1

I was reversing one executable in IDA and found out the function with this structure:

.text:0058A6E0 sub_58A6E0      proc near               
.text:0058A6E0
.text:0058A6E0 var_4           = dword ptr -4
.text:0058A6E0
.text:0058A6E0                 push    ecx
.text:0058A6E1                 mov     ecx, ds:SHAppBarMessage
.text:0058A6E7                 mov     eax, offset loc_612BC0
.text:0058A6EC                 or      eax, offset loc_612BBA
.text:0058A6F1                 or      eax, offset loc_612BB4
.text:0058A6F6                 or      eax, offset loc_612BAE
.text:0058A6FB                 or      eax, ecx
.text:0058A6FD                 mov     ecx, ds:ShellExecuteW
.text:0058A703                 or      eax, ecx
.text:0058A705                 mov     ecx, ds:SHGetFileInfoW
.text:0058A70B                 or      eax, ecx
.text:0058A70D                 mov     ecx, ds:VariantInit
.text:0058A713                 or      eax, ecx
.text:0058A715                 mov     ecx, ds:VariantClear
.text:0058A71B                 or      eax, ecx
.text:0058A71D                 mov     ecx, ds:VariantCopy
.text:0058A723                 or      eax, ecx
.text:0058A725                 mov     ecx, ds:VariantCopyInd
.text:0058A72B                 or      eax, ecx
.text:0058A72D                 mov     ecx, ds:VariantChangeType
...

Lots of different functions.

...
.text:0058B8B8                 or      eax, ecx
.text:0058B8BA                 mov     ecx, ds:RegCloseKey
.text:0058B8C0                 or      eax, ecx
.text:0058B8C2                 mov     ecx, ds:RegOpenKeyExW
.text:0058B8C8                 or      eax, ecx
.text:0058B8CA                 mov     ecx, ds:RegQueryValueExW
.text:0058B8D0                 or      eax, ecx
.text:0058B8D2                 mov     ecx, dword_617AC4
.text:0058B8D8                 or      eax, offset loc_6129F8
...
Repeating simillar stuff
...
.text:0058B8F6                 or      eax, offset loc_6129D4
.text:0058B8FB                 or      eax, ecx
.text:0058B8FD                 mov     ecx, [esp+4+var_4]
.text:0058B901                 or      eax, offset loc_6129CE
.text:0058B906                 or      eax, offset loc_6129C8
...
Repeating simillar stuff
...
.text:0058B938                 or      eax, offset loc_61298C
.text:0058B93D                 or      eax, offset loc_612986
.text:0058B942                 or      eax, ecx
.text:0058B944                 pop     ecx
.text:0058B945                 retn
.text:0058B945 sub_58A6E0      endp

I have tried to find what it is and why it was used, but I found literally nothing about it. It's not the first time I see similar function, so I really want to know what is it. It doesn't make any sense for me and simply abusing the imports. Thank you.

UPD: There is a hex values for some part of this function.

C1 8B 0D 20 65 61 00 0B  C1 8B 0D 1C 65 61 00 0B
C1 8B 0D 18 65 61 00 0B  C1 8B 0D 14 65 61 00 0B
C1 8B 0D 10 65 61 00 0B  C1 8B 0D 0C 65 61 00 0B
C1 8B 0D 08 65 61 00 0B  C1 8B 0D 04 65 61 00 0B
C1 8B 0D 00 65 61 00 0B  C1 8B 0D FC 64 61 00 0B
C1 8B 0D F8 64 61 00 0B  C1 8B 0D F4 64 61 00 0B
C1 8B 0D F0 64 61 00 0B  C1 8B 0D EC 64 61 00 0B
C1 8B 0D E8 64 61 00 0B  C1 8B 0D E4 64 61 00 0B
C1 8B 0D E0 64 61 00 0B  C1 8B 0D DC 64 61 00 0B
C1 8B 0D D8 64 61 00 0B  C1 8B 0D D4 64 61 00 0B
C1 8B 0D D0 64 61 00 0B  C1 8B 0D CC 64 61 00 0B
C1 8B 0D C8 64 61 00 0B  C1 8B 0D C4 64 61 00 0B
C1 8B 0D C0 64 61 00 0B  C1 8B 0D BC 64 61 00 0B
C1 8B 0D B8 64 61 00 0B  C1 8B 0D B4 64 61 00 0B
C1 8B 0D B0 64 61 00 0B  C1 8B 0D AC 64 61 00 0B
C1 8B 0D A8 64 61 00 0B  C1 8B 0D A4 64 61 00 0B
  • can you show raw bytes? – Paweł Łukasik Jan 14 at 14:37
  • Do you mean hex values? – Matthew Darens Jan 14 at 14:43
  • 1
    yes, to see if those opcodes could be something else than code and IDA assuming them as code does it incorrectly. – Paweł Łukasik Jan 14 at 14:44
  • Sadly, I can't find it. I have downloaded many malware samples to reverse and I can't realize which one it was. All I know, that function sub_58A6E0 was referenced once or twice, so it did not look like a loading functions by offsets. – Matthew Darens Jan 14 at 15:01
  • I have updated the post with the hex input from the function. This is the or eax, ecx and mov ecx, ds:"function" repeated. I hope it can help. – Matthew Darens Jan 15 at 8:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.