msm-code

struct chunk {
    uint32_t type;
    uint32_t length;
    char data[chunk_length];
}

msm-code

def nymaim_config_crypt(self, mem, ndx):
    """decrypt final config (read keys and length and decrypt raw data)"""
    key0 = mem.dword(ndx)
    key1 = mem.dword(ndx+4)
    len = mem.dword(ndx+8)
    raw = mem.read(ndx + 12, len)

    prev_chr = 0
    result = ''
    for i, c in enumerate(raw):

msm-code

def nymaim_decrypt(self, raw, from_raw, length):
    from_va = from_raw + self.image_base
    xsize = from_va - self.off
    cur_key = self.key
    if xsize < 0:
        raise RuntimeError("raw too small - min is " + hex(self.off - self.image_base))
    for _ in range(xsize / 4):
        cur_key = (cur_key + self.xstep) & 0xffffffff

    r = ''

msm-code

void encrypted_memcpy(char *to, char *from, int len) {
    if (is_in_encrypted_section(to)) {
        if (is_in_encrypted_section(from)) {
            memcpy(to, from, len);
        } else {
            memcpy_and_encrypt(to, from, len);
        }
    } else {
        if (is_in_encrypted_section(from)) {
            memcpy_and_decrypt(to, from, len);

msm-code

jz    loc_4381B4
xchg  eac, [ebp-0Ch]
; nops
push  ebx
; nops
push  eax
call  sub_428b51
; nops
mov   eax, 25h
mov   ecx, [ebp-0Ch]

msm-code

jz    loc_4381B4
xchg  eac, [ebp-0Ch]
push  053h
call  push_cpu_register  ; push ebx
push  050h
call  push_cpu_register  ; push eax
push  edx
push  8AB4BF9Eh
push  754A35C1h
call  detour_1           ; call f(8AB4BF9Eh, 754A35C1h)

msm-code

push  0x40404040
push  0x02020202
jmp  detour

detour:
pop   eax   ; oversimplification, detour can never spoil registers
pop   ebx
add   eax, ebx  ; or xor, or sub, or add
jmp   eax

msm-code

jmp   0x42424242

msm-code

mov   eax, 0x8CBFB5FF
call  xor_eax_with_8CBFB5DA

msm-code

jz    loc_4381B4
xchg  eac, [ebp-0Ch]
push  053h
call  sub_408D02
push  050h
call  sub_408D02
push  edx
push  8AB4BF9EH
push  754A35C1H
call  sub_41CF77