cipher *__userpurge mlw_decrypt_payload_with_block_cipher@<eax>(
        DWORD *a1@<eax>,
        cipher *cipher,
        BYTE *key,
        size_t keyLen)
{
  int m; // ebx MAPDST
  DWORD *s; // ecx
  _DWORD *srcForS; // eax
  char *keyPtr; // ecx
  int k; // eax
  int n; // esi MAPDST
  DWORD *p; // edi MAPDST
  unsigned int i; // ebx
  int j; // ebx
  unsigned int blockdata_1_; // ecx MAPDST
  char keyCopy[56]; // [esp+10h] [ebp-4Ch] BYREF
  unsigned int blockdata[2]; // [esp+48h] [ebp-14h] BYREF
  DWORD *(*S)[256]; // [esp+50h] [ebp-Ch]
  DWORD *P; // [esp+54h] [ebp-8h]
  int remaining; // [esp+68h] [ebp+Ch]
  int BoxesLeft; // [esp+68h] [ebp+Ch]
  DWORD *(*BoxPtr)[256]; // [esp+6Ch] [ebp+10h]

  cipher->unknown_field_0 = *a1;
  cipher->unknown_field_4 = a1[1];
  cipher->unknown_field_8 = *a1;
  cipher->unknown_field_C = a1[1];

  S = (DWORD *(*)[256])cipher->S;
  memset(cipher->S, 0, sizeof(cipher->S));

  if ( keyLen )
  {
    if ( keyLen > 56 )
      keyLen = 56;
  }
  else
  {
    keyLen = 1;
  }

  m = 0;
  memcpy(keyCopy, key, keyLen);
  P = cipher->P;
  qmemcpy(cipher->P, &HARDCODED_BUFFER_72, sizeof(cipher->P));

  s = (DWORD *)S;
  srcForS = &C2_RESPONSE_PAYLOAD;


  n = 4;
  do
  {
    m = 256;
    do
    {
      *s++ = *srcForS++ ^ 0xB103F154;
      --m;
    }
    while ( m );
    --n;
  }
  while ( n );

  p = P;
  keyPtr = keyCopy;
  remaining = 18;
  do
  {
    k = 0;
    n = 4;
    do
    {
      ++m;
      --n;
      k = (unsigned __int8)*keyPtr++ | (k << 8);
      if ( m == keyLen )
      {
        m = 0;
        keyPtr = keyCopy;
      }
    }
    while ( n );
    *p++ ^= k ^ 0xB103F154;
    --remaining;
  }
  while ( remaining );

  p = P;

  blockdata[0] = 0;
  blockdata[1] = 0;
  // initialize P array using the key
  for ( i = 0; i < 18; i += 2 )
  {
    blowfish::round(cipher, blockdata);
    blockdata_1_ = blockdata[1];
    *p = blockdata[0];
    p[1] = blockdata_1_;
    p += 2;
  }

  BoxPtr = S;
  BoxesLeft = 4;
  do
  {
    p = (DWORD *)BoxPtr;
    for ( j = 0; j < 256; j += 2 )
    {
      blowfish::round(cipher, blockdata);
      blockdata_1_ = blockdata[1];
      *p = blockdata[0];
      p[1] = blockdata_1_;
      p += 2;
    }
    ++BoxPtr;
    --BoxesLeft;
  }
  while ( BoxesLeft );

  return cipher;
}

# Static Analysis Report: `mlw_decrypt_payload_with_block_cipher`

## 1. Functionality Description

This function implements the **key schedule (initialization)** of a block cipher structure. Specifically, it:

1. **Initializes cipher state** from input `a1` (copies 4 DWORDs into the cipher header fields)
2. **Validates/clamps key length** to 1–56 bytes (56 being the Blowfish maximum)
3. **Loads obfuscated constants** — copies a hardcoded P-array buffer and XORs both P-array and S-box data with the constant `0xB103F154`
4. **XORs P-array with key material** — cycles through key bytes in big-endian order, XORing each P entry with the key word XOR'd against `0xB103F154`
5. **Runs the Blowfish key expansion** — starting from an all-zero block `{0, 0}`, repeatedly encrypts through `blowfish::round` to replace:
   - All 18 P-array entries (in pairs)
   - All 4 × 256 S-box entries (in pairs)

---

## 2. Well-Known Algorithm Identification

**Algorithm: Blowfish (Bruce Schneier, 1993)**

| Feature | Code Evidence | Blowfish Spec |
|---|---|---|
| P-array size | 18 entries (`remaining = 18`) | 18 DWORDs |
| S-box count & size | 4 boxes × 256 entries (`BoxesLeft = 4`, `j < 256`) | 4 boxes × 256 DWORDs |
| Max key length | Capped at 56 bytes | 56 bytes (448 bits) |
| Key cycling | Big-endian byte packing: `(uint8)*keyPtr++ \| (k << 8)` | Standard Blowfish key cycling |
| Key expansion pattern | Encrypt all-zero block → replace P, then S entries in order | Exact Blowfish spec |

---

## 3. Indicators of Compromise (IOCs)

| Type | Value | Notes |
|---|---|---|
| **XOR/Obfuscation constant** | `0xB103F154` | Used to deobfuscate Blowfish π-derived constants |
| **Global symbol** | `C2_RESPONSE_PAYLOAD` | Symbol name reveals C2 communication purpose; contains obfuscated S-box initial data |
| **Global symbol** | `HARDCODED_BUFFER_72` | Contains obfuscated P-array initial values (72 bytes = 18 DWORDs) |
| **Function name** | `mlw_decrypt_payload_with_block_cipher` | Naming convention suggests malware framework function |

---

## 4. MITRE ATT&CK Mapping

| Technique ID | Technique Name | Evidence & Justification |
|---|---|---|
| **T1573.001** | Encrypted Channel: Symmetric Cryptography | The function initializes a Blowfish symmetric cipher, and the symbol `C2_RESPONSE_PAYLOAD` directly indicates this is used to decrypt C2 server responses. Blowfish is the symmetric algorithm. |
| **T1140** | Deobfuscate/Decode Files or Information | The function actively decrypts/deobfuscates a payload. The XOR with `0xB103F154` deobfuscates embedded constants, and the full Blowfish key schedule prepares decryption of C2 data. |
| **T1027** | Obfuscated Files or Information | Blowfish constants (hex digits of π) are stored XOR'd with `0xB103F154` to prevent signature-based detection of standard Blowfish lookup tables in the binary. |
| **T1027.009** | Embedded Payloads | The payload data is embedded within the binary (referenced via `C2_RESPONSE_PAYLOAD` and `HARDCODED_BUFFER_72`), encrypted/obfuscated and decoded at runtime. |

---

## 5. Obfuscation & Evasion Techniques

### XOR Constant Obfuscation of Blowfish Constants
- **Observed fact**: Both the P-array (`HARDCODED_BUFFER_72`) and S-box data (`C2_RESPONSE_PAYLOAD`) are XOR'd with `0xB103F154` at runtime.
- **Inferred purpose**: The standard Blowfish initialization constants are the hexadecimal digits of π, which are well-known and easily signatured by AV/EDR. By storing them XOR'd with `0xB103F154`, the raw binary contains no recognizable Blowfish constants, defeating static signature detection.

### Symbol Naming Convention
- **Observed fact**: The `C2_RESPONSE_PAYLOAD` symbol name directly references C2 infrastructure.
- **Inferred purpose**: This may be a debug symbol left in a development build, or it could indicate the malware framework uses descriptive internal naming. The name itself is an operational security failure if left in production binaries.

---

## 6. Facts vs. Inferences

| Category | Statement |
|---|---|
| **Observed Fact** | The code implements a Blowfish key schedule with 18 P entries and 4×256 S-box entries |
| **Observed Fact** | Key length is clamped to max 56 bytes |
| **Observed Fact** | All constant tables are XOR'd with `0xB103F154` |
| **Observed Fact** | The global symbol `C2_RESPONSE_PAYLOAD` supplies S-box data |
| **Observed Fact** | The function name contains "decrypt_payload" |
| **Inferred** | The XOR obfuscation is intentionally applied to evade static detection of Blowfish π-constants |
| **Inferred** | This cipher is used for C2 communication decryption (based on symbol name) |
| **Inferred** | The malware receives encrypted payloads from a C2 server and decrypts them using this Blowfish instance |
| **Inferred** | The `a1` parameter likely contains an IV or cipher state from a received C2 message |