Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- /*
- Script written by VolX
- Script : Aspr2.XX_unpacker
- version : v1.15E
- Date : 07-Mar-2009
- Test Environment : OllyDbg 1.1, ODBGScript 1.65, WINXP, WIN2000
- Debugging options: Tick all items in OllyDbg's Debugging Options-Exceptions
- Tools : OllyDbg, ODBGScript 1.65, Import Reconstructor
- Thanks : Oleh Yuschuk - author of OllyDbg
- SHaG - author of OllyScript
- Epsylon3 - author of ODbgScript
- Special Thank : goes to fly, linex, machenglin for their beta testing.
- */
- //support Asprotect 1.32, 1.33, ,1.35, 1.4, 2.0, 2.1, 2.11, 2.2beta, 2.2, 2.3, 2.4, 2.41
- var tmp1
- var tmp2
- var tmp3
- var tmp4
- var tmp5
- var tmp6
- var tmp7
- var tmp8
- var tmp9
- var tmp10
- var imgbase
- var imgbasefromdisk
- var 1stsecbase
- var 1stsecsize
- var ressecbase
- var signVA
- var sizeofimg
- var dllimgbase
- var freeloc
- var count
- var transit1
- var transit2
- var func1
- var func2
- var func3
- var func4
- var OEP_rva
- var caller
- var caller1
- //for IAT fixing
- var paddr1
- var paddr2
- var paddr3
- var paddr4
- var paddr5
- var paddr6
- var ori1
- var ori2
- var ori3
- var ori4
- var ori5
- var iatstartaddr
- var iatstart_rva
- var iatendaddr
- var iatsize
- var EBXaddr
- var ESIaddr
- var lastsecbase
- var lastsecsize
- var thunkdataloc
- var thunkpt
- var thunkstop
- var type3API
- var type3count
- var type1API
- var E8count
- var writept2
- var APIpoint3
- var crcpoint1
- var FF15flag
- var ESIpara1
- var ESIpara2
- var ESIpara3
- var ESIpara4
- var nortype
- var DFCequ
- var DFCaddr
- var REequ
- var REaddr
- var GPAequ
- var GPAaddr
- var v1.32
- var v2.0x
- var newver
- var sttablesize
- //for stolencode after API
- var SCafterAPIcount
- //for dll
- var reloc_rva
- var reloc_size
- var isdll
- var reloc1
- var reloc2
- var reloc3
- var reloc4
- var reloc5
- var reloc6
- var reloctemp
- //for Aspr API
- var Aspr1stthunk
- var AsprAPIloc
- var EmuAddr
- //std function
- var 55pt
- var 55struct1
- var 55dataloc
- var 55sc
- //delphi initialization table
- var dataendaddr
- var countaddr
- var tablea
- var tableb
- var decryptaddr
- var dataloc
- //OEP/SDK stolen code
- var 57pt
- var 57jmppt
- var 57struct
- var jmptablesize
- var scstk
- var OEPscaddr
- var xtrascloc //freeloc+F00
- var dualvc
- var sdkscaddr
- var sdksccount
- var vcrefstart
- var vcrefend
- var findendaddr
- var patchaddr
- var patchendaddr
- var patchinsamesec
- var SDKsize
- var newphysec
- var newphysecsize
- var virtualsec
- var newzeroVA
- var curzeroVA
- var virzeroVA
- var newpatchaddr
- var newpatchendaddr
- //VM
- var VMcodeloc
- var VMstartaddr
- var VMlength
- cmp $VERSION, "1.64"
- jb odbgver
- dbh
- BPHWCALL //clear hardware breakpoint
- GMI eip, MODULEBASE //get imagebase
- mov imgbase, $RESULT
- //log imgbase
- mov tmp1, [imgbase+3C]
- add tmp1, imgbase //tmp1=signature VA
- mov signVA, tmp1
- mov imgbasefromdisk, [signVA+34]
- //log imgbasefromdisk
- mov sizeofimg, [signVA+50]
- mov tmp2, [signVA+88]
- add tmp2, imgbase
- mov ressecbase, tmp2
- mov 1stsecsize, [signVA+100]
- //log 1stsecsize
- mov 1stsecbase, [signVA+104]
- add 1stsecbase, imgbase
- //log 1stsecbase
- mov tmp1, signVA
- add tmp1, f8 //1st section
- mov tmp2, 0
- mov tmp2, [signVA+6], 2
- last:
- cmp tmp2, 1
- je lab1
- add tmp1, 28
- sub tmp2, 1
- jmp last
- lab1:
- mov lastsecsize, [tmp1+8]
- //log lastsecsize
- mov tmp3, [tmp1+0C]
- add tmp3, imgbase
- mov lastsecbase, tmp3
- //log lastsecbase
- //check if its an exe or dll
- cmp imgbasefromdisk, imgbase
- je lab1_1
- mov isdll, 1
- jmp lab1_2
- lab1_1:
- GPI EXEFILENAME
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- GPI PROCESSNAME
- mov tmp2, $RESULT
- GPI CURRENTDIR
- mov tmp3, $RESULT
- eval "{tmp3}{tmp2}.exe"
- mov tmp4, $RESULT
- eval "{tmp3}{tmp2}.dll"
- mov tmp5, $RESULT
- scmpi tmp1, tmp4
- je lab1_2
- scmpi tmp1, tmp5
- jne error
- mov isdll, 1
- lab1_2:
- cob
- coe
- gpa "GetSystemTime", "kernel32.dll"
- bp $RESULT
- esto
- bc $RESULT
- rtr
- sti
- GMEMI eip, MEMORYOWNER
- mov dllimgbase, $RESULT
- cmp dllimgbase, 0
- je error
- cmp dllimgbase, imgbase
- jne lab1_3
- GMEMI eip, MEMORYBASE
- mov dllimgbase, $RESULT
- cmp dllimgbase, 0
- je error
- log dllimgbase
- lab1_3:
- alloc 1000
- mov freeloc, $RESULT
- log freeloc
- find dllimgbase, #3135310D0A#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je wrongver
- find dllimgbase, #0F318901895104# //check rdtsc trick
- mov tmp1, $RESULT
- cmp tmp1, 0
- je lab1_6
- sub tmp1, 80
- find tmp1, #558BEC#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- bp tmp1
- eob lab1_4
- eoe lab1_4
- esto
- lab1_4:
- cmp eip, tmp1
- je lab1_5
- esto
- lab1_5:
- bc tmp1
- mov eip, [esp]
- add esp, 4
- lab1_6:
- find dllimgbase, #8B5F048B3383C304# //search "mov ebx,[edi+4]" "mov esi,[ebx]""add ebx,4"
- mov tmp2, $RESULT
- cmp tmp2, 0
- jne lab1_7
- find dllimgbase, #8B6F048B750083C504# //search "mov ebp,[edi+4]" "mov esi,[ebp]""add ebp,4"
- mov tmp2, $RESULT
- cmp tmp2, 0
- jne lab1_7
- find dllimgbase, #8B6?0?8B?50083C504# //search "mov ebp,[e??+0?]" "mov e??,[ebp]""add ebp,4"
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- lab1_7:
- find dllimgbase, #3138310D0A#
- cmp $RESULT, 0
- je lab1_8
- sub tmp2, 600
- jmp lab1_9
- lab1_8:
- sub tmp2, 200
- lab1_9:
- find tmp2, #8BF08973??# //search "mov esi, eax", "mov [ebx+??], esi"
- mov tmp3, $RESULT
- cmp tmp3, 0
- je error
- mov 57pt, tmp3
- find 57pt, #3130370D0A#
- mov tmp5, $RESULT
- cmp tmp5, 0
- je error
- sub tmp5, 57pt
- cmp tmp5, 0A0
- ja error
- lab2:
- //log 57pt
- mov tmp1, dllimgbase
- add tmp1, 010e00
- find tmp1, #892D????????3b6C24??#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error45
- find tmp2, #833C240074??#
- mov tmp4, $RESULT
- cmp tmp4, 0
- je error45
- add tmp4, 4
- find tmp1, #8B5483408BC6# //search "mov edx,[ebx+eax*4+40]" "mov eax,esi"
- mov tmp2, $RESULT //vcpoint
- cmp tmp2, 0
- je error
- find tmp2, #807B740074??# //search "cmp [ebx+74],0" "je xxxxxxxx"
- mov tmp3, $RESULT
- cmp tmp3, 0
- je lab2_1
- mov dualvc, 1
- lab2_1:
- bp tmp4
- eob lab3
- eoe lab3
- esto
- lab3:
- cmp eip, tmp4
- je lab4
- esto
- lab4:
- bc tmp4
- mov tmp1, eip
- sub tmp1, 1000
- find tmp1, #F3A566A5# //search "rep movs[edi],[esi]","movs [edi],[esi]"
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- find tmp1, #0F84??000000#
- mov thunkstop, $RESULT
- //log thunkstop
- bp thunkstop
- find dllimgbase, #45894500# //search "inc ebp", "mov [ebp],eax"
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- sub tmp2, 27
- mov APIpoint3, tmp2
- //log APIpoint3
- find dllimgbase, #40890383C704#
- mov tmp1, $RESULT
- add tmp1, 1
- mov thunkpt, tmp1
- //log thunkpt
- cmp isdll, 1
- jne lab7_1
- mov !zf, 1
- mov tmp1, eip
- mov tmp2, [tmp1+2], 2
- cmp tmp2, 5C03 //chk if "add ebx, [esp+4]"
- je lab5
- cmp tmp2, 5C8B //chk if "mov ebx, [esp+4]"
- jne error
- mov reloc_rva, esi
- mov tmp1, esi
- jmp lab6
- lab5:
- mov reloc_rva, ebx
- mov tmp1, ebx
- lab6:
- add tmp1, imgbase
- call ChkRelocSize
- lab7:
- mov reloc_size, tmp2
- lab7_1:
- bp thunkpt
- find dllimgbase, #33C08A433?3BF0# //search "xor eax,eax", "mov al, {ebx+3?]", "cmp esi,eax"
- mov paddr1, $RESULT
- cmp paddr1, 0
- je error
- add paddr1, 7
- //log paddr1
- mov tmp2, [paddr1-3], 1
- cmp tmp2, 3F
- jne lab8
- mov v1.32, 1
- lab8:
- mov thunkdataloc, freeloc
- add thunkdataloc, 200 //freeloc+200
- find dllimgbase, #0036300D0A#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- find tmp1, #68????????68????????68????????68????????#
- mov tmp1, $RESULT
- add tmp1, 14
- mov tmp3, [tmp1], 2
- cmp tmp3, 35FF
- je lab11
- mov crcpoint1, tmp1
- //log crcpoint1
- bp crcpoint1
- eob lab9
- eoe lab9
- esto
- lab9:
- cmp eip, crcpoint1
- je lab10
- esto
- lab10:
- eob
- eoe
- bc crcpoint1
- bc thunkpt
- bc thunkstop
- rtr
- sti
- bp thunkpt
- bp thunkstop
- lab11:
- eob lab12
- eoe lab12
- esto
- lab12:
- cmp eip, thunkpt
- je lab13
- cmp eip, thunkstop
- je lab18
- esto
- lab13:
- bc thunkpt
- mov ESIaddr, esi
- //log ESIaddr
- mov ori1, [paddr1]
- mov ori2, [paddr1+4]
- mov tmp1, [signVA+30]
- add tmp1, imgbase
- find tmp1, #426F726C616E6420432B2B202D# //Search "Borland C++ -"
- mov tmp2, $RESULT
- cmp tmp2, 0
- jne lab13_1
- find tmp1, #436F64654765617220432B2B202D# //Search "CodeGear C++ -"
- mov tmp2, $RESULT
- cmp tmp2, 0
- je lab13_2
- lab13_1:
- mov tmp1, [ebx]
- add tmp1, imgbase
- GMEMI tmp1, MEMORYBASE
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- GMEMI tmp1, MEMORYSIZE
- mov tmp3, $RESULT
- cmp tmp3, 0
- je error
- fill tmp2, tmp3, 00
- lab13_2:
- find eip, #3A5E3?7517#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- mov ESIpara1, [tmp1]
- //log ESIpara1
- add tmp1, 6
- find tmp1, #3A5E3?7517#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- mov ESIpara2, [tmp2]
- //log ESIpara2
- add tmp2, 6
- find tmp2, #3A5E3?75??#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- mov ESIpara3, [tmp1]
- //log ESIpara3
- add tmp1, 6
- //chk version is with AsprAPI ?
- find dllimgbase, #3138300D0A#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je lab13_3
- find tmp1, #8A07E8#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- add tmp2, 3
- mov tmp6, [tmp2]
- add tmp6, tmp2
- add tmp6, 5
- lab13_3:
- find tmp1, #473A5E3?#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- add tmp2, 1
- mov tmp3, [tmp2], 3
- add tmp3, 74000000
- mov ESIpara4, tmp3
- //log ESIpara4
- find eip, #834424080447EB1A# //search "add [esp+8],4", "inc edi"
- mov tmp1, $RESULT
- cmp tmp1, 0
- je lab13_4
- mov nortype, 1
- //log nortype
- //checking iatendaddr
- lab13_4:
- mov tmp7, eip //save eip
- mov tmp1, freeloc
- mov [tmp1], #609CBE740E8C00BD000F8600C74500000286008B4D008B0305000000018901834500048BFB83C70A83C1048939834500#
- add tmp1, 30 //30
- mov [tmp1], #0433C0B9FFFFFFFFF2AE8A1F3A5E34744B3A5E37750883C707FF45FCEBEC3A5E38750883C705FF45FCEBDF3A5E3A751C#
- add tmp1, 30 //60
- mov [tmp1], #508D47F58B0089452058C78560F1FFFFEB12909083C704FF45FCEBBE83C703668B0783C00203F8FF45FCEBAE807D0401#
- add tmp1, 30 //90
- mov [tmp1], #7469478BDF833B000F8575FFFFFFC6450401C7450800026304C745FC000000008B45088B0089450C8945148B45088B40#
- add tmp1, 30 //C0
- mov [tmp1], #04894510834508088B45088B0083F80074213B450C720E89450C8B5D088B5B04895D10EB083B45147703894514834508#
- add tmp1, 30 //F0
- mov [tmp1], #08EBD58B7D10E936FFFFFFB8000263048B0883F90074113B4D147407C741FC0000000083C008EBE89D61909000000000#
- mov tmp1, freeloc
- mov tmp2, freeloc
- add tmp2, 0F00 //freeloc+F00
- add tmp1, 3 //3
- mov [tmp1], ESIaddr
- add tmp1, 5 //8
- mov [tmp1], tmp2
- add tmp1, 7 //F
- mov [tmp1], thunkdataloc
- add tmp1, A //19
- mov [tmp1], imgbase
- add tmp1, 23 //3C
- mov [tmp1], ESIpara4
- add tmp1, 5 //41
- mov [tmp1], ESIpara1
- add tmp1, D //4E
- mov [tmp1], ESIpara2
- add tmp1, D //5B
- mov [tmp1], ESIpara3
- add tmp1, 4A //A5
- mov [tmp1], thunkdataloc
- add tmp1, 57 //FC
- mov [tmp1], thunkdataloc
- cmp nortype, 1
- je lab14
- mov tmp1, freeloc
- add tmp1, 74 //74
- mov [tmp1], #83C705FF#
- lab14:
- cob
- coe
- mov tmp4, freeloc
- add tmp4, 11A //end point
- bp tmp4
- mov eip, freeloc
- run
- bc tmp4
- mov eip, tmp7 //restore eip
- mov tmp1, freeloc
- add tmp1, 0EFC
- mov tmp2, [tmp1] //API count of last dll
- mov tmp3, [tmp1+10] //last thunk addr
- shl tmp2, 2
- add tmp3, tmp2
- mov iatendaddr, tmp3
- //log iatendaddr
- mov iatstartaddr, [tmp1+18]
- //log iatstartaddr
- mov iatstart_rva, iatstartaddr
- sub iatstart_rva, imgbase
- mov [iatendaddr], 0
- mov tmp2, iatendaddr
- sub tmp2, iatstartaddr
- add tmp2, 4
- mov iatsize, tmp2
- find dllimgbase, #3138300D0A#
- cmp $RESULT, 0
- je lab14_1
- find tmp6, #BA01000000B9#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- add tmp2, 6
- mov AsprAPIloc, [tmp2]
- log AsprAPIloc
- mov tmp2, [tmp1+24]
- cmp tmp2, 0
- je lab14_1
- add tmp2, imgbase
- mov Aspr1stthunk, tmp2
- log Aspr1stthunk
- lab14_1:
- fill freeloc, f30, 00
- //force to decrypt all api
- mov tmp1, freeloc
- cmp v1.32, 1
- je lab15
- mov [tmp1], #570FB67B353BF775040FB673365F3BF00F8500000000E900000000#
- jmp lab16
- lab15:
- mov [tmp1], #570FB67B393BF775040FB6733A5F3BF00F8500000000E900000000#
- lab16:
- add tmp1, 10
- mov tmp2, paddr1
- add tmp2, 60
- eval "jnz 0{tmp2}"
- asm tmp1, $RESULT
- add tmp1, 6
- mov tmp2, paddr1
- add tmp2, 5
- eval "jmp 0{tmp2}"
- asm tmp1, $RESULT
- eval "jmp 0{freeloc}"
- asm paddr1, $RESULT
- find paddr1, #3B432?74656AFF# //search "cmp eax,[ebx+2?]","je xxxxxx","push -1"
- mov paddr2, $RESULT
- cmp paddr2, 0
- je lab17
- add paddr2, 3
- //log paddr2
- mov ori3, [paddr2]
- mov [paddr2], #EB#
- lab17:
- find paddr1, #3B432?741b6AFF# //search "cmp eax,[ebx+2?]","je xxxxxx","push -1"
- mov paddr3, $RESULT
- cmp paddr3, 0
- je error
- add paddr3, 3
- //log paddr3
- mov ori4, [paddr3]
- mov [paddr3], #EB#
- find paddr1, #8902B8????????#
- mov paddr4, $RESULT
- cmp paddr4, 0
- je error
- add paddr4, 2
- //log paddr4
- gpa "DllFunctionCall", "MSVBVM60.dll"
- mov tmp2, $RESULT
- cmp tmp2, 0
- je lab17_1
- GMEMI tmp2, MEMORYOWNER
- mov tmp3, $RESULT
- cmp tmp3, 0
- jne lab17_4
- lab17_1:
- gpa "DllFunctionCall", "MSVBVM50.dll"
- mov tmp2, $RESULT
- cmp tmp2, 0
- je lab17_5
- GMEMI tmp2, MEMORYOWNER
- mov tmp3, $RESULT
- cmp tmp3, 0
- je lab17_5
- //Add more VB version if needed.....
- lab17_4:
- mov DFCaddr, tmp2
- mov DFCequ, [paddr4+1]
- mov tmp1, freeloc
- add tmp1, 20 //freeloc+20
- eval "jmp 0{tmp1}"
- asm paddr4, $RESULT
- mov [tmp1], #B8#
- add tmp1, 1 //freeloc+21
- mov [tmp1], tmp2
- mov tmp3, paddr4
- add tmp3, 5
- add tmp1, 4 //freeloc+25
- eval "jmp 0{tmp3}"
- asm tmp1, $RESULT
- lab17_5:
- mov count, 0 //counter
- find paddr4, #C21000#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- mov tmp2, paddr4
- loop2:
- find tmp2, #Eb01??B8????????#
- mov paddr5, $RESULT
- cmp paddr5, 0
- je loop2_1
- cmp paddr5, tmp1
- ja loop2_1
- add count, 1
- mov tmp2, paddr5
- add tmp2, 8
- jmp loop2
- //end
- loop2_1:
- //log count
- cmp count, 2
- je lab17_6
- cmp count, 0
- je lab17_10
- cmp count, 1
- jne error
- mov tmp4, paddr4
- jmp lab17_7
- lab17_6:
- find paddr4, #Eb01??B8????????#
- mov paddr5, $RESULT
- cmp paddr5, 0
- je error
- add paddr5, 3
- //log paddr5
- mov tmp4, paddr5
- gpa "RaiseException", "kernel32.dll"
- mov tmp2, $RESULT
- cmp tmp2, 0
- je lab17_7
- GMEMI tmp2, MEMORYOWNER
- mov tmp3, $RESULT
- cmp tmp3, 0
- je lab17_7
- mov REaddr, tmp2
- mov REequ, [paddr5+1]
- mov tmp1, freeloc
- add tmp1, 30 //freeloc+30
- eval "jmp 0{tmp1}"
- asm paddr5, $RESULT
- mov [tmp1], #B8#
- add tmp1, 1 //freeloc+31
- mov [tmp1], tmp2
- mov tmp3, paddr5
- add tmp3, 5
- add tmp1, 4 //freeloc+35
- eval "jmp 0{tmp3}"
- asm tmp1, $RESULT
- lab17_7:
- find tmp4, #Eb01??B8????????#
- mov paddr6, $RESULT
- cmp paddr6, 0
- je error
- add paddr6, 3
- //log paddr6
- mov tmp1, [paddr6+1]
- mov tmp2, 0
- mov tmp2, [tmp1], 1
- cmp tmp2, 0E8
- jne lab17_8
- mov tmp2, [tmp1+5], 2
- cmp tmp2, 0E0FF
- jne lab17_10
- gpa "RaiseException", "kernel32.dll"
- mov tmp2, $RESULT
- cmp tmp2, 0
- je lab17_10
- GMEMI tmp2, MEMORYOWNER
- mov tmp3, $RESULT
- cmp tmp3, 0
- je lab17_10
- mov REaddr, tmp2
- mov REequ, [paddr6+1]
- cmp count, 1
- jne lab17_9
- mov paddr5, paddr6
- jmp lab17_9
- lab17_8:
- mov tmp2, [tmp1+5], 1
- cmp tmp2, 0C
- jne lab17_10
- mov tmp2, [tmp1+8], 1
- cmp tmp2, 08
- jne lab17_10
- gpa "GetProcAddress", "kernel32.dll"
- mov tmp2, $RESULT
- cmp tmp2, 0
- je lab17_10
- GMEMI tmp2, MEMORYOWNER
- mov tmp3, $RESULT
- cmp tmp3, 0
- je lab17_10
- mov GPAaddr, tmp2
- mov GPAequ, [paddr6+1]
- lab17_9:
- mov tmp1, freeloc
- add tmp1, 40 //freeloc+40
- eval "jmp 0{tmp1}"
- asm paddr6, $RESULT
- mov [tmp1], #B8#
- add tmp1, 1 //freeloc+41
- mov [tmp1], tmp2
- mov tmp3, paddr6
- add tmp3, 5
- add tmp1, 4 //freeloc+45
- eval "jmp 0{tmp3}"
- asm tmp1, $RESULT
- lab17_10:
- mov count, 0
- eob lab12
- eoe lab12
- esto
- lab18:
- bc thunkstop
- bphwc thunkpt
- mov [paddr1], ori1
- mov [paddr1+4], ori2
- cmp DFCequ, 0
- je lab18_1
- mov [paddr4], #B8#
- mov [paddr4+1], DFCequ
- lab18_1:
- cmp REequ, 0
- je lab18_2
- mov [paddr5], #B8#
- mov [paddr5+1], REequ
- lab18_2:
- cmp GPAequ, 0
- je lab18_3
- mov [paddr6], #B8#
- mov [paddr6+1], GPAequ
- lab18_3:
- cmp paddr2, 0
- je lab19
- mov [paddr2], ori3
- lab19:
- mov [paddr3], ori4
- fill freeloc, 60, 00
- find dllimgbase, #8B432C2BC583E805#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- add tmp1, 8
- mov writept2, tmp1
- //log writept2
- bphws writept2, "x"
- find eip, #C700D4000000# //Search dword ptr [eax], 0D4"
- mov 55pt, $RESULT
- cmp 55pt, 0
- add 55pt, 8
- jne lab19_2
- find eip, #C600D485# //Search "mov byte ptr [eax], 0D4"
- mov 55pt, $RESULT
- cmp 55pt, 0
- je lab19_1
- add 55pt, 5
- jmp lab19_2
- lab19_1:
- find eip, #C600D4837D??00# //Search "mov byte ptr [eax], 0D4", "cmp [ebp-8], 0"
- mov 55pt, $RESULT
- cmp 55pt, 0
- je error
- add 55pt, 7
- lab19_2:
- //log 55pt
- bp 55pt
- BPHWS APIpoint3, "x"
- eoe lab20
- eob lab20
- esto
- lab20:
- cmp eip, APIpoint3
- je lab21
- cmp eip, writept2
- je lab23
- cmp eip, 55pt
- je lab25
- esto
- lab21:
- mov type3API, 1
- cmp EBXaddr, 0
- jne lab22
- mov EBXaddr, ebx
- //log EBXaddr
- mov tmp1, [EBXaddr+4A], 1
- mov FF15flag, tmp1
- //log FF15flag
- lab22:
- bphwc APIpoint3
- eob lab22_1
- eoe lab22_1
- esto
- lab22_1:
- cmp eip, writept2
- je lab23
- cmp eip, 55pt
- je lab25
- esto
- lab23:
- bphwc writept2
- cmp EBXaddr, 0
- jne lab24
- mov EBXaddr, ebx
- //log EBXaddr
- mov tmp1, [EBXaddr+4A], 1
- mov FF15flag, tmp1
- //log FF15flag
- lab24:
- mov type1API, 1
- //log type1API
- eob lab24_1
- eoe lab24_1
- esto
- lab24_1:
- cmp eip, APIpoint3
- je lab21
- cmp eip, 55pt
- je lab25
- esto
- lab25:
- bphwc APIpoint3
- bphwc writept2
- bc 55pt
- cmp !zf, 0
- jne lab27_1
- sti
- sti
- sti
- sti
- mov tmp1, eax
- mov tmp2, [tmp1]
- //log tmp2, "55 struct = "
- cmp tmp2, 0
- je lab25_1
- cmp tmp2, 1
- je lab25_2
- msg "Unknown 55 struct"
- //pause
- //old
- lab25_1:
- mov tmp2, eax
- mov tmp6, [tmp2+4] //data size
- add tmp6, tmp2
- sub tmp6, 8 //ending address of data
- add tmp2, 8
- jmp lab25_3
- //new
- lab25_2:
- mov 55struct1, 1
- mov tmp2, eax
- mov tmp6, [tmp2+6] //data size
- add tmp6, tmp2
- sub tmp6, 8 //ending address of data
- add tmp2, 0C
- lab25_3:
- alloc 1000
- mov 55dataloc, $RESULT
- mov tmp3, 55dataloc
- loop3:
- cmp tmp2, tmp6
- jae lab26
- mov tmp4, [tmp2]
- add tmp4, imgbase
- mov [tmp3], tmp4
- add tmp2, 4
- mov tmp5, [tmp2]
- add tmp2, tmp5
- add tmp2, 4
- add tmp3, 4
- add count, 1
- cmp 55struct1, 1
- je loop3_1
- jmp loop3
- loop3_1:
- add tmp2, 2
- jmp loop3
- lab26:
- coe
- cob
- rtr
- //log count
- cmp count, 1
- je onefunc
- cmp count, 2
- je twofunc
- cmp count, 5
- je fivefunc
- cmp count, 6
- je sixfunc
- cmp count, 7
- je sevenfunc
- lab26_1:
- sti
- mov 55sc, 1
- jmp lab27_1
- onefunc:
- log "1 standard functions"
- mov tmp1, 55dataloc
- mov tmp2, [tmp1]
- mov [tmp2], #6AFF5064A100000000508B44240C64892500000000896C240C8D6C240C50C3#
- jmp lab27
- twofunc:
- mov tmp1, 55dataloc
- mov tmp2, [tmp1]
- mov tmp3, [tmp1]
- sub tmp3, A
- mov tmp4, [tmp3]
- cmp tmp4, A6F3D189
- je twofunc_1
- sub tmp3, 1
- mov tmp4, [tmp3]
- cmp tmp4, A6F3D189
- jne lab26_1
- twofunc_1:
- log "2 standard functions"
- mov [tmp2], #56575389C689D709C074038B40FC09D274038B52FC89C139D1760289D139C9F3A6742A8A5EFF80FB61720880FB7A7703#
- add tmp2, 30
- mov [tmp2], #80EB208A7FFF80FF61720880FF7A770380EF2038FB74D80FB6C30FB6D729D05B5F5EC3#
- add tmp1, 4
- mov tmp2, [tmp1]
- mov [tmp2], #575689D789C6B9FFFFFFFF31C0F2AEF7D189D731D2F3A68A46FF8A57FF29D05E5FC3#
- jmp lab27
- fivefunc:
- log "5 standard functions"
- jmp lab26_1
- sixfunc:
- log "6 standard functions"
- mov tmp1, 55dataloc
- mov tmp2, [tmp1]
- mov tmp3, [tmp1]
- sub tmp3, 30
- find tmp3, #0FB646FF0FB657FF#
- mov tmp4, $RESULT
- cmp tmp4, 0
- je lab26_1
- //log tmp4
- cmp tmp4, tmp2
- ja lab26_1
- mov [tmp2], #56575389C689D709C074038B40FC09D274038B52FC89C139D1760289D139C9F3A6742A8A5EFF80FB61720880FB7A7703#
- add tmp2, 30
- mov [tmp2], #80EB208A7FFF80FF61720880FF7A770380EF2038FB74D80FB6C30FB6D729D05B5F5EC3#
- add tmp1, 4 //2nd
- mov tmp2, [tmp1]
- mov [tmp2], #89FA89C7B9FFFFFFFF30C0F2AEB8FEFFFFFF29C889D7C3#
- add tmp1, 4 //3rd
- mov tmp2, [tmp1]
- mov [tmp2], #89FA89C7B9FFFFFFFF30C0F2AE8D47FF89D7C3#
- add tmp1, 4 //4th
- mov tmp2, [tmp1]
- mov [tmp2], #575689C689D7B9FFFFFFFF30C0F2AEF7D189F789D689CA89F8C1E902F3A589D183E103F3A45E5FC3#
- add tmp1, 4 //5th
- mov tmp2, [tmp1]
- mov [tmp2], #575689D789C6B9FFFFFFFF31C0F2AEF7D189D731D2F3A68A46FF8A57FF29D05E5FC3#
- add tmp1, 4 //6th
- mov tmp2, [tmp1]
- mov [tmp2], #568BF08BD0AC08C074123C614172F680F87A77F180E8208846FFEBE9925EC3#
- jmp lab27
- sevenfunc:
- log "7 standard functions"
- mov tmp1, 55dataloc
- mov tmp2, [tmp1]
- mov tmp3, [tmp1]
- sub tmp3, B
- mov tmp4, [tmp3]
- cmp tmp4, A6F3D189
- jne lab26_1
- mov [tmp2], #56575389C689D709C074038B40FC09D274038B52FC89C139D1760289D139C9F3A6742A8A5EFF80FB61720880FB7A7703#
- add tmp2, 30
- mov [tmp2], #80EB208A7FFF80FF61720880FF7A770380EF2038FB74D80FB6C30FB6D729D05B5F5EC3#
- add tmp1, 4 //2nd
- mov tmp2, [tmp1]
- mov [tmp2], #89FA89C7B9FFFFFFFF30C0F2AEB8FEFFFFFF29C889D7C3#
- add tmp1, 4 //3rd
- mov tmp2, [tmp1]
- mov [tmp2], #89FA89C7B9FFFFFFFF30C0F2AE8D47FF89D7C3#
- add tmp1, 4 //4th
- mov tmp2, [tmp1]
- mov [tmp2], #565789D689C789CA39F77711742BC1E902F3A589D183E103F3A45F5EC38D740EFF8D7C0FFF83E103FDF3A483EE0383EF#
- add tmp2, 30
- mov [tmp2], #0389D1C1E902F3A5FC5F5EC3#
- add tmp1, 4 //5th
- mov tmp2, [tmp1]
- mov [tmp2], #575689C689D7B9FFFFFFFF30C0F2AEF7D189F789D689CA89F8C1E902F3A589D183E103F3A45E5FC3#
- add tmp1, 4 //6th
- mov tmp2, [tmp1]
- mov [tmp2], #575689D789C6B9FFFFFFFF31C0F2AEF7D189D731D2F3A68A46FF8A57FF29D05E5FC3#
- add tmp1, 4 //7th
- mov tmp2, [tmp1]
- mov [tmp2], #57565309C0744409D2744089C389D730C0B9FFFFFFFFF2AEF7D149742E89CE89DFB9FFFFFFFFF2AEF7D129F1761D89DF#
- add tmp2, 30
- mov [tmp2], #8D5EFF89D6ACF2AE751189C85789D9F3A65F89C175ED8D47FFEB0231C05B5E5FC3#
- lab27:
- sti
- lab27_1:
- cob
- coe
- find dllimgbase, #0036300D0A#
- mov tmp6, $RESULT
- cmp tmp6, 0
- je error
- mov tmp3, tmp6
- sub tmp3, 90
- find tmp3, #C600??#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je lab27_2
- cmp tmp2, tmp6
- jb lab27_3
- lab27_2:
- find tmp3, #C700D?000000#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- cmp tmp2, tmp6
- ja error
- lab27_3:
- find tmp2, #74??#
- mov tmp4, $RESULT
- cmp tmp4, 0
- je error
- cmp tmp4, tmp6
- ja error
- mov transit1, tmp4
- //log transit1
- find eip, #C700D5000000#
- mov tmp3, $RESULT
- cmp tmp3, 0
- add tmp3, 8
- jne lab27_4
- find eip, #C600D5#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- find tmp1, #74??#
- mov tmp3, $RESULT
- cmp tmp3, 0
- je error
- lab27_4:
- eob lab27_5
- eoe lab27_5
- bp tmp3
- esto
- lab27_5:
- cmp eip, tmp3
- je lab27_6
- esto
- lab27_6:
- bc tmp3
- cmp !zf, 0
- jne lab28
- //Collect SDK stolen code
- find dllimgbase, #C603E98D5301#
- mov 57jmppt, $RESULT
- cmp 57jmppt, 0
- je error
- bp 57jmppt
- mov xtrascloc, freeloc
- add xtrascloc, 0F00 //freeloc+F00
- //log xtrascloc
- //log 57pt
- bp 57pt
- mov tmp4, xtrascloc
- mov tmp5, freeloc
- add tmp5, 300 //freeloc+300
- mov tmp9, freeloc
- add tmp9, 500 //freeloc+500
- mov tmp8, freeloc
- mov tmp7, 0 //counter
- lab28:
- bp transit1
- eob lab28_1
- eoe lab28_1
- esto
- lab28_1:
- cmp eip, 57pt
- je lab29
- cmp eip, 57jmppt
- je lab30
- cmp eip, transit1
- je lab31
- esto
- //Get total SDK sections and collect address of scstk
- lab29:
- cmp sdksccount, 0
- jne lab29_9
- find eip, #8BE55DC2??00#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- mov tmp2, [tmp1+4], 1
- cmp tmp2, 08
- jne lab29_1
- mov sdksccount, [ebp-0c]
- log sdksccount, "Total SDK stolen code sections = "
- mov tmp1, [esp]
- GMEMI tmp1, MEMORYBASE
- mov tmp10, $RESULT
- jmp lab29_2
- lab29_1:
- cmp tmp2, 0c
- jne error
- mov sdksccount, [ebp-10]
- log sdksccount, "SDK stolen code sections = "
- mov tmp1, [esp+4]
- GMEMI tmp1, MEMORYBASE
- mov tmp10, $RESULT
- lab29_2:
- cmp tmp7, 0
- jne lab29_9
- mov tmp1, [tmp10+4], 2
- cmp tmp1, 0
- je lab29_6
- cmp tmp1, 1
- jne lab29_3
- add tmp10, 0E
- jmp lab29_4
- //Aspr 2.3 Build6.26
- lab29_3:
- mov tmp1, [tmp10+4]
- mov tmp2, [tmp10+0E]
- cmp tmp1, tmp2
- jne error //unknown aspr version
- mov tmp1, [tmp10+8], 2
- cmp tmp1, 1
- jne error //unknown aspr version
- mov tmp2, [tmp10+12], 2
- cmp tmp1, tmp2
- jne error //unknown aspr version
- add tmp10, 12
- lab29_4:
- mov tmp1, [tmp10], 2
- cmp tmp1, 01
- jne lab29_9
- mov tmp2, [tmp10+6]
- cmp tmp2, 0
- je lab29_9
- mov tmp1, [tmp10+2]
- cmp tmp1, 0
- je lab29_9
- add tmp1, imgbase
- mov [tmp8], tmp1
- add tmp8, 4
- add tmp10, tmp2
- add tmp10, 0A
- cmp tmp2, 1000
- ja lab29_5
- add SDKsize, 1000
- jmp lab29_4
- lab29_5:
- and tmp2, FFFFF000
- add tmp2, 1000
- add SDKsize, tmp2
- jmp lab29_4
- lab29_6:
- add tmp10, 0C
- lab29_7:
- mov tmp2, [tmp10+4]
- cmp tmp2, 0
- je lab29_9
- mov tmp1, [tmp10]
- cmp tmp1, 0
- je lab29_9
- add tmp1, imgbase
- mov [tmp8], tmp1
- add tmp8, 4
- add tmp10, tmp2
- add tmp10, 08
- cmp tmp2, 1000
- ja lab29_8
- add SDKsize, 1000
- jmp lab29_7
- lab29_8:
- and tmp2, FFFFF000
- add tmp2, 1000
- add SDKsize, tmp2
- jmp lab29_7
- lab29_9:
- mov [tmp4], eax
- add tmp7, 1 //counter
- mov tmp1, [ebx]
- add tmp1, imgbase
- mov [tmp5], tmp1
- add tmp4, 4
- add tmp5, 4
- eob lab28_1
- eoe lab28_1
- esto
- lab30:
- mov tmp1, freeloc
- add tmp1, 500 //freeloc+500
- mov tmp2, [tmp1]
- cmp tmp2, 0
- jne lab30_3
- //Decide the structure of jmp table and dump it
- mov tmp2, edi
- mov jmptablesize, 0
- mov tmp1, [edi], 2
- cmp tmp1, 1
- je lab30_2
- mov tmp1, [edi]
- mov tmp3, [edi+8]
- cmp tmp1, tmp3
- jne lab30_1
- mov 57struct, "57A"
- jmp lab30_3
- lab30_1:
- mov 57struct, "57C"
- jmp lab30_3
- lab30_2:
- mov 57struct, "57B"
- //copy data
- lab30_3:
- scmp 57struct, "57A"
- je lab30_4
- scmp 57struct, "57B"
- je lab30_6
- scmp 57struct, "57C"
- je lab30_8
- jmp error
- lab30_4:
- bc 57jmppt
- cob
- coe
- mov tmp1, freeloc
- add tmp1, 100
- mov [tmp1], #609C8BF7BF0005C0008B06394608750F8B4E04890F83C60883C704F2A4EBEA893D400122019D61909090#
- mov tmp1, freeloc
- add tmp1, 100
- add tmp1, 5 //105
- mov tmp2, freeloc
- add tmp2, 500
- mov [tmp1], tmp2
- add tmp1, 1C //121
- mov tmp2, freeloc
- add tmp2, 140
- mov [tmp1], tmp2
- add tmp1, 6 //127--end point
- bp tmp1
- mov ori1, eip
- mov tmp2, freeloc
- add tmp2, 100
- mov eip, tmp2
- run
- cmp eip, tmp1
- jne error
- bc tmp1
- mov tmp2, [freeloc+140]
- mov tmp3, freeloc
- add tmp3, 500
- sub tmp2, tmp3
- mov jmptablesize, tmp2
- mov eip, ori1
- mov tmp2, freeloc
- add tmp2, 100
- fill tmp2, 44, 00
- jmp lab30_12
- lab30_6:
- bc 57jmppt
- cob
- coe
- mov tmp1, freeloc
- add tmp1, 100
- mov [tmp1], #609C8BF7BF0005C9008B460283F800741439460A750F8B4E06890F83C60A83C704F2A4EBE4893D4001C9009D61909000#
- mov tmp1, freeloc
- add tmp1, 100
- add tmp1, 5 //105
- mov tmp2, freeloc
- add tmp2, 500
- mov [tmp1], tmp2
- add tmp1, 22 //127
- mov tmp2, freeloc
- add tmp2, 140
- mov [tmp1], tmp2
- add tmp1, 6 //12D--end point
- bp tmp1
- mov ori1, eip
- mov tmp2, freeloc
- add tmp2, 100
- mov eip, tmp2
- run
- cmp eip, tmp1
- jne error
- bc tmp1
- mov tmp2, [freeloc+140]
- mov tmp3, freeloc
- add tmp3, 500
- sub tmp2, tmp3
- mov jmptablesize, tmp2
- mov eip, ori1
- mov tmp2, freeloc
- add tmp2, 100
- fill tmp2, 44, 00
- jmp lab30_12
- lab30_8:
- mov tmp2, [edi]
- add tmp2, imgbase
- cmp tmp2, ebx
- jne lab30_12
- mov ori1, edi
- find ori1, #0000000000000000#
- mov tmp3, $RESULT
- cmp tmp3, 0
- je error
- sub tmp3, ori1
- mov tmp2, tmp3
- shr tmp2, 2
- shl tmp2, 2
- cmp tmp3, tmp2
- je lab30_9
- shr tmp3, 2
- add tmp3, 1
- shl tmp3, 2
- lab30_9:
- add jmptablesize, tmp3 //bytes to copy
- add jmptablesize, 0C
- mov tmp2, tmp3
- add tmp2, 8
- mov [tmp9], tmp2
- add tmp9, 4
- lab30_10:
- cmp tmp3, 0
- je lab30_11
- mov tmp1, [ori1]
- mov [tmp9], tmp1
- add ori1, 4
- add tmp9, 4
- sub tmp3, 4
- jmp lab30_10
- lab30_11:
- add tmp9, 8 //add 8 bytes for differentiation
- lab30_12:
- eob lab28_1
- eoe lab28_1
- esto
- lab31:
- cmp sdksccount, 0
- je lab32
- //log SDKsize
- //log jmptablesize
- mov tmp1, freeloc
- add tmp1, 500
- dm tmp1, jmptablesize, "jmptable.bin"
- cmp sdksccount, tmp7 //tmp7=number of section with scstk
- je lab31_1
- log tmp7, "SDK section with scstk = "
- mov tmp1, freeloc //Location of full set address
- mov tmp2, tmp1
- add tmp2, 300 //Location of section with scstk
- mov tmp9, xtrascloc //store SDK section without scstk
- add tmp9, 80
- //find out which SDK section need dumping
- loop4:
- mov tmp3, [tmp1]
- cmp tmp3, 0
- je lab31_1 //compare finished
- loop4_1:
- mov tmp4, [tmp2]
- cmp tmp4, 0
- je loop4_2 //not found
- cmp tmp3, tmp4
- je loop4_3 //jmp if found
- add tmp2, 4
- jmp loop4_1
- //section need to be dump manually found
- loop4_2:
- mov tmp6, [tmp1]
- mov tmp5, [tmp6+1]
- add tmp5, tmp6
- add tmp5, 5
- log tmp5, "SDK stolen code section address = "
- mov [tmp9], tmp6 //store SDK section without scstk
- add tmp9, 4
- mov [tmp9], tmp5
- add tmp9, 4
- add tmp1, 4
- mov tmp2, freeloc
- add tmp2, 300 //Location of section with scstk
- jmp loop4
- loop4_3:
- add tmp1, 4
- mov tmp2, freeloc
- add tmp2, 300 //Location of section with scstk
- jmp loop4
- //end compare
- lab31_1:
- fill freeloc, B00, 00
- lab32:
- bc 57pt
- bc 57jmppt
- bc transit1
- cmp !zf, 0
- jne lab41
- sti
- sti
- sti
- mov countaddr, [eax]
- add countaddr, imgbase
- log countaddr, "Delphi initialization table address "
- find dllimgbase, #55FFD784C07504#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- find tmp1, #837D0?0075E5#
- mov tmp3, $RESULT
- cmp tmp3, 0
- je error
- sub tmp3, 2
- mov tmp2, freeloc
- bp tmp3
- mov tmp4, 0 //counter
- eob lab32_1
- eoe lab32_1
- esto
- lab32_1:
- cmp eip, tmp3
- je lab32_2
- esto
- lab32_2:
- mov [tmp2], edx
- cmp tmp4, 2
- je lab32_3
- add tmp2, 4
- add tmp4, 1
- esto
- lab32_3:
- bc tmp3
- cob
- coe
- rtr
- sti
- rtr
- sti
- rtr
- mov tablea, [freeloc]
- mov tableb, [freeloc+4]
- mov decryptaddr, [freeloc+8]
- fill freeloc, 10, 00
- alloc 4000
- mov dataloc, $RESULT
- //log dataloc
- find decryptaddr, #81??????????0F84????00005?5?#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- add tmp1, 0C
- mov paddr1, tmp1
- //log paddr1
- mov ori1, [paddr1]
- mov ori2, [paddr1+4]
- //log ori1
- //log ori2
- find paddr1, #E8????0000#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- mov tmp9, tmp1
- mov tmp2, [tmp1+1]
- add tmp2, tmp1
- add tmp2, 5
- find tmp2, #3B??0F82??FFFFFF#
- mov tmp3, $RESULT
- cmp tmp3, 0
- je error
- mov paddr2, tmp3
- //log paddr2
- mov tmp2, [tmp3+4]
- add tmp2, tmp3
- add tmp2, 8
- mov tmp1, [tmp2], 1
- cmp tmp1, 2B
- je lab32_4
- find tmp2, #2B??#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- cmp paddr2, tmp1
- jb error
- opcode tmp1
- mov tmp5, $RESULT_2
- add tmp5, tmp1
- jmp lab32_9
- lab32_4:
- opcode tmp2
- mov tmp5, $RESULT_2
- add tmp5, tmp2
- lab32_9:
- mov ori3, [paddr2]
- mov tmp1, freeloc
- mov [tmp1], #609CB800004000B900104000BA00204000BB00304000BD00404000BE00504000BF00604000E80001300090909D619090#
- mov tmp1, freeloc
- mov tmp6, imgbase
- add tmp1, 3 //3
- mov [tmp1], tmp6
- add tmp6, 1000
- add tmp1, 5 //8
- mov [tmp1], tmp6
- add tmp6, 1000
- add tmp1, 5 //D
- mov [tmp1], tmp6
- add tmp6, 1000
- add tmp1, 5 //12
- mov [tmp1], tmp6
- add tmp6, 2000
- add tmp1, 5 //17
- mov [tmp1], tmp6
- add tmp6, 1000
- add tmp1, 5 //1C
- mov [tmp1], tmp6
- add tmp6, 1000
- add tmp1, 5 //21
- mov [tmp1], tmp6
- add tmp1, 4 //25
- eval "call 0{tmp5}"
- asm tmp1, $RESULT
- mov [paddr2], #C390#
- mov tmp7, eip
- mov tmp6, esp
- mov eip, freeloc
- bp paddr2
- eob lab33
- eoe lab33
- run
- lab33:
- cmp eip, paddr2
- je lab33_1
- jmp error
- lab33_1:
- bc paddr2
- mov tmp1, tmp6
- sub tmp1, 28
- mov esp, tmp1
- sti
- mov tmp1, imgbase
- cmp eax, tmp1
- je ecxchk
- mov tmp8, eax
- sub tmp8, tmp1
- cmp tmp8, 10
- jbe lab34
- ecxchk:
- add tmp1, 1000
- cmp ecx, tmp1
- je edxchk
- mov tmp8, ecx
- sub tmp8, tmp1
- cmp tmp8, 10
- jbe lab34
- edxchk:
- add tmp1, 1000
- cmp edx, tmp1
- je ebxchk
- mov tmp8, edx
- sub tmp8, tmp1
- cmp tmp8, 10
- jbe lab34
- ebxchk:
- add tmp1, 1000
- cmp ebx, tmp1
- je ebpchk
- mov tmp8, ebx
- sub tmp8, tmp1
- cmp tmp8, 10
- jbe lab34
- ebpchk:
- add tmp1, 2000
- cmp ebp, tmp1
- je esichk
- mov tmp8, ebp
- sub tmp8, tmp1
- cmp tmp8, 10
- jbe lab34
- esichk:
- add tmp1, 1000
- cmp esi, tmp1
- je edichk
- mov tmp8, esi
- sub tmp8, tmp1
- cmp tmp8, 10
- jbe lab34
- edichk:
- add tmp1, 1000
- cmp edi, tmp1
- je edxchk
- mov tmp8, edi
- sub tmp8, tmp1
- cmp tmp8, 10
- jbe lab34
- jmp error
- lab34:
- cob
- coe
- mov tmp1, freeloc
- add tmp1, 2e
- bp tmp1
- run
- cmp eip, tmp1
- jne error
- bc tmp1
- mov eip, tmp7
- mov [paddr2], ori3 //restore code
- fill freeloc, 50, 00
- mov tmp7, eip
- mov tmp1, freeloc
- mov [tmp1], #609CB90000FD01BA00001602BD00001802BE0000170233C08B3983FF00743281FF72E9EFB9741F8BDE03322B312B0390#
- add tmp1, 30 //30
- mov [tmp1], #909090909090909090909090903BDE72EC03C789450083C50883C10883C208EBC0833DA000BA0001741BB90400FD01BA#
- add tmp1, 30 //60
- mov [tmp1], #04001602BD04001802C705A000BA0001000000EB9C9D61909000000000000000#
- mov tmp1, freeloc
- add tmp1, 3 //3
- mov [tmp1], tablea
- add tmp1, 5 //8
- mov [tmp1], tableb
- add tmp1, 5 //D
- mov [tmp1], dataloc
- add tmp1, 5 //12
- mov [tmp1], decryptaddr
- find tablea, #0000000000000000#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- mov dataendaddr, tmp2
- sub tmp2, 8
- mov tmp3, [tmp2] //data limit
- add tmp1, 0F //21
- mov [tmp1], tmp3
- add tmp1, 10 //31
- eval "add ebx, 0{tmp8}"
- asm tmp1, $RESULT
- mov tmp3, freeloc
- add tmp3, A0
- add tmp1, 22 //53
- mov [tmp1], tmp3
- add tmp1, 8 //5B
- mov tmp2, tablea
- add tmp2, 4
- mov [tmp1], tmp2
- add tmp1, 5 //60
- mov tmp2, tableb
- add tmp2, 4
- mov [tmp1], tmp2
- add tmp1, 5 //65
- mov tmp2, dataloc
- add tmp2, 4
- mov [tmp1], tmp2
- add tmp1, 6 //6B
- mov [tmp1], tmp3
- mov tmp5, freeloc
- add tmp5, 77 //end point
- mov eip, freeloc
- bp tmp5
- eob lab34_1
- eoe lab34_1
- esto
- lab34_1:
- cmp eip, tmp5
- je lab34_2
- esto
- lab34_2:
- bc tmp5
- mov eip, tmp7
- fill freeloc, 100, 00
- find paddr2, #5?5?5?E9??F?FFFF#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- mov paddr3, tmp1
- //log paddr3
- find paddr1, #FFD0# //"call eax" ?
- mov paddr4, $RESULT
- cmp paddr4, 0
- je tryecx
- cmp paddr4, paddr2
- jb iscalleax
- tryecx:
- find paddr1, #FFD1# //"call ecx" ?
- mov paddr4, $RESULT
- cmp paddr4, 0
- je tryedx
- cmp paddr4, paddr2
- jb iscallecx
- tryedx:
- find paddr1, #FFD2# //"call edx" ?
- mov paddr4, $RESULT
- cmp paddr4, 0
- je tryebx
- cmp paddr4, paddr2
- jb iscalledx
- tryebx:
- find paddr1, #FFD3# //"call ebx" ?
- mov paddr4, $RESULT
- cmp paddr4, 0
- je tryesp
- cmp paddr4, paddr2
- jb iscallebx
- tryesp:
- find paddr1, #FFD4# //"call esp" ?
- mov paddr4, $RESULT
- cmp paddr4, 0
- je tryebp
- cmp paddr4, paddr2
- jb iscallesp
- tryebp:
- find paddr1, #FFD5# //"call ebp" ?
- mov paddr4, $RESULT
- cmp paddr4, 0
- je tryesi
- cmp paddr4, paddr2
- jb iscallebp
- tryesi:
- find paddr1, #FFD6# //"call esi" ?
- mov paddr4, $RESULT
- cmp paddr4, 0
- je tryedi
- cmp paddr4, paddr2
- jb iscallesi
- tryedi:
- find paddr1, #FFD7# //"call edi" ?
- mov paddr4, $RESULT
- cmp paddr4, 0
- je hexfind2
- cmp paddr4, paddr2
- jb iscalledi
- hexfind2:
- log tmp9
- mov tmp1, [tmp9+1]
- add tmp1, tmp9
- sub tmp1, 50
- mov tmp4, 50
- loop5:
- cmp tmp4, 0
- je error
- mov tmp2, [tmp1]
- and tmp2, f0ff
- cmp tmp2, 0000D0ff
- je hexfound2
- sub tmp4, 1
- add tmp1, 1
- jmp loop5
- hexfound2:
- mov paddr4, tmp1
- //log paddr4
- mov tmp2, [paddr4+1]
- and tmp2, 0f
- cmp tmp2, 0
- je iscalleax
- cmp tmp2, 1
- je iscallecx
- cmp tmp2, 2
- je iscalledx
- cmp tmp2, 3
- je iscallebx
- cmp tmp2, 4
- je iscallesp
- cmp tmp2, 5
- je iscallebp
- cmp tmp2, 6
- je iscallesi
- cmp tmp2, 7
- je iscalledi
- jmp error
- iscalleax:
- mov caller1, "eax"
- jmp lab35
- iscallecx:
- mov caller1, "ecx"
- jmp lab35
- iscalledx:
- mov caller1, "edx"
- jmp lab35
- iscallebx:
- mov caller1, "ebx"
- jmp lab35
- iscallesp:
- mov caller1, "esp"
- jmp lab35
- iscallebp:
- mov caller1, "ebp"
- jmp lab35
- iscallesi:
- mov caller1, "esi"
- jmp lab35
- iscalledi:
- mov caller1, "edi"
- lab35:
- //log paddr4
- mov paddr5, paddr1
- sub paddr5, 4
- mov ori6, [paddr5]
- mov tmp1, freeloc
- mov tmp2, freeloc
- add tmp2, 100 //freeloc+100
- mov [tmp2], dataloc
- mov tmp3, tmp2
- add tmp3, 4 //freeloc+104
- mov tmp5, dataloc
- add tmp5, 2008
- mov [tmp3], tmp5
- mov tmp4, freeloc
- add tmp4, 7A //freeloc+7A
- mov [tmp1], #609C68000040006800001602680000FD01E8EAFF5C01832D0401BA0004C6057A00BA002DC605D800BA002DC7050001BA#
- add tmp1, 30 //30
- mov [tmp1], #000400180268000040006804001602680400FD01E8B2FF5C01EB5590000000008B050001BA008B00909083050001BA00#
- add tmp1, 30 //60
- mov [tmp1], #0890E92C015D01000000000000009090538B1D0401BA00890383050401BA00085B909090909090909090909090909090#
- add tmp1, 30 //90
- mov [tmp1], #00000000000000000000000000000000BE00201802BFD8214D00B92E010000F2A5B8D8214D00C70096000000C74004E0#
- add tmp1, 30 //C0
- mov [tmp1], #214D009D61909000000000000000009083050001BA000883050401BA0008E9B8005D0100000000000000000000000000#
- mov tmp1, freeloc
- add tmp1, 3
- mov [tmp1], imgbase
- add tmp1, 5 //8
- mov [tmp1], tableb
- add tmp1, 5 //0D
- mov [tmp1], tablea
- add tmp1, 4 //11
- eval "call 0{decryptaddr}"
- asm tmp1, $RESULT
- add tmp1, 7 //18
- mov [tmp1], tmp3
- add tmp1, 7 //1F
- mov [tmp1], tmp4 //tmp4=freeloc+7A
- add tmp1, 7 //26
- add tmp4, 5E //tmp4=freeloc+D8
- mov [tmp1], tmp4
- add tmp1, 7 //2D
- mov [tmp1], tmp2
- add tmp1, 4 //31
- mov tmp5, dataloc
- add tmp5, 4
- mov [tmp1], tmp5
- add tmp1, 5 //36
- mov [tmp1], imgbase
- add tmp1, 5 //3B
- mov tmp5, tableb
- add tmp5, 4
- mov [tmp1], tmp5
- add tmp1, 5 //40
- mov tmp5, tablea
- add tmp5, 4
- mov [tmp1], tmp5
- add tmp1, 4 //44
- eval "call 0{decryptaddr}"
- asm tmp1, $RESULT
- add tmp1, 0E //52
- mov [tmp1], tmp2
- add tmp1, A //5C
- mov [tmp1], tmp2
- add tmp1, 5 //61
- eval "jmp 0{paddr3}"
- asm tmp1, $RESULT
- add tmp1, 12 //73
- mov [tmp1], tmp3
- add tmp1, 8 //7B
- mov [tmp1], tmp3
- mov tmp5, freeloc
- add tmp5, 50
- eval "jmp 0{tmp5}"
- asm paddr1, $RESULT
- mov tmp1, freeloc
- add tmp1, 50 //50
- scmpi caller1, "eax"
- je lab35_1
- scmpi caller1, "ecx"
- je writeecx
- scmpi caller1, "edx"
- je writeedx
- scmpi caller1, "ebx"
- je writeebx
- scmpi caller1, "esp"
- je writeesp
- scmpi caller1, "ebp"
- je writeebp
- scmpi caller1, "esi"
- je writeesi
- scmpi caller1, "edi"
- je writeedi
- jmp error
- writeecx:
- mov [tmp1], #8B0D#
- add tmp1, 6 //56
- asm tmp1, "mov ecx, [ecx]"
- add tmp1, 21 //77
- mov [tmp1], #890B#
- jmp lab35_1
- writeedx:
- mov [tmp1], #8B15#
- add tmp1, 6 //56
- asm tmp1, "mov edx, [edx]"
- add tmp1, 21 //77
- mov [tmp1], #8913#
- jmp lab35_1
- writeebx:
- mov [tmp1], #8B1D#
- add tmp1, 6 //56
- asm tmp1, "mov ebx, [ebx]"
- add tmp1, 1A //70
- asm tmp1, "push eax"
- add tmp1, 1 //71
- mov [tmp1], #8B05#
- add tmp1, 6 //77
- mov [tmp1], #8918#
- add tmp1, 9 //80
- asm tmp1, "pop eax"
- jmp lab35_1
- writeesp:
- mov [tmp1], #8B25#
- add tmp1, 6 //56
- asm tmp1, "mov esp, [esp]"
- add tmp1, 21 //77
- mov [tmp1], #8923#
- jmp lab35_1
- writeebp:
- mov [tmp1], #8B2D#
- add tmp1, 6 //56
- mov [tmp1], #8B6D0090#
- add tmp1, 21 //77
- mov [tmp1], #892B#
- jmp lab35_1
- writeesi:
- mov [tmp1], #8B35#
- add tmp1, 6 //56
- asm tmp1, "mov esi, [esi]"
- add tmp1, 21 //77
- mov [tmp1], #8933#
- jmp lab35_1
- writeedi:
- mov [tmp1], #8B3D#
- add tmp1, 6 //56
- asm tmp1, "mov edi, [edi]"
- add tmp1, 21 //77
- mov [tmp1], #893B#
- lab35_1:
- mov tmp1, freeloc
- add tmp1, 83 //83
- mov ori3, [paddr4]
- mov ori4, [paddr4+4]
- mov ori5, [paddr4+8]
- mov tmp5, paddr4
- add tmp5, 2
- opcode tmp5
- mov tmp4, $RESULT_2 //length of 1st cmd after call reg
- cmp tmp4, 3
- jae lab35_14
- cmp tmp4, 1
- je lab35_3
- //length of 1st cmd = 2
- mov tmp6, [tmp5], 2
- cmp tmp6, 1EB
- je lab35_2
- cmp tmp6, 2EB
- jne lab35_4
- lab35_2:
- mov tmp3, [tmp5+1], 1
- add tmp4, tmp3
- add tmp4, tmp5
- eval "jmp 0{tmp4}"
- asm tmp1, $RESULT
- jmp lab36_1
- //length of 1st cmd = 1
- lab35_3:
- mov tmp3, [tmp5]
- and tmp3, 00F0FFF0
- cmp tmp3, 0EBF0 //"prefix ??", "jmp ???????"
- jne lab35_4
- mov tmp3, [tmp5+2], 1
- add tmp3, tmp5
- add tmp3, tmp4
- add tmp3, 2
- eval "jmp 0{tmp3}"
- asm tmp1, $RESULT
- jmp lab36_1
- //2nd cmd after call reg
- lab35_4:
- mov tmp6, tmp5
- add tmp6, tmp4
- opcode tmp6
- mov tmp8, $RESULT_2 //length of 2nd cmd after call reg
- mov tmp2, tmp4
- add tmp4, tmp8
- cmp tmp8, 2
- je lab35_5
- cmp tmp8, 3
- je lab35_7
- cmp tmp4, 3
- jae copybyte
- jmp lab35_9
- //length of 2nd cmd = 2
- lab35_5:
- mov tmp3, [tmp6], 2
- cmp tmp3, 1EB
- je lab35_6
- cmp tmp3, 2EB
- je lab35_6
- cmp tmp4, 3
- jae copybyte
- jmp lab35_9
- lab35_6:
- opcode tmp5
- mov tmp3, $RESULT_1
- eval "{tmp3}"
- asm tmp1, $RESULT
- add tmp1, tmp8
- mov tmp3, 0 //For Odbgscript compatibility
- mov tmp3, [tmp6+1], 1
- add tmp2, tmp3
- add tmp2, tmp8
- add tmp2, tmp5
- eval "jmp 0{tmp2}"
- asm tmp1, $RESULT
- jmp lab36_1
- //length of 2nd cmd = 3
- lab35_7:
- mov tmp3, [tmp6+1], 2
- cmp tmp3, 1EB
- je lab35_8
- cmp tmp3, 2EB
- je lab35_8
- cmp tmp4, 3
- jae copybyte
- jmp lab35_9
- lab35_8:
- opcode tmp5
- mov tmp3, $RESULT_1
- eval "{tmp3}"
- asm tmp1, $RESULT
- add tmp1, tmp8
- mov tmp3, 0 //For Odbgscript compatibility
- mov tmp3, [tmp6+2], 1
- add tmp2, tmp3
- add tmp2, tmp8
- add tmp2, tmp5
- eval "jmp 0{tmp2}"
- asm tmp1, $RESULT
- jmp lab36_1
- //3rd cmd after call reg
- lab35_9:
- mov tmp7, tmp6
- add tmp7, tmp8
- opcode tmp7
- mov tmp9, $RESULT_2 //length of 3rd cmd after call reg
- add tmp4, tmp9
- cmp tmp9, 2
- je lab35_10
- cmp tmp9, 3
- je lab35_12
- jmp copybyte
- //length of 3rd cmd = 2
- lab35_10:
- mov tmp3, [tmp7], 2
- cmp tmp3, 1EB
- je lab35_11
- cmp tmp3, 2EB
- je lab35_11
- jmp copybyte
- lab35_11:
- mov tmp3, [tmp5], 2
- mov [tmp1], tmp3
- add tmp1, 2
- mov tmp3, [tmp7+1], 1
- add tmp2, tmp3
- add tmp2, tmp8
- add tmp2, tmp9
- add tmp2, tmp5
- eval "jmp 0{tmp2}"
- asm tmp1, $RESULT
- jmp lab36_1
- //length of 3rd cmd = 3
- lab35_12:
- mov tmp3, [tmp7+1], 2
- cmp tmp3, 1EB
- je lab35_13
- cmp tmp3, 2EB
- je lab35_13
- jmp copybyte
- lab35_13:
- mov tmp3, [tmp5], 2
- mov [tmp1], tmp3
- add tmp1, 2
- mov tmp3, [tmp7+2], 1
- add tmp2, tmp3
- add tmp2, tmp8
- add tmp2, tmp9
- add tmp2, tmp5
- eval "jmp 0{tmp2}"
- asm tmp1, $RESULT
- jmp lab36_1
- //one command to copy
- lab35_14:
- cmp tmp4, 3
- jne copybyte
- //length of 1st cmd = 3
- mov tmp3, [tmp5+1]
- and tmp3, 0F0FF
- cmp tmp3, EB
- je lab35_15
- jmp copybyte
- lab35_15:
- mov tmp3, [tmp5+2], 1
- add tmp3, tmp5
- add tmp3, tmp4
- eval "jmp 0{tmp3}"
- asm tmp1, $RESULT
- jmp lab36_1
- copybyte:
- mov tmp6, tmp5 //paddr4+2
- mov tmp7, tmp1 //patch addr in freeloc
- mov tmp3, tmp4 //ttl bytes to copy
- shr tmp3, 2
- mov tmp2, tmp3
- shl tmp2, 2
- cmp tmp4, tmp2
- je copybyte_1
- add tmp3, 1
- copybyte_1:
- cmp tmp3, 0
- je lab36
- mov tmp2, [tmp6]
- mov [tmp7], tmp2
- sub tmp3, 1
- add tmp6, 4
- add tmp7, 4
- jmp copybyte_1
- lab36:
- add tmp1, tmp4
- add tmp5, tmp4
- eval "jmp 0{tmp5}"
- asm tmp1, $RESULT
- lab36_1:
- mov tmp1, freeloc
- add tmp1, 70
- eval "jmp 0{tmp1}"
- asm paddr4, $RESULT
- //
- mov tmp1, freeloc
- add tmp1, D2
- mov tmp2, freeloc
- add tmp2, 100
- mov [tmp1], tmp2
- add tmp1, 7 //D9
- add tmp2, 4
- mov [tmp1], tmp2
- add tmp1, 5 //DE
- mov tmp2, paddr5
- sub tmp2, 2
- mov tmp3, tmp2
- add tmp2, ori6
- add tmp2, 6
- eval "jmp 0{tmp2}"
- asm tmp1, $RESULT
- mov tmp1, freeloc
- add tmp1, D0
- eval "jz 0{tmp1}"
- asm tmp3, $RESULT
- //for move data
- mov tmp1, freeloc
- add tmp1, 0A1 //A1
- mov tmp2, dataloc
- add tmp2, 2000
- mov [tmp1], tmp2
- add tmp1, 5 //A6
- mov [tmp1], countaddr
- add tmp1, 5 //AB
- mov tmp2, dataendaddr
- sub tmp2, tablea
- add tmp2, 8
- shr tmp2, 2
- mov [tmp1], tmp2
- add tmp1, 7 //B2
- mov [tmp1], countaddr
- add tmp1, 6 //B8
- mov tmp2, dataendaddr
- sub tmp2, tablea
- shr tmp2, 3
- mov [tmp1], tmp2
- add tmp1, 7 //BF
- mov tmp2, countaddr
- add tmp2, 8
- mov [tmp1], tmp2
- mov tmp7, eip
- mov eip, freeloc
- mov tmp1, freeloc
- add tmp1, C5 //end point
- bp tmp1
- eob lab36_2
- eoe lab36_2
- esto
- lab36_2:
- cmp eip, tmp1
- je lab36_3
- esto
- lab36_3:
- bc tmp1
- //Restore original code
- mov tmp2, paddr1
- mov [tmp2], ori1
- add tmp2, 4
- mov [tmp2], ori2
- mov tmp2, paddr4
- mov [tmp2], ori3
- add tmp2, 4
- mov [tmp2], ori4
- add tmp2, 4
- mov [tmp2], ori5
- mov [paddr5], ori6
- mov caller1, "nil"
- mov eip, tmp7
- //msg "Delphi initialization table moved"
- fill freeloc, 110, 00
- jmp lab41_1
- lab41:
- cob
- coe
- rtr
- lab41_1:
- cmp type3API, 0
- je lab46
- //fix type3 API
- mov tmp4, APIpoint3
- sub tmp4, 100
- find tmp4, #05FF000000508BC3#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- add tmp1, 8
- //log tmp1
- GCI tmp1, DESTINATION
- mov func1, $RESULT
- //log func1
- add tmp1, 5
- find tmp1, #8BC3E8??#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- add tmp2, 2
- GCI tmp2, DESTINATION
- mov func2, $RESULT
- //log func2
- add tmp2, 5
- find tmp2, #8BC3E8??#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- add tmp1, 2
- GCI tmp1, DESTINATION
- mov func3, $RESULT
- //log func3
- mov tmp3, [tmp1-D], 1
- cmp tmp3, 50
- je lab42
- mov v1.32, 1
- //log v1.32
- lab42:
- mov tmp1, freeloc
- mov [tmp1], #60BB6806CA00BD000DC4008B73548D7B408B43188945608B83E000000089453433C08A078D04408B4C83688BC6FFD18B#
- add tmp1, 30 //30
- mov [tmp1], #C8034B24038BE000000033C08A47098D04408B5483688BC6FFD2807B20000F854C0100003C010F8544010000894D7033#
- add tmp1, 30 //60
- mov [tmp1], #C08A47078D04408B5483688BC6FFD289452433C08A47088D04408B5483688BC6FFD289452833C08A47028D04408B5483#
- add tmp1, 30 //90
- mov [tmp1], #688BC6FFD289453C33C08A47068D04408B5483688BC6FFD28845408B83E000000001453C8B453C5033C08A454005FF00#
- add tmp1, 30 //C0
- mov [tmp1], #0000508BC3E85A6A03008BC88B53108BC3E8725803008B552403553403D08955248B55282B55342BD089552833C08A47#
- add tmp1, 30 //F0
- mov [tmp1], #038D04408B5483688BC6FFD28945348B83E000000001453433C08A47018D04408B5483688BC6FFD28845388D452C5066#
- add tmp1, 30 //120
- mov [tmp1], #8B4D24668B55288BC3E8126503008B552C0393E0000000909090909060E82E00000066B9FF153E8A4538363A434A7405#
- add tmp1, 30 //150
- mov [tmp1], #6681C100108B457066890883C002893061EB3A00000000000000000000000090BEE02150003916740D83C60481FE3C2A#
- add tmp1, 30 //180
- mov [tmp1], #0210770FEBEF81EE0000400081C600004000C390900000000000000000FF4568FF4D6003B3E4000000837D60000F876D#
- add tmp1, 30 //1B0
- mov [tmp1], #FEFFFF6190#
- mov tmp1, freeloc
- mov tmp2, freeloc
- add tmp2, 0D00 //freeloc+D00
- mov tmp3, freeloc
- add tmp3, 0D68 //freeloc+D68
- add tmp1, 2 //2
- mov [tmp1], EBXaddr
- add tmp1, 5 //7
- mov [tmp1], tmp2
- add tmp1, BE //C5
- eval "call 0{func1}"
- asm tmp1, $RESULT
- add tmp1, 0C //D1
- eval "call 0{func2}"
- asm tmp1, $RESULT
- add tmp1, 58 //129
- eval "call 0{func3}"
- asm tmp1, $RESULT
- add tmp1, 48 //171
- mov [tmp1], iatstartaddr
- add tmp1, D //17E
- mov [tmp1], iatendaddr
- add tmp1, A //188
- mov [tmp1], imgbase
- add tmp1, 6 //18E
- mov [tmp1], imgbasefromdisk
- add tmp1, 5 //193 error point
- mov tmp5, tmp1
- bp tmp5
- add tmp1, 21 //1B4 end point
- mov tmp6, tmp1
- bp tmp6
- mov tmp7, eip //store eip
- cmp v1.32, 1
- jne lab43
- mov tmp1, freeloc
- add tmp1, 11B //freeloc+11B
- mov [tmp1], #90909090#
- add tmp1, 13 //freeloc+12E
- mov [tmp1], #8BD090909090909090#
- lab43:
- mov eip, freeloc
- eob lab44
- eoe lab44
- run
- lab44:
- cmp eip, tmp5 //error
- je lab60
- cmp eip, tmp6 //OK
- je lab45
- jmp error
- lab45:
- bc tmp5
- bc tmp6
- //msg "fix type3 API OK!"
- //pause
- mov type3count, [tmp3]
- //log type3count
- fill freeloc, 0E00, 00
- mov eip, tmp7 //restore eip
- lab46:
- cmp AsprAPIloc, 0
- je lab52
- cmp Aspr1stthunk, 0 //VB app ?
- je lab52
- mov count, 120 //Need free space 120 bytes for 2.xx
- call FindEMUAddr
- //call EmulateAsprAPI
- //$$$ fix Asprotect API $$$
- lab46_1:
- //chk number of API
- mov tmp5, 0 //counter
- mov tmp6, Aspr1stthunk
- mov tmp1, AsprAPIloc
- add tmp1, 4
- mov caller, "lab46_1"
- lab46_2:
- mov tmp2, [tmp1]
- GMEMI tmp2, MEMORYOWNER
- mov tmp3, $RESULT
- cmp tmp3, dllimgbase
- jne lab46_3
- add tmp5, 1
- add tmp1, 4
- jmp lab46_2
- lab46_3:
- log tmp5, "Total API in this Asprotect = "
- //Emulate Aspr API
- lab47:
- mov tmp10, 0
- cmp tmp5, 0B
- je loop8
- cmp tmp5, 0C
- je loop9
- cmp tmp5, 0D
- je loop10
- msg "unknown Asprotect API"
- jmp error
- //Asprotect 2.3 build01.14
- loop8:
- mov tmp7, AsprAPIloc
- scmp caller, "lab84"
- je loop8_2
- mov tmp1, [tmp6]
- GMEMI tmp1, MEMORYOWNER
- mov tmp2, $RESULT
- cmp tmp2, dllimgbase
- jne lab48
- mov tmp8, 0 //reset counter
- loop8_1:
- cmp tmp8, tmp5 //compare all the API in AsprAPIloc?
- ja error
- mov tmp2, [tmp7] //AsprAPIloc
- cmp tmp1, tmp2
- je loop8_3
- add tmp7, 4
- add tmp8, 1
- jmp loop8_1
- loop8_2:
- mov tmp1, [tmp6]
- cmp tmp1, 0
- je lab48
- mov tmp8, [tmp6+4]
- //0-GetRegistrationKeys,1-GetRegistrationInformation,2-CheckKey,3-CheckKeyAndDecrypt
- //4-GetKeyDate,5-GetKeyExpirationDate,6-GetTrialDays,7-GetTrialExecs
- //8-GetExpirationDate,9-GetModeInformation,A-GetHardwareID,B-SetUserKey
- loop8_3:
- cmp tmp8, 1
- je B_GRI
- cmp tmp8, 2
- je B_CK
- cmp tmp8, 3
- je B_CKAD
- cmp tmp8, 4
- je B_GKD
- cmp tmp8, 5
- je B_GKED
- cmp tmp8, 6
- je B_GTD
- cmp tmp8, 7
- je B_GTE
- cmp tmp8, 8
- je B_GED
- cmp tmp8, 9
- je B_GMI
- cmp tmp8, 0A
- je B_GHI
- msg "This API is not emulated"
- //pause
- scmp caller, "lab84"
- je loop8_4
- add tmp6, 4
- jmp loop8
- loop8_4:
- add tmp6, 8
- jmp loop8
- //GetRegistrationInformation
- B_GRI:
- mov tmp3, EmuAddr
- mov [tmp3], #8B442408C700909090008B44240CC70090909000B801000000C20C00#
- add tmp3, 6
- mov tmp4, EmuAddr
- add tmp4, 20
- mov [tmp4], #313131313232323233333333# //111122223333
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- cmp isdll, 1
- jne B_GRI_1
- mov tmp9, EmuAddr
- add tmp9, 6
- call DLLASPRAPI
- B_GRI_1:
- add tmp3, 0A
- mov tmp4, EmuAddr
- add tmp4, 30
- cmp isdll, 1
- jne B_GRI_2
- mov tmp9, EmuAddr
- add tmp9, 10
- call DLLASPRAPI
- B_GRI_2:
- mov [tmp4], #04000000566F6C58#
- add tmp4, 4
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- log EmuAddr, "GetRegistrationInformation "
- scmp caller, "lab84"
- je B_GRI_3
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 40
- add tmp6, 4
- jmp loop8
- B_GRI_3:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 40
- add tmp6, 8
- jmp loop8
- //CheckKey
- B_CK:
- mov tmp3, EmuAddr
- mov [tmp3], #B801000000C20C00#
- log EmuAddr, "CheckKey "
- scmp caller, "lab84"
- je B_CK_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 10
- add tmp6, 4
- jmp loop8
- B_CK_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 10
- add tmp6, 8
- jmp loop8
- //CheckKeyAndDecrypt
- B_CKAD:
- mov tmp3, EmuAddr
- mov [tmp3], #B801000000C20C00#
- log EmuAddr, "CheckKeyAndDecrypt "
- scmp caller, "lab84"
- je B_CKAD_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 10
- add tmp6, 4
- jmp loop8
- B_CKAD_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 10
- add tmp6, 8
- jmp loop8
- //GetKeyDate
- B_GKD:
- mov tmp3, EmuAddr
- mov [tmp3], #8B44240866C70001008B44240C66C70001008B44241066C700D707B801000000C21000#
- log EmuAddr, "GetKeyDate "
- scmp caller, "lab84"
- je B_GKD_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 30
- add tmp6, 4
- jmp loop8
- B_GKD_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 30
- add tmp6, 8
- jmp loop8
- //GetKeyExpirationDate
- B_GKED:
- mov tmp3, EmuAddr
- mov [tmp3], #8B44240866C7001E008B44240C66C7000C008B44241066C7006B08B801000000C21000#
- log EmuAddr, "GetKeyExpirationDate "
- scmp caller, "lab84"
- je B_GKED_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 30
- add tmp6, 4
- jmp loop8
- B_GKED_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 30
- add tmp6, 8
- jmp loop8
- //GetTrialDays
- B_GTD:
- mov tmp3, EmuAddr
- mov [tmp3], #8B442408C7001E0000008B44240CC7001E000000B801000000C20C00#
- log EmuAddr, "GetTrialDays "
- scmp caller, "lab84"
- je B_GTD_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 20
- add tmp6, 4
- jmp loop8
- B_GTD_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 20
- add tmp6, 8
- jmp loop8
- //GetTrialExecs
- B_GTE:
- mov tmp3, EmuAddr
- mov [tmp3], #8B442408C7001E0000008B44240CC7001E000000B801000000C20C00#
- log EmuAddr, "GetTrialExecs "
- scmp caller, "lab84"
- je B_GTE_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 20
- add tmp6, 4
- jmp loop8
- B_GTE_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 20
- add tmp6, 8
- jmp loop8
- //GetExpirationDate
- B_GED:
- mov tmp3, EmuAddr
- mov [tmp3], #8B44240866C7001E008B44240C66C7000C008B44241066C7006B08B801000000C21000#
- log EmuAddr, "GetExpirationDate "
- scmp caller, "lab84"
- je B_GED_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 30
- add tmp6, 4
- jmp loop8
- B_GED_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 30
- add tmp6, 8
- jmp loop8
- //GetModeInformation
- B_GMI:
- mov tmp3, EmuAddr
- mov [tmp3], #8B442408C700909090008B44240CC70090909000B801000000C20C00#
- add tmp3, 6
- mov tmp4, EmuAddr
- add tmp4, 20
- mov [tmp4], #53697465204C6963656E7365# //Site license
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- cmp isdll, 1
- jne B_GMI_1
- mov tmp9, EmuAddr
- add tmp9, 6
- call DLLASPRAPI
- B_GMI_1:
- add tmp3, 0A
- mov tmp4, EmuAddr
- add tmp4, 30
- mov [tmp4], #030000000#
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- cmp isdll, 1
- jne B_GMI_2
- mov tmp9, EmuAddr
- add tmp9, 10
- call DLLASPRAPI
- B_GMI_2:
- log EmuAddr, "GetModeInformation "
- scmp caller, "lab84"
- je B_GMI_3
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 40
- add tmp6, 4
- jmp loop8
- B_GMI_3:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 40
- add tmp6, 8
- jmp loop8
- //GetHardwareID
- B_GHI:
- mov tmp3, EmuAddr
- mov [tmp3], #B890909000C3#
- add tmp3, 1
- mov tmp4, EmuAddr
- add tmp4, 10
- mov [tmp4], #31323334353637382D34343434#
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- log EmuAddr, "GetHardwareID "
- cmp isdll, 1
- jne B_GHI_1
- mov tmp9, EmuAddr
- add tmp9, 1
- call DLLASPRAPI
- B_GHI_1:
- scmp caller, "lab84"
- je B_GHI_2
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 20
- add tmp6, 4
- jmp loop8
- B_GHI_2:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 20
- add tmp6, 8
- jmp loop8
- //Asprotect v2.11
- loop9:
- mov tmp7, AsprAPIloc
- scmp caller, "lab84"
- je loop9_2
- mov tmp1, [tmp6]
- GMEMI tmp1, MEMORYOWNER
- mov tmp2, $RESULT
- cmp tmp2, dllimgbase
- jne lab48
- mov tmp8, 0 //reset counter
- loop9_1:
- cmp tmp8, tmp5 //compare all the API in AsprAPIloc?
- ja error
- mov tmp2, [tmp7] //AsprAPIloc
- cmp tmp1, tmp2
- je loop9_3
- add tmp7, 4
- add tmp8, 1
- jmp loop9_1
- loop9_2:
- //log tmp6
- mov tmp1, [tmp6]
- cmp tmp1, 0
- je lab48
- mov tmp8, [tmp6+4]
- //0-GetRegistrationKeys,1-GetRegistrationInformation,2-SaveKey,3-CheckKey
- //4-CheckKeyAndDecrypt,5-GetKeyDate,6-GetKeyExpirationDate,7-GetTrialDays
- //8-GetTrialExecs,9-GetExpirationDate,A-GetModeInformation,B-GetHardwareID
- //C-SetUserKey
- loop9_3:
- cmp tmp8, 1
- je C_GRI
- cmp tmp8, 3
- je C_CK
- cmp tmp8, 4
- je C_CKAD
- cmp tmp8, 5
- je C_GKD
- cmp tmp8, 6
- je C_GKED
- cmp tmp8, 7
- je C_GTD
- cmp tmp8, 8
- je C_GTE
- cmp tmp8, 9
- je C_GED
- cmp tmp8, 0A
- je C_GMI
- cmp tmp8, 0B
- je C_GHI
- msg "This API is not emulated"
- //pause
- scmp caller, "lab84"
- je loop9_4
- add tmp6, 4
- jmp loop9
- loop9_4:
- add tmp6, 8
- jmp loop9
- //GetRegistrationInformation
- C_GRI:
- mov tmp3, EmuAddr
- mov [tmp3], #8B442404C700909090008B442408C70090909000B801000000C20800#
- add tmp3, 6
- mov tmp4, EmuAddr
- add tmp4, 20
- mov [tmp4], #313131313232323233333333# //111122223333
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- cmp isdll, 1
- jne C_GRI_1
- mov tmp9, EmuAddr
- add tmp9, 6
- call DLLASPRAPI
- C_GRI_1:
- add tmp3, 0A
- mov tmp4, EmuAddr
- add tmp4, 30
- cmp isdll, 1
- jne C_GRI_2
- mov tmp9, EmuAddr
- add tmp9, 10
- call DLLASPRAPI
- C_GRI_2:
- mov [tmp4], #04000000566F6C58#
- add tmp4, 4
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- log EmuAddr, "GetRegistrationInformation "
- scmp caller, "lab84"
- je C_GRI_3
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 40
- add tmp6, 4
- jmp loop9
- C_GRI_3:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 40
- add tmp6, 8
- jmp loop9
- //CheckKey
- C_CK:
- mov tmp3, EmuAddr
- mov [tmp3], #B801000000C20800#
- log EmuAddr, "CheckKey "
- scmp caller, "lab84"
- je C_CK_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 10
- add tmp6, 4
- jmp loop9
- C_CK_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 10
- add tmp6, 8
- jmp loop9
- //CheckKeyAndDecrypt
- C_CKAD:
- mov tmp3, EmuAddr
- mov [tmp3], #B801000000C20C00#
- log EmuAddr, "CheckKeyAndDecrypt "
- scmp caller, "lab84"
- je C_CKAD_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 10
- add tmp6, 4
- jmp loop9
- C_CKAD_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 10
- add tmp6, 8
- jmp loop9
- //GetKeyDate
- C_GKD:
- mov tmp3, EmuAddr
- mov [tmp3], #8B44240866C70001008B44240C66C70001008B44241066C700D707B801000000C20C00#
- log EmuAddr, "GetKeyDate "
- scmp caller, "lab84"
- je C_GKD_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 30
- add tmp6, 4
- jmp loop9
- C_GKD_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 30
- add tmp6, 8
- jmp loop9
- //GetKeyExpirationDate
- C_GKED:
- mov tmp3, EmuAddr
- mov [tmp3], #8B44240866C7001E008B44240C66C7000C008B44241066C7006B08B801000000C20C00#
- log EmuAddr, "GetKeyExpirationDate "
- scmp caller, "lab84"
- je C_GKED_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 30
- add tmp6, 4
- jmp loop9
- C_GKED_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 30
- add tmp6, 8
- jmp loop9
- //GetTrialDays
- C_GTD:
- mov tmp3, EmuAddr
- mov [tmp3], #8B442404C7001E0000008B442408C7001E000000B801000000C20800#
- log EmuAddr, "GetTrialDays "
- scmp caller, "lab84"
- je C_GTD_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 20
- add tmp6, 4
- jmp loop9
- C_GTD_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 20
- add tmp6, 8
- jmp loop9
- //GetTrialExecs
- C_GTE:
- mov tmp3, EmuAddr
- mov [tmp3], #8B442404C7001E0000008B442408C7001E000000B801000000C20800#
- log EmuAddr, "GetTrialExecs "
- scmp caller, "lab84"
- je C_GTE_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 20
- add tmp6, 4
- jmp loop9
- C_GTE_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 20
- add tmp6, 8
- jmp loop9
- //GetExpirationDate
- C_GED:
- mov tmp3, EmuAddr
- mov [tmp3], #8B44240866C7001E008B44240C66C7000C008B44241066C7006B08B801000000C20C00#
- log EmuAddr, "GetExpirationDate "
- scmp caller, "lab84"
- je C_GED_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 30
- add tmp6, 4
- jmp loop9
- C_GED_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 30
- add tmp6, 8
- jmp loop9
- //GetModeInformation
- C_GMI:
- mov tmp3, EmuAddr
- mov [tmp3], #8B442404C700909090008B442408C70090909000B801000000C20C00#
- add tmp3, 6
- mov tmp4, EmuAddr
- add tmp4, 20
- mov [tmp4], #53697465204C6963656E7365# //Site license
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- cmp isdll, 1
- jne C_GMI_1
- mov tmp9, EmuAddr
- add tmp9, 6
- call DLLASPRAPI
- C_GMI_1:
- add tmp3, 0A
- mov tmp4, EmuAddr
- add tmp4, 30
- mov [tmp4], #030000000#
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- cmp isdll, 1
- jne C_GMI_2
- mov tmp9, EmuAddr
- add tmp9, 10
- call DLLASPRAPI
- C_GMI_2:
- log EmuAddr, "GetModeInformation "
- scmp caller, "lab84"
- je C_GMI_3
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 40
- add tmp6, 4
- jmp loop9
- C_GMI_3:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 40
- add tmp6, 8
- jmp loop9
- //GetHardwareID
- C_GHI:
- mov tmp3, EmuAddr
- mov [tmp3], #B890909000C3#
- add tmp3, 1
- mov tmp4, EmuAddr
- add tmp4, 10
- mov [tmp4], #31323334353637382D34343434#
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- log EmuAddr, "GetHardwareID "
- cmp isdll, 1
- jne C_GHI_1
- mov tmp9, EmuAddr
- add tmp9, 1
- call DLLASPRAPI
- C_GHI_1:
- scmp caller, "lab84"
- je C_GHI_2
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 20
- add tmp6, 4
- jmp loop9
- C_GHI_2:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 20
- add tmp6, 8
- jmp loop9
- //Asprotect 2.3 build04.26
- loop10:
- mov tmp7, AsprAPIloc
- scmp caller, "lab84"
- je loop10_2
- mov tmp1, [tmp6]
- GMEMI tmp1, MEMORYOWNER
- mov tmp2, $RESULT
- cmp tmp2, dllimgbase
- jne lab48
- mov tmp8, 0 //reset counter
- loop10_1:
- cmp tmp8, tmp5 //compare all the API in AsprAPIloc?
- ja error
- mov tmp2, [tmp7] //AsprAPIloc
- cmp tmp1, tmp2
- je loop10_3
- add tmp7, 4
- add tmp8, 1
- jmp loop10_1
- loop10_2:
- //log tmp6
- mov tmp1, [tmp6]
- cmp tmp1, 0
- je lab48
- mov tmp8, [tmp6+4]
- //0-GetRegistrationKeys,1-GetRegistrationInformation,2-RemoveKey,3-CheckKey
- //4-CheckKeyAndDecrypt,5-GetKeyDate,6-GetKeyExpirationDate,7-GetTrialDays
- //8-GetTrialExecs,9-GetExpirationDate,A-GetModeInformation,B-GetHardwareID
- //C-GetHardwareIDEx,D-SetUserKey
- loop10_3:
- cmp tmp8, 1
- je D_GRI
- cmp tmp8, 2
- je D_RK
- cmp tmp8, 3
- je D_CK
- cmp tmp8, 4
- je D_CKAD
- cmp tmp8, 5
- je D_GKD
- cmp tmp8, 6
- je D_GKED
- cmp tmp8, 7
- je D_GTD
- cmp tmp8, 8
- je D_GTE
- cmp tmp8, 9
- je D_GED
- cmp tmp8, 0A
- je D_GMI
- cmp tmp8, 0B
- je D_GHI
- cmp tmp8, 0C
- je D_GHIE
- msg "This API is not emulated"
- //pause
- scmp caller, "lab84"
- je loop10_4
- add tmp6, 4
- jmp loop10
- loop10_4:
- add tmp6, 8
- jmp loop10
- //GetRegistrationInformation
- D_GRI:
- mov tmp3, EmuAddr
- mov [tmp3], #8B442408C700909090008B44240CC70090909000B801000000C20C00#
- add tmp3, 6
- mov tmp4, EmuAddr
- add tmp4, 20
- mov [tmp4], #313131313232323233333333# //111122223333
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- cmp isdll, 1
- jne D_GRI_1
- mov tmp9, EmuAddr
- add tmp9, 6
- call DLLASPRAPI
- D_GRI_1:
- add tmp3, 0A
- mov tmp4, EmuAddr
- add tmp4, 30
- cmp isdll, 1
- jne D_GRI_2
- mov tmp9, EmuAddr
- add tmp9, 10
- call DLLASPRAPI
- D_GRI_2:
- mov [tmp4], #04000000566F6C58#
- add tmp4, 4
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- log EmuAddr, "GetRegistrationInformation "
- scmp caller, "lab84"
- je D_GRI_3
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 40
- add tmp6, 4
- jmp loop10
- D_GRI_3:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 40
- add tmp6, 8
- jmp loop10
- //RemoveKey
- D_RK:
- mov tmp3, EmuAddr
- mov [tmp3], #B801000000C20C00#
- log EmuAddr, "RemoveKey "
- scmp caller, "lab84"
- je D_RK_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 10
- add tmp6, 4
- jmp loop10
- D_RK_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 10
- add tmp6, 8
- jmp loop10
- //CheckKey
- D_CK:
- mov tmp3, EmuAddr
- mov [tmp3], #B801000000C20C00#
- log EmuAddr, "CheckKey "
- scmp caller, "lab84"
- je D_CK_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 10
- add tmp6, 4
- jmp loop10
- D_CK_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 10
- add tmp6, 8
- jmp loop10
- //CheckKeyAndDecrypt
- D_CKAD:
- mov tmp3, EmuAddr
- mov [tmp3], #B801000000C20C00#
- log EmuAddr, "CheckKeyAndDecrypt "
- scmp caller, "lab84"
- je D_CKAD_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 10
- add tmp6, 4
- jmp loop10
- D_CKAD_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 10
- add tmp6, 8
- jmp loop10
- //GetKeyDate
- D_GKD:
- mov tmp3, EmuAddr
- mov [tmp3], #8B44240866C70001008B44240C66C70001008B44241066C700D707B801000000C21000#
- log EmuAddr, "GetKeyDate "
- scmp caller, "lab84"
- je D_GKD_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 30
- add tmp6, 4
- jmp loop10
- D_GKD_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 30
- add tmp6, 8
- jmp loop10
- //GetKeyExpirationDate
- D_GKED:
- mov tmp3, EmuAddr
- mov [tmp3], #8B44240866C7001E008B44240C66C7000C008B44241066C7006B08B801000000C21000#
- log EmuAddr, "GetKeyExpirationDate "
- scmp caller, "lab84"
- je D_GKED_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 30
- add tmp6, 4
- jmp loop10
- D_GKED_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 30
- add tmp6, 8
- jmp loop10
- //GetTrialDays
- D_GTD:
- mov tmp3, EmuAddr
- mov [tmp3], #8B442408C7001E0000008B44240CC7001E000000B801000000C20C00#
- log EmuAddr, "GetTrialDays "
- scmp caller, "lab84"
- je D_GTD_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 20
- add tmp6, 4
- jmp loop10
- D_GTD_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 20
- add tmp6, 8
- jmp loop10
- //GetTrialExecs
- D_GTE:
- mov tmp3, EmuAddr
- mov [tmp3], #8B442408C7001E0000008B44240CC7001E000000B801000000C20C00#
- log EmuAddr, "GetTrialExecs "
- scmp caller, "lab84"
- je D_GTE_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 20
- add tmp6, 4
- jmp loop10
- D_GTE_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 20
- add tmp6, 8
- jmp loop10
- //GetExpirationDate
- D_GED:
- mov tmp3, EmuAddr
- mov [tmp3], #8B44240866C7001E008B44240C66C7000C008B44241066C7006B08B801000000C21000#
- log EmuAddr, "GetExpirationDate "
- scmp caller, "lab84"
- je D_GED_1
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 30
- add tmp6, 4
- jmp loop10
- D_GED_1:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 30
- add tmp6, 8
- jmp loop10
- //GetModeInformation
- D_GMI:
- mov tmp3, EmuAddr
- mov [tmp3], #8B442408C700909090008B44240CC70090909000B801000000C20C00#
- add tmp3, 6
- mov tmp4, EmuAddr
- add tmp4, 20
- mov [tmp4], #53697465204C6963656E7365# //Site license
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- cmp isdll, 1
- jne D_GMI_1
- mov tmp9, EmuAddr
- add tmp9, 6
- call DLLASPRAPI
- D_GMI_1:
- add tmp3, 0A
- mov tmp4, EmuAddr
- add tmp4, 30
- mov [tmp4], #030000000#
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- cmp isdll, 1
- jne D_GMI_2
- mov tmp9, EmuAddr
- add tmp9, 10
- call DLLASPRAPI
- D_GMI_2:
- log EmuAddr, "GetModeInformation "
- scmp caller, "lab84"
- je D_GMI_3
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 40
- add tmp6, 4
- jmp loop10
- D_GMI_3:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 40
- add tmp6, 8
- jmp loop10
- //GetHardwareID
- D_GHI:
- mov tmp3, EmuAddr
- mov [tmp3], #B890909000C20400#
- add tmp3, 1
- mov tmp4, EmuAddr
- add tmp4, 10
- mov [tmp4], #31323334353637382D34343434#
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- log EmuAddr, "GetHardwareID "
- cmp isdll, 1
- jne D_GHI_1
- mov tmp9, EmuAddr
- add tmp9, 1
- call DLLASPRAPI
- D_GHI_1:
- scmp caller, "lab84"
- je D_GHI_2
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 20
- add tmp6, 4
- jmp loop10
- D_GHI_2:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 20
- add tmp6, 8
- jmp loop10
- //GetHardwareIDEx
- D_GHIE:
- mov tmp3, EmuAddr
- mov [tmp3], #B890909000C3#
- add tmp3, 1
- mov tmp4, EmuAddr
- add tmp4, 10
- mov [tmp4], #31323334353637382D34343434#
- sub tmp4, imgbase
- add tmp4, imgbasefromdisk
- mov [tmp3], tmp4
- log EmuAddr, "GetHardwareIDEx "
- cmp isdll, 1
- jne D_GHIE_1
- mov tmp9, EmuAddr
- add tmp9, 1
- call DLLASPRAPI
- D_GHIE_1:
- scmp caller, "lab84"
- je D_GHIE_2
- mov tmp3, EmuAddr
- sub tmp3, imgbase
- add tmp3, imgbasefromdisk
- mov [tmp6], tmp3
- add EmuAddr, 20
- add tmp6, 4
- jmp loop10
- D_GHIE_2:
- eval "jmp 0{EmuAddr}"
- asm tmp1, $RESULT
- add EmuAddr, 20
- add tmp6, 8
- jmp loop10
- DLLASPRAPI:
- cmp tmp10, 0
- je reloc1
- cmp tmp10, 1
- je reloc2
- cmp tmp10, 2
- je reloc3
- cmp tmp10, 3
- je reloc4
- cmp tmp10, 4
- je reloc5
- cmp tmp10, 5
- je reloc6
- msg "DLLASPRAPI error"
- //pause
- jmp error
- reloc1:
- sub tmp9, imgbase
- mov reloc1, tmp9
- jmp DLLASPRAPI_1
- reloc2:
- sub tmp9, imgbase
- mov reloc2, tmp9
- jmp DLLASPRAPI_1
- reloc3:
- sub tmp9, imgbase
- mov reloc3, tmp9
- jmp DLLASPRAPI_1
- reloc4:
- sub tmp9, imgbase
- mov reloc4, tmp9
- jmp DLLASPRAPI_1
- reloc5:
- sub tmp9, imgbase
- mov reloc5, tmp9
- jmp DLLASPRAPI_1
- reloc6:
- sub tmp9, imgbase
- mov reloc6, tmp9
- DLLASPRAPI_1:
- add tmp10, 1
- ret
- lab48:
- cmp isdll, 1
- jne lab51
- mov tmp1, reloc_rva
- add tmp1, imgbase
- mov tmp2, tmp1
- add tmp2, 08
- mov tmp3, [tmp2], 2
- and tmp3, 0F000
- cmp tmp3, 3000 //type 3 relocation ?
- jne lab51
- GMEMI tmp1, MEMORYSIZE
- mov tmp2, $RESULT
- alloc tmp2
- mov reloctemp, $RESULT
- //log reloctemp
- cmp tmp10, 0 //no relocation of item in emulation code
- je lab49_1
- //add relocate item for dll
- mov tmp1, freeloc
- mov [tmp1], #609CBD00038D00C745040000E200C7450800D00010C7450C5C040000C7451001000000B917010000B8003000008B7D08#
- add tmp1, 30 //30
- mov [tmp1], #8BD7F2AF83F9000F85730000008BFA8B0F83F9000F84160200003BC877078B4F0403F9EBEA8BCF8BD12B4D088B5D0C2B#
- add tmp1, 30 //60
- mov [tmp1], #D98BCB53578B7D048BF2F3A433C05F8BCBF3AA8BFAC7070090000083C20483C708E87A010000E89502000085C0740383#
- add tmp1, 30 //90
- mov [tmp1], #C70283C108890A598B7504F3A4E94701000090909090909090909090909090908BD783EA04031766837AFE007507C745#
- add tmp1, 30 //C0
- mov [tmp1], #0001000000578B0F83E90833C083C7048BD7668B07663DFD32771183C70283E90283F9000F84A6010000EBE690909090#
- add tmp1, 30 //F0
- mov [tmp1], #8BD78BCF2B4D088B5D0C2BD98BCB53578B7D048BF2F3A433C05F8BCBF3AA8BFAE8EB000000598B7504F3A45AE8FF0100#
- add tmp1, 30 //120
- mov [tmp1], #00890A8BFA9C33C98B4510A8010F94C19D83F9010F84AF000000837D0000747090909090909090909090909090909090#
- add tmp1, 30 //150
- mov [tmp1], #8B0F83E90403F98BD783C7028BCF2B4D088B5D0C2BD98B4D10D1E103D98BCB8BF78B7D04F3A433C08BCB8BFAF3AA8BFA#
- add tmp1, 30 //180
- mov [tmp1], #8B75048BCBF3A4EB60909090909090909090909090909090909090909090909090909090909090909090909090909090#
- add tmp1, 30 //1B0
- mov [tmp1], #8B0F83E90403F98BD783EF028BD78BCF2B4D088B5D0C2BD98B4D10D1E103D98BCB8B7D048BF2F3A48BFA66C70700008B#
- add tmp1, 30 //1E0
- mov [tmp1], #CB8B750483C702F3A49D619090909090000000000000000000000000000000008B4D1066C707063649E33E83C70266C7#
- add tmp1, 30 //210
- mov [tmp1], #07103649E33383C70266C707803A49E32883C70266C707803A49E31D83C70266C707803A49E31283C70266C707803A49#
- add tmp1, 30 //240
- mov [tmp1], #83F9000F850500000083C702C390909000000000000000000000000000000000C70700B000008BD783C20483C708E88D#
- add tmp1, 30 //270
- mov [tmp1], #FFFFFFE8A800000083C108890AE967FFFFFF00000000000000000000000000008BCF2B4D088B5D0C2BD98BCB578BF78B#
- add tmp1, 30 //2A0
- mov [tmp1], #7D04F3A45A837D0001750383EA028BFAE84BFFFFFF5AE865000000890A85C0740866C707000083C7028BCB8B7504F3A4#
- add tmp1, 30 //2D0
- mov [tmp1], #E914FFFFFF9000000000000000000000#
- add tmp1, 50 //320
- mov [tmp1], #8B4D10D1E18BF28B0683F800740B837D0000740383E80203C88BC1C1E902C1E1023BC8740A83C0028BC833C040EB0233#
- add tmp1, 30 //350
- mov [tmp1], #C0C30000000000000000000000000000#
- mov tmp1, freeloc
- add tmp1, 3 //3
- mov tmp2, freeloc
- add tmp2, 400
- mov [tmp1], tmp2
- add tmp1, 7 //A
- mov [tmp1], reloctemp
- add tmp1, 7 //11
- mov tmp2, reloc_rva
- add tmp2, imgbase
- mov [tmp1], tmp2
- add tmp1, 7 //18
- mov [tmp1], reloc_size
- add tmp1, 7 //1F
- mov [tmp1], tmp10
- add tmp1, 5 //24
- mov tmp3, reloc_size
- shr tmp3, 2
- mov [tmp1], tmp3 //reloc no.
- add tmp1, 5 //29
- mov tmp5, reloc1
- and tmp5, 0FFFFF000
- mov [tmp1], tmp5
- add tmp1, 4E //77
- mov [tmp1], tmp5
- add tmp1, 60 //D7
- mov tmp3, [tmp1+2]
- mov tmp2, reloc1
- sub tmp2, tmp5
- add tmp2, 3000
- mov [tmp1], tmp2
- add tmp1, 2 //D9
- mov [tmp1], tmp3
- add tmp1, 12D //206
- mov tmp6, reloc1
- sub tmp6, tmp5
- add tmp6, 3000
- mov tmp3, [tmp1+2]
- mov [tmp1], tmp6
- add tmp1, 2
- mov [tmp1], tmp3
- cmp tmp10, 1
- je lab48_1
- mov tmp1, freeloc
- add tmp1, 211 //211
- mov tmp6, reloc2
- sub tmp6, tmp5
- add tmp6, 3000
- mov tmp3, [tmp1+2]
- mov [tmp1], tmp6
- add tmp1, 2
- mov [tmp1], tmp3
- cmp tmp10, 2
- je lab48_1
- mov tmp1, freeloc
- add tmp1, 21C //21C
- mov tmp6, reloc3
- sub tmp6, tmp5
- add tmp6, 3000
- mov tmp3, [tmp1+2]
- mov [tmp1], tmp6
- add tmp1, 2
- mov [tmp1], tmp3
- cmp tmp10, 3
- je lab48_1
- mov tmp1, freeloc
- add tmp1, 227 //227
- mov tmp6, reloc4
- sub tmp6, tmp5
- add tmp6, 3000
- mov tmp3, [tmp1+2]
- mov [tmp1], tmp6
- add tmp1, 2
- mov [tmp1], tmp3
- cmp tmp10, 4
- je lab48_1
- mov tmp1, freeloc
- add tmp1, 232 //232
- mov tmp6, reloc5
- sub tmp6, tmp5
- add tmp6, 3000
- mov tmp3, [tmp1+2]
- mov [tmp1], tmp6
- add tmp1, 2
- mov [tmp1], tmp3
- cmp tmp10, 5
- je lab48_1
- mov tmp1, freeloc
- add tmp1, 23D //23D
- mov tmp6, reloc6
- sub tmp6, tmp5
- add tmp6, 3000
- mov tmp3, [tmp1+2]
- mov [tmp1], tmp6
- add tmp1, 2
- mov [tmp1], tmp3
- cmp tmp10, 6
- jne error
- lab48_1:
- mov tmp1, freeloc
- add tmp1, 262 //262
- mov [tmp1], tmp5
- mov tmp1, freeloc
- add tmp1, 1EB //1EB--end point
- mov tmp2, tmp1
- add tmp2, 63 //24E--error point
- mov tmp7, eip
- mov eip, freeloc
- bp tmp1
- bp tmp2
- eob lab48_2
- eoe lab48_2
- esto
- lab48_2:
- cmp eip, tmp1
- je lab48_3
- cmp eip, tmp2
- je lab48_4
- jmp error
- lab48_3:
- bc tmp1
- bc tmp2
- mov eip, tmp7
- fill freeloc, 420, 00
- mov tmp1, reloc_rva
- add tmp1, imgbase
- call ChkRelocSize
- jmp lab49
- lab48_4:
- msg "Fix relocation table error"
- //pause
- jmp error
- lab49:
- mov reloc_size, tmp2
- //log reloc_size
- //relocate addr in IAT
- lab49_1:
- coe
- cob
- find Aspr1stthunk, #00000000#
- mov tmp10, $RESULT
- sub tmp10, Aspr1stthunk
- mov tmp1, tmp10
- shr tmp10, 2
- mov tmp2, tmp10
- shl tmp2, 2
- cmp tmp1, tmp2
- je lab49_2
- add tmp10, 1
- lab49_2:
- mov tmp1, freeloc
- mov [tmp1], #609CBD00038D00C745040000E200C7450818900010C7450C00900010C7451000D00010C7451460040000B917010000B8#
- add tmp1, 30 //30
- mov [tmp1], #009000008B7D108BD7F2AF85C90F85FD0000008BFA8B0F83F9000F84900000003BC877078B4F0403F9EBEA8BCF8BD12B#
- add tmp1, 30 //60
- mov [tmp1], #4D108B5D142BD98BCB53578B7D048BF2F3A433C05F8BCBF3AA8BFAC7070090000083C7088BD7B9030000008B5D088BF3#
- add tmp1, 30 //90
- mov [tmp1], #2B750C81C6003000006689374983F900740883C70283C304EBE483C7028BCF2BCA83C1088BD9C1E902C1E1023BCB7406#
- add tmp1, 30 //C0
- mov [tmp1], #83C70283C302895AFC5B8BCB8B7504F3A4E99D01000000000000000000009090C70700B0000083C7088BD7B903000000#
- add tmp1, 30 //F0
- mov [tmp1], #8B5D088BF32B750C81C6003000006689374983F900740883C70283C304EBE483C7028BCF2BCA83C1088BD9C1E902C1E1#
- add tmp1, 30 //120
- mov [tmp1], #023BCB740683C70283C302895AFCE940010000000000000000000000000000908BD783EA04031766837AFE00750A832F#
- add tmp1, 30 //150
- mov [tmp1], #02C7450001000000578B0F83E90833C083C7048BD7668B07663D1830770883C70283E902EBEF83F900740D8B42FC83E8#
- add tmp1, 30 //180
- mov [tmp1], #083BC1740383EF028BD78BCF2B4D108B5D142BD98BCB53578B7D048BF2F3A433C05F8BCBF3AA8BFAB9030000008B5D08#
- add tmp1, 30 //1B0
- mov [tmp1], #8BF32B750C81C6003000006689374983F900740883C70283C304EBE483C7025B8BCB8B7504F3A45FB903000000D1E101#
- add tmp1, 30 //1E0
- mov [tmp1], #0F8BC18BD783EA0403178BCA2BCF83E9048BD9C1E902C1E1023BCB7443830702578BFA8BCF2B4D108B5D142BD903D88B#
- add tmp1, 30 //210
- mov [tmp1], #CB578B7D048BF2F3A433C05F66C707000083C7028BCB8B7504F3A45FEB45000000000000000000000000000000009090#
- add tmp1, 30 //240
- mov [tmp1], #837D0001752D8BFA8BCF2B4D108B5D142BD903D88BCB578B7D0483C2028BF2F3A433C05F578BCB8BFAF3AA5F8BCB8B75#
- add tmp1, 30 //270
- mov [tmp1], #04F3A49D619090909090909000000000#
- mov tmp1, freeloc
- add tmp1, 3 //3
- mov tmp2, freeloc
- add tmp2, 300
- mov [tmp1], tmp2
- add tmp1, 7 //0A
- mov [tmp1], reloctemp
- add tmp1, 7 //11
- mov [tmp1], Aspr1stthunk
- add tmp1, 7 //18
- GMEMI Aspr1stthunk, MEMORYBASE
- mov tmp3, $RESULT
- mov [tmp1], tmp3
- add tmp1, 7 //1F
- mov tmp3, reloc_rva
- add tmp3, imgbase
- mov [tmp1], tmp3
- add tmp1, 7 //26
- mov [tmp1], reloc_size
- add tmp1, 5 //2B
- mov tmp3, reloc_size
- shr tmp3, 2
- mov [tmp1], tmp3
- add tmp1, 5 //30
- GMEMI Aspr1stthunk, MEMORYBASE
- mov tmp6, $RESULT
- sub tmp6, imgbase
- mov [tmp1], tmp6
- add tmp1, 4D //7D
- mov [tmp1], tmp6
- add tmp1, A //87
- mov [tmp1], tmp10
- add tmp1, 5B //E2
- mov [tmp1], tmp6
- add tmp1, A //EC
- mov [tmp1], tmp10
- add tmp1, 7E //16A
- mov tmp4, Aspr1stthunk
- sub tmp4, tmp6
- add tmp4, 3000
- mov tmp2, [tmp1+2]
- mov [tmp1], tmp4
- add tmp1, 2 //16C
- mov [tmp1], tmp2
- add tmp1, 3D //1A9
- mov [tmp1], tmp10
- add tmp1, 30 //1D9
- mov [tmp1], tmp10
- add tmp1, 9C //275 -- end point
- mov tmp7, eip
- mov eip, freeloc
- bp tmp1
- eob lab49_3
- eoe lab49_3
- run
- lab49_3:
- cmp eip, tmp1
- je lab49_4
- jmp error
- lab49_4:
- bc tmp1
- mov eip, tmp7
- fill freeloc, 320, 00
- mov tmp1, reloc_rva
- add tmp1, imgbase
- call ChkRelocSize
- lab49_5:
- mov reloc_size, tmp2
- //log reloc_size
- GMEMI reloctemp, MEMORYSIZE
- mov tmp2, $RESULT
- free reloctemp, tmp2
- lab51:
- scmp caller, "lab46_1"
- je lab52
- scmp caller, "lab84"
- je lab85
- jmp error
- //Search and fix CRC check
- lab52:
- mov caller, "nil"
- cob
- coe
- mov tmp9, eip //save eip
- mov tmp1, freeloc
- mov [tmp1], #609CBE00104000B9FCAF28008B1681E2F0F0FF0081FA5050E8000F85100100008A1680E20F80FA0873688A560180E20F#
- add tmp1, 30 //30
- mov [tmp1], #80FA08735D8B5E0481E3FFFFFF0083FB00754F515683C607B90001000033C08B1681E2FFF0F0F081FAC35050E0740846#
- add tmp1, 30 //60
- mov [tmp1], #4985C975EAEB03408BD65E5983F80175218D5E038B1B03DE83C3073BDA73138A42013C58720C8A42023C587205E90E00#
- add tmp1, 30 //90
- mov [tmp1], #0000E9A90100009090909090909090904250515756B8E9000000B9000100008BFE33F6F2AEE3193BFA77158BDF031F83#
- add tmp1, 30 //C0
- mov [tmp1], #C3043BDA75ED46EBEA9090909090909083FE01742B83FE0274095E5F5958E95D0100005E8BC683C002C600B8C7400101#
- add tmp1, 30 //F0
- mov [tmp1], #00000083C005EB0E00000000000000005E8BC683C002C600E98BCA2BC883E9058948015F5958E9250100009000000000#
- add tmp1, 30 //120
- mov [tmp1], #000000000000000000000000000000008B1681E2F0F0FFFF81FA50500F84754066817E06FFFF75388B5EF381E3FFFF00#
- add tmp1, 30 //150
- mov [tmp1], #FF81FB0F8200FF75278B56F981E2F0FFF00081FA5081F000751666C7460290E9E9CB0000000000000000000000000090#
- add tmp1, 30 //180
- mov [tmp1], #803EE90F85B70000008B560183FA000F85AB00000033DB668B5E056681E3F0F06681FB50500F859500000033D28A5605#
- add tmp1, 30 //1B0
- mov [tmp1], #80E20F80FA080F82840000008A560680E20F80FA087279807E07E975738B560881E200FFFFFF83FA007565575150B80F#
- add tmp1, 30 //1E0
- mov [tmp1], #000000B9400000008BFE83EF40F2AE85C97448803F847407803F857417EBEE8BC70347013BC6753366C747FF90E9EB2B#
- add tmp1, 30 //210
- mov [tmp1], #000000008BC70347018038E9751D8A580180E3F080FB1077129090909066837803007507C747010000000058595F9090#
- add tmp1, 30 //240
- mov [tmp1], #83C60183E90185C90F85BEFDFFFF9D619090#
- mov tmp1, freeloc
- add tmp1, 3 //3
- mov [tmp1], 1stsecbase
- add tmp1, 5 //08
- mov tmp3, sizeofimg
- sub tmp3, 2004
- mov [tmp1], tmp3
- mov tmp3, freeloc
- add tmp3, 250 //end point
- mov eip, freeloc
- bp tmp3
- run
- cmp eip, tmp3
- jne error
- bc tmp3
- lab53:
- fill freeloc, 260, 00
- mov eip, tmp9
- //get all call xxxxxxxx
- lab54:
- cmp type1API, 0
- je lab78
- fixtype1:
- find dllimgbase, #3130320D0A# //search "102"
- mov tmp6, $RESULT
- cmp tmp6, 0
- je error
- find tmp6, #05FF00000050# //"Add eax,FF" "push eax"
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- find tmp1, #8B45F4E8#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- add tmp2, 3
- GCI tmp2, DESTINATION
- mov func1, $RESULT
- //log func1
- add tmp2, 5
- find tmp2, #8B45F4E8#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- add tmp1, 3
- GCI tmp1, DESTINATION
- mov func2, $RESULT
- //log func2
- add tmp1, 5
- find tmp1, #8B45F4E8????????#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- add tmp2, 3
- GCI tmp2, DESTINATION
- mov func3, $RESULT
- //log func3
- mov tmp1, tmp2
- add tmp1, 5
- mov tmp3, [tmp1]
- find tmp1, #8B55FCE8#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- add tmp2, 3
- GCI tmp2, DESTINATION
- mov func4, $RESULT
- //log func4
- cmp tmp3, A1FC4589
- jne lab55
- find tmp1, #8B83080100008B401C#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je lab54_1
- mov v2.0x, 1
- jmp lab55
- lab54_1:
- mov v1.32, 1
- lab55:
- //log v1.32
- //log v2.0x
- mov tmp1, freeloc
- mov [tmp1], #609CBB000E0201BE00104000803EE875188B460103C683C0053B432C750B893500C09E00E8170000004681FE00705900#
- add tmp1, 30 //30
- mov [tmp1], #72DA9D6190909000000000000000009060BD0009FB00A100C09E00894510BB000E02018B480103C883C1053B4B2C7421#
- add tmp1, 30 //60
- mov [tmp1], #61C3909090909090909090909090909090909090909090909090909090909090908B45102B43148B55102B53242B93E0#
- add tmp1, 30 //90
- mov [tmp1], #0000008955F83B43280F83600400008D53408955E48B53188955F48B551083C2058A123293E00000008BFA81E7FF0000#
- add tmp1, 30 //C0
- mov [tmp1], #0025FF00000033F83B7DF40F87AE0100008B83E4000000F7EF0343548945FC8B45E40FB6008D04408B7483688B45FCFF#
- add tmp1, 30 //F0
- mov [tmp1], #D68BF03B75F80F8574010000807B2000741B8B45E40FB640098D04408B5483688B45FCFFD23C010F843B0200008D75FC#
- add tmp1, 30 //120
- mov [tmp1], #33C08A43428D04408BD38B7C82688B06FFD78945B833C08A43438D04408BD38B7C82688B06FFD78BF833C08A43458D04#
- add tmp1, 30 //150
- mov [tmp1], #408BD38B5482688B06FFD28845B733C08A43418D04408BD38B5482688B06FFD28845BF8B83E00000000345B88945D433#
- add tmp1, 30 //180
- mov [tmp1], #C08A43478D04408BD38B5482688B06FFD28945E003BBE00000005733C08A45B705FF000000508BC3E88BB102008BC88B#
- add tmp1, 30 //1B0
- mov [tmp1], #53108BC3E80B9F02008945D033C08A43488D04408BD38B7C82688B06FFD78B55D00155E08B5510422B022B45D08B5510#
- add tmp1, 30 //1E0
- mov [tmp1], #0FB61203C28BD38B522C2B551083EA0503C28D55CC52668B4DE08BD08BC3E8E9AB02008B83E00000000145CC837DD4FF#
- add tmp1, 30 //210
- mov [tmp1], #740E8B45108B5D14890383C304895D148B5DCCE978020000909090909090909090909090909090909090909090909090#
- add tmp1, 30 //240
- mov [tmp1], #BE00705900391E741183C60481FE747A59000F87A7020000EBEB81EE0000400081C600004000C3000000000000000090#
- add tmp1, 30 //270
- mov [tmp1], #81C7FF0000003B7DF40F8652FEFFFF8B83080100008B401C488945F48B43188B55F4423BC27405E9630200008B45F485#
- add tmp1, 30 //2A0
- mov [tmp1], #C00F8C58020000408945E0C745EC000000008B83080100008B55ECE8800000008BF88B45E40FB6008D04408B7483688B#
- add tmp1, 30 //2D0
- mov [tmp1], #4704FFD68BF03B75F8753F807B200074178B45E40FB640098D04408B5483688B4704FFD23C01746883C7048BF7E91EFE#
- add tmp1, 30 //300
- mov [tmp1], #FFFF909090900000000000000000000000000000000090909090FF45ECFF4DE07590E9D8010000909090909000000000#
- add tmp1, 30 //330
- mov [tmp1], #0000000000000000000000000000000033C985D27C0B3B501C7D068B40188B0C908BC1C3909090908D75FCEB08909090#
- add tmp1, 30 //360
- mov [tmp1], #83C7048BF733C08A43478D04408BD38B7C82688B06FFD78945EC33C08A43488D04408BD38B7C82688B06FFD78945E833#
- add tmp1, 30 //390
- mov [tmp1], #C08A43428D04408BD38B7C82688B06FFD78BF833C08A43468D04408BD38B5482688B06FFD28845DF03BBE00000005733#
- add tmp1, 30 //3C0
- mov [tmp1], #C08A45DF05FF000000508BC3E867AF02008BC88B53108BC3E8E79C02008945D833C08A43438D04408BD38B7C82688B06#
- add tmp1, 30 //3F0
- mov [tmp1], #FFD78BF803BBE00000008B45EC03C70345D88945EC8B45E82BC72B45D88945E833C08A43418D04408BD38B5482688B06#
- add tmp1, 30 //420
- mov [tmp1], #FFD28845BF895D208BD88D45B450668B4DEC668B55E88B4520E8AEA902008B45208B80E00000000345B48945FC8945CC#
- add tmp1, 30 //450
- mov [tmp1], #576A008D4DE08B45208B403C8B55FCE8106D02008945FC8B45E08B00E81F0000000045BF8B5DCCEB2700000000000000#
- add tmp1, 30 //480
- mov [tmp1], #00000000000000000000000000000090516689C1C1C0106601C828E059C3000081FB909090907507BB90909090EB2181#
- add tmp1, 30 //4B0
- mov [tmp1], #FB909090907507BB90909090EB1281FB90909090750ABB909090009090909090E86BFDFFFF66B9FF158B5DE48A430A3A#
- add tmp1, 30 //4E0
- mov [tmp1], #45BF74056681C100108B5D1066890B83C3028933FF05000E900061C390909090#
- mov tmp1, freeloc
- mov tmp2, tmp1
- add tmp1, 3 //3
- mov [tmp1], EBXaddr
- add tmp1, 5 //8
- mov [tmp1], 1stsecbase
- add tmp1, 18 //20
- mov tmp4, freeloc
- add tmp4, 0E04 //freeloc+0E04
- mov [tmp1], tmp4
- add tmp1, 0C //2C
- mov tmp3, sizeofimg
- sub tmp3, 1000
- add tmp3, imgbase
- mov [tmp1], tmp3
- add tmp1, 16 //42
- mov tmp2, freeloc
- add tmp2, 900 //freeloc+900
- mov [tmp1], tmp2
- add tmp1, 5 //47
- mov [tmp1], tmp4
- add tmp1, 8 //4F
- mov [tmp1], EBXaddr
- add tmp1, 159 //1A8
- eval "call 0{func1}"
- asm tmp1, $RESULT
- add tmp1, C //1B4
- eval "call 0{func2}"
- asm tmp1, $RESULT
- add tmp1, 4A //1FE
- eval "call 0{func3}"
- asm tmp1, $RESULT
- add tmp1, 43 //241
- mov [tmp1], iatstartaddr
- add tmp1, D //24E
- mov [tmp1], iatendaddr
- add tmp1, E //25C
- mov [tmp1], imgbase
- add tmp1, 6 //262
- mov [tmp1], imgbasefromdisk
- add tmp1, 16A //3CC
- eval "call 0{func1}"
- asm tmp1, $RESULT
- add tmp1, C //3D8
- eval "call 0{func2}"
- asm tmp1, $RESULT
- add tmp1, 61 //439
- eval "call 0{func3}"
- asm tmp1, $RESULT
- add tmp1, 26 //45F
- eval "call 0{func4}"
- asm tmp1, $RESULT
- add tmp1, 97 //4F6
- mov tmp2, freeloc
- add tmp2, E00 //freeloc+E00 for storing E8count
- mov [tmp1], tmp2
- mov tmp2, freeloc
- add tmp2, 914 //freeloc+900
- mov [tmp2], lastsecbase //loc for storing sc after API
- mov tmp2, freeloc
- add tmp2, 34 //34 -- end point
- bp tmp2
- mov tmp3, freeloc
- add tmp3, 4FF //4FF -- error point
- bp tmp3
- cmp v1.32, 1
- jne lab56
- mov tmp4, freeloc
- add tmp4, 203 //203
- mov [tmp4], #8945CC83C404909090#
- add tmp4, 7C //27F
- mov [tmp4], #8B830401#
- add tmp4, 33 //2B2
- mov [tmp4], #8B830401#
- add tmp4, 18C //43E
- mov [tmp4], #83C404909090909090909090#
- find dllimgbase, #3136300D0A#
- mov tmp4, $RESULT
- cmp tmp4, 0
- jne lab56_1
- find dllimgbase, #3B7DF40F83????FFFF8B4354#
- mov tmp4, $RESULT
- cmp tmp4, 0
- je error
- mov tmp4, freeloc
- add tmp4, 270 //270
- mov [tmp4], #81C7FF0000003B7DF40F8652FEFFFF8B43548945FC8B7B1885FF0F866F0200008B45E40FB6008D04408B7483688B45FC#
- add tmp4, 30 //2A0
- mov [tmp4], #FFD68BF03B75F87571807B2000741B8B45E40FB640098D04408B5483688B45FCFFD23C010F848E0000008D75FCE94EFE#
- add tmp4, 30 //2D0
- mov [tmp4], #FFFF00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000#
- add tmp4, 30 //300
- mov [tmp4], #00000000000000000000000000000000000000000000909090904F8B83E40000000145FC85FF0F8764FFFFFFE9CE01000090#
- jmp lab56_1
- lab56:
- cmp v2.0x, 1
- jne lab56_1
- mov tmp4, freeloc
- add tmp4, 203 //203
- mov [tmp4], #8945CC83C404909090#
- add tmp4, 23b //43E
- mov [tmp4], #83C404909090909090909090#
- lab56_1:
- cmp DFCequ, 0
- je lab56_2
- mov tmp1, freeloc
- add tmp1, 4A2 //4A2
- mov [tmp1], DFCequ
- add tmp1, 7 //4A9
- mov [tmp1], DFCaddr
- jmp lab56_3
- lab56_2:
- mov tmp1, freeloc
- add tmp1, 4A0
- mov [tmp1], #EB0D#
- lab56_3:
- cmp REequ, 0
- je lab56_4
- mov tmp1, freeloc
- add tmp1, 4B1 //4B1
- mov [tmp1], REequ
- add tmp1, 7 //4B8
- mov [tmp1], REaddr
- jmp lab56_5
- lab56_4:
- mov tmp1, freeloc
- add tmp1, 4AF
- mov [tmp1], #EB0D#
- lab56_5:
- cmp GPAequ, 0
- je lab56_6
- mov tmp1, freeloc
- add tmp1, 4C0 //4C0
- mov [tmp1], GPAequ
- add tmp1, 7 //4C7
- mov [tmp1], GPAaddr
- jmp lab57
- lab56_6:
- mov tmp1, freeloc
- add tmp1, 4BE
- mov [tmp1], #EB0B#
- lab57:
- mov tmp6, eip
- mov eip, freeloc
- eob lab58
- eoe lab58
- esto
- lab58:
- cmp eip, tmp2
- je lab59
- cmp eip, tmp3
- je lab60
- esto
- lab59:
- bc tmp2
- bc tmp3
- mov eip, tmp6
- mov E8count, 0
- mov E8count, [freeloc+0E00]
- //log E8count
- //msg "Fix type 1 API OK!"
- //pause
- jmp lab69
- lab60:
- msg "Unexpected termination of the process"
- //pause
- jmp end
- //lab61_lab68
- lab69:
- mov tmp1, freeloc
- add tmp1, 914 //freeloc+914
- mov tmp2, [tmp1]
- mov tmp3, lastsecbase //loc for storing sc after API
- cmp tmp3, tmp2
- je lab76
- sub tmp2, tmp3
- //dm tmp3, tmp2, "SCafAPI.bin"
- shr tmp2, 2
- mov SCafterAPIcount, tmp2
- //log SCafterAPIcount
- //msg "Advanced IAT protection detected, press OK to fix it"
- //pause
- fill freeloc, 0E10, 00
- //Advanced Import protection
- find dllimgbase, #3130320D0A# //search "102"
- mov tmp6, $RESULT
- cmp tmp6, 0
- je error
- find tmp6, #8B80E4000000E8# //search "mov eax,[eax+E4]" "call xxxxxxxx"
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- add tmp1, 6
- GCI tmp1, DESTINATION
- mov func1, $RESULT
- //log func1
- add tmp1 , 6
- find tmp1, #8BC7E8????????# //search "mov eax,edi","call xxxxxxx"
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- add tmp2, 2
- GCI tmp2, DESTINATION
- mov func2, $RESULT
- //log func2
- add tmp2, 8
- mov ori1, [tmp2]
- //log ori1
- find tmp2, #E8????????#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- GCI tmp1, DESTINATION
- mov func3, $RESULT
- //log func3
- mov tmp3, [tmp1+1]
- add tmp3, tmp1
- add tmp3, 5
- mov tmp4, [tmp3+09]
- cmp tmp4, 01B2D88B
- je lab70
- mov newver, 1
- lab70:
- //log newver
- mov tmp9, eip //save eip
- mov tmp1, freeloc
- mov [tmp1], #60BB6806F400BD000BEE00BF000BEE008B57048BC3E8860900008945D88D73408B83E4000000E821250000897DDC8BF8#
- add tmp1, 30 //30
- mov [tmp1], #8B8BE40000008B55D88BC7E87C6000006A10B9C0B7F1008B93E40000008BC7E8E84801009090909033C08A46028D0440#
- add tmp1, 30 //60
- mov [tmp1], #8BD38B5482688BC7FFD28945F033C08A46038D04408BD38B5482688BC7FFD28945EC33C08A46018D04408BD38B548268#
- add tmp1, 30 //90
- mov [tmp1], #8BC7FFD23A434A74403A434B74423A434C0F84890000003A434D0F84800000003A434F0F84A70600003A43500F841E07#
- add tmp1, 30 //C0
- mov [tmp1], #00003A43510F84750700003A43520F84DC070000E907090000E9E208000090908B8BE0000000034DEC034D908B7DDC8B#
- add tmp1, 30 //F0
- mov [tmp1], #3F8B1F83C3068BC12BC38BD07905F7D283C20481FA81000000770BC603EB83E802884301EB09C603E983E805894301E9#
- add tmp1, 30 //120
- mov [tmp1], #9C0800009090909090909090909090908845D033C08945AC8945B08945B48945B88945BC8A46078D04408B5483688BC7#
- add tmp1, 30 //150
- mov [tmp1], #FFD28945B033C08A46058D04408B5483688BC7FFD28BD080EA080F92C280FA01750A8945B0C745B40100000033C08A46#
- add tmp1, 30 //180
- mov [tmp1], #088D04408B5483688BC7FFD28945B833C08A46068D04408B5483688BC7FFD28BD080EA080F92C280FA01750A8945B8C7#
- add tmp1, 30 //1B0
- mov [tmp1], #45BC0100000033C08A46098D04408B5483688BC7FFD284C0742EFEC87430FEC87432FEC80F8466010000FEC80F841E02#
- add tmp1, 30 //1E0
- mov [tmp1], #0000FEC80F8416030000FEC80F84BE030000E9E907000090E9C307000090E9BD0700009057538B7DDC8B3F8B0F83C106#
- add tmp1, 30 //210
- mov [tmp1], #837DB4010F85B8000000837DBC017547B83900000033D23E8A55B8C0E2033E0255B086F203C2807DB004740E807DB005#
- add tmp1, 30 //240
- mov [tmp1], #741166890183C102EB18668901C6410224EB0C0500400000668901C641020083C103E9D00000003E8B55B881FA800000#
- add tmp1, 30 //270
- mov [tmp1], #007307B883380000EB05B88138000033D23E8A55B086F203C2807DB004740E807DB005741466890183C102EB1B668901#
- add tmp1, 30 //2A0
- mov [tmp1], #C641022483C103EB0F0500400000668901C641020083C1033E8B55B881FA800000007307881183C101EB6C891183C104#
- add tmp1, 30 //2D0
- mov [tmp1], #EB658B45900145B0837DBC017521B83905000033D23E8A55B8C0E20386F203C26689013E8B55B089510283C106EB383E#
- add tmp1, 30 //300
- mov [tmp1], #8B55B881FA800000007317B8833D00006689013E8B45B089410288510683C107EB15B8813D00006689013E8B45B08941#
- add tmp1, 30 //330
- mov [tmp1], #0289510683C10A8BD9E952030000909057538B7DDC8B3F8B0F83C106837DB4010F858A060000837DBC017544B83B0000#
- add tmp1, 30 //360
- mov [tmp1], #0033D23E8A55B0C0E2033E0255B886F203C2807DB804740E807DB805741166890183C102EB3C668901C6410224EB0C05#
- add tmp1, 30 //390
- mov [tmp1], #00400000668901C641020083C103EB22B83B05000033D23E8A55B0C0E20386F203C26689013E8B55B803559089510283#
- add tmp1, 30 //3C0
- mov [tmp1], #C1068BD9E9C702000000000000000000#
- add tmp1, 30 //3F0
- mov [tmp1], #9090909090909090909090909090909057538B7DDC8B3F8B1F83C306837DB4010F859F000000837DBC017551807DB005#
- add tmp1, 30 //420
- mov [tmp1], #742AB83800000033D23E8A55B8C0E2033E0255B086F203C266890383C302807DB0047524C6032483C301EB1CB8384500#
- add tmp1, 30 //450
- mov [tmp1], #0033D23E8A55B8C0E20386F203C2668903C643020083C303E923020000807DB0047423807DB005742BB88038000033D2#
- add tmp1, 30 //480
- mov [tmp1], #3E8A55B086F203C26689038B55B888530283C303EB5AC703833C24008B55B8885303EB0CC703837D00008A55B8885303#
- add tmp1, 30 //4B0
- mov [tmp1], #83C304EB3B837DBC017521B83805000033D23E8A55B8C0E20386F203C26689033E8B55B089530283C306EB1466C70380#
- add tmp1, 30 //4E0
- mov [tmp1], #3D8B55B08953028A45B888430683C307E99B010000909090909090909090909057538B7DDC8B3F8B1F83C306837DB401#
- add tmp1, 30 //510
- mov [tmp1], #0F85CA040000837DBC017544B83A00000033D23E8A55B0C0E2033E0255B886F203C2807DB804740E807DB80574116689#
- add tmp1, 30 //540
- mov [tmp1], #0383C302EB39668903C6430224EB0C0500400000668903C643020083C303EB1FB83A05000033D23E8A55B0C0E20386F2#
- add tmp1, 30 //570
- mov [tmp1], #03C26689033E8B55B889530283C306E90C010000900000000000000000000000#
- add tmp1, 30 //5A0
- mov [tmp1], #0000000090909090909090909090909057538B7DDC8B3F8B1F83C306837DB4010F851A040000837DBC01751EB83BC000#
- add tmp1, 30 //5D0
- mov [tmp1], #0033D23E8A55B0C0E2033E0255B886F203C266890383C302EB4B3E8B55B881FA80000000731AB883F8000033C93E8A4D#
- add tmp1, 30 //600
- mov [tmp1], #B086E903C166890388530283C303EB258B4DB083F900750BC6033D89530183C305EB12B881F8000086E903C166890389#
- add tmp1, 30 //630
- mov [tmp1], #530283C306EB59909090909090909090#
- add tmp1, 30 //660
- add tmp1, 30 //690
- mov [tmp1], #895DAC5B5F33C08A45D03A434C0F851D0300009090909090909090909090909033C08A46048D04408BD38B5482688BC7#
- add tmp1, 30 //6C0
- mov [tmp1], #FFD23C06740E3C07740E3C0A740E3C0B740EEB0EB00AEB0AB00BEB06B006EB02B007508B83E00000000345EC0345908B#
- add tmp1, 30 //6F0
- mov [tmp1], #55AC8BCA2BC87826F7D14980F980720B5883C0708802884A01EB3D5886E0050F80000066890283E904894A02EB2AF7D1#
- add tmp1, 30 //720
- mov [tmp1], #4181F981000000770E5883C070880283E902884A01EB115886E0050F80000066890283E906894A02E973020000000000#
- add tmp1, 30 //750
- mov [tmp1], #0000000000000000000000000090909033C08A46058D04408BD38B5482688BC7FFD28845EB33C08A46078D04408BD38B#
- add tmp1, 30 //780
- mov [tmp1], #5482688BC7FFD28BC88B7DDC8B3F8B1F83C3063D80000000771433C08A45EB86E00583C00000668903884B02EB1E33C0#
- add tmp1, 30 //7B0
- mov [tmp1], #8A45EB3C007508C60305894B01EB0D86E00581C00000668903894B02E9EF010000000000000000000000000000000090#
- add tmp1, 30 //7E0
- mov [tmp1], #33C08A46058D04408BD38B5482688BC7FFD28845EB33C08A46068D04408BD38B5482688BC7FFD28845EA8B7DDC8B3F8B#
- add tmp1, 30 //810
- mov [tmp1], #1F33C08A45EBC1E0030245EA86E0058BC0000066894306E9940100000000000000000000000000000000000000000000#
- add tmp1, 30 //840
- mov [tmp1], #33C08A46058D04408BD38B5482688BC7FFD28845EB33C08A46078D04408BD38B5482688BC7FFD28BC8034D908B7DDC8B#
- add tmp1, 30 //870
- mov [tmp1], #3F8B1F83C306807DEB00741733C08A45EBC0E00386E00589050000668903894B02EB06C603A3894B01E9220100000000#
- add tmp1, 30 //8A0
- mov [tmp1], #0000000000000090909090909090909033C08A46058D04408BD38B5482688BC7FFD28845EB33C08A46068D04408BD38B#
- add tmp1, 30 //8D0
- mov [tmp1], #5482688BC7FFD28845EA33C08A46078D04408BD38B5482688BC7FFD28BC88B7DDC8B3F8B1F83C306807DEB04743B3D80#
- add tmp1, 30 //900
- mov [tmp1], #000000771A33C08A45EAC0E0030245EB86E00589400000668903884B02EB5533C08A45EAC0E0030245EB86E005898000#
- add tmp1, 30 //930
- mov [tmp1], #00668903894B02EB3B3D80000000771B33C08A45EAC0E00386E00589440000668903C6430224884B03EB1933C08A45EA#
- add tmp1, 30 //960
- mov [tmp1], #C0E00386E00589840000668903C6430224894B03EB4A90909000000000000000#
- add tmp1, 30 //990
- mov [tmp1], #0000000000000000000000000000009053568BF28BD83B731C7602EB338BC6F7ABE40000000343585E5BC39000000000#
- add tmp1, 30 //9C0
- mov [tmp1], #8B7DDC8B0783C004833800740A8907FF4704E92AF6FFFF6190900000000000009090#
- mov tmp1, freeloc
- add tmp1, 2 //2
- mov [tmp1], EBXaddr
- mov tmp2, freeloc
- add tmp2, 0B00 //freeloc+0B00
- add tmp1, 5 //7
- mov [tmp1], tmp2
- add tmp1, 5 //C
- mov [tmp1], tmp2
- mov [tmp2], lastsecbase //loc for storing sc after API
- add tmp1, 1A //26
- eval "call 0{func1}"
- asm tmp1, $RESULT
- add tmp1, 15 //3B
- eval "call 0{func2}"
- asm tmp1, $RESULT
- add tmp1, 8 //43
- mov [tmp1], ori1
- add tmp1, 0C //4F
- eval "call 0{func3}"
- asm tmp1, $RESULT
- cmp newver, 1
- je lab70_1
- mov tmp1, freeloc
- add tmp1, 54 //54
- mov [tmp1], #83C40490#
- lab70_1:
- mov tmp1, freeloc
- mov tmp2, tmp1
- mov tmp3, tmp1
- mov tmp4, tmp1
- mov tmp5, tmp1
- add tmp5, A90 //freeloc+A90
- mov [tmp5], imgbasefromdisk
- add tmp3, 1F8 //cmp type 0
- bp tmp3
- add tmp4, 1FE //cmp type 1
- bp tmp4
- add tmp1, 9d8 //9d8
- bp tmp1 //end point
- add tmp2, 9E0 //error point
- bp tmp2
- mov eip, freeloc
- eob lab71
- eoe lab71
- esto
- lab71:
- cmp eip, tmp1
- je lab72
- cmp eip, tmp2
- je lab73
- cmp eip, tmp3
- je lab74
- cmp eip, tmp4
- je lab75
- jmp error
- lab72:
- bc tmp1
- bc tmp2
- bc tmp3
- bc tmp4
- //msg "Fix advanced IAT protection OK!"
- //pause
- mov eip, tmp9 //restore eip
- jmp lab76
- lab73:
- msg "Something error"
- //pause
- jmp end
- lab74:
- msg "cmp type 0"
- pause
- eob lab71
- eoe lab71
- esto
- lab75:
- msg "cmp type 1"
- pause
- eob lab71
- eoe lab71
- esto
- lab76:
- fill freeloc, E10, 00
- fill lastsecbase, lastsecsize, 00
- mov tmp1, type3count
- add tmp1, E8count
- mov tmp2, [EBXaddr+18]
- cmp tmp1, tmp2
- je lab78
- msg "Warning, there are some API not resolved!"
- //pause
- lab78:
- mov caller, "nil"
- mov tmp1, [esp]
- find dllimgbase, #C6463401# //search "mov byte[esi+34], 1"
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- find tmp2, #68????????68????????68#
- mov transit2, $RESULT
- cmp transit2, 0
- je error
- //log transit2
- bp transit2
- find tmp1, #01049?43# //search "add dword ptr [edi+ebx*4],edx" "inc ebx"
- mov tmp2, $RESULT
- cmp tmp2, 0
- jne lab80
- find tmp1, #01148740# //search "add dword ptr [edi+eax*4],edx" "inc eax"
- mov tmp2, $RESULT
- cmp tmp2, 0
- jne lab80
- find tmp1, #3137300D0A#
- cmp $RESULT, 0
- jne lab80_1
- mov tmp1, [esp]
- mov tmp2, [tmp1]
- cmp tmp2, 68
- jne lab80_1
- mov tmp2, [tmp1+5], 1
- cmp tmp2, 68
- jne lab80_1
- mov tmp2, [tmp1+6]
- cmp tmp2, tmp1
- jne lab80_1
- //Internal VM decrypt
- mov VMstartaddr, tmp1
- add tmp1, 20
- find tmp1, #68????????68????????68#
- mov VMlength, $RESULT
- cmp VMlength, 0
- je lab80_1
- sub VMlength, VMstartaddr
- cmp VMlength, 900
- ja error
- log VMlength
- cmp VMcodeloc, 0
- jne lab78_1
- alloc 10000
- mov VMcodeloc, $RESULT
- lab78_1:
- log VMcodeloc
- lm VMcodeloc, 4000, "d:\Asprvm8s.bin"
- mov tmp1, VMcodeloc
- mov tmp2, VMcodeloc
- add tmp2, 3f00
- add tmp1, 2
- mov [tmp1], tmp2
- add tmp1, 2821
- asm tmp1, "call GetCurrentProcessId"
- add tmp1, 56
- asm tmp1, "call GetCurrentProcessId"
- //copy code
- mov tmp1, VMcodeloc
- add tmp1, 4500 //VMcodeloc+4500
- mov [tmp1], [VMstartaddr], VMlength
- coe
- cob
- mov tmp1, VMcodeloc
- mov tmp2, [VMstartaddr+B]
- add tmp1, 9 //VMcodeloc+9
- mov [tmp1], tmp2
- mov tmp2, [VMstartaddr+6]
- add tmp1, 7 //VMcodeloc+10
- mov [tmp1], tmp2
- add tmp1, 2CCE //VMcodeloc+2CDE--end point
- bp tmp1
- mov tmp9, eip
- mov eip, VMcodeloc
- run
- cmp eip, tmp1
- jne error
- bc tmp1
- mov eip, tmp9
- find dllimgbase, #01049?43# //search "add dword ptr [edi+ebx*4],edx" "inc ebx"
- mov tmp2, $RESULT
- cmp tmp2, 0
- jne lab80
- find dllimgbase, #01148740# //search "add dword ptr [edi+eax*4],edx" "inc eax"
- mov tmp2, $RESULT
- cmp tmp2, 0
- je lab80_1
- lab80:
- add tmp2, 9
- bp tmp2
- lab80_1:
- eob lab80_2
- eoe lab80_2
- esto
- lab80_2:
- cmp eip, tmp2
- je lab81
- cmp eip, transit2
- je lab83
- esto
- lab81:
- bc tmp2
- mov tmp1, eip
- mov tmp2, [tmp1+1]
- and tmp2, 0F
- cmp tmp2, 6
- je lab81_1
- cmp tmp2, 7
- je lab81_2
- msg "Unknown Asprotect API register"
- jmp error
- lab81_1:
- mov AsprAPIloc, esi
- jmp lab81_3
- lab81_2:
- mov AsprAPIloc, edi
- lab81_3:
- mov count, 40 //Need free space 40 bytes for 1.3x
- call FindEMUAddr
- //log EmuAddr
- mov tmp1, eip
- mov tmp1, [tmp1-3], 1
- cmp tmp1, 0E
- je lab81_8
- cmp tmp1, 0F
- je lab81_8
- msg "Unknown Asprotect API "
- //pause
- jmp error
- lab81_8:
- cmp isdll, 1
- jne lab81_9
- cmp imgbasefromdisk, imgbase
- je lab81_9
- mov tmp3, tmp1
- mov tmp4, AsprAPIloc
- loop12:
- cmp tmp3, 0
- je loop12_2
- mov tmp2, [tmp4]
- cmp tmp2, 0
- je loop12_1
- mov tmp5, tmp2
- sub tmp2, imgbase
- eval "{tmp5} {tmp2}(RVA)"
- log $RESULT, "Aspr SDK API "
- loop12_1:
- sub tmp3, 1
- add tmp4, 4
- jmp loop12
- loop12_2:
- mov tmp3, tmp1
- shl tmp3, 2
- fill AsprAPIloc, tmp3, 00
- jmp lab81_16
- lab81_9:
- //clear dip
- mov tmp1, AsprAPIloc
- mov [tmp1], 0
- add tmp1, 2c
- mov [tmp1], 0
- //add breakpoint
- mov tmp5, 0
- mov tmp6, 0
- mov tmp7, 0
- mov tmp8, 0
- mov tmp1, AsprAPIloc
- add tmp1, 4
- mov tmp5, [tmp1] //GetRegistrationInformation
- cmp tmp5, 0
- je lab81_13
- mov tmp3, 0
- find tmp5, #C20400#, 100
- mov tmp2, $RESULT
- cmp tmp2, 0
- je lab81_9_2
- mov tmp1, tmp5
- lab81_9_0:
- findop tmp1, #E8????????#
- mov tmp1, $RESULT
- cmp tmp1, tmp2
- ja lab81_10
- mov tmp3, [tmp1+1]
- add tmp3, tmp1
- add tmp3, 5
- cmp tmp3, lastsecbase
- ja lab81_9_1
- cmp tmp3, 1stsecbase
- jb lab81_9_1
- mov tmp4, [tmp3]
- cmp tmp4, 0D285C931
- je lab81_9_2
- mov tmp4, [tmp3+2]
- cmp tmp4, D88BF28B
- jne lab81_9_1
- mov tmp4, [tmp3+6]
- cmp tmp4, D38BC68B
- je lab81_9_2
- lab81_9_1:
- add tmp1, 5
- jmp lab81_9_0
- lab81_9_2:
- mov caller, "chkGRI"
- lab81_10:
- bp tmp5
- lab81_13:
- mov tmp1, AsprAPIloc
- add tmp1, 10 //10
- mov tmp6, [tmp1] //GetHardwareID
- cmp tmp6, 0
- je lab81_14
- bp tmp6
- lab81_14:
- mov tmp1, AsprAPIloc
- add tmp1, 30 //30
- mov tmp7, [tmp1] //GetEncryptProc
- cmp tmp7, 0
- je lab81_15
- bp tmp7
- lab81_15:
- mov tmp1, AsprAPIloc
- add tmp1, 34 //34
- mov tmp8, [tmp1] //GetDecryptProc
- cmp tmp8, 0
- je lab81_16
- bp tmp8
- lab81_16:
- eoe lab82
- eob lab82
- esto
- lab82:
- cmp eip, tmp5
- je 13xGRI
- cmp eip, tmp6
- je 13xGHI
- cmp eip, tmp7
- je 13xGEP
- cmp eip, tmp8
- je 13xGDP
- cmp eip, transit2
- je lab90
- esto
- 13xGRI:
- bc tmp5
- scmp caller, "chkGRI"
- jne 13xGRI_2
- coe
- cob
- mov tmp2, [esp]
- mov tmp1, esp
- add tmp1, 4
- mov tmp3, EmuAddr
- add tmp3, 4
- mov [tmp1], tmp3 //put blank first
- eval "eip == 0{tmp2}"
- tocnd $RESULT
- 13xGRI_1:
- mov caller, "nil"
- jmp 13xGRI_3
- 13xGRI_2:
- mov tmp2, EmuAddr
- add tmp2, 4
- mov tmp1, esp
- add tmp1, 4
- mov [tmp1], tmp2
- 13xGRI_3:
- mov [EmuAddr], #04000000566F6C58# //"VolX"
- log EmuAddr, "GetRegistrationInformation "
- add EmuAddr, 10
- //msg "13xGRI"
- //pause
- eoe lab82
- eob lab82
- esto
- 13xGHI:
- bc tmp6
- mov [EmuAddr], #31323334353637382D34343434# //"12345678-4444"
- mov tmp1, esp
- add tmp1, 4
- mov [tmp1], EmuAddr
- log EmuAddr, "GetHardwareID "
- add EmuAddr, 10
- //msg "13xGHI"
- //pause
- eoe lab82
- eob lab82
- esto
- 13xGEP:
- bc tmp7
- mov tmp1, esp
- add tmp1, 4
- mov [tmp1], EmuAddr
- log EmuAddr, "GetEncryptProc "
- add EmuAddr, 10
- //msg "13xGEP"
- //pause
- mov tmp1, AsprAPIloc
- add tmp1, 30
- mov [tmp1], 0
- eoe lab82
- eob lab82
- esto
- 13xGDP:
- bc tmp8
- mov [EmuAddr], #C3#
- mov tmp1, esp
- add tmp1, 4
- mov [tmp1], EmuAddr
- log EmuAddr, "GetDecryptProc "
- //msg "13xGDP"
- //pause
- mov tmp1, AsprAPIloc
- add tmp1, 34
- mov [tmp1], 0
- eoe lab82
- eob lab82
- esto
- //Fix VB Aspr SDK API
- lab83:
- cmp isdll, 1
- je lab90
- cmp DFCaddr, 0
- je lab90
- GMEMI iatendaddr, MEMORYBASE
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- cmp tmp1, 1stsecbase
- jne lab90
- bc transit2
- cob
- coe
- mov tmp1, freeloc
- mov [tmp1], #609CB8FF000000BF00104000B900100D00F2AEE376803F2575F78B5F0181FB0010400072EC81FB00204D0077E48B1381#
- add tmp1, 30
- mov [tmp1], #FA19A0006675DA8BF74E909090909090BD0002EF00BF00104000B900100D00B8B8000000F2AEE333393775F8807FFA68#
- add tmp1, 30
- mov [tmp1], #75F28B5FFB8B5304833A1077E7837A040075E18BDF83EB11803BA175D7895D008B1A4B895D0483C508EBC99D61909000#
- mov tmp1, freeloc
- add tmp1, 8
- mov [tmp1], 1stsecbase
- add tmp1, 5 //0D
- mov [tmp1], 1stsecsize
- add tmp1, 12 //1F
- mov [tmp1], 1stsecbase
- add tmp1, 8 //27
- mov tmp2, 1stsecbase
- add tmp2, 1stsecsize
- mov [tmp1], tmp2
- add tmp1, 0A //31
- mov [tmp1], DFCaddr
- add tmp1, 10 //41
- mov [tmp1], thunkdataloc
- add tmp1, 5 //46
- mov [tmp1], 1stsecbase
- add tmp1, 5 //4B
- mov [tmp1], 1stsecsize
- add tmp1, 42 //8D -- end point
- bp tmp1
- mov tmp7, eip
- mov eip, freeloc
- run
- cmp eip, tmp1
- jne error
- bc tmp1
- mov eip, tmp7
- fill freeloc, 100, 00
- mov count, 160 //Need free space 160 bytes for VB
- call FindEMUAddr
- lab84:
- add EmuAddr, 40 //put extra space
- mov tmp5, 0 //counter
- mov tmp1, AsprAPIloc
- add tmp1, 4
- mov tmp6, thunkdataloc
- mov caller, "lab84"
- jmp lab46_2
- lab85:
- mov caller, "nil"
- fill thunkdataloc, 100, 00
- lab90:
- bc transit2
- cmp VMstartaddr, 0
- je lab90_1
- mov tmp1, [VMcodeloc+4500]
- cmp tmp1, 0
- je lab90_1
- mov tmp1, VMcodeloc
- add tmp1, 4514 //skip first 14 bytes
- mov tmp2, VMstartaddr
- add tmp2, 14 //skip first 14 bytes
- mov tmp3, VMlength
- sub tmp3, 14 //skip first 14 bytes
- mov [tmp2], [tmp1], tmp3
- fill VMcodeloc, 5000, 00
- mov VMstartaddr, 0
- lab90_1:
- cob
- coe
- mov caller, "nil"
- find dllimgbase, #3135330D0A# //search ASCII"153"
- mov tmp2, $RESULT
- sub tmp2, 40
- find tmp2, #5?5?C3#
- mov tmp3, $RESULT
- cmp tmp3, 0
- je error
- add tmp3, 2
- rtr
- bp tmp3
- eob lab91
- eoe lab91
- esto
- lab91:
- cmp eip, tmp3
- je lab92
- esto
- lab92:
- bc tmp3
- find dllimgbase, #3130330D0A# //search ASCII"103"
- mov tmp2, $RESULT
- cmp tmp2, 0
- je wrongver
- find tmp2, #8D00C3# //search "lea eax,[eax]" "ret"
- mov tmp1, $RESULT
- cmp tmp1, 0
- je wrongver
- bphws tmp1, "x"
- eob lab93
- eoe lab93
- esto
- lab93:
- cmp eip, tmp1
- je lab94
- esto
- lab94:
- bphwc tmp1
- cob
- coe
- find eip, #C700E1000000#
- mov tmp1, $RESULT
- cmp tmp1, 0
- jne lab95
- find eip, #C600E1#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- lab95:
- find tmp1, #A1????????894?# //search "mov eax, [xxxxxxxx]","mov [e?p+??],reg32"
- mov tmp3, $RESULT
- cmp tmp3, 0
- je error
- mov tmp2, 0
- mov tmp2, [tmp3+1]
- mov tmp1, [tmp2]
- cmp tmp1, 0
- jne lab99
- lab98:
- rtr
- sti
- GMEMI eip, MEMORYOWNER
- mov tmp3, $RESULT
- mov tmp2, lastsecbase
- add tmp2, lastsecsize
- cmp tmp3, tmp2
- ja lab98_1
- cmp 1stsecbase, tmp3
- jb error
- GMEMI eip, MEMORYSIZE
- mov tmp1, $RESULT
- add tmp3, tmp1
- eval "eip > 0{tmp3}"
- jmp lab98_2
- lab98_1:
- eval "eip < 0{tmp3}"
- lab98_2:
- ticnd $RESULT
- mov tmp1, eip
- sub tmp1, imgbase
- mov OEP_rva, tmp1
- cmp sdksccount, 0
- je lab141 //Go to dump file
- mov tmp3, eip
- jmp lab104
- lab99:
- bp tmp1
- eob lab99_1
- eoe lab99_1
- esto
- lab99_1:
- cmp eip, tmp1
- je lab100
- esto
- lab100:
- bc tmp1
- mov OEPscaddr, eip
- find eip, #00000000000000000000000000000000#
- mov patchaddr, $RESULT
- mov tmp1, patchaddr
- sub tmp1, 10
- mov tmp4, 20
- mov count, 0
- loop15:
- cmp tmp4, 0
- je notfound
- mov tmp2, [tmp1], 2
- cmp tmp2, 0
- je loop15_1
- mov count, 0
- sub tmp1, 1
- sub tmp4, 1
- jmp loop15
- loop15_1:
- add count, 1
- cmp count, 4
- je loop16
- sub tmp1, 2
- sub tmp4, 2
- jmp loop15
- loop16:
- mov vcrefend, tmp1
- mov tmp2, 0
- mov count, 0
- loop16_1:
- mov tmp2, [vcrefend-8]
- add tmp2, imgbase
- mov tmp1, [tmp2], 1
- cmp tmp1, 0E9
- je lab101
- sub vcrefend, 1
- add count, 1
- cmp count, 2
- je notfound
- jmp loop16_1
- lab101:
- mov tmp1, vcrefend
- sub tmp1, 4
- mov tmp4, 200
- mov count, 0
- loop17:
- cmp tmp4, 0
- je notfound
- mov tmp2, [tmp1]
- cmp tmp2, 00000000
- je loop17_1
- sub tmp1, 8
- sub tmp4, 8
- jmp loop17
- loop17_1:
- cmp count, 1
- je lab102
- add count, 1
- sub tmp1, 8
- sub tmp4, 8
- jmp loop17
- lab102:
- mov tmp4, tmp1
- add tmp4, 4
- mov vcrefstart, tmp4
- loop18:
- cmp tmp4, vcrefend
- jae lab103
- mov tmp1, [tmp4]
- add tmp1, imgbase
- eval "{tmp1}"
- add tmp4, 4
- mov tmp2, [tmp4]
- add tmp2, OEPscaddr //tmp2== address to put comment
- cmt tmp2, $RESULT
- add tmp4, 4
- jmp loop18
- lab103:
- mov tmp1, vcrefend
- sub tmp1, vcrefstart
- mov sttablesize, tmp1
- dm vcrefstart, sttablesize, "st_table.bin"
- GCMT eip
- mov tmp1, $RESULT
- ATOI tmp1
- mov tmp2, $RESULT
- sub tmp2, imgbase
- mov OEP_rva, tmp2
- mov tmp3, $RESULT
- lab104:
- mov tmp1, lastsecbase
- add tmp1, lastsecsize
- lab106_1:
- mov virtualsec, tmp1
- mov tmp1, 0
- cmp SDKsize, 0
- je lab106_2
- //With SDK stolen section
- mov newphysecsize, SDKsize
- lab106_2:
- cmp OEPscaddr, 0
- je lab106_3
- //With OEP stolen code
- GMEMI OEPscaddr, MEMORYSIZE
- mov tmp2, $RESULT
- add newphysecsize, tmp2
- lab106_3:
- cmp 55sc, 1
- jne lab106_4
- //wz std function
- add newphysecsize, 1000
- lab106_4:
- add newphysecsize, 1000 //extra 1000 bytes
- alloc newphysecsize
- mov newphysec, $RESULT
- //log newphysec
- cmp dataloc, 0
- jne lab106_5
- alloc 4000
- mov dataloc, $RESULT
- //log dataloc
- jmp lab106_6
- lab106_5:
- fill dataloc, 4000, 00 //clear data
- lab106_6:
- cmp OEPscaddr, 0
- je lab121
- //analyse OEP stolen code
- find dllimgbase, #33340D0A#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je error
- find tmp1, #FF35????????68#
- mov tmp2, $RESULT
- cmp tmp2, 0
- je error
- mov tmp1, [tmp2+2]
- mov scstk, [tmp1]
- //log scstk
- //chk free space
- mov patchaddr, vcrefend
- add patchaddr, 20
- and patchaddr, fffffff0
- //log patchaddr
- GMEMI OEPscaddr, MEMORYSIZE
- mov tmp1, $RESULT
- GMEMI OEPscaddr, MEMORYOWNER
- mov tmp2, $RESULT
- mov tmp3, tmp1
- //Assume every 1000 bytes will need A0 bytes of free space
- shr tmp3, 0C
- mov tmp4, tmp3
- shl tmp3, 7
- shl tmp4, 5
- add tmp3, tmp4
- //log tmp3, "Free space need = "
- add tmp1, tmp2
- sub tmp1, patchaddr
- //log tmp1, "Free space exist = "
- cmp tmp1, tmp3
- ja lab107
- mov patchaddr, lastsecbase
- jmp lab108
- lab107:
- mov patchinsamesec, 1
- lab108:
- call FillSCPatch
- lab109:
- mov tmp1, freeloc
- mov tmp2, dataloc
- add tmp2, 800 //dataloc+800
- mov tmp3, tmp1
- add tmp3, 0D00 //freeloc+D00
- add tmp1, 5 //5
- mov [tmp1], tmp3
- add tmp1, 5 //0A
- mov [tmp1], scstk
- add tmp1, 0D //17
- mov [tmp1], tmp2
- add tmp1, 2A //41
- mov [tmp1], vcrefstart
- add tmp1, 19 //5A
- mov [tmp1], tmp2
- add tmp1, 7 //61
- mov [tmp1], patchaddr
- add tmp1, 5 //66
- mov [tmp1], scstk
- add tmp1, 77F //7E5
- mov [tmp1], vcrefstart
- add tmp1, d //7F2
- mov [tmp1], vcrefend
- mov tmp4, freeloc
- add tmp4, C9C
- mov tmp1, dataloc
- add tmp1, 1000
- mov [tmp4], tmp1
- add tmp4, 4
- mov [tmp4], dataloc
- mov tmp4, freeloc
- add tmp4, 7D9 //end point
- bp tmp4
- mov tmp5, tmp4
- add tmp5, 7 //error point 7E0
- bp tmp5
- mov tmp7, eip //save eip
- mov eip, freeloc
- eob lab110
- eoe lab110
- esto
- lab110:
- cmp eip, tmp5
- je patcherr
- cmp eip, tmp4
- je lab111
- jmp error
- lab111:
- bc tmp4
- bc tmp5
- mov eip, tmp7
- mov tmp1, freeloc
- add tmp1, CAC
- mov patchendaddr, [tmp1]
- //msg "OEP stolen code analyze OK!"
- //pause
- fill freeloc, 0d00, 00 //cleaning location storing call xxxxxxxx address
- mov curzeroVA, eip
- mov newzeroVA, newphysec
- mov virzeroVA, virtualsec
- mov tmp1, vcrefend
- mov tmp2, [tmp1+0C]
- add tmp2, OEPscaddr
- mov findendaddr, tmp2
- mov caller1, "lab111"
- jmp lab160 //copy code to new section
- lab113:
- mov caller1, "nil"
- cmp patchinsamesec, 1
- je lab121
- fill lastsecbase, lastsecsize, 00
- mov patchinsamesec, 0 //restore flag
- //Analyse SDK stolen code
- lab121:
- cmp sdksccount, 0
- je lab141
- mov count, 0 //counter for fixed sdk stolen code section
- mov tmp1, [xtrascloc]
- cmp tmp1, 0
- je lab150
- lab122:
- mov tmp1, freeloc
- add tmp1, EF0 //freeloc+EF0
- mov [tmp1], xtrascloc
- lab123:
- mov tmp1, freeloc
- add tmp1, EF0
- mov tmp4, [tmp1]
- mov scstk, [tmp4]
- cmp scstk, 0
- je lab150
- //log scstk
- add tmp4, 4
- mov [tmp1], tmp4 //address point to next stolen code section
- mov sdkscaddr, [scstk+18]
- cmp sdkscaddr, 0
- je lab131
- log sdkscaddr, "SDK stolen code section address = "
- find sdkscaddr, #0000000000000000#
- mov findendaddr, $RESULT
- add findendaddr, 8
- mov patchaddr, findendaddr
- add patchaddr, 10
- and patchaddr, fffffff0
- //log patchaddr
- //Check if the freespace is sufficinet
- GMEMI findendaddr, MEMORYOWNER
- mov tmp1, $RESULT
- GMEMI patchaddr, MEMORYOWNER
- mov tmp2, $RESULT
- cmp tmp1, tmp2
- jne lab124
- GMEMI findendaddr, MEMORYSIZE
- mov tmp1, $RESULT
- //log tmp1, "Section size = "
- mov tmp3, tmp1
- //Assume every 1000 bytes will need C0 bytes of free space
- shr tmp3, 0C
- mov tmp4, tmp3
- shl tmp3, 7
- shl tmp4, 6
- add tmp3, tmp4
- //log tmp3, "Free space need = "
- add tmp1, tmp2
- sub tmp1, patchaddr
- //log tmp1, "Free space exist = "
- cmp tmp1, tmp3
- ja lab125
- lab124:
- mov patchaddr, lastsecbase
- mov patchinsamesec, 0
- jmp lab126
- lab125:
- mov patchinsamesec, 1
- lab126:
- call FillSCPatch
- lab127:
- mov tmp1, freeloc
- mov tmp2, dataloc
- add tmp2, 800 //dataloc+800
- mov tmp3, tmp1
- add tmp3, 0D00 //freeloc+D00
- add tmp1, 5 //5
- mov [tmp1], tmp3
- add tmp1, 5 //0A
- mov [tmp1], scstk
- add tmp1, 0D //17
- mov [tmp1], tmp2
- add tmp1, 2A //41
- mov [tmp1], findendaddr
- add tmp1, 19 //5A
- mov [tmp1], tmp2
- add tmp1, 7 //61
- mov [tmp1], patchaddr
- add tmp1, 5 //66
- mov [tmp1], scstk
- add tmp1, A7 //10D
- mov [tmp1], #18#
- add tmp1, 6D7 //7E4
- mov [tmp1], #C390909090#
- mov tmp4, freeloc
- add tmp4, C9C
- mov tmp1, dataloc
- add tmp1, 1000
- mov [tmp4], tmp1
- add tmp4, 4
- mov [tmp4], dataloc
- mov tmp4, freeloc
- add tmp4, 7D9 //end point
- bp tmp4
- mov tmp5, tmp4
- add tmp5, 7 //error point 7E0
- bp tmp5
- mov tmp7, eip //save eip
- mov eip, freeloc
- eob lab128
- eoe lab128
- esto
- lab128:
- cmp eip, tmp5
- je patcherr
- cmp eip, tmp4
- je lab129
- jmp error
- lab129:
- bc tmp4
- bc tmp5
- mov eip, tmp7 //restore eip
- //msg "SDk section analyze OK!"
- //pause
- mov patchendaddr, [freeloc+0CAC]
- lab130:
- add count, 1
- fill freeloc, 0d00, 00 //cleaning location storing call xxxxxxxx address
- lab131:
- mov curzeroVA, sdkscaddr
- lab132:
- cmp newpatchaddr, 0 //1st stolen code section ?
- jne lab133
- mov virzeroVA, virtualsec
- mov newzeroVA, newphysec
- jmp lab134
- lab133:
- mov tmp1, newpatchendaddr
- and tmp1, 0FFFFFF00
- add tmp1, 200
- mov newzeroVA, tmp1
- sub tmp1, newphysec //offset
- add tmp1, virtualsec
- mov virzeroVA, tmp1
- lab134:
- mov caller1, "lab134"
- mov eip, tmp7
- jmp lab160 //move code to new section
- lab135:
- mov caller1, "nil"
- lab137:
- fill dataloc, 4000, 00 //clear data
- cmp patchinsamesec, 1
- je lab138
- fill lastsecbase, lastsecsize, 00 //clear last sec
- lab138:
- mov tmp4, [freeloc+EF0]
- mov scstk, [tmp4]
- //log scstk
- cmp scstk, 0 //Process all SDK section with scstk ?
- jne lab123
- //Process SDK section without scstk
- mov tmp9, newpatchendaddr
- mov tmp1, freeloc
- add tmp1, 0E00
- mov tmp8, xtrascloc
- add tmp8, 80
- mov [tmp1], tmp8
- lab139:
- mov tmp1, freeloc
- add tmp1, 0E00
- mov tmp8, [tmp1]
- mov tmp6, [tmp8]
- cmp tmp6, 0
- je lab141
- and tmp9, 0FFFFFF00
- add tmp9, 200
- mov newzeroVA, tmp9
- sub tmp9, newphysec //offset
- add tmp9, virtualsec
- mov virzeroVA, tmp9
- mov curzeroVA, [tmp8+4]
- mov sdkscaddr, [tmp8+4]
- find curzeroVA, #000000000000000000000000#
- mov tmp4, $RESULT
- cmp tmp4, 0
- je error
- sub tmp4, curzeroVA //size to copy
- mov tmp1, freeloc
- mov [tmp1], #609CBE0039F600BF00296900B990000000F2A49D619090000000000000000000#
- mov tmp1, freeloc
- add tmp1, 3
- mov [tmp1], curzeroVA
- add tmp1, 5 //8
- mov [tmp1], newzeroVA
- add tmp1, 5 //D
- mov [tmp1], tmp4
- add tmp1, 8 //15 --end point
- bp tmp1
- mov tmp7, eip
- mov eip, freeloc
- run
- cmp eip, tmp1
- jne error
- bc tmp1
- mov eip, tmp7
- fill freeloc, 100, 00
- mov tmp9, newzeroVA
- add tmp9, tmp4
- mov newpatchendaddr, tmp9
- mov caller1, "lab139"
- jmp lab180
- lab140:
- mov caller1, "nil"
- mov tmp1, freeloc
- add tmp1, 0E00
- mov tmp8, [tmp1]
- add tmp8, 8
- mov [tmp1], tmp8
- mov tmp9, newpatchendaddr
- jmp lab139
- lab141:
- cmp 55sc, 0
- je lab143
- cmp newphysec, 0
- jne lab141_1
- alloc 1000
- mov newphysec, $RESULT
- mov newzeroVA, newphysec
- mov tmp1, lastsecbase
- add tmp1, lastsecsize
- mov virtualsec, tmp1
- mov virzeroVA, virtualsec
- mov tmp1, 55dataloc
- jmp lab141_2
- lab141_1:
- mov tmp1, newpatchendaddr
- and tmp1, 0FFFFFF00
- add tmp1, 200
- mov newzeroVA, tmp1
- cmp virtualsec, 0
- je error
- sub tmp1, newphysec //offset
- add tmp1, virtualsec
- mov virzeroVA, tmp1
- mov tmp1, 55dataloc
- //process std function
- lab141_2:
- mov tmp2, [tmp1]
- cmp tmp2, 0
- je lab143
- log tmp2, "Std function at "
- mov tmp3, 0
- mov tmp3, [tmp2], 1
- cmp tmp3, 0e9
- je lab141_3
- cmp tmp3, 68
- jne error
- mov tmp4, [tmp2+1]
- jmp lab141_4
- lab141_3:
- GCI tmp2, DESTINATION
- mov tmp4, $RESULT
- lab141_4:
- find tmp4, #0000000000000000#
- mov tmp5, $RESULT
- cmp tmp5, 0
- je error
- sub tmp5, tmp4
- mov [newzeroVA], [tmp4], tmp5
- cmp tmp3, 0e9
- je lab141_5
- cmp tmp3, 68
- jne error
- eval "push 0{virzeroVA}"
- asm tmp2, $RESULT
- jmp lab141_6
- lab141_5:
- eval "jmp 0{virzeroVA}"
- asm tmp2, $RESULT
- lab141_6:
- add newzeroVA, tmp5
- add newzeroVA, 20
- add virzeroVA, tmp5
- add virzeroVA, 20
- add tmp1, 4
- jmp lab141_2
- lab143:
- cmp newphysec, 0
- je lab144
- mov tmp1, lastsecbase
- add tmp1, lastsecsize
- cmp tmp1, virtualsec
- je lab144
- eval "All_{virtualsec}.bin"
- DM newphysec, newphysecsize, $RESULT
- lab144:
- log iatstartaddr, "Address of IAT = "
- log iatstart_rva, "RVA of IAT = "
- log iatsize, "Size of IAT = "
- mov tmp3, OEP_rva
- add tmp3, imgbase
- GPI PROCESSNAME
- mov tmp6, $RESULT
- cob
- coe
- mov tmp1, freeloc
- mov [tmp1], #609C546A4068001000006800004000E88A160577B80002400033D2668B50068BF081C600010000B9080000008BFE83C7#
- add tmp1, 30 //30
- mov [tmp1], #08F2A4664A6683FA00740583C620EBE783C618C70661737072C7460800200000C7460C00003D01C7461000200000C746#
- add tmp1, 30 //60
- mov [tmp1], #1400003D01C74624400000E066FF4006814050002000009D6190900000000000#
- mov tmp1, freeloc
- add tmp1, 0B
- mov [tmp1], imgbase
- add tmp1, 4 //0F
- asm tmp1, "call VirtualProtect"
- add tmp1, 6 //15
- mov [tmp1], signVA
- cmp newphysec, 0 //with stolen code section?
- je lab145
- mov tmp4, lastsecbase
- add tmp4, lastsecsize
- cmp tmp4, virtualsec
- jne lab145
- add tmp1, 37 //4C
- mov [tmp1], newphysecsize
- mov tmp4, lastsecbase
- add tmp4, lastsecsize
- sub tmp4, imgbase
- add tmp1, 7 //53
- mov [tmp1], tmp4
- add tmp1, 7 //5A
- mov [tmp1], newphysecsize
- add tmp1, 7 //61
- mov [tmp1], tmp4
- add tmp1, 12 //73
- mov [tmp1], newphysecsize
- add tmp1, 6 //79 -- end point
- jmp lab145_1
- lab145:
- mov tmp1, freeloc
- add tmp1, 40
- mov [tmp1], #9D619090#
- add tmp1, 2 //42 -- end point
- lab145_1:
- bp tmp1
- mov tmp7, eip
- mov eip, freeloc
- eob lab145_2
- eoe lab145_2
- run
- lab145_2:
- cmp eip, tmp1
- je lab145_3
- jmp error
- lab145_3:
- bc tmp1
- mov eip, tmp7
- fill freeloc, 100, 00
- mov tmp1, signVA
- add tmp1, 3C //signVA+3C -- FileAlignment
- mov [tmp1], 1000
- add tmp1, 18 //signVA+54 -- SizeOfHeaders
- mov [tmp1], 1000
- cmp isdll, 0
- je lab146
- mov tmp4, 0
- mov tmp2, reloc_rva
- add tmp2, imgbase
- loop19:
- mov tmp5, [tmp2+4]
- cmp tmp5, 0
- je lab145_4
- add tmp4, tmp5
- add tmp2, tmp5
- jmp loop19
- lab145_4:
- mov reloc_size, tmp4
- add tmp1, 4C //signVA+A0 -- RVA of Relocation Table
- mov [tmp1], reloc_rva
- add tmp1, 4 //signVA+A4 -- Size of Relocation Table
- mov [tmp1], reloc_size
- log reloc_rva, "RVA of Relocation = "
- log reloc_size, "Size of Relocation = "
- eval "de_{tmp6}.dll"
- mov tmp5, $RESULT
- log tmp3, "Address of OEP = "
- log OEP_rva, "RVA of OEP = "
- mov tmp1, lastsecbase
- add tmp1, lastsecsize
- sub tmp1, imgbase
- dm imgbase, tmp1, tmp5 //dump file
- cmp newphysec, 0 //with stolen code section?
- je lab147
- mov tmp1, lastsecbase
- add tmp1, lastsecsize
- cmp tmp1, virtualsec
- jne lab147
- dma newphysec, newphysecsize, tmp5 //add stolen code section
- jmp lab147
- lab146:
- add tmp1, 4C //signVA+A0 -- RVA of Relocation Table
- mov [tmp1], 0
- add tmp1, 4 //signVA+A4 -- Size of Relocation Table
- mov [tmp1], 0
- eval "de_{tmp6}.exe"
- mov tmp5, $RESULT
- log tmp3, "Address of OEP = "
- log OEP_rva, "RVA of OEP = "
- mov tmp1, lastsecbase
- add tmp1, lastsecsize
- sub tmp1, imgbase
- dm imgbase, tmp1, tmp5 //dump file
- cmp newphysec, 0 //with stolen code section?
- je lab147
- mov tmp1, lastsecbase
- add tmp1, lastsecsize
- cmp tmp1, virtualsec
- jne lab147
- dma newphysec, newphysecsize, tmp5 //add stolen code section
- lab147:
- cmp newphysec, 0
- je lab148
- mov tmp1, lastsecbase
- add tmp1, lastsecsize
- cmp tmp1, virtualsec
- jne lab147_1
- msg "There are stolen code, check IAT data in log window"
- pause
- jmp end
- lab147_1:
- msg "There are stolen code, add stolen code section first before rebuild IAT"
- pause
- jmp end
- lab148:
- msg "No stolen code, check IAT data in log window"
- pause
- jmp end
- lab150:
- msg "lab150"
- pause
- jmp end
- //relocate Call command stolen code
- lab160:
- //log patchendaddr
- mov tmp1, freeloc
- mov [tmp1], #609CBE34027B02BF00007D01B922040000F2A4BD000259018B45008B0083F800741A8BD881EB3402FE008B530181C234#
- add tmp1, 30
- mov [tmp1], #D27E0189530183450004EBDC9D619090#
- mov tmp1, freeloc
- add tmp1, 3 //3
- mov [tmp1], curzeroVA
- add tmp1, 5 //8
- mov [tmp1], newzeroVA
- add tmp1, 5 //0D
- mov tmp2, findendaddr
- sub tmp2, curzeroVA //bytes to copy
- mov [tmp1], tmp2
- add tmp1, 7 //14
- mov tmp2, freeloc
- add tmp2, 200
- mov [tmp1], tmp2
- mov [tmp2], dataloc
- add tmp1, 12 //26
- mov tmp2, curzeroVA
- sub tmp2, newzeroVA
- mov [tmp1], tmp2
- mov tmp1, freeloc
- add tmp1, 2F //2F
- cmp curzeroVA, virtualsec
- ja lab161
- mov tmp2, virzeroVA
- sub tmp2, curzeroVA
- mov [tmp1], tmp2
- mov tmp1, freeloc
- add tmp1, 2D //2D
- mov [tmp1], #81EA#
- jmp lab162
- lab161:
- mov tmp2, curzeroVA
- sub tmp2, virzeroVA
- mov [tmp1], tmp2
- lab162:
- coe
- cob
- mov tmp1, freeloc
- add tmp1, 3E //end point
- mov tmp7, eip //save eip
- mov eip, freeloc
- bp tmp1
- run
- cmp eip, tmp1
- jne error
- bc tmp1
- mov eip, tmp7 //restore eip
- fill freeloc, 500, 00
- scmp caller1, "lab134"
- je lab164_1
- //copy and relocate jxx analysed code
- //Decide new patch addr
- //for Stolen code at OEP
- lab163:
- cmp patchinsamesec, 1
- je lab163_1
- lab163_1:
- mov tmp1, findendaddr
- sub tmp1, curzeroVA //offset
- add tmp1, newzeroVA
- mov tmp2, tmp1
- and tmp2, 0ff
- cmp tmp2, 0
- je lab164
- and tmp1, 0FFFFFFF0
- add tmp1, 20
- jmp lab165
- lab164:
- and tmp1, 0FFFFFFF0
- add tmp1, 10
- jmp lab165
- //for SDK section
- lab164_1:
- cmp patchinsamesec, 1
- je lab164_2
- mov tmp1, findendaddr
- sub tmp1, curzeroVA
- and tmp1, 0FFFFFFF0
- add tmp1, 20
- add tmp1, newzeroVA
- jmp lab165
- lab164_2:
- mov tmp1, patchaddr
- sub tmp1, curzeroVA //offset
- add tmp1, newzeroVA
- lab165:
- mov newpatchaddr, tmp1
- //log newpatchaddr
- mov tmp1, freeloc
- mov [tmp1], #609CBD000DD900BE003ED800BF2018BD01B969000000F2A49090BE0010BE018B0683F8000F84C600000083F8030F844D#
- add tmp1, 30 //30
- mov [tmp1], #0000008B4DE08B460403C18B55DC8BDA2BD083EA058950018B460803C12BC383E80689430283C3068B460C03C12BC383#
- add tmp1, 30 //60
- mov [tmp1], #E80589430183C305895DDC83C610EBAF000000000000000000000000000000008B4DE08B460403C18B55DC8BDA2BD083#
- add tmp1, 30 //90
- mov [tmp1], #EA05895001608BF333D2668B1681E2FFF0000081FA0F800000740346EBEA807E06E975F78975DC618B4DE08B55DC8BDA#
- add tmp1, 30 //C0
- mov [tmp1], #8B460803C12BC383E80689430283C3068B460C03C12BC383E80589430183C305895DDC83C610E934FFFFFF0000000090#
- add tmp1, 30 //F0
- mov [tmp1], #9D619090#
- mov tmp1, freeloc
- mov tmp2, freeloc
- add tmp2, 0D00
- add tmp1, 3 //3
- mov [tmp1], tmp2
- add tmp1, 5 //8
- mov [tmp1], patchaddr
- add tmp1, 5 //0D
- mov [tmp1], newpatchaddr
- add tmp1, 5 //12
- mov tmp3, patchendaddr
- sub tmp3, patchaddr //bytes to copy
- mov [tmp1], tmp3
- mov newpatchendaddr, tmp3
- add newpatchendaddr, newpatchaddr
- add tmp1, 9 //1B
- mov tmp2, dataloc
- add tmp2, 1000
- mov [tmp1], tmp2
- mov tmp2, freeloc
- add tmp2, 0CDC
- mov [tmp2], newpatchaddr
- add tmp2, 4
- mov [tmp2], newzeroVA
- mov tmp1, freeloc
- add tmp1, 0F2 //end point
- mov tmp7, eip
- mov eip, freeloc
- bp tmp1
- run
- cmp eip, tmp1
- jne error
- bc tmp1
- mov eip, tmp7
- fill freeloc, D00, 00
- fill dataloc, 4000, 00
- scmp caller1, "lab134"
- je lab180
- lab166:
- lm dataloc, sttablesize, "st_table.bin"
- mov tmp1, freeloc
- mov [tmp1], #609CBE0000BE01BB00004000B900906A008B0683F800741603C38B560403D18BFA2BF883EF0589780183C608EBE39D61#
- add tmp1, 30
- mov [tmp1], #90909000#
- mov tmp1, freeloc
- add tmp1, 3 //3
- mov [tmp1], dataloc
- add tmp1, 5 //8
- mov [tmp1], imgbase
- add tmp1, 5 //0D
- mov [tmp1], virzeroVA
- add tmp1, 23 //30 -- end point
- mov tmp7, eip
- mov eip, freeloc
- bp tmp1
- run
- cmp eip, tmp1
- jne error
- bc tmp1
- mov eip, tmp7
- fill freeloc, 100, 00
- fill dataloc, sttablesize, 00
- jmp lab190
- //For SDK stolen code
- //relocate analysed patch code
- lab180:
- //log sdkscaddr
- //log scstk
- lm dataloc, jmptablesize, "jmptable.bin"
- mov tmp9, dataloc
- lab181:
- mov tmp2, [tmp9]
- cmp tmp2, 0
- je error
- mov tmp3, [tmp9+4]
- add tmp3, imgbase
- mov tmp4, [tmp3+1]
- add tmp4, tmp3
- add tmp4, 5
- cmp tmp4, sdkscaddr
- je lab182
- add tmp9, tmp2
- add tmp9, 04
- jmp lab181
- lab182:
- mov tmp6, [tmp9] //length
- add tmp9, 04
- mov tmp5, dataloc
- add tmp5, 800
- lab183:
- cmp tmp6, 0
- je lab189
- mov tmp2, [tmp9]
- mov [tmp5], tmp2
- add tmp9, 4
- add tmp5, 4
- sub tmp6, 4
- jmp lab183
- lab189:
- mov tmp1, freeloc
- mov [tmp1], #609CBE0000BE01BB00004000B900906A008B0683F800741603C38B560403D18BFA2BF883EF0589780183C608EBE39D61#
- add tmp1, 30
- mov [tmp1], #90909000#
- mov tmp1, freeloc
- add tmp1, 3 //3
- mov tmp3, dataloc
- add tmp3, 800
- mov [tmp1], tmp3
- add tmp1, 5 //8
- mov [tmp1], imgbase
- add tmp1, 5 //0D
- mov [tmp1], virzeroVA
- add tmp1, 23 //30 -- end point
- mov tmp7, eip
- mov eip, freeloc
- bp tmp1
- run
- cmp eip, tmp1
- jne error
- bc tmp1
- mov eip, tmp7
- fill freeloc, 100, 00
- fill dataloc, 1000, 00
- lab190:
- scmp caller1, "lab111"
- je lab113
- scmp caller1, "lab134"
- je lab135
- scmp caller1, "lab139"
- je lab140
- error:
- msg "Error!"
- pause
- jmp end
- wrongver:
- find dllimgbase, #0038310D0A#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je wrongver_1
- msg "Unsupported Aspr version, probably packed with Aspr v1.31 or v2.0 alpha"
- pause
- jmp end
- wrongver_1:
- find dllimgbase, #0031350D0A#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je wrongver_2
- msg "Unsupported Aspr version, probably packed with Aspr v1.2x"
- pause
- jmp end
- wrongver_2:
- msg "Unsupported Aspr version or it is not packed with Aspr?"
- pause
- jmp end
- error45:
- msg "Error 45!"
- pause
- jmp end
- odbgver:
- msg "This script work with ODbgscript 1.64 or above"
- jmp end
- notfound:
- msg "Not found"
- pause
- jmp end
- patcherr:
- msg "Something error while trying to analyse stolen code"
- pause
- end:
- ret
- //
- //
- //
- //
- ChkRelocSize:
- find tmp1, #0000000000000000#
- mov tmp2, $RESULT
- sub tmp2, imgbase
- sub tmp2, reloc_rva
- mov tmp3, tmp2
- and tmp3, 0F
- mov tmp4, tmp3
- shr tmp4, 2
- shl tmp4, 2
- cmp tmp4, tmp3
- je ChkRelocSize_1
- add tmp2, 2
- ChkRelocSize_1:
- ret
- FindEMUAddr:
- //find freespace
- cob
- coe
- mov tmp1, freeloc
- mov [tmp1], #609CB900040000B800000000BF90909000FDF3AFE30383C70483C704893D3000C9009D61909090000000000000000000#
- add tmp1, D //0D
- mov tmp2, 1stsecbase
- add tmp2, 1stsecsize
- sub tmp2, 4
- mov [tmp1], tmp2
- add tmp1, 11 //1E
- mov tmp2, freeloc
- add tmp2, 30
- mov [tmp1], tmp2
- add tmp1, 6 //24 -- end point
- bp tmp1
- mov tmp3, eip
- mov eip, freeloc
- run
- cmp eip, tmp1
- jne error
- bc tmp1
- mov eip, tmp3
- mov tmp2, [freeloc+30]
- mov tmp3, tmp2
- and tmp3, 0f
- mov tmp4, 10
- sub tmp4, tmp3
- add tmp2, tmp4
- add tmp2, 10
- mov EmuAddr, tmp2
- //log EmuAddr
- fill freeloc, 34, 00
- mov tmp1, 1stsecbase
- add tmp1, 1stsecsize
- cmp EmuAddr, tmp1
- jae FindEMUAddr_3
- sub tmp1, tmp2
- cmp tmp1, count //freespace compare with count bytes (2.xx=120 bytes, 1.3x=40 bytes)
- jae FindEMUAddr_6
- FindEMUAddr_3:
- cmp isdll, 1
- je FindEMUAddr_4
- mov tmp1, imgbase
- add tmp1, 0D00
- mov EmuAddr, tmp1
- jmp FindEMUAddr_6
- FindEMUAddr_4:
- ask "Freespace less than 120 bytes, enter freespace for Asprotect API emualtion code"
- cmp $RESULT, 0
- je error
- mov EmuAddr, $RESULT
- cmp EmuAddr, 1stsecbase
- jb FindEMUAddr_5
- mov tmp1, lastsecbase
- add tmp1, lastsecsize
- cmp tmp1, EmuAddr
- jb FindEMUAddr_5
- //log EmuAddr
- jmp FindEMUAddr_6
- FindEMUAddr_5:
- msg "Can not use this address"
- jmp FindEMUAddr_4
- FindEMUAddr_6:
- mov count, 0 //clear
- ret
- FillSCPatch:
- mov tmp1, freeloc
- mov [tmp1], #6083EC60BD000D5901BB000660018B43188945A4C745A8000859018B7DA4803FE875188B4F0103CF83C1053B4B1C750B#
- add tmp1, 30 //30
- mov [tmp1], #8B75A8893E83C6048975A847897DA481FFA4337B027402EBD290909090909090C745A400000000C745A800085901C745#
- add tmp1, 30 //60
- mov [tmp1], #AC10347B02BB000660018B75A88B368B45A48B4B6CF7E18B4B3003C833C08A43268B7C83408BC1FFD78BF833C08A4327#
- add tmp1, 30 //90
- mov [tmp1], #8B5483408BC1FFD28945F433C08A43258B5483408BC1FFD284C00F841D000000FEC80F8478000000FEC80F84B0000000#
- add tmp1, 30 //C0
- mov [tmp1], #FEC80F8478010000E9130700008B4EFCC606E92BCE83E905894E018B436803F8837B74017503037B70897DF0837DF0FF#
- add tmp1, 30 //F0
- mov [tmp1], #75110345F4034310837B74017503034370EB0B8B45F0E8D9060000034310C646FBE88D4EFB2BC183E8058946FC8B45A0#
- add tmp1, 30 //120
- mov [tmp1], #89088345A004E9950600009090909090C606E98B436803F8837B74017503037B70897DF0837DF0FF75080345F4034310#
- add tmp1, 30 //150
- mov [tmp1], #EB0E8B43180345F02BC683E805894601E95B0600009090909090909090909090E8230000008B459CC700020000008345#
- add tmp1, 30 //180
- mov [tmp1], #9C048BD6E81F000000E82A000000E92D06000090909090908B55AC2BD683EA05C606E9895601C390522B53188B459C89#
- add tmp1, 30 //1B0
- mov [tmp1], #1083459C045AC39033C08A43288B5483408BC1FFD2837B7401750733D28A537032C2E8B905000086E0050F8000008B4D#
- add tmp1, 30 //1E0
- mov [tmp1], #AC6689018B43180345F4034368837B740175030343708BD0E8ABFFFFFF2BD183EA0689510283C106037B18037B68837B#
- add tmp1, 30 //210
- mov [tmp1], #74017503037B70C601E98BD7E887FFFFFF2BD183EA0589510183C1053E894DACC3909090909090909090909090909090#
- add tmp1, 30 //240
- mov [tmp1], #E853FFFFFF8B459CC700030000008345#
- add tmp1, 10 //250
- mov [tmp1], #9C048BD6E84FFFFFFF909090909033C08945B08945B48945B88945BC8A432B8B5483408BC1FFD2837B740175032B4370#
- add tmp1, 30 //280
- mov [tmp1], #8945B033C08A43298B5483408BC1FFD28BD080EA080F92C280FA01750B3E8945B0C745B40100000033C08A432C8B548340#
- add tmp1, 31 //2B1
- mov [tmp1], #8BC1FFD2837B740175032B43708945B833C08A432A8B5483408BC1FFD28BD080EA080F92C280FA01750B3E8945B8C745BC0100000033C08A432D8B5483408BC1#
- add tmp1, 40 //2F1
- mov [tmp1], #FFD285C00F8425000000480F848E010000480F8427020000480F8440030000480F84E9030000E9C404000090909090#
- add tmp1, 2F //320
- mov [tmp1], #51538B4DAC837DB4010F85B8000000837DBC017547B83900000033D23E8A55B8C0E2033E0255B086F203C2807DB00474#
- add tmp1, 30 //350
- mov [tmp1], #0E807DB005741166890183C102EB18668901C6410224EB0C0500400000668901C641020083C103E9CA0000003E8B55B8#
- add tmp1, 30 //380
- mov [tmp1], #81FA800000007307B883380000EB05B88138000033D23E8A55B086F203C2807DB004740E807DB005741466890183C102#
- add tmp1, 30 //3B0
- mov [tmp1], #EB1B668901C641022483C103EB0F0500400000668901C641020083C1033E8B55B881FA800000007307881183C101EB66#
- add tmp1, 30 //3E0
- mov [tmp1], #891183C104EB5F837DBC017521B83905000033D23E8A55B8C0E20386F203C26689013E8B55B089510283C106EB383E8B#
- add tmp1, 30 //410
- mov [tmp1], #55B881FA800000007317B8833D00006689013E8B45B089410288510683C107EB15B8813D00006689013E8B45B0894102#
- add tmp1, 30 //440
- mov [tmp1], #89510683C10A894DACE9320300009090#
- add tmp1, 50 //490
- mov [tmp1], #51538B4DAC837DB4010F854103000083#
- add tmp1, 10 //4A0
- mov [tmp1], #7DBC017544B83B00000033D23E8A55B0C0E2033E0255B886F203C2807DB804740E807DB805741166890183C102EB3966#
- add tmp1, 30 //4D0
- mov [tmp1], #8901C6410224EB0C0500400000668901C641020083C103EB1FB83B05000033D23E8A55B0C0E20386F203C26689013E8B#
- add tmp1, 30 //500
- mov [tmp1], #55B889510283C106894DACE970020000#
- add tmp1, 30 //530
- mov [tmp1], #51538B4DAC837DB4010F859F000000837DBC017551807DB005742AB83800000033D23E8A55B8C0E2033E0255B086F203#
- add tmp1, 30 //560
- mov [tmp1], #C266890183C102807DB0047524C6012483C101EB1CB83845000033D23E8A55B8C0E20386F203C2668901C641020083C1#
- add tmp1, 30 //590
- mov [tmp1], #03E983000000807DB0047423807DB005742BB88038000033D23E8A55B086F203C26689018B55B888510283C103EB5AC7#
- add tmp1, 30 //5C0
- mov [tmp1], #01833C24008A55B8885103EB0CC701837D00008A55B888510383C104EB3B837DBC017521B83805000033D23E8A55B8C0#
- add tmp1, 30 //5F0
- mov [tmp1], #E20386F203C26689013E8B55B089510283C106EB1466C701803D8B55B08951028A45B888410683C107894DACE95F0100#
- add tmp1, 30 //620
- mov [tmp1], #009000#
- add tmp1, 30 //650
- mov [tmp1], #51538B4DAC837DB4010F8581010000837DBC017544B83A00000033D23E8A55B0C0E2033E0255B886F203C2807DB80474#
- add tmp1, 30 //680
- mov [tmp1], #0E807DB805741166890183C102EB39668901C6410224EB0C0500400000668901C641020083C103EB1FB83A05000033D2#
- add tmp1, 30 //6B0
- mov [tmp1], #3E8A55B0C0E20386F203C26689013E8B55B889510283C106894DACE9B0000000#
- add tmp1, 50 //700
- mov [tmp1], #5153837DB4010F85D4000000837DBC017524B83BC0000033D23E8A55B0C0E2033E0255B886F203C28B4DAC66890183C1#
- add tmp1, 30 //730
- mov [tmp1], #02894DACEB22B881F8000033D23E8A55B086F203C28B4DAC6689013E8B55B889510283C106894DACEB26000000000000#
- add tmp1, 50 //780
- mov [tmp1], #5B59E831FAFFFFEB37909090909090903C06740E3C07740E3C0A740E3C0B740EEB0EB00AEB0AB00BEB06B006EB02B007C3909090909090909090909090909090#
- add tmp1, 40 //7C0
- mov [tmp1], #FF45A48345A8048B45A88B0083F8000F8590F8FFFF83C460619090909090909090909090BFD7397A01B9FFFFFFFFF2AF81FF4F3A7A0177E88B47F8C390909090#
- //chk version
- FillSCP1:
- find dllimgbase, #8B5482408BC6FFD22C#
- mov tmp1, $RESULT
- cmp tmp1, 0
- je FillSCP2
- add tmp1, 9
- mov tmp2, [tmp1], 1
- cmp tmp2, 2
- je FillSCP3
- cmp tmp2, 1
- jne patcherr
- mov tmp1, freeloc
- add tmp1, AC //AC
- mov [tmp1], #9001#
- add tmp1, 8 //B4
- mov [tmp1], #15#
- add tmp1, 8 //BC
- mov [tmp1], #70#
- add tmp1, 8 //C4
- mov [tmp1], #A800#
- add tmp1, 233 //2F7
- mov [tmp1], #0504#
- add tmp1, 7 //2FE
- mov [tmp1], #1E00#
- add tmp1, 7 //305
- mov [tmp1], #8701#
- add tmp1, 7 //30C
- mov [tmp1], #2002#
- add tmp1, 7 //313
- mov [tmp1], #3903#
- jmp FillSCP3
- //resolve vm code in aspr dll
- FillSCP2:
- //alloc 10000
- //mov VMcodeloc, $RESULT
- //log VMcodeloc
- //lm VMcodeloc, 4000, "d:\Asprvm8s.bin"
- FillSCP3:
- ret
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement