; To compile use Masm (from 32 bit Visual Studio prompt):
; ml patching1.asm

; Listing generated by Microsoft (R) Optimizing Compiler Version 19.26.28806.0 
	.686P
	.XMM
	.model	flat

INCLUDELIB LIBCMT
INCLUDELIB OLDNAMES

; added:
INCLUDELIB USER32.lib
INCLUDELIB KERNEL32.lib
INCLUDELIB ADVAPI32.lib

PUBLIC	?crc32Intalized@@3_NA				; crc32Intalized
_BSS	SEGMENT
?crc32Intalized@@3_NA DB 01H DUP (?)			; crc32Intalized
_BSS	ENDS
CONST	SEGMENT
$SG116411 DB	0dcH, 'ns', 0baH, 01dH, 08aH, 0a3H, 0d7H, '?', 0e1H, 0faH
	DB	0a4H, '$', 0f9H, 'f', 0a9H, '=', 0e9H, 096H, 08bH, 01fH, '6', 0faH
	DB	010H, 0dfH, 081H, 0a8H, ')l?', 0f9H, 0efH, 'W', 01cH, 00H
	ORG $+1
$SG116413 DB	'Task1: Success!', 00H
$SG116414 DB	'Task1: patching', 00H
$SG116415 DB	'Patch the app to get the flag!', 00H
CONST	ENDS
PUBLIC	?_rc4Init@@YAXPBXGPAURC4KEY@@@Z			; _rc4Init
PUBLIC	?_rc4@@YAPAEPAEKPAURC4KEY@@@Z			; _rc4
PUBLIC	?_rc4Full@@YAXPBXGPAXK@Z			; _rc4Full
PUBLIC	?crc32Hash@@YAKPBXK@Z				; crc32Hash
PUBLIC	?user_check@@YAKXZ				; user_check
PUBLIC	_main
EXTRN	__imp__GetUserNameA@8:PROC
EXTRN	__imp__MessageBoxA@16:PROC
EXTRN	@__security_check_cookie@4:PROC
EXTRN	_memset:PROC
EXTRN	___security_cookie:DWORD
_BSS	SEGMENT
	ALIGN	4

?crc32table@@3PAKA DD 0100H DUP (?)			; crc32table
_BSS	ENDS
; Function compile flags: /Odtp
_TEXT	SEGMENT
_dec_size$ = -60					; size = 4
_dec_checks$ = -56					; size = 4
_out_hash$ = -52					; size = 4
_binKey$ = -48						; size = 4
_enc_flag_size$ = -44					; size = 4
_enc_flag$ = -40					; size = 35
__$ArrayPad$ = -4					; size = 4
_main	PROC
; Line 110
	push	ebp
	mov	ebp, esp
	sub	esp, 60					; 0000003cH
	mov	eax, DWORD PTR ___security_cookie
	xor	eax, ebp
	mov	DWORD PTR __$ArrayPad$[ebp], eax
	push	esi
	push	edi
; Line 111
	call	?user_check@@YAKXZ			; user_check
	mov	DWORD PTR _binKey$[ebp], eax
; Line 113
	mov	DWORD PTR _dec_checks$[ebp], -329281795	; ec5f8efdH
; Line 114
	mov	ecx, 8
	mov	esi, OFFSET $SG116411
	lea	edi, DWORD PTR _enc_flag$[ebp]
	rep movsd
	movsw
	movsb
; Line 120
	mov	DWORD PTR _enc_flag_size$[ebp], 35	; 00000023H
; Line 121
	mov	DWORD PTR _dec_size$[ebp], 34		; 00000022H
; Line 135
	mov	eax, DWORD PTR _enc_flag_size$[ebp]
	push	eax
	lea	ecx, DWORD PTR _enc_flag$[ebp]
	push	ecx
	push	4
	lea	edx, DWORD PTR _binKey$[ebp]
	push	edx
	call	?_rc4Full@@YAXPBXGPAXK@Z		; _rc4Full
	add	esp, 16					; 00000010H
; Line 137
	push	34					; 00000022H
	lea	eax, DWORD PTR _enc_flag$[ebp]
	push	eax
	call	?crc32Hash@@YAKPBXK@Z			; crc32Hash
	add	esp, 8
	mov	DWORD PTR _out_hash$[ebp], eax
; Line 138
	cmp	DWORD PTR _out_hash$[ebp], -329281795	; ec5f8efdH
	jne	SHORT $LN2@main
; Line 139
	push	0
	push	OFFSET $SG116413
	lea	ecx, DWORD PTR _enc_flag$[ebp]
	push	ecx
	push	0
	call	DWORD PTR __imp__MessageBoxA@16
; Line 140
	xor	eax, eax
	jmp	SHORT $LN1@main
$LN2@main:
; Line 142
	push	0
	push	OFFSET $SG116414
	push	OFFSET $SG116415
	push	0
	call	DWORD PTR __imp__MessageBoxA@16
; Line 143
	mov	eax, 1
$LN1@main:
; Line 144
	pop	edi
	pop	esi
	mov	ecx, DWORD PTR __$ArrayPad$[ebp]
	xor	ecx, ebp
	call	@__security_check_cookie@4
	mov	esp, ebp
	pop	ebp
	ret	0
_main	ENDP
_TEXT	ENDS
; Function compile flags: /Odtp
_TEXT	SEGMENT
_hash2$ = -276						; size = 4
_hash$ = -272						; size = 4
_out_len$ = -268					; size = 4
_buf$ = -264						; size = 260
__$ArrayPad$ = -4					; size = 4
?user_check@@YAKXZ PROC					; user_check
; Line 91
	push	ebp
	mov	ebp, esp
	sub	esp, 276				; 00000114H
	mov	eax, DWORD PTR ___security_cookie
	xor	eax, ebp
	mov	DWORD PTR __$ArrayPad$[ebp], eax
; Line 92
	push	260					; 00000104H
	push	0
	lea	eax, DWORD PTR _buf$[ebp]
	push	eax
	call	_memset
	add	esp, 12					; 0000000cH
; Line 93
	mov	DWORD PTR _out_len$[ebp], 260		; 00000104H
; Line 94
	lea	ecx, DWORD PTR _out_len$[ebp]
	push	ecx
	lea	edx, DWORD PTR _buf$[ebp]
	push	edx
	call	DWORD PTR __imp__GetUserNameA@8
; Line 95
	mov	eax, DWORD PTR _out_len$[ebp]
	push	eax
	lea	ecx, DWORD PTR _buf$[ebp]
	push	ecx
	call	?crc32Hash@@YAKPBXK@Z			; crc32Hash
	add	esp, 8
	mov	DWORD PTR _hash$[ebp], -294133293
; Line 97
	mov	DWORD PTR _hash2$[ebp], -294133293	; ee77e1d3H
; Line 103
	cmp	DWORD PTR _hash$[ebp], -294133293	; ee77e1d3H
	jne	SHORT $LN2@user_check
; Line 104
	mov	eax, DWORD PTR _hash$[ebp]
	jmp	SHORT $LN1@user_check
$LN2@user_check:
; Line 106
	xor	eax, eax
$LN1@user_check:
; Line 107
	mov	ecx, DWORD PTR __$ArrayPad$[ebp]
	xor	ecx, ebp
	call	@__security_check_cookie@4
	mov	esp, ebp
	pop	ebp
	ret	0
?user_check@@YAKXZ ENDP					; user_check
_TEXT	ENDS
; Function compile flags: /Odtp
_TEXT	SEGMENT
_j$1 = -20						; size = 4
_cc$ = -16						; size = 4
_i$2 = -12						; size = 4
_i$3 = -8						; size = 4
_crc$4 = -4						; size = 4
_data$ = 8						; size = 4
_size$ = 12						; size = 4
?crc32Hash@@YAKPBXK@Z PROC				; crc32Hash
; Line 66
	push	ebp
	mov	ebp, esp
	sub	esp, 20					; 00000014H
; Line 67
	movzx	eax, BYTE PTR ?crc32Intalized@@3_NA	; crc32Intalized
	test	eax, eax
	jne	SHORT $LN11@crc32Hash
; Line 70
	mov	DWORD PTR _i$3[ebp], 0
	jmp	SHORT $LN4@crc32Hash
$LN2@crc32Hash:
	mov	ecx, DWORD PTR _i$3[ebp]
	add	ecx, 1
	mov	DWORD PTR _i$3[ebp], ecx
$LN4@crc32Hash:
	cmp	DWORD PTR _i$3[ebp], 256		; 00000100H
	jae	SHORT $LN3@crc32Hash
; Line 72
	mov	edx, DWORD PTR _i$3[ebp]
	mov	DWORD PTR _crc$4[ebp], edx
; Line 73
	mov	DWORD PTR _j$1[ebp], 8
	jmp	SHORT $LN7@crc32Hash
$LN5@crc32Hash:
	mov	eax, DWORD PTR _j$1[ebp]
	sub	eax, 1
	mov	DWORD PTR _j$1[ebp], eax
$LN7@crc32Hash:
	cmp	DWORD PTR _j$1[ebp], 0
	jbe	SHORT $LN6@crc32Hash
; Line 75
	mov	ecx, DWORD PTR _crc$4[ebp]
	and	ecx, 1
	je	SHORT $LN12@crc32Hash
	mov	edx, DWORD PTR _crc$4[ebp]
	shr	edx, 1
	xor	edx, -306674912				; edb88320H
	mov	DWORD PTR _crc$4[ebp], edx
	jmp	SHORT $LN13@crc32Hash
$LN12@crc32Hash:
; Line 76
	mov	eax, DWORD PTR _crc$4[ebp]
	shr	eax, 1
	mov	DWORD PTR _crc$4[ebp], eax
$LN13@crc32Hash:
; Line 77
	jmp	SHORT $LN5@crc32Hash
$LN6@crc32Hash:
; Line 78
	mov	ecx, DWORD PTR _i$3[ebp]
	mov	edx, DWORD PTR _crc$4[ebp]
	mov	DWORD PTR ?crc32table@@3PAKA[ecx*4], edx
; Line 79
	jmp	SHORT $LN2@crc32Hash
$LN3@crc32Hash:
; Line 81
	mov	BYTE PTR ?crc32Intalized@@3_NA, 1	; crc32Intalized
$LN11@crc32Hash:
; Line 84
	mov	DWORD PTR _cc$[ebp], -1
; Line 85
	mov	DWORD PTR _i$2[ebp], 0
	jmp	SHORT $LN10@crc32Hash
$LN8@crc32Hash:
	mov	eax, DWORD PTR _i$2[ebp]
	add	eax, 1
	mov	DWORD PTR _i$2[ebp], eax
$LN10@crc32Hash:
	mov	ecx, DWORD PTR _i$2[ebp]
	cmp	ecx, DWORD PTR _size$[ebp]
	jae	SHORT $LN9@crc32Hash
	mov	edx, DWORD PTR _cc$[ebp]
	shr	edx, 8
	mov	eax, DWORD PTR _data$[ebp]
	add	eax, DWORD PTR _i$2[ebp]
	movzx	ecx, BYTE PTR [eax]
	xor	ecx, DWORD PTR _cc$[ebp]
	and	ecx, 255				; 000000ffH
	xor	edx, DWORD PTR ?crc32table@@3PAKA[ecx*4]
	mov	DWORD PTR _cc$[ebp], edx
	jmp	SHORT $LN8@crc32Hash
$LN9@crc32Hash:
; Line 86
	mov	eax, DWORD PTR _cc$[ebp]
	not	eax
; Line 87
	mov	esp, ebp
	pop	ebp
	ret	0
?crc32Hash@@YAKPBXK@Z ENDP				; crc32Hash
_TEXT	ENDS
; Function compile flags: /Odtp
_TEXT	SEGMENT
_key$ = -264						; size = 258
__$ArrayPad$ = -4					; size = 4
_binKey$ = 8						; size = 4
_binKeySize$ = 12					; size = 2
_buffer$ = 16						; size = 4
_size$ = 20						; size = 4
?_rc4Full@@YAXPBXGPAXK@Z PROC				; _rc4Full
; Line 56
	push	ebp
	mov	ebp, esp
	sub	esp, 264				; 00000108H
	mov	eax, DWORD PTR ___security_cookie
	xor	eax, ebp
	mov	DWORD PTR __$ArrayPad$[ebp], eax
; Line 58
	lea	eax, DWORD PTR _key$[ebp]
	push	eax
	movzx	ecx, WORD PTR _binKeySize$[ebp]
	push	ecx
	mov	edx, DWORD PTR _binKey$[ebp]
	push	edx
	call	?_rc4Init@@YAXPBXGPAURC4KEY@@@Z		; _rc4Init
	add	esp, 12					; 0000000cH
; Line 59
	lea	eax, DWORD PTR _key$[ebp]
	push	eax
	mov	ecx, DWORD PTR _size$[ebp]
	push	ecx
	mov	edx, DWORD PTR _buffer$[ebp]
	push	edx
	call	?_rc4@@YAPAEPAEKPAURC4KEY@@@Z		; _rc4
	add	esp, 12					; 0000000cH
; Line 60
	mov	ecx, DWORD PTR __$ArrayPad$[ebp]
	xor	ecx, ebp
	call	@__security_check_cookie@4
	mov	esp, ebp
	pop	ebp
	ret	0
?_rc4Full@@YAXPBXGPAXK@Z ENDP				; _rc4Full
_TEXT	ENDS
; Function compile flags: /Odtp
_TEXT	SEGMENT
_i$1 = -12						; size = 4
_state$ = -8						; size = 4
_swapByte$ = -3						; size = 1
_y$ = -2						; size = 1
_x$ = -1						; size = 1
_buffer$ = 8						; size = 4
_size$ = 12						; size = 4
_key$ = 16						; size = 4
?_rc4@@YAPAEPAEKPAURC4KEY@@@Z PROC			; _rc4
; Line 34
	push	ebp
	mov	ebp, esp
	sub	esp, 12					; 0000000cH
	push	esi
; Line 37
	mov	eax, DWORD PTR _key$[ebp]
	mov	cl, BYTE PTR [eax+256]
	mov	BYTE PTR _x$[ebp], cl
; Line 38
	mov	edx, DWORD PTR _key$[ebp]
	mov	al, BYTE PTR [edx+257]
	mov	BYTE PTR _y$[ebp], al
; Line 39
	mov	ecx, 1
	imul	edx, ecx, 0
	add	edx, DWORD PTR _key$[ebp]
	mov	DWORD PTR _state$[ebp], edx
; Line 41
	mov	DWORD PTR _i$1[ebp], 0
	jmp	SHORT $LN4@rc4
$LN2@rc4:
	mov	eax, DWORD PTR _i$1[ebp]
	add	eax, 1
	mov	DWORD PTR _i$1[ebp], eax
$LN4@rc4:
	mov	ecx, DWORD PTR _i$1[ebp]
	cmp	ecx, DWORD PTR _size$[ebp]
	jae	$LN3@rc4
; Line 43
	movzx	edx, BYTE PTR _x$[ebp]
	add	edx, 1
	and	edx, 255				; 000000ffH
	mov	BYTE PTR _x$[ebp], dl
; Line 44
	movzx	eax, BYTE PTR _x$[ebp]
	mov	ecx, DWORD PTR _state$[ebp]
	movzx	edx, BYTE PTR [ecx+eax]
	movzx	eax, BYTE PTR _y$[ebp]
	add	edx, eax
	and	edx, 255				; 000000ffH
	mov	BYTE PTR _y$[ebp], dl
; Line 45
	movzx	ecx, BYTE PTR _x$[ebp]
	mov	edx, DWORD PTR _state$[ebp]
	mov	al, BYTE PTR [edx+ecx]
	mov	BYTE PTR _swapByte$[ebp], al
	movzx	ecx, BYTE PTR _y$[ebp]
	movzx	edx, BYTE PTR _x$[ebp]
	mov	eax, DWORD PTR _state$[ebp]
	mov	esi, DWORD PTR _state$[ebp]
	mov	cl, BYTE PTR [esi+ecx]
	mov	BYTE PTR [eax+edx], cl
	movzx	edx, BYTE PTR _y$[ebp]
	mov	eax, DWORD PTR _state$[ebp]
	mov	cl, BYTE PTR _swapByte$[ebp]
	mov	BYTE PTR [eax+edx], cl
; Line 46
	movzx	edx, BYTE PTR _x$[ebp]
	mov	eax, DWORD PTR _state$[ebp]
	movzx	ecx, BYTE PTR [eax+edx]
	movzx	edx, BYTE PTR _y$[ebp]
	mov	eax, DWORD PTR _state$[ebp]
	movzx	edx, BYTE PTR [eax+edx]
	add	ecx, edx
	and	ecx, 255				; 000000ffH
	mov	eax, DWORD PTR _state$[ebp]
	movzx	ecx, BYTE PTR [eax+ecx]
	mov	edx, DWORD PTR _buffer$[ebp]
	add	edx, DWORD PTR _i$1[ebp]
	movzx	eax, BYTE PTR [edx]
	xor	eax, ecx
	mov	ecx, DWORD PTR _buffer$[ebp]
	add	ecx, DWORD PTR _i$1[ebp]
	mov	BYTE PTR [ecx], al
; Line 47
	jmp	$LN2@rc4
$LN3@rc4:
; Line 49
	mov	edx, DWORD PTR _key$[ebp]
	mov	al, BYTE PTR _x$[ebp]
	mov	BYTE PTR [edx+256], al
; Line 50
	mov	ecx, DWORD PTR _key$[ebp]
	mov	dl, BYTE PTR _y$[ebp]
	mov	BYTE PTR [ecx+257], dl
; Line 52
	mov	eax, DWORD PTR _buffer$[ebp]
; Line 53
	pop	esi
	mov	esp, ebp
	pop	ebp
	ret	0
?_rc4@@YAPAEPAEKPAURC4KEY@@@Z ENDP			; _rc4
_TEXT	ENDS
; Function compile flags: /Odtp
_TEXT	SEGMENT
_state$ = -12						; size = 4
_i$ = -8						; size = 2
_swapByte$ = -3						; size = 1
_index2$ = -2						; size = 1
_index1$ = -1						; size = 1
_binKey$ = 8						; size = 4
_binKeySize$ = 12					; size = 2
_key$ = 16						; size = 4
?_rc4Init@@YAXPBXGPAURC4KEY@@@Z PROC			; _rc4Init
; Line 15
	push	ebp
	mov	ebp, esp
	sub	esp, 12					; 0000000cH
	push	esi
; Line 17
	mov	BYTE PTR _index1$[ebp], 0
	mov	BYTE PTR _index2$[ebp], 0
; Line 18
	mov	eax, 1
	imul	ecx, eax, 0
	add	ecx, DWORD PTR _key$[ebp]
	mov	DWORD PTR _state$[ebp], ecx
; Line 21
	mov	edx, DWORD PTR _key$[ebp]
	mov	BYTE PTR [edx+256], 0
; Line 22
	mov	eax, DWORD PTR _key$[ebp]
	mov	BYTE PTR [eax+257], 0
; Line 24
	xor	ecx, ecx
	mov	WORD PTR _i$[ebp], cx
	jmp	SHORT $LN4@rc4Init
$LN2@rc4Init:
	mov	dx, WORD PTR _i$[ebp]
	add	dx, 1
	mov	WORD PTR _i$[ebp], dx
$LN4@rc4Init:
	movzx	eax, WORD PTR _i$[ebp]
	cmp	eax, 256				; 00000100H
	jge	SHORT $LN3@rc4Init
	movzx	ecx, WORD PTR _i$[ebp]
	mov	edx, DWORD PTR _state$[ebp]
	mov	al, BYTE PTR _i$[ebp]
	mov	BYTE PTR [edx+ecx], al
	jmp	SHORT $LN2@rc4Init
$LN3@rc4Init:
; Line 25
	xor	ecx, ecx
	mov	WORD PTR _i$[ebp], cx
	jmp	SHORT $LN7@rc4Init
$LN5@rc4Init:
	mov	dx, WORD PTR _i$[ebp]
	add	dx, 1
	mov	WORD PTR _i$[ebp], dx
$LN7@rc4Init:
	movzx	eax, WORD PTR _i$[ebp]
	cmp	eax, 256				; 00000100H
	jge	SHORT $LN1@rc4Init
; Line 27
	movzx	ecx, BYTE PTR _index1$[ebp]
	mov	edx, DWORD PTR _binKey$[ebp]
	movzx	eax, BYTE PTR [edx+ecx]
	movzx	ecx, WORD PTR _i$[ebp]
	mov	edx, DWORD PTR _state$[ebp]
	movzx	ecx, BYTE PTR [edx+ecx]
	add	eax, ecx
	movzx	edx, BYTE PTR _index2$[ebp]
	add	eax, edx
	and	eax, 255				; 000000ffH
	mov	BYTE PTR _index2$[ebp], al
; Line 28
	movzx	eax, WORD PTR _i$[ebp]
	mov	ecx, DWORD PTR _state$[ebp]
	mov	dl, BYTE PTR [ecx+eax]
	mov	BYTE PTR _swapByte$[ebp], dl
	movzx	eax, BYTE PTR _index2$[ebp]
	movzx	ecx, WORD PTR _i$[ebp]
	mov	edx, DWORD PTR _state$[ebp]
	mov	esi, DWORD PTR _state$[ebp]
	mov	al, BYTE PTR [esi+eax]
	mov	BYTE PTR [edx+ecx], al
	movzx	ecx, BYTE PTR _index2$[ebp]
	mov	edx, DWORD PTR _state$[ebp]
	mov	al, BYTE PTR _swapByte$[ebp]
	mov	BYTE PTR [edx+ecx], al
; Line 29
	mov	cl, BYTE PTR _index1$[ebp]
	add	cl, 1
	mov	BYTE PTR _index1$[ebp], cl
	movzx	edx, BYTE PTR _index1$[ebp]
	movzx	eax, WORD PTR _binKeySize$[ebp]
	cmp	edx, eax
	jne	SHORT $LN8@rc4Init
	mov	BYTE PTR _index1$[ebp], 0
$LN8@rc4Init:
; Line 30
	jmp	$LN5@rc4Init
$LN1@rc4Init:
; Line 31
	pop	esi
	mov	esp, ebp
	pop	ebp
	ret	0
?_rc4Init@@YAXPBXGPAURC4KEY@@@Z ENDP			; _rc4Init
_TEXT	ENDS
END
