, 008000200h, 000000000h, 000020208h, 008000200h, 000020008h, 008000008h, 008000008h, 000020000h, 008020208h, 000020008h, 008020000h, 000000208h
        dd 008000000h, 000000008h, 008020200h, 000000200h, 000020200h, 008020000h, 008020008h, 000020208h, 008000208h, 000020200h, 000020000h, 008000208h, 000000008h, 008020208h, 000000200h, 008000000h
        dd 008020200h, 008000000h, 000020008h, 000000208h, 000020000h, 008020200h, 008000200h, 000000000h, 000000200h, 000020008h, 008020208h, 008000200h, 008000008h, 000000200h, 000000000h, 008020008h
        dd 008000208h, 000020000h, 008000000h, 008020208h, 000000008h, 000020208h, 000020200h, 008000008h, 008020000h, 008000208h, 000000208h, 008020000h, 000020208h, 000000008h, 008020008h, 000020200h
    Dst dd 002002608h
    var_17C dd 010200e3ah, 000242327h, 004000431h, 000042834h, 020002b26h, 000241613h, 00008003fh, 001203811h, 020001f00h, 00020340eh, 020093015h, 005000b0ch, 02008030eh, 001000525h, 0000d3c13h
        dd 020103f04h, 008001a21h, 000100e3ah, 003000816h, 020181107h, 001002b30h, 020002432h, 00300330bh, 020081c0dh, 00220052dh, 002082910h, 002002413h, 000081a25h, 00030321ch, 000001d29h, 00402090ah
        dd 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h
        dd 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h
        dd 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h
        dd 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h
   
.code

GetXor proc
    
    
    retn

GetXor endp

Ecode proc ;arg_0:dword,len:dword
  push ebp
  mov  ebp,esp
   pushad
                xor     esi,esi
                mov     ebx,[ebp+0ch]
                shr     ebx, 2          ; ebx = 数据长度
                add     esp, 10h
                xor     edi, edi
                mov     [var_984], ebx
                cmp     ebx, esi
                jbe     loc_40332F
                lea     esp, [esp+0]
                
                mov     esi, [ebp+8]

loc_403100:                             ; CODE XREF: sub_401E00+1529j
                mov     edx, [ebp+8]
                mov     eax, [edx+edi*4]
                mov     edx, [edx+edi*4+4]
                mov     ecx, eax
                mov     ebx, eax
                shr     ebx, 10h
                and     ecx, 0FF0000h
                or      ecx, ebx
                mov     ebx, eax
                and     eax, 0FF00h
                shl     ebx, 10h
                or      ebx, eax
                mov     eax, edx
                shl     ebx, 8
                shr     ecx, 8
                or      ecx, ebx
                mov     ebx, edx
                and     eax, 0FF0000h
                shr     ebx, 10h
                or      eax, ebx
                mov     ebx, edx
                and     edx, 0FF00h
                shl     ebx, 10h
                or      ebx, edx
                shr     eax, 8
                shl     ebx, 8
                or      eax, ebx
                mov     edx, ecx
                shr     edx, 4
                xor     edx, eax
                and     edx, 0F0F0F0Fh
                xor     eax, edx
                shl     edx, 4
                xor     ecx, edx
                mov     edx, ecx
                shr     edx, 10h
                xor     edx, eax
                and     edx, 0FFFFh
                xor     eax, edx
                shl     edx, 10h
                xor     ecx, edx
                mov     edx, eax
                shr     edx, 2
                xor     edx, ecx
                and     edx, 33333333h
                xor     ecx, edx
                add     edx, edx
                add     edx, edx
                xor     eax, edx
                mov     edx, eax
                shr     edx, 8
                xor     edx, ecx
                and     edx, 0FF00FFh
                xor     ecx, edx
                shl     edx, 8
                xor     eax, edx
                mov     edx, ecx
                shr     edx, 1
                xor     edx, eax
                and     edx, 55555555h
                lea     ebx, [edx+edx]
                xor     ebx, ecx
                xor     eax, edx
                rol     ebx, 1
                rol     eax, 1
                xor     ebp, ebp             
                mov     [var_98C], ebp
                mov     ecx, eax

loc_4031C4:                             ; CODE XREF: sub_401E00+145Cj
                mov     eax, [ebp*4+Dst]
                xor     eax, ecx
                mov     edx, ecx
                ror     edx, 4
                xor     edx, [ebp*4+var_17C]
                mov     [var_988], ebx
                mov     ebx, ecx
                mov     ecx, eax
                shr     ecx, 8
                and     ecx, 3Fh
                mov     ecx, [ecx*4+var_680]
                mov     ebp, edx
                shr     ebp, 8
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_480]
                mov     ebp, eax
                shr     ebp, 10h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_980]
                mov     ebp, edx
                shr     ebp, 10h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_280]
                mov     ebp, eax
                shr     ebp, 18h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_880]
                mov     ebp, edx
                shr     ebp, 18h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_780]
                mov     ebp, [var_98C]
                and     eax, 3Fh
                or      ecx, [eax*4+var_580]
                and     edx, 3Fh
                or      ecx, [edx*4+var_380]
                add     ebp, 2
                xor     ecx, [var_988]
                mov     [var_98C], ebp
                cmp     ebp, 20h
                jnz     loc_4031C4
                ror     ecx, 1
                ror     ebx, 1
                mov     edx, ecx
                shr     edx, 1
                mov     eax, ebx
                xor     edx, eax
                and     edx, 55555555h
                xor     eax, edx
                add     edx, edx
                xor     ecx, edx
                mov     edx, eax
                shr     edx, 8
                xor     edx, ecx
                and     edx, 0FF00FFh
                xor     ecx, edx
                shl     edx, 8
                xor     eax, edx
                mov     edx, eax
                shr     edx, 2
                xor     edx, ecx
                and     edx, 33333333h
                xor     ecx, edx
                add     edx, edx
                add     edx, edx
                xor     eax, edx
                mov     edx, ecx
                shr     edx, 10h
                xor     edx, eax
                and     edx, 0FFFFh
                xor     eax, edx
                shl     edx, 10h
                xor     ecx, edx
                mov     ebx, ecx
                shr     ebx, 4
                xor     ebx, eax
                and     ebx, 0F0F0F0Fh
                mov     edx, ebx
                shl     edx, 4
                xor     edx, ecx
                mov     ebp, edx
                mov     ecx, edx
                shr     ecx, 10h
                and     ebp, 0FF0000h
                or      ebp, ecx
                mov     ecx, edx
                xor     eax, ebx
                and     edx, 0FF00h
                shl     ecx, 10h
                or      ecx, edx
                mov     edx, eax
                and     edx, 0FF0000h
                mov     ebx, eax
                shr     ebx, 10h
                or      edx, ebx
                mov     ebx, eax
                shl     ebx, 10h
                and     eax, 0FF00h
                shl     ecx, 8
                or      ebx, eax
                shr     ebp, 8
                or      ebp, ecx
                mov     ecx, esi
                shr     edx, 8
                shl     ebx, 8
                or      edx, ebx
                mov     [ecx+edi*4], ebp
                mov     [ecx+edi*4+4], edx
                add     edi, 2
                cmp     edi, [var_984]
                jb      loc_403100
loc_40332F: 
    popad 
    sub esp,10h
    pop ebp
    ret 8

Ecode endp

main:        ;for test

    push 0ah
    push offset string
    call Ecode
    

    ret


end main
;第二步 化解加密函数
.586
.model flat,stdcall 
                     
                     
option casemap:none

   include msvcrt.inc       ; 
   include windows.inc      ;
   include kernel32.inc     ; 
   ;
   includelib msvcrt.lib
   includelib KERNEL32.LIB

.data

   format db "%s",0
   string db "1234567890",0
   
   ecode  db 041h, 00eh, 097h, 0a3h, 02bh, 05ah, 0b7h, 06dh, 039h, 030h, 036h

   
   src  db 100 dup(1)
   buf  db 100 dup(0)
   
   var_98C         dd 000000000h
   var_988      dd 000000000h
   var_984      dd 000000002h
   
    var_980 dd 000802001h, 000002081h, 000002081h, 000000080h, 000802080h, 000800081h, 000800001h, 000002001h, 000000000h, 000802000h, 000802000h, 000802081h, 000000081h, 000000000h, 000800080h, 000800001h
        dd 000000001h, 000002000h, 000800000h, 000802001h, 000000080h, 000800000h, 000002001h, 000002080h, 000800081h, 000000001h, 000002080h, 000800080h, 000002000h, 000802080h, 000802081h, 000000081h
        dd 000800080h, 000800001h, 000802000h, 000802081h, 000000081h, 000000000h, 000000000h, 000802000h, 000002080h, 000800080h, 000800081h, 000000001h, 000802001h, 000002081h, 000002081h, 000000080h
        dd 000802081h, 000000081h, 000000001h, 000002000h, 000800001h, 000002001h, 000802080h, 000800081h, 000002001h, 000002080h, 000800000h, 000802001h, 000000080h, 000800000h, 000002000h, 000802080h
    var_880 dd 080108020h, 080008000h, 000008000h, 000108020h, 000100000h, 000000020h, 080100020h, 080008020h, 080000020h, 080108020h, 080108000h, 080000000h, 080008000h, 000100000h, 000000020h, 080100020h
        dd 000108000h, 000100020h, 080008020h, 000000000h, 080000000h, 000008000h, 000108020h, 080100000h, 000100020h, 080000020h, 000000000h, 000108000h, 000008020h, 080108000h, 080100000h, 000008020h
        dd 000000000h, 000108020h, 080100020h, 000100000h, 080008020h, 080100000h, 080108000h, 000008000h, 080100000h, 080008000h, 000000020h, 080108020h, 000108020h, 000000020h, 000008000h, 080000000h
        dd 000008020h, 080108000h, 000100000h, 080000020h, 000100020h, 080008020h, 080000020h, 000100020h, 000108000h, 000000000h, 080008000h, 000008020h, 080000000h, 080100020h, 080108020h, 000108000h
    var_780 dd 001010400h, 000000000h, 000010000h, 001010404h, 001010004h, 000010404h, 000000004h, 000010000h, 000000400h, 001010400h, 001010404h, 000000400h, 001000404h, 001010004h, 001000000h, 000000004h
        dd 000000404h, 001000400h, 001000400h, 000010400h, 000010400h, 001010000h, 001010000h, 001000404h, 000010004h, 001000004h, 001000004h, 000010004h, 000000000h, 000000404h, 000010404h, 001000000h
        dd 000010000h, 001010404h, 000000004h, 001010000h, 001010400h, 001000000h, 001000000h, 000000400h, 001010004h, 000010000h, 000010400h, 001000004h, 000000400h, 000000004h, 001000404h, 000010404h
        dd 001010404h, 000010004h, 001010000h, 001000404h, 001000004h, 000000404h, 000010404h, 001010400h, 000000404h, 001000400h, 001000400h, 000000000h, 000010004h, 000010400h, 000000000h, 001010004h
    var_680 dd 020000010h, 020400000h, 000004000h, 020404010h, 020400000h, 000000010h, 020404010h, 000400000h, 020004000h, 000404010h, 000400000h, 020000010h, 000400010h, 020004000h, 020000000h, 000004010h
        dd 000000000h, 000400010h, 020004010h, 000004000h, 000404000h, 020004010h, 000000010h, 020400010h, 020400010h, 000000000h, 000404010h, 020404000h, 000004010h, 000404000h, 020404000h, 020000000h
        dd 020004000h, 000000010h, 020400010h, 000404000h, 020404010h, 000400000h, 000004010h, 020000010h, 000400000h, 020004000h, 020000000h, 000004010h, 020000010h, 020404010h, 000404000h, 020400000h
        dd 000404010h, 020404000h, 000000000h, 020400010h, 000000010h, 000004000h, 020400000h, 000404010h, 000004000h, 000400010h, 020004010h, 000000000h, 020404000h, 020000000h, 000400010h, 020004010h
    var_580 dd 010001040h, 000001000h, 000040000h, 010041040h, 010000000h, 010001040h, 000000040h, 010000000h, 000040040h, 010040000h, 010041040h, 000041000h, 010041000h, 000041040h, 000001000h, 000000040h
        dd 010040000h, 010000040h, 010001000h, 000001040h, 000041000h, 000040040h, 010040040h, 010041000h, 000001040h, 000000000h, 000000000h, 010040040h, 010000040h, 010001000h, 000041040h, 000040000h
        dd 000041040h, 000040000h, 010041000h, 000001000h, 000000040h, 010040040h, 000001000h, 000041040h, 010001000h, 000000040h, 010000040h, 010040000h, 010040040h, 010000000h, 000040000h, 010001040h
        dd 000000000h, 010041040h, 000040040h, 010000040h, 010040000h, 010001000h, 010001040h, 000000000h, 010041040h, 000041000h, 000041000h, 000001040h, 000001040h, 000040040h, 010000000h, 010041000h
    var_480    dd 000000100h, 002080100h, 002080000h, 042000100h, 000080000h, 000000100h, 040000000h, 002080000h, 040080100h, 000080000h, 002000100h, 040080100h, 042000100h, 042080000h, 000080100h, 040000000h
        dd 002000000h, 040080000h, 040080000h, 000000000h, 040000100h, 042080100h, 042080100h, 002000100h, 042080000h, 040000100h, 000000000h, 042000000h, 002080100h, 002000000h, 042000000h, 000080100h
        dd 000080000h, 042000100h, 000000100h, 002000000h, 040000000h, 002080000h, 042000100h, 040080100h, 002000100h, 040000000h, 042080000h, 002080100h, 040080100h, 000000100h, 002000000h, 042080000h
        dd 042080100h, 000080100h, 042000000h, 042080100h, 002080000h, 000000000h, 040080000h, 042000000h, 000080100h, 002000100h, 040000100h, 000080000h, 000000000h, 040080000h, 002080100h, 040000100h
    var_380 dd 000200000h, 004200002h, 004000802h, 000000000h, 000000800h, 004000802h, 000200802h, 004200800h, 004200802h, 000200000h, 000000000h, 004000002h, 000000002h, 004000000h, 004200002h, 000000802h
        dd 004000800h, 000200802h, 000200002h, 004000800h, 004000002h, 004200000h, 004200800h, 000200002h, 004200000h, 000000800h, 000000802h, 004200802h, 000200800h, 000000002h, 004000000h, 000200800h
        dd 004000000h, 000200800h, 000200000h, 004000802h, 004000802h, 004200002h, 004200002h, 000000002h, 000200002h, 004000000h, 004000800h, 000200000h, 004200800h, 000000802h, 000200802h, 004200800h
        dd 000000802h, 004000002h, 004200802h, 004200000h, 000200800h, 000000000h, 000000002h, 004200802h, 000000000h, 000200802h, 004200000h, 000000800h, 004000002h, 004000800h, 000000800h, 000200002h
    var_280 dd 000000208h, 008020200h, 000000000h, 008020008h, 008000200h, 000000000h, 000020208h, 008000200h, 000020008h, 008000008h, 008000008h, 000020000h, 008020208h, 000020008h, 008020000h, 000000208h
        dd 008000000h, 000000008h, 008020200h, 000000200h, 000020200h, 008020000h, 008020008h, 000020208h, 008000208h, 000020200h, 000020000h, 008000208h, 000000008h, 008020208h, 000000200h, 008000000h
        dd 008020200h, 008000000h, 000020008h, 000000208h, 000020000h, 008020200h, 008000200h, 000000000h, 000000200h, 000020008h, 008020208h, 008000200h, 008000008h, 000000200h, 000000000h, 008020008h
        dd 008000208h, 000020000h, 008000000h, 008020208h, 000000008h, 000020208h, 000020200h, 008000008h, 008020000h, 008000208h, 000000208h, 008020000h, 000020208h, 000000008h, 008020008h, 000020200h
    Dst dd 002002608h
    var_17C dd 010200e3ah, 000242327h, 004000431h, 000042834h, 020002b26h, 000241613h, 00008003fh, 001203811h, 020001f00h, 00020340eh, 020093015h, 005000b0ch, 02008030eh, 001000525h, 0000d3c13h
        dd 020103f04h, 008001a21h, 000100e3ah, 003000816h, 020181107h, 001002b30h, 020002432h, 00300330bh, 020081c0dh, 00220052dh, 002082910h, 002002413h, 000081a25h, 00030321ch, 000001d29h, 00402090ah
        dd 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h
        dd 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h
        dd 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h
        dd 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h
   
.code

InitXor proc near
    push ebp
    mov ebp,esp
    mov     edx, [ebp+8]
                mov     eax, [edx+edi*4]
                mov     edx, [edx+edi*4+4]
                mov     ecx, eax
                mov     ebx, eax
                shr     ebx, 10h
                and     ecx, 0FF0000h
                or      ecx, ebx
                mov     ebx, eax
                and     eax, 0FF00h
                shl     ebx, 10h
                or      ebx, eax
                mov     eax, edx
                shl     ebx, 8
                shr     ecx, 8
                or      ecx, ebx
                mov     ebx, edx
                and     eax, 0FF0000h
                shr     ebx, 10h
                or      eax, ebx
                mov     ebx, edx
                and     edx, 0FF00h
                shl     ebx, 10h
                or      ebx, edx
                shr     eax, 8
                shl     ebx, 8
                or      eax, ebx
                mov     edx, ecx
                shr     edx, 4
                xor     edx, eax
                and     edx, 0F0F0F0Fh
                xor     eax, edx
                shl     edx, 4
                xor     ecx, edx
                mov     edx, ecx
                shr     edx, 10h
                xor     edx, eax
                and     edx, 0FFFFh
                xor     eax, edx
                shl     edx, 10h
                xor     ecx, edx
                mov     edx, eax
                shr     edx, 2
                xor     edx, ecx
                and     edx, 33333333h
                xor     ecx, edx
                add     edx, edx
                add     edx, edx
                xor     eax, edx
                mov     edx, eax
                shr     edx, 8
                xor     edx, ecx
                and     edx, 0FF00FFh
                xor     ecx, edx
                shl     edx, 8
                xor     eax, edx
                mov     edx, ecx
                shr     edx, 1
                xor     edx, eax
                and     edx, 55555555h
                lea     ebx, [edx+edx]
                xor     ebx, ecx
                xor     eax, edx
                rol     ebx, 1
                rol     eax, 1
                pop ebp
    retn 4

InitXor endp


LoopXor proc near ; 操作 ebx,eax,返回 ebx,ecx
    
                xor     ebp, ebp             
                mov     [var_98C], ebp
                mov     ecx, eax

loc_4031C4:                             ; CODE XREF: sub_401E00+145Cj
                mov     eax, [ebp*4+Dst]
                xor     eax, ecx
                mov     edx, ecx
                ror     edx, 4
                xor     edx, [ebp*4+var_17C]
                mov     [var_988], ebx
                mov     ebx, ecx
                mov     ecx, eax
                shr     ecx, 8
                and     ecx, 3Fh
                mov     ecx, [ecx*4+var_680]
                mov     ebp, edx
                shr     ebp, 8
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_480]
                mov     ebp, eax
                shr     ebp, 10h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_980]
                mov     ebp, edx
                shr     ebp, 10h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_280]
                mov     ebp, eax
                shr     ebp, 18h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_880]
                mov     ebp, edx
                shr     ebp, 18h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_780]
                mov     ebp, [var_98C]
                and     eax, 3Fh
                or      ecx, [eax*4+var_580]
                and     edx, 3Fh
                or      ecx, [edx*4+var_380]
                add     ebp, 2
                xor     ecx, [var_988]
                mov     [var_98C], ebp
                cmp     ebp, 20h
                jnz     loc_4031C4
    retn

LoopXor endp

ExitXor proc near
    
    ror     ecx, 1
                ror     ebx, 1
                mov     edx, ecx
                shr     edx, 1
                mov     eax, ebx
                xor     edx, eax
                and     edx, 55555555h
                xor     eax, edx
                add     edx, edx
                xor     ecx, edx
                mov     edx, eax
                shr     edx, 8
                xor     edx, ecx
                and     edx, 0FF00FFh
                xor     ecx, edx
                shl     edx, 8
                xor     eax, edx
                mov     edx, eax
                shr     edx, 2
                xor     edx, ecx
                and     edx, 33333333h
                xor     ecx, edx
                add     edx, edx
                add     edx, edx
                xor     eax, edx
                mov     edx, ecx
                shr     edx, 10h
                xor     edx, eax
                and     edx, 0FFFFh
                xor     eax, edx
                shl     edx, 10h
                xor     ecx, edx
                mov     ebx, ecx
                shr     ebx, 4
                xor     ebx, eax
                and     ebx, 0F0F0F0Fh
                mov     edx, ebx
                shl     edx, 4
                xor     edx, ecx
                mov     ebp, edx
                mov     ecx, edx
                shr     ecx, 10h
                and     ebp, 0FF0000h
                or      ebp, ecx
                mov     ecx, edx
                xor     eax, ebx
                and     edx, 0FF00h
                shl     ecx, 10h
                or      ecx, edx
                mov     edx, eax
                and     edx, 0FF0000h
                mov     ebx, eax
                shr     ebx, 10h
                or      edx, ebx
                mov     ebx, eax
                shl     ebx, 10h
                and     eax, 0FF00h
                shl     ecx, 8
                or      ebx, eax
                shr     ebp, 8
                or      ebp, ecx                
                shr     edx, 8
                shl     ebx, 8
                or      edx, ebx
    retn

ExitXor endp

Ecode proc ;arg_0:dword,len:dword
  push ebp
  mov  ebp,esp
   pushad

                xor     esi,esi
                mov     ebx,[ebp+0ch]
                shr     ebx, 2          ; ebx = 数据长度
                add     esp, 10h
                xor     edi, edi
                mov     [var_984], ebx
                cmp     ebx, esi
                jbe     loc_40332F
                lea     esp, [esp+0]
                
                mov     esi, [ebp+8]

loc_403100:                             ; CODE XREF: sub_401E00+1529j
                push    esi
                call    InitXor          ; 操作 eax,edx  返回 ebx,eax
                call    LoopXor          ; 操作 ebx,eax  返回 ebx,ecx 
                call    ExitXor          ; 操作 ebx,ecx  返回 ebp,edx
                mov     ecx, esi
                mov     [ecx+edi*4], ebp
                mov     [ecx+edi*4+4], edx
                add     edi, 2
                cmp     edi, [var_984]
                jb      loc_403100
loc_40332F: 
    popad 
    sub esp,10h
    pop ebp
    ret 8

Ecode endp
;第三步 根据加密函数写出解密函数
.586
.model flat,stdcall 
                     
                     
option casemap:none

   include msvcrt.inc       ; 
   include windows.inc      ;
   include kernel32.inc     ; 
   ;
   includelib msvcrt.lib
   includelib KERNEL32.LIB

.data

   format db "%s",0
   string db "1234567890",0
   
   ecode  db 041h, 00eh, 097h, 0a3h, 02bh, 05ah, 0b7h, 06dh, 039h, 030h, 036h

   
   src  db 100 dup(1)
   buf  db 100 dup(0)
   
   var_98C         dd 000000000h
   var_988      dd 000000000h
   var_984      dd 000000002h
   
    var_980 dd 000802001h, 000002081h, 000002081h, 000000080h, 000802080h, 000800081h, 000800001h, 000002001h, 000000000h, 000802000h, 000802000h, 000802081h, 000000081h, 000000000h, 000800080h, 000800001h
        dd 000000001h, 000002000h, 000800000h, 000802001h, 000000080h, 000800000h, 000002001h, 000002080h, 000800081h, 000000001h, 000002080h, 000800080h, 000002000h, 000802080h, 000802081h, 000000081h
        dd 000800080h, 000800001h, 000802000h, 000802081h, 000000081h, 000000000h, 000000000h, 000802000h, 000002080h, 000800080h, 000800081h, 000000001h, 000802001h, 000002081h, 000002081h, 000000080h
        dd 000802081h, 000000081h, 000000001h, 000002000h, 000800001h, 000002001h, 000802080h, 000800081h, 000002001h, 000002080h, 000800000h, 000802001h, 000000080h, 000800000h, 000002000h, 000802080h
    var_880 dd 080108020h, 080008000h, 000008000h, 000108020h, 000100000h, 000000020h, 080100020h, 080008020h, 080000020h, 080108020h, 080108000h, 080000000h, 080008000h, 000100000h, 000000020h, 080100020h
        dd 000108000h, 000100020h, 080008020h, 000000000h, 080000000h, 000008000h, 000108020h, 080100000h, 000100020h, 080000020h, 000000000h, 000108000h, 000008020h, 080108000h, 080100000h, 000008020h
        dd 000000000h, 000108020h, 080100020h, 000100000h, 080008020h, 080100000h, 080108000h, 000008000h, 080100000h, 080008000h, 000000020h, 080108020h, 000108020h, 000000020h, 000008000h, 080000000h
        dd 000008020h, 080108000h, 000100000h, 080000020h, 000100020h, 080008020h, 080000020h, 000100020h, 000108000h, 000000000h, 080008000h, 000008020h, 080000000h, 080100020h, 080108020h, 000108000h
    var_780 dd 001010400h, 000000000h, 000010000h, 001010404h, 001010004h, 000010404h, 000000004h, 000010000h, 000000400h, 001010400h, 001010404h, 000000400h, 001000404h, 001010004h, 001000000h, 000000004h
        dd 000000404h, 001000400h, 001000400h, 000010400h, 000010400h, 001010000h, 001010000h, 001000404h, 000010004h, 001000004h, 001000004h, 000010004h, 000000000h, 000000404h, 000010404h, 001000000h
        dd 000010000h, 001010404h, 000000004h, 001010000h, 001010400h, 001000000h, 001000000h, 000000400h, 001010004h, 000010000h, 000010400h, 001000004h, 000000400h, 000000004h, 001000404h, 000010404h
        dd 001010404h, 000010004h, 001010000h, 001000404h, 001000004h, 000000404h, 000010404h, 001010400h, 000000404h, 001000400h, 001000400h, 000000000h, 000010004h, 000010400h, 000000000h, 001010004h
    var_680 dd 020000010h, 020400000h, 000004000h, 020404010h, 020400000h, 000000010h, 020404010h, 000400000h, 020004000h, 000404010h, 000400000h, 020000010h, 000400010h, 020004000h, 020000000h, 000004010h
        dd 000000000h, 000400010h, 020004010h, 000004000h, 000404000h, 020004010h, 000000010h, 020400010h, 020400010h, 000000000h, 000404010h, 020404000h, 000004010h, 000404000h, 020404000h, 020000000h
        dd 020004000h, 000000010h, 020400010h, 000404000h, 020404010h, 000400000h, 000004010h, 020000010h, 000400000h, 020004000h, 020000000h, 000004010h, 020000010h, 020404010h, 000404000h, 020400000h
        dd 000404010h, 020404000h, 000000000h, 020400010h, 000000010h, 000004000h, 020400000h, 000404010h, 000004000h, 000400010h, 020004010h, 000000000h, 020404000h, 020000000h, 000400010h, 020004010h
    var_580 dd 010001040h, 000001000h, 000040000h, 010041040h, 010000000h, 010001040h, 000000040h, 010000000h, 000040040h, 010040000h, 010041040h, 000041000h, 010041000h, 000041040h, 000001000h, 000000040h
        dd 010040000h, 010000040h, 010001000h, 000001040h, 000041000h, 000040040h, 010040040h, 010041000h, 000001040h, 000000000h, 000000000h, 010040040h, 010000040h, 010001000h, 000041040h, 000040000h
        dd 000041040h, 000040000h, 010041000h, 000001000h, 000000040h, 010040040h, 000001000h, 000041040h, 010001000h, 000000040h, 010000040h, 010040000h, 010040040h, 010000000h, 000040000h, 010001040h
        dd 000000000h, 010041040h, 000040040h, 010000040h, 010040000h, 010001000h, 010001040h, 000000000h, 010041040h, 000041000h, 000041000h, 000001040h, 000001040h, 000040040h, 010000000h, 010041000h
    var_480    dd 000000100h, 002080100h, 002080000h, 042000100h, 000080000h, 000000100h, 040000000h, 002080000h, 040080100h, 000080000h, 002000100h, 040080100h, 042000100h, 042080000h, 000080100h, 040000000h
        dd 002000000h, 040080000h, 040080000h, 000000000h, 040000100h, 042080100h, 042080100h, 002000100h, 042080000h, 040000100h, 000000000h, 042000000h, 002080100h, 002000000h, 042000000h, 000080100h
        dd 000080000h, 042000100h, 000000100h, 002000000h, 040000000h, 002080000h, 042000100h, 040080100h, 002000100h, 040000000h, 042080000h, 002080100h, 040080100h, 000000100h, 002000000h, 042080000h
        dd 042080100h, 000080100h, 042000000h, 042080100h, 002080000h, 000000000h, 040080000h, 042000000h, 000080100h, 002000100h, 040000100h, 000080000h, 000000000h, 040080000h, 002080100h, 040000100h
    var_380 dd 000200000h, 004200002h, 004000802h, 000000000h, 000000800h, 004000802h, 000200802h, 004200800h, 004200802h, 000200000h, 000000000h, 004000002h, 000000002h, 004000000h, 004200002h, 000000802h
        dd 004000800h, 000200802h, 000200002h, 004000800h, 004000002h, 004200000h, 004200800h, 000200002h, 004200000h, 000000800h, 000000802h, 004200802h, 000200800h, 000000002h, 004000000h, 000200800h
        dd 004000000h, 000200800h, 000200000h, 004000802h, 004000802h, 004200002h, 004200002h, 000000002h, 000200002h, 004000000h, 004000800h, 000200000h, 004200800h, 000000802h, 000200802h, 004200800h
        dd 000000802h, 004000002h, 004200802h, 004200000h, 000200800h, 000000000h, 000000002h, 004200802h, 000000000h, 000200802h, 004200000h, 000000800h, 004000002h, 004000800h, 000000800h, 000200002h
    var_280 dd 000000208h, 008020200h, 000000000h, 008020008h, 008000200h, 000000000h, 000020208h, 008000200h, 000020008h, 008000008h, 008000008h, 000020000h, 008020208h, 000020008h, 008020000h, 000000208h
        dd 008000000h, 000000008h, 008020200h, 000000200h, 000020200h, 008020000h, 008020008h, 000020208h, 008000208h, 000020200h, 000020000h, 008000208h, 000000008h, 008020208h, 000000200h, 008000000h
        dd 008020200h, 008000000h, 000020008h, 000000208h, 000020000h, 008020200h, 008000200h, 000000000h, 000000200h, 000020008h, 008020208h, 008000200h, 008000008h, 000000200h, 000000000h, 008020008h
        dd 008000208h, 000020000h, 008000000h, 008020208h, 000000008h, 000020208h, 000020200h, 008000008h, 008020000h, 008000208h, 000000208h, 008020000h, 000020208h, 000000008h, 008020008h, 000020200h
    Dst dd 002002608h
    var_17C dd 010200e3ah, 000242327h, 004000431h, 000042834h, 020002b26h, 000241613h, 00008003fh, 001203811h, 020001f00h, 00020340eh, 020093015h, 005000b0ch, 02008030eh, 001000525h, 0000d3c13h
        dd 020103f04h, 008001a21h, 000100e3ah, 003000816h, 020181107h, 001002b30h, 020002432h, 00300330bh, 020081c0dh, 00220052dh, 002082910h, 002002413h, 000081a25h, 00030321ch, 000001d29h, 00402090ah
        dd 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h
        dd 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h
        dd 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h
        dd 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h, 000000000h
        
        
    debuf dd 000001d29h 
    debuf2 dd 00402090ah    
        dd 000081a25h, 00030321ch
        dd 002082910h, 002002413h
        dd 020081c0dh, 00220052dh
        dd 020002432h, 00300330bh
        dd 020181107h, 001002b30h
        dd 000100e3ah, 003000816h
        dd 020103f04h, 008001a21h
        dd 001000525h, 0000d3c13h
        dd 005000b0ch, 02008030eh
        dd 00020340eh, 020093015h
        dd 001203811h, 020001f00h
        dd 000241613h, 00008003fh
        dd 000042834h, 020002b26h
        dd 000242327h, 004000431h
        dd 002002608h, 010200e3ah
        
.code

InitXor proc near
    push ebp
    mov ebp,esp
    mov     edx, [ebp+8]
                mov     eax, [edx+edi*4]
                mov     edx, [edx+edi*4+4]
                mov     ecx, eax
                mov     ebx, eax
                shr     ebx, 10h
                and     ecx, 0FF0000h
                or      ecx, ebx
                mov     ebx, eax
                and     eax, 0FF00h
                shl     ebx, 10h
                or      ebx, eax
                mov     eax, edx
                shl     ebx, 8
                shr     ecx, 8
                or      ecx, ebx
                mov     ebx, edx
                and     eax, 0FF0000h
                shr     ebx, 10h
                or      eax, ebx
                mov     ebx, edx
                and     edx, 0FF00h
                shl     ebx, 10h
                or      ebx, edx
                shr     eax, 8
                shl     ebx, 8
                or      eax, ebx
                mov     edx, ecx
                shr     edx, 4
                xor     edx, eax
                and     edx, 0F0F0F0Fh
                xor     eax, edx
                shl     edx, 4
                xor     ecx, edx
                mov     edx, ecx
                shr     edx, 10h
                xor     edx, eax
                and     edx, 0FFFFh
                xor     eax, edx
                shl     edx, 10h
                xor     ecx, edx
                mov     edx, eax
                shr     edx, 2
                xor     edx, ecx
                and     edx, 33333333h
                xor     ecx, edx
                add     edx, edx
                add     edx, edx
                xor     eax, edx
                mov     edx, eax
                shr     edx, 8
                xor     edx, ecx
                and     edx, 0FF00FFh
                xor     ecx, edx
                shl     edx, 8
                xor     eax, edx
                mov     edx, ecx
                shr     edx, 1
                xor     edx, eax
                and     edx, 55555555h
                lea     ebx, [edx+edx]
                xor     ebx, ecx
                xor     eax, edx
                rol     ebx, 1
                rol     eax, 1
                pop ebp
    retn 4

InitXor endp


LoopXor proc near ; 操作 ebx,eax,返回 ebx,ecx
    
                xor     ebp, ebp             
                mov     [var_98C], ebp
                mov     ecx, eax

loc_4031C4:                             ; CODE XREF: sub_401E00+145Cj
                mov     eax, [ebp*4+Dst]
                xor     eax, ecx
                mov     edx, ecx
                ror     edx, 4
                xor     edx, [ebp*4+var_17C]
                mov     [var_988], ebx
                mov     ebx, ecx
                mov     ecx, eax
                shr     ecx, 8
                and     ecx, 3Fh
                mov     ecx, [ecx*4+var_680]
                mov     ebp, edx
                shr     ebp, 8
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_480]
                mov     ebp, eax
                shr     ebp, 10h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_980]
                mov     ebp, edx
                shr     ebp, 10h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_280]
                mov     ebp, eax
                shr     ebp, 18h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_880]
                mov     ebp, edx
                shr     ebp, 18h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_780]
                mov     ebp, [var_98C]
                and     eax, 3Fh
                or      ecx, [eax*4+var_580]
                and     edx, 3Fh
                or      ecx, [edx*4+var_380]
                add     ebp, 2
                xor     ecx, [var_988]
                mov     [var_98C], ebp
                cmp     ebp, 20h
                jnz     loc_4031C4
    retn

LoopXor endp

ExitXor proc near
    
    ror     ecx, 1
                ror     ebx, 1
                mov     edx, ecx
                shr     edx, 1
                mov     eax, ebx
                xor     edx, eax
                and     edx, 55555555h
                xor     eax, edx
                add     edx, edx
                xor     ecx, edx
                mov     edx, eax
                shr     edx, 8
                xor     edx, ecx
                and     edx, 0FF00FFh
                xor     ecx, edx
                shl     edx, 8
                xor     eax, edx
                mov     edx, eax
                shr     edx, 2
                xor     edx, ecx
                and     edx, 33333333h
                xor     ecx, edx
                add     edx, edx
                add     edx, edx
                xor     eax, edx
                mov     edx, ecx
                shr     edx, 10h
                xor     edx, eax
                and     edx, 0FFFFh
                xor     eax, edx
                shl     edx, 10h
                xor     ecx, edx
                mov     ebx, ecx
                shr     ebx, 4
                xor     ebx, eax
                and     ebx, 0F0F0F0Fh
                mov     edx, ebx
                shl     edx, 4
                xor     edx, ecx
                mov     ebp, edx
                mov     ecx, edx
                shr     ecx, 10h
                and     ebp, 0FF0000h
                or      ebp, ecx
                mov     ecx, edx
                xor     eax, ebx
                and     edx, 0FF00h
                shl     ecx, 10h
                or      ecx, edx
                mov     edx, eax
                and     edx, 0FF0000h
                mov     ebx, eax
                shr     ebx, 10h
                or      edx, ebx
                mov     ebx, eax
                shl     ebx, 10h
                and     eax, 0FF00h
                shl     ecx, 8
                or      ebx, eax
                shr     ebp, 8
                or      ebp, ecx                
                shr     edx, 8
                shl     ebx, 8
                or      edx, ebx
    retn

ExitXor endp

LoopXor2 proc near ; 操作 ebx,eax,返回 ebx,ecx
    
                xor     ebp, ebp             
                mov     [var_98C], ebp
                mov     ecx, eax

LOOP1:                             ; CODE XREF: sub_401E00+145Cj
                mov     eax, [ebp*4+debuf]
                xor     eax, ecx
                mov     edx, ecx
                ror     edx, 4
                xor     edx, [ebp*4+debuf2]
                mov     [var_988], ebx
                mov     ebx, ecx
                mov     ecx, eax
                shr     ecx, 8
                and     ecx, 3Fh
                mov     ecx, [ecx*4+var_680]
                mov     ebp, edx
                shr     ebp, 8
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_480]
                mov     ebp, eax
                shr     ebp, 10h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_980]
                mov     ebp, edx
                shr     ebp, 10h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_280]
                mov     ebp, eax
                shr     ebp, 18h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_880]
                mov     ebp, edx
                shr     ebp, 18h
                and     ebp, 3Fh
                or      ecx, [ebp*4+var_780]
                and     eax, 3Fh
                or      ecx, [eax*4+var_580]
                and     edx, 3Fh
                or      ecx, [edx*4+var_380]
                xor     ecx, [var_988]
                mov     ebp, [var_98C]
                add     ebp, 2
                mov     [var_98C], ebp
                cmp     ebp, 20h
                jne     LOOP1
    retn

LoopXor2 endp

Ecode proc ;arg_0:dword,len:dword
  push ebp
  mov  ebp,esp
   pushad

                xor     esi,esi
                mov     ebx,[ebp+0ch]
                shr     ebx, 2          ; ebx = 数据长度
                add     esp, 10h
                xor     edi, edi
                mov     [var_984], ebx
                cmp     ebx, esi
                jbe     loc_40332F
                lea     esp, [esp+0]
                
                mov     esi, [ebp+8]

loc_403100:                             ; CODE XREF: sub_401E00+1529j
                push    esi
                call    InitXor          ; 操作 eax,edx  返回 ebx,eax
                call    LoopXor          ; 操作 ebx,eax  返回 ebx,ecx 
                call    ExitXor          ; 操作 ebx,ecx  返回 ebp,edx
                mov     ecx, esi
                mov     [ecx+edi*4], ebp
                mov     [ecx+edi*4+4], edx
                add     edi, 2
                cmp     edi, [var_984]
                jb      loc_403100
loc_40332F: 
    popad 
    sub esp,10h
    pop ebp
    ret 8

Ecode endp



decode proc 
    
    
  push ebp
  mov  ebp,esp
   pushad

                xor     esi,esi
                mov     ebx,[ebp+0ch]
                shr     ebx, 2          ; ebx = 数据长度
                add     esp, 10h
                xor     edi, edi
                mov     [var_984], ebx
                cmp     ebx, esi
                jbe     loc_40332F
                lea     esp, [esp+0]
                
                mov     esi, [ebp+8]

loc_403100:                             ; CODE XREF: sub_401E00+1529j
                push    esi
                call    InitXor          ; 操作 eax,edx  返回 ebx,eax
                call    LoopXor2          ; 操作 ebx,eax  返回 ebx,ecx 
                call    ExitXor          ; 操作 ebx,ecx  返回 ebp,edx
                mov     ecx, esi
                mov     [ecx+edi*4], ebp
                mov     [ecx+edi*4+4], edx
                add     edi, 2
                cmp     edi, [var_984]
                jb      loc_403100
loc_40332F: 
    popad 
    sub esp,10h
    pop ebp
    ret 8

decode endp

DecodeBuf proc arg0:dword,arg1:dword
    
    push arg1
    push arg0
    call decode
    ret

DecodeBuf endp

end
;main:  ;for test
;
;    push 0ah
;    push offset string
;    call Ecode
;    
;    push 0ah
;    push offset string
;    call decode
;    
;
;    ret
;
;
;end main

将第三部代码放入RADASM编译后,导入VS项目,在test.cpp中声明一下,调用解密即可:

#define _WINSOCK_DEPRECATED_NO_WARNINGS

#include <stdio.h>
#include <WinSock2.h>
#include <windows.h>

#pragma comment (lib, "Ws2_32.lib")

extern "C" void __stdcall DecodeBuf(DWORD, DWORD);

int main()
{
    WSADATA wd = { 0 };
    WSAStartup(MAKEWORD(2, 2), &wd);

    SOCKET s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
    
    SOCKADDR_IN sai = { 0 };
    sai.sin_addr.S_un.S_addr = inet_addr("127.0.0.1");
    sai.sin_port = htons(10010);
    sai.sin_family = AF_INET;
    connect(s, (sockaddr*)&sai, sizeof(SOCKADDR_IN));
    
    CHAR szToSend[100] = { 0 };
    printf("请输入要发送的信息\n");

    scanf_s("%s", szToSend, 100);

    send(s, szToSend, 11, NULL);

    CHAR RecvBuf[200] = { 0 };
    int nlen = recv(s, RecvBuf, 200, NULL);
    
    printf("接收到的加密了之后的信息:\n");
    for (int i = 0; i < nlen; ++i)
    {
        printf("0x%x ", (BYTE)RecvBuf[i]);
    }
    printf("\n");

    DecodeBuf((DWORD)RecvBuf, nlen);
    printf("解密之后的信息:%s\n",RecvBuf);

    system("pause");

    send(s, "quit", 5, NULL);
    closesocket(s);
    WSACleanup();


    return 0;
}

 

posted on 2017-03-25 17:36  fuckitup123  阅读(443)  评论(0编辑  收藏  举报