;; Zlib Decompression Reversed | #MalwareMustDie - @unixfreaxjp /malware/Iptablex]$ date
;; Mon Jun 16 14:08:22 JST 2014
;; Is really advised to take a deep breath before read this (delicious) spaghetti codes :-)
;;The decompress data trace.
.text:0804DB64 jz short loc_804DBC5
.text:0804DB66 mov [esp+18h+var_10], 1E8h
.text:0804DB6E mov [esp+18h+var_14], 0
.text:0804DB76 mov [esp+18h+var_18], offset g_mainsrvinfo
.text:0804DB7D call memset
.text:0804DB82 mov eax, [ebp+arg_0]
.text:0804DB85 mov [esp+18h+var_18], eax
.text:0804DB88 call DeCtlInfo
.text:0804DB8D test eax, eax
.text:0804DB8F mov dword ptr ds:g_mainsrvinfo+124h, eax
.text:0804DB94 jnz short loc_804DBD1
;; The control for decompressor:
public DeCtlInfo
DeCtlInfo proc near
var_28= dword ptr -28h
var_24= dword ptr -24h
var_20= dword ptr -20h
var_14= dword ptr -14h
var_10= dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
arg_0= dword ptr 8
push ebp
mov ebp, esp
push ebx
sub esp, 24h
mov eax, [ebp+arg_0]
lea edx, [ebp+var_14]
mov [ebp+var_14], eax
mov eax, [eax+23Ch]
mov [ebp+var_C], 0
mov [ebp+var_8], 0
mov [esp+28h+var_28], edx
mov [ebp+var_10], eax
lea eax, [ebp+var_C]
mov [esp+28h+var_24], eax
call Hb_DeCompress
test eax, eax
;; main function for decompression handles...
public Hb_DeCompress
Hb_DeCompress proc near
var_28= dword ptr -28h
var_24= dword ptr -24h
var_20= dword ptr -20h
var_1C= dword ptr -1Ch
var_18= dword ptr -18h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr 8
arg_4= dword ptr 0Ch
push ebp
mov ebp, esp
sub esp, 28h
mov [ebp+var_C], ebx
mov [ebp+var_8], esi
mov esi, 0FFFFFFFFh
mov [ebp+var_4], edi
mov edi, [ebp+arg_4]
call zlib_decompress_init
test eax, eax
mov ebx, eax
jz short loc_804BBA7
;; Subroutine of zlib decompress initiation
.text:0804B100 public zlib_decompress_init
.text:0804B100 zlib_decompress_init proc near
.text:0804B100
.text:0804B100 var_138 = dword ptr -138h
.text:0804B100 var_134 = dword ptr -134h
.text:0804B100 var_130 = dword ptr -130h
.text:0804B100 var_128 = dword ptr -128h
.text:0804B100 var_124 = dword ptr -124h
.text:0804B100 var_120 = dword ptr -120h
.text:0804B100 var_11C = dword ptr -11Ch
.text:0804B100 var_118 = dword ptr -118h
.text:0804B100 var_114 = dword ptr -114h
.text:0804B100 var_110 = dword ptr -110h
.text:0804B100 var_10C = dword ptr -10Ch
.text:0804B100 var_98 = dword ptr -98h
.text:0804B100 var_28 = dword ptr -28h
.text:0804B100 var_24 = dword ptr -24h
.text:0804B100 var_20 = dword ptr -20h
.text:0804B100 var_1C = dword ptr -1Ch
.text:0804B100 var_18 = dword ptr -18h
.text:0804B100 var_14 = dword ptr -14h
.text:0804B100 var_10 = dword ptr -10h
.text:0804B100 var_C = dword ptr -0Ch
.text:0804B100
.text:0804B100 push ebp
.text:0804B101 mov ebp, esp
.text:0804B103 push esi
.text:0804B104 push ebx
.text:0804B105 sub esp, 130h
.text:0804B10B mov [esp+138h+var_138], 81ACh
.text:0804B112 lea esi, [ebp+var_128]
.text:0804B118 call malloc
.text:0804B11D mov [esp+138h+var_138], esi
.text:0804B120 mov [esp+138h+var_130], 90h
.text:0804B128 mov [esp+138h+var_134], 8
.text:0804B130 mov ebx, eax
.text:0804B132 call memset
.text:0804B137 lea eax, [ebp+var_98]
.text:0804B13D mov [esp+138h+var_130], 70h
.text:0804B145 mov [esp+138h+var_134], 9
.text:0804B14D mov [esp+138h+var_138], eax
.text:0804B150 call memset
.text:0804B155 mov edx, 120h
.text:0804B15A mov eax, esi
.text:0804B15C mov [ebp+var_28], 7070707h
.text:0804B163 mov [ebp+var_24], 7070707h
.text:0804B16A mov [ebp+var_20], 7070707h
.text:0804B171 mov [ebp+var_1C], 7070707h
.text:0804B178 mov [ebp+var_18], 7070707h
.text:0804B17F mov [ebp+var_14], 7070707h
.text:0804B186 mov [ebp+var_10], (offset loc_8080806+2)
.text:0804B18D mov [ebp+var_C], (offset loc_8080806+2)
.text:0804B194 call zlib_mktable
.text:0804B199 mov edx, 20h
.text:0804B19E mov [ebp+var_128], 5050505h
.text:0804B1A8 mov [ebp+var_124], 5050505h
.text:0804B1B2 mov [ebp+var_120], 5050505h
.text:0804B1BC mov [ebp+var_11C], 5050505h
.text:0804B1C6 mov [ebp+var_118], 5050505h
.text:0804B1D0 mov [ebx], eax
.text:0804B1D2 mov eax, esi
.text:0804B1D4 mov [ebp+var_114], 5050505h
.text:0804B1DE mov [ebp+var_110], 5050505h
.text:0804B1E8 mov [ebp+var_10C], 5050505h
.text:0804B1F2 call zlib_mktable
.text:0804B1F7 mov dword ptr [ebx+14h], 0
.text:0804B1FE mov dword ptr [ebx+10h], 0
.text:0804B205 mov dword ptr [ebx+0Ch], 0
.text:0804B20C mov dword ptr [ebx+8], 0
.text:0804B213 mov dword ptr [ebx+194h], 0
.text:0804B21D mov [ebx+4], eax
.text:0804B220 mov eax, ebx
.text:0804B222 mov dword ptr [ebx+198h], 0
.text:0804B22C mov dword ptr [ebx+819Ch], 0
.text:0804B236 add esp, 130h
.text:0804B23C pop ebx
.text:0804B23D pop esi
.text:0804B23E pop ebp
.text:0804B23F retn
.text:0804B23F zlib_decompress_init endp
.text:0804B23F
;; Table data creation for zlib decompression purpose...
.text:0804AF10 zlib_mktable proc near
.text:0804AF10
.text:0804AF10 var_528 = dword ptr -528h
.text:0804AF10 var_524 = dword ptr -524h
.text:0804AF10 var_520 = dword ptr -520h
.text:0804AF10 var_518 = dword ptr -518h
.text:0804AF10 var_514 = dword ptr -514h
.text:0804AF10 var_510 = dword ptr -510h
.text:0804AF10 var_50C = dword ptr -50Ch
.text:0804AF10 var_8C = dword ptr -8Ch
.text:0804AF10 var_4C = dword ptr -4Ch
.text:0804AF10
.text:0804AF10 push ebp
.text:0804AF11 mov ebp, esp
.text:0804AF13 push edi
.text:0804AF14 push esi
.text:0804AF15 push ebx
.text:0804AF16 sub esp, 51Ch
.text:0804AF1C lea ebx, [ebp+var_4C]
.text:0804AF1F mov [ebp+var_514], eax
.text:0804AF25 xor eax, eax
.text:0804AF27 mov [ebp+var_518], edx
.text:0804AF2D lea esi, [esi+0]
.text:0804AF30
.text:0804AF30 loc_804AF30:
.text:0804AF30 mov dword ptr [ebx+eax*4+4], 0
.text:0804AF38 add eax, 1
.text:0804AF3B cmp eax, 0Fh
.text:0804AF3E jnz short loc_804AF30
.text:0804AF40 mov eax, [ebp+var_518]
.text:0804AF46 mov [ebp+var_510], 0
.text:0804AF50 test eax, eax
.text:0804AF52 jle short loc_804AF7E
.text:0804AF54 xor edx, edx
.text:0804AF56
.text:0804AF56 loc_804AF56:
.text:0804AF56 mov ecx, [ebp+var_514]
.text:0804AF5C movzx eax, byte ptr [edx+ecx]
.text:0804AF60 add [ebp+eax*4+var_4C], 1
.text:0804AF65 cmp [ebp+var_510], eax
.text:0804AF6B jge short loc_804AF73
.text:0804AF6D mov [ebp+var_510], eax
.text:0804AF73
.text:0804AF73 loc_804AF73:
.text:0804AF73 add edx, 1
.text:0804AF76 cmp edx, [ebp+var_518]
.text:0804AF7C jnz short loc_804AF56
.text:0804AF7E
.text:0804AF7E loc_804AF7E: ; CODE XREF: zlib_mktable+42
.text:0804AF7E xor eax, eax
.text:0804AF80 xor edx, edx
.text:0804AF82 lea ecx, [ebp+var_8C]
.text:0804AF88
.text:0804AF88 loc_804AF88:
.text:0804AF88 mov [ecx+edx*4+4], eax
.text:0804AF8C add eax, [ebx+edx*4+4]
.text:0804AF90 add edx, 1
.text:0804AF93 add eax, eax
.text:0804AF95 cmp edx, 0Fh
.text:0804AF98 jnz short loc_804AF88
.text:0804AF9A mov eax, [ebp+var_518]
.text:0804AFA0 test eax, eax
.text:0804AFA2 jle short loc_804AFFA
.text:0804AFA4 xor edi, edi
.text:0804AFA6
.text:0804AFA6 loc_804AFA6:
.text:0804AFA6 mov eax, [ebp+var_514]
.text:0804AFAC movzx edx, byte ptr [edi+eax]
.text:0804AFB0 mov [ebp+edi*4+var_50C], 0
.text:0804AFBB mov ecx, [ebp+edx*4+var_8C]
.text:0804AFC2 test edx, edx
.text:0804AFC4 lea eax, [ecx+1]
.text:0804AFC7 mov [ebp+edx*4+var_8C], eax
.text:0804AFCE jle short loc_804AFEF
.text:0804AFD0 mov esi, edx
.text:0804AFD2 xor ebx, ebx
.text:0804AFD4 xor edx, edx
.text:0804AFD6
.text:0804AFD6 loc_804AFD6:
.text:0804AFD6 mov eax, ecx
.text:0804AFD8 add edx, edx
.text:0804AFDA and eax, 1
.text:0804AFDD add ebx, 1
.text:0804AFE0 or edx, eax
.text:0804AFE2 sar ecx, 1
.text:0804AFE4 cmp esi, ebx
.text:0804AFE6 jg short loc_804AFD6
.text:0804AFE8 mov [ebp+edi*4+var_50C], edx
.text:0804AFEF
.text:0804AFEF loc_804AFEF:
.text:0804AFEF add edi, 1
.text:0804AFF2 cmp edi, [ebp+var_518]
.text:0804AFF8 jnz short loc_804AFA6
.text:0804AFFA
.text:0804AFFA loc_804AFFA:
.text:0804AFFA mov eax, [ebp+var_510]
.text:0804B000 cmp eax, 9
.text:0804B003 jle short loc_804B00A
.text:0804B005 mov eax, 9
.text:0804B00A
.text:0804B00A loc_804B00A:
.text:0804B00A mov ecx, [ebp+var_518]
.text:0804B010 mov edx, [ebp+var_514]
.text:0804B016 mov [esp+528h+var_520], eax
.text:0804B01A lea eax, [ebp+var_50C]
.text:0804B020 mov [esp+528h+var_524], 0
.text:0804B028 mov [esp+528h+var_528], 0
.text:0804B02F call zlib_mkonetab
.text:0804B034 add esp, 51Ch
.text:0804B03A pop ebx
.text:0804B03B pop esi
.text:0804B03C pop edi
.text:0804B03D pop ebp
.text:0804B03E retn
.text:0804B03E zlib_mktable endp
.text:0804B03E
// zlib decompression block...main cource..welcome to the spaghetti code..
.text:0804B3D0 public zlib_decompress_block
.text:0804B3D0 zlib_decompress_block proc near
.text:0804B3D0
.text:0804B3D0 var_18 = dword ptr -18h
.text:0804B3D0 var_14 = dword ptr -14h
.text:0804B3D0 var_10 = dword ptr -10h
.text:0804B3D0 arg_0 = dword ptr 8
.text:0804B3D0 arg_4 = dword ptr 0Ch
.text:0804B3D0 arg_8 = dword ptr 10h
.text:0804B3D0 arg_C = dword ptr 14h
.text:0804B3D0 arg_10 = dword ptr 18h
.text:0804B3D0
.text:0804B3D0 push ebp
.text:0804B3D1 mov ebp, esp
.text:0804B3D3 push edi
.text:0804B3D4 push esi
.text:0804B3D5 push ebx
.text:0804B3D6 sub esp, 0Ch
.text:0804B3D9 mov esi, [ebp+arg_0]
.text:0804B3DC mov [esp+18h+var_18], 100h
.text:0804B3E3 call malloc
.text:0804B3E8 mov dword ptr [esi+81A8h], 100h
.text:0804B3F2 mov dword ptr [esi+81A4h], 0
.text:0804B3FC mov [esi+81A0h], eax
.text:0804B402
.text:0804B402 loc_804B402:
.text:0804B402 mov eax, [ebp+arg_8]
.text:0804B405 test eax, eax
.text:0804B407 jle short loc_804B450
.text:0804B409 mov edx, [esi+198h]
.text:0804B40F cmp edx, 17h
.text:0804B412 mov [ebp+var_14], edx
.text:0804B415 jg short loc_804B461
.text:0804B417
.text:0804B417 loc_804B417:
.text:0804B417 mov ecx, [ebp+arg_4]
.text:0804B41A add edx, 8
.text:0804B41D movzx eax, byte ptr [ecx]
.text:0804B420 movzx ecx, byte ptr [ebp+var_14]
.text:0804B424 add [ebp+arg_4], 1
.text:0804B428 mov [esi+198h], edx
.text:0804B42E shl eax, cl
.text:0804B430 sub [ebp+arg_8], 1
.text:0804B434 or [esi+194h], eax
.text:0804B43A cmp edx, 17h
.text:0804B43D mov [ebp+var_14], edx
.text:0804B440 jg short loc_804B461
.text:0804B442 mov eax, [ebp+arg_8]
.text:0804B445 test eax, eax
.text:0804B447 jle short loc_804B461
.text:0804B449 mov edx, [ebp+var_14]
.text:0804B44C jmp short loc_804B417
.text:0804B450
.text:0804B450 loc_804B450:
.text:0804B450 mov ecx, [esi+198h]
.text:0804B456 test ecx, ecx
.text:0804B458 mov [ebp+var_14], ecx
.text:0804B45B jle loc_804B92D
.text:0804B461
.text:0804B461 loc_804B461:
.text:0804B461 cmp dword ptr [esi+14h], 0Ch
.text:0804B465 ja short loc_804B402
.text:0804B467 mov eax, [esi+14h]
.text:0804B46A jmp ds:off_80B3400[eax*4]
.text:0804B471
.text:0804B471 loc_804B471:
.text:0804B471 cmp [ebp+var_14], 0Fh
.text:0804B475 jle loc_804B92D
.text:0804B47B mov eax, [esi+194h]
.text:0804B481 shr dword ptr [esi+194h], 10h
.text:0804B488 movzx ebx, al
.text:0804B48B movzx eax, ah
.text:0804B48E shl ebx, 8
.text:0804B491 or ebx, eax
.text:0804B493 mov eax, [ebp+var_14]
.text:0804B496 sub eax, 10h
.text:0804B499 mov [esi+198h], eax
.text:0804B49F mov eax, ebx
.text:0804B4A1 and eax, 0F00h
.text:0804B4A6 cmp eax, 800h
.text:0804B4AB jnz loc_804BA89
.text:0804B4B1 mov eax, ebx
.text:0804B4B3 and eax, 0F000h
.text:0804B4B8 cmp eax, 7000h
.text:0804B4BD jg loc_804BA89
.text:0804B4C3 test bl, 20h
.text:0804B4C6 jnz loc_804BA89
.text:0804B4CC mov eax, ebx
.text:0804B4CE mov edx, 84210843h
.text:0804B4D3 imul edx
.text:0804B4D5 add edx, ebx
.text:0804B4D7 sar edx, 4
.text:0804B4DA mov eax, edx
.text:0804B4DC shl eax, 5
.text:0804B4DF sub eax, edx
.text:0804B4E1 cmp ebx, eax
.text:0804B4E3 jnz loc_804BA89
.text:0804B4E9
.text:0804B4E9 loc_804B4E9:
.text:0804B4E9 mov dword ptr [esi+14h], 1
.text:0804B4F0 jmp loc_804B402
.text:0804B4F5
.text:0804B4F5 loc_804B4F5:
.text:0804B4F5 cmp [ebp+var_14], 2
.text:0804B4F9 jle loc_804B92D
.text:0804B4FF mov eax, [ebp+var_14]
.text:0804B502 sub eax, 1
.text:0804B505 mov [esi+198h], eax
.text:0804B50B mov eax, [esi+194h]
.text:0804B511 sub dword ptr [esi+198h], 2
.text:0804B518 shr eax, 1
.text:0804B51A mov [esi+194h], eax
.text:0804B520 shr dword ptr [esi+194h], 2
.text:0804B527 and eax, 3
.text:0804B52A jnz loc_804B98B
.text:0804B530 mov ecx, [esi+198h]
.text:0804B536 mov dword ptr [esi+14h], 0Ah
.text:0804B53D and ecx, 7
.text:0804B540 sub [esi+198h], ecx
.text:0804B546 shr dword ptr [esi+194h], cl
.text:0804B54C jmp loc_804B402
.text:0804B551
.text:0804B551 loc_804B551:
.text:0804B551 cmp [ebp+var_14], 0Dh
.text:0804B555 jle loc_804B92D
.text:0804B55B mov eax, [esi+194h]
.text:0804B561 mov edx, [esi+194h]
.text:0804B567 sub dword ptr [esi+198h], 5
.text:0804B56E sub dword ptr [esi+198h], 5
.text:0804B575 and eax, 1Fh
.text:0804B578 add eax, 101h
.text:0804B57D shr edx, 5
.text:0804B580 mov [esi+1Ch], eax
.text:0804B583 mov eax, edx
.text:0804B585 shr edx, 5
.text:0804B588 and eax, 1Fh
.text:0804B58B mov [esi+194h], edx
.text:0804B591 and edx, 0Fh
.text:0804B594 add eax, 1
.text:0804B597 sub dword ptr [esi+198h], 4
.text:0804B59E shr dword ptr [esi+194h], 4
.text:0804B5A5 lea ebx, [edx+4]
.text:0804B5A8 mov [esi+20h], eax
.text:0804B5AB mov [esi+24h], ebx
.text:0804B5AE mov dword ptr [esi+28h], 0
.text:0804B5B5 mov dword ptr [esi+14h], 3
.text:0804B5BC mov dword ptr [esi+40h], 0
.text:0804B5C3 mov dword ptr [esi+44h], 0
.text:0804B5CA mov dword ptr [esi+48h], 0
.text:0804B5D1 mov dword ptr [esi+4Ch], 0
.text:0804B5D8 mov word ptr [esi+50h], 0
.text:0804B5DE mov byte ptr [esi+52h], 0
.text:0804B5E2 jmp loc_804B402
.text:0804B5E7
.text:0804B5E7 loc_804B5E7:
.text:0804B5E7 mov edx, [esi+1Ch]
.text:0804B5EA mov eax, edx
.text:0804B5EC add eax, [esi+20h]
.text:0804B5EF cmp [esi+28h], eax
.text:0804B5F2 jl loc_804B950
.text:0804B5F8 lea ebx, [esi+53h]
.text:0804B5FB mov eax, ebx
.text:0804B5FD call zlib_mktable
.text:0804B602 mov edx, [esi+20h]
.text:0804B605 add ebx, [esi+1Ch]
.text:0804B608 mov [esi+8], eax
.text:0804B60B mov eax, ebx
.text:0804B60D call zlib_mktable
.text:0804B612 mov [esi+0Ch], eax
.text:0804B615 lea eax, [esi+10h]
.text:0804B618 call zlib_freetable
.text:0804B61D mov dword ptr [esi+10h], 0
.text:0804B624 mov dword ptr [esi+14h], 6
.text:0804B62B jmp loc_804B402
.text:0804B630
.text:0804B630 loc_804B630:
.text:0804B630 mov edx, [esi+2Ch]
.text:0804B633 cmp edx, [ebp+var_14]
.text:0804B636 jg loc_804B92D
.text:0804B63C mov ecx, edx
.text:0804B63E mov eax, 1
.text:0804B643 shl eax, cl
.text:0804B645 sub [ebp+var_14], edx
.text:0804B648 lea ebx, [eax-1]
.text:0804B64B mov eax, [ebp+var_14]
.text:0804B64E and ebx, [esi+194h]
.text:0804B654 add ebx, [esi+30h]
.text:0804B657 shr dword ptr [esi+194h], cl
.text:0804B65D test ebx, ebx
.text:0804B65F mov [esi+198h], eax
.text:0804B665 jle short loc_804B69D
.text:0804B667 mov eax, [esi+1Ch]
.text:0804B66A mov edx, [esi+28h]
.text:0804B66D mov [ebp+var_10], eax
.text:0804B670 add eax, [esi+20h]
.text:0804B673 mov ecx, edx
.text:0804B675 cmp edx, eax
.text:0804B677 jge short loc_804B69D
.text:0804B679 mov edi, [esi+38h]
.text:0804B67C jmp short loc_804B68C
.text:0804B680
.text:0804B680 loc_804B680:
.text:0804B680 mov eax, [ebp+var_10]
.text:0804B683 add eax, [esi+20h]
.text:0804B686 cmp eax, edx
.text:0804B688 jle short loc_804B69D
.text:0804B68A mov ecx, edx
.text:0804B68C
.text:0804B68C loc_804B68C:
.text:0804B68C mov eax, edi
.text:0804B68E sub ebx, 1
.text:0804B691 mov [edx+esi+53h], al
.text:0804B695 lea edx, [ecx+1]
.text:0804B698 mov [esi+28h], edx
.text:0804B69B jnz short loc_804B680
.text:0804B69D
.text:0804B69D loc_804B69D:
.text:0804B69D mov dword ptr [esi+14h], 4
.text:0804B6A4 jmp loc_804B402
.text:0804B6A9
.text:0804B6A9 loc_804B6A9:
.text:0804B6A9 cmp [ebp+var_14], 2
.text:0804B6AD jle loc_804B92D
.text:0804B6B3 mov ecx, [esi+28h]
.text:0804B6B6 mov ebx, [esi+24h]
.text:0804B6B9 cmp ecx, ebx
.text:0804B6BB jl short loc_804B6F1
.text:0804B6BD lea esi, [esi+0]
.text:0804B6C0 jmp short loc_804B6FA
.text:0804B6C2
.text:0804B6C2 loc_804B6C2:
.text:0804B6C2 movzx edx, byte ptr [esi+194h]
.text:0804B6C9 movzx eax, ds:lenlenmap_6439[ecx]
.text:0804B6D0 sub dword ptr [esi+198h], 3
.text:0804B6D7 shr dword ptr [esi+194h], 3
.text:0804B6DE and edx, 7
.text:0804B6E1 mov [eax+esi+40h], dl
.text:0804B6E5 lea eax, [ecx+1]
.text:0804B6E8 cmp eax, ebx
.text:0804B6EA mov ecx, eax
.text:0804B6EC mov [esi+28h], eax
.text:0804B6EF jge short loc_804B6FA
.text:0804B6F1
.text:0804B6F1 loc_804B6F1:
.text:0804B6F1 cmp dword ptr [esi+198h], 2
.text:0804B6F8 jg short loc_804B6C2
.text:0804B6FA
.text:0804B6FA loc_804B6FA:
.text:0804B6FA cmp ecx, ebx
.text:0804B6FC jnz loc_804B402
.text:0804B702 lea eax, [esi+40h]
.text:0804B705 mov edx, 13h
.text:0804B70A call zlib_mktable
.text:0804B70F mov dword ptr [esi+14h], 4
.text:0804B716 mov dword ptr [esi+28h], 0
.text:0804B71D mov [esi+10h], eax
.text:0804B720 jmp loc_804B402
.text:0804B725
.text:0804B725 loc_804B725:
.text:0804B725 mov ecx, [esi+8]
.text:0804B728 lea edx, [esi+198h]
.text:0804B72E lea eax, [esi+194h]
.text:0804B734 call zlib_huflookup
.text:0804B739 cmp eax, 0FFFFFFFFh
.text:0804B73C jz loc_804B92D
.text:0804B742 cmp eax, 0FFFFFFFEh
.text:0804B745 jz loc_804BA89
.text:0804B74B cmp eax, 0FFh
.text:0804B750 jle loc_804B9A9
.text:0804B756 cmp eax, 100h
.text:0804B75B nop
.text:0804B75C lea esi, [esi+0]
.text:0804B760 jz loc_804B9F1
.text:0804B766 cmp eax, 11Dh
.text:0804B76B nop
.text:0804B76C lea esi, [esi+0]
.text:0804B770 jg loc_804B402
.text:0804B776 mov dword ptr [esi+14h], 7
.text:0804B77D mov [esi+18h], eax
.text:0804B780 jmp loc_804B402
.text:0804B785
.text:0804B785 loc_804B785:
.text:0804B785 cmp [ebp+var_14], 0Fh
.text:0804B789 jle loc_804B92D
.text:0804B78F movzx eax, word ptr [esi+194h]
.text:0804B796 sub dword ptr [esi+198h], 10h
.text:0804B79D shr dword ptr [esi+194h], 10h
.text:0804B7A4 mov [esi+3Ch], eax
.text:0804B7A7 mov dword ptr [esi+14h], 0Bh
.text:0804B7AE jmp loc_804B402
.text:0804B7B3
.text:0804B7B3 loc_804B7B3:
.text:0804B7B3 cmp [ebp+var_14], 0Fh
.text:0804B7B7 jle loc_804B92D
.text:0804B7BD mov eax, [ebp+var_14]
.text:0804B7C0 movzx edx, word ptr [esi+194h]
.text:0804B7C7 shr dword ptr [esi+194h], 10h
.text:0804B7CE sub eax, 10h
.text:0804B7D1 mov [esi+198h], eax
.text:0804B7D7 mov eax, [esi+3Ch]
.text:0804B7DA xor edx, 0FFFFh
.text:0804B7E0 cmp eax, edx
.text:0804B7E2 jnz loc_804BA89
.text:0804B7E8 cmp eax, 1
.text:0804B7EB sbb eax, eax
.text:0804B7ED and eax, 0FFFFFFF5h
.text:0804B7F0 add eax, 0Ch
.text:0804B7F3 mov [esi+14h], eax
.text:0804B7F6 jmp loc_804B402
.text:0804B7FB
.text:0804B7FB loc_804B7FB:
.text:0804B7FB mov ecx, [esi+0Ch]
.text:0804B7FE lea edx, [esi+198h]
.text:0804B804 lea eax, [esi+194h]
.text:0804B80A call zlib_huflookup
.text:0804B80F cmp eax, 0FFFFFFFFh
.text:0804B812 jz loc_804B92D
.text:0804B818 cmp eax, 0FFFFFFFEh
.text:0804B81B jz loc_804BA89
.text:0804B821 mov dword ptr [esi+14h], 9
.text:0804B828 mov [esi+18h], eax
.text:0804B82B jmp loc_804B402
.text:0804B830
.text:0804B830 loc_804B830:
.text:0804B830 mov eax, [esi+18h]
.text:0804B833 lea eax, [eax+eax*2]
.text:0804B836 lea edi, ds:80B35A0h[eax*4]
.text:0804B83D movsx edx, word ptr [edi+2]
.text:0804B841 cmp edx, [ebp+var_14]
.text:0804B844 jg loc_804B92D
.text:0804B84A mov ecx, edx
.text:0804B84C mov eax, 1
.text:0804B851 shl eax, cl
.text:0804B853 sub [ebp+var_14], edx
.text:0804B856 lea ebx, [eax-1]
.text:0804B859 mov eax, [ebp+var_14]
.text:0804B85C and ebx, [esi+194h]
.text:0804B862 shr dword ptr [esi+194h], cl
.text:0804B868 add ebx, [edi+4]
.text:0804B86B mov dword ptr [esi+14h], 6
.text:0804B872 mov [esi+198h], eax
.text:0804B878 jmp short loc_804B89C
.text:0804B880 loc_804B880:
.text:0804B880 mov eax, [esi+819Ch]
.text:0804B886 sub eax, ebx
.text:0804B888 and eax, 7FFFh
.text:0804B88D movzx edx, byte ptr [eax+esi+19Ch]
.text:0804B895 mov eax, esi
.text:0804B897 call zlib_emit_char
.text:0804B89C
.text:0804B89C loc_804B89C:
.text:0804B89C mov eax, [esi+34h]
.text:0804B89F sub eax, 1
.text:0804B8A2 mov [esi+34h], eax
.text:0804B8A5 add eax, 1
.text:0804B8A8 jnz short loc_804B880
.text:0804B8AA jmp loc_804B402
.text:0804B8AF loc_804B8AF:
.text:0804B8AF mov eax, [esi+18h]
.text:0804B8B2 lea eax, [eax+eax*2]
.text:0804B8B5 lea ebx, ds:80B2834h[eax*4]
.text:0804B8BC movsx edx, word ptr [ebx+2]
.text:0804B8C0 cmp edx, [ebp+var_14]
.text:0804B8C3 jg short loc_804B92D
.text:0804B8C5 mov ecx, edx
.text:0804B8C7 mov eax, 1
.text:0804B8CC shl eax, cl
.text:0804B8CE sub eax, 1
.text:0804B8D1 and eax, [esi+194h]
.text:0804B8D7 shr dword ptr [esi+194h], cl
.text:0804B8DD add eax, [ebx+4]
.text:0804B8E0 sub [esi+198h], edx
.text:0804B8E6 mov [esi+34h], eax
.text:0804B8E9 mov dword ptr [esi+14h], 8
.text:0804B8F0 jmp loc_804B402
.text:0804B8F5 loc_804B8F5:
.text:0804B8F5 cmp [ebp+var_14], 7
.text:0804B8F9 jle short loc_804B92D
.text:0804B8FB movzx edx, byte ptr [esi+194h]
.text:0804B902 mov eax, esi
.text:0804B904 call zlib_emit_char
.text:0804B909 mov eax, [esi+3Ch]
.text:0804B90C sub dword ptr [esi+198h], 8
.text:0804B913 shr dword ptr [esi+194h], 8
.text:0804B91A sub eax, 1
.text:0804B91D test eax, eax
.text:0804B91F mov [esi+3Ch], eax
.text:0804B922 jnz loc_804B402
.text:0804B928 jmp loc_804B4E9
.text:0804B92D
.text:0804B92D loc_804B92D:
.text:0804B92D mov eax, [esi+81A0h]
.text:0804B933 mov ebx, [ebp+arg_C]
.text:0804B936 mov edx, [ebp+arg_10]
.text:0804B939 mov [ebx], eax
.text:0804B93B mov eax, [esi+81A4h]
.text:0804B941 mov [edx], eax
.text:0804B943 add esp, 0Ch
.text:0804B946 mov eax, 1
.text:0804B94B pop ebx
.text:0804B94C pop esi
.text:0804B94D pop edi
.text:0804B94E pop ebp
.text:0804B94F retn
.text:0804B950 loc_804B950:
.text:0804B950 mov ecx, [esi+10h]
.text:0804B953 lea edx, [esi+198h]
.text:0804B959 lea eax, [esi+194h]
.text:0804B95F call zlib_huflookup
.text:0804B964 cmp eax, 0FFFFFFFFh
.text:0804B967 mov edx, eax
.text:0804B969 jz short loc_804B92D
.text:0804B96B cmp eax, 0FFFFFFFEh
.text:0804B96E jz loc_804BA89
.text:0804B974 cmp eax, 0Fh
.text:0804B977 jg short loc_804B9B7
.text:0804B979 mov eax, [esi+28h]
.text:0804B97C mov [eax+esi+53h], dl
.text:0804B980 add eax, 1
.text:0804B983 mov [esi+28h], eax
.text:0804B986 jmp loc_804B402
.text:0804B98B loc_804B98B:
.text:0804B98B cmp eax, 1
.text:0804B98E jz loc_804BA2E
.text:0804B994 cmp eax, 2
.text:0804B997 jnz loc_804B402
.text:0804B99D mov dword ptr [esi+14h], 2
.text:0804B9A4 jmp loc_804B402
.text:0804B9A9 loc_804B9A9:
.text:0804B9A9 mov edx, eax
.text:0804B9AB mov eax, esi
.text:0804B9AD call zlib_emit_char
.text:0804B9B2 jmp loc_804B402
.text:0804B9B7 loc_804B9B7:
.text:0804B9B7 cmp eax, 10h
.text:0804B9BA jz loc_804BA45
.text:0804B9C0 cmp eax, 11h
.text:0804B9C3 jz loc_804BA66
.text:0804B9C9 cmp eax, 12h
.text:0804B9CC mov dword ptr [esi+2Ch], 7
.text:0804B9D3 jz loc_804BA7B
.text:0804B9D9 mov dword ptr [esi+30h], 3
.text:0804B9E0 xor eax, eax
.text:0804B9E2
.text:0804B9E2 loc_804B9E2:
.text:0804B9E2 mov [esi+38h], eax
.text:0804B9E5 mov dword ptr [esi+14h], 5
.text:0804B9EC jmp loc_804B402
.text:0804B9F1 loc_804B9F1:
.text:0804B9F1 mov eax, [esi+8]
.text:0804B9F4 cmp eax, [esi]
.text:0804B9F6 mov dword ptr [esi+14h], 1
.text:0804B9FD jz short loc_804BA0E
.text:0804B9FF lea eax, [esi+8]
.text:0804BA02 call zlib_freetable
.text:0804BA07 mov dword ptr [esi+8], 0
.text:0804BA0E
.text:0804BA0E loc_804BA0E:
.text:0804BA0E mov eax, [esi+0Ch]
.text:0804BA11 cmp eax, [esi+4]
.text:0804BA14 jz loc_804B402
.text:0804BA1A lea eax, [esi+0Ch]
.text:0804BA1D call zlib_freetable
.text:0804BA22 mov dword ptr [esi+0Ch], 0
.text:0804BA29 jmp loc_804B402
.text:0804BA2E
.text:0804BA2E loc_804BA2E:
.text:0804BA2E mov eax, [esi]
.text:0804BA30 mov dword ptr [esi+14h], 6
.text:0804BA37 mov [esi+8], eax
.text:0804BA3A mov eax, [esi+4]
.text:0804BA3D mov [esi+0Ch], eax
.text:0804BA40 jmp loc_804B402
.text:0804BA45
.text:0804BA45 loc_804BA45:
.text:0804BA45 mov edx, [esi+28h]
.text:0804BA48 xor eax, eax
.text:0804BA4A mov dword ptr [esi+2Ch], 2
.text:0804BA51 mov dword ptr [esi+30h], 3
.text:0804BA58 test edx, edx
.text:0804BA5A jle short loc_804B9E2
.text:0804BA5C movzx eax, byte ptr [edx+esi+52h]
.text:0804BA61 jmp loc_804B9E2
.text:0804BA66
.text:0804BA66 loc_804BA66:
.text:0804BA66 xor eax, eax
.text:0804BA68 mov dword ptr [esi+2Ch], 3
.text:0804BA6F mov dword ptr [esi+30h], 3
.text:0804BA76 jmp loc_804B9E2
.text:0804BA7B
.text:0804BA7B loc_804BA7B:
.text:0804BA7B xor eax, eax
.text:0804BA7D mov dword ptr [esi+30h], 0Bh
.text:0804BA84 jmp loc_804B9E2
.text:0804BA89
.text:0804BA89 loc_804BA89:
.text:0804BA89 mov eax, [esi+81A0h]
.text:0804BA8F mov [esp+18h+var_18], eax
.text:0804BA92 call free
.text:0804BA97 mov ebx, [ebp+arg_10]
.text:0804BA9A xor eax, eax
.text:0804BA9C mov ecx, [ebp+arg_C]
.text:0804BA9F mov dword ptr [esi+81A0h], 0
.text:0804BAA9 mov dword ptr [ebx], 0
.text:0804BAAF mov dword ptr [ecx], 0
.text:0804BAB5 add esp, 0Ch
.text:0804BAB8 pop ebx
.text:0804BAB9 pop esi
.text:0804BABA pop edi
.text:0804BABB pop ebp
.text:0804BABC retn
.text:0804BABC zlib_decompress_block endp
:: Finally...
;; cleaning up mess after decompressing...
.text:0804B2B0 public zlib_decompress_cleanup
.text:0804B2B0 zlib_decompress_cleanup proc near
.text:0804B2B0
.text:0804B2B0 arg_0 = dword ptr 8
.text:0804B2B0
.text:0804B2B0 push ebp
.text:0804B2B1 mov ebp, esp
.text:0804B2B3 push ebx
.text:0804B2B4 sub esp, 4
.text:0804B2B7 mov ebx, [ebp+arg_0]
.text:0804B2BA mov eax, [ebx+8]
.text:0804B2BD test eax, eax
.text:0804B2BF jz short loc_804B2CD
.text:0804B2C1 cmp eax, [ebx]
.text:0804B2C3 jz short loc_804B2CD
.text:0804B2C5 lea eax, [ebx+8]
.text:0804B2C8 call zlib_freetable
.text:0804B2CD loc_804B2CD:
.text:0804B2CD mov eax, [ebx+0Ch]
.text:0804B2D0 test eax, eax
.text:0804B2D2 jz short loc_804B2E1
.text:0804B2D4 cmp eax, [ebx+4]
.text:0804B2D7 jz short loc_804B2E1
.text:0804B2D9 lea eax, [ebx+0Ch]
.text:0804B2DC call zlib_freetable
.text:0804B2E1
.text:0804B2E1 loc_804B2E1:
.text:0804B2E1 mov eax, [ebx+10h]
.text:0804B2E4 test eax, eax
.text:0804B2E6 jz short loc_804B2F0
.text:0804B2E8 lea eax, [ebx+10h]
.text:0804B2EB call zlib_freetable
.text:0804B2F0
.text:0804B2F0 loc_804B2F0:
.text:0804B2F0 mov eax, ebx
.text:0804B2F2 call zlib_freetable
.text:0804B2F7 lea eax, [ebx+4]
.text:0804B2FA call zlib_freetable
.text:0804B2FF mov [ebp+arg_0], ebx
.text:0804B302 add esp, 4
.text:0804B305 pop ebx
.text:0804B306 pop ebp
.text:0804B307 jmp free
.text:0804B307 zlib_decompress_cleanup endp
;; #MalwareMustDie!!
Comments