Guest User

Untitled

a guest
Mar 9th, 2017
3,388
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.07 KB | None | 0 0
  1. [ENABLE]
  2. alloc(newmem,2048)
  3. label(returnhere)
  4. label(code)
  5. label(exit)
  6. label(silver)
  7. label(gold)
  8. label(aobd)
  9. registersymbol(aobd)
  10. aobscan(aob,66 0F D6 45 E4 66 0F D6 45 EC 05)
  11.  
  12. newmem:
  13. push eax
  14. mov eax, [esp+38]
  15.  
  16. cmp byte [eax+9],'B'
  17. jne silver
  18. cmp byte [eax+A],'r'
  19. jne silver
  20. cmp byte [eax+B],'o'
  21. jne silver
  22. cmp byte [eax+C],'n'
  23. jne silver
  24. cmp byte [eax+F],'C'
  25. jne silver
  26. pop eax
  27. mov eax, 00000000
  28. push eax
  29. jmp code
  30.  
  31. silver:
  32. cmp byte [eax+9],'S'
  33. jne gold
  34. cmp byte [eax+A],'i'
  35. jne gold
  36. cmp byte [eax+B],'l'
  37. jne gold
  38. cmp byte [eax+C],'v'
  39. jne gold
  40. cmp byte [eax+F],'C'
  41. jne gold
  42. pop eax
  43. mov eax, 00000000
  44. push eax
  45. jmp code
  46.  
  47. gold:
  48. cmp byte [eax+9],'G'
  49. jne code
  50. cmp byte [eax+A],'o'
  51. jne code
  52. cmp byte [eax+B],'l'
  53. jne code
  54. cmp byte [eax+C],'d'
  55. jne code
  56. cmp byte [eax+D],'C'
  57. jne code
  58. pop eax
  59. mov eax, 00000000
  60. push eax
  61. jmp code
  62.  
  63. code:
  64. pop eax
  65. movq [ebp-1C],xmm0
  66.  
  67. exit:
  68. jmp returnhere
  69.  
  70. aob: //66 0F D6 45 E4 66 0F D6 45 EC 05
  71. aobd:
  72. jmp newmem
  73. returnhere:
  74.  
  75. [DISABLE]
  76. aobd:
  77. movq [ebp-1C],xmm0
  78. unregistersymbol(aobd)
  79. dealloc(newmem)
Advertisement
Add Comment
Please, Sign In to add comment