0

I have the following lines

 push [ebp+dwBytes]
 push 8                 ; dwFlags
 call ds:GetProcessHeap
 push eax               ; hHeap
 call ds:HeapAlloc      
 push [ebp:lpCmdLine]   ; char *
 mov edi, eax
 call _atol
 mov esi, eax
 xor esi, 28Ch
 mov eax, esi
 pop ecx
 mov edx, ebx
 xor eax, 1104h
 xor ecx, ecx
 shr edx, 1
 jz  short loc_60114A

The first part is not difficult. They get a handle to the default heap and after that, they allocate some memory on that heap using the handle hHeap.

The part with lpCmdLine take the lpCmdLine and converts it into a long value.

Now, I do not understand the part which comes after call _atol. Especially the lines with the XOR :

 xor esi, 28Ch

Questions: a) Is that a way of encryption ? I mean, is it so that they try to encrypt the string pointed by lpCmdLine ?

b) Normally I had a cmp before jz, but here as you can see, there is only a jz instruction? Why is the cmp is missing ?

best regards,

1
  • atol = ascii to long, so if you passed 12345678 on the commandline then eax would become that, then its xoring the value, presumably for a compare later, so at a guess jz doesnt need a compare, some of the other operations will adjust the eflags.. like the shr edx.. if edx = 0 after this the zero flag will be set
    – evlncrn8
    Sep 20, 2014 at 20:32

1 Answer 1

2

The number returned by _atol() is XOR'ed with 0x28C and then XOR'ed again with 0x1104. Since XOR is an associative operation, this is equivalent to XOR'ing the number returned by _atol() with 0x1388.

a) Is that a way of encryption ? I mean, is it so that they try to encrypt the string pointed by lpCmdLine?

There's not enough context in your snippet above to infer how this resulting value is being used.

Also, it's unlikely that what IDA is labeling as lpCmdLine is really the program's command line, since a command line typically begins with the executable's file name, on which _atol() would typically fail (you can create a process and have only command line arguments as the command line, and alternatively it is possible that the code above expects the executable's file name to be numeric (like 123.exe), but these are both less likely than IDA just mislabling the variable).

b) Normally I had a cmp before jz, but here as you can see, there is only a jz instruction? Why is the cmp is missing ?

The jz instruction checks the CPU's Zero Flag. The shr instruction prior to the jz instruction sets the Zero Flag as follows (from http://x86.renejeschke.de/html/file_module_x86_id_285.html) --

The SF, ZF, and PF flags are set according to the result [of the shift operation].

In other words, if after shr edx, 1 the register edx is 0x00000000, then the jump is taken. As with your previous question, though, there's not enough context in your snippet above to infer how this is being used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.