Professional Documents
Culture Documents
Finding The Ahk-ExtraDecryption
Finding The Ahk-ExtraDecryption
2. 'unpacking' UPX
just scroll down until it looks like here
PUSH EBX
PUSH EDI
CALL EBP
POP EAX
POPAD
LEA EAX, [ESP-80]
PUSH 0
CMP ESP, EAX
JNZ SHORT 00471BD0
SUB ESP, -80
JMP 00442B4F <- set BREAKPOINT here
DB 00
DB 00
DB 00
DB 00
to jump in here:
AHK-ExtraDecryt:
MOV EAX, [ARG.11] ARG.11= ScriptLength
LEA EDX, [EAX+2BC] DX = ScriptLength + 700 [<-
0x2BC] !!!
CMP DX, BX Note: BX=0000
JNZ SHORT SKIP_EDX_400
MOV EDX, 400
SKIP_EDX_400:
SHR EAX, 1 = ScriptLength \ 2
MOV ECX, [ARG.24] ARG.24 = ScriptStart
MOV [ARG.28], ECX ARG.24 = i
MOV ECX, EBX Note: EBX=00000000
JE SHORT <Continue>
Loop
/MOV EDI, [ARG.28]
|LEA EDI, [EDI+ECX*2]
|SUB [EDI], DX ScriptStart[i*2] =
ScriptStart[i*2] - DX
|INC ECX
|CMP ECX, EAX
\JB SHORT Loop
Continue:
MOV EAX, [ARG.24]