009327A0 /$ 53 PUSH EBX
009327A1 |. 55 PUSH EBP
009327A2 |. 56 PUSH ESI
009327A3 |. 8BF0 MOV ESI,EAX
009327A5 |. 8B56 04 MOV EDX,DWORD PTR DS:[ESI+4]
009327A8 |. 8B4424 10 MOV EAX,DWORD PTR SS:[ESP+10] ; yo3.009331A3
009327AC |. 57 PUSH EDI
009327AD |. 8B3E MOV EDI,DWORD PTR DS:[ESI]
009327AF |. 8B4F 44 MOV ECX,DWORD PTR DS:[EDI+44]
009327B2 |. 3308 XOR ECX,DWORD PTR DS:[EAX]
009327B4 |. 8BC1 MOV EAX,ECX
009327B6 |. C1E8 10 SHR EAX,10
009327B9 |. 25 FF000000 AND EAX,0FF
009327BE |. 8B8482 00040000 MOV EAX,DWORD PTR DS:[EDX+EAX*4+400]
009327C5 |. 8BD9 MOV EBX,ECX
009327C7 |. C1EB 18 SHR EBX,18
009327CA |. 03049A ADD EAX,DWORD PTR DS:[EDX+EBX*4]
009327CD |. 8BD9 MOV EBX,ECX
009327CF |. C1EB 08 SHR EBX,8
009327D2 |. 81E3 FF000000 AND EBX,0FF
009327D8 |. 33849A 00080000 XOR EAX,DWORD PTR DS:[EDX+EBX*4+800]
009327DF |. 8BD9 MOV EBX,ECX
009327E1 |. 81E3 FF000000 AND EBX,0FF
009327E7 |. 03849A 000C0000 ADD EAX,DWORD PTR DS:[EDX+EBX*4+C00]
009327EE |. 8B5C24 18 MOV EBX,DWORD PTR SS:[ESP+18]
009327F2 |. 3347 40 XOR EAX,DWORD PTR DS:[EDI+40]
009327F5 |. 3303 XOR EAX,DWORD PTR DS:[EBX]
009327F7 |. 8BD8 MOV EBX,EAX
009327F9 |. C1EB 10 SHR EBX,10
009327FC |. 81E3 FF000000 AND EBX,0FF
00932802 |. 8B9C9A 00040000 MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
00932809 |. 8BE8 MOV EBP,EAX
0093280B |. C1ED 18 SHR EBP,18
0093280E |. 031CAA ADD EBX,DWORD PTR DS:[EDX+EBP*4]
00932811 |. 8BE8 MOV EBP,EAX
00932813 |. C1ED 08 SHR EBP,8
00932816 |. 81E5 FF000000 AND EBP,0FF
0093281C |. 339CAA 00080000 XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
00932823 |. 8BE8 MOV EBP,EAX
00932825 |. 81E5 FF000000 AND EBP,0FF
0093282B |. 039CAA 000C0000 ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
00932832 |. 335F 3C XOR EBX,DWORD PTR DS:[EDI+3C]
00932835 |. 33CB XOR ECX,EBX
00932837 |. 8BD9 MOV EBX,ECX
00932839 |. C1EB 10 SHR EBX,10
0093283C |. 81E3 FF000000 AND EBX,0FF
00932842 |. 8B9C9A 00040000 MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
00932849 |. 8BE9 MOV EBP,ECX
0093284B |. C1ED 18 SHR EBP,18
0093284E |. 031CAA ADD EBX,DWORD PTR DS:[EDX+EBP*4]
00932851 |. 8BE9 MOV EBP,ECX
00932853 |. C1ED 08 SHR EBP,8
00932856 |. 81E5 FF000000 AND EBP,0FF
0093285C |. 339CAA 00080000 XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
00932863 |. 8BE9 MOV EBP,ECX
00932865 |. 81E5 FF000000 AND EBP,0FF
0093286B |. 039CAA 000C0000 ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
00932872 |. 335F 38 XOR EBX,DWORD PTR DS:[EDI+38]
00932875 |. 33C3 XOR EAX,EBX
00932877 |. 8BD8 MOV EBX,EAX
00932879 |. C1EB 10 SHR EBX,10
0093287C |. 81E3 FF000000 AND EBX,0FF
00932882 |. 8B9C9A 00040000 MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
00932889 |. 8BE8 MOV EBP,EAX
0093288B |. C1ED 18 SHR EBP,18
0093288E |. 031CAA ADD EBX,DWORD PTR DS:[EDX+EBP*4]
00932891 |. 8BE8 MOV EBP,EAX
00932893 |. C1ED 08 SHR EBP,8
00932896 |. 81E5 FF000000 AND EBP,0FF
0093289C |. 339CAA 00080000 XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
009328A3 |. 8BE8 MOV EBP,EAX
009328A5 |. 81E5 FF000000 AND EBP,0FF
009328AB |. 039CAA 000C0000 ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
009328B2 |. 335F 34 XOR EBX,DWORD PTR DS:[EDI+34]
009328B5 |. 33CB XOR ECX,EBX
009328B7 |. 8BD9 MOV EBX,ECX
009328B9 |. C1EB 10 SHR EBX,10
009328BC |. 81E3 FF000000 AND EBX,0FF
009328C2 |. 8B9C9A 00040000 MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
009328C9 |. 8BE9 MOV EBP,ECX
009328CB |. C1ED 18 SHR EBP,18
009328CE |. 031CAA ADD EBX,DWORD PTR DS:[EDX+EBP*4]
009328D1 |. 8BE9 MOV EBP,ECX
009328D3 |. C1ED 08 SHR EBP,8
009328D6 |. 81E5 FF000000 AND EBP,0FF
009328DC |. 339CAA 00080000 XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
009328E3 |. 8BE9 MOV EBP,ECX
009328E5 |. 81E5 FF000000 AND EBP,0FF
009328EB |. 039CAA 000C0000 ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
009328F2 |. 8BF2 MOV ESI,EDX
009328F4 |. 335F 30 XOR EBX,DWORD PTR DS:[EDI+30]
009328F7 |. 33C3 XOR EAX,EBX
009328F9 |. 8BD8 MOV EBX,EAX
009328FB |. C1EB 10 SHR EBX,10
009328FE |. 81E3 FF000000 AND EBX,0FF
00932904 |. 8B9C9A 00040000 MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
0093290B |. 8BE8 MOV EBP,EAX
0093290D |. C1ED 18 SHR EBP,18
00932910 |. 031CAA ADD EBX,DWORD PTR DS:[EDX+EBP*4]
00932913 |. 8BE8 MOV EBP,EAX
00932915 |. C1ED 08 SHR EBP,8
00932918 |. 81E5 FF000000 AND EBP,0FF
0093291E |. 339CAA 00080000 XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
00932925 |. 8BE8 MOV EBP,EAX
00932927 |. 81E5 FF000000 AND EBP,0FF
0093292D |. 039CAA 000C0000 ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
00932934 |. 335F 2C XOR EBX,DWORD PTR DS:[EDI+2C]
00932937 |. 33CB XOR ECX,EBX
00932939 |. 8BD9 MOV EBX,ECX
0093293B |. C1EB 10 SHR EBX,10
0093293E |. 81E3 FF000000 AND EBX,0FF
00932944 |. 8B9C9A 00040000 MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
0093294B |. 8BE9 MOV EBP,ECX
0093294D |. C1ED 18 SHR EBP,18
00932950 |. 031CAA ADD EBX,DWORD PTR DS:[EDX+EBP*4]
00932953 |. 8BE9 MOV EBP,ECX
00932955 |. C1ED 08 SHR EBP,8
00932958 |. 81E5 FF000000 AND EBP,0FF
0093295E |. 339CAA 00080000 XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
00932965 |. 8BE9 MOV EBP,ECX
00932967 |. 81E5 FF000000 AND EBP,0FF
0093296D |. 039CAA 000C0000 ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
00932974 |. 335F 28 XOR EBX,DWORD PTR DS:[EDI+28]
00932977 |. 33C3 XOR EAX,EBX
00932979 |. 8BD8 MOV EBX,EAX
0093297B |. C1EB 10 SHR EBX,10
0093297E |. 81E3 FF000000 AND EBX,0FF
00932984 |. 8B9C9A 00040000 MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
0093298B |. 8BE8 MOV EBP,EAX
0093298D |. C1ED 18 SHR EBP,18
00932990 |. 031CAA ADD EBX,DWORD PTR DS:[EDX+EBP*4]
00932993 |. 8BE8 MOV EBP,EAX
00932995 |. C1ED 08 SHR EBP,8
00932998 |. 81E5 FF000000 AND EBP,0FF
0093299E |. 339CAA 00080000 XOR EBX,DWORD PTR DS:[EDX+EBP*4+800]
009329A5 |. 8BE8 MOV EBP,EAX
009329A7 |. 81E5 FF000000 AND EBP,0FF
009329AD |. 039CAA 000C0000 ADD EBX,DWORD PTR DS:[EDX+EBP*4+C00]
009329B4 |. 335F 24 XOR EBX,DWORD PTR DS:[EDI+24]
009329B7 |. 33CB XOR ECX,EBX
009329B9 |. 8BD9 MOV EBX,ECX
009329BB |. C1EB 10 SHR EBX,10
009329BE |. 81E3 FF000000 AND EBX,0FF
009329C4 |. 8B9C9A 00040000 MOV EBX,DWORD PTR DS:[EDX+EBX*4+400]
009329CB |. 8BE9 MOV EBP,ECX
009329CD |. C1ED 18 SHR EBP,18
009329D0 |. 031CAA ADD EBX,DWORD PTR DS:[EDX+EBP*4]
009329D3 |. 8BD1 MOV EDX,ECX
009329D5 |. C1EA 08 SHR EDX,8
009329D8 |. 81E2 FF000000 AND EDX,0FF
009329DE |. 339C96 00080000 XOR EBX,DWORD PTR DS:[ESI+EDX*4+800]
009329E5 |. 8BD1 MOV EDX,ECX
009329E7 |. 81E2 FF000000 AND EDX,0FF
009329ED |. 039C96 000C0000 ADD EBX,DWORD PTR DS:[ESI+EDX*4+C00]
009329F4 |. 335F 20 XOR EBX,DWORD PTR DS:[EDI+20]
009329F7 |. 33C3 XOR EAX,EBX
009329F9 |. 8BD0 MOV EDX,EAX
009329FB |. C1EA 10 SHR EDX,10
009329FE |. 81E2 FF000000 AND EDX,0FF
00932A04 |. 8B9496 00040000 MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932A0B |. 8BD8 MOV EBX,EAX
00932A0D |. C1EB 18 SHR EBX,18
00932A10 |. 03149E ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932A13 |. 8BD8 MOV EBX,EAX
00932A15 |. C1EB 08 SHR EBX,8
00932A18 |. 81E3 FF000000 AND EBX,0FF
00932A1E |. 33949E 00080000 XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932A25 |. 8BD8 MOV EBX,EAX
00932A27 |. 81E3 FF000000 AND EBX,0FF
00932A2D |. 03949E 000C0000 ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932A34 |. 3357 1C XOR EDX,DWORD PTR DS:[EDI+1C]
00932A37 |. 33CA XOR ECX,EDX
00932A39 |. 8BD1 MOV EDX,ECX
00932A3B |. C1EA 10 SHR EDX,10
00932A3E |. 81E2 FF000000 AND EDX,0FF
00932A44 |. 8B9496 00040000 MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932A4B |. 8BD9 MOV EBX,ECX
00932A4D |. C1EB 18 SHR EBX,18
00932A50 |. 03149E ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932A53 |. 8BD9 MOV EBX,ECX
00932A55 |. C1EB 08 SHR EBX,8
00932A58 |. 81E3 FF000000 AND EBX,0FF
00932A5E |. 33949E 00080000 XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932A65 |. 8BD9 MOV EBX,ECX
00932A67 |. 81E3 FF000000 AND EBX,0FF
00932A6D |. 03949E 000C0000 ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932A74 |. 3357 18 XOR EDX,DWORD PTR DS:[EDI+18]
00932A77 |. 33C2 XOR EAX,EDX
00932A79 |. 8BD0 MOV EDX,EAX
00932A7B |. C1EA 10 SHR EDX,10
00932A7E |. 81E2 FF000000 AND EDX,0FF
00932A84 |. 8B9496 00040000 MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932A8B |. 8BD8 MOV EBX,EAX
00932A8D |. C1EB 18 SHR EBX,18
00932A90 |. 03149E ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932A93 |. 8BD8 MOV EBX,EAX
00932A95 |. C1EB 08 SHR EBX,8
00932A98 |. 81E3 FF000000 AND EBX,0FF
00932A9E |. 33949E 00080000 XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932AA5 |. 8BD8 MOV EBX,EAX
00932AA7 |. 81E3 FF000000 AND EBX,0FF
00932AAD |. 03949E 000C0000 ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932AB4 |. 3357 14 XOR EDX,DWORD PTR DS:[EDI+14]
00932AB7 |. 33CA XOR ECX,EDX
00932AB9 |. 8BD1 MOV EDX,ECX
00932ABB |. C1EA 10 SHR EDX,10
00932ABE |. 81E2 FF000000 AND EDX,0FF
00932AC4 |. 8B9496 00040000 MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932ACB |. 8BD9 MOV EBX,ECX
00932ACD |. C1EB 18 SHR EBX,18
00932AD0 |. 03149E ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932AD3 |. 8BD9 MOV EBX,ECX
00932AD5 |. C1EB 08 SHR EBX,8
00932AD8 |. 81E3 FF000000 AND EBX,0FF
00932ADE |. 33949E 00080000 XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932AE5 |. 8BD9 MOV EBX,ECX
00932AE7 |. 81E3 FF000000 AND EBX,0FF
00932AED |. 03949E 000C0000 ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932AF4 |. 3357 10 XOR EDX,DWORD PTR DS:[EDI+10]
00932AF7 |. 33C2 XOR EAX,EDX
00932AF9 |. 8BD0 MOV EDX,EAX
00932AFB |. C1EA 10 SHR EDX,10
00932AFE |. 81E2 FF000000 AND EDX,0FF
00932B04 |. 8B9496 00040000 MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932B0B |. 8BD8 MOV EBX,EAX
00932B0D |. C1EB 18 SHR EBX,18
00932B10 |. 03149E ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932B13 |. 8BD8 MOV EBX,EAX
00932B15 |. C1EB 08 SHR EBX,8
00932B18 |. 81E3 FF000000 AND EBX,0FF
00932B1E |. 33949E 00080000 XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932B25 |. 8BD8 MOV EBX,EAX
00932B27 |. 81E3 FF000000 AND EBX,0FF
00932B2D |. 03949E 000C0000 ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932B34 |. 3357 0C XOR EDX,DWORD PTR DS:[EDI+C]
00932B37 |. 33CA XOR ECX,EDX
00932B39 |. 8BD1 MOV EDX,ECX
00932B3B |. C1EA 10 SHR EDX,10
00932B3E |. 81E2 FF000000 AND EDX,0FF
00932B44 |. 8B9496 00040000 MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932B4B |. 8BD9 MOV EBX,ECX
00932B4D |. C1EB 18 SHR EBX,18
00932B50 |. 03149E ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932B53 |. 8BD9 MOV EBX,ECX
00932B55 |. C1EB 08 SHR EBX,8
00932B58 |. 81E3 FF000000 AND EBX,0FF
00932B5E |. 33949E 00080000 XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932B65 |. 8BD9 MOV EBX,ECX
00932B67 |. 81E3 FF000000 AND EBX,0FF
00932B6D |. 03949E 000C0000 ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932B74 |. 3357 08 XOR EDX,DWORD PTR DS:[EDI+8]
00932B77 |. 33C2 XOR EAX,EDX
00932B79 |. 8BD0 MOV EDX,EAX
00932B7B |. C1EA 10 SHR EDX,10
00932B7E |. 81E2 FF000000 AND EDX,0FF
00932B84 |. 8B9496 00040000 MOV EDX,DWORD PTR DS:[ESI+EDX*4+400]
00932B8B |. 8BD8 MOV EBX,EAX
00932B8D |. C1EB 18 SHR EBX,18
00932B90 |. 03149E ADD EDX,DWORD PTR DS:[ESI+EBX*4]
00932B93 |. 8BD8 MOV EBX,EAX
00932B95 |. C1EB 08 SHR EBX,8
00932B98 |. 81E3 FF000000 AND EBX,0FF
00932B9E |. 33949E 00080000 XOR EDX,DWORD PTR DS:[ESI+EBX*4+800]
00932BA5 |. 8BD8 MOV EBX,EAX
00932BA7 |. 81E3 FF000000 AND EBX,0FF
00932BAD |. 03949E 000C0000 ADD EDX,DWORD PTR DS:[ESI+EBX*4+C00]
00932BB4 |. 3357 04 XOR EDX,DWORD PTR DS:[EDI+4]
00932BB7 |. 33CA XOR ECX,EDX
00932BB9 |. 8B17 MOV EDX,DWORD PTR DS:[EDI]
00932BBB |. 33D0 XOR EDX,EAX
00932BBD |. 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14]
00932BC1 |. 5F POP EDI ; 14D70138
00932BC2 |. 5E POP ESI ; 14D70138
00932BC3 |. 8910 MOV DWORD PTR DS:[EAX],EDX
00932BC5 |. 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] ; yo3.009331A3
00932BC9 |. 5D POP EBP ; 14D70138
00932BCA |. 890A MOV DWORD PTR DS:[EDX],ECX
00932BCC |. 5B POP EBX ; 14D70138
00932BCD \. C2 0800 RETN 8
so I found that using ollydbg , well first I thought this cipher could be XTEA but XTEA does not do AND on the plain text , so I thought I may post this cipher here maybe someone Identify it and tell me wither it’s an existing cipher or this is a custom cipher and I need to write it based on this asm code. thanks.
This is just the encryption (or decryption) round, it would help to see the initialization function. But it smells like Blowfish. From Wikipedia:
And here’s how the code looks after running it through the Hex-Rays decompiler and creating some structures:
Looks very similar to me.