Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- .text:00403310 ; int __thiscall sub_403310(LPSTR, LPSTR lpFileName, int, int)
- .text:00403310 sub_403310 proc near ; CODE XREF: sub_415F60+DD7p
- .text:00403310 ; sub_420EF0+1E4p ...
- .text:00403310
- .text:00403310 var_98 = dword ptr -98h
- .text:00403310 var_94 = dword ptr -94h
- .text:00403310 var_90 = dword ptr -90h
- .text:00403310 NumberOfBytesRead= dword ptr -8Ch
- .text:00403310 var_88 = _OFSTRUCT ptr -88h
- .text:00403310 lpFileName = dword ptr 4
- .text:00403310 arg_4 = dword ptr 8
- .text:00403310 arg_8 = dword ptr 0Ch
- .text:00403310
- .text:00403310 sub esp, 98h
- .text:00403316 push ebx
- .text:00403317 push esi
- .text:00403318 mov esi, ecx
- .text:0040331A push edi
- .text:0040331B cmp dword ptr [esi+0C0h], 1
- .text:00403322 jnz short loc_40333D
- .text:00403324 mov eax, [esi+0D0h]
- .text:0040332A mov dword ptr [esi+0C0h], 0
- .text:00403334 push eax ; lpMem
- .text:00403335 call sub_422B34
- .text:0040333A add esp, 4
- .text:0040333D
- .text:0040333D loc_40333D: ; CODE XREF: sub_403310+12j
- .text:0040333D mov ebx, [esp+0A4h+lpFileName]
- .text:00403344 lea ecx, [esp+0A4h+var_88]
- .text:00403348 push 0 ; WORD
- .text:0040334A push ecx ; LPOFSTRUCT
- .text:0040334B push ebx ; LPSTR
- .text:0040334C call LZOpenFileA
- .text:00403351 mov edi, eax
- .text:00403353 cmp edi, 0FFFFFFFFh
- .text:00403356 jnz short loc_4033CC
- .text:00403358 push 0 ; hTemplateFile
- .text:0040335A push 80h ; dwFlagsAndAttributes
- .text:0040335F push 3 ; dwCreationDisposition
- .text:00403361 push 0 ; lpSecurityAttributes
- .text:00403363 push 0 ; dwShareMode
- .text:00403365 push 80000000h ; dwDesiredAccess
- .text:0040336A push ebx ; lpFileName
- .text:0040336B call ds:CreateFileA
- .text:00403371 mov edi, eax
- .text:00403373 cmp edi, 0FFFFFFFFh
- .text:00403376 jnz short loc_403386
- .text:00403378 pop edi
- .text:00403379 pop esi
- .text:0040337A xor eax, eax
- .text:0040337C pop ebx
- .text:0040337D add esp, 98h
- .text:00403383 retn 0Ch
- .text:00403386 ; ---------------------------------------------------------------------------
- .text:00403386
- .text:00403386 loc_403386: ; CODE XREF: sub_403310+66j
- .text:00403386 mov ebx, ds:ReadFile
- .text:0040338C lea edx, [esp+0A4h+NumberOfBytesRead]
- .text:00403390 push 0 ; lpOverlapped
- .text:00403392 push edx ; lpNumberOfBytesRead
- .text:00403393 push 0C0h ; nNumberOfBytesToRead
- .text:00403398 push esi ; lpBuffer
- .text:00403399 push edi ; hFile
- .text:0040339A call ebx ; ReadFile
- .text:0040339C mov eax, [esi+0A0h]
- .text:004033A2 push eax ; unsigned int
- .text:004033A3 call ??2@YAPAXI@Z ; operator new(uint)
- .text:004033A8 mov edx, [esi+0A0h]
- .text:004033AE add esp, 4
- .text:004033B1 lea ecx, [esp+0A4h+NumberOfBytesRead]
- .text:004033B5 mov [esi+0D0h], eax
- .text:004033BB push 0 ; lpOverlapped
- .text:004033BD push ecx ; lpNumberOfBytesRead
- .text:004033BE push edx ; nNumberOfBytesToRead
- .text:004033BF push eax ; lpBuffer
- .text:004033C0 push edi ; hFile
- .text:004033C1 call ebx ; ReadFile
- .text:004033C3 push edi ; hObject
- .text:004033C4 call ds:CloseHandle
- .text:004033CA jmp short loc_403401
- .text:004033CC ; ---------------------------------------------------------------------------
- .text:004033CC
- .text:004033CC loc_4033CC: ; CODE XREF: sub_403310+46j
- .text:004033CC push 0C0h ; INT
- .text:004033D1 push esi ; LPSTR
- .text:004033D2 push edi ; INT
- .text:004033D3 call LZRead
- .text:004033D8 mov eax, [esi+0A0h]
- .text:004033DE push eax ; unsigned int
- .text:004033DF call ??2@YAPAXI@Z ; operator new(uint)
- .text:004033E4 mov ecx, [esi+0A0h]
- .text:004033EA add esp, 4
- .text:004033ED mov [esi+0D0h], eax
- .text:004033F3 push ecx ; INT
- .text:004033F4 push eax ; LPSTR
- .text:004033F5 push edi ; INT
- .text:004033F6 call LZRead
- .text:004033FB push edi ; INT
- .text:004033FC call LZClose
- .text:00403401 ; Fully encrypted at this point
- .text:00403401 loc_403401: ; CODE XREF: sub_403310+BAj
- .text:00403401 mov eax, [esi+0A0h]
- .text:00403407 xor ecx, ecx
- .text:00403409 xor ebx, ebx
- .text:0040340B cmp eax, ecx
- .text:0040340D mov [esp+0A4h+var_90], ebx
- .text:00403411 mov [esp+0A4h+var_98], ecx
- .text:00403415 mov [esp+0A4h+var_94], ecx
- .text:00403419 jbe loc_4034BB
- .text:0040341F
- .text:0040341F loc_40341F: ; CODE XREF: sub_403310+1A5j
- .text:0040341F lea eax, [ecx+ebx]
- .text:00403422 xor edx, edx
- .text:00403424 div [esp+0A4h+arg_8]
- .text:0040342B mov eax, [esp+0A4h+var_98]
- .text:0040342F and ecx, 0FFh
- .text:00403435 and eax, 0FFh
- .text:0040343A and ecx, eax
- .text:0040343C mov eax, [esp+0A4h+arg_4]
- .text:00403443 mov edi, edx
- .text:00403445 mov edx, [esi+0D0h]
- .text:0040344B add ebx, edx
- .text:0040344D xor edx, edx
- .text:0040344F mov dl, [edi+eax]
- .text:00403452 or ecx, edx
- .text:00403454 and ecx, 800000FFh
- .text:0040345A jns short loc_403464
- .text:0040345C dec ecx
- .text:0040345D or ecx, 0FFFFFF00h
- .text:00403463 inc ecx
- .text:00403464
- .text:00403464 loc_403464: ; CODE XREF: sub_403310+14Aj
- .text:00403464 push ecx
- .text:00403465 mov cl, [ebx]
- .text:00403467 push ecx
- .text:00403468 mov ecx, esi
- .text:0040346A call sub_402E70
- .text:0040346F test edi, edi
- .text:00403471 mov [ebx], al
- .text:00403473 jnz short loc_4034A0
- .text:00403475 mov edx, [esp+0A4h+var_94]
- .text:00403479 mov edi, [esp+0A4h+var_98]
- .text:0040347D xor ecx, ecx
- .text:0040347F lea eax, [edx+edi]
- .text:00403482 xor edx, edx
- .text:00403484 div [esp+0A4h+arg_8]
- .text:0040348B mov eax, [esp+0A4h+arg_4]
- .text:00403492 inc edi
- .text:00403493 mov [esp+0A4h+var_98], edi
- .text:00403497 mov cl, [edx+eax]
- .text:0040349A mov [esp+0A4h+var_94], ecx
- .text:0040349E jmp short loc_4034A4
- .text:004034A0 ; ---------------------------------------------------------------------------
- .text:004034A0
- .text:004034A0 loc_4034A0: ; CODE XREF: sub_403310+163j
- .text:004034A0 mov ecx, [esp+0A4h+var_94]
- .text:004034A4
- .text:004034A4 loc_4034A4: ; CODE XREF: sub_403310+18Ej
- .text:004034A4 mov ebx, [esp+0A4h+var_90]
- .text:004034A8 mov eax, [esi+0A0h]
- .text:004034AE inc ebx
- .text:004034AF cmp ebx, eax
- .text:004034B1 mov [esp+0A4h+var_90], ebx
- .text:004034B5 jb loc_40341F
- .text:004034BB
- .text:004034BB loc_4034BB: ; CODE XREF: sub_403310+109j
- .text:004034BB mov eax, [esi+0A0h]
- .text:004034C1 mov dword ptr [esi+0C8h], 0
- .text:004034CB mov [esi+0D4h], eax
- .text:004034D1 mov [esi+0D8h], eax
- .text:004034D7 mov dword ptr [esi+0C0h], 1
- .text:004034E1 mov dword ptr [esi+0CCh], 1
- .text:004034EB pop edi
- .text:004034EC pop esi
- .text:004034ED mov eax, 1
- .text:004034F2 pop ebx
- .text:004034F3 add esp, 98h
- .text:004034F9 retn 0Ch ; Fully decrypted
- .text:004034F9 sub_403310 endp
- .text:00402E70 ; =============== S U B R O U T I N E =======================================
- .text:00402E70
- .text:00402E70
- .text:00402E70 sub_402E70 proc near ; CODE XREF: sub_403310+15Ap
- .text:00402E70 ; sub_403820+81p ...
- .text:00402E70
- .text:00402E70 arg_0 = dword ptr 4
- .text:00402E70 arg_4 = dword ptr 8
- .text:00402E70
- .text:00402E70 mov ecx, [esp+arg_4]
- .text:00402E74 mov edx, [esp+arg_0]
- .text:00402E78 and ecx, 0FFh
- .text:00402E7E and edx, 0FFh
- .text:00402E84 mov eax, ecx
- .text:00402E86 or ecx, edx
- .text:00402E88 and eax, edx
- .text:00402E8A not eax
- .text:00402E8C and eax, ecx
- .text:00402E8E retn 8
- .text:00402E8E sub_402E70 endp
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
