#include <windows.h>
#include <stdio.h>

char data[50]={0x0B, 0x00, 0x00, 0x00, 0x50, 0x56, 0x67, 0x48,
0x69, 0x4D, 0x7E, 0x76, 0x56, 0x50, 0x56, 0x67,
0x48, 0x69, 0x4D, 0x7E, 0x76, 0x56, 0x50, 0x56,
0x67, 0x48, 0x69, 0x4D, 0x7E, 0x76, 0x56, 0x50,
0x56, 0x67, 0x48, 0x69, 0x4D, 0x7E, 0x76, 0x56}; //79ea80
char data2[50]={0x09, 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x00,
0x50, 0x56, 0x67, 0x48, 0x69, 0x4D, 0x7E, 0x76,
0x56, 0x50, 0x56, 0x67, 0x48, 0x69, 0x4D, 0x7E,
0x76, 0x56, 0x50, 0x56, 0x67, 0x48, 0x69, 0x4D,
0x7E, 0x76, 0x56, 0x50, 0x56, 0x67, 0x48, 0x69,
0x4D, 0x7E, 0x76, 0x56}; //79ea7c
char newdata[50]={0xFF, 0xFF, 0xFF, 0xFF, 0xFD, 0xFD, 0xFD, 0xFD,
0xFB, 0xFB, 0xFB, 0xFB, 0xF9, 0xF9, 0xF9, 0xF9,
0xF7, 0xF7, 0xF7, 0xF7, 0xF5, 0xF5, 0xF5, 0xF5,
0xF3, 0xF3, 0xF3, 0xF3, 0xF1, 0xF1, 0xF1, 0xF1,
0xEF, 0xEF, 0xEF, 0xEF, 0xED, 0xED, 0xED, 0xED,
0xEB, 0xEB, 0xEB, 0xEB, 0xE9, 0xE9, 0xE9, 0xE9}; //795ae8
char data4[50]={0x50, 0x56, 0x67, 0x48, 0x69, 0x4D, 0x7E, 0x76,
0x56, 0x50, 0x56, 0x67, 0x48, 0x69, 0x4D, 0x7E,
0x76, 0x56, 0x50, 0x56, 0x67, 0x48, 0x69, 0x4D,
0x7E, 0x76, 0x56, 0x50, 0x56, 0x67, 0x48, 0x69,
0x4D, 0x7E, 0x76, 0x56}; //79ea84
char *data3=data4;

__declspec(naked) int __cdecl EncryptFunction(char* Source,char* Dest,int SourceSize,char* EncryptString,int EncryptOption)
{
__asm{
_EncryptFunction: //<= Procedure Start

PUSH EBP
MOV EBP,ESP // function(Source,Dest,SourceSize,EncryptString,EncryptOption)
MOV EAX,DWORD PTR SS:[EBP+0x10] // SourceSize를 eax에 넣는다.
PUSH EBX // ebx 백업
MOV EBX,DWORD PTR SS:[EBP+0xC] // Dest를 ebx에 넣는다.
PUSH ESI // esi 백업
MOV ESI,EAX // esi에 sourceSize를 넣는다.
SHR ESI,0x2 // ESI = SourceSize>>2 // Source의 크기를 4로 나누어 나머지를 버리는 연산
XOR ECX,ECX // ecx=0
TEST ESI,ESI // ESI = SourceSize에서 4로 나눈 몫
PUSH EDI // edi 백업
MOV EDI,DWORD PTR SS:[EBP+0x8] // Source가 EDI로 들어감
JLE _WinBaram_00572582 // WinBaram.00572582
LEA EBX,DWORD PTR DS:[EBX] // ebx=ebx

_WinBaram_00572560:

MOV EAX,ECX // ecx=0 부터 ++하면서 증가
CDQ // 나눗셈을 위해 eax->edx:eax로 변환 edx=나머지 eax=몫
IDIV DWORD PTR SS:[EBP+0x18] // ecx를 SourceSize 로 나눔.
MOV EAX,DWORD PTR SS:[EBP+0x14] // eax = EncryptString
ADD ECX,0x1 // ecx++
ADD EDI,0x4 // Source + 4Byte
ADD EBX,0x4 // Dest + 4Byte
MOV EDX,DWORD PTR DS:[EAX+EDX*0x4] // EncryptString+ 나머지*4
XOR EDX,DWORD PTR DS:[EDI-0x4] // Source 4바이트 앞 xor EncryptString
CMP ECX,ESI // Source의 4바이트로 끊은 esi 와 현 ecx와 비교
MOV DWORD PTR DS:[EBX-0x4],EDX // 암호화된 edx는 dest 4바이트에 넣는다.
JL _WinBaram_00572560 // WinBaram.00572560
MOV EAX,DWORD PTR SS:[EBP+0x10] // Eax = SourceSize

_WinBaram_00572582: