#include<stdio.h>
#include<stdlib.h>
#include<string.h>

void main(){
	
	unsigned char en_data[2046]={0x25,0x80,0x5e,0xc3};//存放待解密的数据
	unsigned char de_data[2046];//存放解密后的数据
	unsigned char key_data[40];
	int en_address=(int)en_data;
	int de_address=(int)de_data;
	int key_address=(int)key_data;
	int len_en_data=strlen((char *)en_data);
	printf("%x\n",en_address);
	printf("%x\n",de_address);
	
	__asm//保存寄存器的值
	{
		push esi
	}
	__asm//初始化寄存器
	{
		mov eax,key_address
		sub eax,0x2000
		mov esi,eax
		mov eax,de_address
		mov ds:[esi+0x2000],eax
		xor eax,eax
		mov ds:[esi+0x2004],eax//初始是一直变化的，暂时定为0
		mov ds:[esi+0x2008],eax
		mov eax,0x07
		mov ds:[esi+0x200c],eax
		mov eax,len_en_data
		shl eax,3
		mov ecx,ds:[esi+0x2004]
		sub eax,ecx
		mov ds:[esi+0x2010],eax
		mov eax,en_address
		mov ds:[esi+0x2014],eax
		xor eax,eax
		mov ds:[esi+0x2018],eax//相当于[ebp-8]
		mov eax,ds:[esi+0x2000]
		mov ds:[esi+0x201c],eax//相当于[ebp-4]
		mov eax,esi
		add eax,0x2020
		mov ds:[esi+0x2020],eax//相当于ebp+8
		mov eax,ds:[esi+0x2014]
		mov ds:[esi+0x2024],eax
		mov ds:[esi+0x2028],eax
		mov eax,0x200
		mov ds:[esi+0x202c],eax

	}
	__asm//算法部分//esi+c,ds:[esi+0x201c],ebp+4,ebp+8
	{
		ElementC_005B56B6:
		mov eax,dword ptr ds:[esi+0x2004]
		mov ecx,dword ptr ds:[esi+0x2014]
		mov edx,eax
		mov dword ptr ds:[esi+0x2008],eax
		shr edx,3
		and eax,7
		add edx,ecx
		mov dword ptr ds:[esi+0x2004],eax
		mov eax,edx
		mov dword ptr ds:[esi+0x2018],ecx
		mov dword ptr ds:[esi+0x2014],edx
		mov ecx,dword ptr ds:[eax]
		mov dword ptr ds:[esi+0x201c],ecx
		mov eax,dword ptr ds:[esi+0x201c]
		bswap eax
		mov dword ptr ds:[esi+0x201c],eax
		mov ecx,dword ptr ds:[esi+0x2004]
		mov eax,dword ptr ss:[esi+0x201c]
		shl eax,cl
		cmp eax,0x80000000
		jnb short ElementC_005B574A
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,8
		add edi,8
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CF4
		mov edx,dword ptr ds:[esi+0x2000]
		shr eax,0x18
		mov byte ptr ds:[edx],al
		mov eax,dword ptr ds:[esi+0x2000]
		inc eax
		mov dword ptr ds:[esi+0x2000],eax
		jmp ElementC_005B5CAB
ElementC_005B574A:
		cmp eax,0xC0000000
		jnb short ElementC_005B5798
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,9
		add edi,9
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CC0
		mov ecx,dword ptr ds:[esi+0x2000]
		shr eax,0x17
		or al,0x80
		mov byte ptr ds:[ecx],al
		mov eax,dword ptr ds:[esi+0x2000]
		inc eax
		mov dword ptr ds:[esi+0x2000],eax
		jmp ElementC_005B5CAB
ElementC_005B5798:
		cmp eax,0xF0000000
		jb ElementC_005B589D
		mov edx,dword ptr ds:[esi+0x200c]
		mov edi,dword ptr ds:[esi+0x2010]
		add edx,0x0A
		add ecx,0x0A
		cmp edx,edi
		mov dword ptr ds:[esi+0x2004],ecx
		mov dword ptr ds:[esi+0x200c],edx
		jnb ElementC_005B5CDA
		shr eax,0x16
		and eax,0x3F
		mov ebx,eax
		jnz ElementC_005B5910
		mov ebx,ecx
		mov eax,8
		and ebx,7
		sub eax,ebx
		cmp eax,8
		jnb short ElementC_005B5800
		add ecx,eax
		add eax,edx
		cmp eax,edi
		mov dword ptr ds:[esi+0x2004],ecx
		mov dword ptr ds:[esi+0x200c],eax
		jnb ElementC_005B5CF4
ElementC_005B5800:
		mov edi,dword ptr ds:[esi+0x2000]
		mov ecx,dword ptr ds:[esi+0x201c]//看下这边ds:[esi+0x201c],ds:[esi+0x2020],ds:[esi+0x2018]
		sub edi,ecx
		mov ecx,dword ptr ds:[esi+0x2020]
		mov edx,dword ptr ds:[ecx+8]
		mov eax,dword ptr ds:[ecx+4]
		mov dword ptr ds:[esi+0x2018],edx
		mov ebx,edx
		sub edx,eax
		sub ebx,eax
		add edx,edi
		push edx
//////////////
		mov eax,dword ptr ss:[esp+4]//这里ss:[esp+4]
		push esi
		mov esi,ecx
		cmp eax,dword ptr ds:[esi+C]//这里[esi+c]
		jbe short ElementC_004201CA
		dec eax
		mov dword ptr ds:[esi+C],2//这
		shr eax,1
		je short ElementC_004201A4
ElementC_00420198:
		mov edx,dword ptr ds:[esi+C]///////////
		shl edx,1
		shr eax,1
		mov dword ptr ds:[esi+C],edx////////////
		jnz short ElementC_00420198
ElementC_004201A4:
		mov ecx,dword ptr ds:[esi+C]//////////
		mov eax,dword ptr ds:[esi+4]////////////
		push edi
		mov edi,dword ptr ds:[esi+8]/////////
		push ecx
		push eax
		sub edi,eax
		call realloc               ; MSVCRT.realloc
		add esp,8
		mov dword ptr ds:[esi+4],eax
		add eax,edi
		mov dword ptr ds:[esi+8],eax
		mov eax,esi
		pop edi
		pop esi
		jmp ElementC_005B5825
		//004201C7     C2 0400     retn 4
ElementC_004201CA:
		mov eax,esi
		pop esi
		jmp ElementC_005B5825
		//004201CD     C2 0400     retn 4
		/////////////
ElementC_005B5825:
		mov eax,dword ptr ds:[esi+0x2018]
		test eax,eax
		je short ElementC_005B585C
		mov eax,dword ptr ds:[esi+0x2020]
		mov ecx,dword ptr ds:[eax+4]
		mov edx,dword ptr ds:[eax+8]
		add ebx,ecx
		sub edx,ebx
		push edx
		lea eax,dword ptr ds:[ebx+edi]
		push ebx
		push eax
		call memmove              ; MSVCRT.memmove
		mov ecx,dword ptr ds:[esi+0x201c]
		push edi
		push ecx
		push ebx
		call memmove               ; MSVCRT.memmove
		mov eax,dword ptr ds:[esi+0x2020]
		add esp,0x18
		add dword ptr ds:[eax+8],edi
		jmp short ElementC_005B5879
ElementC_005B585C:
		mov ebx,dword ptr ds:[esi+0x2020]
		mov edx,dword ptr ds:[esi+0x201c]
		push edi
		push edx
		mov eax,dword ptr ds:[ebx+4]
		push eax
		call memmove                ; MSVCRT.memmove
		mov eax,dword ptr ds:[ebx+4]
		add esp,0x0C
		add edi,eax
		mov dword ptr ds:[ebx+8],edi
ElementC_005B5879:
		mov ecx,dword ptr ds:[esi+0x2000]
		sub ecx,esi
		cmp ecx,0x2000
		jnz short ElementC_005B588F
		mov dword ptr ds:[esi+0x2000],esi
ElementC_005B588F:
		mov dword ptr ds:[esi+0x2000],esi
		mov edx,dword ptr ds:[esi+0x2000]
		mov dword ptr ds:[esi+0x201c],edx
		jmp ElementC_005B5CAB
ElementC_005B589D:
		cmp eax,0xE0000000
		jb short ElementC_005B58D9
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,0x0C
		add edi,0x0C
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CC0
		shr eax,0x14
		and eax,0x0FF
		add eax,0x40
		jmp short ElementC_005B590E
ElementC_005B58D9:
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,0x10
		add edi,0x10
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CDA
		shr eax,0x10
		and eax,0x1FFF
		add eax,0x140
ElementC_005B590E:
		mov ebx,eax
ElementC_005B5910:
		mov eax,dword ptr ds:[esi+0x2004]
		mov edx,dword ptr ds:[esi+0x2014]
		mov ecx,eax
		and eax,7
		shr ecx,3
		add edx,ecx
		mov dword ptr ds:[esi+0x2004],eax
		mov dword ptr ds:[esi+0x2014],edx
		mov eax,dword ptr ds:[edx]
		mov dword ptr ds:[esi+0x2018],eax
		mov eax,dword ptr ds:[esi+0x2018]
		bswap eax
		mov dword ptr ds:[esi+0x2018],eax
		mov ecx,dword ptr ds:[esi+0x2004]
		mov eax,dword ptr ds:[esi+0x2018]
		shl eax,cl
		cmp eax,0x80000000
		jnb short ElementC_005B597F
		mov edx,dword ptr ds:[esi+0x200c]
		inc ecx
		inc edx
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,dword ptr ds:[esi+0x2010]
		mov eax,edx
		cmp eax,ecx
		mov dword ptr ds:[esi+0x200c],edx
		jnb ElementC_005B5CF4
		mov eax,3
		jmp ElementC_005B5C43
ElementC_005B597F:
		cmp eax,0xC0000000
		jnb short ElementC_005B59C0
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,4
		add edi,4
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CC0
		and eax,0x30000000
		or eax,0x40000000
		shr eax,0x1C
		jmp ElementC_005B5C43
ElementC_005B59C0:
		cmp eax,0xE0000000
		jnb short ElementC_005B5A01
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,6
		add edi,6
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CDA
		and eax,0x1C000000
		or eax,0x20000000
		shr eax,0x1A
		jmp ElementC_005B5C43
ElementC_005B5A01:
		cmp eax,0xF0000000
		jnb short ElementC_005B5A42
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,8
		add edi,8
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CF4
		and eax,0x0F000000
		or eax,0x10000000
		shr eax,0x18
		jmp ElementC_005B5C43
ElementC_005B5A42:
		cmp eax,0xF8000000
		jnb short ElementC_005B5A83
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,0x0A
		add edi,0x0A
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CC0
		and eax,0x7C00000
		or eax,0x8000000
		shr eax,0x16
		jmp ElementC_005B5C43
ElementC_005B5A83:
		cmp eax,0xFC000000
		jnb short ElementC_005B5AC4
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,0x0C
		add edi,0x0C
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CDA
		and eax,0x3F00000
		or eax,0x4000000
		shr eax,0x14
		jmp ElementC_005B5C43
ElementC_005B5AC4:
		cmp eax,0xFE000000
		jnb short ElementC_005B5B05
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,0x0E
		add edi,0x0E
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CF4
		and eax,0x1FC0000
		or eax,0x2000000
		shr eax,0x12
		jmp ElementC_005B5C43
ElementC_005B5B05:
		cmp eax,0xFF000000
		jnb short ElementC_005B5B46
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,0x10
		add edi,0x10
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CC0
		and eax,0x0FF0000
		or eax,0x1000000
		shr eax,0x10
		jmp ElementC_005B5C43
ElementC_005B5B46:
		cmp eax,0xFF800000
		jnb short ElementC_005B5B87
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,0x12
		add edi,0x12
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CDA
		and eax,0x7FC000
		or eax,0x800000
		shr eax,0x0E
		jmp ElementC_005B5C43
ElementC_005B5B87:
		cmp eax,0xFFC00000
		jnb short ElementC_005B5BC5
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,0x14
		add edi,0x14
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CF4
		and eax,0x3FF000
		or eax,0x400000
		shr eax,0x0C
		jmp short ElementC_005B5C43
ElementC_005B5BC5:
		cmp eax,0xFFE00000
		jnb short ElementC_005B5C03
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,0x16
		add edi,0x16
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CC0
		and eax,0x1FFC00
		or eax,0x200000
		shr eax,0x0A
		jmp short ElementC_005B5C43
ElementC_005B5C03:
		cmp eax,0xFFF00000
		jnb ElementC_005B5CF4
		mov edi,dword ptr ds:[esi+0x200c]
		mov edx,dword ptr ds:[esi+0x2010]
		add ecx,0x18
		add edi,0x18
		mov dword ptr ds:[esi+0x2004],ecx
		mov ecx,edi
		cmp ecx,edx
		mov dword ptr ds:[esi+0x200c],edi
		jnb ElementC_005B5CDA
		and eax,0x0FFF00
		or eax,0x100000
		shr eax,8
ElementC_005B5C43:
		mov ecx,dword ptr ds:[esi+0x2000]
		lea edx,dword ptr ds:[esi+0x2000]
		mov edi,ecx
		sub edi,ebx
		cmp edi,esi
		jb ElementC_005B5D0C
		lea ebx,dword ptr ds:[ecx+eax]
		cmp ebx,edx
		ja ElementC_005B5D0C
		mov ebx,ecx
		mov edx,eax
		sub ebx,edi
		cmp ebx,3
		jle short ElementC_005B5C94
		cmp eax,3
		jbe short ElementC_005B5C94
		mov ebx,eax
		shr ebx,2
		mov dword ptr ds:[esi+0x2018],ebx///////////////////////////////////
ElementC_005B5C7E:
		mov ebx,dword ptr ds:[edi]
		add edi,4
		mov dword ptr ds:[ecx],ebx
		mov ebx,dword ptr ds:[esi+0x2018]
		add ecx,4
		sub edx,4
		dec ebx
		mov dword ptr ds:[esi+0x2018],ebx
		jnz short ElementC_005B5C7E
ElementC_005B5C94:
		mov ebx,edx
		dec edx
		test ebx,ebx
		je short ElementC_005B5CA5
		inc edx
ElementC_005B5C9C:
		mov bl,byte ptr ds:[edi]
		mov byte ptr ds:[ecx],bl
		inc ecx
		inc edi
		dec edx
		jnz short ElementC_005B5C9C
ElementC_005B5CA5:
		add dword ptr ds:[esi+0x2000],eax
ElementC_005B5CAB:
		mov ecx,dword ptr ds:[esi+0x2010]
		mov eax,dword ptr ds:[esi+0x200c]
		cmp ecx,eax
		jbe short ElementC_005B5D0C
		jmp ElementC_005B56B6
ElementC_005B5CC0:
		mov ecx,dword ptr ds:[esi+0x2008]
		mov edx,dword ptr ds:[esi+0x2018]
		mov dword ptr ds:[esi+0x2004],ecx
		mov dword ptr ds:[esi+0x2014],edx
		jmp short ElementC_005B5D0C
ElementC_005B5CDA:
		mov eax,dword ptr ds:[esi+0x2008]
		mov ecx,dword ptr ds:[esi+0x2018]
		mov dword ptr ds:[esi+0x2004],eax
		mov dword ptr ds:[esi+0x2014],ecx
		jmp short ElementC_005B5D0C
ElementC_005B5CF4:
		mov edx,dword ptr ds:[esi+0x2008]
		mov eax,dword ptr ds:[esi+0x2018]
		mov dword ptr ds:[esi+0x2004],edx
		mov dword ptr ds:[esi+0x2014],eax
ElementC_005B5D0C:
		mov edi,dword ptr ds:[esi+0x2000]
		mov ecx,dword ptr ds:[esi+0x201c]
	}
	__asm //恢复寄存器
	{
		pop esi
	}
	printf("%x\n",de_data[0]);
}

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课