I've used x64dbg to work out decryption in a particular program. I've found where it changes the encrypted material into readable text but can't work out the best way to use this information to convert multiple files.
Is it a standardized encryption method? (eg. blowfish/aes)
It basically copies the file to memory then cycles through this (and one other cycle above it).
Thanks!
Addit 15/12/2019: OUTER FUNCTION
Ouput of signsrch:
offset num description [bits.endian.size]
--------------------------------------------
0002b542 2249 TEA1_DS [32.le.4]
00059090 2065 Haval init [32.le.32&]
00059090 919 Blowfish bfp table [32.le.72]
000590b0 1054 Haval hash pass2 [32.le.128&]
000590e0 921 Blowfish ks0 table [32.le.1024]
000590e0 2335 Blowfish_s_init [32.le.4096]
00059138 2067 Haval mc3 [32.le.128]
00059198 2219 HAVAL2_DS [32.le.32]
000591b8 2069 Haval mc4 [32.le.128]
00059218 2217 HAVAL1_DS [32.le.32]
00059238 2071 Haval mc5 [32.le.128]
000594e0 923 Blowfish ks1 table [32.le.1024]
000598e0 925 Blowfish ks2 table [32.le.1024]
00059ce0 927 Blowfish ks3 table [32.le.1024]
007b1a86 2545 anti-debug: IsDebuggerPresent [..17]
007b7e07 1038 padding used in hashing algorithms (0x80 0 ... 0) [..64]
It must be blowfish. Now to find the key!!!
48 448 848 C48
would be very valuable. Lookup tables usually make spotting the respective crypto algorithm easy. I have a feeling this is AES or AES-related.