;; Zlib Decompression Reversed | #MalwareMustDie - @unixfreaxjp /malware/Iptablex]$ date ;; Mon Jun 16 14:08:22 JST 2014 ;; Is really advised to take a deep breath before read this (delicious) spaghetti codes :-) ;;The decompress data trace. .text:0804DB64 jz short loc_804DBC5 .text:0804DB66 mov [esp+18h+var_10], 1E8h .text:0804DB6E mov [esp+18h+var_14], 0 .text:0804DB76 mov [esp+18h+var_18], offset g_mainsrvinfo .text:0804DB7D call memset .text:0804DB82 mov eax, [ebp+arg_0] .text:0804DB85 mov [esp+18h+var_18], eax .text:0804DB88 call DeCtlInfo .text:0804DB8D test eax, eax .text:0804DB8F mov dword ptr ds:g_mainsrvinfo+124h, eax .text:0804DB94 jnz short loc_804DBD1 ;; The control for decompressor: public DeCtlInfo DeCtlInfo proc near var_28= dword ptr -28h var_24= dword ptr -24h var_20= dword ptr -20h var_14= dword ptr -14h var_10= dword ptr -10h var_C= dword ptr -0Ch var_8= dword ptr -8 arg_0= dword ptr 8 push ebp mov ebp, esp push ebx sub esp, 24h mov eax, [ebp+arg_0] lea edx, [ebp+var_14] mov [ebp+var_14], eax mov eax, [eax+23Ch] mov [ebp+var_C], 0 mov [ebp+var_8], 0 mov [esp+28h+var_28], edx mov [ebp+var_10], eax lea eax, [ebp+var_C] mov [esp+28h+var_24], eax call Hb_DeCompress test eax, eax ;; main function for decompression handles... public Hb_DeCompress Hb_DeCompress proc near var_28= dword ptr -28h var_24= dword ptr -24h var_20= dword ptr -20h var_1C= dword ptr -1Ch var_18= dword ptr -18h var_C= dword ptr -0Ch var_8= dword ptr -8 var_4= dword ptr -4 arg_0= dword ptr 8 arg_4= dword ptr 0Ch push ebp mov ebp, esp sub esp, 28h mov [ebp+var_C], ebx mov [ebp+var_8], esi mov esi, 0FFFFFFFFh mov [ebp+var_4], edi mov edi, [ebp+arg_4] call zlib_decompress_init test eax, eax mov ebx, eax jz short loc_804BBA7 ;; Subroutine of zlib decompress initiation .text:0804B100 public zlib_decompress_init .text:0804B100 zlib_decompress_init proc near .text:0804B100 .text:0804B100 var_138 = dword ptr -138h .text:0804B100 var_134 = dword ptr -134h .text:0804B100 var_130 = dword ptr -130h .text:0804B100 var_128 = dword ptr -128h .text:0804B100 var_124 = dword ptr -124h .text:0804B100 var_120 = dword ptr -120h .text:0804B100 var_11C = dword ptr -11Ch .text:0804B100 var_118 = dword ptr -118h .text:0804B100 var_114 = dword ptr -114h .text:0804B100 var_110 = dword ptr -110h .text:0804B100 var_10C = dword ptr -10Ch .text:0804B100 var_98 = dword ptr -98h .text:0804B100 var_28 = dword ptr -28h .text:0804B100 var_24 = dword ptr -24h .text:0804B100 var_20 = dword ptr -20h .text:0804B100 var_1C = dword ptr -1Ch .text:0804B100 var_18 = dword ptr -18h .text:0804B100 var_14 = dword ptr -14h .text:0804B100 var_10 = dword ptr -10h .text:0804B100 var_C = dword ptr -0Ch .text:0804B100 .text:0804B100 push ebp .text:0804B101 mov ebp, esp .text:0804B103 push esi .text:0804B104 push ebx .text:0804B105 sub esp, 130h .text:0804B10B mov [esp+138h+var_138], 81ACh .text:0804B112 lea esi, [ebp+var_128] .text:0804B118 call malloc .text:0804B11D mov [esp+138h+var_138], esi .text:0804B120 mov [esp+138h+var_130], 90h .text:0804B128 mov [esp+138h+var_134], 8 .text:0804B130 mov ebx, eax .text:0804B132 call memset .text:0804B137 lea eax, [ebp+var_98] .text:0804B13D mov [esp+138h+var_130], 70h .text:0804B145 mov [esp+138h+var_134], 9 .text:0804B14D mov [esp+138h+var_138], eax .text:0804B150 call memset .text:0804B155 mov edx, 120h .text:0804B15A mov eax, esi .text:0804B15C mov [ebp+var_28], 7070707h .text:0804B163 mov [ebp+var_24], 7070707h .text:0804B16A mov [ebp+var_20], 7070707h .text:0804B171 mov [ebp+var_1C], 7070707h .text:0804B178 mov [ebp+var_18], 7070707h .text:0804B17F mov [ebp+var_14], 7070707h .text:0804B186 mov [ebp+var_10], (offset loc_8080806+2) .text:0804B18D mov [ebp+var_C], (offset loc_8080806+2) .text:0804B194 call zlib_mktable .text:0804B199 mov edx, 20h .text:0804B19E mov [ebp+var_128], 5050505h .text:0804B1A8 mov [ebp+var_124], 5050505h .text:0804B1B2 mov [ebp+var_120], 5050505h .text:0804B1BC mov [ebp+var_11C], 5050505h .text:0804B1C6 mov [ebp+var_118], 5050505h .text:0804B1D0 mov [ebx], eax .text:0804B1D2 mov eax, esi .text:0804B1D4 mov [ebp+var_114], 5050505h .text:0804B1DE mov [ebp+var_110], 5050505h .text:0804B1E8 mov [ebp+var_10C], 5050505h .text:0804B1F2 call zlib_mktable .text:0804B1F7 mov dword ptr [ebx+14h], 0 .text:0804B1FE mov dword ptr [ebx+10h], 0 .text:0804B205 mov dword ptr [ebx+0Ch], 0 .text:0804B20C mov dword ptr [ebx+8], 0 .text:0804B213 mov dword ptr [ebx+194h], 0 .text:0804B21D mov [ebx+4], eax .text:0804B220 mov eax, ebx .text:0804B222 mov dword ptr [ebx+198h], 0 .text:0804B22C mov dword ptr [ebx+819Ch], 0 .text:0804B236 add esp, 130h .text:0804B23C pop ebx .text:0804B23D pop esi .text:0804B23E pop ebp .text:0804B23F retn .text:0804B23F zlib_decompress_init endp .text:0804B23F ;; Table data creation for zlib decompression purpose... .text:0804AF10 zlib_mktable proc near .text:0804AF10 .text:0804AF10 var_528 = dword ptr -528h .text:0804AF10 var_524 = dword ptr -524h .text:0804AF10 var_520 = dword ptr -520h .text:0804AF10 var_518 = dword ptr -518h .text:0804AF10 var_514 = dword ptr -514h .text:0804AF10 var_510 = dword ptr -510h .text:0804AF10 var_50C = dword ptr -50Ch .text:0804AF10 var_8C = dword ptr -8Ch .text:0804AF10 var_4C = dword ptr -4Ch .text:0804AF10 .text:0804AF10 push ebp .text:0804AF11 mov ebp, esp .text:0804AF13 push edi .text:0804AF14 push esi .text:0804AF15 push ebx .text:0804AF16 sub esp, 51Ch .text:0804AF1C lea ebx, [ebp+var_4C] .text:0804AF1F mov [ebp+var_514], eax .text:0804AF25 xor eax, eax .text:0804AF27 mov [ebp+var_518], edx .text:0804AF2D lea esi, [esi+0] .text:0804AF30 .text:0804AF30 loc_804AF30: .text:0804AF30 mov dword ptr [ebx+eax*4+4], 0 .text:0804AF38 add eax, 1 .text:0804AF3B cmp eax, 0Fh .text:0804AF3E jnz short loc_804AF30 .text:0804AF40 mov eax, [ebp+var_518] .text:0804AF46 mov [ebp+var_510], 0 .text:0804AF50 test eax, eax .text:0804AF52 jle short loc_804AF7E .text:0804AF54 xor edx, edx .text:0804AF56 .text:0804AF56 loc_804AF56: .text:0804AF56 mov ecx, [ebp+var_514] .text:0804AF5C movzx eax, byte ptr [edx+ecx] .text:0804AF60 add [ebp+eax*4+var_4C], 1 .text:0804AF65 cmp [ebp+var_510], eax .text:0804AF6B jge short loc_804AF73 .text:0804AF6D mov [ebp+var_510], eax .text:0804AF73 .text:0804AF73 loc_804AF73: .text:0804AF73 add edx, 1 .text:0804AF76 cmp edx, [ebp+var_518] .text:0804AF7C jnz short loc_804AF56 .text:0804AF7E .text:0804AF7E loc_804AF7E: ; CODE XREF: zlib_mktable+42 .text:0804AF7E xor eax, eax .text:0804AF80 xor edx, edx .text:0804AF82 lea ecx, [ebp+var_8C] .text:0804AF88 .text:0804AF88 loc_804AF88: .text:0804AF88 mov [ecx+edx*4+4], eax .text:0804AF8C add eax, [ebx+edx*4+4] .text:0804AF90 add edx, 1 .text:0804AF93 add eax, eax .text:0804AF95 cmp edx, 0Fh .text:0804AF98 jnz short loc_804AF88 .text:0804AF9A mov eax, [ebp+var_518] .text:0804AFA0 test eax, eax .text:0804AFA2 jle short loc_804AFFA .text:0804AFA4 xor edi, edi .text:0804AFA6 .text:0804AFA6 loc_804AFA6: .text:0804AFA6 mov eax, [ebp+var_514] .text:0804AFAC movzx edx, byte ptr [edi+eax] .text:0804AFB0 mov [ebp+edi*4+var_50C], 0 .text:0804AFBB mov ecx, [ebp+edx*4+var_8C] .text:0804AFC2 test edx, edx .text:0804AFC4 lea eax, [ecx+1] .text:0804AFC7 mov [ebp+edx*4+var_8C], eax .text:0804AFCE jle short loc_804AFEF .text:0804AFD0 mov esi, edx .text:0804AFD2 xor ebx, ebx .text:0804AFD4 xor edx, edx .text:0804AFD6 .text:0804AFD6 loc_804AFD6: .text:0804AFD6 mov eax, ecx .text:0804AFD8 add edx, edx .text:0804AFDA and eax, 1 .text:0804AFDD add ebx, 1 .text:0804AFE0 or edx, eax .text:0804AFE2 sar ecx, 1 .text:0804AFE4 cmp esi, ebx .text:0804AFE6 jg short loc_804AFD6 .text:0804AFE8 mov [ebp+edi*4+var_50C], edx .text:0804AFEF .text:0804AFEF loc_804AFEF: .text:0804AFEF add edi, 1 .text:0804AFF2 cmp edi, [ebp+var_518] .text:0804AFF8 jnz short loc_804AFA6 .text:0804AFFA .text:0804AFFA loc_804AFFA: .text:0804AFFA mov eax, [ebp+var_510] .text:0804B000 cmp eax, 9 .text:0804B003 jle short loc_804B00A .text:0804B005 mov eax, 9 .text:0804B00A .text:0804B00A loc_804B00A: .text:0804B00A mov ecx, [ebp+var_518] .text:0804B010 mov edx, [ebp+var_514] .text:0804B016 mov [esp+528h+var_520], eax .text:0804B01A lea eax, [ebp+var_50C] .text:0804B020 mov [esp+528h+var_524], 0 .text:0804B028 mov [esp+528h+var_528], 0 .text:0804B02F call zlib_mkonetab .text:0804B034 add esp, 51Ch .text:0804B03A pop ebx .text:0804B03B pop esi .text:0804B03C pop edi .text:0804B03D pop ebp .text:0804B03E retn .text:0804B03E zlib_mktable endp .text:0804B03E // zlib decompression block...main cource..welcome to the spaghetti code.. .text:0804B3D0 public zlib_decompress_block .text:0804B3D0 zlib_decompress_block proc near .text:0804B3D0 .text:0804B3D0 var_18 = dword ptr -18h .text:0804B3D0 var_14 = dword ptr -14h .text:0804B3D0 var_10 = dword ptr -10h .text:0804B3D0 arg_0 = dword ptr 8 .text:0804B3D0 arg_4 = dword ptr 0Ch .text:0804B3D0 arg_8 = dword ptr 10h .text:0804B3D0 arg_C = dword ptr 14h .text:0804B3D0 arg_10 = dword ptr 18h .text:0804B3D0 .text:0804B3D0 push ebp .text:0804B3D1 mov ebp, esp .text:0804B3D3 push edi .text:0804B3D4 push esi .text:0804B3D5 push ebx .text:0804B3D6 sub esp, 0Ch .text:0804B3D9 mov esi, [ebp+arg_0] .text:0804B3DC mov [esp+18h+var_18], 100h .text:0804B3E3 call malloc .text:0804B3E8 mov dword ptr [esi+81A8h], 100h .text:0804B3F2 mov dword ptr [esi+81A4h], 0 .text:0804B3FC mov [esi+81A0h], eax .text:0804B402 .text:0804B402 loc_804B402: .text:0804B402 mov eax, [ebp+arg_8] .text:0804B405 test eax, eax .text:0804B407 jle short loc_804B450 .text:0804B409 mov edx, [esi+198h] .text:0804B40F cmp edx, 17h .text:0804B412 mov [ebp+var_14], edx .text:0804B415 jg short loc_804B461 .text:0804B417 .text:0804B417 loc_804B417: .text:0804B417 mov ecx, [ebp+arg_4] .text:0804B41A add edx, 8 .text:0804B41D movzx eax, byte ptr [ecx] .text:0804B420 movzx ecx, byte ptr [ebp+var_14] .text:0804B424 add [ebp+arg_4], 1 .text:0804B428 mov [esi+198h], edx .text:0804B42E shl eax, cl .text:0804B430 sub [ebp+arg_8], 1 .text:0804B434 or [esi+194h], eax .text:0804B43A cmp edx, 17h .text:0804B43D mov [ebp+var_14], edx .text:0804B440 jg short loc_804B461 .text:0804B442 mov eax, [ebp+arg_8] .text:0804B445 test eax, eax .text:0804B447 jle short loc_804B461 .text:0804B449 mov edx, [ebp+var_14] .text:0804B44C jmp short loc_804B417 .text:0804B450 .text:0804B450 loc_804B450: .text:0804B450 mov ecx, [esi+198h] .text:0804B456 test ecx, ecx .text:0804B458 mov [ebp+var_14], ecx .text:0804B45B jle loc_804B92D .text:0804B461 .text:0804B461 loc_804B461: .text:0804B461 cmp dword ptr [esi+14h], 0Ch .text:0804B465 ja short loc_804B402 .text:0804B467 mov eax, [esi+14h] .text:0804B46A jmp ds:off_80B3400[eax*4] .text:0804B471 .text:0804B471 loc_804B471: .text:0804B471 cmp [ebp+var_14], 0Fh .text:0804B475 jle loc_804B92D .text:0804B47B mov eax, [esi+194h] .text:0804B481 shr dword ptr [esi+194h], 10h .text:0804B488 movzx ebx, al .text:0804B48B movzx eax, ah .text:0804B48E shl ebx, 8 .text:0804B491 or ebx, eax .text:0804B493 mov eax, [ebp+var_14] .text:0804B496 sub eax, 10h .text:0804B499 mov [esi+198h], eax .text:0804B49F mov eax, ebx .text:0804B4A1 and eax, 0F00h .text:0804B4A6 cmp eax, 800h .text:0804B4AB jnz loc_804BA89 .text:0804B4B1 mov eax, ebx .text:0804B4B3 and eax, 0F000h .text:0804B4B8 cmp eax, 7000h .text:0804B4BD jg loc_804BA89 .text:0804B4C3 test bl, 20h .text:0804B4C6 jnz loc_804BA89 .text:0804B4CC mov eax, ebx .text:0804B4CE mov edx, 84210843h .text:0804B4D3 imul edx .text:0804B4D5 add edx, ebx .text:0804B4D7 sar edx, 4 .text:0804B4DA mov eax, edx .text:0804B4DC shl eax, 5 .text:0804B4DF sub eax, edx .text:0804B4E1 cmp ebx, eax .text:0804B4E3 jnz loc_804BA89 .text:0804B4E9 .text:0804B4E9 loc_804B4E9: .text:0804B4E9 mov dword ptr [esi+14h], 1 .text:0804B4F0 jmp loc_804B402 .text:0804B4F5 .text:0804B4F5 loc_804B4F5: .text:0804B4F5 cmp [ebp+var_14], 2 .text:0804B4F9 jle loc_804B92D .text:0804B4FF mov eax, [ebp+var_14] .text:0804B502 sub eax, 1 .text:0804B505 mov [esi+198h], eax .text:0804B50B mov eax, [esi+194h] .text:0804B511 sub dword ptr [esi+198h], 2 .text:0804B518 shr eax, 1 .text:0804B51A mov [esi+194h], eax .text:0804B520 shr dword ptr [esi+194h], 2 .text:0804B527 and eax, 3 .text:0804B52A jnz loc_804B98B .text:0804B530 mov ecx, [esi+198h] .text:0804B536 mov dword ptr [esi+14h], 0Ah .text:0804B53D and ecx, 7 .text:0804B540 sub [esi+198h], ecx .text:0804B546 shr dword ptr [esi+194h], cl .text:0804B54C jmp loc_804B402 .text:0804B551 .text:0804B551 loc_804B551: .text:0804B551 cmp [ebp+var_14], 0Dh .text:0804B555 jle loc_804B92D .text:0804B55B mov eax, [esi+194h] .text:0804B561 mov edx, [esi+194h] .text:0804B567 sub dword ptr [esi+198h], 5 .text:0804B56E sub dword ptr [esi+198h], 5 .text:0804B575 and eax, 1Fh .text:0804B578 add eax, 101h .text:0804B57D shr edx, 5 .text:0804B580 mov [esi+1Ch], eax .text:0804B583 mov eax, edx .text:0804B585 shr edx, 5 .text:0804B588 and eax, 1Fh .text:0804B58B mov [esi+194h], edx .text:0804B591 and edx, 0Fh .text:0804B594 add eax, 1 .text:0804B597 sub dword ptr [esi+198h], 4 .text:0804B59E shr dword ptr [esi+194h], 4 .text:0804B5A5 lea ebx, [edx+4] .text:0804B5A8 mov [esi+20h], eax .text:0804B5AB mov [esi+24h], ebx .text:0804B5AE mov dword ptr [esi+28h], 0 .text:0804B5B5 mov dword ptr [esi+14h], 3 .text:0804B5BC mov dword ptr [esi+40h], 0 .text:0804B5C3 mov dword ptr [esi+44h], 0 .text:0804B5CA mov dword ptr [esi+48h], 0 .text:0804B5D1 mov dword ptr [esi+4Ch], 0 .text:0804B5D8 mov word ptr [esi+50h], 0 .text:0804B5DE mov byte ptr [esi+52h], 0 .text:0804B5E2 jmp loc_804B402 .text:0804B5E7 .text:0804B5E7 loc_804B5E7: .text:0804B5E7 mov edx, [esi+1Ch] .text:0804B5EA mov eax, edx .text:0804B5EC add eax, [esi+20h] .text:0804B5EF cmp [esi+28h], eax .text:0804B5F2 jl loc_804B950 .text:0804B5F8 lea ebx, [esi+53h] .text:0804B5FB mov eax, ebx .text:0804B5FD call zlib_mktable .text:0804B602 mov edx, [esi+20h] .text:0804B605 add ebx, [esi+1Ch] .text:0804B608 mov [esi+8], eax .text:0804B60B mov eax, ebx .text:0804B60D call zlib_mktable .text:0804B612 mov [esi+0Ch], eax .text:0804B615 lea eax, [esi+10h] .text:0804B618 call zlib_freetable .text:0804B61D mov dword ptr [esi+10h], 0 .text:0804B624 mov dword ptr [esi+14h], 6 .text:0804B62B jmp loc_804B402 .text:0804B630 .text:0804B630 loc_804B630: .text:0804B630 mov edx, [esi+2Ch] .text:0804B633 cmp edx, [ebp+var_14] .text:0804B636 jg loc_804B92D .text:0804B63C mov ecx, edx .text:0804B63E mov eax, 1 .text:0804B643 shl eax, cl .text:0804B645 sub [ebp+var_14], edx .text:0804B648 lea ebx, [eax-1] .text:0804B64B mov eax, [ebp+var_14] .text:0804B64E and ebx, [esi+194h] .text:0804B654 add ebx, [esi+30h] .text:0804B657 shr dword ptr [esi+194h], cl .text:0804B65D test ebx, ebx .text:0804B65F mov [esi+198h], eax .text:0804B665 jle short loc_804B69D .text:0804B667 mov eax, [esi+1Ch] .text:0804B66A mov edx, [esi+28h] .text:0804B66D mov [ebp+var_10], eax .text:0804B670 add eax, [esi+20h] .text:0804B673 mov ecx, edx .text:0804B675 cmp edx, eax .text:0804B677 jge short loc_804B69D .text:0804B679 mov edi, [esi+38h] .text:0804B67C jmp short loc_804B68C .text:0804B680 .text:0804B680 loc_804B680: .text:0804B680 mov eax, [ebp+var_10] .text:0804B683 add eax, [esi+20h] .text:0804B686 cmp eax, edx .text:0804B688 jle short loc_804B69D .text:0804B68A mov ecx, edx .text:0804B68C .text:0804B68C loc_804B68C: .text:0804B68C mov eax, edi .text:0804B68E sub ebx, 1 .text:0804B691 mov [edx+esi+53h], al .text:0804B695 lea edx, [ecx+1] .text:0804B698 mov [esi+28h], edx .text:0804B69B jnz short loc_804B680 .text:0804B69D .text:0804B69D loc_804B69D: .text:0804B69D mov dword ptr [esi+14h], 4 .text:0804B6A4 jmp loc_804B402 .text:0804B6A9 .text:0804B6A9 loc_804B6A9: .text:0804B6A9 cmp [ebp+var_14], 2 .text:0804B6AD jle loc_804B92D .text:0804B6B3 mov ecx, [esi+28h] .text:0804B6B6 mov ebx, [esi+24h] .text:0804B6B9 cmp ecx, ebx .text:0804B6BB jl short loc_804B6F1 .text:0804B6BD lea esi, [esi+0] .text:0804B6C0 jmp short loc_804B6FA .text:0804B6C2 .text:0804B6C2 loc_804B6C2: .text:0804B6C2 movzx edx, byte ptr [esi+194h] .text:0804B6C9 movzx eax, ds:lenlenmap_6439[ecx] .text:0804B6D0 sub dword ptr [esi+198h], 3 .text:0804B6D7 shr dword ptr [esi+194h], 3 .text:0804B6DE and edx, 7 .text:0804B6E1 mov [eax+esi+40h], dl .text:0804B6E5 lea eax, [ecx+1] .text:0804B6E8 cmp eax, ebx .text:0804B6EA mov ecx, eax .text:0804B6EC mov [esi+28h], eax .text:0804B6EF jge short loc_804B6FA .text:0804B6F1 .text:0804B6F1 loc_804B6F1: .text:0804B6F1 cmp dword ptr [esi+198h], 2 .text:0804B6F8 jg short loc_804B6C2 .text:0804B6FA .text:0804B6FA loc_804B6FA: .text:0804B6FA cmp ecx, ebx .text:0804B6FC jnz loc_804B402 .text:0804B702 lea eax, [esi+40h] .text:0804B705 mov edx, 13h .text:0804B70A call zlib_mktable .text:0804B70F mov dword ptr [esi+14h], 4 .text:0804B716 mov dword ptr [esi+28h], 0 .text:0804B71D mov [esi+10h], eax .text:0804B720 jmp loc_804B402 .text:0804B725 .text:0804B725 loc_804B725: .text:0804B725 mov ecx, [esi+8] .text:0804B728 lea edx, [esi+198h] .text:0804B72E lea eax, [esi+194h] .text:0804B734 call zlib_huflookup .text:0804B739 cmp eax, 0FFFFFFFFh .text:0804B73C jz loc_804B92D .text:0804B742 cmp eax, 0FFFFFFFEh .text:0804B745 jz loc_804BA89 .text:0804B74B cmp eax, 0FFh .text:0804B750 jle loc_804B9A9 .text:0804B756 cmp eax, 100h .text:0804B75B nop .text:0804B75C lea esi, [esi+0] .text:0804B760 jz loc_804B9F1 .text:0804B766 cmp eax, 11Dh .text:0804B76B nop .text:0804B76C lea esi, [esi+0] .text:0804B770 jg loc_804B402 .text:0804B776 mov dword ptr [esi+14h], 7 .text:0804B77D mov [esi+18h], eax .text:0804B780 jmp loc_804B402 .text:0804B785 .text:0804B785 loc_804B785: .text:0804B785 cmp [ebp+var_14], 0Fh .text:0804B789 jle loc_804B92D .text:0804B78F movzx eax, word ptr [esi+194h] .text:0804B796 sub dword ptr [esi+198h], 10h .text:0804B79D shr dword ptr [esi+194h], 10h .text:0804B7A4 mov [esi+3Ch], eax .text:0804B7A7 mov dword ptr [esi+14h], 0Bh .text:0804B7AE jmp loc_804B402 .text:0804B7B3 .text:0804B7B3 loc_804B7B3: .text:0804B7B3 cmp [ebp+var_14], 0Fh .text:0804B7B7 jle loc_804B92D .text:0804B7BD mov eax, [ebp+var_14] .text:0804B7C0 movzx edx, word ptr [esi+194h] .text:0804B7C7 shr dword ptr [esi+194h], 10h .text:0804B7CE sub eax, 10h .text:0804B7D1 mov [esi+198h], eax .text:0804B7D7 mov eax, [esi+3Ch] .text:0804B7DA xor edx, 0FFFFh .text:0804B7E0 cmp eax, edx .text:0804B7E2 jnz loc_804BA89 .text:0804B7E8 cmp eax, 1 .text:0804B7EB sbb eax, eax .text:0804B7ED and eax, 0FFFFFFF5h .text:0804B7F0 add eax, 0Ch .text:0804B7F3 mov [esi+14h], eax .text:0804B7F6 jmp loc_804B402 .text:0804B7FB .text:0804B7FB loc_804B7FB: .text:0804B7FB mov ecx, [esi+0Ch] .text:0804B7FE lea edx, [esi+198h] .text:0804B804 lea eax, [esi+194h] .text:0804B80A call zlib_huflookup .text:0804B80F cmp eax, 0FFFFFFFFh .text:0804B812 jz loc_804B92D .text:0804B818 cmp eax, 0FFFFFFFEh .text:0804B81B jz loc_804BA89 .text:0804B821 mov dword ptr [esi+14h], 9 .text:0804B828 mov [esi+18h], eax .text:0804B82B jmp loc_804B402 .text:0804B830 .text:0804B830 loc_804B830: .text:0804B830 mov eax, [esi+18h] .text:0804B833 lea eax, [eax+eax*2] .text:0804B836 lea edi, ds:80B35A0h[eax*4] .text:0804B83D movsx edx, word ptr [edi+2] .text:0804B841 cmp edx, [ebp+var_14] .text:0804B844 jg loc_804B92D .text:0804B84A mov ecx, edx .text:0804B84C mov eax, 1 .text:0804B851 shl eax, cl .text:0804B853 sub [ebp+var_14], edx .text:0804B856 lea ebx, [eax-1] .text:0804B859 mov eax, [ebp+var_14] .text:0804B85C and ebx, [esi+194h] .text:0804B862 shr dword ptr [esi+194h], cl .text:0804B868 add ebx, [edi+4] .text:0804B86B mov dword ptr [esi+14h], 6 .text:0804B872 mov [esi+198h], eax .text:0804B878 jmp short loc_804B89C .text:0804B880 loc_804B880: .text:0804B880 mov eax, [esi+819Ch] .text:0804B886 sub eax, ebx .text:0804B888 and eax, 7FFFh .text:0804B88D movzx edx, byte ptr [eax+esi+19Ch] .text:0804B895 mov eax, esi .text:0804B897 call zlib_emit_char .text:0804B89C .text:0804B89C loc_804B89C: .text:0804B89C mov eax, [esi+34h] .text:0804B89F sub eax, 1 .text:0804B8A2 mov [esi+34h], eax .text:0804B8A5 add eax, 1 .text:0804B8A8 jnz short loc_804B880 .text:0804B8AA jmp loc_804B402 .text:0804B8AF loc_804B8AF: .text:0804B8AF mov eax, [esi+18h] .text:0804B8B2 lea eax, [eax+eax*2] .text:0804B8B5 lea ebx, ds:80B2834h[eax*4] .text:0804B8BC movsx edx, word ptr [ebx+2] .text:0804B8C0 cmp edx, [ebp+var_14] .text:0804B8C3 jg short loc_804B92D .text:0804B8C5 mov ecx, edx .text:0804B8C7 mov eax, 1 .text:0804B8CC shl eax, cl .text:0804B8CE sub eax, 1 .text:0804B8D1 and eax, [esi+194h] .text:0804B8D7 shr dword ptr [esi+194h], cl .text:0804B8DD add eax, [ebx+4] .text:0804B8E0 sub [esi+198h], edx .text:0804B8E6 mov [esi+34h], eax .text:0804B8E9 mov dword ptr [esi+14h], 8 .text:0804B8F0 jmp loc_804B402 .text:0804B8F5 loc_804B8F5: .text:0804B8F5 cmp [ebp+var_14], 7 .text:0804B8F9 jle short loc_804B92D .text:0804B8FB movzx edx, byte ptr [esi+194h] .text:0804B902 mov eax, esi .text:0804B904 call zlib_emit_char .text:0804B909 mov eax, [esi+3Ch] .text:0804B90C sub dword ptr [esi+198h], 8 .text:0804B913 shr dword ptr [esi+194h], 8 .text:0804B91A sub eax, 1 .text:0804B91D test eax, eax .text:0804B91F mov [esi+3Ch], eax .text:0804B922 jnz loc_804B402 .text:0804B928 jmp loc_804B4E9 .text:0804B92D .text:0804B92D loc_804B92D: .text:0804B92D mov eax, [esi+81A0h] .text:0804B933 mov ebx, [ebp+arg_C] .text:0804B936 mov edx, [ebp+arg_10] .text:0804B939 mov [ebx], eax .text:0804B93B mov eax, [esi+81A4h] .text:0804B941 mov [edx], eax .text:0804B943 add esp, 0Ch .text:0804B946 mov eax, 1 .text:0804B94B pop ebx .text:0804B94C pop esi .text:0804B94D pop edi .text:0804B94E pop ebp .text:0804B94F retn .text:0804B950 loc_804B950: .text:0804B950 mov ecx, [esi+10h] .text:0804B953 lea edx, [esi+198h] .text:0804B959 lea eax, [esi+194h] .text:0804B95F call zlib_huflookup .text:0804B964 cmp eax, 0FFFFFFFFh .text:0804B967 mov edx, eax .text:0804B969 jz short loc_804B92D .text:0804B96B cmp eax, 0FFFFFFFEh .text:0804B96E jz loc_804BA89 .text:0804B974 cmp eax, 0Fh .text:0804B977 jg short loc_804B9B7 .text:0804B979 mov eax, [esi+28h] .text:0804B97C mov [eax+esi+53h], dl .text:0804B980 add eax, 1 .text:0804B983 mov [esi+28h], eax .text:0804B986 jmp loc_804B402 .text:0804B98B loc_804B98B: .text:0804B98B cmp eax, 1 .text:0804B98E jz loc_804BA2E .text:0804B994 cmp eax, 2 .text:0804B997 jnz loc_804B402 .text:0804B99D mov dword ptr [esi+14h], 2 .text:0804B9A4 jmp loc_804B402 .text:0804B9A9 loc_804B9A9: .text:0804B9A9 mov edx, eax .text:0804B9AB mov eax, esi .text:0804B9AD call zlib_emit_char .text:0804B9B2 jmp loc_804B402 .text:0804B9B7 loc_804B9B7: .text:0804B9B7 cmp eax, 10h .text:0804B9BA jz loc_804BA45 .text:0804B9C0 cmp eax, 11h .text:0804B9C3 jz loc_804BA66 .text:0804B9C9 cmp eax, 12h .text:0804B9CC mov dword ptr [esi+2Ch], 7 .text:0804B9D3 jz loc_804BA7B .text:0804B9D9 mov dword ptr [esi+30h], 3 .text:0804B9E0 xor eax, eax .text:0804B9E2 .text:0804B9E2 loc_804B9E2: .text:0804B9E2 mov [esi+38h], eax .text:0804B9E5 mov dword ptr [esi+14h], 5 .text:0804B9EC jmp loc_804B402 .text:0804B9F1 loc_804B9F1: .text:0804B9F1 mov eax, [esi+8] .text:0804B9F4 cmp eax, [esi] .text:0804B9F6 mov dword ptr [esi+14h], 1 .text:0804B9FD jz short loc_804BA0E .text:0804B9FF lea eax, [esi+8] .text:0804BA02 call zlib_freetable .text:0804BA07 mov dword ptr [esi+8], 0 .text:0804BA0E .text:0804BA0E loc_804BA0E: .text:0804BA0E mov eax, [esi+0Ch] .text:0804BA11 cmp eax, [esi+4] .text:0804BA14 jz loc_804B402 .text:0804BA1A lea eax, [esi+0Ch] .text:0804BA1D call zlib_freetable .text:0804BA22 mov dword ptr [esi+0Ch], 0 .text:0804BA29 jmp loc_804B402 .text:0804BA2E .text:0804BA2E loc_804BA2E: .text:0804BA2E mov eax, [esi] .text:0804BA30 mov dword ptr [esi+14h], 6 .text:0804BA37 mov [esi+8], eax .text:0804BA3A mov eax, [esi+4] .text:0804BA3D mov [esi+0Ch], eax .text:0804BA40 jmp loc_804B402 .text:0804BA45 .text:0804BA45 loc_804BA45: .text:0804BA45 mov edx, [esi+28h] .text:0804BA48 xor eax, eax .text:0804BA4A mov dword ptr [esi+2Ch], 2 .text:0804BA51 mov dword ptr [esi+30h], 3 .text:0804BA58 test edx, edx .text:0804BA5A jle short loc_804B9E2 .text:0804BA5C movzx eax, byte ptr [edx+esi+52h] .text:0804BA61 jmp loc_804B9E2 .text:0804BA66 .text:0804BA66 loc_804BA66: .text:0804BA66 xor eax, eax .text:0804BA68 mov dword ptr [esi+2Ch], 3 .text:0804BA6F mov dword ptr [esi+30h], 3 .text:0804BA76 jmp loc_804B9E2 .text:0804BA7B .text:0804BA7B loc_804BA7B: .text:0804BA7B xor eax, eax .text:0804BA7D mov dword ptr [esi+30h], 0Bh .text:0804BA84 jmp loc_804B9E2 .text:0804BA89 .text:0804BA89 loc_804BA89: .text:0804BA89 mov eax, [esi+81A0h] .text:0804BA8F mov [esp+18h+var_18], eax .text:0804BA92 call free .text:0804BA97 mov ebx, [ebp+arg_10] .text:0804BA9A xor eax, eax .text:0804BA9C mov ecx, [ebp+arg_C] .text:0804BA9F mov dword ptr [esi+81A0h], 0 .text:0804BAA9 mov dword ptr [ebx], 0 .text:0804BAAF mov dword ptr [ecx], 0 .text:0804BAB5 add esp, 0Ch .text:0804BAB8 pop ebx .text:0804BAB9 pop esi .text:0804BABA pop edi .text:0804BABB pop ebp .text:0804BABC retn .text:0804BABC zlib_decompress_block endp :: Finally... ;; cleaning up mess after decompressing... .text:0804B2B0 public zlib_decompress_cleanup .text:0804B2B0 zlib_decompress_cleanup proc near .text:0804B2B0 .text:0804B2B0 arg_0 = dword ptr 8 .text:0804B2B0 .text:0804B2B0 push ebp .text:0804B2B1 mov ebp, esp .text:0804B2B3 push ebx .text:0804B2B4 sub esp, 4 .text:0804B2B7 mov ebx, [ebp+arg_0] .text:0804B2BA mov eax, [ebx+8] .text:0804B2BD test eax, eax .text:0804B2BF jz short loc_804B2CD .text:0804B2C1 cmp eax, [ebx] .text:0804B2C3 jz short loc_804B2CD .text:0804B2C5 lea eax, [ebx+8] .text:0804B2C8 call zlib_freetable .text:0804B2CD loc_804B2CD: .text:0804B2CD mov eax, [ebx+0Ch] .text:0804B2D0 test eax, eax .text:0804B2D2 jz short loc_804B2E1 .text:0804B2D4 cmp eax, [ebx+4] .text:0804B2D7 jz short loc_804B2E1 .text:0804B2D9 lea eax, [ebx+0Ch] .text:0804B2DC call zlib_freetable .text:0804B2E1 .text:0804B2E1 loc_804B2E1: .text:0804B2E1 mov eax, [ebx+10h] .text:0804B2E4 test eax, eax .text:0804B2E6 jz short loc_804B2F0 .text:0804B2E8 lea eax, [ebx+10h] .text:0804B2EB call zlib_freetable .text:0804B2F0 .text:0804B2F0 loc_804B2F0: .text:0804B2F0 mov eax, ebx .text:0804B2F2 call zlib_freetable .text:0804B2F7 lea eax, [ebx+4] .text:0804B2FA call zlib_freetable .text:0804B2FF mov [ebp+arg_0], ebx .text:0804B302 add esp, 4 .text:0804B305 pop ebx .text:0804B306 pop ebp .text:0804B307 jmp free .text:0804B307 zlib_decompress_cleanup endp ;; #MalwareMustDie!!