0

This is far more than I would like anyone to try and decipher, but could anyone provide pointers as to what this function is doing? Or, better yet, tips on how to make sense of this/ tools that can be used in IDA to do so

UPX1:00420CD0
UPX1:00420CD0                 public start
UPX1:00420CD0 start           proc near
UPX1:00420CD0
UPX1:00420CD0 var_AC          = byte ptr -0ACh
UPX1:00420CD0
UPX1:00420CD0                 pusha
UPX1:00420CD1                 mov     esi, offset dword_412000
UPX1:00420CD6                 lea     edi, [esi-11000h]
UPX1:00420CDC                 push    edi
UPX1:00420CDD                 jmp     short loc_420CEA
UPX1:00420CDD ; ---------------------------------------------------------------------------
UPX1:00420CDF                 align 10h
UPX1:00420CE0
UPX1:00420CE0 loc_420CE0:                             ; CODE XREF: start:loc_420CF1j
UPX1:00420CE0                 mov     al, [esi]
UPX1:00420CE2                 inc     esi
UPX1:00420CE3                 mov     [edi], al
UPX1:00420CE5                 inc     edi
UPX1:00420CE6
UPX1:00420CE6 loc_420CE6:                             ; CODE XREF: start+AEj
UPX1:00420CE6                                         ; start+C5j
UPX1:00420CE6                 add     ebx, ebx
UPX1:00420CE8                 jnz     short loc_420CF1
UPX1:00420CEA
UPX1:00420CEA loc_420CEA:                             ; CODE XREF: start+Dj
UPX1:00420CEA                 mov     ebx, [esi]
UPX1:00420CEC                 sub     esi, 0FFFFFFFCh
UPX1:00420CEF                 adc     ebx, ebx
UPX1:00420CF1
UPX1:00420CF1 loc_420CF1:                             ; CODE XREF: start+18j
UPX1:00420CF1                 jb      short loc_420CE0
UPX1:00420CF3                 mov     eax, 1
UPX1:00420CF8
UPX1:00420CF8 loc_420CF8:                             ; CODE XREF: start+37j
UPX1:00420CF8                                         ; start+42j
UPX1:00420CF8                 add     ebx, ebx
UPX1:00420CFA                 jnz     short loc_420D03
UPX1:00420CFC                 mov     ebx, [esi]
UPX1:00420CFE                 sub     esi, 0FFFFFFFCh
UPX1:00420D01                 adc     ebx, ebx
UPX1:00420D03
UPX1:00420D03 loc_420D03:                             ; CODE XREF: start+2Aj
UPX1:00420D03                 adc     eax, eax
UPX1:00420D05                 add     ebx, ebx
UPX1:00420D07                 jnb     short loc_420CF8
UPX1:00420D09                 jnz     short loc_420D14
UPX1:00420D0B                 mov     ebx, [esi]
UPX1:00420D0D                 sub     esi, 0FFFFFFFCh
UPX1:00420D10                 adc     ebx, ebx
UPX1:00420D12                 jnb     short loc_420CF8
UPX1:00420D14
UPX1:00420D14 loc_420D14:                             ; CODE XREF: start+39j
UPX1:00420D14                 xor     ecx, ecx
UPX1:00420D16                 sub     eax, 3
UPX1:00420D19                 jb      short loc_420D28
UPX1:00420D1B                 shl     eax, 8
UPX1:00420D1E                 mov     al, [esi]
UPX1:00420D20                 inc     esi
UPX1:00420D21                 xor     eax, 0FFFFFFFFh
UPX1:00420D24                 jz      short loc_420D9A
UPX1:00420D26                 mov     ebp, eax
UPX1:00420D28
UPX1:00420D28 loc_420D28:                             ; CODE XREF: start+49j
UPX1:00420D28                 add     ebx, ebx
UPX1:00420D2A                 jnz     short loc_420D33
UPX1:00420D2C                 mov     ebx, [esi]
UPX1:00420D2E                 sub     esi, 0FFFFFFFCh
UPX1:00420D31                 adc     ebx, ebx
UPX1:00420D33
UPX1:00420D33 loc_420D33:                             ; CODE XREF: start+5Aj
UPX1:00420D33                 adc     ecx, ecx
UPX1:00420D35                 add     ebx, ebx
UPX1:00420D37                 jnz     short loc_420D40
UPX1:00420D39                 mov     ebx, [esi]
UPX1:00420D3B                 sub     esi, 0FFFFFFFCh
UPX1:00420D3E                 adc     ebx, ebx
UPX1:00420D40
UPX1:00420D40 loc_420D40:                             ; CODE XREF: start+67j
UPX1:00420D40                 adc     ecx, ecx
UPX1:00420D42                 jnz     short loc_420D64
UPX1:00420D44                 inc     ecx
UPX1:00420D45
UPX1:00420D45 loc_420D45:                             ; CODE XREF: start+84j
UPX1:00420D45                                         ; start+8Fj
UPX1:00420D45                 add     ebx, ebx
UPX1:00420D47                 jnz     short loc_420D50
UPX1:00420D49                 mov     ebx, [esi]
UPX1:00420D4B                 sub     esi, 0FFFFFFFCh
UPX1:00420D4E                 adc     ebx, ebx
UPX1:00420D50
UPX1:00420D50 loc_420D50:                             ; CODE XREF: start+77j
UPX1:00420D50                 adc     ecx, ecx
UPX1:00420D52                 add     ebx, ebx
UPX1:00420D54                 jnb     short loc_420D45
UPX1:00420D56                 jnz     short loc_420D61
UPX1:00420D58                 mov     ebx, [esi]
UPX1:00420D5A                 sub     esi, 0FFFFFFFCh
UPX1:00420D5D                 adc     ebx, ebx
UPX1:00420D5F                 jnb     short loc_420D45
UPX1:00420D61
UPX1:00420D61 loc_420D61:                             ; CODE XREF: start+86j
UPX1:00420D61                 add     ecx, 2
UPX1:00420D64
UPX1:00420D64 loc_420D64:                             ; CODE XREF: start+72j
UPX1:00420D64                 cmp     ebp, 0FFFFF300h
UPX1:00420D6A                 adc     ecx, 1
UPX1:00420D6D                 lea     edx, [edi+ebp]
UPX1:00420D70                 cmp     ebp, 0FFFFFFFCh
UPX1:00420D73                 jbe     short loc_420D84
UPX1:00420D75
UPX1:00420D75 loc_420D75:                             ; CODE XREF: start+ACj
UPX1:00420D75                 mov     al, [edx]
UPX1:00420D77                 inc     edx
UPX1:00420D78                 mov     [edi], al
UPX1:00420D7A                 inc     edi
UPX1:00420D7B                 dec     ecx
UPX1:00420D7C                 jnz     short loc_420D75
UPX1:00420D7E                 jmp     loc_420CE6
UPX1:00420D7E ; ---------------------------------------------------------------------------
UPX1:00420D83                 align 4
UPX1:00420D84
UPX1:00420D84 loc_420D84:                             ; CODE XREF: start+A3j
UPX1:00420D84                                         ; start+C1j
UPX1:00420D84                 mov     eax, [edx]
UPX1:00420D86                 add     edx, 4
UPX1:00420D89                 mov     [edi], eax
UPX1:00420D8B                 add     edi, 4
UPX1:00420D8E                 sub     ecx, 4
UPX1:00420D91                 ja      short loc_420D84
UPX1:00420D93                 add     edi, ecx
UPX1:00420D95                 jmp     loc_420CE6
UPX1:00420D9A ; ---------------------------------------------------------------------------
UPX1:00420D9A
UPX1:00420D9A loc_420D9A:                             ; CODE XREF: start+54j
UPX1:00420D9A                 pop     esi
UPX1:00420D9B                 mov     edi, esi
UPX1:00420D9D                 mov     ecx, 7E1h
UPX1:00420DA2
UPX1:00420DA2 loc_420DA2:                             ; CODE XREF: start+D9j
UPX1:00420DA2                                         ; start+DEj
UPX1:00420DA2                 mov     al, [edi]
UPX1:00420DA4                 inc     edi
UPX1:00420DA5                 sub     al, 0E8h
UPX1:00420DA7
UPX1:00420DA7 loc_420DA7:                             ; CODE XREF: start+FCj
UPX1:00420DA7                 cmp     al, 1
UPX1:00420DA9                 ja      short loc_420DA2
UPX1:00420DAB                 cmp     byte ptr [edi], 11h
UPX1:00420DAE                 jnz     short loc_420DA2
UPX1:00420DB0                 mov     eax, [edi]
UPX1:00420DB2                 mov     bl, [edi+4]
UPX1:00420DB5                 shr     ax, 8
UPX1:00420DB9                 rol     eax, 10h
UPX1:00420DBC                 xchg    al, ah
UPX1:00420DBE                 sub     eax, edi
UPX1:00420DC0                 sub     bl, 0E8h
UPX1:00420DC3                 add     eax, esi
UPX1:00420DC5                 mov     [edi], eax
UPX1:00420DC7                 add     edi, 5
UPX1:00420DCA                 mov     al, bl
UPX1:00420DCC                 loop    loc_420DA7
UPX1:00420DCE                 lea     edi, [esi+1E000h]
UPX1:00420DD4
UPX1:00420DD4 loc_420DD4:                             ; CODE XREF: start+126j
UPX1:00420DD4                 mov     eax, [edi]
UPX1:00420DD6                 or      eax, eax
UPX1:00420DD8                 jz      short loc_420E1F
UPX1:00420DDA                 mov     ebx, [edi+4]
UPX1:00420DDD                 lea     eax, [eax+esi+20000h]
UPX1:00420DE4                 add     ebx, esi
UPX1:00420DE6                 push    eax
UPX1:00420DE7                 add     edi, 8
UPX1:00420DEA                 call    dword ptr [esi+20080h]
UPX1:00420DF0                 xchg    eax, ebp
UPX1:00420DF1
UPX1:00420DF1 loc_420DF1:                             ; CODE XREF: start+147j
UPX1:00420DF1                 mov     al, [edi]
UPX1:00420DF3                 inc     edi
UPX1:00420DF4                 or      al, al
UPX1:00420DF6                 jz      short loc_420DD4
UPX1:00420DF8                 mov     ecx, edi
UPX1:00420DFA                 jns     short near ptr loc_420E02+1
UPX1:00420DFC                 movzx   eax, word ptr [edi]
UPX1:00420DFF                 inc     edi
UPX1:00420E00                 push    eax
UPX1:00420E01                 inc     edi
UPX1:00420E02
UPX1:00420E02 loc_420E02:                             ; CODE XREF: start+12Aj
UPX1:00420E02                 mov     ecx, 0AEF24857h
UPX1:00420E07                 push    ebp
UPX1:00420E08                 call    dword ptr [esi+20088h]
UPX1:00420E0E                 or      eax, eax
UPX1:00420E10                 jz      short loc_420E19
UPX1:00420E12                 mov     [ebx], eax
UPX1:00420E14                 add     ebx, 4
UPX1:00420E17                 jmp     short loc_420DF1
UPX1:00420E19 ; ---------------------------------------------------------------------------
UPX1:00420E19
UPX1:00420E19 loc_420E19:                             ; CODE XREF: start+140j
UPX1:00420E19                 call    dword ptr [esi+20084h]
UPX1:00420E1F
UPX1:00420E1F loc_420E1F:                             ; CODE XREF: start+108j
UPX1:00420E1F                 mov     ebp, [esi+2008Ch]
UPX1:00420E25                 lea     edi, [esi-1000h]
UPX1:00420E2B                 mov     ebx, 1000h
UPX1:00420E30                 push    eax
UPX1:00420E31                 push    esp
UPX1:00420E32                 push    4
UPX1:00420E34                 push    ebx
UPX1:00420E35                 push    edi
UPX1:00420E36                 call    ebp
UPX1:00420E38                 lea     eax, [edi+217h]
UPX1:00420E3E                 and     byte ptr [eax], 7Fh
UPX1:00420E41                 and     byte ptr [eax+28h], 7Fh
UPX1:00420E45                 pop     eax
UPX1:00420E46                 push    eax
UPX1:00420E47                 push    esp
UPX1:00420E48                 push    eax
UPX1:00420E49                 push    ebx
UPX1:00420E4A                 push    edi
UPX1:00420E4B                 call    ebp
UPX1:00420E4D                 pop     eax
UPX1:00420E4E                 popa
UPX1:00420E4F                 lea     eax, [esp+2Ch+var_AC]
UPX1:00420E53
UPX1:00420E53 loc_420E53:                             ; CODE XREF: start+187j
UPX1:00420E53                 push    0
UPX1:00420E55                 cmp     esp, eax
UPX1:00420E57                 jnz     short loc_420E53
UPX1:00420E59                 sub     esp, 0FFFFFF80h
UPX1:00420E5C                 jmp     near ptr word_401DCE
UPX1:00420E5C ; ---------------------------------------------------------------------------
New contributor
user man is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 2
    It looks like your binary is packed or compressed by UPX. Here is the step for unpacking. reverseengineering.stackexchange.com/questions/11486/… – ismael_akez Jan 14 at 5:33
  • @ismael_akez I've the ability to use the Universal PE Unpacker in IDA Pro however after it worked yesterday it no longer does today for some reason. Are there any reasons why this might occur? I've gone as far to reinstall IDA and also re-download the malware in question, but to no avail.. – user man Jan 15 at 13:24

Your Answer

user man is a new contributor. Be nice, and check out our Code of Conduct.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.