; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : D2232A0BE23328852CB0021AB5C7CFC0 ; File Name : u:\work\d2232a0be23328852cb0021ab5c7cfc0_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 10000 ; Section 1. (virtual address 00001000) ; Virtual size : 000F2000 ( 991232.) ; Section size in file : 00000000 ( 0.) ; Offset to raw data for section: 00000400 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 11000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 334h dup(?) dword_11CD0 dd 5F81h dup(?) db 3 dup(?) byte_29AD7 db ? ; DATA XREF: start+F5o dd 31D4Ah dup(?) dword_F1000 dd ? dd 47FFh dup(?) UPX0 ends ; Section 2. (virtual address 000F3000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00001000 ( 4096.) ; Offset to raw data for section: 00000200 ; Flags E0000040: Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 103000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_103000 dd 0FF7C9DB9h, 0D0025FFh, 0C08B6840h, 1F60640Fh, 39BFFF5Ch ; DATA XREF: start+1o dd 53545839h, 6A53D88Bh, 0E800h, 0C35B0C00h, 74DFEC8Dh dd 1B0040CAh, 56539014h, 8BF28B57h, 0DB763CF8h, 250ECEB7h dd 0DB85341Ch, 5D562A75h, 0FF1C741Bh, 33FFFF7Dh, 7DF03B24h dd 8BC68B02h, 91CF8BD3h, 2BC0011Eh, 5FC38B14h, 77EDDB5Eh dd 0AFC68C66h, 0A74C085h, 20E615FFh, 1120900h, 6FFEDFC3h dd 0E901B0EFh, 57C69042h, 0CD88C789h, 0E0C1C889h, 890A6610h dd 2F9C1D1h, 0F6FD9BF7h, 0ABF30978h, 3E18310h, 3E5FAAF3h dd 501C7E6Eh, 0A109C083h, 5BFEFFC1h, 5A080E94h, 0C7FC5089h dd 1C01F840h, 1004C6h, 4FC031C3h, 0BF83FEDFh, 0F004C481h dd 5A50FFFFh, 4301EBD8h, 0C684038Ah, 76203C04h, 6FFF6FF5h dd 223B80FFh, 7B800B75h, 83050A01h, 0E6EB02C3h, 25EBC033h dd 1B1AFA80h, 0DA05EB43h, 88F6FBADh, 54400414h, 74D28413h dd 56F02505h, 2F087400h, 59BB7F83h, 3D077E26h, 7C00C400h dd 8BD48BCDh, 0EA491CEh, 2CCCE07h, 0AF27D420h, 9C1F833Eh dd 0FEF8F0D9h, 681E34EFh, 0F7BF2E05h, 448DF876h, 46500424h dd 8BFCFF2Ch, 73C674C8h, 0F74C1EEBh, 4850686h, 8BD68B9Ch dd 7F015C7h, 801FB7FBh, 0EC3E8308h, 0E9EB4B03h, 3AC60801h dd 0FFFF6128h, 83907FFBh, 1C7D04F9h, 3957E367h, 89C474D0h dd 77D789C6h, 0E748D09h, 0F7C8DFFh, 0D87FDFFh, 0A4F3F791h dd 3A302CEBh, 54207766h, 69E57F7Fh, 0C107063Ah, 0C18902F8h dd 29C003B8h, 35C729C6h, 0F3F0CFB3h, 0A749FCA5h, 3E083A5h dd 0C3C23E30h, 0DFC1B8AFh, 0D689C3A9h, 0F889CF89h, 0F989CC11h dd 74F68508h, 7C5F9109h, 89C289F1h, 0D8897DF0h, 896C027Eh dd 8A5DB63Bh, 8F50571Fh, 1E35FF07h, 0BBBC0030h, 5045EB61h dd 8085103Ah, 100C71Bh, 49F84A8Bh, 1B7DDDC5h, 0A750A44h dd 0B7428D50h, 7E589002h, 0D3C9BFF7h, 275041Ch, 0C3022Eh dd 0BEFECDDEh, 0C3B14CB8h, 408B0316h, 932B9FFCh, 89532574h dd 0D82705DFh, 45FC421Ch, 137A8BC2h, 3C0488Bh, 83FDDFFFh dd 0FC100A66h, 5B138B51h, 977D089h, 42F8508Bh, 0B0E17066h dd 2F32347Eh, 72A036BDh, 193207C8h, 80D03C7h, 847783BDh dd 4E041E31h, 4EBFDB75h, 0D06B5609h, 7E4142EEh, 13018738h dd 0ECF04F61h, 31B11F9Eh, 0EC1E48FFh, 7FF7E823h, 147883D1h dd 0E8831D75h, 7F86C209h, 50E08950h, 0B058BC03h, 4CE0B441h dd 0FC705A89h, 28EB4A40h, 409BF83Eh, 63C78340h, 78FA8910h dd 0F77CF139h, 4A2A1807h, 88BD7F1h, 3274C985h, 3F4F86C0h dd 0C89C18B4h, 62590869h, 616F8919h, 893DB0EAh, 0EB9B3110h dd 0A5CA9C93h, 0D0106279h, 5E1AE700h, 0B6565839h, 501A7F23h dd 0C1449952h, 525870C3h, 0EB585A83h, 3C1D37EBh, 500986BAh dd 31DA7378h, 6EDCBFDBh, 0CCB7FFh, 461E8A0Ch, 7420FB80h dd 0C00B5F8h, 869742Dh, 0BB66742Bh, 24D2B9B9h, 58617478h dd 75305C74h, 89354F13h, 4F22DA56h, 0CDC844Ah, 0B45F8204h dd 80340AFDh, 92230EBh, 77F89077h, 80048D28h, 0BC137F0Ch dd 52D801DDh, 0FEE67532h, 7CD28ECDh, 0F6315912h, 0FF7E3289h dd 46250EFFh, 0D8F706EBh, 0EE78F07Eh, 0EBDE295Bh, 4EC5FEECh dd 59BFBCEBh, 0B89EFDBBh, 0DF74630Fh, 3726190h, 0BAA720A0h dd 76DA6FDEh, 5110E0Bh, 0C380D077h, 0B2C9BC0Ah, 0D103F404h dd 0EBD5B9C3h, 2D8CF6A9h, 0E3FC588Bh, 0F4FFF86Fh, 1B7C4A26h dd 1F7DDA39h, 7CE4D329h, 7FD93919h, 3FF60111h, 78CA9555h dd 31115D08h, 89E5EBD2h, 25EBEBD9h, 1FA78686h, 4C25B6Ch dd 0CC527600h, 0C3DA0ED3h, 4C8BF17Fh, 3521094h, 4AFC4103h dd 2EADF275h, 8C1F0FC6h, 149C56DEh, 0BEDFF289h, 82C3CE01h dd 4BFEC1DFh, 85D2E975h, 0AE54EF5Dh, 5A0C0420h, 3B805BAAh dd 248D58FCh, 0B7E0FF94h ; --------------------------------------------------------------------------- push ebp mov ebp, esp sub [ebp+68h], dl ; --------------------------------------------------------------------------- dw 0DA2Eh dd 57FE9EDh, 30FF64D5h, 0FF208964h, 2608B805h, 1A59595Ah dd 0FE3F7010h, 0C3DC31EEh, 0EB5CFCE9h, 833E5DF8h, 97253D2Dh dd 6FB4A63Ch, 7A100D06h, 6E48E65h, 0AC971014h, 0AEDC9C9Ch dd 0A40FA8A7h, 9C9CB4A0h, 989C9C9Ch, 9C9C9094h, 888C9C9Ch dd 9C9C8084h, 787C9C9Ch, 0DFFC7074h, 3792D0F4h, 18508DA6h dd 1440B70Fh, 0C28BD003h, 17FFFFF8h, 535657A6h, 8BFC5251h dd 8B1C2474h, 8324247Ch, 0C931FFCDh, 0A405EBF9h, 0BF0D6300h dd 820574A8h, 0F472DB10h, 571B40F0h, 11DA76BDh, 480E31C0h dd 20DCEB2Dh, 1C791CC1h, 0BFFFED3h, 83AC08E0h, 5874FFF0h dd 0C589F8D1h, 0C9411873h, 5DB76B52h, 8E873D3h, 0DC177307h dd 0FF8EFF47h, 0EA731563h, 8102C183h, 0E4FB00FDh, 5602D183h dd 0F32F348Dh, 0C3FFFFFFh, 6B25EA4h, 8BE389D0h, 53031C53h dd 74D63920h, 37B04807h, 33B00277h, 0AE1C7B2Bh, 2624B2A8h dd 5B0A3AE4h, 97EF5F5Eh, 4F28F25Ch, 714B507h, 923C0BEEh dd 460114BCh, 0CAE8DB33h, 0DECEB321h, 8868F89Eh, 1C171013h dd 0EFC2F021h, 0F72B7EEFh, 7D23FE81h, 3DC72B0Bh, 2102710h dd 0F60701B3h, 90F97FF5h, 485E8C1h, 0C282F93h, 0B4811616h dd 0C4C2277Bh, 0D2B95EA0h, 14BC9589h, 0E5CBB80Ah, 0B0B4B972h dd 4E4A8ACh, 0A0A4972Bh, 0B93FC45h, 0A346D957h, 8C458D7Fh dd 44BAC933h, 0C7ACFDF4h, 0B84CF71Ch, 0D02A17CDh, 2023250h dd 5BB90B04h, 0C926B3D8h, 0FF68E77Ah, 5B7219B5h, 708FDBE1h dd 98B8ED8Dh, 2649B435h, 2B04CA9h, 24C932B0h, 0AC03AC95h dd 992654A8h, 0A4A804A4h, 24CA9205h, 6A0A493h, 5DDF23DEh dd 0BC858D1Fh, 50DBA2Ah, 551F8B5Ch, 13BD061Dh, 44F1B8A8h dd 6E460FD0h, 0C484C1F8h, 0FB45C67Ah, 0C7323700h, 0CE09AE21h dd 387A5834h, 3434128Dh, 45F74A9Ch, 4C6750D4h, 1CF0464Dh dd 4D6DB30h, 0B050F40Ah, 7368FF64h, 48F2E54Fh, 8B2854D0h dd 0A6EC293Dh, 8C3C73E5h, 3C404413h, 74DB0A03h, 0EC222ACDh dd 2530E882h, 0D5050ECh, 0EC76FB65h, 40346334h, 0F47D83F4h dd 0DCE000h, 7DA7D81Bh, 9545ECE8h, 0FC54406Dh, 0DF5CB550h dd 82A70F4Ch, 0ACC58F0Eh, 0EAF6ED44h, 48062E12h, 40597232h dd 8318E08Eh, 7EFE0177h, 0AD973C9Bh, 5010FEC4h, 6B001408h dd 0F76C4AAh, 7891030Ch, 0FF31E450h, 24AFBAD1h, 130C0820h dd 432C4F08h, 75E04DFFh, 0D5B30ADh, 48DA47Fh, 95070075h dd 0F70C5F28h, 7228A17Bh, 3E708589h, 0D8F76497h, 0DA1935F8h dd 8806C01Bh, 390B9DFAh, 0F617D80h, 751AAC53h, 6C93440Dh dd 0BB6309EBh, 74B0D869h, 9C239C27h, 4485CAF9h, 5E03152Ah dd 7B08A0F6h, 0D2737FAAh, 5B8BE849h, 4CE5BD69h, 900FF2Ch dd 6FA35D3Fh, 83AE0620h, 0E1C7F0C4h, 4D4AE0B4h, 50F85550h dd 739151C0h, 0EF0AD2Ch, 2B0C39F8h, 0B9B89DEDh, 0B44571BEh dd 4E7EFF0Ah, 0F82D25BBh, 448AFF6Fh, 0F24FF18h, 548A888Bh dd 0E280FF32h, 0BAC2320Fh, 3FFB8DF3h, 0BC559B4Dh, 0F01AFC2Ch dd 2F34D8Ah, 565488D1h, 5BFBFC5Bh, 3BB4C346h, 0AF057EF0h dd 0B7754F43h, 5EDC56B6h, 30738341h, 90320CADh, 6202BAF8h dd 0A71175F0h, 0A68B4CEBh, 5235C5DEh, 0FCFAE6B7h, 0FB6EABC6h dd 4B9C33FFh, 77EDB85h, 0FF1E7C80h, 36F47620h, 1EC9BACBh dd 3D7EEEE1h, 67741C05h, 0B0D48B51h, 91005A50h, 0CDF0103h dd 24AB3C9Fh, 0A60CD3AFh, 0BEB02245h, 45DFEEFh, 0E0E89418h dd 0EB80C05h, 6C0071Eh, 0B06B0090h, 803FCC30h, 0F0AC8CB7h dd 0D7F22842h, 31A80CE0h, 110DC758h, 0BAADD8E6h, 0C40786F9h dd 4CE8584h, 330A6A5Ch, 0E35AA1F4h, 2CE607C5h, 7CC9008Bh dd 0D81F9A3Ch, 3AB0C22Bh, 8B842F53h, 98F685F0h, 4869D77Ch dd 2A821F8Ch, 2B87947Bh, 0B8728CF0h, 0D68B1838h, 7CF86B7Fh dd 558D5870h, 4120D1Eh, 0F0E23C0Ch, 0BBB9EF0Fh, 40A370B7h dd 8B1C4B20h, 6B531515h, 14F77DF6h, 0D38BCE83h, 4D8DA4A5h dd 1878BAF0h, 0DC2F35A1h, 8B08C02Bh, 44189Dh, 9775A088h dd 1490938h, 0A12C915h, 142402A0h, 28480540h, 50900A80h dd 0A1201500h, 42402A00h, 84815401h, 902A802h, 12055005h dd 240AA00Ah, 48154014h, 902A8028h, 20540050h, 40A800A1h dd 81500142h, 2A00284h, 5400509h, 0A800A12h, 15001424h dd 2A002848h, 54015090h, 0A802A120h, 50054240h, 0A00A8481h dd 40140902h, 80281205h, 50240Ah, 0A14815h, 142902Ah, 2842054h dd 50940A8h, 0A128150h, 142402A0h, 28480540h, 50900A80h dd 0A1201500h, 42402A00h, 84815401h, 902A802h, 12055005h dd 240AA00Ah, 48154014h, 902A8028h, 20540050h, 40A800A1h dd 81500142h, 2A00284h, 5400509h, 0A800A12h, 15001424h dd 2A002848h, 54015090h, 0A802A120h, 50054240h, 0A00A8481h dd 40140902h, 80281205h, 50240Ah, 0A14815h, 142902Ah, 2842054h dd 50940A8h, 0A128150h, 142402A0h, 28480540h, 50900A80h dd 0A1201500h, 42402A00h, 84815401h, 902A802h, 12055005h dd 240AA00Ah, 48154014h, 902A8028h, 20540050h, 40A800A1h dd 81500142h, 2A00284h, 5400509h, 0A800A12h, 15001424h dd 0A2AA2848h, 0F76F5090h, 6A9FF3h, 300D0068h, 501CA120h dd 50180D56h, 0FBEE0630h, 83B8FF94h, 0C08514C4h, 20B80F75h dd 808BC02h, 0C7F1318h, 7D608D94h, 8DED110Dh, 36503345h dd 6C29F0BAh, 7CDFF08Dh, 5B5EDFFFh, 494F5047h, 5245544Eh dd 900FF00h, 34323200h, 77FF3636h, 2033CCEEh, 490F2716h dd 4D334B35h, 4B375035h, 7F684C36h, 5533FFFBh, 4C374A32h dd 45354338h, 1A335034h, 36463148h, 100364Eh, 0A80A6F3Eh dd 4C400630h, 0CF3CB601h, 21030F3h, 410F0420h, 0DC943A85h dd 8141ED04h, 8F35446h, 0F8545092h, 72A07FFh, 4F005000h dd 4E004900h, 45005400h, 8AAB5200h, 0A9711A2h, 8742A088h dd 48150045h, 902A008Bh, 20540116h, 40A8022Ch, 81500459h dd 2A008B2h, 5401164h, 0A8022C8h, 15004592h, 0A2A08FFEh dd 44444150h, 58474E49h, 48800258h, 99F311D8h, 19036A82h dd 0FFCDFF58h, 0D4070FFh, 6C430100h, 4865736Fh, 6C646E61h dd 636F4C65h, 7365526Bh, 7F69756Fh, 6372DF92h, 5364611Bh dd 6F657A69h, 3FF63B66h, 6946E43Bh, 141C416Eh, 54656D75h dd 68657268h, 6F6FB35Fh, 7265541Ah, 74613E6Dh, 0A4725065h dd 657C7332h, 0B6DD8F74h, 6F433967h, 74782C6Eh, 69725722h dd 0D1654D3Fh, 6DF7762Eh, 8A79726Fh, 71472540h, 0DD8DFFF6h dd 0F4731A43h, 74726956h, 416C6175h, 7C226C6Ch, 45D8DDB7h dd 4A401F78h, 87227463h, 58182C69h, 7582B413h, 65D41484h dd 29813670h, 42500533h, 0CD829B10h, 74051EC0h, 2F2215D7h dd 0AF7B7C9Bh, 65724631h, 133FB5DDh, 6DAC6C3Ch, 0E04C806Dh dd 6F4D2156h, 0D8337669h, 40C67564h, 6D614E06h, 7C65D426h dd 0B4E57B41h, 6E55775Ah, 65427056h, 53664F77h, 1C15F95Fh dd 0A8693Ah, 74080601h, 1001B8F0h, 0FDBF7B43h, 1CF01934h dd 0B6081901h, 120D0C01h, 108060Dh, 0DDFFCBF0h, 2C00F5DFh dd 1B484B54h, 82F04D01h, 7F584301h, 412136Eh, 0B7FFFFF6h dd 51A6808h, 0F251818h, 0A060512h, 0FD0D0516h, 70503E2h dd 27F01C12h, 0FF20360Eh, 0E424828Eh, 14C1A45h, 5E190006h dd 0DF842A42h, 0E0FFF6h, 10B818Eh, 14001902h, 1B0180Dh dd 991CD027h, 2D34E6E0h, 17722630h, 0BDF61DB7h, 4011302h dd 190F2079h, 6DCF6B3Dh, 0F4069B3h, 0A9011367h, 50B5D6E8h dd 70517C9Eh, 1A5F00Eh, 55FBAE3h, 0D60F2h, 444F43D4h, 0C43C0F45h dd 3A181C1Eh, 0FB04D721h, 0CFE55EF3h, 54414420h, 46093041h dd 1CDEF902h, 4F0D18ECh, 5342C040h, 0FA252153h, 3F6DD899h dd 2E004F1Ah, 7B476469h, 615A2C13h, 0E750E700h, 0F026404Fh dd 0A1B42870h, 9A9960F7h, 1EEFDDA3h, 0E273504Fh, 0F87E7B52h dd 1A66816h, 20A80087h, 55FBAE4Fh, 0BC2EC608h, 0F1191DEh dd 920CFA25h, 124924h, 0FF540000h, 2 dup(0) ; =============== S U B R O U T I N E ======================================= public start start proc near var_AC = byte ptr -0ACh pusha mov esi, offset dword_103000 lea edi, [esi-0F2000h] push edi or ebp, 0FFFFFFFFh jmp short loc_103D22 ; --------------------------------------------------------------------------- align 8 loc_103D18: ; CODE XREF: start:loc_103D29j mov al, [esi] inc esi mov [edi], al inc edi loc_103D1E: ; CODE XREF: start+D7j start+EDj add ebx, ebx jnz short loc_103D29 loc_103D22: ; CODE XREF: start+10j mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_103D29: ; CODE XREF: start+20j jb short loc_103D18 mov eax, 1 loc_103D30: ; CODE XREF: start+5Aj add ebx, ebx jnz short loc_103D3B mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_103D3B: ; CODE XREF: start+32j adc eax, eax add ebx, ebx jnb short loc_103D4C jnz short loc_103D6B mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jb short loc_103D6B loc_103D4C: ; CODE XREF: start+3Fj dec eax add ebx, ebx jnz short loc_103D58 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_103D58: ; CODE XREF: start+4Fj adc eax, eax jmp short loc_103D30 ; --------------------------------------------------------------------------- loc_103D5C: ; CODE XREF: start:loc_103D8Ej ; start:loc_103D9Cj add ebx, ebx jnz short loc_103D67 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_103D67: ; CODE XREF: start+5Ej adc ecx, ecx jmp short loc_103DBD ; --------------------------------------------------------------------------- loc_103D6B: ; CODE XREF: start+41j start+4Aj xor ecx, ecx sub eax, 3 jb short loc_103D83 shl eax, 8 mov al, [esi] inc esi xor eax, 0FFFFFFFFh jz short loc_103DF2 sar eax, 1 mov ebp, eax jmp short loc_103D8E ; --------------------------------------------------------------------------- loc_103D83: ; CODE XREF: start+70j add ebx, ebx jnz short loc_103D8E mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_103D8E: ; CODE XREF: start+81j start+85j jb short loc_103D5C inc ecx add ebx, ebx jnz short loc_103D9C mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_103D9C: ; CODE XREF: start+93j jb short loc_103D5C loc_103D9E: ; CODE XREF: start+ADj start+B8j add ebx, ebx jnz short loc_103DA9 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_103DA9: ; CODE XREF: start+A0j adc ecx, ecx add ebx, ebx jnb short loc_103D9E jnz short loc_103DBA mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_103D9E loc_103DBA: ; CODE XREF: start+AFj add ecx, 2 loc_103DBD: ; CODE XREF: start+69j cmp ebp, 0FFFFFB00h adc ecx, 2 lea edx, [edi+ebp] cmp ebp, 0FFFFFFFCh jbe short loc_103DDC loc_103DCE: ; CODE XREF: start+D5j mov al, [edx] inc edx mov [edi], al inc edi dec ecx jnz short loc_103DCE jmp loc_103D1E ; --------------------------------------------------------------------------- loc_103DDC: ; CODE XREF: start+CCj start+E9j mov eax, [edx] add edx, 4 mov [edi], eax add edi, 4 sub ecx, 4 ja short loc_103DDC add edi, ecx jmp loc_103D1E ; --------------------------------------------------------------------------- loc_103DF2: ; CODE XREF: start+7Bj pop esi mov edi, esi mov ecx, offset byte_29AD7 loc_103DFA: ; CODE XREF: start+101j mov al, [edi] inc edi sub al, 0E8h loc_103DFF: ; CODE XREF: start+11Dj cmp al, 1 ja short loc_103DFA mov eax, [edi] mov bl, [edi+4] xchg al, ah rol eax, 10h xchg al, ah sub eax, edi sub bl, 0E8h add eax, esi mov [edi], eax add edi, 5 mov al, bl loop loc_103DFF lea edi, dword_F1000[esi] loc_103E25: ; CODE XREF: start+147j mov eax, [edi] or eax, eax jz short loc_103E67 mov ebx, [edi+4] lea eax, [eax+esi+10D5F4h] add ebx, esi push eax add edi, 8 call dword ptr [esi+10D630h] xchg eax, ebp loc_103E42: ; CODE XREF: start+15Fj mov al, [edi] inc edi or al, al jz short loc_103E25 mov ecx, edi push edi dec eax repne scasb push ebp call dword ptr [esi+10D634h] or eax, eax jz short loc_103E61 mov [ebx], eax add ebx, 4 jmp short loc_103E42 ; --------------------------------------------------------------------------- loc_103E61: ; CODE XREF: start+158j call dword ptr [esi+10D63Ch] loc_103E67: ; CODE XREF: start+129j add edi, 4 lea ebx, [esi-4] loc_103E6D: ; CODE XREF: start+189j xor eax, eax mov al, [edi] inc edi or eax, eax jz short loc_103E98 cmp al, 0EFh ja short loc_103E8B loc_103E7A: ; CODE XREF: start+196j add ebx, eax mov eax, [ebx] xchg al, ah rol eax, 10h xchg al, ah add eax, esi mov [ebx], eax jmp short loc_103E6D ; --------------------------------------------------------------------------- loc_103E8B: ; CODE XREF: start+178j and al, 0Fh shl eax, 10h mov ax, [edi] add edi, 2 jmp short loc_103E7A ; --------------------------------------------------------------------------- loc_103E98: ; CODE XREF: start+174j mov ebp, [esi+10D638h] lea edi, [esi-1000h] mov ebx, 1000h push eax push esp push 4 push ebx push edi call ebp lea eax, [edi+21Fh] and byte ptr [eax], 7Fh and byte ptr [eax+28h], 7Fh pop eax push eax push esp push eax push ebx push edi call ebp pop eax popa lea eax, [esp+2Ch+var_AC] loc_103ECC: ; CODE XREF: start+1D0j push 0 cmp esp, eax jnz short loc_103ECC sub esp, 0FFFFFF80h jmp near ptr dword_11CD0 start endp ; sp-analysis failed ; --------------------------------------------------------------------------- align 4 dd 48h dup(0) dd 0E2000000h UPX1 ends end start