Topic created on: October 30, 2005 15:31 CST by bkparadox .

I was wondering if someone could help me.
I can't for the life of me wade through all the functions
to find the right one.
What im trying to achieve is as follows:
p.s I Know this is upx and its easily unpacked but this is
an example..
UPX0:00401000 loc_401000:                             ; CODE XREF: UPX1:00405938j
UPX0:00401000 push    0
UPX0:00401002 call    sub_401DF6
UPX0:00401007 mov     dword_403319, eax
UPX0:0040100C call    sub_401DF0
UPX0:00401011 mov     dword_40331D, eax
UPX0:00401016 push    0Ah
UPX0:00401018 push    dword_40331D
UPX0:0040101E push    0
UPX0:00401020 push    dword_403319
UPX0:00401026 call    sub_401031
UPX0:0040102B push    eax
UPX0:0040102C call    sub_401DEA

Now I want to find what refrences to the call
e.g. the first call goes to
UPX0:00401DF6 sub_401DF6 proc near                    ; CODE XREF: UPX0:00401002p
UPX0:00401DF6 jmp     off_402014
UPX0:00401DF6 sub_401DF6 endp

I want the Name of (off_402014) and to rename sub_401DF6 to the name it gives.. in this case
UPX0:00402014 off_402014 dd offset kernel32_GetModuleHandleA
; DATA XREF: sub_401DF6r

I tried this.. but obviously its poorly written on my part
:(
// Paradox's Deep function gather. for those pesky packed or encrypted apps that use
// Getmoudlehandle This will grab the name of the kernel or w/e function
// and make code more readable
#include <idc.idc>

static find_func(){
    auto ea, x, xrefme, backup, start_loc, end_loc;
    start_loc = SelStart();
    end_loc = SelEnd();
    Message("\n***Changing deep functions names for area***\n");
    
    Message("***" + atoa(start_loc) + " to " + atoa(end_loc) + "***\n");
    for( ea = start_loc; ea < end_loc; ea = NextAddr(ea)){
     x = Rfirst(ea);
x = Rnext(ea,x);
if(x != BADADDR){
backup = ea;
ea = x;
x = Rfirst(ea);
Message(atoa(ea) + " " + Name(x) + atoa(x) +"\n");
x = Rnext(ea,x);
if(x != BADADDR){
xrefme = XrefType();
if ( xrefme == fl_JF ){
     MakeNameEx(ea,Name(x),SN_AUTO);
     }
     Message(atoa(ea) + " refers to " + Name(x) + " : " + atoa(x) + "\n");
     }
    
     ea = backup;
     }
    }
    Message("End of output. \n");

}

Thanks in advance.. im sure its something simple..
Just that i dont know the function set properly or w/e.
Appreciate any help even if it just points me to a function.
I dont mind doing the leg work